@atlasauth/backend 0.24.0 → 0.25.0

package/CHANGELOG.md

@@ -2,6 +2,13 @@
 
 ## Unreleased
 
+## 0.25.0 — 2026-10-26
+
+### Added
+
+- `mfaFactors` client resource for the additional authentication factors: `setYubicoSecret` / `removeYubicoSecret`, `setDuoSecret` / `removeDuoSecret` / `duoHealthCheck`, `setSmartCardSecret` / `removeSmartCardSecret` (all write-only), `yubikeys` (`list`, `register`, `remove`), `smartCardMappings` (`list`, `add`, `remove`) and `resetSecurityQuestions`.
+- `users.create({ mfa })` is typed (`ImportedMfa`): an authenticator (`totp`: SHA-1/256/512, 6 or 8 digits, 30 or 60 seconds) or a counter-based token (`hotp`), plus recovery codes.
+
 ## 0.24.0 — 2026-10-25
 
 ### Added

package/dist/client/abac.d.ts

@@ -0,0 +1,132 @@
+import { type RequestFn } from './request';
+import type { ListPage } from './types';
+export interface AbacPolicyTestCase {
+    name: string;
+    /** principal, action, resource, context and optional entities. */
+    request: Record<string, unknown>;
+    expect: 'allow' | 'deny';
+}
+/** An ABAC policy: named, versioned source in the Cedar-subset policy language. */
+export interface AbacPolicy {
+    object: 'abac_policy';
+    id: string;
+    name: string;
+    description: string | null;
+    enabled: boolean;
+    current_version: number;
+    /** The FGA store `fga.check(...)` in the source consults. */
+    fga_store_id: string | null;
+    source: string;
+    tests: AbacPolicyTestCase[];
+    created_at: number;
+    updated_at: number;
+}
+export interface AbacPolicyVersion {
+    object: 'abac_policy_version';
+    policy_id: string;
+    version: number;
+    source: string;
+    tests: AbacPolicyTestCase[];
+    current: boolean;
+    created_at: number;
+}
+export interface CreateAbacPolicyBody {
+    name: string;
+    description?: string | null;
+    enabled?: boolean;
+    fga_store_id?: string | null;
+    source: string;
+    tests?: AbacPolicyTestCase[];
+}
+/** Sending `source` appends a new version; `current_version` (without source) rolls back. */
+export type UpdateAbacPolicyBody = Partial<CreateAbacPolicyBody> & {
+    current_version?: number;
+};
+export interface AbacEntity {
+    type: string;
+    id: string;
+    attributes?: Record<string, unknown>;
+    /** `Type::id` uids this entity is a member of (for `in`). */
+    parents?: string[];
+}
+export interface AbacEvaluateBody {
+    principal: AbacEntity;
+    action: string;
+    resource: AbacEntity;
+    context?: Record<string, unknown>;
+    entities?: AbacEntity[];
+    /** Evaluate only these policies (default: every enabled one). */
+    policy_ids?: string[];
+}
+export interface AbacDecision {
+    object: 'abac_decision';
+    decision: 'allow' | 'deny';
+    reasons: string[];
+    errors: string[];
+}
+export interface AbacTestRun {
+    object: 'abac_policy_test_run';
+    passed: boolean;
+    results: Array<{
+        name: string;
+        expect: 'allow' | 'deny';
+        actual: 'allow' | 'deny';
+        passed: boolean;
+    }>;
+}
+export interface AuthzenEvaluation {
+    subject?: {
+        type: string;
+        id: string;
+        properties?: Record<string, unknown>;
+    };
+    resource?: {
+        type: string;
+        id: string;
+        properties?: Record<string, unknown>;
+    };
+    action?: {
+        name: string;
+        properties?: Record<string, unknown>;
+    };
+    context?: Record<string, unknown>;
+}
+/** ABAC policies and the policy decision point (including the AuthZEN endpoints). */
+export declare function abacResource(request: RequestFn): {
+    list(): Promise<ListPage<AbacPolicy>>;
+    get(id: string): Promise<AbacPolicy>;
+    create(body: CreateAbacPolicyBody, idempotencyKey?: string): Promise<AbacPolicy>;
+    update(id: string, body: UpdateAbacPolicyBody): Promise<AbacPolicy>;
+    delete(id: string): Promise<{
+        object: "abac_policy";
+        id: string;
+        deleted: true;
+    }>;
+    versions(id: string): Promise<ListPage<AbacPolicyVersion>>;
+    /** Run a version's tests (default: current), or a draft `source` and `tests`, without saving. */
+    test(id: string, body?: {
+        version?: number;
+        source?: string;
+        tests?: AbacPolicyTestCase[];
+    }): Promise<AbacTestRun>;
+    /** May `principal` perform `action` on `resource`? */
+    evaluate(body: AbacEvaluateBody): Promise<AbacDecision>;
+    /** Convenience: the boolean answer to {@link evaluate}. */
+    isAllowed(body: AbacEvaluateBody): Promise<boolean>;
+    /** AuthZEN 1.0 Access Evaluation. */
+    authzenEvaluation(body: AuthzenEvaluation): Promise<{
+        decision: boolean;
+        context?: Record<string, unknown>;
+    }>;
+    /** AuthZEN 1.0 Access Evaluations (batch). */
+    authzenEvaluations(body: AuthzenEvaluation & {
+        evaluations?: AuthzenEvaluation[];
+        options?: {
+            evaluations_semantic?: "execute_all" | "deny_on_first_deny" | "permit_on_first_permit";
+        };
+    }): Promise<{
+        evaluations: Array<{
+            decision: boolean;
+        }>;
+    }>;
+};

