@atlasauth/backend 0.24.0 → 0.25.0

package/dist/client/vault.js

@@ -0,0 +1,50 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.vaultResource = vaultResource;
+const enc = encodeURIComponent;
+function vaultResource(request) {
+    return {
+        create(body, idempotencyKey) {
+            return request({ method: 'POST', path: '/v1/vault/objects', body, idempotencyKey });
+        },
+        /** Metadata only, newest first. */
+        list(params = {}) {
+            const { key_context, ...rest } = params;
+            return request({
+                method: 'GET',
+                path: '/v1/vault/objects',
+                query: { ...rest, ...(key_context ? { key_context: JSON.stringify(key_context) } : {}) },
+            });
+        },
+        /** The decrypted value of the current version, or of `version`. Audited. */
+        read(id, version) {
+            return request({ method: 'GET', path: `/v1/vault/objects/${enc(id)}`, query: version ? { version } : undefined });
+        },
+        metadata(id) {
+            return request({ method: 'GET', path: `/v1/vault/objects/${enc(id)}/metadata` });
+        },
+        versions(id) {
+            return request({ method: 'GET', path: `/v1/vault/objects/${enc(id)}/versions` });
+        },
+        /** Append a version. Pass `version_check` (the version you read) to fail with 409 on a concurrent update. */
+        update(id, body) {
+            return request({ method: 'PUT', path: `/v1/vault/objects/${enc(id)}`, body });
+        },
+        delete(id) {
+            return request({ method: 'DELETE', path: `/v1/vault/objects/${enc(id)}` });
+        },
+        /** Bring your own AWS KMS, Google Cloud KMS or Azure Key Vault key for new versions. */
+        keyProvider: {
+            get() {
+                return request({ method: 'GET', path: '/v1/vault/key_provider' });
+            },
+            set(body) {
+                return request({ method: 'PUT', path: '/v1/vault/key_provider', body });
+            },
+            remove() {
+                return request({ method: 'DELETE', path: '/v1/vault/key_provider' });
+            },
+        },
+    };
+}
+//# sourceMappingURL=vault.js.map

package/dist/client/vault.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"vault.js","sourceRoot":"","sources":["../../src/client/vault.ts"],"names":[],"mappings":";;AAgEA,sCA4CC;AAzGD,MAAM,GAAG,GAAG,kBAAkB,CAAC;AA6D/B,SAAgB,aAAa,CAAC,OAAkB;IAC9C,OAAO;QACL,MAAM,CAAC,IAA2B,EAAE,cAAuB;YACzD,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,mBAAmB,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC;QACtF,CAAC;QACD,mCAAmC;QACnC,IAAI,CAAC,SAAiC,EAAE;YACtC,MAAM,EAAE,WAAW,EAAE,GAAG,IAAI,EAAE,GAAG,MAAM,CAAC;YACxC,OAAO,OAAO,CAAC;gBACb,MAAM,EAAE,KAAK;gBACb,IAAI,EAAE,mBAAmB;gBACzB,KAAK,EAAE,EAAE,GAAG,IAAI,EAAE,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,IAAI,CAAC,SAAS,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE;aACzF,CAAC,CAAC;QACL,CAAC;QACD,4EAA4E;QAC5E,IAAI,CAAC,EAAU,EAAE,OAAgB;YAC/B,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,qBAAqB,GAAG,CAAC,EAAE,CAAC,EAAE,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC;QACpH,CAAC;QACD,QAAQ,CAAC,EAAU;YACjB,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,qBAAqB,GAAG,CAAC,EAAE,CAAC,WAAW,EAAE,CAAC,CAAC;QACnF,CAAC;QACD,QAAQ,CAAC,EAAU;YACjB,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,qBAAqB,GAAG,CAAC,EAAE,CAAC,WAAW,EAAE,CAAC,CAAC;QACnF,CAAC;QACD,6GAA6G;QAC7G,MAAM,CAAC,EAAU,EAAE,IAA+C;YAChE,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,qBAAqB,GAAG,CAAC,EAAE,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;QAChF,CAAC;QACD,MAAM,CAAC,EAAU;YACf,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,qBAAqB,GAAG,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;QAC7E,CAAC;QACD,wFAAwF;QACxF,WAAW,EAAE;YACX,GAAG;gBACD,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,wBAAwB,EAAE,CAAC,CAAC;YACpE,CAAC;YACD,GAAG,CAAC,IAA6B;gBAC/B,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,wBAAwB,EAAE,IAAI,EAAE,CAAC,CAAC;YAC1E,CAAC;YACD,MAAM;gBACJ,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,wBAAwB,EAAE,CAAC,CAAC;YACvE,CAAC;SACF;KACF,CAAC;AACJ,CAAC"}

package/dist/client/vc.d.ts

@@ -0,0 +1,128 @@
+import { type RequestFn } from './request';
+import type { ListPage } from './types';
+export interface VcClaimMapping {
+    name: string;
+    /** user_id | email | first_name | last_name | username | public_metadata.<key> */
+    source: string;
+    /** Selectively disclosable (default true; SD-JWT VC only). */
+    disclosable?: boolean;
+    /** Typing of the value; full-date is YYYY-MM-DD (an mdoc full-date). */
+    value_type?: 'string' | 'number' | 'boolean' | 'full-date';
+}
+export interface VcCredentialType {
+    object: 'vc_credential_type';
+    id: string;
+    /** The vct, or the docType for mso_mdoc. */
+    vct: string;
+    format: VcFormat;
+    namespace: string | null;
+    /** mdoc: PEM IACA roots a presentation must chain to. */
+    iaca_roots: string[];
+    /** mdoc: PEM Document Signer chain published as x5chain. */
+    signer_chain: string[];
+    name: string;
+    claims: VcClaimMapping[];
+    lifetime_seconds: number;
+    require_wallet_attestation: boolean;
+    created_at: number;
+}
+export type VcFormat = 'dc+sd-jwt' | 'mso_mdoc';
+export interface CreateVcCredentialTypeBody {
+    /** The vct, or the docType for mso_mdoc (for example org.iso.18013.5.1.mDL). */
+    vct: string;
+    format?: VcFormat;
+    /** mso_mdoc: the namespace of the claims (default the docType). */
+    namespace?: string;
+    /** mso_mdoc: PEM IACA roots (ISO 18013-5 Annex B); with roots set only a certificate chain is accepted. */
+    iaca_roots?: string[];
+    /** mso_mdoc: PEM Document Signer certificate (then intermediates) for the instance's mdoc signing key. */
+    signer_chain?: string[];
+    name: string;
+    claims: VcClaimMapping[];
+    lifetime_seconds?: number;
+    require_wallet_attestation?: boolean;
+    wallet_attestation_jwks?: {
+        keys: Record<string, unknown>[];
+    };
+}
+export interface VcOffer {
+    object: 'vc_offer';
+    id: string;
+    expires_at: number;
+    credential_offer: Record<string, unknown>;
+    /** The openid-credential-offer:// link for a QR code. Shown once. */
+    credential_offer_uri: string;
+}
+export interface VcCredential {
+    object: 'vc_credential';
+    id: string;
+    credential_type_id: string;
+    user_id: string;
+    status_idx: number;
+    issued_at: number;
+    expires_at: number;
+    revoked_at: number | null;
+}
+export interface VcPresentationRequest {
+    object: 'vc_presentation_request';
+    id: string;
+    vct: string;
+    format: VcFormat;
+    iaca_roots: string[];
+    claims: string[];
+    status: 'pending' | 'verified' | 'failed';
+    result: {
+        issuer: string;
+        vct: string;
+        claims: Record<string, unknown>;
+    } | null;
+    error: string | null;
+    /** Set when the credential was issued by this instance. */
+    user_id: string | null;
+    expires_at: number;
+    request_uri: string;
+    /** The openid4vp:// link for a QR code. */
+    authorization_request_uri: string;
+}
+/** Issue verifiable credentials to wallets (OpenID4VCI) and verify presentations (OpenID4VP), SD-JWT VC. */
+export declare function vcResource(request: RequestFn): {
+    credentialTypes: {
+        list(): Promise<ListPage<VcCredentialType>>;
+        create(body: CreateVcCredentialTypeBody): Promise<VcCredentialType>;
+        get(id: string): Promise<VcCredentialType>;
+        delete(id: string): Promise<{
+            object: "vc_credential_type";
+            id: string;
+            deleted: true;
+        }>;
+    };
+    createOffer(body: {
+        credential_type_id: string;
+        user_id: string;
+        tx_code?: string;
+        expires_in_seconds?: number;
+    }): Promise<VcOffer>;
+    credentials: {
+        list(query?: {
+            user_id?: string;
+        }): Promise<ListPage<VcCredential>>;
+        revoke(id: string): Promise<VcCredential>;
+    };
+    presentationRequests: {
+        create(body: {
+            vct: string;
+            format?: VcFormat;
+            /** mso_mdoc: PEM IACA roots for this request. */
+            iaca_roots?: string[];
+            claims?: string[];
+            trusted_issuers?: Array<{
+                issuer: string;
+                jwks: {
+                    keys: Record<string, unknown>[];
+                };
+            }>;
+            expires_in_seconds?: number;
+        }): Promise<VcPresentationRequest>;
+        get(id: string): Promise<VcPresentationRequest>;
+    };
+};

