@atlasauth/backend 0.34.0 → 0.36.0

package/CHANGELOG.md

@@ -1,5 +1,26 @@
 # @atlasauth/backend changelog
 
+## Unreleased
+
+## 0.36.0 — 2026-11-04
+
+- Identity integrations: `claims` (`org`, `org_role`, `public_metadata`) on the integration body, and `claims` / `extra_claim_names` on its answer.
+
+## 0.35.0 — 2026-11-03
+
+- `organizations.upsertByExternalId(externalId, body)` and `ssoOnboarding.upsertByName(name, body)`: create-or-update in one race-safe call.
+- `SessionClaims.last_active_at` (the session's last activity, epoch seconds).
+
+### Added
+
+- `AtlasWebhookEvent`: a discriminated union over `type` of every webhook event (181), each with its typed `data`, generated from the server's event schemas. `verifyWebhook`, `verifyAtlasWebhook` and `verifyAtlasWebhookRequest` now return it by default (pass a type argument to override). Also `AtlasWebhookEventType`, `ATLAS_WEBHOOK_EVENT_TYPES` and one `WebhookData*` type per payload.
+- `RoleSource`: `"manual" | "scim" | "directory_sync" | "sso:<connection id>" | "ldap:<connection id>"`.
+- `SessionClaims` gains `acr`, `amr`, `auth_time`, `mfa_satisfied` and `email_verified`.
+- `mfaSatisfied(claims)`: `mfa_satisfied === true`, else `mfa === true`, an MFA `acr`/`amr`, or an enterprise SSO sign-in (`sso_connection_id`).
+- `syncLocalUser(claims, { findBySub, findByEmail, subOf, isLocalEmailVerified, link, create, isDuplicateError? })` → `{ user, created, linked }`: mirror the Atlas user into your own table, link by email only when both sides proved it, never relink a row bound to another user (`AtlasLinkConflictError`), race-safe on a unique `sub`.
+- CSRF: `csrfToken({ sid, secret })`, `verifyCsrf(request, { sid, secret })`, `checkCsrfToken`, `deriveCsrfSecret(secretKey)`, and the `CSRF_HEADER` (`x-atlas-csrf`), `CSRF_FORM_FIELD` (`atlas_csrf`) and `CSRF_COOKIE` (`__atlas_csrf`) names.
+- `@atlasauth/backend/rp`: app-credential `touchIfDue` / `endAppSession` for apps with no instance secret key (Sign in with Atlas), and back-channel logout through a sid store (`sidStore`, `memorySidStore`, `sqlSidStore`, `bindSession`, `onBackchannelLogout`, `backchannelLogout`, `routes.backchannelLogout`).
+
 ## 0.34.0 — 2026-11-02
 
 ### Added

package/README.md

@@ -453,6 +453,71 @@ To check the route end to end, `oauthClients.testBackchannelLogout(id)` sends a
 
 The `atlas-signature` header can carry more than one signature, separated by spaces (`v1,<sig> v1,<sig>`). While an endpoint secret rotates, Atlas may sign each delivery with the old and the new secret. `verifyWebhook` accepts the delivery when any one signature matches your secret.
 
+### Typed events
+
+`verifyWebhook` returns an `AtlasWebhookEvent`, a union over `type`, so a `switch` narrows `data`:
+
+```ts
+const { verified, event } = verifyWebhook({ body: rawBody, headers, secret });
+if (!verified || !event) return res.sendStatus(400);
+switch (event.type) {
+  case 'user.created':
+    await createUser(event.data.id, event.data.primary_email_address);
+    break;
+  case 'organization_membership.updated':
+    console.log(event.data.role, event.data.role_source); // RoleSource | null
+    break;
+  default:
+    // an event type newer than this package version
+}
+```
+
+`ATLAS_WEBHOOK_EVENT_TYPES` lists every type. `RoleSource` is `"manual"`, `"scim"`, `"directory_sync"`, `"sso:<connection id>"` or `"ldap:<connection id>"`.
+
+## Mirror the user into your database
+
+`syncLocalUser` finds or creates the row for the signed-in Atlas user. Call it after verifying the session:
+
+```ts
+const { user, created, linked } = await syncLocalUser(auth.claims, {
+  findBySub: (sub) => db.user.findUnique({ where: { atlasSub: sub } }),
+  findByEmail: (email) => db.user.findUnique({ where: { email } }),
+  subOf: (row) => row.atlasSub,
+  isLocalEmailVerified: (row) => row.emailVerified,
+  link: (row, sub) => db.user.update({ where: { id: row.id }, data: { atlasSub: sub } }),
+  create: ({ sub, email, email_verified, external_id }) =>
+    db.user.create({ data: { atlasSub: sub, email, emailVerified: email_verified, externalId: external_id } }),
+});
+```
+
+- A row is found by `sub` first.
+- An existing row is linked by email only when the token says `email_verified: true` AND `isLocalEmailVerified(row)` is true. Linking an address nobody proved would let whoever registered it first take the account.
+- A row already bound to a different Atlas user is never relinked: `AtlasLinkConflictError` is thrown.
+- Put a unique index on the Atlas sub. When two first requests race, the loser's `create` fails on it and `syncLocalUser` returns the winner's row. `isDuplicateError` decides what counts as that failure (default: Postgres `23505`, or a message containing "duplicate" or "unique").
+
+The token carries `email`, `email_verified` and `external_id` when the instance includes the email claim in session tokens.
+
+## Require MFA
+
+```ts
+if (!mfaSatisfied(auth.claims)) return res.status(403).json({ error: 'mfa_required' });
+```
+
+`mfaSatisfied` is true when the token says `mfa_satisfied: true`, or else when `mfa` is true, `acr` is `urn:atlas:acr:mfa` or `amr` includes `mfa`, or the session came through enterprise SSO (`sso_connection_id`). `usedMultiFactor` and `authenticatedWithin` take `SessionClaims` too.
+
+## CSRF tokens
+
+For cookie-authenticated forms and `fetch` calls:
+
+```ts
+const secret = process.env.ATLAS_CSRF_SECRET ?? deriveCsrfSecret(process.env.ATLAS_SECRET_KEY!);
+const token = csrfToken({ sid: auth.claims.sid, secret }); // set as the __atlas_csrf cookie, render into the page
+// on a POST:
+if (!(await verifyCsrf(request, { sid: auth.claims.sid, secret }))) return new Response(null, { status: 403 });
+```
+
+A token is bound to the session (`sid`). `verifyCsrf` takes it from the `x-atlas-csrf` header or an `atlas_csrf` form field, and it must equal the `__atlas_csrf` cookie. A form body is read from a clone, so your handler can still read it. With Next.js, `atlasProxy({ csrf: true })` in `@atlasauth/nextjs` does all of this for you.
+
 ## Referral attribution
 
 With referral attribution on, Atlas reports every interactive sign-up to your referral platform before `user.created` is sent. The answer lands on the user: `referral` (who referred them, or null), `referral_code` and `referral_link` (the user's own code and link, when they are a referrer).

package/dist/client/index.d.ts

@@ -3082,6 +3082,7 @@ declare function buildNamespaces(request: RequestFn): {
         getPolicy(id: string): Promise<import("./organizations").OrganizationPolicy>;
         create(body: import("./organizations").CreateOrganizationBody, idempotencyKey?: string): Promise<import("./organizations").Organization>;
         update(id: string, body: import("./organizations").UpdateOrganizationBody): Promise<import("./organizations").Organization>;
+        upsertByExternalId(externalId: string, body: Omit<import("./organizations").CreateOrganizationBody, "external_id">, idempotencyKey?: string): Promise<import("./organizations").Organization>;
         delete(id: string): Promise<import("./types").DeletedObject>;
         updateMetadata(id: string, body: import("./organizations").ReplaceOrganizationMetadataBody): Promise<import("./organizations").Organization>;
         updatePolicy(id: string, body: import("./organizations").OrganizationPolicyPatch): Promise<import("./organizations").OrganizationPolicy>;
@@ -3958,6 +3959,7 @@ declare function buildNamespaces(request: RequestFn): {
         }): Promise<import("./types").ListPage<import("./sso-onboarding").SsoOnboardingProfile>>;
         get(id: string): Promise<import("./sso-onboarding").SsoOnboardingProfile>;
         create(body: import("./sso-onboarding").CreateSsoOnboardingProfileBody, idempotencyKey?: string): Promise<import("./sso-onboarding").SsoOnboardingProfile>;
+        upsertByName(name: string, body: Omit<import("./sso-onboarding").CreateSsoOnboardingProfileBody, "name">): Promise<import("./sso-onboarding").SsoOnboardingProfile>;
         delete(id: string): Promise<{
             object: "sso_onboarding_profile";
             id: string;

package/dist/client/instance.d.ts

@@ -578,6 +578,14 @@ export interface Integration {
     audience_format?: string | null;
     principal_claim?: 'audience_hint' | null;
     ext_claim?: 'external_id' | null;
+    /** The opt-in organization and metadata claims. */
+    claims?: {
+        org: boolean;
+        org_role: boolean;
+        public_metadata: string[];
+    };
+    /** The claim names `claims` adds to a token, e.g. org_id, org_slug, org_role, plan. */
+    extra_claim_names?: string[];
     ttl_seconds?: number;
     issuer?: string;
     jwks_url?: string;
@@ -643,6 +651,15 @@ export interface SetIntegrationBody {
     audience_format?: string | null;
     principal_claim?: 'audience_hint' | null;
     ext_claim?: 'external_id' | null;
+    /**
+     * Opt-in claims: `org` adds org_id and org_slug of the active organization, `org_role` the user's role there,
+     * `public_metadata` up to 10 keys (the active organization's value, else the user's). null = none.
+     */
+    claims?: {
+        org?: boolean;
+        org_role?: boolean;
+        public_metadata?: string[];
+    } | null;
     /** 10-120. Default 120. */
     ttl_seconds?: number;
     /** Omitted = the preset default; null = none. */

