@atlasauth/backend 0.24.0 → 0.26.0

package/dist/client/connections.js

@@ -0,0 +1,164 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.connectionsResource = connectionsResource;
+const request_1 = require("./request");
+const SKEW_MS = 60_000;
+async function sha256Hex(text) {
+    const d = await globalThis.crypto.subtle.digest('SHA-256', new TextEncoder().encode(text));
+    return [...new Uint8Array(d)].map((b) => b.toString(16).padStart(2, '0')).join('');
+}
+/** Org- or user-owned provider connections and their stored tokens. */
+function connectionsResource(request) {
+    // Tokens read by this client, reused until shortly before the provider's `expires_at`. A token with no expiry is never cached.
+    const cache = new Map();
+    const live = (t, minTtlSeconds) => !!t && t.expires_at !== null && t.expires_at - Date.now() > Math.max(minTtlSeconds * 1000, SKEW_MS);
+    const remember = (t) => {
+        if (t.expires_at !== null)
+            cache.set(t.connection_id, t);
+        else
+            cache.delete(t.connection_id);
+        return t;
+    };
+    return {
+        create(body, idempotencyKey) {
+            return request({ method: 'POST', path: '/v1/connections', body, idempotencyKey });
+        },
+        list(params = {}) {
+            return request({ method: 'GET', path: '/v1/connections', query: { ...params } });
+        },
+        get(id) {
+            return request({ method: 'GET', path: `/v1/connections/${(0, request_1.enc)(id)}` });
+        },
+        update(id, body) {
+            return request({ method: 'PATCH', path: `/v1/connections/${(0, request_1.enc)(id)}`, body });
+        },
+        /** Delete a connection. Pass `{ revoke: true }` to revoke at the provider first and learn what it said. */
+        delete(id, options = {}) {
+            cache.delete(id);
+            return request({ method: 'DELETE', path: `/v1/connections/${(0, request_1.enc)(id)}`, query: options.revoke ? { revoke: 'true' } : undefined });
+        },
+        /** Start the provider authorization; send the owner to `authorization_url`. */
+        connect(id, body) {
+            return request({ method: 'POST', path: `/v1/connections/${(0, request_1.enc)(id)}/connect`, body });
+        },
+        /** Revoke at the provider and forget the stored token. The answer says what the provider said (`provider_revoked`). */
+        revoke(id) {
+            cache.delete(id);
+            return request({ method: 'POST', path: `/v1/connections/${(0, request_1.enc)(id)}/revoke` });
+        },
+        /**
+         * The live token for your backend (refreshed when needed). Needs the `connections:token` scope.
+         * Reads are cached in this client until shortly before `expires_at` (and a cached read is `refreshed: false`),
+         * so calling it in a hot loop costs one request per connection per token lifetime.
+         */
+        async token(id, options = {}) {
+            const minTtl = options.minTtlSeconds ?? 0;
+            const hit = cache.get(id);
+            if (options.subject) {
+                return request({ method: 'GET', path: `/v1/connections/${(0, request_1.enc)(id)}/token`, query: { subject: options.subject, ...(options.refresh ? { refresh: 'true' } : {}) } });
+            }
+            if (!options.refresh && !options.noCache && live(hit, minTtl))
+                return { ...hit, refreshed: false };
+            const t = await request({
+                method: 'GET',
+                path: `/v1/connections/${(0, request_1.enc)(id)}/token`,
+                query: { ...(options.refresh ? { refresh: 'true' } : {}), ...(minTtl ? { min_ttl_seconds: String(minTtl) } : {}) },
+            });
+            return remember(t);
+        },
+        /**
+         * Call this when the provider answers 401 to a token you got from here. Pass the access token you were refused with
+         * (`staleAccessToken`): if Atlas already holds a newer one, you get it back without another call to the provider.
+         */
+        async refreshToken(id, options = {}) {
+            cache.delete(id);
+            const t = await request({
+                method: 'POST',
+                path: `/v1/connections/${(0, request_1.enc)(id)}/token/refresh`,
+                body: { reason: options.reason ?? 'provider_401', ...(options.staleAccessToken ? { stale_token_hash: await sha256Hex(options.staleAccessToken) } : {}) },
+            });
+            return remember(t);
+        },
+        /** Read up to 100 connections' tokens in one call. Each id has its own result, so one dead connection does not fail the rest. */
+        async tokens(ids, options = {}) {
+            const r = await request({
+                method: 'POST',
+                path: '/v1/connections/tokens/batch',
+                body: { ids, ...(options.minTtlSeconds ? { min_ttl_seconds: options.minTtlSeconds } : {}) },
+            });
+            for (const item of r.data)
+                if (item.status === 'ok' && item.token)
+                    remember(item.token);
+            return r;
+        },
+        /** Bulk-import existing provider refresh tokens (up to 500 per call). Needs the `connections:import` scope. */
+        importConnections(body, idempotencyKey) {
+            return request({ method: 'POST', path: '/v1/connections/import', body, idempotencyKey });
+        },
+        /**
+         * Export connections. Without `include_secrets` it lists metadata. With it (scope `connections:export_secrets`) the tokens
+         * come back as one compact JWE sealed to `recipient_public_key`; open it with the matching private key.
+         */
+        exportConnections(body = {}) {
+            return request({ method: 'POST', path: '/v1/connections/export', body, headers: body.include_secrets ? { 'x-atlas-confirm': 'export-secrets' } : undefined });
+        },
+        /** Enter the credential of a non-OAuth connection (write-only; sealed in the vault, never returned). */
+        setCredentials(id, body) {
+            return request({ method: 'PUT', path: `/v1/connections/${(0, request_1.enc)(id)}/credentials`, body });
+        },
+        /** Rotate the credential; the replaced version stays valid for `overlap_seconds`. */
+        rotateCredentials(id, body) {
+            return request({ method: 'POST', path: `/v1/connections/${(0, request_1.enc)(id)}/credentials/rotate`, body });
+        },
+        /** The credential's vault versions (numbers and times, never values). */
+        secretVersions(id) {
+            return request({ method: 'GET', path: `/v1/connections/${(0, request_1.enc)(id)}/credentials/versions` });
+        },
+        /**
+         * Read an api_key, bearer, basic, custom_header or hmac_secret credential. Needs the `connections:secret_read`
+         * scope; every read is audited. `version` is `current` (default), `previous` (inside a rotation's overlap
+         * window) or a number. With `organizationId` the connection must belong to that organization (404 otherwise).
+         */
+        secret(id, options = {}) {
+            const path = options.organizationId ? `/v1/organizations/${(0, request_1.enc)(options.organizationId)}/connections/${(0, request_1.enc)(id)}/secret` : `/v1/connections/${(0, request_1.enc)(id)}/secret`;
+            return request({ method: 'GET', path, query: options.version === undefined ? undefined : { version: String(options.version) } });
+        },
+        /** Have Atlas sign a request with an oauth1 connection (needs `connections:sign`). */
+        oauth1Sign(id, body) {
+            return request({ method: 'POST', path: `/v1/connections/${(0, request_1.enc)(id)}/oauth1/sign`, body });
+        },
+        webhooks: {
+            /** Verify a provider webhook signature (needs `connections:webhook_verify`). */
+            verify(id, body) {
+                return request({ method: 'POST', path: `/v1/connections/${(0, request_1.enc)(id)}/webhooks/verify`, body });
+            },
+            createEndpoint(id, body) {
+                return request({ method: 'POST', path: `/v1/connections/${(0, request_1.enc)(id)}/webhook_endpoints`, body });
+            },
+            listEndpoints(id) {
+                return request({ method: 'GET', path: `/v1/connections/${(0, request_1.enc)(id)}/webhook_endpoints` });
+            },
+            updateEndpoint(id, endpointId, body) {
+                return request({ method: 'PATCH', path: `/v1/connections/${(0, request_1.enc)(id)}/webhook_endpoints/${(0, request_1.enc)(endpointId)}`, body });
+            },
+            deleteEndpoint(id, endpointId) {
+                return request({ method: 'DELETE', path: `/v1/connections/${(0, request_1.enc)(id)}/webhook_endpoints/${(0, request_1.enc)(endpointId)}` });
+            },
+        },
+        oauthClients: {
+            set(body) {
+                return request({ method: 'PUT', path: '/v1/connections/oauth_clients', body });
+            },
+            list(params = {}) {
+                return request({ method: 'GET', path: '/v1/connections/oauth_clients', query: { ...params } });
+            },
+            get(id) {
+                return request({ method: 'GET', path: `/v1/connections/oauth_clients/${(0, request_1.enc)(id)}` });
+            },
+            delete(id) {
+                return request({ method: 'DELETE', path: `/v1/connections/oauth_clients/${(0, request_1.enc)(id)}` });
+            },
+        },
+    };
+}
+//# sourceMappingURL=connections.js.map

