@atlasauth/backend 0.25.0 → 0.26.0

package/dist/client/openfga.d.ts

@@ -16,6 +16,17 @@ export interface OpenFgaTupleKey {
     user: string;
     relation: string;
     object: string;
+    /** A model condition the tuple is bound to. */
+    condition?: {
+        name: string;
+        context?: Record<string, unknown>;
+    };
+}
+/** OpenFGA's `consistency` enum plus Atlas's consistency token (see ListUsers/Check docs). */
+export interface OpenFgaConsistencyOptions {
+    consistency?: 'UNSPECIFIED' | 'MINIMIZE_LATENCY' | 'HIGHER_CONSISTENCY';
+    /** A token from a write; the read reflects at least that write. Also sent as the `Atlas-Consistency-Token` header. */
+    consistency_token?: string;
 }
 /** Contextual tuples: either the OpenFGA `{ tuple_keys }` wrapper or a bare array. */
 export type OpenFgaContextualTuples = {
@@ -38,18 +49,21 @@ export interface WriteOpenFgaModelBody {
     dsl?: string;
     [key: string]: unknown;
 }
-export interface OpenFgaCheckBody {
+export interface OpenFgaCheckBody extends OpenFgaConsistencyOptions {
     tuple_key: OpenFgaTupleKey;
     authorization_model_id?: string;
     contextual_tuples?: OpenFgaContextualTuples;
+    /** Values for condition parameters. */
+    context?: Record<string, unknown>;
 }
 export interface OpenFgaBatchCheckItem {
     tuple_key: OpenFgaTupleKey;
     /** Keys the result; defaults to the item's index. */
     correlation_id?: string;
     contextual_tuples?: OpenFgaContextualTuples;
+    context?: Record<string, unknown>;
 }
-export interface OpenFgaBatchCheckBody {
+export interface OpenFgaBatchCheckBody extends OpenFgaConsistencyOptions {
     /** 1–100 checks. */
     checks: OpenFgaBatchCheckItem[];
     authorization_model_id?: string;
@@ -61,13 +75,74 @@ export interface OpenFgaExpandBody {
     };
     authorization_model_id?: string;
 }
-export interface OpenFgaListObjectsBody {
+export interface OpenFgaListObjectsBody extends OpenFgaConsistencyOptions {
     /** Object type, e.g. `document`. */
     type: string;
     relation: string;
     user: string;
     authorization_model_id?: string;
     contextual_tuples?: OpenFgaContextualTuples;
+    context?: Record<string, unknown>;
+}
+export interface OpenFgaListUsersBody extends OpenFgaConsistencyOptions {
+    object: {
+        type: string;
+        id: string;
+    };
+    relation: string;
+    /** Exactly one filter; add `relation` to get usersets. */
+    user_filters: [{
+        type: string;
+        relation?: string;
+    }];
+    authorization_model_id?: string;
+    contextual_tuples?: OpenFgaContextualTuples;
+    context?: Record<string, unknown>;
+    /** Atlas extension: 1–1000, default 1000. */
+    page_size?: number;
+    /** Atlas extension: the previous page's `continuation_token`. */
+    continuation_token?: string;
+}
+/** One listed user: a person/thing, a userset, or the public wildcard. */
+export type OpenFgaListedUser = {
+    object: {
+        type: string;
+        id: string;
+    };
+} | {
+    userset: {
+        type: string;
+        id: string;
+        relation: string;
+    };
+} | {
+    wildcard: {
+        type: string;
+    };
+};
+export interface OpenFgaListUsersResult {
+    users: OpenFgaListedUser[];
+    excluded_users: Array<{
+        object: {
+            type: string;
+            id: string;
+        };
+    }>;
+    /** Empty on the last page. */
+    continuation_token: string;
+}
+export interface OpenFgaReadChangesParams {
+    type?: string;
+    /** 1–100, default 50. */
+    page_size?: number;
+    continuation_token?: string;
+    /** RFC 3339. */
+    start_time?: string;
+}
+export interface OpenFgaTupleChange {
+    tuple_key: OpenFgaTupleKey;
+    operation: 'TUPLE_OPERATION_WRITE' | 'TUPLE_OPERATION_DELETE';
+    timestamp: string;
 }
 export interface OpenFgaReadBody {
     /** Optional filter; `object` may be a full `type:id` or a bare `type:` prefix. */
@@ -128,6 +203,18 @@ export declare function openfgaResource(request: RequestFn): {
     listObjects(store: string, body: OpenFgaListObjectsBody): Promise<{
         objects: string[];
     }>;
+    /**
+     * Who has `relation` on `object` (OpenFGA ListUsers): users, usersets and the
+     * wildcard with `excluded_users`. One page — see {@link listAllUsers}.
+     */
+    listUsers(store: string, body: OpenFgaListUsersBody): Promise<OpenFgaListUsersResult>;
+    /** {@link listUsers} following `continuation_token` until every page is collected. */
+    listAllUsers(store: string, body: OpenFgaListUsersBody): Promise<OpenFgaListUsersResult>;
+    /** The tuple change log (OpenFGA ReadChanges); the token also resumes after the last page. */
+    readChanges(store: string, params?: OpenFgaReadChangesParams): Promise<{
+        changes: OpenFgaTupleChange[];
+        continuation_token: string;
+    }>;
     read(store: string, body?: OpenFgaReadBody): Promise<{
         tuples: OpenFgaTuple[];
         continuation_token: string;

package/dist/client/openfga.js

@@ -3,7 +3,7 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.openfgaResource = openfgaResource;
 const request_1 = require("./request");
 function openfgaResource(request) {
-    return {
+    const api = {
         stores: {
             list() {
                 return request({ method: 'GET', path: '/v1/openfga/stores' });
@@ -60,6 +60,31 @@ function openfgaResource(request) {
                 body,
             });
         },
+        /**
+         * Who has `relation` on `object` (OpenFGA ListUsers): users, usersets and the
+         * wildcard with `excluded_users`. One page — see {@link listAllUsers}.
+         */
+        listUsers(store, body) {
+            return request({ method: 'POST', path: `/v1/openfga/stores/${(0, request_1.enc)(store)}/list-users`, body });
+        },
+        /** {@link listUsers} following `continuation_token` until every page is collected. */
+        async listAllUsers(store, body) {
+            let page = await api.listUsers(store, body);
+            const users = [...page.users];
+            while (page.continuation_token) {
+                page = await api.listUsers(store, { ...body, continuation_token: page.continuation_token });
+                users.push(...page.users);
+            }
+            return { ...page, users };
+        },
+        /** The tuple change log (OpenFGA ReadChanges); the token also resumes after the last page. */
+        readChanges(store, params = {}) {
+            return request({
+                method: 'GET',
+                path: `/v1/openfga/stores/${(0, request_1.enc)(store)}/changes`,
+                query: { ...params },
+            });
+        },
         read(store, body = {}) {
             return request({ method: 'POST', path: `/v1/openfga/stores/${(0, request_1.enc)(store)}/read`, body });
         },
@@ -68,5 +93,6 @@ function openfgaResource(request) {
             return request({ method: 'POST', path: `/v1/openfga/stores/${(0, request_1.enc)(store)}/write`, body });
         },
     };
+    return api;
 }
 //# sourceMappingURL=openfga.js.map

