@atlasauth/backend 0.25.0 → 0.26.0

package/dist/client/connections.js

@@ -0,0 +1,164 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.connectionsResource = connectionsResource;
+const request_1 = require("./request");
+const SKEW_MS = 60_000;
+async function sha256Hex(text) {
+    const d = await globalThis.crypto.subtle.digest('SHA-256', new TextEncoder().encode(text));
+    return [...new Uint8Array(d)].map((b) => b.toString(16).padStart(2, '0')).join('');
+}
+/** Org- or user-owned provider connections and their stored tokens. */
+function connectionsResource(request) {
+    // Tokens read by this client, reused until shortly before the provider's `expires_at`. A token with no expiry is never cached.
+    const cache = new Map();
+    const live = (t, minTtlSeconds) => !!t && t.expires_at !== null && t.expires_at - Date.now() > Math.max(minTtlSeconds * 1000, SKEW_MS);
+    const remember = (t) => {
+        if (t.expires_at !== null)
+            cache.set(t.connection_id, t);
+        else
+            cache.delete(t.connection_id);
+        return t;
+    };
+    return {
+        create(body, idempotencyKey) {
+            return request({ method: 'POST', path: '/v1/connections', body, idempotencyKey });
+        },
+        list(params = {}) {
+            return request({ method: 'GET', path: '/v1/connections', query: { ...params } });
+        },
+        get(id) {
+            return request({ method: 'GET', path: `/v1/connections/${(0, request_1.enc)(id)}` });
+        },
+        update(id, body) {
+            return request({ method: 'PATCH', path: `/v1/connections/${(0, request_1.enc)(id)}`, body });
+        },
+        /** Delete a connection. Pass `{ revoke: true }` to revoke at the provider first and learn what it said. */
+        delete(id, options = {}) {
+            cache.delete(id);
+            return request({ method: 'DELETE', path: `/v1/connections/${(0, request_1.enc)(id)}`, query: options.revoke ? { revoke: 'true' } : undefined });
+        },
+        /** Start the provider authorization; send the owner to `authorization_url`. */
+        connect(id, body) {
+            return request({ method: 'POST', path: `/v1/connections/${(0, request_1.enc)(id)}/connect`, body });
+        },
+        /** Revoke at the provider and forget the stored token. The answer says what the provider said (`provider_revoked`). */
+        revoke(id) {
+            cache.delete(id);
+            return request({ method: 'POST', path: `/v1/connections/${(0, request_1.enc)(id)}/revoke` });
+        },
+        /**
+         * The live token for your backend (refreshed when needed). Needs the `connections:token` scope.
+         * Reads are cached in this client until shortly before `expires_at` (and a cached read is `refreshed: false`),
+         * so calling it in a hot loop costs one request per connection per token lifetime.
+         */
+        async token(id, options = {}) {
+            const minTtl = options.minTtlSeconds ?? 0;
+            const hit = cache.get(id);
+            if (options.subject) {
+                return request({ method: 'GET', path: `/v1/connections/${(0, request_1.enc)(id)}/token`, query: { subject: options.subject, ...(options.refresh ? { refresh: 'true' } : {}) } });
+            }
+            if (!options.refresh && !options.noCache && live(hit, minTtl))
+                return { ...hit, refreshed: false };
+            const t = await request({
+                method: 'GET',
+                path: `/v1/connections/${(0, request_1.enc)(id)}/token`,
+                query: { ...(options.refresh ? { refresh: 'true' } : {}), ...(minTtl ? { min_ttl_seconds: String(minTtl) } : {}) },
+            });
+            return remember(t);
+        },
+        /**
+         * Call this when the provider answers 401 to a token you got from here. Pass the access token you were refused with
+         * (`staleAccessToken`): if Atlas already holds a newer one, you get it back without another call to the provider.
+         */
+        async refreshToken(id, options = {}) {
+            cache.delete(id);
+            const t = await request({
+                method: 'POST',
+                path: `/v1/connections/${(0, request_1.enc)(id)}/token/refresh`,
+                body: { reason: options.reason ?? 'provider_401', ...(options.staleAccessToken ? { stale_token_hash: await sha256Hex(options.staleAccessToken) } : {}) },
+            });
+            return remember(t);
+        },
+        /** Read up to 100 connections' tokens in one call. Each id has its own result, so one dead connection does not fail the rest. */
+        async tokens(ids, options = {}) {
+            const r = await request({
+                method: 'POST',
+                path: '/v1/connections/tokens/batch',
+                body: { ids, ...(options.minTtlSeconds ? { min_ttl_seconds: options.minTtlSeconds } : {}) },
+            });
+            for (const item of r.data)
+                if (item.status === 'ok' && item.token)
+                    remember(item.token);
+            return r;
+        },
+        /** Bulk-import existing provider refresh tokens (up to 500 per call). Needs the `connections:import` scope. */
+        importConnections(body, idempotencyKey) {
+            return request({ method: 'POST', path: '/v1/connections/import', body, idempotencyKey });
+        },
+        /**
+         * Export connections. Without `include_secrets` it lists metadata. With it (scope `connections:export_secrets`) the tokens
+         * come back as one compact JWE sealed to `recipient_public_key`; open it with the matching private key.
+         */
+        exportConnections(body = {}) {
+            return request({ method: 'POST', path: '/v1/connections/export', body, headers: body.include_secrets ? { 'x-atlas-confirm': 'export-secrets' } : undefined });
+        },
+        /** Enter the credential of a non-OAuth connection (write-only; sealed in the vault, never returned). */
+        setCredentials(id, body) {
+            return request({ method: 'PUT', path: `/v1/connections/${(0, request_1.enc)(id)}/credentials`, body });
+        },
+        /** Rotate the credential; the replaced version stays valid for `overlap_seconds`. */
+        rotateCredentials(id, body) {
+            return request({ method: 'POST', path: `/v1/connections/${(0, request_1.enc)(id)}/credentials/rotate`, body });
+        },
+        /** The credential's vault versions (numbers and times, never values). */
+        secretVersions(id) {
+            return request({ method: 'GET', path: `/v1/connections/${(0, request_1.enc)(id)}/credentials/versions` });
+        },
+        /**
+         * Read an api_key, bearer, basic, custom_header or hmac_secret credential. Needs the `connections:secret_read`
+         * scope; every read is audited. `version` is `current` (default), `previous` (inside a rotation's overlap
+         * window) or a number. With `organizationId` the connection must belong to that organization (404 otherwise).
+         */
+        secret(id, options = {}) {
+            const path = options.organizationId ? `/v1/organizations/${(0, request_1.enc)(options.organizationId)}/connections/${(0, request_1.enc)(id)}/secret` : `/v1/connections/${(0, request_1.enc)(id)}/secret`;
+            return request({ method: 'GET', path, query: options.version === undefined ? undefined : { version: String(options.version) } });
+        },
+        /** Have Atlas sign a request with an oauth1 connection (needs `connections:sign`). */
+        oauth1Sign(id, body) {
+            return request({ method: 'POST', path: `/v1/connections/${(0, request_1.enc)(id)}/oauth1/sign`, body });
+        },
+        webhooks: {
+            /** Verify a provider webhook signature (needs `connections:webhook_verify`). */
+            verify(id, body) {
+                return request({ method: 'POST', path: `/v1/connections/${(0, request_1.enc)(id)}/webhooks/verify`, body });
+            },
+            createEndpoint(id, body) {
+                return request({ method: 'POST', path: `/v1/connections/${(0, request_1.enc)(id)}/webhook_endpoints`, body });
+            },
+            listEndpoints(id) {
+                return request({ method: 'GET', path: `/v1/connections/${(0, request_1.enc)(id)}/webhook_endpoints` });
+            },
+            updateEndpoint(id, endpointId, body) {
+                return request({ method: 'PATCH', path: `/v1/connections/${(0, request_1.enc)(id)}/webhook_endpoints/${(0, request_1.enc)(endpointId)}`, body });
+            },
+            deleteEndpoint(id, endpointId) {
+                return request({ method: 'DELETE', path: `/v1/connections/${(0, request_1.enc)(id)}/webhook_endpoints/${(0, request_1.enc)(endpointId)}` });
+            },
+        },
+        oauthClients: {
+            set(body) {
+                return request({ method: 'PUT', path: '/v1/connections/oauth_clients', body });
+            },
+            list(params = {}) {
+                return request({ method: 'GET', path: '/v1/connections/oauth_clients', query: { ...params } });
+            },
+            get(id) {
+                return request({ method: 'GET', path: `/v1/connections/oauth_clients/${(0, request_1.enc)(id)}` });
+            },
+            delete(id) {
+                return request({ method: 'DELETE', path: `/v1/connections/oauth_clients/${(0, request_1.enc)(id)}` });
+            },
+        },
+    };
+}
+//# sourceMappingURL=connections.js.map

