@atlasauth/backend 0.23.0 → 0.25.0

package/dist/client/vault.js

@@ -0,0 +1,50 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.vaultResource = vaultResource;
+const enc = encodeURIComponent;
+function vaultResource(request) {
+    return {
+        create(body, idempotencyKey) {
+            return request({ method: 'POST', path: '/v1/vault/objects', body, idempotencyKey });
+        },
+        /** Metadata only, newest first. */
+        list(params = {}) {
+            const { key_context, ...rest } = params;
+            return request({
+                method: 'GET',
+                path: '/v1/vault/objects',
+                query: { ...rest, ...(key_context ? { key_context: JSON.stringify(key_context) } : {}) },
+            });
+        },
+        /** The decrypted value of the current version, or of `version`. Audited. */
+        read(id, version) {
+            return request({ method: 'GET', path: `/v1/vault/objects/${enc(id)}`, query: version ? { version } : undefined });
+        },
+        metadata(id) {
+            return request({ method: 'GET', path: `/v1/vault/objects/${enc(id)}/metadata` });
+        },
+        versions(id) {
+            return request({ method: 'GET', path: `/v1/vault/objects/${enc(id)}/versions` });
+        },
+        /** Append a version. Pass `version_check` (the version you read) to fail with 409 on a concurrent update. */
+        update(id, body) {
+            return request({ method: 'PUT', path: `/v1/vault/objects/${enc(id)}`, body });
+        },
+        delete(id) {
+            return request({ method: 'DELETE', path: `/v1/vault/objects/${enc(id)}` });
+        },
+        /** Bring your own AWS KMS, Google Cloud KMS or Azure Key Vault key for new versions. */
+        keyProvider: {
+            get() {
+                return request({ method: 'GET', path: '/v1/vault/key_provider' });
+            },
+            set(body) {
+                return request({ method: 'PUT', path: '/v1/vault/key_provider', body });
+            },
+            remove() {
+                return request({ method: 'DELETE', path: '/v1/vault/key_provider' });
+            },
+        },
+    };
+}
+//# sourceMappingURL=vault.js.map

package/dist/client/vault.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"vault.js","sourceRoot":"","sources":["../../src/client/vault.ts"],"names":[],"mappings":";;AAgEA,sCA4CC;AAzGD,MAAM,GAAG,GAAG,kBAAkB,CAAC;AA6D/B,SAAgB,aAAa,CAAC,OAAkB;IAC9C,OAAO;QACL,MAAM,CAAC,IAA2B,EAAE,cAAuB;YACzD,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,mBAAmB,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC;QACtF,CAAC;QACD,mCAAmC;QACnC,IAAI,CAAC,SAAiC,EAAE;YACtC,MAAM,EAAE,WAAW,EAAE,GAAG,IAAI,EAAE,GAAG,MAAM,CAAC;YACxC,OAAO,OAAO,CAAC;gBACb,MAAM,EAAE,KAAK;gBACb,IAAI,EAAE,mBAAmB;gBACzB,KAAK,EAAE,EAAE,GAAG,IAAI,EAAE,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,IAAI,CAAC,SAAS,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE;aACzF,CAAC,CAAC;QACL,CAAC;QACD,4EAA4E;QAC5E,IAAI,CAAC,EAAU,EAAE,OAAgB;YAC/B,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,qBAAqB,GAAG,CAAC,EAAE,CAAC,EAAE,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC;QACpH,CAAC;QACD,QAAQ,CAAC,EAAU;YACjB,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,qBAAqB,GAAG,CAAC,EAAE,CAAC,WAAW,EAAE,CAAC,CAAC;QACnF,CAAC;QACD,QAAQ,CAAC,EAAU;YACjB,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,qBAAqB,GAAG,CAAC,EAAE,CAAC,WAAW,EAAE,CAAC,CAAC;QACnF,CAAC;QACD,6GAA6G;QAC7G,MAAM,CAAC,EAAU,EAAE,IAA+C;YAChE,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,qBAAqB,GAAG,CAAC,EAAE,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;QAChF,CAAC;QACD,MAAM,CAAC,EAAU;YACf,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,qBAAqB,GAAG,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;QAC7E,CAAC;QACD,wFAAwF;QACxF,WAAW,EAAE;YACX,GAAG;gBACD,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,wBAAwB,EAAE,CAAC,CAAC;YACpE,CAAC;YACD,GAAG,CAAC,IAA6B;gBAC/B,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,wBAAwB,EAAE,IAAI,EAAE,CAAC,CAAC;YAC1E,CAAC;YACD,MAAM;gBACJ,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,wBAAwB,EAAE,CAAC,CAAC;YACvE,CAAC;SACF;KACF,CAAC;AACJ,CAAC"}