package/dist/client/openfga.js.map

@@ -1 +1 @@
-{"version":3,"file":"openfga.js","sourceRoot":"","sources":["../../src/client/openfga.ts"],"names":[],"mappings":";;AA+FA,0CA8EC;AA7KD,uCAAgD;AA+FhD,SAAgB,eAAe,CAAC,OAAkB;IAChD,OAAO;QACL,MAAM,EAAE;YACN,IAAI;gBACF,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,oBAAoB,EAAE,CAAC,CAAC;YAChE,CAAC;YACD,MAAM,CAAC,IAAsB,EAAE,cAAuB;gBACpD,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,oBAAoB,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC;YACvF,CAAC;YACD,GAAG,CAAC,KAAa;gBACf,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,sBAAsB,IAAA,aAAG,EAAC,KAAK,CAAC,EAAE,EAAE,CAAC,CAAC;YAC9E,CAAC;SACF;QACD,mBAAmB,EAAE;YACnB,IAAI,CAAC,KAAa;gBAChB,OAAO,OAAO,CAAC;oBACb,MAAM,EAAE,KAAK;oBACb,IAAI,EAAE,sBAAsB,IAAA,aAAG,EAAC,KAAK,CAAC,uBAAuB;iBAC9D,CAAC,CAAC;YACL,CAAC;YACD,mEAAmE;YACnE,KAAK,CAAC,KAAa,EAAE,IAA2B;gBAC9C,OAAO,OAAO,CAAC;oBACb,MAAM,EAAE,MAAM;oBACd,IAAI,EAAE,sBAAsB,IAAA,aAAG,EAAC,KAAK,CAAC,uBAAuB;oBAC7D,IAAI;iBACL,CAAC,CAAC;YACL,CAAC;YACD,GAAG,CACD,KAAa,EACb,OAAe;gBAEf,OAAO,OAAO,CAAC;oBACb,MAAM,EAAE,KAAK;oBACb,IAAI,EAAE,sBAAsB,IAAA,aAAG,EAAC,KAAK,CAAC,yBAAyB,IAAA,aAAG,EAAC,OAAO,CAAC,EAAE;iBAC9E,CAAC,CAAC;YACL,CAAC;SACF;QACD,KAAK,CAAC,KAAa,EAAE,IAAsB;YACzC,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,sBAAsB,IAAA,aAAG,EAAC,KAAK,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC;QAC3F,CAAC;QACD,qEAAqE;QACrE,UAAU,CACR,KAAa,EACb,IAA2B;YAE3B,OAAO,OAAO,CAAC;gBACb,MAAM,EAAE,MAAM;gBACd,IAAI,EAAE,sBAAsB,IAAA,aAAG,EAAC,KAAK,CAAC,cAAc;gBACpD,IAAI;aACL,CAAC,CAAC;QACL,CAAC;QACD,4EAA4E;QAC5E,MAAM,CACJ,KAAa,EACb,IAAuB;YAEvB,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,sBAAsB,IAAA,aAAG,EAAC,KAAK,CAAC,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAC5F,CAAC;QACD,gEAAgE;QAChE,WAAW,CAAC,KAAa,EAAE,IAA4B;YACrD,OAAO,OAAO,CAAC;gBACb,MAAM,EAAE,MAAM;gBACd,IAAI,EAAE,sBAAsB,IAAA,aAAG,EAAC,KAAK,CAAC,eAAe;gBACrD,IAAI;aACL,CAAC,CAAC;QACL,CAAC;QACD,IAAI,CACF,KAAa,EACb,OAAwB,EAAE;YAE1B,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,sBAAsB,IAAA,aAAG,EAAC,KAAK,CAAC,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;QAC1F,CAAC;QACD,uDAAuD;QACvD,KAAK,CAAC,KAAa,EAAE,IAAsB;YACzC,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,sBAAsB,IAAA,aAAG,EAAC,KAAK,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC;QAC3F,CAAC;KACF,CAAC;AACJ,CAAC"}
+{"version":3,"file":"openfga.js","sourceRoot":"","sources":["../../src/client/openfga.ts"],"names":[],"mappings":";;AAsJA,0CA2GC;AAjQD,uCAAgD;AAsJhD,SAAgB,eAAe,CAAC,OAAkB;IAChD,MAAM,GAAG,GAAG;QACV,MAAM,EAAE;YACN,IAAI;gBACF,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,oBAAoB,EAAE,CAAC,CAAC;YAChE,CAAC;YACD,MAAM,CAAC,IAAsB,EAAE,cAAuB;gBACpD,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,oBAAoB,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC;YACvF,CAAC;YACD,GAAG,CAAC,KAAa;gBACf,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,sBAAsB,IAAA,aAAG,EAAC,KAAK,CAAC,EAAE,EAAE,CAAC,CAAC;YAC9E,CAAC;SACF;QACD,mBAAmB,EAAE;YACnB,IAAI,CAAC,KAAa;gBAChB,OAAO,OAAO,CAAC;oBACb,MAAM,EAAE,KAAK;oBACb,IAAI,EAAE,sBAAsB,IAAA,aAAG,EAAC,KAAK,CAAC,uBAAuB;iBAC9D,CAAC,CAAC;YACL,CAAC;YACD,mEAAmE;YACnE,KAAK,CAAC,KAAa,EAAE,IAA2B;gBAC9C,OAAO,OAAO,CAAC;oBACb,MAAM,EAAE,MAAM;oBACd,IAAI,EAAE,sBAAsB,IAAA,aAAG,EAAC,KAAK,CAAC,uBAAuB;oBAC7D,IAAI;iBACL,CAAC,CAAC;YACL,CAAC;YACD,GAAG,CACD,KAAa,EACb,OAAe;gBAEf,OAAO,OAAO,CAAC;oBACb,MAAM,EAAE,KAAK;oBACb,IAAI,EAAE,sBAAsB,IAAA,aAAG,EAAC,KAAK,CAAC,yBAAyB,IAAA,aAAG,EAAC,OAAO,CAAC,EAAE;iBAC9E,CAAC,CAAC;YACL,CAAC;SACF;QACD,KAAK,CAAC,KAAa,EAAE,IAAsB;YACzC,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,sBAAsB,IAAA,aAAG,EAAC,KAAK,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC;QAC3F,CAAC;QACD,qEAAqE;QACrE,UAAU,CACR,KAAa,EACb,IAA2B;YAE3B,OAAO,OAAO,CAAC;gBACb,MAAM,EAAE,MAAM;gBACd,IAAI,EAAE,sBAAsB,IAAA,aAAG,EAAC,KAAK,CAAC,cAAc;gBACpD,IAAI;aACL,CAAC,CAAC;QACL,CAAC;QACD,4EAA4E;QAC5E,MAAM,CACJ,KAAa,EACb,IAAuB;YAEvB,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,sBAAsB,IAAA,aAAG,EAAC,KAAK,CAAC,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAC5F,CAAC;QACD,gEAAgE;QAChE,WAAW,CAAC,KAAa,EAAE,IAA4B;YACrD,OAAO,OAAO,CAAC;gBACb,MAAM,EAAE,MAAM;gBACd,IAAI,EAAE,sBAAsB,IAAA,aAAG,EAAC,KAAK,CAAC,eAAe;gBACrD,IAAI;aACL,CAAC,CAAC;QACL,CAAC;QACD;;;WAGG;QACH,SAAS,CAAC,KAAa,EAAE,IAA0B;YACjD,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,sBAAsB,IAAA,aAAG,EAAC,KAAK,CAAC,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC;QAChG,CAAC;QACD,sFAAsF;QACtF,KAAK,CAAC,YAAY,CAAC,KAAa,EAAE,IAA0B;YAC1D,IAAI,IAAI,GAAG,MAAM,GAAG,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;YAC5C,MAAM,KAAK,GAAG,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC;YAC9B,OAAO,IAAI,CAAC,kBAAkB,EAAE,CAAC;gBAC/B,IAAI,GAAG,MAAM,GAAG,CAAC,SAAS,CAAC,KAAK,EAAE,EAAE,GAAG,IAAI,EAAE,kBAAkB,EAAE,IAAI,CAAC,kBAAkB,EAAE,CAAC,CAAC;gBAC5F,KAAK,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC;YAC5B,CAAC;YACD,OAAO,EAAE,GAAG,IAAI,EAAE,KAAK,EAAE,CAAC;QAC5B,CAAC;QACD,8FAA8F;QAC9F,WAAW,CACT,KAAa,EACb,SAAmC,EAAE;YAErC,OAAO,OAAO,CAAC;gBACb,MAAM,EAAE,KAAK;gBACb,IAAI,EAAE,sBAAsB,IAAA,aAAG,EAAC,KAAK,CAAC,UAAU;gBAChD,KAAK,EAAE,EAAE,GAAG,MAAM,EAAE;aACrB,CAAC,CAAC;QACL,CAAC;QACD,IAAI,CACF,KAAa,EACb,OAAwB,EAAE;YAE1B,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,sBAAsB,IAAA,aAAG,EAAC,KAAK,CAAC,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;QAC1F,CAAC;QACD,uDAAuD;QACvD,KAAK,CAAC,KAAa,EAAE,IAAsB;YACzC,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,sBAAsB,IAAA,aAAG,EAAC,KAAK,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC;QAC3F,CAAC;KACF,CAAC;IACF,OAAO,GAAG,CAAC;AACb,CAAC"}

