@atlasauth/backend 0.24.0 → 0.25.0

package/dist/client/risk-based-mfa.js.map

@@ -1 +1 @@
-{"version":3,"file":"risk-based-mfa.js","sourceRoot":"","sources":["../../src/client/risk-based-mfa.ts"],"names":[],"mappings":";;AAuDA,oDAWC;AAfD;;;GAGG;AACH,SAAgB,oBAAoB,CAAC,OAAkB;IACrD,OAAO;QACL,4CAA4C;QAC5C,GAAG;YACD,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,oBAAoB,EAAE,CAAC,CAAC;QAChE,CAAC;QACD,0EAA0E;QAC1E,MAAM,CAAC,IAA4B;YACjC,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,oBAAoB,EAAE,IAAI,EAAE,CAAC,CAAC;QACxE,CAAC;KACF,CAAC;AACJ,CAAC"}
+{"version":3,"file":"risk-based-mfa.js","sourceRoot":"","sources":["../../src/client/risk-based-mfa.ts"],"names":[],"mappings":";;AAqKA,oDAuBC;AAGD,gDAeC;AA7CD;;;GAGG;AACH,SAAgB,oBAAoB,CAAC,OAAkB;IACrD,OAAO;QACL,4CAA4C;QAC5C,GAAG;YACD,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,oBAAoB,EAAE,CAAC,CAAC;QAChE,CAAC;QACD,0EAA0E;QAC1E,MAAM,CAAC,IAA4B;YACjC,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,oBAAoB,EAAE,IAAI,EAAE,CAAC,CAAC;QACxE,CAAC;QACD,uGAAuG;QACvG,WAAW,CAAC,IAAqB;YAC/B,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,kBAAkB,EAAE,IAAI,EAAE,CAAC,CAAC;QACrE,CAAC;QACD,oGAAoG;QACpG,mBAAmB,CAAC,MAAc,EAAE,QAAuC;YACzE,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,sCAAsC,EAAE,IAAI,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,EAAE,CAAC,CAAC;QAC9G,CAAC;QACD,kFAAkF;QAClF,sBAAsB,CAAC,QAAuC;YAC5D,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,sCAAsC,EAAE,KAAK,EAAE,EAAE,QAAQ,EAAE,EAAE,CAAC,CAAC;QAC1G,CAAC;KACF,CAAC;AACJ,CAAC;AAED,qDAAqD;AACrD,SAAgB,kBAAkB,CAAC,OAAkB;IACnD,OAAO;QACL,yEAAyE;QACzE,IAAI,CAAC,QAAkF,EAAE;YACvF,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,iBAAiB,EAAE,KAAK,EAAE,CAAC,CAAC;QACpE,CAAC;QACD,6DAA6D;QAC7D,OAAO,CAAC,QAA2B,EAAE;YACnC,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,yBAAyB,EAAE,KAAK,EAAE,CAAC,CAAC;QAC5E,CAAC;QACD,6FAA6F;QAC7F,QAAQ,CAAC,EAAU,EAAE,OAA0B;YAC7C,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,mBAAmB,kBAAkB,CAAC,EAAE,CAAC,WAAW,EAAE,IAAI,EAAE,EAAE,OAAO,EAAE,EAAE,CAAC,CAAC;QACpH,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/client/roles.d.ts

@@ -7,6 +7,7 @@ export interface Role {
     name: string;
     description: string | null;
     is_system: boolean;
+    visibility: 'public' | 'internal';
     permissions: string[];
     member_count: number;
     created_at: number;
@@ -23,11 +24,14 @@ export interface CreateRoleBody {
     key: string;
     name: string;
     description?: string;
+    /** `internal` = assignable by your backend only; hidden from org-admin pickers. */
+    visibility?: 'public' | 'internal';
     permissions?: string[];
 }
 export interface UpdateRoleBody {
     name?: string;
     description?: string;
+    visibility?: 'public' | 'internal';
     /** May be supplied but must equal the current key — the key is immutable. */
     key?: string;
 }

