@atlasauth/backend 0.25.0 → 0.27.0

package/dist/client/vc.d.ts

@@ -18,6 +18,8 @@ export interface VcCredentialType {
     namespace: string | null;
     /** mdoc: PEM IACA roots a presentation must chain to. */
     iaca_roots: string[];
+    /** mdoc: issuer revocation checks (certificate CRL / OCSP, MSO status list). */
+    revocation_policy: VcRevocationPolicy;
     /** mdoc: PEM Document Signer chain published as x5chain. */
     signer_chain: string[];
     name: string;
@@ -27,6 +29,7 @@ export interface VcCredentialType {
     created_at: number;
 }
 export type VcFormat = 'dc+sd-jwt' | 'mso_mdoc';
+export type VcRevocationPolicy = 'off' | 'best_effort' | 'required';
 export interface CreateVcCredentialTypeBody {
     /** The vct, or the docType for mso_mdoc (for example org.iso.18013.5.1.mDL). */
     vct: string;
@@ -35,6 +38,8 @@ export interface CreateVcCredentialTypeBody {
     namespace?: string;
     /** mso_mdoc: PEM IACA roots (ISO 18013-5 Annex B); with roots set only a certificate chain is accepted. */
     iaca_roots?: string[];
+    /** mso_mdoc: off, best_effort (default) or required. */
+    revocation_policy?: VcRevocationPolicy;
     /** mso_mdoc: PEM Document Signer certificate (then intermediates) for the instance's mdoc signing key. */
     signer_chain?: string[];
     name: string;
@@ -69,6 +74,7 @@ export interface VcPresentationRequest {
     vct: string;
     format: VcFormat;
     iaca_roots: string[];
+    revocation_policy: VcRevocationPolicy | null;
     claims: string[];
     status: 'pending' | 'verified' | 'failed';
     result: {
@@ -81,8 +87,33 @@ export interface VcPresentationRequest {
     user_id: string | null;
     expires_at: number;
     request_uri: string;
-    /** The openid4vp:// link for a QR code. */
-    authorization_request_uri: string;
+    /** The openid4vp:// link for a QR code; null for a Digital Credentials API request (use dcApiRequest). */
+    authorization_request_uri: string | null;
+    client_id_prefix?: VcClientIdPrefix;
+    response_mode?: VcResponseMode;
+    dcql_query?: Record<string, unknown> | null;
+    expected_origins?: string[];
+}
+export type VcClientIdPrefix = 'redirect_uri' | 'x509_san_dns' | 'x509_hash';
+export type VcResponseMode = 'direct_post' | 'direct_post.jwt' | 'dc_api' | 'dc_api.jwt';
+/** A credential issuance waiting for an operator decision (OpenID4VCI deferred issuance). */
+export interface VcDeferredIssuance {
+    object: 'vc_deferred_issuance';
+    id: string;
+    credential_type_id: string;
+    user_id: string;
+    credentials_requested: number;
+    status: 'pending' | 'approved' | 'denied' | 'issued';
+    reason: string | null;
+    expires_at: number;
+    created_at: number;
+}
+/** What `navigator.credentials.get({ digital: ... })` takes for a Digital Credentials API request. */
+export interface VcDcApiRequest {
+    object: 'vc_dc_api_request';
+    protocol: 'openid4vp-v1-signed' | 'openid4vp-v1-unsigned';
+    data: Record<string, unknown>;
+    response_endpoint: string;
 }
 /** Issue verifiable credentials to wallets (OpenID4VCI) and verify presentations (OpenID4VP), SD-JWT VC. */
 export declare function vcResource(request: RequestFn): {
@@ -99,7 +130,13 @@ export declare function vcResource(request: RequestFn): {
     createOffer(body: {
         credential_type_id: string;
         user_id: string;
+        /** pre-authorized_code (default) or authorization_code (the wallet signs in first). */
+        grant?: "pre-authorized_code" | "authorization_code";
+        /** Transaction code the user types in the wallet (pre-authorized_code only). */
         tx_code?: string;
+        tx_code_description?: string;
+        /** Hand the wallet a credential_offer_uri instead of the offer itself. */
+        by_reference?: boolean;
         expires_in_seconds?: number;
     }): Promise<VcOffer>;
     credentials: {
@@ -114,6 +151,8 @@ export declare function vcResource(request: RequestFn): {
             format?: VcFormat;
             /** mso_mdoc: PEM IACA roots for this request. */
             iaca_roots?: string[];
+            /** mso_mdoc: overrides the credential type's revocation policy. */
+            revocation_policy?: VcRevocationPolicy;
             claims?: string[];
             trusted_issuers?: Array<{
                 issuer: string;
@@ -121,8 +160,29 @@ export declare function vcResource(request: RequestFn): {
                     keys: Record<string, unknown>[];
                 };
             }>;
+            /** A DCQL query; replaces vct and claims. */
+            dcql_query?: Record<string, unknown>;
+            client_id_prefix?: VcClientIdPrefix;
+            /** PEM certificate chain for the x509 client id prefixes; must match the instance ES256 key. */
+            verifier_chain?: string[];
+            response_mode?: VcResponseMode;
+            /** Web origins allowed to post a Digital Credentials API response. */
+            expected_origins?: string[];
             expires_in_seconds?: number;
         }): Promise<VcPresentationRequest>;
         get(id: string): Promise<VcPresentationRequest>;
+        /** The request for the Digital Credentials API, for a request created with a dc_api response mode. */
+        dcApiRequest(id: string): Promise<VcDcApiRequest>;
+    };
+    deferred: {
+        list(query?: {
+            status?: VcDeferredIssuance["status"];
+        }): Promise<ListPage<VcDeferredIssuance>>;
+        approve(id: string, body?: {
+            reason?: string;
+        }): Promise<VcDeferredIssuance>;
+        deny(id: string, body?: {
+            reason?: string;
+        }): Promise<VcDeferredIssuance>;
     };
 };

package/dist/client/vc.js

@@ -37,6 +37,21 @@ function vcResource(request) {
             get(id) {
                 return request({ method: 'GET', path: `/v1/vc/presentation_requests/${(0, request_1.enc)(id)}` });
             },
+            /** The request for the Digital Credentials API, for a request created with a dc_api response mode. */
+            dcApiRequest(id) {
+                return request({ method: 'GET', path: `/v1/vc/presentation_requests/${(0, request_1.enc)(id)}/dc_api_request` });
+            },
+        },
+        deferred: {
+            list(query = {}) {
+                return request({ method: 'GET', path: '/v1/vc/deferred', query });
+            },
+            approve(id, body = {}) {
+                return request({ method: 'POST', path: `/v1/vc/deferred/${(0, request_1.enc)(id)}/approve`, body });
+            },
+            deny(id, body = {}) {
+                return request({ method: 'POST', path: `/v1/vc/deferred/${(0, request_1.enc)(id)}/deny`, body });
+            },
         },
     };
 }

