@atlasauth/backend 0.26.0 → 0.27.1

package/dist/client/connections.d.ts

@@ -445,6 +445,18 @@ export declare function connectionsResource(request: RequestFn): {
         staleAccessToken?: string;
         reason?: "provider_401" | "expired" | "manual";
     }): Promise<ConnectionToken>;
+    /**
+     * A token limited to a subset of the granted scopes, for a less-trusted caller. Not cached and never replaces the
+     * connection's own token. Refused with 422 `invalid_scope` or `downscope_unsupported` (the provider cannot narrow).
+     */
+    downscopeToken(id: string, scopes: string[]): Promise<{
+        object: "connection_token";
+        connection_id: string;
+        access_token: string;
+        expires_at: number | null;
+        scopes: string[];
+        downscoped: true;
+    }>;
     /** Read up to 100 connections' tokens in one call. Each id has its own result, so one dead connection does not fail the rest. */
     tokens(ids: string[], options?: {
         minTtlSeconds?: number;

package/dist/client/connections.js

@@ -79,6 +79,13 @@ function connectionsResource(request) {
             });
             return remember(t);
         },
+        /**
+         * A token limited to a subset of the granted scopes, for a less-trusted caller. Not cached and never replaces the
+         * connection's own token. Refused with 422 `invalid_scope` or `downscope_unsupported` (the provider cannot narrow).
+         */
+        downscopeToken(id, scopes) {
+            return request({ method: 'POST', path: `/v1/connections/${(0, request_1.enc)(id)}/token/downscope`, body: { scopes } });
+        },
         /** Read up to 100 connections' tokens in one call. Each id has its own result, so one dead connection does not fail the rest. */
         async tokens(ids, options = {}) {
             const r = await request({

