@atlasauth/backend 0.24.0 → 0.25.0

package/dist/client/delegated-ui-proxy.js

@@ -0,0 +1,46 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.delegatedUiProxy = delegatedUiProxy;
+/**
+ * The backend half of the browser helper `createDelegatedUiClient` (@atlasauth/js).
+ * Mount it under any route; it forwards the challenge calls to Atlas with your
+ * secret key. YOU must authenticate the visitor before letting an `accept`
+ * through: pass `authorize` to decide (return the Atlas user id for a login
+ * accept, or throw / return null to refuse).
+ */
+function delegatedUiProxy(atlas, opts) {
+    return async function handle(req) {
+        const login = req.query.login_challenge;
+        const consent = req.query.consent_challenge;
+        const body = (req.body ?? {});
+        try {
+            const route = `${req.method.toUpperCase()} ${req.path.replace(/^\/|\/$/g, '')}`;
+            if (route === 'GET login' && login)
+                return { status: 200, body: await atlas.oauthClients.loginRequests.get(login) };
+            if (route === 'GET consent' && consent)
+                return { status: 200, body: await atlas.oauthClients.consentRequests.get(consent) };
+            if (route === 'POST login/reject' && login)
+                return { status: 200, body: await atlas.oauthClients.loginRequests.reject(login, body) };
+            if (route === 'POST consent/reject' && consent)
+                return { status: 200, body: await atlas.oauthClients.consentRequests.reject(consent, body) };
+            if (route === 'POST login/accept' && login) {
+                const subject = await opts.authorize(req);
+                if (!subject)
+                    return { status: 401, body: { error: { message: 'Not signed in.' } } };
+                // The subject is decided by your authorize(), never by the browser.
+                return { status: 200, body: await atlas.oauthClients.loginRequests.accept(login, { ...body, subject }) };
+            }
+            if (route === 'POST consent/accept' && consent) {
+                if (!(await opts.authorize(req)))
+                    return { status: 401, body: { error: { message: 'Not signed in.' } } };
+                return { status: 200, body: await atlas.oauthClients.consentRequests.accept(consent, body) };
+            }
+            return { status: 404, body: { error: { message: 'Unknown route.' } } };
+        }
+        catch (e) {
+            const status = e.status ?? 502;
+            return { status, body: { error: { message: e instanceof Error ? e.message : 'Request failed.' } } };
+        }
+    };
+}
+//# sourceMappingURL=delegated-ui-proxy.js.map

package/dist/client/delegated-ui-proxy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"delegated-ui-proxy.js","sourceRoot":"","sources":["../../src/client/delegated-ui-proxy.ts"],"names":[],"mappings":";;AAuBA,4CAiCC;AAxCD;;;;;;GAMG;AACH,SAAgB,gBAAgB,CAC9B,KAAY,EACZ,IAGC;IAED,OAAO,KAAK,UAAU,MAAM,CAAC,GAAiB;QAC5C,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,eAAe,CAAC;QACxC,MAAM,OAAO,GAAG,GAAG,CAAC,KAAK,CAAC,iBAAiB,CAAC;QAC5C,MAAM,IAAI,GAAG,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,CAA4B,CAAC;QACzD,IAAI,CAAC;YACH,MAAM,KAAK,GAAG,GAAG,GAAG,CAAC,MAAM,CAAC,WAAW,EAAE,IAAI,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,EAAE,CAAC;YAChF,IAAI,KAAK,KAAK,WAAW,IAAI,KAAK;gBAAE,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,MAAM,KAAK,CAAC,YAAY,CAAC,aAAa,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;YACpH,IAAI,KAAK,KAAK,aAAa,IAAI,OAAO;gBAAE,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,MAAM,KAAK,CAAC,YAAY,CAAC,eAAe,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;YAC5H,IAAI,KAAK,KAAK,mBAAmB,IAAI,KAAK;gBAAE,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,MAAM,KAAK,CAAC,YAAY,CAAC,aAAa,CAAC,MAAM,CAAC,KAAK,EAAE,IAAI,CAAC,EAAE,CAAC;YACrI,IAAI,KAAK,KAAK,qBAAqB,IAAI,OAAO;gBAAE,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,MAAM,KAAK,CAAC,YAAY,CAAC,eAAe,CAAC,MAAM,CAAC,OAAO,EAAE,IAAI,CAAC,EAAE,CAAC;YAC7I,IAAI,KAAK,KAAK,mBAAmB,IAAI,KAAK,EAAE,CAAC;gBAC3C,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;gBAC1C,IAAI,CAAC,OAAO;oBAAE,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,EAAE,OAAO,EAAE,gBAAgB,EAAE,EAAE,EAAE,CAAC;gBACrF,oEAAoE;gBACpE,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,MAAM,KAAK,CAAC,YAAY,CAAC,aAAa,CAAC,MAAM,CAAC,KAAK,EAAE,EAAE,GAAG,IAAI,EAAE,OAAO,EAAyB,CAAC,EAAE,CAAC;YAClI,CAAC;YACD,IAAI,KAAK,KAAK,qBAAqB,IAAI,OAAO,EAAE,CAAC;gBAC/C,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;oBAAE,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,EAAE,OAAO,EAAE,gBAAgB,EAAE,EAAE,EAAE,CAAC;gBACzG,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,MAAM,KAAK,CAAC,YAAY,CAAC,eAAe,CAAC,MAAM,CAAC,OAAO,EAAE,IAAI,CAAC,EAAE,CAAC;YAC/F,CAAC;YACD,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,EAAE,OAAO,EAAE,gBAAgB,EAAE,EAAE,EAAE,CAAC;QACzE,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,MAAM,MAAM,GAAI,CAAyB,CAAC,MAAM,IAAI,GAAG,CAAC;YACxD,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,EAAE,OAAO,EAAE,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,iBAAiB,EAAE,EAAE,EAAE,CAAC;QACtG,CAAC;IACH,CAAC,CAAC;AACJ,CAAC"}