package/dist/client/connections.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"connections.js","sourceRoot":"","sources":["../../src/client/connections.ts"],"names":[],"mappings":";;AA2YA,kDAoJC;AA/hBD,uCAAgD;AAsRhD,MAAM,OAAO,GAAG,MAAM,CAAC;AAEvB,KAAK,UAAU,SAAS,CAAC,IAAY;IACnC,MAAM,CAAC,GAAG,MAAM,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;IAC3F,OAAO,CAAC,GAAG,IAAI,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;AACrF,CAAC;AA+GD,uEAAuE;AACvE,SAAgB,mBAAmB,CAAC,OAAkB;IACpD,+HAA+H;IAC/H,MAAM,KAAK,GAAG,IAAI,GAAG,EAA2B,CAAC;IACjD,MAAM,IAAI,GAAG,CAAC,CAA8B,EAAE,aAAqB,EAAwB,EAAE,CAC3F,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,UAAU,KAAK,IAAI,IAAI,CAAC,CAAC,UAAU,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,GAAG,CAAC,aAAa,GAAG,IAAI,EAAE,OAAO,CAAC,CAAC;IACtG,MAAM,QAAQ,GAAG,CAAC,CAAkB,EAAmB,EAAE;QACvD,IAAI,CAAC,CAAC,UAAU,KAAK,IAAI;YAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC;;YACpD,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC;QACnC,OAAO,CAAC,CAAC;IACX,CAAC,CAAC;IACF,OAAO;QACL,MAAM,CAAC,IAA0B,EAAE,cAAuB;YACxD,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,iBAAiB,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC;QACpF,CAAC;QACD,IAAI,CAAC,SAAgC,EAAE;YACrC,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,iBAAiB,EAAE,KAAK,EAAE,EAAE,GAAG,MAAM,EAAE,EAAE,CAAC,CAAC;QACnF,CAAC;QACD,GAAG,CAAC,EAAU;YACZ,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,mBAAmB,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;QACxE,CAAC;QACD,MAAM,CAAC,EAAU,EAAE,IAA0B;YAC3C,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,mBAAmB,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;QAChF,CAAC;QACD,2GAA2G;QAC3G,MAAM,CAA4B,EAAU,EAAE,UAA0B,EAAE;YACxE,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;YACjB,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,mBAAmB,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,KAAK,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC;QACnI,CAAC;QACD,+EAA+E;QAC/E,OAAO,CAAC,EAAU,EAAE,IAA2B;YAC7C,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,mBAAmB,IAAA,aAAG,EAAC,EAAE,CAAC,UAAU,EAAE,IAAI,EAAE,CAAC,CAAC;QACvF,CAAC;QACD,uHAAuH;QACvH,MAAM,CAAC,EAAU;YACf,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;YACjB,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,mBAAmB,IAAA,aAAG,EAAC,EAAE,CAAC,SAAS,EAAE,CAAC,CAAC;QAChF,CAAC;QACD;;;;WAIG;QACH,KAAK,CAAC,KAAK,CAAC,EAAU,EAAE,UAA4B,EAAE;YACpD,MAAM,MAAM,GAAG,OAAO,CAAC,aAAa,IAAI,CAAC,CAAC;YAC1C,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YAC1B,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC;gBACpB,OAAO,OAAO,CAAkB,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,mBAAmB,IAAA,aAAG,EAAC,EAAE,CAAC,QAAQ,EAAE,KAAK,EAAE,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;YACrL,CAAC;YACD,IAAI,CAAC,OAAO,CAAC,OAAO,IAAI,CAAC,OAAO,CAAC,OAAO,IAAI,IAAI,CAAC,GAAG,EAAE,MAAM,CAAC;gBAAE,OAAO,EAAE,GAAG,GAAG,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC;YACnG,MAAM,CAAC,GAAG,MAAM,OAAO,CAAkB;gBACvC,MAAM,EAAE,KAAK;gBACb,IAAI,EAAE,mBAAmB,IAAA,aAAG,EAAC,EAAE,CAAC,QAAQ;gBACxC,KAAK,EAAE,EAAE,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE;aACnH,CAAC,CAAC;YACH,OAAO,QAAQ,CAAC,CAAC,CAAC,CAAC;QACrB,CAAC;QACD;;;WAGG;QACH,KAAK,CAAC,YAAY,CAAC,EAAU,EAAE,UAAyF,EAAE;YACxH,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;YACjB,MAAM,CAAC,GAAG,MAAM,OAAO,CAAkB;gBACvC,MAAM,EAAE,MAAM;gBACd,IAAI,EAAE,mBAAmB,IAAA,aAAG,EAAC,EAAE,CAAC,gBAAgB;gBAChD,IAAI,EAAE,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,IAAI,cAAc,EAAE,GAAG,CAAC,OAAO,CAAC,gBAAgB,CAAC,CAAC,CAAC,EAAE,gBAAgB,EAAE,MAAM,SAAS,CAAC,OAAO,CAAC,gBAAgB,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE;aACzJ,CAAC,CAAC;YACH,OAAO,QAAQ,CAAC,CAAC,CAAC,CAAC;QACrB,CAAC;QACD,iIAAiI;QACjI,KAAK,CAAC,MAAM,CAAC,GAAa,EAAE,UAAsC,EAAE;YAClE,MAAM,CAAC,GAAG,MAAM,OAAO,CAAwE;gBAC7F,MAAM,EAAE,MAAM;gBACd,IAAI,EAAE,8BAA8B;gBACpC,IAAI,EAAE,EAAE,GAAG,EAAE,GAAG,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,OAAO,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE;aAC5F,CAAC,CAAC;YACH,KAAK,MAAM,IAAI,IAAI,CAAC,CAAC,IAAI;gBAAE,IAAI,IAAI,CAAC,MAAM,KAAK,IAAI,IAAI,IAAI,CAAC,KAAK;oBAAE,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YACxF,OAAO,CAAC,CAAC;QACX,CAAC;QACD,+GAA+G;QAC/G,iBAAiB,CAAC,IAA2B,EAAE,cAAuB;YACpE,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,wBAAwB,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC;QAC3F,CAAC;QACD;;;WAGG;QACH,iBAAiB,CAAC,OAA8B,EAAE;YAChD,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,wBAAwB,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,CAAC,eAAe,CAAC,CAAC,CAAC,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC;QAChK,CAAC;QACD,wGAAwG;QACxG,cAAc,CAAC,EAAU,EAAE,IAAkC;YAC3D,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,mBAAmB,IAAA,aAAG,EAAC,EAAE,CAAC,cAAc,EAAE,IAAI,EAAE,CAAC,CAAC;QAC1F,CAAC;QACD,qFAAqF;QACrF,iBAAiB,CAAC,EAAU,EAAE,IAAqC;YACjE,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,mBAAmB,IAAA,aAAG,EAAC,EAAE,CAAC,qBAAqB,EAAE,IAAI,EAAE,CAAC,CAAC;QAClG,CAAC;QACD,yEAAyE;QACzE,cAAc,CAAC,EAAU;YACvB,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,mBAAmB,IAAA,aAAG,EAAC,EAAE,CAAC,uBAAuB,EAAE,CAAC,CAAC;QAC7F,CAAC;QACD;;;;WAIG;QACH,MAAM,CAAC,EAAU,EAAE,UAAkF,EAAE;YACrG,MAAM,IAAI,GAAG,OAAO,CAAC,cAAc,CAAC,CAAC,CAAC,qBAAqB,IAAA,aAAG,EAAC,OAAO,CAAC,cAAc,CAAC,gBAAgB,IAAA,aAAG,EAAC,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC,mBAAmB,IAAA,aAAG,EAAC,EAAE,CAAC,SAAS,CAAC;YAC7J,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,EAAE,CAAC,CAAC;QACnI,CAAC;QACD,sFAAsF;QACtF,UAAU,CAAC,EAAU,EAAE,IAA4E;YACjG,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,mBAAmB,IAAA,aAAG,EAAC,EAAE,CAAC,cAAc,EAAE,IAAI,EAAE,CAAC,CAAC;QAC3F,CAAC;QACD,QAAQ,EAAE;YACR,gFAAgF;YAChF,MAAM,CAAC,EAAU,EAAE,IAAiC;gBAClD,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,mBAAmB,IAAA,aAAG,EAAC,EAAE,CAAC,kBAAkB,EAAE,IAAI,EAAE,CAAC,CAAC;YAC/F,CAAC;YACD,cAAc,CAAC,EAAU,EAAE,IAAyC;gBAClE,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,mBAAmB,IAAA,aAAG,EAAC,EAAE,CAAC,oBAAoB,EAAE,IAAI,EAAE,CAAC,CAAC;YACjG,CAAC;YACD,aAAa,CAAC,EAAU;gBACtB,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,mBAAmB,IAAA,aAAG,EAAC,EAAE,CAAC,oBAAoB,EAAE,CAAC,CAAC;YAC1F,CAAC;YACD,cAAc,CAAC,EAAU,EAAE,UAAkB,EAAE,IAA0E;gBACvH,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,mBAAmB,IAAA,aAAG,EAAC,EAAE,CAAC,sBAAsB,IAAA,aAAG,EAAC,UAAU,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;YACrH,CAAC;YACD,cAAc,CAAC,EAAU,EAAE,UAAkB;gBAC3C,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,mBAAmB,IAAA,aAAG,EAAC,EAAE,CAAC,sBAAsB,IAAA,aAAG,EAAC,UAAU,CAAC,EAAE,EAAE,CAAC,CAAC;YAChH,CAAC;SACF;QACD,YAAY,EAAE;YACZ,GAAG,CAAC,IAAkC;gBACpC,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,+BAA+B,EAAE,IAAI,EAAE,CAAC,CAAC;YACjF,CAAC;YACD,IAAI,CAAC,SAAqF,EAAE;gBAC1F,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,+BAA+B,EAAE,KAAK,EAAE,EAAE,GAAG,MAAM,EAAE,EAAE,CAAC,CAAC;YACjG,CAAC;YACD,GAAG,CAAC,EAAU;gBACZ,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,iCAAiC,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;YACtF,CAAC;YACD,MAAM,CAAC,EAAU;gBACf,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,iCAAiC,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;YACzF,CAAC;SACF;KACF,CAAC;AACJ,CAAC"}

