@atlasauth/backend 0.26.0 → 0.27.0

package/dist/client/saml-idp.d.ts

@@ -0,0 +1,183 @@
+import { type RequestFn } from './request';
+export type SamlNameIdFormat = 'emailAddress' | 'persistent' | 'transient' | 'unspecified';
+/** A SAML service provider Atlas issues assertions to, with its depth settings. */
+export interface SamlIdpServiceProvider {
+    object: 'saml_idp_service_provider';
+    id: string;
+    name: string;
+    entity_id: string;
+    acs_url: string;
+    acs_urls: string[];
+    name_id_format: SamlNameIdFormat;
+    name_id_field: 'email' | 'user_id';
+    attributes: Record<string, string>;
+    encrypt_assertions: boolean;
+    has_encryption_cert: boolean;
+    signing_cert_count: number;
+    require_signed_requests: boolean;
+    signature_algorithm: 'rsa-sha256' | 'rsa-sha384' | 'rsa-sha512';
+    digest_algorithm: 'sha256' | 'sha384' | 'sha512';
+    sign_response: boolean;
+    artifact_binding: boolean;
+    ecp: boolean;
+    attribute_query: boolean;
+    slo_url: string | null;
+    slo_binding: 'redirect' | 'post' | 'soap' | null;
+    authn_context_class_ref: string | null;
+    assertion_lifetime_seconds: number;
+}
+/** Any of these; `null` clears an optional setting. */
+export interface UpdateSamlIdpServiceProviderBody {
+    name?: string;
+    acs_urls?: string[];
+    name_id_format?: SamlNameIdFormat;
+    name_id_field?: 'email' | 'user_id';
+    attributes?: Record<string, string>;
+    encrypt_assertions?: boolean;
+    encryption_cert?: string | null;
+    signing_certs?: string[];
+    require_signed_requests?: boolean;
+    signature_algorithm?: 'rsa-sha256' | 'rsa-sha384' | 'rsa-sha512';
+    digest_algorithm?: 'sha256' | 'sha384' | 'sha512';
+    sign_response?: boolean;
+    artifact_binding?: boolean;
+    ecp?: boolean;
+    attribute_query?: boolean;
+    slo_url?: string | null;
+    slo_binding?: 'redirect' | 'post' | 'soap';
+    authn_context_class_ref?: string | null;
+    assertion_lifetime_seconds?: number | null;
+}
+export interface SamlIdpSpMetadata {
+    object: 'saml_idp_sp_metadata';
+    saved: boolean;
+    entity_id: string;
+    acs_url: string;
+    acs_urls: string[];
+    name_id_format: SamlNameIdFormat;
+    signing_certs: string[];
+    encryption_cert: string | null;
+    slo_url: string | null;
+    slo_binding: string | null;
+    authn_requests_signed: boolean;
+    want_assertions_signed: boolean;
+    requested_attributes: string[];
+    service_provider?: SamlIdpServiceProvider | null;
+}
+/** Atlas as a SAML identity provider: service-provider settings and metadata import. */
+export declare function samlIdpResource(request: RequestFn): {
+    /** `GET /v1/saml_idp/service_providers` */
+    list(): Promise<{
+        object: "list";
+        data: SamlIdpServiceProvider[];
+    }>;
+    /** `GET /v1/saml_idp/service_providers/:id` */
+    get(id: string): Promise<SamlIdpServiceProvider>;
+    /** `PATCH /v1/saml_idp/service_providers/:id` — NameID format, encryption, request signing, algorithms, logout. */
+    update(id: string, body: UpdateSamlIdpServiceProviderBody): Promise<SamlIdpServiceProvider>;
+    /** `POST /v1/saml_idp/service_providers/import_metadata` — preview, or save with `save_as`. */
+    importMetadata(body: {
+        metadata_xml?: string;
+        metadata_url?: string;
+        mdq_base_url?: string;
+        entity_id?: string;
+        federation_certificate?: string;
+        save_as?: string;
+        name?: string;
+    }): Promise<SamlIdpSpMetadata>;
+};
+export type CloudProvider = 'aws' | 'gcp' | 'azure';
+/** A cloud access target: an AWS account and role, a Google Cloud workforce pool, or an Azure trust. */
+export interface CloudAccessTarget {
+    object: 'cloud_access_target';
+    id: string;
+    provider: CloudProvider;
+    name: string;
+    config: Record<string, unknown>;
+    assignment: Record<string, unknown> | null;
+    launch_url: string | null;
+    created_at: number;
+    updated_at: number;
+}
+export interface CloudAccessSetup {
+    object: 'cloud_access_setup';
+    target_id: string;
+    provider: CloudProvider;
+    steps: string[];
+    snippets: Record<string, string>;
+    sources: string[];
+}
+/** Cloud access portal: account and role tiles for the launcher. */
+export declare function cloudAccessResource(request: RequestFn): {
+    list(provider?: CloudProvider): Promise<{
+        object: "list";
+        data: CloudAccessTarget[];
+    }>;
+    get(id: string): Promise<CloudAccessTarget>;
+    create(body: {
+        provider: CloudProvider;
+        name: string;
+        config: Record<string, unknown>;
+        assignment?: Record<string, unknown>;
+    }): Promise<CloudAccessTarget>;
+    update(id: string, body: {
+        name?: string;
+        config?: Record<string, unknown>;
+        assignment?: Record<string, unknown>;
+    }): Promise<CloudAccessTarget>;
+    delete(id: string): Promise<{
+        object: "cloud_access_target";
+        id: string;
+        deleted: true;
+    }>;
+    /** The commands and policy to apply on the cloud side. */
+    setup(id: string): Promise<CloudAccessSetup>;
+};
+/** A WS-Federation relying-party connection (sign people in through AD FS or another WS-Federation provider). */
+export interface WsFedConnection {
+    object: 'wsfed_connection';
+    id: string;
+    organization_id: string | null;
+    status: 'draft' | 'active' | 'disabled';
+    issuer: string | null;
+    passive_endpoint: string | null;
+    realm: string | null;
+    signing_certificate_count: number;
+    allowed_domains: string[];
+    attribute_mapping: Record<string, string>;
+    freshness_minutes: number | null;
+    auth_method: string | null;
+    /** Enter as the reply URL of the provider's relying-party trust. */
+    acs_url: string;
+    logout_start_url: string;
+    created_at: number;
+    updated_at: number;
+}
+export interface WsFedConnectionBody {
+    organization_id?: string | null;
+    status?: 'draft' | 'active' | 'disabled';
+    metadata_url?: string;
+    metadata_xml?: string;
+    issuer?: string;
+    passive_endpoint?: string;
+    signing_certificates?: string;
+    realm?: string;
+    allowed_domains?: string[];
+    attribute_mapping?: Record<string, string> | null;
+    freshness_minutes?: number | null;
+    auth_method?: string | null;
+}
+export declare function wsfedConnectionsResource(request: RequestFn): {
+    list(): Promise<{
+        object: "list";
+        data: WsFedConnection[];
+    }>;
+    get(id: string): Promise<WsFedConnection>;
+    create(body: WsFedConnectionBody): Promise<WsFedConnection>;
+    update(id: string, body: WsFedConnectionBody): Promise<WsFedConnection>;
+    delete(id: string): Promise<{
+        object: "wsfed_connection";
+        id: string;
+        deleted: true;
+    }>;
+};

