@atlasauth/backend 0.9.0 → 0.10.0

package/CHANGELOG.md

@@ -1,5 +1,22 @@
 # @atlasauth/backend changelog
 
+## 0.10.0
+- **Trusted reverse proxy secret.** `instanceSecurity.getProxySecret()` (`ProxySecret`: `set`, `created_at`, `previous_expires_at`, `secret_header`, `client_ip_header`), `instanceSecurity.createProxySecret({ overlap_seconds? })` (`ProxySecretCreated`: adds `secret`, shown once, and `rotated`; `CreateProxySecretBody`) and `instanceSecurity.deleteProxySecret()`. A proxy that serves the Frontend API from your own origin sends the secret in `X-Atlas-Proxy-Secret` and the browser's IP in `X-Atlas-Client-IP`; Atlas then uses that IP for rate limits, lockout, risk signals, geo, audit logs and session metadata.
+- **Managed email feedback on Resend.** `ManagedEmail.feedback_webhook` is now also returned for Resend (on create and verify): Atlas registers a bounce / complaint webhook on your own Resend account, so `usage.bounces` / `usage.complaints` count for Resend domains too.
+- **Webhook secret rotation with an overlap.** `webhooks.endpoints.rotateSecret(id, { overlap_seconds? })` (new type `RotateWebhookSecretBody`) can keep the previous signing secret signing every delivery for `overlap_seconds` (at most 604800, 7 days). The default is 0: the old secret stops at once, as before. Set an overlap only once every receiver verifies with a verifier that accepts several signatures. During the overlap the `atlas-signature` header carries two entries, `v1,<new> v1,<old>`; `verifyWebhook` (0.9.1 and later) passes with either secret. `WebhookSigningSecret` gains `overlap_seconds` and `previous_secret_expires_at` (epoch ms, or null when the old secret already stopped). `WebhookEndpoint` gains `previous_secret_expires_at` while an overlap is open.
+- **Sign in with Atlas apps.** `atlasIdApps.rotateSecret(id, { overlap_seconds? })` (default 24 hours, `0` = now) and `atlasIdApps.rotateWebhookSecret(id, { overlap_seconds? })` (default 0, as for instance webhooks); new type `RotateAtlasIdAppSecretBody`. `AtlasIdApp` gains `previous_secret_expires_at`, `secret_issued_at` (the real time the current client secret was issued) and `webhook_previous_secret_expires_at`; `AtlasIdAppWithSecret` gains `overlap_seconds`.
+- **Per-instance platform rotation with an overlap.** `apps.instances.rotateSecret(appId, instanceId, { overlap_seconds? }, idempotencyKey?)` keeps the prior keys valid like `apps.rotateSecret` (default 259200 = 72 hours, `0` = revoke now). The 0.9 call `rotateSecret(appId, instanceId, idempotencyKey)` still works. `PlatformInstanceSecretRotation` now types what the API returns: `app_id`, `instance_id`, `overlap_seconds`, `previous_keys_expire_at` (`id` is deprecated: it was never sent). New type `RotatePlatformSecretBody`, also used by `apps.rotateSecret`.
+- **Behaviour change on the server.** A per-instance platform rotation without `overlap_seconds` now keeps the prior keys for 72 hours (they used to be revoked at once). Pass `overlap_seconds: 0` for the old behaviour. Webhook rotations without it behave as before.
+- **Compatible.** New methods, optional parameters, fields and types only.
+
+## 0.9.1
+- **Allowed origins with an integration.** `UpdateInstanceBody.allowed_origins` and the platform app, instance and accountless-app bodies accept `AllowedOriginInput` entries: an origin string or `{ origin, integration }` (`OriginIntegration`: `redirect` | `embedded` | `auto`, or `null` to clear). `Instance`, `InstanceUpdateResult` and `PlatformApp` gain optional `allowed_origin_integrations`. New types: `AllowedOriginEntry`, `AllowedOriginInput`, `OriginIntegration`.
+- **Login readiness.** `LoginReadiness` gains `integration` (`LoginReadinessIntegration`: `assumed`, `source`, `reason`); `LoginReadinessCheck` gains `applies`.
+- **Branding audiences.** `Branding` accepts `audiences` (hint → `BrandingAudience` `{ heading, subheading, logoUrl, primaryColor }`, `null` deletes one); `ResolvedBranding` gains `audiences`. Start a hosted sign-in with `audienceHint` (or `audience_hint` on the URL) to use one.
+- **Error codes.** `AtlasErrorCodes` adds `READ_ONLY_FIELD`, `DEVELOPMENT_EMAIL_NOT_ALLOWED`, `DEVELOPMENT_EMAIL_UNAVAILABLE`, `DEVELOPMENT_EMAIL_LIMIT_REACHED` and `DEVELOPMENT_EMAIL_TEMPLATE_NOT_ALLOWED`.
+- **Webhooks, several signatures.** `verifyWebhook` accepts an `atlas-signature` header with several space-separated `v1,<signature>` entries and verifies when any one matches (each compared in constant time). This prepares for webhook secret rotation with an overlap. A header with a single signature works as before.
+- **Compatible.** New types, optional fields and error codes only; a single-signature webhook header verifies as before.
+
 ## 0.9.0
 - **OIDC relying party.** New `oidc` namespace and standalone functions for the hosted-redirect sign-in: `oidcStart` (`oidc.start`), `oidcCallback` (`oidc.callback`), `oidcLogoutUrl` (`oidc.logoutUrl`), `oidcVerifyIdToken` (`oidc.verifyIdToken`), `oidcClearCookie` (`oidc.clearCookie`). `start({ issuer, clientId, redirectUri, scope?, prompt?, loginHint?, audienceHint?, extraParams?, cookieName?, secret? })` returns `{ url, cookie, state, nonce }`: a PKCE (S256) authorize URL from discovery and a `Set-Cookie` for a 10-minute, httpOnly, `SameSite=Lax`, callback-path flow cookie, AES-GCM sealed when `secret` is set. `callback({ …, clientSecret?, clientAuth?: 'client_secret_basic' | 'client_secret_post' | 'none', query, cookie, secret?, clockToleranceSec? })` returns `OidcIdentity` (`sub`, `namespacedSub` = `${issuer}#${sub}`, `email`, `emailVerified`, `name`, `idToken`, `accessToken`, `refreshToken?`, `expiresAt` in epoch ms, `claims`, `clearCookie`). The ID token is verified with RS256 pinned, exact `iss`, `aud` containing the client id (and `azp` when present or when there are several audiences), `nonce`, `exp`/`iat` with tolerance, and `at_hash`. Discovery is cached per issuer for an hour.
 - **Errors.** `AtlasOidcError` with `code` (`AtlasOidcErrorCode`: `state_mismatch`, `issuer_mismatch`, `invalid_request`, `invalid_token`, `token_exchange_failed`, `access_denied`, `discovery_failed`), `oauthError`, `description`, `status`, `clearCookie` and `cause`.

package/README.md

@@ -399,3 +399,5 @@ To check the route end to end, `oauthClients.testBackchannelLogout(id)` sends a
 ## Webhooks
 
 `verifyWebhook` checks the signature on events Atlas sends to your webhook endpoints. You manage endpoints with `atlas.webhooks.endpoints`: create, update, reveal or rotate a secret, send a test event, and redeliver a past delivery.
+
+The `atlas-signature` header can carry more than one signature, separated by spaces (`v1,<sig> v1,<sig>`). While an endpoint secret rotates, Atlas may sign each delivery with the old and the new secret. `verifyWebhook` accepts the delivery when any one signature matches your secret.

package/dist/client/branding.d.ts

@@ -51,6 +51,13 @@ export interface Branding {
     };
     /** How a verification code is entered — segmented `boxes` (default) or `single`. */
     codeInput?: 'boxes' | 'single';
+    /**
+     * Per-audience branding for the hosted pages, keyed by audience hint
+     * (`[a-z0-9_-]{1,32}`, at most 20). A sign-in started with
+     * `audience_hint=<hint>` uses that entry. An update merges per hint: an entry
+     * replaces that hint, `null` deletes it, `audiences: null` removes them all.
+     */
+    audiences?: Record<string, BrandingAudience | null> | null;
     card?: {
         width?: 'narrow' | 'default' | 'wide';
         align?: 'left' | 'center';
@@ -108,6 +115,17 @@ export interface HostedBackground {
     angle?: number;
     imageUrl?: string;
 }
+/** The hosted-page branding for one audience hint. */
+export interface BrandingAudience {
+    /** Replaces the card heading (up to 120 characters). */
+    heading?: string;
+    /** Replaces the line under the heading (up to 240 characters). */
+    subheading?: string;
+    /** Replaces the logo (https). */
+    logoUrl?: string;
+    /** Replaces the primary colour (hex, rgb() or a CSS colour name). */
+    primaryColor?: string;
+}
 /** What the renderers actually use — everything already escaped or dropped. */
 export interface ResolvedBranding {
     applicationName: string;
@@ -137,6 +155,8 @@ export interface ResolvedBranding {
     providerHidden?: string[];
     socialButtons?: Record<string, unknown>;
     codeInput?: 'boxes' | 'single';
+    /** Every audience the hosted page can theme for, as it reads them (invalid values dropped). */
+    audiences?: Record<string, BrandingAudience>;
     card?: {
         width: string;
         align: string;

package/dist/client/branding.js.map

@@ -1 +1 @@
-{"version":3,"file":"branding.js","sourceRoot":"","sources":["../../src/client/branding.ts"],"names":[],"mappings":";;AAkLA,4CAcC;AAdD,SAAgB,gBAAgB,CAAC,OAAkB;IACjD,OAAO;QACL,GAAG;YACD,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC;QAC1D,CAAC;QACD,kEAAkE;QAClE,MAAM,CAAC,IAAuB;YAC5B,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,cAAc,EAAE,IAAI,EAAE,CAAC,CAAC;QAClE,CAAC;QACD,0EAA0E;QAC1E,OAAO,CAAC,IAAuB;YAC7B,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,sBAAsB,EAAE,IAAI,EAAE,CAAC,CAAC;QACzE,CAAC;KACF,CAAC;AACJ,CAAC"}
+{"version":3,"file":"branding.js","sourceRoot":"","sources":["../../src/client/branding.ts"],"names":[],"mappings":";;AAuMA,4CAcC;AAdD,SAAgB,gBAAgB,CAAC,OAAkB;IACjD,OAAO;QACL,GAAG;YACD,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC;QAC1D,CAAC;QACD,kEAAkE;QAClE,MAAM,CAAC,IAAuB;YAC5B,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,cAAc,EAAE,IAAI,EAAE,CAAC,CAAC;QAClE,CAAC;QACD,0EAA0E;QAC1E,OAAO,CAAC,IAAuB;YAC7B,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,sBAAsB,EAAE,IAAI,EAAE,CAAC,CAAC;QACzE,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/client/diagnostics.d.ts

@@ -8,6 +8,11 @@ export interface LoginReadinessParams {
 export interface LoginReadinessCheck {
     name: string;
     pass: boolean;
+    /**
+     * `false` when the check does not matter for the assumed integration (it
+     * then never makes `ready` false). Absent from older servers.
+     */
+    applies?: boolean;
     observed: unknown;
     /** What was seen, and the fix when it fails. */
     detail: string;
@@ -17,9 +22,20 @@ export interface LoginReadiness {
     origin: string;
     live: boolean;
     data_region?: string | null;
+    /** Every check that applies to the assumed integration passes. */
     ready: boolean;
+    /** The integration the checks assumed for this origin, and why. */
+    integration?: LoginReadinessIntegration;
     checks: LoginReadinessCheck[];
 }
+export interface LoginReadinessIntegration {
+    /** `redirect`: hosted-redirect OIDC, so the `cors` and `session_cookie` checks do not apply. */
+    assumed: 'redirect' | 'embedded';
+    /** `declared` | `embedded_traffic` | `redirect_clients` | `default`. */
+    source: 'declared' | 'embedded_traffic' | 'redirect_clients' | 'default';
+    /** A plain sentence saying why. */
+    reason: string;
+}
 export interface RequestInspectorParams {
     /** The browser origin making the request. */
     origin: string;

package/dist/client/diagnostics.js.map

@@ -1 +1 @@
-{"version":3,"file":"diagnostics.js","sourceRoot":"","sources":["../../src/client/diagnostics.ts"],"names":[],"mappings":";;AAsDA,kDAmBC;AAnBD,SAAgB,mBAAmB,CAAC,OAAkB;IACpD,OAAO;QACL,yGAAyG;QACzG,cAAc,CAAC,MAA4B;YACzC,OAAO,OAAO,CAAC;gBACb,MAAM,EAAE,KAAK;gBACb,IAAI,EAAE,iCAAiC;gBACvC,KAAK,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE;aACpD,CAAC,CAAC;QACL,CAAC;QACD,uFAAuF;QACvF,gBAAgB,CAAC,MAA8B;YAC7C,OAAO,OAAO,CAAC;gBACb,MAAM,EAAE,KAAK;gBACb,IAAI,EAAE,mCAAmC;gBACzC,KAAK,EAAE,EAAE,GAAG,MAAM,EAAE;aACrB,CAAC,CAAC;QACL,CAAC;KACF,CAAC;AACJ,CAAC"}
+{"version":3,"file":"diagnostics.js","sourceRoot":"","sources":["../../src/client/diagnostics.ts"],"names":[],"mappings":";;AAuEA,kDAmBC;AAnBD,SAAgB,mBAAmB,CAAC,OAAkB;IACpD,OAAO;QACL,yGAAyG;QACzG,cAAc,CAAC,MAA4B;YACzC,OAAO,OAAO,CAAC;gBACb,MAAM,EAAE,KAAK;gBACb,IAAI,EAAE,iCAAiC;gBACvC,KAAK,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE;aACpD,CAAC,CAAC;QACL,CAAC;QACD,uFAAuF;QACvF,gBAAgB,CAAC,MAA8B;YAC7C,OAAO,OAAO,CAAC;gBACb,MAAM,EAAE,KAAK;gBACb,IAAI,EAAE,mCAAmC;gBACzC,KAAK,EAAE,EAAE,GAAG,MAAM,EAAE;aACrB,CAAC,CAAC;QACL,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/client/error.d.ts

