@atlasauth/backend 0.23.0 → 0.25.0

package/dist/client/network-acls.d.ts

@@ -12,6 +12,8 @@ export interface NetworkAcl {
     action: NetworkAclAction;
     /** A single IP or CIDR range; refused at write time if malformed. */
     cidr: string;
+    /** The network zone this rule matches instead of `cidr`. */
+    zone_id: string | null;
     description: string | null;
     priority: number;
     enabled: boolean;
@@ -20,7 +22,9 @@ export interface NetworkAcl {
 }
 export interface CreateNetworkAclBody {
     action: NetworkAclAction;
-    cidr: string;
+    /** A CIDR or address — or send `zone_id` instead (one of the two). */
+    cidr?: string;
+    zone_id?: string;
     description?: string | null;
     priority?: number;
     enabled?: boolean;
@@ -28,6 +32,7 @@ export interface CreateNetworkAclBody {
 export interface UpdateNetworkAclBody {
     action?: NetworkAclAction;
     cidr?: string;
+    zone_id?: string | null;
     description?: string | null;
     priority?: number;
     enabled?: boolean;

package/dist/client/network-acls.js.map

@@ -1 +1 @@
-{"version":3,"file":"network-acls.js","sourceRoot":"","sources":["../../src/client/network-acls.ts"],"names":[],"mappings":";;AA2CA,kDAmBC;AA9DD,uCAAgD;AAuChD;;;GAGG;AACH,SAAgB,mBAAmB,CAAC,OAAkB;IACpD,OAAO;QACL,qDAAqD;QACrD,IAAI;YACF,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,kBAAkB,EAAE,CAAC,CAAC;QAC9D,CAAC;QACD,GAAG,CAAC,EAAU;YACZ,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,oBAAoB,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;QACzE,CAAC;QACD,MAAM,CAAC,IAA0B,EAAE,cAAuB;YACxD,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,kBAAkB,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC;QACrF,CAAC;QACD,MAAM,CAAC,EAAU,EAAE,IAA0B;YAC3C,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,oBAAoB,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;QACjF,CAAC;QACD,MAAM,CAAC,EAAU;YACf,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,oBAAoB,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;QAC5E,CAAC;KACF,CAAC;AACJ,CAAC"}
+{"version":3,"file":"network-acls.js","sourceRoot":"","sources":["../../src/client/network-acls.ts"],"names":[],"mappings":";;AAgDA,kDAmBC;AAnED,uCAAgD;AA4ChD;;;GAGG;AACH,SAAgB,mBAAmB,CAAC,OAAkB;IACpD,OAAO;QACL,qDAAqD;QACrD,IAAI;YACF,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,kBAAkB,EAAE,CAAC,CAAC;QAC9D,CAAC;QACD,GAAG,CAAC,EAAU;YACZ,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,oBAAoB,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;QACzE,CAAC;QACD,MAAM,CAAC,IAA0B,EAAE,cAAuB;YACxD,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,kBAAkB,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC;QACrF,CAAC;QACD,MAAM,CAAC,EAAU,EAAE,IAA0B;YAC3C,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,oBAAoB,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;QACjF,CAAC;QACD,MAAM,CAAC,EAAU;YACf,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,oBAAoB,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;QAC5E,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/client/network-zones.d.ts

@@ -0,0 +1,56 @@
+import { type RequestFn } from './request';
+import type { ListPage } from './types';
+export type NetworkZoneAnonymizer = 'tor' | 'datacenter' | 'vpn';
+/**
+ * A reusable network zone: a union of CIDR ranges, ISO countries, ASNs and
+ * anonymizer classes. Network ACL rules reference one by `zone_id`.
+ */
+export interface NetworkZone {
+    object: 'network_zone';
+    id: string;
+    name: string;
+    description: string | null;
+    cidrs: string[];
+    countries: string[];
+    asns: number[];
+    anonymizers: NetworkZoneAnonymizer[];
+    enabled: boolean;
+    created_at: number;
+    updated_at: number;
+}
+export interface CreateNetworkZoneBody {
+    name: string;
+    description?: string | null;
+    cidrs?: string[];
+    countries?: string[];
+    asns?: number[];
+    anonymizers?: NetworkZoneAnonymizer[];
+    enabled?: boolean;
+}
+export type UpdateNetworkZoneBody = Partial<CreateNetworkZoneBody>;
+export interface NetworkZoneCheck {
+    object: 'network_zone_check';
+    zone_id: string;
+    ip: string;
+    matches: boolean;
+    facts: {
+        country: string | null;
+        asn: number | null;
+        tor: boolean | null;
+        datacenter: boolean | null;
+    };
+}
+/** CRUD over the instance's network zones, plus a what-if `check` for one address. */
+export declare function networkZonesResource(request: RequestFn): {
+    list(): Promise<ListPage<NetworkZone>>;
+    get(id: string): Promise<NetworkZone>;
+    create(body: CreateNetworkZoneBody, idempotencyKey?: string): Promise<NetworkZone>;
+    update(id: string, body: UpdateNetworkZoneBody): Promise<NetworkZone>;
+    delete(id: string): Promise<{
+        object: "network_zone";
+        id: string;
+        deleted: true;
+    }>;
+    /** Does `ip` fall inside the zone? Returns the resolved facts too. */
+    check(id: string, ip: string): Promise<NetworkZoneCheck>;
+};

package/dist/client/network-zones.js

@@ -0,0 +1,29 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.networkZonesResource = networkZonesResource;
+const request_1 = require("./request");
+/** CRUD over the instance's network zones, plus a what-if `check` for one address. */
+function networkZonesResource(request) {
+    return {
+        list() {
+            return request({ method: 'GET', path: '/v1/network_zones' });
+        },
+        get(id) {
+            return request({ method: 'GET', path: `/v1/network_zones/${(0, request_1.enc)(id)}` });
+        },
+        create(body, idempotencyKey) {
+            return request({ method: 'POST', path: '/v1/network_zones', body, idempotencyKey });
+        },
+        update(id, body) {
+            return request({ method: 'PATCH', path: `/v1/network_zones/${(0, request_1.enc)(id)}`, body });
+        },
+        delete(id) {
+            return request({ method: 'DELETE', path: `/v1/network_zones/${(0, request_1.enc)(id)}` });
+        },
+        /** Does `ip` fall inside the zone? Returns the resolved facts too. */
+        check(id, ip) {
+            return request({ method: 'POST', path: `/v1/network_zones/${(0, request_1.enc)(id)}/check`, body: { ip } });
+        },
+    };
+}
+//# sourceMappingURL=network-zones.js.map