package/dist/client/roles.js.map

@@ -1 +1 @@
-{"version":3,"file":"roles.js","sourceRoot":"","sources":["../../src/client/roles.ts"],"names":[],"mappings":";;AA+CA,sCAmCC;AAeD,kDAiBC;AAlHD,uCAAgD;AA+ChD,SAAgB,aAAa,CAAC,OAAkB;IAC9C,OAAO;QACL,IAAI;YACF,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC,CAAC;QACvD,CAAC;QACD,MAAM,CAAC,IAAoB,EAAE,cAAuB;YAClD,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC;QAC9E,CAAC;QACD,MAAM,CAAC,EAAU,EAAE,IAAoB;YACrC,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,aAAa,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;QAC1E,CAAC;QACD,iDAAiD;QACjD,cAAc,CAAC,EAAU,EAAE,WAAqB;YAC9C,OAAO,OAAO,CAAC;gBACb,MAAM,EAAE,KAAK;gBACb,IAAI,EAAE,aAAa,IAAA,aAAG,EAAC,EAAE,CAAC,cAAc;gBACxC,IAAI,EAAE,EAAE,WAAW,EAAE;aACtB,CAAC,CAAC;QACL,CAAC;QACD;;;;WAIG;QACH,MAAM,CACJ,EAAU,EACV,IAA8B;YAE9B,OAAO,OAAO,CAAC;gBACb,MAAM,EAAE,QAAQ;gBAChB,IAAI,EAAE,aAAa,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE;gBAC5B,KAAK,EAAE,IAAI,EAAE,UAAU,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,IAAI,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,SAAS;aACvE,CAAC,CAAC;QACL,CAAC;KACF,CAAC;AACJ,CAAC;AAeD,SAAgB,mBAAmB,CAAC,OAAkB;IACpD,OAAO;QACL,IAAI;YACF,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,iBAAiB,EAAE,CAAC,CAAC;QAC7D,CAAC;QACD,MAAM,CAAC,IAA0B,EAAE,cAAuB;YACxD,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,iBAAiB,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC;QACpF,CAAC;QACD,kFAAkF;QAClF,MAAM,CAAC,EAAU,EAAE,IAA0B;YAC3C,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,mBAAmB,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;QAChF,CAAC;QACD,sFAAsF;QACtF,MAAM,CAAC,EAAU;YACf,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,mBAAmB,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;QAC3E,CAAC;KACF,CAAC;AACJ,CAAC"}
+{"version":3,"file":"roles.js","sourceRoot":"","sources":["../../src/client/roles.ts"],"names":[],"mappings":";;AAmDA,sCAmCC;AAeD,kDAiBC;AAtHD,uCAAgD;AAmDhD,SAAgB,aAAa,CAAC,OAAkB;IAC9C,OAAO;QACL,IAAI;YACF,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC,CAAC;QACvD,CAAC;QACD,MAAM,CAAC,IAAoB,EAAE,cAAuB;YAClD,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC;QAC9E,CAAC;QACD,MAAM,CAAC,EAAU,EAAE,IAAoB;YACrC,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,aAAa,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;QAC1E,CAAC;QACD,iDAAiD;QACjD,cAAc,CAAC,EAAU,EAAE,WAAqB;YAC9C,OAAO,OAAO,CAAC;gBACb,MAAM,EAAE,KAAK;gBACb,IAAI,EAAE,aAAa,IAAA,aAAG,EAAC,EAAE,CAAC,cAAc;gBACxC,IAAI,EAAE,EAAE,WAAW,EAAE;aACtB,CAAC,CAAC;QACL,CAAC;QACD;;;;WAIG;QACH,MAAM,CACJ,EAAU,EACV,IAA8B;YAE9B,OAAO,OAAO,CAAC;gBACb,MAAM,EAAE,QAAQ;gBAChB,IAAI,EAAE,aAAa,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE;gBAC5B,KAAK,EAAE,IAAI,EAAE,UAAU,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,IAAI,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,SAAS;aACvE,CAAC,CAAC;QACL,CAAC;KACF,CAAC;AACJ,CAAC;AAeD,SAAgB,mBAAmB,CAAC,OAAkB;IACpD,OAAO;QACL,IAAI;YACF,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,iBAAiB,EAAE,CAAC,CAAC;QAC7D,CAAC;QACD,MAAM,CAAC,IAA0B,EAAE,cAAuB;YACxD,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,iBAAiB,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC;QACpF,CAAC;QACD,kFAAkF;QAClF,MAAM,CAAC,EAAU,EAAE,IAA0B;YAC3C,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,mBAAmB,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;QAChF,CAAC;QACD,sFAAsF;QACtF,MAAM,CAAC,EAAU;YACf,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,mBAAmB,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;QAC3E,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/client/service-connectors.d.ts