package/dist/client/instance.js.map

@@ -1 +1 @@
-{"version":3,"file":"instance.js","sourceRoot":"","sources":["../../src/client/instance.ts"],"names":[],"mappings":";;AAovBA,4CAwMC;AAxMD,SAAgB,gBAAgB,CAAC,OAAkB;IACjD,OAAO;QACL,GAAG;YACD,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC;QAC1D,CAAC;QACD,MAAM,CAAC,IAAwB;YAC7B,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,cAAc,EAAE,IAAI,EAAE,CAAC,CAAC;QAClE,CAAC;QACD;;;;WAIG;QACH,eAAe,EAAE;YACf,GAAG;gBACD,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,iCAAiC,EAAE,CAAC,CAAC;YAC7E,CAAC;YACD,MAAM,CAAC,IAA+B;gBACpC,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,iCAAiC,EAAE,IAAI,EAAE,CAAC,CAAC;YACrF,CAAC;SACF;QACD,wFAAwF;QACxF,WAAW,EAAE;YACX,GAAG;gBACD,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,2BAA2B,EAAE,CAAC,CAAC;YACvE,CAAC;YACD,MAAM,CAAC,IAA2B;gBAChC,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,2BAA2B,EAAE,IAAI,EAAE,CAAC,CAAC;YAC/E,CAAC;SACF;QACD,yFAAyF;QACzF,SAAS,CAAC,SAA0B,EAAE;YACpC,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,wBAAwB,EAAE,KAAK,EAAE,EAAE,GAAG,MAAM,EAAE,EAAE,CAAC,CAAC;QAC1F,CAAC;QACD;;;;WAIG;QACH,aAAa,EAAE;YACb,IAAI;gBACF,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,6BAA6B,EAAE,CAAC,CAAC;YACzE,CAAC;YACD,GAAG,CAAC,IAAY,EAAE,IAA8B;gBAC9C,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,+BAA+B,kBAAkB,CAAC,IAAI,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;YAC3G,CAAC;YACD,MAAM,CAAC,IAAY;gBACjB,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,+BAA+B,kBAAkB,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC;YACxG,CAAC;SACF;QACD;;;;WAIG;QACH,mBAAmB,CAAC,SAA4B,EAAE;YAChD,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,oCAAoC,EAAE,KAAK,EAAE,EAAE,GAAG,MAAM,EAAE,EAAE,CAAC,CAAC;QACtG,CAAC;QACD,mGAAmG;QACnG,WAAW,CAAC,MAA2C;YACrD,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,kBAAkB,EAAE,KAAK,EAAE,EAAE,GAAG,MAAM,EAAE,EAAE,CAAC,CAAC;QACpF,CAAC;QACD;;;;WAIG;QACH,UAAU,CAAC,IAAuB;YAChC,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,0BAA0B,EAAE,IAAI,EAAE,CAAC,CAAC;QAC7E,CAAC;QACD;;;;;WAKG;QACH,iBAAiB,CAAC,SAA+C,EAAE;YACjE,OAAO,OAAO,CAAC;gBACb,MAAM,EAAE,KAAK;gBACb,IAAI,EAAE,wBAAwB;gBAC9B,KAAK,EAAE,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,GAAG,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE;aAC9G,CAAC,CAAC;QACL,CAAC;QACD,oEAAoE;QACpE,0BAA0B;YACxB,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,kCAAkC,EAAE,CAAC,CAAC;QAC9E,CAAC;QACD;;;WAGG;QACH,KAAK,CAAC,MAAsF;YAC1F,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,WAAW,EAAE,KAAK,EAAE,EAAE,GAAG,MAAM,EAAE,EAAE,CAAC,CAAC;QAC7E,CAAC;QACD,2EAA2E;QAC3E,WAAW;YACT,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,0BAA0B,EAAE,CAAC,CAAC;QACtE,CAAC;QACD;;;WAGG;QACH,YAAY,EAAE;YACZ,+FAA+F;YAC/F,IAAI;gBACF,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,2BAA2B,EAAE,CAAC,CAAC;YACvE,CAAC;YACD,GAAG,CAAC,EAAU;gBACZ,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,6BAA6B,kBAAkB,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;YACjG,CAAC;YACD,yFAAyF;YACzF,GAAG,CAAC,EAAU,EAAE,IAAwB,EAAE,OAA6B,EAAE;gBACvE,OAAO,OAAO,CAAC;oBACb,MAAM,EAAE,KAAK;oBACb,IAAI,EAAE,6BAA6B,kBAAkB,CAAC,EAAE,CAAC,EAAE;oBAC3D,IAAI;oBACJ,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;iBACvD,CAAC,CAAC;YACL,CAAC;YACD,MAAM,CAAC,EAAU;gBACf,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,6BAA6B,kBAAkB,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;YACpG,CAAC;YACD,2FAA2F;YAC3F,UAAU,CACR,EAAU,EACV,QAAmF,EAAE;gBAErF,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,6BAA6B,kBAAkB,CAAC,EAAE,CAAC,aAAa,EAAE,KAAK,EAAE,CAAC,CAAC;YACnH,CAAC;YACD,4DAA4D;YAC5D,kBAAkB,CAAC,EAAU;gBAC3B,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,6BAA6B,kBAAkB,CAAC,EAAE,CAAC,gBAAgB,EAAE,CAAC,CAAC;YAChH,CAAC;YACD;;;;eAIG;YACH,kBAAkB,CAChB,EAAU,EACV,OAAqC,EAAE;gBAWvC,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,6BAA6B,kBAAkB,CAAC,EAAE,CAAC,uBAAuB,EAAE,IAAI,EAAE,CAAC,CAAC;YAC7H,CAAC;YACD,wFAAwF;YACxF,YAAY,CAAC,EAAU,EAAE,WAAmB;gBAC1C,OAAO,OAAO,CAAC;oBACb,MAAM,EAAE,MAAM;oBACd,IAAI,EAAE,6BAA6B,kBAAkB,CAAC,EAAE,CAAC,kBAAkB;oBAC3E,IAAI,EAAE,EAAE,YAAY,EAAE,WAAW,EAAE;iBACpC,CAAC,CAAC;YACL,CAAC;YACD,MAAM,EAAE;gBACN,GAAG;oBACD,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,kCAAkC,EAAE,CAAC,CAAC;gBAC9E,CAAC;gBACD,GAAG,CAAC,IAA8B;oBAChC,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,kCAAkC,EAAE,IAAI,EAAE,CAAC,CAAC;gBACpF,CAAC;gBACD,MAAM;oBACJ,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,kCAAkC,EAAE,CAAC,CAAC;gBACjF,CAAC;aACF;YACD,UAAU,EAAE;gBACV,GAAG;oBACD,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,sCAAsC,EAAE,CAAC,CAAC;gBAClF,CAAC;gBACD,qCAAqC;gBACrC,GAAG,CAAC,IAAkC;oBACpC,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,sCAAsC,EAAE,IAAI,EAAE,CAAC,CAAC;gBACxF,CAAC;gBACD,MAAM;oBACJ,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,sCAAsC,EAAE,CAAC,CAAC;gBACrF,CAAC;aACF;SACF;QACD,oEAAoE;QACpE,aAAa,EAAE;YACb,GAAG;gBACD,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,6BAA6B,EAAE,CAAC,CAAC;YACzE,CAAC;YACD,kCAAkC;YAClC,GAAG,CAAC,IAA0B;gBAC5B,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,6BAA6B,EAAE,IAAI,EAAE,CAAC,CAAC;YAC/E,CAAC;YACD,+EAA+E;YAC/E,MAAM;gBACJ,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,6BAA6B,EAAE,CAAC,CAAC;YAC5E,CAAC;SACF;KACF,CAAC;AACJ,CAAC"}
+{"version":3,"file":"instance.js","sourceRoot":"","sources":["../../src/client/instance.ts"],"names":[],"mappings":";;AA6vBA,4CAwMC;AAxMD,SAAgB,gBAAgB,CAAC,OAAkB;IACjD,OAAO;QACL,GAAG;YACD,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC;QAC1D,CAAC;QACD,MAAM,CAAC,IAAwB;YAC7B,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,cAAc,EAAE,IAAI,EAAE,CAAC,CAAC;QAClE,CAAC;QACD;;;;WAIG;QACH,eAAe,EAAE;YACf,GAAG;gBACD,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,iCAAiC,EAAE,CAAC,CAAC;YAC7E,CAAC;YACD,MAAM,CAAC,IAA+B;gBACpC,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,iCAAiC,EAAE,IAAI,EAAE,CAAC,CAAC;YACrF,CAAC;SACF;QACD,wFAAwF;QACxF,WAAW,EAAE;YACX,GAAG;gBACD,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,2BAA2B,EAAE,CAAC,CAAC;YACvE,CAAC;YACD,MAAM,CAAC,IAA2B;gBAChC,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,2BAA2B,EAAE,IAAI,EAAE,CAAC,CAAC;YAC/E,CAAC;SACF;QACD,yFAAyF;QACzF,SAAS,CAAC,SAA0B,EAAE;YACpC,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,wBAAwB,EAAE,KAAK,EAAE,EAAE,GAAG,MAAM,EAAE,EAAE,CAAC,CAAC;QAC1F,CAAC;QACD;;;;WAIG;QACH,aAAa,EAAE;YACb,IAAI;gBACF,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,6BAA6B,EAAE,CAAC,CAAC;YACzE,CAAC;YACD,GAAG,CAAC,IAAY,EAAE,IAA8B;gBAC9C,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,+BAA+B,kBAAkB,CAAC,IAAI,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;YAC3G,CAAC;YACD,MAAM,CAAC,IAAY;gBACjB,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,+BAA+B,kBAAkB,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC;YACxG,CAAC;SACF;QACD;;;;WAIG;QACH,mBAAmB,CAAC,SAA4B,EAAE;YAChD,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,oCAAoC,EAAE,KAAK,EAAE,EAAE,GAAG,MAAM,EAAE,EAAE,CAAC,CAAC;QACtG,CAAC;QACD,mGAAmG;QACnG,WAAW,CAAC,MAA2C;YACrD,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,kBAAkB,EAAE,KAAK,EAAE,EAAE,GAAG,MAAM,EAAE,EAAE,CAAC,CAAC;QACpF,CAAC;QACD;;;;WAIG;QACH,UAAU,CAAC,IAAuB;YAChC,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,0BAA0B,EAAE,IAAI,EAAE,CAAC,CAAC;QAC7E,CAAC;QACD;;;;;WAKG;QACH,iBAAiB,CAAC,SAA+C,EAAE;YACjE,OAAO,OAAO,CAAC;gBACb,MAAM,EAAE,KAAK;gBACb,IAAI,EAAE,wBAAwB;gBAC9B,KAAK,EAAE,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,GAAG,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE;aAC9G,CAAC,CAAC;QACL,CAAC;QACD,oEAAoE;QACpE,0BAA0B;YACxB,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,kCAAkC,EAAE,CAAC,CAAC;QAC9E,CAAC;QACD;;;WAGG;QACH,KAAK,CAAC,MAAsF;YAC1F,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,WAAW,EAAE,KAAK,EAAE,EAAE,GAAG,MAAM,EAAE,EAAE,CAAC,CAAC;QAC7E,CAAC;QACD,2EAA2E;QAC3E,WAAW;YACT,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,0BAA0B,EAAE,CAAC,CAAC;QACtE,CAAC;QACD;;;WAGG;QACH,YAAY,EAAE;YACZ,+FAA+F;YAC/F,IAAI;gBACF,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,2BAA2B,EAAE,CAAC,CAAC;YACvE,CAAC;YACD,GAAG,CAAC,EAAU;gBACZ,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,6BAA6B,kBAAkB,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;YACjG,CAAC;YACD,yFAAyF;YACzF,GAAG,CAAC,EAAU,EAAE,IAAwB,EAAE,OAA6B,EAAE;gBACvE,OAAO,OAAO,CAAC;oBACb,MAAM,EAAE,KAAK;oBACb,IAAI,EAAE,6BAA6B,kBAAkB,CAAC,EAAE,CAAC,EAAE;oBAC3D,IAAI;oBACJ,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;iBACvD,CAAC,CAAC;YACL,CAAC;YACD,MAAM,CAAC,EAAU;gBACf,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,6BAA6B,kBAAkB,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;YACpG,CAAC;YACD,2FAA2F;YAC3F,UAAU,CACR,EAAU,EACV,QAAmF,EAAE;gBAErF,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,6BAA6B,kBAAkB,CAAC,EAAE,CAAC,aAAa,EAAE,KAAK,EAAE,CAAC,CAAC;YACnH,CAAC;YACD,4DAA4D;YAC5D,kBAAkB,CAAC,EAAU;gBAC3B,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,6BAA6B,kBAAkB,CAAC,EAAE,CAAC,gBAAgB,EAAE,CAAC,CAAC;YAChH,CAAC;YACD;;;;eAIG;YACH,kBAAkB,CAChB,EAAU,EACV,OAAqC,EAAE;gBAWvC,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,6BAA6B,kBAAkB,CAAC,EAAE,CAAC,uBAAuB,EAAE,IAAI,EAAE,CAAC,CAAC;YAC7H,CAAC;YACD,wFAAwF;YACxF,YAAY,CAAC,EAAU,EAAE,WAAmB;gBAC1C,OAAO,OAAO,CAAC;oBACb,MAAM,EAAE,MAAM;oBACd,IAAI,EAAE,6BAA6B,kBAAkB,CAAC,EAAE,CAAC,kBAAkB;oBAC3E,IAAI,EAAE,EAAE,YAAY,EAAE,WAAW,EAAE;iBACpC,CAAC,CAAC;YACL,CAAC;YACD,MAAM,EAAE;gBACN,GAAG;oBACD,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,kCAAkC,EAAE,CAAC,CAAC;gBAC9E,CAAC;gBACD,GAAG,CAAC,IAA8B;oBAChC,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,kCAAkC,EAAE,IAAI,EAAE,CAAC,CAAC;gBACpF,CAAC;gBACD,MAAM;oBACJ,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,kCAAkC,EAAE,CAAC,CAAC;gBACjF,CAAC;aACF;YACD,UAAU,EAAE;gBACV,GAAG;oBACD,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,sCAAsC,EAAE,CAAC,CAAC;gBAClF,CAAC;gBACD,qCAAqC;gBACrC,GAAG,CAAC,IAAkC;oBACpC,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,sCAAsC,EAAE,IAAI,EAAE,CAAC,CAAC;gBACxF,CAAC;gBACD,MAAM;oBACJ,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,sCAAsC,EAAE,CAAC,CAAC;gBACrF,CAAC;aACF;SACF;QACD,oEAAoE;QACpE,aAAa,EAAE;YACb,GAAG;gBACD,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,6BAA6B,EAAE,CAAC,CAAC;YACzE,CAAC;YACD,kCAAkC;YAClC,GAAG,CAAC,IAA0B;gBAC5B,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,6BAA6B,EAAE,IAAI,EAAE,CAAC,CAAC;YAC/E,CAAC;YACD,+EAA+E;YAC/E,MAAM;gBACJ,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,6BAA6B,EAAE,CAAC,CAAC;YAC5E,CAAC;SACF;KACF,CAAC;AACJ,CAAC"}

package/dist/client/organizations.d.ts

@@ -376,6 +376,12 @@ export declare function organizationsResource(request: RequestFn): {
     getPolicy(id: string): Promise<OrganizationPolicy>;
     create(body: CreateOrganizationBody, idempotencyKey?: string): Promise<Organization>;
     update(id: string, body: UpdateOrganizationBody): Promise<Organization>;
+    /**
+     * Create the organization with this `external_id`, or update it if it exists
+     * (`PUT /v1/organizations/by_external_id/{external_id}`). Race-safe: parallel
+     * calls for one id create one organization. `name` is required when it creates.
+     */
+    upsertByExternalId(externalId: string, body: Omit<CreateOrganizationBody, "external_id">, idempotencyKey?: string): Promise<Organization>;
     delete(id: string): Promise<DeletedObject>;
     /** `PUT /v1/organizations/:id/metadata` — replaces the named bags wholesale. */
     updateMetadata(id: string, body: ReplaceOrganizationMetadataBody): Promise<Organization>;

