@atlasauth/backend 0.7.2 → 0.8.0

package/CHANGELOG.md

@@ -1,5 +1,23 @@
 # @atlasauth/backend changelog
 
+## 0.8.0
+- **Back-channel logout, retryable failures.** A failed `LogoutTokenResult` gains `retryable: boolean`. It is `true` for `no_keys` (the issuer's keys could not be fetched: a network error, a JWKS outage, or a just-rotated key whose refetch failed) and `false` for `malformed`, `invalid` and `replayed`. Answer `503` with `Retry-After` when it is true, so Atlas retries the delivery, and `400` otherwise. The README example does this.
+- **Back-channel delivery log and test.** `oauthClients.listBackchannelDeliveries(id, { limit?, starting_after? })` returns `BackchannelLogoutDeliveryPage` (`BackchannelLogoutDelivery`: `status`, `http_status`, `latency_ms`, `attempt_number`, `error`, `location`, `test`, timestamps). `oauthClients.testBackchannelLogout(id)` returns `BackchannelLogoutTest` (`ok`, `status`, `latency_ms`, `error`, `location`, `blocked_reason`, `body_excerpt`, `sid`, `delivery_id`). The platform client's `atlasIdApps` gains the same two methods plus `preflight(id)` (`AtlasIdAppPreflight`).
+- **Webhooks.** `verifyWebhook` returns `deliveryId` (the signed `atlas-id` header, the same on every retry of one event: deduplicate on it) and `timestamp` (the signed `atlas-timestamp`, epoch ms) on a verified delivery. `WebhookVerifyResult` gains both, optional.
+- **Users.** `User` gains optional `version`: it strictly increases with every change to the user, and user webhook payloads carry the same value. Apply an update only if its version is newer.
+- **Branding.** `ResolvedBranding` (`resolved` on `branding.get` / `branding.update`) gains every writable field under its input name (`theme`, `layout`, `fontFamily`, `legal`, `copy`, `providers`, `card`, `interaction`, `socialButtons`, …) plus the derived `fontStack`, `providerOrder`, `providerHidden`, `eyebrow`, `headline`, `subheadline`, `footer`. `Branding.copy` accepts `eyebrow`.
+- **Domain moves.** `instance.moveOrigin({ from, to, dry_run? })` rewrites every URL on one origin to another across the instance, its OAuth clients, webhooks, redirect URLs and Sign in with Atlas apps, and returns `OriginMove` (`changes` before → after, `problems`, `applied`); the platform client's `atlasIdApps.moveOrigin(id, body)` does the same for one app.
+- **Connections and integrations.** `instance.connections()` returns `InstanceConnections` (one `InstanceConnection` row per link to another platform, with `ok`, `severity`, `fix_hint`). `instance.integrations.chatly` and `instance.integrations.forumulate` get, set and delete the built-in connections (`ChatlyIntegration`, `ForumulateIntegration`).
+- **Logout fan-out.** New `logoutNotifyEndpoints` namespace: `list`, `create`, `get`, `update`, `delete` and `listDeliveries` for services that receive the same `logout_token` as your OIDC apps (`LogoutNotifyEndpoint`, `LogoutNotifyDelivery`).
+- **Managed email.** `messaging.managedEmail.get / create / verify / delete({ force? })` sends from your own domain through Atlas's email account (`ManagedEmail`, `ManagedEmailRecord`, `CreateManagedEmailBody` with optional write-only `dns`). `MessagingProviders` gains `managed_email`.
+- **Sign in with Atlas apps.** `atlasIdApps.findUsers(id, email)` (privacy-request lookup, `AtlasIdAppUser`), `revokeGrant(id, grantId)` (`AtlasIdGrantRevocation`) and `rotateWebhookSecret(id)`. `AtlasIdApp` gains `webhook_url`, `webhook_events` and `webhook_active`; `AtlasIdAppWithSecret` gains `webhook_secret`; `UpdateAtlasIdAppBody` accepts `webhook_url`.
+- **Publisher.** New platform namespace `atlasIdPublisher`: `get`, `set`, `update({ skip_consent })`, `delete`, `verify` (`AtlasIdPublisher`). The platform client's `configChangelog.list(params)` reads the account's config history.
+- **More fields.** `CookieConsent` gains `culture` and `declared_cookies` (`DeclaredCookie`); `SetCookieConsentBody` accepts `culture`. `PreflightReport` gains `sdk_versions_seen` (`SdkVersionSeen`, `SdkAdvisory`). `WebhookDelivery` gains `error` and `location`; `WebhookEndpointList` gains `event_catalog` (`WebhookEventCatalogEntry`) and `event_audiences`. `CustomDomain` gains `dns`, and `domains.create` accepts `dns` (`CustomDomainDnsInput`). `ConfigChangelogEntry` gains `target`. `users.revokeSessions(id, { revoke_grants })` also revokes OAuth grants and returns `grants_revoked`.
+- **Compatible.** New methods, types and optional fields only (`retryable` is a new field on the failure branch); no signatures changed.
+
+## 0.7.3
+- **Added** error code constants `CAPTCHA_KEYS_REQUIRED` (422: captcha can only be turned on once its own site key and secret are stored) and `CAPTCHA_IN_USE` (409: removing a key a live captcha flow uses; `meta.flows`).
+
 ## 0.7.2
 - **OAuth clients.** `OAuthClient` gains `skip_logout_confirmation` (boolean), and `OAuthClientLogoutFields` (create and update bodies) accepts it. When true, RP-initiated logout with the client's `client_id` and an exactly registered `post_logout_redirect_uri` ends the session and redirects straight back, with no confirmation page. First-party clients only: the API answers `422` (`VALIDATION_FAILED`, `param: skip_logout_confirmation`) on a third-party client.
 - **Cookie consent.** `CookieConsent` gains `settings_link` (`CookieSettingsLink | null`: `label`, `preset`, `attributes`, `rendered_attributes`), and `SetCookieConsentBody` accepts `settings_link` (`CookieSettingsLinkInput | null`: `label`, `preset?`, `attributes?`) for a footer "Cookie settings" link that reopens the consent preferences. New types: `CookieSettingsLink`, `CookieSettingsLinkInput`, `CookieSettingsLinkPreset` (`'cookiemunch' | 'cookiebot' | 'onetrust' | 'custom'`).

package/README.md

@@ -178,6 +178,25 @@ The platform client has these namespaces:
 
 It accepts the same `strict`, `onUnknownFields` and `withOptions` settings.
 
+### Domain moves, logout fan-out and managed email
+
+```ts
+// Move every URL from the old origin to the new one. dry_run first shows the diff.
+const preview = await atlas.instance.moveOrigin({ from: 'https://old.example.com', to: 'https://example.com', dry_run: true });
+for (const c of preview.changes) console.log(c.object, c.field, c.before, '->', c.after);
+
+// Send the same logout_token your OIDC apps get to another service.
+await atlas.logoutNotifyEndpoints.create({ url: 'https://api.example.com/atlas/logout' });
+
+// Send email from your own domain through Atlas, then publish the returned DNS records.
+const managed = await atlas.messaging.managedEmail.create({ from_address: 'Acme <no-reply@example.com>' });
+console.log(managed.records);
+```
+
+On the platform client, `atlasIdApps.findUsers(id, email)` answers a privacy request for one app,
+`atlasIdApps.revokeGrant(id, grantId)` revokes one person's approval, and `atlasIdPublisher` claims and verifies
+the publisher name shown on consent screens.
+
 ## Back-channel logout
 
 When a user signs out of Atlas, Atlas POSTs a `logout_token` to your `backchannel_logout_uri`. Verify it before you end the matching local sessions:
@@ -198,7 +217,13 @@ export async function handleBackchannelLogout(form: URLSearchParams) {
   if (!token) return { status: 400, headers };
 
   const result = await logoutTokens.verify(token);
-  if (!result.ok) return { status: 400, headers };
+  if (!result.ok) {
+    // retryable: our side failed for now (the issuer's keys could not be fetched).
+    // 503 + Retry-After makes Atlas send it again; 400 is final and never retried.
+    return result.retryable
+      ? { status: 503, headers: { ...headers, 'Retry-After': '30' } }
+      : { status: 400, headers };
+  }
 
   const { sid, sub } = result.claims;
   if (sid) await sessions.deleteByAtlasSid(sid); // your session store
@@ -222,6 +247,10 @@ For tokens signed by your own instance, `new AtlasBackend({ issuer }).verifyLogo
 
 To refuse replays across several servers, implement `LogoutReplayStore.remember(jti, expiresAtMs)` on a shared store, for example Redis `SET NX PX`.
 
