@atlasauth/backend 0.24.0 → 0.25.0

package/dist/client/messaging.d.ts

@@ -18,9 +18,9 @@ import { type RequestFn } from './request';
  * stored secret) stays. So a from-address change need not re-enter the API key.
  */
 /** Email transports accepted by `PUT /v1/messaging_providers/email`. */
-export type EmailTransport = 'resend' | 'ses' | 'smtp' | 'brevo' | 'mailgun';
+export type EmailTransport = 'resend' | 'ses' | 'smtp' | 'brevo' | 'mailgun' | 'webhook';
 /** SMS transports accepted by `PUT /v1/messaging_providers/sms`. */
-export type SmsTransport = 'twilio' | 'vonage' | 'messagebird' | 'plivo' | 'telnyx' | 'sinch' | 'infobip' | 'clicksend' | 'bandwidth' | 'aws_sns';
+export type SmsTransport = 'twilio' | 'vonage' | 'messagebird' | 'plivo' | 'telnyx' | 'sinch' | 'infobip' | 'clicksend' | 'bandwidth' | 'aws_sns' | 'webhook';
 export type MessagingTransport = EmailTransport | SmsTransport;
 /** Sender number or ID for an SMS provider. `from_address` on the request takes precedence. */
 interface SmsFrom {
@@ -150,6 +150,15 @@ export interface AwsSnsConfig extends SmsFrom {
     /** STS session token, only for temporary credentials. Write-only: never returned. */
     session_token?: string;
 }
+/** Your own delivery endpoint: Atlas POSTs each message, Standard Webhooks signed. */
+export interface WebhookConfig {
+    /** Your HTTPS endpoint (port 443). Required on first setup. */
+    url: string;
+    /** Signing secret (`whsec_…` base64 or any string). Required on first setup. Write-only: never returned. */
+    signing_secret: string;
+    /** Email only. `rendered` (default) sends the final subject/text/html; `raw` sends the template name and variables. */
+    payload?: 'rendered' | 'raw';
+}
 /** The `config` shape for each transport, keyed by transport. */
 export interface MessagingTransportConfigs {
     resend: ResendConfig;
@@ -167,6 +176,7 @@ export interface MessagingTransportConfigs {
     clicksend: ClicksendConfig;
     bandwidth: BandwidthConfig;
     aws_sns: AwsSnsConfig;
+    webhook: WebhookConfig;
 }
 /** The write-only (secret) keys of each transport — never present in a response. */
 export interface MessagingSecretKeys {
@@ -185,6 +195,7 @@ export interface MessagingSecretKeys {
     clicksend: 'api_key';
     bandwidth: 'password';
     aws_sns: 'secret_access_key' | 'session_token';
+    webhook: 'signing_secret';
 }
 interface ProviderBodyBase<T extends MessagingTransport> {
     transport: T;
@@ -413,7 +424,7 @@ export type EnableDevelopmentEmailBody = {
     provider_id: string;
     from_address?: string;
 } | {
-    transport: 'resend' | 'ses' | 'smtp' | 'brevo' | 'mailgun';
+    transport: 'resend' | 'ses' | 'smtp' | 'brevo' | 'mailgun' | 'webhook';
     config?: Record<string, string>;
     from_address?: string;
 };

