@atlasauth/js 0.24.0 → 0.25.0

package/CHANGELOG.md

@@ -1,6 +1,14 @@
 # @atlasauth/js changelog
 
-## Unreleased
+## 0.25.0 — 2026-10-27
+
+- `signInWithSrp` and `srpClientStart`: SRP-6a password sign-in (RFC 5054, 3072-bit group, SHA-256), so the password never leaves the browser.
+- `listAuthorizedApps`, `disconnectAuthorizedApp` and `revokeAppGrant`: the apps a user authorized, with the OpenID Grant Management grants each holds.
+- Identity governance for the signed-in user: `listAccessCatalog`, `requestAccess`, `listMyAccess`, `listMyAccessRequests`, `getAccessRequest`, `cancelAccessRequest`, `listPendingApprovals`, `decideAccessRequest`, `listAccessReviews`, `decideAccessReview`, `listAccessDelegations`, `delegateApprovals` and `endDelegation`.
+- Connections: `revokeMyConnection` and `revokeOrganizationConnection` return `provider_revoked` (true, false or `'unsupported'`), `provider_status`, `provider_error` and `local_cleared`; `AppConnection.last_error` carries the provider's code and HTTP status and `refresh_failures`.
+- Connections: `setOrganizationConnectionCredentials` takes every credential field (bearer token, basic username and password, custom header value, HMAC secret, signing key, OAuth 1.0a keys), `expiresAt` and `config`; `AppConnection.kind` lists the new kinds and carries `secret_expires_at`. There is still no call that reads a credential back.
+- Connections: `connectMyConnection`, `connectOrganizationConnection`, `revokeOrganizationConnection`, `listOrganizationOAuthClients`, `setOrganizationOAuthClient`, `deleteOrganizationOAuthClient`; `AppConnection` carries `environment`, `external_id`, `host_params`, `scopes`, `metadata` and `last_error`, and its status adds `revoked` and `error`.
+- User-managed access for resource owners: `listUmaResources`, `shareUmaResource`, `unshareUmaResource`, `listUmaAccessRequests` and `decideUmaAccessRequest`, with a typed `UmaError`, plus `umaClaimsUrl` and `parseUmaClaimsRedirect` for the claims-gathering redirect.
 
 ## 0.24.0 — 2026-10-26
 

package/dist/authorized-apps.d.ts

@@ -0,0 +1,42 @@
+import type { FapiClient } from './fapi';
+/**
+ * The signed-in user's authorized apps: the third-party OAuth clients they signed
+ * in to with this application, and the grants (OpenID Grant Management `grant_id`s)
+ * each holds. Cookie-authenticated through the {@link FapiClient}
+ * (`/v1/client/me/oauth_grants`, `/v1/client/me/managed_grants`).
+ */
+/** One grant an app holds for the user; withdrawing it ends every token issued under it. */
+export interface AppGrant {
+    id: string;
+    scopes: string[];
+    /** The API the grant covers, when it is for one. */
+    resource: string | null;
+    created_at: number;
+    updated_at: number;
+}
+export interface AuthorizedApp {
+    object: 'oauth_grant';
+    /** The remembered consent's id; pass it to {@link disconnectAuthorizedApp}. */
+    id: string;
+    client_id: string | null;
+    name: string;
+    logo_url: string | null;
+    first_party: boolean;
+    scopes: string[];
+    grants: AppGrant[];
+    created_at: number;
+}
+/** A refused request; `code` is the server's stable error code. */
+export declare class AuthorizedAppsError extends Error {
+    readonly status: number;
+    readonly code: string;
+    constructor(status: number, code: string, message: string);
+}
+/** The apps this user authorized, each with the grants it holds. */
+export declare function listAuthorizedApps(client: FapiClient): Promise<AuthorizedApp[]>;
+/** Forget an app entirely: its consent, every grant and every live token. */
+export declare function disconnectAuthorizedApp(client: FapiClient, consentId: string): Promise<void>;
+/** Withdraw one grant of an app, leaving its other grants alone. Every token issued under it ends at once. */
+export declare function revokeAppGrant(client: FapiClient, grantId: string): Promise<{
+    tokensEnded: number;
+}>;

package/dist/authorized-apps.js

@@ -0,0 +1,41 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AuthorizedAppsError = void 0;
+exports.listAuthorizedApps = listAuthorizedApps;
+exports.disconnectAuthorizedApp = disconnectAuthorizedApp;
+exports.revokeAppGrant = revokeAppGrant;
+/** A refused request; `code` is the server's stable error code. */
+class AuthorizedAppsError extends Error {
+    status;
+    code;
+    constructor(status, code, message) {
+        super(message);
+        this.name = 'AuthorizedAppsError';
+        this.status = status;
+        this.code = code;
+    }
+}
+exports.AuthorizedAppsError = AuthorizedAppsError;
+async function call(client, path, init) {
+    const res = await client.request(path, init);
+    if (!res.ok || !res.data) {
+        const first = res.errors[0];
+        throw new AuthorizedAppsError(res.status, first?.code ?? 'UNKNOWN', first?.message ?? 'The request failed.');
+    }
+    return res.data;
+}
+/** The apps this user authorized, each with the grants it holds. */
+async function listAuthorizedApps(client) {
+    const body = await call(client, '/v1/client/me/oauth_grants', { method: 'GET' });
+    return (body.data ?? []).map((app) => ({ ...app, grants: app.grants ?? [] }));
+}
+/** Forget an app entirely: its consent, every grant and every live token. */
+async function disconnectAuthorizedApp(client, consentId) {
+    await call(client, `/v1/client/me/oauth_grants/${encodeURIComponent(consentId)}`, { method: 'DELETE' });
+}
+/** Withdraw one grant of an app, leaving its other grants alone. Every token issued under it ends at once. */
+async function revokeAppGrant(client, grantId) {
+    const body = await call(client, `/v1/client/me/managed_grants/${encodeURIComponent(grantId)}`, { method: 'DELETE' });
+    return { tokensEnded: body.tokens_ended ?? 0 };
+}
+//# sourceMappingURL=authorized-apps.js.map

package/dist/authorized-apps.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"authorized-apps.js","sourceRoot":"","sources":["../src/authorized-apps.ts"],"names":[],"mappings":";;;AAsDA,gDAGC;AAGD,0DAEC;AAGD,wCAGC;AApCD,mEAAmE;AACnE,MAAa,mBAAoB,SAAQ,KAAK;IACnC,MAAM,CAAS;IACf,IAAI,CAAS;IACtB,YAAY,MAAc,EAAE,IAAY,EAAE,OAAe;QACvD,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,qBAAqB,CAAC;QAClC,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QACrB,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;IACnB,CAAC;CACF;AATD,kDASC;AAED,KAAK,UAAU,IAAI,CAAI,MAAkB,EAAE,IAAY,EAAE,IAAiB;IACxE,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,OAAO,CAAI,IAAI,EAAE,IAAI,CAAC,CAAC;IAChD,IAAI,CAAC,GAAG,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;QACzB,MAAM,KAAK,GAAG,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;QAC5B,MAAM,IAAI,mBAAmB,CAAC,GAAG,CAAC,MAAM,EAAE,KAAK,EAAE,IAAI,IAAI,SAAS,EAAE,KAAK,EAAE,OAAO,IAAI,qBAAqB,CAAC,CAAC;IAC/G,CAAC;IACD,OAAO,GAAG,CAAC,IAAI,CAAC;AAClB,CAAC;AAED,oEAAoE;AAC7D,KAAK,UAAU,kBAAkB,CAAC,MAAkB;IACzD,MAAM,IAAI,GAAG,MAAM,IAAI,CAA6B,MAAM,EAAE,4BAA4B,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;IAC7G,OAAO,CAAC,IAAI,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,GAAG,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC;AAChF,CAAC;AAED,6EAA6E;AACtE,KAAK,UAAU,uBAAuB,CAAC,MAAkB,EAAE,SAAiB;IACjF,MAAM,IAAI,CAAC,MAAM,EAAE,8BAA8B,kBAAkB,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,CAAC;AAC1G,CAAC;AAED,8GAA8G;AACvG,KAAK,UAAU,cAAc,CAAC,MAAkB,EAAE,OAAe;IACtE,MAAM,IAAI,GAAG,MAAM,IAAI,CAA4B,MAAM,EAAE,gCAAgC,kBAAkB,CAAC,OAAO,CAAC,EAAE,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,CAAC;IAChJ,OAAO,EAAE,WAAW,EAAE,IAAI,CAAC,YAAY,IAAI,CAAC,EAAE,CAAC;AACjD,CAAC"}