package/dist/client/vc.d.ts

@@ -0,0 +1,128 @@
+import { type RequestFn } from './request';
+import type { ListPage } from './types';
+export interface VcClaimMapping {
+    name: string;
+    /** user_id | email | first_name | last_name | username | public_metadata.<key> */
+    source: string;
+    /** Selectively disclosable (default true; SD-JWT VC only). */
+    disclosable?: boolean;
+    /** Typing of the value; full-date is YYYY-MM-DD (an mdoc full-date). */
+    value_type?: 'string' | 'number' | 'boolean' | 'full-date';
+}
+export interface VcCredentialType {
+    object: 'vc_credential_type';
+    id: string;
+    /** The vct, or the docType for mso_mdoc. */
+    vct: string;
+    format: VcFormat;
+    namespace: string | null;
+    /** mdoc: PEM IACA roots a presentation must chain to. */
+    iaca_roots: string[];
+    /** mdoc: PEM Document Signer chain published as x5chain. */
+    signer_chain: string[];
+    name: string;
+    claims: VcClaimMapping[];
+    lifetime_seconds: number;
+    require_wallet_attestation: boolean;
+    created_at: number;
+}
+export type VcFormat = 'dc+sd-jwt' | 'mso_mdoc';
+export interface CreateVcCredentialTypeBody {
+    /** The vct, or the docType for mso_mdoc (for example org.iso.18013.5.1.mDL). */
+    vct: string;
+    format?: VcFormat;
+    /** mso_mdoc: the namespace of the claims (default the docType). */
+    namespace?: string;
+    /** mso_mdoc: PEM IACA roots (ISO 18013-5 Annex B); with roots set only a certificate chain is accepted. */
+    iaca_roots?: string[];
+    /** mso_mdoc: PEM Document Signer certificate (then intermediates) for the instance's mdoc signing key. */
+    signer_chain?: string[];
+    name: string;
+    claims: VcClaimMapping[];
+    lifetime_seconds?: number;
+    require_wallet_attestation?: boolean;
+    wallet_attestation_jwks?: {
+        keys: Record<string, unknown>[];
+    };
+}
+export interface VcOffer {
+    object: 'vc_offer';
+    id: string;
+    expires_at: number;
+    credential_offer: Record<string, unknown>;
+    /** The openid-credential-offer:// link for a QR code. Shown once. */
+    credential_offer_uri: string;
+}
+export interface VcCredential {
+    object: 'vc_credential';
+    id: string;
+    credential_type_id: string;
+    user_id: string;
+    status_idx: number;
+    issued_at: number;
+    expires_at: number;
+    revoked_at: number | null;
+}
+export interface VcPresentationRequest {
+    object: 'vc_presentation_request';
+    id: string;
+    vct: string;
+    format: VcFormat;
+    iaca_roots: string[];
+    claims: string[];
+    status: 'pending' | 'verified' | 'failed';
+    result: {
+        issuer: string;
+        vct: string;
+        claims: Record<string, unknown>;
+    } | null;
+    error: string | null;
+    /** Set when the credential was issued by this instance. */
+    user_id: string | null;
+    expires_at: number;
+    request_uri: string;
+    /** The openid4vp:// link for a QR code. */
+    authorization_request_uri: string;
+}
+/** Issue verifiable credentials to wallets (OpenID4VCI) and verify presentations (OpenID4VP), SD-JWT VC. */
+export declare function vcResource(request: RequestFn): {
+    credentialTypes: {
+        list(): Promise<ListPage<VcCredentialType>>;
+        create(body: CreateVcCredentialTypeBody): Promise<VcCredentialType>;
+        get(id: string): Promise<VcCredentialType>;
+        delete(id: string): Promise<{
+            object: "vc_credential_type";
+            id: string;
+            deleted: true;
+        }>;
+    };
+    createOffer(body: {
+        credential_type_id: string;
+        user_id: string;
+        tx_code?: string;
+        expires_in_seconds?: number;
+    }): Promise<VcOffer>;
+    credentials: {
+        list(query?: {
+            user_id?: string;
+        }): Promise<ListPage<VcCredential>>;
+        revoke(id: string): Promise<VcCredential>;
+    };
+    presentationRequests: {
+        create(body: {
+            vct: string;
+            format?: VcFormat;
+            /** mso_mdoc: PEM IACA roots for this request. */
+            iaca_roots?: string[];
+            claims?: string[];
+            trusted_issuers?: Array<{
+                issuer: string;
+                jwks: {
+                    keys: Record<string, unknown>[];
+                };
+            }>;
+            expires_in_seconds?: number;
+        }): Promise<VcPresentationRequest>;
+        get(id: string): Promise<VcPresentationRequest>;
+    };
+};

