@atlasauth/backend 0.5.0 → 0.7.0

package/dist/client/oauth-clients.d.ts

@@ -13,9 +13,31 @@ export interface OAuthClient {
     secret_prefix: string | null;
     is_public: boolean;
     first_party: boolean;
+    /** Where the client may send users after an RP-initiated logout. */
+    post_logout_redirect_uris: string[];
+    /** Back-channel logout endpoint Atlas POSTs a `logout_token` to, or null. */
+    backchannel_logout_uri: string | null;
+    /** Whether the back-channel `logout_token` must carry `sid`. */
+    backchannel_logout_session_required: boolean;
+    /** Front-channel logout URL Atlas loads in an iframe on sign-out, or null. */
+    frontchannel_logout_uri: string | null;
+    /** Whether `iss` and `sid` are appended to the front-channel logout URL. */
+    frontchannel_logout_session_required: boolean;
     created_at: number;
     updated_at: number;
 }
+/**
+ * OIDC logout registration (RP-Initiated, Back-Channel and Front-Channel
+ * Logout), accepted on create and update. On update, `null` clears a URI and
+ * `[]` clears the post-logout redirect list.
+ */
+export interface OAuthClientLogoutFields {
+    post_logout_redirect_uris?: string[];
+    backchannel_logout_uri?: string | null;
+    backchannel_logout_session_required?: boolean;
+    frontchannel_logout_uri?: string | null;
+    frontchannel_logout_session_required?: boolean;
+}
 /** Create/rotate reveal the secret exactly once, alongside the client. */
 export interface OAuthClientWithSecret extends OAuthClient {
     client_secret?: string;
@@ -31,7 +53,7 @@ export interface ClientGrant {
     created_at: number;
     updated_at: number;
 }
-export interface CreateOAuthClientBody {
+export interface CreateOAuthClientBody extends OAuthClientLogoutFields {
     name: string;
     redirect_uris: string[];
     allowed_scopes?: string[];
@@ -40,7 +62,7 @@ export interface CreateOAuthClientBody {
     logo_url?: string;
     first_party?: boolean;
 }
-export interface UpdateOAuthClientBody {
+export interface UpdateOAuthClientBody extends OAuthClientLogoutFields {
     name?: string;
     redirect_uris?: string[];
     allowed_scopes?: string[];
@@ -48,7 +70,29 @@ export interface UpdateOAuthClientBody {
     logo_url?: string | null;
     first_party?: boolean;
 }
+/** One client in a migration import. Idempotent per `client_id`. */
+export interface ImportOAuthClientEntry {
+    /** Preserve the existing client_id. */
+    client_id: string;
+    name: string;
+    redirect_uris: string[];
+    /** Plaintext secret; hashed on import. Write-only. */
+    client_secret?: string;
+    /** A pre-computed secret hash imported verbatim (instead of `client_secret`). */
+    client_secret_hash?: string;
+    allowed_scopes?: string[];
+    grant_types?: string[];
+    token_endpoint_auth_method?: string;
+}
+/** An imported client as returned by `import`. */
+export interface ImportedOAuthClient extends OAuthClient {
+    client_secret?: string;
+}
 export declare function oauthClientsResource(request: RequestFn): {
+    /** Bulk-import OAuth clients for a migration, optionally with pre-hashed secrets. */
+    import(body: {
+        clients: ImportOAuthClientEntry[];
+    }, idempotencyKey?: string): Promise<ListPage<ImportedOAuthClient>>;
     list(): Promise<ListPage<OAuthClient>>;
     get(id: string): Promise<OAuthClient>;
     create(body: CreateOAuthClientBody, idempotencyKey?: string): Promise<OAuthClientWithSecret>;

package/dist/client/oauth-clients.js

@@ -4,6 +4,10 @@ exports.oauthClientsResource = oauthClientsResource;
 const request_1 = require("./request");
 function oauthClientsResource(request) {
     return {
+        /** Bulk-import OAuth clients for a migration, optionally with pre-hashed secrets. */
+        import(body, idempotencyKey) {
+            return request({ method: 'POST', path: '/v1/oauth_clients/import', body, idempotencyKey });
+        },
         list() {
             return request({ method: 'GET', path: '/v1/oauth_clients' });
         },