package/dist/client/messaging.js.map

@@ -1 +1 @@
-{"version":3,"file":"messaging.js","sourceRoot":"","sources":["../../src/client/messaging.ts"],"names":[],"mappings":";;AAoeA,8CA6GC;AAjlBD,uCAAgD;AAoehD,SAAgB,iBAAiB,CAAC,OAAkB;IAIlD,SAAS,QAAQ,CAAC,IAAa;QAC7B,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,+BAA+B,EAAE,IAAI,EAAE,CAAC,CAAC;IACjF,CAAC;IAKD,SAAS,MAAM,CAAC,IAAa;QAC3B,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,6BAA6B,EAAE,IAAI,EAAE,CAAC,CAAC;IAC/E,CAAC;IAED,OAAO;QACL,0EAA0E;QAC1E,GAAG;YACD,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,yBAAyB,EAAE,CAAC,CAAC;QACrE,CAAC;QACD,oFAAoF;QACpF,OAAO,CACL,OAAU;YAEV,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,2BAA2B,OAAO,EAAE,EAAE,CAAC,CAAC;QAChF,CAAC;QACD;;;;WAIG;QACH,QAAQ;QACR;;;;WAIG;QACH,MAAM;QACN;;;;;;WAMG;QACH,aAAa,CACX,OAAwB,EACxB,UAA+B,EAAE;YAEjC,OAAO,OAAO,CAAC;gBACb,MAAM,EAAE,QAAQ;gBAChB,IAAI,EAAE,2BAA2B,IAAA,aAAG,EAAC,OAAO,CAAC,EAAE;gBAC/C,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aACvD,CAAC,CAAC;QACL,CAAC;QACD;;;WAGG;QACH,gBAAgB,EAAE;YAChB,4EAA4E;YAC5E,GAAG;gBACD,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,2CAA2C,EAAE,CAAC,CAAC;YACvF,CAAC;YACD,8FAA8F;YAC9F,MAAM,CAAC,IAAgC;gBACrC,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,2CAA2C,EAAE,IAAI,EAAE,CAAC,CAAC;YAC9F,CAAC;YACD,iDAAiD;YACjD,OAAO;gBACL,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,2CAA2C,EAAE,CAAC,CAAC;YAC1F,CAAC;SACF;QACD,4FAA4F;QAC5F,YAAY,EAAE;YACZ,uDAAuD;YACvD,GAAG;gBACD,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,uCAAuC,EAAE,CAAC,CAAC;YACnF,CAAC;YACD,yEAAyE;YACzE,MAAM,CAAC,IAA4B;gBACjC,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,uCAAuC,EAAE,IAAI,EAAE,CAAC,CAAC;YAC1F,CAAC;YACD,+EAA+E;YAC/E,MAAM;gBACJ,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,8CAA8C,EAAE,CAAC,CAAC;YAC3F,CAAC;YACD;;;;eAIG;YACH,MAAM,CAAC,UAA+B,EAAE;gBACtC,OAAO,OAAO,CAAC;oBACb,MAAM,EAAE,QAAQ;oBAChB,IAAI,EAAE,uCAAuC;oBAC7C,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;iBACvD,CAAC,CAAC;YACL,CAAC;SACF;QACD,gFAAgF;QAChF,IAAI,CAAC,OAAwB,EAAE,IAAoB;YACjD,OAAO,OAAO,CAAC;gBACb,MAAM,EAAE,MAAM;gBACd,IAAI,EAAE,2BAA2B,IAAA,aAAG,EAAC,OAAO,CAAC,OAAO;gBACpD,IAAI;aACL,CAAC,CAAC;QACL,CAAC;KACF,CAAC;AACJ,CAAC"}
+{"version":3,"file":"messaging.js","sourceRoot":"","sources":["../../src/client/messaging.ts"],"names":[],"mappings":";;AAifA,8CA6GC;AA9lBD,uCAAgD;AAifhD,SAAgB,iBAAiB,CAAC,OAAkB;IAIlD,SAAS,QAAQ,CAAC,IAAa;QAC7B,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,+BAA+B,EAAE,IAAI,EAAE,CAAC,CAAC;IACjF,CAAC;IAKD,SAAS,MAAM,CAAC,IAAa;QAC3B,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,6BAA6B,EAAE,IAAI,EAAE,CAAC,CAAC;IAC/E,CAAC;IAED,OAAO;QACL,0EAA0E;QAC1E,GAAG;YACD,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,yBAAyB,EAAE,CAAC,CAAC;QACrE,CAAC;QACD,oFAAoF;QACpF,OAAO,CACL,OAAU;YAEV,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,2BAA2B,OAAO,EAAE,EAAE,CAAC,CAAC;QAChF,CAAC;QACD;;;;WAIG;QACH,QAAQ;QACR;;;;WAIG;QACH,MAAM;QACN;;;;;;WAMG;QACH,aAAa,CACX,OAAwB,EACxB,UAA+B,EAAE;YAEjC,OAAO,OAAO,CAAC;gBACb,MAAM,EAAE,QAAQ;gBAChB,IAAI,EAAE,2BAA2B,IAAA,aAAG,EAAC,OAAO,CAAC,EAAE;gBAC/C,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aACvD,CAAC,CAAC;QACL,CAAC;QACD;;;WAGG;QACH,gBAAgB,EAAE;YAChB,4EAA4E;YAC5E,GAAG;gBACD,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,2CAA2C,EAAE,CAAC,CAAC;YACvF,CAAC;YACD,8FAA8F;YAC9F,MAAM,CAAC,IAAgC;gBACrC,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,2CAA2C,EAAE,IAAI,EAAE,CAAC,CAAC;YAC9F,CAAC;YACD,iDAAiD;YACjD,OAAO;gBACL,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,2CAA2C,EAAE,CAAC,CAAC;YAC1F,CAAC;SACF;QACD,4FAA4F;QAC5F,YAAY,EAAE;YACZ,uDAAuD;YACvD,GAAG;gBACD,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,uCAAuC,EAAE,CAAC,CAAC;YACnF,CAAC;YACD,yEAAyE;YACzE,MAAM,CAAC,IAA4B;gBACjC,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,uCAAuC,EAAE,IAAI,EAAE,CAAC,CAAC;YAC1F,CAAC;YACD,+EAA+E;YAC/E,MAAM;gBACJ,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,8CAA8C,EAAE,CAAC,CAAC;YAC3F,CAAC;YACD;;;;eAIG;YACH,MAAM,CAAC,UAA+B,EAAE;gBACtC,OAAO,OAAO,CAAC;oBACb,MAAM,EAAE,QAAQ;oBAChB,IAAI,EAAE,uCAAuC;oBAC7C,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;iBACvD,CAAC,CAAC;YACL,CAAC;SACF;QACD,gFAAgF;QAChF,IAAI,CAAC,OAAwB,EAAE,IAAoB;YACjD,OAAO,OAAO,CAAC;gBACb,MAAM,EAAE,MAAM;gBACd,IAAI,EAAE,2BAA2B,IAAA,aAAG,EAAC,OAAO,CAAC,OAAO;gBACpD,IAAI;aACL,CAAC,CAAC;QACL,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/client/mfa-factors.d.ts

