@atlasauth/backend 0.25.0 → 0.26.0

package/CHANGELOG.md

@@ -1,6 +1,37 @@
 # @atlasauth/backend changelog
 
-## Unreleased
+## 0.26.0 — 2026-10-27
+
+### Added
+
+- `iga` client resource: identity governance (access catalog, access requests and approvals, grants, delegations, separation-of-duties rules, joiner/mover/leaver lifecycle, certification campaigns).
+- `desktopMfa` client resource: the desktop login MFA policy, enrolment codes and enrolled devices (`getPolicy`, `updatePolicy`, `createEnrolmentCode`, `listDevices`, `getDevice`, `revokeDevice`, `revokeOfflineCache`, `deleteDevice`).
+- `managedGrants` client resource (`list`, `get`, `narrow`, `revoke`): the OpenID Grant Management grants each OAuth client holds for each user.
+- `leastPrivilege` client resource (`report`, `get`, `exportCsv`, and applying the narrower grants with a `dryRun` preview): what each secret key, OAuth client, MCP gateway and agent holds against what it used.
+- `mcpGateways` gains `abac` (policy checks on every tool call) and `budgets` (`list`, `create`, `get`, `update`, `delete`, `usage`).
+- `fga.settings.get` / `fga.settings.update`: the instance's FGA result-cache lifetime, default consistency mode and tuple change-log retention.
+
+- `connections.token` now caches per client until shortly before `expires_at` and takes `minTtlSeconds`; new `connections.refreshToken` (force-refresh after a provider 401, with `staleAccessToken`), `connections.tokens` (batch read of up to 100), `connections.importConnections` and `connections.exportConnections` (sealed to your public key); `connections.delete(id, { revoke: true })`. `Connection` gains `refresh_failures`, `next_refresh_at` and a typed `last_error` with the provider's code and HTTP status.
+- `connections.revoke` returns `provider_revoked`, `provider_status`, `provider_error` and `local_cleared`.
+- Webhook event types `connection.refresh_failed`, `connection.reauthorization_required`, `connection.revoked`, `connection.scopes_changed`, `connection.recovered`.
+- Connections: `setCredentials`, `rotateCredentials`, `secretVersions`, `secret` (scope `connections:secret_read`), `oauth1Sign`, `webhooks.verify` and `webhooks.*Endpoint`; `token()` takes `subject` for delegated tokens; `Connection` reports `secret_expires_at`, `previous_valid_until` and `allowed_methods`.
+- `connections` client resource: `create`, `list`, `get`, `update` (including `owner` to transfer), `delete`, `connect`, `revoke`, `token` (needs the `connections:token` scope) and `oauthClients` (`set`, `list`, `get`, `delete`), with `host_params`, `environment` and the captured token fields typed.
+- ABAC data filtering: `abac.partialEvaluate` (the policies as a filter over an unknown resource or principal, with relationship conditions resolved and optional SQL or Prisma output) and `abac.accessibleResources` (the resources a principal may act on, paged). The filter helpers `evalFilter`, `filterToSql`, `filterToPrisma` and `filterToDrizzle` are exported.
+- AuthZEN 1.0 search: `abac.authzenSearchSubject`, `authzenSearchResource` and `authzenSearchAction`.
+- ABAC authoring: `abac.templates`, `abac.links`, `abac.schema` (`get`, `set`, `delete`, `validate`), `abac.diff` and `abac.diffSources`; `abac.test` results carry `coverage`.
+- `fga.listObjects` and the resource-role `accessible` call take `limit` and `starting_after`; `listObjects` returns `has_more` and `next_cursor`.
+- `authzDecisions` client resource (`list`, `iterate`, `get`, `stats`, `settings.get/update`): the authorization decision log and its capture settings.
+- `policyBundles` client resource (`export`, `list`, `current`, `get`, `verify`, `import` with `dry_run` / `prune`) and `verifyPolicyBundle`, which verifies a signed policy bundle offline against your instance JWKS and returns its policies and FGA models.
+- `fga.listUsers` / `fga.listAllUsers` and `openfga.listUsers` / `openfga.listAllUsers`: who has a relation on an object (users, usersets, the `type:*` wildcard with `excluded_users`), paged.
+- `fga.readChanges` and `openfga.readChanges`: the tuple change log, resumable with `continuation_token`.
+- Tuple conditions: `condition` on tuple keys and `context` on `check`, `batchCheck` items, `listObjects` and `listUsers`.
+- `consistency` / `consistency_token` on queries; writes and queries return a `consistency_token`.