package/dist/client/devices.d.ts

@@ -0,0 +1,44 @@
+import { type RequestFn } from './request';
+import type { ListPage } from './types';
+export interface Device {
+    object: 'device';
+    id: string;
+    user_id: string | null;
+    source: string;
+    external_id: string;
+    name: string | null;
+    platform: string | null;
+    managed: boolean;
+    compliant: boolean;
+    posture: Record<string, unknown>;
+    last_reported_at: number;
+    created_at: number;
+}
+/** One posture report. Identify the owner with `user_id` or a verified `user_email`. */
+export interface DeviceReportBody {
+    external_id: string;
+    /** Who reported it (`intune`, `jamf`, …); defaults to `api`. */
+    source?: string;
+    user_id?: string | null;
+    user_email?: string;
+    name?: string | null;
+    platform?: string | null;
+    managed?: boolean;
+    compliant?: boolean;
+    posture?: Record<string, unknown>;
+}
+export declare function devicesResource(request: RequestFn): {
+    list(query?: {
+        user_id?: string;
+        source?: string;
+    }): Promise<ListPage<Device>>;
+    get(id: string): Promise<Device>;
+    report(body: DeviceReportBody): Promise<Device>;
+    /** Bulk posture ingestion, up to 500 reports. */
+    ingestPosture(devices: DeviceReportBody[]): Promise<ListPage<Device>>;
+    remove(id: string): Promise<{
+        object: "device";
+        id: string;
+        deleted: true;
+    }>;
+};

package/dist/client/devices.js

@@ -0,0 +1,26 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.devicesResource = devicesResource;
+const request_1 = require("./request");
+function devicesResource(request) {
+    return {
+        list(query = {}) {
+            const q = new URLSearchParams(Object.entries(query).filter((e) => e[1] !== undefined)).toString();
+            return request({ method: 'GET', path: `/v1/devices${q ? `?${q}` : ''}` });
+        },
+        get(id) {
+            return request({ method: 'GET', path: `/v1/devices/${(0, request_1.enc)(id)}` });
+        },
+        report(body) {
+            return request({ method: 'PUT', path: '/v1/devices', body });
+        },
+        /** Bulk posture ingestion, up to 500 reports. */
+        ingestPosture(devices) {
+            return request({ method: 'POST', path: '/v1/device_posture', body: { devices } });
+        },
+        remove(id) {
+            return request({ method: 'DELETE', path: `/v1/devices/${(0, request_1.enc)(id)}` });
+        },
+    };
+}
+//# sourceMappingURL=devices.js.map

package/dist/client/devices.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"devices.js","sourceRoot":"","sources":["../../src/client/devices.ts"],"names":[],"mappings":";;AAgCA,0CAoBC;AApDD,uCAAgD;AAgChD,SAAgB,eAAe,CAAC,OAAkB;IAChD,OAAO;QACL,IAAI,CAAC,QAA+C,EAAE;YACpD,MAAM,CAAC,GAAG,IAAI,eAAe,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAyB,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,SAAS,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC;YACzH,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,cAAc,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;QAC5E,CAAC;QACD,GAAG,CAAC,EAAU;YACZ,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,eAAe,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;QACpE,CAAC;QACD,MAAM,CAAC,IAAsB;YAC3B,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC;QAC/D,CAAC;QACD,iDAAiD;QACjD,aAAa,CAAC,OAA2B;YACvC,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,oBAAoB,EAAE,IAAI,EAAE,EAAE,OAAO,EAAE,EAAE,CAAC,CAAC;QACpF,CAAC;QACD,MAAM,CAAC,EAAU;YACf,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,eAAe,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;QACvE,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/client/email-templates.d.ts

@@ -1,7 +1,7 @@
 import { type RequestFn } from './request';
 import type { ListPage } from './types';
 /** The transactional email a template drives. */
-export type EmailTemplateName = 'verification_code' | 'magic_link' | 'password_reset' | 'password_changed' | 'account_exists_notice' | 'organization_invitation' | 'new_device_sign_in' | 'session_revoked_token_reuse' | 'account_locked' | 'account_secured' | 'team_member_added' | 'team_role_changed' | 'email_changed' | 'verification_link' | 'password_reset_link' | 'account_reactivated';
+export type EmailTemplateName = 'verification_code' | 'magic_link' | 'password_reset' | 'password_changed' | 'account_exists_notice' | 'organization_invitation' | 'new_device_sign_in' | 'session_revoked_token_reuse' | 'account_locked' | 'account_secured' | 'team_member_added' | 'team_role_changed' | 'email_changed' | 'email_change_confirm' | 'parental_consent_request' | 'phone_changed' | 'identity_linked' | 'identity_unlinked' | 'passkey_added' | 'passkey_removed' | 'recovery_codes_regenerated' | 'factor_removed' | 'device_key_added' | 'device_key_removed' | 'risk_alert' | 'verification_link' | 'password_reset_link' | 'account_reactivated';
 /** The customizable body of a template: a subject line and a text body. */
 export interface EmailTemplateBody {
     subject?: string;

