@atlasauth/backend 0.24.0 → 0.25.0

package/dist/client/page-templates.d.ts

@@ -0,0 +1,78 @@
+import { type RequestFn } from './request';
+import type { ListPage } from './types';
+export type PageTemplatePage = 'sign-in' | 'sign-up' | 'user-profile';
+export type TemplateTone = 'default' | 'muted' | 'accent' | 'success' | 'danger';
+type Align = 'left' | 'center' | 'right';
+/** One component. Strings are escaped; links are https, mailto: or a path; there is no raw HTML, CSS or script. */
+export type TemplateNode = {
+    type: 'heading';
+    text: string;
+    level?: 2 | 3;
+    align?: Align;
+} | {
+    type: 'text';
+    text: string;
+    tone?: TemplateTone;
+    size?: 'sm' | 'md';
+    align?: Align;
+} | {
+    type: 'image';
+    src?: string;
+    asset_id?: string;
+    alt: string;
+    width?: number;
+    align?: Align;
+} | {
+    type: 'link';
+    label: string;
+    href: string;
+} | {
+    type: 'button_link';
+    label: string;
+    href: string;
+} | {
+    type: 'list';
+    items: string[];
+} | {
+    type: 'divider';
+} | {
+    type: 'spacer';
+    size?: 'sm' | 'md' | 'lg';
+} | {
+    type: 'columns';
+    columns: TemplateNode[][];
+};
+export interface PageTemplateDefinition {
+    version?: 1;
+    regions: Partial<Record<'header' | 'above_form' | 'below_form' | 'footer', TemplateNode[]>>;
+}
+export interface PageTemplateSlot {
+    version: number;
+    updated_at: number;
+    definition: PageTemplateDefinition;
+}
+export interface PageTemplate {
+    object: 'page_template';
+    page: PageTemplatePage;
+    live: PageTemplateSlot | null;
+    draft: PageTemplateSlot | null;
+}
+export interface PageTemplatePreview {
+    object: 'page_template_preview';
+    page: PageTemplatePage;
+    url: string;
+    expires_at: number;
+}
+export declare function pageTemplatesResource(request: RequestFn): {
+    list(): Promise<ListPage<PageTemplate>>;
+    get(page: PageTemplatePage): Promise<PageTemplate>;
+    /** Save the page's draft. The live page is unchanged until you promote. */
+    saveDraft(page: PageTemplatePage, definition: PageTemplateDefinition): Promise<PageTemplate>;
+    /** A signed link (one hour) to the hosted page with the draft applied. */
+    preview(page: PageTemplatePage): Promise<PageTemplatePreview>;
+    /** Make the draft the live template. */
+    promote(page: PageTemplatePage): Promise<PageTemplate>;
+    /** Drop the draft, or take the live template down. */
+    discard(page: PageTemplatePage, status: "draft" | "live"): Promise<PageTemplate>;
+};
+export {};

package/dist/client/page-templates.js

@@ -0,0 +1,31 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.pageTemplatesResource = pageTemplatesResource;
+const request_1 = require("./request");
+function pageTemplatesResource(request) {
+    return {
+        list() {
+            return request({ method: 'GET', path: '/v1/instance/page_templates' });
+        },
+        get(page) {
+            return request({ method: 'GET', path: `/v1/instance/page_templates/${(0, request_1.enc)(page)}` });
+        },
+        /** Save the page's draft. The live page is unchanged until you promote. */
+        saveDraft(page, definition) {
+            return request({ method: 'PUT', path: `/v1/instance/page_templates/${(0, request_1.enc)(page)}`, body: { definition } });
+        },
+        /** A signed link (one hour) to the hosted page with the draft applied. */
+        preview(page) {
+            return request({ method: 'POST', path: `/v1/instance/page_templates/${(0, request_1.enc)(page)}/preview` });
+        },
+        /** Make the draft the live template. */
+        promote(page) {
+            return request({ method: 'POST', path: `/v1/instance/page_templates/${(0, request_1.enc)(page)}/promote` });
+        },
+        /** Drop the draft, or take the live template down. */
+        discard(page, status) {
+            return request({ method: 'DELETE', path: `/v1/instance/page_templates/${(0, request_1.enc)(page)}`, query: { status } });
+        },
+    };
+}
+//# sourceMappingURL=page-templates.js.map