package/dist/client/vc.js.map

@@ -1 +1 @@
-{"version":3,"file":"vc.js","sourceRoot":"","sources":["../../src/client/vc.ts"],"names":[],"mappings":";;AAyFA,gCA4CC;AArID,uCAAgD;AAwFhD,4GAA4G;AAC5G,SAAgB,UAAU,CAAC,OAAkB;IAC3C,OAAO;QACL,eAAe,EAAE;YACf,IAAI;gBACF,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,yBAAyB,EAAE,CAAC,CAAC;YACrE,CAAC;YACD,MAAM,CAAC,IAAgC;gBACrC,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,yBAAyB,EAAE,IAAI,EAAE,CAAC,CAAC;YAC5E,CAAC;YACD,GAAG,CAAC,EAAU;gBACZ,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,2BAA2B,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;YAChF,CAAC;YACD,MAAM,CAAC,EAAU;gBACf,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,2BAA2B,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;YACnF,CAAC;SACF;QACD,WAAW,CAAC,IAAoG;YAC9G,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,eAAe,EAAE,IAAI,EAAE,CAAC,CAAC;QAClE,CAAC;QACD,WAAW,EAAE;YACX,IAAI,CAAC,QAA8B,EAAE;gBACnC,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,oBAAoB,EAAE,KAAK,EAAE,EAAE,GAAG,KAAK,EAAE,EAAE,CAAC,CAAC;YACrF,CAAC;YACD,MAAM,CAAC,EAAU;gBACf,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,sBAAsB,IAAA,aAAG,EAAC,EAAE,CAAC,SAAS,EAAE,CAAC,CAAC;YACnF,CAAC;SACF;QACD,oBAAoB,EAAE;YACpB,MAAM,CAAC,IAQN;gBACC,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,8BAA8B,EAAE,IAAI,EAAE,CAAC,CAAC;YACjF,CAAC;YACD,GAAG,CAAC,EAAU;gBACZ,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,gCAAgC,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;YACrF,CAAC;SACF;KACF,CAAC;AACJ,CAAC"}
+{"version":3,"file":"vc.js","sourceRoot":"","sources":["../../src/client/vc.ts"],"names":[],"mappings":";;AA2HA,gCAgFC;AA3MD,uCAAgD;AA0HhD,4GAA4G;AAC5G,SAAgB,UAAU,CAAC,OAAkB;IAC3C,OAAO;QACL,eAAe,EAAE;YACf,IAAI;gBACF,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,yBAAyB,EAAE,CAAC,CAAC;YACrE,CAAC;YACD,MAAM,CAAC,IAAgC;gBACrC,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,yBAAyB,EAAE,IAAI,EAAE,CAAC,CAAC;YAC5E,CAAC;YACD,GAAG,CAAC,EAAU;gBACZ,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,2BAA2B,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;YAChF,CAAC;YACD,MAAM,CAAC,EAAU;gBACf,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,2BAA2B,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;YACnF,CAAC;SACF;QACD,WAAW,CAAC,IAWX;YACC,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,eAAe,EAAE,IAAI,EAAE,CAAC,CAAC;QAClE,CAAC;QACD,WAAW,EAAE;YACX,IAAI,CAAC,QAA8B,EAAE;gBACnC,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,oBAAoB,EAAE,KAAK,EAAE,EAAE,GAAG,KAAK,EAAE,EAAE,CAAC,CAAC;YACrF,CAAC;YACD,MAAM,CAAC,EAAU;gBACf,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,sBAAsB,IAAA,aAAG,EAAC,EAAE,CAAC,SAAS,EAAE,CAAC,CAAC;YACnF,CAAC;SACF;QACD,oBAAoB,EAAE;YACpB,MAAM,CAAC,IAkBN;gBACC,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,8BAA8B,EAAE,IAAI,EAAE,CAAC,CAAC;YACjF,CAAC;YACD,GAAG,CAAC,EAAU;gBACZ,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,gCAAgC,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;YACrF,CAAC;YACD,sGAAsG;YACtG,YAAY,CAAC,EAAU;gBACrB,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,gCAAgC,IAAA,aAAG,EAAC,EAAE,CAAC,iBAAiB,EAAE,CAAC,CAAC;YACpG,CAAC;SACF;QACD,QAAQ,EAAE;YACR,IAAI,CAAC,QAAmD,EAAE;gBACxD,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,iBAAiB,EAAE,KAAK,EAAE,CAAC,CAAC;YACpE,CAAC;YACD,OAAO,CAAC,EAAU,EAAE,OAA4B,EAAE;gBAChD,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,mBAAmB,IAAA,aAAG,EAAC,EAAE,CAAC,UAAU,EAAE,IAAI,EAAE,CAAC,CAAC;YACvF,CAAC;YACD,IAAI,CAAC,EAAU,EAAE,OAA4B,EAAE;gBAC7C,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,mBAAmB,IAAA,aAAG,EAAC,EAAE,CAAC,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;YACpF,CAAC;SACF;KACF,CAAC;AACJ,CAAC"}