package/dist/client/vc.js

@@ -0,0 +1,43 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.vcResource = vcResource;
+const request_1 = require("./request");
+/** Issue verifiable credentials to wallets (OpenID4VCI) and verify presentations (OpenID4VP), SD-JWT VC. */
+function vcResource(request) {
+    return {
+        credentialTypes: {
+            list() {
+                return request({ method: 'GET', path: '/v1/vc/credential_types' });
+            },
+            create(body) {
+                return request({ method: 'POST', path: '/v1/vc/credential_types', body });
+            },
+            get(id) {
+                return request({ method: 'GET', path: `/v1/vc/credential_types/${(0, request_1.enc)(id)}` });
+            },
+            delete(id) {
+                return request({ method: 'DELETE', path: `/v1/vc/credential_types/${(0, request_1.enc)(id)}` });
+            },
+        },
+        createOffer(body) {
+            return request({ method: 'POST', path: '/v1/vc/offers', body });
+        },
+        credentials: {
+            list(query = {}) {
+                return request({ method: 'GET', path: '/v1/vc/credentials', query: { ...query } });
+            },
+            revoke(id) {
+                return request({ method: 'POST', path: `/v1/vc/credentials/${(0, request_1.enc)(id)}/revoke` });
+            },
+        },
+        presentationRequests: {
+            create(body) {
+                return request({ method: 'POST', path: '/v1/vc/presentation_requests', body });
+            },
+            get(id) {
+                return request({ method: 'GET', path: `/v1/vc/presentation_requests/${(0, request_1.enc)(id)}` });
+            },
+        },
+    };
+}
+//# sourceMappingURL=vc.js.map

package/dist/client/vc.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"vc.js","sourceRoot":"","sources":["../../src/client/vc.ts"],"names":[],"mappings":";;AAyFA,gCA4CC;AArID,uCAAgD;AAwFhD,4GAA4G;AAC5G,SAAgB,UAAU,CAAC,OAAkB;IAC3C,OAAO;QACL,eAAe,EAAE;YACf,IAAI;gBACF,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,yBAAyB,EAAE,CAAC,CAAC;YACrE,CAAC;YACD,MAAM,CAAC,IAAgC;gBACrC,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,yBAAyB,EAAE,IAAI,EAAE,CAAC,CAAC;YAC5E,CAAC;YACD,GAAG,CAAC,EAAU;gBACZ,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,2BAA2B,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;YAChF,CAAC;YACD,MAAM,CAAC,EAAU;gBACf,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,2BAA2B,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;YACnF,CAAC;SACF;QACD,WAAW,CAAC,IAAoG;YAC9G,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,eAAe,EAAE,IAAI,EAAE,CAAC,CAAC;QAClE,CAAC;QACD,WAAW,EAAE;YACX,IAAI,CAAC,QAA8B,EAAE;gBACnC,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,oBAAoB,EAAE,KAAK,EAAE,EAAE,GAAG,KAAK,EAAE,EAAE,CAAC,CAAC;YACrF,CAAC;YACD,MAAM,CAAC,EAAU;gBACf,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,sBAAsB,IAAA,aAAG,EAAC,EAAE,CAAC,SAAS,EAAE,CAAC,CAAC;YACnF,CAAC;SACF;QACD,oBAAoB,EAAE;YACpB,MAAM,CAAC,IAQN;gBACC,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,8BAA8B,EAAE,IAAI,EAAE,CAAC,CAAC;YACjF,CAAC;YACD,GAAG,CAAC,EAAU;gBACZ,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,gCAAgC,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;YACrF,CAAC;SACF;KACF,CAAC;AACJ,CAAC"}

package/dist/client/webhooks.d.ts

@@ -1,6 +1,6 @@
 import { type ProvisioningFields, type ProvisioningInput, type ProvisioningMetadata } from './compliance';
 import { type RequestFn } from './request';
-export type WebhookDestinationType = 'https' | 'aws_eventbridge' | 'gcp_pubsub' | 'cloudflare_queue';
+export type WebhookDestinationType = 'https' | 'aws_eventbridge' | 'gcp_pubsub' | 'cloudflare_queue' | 'segment' | 'ga4' | 'mixpanel' | 'posthog' | 'amplitude' | 'customerio' | 'slack';
 /** Where deliveries go. Credentials are never returned. */
 export type WebhookDestination = {
     type: 'https';
@@ -17,7 +17,21 @@ export type WebhookDestination = {
     type: 'cloudflare_queue';
     account_id: string;
     queue_id: string;
-};
+} | ({
+    type: 'segment' | 'mixpanel' | 'posthog' | 'amplitude' | 'customerio';
+    region?: 'us' | 'eu';
+} & AnalyticsOptions) | ({
+    type: 'ga4';
+    measurement_id: string;
+} & AnalyticsOptions) | ({
+    type: 'slack';
+} & AnalyticsOptions);
+/** Shared by the analytics and messaging destinations: person-identifying fields are dropped unless `include_pii`. */
+export interface AnalyticsOptions {
+    include_pii?: boolean;
+    /** Rename events: `{ 'user.created': 'Signed Up' }`. */
+    event_map?: Record<string, string>;
+}
 /** Your own credentials for an event destination (stored encrypted, write-only). */
 export type WebhookDestinationCredentials = {
     access_key_id: string;
@@ -27,6 +41,21 @@ export type WebhookDestinationCredentials = {
     service_account_json: string | Record<string, unknown>;
 } | {
     api_token: string;
+} | {
+    write_key: string;
+} | {
+    api_secret: string;
+} | {
+    project_token: string;
+} | {
+    project_api_key: string;
+} | {
+    api_key: string;
+} | {
+    site_id: string;
+    api_key: string;
+} | {
+    webhook_url: string;
 };
 export interface WebhookLastFailure {
     at: number;