package/dist/client/page-templates.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"page-templates.js","sourceRoot":"","sources":["../../src/client/page-templates.ts"],"names":[],"mappings":";;AA4CA,sDAyBC;AArED,uCAAgD;AA4ChD,SAAgB,qBAAqB,CAAC,OAAkB;IACtD,OAAO;QACL,IAAI;YACF,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,6BAA6B,EAAE,CAAC,CAAC;QACzE,CAAC;QACD,GAAG,CAAC,IAAsB;YACxB,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,+BAA+B,IAAA,aAAG,EAAC,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC;QACtF,CAAC;QACD,2EAA2E;QAC3E,SAAS,CAAC,IAAsB,EAAE,UAAkC;YAClE,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,+BAA+B,IAAA,aAAG,EAAC,IAAI,CAAC,EAAE,EAAE,IAAI,EAAE,EAAE,UAAU,EAAE,EAAE,CAAC,CAAC;QAC5G,CAAC;QACD,0EAA0E;QAC1E,OAAO,CAAC,IAAsB;YAC5B,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,+BAA+B,IAAA,aAAG,EAAC,IAAI,CAAC,UAAU,EAAE,CAAC,CAAC;QAC/F,CAAC;QACD,wCAAwC;QACxC,OAAO,CAAC,IAAsB;YAC5B,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,+BAA+B,IAAA,aAAG,EAAC,IAAI,CAAC,UAAU,EAAE,CAAC,CAAC;QAC/F,CAAC;QACD,sDAAsD;QACtD,OAAO,CAAC,IAAsB,EAAE,MAAwB;YACtD,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,+BAA+B,IAAA,aAAG,EAAC,IAAI,CAAC,EAAE,EAAE,KAAK,EAAE,EAAE,MAAM,EAAE,EAAE,CAAC,CAAC;QAC5G,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/client/passkey-api.d.ts

@@ -0,0 +1,73 @@
+import { type RequestFn } from './request';
+import type { ListPage } from './types';
+export interface ExternalPasskey {
+    object: 'external_passkey';
+    id: string;
+    user_id: string;
+    credential_id: string;
+    name: string | null;
+    aaguid: string | null;
+    backed_up: boolean;
+    transports: string[];
+    last_used_at: number | null;
+    created_at: number;
+}
+export interface PasskeyRegistrationFinalize {
+    user_id: string;
+    challenge: string;
+    attestation_object: string;
+    client_data_json: string;
+    name?: string;
+    transports?: string[];
+}
+export interface PasskeyLoginFinalize {
+    handle: string;
+    challenge: string;
+    credential_id: string;
+    authenticator_data: string;
+    client_data_json: string;
+    signature: string;
+    /** Require the passkey to belong to this user. */
+    user_id?: string;
+}
+/**
+ * Passkeys for a user store you own: Atlas runs the WebAuthn ceremony, you keep
+ * the users and the session. Pass `options` to navigator.credentials.create()/get().
+ */
+export declare function passkeyApiResource(request: RequestFn): {
+    registrationInit(body: {
+        user_id: string;
+        username?: string;
+        display_name?: string;
+    }): Promise<{
+        object: "passkey_registration_options";
+        options: Record<string, unknown>;
+    }>;
+    registrationFinalize(body: PasskeyRegistrationFinalize): Promise<ExternalPasskey>;
+    loginInit(body?: {
+        user_id?: string;
+    }): Promise<{
+        object: "passkey_login_options";
+        handle: string;
+        options: Record<string, unknown>;
+    }>;
+    loginFinalize(body: PasskeyLoginFinalize): Promise<{
+        object: "passkey_login_result";
+        verified: true;
+        user_id: string;
+        credential_id: string;
+        passkey_id: string;
+        user_verified: boolean;
+        cloned_warning: boolean;
+    }>;
+    list(userId: string): Promise<ListPage<ExternalPasskey>>;
+    delete(userId: string, id: string): Promise<{
+        object: "external_passkey";
+        id: string;
+        deleted: true;
+    }>;
+    usage(): Promise<{
+        object: "passkey_api_usage";
+        passkeys: number;
+    }>;
+};