package/dist/client/oauth-clients.js.map

@@ -1 +1 @@
-{"version":3,"file":"oauth-clients.js","sourceRoot":"","sources":["../../src/client/oauth-clients.ts"],"names":[],"mappings":";;AAwDA,oDA8CC;AAtGD,uCAAgD;AAwDhD,SAAgB,oBAAoB,CAAC,OAAkB;IACrD,OAAO;QACL,IAAI;YACF,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,mBAAmB,EAAE,CAAC,CAAC;QAC/D,CAAC;QACD,GAAG,CAAC,EAAU;YACZ,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,qBAAqB,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;QAC1E,CAAC;QACD,MAAM,CAAC,IAA2B,EAAE,cAAuB;YACzD,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,mBAAmB,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC;QACtF,CAAC;QACD,MAAM,CAAC,EAAU,EAAE,IAA2B;YAC5C,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,qBAAqB,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;QAClF,CAAC;QACD,YAAY,CAAC,EAAU;YACrB,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,qBAAqB,IAAA,aAAG,EAAC,EAAE,CAAC,gBAAgB,EAAE,CAAC,CAAC;QACzF,CAAC;QACD,MAAM,CAAC,EAAU;YACf,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,qBAAqB,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;QAC7E,CAAC;QAED,MAAM,EAAE;YACN,IAAI,CAAC,QAAgB;gBACnB,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,qBAAqB,IAAA,aAAG,EAAC,QAAQ,CAAC,SAAS,EAAE,CAAC,CAAC;YACvF,CAAC;YACD,MAAM,CACJ,QAAgB,EAChB,IAAuD;gBAEvD,OAAO,OAAO,CAAC;oBACb,MAAM,EAAE,MAAM;oBACd,IAAI,EAAE,qBAAqB,IAAA,aAAG,EAAC,QAAQ,CAAC,SAAS;oBACjD,IAAI;iBACL,CAAC,CAAC;YACL,CAAC;YACD,MAAM,CACJ,QAAgB,EAChB,OAAe;gBAEf,OAAO,OAAO,CAAC;oBACb,MAAM,EAAE,QAAQ;oBAChB,IAAI,EAAE,qBAAqB,IAAA,aAAG,EAAC,QAAQ,CAAC,WAAW,IAAA,aAAG,EAAC,OAAO,CAAC,EAAE;iBAClE,CAAC,CAAC;YACL,CAAC;SACF;KACF,CAAC;AACJ,CAAC"}
+{"version":3,"file":"oauth-clients.js","sourceRoot":"","sources":["../../src/client/oauth-clients.ts"],"names":[],"mappings":";;AAmGA,oDAqDC;AAxJD,uCAAgD;AAmGhD,SAAgB,oBAAoB,CAAC,OAAkB;IACrD,OAAO;QACL,qFAAqF;QACrF,MAAM,CACJ,IAA2C,EAC3C,cAAuB;YAEvB,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,0BAA0B,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC;QAC7F,CAAC;QACD,IAAI;YACF,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,mBAAmB,EAAE,CAAC,CAAC;QAC/D,CAAC;QACD,GAAG,CAAC,EAAU;YACZ,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,qBAAqB,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;QAC1E,CAAC;QACD,MAAM,CAAC,IAA2B,EAAE,cAAuB;YACzD,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,mBAAmB,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC;QACtF,CAAC;QACD,MAAM,CAAC,EAAU,EAAE,IAA2B;YAC5C,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,qBAAqB,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;QAClF,CAAC;QACD,YAAY,CAAC,EAAU;YACrB,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,qBAAqB,IAAA,aAAG,EAAC,EAAE,CAAC,gBAAgB,EAAE,CAAC,CAAC;QACzF,CAAC;QACD,MAAM,CAAC,EAAU;YACf,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,qBAAqB,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;QAC7E,CAAC;QAED,MAAM,EAAE;YACN,IAAI,CAAC,QAAgB;gBACnB,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,qBAAqB,IAAA,aAAG,EAAC,QAAQ,CAAC,SAAS,EAAE,CAAC,CAAC;YACvF,CAAC;YACD,MAAM,CACJ,QAAgB,EAChB,IAAuD;gBAEvD,OAAO,OAAO,CAAC;oBACb,MAAM,EAAE,MAAM;oBACd,IAAI,EAAE,qBAAqB,IAAA,aAAG,EAAC,QAAQ,CAAC,SAAS;oBACjD,IAAI;iBACL,CAAC,CAAC;YACL,CAAC;YACD,MAAM,CACJ,QAAgB,EAChB,OAAe;gBAEf,OAAO,OAAO,CAAC;oBACb,MAAM,EAAE,QAAQ;oBAChB,IAAI,EAAE,qBAAqB,IAAA,aAAG,EAAC,QAAQ,CAAC,WAAW,IAAA,aAAG,EAAC,OAAO,CAAC,EAAE;iBAClE,CAAC,CAAC;YACL,CAAC;SACF;KACF,CAAC;AACJ,CAAC"}