package/dist/connections.d.ts

@@ -5,7 +5,7 @@ import type { FapiClient } from './fapi';
  * an OAuth account a member shared), with live status. Authorizing an OAuth
  * connection uses `connectExternalAccount` / `reauthorizeExternalAccount`.
  */
-export type ConnectionStatus = 'connected' | 'not_connected' | 'needs_reauth';
+export type ConnectionStatus = 'connected' | 'not_connected' | 'needs_reauth' | 'revoked' | 'error';
 export interface AppConnection {
     object: 'connection';
     id: string;
@@ -13,20 +13,121 @@ export interface AppConnection {
         type: 'organization' | 'user';
         id: string;
     };
-    kind: 'oauth' | 'api_key' | 'client_credentials';
+    kind: 'oauth' | 'api_key' | 'client_credentials' | 'bearer' | 'basic' | 'custom_header' | 'hmac_secret' | 'jwt_bearer' | 'oauth1' | 'github_app_installation' | 'admin_consent';
     provider: string;
     name: string;
     allowed_hosts: string[];
     status: ConnectionStatus;
+    /** Always `data`: a connection is never a sign-in method. */
+    purpose?: 'data';
+    environment?: 'production' | 'sandbox';
+    sandbox?: boolean;
+    /** The provider-side account the connection covers (a company, a workspace, a user id). */
+    external_id?: string | null;
+    host_params?: Record<string, string>;
+    scopes?: string[];
+    expires_at?: number | null;
+    /** Non-secret provider handles captured with the token (realmId, instance_url, team_id...). */
+    metadata?: Record<string, string>;
+    /** The provider's own error behind the status (`invalid_grant`, ...), with the HTTP status it answered. */
+    last_error?: {
+        code: string;
+        message: string;
+        httpStatus?: number | null;
+        at: number;
+    } | null;
+    /** Consecutive failed refreshes; 0 when healthy. */
+    refresh_failures?: number;
+    /** @deprecated Always null: a connection owns its tokens. */
     external_account_id: string | null;
     has_secret: boolean;
+    /** When the entered credential expires (epoch ms). The credential itself is never readable from the browser. */
+    secret_expires_at?: number | null;
 }
-/** Credential to enter for an api_key or client_credentials connection. Write-only. */
+/** What the provider said when a connection was disconnected. The stored token is cleared in every case. */
+export interface ConnectionRevokeResult {
+    /** `true` the provider confirmed; `'unsupported'` it has no revoke endpoint; `false` it refused or was unreachable (see `provider_error`). */
+    provider_revoked: boolean | 'unsupported' | 'not_connected';
+    provider_status: number | null;
+    provider_error: {
+        code: string;
+        description: string | null;
+    } | null;
+    local_cleared: true;
+}
+/** What to send when starting the provider authorization of a connection. */
+export interface ConnectConnectionInput {
+    /** Where the owner lands afterwards; the URL carries `__atlas_status=connected` and `__atlas_connection=<id>`. */
+    redirectUrl: string;
+    /** Values for the provider's host templates, e.g. `{ subdomain: 'acme' }` or `{ tenant: 'contoso.onmicrosoft.com' }`. */
+    hostParams?: Record<string, string>;
+    environment?: 'production' | 'sandbox';
+    additionalScopes?: string[];
+    loginHint?: string;
+    display?: 'redirect' | 'popup';
+    /** A different provider account than the connection holds creates a sibling instead of failing with 409. */
+    createIfNew?: boolean;
+}
+export interface ConnectionAuthorization {
+    object: 'connection_authorization';
+    connection_id: string;
+    authorization_url: string;
+    attempt_id: string;
+}
+/** An organization's own OAuth client for a provider (the secret is write-only). */
+export interface ConnectionOAuthClient {
+    object: 'connection_oauth_client';
+    id: string;
+    provider: string;
+    environment: 'production' | 'sandbox';
+    client_id: string;
+    has_secret: true;
+    scopes: string[];
+    host_params: Record<string, string>;
+    enabled: boolean;
+    callback_url: string;
+}
+export interface SetConnectionOAuthClientInput {
+    provider: string;
+    environment?: 'production' | 'sandbox';
+    clientId: string;
+    /** Required the first time; omit to keep the stored secret. */
+    clientSecret?: string;
+    scopes?: string[];
+    hostParams?: Record<string, string>;
+    enabled?: boolean;
+}
+/**
+ * Credential to enter for a non-OAuth connection. Write-only: it is sealed server-side and no browser call can read it
+ * back. Which fields apply depends on the connection's kind.
+ */
 export interface ConnectionCredentialsInput {
+    /** api_key */
     apiKey?: string;
+    /** bearer */
+    token?: string;
+    /** basic */
+    username?: string;
+    password?: string;
+    /** custom_header */
+    value?: string;
+    /** hmac_secret */
+    secret?: string;
+    /** client_credentials */
     clientId?: string;
     clientSecret?: string;
     tokenUrl?: string;
+    /** jwt_bearer / github_app_installation: a PEM private key, or (jwt_bearer) a Google service-account JSON key. */
+    privateKey?: string;
+    serviceAccountJson?: string;
+    /** oauth1 */
+    consumerKey?: string;
+    consumerSecret?: string;
+    tokenSecret?: string;
+    /** Epoch milliseconds or an ISO date; reminders go out 30, 7 and 1 days before. */
+    expiresAt?: number | string;
+    /** Non-secret settings of the kind (placement, header name, algorithm...). */
+    config?: Record<string, unknown>;
 }
 export declare class ConnectionRequestError extends Error {
     readonly status: number;
@@ -41,3 +142,20 @@ export declare function listOrganizationConnections(client: FapiClient, organiza
 export declare function setOrganizationConnectionCredentials(client: FapiClient, organizationId: string, connectionId: string, input: ConnectionCredentialsInput): Promise<AppConnection>;
 /** Share the signed-in admin's own linked provider account with the organization. */
 export declare function shareOrganizationConnection(client: FapiClient, organizationId: string, connectionId: string): Promise<AppConnection>;
+/**
+ * Connect (or reconnect) one of the signed-in user's own connections. Navigate to `authorization_url`. This stores the
+ * tokens on the connection: it adds no sign-in method and needs no step-up.
+ */
+export declare function connectMyConnection(client: FapiClient, connectionId: string, input: ConnectConnectionInput): Promise<ConnectionAuthorization>;
+/** Disconnect one of the signed-in user's own connections. The answer says whether the provider confirmed the revoke. */
+export declare function revokeMyConnection(client: FapiClient, connectionId: string): Promise<AppConnection & ConnectionRevokeResult>;
+/** Connect (or reconnect) an organization's connection (needs the org profile-manage permission, not a step-up). */
+export declare function connectOrganizationConnection(client: FapiClient, organizationId: string, connectionId: string, input: ConnectConnectionInput): Promise<ConnectionAuthorization>;
+/** Disconnect an organization's connection. */
+export declare function revokeOrganizationConnection(client: FapiClient, organizationId: string, connectionId: string): Promise<AppConnection & ConnectionRevokeResult>;
+/** The organization's own OAuth clients. */
+export declare function listOrganizationOAuthClients(client: FapiClient, organizationId: string): Promise<ConnectionOAuthClient[]>;
+/** Set the organization's own OAuth client for a provider; it overrides the instance client for its connections. */
+export declare function setOrganizationOAuthClient(client: FapiClient, organizationId: string, input: SetConnectionOAuthClientInput): Promise<ConnectionOAuthClient>;
+/** Delete the organization's OAuth client (refused while its connections hold tokens it issued). */
+export declare function deleteOrganizationOAuthClient(client: FapiClient, organizationId: string, clientId: string): Promise<void>;