package/dist/client/passkey-api.js

@@ -0,0 +1,34 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.passkeyApiResource = passkeyApiResource;
+const request_1 = require("./request");
+/**
+ * Passkeys for a user store you own: Atlas runs the WebAuthn ceremony, you keep
+ * the users and the session. Pass `options` to navigator.credentials.create()/get().
+ */
+function passkeyApiResource(request) {
+    return {
+        registrationInit(body) {
+            return request({ method: 'POST', path: '/v1/passkey_api/registration/init', body });
+        },
+        registrationFinalize(body) {
+            return request({ method: 'POST', path: '/v1/passkey_api/registration/finalize', body });
+        },
+        loginInit(body = {}) {
+            return request({ method: 'POST', path: '/v1/passkey_api/login/init', body });
+        },
+        loginFinalize(body) {
+            return request({ method: 'POST', path: '/v1/passkey_api/login/finalize', body });
+        },
+        list(userId) {
+            return request({ method: 'GET', path: `/v1/passkey_api/users/${(0, request_1.enc)(userId)}/passkeys` });
+        },
+        delete(userId, id) {
+            return request({ method: 'DELETE', path: `/v1/passkey_api/users/${(0, request_1.enc)(userId)}/passkeys/${(0, request_1.enc)(id)}` });
+        },
+        usage() {
+            return request({ method: 'GET', path: '/v1/passkey_api/usage' });
+        },
+    };
+}
+//# sourceMappingURL=passkey-api.js.map

package/dist/client/passkey-api.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"passkey-api.js","sourceRoot":"","sources":["../../src/client/passkey-api.ts"],"names":[],"mappings":";;AAwCA,gDAgCC;AAxED,uCAAgD;AAoChD;;;GAGG;AACH,SAAgB,kBAAkB,CAAC,OAAkB;IACnD,OAAO;QACL,gBAAgB,CAAC,IAAmE;YAClF,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,mCAAmC,EAAE,IAAI,EAAE,CAAC,CAAC;QACtF,CAAC;QACD,oBAAoB,CAAC,IAAiC;YACpD,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,uCAAuC,EAAE,IAAI,EAAE,CAAC,CAAC;QAC1F,CAAC;QACD,SAAS,CAAC,OAA6B,EAAE;YACvC,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,4BAA4B,EAAE,IAAI,EAAE,CAAC,CAAC;QAC/E,CAAC;QACD,aAAa,CAAC,IAA0B;YAStC,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,gCAAgC,EAAE,IAAI,EAAE,CAAC,CAAC;QACnF,CAAC;QACD,IAAI,CAAC,MAAc;YACjB,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,yBAAyB,IAAA,aAAG,EAAC,MAAM,CAAC,WAAW,EAAE,CAAC,CAAC;QAC3F,CAAC;QACD,MAAM,CAAC,MAAc,EAAE,EAAU;YAC/B,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,yBAAyB,IAAA,aAAG,EAAC,MAAM,CAAC,aAAa,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;QACzG,CAAC;QACD,KAAK;YACH,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,uBAAuB,EAAE,CAAC,CAAC;QACnE,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/client/resources.d.ts