package/dist/client/connections.js.map

@@ -1 +1 @@
-{"version":3,"file":"connections.js","sourceRoot":"","sources":["../../src/client/connections.ts"],"names":[],"mappings":";;AA2YA,kDAoJC;AA/hBD,uCAAgD;AAsRhD,MAAM,OAAO,GAAG,MAAM,CAAC;AAEvB,KAAK,UAAU,SAAS,CAAC,IAAY;IACnC,MAAM,CAAC,GAAG,MAAM,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;IAC3F,OAAO,CAAC,GAAG,IAAI,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;AACrF,CAAC;AA+GD,uEAAuE;AACvE,SAAgB,mBAAmB,CAAC,OAAkB;IACpD,+HAA+H;IAC/H,MAAM,KAAK,GAAG,IAAI,GAAG,EAA2B,CAAC;IACjD,MAAM,IAAI,GAAG,CAAC,CAA8B,EAAE,aAAqB,EAAwB,EAAE,CAC3F,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,UAAU,KAAK,IAAI,IAAI,CAAC,CAAC,UAAU,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,GAAG,CAAC,aAAa,GAAG,IAAI,EAAE,OAAO,CAAC,CAAC;IACtG,MAAM,QAAQ,GAAG,CAAC,CAAkB,EAAmB,EAAE;QACvD,IAAI,CAAC,CAAC,UAAU,KAAK,IAAI;YAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC;;YACpD,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC;QACnC,OAAO,CAAC,CAAC;IACX,CAAC,CAAC;IACF,OAAO;QACL,MAAM,CAAC,IAA0B,EAAE,cAAuB;YACxD,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,iBAAiB,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC;QACpF,CAAC;QACD,IAAI,CAAC,SAAgC,EAAE;YACrC,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,iBAAiB,EAAE,KAAK,EAAE,EAAE,GAAG,MAAM,EAAE,EAAE,CAAC,CAAC;QACnF,CAAC;QACD,GAAG,CAAC,EAAU;YACZ,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,mBAAmB,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;QACxE,CAAC;QACD,MAAM,CAAC,EAAU,EAAE,IAA0B;YAC3C,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,mBAAmB,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;QAChF,CAAC;QACD,2GAA2G;QAC3G,MAAM,CAA4B,EAAU,EAAE,UAA0B,EAAE;YACxE,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;YACjB,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,mBAAmB,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,KAAK,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC;QACnI,CAAC;QACD,+EAA+E;QAC/E,OAAO,CAAC,EAAU,EAAE,IAA2B;YAC7C,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,mBAAmB,IAAA,aAAG,EAAC,EAAE,CAAC,UAAU,EAAE,IAAI,EAAE,CAAC,CAAC;QACvF,CAAC;QACD,uHAAuH;QACvH,MAAM,CAAC,EAAU;YACf,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;YACjB,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,mBAAmB,IAAA,aAAG,EAAC,EAAE,CAAC,SAAS,EAAE,CAAC,CAAC;QAChF,CAAC;QACD;;;;WAIG;QACH,KAAK,CAAC,KAAK,CAAC,EAAU,EAAE,UAA4B,EAAE;YACpD,MAAM,MAAM,GAAG,OAAO,CAAC,aAAa,IAAI,CAAC,CAAC;YAC1C,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YAC1B,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC;gBACpB,OAAO,OAAO,CAAkB,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,mBAAmB,IAAA,aAAG,EAAC,EAAE,CAAC,QAAQ,EAAE,KAAK,EAAE,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;YACrL,CAAC;YACD,IAAI,CAAC,OAAO,CAAC,OAAO,IAAI,CAAC,OAAO,CAAC,OAAO,IAAI,IAAI,CAAC,GAAG,EAAE,MAAM,CAAC;gBAAE,OAAO,EAAE,GAAG,GAAG,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC;YACnG,MAAM,CAAC,GAAG,MAAM,OAAO,CAAkB;gBACvC,MAAM,EAAE,KAAK;gBACb,IAAI,EAAE,mBAAmB,IAAA,aAAG,EAAC,EAAE,CAAC,QAAQ;gBACxC,KAAK,EAAE,EAAE,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE;aACnH,CAAC,CAAC;YACH,OAAO,QAAQ,CAAC,CAAC,CAAC,CAAC;QACrB,CAAC;QACD;;;WAGG;QACH,KAAK,CAAC,YAAY,CAAC,EAAU,EAAE,UAAyF,EAAE;YACxH,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;YACjB,MAAM,CAAC,GAAG,MAAM,OAAO,CAAkB;gBACvC,MAAM,EAAE,MAAM;gBACd,IAAI,EAAE,mBAAmB,IAAA,aAAG,EAAC,EAAE,CAAC,gBAAgB;gBAChD,IAAI,EAAE,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,IAAI,cAAc,EAAE,GAAG,CAAC,OAAO,CAAC,gBAAgB,CAAC,CAAC,CAAC,EAAE,gBAAgB,EAAE,MAAM,SAAS,CAAC,OAAO,CAAC,gBAAgB,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE;aACzJ,CAAC,CAAC;YACH,OAAO,QAAQ,CAAC,CAAC,CAAC,CAAC;QACrB,CAAC;QACD,iIAAiI;QACjI,KAAK,CAAC,MAAM,CAAC,GAAa,EAAE,UAAsC,EAAE;YAClE,MAAM,CAAC,GAAG,MAAM,OAAO,CAAwE;gBAC7F,MAAM,EAAE,MAAM;gBACd,IAAI,EAAE,8BAA8B;gBACpC,IAAI,EAAE,EAAE,GAAG,EAAE,GAAG,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,OAAO,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE;aAC5F,CAAC,CAAC;YACH,KAAK,MAAM,IAAI,IAAI,CAAC,CAAC,IAAI;gBAAE,IAAI,IAAI,CAAC,MAAM,KAAK,IAAI,IAAI,IAAI,CAAC,KAAK;oBAAE,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YACxF,OAAO,CAAC,CAAC;QACX,CAAC;QACD,+GAA+G;QAC/G,iBAAiB,CAAC,IAA2B,EAAE,cAAuB;YACpE,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,wBAAwB,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC;QAC3F,CAAC;QACD;;;WAGG;QACH,iBAAiB,CAAC,OAA8B,EAAE;YAChD,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,wBAAwB,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,CAAC,eAAe,CAAC,CAAC,CAAC,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC;QAChK,CAAC;QACD,wGAAwG;QACxG,cAAc,CAAC,EAAU,EAAE,IAAkC;YAC3D,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,mBAAmB,IAAA,aAAG,EAAC,EAAE,CAAC,cAAc,EAAE,IAAI,EAAE,CAAC,CAAC;QAC1F,CAAC;QACD,qFAAqF;QACrF,iBAAiB,CAAC,EAAU,EAAE,IAAqC;YACjE,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,mBAAmB,IAAA,aAAG,EAAC,EAAE,CAAC,qBAAqB,EAAE,IAAI,EAAE,CAAC,CAAC;QAClG,CAAC;QACD,yEAAyE;QACzE,cAAc,CAAC,EAAU;YACvB,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,mBAAmB,IAAA,aAAG,EAAC,EAAE,CAAC,uBAAuB,EAAE,CAAC,CAAC;QAC7F,CAAC;QACD;;;;WAIG;QACH,MAAM,CAAC,EAAU,EAAE,UAAkF,EAAE;YACrG,MAAM,IAAI,GAAG,OAAO,CAAC,cAAc,CAAC,CAAC,CAAC,qBAAqB,IAAA,aAAG,EAAC,OAAO,CAAC,cAAc,CAAC,gBAAgB,IAAA,aAAG,EAAC,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC,mBAAmB,IAAA,aAAG,EAAC,EAAE,CAAC,SAAS,CAAC;YAC7J,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,EAAE,CAAC,CAAC;QACnI,CAAC;QACD,sFAAsF;QACtF,UAAU,CAAC,EAAU,EAAE,IAA4E;YACjG,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,mBAAmB,IAAA,aAAG,EAAC,EAAE,CAAC,cAAc,EAAE,IAAI,EAAE,CAAC,CAAC;QAC3F,CAAC;QACD,QAAQ,EAAE;YACR,gFAAgF;YAChF,MAAM,CAAC,EAAU,EAAE,IAAiC;gBAClD,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,mBAAmB,IAAA,aAAG,EAAC,EAAE,CAAC,kBAAkB,EAAE,IAAI,EAAE,CAAC,CAAC;YAC/F,CAAC;YACD,cAAc,CAAC,EAAU,EAAE,IAAyC;gBAClE,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,mBAAmB,IAAA,aAAG,EAAC,EAAE,CAAC,oBAAoB,EAAE,IAAI,EAAE,CAAC,CAAC;YACjG,CAAC;YACD,aAAa,CAAC,EAAU;gBACtB,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,mBAAmB,IAAA,aAAG,EAAC,EAAE,CAAC,oBAAoB,EAAE,CAAC,CAAC;YAC1F,CAAC;YACD,cAAc,CAAC,EAAU,EAAE,UAAkB,EAAE,IAA0E;gBACvH,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,mBAAmB,IAAA,aAAG,EAAC,EAAE,CAAC,sBAAsB,IAAA,aAAG,EAAC,UAAU,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;YACrH,CAAC;YACD,cAAc,CAAC,EAAU,EAAE,UAAkB;gBAC3C,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,mBAAmB,IAAA,aAAG,EAAC,EAAE,CAAC,sBAAsB,IAAA,aAAG,EAAC,UAAU,CAAC,EAAE,EAAE,CAAC,CAAC;YAChH,CAAC;SACF;QACD,YAAY,EAAE;YACZ,GAAG,CAAC,IAAkC;gBACpC,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,+BAA+B,EAAE,IAAI,EAAE,CAAC,CAAC;YACjF,CAAC;YACD,IAAI,CAAC,SAAqF,EAAE;gBAC1F,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,+BAA+B,EAAE,KAAK,EAAE,EAAE,GAAG,MAAM,EAAE,EAAE,CAAC,CAAC;YACjG,CAAC;YACD,GAAG,CAAC,EAAU;gBACZ,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,iCAAiC,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;YACtF,CAAC;YACD,MAAM,CAAC,EAAU;gBACf,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,iCAAiC,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;YACzF,CAAC;SACF;KACF,CAAC;AACJ,CAAC"}