package/dist/client/connections.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"connections.js","sourceRoot":"","sources":["../../src/client/connections.ts"],"names":[],"mappings":";;AA2YA,kDAoJC;AA/hBD,uCAAgD;AAsRhD,MAAM,OAAO,GAAG,MAAM,CAAC;AAEvB,KAAK,UAAU,SAAS,CAAC,IAAY;IACnC,MAAM,CAAC,GAAG,MAAM,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;IAC3F,OAAO,CAAC,GAAG,IAAI,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;AACrF,CAAC;AA+GD,uEAAuE;AACvE,SAAgB,mBAAmB,CAAC,OAAkB;IACpD,+HAA+H;IAC/H,MAAM,KAAK,GAAG,IAAI,GAAG,EAA2B,CAAC;IACjD,MAAM,IAAI,GAAG,CAAC,CAA8B,EAAE,aAAqB,EAAwB,EAAE,CAC3F,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,UAAU,KAAK,IAAI,IAAI,CAAC,CAAC,UAAU,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,GAAG,CAAC,aAAa,GAAG,IAAI,EAAE,OAAO,CAAC,CAAC;IACtG,MAAM,QAAQ,GAAG,CAAC,CAAkB,EAAmB,EAAE;QACvD,IAAI,CAAC,CAAC,UAAU,KAAK,IAAI;YAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC;;YACpD,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC;QACnC,OAAO,CAAC,CAAC;IACX,CAAC,CAAC;IACF,OAAO;QACL,MAAM,CAAC,IAA0B,EAAE,cAAuB;YACxD,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,iBAAiB,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC;QACpF,CAAC;QACD,IAAI,CAAC,SAAgC,EAAE;YACrC,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,iBAAiB,EAAE,KAAK,EAAE,EAAE,GAAG,MAAM,EAAE,EAAE,CAAC,CAAC;QACnF,CAAC;QACD,GAAG,CAAC,EAAU;YACZ,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,mBAAmB,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;QACxE,CAAC;QACD,MAAM,CAAC,EAAU,EAAE,IAA0B;YAC3C,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,mBAAmB,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;QAChF,CAAC;QACD,2GAA2G;QAC3G,MAAM,CAA4B,EAAU,EAAE,UAA0B,EAAE;YACxE,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;YACjB,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,mBAAmB,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,KAAK,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC;QACnI,CAAC;QACD,+EAA+E;QAC/E,OAAO,CAAC,EAAU,EAAE,IAA2B;YAC7C,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,mBAAmB,IAAA,aAAG,EAAC,EAAE,CAAC,UAAU,EAAE,IAAI,EAAE,CAAC,CAAC;QACvF,CAAC;QACD,uHAAuH;QACvH,MAAM,CAAC,EAAU;YACf,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;YACjB,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,mBAAmB,IAAA,aAAG,EAAC,EAAE,CAAC,SAAS,EAAE,CAAC,CAAC;QAChF,CAAC;QACD;;;;WAIG;QACH,KAAK,CAAC,KAAK,CAAC,EAAU,EAAE,UAA4B,EAAE;YACpD,MAAM,MAAM,GAAG,OAAO,CAAC,aAAa,IAAI,CAAC,CAAC;YAC1C,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YAC1B,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC;gBACpB,OAAO,OAAO,CAAkB,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,mBAAmB,IAAA,aAAG,EAAC,EAAE,CAAC,QAAQ,EAAE,KAAK,EAAE,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;YACrL,CAAC;YACD,IAAI,CAAC,OAAO,CAAC,OAAO,IAAI,CAAC,OAAO,CAAC,OAAO,IAAI,IAAI,CAAC,GAAG,EAAE,MAAM,CAAC;gBAAE,OAAO,EAAE,GAAG,GAAG,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC;YACnG,MAAM,CAAC,GAAG,MAAM,OAAO,CAAkB;gBACvC,MAAM,EAAE,KAAK;gBACb,IAAI,EAAE,mBAAmB,IAAA,aAAG,EAAC,EAAE,CAAC,QAAQ;gBACxC,KAAK,EAAE,EAAE,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE;aACnH,CAAC,CAAC;YACH,OAAO,QAAQ,CAAC,CAAC,CAAC,CAAC;QACrB,CAAC;QACD;;;WAGG;QACH,KAAK,CAAC,YAAY,CAAC,EAAU,EAAE,UAAyF,EAAE;YACxH,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;YACjB,MAAM,CAAC,GAAG,MAAM,OAAO,CAAkB;gBACvC,MAAM,EAAE,MAAM;gBACd,IAAI,EAAE,mBAAmB,IAAA,aAAG,EAAC,EAAE,CAAC,gBAAgB;gBAChD,IAAI,EAAE,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,IAAI,cAAc,EAAE,GAAG,CAAC,OAAO,CAAC,gBAAgB,CAAC,CAAC,CAAC,EAAE,gBAAgB,EAAE,MAAM,SAAS,CAAC,OAAO,CAAC,gBAAgB,