+Atlas retries a delivery that gets a `5xx`, `408`, `429` or no answer, after 5 seconds, 5 minutes, 30 minutes, 2 hours, 5 hours and 10 hours. Any other `4xx` is final. Atlas never follows a redirect: a `3xx` answer is recorded as `backchannel_redirect_not_followed`, so after a domain move update `backchannel_logout_uri` to the final URL. Answer your own transient failures (a database that is down) with `503` too.
+
+To check the route end to end, `oauthClients.testBackchannelLogout(id)` sends a signed test token (`sid` starting `sid_test_`, extra claim `atlas_test: true`) and returns what your route answered; `oauthClients.listBackchannelDeliveries(id)` lists every attempt.
+
 ## Webhooks
 
 `verifyWebhook` checks the signature on events Atlas sends to your webhook endpoints. You manage endpoints with `atlas.webhooks.endpoints`: create, update, reveal or rotate a secret, send a test event, and redeliver a past delivery.

package/dist/client/activity.d.ts

@@ -70,6 +70,11 @@ export interface ConfigChangelogEntry {
     };
     action: string;
     ip?: string | null;
+    /** The object that changed, e.g. `{ type: 'oauth_client', id }`. */
+    target?: {
+        type: string;
+        id: string | null;
+    } | null;
     changes?: Array<{
         section: string;
         before: unknown;

package/dist/client/activity.js.map

@@ -1 +1 @@
-{"version":3,"file":"activity.js","sourceRoot":"","sources":["../../src/client/activity.ts"],"names":[],"mappings":";;AA4EA,wCAOC;AAED,sCAOC;AAED,0DAaC;AA/BD,SAAgB,cAAc,CAAC,OAAkB;IAC/C,OAAO;QACL,2EAA2E;QAC3E,IAAI,CAAC,SAAmC,EAAE;YACxC,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,YAAY,EAAE,KAAK,EAAE,EAAE,GAAG,MAAM,EAAE,EAAE,CAAC,CAAC;QAC9E,CAAC;KACF,CAAC;AACJ,CAAC;AAED,SAAgB,aAAa,CAAC,OAAkB;IAC9C,OAAO;QACL,0FAA0F;QAC1F,GAAG,CAAC,SAA4B,EAAE;YAChC,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,WAAW,EAAE,KAAK,EAAE,EAAE,GAAG,MAAM,EAAE,EAAE,CAAC,CAAC;QAC7E,CAAC;KACF,CAAC;AACJ,CAAC;AAED,SAAgB,uBAAuB,CAAC,OAAkB;IACxD,OAAO;QACL,IAAI,CACF,SAAoC,EAAE;YAOtC,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,sBAAsB,EAAE,KAAK,EAAE,EAAE,GAAG,MAAM,EAAE,EAAE,CAAC,CAAC;QACxF,CAAC;KACF,CAAC;AACJ,CAAC"}
+{"version":3,"file":"activity.js","sourceRoot":"","sources":["../../src/client/activity.ts"],"names":[],"mappings":";;AA8EA,wCAOC;AAED,sCAOC;AAED,0DAaC;AA/BD,SAAgB,cAAc,CAAC,OAAkB;IAC/C,OAAO;QACL,2EAA2E;QAC3E,IAAI,CAAC,SAAmC,EAAE;YACxC,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,YAAY,EAAE,KAAK,EAAE,EAAE,GAAG,MAAM,EAAE,EAAE,CAAC,CAAC;QAC9E,CAAC;KACF,CAAC;AACJ,CAAC;AAED,SAAgB,aAAa,CAAC,OAAkB;IAC9C,OAAO;QACL,0FAA0F;QAC1F,GAAG,CAAC,SAA4B,EAAE;YAChC,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,WAAW,EAAE,KAAK,EAAE,EAAE,GAAG,MAAM,EAAE,EAAE,CAAC,CAAC;QAC7E,CAAC;KACF,CAAC;AACJ,CAAC;AAED,SAAgB,uBAAuB,CAAC,OAAkB;IACxD,OAAO;QACL,IAAI,CACF,SAAoC,EAAE;YAOtC,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,sBAAsB,EAAE,KAAK,EAAE,EAAE,GAAG,MAAM,EAAE,EAAE,CAAC,CAAC;QACxF,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/client/branding.d.ts

@@ -32,6 +32,7 @@ export interface Branding {
         hidden?: string[];
     };
     copy?: {
+        eyebrow?: string;
         headline?: string;
         subheadline?: string;
         footer?: string;
@@ -116,6 +117,63 @@ export interface ResolvedBranding {
     colorBackground: string;
     colorText: string;
     supportEmail: string | null;
+    colorAccent?: string;
+    colorCard?: string;
+    colorBorder?: string;
+    borderRadius?: string;
+    theme?: 'light' | 'dark' | 'auto';
+    /** The font stack name in force (`system` when unset or unknown). */
+    fontFamily?: string;
+    /** The CSS font-family list `fontFamily` resolves to. */
+    fontStack?: string;
+    fontUrl?: string | null;
+    layout?: 'centered' | 'split' | 'wall';
+    background?: Record<string, unknown>;
+    providers?: {
+        order: string[];
+        hidden: string[];
+    };
+    providerOrder?: string[];
+    providerHidden?: string[];
+    socialButtons?: Record<string, unknown>;
+    codeInput?: 'boxes' | 'single';
+    card?: {
+        width: string;
+        align: string;
+        logoSize: string;
+    };
+    typography?: {
+        headingSize: string;
+        headingWeight: string;
+    };
+    buttonShape?: string;
+    cardBorder?: string;
+    inputSize?: string;
+    interaction?: Record<string, unknown>;
+    backgroundPattern?: string;
+    cardStyle?: string;
+    textScale?: string;
+    socialPlacement?: 'top' | 'bottom';
+    sectionOrder?: string[];
+    legal?: {
+        termsUrl: string | null;
+        privacyUrl: string | null;
+        required: boolean;
+    };
+    signUpFields?: Array<Record<string, unknown>>;
+    copy?: {
+        eyebrow: string | null;
+        headline: string | null;
+        subheadline: string | null;
+        footer: string | null;
+    };
+    eyebrow?: string | null;
+    headline?: string | null;
+    subheadline?: string | null;
+    footer?: string | null;
+    customCss?: string;
+    customHtmlHeader?: string;
+    customHtmlFooter?: string;
 }
 /**
  * A read/update echoes the stored branding plus `resolved` — the sanitized shape

package/dist/client/branding.js.map

@@ -1 +1 @@
-{"version":3,"file":"branding.js","sourceRoot":"","sources":["../../src/client/branding.ts"],"names":[],"mappings":";;AAyIA,4CAcC;AAdD,SAAgB,gBAAgB,CAAC,OAAkB;IACjD,OAAO;QACL,GAAG;YACD,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC;QAC1D,CAAC;QACD,kEAAkE;QAClE,MAAM,CAAC,IAAuB;YAC5B,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,cAAc,EAAE,IAAI,EAAE,CAAC,CAAC;QAClE,CAAC;QACD,0EAA0E;QAC1E,OAAO,CAAC,IAAuB;YAC7B,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,sBAAsB,EAAE,IAAI,EAAE,CAAC,CAAC;QACzE,CAAC;KACF,CAAC;AACJ,CAAC"}
+{"version":3,"file":"branding.js","sourceRoot":"","sources":["../../src/client/branding.ts"],"names":[],"mappings":";;AAkLA,4CAcC;AAdD,SAAgB,gBAAgB,CAAC,OAAkB;IACjD,OAAO;QACL,GAAG;YACD,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC;QAC1D,CAAC;QACD,kEAAkE;QAClE,MAAM,CAAC,IAAuB;YAC5B,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,cAAc,EAAE,IAAI,EAAE,CAAC,CAAC;QAClE,CAAC;QACD,0EAA0E;QAC1E,OAAO,CAAC,IAAuB;YAC7B,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,sBAAsB,EAAE,IAAI,EAAE,CAAC,CAAC;QACzE,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/client/domains.d.ts