@@ -0,0 +1,149 @@
+import { type RequestFn } from './request';
+import type { ListPage } from './types';
+export interface ResourceRoleDef {
+    key: string;
+    name?: string;
+    /** `*` grants every permission. */
+    permissions: string[];
+    /** Other roles of the same type this role also grants. */
+    includes?: string[];
+}
+export interface ResourceType {
+    object: 'resource_type';
+    key: string;
+    name: string;
+    description: string | null;
+    parent_type: string | null;
+    inherit: boolean;
+    roles: ResourceRoleDef[];
+    created_at: number;
+    updated_at: number;
+}
+export interface CreateResourceTypeBody {
+    key: string;
+    name?: string;
+    description?: string | null;
+    /** The type a resource of this type nests under. */
+    parent_type?: string | null;
+    /** Whether assignments on a parent flow down (default true). */
+    inherit?: boolean;
+    roles: ResourceRoleDef[];
+}
+export interface Resource {
+    object: 'resource';
+    id: string;
+    type: string;
+    external_id: string;
+    name: string | null;
+    parent_id: string | null;
+    metadata: Record<string, unknown>;
+    created_at: number;
+    updated_at: number;
+}
+/** A reference to a resource: Atlas `id`, or your own `type` + `external_id`. */
+export type ResourceRef = {
+    id: string;
+} | {
+    type: string;
+    external_id: string;
+};
+export interface UpsertResourceBody {
+    type: string;
+    external_id: string;
+    name?: string | null;
+    /** The parent resource, or null for a root. */
+    parent?: ResourceRef | null;
+    metadata?: Record<string, unknown>;
+}
+export type ResourceSubject = {
+    type: 'user' | 'group' | 'org';
+    id: string;
+};
+export interface ResourceRoleAssignment {
+    object: 'resource_role_assignment';
+    id: string;
+    resource_id: string;
+    subject: ResourceSubject;
+    role: string;
+    inherit: boolean;
+    created_at: number;
+}
+export interface ResourceCheckBody {
+    subject: ResourceSubject;
+    permission: string;
+    resource: ResourceRef;
+    /** Extra group ids the subject belongs to (a user's organizations are added automatically). */
+    groups?: string[];
+}
+export interface ResourceCheck {
+    object: 'resource_check';
+    allowed: boolean;
+    resource_id: string;
+    grants?: Array<{
+        resource_id: string;
+        role: string;
+        subject: string;
+        inherited: boolean;
+    }>;
+}
+/** Resource-scoped RBAC: resource types, the resource tree, role assignments on resources, and permission checks. */
+export declare function resourcesResource(request: RequestFn): {
+    types: {
+        list(): Promise<ListPage<ResourceType>>;
+        get(key: string): Promise<ResourceType>;
+        create(body: CreateResourceTypeBody, idempotencyKey?: string): Promise<ResourceType>;
+        update(key: string, body: Partial<Omit<CreateResourceTypeBody, "key">>): Promise<ResourceType>;
+        delete(key: string): Promise<{
+            object: "resource_type";
+            key: string;
+            deleted: true;
+        }>;
+    };
+    list(query?: {
+        type?: string;
+        parent_id?: string;
+        limit?: number;
+    }): Promise<ListPage<Resource>>;
+    get(id: string): Promise<Resource>;
+    /** Create or update one resource by (type, external_id). */
+    upsert(body: UpsertResourceBody): Promise<Resource>;
+    /** Discovery sync: upsert up to 500 resources in order (parents before children). */
+    sync(resources: UpsertResourceBody[]): Promise<ListPage<Resource>>;
+    delete(id: string): Promise<{
+        object: "resource";
+        id: string;
+        deleted: true;
+    }>;
+    assignments: {
+        list(query?: {
+            resource_id?: string;
+            subject_type?: string;
+            subject_id?: string;
+        }): Promise<ListPage<ResourceRoleAssignment>>;
+        /** Assign `role` on `resource` to a user, group or org. */
+        assign(body: {
+            resource: ResourceRef;
+            subject: ResourceSubject;
+            role: string;
+            inherit?: boolean;
+        }): Promise<ResourceRoleAssignment>;
+        revoke(id: string): Promise<{
+            object: "resource_role_assignment";
+            id: string;
+            deleted: true;
+        }>;
+    };
+    /** May `subject` hold `permission` on `resource`? */
+    check(body: ResourceCheckBody): Promise<ResourceCheck>;
+    /** Convenience: the boolean answer to {@link check}. */
+    can(body: ResourceCheckBody): Promise<boolean>;
+    checkBatch(checks: ResourceCheckBody[]): Promise<ListPage<ResourceCheck>>;
+    /** The resources (of an optional `type`) on which `subject` holds `permission`. */
+    accessible(body: {
+        subject: ResourceSubject;
+        permission: string;
+        type?: string;
+        groups?: string[];
+        limit?: number;
+    }): Promise<ListPage<Resource>>;
+};