package/dist/client/network-zones.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"network-zones.js","sourceRoot":"","sources":["../../src/client/network-zones.ts"],"names":[],"mappings":";;AA4CA,oDAsBC;AAlED,uCAAgD;AA2ChD,sFAAsF;AACtF,SAAgB,oBAAoB,CAAC,OAAkB;IACrD,OAAO;QACL,IAAI;YACF,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,mBAAmB,EAAE,CAAC,CAAC;QAC/D,CAAC;QACD,GAAG,CAAC,EAAU;YACZ,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,qBAAqB,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;QAC1E,CAAC;QACD,MAAM,CAAC,IAA2B,EAAE,cAAuB;YACzD,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,mBAAmB,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC;QACtF,CAAC;QACD,MAAM,CAAC,EAAU,EAAE,IAA2B;YAC5C,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,qBAAqB,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;QAClF,CAAC;QACD,MAAM,CAAC,EAAU;YACf,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,qBAAqB,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;QAC7E,CAAC;QACD,sEAAsE;QACtE,KAAK,CAAC,EAAU,EAAE,EAAU;YAC1B,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,qBAAqB,IAAA,aAAG,EAAC,EAAE,CAAC,QAAQ,EAAE,IAAI,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC;QAC/F,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/client/notifications.d.ts

@@ -1,6 +1,6 @@
 import { type RequestFn } from './request';
 /** Built-in notification templates `send` falls back to when no tenant template has the name. */
-export type BuiltInNotificationTemplate = 'new_device' | 'unattended_access' | 'password_changed' | 'mfa_changed' | 'email_changed';
+export type BuiltInNotificationTemplate = 'new_device' | 'unattended_access' | 'password_changed' | 'mfa_changed' | 'email_changed' | 'phone_changed' | 'identity_linked' | 'identity_unlinked' | 'passkey_added' | 'passkey_removed' | 'recovery_codes_regenerated' | 'factor_removed' | 'device_key_added' | 'device_key_removed' | 'risk_alert';
 export interface SendNotificationBody {
     /** The end-user to notify. */
     user_id: string;

package/dist/client/notifications.js.map

@@ -1 +1 @@
-{"version":3,"file":"notifications.js","sourceRoot":"","sources":["../../src/client/notifications.ts"],"names":[],"mappings":";;AAkEA,sDAqDC;AAvHD,uCAAgD;AAkEhD,SAAgB,qBAAqB,CAAC,OAAkB;IACtD,OAAO;QACL,2FAA2F;QAC3F,IAAI,CAAC,IAA0B,EAAE,cAAuB;YACtD,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,mBAAmB,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC;QACtF,CAAC;QACD,UAAU,EAAE;YACV,IAAI;gBACF,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,6BAA6B,EAAE,CAAC,CAAC;YACzE,CAAC;YACD,4CAA4C;YAC5C,MAAM,CAAC,IAAoC;gBACzC,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,6BAA6B,EAAE,IAAI,EAAE,CAAC,CAAC;YAChF,CAAC;YACD,MAAM,CAAC,GAAW,EAAE,IAAuB;gBACzC,OAAO,OAAO,CAAC;oBACb,MAAM,EAAE,KAAK;oBACb,IAAI,EAAE,+BAA+B,IAAA,aAAG,EAAC,GAAG,CAAC,EAAE;oBAC/C,IAAI;iBACL,CAAC,CAAC;YACL,CAAC;YACD,yDAAyD;YACzD,MAAM,CACJ,GAAW;gBAEX,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,+BAA+B,IAAA,aAAG,EAAC,GAAG,CAAC,EAAE,EAAE,CAAC,CAAC;YACxF,CAAC;SACF;QACD,SAAS,EAAE;YACT,IAAI;gBACF,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,4BAA4B,EAAE,CAAC,CAAC;YACxE,CAAC;YACD,iCAAiC;YACjC,MAAM,CAAC,IAAoC;gBACzC,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,4BAA4B,EAAE,IAAI,EAAE,CAAC,CAAC;YAC/E,CAAC;YACD,GAAG,CAAC,IAAY;gBACd,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,8BAA8B,IAAA,aAAG,EAAC,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC;YACrF,CAAC;YACD,MAAM,CAAC,IAAY,EAAE,IAAoC;gBACvD,OAAO,OAAO,CAAC;oBACb,MAAM,EAAE,KAAK;oBACb,IAAI,EAAE,8BAA8B,IAAA,aAAG,EAAC,IAAI,CAAC,EAAE;oBAC/C,IAAI;iBACL,CAAC,CAAC;YACL,CAAC;YACD,MAAM,CACJ,IAAY;gBAEZ,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,8BAA8B,IAAA,aAAG,EAAC,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC;YACxF,CAAC;SACF;KACF,CAAC;AACJ,CAAC"}
+{"version":3,"file":"notifications.js","sourceRoot":"","sources":["../../src/client/notifications.ts"],"names":[],"mappings":";;AA4EA,sDAqDC;AAjID,uCAAgD;AA4EhD,SAAgB,qBAAqB,CAAC,OAAkB;IACtD,OAAO;QACL,2FAA2F;QAC3F,IAAI,CAAC,IAA0B,EAAE,cAAuB;YACtD,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,mBAAmB,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC;QACtF,CAAC;QACD,UAAU,EAAE;YACV,IAAI;gBACF,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,6BAA6B,EAAE,CAAC,CAAC;YACzE,CAAC;YACD,4CAA4C;YAC5C,MAAM,CAAC,IAAoC;gBACzC,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,6BAA6B,EAAE,IAAI,EAAE,CAAC,CAAC;YAChF,CAAC;YACD,MAAM,CAAC,GAAW,EAAE,IAAuB;gBACzC,OAAO,OAAO,CAAC;oBACb,MAAM,EAAE,KAAK;oBACb,IAAI,EAAE,+BAA+B,IAAA,aAAG,EAAC,GAAG,CAAC,EAAE;oBAC/C,IAAI;iBACL,CAAC,CAAC;YACL,CAAC;YACD,yDAAyD;YACzD,MAAM,CACJ,GAAW;gBAEX,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,+BAA+B,IAAA,aAAG,EAAC,GAAG,CAAC,EAAE,EAAE,CAAC,CAAC;YACxF,CAAC;SACF;QACD,SAAS,EAAE;YACT,IAAI;gBACF,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,4BAA4B,EAAE,CAAC,CAAC;YACxE,CAAC;YACD,iCAAiC;YACjC,MAAM,CAAC,IAAoC;gBACzC,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,4BAA4B,EAAE,IAAI,EAAE,CAAC,CAAC;YAC/E,CAAC;YACD,GAAG,CAAC,IAAY;gBACd,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,8BAA8B,IAAA,aAAG,EAAC,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC;YACrF,CAAC;YACD,MAAM,CAAC,IAAY,EAAE,IAAoC;gBACvD,OAAO,OAAO,CAAC;oBACb,MAAM,EAAE,KAAK;oBACb,IAAI,EAAE,8BAA8B,IAAA,aAAG,EAAC,IAAI,CAAC,EAAE;oBAC/C,IAAI;iBACL,CAAC,CAAC;YACL,CAAC;YACD,MAAM,CACJ,IAAY;gBAEZ,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,8BAA8B,IAAA,aAAG,EAAC,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC;YACxF,CAAC;SACF;KACF,CAAC;AACJ,CAAC"}