package/dist/client/workflows.d.ts

@@ -20,9 +20,98 @@ export type WorkflowTrigger = {
 } | {
     type: 'webhook_event';
     event_type: string;
+    filter?: string;
+}
+/** Started by `invoke` with an input object. */
+ | {
+    type: 'manual';
 };
+/** Fields every step may carry. */
+export interface WorkflowStepBase {
+    /** Names the output: `steps.<id>.output` in later expressions. */
+    id?: string;
+    retry?: {
+        max: number;
+        backoff_seconds?: number;
+    };
+    on_error?: 'fail' | 'continue';
+}
+/** Control flow and integration steps. Expressions: `{{ user.email }}`, `event.*`, `input.*`, `vars.*`, `steps.<id>.output`. */
+export type WorkflowGraphStep = WorkflowStepBase & ({
+    type: 'if';
+    condition: string;
+    then: WorkflowStep[];
+    else?: WorkflowStep[];
+} | {
+    type: 'switch';
+    value: string;
+    cases: Array<{
+        equals: string | number | boolean;
+        steps: WorkflowStep[];
+    }>;
+    default?: WorkflowStep[];
+} | {
+    type: 'for_each';
+    items: string;
+    as?: string;
+    steps: WorkflowStep[];
+    max_iterations?: number;
+} | {
+    type: 'wait';
+    seconds?: number;
+    until?: string;
+} | {
+    type: 'set_variable';
+    name: string;
+    value: unknown;
+} | {
+    type: 'http_request';
+    method?: 'GET' | 'POST';
+    url: string;
+    headers?: Record<string, string>;
+    secret_headers?: Record<string, string>;
+    body?: unknown;
+} | {
+    type: 'call_connector';
+    connector: string;
+    operation: string;
+    input?: Record<string, unknown>;
+} | {
+    type: 'create_ticket';
+    connector: string;
+    summary: string;
+    description?: string;
+    fields?: Record<string, unknown>;
+} | {
+    type: 'create_iga_request';
+    entitlement: string;
+    justification?: string;
+    duration_seconds?: number;
+} | {
+    type: 'start_campaign';
+    campaign_id: string;
+} | {
+    type: 'revoke_grant';
+    entitlement: string;
+    reason?: string;
+} | {
+    type: 'approval';
+    approvers: {
+        type: 'users' | 'manager' | 'group';
+        ids?: string[];
+    };
+    message: string;
+    timeout_seconds?: number;
+    on_deny?: 'fail' | 'continue';
+    on_timeout?: 'fail' | 'continue' | 'approve';
+} | {
+    type: 'kv';
+    op: 'get' | 'set' | 'delete' | 'incr';
+    key: string;
+    value?: unknown;
+});
 /** One step. A step that acts on an organization takes `organization_id`, or uses the membership's own for `membership_age`. */
-export type WorkflowStep = {
+export type WorkflowStep = WorkflowGraphStep | {
     type: 'notify';
     subject: string;
     body: string;
@@ -61,6 +150,42 @@ export type WorkflowStep = {
     type: 'call_action';
     action_id: string;
 };
+export interface WorkflowTriggerInfo {
+    object: 'workflow_trigger';
+    name: string;
+    description: string;
+    subject: 'user' | 'none';
+    payload: string[];
+    emitter: string;
+}
+export interface WorkflowTemplate {
+    object: 'workflow_template';
+    key: string;
+    name: string;
+    description: string;
+    parameters: Array<{
+        key: string;
+        label: string;
+        type: 'string' | 'number';
+        default?: string | number;
+    }>;
+    trigger: WorkflowTrigger;
+    steps: WorkflowStep[];
+}
+export interface WorkflowApproval {
+    object: 'workflow_approval';
+    id: string;
+    workflow_id: string;
+    run_id: string;
+    approver_user_ids: string[];
+    message: string;
+    status: 'pending' | 'approved' | 'denied' | 'timed_out';
+    decided_by: string | null;
+    comment: string | null;
+    expires_at: number | null;
+    decided_at: number | null;
+    created_at: number;
+}
 export interface Workflow {
     object: 'workflow';
     id: string;
@@ -77,8 +202,13 @@ export interface Workflow {
 export interface WorkflowRunStep {
     index: number;
     type: string;
-    status: 'ok' | 'failed' | 'would_run' | 'skipped';
+    status: 'ok' | 'failed' | 'would_run' | 'skipped' | 'retrying' | 'waiting';
+    /** Position in the step tree, e.g. `2.then.0`. */
+    path?: string;
+    attempt?: number;
+    at?: number;
     detail?: string;
+    output?: unknown;
 }
 export interface WorkflowRun {
     object: 'workflow_run';
@@ -87,7 +217,11 @@ export interface WorkflowRun {
     subject: string;
     user_id: string | null;
     dry_run: boolean;
-    status: 'running' | 'succeeded' | 'failed';
+    status: 'running' | 'waiting' | 'succeeded' | 'failed';
+    /** While waiting on a timer or retry: when the run continues (Unix ms). */
+    resume_at?: number | null;
+    /** While waiting on people: `approval:<id>`. */
+    waiting_on?: string | null;
     steps: WorkflowRunStep[];
     error: string | null;
     started_at: number;
@@ -128,4 +262,49 @@ export declare function workflowsResource(request: RequestFn): {
     }): Promise<ListPage<WorkflowRun> & {
         next_cursor: string | null;
     }>;
+    /** One run with its per-step log. */
+    getRun(id: string, runId: string): Promise<WorkflowRun>;
+    /** Start a `manual` workflow with an input object. */
+    invoke(id: string, body?: {
+        user_id?: string;
+        organization_id?: string;
+        input?: Record<string, unknown>;
+    }, idempotencyKey?: string): Promise<WorkflowRun>;
+    /** Retry a failed run from the step that failed. */
+    resume(id: string, runId: string): Promise<WorkflowRun>;
+    /** The events a workflow can start on. */
+    triggers(): Promise<ListPage<WorkflowTriggerInfo>>;
+    templates(): Promise<ListPage<WorkflowTemplate>>;
+    createFromTemplate(body: {
+        template: string;
+        parameters?: Record<string, unknown>;
+        name?: string;
+        enabled?: boolean;
+    }, idempotencyKey?: string): Promise<Workflow>;
+    approvals(query?: {
+        status?: WorkflowApproval["status"];
+    }): Promise<ListPage<WorkflowApproval>>;
+    decideApproval(id: string, body: {
+        decision: "approve" | "deny";
+        comment?: string;
+        user_id?: string;
+    }, idempotencyKey?: string): Promise<WorkflowApproval>;
+    /** The workflow's key-value table. */
+    kv: {
+        list: (id: string) => Promise<ListPage<{
+            object: "workflow_kv";
+            key: string;
+            value: unknown;
+        }>>;
+        set: (id: string, key: string, value: unknown) => Promise<{
+            object: "workflow_kv";
+            key: string;
+            value: unknown;
+        }>;
+        delete: (id: string, key: string) => Promise<{
+            object: "workflow_kv";
+            key: string;
+            deleted: true;
+        }>;
+    };
 };

