@atlasauth/backend 0.7.2 → 0.8.0

package/dist/client/instance.js

@@ -13,6 +13,44 @@ function instanceResource(request) {
         preflight() {
             return request({ method: 'GET', path: '/v1/instance/preflight' });
         },
+        /**
+         * Move every URL that points at one origin to another (a domain move), across
+         * the instance, its OAuth clients, webhooks, redirect URLs and Sign in with
+         * Atlas apps. `dry_run: true` writes nothing.
+         */
+        moveOrigin(body) {
+            return request({ method: 'POST', path: '/v1/instance/move_origin', body });
+        },
+        /** The instance's links to other platforms and their health. Read-only. */
+        connections() {
+            return request({ method: 'GET', path: '/v1/instance/connections' });
+        },
+        /** Built-in connections to other platforms. */
+        integrations: {
+            chatly: {
+                get() {
+                    return request({ method: 'GET', path: '/v1/instance/integrations/chatly' });
+                },
+                set(body) {
+                    return request({ method: 'PUT', path: '/v1/instance/integrations/chatly', body });
+                },
+                delete() {
+                    return request({ method: 'DELETE', path: '/v1/instance/integrations/chatly' });
+                },
+            },
+            forumulate: {
+                get() {
+                    return request({ method: 'GET', path: '/v1/instance/integrations/forumulate' });
+                },
+                /** Replaces the whole connection. */
+                set(body) {
+                    return request({ method: 'PUT', path: '/v1/instance/integrations/forumulate', body });
+                },
+                delete() {
+                    return request({ method: 'DELETE', path: '/v1/instance/integrations/forumulate' });
+                },
+            },
+        },
         /** The cookie-consent script on the hosted pages (any provider). */
         cookieConsent: {
             get() {

package/dist/client/instance.js.map

@@ -1 +1 @@
-{"version":3,"file":"instance.js","sourceRoot":"","sources":["../../src/client/instance.ts"],"names":[],"mappings":";;AAgHA,4CA2BC;AA3BD,SAAgB,gBAAgB,CAAC,OAAkB;IACjD,OAAO;QACL,GAAG;YACD,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC;QAC1D,CAAC;QACD,MAAM,CAAC,IAAwB;YAC7B,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,cAAc,EAAE,IAAI,EAAE,CAAC,CAAC;QAClE,CAAC;QACD,yFAAyF;QACzF,SAAS;YACP,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,wBAAwB,EAAE,CAAC,CAAC;QACpE,CAAC;QACD,oEAAoE;QACpE,aAAa,EAAE;YACb,GAAG;gBACD,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,6BAA6B,EAAE,CAAC,CAAC;YACzE,CAAC;YACD,kCAAkC;YAClC,GAAG,CAAC,IAA0B;gBAC5B,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,6BAA6B,EAAE,IAAI,EAAE,CAAC,CAAC;YAC/E,CAAC;YACD,+EAA+E;YAC/E,MAAM;gBACJ,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,6BAA6B,EAAE,CAAC,CAAC;YAC5E,CAAC;SACF;KACF,CAAC;AACJ,CAAC"}
+{"version":3,"file":"instance.js","sourceRoot":"","sources":["../../src/client/instance.ts"],"names":[],"mappings":";;AAyRA,4CAiEC;AAjED,SAAgB,gBAAgB,CAAC,OAAkB;IACjD,OAAO;QACL,GAAG;YACD,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC;QAC1D,CAAC;QACD,MAAM,CAAC,IAAwB;YAC7B,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,cAAc,EAAE,IAAI,EAAE,CAAC,CAAC;QAClE,CAAC;QACD,yFAAyF;QACzF,SAAS;YACP,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,wBAAwB,EAAE,CAAC,CAAC;QACpE,CAAC;QACD;;;;WAIG;QACH,UAAU,CAAC,IAAuB;YAChC,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,0BAA0B,EAAE,IAAI,EAAE,CAAC,CAAC;QAC7E,CAAC;QACD,2EAA2E;QAC3E,WAAW;YACT,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,0BAA0B,EAAE,CAAC,CAAC;QACtE,CAAC;QACD,+CAA+C;QAC/C,YAAY,EAAE;YACZ,MAAM,EAAE;gBACN,GAAG;oBACD,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,kCAAkC,EAAE,CAAC,CAAC;gBAC9E,CAAC;gBACD,GAAG,CAAC,IAA8B;oBAChC,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,kCAAkC,EAAE,IAAI,EAAE,CAAC,CAAC;gBACpF,CAAC;gBACD,MAAM;oBACJ,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,kCAAkC,EAAE,CAAC,CAAC;gBACjF,CAAC;aACF;YACD,UAAU,EAAE;gBACV,GAAG;oBACD,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,sCAAsC,EAAE,CAAC,CAAC;gBAClF,CAAC;gBACD,qCAAqC;gBACrC,GAAG,CAAC,IAAkC;oBACpC,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,sCAAsC,EAAE,IAAI,EAAE,CAAC,CAAC;gBACxF,CAAC;gBACD,MAAM;oBACJ,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,sCAAsC,EAAE,CAAC,CAAC;gBACrF,CAAC;aACF;SACF;QACD,oEAAoE;QACpE,aAAa,EAAE;YACb,GAAG;gBACD,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,6BAA6B,EAAE,CAAC,CAAC;YACzE,CAAC;YACD,kCAAkC;YAClC,GAAG,CAAC,IAA0B;gBAC5B,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,6BAA6B,EAAE,IAAI,EAAE,CAAC,CAAC;YAC/E,CAAC;YACD,+EAA+E;YAC/E,MAAM;gBACJ,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,6BAA6B,EAAE,CAAC,CAAC;YAC5E,CAAC;SACF;KACF,CAAC;AACJ,CAAC"}