package/dist/client/webhooks.js.map

@@ -1 +1 @@
-{"version":3,"file":"webhooks.js","sourceRoot":"","sources":["../../src/client/webhooks.ts"],"names":[],"mappings":";;AAsTA,4CA+HC;AArbD,6CAAyH;AACzH,uCAAgD;AAqThD,SAAgB,gBAAgB,CAAC,OAAkB;IACjD,OAAO;QACL,SAAS,EAAE;YACT,gFAAgF;YAChF,wEAAwE;YACxE,IAAI,CAAC,OAAyE,EAAE;gBAC9E,OAAO,OAAO,CAAC;oBACb,MAAM,EAAE,KAAK;oBACb,IAAI,EAAE,uBAAuB;oBAC7B,KAAK,EAAE,EAAE,GAAG,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC,CAAC,EAAE,kBAAkB,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,GAAG,IAAA,0BAAa,EAAC,IAAI,CAAC,QAAQ,CAAC,EAAE;iBAC9G,CAAC,CAAC;YACL,CAAC;YACD,GAAG,CAAC,EAAU;gBACZ,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,yBAAyB,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;YAC9E,CAAC;YACD;;;eAGG;YACH,WAAW,CACT,IAA+B,EAC/B,cAAuB;gBAEvB,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,8BAA8B,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC;YAChG,CAAC;YACD,wEAAwE;YACxE,MAAM,CAAC,EAAU,EAAE,IAA+B;gBAChD,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,yBAAyB,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;YACtF,CAAC;YACD,sDAAsD;YACtD,YAAY,CAAC,EAAU;gBACrB,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,yBAAyB,IAAA,aAAG,EAAC,EAAE,CAAC,gBAAgB,EAAE,CAAC,CAAC;YAC7F,CAAC;YACD;;;;eAIG;YACH,YAAY,CAAC,EAAU,EAAE,IAA8B;gBACrD,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,yBAAyB,IAAA,aAAG,EAAC,EAAE,CAAC,gBAAgB,EAAE,IAAI,EAAE,CAAC,CAAC;YACnG,CAAC;YACD,2FAA2F;YAC3F,IAAI,CAAC,EAAU;gBACb,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,yBAAyB,IAAA,aAAG,EAAC,EAAE,CAAC,OAAO,EAAE,CAAC,CAAC;YACpF,CAAC;YACD;;;;eAIG;YACH,OAAO,CAAC,EAAU,EAAE,OAAe,KAAK;gBACtC,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,yBAAyB,IAAA,aAAG,EAAC,EAAE,CAAC,OAAO,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC;YACrG,CAAC;YACD,mGAAmG;YACnG,eAAe,CACb,EAAU,EACV,OAA0D,EAAE,EAC5D,cAAuB;gBAEvB,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,yBAAyB,IAAA,aAAG,EAAC,EAAE,CAAC,YAAY,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC;YAC/G,CAAC;YACD,wFAAwF;YACxF,MAAM,CACJ,EAAU,EACV,IAAqE,EACrE,cAAuB;gBAEvB,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,yBAAyB,IAAA,aAAG,EAAC,EAAE,CAAC,SAAS,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC;YAC5G,CAAC;YACD,+EAA+E;YAC/E,SAAS,CAAC,EAAU,EAAE,UAAkB;gBACtC,OAAO,OAAO,CAAC;oBACb,MAAM,EAAE,MAAM;oBACd,IAAI,EAAE,yBAAyB,IAAA,aAAG,EAAC,EAAE,CAAC,eAAe,IAAA,aAAG,EAAC,UAAU,CAAC,YAAY;iBACjF,CAAC,CAAC;YACL,CAAC;YACD,MAAM,CACJ,IAA+B,EAC/B,cAAuB;gBAEvB,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,uBAAuB,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC;YAC1F,CAAC;YACD,MAAM,CACJ,EAAU;gBAEV,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,yBAAyB,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;YACjF,CAAC;SACF;QACD,oCAAoC;QACpC,UAAU,CACR,EAAU,EACV,SAAsC,EAAE;YAExC,OAAO,OAAO,CAAC;gBACb,MAAM,EAAE,KAAK;gBACb,IAAI,EAAE,yBAAyB,IAAA,aAAG,EAAC,EAAE,CAAC,aAAa;gBACnD,KAAK,EAAE,EAAE,GAAG,MAAM,EAAE;aACrB,CAAC,CAAC;QACL,CAAC;QACD,oDAAoD;QACpD,SAAS;YACP,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,qBAAqB,EAAE,CAAC,CAAC;QACjE,CAAC;QACD,sHAAsH;QACtH,MAAM,CAAC,SAAqE,EAAE;YAK5E,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,qBAAqB,EAAE,KAAK,EAAE,EAAE,GAAG,MAAM,EAAE,EAAE,CAAC,CAAC;QACvF,CAAC;QACD,4EAA4E;QAC5E,gBAAgB,CAAC,IAAwB,EAAE,QAAgB,EAAE,aAA8B;YACzF,OAAO,OAAO,CAAC;gBACb,MAAM,EAAE,KAAK;gBACb,IAAI,EAAE,uBAAuB,IAAA,aAAG,EAAC,IAAI,CAAC,IAAI,IAAA,aAAG,EAAC,QAAQ,CAAC,iBAAiB;gBACxE,IAAI,EAAE,EAAE,cAAc,EAAE,aAAa,EAAE;aACxC,CAAC,CAAC;QACL,CAAC;QACD,8DAA8D;QAC9D,SAAS,CAAC,UAAkB,EAAE,UAAkB;YAC9C,OAAO,OAAO,CAAC;gBACb,MAAM,EAAE,MAAM;gBACd,IAAI,EAAE,yBAAyB,IAAA,aAAG,EAAC,UAAU,CAAC,eAAe,IAAA,aAAG,EAAC,UAAU,CAAC,YAAY;aACzF,CAAC,CAAC;QACL,CAAC;KACF,CAAC;AACJ,CAAC"}
