@atlasauth/backend 0.24.0 → 0.26.0

package/dist/client/resources.d.ts

@@ -0,0 +1,150 @@
+import { type RequestFn } from './request';
+import type { ListPage } from './types';
+export interface ResourceRoleDef {
+    key: string;
+    name?: string;
+    /** `*` grants every permission. */
+    permissions: string[];
+    /** Other roles of the same type this role also grants. */
+    includes?: string[];
+}
+export interface ResourceType {
+    object: 'resource_type';
+    key: string;
+    name: string;
+    description: string | null;
+    parent_type: string | null;
+    inherit: boolean;
+    roles: ResourceRoleDef[];
+    created_at: number;
+    updated_at: number;
+}
+export interface CreateResourceTypeBody {
+    key: string;
+    name?: string;
+    description?: string | null;
+    /** The type a resource of this type nests under. */
+    parent_type?: string | null;
+    /** Whether assignments on a parent flow down (default true). */
+    inherit?: boolean;
+    roles: ResourceRoleDef[];
+}
+export interface Resource {
+    object: 'resource';
+    id: string;
+    type: string;
+    external_id: string;
+    name: string | null;
+    parent_id: string | null;
+    metadata: Record<string, unknown>;
+    created_at: number;
+    updated_at: number;
+}
+/** A reference to a resource: Atlas `id`, or your own `type` + `external_id`. */
+export type ResourceRef = {
+    id: string;
+} | {
+    type: string;
+    external_id: string;
+};
+export interface UpsertResourceBody {
+    type: string;
+    external_id: string;
+    name?: string | null;
+    /** The parent resource, or null for a root. */
+    parent?: ResourceRef | null;
+    metadata?: Record<string, unknown>;
+}
+export type ResourceSubject = {
+    type: 'user' | 'group' | 'org';
+    id: string;
+};
+export interface ResourceRoleAssignment {
+    object: 'resource_role_assignment';
+    id: string;
+    resource_id: string;
+    subject: ResourceSubject;
+    role: string;
+    inherit: boolean;
+    created_at: number;
+}
+export interface ResourceCheckBody {
+    subject: ResourceSubject;
+    permission: string;
+    resource: ResourceRef;
+    /** Extra group ids the subject belongs to (a user's organizations are added automatically). */
+    groups?: string[];
+}
+export interface ResourceCheck {
+    object: 'resource_check';
+    allowed: boolean;
+    resource_id: string;
+    grants?: Array<{
+        resource_id: string;
+        role: string;
+        subject: string;
+        inherited: boolean;
+    }>;
+}
+/** Resource-scoped RBAC: resource types, the resource tree, role assignments on resources, and permission checks. */
+export declare function resourcesResource(request: RequestFn): {
+    types: {
+        list(): Promise<ListPage<ResourceType>>;
+        get(key: string): Promise<ResourceType>;
+        create(body: CreateResourceTypeBody, idempotencyKey?: string): Promise<ResourceType>;
+        update(key: string, body: Partial<Omit<CreateResourceTypeBody, "key">>): Promise<ResourceType>;
+        delete(key: string): Promise<{
+            object: "resource_type";
+            key: string;
+            deleted: true;
+        }>;
+    };
+    list(query?: {
+        type?: string;
+        parent_id?: string;
+        limit?: number;
+    }): Promise<ListPage<Resource>>;
+    get(id: string): Promise<Resource>;
+    /** Create or update one resource by (type, external_id). */
+    upsert(body: UpsertResourceBody): Promise<Resource>;
+    /** Discovery sync: upsert up to 500 resources in order (parents before children). */
+    sync(resources: UpsertResourceBody[]): Promise<ListPage<Resource>>;
+    delete(id: string): Promise<{
+        object: "resource";
+        id: string;
+        deleted: true;
+    }>;
+    assignments: {
+        list(query?: {
+            resource_id?: string;
+            subject_type?: string;
+            subject_id?: string;
+        }): Promise<ListPage<ResourceRoleAssignment>>;
+        /** Assign `role` on `resource` to a user, group or org. */
+        assign(body: {
+            resource: ResourceRef;
+            subject: ResourceSubject;
+            role: string;
+            inherit?: boolean;
+        }): Promise<ResourceRoleAssignment>;
+        revoke(id: string): Promise<{
+            object: "resource_role_assignment";
+            id: string;
+            deleted: true;
+        }>;
+    };
+    /** May `subject` hold `permission` on `resource`? */
+    check(body: ResourceCheckBody): Promise<ResourceCheck>;
+    /** Convenience: the boolean answer to {@link check}. */
+    can(body: ResourceCheckBody): Promise<boolean>;
+    checkBatch(checks: ResourceCheckBody[]): Promise<ListPage<ResourceCheck>>;
+    /** The resources (of an optional `type`) on which `subject` holds `permission`. */
+    accessible(body: {
+        subject: ResourceSubject;
+        permission: string;
+        type?: string;
+        groups?: string[];
+        limit?: number;
+        starting_after?: string;
+    }): Promise<ListPage<Resource>>;
+};