package/dist/client/policy-bundles.d.ts

@@ -0,0 +1,105 @@
+import { type RequestFn } from './request';
+/**
+ * Signed policy bundles: the instance's ABAC policies and FGA authorization
+ * models as one versioned tar.gz with a manifest of file digests, signed with the
+ * instance signing key (detached JWS). Export, verify, and import with a dry-run
+ * diff. To check a bundle WITHOUT calling Atlas, use `verifyPolicyBundle`.
+ */
+export interface PolicyBundle {
+    object: 'policy_bundle';
+    /** A digest of the bundle CONTENT (`rev_…`): the same policy has the same revision everywhere. */
+    revision: string;
+    sha256: string;
+    size: number;
+    key_id: string;
+    algorithm: 'RS256' | 'ES256';
+    /** Detached compact JWS (`header..signature`) over the archive bytes. */
+    signature: string;
+    origin: 'export' | 'import';
+    manifest: Record<string, unknown>;
+    /** The tar.gz, base64. Present on export and get; omitted from lists. */
+    bundle?: string;
+    media_type?: 'application/gzip';
+    created_at: number;
+}
+export interface PolicyBundleUpload {
+    /** The tar.gz, base64 (a `Uint8Array` is encoded for you). */
+    bundle: string | Uint8Array;
+    signature: string;
+    /** Public keys to trust in addition to this instance's, e.g. the staging instance when promoting to production. */
+    trusted_jwks?: {
+        keys: Array<Record<string, unknown>>;
+    };
+}
+export interface PolicyBundleVerification {
+    object: 'policy_bundle_verification';
+    /** Signature AND integrity both check out. */
+    valid: boolean;
+    signature: {
+        valid: boolean;
+        key_id: string | null;
+        algorithm: string | null;
+        error?: string;
+    };
+    integrity: {
+        valid: boolean;
+        code?: string;
+        error?: string;
+    };
+    revision: string | null;
+    manifest: Record<string, unknown> | null;
+}
+export interface PolicyBundleDiffSection {
+    create: string[];
+    update: Array<{
+        name: string;
+        changed: string[];
+    }>;
+    /** On the instance, absent from the bundle. ABAC policies are deleted only with `prune`; FGA stores never. */
+    absent: string[];
+    unchanged: number;
+}
+export interface PolicyBundleDiff {
+    abac_policies: PolicyBundleDiffSection;
+    fga_stores: PolicyBundleDiffSection;
+    abac_templates: PolicyBundleDiffSection;
+    abac_links: PolicyBundleDiffSection;
+    /** `absent`: the instance has a schema and the bundle does not (removed only with `prune`). */
+    abac_schema: 'create' | 'update' | 'absent' | 'unchanged';
+    identical: boolean;
+}
+export interface PolicyBundleImport {
+    object: 'policy_bundle_import';
+    dry_run: boolean;
+    applied: boolean;
+    prune: boolean;
+    revision: string;
+    diff: PolicyBundleDiff;
+}
+export declare function policyBundlesResource(request: RequestFn): {
+    /** The stored bundles, newest first (without archives). */
+    list(): Promise<{
+        object: "list";
+        data: PolicyBundle[];
+        has_more: boolean;
+    }>;
+    /** The revision the instance policy is at right now — compare with a deployed bundle's to detect drift. */
+    current(): Promise<{
+        object: "policy_bundle_revision";
+        revision: string;
+    }>;
+    /** Export the current policy as a signed bundle. */
+    export(): Promise<PolicyBundle>;
+    get(revision: string): Promise<PolicyBundle>;
+    /** Check a bundle's signature and integrity on Atlas. */
+    verify(body: PolicyBundleUpload): Promise<PolicyBundleVerification>;
+    /**
+     * Import a signed bundle. `dryRun` returns what would change and applies
+     * nothing; a real import applies everything in one transaction. A bundle whose
+     * signature or integrity fails is refused with 422 before anything changes.
+     */
+    import(body: PolicyBundleUpload & {
+        dry_run?: boolean;
+        prune?: boolean;
+    }): Promise<PolicyBundleImport>;
+};

package/dist/client/policy-bundles.js

@@ -0,0 +1,38 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.policyBundlesResource = policyBundlesResource;
+const request_1 = require("./request");
+const toBase64 = (b) => typeof b === 'string' ? b : btoa(Array.from(b, (c) => String.fromCharCode(c)).join(''));
+function policyBundlesResource(request) {
+    const upload = (u) => ({ ...u, bundle: toBase64(u.bundle) });
+    return {
+        /** The stored bundles, newest first (without archives). */
+        list() {
+            return request({ method: 'GET', path: '/v1/policy_bundles' });
+        },
+        /** The revision the instance policy is at right now — compare with a deployed bundle's to detect drift. */
+        current() {
+            return request({ method: 'GET', path: '/v1/policy_bundles/current' });
+        },
+        /** Export the current policy as a signed bundle. */
+        export() {
+            return request({ method: 'POST', path: '/v1/policy_bundles' });
+        },
+        get(revision) {
+            return request({ method: 'GET', path: `/v1/policy_bundles/${(0, request_1.enc)(revision)}` });
+        },
+        /** Check a bundle's signature and integrity on Atlas. */
+        verify(body) {
+            return request({ method: 'POST', path: '/v1/policy_bundles/verify', body: upload(body) });
+        },
+        /**
+         * Import a signed bundle. `dryRun` returns what would change and applies
+         * nothing; a real import applies everything in one transaction. A bundle whose
+         * signature or integrity fails is refused with 422 before anything changes.
+         */
+        import(body) {
+            return request({ method: 'POST', path: '/v1/policy_bundles/import', body: upload(body) });
+        },
+    };
+}
+//# sourceMappingURL=policy-bundles.js.map

package/dist/client/policy-bundles.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"policy-bundles.js","sourceRoot":"","sources":["../../src/client/policy-bundles.ts"],"names":[],"mappings":";;AA2EA,sDA+BC;AA1GD,uCAAgD;AAwEhD,MAAM,QAAQ,GAAG,CAAC,CAAsB,EAAU,EAAE,CAClD,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC;AAE1F,SAAgB,qBAAqB,CAAC,OAAkB;IACtD,MAAM,MAAM,GAAG,CAAC,CAAqB,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;IACjF,OAAO;QACL,2DAA2D;QAC3D,IAAI;YACF,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,oBAAoB,EAAE,CAAC,CAAC;QAChE,CAAC;QACD,2GAA2G;QAC3G,OAAO;YACL,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,4BAA4B,EAAE,CAAC,CAAC;QACxE,CAAC;QACD,oDAAoD;QACpD,MAAM;YACJ,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,oBAAoB,EAAE,CAAC,CAAC;QACjE,CAAC;QACD,GAAG,CAAC,QAAgB;YAClB,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,sBAAsB,IAAA,aAAG,EAAC,QAAQ,CAAC,EAAE,EAAE,CAAC,CAAC;QACjF,CAAC;QACD,yDAAyD;QACzD,MAAM,CAAC,IAAwB;YAC7B,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,2BAA2B,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAC5F,CAAC;QACD;;;;WAIG;QACH,MAAM,CAAC,IAAiE;YACtE,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,2BAA2B,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAC5F,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/client/resources.d.ts