package/dist/client/vc.js

@@ -0,0 +1,43 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.vcResource = vcResource;
+const request_1 = require("./request");
+/** Issue verifiable credentials to wallets (OpenID4VCI) and verify presentations (OpenID4VP), SD-JWT VC. */
+function vcResource(request) {
+    return {
+        credentialTypes: {
+            list() {
+                return request({ method: 'GET', path: '/v1/vc/credential_types' });
+            },
+            create(body) {
+                return request({ method: 'POST', path: '/v1/vc/credential_types', body });
+            },
+            get(id) {
+                return request({ method: 'GET', path: `/v1/vc/credential_types/${(0, request_1.enc)(id)}` });
+            },
+            delete(id) {
+                return request({ method: 'DELETE', path: `/v1/vc/credential_types/${(0, request_1.enc)(id)}` });
+            },
+        },
+        createOffer(body) {
+            return request({ method: 'POST', path: '/v1/vc/offers', body });
+        },
+        credentials: {
+            list(query = {}) {
+                return request({ method: 'GET', path: '/v1/vc/credentials', query: { ...query } });
+            },
+            revoke(id) {
+                return request({ method: 'POST', path: `/v1/vc/credentials/${(0, request_1.enc)(id)}/revoke` });
+            },
+        },
+        presentationRequests: {
+            create(body) {
+                return request({ method: 'POST', path: '/v1/vc/presentation_requests', body });
+            },
+            get(id) {
+                return request({ method: 'GET', path: `/v1/vc/presentation_requests/${(0, request_1.enc)(id)}` });
+            },
+        },
+    };
+}
+//# sourceMappingURL=vc.js.map

package/dist/client/vc.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"vc.js","sourceRoot":"","sources":["../../src/client/vc.ts"],"names":[],"mappings":";;AAyFA,gCA4CC;AArID,uCAAgD;AAwFhD,4GAA4G;AAC5G,SAAgB,UAAU,CAAC,OAAkB;IAC3C,OAAO;QACL,eAAe,EAAE;YACf,IAAI;gBACF,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,yBAAyB,EAAE,CAAC,CAAC;YACrE,CAAC;YACD,MAAM,CAAC,IAAgC;gBACrC,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,yBAAyB,EAAE,IAAI,EAAE,CAAC,CAAC;YAC5E,CAAC;YACD,GAAG,CAAC,EAAU;gBACZ,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,2BAA2B,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;YAChF,CAAC;YACD,MAAM,CAAC,EAAU;gBACf,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,2BAA2B,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;YACnF,CAAC;SACF;QACD,WAAW,CAAC,IAAoG;YAC9G,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,eAAe,EAAE,IAAI,EAAE,CAAC,CAAC;QAClE,CAAC;QACD,WAAW,EAAE;YACX,IAAI,CAAC,QAA8B,EAAE;gBACnC,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,oBAAoB,EAAE,KAAK,EAAE,EAAE,GAAG,KAAK,EAAE,EAAE,CAAC,CAAC;YACrF,CAAC;YACD,MAAM,CAAC,EAAU;gBACf,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,sBAAsB,IAAA,aAAG,EAAC,EAAE,CAAC,SAAS,EAAE,CAAC,CAAC;YACnF,CAAC;SACF;QACD,oBAAoB,EAAE;YACpB,MAAM,CAAC,IAQN;gBACC,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,8BAA8B,EAAE,IAAI,EAAE,CAAC,CAAC;YACjF,CAAC;YACD,GAAG,CAAC,EAAU;gBACZ,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,gCAAgC,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;YACrF,CAAC;SACF;KACF,CAAC;AACJ,CAAC"}

package/dist/client/webhooks.d.ts

@@ -1,6 +1,6 @@
 import { type ProvisioningFields, type ProvisioningInput, type ProvisioningMetadata } from './compliance';
 import { type RequestFn } from './request';
-export type WebhookDestinationType = 'https' | 'aws_eventbridge' | 'gcp_pubsub' | 'cloudflare_queue';
+export type WebhookDestinationType = 'https' | 'aws_eventbridge' | 'gcp_pubsub' | 'cloudflare_queue' | 'segment' | 'ga4' | 'mixpanel' | 'posthog' | 'amplitude' | 'customerio' | 'slack';
 /** Where deliveries go. Credentials are never returned. */
 export type WebhookDestination = {
     type: 'https';
@@ -17,7 +17,21 @@ export type WebhookDestination = {
     type: 'cloudflare_queue';
     account_id: string;
     queue_id: string;
-};
+} | ({
+    type: 'segment' | 'mixpanel' | 'posthog' | 'amplitude' | 'customerio';
+    region?: 'us' | 'eu';
+} & AnalyticsOptions) | ({
+    type: 'ga4';
+    measurement_id: string;
+} & AnalyticsOptions) | ({
+    type: 'slack';
+} & AnalyticsOptions);
+/** Shared by the analytics and messaging destinations: person-identifying fields are dropped unless `include_pii`. */
+export interface AnalyticsOptions {
+    include_pii?: boolean;
+    /** Rename events: `{ 'user.created': 'Signed Up' }`. */
+    event_map?: Record<string, string>;
+}
 /** Your own credentials for an event destination (stored encrypted, write-only). */
 export type WebhookDestinationCredentials = {
     access_key_id: string;
@@ -27,6 +41,21 @@ export type WebhookDestinationCredentials = {
     service_account_json: string | Record<string, unknown>;
 } | {
     api_token: string;
+} | {
+    write_key: string;
+} | {
+    api_secret: string;
+} | {
+    project_token: string;
+} | {
+    project_api_key: string;
+} | {
+    api_key: string;
+} | {
+    site_id: string;
+    api_key: string;
+} | {
+    webhook_url: string;
 };
 export interface WebhookLastFailure {
     at: number;

