@atlasauth/backend 0.26.0 → 0.27.1

package/CHANGELOG.md

@@ -1,5 +1,21 @@
 # @atlasauth/backend changelog
 
+## 0.27.1 — 2026-10-28
+
+### Fixed
+
+- The package entry no longer imports `node:crypto`: webhook, policy-feed, bot-id and referral signing use @noble/hashes and Web Crypto, so it bundles for edge and worker runtimes (Next.js 15 edge middleware). Public API unchanged.
+
+## 0.27.0 — 2026-10-28
+
+- SAML IdP (service providers, artifacts, attribute queries), WS-Federation, outbound provisioning connectors, SCIM custom resources and cloud access targets
+- OpenID provider: per-client signing/encryption, op key rotation, token-exchange profiles, refresh-token search and bulk revoke, federation resolve, verifiable-credential deferred issuance and presentation requests; `requireAcr`/`maxAge` step-up on access-token verification and `verifyTransactionToken`
+- Conditional access depth: report-only and impact replay, device assurance policies and pull integrations, risky users, containment, temporary access passes, email risk, authenticator policies
+- Workflows, chat integrations (Slack/Teams approvals), eligible access and activation, staged and recurring reviews, bundles, administrative units, organization application access and B2B connections
+- MCP gateway v2 (upstreams, packs, pins, user auth), connection actions and triggers, agent lifecycle and reviews, telemetry export
+- Authorization: tuple expiry, decision points, Cedar JSON and token authorization, FGA assertions/materializations/bulk import, customer-managed keys, coupons, credits, user merge, audit retention
+- Device-bound SSO registrations; SMTP2GO email transport
+
 ## 0.26.0 — 2026-10-27
 
 ### Added

package/dist/botid.js

@@ -3,7 +3,7 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.BOTID_SECRET_MIN_LENGTH = exports.BOTID_ATTESTATION_MAX_TTL_SECONDS = exports.BOTID_ATTESTATION_PREFIX = void 0;
 exports.createBotIdAttestation = createBotIdAttestation;
 exports.botIdAttestationHandler = botIdAttestationHandler;
-const node_crypto_1 = require("node:crypto");
+const edge_crypto_1 = require("./edge-crypto");
 /**
  * Vercel BotID for Atlas — the server half that runs on YOUR Vercel deployment.
  *
@@ -55,9 +55,9 @@ function createBotIdAttestation(options) {
         verified_bot: verdict.isVerifiedBot === true,
         iat,
         exp: iat + ttl,
-        jti: (0, node_crypto_1.randomBytes)(18).toString('base64url'),
+        jti: (0, edge_crypto_1.randomBytes)(18).toString('base64url'),
     }), 'utf8').toString('base64url');
-    const sig = (0, node_crypto_1.createHmac)('sha256', secret).update(exports.BOTID_ATTESTATION_PREFIX + payload).digest('base64url');
+    const sig = (0, edge_crypto_1.createHmac)('sha256', secret).update(exports.BOTID_ATTESTATION_PREFIX + payload).digest('base64url');
     return `${exports.BOTID_ATTESTATION_PREFIX}${payload}.${sig}`;
 }
 /**