package/dist/connections.js

@@ -5,6 +5,13 @@ exports.listMyConnections = listMyConnections;
 exports.listOrganizationConnections = listOrganizationConnections;
 exports.setOrganizationConnectionCredentials = setOrganizationConnectionCredentials;
 exports.shareOrganizationConnection = shareOrganizationConnection;
+exports.connectMyConnection = connectMyConnection;
+exports.revokeMyConnection = revokeMyConnection;
+exports.connectOrganizationConnection = connectOrganizationConnection;
+exports.revokeOrganizationConnection = revokeOrganizationConnection;
+exports.listOrganizationOAuthClients = listOrganizationOAuthClients;
+exports.setOrganizationOAuthClient = setOrganizationOAuthClient;
+exports.deleteOrganizationOAuthClient = deleteOrganizationOAuthClient;
 class ConnectionRequestError extends Error {
     status;
     code;
@@ -35,19 +42,76 @@ async function listOrganizationConnections(client, organizationId) {
 }
 /** Enter the organization's credential for a connection (needs the org profile-manage permission). */
 function setOrganizationConnectionCredentials(client, organizationId, connectionId, input) {
+    const map = [
+        ['apiKey', 'api_key'], ['token', 'token'], ['username', 'username'], ['password', 'password'], ['value', 'value'], ['secret', 'secret'],
+        ['clientId', 'client_id'], ['clientSecret', 'client_secret'], ['tokenUrl', 'token_url'], ['privateKey', 'private_key'],
+        ['serviceAccountJson', 'service_account_json'], ['consumerKey', 'consumer_key'], ['consumerSecret', 'consumer_secret'],
+        ['tokenSecret', 'token_secret'], ['expiresAt', 'expires_at'], ['config', 'config'],
+    ];
     const body = {};
-    if (input.apiKey !== undefined)
-        body.api_key = input.apiKey;
-    if (input.clientId !== undefined)
-        body.client_id = input.clientId;
-    if (input.clientSecret !== undefined)
-        body.client_secret = input.clientSecret;
-    if (input.tokenUrl !== undefined)
-        body.token_url = input.tokenUrl;
+    for (const [from, to] of map)
+        if (input[from] !== undefined)
+            body[to] = input[from];
     return call(client, `${orgBase(organizationId)}/${encodeURIComponent(connectionId)}/credentials`, { method: 'PUT', body: JSON.stringify(body) });
 }
 /** Share the signed-in admin's own linked provider account with the organization. */
 function shareOrganizationConnection(client, organizationId, connectionId) {
     return call(client, `${orgBase(organizationId)}/${encodeURIComponent(connectionId)}/share`, { method: 'POST', body: '{}' });
 }
+const connectBody = (i) => ({
+    redirect_url: i.redirectUrl,
+    ...(i.hostParams ? { host_params: i.hostParams } : {}),
+    ...(i.environment ? { environment: i.environment } : {}),
+    ...(i.additionalScopes ? { additional_scopes: i.additionalScopes } : {}),
+    ...(i.loginHint ? { login_hint: i.loginHint } : {}),
+    ...(i.display ? { display: i.display } : {}),
+    ...(i.createIfNew ? { create_if_new: true } : {}),
+});
+/**
+ * Connect (or reconnect) one of the signed-in user's own connections. Navigate to `authorization_url`. This stores the
+ * tokens on the connection: it adds no sign-in method and needs no step-up.
+ */
+function connectMyConnection(client, connectionId, input) {
+    return call(client, `/v1/client/me/connections/${encodeURIComponent(connectionId)}/connect`, { method: 'POST', body: JSON.stringify(connectBody(input)) });
+}
+/** Disconnect one of the signed-in user's own connections. The answer says whether the provider confirmed the revoke. */
+function revokeMyConnection(client, connectionId) {
+    return call(client, `/v1/client/me/connections/${encodeURIComponent(connectionId)}/revoke`, { method: 'POST', body: '{}' });
+}
+/** Connect (or reconnect) an organization's connection (needs the org profile-manage permission, not a step-up). */
+function connectOrganizationConnection(client, organizationId, connectionId, input) {
+    return call(client, `${orgBase(organizationId)}/${encodeURIComponent(connectionId)}/connect`, { method: 'POST', body: JSON.stringify(connectBody(input)) });
+}
+/** Disconnect an organization's connection. */
+function revokeOrganizationConnection(client, organizationId, connectionId) {
+    return call(client, `${orgBase(organizationId)}/${encodeURIComponent(connectionId)}/revoke`, { method: 'POST', body: '{}' });
+}
+const clientsBase = (organizationId) => `/v1/client/organizations/${encodeURIComponent(organizationId)}/connection_oauth_clients`;
+/** The organization's own OAuth clients. */
+async function listOrganizationOAuthClients(client, organizationId) {
+    return (await call(client, clientsBase(organizationId), { method: 'GET' })).data ?? [];
+}
+/** Set the organization's own OAuth client for a provider; it overrides the instance client for its connections. */
+function setOrganizationOAuthClient(client, organizationId, input) {
+    return call(client, clientsBase(organizationId), {
+        method: 'PUT',
+        body: JSON.stringify({
+            provider: input.provider,
+            ...(input.environment ? { environment: input.environment } : {}),
+            client_id: input.clientId,
+            ...(input.clientSecret ? { client_secret: input.clientSecret } : {}),
+            ...(input.scopes ? { scopes: input.scopes } : {}),
+            ...(input.hostParams ? { host_params: input.hostParams } : {}),
+            ...(input.enabled !== undefined ? { enabled: input.enabled } : {}),
+        }),
+    });
+}
+/** Delete the organization's OAuth client (refused while its connections hold tokens it issued). */
+async function deleteOrganizationOAuthClient(client, organizationId, clientId) {
+    const res = await client.request(`${clientsBase(organizationId)}/${encodeURIComponent(clientId)}`, { method: 'DELETE' });
+    if (!res.ok) {
+        const first = res.errors[0];
+        throw new ConnectionRequestError(res.status, first?.code ?? 'UNKNOWN', first?.message ?? 'The request failed.');
+    }
+}
 //# sourceMappingURL=connections.js.map