package/dist/client/organizations.js

@@ -32,6 +32,14 @@ function organizationsResource(request) {
         update(id, body) {
             return request({ method: 'PATCH', path: `/v1/organizations/${(0, request_1.enc)(id)}`, body });
         },
+        /**
+         * Create the organization with this `external_id`, or update it if it exists
+         * (`PUT /v1/organizations/by_external_id/{external_id}`). Race-safe: parallel
+         * calls for one id create one organization. `name` is required when it creates.
+         */
+        upsertByExternalId(externalId, body, idempotencyKey) {
+            return request({ method: 'PUT', path: `/v1/organizations/by_external_id/${(0, request_1.enc)(externalId)}`, body, idempotencyKey });
+        },
         delete(id) {
             return request({ method: 'DELETE', path: `/v1/organizations/${(0, request_1.enc)(id)}` });
         },

package/dist/client/organizations.js.map

@@ -1 +1 @@
-{"version":3,"file":"organizations.js","sourceRoot":"","sources":["../../src/client/organizations.ts"],"names":[],"mappings":";;AAqWA,sDA4aC;AAjxBD,uCAAgD;AAqWhD,SAAgB,qBAAqB,CAAC,OAAkB;IACtD,OAAO;QACL,IAAI,CAAC,SAAkC,EAAE;YACvC,MAAM,EAAE,QAAQ,EAAE,GAAG,IAAI,EAAE,GAAG,MAAM,CAAC;YACrC,MAAM,KAAK,GAA0D,EAAE,GAAG,IAAI,EAAE,CAAC;YACjF,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,QAAQ,IAAI,EAAE,CAAC;gBAAE,KAAK,CAAC,YAAY,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YACjF,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,mBAAmB,EAAE,KAAK,EAAE,CAAC,CAAC;QACtE,CAAC;QACD,GAAG,CAAC,EAAU;YACZ,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,qBAAqB,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;QAC1E,CAAC;QACD,uHAAuH;QACvH,YAAY,CAAC,MAAc,EAAE,OAAwC,EAAE;YACrE,OAAO,OAAO,CAAC;gBACb,MAAM,EAAE,KAAK;gBACb,IAAI,EAAE,+BAA+B,IAAA,aAAG,EAAC,MAAM,CAAC,EAAE;gBAClD,KAAK,EAAE,IAAI,CAAC,iBAAiB,CAAC,CAAC,CAAC,EAAE,kBAAkB,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE;aACpE,CAAC,CAAC;QACL,CAAC;QACD,0CAA0C;QAC1C,SAAS,CAAC,EAAU;YAClB,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,qBAAqB,IAAA,aAAG,EAAC,EAAE,CAAC,SAAS,EAAE,CAAC,CAAC;QACjF,CAAC;QACD,MAAM,CAAC,IAA4B,EAAE,cAAuB;YAC1D,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,mBAAmB,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC;QACtF,CAAC;QACD,MAAM,CAAC,EAAU,EAAE,IAA4B;YAC7C,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,qBAAqB,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;QAClF,CAAC;QACD,MAAM,CAAC,EAAU;YACf,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,qBAAqB,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;QAC7E,CAAC;QACD,gFAAgF;QAChF,cAAc,CAAC,EAAU,EAAE,IAAqC;YAC9D,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,qBAAqB,IAAA,aAAG,EAAC,EAAE,CAAC,WAAW,EAAE,IAAI,EAAE,CAAC,CAAC;QACzF,CAAC;QACD,4CAA4C;QAC5C,YAAY,CAAC,EAAU,EAAE,IAA6B;YACpD,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,qBAAqB,IAAA,aAAG,EAAC,EAAE,CAAC,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACzF,CAAC;QACD;;;;WAIG;QACH,SAAS,CAAC,EAAU,EAAE,IAA+C;YACnE,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,qBAAqB,IAAA,aAAG,EAAC,EAAE,CAAC,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACvF,CAAC;QACD,gGAAgG;QAChG,SAAS,CAAC,EAAU;YAClB,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,qBAAqB,IAAA,aAAG,EAAC,EAAE,CAAC,YAAY,EAAE,CAAC,CAAC;QACpF,CAAC;QACD;;;WAGG;QACH,YAAY,CAAC,EAAU;YACrB,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,qBAAqB,IAAA,aAAG,EAAC,EAAE,CAAC,eAAe,EAAE,CAAC,CAAC;QACvF,CAAC;QAED,WAAW,EAAE;YACX,IAAI,CAAC,KAAa;gBAChB,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,qBAAqB,IAAA,aAAG,EAAC,KAAK,CAAC,cAAc,EAAE,CAAC,CAAC;YACzF,CAAC;YACD,GAAG,CACD,KAAa,EACb,IAAwC,EACxC,cAAuB;gBAOvB,OAAO,OAAO,CAAC;oBACb,MAAM,EAAE,MAAM;oBACd,IAAI,EAAE,qBAAqB,IAAA,aAAG,EAAC,KAAK,CAAC,cAAc;oBACnD,IAAI;oBACJ,cAAc;iBACf,CAAC,CAAC;YACL,CAAC;YACD,MAAM,CACJ,KAAa,EACb,MAAc;YACd;;;;eAIG;YACH,IAA6C;gBAE7C,OAAO,OAAO,CAAC;oBACb,MAAM,EAAE,OAAO;oBACf,IAAI,EAAE,qBAAqB,IAAA,aAAG,EAAC,KAAK,CAAC,gBAAgB,IAAA,aAAG,EAAC,MAAM,CAAC,EAAE;oBAClE,IAAI;iBACL,CAAC,CAAC;YACL,CAAC;YACD,MAAM,CACJ,KAAa,EACb,MAAc;gBAEd,OAAO,OAAO,CAAC;oBACb,MAAM,EAAE,QAAQ;oBAChB,IAAI,EAAE,qBAAqB,IAAA,aAAG,EAAC,KAAK,CAAC,gBAAgB,IAAA,aAAG,EAAC,MAAM,CAAC,EAAE;iBACnE,CAAC,CAAC;YACL,CAAC;SACF;QAED,WAAW,EAAE;YACX,IAAI,CAAC,KAAa;gBAChB,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,qBAAqB,IAAA,aAAG,EAAC,KAAK,CAAC,cAAc,EAAE,CAAC,CAAC;YACzF,CAAC;YACD,MAAM,CACJ,KAAa,EACb,IAA8D,EAC9D,cAAuB;gBASvB,OAAO,OAAO,CAAC;oBACb,MAAM,EAAE,MAAM;oBACd,IAAI,EAAE,qBAAqB,IAAA,aAAG,EAAC,KAAK,CAAC,cAAc;oBACnD,IAAI;oBACJ,cAAc;iBACf,CAAC,CAAC;YACL,CAAC;YACD,MAAM,CACJ,KAAa,EACb,YAAoB;gBAEpB,OAAO,OAAO,CAAC;oBACb,MAAM,EAAE,MAAM;oBACd,IAAI,EAAE,qBAAqB,IAAA,aAAG,EAAC,KAAK,CAAC,gBAAgB,IAAA,aAAG,EAAC,YAAY,CAAC,SAAS;iBAChF,CAAC,CAAC;YACL,CAAC;SACF;QAED,OAAO,EAAE;YACP,IAAI,CAAC,KAAa;gBAChB,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,qBAAqB,IAAA,aAAG,EAAC,KAAK,CAAC,UAAU,EAAE,CAAC,CAAC;YACrF,CAAC;YACD,MAAM,CACJ,KAAa,EACb,IAA8E,EAC9E,cAAuB;gBAEvB,OAAO,OAAO,CAAC;oBACb,MAAM,EAAE,MAAM;oBACd,IAAI,EAAE,qBAAqB,IAAA,aAAG,EAAC,KAAK,CAAC,UAAU;oBAC/C,IAAI;oBACJ,cAAc;iBACf,CAAC,CAAC;YACL,CAAC;YACD,6GAA6G;YAC7G,MAAM,CACJ,KAAa,EACb,QAAgB,EAChB,IAA8D;gBAE9D,OAAO,OAAO,CAAC;oBACb,MAAM,EAAE,MAAM;oBACd,IAAI,EAAE,qBAAqB,IAAA,aAAG,EAAC,KAAK,CAAC,YAAY,IAAA,aAAG,EAAC,QAAQ,CAAC,SAAS;oBACvE,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;iBAC1B,CAAC,CAAC;YACL,CAAC;YACD,qHAAqH;YACrH,qBAAqB,CACnB,KAAa,EACb,QAAgB,EAChB,OAA4F,EAAE;gBAE9F,OAAO,OAAO,CAAC;oBACb,MAAM,EAAE,MAAM;oBACd,IAAI,EAAE,qBAAqB,IAAA,aAAG,EAAC,KAAK,CAAC,YAAY,IAAA,aAAG,EAAC,QAAQ,CAAC,qBAAqB;oBACnF,IAAI;iBACL,CAAC,CAAC;YACL,CAAC;YACD,MAAM,CACJ,KAAa,EACb,QAAgB;gBAEhB,OAAO,OAAO,CAAC;oBACb,MAAM,EAAE,QAAQ;oBAChB,IAAI,EAAE,qBAAqB,IAAA,aAAG,EAAC,KAAK,CAAC,YAAY,IAAA,aAAG,EAAC,QAAQ,CAAC,EAAE;iBACjE,CAAC,CAAC;YACL,CAAC;SACF;QAED,4FAA4F;QAC5F,QAAQ,EAAE;YACR,0DAA0D;YAC1D,GAAG,CAAC,KAAa;gBACf,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,qBAAqB,IAAA,aAAG,EAAC,KAAK,CAAC,WAAW,EAAE,CAAC,CAAC;YACtF,CAAC;YACD,iFAAiF;YACjF,OAAO,CACL,KAAa,EACb,MAA+B,EAC/B,cAAuB;gBAEvB,OAAO,OAAO,CAAC;oBACb,MAAM,EAAE,KAAK;oBACb,IAAI,EAAE,qBAAqB,IAAA,aAAG,EAAC,KAAK,CAAC,WAAW;oBAChD,IAAI,EAAE,EAAE,MAAM,EAAE;oBAChB,cAAc;iBACf,CAAC,CAAC;YACL,CAAC;YACD;;;eAGG;YACH,MAAM,CACJ,KAAa,EACb,MAA+B,EAC/B,cAAuB;gBAEvB,OAAO,OAAO,CAAC;oBACb,MAAM,EAAE,OAAO;oBACf,IAAI,EAAE,qBAAqB,IAAA,aAAG,EAAC,KAAK,CAAC,WAAW;oBAChD,IAAI,EAAE,EAAE,MAAM,EAAE;oBAChB,cAAc;iBACf,CAAC,CAAC;YACL,CAAC;SACF;QAED,yFAAyF;QACzF,YAAY,EAAE;YACZ,IAAI,CAAC,KAAa;gBAChB,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,qBAAqB,IAAA,aAAG,EAAC,KAAK,CAAC,gBAAgB,EAAE,CAAC,CAAC;YAC3F,CAAC;YACD,MAAM,CACJ,KAAa,EACb,IAAuC,EACvC,cAAuB;gBAEvB,OAAO,OAAO,CAAC;oBACb,MAAM,EAAE,MAAM;oBACd,IAAI,EAAE,qBAAqB,IAAA,aAAG,EAAC,KAAK,CAAC,gBAAgB;oBACrD,IAAI;oBACJ,cAAc;iBACf,CAAC,CAAC;YACL,CAAC;YACD,MAAM,CACJ,KAAa