@@ -47,6 +47,16 @@ export declare const AtlasErrorCodes: {
     readonly CAPTCHA_IN_USE: "CAPTCHA_IN_USE";
     /** Strict mode: the body had a field this endpoint does not accept (`param` names it). */
     readonly UNKNOWN_FIELD: "UNKNOWN_FIELD";
+    /** 422 — the body set a field that is not writable on this endpoint (`param` names it; the message names the call that changes it). */
+    readonly READ_ONLY_FIELD: "READ_ONLY_FIELD";
+    /** 409 — the development email sender is not available on a production instance. */
+    readonly DEVELOPMENT_EMAIL_NOT_ALLOWED: "DEVELOPMENT_EMAIL_NOT_ALLOWED";
+    /** 503 — the development email sender is not available on this deployment. */
+    readonly DEVELOPMENT_EMAIL_UNAVAILABLE: "DEVELOPMENT_EMAIL_UNAVAILABLE";
+    /** 429 — the development sender's daily or per-recipient hourly cap is spent (`meta.window`, `meta.retry_after_seconds`). */
+    readonly DEVELOPMENT_EMAIL_LIMIT_REACHED: "DEVELOPMENT_EMAIL_LIMIT_REACHED";
+    /** 422 — the development sender sends only Atlas's own sign-in emails, never custom templates. */
+    readonly DEVELOPMENT_EMAIL_TEMPLATE_NOT_ALLOWED: "DEVELOPMENT_EMAIL_TEMPLATE_NOT_ALLOWED";
     /** The billing plan still has subscribers and cannot be removed. */
     readonly PLAN_IN_USE: "PLAN_IN_USE";
     /** The key is valid but for another API surface (e.g. a platform key on the Backend API). */

package/dist/client/error.js

@@ -43,6 +43,16 @@ exports.AtlasErrorCodes = {
     CAPTCHA_IN_USE: 'CAPTCHA_IN_USE',
     /** Strict mode: the body had a field this endpoint does not accept (`param` names it). */
     UNKNOWN_FIELD: 'UNKNOWN_FIELD',
+    /** 422 — the body set a field that is not writable on this endpoint (`param` names it; the message names the call that changes it). */
+    READ_ONLY_FIELD: 'READ_ONLY_FIELD',
+    /** 409 — the development email sender is not available on a production instance. */
+    DEVELOPMENT_EMAIL_NOT_ALLOWED: 'DEVELOPMENT_EMAIL_NOT_ALLOWED',
+    /** 503 — the development email sender is not available on this deployment. */
+    DEVELOPMENT_EMAIL_UNAVAILABLE: 'DEVELOPMENT_EMAIL_UNAVAILABLE',
+    /** 429 — the development sender's daily or per-recipient hourly cap is spent (`meta.window`, `meta.retry_after_seconds`). */
+    DEVELOPMENT_EMAIL_LIMIT_REACHED: 'DEVELOPMENT_EMAIL_LIMIT_REACHED',
+    /** 422 — the development sender sends only Atlas's own sign-in emails, never custom templates. */
+    DEVELOPMENT_EMAIL_TEMPLATE_NOT_ALLOWED: 'DEVELOPMENT_EMAIL_TEMPLATE_NOT_ALLOWED',
     /** The billing plan still has subscribers and cannot be removed. */
     PLAN_IN_USE: 'PLAN_IN_USE',
     /** The key is valid but for another API surface (e.g. a platform key on the Backend API). */

package/dist/client/error.js.map

@@ -1 +1 @@
-{"version":3,"file":"error.js","sourceRoot":"","sources":["../../src/client/error.ts"],"names":[],"mappings":";;;AAoBA,MAAa,aAAc,SAAQ,KAAK;IACpB,IAAI,GAAG,eAAe,CAAC;IACzC,0CAA0C;IACjC,MAAM,CAAS;IACxB,8CAA8C;IACrC,MAAM,CAAmB;IAElC,YAAY,MAAc,EAAE,MAAwB,EAAE,OAAgB;QACpE,KAAK,CAAC,OAAO,IAAI,MAAM,CAAC,CAAC,CAAC,EAAE,OAAO,IAAI,wCAAwC,MAAM,EAAE,CAAC,CAAC;QACzF,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QACrB,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QACrB,uEAAuE;QACvE,sEAAsE;QACtE,MAAM,CAAC,cAAc,CAAC,IAAI,EAAE,aAAa,CAAC,SAAS,CAAC,CAAC;IACvD,CAAC;IAED,uEAAuE;IACvE,IAAI,IAAI;QACN,OAAO,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC;IAC9B,CAAC;IAED,yEAAyE;IACzE,OAAO,CAAC,IAAY;QAClB,OAAO,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC;IAClD,CAAC;CACF;AAzBD,sCAyBC;AAED;;;;GAIG;AACU,QAAA,eAAe,GAAG;IAC7B,+EAA+E;IAC/E,6BAA6B,EAAE,+BAA+B;IAC9D,mEAAmE;IACnE,uBAAuB,EAAE,yBAAyB;IAClD,oGAAoG;IACpG,qBAAqB,EAAE,uBAAuB;IAC9C,oGAAoG;IACpG,qBAAqB,EAAE,uBAAuB;IAC9C,wGAAwG;IACxG,cAAc,EAAE,gBAAgB;IAChC,0FAA0F;IAC1F,aAAa,EAAE,eAAe;IAC9B,oEAAoE;IACpE,WAAW,EAAE,aAAa;IAC1B,6FAA6F;IAC7F,iBAAiB,EAAE,mBAAmB;IACtC,gDAAgD;IAChD,WAAW,EAAE,aAAa;IAC1B,SAAS,EAAE,WAAW;IACtB,iBAAiB,EAAE,mBAAmB;IACtC,YAAY,EAAE,cAAc;IAC5B,4FAA4F;IAC5F,oBAAoB,EAAE,sBAAsB;IAC5C,yFAAyF;IACzF,cAAc,EAAE,gBAAgB;IAChC,eAAe,EAAE,iBAAiB;IAClC,oBAAoB,EAAE,sBAAsB;IAC5C,eAAe,EAAE,iBAAiB;IAClC,aAAa,EAAE,eAAe;IAC9B,SAAS,EAAE,WAAW;IACtB,QAAQ,EAAE,UAAU;CACZ,CAAC"}
+{"version":3,"file":"error.js","sourceRoot":"","sources":["../../src/client/error.ts"],"names":[],"mappings":";;;AAoBA,MAAa,aAAc,SAAQ,KAAK;IACpB,IAAI,GAAG,eAAe,CAAC;IACzC,0CAA0C;IACjC,MAAM,CAAS;IACxB,8CAA8C;IACrC,MAAM,CAAmB;IAElC,YAAY,MAAc,EAAE,MAAwB,EAAE,OAAgB;QACpE,KAAK,CAAC,OAAO,IAAI,MAAM,CAAC,CAAC,CAAC,EAAE,OAAO,IAAI,wCAAwC,MAAM,EAAE,CAAC,CAAC;QACzF,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QACrB,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QACrB,uEAAuE;QACvE,sEAAsE;QACtE,MAAM,CAAC,cAAc,CAAC,IAAI,EAAE,aAAa,CAAC,SAAS,CAAC,CAAC;IACvD,CAAC;IAED,uEAAuE;IACvE,IAAI,IAAI;QACN,OAAO,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC;IAC9B,CAAC;IAED,yEAAyE;IACzE,OAAO,CAAC,IAAY;QAClB,OAAO,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC;IAClD,CAAC;CACF;AAzBD,sCAyBC;AAED;;;;GAIG;AACU,QAAA,eAAe,GAAG;IAC7B,+EAA+E;IAC/E,6BAA6B,EAAE,+BAA+B;IAC9D,mEAAmE;IACnE,uBAAuB,EAAE,yBAAyB;IAClD,oGAAoG;IACpG,qBAAqB,EAAE,uBAAuB;IAC9C,oGAAoG;IACpG,qBAAqB,EAAE,uBAAuB;IAC9C,wGAAwG;IACxG,cAAc,EAAE,gBAAgB;IAChC,0FAA0F;IAC1F,aAAa,EAAE,eAAe;IAC9B,uIAAuI;IACvI,eAAe,EAAE,iBAAiB;IAClC,oFAAoF;IACpF,6BAA6B,EAAE,+BAA+B;IAC9D,8EAA8E;IAC9E,6BAA6B,EAAE,+BAA+B;IAC9D,6HAA6H;IAC7H,+BAA+B,EAAE,iCAAiC;IAClE,kGAAkG;IAClG,sCAAsC,EAAE,wCAAwC;IAChF,oEAAoE;IACpE,WAAW,EAAE,aAAa;IAC1B,6FAA6F;IAC7F,iBAAiB,EAAE,mBAAmB;IACtC,gDAAgD;IAChD,WAAW,EAAE,aAAa;IAC1B,SAAS,EAAE,WAAW;IACtB,iBAAiB,EAAE,mBAAmB;IACtC,YAAY,EAAE,cAAc;IAC5B,4FAA4F;IAC5F,oBAAoB,EAAE,sBAAsB;IAC5C,yFAAyF;IACzF,cAAc,EAAE,gBAAgB;IAChC,eAAe,EAAE,iBAAiB;IAClC,oBAAoB,EAAE,sBAAsB;IAC5C,eAAe,EAAE,iBAAiB;IAClC,aAAa,EAAE,eAAe;IAC9B,SAAS,EAAE,WAAW;IACtB,QAAQ,EAAE,UAAU;CACZ,CAAC"}

package/dist/client/index.d.ts

@@ -479,7 +479,7 @@ declare function buildNamespaces(request: RequestFn): {
             list(): Promise<import("./webhooks").WebhookEndpointList>;
             update(id: string, body: import("./webhooks").UpdateWebhookEndpointBody): Promise<import("./webhooks").WebhookEndpoint>;
             revealSecret(id: string): Promise<import("./webhooks").WebhookSigningSecret>;
-            rotateSecret(id: string): Promise<import("./webhooks").WebhookSigningSecret>;
+            rotateSecret(id: string, body?: import("./webhooks").RotateWebhookSecretBody): Promise<import("./webhooks").WebhookSigningSecret>;
             test(id: string): Promise<import("./webhooks").WebhookDeliveryQueued>;
             redeliver(id: string, deliveryId: string): Promise<import("./webhooks").WebhookDeliveryQueued>;
             create(body: import("./webhooks").CreateWebhookEndpointBody, idempotencyKey?: string): Promise<import("./webhooks").WebhookEndpointWithSecret>;
@@ -951,6 +951,12 @@ declare function buildNamespaces(request: RequestFn): {
             object: "kerberos_secret";
             deleted: true;
         }>;
+        getProxySecret(): Promise<import("./instance-security").ProxySecret>;
+        createProxySecret(body?: import("./instance-security").CreateProxySecretBody): Promise<import("./instance-security").ProxySecretCreated>;
+        deleteProxySecret(): Promise<{
+            object: "proxy_secret";
+            deleted: true;
+        }>;
         setLdapBindPassword(connectionId: string, body: {
             bind_password: string;
         }): Promise<{