@@ -13,6 +13,18 @@ export interface CustomDomain {
     failure_reason: string | null;
     certificate_expires_at: number | null;
     cookie_domain: string | null;
+    /** DNS automation: the provider Atlas writes this host's record with (the token is never returned). */
+    dns?: {
+        provider: 'cloudflare';
+        token_set: boolean;
+    } | null;
+}
+/** Let Atlas write the domain's DNS record. The token is write-only. */
+export interface CustomDomainDnsInput {
+    provider: 'cloudflare';
+    api_token: string;
+    /** Replace a conflicting existing record. */
+    overwrite?: boolean;
 }
 export interface ListDomainsResponse {
     object: 'list';
@@ -31,6 +43,7 @@ export declare function domainsResource(request: RequestFn): {
     create(body: {
         host: string;
         role?: "fapi" | "accounts";
+        dns?: CustomDomainDnsInput;
     }, idempotencyKey?: string): Promise<CustomDomain & {
         instructions: Record<string, unknown>;
     }>;

package/dist/client/domains.js.map

@@ -1 +1 @@
-{"version":3,"file":"domains.js","sourceRoot":"","sources":["../../src/client/domains.ts"],"names":[],"mappings":";;AA4BA,0CAkBC;AA9CD,uCAAgD;AA4BhD,SAAgB,eAAe,CAAC,OAAkB;IAChD,OAAO;QACL,IAAI;YACF,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,aAAa,EAAE,CAAC,CAAC;QACzD,CAAC;QACD,MAAM,CACJ,IAAkD,EAClD,cAAuB;YAEvB,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,aAAa,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC;QAChF,CAAC;QACD,MAAM,CAAC,EAAU;YACf,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,eAAe,IAAA,aAAG,EAAC,EAAE,CAAC,SAAS,EAAE,CAAC,CAAC;QAC5E,CAAC;QACD,MAAM,CAAC,EAAU;YACf,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,eAAe,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;QACvE,CAAC;KACF,CAAC;AACJ,CAAC"}
+{"version":3,"file":"domains.js","sourceRoot":"","sources":["../../src/client/domains.ts"],"names":[],"mappings":";;AAsCA,0CAkBC;AAxDD,uCAAgD;AAsChD,SAAgB,eAAe,CAAC,OAAkB;IAChD,OAAO;QACL,IAAI;YACF,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,aAAa,EAAE,CAAC,CAAC;QACzD,CAAC;QACD,MAAM,CACJ,IAA8E,EAC9E,cAAuB;YAEvB,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,aAAa,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC;QAChF,CAAC;QACD,MAAM,CAAC,EAAU;YACf,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,eAAe,IAAA,aAAG,EAAC,EAAE,CAAC,SAAS,EAAE,CAAC,CAAC;QAC5E,CAAC;QACD,MAAM,CAAC,EAAU;YACf,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,eAAe,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;QACvE,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/client/error.d.ts

@@ -41,6 +41,10 @@ export declare const AtlasErrorCodes: {
     readonly EMAIL_PROVIDER_REQUIRED: "EMAIL_PROVIDER_REQUIRED";
     /** The email provider can't be removed while email-dependent features need it (`meta.features`). */
     readonly EMAIL_PROVIDER_IN_USE: "EMAIL_PROVIDER_IN_USE";
+    /** 422 — captcha turned on without its own site key and secret (captcha is bring-your-own-keys). */
+    readonly CAPTCHA_KEYS_REQUIRED: "CAPTCHA_KEYS_REQUIRED";
+    /** 409 — removing a captcha key a live flow uses (`meta.flows`); `force=true` turns those flows off. */
+    readonly CAPTCHA_IN_USE: "CAPTCHA_IN_USE";
     /** Strict mode: the body had a field this endpoint does not accept (`param` names it). */
     readonly UNKNOWN_FIELD: "UNKNOWN_FIELD";
     /** The billing plan still has subscribers and cannot be removed. */

package/dist/client/error.js

@@ -37,6 +37,10 @@ exports.AtlasErrorCodes = {
     EMAIL_PROVIDER_REQUIRED: 'EMAIL_PROVIDER_REQUIRED',
     /** The email provider can't be removed while email-dependent features need it (`meta.features`). */
     EMAIL_PROVIDER_IN_USE: 'EMAIL_PROVIDER_IN_USE',
+    /** 422 — captcha turned on without its own site key and secret (captcha is bring-your-own-keys). */
+    CAPTCHA_KEYS_REQUIRED: 'CAPTCHA_KEYS_REQUIRED',
+    /** 409 — removing a captcha key a live flow uses (`meta.flows`); `force=true` turns those flows off. */
+    CAPTCHA_IN_USE: 'CAPTCHA_IN_USE',
     /** Strict mode: the body had a field this endpoint does not accept (`param` names it). */
     UNKNOWN_FIELD: 'UNKNOWN_FIELD',
     /** The billing plan still has subscribers and cannot be removed. */

package/dist/client/error.js.map

@@ -1 +1 @@
-{"version":3,"file":"error.js","sourceRoot":"","sources":["../../src/client/error.ts"],"names":[],"mappings":";;;AAoBA,MAAa,aAAc,SAAQ,KAAK;IACpB,IAAI,GAAG,eAAe,CAAC;IACzC,0CAA0C;IACjC,MAAM,CAAS;IACxB,8CAA8C;IACrC,MAAM,CAAmB;IAElC,YAAY,MAAc,EAAE,MAAwB,EAAE,OAAgB;QACpE,KAAK,CAAC,OAAO,IAAI,MAAM,CAAC,CAAC,CAAC,EAAE,OAAO,IAAI,wCAAwC,MAAM,EAAE,CAAC,CAAC;QACzF,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QACrB,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QACrB,uEAAuE;QACvE,sEAAsE;QACtE,MAAM,CAAC,cAAc,CAAC,IAAI,EAAE,aAAa,CAAC,SAAS,CAAC,CAAC;IACvD,CAAC;IAED,uEAAuE;IACvE,IAAI,IAAI;QACN,OAAO,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC;IAC9B,CAAC;IAED,yEAAyE;IACzE,OAAO,CAAC,IAAY;QAClB,OAAO,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC;IAClD,CAAC;CACF;AAzBD,sCAyBC;AAED;;;;GAIG;AACU,QAAA,eAAe,GAAG;IAC7B,+EAA+E;IAC/E,6BAA6B,EAAE,+BAA+B;IAC9D,mEAAmE;IACnE,uBAAuB,EAAE,yBAAyB;IAClD,oGAAoG;IACpG,qBAAqB,EAAE,uBAAuB;IAC9C,0FAA0F;IAC1F,aAAa,EAAE,eAAe;IAC9B,oEAAoE;IACpE,WAAW,EAAE,aAAa;IAC1B,6FAA6F;IAC7F,iBAAiB,EAAE,mBAAmB;IACtC,gDAAgD;IAChD,WAAW,EAAE,aAAa;IAC1B,SAAS,EAAE,WAAW;IACtB,iBAAiB,EAAE,mBAAmB;IACtC,YAAY,EAAE,cAAc;IAC5B,4FAA4F;IAC5F,oBAAoB,EAAE,sBAAsB;IAC5C,yFAAyF;IACzF,cAAc,EAAE,gBAAgB;IAChC,eAAe,EAAE,iBAAiB;IAClC,oBAAoB,EAAE,sBAAsB;IAC5C,eAAe,EAAE,iBAAiB;IAClC,aAAa,EAAE,eAAe;IAC9B,SAAS,EAAE,WAAW;IACtB,QAAQ,EAAE,UAAU;CACZ,CAAC"}
+{"version":3,"file":"error.js","sourceRoot":"","sources":["../../src/client/error.ts"],"names":[],"mappings":";;;AAoBA,MAAa,aAAc,SAAQ,KAAK;IACpB,IAAI,GAAG,eAAe,CAAC;IACzC,0CAA0C;IACjC,MAAM,CAAS;IACxB,8CAA8C;IACrC,MAAM,CAAmB;IAElC,YAAY,MAAc,EAAE,MAAwB,EAAE,OAAgB;QACpE,KAAK,CAAC,OAAO,IAAI,MAAM,CAAC,CAAC,CAAC,EAAE,OAAO,IAAI,wCAAwC,MAAM,EAAE,CAAC,CAAC;QACzF,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QACrB,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QACrB,uEAAuE;QACvE,sEAAsE;QACtE,MAAM,CAAC,cAAc,CAAC,IAAI,EAAE,aAAa,CAAC,SAAS,CAAC,CAAC;IACvD,CAAC;IAED,uEAAuE;IACvE,IAAI,IAAI;QACN,OAAO,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC;IAC9B,CAAC;IAED,yEAAyE;IACzE,OAAO,CAAC,IAAY;QAClB,OAAO,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC;IAClD,CAAC;CACF;AAzBD,sCAyBC;AAED;;;;GAIG;AACU,QAAA,eAAe,GAAG;IAC7B,+EAA+E;IAC/E,6BAA6B,EAAE,+BAA+B;IAC9D,mEAAmE;IACnE,uBAAuB,EAAE,yBAAyB;IAClD,oGAAoG;IACpG,qBAAqB,EAAE,uBAAuB;IAC9C,oGAAoG;IACpG,qBAAqB,EAAE,uBAAuB;IAC9C,wGAAwG;IACxG,cAAc,EAAE,gBAAgB;IAChC,0FAA0F;IAC1F,aAAa,EAAE,eAAe;IAC9B,oEAAoE;IACpE,WAAW,EAAE,aAAa;IAC1B,6FAA6F;IAC7F,iBAAiB,EAAE,mBAAmB;IACtC,gDAAgD;IAChD,WAAW,EAAE,aAAa;IAC1B,SAAS,EAAE,WAAW;IACtB,iBAAiB,EAAE,mBAAmB;IACtC,YAAY,EAAE,cAAc;IAC5B,4FAA4F;IAC5F,oBAAoB,EAAE,sBAAsB;IAC5C,yFAAyF;IACzF,cAAc,EAAE,gBAAgB;IAChC,eAAe,EAAE,iBAAiB;IAClC,oBAAoB,EAAE,sBAAsB;IAC5C,eAAe,EAAE,iBAAiB;IAClC,aAAa,EAAE,eAAe;IAC9B,SAAS,EAAE,WAAW;IACtB,QAAQ,EAAE,UAAU;CACZ,CAAC"}