package/dist/client/credentials.d.ts

@@ -39,6 +39,8 @@ export interface SecretKey extends StandardKey {
     allowed_ips: string[];
     /** Alias of `origin_allowlist`: browser origins the key may be used from (empty = any). */
     allowed_origins: string[];
+    /** Partner admin: the organizations the key is limited to (empty = unrestricted). */
+    organization_ids: string[];
     rotated_from: string | null;
     /** Provisioning tags (filter the list with `metadata`). */
     metadata?: Record<string, string | number | boolean>;
@@ -63,6 +65,10 @@ export interface CreateSecretKeyBody {
     allowed_ips?: string[];
     /** Browser origins (`https://app.example.com`, `https://*.example.com`) a request with an Origin must come from. */
     allowed_origins?: string[];
+    /**
+     * Partner admin: limit the key to these organizations. A limited key may call only the organization routes for them.
+     */
+    organization_ids?: string[];
     /** The person or service responsible. Default: whoever creates the key. */
     owner?: string | null;
     /** `atlas` (default) or `legacy`. */
@@ -260,6 +266,8 @@ export declare function secretKeysResource(request: RequestFn): {
         expires_at?: number | string | null;
         allowed_ips?: string[];
         allowed_origins?: string[];
+        /** `[]` lifts an organization limit. */
+        organization_ids?: string[];
         metadata?: Record<string, string | number | boolean> | null;
     }): Promise<SecretKey>;
     /** New key with the same scopes; the old one works for `overlap_seconds` (default 72 h, 0 = now). */