+- Desktop login MFA passkeys: `DesktopPasskey` and the policy fields `passkey_scope`, `passkey_rp_id` and `passkey_require_uv`.
+- Connections: `token_family` on connections and `split_tenants` on connect, so one grant covering several accounts (Xero organisations) becomes one connection per account sharing one token set.
+- Custom OAuth providers: `revocation_endpoint`, `host_params_schema` and `data_only` (connect-time host templates for data-only providers).
+- OAuth clients: `claims_redirect_uris` for UMA 2.0 claims gathering.
+- Shared Signals receivers: the `sync_posture` action records device posture without touching sessions.
+- Verifiable credentials: mdoc issuer revocation checks (`revocation_policy`: off, best_effort or required).
 
 ## 0.25.0 — 2026-10-26
 

package/dist/client/abac.d.ts

@@ -1,5 +1,6 @@
 import { type RequestFn } from './request';
 import type { ListPage } from './types';
+import type { Filter, SqlColumn, SqlDialect } from '@atlasauth/authz';
 export interface AbacPolicyTestCase {
     name: string;
     /** principal, action, resource, context and optional entities. */
@@ -64,6 +65,38 @@ export interface AbacDecision {
     reasons: string[];
     errors: string[];
 }
+export interface AbacCoverageClause {
+    kind: 'when' | 'unless';
+    index: number;
+    line: number | null;
+    true: number;
+    false: number;
+    error: number;
+}
+/** Which rules and `when`/`unless` clauses the test cases exercised. */
+export interface AbacCoverage {
+    object: 'abac_coverage';
+    tests: number;
+    rules: Array<{
+        rule: number;
+        effect: 'permit' | 'forbid';
+        line: number | null;
+        in_scope: number;
+        matched: number;
+        status: 'covered' | 'partial' | 'untouched';
+        clauses: AbacCoverageClause[];
+    }>;
+    summary: {
+        rules: number;
+        reached: number;
+        matched: number;
+        clauses: number;
+        clauses_both_ways: number;
+        percent: number;
+    };
+    /** What to add a test for, one sentence each. */
+    gaps: string[];
+}
 export interface AbacTestRun {
     object: 'abac_policy_test_run';
     passed: boolean;
@@ -73,6 +106,169 @@ export interface AbacTestRun {
         actual: 'allow' | 'deny';
         passed: boolean;
     }>;
+    coverage: AbacCoverage;
+}
+export interface AbacEntityRef {
+    type: string;
+    id: string;
+}
+/** A policy template: source with `?principal` / `?resource` slots, filled by links. */
+export interface AbacPolicyTemplate {
+    object: 'abac_policy_template';
+    id: string;
+    name: string;
+    description: string | null;
+    source: string;
+    version: number;
+    slots: Array<'?principal' | '?resource'>;
+    fga_store_id: string | null;
+    link_count: number;
+    /** On an update that changed `source`: the links that now evaluate the new source. */
+    links_updated?: number;
+    created_at: number;
+    updated_at: number;
+}
+export interface CreateAbacTemplateBody {
+    name: string;
+    source: string;
+    description?: string | null;
+    fga_store_id?: string | null;
+}
+export interface AbacPolicyLink {
+    object: 'abac_policy_link';
+    id: string;
+    name: string;
+    template_id: string;
+    template_name: string | null;
+    /** The template version the link follows (always the latest). */
+    template_version: number | null;
+    principal: AbacEntityRef | null;
+    resource: AbacEntityRef | null;
+    enabled: boolean;
+    /** The policy source the link evaluates: the template with its slots filled. */
+    source: string;
+    created_at: number;
+    updated_at: number;
+}
+export interface CreateAbacLinkBody {
+    template_id: string;
+    name: string;
+    principal?: AbacEntityRef | null;
+    resource?: AbacEntityRef | null;
+    enabled?: boolean;
+}
+export type AbacSchemaType = {
+    type: 'boolean' | 'long' | 'string';
+} | {
+    type: 'set';
+    element: AbacSchemaType;
+} | {
+    type: 'entity';
+    name: string;
+} | {
+    type: 'record';
+    attributes: Record<string, AbacSchemaType & {
+        required?: boolean;
+    }>;
+};
+/** The entity schema policies are type-checked against when saved. */
+export interface AbacSchemaDocument {
+    entity_types: Record<string, {
+        attributes?: Record<string, AbacSchemaType & {
+            required?: boolean;