,EACb,QAAgB;gBAEhB,OAAO,OAAO,CAAC;oBACb,MAAM,EAAE,QAAQ;oBAChB,IAAI,EAAE,qBAAqB,IAAA,aAAG,EAAC,KAAK,CAAC,kBAAkB,IAAA,aAAG,EAAC,QAAQ,CAAC,EAAE;iBACvE,CAAC,CAAC;YACL,CAAC;SACF;QAED;;;;WAIG;QACH,gBAAgB,EAAE;YAChB,IAAI,CAAC,KAAa;gBAChB,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,qBAAqB,IAAA,aAAG,EAAC,KAAK,CAAC,oBAAoB,EAAE,CAAC,CAAC;YAC/F,CAAC;YACD,GAAG,CAAC,KAAa,EAAE,UAAkB;gBACnC,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,qBAAqB,IAAA,aAAG,EAAC,KAAK,CAAC,sBAAsB,IAAA,aAAG,EAAC,UAAU,CAAC,EAAE,EAAE,CAAC,CAAC;YAClH,CAAC;YACD,mDAAmD;YACnD,MAAM,CACJ,KAAa,EACb,IAAuD,EACvD,cAAuB;gBAEvB,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,qBAAqB,IAAA,aAAG,EAAC,KAAK,CAAC,oBAAoB,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC;YACtH,CAAC;YACD,MAAM,CAAC,KAAa,EAAE,UAAkB,EAAE,IAAqC;gBAC7E,OAAO,OAAO,CAAC;oBACb,MAAM,EAAE,OAAO;oBACf,IAAI,EAAE,qBAAqB,IAAA,aAAG,EAAC,KAAK,CAAC,sBAAsB,IAAA,aAAG,EAAC,UAAU,CAAC,EAAE;oBAC5E,IAAI;iBACL,CAAC,CAAC;YACL,CAAC;YACD,MAAM,CAAC,KAAa,EAAE,UAAkB;gBACtC,OAAO,OAAO,CAAC;oBACb,MAAM,EAAE,QAAQ;oBAChB,IAAI,EAAE,qBAAqB,IAAA,aAAG,EAAC,KAAK,CAAC,sBAAsB,IAAA,aAAG,EAAC,UAAU,CAAC,EAAE;iBAC7E,CAAC,CAAC;YACL,CAAC;YACD,gFAAgF;YAChF,YAAY,CACV,KAAa,EACb,UAAkB;gBAElB,OAAO,OAAO,CAAC;oBACb,MAAM,EAAE,MAAM;oBACd,IAAI,EAAE,qBAAqB,IAAA,aAAG,EAAC,KAAK,CAAC,sBAAsB,IAAA,aAAG,EAAC,UAAU,CAAC,gBAAgB;iBAC3F,CAAC,CAAC;YACL,CAAC;YACD,UAAU,CAAC,KAAa,EAAE,UAAkB,EAAE,QAAqD,EAAE;gBACnG,OAAO,OAAO,CAAC;oBACb,MAAM,EAAE,KAAK;oBACb,IAAI,EAAE,qBAAqB,IAAA,aAAG,EAAC,KAAK,CAAC,sBAAsB,IAAA,aAAG,EAAC,UAAU,CAAC,aAAa;oBACvF,KAAK;iBACN,CAAC,CAAC;YACL,CAAC;SACF;QAED,uDAAuD;QACvD,QAAQ,EAAE;YACR,GAAG,CAAC,KAAa;gBACf,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,qBAAqB,IAAA,aAAG,EAAC,KAAK,CAAC,WAAW,EAAE,CAAC,CAAC;YACtF,CAAC;YACD,yFAAyF;YACzF,MAAM,CAAC,KAAa,EAAE,IAAoC;gBACxD,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,qBAAqB,IAAA,aAAG,EAAC,KAAK,CAAC,WAAW,EAAE,IAAI,EAAE,CAAC,CAAC;YAC5F,CAAC;SACF;QAED,qFAAqF;QACrF,QAAQ,EAAE;YACR,IAAI,CACF,KAAa,EACb,SAAyC,EAAE;gBAE3C,OAAO,OAAO,CAAC;oBACb,MAAM,EAAE,KAAK;oBACb,IAAI,EAAE,qBAAqB,IAAA,aAAG,EAAC,KAAK,CAAC,YAAY;oBACjD,KAAK,EAAE,EAAE,GAAG,MAAM,EAAE;iBACrB,CAAC,CAAC;YACL,CAAC;YACD,2FAA2F;YAC3F,GAAG,CACD,KAAa,EACb,IAAgC,EAChC,cAAuB;gBAEvB,OAAO,OAAO,CAAC;oBACb,MAAM,EAAE,MAAM;oBACd,IAAI,EAAE,qBAAqB,IAAA,aAAG,EAAC,KAAK,CAAC,YAAY;oBACjD,IAAI;oBACJ,cAAc;iBACf,CAAC,CAAC;YACL,CAAC;YACD,8DAA8D;YAC9D,MAAM,CACJ,KAAa,EACb,MAAc,EACd,IAA2C;gBAE3C,OAAO,OAAO,CAAC;oBACb,MAAM,EAAE,OAAO;oBACf,IAAI,EAAE,qBAAqB,IAAA,aAAG,EAAC,KAAK,CAAC,cAAc,IAAA,aAAG,EAAC,MAAM,CAAC,EAAE;oBAChE,IAAI;iBACL,CAAC,CAAC;YACL,CAAC;YACD,MAAM,CACJ,KAAa,EACb,MAAc;gBAEd,OAAO,OAAO,CAAC;oBACb,MAAM,EAAE,QAAQ;oBAChB,IAAI,EAAE,qBAAqB,IAAA,aAAG,EAAC,KAAK,CAAC,cAAc,IAAA,aAAG,EAAC,MAAM,CAAC,EAAE;iBACjE,CAAC,CAAC;YACL,CAAC;SACF;QAED,wEAAwE;QACxE,YAAY,EAAE;YACZ,IAAI,CAAC,KAAa;gBAChB,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,qBAAqB,IAAA,aAAG,EAAC,KAAK,CAAC,gBAAgB,EAAE,CAAC,CAAC;YAC3F,CAAC;YACD,mFAAmF;YACnF,MAAM,CACJ,KAAa,EACb,IAAsB,EACtB,cAAuB;gBAEvB,OAAO,OAAO,CAAC;oBACb,MAAM,EAAE,MAAM;oBACd,IAAI,EAAE,qBAAqB,IAAA,aAAG,EAAC,KAAK,CAAC,gBAAgB;oBACrD,IAAI;oBACJ,cAAc;iBACf,CAAC,CAAC;YACL,CAAC;YACD,MAAM,CAAC,KAAa;gBAClB,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,qBAAqB,IAAA,aAAG,EAAC,KAAK,CAAC,gBAAgB,EAAE,CAAC,CAAC;YAC9F,CAAC;SACF;QAED,uEAAuE;QACvE,UAAU,EAAE;YACV,KAAK,CACH,KAAa,EACb,OAAe,EACf,MAAc;gBAQd,OAAO,OAAO,CAAC;oBACb,MAAM,EAAE,KAAK;oBACb,IAAI,EAAE,qBAAqB,IAAA,aAAG,EAAC,KAAK,CAAC,WAAW,IAAA,aAAG,EAAC,OAAO,CAAC,UAAU,IAAA,aAAG,EAAC,MAAM,CAAC,EAAE;iBACpF,CAAC,CAAC;YACL,CAAC;YACD,MAAM,CACJ,KAAa,EACb,OAAe,EACf,MAAc;gBAQd,OAAO,OAAO,CAAC;oBACb,MAAM,EAAE,QAAQ;oBAChB,IAAI,EAAE,qBAAqB,IAAA,aAAG,EAAC,KAAK,CAAC,WAAW,IAAA,aAAG,EAAC,OAAO,CAAC,UAAU,IAAA,aAAG,EAAC,MAAM,CAAC,EAAE;iBACpF,CAAC,CAAC;YACL,CAAC;SACF;KACF,CAAC;AACJ,CAAC"}
+{"version":3,"file":"organizations.js","sourceRoot":"","sources":["../../src/client/organizations.ts"],"names":[],"mappings":";;AAqWA,sDAwbC;AA7xBD,uCAAgD;AAqWhD,SAAgB,qBAAqB,CAAC,OAAkB;IACtD,OAAO;QACL,IAAI,CAAC,SAAkC,EAAE;YACvC,MAAM,EAAE,QAAQ,EAAE,GAAG,IAAI,EAAE,GAAG,MAAM,CAAC;YACrC,MAAM,KAAK,GAA0D,EAAE,GAAG,IAAI,EAAE,CAAC;YACjF,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,QAAQ,IAAI,EAAE,CAAC;gBAAE,KAAK,CAAC,YAAY,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YACjF,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,mBAAmB,EAAE,KAAK,EAAE,CAAC,CAAC;QACtE,CAAC;QACD,GAAG,CAAC,EAAU;YACZ,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,qBAAqB,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;QAC1E,CAAC;QACD,uHAAuH;QACvH,YAAY,CAAC,MAAc,EAAE,OAAwC,EAAE;YACrE,OAAO,OAAO,CAAC;gBACb,MAAM,EAAE,KAAK;gBACb,IAAI,EAAE,+BAA+B,IAAA,aAAG,EAAC,MAAM,CAAC,EAAE;gBAClD,KAAK,EAAE,IAAI,CAAC,iBAAiB,CAAC,CAAC,CAAC,EAAE,kBAAkB,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE;aACpE,CAAC,CAAC;QACL,CAAC;QACD,0CAA0C;QAC1C,SAAS,CAAC,EAAU;YAClB,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,qBAAqB,IAAA,aAAG,EAAC,EAAE,CAAC,SAAS,EAAE,CAAC,CAAC;QACjF,CAAC;QACD,MAAM,CAAC,IAA4B,EAAE,cAAuB;YAC1D,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,mBAAmB,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC;QACtF,CAAC;QACD,MAAM,CAAC,EAAU,EAAE,IAA4B;YAC7C,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,qBAAqB,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;QAClF,CAAC;QACD;;;;WAIG;QACH,kBAAkB,CAChB,UAAkB,EAClB,IAAiD,EACjD,cAAuB;YAEvB,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,oCAAoC,IAAA,aAAG,EAAC,UAAU,CAAC,EAAE,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC;QACvH,CAAC;QACD,MAAM,CAAC,EAAU;YACf,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,qBAAqB,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;QAC7E,CAAC;QACD,gFAAgF;QAChF,cAAc,CAAC,EAAU,EAAE,IAAqC;YAC9D,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,qBAAqB,IAAA,aAAG,EAAC,EAAE,CAAC,WAAW,EAAE,IAAI,EAAE,CAAC,CAAC;QACzF,CAAC;QACD,4CAA4C;QAC5C,YAAY,CAAC,EAAU,EAAE,IAA6B;YACpD,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,qBAAqB,IAAA,aAAG,EAAC,EAAE,CAAC,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACzF,CAAC;QACD;;;;WAIG;QACH,SAAS,CAAC,EAAU,EAAE,IAA+C;YACnE,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,qBAAqB,IAAA,aAAG,EAAC,EAAE,CAAC,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACvF,CAAC;QACD,gGAAgG;QAChG,SAAS,CAAC,EAAU;YAClB,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,qBAAqB,IAAA,aAAG,EAAC,EAAE,CAAC,YAAY,EAAE,CAAC,CAAC;QACpF,CAAC;QACD;;;WAGG;QACH,YAAY,CAAC,EAAU;YACrB,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,qBAAqB,IAAA,aAAG,EAAC,EAAE,CAAC,eAAe,EAAE,CAAC,CAAC;QACvF,CAAC;QAED,WAAW,EAAE;YACX,IAAI,CAAC,KAAa;gBAChB,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,qBAAqB,IAAA,aAAG,EAAC,KAAK,CAAC,cAAc,EAAE,CAAC,CAAC;YACzF,CAAC;YACD,GAAG,CACD,KAAa,EACb,IAAwC,EACxC,cAAuB;gBAOvB,OAAO,OAAO,CAAC;oBACb,MAAM,EAAE,MAAM;oBACd,IAAI,EAAE,qBAAqB,IAAA,aAAG,EAAC,KAAK,CAAC,cAAc;oBACnD,IAAI;oBACJ,cAAc;iBACf,CAAC,CAAC;YACL,CAAC;YACD,MAAM,CACJ,KAAa,EACb,MAAc;YACd;;;;eAIG;YACH,IAA6C;gBAE7C,OAAO,OAAO,CAAC;oBACb,MAAM,EAAE,OAAO;oBACf,IAAI,EAAE,qBAAqB,IAAA,aAAG,EAAC,KAAK,CAAC,gBAAgB,IAAA,aAAG,EAAC,MAAM,CAAC,EAAE;oBAClE,IAAI;iBACL,CAAC,CAAC;YACL,CAAC;YACD,MAAM,CACJ,KAAa,EACb,MAAc;gBAEd,OAAO,OAAO,CAAC;oBACb,MAAM,EAAE,QAAQ;oBAChB,IAAI,EAAE,qBAAqB,IAAA,aAAG,EAAC,KAAK,CAAC,gBAAgB,IAAA,aAAG,EAAC,MAAM,CAAC,EAAE;iBACnE,CAAC,CAAC;YACL,CAAC;SACF;QAED,WAAW,EAAE;YACX,IAAI,CAAC,KAAa;gBAChB,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,qBAAqB,IAAA,aAAG,EAAC,KAAK,CAAC,cAAc,EAAE,CAAC,CAAC;YACzF,CAAC;YACD,MAAM,CACJ,KAAa,EACb,IAA8D,EAC9D,cAAuB;gBASvB,OAAO,OAAO,CAAC;oBACb,MAAM,EAAE,MAAM;oBACd,IAAI,EAAE,qBAAqB,IAAA,aAAG,EAAC,KAAK,CAAC,cAAc;oBACnD,IAAI;oBACJ,cAAc;iBACf,CAAC,CAAC;YACL,CAAC;YACD,MAAM,CACJ,KAAa,EACb,YAAoB;gBAEpB,OAAO,OAAO,CAAC;oBACb,MAAM,EAAE,MAAM;oBACd,IAAI,EAAE,qBAAqB,IAAA,aAAG,EAAC,KAAK,CAAC,gBAAgB,IAAA,aAAG,EAAC,YAAY,CAAC,SAAS;iBAChF,CAAC,CAAC;YACL,CAAC;SACF;QAED,OAAO,EAAE;YACP,IAAI,CAAC,KAAa;gBAChB,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,qBAAqB,IAAA,aAAG,EAAC,KAAK,CAAC,UAAU,EAAE,CAAC,CAAC;YACrF,CAAC;YACD,MAAM,CACJ,KAAa,EACb,IAA8E,EAC9E,cAAuB;gBAEvB,OAAO,OAAO,CAAC;oBACb,MAAM,EAAE,MAAM;oBACd,IAAI,EAAE,qBAAqB,IAAA,aAAG,EAAC,KAAK,CAAC,UAAU;oBAC/C,IAAI;oBACJ,cAAc;iBACf,CAAC,CAAC;YACL,CAAC;YACD,6GAA6G;YAC7G,MAAM,CACJ,KAAa,EACb,QAAgB,EAChB,IAA8D;gBAE9D,OAAO,OAAO,CAAC;oBACb,MAAM,EAAE,MAAM;oBACd,IAAI,EAAE,qBAAqB,IAAA,aAAG,EAAC,KAAK,CAAC,YAAY,IAAA,aAAG,EAAC,QAAQ,CAAC,SAAS;oBACvE,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;iBAC1B,CAAC,CAAC;YACL,CAAC;YACD,qHAAqH;YACrH,qBAAqB,CACnB,KAAa,EACb,QAAgB,EAChB,OAA4F,EAAE;gBAE9F,OAAO,OAAO,CAAC;oBACb,MAAM,EAAE,MAAM;oBACd,IAAI,EAAE,qBAAqB,IAAA,aAAG,EAAC,KAAK,CAAC,YAAY,IAAA,aAAG,EAAC,QAAQ,CAAC,qBAAqB;oBACnF,IAAI;iBACL,CAAC,CAAC;YACL,CAAC;YACD,MAAM,CACJ,KAAa,EACb,QAAgB;gBAEhB,OAAO,OAAO,CAAC;oBACb,MAAM,EAAE,QAAQ;oBAChB,IAAI,EAAE,qBAAqB,IAAA,aAAG,EAAC,KAAK,CAAC,YAAY,IAAA,aAAG,EAAC,QAAQ,CAAC,EAAE;iBACjE,CAAC,CAAC;YACL,CAAC;SACF;QAED,4FAA4F;QAC5F,QAAQ,EAAE;YACR,0DAA0D;YAC1D,GAAG,CAAC,KAAa;gBACf,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,qBAAqB,IAAA,aAAG,EAAC,KAAK,CAAC,WAAW,EAAE,CAAC,CAAC;YACtF,CAAC;YACD,iFAAiF;YACjF,OAAO,CACL,KAAa,EACb,MAA+B,EAC/B,cAAuB;gBAEvB,OAAO,OAAO,CAAC;oBACb,MAAM,EAAE,KAAK;oBACb,IAAI,EAAE,qBAAqB,IAAA,aAAG,EAAC,KAAK,CAAC,WAAW;oBAChD,IAAI,EAAE,EAAE,MAAM,EAAE;oBAChB,cAAc;iBACf,CAAC,CAAC;YACL,CAAC;YACD;;;eAGG;YACH,MAAM,CACJ,KAAa,EACb,MAA+B,EAC/B,cAAuB;gBAEvB,OAAO,OAAO,CAAC;oBACb,MAAM,EAAE,OAAO;oBACf,IAAI,EAAE,qBAAqB,IAAA,aAAG,EAAC,KAAK,CAAC,WAAW;oBAChD,IAAI,EAAE,EAAE,MAAM,EAAE;oBAChB,cAAc;iBACf,CAAC,CAAC;YACL,CAAC;SACF;QAED,yFAAyF;QACzF,YAAY,EAAE;YACZ,IAAI,CAAC,KAAa;gBAChB,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,qBAAqB,IAAA,aAAG,EAAC,KAAK,CAAC,gBAAgB,EAAE,CAAC,CAAC;YAC3F,CAAC;YACD,MAAM,CACJ,KAAa,EACb,IAAuC,EACvC,cAAuB;gBAEvB,OAAO,OAAO,CAAC;oBACb,MAAM,EAAE,MAAM;oBACd,IAAI,EAAE,qBAAqB,IAAA,aAAG,EAAC,KAAK,CAAC,gBAAgB;oBACrD,IAAI;oBACJ,cAAc;iBACf,CAAC,CAAC;YACL,CAAC;YACD,MAAM,CACJ,KAAa,EACb,QAAgB;gBAEhB,OAAO,OAAO,CAAC;oBACb,MAAM,EAAE,QAAQ;oBAChB,IAAI,EAAE,qBAAqB,IAAA,aAAG,EAAC,KAAK,CAAC,kBAAkB,IAAA,aAAG,EAAC,QAAQ,CAAC,EAAE;iBACvE,CAAC,CAAC;YACL,CAAC;SACF;QAED;;;;WAIG;QACH,gBAAgB,EAAE;YAChB,IAAI,CAAC,KAAa;gBAChB,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,qBAAqB,IAAA,aAAG,EAAC,KAAK,CAAC,oBAAoB,EAAE,CAAC,CAAC;YAC/F,CAAC;YACD,GAAG,CAAC,KAAa,EAAE,UAAkB;gBACnC,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,qBAAqB,IAAA,aAAG,EAAC,KAAK,CAAC,sBAAsB,IAAA,aAAG,EAAC,UAAU,CAAC,EAAE,EAAE,CAAC,CAAC;YAClH,CAAC;YACD,mDAAmD;YACnD,MAAM,CACJ,KAAa,EACb,IAAuD,EACvD,cAAuB;gBAEvB,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,qBAAqB,IAAA,aAAG,EAAC,KAAK,CAAC,oBAAoB,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC;YACtH,CAAC;YACD,MAAM,CAAC,KAAa,EAAE,UAAkB,EAAE,IAAqC;gBAC7E,OAAO,OAAO,CAAC;oBACb,MAAM,EAAE,OAAO;oBACf,IAAI,EAAE,qBAAqB,IAAA,aAAG,EAAC,KAAK,CAAC,sBAAsB,IAAA,aAAG,EAAC,UAAU,CAAC,EAAE;oBAC5E,IAAI;iBACL,CAAC,CAAC;YACL,CAAC;YACD,MAAM,CAAC,KAAa,EAAE,UAAkB;gBACtC,OAAO,OAAO,CAAC;oBACb,MAAM,EAAE,QAAQ;oBAChB,IAAI,EAAE,qBAAqB,IAAA,aAAG,EAAC,KAAK,CAAC,sBAAsB,IAAA,aAAG,EAAC,UAAU,CAAC,EAAE;iBAC7E,CAAC,CAAC;YACL,CAAC;YACD,gFAAgF;YAChF,YAAY,CACV,KAAa,EACb,UAAkB;gBAElB,OAAO,OAAO,CAAC;oBACb,MAAM,EAAE,MAAM;oBACd,IAAI,EAAE,qBAAqB,IAAA,aAAG,EAAC,KAAK,CAAC,sBAAsB,IAAA,aAAG,EAAC,UAAU,CAAC,gBAAgB;iBAC3F,CAAC,CAAC;YACL,CAAC;YACD,UAAU,CAAC,KAAa,EAAE,UAAkB,EAAE,QAAqD,EAAE;gBACnG,OAAO,OAAO,CAAC;oBACb,MAAM,EAAE,KAAK;oBACb,IAAI,EAAE,qBAAqB,IAAA,aAAG,EAAC,KAAK,CAAC,sBAAsB,IAAA,aAAG,EAAC,UAAU,CAAC,aAAa;oBACvF,KAAK;iBACN,CAAC,CAAC;YACL,CAAC;SACF;QAED,uDAAuD;QACvD,QAAQ,EAAE;YACR,GAAG,CAAC,KAAa;gBACf,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,qBAAqB,IAAA,aAAG,EAAC,KAAK,CAAC,WAAW,EAAE,CAAC,CAAC;YACtF,CAAC;YACD,yFAAyF;YACzF,MAAM,CAAC,KAAa,EAAE,IAAoC;gBACxD,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,qBAAqB,IAAA,aAAG,EAAC,KAAK,CAAC,WAAW,EAAE,IAAI,EAAE,CAAC,CAAC;YAC5F,CAAC;SACF;QAED,qFAAqF;QACrF,QAAQ,EAAE;YACR,IAAI,CACF,KAAa,EACb,SAAyC,EAAE;gBAE3C,OAAO,OAAO,CAAC;oBACb,MAAM,EAAE,KAAK;oBACb,IAAI,EAAE,qBAAqB,IAAA,aAAG,EAAC,KAAK,CAAC,YAAY;oBACjD,KAAK,EAAE,EAAE,GAAG,MAAM,EAAE;iBACrB,CAAC,CAAC;YACL,CAAC;YACD,2FAA2F;YAC3F,GAAG,CACD,KAAa,EACb,IAAgC,EAChC,cAAuB;gBAEvB,OAAO,OAAO,CAAC;oBACb,MAAM,EAAE,MAAM;oBACd,IAAI,EAAE,qBAAqB,IAAA,aAAG,EAAC,KAAK,CAAC,YAAY;oBACjD,IAAI;oBACJ,cAAc;iBACf,CAAC,CAAC;YACL,CAAC;YACD,8DAA8D;YAC9D,MAAM,CACJ,KAAa,EACb,MAAc,EACd,IAA2C;gBAE3C,OAAO,OAAO,CAAC;oBACb,MAAM,EAAE,OAAO;oBACf,IAAI,EAAE,qBAAqB,IAAA,aAAG,EAAC,KAAK,CAAC,cAAc,IAAA,aAAG,EAAC,MAAM,CAAC,EAAE;oBAChE,IAAI;iBACL,CAAC,CAAC;YACL,CAAC;YACD,MAAM,CACJ,KAAa,EACb,MAAc;gBAEd,OAAO,OAAO,CAAC;oBACb,MAAM,EAAE,QAAQ;oBAChB,IAAI,EAAE,qBAAqB,IAAA,aAAG,EAAC,KAAK,CAAC,cAAc,IAAA,aAAG,EAAC,MAAM,CAAC,EAAE;iBACjE,CAAC,CAAC;YACL,CAAC;SACF;QAED,wEAAwE;QACxE,YAAY,EAAE;YACZ,IAAI,CAAC,KAAa;gBAChB,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,qBAAqB,IAAA,aAAG,EAAC,KAAK,CAAC,gBAAgB,EAAE,CAAC,CAAC;YAC3F,CAAC;YACD,mFAAmF;YACnF,MAAM,CACJ,KAAa,EACb,IAAsB,EACtB,cAAuB;gBAEvB,OAAO,OAAO,CAAC;oBACb,MAAM,EAAE,MAAM;oBACd,IAAI,EAAE,qBAAqB,IAAA,aAAG,EAAC,KAAK,CAAC,gBAAgB;oBACrD,IAAI;oBACJ,cAAc;iBACf,CAAC,CAAC;YACL,CAAC;YACD,MAAM,CAAC,KAAa;gBAClB,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,qBAAqB,IAAA,aAAG,EAAC,KAAK,CAAC,gBAAgB,EAAE,CAAC,CAAC;YAC9F,CAAC;SACF;QAED,uEAAuE;QACvE,UAAU,EAAE;YACV,KAAK,CACH,KAAa,EACb,OAAe,EACf,MAAc;gBAQd,OAAO,OAAO,CAAC;oBACb,MAAM,EAAE,KAAK;oBACb,IAAI,EAAE,qBAAqB,IAAA,aAAG,EAAC,KAAK,CAAC,WAAW,IAAA,aAAG,EAAC,OAAO,CAAC,UAAU,IAAA,aAAG,EAAC,MAAM,CAAC,EAAE;iBACpF,CAAC,CAAC;YACL,CAAC;YACD,MAAM,CACJ,KAAa,EACb,OAAe,EACf,MAAc;gBAQd,OAAO,OAAO,CAAC;oBACb,MAAM,EAAE,QAAQ;oBAChB,IAAI,EAAE,qBAAqB,IAAA,aAAG,EAAC,KAAK,CAAC,WAAW,IAAA,aAAG,EAAC,OAAO,CAAC,UAAU,IAAA,aAAG,EAAC,MAAM,CAAC,EAAE;iBACpF,CAAC,CAAC;YACL,CAAC;SACF;KACF,CAAC;AACJ,CAAC"}

