@atlasauth/backend 0.24.0 → 0.26.0

package/dist/client/analytics-reports.d.ts

@@ -0,0 +1,215 @@
+import { type RequestFn } from './request';
+import type { DeletedObject } from './types';
+/** The window every analytics read takes: `from`/`to` (epoch ms or ISO 8601) or `days`, at most 180. */
+export interface AnalyticsParams {
+    from?: number | string;
+    to?: number | string;
+    days?: number;
+    granularity?: 'day' | 'week' | 'month';
+    /** Only members of this organization (not available for failures). */
+    organization_id?: string;
+}
+export interface AnalyticsReport<Row> {
+    object: string;
+    window: {
+        from: number;
+        to: number;
+        granularity: string;
+        organization_id: string | null;
+    };
+    data: Row[];
+    [meta: string]: unknown;
+}
+export interface FunnelRow {
+    method: string;
+    started: number;
+    completed: number;
+    abandoned: number;
+    in_progress: number;
+    needs_first_factor: number;
+    needs_second_factor: number;
+    needs_email_verification: number;
+    completion_rate: number;
+}
+export interface JourneyFunnelRow {
+    step: string;
+    held: number;
+    completed: number;
+    applied: number;
+    denied: number;
+    completion_rate: number;
+}
+export interface FailureRow {
+    phase: string;
+    reason: string;
+    method: string;
+    count: number;
+    share: number;
+}
+export interface BreakdownRow {
+    value: string;
+    count: number;
+    share: number;
+}
+export interface ActiveUsersRow {
+    bucket: string;
+    active_users: number;
+    new_users: number;
+    returning_users: number;
+    sign_ins: number;
+}
+export interface PasskeyAdoptionRow {
+    bucket: string;
+    passkey_sign_ins: number;
+    sign_ins: number;
+    passkey_share: number;
+}
+export interface InactiveUserRow {
+    user_id: string;
+    email: string | null;
+    last_sign_in_at: string | null;
+    created_at: string;
+}
+export interface MfaCoverageRow {
+    protection: string;
+    users: number;
+    share: number;
+}
+export interface AccessByAppRow {
+    client_id: string;
+    name: string;
+    users: number;
+    active_grants: number;
+    users_in_window: number;
+}
+export type AlertMetric = 'sign_in_success_rate' | 'failed_passkey_ratio' | 'failed_sign_ins' | 'sign_in_p95_seconds' | 'api_usage_spike' | 'unused_permissions';
+export type UsageSubjectType = 'api_key' | 'end_user_api_key' | 'organization';
+/** One key's or organization's API usage against its 7-day hourly baseline. */
+export interface ApiUsageSubject {
+    type: UsageSubjectType;
+    id: string;
+    current: number;
+    current_per_hour: number;
+    baseline_per_hour: number;
+    /** current_per_hour / baseline_per_hour (the baseline is floored at 1 request an hour). */
+    ratio: number;
+    error_rate: number;
+}
+export interface AnalyticsAlertRule {
+    object: 'analytics_alert_rule';
+    id: string;
+    name: string;
+    metric: AlertMetric;
+    comparator: 'lt' | 'gt';
+    threshold: number;
+    window_minutes: number;
+    min_sample: number;
+    cooldown_minutes: number;
+    email_contacts: string[];
+    webhook_url: string | null;
+    has_webhook_secret: boolean;
+    enabled: boolean;
+    subject_type: UsageSubjectType | null;
+    subject_id: string | null;
+    ssf: boolean;
+    state: 'ok' | 'firing';
+    last_value: number | null;
+    last_evaluated_at: number | null;
+    last_triggered_at: number | null;
+    last_error: string | null;
+    created_at: number;
+}
+export interface AnalyticsAlertRuleInput {
+    name: string;
+    metric: AlertMetric;
+    comparator: 'lt' | 'gt';
+    threshold: number;
+    /** 5 to 1440 (default 60). */
+    window_minutes?: number;
+    /** Ratios and latency are not evaluated on fewer observations (default 20). */
+    min_sample?: number;
+    /** Minutes between notifications while the rule stays firing (default 60). */
+    cooldown_minutes?: number;