package/dist/client/oauth-providers.d.ts

@@ -45,6 +45,46 @@ export interface OAuthProvider {
     allow_sign_up: boolean;
     scopes: string[];
     updated_at: number | null;
+    /** Extra scopes the provider's API supports beyond sign-in. */
+    api_scopes?: string[];
+    /** The effective sign-in mode (in-page native library or redirect). */
+    mode?: OAuthProviderMode;
+    /** Native providers only: the JavaScript origins to register at the provider console. */
+    javascript_origins?: string[];
+    /** Atlas's own callback URL; a `custom_redirect_uri` forwards `?code&state` here. */
+    atlas_callback?: string;
+    /** Your own already-registered callback (migration), or null. */
+    custom_redirect_uri?: string | null;
+    /** The instance's icon override for this provider's button, or null. */
+    icon_url?: string | null;
+    /** Wallet providers only (siwe, siws, siwf): the stored verifier settings. */
+    setting_values?: Record<string, string>;
+}
+export type OAuthProviderMode = 'native' | 'redirect';
+/** `GET /v1/oauth_providers` filters. */
+export interface ListOAuthProvidersParams {
+    /** Only these catalogue keys (exact match, e.g. `google`). */
+    provider?: string | string[];
+    /** `true`: only providers with credentials stored; `false`: only those not set up. */
+    configured?: boolean;
+}
+/**
+ * Verifier settings for the wallet providers (no credentials). `null` or `""`
+ * clears one; an unknown key is refused.
+ */
+export interface OAuthWalletSettings {
+    /** siwe / siws / siwf: the expected domain (`hostname[:port]`). */
+    domain?: string | null;
+    /** siwe / siwf: allowed chain ids (positive integers, array or comma list). */
+    chain_ids?: number[] | string | null;
+    /** siwe: an https RPC URL; enables smart-contract (EIP-1271) wallets. */
+    rpc_url?: string | null;
+    /** siws: allowed networks. */
+    networks?: Array<'mainnet' | 'devnet' | 'testnet'> | string | null;
+    /** siwf: an https Optimism RPC URL, required to verify FID ownership. */
+    optimism_rpc_url?: string | null;
+    /** siwf: the Farcaster ID registry contract (`0x…`). */
+    id_registry_address?: string | null;
 }
 /**
  * Credentials for the redirect code-exchange flow. `client_id`/`client_secret`
@@ -58,7 +98,31 @@ export interface UpsertOAuthProviderBody {
     client_secret?: string;
     scopes?: string[];
     values?: Record<string, string>;
-    settings?: Record<string, string>;
+    /**
+     * Non-secret provider settings (e.g. `redirect_uri`), or the wallet
+     * providers' verifier settings. `null` or `""` clears a setting.
+     */
+    settings?: Record<string, string | null> | OAuthWalletSettings;
+    /** Your own already-registered callback URL (migration). */
+    custom_redirect_uri?: string;
+    native?: boolean;
+    /** Force the sign-in mode; `""` or `null` clears the override. */
+    mode?: OAuthProviderMode | '' | null;
+    /** The brand shown on the button (e.g. "Discord"); empty or `null` clears. Display only. */
+    display_name?: string | null;
+    /** An http(s) or `data:image` icon for the button; empty or `null` clears. */
+    icon_url?: string | null;
+}
+/** What `upsert` returns. */
+export interface OAuthProviderUpsertResult {
+    object: 'oauth_provider';
+    provider: string;
+    configured: boolean;
+    enabled: boolean;
+    /** Wallet providers only: the stored verifier settings after this write. */
+    setting_values?: Record<string, string>;
+    updated_fields: string[];
+    warning?: string;
 }
 /** The connectivity test's honest verdict: what it proved, and what it did not. */
 export interface OAuthConnectionTest {
@@ -74,14 +138,10 @@ export interface OAuthConnectionTest {
 }
 export declare function oauthProvidersResource(request: RequestFn): {
     /** The whole catalog, configured or not — a not-yet-set-up provider is exactly the one a setup agent wants. */
-    list(): Promise<ListPage<OAuthProvider>>;
+    list(params?: ListOAuthProvidersParams): Promise<ListPage<OAuthProvider>>;
     get(provider: string): Promise<OAuthProvider>;
     /** Set (or replace) this instance's own credentials for a provider. */
-    upsert(provider: string, body: UpsertOAuthProviderBody, idempotencyKey?: string): Promise<{
-        object: "oauth_provider";
-        provider: string;
-        configured: true;
-    }>;
+    upsert(provider: string, body: UpsertOAuthProviderBody, idempotencyKey?: string): Promise<OAuthProviderUpsertResult>;
     delete(provider: string): Promise<{
         object: "oauth_provider";
         provider: string;

package/dist/client/oauth-providers.js

@@ -5,8 +5,13 @@ const request_1 = require("./request");
 function oauthProvidersResource(request) {
     return {
         /** The whole catalog, configured or not — a not-yet-set-up provider is exactly the one a setup agent wants. */
-        list() {
-            return request({ method: 'GET', path: '/v1/oauth_providers' });
+        list(params = {}) {
+            const provider = Array.isArray(params.provider) ? params.provider.join(',') : params.provider;
+            return request({
+                method: 'GET',
+                path: '/v1/oauth_providers',
+                query: { provider, configured: params.configured },
+            });
         },
         get(provider) {
             return request({ method: 'GET', path: `/v1/oauth_providers/${(0, request_1.enc)(provider)}` });