package/dist/connections.js.map

@@ -1 +1 @@
-{"version":3,"file":"connections.js","sourceRoot":"","sources":["../src/connections.ts"],"names":[],"mappings":";;;AAsDA,8CAEC;AAGD,kEAEC;AAGD,oFAYC;AAGD,kEAEC;AAlDD,MAAa,sBAAuB,SAAQ,KAAK;IAEpC;IACA;IAFX,YACW,MAAc,EACd,IAAY,EACrB,OAAe;QAEf,KAAK,CAAC,OAAO,CAAC,CAAC;QAJN,WAAM,GAAN,MAAM,CAAQ;QACd,SAAI,GAAJ,IAAI,CAAQ;QAIrB,IAAI,CAAC,IAAI,GAAG,wBAAwB,CAAC;IACvC,CAAC;CACF;AATD,wDASC;AAED,KAAK,UAAU,IAAI,CAAI,MAAkB,EAAE,IAAY,EAAE,IAAiB;IACxE,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,OAAO,CAAI,IAAI,EAAE,IAAI,CAAC,CAAC;IAChD,IAAI,CAAC,GAAG,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;QACzB,MAAM,KAAK,GAAG,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;QAC5B,MAAM,IAAI,sBAAsB,CAAC,GAAG,CAAC,MAAM,EAAE,KAAK,EAAE,IAAI,IAAI,SAAS,EAAE,KAAK,EAAE,OAAO,IAAI,qBAAqB,CAAC,CAAC;IAClH,CAAC;IACD,OAAO,GAAG,CAAC,IAAI,CAAC;AAClB,CAAC;AAED,MAAM,OAAO,GAAG,CAAC,cAAsB,EAAE,EAAE,CAAC,4BAA4B,kBAAkB,CAAC,cAAc,CAAC,cAAc,CAAC;AAEzH,4CAA4C;AACrC,KAAK,UAAU,iBAAiB,CAAC,MAAkB;IACxD,OAAO,CAAC,MAAM,IAAI,CAA4B,MAAM,EAAE,2BAA2B,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,IAAI,EAAE,CAAC;AACpH,CAAC;AAED,6CAA6C;AACtC,KAAK,UAAU,2BAA2B,CAAC,MAAkB,EAAE,cAAsB;IAC1F,OAAO,CAAC,MAAM,IAAI,CAA4B,MAAM,EAAE,OAAO,CAAC,cAAc,CAAC,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,IAAI,EAAE,CAAC;AAChH,CAAC;AAED,sGAAsG;AACtG,SAAgB,oCAAoC,CAClD,MAAkB,EAClB,cAAsB,EACtB,YAAoB,EACpB,KAAiC;IAEjC,MAAM,IAAI,GAA2B,EAAE,CAAC;IACxC,IAAI,KAAK,CAAC,MAAM,KAAK,SAAS;QAAE,IAAI,CAAC,OAAO,GAAG,KAAK,CAAC,MAAM,CAAC;IAC5D,IAAI,KAAK,CAAC,QAAQ,KAAK,SAAS;QAAE,IAAI,CAAC,SAAS,GAAG,KAAK,CAAC,QAAQ,CAAC;IAClE,IAAI,KAAK,CAAC,YAAY,KAAK,SAAS;QAAE,IAAI,CAAC,aAAa,GAAG,KAAK,CAAC,YAAY,CAAC;IAC9E,IAAI,KAAK,CAAC,QAAQ,KAAK,SAAS;QAAE,IAAI,CAAC,SAAS,GAAG,KAAK,CAAC,QAAQ,CAAC;IAClE,OAAO,IAAI,CAAgB,MAAM,EAAE,GAAG,OAAO,CAAC,cAAc,CAAC,IAAI,kBAAkB,CAAC,YAAY,CAAC,cAAc,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;AAClK,CAAC;AAED,qFAAqF;AACrF,SAAgB,2BAA2B,CAAC,MAAkB,EAAE,cAAsB,EAAE,YAAoB;IAC1G,OAAO,IAAI,CAAgB,MAAM,EAAE,GAAG,OAAO,CAAC,cAAc,CAAC,IAAI,kBAAkB,CAAC,YAAY,CAAC,QAAQ,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;AAC7I,CAAC"}
+{"version":3,"file":"connections.js","sourceRoot":"","sources":["../src/connections.ts"],"names":[],"mappings":";;;AAwJA,8CAEC;AAGD,kEAEC;AAGD,oFAeC;AAGD,kEAEC;AAgBD,kDAEC;AAGD,gDAEC;AAGD,sEAEC;AAGD,oEAEC;AAKD,oEAEC;AAGD,gEAaC;AAGD,sEAMC;AAtHD,MAAa,sBAAuB,SAAQ,KAAK;IAEpC;IACA;IAFX,YACW,MAAc,EACd,IAAY,EACrB,OAAe;QAEf,KAAK,CAAC,OAAO,CAAC,CAAC;QAJN,WAAM,GAAN,MAAM,CAAQ;QACd,SAAI,GAAJ,IAAI,CAAQ;QAIrB,IAAI,CAAC,IAAI,GAAG,wBAAwB,CAAC;IACvC,CAAC;CACF;AATD,wDASC;AAED,KAAK,UAAU,IAAI,CAAI,MAAkB,EAAE,IAAY,EAAE,IAAiB;IACxE,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,OAAO,CAAI,IAAI,EAAE,IAAI,CAAC,CAAC;IAChD,IAAI,CAAC,GAAG,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;QACzB,MAAM,KAAK,GAAG,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;QAC5B,MAAM,IAAI,sBAAsB,CAAC,GAAG,CAAC,MAAM,EAAE,KAAK,EAAE,IAAI,IAAI,SAAS,EAAE,KAAK,EAAE,OAAO,IAAI,qBAAqB,CAAC,CAAC;IAClH,CAAC;IACD,OAAO,GAAG,CAAC,IAAI,CAAC;AAClB,CAAC;AAED,MAAM,OAAO,GAAG,CAAC,cAAsB,EAAE,EAAE,CAAC,4BAA4B,kBAAkB,CAAC,cAAc,CAAC,cAAc,CAAC;AAEzH,4CAA4C;AACrC,KAAK,UAAU,iBAAiB,CAAC,MAAkB;IACxD,OAAO,CAAC,MAAM,IAAI,CAA4B,MAAM,EAAE,2BAA2B,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,IAAI,EAAE,CAAC;AACpH,CAAC;AAED,6CAA6C;AACtC,KAAK,UAAU,2BAA2B,CAAC,MAAkB,EAAE,cAAsB;IAC1F,OAAO,CAAC,MAAM,IAAI,CAA4B,MAAM,EAAE,OAAO,CAAC,cAAc,CAAC,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,IAAI,EAAE,CAAC;AAChH,CAAC;AAED,sGAAsG;AACtG,SAAgB,oCAAoC,CAClD,MAAkB,EAClB,cAAsB,EACtB,YAAoB,EACpB,KAAiC;IAEjC,MAAM,GAAG,GAAsD;QAC7D,CAAC,QAAQ,EAAE,SAAS,CAAC,EAAE,CAAC,OAAO,EAAE,OAAO,CAAC,EAAE,CAAC,UAAU,EAAE,UAAU,CAAC,EAAE,CAAC,UAAU,EAAE,UAAU,CAAC,EAAE,CAAC,OAAO,EAAE,OAAO,CAAC,EAAE,CAAC,QAAQ,EAAE,QAAQ,CAAC;QACvI,CAAC,UAAU,EAAE,WAAW,CAAC,EAAE,CAAC,cAAc,EAAE,eAAe,CAAC,EAAE,CAAC,UAAU,EAAE,WAAW,CAAC,EAAE,CAAC,YAAY,EAAE,aAAa,CAAC;QACtH,CAAC,oBAAoB,EAAE,sBAAsB,CAAC,EAAE,CAAC,aAAa,EAAE,cAAc,CAAC,EAAE,CAAC,gBAAgB,EAAE,iBAAiB,CAAC;QACtH,CAAC,aAAa,EAAE,cAAc,CAAC,EAAE,CAAC,WAAW,EAAE,YAAY,CAAC,EAAE,CAAC,QAAQ,EAAE,QAAQ,CAAC;KACnF,CAAC;IACF,MAAM,IAAI,GAA4B,EAAE,CAAC;IACzC,KAAK,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,GAAG;QAAE,IAAI,KAAK,CAAC,IAAI,CAAC,KAAK,SAAS;YAAE,IAAI,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC;IACpF,OAAO,IAAI,CAAgB,MAAM,EAAE,GAAG,OAAO,CAAC,cAAc,CAAC,IAAI,kBAAkB,CAAC,YAAY,CAAC,cAAc,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;AAClK,CAAC;AAED,qFAAqF;AACrF,SAAgB,2BAA2B,CAAC,MAAkB,EAAE,cAAsB,EAAE,YAAoB;IAC1G,OAAO,IAAI,CAAgB,MAAM,EAAE,GAAG,OAAO,CAAC,cAAc,CAAC,IAAI,kBAAkB,CAAC,YAAY,CAAC,QAAQ,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;AAC7I,CAAC;AAED,MAAM,WAAW,GAAG,CAAC,CAAyB,EAAE,EAAE,CAAC,CAAC;IAClD,YAAY,EAAE,CAAC,CAAC,WAAW;IAC3B,GAAG,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IACtD,GAAG,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IACxD,GAAG,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,EAAE,iBAAiB,EAAE,CAAC,CAAC,gBAAgB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IACxE,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IACnD,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IAC5C,GAAG,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;CAClD,CAAC,CAAC;AAEH;;;GAGG;AACH,SAAgB,mBAAmB,CAAC,MAAkB,EAAE,YAAoB,EAAE,KAA6B;IACzG,OAAO,IAAI,CAA0B,MAAM,EAAE,6BAA6B,kBAAkB,CAAC,YAAY,CAAC,UAAU,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC;AACtL,CAAC;AAED,yHAAyH;AACzH,SAAgB,kBAAkB,CAAC,MAAkB,EAAE,YAAoB;IACzE,OAAO,IAAI,CAAyC,MAAM,EAAE,6BAA6B,kBAAkB,CAAC,YAAY,CAAC,SAAS,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;AACtK,CAAC;AAED,oHAAoH;AACpH,SAAgB,6BAA6B,CAAC,MAAkB,EAAE,cAAsB,EAAE,YAAoB,EAAE,KAA6B;IAC3I,OAAO,IAAI,CAA0B,MAAM,EAAE,GAAG,OAAO,CAAC,cAAc,CAAC,IAAI,kBAAkB,CAAC,YAAY,CAAC,UAAU,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC;AACvL,CAAC;AAED,+CAA+C;AAC/C,SAAgB,4BAA4B,CAAC,MAAkB,EAAE,cAAsB,EAAE,YAAoB;IAC3G,OAAO,IAAI,CAAyC,MAAM,EAAE,GAAG,OAAO,CAAC,cAAc,CAAC,IAAI,kBAAkB,CAAC,YAAY,CAAC,SAAS,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;AACvK,CAAC;AAED,MAAM,WAAW,GAAG,CAAC,cAAsB,EAAE,EAAE,CAAC,4BAA4B,kBAAkB,CAAC,cAAc,CAAC,2BAA2B,CAAC;AAE1I,4CAA4C;AACrC,KAAK,UAAU,4BAA4B,CAAC,MAAkB,EAAE,cAAsB;IAC3F,OAAO,CAAC,MAAM,IAAI,CAAoC,MAAM,EAAE,WAAW,CAAC,cAAc,CAAC,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,IAAI,EAAE,CAAC;AAC5H,CAAC;AAED,oHAAoH;AACpH,SAAgB,0BAA0B,CAAC,MAAkB,EAAE,cAAsB,EAAE,KAAoC;IACzH,OAAO,IAAI,CAAwB,MAAM,EAAE,WAAW,CAAC,cAAc,CAAC,EAAE;QACtE,MAAM,EAAE,KAAK;QACb,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;YACnB,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,GAAG,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,KAAK,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAChE,SAAS,EAAE,KAAK,CAAC,QAAQ;YACzB,GAAG,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,KAAK,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACpE,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACjD,GAAG,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,KAAK,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC9D,GAAG,CAAC,KAAK,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACnE,CAAC;KACH,CAAC,CAAC;AACL,CAAC;AAED,oGAAoG;AAC7F,KAAK,UAAU,6BAA6B,CAAC,MAAkB,EAAE,cAAsB,EAAE,QAAgB;IAC9G,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,OAAO,CAAU,GAAG,WAAW,CAAC,cAAc,CAAC,IAAI,kBAAkB,CAAC,QAAQ,CAAC,EAAE,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,CAAC;IAClI,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;QACZ,MAAM,KAAK,GAAG,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;QAC5B,MAAM,IAAI,sBAAsB,CAAC,GAAG,CAAC,MAAM,EAAE,KAAK,EAAE,IAAI,IAAI,SAAS,EAAE,KAAK,EAAE,OAAO,IAAI,qBAAqB,CAAC,CAAC;IAClH,CAAC;AACH,CAAC"}