package/dist/client/credentials.js.map

@@ -1 +1 @@
-{"version":3,"file":"credentials.js","sourceRoot":"","sources":["../../src/client/credentials.ts"],"names":[],"mappings":";;AA+OA,wCAGC;AAED,gDAmCC;AAED,oCAOC;AAED,oDA8DC;AAED,sDA8BC;AA0DD,gDAgBC;AAOD,8DAKC;AAtdD,uCAA4D;AAG5D,0CAA+F;AA0O/F,MAAM,GAAG,GAAG,kBAAkB,CAAC;AAE/B,SAAgB,cAAc,CAAC,OAAkB;IAC/C,2CAA2C;IAC3C,OAAO,GAAoB,EAAE,CAAC,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC,CAAC;AAC/E,CAAC;AAED,SAAgB,kBAAkB,CAAC,OAAkB;IACnD,OAAO;QACL,MAAM,CAAC,IAAyB;YAC9B,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,iBAAiB,EAAE,IAAI,EAAE,CAAC,CAAC;QACpE,CAAC;QACD,wEAAwE;QACxE,IAAI,CAAC,SAAgD,EAAE;YACrD,MAAM,KAAK,GAA2B,EAAE,CAAC;YACzC,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,QAAQ,IAAI,EAAE,CAAC;gBAAE,KAAK,CAAC,YAAY,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YACxF,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,iBAAiB,EAAE,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;QAC9G,CAAC;QACD,GAAG,CAAC,EAAU;YACZ,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,mBAAmB,GAAG,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;QACxE,CAAC;QACD,MAAM,CACJ,EAAU,EACV,IAOC;YAED,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,mBAAmB,GAAG,CAAC,EAAE,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;QAChF,CAAC;QACD,qGAAqG;QACrG,MAAM,CAAC,EAAU,EAAE,OAAsE,EAAE;YACzF,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,mBAAmB,GAAG,CAAC,EAAE,CAAC,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACtF,CAAC;QACD,MAAM,CAAC,EAAU;YACf,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,mBAAmB,GAAG,CAAC,EAAE,CAAC,SAAS,EAAE,CAAC,CAAC;QAChF,CAAC;KACF,CAAC;AACJ,CAAC;AAED,SAAgB,YAAY,CAAC,OAAkB;IAC7C,OAAO;QACL,wDAAwD;QACxD,IAAI;YACF,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC,CAAC;QACtD,CAAC;KACF,CAAC;AACJ,CAAC;AAED,SAAgB,oBAAoB,CAAC,OAAkB;IACrD,OAAO;QACL,yHAAyH;QACzH,MAAM,CAAC,IAAsH;YAC3H,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,mBAAmB,EAAE,IAAI,EAAE,CAAC,CAAC;QACtE,CAAC;QACD,sEAAsE;QACtE,eAAe,CAAC,EAAU,EAAE,gBAA0B;YACpD,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,qBAAqB,GAAG,CAAC,EAAE,CAAC,EAAE,EAAE,IAAI,EAAE,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,EAAE,CAAC,CAAC;QAC3H,CAAC;QACD,QAAQ,EAAE;YACR,IAAI,CAAC,SAA0F,EAAE;gBAC/F,MAAM,KAAK,GAA2B,EAAE,CAAC;gBACzC,IAAI,MAAM,CAAC,SAAS;oBAAE,KAAK,CAAC,SAAS,GAAG,MAAM,CAAC,SAAS,CAAC;gBACzD,IAAI,MAAM,CAAC,MAAM,EAAE,MAAM;oBAAE,KAAK,CAAC,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;gBAClE,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,4BAA4B,EAAE,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;YACzH,CAAC;YACD,GAAG,CAAC,EAAU;gBACZ,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,8BAA8B,GAAG,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;YACnF,CAAC;YACD,2FAA2F;YAC3F,OAAO,CAAC,EAAU,EAAE,OAA4D,EAAE;gBAChF,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,8BAA8B,GAAG,CAAC,EAAE,CAAC,UAAU,EAAE,IAAI,EAAE,CAAC,CAAC;YAClG,CAAC;YACD,IAAI,CAAC,EAAU;gBACb,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,8BAA8B,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,CAAC;YACzF,CAAC;SACF;QACD,IAAI;YACF,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,mBAAmB,EAAE,CAAC,CAAC;QAC/D,CAAC;QACD,GAAG,CAAC,EAAU;YACZ,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,qBAAqB,GAAG,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;QAC1E,CAAC;QACD,YAAY,CAAC,EAAU;YACrB,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,qBAAqB,GAAG,CAAC,EAAE,CAAC,gBAAgB,EAAE,CAAC,CAAC;QACzF,CAAC;QACD,MAAM,CAAC,EAAU;YACf,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,qBAAqB,GAAG,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;QAC7E,CAAC;QACD,QAAQ,EAAE;YACR,IAAI;gBACF,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,4BAA4B,EAAE,CAAC,CAAC;YACxE,CAAC;YACD,IAAI,CAAC,OAAe,EAAE,IAAiC;gBACrD,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,8BAA8B,GAAG,CAAC,OAAO,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;YAC9F,CAAC;YACD,IAAI,CAAC,OAAe;gBAClB,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,8BAA8B,GAAG,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC;YAC9F,CAAC;YACD,MAAM,CAAC,OAAe;gBACpB,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,8BAA8B,GAAG,CAAC,OAAO,CAAC,EAAE,EAAE,CAAC,CAAC;YAC3F,CAAC;YACD,gGAAgG;YAChG,OAAO,CACL,OAAe,EACf,IAAmG;gBAEnG,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,8BAA8B,GAAG,CAAC,OAAO,CAAC,UAAU,EAAE,IAAI,EAAE,CAAC,CAAC;YACvG,CAAC;SACF;KACF,CAAC;AACJ,CAAC;AAED,SAAgB,qBAAqB,CAAC,OAAkB;IACtD,OAAO;QACL,mHAAmH;QACnH,QAAQ;YAaN,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,mBAAmB,EAAE,CAAC,CAAC;QAC/D,CAAC;QACD,oFAAoF;QACpF,SAAS,CAAC,KAAa;YACrB,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,qBAAqB,GAAG,CAAC,KAAK,CAAC,YAAY,EAAE,CAAC,CAAC;QACvF,CAAC;QACD,sEAAsE;QACtE,MAAM,CAAC,KAAa,EAAE,KAAa;YACjC,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,qBAAqB,GAAG,CAAC,KAAK,CAAC,QAAQ,EAAE,KAAK,EAAE,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC;QACrG,CAAC;QACD,MAAM,CAAC,KAAa,EAAE,OAAe;YACnC,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,qBAAqB,GAAG,CAAC,KAAK,CAAC,WAAW,GAAG,CAAC,OAAO,CAAC,EAAE,EAAE,CAAC,CAAC;QACvG,CAAC;KACF,CAAC;AACJ,CAAC;AAoDD;;;;;GAKG;AACI,KAAK,UAAU,kBAAkB,CACtC,KAA8B,EAC9B,OAAkD,EAAE;IAEpD,MAAM,IAAI,GAAG,CAAC,IAAI,CAAC,MAAM,IAAI,yBAAe,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IAClE,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,CAAC,GAAG,IAAI,2BAA2B,EAAE;QAC1E,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,MAAM,EAAE,kBAAkB,EAAE;QAC3E,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC;KAC5B,CAAC,CAAC;IACH,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAA4B,CAAC;IAC7E,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;QACZ,MAAM,KAAK,GAAI,IAAI,CAAC,MAAkD,EAAE,CAAC,CAAC,CAAC,CAAC;QAC5E,MAAM,IAAI,KAAK,CAAC,gDAAgD,GAAG,CAAC,MAAM,GAAG,KAAK,EAAE,OAAO,CAAC,CAAC,CAAC,KAAK,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC;IAC/H,CAAC;IACD,OAAO,IAA4C,CAAC;AACtD,CAAC;AAED;;;;GAIG;AACH,SAAgB,yBAAyB,CACvC,KAAqE;IAErE,MAAM,EAAE,aAAa,EAAE,GAAG,IAAI,EAAE,GAAG,KAAK,CAAC;IACzC,OAAO,IAAA,wBAAa,EAAsB,EAAE,GAAG,IAAI,EAAE,MAAM,EAAE,aAAa,EAAE,CAAC,CAAC;AAChF,CAAC"}
+{"version":3,"file":"credentials.js","sourceRoot":"","sources":["../../src/client/credentials.ts"],"names":[],"mappings":";;AAqPA,wCAGC;AAED,gDAqCC;AAED,oCAOC;AAED,oDA8DC;AAED,sDA8BC;AA0DD,gDAgBC;AAOD,8DAKC;AA9dD,uCAA4D;AAG5D,0CAA+F;AAgP/F,MAAM,GAAG,GAAG,kBAAkB,CAAC;AAE/B,SAAgB,cAAc,CAAC,OAAkB;IAC/C,2CAA2C;IAC3C,OAAO,GAAoB,EAAE,CAAC,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC,CAAC;AAC/E,CAAC;AAED,SAAgB,kBAAkB,CAAC,OAAkB;IACnD,OAAO;QACL,MAAM,CAAC,IAAyB;YAC9B,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,iBAAiB,EAAE,IAAI,EAAE,CAAC,CAAC;QACpE,CAAC;QACD,wEAAwE;QACxE,IAAI,CAAC,SAAgD,EAAE;YACrD,MAAM,KAAK,GAA2B,EAAE,CAAC;YACzC,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,QAAQ,IAAI,EAAE,CAAC;gBAAE,KAAK,CAAC,YAAY,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YACxF,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,iBAAiB,EAAE,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;QAC9G,CAAC;QACD,GAAG,CAAC,EAAU;YACZ,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,mBAAmB,GAAG,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;QACxE,CAAC;QACD,MAAM,CACJ,EAAU,EACV,IASC;YAED,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,mBAAmB,GAAG,CAAC,EAAE,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;QAChF,CAAC;QACD,qGAAqG;QACrG,MAAM,CAAC,EAAU,EAAE,OAAsE,EAAE;YACzF,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,mBAAmB,GAAG,CAAC,EAAE,CAAC,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACtF,CAAC;QACD,MAAM,CAAC,EAAU;YACf,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,mBAAmB,GAAG,CAAC,EAAE,CAAC,SAAS,EAAE,CAAC,CAAC;QAChF,CAAC;KACF,CAAC;AACJ,CAAC;AAED,SAAgB,YAAY,CAAC,OAAkB;IAC7C,OAAO;QACL,wDAAwD;QACxD,IAAI;YACF,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC,CAAC;QACtD,CAAC;KACF,CAAC;AACJ,CAAC;AAED,SAAgB,oBAAoB,CAAC,OAAkB;IACrD,OAAO;QACL,yHAAyH;QACzH,MAAM,CAAC,IAAsH;YAC3H,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,mBAAmB,EAAE,IAAI,EAAE,CAAC,CAAC;QACtE,CAAC;QACD,sEAAsE;QACtE,eAAe,CAAC,EAAU,EAAE,gBAA0B;YACpD,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,qBAAqB,GAAG,CAAC,EAAE,CAAC,EAAE,EAAE,IAAI,EAAE,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,EAAE,CAAC,CAAC;QAC3H,CAAC;QACD,QAAQ,EAAE;YACR,IAAI,CAAC,SAA0F,EAAE;gBAC/F,MAAM,KAAK,GAA2B,EAAE,CAAC;gBACzC,IAAI,MAAM,CAAC,SAAS;oBAAE,KAAK,CAAC,SAAS,GAAG,MAAM,CAAC,SAAS,CAAC;gBACzD,IAAI,MAAM,CAAC,MAAM,EAAE,MAAM;oBAAE,KAAK,CAAC,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;gBAClE,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,4BAA4B,EAAE,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;YACzH,CAAC;YACD,GAAG,CAAC,EAAU;gBACZ,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,8BAA8B,GAAG,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;YACnF,CAAC;YACD,2FAA2F;YAC3F,OAAO,CAAC,EAAU,EAAE,OAA4D,EAAE;gBAChF,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,8BAA8B,GAAG,CAAC,EAAE,CAAC,UAAU,EAAE,IAAI,EAAE,CAAC,CAAC;YAClG,CAAC;YACD,IAAI,CAAC,EAAU;gBACb,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,8BAA8B,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,CAAC;YACzF,CAAC;SACF;QACD,IAAI;YACF,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,mBAAmB,EAAE,CAAC,CAAC;QAC/D,CAAC;QACD,GAAG,CAAC,EAAU;YACZ,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,qBAAqB,GAAG,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;QAC1E,CAAC;QACD,YAAY,CAAC,EAAU;YACrB,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,qBAAqB,GAAG,CAAC,EAAE,CAAC,gBAAgB,EAAE,CAAC,CAAC;QACzF,CAAC;QACD,MAAM,CAAC,EAAU;YACf,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,qBAAqB,GAAG,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;QAC7E,CAAC;QACD,QAAQ,EAAE;YACR,IAAI;gBACF,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,4BAA4B,EAAE,CAAC,CAAC;YACxE,CAAC;YACD,IAAI,CAAC,OAAe,EAAE,IAAiC;gBACrD,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,8BAA8B,GAAG,CAAC,OAAO,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;YAC9F,CAAC;YACD,IAAI,CAAC,OAAe;gBAClB,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,8BAA8B,GAAG,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC;YAC9F,CAAC;YACD,MAAM,CAAC,OAAe;gBACpB,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,8BAA8B,GAAG,CAAC,OAAO,CAAC,EAAE,EAAE,CAAC,CAAC;YAC3F,CAAC;YACD,gGAAgG;YAChG,OAAO,CACL,OAAe,EACf,IAAmG;gBAEnG,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,8BAA8B,GAAG,CAAC,OAAO,CAAC,UAAU,EAAE,IAAI,EAAE,CAAC,CAAC;YACvG,CAAC;SACF;KACF,CAAC;AACJ,CAAC;AAED,SAAgB,qBAAqB,CAAC,OAAkB;IACtD,OAAO;QACL,mHAAmH;QACnH,QAAQ;YAaN,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,mBAAmB,EAAE,CAAC,CAAC;QAC/D,CAAC;QACD,oFAAoF;QACpF,SAAS,CAAC,KAAa;YACrB,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,qBAAqB,GAAG,CAAC,KAAK,CAAC,YAAY,EAAE,CAAC,CAAC;QACvF,CAAC;QACD,sEAAsE;QACtE,MAAM,CAAC,KAAa,EAAE,KAAa;YACjC,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,qBAAqB,GAAG,CAAC,KAAK,CAAC,QAAQ,EAAE,KAAK,EAAE,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC;QACrG,CAAC;QACD,MAAM,CAAC,KAAa,EAAE,OAAe;YACnC,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,qBAAqB,GAAG,CAAC,KAAK,CAAC,WAAW,GAAG,CAAC,OAAO,CAAC,EAAE,EAAE,CAAC,CAAC;QACvG,CAAC;KACF,CAAC;AACJ,CAAC;AAoDD;;;;;GAKG;AACI,KAAK,UAAU,kBAAkB,CACtC,KAA8B,EAC9B,OAAkD,EAAE;IAEpD,MAAM,IAAI,GAAG,CAAC,IAAI,CAAC,MAAM,IAAI,yBAAe,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IAClE,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,CAAC,GAAG,IAAI,2BAA2B,EAAE;QAC1E,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,MAAM,EAAE,kBAAkB,EAAE;QAC3E,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC;KAC5B,CAAC,CAAC;IACH,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAA4B,CAAC;IAC7E,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;QACZ,MAAM,KAAK,GAAI,IAAI,CAAC,MAAkD,EAAE,CAAC,CAAC,CAAC,CAAC;QAC5E,MAAM,IAAI,KAAK,CAAC,gDAAgD,GAAG,CAAC,MAAM,GAAG,KAAK,EAAE,OAAO,CAAC,CAAC,CAAC,KAAK,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC;IAC/H,CAAC;IACD,OAAO,IAA4C,CAAC;AACtD,CAAC;AAED;;;;GAIG;AACH,SAAgB,yBAAyB,CACvC,KAAqE;IAErE,MAAM,EAAE,aAAa,EAAE,GAAG,IAAI,EAAE,GAAG,KAAK,CAAC;IACzC,OAAO,IAAA,wBAAa,EAAsB,EAAE,GAAG,IAAI,EAAE,MAAM,EAAE,aAAa,EAAE,CAAC,CAAC;AAChF,CAAC"}