@@ -0,0 +1,120 @@
+import { type RequestFn } from './request';
+/** An existing second factor to import with a user (`atlas.users.create({ mfa })`). */
+export interface ImportedMfa {
+    /** An authenticator-app secret. SHA1, SHA256 or SHA512; 6 or 8 digits; 30 or 60 second step. */
+    totp?: {
+        secret_base32: string;
+        algorithm?: 'SHA1' | 'SHA256' | 'SHA512';
+        digits?: 6 | 8;
+        period?: 30 | 60;
+        verified_at?: number | string;
+    };
+    /** A counter-based (HOTP) token. Give `totp` or `hotp`, not both. */
+    hotp?: {
+        secret_base32: string;
+        algorithm?: 'SHA1' | 'SHA256' | 'SHA512';
+        digits?: 6 | 8;
+        /** The next counter the token will produce. Default 0. */
+        counter?: number;
+        verified_at?: number | string;
+    };
+    /** Plaintext recovery codes; they are hashed on import. */
+    backup_codes?: string[];
+}
+export type SmartCardMappingKind = 'san_email' | 'san_upn' | 'subject_cn' | 'serial' | 'fingerprint';
+export interface Yubikey {
+    object: 'yubikey';
+    id: string;
+    public_id: string;
+    label: string | null;
+    user_id: string | null;
+    has_private_id: boolean;
+    last_counter: number | null;
+    created_at: number;
+}
+export interface SmartCardMapping {
+    object: 'smartcard_mapping';
+    id: string;
+    user_id: string;
+    kind: SmartCardMappingKind;
+    value: string;
+    label: string | null;
+    last_used_at: number | null;
+    created_at: number;
+}
+type SecretSet<T extends string> = {
+    object: T;
+    set: true;
+};
+type SecretDeleted<T extends string> = {
+    object: T;
+    deleted: true;
+};
+/**
+ * The additional authentication factors: the write-only BYOK secrets (Yubico cloud, Duo, the
+ * smart card proxy), the self-held Yubico OTP key registry, smart card certificate mappings and
+ * the admin reset for security questions. Turn the factors on in the auth config (`mfa.factors`,
+ * `mfa.hotp`, `mfa.yubikey`, `mfa.duo`, `mfa.smartCard`, `mfa.securityQuestions`).
+ */
+export declare function mfaFactorsResource(request: RequestFn): {
+    /** Store the Yubico cloud API secret key (base64). Write-only. */
+    setYubicoSecret(secret: string): Promise<SecretSet<"yubico_secret">>;
+    removeYubicoSecret(): Promise<SecretDeleted<"yubico_secret">>;
+    /** Store the Duo client secret. Write-only. */
+    setDuoSecret(secret: string): Promise<SecretSet<"duo_secret">>;
+    removeDuoSecret(): Promise<SecretDeleted<"duo_secret">>;
+    /** Ask Duo whether the configured integration key, stored secret and API host are accepted. */
+    duoHealthCheck(): Promise<{
+        object: "duo_health_check";
+        ok: boolean;
+        message: string;
+    }>;
+    /** Store the shared secret your TLS proxy sends so Atlas trusts its certificate headers. Write-only. */
+    setSmartCardSecret(secret: string): Promise<SecretSet<"smart_card_secret">>;
+    removeSmartCardSecret(): Promise<SecretDeleted<"smart_card_secret">>;
+    yubikeys: {
+        /** Registered self-held YubiKeys. The AES keys are never returned. */
+        list(): Promise<{
+            object: "list";
+            data: Yubikey[];
+        }>;
+        /** Register a YubiKey's AES key for self-held Yubico OTP. `userId` assigns it; otherwise the first user to enrol it claims it. */
+        register(body: {
+            publicId: string;
+            aesKey: string;
+            privateId?: string;
+            label?: string;
+            userId?: string;
+        }): Promise<Yubikey>;
+        remove(id: string): Promise<{
+            object: "yubikey";
+            id: string;
+            deleted: true;
+        }>;
+    };
+    smartCardMappings: {
+        list(userId: string): Promise<{
+            object: "list";
+            data: SmartCardMapping[];
+        }>;
+        /** Pre-register the certificate attribute that signs a user in. A `serial` needs the certificate's `issuer` DN. */
+        add(userId: string, body: {
+            kind: SmartCardMappingKind;
+            value: string;
+            issuer?: string;
+            label?: string;
+        }): Promise<SmartCardMapping>;
+        remove(userId: string, mappingId: string): Promise<{
+            object: "smartcard_mapping";
+            id: string;
+            deleted: true;
+        }>;
+    };
+    /** Clear a user's security-question answers (and any lockout). */
+    resetSecurityQuestions(userId: string): Promise<{
+        object: "security_questions";
+        user_id: string;
+        deleted: boolean;
+    }>;
+};
+export {};

package/dist/client/mfa-factors.js

@@ -0,0 +1,73 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.mfaFactorsResource = mfaFactorsResource;
+const request_1 = require("./request");
+/**
+ * The additional authentication factors: the write-only BYOK secrets (Yubico cloud, Duo, the
+ * smart card proxy), the self-held Yubico OTP key registry, smart card certificate mappings and
+ * the admin reset for security questions. Turn the factors on in the auth config (`mfa.factors`,
+ * `mfa.hotp`, `mfa.yubikey`, `mfa.duo`, `mfa.smartCard`, `mfa.securityQuestions`).
+ */
+function mfaFactorsResource(request) {
+    return {
+        /** Store the Yubico cloud API secret key (base64). Write-only. */
+        setYubicoSecret(secret) {
+            return request({ method: 'PUT', path: '/v1/instance/yubico_secret', body: { secret } });
+        },
+        removeYubicoSecret() {
+            return request({ method: 'DELETE', path: '/v1/instance/yubico_secret' });
+        },
+        /** Store the Duo client secret. Write-only. */
+        setDuoSecret(secret) {
+            return request({ method: 'PUT', path: '/v1/instance/duo_secret', body: { secret } });
+        },
+        removeDuoSecret() {
+            return request({ method: 'DELETE', path: '/v1/instance/duo_secret' });
+        },
+        /** Ask Duo whether the configured integration key, stored secret and API host are accepted. */
+        duoHealthCheck() {
+            return request({ method: 'POST', path: '/v1/instance/duo_health_check' });
+        },
+        /** Store the shared secret your TLS proxy sends so Atlas trusts its certificate headers. Write-only. */
+        setSmartCardSecret(secret) {
+            return request({ method: 'PUT', path: '/v1/instance/smart_card_secret', body: { secret } });
+        },
+        removeSmartCardSecret() {
+            return request({ method: 'DELETE', path: '/v1/instance/smart_card_secret' });
+        },
+        yubikeys: {
+            /** Registered self-held YubiKeys. The AES keys are never returned. */
+            list() {
+                return request({ method: 'GET', path: '/v1/yubikeys' });
+            },
+            /** Register a YubiKey's AES key for self-held Yubico OTP. `userId` assigns it; otherwise the first user to enrol it claims it. */
+            register(body) {
+                return request({
+                    method: 'POST',
+                    path: '/v1/yubikeys',
+                    body: { public_id: body.publicId, aes_key: body.aesKey, private_id: body.privateId, label: body.label, user_id: body.userId },
+                });
+            },
+            remove(id) {
+                return request({ method: 'DELETE', path: `/v1/yubikeys/${(0, request_1.enc)(id)}` });
+            },
+        },
+        smartCardMappings: {
+            list(userId) {
+                return request({ method: 'GET', path: `/v1/users/${(0, request_1.enc)(userId)}/smartcard_mappings` });
+            },
+            /** Pre-register the certificate attribute that signs a user in. A `serial` needs the certificate's `issuer` DN. */
+            add(userId, body) {
+                return request({ method: 'POST', path: `/v1/users/${(0, request_1.enc)(userId)}/smartcard_mappings`, body });
+            },
+            remove(userId, mappingId) {
+                return request({ method: 'DELETE', path: `/v1/users/${(0, request_1.enc)(userId)}/smartcard_mappings/${(0, request_1.enc)(mappingId)}` });
+            },
+        },
+        /** Clear a user's security-question answers (and any lockout). */
+        resetSecurityQuestions(userId) {
+            return request({ method: 'DELETE', path: `/v1/users/${(0, request_1.enc)(userId)}/security_questions` });
+        },
+    };
+}
+//# sourceMappingURL=mfa-factors.js.map