+    email_contacts?: string[];
+    /** A public HTTPS endpoint; the body is signed like any Atlas webhook. */
+    webhook_url?: string | null;
+    enabled?: boolean;
+    /** api_usage_spike: which kind of subject to watch (null = all). */
+    subject_type?: UsageSubjectType | null;
+    /** api_usage_spike: one key or organization (needs subject_type). */
+    subject_id?: string | null;
+    /** Also raise a Shared Signals event when the rule fires. */
+    ssf?: boolean;
+}
+export declare function analyticsResource(request: RequestFn): {
+    /** Where sign-in (or sign-up) attempts end, per method. */
+    funnel: (params?: AnalyticsParams & {
+        kind?: "sign_in" | "sign_up";
+    }) => Promise<AnalyticsReport<FunnelRow>>;
+    /** What happened at each step of a sign-in journey. */
+    journeyFunnel: (params: Omit<AnalyticsParams, "organization_id"> & {
+        journey_id: string;
+    }) => Promise<AnalyticsReport<JourneyFunnelRow>>;
+    /** Failed attempts by reason and method. */
+    failures: (params?: Omit<AnalyticsParams, "organization_id">) => Promise<AnalyticsReport<FailureRow>>;
+    /** Sign-ins by method, device, browser, os or country. */
+    breakdown: (params?: AnalyticsParams & {
+        dimension?: "method" | "device" | "browser" | "os" | "country";
+    }) => Promise<AnalyticsReport<BreakdownRow>>;
+    /** DAU/WAU/MAU and a series, with new vs returning users. */
+    activeUsers: (params?: AnalyticsParams) => Promise<AnalyticsReport<ActiveUsersRow>>;
+    passkeyAdoption: (params?: AnalyticsParams) => Promise<AnalyticsReport<PasskeyAdoptionRow>>;
+    /** API usage per secret key, end-user API key or organization against its own baseline, highest ratio first. */
+    apiUsage: (params?: {
+        subject_type?: UsageSubjectType;
+        subject_id?: string;
+        window_minutes?: number;
+    }) => Promise<{
+        object: "api_usage";
+        window_minutes: number;
+        baseline_hours: number;
+        generated_at: number;
+        data: ApiUsageSubject[];
+    }>;
+    reports: {
+        inactiveUsers: (params?: AnalyticsParams & {
+            inactive_days?: number;
+            limit?: number;
+            starting_after?: string;
+        }) => Promise<AnalyticsReport<InactiveUserRow>>;
+        mfaCoverage: (params?: AnalyticsParams) => Promise<AnalyticsReport<MfaCoverageRow>>;
+        accessByApp: (params?: AnalyticsParams) => Promise<AnalyticsReport<AccessByAppRow>>;
+    };
+    /**
+     * Any analytics read as CSV text, e.g. `exportCsv('breakdown', { dimension: 'country' })`.
+     * For Parquet call the same path with `format=parquet` over HTTP (a binary body).
+     */
+    exportCsv: (report: "funnel" | "failures" | "breakdown" | "active_users" | "passkey_adoption" | "reports/inactive_users" | "reports/mfa_coverage" | "reports/access_by_app", params?: object) => Promise<string>;
+    alertRules: {
+        list(): Promise<{
+            object: "list";
+            data: AnalyticsAlertRule[];
+            has_more: boolean;
+        }>;
+        get(id: string): Promise<AnalyticsAlertRule>;
+        /** A webhook rule's `webhook_secret` is in this response only. */
+        create(body: AnalyticsAlertRuleInput, idempotencyKey?: string): Promise<AnalyticsAlertRule & {
+            webhook_secret?: string;
+        }>;
+        update(id: string, body: Partial<AnalyticsAlertRuleInput>): Promise<AnalyticsAlertRule & {
+            webhook_secret?: string;
+        }>;
+        delete(id: string): Promise<DeletedObject>;
+        /** Measure now; `notify: true` also sends the rule's email and webhook. */
+        test(id: string, body?: {
+            notify?: boolean;
+        }): Promise<{
+            object: "analytics_alert_test";
+            value: number | null;
+            sample: number;
+            subject: ApiUsageSubject | null;
+            notified: boolean;
+            error: string | null;
+        }>;
+    };
+};