package/dist/client/custom-oauth-providers.d.ts

@@ -42,6 +42,11 @@ export interface ProfileMapping {
     update_on_sign_in?: boolean;
 }
 export type TokenEndpointAuthMethod = 'client_secret_basic' | 'client_secret_post' | 'client_secret_jwt' | 'private_key_jwt' | 'none';
+/** One connect-time host value: `{name}` in an endpoint URL is filled from `host_params.name`, which must match `pattern` as a whole. */
+export interface HostParamsSchemaEntry {
+    name: string;
+    pattern: string;
+}
 export interface UpstreamLogoutSettings {
     /** On Atlas sign-out, hand back the provider end-session URL to send the browser to. */
     rp_initiated?: boolean;
@@ -88,6 +93,11 @@ export interface CustomOAuthProviderSettings {
     userinfo_endpoint?: string | null;
     jwks_uri?: string | null;
     end_session_endpoint?: string | null;
+    revocation_endpoint?: string | null;
+    /** The connect-time `host_params` the `{name}` templates in the endpoints take (data-only providers, OAuth 2.0). */
+    host_params_schema?: HostParamsSchemaEntry[] | null;
+    /** Never a sign-in method: only connections use it. Required for endpoints with `{name}` templates. */
+    data_only?: boolean;
     scopes?: string[];
     scope_separator?: ' ' | ',' | '+';
     pkce?: boolean;
@@ -125,6 +135,11 @@ export interface CustomOAuthProvider extends UpstreamUrls {
     userinfo_endpoint: string | null;
     jwks_uri: string | null;
     end_session_endpoint: string | null;
+    /** RFC 7009 revoke endpoint; may carry `{name}` host templates. */
+    revocation_endpoint: string | null;
+    host_params_schema: HostParamsSchemaEntry[];
+    /** A data-only provider serves connections and is never a sign-in method. */
+    data_only: boolean;
     scopes: string[];
     scope_separator: ' ' | ',' | '+';
     pkce: boolean;

package/dist/client/custom-oauth-providers.js.map

@@ -1 +1 @@
-{"version":3,"file":"custom-oauth-providers.js","sourceRoot":"","sources":["../../src/client/custom-oauth-providers.ts"],"names":[],"mappings":";;AAqOA,kDAcC;AAED,oEAqCC;AA1RD,uCAAgD;AAoOhD,kFAAkF;AAClF,SAAgB,mBAAmB,CAAC,OAAkB,EAAE,IAAY;IAClE,OAAO;QACL,IAAI;YACF,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,IAAI,eAAe,EAAE,CAAC,CAAC;QAClE,CAAC;QACD,sFAAsF;QACtF,MAAM,CAAC,OAA8C,EAAE,EAAE,cAAuB;YAC9E,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,IAAI,eAAe,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC;QACzF,CAAC;QACD,oDAAoD;QACpD,MAAM,CAAC,GAAW;YAChB,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,IAAI,iBAAiB,IAAA,aAAG,EAAC,GAAG,CAAC,SAAS,EAAE,CAAC,CAAC;QACtF,CAAC;KACF,CAAC;AACJ,CAAC;AAED,SAAgB,4BAA4B,CAAC,OAAkB;IAC7D,MAAM,IAAI,GAAG,CAAC,EAAU,EAAE,EAAE,CAAC,8BAA8B,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,CAAC;IACrE,OAAO;QACL,IAAI;YACF,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,4BAA4B,EAAE,CAAC,CAAC;QACxE,CAAC;QACD,GAAG,CAAC,EAAU;YACZ,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;QACpD,CAAC;QACD,MAAM,CAAC,IAAmC,EAAE,cAAuB;YACjE,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,4BAA4B,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC;QAC/F,CAAC;QACD,MAAM,CAAC,EAAU,EAAE,IAAiC,EAAE,cAAuB;YAC3E,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,CAAC,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC;QAC5E,CAAC;QACD,MAAM,CAAC,EAAU;YACf,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;QACvD,CAAC;QACD,wEAAwE;QACxE,QAAQ,CAAC,IAAgD;YACvD,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,qCAAqC,EAAE,IAAI,EAAE,CAAC,CAAC;QACxF,CAAC;QACD;;;WAGG;QACH,qBAAqB,CAAC,IAA+B,EAAE,EAAW;YAChE,OAAO,OAAO,CAAC;gBACb,MAAM,EAAE,MAAM;gBACd,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,EAAE,CAAC,0BAA0B,CAAC,CAAC,CAAC,oDAAoD;gBACvG,IAAI;aACL,CAAC,CAAC;QACL,CAAC;QACD,WAAW,CAAC,EAAU;YACpB,OAAO,mBAAmB,CAAC,OAAO,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC;QAChD,CAAC;KACF,CAAC;AACJ,CAAC"}
+{"version":3,"file":"custom-oauth-providers.js","sourceRoot":"","sources":["../../src/client/custom-oauth-providers.ts"],"names":[],"mappings":";;AAqPA,kDAcC;AAED,oEAqCC;AA1SD,uCAAgD;AAoPhD,kFAAkF;AAClF,SAAgB,mBAAmB,CAAC,OAAkB,EAAE,IAAY;IAClE,OAAO;QACL,IAAI;YACF,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,IAAI,eAAe,EAAE,CAAC,CAAC;QAClE,CAAC;QACD,sFAAsF;QACtF,MAAM,CAAC,OAA8C,EAAE,EAAE,cAAuB;YAC9E,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,IAAI,eAAe,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC;QACzF,CAAC;QACD,oDAAoD;QACpD,MAAM,CAAC,GAAW;YAChB,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,IAAI,iBAAiB,IAAA,aAAG,EAAC,GAAG,CAAC,SAAS,EAAE,CAAC,CAAC;QACtF,CAAC;KACF,CAAC;AACJ,CAAC;AAED,SAAgB,4BAA4B,CAAC,OAAkB;IAC7D,MAAM,IAAI,GAAG,CAAC,EAAU,EAAE,EAAE,CAAC,8BAA8B,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,CAAC;IACrE,OAAO;QACL,IAAI;YACF,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,4BAA4B,EAAE,CAAC,CAAC;QACxE,CAAC;QACD,GAAG,CAAC,EAAU;YACZ,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;QACpD,CAAC;QACD,MAAM,CAAC,IAAmC,EAAE,cAAuB;YACjE,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,4BAA4B,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC;QAC/F,CAAC;QACD,MAAM,CAAC,EAAU,EAAE,IAAiC,EAAE,cAAuB;YAC3E,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,CAAC,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC;QAC5E,CAAC;QACD,MAAM,CAAC,EAAU;YACf,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;QACvD,CAAC;QACD,wEAAwE;QACxE,QAAQ,CAAC,IAAgD;YACvD,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,qCAAqC,EAAE,IAAI,EAAE,CAAC,CAAC;QACxF,CAAC;QACD;;;WAGG;QACH,qBAAqB,CAAC,IAA+B,EAAE,EAAW;YAChE,OAAO,OAAO,CAAC;gBACb,MAAM,EAAE,MAAM;gBACd,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,EAAE,CAAC,0BAA0B,CAAC,CAAC,CAAC,oDAAoD;gBACvG,IAAI;aACL,CAAC,CAAC;QACL,CAAC;QACD,WAAW,CAAC,EAAU;YACpB,OAAO,mBAAmB,CAAC,OAAO,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC;QAChD,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/client/delegated-ui-proxy.d.ts

