@atlasauth/backend 0.26.0 → 0.27.0

package/CHANGELOG.md

@@ -1,5 +1,15 @@
 # @atlasauth/backend changelog
 
+## 0.27.0 — 2026-10-28
+
+- SAML IdP (service providers, artifacts, attribute queries), WS-Federation, outbound provisioning connectors, SCIM custom resources and cloud access targets
+- OpenID provider: per-client signing/encryption, op key rotation, token-exchange profiles, refresh-token search and bulk revoke, federation resolve, verifiable-credential deferred issuance and presentation requests; `requireAcr`/`maxAge` step-up on access-token verification and `verifyTransactionToken`
+- Conditional access depth: report-only and impact replay, device assurance policies and pull integrations, risky users, containment, temporary access passes, email risk, authenticator policies
+- Workflows, chat integrations (Slack/Teams approvals), eligible access and activation, staged and recurring reviews, bundles, administrative units, organization application access and B2B connections
+- MCP gateway v2 (upstreams, packs, pins, user auth), connection actions and triggers, agent lifecycle and reviews, telemetry export
+- Authorization: tuple expiry, decision points, Cedar JSON and token authorization, FGA assertions/materializations/bulk import, customer-managed keys, coupons, credits, user merge, audit retention
+- Device-bound SSO registrations; SMTP2GO email transport
+
 ## 0.26.0 — 2026-10-27
 
 ### Added

package/dist/client/abac.d.ts

@@ -64,6 +64,11 @@ export interface AbacDecision {
     decision: 'allow' | 'deny';
     reasons: string[];
     errors: string[];
+    /** `@annotations` of the policies that decided it, when any carry them. */
+    annotations?: Array<{
+        policy: string;
+        annotations: Record<string, string>;
+    }>;
 }
 export interface AbacCoverageClause {
     kind: 'when' | 'unless';
@@ -410,6 +415,51 @@ export declare function abacResource(request: RequestFn): {
         source?: string;
         tests?: AbacPolicyTestCase[];
     }): Promise<AbacTestRun>;
+    /** Cedar JSON policy format: export policy text, import JSON (optionally creating the policy with `name`). */
+    cedar: {
+        export(source: string): Promise<{
+            object: "cedar_json_policies";
+            policies: Array<Record<string, unknown>>;
+        }>;
+        import(body: {
+            policies: Array<Record<string, unknown>>;
+            name?: string;
+            fga_store_id?: string | null;
+        }): Promise<{
+            object: "cedar_source";
+            source: string;
+            policies: number;
+        } | AbacPolicy>;
+        forPolicy(id: string): Promise<{
+            object: "cedar_json_policies";
+            policies: Array<Record<string, unknown>>;
+        }>;
+    };
+    /** How access-token claims become a policy principal and its parents (used by {@link authorizeToken}). */
+    tokenMapping: {
+        get(): Promise<AbacTokenMapping>;
+        put(body: Partial<Omit<AbacTokenMapping, "object">>): Promise<AbacTokenMapping>;
+    };
+    /** Decide for the principal an access token stands for (verified first; an invalid token is a 401). */
+    authorizeToken(body: {
+        access_token: string;
+        action: string;
+        resource: {
+            type: string;
+            id: string;
+            attributes?: Record<string, unknown>;
+        };
+        context?: Record<string, unknown>;
+        entities?: AbacEntity[];
+        policy_ids?: string[];
+    }): Promise<AbacDecision & {
+        principal: {
+            type: string;
+            id: string;
+            parents: string[];
+        };
+        issuer: "atlas" | "trusted";
+    }>;
     /** May `principal` perform `action` on `resource`? */
     evaluate(body: AbacEvaluateBody): Promise<AbacDecision>;
     /**
@@ -519,3 +569,18 @@ export declare function abacResource(request: RequestFn): {
     }>;
 };
 export { FilterCompileError, evalFilter, filterToDrizzle, filterToPrisma, filterToSql, type DrizzleOps, type DrizzleOptions, type Filter, type FilterRows, type PrismaOptions, type SqlColumn, type SqlDialect, type SqlFragment, type SqlOptions, } from '@atlasauth/authz';
+export interface AbacTokenMapping {
+    object: 'abac_token_mapping';
+    principal_type: string;
+    id_claim: string;
+    parents: Array<{
+        claim: string;
+        type: string;
+    }>;
+    attribute_claims: string[];
+    trusted_issuers: Array<{
+        issuer: string;
+        jwks_uri: string;
+        audience?: string;
+    }>;
+}

package/dist/client/abac.js

@@ -28,6 +28,31 @@ function abacResource(request) {
         test(id, body = {}) {
             return request({ method: 'POST', path: `/v1/abac_policies/${(0, request_1.enc)(id)}/test`, body });
         },
+        /** Cedar JSON policy format: export policy text, import JSON (optionally creating the policy with `name`). */
+        cedar: {
+            export(source) {
+                return request({ method: 'POST', path: '/v1/abac/cedar/export', body: { source } });
+            },
+            import(body) {
+                return request({ method: 'POST', path: '/v1/abac/cedar/import', body });
+            },
+            forPolicy(id) {
+                return request({ method: 'GET', path: `/v1/abac_policies/${(0, request_1.enc)(id)}/cedar_json` });
+            },
+        },
+        /** How access-token claims become a policy principal and its parents (used by {@link authorizeToken}). */
+        tokenMapping: {
+            get() {
+                return request({ method: 'GET', path: '/v1/abac/token_mapping' });
+            },
+            put(body) {
+                return request({ method: 'PUT', path: '/v1/abac/token_mapping', body });
+            },
+        },
+        /** Decide for the principal an access token stands for (verified first; an invalid token is a 401). */
+        authorizeToken(body) {
+            return request({ method: 'POST', path: '/v1/abac/authorize_token', body });
+        },
         /** May `principal` perform `action` on `resource`? */
         evaluate(body) {
             return request({ method: 'POST', path: '/v1/abac/evaluate', body });