package/dist/iga.d.ts

@@ -0,0 +1,118 @@
+import type { FapiClient } from './fapi';
+import type { FieldError } from './attempt';
+/**
+ * Identity governance for the signed-in user: browse what can be requested,
+ * request it, follow requests, decide approvals waiting on you, certify access
+ * you were asked to review, and hand your approvals to a stand-in.
+ */
+export type AccessRisk = 'low' | 'medium' | 'high' | 'critical';
+export type AccessRequestStatus = 'pending' | 'approved' | 'denied' | 'cancelled' | 'fulfilled' | 'failed';
+export interface AccessCatalogItem {
+    object: 'iga_catalog_item';
+    id: string;
+    key: string;
+    name: string;
+    description: string | null;
+    kind: 'role' | 'org_membership' | 'group' | 'resource_role' | 'app_assignment' | 'custom';
+    risk_level: AccessRisk;
+    /** How many approval steps a request goes through (0 = granted immediately). */
+    approval_steps: number;
+    max_duration_seconds: number | null;
+    require_justification: boolean;
+}
+export interface AccessGrant {
+    object: 'iga_grant';
+    id: string;
+    user_id: string;
+    entitlement_id: string;
+    source: 'request' | 'admin' | 'birthright' | 'existing';
+    status: 'active' | 'revoked' | 'expired';
+    granted_at: number;
+    /** When a time-bound grant ends; null = until revoked. */
+    expires_at: number | null;
+}
+export interface AccessRequest {
+    object: 'iga_request';
+    id: string;
+    entitlement_id: string;
+    beneficiary_user_id: string;
+    justification: string | null;
+    duration_seconds: number | null;
+    status: AccessRequestStatus;
+    /** The step waiting on a decision (null once the request is final). */
+    current_step: number | null;
+    steps: Array<{
+        index: number;
+        type: string;
+        mode: 'any' | 'all';
+        approvers: string[];
+        status: 'pending' | 'approved' | 'denied';
+        escalated: boolean;
+    }>;
+    approvals: Array<{
+        step: number;
+        approver_user_id: string;
+        acting_for_user_id: string | null;
+        decision: 'approve' | 'deny';
+        comment: string | null;
+        decided_at: number;
+    }>;
+    created_at: number;
+}
+export interface AccessReviewItem {
+    object: 'iga_campaign_item';
+    id: string;
+    campaign_id: string;
+    user_id: string;
+    entitlement_id: string;
+    decision: 'pending' | 'certified' | 'revoked';
+}
+export interface AccessDelegation {
+    object: 'iga_delegation';
+    id: string;
+    delegator_user_id: string;
+    delegate_user_id: string;
+    starts_at: number;
+    ends_at: number;
+}
+export type AccessResult<T> = {
+    ok: true;
+    data: T;
+} | {
+    ok: false;
+    errors: FieldError[];
+};
+/** What the signed-in user may request. */
+export declare const listAccessCatalog: (client: FapiClient) => Promise<AccessResult<AccessCatalogItem[]>>;
+/** Access the user holds through governance, with expiry dates. */
+export declare const listMyAccess: (client: FapiClient) => Promise<AccessResult<AccessGrant[]>>;
+export declare const listMyAccessRequests: (client: FapiClient) => Promise<AccessResult<AccessRequest[]>>;
+/**
+ * Ask for access. A refusal carries the reason: a missing justification (400), access
+ * already held or already requested (409), or a separation-of-duties conflict (409, with
+ * `meta.sod`).
+ */
+export declare function requestAccess(client: FapiClient, input: {
+    entitlement: string;
+    justification?: string;
+    durationSeconds?: number;
+}): Promise<AccessResult<AccessRequest>>;
+export declare function getAccessRequest(client: FapiClient, id: string): Promise<AccessResult<AccessRequest>>;
+export declare function cancelAccessRequest(client: FapiClient, id: string): Promise<AccessResult<AccessRequest>>;
+/** Requests waiting on this user's decision (their own steps and those delegated to them). */
+export declare const listPendingApprovals: (client: FapiClient) => Promise<AccessResult<AccessRequest[]>>;
+export declare function decideAccessRequest(client: FapiClient, id: string, decision: 'approve' | 'deny', comment?: string): Promise<AccessResult<AccessRequest>>;
+/** Access review items waiting on this user. */
+export declare const listAccessReviews: (client: FapiClient) => Promise<AccessResult<AccessReviewItem[]>>;
+export declare function decideAccessReview(client: FapiClient, id: string, decision: 'certify' | 'revoke', comment?: string): Promise<AccessResult<AccessReviewItem>>;
+export declare const listAccessDelegations: (client: FapiClient) => Promise<AccessResult<AccessDelegation[]>>;
+/** Let another user decide your approvals and reviews until `endsAt` (epoch ms, at most a year out). */
+export declare function delegateApprovals(client: FapiClient, input: {
+    delegateUserId: string;
+    endsAt: number;
+    startsAt?: number;
+}): Promise<AccessResult<AccessDelegation>>;
+export declare function endDelegation(client: FapiClient, id: string): Promise<AccessResult<{
+    id: string;
+    deleted: true;
+}>>;