@@ -0,0 +1,25 @@
+import type { AtlasClient } from './index';
+type Atlas = Pick<AtlasClient, 'oauthClients'>;
+export interface ProxyRequest {
+    method: string;
+    /** Path under your mount point: `login`, `login/accept`, `login/reject`, `consent`, `consent/accept`, `consent/reject`. */
+    path: string;
+    query: Record<string, string | undefined>;
+    body?: unknown;
+}
+export interface ProxyResponse {
+    status: number;
+    body: unknown;
+}
+/**
+ * The backend half of the browser helper `createDelegatedUiClient` (@atlasauth/js).
+ * Mount it under any route; it forwards the challenge calls to Atlas with your
+ * secret key. YOU must authenticate the visitor before letting an `accept`
+ * through: pass `authorize` to decide (return the Atlas user id for a login
+ * accept, or throw / return null to refuse).
+ */
+export declare function delegatedUiProxy(atlas: Atlas, opts: {
+    /** Called for `login/accept` and `consent/*`; return the Atlas user id the visitor is, or null to refuse. */
+    authorize: (req: ProxyRequest) => Promise<string | null> | string | null;
+}): (req: ProxyRequest) => Promise<ProxyResponse>;
+export {};

package/dist/client/delegated-ui-proxy.js

@@ -0,0 +1,46 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.delegatedUiProxy = delegatedUiProxy;
+/**
+ * The backend half of the browser helper `createDelegatedUiClient` (@atlasauth/js).
+ * Mount it under any route; it forwards the challenge calls to Atlas with your
+ * secret key. YOU must authenticate the visitor before letting an `accept`
+ * through: pass `authorize` to decide (return the Atlas user id for a login
+ * accept, or throw / return null to refuse).
+ */
+function delegatedUiProxy(atlas, opts) {
+    return async function handle(req) {
+        const login = req.query.login_challenge;
+        const consent = req.query.consent_challenge;
+        const body = (req.body ?? {});
+        try {
+            const route = `${req.method.toUpperCase()} ${req.path.replace(/^\/|\/$/g, '')}`;
+            if (route === 'GET login' && login)
+                return { status: 200, body: await atlas.oauthClients.loginRequests.get(login) };
+            if (route === 'GET consent' && consent)
+                return { status: 200, body: await atlas.oauthClients.consentRequests.get(consent) };
+            if (route === 'POST login/reject' && login)
+                return { status: 200, body: await atlas.oauthClients.loginRequests.reject(login, body) };
+            if (route === 'POST consent/reject' && consent)
+                return { status: 200, body: await atlas.oauthClients.consentRequests.reject(consent, body) };
+            if (route === 'POST login/accept' && login) {
+                const subject = await opts.authorize(req);
+                if (!subject)
+                    return { status: 401, body: { error: { message: 'Not signed in.' } } };
+                // The subject is decided by your authorize(), never by the browser.
+                return { status: 200, body: await atlas.oauthClients.loginRequests.accept(login, { ...body, subject }) };
+            }
+            if (route === 'POST consent/accept' && consent) {
+                if (!(await opts.authorize(req)))
+                    return { status: 401, body: { error: { message: 'Not signed in.' } } };
+                return { status: 200, body: await atlas.oauthClients.consentRequests.accept(consent, body) };
+            }
+            return { status: 404, body: { error: { message: 'Unknown route.' } } };
+        }
+        catch (e) {
+            const status = e.status ?? 502;
+            return { status, body: { error: { message: e instanceof Error ? e.message : 'Request failed.' } } };
+        }
+    };
+}
+//# sourceMappingURL=delegated-ui-proxy.js.map

package/dist/client/delegated-ui-proxy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"delegated-ui-proxy.js","sourceRoot":"","sources":["../../src/client/delegated-ui-proxy.ts"],"names":[],"mappings":";;AAuBA,4CAiCC;AAxCD;;;;;;GAMG;AACH,SAAgB,gBAAgB,CAC9B,KAAY,EACZ,IAGC;IAED,OAAO,KAAK,UAAU,MAAM,CAAC,GAAiB;QAC5C,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,eAAe,CAAC;QACxC,MAAM,OAAO,GAAG,GAAG,CAAC,KAAK,CAAC,iBAAiB,CAAC;QAC5C,MAAM,IAAI,GAAG,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,CAA4B,CAAC;QACzD,IAAI,CAAC;YACH,MAAM,KAAK,GAAG,GAAG,GAAG,CAAC,MAAM,CAAC,WAAW,EAAE,IAAI,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,EAAE,CAAC;YAChF,IAAI,KAAK,KAAK,WAAW,IAAI,KAAK;gBAAE,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,MAAM,KAAK,CAAC,YAAY,CAAC,aAAa,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;YACpH,IAAI,KAAK,KAAK,aAAa,IAAI,OAAO;gBAAE,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,MAAM,KAAK,CAAC,YAAY,CAAC,eAAe,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;YAC5H,IAAI,KAAK,KAAK,mBAAmB,IAAI,KAAK;gBAAE,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,MAAM,KAAK,CAAC,YAAY,CAAC,aAAa,CAAC,MAAM,CAAC,KAAK,EAAE,IAAI,CAAC,EAAE,CAAC;YACrI,IAAI,KAAK,KAAK,qBAAqB,IAAI,OAAO;gBAAE,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,MAAM,KAAK,CAAC,YAAY,CAAC,eAAe,CAAC,MAAM,CAAC,OAAO,EAAE,IAAI,CAAC,EAAE,CAAC;YAC7I,IAAI,KAAK,KAAK,mBAAmB,IAAI,KAAK,EAAE,CAAC;gBAC3C,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;gBAC1C,IAAI,CAAC,OAAO;oBAAE,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,EAAE,OAAO,EAAE,gBAAgB,EAAE,EAAE,EAAE,CAAC;gBACrF,oEAAoE;gBACpE,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,MAAM,KAAK,CAAC,YAAY,CAAC,aAAa,CAAC,MAAM,CAAC,KAAK,EAAE,EAAE,GAAG,IAAI,EAAE,OAAO,EAAyB,CAAC,EAAE,CAAC;YAClI,CAAC;YACD,IAAI,KAAK,KAAK,qBAAqB,IAAI,OAAO,EAAE,CAAC;gBAC/C,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;oBAAE,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,EAAE,OAAO,EAAE,gBAAgB,EAAE,EAAE,EAAE,CAAC;gBACzG,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,MAAM,KAAK,CAAC,YAAY,CAAC,eAAe,CAAC,MAAM,CAAC,OAAO,EAAE,IAAI,CAAC,EAAE,CAAC;YAC/F,CAAC;YACD,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,EAAE,OAAO,EAAE,gBAAgB,EAAE,EAAE,EAAE,CAAC;QACzE,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,MAAM,MAAM,GAAI,CAAyB,CAAC,MAAM,IAAI,GAAG,CAAC;YACxD,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,EAAE,OAAO,EAAE,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,iBAAiB,EAAE,EAAE,EAAE,CAAC;QACtG,CAAC;IACH,CAAC,CAAC;AACJ,CAAC"}