package/dist/client/saml-idp.js

@@ -0,0 +1,71 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.samlIdpResource = samlIdpResource;
+exports.cloudAccessResource = cloudAccessResource;
+exports.wsfedConnectionsResource = wsfedConnectionsResource;
+const request_1 = require("./request");
+/** Atlas as a SAML identity provider: service-provider settings and metadata import. */
+function samlIdpResource(request) {
+    return {
+        /** `GET /v1/saml_idp/service_providers` */
+        list() {
+            return request({ method: 'GET', path: '/v1/saml_idp/service_providers' });
+        },
+        /** `GET /v1/saml_idp/service_providers/:id` */
+        get(id) {
+            return request({ method: 'GET', path: `/v1/saml_idp/service_providers/${(0, request_1.enc)(id)}` });
+        },
+        /** `PATCH /v1/saml_idp/service_providers/:id` — NameID format, encryption, request signing, algorithms, logout. */
+        update(id, body) {
+            return request({ method: 'PATCH', path: `/v1/saml_idp/service_providers/${(0, request_1.enc)(id)}`, body });
+        },
+        /** `POST /v1/saml_idp/service_providers/import_metadata` — preview, or save with `save_as`. */
+        importMetadata(body) {
+            return request({ method: 'POST', path: '/v1/saml_idp/service_providers/import_metadata', body });
+        },
+    };
+}
+/** Cloud access portal: account and role tiles for the launcher. */
+function cloudAccessResource(request) {
+    return {
+        list(provider) {
+            return request({ method: 'GET', path: `/v1/cloud_access/targets${provider ? `?provider=${provider}` : ''}` });
+        },
+        get(id) {
+            return request({ method: 'GET', path: `/v1/cloud_access/targets/${(0, request_1.enc)(id)}` });
+        },
+        create(body) {
+            return request({ method: 'POST', path: '/v1/cloud_access/targets', body });
+        },
+        update(id, body) {
+            return request({ method: 'PATCH', path: `/v1/cloud_access/targets/${(0, request_1.enc)(id)}`, body });
+        },
+        delete(id) {
+            return request({ method: 'DELETE', path: `/v1/cloud_access/targets/${(0, request_1.enc)(id)}` });
+        },
+        /** The commands and policy to apply on the cloud side. */
+        setup(id) {
+            return request({ method: 'GET', path: `/v1/cloud_access/targets/${(0, request_1.enc)(id)}/setup` });
+        },
+    };
+}
+function wsfedConnectionsResource(request) {
+    return {
+        list() {
+            return request({ method: 'GET', path: '/v1/wsfed_connections' });
+        },
+        get(id) {
+            return request({ method: 'GET', path: `/v1/wsfed_connections/${(0, request_1.enc)(id)}` });
+        },
+        create(body) {
+            return request({ method: 'POST', path: '/v1/wsfed_connections', body });
+        },
+        update(id, body) {
+            return request({ method: 'PATCH', path: `/v1/wsfed_connections/${(0, request_1.enc)(id)}`, body });
+        },
+        delete(id) {
+            return request({ method: 'DELETE', path: `/v1/wsfed_connections/${(0, request_1.enc)(id)}` });
+        },
+    };
+}
+//# sourceMappingURL=saml-idp.js.map