package/dist/client/workflows.js

@@ -31,6 +31,40 @@ function workflowsResource(request) {
         runs(id, query = {}) {
             return request({ method: 'GET', path: `/v1/workflows/${(0, request_1.enc)(id)}/runs`, query });
         },
+        /** One run with its per-step log. */
+        getRun(id, runId) {
+            return request({ method: 'GET', path: `/v1/workflows/${(0, request_1.enc)(id)}/runs/${(0, request_1.enc)(runId)}` });
+        },
+        /** Start a `manual` workflow with an input object. */
+        invoke(id, body = {}, idempotencyKey) {
+            return request({ method: 'POST', path: `/v1/workflows/${(0, request_1.enc)(id)}/invoke`, body, idempotencyKey });
+        },
+        /** Retry a failed run from the step that failed. */
+        resume(id, runId) {
+            return request({ method: 'POST', path: `/v1/workflows/${(0, request_1.enc)(id)}/runs/${(0, request_1.enc)(runId)}/resume`, body: {} });
+        },
+        /** The events a workflow can start on. */
+        triggers() {
+            return request({ method: 'GET', path: '/v1/workflow_triggers' });
+        },
+        templates() {
+            return request({ method: 'GET', path: '/v1/workflow_templates' });
+        },
+        createFromTemplate(body, idempotencyKey) {
+            return request({ method: 'POST', path: '/v1/workflows/from_template', body, idempotencyKey });
+        },
+        approvals(query = {}) {
+            return request({ method: 'GET', path: '/v1/workflow_approvals', query });
+        },
+        decideApproval(id, body, idempotencyKey) {
+            return request({ method: 'POST', path: `/v1/workflow_approvals/${(0, request_1.enc)(id)}/decide`, body, idempotencyKey });
+        },
+        /** The workflow's key-value table. */
+        kv: {
+            list: (id) => request({ method: 'GET', path: `/v1/workflows/${(0, request_1.enc)(id)}/kv` }),
+            set: (id, key, value) => request({ method: 'PUT', path: `/v1/workflows/${(0, request_1.enc)(id)}/kv/${(0, request_1.enc)(key)}`, body: { value } }),
+            delete: (id, key) => request({ method: 'DELETE', path: `/v1/workflows/${(0, request_1.enc)(id)}/kv/${(0, request_1.enc)(key)}` }),
+        },
     };
 }
 //# sourceMappingURL=workflows.js.map

package/dist/client/workflows.js.map

@@ -1 +1 @@
-{"version":3,"file":"workflows.js","sourceRoot":"","sources":["../../src/client/workflows.ts"],"names":[],"mappings":";;AAuEA,8CA8BC;AArGD,uCAAgD;AAuEhD,SAAgB,iBAAiB,CAAC,OAAkB;IAClD,OAAO;QACL,IAAI;YACF,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,eAAe,EAAE,CAAC,CAAC;QAC3D,CAAC;QACD,MAAM,CAAC,IAAwB,EAAE,cAAuB;YACtD,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,eAAe,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC;QAClF,CAAC;QACD,GAAG,CAAC,EAAU;YACZ,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,iBAAiB,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;QACtE,CAAC;QACD,MAAM,CAAC,EAAU,EAAE,IAAwB;YACzC,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,iBAAiB,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;QAC9E,CAAC;QACD,MAAM,CAAC,EAAU;YACf,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,iBAAiB,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;QACzE,CAAC;QACD,sHAAsH;QACtH,MAAM,CAAC,EAAU,EAAE,SAAyD,EAAE;YAC5E,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,iBAAiB,IAAA,aAAG,EAAC,EAAE,CAAC,UAAU,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC;QAC7F,CAAC;QACD,iEAAiE;QACjE,GAAG,CAAC,EAAU,EAAE,SAAyD,EAAE,EAAE,cAAuB;YAClG,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,iBAAiB,IAAA,aAAG,EAAC,EAAE,CAAC,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,cAAc,EAAE,CAAC,CAAC;QACzG,CAAC;QACD,iCAAiC;QACjC,IAAI,CAAC,EAAU,EAAE,QAAqD,EAAE;YACtE,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,iBAAiB,IAAA,aAAG,EAAC,EAAE,CAAC,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC;QAClF,CAAC;KACF,CAAC;AACJ,CAAC"}
+{"version":3,"file":"workflows.js","sourceRoot":"","sources":["../../src/client/workflows.ts"],"names":[],"mappings":";;AA6IA,8CAgEC;AA7MD,uCAAgD;AA6IhD,SAAgB,iBAAiB,CAAC,OAAkB;IAClD,OAAO;QACL,IAAI;YACF,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,eAAe,EAAE,CAAC,CAAC;QAC3D,CAAC;QACD,MAAM,CAAC,IAAwB,EAAE,cAAuB;YACtD,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,eAAe,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC;QAClF,CAAC;QACD,GAAG,CAAC,EAAU;YACZ,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,iBAAiB,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;QACtE,CAAC;QACD,MAAM,CAAC,EAAU,EAAE,IAAwB;YACzC,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,iBAAiB,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;QAC9E,CAAC;QACD,MAAM,CAAC,EAAU;YACf,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,iBAAiB,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;QACzE,CAAC;QACD,sHAAsH;QACtH,MAAM,CAAC,EAAU,EAAE,SAAyD,EAAE;YAC5E,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,iBAAiB,IAAA,aAAG,EAAC,EAAE,CAAC,UAAU,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC;QAC7F,CAAC;QACD,iEAAiE;QACjE,GAAG,CAAC,EAAU,EAAE,SAAyD,EAAE,EAAE,cAAuB;YAClG,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,iBAAiB,IAAA,aAAG,EAAC,EAAE,CAAC,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,cAAc,EAAE,CAAC,CAAC;QACzG,CAAC;QACD,iCAAiC;QACjC,IAAI,CAAC,EAAU,EAAE,QAAqD,EAAE;YACtE,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,iBAAiB,IAAA,aAAG,EAAC,EAAE,CAAC,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC;QAClF,CAAC;QACD,qCAAqC;QACrC,MAAM,CAAC,EAAU,EAAE,KAAa;YAC9B,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,iBAAiB,IAAA,aAAG,EAAC,EAAE,CAAC,SAAS,IAAA,aAAG,EAAC,KAAK,CAAC,EAAE,EAAE,CAAC,CAAC;QACzF,CAAC;QACD,sDAAsD;QACtD,MAAM,CAAC,EAAU,EAAE,OAAwF,EAAE,EAAE,cAAuB;YACpI,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,iBAAiB,IAAA,aAAG,EAAC,EAAE,CAAC,SAAS,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC;QACpG,CAAC;QACD,oDAAoD;QACpD,MAAM,CAAC,EAAU,EAAE,KAAa;YAC9B,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,iBAAiB,IAAA,aAAG,EAAC,EAAE,CAAC,SAAS,IAAA,aAAG,EAAC,KAAK,CAAC,SAAS,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC;QAC3G,CAAC;QACD,0CAA0C;QAC1C,QAAQ;YACN,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,uBAAuB,EAAE,CAAC,CAAC;QACnE,CAAC;QACD,SAAS;YACP,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,wBAAwB,EAAE,CAAC,CAAC;QACpE,CAAC;QACD,kBAAkB,CAAC,IAAkG,EAAE,cAAuB;YAC5I,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,6BAA6B,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC;QAChG,CAAC;QACD,SAAS,CAAC,QAAiD,EAAE;YAC3D,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,wBAAwB,EAAE,KAAK,EAAE,CAAC,CAAC;QAC3E,CAAC;QACD,cAAc,CAAC,EAAU,EAAE,IAA0E,EAAE,cAAuB;YAC5H,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,0BAA0B,IAAA,aAAG,EAAC,EAAE,CAAC,SAAS,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC;QAC7G,CAAC;QACD,sCAAsC;QACtC,EAAE,EAAE;YACF,IAAI,EAAE,CAAC,EAAU,EAA6E,EAAE,CAAC,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,iBAAiB,IAAA,aAAG,EAAC,EAAE,CAAC,KAAK,EAAE,CAAC;YAChK,GAAG,EAAE,CAAC,EAAU,EAAE,GAAW,EAAE,KAAc,EAAmE,EAAE,CAAC,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,iBAAiB,IAAA,aAAG,EAAC,EAAE,CAAC,OAAO,IAAA,aAAG,EAAC,GAAG,CAAC,EAAE,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,EAAE,CAAC;YAC/M,MAAM,EAAE,CAAC,EAAU,EAAE,GAAW,EAAkE,EAAE,CAAC,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,iBAAiB,IAAA,aAAG,EAAC,EAAE,CAAC,OAAO,IAAA,aAAG,EAAC,GAAG,CAAC,EAAE,EAAE,CAAC;SACpL;KACF,CAAC;AACJ,CAAC"}