+{"version":3,"file":"connections.js","sourceRoot":"","sources":["../../src/client/connections.ts"],"names":[],"mappings":";;AA2YA,kDA2JC;AAtiBD,uCAAgD;AAsRhD,MAAM,OAAO,GAAG,MAAM,CAAC;AAEvB,KAAK,UAAU,SAAS,CAAC,IAAY;IACnC,MAAM,CAAC,GAAG,MAAM,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;IAC3F,OAAO,CAAC,GAAG,IAAI,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;AACrF,CAAC;AA+GD,uEAAuE;AACvE,SAAgB,mBAAmB,CAAC,OAAkB;IACpD,+HAA+H;IAC/H,MAAM,KAAK,GAAG,IAAI,GAAG,EAA2B,CAAC;IACjD,MAAM,IAAI,GAAG,CAAC,CAA8B,EAAE,aAAqB,EAAwB,EAAE,CAC3F,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,UAAU,KAAK,IAAI,IAAI,CAAC,CAAC,UAAU,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,GAAG,CAAC,aAAa,GAAG,IAAI,EAAE,OAAO,CAAC,CAAC;IACtG,MAAM,QAAQ,GAAG,CAAC,CAAkB,EAAmB,EAAE;QACvD,IAAI,CAAC,CAAC,UAAU,KAAK,IAAI;YAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC;;YACpD,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC;QACnC,OAAO,CAAC,CAAC;IACX,CAAC,CAAC;IACF,OAAO;QACL,MAAM,CAAC,IAA0B,EAAE,cAAuB;YACxD,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,iBAAiB,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC;QACpF,CAAC;QACD,IAAI,CAAC,SAAgC,EAAE;YACrC,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,iBAAiB,EAAE,KAAK,EAAE,EAAE,GAAG,MAAM,EAAE,EAAE,CAAC,CAAC;QACnF,CAAC;QACD,GAAG,CAAC,EAAU;YACZ,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,mBAAmB,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;QACxE,CAAC;QACD,MAAM,CAAC,EAAU,EAAE,IAA0B;YAC3C,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,mBAAmB,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;QAChF,CAAC;QACD,2GAA2G;QAC3G,MAAM,CAA4B,EAAU,EAAE,UAA0B,EAAE;YACxE,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;YACjB,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,mBAAmB,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,KAAK,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC;QACnI,CAAC;QACD,+EAA+E;QAC/E,OAAO,CAAC,EAAU,EAAE,IAA2B;YAC7C,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,mBAAmB,IAAA,aAAG,EAAC,EAAE,CAAC,UAAU,EAAE,IAAI,EAAE,CAAC,CAAC;QACvF,CAAC;QACD,uHAAuH;QACvH,MAAM,CAAC,EAAU;YACf,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;YACjB,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,mBAAmB,IAAA,aAAG,EAAC,EAAE,CAAC,SAAS,EAAE,CAAC,CAAC;QAChF,CAAC;QACD;;;;WAIG;QACH,KAAK,CAAC,KAAK,CAAC,EAAU,EAAE,UAA4B,EAAE;YACpD,MAAM,MAAM,GAAG,OAAO,CAAC,aAAa,IAAI,CAAC,CAAC;YAC1C,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YAC1B,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC;gBACpB,OAAO,OAAO,CAAkB,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,mBAAmB,IAAA,aAAG,EAAC,EAAE,CAAC,QAAQ,EAAE,KAAK,EAAE,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;YACrL,CAAC;YACD,IAAI,CAAC,OAAO,CAAC,OAAO,IAAI,CAAC,OAAO,CAAC,OAAO,IAAI,IAAI,CAAC,GAAG,EAAE,MAAM,CAAC;gBAAE,OAAO,EAAE,GAAG,GAAG,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC;YACnG,MAAM,CAAC,GAAG,MAAM,OAAO,CAAkB;gBACvC,MAAM,EAAE,KAAK;gBACb,IAAI,EAAE,mBAAmB,IAAA,aAAG,EAAC,EAAE,CAAC,QAAQ;gBACxC,KAAK,EAAE,EAAE,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE;aACnH,CAAC,CAAC;YACH,OAAO,QAAQ,CAAC,CAAC,CAAC,CAAC;QACrB,CAAC;QACD;;;WAGG;QACH,KAAK,CAAC,YAAY,CAAC,EAAU,EAAE,UAAyF,EAAE;YACxH,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;YACjB,MAAM,CAAC,GAAG,MAAM,OAAO,CAAkB;gBACvC,MAAM,EAAE,MAAM;gBACd,IAAI,EAAE,mBAAmB,IAAA,aAAG,EAAC,EAAE,CAAC,gBAAgB;gBAChD,IAAI,EAAE,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,IAAI,cAAc,EAAE,GAAG,CAAC,OAAO,CAAC,gBAAgB,CAAC,CAAC,CAAC,EAAE,gBAAgB,EAAE,MAAM,SAAS,CAAC,OAAO,CAAC,gBAAgB,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE;aACzJ,CAAC,CAAC;YACH,OAAO,QAAQ,CAAC,CAAC,CAAC,CAAC;QACrB,CAAC;QACD;;;WAGG;QACH,cAAc,CAAC,EAAU,EAAE,MAAgB;YACzC,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,mBAAmB,IAAA,aAAG,EAAC,EAAE,CAAC,kBAAkB,EAAE,IAAI,EAAE,EAAE,MAAM,EAAE,EAAE,CAAC,CAAC;QAC3G,CAAC;QACD,iIAAiI;QACjI,KAAK,CAAC,MAAM,CAAC,GAAa,EAAE,UAAsC,EAAE;YAClE,MAAM,CAAC,GAAG,MAAM,OAAO,CAAwE;gBAC7F,MAAM,EAAE,MAAM;gBACd,IAAI,EAAE,8BAA8B;gBACpC,IAAI,EAAE,EAAE,GAAG,EAAE,GAAG,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,OAAO,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE;aAC5F,CAAC,CAAC;YACH,KAAK,MAAM,IAAI,IAAI,CAAC,CAAC,IAAI;gBAAE,IAAI,IAAI,CAAC,MAAM,KAAK,IAAI,IAAI,IAAI,CAAC,KAAK;oBAAE,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YACxF,OAAO,CAAC,CAAC;QACX,CAAC;QACD,+GAA+G;QAC/G,iBAAiB,CAAC,IAA2B,EAAE,cAAuB;YACpE,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,wBAAwB,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC;QAC3F,CAAC;QACD;;;WAGG;QACH,iBAAiB,CAAC,OAA8B,EAAE;YAChD,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,wBAAwB,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,CAAC,eAAe,CAAC,CAAC,CAAC,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC;QAChK,CAAC;QACD,wGAAwG;QACxG,cAAc,CAAC,EAAU,EAAE,IAAkC;YAC3D,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,mBAAmB,IAAA,aAAG,EAAC,EAAE,CAAC,cAAc,EAAE,IAAI,EAAE,CAAC,CAAC;QAC1F,CAAC;QACD,qFAAqF;QACrF,iBAAiB,CAAC,EAAU,EAAE,IAAqC;YACjE,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,mBAAmB,IAAA,aAAG,EAAC,EAAE,CAAC,qBAAqB,EAAE,IAAI,EAAE,CAAC,CAAC;QAClG,CAAC;QACD,yEAAyE;QACzE,cAAc,CAAC,EAAU;YACvB,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,mBAAmB,IAAA,aAAG,EAAC,EAAE,CAAC,uBAAuB,EAAE,CAAC,CAAC;QAC7F,CAAC;QACD;;;;WAIG;QACH,MAAM,CAAC,EAAU,EAAE,UAAkF,EAAE;YACrG,MAAM,IAAI,GAAG,OAAO,CAAC,cAAc,CAAC,CAAC,CAAC,qBAAqB,IAAA,aAAG,EAAC,OAAO,CAAC,cAAc,CAAC,gBAAgB,IAAA,aAAG,EAAC,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC,mBAAmB,IAAA,aAAG,EAAC,EAAE,CAAC,SAAS,CAAC;YAC7J,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,EAAE,CAAC,CAAC;QACnI,CAAC;QACD,sFAAsF;QACtF,UAAU,CAAC,EAAU,EAAE,IAA4E;YACjG,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,mBAAmB,IAAA,aAAG,EAAC,EAAE,CAAC,cAAc,EAAE,IAAI,EAAE,CAAC,CAAC;QAC3F,CAAC;QACD,QAAQ,EAAE;YACR,gFAAgF;YAChF,MAAM,CAAC,EAAU,EAAE,IAAiC;gBAClD,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,mBAAmB,IAAA,aAAG,EAAC,EAAE,CAAC,kBAAkB,EAAE,IAAI,EAAE,CAAC,CAAC;YAC/F,CAAC;YACD,cAAc,CAAC,EAAU,EAAE,IAAyC;gBAClE,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,mBAAmB,IAAA,aAAG,EAAC,EAAE,CAAC,oBAAoB,EAAE,IAAI,EAAE,CAAC,CAAC;YACjG,CAAC;YACD,aAAa,CAAC,EAAU;gBACtB,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,mBAAmB,IAAA,aAAG,EAAC,EAAE,CAAC,oBAAoB,EAAE,CAAC,CAAC;YAC1F,CAAC;YACD,cAAc,CAAC,EAAU,EAAE,UAAkB,EAAE,IAA0E;gBACvH,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,mBAAmB,IAAA,aAAG,EAAC,EAAE,CAAC,sBAAsB,IAAA,aAAG,EAAC,UAAU,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;YACrH,CAAC;YACD,cAAc,CAAC,EAAU,EAAE,UAAkB;gBAC3C,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,mBAAmB,IAAA,aAAG,EAAC,EAAE,CAAC,sBAAsB,IAAA,aAAG,EAAC,UAAU,CAAC,EAAE,EAAE,CAAC,CAAC;YAChH,CAAC;SACF;QACD,YAAY,EAAE;YACZ,GAAG,CAAC,IAAkC;gBACpC,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,+BAA+B,EAAE,IAAI,EAAE,CAAC,CAAC;YACjF,CAAC;YACD,IAAI,CAAC,SAAqF,EAAE;gBAC1F,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,+BAA+B,EAAE,KAAK,EAAE,EAAE,GAAG,MAAM,EAAE,EAAE,CAAC,CAAC;YACjG,CAAC;YACD,GAAG,CAAC,EAAU;gBACZ,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,iCAAiC,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;YACtF,CAAC;YACD,MAAM,CAAC,EAAU;gBACf,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,iCAAiC,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;YACzF,CAAC;SACF;KACF,CAAC;AACJ,CAAC"}