package/dist/botid.js.map

@@ -1 +1 @@
-{"version":3,"file":"botid.js","sourceRoot":"","sources":["../src/botid.ts"],"names":[],"mappings":";;;AA8DA,wDAoBC;AAiBD,0DAiBC;AApHD,6CAAsD;AAEtD;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAEH,4CAA4C;AAC/B,QAAA,wBAAwB,GAAG,iBAAiB,CAAC;AAE1D,yEAAyE;AAC5D,QAAA,iCAAiC,GAAG,GAAG,CAAC;AAErD,+CAA+C;AAClC,QAAA,uBAAuB,GAAG,EAAE,CAAC;AAoB1C;;;;GAIG;AACH,SAAgB,sBAAsB,CAAC,OAAsC;IAC3E,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC;IACpC,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,CAAC,MAAM,GAAG,+BAAuB,EAAE,CAAC;QAC1E,MAAM,IAAI,KAAK,CAAC,iDAAiD,+BAAuB,cAAc,CAAC,CAAC;IAC1G,CAAC;IACD,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,UAAU,IAAI,EAAE,CAAC,EAAE,CAAC,CAAC,EAAE,yCAAiC,CAAC,CAAC;IAC3G,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC,GAAG,IAAI,CAAC,CAAC;IAC3D,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CACzB,IAAI,CAAC,SAAS,CAAC;QACb,CAAC,EAAE,CAAC;QACJ,MAAM,EAAE,OAAO,CAAC,KAAK,KAAK,KAAK;QAC/B,YAAY,EAAE,OAAO,CAAC,aAAa,KAAK,IAAI;QAC5C,GAAG;QACH,GAAG,EAAE,GAAG,GAAG,GAAG;QACd,GAAG,EAAE,IAAA,yBAAW,EAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC;KAC3C,CAAC,EACF,MAAM,CACP,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IACxB,MAAM,GAAG,GAAG,IAAA,wBAAU,EAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,gCAAwB,GAAG,OAAO,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;IACxG,OAAO,GAAG,gCAAwB,GAAG,OAAO,IAAI,GAAG,EAAE,CAAC;AACxD,CAAC;AAWD;;;;;GAKG;AACH,SAAgB,uBAAuB,CAAC,OAAuC;IAC7E,OAAO,KAAK,IAAI,EAAE;QAChB,IAAI,OAAqB,CAAC;QAC1B,IAAI,CAAC;YACH,OAAO,GAAG,MAAM,OAAO,CAAC,UAAU,EAAE,CAAC;QACvC,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,mBAAmB,EAAE,CAAC,EAAE;gBAClE,MAAM,EAAE,GAAG;gBACX,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,eAAe,EAAE,UAAU,EAAE;aAC7E,CAAC,CAAC;QACL,CAAC;QACD,MAAM,KAAK,GAAG,sBAAsB,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,OAAO,EAAE,UAAU,EAAE,OAAO,CAAC,UAAU,EAAE,CAAC,CAAC;QAC1G,OAAO,IAAI,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE;YAC7C,MAAM,EAAE,GAAG;YACX,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,eAAe,EAAE,UAAU,EAAE;SAC7E,CAAC,CAAC;IACL,CAAC,CAAC;AACJ,CAAC"}
+{"version":3,"file":"botid.js","sourceRoot":"","sources":["../src/botid.ts"],"names":[],"mappings":";;;AA8DA,wDAoBC;AAiBD,0DAiBC;AApHD,+CAAwD;AAExD;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAEH,4CAA4C;AAC/B,QAAA,wBAAwB,GAAG,iBAAiB,CAAC;AAE1D,yEAAyE;AAC5D,QAAA,iCAAiC,GAAG,GAAG,CAAC;AAErD,+CAA+C;AAClC,QAAA,uBAAuB,GAAG,EAAE,CAAC;AAoB1C;;;;GAIG;AACH,SAAgB,sBAAsB,CAAC,OAAsC;IAC3E,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC;IACpC,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,CAAC,MAAM,GAAG,+BAAuB,EAAE,CAAC;QAC1E,MAAM,IAAI,KAAK,CAAC,iDAAiD,+BAAuB,cAAc,CAAC,CAAC;IAC1G,CAAC;IACD,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,UAAU,IAAI,EAAE,CAAC,EAAE,CAAC,CAAC,EAAE,yCAAiC,CAAC,CAAC;IAC3G,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC,GAAG,IAAI,CAAC,CAAC;IAC3D,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CACzB,IAAI,CAAC,SAAS,CAAC;QACb,CAAC,EAAE,CAAC;QACJ,MAAM,EAAE,OAAO,CAAC,KAAK,KAAK,KAAK;QAC/B,YAAY,EAAE,OAAO,CAAC,aAAa,KAAK,IAAI;QAC5C,GAAG;QACH,GAAG,EAAE,GAAG,GAAG,GAAG;QACd,GAAG,EAAE,IAAA,yBAAW,EAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC;KAC3C,CAAC,EACF,MAAM,CACP,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IACxB,MAAM,GAAG,GAAG,IAAA,wBAAU,EAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,gCAAwB,GAAG,OAAO,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;IACxG,OAAO,GAAG,gCAAwB,GAAG,OAAO,IAAI,GAAG,EAAE,CAAC;AACxD,CAAC;AAWD;;;;;GAKG;AACH,SAAgB,uBAAuB,CAAC,OAAuC;IAC7E,OAAO,KAAK,IAAI,EAAE;QAChB,IAAI,OAAqB,CAAC;QAC1B,IAAI,CAAC;YACH,OAAO,GAAG,MAAM,OAAO,CAAC,UAAU,EAAE,CAAC;QACvC,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,mBAAmB,EAAE,CAAC,EAAE;gBAClE,MAAM,EAAE,GAAG;gBACX,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,eAAe,EAAE,UAAU,EAAE;aAC7E,CAAC,CAAC;QACL,CAAC;QACD,MAAM,KAAK,GAAG,sBAAsB,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,OAAO,EAAE,UAAU,EAAE,OAAO,CAAC,UAAU,EAAE,CAAC,CAAC;QAC1G,OAAO,IAAI,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE;YAC7C,MAAM,EAAE,GAAG;YACX,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,eAAe,EAAE,UAAU,EAAE;SAC7E,CAAC,CAAC;IACL,CAAC,CAAC;AACJ,CAAC"}

package/dist/client/abac.d.ts

@@ -64,6 +64,11 @@ export interface AbacDecision {
     decision: 'allow' | 'deny';
     reasons: string[];
     errors: string[];
+    /** `@annotations` of the policies that decided it, when any carry them. */
+    annotations?: Array<{
+        policy: string;
+        annotations: Record<string, string>;
+    }>;
 }
 export interface AbacCoverageClause {
     kind: 'when' | 'unless';
@@ -410,6 +415,51 @@ export declare function abacResource(request: RequestFn): {
         source?: string;
         tests?: AbacPolicyTestCase[];
     }): Promise<AbacTestRun>;
+    /** Cedar JSON policy format: export policy text, import JSON (optionally creating the policy with `name`). */
+    cedar: {
+        export(source: string): Promise<{
+            object: "cedar_json_policies";
+            policies: Array<Record<string, unknown>>;
+        }>;
+        import(body: {
+            policies: Array<Record<string, unknown>>;
+            name?: string;
+            fga_store_id?: string | null;
+        }): Promise<{
+            object: "cedar_source";
+            source: string;
+            policies: number;
+        } | AbacPolicy>;
+        forPolicy(id: string): Promise<{
+            object: "cedar_json_policies";
+            policies: Array<Record<string, unknown>>;
+        }>;
+    };
+    /** How access-token claims become a policy principal and its parents (used by {@link authorizeToken}). */
+    tokenMapping: {
+        get(): Promise<AbacTokenMapping>;
+        put(body: Partial<Omit<AbacTokenMapping, "object">>): Promise<AbacTokenMapping>;
+    };
+    /** Decide for the principal an access token stands for (verified first; an invalid token is a 401). */
+    authorizeToken(body: {
+        access_token: string;
+        action: string;
+        resource: {
+            type: string;
+            id: string;
+            attributes?: Record<string, unknown>;
+        };
+        context?: Record<string, unknown>;
+        entities?: AbacEntity[];
+        policy_ids?: string[];
+    }): Promise<AbacDecision & {
+        principal: {
+            type: string;
+            id: string;
+            parents: string[];
+        };
+        issuer: "atlas" | "trusted";
+    }>;
     /** May `principal` perform `action` on `resource`? */
     evaluate(body: AbacEvaluateBody): Promise<AbacDecision>;
     /**
@@ -519,3 +569,18 @@ export declare function abacResource(request: RequestFn): {
     }>;
 };
 export { FilterCompileError, evalFilter, filterToDrizzle, filterToPrisma, filterToSql, type DrizzleOps, type DrizzleOptions, type Filter, type FilterRows, type PrismaOptions, type SqlColumn, type SqlDialect, type SqlFragment, type SqlOptions, } from '@atlasauth/authz';
+export interface AbacTokenMapping {
+    object: 'abac_token_mapping';
+    principal_type: string;
+    id_claim: string;
+    parents: Array<{
+        claim: string;
+        type: string;
+    }>;
+    attribute_claims: string[];
+    trusted_issuers: Array<{
+        issuer: string;
+        jwks_uri: string;
+        audience?: string;
+    }>;
+}