package/dist/client/mfa-factors.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"mfa-factors.js","sourceRoot":"","sources":["../../src/client/mfa-factors.ts"],"names":[],"mappings":";;AA0DA,gDAgEC;AA1HD,uCAAgD;AAoDhD;;;;;GAKG;AACH,SAAgB,kBAAkB,CAAC,OAAkB;IACnD,OAAO;QACL,kEAAkE;QAClE,eAAe,CAAC,MAAc;YAC5B,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,4BAA4B,EAAE,IAAI,EAAE,EAAE,MAAM,EAAE,EAAE,CAAC,CAAC;QAC1F,CAAC;QACD,kBAAkB;YAChB,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,4BAA4B,EAAE,CAAC,CAAC;QAC3E,CAAC;QACD,+CAA+C;QAC/C,YAAY,CAAC,MAAc;YACzB,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,yBAAyB,EAAE,IAAI,EAAE,EAAE,MAAM,EAAE,EAAE,CAAC,CAAC;QACvF,CAAC;QACD,eAAe;YACb,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,yBAAyB,EAAE,CAAC,CAAC;QACxE,CAAC;QACD,+FAA+F;QAC/F,cAAc;YACZ,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,+BAA+B,EAAE,CAAC,CAAC;QAC5E,CAAC;QACD,wGAAwG;QACxG,kBAAkB,CAAC,MAAc;YAC/B,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,gCAAgC,EAAE,IAAI,EAAE,EAAE,MAAM,EAAE,EAAE,CAAC,CAAC;QAC9F,CAAC;QACD,qBAAqB;YACnB,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,gCAAgC,EAAE,CAAC,CAAC;QAC/E,CAAC;QAED,QAAQ,EAAE;YACR,sEAAsE;YACtE,IAAI;gBACF,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC;YAC1D,CAAC;YACD,kIAAkI;YAClI,QAAQ,CAAC,IAA+F;gBACtG,OAAO,OAAO,CAAC;oBACb,MAAM,EAAE,MAAM;oBACd,IAAI,EAAE,cAAc;oBACpB,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,CAAC,QAAQ,EAAE,OAAO,EAAE,IAAI,CAAC,MAAM,EAAE,UAAU,EAAE,IAAI,CAAC,SAAS,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,OAAO,EAAE,IAAI,CAAC,MAAM,EAAE;iBAC9H,CAAC,CAAC;YACL,CAAC;YACD,MAAM,CAAC,EAAU;gBACf,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,gBAAgB,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;YACxE,CAAC;SACF;QAED,iBAAiB,EAAE;YACjB,IAAI,CAAC,MAAc;gBACjB,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,aAAa,IAAA,aAAG,EAAC,MAAM,CAAC,qBAAqB,EAAE,CAAC,CAAC;YACzF,CAAC;YACD,mHAAmH;YACnH,GAAG,CAAC,MAAc,EAAE,IAAoF;gBACtG,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,aAAa,IAAA,aAAG,EAAC,MAAM,CAAC,qBAAqB,EAAE,IAAI,EAAE,CAAC,CAAC;YAChG,CAAC;YACD,MAAM,CAAC,MAAc,EAAE,SAAiB;gBACtC,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,aAAa,IAAA,aAAG,EAAC,MAAM,CAAC,uBAAuB,IAAA,aAAG,EAAC,SAAS,CAAC,EAAE,EAAE,CAAC,CAAC;YAC9G,CAAC;SACF;QAED,kEAAkE;QAClE,sBAAsB,CAAC,MAAc;YACnC,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,aAAa,IAAA,aAAG,EAAC,MAAM,CAAC,qBAAqB,EAAE,CAAC,CAAC;QAC5F,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/client/migrations.d.ts

@@ -14,7 +14,7 @@ import type { CursorPage, CursorParams } from './types';
  *            (a vendor JWT preset, or imported sessions).
  *   sources  `/v1/migrations/sources` — what each source supports.
  */
-export type MigrationSourceId = 'better_auth' | 'auth0' | 'clerk' | 'cognito' | 'firebase' | 'supabase' | 'workos' | 'authjs' | 'okta' | 'stytch' | 'keycloak' | 'fusionauth' | 'kinde' | 'descope' | 'lucia' | 'ory' | 'frontegg' | 'custom';
+export type MigrationSourceId = 'better_auth' | 'auth0' | 'clerk' | 'cognito' | 'firebase' | 'supabase' | 'workos' | 'authjs' | 'okta' | 'stytch' | 'keycloak' | 'fusionauth' | 'kinde' | 'descope' | 'lucia' | 'ory' | 'frontegg' | 'propelauth' | 'magic' | 'userfront' | 'corbado' | 'custom';
 export type MigrationImportStatus = 'uploading' | 'analyzing' | 'ready' | 'invalid' | 'queued' | 'applying' | 'completed' | 'failed';
 export interface MigrationImportKey {
     object: 'migration_import_key';