package/dist/client/resources.js

@@ -0,0 +1,73 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.resourcesResource = resourcesResource;
+const request_1 = require("./request");
+/** Resource-scoped RBAC: resource types, the resource tree, role assignments on resources, and permission checks. */
+function resourcesResource(request) {
+    return {
+        types: {
+            list() {
+                return request({ method: 'GET', path: '/v1/resource_types' });
+            },
+            get(key) {
+                return request({ method: 'GET', path: `/v1/resource_types/${(0, request_1.enc)(key)}` });
+            },
+            create(body, idempotencyKey) {
+                return request({ method: 'POST', path: '/v1/resource_types', body, idempotencyKey });
+            },
+            update(key, body) {
+                return request({ method: 'PATCH', path: `/v1/resource_types/${(0, request_1.enc)(key)}`, body });
+            },
+            delete(key) {
+                return request({ method: 'DELETE', path: `/v1/resource_types/${(0, request_1.enc)(key)}` });
+            },
+        },
+        list(query = {}) {
+            const q = new URLSearchParams(Object.entries(query).filter(([, v]) => v !== undefined).map(([k, v]) => [k, String(v)]));
+            return request({ method: 'GET', path: `/v1/resources${q.size ? `?${q}` : ''}` });
+        },
+        get(id) {
+            return request({ method: 'GET', path: `/v1/resources/${(0, request_1.enc)(id)}` });
+        },
+        /** Create or update one resource by (type, external_id). */
+        upsert(body) {
+            return request({ method: 'PUT', path: '/v1/resources', body });
+        },
+        /** Discovery sync: upsert up to 500 resources in order (parents before children). */
+        sync(resources) {
+            return request({ method: 'POST', path: '/v1/resources/sync', body: { resources } });
+        },
+        delete(id) {
+            return request({ method: 'DELETE', path: `/v1/resources/${(0, request_1.enc)(id)}` });
+        },
+        assignments: {
+            list(query = {}) {
+                const q = new URLSearchParams(Object.entries(query).filter(([, v]) => v !== undefined));
+                return request({ method: 'GET', path: `/v1/resource_role_assignments${q.size ? `?${q}` : ''}` });
+            },
+            /** Assign `role` on `resource` to a user, group or org. */
+            assign(body) {
+                return request({ method: 'POST', path: '/v1/resource_role_assignments', body });
+            },
+            revoke(id) {
+                return request({ method: 'DELETE', path: `/v1/resource_role_assignments/${(0, request_1.enc)(id)}` });
+            },
+        },
+        /** May `subject` hold `permission` on `resource`? */
+        check(body) {
+            return request({ method: 'POST', path: '/v1/resource_checks', body });
+        },
+        /** Convenience: the boolean answer to {@link check}. */
+        async can(body) {
+            return (await request({ method: 'POST', path: '/v1/resource_checks', body })).allowed;
+        },
+        checkBatch(checks) {
+            return request({ method: 'POST', path: '/v1/resource_checks/batch', body: { checks } });
+        },
+        /** The resources (of an optional `type`) on which `subject` holds `permission`. */
+        accessible(body) {
+            return request({ method: 'POST', path: '/v1/resource_checks/list', body });
+        },
+    };
+}
+//# sourceMappingURL=resources.js.map

