@atlasauth/backend 0.25.0 → 0.27.0

package/dist/client/abac.js.map

@@ -1 +1 @@
-{"version":3,"file":"abac.js","sourceRoot":"","sources":["../../src/client/abac.ts"],"names":[],"mappings":";;AAuFA,oCA2CC;AAlID,uCAAgD;AAsFhD,qFAAqF;AACrF,SAAgB,YAAY,CAAC,OAAkB;IAC7C,OAAO;QACL,IAAI;YACF,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,mBAAmB,EAAE,CAAC,CAAC;QAC/D,CAAC;QACD,GAAG,CAAC,EAAU;YACZ,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,qBAAqB,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;QAC1E,CAAC;QACD,MAAM,CAAC,IAA0B,EAAE,cAAuB;YACxD,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,mBAAmB,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC;QACtF,CAAC;QACD,MAAM,CAAC,EAAU,EAAE,IAA0B;YAC3C,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,qBAAqB,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;QAClF,CAAC;QACD,MAAM,CAAC,EAAU;YACf,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,qBAAqB,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;QAC7E,CAAC;QACD,QAAQ,CAAC,EAAU;YACjB,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,qBAAqB,IAAA,aAAG,EAAC,EAAE,CAAC,WAAW,EAAE,CAAC,CAAC;QACnF,CAAC;QACD,iGAAiG;QACjG,IAAI,CAAC,EAAU,EAAE,OAA4E,EAAE;YAC7F,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,qBAAqB,IAAA,aAAG,EAAC,EAAE,CAAC,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;QACtF,CAAC;QACD,sDAAsD;QACtD,QAAQ,CAAC,IAAsB;YAC7B,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,mBAAmB,EAAE,IAAI,EAAE,CAAC,CAAC;QACtE,CAAC;QACD,2DAA2D;QAC3D,KAAK,CAAC,SAAS,CAAC,IAAsB;YACpC,OAAO,CAAC,MAAM,OAAO,CAAe,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,mBAAmB,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,OAAO,CAAC;QACjH,CAAC;QACD,qCAAqC;QACrC,iBAAiB,CAAC,IAAuB;YACvC,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,kCAAkC,EAAE,IAAI,EAAE,CAAC,CAAC;QACrF,CAAC;QACD,8CAA8C;QAC9C,kBAAkB,CAChB,IAAqK;YAErK,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,mCAAmC,EAAE,IAAI,EAAE,CAAC,CAAC;QACtF,CAAC;KACF,CAAC;AACJ,CAAC"}
+{"version":3,"file":"abac.js","sourceRoot":"","sources":["../../src/client/abac.ts"],"names":[],"mappings":";;;AA6UA,oCA8JC;AA3eD,uCAAgD;AA4UhD,qFAAqF;AACrF,SAAgB,YAAY,CAAC,OAAkB;IAC7C,OAAO;QACL,IAAI;YACF,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,mBAAmB,EAAE,CAAC,CAAC;QAC/D,CAAC;QACD,GAAG,CAAC,EAAU;YACZ,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,qBAAqB,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;QAC1E,CAAC;QACD,MAAM,CAAC,IAA0B,EAAE,cAAuB;YACxD,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,mBAAmB,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC;QACtF,CAAC;QACD,MAAM,CAAC,EAAU,EAAE,IAA0B;YAC3C,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,qBAAqB,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;QAClF,CAAC;QACD,MAAM,CAAC,EAAU;YACf,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,qBAAqB,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;QAC7E,CAAC;QACD,QAAQ,CAAC,EAAU;YACjB,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,qBAAqB,IAAA,aAAG,EAAC,EAAE,CAAC,WAAW,EAAE,CAAC,CAAC;QACnF,CAAC;QACD,iGAAiG;QACjG,IAAI,CAAC,EAAU,EAAE,OAA4E,EAAE;YAC7F,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,qBAAqB,IAAA,aAAG,EAAC,EAAE,CAAC,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;QACtF,CAAC;QACD,8GAA8G;QAC9G,KAAK,EAAE;YACL,MAAM,CAAC,MAAc;gBACnB,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,uBAAuB,EAAE,IAAI,EAAE,EAAE,MAAM,EAAE,EAAE,CAAC,CAAC;YACtF,CAAC;YACD,MAAM,CAAC,IAA+F;gBACpG,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,uBAAuB,EAAE,IAAI,EAAE,CAAC,CAAC;YAC1E,CAAC;YACD,SAAS,CAAC,EAAU;gBAClB,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,qBAAqB,IAAA,aAAG,EAAC,EAAE,CAAC,aAAa,EAAE,CAAC,CAAC;YACrF,CAAC;SACF;QACD,0GAA0G;QAC1G,YAAY,EAAE;YACZ,GAAG;gBACD,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,wBAAwB,EAAE,CAAC,CAAC;YACpE,CAAC;YACD,GAAG,CAAC,IAA+C;gBACjD,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,wBAAwB,EAAE,IAAI,EAAE,CAAC,CAAC;YAC1E,CAAC;SACF;QACD,uGAAuG;QACvG,cAAc,CAAC,IAA+M;YAC5N,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,0BAA0B,EAAE,IAAI,EAAE,CAAC,CAAC;QAC7E,CAAC;QACD,sDAAsD;QACtD,QAAQ,CAAC,IAAsB;YAC7B,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,mBAAmB,EAAE,IAAI,EAAE,CAAC,CAAC;QACtE,CAAC;QACD;;;WAGG;QACH,eAAe,CAAC,IAAqB;YACnC,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,2BAA2B,EAAE,IAAI,EAAE,CAAC,CAAC;QAC9E,CAAC;QACD,wFAAwF;QACxF,mBAAmB,CAAC,IAAwB;YAC1C,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,+BAA+B,EAAE,IAAI,EAAE,CAAC,CAAC;QAClF,CAAC;QACD,2GAA2G;QAC3G,SAAS,EAAE;YACT,IAAI;gBACF,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,oBAAoB,EAAE,CAAC,CAAC;YAChE,CAAC;YACD,GAAG,CAAC,EAAU;gBACZ,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,sBAAsB,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;YAC3E,CAAC;YACD,MAAM,CAAC,IAA4B,EAAE,cAAuB;gBAC1D,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,oBAAoB,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC;YACvF,CAAC;YACD,gIAAgI;YAChI,MAAM,CAAC,EAAU,EAAE,IAAqC;gBACtD,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,sBAAsB,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;YACnF,CAAC;YACD,qFAAqF;YACrF,MAAM,CAAC,EAAU,EAAE,OAA4B,EAAE;gBAC/C,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,sBAAsB,IAAA,aAAG,EAAC,EAAE,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;YAChH,CAAC;SACF;QACD,mHAAmH;QACnH,KAAK,EAAE;YACL,IAAI,CAAC,QAAkC,EAAE;gBACvC,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,wBAAwB,KAAK,CAAC,WAAW,CAAC,CAAC,CAAC,gBAAgB,IAAA,aAAG,EAAC,KAAK,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;YACvI,CAAC;YACD,GAAG,CAAC,EAAU;gBACZ,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,yBAAyB,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;YAC9E,CAAC;YACD,MAAM,CAAC,IAAwB,EAAE,cAAuB;gBACtD,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,uBAAuB,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC;YAC1F,CAAC;YACD,MAAM,CAAC,EAAU,EAAE,IAAsD;gBACvE,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,yBAAyB,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;YACtF,CAAC;YACD,MAAM,CAAC,EAAU;gBACf,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,yBAAyB,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;YACjF,CAAC;SACF;QACD,uFAAuF;QACvF,MAAM,EAAE;YACN,GAAG;gBACD,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,iBAAiB,EAAE,CAAC,CAAC;YAC7D,CAAC;YACD,2GAA2G;YAC3G,GAAG,CAAC,MAA0B;gBAC5B,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,iBAAiB,EAAE,IAAI,EAAE,EAAE,MAAM,EAAE,EAAE,CAAC,CAAC;YAC/E,CAAC;YACD,MAAM;gBACJ,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,iBAAiB,EAAE,CAAC,CAAC;YAChE,CAAC;YACD,8FAA8F;YAC9F,QAAQ,CAAC,IAAyE;gBAChF,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,0BAA0B,EAAE,IAAI,EAAE,CAAC,CAAC;YAC7E,CAAC;SACF;QACD,2FAA2F;QAC3F,IAAI,CAAC,EAAU,EAAE,OAAwB,EAAE;YACzC,MAAM,EAAE,GAAG,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC;iBAC5B,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,SAAS,CAAC;iBAClC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,kBAAkB,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;iBACxD,IAAI,CAAC,GAAG,CAAC,CAAC;YACb,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,qBAAqB,IAAA,aAAG,EAAC,EAAE,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;QACpG,CAAC;QACD,oEAAoE;QACpE,WAAW,CAAC,IAAwG;YAClH,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,eAAe,EAAE,IAAI,EAAE,CAAC,CAAC;QAClE,CAAC;QACD,sGAAsG;QACtG,oBAAoB,CAAC,IAA0B;YAC7C,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,sCAAsC,EAAE,IAAI,EAAE,CAAC,CAAC;QACzF,CAAC;QACD,kGAAkG;QAClG,qBAAqB,CAAC,IAA0B;YAC9C,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,uCAAuC,EAAE,IAAI,EAAE,CAAC,CAAC;QAC1F,CAAC;QACD,sFAAsF;QACtF,mBAAmB,CAAC,IAA0B;YAC5C,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,qCAAqC,EAAE,IAAI,EAAE,CAAC,CAAC;QACxF,CAAC;QACD,2DAA2D;QAC3D,KAAK,CAAC,SAAS,CAAC,IAAsB;YACpC,OAAO,CAAC,MAAM,OAAO,CAAe,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,mBAAmB,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,OAAO,CAAC;QACjH,CAAC;QACD,qCAAqC;QACrC,iBAAiB,CAAC,IAAuB;YACvC,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,kCAAkC,EAAE,IAAI,EAAE,CAAC,CAAC;QACrF,CAAC;QACD,8CAA8C;QAC9C,kBAAkB,CAChB,IAAqK;YAErK,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,mCAAmC,EAAE,IAAI,EAAE,CAAC,CAAC;QACtF,CAAC;KACF,CAAC;AACJ,CAAC;AAED,sGAAsG;AACtG,0CAe0B;AAdxB,2GAAA,kBAAkB,OAAA;AAClB,mGAAA,UAAU,OAAA;AACV,wGAAA,eAAe,OAAA;AACf,uGAAA,cAAc,OAAA;AACd,oGAAA,WAAW,OAAA"}