package/dist/client/migrations.js.map

@@ -1 +1 @@
-{"version":3,"file":"migrations.js","sourceRoot":"","sources":["../../src/client/migrations.ts"],"names":[],"mappings":";;AAkMA,gDAkGC;AApSD,+DAA0F;AAC1F,uCAAgD;AA+LhD,MAAM,QAAQ,GAAqC,CAAC,OAAO,EAAE,SAAS,EAAE,WAAW,EAAE,QAAQ,CAAC,CAAC;AAE/F,SAAgB,kBAAkB,CAAC,OAAkB;IACnD,MAAM,UAAU,GAAG,CAAC,MAAkC,EAAE,EAAE;QACxD,MAAM,IAAI,GAAG,kBAAkB,IAAA,aAAG,EAAC,MAAM,CAAC,UAAU,CAAC;QACrD,MAAM,IAAI,GAAG;YACX,6EAA6E;YAC7E,YAAY;gBACV,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,IAAI,aAAa,EAAE,CAAC,CAAC;YAChE,CAAC;YACD,gFAAgF;YAChF,eAAe;gBACb,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,IAAI,oBAAoB,EAAE,CAAC,CAAC;YACxE,CAAC;YACD,MAAM,CAAC,OAA6C,EAAE,EAAE,cAAuB;gBAC7E,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC;YACvE,CAAC;YACD,IAAI,CAAC,SAAuB,EAAE;gBAC5B,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,GAAG,MAAM,EAAE,EAAE,CAAC,CAAC;YACtE,CAAC;YACD,GAAG,CAAC,EAAU;gBACZ,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,IAAI,IAAI,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;YAChE,CAAC;YACD,8DAA8D;YAC9D,UAAU,CAAC,EAAU,EAAE,IAAY,EAAE,IAAY;gBAC/C,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,IAAI,IAAI,IAAA,aAAG,EAAC,EAAE,CAAC,UAAU,IAAI,EAAE,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC;YAC9F,CAAC;YACD,oFAAoF;YACpF,QAAQ,CAAC,EAAU;gBACjB,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,IAAI,IAAI,IAAA,aAAG,EAAC,EAAE,CAAC,WAAW,EAAE,CAAC,CAAC;YAC1E,CAAC;YACD,MAAM,CAAC,EAAU,EAAE,OAA6C,EAAE;gBAChE,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,IAAI,IAAI,IAAA,aAAG,EAAC,EAAE,CAAC,UAAU,EAAE,IAAI,EAAE,CAAC,CAAC;YAC/E,CAAC;YACD,sFAAsF;YACtF,KAAK,CAAC,EAAU,EAAE,OAAwC,EAAE;gBAC1D,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,IAAI,IAAI,IAAA,aAAG,EAAC,EAAE,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC;YAC7E,CAAC;YACD,MAAM,CAAC,EAAU;gBACf,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,GAAG,IAAI,IAAI,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;YACnE,CAAC;YACD;;;eAGG;YACH,KAAK,CAAC,MAAM,CACV,UAAkB,EAClB,OAAmJ,EAAE;gBAErJ,MAAM,KAAK,GAAG,IAAA,sCAAgB,EAAC,UAAU,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;gBAC3D,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;oBAAE,MAAM,IAAI,KAAK,CAAC,sBAAsB,CAAC,CAAC;gBAChE,MAAM,EAAE,GAAG,IAAI,CAAC,QAAQ,IAAI,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAClG,KAAK,IAAI,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC,UAAU,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;oBAC5E,MAAM,IAAI,CAAC,UAAU,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,EAAE,KAAK,CAAC,CAAC,CAAE,CAAC,CAAC;oBAC5C,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;gBACrC,CAAC;gBACD,OAAO,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;YAC3B,CAAC;YACD,kEAAkE;YAClE,KAAK,CAAC,OAAO,CACX,EAAU,EACV,OAAwI,EAAE;gBAE1I,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,CAAC,CAAC,EAAU,EAAE,EAAE,CAAC,IAAI,OAAO,CAAO,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC;gBAC1F,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,IAAI,CAAC,SAAS,IAAI,CAAC,GAAG,QAAQ,CAAC,CAAC;gBAC/D,SAAS,CAAC;oBACR,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;oBAC/B,IAAI,CAAC,UAAU,EAAE,CAAC,GAAG,CAAC,CAAC;oBACvB,IAAI,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,GAAG,CAAC,MAAM,KAAK,WAAW;wBAAE,OAAO,GAAG,CAAC;oBAC5E,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,QAAQ;wBAAE,MAAM,IAAI,KAAK,CAAC,0CAA0C,EAAE,YAAY,GAAG,CAAC,MAAM,IAAI,CAAC,CAAC;oBACnH,MAAM,KAAK,CAAC,IAAI,CAAC,UAAU,IAAI,IAAI,CAAC,CAAC;gBACvC,CAAC;YACH,CAAC;SACF,CAAC;QACF,OAAO,IAAI,CAAC;IACd,CAAC,CAAC;IACF,MAAM,SAAS,GAAG,CAAC,MAAkC,EAAE,EAAE;QACvD,MAAM,IAAI,GAAG,kBAAkB,IAAA,aAAG,EAAC,MAAM,CAAC,SAAS,CAAC;QACpD,OAAO;YACL,GAAG;gBACD,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;YAC1C,CAAC;YACD,MAAM,CAAC,IAAmC;gBACxC,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;YAChD,CAAC;YACD,MAAM;gBACJ,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC;YAC7C,CAAC;SACF,CAAC;IACJ,CAAC,CAAC;IACF,OAAO;QACL,mDAAmD;QACnD,OAAO;YACL,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,wBAAwB,EAAE,CAAC,CAAC;QACpE,CAAC;QACD,oFAAoF;QACpF,OAAO,EAAE,UAAU;QACnB,qDAAqD;QACrD,MAAM,EAAE,SAAS;KAClB,CAAC;AACJ,CAAC"}