package/dist/client/resources.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"resources.js","sourceRoot":"","sources":["../../src/client/resources.ts"],"names":[],"mappings":";;AAuFA,8CAkEC;AAzJD,uCAAgD;AAsFhD,qHAAqH;AACrH,SAAgB,iBAAiB,CAAC,OAAkB;IAClD,OAAO;QACL,KAAK,EAAE;YACL,IAAI;gBACF,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,oBAAoB,EAAE,CAAC,CAAC;YAChE,CAAC;YACD,GAAG,CAAC,GAAW;gBACb,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,sBAAsB,IAAA,aAAG,EAAC,GAAG,CAAC,EAAE,EAAE,CAAC,CAAC;YAC5E,CAAC;YACD,MAAM,CAAC,IAA4B,EAAE,cAAuB;gBAC1D,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,oBAAoB,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC;YACvF,CAAC;YACD,MAAM,CAAC,GAAW,EAAE,IAAkD;gBACpE,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,sBAAsB,IAAA,aAAG,EAAC,GAAG,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;YACpF,CAAC;YACD,MAAM,CAAC,GAAW;gBAChB,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,sBAAsB,IAAA,aAAG,EAAC,GAAG,CAAC,EAAE,EAAE,CAAC,CAAC;YAC/E,CAAC;SACF;QACD,IAAI,CAAC,QAA+D,EAAE;YACpE,MAAM,CAAC,GAAG,IAAI,eAAe,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,SAAS,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAoB,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YAC1I,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,gBAAgB,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;QACnF,CAAC;QACD,GAAG,CAAC,EAAU;YACZ,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,iBAAiB,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;QACtE,CAAC;QACD,4DAA4D;QAC5D,MAAM,CAAC,IAAwB;YAC7B,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,eAAe,EAAE,IAAI,EAAE,CAAC,CAAC;QACjE,CAAC;QACD,qFAAqF;QACrF,IAAI,CAAC,SAA+B;YAClC,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,oBAAoB,EAAE,IAAI,EAAE,EAAE,SAAS,EAAE,EAAE,CAAC,CAAC;QACtF,CAAC;QACD,MAAM,CAAC,EAAU;YACf,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,iBAAiB,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;QACzE,CAAC;QACD,WAAW,EAAE;YACX,IAAI,CAAC,QAA8E,EAAE;gBACnF,MAAM,CAAC,GAAG,IAAI,eAAe,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,SAAS,CAAuB,CAAC,CAAC;gBAC9G,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,gCAAgC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;YACnG,CAAC;YACD,2DAA2D;YAC3D,MAAM,CAAC,IAA0F;gBAC/F,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,+BAA+B,EAAE,IAAI,EAAE,CAAC,CAAC;YAClF,CAAC;YACD,MAAM,CAAC,EAAU;gBACf,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,iCAAiC,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;YACzF,CAAC;SACF;QACD,qDAAqD;QACrD,KAAK,CAAC,IAAuB;YAC3B,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,qBAAqB,EAAE,IAAI,EAAE,CAAC,CAAC;QACxE,CAAC;QACD,wDAAwD;QACxD,KAAK,CAAC,GAAG,CAAC,IAAuB;YAC/B,OAAO,CAAC,MAAM,OAAO,CAAgB,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,qBAAqB,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC;QACvG,CAAC;QACD,UAAU,CAAC,MAA2B;YACpC,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,2BAA2B,EAAE,IAAI,EAAE,EAAE,MAAM,EAAE,EAAE,CAAC,CAAC;QAC1F,CAAC;QACD,mFAAmF;QACnF,UAAU,CAAC,IAAiI;YAC1I,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,0BAA0B,EAAE,IAAI,EAAE,CAAC,CAAC;QAC7E,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/client/risk-based-mfa.d.ts