package/dist/client/oauth-providers.js.map

@@ -1 +1 @@
-{"version":3,"file":"oauth-providers.js","sourceRoot":"","sources":["../../src/client/oauth-providers.ts"],"names":[],"mappings":";;AAgFA,wDA2DC;AA3ID,uCAAgD;AAgFhD,SAAgB,sBAAsB,CAAC,OAAkB;IACvD,OAAO;QACL,+GAA+G;QAC/G,IAAI;YACF,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,qBAAqB,EAAE,CAAC,CAAC;QACjE,CAAC;QACD,GAAG,CAAC,QAAgB;YAClB,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,uBAAuB,IAAA,aAAG,EAAC,QAAQ,CAAC,EAAE,EAAE,CAAC,CAAC;QAClF,CAAC;QACD,uEAAuE;QACvE,MAAM,CACJ,QAAgB,EAChB,IAA6B,EAC7B,cAAuB;YAEvB,OAAO,OAAO,CAAC;gBACb,MAAM,EAAE,KAAK;gBACb,IAAI,EAAE,uBAAuB,IAAA,aAAG,EAAC,QAAQ,CAAC,EAAE;gBAC5C,IAAI;gBACJ,cAAc;aACf,CAAC,CAAC;QACL,CAAC;QACD,MAAM,CACJ,QAAgB;YAEhB,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,uBAAuB,IAAA,aAAG,EAAC,QAAQ,CAAC,EAAE,EAAE,CAAC,CAAC;QACrF,CAAC;QACD,qFAAqF;QACrF,UAAU,CACR,QAAgB,EAChB,OAAgB;YAEhB,OAAO,OAAO,CAAC;gBACb,MAAM,EAAE,MAAM;gBACd,IAAI,EAAE,uBAAuB,IAAA,aAAG,EAAC,QAAQ,CAAC,UAAU;gBACpD,IAAI,EAAE,EAAE,OAAO,EAAE;aAClB,CAAC,CAAC;QACL,CAAC;QACD,0EAA0E;QAC1E,QAAQ,CACN,QAAgB,EAChB,IAAwD;YAOxD,OAAO,OAAO,CAAC;gBACb,MAAM,EAAE,MAAM;gBACd,IAAI,EAAE,uBAAuB,IAAA,aAAG,EAAC,QAAQ,CAAC,QAAQ;gBAClD,IAAI;aACL,CAAC,CAAC;QACL,CAAC;QACD,gGAAgG;QAChG,IAAI,CAAC,QAAgB;YACnB,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,uBAAuB,IAAA,aAAG,EAAC,QAAQ,CAAC,OAAO,EAAE,CAAC,CAAC;QACxF,CAAC;KACF,CAAC;AACJ,CAAC"}
+{"version":3,"file":"oauth-providers.js","sourceRoot":"","sources":["../../src/client/oauth-providers.ts"],"names":[],"mappings":";;AAoJA,wDAgEC;AApND,uCAAgD;AAoJhD,SAAgB,sBAAsB,CAAC,OAAkB;IACvD,OAAO;QACL,+GAA+G;QAC/G,IAAI,CAAC,SAAmC,EAAE;YACxC,MAAM,QAAQ,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC;YAC9F,OAAO,OAAO,CAAC;gBACb,MAAM,EAAE,KAAK;gBACb,IAAI,EAAE,qBAAqB;gBAC3B,KAAK,EAAE,EAAE,QAAQ,EAAE,UAAU,EAAE,MAAM,CAAC,UAAU,EAAE;aACnD,CAAC,CAAC;QACL,CAAC;QACD,GAAG,CAAC,QAAgB;YAClB,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,uBAAuB,IAAA,aAAG,EAAC,QAAQ,CAAC,EAAE,EAAE,CAAC,CAAC;QAClF,CAAC;QACD,uEAAuE;QACvE,MAAM,CACJ,QAAgB,EAChB,IAA6B,EAC7B,cAAuB;YAEvB,OAAO,OAAO,CAAC;gBACb,MAAM,EAAE,KAAK;gBACb,IAAI,EAAE,uBAAuB,IAAA,aAAG,EAAC,QAAQ,CAAC,EAAE;gBAC5C,IAAI;gBACJ,cAAc;aACf,CAAC,CAAC;QACL,CAAC;QACD,MAAM,CACJ,QAAgB;YAEhB,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,uBAAuB,IAAA,aAAG,EAAC,QAAQ,CAAC,EAAE,EAAE,CAAC,CAAC;QACrF,CAAC;QACD,qFAAqF;QACrF,UAAU,CACR,QAAgB,EAChB,OAAgB;YAEhB,OAAO,OAAO,CAAC;gBACb,MAAM,EAAE,MAAM;gBACd,IAAI,EAAE,uBAAuB,IAAA,aAAG,EAAC,QAAQ,CAAC,UAAU;gBACpD,IAAI,EAAE,EAAE,OAAO,EAAE;aAClB,CAAC,CAAC;QACL,CAAC;QACD,0EAA0E;QAC1E,QAAQ,CACN,QAAgB,EAChB,IAAwD;YAOxD,OAAO,OAAO,CAAC;gBACb,MAAM,EAAE,MAAM;gBACd,IAAI,EAAE,uBAAuB,IAAA,aAAG,EAAC,QAAQ,CAAC,QAAQ;gBAClD,IAAI;aACL,CAAC,CAAC;QACL,CAAC;QACD,gGAAgG;QAChG,IAAI,CAAC,QAAgB;YACnB,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,uBAAuB,IAAA,aAAG,EAAC,QAAQ,CAAC,OAAO,EAAE,CAAC,CAAC;QACxF,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/client/openfga.d.ts