package/dist/client/saml-idp.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"saml-idp.js","sourceRoot":"","sources":["../../src/client/saml-idp.ts"],"names":[],"mappings":";;AAwEA,0CAmBC;AA2BD,kDAsBC;AAsCD,4DAkBC;AApMD,uCAAgD;AAuEhD,wFAAwF;AACxF,SAAgB,eAAe,CAAC,OAAkB;IAChD,OAAO;QACL,2CAA2C;QAC3C,IAAI;YACF,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,gCAAgC,EAAE,CAAC,CAAC;QAC5E,CAAC;QACD,+CAA+C;QAC/C,GAAG,CAAC,EAAU;YACZ,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,kCAAkC,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;QACvF,CAAC;QACD,mHAAmH;QACnH,MAAM,CAAC,EAAU,EAAE,IAAsC;YACvD,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,kCAAkC,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;QAC/F,CAAC;QACD,+FAA+F;QAC/F,cAAc,CAAC,IAAmK;YAChL,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,gDAAgD,EAAE,IAAI,EAAE,CAAC,CAAC;QACnG,CAAC;KACF,CAAC;AACJ,CAAC;AA0BD,oEAAoE;AACpE,SAAgB,mBAAmB,CAAC,OAAkB;IACpD,OAAO;QACL,IAAI,CAAC,QAAwB;YAC3B,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,2BAA2B,QAAQ,CAAC,CAAC,CAAC,aAAa,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;QAChH,CAAC;QACD,GAAG,CAAC,EAAU;YACZ,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,4BAA4B,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;QACjF,CAAC;QACD,MAAM,CAAC,IAAsH;YAC3H,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,0BAA0B,EAAE,IAAI,EAAE,CAAC,CAAC;QAC7E,CAAC;QACD,MAAM,CAAC,EAAU,EAAE,IAA+F;YAChH,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,4BAA4B,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;QACzF,CAAC;QACD,MAAM,CAAC,EAAU;YACf,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,4BAA4B,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;QACpF,CAAC;QACD,0DAA0D;QAC1D,KAAK,CAAC,EAAU;YACd,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,4BAA4B,IAAA,aAAG,EAAC,EAAE,CAAC,QAAQ,EAAE,CAAC,CAAC;QACvF,CAAC;KACF,CAAC;AACJ,CAAC;AAsCD,SAAgB,wBAAwB,CAAC,OAAkB;IACzD,OAAO;QACL,IAAI;YACF,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,uBAAuB,EAAE,CAAC,CAAC;QACnE,CAAC;QACD,GAAG,CAAC,EAAU;YACZ,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,yBAAyB,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;QAC9E,CAAC;QACD,MAAM,CAAC,IAAyB;YAC9B,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,uBAAuB,EAAE,IAAI,EAAE,CAAC,CAAC;QAC1E,CAAC;QACD,MAAM,CAAC,EAAU,EAAE,IAAyB;YAC1C,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,yBAAyB,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;QACtF,CAAC;QACD,MAAM,CAAC,EAAU;YACf,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,yBAAyB,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;QACjF,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/client/scim-provisioning.d.ts

@@ -10,6 +10,11 @@ export interface ScimProvisioningTarget {
     object: 'scim_provisioning_target';
     id: string;
     name: string;
+    kind: ProvisioningKind;
+    /** The kind's non-secret settings. */
+    connector_config: Record<string, unknown>;
+    /** Whether write-only credentials are stored (non-SCIM kinds) — never the values. */
+    has_credentials: boolean;
     base_url: string;
     /** Whether a bearer is set — never the value. */
     has_bearer_token: boolean;
@@ -24,18 +29,28 @@ export interface ScimProvisioningTarget {
     created_at: number;
     updated_at: number;
 }
+export type ProvisioningKind = 'scim' | 'google_workspace' | 'microsoft_graph' | 'rest' | 'ad_writeback' | 'sql';
 export interface CreateScimProvisioningTargetBody {
     name: string;
-    /** Must be an https:// URL so the bearer never travels in cleartext. */
-    base_url: string;
-    /** Write-only; stored encrypted, never returned. */
-    bearer_token: string;
+    /** Default scim. GET /v1/provisioning_connectors lists what each kind needs. */
+    kind?: ProvisioningKind;
+    connector_config?: Record<string, unknown>;
+    /** Write-only secrets for a non-SCIM kind. */
+    credentials?: Record<string, unknown>;
+    /** scim and rest only. Must be an https:// URL so the bearer never travels in cleartext. */
+    base_url?: string;
+    /** Required for scim. Write-only; stored encrypted, never returned. */
+    bearer_token?: string;
+    preset?: string;
+    preset_params?: Record<string, string>;
     attribute_mapping?: Record<string, unknown>;
     deprovision_action?: 'deactivate' | 'delete';
     enabled?: boolean;
 }
 export interface UpdateScimProvisioningTargetBody {
     name?: string;
+    connector_config?: Record<string, unknown>;
+    credentials?: Record<string, unknown>;
     base_url?: string;
     /** Write-only; omit to leave the stored bearer unchanged. */
     bearer_token?: string;
@@ -75,6 +90,40 @@ export interface ScimProvisioningGroupSyncResult {
     member_count: number;
     error: string | null;
 }
+export interface ProvisioningPreview {
+    object: 'provisioning_preview';
+    user_id: string;
+    attributes: Array<{
+        attribute: string;
+        source: string;
+        expression: boolean;
+        ok: boolean;
+        value: unknown;
+        error: string | null;
+    }>;
+    payload: Record<string, unknown>;
+}
+export interface ProvisioningLogEntry {
+    object: 'provisioning_log_entry';
+    id: string;
+    resource_type: 'user' | 'group';
+    resource_id: string;
+    operation: string;
+    ok: boolean;
+    status: number | null;
+    remote_id: string | null;
+    error: string | null;
+    created_at: number;
+}
+export interface ProvisioningFailure {
+    object: 'provisioning_failure';
+    resource_type: 'user' | 'group';
+    resource_id: string;
+    remote_id: string | null;
+    error: string | null;
+    attempts: number;
+    last_attempt_at: number;
+}
 export declare function scimProvisioningResource(request: RequestFn): {
     list(): Promise<ListPage<ScimProvisioningTarget>>;
     get(id: string): Promise<ScimProvisioningTarget>;
@@ -91,4 +140,51 @@ export declare function scimProvisioningResource(request: RequestFn): {
     syncUser(id: string, userId: string): Promise<ScimProvisioningSyncResult>;
     /** Force one org's (group) sync now; only already-provisioned members are sent. */
     syncGroup(id: string, organizationId: string): Promise<ScimProvisioningGroupSyncResult>;
+    /** The connector kinds, what each needs, and the expression functions. */
+    connectors(): Promise<{
+        object: "list";
+        data: Array<{
+            kind: ProvisioningKind;
+            name: string;
+            needs_relay_agent: boolean;
+            credentials: string[];
+            config: string[];
+            hint: string;
+        }>;
+        expression_functions: string[];
+    }>;
+    /** Evaluate a mapping for one user without sending anything. */
+    preview(body: {
+        attribute_mapping?: Record<string, string>;
+        lookups?: Record<string, unknown>;
+        target_id?: string;
+        user_id?: string;
+        user?: Record<string, unknown>;
+    }): Promise<ProvisioningPreview>;
+    /** The target's provisioning log, newest first. */
+    logs(id: string, query?: {
+        limit?: number;
+        starting_after?: string;
+        failures?: boolean;
+        resource_id?: string;
+    }): Promise<ListPage<ProvisioningLogEntry> & {
+        next_cursor: string | null;
+    }>;
+    /** Users and organizations whose last push failed. */
+    failures(id: string): Promise<ListPage<ProvisioningFailure>>;
+    /** Retry failed users and groups now (all, or one with resource_type + resource_id). */
+    retryFailed(id: string, body?: {
+        resource_type?: "user" | "group";
+        resource_id?: string;
+    }): Promise<{
+        object: "provisioning_retry_result";
+        retried: number;
+        succeeded: number;
+        results: Array<{
+            resource_type: string;
+            resource_id: string;
+            ok: boolean;
+            error: string | null;
+        }>;
+    }>;
 };

