@atlasauth/backend 0.24.0 → 0.26.0

package/dist/client/network-zones.d.ts

@@ -0,0 +1,56 @@
+import { type RequestFn } from './request';
+import type { ListPage } from './types';
+export type NetworkZoneAnonymizer = 'tor' | 'datacenter' | 'vpn';
+/**
+ * A reusable network zone: a union of CIDR ranges, ISO countries, ASNs and
+ * anonymizer classes. Network ACL rules reference one by `zone_id`.
+ */
+export interface NetworkZone {
+    object: 'network_zone';
+    id: string;
+    name: string;
+    description: string | null;
+    cidrs: string[];
+    countries: string[];
+    asns: number[];
+    anonymizers: NetworkZoneAnonymizer[];
+    enabled: boolean;
+    created_at: number;
+    updated_at: number;
+}
+export interface CreateNetworkZoneBody {
+    name: string;
+    description?: string | null;
+    cidrs?: string[];
+    countries?: string[];
+    asns?: number[];
+    anonymizers?: NetworkZoneAnonymizer[];
+    enabled?: boolean;
+}
+export type UpdateNetworkZoneBody = Partial<CreateNetworkZoneBody>;
+export interface NetworkZoneCheck {
+    object: 'network_zone_check';
+    zone_id: string;
+    ip: string;
+    matches: boolean;
+    facts: {
+        country: string | null;
+        asn: number | null;
+        tor: boolean | null;
+        datacenter: boolean | null;
+    };
+}
+/** CRUD over the instance's network zones, plus a what-if `check` for one address. */
+export declare function networkZonesResource(request: RequestFn): {
+    list(): Promise<ListPage<NetworkZone>>;
+    get(id: string): Promise<NetworkZone>;
+    create(body: CreateNetworkZoneBody, idempotencyKey?: string): Promise<NetworkZone>;
+    update(id: string, body: UpdateNetworkZoneBody): Promise<NetworkZone>;
+    delete(id: string): Promise<{
+        object: "network_zone";
+        id: string;
+        deleted: true;
+    }>;
+    /** Does `ip` fall inside the zone? Returns the resolved facts too. */
+    check(id: string, ip: string): Promise<NetworkZoneCheck>;
+};

package/dist/client/network-zones.js

@@ -0,0 +1,29 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.networkZonesResource = networkZonesResource;
+const request_1 = require("./request");
+/** CRUD over the instance's network zones, plus a what-if `check` for one address. */
+function networkZonesResource(request) {
+    return {
+        list() {
+            return request({ method: 'GET', path: '/v1/network_zones' });
+        },
+        get(id) {
+            return request({ method: 'GET', path: `/v1/network_zones/${(0, request_1.enc)(id)}` });
+        },
+        create(body, idempotencyKey) {
+            return request({ method: 'POST', path: '/v1/network_zones', body, idempotencyKey });
+        },
+        update(id, body) {
+            return request({ method: 'PATCH', path: `/v1/network_zones/${(0, request_1.enc)(id)}`, body });
+        },
+        delete(id) {
+            return request({ method: 'DELETE', path: `/v1/network_zones/${(0, request_1.enc)(id)}` });
+        },
+        /** Does `ip` fall inside the zone? Returns the resolved facts too. */
+        check(id, ip) {
+            return request({ method: 'POST', path: `/v1/network_zones/${(0, request_1.enc)(id)}/check`, body: { ip } });
+        },
+    };
+}
+//# sourceMappingURL=network-zones.js.map

package/dist/client/network-zones.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"network-zones.js","sourceRoot":"","sources":["../../src/client/network-zones.ts"],"names":[],"mappings":";;AA4CA,oDAsBC;AAlED,uCAAgD;AA2ChD,sFAAsF;AACtF,SAAgB,oBAAoB,CAAC,OAAkB;IACrD,OAAO;QACL,IAAI;YACF,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,mBAAmB,EAAE,CAAC,CAAC;QAC/D,CAAC;QACD,GAAG,CAAC,EAAU;YACZ,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,qBAAqB,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;QAC1E,CAAC;QACD,MAAM,CAAC,IAA2B,EAAE,cAAuB;YACzD,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,mBAAmB,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC;QACtF,CAAC;QACD,MAAM,CAAC,EAAU,EAAE,IAA2B;YAC5C,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,qBAAqB,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;QAClF,CAAC;QACD,MAAM,CAAC,EAAU;YACf,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,qBAAqB,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;QAC7E,CAAC;QACD,sEAAsE;QACtE,KAAK,CAAC,EAAU,EAAE,EAAU;YAC1B,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,qBAAqB,IAAA,aAAG,EAAC,EAAE,CAAC,QAAQ,EAAE,IAAI,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC;QAC/F,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/client/notifications.d.ts

@@ -1,6 +1,6 @@
 import { type RequestFn } from './request';
 /** Built-in notification templates `send` falls back to when no tenant template has the name. */
-export type BuiltInNotificationTemplate = 'new_device' | 'unattended_access' | 'password_changed' | 'mfa_changed' | 'email_changed';
+export type BuiltInNotificationTemplate = 'new_device' | 'unattended_access' | 'password_changed' | 'mfa_changed' | 'email_changed' | 'phone_changed' | 'identity_linked' | 'identity_unlinked' | 'passkey_added' | 'passkey_removed' | 'recovery_codes_regenerated' | 'factor_removed' | 'device_key_added' | 'device_key_removed' | 'risk_alert';
 export interface SendNotificationBody {
     /** The end-user to notify. */
     user_id: string;