+{"version":3,"file":"migrations.js","sourceRoot":"","sources":["../../src/client/migrations.ts"],"names":[],"mappings":";;AAsMA,gDAkGC;AAxSD,+DAA0F;AAC1F,uCAAgD;AAmMhD,MAAM,QAAQ,GAAqC,CAAC,OAAO,EAAE,SAAS,EAAE,WAAW,EAAE,QAAQ,CAAC,CAAC;AAE/F,SAAgB,kBAAkB,CAAC,OAAkB;IACnD,MAAM,UAAU,GAAG,CAAC,MAAkC,EAAE,EAAE;QACxD,MAAM,IAAI,GAAG,kBAAkB,IAAA,aAAG,EAAC,MAAM,CAAC,UAAU,CAAC;QACrD,MAAM,IAAI,GAAG;YACX,6EAA6E;YAC7E,YAAY;gBACV,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,IAAI,aAAa,EAAE,CAAC,CAAC;YAChE,CAAC;YACD,gFAAgF;YAChF,eAAe;gBACb,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,IAAI,oBAAoB,EAAE,CAAC,CAAC;YACxE,CAAC;YACD,MAAM,CAAC,OAA6C,EAAE,EAAE,cAAuB;gBAC7E,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC;YACvE,CAAC;YACD,IAAI,CAAC,SAAuB,EAAE;gBAC5B,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,GAAG,MAAM,EAAE,EAAE,CAAC,CAAC;YACtE,CAAC;YACD,GAAG,CAAC,EAAU;gBACZ,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,IAAI,IAAI,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;YAChE,CAAC;YACD,8DAA8D;YAC9D,UAAU,CAAC,EAAU,EAAE,IAAY,EAAE,IAAY;gBAC/C,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,IAAI,IAAI,IAAA,aAAG,EAAC,EAAE,CAAC,UAAU,IAAI,EAAE,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC;YAC9F,CAAC;YACD,oFAAoF;YACpF,QAAQ,CAAC,EAAU;gBACjB,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,IAAI,IAAI,IAAA,aAAG,EAAC,EAAE,CAAC,WAAW,EAAE,CAAC,CAAC;YAC1E,CAAC;YACD,MAAM,CAAC,EAAU,EAAE,OAA6C,EAAE;gBAChE,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,IAAI,IAAI,IAAA,aAAG,EAAC,EAAE,CAAC,UAAU,EAAE,IAAI,EAAE,CAAC,CAAC;YAC/E,CAAC;YACD,sFAAsF;YACtF,KAAK,CAAC,EAAU,EAAE,OAAwC,EAAE;gBAC1D,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,IAAI,IAAI,IAAA,aAAG,EAAC,EAAE,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC;YAC7E,CAAC;YACD,MAAM,CAAC,EAAU;gBACf,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,GAAG,IAAI,IAAI,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;YACnE,CAAC;YACD;;;eAGG;YACH,KAAK,CAAC,MAAM,CACV,UAAkB,EAClB,OAAmJ,EAAE;gBAErJ,MAAM,KAAK,GAAG,IAAA,sCAAgB,EAAC,UAAU,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;gBAC3D,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;oBAAE,MAAM,IAAI,KAAK,CAAC,sBAAsB,CAAC,CAAC;gBAChE,MAAM,EAAE,GAAG,IAAI,CAAC,QAAQ,IAAI,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAClG,KAAK,IAAI,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC,UAAU,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;oBAC5E,MAAM,IAAI,CAAC,UAAU,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,EAAE,KAAK,CAAC,CAAC,CAAE,CAAC,CAAC;oBAC5C,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;gBACrC,CAAC;gBACD,OAAO,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;YAC3B,CAAC;YACD,kEAAkE;YAClE,KAAK,CAAC,OAAO,CACX,EAAU,EACV,OAAwI,EAAE;gBAE1I,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,CAAC,CAAC,EAAU,EAAE,EAAE,CAAC,IAAI,OAAO,CAAO,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC;gBAC1F,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,IAAI,CAAC,SAAS,IAAI,CAAC,GAAG,QAAQ,CAAC,CAAC;gBAC/D,SAAS,CAAC;oBACR,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;oBAC/B,IAAI,CAAC,UAAU,EAAE,CAAC,GAAG,CAAC,CAAC;oBACvB,IAAI,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,GAAG,CAAC,MAAM,KAAK,WAAW;wBAAE,OAAO,GAAG,CAAC;oBAC5E,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,QAAQ;wBAAE,MAAM,IAAI,KAAK,CAAC,0CAA0C,EAAE,YAAY,GAAG,CAAC,MAAM,IAAI,CAAC,CAAC;oBACnH,MAAM,KAAK,CAAC,IAAI,CAAC,UAAU,IAAI,IAAI,CAAC,CAAC;gBACvC,CAAC;YACH,CAAC;SACF,CAAC;QACF,OAAO,IAAI,CAAC;IACd,CAAC,CAAC;IACF,MAAM,SAAS,GAAG,CAAC,MAAkC,EAAE,EAAE;QACvD,MAAM,IAAI,GAAG,kBAAkB,IAAA,aAAG,EAAC,MAAM,CAAC,SAAS,CAAC;QACpD,OAAO;YACL,GAAG;gBACD,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;YAC1C,CAAC;YACD,MAAM,CAAC,IAAmC;gBACxC,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;YAChD,CAAC;YACD,MAAM;gBACJ,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC;YAC7C,CAAC;SACF,CAAC;IACJ,CAAC,CAAC;IACF,OAAO;QACL,mDAAmD;QACnD,OAAO;YACL,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,wBAAwB,EAAE,CAAC,CAAC;QACpE,CAAC;QACD,oFAAoF;QACpF,OAAO,EAAE,UAAU;QACnB,qDAAqD;QACrD,MAAM,EAAE,SAAS;KAClB,CAAC;AACJ,CAAC"}