package/dist/client/desktop-mfa.d.ts

@@ -16,6 +16,27 @@ export interface DesktopMfaPolicy {
     /** Relying-party domain the agents use; null uses the application's passkey RP id. */
     passkey_rp_id: string | null;
     passkey_require_uv: boolean;
+    /** Device-bound SSO (macOS Platform SSO, Windows broker) accepts registrations and logins. */
+    device_sso_enabled: boolean;
+    device_sso_session_minutes: number;
+    device_sso_refresh_days: number;
+}
+/** A device registered for device-bound SSO. */
+export interface DeviceSsoRegistration {
+    object: 'device_sso_registration';
+    id: string;
+    user_id: string;
+    platform: 'macos' | 'windows';
+    hostname: string | null;
+    agent_version: string | null;
+    status: 'active' | 'revoked';
+    signing_key_id: string;
+    user_key_registered: boolean;
+    user_key_method: 'user_secure_enclave_key' | 'user_tpm_key' | null;
+    local_username: string | null;
+    last_login_at: number | null;
+    revoked_at: number | null;
+    created_at: number;
 }
 /** A passkey registered through a workstation. It answers the desktop passkey factor and never a web sign-in. */
 export interface DesktopPasskey {
@@ -101,4 +122,20 @@ export declare function desktopMfaResource(request: RequestFn): {
         id: string;
         deleted: boolean;
     }>;
+    /** Devices registered for device-bound SSO (macOS Platform SSO, Windows broker). */
+    listDeviceSsoRegistrations(query?: {
+        user_id?: string;
+    }): Promise<{
+        object: "list";
+        data: DeviceSsoRegistration[];
+        has_more: boolean;
+    }>;
+    getDeviceSsoRegistration(id: string): Promise<DeviceSsoRegistration>;
+    /** Ends every session the device holds and refuses its next call. */
+    revokeDeviceSsoRegistration(id: string): Promise<DeviceSsoRegistration>;
+    deleteDeviceSsoRegistration(id: string): Promise<{
+        object: "device_sso_registration";
+        id: string;
+        deleted: boolean;
+    }>;
 };

package/dist/client/desktop-mfa.js

@@ -39,6 +39,20 @@ function desktopMfaResource(request) {
         deleteDevice(id) {
             return request({ method: 'DELETE', path: `/v1/desktop_mfa/devices/${(0, request_1.enc)(id)}` });
         },
+        /** Devices registered for device-bound SSO (macOS Platform SSO, Windows broker). */
+        listDeviceSsoRegistrations(query = {}) {
+            return request({ method: 'GET', path: '/v1/device_sso/registrations', query });
+        },
+        getDeviceSsoRegistration(id) {
+            return request({ method: 'GET', path: `/v1/device_sso/registrations/${(0, request_1.enc)(id)}` });
+        },
+        /** Ends every session the device holds and refuses its next call. */
+        revokeDeviceSsoRegistration(id) {
+            return request({ method: 'POST', path: `/v1/device_sso/registrations/${(0, request_1.enc)(id)}/revoke` });
+        },
+        deleteDeviceSsoRegistration(id) {
+            return request({ method: 'DELETE', path: `/v1/device_sso/registrations/${(0, request_1.enc)(id)}` });
+        },
     };
 }
 //# sourceMappingURL=desktop-mfa.js.map