+        }>;
+        member_of?: string[];
+    }>;
+    actions?: Record<string, {
+        applies_to?: {
+            principal_types: string[];
+            resource_types: string[];
+            context?: Record<string, AbacSchemaType & {
+                required?: boolean;
+            }>;
+        };
+        member_of?: string[];
+    }>;
+}
+export interface AbacPolicyIssue {
+    severity: 'error' | 'warning';
+    /** 1-based position of the policy in the source (0 for a syntax error). */
+    policy: number;
+    rule: 'permit' | 'forbid';
+    clause?: {
+        kind: 'when' | 'unless';
+        index: number;
+    };
+    message: string;
+    offset?: number;
+    line?: number;
+    column?: number;
+    source_name?: string;
+}
+export interface AbacSchemaState {
+    object: 'abac_schema';
+    schema: AbacSchemaDocument | null;
+    version: number;
+    updated_at: number | null;
+    /** On a save: the errors the schema would give the policies and links already stored. */
+    policy_issues?: AbacPolicyIssue[];
+}
+export interface AbacValidation {
+    object: 'abac_validation';
+    valid: boolean;
+    schema_checked: boolean;
+    issues: AbacPolicyIssue[];
+}
+export interface AbacDiffChange {
+    request: Record<string, unknown>;
+    before: 'allow' | 'deny';
+    after: 'allow' | 'deny';
+    /** Present when a version uses `fga.check`: the assumption the change holds under. */
+    assuming?: {
+        fga_check: boolean;
+    };
+}
+export interface AbacPolicyDiff {
+    object: 'abac_policy_diff';
+    policy_id?: string;
+    from?: number;
+    to?: number;
+    text: {
+        identical: boolean;
+        added: number;
+        removed: number;
+        lines: Array<{
+            type: 'context' | 'add' | 'remove';
+            text: string;
+            before_line?: number;
+            after_line?: number;
+        }>;
+    };
+    /** The requests whose decision changes; null when `semantic` was false. */
+    semantic: {
+        enumerated: number;
+        space: number;
+        exhaustive: boolean;
+        changed: number;
+        newly_allowed: number;
+        newly_denied: number;
+        by_action: Record<string, {
+            newly_allowed: number;
+            newly_denied: number;
+        }>;
+        changes: AbacDiffChange[];
+        truncated: boolean;
+    } | null;
+}
+export interface AbacDiffOptions {
+    from?: number;
+    to?: number;
+    /** false returns only the text diff. */
+    semantic?: boolean;
+    /** Requests to compare; the space is sampled beyond this. Default 5000. */
+    max_requests?: number;
+    /** Changed requests to list. Default 50. */
+    max_changes?: number;
 }
 export interface AuthzenEvaluation {
     subject?: {
@@ -91,6 +287,111 @@ export interface AuthzenEvaluation {
     };
     context?: Record<string, unknown>;
 }
+/** An entity for partial evaluation: an unknown one needs only its `type`. */
+export interface AbacPartialEntity {
+    type: string;
+    id?: string;
+    attributes?: Record<string, unknown>;
+    parents?: string[];
+}
+export interface AbacPartialBody {
+    principal: AbacPartialEntity;
+    action: string;
+    resource: AbacPartialEntity;
+    context?: Record<string, unknown>;
+    entities?: AbacEntity[];
+    policy_ids?: string[];
+    /** Which entity's attributes are unknown. Default `['resource']`. */
+    unknowns?: Array<'principal' | 'resource'>;
+    /** Replace relationship (`fga.check`) conditions with the ids the FGA store returns. Default true. */
+    resolve_relations?: boolean;
+    /** Ask for a ready-made query: parameterised SQL (field-to-column map) and/or a Prisma where object. */
+    output?: {
+        sql?: {
+            columns: Record<string, SqlColumn>;
+            dialect?: SqlDialect;
+            param_offset?: number;
+        };
+        prisma?: {
+            fields: Record<string, string>;
+        };
+    };
+}
+export interface AbacResidual {
+    object: 'abac_residual';
+    /** `allow` / `deny` when the filter is constant, else `conditional`. */
+    decision: 'allow' | 'deny' | 'conditional';
+    /** The condition on the unknown entity under which the request is allowed. */
+    filter: Filter;
+    permit: Filter;
+    forbid: Filter;
+    unknowns: Array<'principal' | 'resource'>;
+    relations_resolved: boolean;