package/dist/client/email-templates.js.map

@@ -1 +1 @@
-{"version":3,"file":"email-templates.js","sourceRoot":"","sources":["../../src/client/email-templates.ts"],"names":[],"mappings":";;AA6DA,wDAkBC;AA/ED,uCAAgD;AA6DhD,SAAgB,sBAAsB,CAAC,OAAkB;IACvD,OAAO;QACL,IAAI;YACF,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,qBAAqB,EAAE,CAAC,CAAC;QACjE,CAAC;QACD,2EAA2E;QAC3E,OAAO,CAAC,IAAY,EAAE,OAA0B,EAAE;YAChD,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,uBAAuB,IAAA,aAAG,EAAC,IAAI,CAAC,UAAU,EAAE,IAAI,EAAE,CAAC,CAAC;QAC7F,CAAC;QACD,2DAA2D;QAC3D,MAAM,CAAC,IAAY,EAAE,IAAuB;YAC1C,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,uBAAuB,IAAA,aAAG,EAAC,IAAI,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;QACpF,CAAC;QACD,8BAA8B;QAC9B,MAAM,CAAC,IAAY;YACjB,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,uBAAuB,IAAA,aAAG,EAAC,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC;QACjF,CAAC;KACF,CAAC;AACJ,CAAC"}
+{"version":3,"file":"email-templates.js","sourceRoot":"","sources":["../../src/client/email-templates.ts"],"names":[],"mappings":";;AAyEA,wDAkBC;AA3FD,uCAAgD;AAyEhD,SAAgB,sBAAsB,CAAC,OAAkB;IACvD,OAAO;QACL,IAAI;YACF,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,qBAAqB,EAAE,CAAC,CAAC;QACjE,CAAC;QACD,2EAA2E;QAC3E,OAAO,CAAC,IAAY,EAAE,OAA0B,EAAE;YAChD,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,uBAAuB,IAAA,aAAG,EAAC,IAAI,CAAC,UAAU,EAAE,IAAI,EAAE,CAAC,CAAC;QAC7F,CAAC;QACD,2DAA2D;QAC3D,MAAM,CAAC,IAAY,EAAE,IAAuB;YAC1C,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,uBAAuB,IAAA,aAAG,EAAC,IAAI,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;QACpF,CAAC;QACD,8BAA8B;QAC9B,MAAM,CAAC,IAAY;YACjB,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,uBAAuB,IAAA,aAAG,EAAC,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC;QACjF,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/client/flags.d.ts

@@ -0,0 +1,101 @@
+import { type RequestFn } from './request';
+import type { CursorParams } from './types';
+export type FeatureFlagType = 'boolean' | 'string' | 'int' | 'json';
+export type FeatureFlagValue = boolean | string | number | Record<string, unknown> | unknown[];
+/** Who a flag is evaluated for. `user_id` (else `org_id`) seeds percentage rollouts. */
+export interface FeatureFlagSubject {
+    user_id?: string | null;
+    org_id?: string | null;
+    plan?: string | null;
+}
+/** Every given `match` dimension must hold; an empty rule matches everyone. */
+export interface FeatureFlagRule {
+    match?: {
+        user_ids?: string[];
+        org_ids?: string[];
+        plans?: string[];
+    };
+    /** 0–100: the share of matching subjects, stable per flag and subject. */
+    percentage?: number;
+    value: FeatureFlagValue;
+}
+export interface FeatureFlag {
+    object: 'feature_flag';
+    id: string;
+    key: string;
+    type: FeatureFlagType;
+    description: string | null;
+    enabled: boolean;
+    default_value: FeatureFlagValue;
+    /** Returned while the flag is switched off. */
+    off_value: FeatureFlagValue;
+    rules: FeatureFlagRule[];
+    created_at: number;
+    updated_at: number;
+}
+export interface CreateFeatureFlagBody {
+    key: string;
+    type: FeatureFlagType;
+    default_value: FeatureFlagValue;
+    description?: string;
+    enabled?: boolean;
+    off_value?: FeatureFlagValue;
+    rules?: FeatureFlagRule[];
+}
+export type UpdateFeatureFlagBody = Partial<Omit<CreateFeatureFlagBody, 'key' | 'type'>>;
+export interface FeatureFlagEvaluation {
+    object: 'feature_flag_evaluation';
+    subject: FeatureFlagSubject;
+    flags: Record<string, {
+        value: FeatureFlagValue;
+        reason: string;
+    }>;
+}
+export interface AssignEntitlementsBody {
+    plan?: string | null;
+    features?: string[] | null;
+    limits?: Record<string, unknown> | null;
+    /** Epoch ms; omit for open-ended. */
+    expires_at?: number | null;
+}
+export interface AssignedEntitlements {
+    object: 'assigned_entitlements';
+    subject_type: 'user' | 'org';
+    subject_id: string;
+    plan: string | null;
+    features: string[] | null;
+    limits: Record<string, unknown> | null;
+    expires_at: number | null;
+}
+/** Evaluate a flag definition for a subject (first matching in-bucket rule wins, else the default). */
+export declare function evaluateFeatureFlag(flag: FeatureFlag, subject: FeatureFlagSubject): FeatureFlagValue;
+export declare function flagsResource(request: RequestFn, cacheTtlMs?: number): {
+    create(body: CreateFeatureFlagBody, idempotencyKey?: string): Promise<FeatureFlag>;
+    /** `starting_after` is the key of the last flag of the previous page. */
+    list(params?: CursorParams): Promise<{
+        object: "list";
+        data: FeatureFlag[];
+        has_more: boolean;
+    }>;
+    retrieve(key: string): Promise<FeatureFlag>;
+    update(key: string, body: UpdateFeatureFlagBody): Promise<FeatureFlag>;
+    delete(key: string): Promise<{
+        object: "feature_flag";
+        id: string;
+        key: string;
+        deleted: boolean;
+    }>;
+    /** Server-side evaluation; `plan` defaults to the org's (else the user's) resolved plan. */
+    evaluate(body: FeatureFlagSubject & {
+        keys?: string[];
+    }): Promise<FeatureFlagEvaluation>;
+    /** Local evaluation against cached definitions. `plan` is not looked up here — pass it for plan rules. */
+    get<T extends FeatureFlagValue>(key: string, subject: FeatureFlagSubject, fallback: T): Promise<T>;
+    /** True only for a boolean flag that evaluates to true; an unknown flag is false. */
+    isEnabled(key: string, subject?: FeatureFlagSubject): Promise<boolean>;
+    /** Drop the cached definitions (e.g. after changing a flag). */
+    invalidate(): void;
+    /** Replace the entitlements assigned to an organization (an empty body clears them). */
+    assignOrganizationEntitlements(orgId: string, body: AssignEntitlementsBody): Promise<AssignedEntitlements>;
+    assignUserEntitlements(userId: string, body: AssignEntitlementsBody): Promise<AssignedEntitlements>;
+};