package/dist/client/notifications.js.map

@@ -1 +1 @@
-{"version":3,"file":"notifications.js","sourceRoot":"","sources":["../../src/client/notifications.ts"],"names":[],"mappings":";;AAkEA,sDAqDC;AAvHD,uCAAgD;AAkEhD,SAAgB,qBAAqB,CAAC,OAAkB;IACtD,OAAO;QACL,2FAA2F;QAC3F,IAAI,CAAC,IAA0B,EAAE,cAAuB;YACtD,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,mBAAmB,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC;QACtF,CAAC;QACD,UAAU,EAAE;YACV,IAAI;gBACF,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,6BAA6B,EAAE,CAAC,CAAC;YACzE,CAAC;YACD,4CAA4C;YAC5C,MAAM,CAAC,IAAoC;gBACzC,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,6BAA6B,EAAE,IAAI,EAAE,CAAC,CAAC;YAChF,CAAC;YACD,MAAM,CAAC,GAAW,EAAE,IAAuB;gBACzC,OAAO,OAAO,CAAC;oBACb,MAAM,EAAE,KAAK;oBACb,IAAI,EAAE,+BAA+B,IAAA,aAAG,EAAC,GAAG,CAAC,EAAE;oBAC/C,IAAI;iBACL,CAAC,CAAC;YACL,CAAC;YACD,yDAAyD;YACzD,MAAM,CACJ,GAAW;gBAEX,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,+BAA+B,IAAA,aAAG,EAAC,GAAG,CAAC,EAAE,EAAE,CAAC,CAAC;YACxF,CAAC;SACF;QACD,SAAS,EAAE;YACT,IAAI;gBACF,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,4BAA4B,EAAE,CAAC,CAAC;YACxE,CAAC;YACD,iCAAiC;YACjC,MAAM,CAAC,IAAoC;gBACzC,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,4BAA4B,EAAE,IAAI,EAAE,CAAC,CAAC;YAC/E,CAAC;YACD,GAAG,CAAC,IAAY;gBACd,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,8BAA8B,IAAA,aAAG,EAAC,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC;YACrF,CAAC;YACD,MAAM,CAAC,IAAY,EAAE,IAAoC;gBACvD,OAAO,OAAO,CAAC;oBACb,MAAM,EAAE,KAAK;oBACb,IAAI,EAAE,8BAA8B,IAAA,aAAG,EAAC,IAAI,CAAC,EAAE;oBAC/C,IAAI;iBACL,CAAC,CAAC;YACL,CAAC;YACD,MAAM,CACJ,IAAY;gBAEZ,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,8BAA8B,IAAA,aAAG,EAAC,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC;YACxF,CAAC;SACF;KACF,CAAC;AACJ,CAAC"}
+{"version":3,"file":"notifications.js","sourceRoot":"","sources":["../../src/client/notifications.ts"],"names":[],"mappings":";;AA4EA,sDAqDC;AAjID,uCAAgD;AA4EhD,SAAgB,qBAAqB,CAAC,OAAkB;IACtD,OAAO;QACL,2FAA2F;QAC3F,IAAI,CAAC,IAA0B,EAAE,cAAuB;YACtD,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,mBAAmB,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC;QACtF,CAAC;QACD,UAAU,EAAE;YACV,IAAI;gBACF,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,6BAA6B,EAAE,CAAC,CAAC;YACzE,CAAC;YACD,4CAA4C;YAC5C,MAAM,CAAC,IAAoC;gBACzC,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,6BAA6B,EAAE,IAAI,EAAE,CAAC,CAAC;YAChF,CAAC;YACD,MAAM,CAAC,GAAW,EAAE,IAAuB;gBACzC,OAAO,OAAO,CAAC;oBACb,MAAM,EAAE,KAAK;oBACb,IAAI,EAAE,+BAA+B,IAAA,aAAG,EAAC,GAAG,CAAC,EAAE;oBAC/C,IAAI;iBACL,CAAC,CAAC;YACL,CAAC;YACD,yDAAyD;YACzD,MAAM,CACJ,GAAW;gBAEX,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,+BAA+B,IAAA,aAAG,EAAC,GAAG,CAAC,EAAE,EAAE,CAAC,CAAC;YACxF,CAAC;SACF;QACD,SAAS,EAAE;YACT,IAAI;gBACF,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,4BAA4B,EAAE,CAAC,CAAC;YACxE,CAAC;YACD,iCAAiC;YACjC,MAAM,CAAC,IAAoC;gBACzC,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,4BAA4B,EAAE,IAAI,EAAE,CAAC,CAAC;YAC/E,CAAC;YACD,GAAG,CAAC,IAAY;gBACd,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,8BAA8B,IAAA,aAAG,EAAC,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC;YACrF,CAAC;YACD,MAAM,CAAC,IAAY,EAAE,IAAoC;gBACvD,OAAO,OAAO,CAAC;oBACb,MAAM,EAAE,KAAK;oBACb,IAAI,EAAE,8BAA8B,IAAA,aAAG,EAAC,IAAI,CAAC,EAAE;oBAC/C,IAAI;iBACL,CAAC,CAAC;YACL,CAAC;YACD,MAAM,CACJ,IAAY;gBAEZ,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,8BAA8B,IAAA,aAAG,EAAC,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC;YACxF,CAAC;SACF;KACF,CAAC;AACJ,CAAC"}