package/dist/client/sso-onboarding.d.ts

@@ -79,6 +79,12 @@ export declare function ssoOnboardingResource(request: RequestFn): {
     }): Promise<ListPage<SsoOnboardingProfile>>;
     get(id: string): Promise<SsoOnboardingProfile>;
     create(body: CreateSsoOnboardingProfileBody, idempotencyKey?: string): Promise<SsoOnboardingProfile>;
+    /**
+     * Create the profile with this name, or update it if it exists
+     * (`PUT /v1/sso_onboarding_profiles/by_name/{name}`). Parallel calls for one
+     * name create one profile.
+     */
+    upsertByName(name: string, body: Omit<CreateSsoOnboardingProfileBody, "name">): Promise<SsoOnboardingProfile>;
     delete(id: string): Promise<{
         object: "sso_onboarding_profile";
         id: string;

package/dist/client/sso-onboarding.js

@@ -19,6 +19,14 @@ function ssoOnboardingResource(request) {
                 idempotencyKey,
             });
         },
+        /**
+         * Create the profile with this name, or update it if it exists
+         * (`PUT /v1/sso_onboarding_profiles/by_name/{name}`). Parallel calls for one
+         * name create one profile.
+         */
+        upsertByName(name, body) {
+            return request({ method: 'PUT', path: `/v1/sso_onboarding_profiles/by_name/${(0, request_1.enc)(name)}`, body });
+        },
         delete(id) {
             return request({ method: 'DELETE', path: `/v1/sso_onboarding_profiles/${(0, request_1.enc)(id)}` });
         },

package/dist/client/sso-onboarding.js.map

@@ -1 +1 @@
-{"version":3,"file":"sso-onboarding.js","sourceRoot":"","sources":["../../src/client/sso-onboarding.ts"],"names":[],"mappings":";;AAyFA,sDA8CC;AAvID,uCAAgD;AAyFhD,SAAgB,qBAAqB,CAAC,OAAkB;IACtD,OAAO;QACL,gFAAgF;QAChF,IAAI,CAAC,SAA4B,EAAE;YACjC,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,6BAA6B,EAAE,KAAK,EAAE,EAAE,GAAG,MAAM,EAAE,EAAE,CAAC,CAAC;QAC/F,CAAC;QACD,GAAG,CAAC,EAAU;YACZ,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,+BAA+B,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;QACpF,CAAC;QACD,MAAM,CACJ,IAAoC,EACpC,cAAuB;YAEvB,OAAO,OAAO,CAAC;gBACb,MAAM,EAAE,MAAM;gBACd,IAAI,EAAE,6BAA6B;gBACnC,IAAI;gBACJ,cAAc;aACf,CAAC,CAAC;QACL,CAAC;QACD,MAAM,CAAC,EAAU;YACf,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,+BAA+B,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;QACvF,CAAC;QACD,+EAA+E;QAC/E,YAAY,CACV,SAAiB,EACjB,OAAsC,EAAE,EACxC,cAAuB;YAEvB,OAAO,OAAO,CAAC;gBACb,MAAM,EAAE,MAAM;gBACd,IAAI,EAAE,+BAA+B,IAAA,aAAG,EAAC,SAAS,CAAC,UAAU;gBAC7D,IAAI;gBACJ,cAAc;aACf,CAAC,CAAC;QACL,CAAC;QACD,kFAAkF;QAClF,YAAY,CACV,QAAgB;YAEhB,OAAO,OAAO,CAAC;gBACb,MAAM,EAAE,MAAM;gBACd,IAAI,EAAE,8BAA8B,IAAA,aAAG,EAAC,QAAQ,CAAC,SAAS;aAC3D,CAAC,CAAC;QACL,CAAC;KACF,CAAC;AACJ,CAAC"}
+{"version":3,"file":"sso-onboarding.js","sourceRoot":"","sources":["../../src/client/sso-onboarding.ts"],"names":[],"mappings":";;AAyFA,sDAsDC;AA/ID,uCAAgD;AAyFhD,SAAgB,qBAAqB,CAAC,OAAkB;IACtD,OAAO;QACL,gFAAgF;QAChF,IAAI,CAAC,SAA4B,EAAE;YACjC,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,6BAA6B,EAAE,KAAK,EAAE,EAAE,GAAG,MAAM,EAAE,EAAE,CAAC,CAAC;QAC/F,CAAC;QACD,GAAG,CAAC,EAAU;YACZ,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,+BAA+B,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;QACpF,CAAC;QACD,MAAM,CACJ,IAAoC,EACpC,cAAuB;YAEvB,OAAO,OAAO,CAAC;gBACb,MAAM,EAAE,MAAM;gBACd,IAAI,EAAE,6BAA6B;gBACnC,IAAI;gBACJ,cAAc;aACf,CAAC,CAAC;QACL,CAAC;QACD;;;;WAIG;QACH,YAAY,CAAC,IAAY,EAAE,IAAkD;YAC3E,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,uCAAuC,IAAA,aAAG,EAAC,IAAI,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;QACpG,CAAC;QACD,MAAM,CAAC,EAAU;YACf,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,+BAA+B,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;QACvF,CAAC;QACD,+EAA+E;QAC/E,YAAY,CACV,SAAiB,EACjB,OAAsC,EAAE,EACxC,cAAuB;YAEvB,OAAO,OAAO,CAAC;gBACb,MAAM,EAAE,MAAM;gBACd,IAAI,EAAE,+BAA+B,IAAA,aAAG,EAAC,SAAS,CAAC,UAAU;gBAC7D,IAAI;gBACJ,cAAc;aACf,CAAC,CAAC;QACL,CAAC;QACD,kFAAkF;QAClF,YAAY,CACV,QAAgB;YAEhB,OAAO,OAAO,CAAC;gBACb,MAAM,EAAE,MAAM;gBACd,IAAI,EAAE,8BAA8B,IAAA,aAAG,EAAC,QAAQ,CAAC,SAAS;aAC3D,CAAC,CAAC;QACL,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/csrf.d.ts

@@ -0,0 +1,50 @@
+/**
+ * CSRF tokens bound to the Atlas session: `<nonce>.<mac>`, where the MAC is
+ * HMAC-SHA256(secret, `<sid>.<nonce>`), both base64url. A token minted for one
+ * session never verifies for another. The browser sends it back in the
+ * `x-atlas-csrf` header (or an `atlas_csrf` form field) AND carries it in the
+ * `__atlas_csrf` cookie (double submit): a cross-site page can trigger the
+ * cookie but cannot read it to fill the header or field.
+ *
+ * Edge-safe: no `node:crypto`.
+ */
+export declare const CSRF_HEADER = "x-atlas-csrf";
+export declare const CSRF_FORM_FIELD = "atlas_csrf";
+export declare const CSRF_COOKIE = "__atlas_csrf";
+export interface CsrfOptions {
+    /** The session id (`sid` claim). */
+    sid: string;
+    /** A server secret: `ATLAS_CSRF_SECRET`, or {@link deriveCsrfSecret} of your secret key. */
+    secret: string;
+}
+/** Mint a fresh token for this session (a new random nonce each call). */
+export declare function csrfToken(options: CsrfOptions): string;
+/** Whether `token` was minted for this session with this secret. */
+export declare function checkCsrfToken(token: string | null | undefined, options: CsrfOptions): boolean;
+/**
+ * A 32-byte CSRF secret derived from your instance secret key (HKDF-SHA256,
+ * info `atlas-csrf-v1`), for when `ATLAS_CSRF_SECRET` isn't set. Rotating the
+ * secret key invalidates outstanding tokens; browsers get a fresh one on their
+ * next page load.
+ */
+export declare function deriveCsrfSecret(secretKey: string): string;
+/** Read one cookie from a `Cookie` header. */
+export declare function readCookieValue(header: string | null | undefined, name: string): string | undefined;
+/** The request slice {@link verifyCsrf} reads (a Fetch `Request` / `NextRequest` fits). */
+export interface CsrfRequest {
+    headers: {
+        get(name: string): string | null;
+    };
+    clone?(): {
+        formData(): Promise<{
+            get(name: string): unknown;
+        }>;
+    };
+}
+/**
+ * Verify a state-changing request: the submitted token (`x-atlas-csrf` header,
+ * else the `atlas_csrf` field of a urlencoded / multipart form) must equal the
+ * `__atlas_csrf` cookie and be valid for `sid`. Reads a form body from a CLONE,
+ * so your handler can still read it.
+ */
+export declare function verifyCsrf(request: CsrfRequest, options: CsrfOptions): Promise<boolean>;

package/dist/csrf.js

@@ -0,0 +1,124 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.CSRF_COOKIE = exports.CSRF_FORM_FIELD = exports.CSRF_HEADER = void 0;
+exports.csrfToken = csrfToken;
+exports.checkCsrfToken = checkCsrfToken;
+exports.deriveCsrfSecret = deriveCsrfSecret;
+exports.readCookieValue = readCookieValue;
+exports.verifyCsrf = verifyCsrf;
+const hmac_1 = require("@noble/hashes/hmac");
+const hkdf_1 = require("@noble/hashes/hkdf");
+const sha256_1 = require("@noble/hashes/sha256");
+/**
+ * CSRF tokens bound to the Atlas session: `<nonce>.<mac>`, where the MAC is
+ * HMAC-SHA256(secret, `<sid>.<nonce>`), both base64url. A token minted for one
+ * session never verifies for another. The browser sends it back in the
+ * `x-atlas-csrf` header (or an `atlas_csrf` form field) AND carries it in the
+ * `__atlas_csrf` cookie (double submit): a cross-site page can trigger the
+ * cookie but cannot read it to fill the header or field.
+ *
+ * Edge-safe: no `node:crypto`.
+ */
+exports.CSRF_HEADER = 'x-atlas-csrf';
+exports.CSRF_FORM_FIELD = 'atlas_csrf';
+exports.CSRF_COOKIE = '__atlas_csrf';
+const enc = new TextEncoder();
+function b64url(bytes) {
+    let bin = '';
+    for (const b of bytes)
+        bin += String.fromCharCode(b);
+    return btoa(bin).replace(/\+/g, '-').replace(/\//g, '_').replace(/=+$/, '');
+}
+function mac(secret, sid, nonce) {
+    return b64url((0, hmac_1.hmac)(sha256_1.sha256, enc.encode(secret), enc.encode(`${sid}.${nonce}`)));
+}
+/** Compares every character whatever the lengths. */
+function constantTimeEqual(a, b) {
+    let diff = a.length ^ b.length;
+    const n = Math.max(a.length, b.length);
+    for (let i = 0; i < n; i++)
+        diff |= (a.charCodeAt(i) || 0) ^ (b.charCodeAt(i) || 0);
+    return diff === 0;
+}
+function requireOptions({ sid, secret }) {
+    if (typeof sid !== 'string' || sid === '')
+        throw new TypeError('csrf: sid is required');
+    if (typeof secret !== 'string' || secret.length < 16)
+        throw new TypeError('csrf: secret must be at least 16 characters');
+}
+/** Mint a fresh token for this session (a new random nonce each call). */
+function csrfToken(options) {
+    requireOptions(options);
+    const nonce = b64url(globalThis.crypto.getRandomValues(new Uint8Array(16)));
+    return `${nonce}.${mac(options.secret, options.sid, nonce)}`;
+}
+/** Whether `token` was minted for this session with this secret. */
+function checkCsrfToken(token, options) {
+    requireOptions(options);
+    if (typeof token !== 'string')
+        return false;
+    const dot = token.indexOf('.');
+    if (dot <= 0 || dot !== token.lastIndexOf('.'))
+        return false;
+    return constantTimeEqual(token.slice(dot + 1), mac(options.secret, options.sid, token.slice(0, dot)));
+}
+/**
+ * A 32-byte CSRF secret derived from your instance secret key (HKDF-SHA256,
+ * info `atlas-csrf-v1`), for when `ATLAS_CSRF_SECRET` isn't set. Rotating the
+ * secret key invalidates outstanding tokens; browsers get a fresh one on their
+ * next page load.
+ */
+function deriveCsrfSecret(secretKey) {
+    if (typeof secretKey !== 'string' || secretKey === '')
+        throw new TypeError('deriveCsrfSecret: secretKey is required');
+    return b64url((0, hkdf_1.hkdf)(sha256_1.sha256, enc.encode(secretKey), undefined, enc.encode('atlas-csrf-v1'), 32));
+}
+/** Read one cookie from a `Cookie` header. */
+function readCookieValue(header, name) {
+    if (!header)
+        return undefined;
+    for (const part of header.split(';')) {
+        const eq = part.indexOf('=');
+        if (eq === -1)
+            continue;
+        if (part.slice(0, eq).trim() === name) {
+            const raw = part.slice(eq + 1).trim();
+            try {
+                return decodeURIComponent(raw);
+            }
+            catch {
+                return raw;
+            }
+        }
+    }
+    return undefined;
+}
+/**
+ * Verify a state-changing request: the submitted token (`x-atlas-csrf` header,
+ * else the `atlas_csrf` field of a urlencoded / multipart form) must equal the
+ * `__atlas_csrf` cookie and be valid for `sid`. Reads a form body from a CLONE,
+ * so your handler can still read it.
+ */
+async function verifyCsrf(request, options) {
+    requireOptions(options);
+    const cookie = readCookieValue(request.headers.get('cookie'), exports.CSRF_COOKIE);
+    if (!cookie)
+        return false;
+    let submitted = request.headers.get(exports.CSRF_HEADER);
+    if (submitted === null) {
+        const type = (request.headers.get('content-type') ?? '').toLowerCase();
+        if (request.clone && (type.startsWith('application/x-www-form-urlencoded') || type.startsWith('multipart/form-data'))) {
+            try {
+                const field = (await request.clone().formData()).get(exports.CSRF_FORM_FIELD);
+                submitted = typeof field === 'string' ? field : null;
+            }
+            catch {
+                submitted = null;
+            }
+        }
+    }
+    if (submitted === null || !constantTimeEqual(submitted, cookie))
+        return false;
+    return checkCsrfToken(submitted, options);
+}
+//# sourceMappingURL=csrf.js.map