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE;aACzJ,CAAC,CAAC;YACH,OAAO,QAAQ,CAAC,CAAC,CAAC,CAAC;QACrB,CAAC;QACD,iIAAiI;QACjI,KAAK,CAAC,MAAM,CAAC,GAAa,EAAE,UAAsC,EAAE;YAClE,MAAM,CAAC,GAAG,MAAM,OAAO,CAAwE;gBAC7F,MAAM,EAAE,MAAM;gBACd,IAAI,EAAE,8BAA8B;gBACpC,IAAI,EAAE,EAAE,GAAG,EAAE,GAAG,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,OAAO,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE;aAC5F,CAAC,CAAC;YACH,KAAK,MAAM,IAAI,IAAI,CAAC,CAAC,IAAI;gBAAE,IAAI,IAAI,CAAC,MAAM,KAAK,IAAI,IAAI,IAAI,CAAC,KAAK;oBAAE,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YACxF,OAAO,CAAC,CAAC;QACX,CAAC;QACD,+GAA+G;QAC/G,iBAAiB,CAAC,IAA2B,EAAE,cAAuB;YACpE,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,wBAAwB,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC;QAC3F,CAAC;QACD;;;WAGG;QACH,iBAAiB,CAAC,OAA8B,EAAE;YAChD,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,wBAAwB,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,CAAC,eAAe,CAAC,CAAC,CAAC,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC;QAChK,CAAC;QACD,wGAAwG;QACxG,cAAc,CAAC,EAAU,EAAE,IAAkC;YAC3D,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,mBAAmB,IAAA,aAAG,EAAC,EAAE,CAAC,cAAc,EAAE,IAAI,EAAE,CAAC,CAAC;QAC1F,CAAC;QACD,qFAAqF;QACrF,iBAAiB,CAAC,EAAU,EAAE,IAAqC;YACjE,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,mBAAmB,IAAA,aAAG,EAAC,EAAE,CAAC,qBAAqB,EAAE,IAAI,EAAE,CAAC,CAAC;QAClG,CAAC;QACD,yEAAyE;QACzE,cAAc,CAAC,EAAU;YACvB,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,mBAAmB,IAAA,aAAG,EAAC,EAAE,CAAC,uBAAuB,EAAE,CAAC,CAAC;QAC7F,CAAC;QACD;;;;WAIG;QACH,MAAM,CAAC,EAAU,EAAE,UAAkF,EAAE;YACrG,MAAM,IAAI,GAAG,OAAO,CAAC,cAAc,CAAC,CAAC,CAAC,qBAAqB,IAAA,aAAG,EAAC,OAAO,CAAC,cAAc,CAAC,gBAAgB,IAAA,aAAG,EAAC,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC,mBAAmB,IAAA,aAAG,EAAC,EAAE,CAAC,SAAS,CAAC;YAC7J,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,EAAE,CAAC,CAAC;QACnI,CAAC;QACD,sFAAsF;QACtF,UAAU,CAAC,EAAU,EAAE,IAA4E;YACjG,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,mBAAmB,IAAA,aAAG,EAAC,EAAE,CAAC,cAAc,EAAE,IAAI,EAAE,CAAC,CAAC;QAC3F,CAAC;QACD,QAAQ,EAAE;YACR,gFAAgF;YAChF,MAAM,CAAC,EAAU,EAAE,IAAiC;gBAClD,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,mBAAmB,IAAA,aAAG,EAAC,EAAE,CAAC,kBAAkB,EAAE,IAAI,EAAE,CAAC,CAAC;YAC/F,CAAC;YACD,cAAc,CAAC,EAAU,EAAE,IAAyC;gBAClE,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,mBAAmB,IAAA,aAAG,EAAC,EAAE,CAAC,oBAAoB,EAAE,IAAI,EAAE,CAAC,CAAC;YACjG,CAAC;YACD,aAAa,CAAC,EAAU;gBACtB,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,mBAAmB,IAAA,aAAG,EAAC,EAAE,CAAC,oBAAoB,EAAE,CAAC,CAAC;YAC1F,CAAC;YACD,cAAc,CAAC,EAAU,EAAE,UAAkB,EAAE,IAA0E;gBACvH,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,mBAAmB,IAAA,aAAG,EAAC,EAAE,CAAC,sBAAsB,IAAA,aAAG,EAAC,UAAU,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;YACrH,CAAC;YACD,cAAc,CAAC,EAAU,EAAE,UAAkB;gBAC3C,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,mBAAmB,IAAA,aAAG,EAAC,EAAE,CAAC,sBAAsB,IAAA,aAAG,EAAC,UAAU,CAAC,EAAE,EAAE,CAAC,CAAC;YAChH,CAAC;SACF;QACD,YAAY,EAAE;YACZ,GAAG,CAAC,IAAkC;gBACpC,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,+BAA+B,EAAE,IAAI,EAAE,CAAC,CAAC;YACjF,CAAC;YACD,IAAI,CAAC,SAAqF,EAAE;gBAC1F,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,+BAA+B,EAAE,KAAK,EAAE,EAAE,GAAG,MAAM,EAAE,EAAE,CAAC,CAAC;YACjG,CAAC;YACD,GAAG,CAAC,EAAU;gBACZ,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,iCAAiC,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;YACtF,CAAC;YACD,MAAM,CAAC,EAAU;gBACf,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,iCAAiC,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;YACzF,CAAC;SACF;KACF,CAAC;AACJ,CAAC"}