package/dist/index.d.ts

@@ -3,6 +3,7 @@ export { DiscoveryError, JwksDiscovery, discoveryUrlFor, instanceIdFromPublishab
 export * from './verify';
 export * from './request-auth';
 export * from './recent-auth';
+export * from './txn-token';
 export * from './access-control';
 export * from './handshake';
 export * from './better-auth';
@@ -16,6 +17,7 @@ export type { LegacyIssuer, LegacyIssuerKind } from './legacy-issuers';
 export * from './legacy-issuer-presets';
 export * from './framework-sessions';
 export * from './framework-bridge';
+export * from './policy-bundle';
 export { BACKCHANNEL_LOGOUT_EVENT, LOGOUT_TOKEN_CLOCK_SKEW_SECONDS, LOGOUT_TOKEN_MAX_AGE_SECONDS, LogoutTokenVerifier, memoryLogoutReplayStore, verifyLogoutToken, } from './logout-token';
 export type { LogoutReplayStore, LogoutTokenCheckOptions, LogoutTokenClaims, LogoutTokenResult, LogoutTokenVerifierOptions, } from './logout-token';
 export { expressBackchannelLogout, fastifyBackchannelLogout, fastifyBackchannelLogoutPlugin, fetchBackchannelLogout, handleBackchannelLogout, nextBackchannelLogout, readLogoutToken, } from './backchannel-handlers';
@@ -37,6 +39,7 @@ export { verifyPCActn } from './pca/verify';
 export type { PcaVerdict, PcaContext, VerifyPCActnOptions } from './pca/verify';
 export { requirePCA, defaultExtract, memoryPcaStore } from './pca/require-pca';
 export type { RequirePcaOptions, PcaGuardResult, PcaRequestLike, PcaStateStore } from './pca/require-pca';
-export { ACCESS_TOKEN_CLOCK_SKEW_SECONDS, DPOP_PROOF_MAX_AGE_SECONDS, buildWwwAuthenticate, createAccessTokenVerifier, createIntrospector, hmacDpopNonceSource, memoryDpopNonceSource, memoryDpopReplayStore, protectedResourceMetadata, protectedResourceMetadataPath, verifyAccessToken, } from './oauth-resource';
-export type { AccessTokenClaims, AccessTokenErrorCode, AccessTokenResult, AccessTokenVerifierOptions, DpopNonceSource, DpopReplayStore, IntrospectionOptions, ResourceRequestLike, } from './oauth-resource';
+export { ACCESS_TOKEN_CLOCK_SKEW_SECONDS, DPOP_PROOF_MAX_AGE_SECONDS, buildWwwAuthenticate, createAccessTokenVerifier, createIntrospector, hmacDpopNonceSource, memoryDpopNonceSource, memoryDpopReplayStore, protectedResourceMetadata, protectedResourceMetadataPath, requireAcr, verifyAccessToken, } from './oauth-resource';
+export type { AccessTokenCallOptions, AccessTokenClaims, AccessTokenErrorCode, AccessTokenResult, AccessTokenVerifierOptions, DpopNonceSource, DpopReplayStore, IntrospectionOptions, ResourceRequestLike, } from './oauth-resource';
 export * from './legacy-verify';
+export * from './uma';