package/dist/client/scim-provisioning.js

@@ -44,6 +44,36 @@ function scimProvisioningResource(request) {
                 body: { organization_id: organizationId },
             });
         },
+        /** The connector kinds, what each needs, and the expression functions. */
+        connectors() {
+            return request({ method: 'GET', path: '/v1/provisioning_connectors' });
+        },
+        /** Evaluate a mapping for one user without sending anything. */
+        preview(body) {
+            return request({ method: 'POST', path: '/v1/provisioning/preview', body });
+        },
+        /** The target's provisioning log, newest first. */
+        logs(id, query = {}) {
+            const q = new URLSearchParams();
+            if (query.limit)
+                q.set('limit', String(query.limit));
+            if (query.starting_after)
+                q.set('starting_after', query.starting_after);
+            if (query.failures)
+                q.set('failures', 'true');
+            if (query.resource_id)
+                q.set('resource_id', query.resource_id);
+            const qs = q.toString();
+            return request({ method: 'GET', path: `/v1/scim_provisioning_targets/${(0, request_1.enc)(id)}/logs${qs ? `?${qs}` : ''}` });
+        },
+        /** Users and organizations whose last push failed. */
+        failures(id) {
+            return request({ method: 'GET', path: `/v1/scim_provisioning_targets/${(0, request_1.enc)(id)}/failures` });
+        },
+        /** Retry failed users and groups now (all, or one with resource_type + resource_id). */
+        retryFailed(id, body = {}) {
+            return request({ method: 'POST', path: `/v1/scim_provisioning_targets/${(0, request_1.enc)(id)}/retry_failed`, body });
+        },
     };
 }
 //# sourceMappingURL=scim-provisioning.js.map