package/dist/client/flags.js

@@ -0,0 +1,104 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.evaluateFeatureFlag = evaluateFeatureFlag;
+exports.flagsResource = flagsResource;
+const sha256_1 = require("@noble/hashes/sha256");
+const request_1 = require("./request");
+/** Same bucketing as the server: the same subject lands in the same bucket everywhere. */
+function bucket(flagKey, subjectKey) {
+    const d = (0, sha256_1.sha256)(new TextEncoder().encode(`${flagKey}:${subjectKey}`));
+    return (((d[0] << 24) | (d[1] << 16) | (d[2] << 8) | d[3]) >>> 0) % 100;
+}
+/** Evaluate a flag definition for a subject (first matching in-bucket rule wins, else the default). */
+function evaluateFeatureFlag(flag, subject) {
+    if (!flag.enabled)
+        return flag.off_value;
+    const seed = subject.user_id ?? subject.org_id ?? '';
+    for (const rule of flag.rules) {
+        const m = rule.match ?? {};
+        if (m.user_ids && (!subject.user_id || !m.user_ids.includes(subject.user_id)))
+            continue;
+        if (m.org_ids && (!subject.org_id || !m.org_ids.includes(subject.org_id)))
+            continue;
+        if (m.plans && (!subject.plan || !m.plans.includes(subject.plan)))
+            continue;
+        if (rule.percentage !== undefined && (!seed || bucket(flag.key, seed) >= rule.percentage))
+            continue;
+        return rule.value;
+    }
+    return flag.default_value;
+}
+const pageAll = async (request) => {
+    const out = [];
+    let after;
+    for (;;) {
+        const page = await request({
+            method: 'GET',
+            path: '/v1/feature_flags',
+            query: { limit: 200, starting_after: after },
+        });
+        out.push(...page.data);
+        if (!page.has_more || page.data.length === 0)
+            return out;
+        after = page.data[page.data.length - 1].key;
+    }
+};
+function flagsResource(request, cacheTtlMs = 30_000) {
+    let cache;
+    let inflight;
+    /** All flag definitions, cached for `cacheTtlMs`; concurrent callers share one fetch. */
+    const definitions = async () => {
+        if (cache && Date.now() - cache.at < cacheTtlMs)
+            return cache.flags;
+        inflight ??= pageAll(request)
+            .then((all) => {
+            cache = { at: Date.now(), flags: new Map(all.map((f) => [f.key, f])) };
+            return cache.flags;
+        })
+            .finally(() => { inflight = undefined; });
+        return inflight;
+    };
+    return {
+        create(body, idempotencyKey) {
+            return request({ method: 'POST', path: '/v1/feature_flags', body, idempotencyKey });
+        },
+        /** `starting_after` is the key of the last flag of the previous page. */
+        list(params = {}) {
+            return request({ method: 'GET', path: '/v1/feature_flags', query: params });
+        },
+        retrieve(key) {
+            return request({ method: 'GET', path: `/v1/feature_flags/${(0, request_1.enc)(key)}` });
+        },
+        update(key, body) {
+            return request({ method: 'PATCH', path: `/v1/feature_flags/${(0, request_1.enc)(key)}`, body });
+        },
+        delete(key) {
+            return request({ method: 'DELETE', path: `/v1/feature_flags/${(0, request_1.enc)(key)}` });
+        },
+        /** Server-side evaluation; `plan` defaults to the org's (else the user's) resolved plan. */
+        evaluate(body) {
+            return request({ method: 'POST', path: '/v1/feature_flags/evaluate', body });
+        },
+        /** Local evaluation against cached definitions. `plan` is not looked up here — pass it for plan rules. */
+        async get(key, subject, fallback) {
+            const flag = (await definitions()).get(key);
+            return flag ? evaluateFeatureFlag(flag, subject) : fallback;
+        },
+        /** True only for a boolean flag that evaluates to true; an unknown flag is false. */
+        async isEnabled(key, subject = {}) {
+            return (await this.get(key, subject, false)) === true;
+        },
+        /** Drop the cached definitions (e.g. after changing a flag). */
+        invalidate() {
+            cache = undefined;
+        },
+        /** Replace the entitlements assigned to an organization (an empty body clears them). */
+        assignOrganizationEntitlements(orgId, body) {
+            return request({ method: 'PUT', path: `/v1/organizations/${(0, request_1.enc)(orgId)}/entitlements`, body });
+        },
+        assignUserEntitlements(userId, body) {
+            return request({ method: 'PUT', path: `/v1/users/${(0, request_1.enc)(userId)}/entitlements`, body });
+        },
+    };
+}
+//# sourceMappingURL=flags.js.map