package/dist/client/custom-oauth-providers.d.ts

@@ -42,6 +42,11 @@ export interface ProfileMapping {
     update_on_sign_in?: boolean;
 }
 export type TokenEndpointAuthMethod = 'client_secret_basic' | 'client_secret_post' | 'client_secret_jwt' | 'private_key_jwt' | 'none';
+/** One connect-time host value: `{name}` in an endpoint URL is filled from `host_params.name`, which must match `pattern` as a whole. */
+export interface HostParamsSchemaEntry {
+    name: string;
+    pattern: string;
+}
 export interface UpstreamLogoutSettings {
     /** On Atlas sign-out, hand back the provider end-session URL to send the browser to. */
     rp_initiated?: boolean;
@@ -88,6 +93,11 @@ export interface CustomOAuthProviderSettings {
     userinfo_endpoint?: string | null;
     jwks_uri?: string | null;
     end_session_endpoint?: string | null;
+    revocation_endpoint?: string | null;
+    /** The connect-time `host_params` the `{name}` templates in the endpoints take (data-only providers, OAuth 2.0). */
+    host_params_schema?: HostParamsSchemaEntry[] | null;
+    /** Never a sign-in method: only connections use it. Required for endpoints with `{name}` templates. */
+    data_only?: boolean;
     scopes?: string[];
     scope_separator?: ' ' | ',' | '+';
     pkce?: boolean;
@@ -125,6 +135,11 @@ export interface CustomOAuthProvider extends UpstreamUrls {
     userinfo_endpoint: string | null;
     jwks_uri: string | null;
     end_session_endpoint: string | null;
+    /** RFC 7009 revoke endpoint; may carry `{name}` host templates. */
+    revocation_endpoint: string | null;
+    host_params_schema: HostParamsSchemaEntry[];
+    /** A data-only provider serves connections and is never a sign-in method. */
+    data_only: boolean;
     scopes: string[];
     scope_separator: ' ' | ',' | '+';
     pkce: boolean;

package/dist/client/custom-oauth-providers.js.map

@@ -1 +1 @@
-{"version":3,"file":"custom-oauth-providers.js","sourceRoot":"","sources":["../../src/client/custom-oauth-providers.ts"],"names":[],"mappings":";;AAqOA,kDAcC;AAED,oEAqCC;AA1RD,uCAAgD;AAoOhD,kFAAkF;AAClF,SAAgB,mBAAmB,CAAC,OAAkB,EAAE,IAAY;IAClE,OAAO;QACL,IAAI;YACF,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,IAAI,eAAe,EAAE,CAAC,CAAC;QAClE,CAAC;QACD,sFAAsF;QACtF,MAAM,CAAC,OAA8C,EAAE,EAAE,cAAuB;YAC9E,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,IAAI,eAAe,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC;QACzF,CAAC;QACD,oDAAoD;QACpD,MAAM,CAAC,GAAW;YAChB,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,IAAI,iBAAiB,IAAA,aAAG,EAAC,GAAG,CAAC,SAAS,EAAE,CAAC,CAAC;QACtF,CAAC;KACF,CAAC;AACJ,CAAC;AAED,SAAgB,4BAA4B,CAAC,OAAkB;IAC7D,MAAM,IAAI,GAAG,CAAC,EAAU,EAAE,EAAE,CAAC,8BAA8B,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,CAAC;IACrE,OAAO;QACL,IAAI;YACF,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,4BAA4B,EAAE,CAAC,CAAC;QACxE,CAAC;QACD,GAAG,CAAC,EAAU;YACZ,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;QACpD,CAAC;QACD,MAAM,CAAC,IAAmC,EAAE,cAAuB;YACjE,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,4BAA4B,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC;QAC/F,CAAC;QACD,MAAM,CAAC,EAAU,EAAE,IAAiC,EAAE,cAAuB;YAC3E,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,CAAC,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC;QAC5E,CAAC;QACD,MAAM,CAAC,EAAU;YACf,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;QACvD,CAAC;QACD,wEAAwE;QACxE,QAAQ,CAAC,IAAgD;YACvD,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,qCAAqC,EAAE,IAAI,EAAE,CAAC,CAAC;QACxF,CAAC;QACD;;;WAGG;QACH,qBAAqB,CAAC,IAA+B,EAAE,EAAW;YAChE,OAAO,OAAO,CAAC;gBACb,MAAM,EAAE,MAAM;gBACd,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,EAAE,CAAC,0BAA0B,CAAC,CAAC,CAAC,oDAAoD;gBACvG,IAAI;aACL,CAAC,CAAC;QACL,CAAC;QACD,WAAW,CAAC,EAAU;YACpB,OAAO,mBAAmB,CAAC,OAAO,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC;QAChD,CAAC;KACF,CAAC;AACJ,CAAC"}
+{"version":3,"file":"custom-oauth-providers.js","sourceRoot":"","sources":["../../src/client/custom-oauth-providers.ts"],"names":[],"mappings":";;AAqPA,kDAcC;AAED,oEAqCC;AA1SD,uCAAgD;AAoPhD,kFAAkF;AAClF,SAAgB,mBAAmB,CAAC,OAAkB,EAAE,IAAY;IAClE,OAAO;QACL,IAAI;YACF,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,IAAI,eAAe,EAAE,CAAC,CAAC;QAClE,CAAC;QACD,sFAAsF;QACtF,MAAM,CAAC,OAA8C,EAAE,EAAE,cAAuB;YAC9E,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,IAAI,eAAe,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC;QACzF,CAAC;QACD,oDAAoD;QACpD,MAAM,CAAC,GAAW;YAChB,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,IAAI,iBAAiB,IAAA,aAAG,EAAC,GAAG,CAAC,SAAS,EAAE,CAAC,CAAC;QACtF,CAAC;KACF,CAAC;AACJ,CAAC;AAED,SAAgB,4BAA4B,CAAC,OAAkB;IAC7D,MAAM,IAAI,GAAG,CAAC,EAAU,EAAE,EAAE,CAAC,8BAA8B,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,CAAC;IACrE,OAAO;QACL,IAAI;YACF,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,4BAA4B,EAAE,CAAC,CAAC;QACxE,CAAC;QACD,GAAG,CAAC,EAAU;YACZ,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;QACpD,CAAC;QACD,MAAM,CAAC,IAAmC,EAAE,cAAuB;YACjE,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,4BAA4B,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC;QAC/F,CAAC;QACD,MAAM,CAAC,EAAU,EAAE,IAAiC,EAAE,cAAuB;YAC3E,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,CAAC,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC;QAC5E,CAAC;QACD,MAAM,CAAC,EAAU;YACf,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;QACvD,CAAC;QACD,wEAAwE;QACxE,QAAQ,CAAC,IAAgD;YACvD,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,qCAAqC,EAAE,IAAI,EAAE,CAAC,CAAC;QACxF,CAAC;QACD;;;WAGG;QACH,qBAAqB,CAAC,IAA+B,EAAE,EAAW;YAChE,OAAO,OAAO,CAAC;gBACb,MAAM,EAAE,MAAM;gBACd,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,EAAE,CAAC,0BAA0B,CAAC,CAAC,CAAC,oDAAoD;gBACvG,IAAI;aACL,CAAC,CAAC;QACL,CAAC;QACD,WAAW,CAAC,EAAU;YACpB,OAAO,mBAAmB,CAAC,OAAO,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC;QAChD,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/client/desktop-mfa.d.ts