package/dist/client/webhooks.js.map

@@ -1 +1 @@
-{"version":3,"file":"webhooks.js","sourceRoot":"","sources":["../../src/client/webhooks.ts"],"names":[],"mappings":";;AAsTA,4CA+HC;AArbD,6CAAyH;AACzH,uCAAgD;AAqThD,SAAgB,gBAAgB,CAAC,OAAkB;IACjD,OAAO;QACL,SAAS,EAAE;YACT,gFAAgF;YAChF,wEAAwE;YACxE,IAAI,CAAC,OAAyE,EAAE;gBAC9E,OAAO,OAAO,CAAC;oBACb,MAAM,EAAE,KAAK;oBACb,IAAI,EAAE,uBAAuB;oBAC7B,KAAK,EAAE,EAAE,GAAG,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC,CAAC,EAAE,kBAAkB,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,GAAG,IAAA,0BAAa,EAAC,IAAI,CAAC,QAAQ,CAAC,EAAE;iBAC9G,CAAC,CAAC;YACL,CAAC;YACD,GAAG,CAAC,EAAU;gBACZ,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,yBAAyB,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;YAC9E,CAAC;YACD;;;eAGG;YACH,WAAW,CACT,IAA+B,EAC/B,cAAuB;gBAEvB,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,8BAA8B,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC;YAChG,CAAC;YACD,wEAAwE;YACxE,MAAM,CAAC,EAAU,EAAE,IAA+B;gBAChD,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,yBAAyB,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;YACtF,CAAC;YACD,sDAAsD;YACtD,YAAY,CAAC,EAAU;gBACrB,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,yBAAyB,IAAA,aAAG,EAAC,EAAE,CAAC,gBAAgB,EAAE,CAAC,CAAC;YAC7F,CAAC;YACD;;;;eAIG;YACH,YAAY,CAAC,EAAU,EAAE,IAA8B;gBACrD,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,yBAAyB,IAAA,aAAG,EAAC,EAAE,CAAC,gBAAgB,EAAE,IAAI,EAAE,CAAC,CAAC;YACnG,CAAC;YACD,2FAA2F;YAC3F,IAAI,CAAC,EAAU;gBACb,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,yBAAyB,IAAA,aAAG,EAAC,EAAE,CAAC,OAAO,EAAE,CAAC,CAAC;YACpF,CAAC;YACD;;;;eAIG;YACH,OAAO,CAAC,EAAU,EAAE,OAAe,KAAK;gBACtC,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,yBAAyB,IAAA,aAAG,EAAC,EAAE,CAAC,OAAO,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC;YACrG,CAAC;YACD,mGAAmG;YACnG,eAAe,CACb,EAAU,EACV,OAA0D,EAAE,EAC5D,cAAuB;gBAEvB,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,yBAAyB,IAAA,aAAG,EAAC,EAAE,CAAC,YAAY,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC;YAC/G,CAAC;YACD,wFAAwF;YACxF,MAAM,CACJ,EAAU,EACV,IAAqE,EACrE,cAAuB;gBAEvB,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,yBAAyB,IAAA,aAAG,EAAC,EAAE,CAAC,SAAS,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC;YAC5G,CAAC;YACD,+EAA+E;YAC/E,SAAS,CAAC,EAAU,EAAE,UAAkB;gBACtC,OAAO,OAAO,CAAC;oBACb,MAAM,EAAE,MAAM;oBACd,IAAI,EAAE,yBAAyB,IAAA,aAAG,EAAC,EAAE,CAAC,eAAe,IAAA,aAAG,EAAC,UAAU,CAAC,YAAY;iBACjF,CAAC,CAAC;YACL,CAAC;YACD,MAAM,CACJ,IAA+B,EAC/B,cAAuB;gBAEvB,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,uBAAuB,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC;YAC1F,CAAC;YACD,MAAM,CACJ,EAAU;gBAEV,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,yBAAyB,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;YACjF,CAAC;SACF;QACD,oCAAoC;QACpC,UAAU,CACR,EAAU,EACV,SAAsC,EAAE;YAExC,OAAO,OAAO,CAAC;gBACb,MAAM,EAAE,KAAK;gBACb,IAAI,EAAE,yBAAyB,IAAA,aAAG,EAAC,EAAE,CAAC,aAAa;gBACnD,KAAK,EAAE,EAAE,GAAG,MAAM,EAAE;aACrB,CAAC,CAAC;QACL,CAAC;QACD,oDAAoD;QACpD,SAAS;YACP,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,qBAAqB,EAAE,CAAC,CAAC;QACjE,CAAC;QACD,sHAAsH;QACtH,MAAM,CAAC,SAAqE,EAAE;YAK5E,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,qBAAqB,EAAE,KAAK,EAAE,EAAE,GAAG,MAAM,EAAE,EAAE,CAAC,CAAC;QACvF,CAAC;QACD,4EAA4E;QAC5E,gBAAgB,CAAC,IAAwB,EAAE,QAAgB,EAAE,aAA8B;YACzF,OAAO,OAAO,CAAC;gBACb,MAAM,EAAE,KAAK;gBACb,IAAI,EAAE,uBAAuB,IAAA,aAAG,EAAC,IAAI,CAAC,IAAI,IAAA,aAAG,EAAC,QAAQ,CAAC,iBAAiB;gBACxE,IAAI,EAAE,EAAE,cAAc,EAAE,aAAa,EAAE;aACxC,CAAC,CAAC;QACL,CAAC;QACD,8DAA8D;QAC9D,SAAS,CAAC,UAAkB,EAAE,UAAkB;YAC9C,OAAO,OAAO,CAAC;gBACb,MAAM,EAAE,MAAM;gBACd,IAAI,EAAE,yBAAyB,IAAA,aAAG,EAAC,UAAU,CAAC,eAAe,IAAA,aAAG,EAAC,UAAU,CAAC,YAAY;aACzF,CAAC,CAAC;QACL,CAAC;KACF,CAAC;AACJ,CAAC"}
+{"version":3,"file":"webhooks.js","sourceRoot":"","sources":["../../src/client/webhooks.ts"],"names":[],"mappings":";;AAuUA,4CA+HC;AAtcD,6CAAyH;AACzH,uCAAgD;AAsUhD,SAAgB,gBAAgB,CAAC,OAAkB;IACjD,OAAO;QACL,SAAS,EAAE;YACT,gFAAgF;YAChF,wEAAwE;YACxE,IAAI,CAAC,OAAyE,EAAE;gBAC9E,OAAO,OAAO,CAAC;oBACb,MAAM,EAAE,KAAK;oBACb,IAAI,EAAE,uBAAuB;oBAC7B,KAAK,EAAE,EAAE,GAAG,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC,CAAC,EAAE,kBAAkB,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,GAAG,IAAA,0BAAa,EAAC,IAAI,CAAC,QAAQ,CAAC,EAAE;iBAC9G,CAAC,CAAC;YACL,CAAC;YACD,GAAG,CAAC,EAAU;gBACZ,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,yBAAyB,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;YAC9E,CAAC;YACD;;;eAGG;YACH,WAAW,CACT,IAA+B,EAC/B,cAAuB;gBAEvB,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,8BAA8B,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC;YAChG,CAAC;YACD,wEAAwE;YACxE,MAAM,CAAC,EAAU,EAAE,IAA+B;gBAChD,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,yBAAyB,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;YACtF,CAAC;YACD,sDAAsD;YACtD,YAAY,CAAC,EAAU;gBACrB,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,yBAAyB,IAAA,aAAG,EAAC,EAAE,CAAC,gBAAgB,EAAE,CAAC,CAAC;YAC7F,CAAC;YACD;;;;eAIG;YACH,YAAY,CAAC,EAAU,EAAE,IAA8B;gBACrD,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,yBAAyB,IAAA,aAAG,EAAC,EAAE,CAAC,gBAAgB,EAAE,IAAI,EAAE,CAAC,CAAC;YACnG,CAAC;YACD,2FAA2F;YAC3F,IAAI,CAAC,EAAU;gBACb,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,yBAAyB,IAAA,aAAG,EAAC,EAAE,CAAC,OAAO,EAAE,CAAC,CAAC;YACpF,CAAC;YACD;;;;eAIG;YACH,OAAO,CAAC,EAAU,EAAE,OAAe,KAAK;gBACtC,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,yBAAyB,IAAA,aAAG,EAAC,EAAE,CAAC,OAAO,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC;YACrG,CAAC;YACD,mGAAmG;YACnG,eAAe,CACb,EAAU,EACV,OAA0D,EAAE,EAC5D,cAAuB;gBAEvB,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,yBAAyB,IAAA,aAAG,EAAC,EAAE,CAAC,YAAY,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC;YAC/G,CAAC;YACD,wFAAwF;YACxF,MAAM,CACJ,EAAU,EACV,IAAqE,EACrE,cAAuB;gBAEvB,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,yBAAyB,IAAA,aAAG,EAAC,EAAE,CAAC,SAAS,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC;YAC5G,CAAC;YACD,+EAA+E;YAC/E,SAAS,CAAC,EAAU,EAAE,UAAkB;gBACtC,OAAO,OAAO,CAAC;oBACb,MAAM,EAAE,MAAM;oBACd,IAAI,EAAE,yBAAyB,IAAA,aAAG,EAAC,EAAE,CAAC,eAAe,IAAA,aAAG,EAAC,UAAU,CAAC,YAAY;iBACjF,CAAC,CAAC;YACL,CAAC;YACD,MAAM,CACJ,IAA+B,EAC/B,cAAuB;gBAEvB,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,uBAAuB,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC;YAC1F,CAAC;YACD,MAAM,CACJ,EAAU;gBAEV,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,yBAAyB,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;YACjF,CAAC;SACF;QACD,oCAAoC;QACpC,UAAU,CACR,EAAU,EACV,SAAsC,EAAE;YAExC,OAAO,OAAO,CAAC;gBACb,MAAM,EAAE,KAAK;gBACb,IAAI,EAAE,yBAAyB,IAAA,aAAG,EAAC,EAAE,CAAC,aAAa;gBACnD,KAAK,EAAE,EAAE,GAAG,MAAM,EAAE;aACrB,CAAC,CAAC;QACL,CAAC;QACD,oDAAoD;QACpD,SAAS;YACP,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,qBAAqB,EAAE,CAAC,CAAC;QACjE,CAAC;QACD,sHAAsH;QACtH,MAAM,CAAC,SAAqE,EAAE;YAK5E,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,qBAAqB,EAAE,KAAK,EAAE,EAAE,GAAG,MAAM,EAAE,EAAE,CAAC,CAAC;QACvF,CAAC;QACD,4EAA4E;QAC5E,gBAAgB,CAAC,IAAwB,EAAE,QAAgB,EAAE,aAA8B;YACzF,OAAO,OAAO,CAAC;gBACb,MAAM,EAAE,KAAK;gBACb,IAAI,EAAE,uBAAuB,IAAA,aAAG,EAAC,IAAI,CAAC,IAAI,IAAA,aAAG,EAAC,QAAQ,CAAC,iBAAiB;gBACxE,IAAI,EAAE,EAAE,cAAc,EAAE,aAAa,EAAE;aACxC,CAAC,CAAC;QACL,CAAC;QACD,8DAA8D;QAC9D,SAAS,CAAC,UAAkB,EAAE,UAAkB;YAC9C,OAAO,OAAO,CAAC;gBACb,MAAM,EAAE,MAAM;gBACd,IAAI,EAAE,yBAAyB,IAAA,aAAG,EAAC,UAAU,CAAC,eAAe,IAAA,aAAG,EAAC,UAAU,CAAC,YAAY;aACzF,CAAC,CAAC;QACL,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/client/workflows.d.ts