@@ -0,0 +1,83 @@
+import { type RequestFn } from './request';
+export type ServiceConnectorCategory = 'messaging' | 'crm' | 'analytics' | 'fraud' | 'idv' | 'http';
+/** A configured service. Credentials are write-only: they live in the vault and are never returned. */
+export interface ServiceConnector {
+    object: 'service_connector';
+    id: string;
+    name: string;
+    /** `twilio`, `sendgrid`, `slack`, `hubspot`, `salesforce`, `segment`, `fingerprint`, `arkose`, `forter`, `sardine`, `persona`, `onfido`, `veriff`, `stripe_identity` or `http`. */
+    kind: string;
+    category: ServiceConnectorCategory | null;
+    config: Record<string, string>;
+    enabled: boolean;
+    last_used_at: number | null;
+    last_status: 'ok' | 'error' | null;
+    created_at: number;
+    updated_at: number;
+}
+export interface ServiceConnectorField {
+    key: string;
+    label: string;
+    required: boolean;
+    type?: string;
+    enum?: string[];
+    default?: string;
+}
+export interface ServiceConnectorKind {
+    object: 'service_connector_kind';
+    kind: string;
+    name: string;
+    category: ServiceConnectorCategory;
+    summary: string;
+    credentials: ServiceConnectorField[];
+    config: ServiceConnectorField[];
+    operations: Array<{
+        operation: string;
+        summary: string;
+        input: ServiceConnectorField[];
+    }>;
+}
+export interface CreateServiceConnectorBody {
+    /** Lowercase letters, digits, `-` and `_`; what Actions call it by. */
+    name: string;
+    kind: string;
+    config?: Record<string, string>;
+    /** Stored in the vault. See the catalog entry for the fields. */
+    credentials: Record<string, string>;
+}
+export interface UpdateServiceConnectorBody {
+    name?: string;
+    enabled?: boolean;
+    /** Merged into the current config. */
+    config?: Record<string, string>;
+    /** Only the fields you pass are replaced. */
+    credentials?: Record<string, string>;
+}
+/** Typed connectors to messaging, CRM, analytics, fraud and identity-verification services. */
+export declare function serviceConnectorsResource(request: RequestFn): {
+    /** The services you can connect, with their fields and operations. */
+    catalog(): Promise<{
+        object: "list";
+        data: ServiceConnectorKind[];
+        has_more: boolean;
+    }>;
+    list(): Promise<{
+        object: "list";
+        data: ServiceConnector[];
+        has_more: boolean;
+    }>;
+    get(id: string): Promise<ServiceConnector>;
+    create(body: CreateServiceConnectorBody, idempotencyKey?: string): Promise<ServiceConnector>;
+    update(id: string, body: UpdateServiceConnectorBody): Promise<ServiceConnector>;
+    delete(id: string): Promise<{
+        object: "service_connector.deleted";
+        id: string;
+        deleted: boolean;
+    }>;
+    /** Run an operation, e.g. `invoke(id, 'send_sms', { to, body })`. A failure from the service is a 502 `CONNECTOR_UPSTREAM_ERROR`. */
+    invoke(id: string, operation: string, input?: Record<string, unknown>): Promise<{
+        object: "service_connector_result";
+        operation: string;
+        result: Record<string, unknown>;
+    }>;
+};