@@ -0,0 +1,137 @@
+import { type RequestFn } from './request';
+/**
+ * The OpenFGA-wire ReBAC surface (`/v1/openfga/stores/...`). Shapes follow the
+ * OpenFGA HTTP API (snake_case on the wire), so an existing OpenFGA client's
+ * payloads work unchanged. Distinct from `fga` (Atlas's own relationship API).
+ */
+/** An OpenFGA store. Timestamps are ISO-8601 strings, as in OpenFGA. */
+export interface OpenFgaStore {
+    id: string;
+    name: string;
+    created_at: string;
+    updated_at: string;
+}
+/** A relationship tuple key: `user` (e.g. `user:alice`), `relation`, `object` (e.g. `document:roadmap`). */
+export interface OpenFgaTupleKey {
+    user: string;
+    relation: string;
+    object: string;
+}
+/** Contextual tuples: either the OpenFGA `{ tuple_keys }` wrapper or a bare array. */
+export type OpenFgaContextualTuples = {
+    tuple_keys: OpenFgaTupleKey[];
+} | OpenFgaTupleKey[];
+/** An authorization model. `type_definitions` and other OpenFGA keys pass through as-is. */
+export interface OpenFgaAuthorizationModel {
+    id: string;
+    schema_version: string;
+    type_definitions?: Array<Record<string, unknown>>;
+    [key: string]: unknown;
+}
+/**
+ * A new model: the OpenFGA JSON form (`schema_version` + `type_definitions`) or
+ * the DSL text in `dsl`.
+ */
+export interface WriteOpenFgaModelBody {
+    type_definitions?: Array<Record<string, unknown>>;
+    schema_version?: string;
+    dsl?: string;
+    [key: string]: unknown;
+}
+export interface OpenFgaCheckBody {
+    tuple_key: OpenFgaTupleKey;
+    authorization_model_id?: string;
+    contextual_tuples?: OpenFgaContextualTuples;
+}
+export interface OpenFgaBatchCheckItem {
+    tuple_key: OpenFgaTupleKey;
+    /** Keys the result; defaults to the item's index. */
+    correlation_id?: string;
+    contextual_tuples?: OpenFgaContextualTuples;
+}
+export interface OpenFgaBatchCheckBody {
+    /** 1–100 checks. */
+    checks: OpenFgaBatchCheckItem[];
+    authorization_model_id?: string;
+}
+export interface OpenFgaExpandBody {
+    tuple_key: {
+        object: string;
+        relation: string;
+    };
+    authorization_model_id?: string;
+}
+export interface OpenFgaListObjectsBody {
+    /** Object type, e.g. `document`. */
+    type: string;
+    relation: string;
+    user: string;
+    authorization_model_id?: string;
+    contextual_tuples?: OpenFgaContextualTuples;
+}
+export interface OpenFgaReadBody {
+    /** Optional filter; `object` may be a full `type:id` or a bare `type:` prefix. */
+    tuple_key?: Partial<OpenFgaTupleKey>;
+    page_size?: number;
+    continuation_token?: string;
+}
+export interface OpenFgaTuple {
+    key: OpenFgaTupleKey;
+    timestamp: string;
+}
+export interface OpenFgaWriteBody {
+    writes?: {
+        tuple_keys: OpenFgaTupleKey[];
+    };
+    deletes?: {
+        tuple_keys: OpenFgaTupleKey[];
+    };
+}
+export declare function openfgaResource(request: RequestFn): {
+    stores: {
+        list(): Promise<{
+            stores: OpenFgaStore[];
+        }>;
+        create(body: {
+            name: string;
+        }, idempotencyKey?: string): Promise<OpenFgaStore>;
+        get(store: string): Promise<OpenFgaStore>;
+    };
+    authorizationModels: {
+        list(store: string): Promise<{
+            authorization_models: OpenFgaAuthorizationModel[];
+        }>;
+        /** Write a new model; it becomes the latest model of the store. */
+        write(store: string, body: WriteOpenFgaModelBody): Promise<{
+            authorization_model_id: string;
+        }>;
+        get(store: string, modelId: string): Promise<{
+            authorization_model: OpenFgaAuthorizationModel;
+        }>;
+    };
+    check(store: string, body: OpenFgaCheckBody): Promise<{
+        allowed: boolean;
+    }>;
+    /** Up to 100 checks in one call; results keyed by correlation id. */
+    batchCheck(store: string, body: OpenFgaBatchCheckBody): Promise<{
+        result: Record<string, {
+            allowed: boolean;
+        }>;
+    }>;
+    /** The userset tree for an (object, relation), in OpenFGA's node format. */
+    expand(store: string, body: OpenFgaExpandBody): Promise<{
+        tree: {
+            root: Record<string, unknown>;
+        };
+    }>;
+    /** Objects (`type:id`) of `type` the user has `relation` on. */
+    listObjects(store: string, body: OpenFgaListObjectsBody): Promise<{
+        objects: string[];
+    }>;
+    read(store: string, body?: OpenFgaReadBody): Promise<{
+        tuples: OpenFgaTuple[];
+        continuation_token: string;
+    }>;
+    /** Add (`writes`) and/or remove (`deletes`) tuples. */
+    write(store: string, body: OpenFgaWriteBody): Promise<Record<string, never>>;
+};