package/dist/client/abac.js

@@ -28,6 +28,31 @@ function abacResource(request) {
         test(id, body = {}) {
             return request({ method: 'POST', path: `/v1/abac_policies/${(0, request_1.enc)(id)}/test`, body });
         },
+        /** Cedar JSON policy format: export policy text, import JSON (optionally creating the policy with `name`). */
+        cedar: {
+            export(source) {
+                return request({ method: 'POST', path: '/v1/abac/cedar/export', body: { source } });
+            },
+            import(body) {
+                return request({ method: 'POST', path: '/v1/abac/cedar/import', body });
+            },
+            forPolicy(id) {
+                return request({ method: 'GET', path: `/v1/abac_policies/${(0, request_1.enc)(id)}/cedar_json` });
+            },
+        },
+        /** How access-token claims become a policy principal and its parents (used by {@link authorizeToken}). */
+        tokenMapping: {
+            get() {
+                return request({ method: 'GET', path: '/v1/abac/token_mapping' });
+            },
+            put(body) {
+                return request({ method: 'PUT', path: '/v1/abac/token_mapping', body });
+            },
+        },
+        /** Decide for the principal an access token stands for (verified first; an invalid token is a 401). */
+        authorizeToken(body) {
+            return request({ method: 'POST', path: '/v1/abac/authorize_token', body });
+        },
         /** May `principal` perform `action` on `resource`? */
         evaluate(body) {
             return request({ method: 'POST', path: '/v1/abac/evaluate', body });