@@ -145,5 +145,6 @@ export declare function resourcesResource(request: RequestFn): {
         type?: string;
         groups?: string[];
         limit?: number;
+        starting_after?: string;
     }): Promise<ListPage<Resource>>;
 };

package/dist/client/resources.js.map

@@ -1 +1 @@
-{"version":3,"file":"resources.js","sourceRoot":"","sources":["../../src/client/resources.ts"],"names":[],"mappings":";;AAuFA,8CAkEC;AAzJD,uCAAgD;AAsFhD,qHAAqH;AACrH,SAAgB,iBAAiB,CAAC,OAAkB;IAClD,OAAO;QACL,KAAK,EAAE;YACL,IAAI;gBACF,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,oBAAoB,EAAE,CAAC,CAAC;YAChE,CAAC;YACD,GAAG,CAAC,GAAW;gBACb,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,sBAAsB,IAAA,aAAG,EAAC,GAAG,CAAC,EAAE,EAAE,CAAC,CAAC;YAC5E,CAAC;YACD,MAAM,CAAC,IAA4B,EAAE,cAAuB;gBAC1D,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,oBAAoB,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC;YACvF,CAAC;YACD,MAAM,CAAC,GAAW,EAAE,IAAkD;gBACpE,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,sBAAsB,IAAA,aAAG,EAAC,GAAG,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;YACpF,CAAC;YACD,MAAM,CAAC,GAAW;gBAChB,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,sBAAsB,IAAA,aAAG,EAAC,GAAG,CAAC,EAAE,EAAE,CAAC,CAAC;YAC/E,CAAC;SACF;QACD,IAAI,CAAC,QAA+D,EAAE;YACpE,MAAM,CAAC,GAAG,IAAI,eAAe,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,SAAS,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAoB,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YAC1I,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,gBAAgB,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;QACnF,CAAC;QACD,GAAG,CAAC,EAAU;YACZ,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,iBAAiB,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;QACtE,CAAC;QACD,4DAA4D;QAC5D,MAAM,CAAC,IAAwB;YAC7B,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,eAAe,EAAE,IAAI,EAAE,CAAC,CAAC;QACjE,CAAC;QACD,qFAAqF;QACrF,IAAI,CAAC,SAA+B;YAClC,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,oBAAoB,EAAE,IAAI,EAAE,EAAE,SAAS,EAAE,EAAE,CAAC,CAAC;QACtF,CAAC;QACD,MAAM,CAAC,EAAU;YACf,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,iBAAiB,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;QACzE,CAAC;QACD,WAAW,EAAE;YACX,IAAI,CAAC,QAA8E,EAAE;gBACnF,MAAM,CAAC,GAAG,IAAI,eAAe,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,SAAS,CAAuB,CAAC,CAAC;gBAC9G,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,gCAAgC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;YACnG,CAAC;YACD,2DAA2D;YAC3D,MAAM,CAAC,IAA0F;gBAC/F,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,+BAA+B,EAAE,IAAI,EAAE,CAAC,CAAC;YAClF,CAAC;YACD,MAAM,CAAC,EAAU;gBACf,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,iCAAiC,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;YACzF,CAAC;SACF;QACD,qDAAqD;QACrD,KAAK,CAAC,IAAuB;YAC3B,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,qBAAqB,EAAE,IAAI,EAAE,CAAC,CAAC;QACxE,CAAC;QACD,wDAAwD;QACxD,KAAK,CAAC,GAAG,CAAC,IAAuB;YAC/B,OAAO,CAAC,MAAM,OAAO,CAAgB,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,qBAAqB,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC;QACvG,CAAC;QACD,UAAU,CAAC,MAA2B;YACpC,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,2BAA2B,EAAE,IAAI,EAAE,EAAE,MAAM,EAAE,EAAE,CAAC,CAAC;QAC1F,CAAC;QACD,mFAAmF;QACnF,UAAU,CAAC,IAAwG;YACjH,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,0BAA0B,EAAE,IAAI,EAAE,CAAC,CAAC;QAC7E,CAAC;KACF,CAAC;AACJ,CAAC"}
+{"version":3,"file":"resources.js","sourceRoot":"","sources":["../../src/client/resources.ts"],"names":[],"mappings":";;AAuFA,8CAkEC;AAzJD,uCAAgD;AAsFhD,qHAAqH;AACrH,SAAgB,iBAAiB,CAAC,OAAkB;IAClD,OAAO;QACL,KAAK,EAAE;YACL,IAAI;gBACF,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,oBAAoB,EAAE,CAAC,CAAC;YAChE,CAAC;YACD,GAAG,CAAC,GAAW;gBACb,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,sBAAsB,IAAA,aAAG,EAAC,GAAG,CAAC,EAAE,EAAE,CAAC,CAAC;YAC5E,CAAC;YACD,MAAM,CAAC,IAA4B,EAAE,cAAuB;gBAC1D,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,oBAAoB,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC;YACvF,CAAC;YACD,MAAM,CAAC,GAAW,EAAE,IAAkD;gBACpE,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,sBAAsB,IAAA,aAAG,EAAC,GAAG,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;YACpF,CAAC;YACD,MAAM,CAAC,GAAW;gBAChB,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,sBAAsB,IAAA,aAAG,EAAC,GAAG,CAAC,EAAE,EAAE,CAAC,CAAC;YAC/E,CAAC;SACF;QACD,IAAI,CAAC,QAA+D,EAAE;YACpE,MAAM,CAAC,GAAG,IAAI,eAAe,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,SAAS,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAoB,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YAC1I,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,gBAAgB,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;QACnF,CAAC;QACD,GAAG,CAAC,EAAU;YACZ,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,iBAAiB,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;QACtE,CAAC;QACD,4DAA4D;QAC5D,MAAM,CAAC,IAAwB;YAC7B,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,eAAe,EAAE,IAAI,EAAE,CAAC,CAAC;QACjE,CAAC;QACD,qFAAqF;QACrF,IAAI,CAAC,SAA+B;YAClC,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,oBAAoB,EAAE,IAAI,EAAE,EAAE,SAAS,EAAE,EAAE,CAAC,CAAC;QACtF,CAAC;QACD,MAAM,CAAC,EAAU;YACf,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,iBAAiB,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;QACzE,CAAC;QACD,WAAW,EAAE;YACX,IAAI,CAAC,QAA8E,EAAE;gBACnF,MAAM,CAAC,GAAG,IAAI,eAAe,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,SAAS,CAAuB,CAAC,CAAC;gBAC9G,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,gCAAgC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;YACnG,CAAC;YACD,2DAA2D;YAC3D,MAAM,CAAC,IAA0F;gBAC/F,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,+BAA+B,EAAE,IAAI,EAAE,CAAC,CAAC;YAClF,CAAC;YACD,MAAM,CAAC,EAAU;gBACf,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,iCAAiC,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;YACzF,CAAC;SACF;QACD,qDAAqD;QACrD,KAAK,CAAC,IAAuB;YAC3B,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,qBAAqB,EAAE,IAAI,EAAE,CAAC,CAAC;QACxE,CAAC;QACD,wDAAwD;QACxD,KAAK,CAAC,GAAG,CAAC,IAAuB;YAC/B,OAAO,CAAC,MAAM,OAAO,CAAgB,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,qBAAqB,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC;QACvG,CAAC;QACD,UAAU,CAAC,MAA2B;YACpC,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,2BAA2B,EAAE,IAAI,EAAE,EAAE,MAAM,EAAE,EAAE,CAAC,CAAC;QAC1F,CAAC;QACD,mFAAmF;QACnF,UAAU,CAAC,IAAiI;YAC1I,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,0BAA0B,EAAE,IAAI,EAAE,CAAC,CAAC;QAC7E,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/client/ssf.d.ts