@@ -3,6 +3,14 @@ import { type RequestFn } from './request';
 export type RiskLevel = 'low' | 'medium' | 'high';
 /** What to do at high risk when the user has NO enrolled factor. */
 export type OnHighRiskNoFactor = 'allow' | 'block' | 'require_enroll';
+/** `audit` scores and records every sign-in but never changes the outcome. */
+export type RiskMode = 'enforce' | 'audit';
+/** What a risk level does; `default` keeps the step-up threshold behaviour. */
+export type RiskLevelAction = 'default' | 'allow' | 'notify' | 'mfa' | 'block';
+export interface RiskLevelActions {
+    medium: RiskLevelAction;
+    high: RiskLevelAction;
+}
 /** Per-signal score weights that feed the risk total. */
 export interface RiskWeights {
     newDevice: number;
@@ -34,6 +42,78 @@ export interface RiskBasedMfa {
     on_high_risk_no_factor: OnHighRiskNoFactor;
     weights: RiskWeights;
     signals: RiskSignalToggles;
+    mode: RiskMode;
+    level_actions: RiskLevelActions;
+    reputation: RiskReputation;
+    fraud: FraudConfig;
+    /** Per-user baseline: unusual sign-in hour or never-seen country adds `weight` points each. */
+    baseline: {
+        enabled: boolean;
+        weight: number;
+    };
+    /** Re-evaluate a session when it refreshes from a different network. */
+    mid_session: {
+        enabled: boolean;
+        action: 'revoke' | 'notify' | 'audit';
+    };
+}
+export type FraudAction = 'allow' | 'challenge' | 'block';
+export interface FraudRule {
+    id: string;
+    name: string;
+    enabled: boolean;
+    action: FraudAction;
+    /** Reason code returned when the rule matches. */
+    reason: string;
+    /** All conditions must hold. */
+    conditions: Array<{
+        field: 'country' | 'asn' | 'datacenter' | 'anonymizer' | 'headless' | 'automation' | 'client_class' | 'bot_score' | 'email_disposable' | 'ip_velocity' | 'device_velocity' | 'email_velocity';
+        op: 'eq' | 'neq' | 'gt' | 'gte' | 'lt' | 'lte' | 'in' | 'nin';
+        value: string | number | boolean | Array<string | number>;
+    }>;
+}
+export interface FraudConfig {
+    /** Two-letter country codes that are always blocked. */
+    sanctioned_countries: string[];
+    rules: FraudRule[];
+    /** Cap on lookups per device per hour; adaptive halves it for bot-like, datacenter or anonymized clients. */
+    device_rate_limit?: {
+        enabled: boolean;
+        per_hour: number;
+        adaptive: boolean;
+    };
+}
+export interface FraudLookupBody {
+    ip: string;
+    user_agent?: string;
+    /** The stable id from the JS SDK. */
+    device_id?: string;
+    email?: string;
+    /** A user of this instance, for user_age_days / user_mfa_enabled / user_banned rules. */
+    user_id?: string;
+    /** The organization the action is for, for org_id rules. */
+    org_id?: string;
+    /** Device features reported by the SDK (see the telemetry beacon). */
+    device?: Record<string, unknown>;
+}
+export interface FraudLookup {
+    object: 'fraud_lookup';
+    verdict: FraudAction;
+    reasons: string[];
+    matched_rules: string[];
+    device_id: string | null;
+    signals: Record<string, string | number | boolean | null>;
+}
+/** External IP-reputation / email-risk feeds (bring your own provider key). */
+export interface RiskReputation {
+    provider: 'none' | 'ipqs' | 'spur' | 'minfraud';
+    /** Score points added when the IP is flagged. */
+    ip_weight: number;
+    /** Provider fraud score (1-100) at or above which the IP is flagged. */
+    min_score: number;
+    flag_anonymizers: boolean;
+    email_checks: boolean;
+    email_weight: number;
 }
 export interface UpdateRiskBasedMfaBody {
     enabled?: boolean;
@@ -41,6 +121,40 @@ export interface UpdateRiskBasedMfaBody {
     on_high_risk_no_factor?: OnHighRiskNoFactor;
     weights?: Partial<RiskWeights>;
     signals?: Partial<RiskSignalToggles>;
+    mode?: RiskMode;
+    level_actions?: Partial<RiskLevelActions>;
+    reputation?: Partial<RiskReputation>;
+    fraud?: Partial<FraudConfig>;
+    baseline?: Partial<RiskBasedMfa['baseline']>;
+    mid_session?: Partial<RiskBasedMfa['mid_session']>;
+}
+/** One risk-scored sign-in on the audit / shadow-mode timeline. */
+export interface RiskEvent {
+    object: 'risk_event';
+    id: string;
+    user_id: string;
+    level: RiskLevel;
+    score: number;
+    /** Names of the signals that fired. */
+    signals: string[];
+    /** The action decided; in audit mode, what WOULD have happened. */
+    action: string;
+    mode: RiskMode;
+    ip: string | null;
+    feedback: 'legit' | 'fraud' | null;
+    feedback_at: string | null;
+    created_at: string;
+}
+export interface RiskEventMetrics {
+    object: 'risk_event_metrics';
+    days: number;
+    total: number;
+    buckets: Array<{
+        level: string;
+        action: string;
+        mode: string;
+        count: number;
+    }>;
 }
 /**
  * Read and tune the instance's adaptive-MFA engine — when a second factor is
@@ -51,4 +165,37 @@ export declare function riskBasedMfaResource(request: RequestFn): {
     get(): Promise<RiskBasedMfa>;
     /** Change any subset of the config; omitted fields are left unchanged. */
     update(body: UpdateRiskBasedMfaBody): Promise<RiskBasedMfa>;
+    /** Fraud decision (allow / challenge / block with reason codes) for a sign-up, sign-in or checkout. */
+    fraudLookup(body: FraudLookupBody): Promise<FraudLookup>;
+    /** Store the reputation provider's API key (write-only; minfraud: "<account id>:<license key>"). */
+    setReputationSecret(secret: string, provider?: "ipqs" | "spur" | "minfraud"): Promise<{
+        object: "risk_reputation_secret";
+        provider: string;
+        set: true;
+    }>;
+    /** Remove a stored reputation provider key (default: the configured provider). */
+    removeReputationSecret(provider?: "ipqs" | "spur" | "minfraud"): Promise<{
+        object: "risk_reputation_secret";
+        provider: string;
+        deleted: true;
+    }>;
+};
+/** The risk-event timeline, metrics and feedback. */
+export declare function riskEventsResource(request: RequestFn): {
+    /** Newest first. Page with `before` (the created_at of the last row). */
+    list(query?: {
+        user_id?: string;
+        level?: RiskLevel;
+        limit?: number;
+        before?: string;
+    }): Promise<{
+        object: "list";
+        data: RiskEvent[];
+    }>;
+    /** Counts per level / action / mode over the last `days`. */
+    metrics(query?: {
+        days?: number;
+    }): Promise<RiskEventMetrics>;
+    /** Mark a scored sign-in `legit` or `fraud`; the fired signals' weights move accordingly. */
+    feedback(id: string, verdict: "legit" | "fraud"): Promise<RiskEvent>;
 };