package/dist/client/abac.js

@@ -0,0 +1,48 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.abacResource = abacResource;
+const request_1 = require("./request");
+/** ABAC policies and the policy decision point (including the AuthZEN endpoints). */
+function abacResource(request) {
+    return {
+        list() {
+            return request({ method: 'GET', path: '/v1/abac_policies' });
+        },
+        get(id) {
+            return request({ method: 'GET', path: `/v1/abac_policies/${(0, request_1.enc)(id)}` });
+        },
+        create(body, idempotencyKey) {
+            return request({ method: 'POST', path: '/v1/abac_policies', body, idempotencyKey });
+        },
+        update(id, body) {
+            return request({ method: 'PATCH', path: `/v1/abac_policies/${(0, request_1.enc)(id)}`, body });
+        },
+        delete(id) {
+            return request({ method: 'DELETE', path: `/v1/abac_policies/${(0, request_1.enc)(id)}` });
+        },
+        versions(id) {
+            return request({ method: 'GET', path: `/v1/abac_policies/${(0, request_1.enc)(id)}/versions` });
+        },
+        /** Run a version's tests (default: current), or a draft `source` and `tests`, without saving. */
+        test(id, body = {}) {
+            return request({ method: 'POST', path: `/v1/abac_policies/${(0, request_1.enc)(id)}/test`, body });
+        },
+        /** May `principal` perform `action` on `resource`? */
+        evaluate(body) {
+            return request({ method: 'POST', path: '/v1/abac/evaluate', body });
+        },
+        /** Convenience: the boolean answer to {@link evaluate}. */
+        async isAllowed(body) {
+            return (await request({ method: 'POST', path: '/v1/abac/evaluate', body })).decision === 'allow';
+        },
+        /** AuthZEN 1.0 Access Evaluation. */
+        authzenEvaluation(body) {
+            return request({ method: 'POST', path: '/v1/authzen/access/v1/evaluation', body });
+        },
+        /** AuthZEN 1.0 Access Evaluations (batch). */
+        authzenEvaluations(body) {
+            return request({ method: 'POST', path: '/v1/authzen/access/v1/evaluations', body });
+        },
+    };
+}
+//# sourceMappingURL=abac.js.map

package/dist/client/abac.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"abac.js","sourceRoot":"","sources":["../../src/client/abac.ts"],"names":[],"mappings":";;AAuFA,oCA2CC;AAlID,uCAAgD;AAsFhD,qFAAqF;AACrF,SAAgB,YAAY,CAAC,OAAkB;IAC7C,OAAO;QACL,IAAI;YACF,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,mBAAmB,EAAE,CAAC,CAAC;QAC/D,CAAC;QACD,GAAG,CAAC,EAAU;YACZ,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,qBAAqB,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;QAC1E,CAAC;QACD,MAAM,CAAC,IAA0B,EAAE,cAAuB;YACxD,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,mBAAmB,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC;QACtF,CAAC;QACD,MAAM,CAAC,EAAU,EAAE,IAA0B;YAC3C,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,qBAAqB,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;QAClF,CAAC;QACD,MAAM,CAAC,EAAU;YACf,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,qBAAqB,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;QAC7E,CAAC;QACD,QAAQ,CAAC,EAAU;YACjB,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,qBAAqB,IAAA,aAAG,EAAC,EAAE,CAAC,WAAW,EAAE,CAAC,CAAC;QACnF,CAAC;QACD,iGAAiG;QACjG,IAAI,CAAC,EAAU,EAAE,OAA4E,EAAE;YAC7F,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,qBAAqB,IAAA,aAAG,EAAC,EAAE,CAAC,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;QACtF,CAAC;QACD,sDAAsD;QACtD,QAAQ,CAAC,IAAsB;YAC7B,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,mBAAmB,EAAE,IAAI,EAAE,CAAC,CAAC;QACtE,CAAC;QACD,2DAA2D;QAC3D,KAAK,CAAC,SAAS,CAAC,IAAsB;YACpC,OAAO,CAAC,MAAM,OAAO,CAAe,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,mBAAmB,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,OAAO,CAAC;QACjH,CAAC;QACD,qCAAqC;QACrC,iBAAiB,CAAC,IAAuB;YACvC,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,kCAAkC,EAAE,IAAI,EAAE,CAAC,CAAC;QACrF,CAAC;QACD,8CAA8C;QAC9C,kBAAkB,CAChB,IAAqK;YAErK,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,mCAAmC,EAAE,IAAI,EAAE,CAAC,CAAC;QACtF,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/client/access-policies.d.ts