package/dist/client/network-acls.d.ts

@@ -12,6 +12,8 @@ export interface NetworkAcl {
     action: NetworkAclAction;
     /** A single IP or CIDR range; refused at write time if malformed. */
     cidr: string;
+    /** The network zone this rule matches instead of `cidr`. */
+    zone_id: string | null;
     description: string | null;
     priority: number;
     enabled: boolean;
@@ -20,7 +22,9 @@ export interface NetworkAcl {
 }
 export interface CreateNetworkAclBody {
     action: NetworkAclAction;
-    cidr: string;
+    /** A CIDR or address — or send `zone_id` instead (one of the two). */
+    cidr?: string;
+    zone_id?: string;
     description?: string | null;
     priority?: number;
     enabled?: boolean;
@@ -28,6 +32,7 @@ export interface CreateNetworkAclBody {
 export interface UpdateNetworkAclBody {
     action?: NetworkAclAction;
     cidr?: string;
+    zone_id?: string | null;
     description?: string | null;
     priority?: number;
     enabled?: boolean;

package/dist/client/network-acls.js.map

@@ -1 +1 @@
-{"version":3,"file":"network-acls.js","sourceRoot":"","sources":["../../src/client/network-acls.ts"],"names":[],"mappings":";;AA2CA,kDAmBC;AA9DD,uCAAgD;AAuChD;;;GAGG;AACH,SAAgB,mBAAmB,CAAC,OAAkB;IACpD,OAAO;QACL,qDAAqD;QACrD,IAAI;YACF,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,kBAAkB,EAAE,CAAC,CAAC;QAC9D,CAAC;QACD,GAAG,CAAC,EAAU;YACZ,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,oBAAoB,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;QACzE,CAAC;QACD,MAAM,CAAC,IAA0B,EAAE,cAAuB;YACxD,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,kBAAkB,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC;QACrF,CAAC;QACD,MAAM,CAAC,EAAU,EAAE,IAA0B;YAC3C,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,oBAAoB,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;QACjF,CAAC;QACD,MAAM,CAAC,EAAU;YACf,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,oBAAoB,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;QAC5E,CAAC;KACF,CAAC;AACJ,CAAC"}
+{"version":3,"file":"network-acls.js","sourceRoot":"","sources":["../../src/client/network-acls.ts"],"names":[],"mappings":";;AAgDA,kDAmBC;AAnED,uCAAgD;AA4ChD;;;GAGG;AACH,SAAgB,mBAAmB,CAAC,OAAkB;IACpD,OAAO;QACL,qDAAqD;QACrD,IAAI;YACF,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,kBAAkB,EAAE,CAAC,CAAC;QAC9D,CAAC;QACD,GAAG,CAAC,EAAU;YACZ,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,oBAAoB,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;QACzE,CAAC;QACD,MAAM,CAAC,IAA0B,EAAE,cAAuB;YACxD,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,kBAAkB,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC;QACrF,CAAC;QACD,MAAM,CAAC,EAAU,EAAE,IAA0B;YAC3C,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,oBAAoB,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;QACjF,CAAC;QACD,MAAM,CAAC,EAAU;YACf,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,oBAAoB,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;QAC5E,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/client/network-zones.d.ts

@@ -0,0 +1,56 @@
+import { type RequestFn } from './request';
+import type { ListPage } from './types';
+export type NetworkZoneAnonymizer = 'tor' | 'datacenter' | 'vpn';
+/**
+ * A reusable network zone: a union of CIDR ranges, ISO countries, ASNs and
+ * anonymizer classes. Network ACL rules reference one by `zone_id`.
+ */
+export interface NetworkZone {
+    object: 'network_zone';
+    id: string;
+    name: string;
+    description: string | null;
+    cidrs: string[];
+    countries: string[];
+    asns: number[];
+    anonymizers: NetworkZoneAnonymizer[];
+    enabled: boolean;
+    created_at: number;
+    updated_at: number;
+}
+export interface CreateNetworkZoneBody {
+    name: string;
+    description?: string | null;
+    cidrs?: string[];
+    countries?: string[];
+    asns?: number[];
+    anonymizers?: NetworkZoneAnonymizer[];
+    enabled?: boolean;
+}
+export type UpdateNetworkZoneBody = Partial<CreateNetworkZoneBody>;
+export interface NetworkZoneCheck {
+    object: 'network_zone_check';
+    zone_id: string;
+    ip: string;
+    matches: boolean;
+    facts: {
+        country: string | null;
+        asn: number | null;
+        tor: boolean | null;
+        datacenter: boolean | null;
+    };
+}
+/** CRUD over the instance's network zones, plus a what-if `check` for one address. */
+export declare function networkZonesResource(request: RequestFn): {
+    list(): Promise<ListPage<NetworkZone>>;
+    get(id: string): Promise<NetworkZone>;
+    create(body: CreateNetworkZoneBody, idempotencyKey?: string): Promise<NetworkZone>;
+    update(id: string, body: UpdateNetworkZoneBody): Promise<NetworkZone>;
+    delete(id: string): Promise<{
+        object: "network_zone";
+        id: string;
+        deleted: true;
+    }>;
+    /** Does `ip` fall inside the zone? Returns the resolved facts too. */
+    check(id: string, ip: string): Promise<NetworkZoneCheck>;
+};

package/dist/client/network-zones.js

@@ -0,0 +1,29 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.networkZonesResource = networkZonesResource;
+const request_1 = require("./request");
+/** CRUD over the instance's network zones, plus a what-if `check` for one address. */
+function networkZonesResource(request) {
+    return {
+        list() {
+            return request({ method: 'GET', path: '/v1/network_zones' });
+        },
+        get(id) {
+            return request({ method: 'GET', path: `/v1/network_zones/${(0, request_1.enc)(id)}` });
+        },
+        create(body, idempotencyKey) {
+            return request({ method: 'POST', path: '/v1/network_zones', body, idempotencyKey });
+        },
+        update(id, body) {
+            return request({ method: 'PATCH', path: `/v1/network_zones/${(0, request_1.enc)(id)}`, body });
+        },
+        delete(id) {
+            return request({ method: 'DELETE', path: `/v1/network_zones/${(0, request_1.enc)(id)}` });
+        },
+        /** Does `ip` fall inside the zone? Returns the resolved facts too. */
+        check(id, ip) {
+            return request({ method: 'POST', path: `/v1/network_zones/${(0, request_1.enc)(id)}/check`, body: { ip } });
+        },
+    };
+}
+//# sourceMappingURL=network-zones.js.map

package/dist/client/network-zones.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"network-zones.js","sourceRoot":"","sources":["../../src/client/network-zones.ts"],"names":[],"mappings":";;AA4CA,oDAsBC;AAlED,uCAAgD;AA2ChD,sFAAsF;AACtF,SAAgB,oBAAoB,CAAC,OAAkB;IACrD,OAAO;QACL,IAAI;YACF,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,mBAAmB,EAAE,CAAC,CAAC;QAC/D,CAAC;QACD,GAAG,CAAC,EAAU;YACZ,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,qBAAqB,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;QAC1E,CAAC;QACD,MAAM,CAAC,IAA2B,EAAE,cAAuB;YACzD,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,mBAAmB,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC;QACtF,CAAC;QACD,MAAM,CAAC,EAAU,EAAE,IAA2B;YAC5C,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,qBAAqB,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;QAClF,CAAC;QACD,MAAM,CAAC,EAAU;YACf,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,qBAAqB,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;QAC7E,CAAC;QACD,sEAAsE;QACtE,KAAK,CAAC,EAAU,EAAE,EAAU;YAC1B,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,qBAAqB,IAAA,aAAG,EAAC,EAAE,CAAC,QAAQ,EAAE,IAAI,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC;QAC/F,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/client/notifications.d.ts

