@atlasauth/backend 0.23.0 → 0.25.0

package/dist/client/app-catalog.d.ts

@@ -0,0 +1,74 @@
+import { type RequestFn } from './request';
+export interface AppPreset {
+    object: 'app_preset';
+    id: string;
+    protocol: 'saml' | 'oidc';
+    name: string;
+    category: string;
+    icon_domain: string;
+    /** False: the values could not be confirmed in the vendor's docs; check them against the app's SSO settings. */
+    verified: boolean;
+    /** The vendor SSO documentation the values come from. */
+    source_url: string | null;
+    params: Array<{
+        key: string;
+        label: string;
+    }>;
+}
+/** Who may open an installed app; `assigned` admits only the listed users, groups, organizations and roles. */
+export interface AppAssignment {
+    mode: 'everyone' | 'assigned';
+    user_ids?: string[];
+    /** Instance group ids or slugs (members of child groups count). */
+    groups?: string[];
+    organizations?: string[];
+    /** Organization role keys. */
+    roles?: string[];
+}
+export interface InstalledApp {
+    object: 'installed_app';
+    id: string;
+    protocol: 'saml' | 'oidc';
+    name: string;
+    preset_id: string | null;
+    entity_id: string | null;
+    acs_url: string | null;
+    client_id: string | null;
+    launch_url: string | null;
+    allowed_email_domains: string[];
+    assignment: Required<AppAssignment>;
+}
+export interface InstallAppBody {
+    params?: Record<string, string>;
+    installed_id?: string;
+    name?: string;
+    allowed_email_domains?: string[];
+    assignment?: AppAssignment;
+}
+/** The app catalog: SAML and OpenID Connect presets, installs, and who may open each app. */
+export declare function appCatalogResource(request: RequestFn): {
+    /** `GET /v1/app_catalog` — every preset with its protocol and parameters. */
+    presets(): Promise<{
+        object: "list";
+        data: AppPreset[];
+    }>;
+    /** `GET /v1/app_catalog/installed` */
+    installed(): Promise<{
+        object: "list";
+        data: InstalledApp[];
+    }>;
+    /** `POST /v1/app_catalog/:presetId/install` — an OIDC app's `client_secret` is in this response only. */
+    install(presetId: string, body?: InstallAppBody, idempotencyKey?: string): Promise<InstalledApp & {
+        client_secret?: string;
+        redirect_uri?: string;
+        issuer?: string;
+    }>;
+    /** `PATCH /v1/app_catalog/installed/:id` — name, allowed_email_domains, assignment. */
+    update(id: string, body: Pick<InstallAppBody, "name" | "allowed_email_domains" | "assignment">): Promise<InstalledApp>;
+    /** `DELETE /v1/app_catalog/installed/:id` */
+    uninstall(id: string): Promise<{
+        object: "installed_app";
+        id: string;
+        deleted: true;
+    }>;
+};

package/dist/client/app-catalog.js

@@ -0,0 +1,30 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.appCatalogResource = appCatalogResource;
+const request_1 = require("./request");
+/** The app catalog: SAML and OpenID Connect presets, installs, and who may open each app. */
+function appCatalogResource(request) {
+    return {
+        /** `GET /v1/app_catalog` — every preset with its protocol and parameters. */
+        presets() {
+            return request({ method: 'GET', path: '/v1/app_catalog' });
+        },
+        /** `GET /v1/app_catalog/installed` */
+        installed() {
+            return request({ method: 'GET', path: '/v1/app_catalog/installed' });
+        },
+        /** `POST /v1/app_catalog/:presetId/install` — an OIDC app's `client_secret` is in this response only. */
+        install(presetId, body = {}, idempotencyKey) {
+            return request({ method: 'POST', path: `/v1/app_catalog/${(0, request_1.enc)(presetId)}/install`, body, idempotencyKey });
+        },
+        /** `PATCH /v1/app_catalog/installed/:id` — name, allowed_email_domains, assignment. */
+        update(id, body) {
+            return request({ method: 'PATCH', path: `/v1/app_catalog/installed/${(0, request_1.enc)(id)}`, body });
+        },
+        /** `DELETE /v1/app_catalog/installed/:id` */
+        uninstall(id) {
+            return request({ method: 'DELETE', path: `/v1/app_catalog/installed/${(0, request_1.enc)(id)}` });
+        },
+    };
+}
+//# sourceMappingURL=app-catalog.js.map

package/dist/client/app-catalog.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"app-catalog.js","sourceRoot":"","sources":["../../src/client/app-catalog.ts"],"names":[],"mappings":";;AAkDA,gDAuBC;AAzED,uCAAgD;AAiDhD,6FAA6F;AAC7F,SAAgB,kBAAkB,CAAC,OAAkB;IACnD,OAAO;QACL,6EAA6E;QAC7E,OAAO;YACL,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,iBAAiB,EAAE,CAAC,CAAC;QAC7D,CAAC;QACD,sCAAsC;QACtC,SAAS;YACP,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,2BAA2B,EAAE,CAAC,CAAC;QACvE,CAAC;QACD,yGAAyG;QACzG,OAAO,CAAC,QAAgB,EAAE,OAAuB,EAAE,EAAE,cAAuB;YAC1E,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,mBAAmB,IAAA,aAAG,EAAC,QAAQ,CAAC,UAAU,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC;QAC7G,CAAC;QACD,uFAAuF;QACvF,MAAM,CAAC,EAAU,EAAE,IAA2E;YAC5F,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,6BAA6B,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;QAC1F,CAAC;QACD,6CAA6C;QAC7C,SAAS,CAAC,EAAU;YAClB,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,6BAA6B,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;QACrF,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/client/attack-protection.d.ts

@@ -70,4 +70,14 @@ export interface UpdateAttackProtectionBody {
 export declare function attackProtectionResource(request: RequestFn): {
     get(): Promise<AttackProtection>;
     update(body: UpdateAttackProtectionBody): Promise<AttackProtection>;
+    /** Store the Play Integrity response-decryption key (base64 AES-256) for app attestation. Write-only. */
+    /** Store the Play Integrity decryption key (default) or, with kind 'devicecheck', the Apple DeviceCheck .p8 key. Write-only. */
+    setAppAttestationSecret(secret: string, kind?: "play_integrity" | "devicecheck"): Promise<{
+        object: "app_attestation_secret";
+        set: true;
+    }>;
+    removeAppAttestationSecret(kind?: "play_integrity" | "devicecheck"): Promise<{
+        object: "app_attestation_secret";
+        deleted: true;
+    }>;
 };

package/dist/client/attack-protection.js

@@ -9,6 +9,14 @@ function attackProtectionResource(request) {
         update(body) {
             return request({ method: 'PATCH', path: '/v1/attack_protection', body });
         },
+        /** Store the Play Integrity response-decryption key (base64 AES-256) for app attestation. Write-only. */
+        /** Store the Play Integrity decryption key (default) or, with kind 'devicecheck', the Apple DeviceCheck .p8 key. Write-only. */
+        setAppAttestationSecret(secret, kind = 'play_integrity') {
+            return request({ method: 'PUT', path: '/v1/attack_protection/app_attestation_secret', body: { secret, kind } });
+        },
+        removeAppAttestationSecret(kind = 'play_integrity') {
+            return request({ method: 'DELETE', path: '/v1/attack_protection/app_attestation_secret', query: { kind } });
+        },
     };
 }
 //# sourceMappingURL=attack-protection.js.map