package/dist/client/scim-provisioning.js.map

@@ -1 +1 @@
-{"version":3,"file":"scim-provisioning.js","sourceRoot":"","sources":["../../src/client/scim-provisioning.ts"],"names":[],"mappings":";;AAoFA,4DAmDC;AAvID,uCAAgD;AAoFhD,SAAgB,wBAAwB,CAAC,OAAkB;IACzD,OAAO;QACL,IAAI;YACF,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,+BAA+B,EAAE,CAAC,CAAC;QAC3E,CAAC;QACD,GAAG,CAAC,EAAU;YACZ,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,iCAAiC,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;QACtF,CAAC;QACD,MAAM,CACJ,IAAsC,EACtC,cAAuB;YAEvB,OAAO,OAAO,CAAC;gBACb,MAAM,EAAE,MAAM;gBACd,IAAI,EAAE,+BAA+B;gBACrC,IAAI;gBACJ,cAAc;aACf,CAAC,CAAC;QACL,CAAC;QACD,MAAM,CACJ,EAAU,EACV,IAAsC;YAEtC,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,iCAAiC,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;QAC9F,CAAC;QACD,MAAM,CACJ,EAAU;YAEV,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,iCAAiC,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;QACzF,CAAC;QACD,wFAAwF;QACxF,IAAI,CAAC,EAAU;YACb,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,iCAAiC,IAAA,aAAG,EAAC,EAAE,CAAC,OAAO,EAAE,CAAC,CAAC;QAC5F,CAAC;QACD,mFAAmF;QACnF,QAAQ,CAAC,EAAU,EAAE,MAAc;YACjC,OAAO,OAAO,CAAC;gBACb,MAAM,EAAE,MAAM;gBACd,IAAI,EAAE,iCAAiC,IAAA,aAAG,EAAC,EAAE,CAAC,YAAY;gBAC1D,IAAI,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE;aAC1B,CAAC,CAAC;QACL,CAAC;QACD,mFAAmF;QACnF,SAAS,CAAC,EAAU,EAAE,cAAsB;YAC1C,OAAO,OAAO,CAAC;gBACb,MAAM,EAAE,MAAM;gBACd,IAAI,EAAE,iCAAiC,IAAA,aAAG,EAAC,EAAE,CAAC,aAAa;gBAC3D,IAAI,EAAE,EAAE,eAAe,EAAE,cAAc,EAAE;aAC1C,CAAC,CAAC;QACL,CAAC;KACF,CAAC;AACJ,CAAC"}
+{"version":3,"file":"scim-provisioning.js","sourceRoot":"","sources":["../../src/client/scim-provisioning.ts"],"names":[],"mappings":";;AAgIA,4DA6EC;AA7MD,uCAAgD;AAgIhD,SAAgB,wBAAwB,CAAC,OAAkB;IACzD,OAAO;QACL,IAAI;YACF,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,+BAA+B,EAAE,CAAC,CAAC;QAC3E,CAAC;QACD,GAAG,CAAC,EAAU;YACZ,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,iCAAiC,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;QACtF,CAAC;QACD,MAAM,CACJ,IAAsC,EACtC,cAAuB;YAEvB,OAAO,OAAO,CAAC;gBACb,MAAM,EAAE,MAAM;gBACd,IAAI,EAAE,+BAA+B;gBACrC,IAAI;gBACJ,cAAc;aACf,CAAC,CAAC;QACL,CAAC;QACD,MAAM,CACJ,EAAU,EACV,IAAsC;YAEtC,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,iCAAiC,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;QAC9F,CAAC;QACD,MAAM,CACJ,EAAU;YAEV,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,iCAAiC,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;QACzF,CAAC;QACD,wFAAwF;QACxF,IAAI,CAAC,EAAU;YACb,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,iCAAiC,IAAA,aAAG,EAAC,EAAE,CAAC,OAAO,EAAE,CAAC,CAAC;QAC5F,CAAC;QACD,mFAAmF;QACnF,QAAQ,CAAC,EAAU,EAAE,MAAc;YACjC,OAAO,OAAO,CAAC;gBACb,MAAM,EAAE,MAAM;gBACd,IAAI,EAAE,iCAAiC,IAAA,aAAG,EAAC,EAAE,CAAC,YAAY;gBAC1D,IAAI,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE;aAC1B,CAAC,CAAC;QACL,CAAC;QACD,mFAAmF;QACnF,SAAS,CAAC,EAAU,EAAE,cAAsB;YAC1C,OAAO,OAAO,CAAC;gBACb,MAAM,EAAE,MAAM;gBACd,IAAI,EAAE,iCAAiC,IAAA,aAAG,EAAC,EAAE,CAAC,aAAa;gBAC3D,IAAI,EAAE,EAAE,eAAe,EAAE,cAAc,EAAE;aAC1C,CAAC,CAAC;QACL,CAAC;QACA,0EAA0E;QAC3E,UAAU;YACR,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,6BAA6B,EAAE,CAAC,CAAC;QACzE,CAAC;QACD,gEAAgE;QAChE,OAAO,CAAC,IAA6J;YACnK,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,0BAA0B,EAAE,IAAI,EAAE,CAAC,CAAC;QAC7E,CAAC;QACD,mDAAmD;QACnD,IAAI,CAAC,EAAU,EAAE,QAA+F,EAAE;YAChH,MAAM,CAAC,GAAG,IAAI,eAAe,EAAE,CAAC;YAChC,IAAI,KAAK,CAAC,KAAK;gBAAE,CAAC,CAAC,GAAG,CAAC,OAAO,EAAE,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC;YACrD,IAAI,KAAK,CAAC,cAAc;gBAAE,CAAC,CAAC,GAAG,CAAC,gBAAgB,EAAE,KAAK,CAAC,cAAc,CAAC,CAAC;YACxE,IAAI,KAAK,CAAC,QAAQ;gBAAE,CAAC,CAAC,GAAG,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;YAC9C,IAAI,KAAK,CAAC,WAAW;gBAAE,CAAC,CAAC,GAAG,CAAC,aAAa,EAAE,KAAK,CAAC,WAAW,CAAC,CAAC;YAC/D,MAAM,EAAE,GAAG,CAAC,CAAC,QAAQ,EAAE,CAAC;YACxB,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,iCAAiC,IAAA,aAAG,EAAC,EAAE,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;QAChH,CAAC;QACD,sDAAsD;QACtD,QAAQ,CAAC,EAAU;YACjB,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,iCAAiC,IAAA,aAAG,EAAC,EAAE,CAAC,WAAW,EAAE,CAAC,CAAC;QAC/F,CAAC;QACD,wFAAwF;QACxF,WAAW,CAAC,EAAU,EAAE,OAAmE,EAAE;YAC3F,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,iCAAiC,IAAA,aAAG,EAAC,EAAE,CAAC,eAAe,EAAE,IAAI,EAAE,CAAC,CAAC;QAC1G,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/client/scim-tokens.d.ts