package/dist/client/abac.js.map

@@ -1 +1 @@
-{"version":3,"file":"abac.js","sourceRoot":"","sources":["../../src/client/abac.ts"],"names":[],"mappings":";;;AA2UA,oCAqIC;AAhdD,uCAAgD;AA0UhD,qFAAqF;AACrF,SAAgB,YAAY,CAAC,OAAkB;IAC7C,OAAO;QACL,IAAI;YACF,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,mBAAmB,EAAE,CAAC,CAAC;QAC/D,CAAC;QACD,GAAG,CAAC,EAAU;YACZ,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,qBAAqB,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;QAC1E,CAAC;QACD,MAAM,CAAC,IAA0B,EAAE,cAAuB;YACxD,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,mBAAmB,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC;QACtF,CAAC;QACD,MAAM,CAAC,EAAU,EAAE,IAA0B;YAC3C,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,qBAAqB,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;QAClF,CAAC;QACD,MAAM,CAAC,EAAU;YACf,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,qBAAqB,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;QAC7E,CAAC;QACD,QAAQ,CAAC,EAAU;YACjB,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,qBAAqB,IAAA,aAAG,EAAC,EAAE,CAAC,WAAW,EAAE,CAAC,CAAC;QACnF,CAAC;QACD,iGAAiG;QACjG,IAAI,CAAC,EAAU,EAAE,OAA4E,EAAE;YAC7F,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,qBAAqB,IAAA,aAAG,EAAC,EAAE,CAAC,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;QACtF,CAAC;QACD,sDAAsD;QACtD,QAAQ,CAAC,IAAsB;YAC7B,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,mBAAmB,EAAE,IAAI,EAAE,CAAC,CAAC;QACtE,CAAC;QACD;;;WAGG;QACH,eAAe,CAAC,IAAqB;YACnC,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,2BAA2B,EAAE,IAAI,EAAE,CAAC,CAAC;QAC9E,CAAC;QACD,wFAAwF;QACxF,mBAAmB,CAAC,IAAwB;YAC1C,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,+BAA+B,EAAE,IAAI,EAAE,CAAC,CAAC;QAClF,CAAC;QACD,2GAA2G;QAC3G,SAAS,EAAE;YACT,IAAI;gBACF,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,oBAAoB,EAAE,CAAC,CAAC;YAChE,CAAC;YACD,GAAG,CAAC,EAAU;gBACZ,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,sBAAsB,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;YAC3E,CAAC;YACD,MAAM,CAAC,IAA4B,EAAE,cAAuB;gBAC1D,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,oBAAoB,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC;YACvF,CAAC;YACD,gIAAgI;YAChI,MAAM,CAAC,EAAU,EAAE,IAAqC;gBACtD,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,sBAAsB,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;YACnF,CAAC;YACD,qFAAqF;YACrF,MAAM,CAAC,EAAU,EAAE,OAA4B,EAAE;gBAC/C,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,sBAAsB,IAAA,aAAG,EAAC,EAAE,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;YAChH,CAAC;SACF;QACD,mHAAmH;QACnH,KAAK,EAAE;YACL,IAAI,CAAC,QAAkC,EAAE;gBACvC,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,wBAAwB,KAAK,CAAC,WAAW,CAAC,CAAC,CAAC,gBAAgB,IAAA,aAAG,EAAC,KAAK,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;YACvI,CAAC;YACD,GAAG,CAAC,EAAU;gBACZ,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,yBAAyB,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;YAC9E,CAAC;YACD,MAAM,CAAC,IAAwB,EAAE,cAAuB;gBACtD,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,uBAAuB,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC;YAC1F,CAAC;YACD,MAAM,CAAC,EAAU,EAAE,IAAsD;gBACvE,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,yBAAyB,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;YACtF,CAAC;YACD,MAAM,CAAC,EAAU;gBACf,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,yBAAyB,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;YACjF,CAAC;SACF;QACD,uFAAuF;QACvF,MAAM,EAAE;YACN,GAAG;gBACD,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,iBAAiB,EAAE,CAAC,CAAC;YAC7D,CAAC;YACD,2GAA2G;YAC3G,GAAG,CAAC,MAA0B;gBAC5B,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,iBAAiB,EAAE,IAAI,EAAE,EAAE,MAAM,EAAE,EAAE,CAAC,CAAC;YAC/E,CAAC;YACD,MAAM;gBACJ,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,iBAAiB,EAAE,CAAC,CAAC;YAChE,CAAC;YACD,8FAA8F;YAC9F,QAAQ,CAAC,IAAyE;gBAChF,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,0BAA0B,EAAE,IAAI,EAAE,CAAC,CAAC;YAC7E,CAAC;SACF;QACD,2FAA2F;QAC3F,IAAI,CAAC,EAAU,EAAE,OAAwB,EAAE;YACzC,MAAM,EAAE,GAAG,