package/dist/client/attack-protection.js.map

@@ -1 +1 @@
-{"version":3,"file":"attack-protection.js","sourceRoot":"","sources":["../../src/client/attack-protection.ts"],"names":[],"mappings":";;AA8DA,4DASC;AATD,SAAgB,wBAAwB,CAAC,OAAkB;IACzD,OAAO;QACL,GAAG;YACD,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,uBAAuB,EAAE,CAAC,CAAC;QACnE,CAAC;QACD,MAAM,CAAC,IAAgC;YACrC,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,uBAAuB,EAAE,IAAI,EAAE,CAAC,CAAC;QAC3E,CAAC;KACF,CAAC;AACJ,CAAC"}
+{"version":3,"file":"attack-protection.js","sourceRoot":"","sources":["../../src/client/attack-protection.ts"],"names":[],"mappings":";;AA8DA,4DAiBC;AAjBD,SAAgB,wBAAwB,CAAC,OAAkB;IACzD,OAAO;QACL,GAAG;YACD,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,uBAAuB,EAAE,CAAC,CAAC;QACnE,CAAC;QACD,MAAM,CAAC,IAAgC;YACrC,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,uBAAuB,EAAE,IAAI,EAAE,CAAC,CAAC;QAC3E,CAAC;QACD,yGAAyG;QACzG,gIAAgI;QAChI,uBAAuB,CAAC,MAAc,EAAE,OAAyC,gBAAgB;YAC/F,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,8CAA8C,EAAE,IAAI,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC;QAClH,CAAC;QACD,0BAA0B,CAAC,OAAyC,gBAAgB;YAClF,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,8CAA8C,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC;QAC9G,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/client/audit-events.d.ts

@@ -25,6 +25,8 @@ export interface CustomAuditEvent {
     /** When it happened in your system (epoch ms). */
     occurred_at: number;
     metadata: unknown;
+    /** The registered schema version this event satisfied; null when its action has no schema. */
+    schema_version?: number | null;
     /** When Atlas received it (epoch ms). */
     created_at: number;
 }
@@ -45,6 +47,8 @@ export interface CreateCustomAuditEventBody {
     occurred_at?: number;
     /** Non-secret structured context. */
     metadata?: Record<string, unknown>;
+    /** Pin to a registered schema version; default the latest active one for the action. */
+    schema_version?: number;
 }
 /** Shared filters of the list and export endpoints. */
 export interface CustomAuditEventFilters {
@@ -101,3 +105,70 @@ export declare function auditEventsResource(request: RequestFn): {
         deleted: number;
     }>;
 };
+/** A registered audit event schema: what an action's events must look like. */
+export interface AuditEventSchema {
+    object: 'audit_event_schema';
+    id: string;
+    action: string;
+    version: number;
+    description: string | null;
+    /** Allowed `target.type` values (empty = any). */
+    target_types: string[];
+    /** Allowed `actor.type` values (empty = any). */
+    actor_types: string[];
+    /** A JSON Schema the event's metadata must satisfy. */
+    metadata_schema: Record<string, unknown>;
+    status: 'active' | 'deprecated';
+    created_at: number;
+}
+export interface RegisterAuditEventSchemaBody {
+    action: string;
+    /** Defaults to the next version for the action; a version is immutable. */
+    version?: number;
+    description?: string;
+    target_types?: string[];
+    actor_types?: string[];
+    metadata_schema?: Record<string, unknown>;
+}
+export declare function auditEventSchemasResource(request: RequestFn): {
+    list(): Promise<{
+        object: "list";
+        data: AuditEventSchema[];
+        has_more: false;
+    }>;
+    get(id: string): Promise<AuditEventSchema>;
+    /** Events with this action are validated against it from now on. Change a schema by registering a new version. */
+    register(body: RegisterAuditEventSchemaBody): Promise<AuditEventSchema>;
+    update(id: string, body: {
+        description?: string | null;
+        status?: "active" | "deprecated";
+    }): Promise<AuditEventSchema>;
+    delete(id: string): Promise<{
+        object: "audit_event_schema";
+        id: string;
+        deleted: true;
+    }>;
+    /** Blank fields of one event (`actor_id`, `target_id`, `target_name`, `metadata.<path>`); logged, never deleted. */
+    redact(eventId: string, body: {
+        fields: string[];
+        reason: string;
+    }): Promise<{
+        object: "audit_event_redaction";
+        event_id: string;
+        redacted: string[];
+        unchanged: string[];
+        reason: string;
+    }>;
+    redactions(eventId: string): Promise<{
+        object: "list";
+        data: Array<{
+            id: string;
+            event_id: string;
+            fields: string[];
+            reason: string;
+            redacted_by: string | null;
+            created_at: number;
+        }>;
+        has_more: false;
+    }>;
+};

package/dist/client/audit-events.js

@@ -1,6 +1,7 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.auditEventsResource = auditEventsResource;
+exports.auditEventSchemasResource = auditEventSchemasResource;
 function auditEventsResource(request) {
     return {
         create(body, idempotencyKey) {
@@ -40,4 +41,31 @@ function auditEventsResource(request) {
         },
     };
 }
+function auditEventSchemasResource(request) {
+    return {
+        list() {
+            return request({ method: 'GET', path: '/v1/audit_event_schemas' });
+        },
+        get(id) {
+            return request({ method: 'GET', path: `/v1/audit_event_schemas/${encodeURIComponent(id)}` });
+        },
+        /** Events with this action are validated against it from now on. Change a schema by registering a new version. */
+        register(body) {
+            return request({ method: 'POST', path: '/v1/audit_event_schemas', body });
+        },
+        update(id, body) {
+            return request({ method: 'PATCH', path: `/v1/audit_event_schemas/${encodeURIComponent(id)}`, body });
+        },
+        delete(id) {
+            return request({ method: 'DELETE', path: `/v1/audit_event_schemas/${encodeURIComponent(id)}` });
+        },
+        /** Blank fields of one event (`actor_id`, `target_id`, `target_name`, `metadata.<path>`); logged, never deleted. */
+        redact(eventId, body) {
+            return request({ method: 'POST', path: `/v1/audit_events/${encodeURIComponent(eventId)}/redact`, body });
+        },
+        redactions(eventId) {
+            return request({ method: 'GET', path: `/v1/audit_events/${encodeURIComponent(eventId)}/redactions` });
+        },
+    };
+}
 //# sourceMappingURL=audit-events.js.map