package/dist/client/instance-security.d.ts

@@ -3,8 +3,8 @@ import { type RequestFn } from './request';
  * §5/§11.2 instance security config — the agent mirror of the dashboard security
  * screen. Settings that live OUTSIDE `auth_config` (so a raw `PATCH /v1/instance`
  * cannot reach them): the per-flow kill switches, the customer IP allowlist, and
- * the write-only provider secrets (captcha, Kerberos proxy, LDAP bind password).
- * No secret is ever readable back.
+ * the write-only provider secrets (captcha, Kerberos proxy, LDAP bind password),
+ * and the trusted reverse proxy secret. No secret is ever readable back.
  */
 export interface InstanceKillSwitches {
     /** Refuse sign-ups for this instance only. */
@@ -31,6 +31,34 @@ export interface UpdateInstanceSecurityBody {
      */
     confirm_lockout?: boolean;
 }
+/**
+ * The trusted reverse proxy secret: with it, a proxy that serves the Frontend
+ * API from your own origin sends `X-Atlas-Proxy-Secret` + `X-Atlas-Client-IP`,
+ * and Atlas uses the browser's IP for rate limits, lockout, risk signals, geo,
+ * audit logs and session metadata. Never returned after creation.
+ */
+export interface ProxySecret {
+    object: 'proxy_secret';
+    /** Whether a proxy secret is set. */
+    set: boolean;
+    /** When the current secret was created (epoch ms), or null. */
+    created_at: number | null;
+    /** After a rotation: when the replaced secret stops working (epoch ms), or null. */
+    previous_expires_at: number | null;
+    secret_header: 'X-Atlas-Proxy-Secret';
+    client_ip_header: 'X-Atlas-Client-IP';
+}
+/** Create / rotate result: the secret, shown only here. */
+export interface ProxySecretCreated extends ProxySecret {
+    /** `aps_…`. Store it in your proxy's environment; Atlas keeps only a hash. */
+    secret: string;
+    /** true when an existing secret was replaced. */
+    rotated: boolean;
+}
+export interface CreateProxySecretBody {
+    /** On rotation: seconds the replaced secret keeps working. Default 86400, 0 = stop now, at most 604800. */
+    overlap_seconds?: number | null;
+}
 /** A confirmed self-lockout returns the config plus a plain-language `warning`. */
 export interface InstanceSecurityResult extends InstanceSecurity {
     warning?: string;
@@ -62,6 +90,15 @@ export declare function instanceSecurityResource(request: RequestFn): {
         object: "kerberos_secret";
         deleted: true;
     }>;
+    /** Whether a trusted reverse proxy secret is set (never the secret). */
+    getProxySecret(): Promise<ProxySecret>;
+    /** Create, or rotate (with `overlap_seconds`), the trusted reverse proxy secret. The secret is returned once. */
+    createProxySecret(body?: CreateProxySecretBody): Promise<ProxySecretCreated>;
+    /** Remove the proxy secret: `X-Atlas-Client-IP` is ignored again. */
+    deleteProxySecret(): Promise<{
+        object: "proxy_secret";
+        deleted: true;
+    }>;
     /** Store an LDAP connection's service-account bind password. The connection
      *  must already exist in `auth_config.ldap.connections`. */
     setLdapBindPassword(connectionId: string, body: {

package/dist/client/instance-security.js

@@ -24,6 +24,18 @@ function instanceSecurityResource(request) {
         deleteKerberosSecret() {
             return request({ method: 'DELETE', path: '/v1/instance/kerberos_secret' });
         },
+        /** Whether a trusted reverse proxy secret is set (never the secret). */
+        getProxySecret() {
+            return request({ method: 'GET', path: '/v1/instance/proxy_secret' });
+        },
+        /** Create, or rotate (with `overlap_seconds`), the trusted reverse proxy secret. The secret is returned once. */
+        createProxySecret(body = {}) {
+            return request({ method: 'POST', path: '/v1/instance/proxy_secret', body });
+        },
+        /** Remove the proxy secret: `X-Atlas-Client-IP` is ignored again. */
+        deleteProxySecret() {
+            return request({ method: 'DELETE', path: '/v1/instance/proxy_secret' });
+        },
         /** Store an LDAP connection's service-account bind password. The connection
          *  must already exist in `auth_config.ldap.connections`. */
         setLdapBindPassword(connectionId, body) {

package/dist/client/instance-security.js.map

@@ -1 +1 @@
-{"version":3,"file":"instance-security.js","sourceRoot":"","sources":["../../src/client/instance-security.ts"],"names":[],"mappings":";;AA2CA,4DAgDC;AA3FD,uCAAgD;AA2ChD,SAAgB,wBAAwB,CAAC,OAAkB;IACzD,OAAO;QACL,GAAG;YACD,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,uBAAuB,EAAE,CAAC,CAAC;QACnE,CAAC;QACD,MAAM,CAAC,IAAgC;YACrC,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,uBAAuB,EAAE,IAAI,EAAE,CAAC,CAAC;QAC3E,CAAC;QAED,+EAA+E;QAC/E,gBAAgB,CACd,IAAwB;YAExB,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,6BAA6B,EAAE,IAAI,EAAE,CAAC,CAAC;QAC/E,CAAC;QACD,mBAAmB;YACjB,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,6BAA6B,EAAE,CAAC,CAAC;QAC5E,CAAC;QAED,sFAAsF;QACtF,iBAAiB,CAAC,IAAwB;YACxC,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,8BAA8B,EAAE,IAAI,EAAE,CAAC,CAAC;QAChF,CAAC;QACD,oBAAoB;YAClB,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,8BAA8B,EAAE,CAAC,CAAC;QAC7E,CAAC;QAED;oEAC4D;QAC5D,mBAAmB,CACjB,YAAoB,EACpB,IAA+B;YAE/B,OAAO,OAAO,CAAC;gBACb,MAAM,EAAE,KAAK;gBACb,IAAI,EAAE,iCAAiC,IAAA,aAAG,EAAC,YAAY,CAAC,gBAAgB;gBACxE,IAAI;aACL,CAAC,CAAC;QACL,CAAC;QACD,sBAAsB,CACpB,YAAoB;YAEpB,OAAO,OAAO,CAAC;gBACb,MAAM,EAAE,QAAQ;gBAChB,IAAI,EAAE,iCAAiC,IAAA,aAAG,EAAC,YAAY,CAAC,gBAAgB;aACzE,CAAC,CAAC;QACL,CAAC;KACF,CAAC;AACJ,CAAC"}
+{"version":3,"file":"instance-security.js","sourceRoot":"","sources":["../../src/client/instance-security.ts"],"names":[],"mappings":";;AA0EA,4DA6DC;AAvID,uCAAgD;AA0EhD,SAAgB,wBAAwB,CAAC,OAAkB;IACzD,OAAO;QACL,GAAG;YACD,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,uBAAuB,EAAE,CAAC,CAAC;QACnE,CAAC;QACD,MAAM,CAAC,IAAgC;YACrC,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,uBAAuB,EAAE,IAAI,EAAE,CAAC,CAAC;QAC3E,CAAC;QAED,+EAA+E;QAC/E,gBAAgB,CACd,IAAwB;YAExB,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,6BAA6B,EAAE,IAAI,EAAE,CAAC,CAAC;QAC/E,CAAC;QACD,mBAAmB;YACjB,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,6BAA6B,EAAE,CAAC,CAAC;QAC5E,CAAC;QAED,sFAAsF;QACtF,iBAAiB,CAAC,IAAwB;YACxC,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,8BAA8B,EAAE,IAAI,EAAE,CAAC,CAAC;QAChF,CAAC;QACD,oBAAoB;YAClB,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,8BAA8B,EAAE,CAAC,CAAC;QAC7E,CAAC;QAED,wEAAwE;QACxE,cAAc;YACZ,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,2BAA2B,EAAE,CAAC,CAAC;QACvE,CAAC;QACD,iHAAiH;QACjH,iBAAiB,CAAC,OAA8B,EAAE;YAChD,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,2BAA2B,EAAE,IAAI,EAAE,CAAC,CAAC;QAC9E,CAAC;QACD,qEAAqE;QACrE,iBAAiB;YACf,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,2BAA2B,EAAE,CAAC,CAAC;QAC1E,CAAC;QAED;oEAC4D;QAC5D,mBAAmB,CACjB,YAAoB,EACpB,IAA+B;YAE/B,OAAO,OAAO,CAAC;gBACb,MAAM,EAAE,KAAK;gBACb,IAAI,EAAE,iCAAiC,IAAA,aAAG,EAAC,YAAY,CAAC,gBAAgB;gBACxE,IAAI;aACL,CAAC,CAAC;QACL,CAAC;QACD,sBAAsB,CACpB,YAAoB;YAEpB,OAAO,OAAO,CAAC;gBACb,MAAM,EAAE,QAAQ;gBAChB,IAAI,EAAE,iCAAiC,IAAA,aAAG,EAAC,YAAY,CAAC,gBAAgB;aACzE,CAAC,CAAC;QACL,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/client/instance.d.ts

@@ -22,12 +22,30 @@ export interface Instance {
     /** The JWKS holding this instance's signing keys. */
     jwks_uri: string;
     allowed_origins: string[];
+    /**
+     * The declared integration per allowed origin (`redirect` or `embedded`). An
+     * origin not listed is inferred by preflight and login readiness.
+     */
+    allowed_origin_integrations?: Record<string, 'redirect' | 'embedded'>;
     auth_config: Metadata;
     created_at: number;
 }
+/**
+ * How an allowed origin signs in: `redirect` (hosted-redirect OIDC: the app
+ * never runs the embedded components), `embedded` (the sign-in components run
+ * on the origin), or `auto` / `null` (clear the hint; Atlas infers it).
+ */
+export type OriginIntegration = 'redirect' | 'embedded' | 'auto';
+/** An `allowed_origins` entry that also declares how the origin signs in. */
+export interface AllowedOriginEntry {
+    origin: string;
+    integration?: OriginIntegration | null;
+}
+/** An origin string, or `{ origin, integration }`. A plain string keeps the origin's current hint. */
+export type AllowedOriginInput = string | AllowedOriginEntry;
 export interface UpdateInstanceBody {
-    /** Exact origins only — a wildcard or a path is rejected (§13.1). */
-    allowed_origins?: string[];
+    /** Exact origins only — a wildcard or a path is rejected (§13.1). The list replaces the stored one. */
+    allowed_origins?: AllowedOriginInput[];
     auth_config?: Record<string, unknown>;
 }
 /** `PATCH /v1/instance` echoes only the mutable fields, not a full Instance. */
@@ -35,6 +53,7 @@ export interface InstanceUpdateResult {
     object: 'instance';
     id: string;
     allowed_origins: string[];
+    allowed_origin_integrations?: Record<string, 'redirect' | 'embedded'>;
     auth_config: Metadata;
 }
 /** One problem (or note) the setup check found. */

package/dist/client/instance.js.map

@@ -1 +1 @@
-{"version":3,"file":"instance.js","sourceRoot":"","sources":["../../src/client/instance.ts"],"names":[],"mappings":";;AAkSA,4CAiEC;AAjED,SAAgB,gBAAgB,CAAC,OAAkB;IACjD,OAAO;QACL,GAAG;YACD,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC;QAC1D,CAAC;QACD,MAAM,CAAC,IAAwB;YAC7B,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,cAAc,EAAE,IAAI,EAAE,CAAC,CAAC;QAClE,CAAC;QACD,yFAAyF;QACzF,SAAS;YACP,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,wBAAwB,EAAE,CAAC,CAAC;QACpE,CAAC;QACD;;;;WAIG;QACH,UAAU,CAAC,IAAuB;YAChC,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,0BAA0B,EAAE,IAAI,EAAE,CAAC,CAAC;QAC7E,CAAC;QACD,2EAA2E;QAC3E,WAAW;YACT,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,0BAA0B,EAAE,CAAC,CAAC;QACtE,CAAC;QACD,+CAA+C;QAC/C,YAAY,EAAE;YACZ,MAAM,EAAE;gBACN,GAAG;oBACD,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,kCAAkC,EAAE,CAAC,CAAC;gBAC9E,CAAC;gBACD,GAAG,CAAC,IAA8B;oBAChC,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,kCAAkC,EAAE,IAAI,EAAE,CAAC,CAAC;gBACpF,CAAC;gBACD,MAAM;oBACJ,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,kCAAkC,EAAE,CAAC,CAAC;gBACjF,CAAC;aACF;YACD,UAAU,EAAE;gBACV,GAAG;oBACD,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,sCAAsC,EAAE,CAAC,CAAC;gBAClF,CAAC;gBACD,qCAAqC;gBACrC,GAAG,CAAC,IAAkC;oBACpC,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,sCAAsC,EAAE,IAAI,EAAE,CAAC,CAAC;gBACxF,CAAC;gBACD,MAAM;oBACJ,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,sCAAsC,EAAE,CAAC,CAAC;gBACrF,CAAC;aACF;SACF;QACD,oEAAoE;QACpE,aAAa,EAAE;YACb,GAAG;gBACD,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,6BAA6B,EAAE,CAAC,CAAC;YACzE,CAAC;YACD,kCAAkC;YAClC,GAAG,CAAC,IAA0B;gBAC5B,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,6BAA6B,EAAE,IAAI,EAAE,CAAC,CAAC;YAC/E,CAAC;YACD,+EAA+E;YAC/E,MAAM;gBACJ,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,6BAA6B,EAAE,CAAC,CAAC;YAC5E,CAAC;SACF;KACF,CAAC;AACJ,CAAC"}
+{"version":3,"file":"instance.js","sourceRoot":"","sources":["../../src/client/instance.ts"],"names":[],"mappings":";;AAwTA,4CAiEC;AAjED,SAAgB,gBAAgB,CAAC,OAAkB;IACjD,OAAO;QACL,GAAG;YACD,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC;QAC1D,CAAC;QACD,MAAM,CAAC,IAAwB;YAC7B,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,cAAc,EAAE,IAAI,EAAE,CAAC,CAAC;QAClE,CAAC;QACD,yFAAyF;QACzF,SAAS;YACP,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,wBAAwB,EAAE,CAAC,CAAC;QACpE,CAAC;QACD;;;;WAIG;QACH,UAAU,CAAC,IAAuB;YAChC,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,0BAA0B,EAAE,IAAI,EAAE,CAAC,CAAC;QAC7E,CAAC;QACD,2EAA2E;QAC3E,WAAW;YACT,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,0BAA0B,EAAE,CAAC,CAAC;QACtE,CAAC;QACD,+CAA+C;QAC/C,YAAY,EAAE;YACZ,MAAM,EAAE;gBACN,GAAG;oBACD,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,kCAAkC,EAAE,CAAC,CAAC;gBAC9E,CAAC;gBACD,GAAG,CAAC,IAA8B;oBAChC,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,kCAAkC,EAAE,IAAI,EAAE,CAAC,CAAC;gBACpF,CAAC;gBACD,MAAM;oBACJ,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,kCAAkC,EAAE,CAAC,CAAC;gBACjF,CAAC;aACF;YACD,UAAU,EAAE;gBACV,GAAG;oBACD,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,sCAAsC,EAAE,CAAC,CAAC;gBAClF,CAAC;gBACD,qCAAqC;gBACrC,GAAG,CAAC,IAAkC;oBACpC,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,sCAAsC,EAAE,IAAI,EAAE,CAAC,CAAC;gBACxF,CAAC;gBACD,MAAM;oBACJ,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,sCAAsC,EAAE,CAAC,CAAC;gBACrF,CAAC;aACF;SACF;QACD,oEAAoE;QACpE,aAAa,EAAE;YACb,GAAG;gBACD,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,6BAA6B,EAAE,CAAC,CAAC;YACzE,CAAC;YACD,kCAAkC;YAClC,GAAG,CAAC,IAA0B;gBAC5B,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,6BAA6B,EAAE,IAAI,EAAE,CAAC,CAAC;YAC/E,CAAC;YACD,+EAA+E;YAC/E,MAAM;gBACJ,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,6BAA6B,EAAE,CAAC,CAAC;YAC5E,CAAC;SACF;KACF,CAAC;AACJ,CAAC"}