+{"version":3,"file":"webhooks.js","sourceRoot":"","sources":["../../src/client/webhooks.ts"],"names":[],"mappings":";;AAuUA,4CA+HC;AAtcD,6CAAyH;AACzH,uCAAgD;AAsUhD,SAAgB,gBAAgB,CAAC,OAAkB;IACjD,OAAO;QACL,SAAS,EAAE;YACT,gFAAgF;YAChF,wEAAwE;YACxE,IAAI,CAAC,OAAyE,EAAE;gBAC9E,OAAO,OAAO,CAAC;oBACb,MAAM,EAAE,KAAK;oBACb,IAAI,EAAE,uBAAuB;oBAC7B,KAAK,EAAE,EAAE,GAAG,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC,CAAC,EAAE,kBAAkB,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,GAAG,IAAA,0BAAa,EAAC,IAAI,CAAC,QAAQ,CAAC,EAAE;iBAC9G,CAAC,CAAC;YACL,CAAC;YACD,GAAG,CAAC,EAAU;gBACZ,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,yBAAyB,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;YAC9E,CAAC;YACD;;;eAGG;YACH,WAAW,CACT,IAA+B,EAC/B,cAAuB;gBAEvB,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,8BAA8B,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC;YAChG,CAAC;YACD,wEAAwE;YACxE,MAAM,CAAC,EAAU,EAAE,IAA+B;gBAChD,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,yBAAyB,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;YACtF,CAAC;YACD,sDAAsD;YACtD,YAAY,CAAC,EAAU;gBACrB,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,yBAAyB,IAAA,aAAG,EAAC,EAAE,CAAC,gBAAgB,EAAE,CAAC,CAAC;YAC7F,CAAC;YACD;;;;eAIG;YACH,YAAY,CAAC,EAAU,EAAE,IAA8B;gBACrD,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,yBAAyB,IAAA,aAAG,EAAC,EAAE,CAAC,gBAAgB,EAAE,IAAI,EAAE,CAAC,CAAC;YACnG,CAAC;YACD,2FAA2F;YAC3F,IAAI,CAAC,EAAU;gBACb,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,yBAAyB,IAAA,aAAG,EAAC,EAAE,CAAC,OAAO,EAAE,CAAC,CAAC;YACpF,CAAC;YACD;;;;eAIG;YACH,OAAO,CAAC,EAAU,EAAE,OAAe,KAAK;gBACtC,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,yBAAyB,IAAA,aAAG,EAAC,EAAE,CAAC,OAAO,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC;YACrG,CAAC;YACD,mGAAmG;YACnG,eAAe,CACb,EAAU,EACV,OAA0D,EAAE,EAC5D,cAAuB;gBAEvB,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,yBAAyB,IAAA,aAAG,EAAC,EAAE,CAAC,YAAY,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC;YAC/G,CAAC;YACD,wFAAwF;YACxF,MAAM,CACJ,EAAU,EACV,IAAqE,EACrE,cAAuB;gBAEvB,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,yBAAyB,IAAA,aAAG,EAAC,EAAE,CAAC,SAAS,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC;YAC5G,CAAC;YACD,+EAA+E;YAC/E,SAAS,CAAC,EAAU,EAAE,UAAkB;gBACtC,OAAO,OAAO,CAAC;oBACb,MAAM,EAAE,MAAM;oBACd,IAAI,EAAE,yBAAyB,IAAA,aAAG,EAAC,EAAE,CAAC,eAAe,IAAA,aAAG,EAAC,UAAU,CAAC,YAAY;iBACjF,CAAC,CAAC;YACL,CAAC;YACD,MAAM,CACJ,IAA+B,EAC/B,cAAuB;gBAEvB,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,uBAAuB,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC;YAC1F,CAAC;YACD,MAAM,CACJ,EAAU;gBAEV,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,yBAAyB,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;YACjF,CAAC;SACF;QACD,oCAAoC;QACpC,UAAU,CACR,EAAU,EACV,SAAsC,EAAE;YAExC,OAAO,OAAO,CAAC;gBACb,MAAM,EAAE,KAAK;gBACb,IAAI,EAAE,yBAAyB,IAAA,aAAG,EAAC,EAAE,CAAC,aAAa;gBACnD,KAAK,EAAE,EAAE,GAAG,MAAM,EAAE;aACrB,CAAC,CAAC;QACL,CAAC;QACD,oDAAoD;QACpD,SAAS;YACP,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,qBAAqB,EAAE,CAAC,CAAC;QACjE,CAAC;QACD,sHAAsH;QACtH,MAAM,CAAC,SAAqE,EAAE;YAK5E,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,qBAAqB,EAAE,KAAK,EAAE,EAAE,GAAG,MAAM,EAAE,EAAE,CAAC,CAAC;QACvF,CAAC;QACD,4EAA4E;QAC5E,gBAAgB,CAAC,IAAwB,EAAE,QAAgB,EAAE,aAA8B;YACzF,OAAO,OAAO,CAAC;gBACb,MAAM,EAAE,KAAK;gBACb,IAAI,EAAE,uBAAuB,IAAA,aAAG,EAAC,IAAI,CAAC,IAAI,IAAA,aAAG,EAAC,QAAQ,CAAC,iBAAiB;gBACxE,IAAI,EAAE,EAAE,cAAc,EAAE,aAAa,EAAE;aACxC,CAAC,CAAC;QACL,CAAC;QACD,8DAA8D;QAC9D,SAAS,CAAC,UAAkB,EAAE,UAAkB;YAC9C,OAAO,OAAO,CAAC;gBACb,MAAM,EAAE,MAAM;gBACd,IAAI,EAAE,yBAAyB,IAAA,aAAG,EAAC,UAAU,CAAC,eAAe,IAAA,aAAG,EAAC,UAAU,CAAC,YAAY;aACzF,CAAC,CAAC;QACL,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/client/workflows.d.ts