package/dist/iga.js

@@ -0,0 +1,60 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.listAccessDelegations = exports.listAccessReviews = exports.listPendingApprovals = exports.listMyAccessRequests = exports.listMyAccess = exports.listAccessCatalog = void 0;
+exports.requestAccess = requestAccess;
+exports.getAccessRequest = getAccessRequest;
+exports.cancelAccessRequest = cancelAccessRequest;
+exports.decideAccessRequest = decideAccessRequest;
+exports.decideAccessReview = decideAccessReview;
+exports.delegateApprovals = delegateApprovals;
+exports.endDelegation = endDelegation;
+const P = '/v1/client/me/iga';
+const wrap = (res) => (res.ok && res.data !== null ? { ok: true, data: res.data } : { ok: false, errors: res.errors });
+const list = async (client, path) => {
+    const r = wrap(await client.get(path));
+    return r.ok ? { ok: true, data: r.data.data } : r;
+};
+/** What the signed-in user may request. */
+const listAccessCatalog = (client) => list(client, `${P}/catalog`);
+exports.listAccessCatalog = listAccessCatalog;
+/** Access the user holds through governance, with expiry dates. */
+const listMyAccess = (client) => list(client, `${P}/grants`);
+exports.listMyAccess = listMyAccess;
+const listMyAccessRequests = (client) => list(client, `${P}/requests`);
+exports.listMyAccessRequests = listMyAccessRequests;
+/**
+ * Ask for access. A refusal carries the reason: a missing justification (400), access
+ * already held or already requested (409), or a separation-of-duties conflict (409, with
+ * `meta.sod`).
+ */
+async function requestAccess(client, input) {
+    return wrap(await client.post(`${P}/requests`, { entitlement: input.entitlement, justification: input.justification, duration_seconds: input.durationSeconds }));
+}
+async function getAccessRequest(client, id) {
+    return wrap(await client.get(`${P}/requests/${encodeURIComponent(id)}`));
+}
+async function cancelAccessRequest(client, id) {
+    return wrap(await client.post(`${P}/requests/${encodeURIComponent(id)}/cancel`, {}));
+}
+/** Requests waiting on this user's decision (their own steps and those delegated to them). */
+const listPendingApprovals = (client) => list(client, `${P}/approvals`);
+exports.listPendingApprovals = listPendingApprovals;
+async function decideAccessRequest(client, id, decision, comment) {
+    return wrap(await client.post(`${P}/requests/${encodeURIComponent(id)}/decide`, { decision, comment }));
+}
+/** Access review items waiting on this user. */
+const listAccessReviews = (client) => list(client, `${P}/reviews`);
+exports.listAccessReviews = listAccessReviews;
+async function decideAccessReview(client, id, decision, comment) {
+    return wrap(await client.post(`${P}/reviews/${encodeURIComponent(id)}/decide`, { decision, comment }));
+}
+const listAccessDelegations = (client) => list(client, `${P}/delegations`);
+exports.listAccessDelegations = listAccessDelegations;
+/** Let another user decide your approvals and reviews until `endsAt` (epoch ms, at most a year out). */
+async function delegateApprovals(client, input) {
+    return wrap(await client.post(`${P}/delegations`, { delegate_user_id: input.delegateUserId, ends_at: input.endsAt, starts_at: input.startsAt }));
+}
+async function endDelegation(client, id) {
+    return wrap(await client.request(`${P}/delegations/${encodeURIComponent(id)}`, { method: 'DELETE' }));
+}
+//# sourceMappingURL=iga.js.map

package/dist/iga.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"iga.js","sourceRoot":"","sources":["../src/iga.ts"],"names":[],"mappings":";;;AA4FA,sCAEC;AACD,4CAEC;AACD,kDAEC;AAID,kDAEC;AAID,gDAEC;AAID,8CAEC;AACD,sCAEC;AA/CD,MAAM,CAAC,GAAG,mBAAmB,CAAC;AAC9B,MAAM,IAAI,GAAG,CAAI,GAAoB,EAAmB,EAAE,CAAC,CAAC,GAAG,CAAC,EAAE,IAAI,GAAG,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC;AAC5J,MAAM,IAAI,GAAG,KAAK,EAAK,MAAkB,EAAE,IAAY,EAA8B,EAAE;IACrF,MAAM,CAAC,GAAG,IAAI,CAAC,MAAM,MAAM,CAAC,GAAG,CAAY,IAAI,CAAC,CAAC,CAAC;IAClD,OAAO,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;AACpD,CAAC,CAAC;AAEF,2CAA2C;AACpC,MAAM,iBAAiB,GAAG,CAAC,MAAkB,EAAE,EAAE,CAAC,IAAI,CAAoB,MAAM,EAAE,GAAG,CAAC,UAAU,CAAC,CAAC;AAA5F,QAAA,iBAAiB,qBAA2E;AACzG,mEAAmE;AAC5D,MAAM,YAAY,GAAG,CAAC,MAAkB,EAAE,EAAE,CAAC,IAAI,CAAc,MAAM,EAAE,GAAG,CAAC,SAAS,CAAC,CAAC;AAAhF,QAAA,YAAY,gBAAoE;AACtF,MAAM,oBAAoB,GAAG,CAAC,MAAkB,EAAE,EAAE,CAAC,IAAI,CAAgB,MAAM,EAAE,GAAG,CAAC,WAAW,CAAC,CAAC;AAA5F,QAAA,oBAAoB,wBAAwE;AAEzG;;;;GAIG;AACI,KAAK,UAAU,aAAa,CAAC,MAAkB,EAAE,KAAgF;IACtI,OAAO,IAAI,CAAC,MAAM,MAAM,CAAC,IAAI,CAAgB,GAAG,CAAC,WAAW,EAAE,EAAE,WAAW,EAAE,KAAK,CAAC,WAAW,EAAE,aAAa,EAAE,KAAK,CAAC,aAAa,EAAE,gBAAgB,EAAE,KAAK,CAAC,eAAe,EAAE,CAAC,CAAC,CAAC;AAClL,CAAC;AACM,KAAK,UAAU,gBAAgB,CAAC,MAAkB,EAAE,EAAU;IACnE,OAAO,IAAI,CAAC,MAAM,MAAM,CAAC,GAAG,CAAgB,GAAG,CAAC,aAAa,kBAAkB,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC;AAC1F,CAAC;AACM,KAAK,UAAU,mBAAmB,CAAC,MAAkB,EAAE,EAAU;IACtE,OAAO,IAAI,CAAC,MAAM,MAAM,CAAC,IAAI,CAAgB,GAAG,CAAC,aAAa,kBAAkB,CAAC,EAAE,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC,CAAC;AACtG,CAAC;AAED,8FAA8F;AACvF,MAAM,oBAAoB,GAAG,CAAC,MAAkB,EAAE,EAAE,CAAC,IAAI,CAAgB,MAAM,EAAE,GAAG,CAAC,YAAY,CAAC,CAAC;AAA7F,QAAA,oBAAoB,wBAAyE;AACnG,KAAK,UAAU,mBAAmB,CAAC,MAAkB,EAAE,EAAU,EAAE,QAA4B,EAAE,OAAgB;IACtH,OAAO,IAAI,CAAC,MAAM,MAAM,CAAC,IAAI,CAAgB,GAAG,CAAC,aAAa,kBAAkB,CAAC,EAAE,CAAC,SAAS,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC;AACzH,CAAC;AAED,gDAAgD;AACzC,MAAM,iBAAiB,GAAG,CAAC,MAAkB,EAAE,EAAE,CAAC,IAAI,CAAmB,MAAM,EAAE,GAAG,CAAC,UAAU,CAAC,CAAC;AAA3F,QAAA,iBAAiB,qBAA0E;AACjG,KAAK,UAAU,kBAAkB,CAAC,MAAkB,EAAE,EAAU,EAAE,QAA8B,EAAE,OAAgB;IACvH,OAAO,IAAI,CAAC,MAAM,MAAM,CAAC,IAAI,CAAmB,GAAG,CAAC,YAAY,kBAAkB,CAAC,EAAE,CAAC,SAAS,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC;AAC3H,CAAC;AAEM,MAAM,qBAAqB,GAAG,CAAC,MAAkB,EAAE,EAAE,CAAC,IAAI,CAAmB,MAAM,EAAE,GAAG,CAAC,cAAc,CAAC,CAAC;AAAnG,QAAA,qBAAqB,yBAA8E;AAChH,wGAAwG;AACjG,KAAK,UAAU,iBAAiB,CAAC,MAAkB,EAAE,KAAoE;IAC9H,OAAO,IAAI,CAAC,MAAM,MAAM,CAAC,IAAI,CAAmB,GAAG,CAAC,cAAc,EAAE,EAAE,gBAAgB,EAAE,KAAK,CAAC,cAAc,EAAE,OAAO,EAAE,KAAK,CAAC,MAAM,EAAE,SAAS,EAAE,KAAK,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC;AACrK,CAAC;AACM,KAAK,UAAU,aAAa,CAAC,MAAkB,EAAE,EAAU;IAChE,OAAO,IAAI,CAAC,MAAM,MAAM,CAAC,OAAO,CAAgC,GAAG,CAAC,gBAAgB,kBAAkB,CAAC,EAAE,CAAC,EAAE,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC;AACvI,CAAC"}