package/dist/client/service-connectors.js

@@ -0,0 +1,33 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.serviceConnectorsResource = serviceConnectorsResource;
+const request_1 = require("./request");
+/** Typed connectors to messaging, CRM, analytics, fraud and identity-verification services. */
+function serviceConnectorsResource(request) {
+    return {
+        /** The services you can connect, with their fields and operations. */
+        catalog() {
+            return request({ method: 'GET', path: '/v1/service_connector_catalog' });
+        },
+        list() {
+            return request({ method: 'GET', path: '/v1/service_connectors' });
+        },
+        get(id) {
+            return request({ method: 'GET', path: `/v1/service_connectors/${(0, request_1.enc)(id)}` });
+        },
+        create(body, idempotencyKey) {
+            return request({ method: 'POST', path: '/v1/service_connectors', body, idempotencyKey });
+        },
+        update(id, body) {
+            return request({ method: 'PATCH', path: `/v1/service_connectors/${(0, request_1.enc)(id)}`, body });
+        },
+        delete(id) {
+            return request({ method: 'DELETE', path: `/v1/service_connectors/${(0, request_1.enc)(id)}` });
+        },
+        /** Run an operation, e.g. `invoke(id, 'send_sms', { to, body })`. A failure from the service is a 502 `CONNECTOR_UPSTREAM_ERROR`. */
+        invoke(id, operation, input = {}) {
+            return request({ method: 'POST', path: `/v1/service_connectors/${(0, request_1.enc)(id)}/invoke`, body: { operation, input } });
+        },
+    };
+}
+//# sourceMappingURL=service-connectors.js.map

package/dist/client/service-connectors.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"service-connectors.js","sourceRoot":"","sources":["../../src/client/service-connectors.ts"],"names":[],"mappings":";;AA2DA,8DA0BC;AArFD,uCAAgD;AA0DhD,+FAA+F;AAC/F,SAAgB,yBAAyB,CAAC,OAAkB;IAC1D,OAAO;QACL,sEAAsE;QACtE,OAAO;YACL,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,+BAA+B,EAAE,CAAC,CAAC;QAC3E,CAAC;QACD,IAAI;YACF,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,wBAAwB,EAAE,CAAC,CAAC;QACpE,CAAC;QACD,GAAG,CAAC,EAAU;YACZ,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,0BAA0B,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;QAC/E,CAAC;QACD,MAAM,CAAC,IAAgC,EAAE,cAAuB;YAC9D,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,wBAAwB,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC;QAC3F,CAAC;QACD,MAAM,CAAC,EAAU,EAAE,IAAgC;YACjD,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,0BAA0B,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;QACvF,CAAC;QACD,MAAM,CAAC,EAAU;YACf,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,0BAA0B,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;QAClF,CAAC;QACD,qIAAqI;QACrI,MAAM,CAAC,EAAU,EAAE,SAAiB,EAAE,QAAiC,EAAE;YACvE,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,0BAA0B,IAAA,aAAG,EAAC,EAAE,CAAC,SAAS,EAAE,IAAI,EAAE,EAAE,SAAS,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC;QACnH,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/client/ssf.d.ts