package/dist/client/analytics-reports.js

@@ -0,0 +1,56 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.analyticsResource = analyticsResource;
+const request_1 = require("./request");
+function analyticsResource(request) {
+    const read = (path, params) => request({ method: 'GET', path, query: { ...params } });
+    const csv = (path, params) => request({ method: 'GET', path, query: { ...params, format: 'csv' }, raw: true });
+    return {
+        /** Where sign-in (or sign-up) attempts end, per method. */
+        funnel: (params = {}) => read('/v1/analytics/funnel', params),
+        /** What happened at each step of a sign-in journey. */
+        journeyFunnel: (params) => read('/v1/analytics/journey_funnel', params),
+        /** Failed attempts by reason and method. */
+        failures: (params = {}) => read('/v1/analytics/failures', params),
+        /** Sign-ins by method, device, browser, os or country. */
+        breakdown: (params = {}) => read('/v1/analytics/breakdown', params),
+        /** DAU/WAU/MAU and a series, with new vs returning users. */
+        activeUsers: (params = {}) => read('/v1/analytics/active_users', params),
+        passkeyAdoption: (params = {}) => read('/v1/analytics/passkey_adoption', params),
+        /** API usage per secret key, end-user API key or organization against its own baseline, highest ratio first. */
+        apiUsage: (params = {}) => request({ method: 'GET', path: '/v1/analytics/api_usage', query: { ...params } }),
+        reports: {
+            inactiveUsers: (params = {}) => read('/v1/analytics/reports/inactive_users', params),
+            mfaCoverage: (params = {}) => read('/v1/analytics/reports/mfa_coverage', params),
+            accessByApp: (params = {}) => read('/v1/analytics/reports/access_by_app', params),
+        },
+        /**
+         * Any analytics read as CSV text, e.g. `exportCsv('breakdown', { dimension: 'country' })`.
+         * For Parquet call the same path with `format=parquet` over HTTP (a binary body).
+         */
+        exportCsv: (report, params = {}) => csv(`/v1/analytics/${report}`, params),
+        alertRules: {
+            list() {
+                return request({ method: 'GET', path: '/v1/analytics/alert_rules' });
+            },
+            get(id) {
+                return request({ method: 'GET', path: `/v1/analytics/alert_rules/${(0, request_1.enc)(id)}` });
+            },
+            /** A webhook rule's `webhook_secret` is in this response only. */
+            create(body, idempotencyKey) {
+                return request({ method: 'POST', path: '/v1/analytics/alert_rules', body, idempotencyKey });
+            },
+            update(id, body) {
+                return request({ method: 'PATCH', path: `/v1/analytics/alert_rules/${(0, request_1.enc)(id)}`, body });
+            },
+            delete(id) {
+                return request({ method: 'DELETE', path: `/v1/analytics/alert_rules/${(0, request_1.enc)(id)}` });
+            },
+            /** Measure now; `notify: true` also sends the rule's email and webhook. */
+            test(id, body = {}) {
+                return request({ method: 'POST', path: `/v1/analytics/alert_rules/${(0, request_1.enc)(id)}/test`, body });
+            },
+        },
+    };
+}
+//# sourceMappingURL=analytics-reports.js.map