package/dist/client/index.d.ts

@@ -35,10 +35,13 @@ declare function buildNamespaces(request: RequestFn): {
             deleted: true;
         }>;
         listSessions(id: string): Promise<import("./types").ListPage<import("./users").UserSession>>;
-        revokeSessions(id: string): Promise<{
+        revokeSessions(id: string, options?: {
+            revoke_grants?: boolean;
+        }): Promise<{
             object: "user";
             id: string;
             sessions_revoked: number;
+            grants_revoked?: number;
         }>;
         addEmail(id: string, body: {
             email_address: string;
@@ -345,6 +348,8 @@ declare function buildNamespaces(request: RequestFn): {
             deleted: true;
             note: string;
         }>;
+        listBackchannelDeliveries(id: string, query?: import("./oauth-clients").BackchannelDeliveriesQuery): Promise<import("./oauth-clients").BackchannelLogoutDeliveryPage>;
+        testBackchannelLogout(id: string): Promise<import("./oauth-clients").BackchannelLogoutTest>;
         grants: {
             list(clientId: string): Promise<import("./types").ListPage<import("./oauth-clients").ClientGrant>>;
             create(clientId: string, body: {
@@ -396,6 +401,7 @@ declare function buildNamespaces(request: RequestFn): {
         create(body: {
             host: string;
             role?: "fapi" | "accounts";
+            dns?: import("./domains").CustomDomainDnsInput;
         }, idempotencyKey?: string): Promise<import("./domains").CustomDomain & {
             instructions: Record<string, unknown>;
         }>;
@@ -835,6 +841,14 @@ declare function buildNamespaces(request: RequestFn): {
         deleteChannel(channel: "email" | "sms", options?: {
             force?: boolean;
         }): Promise<import("./messaging").DeletedMessagingProvider>;
+        managedEmail: {
+            get(): Promise<import("./messaging").ManagedEmail>;
+            create(body: import("./messaging").CreateManagedEmailBody): Promise<import("./messaging").ManagedEmail>;
+            verify(): Promise<import("./messaging").ManagedEmail>;
+            delete(options?: {
+                force?: boolean;
+            }): Promise<import("./messaging").DeletedManagedEmail>;
+        };
         test(channel: "email" | "sms", body: {
             to: string;
         }): Promise<import("./messaging").MessagingTestResult>;
@@ -882,6 +896,20 @@ declare function buildNamespaces(request: RequestFn): {
         get(): Promise<import("./instance").Instance>;
         update(body: import("./instance").UpdateInstanceBody): Promise<import("./instance").InstanceUpdateResult>;
         preflight(): Promise<import("./instance").PreflightReport>;
+        moveOrigin(body: import("./instance").OriginMoveRequest): Promise<import("./instance").OriginMove>;
+        connections(): Promise<import("./instance").InstanceConnections>;
+        integrations: {
+            chatly: {
+                get(): Promise<import("./instance").ChatlyIntegration>;
+                set(body: import("./instance").SetChatlyIntegrationBody): Promise<import("./instance").ChatlyIntegration>;
+                delete(): Promise<import("./instance").ChatlyIntegration>;
+            };
+            forumulate: {
+                get(): Promise<import("./instance").ForumulateIntegration>;
+                set(body: import("./instance").SetForumulateIntegrationBody): Promise<import("./instance").ForumulateIntegration>;
+                delete(): Promise<import("./instance").ForumulateIntegration>;
+            };
+        };
         cookieConsent: {
             get(): Promise<import("./instance").CookieConsent>;
             set(body: import("./instance").SetCookieConsentBody): Promise<import("./instance").CookieConsent>;
@@ -1200,6 +1228,20 @@ declare function buildNamespaces(request: RequestFn): {
         loginReadiness(params: import("./diagnostics").LoginReadinessParams): Promise<import("./diagnostics").LoginReadiness>;
         requestInspector(params: import("./diagnostics").RequestInspectorParams): Promise<import("./diagnostics").RequestInspection>;
     };
+    logoutNotifyEndpoints: {
+        list(): Promise<import("./logout-notify-endpoints").LogoutNotifyList<import("./logout-notify-endpoints").LogoutNotifyEndpoint>>;
+        create(body: import("./logout-notify-endpoints").CreateLogoutNotifyEndpointBody, idempotencyKey?: string): Promise<import("./logout-notify-endpoints").LogoutNotifyEndpoint>;
+        get(id: string): Promise<import("./logout-notify-endpoints").LogoutNotifyEndpoint>;
+        update(id: string, body: import("./logout-notify-endpoints").UpdateLogoutNotifyEndpointBody, idempotencyKey?: string): Promise<import("./logout-notify-endpoints").LogoutNotifyEndpoint>;
+        delete(id: string, idempotencyKey?: string): Promise<{
+            object: "logout_notify_endpoint";
+            id: string;
+            deleted: true;
+        }>;
+        listDeliveries(id: string, params?: {
+            limit?: number;
+        }): Promise<import("./logout-notify-endpoints").LogoutNotifyList<import("./logout-notify-endpoints").LogoutNotifyDelivery>>;
+    };
 };
 /** Every resource namespace of the management client. */
 export type AtlasClientNamespaces = ReturnType<typeof buildNamespaces>;
@@ -1282,4 +1324,5 @@ export * from './session-exchange-apps';
 export * from './tickets';
 export * from './test-mode';
 export * from './diagnostics';
+export * from './logout-notify-endpoints';
 export * from './platform';

package/dist/client/index.js

@@ -72,6 +72,7 @@ const connectors_1 = require("./connectors");
 const notifications_1 = require("./notifications");
 const audit_events_1 = require("./audit-events");
 const activity_1 = require("./activity");
+const logout_notify_endpoints_1 = require("./logout-notify-endpoints");
 const pca_1 = require("./pca");
 const mcp_1 = require("./mcp");
 const legacy_auth_1 = require("./legacy-auth");
@@ -175,6 +176,8 @@ function buildNamespaces(request) {
         // Development-instance helpers: the paired test instance, test users, testing tokens.
         testMode: (0, test_mode_1.testModeResource)(request),
         diagnostics: (0, diagnostics_1.diagnosticsResource)(request),
+        // Downstream services that get the same logout_token as your OIDC apps.
+        logoutNotifyEndpoints: (0, logout_notify_endpoints_1.logoutNotifyEndpointsResource)(request),
     };
 }
 var request_2 = require("./request");
@@ -253,5 +256,6 @@ __exportStar(require("./session-exchange-apps"), exports);
 __exportStar(require("./tickets"), exports);
 __exportStar(require("./test-mode"), exports);
 __exportStar(require("./diagnostics"), exports);
+__exportStar(require("./logout-notify-endpoints"), exports);
 __exportStar(require("./platform"), exports);
 //# sourceMappingURL=index.js.map