package/dist/client/risk-based-mfa.js

@@ -1,6 +1,7 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.riskBasedMfaResource = riskBasedMfaResource;
+exports.riskEventsResource = riskEventsResource;
 /**
  * Read and tune the instance's adaptive-MFA engine — when a second factor is
  * demanded, and how each risk signal is weighted.
@@ -15,6 +16,35 @@ function riskBasedMfaResource(request) {
         update(body) {
             return request({ method: 'PATCH', path: '/v1/risk_based_mfa', body });
         },
+        /** Fraud decision (allow / challenge / block with reason codes) for a sign-up, sign-in or checkout. */
+        fraudLookup(body) {
+            return request({ method: 'POST', path: '/v1/fraud/lookup', body });
+        },
+        /** Store the reputation provider's API key (write-only; minfraud: "<account id>:<license key>"). */
+        setReputationSecret(secret, provider) {
+            return request({ method: 'PUT', path: '/v1/risk_based_mfa/reputation_secret', body: { secret, provider } });
+        },
+        /** Remove a stored reputation provider key (default: the configured provider). */
+        removeReputationSecret(provider) {
+            return request({ method: 'DELETE', path: '/v1/risk_based_mfa/reputation_secret', query: { provider } });
+        },
+    };
+}
+/** The risk-event timeline, metrics and feedback. */
+function riskEventsResource(request) {
+    return {
+        /** Newest first. Page with `before` (the created_at of the last row). */
+        list(query = {}) {
+            return request({ method: 'GET', path: '/v1/risk_events', query });
+        },
+        /** Counts per level / action / mode over the last `days`. */
+        metrics(query = {}) {
+            return request({ method: 'GET', path: '/v1/risk_events/metrics', query });
+        },
+        /** Mark a scored sign-in `legit` or `fraud`; the fired signals' weights move accordingly. */
+        feedback(id, verdict) {
+            return request({ method: 'POST', path: `/v1/risk_events/${encodeURIComponent(id)}/feedback`, body: { verdict } });
+        },
     };
 }
 //# sourceMappingURL=risk-based-mfa.js.map