package/dist/client/access-policies.d.ts

@@ -1,11 +1,18 @@
 import { type RequestFn } from './request';
 import type { ListPage } from './types';
 export type AccessPolicyStage = 'sign_in' | 'authorize' | 'token';
-export type AccessPolicyGrantType = 'allow' | 'block' | 'require_mfa' | 'require_acr' | 'require_policy_acceptance' | 'require_action';
+export type AccessPolicyGrantType = 'allow' | 'block' | 'require_mfa' | 'require_acr' | 'require_policy_acceptance' | 'require_action' | 'require_auth_strength' | 'require_device_bound_session' | 'require_password_change' | 'sign_in_frequency' | 'persistent_session' | 'max_session_age';
+export type AccessPolicyMode = 'enforce' | 'report_only';
+export type AccessPolicyTarget = 'user' | 'machine' | 'agent';
+export type AccessClientType = 'browser' | 'native' | 'legacy' | 'device_code' | 'ciba' | 'machine' | 'agent';
 export interface AccessPolicyGrant {
     type: AccessPolicyGrantType;
-    /** require_acr: the acr; require_policy_acceptance: the policy key; require_action: the action name. */
+    /** require_acr: the acr; require_policy_acceptance: the policy key; require_action: the action name; require_auth_strength: mfa | passwordless | phishing_resistant. */
     value?: string;
+    /** sign_in_frequency / max_session_age: the limit in seconds (60 to 31536000). */
+    seconds?: number;
+    /** persistent_session: false forbids a remembered session. */
+    allow?: boolean;
 }
 /** Every present condition must match; an absent one matches anything. */
 export interface AccessPolicyConditions {
@@ -28,6 +35,21 @@ export interface AccessPolicyConditions {
         end: string;
         timezone?: string;
     };
+    devicePlatforms?: string[];
+    osVersion?: {
+        min?: string;
+        max?: string;
+    };
+    clientTypes?: AccessClientType[];
+    userAttributes?: Array<{
+        key: string;
+        op: 'eq' | 'neq' | 'in' | 'not_in' | 'contains' | 'exists';
+        value?: unknown;
+    }>;
+    userRiskLevels?: Array<'low' | 'medium' | 'high'>;
+    signInRiskLevels?: Array<'low' | 'medium' | 'high'>;
+    /** Machine identity or agent ids (targets machine / agent). */
+    principalIds?: string[];
 }
 /** A conditional-access policy, evaluated at sign-in, /authorize and token issuance. */
 export interface AccessPolicy {
@@ -40,6 +62,9 @@ export interface AccessPolicy {
     stages: AccessPolicyStage[];
     conditions: AccessPolicyConditions;
     grants: AccessPolicyGrant[];
+    /** `report_only` never denies; it records `access_policy.would_block`. */
+    mode: AccessPolicyMode;
+    targets: AccessPolicyTarget[];
     created_at: number;
     updated_at: number;
 }
@@ -51,6 +76,8 @@ export interface CreateAccessPolicyBody {
     stages?: AccessPolicyStage[];
     conditions?: AccessPolicyConditions;
     grants: AccessPolicyGrant[];
+    mode?: AccessPolicyMode;
+    targets?: AccessPolicyTarget[];
 }
 export type UpdateAccessPolicyBody = Partial<CreateAccessPolicyBody>;
 export interface SimulateAccessBody {
@@ -70,6 +97,42 @@ export interface SimulateAccessBody {
     acr?: string[];
     /** Epoch ms; default now. */
     now?: number;
+    target_type?: AccessPolicyTarget;
+    principal_id?: string;
+    device_platform?: string;
+    os_version?: string;
+    client_type?: AccessClientType;
+    user_attributes?: Record<string, unknown>;
+    user_risk_level?: 'low' | 'medium' | 'high';
+    last_auth_age_seconds?: number;
+    session_age_seconds?: number;
+    device_bound_session?: boolean;
+}
+export interface AccessPolicyImpact {
+    object: 'access_policy_impact';
+    days: number;
+    evaluated: number;
+    would_allow: number;
+    would_step_up: number;
+    would_block: number;
+    distinct_users: number;
+    affected_users: number;
+    samples: Array<{
+        user_id: string | null;
+        stage: string;
+        outcome: string;
+        unmet: string[];
+        at: number;
+    }>;
+}
+export interface AccessPolicyInsights {
+    object: 'access_policy_insights';
+    days: number;
+    evaluated: number;
+    would_block: number;
+    would_step_up: number;
+    by_policy: Record<string, number>;
+    by_day: Record<string, number>;
 }
 export interface AccessPolicySimulation {
     object: 'access_policy_simulation';
@@ -81,8 +144,18 @@ export interface AccessPolicySimulation {
         acr: string[];
         policy_acceptance: string[];
         actions: string[];
+        auth_strength: 'mfa' | 'passwordless' | 'phishing_resistant' | null;
+        sign_in_frequency_seconds: number | null;
+        max_session_age_seconds: number | null;
+        persistent_session: boolean;
+        device_bound_session: boolean;
     };
     unmet: string[];
+    report_only: {
+        decision: 'allow' | 'block' | 'step_up';
+        matched: string[];
+        blocked_by: string | null;
+    } | null;
 }
 /** CRUD over conditional-access policies, plus a what-if `simulate`. */
 export declare function accessPoliciesResource(request: RequestFn): {
@@ -95,6 +168,15 @@ export declare function accessPoliciesResource(request: RequestFn): {
         id: string;
         deleted: true;
     }>;
+    /** Replay a draft policy against recent sampled sign-ins: how many would be allowed, stepped up or blocked. */
+    impact(body: {
+        draft: CreateAccessPolicyBody | Record<string, unknown>;
+        days?: number;
+    }): Promise<AccessPolicyImpact>;
+    /** How often report-only policies would have intervened. */
+    insights(query?: {
+        days?: number;
+    }): Promise<AccessPolicyInsights>;
     /** What would the policies decide for this request? */
     simulate(body: SimulateAccessBody): Promise<AccessPolicySimulation>;
 };

package/dist/client/access-policies.js

@@ -20,6 +20,14 @@ function accessPoliciesResource(request) {
         delete(id) {
             return request({ method: 'DELETE', path: `/v1/access_policies/${(0, request_1.enc)(id)}` });
         },
+        /** Replay a draft policy against recent sampled sign-ins: how many would be allowed, stepped up or blocked. */
+        impact(body) {
+            return request({ method: 'POST', path: '/v1/access_policies/impact', body });
+        },
+        /** How often report-only policies would have intervened. */
+        insights(query = {}) {
+            return request({ method: 'GET', path: `/v1/access_policies/insights${query.days ? `?days=${query.days}` : ''}` });
+        },
         /** What would the policies decide for this request? */
         simulate(body) {
             return request({ method: 'POST', path: '/v1/access_policies/simulate', body });

package/dist/client/access-policies.js.map

@@ -1 +1 @@
-{"version":3,"file":"access-policies.js","sourceRoot":"","sources":["../../src/client/access-policies.ts"],"names":[],"mappings":";;AAmFA,wDAsBC;AAzGD,uCAAgD;AAkFhD,wEAAwE;AACxE,SAAgB,sBAAsB,CAAC,OAAkB;IACvD,OAAO;QACL,IAAI;YACF,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,qBAAqB,EAAE,CAAC,CAAC;QACjE,CAAC;QACD,GAAG,CAAC,EAAU;YACZ,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,uBAAuB,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;QAC5E,CAAC;QACD,MAAM,CAAC,IAA4B,EAAE,cAAuB;YAC1D,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,qBAAqB,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC;QACxF,CAAC;QACD,MAAM,CAAC,EAAU,EAAE,IAA4B;YAC7C,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,uBAAuB,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;QACpF,CAAC;QACD,MAAM,CAAC,EAAU;YACf,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,uBAAuB,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;QAC/E,CAAC;QACD,uDAAuD;QACvD,QAAQ,CAAC,IAAwB;YAC/B,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,8BAA8B,EAAE,IAAI,EAAE,CAAC,CAAC;QACjF,CAAC;KACF,CAAC;AACJ,CAAC"}
+{"version":3,"file":"access-policies.js","sourceRoot":"","sources":["../../src/client/access-policies.ts"],"names":[],"mappings":";;AA8JA,wDA8BC;AA5LD,uCAAgD;AA6JhD,wEAAwE;AACxE,SAAgB,sBAAsB,CAAC,OAAkB;IACvD,OAAO;QACL,IAAI;YACF,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,qBAAqB,EAAE,CAAC,CAAC;QACjE,CAAC;QACD,GAAG,CAAC,EAAU;YACZ,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,uBAAuB,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;QAC5E,CAAC;QACD,MAAM,CAAC,IAA4B,EAAE,cAAuB;YAC1D,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,qBAAqB,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC;QACxF,CAAC;QACD,MAAM,CAAC,EAAU,EAAE,IAA4B;YAC7C,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,uBAAuB,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;QACpF,CAAC;QACD,MAAM,CAAC,EAAU;YACf,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,uBAAuB,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;QAC/E,CAAC;QACD,+GAA+G;QAC/G,MAAM,CAAC,IAAgF;YACrF,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,4BAA4B,EAAE,IAAI,EAAE,CAAC,CAAC;QAC/E,CAAC;QACD,4DAA4D;QAC5D,QAAQ,CAAC,QAA2B,EAAE;YACpC,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,+BAA+B,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;QACpH,CAAC;QACD,uDAAuD;QACvD,QAAQ,CAAC,IAAwB;YAC/B,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,8BAA8B,EAAE,IAAI,EAAE,CAAC,CAAC;QACjF,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/client/actions.d.ts