package/dist/index.d.ts

@@ -32,12 +32,14 @@ export * from './mfa-factors';
 export * from './passkey-sign-in';
 export * from './passkey-sign-up';
 export * from './email-code-check';
+export * from './srp';
 export * from './step-up';
 export * from './telegram';
 export * from './siwe';
 export * from './telemetry';
 export * from './reauth';
 export * from './api-keys';
+export * from './authorized-apps';
 export * from './device-authorization';
 export * from './app-launcher';
 export * from './organizations';
@@ -49,6 +51,7 @@ export * from './email-addresses';
 export * from './account-hints';
 export * from './custom-challenge';
 export * from './identity-verification';
+export * from './iga';
 export * from './profile';
 export * from './connect';
 export * from './connections';
@@ -69,3 +72,4 @@ export * from './journey-redirect';
 export * from './delegated-ui';
 export * from './external-passkeys';
 export * from './credentials';
+export * from './uma';

package/dist/index.js

@@ -78,6 +78,8 @@ __exportStar(require("./passkey-sign-in"), exports);
 __exportStar(require("./passkey-sign-up"), exports);
 // Check an emailed one-time code without using it up (sign-in, sign-up, step-up, email verification).
 __exportStar(require("./email-code-check"), exports);
+// SRP-6a sign-in (RFC 5054, 3072-bit group, SHA-256): the password never leaves the browser.
+__exportStar(require("./srp"), exports);
 __exportStar(require("./step-up"), exports);
 __exportStar(require("./telegram"), exports);
 __exportStar(require("./siwe"), exports);
@@ -85,6 +87,8 @@ __exportStar(require("./telemetry"), exports);
 __exportStar(require("./reauth"), exports);
 // End-user API key self-service (`/v1/client/me/api_keys`).
 __exportStar(require("./api-keys"), exports);
+// The apps a user authorized, with the OpenID Grant Management grants each holds.
+__exportStar(require("./authorized-apps"), exports);
 __exportStar(require("./device-authorization"), exports);
 __exportStar(require("./app-launcher"), exports);
 __exportStar(require("./organizations"), exports);
@@ -98,6 +102,8 @@ __exportStar(require("./account-hints"), exports);
 __exportStar(require("./custom-challenge"), exports);
 // Identity verification (document and selfie) through the app's verification service.
 __exportStar(require("./identity-verification"), exports);
+// Identity governance: request access, approve, review, delegate.
+__exportStar(require("./iga"), exports);
 // Self-service profile update (incl. user-editable identity traits).
 __exportStar(require("./profile"), exports);
 __exportStar(require("./connect"), exports);
@@ -143,4 +149,5 @@ __exportStar(require("./delegated-ui"), exports);
 __exportStar(require("./external-passkeys"), exports);
 // Wallet-side helpers for verifiable credentials (receive an offer, present an SD-JWT VC).
 __exportStar(require("./credentials"), exports);
+__exportStar(require("./uma"), exports);
 //# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;AAAA,6EAA6E;AAC7E,2CAAyB;AACzB,6CAA2B;AAC3B,yDAAyD;AACzD,kDAAgC;AAChC,sFAAsF;AACtF,mDAAiC;AACjC,gDAA8B;AAC9B,iDAA+B;AAC/B,4CAA0B;AAC1B,iDAA+B;AAC/B,kDAAgC;AAChC,uEAAuE;AACvE,2CAAyB;AACzB,6CAA2B;AAC3B,qFAAqF;AACrF,kDAAgC;AAChC,yCAAuB;AACvB,uEAAuE;AACvE,6CAA2B;AAC3B,mGAAmG;AACnG,2DAAyC;AACzC,4GAA4G;AAC5G,sDAAoC;AACpC,+CAA6B;AAC7B,+EAA+E;AAC/E,6CAA2B;AAC3B,8DAA4C;AAC5C,gGAAgG;AAChG,6CAAgJ;AAAvI,gHAAA,iBAAiB,OAAA;AAAE,8GAAA,eAAe,OAAA;AAAE,oHAAA,qBAAqB,OAAA;AAAE,6GAAA,cAAc,OAAA;AAAE,6GAAA,cAAc,OAAA;AAClG,qDAW2B;AAVzB,oHAAA,iBAAiB,OAAA;AACjB,2HAAA,wBAAwB,OAAA;AACxB,oHAAA,iBAAiB,OAAA;AACjB,gHAAA,aAAa,OAAA;AACb,wHAAA,qBAAqB,OAAA;AACrB,uHAAA,oBAAoB,OAAA;AAMtB,iEAAiE;AACjE,iDAA+B;AAC/B,4CAA0B;AAC1B,yFAAyF;AACzF,oDAAkC;AAClC,2CAAyB;AACzB,mDAAiC;AACjC,4CAA0B;AAC1B,2FAA2F;AAC3F,gDAA8B;AAC9B,+CAA6B;AAC7B,0GAA0G;AAC1G,mDAAiC;AACjC,iFAAiF;AACjF,gDAA8B;AAC9B,uFAAuF;AACvF,oDAAkC;AAClC,4EAA4E;AAC5E,oDAAkC;AAClC,sGAAsG;AACtG,qDAAmC;AACnC,4CAA0B;AAC1B,6CAA2B;AAC3B,yCAAuB;AACvB,8CAA4B;AAC5B,2CAAyB;AACzB,4DAA4D;AAC5D,6CAA2B;AAC3B,yDAAuC;AACvC,iDAA+B;AAC/B,kDAAgC;AAChC,uDAAqC;AACrC,4CAA0B;AAC1B,8CAA4B;AAC5B,kDAAgC;AAChC,oDAAkC;AAClC,+DAA+D;AAC/D,kDAAgC;AAChC,qDAAmC;AACnC,sFAAsF;AACtF,0DAAwC;AACxC,qEAAqE;AACrE,4CAA0B;AAC1B,4CAA0B;AAC1B,gDAA8B;AAC9B,mDAAiC;AACjC,kDAAgC;AAChC,gGAAgG;AAChG,uDAAqC;AACrC,+DAA6C;AAC7C,sDAAsD;AACtD,wDAAsC;AACtC,+EAA+E;AAC/E,oDAAkC;AAClC,+EAA+E;AAC/E,2EAA2E;AAC3E,4CAA0B;AAC1B,kFAAkF;AAClF,mDAAiC;AACjC,4FAA4F;AAC5F,kDAAgC;AAChC,kFAAkF;AAClF,yEAAyE;AACzE,oEAAoE;AACpE,uDAAqC;AACrC,sDAAoC;AACpC,uEAAuE;AACvE,gDAA8B;AAC9B,0EAA0E;AAC1E,4EAA4E;AAC5E,0CAa0B;AARxB,iGAAA,QAAQ,OAAA;AACR,sGAAA,aAAa,OAAA;AACb,0GAAA,iBAAiB,OAAA;AACjB,uGAAA,cAAc,OAAA;AACd,yGAAA,gBAAgB,OAAA;AAChB,+GAAA,sBAAsB,OAAA;AACtB,kGAAA,SAAS,OAAA;AACT,wGAAA,eAAe,OAAA;AAEjB,qDAAmC;AAEnC,yGAAyG;AACzG,iDAA+B;AAE/B,kFAAkF;AAClF,sDAAoC;AAEpC,2FAA2F;AAC3F,gDAA8B"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;AAAA,6EAA6E;AAC7E,2CAAyB;AACzB,6CAA2B;AAC3B,yDAAyD;AACzD,kDAAgC;AAChC,sFAAsF;AACtF,mDAAiC;AACjC,gDAA8B;AAC9B,iDAA+B;AAC/B,4CAA0B;AAC1B,iDAA+B;AAC/B,kDAAgC;AAChC,uEAAuE;AACvE,2CAAyB;AACzB,6CAA2B;AAC3B,qFAAqF;AACrF,kDAAgC;AAChC,yCAAuB;AACvB,uEAAuE;AACvE,6CAA2B;AAC3B,mGAAmG;AACnG,2DAAyC;AACzC,4GAA4G;AAC5G,sDAAoC;AACpC,+CAA6B;AAC7B,+EAA+E;AAC/E,6CAA2B;AAC3B,8DAA4C;AAC5C,gGAAgG;AAChG,6CAAgJ;AAAvI,gHAAA,iBAAiB,OAAA;AAAE,8GAAA,eAAe,OAAA;AAAE,oHAAA,qBAAqB,OAAA;AAAE,6GAAA,cAAc,OAAA;AAAE,6GAAA,cAAc,OAAA;AAClG,qDAW2B;AAVzB,oHAAA,iBAAiB,OAAA;AACjB,2HAAA,wBAAwB,OAAA;AACxB,oHAAA,iBAAiB,OAAA;AACjB,gHAAA,aAAa,OAAA;AACb,wHAAA,qBAAqB,OAAA;AACrB,uHAAA,oBAAoB,OAAA;AAMtB,iEAAiE;AACjE,iDAA+B;AAC/B,4CAA0B;AAC1B,yFAAyF;AACzF,oDAAkC;AAClC,2CAAyB;AACzB,mDAAiC;AACjC,4CAA0B;AAC1B,2FAA2F;AAC3F,gDAA8B;AAC9B,+CAA6B;AAC7B,0GAA0G;AAC1G,mDAAiC;AACjC,iFAAiF;AACjF,gDAA8B;AAC9B,uFAAuF;AACvF,oDAAkC;AAClC,4EAA4E;AAC5E,oDAAkC;AAClC,sGAAsG;AACtG,qDAAmC;AACnC,6FAA6F;AAC7F,wCAAsB;AACtB,4CAA0B;AAC1B,6CAA2B;AAC3B,yCAAuB;AACvB,8CAA4B;AAC5B,2CAAyB;AACzB,4DAA4D;AAC5D,6CAA2B;AAC3B,kFAAkF;AAClF,oDAAkC;AAClC,yDAAuC;AACvC,iDAA+B;AAC/B,kDAAgC;AAChC,uDAAqC;AACrC,4CAA0B;AAC1B,8CAA4B;AAC5B,kDAAgC;AAChC,oDAAkC;AAClC,+DAA+D;AAC/D,kDAAgC;AAChC,qDAAmC;AACnC,sFAAsF;AACtF,0DAAwC;AACxC,kEAAkE;AAClE,wCAAsB;AACtB,qEAAqE;AACrE,4CAA0B;AAC1B,4CAA0B;AAC1B,gDAA8B;AAC9B,mDAAiC;AACjC,kDAAgC;AAChC,gGAAgG;AAChG,uDAAqC;AACrC,+DAA6C;AAC7C,sDAAsD;AACtD,wDAAsC;AACtC,+EAA+E;AAC/E,oDAAkC;AAClC,+EAA+E;AAC/E,2EAA2E;AAC3E,4CAA0B;AAC1B,kFAAkF;AAClF,mDAAiC;AACjC,4FAA4F;AAC5F,kDAAgC;AAChC,kFAAkF;AAClF,yEAAyE;AACzE,oEAAoE;AACpE,uDAAqC;AACrC,sDAAoC;AACpC,uEAAuE;AACvE,gDAA8B;AAC9B,0EAA0E;AAC1E,4EAA4E;AAC5E,0CAa0B;AARxB,iGAAA,QAAQ,OAAA;AACR,sGAAA,aAAa,OAAA;AACb,0GAAA,iBAAiB,OAAA;AACjB,uGAAA,cAAc,OAAA;AACd,yGAAA,gBAAgB,OAAA;AAChB,+GAAA,sBAAsB,OAAA;AACtB,kGAAA,SAAS,OAAA;AACT,wGAAA,eAAe,OAAA;AAEjB,qDAAmC;AAEnC,yGAAyG;AACzG,iDAA+B;AAE/B,kFAAkF;AAClF,sDAAoC;AAEpC,2FAA2F;AAC3F,gDAA8B;AAC9B,wCAAsB"}