package/dist/client/oauth-clients.d.ts

@@ -1,6 +1,46 @@
 import { type ProvisioningFields, type ProvisioningInput, type ProvisioningMetadata } from './compliance';
 import { type RequestFn } from './request';
 import type { ListPage } from './types';
+export interface TrustedIssuer {
+    object: 'oauth_trusted_issuer';
+    id: string;
+    client_id: string;
+    issuer: string;
+    jwks: {
+        keys: unknown[];
+    } | null;
+    jwks_uri: string | null;
+    subject_mapping: 'user_id' | 'external_id' | 'email';
+    workload_kind: 'generic' | 'spiffe' | 'kubernetes' | 'github_actions' | 'gcp' | 'azure';
+    purpose: 'user_assertion' | 'client_auth' | 'both';
+    subject_pattern: string | null;
+    required_claims: Record<string, string> | null;
+    audiences: string[] | null;
+    created_at: number;
+}
+export interface TrustedIssuerInput {
+    issuer?: string;
+    jwks?: {
+        keys: unknown[];
+    };
+    jwks_uri?: string;
+    subject_mapping?: 'user_id' | 'external_id' | 'email';
+    workload_kind?: TrustedIssuer['workload_kind'];
+    tenant_id?: string;
+    purpose?: TrustedIssuer['purpose'];
+    subject_pattern?: string;
+    required_claims?: Record<string, string>;
+    audiences?: string[];
+}
+export interface WorkloadPreset {
+    object: 'workload_identity_preset';
+    kind: string;
+    title: string;
+    issuer: string | null;
+    jwks_uri: string | null;
+    subject_example: string;
+    notes: string;
+}
 export interface OAuthClient extends ProvisioningFields {
     object: 'oauth_client';
     id: string;
@@ -10,7 +50,7 @@ export interface OAuthClient extends ProvisioningFields {
     redirect_uris: string[];
     allowed_scopes: string[];
     grant_types: string[];
-    token_endpoint_auth_method: 'client_secret_basic' | 'client_secret_post' | 'none';
+    token_endpoint_auth_method: 'client_secret_basic' | 'client_secret_post' | 'none' | 'private_key_jwt' | 'workload_jwt';
     secret_prefix: string | null;
     /**
      * After a rotation with overlap: when the previous secret stops working (epoch
@@ -21,6 +61,8 @@ export interface OAuthClient extends ProvisioningFields {
     first_party: boolean;
     /** Where the client may send users after an RP-initiated logout. */
     post_logout_redirect_uris: string[];
+    /** UMA 2.0 claims-gathering redirect allowlist (exact match). */
+    claims_redirect_uris: string[];
     /** Back-channel logout endpoint Atlas POSTs a `logout_token` to, or null. */
     backchannel_logout_uri: string | null;
     /** Whether the back-channel `logout_token` must carry `sid`. */
@@ -109,6 +151,8 @@ export interface CreateInitialAccessTokenBody {
  */
 export interface OAuthClientLogoutFields {
     post_logout_redirect_uris?: string[];
+    /** UMA 2.0 claims-gathering redirect allowlist (exact match). */
+    claims_redirect_uris?: string[];
     backchannel_logout_uri?: string | null;
     backchannel_logout_session_required?: boolean;
     frontchannel_logout_uri?: string | null;
@@ -160,7 +204,7 @@ export interface CreateOAuthClientBody extends ProvisioningInput, OAuthClientLog
     redirect_uris: string[];
     allowed_scopes?: string[];
     grant_types?: string[];
-    token_endpoint_auth_method?: 'client_secret_basic' | 'client_secret_post' | 'none';
+    token_endpoint_auth_method?: 'client_secret_basic' | 'client_secret_post' | 'none' | 'workload_jwt';
     logo_url?: string;
     first_party?: boolean;
     /** How long the issued secret authenticates, in seconds; omit for no expiry. */
@@ -174,7 +218,7 @@ export interface UpdateOAuthClientBody extends OAuthClientLogoutFields, OAuthCli
     name?: string;
     redirect_uris?: string[];
     allowed_scopes?: string[];
-    token_endpoint_auth_method?: 'client_secret_basic' | 'client_secret_post' | 'none';
+    token_endpoint_auth_method?: 'client_secret_basic' | 'client_secret_post' | 'none' | 'workload_jwt';
     logo_url?: string | null;
     first_party?: boolean;
     /** Refuse every OAuth flow for this client without deleting it. */
@@ -280,10 +324,50 @@ export declare function oauthClientsResource(request: RequestFn): {
         deleted: true;
         note: string;
     }>;
+    /**
+     * Per-application settings: allowed sign-in methods, hosted-page branding,
+     * the user-claim allow-list for ID tokens and userinfo, and writable traits.
+     */
+    appSettings: {
+        /** `GET /v1/oauth_clients/:id/app_settings` */
+        get(id: string): Promise<OAuthClientAppSettings>;
+        /** `PATCH /v1/oauth_clients/:id/app_settings` — fields sent replace the stored ones; null clears. */
+        update(id: string, body: OAuthClientAppSettingsPatch): Promise<OAuthClientAppSettings>;
+    };
     /** The client's back-channel logout delivery log, newest first. */
     listBackchannelDeliveries(id: string, query?: BackchannelDeliveriesQuery): Promise<BackchannelLogoutDeliveryPage>;
     /** Send a test back-channel logout now and return what the receiver answered. */
     testBackchannelLogout(id: string): Promise<BackchannelLogoutTest>;
+    /** Set (or clear with null) the URLs of your own sign-in and consent pages for a client. */
+    setDelegatedUi(id: string, body: {
+        login_url?: string | null;
+        consent_url?: string | null;
+    }): Promise<{
+        object: "oauth_client_delegated_ui";
+        client_id: string;
+        login_url: string | null;
+        consent_url: string | null;
+    }>;
+    /** Delegated login: read, accept or reject the `login_challenge` your sign-in page received. */
+    loginRequests: {
+        get(loginChallenge: string): Promise<DelegatedLoginRequest>;
+        accept(loginChallenge: string, body: {
+            subject: string;
+            remember?: boolean;
+            amr?: string[];
+            acr?: string;
+        }): Promise<DelegatedRedirect>;
+        reject(loginChallenge: string, body?: DelegatedReject): Promise<DelegatedRedirect>;
+    };
+    /** Delegated consent: read, accept or reject the `consent_challenge` your consent page received. */
+    consentRequests: {
+        get(consentChallenge: string): Promise<DelegatedConsentRequest>;
+        accept(consentChallenge: string, body?: {
+            grant_scope?: string[];
+            remember?: boolean;
+        }): Promise<DelegatedRedirect>;
+        reject(consentChallenge: string, body?: DelegatedReject): Promise<DelegatedRedirect>;
+    };
     /** RFC 7591 §3 initial access tokens for dynamic client registration. */
     initialAccessTokens: {
         list(): Promise<ListPage<OAuthInitialAccessToken>>;
@@ -294,6 +378,26 @@ export declare function oauthClientsResource(request: RequestFn): {
         }>;
         revoke(id: string): Promise<OAuthInitialAccessToken>;
     };
+    /** Issuers whose signed tokens this client accepts (jwt-bearer grant, workload identity). */
+    trustedIssuers: {
+        list(clientId: string): Promise<ListPage<TrustedIssuer>>;
+        create(clientId: string, body: TrustedIssuerInput): Promise<TrustedIssuer>;
+        delete(clientId: string, issuerId: string): Promise<{
+            object: "oauth_trusted_issuer";
+            id: string;
+            deleted: true;
+        }>;
+    };
+    /** Workload identity federation helpers (SPIFFE, Kubernetes, GitHub Actions, GCP, Azure). */
+    workloadIdentity: {
+        presets(): Promise<ListPage<WorkloadPreset>>;
+        cloudTrust(query: {
+            provider: "aws" | "gcp" | "azure";
+            audience: string;
+            subject: string;
+            tenant_id?: string;
+        }): Promise<Record<string, unknown>>;
+    };
     grants: {
         list(clientId: string): Promise<ListPage<ClientGrant>>;
         create(clientId: string, body: {
@@ -307,3 +411,83 @@ export declare function oauthClientsResource(request: RequestFn): {
         }>;
     };
 };
+export interface OAuthClientAppBranding {
+    heading?: string | null;
+    subheading?: string | null;
+    logo_url?: string | null;
+    primary_color?: string | null;
+}
+export interface OAuthClientAppSettingsPatch {
+    /** Method names (password, passkey, oauth_google, ...) or the families oauth and enterprise_sso. */
+    allowed_sign_in_methods?: string[] | null;
+    branding?: OAuthClientAppBranding | null;
+    /** User claims the app receives in ID tokens and userinfo; protocol claims always pass. */
+    claims_allowlist?: string[] | null;
+    /** Traits a session from this app may change. */
+    writable_traits?: string[] | null;
+    /** Overrides of the instance's risk-based MFA for sign-ins to this app. */
+    risk?: OAuthClientAppRisk | null;
+}
+export type OAuthClientRiskLevelAction = 'default' | 'allow' | 'notify' | 'mfa' | 'block';
+export interface OAuthClientAppRisk {
+    enabled?: boolean | null;
+    mode?: 'enforce' | 'audit' | null;
+    step_up_threshold?: 'low' | 'medium' | 'high' | null;
+    on_high_risk_no_factor?: 'allow' | 'block' | 'require_enroll' | null;
+    level_actions?: {
+        medium?: OAuthClientRiskLevelAction | null;
+        high?: OAuthClientRiskLevelAction | null;
+    } | null;
+    /** The refresh-time check for sessions that came from this app. */
+    mid_session?: {
+        enabled?: boolean | null;
+        action?: 'revoke' | 'notify' | 'audit' | null;
+    } | null;
+}
+export interface OAuthClientAppSettings {
+    object: 'app_settings';
+    client_id: string;
+    allowed_sign_in_methods: string[] | null;
+    branding: Required<OAuthClientAppBranding> | null;
+    claims_allowlist: string[] | null;
+    writable_traits: string[] | null;
+    risk: OAuthClientAppRisk | null;
+}
+export interface DelegatedClientRef {
+    id: string;
+    client_id: string;
+    name: string;
+    first_party?: boolean;
+}
+export interface DelegatedLoginRequest {
+    object: 'oauth_login_request';
+    client: DelegatedClientRef;
+    requested_scope: string[];
+    audience: string | null;
+    page: 'sign-in' | 'sign-up';
+    /** The Atlas user already signed in on this browser, if any. */
+    session_subject: string | null;
+    ui_locales: string | null;
+    login_hint: string | null;
+    expires_at: number;
+}
+export interface DelegatedConsentRequest {
+    object: 'oauth_consent_request';
+    subject: string;
+    client: DelegatedClientRef;
+    requested_scope: string[];
+    audience: string | null;
+    authorization_details: unknown[];
+    organization_id: string | null;
+    redirect_uri: string;
+    expires_at: number;
+}
+export interface DelegatedRedirect {
+    object: 'oauth_login_redirect' | 'oauth_consent_redirect';
+    /** Send the end user's browser here next. */
+    redirect_to: string;
+}
+export interface DelegatedReject {
+    error?: 'access_denied' | 'login_required' | 'interaction_required' | 'consent_required' | 'account_selection_required' | 'unauthorized_client' | 'temporarily_unavailable' | 'server_error';
+    error_description?: string;
+}