@@ -0,0 +1,131 @@
+import { type RequestFn } from './request';
+import type { ListPage } from './types';
+/** What starts a workflow run. */
+export type WorkflowTrigger = {
+    type: 'cron';
+    cron: string;
+} | {
+    type: 'user_created';
+    after_minutes?: number;
+} | {
+    type: 'inactive';
+    days: number;
+} | {
+    type: 'membership_age';
+    days: number;
+    organization_id?: string;
+} | {
+    type: 'trial_end';
+    days_before?: number;
+} | {
+    type: 'webhook_event';
+    event_type: string;
+};
+/** One step. A step that acts on an organization takes `organization_id`, or uses the membership's own for `membership_age`. */
+export type WorkflowStep = {
+    type: 'notify';
+    subject: string;
+    body: string;
+    to?: string;
+} | {
+    type: 'disable';
+    reason?: string;
+} | {
+    type: 'delete';
+} | {
+    type: 'invite';
+    role: string;
+    organization_id?: string;
+} | {
+    type: 'add_to_org';
+    role: string;
+    organization_id?: string;
+} | {
+    type: 'remove_from_org';
+    organization_id?: string;
+} | {
+    type: 'add_to_team';
+    team_id: string;
+    organization_id?: string;
+} | {
+    type: 'remove_from_team';
+    team_id: string;
+    organization_id?: string;
+} | {
+    type: 'add_to_group';
+    group: string;
+} | {
+    type: 'remove_from_group';
+    group: string;
+} | {
+    type: 'call_action';
+    action_id: string;
+};
+export interface Workflow {
+    object: 'workflow';
+    id: string;
+    name: string;
+    description: string | null;
+    enabled: boolean;
+    trigger: WorkflowTrigger;
+    steps: WorkflowStep[];
+    /** A cron workflow's next slot (Unix ms); null for other triggers. */
+    next_run_at: number | null;
+    created_at: number;
+    updated_at: number;
+}
+export interface WorkflowRunStep {
+    index: number;
+    type: string;
+    status: 'ok' | 'failed' | 'would_run' | 'skipped';
+    detail?: string;
+}
+export interface WorkflowRun {
+    object: 'workflow_run';
+    id: string;
+    workflow_id: string;
+    subject: string;
+    user_id: string | null;
+    dry_run: boolean;
+    status: 'running' | 'succeeded' | 'failed';
+    steps: WorkflowRunStep[];
+    error: string | null;
+    started_at: number;
+    finished_at: number | null;
+}
+export interface CreateWorkflowBody {
+    name: string;
+    description?: string | null;
+    enabled?: boolean;
+    trigger: WorkflowTrigger;
+    steps: WorkflowStep[];
+}
+export type UpdateWorkflowBody = Partial<CreateWorkflowBody>;
+export declare function workflowsResource(request: RequestFn): {
+    list(): Promise<ListPage<Workflow>>;
+    create(body: CreateWorkflowBody, idempotencyKey?: string): Promise<Workflow>;
+    get(id: string): Promise<Workflow>;
+    update(id: string, body: UpdateWorkflowBody): Promise<Workflow>;
+    delete(id: string): Promise<{
+        object: "workflow";
+        id: string;
+        deleted: true;
+    }>;
+    /** Validate every step against live data for a user (none for cron) and report what would happen; changes nothing. */
+    dryRun(id: string, target?: {
+        user_id?: string;
+        organization_id?: string;
+    }): Promise<WorkflowRun>;
+    /** Run now for one user (none for cron), outside the trigger. */
+    run(id: string, target?: {
+        user_id?: string;
+        organization_id?: string;
+    }, idempotencyKey?: string): Promise<WorkflowRun>;
+    /** Run history, newest first. */
+    runs(id: string, query?: {
+        limit?: number;
+        starting_after?: string;
+    }): Promise<ListPage<WorkflowRun> & {
+        next_cursor: string | null;
+    }>;
+};