@@ -0,0 +1,100 @@
+import { type RequestFn } from './request';
+import type { ListPage } from './types';
+export type AccessPolicyStage = 'sign_in' | 'authorize' | 'token';
+export type AccessPolicyGrantType = 'allow' | 'block' | 'require_mfa' | 'require_acr' | 'require_policy_acceptance' | 'require_action';
+export interface AccessPolicyGrant {
+    type: AccessPolicyGrantType;
+    /** require_acr: the acr; require_policy_acceptance: the policy key; require_action: the action name. */
+    value?: string;
+}
+/** Every present condition must match; an absent one matches anything. */
+export interface AccessPolicyConditions {
+    applications?: string[];
+    userIds?: string[];
+    groups?: string[];
+    orgs?: string[];
+    roles?: string[];
+    networkZones?: {
+        include?: string[];
+        exclude?: string[];
+    };
+    countries?: string[];
+    riskLevels?: Array<'low' | 'medium' | 'high'>;
+    deviceTrust?: Array<'trusted' | 'untrusted' | 'unknown'>;
+    authMethods?: string[];
+    timeWindow?: {
+        days?: number[];
+        start: string;
+        end: string;
+        timezone?: string;
+    };
+}
+/** A conditional-access policy, evaluated at sign-in, /authorize and token issuance. */
+export interface AccessPolicy {
+    object: 'access_policy';
+    id: string;
+    name: string;
+    description: string | null;
+    enabled: boolean;
+    priority: number;
+    stages: AccessPolicyStage[];
+    conditions: AccessPolicyConditions;
+    grants: AccessPolicyGrant[];
+    created_at: number;
+    updated_at: number;
+}
+export interface CreateAccessPolicyBody {
+    name: string;
+    description?: string | null;
+    enabled?: boolean;
+    priority?: number;
+    stages?: AccessPolicyStage[];
+    conditions?: AccessPolicyConditions;
+    grants: AccessPolicyGrant[];
+}
+export type UpdateAccessPolicyBody = Partial<CreateAccessPolicyBody>;
+export interface SimulateAccessBody {
+    policy_id?: string;
+    stage?: AccessPolicyStage;
+    ip?: string;
+    application_id?: string;
+    user_id?: string;
+    groups?: string[];
+    orgs?: string[];
+    roles?: string[];
+    country?: string;
+    risk_level?: 'low' | 'medium' | 'high';
+    device_trust?: 'trusted' | 'untrusted' | 'unknown';
+    auth_methods?: string[];
+    mfa_verified?: boolean;
+    acr?: string[];
+    /** Epoch ms; default now. */
+    now?: number;
+}
+export interface AccessPolicySimulation {
+    object: 'access_policy_simulation';
+    decision: 'allow' | 'block' | 'step_up';
+    matched: string[];
+    blocked_by: string | null;
+    requirements: {
+        mfa: boolean;
+        acr: string[];
+        policy_acceptance: string[];
+        actions: string[];
+    };
+    unmet: string[];
+}
+/** CRUD over conditional-access policies, plus a what-if `simulate`. */
+export declare function accessPoliciesResource(request: RequestFn): {
+    list(): Promise<ListPage<AccessPolicy>>;
+    get(id: string): Promise<AccessPolicy>;
+    create(body: CreateAccessPolicyBody, idempotencyKey?: string): Promise<AccessPolicy>;
+    update(id: string, body: UpdateAccessPolicyBody): Promise<AccessPolicy>;
+    delete(id: string): Promise<{
+        object: "access_policy";
+        id: string;
+        deleted: true;
+    }>;
+    /** What would the policies decide for this request? */
+    simulate(body: SimulateAccessBody): Promise<AccessPolicySimulation>;
+};