@@ -1,7 +1,7 @@
 import { type RequestFn } from './request';
 import type { ListPage } from './types';
 /** The fixed point in the auth pipeline an action runs at. */
-export type ActionTrigger = 'post_login' | 'pre_user_registration' | 'post_user_registration' | 'pre_organization_create' | 'pre_member_add' | 'pre_invitation_create' | 'pre_authentication' | 'pre_token' | 'post_token_exchange' | 'pre_user_update' | 'mfa_verification_attempt' | 'password_verification_attempt' | 'account_link_decision' | 'billing_plan_selected' | 'post_change_password' | 'post_password_reset' | 'post_user_update' | 'post_email_verified' | 'post_mfa_enroll' | 'post_mfa_remove' | 'post_logout' | 'org_membership_changed' | 'custom_challenge_create' | 'custom_challenge_verify' | 'workflow_step';
+export type ActionTrigger = 'post_login' | 'pre_user_registration' | 'post_user_registration' | 'pre_organization_create' | 'pre_member_add' | 'pre_invitation_create' | 'pre_authentication' | 'pre_token' | 'post_token_exchange' | 'custom_token_exchange' | 'pre_user_update' | 'mfa_verification_attempt' | 'password_verification_attempt' | 'account_link_decision' | 'billing_plan_selected' | 'post_change_password' | 'post_password_reset' | 'post_user_update' | 'post_email_verified' | 'post_mfa_enroll' | 'post_mfa_remove' | 'post_logout' | 'org_membership_changed' | 'custom_challenge_create' | 'custom_challenge_verify' | 'workflow_step';
 /**
  * Tenant code run in the hardened isolate at a trigger. Secret VALUES are
  * write-only and never returned — a read reports only `secret_names`. Timestamps

package/dist/client/actions.js.map

@@ -1 +1 @@
-{"version":3,"file":"actions.js","sourceRoot":"","sources":["../../src/client/actions.ts"],"names":[],"mappings":";;AA8MA,0CAyCC;AAvPD,uCAAgD;AA8MhD,SAAgB,eAAe,CAAC,OAAkB;IAChD,OAAO;QACL,IAAI;YACF,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,aAAa,EAAE,CAAC,CAAC;QACzD,CAAC;QACD,MAAM,CAAC,IAAsB,EAAE,cAAuB;YACpD,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,aAAa,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC;QAChF,CAAC;QACD,GAAG,CAAC,EAAU;YACZ,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,eAAe,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;QACpE,CAAC;QACD,MAAM,CAAC,EAAU,EAAE,IAAsB;YACvC,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,eAAe,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;QAC5E,CAAC;QACD,MAAM,CAAC,EAAU;YACf,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,eAAe,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;QACvE,CAAC;QACD,2EAA2E;QAC3E,IAAI,CAAC,EAAU,EAAE,QAAyB,EAAE;YAC1C,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,eAAe,IAAA,aAAG,EAAC,EAAE,CAAC,OAAO,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC;QAC3F,CAAC;QACD,0EAA0E;QAC1E,KAAK,CACH,EAAU,EACV,QAAqJ,EAAE;YAEvJ,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,eAAe,IAAA,aAAG,EAAC,EAAE,CAAC,QAAQ,EAAE,KAAK,EAAE,CAAC,CAAC;QACjF,CAAC;QACD,oDAAoD;QACpD,WAAW,CAAC,OAAsB;YAChC,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,wBAAwB,IAAA,aAAG,EAAC,OAAO,CAAC,EAAE,EAAE,CAAC,CAAC;QAClF,CAAC;QACD,+CAA+C;QAC/C,WAAW,CAAC,OAAsB,EAAE,SAAmB;YACrD,OAAO,OAAO,CAAC;gBACb,MAAM,EAAE,KAAK;gBACb,IAAI,EAAE,wBAAwB,IAAA,aAAG,EAAC,OAAO,CAAC,EAAE;gBAC5C,IAAI,EAAE,EAAE,UAAU,EAAE,SAAS,EAAE;aAChC,CAAC,CAAC;QACL,CAAC;KACF,CAAC;AACJ,CAAC"}
+{"version":3,"file":"actions.js","sourceRoot":"","sources":["../../src/client/actions.ts"],"names":[],"mappings":";;AA+MA,0CAyCC;AAxPD,uCAAgD;AA+MhD,SAAgB,eAAe,CAAC,OAAkB;IAChD,OAAO;QACL,IAAI;YACF,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,aAAa,EAAE,CAAC,CAAC;QACzD,CAAC;QACD,MAAM,CAAC,IAAsB,EAAE,cAAuB;YACpD,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,aAAa,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC;QAChF,CAAC;QACD,GAAG,CAAC,EAAU;YACZ,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,eAAe,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;QACpE,CAAC;QACD,MAAM,CAAC,EAAU,EAAE,IAAsB;YACvC,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,eAAe,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;QAC5E,CAAC;QACD,MAAM,CAAC,EAAU;YACf,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,eAAe,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;QACvE,CAAC;QACD,2EAA2E;QAC3E,IAAI,CAAC,EAAU,EAAE,QAAyB,EAAE;YAC1C,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,eAAe,IAAA,aAAG,EAAC,EAAE,CAAC,OAAO,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC;QAC3F,CAAC;QACD,0EAA0E;QAC1E,KAAK,CACH,EAAU,EACV,QAAqJ,EAAE;YAEvJ,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,eAAe,IAAA,aAAG,EAAC,EAAE,CAAC,QAAQ,EAAE,KAAK,EAAE,CAAC,CAAC;QACjF,CAAC;QACD,oDAAoD;QACpD,WAAW,CAAC,OAAsB;YAChC,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,wBAAwB,IAAA,aAAG,EAAC,OAAO,CAAC,EAAE,EAAE,CAAC,CAAC;QAClF,CAAC;QACD,+CAA+C;QAC/C,WAAW,CAAC,OAAsB,EAAE,SAAmB;YACrD,OAAO,OAAO,CAAC;gBACb,MAAM,EAAE,KAAK;gBACb,IAAI,EAAE,wBAAwB,IAAA,aAAG,EAAC,OAAO,CAAC,EAAE;gBAC5C,IAAI,EAAE,EAAE,UAAU,EAAE,SAAS,EAAE;aAChC,CAAC,CAAC;QACL,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/client/agent-platform.d.ts