package/dist/client/desktop-mfa.js.map

@@ -1 +1 @@
-{"version":3,"file":"desktop-mfa.js","sourceRoot":"","sources":["../../src/client/desktop-mfa.ts"],"names":[],"mappings":";;AAqEA,gDAqCC;AA1GD,uCAAgD;AAoEhD,4EAA4E;AAC5E,SAAgB,kBAAkB,CAAC,OAAkB;IACnD,OAAO;QACL,SAAS;YACP,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,wBAAwB,EAAE,CAAC,CAAC;QACpE,CAAC;QACD,sCAAsC;QACtC,YAAY,CAAC,IAAgC;YAC3C,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,wBAAwB,EAAE,IAAI,EAAE,CAAC,CAAC;QAC1E,CAAC;QACD,gGAAgG;QAChG,mBAAmB,CAAC,IAAsD;YACxE,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,iCAAiC,EAAE,IAAI,EAAE,CAAC,CAAC;QACpF,CAAC;QACD,WAAW,CAAC,QAA8B,EAAE;YAC1C,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,yBAAyB,EAAE,KAAK,EAAE,CAAC,CAAC;QAC5E,CAAC;QACD,SAAS,CAAC,EAAU;YAClB,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,2BAA2B,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;QAChF,CAAC;QACD,kBAAkB,CAAC,EAAU;YAC3B,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,2BAA2B,IAAA,aAAG,EAAC,EAAE,CAAC,WAAW,EAAE,CAAC,CAAC;QACzF,CAAC;QACD,mBAAmB,CAAC,EAAU,EAAE,SAAiB;YAC/C,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,2BAA2B,IAAA,aAAG,EAAC,EAAE,CAAC,aAAa,IAAA,aAAG,EAAC,SAAS,CAAC,EAAE,EAAE,CAAC,CAAC;QAC9G,CAAC;QACD,6EAA6E;QAC7E,YAAY,CAAC,EAAU;YACrB,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,2BAA2B,IAAA,aAAG,EAAC,EAAE,CAAC,SAAS,EAAE,CAAC,CAAC;QACxF,CAAC;QACD,0GAA0G;QAC1G,kBAAkB,CAAC,EAAU;YAC3B,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,2BAA2B,IAAA,aAAG,EAAC,EAAE,CAAC,uBAAuB,EAAE,CAAC,CAAC;QACtG,CAAC;QACD,YAAY,CAAC,EAAU;YACrB,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,2BAA2B,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;QACnF,CAAC;KACF,CAAC;AACJ,CAAC"}
+{"version":3,"file":"desktop-mfa.js","sourceRoot":"","sources":["../../src/client/desktop-mfa.ts"],"names":[],"mappings":";;AA2FA,gDAmDC;AA9ID,uCAAgD;AA0FhD,4EAA4E;AAC5E,SAAgB,kBAAkB,CAAC,OAAkB;IACnD,OAAO;QACL,SAAS;YACP,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,wBAAwB,EAAE,CAAC,CAAC;QACpE,CAAC;QACD,sCAAsC;QACtC,YAAY,CAAC,IAAgC;YAC3C,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,wBAAwB,EAAE,IAAI,EAAE,CAAC,CAAC;QAC1E,CAAC;QACD,gGAAgG;QAChG,mBAAmB,CAAC,IAAsD;YACxE,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,iCAAiC,EAAE,IAAI,EAAE,CAAC,CAAC;QACpF,CAAC;QACD,WAAW,CAAC,QAA8B,EAAE;YAC1C,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,yBAAyB,EAAE,KAAK,EAAE,CAAC,CAAC;QAC5E,CAAC;QACD,SAAS,CAAC,EAAU;YAClB,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,2BAA2B,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;QAChF,CAAC;QACD,kBAAkB,CAAC,EAAU;YAC3B,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,2BAA2B,IAAA,aAAG,EAAC,EAAE,CAAC,WAAW,EAAE,CAAC,CAAC;QACzF,CAAC;QACD,mBAAmB,CAAC,EAAU,EAAE,SAAiB;YAC/C,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,2BAA2B,IAAA,aAAG,EAAC,EAAE,CAAC,aAAa,IAAA,aAAG,EAAC,SAAS,CAAC,EAAE,EAAE,CAAC,CAAC;QAC9G,CAAC;QACD,6EAA6E;QAC7E,YAAY,CAAC,EAAU;YACrB,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,2BAA2B,IAAA,aAAG,EAAC,EAAE,CAAC,SAAS,EAAE,CAAC,CAAC;QACxF,CAAC;QACD,0GAA0G;QAC1G,kBAAkB,CAAC,EAAU;YAC3B,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,2BAA2B,IAAA,aAAG,EAAC,EAAE,CAAC,uBAAuB,EAAE,CAAC,CAAC;QACtG,CAAC;QACD,YAAY,CAAC,EAAU;YACrB,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,2BAA2B,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;QACnF,CAAC;QACD,oFAAoF;QACpF,0BAA0B,CAAC,QAA8B,EAAE;YACzD,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,8BAA8B,EAAE,KAAK,EAAE,CAAC,CAAC;QACjF,CAAC;QACD,wBAAwB,CAAC,EAAU;YACjC,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,gCAAgC,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;QACrF,CAAC;QACD,qEAAqE;QACrE,2BAA2B,CAAC,EAAU;YACpC,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,gCAAgC,IAAA,aAAG,EAAC,EAAE,CAAC,SAAS,EAAE,CAAC,CAAC;QAC7F,CAAC;QACD,2BAA2B,CAAC,EAAU;YACpC,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,gCAAgC,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;QACxF,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/client/devices.d.ts

@@ -11,6 +11,21 @@ export interface Device {
     managed: boolean;
     compliant: boolean;
     posture: Record<string, unknown>;
+    os_version: string | null;
+    disk_encrypted: boolean | null;
+    screen_lock: boolean | null;
+    secure_hardware: boolean | null;
+    jailbroken: boolean | null;
+    firewall: boolean | null;
+    edr_present: boolean | null;
+    assurance_state: 'compliant' | 'grace' | 'noncompliant' | null;
+    assurance_checks: Array<{
+        policyId: string;
+        check: string;
+        ok: boolean;
+        detail?: string;
+    }>;
+    integration_id: string | null;
     last_reported_at: number;
     created_at: number;
 }
@@ -26,11 +41,71 @@ export interface DeviceReportBody {
     managed?: boolean;
     compliant?: boolean;
     posture?: Record<string, unknown>;
+    /** Typed posture; `null` or absent = unknown (never assumed good). */
+    os_version?: string | null;
+    disk_encrypted?: boolean | null;
+    screen_lock?: boolean | null;
+    secure_hardware?: boolean | null;
+    jailbroken?: boolean | null;
+    firewall?: boolean | null;
+    edr_present?: boolean | null;
+}
+export type DevicePlatform = 'any' | 'macos' | 'windows' | 'linux' | 'ios' | 'android' | 'chromeos';
+export interface DeviceAssurancePolicy {
+    object: 'device_assurance_policy';
+    id: string;
+    name: string;
+    platform: DevicePlatform;
+    enabled: boolean;
+    min_os_version: string | null;
+    os_latest_minus: number | null;
+    require_disk_encryption: boolean;
+    require_screen_lock: boolean;
+    require_secure_hardware: boolean;
+    block_jailbroken: boolean;
+    require_firewall: boolean;
+    require_edr: boolean;
+    grace_hours: number;
+    created_at: number;
+    updated_at: number;
+}
+export type DeviceAssurancePolicyBody = Partial<Omit<DeviceAssurancePolicy, 'object' | 'id' | 'created_at' | 'updated_at'>> & {
+    name?: string;
+};
+export type DeviceIntegrationProvider = 'intune' | 'jamf' | 'crowdstrike' | 'fleet' | 'chrome';
+export interface DeviceIntegration {
+    object: 'device_integration';
+    id: string;
+    provider: DeviceIntegrationProvider;
+    name: string;
+    status: 'active' | 'paused';
+    config: Record<string, unknown>;
+    has_credentials: boolean;
+    interval_minutes: number;
+    next_sync_at: number | null;
+    last_sync_at: number | null;
+    last_status: string | null;
+    last_error: string | null;
+    last_stats: Record<string, unknown>;
+    created_at: number;
+    updated_at: number;
+}
+export interface DeviceIntegrationBody {
+    provider?: DeviceIntegrationProvider;
+    name?: string;
+    /** Intune `{ tenantId }`; Jamf and Fleet `{ baseUrl }`; CrowdStrike `{ cloud, minZtaScore?, userEmailDomain? }`; Chrome `{ customer? }`. */
+    config?: Record<string, unknown>;
+    /** Write-only. Intune and Jamf and CrowdStrike `{ clientId, clientSecret }`; Fleet `{ apiToken }`; Chrome `{ clientEmail, privateKey, adminEmail }`. */
+    credentials?: Record<string, unknown>;
+    interval_minutes?: number;
+    status?: 'active' | 'paused';
 }
 export declare function devicesResource(request: RequestFn): {
     list(query?: {
         user_id?: string;
         source?: string;
+        platform?: string;
+        assurance_state?: string;
     }): Promise<ListPage<Device>>;
     get(id: string): Promise<Device>;
     report(body: DeviceReportBody): Promise<Device>;
@@ -41,4 +116,59 @@ export declare function devicesResource(request: RequestFn): {
         id: string;
         deleted: true;
     }>;
+    /** The compliance transitions of one device, newest first. */
+    complianceHistory(id: string): Promise<ListPage<{
+        object: "device_compliance_entry";
+        id: string;
+        device_id: string;
+        user_id: string | null;
+        state: string;
+        compliant: boolean;
+        failing: string[];
+        source: string;
+        created_at: number;
+    }>>;
+};
+/** Per-platform posture requirements (OS version, disk encryption, screen lock, ...) with a grace period. */
+export declare function deviceAssurancePoliciesResource(request: RequestFn): {
+    list(): Promise<ListPage<DeviceAssurancePolicy>>;
+    get(id: string): Promise<DeviceAssurancePolicy>;
+    create(body: DeviceAssurancePolicyBody & {
+        name: string;
+    }): Promise<DeviceAssurancePolicy>;
+    update(id: string, body: DeviceAssurancePolicyBody): Promise<DeviceAssurancePolicy>;
+    delete(id: string): Promise<{
+        object: "device_assurance_policy";
+        id: string;
+        deleted: true;
+    }>;
+    /** Re-evaluate every device against the current policies. */
+    evaluate(): Promise<{
+        object: "device_assurance_evaluation";
+        evaluated: number;
+        changed: number;
+    }>;
+};
+/** Pull connectors for Intune, Jamf Pro, CrowdStrike Falcon, Fleet and Google Chrome / ChromeOS. */
+export declare function deviceIntegrationsResource(request: RequestFn): {
+    list(): Promise<ListPage<DeviceIntegration>>;
+    get(id: string): Promise<DeviceIntegration>;
+    create(body: DeviceIntegrationBody & {
+        provider: DeviceIntegrationProvider;
+        name: string;
+    }): Promise<DeviceIntegration>;
+    update(id: string, body: DeviceIntegrationBody): Promise<DeviceIntegration>;
+    delete(id: string): Promise<{
+        object: "device_integration";
+        id: string;
+        deleted: true;
+    }>;
+    /** Pull now instead of waiting for the schedule. */
+    sync(id: string): Promise<{
+        object: "device_integration_sync";
+        integration_id: string;
+        ok: boolean;
+        seen: number;
+        error: string | null;
+    }>;
 };