package/dist/client/logout-notify-endpoints.d.ts

@@ -0,0 +1,71 @@
+import { type RequestFn } from './request';
+/**
+ * Logout fan-out ("also notify") endpoints: downstream services that receive the
+ * same signed `logout_token` as your OIDC apps whenever an Atlas session ends,
+ * plus a subject-wide one (sub, no sid) on ban, deletion or deprovisioning.
+ */
+export interface LogoutNotifyEndpoint {
+    object: 'logout_notify_endpoint';
+    id: string;
+    url: string;
+    /** The client_id this endpoint follows; null = instance-wide. */
+    oauth_client_id: string | null;
+    /** The `aud` its logout_tokens carry. */
+    audience: string;
+    description?: string | null;
+    created_at: number;
+    updated_at: number;
+}
+export interface CreateLogoutNotifyEndpointBody {
+    /** Public https endpoint. */
+    url: string;
+    /** A client_id of this instance to follow; omit for instance-wide. */
+    oauth_client_id?: string | null;
+    /** The logout_token `aud`. Default: the client_id when following a client, else the instance id. */
+    audience?: string | null;
+    /** Up to 200 characters. */
+    description?: string | null;
+}
+export interface UpdateLogoutNotifyEndpointBody {
+    url?: string;
+    audience?: string | null;
+    description?: string | null;
+}
+/** One logout_token sent to a fan-out endpoint. */
+export interface LogoutNotifyDelivery {
+    object: 'logout_notify_delivery';
+    id: string;
+    sub: string;
+    /** null = a subject-wide logout (ban / deletion). */
+    sid?: string | null;
+    status: 'pending' | 'success' | 'failed';
+    attempt_number: number;
+    http_status?: number | null;
+    response_snippet?: string | null;
+    next_retry_at?: number | null;
+    delivered_at?: number | null;
+    created_at: number;
+}
+export interface LogoutNotifyList<T> {
+    object: 'list';
+    data: T[];
+    has_more?: boolean;
+    next_cursor?: string | null;
+}
+export declare function logoutNotifyEndpointsResource(request: RequestFn): {
+    list(): Promise<LogoutNotifyList<LogoutNotifyEndpoint>>;
+    /** Register an endpoint. The URL must be public https. */
+    create(body: CreateLogoutNotifyEndpointBody, idempotencyKey?: string): Promise<LogoutNotifyEndpoint>;
+    get(id: string): Promise<LogoutNotifyEndpoint>;
+    update(id: string, body: UpdateLogoutNotifyEndpointBody, idempotencyKey?: string): Promise<LogoutNotifyEndpoint>;
+    /** Its queued deliveries go with it. */
+    delete(id: string, idempotencyKey?: string): Promise<{
+        object: "logout_notify_endpoint";
+        id: string;
+        deleted: true;
+    }>;
+    /** The endpoint's delivery log, newest first. */
+    listDeliveries(id: string, params?: {
+        limit?: number;
+    }): Promise<LogoutNotifyList<LogoutNotifyDelivery>>;
+};

package/dist/client/logout-notify-endpoints.js

@@ -0,0 +1,34 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.logoutNotifyEndpointsResource = logoutNotifyEndpointsResource;
+const request_1 = require("./request");
+function logoutNotifyEndpointsResource(request) {
+    return {
+        list() {
+            return request({ method: 'GET', path: '/v1/logout_notify_endpoints' });
+        },
+        /** Register an endpoint. The URL must be public https. */
+        create(body, idempotencyKey) {
+            return request({ method: 'POST', path: '/v1/logout_notify_endpoints', body, idempotencyKey });
+        },
+        get(id) {
+            return request({ method: 'GET', path: `/v1/logout_notify_endpoints/${(0, request_1.enc)(id)}` });
+        },
+        update(id, body, idempotencyKey) {
+            return request({ method: 'PATCH', path: `/v1/logout_notify_endpoints/${(0, request_1.enc)(id)}`, body, idempotencyKey });
+        },
+        /** Its queued deliveries go with it. */
+        delete(id, idempotencyKey) {
+            return request({ method: 'DELETE', path: `/v1/logout_notify_endpoints/${(0, request_1.enc)(id)}`, idempotencyKey });
+        },
+        /** The endpoint's delivery log, newest first. */
+        listDeliveries(id, params = {}) {
+            return request({
+                method: 'GET',
+                path: `/v1/logout_notify_endpoints/${(0, request_1.enc)(id)}/deliveries`,
+                query: { ...params },
+            });
+        },
+    };
+}
+//# sourceMappingURL=logout-notify-endpoints.js.map