package/dist/client/resources.js

@@ -0,0 +1,73 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.resourcesResource = resourcesResource;
+const request_1 = require("./request");
+/** Resource-scoped RBAC: resource types, the resource tree, role assignments on resources, and permission checks. */
+function resourcesResource(request) {
+    return {
+        types: {
+            list() {
+                return request({ method: 'GET', path: '/v1/resource_types' });
+            },
+            get(key) {
+                return request({ method: 'GET', path: `/v1/resource_types/${(0, request_1.enc)(key)}` });
+            },
+            create(body, idempotencyKey) {
+                return request({ method: 'POST', path: '/v1/resource_types', body, idempotencyKey });
+            },
+            update(key, body) {
+                return request({ method: 'PATCH', path: `/v1/resource_types/${(0, request_1.enc)(key)}`, body });
+            },
+            delete(key) {
+                return request({ method: 'DELETE', path: `/v1/resource_types/${(0, request_1.enc)(key)}` });
+            },
+        },
+        list(query = {}) {
+            const q = new URLSearchParams(Object.entries(query).filter(([, v]) => v !== undefined).map(([k, v]) => [k, String(v)]));
+            return request({ method: 'GET', path: `/v1/resources${q.size ? `?${q}` : ''}` });
+        },
+        get(id) {
+            return request({ method: 'GET', path: `/v1/resources/${(0, request_1.enc)(id)}` });
+        },
+        /** Create or update one resource by (type, external_id). */
+        upsert(body) {
+            return request({ method: 'PUT', path: '/v1/resources', body });
+        },
+        /** Discovery sync: upsert up to 500 resources in order (parents before children). */
+        sync(resources) {
+            return request({ method: 'POST', path: '/v1/resources/sync', body: { resources } });
+        },
+        delete(id) {
+            return request({ method: 'DELETE', path: `/v1/resources/${(0, request_1.enc)(id)}` });
+        },
+        assignments: {
+            list(query = {}) {
+                const q = new URLSearchParams(Object.entries(query).filter(([, v]) => v !== undefined));
+                return request({ method: 'GET', path: `/v1/resource_role_assignments${q.size ? `?${q}` : ''}` });
+            },
+            /** Assign `role` on `resource` to a user, group or org. */
+            assign(body) {
+                return request({ method: 'POST', path: '/v1/resource_role_assignments', body });
+            },
+            revoke(id) {
+                return request({ method: 'DELETE', path: `/v1/resource_role_assignments/${(0, request_1.enc)(id)}` });
+            },
+        },
+        /** May `subject` hold `permission` on `resource`? */
+        check(body) {
+            return request({ method: 'POST', path: '/v1/resource_checks', body });
+        },
+        /** Convenience: the boolean answer to {@link check}. */
+        async can(body) {
+            return (await request({ method: 'POST', path: '/v1/resource_checks', body })).allowed;
+        },
+        checkBatch(checks) {
+            return request({ method: 'POST', path: '/v1/resource_checks/batch', body: { checks } });
+        },
+        /** The resources (of an optional `type`) on which `subject` holds `permission`. */
+        accessible(body) {
+            return request({ method: 'POST', path: '/v1/resource_checks/list', body });
+        },
+    };
+}
+//# sourceMappingURL=resources.js.map