package/dist/client/devices.js

@@ -1,6 +1,8 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.devicesResource = devicesResource;
+exports.deviceAssurancePoliciesResource = deviceAssurancePoliciesResource;
+exports.deviceIntegrationsResource = deviceIntegrationsResource;
 const request_1 = require("./request");
 function devicesResource(request) {
     return {
@@ -21,6 +23,58 @@ function devicesResource(request) {
         remove(id) {
             return request({ method: 'DELETE', path: `/v1/devices/${(0, request_1.enc)(id)}` });
         },
+        /** The compliance transitions of one device, newest first. */
+        complianceHistory(id) {
+            return request({ method: 'GET', path: `/v1/devices/${(0, request_1.enc)(id)}/compliance_history` });
+        },
+    };
+}
+/** Per-platform posture requirements (OS version, disk encryption, screen lock, ...) with a grace period. */
+function deviceAssurancePoliciesResource(request) {
+    return {
+        list() {
+            return request({ method: 'GET', path: '/v1/device_assurance_policies' });
+        },
+        get(id) {
+            return request({ method: 'GET', path: `/v1/device_assurance_policies/${(0, request_1.enc)(id)}` });
+        },
+        create(body) {
+            return request({ method: 'POST', path: '/v1/device_assurance_policies', body });
+        },
+        update(id, body) {
+            return request({ method: 'PATCH', path: `/v1/device_assurance_policies/${(0, request_1.enc)(id)}`, body });
+        },
+        delete(id) {
+            return request({ method: 'DELETE', path: `/v1/device_assurance_policies/${(0, request_1.enc)(id)}` });
+        },
+        /** Re-evaluate every device against the current policies. */
+        evaluate() {
+            return request({ method: 'POST', path: '/v1/device_assurance_policies/evaluate', body: {} });
+        },
+    };
+}
+/** Pull connectors for Intune, Jamf Pro, CrowdStrike Falcon, Fleet and Google Chrome / ChromeOS. */
+function deviceIntegrationsResource(request) {
+    return {
+        list() {
+            return request({ method: 'GET', path: '/v1/device_integrations' });
+        },
+        get(id) {
+            return request({ method: 'GET', path: `/v1/device_integrations/${(0, request_1.enc)(id)}` });
+        },
+        create(body) {
+            return request({ method: 'POST', path: '/v1/device_integrations', body });
+        },
+        update(id, body) {
+            return request({ method: 'PATCH', path: `/v1/device_integrations/${(0, request_1.enc)(id)}`, body });
+        },
+        delete(id) {
+            return request({ method: 'DELETE', path: `/v1/device_integrations/${(0, request_1.enc)(id)}` });
+        },
+        /** Pull now instead of waiting for the schedule. */
+        sync(id) {
+            return request({ method: 'POST', path: `/v1/device_integrations/${(0, request_1.enc)(id)}/sync`, body: {} });
+        },
     };
 }
 //# sourceMappingURL=devices.js.map