package/dist/client/audit-events.js.map

@@ -1 +1 @@
-{"version":3,"file":"audit-events.js","sourceRoot":"","sources":["../../src/client/audit-events.ts"],"names":[],"mappings":";;AAoEA,kDA2CC;AA3CD,SAAgB,mBAAmB,CAAC,OAAkB;IACpD,OAAO;QACL,MAAM,CAAC,IAAgC,EAAE,cAAuB;YAC9D,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,kBAAkB,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC;QACrF,CAAC;QACD,kFAAkF;QAClF,WAAW,CACT,MAAoC,EACpC,cAAuB;YAEvB,OAAO,OAAO,CAAC;gBACb,MAAM,EAAE,MAAM;gBACd,IAAI,EAAE,wBAAwB;gBAC9B,IAAI,EAAE,EAAE,MAAM,EAAE;gBAChB,cAAc;aACf,CAAC,CAAC;QACL,CAAC;QACD,sCAAsC;QACtC,IAAI,CAAC,SAAsC,EAAE;YAC3C,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,kBAAkB,EAAE,KAAK,EAAE,EAAE,GAAG,MAAM,EAAE,EAAE,CAAC,CAAC;QACpF,CAAC;QACD;;;WAGG;QACH,MAAM,CAAC,SAAwC,EAAE;YAC/C,OAAO,OAAO,CAAC;gBACb,MAAM,EAAE,KAAK;gBACb,IAAI,EAAE,yBAAyB;gBAC/B,KAAK,EAAE,EAAE,GAAG,MAAM,EAAE;gBACpB,GAAG,EAAE,IAAI;aACV,CAAC,CAAC;QACL,CAAC;QACD;;;WAGG;QACH,SAAS,CACP,SAAwD,EAAE;YAE1D,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,kBAAkB,EAAE,KAAK,EAAE,EAAE,GAAG,MAAM,EAAE,EAAE,CAAC,CAAC;QACvF,CAAC;KACF,CAAC;AACJ,CAAC"}
+{"version":3,"file":"audit-events.js","sourceRoot":"","sources":["../../src/client/audit-events.ts"],"names":[],"mappings":";;AAwEA,kDA2CC;AA6BD,8DA0BC;AAlGD,SAAgB,mBAAmB,CAAC,OAAkB;IACpD,OAAO;QACL,MAAM,CAAC,IAAgC,EAAE,cAAuB;YAC9D,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,kBAAkB,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC;QACrF,CAAC;QACD,kFAAkF;QAClF,WAAW,CACT,MAAoC,EACpC,cAAuB;YAEvB,OAAO,OAAO,CAAC;gBACb,MAAM,EAAE,MAAM;gBACd,IAAI,EAAE,wBAAwB;gBAC9B,IAAI,EAAE,EAAE,MAAM,EAAE;gBAChB,cAAc;aACf,CAAC,CAAC;QACL,CAAC;QACD,sCAAsC;QACtC,IAAI,CAAC,SAAsC,EAAE;YAC3C,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,kBAAkB,EAAE,KAAK,EAAE,EAAE,GAAG,MAAM,EAAE,EAAE,CAAC,CAAC;QACpF,CAAC;QACD;;;WAGG;QACH,MAAM,CAAC,SAAwC,EAAE;YAC/C,OAAO,OAAO,CAAC;gBACb,MAAM,EAAE,KAAK;gBACb,IAAI,EAAE,yBAAyB;gBAC/B,KAAK,EAAE,EAAE,GAAG,MAAM,EAAE;gBACpB,GAAG,EAAE,IAAI;aACV,CAAC,CAAC;QACL,CAAC;QACD;;;WAGG;QACH,SAAS,CACP,SAAwD,EAAE;YAE1D,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,kBAAkB,EAAE,KAAK,EAAE,EAAE,GAAG,MAAM,EAAE,EAAE,CAAC,CAAC;QACvF,CAAC;KACF,CAAC;AACJ,CAAC;AA6BD,SAAgB,yBAAyB,CAAC,OAAkB;IAC1D,OAAO;QACL,IAAI;YACF,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,yBAAyB,EAAE,CAAC,CAAC;QACrE,CAAC;QACD,GAAG,CAAC,EAAU;YACZ,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,2BAA2B,kBAAkB,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;QAC/F,CAAC;QACD,kHAAkH;QAClH,QAAQ,CAAC,IAAkC;YACzC,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,yBAAyB,EAAE,IAAI,EAAE,CAAC,CAAC;QAC5E,CAAC;QACD,MAAM,CAAC,EAAU,EAAE,IAAuE;YACxF,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,2BAA2B,kBAAkB,CAAC,EAAE,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;QACvG,CAAC;QACD,MAAM,CAAC,EAAU;YACf,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,2BAA2B,kBAAkB,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;QAClG,CAAC;QACD,oHAAoH;QACpH,MAAM,CAAC,OAAe,EAAE,IAA0C;YAChE,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,oBAAoB,kBAAkB,CAAC,OAAO,CAAC,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAC3G,CAAC;QACD,UAAU,CAAC,OAAe;YACxB,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,oBAAoB,kBAAkB,CAAC,OAAO,CAAC,aAAa,EAAE,CAAC,CAAC;QACxG,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/client/credentials.d.ts

@@ -39,6 +39,8 @@ export interface SecretKey extends StandardKey {
     allowed_ips: string[];
     /** Alias of `origin_allowlist`: browser origins the key may be used from (empty = any). */
     allowed_origins: string[];
+    /** Partner admin: the organizations the key is limited to (empty = unrestricted). */
+    organization_ids: string[];
     rotated_from: string | null;
     /** Provisioning tags (filter the list with `metadata`). */
     metadata?: Record<string, string | number | boolean>;
@@ -63,6 +65,10 @@ export interface CreateSecretKeyBody {
     allowed_ips?: string[];
     /** Browser origins (`https://app.example.com`, `https://*.example.com`) a request with an Origin must come from. */
     allowed_origins?: string[];
+    /**
+     * Partner admin: limit the key to these organizations. A limited key may call only the organization routes for them.
+     */
+    organization_ids?: string[];
     /** The person or service responsible. Default: whoever creates the key. */
     owner?: string | null;
     /** `atlas` (default) or `legacy`. */
@@ -260,6 +266,8 @@ export declare function secretKeysResource(request: RequestFn): {
         expires_at?: number | string | null;
         allowed_ips?: string[];
         allowed_origins?: string[];
+        /** `[]` lifts an organization limit. */
+        organization_ids?: string[];
         metadata?: Record<string, string | number | boolean> | null;
     }): Promise<SecretKey>;
     /** New key with the same scopes; the old one works for `overlap_seconds` (default 72 h, 0 = now). */