package/dist/client/logout-notify-endpoints.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"logout-notify-endpoints.js","sourceRoot":"","sources":["../../src/client/logout-notify-endpoints.ts"],"names":[],"mappings":";;AA4DA,sEA+BC;AA3FD,uCAAgD;AA4DhD,SAAgB,6BAA6B,CAAC,OAAkB;IAC9D,OAAO;QACL,IAAI;YACF,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,6BAA6B,EAAE,CAAC,CAAC;QACzE,CAAC;QACD,0DAA0D;QAC1D,MAAM,CAAC,IAAoC,EAAE,cAAuB;YAClE,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,6BAA6B,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC;QAChG,CAAC;QACD,GAAG,CAAC,EAAU;YACZ,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,+BAA+B,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;QACpF,CAAC;QACD,MAAM,CAAC,EAAU,EAAE,IAAoC,EAAE,cAAuB;YAC9E,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,+BAA+B,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC;QAC5G,CAAC;QACD,wCAAwC;QACxC,MAAM,CACJ,EAAU,EACV,cAAuB;YAEvB,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,+BAA+B,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,cAAc,EAAE,CAAC,CAAC;QACvG,CAAC;QACD,iDAAiD;QACjD,cAAc,CAAC,EAAU,EAAE,SAA6B,EAAE;YACxD,OAAO,OAAO,CAAC;gBACb,MAAM,EAAE,KAAK;gBACb,IAAI,EAAE,+BAA+B,IAAA,aAAG,EAAC,EAAE,CAAC,aAAa;gBACzD,KAAK,EAAE,EAAE,GAAG,MAAM,EAAE;aACrB,CAAC,CAAC;QACL,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/client/messaging.d.ts

@@ -272,6 +272,80 @@ export interface MessagingProviders {
     object: 'messaging_providers';
     email: EmailProvider | null;
     sms: SmsProvider | null;
+    /** The Atlas-managed sending domain, when one is set up (summary). */
+    managed_email?: {
+        object: 'managed_email';
+        from_address: string;
+        domain: string;
+        status: string;
+        verified: boolean;
+    } | null;
+}
+/** A DNS record to publish for the managed sending domain. */
+export interface ManagedEmailRecord {
+    purpose: 'dkim' | 'spf' | 'return_path' | 'other';
+    type: 'TXT' | 'MX' | 'CNAME';
+    /** Fully-qualified record name. */
+    name: string;
+    value: string;
+    priority?: number;
+    status?: string;
+}
+/** Atlas-managed email: your own sending domain on Atlas's email account. */
+export interface ManagedEmail {
+    object: 'managed_email';
+    id: string;
+    from_address: string;
+    domain: string;
+    provider: string;
+    region: string | null;
+    /** `not_started` | `pending` | `verified` | `failed` | `temporary_failure`. Email sends only when verified. */
+    status: string;
+    verified: boolean;
+    records: ManagedEmailRecord[];
+    limits: {
+        hourly: number;
+        daily: number;
+    };
+    usage: {
+        sent: number;
+        bounces: number;
+        complaints: number;
+        last_bounce_at: number | null;
+        last_complaint_at: number | null;
+    };
+    reputation: 'shared_platform_account';
+    /** DNS automation, when set. The token is never returned. */
+    dns: {
+        provider: string;
+        token_set: boolean;
+    } | null;
+    failure_reason: string | null;
+    last_checked_at: number | null;
+    verified_at: number | null;
+    created_at: number;
+    updated_at: number;
+    /** Create only, with `dns`: the zone and the records Atlas wrote. */
+    dns_result?: Record<string, unknown>;
+    next_step?: string;
+}
+export interface CreateManagedEmailBody {
+    /** The From address, bare or `"Name <address>"`. Its domain becomes the sending domain. */
+    from_address: string;
+    region?: 'us-east-1' | 'eu-west-1' | 'sa-east-1' | 'ap-northeast-1';
+    /** Let Atlas write the DNS records. The token is write-only. */
+    dns?: {
+        provider: 'cloudflare';
+        /** A DNS API token with Zone Read and DNS Edit on the zone. Write-only. */
+        api_token: string;
+        /** Replace a conflicting existing record. */
+        overwrite?: boolean;
+    };
+}
+export interface DeletedManagedEmail {
+    object: 'managed_email';
+    domain: string;
+    deleted: true;
 }
 export interface MessagingTestResult {
     object: 'messaging_test';
@@ -323,6 +397,23 @@ export declare function messagingResource(request: RequestFn): {
     deleteChannel(channel: "email" | "sms", options?: {
         force?: boolean;
     }): Promise<DeletedMessagingProvider>;
+    /** Atlas-managed email: send from your own domain without your own email provider. */
+    managedEmail: {
+        /** 404 when none is configured. */
+        get(): Promise<ManagedEmail>;
+        /** Register the sending domain; returns the DNS `records` to publish. */
+        create(body: CreateManagedEmailBody): Promise<ManagedEmail>;
+        /** Re-check the DNS records now; `verified` is true once email can be sent. */
+        verify(): Promise<ManagedEmail>;
+        /**
+         * Stop using managed email (DNS records are left in place). Refused with
+         * `409 EMAIL_PROVIDER_IN_USE` while it is the only way to send email; pass
+         * `{ force: true }` to remove it anyway.
+         */
+        delete(options?: {
+            force?: boolean;
+        }): Promise<DeletedManagedEmail>;
+    };
     /** Send a fixed, clearly-marked test message through the channel's provider. */
     test(channel: "email" | "sms", body: {
         to: string;