@@ -0,0 +1,111 @@
+import { type RequestFn } from './request';
+/** Event type URIs (CAEP + RISC) a stream can subscribe to. */
+export type SsfEventType = 'https://schemas.openid.net/secevent/caep/event-type/session-revoked' | 'https://schemas.openid.net/secevent/caep/event-type/credential-change' | 'https://schemas.openid.net/secevent/caep/event-type/assurance-level-change' | 'https://schemas.openid.net/secevent/caep/event-type/token-claims-change' | 'https://schemas.openid.net/secevent/caep/event-type/risk-level-change' | 'https://schemas.openid.net/secevent/risc/event-type/account-disabled' | 'https://schemas.openid.net/secevent/risc/event-type/account-enabled' | 'https://schemas.openid.net/secevent/risc/event-type/account-purged' | 'https://schemas.openid.net/secevent/risc/event-type/credential-compromise';
+export interface SsfStream {
+    object: 'ssf_stream';
+    id: string;
+    description: string | null;
+    delivery: {
+        method: string;
+        endpoint_url?: string | null;
+    };
+    delivery_method: 'push' | 'poll';
+    audience: string;
+    events_requested: string[];
+    events_supported: string[];
+    status: 'enabled' | 'paused' | 'disabled';
+    created_at: number;
+    updated_at: number;
+    pending_events?: number;
+}
+/** Returned once on create for a poll stream. */
+export interface SsfStreamCreated extends SsfStream {
+    poll_token?: string;
+    poll_endpoint?: string;
+}
+export interface CreateSsfStreamBody {
+    delivery_method: 'push' | 'poll';
+    /** Push only: the https endpoint that receives each SET. */
+    endpoint_url?: string;
+    /** Push only: sent as the `Authorization` header (write-only). */
+    authorization_header?: string;
+    audience?: string;
+    description?: string;
+    events_requested?: string[];
+}
+export interface UpdateSsfStreamBody {
+    endpoint_url?: string;
+    authorization_header?: string;
+    description?: string;
+    events_requested?: string[];
+    status?: 'enabled' | 'paused' | 'disabled';
+}
+export interface SsfEventRecord {
+    object: 'ssf_event';
+    id: string;
+    event_type: string;
+    user_id: string | null;
+    status: 'pending' | 'delivered' | 'failed';
+    attempts: number;
+    last_error: string | null;
+    delivered_at: number | null;
+    created_at: number;
+}
+export type SsfReceiverAction = 'revoke_sessions' | 'ban' | 'ignore';
+export interface SsfReceiver {
+    object: 'ssf_receiver';
+    id: string;
+    name: string;
+    issuer: string;
+    jwks_uri: string;
+    audience: string | null;
+    actions: Record<string, SsfReceiverAction>;
+    enabled: boolean;
+    last_received_at: number | null;
+    created_at: number;
+    /** Only on create. */
+    receive_endpoint?: string;
+}
+export interface CreateSsfReceiverBody {
+    name: string;
+    issuer: string;
+    jwks_uri: string;
+    audience?: string;
+    actions?: Record<string, SsfReceiverAction>;
+}
+/** Shared Signals Framework (SSF 1.0) with CAEP and RISC: transmitter streams and inbound receivers. */
+export declare function ssfResource(request: RequestFn): {
+    streams: {
+        list(): Promise<{
+            object: "list";
+            data: SsfStream[];
+        }>;
+        create(body: CreateSsfStreamBody): Promise<SsfStreamCreated>;
+        get(id: string): Promise<SsfStream>;
+        update(id: string, body: UpdateSsfStreamBody): Promise<SsfStream>;
+        delete(id: string): Promise<void>;
+        /** Queue a verification event so the receiver can confirm the stream works. */
+        verify(id: string, state?: string): Promise<{
+            object: "ssf_verification";
+            stream_id: string;
+            state: string;
+        }>;
+        events(id: string, query?: {
+            limit?: number;
+        }): Promise<{
+            object: "list";
+            data: SsfEventRecord[];
+        }>;
+    };
+    receivers: {
+        list(): Promise<{
+            object: "list";
+            data: SsfReceiver[];
+        }>;
+        create(body: CreateSsfReceiverBody): Promise<SsfReceiver>;
+        update(id: string, body: Partial<Omit<CreateSsfReceiverBody, "issuer">> & {
+            enabled?: boolean;
+        }): Promise<SsfReceiver>;
+        delete(id: string): Promise<void>;
+    };
+};

package/dist/client/ssf.js

@@ -0,0 +1,49 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ssfResource = ssfResource;
+/** Shared Signals Framework (SSF 1.0) with CAEP and RISC: transmitter streams and inbound receivers. */
+function ssfResource(request) {
+    const stream = (id) => `/v1/ssf/streams/${encodeURIComponent(id)}`;
+    const receiver = (id) => `/v1/ssf/receivers/${encodeURIComponent(id)}`;
+    return {
+        streams: {
+            list() {
+                return request({ method: 'GET', path: '/v1/ssf/streams' });
+            },
+            create(body) {
+                return request({ method: 'POST', path: '/v1/ssf/streams', body });
+            },
+            get(id) {
+                return request({ method: 'GET', path: stream(id) });
+            },
+            update(id, body) {
+                return request({ method: 'PATCH', path: stream(id), body });
+            },
+            delete(id) {
+                return request({ method: 'DELETE', path: stream(id) });
+            },
+            /** Queue a verification event so the receiver can confirm the stream works. */
+            verify(id, state) {
+                return request({ method: 'POST', path: `${stream(id)}/verify`, body: { state } });
+            },
+            events(id, query = {}) {
+                return request({ method: 'GET', path: `${stream(id)}/events`, query });
+            },
+        },
+        receivers: {
+            list() {
+                return request({ method: 'GET', path: '/v1/ssf/receivers' });
+            },
+            create(body) {
+                return request({ method: 'POST', path: '/v1/ssf/receivers', body });
+            },
+            update(id, body) {
+                return request({ method: 'PATCH', path: receiver(id), body });
+            },
+            delete(id) {
+                return request({ method: 'DELETE', path: receiver(id) });
+            },
+        },
+    };
+}
+//# sourceMappingURL=ssf.js.map