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC;iBAC5B,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,SAAS,CAAC;iBAClC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,kBAAkB,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;iBACxD,IAAI,CAAC,GAAG,CAAC,CAAC;YACb,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,qBAAqB,IAAA,aAAG,EAAC,EAAE,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;QACpG,CAAC;QACD,oEAAoE;QACpE,WAAW,CAAC,IAAwG;YAClH,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,eAAe,EAAE,IAAI,EAAE,CAAC,CAAC;QAClE,CAAC;QACD,sGAAsG;QACtG,oBAAoB,CAAC,IAA0B;YAC7C,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,sCAAsC,EAAE,IAAI,EAAE,CAAC,CAAC;QACzF,CAAC;QACD,kGAAkG;QAClG,qBAAqB,CAAC,IAA0B;YAC9C,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,uCAAuC,EAAE,IAAI,EAAE,CAAC,CAAC;QAC1F,CAAC;QACD,sFAAsF;QACtF,mBAAmB,CAAC,IAA0B;YAC5C,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,qCAAqC,EAAE,IAAI,EAAE,CAAC,CAAC;QACxF,CAAC;QACD,2DAA2D;QAC3D,KAAK,CAAC,SAAS,CAAC,IAAsB;YACpC,OAAO,CAAC,MAAM,OAAO,CAAe,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,mBAAmB,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,OAAO,CAAC;QACjH,CAAC;QACD,qCAAqC;QACrC,iBAAiB,CAAC,IAAuB;YACvC,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,kCAAkC,EAAE,IAAI,EAAE,CAAC,CAAC;QACrF,CAAC;QACD,8CAA8C;QAC9C,kBAAkB,CAChB,IAAqK;YAErK,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,mCAAmC,EAAE,IAAI,EAAE,CAAC,CAAC;QACtF,CAAC;KACF,CAAC;AACJ,CAAC;AAED,sGAAsG;AACtG,0CAe0B;AAdxB,2GAAA,kBAAkB,OAAA;AAClB,mGAAA,UAAU,OAAA;AACV,wGAAA,eAAe,OAAA;AACf,uGAAA,cAAc,OAAA;AACd,oGAAA,WAAW,OAAA"}
+{"version":3,"file":"abac.js","sourceRoot":"","sources":["../../src/client/abac.ts"],"names":[],"mappings":";;;AA6UA,oCA8JC;AA3eD,uCAAgD;AA4UhD,qFAAqF;AACrF,SAAgB,YAAY,CAAC,OAAkB;IAC7C,OAAO;QACL,IAAI;YACF,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,mBAAmB,EAAE,CAAC,CAAC;QAC/D,CAAC;QACD,GAAG,CAAC,EAAU;YACZ,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,qBAAqB,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;QAC1E,CAAC;QACD,MAAM,CAAC,IAA0B,EAAE,cAAuB;YACxD,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,mBAAmB,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC;QACtF,CAAC;QACD,MAAM,CAAC,EAAU,EAAE,IAA0B;YAC3C,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,qBAAqB,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;QAClF,CAAC;QACD,MAAM,CAAC,EAAU;YACf,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,qBAAqB,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;QAC7E,CAAC;QACD,QAAQ,CAAC,EAAU;YACjB,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,qBAAqB,IAAA,aAAG,EAAC,EAAE,CAAC,WAAW,EAAE,CAAC,CAAC;QACnF,CAAC;QACD,iGAAiG;QACjG,IAAI,CAAC,EAAU,EAAE,OAA4E,EAAE;YAC7F,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,qBAAqB,IAAA,aAAG,EAAC,EAAE,CAAC,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;QACtF,CAAC;QACD,8GAA8G;QAC9G,KAAK,EAAE;YACL,MAAM,CAAC,MAAc;gBACnB,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,uBAAuB,EAAE,IAAI,EAAE,EAAE,MAAM,EAAE,EAAE,CAAC,CAAC;YACtF,CAAC;YACD,MAAM,CAAC,IAA+F;gBACpG,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,uBAAuB,EAAE,IAAI,EAAE,CAAC,CAAC;YAC1E,CAAC;YACD,SAAS,CAAC,EAAU;gBAClB,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,qBAAqB,IAAA,aAAG,EAAC,EAAE,CAAC,aAAa,EAAE,CAAC,CAAC;YACrF,CAAC;SACF;QACD,0GAA0G;QAC1G,YAAY,EAAE;YACZ,GAAG;gBACD,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,wBAAwB,EAAE,CAAC,CAAC;YACpE,CAAC;YACD,GAAG,CAAC,IAA+C;gBACjD,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,wBAAwB,EAAE,IAAI,EAAE,CAAC,CAAC;YAC1E,CAAC;SACF;QACD,uGAAuG;QACvG,cAAc,CAAC,IAA+M;YAC5N,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,0BAA0B,EAAE,IAAI,EAAE,CAAC,CAAC;QAC7E,CAAC;QACD,sDAAsD;QACtD,QAAQ,CAAC,IAAsB;YAC7B,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,mBAAmB,EAAE,IAAI,EAAE,CAAC,CAAC;QACtE,CAAC;QACD;;;WAGG;QACH,eAAe,CAAC,IAAqB;YACnC,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,2BAA2B,EAAE,IAAI,EAAE,CAAC,CAAC;QAC9E,CAAC;QACD,wFAAwF;QACxF,mBAAmB,CAAC,IAAwB;YAC1C,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,+BAA+B,EAAE,IAAI,EAAE,CAAC,CAAC;QAClF,CAAC;QACD,2GAA2G;QAC3G,SAAS,EAAE;YACT,IAAI;gBACF,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,oBAAoB,EAAE,CAAC,CAAC;YAChE,CAAC;YACD,GAAG,CAAC,EAAU;gBACZ,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,sBAAsB,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;YAC3E,CAAC;YACD,MAAM,CAAC,IAA4B,EAAE,cAAuB;gBAC1D,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,oBAAoB,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC;YACvF,CAAC;YACD,gIAAgI;YAChI,MAAM,CAAC,EAAU,EAAE,IAAqC;gBACtD,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,sBAAsB,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;YACnF,CAAC;YACD,qFAAqF;YACrF,MAAM,CAAC,EAAU,EAAE,OAA4B,EAAE;gBAC/C,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,sBAAsB,IAAA,aAAG,EAAC,EAAE,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;YAChH,CAAC;SACF;QACD,mHAAmH;QACnH,KAAK,EAAE;YACL,IAAI,CAAC,QAAkC,EAAE;gBACvC,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,wBAAwB,KAAK,CAAC,WAAW,CAAC,CAAC,CAAC,gBAAgB,IAAA,aAAG,EAAC,KAAK,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;YACvI,CAAC;YACD,GAAG,CAAC,EAAU;gBACZ,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,yBAAyB,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;YAC9E,CAAC;YACD,MAAM,CAAC,IAAwB,EAAE,cAAuB;gBACtD,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,uBAAuB,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC;YAC1F,CAAC;YACD,MAAM,CAAC,EAAU,EAAE,IAAsD;gBACvE,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,yBAAyB,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;YACtF,CAAC;YACD,MAAM,CAAC,EAAU;gBACf,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,yBAAyB,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;YACjF,CAAC;SACF;QACD,uFAAuF;QACvF,MAAM,EAAE;YACN,GAAG;gBACD,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,iBAAiB,EAAE,CAAC,CAAC;YAC7D,CAAC;YACD,2GAA2G;YAC3G,GAAG,CAAC,MAA0B;gBAC5B,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,iBAAiB,EAAE,IAAI,EAAE,EAAE,MAAM,EAAE,EAAE,CAAC,CAAC;YAC/E,CAAC;YACD,MAAM;gBACJ,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,iBAAiB,EAAE,CAAC,CAAC;YAChE,CAAC;YACD,8FAA8F;YAC9F,QAAQ,CAAC,IAAyE;gBAChF,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,0BAA0B,EAAE,IAAI,EAAE,CAAC,CAAC;YAC7E,CAAC;SACF;QACD,2FAA2F;QAC3F,IAAI,CAAC,EAAU,EAAE,OAAwB,EAAE;YACzC,MAAM,EAAE,GAAG,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC;iBAC5B,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,SAAS,CAAC;iBAClC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,kBAAkB,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;iBACxD,IAAI,CAAC,GAAG,CAAC,CAAC;YACb,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,qBAAqB,IAAA,aAAG,EAAC,EAAE,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;QACpG,CAAC;QACD,oEAAoE;QACpE,WAAW,CAAC,IAAwG;YAClH,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,eAAe,EAAE,IAAI,EAAE,CAAC,CAAC;QAClE,CAAC;QACD,sGAAsG;QACtG,oBAAoB,CAAC,IAA0B;YAC7C,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,sCAAsC,EAAE,IAAI,EAAE,CAAC,CAAC;QACzF,CAAC;QACD,kGAAkG;QAClG,qBAAqB,CAAC,IAA0B;YAC9C,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,uCAAuC,EAAE,IAAI,EAAE,CAAC,CAAC;QAC1F,CAAC;QACD,sFAAsF;QACtF,mBAAmB,CAAC,IAA0B;YAC5C,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,qCAAqC,EAAE,IAAI,EAAE,CAAC,CAAC;QACxF,CAAC;QACD,2DAA2D;QAC3D,KAAK,CAAC,SAAS,CAAC,IAAsB;YACpC,OAAO,CAAC,MAAM,OAAO,CAAe,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,mBAAmB,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,OAAO,CAAC;QACjH,CAAC;QACD,qCAAqC;QACrC,iBAAiB,CAAC,IAAuB;YACvC,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,kCAAkC,EAAE,IAAI,EAAE,CAAC,CAAC;QACrF,CAAC;QACD,8CAA8C;QAC9C,kBAAkB,CAChB,IAAqK;YAErK,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,mCAAmC,EAAE,IAAI,EAAE,CAAC,CAAC;QACtF,CAAC;KACF,CAAC;AACJ,CAAC;AAED,sGAAsG;AACtG,0CAe0B;AAdxB,2GAAA,kBAAkB,OAAA;AAClB,mGAAA,UAAU,OAAA;AACV,wGAAA,eAAe,OAAA;AACf,uGAAA,cAAc,OAAA;AACd,oGAAA,WAAW,OAAA"}