@@ -0,0 +1,294 @@
+import { type RequestFn } from './request';
+import type { ListPage } from './types';
+/** An action over a connection: a typed provider operation. */
+export interface ConnectionAction {
+    object: 'connection_action';
+    provider: string;
+    name: string;
+    description: string;
+    input_schema: Record<string, unknown>;
+    method: string;
+    mutating: boolean;
+    scopes: string[];
+    source: 'first_party' | 'custom';
+}
+export interface ConnectionActionResult {
+    object: 'connection_action_result';
+    action: string;
+    connection_id: string;
+    ok: boolean;
+    status: number | null;
+    data: unknown;
+    error: string | null;
+    truncated: boolean;
+    attempts: number;
+    dry_run?: Record<string, unknown>;
+}
+/** A custom action definition: data only (input schema, request template, response mapping). */
+export interface ConnectionActionDefinition {
+    description: string;
+    input?: Record<string, unknown>;
+    request: {
+        method: 'GET' | 'POST' | 'PUT' | 'PATCH' | 'DELETE';
+        base_url: string;
+        path: string;
+        query?: Record<string, string>;
+        body?: unknown;
+        headers?: Record<string, string>;
+    };
+    response?: {
+        path?: string;
+        ok_field?: string;
+        error_field?: string;
+    };
+    scopes?: string[];
+    paginate?: Record<string, unknown>;
+    mutating?: boolean;
+}
+export interface ConnectionTrigger {
+    object: 'connection_trigger';
+    id: string;
+    connection_id: string;
+    event: string;
+    mode: 'webhook' | 'poll';
+    filter: Record<string, string>;
+    target_url: string | null;
+    status: 'active' | 'paused' | 'failed';
+    provider_registered: boolean;
+    ingress_url: string | null;
+    poll: Record<string, unknown> | null;
+    next_poll_at: number | null;
+    last_error: string | null;
+    last_fired_at: number | null;
+    fired_count: number;
+    /** Shown once on creation of a webhook trigger. */
+    forward_secret?: string;
+    created_at: number;
+}
+export interface CreateConnectionTriggerBody {
+    event: string;
+    mode?: 'webhook' | 'poll';
+    filter?: Record<string, string>;
+    target_url?: string;
+    scheme?: string;
+    signing_secret?: string;
+    options?: Record<string, string>;
+    poll?: {
+        action: string;
+        input?: Record<string, unknown>;
+        items_path?: string;
+        id_field: string;
+        interval_seconds?: number;
+    };
+}
+/** Typed actions over connections, provider event triggers, scoped relay tokens and usage records. */
+export declare function connectionActionsResource(request: RequestFn): {
+    catalog: {
+        list(query?: {
+            provider?: string;
+        }): Promise<ListPage<ConnectionAction>>;
+        get(provider: string, name: string): Promise<ConnectionAction>;
+        /** Define or replace a custom action (data, never code). */
+        define(provider: string, name: string, body: ConnectionActionDefinition): Promise<ConnectionAction>;
+        delete(provider: string, name: string): Promise<void>;
+    };
+    /** The actions available on one connection. */
+    list(connectionId: string): Promise<ListPage<ConnectionAction>>;
+    run(connectionId: string, name: string, body?: {
+        input?: Record<string, unknown>;
+        dry_run?: boolean;
+        all_pages?: boolean;
+        redirect_url?: string;
+        connect_user_id?: string;
+    }): Promise<ConnectionActionResult>;
+    triggers: {
+        list(connectionId: string): Promise<ListPage<ConnectionTrigger>>;
+        create(connectionId: string, body: CreateConnectionTriggerBody): Promise<ConnectionTrigger>;
+        get(connectionId: string, triggerId: string): Promise<ConnectionTrigger>;
+        setStatus(connectionId: string, triggerId: string, status: "active" | "paused"): Promise<ConnectionTrigger>;
+        delete(connectionId: string, triggerId: string): Promise<{
+            object: "connection_trigger";
+            id: string;
+            deleted: true;
+            provider_unregistered: boolean | null;
+        }>;
+    };
+    /** A signed credential for one connection that only works through the relay, for listed methods and URL prefixes. */
+    mintScopedToken(connectionId: string, body: {
+        url_prefixes: string[];
+        methods?: string[];
+        ttl_seconds?: number;
+    }): Promise<{
+        object: "connection_scoped_token";
+        connection_id: string;
+        token: string;
+        expires_at: number;
+        methods: string[];
+        url_prefixes: string[];
+    }>;
+    /** Calls through connections, agent connection use and gateway calls, counted from the audit trail. */
+    usage(query?: {
+        from?: string | number;
+        to?: string | number;
+        group_by?: "action" | "day" | "agent" | "connection";
+    }): Promise<{
+        object: "list";
+        from: number;
+        to: number;
+        group_by: string;
+        data: Array<{
+            object: "connection_usage";