package/dist/index.js

@@ -15,7 +15,7 @@ var __exportStar = (this && this.__exportStar) || function(m, exports) {
 };
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.memoryPcaStore = exports.defaultExtract = exports.requirePCA = exports.verifyPCActn = exports.REFERALLI_API_VERSION = exports.referralEmailHash = exports.referalliSignatureV2 = exports.referalliSignature = exports.signReferralUpdatedEvent = exports.signReferalliCall = exports.signAtlasReferralCall = exports.testTenantClaims = exports.TEST_TOKEN_TAMPERS = exports.createTestIssuer = exports.createAtlasClient = exports.resetOidcCaches = exports.oidcSsoOf = exports.oidcOrganizationsOf = exports.oidcOrganizationOf = exports.oidcVerifyIdToken = exports.oidcStart = exports.oidcLogoutUrl = exports.oidcClearCookie = exports.oidcCallback = exports.oidc = exports.OIDC_FLOW_MAX_AGE_SECONDS = exports.OIDC_FLOW_COOKIE = exports.AtlasOidcError = exports.readLogoutToken = exports.nextBackchannelLogout = exports.handleBackchannelLogout = exports.fetchBackchannelLogout = exports.fastifyBackchannelLogoutPlugin = exports.fastifyBackchannelLogout = exports.expressBackchannelLogout = exports.verifyLogoutToken = exports.memoryLogoutReplayStore = exports.LogoutTokenVerifier = exports.LOGOUT_TOKEN_MAX_AGE_SECONDS = exports.LOGOUT_TOKEN_CLOCK_SKEW_SECONDS = exports.BACKCHANNEL_LOGOUT_EVENT = exports.peekIssuer = exports.BETTER_AUTH_JWT_ALGS = exports.workosSessionTokenExtractor = exports.magicDidTokenExtractor = exports.looksLikeMagicDidToken = exports.instanceIdFromPublishableKey = exports.discoveryUrlFor = exports.JwksDiscovery = exports.DiscoveryError = void 0;
-exports.verifyAccessToken = exports.protectedResourceMetadataPath = exports.protectedResourceMetadata = exports.memoryDpopReplayStore = exports.memoryDpopNonceSource = exports.hmacDpopNonceSource = exports.createIntrospector = exports.createAccessTokenVerifier = exports.buildWwwAuthenticate = exports.DPOP_PROOF_MAX_AGE_SECONDS = exports.ACCESS_TOKEN_CLOCK_SKEW_SECONDS = void 0;
+exports.verifyAccessToken = exports.requireAcr = exports.protectedResourceMetadataPath = exports.protectedResourceMetadata = exports.memoryDpopReplayStore = exports.memoryDpopNonceSource = exports.hmacDpopNonceSource = exports.createIntrospector = exports.createAccessTokenVerifier = exports.buildWwwAuthenticate = exports.DPOP_PROOF_MAX_AGE_SECONDS = exports.ACCESS_TOKEN_CLOCK_SKEW_SECONDS = void 0;
 // §7.3 token verification — the original surface, unchanged.
 __exportStar(require("./jwks-cache"), exports);
 // OIDC discovery of the JWKS URL when only `issuer` is configured.
@@ -27,6 +27,7 @@ Object.defineProperty(exports, "instanceIdFromPublishableKey", { enumerable: tru
 __exportStar(require("./verify"), exports);
 __exportStar(require("./request-auth"), exports);
 __exportStar(require("./recent-auth"), exports);
+__exportStar(require("./txn-token"), exports);
 __exportStar(require("./access-control"), exports);
 __exportStar(require("./handshake"), exports);
 // Moving from Better Auth: exchange its session cookie once, accept its JWTs for a window.
@@ -49,6 +50,8 @@ __exportStar(require("./legacy-issuer-presets"), exports);
 __exportStar(require("./framework-sessions"), exports);
 // …and their bridge presets + token extractors (registers the presets on load).
 __exportStar(require("./framework-bridge"), exports);
+// Verify a signed policy bundle offline (no call to Atlas).
+__exportStar(require("./policy-bundle"), exports);
 // OIDC Back-Channel Logout: verify the logout_token Atlas POSTs to your app.
 var logout_token_1 = require("./logout-token");
 Object.defineProperty(exports, "BACKCHANNEL_LOGOUT_EVENT", { enumerable: true, get: function () { return logout_token_1.BACKCHANNEL_LOGOUT_EVENT; } });
@@ -129,6 +132,8 @@ Object.defineProperty(exports, "memoryDpopNonceSource", { enumerable: true, get:
 Object.defineProperty(exports, "memoryDpopReplayStore", { enumerable: true, get: function () { return oauth_resource_1.memoryDpopReplayStore; } });
 Object.defineProperty(exports, "protectedResourceMetadata", { enumerable: true, get: function () { return oauth_resource_1.protectedResourceMetadata; } });
 Object.defineProperty(exports, "protectedResourceMetadataPath", { enumerable: true, get: function () { return oauth_resource_1.protectedResourceMetadataPath; } });
+Object.defineProperty(exports, "requireAcr", { enumerable: true, get: function () { return oauth_resource_1.requireAcr; } });
 Object.defineProperty(exports, "verifyAccessToken", { enumerable: true, get: function () { return oauth_resource_1.verifyAccessToken; } });