package/dist/client/risk-based-mfa.js.map

@@ -1 +1 @@
-{"version":3,"file":"risk-based-mfa.js","sourceRoot":"","sources":["../../src/client/risk-based-mfa.ts"],"names":[],"mappings":";;AAuDA,oDAWC;AAfD;;;GAGG;AACH,SAAgB,oBAAoB,CAAC,OAAkB;IACrD,OAAO;QACL,4CAA4C;QAC5C,GAAG;YACD,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,oBAAoB,EAAE,CAAC,CAAC;QAChE,CAAC;QACD,0EAA0E;QAC1E,MAAM,CAAC,IAA4B;YACjC,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,oBAAoB,EAAE,IAAI,EAAE,CAAC,CAAC;QACxE,CAAC;KACF,CAAC;AACJ,CAAC"}
+{"version":3,"file":"risk-based-mfa.js","sourceRoot":"","sources":["../../src/client/risk-based-mfa.ts"],"names":[],"mappings":";;AAqKA,oDAuBC;AAGD,gDAeC;AA7CD;;;GAGG;AACH,SAAgB,oBAAoB,CAAC,OAAkB;IACrD,OAAO;QACL,4CAA4C;QAC5C,GAAG;YACD,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,oBAAoB,EAAE,CAAC,CAAC;QAChE,CAAC;QACD,0EAA0E;QAC1E,MAAM,CAAC,IAA4B;YACjC,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,oBAAoB,EAAE,IAAI,EAAE,CAAC,CAAC;QACxE,CAAC;QACD,uGAAuG;QACvG,WAAW,CAAC,IAAqB;YAC/B,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,kBAAkB,EAAE,IAAI,EAAE,CAAC,CAAC;QACrE,CAAC;QACD,oGAAoG;QACpG,mBAAmB,CAAC,MAAc,EAAE,QAAuC;YACzE,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,sCAAsC,EAAE,IAAI,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,EAAE,CAAC,CAAC;QAC9G,CAAC;QACD,kFAAkF;QAClF,sBAAsB,CAAC,QAAuC;YAC5D,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,sCAAsC,EAAE,KAAK,EAAE,EAAE,QAAQ,EAAE,EAAE,CAAC,CAAC;QAC1G,CAAC;KACF,CAAC;AACJ,CAAC;AAED,qDAAqD;AACrD,SAAgB,kBAAkB,CAAC,OAAkB;IACnD,OAAO;QACL,yEAAyE;QACzE,IAAI,CAAC,QAAkF,EAAE;YACvF,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,iBAAiB,EAAE,KAAK,EAAE,CAAC,CAAC;QACpE,CAAC;QACD,6DAA6D;QAC7D,OAAO,CAAC,QAA2B,EAAE;YACnC,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,yBAAyB,EAAE,KAAK,EAAE,CAAC,CAAC;QAC5E,CAAC;QACD,6FAA6F;QAC7F,QAAQ,CAAC,EAAU,EAAE,OAA0B;YAC7C,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,mBAAmB,kBAAkB,CAAC,EAAE,CAAC,WAAW,EAAE,IAAI,EAAE,EAAE,OAAO,EAAE,EAAE,CAAC,CAAC;QACpH,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/client/roles.d.ts

@@ -7,6 +7,7 @@ export interface Role {
     name: string;
     description: string | null;
     is_system: boolean;
+    visibility: 'public' | 'internal';
     permissions: string[];
     member_count: number;
     created_at: number;
@@ -23,11 +24,14 @@ export interface CreateRoleBody {
     key: string;
     name: string;
     description?: string;
+    /** `internal` = assignable by your backend only; hidden from org-admin pickers. */
+    visibility?: 'public' | 'internal';
     permissions?: string[];
 }
 export interface UpdateRoleBody {
     name?: string;
     description?: string;
+    visibility?: 'public' | 'internal';
     /** May be supplied but must equal the current key — the key is immutable. */
     key?: string;
 }