package/dist/client/abac.js.map

@@ -1 +1 @@
-{"version":3,"file":"abac.js","sourceRoot":"","sources":["../../src/client/abac.ts"],"names":[],"mappings":";;;AA2UA,oCAqIC;AAhdD,uCAAgD;AA0UhD,qFAAqF;AACrF,SAAgB,YAAY,CAAC,OAAkB;IAC7C,OAAO;QACL,IAAI;YACF,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,mBAAmB,EAAE,CAAC,CAAC;QAC/D,CAAC;QACD,GAAG,CAAC,EAAU;YACZ,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,qBAAqB,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;QAC1E,CAAC;QACD,MAAM,CAAC,IAA0B,EAAE,cAAuB;YACxD,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,mBAAmB,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC;QACtF,CAAC;QACD,MAAM,CAAC,EAAU,EAAE,IAA0B;YAC3C,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,qBAAqB,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;QAClF,CAAC;QACD,MAAM,CAAC,EAAU;YACf,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,qBAAqB,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;QAC7E,CAAC;QACD,QAAQ,CAAC,EAAU;YACjB,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,qBAAqB,IAAA,aAAG,EAAC,EAAE,CAAC,WAAW,EAAE,CAAC,CAAC;QACnF,CAAC;QACD,iGAAiG;QACjG,IAAI,CAAC,EAAU,EAAE,OAA4E,EAAE;YAC7F,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,qBAAqB,IAAA,aAAG,EAAC,EAAE,CAAC,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;QACtF,CAAC;QACD,sDAAsD;QACtD,QAAQ,CAAC,IAAsB;YAC7B,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,mBAAmB,EAAE,IAAI,EAAE,CAAC,CAAC;QACtE,CAAC;QACD;;;WAGG;QACH,eAAe,CAAC,IAAqB;YACnC,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,2BAA2B,EAAE,IAAI,EAAE,CAAC,CAAC;QAC9E,CAAC;QACD,wFAAwF;QACxF,mBAAmB,CAAC,IAAwB;YAC1C,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,+BAA+B,EAAE,IAAI,EAAE,CAAC,CAAC;QAClF,CAAC;QACD,2GAA2G;QAC3G,SAAS,EAAE;YACT,IAAI;gBACF,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,oBAAoB,EAAE,CAAC,CAAC;YAChE,CAAC;YACD,GAAG,CAAC,EAAU;gBACZ,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,sBAAsB,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;YAC3E,CAAC;YACD,MAAM,CAAC,IAA4B,EAAE,cAAuB;gBAC1D,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,oBAAoB,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC;YACvF,CAAC;YACD,gIAAgI;YAChI,MAAM,CAAC,EAAU,EAAE,IAAqC;gBACtD,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,sBAAsB,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;YACnF,CAAC;YACD,qFAAqF;YACrF,MAAM,CAAC,EAAU,EAAE,OAA4B,EAAE;gBAC/C,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,sBAAsB,IAAA,aAAG,EAAC,EAAE,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;YAChH,CAAC;SACF;QACD,mHAAmH;QACnH,KAAK,EAAE;YACL,IAAI,CAAC,QAAkC,EAAE;gBACvC,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,wBAAwB,KAAK,CAAC,WAAW,CAAC,CAAC,CAAC,gBAAgB,IAAA,aAAG,EAAC,KAAK,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;YACvI,CAAC;YACD,GAAG,CAAC,EAAU;gBACZ,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,yBAAyB,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;YAC9E,CAAC;YACD,MAAM,CAAC,IAAwB,EAAE,cAAuB;gBACtD,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,uBAAuB,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC;YAC1F,CAAC;YACD,MAAM,CAAC,EAAU,EAAE,IAAsD;gBACvE,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,yBAAyB,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;YACtF,CAAC;YACD,MAAM,CAAC,EAAU;gBACf,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,yBAAyB,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;YACjF,CAAC;SACF;QACD,uFAAuF;QACvF,MAAM,EAAE;YACN,GAAG;gBACD,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,iBAAiB,EAAE,CAAC,CAAC;YAC7D,CAAC;YACD,2GAA2G;YAC3G,GAAG,CAAC,MAA0B;gBAC5B,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,iBAAiB,EAAE,IAAI,EAAE,EAAE,MAAM,EAAE,EAAE,CAAC,CAAC;YAC/E,CAAC;YACD,MAAM;gBACJ,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,iBAAiB,EAAE,CAAC,CAAC;YAChE,CAAC;YACD,8FAA8F;YAC9F,QAAQ,CAAC,IAAyE;gBAChF,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,0BAA0B,EAAE,IAAI,EAAE,CAAC,CAAC;YAC7E,CAAC;SACF;QACD,2FAA2F;QAC3F,IAAI,CAAC,EAAU,EAAE,OAAwB,EAAE;YACzC,MAAM,EAAE,GAAG,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC;iBAC5B,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,SAAS,CAAC;iBAClC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,kBAAkB,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;iBACxD,IAAI,CAAC,GAAG,CAAC,CAAC;YACb,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,qBAAqB,IAAA,aAAG,EAAC,EAAE,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;QACpG,CAAC;QACD,oEAAoE;QACpE,WAAW,CAAC,IAAwG;YAClH,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,eAAe,EAAE,IAAI,EAAE,CAAC,CAAC;QAClE,CAAC;QACD,sGAAsG;QACtG,oBAAoB,CAAC,IAA0B;YAC7C,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,sCAAsC,EAAE,IAAI,EAAE,CAAC,CAAC;QACzF,CAAC;QACD,kGAAkG;QAClG,qBAAqB,CAAC,IAA0B;YAC9C,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,uCAAuC,EAAE,IAAI,EAAE,CAAC,CAAC;QAC1F,CAAC;QACD,sFAAsF;QACtF,mBAAmB,CAAC,IAA0B;YAC5C,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,qCAAqC,EAAE,IAAI,EAAE,CAAC,CAAC;QACxF,CAAC;QACD,2DAA2D;QAC3D,KAAK,CAAC,SAAS,CAAC,IAAsB;YACpC,OAAO,CAAC,MAAM,OAAO,CAAe,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,mBAAmB,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,OAAO,CAAC;QACjH,CAAC;QACD,qCAAqC;QACrC,iBAAiB,CAAC,IAAuB;YACvC,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,kCAAkC,EAAE,IAAI,EAAE,CAAC,CAAC;QACrF,CAAC;QACD,8CAA8C;QAC9C,kBAAkB,CAChB,IAAqK;YAErK,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,mCAAmC,EAAE,IAAI,EAAE,CAAC,CAAC;QACtF,CAAC;KACF,CAAC;AACJ,CAAC;AAED,sGAAsG;AACtG,0CAe0B;AAdxB,2GAAA,kBAAkB,OAAA;AAClB,mGAAA,UAAU,OAAA;AACV,wGAAA,eAAe,OAAA;AACf,uGAAA,cAAc,OAAA;AACd,oGAAA,WAAW,OAAA"}