package/dist/client/workflows.js

@@ -0,0 +1,36 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.workflowsResource = workflowsResource;
+const request_1 = require("./request");
+function workflowsResource(request) {
+    return {
+        list() {
+            return request({ method: 'GET', path: '/v1/workflows' });
+        },
+        create(body, idempotencyKey) {
+            return request({ method: 'POST', path: '/v1/workflows', body, idempotencyKey });
+        },
+        get(id) {
+            return request({ method: 'GET', path: `/v1/workflows/${(0, request_1.enc)(id)}` });
+        },
+        update(id, body) {
+            return request({ method: 'PATCH', path: `/v1/workflows/${(0, request_1.enc)(id)}`, body });
+        },
+        delete(id) {
+            return request({ method: 'DELETE', path: `/v1/workflows/${(0, request_1.enc)(id)}` });
+        },
+        /** Validate every step against live data for a user (none for cron) and report what would happen; changes nothing. */
+        dryRun(id, target = {}) {
+            return request({ method: 'POST', path: `/v1/workflows/${(0, request_1.enc)(id)}/dry_run`, body: target });
+        },
+        /** Run now for one user (none for cron), outside the trigger. */
+        run(id, target = {}, idempotencyKey) {
+            return request({ method: 'POST', path: `/v1/workflows/${(0, request_1.enc)(id)}/run`, body: target, idempotencyKey });
+        },
+        /** Run history, newest first. */
+        runs(id, query = {}) {
+            return request({ method: 'GET', path: `/v1/workflows/${(0, request_1.enc)(id)}/runs`, query });
+        },
+    };
+}
+//# sourceMappingURL=workflows.js.map

package/dist/client/workflows.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"workflows.js","sourceRoot":"","sources":["../../src/client/workflows.ts"],"names":[],"mappings":";;AAuEA,8CA8BC;AArGD,uCAAgD;AAuEhD,SAAgB,iBAAiB,CAAC,OAAkB;IAClD,OAAO;QACL,IAAI;YACF,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,eAAe,EAAE,CAAC,CAAC;QAC3D,CAAC;QACD,MAAM,CAAC,IAAwB,EAAE,cAAuB;YACtD,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,eAAe,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC;QAClF,CAAC;QACD,GAAG,CAAC,EAAU;YACZ,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,iBAAiB,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;QACtE,CAAC;QACD,MAAM,CAAC,EAAU,EAAE,IAAwB;YACzC,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,iBAAiB,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;QAC9E,CAAC;QACD,MAAM,CAAC,EAAU;YACf,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,iBAAiB,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;QACzE,CAAC;QACD,sHAAsH;QACtH,MAAM,CAAC,EAAU,EAAE,SAAyD,EAAE;YAC5E,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,iBAAiB,IAAA,aAAG,EAAC,EAAE,CAAC,UAAU,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC;QAC7F,CAAC;QACD,iEAAiE;QACjE,GAAG,CAAC,EAAU,EAAE,SAAyD,EAAE,EAAE,cAAuB;YAClG,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,iBAAiB,IAAA,aAAG,EAAC,EAAE,CAAC,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,cAAc,EAAE,CAAC,CAAC;QACzG,CAAC;QACD,iCAAiC;QACjC,IAAI,CAAC,EAAU,EAAE,QAAqD,EAAE;YACtE,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,iBAAiB,IAAA,aAAG,EAAC,EAAE,CAAC,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC;QAClF,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/index.d.ts

@@ -1,6 +1,7 @@
 export * from './jwks-cache';
 export { DiscoveryError, JwksDiscovery, discoveryUrlFor, instanceIdFromPublishableKey } from './discovery';
 export * from './verify';
+export * from './request-auth';
 export * from './recent-auth';
 export * from './access-control';
 export * from './handshake';
@@ -8,6 +9,8 @@ export * from './better-auth';
 export * from './migration-presets';
 export * from './migration-bridge';
 export * from './auth0-session';
+export { looksLikeMagicDidToken, magicDidTokenExtractor } from './magic-did';
+export { workosSessionTokenExtractor } from './workos-session';
 export { BETTER_AUTH_JWT_ALGS, peekIssuer } from './legacy-issuers';
 export type { LegacyIssuer, LegacyIssuerKind } from './legacy-issuers';
 export * from './legacy-issuer-presets';