+            key: string | null;
+            calls: number;
+        }>;
+    }>;
+};
+export interface AgentLifecycle {
+    object: 'agent_lifecycle';
+    agent_id: string;
+    sponsor_user_id: string | null;
+    backup_sponsor_user_id: string | null;
+    expires_at: number | null;
+    renewed_at: number | null;
+    renewal_count: number;
+}
+export interface AgentAccessReview {
+    object: 'agent_access_review';
+    id: string;
+    name: string;
+    status: 'open' | 'closed';
+    due_at: number | null;
+    created_at: number;
+    closed_at: number | null;
+    item_count?: number;
+}
+export interface AgentAccessReviewItem {
+    object: 'agent_access_review_item';
+    id: string;
+    review_id: string;
+    agent_id: string;
+    kind: string;
+    resource: string;
+    reviewer_user_id: string | null;
+    decision: 'pending' | 'certified' | 'revoked';
+    decided_by: string | null;
+    decided_at: number | null;
+    comment: string | null;
+    revoked_applied: boolean;
+}
+/** Agent governance: sponsors, expiry and renewal, the activity log, and access reviews of agents' grants. */
+export declare function agentGovernanceResource(request: RequestFn): {
+    lifecycle: {
+        get(agentId: string): Promise<AgentLifecycle>;
+        set(agentId: string, body: {
+            sponsor_user_id?: string | null;
+            backup_sponsor_user_id?: string | null;
+            expires_at?: number | string | null;
+        }): Promise<AgentLifecycle>;
+        renew(agentId: string, extendDays: number): Promise<AgentLifecycle>;
+    };
+    activity(agentId: string, query?: {
+        since?: string | number;
+        before?: string | number;
+        limit?: number;
+    }): Promise<ListPage<{
+        object: "agent_activity";
+        id: string;
+        action: string;
+        target_type: string | null;
+        target_id: string | null;
+        metadata: Record<string, unknown>;
+        at: number;
+    }>>;
+    reviews: {
+        list(): Promise<ListPage<AgentAccessReview>>;
+        start(body: {
+            name: string;
+            due_at?: number | string | null;
+            tier?: "trusted" | "untrusted";
+            kind?: "tool" | "connection";
+        }): Promise<AgentAccessReview>;
+        get(id: string, query?: {
+            decision?: "pending" | "certified" | "revoked";
+            reviewer_user_id?: string;
+        }): Promise<AgentAccessReview & {
+            items: AgentAccessReviewItem[];
+        }>;
+        decide(id: string, itemId: string, body: {
+            decision: "certified" | "revoked";
+            comment?: string;
+            decided_by?: string;
+        }): Promise<AgentAccessReviewItem>;
+        close(id: string): Promise<AgentAccessReview>;
+    };
+};
+export interface McpRegistryEntry {
+    object: 'mcp_registry_entry';
+    id: string;
+    name: string;
+    url: string;
+    description: string | null;
+    status: 'pending' | 'approved' | 'rejected';
+    requested_by: string | null;
+    decided_by: string | null;
+    decided_at: number | null;
+    created_at: number;
+}
+/** The registry of approved upstream MCP servers, and write elevations for the admin MCP server. */
+export declare function mcpRegistryResource(request: RequestFn): {
+    list(query?: {
+        status?: "pending" | "approved" | "rejected";
+    }): Promise<ListPage<McpRegistryEntry>>;
+    add(body: {
+        name: string;
+        url: string;
+        description?: string;
+        status?: "approved" | "pending";
+    }): Promise<McpRegistryEntry>;
+    decide(id: string, status: "approved" | "rejected"): Promise<McpRegistryEntry>;
+    remove(id: string): Promise<{
+        object: "mcp_registry_entry";
+        id: string;
+        deleted: true;
+    }>;
+    /** Grant another API key a short write elevation over the admin MCP server. */
+    elevate(body: {
+        api_key_id: string;
+        ttl_seconds?: number;
+        reason?: string;
+    }): Promise<{
+        object: "mcp_elevation";
+        api_key_id: string;
+        token: string;
+        expires_at: number;
+        header: string;
+    }>;
+};
+export interface TelemetryExport {
+    object: 'telemetry_export';
+    enabled: boolean;
+    endpoint: string | null;
+    /** Headers are write-only. */
+    has_headers: boolean;
+    service_name: string;
+    traces: boolean;
+    metrics: boolean;
+}
+/** OTLP/HTTP export of gateway and relay calls (spans and metrics) to your collector. */
+export declare function telemetryExportResource(request: RequestFn): {
+    get(): Promise<TelemetryExport>;
+    update(body: {
+        enabled?: boolean;
+        endpoint?: string;
+        headers?: Record<string, string> | null;
+        service_name?: string;
+        traces?: boolean;
+        metrics?: boolean;
+    }): Promise<TelemetryExport>;
+    /** Send one test span now. */
+    test(): Promise<{
+        object: "telemetry_export_test";
+        ok: boolean;
+        error: string | null;
+    }>;
+};