package/dist/client/analytics-reports.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"analytics-reports.js","sourceRoot":"","sources":["../../src/client/analytics-reports.ts"],"names":[],"mappings":";;AAwGA,8CA6DC;AArKD,uCAAgD;AAwGhD,SAAgB,iBAAiB,CAAC,OAAkB;IAClD,MAAM,IAAI,GAAG,CAAM,IAAY,EAAE,MAAc,EAAiC,EAAE,CAChF,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,GAAG,MAAM,EAAE,EAAE,CAAC,CAAC;IACzD,MAAM,GAAG,GAAG,CAAC,IAAY,EAAE,MAAc,EAAmB,EAAE,CAC5D,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,GAAG,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,CAAC,CAAC;IACnF,OAAO;QACL,2DAA2D;QAC3D,MAAM,EAAE,CAAC,SAA6D,EAAE,EAAE,EAAE,CAAC,IAAI,CAAY,sBAAsB,EAAE,MAAM,CAAC;QAC5H,uDAAuD;QACvD,aAAa,EAAE,CAAC,MAAyE,EAAE,EAAE,CAAC,IAAI,CAAmB,8BAA8B,EAAE,MAAM,CAAC;QAC5J,4CAA4C;QAC5C,QAAQ,EAAE,CAAC,SAAmD,EAAE,EAAE,EAAE,CAAC,IAAI,CAAa,wBAAwB,EAAE,MAAM,CAAC;QACvH,0DAA0D;QAC1D,SAAS,EAAE,CAAC,SAA+F,EAAE,EAAE,EAAE,CAC/G,IAAI,CAAe,yBAAyB,EAAE,MAAM,CAAC;QACvD,6DAA6D;QAC7D,WAAW,EAAE,CAAC,SAA0B,EAAE,EAAE,EAAE,CAAC,IAAI,CAAiB,4BAA4B,EAAE,MAAM,CAAC;QACzG,eAAe,EAAE,CAAC,SAA0B,EAAE,EAAE,EAAE,CAAC,IAAI,CAAqB,gCAAgC,EAAE,MAAM,CAAC;QACrH,gHAAgH;QAChH,QAAQ,EAAE,CAAC,SAA4F,EAAE,EAMtG,EAAE,CAAC,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,yBAAyB,EAAE,KAAK,EAAE,EAAE,GAAG,MAAM,EAAE,EAAE,CAAC;QACvF,OAAO,EAAE;YACP,aAAa,EAAE,CAAC,SAAgG,EAAE,EAAE,EAAE,CACpH,IAAI,CAAkB,sCAAsC,EAAE,MAAM,CAAC;YACvE,WAAW,EAAE,CAAC,SAA0B,EAAE,EAAE,EAAE,CAAC,IAAI,CAAiB,oCAAoC,EAAE,MAAM,CAAC;YACjH,WAAW,EAAE,CAAC,SAA0B,EAAE,EAAE,EAAE,CAAC,IAAI,CAAiB,qCAAqC,EAAE,MAAM,CAAC;SACnH;QACD;;;WAGG;QACH,SAAS,EAAE,CAAC,MAA+J,EAAE,SAAiB,EAAE,EAAE,EAAE,CAClM,GAAG,CAAC,iBAAiB,MAAM,EAAE,EAAE,MAAM,CAAC;QACxC,UAAU,EAAE;YACV,IAAI;gBACF,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,2BAA2B,EAAE,CAAC,CAAC;YACvE,CAAC;YACD,GAAG,CAAC,EAAU;gBACZ,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,6BAA6B,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;YAClF,CAAC;YACD,kEAAkE;YAClE,MAAM,CAAC,IAA6B,EAAE,cAAuB;gBAC3D,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,2BAA2B,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC;YAC9F,CAAC;YACD,MAAM,CAAC,EAAU,EAAE,IAAsC;gBACvD,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,6BAA6B,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;YAC1F,CAAC;YACD,MAAM,CAAC,EAAU;gBACf,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,6BAA6B,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;YACrF,CAAC;YACD,2EAA2E;YAC3E,IAAI,CAAC,EAAU,EAAE,OAA6B,EAAE;gBAC9C,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,6BAA6B,IAAA,aAAG,EAAC,EAAE,CAAC,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;YAC9F,CAAC;SACF;KACF,CAAC;AACJ,CAAC"}

package/dist/client/app-catalog.d.ts

@@ -0,0 +1,74 @@
+import { type RequestFn } from './request';
+export interface AppPreset {
+    object: 'app_preset';
+    id: string;
+    protocol: 'saml' | 'oidc';
+    name: string;
+    category: string;
+    icon_domain: string;
+    /** False: the values could not be confirmed in the vendor's docs; check them against the app's SSO settings. */
+    verified: boolean;
+    /** The vendor SSO documentation the values come from. */
+    source_url: string | null;
+    params: Array<{
+        key: string;
+        label: string;
+    }>;
+}
+/** Who may open an installed app; `assigned` admits only the listed users, groups, organizations and roles. */
+export interface AppAssignment {
+    mode: 'everyone' | 'assigned';
+    user_ids?: string[];
+    /** Instance group ids or slugs (members of child groups count). */
+    groups?: string[];
+    organizations?: string[];
+    /** Organization role keys. */
+    roles?: string[];
+}
+export interface InstalledApp {
+    object: 'installed_app';
+    id: string;
+    protocol: 'saml' | 'oidc';
+    name: string;
+    preset_id: string | null;
+    entity_id: string | null;
+    acs_url: string | null;
+    client_id: string | null;
+    launch_url: string | null;
+    allowed_email_domains: string[];
+    assignment: Required<AppAssignment>;
+}
+export interface InstallAppBody {
+    params?: Record<string, string>;
+    installed_id?: string;
+    name?: string;
+    allowed_email_domains?: string[];
+    assignment?: AppAssignment;
+}
+/** The app catalog: SAML and OpenID Connect presets, installs, and who may open each app. */
+export declare function appCatalogResource(request: RequestFn): {
+    /** `GET /v1/app_catalog` — every preset with its protocol and parameters. */
+    presets(): Promise<{
+        object: "list";
+        data: AppPreset[];
+    }>;
+    /** `GET /v1/app_catalog/installed` */
+    installed(): Promise<{
+        object: "list";
+        data: InstalledApp[];
+    }>;
+    /** `POST /v1/app_catalog/:presetId/install` — an OIDC app's `client_secret` is in this response only. */
+    install(presetId: string, body?: InstallAppBody, idempotencyKey?: string): Promise<InstalledApp & {
+        client_secret?: string;
+        redirect_uri?: string;
+        issuer?: string;
+    }>;
+    /** `PATCH /v1/app_catalog/installed/:id` — name, allowed_email_domains, assignment. */
+    update(id: string, body: Pick<InstallAppBody, "name" | "allowed_email_domains" | "assignment">): Promise<InstalledApp>;
+    /** `DELETE /v1/app_catalog/installed/:id` */
+    uninstall(id: string): Promise<{
+        object: "installed_app";
+        id: string;
+        deleted: true;
+    }>;
+};