@@ -50,3 +50,37 @@ export declare function scimTokensResource(request: RequestFn): {
         note: string;
     }>;
 };
+/** A custom SCIM resource type an instance serves at /scim/v2/<endpoint>. */
+export interface ScimResourceType {
+    object: 'scim_resource_type';
+    id: string;
+    name: string;
+    endpoint: string;
+    schema_uri: string;
+    description: string | null;
+    attributes: Array<{
+        name: string;
+        type: string;
+        multiValued?: boolean;
+        required?: boolean;
+        mutability?: string;
+        subAttributes?: unknown[];
+    }>;
+    created_at: number;
+}
+export declare function scimResourceTypesResource(request: RequestFn): {
+    list(): Promise<ListPage<ScimResourceType>>;
+    get(id: string): Promise<ScimResourceType>;
+    create(body: {
+        name: string;
+        endpoint: string;
+        schema_uri: string;
+        description?: string;
+        attributes?: ScimResourceType["attributes"];
+    }): Promise<ScimResourceType>;
+    delete(id: string): Promise<{
+        object: "scim_resource_type";
+        id: string;
+        deleted: true;
+    }>;
+};

package/dist/client/scim-tokens.js

@@ -1,6 +1,7 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.scimTokensResource = scimTokensResource;
+exports.scimResourceTypesResource = scimResourceTypesResource;
 const request_1 = require("./request");
 function scimTokensResource(request) {
     return {
@@ -19,4 +20,20 @@ function scimTokensResource(request) {
         },
     };
 }
+function scimResourceTypesResource(request) {
+    return {
+        list() {
+            return request({ method: 'GET', path: '/v1/scim_resource_types' });
+        },
+        get(id) {
+            return request({ method: 'GET', path: `/v1/scim_resource_types/${(0, request_1.enc)(id)}` });
+        },
+        create(body) {
+            return request({ method: 'POST', path: '/v1/scim_resource_types', body });
+        },
+        delete(id) {
+            return request({ method: 'DELETE', path: `/v1/scim_resource_types/${(0, request_1.enc)(id)}` });
+        },
+    };
+}
 //# sourceMappingURL=scim-tokens.js.map

package/dist/client/scim-tokens.js.map

@@ -1 +1 @@
-{"version":3,"file":"scim-tokens.js","sourceRoot":"","sources":["../../src/client/scim-tokens.ts"],"names":[],"mappings":";;AA8CA,gDAkBC;AAhED,uCAAgD;AA8ChD,SAAgB,kBAAkB,CAAC,OAAkB;IACnD,OAAO;QACL,IAAI;YACF,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,iBAAiB,EAAE,CAAC,CAAC;QAC7D,CAAC;QACD,MAAM,CAAC,IAAyB,EAAE,cAAuB;YACvD,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,iBAAiB,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC;QACpF,CAAC;QACD,sDAAsD;QACtD,MAAM,CAAC,EAAU,EAAE,IAAyB;YAC1C,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,mBAAmB,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;QAChF,CAAC;QACD,MAAM,CACJ,EAAU;YAEV,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,mBAAmB,IAAA,aAAG,EAAC,EAAE,CAAC,SAAS,EAAE,CAAC,CAAC;QAChF,CAAC;KACF,CAAC;AACJ,CAAC"}
+{"version":3,"file":"scim-tokens.js","sourceRoot":"","sources":["../../src/client/scim-tokens.ts"],"names":[],"mappings":";;AA8CA,gDAkBC;AAcD,8DAeC;AA7FD,uCAAgD;AA8ChD,SAAgB,kBAAkB,CAAC,OAAkB;IACnD,OAAO;QACL,IAAI;YACF,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,iBAAiB,EAAE,CAAC,CAAC;QAC7D,CAAC;QACD,MAAM,CAAC,IAAyB,EAAE,cAAuB;YACvD,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,iBAAiB,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC;QACpF,CAAC;QACD,sDAAsD;QACtD,MAAM,CAAC,EAAU,EAAE,IAAyB;YAC1C,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,mBAAmB,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;QAChF,CAAC;QACD,MAAM,CACJ,EAAU;YAEV,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,mBAAmB,IAAA,aAAG,EAAC,EAAE,CAAC,SAAS,EAAE,CAAC,CAAC;QAChF,CAAC;KACF,CAAC;AACJ,CAAC;AAcD,SAAgB,yBAAyB,CAAC,OAAkB;IAC1D,OAAO;QACL,IAAI;YACF,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,yBAAyB,EAAE,CAAC,CAAC;QACrE,CAAC;QACD,GAAG,CAAC,EAAU;YACZ,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,2BAA2B,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;QAChF,CAAC;QACD,MAAM,CAAC,IAA+H;YACpI,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,yBAAyB,EAAE,IAAI,EAAE,CAAC,CAAC;QAC5E,CAAC;QACD,MAAM,CAAC,EAAU;YACf,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,2BAA2B,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;QACnF,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/client/service-connectors.d.ts