package/dist/client/flags.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"flags.js","sourceRoot":"","sources":["../../src/client/flags.ts"],"names":[],"mappings":";;AAgFA,kDAYC;AAiBD,sCA0DC;AAvKD,iDAA8C;AAC9C,uCAAgD;AAwEhD,0FAA0F;AAC1F,SAAS,MAAM,CAAC,OAAe,EAAE,UAAkB;IACjD,MAAM,CAAC,GAAG,IAAA,eAAM,EAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,GAAG,OAAO,IAAI,UAAU,EAAE,CAAC,CAAC,CAAC;IACvE,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAE,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAE,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAE,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAE,CAAC,KAAK,CAAC,CAAC,GAAG,GAAG,CAAC;AAC9E,CAAC;AAED,uGAAuG;AACvG,SAAgB,mBAAmB,CAAC,IAAiB,EAAE,OAA2B;IAChF,IAAI,CAAC,IAAI,CAAC,OAAO;QAAE,OAAO,IAAI,CAAC,SAAS,CAAC;IACzC,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,IAAI,OAAO,CAAC,MAAM,IAAI,EAAE,CAAC;IACrD,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;QAC9B,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC;QAC3B,IAAI,CAAC,CAAC,QAAQ,IAAI,CAAC,CAAC,OAAO,CAAC,OAAO,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;YAAE,SAAS;QACxF,IAAI,CAAC,CAAC,OAAO,IAAI,CAAC,CAAC,OAAO,CAAC,MAAM,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;YAAE,SAAS;QACpF,IAAI,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,OAAO,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;YAAE,SAAS;QAC5E,IAAI,IAAI,CAAC,UAAU,KAAK,SAAS,IAAI,CAAC,CAAC,IAAI,IAAI,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC;YAAE,SAAS;QACpG,OAAO,IAAI,CAAC,KAAK,CAAC;IACpB,CAAC;IACD,OAAO,IAAI,CAAC,aAAa,CAAC;AAC5B,CAAC;AAED,MAAM,OAAO,GAAG,KAAK,EAAE,OAAkB,EAA0B,EAAE;IACnE,MAAM,GAAG,GAAkB,EAAE,CAAC;IAC9B,IAAI,KAAyB,CAAC;IAC9B,SAAS,CAAC;QACR,MAAM,IAAI,GAAG,MAAM,OAAO,CAA6C;YACrE,MAAM,EAAE,KAAK;YACb,IAAI,EAAE,mBAAmB;YACzB,KAAK,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,cAAc,EAAE,KAAK,EAAE;SAC7C,CAAC,CAAC;QACH,GAAG,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC;QACvB,IAAI,CAAC,IAAI,CAAC,QAAQ,IAAI,IAAI,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,GAAG,CAAC;QACzD,KAAK,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAE,CAAC,GAAG,CAAC;IAC/C,CAAC;AACH,CAAC,CAAC;AAEF,SAAgB,aAAa,CAAC,OAAkB,EAAE,UAAU,GAAG,MAAM;IACnE,IAAI,KAAkE,CAAC;IACvE,IAAI,QAAuD,CAAC;IAE5D,yFAAyF;IACzF,MAAM,WAAW,GAAG,KAAK,IAAuC,EAAE;QAChE,IAAI,KAAK,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK,CAAC,EAAE,GAAG,UAAU;YAAE,OAAO,KAAK,CAAC,KAAK,CAAC;QACpE,QAAQ,KAAK,OAAO,CAAC,OAAO,CAAC;aAC1B,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE;YACZ,KAAK,GAAG,EAAE,EAAE,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YACvE,OAAO,KAAK,CAAC,KAAK,CAAC;QACrB,CAAC,CAAC;aACD,OAAO,CAAC,GAAG,EAAE,GAAG,QAAQ,GAAG,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC;QAC5C,OAAO,QAAQ,CAAC;IAClB,CAAC,CAAC;IAEF,OAAO;QACL,MAAM,CAAC,IAA2B,EAAE,cAAuB;YACzD,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,mBAAmB,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC;QACtF,CAAC;QACD,yEAAyE;QACzE,IAAI,CAAC,SAAuB,EAAE;YAC5B,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,mBAAmB,EAAE,KAAK,EAAE,MAAqD,EAAE,CAAC,CAAC;QAC7H,CAAC;QACD,QAAQ,CAAC,GAAW;YAClB,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,qBAAqB,IAAA,aAAG,EAAC,GAAG,CAAC,EAAE,EAAE,CAAC,CAAC;QAC3E,CAAC;QACD,MAAM,CAAC,GAAW,EAAE,IAA2B;YAC7C,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,qBAAqB,IAAA,aAAG,EAAC,GAAG,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;QACnF,CAAC;QACD,MAAM,CAAC,GAAW;YAChB,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,qBAAqB,IAAA,aAAG,EAAC,GAAG,CAAC,EAAE,EAAE,CAAC,CAAC;QAC9E,CAAC;QACD,4FAA4F;QAC5F,QAAQ,CAAC,IAA8C;YACrD,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,4BAA4B,EAAE,IAAI,EAAE,CAAC,CAAC;QAC/E,CAAC;QACD,0GAA0G;QAC1G,KAAK,CAAC,GAAG,CAA6B,GAAW,EAAE,OAA2B,EAAE,QAAW;YACzF,MAAM,IAAI,GAAG,CAAC,MAAM,WAAW,EAAE,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YAC5C,OAAO,IAAI,CAAC,CAAC,CAAE,mBAAmB,CAAC,IAAI,EAAE,OAAO,CAAO,CAAC,CAAC,CAAC,QAAQ,CAAC;QACrE,CAAC;QACD,qFAAqF;QACrF,KAAK,CAAC,SAAS,CAAC,GAAW,EAAE,UAA8B,EAAE;YAC3D,OAAO,CAAC,MAAM,IAAI,CAAC,GAAG,CAAmB,GAAG,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC,KAAK,IAAI,CAAC;QAC1E,CAAC;QACD,gEAAgE;QAChE,UAAU;YACR,KAAK,GAAG,SAAS,CAAC;QACpB,CAAC;QACD,wFAAwF;QACxF,8BAA8B,CAAC,KAAa,EAAE,IAA4B;YACxE,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,qBAAqB,IAAA,aAAG,EAAC,KAAK,CAAC,eAAe,EAAE,IAAI,EAAE,CAAC,CAAC;QAChG,CAAC;QACD,sBAAsB,CAAC,MAAc,EAAE,IAA4B;YACjE,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,aAAa,IAAA,aAAG,EAAC,MAAM,CAAC,eAAe,EAAE,IAAI,EAAE,CAAC,CAAC;QACzF,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/client/groups.d.ts