package/dist/client/resources.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"resources.js","sourceRoot":"","sources":["../../src/client/resources.ts"],"names":[],"mappings":";;AAuFA,8CAkEC;AAzJD,uCAAgD;AAsFhD,qHAAqH;AACrH,SAAgB,iBAAiB,CAAC,OAAkB;IAClD,OAAO;QACL,KAAK,EAAE;YACL,IAAI;gBACF,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,oBAAoB,EAAE,CAAC,CAAC;YAChE,CAAC;YACD,GAAG,CAAC,GAAW;gBACb,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,sBAAsB,IAAA,aAAG,EAAC,GAAG,CAAC,EAAE,EAAE,CAAC,CAAC;YAC5E,CAAC;YACD,MAAM,CAAC,IAA4B,EAAE,cAAuB;gBAC1D,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,oBAAoB,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC;YACvF,CAAC;YACD,MAAM,CAAC,GAAW,EAAE,IAAkD;gBACpE,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,sBAAsB,IAAA,aAAG,EAAC,GAAG,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;YACpF,CAAC;YACD,MAAM,CAAC,GAAW;gBAChB,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,sBAAsB,IAAA,aAAG,EAAC,GAAG,CAAC,EAAE,EAAE,CAAC,CAAC;YAC/E,CAAC;SACF;QACD,IAAI,CAAC,QAA+D,EAAE;YACpE,MAAM,CAAC,GAAG,IAAI,eAAe,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,SAAS,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAoB,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YAC1I,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,gBAAgB,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;QACnF,CAAC;QACD,GAAG,CAAC,EAAU;YACZ,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,iBAAiB,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;QACtE,CAAC;QACD,4DAA4D;QAC5D,MAAM,CAAC,IAAwB;YAC7B,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,eAAe,EAAE,IAAI,EAAE,CAAC,CAAC;QACjE,CAAC;QACD,qFAAqF;QACrF,IAAI,CAAC,SAA+B;YAClC,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,oBAAoB,EAAE,IAAI,EAAE,EAAE,SAAS,EAAE,EAAE,CAAC,CAAC;QACtF,CAAC;QACD,MAAM,CAAC,EAAU;YACf,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,iBAAiB,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;QACzE,CAAC;QACD,WAAW,EAAE;YACX,IAAI,CAAC,QAA8E,EAAE;gBACnF,MAAM,CAAC,GAAG,IAAI,eAAe,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,SAAS,CAAuB,CAAC,CAAC;gBAC9G,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,gCAAgC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;YACnG,CAAC;YACD,2DAA2D;YAC3D,MAAM,CAAC,IAA0F;gBAC/F,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,+BAA+B,EAAE,IAAI,EAAE,CAAC,CAAC;YAClF,CAAC;YACD,MAAM,CAAC,EAAU;gBACf,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,iCAAiC,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;YACzF,CAAC;SACF;QACD,qDAAqD;QACrD,KAAK,CAAC,IAAuB;YAC3B,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,qBAAqB,EAAE,IAAI,EAAE,CAAC,CAAC;QACxE,CAAC;QACD,wDAAwD;QACxD,KAAK,CAAC,GAAG,CAAC,IAAuB;YAC/B,OAAO,CAAC,MAAM,OAAO,CAAgB,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,qBAAqB,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC;QACvG,CAAC;QACD,UAAU,CAAC,MAA2B;YACpC,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,2BAA2B,EAAE,IAAI,EAAE,EAAE,MAAM,EAAE,EAAE,CAAC,CAAC;QAC1F,CAAC;QACD,mFAAmF;QACnF,UAAU,CAAC,IAAwG;YACjH,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,0BAA0B,EAAE,IAAI,EAAE,CAAC,CAAC;QAC7E,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/client/risk-based-mfa.d.ts