package/dist/client/credentials.js.map

@@ -1 +1 @@
-{"version":3,"file":"credentials.js","sourceRoot":"","sources":["../../src/client/credentials.ts"],"names":[],"mappings":";;AA+OA,wCAGC;AAED,gDAmCC;AAED,oCAOC;AAED,oDA8DC;AAED,sDA8BC;AA0DD,gDAgBC;AAOD,8DAKC;AAtdD,uCAA4D;AAG5D,0CAA+F;AA0O/F,MAAM,GAAG,GAAG,kBAAkB,CAAC;AAE/B,SAAgB,cAAc,CAAC,OAAkB;IAC/C,2CAA2C;IAC3C,OAAO,GAAoB,EAAE,CAAC,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC,CAAC;AAC/E,CAAC;AAED,SAAgB,kBAAkB,CAAC,OAAkB;IACnD,OAAO;QACL,MAAM,CAAC,IAAyB;YAC9B,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,iBAAiB,EAAE,IAAI,EAAE,CAAC,CAAC;QACpE,CAAC;QACD,wEAAwE;QACxE,IAAI,CAAC,SAAgD,EAAE;YACrD,MAAM,KAAK,GAA2B,EAAE,CAAC;YACzC,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,QAAQ,IAAI,EAAE,CAAC;gBAAE,KAAK,CAAC,YAAY,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YACxF,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,iBAAiB,EAAE,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;QAC9G,CAAC;QACD,GAAG,CAAC,EAAU;YACZ,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,mBAAmB,GAAG,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;QACxE,CAAC;QACD,MAAM,CACJ,EAAU,EACV,IAOC;YAED,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,mBAAmB,GAAG,CAAC,EAAE,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;QAChF,CAAC;QACD,qGAAqG;QACrG,MAAM,CAAC,EAAU,EAAE,OAAsE,EAAE;YACzF,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,mBAAmB,GAAG,CAAC,EAAE,CAAC,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACtF,CAAC;QACD,MAAM,CAAC,EAAU;YACf,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,mBAAmB,GAAG,CAAC,EAAE,CAAC,SAAS,EAAE,CAAC,CAAC;QAChF,CAAC;KACF,CAAC;AACJ,CAAC;AAED,SAAgB,YAAY,CAAC,OAAkB;IAC7C,OAAO;QACL,wDAAwD;QACxD,IAAI;YACF,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC,CAAC;QACtD,CAAC;KACF,CAAC;AACJ,CAAC;AAED,SAAgB,oBAAoB,CAAC,OAAkB;IACrD,OAAO;QACL,yHAAyH;QACzH,MAAM,CAAC,IAAsH;YAC3H,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,mBAAmB,EAAE,IAAI,EAAE,CAAC,CAAC;QACtE,CAAC;QACD,sEAAsE;QACtE,eAAe,CAAC,EAAU,EAAE,gBAA0B;YACpD,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,qBAAqB,GAAG,CAAC,EAAE,CAAC,EAAE,EAAE,IAAI,EAAE,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,EAAE,CAAC,CAAC;QAC3H,CAAC;QACD,QAAQ,EAAE;YACR,IAAI,CAAC,SAA0F,EAAE;gBAC/F,MAAM,KAAK,GAA2B,EAAE,CAAC;gBACzC,IAAI,MAAM,CAAC,SAAS;oBAAE,KAAK,CAAC,SAAS,GAAG,MAAM,CAAC,SAAS,CAAC;gBACzD,IAAI,MAAM,CAAC,MAAM,EAAE,MAAM;oBAAE,KAAK,CAAC,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;gBAClE,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,4BAA4B,EAAE,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;YACzH,CAAC;YACD,GAAG,CAAC,EAAU;gBACZ,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,8BAA8B,GAAG,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;YACnF,CAAC;YACD,2FAA2F;YAC3F,OAAO,CAAC,EAAU,EAAE,OAA4D,EAAE;gBAChF,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,8BAA8B,GAAG,CAAC,EAAE,CAAC,UAAU,EAAE,IAAI,EAAE,CAAC,CAAC;YAClG,CAAC;YACD,IAAI,CAAC,EAAU;gBACb,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,8BAA8B,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,CAAC;YACzF,CAAC;SACF;QACD,IAAI;YACF,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,mBAAmB,EAAE,CAAC,CAAC;QAC/D,CAAC;QACD,GAAG,CAAC,EAAU;YACZ,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,qBAAqB,GAAG,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;QAC1E,CAAC;QACD,YAAY,CAAC,EAAU;YACrB,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,qBAAqB,GAAG,CAAC,EAAE,CAAC,gBAAgB,EAAE,CAAC,CAAC;QACzF,CAAC;QACD,MAAM,CAAC,EAAU;YACf,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,qBAAqB,GAAG,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;QAC7E,CAAC;QACD,QAAQ,EAAE;YACR,IAAI;gBACF,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,4BAA4B,EAAE,CAAC,CAAC;YACxE,CAAC;YACD,IAAI,CAAC,OAAe,EAAE,IAAiC;gBACrD,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,8BAA8B,GAAG,CAAC,OAAO,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;YAC9F,CAAC;YACD,IAAI,CAAC,OAAe;gBAClB,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,8BAA8B,GAAG,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC;YAC9F,CAAC;YACD,MAAM,CAAC,OAAe;gBACpB,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,8BAA8B,GAAG,CAAC,OAAO,CAAC,EAAE,EAAE,CAAC,CAAC;YAC3F,CAAC;YACD,gGAAgG;YAChG,OAAO,CACL,OAAe,EACf,IAAmG;gBAEnG,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,8BAA8B,GAAG,CAAC,OAAO,CAAC,UAAU,EAAE,IAAI,EAAE,CAAC,CAAC;YACvG,CAAC;SACF;KACF,CAAC;AACJ,CAAC;AAED,SAAgB,qBAAqB,CAAC,OAAkB;IACtD,OAAO;QACL,mHAAmH;QACnH,QAAQ;YAaN,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,mBAAmB,EAAE,CAAC,CAAC;QAC/D,CAAC;QACD,oFAAoF;QACpF,SAAS,CAAC,KAAa;YACrB,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,qBAAqB,GAAG,CAAC,KAAK,CAAC,YAAY,EAAE,CAAC,CAAC;QACvF,CAAC;QACD,sEAAsE;QACtE,MAAM,CAAC,KAAa,EAAE,KAAa;YACjC,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,qBAAqB,GAAG,CAAC,KAAK,CAAC,QAAQ,EAAE,KAAK,EAAE,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC;QACrG,CAAC;QACD,MAAM,CAAC,KAAa,EAAE,OAAe;YACnC,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,qBAAqB,GAAG,CAAC,KAAK,CAAC,WAAW,GAAG,CAAC,OAAO,CAAC,EAAE,EAAE,CAAC,CAAC;QACvG,CAAC;KACF,CAAC;AACJ,CAAC;AAoDD;;;;;GAKG;AACI,KAAK,UAAU,kBAAkB,CACtC,KAA8B,EAC9B,OAAkD,EAAE;IAEpD,MAAM,IAAI,GAAG,CAAC,IAAI,CAAC,MAAM,IAAI,yBAAe,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IAClE,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,CAAC,GAAG,IAAI,2BAA2B,EAAE;QAC1E,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,MAAM,EAAE,kBAAkB,EAAE;QAC3E,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC;KAC5B,CAAC,CAAC;IACH,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAA4B,CAAC;IAC7E,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;QACZ,MAAM,KAAK,GAAI,IAAI,CAAC,MAAkD,EAAE,CAAC,CAAC,CAAC,CAAC;QAC5E,MAAM,IAAI,KAAK,CAAC,gDAAgD,GAAG,CAAC,MAAM,GAAG,KAAK,EAAE,OAAO,CAAC,CAAC,CAAC,KAAK,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC;IAC/H,CAAC;IACD,OAAO,IAA4C,CAAC;AACtD,CAAC;AAED;;;;GAIG;AACH,SAAgB,yBAAyB,CACvC,KAAqE;IAErE,MAAM,EAAE,aAAa,EAAE,GAAG,IAAI,EAAE,GAAG,KAAK,CAAC;IACzC,OAAO,IAAA,wBAAa,EAAsB,EAAE,GAAG,IAAI,EAAE,MAAM,EAAE,aAAa,EAAE,CAAC,CAAC;AAChF,CAAC"}