+    sql?: {
+        text: string;
+        params: unknown[];
+    };
+    prisma?: Record<string, unknown>;
+}
+export interface AbacAccessibleBody {
+    principal: AbacPartialEntity;
+    action: string;
+    /** The Atlas resource type key; policies see its PascalCase form. */
+    resource_type: string;
+    context?: Record<string, unknown>;
+    entities?: AbacEntity[];
+    /** Resources to filter instead of the Atlas ones. */
+    candidates?: Array<{
+        id: string;
+        attributes?: Record<string, unknown>;
+        parents?: string[];
+    }>;
+    policy_ids?: string[];
+    limit?: number;
+    starting_after?: string;
+}
+export interface AbacAccessibleList {
+    object: 'list';
+    data: Array<{
+        object: 'abac_resource';
+        type: string;
+        id: string;
+    }>;
+    has_more: boolean;
+    next_cursor: string | null;
+    total: number;
+    evaluated: number;
+    /** `residual` when one filter was applied to every candidate; `per_resource` when each had to be evaluated. */
+    method: 'residual' | 'per_resource';
+}
+/** AuthZEN 1.0 search request: leave the `id` out of the entity you are looking for. */
+export interface AuthzenSearchRequest {
+    subject?: {
+        type: string;
+        id?: string;
+        properties?: Record<string, unknown>;
+    };
+    resource?: {
+        type: string;
+        id?: string;
+        properties?: Record<string, unknown>;
+    };
+    action?: {
+        name: string;
+        properties?: Record<string, unknown>;
+    };
+    context?: Record<string, unknown>;
+    page?: {
+        limit?: number;
+        token?: string;
+    };
+}
+export interface AuthzenSearchPage {
+    /** Empty on the last page. */
+    next_token: string;
+    count: number;
+    total: number;
+}
 /** ABAC policies and the policy decision point (including the AuthZEN endpoints). */
 export declare function abacResource(request: RequestFn): {
     list(): Promise<ListPage<AbacPolicy>>;
@@ -111,6 +412,93 @@ export declare function abacResource(request: RequestFn): {
     }): Promise<AbacTestRun>;
     /** May `principal` perform `action` on `resource`? */
     evaluate(body: AbacEvaluateBody): Promise<AbacDecision>;
+    /**
+     * Partial evaluation (data filtering): the condition under which the request is allowed when
+     * an entity is unknown, as a filter AST and, on request, parameterised SQL or a Prisma object.
+     */
+    partialEvaluate(body: AbacPartialBody): Promise<AbacResidual>;
+    /** The resources of a type a principal may perform an action on, one page at a time. */
+    accessibleResources(body: AbacAccessibleBody): Promise<AbacAccessibleList>;
+    /** Policy templates: policy source with `?principal` / `?resource` slots that links fill with entities. */
+    templates: {
+        list(): Promise<ListPage<AbacPolicyTemplate>>;
+        get(id: string): Promise<AbacPolicyTemplate>;
+        create(body: CreateAbacTemplateBody, idempotencyKey?: string): Promise<AbacPolicyTemplate>;
+        /** A new `source` reaches every link at once; it is refused if a link could no longer be filled in or would fail the schema. */
+        update(id: string, body: Partial<CreateAbacTemplateBody>): Promise<AbacPolicyTemplate>;
+        /** A template with links is refused unless `force` (which deletes the links too). */
+        delete(id: string, opts?: {
+            force?: boolean;
+        }): Promise<{
+            object: "abac_policy_template";
+            id: string;
+            deleted: true;
+            links_deleted: number;
+        }>;
+    };
+    /** Links: a template with its slots filled by entities. A link is evaluated from the template's current source. */
+    links: {
+        list(query?: {
+            template_id?: string;
+        }): Promise<ListPage<AbacPolicyLink>>;
+        get(id: string): Promise<AbacPolicyLink>;
+        create(body: CreateAbacLinkBody, idempotencyKey?: string): Promise<AbacPolicyLink>;
+        update(id: string, body: Partial<Omit<CreateAbacLinkBody, "template_id">>): Promise<AbacPolicyLink>;
+        delete(id: string): Promise<{
+            object: "abac_policy_link";
+            id: string;
+            deleted: true;
+        }>;
+    };
+    /** The entity schema: once set, policies and templates are type-checked when saved. */
+    schema: {