package/dist/client/messaging.js

@@ -40,6 +40,33 @@ function messagingResource(request) {
                 ...(options.force ? { query: { force: 'true' } } : {}),
             });
         },
+        /** Atlas-managed email: send from your own domain without your own email provider. */
+        managedEmail: {
+            /** 404 when none is configured. */
+            get() {
+                return request({ method: 'GET', path: '/v1/messaging_providers/email/managed' });
+            },
+            /** Register the sending domain; returns the DNS `records` to publish. */
+            create(body) {
+                return request({ method: 'POST', path: '/v1/messaging_providers/email/managed', body });
+            },
+            /** Re-check the DNS records now; `verified` is true once email can be sent. */
+            verify() {
+                return request({ method: 'POST', path: '/v1/messaging_providers/email/managed/verify' });
+            },
+            /**
+             * Stop using managed email (DNS records are left in place). Refused with
+             * `409 EMAIL_PROVIDER_IN_USE` while it is the only way to send email; pass
+             * `{ force: true }` to remove it anyway.
+             */
+            delete(options = {}) {
+                return request({
+                    method: 'DELETE',
+                    path: '/v1/messaging_providers/email/managed',
+                    ...(options.force ? { query: { force: 'true' } } : {}),
+                });
+            },
+        },
         /** Send a fixed, clearly-marked test message through the channel's provider. */
         test(channel, body) {
             return request({

package/dist/client/messaging.js.map

@@ -1 +1 @@
-{"version":3,"file":"messaging.js","sourceRoot":"","sources":["../../src/client/messaging.ts"],"names":[],"mappings":";;AAsVA,8CA0DC;AAhZD,uCAAgD;AAsVhD,SAAgB,iBAAiB,CAAC,OAAkB;IAIlD,SAAS,QAAQ,CAAC,IAAa;QAC7B,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,+BAA+B,EAAE,IAAI,EAAE,CAAC,CAAC;IACjF,CAAC;IAKD,SAAS,MAAM,CAAC,IAAa;QAC3B,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,6BAA6B,EAAE,IAAI,EAAE,CAAC,CAAC;IAC/E,CAAC;IAED,OAAO;QACL,0EAA0E;QAC1E,GAAG;YACD,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,yBAAyB,EAAE,CAAC,CAAC;QACrE,CAAC;QACD;;;;WAIG;QACH,QAAQ;QACR;;;;WAIG;QACH,MAAM;QACN;;;;;;WAMG;QACH,aAAa,CACX,OAAwB,EACxB,UAA+B,EAAE;YAEjC,OAAO,OAAO,CAAC;gBACb,MAAM,EAAE,QAAQ;gBAChB,IAAI,EAAE,2BAA2B,IAAA,aAAG,EAAC,OAAO,CAAC,EAAE;gBAC/C,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aACvD,CAAC,CAAC;QACL,CAAC;QACD,gFAAgF;QAChF,IAAI,CAAC,OAAwB,EAAE,IAAoB;YACjD,OAAO,OAAO,CAAC;gBACb,MAAM,EAAE,MAAM;gBACd,IAAI,EAAE,2BAA2B,IAAA,aAAG,EAAC,OAAO,CAAC,OAAO;gBACpD,IAAI;aACL,CAAC,CAAC;QACL,CAAC;KACF,CAAC;AACJ,CAAC"}
+{"version":3,"file":"messaging.js","sourceRoot":"","sources":["../../src/client/messaging.ts"],"names":[],"mappings":";;AAgaA,8CAqFC;AArfD,uCAAgD;AAgahD,SAAgB,iBAAiB,CAAC,OAAkB;IAIlD,SAAS,QAAQ,CAAC,IAAa;QAC7B,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,+BAA+B,EAAE,IAAI,EAAE,CAAC,CAAC;IACjF,CAAC;IAKD,SAAS,MAAM,CAAC,IAAa;QAC3B,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,6BAA6B,EAAE,IAAI,EAAE,CAAC,CAAC;IAC/E,CAAC;IAED,OAAO;QACL,0EAA0E;QAC1E,GAAG;YACD,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,yBAAyB,EAAE,CAAC,CAAC;QACrE,CAAC;QACD;;;;WAIG;QACH,QAAQ;QACR;;;;WAIG;QACH,MAAM;QACN;;;;;;WAMG;QACH,aAAa,CACX,OAAwB,EACxB,UAA+B,EAAE;YAEjC,OAAO,OAAO,CAAC;gBACb,MAAM,EAAE,QAAQ;gBAChB,IAAI,EAAE,2BAA2B,IAAA,aAAG,EAAC,OAAO,CAAC,EAAE;gBAC/C,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aACvD,CAAC,CAAC;QACL,CAAC;QACD,sFAAsF;QACtF,YAAY,EAAE;YACZ,mCAAmC;YACnC,GAAG;gBACD,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,uCAAuC,EAAE,CAAC,CAAC;YACnF,CAAC;YACD,yEAAyE;YACzE,MAAM,CAAC,IAA4B;gBACjC,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,uCAAuC,EAAE,IAAI,EAAE,CAAC,CAAC;YAC1F,CAAC;YACD,+EAA+E;YAC/E,MAAM;gBACJ,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,8CAA8C,EAAE,CAAC,CAAC;YAC3F,CAAC;YACD;;;;eAIG;YACH,MAAM,CAAC,UAA+B,EAAE;gBACtC,OAAO,OAAO,CAAC;oBACb,MAAM,EAAE,QAAQ;oBAChB,IAAI,EAAE,uCAAuC;oBAC7C,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;iBACvD,CAAC,CAAC;YACL,CAAC;SACF;QACD,gFAAgF;QAChF,IAAI,CAAC,OAAwB,EAAE,IAAoB;YACjD,OAAO,OAAO,CAAC;gBACb,MAAM,EAAE,MAAM;gBACd,IAAI,EAAE,2BAA2B,IAAA,aAAG,EAAC,OAAO,CAAC,OAAO;gBACpD,IAAI;aACL,CAAC,CAAC;QACL,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/client/oauth-clients.d.ts