+{"version":3,"file":"credentials.js","sourceRoot":"","sources":["../../src/client/credentials.ts"],"names":[],"mappings":";;AAqPA,wCAGC;AAED,gDAqCC;AAED,oCAOC;AAED,oDA8DC;AAED,sDA8BC;AA0DD,gDAgBC;AAOD,8DAKC;AA9dD,uCAA4D;AAG5D,0CAA+F;AAgP/F,MAAM,GAAG,GAAG,kBAAkB,CAAC;AAE/B,SAAgB,cAAc,CAAC,OAAkB;IAC/C,2CAA2C;IAC3C,OAAO,GAAoB,EAAE,CAAC,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC,CAAC;AAC/E,CAAC;AAED,SAAgB,kBAAkB,CAAC,OAAkB;IACnD,OAAO;QACL,MAAM,CAAC,IAAyB;YAC9B,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,iBAAiB,EAAE,IAAI,EAAE,CAAC,CAAC;QACpE,CAAC;QACD,wEAAwE;QACxE,IAAI,CAAC,SAAgD,EAAE;YACrD,MAAM,KAAK,GAA2B,EAAE,CAAC;YACzC,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,QAAQ,IAAI,EAAE,CAAC;gBAAE,KAAK,CAAC,YAAY,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YACxF,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,iBAAiB,EAAE,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;QAC9G,CAAC;QACD,GAAG,CAAC,EAAU;YACZ,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,mBAAmB,GAAG,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;QACxE,CAAC;QACD,MAAM,CACJ,EAAU,EACV,IASC;YAED,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,mBAAmB,GAAG,CAAC,EAAE,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;QAChF,CAAC;QACD,qGAAqG;QACrG,MAAM,CAAC,EAAU,EAAE,OAAsE,EAAE;YACzF,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,mBAAmB,GAAG,CAAC,EAAE,CAAC,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACtF,CAAC;QACD,MAAM,CAAC,EAAU;YACf,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,mBAAmB,GAAG,CAAC,EAAE,CAAC,SAAS,EAAE,CAAC,CAAC;QAChF,CAAC;KACF,CAAC;AACJ,CAAC;AAED,SAAgB,YAAY,CAAC,OAAkB;IAC7C,OAAO;QACL,wDAAwD;QACxD,IAAI;YACF,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC,CAAC;QACtD,CAAC;KACF,CAAC;AACJ,CAAC;AAED,SAAgB,oBAAoB,CAAC,OAAkB;IACrD,OAAO;QACL,yHAAyH;QACzH,MAAM,CAAC,IAAsH;YAC3H,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,mBAAmB,EAAE,IAAI,EAAE,CAAC,CAAC;QACtE,CAAC;QACD,sEAAsE;QACtE,eAAe,CAAC,EAAU,EAAE,gBAA0B;YACpD,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,qBAAqB,GAAG,CAAC,EAAE,CAAC,EAAE,EAAE,IAAI,EAAE,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,EAAE,CAAC,CAAC;QAC3H,CAAC;QACD,QAAQ,EAAE;YACR,IAAI,CAAC,SAA0F,EAAE;gBAC/F,MAAM,KAAK,GAA2B,EAAE,CAAC;gBACzC,IAAI,MAAM,CAAC,SAAS;oBAAE,KAAK,CAAC,SAAS,GAAG,MAAM,CAAC,SAAS,CAAC;gBACzD,IAAI,MAAM,CAAC,MAAM,EAAE,MAAM;oBAAE,KAAK,CAAC,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;gBAClE,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,4BAA4B,EAAE,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;YACzH,CAAC;YACD,GAAG,CAAC,EAAU;gBACZ,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,8BAA8B,GAAG,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;YACnF,CAAC;YACD,2FAA2F;YAC3F,OAAO,CAAC,EAAU,EAAE,OAA4D,EAAE;gBAChF,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,8BAA8B,GAAG,CAAC,EAAE,CAAC,UAAU,EAAE,IAAI,EAAE,CAAC,CAAC;YAClG,CAAC;YACD,IAAI,CAAC,EAAU;gBACb,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,8BAA8B,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,CAAC;YACzF,CAAC;SACF;QACD,IAAI;YACF,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,mBAAmB,EAAE,CAAC,CAAC;QAC/D,CAAC;QACD,GAAG,CAAC,EAAU;YACZ,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,qBAAqB,GAAG,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;QAC1E,CAAC;QACD,YAAY,CAAC,EAAU;YACrB,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,qBAAqB,GAAG,CAAC,EAAE,CAAC,gBAAgB,EAAE,CAAC,CAAC;QACzF,CAAC;QACD,MAAM,CAAC,EAAU;YACf,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,qBAAqB,GAAG,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;QAC7E,CAAC;QACD,QAAQ,EAAE;YACR,IAAI;gBACF,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,4BAA4B,EAAE,CAAC,CAAC;YACxE,CAAC;YACD,IAAI,CAAC,OAAe,EAAE,IAAiC;gBACrD,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,8BAA8B,GAAG,CAAC,OAAO,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;YAC9F,CAAC;YACD,IAAI,CAAC,OAAe;gBAClB,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,8BAA8B,GAAG,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC;YAC9F,CAAC;YACD,MAAM,CAAC,OAAe;gBACpB,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,8BAA8B,GAAG,CAAC,OAAO,CAAC,EAAE,EAAE,CAAC,CAAC;YAC3F,CAAC;YACD,gGAAgG;YAChG,OAAO,CACL,OAAe,EACf,IAAmG;gBAEnG,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,8BAA8B,GAAG,CAAC,OAAO,CAAC,UAAU,EAAE,IAAI,EAAE,CAAC,CAAC;YACvG,CAAC;SACF;KACF,CAAC;AACJ,CAAC;AAED,SAAgB,qBAAqB,CAAC,OAAkB;IACtD,OAAO;QACL,mHAAmH;QACnH,QAAQ;YAaN,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,mBAAmB,EAAE,CAAC,CAAC;QAC/D,CAAC;QACD,oFAAoF;QACpF,SAAS,CAAC,KAAa;YACrB,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,qBAAqB,GAAG,CAAC,KAAK,CAAC,YAAY,EAAE,CAAC,CAAC;QACvF,CAAC;QACD,sEAAsE;QACtE,MAAM,CAAC,KAAa,EAAE,KAAa;YACjC,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,qBAAqB,GAAG,CAAC,KAAK,CAAC,QAAQ,EAAE,KAAK,EAAE,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC;QACrG,CAAC;QACD,MAAM,CAAC,KAAa,EAAE,OAAe;YACnC,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,qBAAqB,GAAG,CAAC,KAAK,CAAC,WAAW,GAAG,CAAC,OAAO,CAAC,EAAE,EAAE,CAAC,CAAC;QACvG,CAAC;KACF,CAAC;AACJ,CAAC;AAoDD;;;;;GAKG;AACI,KAAK,UAAU,kBAAkB,CACtC,KAA8B,EAC9B,OAAkD,EAAE;IAEpD,MAAM,IAAI,GAAG,CAAC,IAAI,CAAC,MAAM,IAAI,yBAAe,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IAClE,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,CAAC,GAAG,IAAI,2BAA2B,EAAE;QAC1E,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,MAAM,EAAE,kBAAkB,EAAE;QAC3E,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC;KAC5B,CAAC,CAAC;IACH,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAA4B,CAAC;IAC7E,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;QACZ,MAAM,KAAK,GAAI,IAAI,CAAC,MAAkD,EAAE,CAAC,CAAC,CAAC,CAAC;QAC5E,MAAM,IAAI,KAAK,CAAC,gDAAgD,GAAG,CAAC,MAAM,GAAG,KAAK,EAAE,OAAO,CAAC,CAAC,CAAC,KAAK,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC;IAC/H,CAAC;IACD,OAAO,IAA4C,CAAC;AACtD,CAAC;AAED;;;;GAIG;AACH,SAAgB,yBAAyB,CACvC,KAAqE;IAErE,MAAM,EAAE,aAAa,EAAE,GAAG,IAAI,EAAE,GAAG,KAAK,CAAC;IACzC,OAAO,IAAA,wBAAa,EAAsB,EAAE,GAAG,IAAI,EAAE,MAAM,EAAE,aAAa,EAAE,CAAC,CAAC;AAChF,CAAC"}