@@ -0,0 +1,104 @@
+import { type RequestFn } from './request';
+export type DesktopMfaFactor = 'push' | 'totp' | 'passkey';
+/** Who must pass a second factor at workstation login, with which factors, and how long offline unlock lasts. */
+export interface DesktopMfaPolicy {
+    object: 'desktop_mfa_policy';
+    enabled: boolean;
+    applies_to: 'all' | 'selected';
+    user_ids: string[];
+    org_ids: string[];
+    allowed_factors: DesktopMfaFactor[];
+    offline_enabled: boolean;
+    offline_grace_hours: number;
+    offline_pin_required: boolean;
+    /** `account`: any passkey the user holds answers the passkey factor. `device`: only keys registered through that workstation. */
+    passkey_scope: 'account' | 'device';
+    /** Relying-party domain the agents use; null uses the application's passkey RP id. */
+    passkey_rp_id: string | null;
+    passkey_require_uv: boolean;
+}
+/** A passkey registered through a workstation. It answers the desktop passkey factor and never a web sign-in. */
+export interface DesktopPasskey {
+    object: 'desktop_passkey';
+    id: string;
+    device_id: string;
+    user_id: string;
+    name: string | null;
+    aaguid: string | null;
+    transports: string[];
+    backed_up: boolean;
+    last_used_at: number | null;
+    created_at: number;
+}
+export type UpdateDesktopMfaPolicyBody = Partial<Omit<DesktopMfaPolicy, 'object'>>;
+/** A workstation running the Atlas Windows or macOS login agent. */
+export interface DesktopDevice {
+    object: 'desktop_device';
+    id: string;
+    user_id: string;
+    device_key_id: string;
+    hostname: string | null;
+    platform: 'windows' | 'macos' | 'linux';
+    agent_version: string | null;
+    status: 'active' | 'revoked';
+    offline_pin_set: boolean;
+    /** Raised to void every offline verifier issued so far. */
+    bundle_generation: number;
+    last_seen_at: number | null;
+    revoked_at: number | null;
+    created_at: number;
+}
+export interface DesktopDeviceDetail extends DesktopDevice {
+    offline_bundles: Array<{
+        id: string;
+        generation: number;
+        issued_at: number;
+        expires_at: number;
+        revoked_at: number | null;
+    }>;
+}
+export interface DesktopEnrolmentCode {
+    object: 'desktop_enrolment_code';
+    /** Shown once. The user types it into the workstation agent. */
+    code: string;
+    expires_at: number;
+    user_id: string;
+}
+/** Desktop-login MFA: policy, enrolment codes and enrolled workstations. */
+export declare function desktopMfaResource(request: RequestFn): {
+    getPolicy(): Promise<DesktopMfaPolicy>;
+    /** Send only the fields to change. */
+    updatePolicy(body: UpdateDesktopMfaPolicyBody): Promise<DesktopMfaPolicy>;
+    /** A single-use code for a user to enrol a workstation (default 60 minutes, at most 7 days). */
+    createEnrolmentCode(body: {
+        user_id: string;
+        expires_in_minutes?: number;
+    }): Promise<DesktopEnrolmentCode>;
+    listDevices(query?: {
+        user_id?: string;
+    }): Promise<{
+        object: "list";
+        data: DesktopDevice[];
+        has_more: boolean;
+    }>;
+    getDevice(id: string): Promise<DesktopDeviceDetail>;
+    listDevicePasskeys(id: string): Promise<{
+        object: "list";
+        data: DesktopPasskey[];
+        has_more: boolean;
+    }>;
+    deleteDevicePasskey(id: string, passkeyId: string): Promise<{
+        object: "desktop_passkey";
+        id: string;
+        deleted: boolean;
+    }>;
+    /** The workstation's next call is refused and it wipes its offline cache. */
+    revokeDevice(id: string): Promise<DesktopDevice>;
+    /** Void every offline verifier without revoking the workstation; it gets a fresh one on its next sync. */
+    revokeOfflineCache(id: string): Promise<DesktopDevice>;
+    deleteDevice(id: string): Promise<{
+        object: "desktop_device";
+        id: string;
+        deleted: boolean;
+    }>;
+};