package/dist/client/access-policies.js

@@ -0,0 +1,29 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.accessPoliciesResource = accessPoliciesResource;
+const request_1 = require("./request");
+/** CRUD over conditional-access policies, plus a what-if `simulate`. */
+function accessPoliciesResource(request) {
+    return {
+        list() {
+            return request({ method: 'GET', path: '/v1/access_policies' });
+        },
+        get(id) {
+            return request({ method: 'GET', path: `/v1/access_policies/${(0, request_1.enc)(id)}` });
+        },
+        create(body, idempotencyKey) {
+            return request({ method: 'POST', path: '/v1/access_policies', body, idempotencyKey });
+        },
+        update(id, body) {
+            return request({ method: 'PATCH', path: `/v1/access_policies/${(0, request_1.enc)(id)}`, body });
+        },
+        delete(id) {
+            return request({ method: 'DELETE', path: `/v1/access_policies/${(0, request_1.enc)(id)}` });
+        },
+        /** What would the policies decide for this request? */
+        simulate(body) {
+            return request({ method: 'POST', path: '/v1/access_policies/simulate', body });
+        },
+    };
+}
+//# sourceMappingURL=access-policies.js.map

package/dist/client/access-policies.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"access-policies.js","sourceRoot":"","sources":["../../src/client/access-policies.ts"],"names":[],"mappings":";;AAmFA,wDAsBC;AAzGD,uCAAgD;AAkFhD,wEAAwE;AACxE,SAAgB,sBAAsB,CAAC,OAAkB;IACvD,OAAO;QACL,IAAI;YACF,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,qBAAqB,EAAE,CAAC,CAAC;QACjE,CAAC;QACD,GAAG,CAAC,EAAU;YACZ,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,uBAAuB,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;QAC5E,CAAC;QACD,MAAM,CAAC,IAA4B,EAAE,cAAuB;YAC1D,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,qBAAqB,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC;QACxF,CAAC;QACD,MAAM,CAAC,EAAU,EAAE,IAA4B;YAC7C,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,uBAAuB,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;QACpF,CAAC;QACD,MAAM,CAAC,EAAU;YACf,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,uBAAuB,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;QAC/E,CAAC;QACD,uDAAuD;QACvD,QAAQ,CAAC,IAAwB;YAC/B,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,8BAA8B,EAAE,IAAI,EAAE,CAAC,CAAC;QACjF,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/client/action-gallery.d.ts

@@ -7,7 +7,7 @@ import type { ListPage } from './types';
  * actions up to date, and publish your own templates for review.
  */
 /** Every trigger a template can target (a superset of the classic three). */
-export type GalleryTrigger = ActionTrigger | 'pre_organization_create' | 'pre_member_add' | 'pre_invitation_create';
+export type GalleryTrigger = ActionTrigger;
 /** A secret a template reads, declared by NAME; values are never part of a template. */
 export interface ActionTemplateSecret {
     name: string;