+{"version":3,"file":"abac.js","sourceRoot":"","sources":["../../src/client/abac.ts"],"names":[],"mappings":";;;AA6UA,oCA8JC;AA3eD,uCAAgD;AA4UhD,qFAAqF;AACrF,SAAgB,YAAY,CAAC,OAAkB;IAC7C,OAAO;QACL,IAAI;YACF,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,mBAAmB,EAAE,CAAC,CAAC;QAC/D,CAAC;QACD,GAAG,CAAC,EAAU;YACZ,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,qBAAqB,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;QAC1E,CAAC;QACD,MAAM,CAAC,IAA0B,EAAE,cAAuB;YACxD,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,mBAAmB,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC;QACtF,CAAC;QACD,MAAM,CAAC,EAAU,EAAE,IAA0B;YAC3C,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,qBAAqB,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;QAClF,CAAC;QACD,MAAM,CAAC,EAAU;YACf,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,qBAAqB,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;QAC7E,CAAC;QACD,QAAQ,CAAC,EAAU;YACjB,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,qBAAqB,IAAA,aAAG,EAAC,EAAE,CAAC,WAAW,EAAE,CAAC,CAAC;QACnF,CAAC;QACD,iGAAiG;QACjG,IAAI,CAAC,EAAU,EAAE,OAA4E,EAAE;YAC7F,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,qBAAqB,IAAA,aAAG,EAAC,EAAE,CAAC,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;QACtF,CAAC;QACD,8GAA8G;QAC9G,KAAK,EAAE;YACL,MAAM,CAAC,MAAc;gBACnB,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,uBAAuB,EAAE,IAAI,EAAE,EAAE,MAAM,EAAE,EAAE,CAAC,CAAC;YACtF,CAAC;YACD,MAAM,CAAC,IAA+F;gBACpG,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,uBAAuB,EAAE,IAAI,EAAE,CAAC,CAAC;YAC1E,CAAC;YACD,SAAS,CAAC,EAAU;gBAClB,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,qBAAqB,IAAA,aAAG,EAAC,EAAE,CAAC,aAAa,EAAE,CAAC,CAAC;YACrF,CAAC;SACF;QACD,0GAA0G;QAC1G,YAAY,EAAE;YACZ,GAAG;gBACD,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,wBAAwB,EAAE,CAAC,CAAC;YACpE,CAAC;YACD,GAAG,CAAC,IAA+C;gBACjD,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,wBAAwB,EAAE,IAAI,EAAE,CAAC,CAAC;YAC1E,CAAC;SACF;QACD,uGAAuG;QACvG,cAAc,CAAC,IAA+M;YAC5N,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,0BAA0B,EAAE,IAAI,EAAE,CAAC,CAAC;QAC7E,CAAC;QACD,sDAAsD;QACtD,QAAQ,CAAC,IAAsB;YAC7B,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,mBAAmB,EAAE,IAAI,EAAE,CAAC,CAAC;QACtE,CAAC;QACD;;;WAGG;QACH,eAAe,CAAC,IAAqB;YACnC,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,2BAA2B,EAAE,IAAI,EAAE,CAAC,CAAC;QAC9E,CAAC;QACD,wFAAwF;QACxF,mBAAmB,CAAC,IAAwB;YAC1C,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,+BAA+B,EAAE,IAAI,EAAE,CAAC,CAAC;QAClF,CAAC;QACD,2GAA2G;QAC3G,SAAS,EAAE;YACT,IAAI;gBACF,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,oBAAoB,EAAE,CAAC,CAAC;YAChE,CAAC;YACD,GAAG,CAAC,EAAU;gBACZ,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,sBAAsB,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;YAC3E,CAAC;YACD,MAAM,CAAC,IAA4B,EAAE,cAAuB;gBAC1D,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,oBAAoB,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC;YACvF,CAAC;YACD,gIAAgI;YAChI,MAAM,CAAC,EAAU,EAAE,IAAqC;gBACtD,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,sBAAsB,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;YACnF,CAAC;YACD,qFAAqF;YACrF,MAAM,CAAC,EAAU,EAAE,OAA4B,EAAE;gBAC/C,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,sBAAsB,IAAA,aAAG,EAAC,EAAE,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;YAChH,CAAC;SACF;QACD,mHAAmH;QACnH,KAAK,EAAE;YACL,IAAI,CAAC,QAAkC,EAAE;gBACvC,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,wBAAwB,KAAK,CAAC,WAAW,CAAC,CAAC,CAAC,gBAAgB,IAAA,aAAG,EAAC,KAAK,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;YACvI,CAAC;YACD,GAAG,CAAC,EAAU;gBACZ,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,yBAAyB,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;YAC9E,CAAC;YACD,MAAM,CAAC,IAAwB,EAAE,cAAuB;gBACtD,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,uBAAuB,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC;YAC1F,CAAC;YACD,MAAM,CAAC,EAAU,EAAE,IAAsD;gBACvE,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,yBAAyB,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;YACtF,CAAC;YACD,MAAM,CAAC,EAAU;gBACf,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,yBAAyB,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;YACjF,CAAC;SACF;QACD,uFAAuF;QACvF,MAAM,EAAE;YACN,GAAG;gBACD,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,iBAAiB,EAAE,CAAC,CAAC;YAC7D,CAAC;YACD,2GAA2G;YAC3G,GAAG,CAAC,MAA0B;gBAC5B,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,iBAAiB,EAAE,IAAI,EAAE,EAAE,MAAM,EAAE,EAAE,CAAC,CAAC;YAC/E,CAAC;YACD,MAAM;gBACJ,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,iBAAiB,EAAE,CAAC,CAAC;YAChE,CAAC;YACD,8FAA8F;YAC9F,QAAQ,CAAC,IAAyE;gBAChF,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,0BAA0B,EAAE,IAAI,EAAE,CAAC,CAAC;YAC7E,CAAC;SACF;QACD,2FAA2F;QAC3F,IAAI,CAAC,EAAU,EAAE,OAAwB,EAAE;YACzC,MAAM,EAAE,GAAG,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC;iBAC5B,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,SAAS,CAAC;iBAClC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,kBAAkB,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;iBACxD,IAAI,CAAC,GAAG,CAAC,CAAC;YACb,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,qBAAqB,IAAA,aAAG,EAAC,EAAE,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;QACpG,CAAC;QACD,oEAAoE;QACpE,WAAW,CAAC,IAAwG;YAClH,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,eAAe,EAAE,IAAI,EAAE,CAAC,CAAC;QAClE,CAAC;QACD,sGAAsG;QACtG,oBAAoB,CAAC,IAA0B;YAC7C,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,sCAAsC,EAAE,IAAI,EAAE,CAAC,CAAC;QACzF,CAAC;QACD,kGAAkG;QAClG,qBAAqB,CAAC,IAA0B;YAC9C,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,uCAAuC,EAAE,IAAI,EAAE,CAAC,CAAC;QAC1F,CAAC;QACD,sFAAsF;QACtF,mBAAmB,CAAC,IAA0B;YAC5C,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,qCAAqC,EAAE,IAAI,EAAE,CAAC,CAAC;QACxF,CAAC;QACD,2DAA2D;QAC3D,KAAK,CAAC,SAAS,CAAC,IAAsB;YACpC,OAAO,CAAC,MAAM,OAAO,CAAe,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,mBAAmB,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,OAAO,CAAC;QACjH,CAAC;QACD,qCAAqC;QACrC,iBAAiB,CAAC,IAAuB;YACvC,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,kCAAkC,EAAE,IAAI,EAAE,CAAC,CAAC;QACrF,CAAC;QACD,8CAA8C;QAC9C,kBAAkB,CAChB,IAAqK;YAErK,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,mCAAmC,EAAE,IAAI,EAAE,CAAC,CAAC;QACtF,CAAC;KACF,CAAC;AACJ,CAAC;AAED,sGAAsG;AACtG,0CAe0B;AAdxB,2GAAA,kBAAkB,OAAA;AAClB,mGAAA,UAAU,OAAA;AACV,wGAAA,eAAe,OAAA;AACf,uGAAA,cAAc,OAAA;AACd,oGAAA,WAAW,OAAA"}