package/dist/client/roles.js.map

@@ -1 +1 @@
-{"version":3,"file":"roles.js","sourceRoot":"","sources":["../../src/client/roles.ts"],"names":[],"mappings":";;AA+CA,sCAmCC;AAeD,kDAiBC;AAlHD,uCAAgD;AA+ChD,SAAgB,aAAa,CAAC,OAAkB;IAC9C,OAAO;QACL,IAAI;YACF,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC,CAAC;QACvD,CAAC;QACD,MAAM,CAAC,IAAoB,EAAE,cAAuB;YAClD,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC;QAC9E,CAAC;QACD,MAAM,CAAC,EAAU,EAAE,IAAoB;YACrC,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,aAAa,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;QAC1E,CAAC;QACD,iDAAiD;QACjD,cAAc,CAAC,EAAU,EAAE,WAAqB;YAC9C,OAAO,OAAO,CAAC;gBACb,MAAM,EAAE,KAAK;gBACb,IAAI,EAAE,aAAa,IAAA,aAAG,EAAC,EAAE,CAAC,cAAc;gBACxC,IAAI,EAAE,EAAE,WAAW,EAAE;aACtB,CAAC,CAAC;QACL,CAAC;QACD;;;;WAIG;QACH,MAAM,CACJ,EAAU,EACV,IAA8B;YAE9B,OAAO,OAAO,CAAC;gBACb,MAAM,EAAE,QAAQ;gBAChB,IAAI,EAAE,aAAa,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE;gBAC5B,KAAK,EAAE,IAAI,EAAE,UAAU,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,IAAI,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,SAAS;aACvE,CAAC,CAAC;QACL,CAAC;KACF,CAAC;AACJ,CAAC;AAeD,SAAgB,mBAAmB,CAAC,OAAkB;IACpD,OAAO;QACL,IAAI;YACF,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,iBAAiB,EAAE,CAAC,CAAC;QAC7D,CAAC;QACD,MAAM,CAAC,IAA0B,EAAE,cAAuB;YACxD,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,iBAAiB,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC;QACpF,CAAC;QACD,kFAAkF;QAClF,MAAM,CAAC,EAAU,EAAE,IAA0B;YAC3C,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,mBAAmB,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;QAChF,CAAC;QACD,sFAAsF;QACtF,MAAM,CAAC,EAAU;YACf,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,mBAAmB,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;QAC3E,CAAC;KACF,CAAC;AACJ,CAAC"}
+{"version":3,"file":"roles.js","sourceRoot":"","sources":["../../src/client/roles.ts"],"names":[],"mappings":";;AAmDA,sCAmCC;AAeD,kDAiBC;AAtHD,uCAAgD;AAmDhD,SAAgB,aAAa,CAAC,OAAkB;IAC9C,OAAO;QACL,IAAI;YACF,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC,CAAC;QACvD,CAAC;QACD,MAAM,CAAC,IAAoB,EAAE,cAAuB;YAClD,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC;QAC9E,CAAC;QACD,MAAM,CAAC,EAAU,EAAE,IAAoB;YACrC,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,aAAa,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;QAC1E,CAAC;QACD,iDAAiD;QACjD,cAAc,CAAC,EAAU,EAAE,WAAqB;YAC9C,OAAO,OAAO,CAAC;gBACb,MAAM,EAAE,KAAK;gBACb,IAAI,EAAE,aAAa,IAAA,aAAG,EAAC,EAAE,CAAC,cAAc;gBACxC,IAAI,EAAE,EAAE,WAAW,EAAE;aACtB,CAAC,CAAC;QACL,CAAC;QACD;;;;WAIG;QACH,MAAM,CACJ,EAAU,EACV,IAA8B;YAE9B,OAAO,OAAO,CAAC;gBACb,MAAM,EAAE,QAAQ;gBAChB,IAAI,EAAE,aAAa,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE;gBAC5B,KAAK,EAAE,IAAI,EAAE,UAAU,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,IAAI,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,SAAS;aACvE,CAAC,CAAC;QACL,CAAC;KACF,CAAC;AACJ,CAAC;AAeD,SAAgB,mBAAmB,CAAC,OAAkB;IACpD,OAAO;QACL,IAAI;YACF,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,iBAAiB,EAAE,CAAC,CAAC;QAC7D,CAAC;QACD,MAAM,CAAC,IAA0B,EAAE,cAAuB;YACxD,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,iBAAiB,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC;QACpF,CAAC;QACD,kFAAkF;QAClF,MAAM,CAAC,EAAU,EAAE,IAA0B;YAC3C,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,mBAAmB,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;QAChF,CAAC;QACD,sFAAsF;QACtF,MAAM,CAAC,EAAU;YACf,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,mBAAmB,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;QAC3E,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/client/service-connectors.d.ts

@@ -0,0 +1,83 @@
+import { type RequestFn } from './request';
+export type ServiceConnectorCategory = 'messaging' | 'crm' | 'analytics' | 'fraud' | 'idv' | 'http';
+/** A configured service. Credentials are write-only: they live in the vault and are never returned. */
+export interface ServiceConnector {
+    object: 'service_connector';
+    id: string;
+    name: string;
+    /** `twilio`, `sendgrid`, `slack`, `hubspot`, `salesforce`, `segment`, `fingerprint`, `arkose`, `forter`, `sardine`, `persona`, `onfido`, `veriff`, `stripe_identity` or `http`. */
+    kind: string;
+    category: ServiceConnectorCategory | null;
+    config: Record<string, string>;
+    enabled: boolean;
+    last_used_at: number | null;
+    last_status: 'ok' | 'error' | null;
+    created_at: number;
+    updated_at: number;
+}
+export interface ServiceConnectorField {
+    key: string;
+    label: string;
+    required: boolean;
+    type?: string;
+    enum?: string[];
+    default?: string;
+}
+export interface ServiceConnectorKind {
+    object: 'service_connector_kind';
+    kind: string;
+    name: string;
+    category: ServiceConnectorCategory;
+    summary: string;
+    credentials: ServiceConnectorField[];
+    config: ServiceConnectorField[];
+    operations: Array<{
+        operation: string;
+        summary: string;
+        input: ServiceConnectorField[];
+    }>;
+}
+export interface CreateServiceConnectorBody {
+    /** Lowercase letters, digits, `-` and `_`; what Actions call it by. */
+    name: string;
+    kind: string;
+    config?: Record<string, string>;
+    /** Stored in the vault. See the catalog entry for the fields. */
+    credentials: Record<string, string>;
+}
+export interface UpdateServiceConnectorBody {
+    name?: string;
+    enabled?: boolean;
+    /** Merged into the current config. */
+    config?: Record<string, string>;
+    /** Only the fields you pass are replaced. */
+    credentials?: Record<string, string>;
+}
+/** Typed connectors to messaging, CRM, analytics, fraud and identity-verification services. */
+export declare function serviceConnectorsResource(request: RequestFn): {
+    /** The services you can connect, with their fields and operations. */
+    catalog(): Promise<{
+        object: "list";
+        data: ServiceConnectorKind[];
+        has_more: boolean;
+    }>;
+    list(): Promise<{
+        object: "list";
+        data: ServiceConnector[];
+        has_more: boolean;
+    }>;
+    get(id: string): Promise<ServiceConnector>;
+    create(body: CreateServiceConnectorBody, idempotencyKey?: string): Promise<ServiceConnector>;
+    update(id: string, body: UpdateServiceConnectorBody): Promise<ServiceConnector>;
+    delete(id: string): Promise<{
+        object: "service_connector.deleted";
+        id: string;
+        deleted: boolean;
+    }>;
+    /** Run an operation, e.g. `invoke(id, 'send_sms', { to, body })`. A failure from the service is a 502 `CONNECTOR_UPSTREAM_ERROR`. */
+    invoke(id: string, operation: string, input?: Record<string, unknown>): Promise<{
+        object: "service_connector_result";
+        operation: string;
+        result: Record<string, unknown>;
+    }>;
+};