package/dist/client/devices.js.map

@@ -1 +1 @@
-{"version":3,"file":"devices.js","sourceRoot":"","sources":["../../src/client/devices.ts"],"names":[],"mappings":";;AAgCA,0CAoBC;AApDD,uCAAgD;AAgChD,SAAgB,eAAe,CAAC,OAAkB;IAChD,OAAO;QACL,IAAI,CAAC,QAA+C,EAAE;YACpD,MAAM,CAAC,GAAG,IAAI,eAAe,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAyB,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,SAAS,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC;YACzH,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,cAAc,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;QAC5E,CAAC;QACD,GAAG,CAAC,EAAU;YACZ,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,eAAe,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;QACpE,CAAC;QACD,MAAM,CAAC,IAAsB;YAC3B,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC;QAC/D,CAAC;QACD,iDAAiD;QACjD,aAAa,CAAC,OAA2B;YACvC,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,oBAAoB,EAAE,IAAI,EAAE,EAAE,OAAO,EAAE,EAAE,CAAC,CAAC;QACpF,CAAC;QACD,MAAM,CAAC,EAAU;YACf,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,eAAe,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;QACvE,CAAC;KACF,CAAC;AACJ,CAAC"}
+{"version":3,"file":"devices.js","sourceRoot":"","sources":["../../src/client/devices.ts"],"names":[],"mappings":";;AAwGA,0CAwBC;AAGD,0EAsBC;AAGD,gEAsBC;AAlLD,uCAAgD;AAwGhD,SAAgB,eAAe,CAAC,OAAkB;IAChD,OAAO;QACL,IAAI,CAAC,QAA4F,EAAE;YACjG,MAAM,CAAC,GAAG,IAAI,eAAe,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAyB,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,SAAS,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC;YACzH,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,cAAc,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;QAC5E,CAAC;QACD,GAAG,CAAC,EAAU;YACZ,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,eAAe,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;QACpE,CAAC;QACD,MAAM,CAAC,IAAsB;YAC3B,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC;QAC/D,CAAC;QACD,iDAAiD;QACjD,aAAa,CAAC,OAA2B;YACvC,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,oBAAoB,EAAE,IAAI,EAAE,EAAE,OAAO,EAAE,EAAE,CAAC,CAAC;QACpF,CAAC;QACD,MAAM,CAAC,EAAU;YACf,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,eAAe,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;QACvE,CAAC;QACD,8DAA8D;QAC9D,iBAAiB,CAAC,EAAU;YAC1B,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,eAAe,IAAA,aAAG,EAAC,EAAE,CAAC,qBAAqB,EAAE,CAAC,CAAC;QACvF,CAAC;KACF,CAAC;AACJ,CAAC;AAED,6GAA6G;AAC7G,SAAgB,+BAA+B,CAAC,OAAkB;IAChE,OAAO;QACL,IAAI;YACF,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,+BAA+B,EAAE,CAAC,CAAC;QAC3E,CAAC;QACD,GAAG,CAAC,EAAU;YACZ,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,iCAAiC,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;QACtF,CAAC;QACD,MAAM,CAAC,IAAkD;YACvD,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,+BAA+B,EAAE,IAAI,EAAE,CAAC,CAAC;QAClF,CAAC;QACD,MAAM,CAAC,EAAU,EAAE,IAA+B;YAChD,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,iCAAiC,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;QAC9F,CAAC;QACD,MAAM,CAAC,EAAU;YACf,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,iCAAiC,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;QACzF,CAAC;QACD,6DAA6D;QAC7D,QAAQ;YACN,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,wCAAwC,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC;QAC/F,CAAC;KACF,CAAC;AACJ,CAAC;AAED,oGAAoG;AACpG,SAAgB,0BAA0B,CAAC,OAAkB;IAC3D,OAAO;QACL,IAAI;YACF,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,yBAAyB,EAAE,CAAC,CAAC;QACrE,CAAC;QACD,GAAG,CAAC,EAAU;YACZ,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,2BAA2B,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;QAChF,CAAC;QACD,MAAM,CAAC,IAAmF;YACxF,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,yBAAyB,EAAE,IAAI,EAAE,CAAC,CAAC;QAC5E,CAAC;QACD,MAAM,CAAC,EAAU,EAAE,IAA2B;YAC5C,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,2BAA2B,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;QACxF,CAAC;QACD,MAAM,CAAC,EAAU;YACf,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,2BAA2B,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;QACnF,CAAC;QACD,oDAAoD;QACpD,IAAI,CAAC,EAAU;YACb,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,2BAA2B,IAAA,aAAG,EAAC,EAAE,CAAC,OAAO,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC;QAChG,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/client/email-templates.d.ts

@@ -1,7 +1,7 @@
 import { type RequestFn } from './request';
 import type { ListPage } from './types';
 /** The transactional email a template drives. */
-export type EmailTemplateName = 'verification_code' | 'magic_link' | 'password_reset' | 'password_changed' | 'account_exists_notice' | 'organization_invitation' | 'new_device_sign_in' | 'session_revoked_token_reuse' | 'account_locked' | 'account_secured' | 'team_member_added' | 'team_role_changed' | 'email_changed' | 'email_change_confirm' | 'parental_consent_request' | 'phone_changed' | 'identity_linked' | 'identity_unlinked' | 'passkey_added' | 'passkey_removed' | 'recovery_codes_regenerated' | 'factor_removed' | 'device_key_added' | 'device_key_removed' | 'uma_request_submitted' | 'risk_alert' | 'verification_link' | 'password_reset_link' | 'account_reactivated';
+export type EmailTemplateName = 'verification_code' | 'magic_link' | 'password_reset' | 'password_changed' | 'account_exists_notice' | 'organization_invitation' | 'new_device_sign_in' | 'session_revoked_token_reuse' | 'account_locked' | 'account_secured' | 'team_member_added' | 'team_role_changed' | 'email_changed' | 'email_change_confirm' | 'parental_consent_request' | 'phone_changed' | 'identity_linked' | 'identity_unlinked' | 'passkey_added' | 'passkey_removed' | 'recovery_codes_regenerated' | 'factor_removed' | 'device_key_added' | 'device_key_removed' | 'uma_request_submitted' | 'risk_alert' | 'account_unblock' | 'impersonation_alert' | 'verification_link' | 'password_reset_link' | 'account_reactivated';
 /** The customizable body of a template: a subject line and a text body. */
 export interface EmailTemplateBody {
     subject?: string;

package/dist/client/email-templates.js.map

@@ -1 +1 @@
-{"version":3,"file":"email-templates.js","sourceRoot":"","sources":["../../src/client/email-templates.ts"],"names":[],"mappings":";;AA0EA,wDAkBC;AA5FD,uCAAgD;AA0EhD,SAAgB,sBAAsB,CAAC,OAAkB;IACvD,OAAO;QACL,IAAI;YACF,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,qBAAqB,EAAE,CAAC,CAAC;QACjE,CAAC;QACD,2EAA2E;QAC3E,OAAO,CAAC,IAAY,EAAE,OAA0B,EAAE;YAChD,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,uBAAuB,IAAA,aAAG,EAAC,IAAI,CAAC,UAAU,EAAE,IAAI,EAAE,CAAC,CAAC;QAC7F,CAAC;QACD,2DAA2D;QAC3D,MAAM,CAAC,IAAY,EAAE,IAAuB;YAC1C,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,uBAAuB,IAAA,aAAG,EAAC,IAAI,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;QACpF,CAAC;QACD,8BAA8B;QAC9B,MAAM,CAAC,IAAY;YACjB,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,uBAAuB,IAAA,aAAG,EAAC,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC;QACjF,CAAC;KACF,CAAC;AACJ,CAAC"}
+{"version":3,"file":"email-templates.js","sourceRoot":"","sources":["../../src/client/email-templates.ts"],"names":[],"mappings":";;AA4EA,wDAkBC;AA9FD,uCAAgD;AA4EhD,SAAgB,sBAAsB,CAAC,OAAkB;IACvD,OAAO;QACL,IAAI;YACF,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,qBAAqB,EAAE,CAAC,CAAC;QACjE,CAAC;QACD,2EAA2E;QAC3E,OAAO,CAAC,IAAY,EAAE,OAA0B,EAAE;YAChD,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,uBAAuB,IAAA,aAAG,EAAC,IAAI,CAAC,UAAU,EAAE,IAAI,EAAE,CAAC,CAAC;QAC7F,CAAC;QACD,2DAA2D;QAC3D,MAAM,CAAC,IAAY,EAAE,IAAuB;YAC1C,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,uBAAuB,IAAA,aAAG,EAAC,IAAI,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;QACpF,CAAC;QACD,8BAA8B;QAC9B,MAAM,CAAC,IAAY;YACjB,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,uBAAuB,IAAA,aAAG,EAAC,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC;QACjF,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/client/fga.d.ts