 __exportStar(require("./legacy-verify"), exports);
+__exportStar(require("./uma"), exports);
 //# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;AAAA,6DAA6D;AAC7D,+CAA6B;AAC7B,mEAAmE;AACnE,yCAA2G;AAAlG,2GAAA,cAAc,OAAA;AAAE,0GAAA,aAAa,OAAA;AAAE,4GAAA,eAAe,OAAA;AAAE,yHAAA,4BAA4B,OAAA;AACrF,2CAAyB;AACzB,iDAA+B;AAC/B,gDAA8B;AAC9B,mDAAiC;AACjC,8CAA4B;AAC5B,2FAA2F;AAC3F,gDAA8B;AAC9B,qFAAqF;AACrF,sDAAoC;AACpC,qDAAmC;AACnC,kDAAgC;AAChC,yCAA6E;AAApE,mHAAA,sBAAsB,OAAA;AAAE,mHAAA,sBAAsB,OAAA;AACvD,mDAA+D;AAAtD,6HAAA,2BAA2B,OAAA;AACpC,mDAAoE;AAA3D,sHAAA,oBAAoB,OAAA;AAAE,4GAAA,UAAU,OAAA;AAEzC,0DAAwC;AACxC,+EAA+E;AAC/E,4DAA4D;AAC5D,uDAAqC;AACrC,gFAAgF;AAChF,qDAAmC;AAEnC,6EAA6E;AAC7E,+CAOwB;AANtB,wHAAA,wBAAwB,OAAA;AACxB,+HAAA,+BAA+B,OAAA;AAC/B,4HAAA,4BAA4B,OAAA;AAC5B,mHAAA,mBAAmB,OAAA;AACnB,uHAAA,uBAAuB,OAAA;AACvB,iHAAA,iBAAiB,OAAA;AASnB,+EAA+E;AAC/E,+DAQgC;AAP9B,gIAAA,wBAAwB,OAAA;AACxB,gIAAA,wBAAwB,OAAA;AACxB,sIAAA,8BAA8B,OAAA;AAC9B,8HAAA,sBAAsB,OAAA;AACtB,+HAAA,uBAAuB,OAAA;AACvB,6HAAA,qBAAqB,OAAA;AACrB,uHAAA,eAAe,OAAA;AAIjB,sEAAsE;AACtE,iFAAiF;AACjF,+BAcgB;AAbd,sGAAA,cAAc,OAAA;AACd,wGAAA,gBAAgB,OAAA;AAChB,iHAAA,yBAAyB,OAAA;AACzB,4FAAA,IAAI,OAAA;AACJ,oGAAA,YAAY,OAAA;AACZ,uGAAA,eAAe,OAAA;AACf,qGAAA,aAAa,OAAA;AACb,iGAAA,SAAS,OAAA;AACT,yGAAA,iBAAiB,OAAA;AACjB,0GAAA,kBAAkB,OAAA;AAClB,2GAAA,mBAAmB,OAAA;AACnB,iGAAA,SAAS,OAAA;AACT,uGAAA,eAAe,OAAA;AAkBjB,oDAAoD;AACpD,6CAA2B;AAE3B,uFAAuF;AACvF,8CAA4B;AAC5B,kDAAgC;AAEhC,0FAA0F;AAC1F,0CAAwB;AAExB,8DAA8D;AAC9D,mCAA6C;AAApC,2GAAA,iBAAiB,OAAA;AAE1B,2CAAyB;AAEzB,yEAAyE;AACzE,2EAA2E;AAC3E,iEAAiE;AACjE,qCAAmF;AAA1E,2GAAA,gBAAgB,OAAA;AAAE,6GAAA,kBAAkB,OAAA;AAAE,2GAAA,gBAAgB,OAAA;AAU/D,6DAQ+B;AAP7B,4HAAA,qBAAqB,OAAA;AACrB,wHAAA,iBAAiB,OAAA;AACjB,+HAAA,wBAAwB,OAAA;AACxB,yHAAA,kBAAkB,OAAA;AAClB,2HAAA,oBAAoB,OAAA;AACpB,wHAAA,iBAAiB,OAAA;AACjB,4HAAA,qBAAqB,OAAA;AAWvB,wFAAwF;AACxF,2CAA2C;AAC3C,uCAA4C;AAAnC,sGAAA,YAAY,OAAA;AAErB,iDAA+E;AAAtE,yGAAA,UAAU,OAAA;AAAE,6GAAA,cAAc,OAAA;AAAE,6GAAA,cAAc,OAAA;AAGnD,8EAA8E;AAC9E,gFAAgF;AAChF,mDAY0B;AAXxB,iIAAA,+BAA+B,OAAA;AAC/B,4HAAA,0BAA0B,OAAA;AAC1B,sHAAA,oBAAoB,OAAA;AACpB,2HAAA,yBAAyB,OAAA;AACzB,oHAAA,kBAAkB,OAAA;AAClB,qHAAA,mBAAmB,OAAA;AACnB,uHAAA,qBAAqB,OAAA;AACrB,uHAAA,qBAAqB,OAAA;AACrB,2HAAA,yBAAyB,OAAA;AACzB,+HAAA,6BAA6B,OAAA;AAC7B,mHAAA,iBAAiB,OAAA;AAYnB,kDAAgC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;AAAA,6DAA6D;AAC7D,+CAA6B;AAC7B,mEAAmE;AACnE,yCAA2G;AAAlG,2GAAA,cAAc,OAAA;AAAE,0GAAA,aAAa,OAAA;AAAE,4GAAA,eAAe,OAAA;AAAE,yHAAA,4BAA4B,OAAA;AACrF,2CAAyB;AACzB,iDAA+B;AAC/B,gDAA8B;AAC9B,8CAA4B;AAC5B,mDAAiC;AACjC,8CAA4B;AAC5B,2FAA2F;AAC3F,gDAA8B;AAC9B,qFAAqF;AACrF,sDAAoC;AACpC,qDAAmC;AACnC,kDAAgC;AAChC,yCAA6E;AAApE,mHAAA,sBAAsB,OAAA;AAAE,mHAAA,sBAAsB,OAAA;AACvD,mDAA+D;AAAtD,6HAAA,2BAA2B,OAAA;AACpC,mDAAoE;AAA3D,sHAAA,oBAAoB,OAAA;AAAE,4GAAA,UAAU,OAAA;AAEzC,0DAAwC;AACxC,+EAA+E;AAC/E,4DAA4D;AAC5D,uDAAqC;AACrC,gFAAgF;AAChF,qDAAmC;AAEnC,4DAA4D;AAC5D,kDAAgC;AAEhC,6EAA6E;AAC7E,+CAOwB;AANtB,wHAAA,wBAAwB,OAAA;AACxB,+HAAA,+BAA+B,OAAA;AAC/B,4HAAA,4BAA4B,OAAA;AAC5B,mHAAA,mBAAmB,OAAA;AACnB,uHAAA,uBAAuB,OAAA;AACvB,iHAAA,iBAAiB,OAAA;AASnB,+EAA+E;AAC/E,+DAQgC;AAP9B,gIAAA,wBAAwB,OAAA;AACxB,gIAAA,wBAAwB,OAAA;AACxB,sIAAA,8BAA8B,OAAA;AAC9B,8HAAA,sBAAsB,OAAA;AACtB,+HAAA,uBAAuB,OAAA;AACvB,6HAAA,qBAAqB,OAAA;AACrB,uHAAA,eAAe,OAAA;AAIjB,sEAAsE;AACtE,iFAAiF;AACjF,+BAcgB;AAbd,sGAAA,cAAc,OAAA;AACd,wGAAA,gBAAgB,OAAA;AAChB,iHAAA,yBAAyB,OAAA;AACzB,4FAAA,IAAI,OAAA;AACJ,oGAAA,YAAY,OAAA;AACZ,uGAAA,eAAe,OAAA;AACf,qGAAA,aAAa,OAAA;AACb,iGAAA,SAAS,OAAA;AACT,yGAAA,iBAAiB,OAAA;AACjB,0GAAA,kBAAkB,OAAA;AAClB,2GAAA,mBAAmB,OAAA;AACnB,iGAAA,SAAS,OAAA;AACT,uGAAA,eAAe,OAAA;AAkBjB,oDAAoD;AACpD,6CAA2B;AAE3B,uFAAuF;AACvF,8CAA4B;AAC5B,kDAAgC;AAEhC,0FAA0F;AAC1F,0CAAwB;AAExB,8DAA8D;AAC9D,mCAA6C;AAApC,2GAAA,iBAAiB,OAAA;AAE1B,2CAAyB;AAEzB,yEAAyE;AACzE,2EAA2E;AAC3E,iEAAiE;AACjE,qCAAmF;AAA1E,2GAAA,gBAAgB,OAAA;AAAE,6GAAA,kBAAkB,OAAA;AAAE,2GAAA,gBAAgB,OAAA;AAU/D,6DAQ+B;AAP7B,4HAAA,qBAAqB,OAAA;AACrB,wHAAA,iBAAiB,OAAA;AACjB,+HAAA,wBAAwB,OAAA;AACxB,yHAAA,kBAAkB,OAAA;AAClB,2HAAA,oBAAoB,OAAA;AACpB,wHAAA,iBAAiB,OAAA;AACjB,4HAAA,qBAAqB,OAAA;AAWvB,wFAAwF;AACxF,2CAA2C;AAC3C,uCAA4C;AAAnC,sGAAA,YAAY,OAAA;AAErB,iDAA+E;AAAtE,yGAAA,UAAU,OAAA;AAAE,6GAAA,cAAc,OAAA;AAAE,6GAAA,cAAc,OAAA;AAGnD,8EAA8E;AAC9E,gFAAgF;AAChF,mDAa0B;AAZxB,iIAAA,+BAA+B,OAAA;AAC/B,4HAAA,0BAA0B,OAAA;AAC1B,sHAAA,oBAAoB,OAAA;AACpB,2HAAA,yBAAyB,OAAA;AACzB,oHAAA,kBAAkB,OAAA;AAClB,qHAAA,mBAAmB,OAAA;AACnB,uHAAA,qBAAqB,OAAA;AACrB,uHAAA,qBAAqB,OAAA;AACrB,2HAAA,yBAAyB,OAAA;AACzB,+HAAA,6BAA6B,OAAA;AAC7B,4GAAA,UAAU,OAAA;AACV,mHAAA,iBAAiB,OAAA;AAanB,kDAAgC;AAChC,wCAAsB"}