package/dist/client/agent-platform.js

@@ -0,0 +1,132 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.connectionActionsResource = connectionActionsResource;
+exports.agentGovernanceResource = agentGovernanceResource;
+exports.mcpRegistryResource = mcpRegistryResource;
+exports.telemetryExportResource = telemetryExportResource;
+const request_1 = require("./request");
+/** Typed actions over connections, provider event triggers, scoped relay tokens and usage records. */
+function connectionActionsResource(request) {
+    return {
+        catalog: {
+            list(query = {}) {
+                return request({ method: 'GET', path: '/v1/connection_actions', query: { ...query } });
+            },
+            get(provider, name) {
+                return request({ method: 'GET', path: `/v1/connection_actions/${(0, request_1.enc)(provider)}/${(0, request_1.enc)(name)}` });
+            },
+            /** Define or replace a custom action (data, never code). */
+            define(provider, name, body) {
+                return request({ method: 'PUT', path: `/v1/connection_actions/${(0, request_1.enc)(provider)}/${(0, request_1.enc)(name)}`, body });
+            },
+            delete(provider, name) {
+                return request({ method: 'DELETE', path: `/v1/connection_actions/${(0, request_1.enc)(provider)}/${(0, request_1.enc)(name)}` });
+            },
+        },
+        /** The actions available on one connection. */
+        list(connectionId) {
+            return request({ method: 'GET', path: `/v1/connections/${(0, request_1.enc)(connectionId)}/actions` });
+        },
+        run(connectionId, name, body = {}) {
+            return request({ method: 'POST', path: `/v1/connections/${(0, request_1.enc)(connectionId)}/actions/${(0, request_1.enc)(name)}`, body });
+        },
+        triggers: {
+            list(connectionId) {
+                return request({ method: 'GET', path: `/v1/connections/${(0, request_1.enc)(connectionId)}/triggers` });
+            },
+            create(connectionId, body) {
+                return request({ method: 'POST', path: `/v1/connections/${(0, request_1.enc)(connectionId)}/triggers`, body });
+            },
+            get(connectionId, triggerId) {
+                return request({ method: 'GET', path: `/v1/connections/${(0, request_1.enc)(connectionId)}/triggers/${(0, request_1.enc)(triggerId)}` });
+            },
+            setStatus(connectionId, triggerId, status) {
+                return request({ method: 'PATCH', path: `/v1/connections/${(0, request_1.enc)(connectionId)}/triggers/${(0, request_1.enc)(triggerId)}`, body: { status } });
+            },
+            delete(connectionId, triggerId) {
+                return request({ method: 'DELETE', path: `/v1/connections/${(0, request_1.enc)(connectionId)}/triggers/${(0, request_1.enc)(triggerId)}` });
+            },
+        },
+        /** A signed credential for one connection that only works through the relay, for listed methods and URL prefixes. */
+        mintScopedToken(connectionId, body) {
+            return request({ method: 'POST', path: `/v1/connections/${(0, request_1.enc)(connectionId)}/scoped_tokens`, body });
+        },
+        /** Calls through connections, agent connection use and gateway calls, counted from the audit trail. */
+        usage(query = {}) {
+            return request({ method: 'GET', path: '/v1/usage/connections', query: { ...query } });
+        },
+    };
+}
+/** Agent governance: sponsors, expiry and renewal, the activity log, and access reviews of agents' grants. */
+function agentGovernanceResource(request) {
+    return {
+        lifecycle: {
+            get(agentId) {
+                return request({ method: 'GET', path: `/v1/agents/${(0, request_1.enc)(agentId)}/lifecycle` });
+            },
+            set(agentId, body) {
+                return request({ method: 'PUT', path: `/v1/agents/${(0, request_1.enc)(agentId)}/lifecycle`, body });
+            },
+            renew(agentId, extendDays) {
+                return request({ method: 'POST', path: `/v1/agents/${(0, request_1.enc)(agentId)}/renew`, body: { extend_days: extendDays } });
+            },
+        },
+        activity(agentId, query = {}) {
+            return request({ method: 'GET', path: `/v1/agents/${(0, request_1.enc)(agentId)}/activity`, query: { ...query } });
+        },
+        reviews: {
+            list() {
+                return request({ method: 'GET', path: '/v1/agent_access_reviews' });
+            },
+            start(body) {
+                return request({ method: 'POST', path: '/v1/agent_access_reviews', body });
+            },
+            get(id, query = {}) {
+                return request({ method: 'GET', path: `/v1/agent_access_reviews/${(0, request_1.enc)(id)}`, query: { ...query } });
+            },
+            decide(id, itemId, body) {
+                return request({ method: 'POST', path: `/v1/agent_access_reviews/${(0, request_1.enc)(id)}/items/${(0, request_1.enc)(itemId)}/decide`, body });
+            },
+            close(id) {
+                return request({ method: 'POST', path: `/v1/agent_access_reviews/${(0, request_1.enc)(id)}/close` });
+            },
+        },
+    };
+}
+/** The registry of approved upstream MCP servers, and write elevations for the admin MCP server. */
+function mcpRegistryResource(request) {
+    return {
+        list(query = {}) {
+            return request({ method: 'GET', path: '/v1/mcp_registry', query: { ...query } });
+        },
+        add(body) {
+            return request({ method: 'POST', path: '/v1/mcp_registry', body });
+        },
+        decide(id, status) {
+            return request({ method: 'POST', path: `/v1/mcp_registry/${(0, request_1.enc)(id)}/decide`, body: { status } });
+        },
+        remove(id) {
+            return request({ method: 'DELETE', path: `/v1/mcp_registry/${(0, request_1.enc)(id)}` });
+        },
+        /** Grant another API key a short write elevation over the admin MCP server. */
+        elevate(body) {
+            return request({ method: 'POST', path: '/v1/mcp/elevations', body });
+        },
+    };
+}
+/** OTLP/HTTP export of gateway and relay calls (spans and metrics) to your collector. */
+function telemetryExportResource(request) {
+    return {
+        get() {
+            return request({ method: 'GET', path: '/v1/telemetry_export' });
+        },
+        update(body) {
+            return request({ method: 'PUT', path: '/v1/telemetry_export', body });
+        },
+        /** Send one test span now. */
+        test() {
+            return request({ method: 'POST', path: '/v1/telemetry_export/test' });
+        },
+    };
+}
+//# sourceMappingURL=agent-platform.js.map