package/dist/index.js

@@ -14,8 +14,8 @@ var __exportStar = (this && this.__exportStar) || function(m, exports) {
     for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.buildWwwAuthenticate = exports.DPOP_PROOF_MAX_AGE_SECONDS = exports.ACCESS_TOKEN_CLOCK_SKEW_SECONDS = exports.memoryPcaStore = exports.defaultExtract = exports.requirePCA = exports.verifyPCActn = exports.REFERALLI_API_VERSION = exports.referralEmailHash = exports.referalliSignatureV2 = exports.referalliSignature = exports.signReferralUpdatedEvent = exports.signReferalliCall = exports.signAtlasReferralCall = exports.testTenantClaims = exports.TEST_TOKEN_TAMPERS = exports.createTestIssuer = exports.createAtlasClient = exports.resetOidcCaches = exports.oidcSsoOf = exports.oidcOrganizationsOf = exports.oidcOrganizationOf = exports.oidcVerifyIdToken = exports.oidcStart = exports.oidcLogoutUrl = exports.oidcClearCookie = exports.oidcCallback = exports.oidc = exports.OIDC_FLOW_MAX_AGE_SECONDS = exports.OIDC_FLOW_COOKIE = exports.AtlasOidcError = exports.readLogoutToken = exports.nextBackchannelLogout = exports.handleBackchannelLogout = exports.fetchBackchannelLogout = exports.fastifyBackchannelLogoutPlugin = exports.fastifyBackchannelLogout = exports.expressBackchannelLogout = exports.verifyLogoutToken = exports.memoryLogoutReplayStore = exports.LogoutTokenVerifier = exports.LOGOUT_TOKEN_MAX_AGE_SECONDS = exports.LOGOUT_TOKEN_CLOCK_SKEW_SECONDS = exports.BACKCHANNEL_LOGOUT_EVENT = exports.peekIssuer = exports.BETTER_AUTH_JWT_ALGS = exports.instanceIdFromPublishableKey = exports.discoveryUrlFor = exports.JwksDiscovery = exports.DiscoveryError = void 0;
-exports.verifyAccessToken = exports.protectedResourceMetadataPath = exports.protectedResourceMetadata = exports.memoryDpopReplayStore = exports.memoryDpopNonceSource = exports.hmacDpopNonceSource = exports.createIntrospector = exports.createAccessTokenVerifier = void 0;
+exports.memoryPcaStore = exports.defaultExtract = exports.requirePCA = exports.verifyPCActn = exports.REFERALLI_API_VERSION = exports.referralEmailHash = exports.referalliSignatureV2 = exports.referalliSignature = exports.signReferralUpdatedEvent = exports.signReferalliCall = exports.signAtlasReferralCall = exports.testTenantClaims = exports.TEST_TOKEN_TAMPERS = exports.createTestIssuer = exports.createAtlasClient = exports.resetOidcCaches = exports.oidcSsoOf = exports.oidcOrganizationsOf = exports.oidcOrganizationOf = exports.oidcVerifyIdToken = exports.oidcStart = exports.oidcLogoutUrl = exports.oidcClearCookie = exports.oidcCallback = exports.oidc = exports.OIDC_FLOW_MAX_AGE_SECONDS = exports.OIDC_FLOW_COOKIE = exports.AtlasOidcError = exports.readLogoutToken = exports.nextBackchannelLogout = exports.handleBackchannelLogout = exports.fetchBackchannelLogout = exports.fastifyBackchannelLogoutPlugin = exports.fastifyBackchannelLogout = exports.expressBackchannelLogout = exports.verifyLogoutToken = exports.memoryLogoutReplayStore = exports.LogoutTokenVerifier = exports.LOGOUT_TOKEN_MAX_AGE_SECONDS = exports.LOGOUT_TOKEN_CLOCK_SKEW_SECONDS = exports.BACKCHANNEL_LOGOUT_EVENT = exports.peekIssuer = exports.BETTER_AUTH_JWT_ALGS = exports.workosSessionTokenExtractor = exports.magicDidTokenExtractor = exports.looksLikeMagicDidToken = exports.instanceIdFromPublishableKey = exports.discoveryUrlFor = exports.JwksDiscovery = exports.DiscoveryError = void 0;
+exports.verifyAccessToken = exports.protectedResourceMetadataPath = exports.protectedResourceMetadata = exports.memoryDpopReplayStore = exports.memoryDpopNonceSource = exports.hmacDpopNonceSource = exports.createIntrospector = exports.createAccessTokenVerifier = exports.buildWwwAuthenticate = exports.DPOP_PROOF_MAX_AGE_SECONDS = exports.ACCESS_TOKEN_CLOCK_SKEW_SECONDS = void 0;
 // §7.3 token verification — the original surface, unchanged.
 __exportStar(require("./jwks-cache"), exports);
 // OIDC discovery of the JWKS URL when only `issuer` is configured.
@@ -25,6 +25,7 @@ Object.defineProperty(exports, "JwksDiscovery", { enumerable: true, get: functio
 Object.defineProperty(exports, "discoveryUrlFor", { enumerable: true, get: function () { return discovery_1.discoveryUrlFor; } });
 Object.defineProperty(exports, "instanceIdFromPublishableKey", { enumerable: true, get: function () { return discovery_1.instanceIdFromPublishableKey; } });
 __exportStar(require("./verify"), exports);
+__exportStar(require("./request-auth"), exports);
 __exportStar(require("./recent-auth"), exports);
 __exportStar(require("./access-control"), exports);
 __exportStar(require("./handshake"), exports);
@@ -34,6 +35,11 @@ __exportStar(require("./better-auth"), exports);
 __exportStar(require("./migration-presets"), exports);
 __exportStar(require("./migration-bridge"), exports);
 __exportStar(require("./auth0-session"), exports);
+var magic_did_1 = require("./magic-did");
+Object.defineProperty(exports, "looksLikeMagicDidToken", { enumerable: true, get: function () { return magic_did_1.looksLikeMagicDidToken; } });
+Object.defineProperty(exports, "magicDidTokenExtractor", { enumerable: true, get: function () { return magic_did_1.magicDidTokenExtractor; } });
+var workos_session_1 = require("./workos-session");
+Object.defineProperty(exports, "workosSessionTokenExtractor", { enumerable: true, get: function () { return workos_session_1.workosSessionTokenExtractor; } });
 var legacy_issuers_1 = require("./legacy-issuers");
 Object.defineProperty(exports, "BETTER_AUTH_JWT_ALGS", { enumerable: true, get: function () { return legacy_issuers_1.BETTER_AUTH_JWT_ALGS; } });
 Object.defineProperty(exports, "peekIssuer", { enumerable: true, get: function () { return legacy_issuers_1.peekIssuer; } });