package/dist/client/access-policies.d.ts

@@ -1,11 +1,18 @@
 import { type RequestFn } from './request';
 import type { ListPage } from './types';
 export type AccessPolicyStage = 'sign_in' | 'authorize' | 'token';
-export type AccessPolicyGrantType = 'allow' | 'block' | 'require_mfa' | 'require_acr' | 'require_policy_acceptance' | 'require_action';
+export type AccessPolicyGrantType = 'allow' | 'block' | 'require_mfa' | 'require_acr' | 'require_policy_acceptance' | 'require_action' | 'require_auth_strength' | 'require_device_bound_session' | 'require_password_change' | 'sign_in_frequency' | 'persistent_session' | 'max_session_age';
+export type AccessPolicyMode = 'enforce' | 'report_only';
+export type AccessPolicyTarget = 'user' | 'machine' | 'agent';
+export type AccessClientType = 'browser' | 'native' | 'legacy' | 'device_code' | 'ciba' | 'machine' | 'agent';
 export interface AccessPolicyGrant {
     type: AccessPolicyGrantType;
-    /** require_acr: the acr; require_policy_acceptance: the policy key; require_action: the action name. */
+    /** require_acr: the acr; require_policy_acceptance: the policy key; require_action: the action name; require_auth_strength: mfa | passwordless | phishing_resistant. */
     value?: string;
+    /** sign_in_frequency / max_session_age: the limit in seconds (60 to 31536000). */
+    seconds?: number;
+    /** persistent_session: false forbids a remembered session. */
+    allow?: boolean;
 }
 /** Every present condition must match; an absent one matches anything. */
 export interface AccessPolicyConditions {
@@ -28,6 +35,21 @@ export interface AccessPolicyConditions {
         end: string;
         timezone?: string;
     };
+    devicePlatforms?: string[];
+    osVersion?: {
+        min?: string;
+        max?: string;
+    };
+    clientTypes?: AccessClientType[];
+    userAttributes?: Array<{
+        key: string;
+        op: 'eq' | 'neq' | 'in' | 'not_in' | 'contains' | 'exists';
+        value?: unknown;
+    }>;
+    userRiskLevels?: Array<'low' | 'medium' | 'high'>;
+    signInRiskLevels?: Array<'low' | 'medium' | 'high'>;
+    /** Machine identity or agent ids (targets machine / agent). */
+    principalIds?: string[];
 }
 /** A conditional-access policy, evaluated at sign-in, /authorize and token issuance. */
 export interface AccessPolicy {
@@ -40,6 +62,9 @@ export interface AccessPolicy {
     stages: AccessPolicyStage[];
     conditions: AccessPolicyConditions;
     grants: AccessPolicyGrant[];
+    /** `report_only` never denies; it records `access_policy.would_block`. */
+    mode: AccessPolicyMode;
+    targets: AccessPolicyTarget[];
     created_at: number;
     updated_at: number;
 }
@@ -51,6 +76,8 @@ export interface CreateAccessPolicyBody {
     stages?: AccessPolicyStage[];
     conditions?: AccessPolicyConditions;
     grants: AccessPolicyGrant[];
+    mode?: AccessPolicyMode;
+    targets?: AccessPolicyTarget[];
 }
 export type UpdateAccessPolicyBody = Partial<CreateAccessPolicyBody>;
 export interface SimulateAccessBody {
@@ -70,6 +97,42 @@ export interface SimulateAccessBody {
     acr?: string[];
     /** Epoch ms; default now. */
     now?: number;
+    target_type?: AccessPolicyTarget;
+    principal_id?: string;
+    device_platform?: string;
+    os_version?: string;
+    client_type?: AccessClientType;
+    user_attributes?: Record<string, unknown>;
+    user_risk_level?: 'low' | 'medium' | 'high';
+    last_auth_age_seconds?: number;
+    session_age_seconds?: number;
+    device_bound_session?: boolean;
+}
+export interface AccessPolicyImpact {
+    object: 'access_policy_impact';
+    days: number;
+    evaluated: number;
+    would_allow: number;
+    would_step_up: number;
+    would_block: number;
+    distinct_users: number;
+    affected_users: number;
+    samples: Array<{
+        user_id: string | null;
+        stage: string;
+        outcome: string;
+        unmet: string[];
+        at: number;
+    }>;
+}
+export interface AccessPolicyInsights {
+    object: 'access_policy_insights';
+    days: number;
+    evaluated: number;
+    would_block: number;
+    would_step_up: number;
+    by_policy: Record<string, number>;
+    by_day: Record<string, number>;
 }
 export interface AccessPolicySimulation {
     object: 'access_policy_simulation';
@@ -81,8 +144,18 @@ export interface AccessPolicySimulation {
         acr: string[];
         policy_acceptance: string[];
         actions: string[];
+        auth_strength: 'mfa' | 'passwordless' | 'phishing_resistant' | null;
+        sign_in_frequency_seconds: number | null;
+        max_session_age_seconds: number | null;
+        persistent_session: boolean;
+        device_bound_session: boolean;
     };
     unmet: string[];
+    report_only: {
+        decision: 'allow' | 'block' | 'step_up';
+        matched: string[];
+        blocked_by: string | null;
+    } | null;
 }
 /** CRUD over conditional-access policies, plus a what-if `simulate`. */
 export declare function accessPoliciesResource(request: RequestFn): {
@@ -95,6 +168,15 @@ export declare function accessPoliciesResource(request: RequestFn): {
         id: string;
         deleted: true;
     }>;
+    /** Replay a draft policy against recent sampled sign-ins: how many would be allowed, stepped up or blocked. */
+    impact(body: {
+        draft: CreateAccessPolicyBody | Record<string, unknown>;
+        days?: number;
+    }): Promise<AccessPolicyImpact>;
+    /** How often report-only policies would have intervened. */
+    insights(query?: {
+        days?: number;
+    }): Promise<AccessPolicyInsights>;
     /** What would the policies decide for this request? */
     simulate(body: SimulateAccessBody): Promise<AccessPolicySimulation>;
 };

package/dist/client/access-policies.js

@@ -20,6 +20,14 @@ function accessPoliciesResource(request) {
         delete(id) {
             return request({ method: 'DELETE', path: `/v1/access_policies/${(0, request_1.enc)(id)}` });
         },
+        /** Replay a draft policy against recent sampled sign-ins: how many would be allowed, stepped up or blocked. */
+        impact(body) {
+            return request({ method: 'POST', path: '/v1/access_policies/impact', body });
+        },
+        /** How often report-only policies would have intervened. */
+        insights(query = {}) {
+            return request({ method: 'GET', path: `/v1/access_policies/insights${query.days ? `?days=${query.days}` : ''}` });
+        },
         /** What would the policies decide for this request? */
         simulate(body) {
             return request({ method: 'POST', path: '/v1/access_policies/simulate', body });