+        get(): Promise<AbacSchemaState>;
+        /** Saves the schema and reports the errors it would give the policies already stored (`policy_issues`). */
+        set(schema: AbacSchemaDocument): Promise<AbacSchemaState>;
+        delete(): Promise<{
+            object: "abac_schema";
+            deleted: true;
+        }>;
+        /** Type-check draft source against the saved schema (or `schema`) without saving anything. */
+        validate(body: {
+            source: string;
+            schema?: AbacSchemaDocument;
+            template?: boolean;
+        }): Promise<AbacValidation>;
+    };
+    /** Compare two versions of a policy: the text, and the requests whose decision changes. */
+    diff(id: string, opts?: AbacDiffOptions): Promise<AbacPolicyDiff>;
+    /** The same comparison for two sources you send, without saving. */
+    diffSources(body: {
+        before: string;
+        after: string;
+        semantic?: boolean;
+        max_requests?: number;
+        max_changes?: number;
+    }): Promise<AbacPolicyDiff>;
+    /** AuthZEN 1.0 Subject Search: the subjects of a type that may perform the action on the resource. */
+    authzenSearchSubject(body: AuthzenSearchRequest): Promise<{
+        results: Array<{
+            type: string;
+            id: string;
+        }>;
+        page: AuthzenSearchPage;
+    }>;
+    /** AuthZEN 1.0 Resource Search: the resources of a type the subject may perform the action on. */
+    authzenSearchResource(body: AuthzenSearchRequest): Promise<{
+        results: Array<{
+            type: string;
+            id: string;
+        }>;
+        page: AuthzenSearchPage;
+    }>;
+    /** AuthZEN 1.0 Action Search: the actions the subject may perform on the resource. */
+    authzenSearchAction(body: AuthzenSearchRequest): Promise<{
+        results: Array<{
+            name: string;
+        }>;
+        page: AuthzenSearchPage;
+    }>;
     /** Convenience: the boolean answer to {@link evaluate}. */
     isAllowed(body: AbacEvaluateBody): Promise<boolean>;
     /** AuthZEN 1.0 Access Evaluation. */
@@ -130,3 +518,4 @@ export declare function abacResource(request: RequestFn): {
         }>;
     }>;
 };
+export { FilterCompileError, evalFilter, filterToDrizzle, filterToPrisma, filterToSql, type DrizzleOps, type DrizzleOptions, type Filter, type FilterRows, type PrismaOptions, type SqlColumn, type SqlDialect, type SqlFragment, type SqlOptions, } from '@atlasauth/authz';

package/dist/client/abac.js

@@ -1,5 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.filterToSql = exports.filterToPrisma = exports.filterToDrizzle = exports.evalFilter = exports.FilterCompileError = void 0;
 exports.abacResource = abacResource;
 const request_1 = require("./request");
 /** ABAC policies and the policy decision point (including the AuthZEN endpoints). */
@@ -31,6 +32,96 @@ function abacResource(request) {
         evaluate(body) {
             return request({ method: 'POST', path: '/v1/abac/evaluate', body });
         },
+        /**
+         * Partial evaluation (data filtering): the condition under which the request is allowed when
+         * an entity is unknown, as a filter AST and, on request, parameterised SQL or a Prisma object.
+         */
+        partialEvaluate(body) {
+            return request({ method: 'POST', path: '/v1/abac/partial_evaluate', body });
+        },
+        /** The resources of a type a principal may perform an action on, one page at a time. */
+        accessibleResources(body) {
+            return request({ method: 'POST', path: '/v1/abac/accessible_resources', body });
+        },
+        /** Policy templates: policy source with `?principal` / `?resource` slots that links fill with entities. */
+        templates: {
+            list() {
+                return request({ method: 'GET', path: '/v1/abac_templates' });
+            },
+            get(id) {
+                return request({ method: 'GET', path: `/v1/abac_templates/${(0, request_1.enc)(id)}` });
+            },
+            create(body, idempotencyKey) {
+                return request({ method: 'POST', path: '/v1/abac_templates', body, idempotencyKey });
+            },
+            /** A new `source` reaches every link at once; it is refused if a link could no longer be filled in or would fail the schema. */
+            update(id, body) {