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;AAAA,6DAA6D;AAC7D,+CAA6B;AAC7B,mEAAmE;AACnE,yCAA2G;AAAlG,2GAAA,cAAc,OAAA;AAAE,0GAAA,aAAa,OAAA;AAAE,4GAAA,eAAe,OAAA;AAAE,yHAAA,4BAA4B,OAAA;AACrF,2CAAyB;AACzB,gDAA8B;AAC9B,mDAAiC;AACjC,8CAA4B;AAC5B,2FAA2F;AAC3F,gDAA8B;AAC9B,qFAAqF;AACrF,sDAAoC;AACpC,qDAAmC;AACnC,kDAAgC;AAChC,mDAAoE;AAA3D,sHAAA,oBAAoB,OAAA;AAAE,4GAAA,UAAU,OAAA;AAEzC,0DAAwC;AACxC,+EAA+E;AAC/E,4DAA4D;AAC5D,uDAAqC;AACrC,gFAAgF;AAChF,qDAAmC;AAEnC,6EAA6E;AAC7E,+CAOwB;AANtB,wHAAA,wBAAwB,OAAA;AACxB,+HAAA,+BAA+B,OAAA;AAC/B,4HAAA,4BAA4B,OAAA;AAC5B,mHAAA,mBAAmB,OAAA;AACnB,uHAAA,uBAAuB,OAAA;AACvB,iHAAA,iBAAiB,OAAA;AASnB,+EAA+E;AAC/E,+DAQgC;AAP9B,gIAAA,wBAAwB,OAAA;AACxB,gIAAA,wBAAwB,OAAA;AACxB,sIAAA,8BAA8B,OAAA;AAC9B,8HAAA,sBAAsB,OAAA;AACtB,+HAAA,uBAAuB,OAAA;AACvB,6HAAA,qBAAqB,OAAA;AACrB,uHAAA,eAAe,OAAA;AAIjB,sEAAsE;AACtE,iFAAiF;AACjF,+BAcgB;AAbd,sGAAA,cAAc,OAAA;AACd,wGAAA,gBAAgB,OAAA;AAChB,iHAAA,yBAAyB,OAAA;AACzB,4FAAA,IAAI,OAAA;AACJ,oGAAA,YAAY,OAAA;AACZ,uGAAA,eAAe,OAAA;AACf,qGAAA,aAAa,OAAA;AACb,iGAAA,SAAS,OAAA;AACT,yGAAA,iBAAiB,OAAA;AACjB,0GAAA,kBAAkB,OAAA;AAClB,2GAAA,mBAAmB,OAAA;AACnB,iGAAA,SAAS,OAAA;AACT,uGAAA,eAAe,OAAA;AAkBjB,oDAAoD;AACpD,6CAA2B;AAE3B,uFAAuF;AACvF,8CAA4B;AAC5B,kDAAgC;AAEhC,0FAA0F;AAC1F,0CAAwB;AAExB,8DAA8D;AAC9D,mCAA6C;AAApC,2GAAA,iBAAiB,OAAA;AAE1B,2CAAyB;AAEzB,yEAAyE;AACzE,2EAA2E;AAC3E,iEAAiE;AACjE,qCAAmF;AAA1E,2GAAA,gBAAgB,OAAA;AAAE,6GAAA,kBAAkB,OAAA;AAAE,2GAAA,gBAAgB,OAAA;AAU/D,6DAQ+B;AAP7B,4HAAA,qBAAqB,OAAA;AACrB,wHAAA,iBAAiB,OAAA;AACjB,+HAAA,wBAAwB,OAAA;AACxB,yHAAA,kBAAkB,OAAA;AAClB,2HAAA,oBAAoB,OAAA;AACpB,wHAAA,iBAAiB,OAAA;AACjB,4HAAA,qBAAqB,OAAA;AAWvB,wFAAwF;AACxF,2CAA2C;AAC3C,uCAA4C;AAAnC,sGAAA,YAAY,OAAA;AAErB,iDAA+E;AAAtE,yGAAA,UAAU,OAAA;AAAE,6GAAA,cAAc,OAAA;AAAE,6GAAA,cAAc,OAAA;AAGnD,8EAA8E;AAC9E,gFAAgF;AAChF,mDAY0B;AAXxB,iIAAA,+BAA+B,OAAA;AAC/B,4HAAA,0BAA0B,OAAA;AAC1B,sHAAA,oBAAoB,OAAA;AACpB,2HAAA,yBAAyB,OAAA;AACzB,oHAAA,kBAAkB,OAAA;AAClB,qHAAA,mBAAmB,OAAA;AACnB,uHAAA,qBAAqB,OAAA;AACrB,uHAAA,qBAAqB,OAAA;AACrB,2HAAA,yBAAyB,OAAA;AACzB,+HAAA,6BAA6B,OAAA;AAC7B,mHAAA,iBAAiB,OAAA;AAYnB,kDAAgC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;AAAA,6DAA6D;AAC7D,+CAA6B;AAC7B,mEAAmE;AACnE,yCAA2G;AAAlG,2GAAA,cAAc,OAAA;AAAE,0GAAA,aAAa,OAAA;AAAE,4GAAA,eAAe,OAAA;AAAE,yHAAA,4BAA4B,OAAA;AACrF,2CAAyB;AACzB,iDAA+B;AAC/B,gDAA8B;AAC9B,mDAAiC;AACjC,8CAA4B;AAC5B,2FAA2F;AAC3F,gDAA8B;AAC9B,qFAAqF;AACrF,sDAAoC;AACpC,qDAAmC;AACnC,kDAAgC;AAChC,yCAA6E;AAApE,mHAAA,sBAAsB,OAAA;AAAE,mHAAA,sBAAsB,OAAA;AACvD,mDAA+D;AAAtD,6HAAA,2BAA2B,OAAA;AACpC,mDAAoE;AAA3D,sHAAA,oBAAoB,OAAA;AAAE,4GAAA,UAAU,OAAA;AAEzC,0DAAwC;AACxC,+EAA+E;AAC/E,4DAA4D;AAC5D,uDAAqC;AACrC,gFAAgF;AAChF,qDAAmC;AAEnC,6EAA6E;AAC7E,+CAOwB;AANtB,wHAAA,wBAAwB,OAAA;AACxB,+HAAA,+BAA+B,OAAA;AAC/B,4HAAA,4BAA4B,OAAA;AAC5B,mHAAA,mBAAmB,OAAA;AACnB,uHAAA,uBAAuB,OAAA;AACvB,iHAAA,iBAAiB,OAAA;AASnB,+EAA+E;AAC/E,+DAQgC;AAP9B,gIAAA,wBAAwB,OAAA;AACxB,gIAAA,wBAAwB,OAAA;AACxB,sIAAA,8BAA8B,OAAA;AAC9B,8HAAA,sBAAsB,OAAA;AACtB,+HAAA,uBAAuB,OAAA;AACvB,6HAAA,qBAAqB,OAAA;AACrB,uHAAA,eAAe,OAAA;AAIjB,sEAAsE;AACtE,iFAAiF;AACjF,+BAcgB;AAbd,sGAAA,cAAc,OAAA;AACd,wGAAA,gBAAgB,OAAA;AAChB,iHAAA,yBAAyB,OAAA;AACzB,4FAAA,IAAI,OAAA;AACJ,oGAAA,YAAY,OAAA;AACZ,uGAAA,eAAe,OAAA;AACf,qGAAA,aAAa,OAAA;AACb,iGAAA,SAAS,OAAA;AACT,yGAAA,iBAAiB,OAAA;AACjB,0GAAA,kBAAkB,OAAA;AAClB,2GAAA,mBAAmB,OAAA;AACnB,iGAAA,SAAS,OAAA;AACT,uGAAA,eAAe,OAAA;AAkBjB,oDAAoD;AACpD,6CAA2B;AAE3B,uFAAuF;AACvF,8CAA4B;AAC5B,kDAAgC;AAEhC,0FAA0F;AAC1F,0CAAwB;AAExB,8DAA8D;AAC9D,mCAA6C;AAApC,2GAAA,iBAAiB,OAAA;AAE1B,2CAAyB;AAEzB,yEAAyE;AACzE,2EAA2E;AAC3E,iEAAiE;AACjE,qCAAmF;AAA1E,2GAAA,gBAAgB,OAAA;AAAE,6GAAA,kBAAkB,OAAA;AAAE,2GAAA,gBAAgB,OAAA;AAU/D,6DAQ+B;AAP7B,4HAAA,qBAAqB,OAAA;AACrB,wHAAA,iBAAiB,OAAA;AACjB,+HAAA,wBAAwB,OAAA;AACxB,yHAAA,kBAAkB,OAAA;AAClB,2HAAA,oBAAoB,OAAA;AACpB,wHAAA,iBAAiB,OAAA;AACjB,4HAAA,qBAAqB,OAAA;AAWvB,wFAAwF;AACxF,2CAA2C;AAC3C,uCAA4C;AAAnC,sGAAA,YAAY,OAAA;AAErB,iDAA+E;AAAtE,yGAAA,UAAU,OAAA;AAAE,6GAAA,cAAc,OAAA;AAAE,6GAAA,cAAc,OAAA;AAGnD,8EAA8E;AAC9E,gFAAgF;AAChF,mDAY0B;AAXxB,iIAAA,+BAA+B,OAAA;AAC/B,4HAAA,0BAA0B,OAAA;AAC1B,sHAAA,oBAAoB,OAAA;AACpB,2HAAA,yBAAyB,OAAA;AACzB,oHAAA,kBAAkB,OAAA;AAClB,qHAAA,mBAAmB,OAAA;AACnB,uHAAA,qBAAqB,OAAA;AACrB,uHAAA,qBAAqB,OAAA;AACrB,2HAAA,yBAAyB,OAAA;AACzB,+HAAA,6BAA6B,OAAA;AAC7B,mHAAA,iBAAiB,OAAA;AAYnB,kDAAgC"}