package/dist/client/ssf.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ssf.js","sourceRoot":"","sources":["../../src/client/ssf.ts"],"names":[],"mappings":";;AA4FA,kCA2CC;AA5CD,wGAAwG;AACxG,SAAgB,WAAW,CAAC,OAAkB;IAC5C,MAAM,MAAM,GAAG,CAAC,EAAU,EAAE,EAAE,CAAC,mBAAmB,kBAAkB,CAAC,EAAE,CAAC,EAAE,CAAC;IAC3E,MAAM,QAAQ,GAAG,CAAC,EAAU,EAAE,EAAE,CAAC,qBAAqB,kBAAkB,CAAC,EAAE,CAAC,EAAE,CAAC;IAC/E,OAAO;QACL,OAAO,EAAE;YACP,IAAI;gBACF,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,iBAAiB,EAAE,CAAC,CAAC;YAC7D,CAAC;YACD,MAAM,CAAC,IAAyB;gBAC9B,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,iBAAiB,EAAE,IAAI,EAAE,CAAC,CAAC;YACpE,CAAC;YACD,GAAG,CAAC,EAAU;gBACZ,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;YACtD,CAAC;YACD,MAAM,CAAC,EAAU,EAAE,IAAyB;gBAC1C,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,CAAC,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC;YAC9D,CAAC;YACD,MAAM,CAAC,EAAU;gBACf,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;YACzD,CAAC;YACD,+EAA+E;YAC/E,MAAM,CAAC,EAAU,EAAE,KAAc;gBAC/B,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,CAAC,EAAE,CAAC,SAAS,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC;YACpF,CAAC;YACD,MAAM,CAAC,EAAU,EAAE,QAA4B,EAAE;gBAC/C,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,MAAM,CAAC,EAAE,CAAC,SAAS,EAAE,KAAK,EAAE,CAAC,CAAC;YACzE,CAAC;SACF;QACD,SAAS,EAAE;YACT,IAAI;gBACF,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,mBAAmB,EAAE,CAAC,CAAC;YAC/D,CAAC;YACD,MAAM,CAAC,IAA2B;gBAChC,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,mBAAmB,EAAE,IAAI,EAAE,CAAC,CAAC;YACtE,CAAC;YACD,MAAM,CAAC,EAAU,EAAE,IAA4E;gBAC7F,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,CAAC,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC;YAChE,CAAC;YACD,MAAM,CAAC,EAAU;gBACf,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,QAAQ,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;YAC3D,CAAC;SACF;KACF,CAAC;AACJ,CAAC"}

package/dist/client/sso-onboarding.d.ts

@@ -5,6 +5,8 @@ import type { ListPage } from './types';
  * self-service-profiles model. It fixes which protocols an end-customer may
  * configure and either binds an org or promises to name one at ticket issue.
  */
+/** An Admin Portal task a ticket may perform for its organization. */
+export type SsoPortalIntent = 'sso' | 'directory_sync' | 'domain_verification' | 'log_stream' | 'audit_log' | 'certificate_renewal' | 'api_keys' | 'webhooks';
 export interface SsoOnboardingProfile {
     object: 'sso_onboarding_profile';
     id: string;
@@ -14,6 +16,8 @@ export interface SsoOnboardingProfile {
     organization_id: string | null;
     company_name: string | null;
     allow_scim: boolean;
+    /** The Admin Portal tasks this profile's tickets may perform. */
+    intents: SsoPortalIntent[];
     created_at: number;
     updated_at: number;
 }
@@ -49,6 +53,8 @@ export interface CreateSsoOnboardingProfileBody {
     organization_id?: string | null;
     company_name?: string | null;
     allow_scim?: boolean;
+    /** Admin Portal tasks to grant; omit for the classic SSO (+ domain) profile. */
+    intents?: SsoPortalIntent[];
 }
 export interface CreateSsoOnboardingTicketBody {
     /** Required for an unbound profile; must match (or be omitted) for a bound one. */