@@ -96,6 +96,63 @@ export interface ImportOAuthClientEntry {
 export interface ImportedOAuthClient extends OAuthClient {
     client_secret?: string;
 }
+/**
+ * One back-channel logout attempt to a client's `backchannel_logout_uri`.
+ * Atlas never follows redirects: a 3xx fails with
+ * `error: 'backchannel_redirect_not_followed'` and the `location` it pointed at.
+ */
+export interface BackchannelLogoutDelivery {
+    object: 'backchannel_logout_delivery';
+    id: string;
+    oauth_client_id: string | null;
+    /** The ended session (`sid_test_…` for a test); null for "sign out everywhere". */
+    sid: string | null;
+    /** Sent by `testBackchannelLogout`; never retried. */
+    test: boolean;
+    status: 'pending' | 'success' | 'failed';
+    attempt_number: number;
+    max_attempts: number;
+    http_status: number | null;
+    latency_ms: number | null;
+    /**
+     * `backchannel_redirect_not_followed`, `backchannel_http_error`,
+     * `backchannel_timeout`, `backchannel_network_error` or `backchannel_url_blocked`.
+     */
+    error: string | null;
+    location: string | null;
+    response_snippet: string | null;
+    next_retry_at: number | null;
+    attempted_at: number | null;
+    delivered_at: number | null;
+    created_at: number;
+}
+/** A page of {@link BackchannelLogoutDelivery}, newest first. */
+export interface BackchannelLogoutDeliveryPage extends ListPage<BackchannelLogoutDelivery> {
+    has_more: boolean;
+    /** Pass as `starting_after` for the next page. */
+    next_cursor: string | null;
+}
+/** Paging for a delivery log. */
+export interface BackchannelDeliveriesQuery {
+    limit?: number;
+    starting_after?: string;
+}
+/** The result of a test back-channel logout (a signed token for `sid_test_…` with `atlas_test: true`). */
+export interface BackchannelLogoutTest {
+    object: 'backchannel_logout_test';
+    delivery_id: string;
+    /** True when the receiver answered 2xx. */
+    ok: boolean;
+    sid: string;
+    status: number | null;
+    latency_ms: number | null;
+    error: string | null;
+    location: string | null;
+    /** Set when nothing was sent because the URI points at a private, loopback or non-https address. */
+    blocked_reason: string | null;
+    /** First 512 characters of the response body. */
+    body_excerpt: string | null;
+}
 export declare function oauthClientsResource(request: RequestFn): {
     /** Bulk-import OAuth clients for a migration, optionally with pre-hashed secrets. */
     import(body: {
@@ -112,6 +169,10 @@ export declare function oauthClientsResource(request: RequestFn): {
         deleted: true;
         note: string;
     }>;
+    /** The client's back-channel logout delivery log, newest first. */
+    listBackchannelDeliveries(id: string, query?: BackchannelDeliveriesQuery): Promise<BackchannelLogoutDeliveryPage>;
+    /** Send a test back-channel logout now and return what the receiver answered. */
+    testBackchannelLogout(id: string): Promise<BackchannelLogoutTest>;
     grants: {
         list(clientId: string): Promise<ListPage<ClientGrant>>;
         create(clientId: string, body: {