package/dist/magic-did.d.ts

@@ -0,0 +1,5 @@
+import type { MigrationTokenExtractor } from './migration-bridge';
+/** Is this a Magic DID token by shape (`[0x…proof, claim JSON with a did:ethr iss]`)? Nothing is verified. */
+export declare function looksLikeMagicDidToken(token: string): boolean;
+/** The bridge token extractor for Magic: the DID token in `Authorization: Bearer`, when there is one. */
+export declare function magicDidTokenExtractor(): MigrationTokenExtractor;

package/dist/magic-did.js

@@ -0,0 +1,49 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.looksLikeMagicDidToken = looksLikeMagicDidToken;
+exports.magicDidTokenExtractor = magicDidTokenExtractor;
+/**
+ * Magic (magic.link) DID tokens for the migration bridge. A Magic app sends
+ * `magic.user.getIdToken()` to its server as `Authorization: Bearer <DID token>`;
+ * a DID token is base64(JSON `[proof, claim]`), not a JWT, so the bridge's
+ * generic Bearer reading (which routes on a JWT's `iss`) does not see it.
+ * This extractor picks it out (by shape only — Atlas verifies the signature,
+ * expiry and audience on exchange). Runs on every runtime (no Buffer).
+ *
+ *   migrationBridge({ source: 'magic', presetVars: { client_id }, extractToken: magicDidTokenExtractor() })
+ */
+const ISSUER = /^did:ethr:0x[0-9a-fA-F]{40}$/;
+function header(headers, name) {
+    if (typeof headers.get === 'function')
+        return headers.get(name) ?? undefined;
+    const record = headers;
+    const value = record[name] ?? record[name.toLowerCase()];
+    return Array.isArray(value) ? value[0] : value;
+}
+/** Is this a Magic DID token by shape (`[0x…proof, claim JSON with a did:ethr iss]`)? Nothing is verified. */
+function looksLikeMagicDidToken(token) {
+    if (!token || token.length > 16_384 || !/^[A-Za-z0-9+/_-]+={0,2}$/.test(token))
+        return false;
+    try {
+        const b64 = token.replace(/-/g, '+').replace(/_/g, '/').padEnd(Math.ceil(token.length / 4) * 4, '=');
+        const outer = JSON.parse(new TextDecoder().decode(Uint8Array.from(atob(b64), (c) => c.charCodeAt(0))));
+        if (!Array.isArray(outer) || outer.length !== 2 || typeof outer[0] !== 'string' || typeof outer[1] !== 'string')
+            return false;
+        if (!/^0x[0-9a-fA-F]{130}$/.test(outer[0]))
+            return false;
+        const claim = JSON.parse(outer[1]);
+        return typeof claim?.iss === 'string' && ISSUER.test(claim.iss);
+    }
+    catch {
+        return false;
+    }
+}
+/** The bridge token extractor for Magic: the DID token in `Authorization: Bearer`, when there is one. */
+function magicDidTokenExtractor() {
+    return ({ headers }) => {
+        const auth = header(headers, 'authorization');
+        const m = auth ? /^Bearer\s+(\S+)$/i.exec(auth.trim()) : null;
+        return m && looksLikeMagicDidToken(m[1]) ? m[1] : undefined;
+    };
+}
+//# sourceMappingURL=magic-did.js.map

package/dist/magic-did.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"magic-did.js","sourceRoot":"","sources":["../src/magic-did.ts"],"names":[],"mappings":";;AAuBA,wDAYC;AAGD,wDAMC;AA1CD;;;;;;;;;GASG;AAEH,MAAM,MAAM,GAAG,8BAA8B,CAAC;AAE9C,SAAS,MAAM,CAAC,OAA0D,EAAE,IAAY;IACtF,IAAI,OAAQ,OAA6B,CAAC,GAAG,KAAK,UAAU;QAAE,OAAQ,OAAgD,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,SAAS,CAAC;IAC9I,MAAM,MAAM,GAAG,OAAwD,CAAC;IACxE,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC;IACzD,OAAO,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;AACjD,CAAC;AAED,8GAA8G;AAC9G,SAAgB,sBAAsB,CAAC,KAAa;IAClD,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,MAAM,GAAG,MAAM,IAAI,CAAC,0BAA0B,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IAC7F,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,GAAG,CAAC,EAAE,GAAG,CAAC,CAAC;QACrG,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,CAAY,CAAC;QAClH,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,OAAO,KAAK,CAAC,CAAC,CAAC,KAAK,QAAQ,IAAI,OAAO,KAAK,CAAC,CAAC,CAAC,KAAK,QAAQ;YAAE,OAAO,KAAK,CAAC;QAC9H,IAAI,CAAC,sBAAsB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;YAAE,OAAO,KAAK,CAAC;QACzD,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAsB,CAAC;QACxD,OAAO,OAAO,KAAK,EAAE,GAAG,KAAK,QAAQ,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAClE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,yGAAyG;AACzG,SAAgB,sBAAsB;IACpC,OAAO,CAAC,EAAE,OAAO,EAAE,EAAE,EAAE;QACrB,MAAM,IAAI,GAAG,MAAM,CAAC,OAAO,EAAE,eAAe,CAAC,CAAC;QAC9C,MAAM,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,mBAAmB,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QAC9D,OAAO,CAAC,IAAI,sBAAsB,CAAC,CAAC,CAAC,CAAC,CAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAC/D,CAAC,CAAC;AACJ,CAAC"}

package/dist/migration-bridge.d.ts

@@ -130,11 +130,20 @@ export type MigrationBridgeDecision =
 };
 /** Parse a Cookie header into name → raw value (first occurrence wins). */
 export declare function parseCookieHeader(cookieHeader: string | null | undefined): Record<string, string>;
+/** The token in the PocketBase JS SDK's `authStore.exportToCookie()` cookie (`pb_auth`: JSON `{ token, record }`). */
+export declare function readPocketBaseCookieToken(raw: string | undefined): string | undefined;
 /**
  * Supabase SSR cookie: `sb-<ref>-auth-token` (or chunks `.0`, `.1`, … joined in
  * order), the value JSON or `base64-` + base64url(JSON), holding `access_token`.
  */
 export declare function readSupabaseAccessToken(cookies: Record<string, string>, baseName: string): string | undefined;
+/**
+ * The refresh token in the same cookie (`refresh_token`, or the second entry
+ * of the older auth-helpers array): what the `supabase_refresh_token`
+ * session-table preset looks up among the sessions a dump of
+ * auth.refresh_tokens imported.
+ */
+export declare function readSupabaseRefreshToken(cookies: Record<string, string>, baseName: string): string | undefined;
 /** Resolve the cookie names / format / bearer flag the bridge uses for its source. */
 export declare function bridgeCookieConfig(options: Pick<MigrationBridgeOptions, 'source' | 'preset' | 'presetVars' | 'cookieNames' | 'clearCookieNames' | 'tokenFormat' | 'bearer'>): {
     cookies: string[];