package/dist/client/oauth-clients.d.ts

@@ -1,6 +1,46 @@
 import { type ProvisioningFields, type ProvisioningInput, type ProvisioningMetadata } from './compliance';
 import { type RequestFn } from './request';
 import type { ListPage } from './types';
+export interface TrustedIssuer {
+    object: 'oauth_trusted_issuer';
+    id: string;
+    client_id: string;
+    issuer: string;
+    jwks: {
+        keys: unknown[];
+    } | null;
+    jwks_uri: string | null;
+    subject_mapping: 'user_id' | 'external_id' | 'email';
+    workload_kind: 'generic' | 'spiffe' | 'kubernetes' | 'github_actions' | 'gcp' | 'azure';
+    purpose: 'user_assertion' | 'client_auth' | 'both';
+    subject_pattern: string | null;
+    required_claims: Record<string, string> | null;
+    audiences: string[] | null;
+    created_at: number;
+}
+export interface TrustedIssuerInput {
+    issuer?: string;
+    jwks?: {
+        keys: unknown[];
+    };
+    jwks_uri?: string;
+    subject_mapping?: 'user_id' | 'external_id' | 'email';
+    workload_kind?: TrustedIssuer['workload_kind'];
+    tenant_id?: string;
+    purpose?: TrustedIssuer['purpose'];
+    subject_pattern?: string;
+    required_claims?: Record<string, string>;
+    audiences?: string[];
+}
+export interface WorkloadPreset {
+    object: 'workload_identity_preset';
+    kind: string;
+    title: string;
+    issuer: string | null;
+    jwks_uri: string | null;
+    subject_example: string;
+    notes: string;
+}
 export interface OAuthClient extends ProvisioningFields {
     object: 'oauth_client';
     id: string;
@@ -10,7 +50,7 @@ export interface OAuthClient extends ProvisioningFields {
     redirect_uris: string[];
     allowed_scopes: string[];
     grant_types: string[];
-    token_endpoint_auth_method: 'client_secret_basic' | 'client_secret_post' | 'none';
+    token_endpoint_auth_method: 'client_secret_basic' | 'client_secret_post' | 'none' | 'private_key_jwt' | 'workload_jwt';
     secret_prefix: string | null;
     /**
      * After a rotation with overlap: when the previous secret stops working (epoch
@@ -160,7 +200,7 @@ export interface CreateOAuthClientBody extends ProvisioningInput, OAuthClientLog
     redirect_uris: string[];
     allowed_scopes?: string[];
     grant_types?: string[];
-    token_endpoint_auth_method?: 'client_secret_basic' | 'client_secret_post' | 'none';
+    token_endpoint_auth_method?: 'client_secret_basic' | 'client_secret_post' | 'none' | 'workload_jwt';
     logo_url?: string;
     first_party?: boolean;
     /** How long the issued secret authenticates, in seconds; omit for no expiry. */
@@ -174,7 +214,7 @@ export interface UpdateOAuthClientBody extends OAuthClientLogoutFields, OAuthCli
     name?: string;
     redirect_uris?: string[];
     allowed_scopes?: string[];
-    token_endpoint_auth_method?: 'client_secret_basic' | 'client_secret_post' | 'none';
+    token_endpoint_auth_method?: 'client_secret_basic' | 'client_secret_post' | 'none' | 'workload_jwt';
     logo_url?: string | null;
     first_party?: boolean;
     /** Refuse every OAuth flow for this client without deleting it. */
@@ -280,10 +320,50 @@ export declare function oauthClientsResource(request: RequestFn): {
         deleted: true;
         note: string;
     }>;
+    /**
+     * Per-application settings: allowed sign-in methods, hosted-page branding,
+     * the user-claim allow-list for ID tokens and userinfo, and writable traits.
+     */
+    appSettings: {
+        /** `GET /v1/oauth_clients/:id/app_settings` */
+        get(id: string): Promise<OAuthClientAppSettings>;
+        /** `PATCH /v1/oauth_clients/:id/app_settings` — fields sent replace the stored ones; null clears. */
+        update(id: string, body: OAuthClientAppSettingsPatch): Promise<OAuthClientAppSettings>;
+    };
     /** The client's back-channel logout delivery log, newest first. */
     listBackchannelDeliveries(id: string, query?: BackchannelDeliveriesQuery): Promise<BackchannelLogoutDeliveryPage>;
     /** Send a test back-channel logout now and return what the receiver answered. */
     testBackchannelLogout(id: string): Promise<BackchannelLogoutTest>;
+    /** Set (or clear with null) the URLs of your own sign-in and consent pages for a client. */
+    setDelegatedUi(id: string, body: {
+        login_url?: string | null;
+        consent_url?: string | null;
+    }): Promise<{
+        object: "oauth_client_delegated_ui";
+        client_id: string;
+        login_url: string | null;
+        consent_url: string | null;
+    }>;
+    /** Delegated login: read, accept or reject the `login_challenge` your sign-in page received. */
+    loginRequests: {
+        get(loginChallenge: string): Promise<DelegatedLoginRequest>;
+        accept(loginChallenge: string, body: {
+            subject: string;
+            remember?: boolean;
+            amr?: string[];
+            acr?: string;
+        }): Promise<DelegatedRedirect>;
+        reject(loginChallenge: string, body?: DelegatedReject): Promise<DelegatedRedirect>;