package/dist/client/action-gallery.js.map

@@ -1 +1 @@
-{"version":3,"file":"action-gallery.js","sourceRoot":"","sources":["../../src/client/action-gallery.ts"],"names":[],"mappings":";;AA6LA,sDAuBC;AAED,0DAmCC;AAzPD,uCAAgD;AA6LhD,SAAgB,qBAAqB,CAAC,OAAkB;IACtD,OAAO;QACL,+BAA+B;QAC/B,IAAI,CAAC,SAA8B,EAAE;YACnC,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,oBAAoB,EAAE,KAAK,EAAE,EAAE,GAAG,MAAM,EAAE,EAAE,CAAC,CAAC;QACtF,CAAC;QACD,6DAA6D;QAC7D,GAAG,CAAC,IAAY;YACd,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,sBAAsB,IAAA,aAAG,EAAC,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC;QAC7E,CAAC;QACD,kFAAkF;QAClF,OAAO,CAAC,IAAY,EAAE,OAA4B,EAAE,EAAE,cAAuB;YAC3E,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,sBAAsB,IAAA,aAAG,EAAC,IAAI,CAAC,UAAU,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC;QAC5G,CAAC;QACD,8DAA8D;QAC9D,QAAQ;YACN,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,6BAA6B,EAAE,CAAC,CAAC;QACzE,CAAC;QACD,iEAAiE;QACjE,MAAM,CAAC,QAAgB,EAAE,OAA6C,EAAE;YACtE,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,eAAe,IAAA,aAAG,EAAC,QAAQ,CAAC,iBAAiB,EAAE,IAAI,EAAE,CAAC,CAAC;QAChG,CAAC;KACF,CAAC;AACJ,CAAC;AAED,SAAgB,uBAAuB,CAAC,OAAkB;IACxD,OAAO;QACL,IAAI;YACF,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,sBAAsB,EAAE,CAAC,CAAC;QAClE,CAAC;QACD,MAAM,CAAC,IAA8B,EAAE,cAAuB;YAC5D,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,sBAAsB,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC;QACzF,CAAC;QACD,GAAG,CAAC,EAAU;YACZ,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,wBAAwB,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;QAC7E,CAAC;QACD,MAAM,CAAC,EAAU,EAAE,IAA2B;YAC5C,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,wBAAwB,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;QACrF,CAAC;QACD,MAAM,CAAC,EAAU;YACf,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,wBAAwB,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;QAChF,CAAC;QACD,UAAU,CAAC,EAAU,EAAE,IAAwB;YAC7C,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,wBAAwB,IAAA,aAAG,EAAC,EAAE,CAAC,WAAW,EAAE,IAAI,EAAE,CAAC,CAAC;QAC7F,CAAC;QACD,aAAa,CAAC,EAAU,EAAE,OAAe;YACvC,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,wBAAwB,IAAA,aAAG,EAAC,EAAE,CAAC,aAAa,IAAA,aAAG,EAAC,OAAO,CAAC,SAAS,EAAE,CAAC,CAAC;QAC9G,CAAC;QACD,aAAa,CAAC,EAAU,EAAE,OAAe;YACvC,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,wBAAwB,IAAA,aAAG,EAAC,EAAE,CAAC,aAAa,IAAA,aAAG,EAAC,OAAO,CAAC,EAAE,EAAE,CAAC,CAAC;QACzG,CAAC;QACD,0DAA0D;QAC1D,OAAO,CAAC,EAAU;YAChB,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,wBAAwB,IAAA,aAAG,EAAC,EAAE,CAAC,UAAU,EAAE,CAAC,CAAC;QACtF,CAAC;QACD,gEAAgE;QAChE,MAAM,CAAC,EAAU;YACf,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,wBAAwB,IAAA,aAAG,EAAC,EAAE,CAAC,SAAS,EAAE,CAAC,CAAC;QACrF,CAAC;KACF,CAAC;AACJ,CAAC"}
+{"version":3,"file":"action-gallery.js","sourceRoot":"","sources":["../../src/client/action-gallery.ts"],"names":[],"mappings":";;AAyLA,sDAuBC;AAED,0DAmCC;AArPD,uCAAgD;AAyLhD,SAAgB,qBAAqB,CAAC,OAAkB;IACtD,OAAO;QACL,+BAA+B;QAC/B,IAAI,CAAC,SAA8B,EAAE;YACnC,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,oBAAoB,EAAE,KAAK,EAAE,EAAE,GAAG,MAAM,EAAE,EAAE,CAAC,CAAC;QACtF,CAAC;QACD,6DAA6D;QAC7D,GAAG,CAAC,IAAY;YACd,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,sBAAsB,IAAA,aAAG,EAAC,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC;QAC7E,CAAC;QACD,kFAAkF;QAClF,OAAO,CAAC,IAAY,EAAE,OAA4B,EAAE,EAAE,cAAuB;YAC3E,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,sBAAsB,IAAA,aAAG,EAAC,IAAI,CAAC,UAAU,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC;QAC5G,CAAC;QACD,8DAA8D;QAC9D,QAAQ;YACN,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,6BAA6B,EAAE,CAAC,CAAC;QACzE,CAAC;QACD,iEAAiE;QACjE,MAAM,CAAC,QAAgB,EAAE,OAA6C,EAAE;YACtE,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,eAAe,IAAA,aAAG,EAAC,QAAQ,CAAC,iBAAiB,EAAE,IAAI,EAAE,CAAC,CAAC;QAChG,CAAC;KACF,CAAC;AACJ,CAAC;AAED,SAAgB,uBAAuB,CAAC,OAAkB;IACxD,OAAO;QACL,IAAI;YACF,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,sBAAsB,EAAE,CAAC,CAAC;QAClE,CAAC;QACD,MAAM,CAAC,IAA8B,EAAE,cAAuB;YAC5D,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,sBAAsB,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC;QACzF,CAAC;QACD,GAAG,CAAC,EAAU;YACZ,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,wBAAwB,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;QAC7E,CAAC;QACD,MAAM,CAAC,EAAU,EAAE,IAA2B;YAC5C,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,wBAAwB,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;QACrF,CAAC;QACD,MAAM,CAAC,EAAU;YACf,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,wBAAwB,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;QAChF,CAAC;QACD,UAAU,CAAC,EAAU,EAAE,IAAwB;YAC7C,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,wBAAwB,IAAA,aAAG,EAAC,EAAE,CAAC,WAAW,EAAE,IAAI,EAAE,CAAC,CAAC;QAC7F,CAAC;QACD,aAAa,CAAC,EAAU,EAAE,OAAe;YACvC,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,wBAAwB,IAAA,aAAG,EAAC,EAAE,CAAC,aAAa,IAAA,aAAG,EAAC,OAAO,CAAC,SAAS,EAAE,CAAC,CAAC;QAC9G,CAAC;QACD,aAAa,CAAC,EAAU,EAAE,OAAe;YACvC,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,wBAAwB,IAAA,aAAG,EAAC,EAAE,CAAC,aAAa,IAAA,aAAG,EAAC,OAAO,CAAC,EAAE,EAAE,CAAC,CAAC;QACzG,CAAC;QACD,0DAA0D;QAC1D,OAAO,CAAC,EAAU;YAChB,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,wBAAwB,IAAA,aAAG,EAAC,EAAE,CAAC,UAAU,EAAE,CAAC,CAAC;QACtF,CAAC;QACD,gEAAgE;QAChE,MAAM,CAAC,EAAU;YACf,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,wBAAwB,IAAA,aAAG,EAAC,EAAE,CAAC,SAAS,EAAE,CAAC,CAAC;QACrF,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/client/actions.d.ts