package/dist/client/desktop-mfa.js

@@ -0,0 +1,44 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.desktopMfaResource = desktopMfaResource;
+const request_1 = require("./request");
+/** Desktop-login MFA: policy, enrolment codes and enrolled workstations. */
+function desktopMfaResource(request) {
+    return {
+        getPolicy() {
+            return request({ method: 'GET', path: '/v1/desktop_mfa/policy' });
+        },
+        /** Send only the fields to change. */
+        updatePolicy(body) {
+            return request({ method: 'PUT', path: '/v1/desktop_mfa/policy', body });
+        },
+        /** A single-use code for a user to enrol a workstation (default 60 minutes, at most 7 days). */
+        createEnrolmentCode(body) {
+            return request({ method: 'POST', path: '/v1/desktop_mfa/enrolment_codes', body });
+        },
+        listDevices(query = {}) {
+            return request({ method: 'GET', path: '/v1/desktop_mfa/devices', query });
+        },
+        getDevice(id) {
+            return request({ method: 'GET', path: `/v1/desktop_mfa/devices/${(0, request_1.enc)(id)}` });
+        },
+        listDevicePasskeys(id) {
+            return request({ method: 'GET', path: `/v1/desktop_mfa/devices/${(0, request_1.enc)(id)}/passkeys` });
+        },
+        deleteDevicePasskey(id, passkeyId) {
+            return request({ method: 'DELETE', path: `/v1/desktop_mfa/devices/${(0, request_1.enc)(id)}/passkeys/${(0, request_1.enc)(passkeyId)}` });
+        },
+        /** The workstation's next call is refused and it wipes its offline cache. */
+        revokeDevice(id) {
+            return request({ method: 'POST', path: `/v1/desktop_mfa/devices/${(0, request_1.enc)(id)}/revoke` });
+        },
+        /** Void every offline verifier without revoking the workstation; it gets a fresh one on its next sync. */
+        revokeOfflineCache(id) {
+            return request({ method: 'POST', path: `/v1/desktop_mfa/devices/${(0, request_1.enc)(id)}/revoke_offline_cache` });
+        },
+        deleteDevice(id) {
+            return request({ method: 'DELETE', path: `/v1/desktop_mfa/devices/${(0, request_1.enc)(id)}` });
+        },
+    };
+}
+//# sourceMappingURL=desktop-mfa.js.map

package/dist/client/desktop-mfa.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"desktop-mfa.js","sourceRoot":"","sources":["../../src/client/desktop-mfa.ts"],"names":[],"mappings":";;AAqEA,gDAqCC;AA1GD,uCAAgD;AAoEhD,4EAA4E;AAC5E,SAAgB,kBAAkB,CAAC,OAAkB;IACnD,OAAO;QACL,SAAS;YACP,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,wBAAwB,EAAE,CAAC,CAAC;QACpE,CAAC;QACD,sCAAsC;QACtC,YAAY,CAAC,IAAgC;YAC3C,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,wBAAwB,EAAE,IAAI,EAAE,CAAC,CAAC;QAC1E,CAAC;QACD,gGAAgG;QAChG,mBAAmB,CAAC,IAAsD;YACxE,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,iCAAiC,EAAE,IAAI,EAAE,CAAC,CAAC;QACpF,CAAC;QACD,WAAW,CAAC,QAA8B,EAAE;YAC1C,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,yBAAyB,EAAE,KAAK,EAAE,CAAC,CAAC;QAC5E,CAAC;QACD,SAAS,CAAC,EAAU;YAClB,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,2BAA2B,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;QAChF,CAAC;QACD,kBAAkB,CAAC,EAAU;YAC3B,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,2BAA2B,IAAA,aAAG,EAAC,EAAE,CAAC,WAAW,EAAE,CAAC,CAAC;QACzF,CAAC;QACD,mBAAmB,CAAC,EAAU,EAAE,SAAiB;YAC/C,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,2BAA2B,IAAA,aAAG,EAAC,EAAE,CAAC,aAAa,IAAA,aAAG,EAAC,SAAS,CAAC,EAAE,EAAE,CAAC,CAAC;QAC9G,CAAC;QACD,6EAA6E;QAC7E,YAAY,CAAC,EAAU;YACrB,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,2BAA2B,IAAA,aAAG,EAAC,EAAE,CAAC,SAAS,EAAE,CAAC,CAAC;QACxF,CAAC;QACD,0GAA0G;QAC1G,kBAAkB,CAAC,EAAU;YAC3B,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,2BAA2B,IAAA,aAAG,EAAC,EAAE,CAAC,uBAAuB,EAAE,CAAC,CAAC;QACtG,CAAC;QACD,YAAY,CAAC,EAAU;YACrB,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,2BAA2B,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;QACnF,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/client/email-templates.d.ts