@@ -0,0 +1,131 @@
+import { type RequestFn } from './request';
+import type { ListPage } from './types';
+/** What starts a workflow run. */
+export type WorkflowTrigger = {
+    type: 'cron';
+    cron: string;
+} | {
+    type: 'user_created';
+    after_minutes?: number;
+} | {
+    type: 'inactive';
+    days: number;
+} | {
+    type: 'membership_age';
+    days: number;
+    organization_id?: string;
+} | {
+    type: 'trial_end';
+    days_before?: number;
+} | {
+    type: 'webhook_event';
+    event_type: string;
+};
+/** One step. A step that acts on an organization takes `organization_id`, or uses the membership's own for `membership_age`. */
+export type WorkflowStep = {
+    type: 'notify';
+    subject: string;
+    body: string;
+    to?: string;
+} | {
+    type: 'disable';
+    reason?: string;
+} | {
+    type: 'delete';
+} | {
+    type: 'invite';
+    role: string;
+    organization_id?: string;
+} | {
+    type: 'add_to_org';
+    role: string;
+    organization_id?: string;
+} | {
+    type: 'remove_from_org';
+    organization_id?: string;
+} | {
+    type: 'add_to_team';
+    team_id: string;
+    organization_id?: string;
+} | {
+    type: 'remove_from_team';
+    team_id: string;
+    organization_id?: string;
+} | {
+    type: 'add_to_group';
+    group: string;
+} | {
+    type: 'remove_from_group';
+    group: string;
+} | {
+    type: 'call_action';
+    action_id: string;
+};
+export interface Workflow {
+    object: 'workflow';
+    id: string;
+    name: string;
+    description: string | null;
+    enabled: boolean;
+    trigger: WorkflowTrigger;
+    steps: WorkflowStep[];
+    /** A cron workflow's next slot (Unix ms); null for other triggers. */
+    next_run_at: number | null;
+    created_at: number;
+    updated_at: number;
+}
+export interface WorkflowRunStep {
+    index: number;
+    type: string;
+    status: 'ok' | 'failed' | 'would_run' | 'skipped';
+    detail?: string;
+}
+export interface WorkflowRun {
+    object: 'workflow_run';
+    id: string;
+    workflow_id: string;
+    subject: string;
+    user_id: string | null;
+    dry_run: boolean;
+    status: 'running' | 'succeeded' | 'failed';
+    steps: WorkflowRunStep[];
+    error: string | null;
+    started_at: number;
+    finished_at: number | null;
+}
+export interface CreateWorkflowBody {
+    name: string;
+    description?: string | null;
+    enabled?: boolean;
+    trigger: WorkflowTrigger;
+    steps: WorkflowStep[];
+}
+export type UpdateWorkflowBody = Partial<CreateWorkflowBody>;
+export declare function workflowsResource(request: RequestFn): {
+    list(): Promise<ListPage<Workflow>>;
+    create(body: CreateWorkflowBody, idempotencyKey?: string): Promise<Workflow>;
+    get(id: string): Promise<Workflow>;
+    update(id: string, body: UpdateWorkflowBody): Promise<Workflow>;
+    delete(id: string): Promise<{
+        object: "workflow";
+        id: string;
+        deleted: true;
+    }>;
+    /** Validate every step against live data for a user (none for cron) and report what would happen; changes nothing. */
+    dryRun(id: string, target?: {
+        user_id?: string;
+        organization_id?: string;
+    }): Promise<WorkflowRun>;
+    /** Run now for one user (none for cron), outside the trigger. */
+    run(id: string, target?: {
+        user_id?: string;
+        organization_id?: string;
+    }, idempotencyKey?: string): Promise<WorkflowRun>;
+    /** Run history, newest first. */
+    runs(id: string, query?: {
+        limit?: number;
+        starting_after?: string;
+    }): Promise<ListPage<WorkflowRun> & {
+        next_cursor: string | null;
+    }>;
+};