@@ -0,0 +1,146 @@
+import { type RequestFn } from './request';
+import type { ListPage } from './types';
+/**
+ * Instance-level groups (independent of organizations) and the rules engine.
+ * Groups nest, carry attributes, map to app roles, can ride the session token as
+ * `groups`, and fill by hand, by filter, from SSO claims or by rules.
+ */
+export interface Group {
+    object: 'group';
+    id: string;
+    slug: string;
+    name: string;
+    description: string | null;
+    parent_id: string | null;
+    attributes: Record<string, unknown>;
+    app_role_keys: string[];
+    include_in_token: boolean;
+    dynamic_filter: Record<string, unknown> | null;
+    sso_match: {
+        claim: string;
+        equals?: string;
+        contains?: string;
+        matches?: string;
+    } | null;
+    member_count?: number;
+    /** `users.groups` only: how the user joined. */
+    source?: 'manual' | 'dynamic' | 'sso' | 'rule';
+    created_at: number;
+    updated_at: number;
+}
+export interface GroupBody {
+    slug?: string;
+    name?: string;
+    description?: string | null;
+    parent_id?: string | null;
+    attributes?: Record<string, unknown>;
+    app_role_keys?: string[];
+    include_in_token?: boolean;
+    /** A user-search filter tree. */
+    dynamic_filter?: Record<string, unknown> | null;
+    sso_match?: Group['sso_match'];
+}
+export interface GroupMember {
+    object: 'group_member';
+    group_id: string;
+    user_id: string;
+    source: 'manual' | 'dynamic' | 'sso' | 'rule';
+    source_ref: string | null;
+    created_at: number;
+}
+export type GroupRuleAction = {
+    type: 'add_to_group';
+    group: string;
+} | {
+    type: 'add_app_role';
+    role: string;
+} | {
+    type: 'set_trait';
+    key: string;
+    value: unknown;
+};
+export interface GroupRule {
+    object: 'group_rule';
+    id: string;
+    name: string;
+    enabled: boolean;
+    priority: number;
+    condition: Record<string, unknown>;
+    actions: GroupRuleAction[];
+    created_by: string | null;
+    created_at: number;
+    updated_at: number;
+}
+export interface GroupRuleBody {
+    name?: string;
+    enabled?: boolean;
+    priority?: number;
+    condition?: Record<string, unknown>;
+    actions?: GroupRuleAction[];
+}
+export interface GroupRuleResult {
+    object: 'group_rule_result';
+    rule_id: string;
+    matched: number;
+    groups_added: number;
+    groups_removed: number;
+    roles_granted: number;
+    traits_set: number;
+}
+export declare function groupsResource(request: RequestFn): {
+    list(): Promise<ListPage<Group>>;
+    get(idOrSlug: string): Promise<Group>;
+    create(body: GroupBody & {
+        slug: string;
+        name: string;
+    }, idempotencyKey?: string): Promise<Group>;
+    update(idOrSlug: string, body: GroupBody): Promise<Group>;
+    delete(idOrSlug: string): Promise<{
+        object: "group";
+        id: string;
+        deleted: true;
+    }>;
+    listMembers(idOrSlug: string, query?: {
+        limit?: number;
+        starting_after?: string;
+    }): Promise<ListPage<GroupMember> & {
+        next_cursor: string | null;
+    }>;
+    /** Add up to 500 users by hand. */
+    addMembers(idOrSlug: string, userIds: string[]): Promise<{
+        added: number;
+        promoted: number;
+        already_member: number;
+        skipped: number;
+    }>;
+    removeMembers(idOrSlug: string, userIds: string[]): Promise<{
+        removed: number;
+    }>;
+    /** Re-evaluate a dynamic group's filter now. */
+    reapply(idOrSlug: string): Promise<{
+        matched: number;
+        added: number;
+        removed: number;
+    }>;
+    /** A user's direct groups. */
+    forUser(userId: string): Promise<ListPage<Group>>;
+    rules: {
+        list(): Promise<ListPage<GroupRule>>;
+        get(id: string): Promise<GroupRule>;
+        create(body: GroupRuleBody & {
+            name: string;
+            condition: Record<string, unknown>;
+            actions: GroupRuleAction[];
+        }, idempotencyKey?: string): Promise<GroupRule>;
+        update(id: string, body: GroupRuleBody): Promise<GroupRule>;
+        delete(id: string): Promise<{
+            object: "group_rule";
+            id: string;
+            deleted: true;
+        }>;
+        /** Run one rule now. */
+        apply(id: string): Promise<GroupRuleResult>;
+        /** Run every enabled rule in priority order. */
+        applyAll(): Promise<ListPage<GroupRuleResult>>;
+    };
+};