package/dist/client/messaging.d.ts

@@ -333,7 +333,7 @@ export interface ManagedEmail {
         last_complaint_at: number | null;
     };
     reputation: 'your_provider_account';
-    /** Brevo, on create: whether the bounce / complaint webhook was registered on your account. */
+    /** On create (Brevo and Resend) and verify (Resend): whether the bounce / complaint webhook was registered on your account. */
     feedback_webhook?: 'registered' | 'not_registered';
     /** DNS automation, when set. The token is never returned. */
     dns: {

package/dist/client/platform.d.ts

@@ -1,7 +1,7 @@
 import { type AtlasRequestSettings, type RequestFn, type UnknownFieldsEvent } from './request';
 import type { ListPage } from './types';
 import type { BackchannelDeliveriesQuery, BackchannelLogoutDeliveryPage, BackchannelLogoutTest } from './oauth-clients';
-import type { OriginMove, OriginMoveRequest, PreflightFinding } from './instance';
+import type { AllowedOriginInput, OriginMove, OriginMoveRequest, PreflightFinding } from './instance';
 import type { ConfigChangelogEntry, ListConfigChangelogParams } from './activity';
 import type { AtlasDesign, AtlasDesignPatch, DeletedDesignAsset, DesignAsset, DesignAssetData, DesignPreview, ResolvedAtlasDesign, UploadDesignAssetOptions } from './design';
 /** `GET /v1/platform/atlas_id_apps/{id}/preflight`. */
@@ -52,6 +52,8 @@ export interface PlatformApp {
     /** The JWKS holding this app's signing keys. */
     jwks_uri: string;
     allowed_origins: string[];
+    /** The declared integration per allowed origin. Write `allowed_origins` entries as `{ origin, integration }` to set one. */
+    allowed_origin_integrations?: Record<string, 'redirect' | 'embedded'>;
     /** Housekeeping labels (up to 20, each up to 40 chars). */
     tags: string[];
     /** Hidden from the default listing. A visibility flag only: the app still serves auth. */
@@ -79,14 +81,16 @@ export interface CreatedPlatformApp extends PlatformAppWithSecret {
 export interface CreatePlatformAppBody {
     name?: string;
     environment?: 'production' | 'development';
-    allowed_origins?: string[];
+    /** Origin strings, or `{ origin, integration }` entries (`redirect` | `embedded` | `auto`). */
+    allowed_origins?: AllowedOriginInput[];
     /** Default true: also provision a test-mode sibling instance. */
     create_development_sibling?: boolean;
     tags?: string[];
 }
 export interface UpdatePlatformAppBody {
     name?: string;
-    allowed_origins?: string[];
+    /** Origin strings, or `{ origin, integration }` entries (`redirect` | `embedded` | `auto`). */
+    allowed_origins?: AllowedOriginInput[];
     tags?: string[];
 }
 export interface ListPlatformAppsParams {
@@ -99,7 +103,8 @@ export interface ListPlatformAppsParams {
 }
 export interface CreatePlatformInstanceBody {
     environment?: 'production' | 'development';
-    allowed_origins?: string[];
+    /** Origin strings, or `{ origin, integration }` entries (`redirect` | `embedded` | `auto`). */
+    allowed_origins?: AllowedOriginInput[];
 }
 export interface PlatformAppSecretRotation {
     object: 'app_secret';
@@ -113,10 +118,32 @@ export interface PlatformAppSecretRotation {
 }
 export interface PlatformInstanceSecretRotation {
     object: 'app_secret';
-    id: string;
+    app_id: string;
+    instance_id: string;
+    /** @deprecated Never sent; read `instance_id`. */
+    id?: string;
+    /** The new secret key, revealed exactly once. */
     secret: string;
+    /** The overlap applied, in seconds. */
+    overlap_seconds: number;
+    /** When the prior keys stop working (epoch ms); null on a hard cut. */
+    previous_keys_expire_at: number | null;
     note: string;
 }
+/** Body of the platform app and instance rotate_secret calls. */
+export interface RotatePlatformSecretBody {
+    /** How long the prior keys keep working, in seconds. Default 259200 (72 hours). `0` revokes them now. At most 604800 (7 days). */
+    overlap_seconds?: number;
+}
+/** Body of the Sign in with Atlas app rotate calls (client secret and webhook secret). */
+export interface RotateAtlasIdAppSecretBody {
+    /**
+     * How long the previous secret keeps working, in seconds; at most 604800 (7
+     * days). Default for the client secret: 86400 (24 hours). Default for the
+     * webhook secret: 0 (it stops signing at once). `0` stops it now.
+     */
+    overlap_seconds?: number;
+}
 /** Metadata of a currently-valid secret key. Never the secret itself. */
 export interface PlatformSecretKey {
     object: 'secret_key';
@@ -155,7 +182,8 @@ export interface AccountlessApp {
 export interface CreateAccountlessAppBody {
     name?: string;
     environment?: 'production' | 'development';
-    allowed_origins?: string[];
+    /** Origin strings, or `{ origin, integration }` entries (`redirect` | `embedded` | `auto`). */
+    allowed_origins?: AllowedOriginInput[];
 }
 /** Page text on the Sign in with Atlas page. Plain text; null or empty uses the default. */
 export interface AtlasIdAppCopy {
@@ -230,12 +258,20 @@ export interface AtlasIdApp {
     webhook_events?: Array<'user.updated' | 'user.deleted' | 'grant.revoked'>;
     /** false once auto-disabled after repeated failures; null without a webhook. */
     webhook_active?: boolean | null;
+    /** While a webhook secret rotation overlap is open: when the previous secret stops signing deliveries (epoch ms); else null. */
+    webhook_previous_secret_expires_at?: number | null;
+    /** After a client secret rotation with overlap: when the previous secret stops working (epoch ms); else null. */
+    previous_secret_expires_at?: number | null;
+    /** When the current client secret was issued (epoch ms); null for a public app. */
+    secret_issued_at?: number | null;
 }
 /** Create / rotate response: confidential apps carry the client secret exactly once. */
 export interface AtlasIdAppWithSecret extends AtlasIdApp {
     client_secret?: string;
     /** The per-app webhook signing secret, returned exactly once (first set, or rotated). */
     webhook_secret?: string;
+    /** On a rotation: the overlap applied, in seconds. */
+    overlap_seconds?: number;
     note?: string;
 }
 /** A person who has approved a Sign in with Atlas app (privacy-request lookup). */
@@ -349,17 +385,20 @@ declare function platformNamespaces(request: RequestFn): {
          * Mint a new secret key while the prior keys stay valid for
          * `overlap_seconds` (default 72h, max 7 days; 0 = immediate cut).
          */
-        rotateSecret(id: string, body?: {
-            overlap_seconds?: number;
-        }, idempotencyKey?: string): Promise<PlatformAppSecretRotation>;
+        rotateSecret(id: string, body?: RotatePlatformSecretBody, idempotencyKey?: string): Promise<PlatformAppSecretRotation>;
         /** Currently-valid secret keys (metadata only). */
         secretKeys(id: string): Promise<ListPage<PlatformSecretKey>>;
         instances: {
             list(appId: string): Promise<ListPage<PlatformApp>>;
             /** Add an instance (e.g. development beside production); secret revealed once. */
             create(appId: string, body?: CreatePlatformInstanceBody, idempotencyKey?: string): Promise<PlatformAppWithSecret>;
-            /** Revoke the instance's prior keys and mint a new one, revealed once. */
-            rotateSecret(appId: string, instanceId: string, idempotencyKey?: string): Promise<PlatformInstanceSecretRotation>;
+            /**
+             * Mint a new secret key for one instance, revealed once. The prior keys
+             * stay valid for `overlap_seconds` (default 72h, max 7 days; 0 =
+             * immediate cut), like `apps.rotateSecret`. The third argument may also
+             * be the idempotency key (the 0.9 signature).
+             */
+            rotateSecret(appId: string, instanceId: string, bodyOrIdempotencyKey?: RotatePlatformSecretBody | string, idempotencyKey?: string): Promise<PlatformInstanceSecretRotation>;
         };
         /** Start a transfer: a one-time token the receiving platform accepts. */
         transfer(id: string, idempotencyKey?: string): Promise<PlatformAppTransfer>;
@@ -388,8 +427,11 @@ declare function platformNamespaces(request: RequestFn): {
             id: string;
             deleted: true;
         }>;
-        /** New client secret, returned exactly once. Public apps have none (409). */
-        rotateSecret(id: string): Promise<AtlasIdAppWithSecret>;
+        /**
+         * New client secret, returned exactly once. The previous one keeps working
+         * for `overlap_seconds` (default 24h; 0 = revoke now). Public apps have none (409).
+         */
+        rotateSecret(id: string, body?: RotateAtlasIdAppSecretBody): Promise<AtlasIdAppWithSecret>;
         /** The app's back-channel logout delivery log, newest first. */
         listBackchannelDeliveries(id: string, query?: BackchannelDeliveriesQuery): Promise<BackchannelLogoutDeliveryPage>;
         /** Send a test back-channel logout to the app now and return what it answered. */
@@ -408,8 +450,12 @@ declare function platformNamespaces(request: RequestFn): {
         revokeGrant(id: string, grantId: string): Promise<AtlasIdGrantRevocation>;
         /** Move the app's URLs from one origin to another. `dry_run: true` writes nothing. */
         moveOrigin(id: string, body: OriginMoveRequest): Promise<OriginMove>;
-        /** New per-app webhook signing secret (`webhook_secret`), returned once. 409 without a webhook. */
-        rotateWebhookSecret(id: string): Promise<AtlasIdAppWithSecret>;
+        /**
+         * New per-app webhook signing secret (`webhook_secret`), returned once. By
+         * default the previous secret stops at once; for `overlap_seconds` it signs
+         * each delivery too. 409 without a webhook.
+         */
+        rotateWebhookSecret(id: string, body?: RotateAtlasIdAppSecretBody): Promise<AtlasIdAppWithSecret>;
         /** Preview a design on the Sign in with Atlas page without saving it. */
         previewDesign(design: AtlasDesign): Promise<DesignPreview>;
     };