@@ -1,5 +1,5 @@
 import { type RequestFn } from './request';
-export type ServiceConnectorCategory = 'messaging' | 'crm' | 'analytics' | 'fraud' | 'idv' | 'http';
+export type ServiceConnectorCategory = 'messaging' | 'crm' | 'analytics' | 'fraud' | 'idv' | 'http' | 'ticketing';
 /** A configured service. Credentials are write-only: they live in the vault and are never returned. */
 export interface ServiceConnector {
     object: 'service_connector';

package/dist/client/ssf.d.ts

@@ -4,6 +4,7 @@ export type SsfEventType = 'https://schemas.openid.net/secevent/caep/event-type/
 export interface SsfStream {
     object: 'ssf_stream';
     id: string;
+    default_subjects?: 'ALL' | 'NONE';
     description: string | null;
     delivery: {
         method: string;
@@ -32,6 +33,7 @@ export interface CreateSsfStreamBody {
     audience?: string;
     description?: string;
     events_requested?: string[];
+    default_subjects?: 'ALL' | 'NONE';
 }
 export interface UpdateSsfStreamBody {
     endpoint_url?: string;
@@ -76,6 +78,22 @@ export interface CreateSsfReceiverBody {
 }
 /** Shared Signals Framework (SSF 1.0) with CAEP and RISC: transmitter streams and inbound receivers. */
 export declare function ssfResource(request: RequestFn): {
+    subjects: {
+        /** Add a subject to a stream (iss_sub, email, phone_number, opaque, account, did or uri identifier). */
+        add(streamId: string, subject: Record<string, string>): Promise<void>;
+        remove(streamId: string, subject: Record<string, string>): Promise<void>;
+    };
+    /** Raise a CAEP / RISC event for one of your users by hand (opt-in, opt-out-*, identifier-recycled, recovery-* ...). */
+    emit(body: {
+        user_id: string;
+        event: string;
+        subject?: Record<string, string>;
+        data?: Record<string, unknown>;
+    }): Promise<{
+        object: "ssf_event_emit";
+        event: string;
+        user_id: string;
+    }>;
     streams: {
         list(): Promise<{
             object: "list";
@@ -91,6 +109,17 @@ export declare function ssfResource(request: RequestFn): {
             stream_id: string;
             state: string;
         }>;
+        /** SSF 1.0 subject management: `default_subjects` ALL streams carry everyone but removed subjects, NONE streams only added ones. */
+        subjects(id: string): Promise<{
+            object: "list";
+            default_subjects: "ALL" | "NONE";
+            data: Array<{
+                object: "ssf_stream_subject";
+                subject: Record<string, string>;
+                mode: "include" | "exclude";
+                created_at: number;
+            }>;
+        }>;
         events(id: string, query?: {
             limit?: number;
         }): Promise<{

package/dist/client/ssf.js

@@ -6,6 +6,19 @@ function ssfResource(request) {
     const stream = (id) => `/v1/ssf/streams/${encodeURIComponent(id)}`;
     const receiver = (id) => `/v1/ssf/receivers/${encodeURIComponent(id)}`;
     return {
+        subjects: {
+            /** Add a subject to a stream (iss_sub, email, phone_number, opaque, account, did or uri identifier). */
+            add(streamId, subject) {
+                return request({ method: 'POST', path: '/v1/ssf/subjects/add', body: { stream_id: streamId, subject } });
+            },
+            remove(streamId, subject) {
+                return request({ method: 'POST', path: '/v1/ssf/subjects/remove', body: { stream_id: streamId, subject } });
+            },
+        },
+        /** Raise a CAEP / RISC event for one of your users by hand (opt-in, opt-out-*, identifier-recycled, recovery-* ...). */
+        emit(body) {
+            return request({ method: 'POST', path: '/v1/ssf/events', body });
+        },
         streams: {
             list() {
                 return request({ method: 'GET', path: '/v1/ssf/streams' });
@@ -26,6 +39,10 @@ function ssfResource(request) {
             verify(id, state) {
                 return request({ method: 'POST', path: `${stream(id)}/verify`, body: { state } });
             },
+            /** SSF 1.0 subject management: `default_subjects` ALL streams carry everyone but removed subjects, NONE streams only added ones. */
+            subjects(id) {
+                return request({ method: 'GET', path: `${stream(id)}/subjects` });
+            },
             events(id, query = {}) {
                 return request({ method: 'GET', path: `${stream(id)}/events`, query });
             },