@@ -1,7 +1,7 @@
 import { type RequestFn } from './request';
 import type { ListPage } from './types';
 /** The fixed point in the auth pipeline an action runs at. */
-export type ActionTrigger = 'post_login' | 'pre_user_registration' | 'post_user_registration';
+export type ActionTrigger = 'post_login' | 'pre_user_registration' | 'post_user_registration' | 'pre_organization_create' | 'pre_member_add' | 'pre_invitation_create' | 'pre_authentication' | 'pre_token' | 'post_token_exchange' | 'pre_user_update' | 'mfa_verification_attempt' | 'password_verification_attempt' | 'account_link_decision' | 'billing_plan_selected' | 'post_change_password' | 'post_password_reset' | 'post_user_update' | 'post_email_verified' | 'post_mfa_enroll' | 'post_mfa_remove' | 'post_logout' | 'org_membership_changed' | 'custom_challenge_create' | 'custom_challenge_verify' | 'workflow_step';
 /**
  * Tenant code run in the hardened isolate at a trigger. Secret VALUES are
  * write-only and never returned — a read reports only `secret_names`. Timestamps
@@ -12,27 +12,96 @@ export interface Action {
     id: string;
     name: string;
     trigger: ActionTrigger;
+    /** The JavaScript of a `node` Action; empty for an `http` one. */
     code: string;
-    runtime: string;
+    /** `node` runs `code` in the sandbox; `http` calls `http_target.url`. */
+    runtime: 'node' | 'http' | (string & {});
+    /** An `http` Action's endpoint; null for a `node` one. */
+    http_target: ActionHttpTarget | null;
     enabled: boolean;
     secret_names: string[];
     created_at: number;
     updated_at: number;
 }
+/** Where an `http` Action sends the event. Timestamps are epoch milliseconds. */
+export interface ActionHttpTarget {
+    url: string;
+    /** 500 to 5000; default 3000. */
+    timeout_ms: number;
+    /** What a failed call does: `closed` (default) refuses a gate, `open` carries on. */
+    failure_mode: 'open' | 'closed';
+}
 export interface CreateActionBody {
     name: string;
     trigger: ActionTrigger;
-    code: string;
+    /** Required for a `node` Action; an `http` Action has none. */
+    code?: string;
+    /** `node` (default) or `http`: call your own HTTPS endpoint instead of running code. */
+    runtime?: 'node' | 'http';
+    /** Required when `runtime` is `http`. */
+    http_target?: {
+        url: string;
+        timeout_ms?: number;
+        failure_mode?: 'open' | 'closed';
+    };
+    /** `http` only: your own 16 to 512 character secret. Omit it and Atlas generates one, returned once. */
+    signing_secret?: string;
     enabled?: boolean;
     /** Write-only, encrypted at rest, never read back. */
     secrets?: Record<string, string>;
 }
+/** The create/update response of an `http` Action carries a generated signing secret once. */
+export type ActionWithSecret = Action & {
+    signing_secret?: string;
+};
 export interface UpdateActionBody {
     name?: string;
     code?: string;
+    /** `http` only; omitted settings keep their value. */
+    http_target?: {
+        url?: string;
+        timeout_ms?: number;
+        failure_mode?: 'open' | 'closed';
+    };
+    /** `http` only: replace the signing secret with your own. */
+    signing_secret?: string;
+    /** `http` only: generate a new signing secret, returned once on the response. */
+    rotate_signing_secret?: boolean;
     enabled?: boolean;
     secrets?: Record<string, string>;
 }
+/** One call to an `http` Action's endpoint. */
+export interface ActionHttpCall {
+    object: 'action_http_call';
+    id: string;
+    action_id: string;
+    trigger: ActionTrigger;
+    user_id: string | null;
+    /** A dry-run test call; kept out of the stats. */
+    test: boolean;
+    status: 'ok' | 'denied' | 'timeout' | 'error' | 'invalid_response';
+    http_status: number | null;
+    latency_ms: number | null;
+    error: string | null;
+    /** What the endpoint answered with, reduced to the names it set. */
+    answer: Record<string, unknown> | null;
+    created_at: number;
+}
+export interface ActionHttpCallList {
+    object: 'list';
+    data: ActionHttpCall[];
+    has_more: boolean;
+    next_cursor: string | null;
+    /** Real (non-test) calls in the last 24 hours. */
+    stats: {
+        calls_24h: number;
+        denied_24h: number;
+        failed_24h: number;
+        timeouts_24h: number;
+        p95_latency_ms: number | null;
+        last_failed_at: number | null;
+    };
+}