package/dist/client/delegated-ui-proxy.d.ts

@@ -0,0 +1,25 @@
+import type { AtlasClient } from './index';
+type Atlas = Pick<AtlasClient, 'oauthClients'>;
+export interface ProxyRequest {
+    method: string;
+    /** Path under your mount point: `login`, `login/accept`, `login/reject`, `consent`, `consent/accept`, `consent/reject`. */
+    path: string;
+    query: Record<string, string | undefined>;
+    body?: unknown;
+}
+export interface ProxyResponse {
+    status: number;
+    body: unknown;
+}
+/**
+ * The backend half of the browser helper `createDelegatedUiClient` (@atlasauth/js).
+ * Mount it under any route; it forwards the challenge calls to Atlas with your
+ * secret key. YOU must authenticate the visitor before letting an `accept`
+ * through: pass `authorize` to decide (return the Atlas user id for a login
+ * accept, or throw / return null to refuse).
+ */
+export declare function delegatedUiProxy(atlas: Atlas, opts: {
+    /** Called for `login/accept` and `consent/*`; return the Atlas user id the visitor is, or null to refuse. */
+    authorize: (req: ProxyRequest) => Promise<string | null> | string | null;
+}): (req: ProxyRequest) => Promise<ProxyResponse>;
+export {};

package/dist/client/delegated-ui-proxy.js

@@ -0,0 +1,46 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.delegatedUiProxy = delegatedUiProxy;
+/**
+ * The backend half of the browser helper `createDelegatedUiClient` (@atlasauth/js).
+ * Mount it under any route; it forwards the challenge calls to Atlas with your
+ * secret key. YOU must authenticate the visitor before letting an `accept`
+ * through: pass `authorize` to decide (return the Atlas user id for a login
+ * accept, or throw / return null to refuse).
+ */
+function delegatedUiProxy(atlas, opts) {
+    return async function handle(req) {
+        const login = req.query.login_challenge;
+        const consent = req.query.consent_challenge;
+        const body = (req.body ?? {});
+        try {
+            const route = `${req.method.toUpperCase()} ${req.path.replace(/^\/|\/$/g, '')}`;
+            if (route === 'GET login' && login)
+                return { status: 200, body: await atlas.oauthClients.loginRequests.get(login) };
+            if (route === 'GET consent' && consent)
+                return { status: 200, body: await atlas.oauthClients.consentRequests.get(consent) };
+            if (route === 'POST login/reject' && login)
+                return { status: 200, body: await atlas.oauthClients.loginRequests.reject(login, body) };
+            if (route === 'POST consent/reject' && consent)
+                return { status: 200, body: await atlas.oauthClients.consentRequests.reject(consent, body) };
+            if (route === 'POST login/accept' && login) {
+                const subject = await opts.authorize(req);
+                if (!subject)
+                    return { status: 401, body: { error: { message: 'Not signed in.' } } };
+                // The subject is decided by your authorize(), never by the browser.
+                return { status: 200, body: await atlas.oauthClients.loginRequests.accept(login, { ...body, subject }) };
+            }
+            if (route === 'POST consent/accept' && consent) {
+                if (!(await opts.authorize(req)))
+                    return { status: 401, body: { error: { message: 'Not signed in.' } } };
+                return { status: 200, body: await atlas.oauthClients.consentRequests.accept(consent, body) };
+            }
+            return { status: 404, body: { error: { message: 'Unknown route.' } } };
+        }
+        catch (e) {
+            const status = e.status ?? 502;
+            return { status, body: { error: { message: e instanceof Error ? e.message : 'Request failed.' } } };
+        }
+    };
+}
+//# sourceMappingURL=delegated-ui-proxy.js.map