package/dist/client/service-connectors.js

@@ -0,0 +1,33 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.serviceConnectorsResource = serviceConnectorsResource;
+const request_1 = require("./request");
+/** Typed connectors to messaging, CRM, analytics, fraud and identity-verification services. */
+function serviceConnectorsResource(request) {
+    return {
+        /** The services you can connect, with their fields and operations. */
+        catalog() {
+            return request({ method: 'GET', path: '/v1/service_connector_catalog' });
+        },
+        list() {
+            return request({ method: 'GET', path: '/v1/service_connectors' });
+        },
+        get(id) {
+            return request({ method: 'GET', path: `/v1/service_connectors/${(0, request_1.enc)(id)}` });
+        },
+        create(body, idempotencyKey) {
+            return request({ method: 'POST', path: '/v1/service_connectors', body, idempotencyKey });
+        },
+        update(id, body) {
+            return request({ method: 'PATCH', path: `/v1/service_connectors/${(0, request_1.enc)(id)}`, body });
+        },
+        delete(id) {
+            return request({ method: 'DELETE', path: `/v1/service_connectors/${(0, request_1.enc)(id)}` });
+        },
+        /** Run an operation, e.g. `invoke(id, 'send_sms', { to, body })`. A failure from the service is a 502 `CONNECTOR_UPSTREAM_ERROR`. */
+        invoke(id, operation, input = {}) {
+            return request({ method: 'POST', path: `/v1/service_connectors/${(0, request_1.enc)(id)}/invoke`, body: { operation, input } });
+        },
+    };
+}
+//# sourceMappingURL=service-connectors.js.map

package/dist/client/service-connectors.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"service-connectors.js","sourceRoot":"","sources":["../../src/client/service-connectors.ts"],"names":[],"mappings":";;AA2DA,8DA0BC;AArFD,uCAAgD;AA0DhD,+FAA+F;AAC/F,SAAgB,yBAAyB,CAAC,OAAkB;IAC1D,OAAO;QACL,sEAAsE;QACtE,OAAO;YACL,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,+BAA+B,EAAE,CAAC,CAAC;QAC3E,CAAC;QACD,IAAI;YACF,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,wBAAwB,EAAE,CAAC,CAAC;QACpE,CAAC;QACD,GAAG,CAAC,EAAU;YACZ,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,0BAA0B,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;QAC/E,CAAC;QACD,MAAM,CAAC,IAAgC,EAAE,cAAuB;YAC9D,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,wBAAwB,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC;QAC3F,CAAC;QACD,MAAM,CAAC,EAAU,EAAE,IAAgC;YACjD,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,0BAA0B,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;QACvF,CAAC;QACD,MAAM,CAAC,EAAU;YACf,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,0BAA0B,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;QAClF,CAAC;QACD,qIAAqI;QACrI,MAAM,CAAC,EAAU,EAAE,SAAiB,EAAE,QAAiC,EAAE;YACvE,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,0BAA0B,IAAA,aAAG,EAAC,EAAE,CAAC,SAAS,EAAE,IAAI,EAAE,EAAE,SAAS,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC;QACnH,CAAC;KACF,CAAC;AACJ,CAAC"}