package/dist/csrf.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"csrf.js","sourceRoot":"","sources":["../src/csrf.ts"],"names":[],"mappings":";;;AAoDA,8BAIC;AAGD,wCAMC;AAQD,4CAGC;AAGD,0CAeC;AAcD,gCAkBC;AA9HD,6CAA0C;AAC1C,6CAA0C;AAC1C,iDAA8C;AAE9C;;;;;;;;;GASG;AAEU,QAAA,WAAW,GAAG,cAAc,CAAC;AAC7B,QAAA,eAAe,GAAG,YAAY,CAAC;AAC/B,QAAA,WAAW,GAAG,cAAc,CAAC;AAS1C,MAAM,GAAG,GAAG,IAAI,WAAW,EAAE,CAAC;AAE9B,SAAS,MAAM,CAAC,KAAiB;IAC/B,IAAI,GAAG,GAAG,EAAE,CAAC;IACb,KAAK,MAAM,CAAC,IAAI,KAAK;QAAE,GAAG,IAAI,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;IACrD,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;AAC9E,CAAC;AAED,SAAS,GAAG,CAAC,MAAc,EAAE,GAAW,EAAE,KAAa;IACrD,OAAO,MAAM,CAAC,IAAA,WAAI,EAAC,eAAM,EAAE,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,GAAG,CAAC,MAAM,CAAC,GAAG,GAAG,IAAI,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC;AACjF,CAAC;AAED,qDAAqD;AACrD,SAAS,iBAAiB,CAAC,CAAS,EAAE,CAAS;IAC7C,IAAI,IAAI,GAAG,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,MAAM,CAAC;IAC/B,MAAM,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC;IACvC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE;QAAE,IAAI,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;IACpF,OAAO,IAAI,KAAK,CAAC,CAAC;AACpB,CAAC;AAED,SAAS,cAAc,CAAC,EAAE,GAAG,EAAE,MAAM,EAAe;IAClD,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,KAAK,EAAE;QAAE,MAAM,IAAI,SAAS,CAAC,uBAAuB,CAAC,CAAC;IACxF,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,CAAC,MAAM,GAAG,EAAE;QAAE,MAAM,IAAI,SAAS,CAAC,6CAA6C,CAAC,CAAC;AAC3H,CAAC;AAED,0EAA0E;AAC1E,SAAgB,SAAS,CAAC,OAAoB;IAC5C,cAAc,CAAC,OAAO,CAAC,CAAC;IACxB,MAAM,KAAK,GAAG,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC,eAAe,CAAC,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IAC5E,OAAO,GAAG,KAAK,IAAI,GAAG,CAAC,OAAO,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,CAAC;AAC/D,CAAC;AAED,oEAAoE;AACpE,SAAgB,cAAc,CAAC,KAAgC,EAAE,OAAoB;IACnF,cAAc,CAAC,OAAO,CAAC,CAAC;IACxB,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IAC5C,MAAM,GAAG,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAC/B,IAAI,GAAG,IAAI,CAAC,IAAI,GAAG,KAAK,KAAK,CAAC,WAAW,CAAC,GAAG,CAAC;QAAE,OAAO,KAAK,CAAC;IAC7D,OAAO,iBAAiB,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,GAAG,CAAC,CAAC,EAAE,GAAG,CAAC,OAAO,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC;AACxG,CAAC;AAED;;;;;GAKG;AACH,SAAgB,gBAAgB,CAAC,SAAiB;IAChD,IAAI,OAAO,SAAS,KAAK,QAAQ,IAAI,SAAS,KAAK,EAAE;QAAE,MAAM,IAAI,SAAS,CAAC,yCAAyC,CAAC,CAAC;IACtH,OAAO,MAAM,CAAC,IAAA,WAAI,EAAC,eAAM,EAAE,GAAG,CAAC,MAAM,CAAC,SAAS,CAAC,EAAE,SAAS,EAAE,GAAG,CAAC,MAAM,CAAC,eAAe,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;AACjG,CAAC;AAED,8CAA8C;AAC9C,SAAgB,eAAe,CAAC,MAAiC,EAAE,IAAY;IAC7E,IAAI,CAAC,MAAM;QAAE,OAAO,SAAS,CAAC;IAC9B,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;QACrC,MAAM,EAAE,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAC7B,IAAI,EAAE,KAAK,CAAC,CAAC;YAAE,SAAS;QACxB,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,KAAK,IAAI,EAAE,CAAC;YACtC,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;YACtC,IAAI,CAAC;gBACH,OAAO,kBAAkB,CAAC,GAAG,CAAC,CAAC;YACjC,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,GAAG,CAAC;YACb,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAQD;;;;;GAKG;AACI,KAAK,UAAU,UAAU,CAAC,OAAoB,EAAE,OAAoB;IACzE,cAAc,CAAC,OAAO,CAAC,CAAC;IACxB,MAAM,MAAM,GAAG,eAAe,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,mBAAW,CAAC,CAAC;IAC3E,IAAI,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IAC1B,IAAI,SAAS,GAAkB,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,mBAAW,CAAC,CAAC;IAChE,IAAI,SAAS,KAAK,IAAI,EAAE,CAAC;QACvB,MAAM,IAAI,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;QACvE,IAAI,OAAO,CAAC,KAAK,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,mCAAmC,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,qBAAqB,CAAC,CAAC,EAAE,CAAC;YACtH,IAAI,CAAC;gBACH,MAAM,KAAK,GAAG,CAAC,MAAM,OAAO,CAAC,KAAK,EAAE,CAAC,QAAQ,EAAE,CAAC,CAAC,GAAG,CAAC,uBAAe,CAAC,CAAC;gBACtE,SAAS,GAAG,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC;YACvD,CAAC;YAAC,MAAM,CAAC;gBACP,SAAS,GAAG,IAAI,CAAC;YACnB,CAAC;QACH,CAAC;IACH,CAAC;IACD,IAAI,SAAS,KAAK,IAAI,IAAI,CAAC,iBAAiB,CAAC,SAAS,EAAE,MAAM,CAAC;QAAE,OAAO,KAAK,CAAC;IAC9E,OAAO,cAAc,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;AAC5C,CAAC"}

package/dist/index.d.ts

@@ -26,6 +26,9 @@ export { AtlasOidcError, OIDC_FLOW_COOKIE, OIDC_FLOW_MAX_AGE_SECONDS, oidc, oidc
 export type { AtlasIdTokenClaims, AtlasOidc, AtlasOidcErrorCode, OidcOrganization, OidcOrganizationMembership, OidcSsoContext, OidcCallbackOptions, OidcClientAuth, OidcIdentity, OidcLogoutUrlOptions, OidcStartOptions, OidcStartResult, VerifyIdTokenOptions, } from './oidc';
 export * from './webhooks';
 export * from './webhook-dedupe';
+export * from './webhook-events';
+export * from './sync-local-user';
+export * from './csrf';
 export * from './referrals';
 export * from './policy-source';
 export * from './botid';

package/dist/index.js

@@ -88,6 +88,10 @@ Object.defineProperty(exports, "resetOidcCaches", { enumerable: true, get: funct
 // §12.2 inbound webhook verification for consumers.
 __exportStar(require("./webhooks"), exports);
 __exportStar(require("./webhook-dedupe"), exports);
+__exportStar(require("./webhook-events"), exports);
+// Session helpers: mirror the Atlas user into your own table; CSRF tokens bound to the session.
+__exportStar(require("./sync-local-user"), exports);
+__exportStar(require("./csrf"), exports);
 // The Atlas referral protocol, for a referral platform receiving Atlas's signed calls.
 __exportStar(require("./referrals"), exports);
 __exportStar(require("./policy-source"), exports);