@@ -3,6 +3,14 @@ import { type RequestFn } from './request';
 export type RiskLevel = 'low' | 'medium' | 'high';
 /** What to do at high risk when the user has NO enrolled factor. */
 export type OnHighRiskNoFactor = 'allow' | 'block' | 'require_enroll';
+/** `audit` scores and records every sign-in but never changes the outcome. */
+export type RiskMode = 'enforce' | 'audit';
+/** What a risk level does; `default` keeps the step-up threshold behaviour. */
+export type RiskLevelAction = 'default' | 'allow' | 'notify' | 'mfa' | 'block';
+export interface RiskLevelActions {
+    medium: RiskLevelAction;
+    high: RiskLevelAction;
+}
 /** Per-signal score weights that feed the risk total. */
 export interface RiskWeights {
     newDevice: number;
@@ -34,6 +42,78 @@ export interface RiskBasedMfa {
     on_high_risk_no_factor: OnHighRiskNoFactor;
     weights: RiskWeights;
     signals: RiskSignalToggles;
+    mode: RiskMode;
+    level_actions: RiskLevelActions;
+    reputation: RiskReputation;
+    fraud: FraudConfig;
+    /** Per-user baseline: unusual sign-in hour or never-seen country adds `weight` points each. */
+    baseline: {
+        enabled: boolean;
+        weight: number;
+    };
+    /** Re-evaluate a session when it refreshes from a different network. */
+    mid_session: {
+        enabled: boolean;
+        action: 'revoke' | 'notify' | 'audit';
+    };
+}
+export type FraudAction = 'allow' | 'challenge' | 'block';
+export interface FraudRule {
+    id: string;
+    name: string;
+    enabled: boolean;
+    action: FraudAction;
+    /** Reason code returned when the rule matches. */
+    reason: string;
+    /** All conditions must hold. */
+    conditions: Array<{
+        field: 'country' | 'asn' | 'datacenter' | 'anonymizer' | 'headless' | 'automation' | 'client_class' | 'bot_score' | 'email_disposable' | 'ip_velocity' | 'device_velocity' | 'email_velocity';
+        op: 'eq' | 'neq' | 'gt' | 'gte' | 'lt' | 'lte' | 'in' | 'nin';
+        value: string | number | boolean | Array<string | number>;
+    }>;
+}
+export interface FraudConfig {
+    /** Two-letter country codes that are always blocked. */
+    sanctioned_countries: string[];
+    rules: FraudRule[];
+    /** Cap on lookups per device per hour; adaptive halves it for bot-like, datacenter or anonymized clients. */
+    device_rate_limit?: {
+        enabled: boolean;
+        per_hour: number;
+        adaptive: boolean;
+    };
+}
+export interface FraudLookupBody {
+    ip: string;
+    user_agent?: string;
+    /** The stable id from the JS SDK. */
+    device_id?: string;
+    email?: string;
+    /** A user of this instance, for user_age_days / user_mfa_enabled / user_banned rules. */
+    user_id?: string;
+    /** The organization the action is for, for org_id rules. */
+    org_id?: string;
+    /** Device features reported by the SDK (see the telemetry beacon). */
+    device?: Record<string, unknown>;
+}
+export interface FraudLookup {
+    object: 'fraud_lookup';
+    verdict: FraudAction;
+    reasons: string[];
+    matched_rules: string[];
+    device_id: string | null;
+    signals: Record<string, string | number | boolean | null>;
+}
+/** External IP-reputation / email-risk feeds (bring your own provider key). */
+export interface RiskReputation {
+    provider: 'none' | 'ipqs' | 'spur' | 'minfraud';
+    /** Score points added when the IP is flagged. */
+    ip_weight: number;
+    /** Provider fraud score (1-100) at or above which the IP is flagged. */
+    min_score: number;
+    flag_anonymizers: boolean;
+    email_checks: boolean;
+    email_weight: number;
 }
 export interface UpdateRiskBasedMfaBody {
     enabled?: boolean;
@@ -41,6 +121,40 @@ export interface UpdateRiskBasedMfaBody {
     on_high_risk_no_factor?: OnHighRiskNoFactor;
     weights?: Partial<RiskWeights>;
     signals?: Partial<RiskSignalToggles>;
+    mode?: RiskMode;
+    level_actions?: Partial<RiskLevelActions>;
+    reputation?: Partial<RiskReputation>;
+    fraud?: Partial<FraudConfig>;
+    baseline?: Partial<RiskBasedMfa['baseline']>;
+    mid_session?: Partial<RiskBasedMfa['mid_session']>;
+}
+/** One risk-scored sign-in on the audit / shadow-mode timeline. */
+export interface RiskEvent {
+    object: 'risk_event';
+    id: string;
+    user_id: string;
+    level: RiskLevel;
+    score: number;
+    /** Names of the signals that fired. */
+    signals: string[];
+    /** The action decided; in audit mode, what WOULD have happened. */
+    action: string;
+    mode: RiskMode;
+    ip: string | null;
+    feedback: 'legit' | 'fraud' | null;
+    feedback_at: string | null;
+    created_at: string;
+}
+export interface RiskEventMetrics {
+    object: 'risk_event_metrics';
+    days: number;
+    total: number;
+    buckets: Array<{
+        level: string;
+        action: string;
+        mode: string;
+        count: number;
+    }>;
 }
 /**
  * Read and tune the instance's adaptive-MFA engine — when a second factor is
@@ -51,4 +165,37 @@ export declare function riskBasedMfaResource(request: RequestFn): {
     get(): Promise<RiskBasedMfa>;
     /** Change any subset of the config; omitted fields are left unchanged. */
     update(body: UpdateRiskBasedMfaBody): Promise<RiskBasedMfa>;
+    /** Fraud decision (allow / challenge / block with reason codes) for a sign-up, sign-in or checkout. */
+    fraudLookup(body: FraudLookupBody): Promise<FraudLookup>;
+    /** Store the reputation provider's API key (write-only; minfraud: "<account id>:<license key>"). */
+    setReputationSecret(secret: string, provider?: "ipqs" | "spur" | "minfraud"): Promise<{
+        object: "risk_reputation_secret";
+        provider: string;
+        set: true;
+    }>;
+    /** Remove a stored reputation provider key (default: the configured provider). */
+    removeReputationSecret(provider?: "ipqs" | "spur" | "minfraud"): Promise<{
+        object: "risk_reputation_secret";
+        provider: string;
+        deleted: true;
+    }>;
+};
+/** The risk-event timeline, metrics and feedback. */
+export declare function riskEventsResource(request: RequestFn): {
+    /** Newest first. Page with `before` (the created_at of the last row). */
+    list(query?: {
+        user_id?: string;
+        level?: RiskLevel;
+        limit?: number;
+        before?: string;
+    }): Promise<{
+        object: "list";
+        data: RiskEvent[];
+    }>;
+    /** Counts per level / action / mode over the last `days`. */
+    metrics(query?: {
+        days?: number;
+    }): Promise<RiskEventMetrics>;
+    /** Mark a scored sign-in `legit` or `fraud`; the fired signals' weights move accordingly. */
+    feedback(id: string, verdict: "legit" | "fraud"): Promise<RiskEvent>;
 };