+                return request({ method: 'PATCH', path: `/v1/abac_templates/${(0, request_1.enc)(id)}`, body });
+            },
+            /** A template with links is refused unless `force` (which deletes the links too). */
+            delete(id, opts = {}) {
+                return request({ method: 'DELETE', path: `/v1/abac_templates/${(0, request_1.enc)(id)}${opts.force ? '?force=true' : ''}` });
+            },
+        },
+        /** Links: a template with its slots filled by entities. A link is evaluated from the template's current source. */
+        links: {
+            list(query = {}) {
+                return request({ method: 'GET', path: `/v1/abac_policy_links${query.template_id ? `?template_id=${(0, request_1.enc)(query.template_id)}` : ''}` });
+            },
+            get(id) {
+                return request({ method: 'GET', path: `/v1/abac_policy_links/${(0, request_1.enc)(id)}` });
+            },
+            create(body, idempotencyKey) {
+                return request({ method: 'POST', path: '/v1/abac_policy_links', body, idempotencyKey });
+            },
+            update(id, body) {
+                return request({ method: 'PATCH', path: `/v1/abac_policy_links/${(0, request_1.enc)(id)}`, body });
+            },
+            delete(id) {
+                return request({ method: 'DELETE', path: `/v1/abac_policy_links/${(0, request_1.enc)(id)}` });
+            },
+        },
+        /** The entity schema: once set, policies and templates are type-checked when saved. */
+        schema: {
+            get() {
+                return request({ method: 'GET', path: '/v1/abac_schema' });
+            },
+            /** Saves the schema and reports the errors it would give the policies already stored (`policy_issues`). */
+            set(schema) {
+                return request({ method: 'PUT', path: '/v1/abac_schema', body: { schema } });
+            },
+            delete() {
+                return request({ method: 'DELETE', path: '/v1/abac_schema' });
+            },
+            /** Type-check draft source against the saved schema (or `schema`) without saving anything. */
+            validate(body) {
+                return request({ method: 'POST', path: '/v1/abac_schema/validate', body });
+            },
+        },
+        /** Compare two versions of a policy: the text, and the requests whose decision changes. */
+        diff(id, opts = {}) {
+            const qs = Object.entries(opts)
+                .filter(([, v]) => v !== undefined)
+                .map(([k, v]) => `${k}=${encodeURIComponent(String(v))}`)
+                .join('&');
+            return request({ method: 'GET', path: `/v1/abac_policies/${(0, request_1.enc)(id)}/diff${qs ? `?${qs}` : ''}` });
+        },
+        /** The same comparison for two sources you send, without saving. */
+        diffSources(body) {
+            return request({ method: 'POST', path: '/v1/abac/diff', body });
+        },
+        /** AuthZEN 1.0 Subject Search: the subjects of a type that may perform the action on the resource. */
+        authzenSearchSubject(body) {
+            return request({ method: 'POST', path: '/v1/authzen/access/v1/search/subject', body });
+        },
+        /** AuthZEN 1.0 Resource Search: the resources of a type the subject may perform the action on. */
+        authzenSearchResource(body) {
+            return request({ method: 'POST', path: '/v1/authzen/access/v1/search/resource', body });
+        },
+        /** AuthZEN 1.0 Action Search: the actions the subject may perform on the resource. */
+        authzenSearchAction(body) {
+            return request({ method: 'POST', path: '/v1/authzen/access/v1/search/action', body });
+        },
         /** Convenience: the boolean answer to {@link evaluate}. */
         async isAllowed(body) {
             return (await request({ method: 'POST', path: '/v1/abac/evaluate', body })).decision === 'allow';
@@ -45,4 +136,11 @@ function abacResource(request) {
         },
     };
 }
+// The residual-filter helpers: evaluate a filter in memory, or compile it for SQL, Prisma or Drizzle.
+var authz_1 = require("@atlasauth/authz");
+Object.defineProperty(exports, "FilterCompileError", { enumerable: true, get: function () { return authz_1.FilterCompileError; } });