package/dist/client/access-policies.js.map

@@ -1 +1 @@
-{"version":3,"file":"access-policies.js","sourceRoot":"","sources":["../../src/client/access-policies.ts"],"names":[],"mappings":";;AAmFA,wDAsBC;AAzGD,uCAAgD;AAkFhD,wEAAwE;AACxE,SAAgB,sBAAsB,CAAC,OAAkB;IACvD,OAAO;QACL,IAAI;YACF,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,qBAAqB,EAAE,CAAC,CAAC;QACjE,CAAC;QACD,GAAG,CAAC,EAAU;YACZ,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,uBAAuB,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;QAC5E,CAAC;QACD,MAAM,CAAC,IAA4B,EAAE,cAAuB;YAC1D,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,qBAAqB,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC;QACxF,CAAC;QACD,MAAM,CAAC,EAAU,EAAE,IAA4B;YAC7C,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,uBAAuB,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;QACpF,CAAC;QACD,MAAM,CAAC,EAAU;YACf,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,uBAAuB,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;QAC/E,CAAC;QACD,uDAAuD;QACvD,QAAQ,CAAC,IAAwB;YAC/B,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,8BAA8B,EAAE,IAAI,EAAE,CAAC,CAAC;QACjF,CAAC;KACF,CAAC;AACJ,CAAC"}
+{"version":3,"file":"access-policies.js","sourceRoot":"","sources":["../../src/client/access-policies.ts"],"names":[],"mappings":";;AA8JA,wDA8BC;AA5LD,uCAAgD;AA6JhD,wEAAwE;AACxE,SAAgB,sBAAsB,CAAC,OAAkB;IACvD,OAAO;QACL,IAAI;YACF,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,qBAAqB,EAAE,CAAC,CAAC;QACjE,CAAC;QACD,GAAG,CAAC,EAAU;YACZ,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,uBAAuB,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;QAC5E,CAAC;QACD,MAAM,CAAC,IAA4B,EAAE,cAAuB;YAC1D,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,qBAAqB,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC;QACxF,CAAC;QACD,MAAM,CAAC,EAAU,EAAE,IAA4B;YAC7C,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,uBAAuB,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;QACpF,CAAC;QACD,MAAM,CAAC,EAAU;YACf,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,uBAAuB,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;QAC/E,CAAC;QACD,+GAA+G;QAC/G,MAAM,CAAC,IAAgF;YACrF,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,4BAA4B,EAAE,IAAI,EAAE,CAAC,CAAC;QAC/E,CAAC;QACD,4DAA4D;QAC5D,QAAQ,CAAC,QAA2B,EAAE;YACpC,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,+BAA+B,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;QACpH,CAAC;QACD,uDAAuD;QACvD,QAAQ,CAAC,IAAwB;YAC/B,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,8BAA8B,EAAE,IAAI,EAAE,CAAC,CAAC;QACjF,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/client/actions.d.ts

@@ -1,7 +1,7 @@
 import { type RequestFn } from './request';
 import type { ListPage } from './types';
 /** The fixed point in the auth pipeline an action runs at. */
-export type ActionTrigger = 'post_login' | 'pre_user_registration' | 'post_user_registration' | 'pre_organization_create' | 'pre_member_add' | 'pre_invitation_create' | 'pre_authentication' | 'pre_token' | 'post_token_exchange' | 'pre_user_update' | 'mfa_verification_attempt' | 'password_verification_attempt' | 'account_link_decision' | 'billing_plan_selected' | 'post_change_password' | 'post_password_reset' | 'post_user_update' | 'post_email_verified' | 'post_mfa_enroll' | 'post_mfa_remove' | 'post_logout' | 'org_membership_changed' | 'custom_challenge_create' | 'custom_challenge_verify' | 'workflow_step';
+export type ActionTrigger = 'post_login' | 'pre_user_registration' | 'post_user_registration' | 'pre_organization_create' | 'pre_member_add' | 'pre_invitation_create' | 'pre_authentication' | 'pre_token' | 'post_token_exchange' | 'custom_token_exchange' | 'pre_user_update' | 'mfa_verification_attempt' | 'password_verification_attempt' | 'account_link_decision' | 'billing_plan_selected' | 'post_change_password' | 'post_password_reset' | 'post_user_update' | 'post_email_verified' | 'post_mfa_enroll' | 'post_mfa_remove' | 'post_logout' | 'org_membership_changed' | 'custom_challenge_create' | 'custom_challenge_verify' | 'workflow_step';
 /**
  * Tenant code run in the hardened isolate at a trigger. Secret VALUES are
  * write-only and never returned — a read reports only `secret_names`. Timestamps

package/dist/client/actions.js.map

@@ -1 +1 @@
-{"version":3,"file":"actions.js","sourceRoot":"","sources":["../../src/client/actions.ts"],"names":[],"mappings":";;AA8MA,0CAyCC;AAvPD,uCAAgD;AA8MhD,SAAgB,eAAe,CAAC,OAAkB;IAChD,OAAO;QACL,IAAI;YACF,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,aAAa,EAAE,CAAC,CAAC;QACzD,CAAC;QACD,MAAM,CAAC,IAAsB,EAAE,cAAuB;YACpD,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,aAAa,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC;QAChF,CAAC;QACD,GAAG,CAAC,EAAU;YACZ,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,eAAe,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;QACpE,CAAC;QACD,MAAM,CAAC,EAAU,EAAE,IAAsB;YACvC,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,eAAe,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;QAC5E,CAAC;QACD,MAAM,CAAC,EAAU;YACf,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,eAAe,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;QACvE,CAAC;QACD,2EAA2E;QAC3E,IAAI,CAAC,EAAU,EAAE,QAAyB,EAAE;YAC1C,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,eAAe,IAAA,aAAG,EAAC,EAAE,CAAC,OAAO,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC;QAC3F,CAAC;QACD,0EAA0E;QAC1E,KAAK,CACH,EAAU,EACV,QAAqJ,EAAE;YAEvJ,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,eAAe,IAAA,aAAG,EAAC,EAAE,CAAC,QAAQ,EAAE,KAAK,EAAE,CAAC,CAAC;QACjF,CAAC;QACD,oDAAoD;QACpD,WAAW,CAAC,OAAsB;YAChC,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,wBAAwB,IAAA,aAAG,EAAC,OAAO,CAAC,EAAE,EAAE,CAAC,CAAC;QAClF,CAAC;QACD,+CAA+C;QAC/C,WAAW,CAAC,OAAsB,EAAE,SAAmB;YACrD,OAAO,OAAO,CAAC;gBACb,MAAM,EAAE,KAAK;gBACb,IAAI,EAAE,wBAAwB,IAAA,aAAG,EAAC,OAAO,CAAC,EAAE;gBAC5C,IAAI,EAAE,EAAE,UAAU,EAAE,SAAS,EAAE;aAChC,CAAC,CAAC;QACL,CAAC;KACF,CAAC;AACJ,CAAC"}
+{"version":3,"file":"actions.js","sourceRoot":"","sources":["../../src/client/actions.ts"],"names":[],"mappings":";;AA+MA,0CAyCC;AAxPD,uCAAgD;AA+MhD,SAAgB,eAAe,CAAC,OAAkB;IAChD,OAAO;QACL,IAAI;YACF,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,aAAa,EAAE,CAAC,CAAC;QACzD,CAAC;QACD,MAAM,CAAC,IAAsB,EAAE,cAAuB;YACpD,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,aAAa,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC;QAChF,CAAC;QACD,GAAG,CAAC,EAAU;YACZ,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,eAAe,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;QACpE,CAAC;QACD,MAAM,CAAC,EAAU,EAAE,IAAsB;YACvC,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,eAAe,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;QAC5E,CAAC;QACD,MAAM,CAAC,EAAU;YACf,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,eAAe,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;QACvE,CAAC;QACD,2EAA2E;QAC3E,IAAI,CAAC,EAAU,EAAE,QAAyB,EAAE;YAC1C,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,eAAe,IAAA,aAAG,EAAC,EAAE,CAAC,OAAO,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC;QAC3F,CAAC;QACD,0EAA0E;QAC1E,KAAK,CACH,EAAU,EACV,QAAqJ,EAAE;YAEvJ,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,eAAe,IAAA,aAAG,EAAC,EAAE,CAAC,QAAQ,EAAE,KAAK,EAAE,CAAC,CAAC;QACjF,CAAC;QACD,oDAAoD;QACpD,WAAW,CAAC,OAAsB;YAChC,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,wBAAwB,IAAA,aAAG,EAAC,OAAO,CAAC,EAAE,EAAE,CAAC,CAAC;QAClF,CAAC;QACD,+CAA+C;QAC/C,WAAW,CAAC,OAAsB,EAAE,SAAmB;YACrD,OAAO,OAAO,CAAC;gBACb,MAAM,EAAE,KAAK;gBACb,IAAI,EAAE,wBAAwB,IAAA,aAAG,EAAC,OAAO,CAAC,EAAE;gBAC5C,IAAI,EAAE,EAAE,UAAU,EAAE,SAAS,EAAE;aAChC,CAAC,CAAC;QACL,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/client/agent-platform.d.ts