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;AAAA,6DAA6D;AAC7D,+CAA6B;AAC7B,mEAAmE;AACnE,yCAA2G;AAAlG,2GAAA,cAAc,OAAA;AAAE,0GAAA,aAAa,OAAA;AAAE,4GAAA,eAAe,OAAA;AAAE,yHAAA,4BAA4B,OAAA;AACrF,2CAAyB;AACzB,iDAA+B;AAC/B,gDAA8B;AAC9B,8CAA4B;AAC5B,mDAAiC;AACjC,8CAA4B;AAC5B,2FAA2F;AAC3F,gDAA8B;AAC9B,qFAAqF;AACrF,sDAAoC;AACpC,qDAAmC;AACnC,kDAAgC;AAChC,yCAA6E;AAApE,mHAAA,sBAAsB,OAAA;AAAE,mHAAA,sBAAsB,OAAA;AACvD,mDAA+D;AAAtD,6HAAA,2BAA2B,OAAA;AACpC,mDAAoE;AAA3D,sHAAA,oBAAoB,OAAA;AAAE,4GAAA,UAAU,OAAA;AAEzC,0DAAwC;AACxC,+EAA+E;AAC/E,4DAA4D;AAC5D,uDAAqC;AACrC,gFAAgF;AAChF,qDAAmC;AAEnC,4DAA4D;AAC5D,kDAAgC;AAEhC,6EAA6E;AAC7E,+CAOwB;AANtB,wHAAA,wBAAwB,OAAA;AACxB,+HAAA,+BAA+B,OAAA;AAC/B,4HAAA,4BAA4B,OAAA;AAC5B,mHAAA,mBAAmB,OAAA;AACnB,uHAAA,uBAAuB,OAAA;AACvB,iHAAA,iBAAiB,OAAA;AASnB,+EAA+E;AAC/E,+DAQgC;AAP9B,gIAAA,wBAAwB,OAAA;AACxB,gIAAA,wBAAwB,OAAA;AACxB,sIAAA,8BAA8B,OAAA;AAC9B,8HAAA,sBAAsB,OAAA;AACtB,+HAAA,uBAAuB,OAAA;AACvB,6HAAA,qBAAqB,OAAA;AACrB,uHAAA,eAAe,OAAA;AAIjB,sEAAsE;AACtE,iFAAiF;AACjF,+BAcgB;AAbd,sGAAA,cAAc,OAAA;AACd,wGAAA,gBAAgB,OAAA;AAChB,iHAAA,yBAAyB,OAAA;AACzB,4FAAA,IAAI,OAAA;AACJ,oGAAA,YAAY,OAAA;AACZ,uGAAA,eAAe,OAAA;AACf,qGAAA,aAAa,OAAA;AACb,iGAAA,SAAS,OAAA;AACT,yGAAA,iBAAiB,OAAA;AACjB,0GAAA,kBAAkB,OAAA;AAClB,2GAAA,mBAAmB,OAAA;AACnB,iGAAA,SAAS,OAAA;AACT,uGAAA,eAAe,OAAA;AAkBjB,oDAAoD;AACpD,6CAA2B;AAC3B,mDAAiC;AAEjC,uFAAuF;AACvF,8CAA4B;AAC5B,kDAAgC;AAEhC,0FAA0F;AAC1F,0CAAwB;AAExB,8DAA8D;AAC9D,mCAA6C;AAApC,2GAAA,iBAAiB,OAAA;AAE1B,2CAAyB;AAEzB,4EAA4E;AAC5E,wEAAwE;AACxE,2CAAuF;AAA9E,6GAAA,eAAe,OAAA;AAAE,kHAAA,oBAAoB,OAAA;AAAE,8GAAA,gBAAgB,OAAA;AAGhE,yEAAyE;AACzE,2EAA2E;AAC3E,iEAAiE;AACjE,qCAAmF;AAA1E,2GAAA,gBAAgB,OAAA;AAAE,6GAAA,kBAAkB,OAAA;AAAE,2GAAA,gBAAgB,OAAA;AAU/D,6DAQ+B;AAP7B,4HAAA,qBAAqB,OAAA;AACrB,wHAAA,iBAAiB,OAAA;AACjB,+HAAA,wBAAwB,OAAA;AACxB,yHAAA,kBAAkB,OAAA;AAClB,2HAAA,oBAAoB,OAAA;AACpB,wHAAA,iBAAiB,OAAA;AACjB,4HAAA,qBAAqB,OAAA;AAWvB,2FAA2F;AAC3F,uEAAuE;AAGvE,8EAA8E;AAC9E,gFAAgF;AAChF,mDAa0B;AAZxB,iIAAA,+BAA+B,OAAA;AAC/B,4HAAA,0BAA0B,OAAA;AAC1B,sHAAA,oBAAoB,OAAA;AACpB,2HAAA,yBAAyB,OAAA;AACzB,oHAAA,kBAAkB,OAAA;AAClB,qHAAA,mBAAmB,OAAA;AACnB,uHAAA,qBAAqB,OAAA;AACrB,uHAAA,qBAAqB,OAAA;AACrB,2HAAA,yBAAyB,OAAA;AACzB,+HAAA,6BAA6B,OAAA;AAC7B,4GAAA,UAAU,OAAA;AACV,mHAAA,iBAAiB,OAAA;AAanB,kDAAgC;AAChC,wCAAsB"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;AAAA,6DAA6D;AAC7D,+CAA6B;AAC7B,mEAAmE;AACnE,yCAA2G;AAAlG,2GAAA,cAAc,OAAA;AAAE,0GAAA,aAAa,OAAA;AAAE,4GAAA,eAAe,OAAA;AAAE,yHAAA,4BAA4B,OAAA;AACrF,2CAAyB;AACzB,iDAA+B;AAC/B,gDAA8B;AAC9B,8CAA4B;AAC5B,mDAAiC;AACjC,8CAA4B;AAC5B,2FAA2F;AAC3F,gDAA8B;AAC9B,qFAAqF;AACrF,sDAAoC;AACpC,qDAAmC;AACnC,kDAAgC;AAChC,yCAA6E;AAApE,mHAAA,sBAAsB,OAAA;AAAE,mHAAA,sBAAsB,OAAA;AACvD,mDAA+D;AAAtD,6HAAA,2BAA2B,OAAA;AACpC,mDAAoE;AAA3D,sHAAA,oBAAoB,OAAA;AAAE,4GAAA,UAAU,OAAA;AAEzC,0DAAwC;AACxC,+EAA+E;AAC/E,4DAA4D;AAC5D,uDAAqC;AACrC,gFAAgF;AAChF,qDAAmC;AAEnC,4DAA4D;AAC5D,kDAAgC;AAEhC,6EAA6E;AAC7E,+CAOwB;AANtB,wHAAA,wBAAwB,OAAA;AACxB,+HAAA,+BAA+B,OAAA;AAC/B,4HAAA,4BAA4B,OAAA;AAC5B,mHAAA,mBAAmB,OAAA;AACnB,uHAAA,uBAAuB,OAAA;AACvB,iHAAA,iBAAiB,OAAA;AASnB,+EAA+E;AAC/E,+DAQgC;AAP9B,gIAAA,wBAAwB,OAAA;AACxB,gIAAA,wBAAwB,OAAA;AACxB,sIAAA,8BAA8B,OAAA;AAC9B,8HAAA,sBAAsB,OAAA;AACtB,+HAAA,uBAAuB,OAAA;AACvB,6HAAA,qBAAqB,OAAA;AACrB,uHAAA,eAAe,OAAA;AAIjB,sEAAsE;AACtE,iFAAiF;AACjF,+BAcgB;AAbd,sGAAA,cAAc,OAAA;AACd,wGAAA,gBAAgB,OAAA;AAChB,iHAAA,yBAAyB,OAAA;AACzB,4FAAA,IAAI,OAAA;AACJ,oGAAA,YAAY,OAAA;AACZ,uGAAA,eAAe,OAAA;AACf,qGAAA,aAAa,OAAA;AACb,iGAAA,SAAS,OAAA;AACT,yGAAA,iBAAiB,OAAA;AACjB,0GAAA,kBAAkB,OAAA;AAClB,2GAAA,mBAAmB,OAAA;AACnB,iGAAA,SAAS,OAAA;AACT,uGAAA,eAAe,OAAA;AAkBjB,oDAAoD;AACpD,6CAA2B;AAC3B,mDAAiC;AACjC,mDAAiC;AAEjC,gGAAgG;AAChG,oDAAkC;AAClC,yCAAuB;AAEvB,uFAAuF;AACvF,8CAA4B;AAC5B,kDAAgC;AAEhC,0FAA0F;AAC1F,0CAAwB;AAExB,8DAA8D;AAC9D,mCAA6C;AAApC,2GAAA,iBAAiB,OAAA;AAE1B,2CAAyB;AAEzB,4EAA4E;AAC5E,wEAAwE;AACxE,2CAAuF;AAA9E,6GAAA,eAAe,OAAA;AAAE,kHAAA,oBAAoB,OAAA;AAAE,8GAAA,gBAAgB,OAAA;AAGhE,yEAAyE;AACzE,2EAA2E;AAC3E,iEAAiE;AACjE,qCAAmF;AAA1E,2GAAA,gBAAgB,OAAA;AAAE,6GAAA,kBAAkB,OAAA;AAAE,2GAAA,gBAAgB,OAAA;AAU/D,6DAQ+B;AAP7B,4HAAA,qBAAqB,OAAA;AACrB,wHAAA,iBAAiB,OAAA;AACjB,+HAAA,wBAAwB,OAAA;AACxB,yHAAA,kBAAkB,OAAA;AAClB,2HAAA,oBAAoB,OAAA;AACpB,wHAAA,iBAAiB,OAAA;AACjB,4HAAA,qBAAqB,OAAA;AAWvB,2FAA2F;AAC3F,uEAAuE;AAGvE,8EAA8E;AAC9E,gFAAgF;AAChF,mDAa0B;AAZxB,iIAAA,+BAA+B,OAAA;AAC/B,4HAAA,0BAA0B,OAAA;AAC1B,sHAAA,oBAAoB,OAAA;AACpB,2HAAA,yBAAyB,OAAA;AACzB,oHAAA,kBAAkB,OAAA;AAClB,qHAAA,mBAAmB,OAAA;AACnB,uHAAA,qBAAqB,OAAA;AACrB,uHAAA,qBAAqB,OAAA;AACrB,2HAAA,yBAAyB,OAAA;AACzB,+HAAA,6BAA6B,OAAA;AAC7B,4GAAA,UAAU,OAAA;AACV,mHAAA,iBAAiB,OAAA;AAanB,kDAAgC;AAChC,wCAAsB"}

package/dist/recent-auth.d.ts

@@ -19,3 +19,20 @@ export declare function usedMultiFactor(claims: {
     acr?: unknown;
     amr?: unknown;
 }): boolean;
+/**
+ * Whether the session satisfies a "requires MFA" rule. The rule, in order:
+ *
+ * 1. `mfa_satisfied` — the server's own verdict, final whenever the token carries it
+ *    (true or false). Tokens minted before the claim existed fall back to:
+ * 2. `mfa === true` (a second factor was verified at sign-in),
+ * 3. or {@link usedMultiFactor} (`acr` is `urn:atlas:acr:mfa`, or `amr` includes `mfa`),
+ * 4. or `sso_connection_id` is a string (an enterprise SSO sign-in: the identity
+ *    provider owns the second factor).
+ */
+export declare function mfaSatisfied(claims: {
+    mfa_satisfied?: unknown;
+    mfa?: unknown;
+    acr?: unknown;
+    amr?: unknown;
+    sso_connection_id?: unknown;
+}): boolean;

package/dist/recent-auth.js

@@ -14,6 +14,7 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.authenticatedWithin = authenticatedWithin;
 exports.usedMultiFactor = usedMultiFactor;
+exports.mfaSatisfied = mfaSatisfied;
 /** Whether `auth_time` is within `maxAgeSeconds` of now. A token without `auth_time` never is. */
 function authenticatedWithin(claims, maxAgeSeconds, nowMs = Date.now()) {
     const at = claims.auth_time;
@@ -27,4 +28,19 @@ function usedMultiFactor(claims) {
         return true;
     return Array.isArray(claims.amr) && claims.amr.includes('mfa');
 }
+/**
+ * Whether the session satisfies a "requires MFA" rule. The rule, in order:
+ *
+ * 1. `mfa_satisfied` — the server's own verdict, final whenever the token carries it
+ *    (true or false). Tokens minted before the claim existed fall back to:
+ * 2. `mfa === true` (a second factor was verified at sign-in),
+ * 3. or {@link usedMultiFactor} (`acr` is `urn:atlas:acr:mfa`, or `amr` includes `mfa`),
+ * 4. or `sso_connection_id` is a string (an enterprise SSO sign-in: the identity
+ *    provider owns the second factor).
+ */
+function mfaSatisfied(claims) {
+    if (typeof claims.mfa_satisfied === 'boolean')
+        return claims.mfa_satisfied;
+    return claims.mfa === true || usedMultiFactor(claims) || typeof claims.sso_connection_id === 'string';
+}
 //# sourceMappingURL=recent-auth.js.map

package/dist/recent-auth.js.map

@@ -1 +1 @@
-{"version":3,"file":"recent-auth.js","sourceRoot":"","sources":["../src/recent-auth.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;GAWG;;AAGH,kDAIC;AAGD,0CAGC;AAXD,kGAAkG;AAClG,SAAgB,mBAAmB,CAAC,MAA+B,EAAE,aAAqB,EAAE,QAAgB,IAAI,CAAC,GAAG,EAAE;IACpH,MAAM,EAAE,GAAG,MAAM,CAAC,SAAS,CAAC;IAC5B,IAAI,OAAO,EAAE,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC;QAAE,OAAO,KAAK,CAAC;IACjE,OAAO,KAAK,GAAG,IAAI,GAAG,EAAE,IAAI,aAAa,CAAC;AAC5C,CAAC;AAED,yHAAyH;AACzH,SAAgB,eAAe,CAAC,MAAwC;IACtE,IAAI,MAAM,CAAC,GAAG,KAAK,mBAAmB;QAAE,OAAO,IAAI,CAAC;IACpD,OAAO,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;AACjE,CAAC"}
+{"version":3,"file":"recent-auth.js","sourceRoot":"","sources":["../src/recent-auth.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;GAWG;;AAGH,kDAIC;AAGD,0CAGC;AAYD,oCASC;AAhCD,kGAAkG;AAClG,SAAgB,mBAAmB,CAAC,MAA+B,EAAE,aAAqB,EAAE,QAAgB,IAAI,CAAC,GAAG,EAAE;IACpH,MAAM,EAAE,GAAG,MAAM,CAAC,SAAS,CAAC;IAC5B,IAAI,OAAO,EAAE,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC;QAAE,OAAO,KAAK,CAAC;IACjE,OAAO,KAAK,GAAG,IAAI,GAAG,EAAE,IAAI,aAAa,CAAC;AAC5C,CAAC;AAED,yHAAyH;AACzH,SAAgB,eAAe,CAAC,MAAwC;IACtE,IAAI,MAAM,CAAC,GAAG,KAAK,mBAAmB;QAAE,OAAO,IAAI,CAAC;IACpD,OAAO,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;AACjE,CAAC;AAED;;;;;;;;;GASG;AACH,SAAgB,YAAY,CAAC,MAM5B;IACC,IAAI,OAAO,MAAM,CAAC,aAAa,KAAK,SAAS;QAAE,OAAO,MAAM,CAAC,aAAa,CAAC;IAC3E,OAAO,MAAM,CAAC,GAAG,KAAK,IAAI,IAAI,eAAe,CAAC,MAAM,CAAC,IAAI,OAAO,MAAM,CAAC,iBAAiB,KAAK,QAAQ,CAAC;AACxG,CAAC"}

package/dist/rp-sid-store.d.ts

@@ -0,0 +1,36 @@
+/**
+ * Maps an Atlas `sid` (the `sid` claim of the ID token) to the session ids of
+ * YOUR app, so a back-channel logout that names only the `sid` can end exactly
+ * the app sessions it backs.
+ *
+ * Bind when you create your app session (after MFA, if you gate on it): a
+ * step-up callback carries the same `sid`, so there is nothing new to bind
+ * unless you rotate your own session id then, in which case bind the new one.
+ */
+export interface SidStore {
+    /** Remember that `appSessionId` belongs to `sid` until `expiresAt` (epoch milliseconds or a Date). */
+    bind(sid: string, appSessionId: string, expiresAt: number | Date): Promise<void> | void;
+    /** Return AND remove every unexpired app session bound to `sid` (an empty list when none). */
+    take(sid: string): Promise<string[]> | string[];
+}
+/** An in-process {@link SidStore}. Fine for one server; use a shared store (e.g. {@link sqlSidStore}) for several. */
+export declare function memorySidStore(now?: () => number): SidStore;
+/** The one method {@link sqlSidStore} needs: a pg-compatible `query` (node-postgres `Pool`/`Client`, or a wrapper). */
+export interface SqlSidStoreOptions {
+    query(sql: string, params: unknown[]): Promise<{
+        rows: any[];
+    }>;
+}
+/**
+ * A {@link SidStore} on PostgreSQL. Create the table once:
+ *
+ *   create table atlas_rp_sessions (
+ *     sid text not null,
+ *     app_session_id text not null,
+ *     expires_at timestamptz not null,
+ *     primary key (sid, app_session_id)
+ *   );
+ *
+ * `take` deletes every row for the sid (expired ones too) and returns the unexpired ids.
+ */
+export declare function sqlSidStore({ query }: SqlSidStoreOptions): SidStore;