package/dist/client/platform.js

@@ -64,12 +64,19 @@ function platformNamespaces(request) {
                         idempotencyKey,
                     });
                 },
-                /** Revoke the instance's prior keys and mint a new one, revealed once. */
-                rotateSecret(appId, instanceId, idempotencyKey) {
+                /**
+                 * Mint a new secret key for one instance, revealed once. The prior keys
+                 * stay valid for `overlap_seconds` (default 72h, max 7 days; 0 =
+                 * immediate cut), like `apps.rotateSecret`. The third argument may also
+                 * be the idempotency key (the 0.9 signature).
+                 */
+                rotateSecret(appId, instanceId, bodyOrIdempotencyKey, idempotencyKey) {
+                    const legacyKey = typeof bodyOrIdempotencyKey === 'string';
                     return request({
                         method: 'POST',
                         path: `/v1/platform/apps/${(0, request_1.enc)(appId)}/instances/${(0, request_1.enc)(instanceId)}/rotate_secret`,
-                        idempotencyKey,
+                        body: legacyKey ? undefined : bodyOrIdempotencyKey,
+                        idempotencyKey: legacyKey ? bodyOrIdempotencyKey : idempotencyKey,
                     });
                 },
             },
@@ -136,11 +143,15 @@ function platformNamespaces(request) {
             delete(id) {
                 return request({ method: 'DELETE', path: `/v1/platform/atlas_id_apps/${(0, request_1.enc)(id)}` });
             },
-            /** New client secret, returned exactly once. Public apps have none (409). */
-            rotateSecret(id) {
+            /**
+             * New client secret, returned exactly once. The previous one keeps working
+             * for `overlap_seconds` (default 24h; 0 = revoke now). Public apps have none (409).
+             */
+            rotateSecret(id, body) {
                 return request({
                     method: 'POST',
                     path: `/v1/platform/atlas_id_apps/${(0, request_1.enc)(id)}/rotate_secret`,
+                    body,
                 });
             },
             /** The app's back-channel logout delivery log, newest first. */
@@ -188,11 +199,16 @@ function platformNamespaces(request) {
                     body,
                 });
             },
-            /** New per-app webhook signing secret (`webhook_secret`), returned once. 409 without a webhook. */
-            rotateWebhookSecret(id) {
+            /**
+             * New per-app webhook signing secret (`webhook_secret`), returned once. By
+             * default the previous secret stops at once; for `overlap_seconds` it signs
+             * each delivery too. 409 without a webhook.
+             */
+            rotateWebhookSecret(id, body) {
                 return request({
                     method: 'POST',
                     path: `/v1/platform/atlas_id_apps/${(0, request_1.enc)(id)}/webhook/rotate_secret`,
+                    body,
                 });
             },
             /** Preview a design on the Sign in with Atlas page without saving it. */