package/dist/client/oauth-clients.js

@@ -37,6 +37,20 @@ function oauthClientsResource(request) {
         delete(id) {
             return request({ method: 'DELETE', path: `/v1/oauth_clients/${(0, request_1.enc)(id)}` });
         },
+        /**
+         * Per-application settings: allowed sign-in methods, hosted-page branding,
+         * the user-claim allow-list for ID tokens and userinfo, and writable traits.
+         */
+        appSettings: {
+            /** `GET /v1/oauth_clients/:id/app_settings` */
+            get(id) {
+                return request({ method: 'GET', path: `/v1/oauth_clients/${(0, request_1.enc)(id)}/app_settings` });
+            },
+            /** `PATCH /v1/oauth_clients/:id/app_settings` — fields sent replace the stored ones; null clears. */
+            update(id, body) {
+                return request({ method: 'PATCH', path: `/v1/oauth_clients/${(0, request_1.enc)(id)}/app_settings`, body });
+            },
+        },
         /** The client's back-channel logout delivery log, newest first. */
         listBackchannelDeliveries(id, query = {}) {
             return request({
@@ -49,6 +63,34 @@ function oauthClientsResource(request) {
         testBackchannelLogout(id) {
             return request({ method: 'POST', path: `/v1/oauth_clients/${(0, request_1.enc)(id)}/backchannel_logout/test` });
         },
+        /** Set (or clear with null) the URLs of your own sign-in and consent pages for a client. */
+        setDelegatedUi(id, body) {
+            return request({ method: 'PUT', path: `/v1/oauth_clients/${(0, request_1.enc)(id)}/delegated_ui`, body });
+        },
+        /** Delegated login: read, accept or reject the `login_challenge` your sign-in page received. */
+        loginRequests: {
+            get(loginChallenge) {
+                return request({ method: 'GET', path: '/v1/oauth_login_requests', query: { login_challenge: loginChallenge } });
+            },
+            accept(loginChallenge, body) {
+                return request({ method: 'PUT', path: '/v1/oauth_login_requests/accept', query: { login_challenge: loginChallenge }, body });
+            },
+            reject(loginChallenge, body = {}) {
+                return request({ method: 'PUT', path: '/v1/oauth_login_requests/reject', query: { login_challenge: loginChallenge }, body });
+            },
+        },
+        /** Delegated consent: read, accept or reject the `consent_challenge` your consent page received. */
+        consentRequests: {
+            get(consentChallenge) {
+                return request({ method: 'GET', path: '/v1/oauth_consent_requests', query: { consent_challenge: consentChallenge } });
+            },
+            accept(consentChallenge, body = {}) {
+                return request({ method: 'PUT', path: '/v1/oauth_consent_requests/accept', query: { consent_challenge: consentChallenge }, body });
+            },
+            reject(consentChallenge, body = {}) {
+                return request({ method: 'PUT', path: '/v1/oauth_consent_requests/reject', query: { consent_challenge: consentChallenge }, body });
+            },
+        },
         /** RFC 7591 §3 initial access tokens for dynamic client registration. */
         initialAccessTokens: {
             list() {
@@ -62,6 +104,28 @@ function oauthClientsResource(request) {
                 return request({ method: 'DELETE', path: `/v1/oauth_initial_access_tokens/${(0, request_1.enc)(id)}` });
             },
         },
+        /** Issuers whose signed tokens this client accepts (jwt-bearer grant, workload identity). */
+        trustedIssuers: {
+            list(clientId) {
+                return request({ method: 'GET', path: `/v1/oauth_clients/${(0, request_1.enc)(clientId)}/trusted_issuers` });
+            },
+            create(clientId, body) {
+                return request({ method: 'POST', path: `/v1/oauth_clients/${(0, request_1.enc)(clientId)}/trusted_issuers`, body });
+            },
+            delete(clientId, issuerId) {
+                return request({ method: 'DELETE', path: `/v1/oauth_clients/${(0, request_1.enc)(clientId)}/trusted_issuers/${(0, request_1.enc)(issuerId)}` });
+            },
+        },
+        /** Workload identity federation helpers (SPIFFE, Kubernetes, GitHub Actions, GCP, Azure). */
+        workloadIdentity: {
+            presets() {
+                return request({ method: 'GET', path: '/v1/workload_identity/presets' });
+            },
+            cloudTrust(query) {
+                const qs = new URLSearchParams(query).toString();
+                return request({ method: 'GET', path: `/v1/workload_identity/cloud_trust?${qs}` });
+            },
+        },
         grants: {
             list(clientId) {
                 return request({ method: 'GET', path: `/v1/oauth_clients/${(0, request_1.enc)(clientId)}/grants` });