package/dist/client/app-catalog.js

@@ -0,0 +1,30 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.appCatalogResource = appCatalogResource;
+const request_1 = require("./request");
+/** The app catalog: SAML and OpenID Connect presets, installs, and who may open each app. */
+function appCatalogResource(request) {
+    return {
+        /** `GET /v1/app_catalog` — every preset with its protocol and parameters. */
+        presets() {
+            return request({ method: 'GET', path: '/v1/app_catalog' });
+        },
+        /** `GET /v1/app_catalog/installed` */
+        installed() {
+            return request({ method: 'GET', path: '/v1/app_catalog/installed' });
+        },
+        /** `POST /v1/app_catalog/:presetId/install` — an OIDC app's `client_secret` is in this response only. */
+        install(presetId, body = {}, idempotencyKey) {
+            return request({ method: 'POST', path: `/v1/app_catalog/${(0, request_1.enc)(presetId)}/install`, body, idempotencyKey });
+        },
+        /** `PATCH /v1/app_catalog/installed/:id` — name, allowed_email_domains, assignment. */
+        update(id, body) {
+            return request({ method: 'PATCH', path: `/v1/app_catalog/installed/${(0, request_1.enc)(id)}`, body });
+        },
+        /** `DELETE /v1/app_catalog/installed/:id` */
+        uninstall(id) {
+            return request({ method: 'DELETE', path: `/v1/app_catalog/installed/${(0, request_1.enc)(id)}` });
+        },
+    };
+}
+//# sourceMappingURL=app-catalog.js.map

package/dist/client/app-catalog.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"app-catalog.js","sourceRoot":"","sources":["../../src/client/app-catalog.ts"],"names":[],"mappings":";;AAkDA,gDAuBC;AAzED,uCAAgD;AAiDhD,6FAA6F;AAC7F,SAAgB,kBAAkB,CAAC,OAAkB;IACnD,OAAO;QACL,6EAA6E;QAC7E,OAAO;YACL,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,iBAAiB,EAAE,CAAC,CAAC;QAC7D,CAAC;QACD,sCAAsC;QACtC,SAAS;YACP,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,2BAA2B,EAAE,CAAC,CAAC;QACvE,CAAC;QACD,yGAAyG;QACzG,OAAO,CAAC,QAAgB,EAAE,OAAuB,EAAE,EAAE,cAAuB;YAC1E,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,mBAAmB,IAAA,aAAG,EAAC,QAAQ,CAAC,UAAU,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC;QAC7G,CAAC;QACD,uFAAuF;QACvF,MAAM,CAAC,EAAU,EAAE,IAA2E;YAC5F,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,6BAA6B,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;QAC1F,CAAC;QACD,6CAA6C;QAC7C,SAAS,CAAC,EAAU;YAClB,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,6BAA6B,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;QACrF,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/client/attack-protection.d.ts