@@ -1,7 +1,7 @@
 import { type RequestFn } from './request';
 import type { ListPage } from './types';
 /** The transactional email a template drives. */
-export type EmailTemplateName = 'verification_code' | 'magic_link' | 'password_reset' | 'password_changed' | 'account_exists_notice' | 'organization_invitation' | 'new_device_sign_in' | 'session_revoked_token_reuse' | 'account_locked' | 'account_secured' | 'team_member_added' | 'team_role_changed' | 'email_changed' | 'email_change_confirm' | 'parental_consent_request' | 'phone_changed' | 'identity_linked' | 'identity_unlinked' | 'passkey_added' | 'passkey_removed' | 'recovery_codes_regenerated' | 'factor_removed' | 'device_key_added' | 'device_key_removed' | 'risk_alert' | 'verification_link' | 'password_reset_link' | 'account_reactivated';
+export type EmailTemplateName = 'verification_code' | 'magic_link' | 'password_reset' | 'password_changed' | 'account_exists_notice' | 'organization_invitation' | 'new_device_sign_in' | 'session_revoked_token_reuse' | 'account_locked' | 'account_secured' | 'team_member_added' | 'team_role_changed' | 'email_changed' | 'email_change_confirm' | 'parental_consent_request' | 'phone_changed' | 'identity_linked' | 'identity_unlinked' | 'passkey_added' | 'passkey_removed' | 'recovery_codes_regenerated' | 'factor_removed' | 'device_key_added' | 'device_key_removed' | 'uma_request_submitted' | 'risk_alert' | 'verification_link' | 'password_reset_link' | 'account_reactivated';
 /** The customizable body of a template: a subject line and a text body. */
 export interface EmailTemplateBody {
     subject?: string;

package/dist/client/email-templates.js.map

@@ -1 +1 @@
-{"version":3,"file":"email-templates.js","sourceRoot":"","sources":["../../src/client/email-templates.ts"],"names":[],"mappings":";;AAyEA,wDAkBC;AA3FD,uCAAgD;AAyEhD,SAAgB,sBAAsB,CAAC,OAAkB;IACvD,OAAO;QACL,IAAI;YACF,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,qBAAqB,EAAE,CAAC,CAAC;QACjE,CAAC;QACD,2EAA2E;QAC3E,OAAO,CAAC,IAAY,EAAE,OAA0B,EAAE;YAChD,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,uBAAuB,IAAA,aAAG,EAAC,IAAI,CAAC,UAAU,EAAE,IAAI,EAAE,CAAC,CAAC;QAC7F,CAAC;QACD,2DAA2D;QAC3D,MAAM,CAAC,IAAY,EAAE,IAAuB;YAC1C,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,uBAAuB,IAAA,aAAG,EAAC,IAAI,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;QACpF,CAAC;QACD,8BAA8B;QAC9B,MAAM,CAAC,IAAY;YACjB,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,uBAAuB,IAAA,aAAG,EAAC,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC;QACjF,CAAC;KACF,CAAC;AACJ,CAAC"}
+{"version":3,"file":"email-templates.js","sourceRoot":"","sources":["../../src/client/email-templates.ts"],"names":[],"mappings":";;AA0EA,wDAkBC;AA5FD,uCAAgD;AA0EhD,SAAgB,sBAAsB,CAAC,OAAkB;IACvD,OAAO;QACL,IAAI;YACF,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,qBAAqB,EAAE,CAAC,CAAC;QACjE,CAAC;QACD,2EAA2E;QAC3E,OAAO,CAAC,IAAY,EAAE,OAA0B,EAAE;YAChD,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,uBAAuB,IAAA,aAAG,EAAC,IAAI,CAAC,UAAU,EAAE,IAAI,EAAE,CAAC,CAAC;QAC7F,CAAC;QACD,2DAA2D;QAC3D,MAAM,CAAC,IAAY,EAAE,IAAuB;YAC1C,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,uBAAuB,IAAA,aAAG,EAAC,IAAI,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;QACpF,CAAC;QACD,8BAA8B;QAC9B,MAAM,CAAC,IAAY;YACjB,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,uBAAuB,IAAA,aAAG,EAAC,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC;QACjF,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/client/fga.d.ts