package/dist/client/oauth-clients.js.map

@@ -1 +1 @@
-{"version":3,"file":"oauth-clients.js","sourceRoot":"","sources":["../../src/client/oauth-clients.ts"],"names":[],"mappings":";;AAoRA,oDAgGC;AApXD,6CAAyH;AACzH,uCAAgD;AAmRhD,SAAgB,oBAAoB,CAAC,OAAkB;IACrD,OAAO;QACL,qFAAqF;QACrF,MAAM,CACJ,IAA2C,EAC3C,cAAuB;YAEvB,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,0BAA0B,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC;QAC7F,CAAC;QACD,wEAAwE;QACxE,IAAI,CAAC,SAA8C,EAAE;YACnD,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,mBAAmB,EAAE,KAAK,EAAE,IAAA,0BAAa,EAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;QACtG,CAAC;QACD,GAAG,CAAC,EAAU;YACZ,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,qBAAqB,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;QAC1E,CAAC;QACD,MAAM,CAAC,IAA2B,EAAE,cAAuB;YACzD,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,mBAAmB,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC;QACtF,CAAC;QACD,MAAM,CAAC,EAAU,EAAE,IAA2B;YAC5C,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,qBAAqB,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;QAClF,CAAC;QACD;;;WAGG;QACH,YAAY,CACV,EAAU,EACV,OAAoC,EAAE,EACtC,cAAuB;YAEvB,OAAO,OAAO,CAAC;gBACb,MAAM,EAAE,MAAM;gBACd,IAAI,EAAE,qBAAqB,IAAA,aAAG,EAAC,EAAE,CAAC,gBAAgB;gBAClD,IAAI;gBACJ,cAAc;aACf,CAAC,CAAC;QACL,CAAC;QACD,MAAM,CAAC,EAAU;YACf,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,qBAAqB,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;QAC7E,CAAC;QACD,mEAAmE;QACnE,yBAAyB,CACvB,EAAU,EACV,QAAoC,EAAE;YAEtC,OAAO,OAAO,CAAC;gBACb,MAAM,EAAE,KAAK;gBACb,IAAI,EAAE,qBAAqB,IAAA,aAAG,EAAC,EAAE,CAAC,yBAAyB;gBAC3D,KAAK,EAAE,EAAE,GAAG,KAAK,EAAE;aACpB,CAAC,CAAC;QACL,CAAC;QACD,iFAAiF;QACjF,qBAAqB,CAAC,EAAU;YAC9B,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,qBAAqB,IAAA,aAAG,EAAC,EAAE,CAAC,0BAA0B,EAAE,CAAC,CAAC;QACnG,CAAC;QAED,yEAAyE;QACzE,mBAAmB,EAAE;YACnB,IAAI;gBACF,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,iCAAiC,EAAE,CAAC,CAAC;YAC7E,CAAC;YACD,4CAA4C;YAC5C,MAAM,CAAC,OAAqC,EAAE;gBAC5C,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,iCAAiC,EAAE,IAAI,EAAE,CAAC,CAAC;YACpF,CAAC;YACD,MAAM,CAAC,EAAU;gBACf,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,mCAAmC,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;YAC3F,CAAC;SACF;QAED,MAAM,EAAE;YACN,IAAI,CAAC,QAAgB;gBACnB,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,qBAAqB,IAAA,aAAG,EAAC,QAAQ,CAAC,SAAS,EAAE,CAAC,CAAC;YACvF,CAAC;YACD,MAAM,CACJ,QAAgB,EAChB,IAAuD;gBAEvD,OAAO,OAAO,CAAC;oBACb,MAAM,EAAE,MAAM;oBACd,IAAI,EAAE,qBAAqB,IAAA,aAAG,EAAC,QAAQ,CAAC,SAAS;oBACjD,IAAI;iBACL,CAAC,CAAC;YACL,CAAC;YACD,MAAM,CACJ,QAAgB,EAChB,OAAe;gBAEf,OAAO,OAAO,CAAC;oBACb,MAAM,EAAE,QAAQ;oBAChB,IAAI,EAAE,qBAAqB,IAAA,aAAG,EAAC,QAAQ,CAAC,WAAW,IAAA,aAAG,EAAC,OAAO,CAAC,EAAE;iBAClE,CAAC,CAAC;YACL,CAAC;SACF;KACF,CAAC;AACJ,CAAC"}
+{"version":3,"file":"oauth-clients.js","sourceRoot":"","sources":["../../src/client/oauth-clients.ts"],"names":[],"mappings":";;AA+TA,oDAyKC;AAxeD,6CAAyH;AACzH,uCAAgD;AA8ThD,SAAgB,oBAAoB,CAAC,OAAkB;IACrD,OAAO;QACL,qFAAqF;QACrF,MAAM,CACJ,IAA2C,EAC3C,cAAuB;YAEvB,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,0BAA0B,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC;QAC7F,CAAC;QACD,wEAAwE;QACxE,IAAI,CAAC,SAA8C,EAAE;YACnD,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,mBAAmB,EAAE,KAAK,EAAE,IAAA,0BAAa,EAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;QACtG,CAAC;QACD,GAAG,CAAC,EAAU;YACZ,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,qBAAqB,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;QAC1E,CAAC;QACD,MAAM,CAAC,IAA2B,EAAE,cAAuB;YACzD,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,mBAAmB,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC;QACtF,CAAC;QACD,MAAM,CAAC,EAAU,EAAE,IAA2B;YAC5C,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,qBAAqB,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;QAClF,CAAC;QACD;;;WAGG;QACH,YAAY,CACV,EAAU,EACV,OAAoC,EAAE,EACtC,cAAuB;YAEvB,OAAO,OAAO,CAAC;gBACb,MAAM,EAAE,MAAM;gBACd,IAAI,EAAE,qBAAqB,IAAA,aAAG,EAAC,EAAE,CAAC,gBAAgB;gBAClD,IAAI;gBACJ,cAAc;aACf,CAAC,CAAC;QACL,CAAC