package/dist/client/openfga.js

@@ -0,0 +1,72 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.openfgaResource = openfgaResource;
+const request_1 = require("./request");
+function openfgaResource(request) {
+    return {
+        stores: {
+            list() {
+                return request({ method: 'GET', path: '/v1/openfga/stores' });
+            },
+            create(body, idempotencyKey) {
+                return request({ method: 'POST', path: '/v1/openfga/stores', body, idempotencyKey });
+            },
+            get(store) {
+                return request({ method: 'GET', path: `/v1/openfga/stores/${(0, request_1.enc)(store)}` });
+            },
+        },
+        authorizationModels: {
+            list(store) {
+                return request({
+                    method: 'GET',
+                    path: `/v1/openfga/stores/${(0, request_1.enc)(store)}/authorization-models`,
+                });
+            },
+            /** Write a new model; it becomes the latest model of the store. */
+            write(store, body) {
+                return request({
+                    method: 'POST',
+                    path: `/v1/openfga/stores/${(0, request_1.enc)(store)}/authorization-models`,
+                    body,
+                });
+            },
+            get(store, modelId) {
+                return request({
+                    method: 'GET',
+                    path: `/v1/openfga/stores/${(0, request_1.enc)(store)}/authorization-models/${(0, request_1.enc)(modelId)}`,
+                });
+            },
+        },
+        check(store, body) {
+            return request({ method: 'POST', path: `/v1/openfga/stores/${(0, request_1.enc)(store)}/check`, body });
+        },
+        /** Up to 100 checks in one call; results keyed by correlation id. */
+        batchCheck(store, body) {
+            return request({
+                method: 'POST',
+                path: `/v1/openfga/stores/${(0, request_1.enc)(store)}/batch-check`,
+                body,
+            });
+        },
+        /** The userset tree for an (object, relation), in OpenFGA's node format. */
+        expand(store, body) {
+            return request({ method: 'POST', path: `/v1/openfga/stores/${(0, request_1.enc)(store)}/expand`, body });
+        },
+        /** Objects (`type:id`) of `type` the user has `relation` on. */
+        listObjects(store, body) {
+            return request({
+                method: 'POST',
+                path: `/v1/openfga/stores/${(0, request_1.enc)(store)}/list-objects`,
+                body,
+            });
+        },
+        read(store, body = {}) {
+            return request({ method: 'POST', path: `/v1/openfga/stores/${(0, request_1.enc)(store)}/read`, body });
+        },
+        /** Add (`writes`) and/or remove (`deletes`) tuples. */
+        write(store, body) {
+            return request({ method: 'POST', path: `/v1/openfga/stores/${(0, request_1.enc)(store)}/write`, body });
+        },
+    };
+}
+//# sourceMappingURL=openfga.js.map

package/dist/client/openfga.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"openfga.js","sourceRoot":"","sources":["../../src/client/openfga.ts"],"names":[],"mappings":";;AA+FA,0CA8EC;AA7KD,uCAAgD;AA+FhD,SAAgB,eAAe,CAAC,OAAkB;IAChD,OAAO;QACL,MAAM,EAAE;YACN,IAAI;gBACF,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,oBAAoB,EAAE,CAAC,CAAC;YAChE,CAAC;YACD,MAAM,CAAC,IAAsB,EAAE,cAAuB;gBACpD,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,oBAAoB,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC;YACvF,CAAC;YACD,GAAG,CAAC,KAAa;gBACf,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,sBAAsB,IAAA,aAAG,EAAC,KAAK,CAAC,EAAE,EAAE,CAAC,CAAC;YAC9E,CAAC;SACF;QACD,mBAAmB,EAAE;YACnB,IAAI,CAAC,KAAa;gBAChB,OAAO,OAAO,CAAC;oBACb,MAAM,EAAE,KAAK;oBACb,IAAI,EAAE,sBAAsB,IAAA,aAAG,EAAC,KAAK,CAAC,uBAAuB;iBAC9D,CAAC,CAAC;YACL,CAAC;YACD,mEAAmE;YACnE,KAAK,CAAC,KAAa,EAAE,IAA2B;gBAC9C,OAAO,OAAO,CAAC;oBACb,MAAM,EAAE,MAAM;oBACd,IAAI,EAAE,sBAAsB,IAAA,aAAG,EAAC,KAAK,CAAC,uBAAuB;oBAC7D,IAAI;iBACL,CAAC,CAAC;YACL,CAAC;YACD,GAAG,CACD,KAAa,EACb,OAAe;gBAEf,OAAO,OAAO,CAAC;oBACb,MAAM,EAAE,KAAK;oBACb,IAAI,EAAE,sBAAsB,IAAA,aAAG,EAAC,KAAK,CAAC,yBAAyB,IAAA,aAAG,EAAC,OAAO,CAAC,EAAE;iBAC9E,CAAC,CAAC;YACL,CAAC;SACF;QACD,KAAK,CAAC,KAAa,EAAE,IAAsB;YACzC,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,sBAAsB,IAAA,aAAG,EAAC,KAAK,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC;QAC3F,CAAC;QACD,qEAAqE;QACrE,UAAU,CACR,KAAa,EACb,IAA2B;YAE3B,OAAO,OAAO,CAAC;gBACb,MAAM,EAAE,MAAM;gBACd,IAAI,EAAE,sBAAsB,IAAA,aAAG,EAAC,KAAK,CAAC,cAAc;gBACpD,IAAI;aACL,CAAC,CAAC;QACL,CAAC;QACD,4EAA4E;QAC5E,MAAM,CACJ,KAAa,EACb,IAAuB;YAEvB,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,sBAAsB,IAAA,aAAG,EAAC,KAAK,CAAC,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAC5F,CAAC;QACD,gEAAgE;QAChE,WAAW,CAAC,KAAa,EAAE,IAA4B;YACrD,OAAO,OAAO,CAAC;gBACb,MAAM,EAAE,MAAM;gBACd,IAAI,EAAE,sBAAsB,IAAA,aAAG,EAAC,KAAK,CAAC,eAAe;gBACrD,IAAI;aACL,CAAC,CAAC;QACL,CAAC;QACD,IAAI,CACF,KAAa,EACb,OAAwB,EAAE;YAE1B,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,sBAAsB,IAAA,aAAG,EAAC,KAAK,CAAC,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;QAC1F,CAAC;QACD,uDAAuD;QACvD,KAAK,CAAC,KAAa,EAAE,IAAsB;YACzC,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,sBAAsB,IAAA,aAAG,EAAC,KAAK,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC;QAC3F,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/client/org-ldap-connections.d.ts