@@ -70,4 +70,14 @@ export interface UpdateAttackProtectionBody {
 export declare function attackProtectionResource(request: RequestFn): {
     get(): Promise<AttackProtection>;
     update(body: UpdateAttackProtectionBody): Promise<AttackProtection>;
+    /** Store the Play Integrity response-decryption key (base64 AES-256) for app attestation. Write-only. */
+    /** Store the Play Integrity decryption key (default) or, with kind 'devicecheck', the Apple DeviceCheck .p8 key. Write-only. */
+    setAppAttestationSecret(secret: string, kind?: "play_integrity" | "devicecheck"): Promise<{
+        object: "app_attestation_secret";
+        set: true;
+    }>;
+    removeAppAttestationSecret(kind?: "play_integrity" | "devicecheck"): Promise<{
+        object: "app_attestation_secret";
+        deleted: true;
+    }>;
 };

package/dist/client/attack-protection.js

@@ -9,6 +9,14 @@ function attackProtectionResource(request) {
         update(body) {
             return request({ method: 'PATCH', path: '/v1/attack_protection', body });
         },
+        /** Store the Play Integrity response-decryption key (base64 AES-256) for app attestation. Write-only. */
+        /** Store the Play Integrity decryption key (default) or, with kind 'devicecheck', the Apple DeviceCheck .p8 key. Write-only. */
+        setAppAttestationSecret(secret, kind = 'play_integrity') {
+            return request({ method: 'PUT', path: '/v1/attack_protection/app_attestation_secret', body: { secret, kind } });
+        },
+        removeAppAttestationSecret(kind = 'play_integrity') {
+            return request({ method: 'DELETE', path: '/v1/attack_protection/app_attestation_secret', query: { kind } });
+        },
     };
 }
 //# sourceMappingURL=attack-protection.js.map

package/dist/client/attack-protection.js.map

@@ -1 +1 @@
-{"version":3,"file":"attack-protection.js","sourceRoot":"","sources":["../../src/client/attack-protection.ts"],"names":[],"mappings":";;AA8DA,4DASC;AATD,SAAgB,wBAAwB,CAAC,OAAkB;IACzD,OAAO;QACL,GAAG;YACD,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,uBAAuB,EAAE,CAAC,CAAC;QACnE,CAAC;QACD,MAAM,CAAC,IAAgC;YACrC,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,uBAAuB,EAAE,IAAI,EAAE,CAAC,CAAC;QAC3E,CAAC;KACF,CAAC;AACJ,CAAC"}
+{"version":3,"file":"attack-protection.js","sourceRoot":"","sources":["../../src/client/attack-protection.ts"],"names":[],"mappings":";;AA8DA,4DAiBC;AAjBD,SAAgB,wBAAwB,CAAC,OAAkB;IACzD,OAAO;QACL,GAAG;YACD,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,uBAAuB,EAAE,CAAC,CAAC;QACnE,CAAC;QACD,MAAM,CAAC,IAAgC;YACrC,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,uBAAuB,EAAE,IAAI,EAAE,CAAC,CAAC;QAC3E,CAAC;QACD,yGAAyG;QACzG,gIAAgI;QAChI,uBAAuB,CAAC,MAAc,EAAE,OAAyC,gBAAgB;YAC/F,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,8CAA8C,EAAE,IAAI,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC;QAClH,CAAC;QACD,0BAA0B,CAAC,OAAyC,gBAAgB;YAClF,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,8CAA8C,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC;QAC9G,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/client/audit-events.d.ts