;QACD,MAAM,CAAC,EAAU;YACf,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,qBAAqB,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;QAC7E,CAAC;QACD;;;WAGG;QACH,WAAW,EAAE;YACX,+CAA+C;YAC/C,GAAG,CAAC,EAAU;gBACZ,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,qBAAqB,IAAA,aAAG,EAAC,EAAE,CAAC,eAAe,EAAE,CAAC,CAAC;YACvF,CAAC;YACD,qGAAqG;YACrG,MAAM,CAAC,EAAU,EAAE,IAAiC;gBAClD,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,qBAAqB,IAAA,aAAG,EAAC,EAAE,CAAC,eAAe,EAAE,IAAI,EAAE,CAAC,CAAC;YAC/F,CAAC;SACF;QACD,mEAAmE;QACnE,yBAAyB,CACvB,EAAU,EACV,QAAoC,EAAE;YAEtC,OAAO,OAAO,CAAC;gBACb,MAAM,EAAE,KAAK;gBACb,IAAI,EAAE,qBAAqB,IAAA,aAAG,EAAC,EAAE,CAAC,yBAAyB;gBAC3D,KAAK,EAAE,EAAE,GAAG,KAAK,EAAE;aACpB,CAAC,CAAC;QACL,CAAC;QACD,iFAAiF;QACjF,qBAAqB,CAAC,EAAU;YAC9B,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,qBAAqB,IAAA,aAAG,EAAC,EAAE,CAAC,0BAA0B,EAAE,CAAC,CAAC;QACnG,CAAC;QAED,4FAA4F;QAC5F,cAAc,CACZ,EAAU,EACV,IAAgE;YAEhE,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,qBAAqB,IAAA,aAAG,EAAC,EAAE,CAAC,eAAe,EAAE,IAAI,EAAE,CAAC,CAAC;QAC7F,CAAC;QACD,gGAAgG;QAChG,aAAa,EAAE;YACb,GAAG,CAAC,cAAsB;gBACxB,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,0BAA0B,EAAE,KAAK,EAAE,EAAE,eAAe,EAAE,cAAc,EAAE,EAAE,CAAC,CAAC;YAClH,CAAC;YACD,MAAM,CACJ,cAAsB,EACtB,IAA2E;gBAE3E,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,iCAAiC,EAAE,KAAK,EAAE,EAAE,eAAe,EAAE,cAAc,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;YAC/H,CAAC;YACD,MAAM,CAAC,cAAsB,EAAE,OAAwB,EAAE;gBACvD,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,iCAAiC,EAAE,KAAK,EAAE,EAAE,eAAe,EAAE,cAAc,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;YAC/H,CAAC;SACF;QACD,oGAAoG;QACpG,eAAe,EAAE;YACf,GAAG,CAAC,gBAAwB;gBAC1B,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,4BAA4B,EAAE,KAAK,EAAE,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,EAAE,CAAC,CAAC;YACxH,CAAC;YACD,MAAM,CAAC,gBAAwB,EAAE,OAAuD,EAAE;gBACxF,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,mCAAmC,EAAE,KAAK,EAAE,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;YACrI,CAAC;YACD,MAAM,CAAC,gBAAwB,EAAE,OAAwB,EAAE;gBACzD,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,mCAAmC,EAAE,KAAK,EAAE,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;YACrI,CAAC;SACF;QAED,yEAAyE;QACzE,mBAAmB,EAAE;YACnB,IAAI;gBACF,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,iCAAiC,EAAE,CAAC,CAAC;YAC7E,CAAC;YACD,4CAA4C;YAC5C,MAAM,CAAC,OAAqC,EAAE;gBAC5C,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,iCAAiC,EAAE,IAAI,EAAE,CAAC,CAAC;YACpF,CAAC;YACD,MAAM,CAAC,EAAU;gBACf,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,mCAAmC,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;YAC3F,CAAC;SACF;QAED,6FAA6F;QAC7F,cAAc,EAAE;YACd,IAAI,CAAC,QAAgB;gBACnB,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,qBAAqB,IAAA,aAAG,EAAC,QAAQ,CAAC,kBAAkB,EAAE,CAAC,CAAC;YAChG,CAAC;YACD,MAAM,CAAC,QAAgB,EAAE,IAAwB;gBAC/C,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,qBAAqB,IAAA,aAAG,EAAC,QAAQ,CAAC,kBAAkB,EAAE,IAAI,EAAE,CAAC,CAAC;YACvG,CAAC;YACD,MAAM,CAAC,QAAgB,EAAE,QAAgB;gBACvC,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,qBAAqB,IAAA,aAAG,EAAC,QAAQ,CAAC,oBAAoB,IAAA,aAAG,EAAC,QAAQ,CAAC,EAAE,EAAE,CAAC,CAAC;YACpH,CAAC;SACF;QAED,6FAA6F;QAC7F,gBAAgB,EAAE;YAChB,OAAO;gBACL,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,+BAA+B,EAAE,CAAC,CAAC;YAC3E,CAAC;YACD,UAAU,CAAC,KAAmG;gBAC5G,MAAM,EAAE,GAAG,IAAI,eAAe,CAAC,KAA+B,CAAC,CAAC,QAAQ,EAAE,CAAC;gBAC3E,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,qCAAqC,EAAE,EAAE,EAAE,CAAC,CAAC;YACrF,CAAC;SACF;QAED,MAAM,EAAE;YACN,IAAI,CAAC,QAAgB;gBACnB,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,qBAAqB,IAAA,aAAG,EAAC,QAAQ,CAAC,SAAS,EAAE,CAAC,CAAC;YACvF,CAAC;YACD,MAAM,CACJ,QAAgB,EAChB,IAAuD;gBAEvD,OAAO,OAAO,CAAC;oBACb,MAAM,EAAE,MAAM;oBACd,IAAI,EAAE,qBAAqB,IAAA,aAAG,EAAC,QAAQ,CAAC,SAAS;oBACjD,IAAI;iBACL,CAAC,CAAC;YACL,CAAC;YACD,MAAM,CACJ,QAAgB,EAChB,OAAe;gBAEf,OAAO,OAAO,CAAC;oBACb,MAAM,EAAE,QAAQ;oBAChB,IAAI,EAAE,qBAAqB,IAAA,aAAG,EAAC,QAAQ,CAAC,WAAW,IAAA,aAAG,EAAC,OAAO,CAAC,EAAE;iBAClE,CAAC,CAAC;YACL,CAAC;SACF;KACF,CAAC;AACJ,CAAC"}