package/dist/client/oauth-clients.js

@@ -26,6 +26,18 @@ function oauthClientsResource(request) {
         delete(id) {
             return request({ method: 'DELETE', path: `/v1/oauth_clients/${(0, request_1.enc)(id)}` });
         },
+        /** The client's back-channel logout delivery log, newest first. */
+        listBackchannelDeliveries(id, query = {}) {
+            return request({
+                method: 'GET',
+                path: `/v1/oauth_clients/${(0, request_1.enc)(id)}/backchannel_deliveries`,
+                query: { ...query },
+            });
+        },
+        /** Send a test back-channel logout now and return what the receiver answered. */
+        testBackchannelLogout(id) {
+            return request({ method: 'POST', path: `/v1/oauth_clients/${(0, request_1.enc)(id)}/backchannel_logout/test` });
+        },
         grants: {
             list(clientId) {
                 return request({ method: 'GET', path: `/v1/oauth_clients/${(0, request_1.enc)(clientId)}/grants` });

package/dist/client/oauth-clients.js.map

@@ -1 +1 @@
-{"version":3,"file":"oauth-clients.js","sourceRoot":"","sources":["../../src/client/oauth-clients.ts"],"names":[],"mappings":";;AA2GA,oDAqDC;AAhKD,uCAAgD;AA2GhD,SAAgB,oBAAoB,CAAC,OAAkB;IACrD,OAAO;QACL,qFAAqF;QACrF,MAAM,CACJ,IAA2C,EAC3C,cAAuB;YAEvB,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,0BAA0B,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC;QAC7F,CAAC;QACD,IAAI;YACF,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,mBAAmB,EAAE,CAAC,CAAC;QAC/D,CAAC;QACD,GAAG,CAAC,EAAU;YACZ,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,qBAAqB,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;QAC1E,CAAC;QACD,MAAM,CAAC,IAA2B,EAAE,cAAuB;YACzD,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,mBAAmB,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC;QACtF,CAAC;QACD,MAAM,CAAC,EAAU,EAAE,IAA2B;YAC5C,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,qBAAqB,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;QAClF,CAAC;QACD,YAAY,CAAC,EAAU;YACrB,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,qBAAqB,IAAA,aAAG,EAAC,EAAE,CAAC,gBAAgB,EAAE,CAAC,CAAC;QACzF,CAAC;QACD,MAAM,CAAC,EAAU;YACf,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,qBAAqB,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;QAC7E,CAAC;QAED,MAAM,EAAE;YACN,IAAI,CAAC,QAAgB;gBACnB,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,qBAAqB,IAAA,aAAG,EAAC,QAAQ,CAAC,SAAS,EAAE,CAAC,CAAC;YACvF,CAAC;YACD,MAAM,CACJ,QAAgB,EAChB,IAAuD;gBAEvD,OAAO,OAAO,CAAC;oBACb,MAAM,EAAE,MAAM;oBACd,IAAI,EAAE,qBAAqB,IAAA,aAAG,EAAC,QAAQ,CAAC,SAAS;oBACjD,IAAI;iBACL,CAAC,CAAC;YACL,CAAC;YACD,MAAM,CACJ,QAAgB,EAChB,OAAe;gBAEf,OAAO,OAAO,CAAC;oBACb,MAAM,EAAE,QAAQ;oBAChB,IAAI,EAAE,qBAAqB,IAAA,aAAG,EAAC,QAAQ,CAAC,WAAW,IAAA,aAAG,EAAC,OAAO,CAAC,EAAE;iBAClE,CAAC,CAAC;YACL,CAAC;SACF;KACF,CAAC;AACJ,CAAC"}
+{"version":3,"file":"oauth-clients.js","sourceRoot":"","sources":["../../src/client/oauth-clients.ts"],"names":[],"mappings":";;AAwKA,oDAoEC;AA5OD,uCAAgD;AAwKhD,SAAgB,oBAAoB,CAAC,OAAkB;IACrD,OAAO;QACL,qFAAqF;QACrF,MAAM,CACJ,IAA2C,EAC3C,cAAuB;YAEvB,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,0BAA0B,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC;QAC7F,CAAC;QACD,IAAI;YACF,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,mBAAmB,EAAE,CAAC,CAAC;QAC/D,CAAC;QACD,GAAG,CAAC,EAAU;YACZ,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,qBAAqB,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;QAC1E,CAAC;QACD,MAAM,CAAC,IAA2B,EAAE,cAAuB;YACzD,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,mBAAmB,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC;QACtF,CAAC;QACD,MAAM,CAAC,EAAU,EAAE,IAA2B;YAC5C,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,qBAAqB,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;QAClF,CAAC;QACD,YAAY,CAAC,EAAU;YACrB,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,qBAAqB,IAAA,aAAG,EAAC,EAAE,CAAC,gBAAgB,EAAE,CAAC,CAAC;QACzF,CAAC;QACD,MAAM,CAAC,EAAU;YACf,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,qBAAqB,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;QAC7E,CAAC;QACD,mEAAmE;QACnE,yBAAyB,CACvB,EAAU,EACV,QAAoC,EAAE;YAEtC,OAAO,OAAO,CAAC;gBACb,MAAM,EAAE,KAAK;gBACb,IAAI,EAAE,qBAAqB,IAAA,aAAG,EAAC,EAAE,CAAC,yBAAyB;gBAC3D,KAAK,EAAE,EAAE,GAAG,KAAK,EAAE;aACpB,CAAC,CAAC;QACL,CAAC;QACD,iFAAiF;QACjF,qBAAqB,CAAC,EAAU;YAC9B,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,qBAAqB,IAAA,aAAG,EAAC,EAAE,CAAC,0BAA0B,EAAE,CAAC,CAAC;QACnG,CAAC;QAED,MAAM,EAAE;YACN,IAAI,CAAC,QAAgB;gBACnB,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,qBAAqB,IAAA,aAAG,EAAC,QAAQ,CAAC,SAAS,EAAE,CAAC,CAAC;YACvF,CAAC;YACD,MAAM,CACJ,QAAgB,EAChB,IAAuD;gBAEvD,OAAO,OAAO,CAAC;oBACb,MAAM,EAAE,MAAM;oBACd,IAAI,EAAE,qBAAqB,IAAA,aAAG,EAAC,QAAQ,CAAC,SAAS;oBACjD,IAAI;iBACL,CAAC,CAAC;YACL,CAAC;YACD,MAAM,CACJ,QAAgB,EAChB,OAAe;gBAEf,OAAO,OAAO,CAAC;oBACb,MAAM,EAAE,QAAQ;oBAChB,IAAI,EAAE,qBAAqB,IAAA,aAAG,EAAC,QAAQ,CAAC,WAAW,IAAA,aAAG,EAAC,OAAO,CAAC,EAAE;iBAClE,CAAC,CAAC;YACL,CAAC;SACF;KACF,CAAC;AACJ,CAAC"}