package/dist/client/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/client/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;AA2EA,8CAQC;AAnFD,uCAA6F;AAC7F,mCAAwC;AACxC,yCAA8C;AAC9C,mDAAwD;AACxD,mCAA6D;AAC7D,mDAAuD;AACvD,yDAA6D;AAC7D,uDAA2D;AAC3D,+CAAmD;AACnD,uCAA4C;AAC5C,yCAA8C;AAC9C,iDAAsE;AACtE,2DAA+D;AAC/D,iDAAqD;AACrD,+CAAoD;AACpD,yCAA8C;AAC9C,qDAAwD;AACxD,6CAAiD;AACjD,mDAAuD;AACvD,yCAA6C;AAC7C,yCAA8C;AAC9C,uDAA2D;AAC3D,qDAAyD;AACzD,2DAA+D;AAC/D,+BAAoC;AACpC,6CAAuD;AACvD,qDAAwD;AACxD,+CAAmD;AACnD,iDAAqD;AACrD,+CAAmD;AACnD,+CAAmD;AACnD,yCAA8C;AAC9C,uDAA2D;AAC3D,mDAAuD;AACvD,mDAAwD;AACxD,uCAA4C;AAC5C,mDAAkD;AAClD,2CAAgD;AAChD,mDAAuD;AACvD,mEAAsE;AACtE,qDAAyD;AACzD,mDAAuD;AACvD,yCAA8C;AAC9C,2DAA+D;AAC/D,qCAA0C;AAC1C,uCAA4C;AAC5C,qCAA0C;AAC1C,mEAAuE;AACvE,iEAAoE;AACpE,iFAAoF;AACpF,uDAA2D;AAC3D,uCAA4C;AAC5C,6CAAkD;AAClD,mDAAwD;AACxD,iDAAqD;AACrD,yCAAoF;AACpF,+BAAoC;AACpC,+BAA0D;AAC1D,+CAA6D;AAC7D,mDAAuD;AACvD,mEAAsE;AACtE,uCAA4C;AAC5C,2CAA+C;AAC/C,+CAAoD;AAGpD;;;;;;;;GAQG;AACH,SAAgB,iBAAiB,CAAC,MAAyB;IACzD,MAAM,OAAO,GAAG,IAAA,uBAAa,EAAC,MAAM,CAAC,CAAC;IACtC,OAAO;QACL,GAAG,eAAe,CAAC,OAAO,CAAC;QAC3B,WAAW,CAAC,SAA+B;YACzC,OAAO,iBAAiB,CAAC,EAAE,GAAG,MAAM,EAAE,GAAG,SAAS,EAAE,CAAC,CAAC;QACxD,CAAC;KACF,CAAC;AACJ,CAAC;AAED,SAAS,eAAe,CAAC,OAAkB;IACzC,OAAO;QACL,KAAK,EAAE,IAAA,qBAAa,EAAC,OAAO,CAAC;QAC7B,QAAQ,EAAE,IAAA,2BAAgB,EAAC,OAAO,CAAC;QACnC,aAAa,EAAE,IAAA,qCAAqB,EAAC,OAAO,CAAC;QAC7C,KAAK,EAAE,IAAA,qBAAa,EAAC,OAAO,CAAC;QAC7B,WAAW,EAAE,IAAA,2BAAmB,EAAC,OAAO,CAAC;QACzC,YAAY,EAAE,IAAA,oCAAoB,EAAC,OAAO,CAAC;QAC3C,eAAe,EAAE,IAAA,0CAAuB,EAAC,OAAO,CAAC;QACjD,cAAc,EAAE,IAAA,wCAAsB,EAAC,OAAO,CAAC;QAC/C,UAAU,EAAE,IAAA,gCAAkB,EAAC,OAAO,CAAC;QACvC,OAAO,EAAE,IAAA,yBAAe,EAAC,OAAO,CAAC;QACjC,QAAQ,EAAE,IAAA,2BAAgB,EAAC,OAAO,CAAC;QACnC,SAAS,EAAE,IAAA,gCAAiB,EAAC,OAAO,CAAC;QACrC,SAAS,EAAE,IAAA,gCAAiB,EAAC,OAAO,CAAC;QACrC,gBAAgB,EAAE,IAAA,4CAAwB,EAAC,OAAO,CAAC;QACnD,WAAW,EAAE,IAAA,kCAAmB,EAAC,OAAO,CAAC;QACzC,WAAW,EAAE,IAAA,iCAAmB,EAAC,OAAO,CAAC;QACzC,QAAQ,EAAE,IAAA,2BAAgB,EAAC,OAAO,CAAC;QACnC,YAAY,EAAE,IAAA,qCAAoB,EAAC,OAAO,CAAC;QAC3C,SAAS,EAAE,IAAA,8BAAiB,EAAC,OAAO,CAAC;QACrC,YAAY,EAAE,IAAA,oCAAoB,EAAC,OAAO,CAAC;QAC3C,OAAO,EAAE,IAAA,0BAAe,EAAC,OAAO,CAAC;QACjC,8EAA8E;QAC9E,QAAQ,EAAE,IAAA,2BAAgB,EAAC,OAAO,CAAC;QACnC,cAAc,EAAE,IAAA,wCAAsB,EAAC,OAAO,CAAC;QAC/C,aAAa,EAAE,IAAA,sCAAqB,EAAC,OAAO,CAAC;QAC7C,gBAAgB,EAAE,IAAA,4CAAwB,EAAC,OAAO,CAAC;QACnD,GAAG,EAAE,IAAA,iBAAW,EAAC,OAAO,CAAC;QACzB,eAAe,EAAE,IAAA,oCAAuB,EAAC,OAAO,CAAC;QACjD,YAAY,EAAE,IAAA,qCAAoB,EAAC,OAAO,CAAC;QAC3C,UAAU,EAAE,IAAA,gCAAkB,EAAC,OAAO,CAAC;QACvC,WAAW,EAAE,IAAA,kCAAmB,EAAC,OAAO,CAAC;QACzC,UAAU,EAAE,IAAA,gCAAkB,EAAC,OAAO,CAAC;QACvC,UAAU,EAAE,IAAA,gCAAkB,EAAC,OAAO,CAAC;QACvC,QAAQ,EAAE,IAAA,2BAAgB,EAAC,OAAO,CAAC;QACnC,cAAc,EAAE,IAAA,wCAAsB,EAAC,OAAO,CAAC;QAC/C,YAAY,EAAE,IAAA,oCAAoB,EAAC,OAAO,CAAC;QAC3C,aAAa,EAAE,IAAA,qCAAqB,EAAC,OAAO,CAAC;QAC7C,OAAO,EAAE,IAAA,yBAAe,EAAC,OAAO,CAAC;QACjC,OAAO,EAAE,IAAA,+BAAe,EAAC,OAAO,CAAC;QACjC,SAAS,EAAE,IAAA,6BAAiB,EAAC,OAAO,CAAC;QACrC,YAAY,EAAE,IAAA,oCAAoB,EAAC,OAAO,CAAC;QAC3C,mBAAmB,EAAE,IAAA,mDAA2B,EAAC,OAAO,CAAC;QACzD,aAAa,EAAE,IAAA,sCAAqB,EAAC,OAAO,CAAC;QAC7C,YAAY,EAAE,IAAA,oCAAoB,EAAC,OAAO,CAAC;QAC3C,QAAQ,EAAE,IAAA,2BAAgB,EAAC,OAAO,CAAC;QACnC,gBAAgB,EAAE,IAAA,4CAAwB,EAAC,OAAO,CAAC;QACnD,MAAM,EAAE,IAAA,uBAAc,EAAC,OAAO,CAAC;QAC/B,0EAA0E;QAC1E,6EAA6E;QAC7E,OAAO,EAAE,IAAA,yBAAe,EAAC,OAAO,CAAC;QACjC,+EAA+E;QAC/E,MAAM,EAAE,IAAA,uBAAc,EAAC,OAAO,CAAC;QAC/B,oBAAoB,EAAE,IAAA,oDAA4B,EAAC,OAAO,CAAC;QAC3D,kBAAkB,EAAE,IAAA,iDAA0B,EAAC,OAAO,CAAC;QACvD,0BAA0B,EAAE,IAAA,iEAAkC,EAAC,OAAO,CAAC;QACvE,cAAc,EAAE,IAAA,wCAAsB,EAAC,OAAO,CAAC;QAC/C,gDAAgD;QAChD,OAAO,EAAE,IAAA,