@@ -30,6 +30,8 @@ export interface FgaTuple {
     /** The object of the tuple as `type:id`. */
     target: string;
     condition?: FgaTupleCondition;
+    /** Epoch ms after which the tuple stops granting. */
+    expires_at?: number;
     created_at: number;
 }
 /** A model condition bound to a tuple, with the parameter values fixed on it. */
@@ -44,6 +46,8 @@ export interface FgaTupleKey {
     object: string;
     /** The tuple grants only while this model condition holds. */
     condition?: FgaTupleCondition;
+    /** The tuple stops granting at this time (ISO 8601 or epoch ms, in the future); a sweep then deletes it. */
+    expires_at?: string | number;
 }
 /**
  * Freshness of a read. `MINIMIZE_LATENCY` (and the default) may be served from a
@@ -192,10 +196,12 @@ export declare function fgaResource(request: RequestFn): {
         create(storeId: string, body: FgaAuthorizationModelInput, idempotencyKey?: string): Promise<FgaAuthorizationModel>;
         get(storeId: string, modelId: string): Promise<FgaAuthorizationModel>;
     };
-    /** Write and/or delete tuples in one atomic call. */
+    /** Write and/or delete tuples in one atomic call. `on_duplicate` / `on_missing` = `error` refuse a repeat write or a delete of nothing. */
     write(storeId: string, body: {
         writes?: FgaTupleKeys;
         deletes?: FgaTupleKeys;
+        on_duplicate?: "ignore" | "error";
+        on_missing?: "ignore" | "error";
     }, idempotencyKey?: string): Promise<{
         object: "fga.write_result";
         writes: number;
@@ -242,6 +248,77 @@ export declare function fgaResource(request: RequestFn): {
      * to receive only what changed since.
      */
     readChanges(storeId: string, params?: FgaReadChangesParams): Promise<FgaChangesPage>;
+    /** What a local PDP syncs: a page of tuples (full), or the changes after `since` (a store revision). */
+    snapshot(storeId: string, params?: {
+        since?: number;
+        cursor?: string;
+        limit?: number;
+    }): Promise<FgaSnapshot>;
+    /** Bulk-import tuples (idempotent; `dry_run` reports without writing). */
+    importTuples(storeId: string, body: {
+        tuples: Array<FgaTupleKey>;
+        dry_run?: boolean;
+    }): Promise<{
+        object: "fga.import_result";
+        dry_run: boolean;
+        total: number;
+        new: number;
+        existing: number;
+        revision: number;
+        consistency_token?: string;
+    }>;
+    /** Run an FGA test suite in memory (the model from `dsl` / `modules`, or the store's). */
+    runTests(storeId: string, body: FgaTestSuite): Promise<FgaTestReport>;
+    /** The same, with no store: the model comes from `dsl` / `modules`. */
+    runTestsWithoutStore(body: FgaTestSuite): Promise<FgaTestReport>;
+    /** Validate a model and convert it DSL <-> JSON; `modules` compile to one model. */
+    transformModel(body: {
+        dsl?: string;
+        modules?: Array<{
+            name: string;
+            contents: string;
+        }>;
+        model?: Record<string, unknown>;
+    }): Promise<{
+        object: "fga.model_transform";
+        valid: true;
+        model: Record<string, unknown>;
+        dsl: string;
+    }>;
+    /** Nodes and edges of a model version, for a visualizer. */
+    modelGraph(storeId: string, modelId: string): Promise<{
+        object: "fga.model_graph";
+        model_id: string;
+        nodes: Array<{
+            id: string;
+            kind: "type" | "relation";
+            type: string;
+            relation?: string;
+        }>;
+        edges: Array<{
+            from: string;
+            to: string;
+            kind: "direct" | "computed" | "tupleset" | "parent";
+            label?: string;
+        }>;
+    }>;
+    /** What changed from the previous version (or `against`). */
+    modelDiff(storeId: string, modelId: string, against?: string): Promise<FgaModelDiff>;
+    /** OpenFGA assertions stored against a model version. */
+    assertions: {
+        get(storeId: string, modelId: string): Promise<{
+            authorization_model_id: string;
+            assertions: unknown[];
+        }>;
+        put(storeId: string, modelId: string, assertions: unknown[]): Promise<void>;
+        run(storeId: string, modelId: string): Promise<{
+            object: "fga.assertion_run";
+            passed: boolean;
+            total: number;
+            failed: number;
+            results: unknown[];
+        }>;
+    };
     /** Expand the full userset tree for an object#relation. */
     expand(storeId: string, body: {
         object: string;
@@ -310,3 +387,101 @@ export declare function fgaResource(request: RequestFn): {
         };
     };
 };
+export interface FgaSnapshot {
+    object: 'fga.snapshot';
+    store_id: string;
+    model_id: string | null;
+    model: Record<string, unknown> | null;
+    full: boolean;
+    /** The store revision this snapshot is at; pass it back as `since`. */
+    revision: number;
+    tuples?: Array<FgaTupleKey>;
+    changes?: Array<FgaTupleKey & {
+        operation: 'write' | 'delete';
+    }>;
+    next_cursor?: string | null;
+    has_more: boolean;
+}
+export interface FgaTestSuite {
+    model_id?: string;
+    dsl?: string;
+    modules?: Array<{
+        name: string;
+        contents: string;
+    }>;
+    tuples?: Array<FgaTupleKey>;
+    tests: Array<{
+        name?: string;
+        tuples?: Array<FgaTupleKey>;
+        check?: Array<{
+            user: string;
+            object: string;
+            context?: Record<string, unknown>;
+            assertions: Record<string, boolean>;
+        }>;
+        list_objects?: Array<{
+            user: string;
+            type: string;
+            context?: Record<string, unknown>;
+            assertions: Record<string, string[]>;
+        }>;
+        list_users?: Array<{
+            object: string;
+            user_filter: {
+                type: string;
+                relation?: string;
+            } | Array<{
+                type: string;
+                relation?: string;
+            }>;
+            context?: Record<string, unknown>;
+            assertions: Record<string, {
+                users: string[];
+            }>;
+        }>;
+    }>;
+}
+export interface FgaTestReport {
+    object: 'fga.test_report';
+    passed: boolean;
+    total: number;
+    failed: number;
+    coverage: {
+        relations: number;
+        covered: number;
+        uncovered: string[];
+    };
+    results: Array<{
+        name: string;
+        passed: boolean;
+        checks: number;
+        failures: Array<{
+            kind: 'check' | 'list_objects' | 'list_users';
+            query: string;
+            expected: unknown;
+            actual: unknown;
+            error?: string;
+        }>;
+    }>;
+}
+export interface FgaModelDiff {
+    object: 'fga.model_diff';
+    from: string | null;
+    to: string;
+    types: {
+        added: string[];
+        removed: string[];
+    };
+    relations: {
+        added: string[];
+        removed: string[];
+        changed: string[];
+    };
+    conditions: {
+        added: string[];
+        removed: string[];
+        changed: string[];
+    };
+    breaking: boolean;
+    identical: boolean;
+}