package/dist/client/access-policies.d.ts

@@ -1,11 +1,18 @@
 import { type RequestFn } from './request';
 import type { ListPage } from './types';
 export type AccessPolicyStage = 'sign_in' | 'authorize' | 'token';
-export type AccessPolicyGrantType = 'allow' | 'block' | 'require_mfa' | 'require_acr' | 'require_policy_acceptance' | 'require_action';
+export type AccessPolicyGrantType = 'allow' | 'block' | 'require_mfa' | 'require_acr' | 'require_policy_acceptance' | 'require_action' | 'require_auth_strength' | 'require_device_bound_session' | 'require_password_change' | 'sign_in_frequency' | 'persistent_session' | 'max_session_age';
+export type AccessPolicyMode = 'enforce' | 'report_only';
+export type AccessPolicyTarget = 'user' | 'machine' | 'agent';
+export type AccessClientType = 'browser' | 'native' | 'legacy' | 'device_code' | 'ciba' | 'machine' | 'agent';
 export interface AccessPolicyGrant {
     type: AccessPolicyGrantType;
-    /** require_acr: the acr; require_policy_acceptance: the policy key; require_action: the action name. */
+    /** require_acr: the acr; require_policy_acceptance: the policy key; require_action: the action name; require_auth_strength: mfa | passwordless | phishing_resistant. */
     value?: string;
+    /** sign_in_frequency / max_session_age: the limit in seconds (60 to 31536000). */
+    seconds?: number;
+    /** persistent_session: false forbids a remembered session. */
+    allow?: boolean;
 }
 /** Every present condition must match; an absent one matches anything. */
 export interface AccessPolicyConditions {
@@ -28,6 +35,21 @@ export interface AccessPolicyConditions {
         end: string;
         timezone?: string;
     };
+    devicePlatforms?: string[];
+    osVersion?: {
+        min?: string;
+        max?: string;
+    };
+    clientTypes?: AccessClientType[];
+    userAttributes?: Array<{
+        key: string;
+        op: 'eq' | 'neq' | 'in' | 'not_in' | 'contains' | 'exists';
+        value?: unknown;
+    }>;
+    userRiskLevels?: Array<'low' | 'medium' | 'high'>;
+    signInRiskLevels?: Array<'low' | 'medium' | 'high'>;
+    /** Machine identity or agent ids (targets machine / agent). */
+    principalIds?: string[];
 }
 /** A conditional-access policy, evaluated at sign-in, /authorize and token issuance. */
 export interface AccessPolicy {
@@ -40,6 +62,9 @@ export interface AccessPolicy {
     stages: AccessPolicyStage[];
     conditions: AccessPolicyConditions;
     grants: AccessPolicyGrant[];
+    /** `report_only` never denies; it records `access_policy.would_block`. */
+    mode: AccessPolicyMode;
+    targets: AccessPolicyTarget[];
     created_at: number;
     updated_at: number;
 }
@@ -51,6 +76,8 @@ export interface CreateAccessPolicyBody {
     stages?: AccessPolicyStage[];
     conditions?: AccessPolicyConditions;
     grants: AccessPolicyGrant[];
+    mode?: AccessPolicyMode;
+    targets?: AccessPolicyTarget[];
 }
 export type UpdateAccessPolicyBody = Partial<CreateAccessPolicyBody>;
 export interface SimulateAccessBody {
@@ -70,6 +97,42 @@ export interface SimulateAccessBody {
     acr?: string[];
     /** Epoch ms; default now. */
     now?: number;
+    target_type?: AccessPolicyTarget;
+    principal_id?: string;
+    device_platform?: string;
+    os_version?: string;
+    client_type?: AccessClientType;
+    user_attributes?: Record<string, unknown>;
+    user_risk_level?: 'low' | 'medium' | 'high';
+    last_auth_age_seconds?: number;
+    session_age_seconds?: number;
+    device_bound_session?: boolean;
+}
+export interface AccessPolicyImpact {
+    object: 'access_policy_impact';
+    days: number;
+    evaluated: number;
+    would_allow: number;
+    would_step_up: number;
+    would_block: number;
+    distinct_users: number;
+    affected_users: number;
+    samples: Array<{
+        user_id: string | null;
+        stage: string;
+        outcome: string;
+        unmet: string[];
+        at: number;
+    }>;
+}
+export interface AccessPolicyInsights {
+    object: 'access_policy_insights';
+    days: number;
+    evaluated: number;
+    would_block: number;
+    would_step_up: number;
+    by_policy: Record<string, number>;
+    by_day: Record<string, number>;
 }
 export interface AccessPolicySimulation {
     object: 'access_policy_simulation';
@@ -81,8 +144,18 @@ export interface AccessPolicySimulation {
         acr: string[];
         policy_acceptance: string[];
         actions: string[];
+        auth_strength: 'mfa' | 'passwordless' | 'phishing_resistant' | null;
+        sign_in_frequency_seconds: number | null;
+        max_session_age_seconds: number | null;
+        persistent_session: boolean;
+        device_bound_session: boolean;
     };
     unmet: string[];
+    report_only: {
+        decision: 'allow' | 'block' | 'step_up';
+        matched: string[];
+        blocked_by: string | null;
+    } | null;
 }
 /** CRUD over conditional-access policies, plus a what-if `simulate`. */
 export declare function accessPoliciesResource(request: RequestFn): {
@@ -95,6 +168,15 @@ export declare function accessPoliciesResource(request: RequestFn): {
         id: string;
         deleted: true;
     }>;
+    /** Replay a draft policy against recent sampled sign-ins: how many would be allowed, stepped up or blocked. */
+    impact(body: {
+        draft: CreateAccessPolicyBody | Record<string, unknown>;
+        days?: number;
+    }): Promise<AccessPolicyImpact>;
+    /** How often report-only policies would have intervened. */
+    insights(query?: {
+        days?: number;
+    }): Promise<AccessPolicyInsights>;
     /** What would the policies decide for this request? */
     simulate(body: SimulateAccessBody): Promise<AccessPolicySimulation>;
 };