package/dist/client/openfga.d.ts

@@ -16,6 +16,17 @@ export interface OpenFgaTupleKey {
     user: string;
     relation: string;
     object: string;
+    /** A model condition the tuple is bound to. */
+    condition?: {
+        name: string;
+        context?: Record<string, unknown>;
+    };
+}
+/** OpenFGA's `consistency` enum plus Atlas's consistency token (see ListUsers/Check docs). */
+export interface OpenFgaConsistencyOptions {
+    consistency?: 'UNSPECIFIED' | 'MINIMIZE_LATENCY' | 'HIGHER_CONSISTENCY';
+    /** A token from a write; the read reflects at least that write. Also sent as the `Atlas-Consistency-Token` header. */
+    consistency_token?: string;
 }
 /** Contextual tuples: either the OpenFGA `{ tuple_keys }` wrapper or a bare array. */
 export type OpenFgaContextualTuples = {
@@ -38,18 +49,21 @@ export interface WriteOpenFgaModelBody {
     dsl?: string;
     [key: string]: unknown;
 }
-export interface OpenFgaCheckBody {
+export interface OpenFgaCheckBody extends OpenFgaConsistencyOptions {
     tuple_key: OpenFgaTupleKey;
     authorization_model_id?: string;
     contextual_tuples?: OpenFgaContextualTuples;
+    /** Values for condition parameters. */
+    context?: Record<string, unknown>;
 }
 export interface OpenFgaBatchCheckItem {
     tuple_key: OpenFgaTupleKey;
     /** Keys the result; defaults to the item's index. */
     correlation_id?: string;
     contextual_tuples?: OpenFgaContextualTuples;
+    context?: Record<string, unknown>;
 }
-export interface OpenFgaBatchCheckBody {
+export interface OpenFgaBatchCheckBody extends OpenFgaConsistencyOptions {
     /** 1–100 checks. */
     checks: OpenFgaBatchCheckItem[];
     authorization_model_id?: string;
@@ -61,13 +75,74 @@ export interface OpenFgaExpandBody {
     };
     authorization_model_id?: string;
 }
-export interface OpenFgaListObjectsBody {
+export interface OpenFgaListObjectsBody extends OpenFgaConsistencyOptions {
     /** Object type, e.g. `document`. */
     type: string;
     relation: string;
     user: string;
     authorization_model_id?: string;
     contextual_tuples?: OpenFgaContextualTuples;
+    context?: Record<string, unknown>;
+}
+export interface OpenFgaListUsersBody extends OpenFgaConsistencyOptions {
+    object: {
+        type: string;
+        id: string;
+    };
+    relation: string;
+    /** Exactly one filter; add `relation` to get usersets. */
+    user_filters: [{
+        type: string;
+        relation?: string;
+    }];
+    authorization_model_id?: string;
+    contextual_tuples?: OpenFgaContextualTuples;
+    context?: Record<string, unknown>;
+    /** Atlas extension: 1–1000, default 1000. */
+    page_size?: number;
+    /** Atlas extension: the previous page's `continuation_token`. */
+    continuation_token?: string;
+}
+/** One listed user: a person/thing, a userset, or the public wildcard. */
+export type OpenFgaListedUser = {
+    object: {
+        type: string;
+        id: string;
+    };
+} | {
+    userset: {
+        type: string;
+        id: string;
+        relation: string;
+    };
+} | {
+    wildcard: {
+        type: string;
+    };
+};
+export interface OpenFgaListUsersResult {
+    users: OpenFgaListedUser[];
+    excluded_users: Array<{
+        object: {
+            type: string;
+            id: string;
+        };
+    }>;
+    /** Empty on the last page. */
+    continuation_token: string;
+}
+export interface OpenFgaReadChangesParams {
+    type?: string;
+    /** 1–100, default 50. */
+    page_size?: number;
+    continuation_token?: string;
+    /** RFC 3339. */
+    start_time?: string;
+}
+export interface OpenFgaTupleChange {
+    tuple_key: OpenFgaTupleKey;
+    operation: 'TUPLE_OPERATION_WRITE' | 'TUPLE_OPERATION_DELETE';
+    timestamp: string;
 }
 export interface OpenFgaReadBody {
     /** Optional filter; `object` may be a full `type:id` or a bare `type:` prefix. */
@@ -128,6 +203,18 @@ export declare function openfgaResource(request: RequestFn): {
     listObjects(store: string, body: OpenFgaListObjectsBody): Promise<{
         objects: string[];
     }>;
+    /**
+     * Who has `relation` on `object` (OpenFGA ListUsers): users, usersets and the
+     * wildcard with `excluded_users`. One page — see {@link listAllUsers}.
+     */
+    listUsers(store: string, body: OpenFgaListUsersBody): Promise<OpenFgaListUsersResult>;
+    /** {@link listUsers} following `continuation_token` until every page is collected. */
+    listAllUsers(store: string, body: OpenFgaListUsersBody): Promise<OpenFgaListUsersResult>;
+    /** The tuple change log (OpenFGA ReadChanges); the token also resumes after the last page. */
+    readChanges(store: string, params?: OpenFgaReadChangesParams): Promise<{
+        changes: OpenFgaTupleChange[];
+        continuation_token: string;
+    }>;
     read(store: string, body?: OpenFgaReadBody): Promise<{
         tuples: OpenFgaTuple[];
         continuation_token: string;

package/dist/client/openfga.js

@@ -3,7 +3,7 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.openfgaResource = openfgaResource;
 const request_1 = require("./request");
 function openfgaResource(request) {
-    return {
+    const api = {
         stores: {
             list() {
                 return request({ method: 'GET', path: '/v1/openfga/stores' });
@@ -60,6 +60,31 @@ function openfgaResource(request) {
                 body,
             });
         },
+        /**
+         * Who has `relation` on `object` (OpenFGA ListUsers): users, usersets and the
+         * wildcard with `excluded_users`. One page — see {@link listAllUsers}.
+         */
+        listUsers(store, body) {
+            return request({ method: 'POST', path: `/v1/openfga/stores/${(0, request_1.enc)(store)}/list-users`, body });
+        },
+        /** {@link listUsers} following `continuation_token` until every page is collected. */
+        async listAllUsers(store, body) {
+            let page = await api.listUsers(store, body);
+            const users = [...page.users];
+            while (page.continuation_token) {
+                page = await api.listUsers(store, { ...body, continuation_token: page.continuation_token });
+                users.push(...page.users);
+            }
+            return { ...page, users };
+        },
+        /** The tuple change log (OpenFGA ReadChanges); the token also resumes after the last page. */
+        readChanges(store, params = {}) {
+            return request({
+                method: 'GET',
+                path: `/v1/openfga/stores/${(0, request_1.enc)(store)}/changes`,
+                query: { ...params },
+            });
+        },
         read(store, body = {}) {
             return request({ method: 'POST', path: `/v1/openfga/stores/${(0, request_1.enc)(store)}/read`, body });
         },
@@ -68,5 +93,6 @@ function openfgaResource(request) {
             return request({ method: 'POST', path: `/v1/openfga/stores/${(0, request_1.enc)(store)}/write`, body });
         },
     };
+    return api;
 }
 //# sourceMappingURL=openfga.js.map