@@ -51,7 +51,8 @@ export interface SsfEventRecord {
     delivered_at: number | null;
     created_at: number;
 }
-export type SsfReceiverAction = 'revoke_sessions' | 'ban' | 'ignore';
+/** `sync_posture` (device-compliance-change only) records the device's compliance in Atlas device posture and nothing else. */
+export type SsfReceiverAction = 'revoke_sessions' | 'refresh_claims' | 'ban' | 'sync_posture' | 'ignore';
 export interface SsfReceiver {
     object: 'ssf_receiver';
     id: string;

package/dist/client/ssf.js.map

@@ -1 +1 @@
-{"version":3,"file":"ssf.js","sourceRoot":"","sources":["../../src/client/ssf.ts"],"names":[],"mappings":";;AA4FA,kCA2CC;AA5CD,wGAAwG;AACxG,SAAgB,WAAW,CAAC,OAAkB;IAC5C,MAAM,MAAM,GAAG,CAAC,EAAU,EAAE,EAAE,CAAC,mBAAmB,kBAAkB,CAAC,EAAE,CAAC,EAAE,CAAC;IAC3E,MAAM,QAAQ,GAAG,CAAC,EAAU,EAAE,EAAE,CAAC,qBAAqB,kBAAkB,CAAC,EAAE,CAAC,EAAE,CAAC;IAC/E,OAAO;QACL,OAAO,EAAE;YACP,IAAI;gBACF,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,iBAAiB,EAAE,CAAC,CAAC;YAC7D,CAAC;YACD,MAAM,CAAC,IAAyB;gBAC9B,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,iBAAiB,EAAE,IAAI,EAAE,CAAC,CAAC;YACpE,CAAC;YACD,GAAG,CAAC,EAAU;gBACZ,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;YACtD,CAAC;YACD,MAAM,CAAC,EAAU,EAAE,IAAyB;gBAC1C,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,CAAC,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC;YAC9D,CAAC;YACD,MAAM,CAAC,EAAU;gBACf,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;YACzD,CAAC;YACD,+EAA+E;YAC/E,MAAM,CAAC,EAAU,EAAE,KAAc;gBAC/B,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,CAAC,EAAE,CAAC,SAAS,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC;YACpF,CAAC;YACD,MAAM,CAAC,EAAU,EAAE,QAA4B,EAAE;gBAC/C,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,MAAM,CAAC,EAAE,CAAC,SAAS,EAAE,KAAK,EAAE,CAAC,CAAC;YACzE,CAAC;SACF;QACD,SAAS,EAAE;YACT,IAAI;gBACF,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,mBAAmB,EAAE,CAAC,CAAC;YAC/D,CAAC;YACD,MAAM,CAAC,IAA2B;gBAChC,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,mBAAmB,EAAE,IAAI,EAAE,CAAC,CAAC;YACtE,CAAC;YACD,MAAM,CAAC,EAAU,EAAE,IAA4E;gBAC7F,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,CAAC,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC;YAChE,CAAC;YACD,MAAM,CAAC,EAAU;gBACf,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,QAAQ,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;YAC3D,CAAC;SACF;KACF,CAAC;AACJ,CAAC"}
+{"version":3,"file":"ssf.js","sourceRoot":"","sources":["../../src/client/ssf.ts"],"names":[],"mappings":";;AA6FA,kCA2CC;AA5CD,wGAAwG;AACxG,SAAgB,WAAW,CAAC,OAAkB;IAC5C,MAAM,MAAM,GAAG,CAAC,EAAU,EAAE,EAAE,CAAC,mBAAmB,kBAAkB,CAAC,EAAE,CAAC,EAAE,CAAC;IAC3E,MAAM,QAAQ,GAAG,CAAC,EAAU,EAAE,EAAE,CAAC,qBAAqB,kBAAkB,CAAC,EAAE,CAAC,EAAE,CAAC;IAC/E,OAAO;QACL,OAAO,EAAE;YACP,IAAI;gBACF,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,iBAAiB,EAAE,CAAC,CAAC;YAC7D,CAAC;YACD,MAAM,CAAC,IAAyB;gBAC9B,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,iBAAiB,EAAE,IAAI,EAAE,CAAC,CAAC;YACpE,CAAC;YACD,GAAG,CAAC,EAAU;gBACZ,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;YACtD,CAAC;YACD,MAAM,CAAC,EAAU,EAAE,IAAyB;gBAC1C,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,CAAC,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC;YAC9D,CAAC;YACD,MAAM,CAAC,EAAU;gBACf,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;YACzD,CAAC;YACD,+EAA+E;YAC/E,MAAM,CAAC,EAAU,EAAE,KAAc;gBAC/B,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,CAAC,EAAE,CAAC,SAAS,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC;YACpF,CAAC;YACD,MAAM,CAAC,EAAU,EAAE,QAA4B,EAAE;gBAC/C,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,MAAM,CAAC,EAAE,CAAC,SAAS,EAAE,KAAK,EAAE,CAAC,CAAC;YACzE,CAAC;SACF;QACD,SAAS,EAAE;YACT,IAAI;gBACF,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,mBAAmB,EAAE,CAAC,CAAC;YAC/D,CAAC;YACD,MAAM,CAAC,IAA2B;gBAChC,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,mBAAmB,EAAE,IAAI,EAAE,CAAC,CAAC;YACtE,CAAC;YACD,MAAM,CAAC,EAAU,EAAE,IAA4E;gBAC7F,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,CAAC,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC;YAChE,CAAC;YACD,MAAM,CAAC,EAAU;gBACf,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,QAAQ,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;YAC3D,CAAC;SACF;KACF,CAAC;AACJ,CAAC"}