package/dist/client/workflows.js

@@ -0,0 +1,36 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.workflowsResource = workflowsResource;
+const request_1 = require("./request");
+function workflowsResource(request) {
+    return {
+        list() {
+            return request({ method: 'GET', path: '/v1/workflows' });
+        },
+        create(body, idempotencyKey) {
+            return request({ method: 'POST', path: '/v1/workflows', body, idempotencyKey });
+        },
+        get(id) {
+            return request({ method: 'GET', path: `/v1/workflows/${(0, request_1.enc)(id)}` });
+        },
+        update(id, body) {
+            return request({ method: 'PATCH', path: `/v1/workflows/${(0, request_1.enc)(id)}`, body });
+        },
+        delete(id) {
+            return request({ method: 'DELETE', path: `/v1/workflows/${(0, request_1.enc)(id)}` });
+        },
+        /** Validate every step against live data for a user (none for cron) and report what would happen; changes nothing. */
+        dryRun(id, target = {}) {
+            return request({ method: 'POST', path: `/v1/workflows/${(0, request_1.enc)(id)}/dry_run`, body: target });
+        },
+        /** Run now for one user (none for cron), outside the trigger. */
+        run(id, target = {}, idempotencyKey) {
+            return request({ method: 'POST', path: `/v1/workflows/${(0, request_1.enc)(id)}/run`, body: target, idempotencyKey });
+        },
+        /** Run history, newest first. */
+        runs(id, query = {}) {
+            return request({ method: 'GET', path: `/v1/workflows/${(0, request_1.enc)(id)}/runs`, query });
+        },
+    };
+}
+//# sourceMappingURL=workflows.js.map

package/dist/client/workflows.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"workflows.js","sourceRoot":"","sources":["../../src/client/workflows.ts"],"names":[],"mappings":";;AAuEA,8CA8BC;AArGD,uCAAgD;AAuEhD,SAAgB,iBAAiB,CAAC,OAAkB;IAClD,OAAO;QACL,IAAI;YACF,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,eAAe,EAAE,CAAC,CAAC;QAC3D,CAAC;QACD,MAAM,CAAC,IAAwB,EAAE,cAAuB;YACtD,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,eAAe,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC;QAClF,CAAC;QACD,GAAG,CAAC,EAAU;YACZ,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,iBAAiB,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;QACtE,CAAC;QACD,MAAM,CAAC,EAAU,EAAE,IAAwB;YACzC,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,iBAAiB,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;QAC9E,CAAC;QACD,MAAM,CAAC,EAAU;YACf,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,iBAAiB,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;QACzE,CAAC;QACD,sHAAsH;QACtH,MAAM,CAAC,EAAU,EAAE,SAAyD,EAAE;YAC5E,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,iBAAiB,IAAA,aAAG,EAAC,EAAE,CAAC,UAAU,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC;QAC7F,CAAC;QACD,iEAAiE;QACjE,GAAG,CAAC,EAAU,EAAE,SAAyD,EAAE,EAAE,cAAuB;YAClG,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,iBAAiB,IAAA,aAAG,EAAC,EAAE,CAAC,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,cAAc,EAAE,CAAC,CAAC;QACzG,CAAC;QACD,iCAAiC;QACjC,IAAI,CAAC,EAAU,EAAE,QAAqD,EAAE;YACtE,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,iBAAiB,IAAA,aAAG,EAAC,EAAE,CAAC,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC;QAClF,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/framework-bridge.d.ts