package/dist/client/agent-platform.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"agent-platform.js","sourceRoot":"","sources":["../../src/client/agent-platform.ts"],"names":[],"mappings":";;AAyEA,8DAkDC;AAuCD,0DAkCC;AAgBD,kDAmBC;AAcD,0DAaC;AAlQD,uCAAgD;AAwEhD,sGAAsG;AACtG,SAAgB,yBAAyB,CAAC,OAAkB;IAC1D,OAAO;QACL,OAAO,EAAE;YACP,IAAI,CAAC,QAA+B,EAAE;gBACpC,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,wBAAwB,EAAE,KAAK,EAAE,EAAE,GAAG,KAAK,EAAE,EAAE,CAAC,CAAC;YACzF,CAAC;YACD,GAAG,CAAC,QAAgB,EAAE,IAAY;gBAChC,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,0BAA0B,IAAA,aAAG,EAAC,QAAQ,CAAC,IAAI,IAAA,aAAG,EAAC,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC;YAClG,CAAC;YACD,4DAA4D;YAC5D,MAAM,CAAC,QAAgB,EAAE,IAAY,EAAE,IAAgC;gBACrE,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,0BAA0B,IAAA,aAAG,EAAC,QAAQ,CAAC,IAAI,IAAA,aAAG,EAAC,IAAI,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;YACxG,CAAC;YACD,MAAM,CAAC,QAAgB,EAAE,IAAY;gBACnC,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,0BAA0B,IAAA,aAAG,EAAC,QAAQ,CAAC,IAAI,IAAA,aAAG,EAAC,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC;YACrG,CAAC;SACF;QACD,+CAA+C;QAC/C,IAAI,CAAC,YAAoB;YACvB,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,mBAAmB,IAAA,aAAG,EAAC,YAAY,CAAC,UAAU,EAAE,CAAC,CAAC;QAC1F,CAAC;QACD,GAAG,CAAC,YAAoB,EAAE,IAAY,EAAE,OAAqI,EAAE;YAC7K,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,mBAAmB,IAAA,aAAG,EAAC,YAAY,CAAC,YAAY,IAAA,aAAG,EAAC,IAAI,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;QAC9G,CAAC;QACD,QAAQ,EAAE;YACR,IAAI,CAAC,YAAoB;gBACvB,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,mBAAmB,IAAA,aAAG,EAAC,YAAY,CAAC,WAAW,EAAE,CAAC,CAAC;YAC3F,CAAC;YACD,MAAM,CAAC,YAAoB,EAAE,IAAiC;gBAC5D,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,mBAAmB,IAAA,aAAG,EAAC,YAAY,CAAC,WAAW,EAAE,IAAI,EAAE,CAAC,CAAC;YAClG,CAAC;YACD,GAAG,CAAC,YAAoB,EAAE,SAAiB;gBACzC,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,mBAAmB,IAAA,aAAG,EAAC,YAAY,CAAC,aAAa,IAAA,aAAG,EAAC,SAAS,CAAC,EAAE,EAAE,CAAC,CAAC;YAC7G,CAAC;YACD,SAAS,CAAC,YAAoB,EAAE,SAAiB,EAAE,MAA2B;gBAC5E,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,mBAAmB,IAAA,aAAG,EAAC,YAAY,CAAC,aAAa,IAAA,aAAG,EAAC,SAAS,CAAC,EAAE,EAAE,IAAI,EAAE,EAAE,MAAM,EAAE,EAAE,CAAC,CAAC;YACjI,CAAC;YACD,MAAM,CAAC,YAAoB,EAAE,SAAiB;gBAC5C,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,mBAAmB,IAAA,aAAG,EAAC,YAAY,CAAC,aAAa,IAAA,aAAG,EAAC,SAAS,CAAC,EAAE,EAAE,CAAC,CAAC;YAChH,CAAC;SACF;QACD,qHAAqH;QACrH,eAAe,CAAC,YAAoB,EAAE,IAA0E;YAC9G,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,mBAAmB,IAAA,aAAG,EAAC,YAAY,CAAC,gBAAgB,EAAE,IAAI,EAAE,CAAC,CAAC;QACvG,CAAC;QACD,uGAAuG;QACvG,KAAK,CAAC,QAAgH,EAAE;YACtH,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,uBAAuB,EAAE,KAAK,EAAE,EAAE,GAAG,KAAK,EAAE,EAAE,CAAC,CAAC;QACxF,CAAC;KACF,CAAC;AACJ,CAAC;AAsCD,8GAA8G;AAC9G,SAAgB,uBAAuB,CAAC,OAAkB;IACxD,OAAO;QACL,SAAS,EAAE;YACT,GAAG,CAAC,OAAe;gBACjB,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,cAAc,IAAA,aAAG,EAAC,OAAO,CAAC,YAAY,EAAE,CAAC,CAAC;YAClF,CAAC;YACD,GAAG,CAAC,OAAe,EAAE,IAAsH;gBACzI,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,cAAc,IAAA,aAAG,EAAC,OAAO,CAAC,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC;YACxF,CAAC;YACD,KAAK,CAAC,OAAe,EAAE,UAAkB;gBACvC,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,cAAc,IAAA,aAAG,EAAC,OAAO,CAAC,QAAQ,EAAE,IAAI,EAAE,EAAE,WAAW,EAAE,UAAU,EAAE,EAAE,CAAC,CAAC;YAClH,CAAC;SACF;QACD,QAAQ,CAAC,OAAe,EAAE,QAA+E,EAAE;YACzG,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,cAAc,IAAA,aAAG,EAAC,OAAO,CAAC,WAAW,EAAE,KAAK,EAAE,EAAE,GAAG,KAAK,EAAE,EAAE,CAAC,CAAC;QACtG,CAAC;QACD,OAAO,EAAE;YACP,IAAI;gBACF,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,0BAA0B,EAAE,CAAC,CAAC;YACtE,CAAC;YACD,KAAK,CAAC,IAAqH;gBACzH,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,0BAA0B,EAAE,IAAI,EAAE,CAAC,CAAC;YAC7E,CAAC;YACD,GAAG,CAAC,EAAU,EAAE,QAAuF,EAAE;gBACvG,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,4BAA4B,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,KAAK,EAAE,EAAE,GAAG,KAAK,EAAE,EAAE,CAAC,CAAC;YACtG,CAAC;YACD,MAAM,CAAC,EAAU,EAAE,MAAc,EAAE,IAAkF;gBACnH,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,4BAA4B,IAAA,aAAG,EAAC,EAAE,CAAC,UAAU,IAAA,aAAG,EAAC,MAAM,CAAC,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;YACpH,CAAC;YACD,KAAK,CAAC,EAAU;gBACd,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,4BAA4B,IAAA,aAAG,EAAC,EAAE,CAAC,QAAQ,EAAE,CAAC,CAAC;YACxF,CAAC;SACF;KACF,CAAC;AACJ,CAAC;AAeD,oGAAoG;AACpG,SAAgB,mBAAmB,CAAC,OAAkB;IACpD,OAAO;QACL,IAAI,CAAC,QAA0D,EAAE;YAC/D,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,kBAAkB,EAAE,KAAK,EAAE,EAAE,GAAG,KAAK,EAAE,EAAE,CAAC,CAAC;QACnF,CAAC;QACD,GAAG,CAAC,IAA0F;YAC5F,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,kBAAkB,EAAE,IAAI,EAAE,CAAC,CAAC;QACrE,CAAC;QACD,MAAM,CAAC,EAAU,EAAE,MAA+B;YAChD,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,oBAAoB,IAAA,aAAG,EAAC,EAAE,CAAC,SAAS,EAAE,IAAI,EAAE,EAAE,MAAM,EAAE,EAAE,CAAC,CAAC;QACnG,CAAC;QACD,MAAM,CAAC,EAAU;YACf,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,oBAAoB,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;QAC5E,CAAC;QACD,+EAA+E;QAC/E,OAAO,CAAC,IAAmE;YACzE,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,oBAAoB,EAAE,IAAI,EAAE,CAAC,CAAC;QACvE,CAAC;KACF,CAAC;AACJ,CAAC;AAaD,yFAAyF;AACzF,SAAgB,uBAAuB,CAAC,OAAkB;IACxD,OAAO;QACL,GAAG;YACD,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,sBAAsB,EAAE,CAAC,CAAC;QAClE,CAAC;QACD,MAAM,CAAC,IAAmJ;YACxJ,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,sBAAsB,EAAE,IAAI,EAAE,CAAC,CAAC;QACxE,CAAC;QACD,8BAA8B;QAC9B,IAAI;YACF,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,2BAA2B,EAAE,CAAC,CAAC;QACxE,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/client/analytics-reports.d.ts

@@ -82,7 +82,7 @@ export interface AccessByAppRow {
     active_grants: number;
     users_in_window: number;
 }
-export type AlertMetric = 'sign_in_success_rate' | 'failed_passkey_ratio' | 'failed_sign_ins' | 'sign_in_p95_seconds' | 'api_usage_spike';
+export type AlertMetric = 'sign_in_success_rate' | 'failed_passkey_ratio' | 'failed_sign_ins' | 'sign_in_p95_seconds' | 'api_usage_spike' | 'unused_permissions';
 export type UsageSubjectType = 'api_key' | 'end_user_api_key' | 'organization';
 /** One key's or organization's API usage against its 7-day hourly baseline. */
 export interface ApiUsageSubject {