 /** The sample event a dry-run runs against; every field has a stand-in default. */
 export interface ActionTestEvent {
     user?: {
@@ -50,6 +119,7 @@ export interface ActionTestEvent {
     };
     connection?: {
         strategy?: string;
+        method?: string;
     };
     /** `country` is the ISO code `event.request.country` should carry. */
     request?: {
@@ -57,6 +127,16 @@ export interface ActionTestEvent {
         user_agent?: string;
         country?: string;
     };
+    /** The per-trigger `event.context` (token type, changed fields, MFA result, …). */
+    context?: Record<string, unknown>;
+    /** Registration triggers: the typed sign-up field values (`event.signUpFields`). */
+    sign_up_fields?: Record<string, string>;
+    /** Organization triggers: `event.organization`. */
+    organization?: {
+        id?: string | null;
+        name?: string;
+        slug?: string;
+    };
 }
 /** An outbound request the code queued with `api.http` (a dry run sends nothing). */
 export interface ActionTestHttpRequest {
@@ -68,6 +148,17 @@ export interface ActionTestHttpRequest {
     has_body: boolean;
     save_response_as: string | null;
 }
+/** Edits to the user an Action asked for. */
+export interface ActionUserEdits {
+    banned?: {
+        value: boolean;
+        reason: string | null;
+    };
+    emailVerified?: boolean;
+    firstName?: string | null;
+    lastName?: string | null;
+    imageUrl?: string | null;
+}
 /** What an action produced against a sample event — no real data is touched. */
 export interface ActionTestResult {
     object: 'action_test_result';
@@ -77,8 +168,33 @@ export interface ActionTestResult {
     access_token_claims: Record<string, unknown>;
     id_token_claims: Record<string, unknown>;
     app_metadata: Record<string, unknown>;
+    /** Set when the code called `api.access.lock()`; a real run locks the account for 15 minutes. */
+    lock_reason?: string | null;
+    challenge?: {
+        prompt: string;
+        hint: string | null;
+        state: unknown;
+    } | null;
+    challenge_accepted?: {
+        amr: string[];
+    } | null;
+    /** `pre_token`: the claims the code asked to remove. */
+    suppressed_access_claims?: string[];
+    suppressed_id_claims?: string[];
+    /** An `http` Action only: how the endpoint call went (the test really calls it, flagged `test`). */
+    http_call?: {
+        status: string;
+        http_status: number | null;
+        latency_ms: number | null;
+        error: string | null;
+    };
+    /** `api.user.setBanned/setEmailVerified/setName/setImage`, as a real run would apply them. */
+    user_edits?: ActionUserEdits;
+    /** Registration triggers: `api.signUp.prefill` and `modify`. */
+    sign_up_prefill?: Record<string, string>;
+    sign_up_modify?: Record<string, string>;
     logs: string[];
-    /** What the code queued with `api.http`; sent only on a real post_login / post_user_registration run. */
+    /** What the code queued with `api.http`; sent only on a real run of a post_login or side-effect trigger. */
     http_requests?: ActionTestHttpRequest[];
     error: string | null;
 }
@@ -90,9 +206,9 @@ export interface ActionBindingList {
 }
 export declare function actionsResource(request: RequestFn): {
     list(): Promise<ListPage<Action>>;
-    create(body: CreateActionBody, idempotencyKey?: string): Promise<Action>;
+    create(body: CreateActionBody, idempotencyKey?: string): Promise<ActionWithSecret>;
     get(id: string): Promise<Action>;
-    update(id: string, body: UpdateActionBody): Promise<Action>;
+    update(id: string, body: UpdateActionBody): Promise<ActionWithSecret>;
     delete(id: string): Promise<{
         object: "action";
         id: string;
@@ -100,6 +216,13 @@ export declare function actionsResource(request: RequestFn): {
     }>;
     /** Dry-run against a sample event in the sandbox; nothing is persisted. */
     test(id: string, event?: ActionTestEvent): Promise<ActionTestResult>;
+    /** The call log of an `http` Action, newest first, with 24 hour stats. */
+    calls(id: string, query?: {
+        limit?: number;
+        status?: "ok" | "denied" | "failed" | "timeout" | "error" | "invalid_response";
+        test?: boolean;
+        starting_after?: string;
+    }): Promise<ActionHttpCallList>;
     /** The actions bound to a trigger, in run order. */
     getBindings(trigger: ActionTrigger): Promise<ActionBindingList>;
     /** Replace a trigger's ordered binding set. */