@@ -0,0 +1,294 @@
+import { type RequestFn } from './request';
+import type { ListPage } from './types';
+/** An action over a connection: a typed provider operation. */
+export interface ConnectionAction {
+    object: 'connection_action';
+    provider: string;
+    name: string;
+    description: string;
+    input_schema: Record<string, unknown>;
+    method: string;
+    mutating: boolean;
+    scopes: string[];
+    source: 'first_party' | 'custom';
+}
+export interface ConnectionActionResult {
+    object: 'connection_action_result';
+    action: string;
+    connection_id: string;
+    ok: boolean;
+    status: number | null;
+    data: unknown;
+    error: string | null;
+    truncated: boolean;
+    attempts: number;
+    dry_run?: Record<string, unknown>;
+}
+/** A custom action definition: data only (input schema, request template, response mapping). */
+export interface ConnectionActionDefinition {
+    description: string;
+    input?: Record<string, unknown>;
+    request: {
+        method: 'GET' | 'POST' | 'PUT' | 'PATCH' | 'DELETE';
+        base_url: string;
+        path: string;
+        query?: Record<string, string>;
+        body?: unknown;
+        headers?: Record<string, string>;
+    };
+    response?: {
+        path?: string;
+        ok_field?: string;
+        error_field?: string;
+    };
+    scopes?: string[];
+    paginate?: Record<string, unknown>;
+    mutating?: boolean;
+}
+export interface ConnectionTrigger {
+    object: 'connection_trigger';
+    id: string;
+    connection_id: string;
+    event: string;
+    mode: 'webhook' | 'poll';
+    filter: Record<string, string>;
+    target_url: string | null;
+    status: 'active' | 'paused' | 'failed';
+    provider_registered: boolean;
+    ingress_url: string | null;
+    poll: Record<string, unknown> | null;
+    next_poll_at: number | null;
+    last_error: string | null;
+    last_fired_at: number | null;
+    fired_count: number;
+    /** Shown once on creation of a webhook trigger. */
+    forward_secret?: string;
+    created_at: number;
+}
+export interface CreateConnectionTriggerBody {
+    event: string;
+    mode?: 'webhook' | 'poll';
+    filter?: Record<string, string>;
+    target_url?: string;
+    scheme?: string;
+    signing_secret?: string;
+    options?: Record<string, string>;
+    poll?: {
+        action: string;
+        input?: Record<string, unknown>;
+        items_path?: string;
+        id_field: string;
+        interval_seconds?: number;
+    };
+}
+/** Typed actions over connections, provider event triggers, scoped relay tokens and usage records. */
+export declare function connectionActionsResource(request: RequestFn): {
+    catalog: {
+        list(query?: {
+            provider?: string;
+        }): Promise<ListPage<ConnectionAction>>;
+        get(provider: string, name: string): Promise<ConnectionAction>;
+        /** Define or replace a custom action (data, never code). */
+        define(provider: string, name: string, body: ConnectionActionDefinition): Promise<ConnectionAction>;
+        delete(provider: string, name: string): Promise<void>;
+    };
+    /** The actions available on one connection. */
+    list(connectionId: string): Promise<ListPage<ConnectionAction>>;
+    run(connectionId: string, name: string, body?: {
+        input?: Record<string, unknown>;
+        dry_run?: boolean;
+        all_pages?: boolean;
+        redirect_url?: string;
+        connect_user_id?: string;
+    }): Promise<ConnectionActionResult>;
+    triggers: {
+        list(connectionId: string): Promise<ListPage<ConnectionTrigger>>;
+        create(connectionId: string, body: CreateConnectionTriggerBody): Promise<ConnectionTrigger>;
+        get(connectionId: string, triggerId: string): Promise<ConnectionTrigger>;
+        setStatus(connectionId: string, triggerId: string, status: "active" | "paused"): Promise<ConnectionTrigger>;
+        delete(connectionId: string, triggerId: string): Promise<{
+            object: "connection_trigger";
+            id: string;
+            deleted: true;
+            provider_unregistered: boolean | null;
+        }>;
+    };
+    /** A signed credential for one connection that only works through the relay, for listed methods and URL prefixes. */
+    mintScopedToken(connectionId: string, body: {
+        url_prefixes: string[];
+        methods?: string[];
+        ttl_seconds?: number;
+    }): Promise<{
+        object: "connection_scoped_token";
+        connection_id: string;
+        token: string;
+        expires_at: number;
+        methods: string[];
+        url_prefixes: string[];
+    }>;
+    /** Calls through connections, agent connection use and gateway calls, counted from the audit trail. */
+    usage(query?: {
+        from?: string | number;
+        to?: string | number;
+        group_by?: "action" | "day" | "agent" | "connection";
+    }): Promise<{
+        object: "list";
+        from: number;
+        to: number;
+        group_by: string;
+        data: Array<{