package/dist/client/desktop-mfa.d.ts

@@ -0,0 +1,104 @@
+import { type RequestFn } from './request';
+export type DesktopMfaFactor = 'push' | 'totp' | 'passkey';
+/** Who must pass a second factor at workstation login, with which factors, and how long offline unlock lasts. */
+export interface DesktopMfaPolicy {
+    object: 'desktop_mfa_policy';
+    enabled: boolean;
+    applies_to: 'all' | 'selected';
+    user_ids: string[];
+    org_ids: string[];
+    allowed_factors: DesktopMfaFactor[];
+    offline_enabled: boolean;
+    offline_grace_hours: number;
+    offline_pin_required: boolean;
+    /** `account`: any passkey the user holds answers the passkey factor. `device`: only keys registered through that workstation. */
+    passkey_scope: 'account' | 'device';
+    /** Relying-party domain the agents use; null uses the application's passkey RP id. */
+    passkey_rp_id: string | null;
+    passkey_require_uv: boolean;
+}
+/** A passkey registered through a workstation. It answers the desktop passkey factor and never a web sign-in. */
+export interface DesktopPasskey {
+    object: 'desktop_passkey';
+    id: string;
+    device_id: string;
+    user_id: string;
+    name: string | null;
+    aaguid: string | null;
+    transports: string[];
+    backed_up: boolean;
+    last_used_at: number | null;
+    created_at: number;
+}
+export type UpdateDesktopMfaPolicyBody = Partial<Omit<DesktopMfaPolicy, 'object'>>;
+/** A workstation running the Atlas Windows or macOS login agent. */
+export interface DesktopDevice {
+    object: 'desktop_device';
+    id: string;
+    user_id: string;
+    device_key_id: string;
+    hostname: string | null;
+    platform: 'windows' | 'macos' | 'linux';
+    agent_version: string | null;
+    status: 'active' | 'revoked';
+    offline_pin_set: boolean;
+    /** Raised to void every offline verifier issued so far. */
+    bundle_generation: number;
+    last_seen_at: number | null;
+    revoked_at: number | null;
+    created_at: number;
+}
+export interface DesktopDeviceDetail extends DesktopDevice {
+    offline_bundles: Array<{
+        id: string;
+        generation: number;
+        issued_at: number;
+        expires_at: number;
+        revoked_at: number | null;
+    }>;
+}
+export interface DesktopEnrolmentCode {
+    object: 'desktop_enrolment_code';
+    /** Shown once. The user types it into the workstation agent. */
+    code: string;
+    expires_at: number;
+    user_id: string;
+}
+/** Desktop-login MFA: policy, enrolment codes and enrolled workstations. */
+export declare function desktopMfaResource(request: RequestFn): {
+    getPolicy(): Promise<DesktopMfaPolicy>;
+    /** Send only the fields to change. */
+    updatePolicy(body: UpdateDesktopMfaPolicyBody): Promise<DesktopMfaPolicy>;
+    /** A single-use code for a user to enrol a workstation (default 60 minutes, at most 7 days). */
+    createEnrolmentCode(body: {
+        user_id: string;
+        expires_in_minutes?: number;
+    }): Promise<DesktopEnrolmentCode>;
+    listDevices(query?: {
+        user_id?: string;
+    }): Promise<{
+        object: "list";
+        data: DesktopDevice[];
+        has_more: boolean;
+    }>;
+    getDevice(id: string): Promise<DesktopDeviceDetail>;
+    listDevicePasskeys(id: string): Promise<{
+        object: "list";
+        data: DesktopPasskey[];
+        has_more: boolean;
+    }>;
+    deleteDevicePasskey(id: string, passkeyId: string): Promise<{
+        object: "desktop_passkey";
+        id: string;
+        deleted: boolean;
+    }>;
+    /** The workstation's next call is refused and it wipes its offline cache. */
+    revokeDevice(id: string): Promise<DesktopDevice>;
+    /** Void every offline verifier without revoking the workstation; it gets a fresh one on its next sync. */
+    revokeOfflineCache(id: string): Promise<DesktopDevice>;
+    deleteDevice(id: string): Promise<{
+        object: "desktop_device";
+        id: string;
+        deleted: boolean;
+    }>;
+};

package/dist/client/desktop-mfa.js

@@ -0,0 +1,44 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.desktopMfaResource = desktopMfaResource;
+const request_1 = require("./request");
+/** Desktop-login MFA: policy, enrolment codes and enrolled workstations. */
+function desktopMfaResource(request) {
+    return {
+        getPolicy() {
+            return request({ method: 'GET', path: '/v1/desktop_mfa/policy' });
+        },
+        /** Send only the fields to change. */
+        updatePolicy(body) {
+            return request({ method: 'PUT', path: '/v1/desktop_mfa/policy', body });
+        },
+        /** A single-use code for a user to enrol a workstation (default 60 minutes, at most 7 days). */
+        createEnrolmentCode(body) {
+            return request({ method: 'POST', path: '/v1/desktop_mfa/enrolment_codes', body });
+        },
+        listDevices(query = {}) {
+            return request({ method: 'GET', path: '/v1/desktop_mfa/devices', query });
+        },
+        getDevice(id) {
+            return request({ method: 'GET', path: `/v1/desktop_mfa/devices/${(0, request_1.enc)(id)}` });
+        },
+        listDevicePasskeys(id) {
+            return request({ method: 'GET', path: `/v1/desktop_mfa/devices/${(0, request_1.enc)(id)}/passkeys` });
+        },
+        deleteDevicePasskey(id, passkeyId) {
+            return request({ method: 'DELETE', path: `/v1/desktop_mfa/devices/${(0, request_1.enc)(id)}/passkeys/${(0, request_1.enc)(passkeyId)}` });
+        },
+        /** The workstation's next call is refused and it wipes its offline cache. */
+        revokeDevice(id) {
+            return request({ method: 'POST', path: `/v1/desktop_mfa/devices/${(0, request_1.enc)(id)}/revoke` });
+        },
+        /** Void every offline verifier without revoking the workstation; it gets a fresh one on its next sync. */
+        revokeOfflineCache(id) {
+            return request({ method: 'POST', path: `/v1/desktop_mfa/devices/${(0, request_1.enc)(id)}/revoke_offline_cache` });
+        },
+        deleteDevice(id) {
+            return request({ method: 'DELETE', path: `/v1/desktop_mfa/devices/${(0, request_1.enc)(id)}` });
+        },
+    };
+}
+//# sourceMappingURL=desktop-mfa.js.map

package/dist/client/desktop-mfa.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"desktop-mfa.js","sourceRoot":"","sources":["../../src/client/desktop-mfa.ts"],"names":[],"mappings":";;AAqEA,gDAqCC;AA1GD,uCAAgD;AAoEhD,4EAA4E;AAC5E,SAAgB,kBAAkB,CAAC,OAAkB;IACnD,OAAO;QACL,SAAS;YACP,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,wBAAwB,EAAE,CAAC,CAAC;QACpE,CAAC;QACD,sCAAsC;QACtC,YAAY,CAAC,IAAgC;YAC3C,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,wBAAwB,EAAE,IAAI,EAAE,CAAC,CAAC;QAC1E,CAAC;QACD,gGAAgG;QAChG,mBAAmB,CAAC,IAAsD;YACxE,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,iCAAiC,EAAE,IAAI,EAAE,CAAC,CAAC;QACpF,CAAC;QACD,WAAW,CAAC,QAA8B,EAAE;YAC1C,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,yBAAyB,EAAE,KAAK,EAAE,CAAC,CAAC;QAC5E,CAAC;QACD,SAAS,CAAC,EAAU;YAClB,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,2BAA2B,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;QAChF,CAAC;QACD,kBAAkB,CAAC,EAAU;YAC3B,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,2BAA2B,IAAA,aAAG,EAAC,EAAE,CAAC,WAAW,EAAE,CAAC,CAAC;QACzF,CAAC;QACD,mBAAmB,CAAC,EAAU,EAAE,SAAiB;YAC/C,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,2BAA2B,IAAA,aAAG,EAAC,EAAE,CAAC,aAAa,IAAA,aAAG,EAAC,SAAS,CAAC,EAAE,EAAE,CAAC,CAAC;QAC9G,CAAC;QACD,6EAA6E;QAC7E,YAAY,CAAC,EAAU;YACrB,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,2BAA2B,IAAA,aAAG,EAAC,EAAE,CAAC,SAAS,EAAE,CAAC,CAAC;QACxF,CAAC;QACD,0GAA0G;QAC1G,kBAAkB,CAAC,EAAU;YAC3B,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,2BAA2B,IAAA,aAAG,EAAC,EAAE,CAAC,uBAAuB,EAAE,CAAC,CAAC;QACtG,CAAC;QACD,YAAY,CAAC,EAAU;YACrB,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,2BAA2B,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;QACnF,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/client/devices.d.ts