package/dist/client/actions.js

@@ -23,6 +23,10 @@ function actionsResource(request) {
         test(id, event = {}) {
             return request({ method: 'POST', path: `/v1/actions/${(0, request_1.enc)(id)}/test`, body: { event } });
         },
+        /** The call log of an `http` Action, newest first, with 24 hour stats. */
+        calls(id, query = {}) {
+            return request({ method: 'GET', path: `/v1/actions/${(0, request_1.enc)(id)}/calls`, query });
+        },
         /** The actions bound to a trigger, in run order. */
         getBindings(trigger) {
             return request({ method: 'GET', path: `/v1/actions/bindings/${(0, request_1.enc)(trigger)}` });

package/dist/client/actions.js.map

@@ -1 +1 @@
-{"version":3,"file":"actions.js","sourceRoot":"","sources":["../../src/client/actions.ts"],"names":[],"mappings":";;AAwFA,0CAkCC;AA1HD,uCAAgD;AAwFhD,SAAgB,eAAe,CAAC,OAAkB;IAChD,OAAO;QACL,IAAI;YACF,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,aAAa,EAAE,CAAC,CAAC;QACzD,CAAC;QACD,MAAM,CAAC,IAAsB,EAAE,cAAuB;YACpD,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,aAAa,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC;QAChF,CAAC;QACD,GAAG,CAAC,EAAU;YACZ,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,eAAe,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;QACpE,CAAC;QACD,MAAM,CAAC,EAAU,EAAE,IAAsB;YACvC,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,eAAe,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;QAC5E,CAAC;QACD,MAAM,CAAC,EAAU;YACf,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,eAAe,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;QACvE,CAAC;QACD,2EAA2E;QAC3E,IAAI,CAAC,EAAU,EAAE,QAAyB,EAAE;YAC1C,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,eAAe,IAAA,aAAG,EAAC,EAAE,CAAC,OAAO,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC;QAC3F,CAAC;QACD,oDAAoD;QACpD,WAAW,CAAC,OAAsB;YAChC,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,wBAAwB,IAAA,aAAG,EAAC,OAAO,CAAC,EAAE,EAAE,CAAC,CAAC;QAClF,CAAC;QACD,+CAA+C;QAC/C,WAAW,CAAC,OAAsB,EAAE,SAAmB;YACrD,OAAO,OAAO,CAAC;gBACb,MAAM,EAAE,KAAK;gBACb,IAAI,EAAE,wBAAwB,IAAA,aAAG,EAAC,OAAO,CAAC,EAAE;gBAC5C,IAAI,EAAE,EAAE,UAAU,EAAE,SAAS,EAAE;aAChC,CAAC,CAAC;QACL,CAAC;KACF,CAAC;AACJ,CAAC"}
+{"version":3,"file":"actions.js","sourceRoot":"","sources":["../../src/client/actions.ts"],"names":[],"mappings":";;AA8MA,0CAyCC;AAvPD,uCAAgD;AA8MhD,SAAgB,eAAe,CAAC,OAAkB;IAChD,OAAO;QACL,IAAI;YACF,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,aAAa,EAAE,CAAC,CAAC;QACzD,CAAC;QACD,MAAM,CAAC,IAAsB,EAAE,cAAuB;YACpD,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,aAAa,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC;QAChF,CAAC;QACD,GAAG,CAAC,EAAU;YACZ,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,eAAe,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;QACpE,CAAC;QACD,MAAM,CAAC,EAAU,EAAE,IAAsB;YACvC,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,eAAe,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;QAC5E,CAAC;QACD,MAAM,CAAC,EAAU;YACf,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,eAAe,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;QACvE,CAAC;QACD,2EAA2E;QAC3E,IAAI,CAAC,EAAU,EAAE,QAAyB,EAAE;YAC1C,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,eAAe,IAAA,aAAG,EAAC,EAAE,CAAC,OAAO,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC;QAC3F,CAAC;QACD,0EAA0E;QAC1E,KAAK,CACH,EAAU,EACV,QAAqJ,EAAE;YAEvJ,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,eAAe,IAAA,aAAG,EAAC,EAAE,CAAC,QAAQ,EAAE,KAAK,EAAE,CAAC,CAAC;QACjF,CAAC;QACD,oDAAoD;QACpD,WAAW,CAAC,OAAsB;YAChC,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,wBAAwB,IAAA,aAAG,EAAC,OAAO,CAAC,EAAE,EAAE,CAAC,CAAC;QAClF,CAAC;QACD,+CAA+C;QAC/C,WAAW,CAAC,OAAsB,EAAE,SAAmB;YACrD,OAAO,OAAO,CAAC;gBACb,MAAM,EAAE,KAAK;gBACb,IAAI,EAAE,wBAAwB,IAAA,aAAG,EAAC,OAAO,CAAC,EAAE;gBAC5C,IAAI,EAAE,EAAE,UAAU,EAAE,SAAS,EAAE;aAChC,CAAC,CAAC;QACL,CAAC;KACF,CAAC;AACJ,CAAC"}