package/dist/client/platform.d.ts

@@ -1,6 +1,19 @@
 import { type AtlasRequestSettings, type RequestFn, type UnknownFieldsEvent } from './request';
 import type { ListPage } from './types';
+import type { BackchannelDeliveriesQuery, BackchannelLogoutDeliveryPage, BackchannelLogoutTest } from './oauth-clients';
+import type { OriginMove, OriginMoveRequest, PreflightFinding } from './instance';
+import type { ConfigChangelogEntry, ListConfigChangelogParams } from './activity';
 import type { AtlasDesign, AtlasDesignPatch, DeletedDesignAsset, DesignAsset, DesignAssetData, DesignPreview, ResolvedAtlasDesign, UploadDesignAssetOptions } from './design';
+/** `GET /v1/platform/atlas_id_apps/{id}/preflight`. */
+export interface AtlasIdAppPreflight {
+    object: 'preflight';
+    app_id: string;
+    /** True when there are no error-severity findings. */
+    ok: boolean;
+    checked_at: number;
+    user_count: number;
+    findings: PreflightFinding[];
+}
 /**
  * The platform client: the platform-key (`psk_...`) surface for provisioning and
  * managing apps you own, and for registering Sign in with Atlas apps.
@@ -201,12 +214,66 @@ export interface AtlasIdApp {
     updated_at: number;
     /** On `get` only: people who have approved the app. */
     user_count?: number;
+    /** The per-app webhook URL, or null. */
+    webhook_url?: string | null;
+    webhook_events?: Array<'user.updated' | 'user.deleted' | 'grant.revoked'>;
+    /** false once auto-disabled after repeated failures; null without a webhook. */
+    webhook_active?: boolean | null;
 }
 /** Create / rotate response: confidential apps carry the client secret exactly once. */
 export interface AtlasIdAppWithSecret extends AtlasIdApp {
     client_secret?: string;
+    /** The per-app webhook signing secret, returned exactly once (first set, or rotated). */
+    webhook_secret?: string;
     note?: string;
 }
+/** A person who has approved a Sign in with Atlas app (privacy-request lookup). */
+export interface AtlasIdAppUser {
+    object: 'atlas_id_user';
+    atlas_id_user: true;
+    /** The user id as this app sees it (the id_token `sub`). */
+    sub: string;
+    grant_id: string;
+    scopes: string[];
+    granted_at: number;
+}
+/** A revoked grant: the app's refresh tokens for the user stop working. */
+export interface AtlasIdGrantRevocation {
+    object: 'atlas_id_grant';
+    id: string;
+    sub: string;
+    revoked: true;
+    tokens_revoked?: number;
+    backchannel_logouts?: number;
+}
+/** The account's Sign in with Atlas publisher (name + DNS-verified domain). */
+export interface AtlasIdPublisher {
+    object: 'atlas_id_publisher';
+    name: string;
+    domain: string;
+    verified: boolean;
+    verified_at?: number | null;
+    /** Publisher-wide consent for verified apps (openid / email / profile only). */
+    skip_consent: boolean;
+    /** The TXT record to publish. */
+    verification: {
+        record_name: string;
+        record_type: 'TXT';
+        record_value: string;
+    };
+    last_checked_at?: number | null;
+    created_at?: number;
+    updated_at?: number;
+    /** On `verify` only: whether the TXT record matched. */
+    record_found?: boolean;
+}
+export interface SetAtlasIdPublisherBody {
+    /** Shown on consent screens once verified (up to 100 characters). */
+    name: string;
+    /** The host your apps' homepage_url lives on, e.g. `example.com`. */
+    domain: string;
+    skip_consent?: boolean;
+}
 export interface AtlasIdAppList {
     object: 'list';
     data: AtlasIdApp[];