package/dist/client/access-policies.js

@@ -20,6 +20,14 @@ function accessPoliciesResource(request) {
         delete(id) {
             return request({ method: 'DELETE', path: `/v1/access_policies/${(0, request_1.enc)(id)}` });
         },
+        /** Replay a draft policy against recent sampled sign-ins: how many would be allowed, stepped up or blocked. */
+        impact(body) {
+            return request({ method: 'POST', path: '/v1/access_policies/impact', body });
+        },
+        /** How often report-only policies would have intervened. */
+        insights(query = {}) {
+            return request({ method: 'GET', path: `/v1/access_policies/insights${query.days ? `?days=${query.days}` : ''}` });
+        },
         /** What would the policies decide for this request? */
         simulate(body) {
             return request({ method: 'POST', path: '/v1/access_policies/simulate', body });

package/dist/client/access-policies.js.map

@@ -1 +1 @@
-{"version":3,"file":"access-policies.js","sourceRoot":"","sources":["../../src/client/access-policies.ts"],"names":[],"mappings":";;AAmFA,wDAsBC;AAzGD,uCAAgD;AAkFhD,wEAAwE;AACxE,SAAgB,sBAAsB,CAAC,OAAkB;IACvD,OAAO;QACL,IAAI;YACF,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,qBAAqB,EAAE,CAAC,CAAC;QACjE,CAAC;QACD,GAAG,CAAC,EAAU;YACZ,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,uBAAuB,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;QAC5E,CAAC;QACD,MAAM,CAAC,IAA4B,EAAE,cAAuB;YAC1D,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,qBAAqB,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC;QACxF,CAAC;QACD,MAAM,CAAC,EAAU,EAAE,IAA4B;YAC7C,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,uBAAuB,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;QACpF,CAAC;QACD,MAAM,CAAC,EAAU;YACf,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,uBAAuB,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;QAC/E,CAAC;QACD,uDAAuD;QACvD,QAAQ,CAAC,IAAwB;YAC/B,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,8BAA8B,EAAE,IAAI,EAAE,CAAC,CAAC;QACjF,CAAC;KACF,CAAC;AACJ,CAAC"}
+{"version":3,"file":"access-policies.js","sourceRoot":"","sources":["../../src/client/access-policies.ts"],"names":[],"mappings":";;AA8JA,wDA8BC;AA5LD,uCAAgD;AA6JhD,wEAAwE;AACxE,SAAgB,sBAAsB,CAAC,OAAkB;IACvD,OAAO;QACL,IAAI;YACF,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,qBAAqB,EAAE,CAAC,CAAC;QACjE,CAAC;QACD,GAAG,CAAC,EAAU;YACZ,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,uBAAuB,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;QAC5E,CAAC;QACD,MAAM,CAAC,IAA4B,EAAE,cAAuB;YAC1D,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,qBAAqB,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC;QACxF,CAAC;QACD,MAAM,CAAC,EAAU,EAAE,IAA4B;YAC7C,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,uBAAuB,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;QACpF,CAAC;QACD,MAAM,CAAC,EAAU;YACf,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,uBAAuB,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;QAC/E,CAAC;QACD,+GAA+G;QAC/G,MAAM,CAAC,IAAgF;YACrF,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,4BAA4B,EAAE,IAAI,EAAE,CAAC,CAAC;QAC/E,CAAC;QACD,4DAA4D;QAC5D,QAAQ,CAAC,QAA2B,EAAE;YACpC,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,+BAA+B,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;QACpH,CAAC;QACD,uDAAuD;QACvD,QAAQ,CAAC,IAAwB;YAC/B,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,8BAA8B,EAAE,IAAI,EAAE,CAAC,CAAC;QACjF,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/client/actions.d.ts