package/dist/client/vc.d.ts

@@ -18,6 +18,8 @@ export interface VcCredentialType {
     namespace: string | null;
     /** mdoc: PEM IACA roots a presentation must chain to. */
     iaca_roots: string[];
+    /** mdoc: issuer revocation checks (certificate CRL / OCSP, MSO status list). */
+    revocation_policy: VcRevocationPolicy;
     /** mdoc: PEM Document Signer chain published as x5chain. */
     signer_chain: string[];
     name: string;
@@ -27,6 +29,7 @@ export interface VcCredentialType {
     created_at: number;
 }
 export type VcFormat = 'dc+sd-jwt' | 'mso_mdoc';
+export type VcRevocationPolicy = 'off' | 'best_effort' | 'required';
 export interface CreateVcCredentialTypeBody {
     /** The vct, or the docType for mso_mdoc (for example org.iso.18013.5.1.mDL). */
     vct: string;
@@ -35,6 +38,8 @@ export interface CreateVcCredentialTypeBody {
     namespace?: string;
     /** mso_mdoc: PEM IACA roots (ISO 18013-5 Annex B); with roots set only a certificate chain is accepted. */
     iaca_roots?: string[];
+    /** mso_mdoc: off, best_effort (default) or required. */
+    revocation_policy?: VcRevocationPolicy;
     /** mso_mdoc: PEM Document Signer certificate (then intermediates) for the instance's mdoc signing key. */
     signer_chain?: string[];
     name: string;
@@ -69,6 +74,7 @@ export interface VcPresentationRequest {
     vct: string;
     format: VcFormat;
     iaca_roots: string[];
+    revocation_policy: VcRevocationPolicy | null;
     claims: string[];
     status: 'pending' | 'verified' | 'failed';
     result: {
@@ -114,6 +120,8 @@ export declare function vcResource(request: RequestFn): {
             format?: VcFormat;
             /** mso_mdoc: PEM IACA roots for this request. */
             iaca_roots?: string[];
+            /** mso_mdoc: overrides the credential type's revocation policy. */
+            revocation_policy?: VcRevocationPolicy;
             claims?: string[];
             trusted_issuers?: Array<{
                 issuer: string;

package/dist/client/vc.js.map

@@ -1 +1 @@
-{"version":3,"file":"vc.js","sourceRoot":"","sources":["../../src/client/vc.ts"],"names":[],"mappings":";;AAyFA,gCA4CC;AArID,uCAAgD;AAwFhD,4GAA4G;AAC5G,SAAgB,UAAU,CAAC,OAAkB;IAC3C,OAAO;QACL,eAAe,EAAE;YACf,IAAI;gBACF,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,yBAAyB,EAAE,CAAC,CAAC;YACrE,CAAC;YACD,MAAM,CAAC,IAAgC;gBACrC,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,yBAAyB,EAAE,IAAI,EAAE,CAAC,CAAC;YAC5E,CAAC;YACD,GAAG,CAAC,EAAU;gBACZ,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,2BAA2B,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;YAChF,CAAC;YACD,MAAM,CAAC,EAAU;gBACf,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,2BAA2B,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;YACnF,CAAC;SACF;QACD,WAAW,CAAC,IAAoG;YAC9G,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,eAAe,EAAE,IAAI,EAAE,CAAC,CAAC;QAClE,CAAC;QACD,WAAW,EAAE;YACX,IAAI,CAAC,QAA8B,EAAE;gBACnC,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,oBAAoB,EAAE,KAAK,EAAE,EAAE,GAAG,KAAK,EAAE,EAAE,CAAC,CAAC;YACrF,CAAC;YACD,MAAM,CAAC,EAAU;gBACf,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,sBAAsB,IAAA,aAAG,EAAC,EAAE,CAAC,SAAS,EAAE,CAAC,CAAC;YACnF,CAAC;SACF;QACD,oBAAoB,EAAE;YACpB,MAAM,CAAC,IAQN;gBACC,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,8BAA8B,EAAE,IAAI,EAAE,CAAC,CAAC;YACjF,CAAC;YACD,GAAG,CAAC,EAAU;gBACZ,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,gCAAgC,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;YACrF,CAAC;SACF;KACF,CAAC;AACJ,CAAC"}
+{"version":3,"file":"vc.js","sourceRoot":"","sources":["../../src/client/vc.ts"],"names":[],"mappings":";;AA+FA,gCA8CC;AA7ID,uCAAgD;AA8FhD,4GAA4G;AAC5G,SAAgB,UAAU,CAAC,OAAkB;IAC3C,OAAO;QACL,eAAe,EAAE;YACf,IAAI;gBACF,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,yBAAyB,EAAE,CAAC,CAAC;YACrE,CAAC;YACD,MAAM,CAAC,IAAgC;gBACrC,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,yBAAyB,EAAE,IAAI,EAAE,CAAC,CAAC;YAC5E,CAAC;YACD,GAAG,CAAC,EAAU;gBACZ,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,2BAA2B,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;YAChF,CAAC;YACD,MAAM,CAAC,EAAU;gBACf,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,2BAA2B,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;YACnF,CAAC;SACF;QACD,WAAW,CAAC,IAAoG;YAC9G,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,eAAe,EAAE,IAAI,EAAE,CAAC,CAAC;QAClE,CAAC;QACD,WAAW,EAAE;YACX,IAAI,CAAC,QAA8B,EAAE;gBACnC,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,oBAAoB,EAAE,KAAK,EAAE,EAAE,GAAG,KAAK,EAAE,EAAE,CAAC,CAAC;YACrF,CAAC;YACD,MAAM,CAAC,EAAU;gBACf,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,sBAAsB,IAAA,aAAG,EAAC,EAAE,CAAC,SAAS,EAAE,CAAC,CAAC;YACnF,CAAC;SACF;QACD,oBAAoB,EAAE;YACpB,MAAM,CAAC,IAUN;gBACC,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,8BAA8B,EAAE,IAAI,EAAE,CAAC,CAAC;YACjF,CAAC;YACD,GAAG,CAAC,EAAU;gBACZ,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,gCAAgC,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;YACrF,CAAC;SACF;KACF,CAAC;AACJ,CAAC"}

package/dist/index.d.ts

@@ -16,6 +16,7 @@ export type { LegacyIssuer, LegacyIssuerKind } from './legacy-issuers';
 export * from './legacy-issuer-presets';
 export * from './framework-sessions';
 export * from './framework-bridge';
+export * from './policy-bundle';
 export { BACKCHANNEL_LOGOUT_EVENT, LOGOUT_TOKEN_CLOCK_SKEW_SECONDS, LOGOUT_TOKEN_MAX_AGE_SECONDS, LogoutTokenVerifier, memoryLogoutReplayStore, verifyLogoutToken, } from './logout-token';
 export type { LogoutReplayStore, LogoutTokenCheckOptions, LogoutTokenClaims, LogoutTokenResult, LogoutTokenVerifierOptions, } from './logout-token';
 export { expressBackchannelLogout, fastifyBackchannelLogout, fastifyBackchannelLogoutPlugin, fetchBackchannelLogout, handleBackchannelLogout, nextBackchannelLogout, readLogoutToken, } from './backchannel-handlers';
@@ -40,3 +41,4 @@ export type { RequirePcaOptions, PcaGuardResult, PcaRequestLike, PcaStateStore }
 export { ACCESS_TOKEN_CLOCK_SKEW_SECONDS, DPOP_PROOF_MAX_AGE_SECONDS, buildWwwAuthenticate, createAccessTokenVerifier, createIntrospector, hmacDpopNonceSource, memoryDpopNonceSource, memoryDpopReplayStore, protectedResourceMetadata, protectedResourceMetadataPath, verifyAccessToken, } from './oauth-resource';
 export type { AccessTokenClaims, AccessTokenErrorCode, AccessTokenResult, AccessTokenVerifierOptions, DpopNonceSource, DpopReplayStore, IntrospectionOptions, ResourceRequestLike, } from './oauth-resource';
 export * from './legacy-verify';
+export * from './uma';