@@ -0,0 +1,98 @@
+import type { MigrationTokenExtractor } from './migration-bridge';
+/**
+ * Zero-logout bridge for the SELF-HOSTED frameworks (Auth.js, Lucia,
+ * Passport, iron-session, Devise, Django): their presets, and the token
+ * extractors `migrationBridge({ extractToken })` takes.
+ *
+ * Two families:
+ *
+ *   - Database sessions (Auth.js database strategy, Lucia, express-session
+ *     stores, Django's database backend, Rails' activerecord-session_store):
+ *     preset mode `session_table`. The cookie carries an opaque id; Atlas finds
+ *     sha256(id) among the sessions you imported. Lucia, Auth.js and Django
+ *     cookies are read as they are; express-session's cookie is signed
+ *     (`s:<id>.<signature>`), so {@link expressSessionExtractor} pulls the id out.
+ *
+ *   - Sealed cookies (Auth.js JWT strategy, iron-session, Rails' cookie store
+ *     under Devise, Django's signed-cookie backend): there is no session row to
+ *     import — the cookie IS the session, and only your app's secret opens it.
+ *     The extractor opens it ON YOUR SERVER and hands Atlas a short-lived
+ *     BRIDGE ASSERTION instead: an HS256 JWT (`iss` = `urn:atlas:bridge:<source>`,
+ *     `sub` = the user id you exported, `jti` = the old session's id) signed
+ *     with a bridge secret you generate and store in the bridge settings
+ *     (`shared_secret`). Your AUTH_SECRET / secret_key_base / SECRET_KEY /
+ *     iron password never leave your server; Atlas verifies the assertion,
+ *     spends its `jti` once, and signs the user in.
+ */
+/** The issuer of a bridge assertion for a source. */
+export declare function bridgeAssertionIssuer(source: string): string;
+/** Lifetime of a bridge assertion: it is exchanged immediately, once. */
+export declare const BRIDGE_ASSERTION_TTL_SECONDS = 120;
+export interface BridgeAssertion {
+    source: string;
+    /** The source user id (the `user.id` your export wrote). */
+    sub: string;
+    /** The old session's own id, so the session exchanges once (single-use ledger). */
+    sessionKey: string;
+    email?: string | null;
+    name?: string | null;
+    /** The old session had already passed a second factor. */
+    mfa?: boolean;
+}
+/** Sign a bridge assertion with the bridge secret (HS256). */
+export declare function signBridgeAssertion(assertion: BridgeAssertion, bridgeSecret: string, now?: Date): Promise<string>;
+/**
+ * Auth.js / NextAuth, either session strategy. A database-session cookie is
+ * returned as it is (preset `authjs`); a JWT-strategy cookie is decrypted with
+ * `secret` (AUTH_SECRET / NEXTAUTH_SECRET, or the rotation list) and turned
+ * into a bridge assertion (preset `authjs_jwt`, needs `bridgeSecret`).
+ */
+export declare function authJsExtractor(options: {
+    secret?: string | readonly string[];
+    bridgeSecret?: string;
+    cookieName?: string;
+}): MigrationTokenExtractor;
+/**
+ * Passport / express-session: the session id out of the signed `connect.sid`
+ * cookie (preset `passport`). Pass `secrets` (your `session({ secret })`) to
+ * check the signature as express-session does.
+ */
+export declare function expressSessionExtractor(options?: {
+    cookieName?: string;
+    secrets?: string | readonly string[];
+}): MigrationTokenExtractor;
+/**
+ * iron-session: unseal the cookie with your session password and assert the
+ * user at `userIdPath` (default: `userId`, then `user.id`, then `id`).
+ */
+export declare function ironSessionExtractor(options: {
+    cookieName: string;
+    password: string | Readonly<Record<string, string>>;
+    bridgeSecret: string;
+    userIdPath?: string;
+    emailPath?: string;
+}): MigrationTokenExtractor;
+/**
+ * Devise on Rails' cookie store: decrypt `_<app>_session` with
+ * `secret_key_base` and assert the Warden user (`scope`, default `user`).
+ */
+export declare function deviseExtractor(options: {
+    cookieName: string;
+    secretKeyBase: string | readonly string[];
+    bridgeSecret: string;
+    scope?: string;
+    keyDigest?: 'SHA-256' | 'SHA-1';
+}): MigrationTokenExtractor;
+/**
+ * Django's signed-cookie session backend: verify the cookie with SECRET_KEY
+ * (then SECRET_KEY_FALLBACKS) and assert `_auth_user_id`.
+ */
+export declare function djangoSignedCookieExtractor(options: {
+    secretKey: string | readonly string[];
+    bridgeSecret: string;
+    cookieName?: string;
+    /** SESSION_COOKIE_AGE (default two weeks). */
+    maxAgeSeconds?: number;
+}): MigrationTokenExtractor;
+/** The preset ids this module registers (for docs and the settings UI). */
+export declare const FRAMEWORK_BRIDGE_PRESETS: string[];