package/dist/client/risk-based-mfa.js

@@ -1,6 +1,7 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.riskBasedMfaResource = riskBasedMfaResource;
+exports.riskEventsResource = riskEventsResource;
 /**
  * Read and tune the instance's adaptive-MFA engine — when a second factor is
  * demanded, and how each risk signal is weighted.
@@ -15,6 +16,35 @@ function riskBasedMfaResource(request) {
         update(body) {
             return request({ method: 'PATCH', path: '/v1/risk_based_mfa', body });
         },
+        /** Fraud decision (allow / challenge / block with reason codes) for a sign-up, sign-in or checkout. */
+        fraudLookup(body) {
+            return request({ method: 'POST', path: '/v1/fraud/lookup', body });
+        },
+        /** Store the reputation provider's API key (write-only; minfraud: "<account id>:<license key>"). */
+        setReputationSecret(secret, provider) {
+            return request({ method: 'PUT', path: '/v1/risk_based_mfa/reputation_secret', body: { secret, provider } });
+        },
+        /** Remove a stored reputation provider key (default: the configured provider). */
+        removeReputationSecret(provider) {
+            return request({ method: 'DELETE', path: '/v1/risk_based_mfa/reputation_secret', query: { provider } });
+        },
+    };
+}
+/** The risk-event timeline, metrics and feedback. */
+function riskEventsResource(request) {
+    return {
+        /** Newest first. Page with `before` (the created_at of the last row). */
+        list(query = {}) {
+            return request({ method: 'GET', path: '/v1/risk_events', query });
+        },
+        /** Counts per level / action / mode over the last `days`. */
+        metrics(query = {}) {
+            return request({ method: 'GET', path: '/v1/risk_events/metrics', query });
+        },
+        /** Mark a scored sign-in `legit` or `fraud`; the fired signals' weights move accordingly. */
+        feedback(id, verdict) {
+            return request({ method: 'POST', path: `/v1/risk_events/${encodeURIComponent(id)}/feedback`, body: { verdict } });
+        },
     };
 }
 //# sourceMappingURL=risk-based-mfa.js.map