package/dist/client/platform.js.map

@@ -1 +1 @@
-{"version":3,"file":"platform.js","sourceRoot":"","sources":["../../src/client/platform.ts"],"names":[],"mappings":";;AAipBA,8DAWC;AA5pBD,uCAMmB;AA8WnB,mFAAmF;AAEnF,SAAS,kBAAkB,CAAC,OAAkB;IAC5C,OAAO;QACL,IAAI,EAAE;YACJ,+EAA+E;YAC/E,IAAI,CAAC,SAAiC,EAAE;gBACtC,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,mBAAmB,EAAE,KAAK,EAAE,EAAE,GAAG,MAAM,EAAE,EAAE,CAAC,CAAC;YACrF,CAAC;YACD,iEAAiE;YACjE,MAAM,CAAC,OAA8B,EAAE,EAAE,cAAuB;gBAC9D,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,mBAAmB,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC;YACtF,CAAC;YACD,GAAG,CAAC,EAAU;gBACZ,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,qBAAqB,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;YAC1E,CAAC;YACD,MAAM,CAAC,EAAU,EAAE,IAA2B;gBAC5C,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,qBAAqB,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;YAClF,CAAC;YACD,4EAA4E;YAC5E,MAAM,CACJ,EAAU;gBAEV,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,qBAAqB,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;YAC7E,CAAC;YACD,6EAA6E;YAC7E,UAAU,CAAC,GAAa;gBACtB,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,+BAA+B,EAAE,IAAI,EAAE,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC;YAC3F,CAAC;YACD,+DAA+D;YAC/D,OAAO,CAAC,EAAU;gBAChB,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,qBAAqB,IAAA,aAAG,EAAC,EAAE,CAAC,UAAU,EAAE,CAAC,CAAC;YACnF,CAAC;YACD,SAAS,CAAC,EAAU;gBAClB,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,qBAAqB,IAAA,aAAG,EAAC,EAAE,CAAC,YAAY,EAAE,CAAC,CAAC;YACrF,CAAC;YACD;;;eAGG;YACH,YAAY,CACV,EAAU,EACV,OAAqC,EAAE,EACvC,cAAuB;gBAEvB,OAAO,OAAO,CAAC;oBACb,MAAM,EAAE,MAAM;oBACd,IAAI,EAAE,qBAAqB,IAAA,aAAG,EAAC,EAAE,CAAC,gBAAgB;oBAClD,IAAI;oBACJ,cAAc;iBACf,CAAC,CAAC;YACL,CAAC;YACD,mDAAmD;YACnD,UAAU,CAAC,EAAU;gBACnB,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,qBAAqB,IAAA,aAAG,EAAC,EAAE,CAAC,cAAc,EAAE,CAAC,CAAC;YACtF,CAAC;YACD,SAAS,EAAE;gBACT,IAAI,CAAC,KAAa;oBAChB,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,qBAAqB,IAAA,aAAG,EAAC,KAAK,CAAC,YAAY,EAAE,CAAC,CAAC;gBACvF,CAAC;gBACD,kFAAkF;gBAClF,MAAM,CACJ,KAAa,EACb,OAAmC,EAAE,EACrC,cAAuB;oBAEvB,OAAO,OAAO,CAAC;wBACb,MAAM,EAAE,MAAM;wBACd,IAAI,EAAE,qBAAqB,IAAA,aAAG,EAAC,KAAK,CAAC,YAAY;wBACjD,IAAI;wBACJ,cAAc;qBACf,CAAC,CAAC;gBACL,CAAC;gBACD,0EAA0E;gBAC1E,YAAY,CACV,KAAa,EACb,UAAkB,EAClB,cAAuB;oBAEvB,OAAO,OAAO,CAAC;wBACb,MAAM,EAAE,MAAM;wBACd,IAAI,EAAE,qBAAqB,IAAA,aAAG,EAAC,KAAK,CAAC,cAAc,IAAA,aAAG,EAAC,UAAU,CAAC,gBAAgB;wBAClF,cAAc;qBACf,CAAC,CAAC;gBACL,CAAC;aACF;YACD,yEAAyE;YACzE,QAAQ,CAAC,EAAU,EAAE,cAAuB;gBAC1C,OAAO,OAAO,CAAC;oBACb,MAAM,EAAE,MAAM;oBACd,IAAI,EAAE,qBAAqB,IAAA,aAAG,EAAC,EAAE,CAAC,WAAW;oBAC7C,cAAc;iBACf,CAAC,CAAC;YACL,CAAC;YACD,sDAAsD;YACtD,cAAc,CACZ,aAAqB,EACrB,cAAuB;gBAEvB,OAAO,OAAO,CAAC;oBACb,MAAM,EAAE,MAAM;oBACd,IAAI,EAAE,mCAAmC;oBACzC,IAAI,EAAE,EAAE,cAAc,EAAE,aAAa,EAAE;oBACvC,cAAc;iBACf,CAAC,CAAC;YACL,CAAC;YACD,+EAA+E;YAC/E,KAAK,CAAC,UAAkB,EAAE,cAAuB;gBAC/C,OAAO,OAAO,CAAC;oBACb,MAAM,EAAE,MAAM;oBACd,IAAI,EAAE,yBAAyB;oBAC/B,IAAI,EAAE,EAAE,WAAW,EAAE,UAAU,EAAE;oBACjC,cAAc;iBACf,CAAC,CAAC;YACL,CAAC;SACF;QACD,eAAe,EAAE;YACf,8FAA8F;YAC9F,MAAM,CAAC,OAAiC,EAAE,EAAE,cAAuB;gBACjE,OAAO,OAAO,CAAC;oBACb,MAAM,EAAE,MAAM;oBACd,IAAI,EAAE,+BAA+B;oBACrC,IAAI;oBACJ,cAAc;iBACf,CAAC,CAAC;YACL,CAAC;SACF;QACD,oEAAoE;QACpE,WAAW,EAAE;YACX,IAAI;gBACF,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,4BAA4B,EAAE,CAAC,CAAC;YACxE,CAAC;YACD,sFAAsF;YACtF,MAAM,CAAC,IAA0B,EAAE,cAAuB;gBACxD,OAAO,OAAO,CAAC;oBACb,MAAM,EAAE,MAAM;oBACd,IAAI,EAAE,4BAA4B;oBAClC,IAAI;oBACJ,cAAc;iBACf,CAAC,CAAC;YACL,CAAC;YACD,GAAG,CAAC,EAAU;gBACZ,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,8BAA8B,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;YACnF,CAAC;YACD,0DAA0D;YAC1D,MAAM,CAAC,EAAU,EAAE,IAA0B;gBAC3C,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,8BAA8B,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;YAC3F,CAAC;YACD,+CAA+C;YAC/C,MAAM,CAAC,EAAU;gBACf,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,8BAA8B,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;YACtF,CAAC;YACD,6EAA6E;YAC7E,YAAY,CAAC,EAAU;gBACrB,OAAO,OAAO,CAAC;oBACb,MAAM,EAAE,MAAM;oBACd,IAAI,EAAE,8BAA8B,IAAA,aAAG,EAAC,EAAE,CAAC,gBAAgB;iBAC5D,CAAC,CAAC;YACL,CAAC;YACD,gEAAgE;YAChE,yBAAyB,CACvB,EAAU,EACV,QAAoC,EAAE;gBAEtC,OAAO,OAAO,CAAC;oBACb,MAAM,EAAE,KAAK;oBACb,IAAI,EAAE,8BAA8B,IAAA,aAAG,EAAC,EAAE,CAAC,yBAAyB;oBACpE,KAAK,EAAE,EAAE,GAAG,KAAK,EAAE;iBACpB,CAAC,CAAC;YACL,CAAC;YACD,kFAAkF;YAClF,qBAAqB,CAAC,EAAU;gBAC9B,OAAO,OAAO,CAAC;oBACb,MAAM,EAAE,MAAM;oBACd,IAAI,EAAE,8BAA8B,IAAA,aAAG,EAAC,EAAE,CAAC,0BAA0B;iBACtE,CAAC,CAAC;YACL,CAAC;YACD,mGAAmG;YACnG,SAAS,CAAC,EAAU;gBAClB,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,8BAA8B,IAAA,aAAG,EAAC,EAAE,CAAC,YAAY,EAAE,CAAC,CAAC;YAC7F,CAAC;YACD;;;eAGG;YACH,SAAS,CAAC,EAAU,EAAE,KAAa;gBACjC,OAAO,OAAO,CAAC;oBACb,MAAM,EAAE,KAAK;oBACb,IAAI,EAAE,8BAA8B,IAAA,aAAG,EAAC,EAAE,CAAC,QAAQ;oBACnD,KAAK,EAAE,EAAE,KAAK,EAAE;iBACjB,CAAC,CAAC;YACL,CAAC;YACD,oGAAoG;YACpG,WAAW,CAAC,EAAU,EAAE,OAAe;gBACrC,OAAO,OAAO,CAAC;oBACb,MAAM,EAAE,QAAQ;oBAChB,IAAI,EAAE,8BAA8B,IAAA,aAAG,EAAC,EAAE,CAAC,WAAW,IAAA,aAAG,EAAC,OAAO,CAAC,EAAE;iBACrE,CAAC,CAAC;YACL,CAAC;YACD,sFAAsF;YACtF,UAAU,CAAC,EAAU,EAAE,IAAuB;gBAC5C,OAAO,OAAO,CAAC;oBACb,MAAM,EAAE,MAAM;oBACd,IAAI,EAAE,8BAA8B,IAAA,aAAG,EAAC,EAAE,CAAC,cAAc;oBACzD,IAAI;iBACL,CAAC,CAAC;YACL,CAAC;YACD,mGAAmG;YACnG,mBAAmB,CAAC,EAAU;gBAC5B,OAAO,OAAO,CAAC;oBACb,MAAM,EAAE,MAAM;oBACd,IAAI,EAAE,8BAA8B,IAAA,aAAG,EAAC,EAAE,CAAC,wBAAwB;iBACpE,CAAC,CAAC;YACL,CAAC;YACD,yEAAyE;YACzE,aAAa,CAAC,MAAmB;gBAC/B,OAAO,OAAO,CAAC;oBACb,MAAM,EAAE,MAAM;oBACd,IAAI,EAAE,2CAA2C;oBACjD,IAAI,EAAE,EAAE,MAAM,EAAE;iBACjB,CAAC,CAAC;YACL,CAAC;SACF;QACD,2EAA2E;QAC3E,gBAAgB,EAAE;YAChB,yBAAyB;YACzB,GAAG;gBACD,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,iCAAiC,EAAE,CAAC,CAAC;YAC7E,CAAC;YACD,4EAA4E;YAC5E,GAAG,CAAC,IAA6B;gBAC/B,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,iCAAiC,EAAE,IAAI,EAAE,CAAC,CAAC;YACnF,CAAC;YACD,6CAA6C;YAC7C,MAAM,CAAC,IAA+B;gBACpC,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,iCAAiC,EAAE,IAAI,EAAE,CAAC,CAAC;YACrF,CAAC;YACD,MAAM;gBACJ,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,iCAAiC,EAAE,CAAC,CAAC;YAChF,CAAC;YACD,mDAAmD;YACnD,MAAM;gBACJ,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,wCAAwC,EAAE,CAAC,CAAC;YACrF,CAAC;SACF;QACD,uEAAuE;QACvE,eAAe,EAAE;YACf,IAAI,CAAC,SAAoC,EAAE;gBAMzC,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,+BAA+B,EAAE,KAAK,EAAE,EAAE,GAAG,MAAM,EAAE,EAAE,CAAC,CAAC;YACjG,CAAC;SACF;QACD,yFAAyF;QACzF,YAAY,EAAE;YACZ,MAAM,CAAC,IAAqB,EAAE,UAAoC,EAAE;gBAClE,OAAO,OAAO,CAAC;oBACb,MAAM,EAAE,MAAM;oBACd,IAAI,EAAE,4BAA4B;oBAClC,KAAK,EAAE,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE;oBAC7B,OAAO,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,CAAC,WAAW,EAAE;iBACpD,CAAC,CAAC;YACL,CAAC;YACD,IAAI;gBACF,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,4BAA4B,EAAE,CAAC,CAAC;YACxE,CAAC;YACD,+DAA+D;YAC/D,MAAM,CAAC,OAAe;gBACpB,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,8BAA8B,IAAA,aAAG,EAAC,OAAO,CAAC,EAAE,EAAE,CAAC,CAAC;YAC3F,CAAC;SACF;KACF,CAAC;AACJ,CAAC;AAUD,SAAgB,yBAAyB,CAAC,MAAiC;IACzE,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC;QACxB,MAAM,IAAI,KAAK,CAAC,mDAAmD,CAAC,CAAC;IACvE,CAAC;IACD,MAAM,OAAO,GAAG,IAAA,4BAAkB,EAAC,MAAM,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC;IAC/D,OAAO;QACL,GAAG,kBAAkB,CAAC,OAAO,CAAC;QAC9B,WAAW,CAAC,SAA+B;YACzC,OAAO,yBAAyB,CAAC,EAAE,GAAG,MAAM,EAAE,GAAG,SAAS,EAAE,CAAC,CAAC;QAChE,CAAC;KACF,CAAC;AACJ,CAAC"}
+{"version":3,"file":"platform.js","sourceRoot":"","sources":["../../src/client/platform.ts"],"names":[],"mappings":";;AAwsBA,8DAWC;AAntBD,uCAMmB;AAoZnB,mFAAmF;AAEnF,SAAS,kBAAkB,CAAC,OAAkB;IAC5C,OAAO;QACL,IAAI,EAAE;YACJ,+EAA+E;YAC/E,IAAI,CAAC,SAAiC,EAAE;gBACtC,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,mBAAmB,EAAE,KAAK,EAAE,EAAE,GAAG,MAAM,EAAE,EAAE,CAAC,CAAC;YACrF,CAAC;YACD,iEAAiE;YACjE,MAAM,CAAC,OAA8B,EAAE,EAAE,cAAuB;gBAC9D,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,mBAAmB,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC;YACtF,CAAC;YACD,GAAG,CAAC,EAAU;gBACZ,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,qBAAqB,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;YAC1E,CAAC;YACD,MAAM,CAAC,EAAU,EAAE,IAA2B;gBAC5C,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,qBAAqB,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;YAClF,CAAC;YACD,4EAA4E;YAC5E,MAAM,CACJ,EAAU;gBAEV,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,qBAAqB,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;YAC7E,CAAC;YACD,6EAA6E;YAC7E,UAAU,CAAC,GAAa;gBACtB,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,+BAA+B,EAAE,IAAI,EAAE,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC;YAC3F,CAAC;YACD,+DAA+D;YAC/D,OAAO,CAAC,EAAU;gBAChB,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,qBAAqB,IAAA,aAAG,EAAC,EAAE,CAAC,UAAU,EAAE,CAAC,CAAC;YACnF,CAAC;YACD,SAAS,CAAC,EAAU;gBAClB,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,qBAAqB,IAAA,aAAG,EAAC,EAAE,CAAC,YAAY,EAAE,CAAC,CAAC;YACrF,CAAC;YACD;;;eAGG;YACH,YAAY,CACV,EAAU,EACV,OAAiC,EAAE,EACnC,cAAuB;gBAEvB,OAAO,OAAO,CAAC;oBACb,MAAM,EAAE,MAAM;oBACd,IAAI,EAAE,qBAAqB,IAAA,aAAG,EAAC,EAAE,CAAC,gBAAgB;oBAClD,IAAI;oBACJ,cAAc;iBACf,CAAC,CAAC;YACL,CAAC;YACD,mDAAmD;YACnD,UAAU,CAAC,EAAU;gBACnB,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,qBAAqB,IAAA,aAAG,EAAC,EAAE,CAAC,cAAc,EAAE,CAAC,CAAC;YACtF,CAAC;YACD,SAAS,EAAE;gBACT,IAAI,CAAC,KAAa;oBAChB,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,qBAAqB,IAAA,aAAG,EAAC,KAAK,CAAC,YAAY,EAAE,CAAC,CAAC;gBACvF,CAAC;gBACD,kFAAkF;gBAClF,MAAM,CACJ,KAAa,EACb,OAAmC,EAAE,EACrC,cAAuB;oBAEvB,OAAO,OAAO,CAAC;wBACb,MAAM,EAAE,MAAM;wBACd,IAAI,EAAE,qBAAqB,IAAA,aAAG,EAAC,KAAK,CAAC,YAAY;wBACjD,IAAI;wBACJ,cAAc;qBACf,CAAC,CAAC;gBACL,CAAC;gBACD;;;;;mBAKG;gBACH,YAAY,CACV,KAAa,EACb,UAAkB,EAClB,oBAAwD,EACxD,cAAuB;oBAEvB,MAAM,SAAS,GAAG,OAAO,oBAAoB,KAAK,QAAQ,CAAC;oBAC3D,OAAO,OAAO,CAAC;wBACb,MAAM,EAAE,MAAM;wBACd,IAAI,EAAE,qBAAqB,IAAA,aAAG,EAAC,KAAK,CAAC,cAAc,IAAA,aAAG,EAAC,UAAU,CAAC,gBAAgB;wBAClF,IAAI,EAAE,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,oBAAoB;wBAClD,cAAc,EAAE,SAAS,CAAC,CAAC,CAAC,oBAAoB,CAAC,CAAC,CAAC,cAAc;qBAClE,CAAC,CAAC;gBACL,CAAC;aACF;YACD,yEAAyE;YACzE,QAAQ,CAAC,EAAU,EAAE,cAAuB;gBAC1C,OAAO,OAAO,CAAC;oBACb,MAAM,EAAE,MAAM;oBACd,IAAI,EAAE,qBAAqB,IAAA,aAAG,EAAC,EAAE,CAAC,WAAW;oBAC7C,cAAc;iBACf,CAAC,CAAC;YACL,CAAC;YACD,sDAAsD;YACtD,cAAc,CACZ,aAAqB,EACrB,cAAuB;gBAEvB,OAAO,OAAO,CAAC;oBACb,MAAM,EAAE,MAAM;oBACd,IAAI,EAAE,mCAAmC;oBACzC,IAAI,EAAE,EAAE,cAAc,EAAE,aAAa,EAAE;oBACvC,cAAc;iBACf,CAAC,CAAC;YACL,CAAC;YACD,+EAA+E;YAC/E,KAAK,CAAC,UAAkB,EAAE,cAAuB;gBAC/C,OAAO,OAAO,CAAC;oBACb,MAAM,EAAE,MAAM;oBACd,IAAI,EAAE,yBAAyB;oBAC/B,IAAI,EAAE,EAAE,WAAW,EAAE,UAAU,EAAE;oBACjC,cAAc;iBACf,CAAC,CAAC;YACL,CAAC;SACF;QACD,eAAe,EAAE;YACf,8FAA8F;YAC9F,MAAM,CAAC,OAAiC,EAAE,EAAE,cAAuB;gBACjE,OAAO,OAAO,CAAC;oBACb,MAAM,EAAE,MAAM;oBACd,IAAI,EAAE,+BAA+B;oBACrC,IAAI;oBACJ,cAAc;iBACf,CAAC,CAAC;YACL,CAAC;SACF;QACD,oEAAoE;QACpE,WAAW,EAAE;YACX,IAAI;gBACF,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,4BAA4B,EAAE,CAAC,CAAC;YACxE,CAAC;YACD,sFAAsF;YACtF,MAAM,CAAC,IAA0B,EAAE,cAAuB;gBACxD,OAAO,OAAO,CAAC;oBACb,MAAM,EAAE,MAAM;oBACd,IAAI,EAAE,4BAA4B;oBAClC,IAAI;oBACJ,cAAc;iBACf,CAAC,CAAC;YACL,CAAC;YACD,GAAG,CAAC,EAAU;gBACZ,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,8BAA8B,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;YACnF,CAAC;YACD,0DAA0D;YAC1D,MAAM,CAAC,EAAU,EAAE,IAA0B;gBAC3C,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,8BAA8B,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;YAC3F,CAAC;YACD,+CAA+C;YAC/C,MAAM,CAAC,EAAU;gBACf,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,8BAA8B,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;YACtF,CAAC;YACD;;;eAGG;YACH,YAAY,CAAC,EAAU,EAAE,IAAiC;gBACxD,OAAO,OAAO,CAAC;oBACb,MAAM,EAAE,MAAM;oBACd,IAAI,EAAE,8BAA8B,IAAA,aAAG,EAAC,EAAE,CAAC,gBAAgB;oBAC3D,IAAI;iBACL,CAAC,CAAC;YACL,CAAC;YACD,gEAAgE;YAChE,yBAAyB,CACvB,EAAU,EACV,QAAoC,EAAE;gBAEtC,OAAO,OAAO,CAAC;oBACb,MAAM,EAAE,KAAK;oBACb,IAAI,EAAE,8BAA8B,IAAA,aAAG,EAAC,EAAE,CAAC,yBAAyB;oBACpE,KAAK,EAAE,EAAE,GAAG,KAAK,EAAE;iBACpB,CAAC,CAAC;YACL,CAAC;YACD,kFAAkF;YAClF,qBAAqB,CAAC,EAAU;gBAC9B,OAAO,OAAO,CAAC;oBACb,MAAM,EAAE,MAAM;oBACd,IAAI,EAAE,8BAA8B,IAAA,aAAG,EAAC,EAAE,CAAC,0BAA0B;iBACtE,CAAC,CAAC;YACL,CAAC;YACD,mGAAmG;YACnG,SAAS,CAAC,EAAU;gBAClB,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,8BAA8B,IAAA,aAAG,EAAC,EAAE,CAAC,YAAY,EAAE,CAAC,CAAC;YAC7F,CAAC;YACD;;;eAGG;YACH,SAAS,CAAC,EAAU,EAAE,KAAa;gBACjC,OAAO,OAAO,CAAC;oBACb,MAAM,EAAE,KAAK;oBACb,IAAI,EAAE,8BAA8B,IAAA,aAAG,EAAC,EAAE,CAAC,QAAQ;oBACnD,KAAK,EAAE,EAAE,KAAK,EAAE;iBACjB,CAAC,CAAC;YACL,CAAC;YACD,oGAAoG;YACpG,WAAW,CAAC,EAAU,EAAE,OAAe;gBACrC,OAAO,OAAO,CAAC;oBACb,MAAM,EAAE,QAAQ;oBAChB,IAAI,EAAE,8BAA8B,IAAA,aAAG,EAAC,EAAE,CAAC,WAAW,IAAA,aAAG,EAAC,OAAO,CAAC,EAAE;iBACrE,CAAC,CAAC;YACL,CAAC;YACD,sFAAsF;YACtF,UAAU,CAAC,EAAU,EAAE,IAAuB;gBAC5C,OAAO,OAAO,CAAC;oBACb,MAAM,EAAE,MAAM;oBACd,IAAI,EAAE,8BAA8B,IAAA,aAAG,EAAC,EAAE,CAAC,cAAc;oBACzD,IAAI;iBACL,CAAC,CAAC;YACL,CAAC;YACD;;;;eAIG;YACH,mBAAmB,CAAC,EAAU,EAAE,IAAiC;gBAC/D,OAAO,OAAO,CAAC;oBACb,MAAM,EAAE,MAAM;oBACd,IAAI,EAAE,8BAA8B,IAAA,aAAG,EAAC,EAAE,CAAC,wBAAwB;oBACnE,IAAI;iBACL,CAAC,CAAC;YACL,CAAC;YACD,yEAAyE;YACzE,aAAa,CAAC,MAAmB;gBAC/B,OAAO,OAAO,CAAC;oBACb,MAAM,EAAE,MAAM;oBACd,IAAI,EAAE,2CAA2C;oBACjD,IAAI,EAAE,EAAE,MAAM,EAAE;iBACjB,CAAC,CAAC;YACL,CAAC;SACF;QACD,2EAA2E;QAC3E,gBAAgB,EAAE;YAChB,yBAAyB;YACzB,GAAG;gBACD,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,iCAAiC,EAAE,CAAC,CAAC;YAC7E,CAAC;YACD,4EAA4E;YAC5E,GAAG,CAAC,IAA6B;gBAC/B,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,iCAAiC,EAAE,IAAI,EAAE,CAAC,CAAC;YACnF,CAAC;YACD,6CAA6C;YAC7C,MAAM,CAAC,IAA+B;gBACpC,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,iCAAiC,EAAE,IAAI,EAAE,CAAC,CAAC;YACrF,CAAC;YACD,MAAM;gBACJ,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,iCAAiC,EAAE,CAAC,CAAC;YAChF,CAAC;YACD,mDAAmD;YACnD,MAAM;gBACJ,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,wCAAwC,EAAE,CAAC,CAAC;YACrF,CAAC;SACF;QACD,uEAAuE;QACvE,eAAe,EAAE;YACf,IAAI,CAAC,SAAoC,EAAE;gBAMzC,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,+BAA+B,EAAE,KAAK,EAAE,EAAE,GAAG,MAAM,EAAE,EAAE,CAAC,CAAC;YACjG,CAAC;SACF;QACD,yFAAyF;QACzF,YAAY,EAAE;YACZ,MAAM,CAAC,IAAqB,EAAE,UAAoC,EAAE;gBAClE,OAAO,OAAO,CAAC;oBACb,MAAM,EAAE,MAAM;oBACd,IAAI,EAAE,4BAA4B;oBAClC,KAAK,EAAE,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE;oBAC7B,OAAO,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,CAAC,WAAW,EAAE;iBACpD,CAAC,CAAC;YACL,CAAC;YACD,IAAI;gBACF,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,4BAA4B,EAAE,CAAC,CAAC;YACxE,CAAC;YACD,+DAA+D;YAC/D,MAAM,CAAC,OAAe;gBACpB,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,8BAA8B,IAAA,aAAG,EAAC,OAAO,CAAC,EAAE,EAAE,CAAC,CAAC;YAC3F,CAAC;SACF;KACF,CAAC;AACJ,CAAC;AAUD,SAAgB,yBAAyB,CAAC,MAAiC;IACzE,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC;QACxB,MAAM,IAAI,KAAK,CAAC,mDAAmD,CAAC,CAAC;IACvE,CAAC;IACD,MAAM,OAAO,GAAG,IAAA,4BAAkB,EAAC,MAAM,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC;IAC/D,OAAO;QACL,GAAG,kBAAkB,CAAC,OAAO,CAAC;QAC9B,WAAW,CAAC,SAA+B;YACzC,OAAO,yBAAyB,CAAC,EAAE,GAAG,MAAM,EAAE,GAAG,SAAS,EAAE,CAAC,CAAC;QAChE,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/client/webhooks.d.ts