@@ -1,6 +1,6 @@
 import { type RequestFn } from './request';
 /** Built-in notification templates `send` falls back to when no tenant template has the name. */
-export type BuiltInNotificationTemplate = 'new_device' | 'unattended_access' | 'password_changed' | 'mfa_changed' | 'email_changed';
+export type BuiltInNotificationTemplate = 'new_device' | 'unattended_access' | 'password_changed' | 'mfa_changed' | 'email_changed' | 'phone_changed' | 'identity_linked' | 'identity_unlinked' | 'passkey_added' | 'passkey_removed' | 'recovery_codes_regenerated' | 'factor_removed' | 'device_key_added' | 'device_key_removed' | 'risk_alert';
 export interface SendNotificationBody {
     /** The end-user to notify. */
     user_id: string;

package/dist/client/notifications.js.map

@@ -1 +1 @@
-{"version":3,"file":"notifications.js","sourceRoot":"","sources":["../../src/client/notifications.ts"],"names":[],"mappings":";;AAkEA,sDAqDC;AAvHD,uCAAgD;AAkEhD,SAAgB,qBAAqB,CAAC,OAAkB;IACtD,OAAO;QACL,2FAA2F;QAC3F,IAAI,CAAC,IAA0B,EAAE,cAAuB;YACtD,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,mBAAmB,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC;QACtF,CAAC;QACD,UAAU,EAAE;YACV,IAAI;gBACF,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,6BAA6B,EAAE,CAAC,CAAC;YACzE,CAAC;YACD,4CAA4C;YAC5C,MAAM,CAAC,IAAoC;gBACzC,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,6BAA6B,EAAE,IAAI,EAAE,CAAC,CAAC;YAChF,CAAC;YACD,MAAM,CAAC,GAAW,EAAE,IAAuB;gBACzC,OAAO,OAAO,CAAC;oBACb,MAAM,EAAE,KAAK;oBACb,IAAI,EAAE,+BAA+B,IAAA,aAAG,EAAC,GAAG,CAAC,EAAE;oBAC/C,IAAI;iBACL,CAAC,CAAC;YACL,CAAC;YACD,yDAAyD;YACzD,MAAM,CACJ,GAAW;gBAEX,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,+BAA+B,IAAA,aAAG,EAAC,GAAG,CAAC,EAAE,EAAE,CAAC,CAAC;YACxF,CAAC;SACF;QACD,SAAS,EAAE;YACT,IAAI;gBACF,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,4BAA4B,EAAE,CAAC,CAAC;YACxE,CAAC;YACD,iCAAiC;YACjC,MAAM,CAAC,IAAoC;gBACzC,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,4BAA4B,EAAE,IAAI,EAAE,CAAC,CAAC;YAC/E,CAAC;YACD,GAAG,CAAC,IAAY;gBACd,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,8BAA8B,IAAA,aAAG,EAAC,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC;YACrF,CAAC;YACD,MAAM,CAAC,IAAY,EAAE,IAAoC;gBACvD,OAAO,OAAO,CAAC;oBACb,MAAM,EAAE,KAAK;oBACb,IAAI,EAAE,8BAA8B,IAAA,aAAG,EAAC,IAAI,CAAC,EAAE;oBAC/C,IAAI;iBACL,CAAC,CAAC;YACL,CAAC;YACD,MAAM,CACJ,IAAY;gBAEZ,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,8BAA8B,IAAA,aAAG,EAAC,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC;YACxF,CAAC;SACF;KACF,CAAC;AACJ,CAAC"}
+{"version":3,"file":"notifications.js","sourceRoot":"","sources":["../../src/client/notifications.ts"],"names":[],"mappings":";;AA4EA,sDAqDC;AAjID,uCAAgD;AA4EhD,SAAgB,qBAAqB,CAAC,OAAkB;IACtD,OAAO;QACL,2FAA2F;QAC3F,IAAI,CAAC,IAA0B,EAAE,cAAuB;YACtD,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,mBAAmB,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC;QACtF,CAAC;QACD,UAAU,EAAE;YACV,IAAI;gBACF,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,6BAA6B,EAAE,CAAC,CAAC;YACzE,CAAC;YACD,4CAA4C;YAC5C,MAAM,CAAC,IAAoC;gBACzC,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,6BAA6B,EAAE,IAAI,EAAE,CAAC,CAAC;YAChF,CAAC;YACD,MAAM,CAAC,GAAW,EAAE,IAAuB;gBACzC,OAAO,OAAO,CAAC;oBACb,MAAM,EAAE,KAAK;oBACb,IAAI,EAAE,+BAA+B,IAAA,aAAG,EAAC,GAAG,CAAC,EAAE;oBAC/C,IAAI;iBACL,CAAC,CAAC;YACL,CAAC;YACD,yDAAyD;YACzD,MAAM,CACJ,GAAW;gBAEX,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,+BAA+B,IAAA,aAAG,EAAC,GAAG,CAAC,EAAE,EAAE,CAAC,CAAC;YACxF,CAAC;SACF;QACD,SAAS,EAAE;YACT,IAAI;gBACF,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,4BAA4B,EAAE,CAAC,CAAC;YACxE,CAAC;YACD,iCAAiC;YACjC,MAAM,CAAC,IAAoC;gBACzC,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,4BAA4B,EAAE,IAAI,EAAE,CAAC,CAAC;YAC/E,CAAC;YACD,GAAG,CAAC,IAAY;gBACd,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,8BAA8B,IAAA,aAAG,EAAC,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC;YACrF,CAAC;YACD,MAAM,CAAC,IAAY,EAAE,IAAoC;gBACvD,OAAO,OAAO,CAAC;oBACb,MAAM,EAAE,KAAK;oBACb,IAAI,EAAE,8BAA8B,IAAA,aAAG,EAAC,IAAI,CAAC,EAAE;oBAC/C,IAAI;iBACL,CAAC,CAAC;YACL,CAAC;YACD,MAAM,CACJ,IAAY;gBAEZ,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,8BAA8B,IAAA,aAAG,EAAC,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC;YACxF,CAAC;SACF;KACF,CAAC;AACJ,CAAC"}