+    };
+    /** Delegated consent: read, accept or reject the `consent_challenge` your consent page received. */
+    consentRequests: {
+        get(consentChallenge: string): Promise<DelegatedConsentRequest>;
+        accept(consentChallenge: string, body?: {
+            grant_scope?: string[];
+            remember?: boolean;
+        }): Promise<DelegatedRedirect>;
+        reject(consentChallenge: string, body?: DelegatedReject): Promise<DelegatedRedirect>;
+    };
     /** RFC 7591 §3 initial access tokens for dynamic client registration. */
     initialAccessTokens: {
         list(): Promise<ListPage<OAuthInitialAccessToken>>;
@@ -294,6 +374,26 @@ export declare function oauthClientsResource(request: RequestFn): {
         }>;
         revoke(id: string): Promise<OAuthInitialAccessToken>;
     };
+    /** Issuers whose signed tokens this client accepts (jwt-bearer grant, workload identity). */
+    trustedIssuers: {
+        list(clientId: string): Promise<ListPage<TrustedIssuer>>;
+        create(clientId: string, body: TrustedIssuerInput): Promise<TrustedIssuer>;
+        delete(clientId: string, issuerId: string): Promise<{
+            object: "oauth_trusted_issuer";
+            id: string;
+            deleted: true;
+        }>;
+    };
+    /** Workload identity federation helpers (SPIFFE, Kubernetes, GitHub Actions, GCP, Azure). */
+    workloadIdentity: {
+        presets(): Promise<ListPage<WorkloadPreset>>;
+        cloudTrust(query: {
+            provider: "aws" | "gcp" | "azure";
+            audience: string;
+            subject: string;
+            tenant_id?: string;
+        }): Promise<Record<string, unknown>>;
+    };
     grants: {
         list(clientId: string): Promise<ListPage<ClientGrant>>;
         create(clientId: string, body: {
@@ -307,3 +407,83 @@ export declare function oauthClientsResource(request: RequestFn): {
         }>;
     };
 };
+export interface OAuthClientAppBranding {
+    heading?: string | null;
+    subheading?: string | null;
+    logo_url?: string | null;
+    primary_color?: string | null;
+}
+export interface OAuthClientAppSettingsPatch {
+    /** Method names (password, passkey, oauth_google, ...) or the families oauth and enterprise_sso. */
+    allowed_sign_in_methods?: string[] | null;
+    branding?: OAuthClientAppBranding | null;
+    /** User claims the app receives in ID tokens and userinfo; protocol claims always pass. */
+    claims_allowlist?: string[] | null;
+    /** Traits a session from this app may change. */
+    writable_traits?: string[] | null;
+    /** Overrides of the instance's risk-based MFA for sign-ins to this app. */
+    risk?: OAuthClientAppRisk | null;
+}
+export type OAuthClientRiskLevelAction = 'default' | 'allow' | 'notify' | 'mfa' | 'block';
+export interface OAuthClientAppRisk {
+    enabled?: boolean | null;
+    mode?: 'enforce' | 'audit' | null;
+    step_up_threshold?: 'low' | 'medium' | 'high' | null;
+    on_high_risk_no_factor?: 'allow' | 'block' | 'require_enroll' | null;
+    level_actions?: {
+        medium?: OAuthClientRiskLevelAction | null;
+        high?: OAuthClientRiskLevelAction | null;
+    } | null;
+    /** The refresh-time check for sessions that came from this app. */
+    mid_session?: {
+        enabled?: boolean | null;
+        action?: 'revoke' | 'notify' | 'audit' | null;
+    } | null;
+}
+export interface OAuthClientAppSettings {
+    object: 'app_settings';
+    client_id: string;
+    allowed_sign_in_methods: string[] | null;
+    branding: Required<OAuthClientAppBranding> | null;
+    claims_allowlist: string[] | null;
+    writable_traits: string[] | null;
+    risk: OAuthClientAppRisk | null;
+}
+export interface DelegatedClientRef {
+    id: string;
+    client_id: string;
+    name: string;
+    first_party?: boolean;
+}
+export interface DelegatedLoginRequest {
+    object: 'oauth_login_request';
+    client: DelegatedClientRef;
+    requested_scope: string[];
+    audience: string | null;
+    page: 'sign-in' | 'sign-up';
+    /** The Atlas user already signed in on this browser, if any. */
+    session_subject: string | null;
+    ui_locales: string | null;
+    login_hint: string | null;
+    expires_at: number;
+}
+export interface DelegatedConsentRequest {
+    object: 'oauth_consent_request';
+    subject: string;
+    client: DelegatedClientRef;
+    requested_scope: string[];
+    audience: string | null;
+    authorization_details: unknown[];
+    organization_id: string | null;
+    redirect_uri: string;
+    expires_at: number;
+}
+export interface DelegatedRedirect {
+    object: 'oauth_login_redirect' | 'oauth_consent_redirect';
+    /** Send the end user's browser here next. */
+    redirect_to: string;
+}
+export interface DelegatedReject {
+    error?: 'access_denied' | 'login_required' | 'interaction_required' | 'consent_required' | 'account_selection_required' | 'unauthorized_client' | 'temporarily_unavailable' | 'server_error';
+    error_description?: string;
+}