+Object.defineProperty(exports, "evalFilter", { enumerable: true, get: function () { return authz_1.evalFilter; } });
+Object.defineProperty(exports, "filterToDrizzle", { enumerable: true, get: function () { return authz_1.filterToDrizzle; } });
+Object.defineProperty(exports, "filterToPrisma", { enumerable: true, get: function () { return authz_1.filterToPrisma; } });
+Object.defineProperty(exports, "filterToSql", { enumerable: true, get: function () { return authz_1.filterToSql; } });
 //# sourceMappingURL=abac.js.map

package/dist/client/abac.js.map

@@ -1 +1 @@
-{"version":3,"file":"abac.js","sourceRoot":"","sources":["../../src/client/abac.ts"],"names":[],"mappings":";;AAuFA,oCA2CC;AAlID,uCAAgD;AAsFhD,qFAAqF;AACrF,SAAgB,YAAY,CAAC,OAAkB;IAC7C,OAAO;QACL,IAAI;YACF,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,mBAAmB,EAAE,CAAC,CAAC;QAC/D,CAAC;QACD,GAAG,CAAC,EAAU;YACZ,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,qBAAqB,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;QAC1E,CAAC;QACD,MAAM,CAAC,IAA0B,EAAE,cAAuB;YACxD,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,mBAAmB,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC;QACtF,CAAC;QACD,MAAM,CAAC,EAAU,EAAE,IAA0B;YAC3C,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,qBAAqB,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;QAClF,CAAC;QACD,MAAM,CAAC,EAAU;YACf,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,qBAAqB,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;QAC7E,CAAC;QACD,QAAQ,CAAC,EAAU;YACjB,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,qBAAqB,IAAA,aAAG,EAAC,EAAE,CAAC,WAAW,EAAE,CAAC,CAAC;QACnF,CAAC;QACD,iGAAiG;QACjG,IAAI,CAAC,EAAU,EAAE,OAA4E,EAAE;YAC7F,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,qBAAqB,IAAA,aAAG,EAAC,EAAE,CAAC,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;QACtF,CAAC;QACD,sDAAsD;QACtD,QAAQ,CAAC,IAAsB;YAC7B,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,mBAAmB,EAAE,IAAI,EAAE,CAAC,CAAC;QACtE,CAAC;QACD,2DAA2D;QAC3D,KAAK,CAAC,SAAS,CAAC,IAAsB;YACpC,OAAO,CAAC,MAAM,OAAO,CAAe,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,mBAAmB,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,OAAO,CAAC;QACjH,CAAC;QACD,qCAAqC;QACrC,iBAAiB,CAAC,IAAuB;YACvC,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,kCAAkC,EAAE,IAAI,EAAE,CAAC,CAAC;QACrF,CAAC;QACD,8CAA8C;QAC9C,kBAAkB,CAChB,IAAqK;YAErK,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,mCAAmC,EAAE,IAAI,EAAE,CAAC,CAAC;QACtF,CAAC;KACF,CAAC;AACJ,CAAC"}
+{"version":3,"file":"abac.js","sourceRoot":"","sources":["../../src/client/abac.ts"],"names":[],"mappings":";;;AA2UA,oCAqIC;AAhdD,uCAAgD;AA0UhD,qFAAqF;AACrF,SAAgB,YAAY,CAAC,OAAkB;IAC7C,OAAO;QACL,IAAI;YACF,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,mBAAmB,EAAE,CAAC,CAAC;QAC/D,CAAC;QACD,GAAG,CAAC,EAAU;YACZ,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,qBAAqB,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;QAC1E,CAAC;QACD,MAAM,CAAC,IAA0B,EAAE,cAAuB;YACxD,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,mBAAmB,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC;QACtF,CAAC;QACD,MAAM,CAAC,EAAU,EAAE,IAA0B;YAC3C,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,qBAAqB,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;QAClF,CAAC;QACD,MAAM,CAAC,EAAU;YACf,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,qBAAqB,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;QAC7E,CAAC;QACD,QAAQ,CAAC,EAAU;YACjB,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,qBAAqB,IAAA,aAAG,EAAC,EAAE,CAAC,WAAW,EAAE,CAAC,CAAC;QACnF,CAAC;QACD,iGAAiG;QACjG,IAAI,CAAC,EAAU,EAAE,OAA4E,EAAE;YAC7F,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,qBAAqB,IAAA,aAAG,EAAC,EAAE,CAAC,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;QACtF,CAAC;QACD,sDAAsD;QACtD,QAAQ,CAAC,IAAsB;YAC7B,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,mBAAmB,EAAE,IAAI,EAAE,CAAC,CAAC;QACtE,CAAC;QACD;;;WAGG;QACH,eAAe,CAAC,IAAqB;YACnC,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,2BAA2B,EAAE,IAAI,EAAE,CAAC,CAAC;QAC9E,CAAC;QACD,wFAAwF;QACxF,mBAAmB,CAAC,IAAwB;YAC1C,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,+BAA+B,EAAE,IAAI,EAAE,CAAC,CAAC;QAClF,CAAC;QACD,2GAA2G;QAC3G,SAAS,EAAE;YACT,IAAI;gBACF,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,oBAAoB,EAAE,CAAC,CAAC;YAChE,CAAC;YACD,GAAG,CAAC,EAAU;gBACZ,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,sBAAsB,