package/dist/client/delegated-ui-proxy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"delegated-ui-proxy.js","sourceRoot":"","sources":["../../src/client/delegated-ui-proxy.ts"],"names":[],"mappings":";;AAuBA,4CAiCC;AAxCD;;;;;;GAMG;AACH,SAAgB,gBAAgB,CAC9B,KAAY,EACZ,IAGC;IAED,OAAO,KAAK,UAAU,MAAM,CAAC,GAAiB;QAC5C,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,eAAe,CAAC;QACxC,MAAM,OAAO,GAAG,GAAG,CAAC,KAAK,CAAC,iBAAiB,CAAC;QAC5C,MAAM,IAAI,GAAG,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,CAA4B,CAAC;QACzD,IAAI,CAAC;YACH,MAAM,KAAK,GAAG,GAAG,GAAG,CAAC,MAAM,CAAC,WAAW,EAAE,IAAI,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,EAAE,CAAC;YAChF,IAAI,KAAK,KAAK,WAAW,IAAI,KAAK;gBAAE,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,MAAM,KAAK,CAAC,YAAY,CAAC,aAAa,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;YACpH,IAAI,KAAK,KAAK,aAAa,IAAI,OAAO;gBAAE,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,MAAM,KAAK,CAAC,YAAY,CAAC,eAAe,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;YAC5H,IAAI,KAAK,KAAK,mBAAmB,IAAI,KAAK;gBAAE,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,MAAM,KAAK,CAAC,YAAY,CAAC,aAAa,CAAC,MAAM,CAAC,KAAK,EAAE,IAAI,CAAC,EAAE,CAAC;YACrI,IAAI,KAAK,KAAK,qBAAqB,IAAI,OAAO;gBAAE,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,MAAM,KAAK,CAAC,YAAY,CAAC,eAAe,CAAC,MAAM,CAAC,OAAO,EAAE,IAAI,CAAC,EAAE,CAAC;YAC7I,IAAI,KAAK,KAAK,mBAAmB,IAAI,KAAK,EAAE,CAAC;gBAC3C,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;gBAC1C,IAAI,CAAC,OAAO;oBAAE,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,EAAE,OAAO,EAAE,gBAAgB,EAAE,EAAE,EAAE,CAAC;gBACrF,oEAAoE;gBACpE,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,MAAM,KAAK,CAAC,YAAY,CAAC,aAAa,CAAC,MAAM,CAAC,KAAK,EAAE,EAAE,GAAG,IAAI,EAAE,OAAO,EAAyB,CAAC,EAAE,CAAC;YAClI,CAAC;YACD,IAAI,KAAK,KAAK,qBAAqB,IAAI,OAAO,EAAE,CAAC;gBAC/C,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;oBAAE,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,EAAE,OAAO,EAAE,gBAAgB,EAAE,EAAE,EAAE,CAAC;gBACzG,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,MAAM,KAAK,CAAC,YAAY,CAAC,eAAe,CAAC,MAAM,CAAC,OAAO,EAAE,IAAI,CAAC,EAAE,CAAC;YAC/F,CAAC;YACD,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,EAAE,OAAO,EAAE,gBAAgB,EAAE,EAAE,EAAE,CAAC;QACzE,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,MAAM,MAAM,GAAI,CAAyB,CAAC,MAAM,IAAI,GAAG,CAAC;YACxD,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,EAAE,OAAO,EAAE,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,iBAAiB,EAAE,EAAE,EAAE,CAAC;QACtG,CAAC;IACH,CAAC,CAAC;AACJ,CAAC"}

package/dist/client/devices.d.ts

@@ -0,0 +1,44 @@
+import { type RequestFn } from './request';
+import type { ListPage } from './types';
+export interface Device {
+    object: 'device';
+    id: string;
+    user_id: string | null;
+    source: string;
+    external_id: string;
+    name: string | null;
+    platform: string | null;
+    managed: boolean;
+    compliant: boolean;
+    posture: Record<string, unknown>;
+    last_reported_at: number;
+    created_at: number;
+}
+/** One posture report. Identify the owner with `user_id` or a verified `user_email`. */
+export interface DeviceReportBody {
+    external_id: string;
+    /** Who reported it (`intune`, `jamf`, …); defaults to `api`. */
+    source?: string;
+    user_id?: string | null;
+    user_email?: string;
+    name?: string | null;
+    platform?: string | null;
+    managed?: boolean;
+    compliant?: boolean;
+    posture?: Record<string, unknown>;
+}
+export declare function devicesResource(request: RequestFn): {
+    list(query?: {
+        user_id?: string;
+        source?: string;
+    }): Promise<ListPage<Device>>;
+    get(id: string): Promise<Device>;
+    report(body: DeviceReportBody): Promise<Device>;
+    /** Bulk posture ingestion, up to 500 reports. */
+    ingestPosture(devices: DeviceReportBody[]): Promise<ListPage<Device>>;
+    remove(id: string): Promise<{
+        object: "device";
+        id: string;
+        deleted: true;
+    }>;
+};

package/dist/client/devices.js

@@ -0,0 +1,26 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.devicesResource = devicesResource;
+const request_1 = require("./request");
+function devicesResource(request) {
+    return {
+        list(query = {}) {
+            const q = new URLSearchParams(Object.entries(query).filter((e) => e[1] !== undefined)).toString();
+            return request({ method: 'GET', path: `/v1/devices${q ? `?${q}` : ''}` });
+        },
+        get(id) {
+            return request({ method: 'GET', path: `/v1/devices/${(0, request_1.enc)(id)}` });
+        },
+        report(body) {
+            return request({ method: 'PUT', path: '/v1/devices', body });
+        },
+        /** Bulk posture ingestion, up to 500 reports. */
+        ingestPosture(devices) {
+            return request({ method: 'POST', path: '/v1/device_posture', body: { devices } });
+        },
+        remove(id) {
+            return request({ method: 'DELETE', path: `/v1/devices/${(0, request_1.enc)(id)}` });
+        },
+    };
+}
+//# sourceMappingURL=devices.js.map

package/dist/client/devices.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"devices.js","sourceRoot":"","sources":["../../src/client/devices.ts"],"names":[],"mappings":";;AAgCA,0CAoBC;AApDD,uCAAgD;AAgChD,SAAgB,eAAe,CAAC,OAAkB;IAChD,OAAO;QACL,IAAI,CAAC,QAA+C,EAAE;YACpD,MAAM,CAAC,GAAG,IAAI,eAAe,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAyB,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,SAAS,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC;YACzH,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,cAAc,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;QAC5E,CAAC;QACD,GAAG,CAAC,EAAU;YACZ,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,eAAe,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;QACpE,CAAC;QACD,MAAM,CAAC,IAAsB;YAC3B,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC;QAC/D,CAAC;QACD,iDAAiD;QACjD,aAAa,CAAC,OAA2B;YACvC,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,oBAAoB,EAAE,IAAI,EAAE,EAAE,OAAO,EAAE,EAAE,CAAC,CAAC;QACpF,CAAC;QACD,MAAM,CAAC,EAAU;YACf,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,eAAe,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;QACvE,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/client/email-templates.d.ts

@@ -1,7 +1,7 @@
 import { type RequestFn } from './request';
 import type { ListPage } from './types';
 /** The transactional email a template drives. */
-export type EmailTemplateName = 'verification_code' | 'magic_link' | 'password_reset' | 'password_changed' | 'account_exists_notice' | 'organization_invitation' | 'new_device_sign_in' | 'session_revoked_token_reuse' | 'account_locked' | 'account_secured' | 'team_member_added' | 'team_role_changed' | 'email_changed' | 'verification_link' | 'password_reset_link' | 'account_reactivated';
+export type EmailTemplateName = 'verification_code' | 'magic_link' | 'password_reset' | 'password_changed' | 'account_exists_notice' | 'organization_invitation' | 'new_device_sign_in' | 'session_revoked_token_reuse' | 'account_locked' | 'account_secured' | 'team_member_added' | 'team_role_changed' | 'email_changed' | 'email_change_confirm' | 'parental_consent_request' | 'phone_changed' | 'identity_linked' | 'identity_unlinked' | 'passkey_added' | 'passkey_removed' | 'recovery_codes_regenerated' | 'factor_removed' | 'device_key_added' | 'device_key_removed' | 'risk_alert' | 'verification_link' | 'password_reset_link' | 'account_reactivated';
 /** The customizable body of a template: a subject line and a text body. */
 export interface EmailTemplateBody {
     subject?: string;