package/dist/client/oauth-clients.js

@@ -37,6 +37,20 @@ function oauthClientsResource(request) {
         delete(id) {
             return request({ method: 'DELETE', path: `/v1/oauth_clients/${(0, request_1.enc)(id)}` });
         },
+        /**
+         * Per-application settings: allowed sign-in methods, hosted-page branding,
+         * the user-claim allow-list for ID tokens and userinfo, and writable traits.
+         */
+        appSettings: {
+            /** `GET /v1/oauth_clients/:id/app_settings` */
+            get(id) {
+                return request({ method: 'GET', path: `/v1/oauth_clients/${(0, request_1.enc)(id)}/app_settings` });
+            },
+            /** `PATCH /v1/oauth_clients/:id/app_settings` — fields sent replace the stored ones; null clears. */
+            update(id, body) {
+                return request({ method: 'PATCH', path: `/v1/oauth_clients/${(0, request_1.enc)(id)}/app_settings`, body });
+            },
+        },
         /** The client's back-channel logout delivery log, newest first. */
         listBackchannelDeliveries(id, query = {}) {
             return request({
@@ -49,6 +63,34 @@ function oauthClientsResource(request) {
         testBackchannelLogout(id) {
             return request({ method: 'POST', path: `/v1/oauth_clients/${(0, request_1.enc)(id)}/backchannel_logout/test` });
         },
+        /** Set (or clear with null) the URLs of your own sign-in and consent pages for a client. */
+        setDelegatedUi(id, body) {
+            return request({ method: 'PUT', path: `/v1/oauth_clients/${(0, request_1.enc)(id)}/delegated_ui`, body });
+        },
+        /** Delegated login: read, accept or reject the `login_challenge` your sign-in page received. */
+        loginRequests: {
+            get(loginChallenge) {
+                return request({ method: 'GET', path: '/v1/oauth_login_requests', query: { login_challenge: loginChallenge } });
+            },
+            accept(loginChallenge, body) {
+                return request({ method: 'PUT', path: '/v1/oauth_login_requests/accept', query: { login_challenge: loginChallenge }, body });
+            },
+            reject(loginChallenge, body = {}) {
+                return request({ method: 'PUT', path: '/v1/oauth_login_requests/reject', query: { login_challenge: loginChallenge }, body });
+            },
+        },
+        /** Delegated consent: read, accept or reject the `consent_challenge` your consent page received. */
+        consentRequests: {
+            get(consentChallenge) {
+                return request({ method: 'GET', path: '/v1/oauth_consent_requests', query: { consent_challenge: consentChallenge } });
+            },
+            accept(consentChallenge, body = {}) {
+                return request({ method: 'PUT', path: '/v1/oauth_consent_requests/accept', query: { consent_challenge: consentChallenge }, body });
+            },
+            reject(consentChallenge, body = {}) {
+                return request({ method: 'PUT', path: '/v1/oauth_consent_requests/reject', query: { consent_challenge: consentChallenge }, body });
+            },
+        },
         /** RFC 7591 §3 initial access tokens for dynamic client registration. */
         initialAccessTokens: {
             list() {
@@ -62,6 +104,28 @@ function oauthClientsResource(request) {
                 return request({ method: 'DELETE', path: `/v1/oauth_initial_access_tokens/${(0, request_1.enc)(id)}` });
             },
         },
+        /** Issuers whose signed tokens this client accepts (jwt-bearer grant, workload identity). */
+        trustedIssuers: {
+            list(clientId) {
+                return request({ method: 'GET', path: `/v1/oauth_clients/${(0, request_1.enc)(clientId)}/trusted_issuers` });
+            },
+            create(clientId, body) {
+                return request({ method: 'POST', path: `/v1/oauth_clients/${(0, request_1.enc)(clientId)}/trusted_issuers`, body });
+            },
+            delete(clientId, issuerId) {
+                return request({ method: 'DELETE', path: `/v1/oauth_clients/${(0, request_1.enc)(clientId)}/trusted_issuers/${(0, request_1.enc)(issuerId)}` });
+            },
+        },
+        /** Workload identity federation helpers (SPIFFE, Kubernetes, GitHub Actions, GCP, Azure). */
+        workloadIdentity: {
+            presets() {
+                return request({ method: 'GET', path: '/v1/workload_identity/presets' });
+            },
+            cloudTrust(query) {
+                const qs = new URLSearchParams(query).toString();
+                return request({ method: 'GET', path: `/v1/workload_identity/cloud_trust?${qs}` });
+            },
+        },
         grants: {
             list(clientId) {
                 return request({ method: 'GET', path: `/v1/oauth_clients/${(0, request_1.enc)(clientId)}/grants` });