@@ -241,6 +308,11 @@ export interface CreateAtlasIdAppBody extends AtlasIdAppFields {
 export interface UpdateAtlasIdAppBody extends AtlasIdAppFields {
     name?: string;
     redirect_uris?: string[];
+    /**
+     * Per-app webhook (public https): user.updated, user.deleted and grant.revoked for
+     * this app's users. Setting it the first time returns `webhook_secret` once; null removes it.
+     */
+    webhook_url?: string | null;
 }
 declare function platformNamespaces(request: RequestFn): {
     apps: {
@@ -307,9 +379,55 @@ declare function platformNamespaces(request: RequestFn): {
         }>;
         /** New client secret, returned exactly once. Public apps have none (409). */
         rotateSecret(id: string): Promise<AtlasIdAppWithSecret>;
+        /** The app's back-channel logout delivery log, newest first. */
+        listBackchannelDeliveries(id: string, query?: BackchannelDeliveriesQuery): Promise<BackchannelLogoutDeliveryPage>;
+        /** Send a test back-channel logout to the app now and return what it answered. */
+        testBackchannelLogout(id: string): Promise<BackchannelLogoutTest>;
+        /** Check the app's setup (URIs, back-channel delivery, homepage host, legal links, secret age). */
+        preflight(id: string): Promise<AtlasIdAppPreflight>;
+        /**
+         * Privacy requests: is this person one of the app's users? Exact match on a
+         * verified email; anyone else gets the same empty list.
+         */
+        findUsers(id: string, email: string): Promise<{
+            object: "list";
+            data: AtlasIdAppUser[];
+        }>;
+        /** Revoke one user's grant (grant_id from `findUsers`); the next sign-in asks for consent again. */
+        revokeGrant(id: string, grantId: string): Promise<AtlasIdGrantRevocation>;
+        /** Move the app's URLs from one origin to another. `dry_run: true` writes nothing. */
+        moveOrigin(id: string, body: OriginMoveRequest): Promise<OriginMove>;
+        /** New per-app webhook signing secret (`webhook_secret`), returned once. 409 without a webhook. */
+        rotateWebhookSecret(id: string): Promise<AtlasIdAppWithSecret>;
         /** Preview a design on the Sign in with Atlas page without saving it. */
         previewDesign(design: AtlasDesign): Promise<DesignPreview>;
     };
+    /** The account's Sign in with Atlas publisher name and verified domain. */
+    atlasIdPublisher: {
+        /** 404 until claimed. */
+        get(): Promise<AtlasIdPublisher>;
+        /** Claim a publisher name and domain; returns the TXT record to publish. */
+        set(body: SetAtlasIdPublisherBody): Promise<AtlasIdPublisher>;
+        /** Turn publisher-wide consent on or off. */
+        update(body: {
+            skip_consent: boolean;
+        }): Promise<AtlasIdPublisher>;
+        delete(): Promise<{
+            object: "atlas_id_publisher";
+            deleted: true;
+        }>;
+        /** Look up the TXT record now (`record_found`). */
+        verify(): Promise<AtlasIdPublisher>;
+    };
+    /** Config change history for the account's Sign in with Atlas apps. */
+    configChangelog: {
+        list(params?: ListConfigChangelogParams): Promise<{
+            object: "config_changelog";
+            data: ConfigChangelogEntry[];
+            has_more?: boolean;
+            next_cursor?: string | null;
+        }>;
+    };
     /** Design images owned by the platform's account, for Sign in with Atlas app designs. */
     designAssets: {
         upload(data: DesignAssetData, options?: UploadDesignAssetOptions): Promise<DesignAsset>;