package/dist/client/groups.js

@@ -0,0 +1,67 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.groupsResource = groupsResource;
+const request_1 = require("./request");
+function groupsResource(request) {
+    return {
+        list() {
+            return request({ method: 'GET', path: '/v1/groups' });
+        },
+        get(idOrSlug) {
+            return request({ method: 'GET', path: `/v1/groups/${(0, request_1.enc)(idOrSlug)}` });
+        },
+        create(body, idempotencyKey) {
+            return request({ method: 'POST', path: '/v1/groups', body, idempotencyKey });
+        },
+        update(idOrSlug, body) {
+            return request({ method: 'PATCH', path: `/v1/groups/${(0, request_1.enc)(idOrSlug)}`, body });
+        },
+        delete(idOrSlug) {
+            return request({ method: 'DELETE', path: `/v1/groups/${(0, request_1.enc)(idOrSlug)}` });
+        },
+        listMembers(idOrSlug, query = {}) {
+            return request({ method: 'GET', path: `/v1/groups/${(0, request_1.enc)(idOrSlug)}/members`, query });
+        },
+        /** Add up to 500 users by hand. */
+        addMembers(idOrSlug, userIds) {
+            return request({ method: 'POST', path: `/v1/groups/${(0, request_1.enc)(idOrSlug)}/members`, body: { user_ids: userIds } });
+        },
+        removeMembers(idOrSlug, userIds) {
+            return request({ method: 'POST', path: `/v1/groups/${(0, request_1.enc)(idOrSlug)}/members/remove`, body: { user_ids: userIds } });
+        },
+        /** Re-evaluate a dynamic group's filter now. */
+        reapply(idOrSlug) {
+            return request({ method: 'POST', path: `/v1/groups/${(0, request_1.enc)(idOrSlug)}/reapply` });
+        },
+        /** A user's direct groups. */
+        forUser(userId) {
+            return request({ method: 'GET', path: `/v1/users/${(0, request_1.enc)(userId)}/groups` });
+        },
+        rules: {
+            list() {
+                return request({ method: 'GET', path: '/v1/group_rules' });
+            },
+            get(id) {
+                return request({ method: 'GET', path: `/v1/group_rules/${(0, request_1.enc)(id)}` });
+            },
+            create(body, idempotencyKey) {
+                return request({ method: 'POST', path: '/v1/group_rules', body, idempotencyKey });
+            },
+            update(id, body) {
+                return request({ method: 'PATCH', path: `/v1/group_rules/${(0, request_1.enc)(id)}`, body });
+            },
+            delete(id) {
+                return request({ method: 'DELETE', path: `/v1/group_rules/${(0, request_1.enc)(id)}` });
+            },
+            /** Run one rule now. */
+            apply(id) {
+                return request({ method: 'POST', path: `/v1/group_rules/${(0, request_1.enc)(id)}/apply` });
+            },
+            /** Run every enabled rule in priority order. */
+            applyAll() {
+                return request({ method: 'POST', path: '/v1/group_rules/apply' });
+            },
+        },
+    };
+}
+//# sourceMappingURL=groups.js.map