package/dist/client/oauth-clients.js.map

@@ -1 +1 @@
-{"version":3,"file":"oauth-clients.js","sourceRoot":"","sources":["../../src/client/oauth-clients.ts"],"names":[],"mappings":";;AAoRA,oDAgGC;AApXD,6CAAyH;AACzH,uCAAgD;AAmRhD,SAAgB,oBAAoB,CAAC,OAAkB;IACrD,OAAO;QACL,qFAAqF;QACrF,MAAM,CACJ,IAA2C,EAC3C,cAAuB;YAEvB,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,0BAA0B,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC;QAC7F,CAAC;QACD,wEAAwE;QACxE,IAAI,CAAC,SAA8C,EAAE;YACnD,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,mBAAmB,EAAE,KAAK,EAAE,IAAA,0BAAa,EAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;QACtG,CAAC;QACD,GAAG,CAAC,EAAU;YACZ,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,qBAAqB,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;QAC1E,CAAC;QACD,MAAM,CAAC,IAA2B,EAAE,cAAuB;YACzD,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,mBAAmB,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC;QACtF,CAAC;QACD,MAAM,CAAC,EAAU,EAAE,IAA2B;YAC5C,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,qBAAqB,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;QAClF,CAAC;QACD;;;WAGG;QACH,YAAY,CACV,EAAU,EACV,OAAoC,EAAE,EACtC,cAAuB;YAEvB,OAAO,OAAO,CAAC;gBACb,MAAM,EAAE,MAAM;gBACd,IAAI,EAAE,qBAAqB,IAAA,aAAG,EAAC,EAAE,CAAC,gBAAgB;gBAClD,IAAI;gBACJ,cAAc;aACf,CAAC,CAAC;QACL,CAAC;QACD,MAAM,CAAC,EAAU;YACf,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,qBAAqB,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;QAC7E,CAAC;QACD,mEAAmE;QACnE,yBAAyB,CACvB,EAAU,EACV,QAAoC,EAAE;YAEtC,OAAO,OAAO,CAAC;gBACb,MAAM,EAAE,KAAK;gBACb,IAAI,EAAE,qBAAqB,IAAA,aAAG,EAAC,EAAE,CAAC,yBAAyB;gBAC3D,KAAK,EAAE,EAAE,GAAG,KAAK,EAAE;aACpB,CAAC,CAAC;QACL,CAAC;QACD,iFAAiF;QACjF,qBAAqB,CAAC,EAAU;YAC9B,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,qBAAqB,IAAA,aAAG,EAAC,EAAE,CAAC,0BAA0B,EAAE,CAAC,CAAC;QACnG,CAAC;QAED,yEAAyE;QACzE,mBAAmB,EAAE;YACnB,IAAI;gBACF,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,iCAAiC,EAAE,CAAC,CAAC;YAC7E,CAAC;YACD,4CAA4C;YAC5C,MAAM,CAAC,OAAqC,EAAE;gBAC5C,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,iCAAiC,EAAE,IAAI,EAAE,CAAC,CAAC;YACpF,CAAC;YACD,MAAM,CAAC,EAAU;gBACf,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,mCAAmC,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;YAC3F,CAAC;SACF;QAED,MAAM,EAAE;YACN,IAAI,CAAC,QAAgB;gBACnB,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,qBAAqB,IAAA,aAAG,EAAC,QAAQ,CAAC,SAAS,EAAE,CAAC,CAAC;YACvF,CAAC;YACD,MAAM,CACJ,QAAgB,EAChB,IAAuD;gBAEvD,OAAO,OAAO,CAAC;oBACb,MAAM,EAAE,MAAM;oBACd,IAAI,EAAE,qBAAqB,IAAA,aAAG,EAAC,QAAQ,CAAC,SAAS;oBACjD,IAAI;iBACL,CAAC,CAAC;YACL,CAAC;YACD,MAAM,CACJ,QAAgB,EAChB,OAAe;gBAEf,OAAO,OAAO,CAAC;oBACb,MAAM,EAAE,QAAQ;oBAChB,IAAI,EAAE,qBAAqB,IAAA,aAAG,EAAC,QAAQ,CAAC,WAAW,IAAA,aAAG,EAAC,OAAO,CAAC,EAAE;iBAClE,CAAC,CAAC;YACL,CAAC;SACF;KACF,CAAC;AACJ,CAAC"}
+{"version":3,"file":"oauth-clients.js","sourceRoot":"","sources":["../../src/client/oauth-clients.ts"],"names":[],"mappings":";;AA2TA,oDAyKC;AApeD,6CAAyH;AACzH,uCAAgD;AA0ThD,SAAgB,oBAAoB,CAAC,OAAkB;IACrD,OAAO;QACL,qFAAqF;QACrF,MAAM,CACJ,IAA2C,EAC3C,cAAuB;YAEvB,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,0BAA0B,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC;QAC7F,CAAC;QACD,wEAAwE;QACxE,IAAI,CAAC,SAA8C,EAAE;YACnD,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,mBAAmB,EAAE,KAAK,EAAE,IAAA,0BAAa,EAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;QACtG,CAAC;QACD,GAAG,CAAC,EAAU;YACZ,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,qBAAqB,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;QAC1E,CAAC;QACD,MAAM,CAAC,IAA2B,EAAE,cAAuB;YACzD,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,mBAAmB,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC;QACtF,CAAC;QACD,MAAM,CAAC,EAAU,EAAE,IAA2B;YAC5C,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,qBAAqB,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;QAClF,CAAC;QACD;;;WAGG;QACH,YAAY,CACV,EAAU,EACV,OAAoC,EAAE,EACtC,cAAuB;YAEvB,OAAO,OAAO,CAAC;gBACb,MAAM,EAAE,MAAM;gBACd,IAAI,EAAE,qBAAqB,IAAA,aAAG,EAAC,EAAE,CAAC,gBAAgB;gBAClD,IAAI;gBACJ,cAAc;aACf,CAAC,CAAC;QACL,CAAC