@@ -25,6 +25,8 @@ export interface CustomAuditEvent {
     /** When it happened in your system (epoch ms). */
     occurred_at: number;
     metadata: unknown;
+    /** The registered schema version this event satisfied; null when its action has no schema. */
+    schema_version?: number | null;
     /** When Atlas received it (epoch ms). */
     created_at: number;
 }
@@ -45,6 +47,8 @@ export interface CreateCustomAuditEventBody {
     occurred_at?: number;
     /** Non-secret structured context. */
     metadata?: Record<string, unknown>;
+    /** Pin to a registered schema version; default the latest active one for the action. */
+    schema_version?: number;
 }
 /** Shared filters of the list and export endpoints. */
 export interface CustomAuditEventFilters {
@@ -101,3 +105,70 @@ export declare function auditEventsResource(request: RequestFn): {
         deleted: number;
     }>;
 };
+/** A registered audit event schema: what an action's events must look like. */
+export interface AuditEventSchema {
+    object: 'audit_event_schema';
+    id: string;
+    action: string;
+    version: number;
+    description: string | null;
+    /** Allowed `target.type` values (empty = any). */
+    target_types: string[];
+    /** Allowed `actor.type` values (empty = any). */
+    actor_types: string[];
+    /** A JSON Schema the event's metadata must satisfy. */
+    metadata_schema: Record<string, unknown>;
+    status: 'active' | 'deprecated';
+    created_at: number;
+}
+export interface RegisterAuditEventSchemaBody {
+    action: string;
+    /** Defaults to the next version for the action; a version is immutable. */
+    version?: number;
+    description?: string;
+    target_types?: string[];
+    actor_types?: string[];
+    metadata_schema?: Record<string, unknown>;
+}
+export declare function auditEventSchemasResource(request: RequestFn): {
+    list(): Promise<{
+        object: "list";
+        data: AuditEventSchema[];
+        has_more: false;
+    }>;
+    get(id: string): Promise<AuditEventSchema>;
+    /** Events with this action are validated against it from now on. Change a schema by registering a new version. */
+    register(body: RegisterAuditEventSchemaBody): Promise<AuditEventSchema>;
+    update(id: string, body: {
+        description?: string | null;
+        status?: "active" | "deprecated";
+    }): Promise<AuditEventSchema>;
+    delete(id: string): Promise<{
+        object: "audit_event_schema";
+        id: string;
+        deleted: true;
+    }>;
+    /** Blank fields of one event (`actor_id`, `target_id`, `target_name`, `metadata.<path>`); logged, never deleted. */
+    redact(eventId: string, body: {
+        fields: string[];
+        reason: string;
+    }): Promise<{
+        object: "audit_event_redaction";
+        event_id: string;
+        redacted: string[];
+        unchanged: string[];
+        reason: string;
+    }>;
+    redactions(eventId: string): Promise<{
+        object: "list";
+        data: Array<{
+            id: string;
+            event_id: string;
+            fields: string[];
+            reason: string;
+            redacted_by: string | null;
+            created_at: number;
+        }>;
+        has_more: false;
+    }>;
+};

package/dist/client/audit-events.js

@@ -1,6 +1,7 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.auditEventsResource = auditEventsResource;
+exports.auditEventSchemasResource = auditEventSchemasResource;
 function auditEventsResource(request) {
     return {
         create(body, idempotencyKey) {
@@ -40,4 +41,31 @@ function auditEventsResource(request) {
         },
     };
 }
+function auditEventSchemasResource(request) {
+    return {
+        list() {
+            return request({ method: 'GET', path: '/v1/audit_event_schemas' });
+        },
+        get(id) {
+            return request({ method: 'GET', path: `/v1/audit_event_schemas/${encodeURIComponent(id)}` });
+        },
+        /** Events with this action are validated against it from now on. Change a schema by registering a new version. */
+        register(body) {
+            return request({ method: 'POST', path: '/v1/audit_event_schemas', body });
+        },
+        update(id, body) {
+            return request({ method: 'PATCH', path: `/v1/audit_event_schemas/${encodeURIComponent(id)}`, body });
+        },
+        delete(id) {
+            return request({ method: 'DELETE', path: `/v1/audit_event_schemas/${encodeURIComponent(id)}` });
+        },
+        /** Blank fields of one event (`actor_id`, `target_id`, `target_name`, `metadata.<path>`); logged, never deleted. */
+        redact(eventId, body) {
+            return request({ method: 'POST', path: `/v1/audit_events/${encodeURIComponent(eventId)}/redact`, body });
+        },
+        redactions(eventId) {
+            return request({ method: 'GET', path: `/v1/audit_events/${encodeURIComponent(eventId)}/redactions` });
+        },
+    };
+}
 //# sourceMappingURL=audit-events.js.map