@@ -29,13 +29,31 @@ export interface FgaTuple {
     relation: string;
     /** The object of the tuple as `type:id`. */
     target: string;
+    condition?: FgaTupleCondition;
     created_at: number;
 }
+/** A model condition bound to a tuple, with the parameter values fixed on it. */
+export interface FgaTupleCondition {
+    name: string;
+    context?: Record<string, unknown>;
+}
 /** A tuple key. `object` is the target as `type:id`; `target` is accepted too. */
 export interface FgaTupleKey {
     user: string;
     relation: string;
     object: string;
+    /** The tuple grants only while this model condition holds. */
+    condition?: FgaTupleCondition;
+}
+/**
+ * Freshness of a read. `MINIMIZE_LATENCY` (and the default) may be served from a
+ * short-lived cache; `HIGHER_CONSISTENCY` reads the primary.
+ */
+export type FgaConsistency = 'UNSPECIFIED' | 'MINIMIZE_LATENCY' | 'HIGHER_CONSISTENCY';
+export interface FgaConsistencyOptions {
+    consistency?: FgaConsistency;
+    /** A token from a write: the read reflects at least that write. */
+    consistency_token?: string;
 }
 /** An OpenFGA authorization model to persist. Validated before storage. */
 export interface FgaAuthorizationModelInput {
@@ -48,20 +66,80 @@ export interface FgaAuthorizationModelInput {
 export type FgaTupleKeys = FgaTupleKey[] | {
     tuple_keys: FgaTupleKey[];
 };
-export interface FgaCheckBody {
+export interface FgaCheckBody extends FgaConsistencyOptions {
     user: string;
     relation: string;
     object: string;
     /** Defaults to the store's latest model. */
     authorization_model_id?: string;
     contextual_tuples?: FgaTupleKeys;
+    /** Values for tuple-condition parameters (a tuple's own context wins). */
+    context?: Record<string, unknown>;
 }
-export interface FgaListObjectsBody {
+export interface FgaListObjectsBody extends FgaConsistencyOptions {
     user: string;
     relation: string;
     type: string;
     authorization_model_id?: string;
     contextual_tuples?: FgaTupleKeys;
+    /** Page size; without it every object is returned. */
+    limit?: number;
+    /** The `next_cursor` of the previous page. */
+    starting_after?: string;
+    context?: Record<string, unknown>;
+}
+export interface FgaListUsersBody extends FgaConsistencyOptions {
+    /** `type:id`. */
+    object: string;
+    relation: string;
+    /** Exactly one filter; add `relation` to get usersets such as `group:eng#member`. */
+    user_filters: [{
+        type: string;
+        relation?: string;
+    }];
+    authorization_model_id?: string;
+    contextual_tuples?: FgaTupleKeys;
+    context?: Record<string, unknown>;
+    /** 1–1000; defaults to 1000. */
+    page_size?: number;
+    continuation_token?: string;
+}
+export interface FgaListUsersResult {
+    object: 'fga.list_users';
+    /** `type:id`, `type:id#relation`, or `type:*` for a public wildcard. */
+    users: string[];
+    /** Ids a wildcard in `users` does not cover. */
+    excluded_users: string[];
+    /** Pass back for the next page; null on the last. */
+    continuation_token: string | null;
+    authorization_model_id: string;
+    consistency_token: string;
+}
+export interface FgaReadChangesParams {
+    /** Only changes to tuples on objects of this type. */
+    type?: string;
+    /** 1–100; defaults to 50. */
+    page_size?: number;
+    continuation_token?: string;
+    /** RFC 3339: only changes at or after it. */
+    start_time?: string;
+}
+export interface FgaTupleChange {
+    object: 'fga.tuple_change';
+    operation: 'write' | 'delete';
+    user: string;
+    relation: string;
+    target: string;
+    condition?: FgaTupleCondition;
+    consistency_token: string;
+    created_at: number;
+}
+export interface FgaChangesPage {
+    object: 'list';
+    data: FgaTupleChange[];
+    has_more: boolean;
+    /** Save it and call again later to receive only newer changes. */
+    continuation_token: string;
 }
 /** One item in a batch check; `correlation_id` is echoed back to match results. */
 export interface FgaBatchCheckItem {
@@ -70,16 +148,33 @@ export interface FgaBatchCheckItem {
     object: string;
     correlation_id?: string;
     contextual_tuples?: FgaTupleKeys;
+    context?: Record<string, unknown>;
 }
 export interface FgaBatchCheckResult {
     object: 'fga.batch_check';
     authorization_model_id: string;
+    consistency_token: string;
     result: Array<{
         correlation_id: string;
         allowed: boolean;
     }>;
 }
+/** How the instance runs FGA reads and keeps its tuple change log. */
+export interface FgaSettings {
+    object: 'fga.settings';
+    /** Result-cache TTL in ms; null uses the platform default, 0 turns the cache off. */
+    cache_ttl_ms: number | null;
+    /** Applied to reads that name no `consistency`. */
+    default_consistency: FgaConsistency;
+    /** Days of tuple change log kept; null keeps all of it. */
+    changelog_retention_days: number | null;
+}
+export type UpdateFgaSettingsBody = Partial<Omit<FgaSettings, 'object'>>;
 export declare function fgaResource(request: RequestFn): {
+    settings: {
+        get(): Promise<FgaSettings>;
+        update(body: UpdateFgaSettingsBody): Promise<FgaSettings>;
+    };
     stores: {
         list(): Promise<ListPage<FgaStore>>;
         create(body: {
@@ -105,6 +200,7 @@ export declare function fgaResource(request: RequestFn): {
         object: "fga.write_result";
         writes: number;
         deletes: number;
+        consistency_token: string;
     }>;
     /** Query stored tuples by any of user / relation / object. */
     read(storeId: string, body: {
@@ -117,18 +213,35 @@ export declare function fgaResource(request: RequestFn): {
         object: "fga.check";
         allowed: boolean;
         authorization_model_id: string;
+        consistency_token: string;
     }>;
     /** Resolve MANY access questions in one round trip (list-authorization UIs). */
     batchCheck(storeId: string, body: {
         checks: FgaBatchCheckItem[];
         authorization_model_id?: string;
-    }): Promise<FgaBatchCheckResult>;
+    } & FgaConsistencyOptions): Promise<FgaBatchCheckResult>;
     /** List the objects of a type a user has a relation to. */
     listObjects(storeId: string, body: FgaListObjectsBody): Promise<{
         object: "fga.list_objects";
         objects: string[];
+        has_more: boolean;
+        next_cursor: string | null;
         authorization_model_id: string;
+        consistency_token: string;
     }>;
+    /**
+     * Who has a relation on an object: concrete users, usersets (give the filter
+     * a `relation`) and the `type:*` wildcard with `excluded_users`. One page.
+     */
+    listUsers(storeId: string, body: FgaListUsersBody): Promise<FgaListUsersResult>;
+    /** {@link listUsers} following `continuation_token` until every page is collected. */
+    listAllUsers(storeId: string, body: FgaListUsersBody): Promise<FgaListUsersResult>;
+    /**
+     * The store's tuple change log, in commit order. The returned
+     * `continuation_token` works even on the last page: persist it and call again
+     * to receive only what changed since.
+     */
+    readChanges(storeId: string, params?: FgaReadChangesParams): Promise<FgaChangesPage>;
     /** Expand the full userset tree for an object#relation. */
     expand(storeId: string, body: {
         object: string;
@@ -153,6 +266,7 @@ export declare function fgaResource(request: RequestFn): {
             object: "fga.write_result";
             writes: number;
             deletes: number;
+            consistency_token: string;
         }>;
         read: (body: {
             user?: string;
@@ -163,16 +277,23 @@ export declare function fgaResource(request: RequestFn): {
             object: "fga.check";
             allowed: boolean;
             authorization_model_id: string;
+            consistency_token: string;
         }>;
         batchCheck: (body: {
             checks: FgaBatchCheckItem[];
             authorization_model_id?: string;
-        }) => Promise<FgaBatchCheckResult>;
+        } & FgaConsistencyOptions) => Promise<FgaBatchCheckResult>;
         listObjects: (body: FgaListObjectsBody) => Promise<{
             object: "fga.list_objects";
             objects: string[];
+            has_more: boolean;
+            next_cursor: string | null;
             authorization_model_id: string;
+            consistency_token: string;
         }>;
+        listUsers: (body: FgaListUsersBody) => Promise<FgaListUsersResult>;
+        listAllUsers: (body: FgaListUsersBody) => Promise<FgaListUsersResult>;
+        readChanges: (params?: FgaReadChangesParams) => Promise<FgaChangesPage>;
         expand: (body: {
             object: string;
             relation: string;