;QACD,MAAM,CAAC,EAAU;YACf,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,qBAAqB,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;QAC7E,CAAC;QACD;;;WAGG;QACH,WAAW,EAAE;YACX,+CAA+C;YAC/C,GAAG,CAAC,EAAU;gBACZ,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,qBAAqB,IAAA,aAAG,EAAC,EAAE,CAAC,eAAe,EAAE,CAAC,CAAC;YACvF,CAAC;YACD,qGAAqG;YACrG,MAAM,CAAC,EAAU,EAAE,IAAiC;gBAClD,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,qBAAqB,IAAA,aAAG,EAAC,EAAE,CAAC,eAAe,EAAE,IAAI,EAAE,CAAC,CAAC;YAC/F,CAAC;SACF;QACD,mEAAmE;QACnE,yBAAyB,CACvB,EAAU,EACV,QAAoC,EAAE;YAEtC,OAAO,OAAO,CAAC;gBACb,MAAM,EAAE,KAAK;gBACb,IAAI,EAAE,qBAAqB,IAAA,aAAG,EAAC,EAAE,CAAC,yBAAyB;gBAC3D,KAAK,EAAE,EAAE,GAAG,KAAK,EAAE;aACpB,CAAC,CAAC;QACL,CAAC;QACD,iFAAiF;QACjF,qBAAqB,CAAC,EAAU;YAC9B,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,qBAAqB,IAAA,aAAG,EAAC,EAAE,CAAC,0BAA0B,EAAE,CAAC,CAAC;QACnG,CAAC;QAED,4FAA4F;QAC5F,cAAc,CACZ,EAAU,EACV,IAAgE;YAEhE,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,qBAAqB,IAAA,aAAG,EAAC,EAAE,CAAC,eAAe,EAAE,IAAI,EAAE,CAAC,CAAC;QAC7F,CAAC;QACD,gGAAgG;QAChG,aAAa,EAAE;YACb,GAAG,CAAC,cAAsB;gBACxB,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,0BAA0B,EAAE,KAAK,EAAE,EAAE,eAAe,EAAE,cAAc,EAAE,EAAE,CAAC,CAAC;YAClH,CAAC;YACD,MAAM,CACJ,cAAsB,EACtB,IAA2E;gBAE3E,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,iCAAiC,EAAE,KAAK,EAAE,EAAE,eAAe,EAAE,cAAc,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;YAC/H,CAAC;YACD,MAAM,CAAC,cAAsB,EAAE,OAAwB,EAAE;gBACvD,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,iCAAiC,EAAE,KAAK,EAAE,EAAE,eAAe,EAAE,cAAc,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;YAC/H,CAAC;SACF;QACD,oGAAoG;QACpG,eAAe,EAAE;YACf,GAAG,CAAC,gBAAwB;gBAC1B,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,4BAA4B,EAAE,KAAK,EAAE,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,EAAE,CAAC,CAAC;YACxH,CAAC;YACD,MAAM,CAAC,gBAAwB,EAAE,OAAuD,EAAE;gBACxF,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,mCAAmC,EAAE,KAAK,EAAE,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;YACrI,CAAC;YACD,MAAM,CAAC,gBAAwB,EAAE,OAAwB,EAAE;gBACzD,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,mCAAmC,EAAE,KAAK,EAAE,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;YACrI,CAAC;SACF;QAED,yEAAyE;QACzE,mBAAmB,EAAE;YACnB,IAAI;gBACF,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,iCAAiC,EAAE,CAAC,CAAC;YAC7E,CAAC;YACD,4CAA4C;YAC5C,MAAM,CAAC,OAAqC,EAAE;gBAC5C,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,iCAAiC,EAAE,IAAI,EAAE,CAAC,CAAC;YACpF,CAAC;YACD,MAAM,CAAC,EAAU;gBACf,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,mCAAmC,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;YAC3F,CAAC;SACF;QAED,6FAA6F;QAC7F,cAAc,EAAE;YACd,IAAI,CAAC,QAAgB;gBACnB,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,qBAAqB,IAAA,aAAG,EAAC,QAAQ,CAAC,kBAAkB,EAAE,CAAC,CAAC;YAChG,CAAC;YACD,MAAM,CAAC,QAAgB,EAAE,IAAwB;gBAC/C,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,qBAAqB,IAAA,aAAG,EAAC,QAAQ,CAAC,kBAAkB,EAAE,IAAI,EAAE,CAAC,CAAC;YACvG,CAAC;YACD,MAAM,CAAC,QAAgB,EAAE,QAAgB;gBACvC,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,qBAAqB,IAAA,aAAG,EAAC,QAAQ,CAAC,oBAAoB,IAAA,aAAG,EAAC,QAAQ,CAAC,EAAE,EAAE,CAAC,CAAC;YACpH,CAAC;SACF;QAED,6FAA6F;QAC7F,gBAAgB,EAAE;YAChB,OAAO;gBACL,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,+BAA+B,EAAE,CAAC,CAAC;YAC3E,CAAC;YACD,UAAU,CAAC,KAAmG;gBAC5G,MAAM,EAAE,GAAG,IAAI,eAAe,CAAC,KAA+B,CAAC,CAAC,QAAQ,EAAE,CAAC;gBAC3E,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,qCAAqC,EAAE,EAAE,EAAE,CAAC,CAAC;YACrF,CAAC;SACF;QAED,MAAM,EAAE;YACN,IAAI,CAAC,QAAgB;gBACnB,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,qBAAqB,IAAA,aAAG,EAAC,QAAQ,CAAC,SAAS,EAAE,CAAC,CAAC;YACvF,CAAC;YACD,MAAM,CACJ,QAAgB,EAChB,IAAuD;gBAEvD,OAAO,OAAO,CAAC;oBACb,MAAM,EAAE,MAAM;oBACd,IAAI,EAAE,qBAAqB,IAAA,aAAG,EAAC,QAAQ,CAAC,SAAS;oBACjD,IAAI;iBACL,CAAC,CAAC;YACL,CAAC;YACD,MAAM,CACJ,QAAgB,EAChB,OAAe;gBAEf,OAAO,OAAO,CAAC;oBACb,MAAM,EAAE,QAAQ;oBAChB,IAAI,EAAE,qBAAqB,IAAA,aAAG,EAAC,QAAQ,CAAC,WAAW,IAAA,aAAG,EAAC,OAAO,CAAC,EAAE;iBAClE,CAAC,CAAC;YACL,CAAC;SACF;KACF,CAAC;AACJ,CAAC"}