@@ -0,0 +1,44 @@
+import { type RequestFn } from './request';
+import type { ListPage } from './types';
+export interface Device {
+    object: 'device';
+    id: string;
+    user_id: string | null;
+    source: string;
+    external_id: string;
+    name: string | null;
+    platform: string | null;
+    managed: boolean;
+    compliant: boolean;
+    posture: Record<string, unknown>;
+    last_reported_at: number;
+    created_at: number;
+}
+/** One posture report. Identify the owner with `user_id` or a verified `user_email`. */
+export interface DeviceReportBody {
+    external_id: string;
+    /** Who reported it (`intune`, `jamf`, …); defaults to `api`. */
+    source?: string;
+    user_id?: string | null;
+    user_email?: string;
+    name?: string | null;
+    platform?: string | null;
+    managed?: boolean;
+    compliant?: boolean;
+    posture?: Record<string, unknown>;
+}
+export declare function devicesResource(request: RequestFn): {
+    list(query?: {
+        user_id?: string;
+        source?: string;
+    }): Promise<ListPage<Device>>;
+    get(id: string): Promise<Device>;
+    report(body: DeviceReportBody): Promise<Device>;
+    /** Bulk posture ingestion, up to 500 reports. */
+    ingestPosture(devices: DeviceReportBody[]): Promise<ListPage<Device>>;
+    remove(id: string): Promise<{
+        object: "device";
+        id: string;
+        deleted: true;
+    }>;
+};

package/dist/client/devices.js

@@ -0,0 +1,26 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.devicesResource = devicesResource;
+const request_1 = require("./request");
+function devicesResource(request) {
+    return {
+        list(query = {}) {
+            const q = new URLSearchParams(Object.entries(query).filter((e) => e[1] !== undefined)).toString();
+            return request({ method: 'GET', path: `/v1/devices${q ? `?${q}` : ''}` });
+        },
+        get(id) {
+            return request({ method: 'GET', path: `/v1/devices/${(0, request_1.enc)(id)}` });
+        },
+        report(body) {
+            return request({ method: 'PUT', path: '/v1/devices', body });
+        },
+        /** Bulk posture ingestion, up to 500 reports. */
+        ingestPosture(devices) {
+            return request({ method: 'POST', path: '/v1/device_posture', body: { devices } });
+        },
+        remove(id) {
+            return request({ method: 'DELETE', path: `/v1/devices/${(0, request_1.enc)(id)}` });
+        },
+    };
+}
+//# sourceMappingURL=devices.js.map

package/dist/client/devices.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"devices.js","sourceRoot":"","sources":["../../src/client/devices.ts"],"names":[],"mappings":";;AAgCA,0CAoBC;AApDD,uCAAgD;AAgChD,SAAgB,eAAe,CAAC,OAAkB;IAChD,OAAO;QACL,IAAI,CAAC,QAA+C,EAAE;YACpD,MAAM,CAAC,GAAG,IAAI,eAAe,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAyB,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,SAAS,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC;YACzH,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,cAAc,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;QAC5E,CAAC;QACD,GAAG,CAAC,EAAU;YACZ,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,eAAe,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;QACpE,CAAC;QACD,MAAM,CAAC,IAAsB;YAC3B,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC;QAC/D,CAAC;QACD,iDAAiD;QACjD,aAAa,CAAC,OAA2B;YACvC,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,oBAAoB,EAAE,IAAI,EAAE,EAAE,OAAO,EAAE,EAAE,CAAC,CAAC;QACpF,CAAC;QACD,MAAM,CAAC,EAAU;YACf,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,eAAe,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;QACvE,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/client/email-templates.d.ts

@@ -1,7 +1,7 @@
 import { type RequestFn } from './request';
 import type { ListPage } from './types';
 /** The transactional email a template drives. */
-export type EmailTemplateName = 'verification_code' | 'magic_link' | 'password_reset' | 'password_changed' | 'account_exists_notice' | 'organization_invitation' | 'new_device_sign_in' | 'session_revoked_token_reuse' | 'account_locked' | 'account_secured' | 'team_member_added' | 'team_role_changed' | 'email_changed' | 'verification_link' | 'password_reset_link' | 'account_reactivated';
+export type EmailTemplateName = 'verification_code' | 'magic_link' | 'password_reset' | 'password_changed' | 'account_exists_notice' | 'organization_invitation' | 'new_device_sign_in' | 'session_revoked_token_reuse' | 'account_locked' | 'account_secured' | 'team_member_added' | 'team_role_changed' | 'email_changed' | 'email_change_confirm' | 'parental_consent_request' | 'phone_changed' | 'identity_linked' | 'identity_unlinked' | 'passkey_added' | 'passkey_removed' | 'recovery_codes_regenerated' | 'factor_removed' | 'device_key_added' | 'device_key_removed' | 'uma_request_submitted' | 'risk_alert' | 'verification_link' | 'password_reset_link' | 'account_reactivated';
 /** The customizable body of a template: a subject line and a text body. */
 export interface EmailTemplateBody {
     subject?: string;

package/dist/client/email-templates.js.map

@@ -1 +1 @@
-{"version":3,"file":"email-templates.js","sourceRoot":"","sources":["../../src/client/email-templates.ts"],"names":[],"mappings":";;AA6DA,wDAkBC;AA/ED,uCAAgD;AA6DhD,SAAgB,sBAAsB,CAAC,OAAkB;IACvD,OAAO;QACL,IAAI;YACF,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,qBAAqB,EAAE,CAAC,CAAC;QACjE,CAAC;QACD,2EAA2E;QAC3E,OAAO,CAAC,IAAY,EAAE,OAA0B,EAAE;YAChD,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,uBAAuB,IAAA,aAAG,EAAC,IAAI,CAAC,UAAU,EAAE,IAAI,EAAE,CAAC,CAAC;QAC7F,CAAC;QACD,2DAA2D;QAC3D,MAAM,CAAC,IAAY,EAAE,IAAuB;YAC1C,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,uBAAuB,IAAA,aAAG,EAAC,IAAI,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;QACpF,CAAC;QACD,8BAA8B;QAC9B,MAAM,CAAC,IAAY;YACjB,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,uBAAuB,IAAA,aAAG,EAAC,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC;QACjF,CAAC;KACF,CAAC;AACJ,CAAC"}
+{"version":3,"file":"email-templates.js","sourceRoot":"","sources":["../../src/client/email-templates.ts"],"names":[],"mappings":";;AA0EA,wDAkBC;AA5FD,uCAAgD;AA0EhD,SAAgB,sBAAsB,CAAC,OAAkB;IACvD,OAAO;QACL,IAAI;YACF,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,qBAAqB,EAAE,CAAC,CAAC;QACjE,CAAC;QACD,2EAA2E;QAC3E,OAAO,CAAC,IAAY,EAAE,OAA0B,EAAE;YAChD,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,uBAAuB,IAAA,aAAG,EAAC,IAAI,CAAC,UAAU,EAAE,IAAI,EAAE,CAAC,CAAC;QAC7F,CAAC;QACD,2DAA2D;QAC3D,MAAM,CAAC,IAAY,EAAE,IAAuB;YAC1C,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,uBAAuB,IAAA,aAAG,EAAC,IAAI,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;QACpF,CAAC;QACD,8BAA8B;QAC9B,MAAM,CAAC,IAAY;YACjB,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,uBAAuB,IAAA,aAAG,EAAC,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC;QACjF,CAAC;KACF,CAAC;AACJ,CAAC"}