+            object: "connection_usage";
+            key: string | null;
+            calls: number;
+        }>;
+    }>;
+};
+export interface AgentLifecycle {
+    object: 'agent_lifecycle';
+    agent_id: string;
+    sponsor_user_id: string | null;
+    backup_sponsor_user_id: string | null;
+    expires_at: number | null;
+    renewed_at: number | null;
+    renewal_count: number;
+}
+export interface AgentAccessReview {
+    object: 'agent_access_review';
+    id: string;
+    name: string;
+    status: 'open' | 'closed';
+    due_at: number | null;
+    created_at: number;
+    closed_at: number | null;
+    item_count?: number;
+}
+export interface AgentAccessReviewItem {
+    object: 'agent_access_review_item';
+    id: string;
+    review_id: string;
+    agent_id: string;
+    kind: string;
+    resource: string;
+    reviewer_user_id: string | null;
+    decision: 'pending' | 'certified' | 'revoked';
+    decided_by: string | null;
+    decided_at: number | null;
+    comment: string | null;
+    revoked_applied: boolean;
+}
+/** Agent governance: sponsors, expiry and renewal, the activity log, and access reviews of agents' grants. */
+export declare function agentGovernanceResource(request: RequestFn): {
+    lifecycle: {
+        get(agentId: string): Promise<AgentLifecycle>;
+        set(agentId: string, body: {
+            sponsor_user_id?: string | null;
+            backup_sponsor_user_id?: string | null;
+            expires_at?: number | string | null;
+        }): Promise<AgentLifecycle>;
+        renew(agentId: string, extendDays: number): Promise<AgentLifecycle>;
+    };
+    activity(agentId: string, query?: {
+        since?: string | number;
+        before?: string | number;
+        limit?: number;
+    }): Promise<ListPage<{
+        object: "agent_activity";
+        id: string;
+        action: string;
+        target_type: string | null;
+        target_id: string | null;
+        metadata: Record<string, unknown>;
+        at: number;
+    }>>;
+    reviews: {
+        list(): Promise<ListPage<AgentAccessReview>>;
+        start(body: {
+            name: string;
+            due_at?: number | string | null;
+            tier?: "trusted" | "untrusted";
+            kind?: "tool" | "connection";
+        }): Promise<AgentAccessReview>;
+        get(id: string, query?: {
+            decision?: "pending" | "certified" | "revoked";
+            reviewer_user_id?: string;
+        }): Promise<AgentAccessReview & {
+            items: AgentAccessReviewItem[];
+        }>;
+        decide(id: string, itemId: string, body: {
+            decision: "certified" | "revoked";
+            comment?: string;
+            decided_by?: string;
+        }): Promise<AgentAccessReviewItem>;
+        close(id: string): Promise<AgentAccessReview>;
+    };
+};
+export interface McpRegistryEntry {
+    object: 'mcp_registry_entry';
+    id: string;
+    name: string;
+    url: string;
+    description: string | null;
+    status: 'pending' | 'approved' | 'rejected';
+    requested_by: string | null;
+    decided_by: string | null;
+    decided_at: number | null;
+    created_at: number;
+}
+/** The registry of approved upstream MCP servers, and write elevations for the admin MCP server. */
+export declare function mcpRegistryResource(request: RequestFn): {
+    list(query?: {
+        status?: "pending" | "approved" | "rejected";
+    }): Promise<ListPage<McpRegistryEntry>>;
+    add(body: {
+        name: string;
+        url: string;
+        description?: string;
+        status?: "approved" | "pending";
+    }): Promise<McpRegistryEntry>;
+    decide(id: string, status: "approved" | "rejected"): Promise<McpRegistryEntry>;
+    remove(id: string): Promise<{
+        object: "mcp_registry_entry";
+        id: string;
+        deleted: true;
+    }>;
+    /** Grant another API key a short write elevation over the admin MCP server. */
+    elevate(body: {
+        api_key_id: string;
+        ttl_seconds?: number;
+        reason?: string;
+    }): Promise<{
+        object: "mcp_elevation";
+        api_key_id: string;
+        token: string;
+        expires_at: number;
+        header: string;
+    }>;
+};
+export interface TelemetryExport {
+    object: 'telemetry_export';
+    enabled: boolean;
+    endpoint: string | null;
+    /** Headers are write-only. */
+    has_headers: boolean;
+    service_name: string;
+    traces: boolean;
+    metrics: boolean;
+}
+/** OTLP/HTTP export of gateway and relay calls (spans and metrics) to your collector. */
+export declare function telemetryExportResource(request: RequestFn): {
+    get(): Promise<TelemetryExport>;
+    update(body: {
+        enabled?: boolean;
+        endpoint?: string;
+        headers?: Record<string, string> | null;
+        service_name?: string;
+        traces?: boolean;
+        metrics?: boolean;
+    }): Promise<TelemetryExport>;
+    /** Send one test span now. */
+    test(): Promise<{
+        object: "telemetry_export_test";
+        ok: boolean;
+        error: string | null;
+    }>;
+};