yBAAe,EAAC,OAAO,CAAC;QACjC,UAAU,EAAE,IAAA,+BAAkB,EAAC,OAAO,CAAC;QACvC,aAAa,EAAE,IAAA,qCAAqB,EAAC,OAAO,CAAC;QAC7C,0EAA0E;QAC1E,WAAW,EAAE,IAAA,kCAAmB,EAAC,OAAO,CAAC;QACzC,MAAM,EAAE,IAAA,yBAAc,EAAC,OAAO,CAAC;QAC/B,KAAK,EAAE,IAAA,wBAAa,EAAC,OAAO,CAAC;QAC7B,eAAe,EAAE,IAAA,kCAAuB,EAAC,OAAO,CAAC;QACjD,GAAG,EAAE,IAAA,iBAAW,EAAC,OAAO,CAAC;QACzB,GAAG,EAAE,IAAA,iBAAW,EAAC,OAAO,CAAC;QACzB,YAAY,EAAE,IAAA,0BAAoB,EAAC,OAAO,CAAC;QAC3C,oBAAoB,EAAE,IAAA,0CAA4B,EAAC,OAAO,CAAC;QAC3D,YAAY,EAAE,IAAA,oCAAoB,EAAC,OAAO,CAAC;QAC3C,mBAAmB,EAAE,IAAA,mDAA2B,EAAC,OAAO,CAAC;QACzD,OAAO,EAAE,IAAA,yBAAe,EAAC,OAAO,CAAC;QACjC,sFAAsF;QACtF,QAAQ,EAAE,IAAA,4BAAgB,EAAC,OAAO,CAAC;QACnC,WAAW,EAAE,IAAA,iCAAmB,EAAC,OAAO,CAAC;KAC1C,CAAC;AACJ,CAAC;AAoBD,qCAA4C;AAAnC,0GAAA,eAAe,OAAA;AACxB,iCAA+D;AAAtD,wGAAA,eAAe,OAAA;AACxB,uCAAuD;AAA9C,qHAAA,yBAAyB,OAAA;AAElC,iCAA6D;AAApD,sGAAA,aAAa,OAAA;AACtB,uCAA+C;AAAtC,oGAAA,QAAQ,OAAA;AAAE,mGAAA,OAAO,OAAA;AAE1B,oEAAoE;AACpE,0CAAwB;AACxB,0CAAwB;AACxB,6CAA2B;AAC3B,kDAAgC;AAChC,0CAAwB;AACxB,kDAAgC;AAChC,qDAAmC;AACnC,oDAAkC;AAClC,gDAA8B;AAC9B,4CAA0B;AAC1B,6CAA2B;AAC3B,iDAA+B;AAC/B,sDAAoC;AACpC,iDAA+B;AAC/B,gDAA8B;AAC9B,6CAA2B;AAC3B,mDAAiC;AACjC,+CAA6B;AAC7B,kDAAgC;AAChC,6CAA2B;AAC3B,6CAA2B;AAC3B,oDAAkC;AAClC,mDAAiC;AACjC,sDAAoC;AACpC,wCAAsB;AACtB,+CAA6B;AAC7B,mDAAiC;AACjC,gDAA8B;AAC9B,iDAA+B;AAC/B,gDAA8B;AAC9B,gDAA8B;AAC9B,6CAA2B;AAC3B,oDAAkC;AAClC,kDAAgC;AAChC,kDAAgC;AAChC,4CAA0B;AAC1B,kDAAgC;AAChC,8CAA4B;AAC5B,kDAAgC;AAChC,0DAAwC;AACxC,mDAAiC;AACjC,kDAAgC;AAChC,6CAA2B;AAC3B,sDAAoC;AACpC,2CAAyB;AACzB,4CAA0B;AAC1B,2CAAyB;AACzB,0DAAwC;AACxC,yDAAuC;AACvC,iEAA+C;AAC/C,oDAAkC;AAClC,4CAA0B;AAC1B,+CAA6B;AAC7B,kDAAgC;AAChC,iDAA+B;AAC/B,6CAA2B;AAC3B,wCAAsB;AACtB,wCAAsB;AACtB,gDAA8B;AAC9B,kDAAgC;AAChC,0DAAwC;AACxC,4CAA0B;AAC1B,8CAA4B;AAC5B,gDAA8B;AAC9B,6CAA2B"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/client/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;AA4EA,8CAQC;AApFD,uCAA6F;AAC7F,mCAAwC;AACxC,yCAA8C;AAC9C,mDAAwD;AACxD,mCAA6D;AAC7D,mDAAuD;AACvD,yDAA6D;AAC7D,uDAA2D;AAC3D,+CAAmD;AACnD,uCAA4C;AAC5C,yCAA8C;AAC9C,iDAAsE;AACtE,2DAA+D;AAC/D,iDAAqD;AACrD,+CAAoD;AACpD,yCAA8C;AAC9C,qDAAwD;AACxD,6CAAiD;AACjD,mDAAuD;AACvD,yCAA6C;AAC7C,yCAA8C;AAC9C,uDAA2D;AAC3D,qDAAyD;AACzD,2DAA+D;AAC/D,+BAAoC;AACpC,6CAAuD;AACvD,qDAAwD;AACxD,+CAAmD;AACnD,iDAAqD;AACrD,+CAAmD;AACnD,+CAAmD;AACnD,yCAA8C;AAC9C,uDAA2D;AAC3D,mDAAuD;AACvD,mDAAwD;AACxD,uCAA4C;AAC5C,mDAAkD;AAClD,2CAAgD;AAChD,mDAAuD;AACvD,mEAAsE;AACtE,qDAAyD;AACzD,mDAAuD;AACvD,yCAA8C;AAC9C,2DAA+D;AAC/D,qCAA0C;AAC1C,uCAA4C;AAC5C,qCAA0C;AAC1C,mEAAuE;AACvE,iEAAoE;AACpE,iFAAoF;AACpF,uDAA2D;AAC3D,uCAA4C;AAC5C,6CAAkD;AAClD,mDAAwD;AACxD,iDAAqD;AACrD,yCAAoF;AACpF,uEAA0E;AAC1E,+BAAoC;AACpC,+BAA0D;AAC1D,+CAA6D;AAC7D,mDAAuD;AACvD,mEAAsE;AACtE,uCAA4C;AAC5C,2CAA+C;AAC/C,+CAAoD;AAGpD;;;;;;;;GAQG;AACH,SAAgB,iBAAiB,CAAC,MAAyB;IACzD,MAAM,OAAO,GAAG,IAAA,uBAAa,EAAC,MAAM,CAAC,CAAC;IACtC,OAAO;QACL,GAAG,eAAe,CAAC,OAAO,CAAC;QAC3B,WAAW,CAAC,SAA+B;YACzC,OAAO,iBAAiB,CAAC,EAAE,GAAG,MAAM,EAAE,GAAG,SAAS,EAAE,CAAC,CAAC;QACxD,CAAC;KACF,CAAC;AACJ,CAAC;AAED,SAAS,eAAe,CAAC,OAAkB;IACzC,OAAO;QACL,KAAK,EAAE,IAAA,qBAAa,EAAC,OAAO,CAAC;QAC7B,QAAQ,EAAE,IAAA,2BAAgB,EAAC,OAAO,CAAC;QACnC,aAAa,EAAE,IAAA,qCAAqB,EAAC,OAAO,CAAC;QAC7C,KAAK,EAAE,IAAA,qBAAa,EAAC,OAAO,CAAC;QAC7B,WAAW,EAAE,IAAA,2BAAmB,EAAC,OAAO,CAAC;QACzC,YAAY,EAAE,IAAA,oCAAoB,EAAC,OAAO,CAAC;QAC3C,eAAe,EAAE,IAAA,0CAAuB,EAAC,OAAO,CAAC;QACjD,cAAc,EAAE,IAAA,wCAAsB,EAAC,OAAO,CAAC;QAC/C,UAAU,EAAE,IAAA,gCAAkB,EAAC,OAAO,CAAC;QACvC,OAAO,EAAE,IAAA,yBAAe,EAAC,OAAO,CAAC;QACjC,QAAQ,EAAE,IAAA,2BAAgB,EAAC,OAAO,CAAC;QACnC,SAAS,EAAE,IAAA,gCAAiB,EAAC,OAAO,CAAC;QACrC,SAAS,EAAE,IAAA,gCAAiB,EAAC,OAAO,CAAC;QACrC,gBAAgB,EAAE,IAAA,4CAAwB,EAAC,OAAO,CAAC;QACnD,WAAW,EAAE,IAAA,kCAAmB,EAAC,OAAO,CAAC;QACzC,WAAW,EAAE,IAAA,iCAAmB,EAAC,OAAO,CAAC;QACzC,QAAQ,EAAE,IAAA,2BAAgB,EAAC,OAAO,CAAC;QACnC,YAAY,EAAE,IAAA,qCAAoB,EAAC,OAAO,CAAC;QAC3C,SAAS,EAAE,IAAA,8BAAiB,EAAC,OAAO,CAAC;QACrC,YAAY,EAAE,IAAA,oCAAoB,EAAC,OAAO,CAAC;QAC3C,OAAO,EAAE,IAAA,0BAAe,EAAC,OAAO,CAAC;QACjC,8EAA8E;QAC9E,QAAQ,EAAE,IAAA,2BAAgB,EAAC,OAAO,CAAC;QACnC,cAAc,EAAE,IAAA,wCAAsB,EAAC,OAAO,CAAC;QAC/C,aAAa,EAAE,IAAA,sCAAqB,EAAC,OAAO,CAAC;QAC7C,gBAAgB,EAAE,IAAA,4CAAwB,EAAC,OAAO,CAAC;QACnD,GAAG,EAAE,IAAA,iBAAW,EAAC,OAAO,CAAC;QACzB,eAAe,EAAE,IAAA,oCAAuB,EAAC,OAAO,CAAC;QACjD,YAAY,EAAE,IAAA,qCAAoB,EAAC,OAAO,CAAC;QAC3C,UAAU,EAAE,IAAA,gCAAkB,EAAC,OAAO,CAAC;QACvC,WAAW,EAAE,IAAA,kCAAmB,EAAC,OAAO,CAAC;QACzC,UAAU,EAAE,IAAA,gCAAkB,EAAC,OAAO,CAAC;QACvC,UAAU,EAAE,IAAA,gCAAkB,EAAC,OAAO,CAAC;QACvC,QAAQ,EAAE,IAAA,2BAAgB,EAAC,OAAO,CAAC;QACnC,cAAc,EAAE,IAAA,wCAAsB,EAAC,OAAO,CAAC;QAC/C,YAAY,EAAE,IAAA,oCAAoB,EAAC,OAAO,CAAC;QAC3C,aAAa,EAAE,IAAA,qCAAqB,EAAC,OAAO,CAAC;QAC7C,OAAO,EAAE,IAAA,yBAAe,EAAC,OAAO,CAAC;QACjC,OAAO,EAAE,IAAA,+BAAe,EAAC,OAAO,CAAC;QACjC,SAAS,EAAE,IAAA,6BAAiB,EAAC,OAAO,CAAC;QACrC,YAAY,EAAE,IAAA,oCAAoB,EAAC,OAAO,CAAC;QAC3C,mBAAmB,EAAE,IAAA,mDAA2B,EAAC,OAAO,CAAC;QACzD,aAAa,EAAE,IAAA,sCAAqB,EAAC,OAAO,CAAC;QAC7C,YAAY,EAAE,IAAA,oCAAoB,EAAC,OAAO,CAAC;QAC3C,QAAQ,EAAE,IAAA,2BAAgB,EAAC,OAAO,CAAC;QACnC,gBAAgB,EAAE,IAAA,4CAAwB,EAAC,OAAO,CAAC;QACnD,MAAM,EAAE,IAAA,uBAAc,EAAC,OAAO,CAAC;QAC/B,0EAA0E;QAC1E,6EAA6E;QAC7E,OAAO,EAAE,IAAA,yBAAe,EAAC,OAAO,CAAC;QACjC,+EAA+E;QAC/E,MAAM,EAAE,IAAA,uBAAc,EAAC,OAAO,CAAC;QAC/B,oBAAoB,EAAE,IAAA,oDAA4B,EAAC,OAAO,CAAC;QAC3D,kBAAkB,EAAE,IAAA,iDAA0B,EAAC,OAAO,CAAC;QACvD,0BAA0B,EAAE,IAAA,iEAAkC,EAAC,OAAO,CAAC;QACvE,cAAc,EAAE,IAAA,wCAAsB,EAAC,OAAO,CAAC;QAC/C,gDAAgD;QAChD,OAAO,EAAE,IAAA,yBAAe,EAAC,OAAO,CAAC;QACjC,UAAU,EAAE,IAAA,+BAAkB,EAAC,OAAO,CAAC;QACvC,aAAa,EAAE,IAAA,qCAAqB,EAAC,OAAO,CAAC;QAC7C,0EAA0E;QAC1E,WAAW,EAAE,IAAA,kCAAmB,EAAC,OAAO,CAAC;QACzC,MAAM,EAAE,IAAA,yBAAc,EAAC,OAAO,CAAC;QAC/B,KAAK,EAAE,IAAA,wBAAa,EAAC,OAAO,CAAC;QAC7B,eAAe,EAAE,IAAA,kCAAuB,EAAC,OAAO,CAAC;QACjD,GAAG,EAAE,IAAA,iBAAW,EAAC,OAAO,CAAC;QACzB,GAAG,EAAE,IAAA,iBAAW,EAAC,OAAO,CAAC;QACzB,YAAY,EAAE,IAAA,0BAAoB,EAAC,OAAO,CAAC;QAC3C,oBAAoB,EAAE,IAAA,0CAA4B,EAAC,OAAO,CAAC;QAC3D,YAAY,EAAE,IAAA,oCAAoB,EAAC,OAAO,CAAC;QAC3C,mBAAmB,EAAE,IAAA,mDAA2B,EAAC,OAAO,CAAC;QACzD,OAAO,EAAE,IAAA,yBAAe,EAAC,OAAO,CAAC;QACjC,sFAAsF;QACtF,QAAQ,EAAE,IAAA,4BAAgB,EAAC,OAAO,CAAC;QACnC,WAAW,EAAE,IAAA,iCAAmB,EAAC,OAAO,CAAC;QACzC,wEAAwE;QACxE,qBAAqB,EAAE,IAAA,uDAA6B,EAAC,OAAO,CAAC;KAC9D,CAAC;AACJ,CAAC;AAoBD,qCAA4C;AAAnC,0GAAA,eAAe,OAAA;AACxB,iCAA+D;AAAtD,wGAAA,eAAe,OAAA;AACxB,uCAAuD;AAA9C,qHAAA,yBAAyB,OAAA;AAElC,iCAA6D;AAApD,sGAAA,aAAa,OAAA;AACtB,uCAA+C;AAAtC,oGAAA,QAAQ,OAAA;AAAE,mGAAA,OAAO,OAAA;AAE1B,oEAAoE;AACpE,0CAAwB;AACxB,0CAAwB;AACxB,6CAA2B;AAC3B,kDAAgC;AAChC,0CAAwB;AACxB,kDAAgC;AAChC,qDAAmC;AACnC,oDAAkC;AAClC,gDAA8B;AAC9B,4CAA0B;AAC1B,6CAA2B;AAC3B,iDAA+B;AAC/B,sDAAoC;AACpC,iDAA+B;AAC/B,gDAA8B;AAC9B,6CAA2B;AAC3B,mDAAiC;AACjC,+CAA6B;AAC7B,kDAAgC;AAChC,6CAA2B;AAC3B,6CAA2B;AAC3B,oDAAkC;AAClC,mDAAiC;AACjC,sDAAoC;AACpC,wCAAsB;AACtB,+CAA6B;AAC7B,mDAAiC;AACjC,gDAA8B;AAC9B,iDAA+B;AAC/B,gDAA8B;AAC9B,gDAA8B;AAC9B,6CAA2B;AAC3B,oDAAkC;AAClC,kDAAgC;AAChC,kDAAgC;AAChC,4CAA0B;AAC1B,kDAAgC;AAChC,8CAA4B;AAC5B,kDAAgC;AAChC,0DAAwC;AACxC,mDAAiC;AACjC,kDAAgC;AAChC,6CAA2B;AAC3B,sDAAoC;AACpC,2CAAyB;AACzB,4CAA0B;AAC1B,2CAAyB;AACzB,0DAAwC;AACxC,yDAAuC;AACvC,iEAA+C;AAC/C,oDAAkC;AAClC,4CAA0B;AAC1B,+CAA6B;AAC7B,kDAAgC;AAChC,iDAA+B;AAC/B,6CAA2B;AAC3B,wCAAsB;AACtB,wCAAsB;AACtB,gDAA8B;AAC9B,kDAAgC;AAChC,0DAAwC;AACxC,4CAA0B;AAC1B,8CAA4B;AAC5B,gDAA8B;AAC9B,4DAA0C;AAC1C,6CAA2B"}