package/dist/client/ssf.js.map

@@ -1 +1 @@
-{"version":3,"file":"ssf.js","sourceRoot":"","sources":["../../src/client/ssf.ts"],"names":[],"mappings":";;AA6FA,kCA2CC;AA5CD,wGAAwG;AACxG,SAAgB,WAAW,CAAC,OAAkB;IAC5C,MAAM,MAAM,GAAG,CAAC,EAAU,EAAE,EAAE,CAAC,mBAAmB,kBAAkB,CAAC,EAAE,CAAC,EAAE,CAAC;IAC3E,MAAM,QAAQ,GAAG,CAAC,EAAU,EAAE,EAAE,CAAC,qBAAqB,kBAAkB,CAAC,EAAE,CAAC,EAAE,CAAC;IAC/E,OAAO;QACL,OAAO,EAAE;YACP,IAAI;gBACF,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,iBAAiB,EAAE,CAAC,CAAC;YAC7D,CAAC;YACD,MAAM,CAAC,IAAyB;gBAC9B,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,iBAAiB,EAAE,IAAI,EAAE,CAAC,CAAC;YACpE,CAAC;YACD,GAAG,CAAC,EAAU;gBACZ,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;YACtD,CAAC;YACD,MAAM,CAAC,EAAU,EAAE,IAAyB;gBAC1C,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,CAAC,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC;YAC9D,CAAC;YACD,MAAM,CAAC,EAAU;gBACf,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;YACzD,CAAC;YACD,+EAA+E;YAC/E,MAAM,CAAC,EAAU,EAAE,KAAc;gBAC/B,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,CAAC,EAAE,CAAC,SAAS,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC;YACpF,CAAC;YACD,MAAM,CAAC,EAAU,EAAE,QAA4B,EAAE;gBAC/C,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,MAAM,CAAC,EAAE,CAAC,SAAS,EAAE,KAAK,EAAE,CAAC,CAAC;YACzE,CAAC;SACF;QACD,SAAS,EAAE;YACT,IAAI;gBACF,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,mBAAmB,EAAE,CAAC,CAAC;YAC/D,CAAC;YACD,MAAM,CAAC,IAA2B;gBAChC,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,mBAAmB,EAAE,IAAI,EAAE,CAAC,CAAC;YACtE,CAAC;YACD,MAAM,CAAC,EAAU,EAAE,IAA4E;gBAC7F,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,CAAC,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC;YAChE,CAAC;YACD,MAAM,CAAC,EAAU;gBACf,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,QAAQ,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;YAC3D,CAAC;SACF;KACF,CAAC;AACJ,CAAC"}
+{"version":3,"file":"ssf.js","sourceRoot":"","sources":["../../src/client/ssf.ts"],"names":[],"mappings":";;AA+FA,kCA4DC;AA7DD,wGAAwG;AACxG,SAAgB,WAAW,CAAC,OAAkB;IAC5C,MAAM,MAAM,GAAG,CAAC,EAAU,EAAE,EAAE,CAAC,mBAAmB,kBAAkB,CAAC,EAAE,CAAC,EAAE,CAAC;IAC3E,MAAM,QAAQ,GAAG,CAAC,EAAU,EAAE,EAAE,CAAC,qBAAqB,kBAAkB,CAAC,EAAE,CAAC,EAAE,CAAC;IAC/E,OAAO;QACL,QAAQ,EAAE;YACR,wGAAwG;YACxG,GAAG,CAAC,QAAgB,EAAE,OAA+B;gBACnD,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,sBAAsB,EAAE,IAAI,EAAE,EAAE,SAAS,EAAE,QAAQ,EAAE,OAAO,EAAE,EAAE,CAAC,CAAC;YAC3G,CAAC;YACD,MAAM,CAAC,QAAgB,EAAE,OAA+B;gBACtD,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,yBAAyB,EAAE,IAAI,EAAE,EAAE,SAAS,EAAE,QAAQ,EAAE,OAAO,EAAE,EAAE,CAAC,CAAC;YAC9G,CAAC;SACF;QACD,wHAAwH;QACxH,IAAI,CAAC,IAA0G;YAC7G,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,gBAAgB,EAAE,IAAI,EAAE,CAAC,CAAC;QACnE,CAAC;QACD,OAAO,EAAE;YACP,IAAI;gBACF,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,iBAAiB,EAAE,CAAC,CAAC;YAC7D,CAAC;YACD,MAAM,CAAC,IAAyB;gBAC9B,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,iBAAiB,EAAE,IAAI,EAAE,CAAC,CAAC;YACpE,CAAC;YACD,GAAG,CAAC,EAAU;gBACZ,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;YACtD,CAAC;YACD,MAAM,CAAC,EAAU,EAAE,IAAyB;gBAC1C,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,CAAC,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC;YAC9D,CAAC;YACD,MAAM,CAAC,EAAU;gBACf,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;YACzD,CAAC;YACD,+EAA+E;YAC/E,MAAM,CAAC,EAAU,EAAE,KAAc;gBAC/B,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,CAAC,EAAE,CAAC,SAAS,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC;YACpF,CAAC;YACD,oIAAoI;YACpI,QAAQ,CAAC,EAAU;gBACjB,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,MAAM,CAAC,EAAE,CAAC,WAAW,EAAE,CAAC,CAAC;YACpE,CAAC;YACD,MAAM,CAAC,EAAU,EAAE,QAA4B,EAAE;gBAC/C,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,MAAM,CAAC,EAAE,CAAC,SAAS,EAAE,KAAK,EAAE,CAAC,CAAC;YACzE,CAAC;SACF;QACD,SAAS,EAAE;YACT,IAAI;gBACF,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,mBAAmB,EAAE,CAAC,CAAC;YAC/D,CAAC;YACD,MAAM,CAAC,IAA2B;gBAChC,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,mBAAmB,EAAE,IAAI,EAAE,CAAC,CAAC;YACtE,CAAC;YACD,MAAM,CAAC,EAAU,EAAE,IAA4E;gBAC7F,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,CAAC,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC;YAChE,CAAC;YACD,MAAM,CAAC,EAAU;gBACf,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,QAAQ,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;YAC3D,CAAC;SACF;KACF,CAAC;AACJ,CAAC"}

package/dist/client/users.d.ts

@@ -1,3 +1,4 @@
+import { type CreateTemporaryAccessBody, type TemporaryAccessPass } from './risk-containment';
 import { type RequestFn } from './request';
 import type { ImportedMfa } from './mfa-factors';
 import type { CursorPage, CursorParams, DeletedObject, ListPage, Metadata } from './types';
@@ -258,6 +259,14 @@ export declare function usersResource(request: RequestFn): {
         total_count?: number;
     }>;
     get(id: string): Promise<User>;
+    /**
+     * Issue a temporary access pass: a time-limited code the user signs in with
+     * (`strategy: "temporary_access_pass"`), which counts as MFA for that sign-in and makes them register a
+     * passkey or second factor. The `code` is returned once.
+     */
+    createTemporaryAccess(id: string, body?: CreateTemporaryAccessBody): Promise<TemporaryAccessPass & {
+        code: string;
+    }>;
     create(body: CreateUserBody, idempotencyKey?: string): Promise<User>;
     update(id: string, body: UpdateUserBody): Promise<User>;
     /**