@@ -0,0 +1,75 @@
+import { type RequestFn } from './request';
+import type { ListPage } from './types';
+export type OrgLdapConnectionStatus = 'draft' | 'active' | 'disabled';
+/** Directory attribute → Atlas field mapping. `email` is required. */
+export interface OrgLdapAttributeMap {
+    email: string;
+    firstName?: string;
+    lastName?: string;
+    username?: string;
+}
+/** An organization-owned LDAP / Active Directory connection. Never the bind password. */
+export interface OrgLdapConnection {
+    object: 'org_ldap_connection';
+    id: string;
+    organization_id: string;
+    status: OrgLdapConnectionStatus;
+    url: string;
+    bind_dn: string;
+    base_dn: string;
+    user_filter: string;
+    start_tls: boolean;
+    attributes: OrgLdapAttributeMap;
+    has_bind_password: boolean;
+    default_role_id: string | null;
+    created_at: number;
+    updated_at: number;
+}
+export interface UpdateOrgLdapConnectionBody {
+    status?: OrgLdapConnectionStatus;
+    /** `ldap://` or `ldaps://` directory URL. */
+    url?: string;
+    /** Service-account DN Atlas binds as to search. */
+    bind_dn?: string;
+    /** Subtree searched under. */
+    base_dn?: string;
+    /** Search filter with a `{{username}}` placeholder. */
+    user_filter?: string;
+    start_tls?: boolean;
+    attributes?: OrgLdapAttributeMap;
+    /** Service-account password. Write-only; re-encrypted only when supplied. */
+    bind_password?: string;
+    default_role_id?: string | null;
+}
+/** One connection per organization. */
+export interface CreateOrgLdapConnectionBody extends UpdateOrgLdapConnectionBody {
+    organization_id: string;
+}
+export interface OrgLdapConnectionTest {
+    object: 'org_ldap_connection_test';
+    id: string;
+    /** Whether the service-account bind succeeded. */
+    ok: boolean;
+    /** Present only when the bind failed. */
+    error?: string;
+}
+export declare function orgLdapConnectionsResource(request: RequestFn): {
+    list(params?: {
+        organization_id?: string;
+    }): Promise<ListPage<OrgLdapConnection>>;
+    create(body: CreateOrgLdapConnectionBody, idempotencyKey?: string): Promise<OrgLdapConnection>;
+    get(id: string): Promise<OrgLdapConnection>;
+    update(id: string, body: UpdateOrgLdapConnectionBody, idempotencyKey?: string): Promise<OrgLdapConnection>;
+    delete(id: string): Promise<{
+        object: "org_ldap_connection";
+        id: string;
+        deleted: true;
+    }>;
+    /**
+     * Attempt a service-account bind and report ok/failure. Pass `bind_password`
+     * to test a password before saving it.
+     */
+    test(id: string, body?: {
+        bind_password?: string;
+    }): Promise<OrgLdapConnectionTest>;
+};

package/dist/client/org-ldap-connections.js

@@ -0,0 +1,36 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.orgLdapConnectionsResource = orgLdapConnectionsResource;
+const request_1 = require("./request");
+function orgLdapConnectionsResource(request) {
+    return {
+        list(params = {}) {
+            return request({ method: 'GET', path: '/v1/org_ldap_connections', query: { ...params } });
+        },
+        create(body, idempotencyKey) {
+            return request({ method: 'POST', path: '/v1/org_ldap_connections', body, idempotencyKey });
+        },
+        get(id) {
+            return request({ method: 'GET', path: `/v1/org_ldap_connections/${(0, request_1.enc)(id)}` });
+        },
+        update(id, body, idempotencyKey) {
+            return request({
+                method: 'PATCH',
+                path: `/v1/org_ldap_connections/${(0, request_1.enc)(id)}`,
+                body,
+                idempotencyKey,
+            });
+        },
+        delete(id) {
+            return request({ method: 'DELETE', path: `/v1/org_ldap_connections/${(0, request_1.enc)(id)}` });
+        },
+        /**
+         * Attempt a service-account bind and report ok/failure. Pass `bind_password`
+         * to test a password before saving it.
+         */
+        test(id, body = {}) {
+            return request({ method: 'POST', path: `/v1/org_ldap_connections/${(0, request_1.enc)(id)}/test`, body });
+        },
+    };
+}
+//# sourceMappingURL=org-ldap-connections.js.map