@@ -1,7 +1,7 @@
 import { type RequestFn } from './request';
 import type { ListPage } from './types';
 /** The fixed point in the auth pipeline an action runs at. */
-export type ActionTrigger = 'post_login' | 'pre_user_registration' | 'post_user_registration' | 'pre_organization_create' | 'pre_member_add' | 'pre_invitation_create' | 'pre_authentication' | 'pre_token' | 'post_token_exchange' | 'pre_user_update' | 'mfa_verification_attempt' | 'password_verification_attempt' | 'account_link_decision' | 'billing_plan_selected' | 'post_change_password' | 'post_password_reset' | 'post_user_update' | 'post_email_verified' | 'post_mfa_enroll' | 'post_mfa_remove' | 'post_logout' | 'org_membership_changed' | 'custom_challenge_create' | 'custom_challenge_verify' | 'workflow_step';
+export type ActionTrigger = 'post_login' | 'pre_user_registration' | 'post_user_registration' | 'pre_organization_create' | 'pre_member_add' | 'pre_invitation_create' | 'pre_authentication' | 'pre_token' | 'post_token_exchange' | 'custom_token_exchange' | 'pre_user_update' | 'mfa_verification_attempt' | 'password_verification_attempt' | 'account_link_decision' | 'billing_plan_selected' | 'post_change_password' | 'post_password_reset' | 'post_user_update' | 'post_email_verified' | 'post_mfa_enroll' | 'post_mfa_remove' | 'post_logout' | 'org_membership_changed' | 'custom_challenge_create' | 'custom_challenge_verify' | 'workflow_step';
 /**
  * Tenant code run in the hardened isolate at a trigger. Secret VALUES are
  * write-only and never returned — a read reports only `secret_names`. Timestamps

package/dist/client/actions.js.map

@@ -1 +1 @@
-{"version":3,"file":"actions.js","sourceRoot":"","sources":["../../src/client/actions.ts"],"names":[],"mappings":";;AA8MA,0CAyCC;AAvPD,uCAAgD;AA8MhD,SAAgB,eAAe,CAAC,OAAkB;IAChD,OAAO;QACL,IAAI;YACF,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,aAAa,EAAE,CAAC,CAAC;QACzD,CAAC;QACD,MAAM,CAAC,IAAsB,EAAE,cAAuB;YACpD,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,aAAa,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC;QAChF,CAAC;QACD,GAAG,CAAC,EAAU;YACZ,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,eAAe,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;QACpE,CAAC;QACD,MAAM,CAAC,EAAU,EAAE,IAAsB;YACvC,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,eAAe,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;QAC5E,CAAC;QACD,MAAM,CAAC,EAAU;YACf,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,eAAe,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;QACvE,CAAC;QACD,2EAA2E;QAC3E,IAAI,CAAC,EAAU,EAAE,QAAyB,EAAE;YAC1C,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,eAAe,IAAA,aAAG,EAAC,EAAE,CAAC,OAAO,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC;QAC3F,CAAC;QACD,0EAA0E;QAC1E,KAAK,CACH,EAAU,EACV,QAAqJ,EAAE;YAEvJ,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,eAAe,IAAA,aAAG,EAAC,EAAE,CAAC,QAAQ,EAAE,KAAK,EAAE,CAAC,CAAC;QACjF,CAAC;QACD,oDAAoD;QACpD,WAAW,CAAC,OAAsB;YAChC,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,wBAAwB,IAAA,aAAG,EAAC,OAAO,CAAC,EAAE,EAAE,CAAC,CAAC;QAClF,CAAC;QACD,+CAA+C;QAC/C,WAAW,CAAC,OAAsB,EAAE,SAAmB;YACrD,OAAO,OAAO,CAAC;gBACb,MAAM,EAAE,KAAK;gBACb,IAAI,EAAE,wBAAwB,IAAA,aAAG,EAAC,OAAO,CAAC,EAAE;gBAC5C,IAAI,EAAE,EAAE,UAAU,EAAE,SAAS,EAAE;aAChC,CAAC,CAAC;QACL,CAAC;KACF,CAAC;AACJ,CAAC"}
+{"version":3,"file":"actions.js","sourceRoot":"","sources":["../../src/client/actions.ts"],"names":[],"mappings":";;AA+MA,0CAyCC;AAxPD,uCAAgD;AA+MhD,SAAgB,eAAe,CAAC,OAAkB;IAChD,OAAO;QACL,IAAI;YACF,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,aAAa,EAAE,CAAC,CAAC;QACzD,CAAC;QACD,MAAM,CAAC,IAAsB,EAAE,cAAuB;YACpD,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,aAAa,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC;QAChF,CAAC;QACD,GAAG,CAAC,EAAU;YACZ,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,eAAe,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;QACpE,CAAC;QACD,MAAM,CAAC,EAAU,EAAE,IAAsB;YACvC,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,eAAe,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;QAC5E,CAAC;QACD,MAAM,CAAC,EAAU;YACf,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,eAAe,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;QACvE,CAAC;QACD,2EAA2E;QAC3E,IAAI,CAAC,EAAU,EAAE,QAAyB,EAAE;YAC1C,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,eAAe,IAAA,aAAG,EAAC,EAAE,CAAC,OAAO,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC;QAC3F,CAAC;QACD,0EAA0E;QAC1E,KAAK,CACH,EAAU,EACV,QAAqJ,EAAE;YAEvJ,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,eAAe,IAAA,aAAG,EAAC,EAAE,CAAC,QAAQ,EAAE,KAAK,EAAE,CAAC,CAAC;QACjF,CAAC;QACD,oDAAoD;QACpD,WAAW,CAAC,OAAsB;YAChC,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,wBAAwB,IAAA,aAAG,EAAC,OAAO,CAAC,EAAE,EAAE,CAAC,CAAC;QAClF,CAAC;QACD,+CAA+C;QAC/C,WAAW,CAAC,OAAsB,EAAE,SAAmB;YACrD,OAAO,OAAO,CAAC;gBACb,MAAM,EAAE,KAAK;gBACb,IAAI,EAAE,wBAAwB,IAAA,aAAG,EAAC,OAAO,CAAC,EAAE;gBAC5C,IAAI,EAAE,EAAE,UAAU,EAAE,SAAS,EAAE;aAChC,CAAC,CAAC;QACL,CAAC;KACF,CAAC;AACJ,CAAC"}