package/dist/client/sso-onboarding.js.map

@@ -1 +1 @@
-{"version":3,"file":"sso-onboarding.js","sourceRoot":"","sources":["../../src/client/sso-onboarding.ts"],"names":[],"mappings":";;AAgEA,sDA6CC;AA7GD,uCAAgD;AAgEhD,SAAgB,qBAAqB,CAAC,OAAkB;IACtD,OAAO;QACL,IAAI;YACF,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,6BAA6B,EAAE,CAAC,CAAC;QACzE,CAAC;QACD,GAAG,CAAC,EAAU;YACZ,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,+BAA+B,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;QACpF,CAAC;QACD,MAAM,CACJ,IAAoC,EACpC,cAAuB;YAEvB,OAAO,OAAO,CAAC;gBACb,MAAM,EAAE,MAAM;gBACd,IAAI,EAAE,6BAA6B;gBACnC,IAAI;gBACJ,cAAc;aACf,CAAC,CAAC;QACL,CAAC;QACD,MAAM,CAAC,EAAU;YACf,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,+BAA+B,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;QACvF,CAAC;QACD,+EAA+E;QAC/E,YAAY,CACV,SAAiB,EACjB,OAAsC,EAAE,EACxC,cAAuB;YAEvB,OAAO,OAAO,CAAC;gBACb,MAAM,EAAE,MAAM;gBACd,IAAI,EAAE,+BAA+B,IAAA,aAAG,EAAC,SAAS,CAAC,UAAU;gBAC7D,IAAI;gBACJ,cAAc;aACf,CAAC,CAAC;QACL,CAAC;QACD,kFAAkF;QAClF,YAAY,CACV,QAAgB;YAEhB,OAAO,OAAO,CAAC;gBACb,MAAM,EAAE,MAAM;gBACd,IAAI,EAAE,8BAA8B,IAAA,aAAG,EAAC,QAAQ,CAAC,SAAS;aAC3D,CAAC,CAAC;QACL,CAAC;KACF,CAAC;AACJ,CAAC"}
+{"version":3,"file":"sso-onboarding.js","sourceRoot":"","sources":["../../src/client/sso-onboarding.ts"],"names":[],"mappings":";;AA+EA,sDA6CC;AA5HD,uCAAgD;AA+EhD,SAAgB,qBAAqB,CAAC,OAAkB;IACtD,OAAO;QACL,IAAI;YACF,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,6BAA6B,EAAE,CAAC,CAAC;QACzE,CAAC;QACD,GAAG,CAAC,EAAU;YACZ,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,+BAA+B,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;QACpF,CAAC;QACD,MAAM,CACJ,IAAoC,EACpC,cAAuB;YAEvB,OAAO,OAAO,CAAC;gBACb,MAAM,EAAE,MAAM;gBACd,IAAI,EAAE,6BAA6B;gBACnC,IAAI;gBACJ,cAAc;aACf,CAAC,CAAC;QACL,CAAC;QACD,MAAM,CAAC,EAAU;YACf,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,+BAA+B,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;QACvF,CAAC;QACD,+EAA+E;QAC/E,YAAY,CACV,SAAiB,EACjB,OAAsC,EAAE,EACxC,cAAuB;YAEvB,OAAO,OAAO,CAAC;gBACb,MAAM,EAAE,MAAM;gBACd,IAAI,EAAE,+BAA+B,IAAA,aAAG,EAAC,SAAS,CAAC,UAAU;gBAC7D,IAAI;gBACJ,cAAc;aACf,CAAC,CAAC;QACL,CAAC;QACD,kFAAkF;QAClF,YAAY,CACV,QAAgB;YAEhB,OAAO,OAAO,CAAC;gBACb,MAAM,EAAE,MAAM;gBACd,IAAI,EAAE,8BAA8B,IAAA,aAAG,EAAC,QAAQ,CAAC,SAAS;aAC3D,CAAC,CAAC;QACL,CAAC;KACF,CAAC;AACJ,CAAC"}