package/dist/client/org-ldap-connections.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"org-ldap-connections.js","sourceRoot":"","sources":["../../src/client/org-ldap-connections.ts"],"names":[],"mappings":";;AA8DA,gEAuCC;AArGD,uCAAgD;AA8DhD,SAAgB,0BAA0B,CAAC,OAAkB;IAC3D,OAAO;QACL,IAAI,CACF,SAAuC,EAAE;YAEzC,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,0BAA0B,EAAE,KAAK,EAAE,EAAE,GAAG,MAAM,EAAE,EAAE,CAAC,CAAC;QAC5F,CAAC;QACD,MAAM,CACJ,IAAiC,EACjC,cAAuB;YAEvB,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,0BAA0B,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC;QAC7F,CAAC;QACD,GAAG,CAAC,EAAU;YACZ,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,4BAA4B,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;QACjF,CAAC;QACD,MAAM,CACJ,EAAU,EACV,IAAiC,EACjC,cAAuB;YAEvB,OAAO,OAAO,CAAC;gBACb,MAAM,EAAE,OAAO;gBACf,IAAI,EAAE,4BAA4B,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE;gBAC3C,IAAI;gBACJ,cAAc;aACf,CAAC,CAAC;QACL,CAAC;QACD,MAAM,CAAC,EAAU;YACf,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,4BAA4B,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;QACpF,CAAC;QACD;;;WAGG;QACH,IAAI,CAAC,EAAU,EAAE,OAAmC,EAAE;YACpD,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,4BAA4B,IAAA,aAAG,EAAC,EAAE,CAAC,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;QAC7F,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/client/organization-settings-schema.d.ts

@@ -0,0 +1,24 @@
+import type { RequestFn } from './request';
+/**
+ * The instance-wide JSON Schema every organization's settings document is
+ * validated against (`organizations.settings.*`). The validated subset is
+ * type/required/properties/enum/minimum/maximum/minLength/maxLength/minItems/
+ * maxItems/items/additionalProperties/pattern/format (email, uri/url,
+ * date-time, uuid).
+ */
+export interface OrganizationSettingsSchema {
+    object: 'organization_settings_schema';
+    schema: Record<string, unknown>;
+    /** Bumped each time the schema is re-registered. */
+    version: number;
+    /** Last registered (epoch ms). */
+    updated_at: number;
+}
+export declare function organizationSettingsSchemaResource(request: RequestFn): {
+    /** 404 when no schema is registered. */
+    get(): Promise<OrganizationSettingsSchema>;
+    /** First registration. */
+    create(schema: Record<string, unknown>, idempotencyKey?: string): Promise<OrganizationSettingsSchema>;
+    /** Replace the schema; bumps `version` so consumers can detect the contract change. */
+    replace(schema: Record<string, unknown>, idempotencyKey?: string): Promise<OrganizationSettingsSchema>;
+};

package/dist/client/organization-settings-schema.js

@@ -0,0 +1,30 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.organizationSettingsSchemaResource = organizationSettingsSchemaResource;
+function organizationSettingsSchemaResource(request) {
+    return {
+        /** 404 when no schema is registered. */
+        get() {
+            return request({ method: 'GET', path: '/v1/organization_settings_schema' });
+        },
+        /** First registration. */
+        create(schema, idempotencyKey) {
+            return request({
+                method: 'POST',
+                path: '/v1/organization_settings_schema',
+                body: { schema },
+                idempotencyKey,
+            });
+        },
+        /** Replace the schema; bumps `version` so consumers can detect the contract change. */
+        replace(schema, idempotencyKey) {
+            return request({
+                method: 'PUT',
+                path: '/v1/organization_settings_schema',
+                body: { schema },
+                idempotencyKey,
+            });
+        },
+    };
+}
+//# sourceMappingURL=organization-settings-schema.js.map

package/dist/client/organization-settings-schema.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"organization-settings-schema.js","sourceRoot":"","sources":["../../src/client/organization-settings-schema.ts"],"names":[],"mappings":";;AAkBA,gFA+BC;AA/BD,SAAgB,kCAAkC,CAAC,OAAkB;IACnE,OAAO;QACL,wCAAwC;QACxC,GAAG;YACD,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,kCAAkC,EAAE,CAAC,CAAC;QAC9E,CAAC;QACD,0BAA0B;QAC1B,MAAM,CACJ,MAA+B,EAC/B,cAAuB;YAEvB,OAAO,OAAO,CAAC;gBACb,MAAM,EAAE,MAAM;gBACd,IAAI,EAAE,kCAAkC;gBACxC,IAAI,EAAE,EAAE,MAAM,EAAE;gBAChB,cAAc;aACf,CAAC,CAAC;QACL,CAAC;QACD,uFAAuF;QACvF,OAAO,CACL,MAA+B,EAC/B,cAAuB;YAEvB,OAAO,OAAO,CAAC;gBACb,MAAM,EAAE,KAAK;gBACb,IAAI,EAAE,kCAAkC;gBACxC,IAAI,EAAE,EAAE,MAAM,EAAE;gBAChB,cAAc;aACf,CAAC,CAAC;QACL,CAAC;KACF,CAAC;AACJ,CAAC"}