package/dist/oauth-resource.d.ts

@@ -160,7 +160,7 @@ export declare function createIntrospector(issuer: string, options: Introspectio
     fetchImpl?: typeof fetch;
     now?: () => number;
 }): (token: string) => Promise<AccessTokenClaims | null>;
-export type AccessTokenErrorCode = 'invalid_request' | 'invalid_token' | 'insufficient_scope' | 'invalid_dpop_proof' | 'use_dpop_nonce';
+export type AccessTokenErrorCode = 'invalid_request' | 'invalid_token' | 'insufficient_scope' | 'invalid_dpop_proof' | 'use_dpop_nonce' | 'insufficient_user_authentication';
 export type AccessTokenResult = {
     ok: true;
     claims: AccessTokenClaims;
@@ -193,14 +193,41 @@ export declare function buildWwwAuthenticate(opts: {
     scope?: readonly string[];
     resourceMetadataUrl?: string;
     dpopAlgs?: readonly string[];
+    /** RFC 9470: the acr values the resource will accept (step-up challenge). */
+    acrValues?: readonly string[];
+    /** RFC 9470: the maximum age, in seconds, of the user authentication. */
+    maxAge?: number;
 }): string;
 /**
  * A reusable verifier (one JWKS cache for the life of the process). Call it per
  * request; it never throws for a bad token — it returns the status + challenge.
  */
-export declare function createAccessTokenVerifier(options: AccessTokenVerifierOptions): (request: ResourceRequestLike, extra?: {
+/** Per-call extras for the verifier: scopes plus the RFC 9470 step-up requirements. */
+export interface AccessTokenCallOptions {
     requiredScopes?: readonly string[];
-}) => Promise<AccessTokenResult>;
+    /** Accept only these `acr` values; otherwise answer `insufficient_user_authentication`. */
+    requireAcr?: readonly string[];
+    /** Require `auth_time` within this many seconds; otherwise answer `insufficient_user_authentication`. */
+    maxAge?: number;
+}
+/**
+ * RFC 9470 check on verified claims. Returns null when satisfied, else the
+ * `insufficient_user_authentication` challenge to send (HTTP 401).
+ */
+export declare function requireAcr(claims: Readonly<Record<string, unknown>>, req: {
+    acrValues?: readonly string[];
+    maxAge?: number;
+    scheme?: 'Bearer' | 'DPoP';
+    realm?: string;
+    resourceMetadataUrl?: string;
+    nowMs?: number;
+}): {
+    status: 401;
+    error: 'insufficient_user_authentication';
+    description: string;
+    wwwAuthenticate: string;
+} | null;
+export declare function createAccessTokenVerifier(options: AccessTokenVerifierOptions): (request: ResourceRequestLike, extra?: AccessTokenCallOptions) => Promise<AccessTokenResult>;
 /** One-shot form of {@link createAccessTokenVerifier} (builds a fresh JWKS cache each call — prefer the factory). */
 export declare function verifyAccessToken(request: ResourceRequestLike, options: AccessTokenVerifierOptions): Promise<AccessTokenResult>;
 /**

package/dist/oauth-resource.js

@@ -6,6 +6,7 @@ exports.hmacDpopNonceSource = hmacDpopNonceSource;
 exports.memoryDpopReplayStore = memoryDpopReplayStore;
 exports.createIntrospector = createIntrospector;
 exports.buildWwwAuthenticate = buildWwwAuthenticate;
+exports.requireAcr = requireAcr;
 exports.createAccessTokenVerifier = createAccessTokenVerifier;
 exports.verifyAccessToken = verifyAccessToken;
 exports.protectedResourceMetadata = protectedResourceMetadata;
@@ -215,6 +216,10 @@ function buildWwwAuthenticate(opts) {
         parts.push(`scope=${quote(opts.scope.join(' '))}`);
     if (opts.resourceMetadataUrl)
         parts.push(`resource_metadata=${quote(opts.resourceMetadataUrl)}`);
+    if (opts.acrValues && opts.acrValues.length > 0)
+        parts.push(`acr_values=${quote(opts.acrValues.join(' '))}`);
+    if (opts.maxAge !== undefined)
+        parts.push(`max_age=${Math.max(0, Math.floor(opts.maxAge))}`);
     if (opts.scheme === 'DPoP' && opts.dpopAlgs)
         parts.push(`algs=${quote(opts.dpopAlgs.join(' '))}`);
     return `${opts.scheme ?? 'Bearer'}${parts.length ? ` ${parts.join(', ')}` : ''}`;
@@ -237,9 +242,32 @@ function htuOf(url) {
     }
 }
 /**
- * A reusable verifier (one JWKS cache for the life of the process). Call it per
- * request; it never throws for a bad token — it returns the status + challenge.
+ * RFC 9470 check on verified claims. Returns null when satisfied, else the
+ * `insufficient_user_authentication` challenge to send (HTTP 401).
  */
+function requireAcr(claims, req) {
+    const acrOk = !req.acrValues?.length || (typeof claims.acr === 'string' && req.acrValues.includes(claims.acr));
+    const at = claims.auth_time;
+    const ageOk = req.maxAge === undefined ||
+        (typeof at === 'number' && Number.isFinite(at) && (req.nowMs ?? Date.now()) / 1000 - at <= req.maxAge);
+    if (acrOk && ageOk)
+        return null;
+    const description = 'A stronger or more recent user authentication is required.';
+    return {
+        status: 401,
+        error: 'insufficient_user_authentication',
+        description,
+        wwwAuthenticate: buildWwwAuthenticate({
+            scheme: req.scheme,
+            realm: req.realm,
+            error: 'insufficient_user_authentication',
+            description,
+            acrValues: req.acrValues,
+            maxAge: req.maxAge,
+            resourceMetadataUrl: req.resourceMetadataUrl,
+        }),
+    };
+}
 function createAccessTokenVerifier(options) {
     if (!options.issuer)
         throw new Error('createAccessTokenVerifier needs `issuer`.');
@@ -367,6 +395,19 @@ function createAccessTokenVerifier(options) {
         if (missing.length > 0) {
             return fail(403, 'insufficient_scope', `The access token is missing the required scope(s): ${missing.join(' ')}.`);
         }
+        if (extra?.requireAcr?.length || extra?.maxAge !== undefined) {
+            const step = requireAcr(claims, {
+                acrValues: extra.requireAcr,
+                maxAge: extra.maxAge,
+                scheme: presentedScheme === 'DPoP' ? 'DPoP' : 'Bearer',
+                realm: options.realm,
+                resourceMetadataUrl: options.resourceMetadataUrl,
+                nowMs: now(),
+            });
+            if (step) {
+                return { ok: false, status: 401, error: step.error, description: step.description, wwwAuthenticate: step.wwwAuthenticate };
+            }
+        }
         return {
             ok: true,
             claims,