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;YAC3E,CAAC;YACD,MAAM,CAAC,IAA4B,EAAE,cAAuB;gBAC1D,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,oBAAoB,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC;YACvF,CAAC;YACD,gIAAgI;YAChI,MAAM,CAAC,EAAU,EAAE,IAAqC;gBACtD,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,sBAAsB,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;YACnF,CAAC;YACD,qFAAqF;YACrF,MAAM,CAAC,EAAU,EAAE,OAA4B,EAAE;gBAC/C,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,sBAAsB,IAAA,aAAG,EAAC,EAAE,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;YAChH,CAAC;SACF;QACD,mHAAmH;QACnH,KAAK,EAAE;YACL,IAAI,CAAC,QAAkC,EAAE;gBACvC,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,wBAAwB,KAAK,CAAC,WAAW,CAAC,CAAC,CAAC,gBAAgB,IAAA,aAAG,EAAC,KAAK,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;YACvI,CAAC;YACD,GAAG,CAAC,EAAU;gBACZ,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,yBAAyB,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;YAC9E,CAAC;YACD,MAAM,CAAC,IAAwB,EAAE,cAAuB;gBACtD,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,uBAAuB,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC;YAC1F,CAAC;YACD,MAAM,CAAC,EAAU,EAAE,IAAsD;gBACvE,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,yBAAyB,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;YACtF,CAAC;YACD,MAAM,CAAC,EAAU;gBACf,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,yBAAyB,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;YACjF,CAAC;SACF;QACD,uFAAuF;QACvF,MAAM,EAAE;YACN,GAAG;gBACD,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,iBAAiB,EAAE,CAAC,CAAC;YAC7D,CAAC;YACD,2GAA2G;YAC3G,GAAG,CAAC,MAA0B;gBAC5B,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,iBAAiB,EAAE,IAAI,EAAE,EAAE,MAAM,EAAE,EAAE,CAAC,CAAC;YAC/E,CAAC;YACD,MAAM;gBACJ,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,iBAAiB,EAAE,CAAC,CAAC;YAChE,CAAC;YACD,8FAA8F;YAC9F,QAAQ,CAAC,IAAyE;gBAChF,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,0BAA0B,EAAE,IAAI,EAAE,CAAC,CAAC;YAC7E,CAAC;SACF;QACD,2FAA2F;QAC3F,IAAI,CAAC,EAAU,EAAE,OAAwB,EAAE;YACzC,MAAM,EAAE,GAAG,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC;iBAC5B,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,SAAS,CAAC;iBAClC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,kBAAkB,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;iBACxD,IAAI,CAAC,GAAG,CAAC,CAAC;YACb,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,qBAAqB,IAAA,aAAG,EAAC,EAAE,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;QACpG,CAAC;QACD,oEAAoE;QACpE,WAAW,CAAC,IAAwG;YAClH,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,eAAe,EAAE,IAAI,EAAE,CAAC,CAAC;QAClE,CAAC;QACD,sGAAsG;QACtG,oBAAoB,CAAC,IAA0B;YAC7C,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,sCAAsC,EAAE,IAAI,EAAE,CAAC,CAAC;QACzF,CAAC;QACD,kGAAkG;QAClG,qBAAqB,CAAC,IAA0B;YAC9C,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,uCAAuC,EAAE,IAAI,EAAE,CAAC,CAAC;QAC1F,CAAC;QACD,sFAAsF;QACtF,mBAAmB,CAAC,IAA0B;YAC5C,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,qCAAqC,EAAE,IAAI,EAAE,CAAC,CAAC;QACxF,CAAC;QACD,2DAA2D;QAC3D,KAAK,CAAC,SAAS,CAAC,IAAsB;YACpC,OAAO,CAAC,MAAM,OAAO,CAAe,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,mBAAmB,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,OAAO,CAAC;QACjH,CAAC;QACD,qCAAqC;QACrC,iBAAiB,CAAC,IAAuB;YACvC,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,kCAAkC,EAAE,IAAI,EAAE,CAAC,CAAC;QACrF,CAAC;QACD,8CAA8C;QAC9C,kBAAkB,CAChB,IAAqK;YAErK,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,mCAAmC,EAAE,IAAI,EAAE,CAAC,CAAC;QACtF,CAAC;KACF,CAAC;AACJ,CAAC;AAED,sGAAsG;AACtG,0CAe0B;AAdxB,2GAAA,kBAAkB,OAAA;AAClB,mGAAA,UAAU,OAAA;AACV,wGAAA,eAAe,OAAA;AACf,uGAAA,cAAc,OAAA;AACd,oGAAA,WAAW,OAAA"}

package/dist/client/analytics-reports.d.ts

@@ -82,7 +82,7 @@ export interface AccessByAppRow {
     active_grants: number;
     users_in_window: number;
 }
-export type AlertMetric = 'sign_in_success_rate' | 'failed_passkey_ratio' | 'failed_sign_ins' | 'sign_in_p95_seconds' | 'api_usage_spike';
+export type AlertMetric = 'sign_in_success_rate' | 'failed_passkey_ratio' | 'failed_sign_ins' | 'sign_in_p95_seconds' | 'api_usage_spike' | 'unused_permissions';
 export type UsageSubjectType = 'api_key' | 'end_user_api_key' | 'organization';
 /** One key's or organization's API usage against its 7-day hourly baseline. */
 export interface ApiUsageSubject {