package/dist/client/groups.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"groups.js","sourceRoot":"","sources":["../../src/client/groups.ts"],"names":[],"mappings":";;AAqFA,wCA6DC;AAlJD,uCAAgD;AAqFhD,SAAgB,cAAc,CAAC,OAAkB;IAC/C,OAAO;QACL,IAAI;YACF,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC,CAAC;QACxD,CAAC;QACD,GAAG,CAAC,QAAgB;YAClB,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,cAAc,IAAA,aAAG,EAAC,QAAQ,CAAC,EAAE,EAAE,CAAC,CAAC;QACzE,CAAC;QACD,MAAM,CAAC,IAAgD,EAAE,cAAuB;YAC9E,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC;QAC/E,CAAC;QACD,MAAM,CAAC,QAAgB,EAAE,IAAe;YACtC,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,cAAc,IAAA,aAAG,EAAC,QAAQ,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;QACjF,CAAC;QACD,MAAM,CAAC,QAAgB;YACrB,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,cAAc,IAAA,aAAG,EAAC,QAAQ,CAAC,EAAE,EAAE,CAAC,CAAC;QAC5E,CAAC;QACD,WAAW,CAAC,QAAgB,EAAE,QAAqD,EAAE;YACnF,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,cAAc,IAAA,aAAG,EAAC,QAAQ,CAAC,UAAU,EAAE,KAAK,EAAE,CAAC,CAAC;QACxF,CAAC;QACD,mCAAmC;QACnC,UAAU,CAAC,QAAgB,EAAE,OAAiB;YAC5C,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,cAAc,IAAA,aAAG,EAAC,QAAQ,CAAC,UAAU,EAAE,IAAI,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE,EAAE,CAAC,CAAC;QAC/G,CAAC;QACD,aAAa,CAAC,QAAgB,EAAE,OAAiB;YAC/C,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,cAAc,IAAA,aAAG,EAAC,QAAQ,CAAC,iBAAiB,EAAE,IAAI,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE,EAAE,CAAC,CAAC;QACtH,CAAC;QACD,gDAAgD;QAChD,OAAO,CAAC,QAAgB;YACtB,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,cAAc,IAAA,aAAG,EAAC,QAAQ,CAAC,UAAU,EAAE,CAAC,CAAC;QAClF,CAAC;QACD,8BAA8B;QAC9B,OAAO,CAAC,MAAc;YACpB,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,aAAa,IAAA,aAAG,EAAC,MAAM,CAAC,SAAS,EAAE,CAAC,CAAC;QAC7E,CAAC;QACD,KAAK,EAAE;YACL,IAAI;gBACF,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,iBAAiB,EAAE,CAAC,CAAC;YAC7D,CAAC;YACD,GAAG,CAAC,EAAU;gBACZ,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,mBAAmB,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;YACxE,CAAC;YACD,MAAM,CAAC,IAAsG,EAAE,cAAuB;gBACpI,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,iBAAiB,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC;YACpF,CAAC;YACD,MAAM,CAAC,EAAU,EAAE,IAAmB;gBACpC,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,mBAAmB,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;YAChF,CAAC;YACD,MAAM,CAAC,EAAU;gBACf,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,mBAAmB,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;YAC3E,CAAC;YACD,wBAAwB;YACxB,KAAK,CAAC,EAAU;gBACd,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,mBAAmB,IAAA,aAAG,EAAC,EAAE,CAAC,QAAQ,EAAE,CAAC,CAAC;YAC/E,CAAC;YACD,gDAAgD;YAChD,QAAQ;gBACN,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,uBAAuB,EAAE,CAAC,CAAC;YACpE,CAAC;SACF;KACF,CAAC;AACJ,CAAC"}

package/dist/client/identity-verification.d.ts

@@ -0,0 +1,62 @@
+import { type RequestFn } from './request';
+export type IdentityVerificationOutcome = 'pending' | 'approved' | 'declined' | 'needs_review';
+export interface IdentityVerification {
+    object: 'identity_verification';
+    id: string;
+    user_id: string;
+    provider: 'persona' | 'onfido' | 'veriff' | 'stripe_identity';
+    status: IdentityVerificationOutcome;
+    reason: string | null;
+    /** The verification service's hosted page, while pending. */
+    url: string | null;
+    decided_by: string | null;
+    created_at: number;
+    completed_at: number | null;
+}
+export interface IdentityVerificationSettings {
+    object: 'identity_verification_settings';
+    enabled: boolean;
+    /** The service connector (Persona, Onfido, Veriff or Stripe Identity) that does the checking. */
+    connector_id: string | null;
+    /** Offer a verified identity as the custom second step of sign-in. */
+    as_challenge: boolean;
+    /** Give this URL to the verification service for verdict webhooks; store its webhook secret on the connector as `webhook_secret`. */
+    webhook_url: string | null;
+}
+/**
+ * Identity verification (document and selfie) through your own verification
+ * service. An approved check is written to the user as
+ * `public_metadata.verification.identity` (`{ status, provider, verified_at }`).
+ */
+export declare function identityVerificationResource(request: RequestFn): {
+    settings(): Promise<IdentityVerificationSettings>;
+    updateSettings(body: {
+        enabled: boolean;
+        connector_id?: string | null;
+        as_challenge?: boolean;
+    }): Promise<IdentityVerificationSettings>;
+    /** Checks by status, newest first. Defaults to `needs_review`, the review queue. */
+    list(params?: {
+        status?: IdentityVerificationOutcome;
+    }): Promise<{
+        object: "list";
+        data: IdentityVerification[];
+        has_more: boolean;
+    }>;
+    /** One check; a pending one is refreshed from the verification service. */
+    get(id: string): Promise<IdentityVerification>;
+    /** Approve or decline a check that is waiting for review. */
+    decide(id: string, body: {
+        decision: "approved" | "declined";
+        reason?: string;
+    }): Promise<IdentityVerification>;
+    forUser(userId: string): Promise<{
+        object: "list";
+        data: IdentityVerification[];
+        has_more: boolean;
+    }>;
+    /** Start a check for a user; send them to the returned `url`. */
+    start(userId: string, body?: {
+        redirect_url?: string;
+    }): Promise<IdentityVerification>;
+};