package/dist/index.js

@@ -49,6 +49,8 @@ __exportStar(require("./legacy-issuer-presets"), exports);
 __exportStar(require("./framework-sessions"), exports);
 // …and their bridge presets + token extractors (registers the presets on load).
 __exportStar(require("./framework-bridge"), exports);
+// Verify a signed policy bundle offline (no call to Atlas).
+__exportStar(require("./policy-bundle"), exports);
 // OIDC Back-Channel Logout: verify the logout_token Atlas POSTs to your app.
 var logout_token_1 = require("./logout-token");
 Object.defineProperty(exports, "BACKCHANNEL_LOGOUT_EVENT", { enumerable: true, get: function () { return logout_token_1.BACKCHANNEL_LOGOUT_EVENT; } });
@@ -131,4 +133,5 @@ Object.defineProperty(exports, "protectedResourceMetadata", { enumerable: true,
 Object.defineProperty(exports, "protectedResourceMetadataPath", { enumerable: true, get: function () { return oauth_resource_1.protectedResourceMetadataPath; } });
 Object.defineProperty(exports, "verifyAccessToken", { enumerable: true, get: function () { return oauth_resource_1.verifyAccessToken; } });
 __exportStar(require("./legacy-verify"), exports);
+__exportStar(require("./uma"), exports);
 //# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;AAAA,6DAA6D;AAC7D,+CAA6B;AAC7B,mEAAmE;AACnE,yCAA2G;AAAlG,2GAAA,cAAc,OAAA;AAAE,0GAAA,aAAa,OAAA;AAAE,4GAAA,eAAe,OAAA;AAAE,yHAAA,4BAA4B,OAAA;AACrF,2CAAyB;AACzB,iDAA+B;AAC/B,gDAA8B;AAC9B,mDAAiC;AACjC,8CAA4B;AAC5B,2FAA2F;AAC3F,gDAA8B;AAC9B,qFAAqF;AACrF,sDAAoC;AACpC,qDAAmC;AACnC,kDAAgC;AAChC,yCAA6E;AAApE,mHAAA,sBAAsB,OAAA;AAAE,mHAAA,sBAAsB,OAAA;AACvD,mDAA+D;AAAtD,6HAAA,2BAA2B,OAAA;AACpC,mDAAoE;AAA3D,sHAAA,oBAAoB,OAAA;AAAE,4GAAA,UAAU,OAAA;AAEzC,0DAAwC;AACxC,+EAA+E;AAC/E,4DAA4D;AAC5D,uDAAqC;AACrC,gFAAgF;AAChF,qDAAmC;AAEnC,6EAA6E;AAC7E,+CAOwB;AANtB,wHAAA,wBAAwB,OAAA;AACxB,+HAAA,+BAA+B,OAAA;AAC/B,4HAAA,4BAA4B,OAAA;AAC5B,mHAAA,mBAAmB,OAAA;AACnB,uHAAA,uBAAuB,OAAA;AACvB,iHAAA,iBAAiB,OAAA;AASnB,+EAA+E;AAC/E,+DAQgC;AAP9B,gIAAA,wBAAwB,OAAA;AACxB,gIAAA,wBAAwB,OAAA;AACxB,sIAAA,8BAA8B,OAAA;AAC9B,8HAAA,sBAAsB,OAAA;AACtB,+HAAA,uBAAuB,OAAA;AACvB,6HAAA,qBAAqB,OAAA;AACrB,uHAAA,eAAe,OAAA;AAIjB,sEAAsE;AACtE,iFAAiF;AACjF,+BAcgB;AAbd,sGAAA,cAAc,OAAA;AACd,wGAAA,gBAAgB,OAAA;AAChB,iHAAA,yBAAyB,OAAA;AACzB,4FAAA,IAAI,OAAA;AACJ,oGAAA,YAAY,OAAA;AACZ,uGAAA,eAAe,OAAA;AACf,qGAAA,aAAa,OAAA;AACb,iGAAA,SAAS,OAAA;AACT,yGAAA,iBAAiB,OAAA;AACjB,0GAAA,kBAAkB,OAAA;AAClB,2GAAA,mBAAmB,OAAA;AACnB,iGAAA,SAAS,OAAA;AACT,uGAAA,eAAe,OAAA;AAkBjB,oDAAoD;AACpD,6CAA2B;AAE3B,uFAAuF;AACvF,8CAA4B;AAC5B,kDAAgC;AAEhC,0FAA0F;AAC1F,0CAAwB;AAExB,8DAA8D;AAC9D,mCAA6C;AAApC,2GAAA,iBAAiB,OAAA;AAE1B,2CAAyB;AAEzB,yEAAyE;AACzE,2EAA2E;AAC3E,iEAAiE;AACjE,qCAAmF;AAA1E,2GAAA,gBAAgB,OAAA;AAAE,6GAAA,kBAAkB,OAAA;AAAE,2GAAA,gBAAgB,OAAA;AAU/D,6DAQ+B;AAP7B,4HAAA,qBAAqB,OAAA;AACrB,wHAAA,iBAAiB,OAAA;AACjB,+HAAA,wBAAwB,OAAA;AACxB,yHAAA,kBAAkB,OAAA;AAClB,2HAAA,oBAAoB,OAAA;AACpB,wHAAA,iBAAiB,OAAA;AACjB,4HAAA,qBAAqB,OAAA;AAWvB,wFAAwF;AACxF,2CAA2C;AAC3C,uCAA4C;AAAnC,sGAAA,YAAY,OAAA;AAErB,iDAA+E;AAAtE,yGAAA,UAAU,OAAA;AAAE,6GAAA,cAAc,OAAA;AAAE,6GAAA,cAAc,OAAA;AAGnD,8EAA8E;AAC9E,gFAAgF;AAChF,mDAY0B;AAXxB,iIAAA,+BAA+B,OAAA;AAC/B,4HAAA,0BAA0B,OAAA;AAC1B,sHAAA,oBAAoB,OAAA;AACpB,2HAAA,yBAAyB,OAAA;AACzB,oHAAA,kBAAkB,OAAA;AAClB,qHAAA,mBAAmB,OAAA;AACnB,uHAAA,qBAAqB,OAAA;AACrB,uHAAA,qBAAqB,OAAA;AACrB,2HAAA,yBAAyB,OAAA;AACzB,+HAAA,6BAA6B,OAAA;AAC7B,mHAAA,iBAAiB,OAAA;AAYnB,kDAAgC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;AAAA,6DAA6D;AAC7D,+CAA6B;AAC7B,mEAAmE;AACnE,yCAA2G;AAAlG,2GAAA,cAAc,OAAA;AAAE,0GAAA,aAAa,OAAA;AAAE,4GAAA,eAAe,OAAA;AAAE,yHAAA,4BAA4B,OAAA;AACrF,2CAAyB;AACzB,iDAA+B;AAC/B,gDAA8B;AAC9B,mDAAiC;AACjC,8CAA4B;AAC5B,2FAA2F;AAC3F,gDAA8B;AAC9B,qFAAqF;AACrF,sDAAoC;AACpC,qDAAmC;AACnC,kDAAgC;AAChC,yCAA6E;AAApE,mHAAA,sBAAsB,OAAA;AAAE,mHAAA,sBAAsB,OAAA;AACvD,mDAA+D;AAAtD,6HAAA,2BAA2B,OAAA;AACpC,mDAAoE;AAA3D,sHAAA,oBAAoB,OAAA;AAAE,4GAAA,UAAU,OAAA;AAEzC,0DAAwC;AACxC,+EAA+E;AAC/E,4DAA4D;AAC5D,uDAAqC;AACrC,gFAAgF;AAChF,qDAAmC;AAEnC,4DAA4D;AAC5D,kDAAgC;AAEhC,6EAA6E;AAC7E,+CAOwB;AANtB,wHAAA,wBAAwB,OAAA;AACxB,+HAAA,+BAA+B,OAAA;AAC/B,4HAAA,4BAA4B,OAAA;AAC5B,mHAAA,mBAAmB,OAAA;AACnB,uHAAA,uBAAuB,OAAA;AACvB,iHAAA,iBAAiB,OAAA;AASnB,+EAA+E;AAC/E,+DAQgC;AAP9B,gIAAA,wBAAwB,OAAA;AACxB,gIAAA,wBAAwB,OAAA;AACxB,sIAAA,8BAA8B,OAAA;AAC9B,8HAAA,sBAAsB,OAAA;AACtB,+HAAA,uBAAuB,OAAA;AACvB,6HAAA,qBAAqB,OAAA;AACrB,uHAAA,eAAe,OAAA;AAIjB,sEAAsE;AACtE,iFAAiF;AACjF,+BAcgB;AAbd,sGAAA,cAAc,OAAA;AACd,wGAAA,gBAAgB,OAAA;AAChB,iHAAA,yBAAyB,OAAA;AACzB,4FAAA,IAAI,OAAA;AACJ,oGAAA,YAAY,OAAA;AACZ,uGAAA,eAAe,OAAA;AACf,qGAAA,aAAa,OAAA;AACb,iGAAA,SAAS,OAAA;AACT,yGAAA,iBAAiB,OAAA;AACjB,0GAAA,kBAAkB,OAAA;AAClB,2GAAA,mBAAmB,OAAA;AACnB,iGAAA,SAAS,OAAA;AACT,uGAAA,eAAe,OAAA;AAkBjB,oDAAoD;AACpD,6CAA2B;AAE3B,uFAAuF;AACvF,8CAA4B;AAC5B,kDAAgC;AAEhC,0FAA0F;AAC1F,0CAAwB;AAExB,8DAA8D;AAC9D,mCAA6C;AAApC,2GAAA,iBAAiB,OAAA;AAE1B,2CAAyB;AAEzB,yEAAyE;AACzE,2EAA2E;AAC3E,iEAAiE;AACjE,qCAAmF;AAA1E,2GAAA,gBAAgB,OAAA;AAAE,6GAAA,kBAAkB,OAAA;AAAE,2GAAA,gBAAgB,OAAA;AAU/D,6DAQ+B;AAP7B,4HAAA,qBAAqB,OAAA;AACrB,wHAAA,iBAAiB,OAAA;AACjB,+HAAA,wBAAwB,OAAA;AACxB,yHAAA,kBAAkB,OAAA;AAClB,2HAAA,oBAAoB,OAAA;AACpB,wHAAA,iBAAiB,OAAA;AACjB,4HAAA,qBAAqB,OAAA;AAWvB,wFAAwF;AACxF,2CAA2C;AAC3C,uCAA4C;AAAnC,sGAAA,YAAY,OAAA;AAErB,iDAA+E;AAAtE,yGAAA,UAAU,OAAA;AAAE,6GAAA,cAAc,OAAA;AAAE,6GAAA,cAAc,OAAA;AAGnD,8EAA8E;AAC9E,gFAAgF;AAChF,mDAY0B;AAXxB,iIAAA,+BAA+B,OAAA;AAC/B,4HAAA,0BAA0B,OAAA;AAC1B,sHAAA,oBAAoB,OAAA;AACpB,2HAAA,yBAAyB,OAAA;AACzB,oHAAA,kBAAkB,OAAA;AAClB,qHAAA,mBAAmB,OAAA;AACnB,uHAAA,qBAAqB,OAAA;AACrB,uHAAA,qBAAqB,OAAA;AACrB,2HAAA,yBAAyB,OAAA;AACzB,+HAAA,6BAA6B,OAAA;AAC7B,mHAAA,iBAAiB,OAAA;AAYnB,kDAAgC;AAChC,wCAAsB"}