package/dist/client/org-role-grants.d.ts

@@ -0,0 +1,57 @@
+import { type RequestFn } from './request';
+import type { ListPage } from './types';
+export interface OrgRoleGrant {
+    object: 'org_role_grant';
+    id: string;
+    grantor_org_id: string;
+    grantee_org_id: string;
+    role_keys: string[];
+    status: 'active' | 'revoked';
+    created_at: number;
+    revoked_at: number | null;
+}
+export interface OrgRoleDelegation {
+    object: 'org_role_delegation';
+    id: string;
+    grant_id: string;
+    user_id: string;
+    role_key: string;
+    created_at: number;
+}
+export interface EffectiveDelegatedRole {
+    organization_id: string;
+    grant_id: string;
+    role_key: string;
+    permissions: string[];
+}
+export declare function orgRoleGrantsResource(request: RequestFn): {
+    list(query?: {
+        grantor_org_id?: string;
+        grantee_org_id?: string;
+        status?: "active";
+    }): Promise<ListPage<OrgRoleGrant>>;
+    create(body: {
+        grantor_org_id: string;
+        grantee_org_id: string;
+        role_keys: string[];
+    }): Promise<OrgRoleGrant>;
+    get(id: string): Promise<OrgRoleGrant>;
+    update(id: string, body: {
+        role_keys: string[];
+    }): Promise<OrgRoleGrant>;
+    revoke(id: string): Promise<OrgRoleGrant>;
+    listDelegations(id: string): Promise<ListPage<OrgRoleDelegation>>;
+    delegate(id: string, body: {
+        user_id: string;
+        role_key: string;
+    }): Promise<OrgRoleDelegation>;
+    undelegate(id: string, delegationId: string): Promise<{
+        object: "org_role_delegation";
+        id: string;
+        deleted: true;
+    }>;
+    effective(query: {
+        user_id: string;
+        organization_id?: string;
+    }): Promise<ListPage<EffectiveDelegatedRole>>;
+};

package/dist/client/org-role-grants.js

@@ -0,0 +1,40 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.orgRoleGrantsResource = orgRoleGrantsResource;
+const request_1 = require("./request");
+const qs = (query) => {
+    const q = new URLSearchParams(Object.entries(query).filter((e) => e[1] !== undefined)).toString();
+    return q ? `?${q}` : '';
+};
+function orgRoleGrantsResource(request) {
+    return {
+        list(query = {}) {
+            return request({ method: 'GET', path: `/v1/org_role_grants${qs(query)}` });
+        },
+        create(body) {
+            return request({ method: 'POST', path: '/v1/org_role_grants', body });
+        },
+        get(id) {
+            return request({ method: 'GET', path: `/v1/org_role_grants/${(0, request_1.enc)(id)}` });
+        },
+        update(id, body) {
+            return request({ method: 'PATCH', path: `/v1/org_role_grants/${(0, request_1.enc)(id)}`, body });
+        },
+        revoke(id) {
+            return request({ method: 'DELETE', path: `/v1/org_role_grants/${(0, request_1.enc)(id)}` });
+        },
+        listDelegations(id) {
+            return request({ method: 'GET', path: `/v1/org_role_grants/${(0, request_1.enc)(id)}/delegations` });
+        },
+        delegate(id, body) {
+            return request({ method: 'POST', path: `/v1/org_role_grants/${(0, request_1.enc)(id)}/delegations`, body });
+        },
+        undelegate(id, delegationId) {
+            return request({ method: 'DELETE', path: `/v1/org_role_grants/${(0, request_1.enc)(id)}/delegations/${(0, request_1.enc)(delegationId)}` });
+        },
+        effective(query) {
+            return request({ method: 'GET', path: `/v1/org_role_grants/effective${qs(query)}` });
+        },
+    };
+}
+//# sourceMappingURL=org-role-grants.js.map

package/dist/client/org-role-grants.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"org-role-grants.js","sourceRoot":"","sources":["../../src/client/org-role-grants.ts"],"names":[],"mappings":";;AAmCA,sDA8BC;AAjED,uCAAgD;AA8BhD,MAAM,EAAE,GAAG,CAAC,KAAyC,EAAE,EAAE;IACvD,MAAM,CAAC,GAAG,IAAI,eAAe,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAyB,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,SAAS,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC;IACzH,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;AAC1B,CAAC,CAAC;AAEF,SAAgB,qBAAqB,CAAC,OAAkB;IACtD,OAAO;QACL,IAAI,CAAC,QAAiF,EAAE;YACtF,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,sBAAsB,EAAE,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC,CAAC;QAC7E,CAAC;QACD,MAAM,CAAC,IAA6E;YAClF,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,qBAAqB,EAAE,IAAI,EAAE,CAAC,CAAC;QACxE,CAAC;QACD,GAAG,CAAC,EAAU;YACZ,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,uBAAuB,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;QAC5E,CAAC;QACD,MAAM,CAAC,EAAU,EAAE,IAA6B;YAC9C,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,uBAAuB,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;QACpF,CAAC;QACD,MAAM,CAAC,EAAU;YACf,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,uBAAuB,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;QAC/E,CAAC;QACD,eAAe,CAAC,EAAU;YACxB,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,uBAAuB,IAAA,aAAG,EAAC,EAAE,CAAC,cAAc,EAAE,CAAC,CAAC;QACxF,CAAC;QACD,QAAQ,CAAC,EAAU,EAAE,IAA2C;YAC9D,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,uBAAuB,IAAA,aAAG,EAAC,EAAE,CAAC,cAAc,EAAE,IAAI,EAAE,CAAC,CAAC;QAC/F,CAAC;QACD,UAAU,CAAC,EAAU,EAAE,YAAoB;YACzC,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,uBAAuB,IAAA,aAAG,EAAC,EAAE,CAAC,gBAAgB,IAAA,aAAG,EAAC,YAAY,CAAC,EAAE,EAAE,CAAC,CAAC;QAChH,CAAC;QACD,SAAS,CAAC,KAAoD;YAC5D,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,gCAAgC,EAAE,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC,CAAC;QACvF,CAAC;KACF,CAAC;AACJ,CAAC"}