@@ -8,6 +8,12 @@ export interface WebhookEndpoint {
     /** Start of the current failure streak (epoch ms), or null when the last delivery succeeded. */
     failing_since?: number | null;
     disabled_at: number | null;
+    /**
+     * While a secret rotation overlap is open: when the previous secret stops
+     * signing deliveries (epoch ms). Until then every delivery carries two
+     * signatures, one per secret. Null otherwise.
+     */
+    previous_secret_expires_at?: number | null;
     created_at: number;
 }
 /** Create reveals the signing secret (`whsec_...`) exactly once. */
@@ -80,8 +86,21 @@ export interface WebhookSigningSecret {
     object: 'webhook_secret';
     /** The `whsec_...` signing secret. */
     secret: string;
+    /** On a rotation: the overlap applied, in seconds. */
+    overlap_seconds?: number;
+    /** On a rotation: when the previous secret stops signing deliveries (epoch ms), or null when it already has. */
+    previous_secret_expires_at?: number | null;
     warning?: string;
 }
+export interface RotateWebhookSecretBody {
+    /**
+     * How long the previous secret keeps signing deliveries (as a second
+     * `atlas-signature` entry), in seconds. Default 0: it stops at once. At most
+     * 604800 (7 days). Set it only once every receiver verifies with a verifier
+     * that accepts several signatures (this package 0.9.1+).
+     */
+    overlap_seconds?: number;
+}
 /** A queued delivery (from `test` or `redeliver`). */
 export interface WebhookDeliveryQueued {
     object: 'webhook_delivery';
@@ -101,8 +120,12 @@ export declare function webhooksResource(request: RequestFn): {
         update(id: string, body: UpdateWebhookEndpointBody): Promise<WebhookEndpoint>;
         /** Show the current signing secret again. Audited. */
         revealSecret(id: string): Promise<WebhookSigningSecret>;
-        /** Rotate the signing secret; the new one is revealed exactly once. */
-        rotateSecret(id: string): Promise<WebhookSigningSecret>;
+        /**
+         * Rotate the signing secret; the new one is revealed exactly once. By
+         * default the old secret stops signing at once; for `overlap_seconds`
+         * every delivery is signed with both, so a verifier holding either passes.
+         */
+        rotateSecret(id: string, body?: RotateWebhookSecretBody): Promise<WebhookSigningSecret>;
         /** Send a synthetic `webhook.test` event to this endpoint only. */
         test(id: string): Promise<WebhookDeliveryQueued>;
         /** Redeliver a past event as a fresh attempt (409 once past its retention). */

package/dist/client/webhooks.js

@@ -16,9 +16,13 @@ function webhooksResource(request) {
             revealSecret(id) {
                 return request({ method: 'POST', path: `/v1/webhook_endpoints/${(0, request_1.enc)(id)}/reveal_secret` });
             },
-            /** Rotate the signing secret; the new one is revealed exactly once. */
-            rotateSecret(id) {
-                return request({ method: 'POST', path: `/v1/webhook_endpoints/${(0, request_1.enc)(id)}/rotate_secret` });
+            /**
+             * Rotate the signing secret; the new one is revealed exactly once. By
+             * default the old secret stops signing at once; for `overlap_seconds`
+             * every delivery is signed with both, so a verifier holding either passes.
+             */
+            rotateSecret(id, body) {
+                return request({ method: 'POST', path: `/v1/webhook_endpoints/${(0, request_1.enc)(id)}/rotate_secret`, body });
             },
             /** Send a synthetic `webhook.test` event to this endpoint only. */
             test(id) {

package/dist/client/webhooks.js.map

@@ -1 +1 @@
-{"version":3,"file":"webhooks.js","sourceRoot":"","sources":["../../src/client/webhooks.ts"],"names":[],"mappings":";;AA2GA,4CA4DC;AAvKD,uCAAgD;AA2GhD,SAAgB,gBAAgB,CAAC,OAAkB;IACjD,OAAO;QACL,SAAS,EAAE;YACT,IAAI;gBACF,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,uBAAuB,EAAE,CAAC,CAAC;YACnE,CAAC;YACD,wEAAwE;YACxE,MAAM,CAAC,EAAU,EAAE,IAA+B;gBAChD,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,yBAAyB,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;YACtF,CAAC;YACD,sDAAsD;YACtD,YAAY,CAAC,EAAU;gBACrB,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,yBAAyB,IAAA,aAAG,EAAC,EAAE,CAAC,gBAAgB,EAAE,CAAC,CAAC;YAC7F,CAAC;YACD,uEAAuE;YACvE,YAAY,CAAC,EAAU;gBACrB,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,yBAAyB,IAAA,aAAG,EAAC,EAAE,CAAC,gBAAgB,EAAE,CAAC,CAAC;YAC7F,CAAC;YACD,mEAAmE;YACnE,IAAI,CAAC,EAAU;gBACb,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,yBAAyB,IAAA,aAAG,EAAC,EAAE,CAAC,OAAO,EAAE,CAAC,CAAC;YACpF,CAAC;YACD,+EAA+E;YAC/E,SAAS,CAAC,EAAU,EAAE,UAAkB;gBACtC,OAAO,OAAO,CAAC;oBACb,MAAM,EAAE,MAAM;oBACd,IAAI,EAAE,yBAAyB,IAAA,aAAG,EAAC,EAAE,CAAC,eAAe,IAAA,aAAG,EAAC,UAAU,CAAC,YAAY;iBACjF,CAAC,CAAC;YACL,CAAC;YACD,MAAM,CACJ,IAA+B,EAC/B,cAAuB;gBAEvB,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,uBAAuB,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC;YAC1F,CAAC;YACD,MAAM,CACJ,EAAU;gBAEV,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,yBAAyB,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;YACjF,CAAC;SACF;QACD,oCAAoC;QACpC,UAAU,CACR,EAAU,EACV,SAAsC,EAAE;YAExC,OAAO,OAAO,CAAC;gBACb,MAAM,EAAE,KAAK;gBACb,IAAI,EAAE,yBAAyB,IAAA,aAAG,EAAC,EAAE,CAAC,aAAa;gBACnD,KAAK,EAAE,EAAE,GAAG,MAAM,EAAE;aACrB,CAAC,CAAC;QACL,CAAC;QACD,8DAA8D;QAC9D,SAAS,CAAC,UAAkB,EAAE,UAAkB;YAC9C,OAAO,OAAO,CAAC;gBACb,MAAM,EAAE,MAAM;gBACd,IAAI,EAAE,yBAAyB,IAAA,aAAG,EAAC,UAAU,CAAC,eAAe,IAAA,aAAG,EAAC,UAAU,CAAC,YAAY;aACzF,CAAC,CAAC;QACL,CAAC;KACF,CAAC;AACJ,CAAC"}
+{"version":3,"file":"webhooks.js","sourceRoot":"","sources":["../../src/client/webhooks.ts"],"names":[],"mappings":";;AA+HA,4CAgEC;AA/LD,uCAAgD;AA+HhD,SAAgB,gBAAgB,CAAC,OAAkB;IACjD,OAAO;QACL,SAAS,EAAE;YACT,IAAI;gBACF,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,uBAAuB,EAAE,CAAC,CAAC;YACnE,CAAC;YACD,wEAAwE;YACxE,MAAM,CAAC,EAAU,EAAE,IAA+B;gBAChD,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,yBAAyB,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;YACtF,CAAC;YACD,sDAAsD;YACtD,YAAY,CAAC,EAAU;gBACrB,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,yBAAyB,IAAA,aAAG,EAAC,EAAE,CAAC,gBAAgB,EAAE,CAAC,CAAC;YAC7F,CAAC;YACD;;;;eAIG;YACH,YAAY,CAAC,EAAU,EAAE,IAA8B;gBACrD,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,yBAAyB,IAAA,aAAG,EAAC,EAAE,CAAC,gBAAgB,EAAE,IAAI,EAAE,CAAC,CAAC;YACnG,CAAC;YACD,mEAAmE;YACnE,IAAI,CAAC,EAAU;gBACb,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,yBAAyB,IAAA,aAAG,EAAC,EAAE,CAAC,OAAO,EAAE,CAAC,CAAC;YACpF,CAAC;YACD,+EAA+E;YAC/E,SAAS,CAAC,EAAU,EAAE,UAAkB;gBACtC,OAAO,OAAO,CAAC;oBACb,MAAM,EAAE,MAAM;oBACd,IAAI,EAAE,yBAAyB,IAAA,aAAG,EAAC,EAAE,CAAC,eAAe,IAAA,aAAG,EAAC,UAAU,CAAC,YAAY;iBACjF,CAAC,CAAC;YACL,CAAC;YACD,MAAM,CACJ,IAA+B,EAC/B,cAAuB;gBAEvB,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,uBAAuB,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC;YAC1F,CAAC;YACD,MAAM,CACJ,EAAU;gBAEV,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,yBAAyB,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;YACjF,CAAC;SACF;QACD,oCAAoC;QACpC,UAAU,CACR,EAAU,EACV,SAAsC,EAAE;YAExC,OAAO,OAAO,CAAC;gBACb,MAAM,EAAE,KAAK;gBACb,IAAI,EAAE,yBAAyB,IAAA,aAAG,EAAC,EAAE,CAAC,aAAa;gBACnD,KAAK,EAAE,EAAE,GAAG,MAAM,EAAE;aACrB,CAAC,CAAC;QACL,CAAC;QACD,8DAA8D;QAC9D,SAAS,CAAC,UAAkB,EAAE,UAAkB;YAC9C,OAAO,OAAO,CAAC;gBACb,MAAM,EAAE,MAAM;gBACd,IAAI,EAAE,yBAAyB,IAAA,aAAG,EAAC,UAAU,CAAC,eAAe,IAAA,aAAG,EAAC,UAAU,CAAC,YAAY;aACzF,CAAC,CAAC;QACL,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/webhooks.js