package/dist/client/audit-events.js.map

@@ -1 +1 @@
-{"version":3,"file":"audit-events.js","sourceRoot":"","sources":["../../src/client/audit-events.ts"],"names":[],"mappings":";;AAoEA,kDA2CC;AA3CD,SAAgB,mBAAmB,CAAC,OAAkB;IACpD,OAAO;QACL,MAAM,CAAC,IAAgC,EAAE,cAAuB;YAC9D,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,kBAAkB,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC;QACrF,CAAC;QACD,kFAAkF;QAClF,WAAW,CACT,MAAoC,EACpC,cAAuB;YAEvB,OAAO,OAAO,CAAC;gBACb,MAAM,EAAE,MAAM;gBACd,IAAI,EAAE,wBAAwB;gBAC9B,IAAI,EAAE,EAAE,MAAM,EAAE;gBAChB,cAAc;aACf,CAAC,CAAC;QACL,CAAC;QACD,sCAAsC;QACtC,IAAI,CAAC,SAAsC,EAAE;YAC3C,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,kBAAkB,EAAE,KAAK,EAAE,EAAE,GAAG,MAAM,EAAE,EAAE,CAAC,CAAC;QACpF,CAAC;QACD;;;WAGG;QACH,MAAM,CAAC,SAAwC,EAAE;YAC/C,OAAO,OAAO,CAAC;gBACb,MAAM,EAAE,KAAK;gBACb,IAAI,EAAE,yBAAyB;gBAC/B,KAAK,EAAE,EAAE,GAAG,MAAM,EAAE;gBACpB,GAAG,EAAE,IAAI;aACV,CAAC,CAAC;QACL,CAAC;QACD;;;WAGG;QACH,SAAS,CACP,SAAwD,EAAE;YAE1D,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,kBAAkB,EAAE,KAAK,EAAE,EAAE,GAAG,MAAM,EAAE,EAAE,CAAC,CAAC;QACvF,CAAC;KACF,CAAC;AACJ,CAAC"}
+{"version":3,"file":"audit-events.js","sourceRoot":"","sources":["../../src/client/audit-events.ts"],"names":[],"mappings":";;AAwEA,kDA2CC;AA6BD,8DA0BC;AAlGD,SAAgB,mBAAmB,CAAC,OAAkB;IACpD,OAAO;QACL,MAAM,CAAC,IAAgC,EAAE,cAAuB;YAC9D,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,kBAAkB,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC;QACrF,CAAC;QACD,kFAAkF;QAClF,WAAW,CACT,MAAoC,EACpC,cAAuB;YAEvB,OAAO,OAAO,CAAC;gBACb,MAAM,EAAE,MAAM;gBACd,IAAI,EAAE,wBAAwB;gBAC9B,IAAI,EAAE,EAAE,MAAM,EAAE;gBAChB,cAAc;aACf,CAAC,CAAC;QACL,CAAC;QACD,sCAAsC;QACtC,IAAI,CAAC,SAAsC,EAAE;YAC3C,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,kBAAkB,EAAE,KAAK,EAAE,EAAE,GAAG,MAAM,EAAE,EAAE,CAAC,CAAC;QACpF,CAAC;QACD;;;WAGG;QACH,MAAM,CAAC,SAAwC,EAAE;YAC/C,OAAO,OAAO,CAAC;gBACb,MAAM,EAAE,KAAK;gBACb,IAAI,EAAE,yBAAyB;gBAC/B,KAAK,EAAE,EAAE,GAAG,MAAM,EAAE;gBACpB,GAAG,EAAE,IAAI;aACV,CAAC,CAAC;QACL,CAAC;QACD;;;WAGG;QACH,SAAS,CACP,SAAwD,EAAE;YAE1D,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,kBAAkB,EAAE,KAAK,EAAE,EAAE,GAAG,MAAM,EAAE,EAAE,CAAC,CAAC;QACvF,CAAC;KACF,CAAC;AACJ,CAAC;AA6BD,SAAgB,yBAAyB,CAAC,OAAkB;IAC1D,OAAO;QACL,IAAI;YACF,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,yBAAyB,EAAE,CAAC,CAAC;QACrE,CAAC;QACD,GAAG,CAAC,EAAU;YACZ,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,2BAA2B,kBAAkB,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;QAC/F,CAAC;QACD,kHAAkH;QAClH,QAAQ,CAAC,IAAkC;YACzC,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,yBAAyB,EAAE,IAAI,EAAE,CAAC,CAAC;QAC5E,CAAC;QACD,MAAM,CAAC,EAAU,EAAE,IAAuE;YACxF,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,2BAA2B,kBAAkB,CAAC,EAAE,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;QACvG,CAAC;QACD,MAAM,CAAC,EAAU;YACf,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,2BAA2B,kBAAkB,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;QAClG,CAAC;QACD,oHAAoH;QACpH,MAAM,CAAC,OAAe,EAAE,IAA0C;YAChE,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,oBAAoB,kBAAkB,CAAC,OAAO,CAAC,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAC3G,CAAC;QACD,UAAU,CAAC,OAAe;YACxB,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,oBAAoB,kBAAkB,CAAC,OAAO,CAAC,aAAa,EAAE,CAAC,CAAC;QACxG,CAAC;KACF,CAAC;AACJ,CAAC"}