package/dist/client/instance.d.ts

@@ -40,6 +40,30 @@ export interface PreflightFinding {
     /** Ids of what the finding is about (provider, client_id, domain, …). */
     subject?: Record<string, string>;
 }
+/** An advisory published for an Atlas browser SDK version. */
+export interface SdkAdvisory {
+    object: 'sdk_advisory';
+    /** e.g. `@atlasauth/react`. */
+    package: string;
+    /** The affected range, e.g. `<0.8.1`. */
+    affected: string;
+    fixed_in: string;
+    /** Stable code, e.g. `email_code_sign_in`. */
+    reason: string;
+    severity: 'critical' | 'high' | 'medium' | 'low';
+    summary: string;
+    /** ISO date. */
+    published_at: string;
+}
+/** An Atlas browser SDK version that called this instance recently. */
+export interface SdkVersionSeen {
+    package: string;
+    version: string;
+    /** Epoch ms. */
+    last_seen_at: number;
+    /** The advisories that apply to this version. */
+    advisories: SdkAdvisory[];
+}
 export interface PreflightReport {
     object: 'preflight';
     /** True when there are no error-severity findings. */
@@ -48,6 +72,8 @@ export interface PreflightReport {
     checked_at: number;
     /** Ordered error, then warning, then info. */
     findings: PreflightFinding[];
+    /** Atlas browser SDK versions seen in the last 7 days (newest first), with their advisories. */
+    sdk_versions_seen?: SdkVersionSeen[];
 }
 /** A consent tool whose documented "reopen preferences" trigger Atlas fills in. */
 export type CookieSettingsLinkPreset = 'cookiemunch' | 'cookiebot' | 'onetrust' | 'custom';
@@ -71,6 +97,27 @@ export interface CookieSettingsLink {
     /** The attributes the rendered link carries: `attributes` plus the preset's trigger. */
     rendered_attributes: Record<string, string>;
 }
+/** One cookie or browser-storage key Atlas writes for the instance (all strictly necessary). */
+export interface DeclaredCookie {
+    /** The exact name, or null when `pattern` describes a family of keys. */
+    name: string | null;
+    /** A `*` wildcard for keys with an id suffix, e.g. `atlasid:*`. */
+    pattern: string | null;
+    store: 'cookie' | 'localStorage' | 'sessionStorage' | 'indexedDB';
+    /** A cookie's Domain (or the exact Frontend API host); for storage, "your app's origin". */
+    domain: string;
+    /** Seconds; null = browser session (cookie) or until cleared (storage). */
+    lifetime_seconds: number | null;
+    /** The lifetime in words, for a cookie policy table. */
+    lifetime: string;
+    http_only: boolean;
+    category: 'necessary';
+    purpose: string;
+    written_when: string;
+    set_by: 'atlas_frontend_api' | 'atlas_sdk';
+}
+/** `page` (default): the consent tag carries the page language; `browser`: no attribute. */
+export type CookieConsentCulture = 'page' | 'browser';
 /** The cookie-consent script injected into the hosted sign-in, sign-up and account pages. */
 export interface CookieConsent {
     object: 'cookie_consent';
@@ -83,6 +130,9 @@ export interface CookieConsent {
     extra_origins?: string[];
     /** The footer "Cookie settings" link, or null when none is set. */
     settings_link?: CookieSettingsLink | null;
+    culture?: CookieConsentCulture;
+    /** Every cookie and browser-storage key Atlas writes for this instance, for your cookie policy. */
+    declared_cookies?: DeclaredCookie[];
 }
 export interface SetCookieConsentBody {
     /** Your consent script URL. Must be https; its origin is added to the page CSP. */
@@ -97,12 +147,154 @@ export interface SetCookieConsentBody {
     extra_origins?: string[];
     /** A footer "Cookie settings" link that reopens the consent preferences; null or omitted for none. */
     settings_link?: CookieSettingsLinkInput | null;
+    /** `page` (default) tags the consent script with the page language; `browser` leaves it to the tool. */
+    culture?: CookieConsentCulture | null;
+}
+/** `POST /v1/instance/move_origin` (and the platform app twin). */
+export interface OriginMoveRequest {
+    /** The old origin, `scheme://host[:port]`. */
+    from: string;
+    /** The new origin: https, or http only for localhost. */
+    to: string;
+    /** `true` reports the diff and any problems and writes nothing. */
+    dry_run?: boolean;
+}
+export interface OriginMoveChange {
+    object: 'instance' | 'oauth_client' | 'atlas_id_app' | 'webhook_endpoint' | 'redirect_url';
+    id: string;
+    /** e.g. `allowed_origins`, `redirect_uris`, `homepage_url`, `branding.legal.privacyUrl`. */
+    field: string;
+    before: string | string[] | null;
+    after: string | string[] | null;
+}
+export interface OriginMoveProblem {
+    object?: string;
+    id?: string;
+    field?: string;
+    url?: string;
+    message?: string;
+}
+/** The before → after diff of an origin move. A repeated run returns no changes. */
+export interface OriginMove {
+    object: 'origin_move';
+    from: string;
+    to: string;
+    dry_run: boolean;
+    /** True when this run wrote changes. */
+    applied: boolean;
+    changes: OriginMoveChange[];
+    /** Values the field would refuse; a real run with problems is a 422 and writes nothing. */
+    problems: OriginMoveProblem[];
+    /** Platform app twin only: the app after the move. */
+    app?: Record<string, unknown>;
+}
+/** One link from this instance to another platform, and its health. */
+export interface InstanceConnection {
+    object: 'connection';
+    kind: 'privacy_webhook' | 'cmp' | 'atlas_id_app' | 'jwt_template';
+    /** What was checked, e.g. `privacy_webhook_delivery`, `cmp_site`. */
+    check: string;
+    ok: boolean;
+    severity: 'error' | 'warning' | 'info';
+    subject: Record<string, string>;
+    /** What to do when `ok` is false. */
+    fix_hint: string | null;
+    /** Epoch ms. */
+    last_checked_at: number;
+    /** Kind-specific facts. */
+    details: Record<string, unknown>;
+}
+export interface InstanceConnections {
+    object: 'instance_connections';
+    /** False when any warning- or error-severity row is not ok. */
+    ok: boolean;
+    checked_at: number;
+    data: InstanceConnection[];
+}
+/** The Chatly connection (`enabled: false` and nothing else when none is set). */
+export interface ChatlyIntegration {
+    object: 'chatly_integration';
+    enabled: boolean;
+    channel?: string;
+    /** The template name to pass to `getToken({ template: 'chatly' })`. */
+    template?: 'chatly';
+    /** `chatly:<channel>`. */
+    audience?: string;
+    issuer?: string;
+    jwks_url?: string;
+    token_ttl_seconds?: number;
+    identity_verification?: {
+        mode?: 'oidc';
+        issuer?: string;
+        jwks_url?: string;
+        audience?: string;
+    };
+}
+export interface SetChatlyIntegrationBody {
+    /** The chat channel public id (letters, digits, `_` and `-`). */
+    channel: string;
+}
+/** The Forumulate connection (`enabled: false` and nothing else when none is set). */
+export interface ForumulateIntegration {
+    object: 'forumulate_integration';
+    enabled: boolean;
+    org_id?: string;
+    spaces?: Array<{
+        id: string;
+        redeem_url: string;
+    }>;
+    audience?: string;
+    issuer?: string;
+    jwks_url?: string;
+    token_ttl_seconds?: number;
+    /** The external_jwt provider to store on each space. */
+    reader_auth_provider?: {
+        method?: 'external_jwt';
+        order?: number;
+        config?: {
+            jwksUrl?: string;
+            issuer?: string;
+            clientId?: string;
+        };
+    };
+}
+export interface SetForumulateIntegrationBody {
+    org_id: string;
+    /** 1-50 space ids, or `{ id, redeem_url }`. */
+    spaces: Array<string | {
+        id: string;
+        redeem_url?: string | null;
+    }>;
+    /** The token `aud`. Default `forumulate:<org_id>`. */
+    audience?: string | null;
 }
 export declare function instanceResource(request: RequestFn): {
     get(): Promise<Instance>;
     update(body: UpdateInstanceBody): Promise<InstanceUpdateResult>;
     /** Check your setup in one call: configuration the server can see is broken or risky. */
     preflight(): Promise<PreflightReport>;
+    /**
+     * Move every URL that points at one origin to another (a domain move), across
+     * the instance, its OAuth clients, webhooks, redirect URLs and Sign in with
+     * Atlas apps. `dry_run: true` writes nothing.
+     */
+    moveOrigin(body: OriginMoveRequest): Promise<OriginMove>;
+    /** The instance's links to other platforms and their health. Read-only. */
+    connections(): Promise<InstanceConnections>;
+    /** Built-in connections to other platforms. */
+    integrations: {
+        chatly: {
+            get(): Promise<ChatlyIntegration>;
+            set(body: SetChatlyIntegrationBody): Promise<ChatlyIntegration>;
+            delete(): Promise<ChatlyIntegration>;
+        };
+        forumulate: {
+            get(): Promise<ForumulateIntegration>;
+            /** Replaces the whole connection. */
+            set(body: SetForumulateIntegrationBody): Promise<ForumulateIntegration>;
+            delete(): Promise<ForumulateIntegration>;
+        };
+    };
     /** The cookie-consent script on the hosted pages (any provider). */
     cookieConsent: {
         get(): Promise<CookieConsent>;