@@ -11,7 +11,9 @@ const node_crypto_1 = require("node:crypto");
  * and `atlas-timestamp` (epoch ms) headers. The timestamp is INSIDE the signed
  * material — a header-only timestamp would let an attacker replay a captured
  * body under a fresh timestamp — and a delivery older than 5 minutes is rejected
- * so a captured request cannot be replayed later.
+ * so a captured request cannot be replayed later. The header may carry several
+ * space-separated `v1,<base64>` entries (one per secret while a secret rotates
+ * with an overlap); the delivery verifies when any one of them matches.
  *
  * The signing logic is identical to the server's (`@atlas/core` `verifyWebhook`),
  * reimplemented here with zero dependencies so an integrator gets a first-party
@@ -41,6 +43,24 @@ function readHeader(headers, name) {
     const found = hit ? bag[hit] : undefined;
     return Array.isArray(found) ? found[0] : found;
 }
+/**
+ * The `v1` signatures in an `atlas-signature` header. The header carries one
+ * `v1,<base64>` entry, or several separated by spaces (while an endpoint
+ * secret rotates, Atlas signs with the old and the new secret). Entries of
+ * another version are skipped, so a future scheme never breaks this verifier.
+ */
+function parseSignatures(header) {
+    const out = [];
+    for (const entry of header.trim().split(/\s+/)) {
+        const comma = entry.indexOf(',');
+        if (comma <= 0)
+            continue;
+        const value = entry.slice(comma + 1);
+        if (entry.slice(0, comma) === SIGNATURE_VERSION && value)
+            out.push(value);
+    }
+    return out;
+}
 /**
  * Verify and parse an Atlas webhook. Returns `{ verified, reason?, event?,
  * deliveryId?, timestamp? }` — it never throws on a bad signature (a thrown
@@ -67,8 +87,8 @@ function verifyWebhook(input) {
     const signature = readHeader(input.headers, exports.ATLAS_WEBHOOK_HEADERS.signature);
     if (!id || !timestampRaw || !signature)
         return { verified: false, reason: 'missing_headers' };
-    const [version, provided] = signature.split(',');
-    if (version !== SIGNATURE_VERSION || !provided)
+    const provided = parseSignatures(signature);
+    if (provided.length === 0)
         return { verified: false, reason: 'malformed_signature' };
     const timestamp = Number(timestampRaw);
     const now = (input.now ?? new Date()).getTime();
@@ -78,10 +98,15 @@ function verifyWebhook(input) {
     if (!Number.isFinite(timestamp) || Math.abs(now - timestamp) > tolerance) {
         return { verified: false, reason: 'stale_timestamp' };
     }
-    const expected = (0, node_crypto_1.createHmac)('sha256', input.secret).update(`${id}.${timestamp}.${raw}`).digest('base64');
-    const a = Buffer.from(provided);
-    const b = Buffer.from(expected);
-    if (a.length !== b.length || !(0, node_crypto_1.timingSafeEqual)(a, b))
+    const expected = Buffer.from((0, node_crypto_1.createHmac)('sha256', input.secret).update(`${id}.${timestamp}.${raw}`).digest('base64'));
+    // Compare every entry (no early exit), each in constant time.
+    let matched = false;
+    for (const candidate of provided) {
+        const a = Buffer.from(candidate);
+        if (a.length === expected.length && (0, node_crypto_1.timingSafeEqual)(a, expected))
+            matched = true;
+    }
+    if (!matched)
         return { verified: false, reason: 'signature_mismatch' };
     try {
         return { verified: true, event: JSON.parse(raw), deliveryId: id, timestamp };

package/dist/webhooks.js.map

@@ -1 +1 @@
-{"version":3,"file":"webhooks.js","sourceRoot":"","sources":["../src/webhooks.ts"],"names":[],"mappings":";;;AAmGA,sCA8BC;AAjID,6CAA0D;AAE1D;;;;;;;;;;;;;;GAcG;AAEH,MAAM,iBAAiB,GAAG,IAAI,CAAC;AAC/B,MAAM,mBAAmB,GAAG,CAAC,GAAG,MAAM,CAAC;AAEvC,yFAAyF;AAC5E,QAAA,qBAAqB,GAAG;IACnC,EAAE,EAAE,UAAU;IACd,SAAS,EAAE,iBAAiB;IAC5B,SAAS,EAAE,iBAAiB;CACpB,CAAC;AAwBX,iFAAiF;AACjF,SAAS,UAAU,CAAC,OAAoB,EAAE,IAAY;IACpD,IAAI,OAAQ,OAAmB,CAAC,GAAG,KAAK,UAAU,EAAE,CAAC;QACnD,OAAQ,OAAmB,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,SAAS,CAAC;IACrD,CAAC;IACD,MAAM,GAAG,GAAG,OAAwD,CAAC;IACrE,MAAM,MAAM,GAAG,GAAG,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC;IACpD,MAAM,CAAC,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;IACrD,IAAI,CAAC,KAAK,SAAS;QAAE,OAAO,CAAC,CAAC;IAC9B,wEAAwE;IACxE,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,KAAK,IAAI,CAAC,CAAC;IACnE,MAAM,KAAK,GAAG,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IACzC,OAAO,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;AACjD,CAAC;AAiBD;;;;;;;;;;;;;;;;;;GAkBG;AACH,SAAgB,aAAa,CAAc,KAAyB;IAClE,MAAM,GAAG,GAAG,OAAO,KAAK,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IACtF,MAAM,EAAE,GAAG,UAAU,CAAC,KAAK,CAAC,OAAO,EAAE,6BAAqB,CAAC,EAAE,CAAC,CAAC;IAC/D,MAAM,YAAY,GAAG,UAAU,CAAC,KAAK,CAAC,OAAO,EAAE,6BAAqB,CAAC,SAAS,CAAC,CAAC;IAChF,MAAM,SAAS,GAAG,UAAU,CAAC,KAAK,CAAC,OAAO,EAAE,6BAAqB,CAAC,SAAS,CAAC,CAAC;IAC7E,IAAI,CAAC,EAAE,IAAI,CAAC,YAAY,IAAI,CAAC,SAAS;QAAE,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,iBAAiB,EAAE,CAAC;IAE9F,MAAM,CAAC,OAAO,EAAE,QAAQ,CAAC,GAAG,SAAS,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACjD,IAAI,OAAO,KAAK,iBAAiB,IAAI,CAAC,QAAQ;QAAE,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,qBAAqB,EAAE,CAAC;IAE1G,MAAM,SAAS,GAAG,MAAM,CAAC,YAAY,CAAC,CAAC;IACvC,MAAM,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,IAAI,IAAI,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC;IAChD,MAAM,SAAS,GAAG,KAAK,CAAC,WAAW,IAAI,mBAAmB,CAAC;IAC3D,4EAA4E;IAC5E,2EAA2E;IAC3E,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,IAAI,CAAC,GAAG,CAAC,GAAG,GAAG,SAAS,CAAC,GAAG,SAAS,EAAE,CAAC;QACzE,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,iBAAiB,EAAE,CAAC;IACxD,CAAC;IAED,MAAM,QAAQ,GAAG,IAAA,wBAAU,EAAC,QAAQ,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,GAAG,EAAE,IAAI,SAAS,IAAI,GAAG,EAAE,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IACzG,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IAChC,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IAChC,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM,IAAI,CAAC,IAAA,6BAAe,EAAC,CAAC,EAAE,CAAC,CAAC;QAAE,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,oBAAoB,EAAE,CAAC;IAE9G,IAAI,CAAC;QACH,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG,CAAM,EAAE,UAAU,EAAE,EAAE,EAAE,SAAS,EAAE,CAAC;IACpF,CAAC;IAAC,MAAM,CAAC;QACP,qFAAqF;QACrF,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,UAAU,EAAE,EAAE,EAAE,SAAS,EAAE,CAAC;IACvD,CAAC;AACH,CAAC"}
+{"version":3,"file":"webhooks.js","sourceRoot":"","sources":["../src/webhooks.ts"],"names":[],"mappings":";;;AAsHA,sCAoCC;AA1JD,6CAA0D;AAE1D;;;;;;;;;;;;;;;;GAgBG;AAEH,MAAM,iBAAiB,GAAG,IAAI,CAAC;AAC/B,MAAM,mBAAmB,GAAG,CAAC,GAAG,MAAM,CAAC;AAEvC,yFAAyF;AAC5E,QAAA,qBAAqB,GAAG;IACnC,EAAE,EAAE,UAAU;IACd,SAAS,EAAE,iBAAiB;IAC5B,SAAS,EAAE,iBAAiB;CACpB,CAAC;AAwBX,iFAAiF;AACjF,SAAS,UAAU,CAAC,OAAoB,EAAE,IAAY;IACpD,IAAI,OAAQ,OAAmB,CAAC,GAAG,KAAK,UAAU,EAAE,CAAC;QACnD,OAAQ,OAAmB,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,SAAS,CAAC;IACrD,CAAC;IACD,MAAM,GAAG,GAAG,OAAwD,CAAC;IACrE,MAAM,MAAM,GAAG,GAAG,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC;IACpD,MAAM,CAAC,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;IACrD,IAAI,CAAC,KAAK,SAAS;QAAE,OAAO,CAAC,CAAC;IAC9B,wEAAwE;IACxE,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,KAAK,IAAI,CAAC,CAAC;IACnE,MAAM,KAAK,GAAG,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IACzC,OAAO,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;AACjD,CAAC;AAED;;;;;GAKG;AACH,SAAS,eAAe,CAAC,MAAc;IACrC,MAAM,GAAG,GAAa,EAAE,CAAC;IACzB,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC;QAC/C,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACjC,IAAI,KAAK,IAAI,CAAC;YAAE,SAAS;QACzB,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC;QACrC,IAAI,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,KAAK,iBAAiB,IAAI,KAAK;YAAE,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC5E,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAiBD;;;;;;;;;;;;;;;;;;GAkBG;AACH,SAAgB,aAAa,CAAc,KAAyB;IAClE,MAAM,GAAG,GAAG,OAAO,KAAK,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IACtF,MAAM,EAAE,GAAG,UAAU,CAAC,KAAK,CAAC,OAAO,EAAE,6BAAqB,CAAC,EAAE,CAAC,CAAC;IAC/D,MAAM,YAAY,GAAG,UAAU,CAAC,KAAK,CAAC,OAAO,EAAE,6BAAqB,CAAC,SAAS,CAAC,CAAC;IAChF,MAAM,SAAS,GAAG,UAAU,CAAC,KAAK,CAAC,OAAO,EAAE,6BAAqB,CAAC,SAAS,CAAC,CAAC;IAC7E,IAAI,CAAC,EAAE,IAAI,CAAC,YAAY,IAAI,CAAC,SAAS;QAAE,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,iBAAiB,EAAE,CAAC;IAE9F,MAAM,QAAQ,GAAG,eAAe,CAAC,SAAS,CAAC,CAAC;IAC5C,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,qBAAqB,EAAE,CAAC;IAErF,MAAM,SAAS,GAAG,MAAM,CAAC,YAAY,CAAC,CAAC;IACvC,MAAM,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,IAAI,IAAI,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC;IAChD,MAAM,SAAS,GAAG,KAAK,CAAC,WAAW,IAAI,mBAAmB,CAAC;IAC3D,4EAA4E;IAC5E,2EAA2E;IAC3E,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,IAAI,CAAC,GAAG,CAAC,GAAG,GAAG,SAAS,CAAC,GAAG,SAAS,EAAE,CAAC;QACzE,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,iBAAiB,EAAE,CAAC;IACxD,CAAC;IAED,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAC1B,IAAA,wBAAU,EAAC,QAAQ,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,GAAG,EAAE,IAAI,SAAS,IAAI,GAAG,EAAE,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CACxF,CAAC;IACF,8DAA8D;IAC9D,IAAI,OAAO,GAAG,KAAK,CAAC;IACpB,KAAK,MAAM,SAAS,IAAI,QAAQ,EAAE,CAAC;QACjC,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QACjC,IAAI,CAAC,CAAC,MAAM,KAAK,QAAQ,CAAC,MAAM,IAAI,IAAA,6BAAe,EAAC,CAAC,EAAE,QAAQ,CAAC;YAAE,OAAO,GAAG,IAAI,CAAC;IACnF,CAAC;IACD,IAAI,CAAC,OAAO;QAAE,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,oBAAoB,EAAE,CAAC;IAEvE,IAAI,CAAC;QACH,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG,CAAM,EAAE,UAAU,EAAE,EAAE,EAAE,SAAS,EAAE,CAAC;IACpF,CAAC;IAAC,MAAM,CAAC;QACP,qFAAqF;QACrF,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,UAAU,EAAE,EAAE,EAAE,SAAS,EAAE,CAAC;IACvD,CAAC;AACH,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@atlasauth/backend",
-  "version": "0.9.0",
+  "version": "0.10.0",
   "main": "./dist/index.js",
   "types": "./dist/index.d.ts",
   "dependencies": {