package/dist/client/openfga.js.map

@@ -1 +1 @@
-{"version":3,"file":"openfga.js","sourceRoot":"","sources":["../../src/client/openfga.ts"],"names":[],"mappings":";;AA+FA,0CA8EC;AA7KD,uCAAgD;AA+FhD,SAAgB,eAAe,CAAC,OAAkB;IAChD,OAAO;QACL,MAAM,EAAE;YACN,IAAI;gBACF,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,oBAAoB,EAAE,CAAC,CAAC;YAChE,CAAC;YACD,MAAM,CAAC,IAAsB,EAAE,cAAuB;gBACpD,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,oBAAoB,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC;YACvF,CAAC;YACD,GAAG,CAAC,KAAa;gBACf,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,sBAAsB,IAAA,aAAG,EAAC,KAAK,CAAC,EAAE,EAAE,CAAC,CAAC;YAC9E,CAAC;SACF;QACD,mBAAmB,EAAE;YACnB,IAAI,CAAC,KAAa;gBAChB,OAAO,OAAO,CAAC;oBACb,MAAM,EAAE,KAAK;oBACb,IAAI,EAAE,sBAAsB,IAAA,aAAG,EAAC,KAAK,CAAC,uBAAuB;iBAC9D,CAAC,CAAC;YACL,CAAC;YACD,mEAAmE;YACnE,KAAK,CAAC,KAAa,EAAE,IAA2B;gBAC9C,OAAO,OAAO,CAAC;oBACb,MAAM,EAAE,MAAM;oBACd,IAAI,EAAE,sBAAsB,IAAA,aAAG,EAAC,KAAK,CAAC,uBAAuB;oBAC7D,IAAI;iBACL,CAAC,CAAC;YACL,CAAC;YACD,GAAG,CACD,KAAa,EACb,OAAe;gBAEf,OAAO,OAAO,CAAC;oBACb,MAAM,EAAE,KAAK;oBACb,IAAI,EAAE,sBAAsB,IAAA,aAAG,EAAC,KAAK,CAAC,yBAAyB,IAAA,aAAG,EAAC,OAAO,CAAC,EAAE;iBAC9E,CAAC,CAAC;YACL,CAAC;SACF;QACD,KAAK,CAAC,KAAa,EAAE,IAAsB;YACzC,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,sBAAsB,IAAA,aAAG,EAAC,KAAK,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC;QAC3F,CAAC;QACD,qEAAqE;QACrE,UAAU,CACR,KAAa,EACb,IAA2B;YAE3B,OAAO,OAAO,CAAC;gBACb,MAAM,EAAE,MAAM;gBACd,IAAI,EAAE,sBAAsB,IAAA,aAAG,EAAC,KAAK,CAAC,cAAc;gBACpD,IAAI;aACL,CAAC,CAAC;QACL,CAAC;QACD,4EAA4E;QAC5E,MAAM,CACJ,KAAa,EACb,IAAuB;YAEvB,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,sBAAsB,IAAA,aAAG,EAAC,KAAK,CAAC,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAC5F,CAAC;QACD,gEAAgE;QAChE,WAAW,CAAC,KAAa,EAAE,IAA4B;YACrD,OAAO,OAAO,CAAC;gBACb,MAAM,EAAE,MAAM;gBACd,IAAI,EAAE,sBAAsB,IAAA,aAAG,EAAC,KAAK,CAAC,eAAe;gBACrD,IAAI;aACL,CAAC,CAAC;QACL,CAAC;QACD,IAAI,CACF,KAAa,EACb,OAAwB,EAAE;YAE1B,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,sBAAsB,IAAA,aAAG,EAAC,KAAK,CAAC,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;QAC1F,CAAC;QACD,uDAAuD;QACvD,KAAK,CAAC,KAAa,EAAE,IAAsB;YACzC,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,sBAAsB,IAAA,aAAG,EAAC,KAAK,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC;QAC3F,CAAC;KACF,CAAC;AACJ,CAAC"}
+{"version":3,"file":"openfga.js","sourceRoot":"","sources":["../../src/client/openfga.ts"],"names":[],"mappings":";;AAsJA,0CA2GC;AAjQD,uCAAgD;AAsJhD,SAAgB,eAAe,CAAC,OAAkB;IAChD,MAAM,GAAG,GAAG;QACV,MAAM,EAAE;YACN,IAAI;gBACF,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,oBAAoB,EAAE,CAAC,CAAC;YAChE,CAAC;YACD,MAAM,CAAC,IAAsB,EAAE,cAAuB;gBACpD,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,oBAAoB,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC;YACvF,CAAC;YACD,GAAG,CAAC,KAAa;gBACf,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,sBAAsB,IAAA,aAAG,EAAC,KAAK,CAAC,EAAE,EAAE,CAAC,CAAC;YAC9E,CAAC;SACF;QACD,mBAAmB,EAAE;YACnB,IAAI,CAAC,KAAa;gBAChB,OAAO,OAAO,CAAC;oBACb,MAAM,EAAE,KAAK;oBACb,IAAI,EAAE,sBAAsB,IAAA,aAAG,EAAC,KAAK,CAAC,uBAAuB;iBAC9D,CAAC,CAAC;YACL,CAAC;YACD,mEAAmE;YACnE,KAAK,CAAC,KAAa,EAAE,IAA2B;gBAC9C,OAAO,OAAO,CAAC;oBACb,MAAM,EAAE,MAAM;oBACd,IAAI,EAAE,sBAAsB,IAAA,aAAG,EAAC,KAAK,CAAC,uBAAuB;oBAC7D,IAAI;iBACL,CAAC,CAAC;YACL,CAAC;YACD,GAAG,CACD,KAAa,EACb,OAAe;gBAEf,OAAO,OAAO,CAAC;oBACb,MAAM,EAAE,KAAK;oBACb,IAAI,EAAE,sBAAsB,IAAA,aAAG,EAAC,KAAK,CAAC,yBAAyB,IAAA,aAAG,EAAC,OAAO,CAAC,EAAE;iBAC9E,CAAC,CAAC;YACL,CAAC;SACF;QACD,KAAK,CAAC,KAAa,EAAE,IAAsB;YACzC,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,sBAAsB,IAAA,aAAG,EAAC,KAAK,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC;QAC3F,CAAC;QACD,qEAAqE;QACrE,UAAU,CACR,KAAa,EACb,IAA2B;YAE3B,OAAO,OAAO,CAAC;gBACb,MAAM,EAAE,MAAM;gBACd,IAAI,EAAE,sBAAsB,IAAA,aAAG,EAAC,KAAK,CAAC,cAAc;gBACpD,IAAI;aACL,CAAC,CAAC;QACL,CAAC;QACD,4EAA4E;QAC5E,MAAM,CACJ,KAAa,EACb,IAAuB;YAEvB,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,sBAAsB,IAAA,aAAG,EAAC,KAAK,CAAC,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAC5F,CAAC;QACD,gEAAgE;QAChE,WAAW,CAAC,KAAa,EAAE,IAA4B;YACrD,OAAO,OAAO,CAAC;gBACb,MAAM,EAAE,MAAM;gBACd,IAAI,EAAE,sBAAsB,IAAA,aAAG,EAAC,KAAK,CAAC,eAAe;gBACrD,IAAI;aACL,CAAC,CAAC;QACL,CAAC;QACD;;;WAGG;QACH,SAAS,CAAC,KAAa,EAAE,IAA0B;YACjD,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,sBAAsB,IAAA,aAAG,EAAC,KAAK,CAAC,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC;QAChG,CAAC;QACD,sFAAsF;QACtF,KAAK,CAAC,YAAY,CAAC,KAAa,EAAE,IAA0B;YAC1D,IAAI,IAAI,GAAG,MAAM,GAAG,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;YAC5C,MAAM,KAAK,GAAG,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC;YAC9B,OAAO,IAAI,CAAC,kBAAkB,EAAE,CAAC;gBAC/B,IAAI,GAAG,MAAM,GAAG,CAAC,SAAS,CAAC,KAAK,EAAE,EAAE,GAAG,IAAI,EAAE,kBAAkB,EAAE,IAAI,CAAC,kBAAkB,EAAE,CAAC,CAAC;gBAC5F,KAAK,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC;YAC5B,CAAC;YACD,OAAO,EAAE,GAAG,IAAI,EAAE,KAAK,EAAE,CAAC;QAC5B,CAAC;QACD,8FAA8F;QAC9F,WAAW,CACT,KAAa,EACb,SAAmC,EAAE;YAErC,OAAO,OAAO,CAAC;gBACb,MAAM,EAAE,KAAK;gBACb,IAAI,EAAE,sBAAsB,IAAA,aAAG,EAAC,KAAK,CAAC,UAAU;gBAChD,KAAK,EAAE,EAAE,GAAG,MAAM,EAAE;aACrB,CAAC,CAAC;QACL,CAAC;QACD,IAAI,CACF,KAAa,EACb,OAAwB,EAAE;YAE1B,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,sBAAsB,IAAA,aAAG,EAAC,KAAK,CAAC,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;QAC1F,CAAC;QACD,uDAAuD;QACvD,KAAK,CAAC,KAAa,EAAE,IAAsB;YACzC,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,sBAAsB,IAAA,aAAG,EAAC,KAAK,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC;QAC3F,CAAC;KACF,CAAC;IACF,OAAO,GAAG,CAAC;AACb,CAAC"}