package/dist/policy-bundle.d.ts

@@ -0,0 +1,110 @@
+import { type JWK } from 'jose';
+/**
+ * Verify a signed policy bundle OFFLINE — no call to Atlas. This is what an edge
+ * PDP, a CI job or an air-gapped service runs before it trusts a bundle:
+ *
+ *   1. the detached JWS over the archive bytes verifies against a public key you
+ *      trust (the instance JWKS you fetched or pinned; RS256 / ES256 only),
+ *   2. the archive is a well-formed tar.gz of bounded size with no unsafe paths,
+ *   3. every file matches its SHA-256 in the manifest, nothing is added or
+ *      missing, and the revision recomputed from the content equals the manifest's.
+ *
+ * Only if all three hold does it return the policies and models. Runs anywhere
+ * with `fetch`-era Web APIs: Node 18+, Deno, Bun, edge workers (it uses
+ * `DecompressionStream` and `crypto.subtle`).
+ */
+export type PolicyBundleErrorCode = 'invalid_signature' | 'unknown_key' | 'invalid_archive' | 'invalid_manifest' | 'digest_mismatch' | 'unlisted_file' | 'missing_file' | 'revision_mismatch' | 'invalid_content' | 'unsupported_version' | 'unexpected_revision';
+export declare class PolicyBundleError extends Error {
+    readonly code: PolicyBundleErrorCode;
+    constructor(code: PolicyBundleErrorCode, message: string);
+}
+export interface BundleAbacPolicy {
+    name: string;
+    description: string | null;
+    enabled: boolean;
+    /** The FGA store the policy's `fga.check(...)` consults, by name. */
+    fga_store: string | null;
+    source: string;
+    tests: Array<{
+        name: string;
+        request: Record<string, unknown>;
+        expect: 'allow' | 'deny';
+    }>;
+}
+export interface BundleFgaStore {
+    name: string;
+    model: {
+        schema_version: string;
+        type_definitions: unknown[];
+        conditions?: Record<string, unknown>;
+    } | null;
+}
+export interface BundleAbacTemplate {
+    name: string;
+    description: string | null;
+    fga_store: string | null;
+    /** Policy source with ?principal / ?resource slots. */
+    source: string;
+}
+export interface BundleAbacLink {
+    name: string;
+    /** The template it fills, by name. */
+    template: string;
+    principal: {
+        type: string;
+        id: string;
+    } | null;
+    resource: {
+        type: string;
+        id: string;
+    } | null;
+    enabled: boolean;
+}
+export interface VerifiedPolicyBundle {
+    revision: string;
+    manifest: {
+        format: string;
+        format_version: number;
+        revision: string;
+        created_at: string;
+        issuer: string | null;
+        contents: {
+            abac_policies: number;
+            fga_stores: number;
+            abac_templates?: number;
+            abac_links?: number;
+            abac_schema?: boolean;
+        };
+        files: Array<{
+            path: string;
+            sha256: string;
+            size: number;
+        }>;
+    };
+    policies: BundleAbacPolicy[];
+    fgaStores: BundleFgaStore[];
+    /** The ABAC entity schema, or null when the bundle has none. */
+    abacSchema: Record<string, unknown> | null;
+    abacTemplates: BundleAbacTemplate[];
+    abacLinks: BundleAbacLink[];
+    /** The key id that signed it. */
+    keyId: string | undefined;
+    algorithm: string;
+}
+export interface VerifyPolicyBundleOptions {
+    /** The tar.gz bytes, or the base64 the API returns. */
+    bundle: Uint8Array | string;
+    /** The detached JWS (`header..signature`). */
+    signature: string;
+    /** Public keys you trust: the instance JWKS (`/.well-known/jwks.json`), or the key array. */
+    jwks: {
+        keys: JWK[];
+    } | JWK[];
+    /** Refuse a bundle that is not exactly this revision (pin what you deployed). */
+    expectedRevision?: string;
+}
+/**
+ * Verify and open a signed policy bundle. Throws {@link PolicyBundleError} with a
+ * stable `code` on any failure; returns the content only when everything checks out.
+ */
+export declare function verifyPolicyBundle(opts: VerifyPolicyBundleOptions): Promise<VerifiedPolicyBundle>;