package/dist/client/email-templates.js.map

@@ -1 +1 @@
-{"version":3,"file":"email-templates.js","sourceRoot":"","sources":["../../src/client/email-templates.ts"],"names":[],"mappings":";;AA6DA,wDAkBC;AA/ED,uCAAgD;AA6DhD,SAAgB,sBAAsB,CAAC,OAAkB;IACvD,OAAO;QACL,IAAI;YACF,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,qBAAqB,EAAE,CAAC,CAAC;QACjE,CAAC;QACD,2EAA2E;QAC3E,OAAO,CAAC,IAAY,EAAE,OAA0B,EAAE;YAChD,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,uBAAuB,IAAA,aAAG,EAAC,IAAI,CAAC,UAAU,EAAE,IAAI,EAAE,CAAC,CAAC;QAC7F,CAAC;QACD,2DAA2D;QAC3D,MAAM,CAAC,IAAY,EAAE,IAAuB;YAC1C,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,uBAAuB,IAAA,aAAG,EAAC,IAAI,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;QACpF,CAAC;QACD,8BAA8B;QAC9B,MAAM,CAAC,IAAY;YACjB,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,uBAAuB,IAAA,aAAG,EAAC,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC;QACjF,CAAC;KACF,CAAC;AACJ,CAAC"}
+{"version":3,"file":"email-templates.js","sourceRoot":"","sources":["../../src/client/email-templates.ts"],"names":[],"mappings":";;AAyEA,wDAkBC;AA3FD,uCAAgD;AAyEhD,SAAgB,sBAAsB,CAAC,OAAkB;IACvD,OAAO;QACL,IAAI;YACF,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,qBAAqB,EAAE,CAAC,CAAC;QACjE,CAAC;QACD,2EAA2E;QAC3E,OAAO,CAAC,IAAY,EAAE,OAA0B,EAAE;YAChD,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,uBAAuB,IAAA,aAAG,EAAC,IAAI,CAAC,UAAU,EAAE,IAAI,EAAE,CAAC,CAAC;QAC7F,CAAC;QACD,2DAA2D;QAC3D,MAAM,CAAC,IAAY,EAAE,IAAuB;YAC1C,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,uBAAuB,IAAA,aAAG,EAAC,IAAI,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;QACpF,CAAC;QACD,8BAA8B;QAC9B,MAAM,CAAC,IAAY;YACjB,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,uBAAuB,IAAA,aAAG,EAAC,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC;QACjF,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/client/flags.d.ts

@@ -0,0 +1,101 @@
+import { type RequestFn } from './request';
+import type { CursorParams } from './types';
+export type FeatureFlagType = 'boolean' | 'string' | 'int' | 'json';
+export type FeatureFlagValue = boolean | string | number | Record<string, unknown> | unknown[];
+/** Who a flag is evaluated for. `user_id` (else `org_id`) seeds percentage rollouts. */
+export interface FeatureFlagSubject {
+    user_id?: string | null;
+    org_id?: string | null;
+    plan?: string | null;
+}
+/** Every given `match` dimension must hold; an empty rule matches everyone. */
+export interface FeatureFlagRule {
+    match?: {
+        user_ids?: string[];
+        org_ids?: string[];
+        plans?: string[];
+    };
+    /** 0–100: the share of matching subjects, stable per flag and subject. */
+    percentage?: number;
+    value: FeatureFlagValue;
+}
+export interface FeatureFlag {
+    object: 'feature_flag';
+    id: string;
+    key: string;
+    type: FeatureFlagType;
+    description: string | null;
+    enabled: boolean;
+    default_value: FeatureFlagValue;
+    /** Returned while the flag is switched off. */
+    off_value: FeatureFlagValue;
+    rules: FeatureFlagRule[];
+    created_at: number;
+    updated_at: number;
+}
+export interface CreateFeatureFlagBody {
+    key: string;
+    type: FeatureFlagType;
+    default_value: FeatureFlagValue;
+    description?: string;
+    enabled?: boolean;
+    off_value?: FeatureFlagValue;
+    rules?: FeatureFlagRule[];
+}
+export type UpdateFeatureFlagBody = Partial<Omit<CreateFeatureFlagBody, 'key' | 'type'>>;
+export interface FeatureFlagEvaluation {
+    object: 'feature_flag_evaluation';
+    subject: FeatureFlagSubject;
+    flags: Record<string, {
+        value: FeatureFlagValue;
+        reason: string;
+    }>;
+}
+export interface AssignEntitlementsBody {
+    plan?: string | null;
+    features?: string[] | null;
+    limits?: Record<string, unknown> | null;
+    /** Epoch ms; omit for open-ended. */
+    expires_at?: number | null;
+}
+export interface AssignedEntitlements {
+    object: 'assigned_entitlements';
+    subject_type: 'user' | 'org';
+    subject_id: string;
+    plan: string | null;
+    features: string[] | null;
+    limits: Record<string, unknown> | null;
+    expires_at: number | null;
+}
+/** Evaluate a flag definition for a subject (first matching in-bucket rule wins, else the default). */
+export declare function evaluateFeatureFlag(flag: FeatureFlag, subject: FeatureFlagSubject): FeatureFlagValue;
+export declare function flagsResource(request: RequestFn, cacheTtlMs?: number): {
+    create(body: CreateFeatureFlagBody, idempotencyKey?: string): Promise<FeatureFlag>;
+    /** `starting_after` is the key of the last flag of the previous page. */
+    list(params?: CursorParams): Promise<{
+        object: "list";
+        data: FeatureFlag[];
+        has_more: boolean;
+    }>;
+    retrieve(key: string): Promise<FeatureFlag>;
+    update(key: string, body: UpdateFeatureFlagBody): Promise<FeatureFlag>;
+    delete(key: string): Promise<{
+        object: "feature_flag";
+        id: string;
+        key: string;
+        deleted: boolean;
+    }>;
+    /** Server-side evaluation; `plan` defaults to the org's (else the user's) resolved plan. */
+    evaluate(body: FeatureFlagSubject & {
+        keys?: string[];
+    }): Promise<FeatureFlagEvaluation>;
+    /** Local evaluation against cached definitions. `plan` is not looked up here — pass it for plan rules. */
+    get<T extends FeatureFlagValue>(key: string, subject: FeatureFlagSubject, fallback: T): Promise<T>;
+    /** True only for a boolean flag that evaluates to true; an unknown flag is false. */
+    isEnabled(key: string, subject?: FeatureFlagSubject): Promise<boolean>;
+    /** Drop the cached definitions (e.g. after changing a flag). */
+    invalidate(): void;
+    /** Replace the entitlements assigned to an organization (an empty body clears them). */
+    assignOrganizationEntitlements(orgId: string, body: AssignEntitlementsBody): Promise<AssignedEntitlements>;
+    assignUserEntitlements(userId: string, body: AssignEntitlementsBody): Promise<AssignedEntitlements>;
+};