package/dist/srp.d.ts

@@ -0,0 +1,55 @@
+/**
+ * SRP-6a sign-in: prove knowledge of the password without sending it.
+ *
+ * Uses RFC 5054's 3072-bit group with SHA-256 (the server publishes the same
+ * parameters), on WebCrypto and BigInt, so it runs in any current browser and
+ * Node. The flow on an existing sign-in attempt:
+ *
+ *   srp_challenge  -> salt, B, and the identity to hash in
+ *   srp_verify     -> M1 (the client proof); the server answers with M2
+ *
+ * and the helper checks M2, so a server that does not know the verifier cannot
+ * pass as Atlas. SRP does not replace TLS, and a passkey is a stronger
+ * sign-in; use this for apps that already speak SRP (Cognito migrations) or
+ * that must keep the password out of the request body.
+ */
+import type { FapiClient, FapiResponse } from './fapi';
+export interface SrpClientProof {
+    /** Public value A, hex, for the challenge request. */
+    A: string;
+    /** Finish with the server's answer: the client proof M1 and the server proof M2 expected back (both hex). */
+    respond(challenge: {
+        salt: string;
+        srp_b: string;
+        user_id_for_srp: string;
+    }, password: string): Promise<{
+        M1: string;
+        M2: string;
+    }>;
+}
+/** Start the client side of an exchange. `privateKey` is for tests; leave it unset. */
+export declare function srpClientStart(privateKey?: bigint): SrpClientProof;
+export declare const SRP_CHALLENGE_PATH: (attemptId: string) => string;
+export declare const SRP_VERIFY_PATH: (attemptId: string) => string;
+export interface SrpSignInOptions {
+    identifier: string;
+    password: string;
+    /** Continue an attempt that already has its identifier; otherwise one is started. */
+    attemptId?: string;
+    /**
+     * When SRP does not work (the account has no verifier yet, for example one migrated from
+     * another provider), try an ordinary password sign-in on the same attempt, which also
+     * sets up the verifier for next time. Default false.
+     */
+    fallbackToPassword?: boolean;
+    /** Fixed client private value, for tests only. */
+    privateKey?: bigint;
+}
+export type SrpSignInResult = FapiResponse<Record<string, unknown>> & {
+    /** True when the server proved it knew the verifier (its M2 matched). */
+    serverVerified: boolean;
+    attemptId: string | null;
+    method: 'srp' | 'password';
+};
+/** Sign in with SRP. On success `data` is the attempt view (with `ticket` when complete). */
+export declare function signInWithSrp(client: FapiClient, opts: SrpSignInOptions): Promise<SrpSignInResult>;

package/dist/srp.js

@@ -0,0 +1,120 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.SRP_VERIFY_PATH = exports.SRP_CHALLENGE_PATH = void 0;
+exports.srpClientStart = srpClientStart;
+exports.signInWithSrp = signInWithSrp;
+const N_HEX = 'FFFFFFFFFFFFFFFFC90FDAA22168C234C4C6628B80DC1CD129024E088A67CC74020BBEA63B139B22514A08798E3404DDEF9519B3CD3A431B302B0A6DF25F14374FE1356D6D51C245E485B576625E7EC6F44C42E9A637ED6B0BFF5CB6F406B7EDEE386BFB5A899FA5AE9F24117C4B1FE649286651ECE45B3DC2007CB8A163BF0598DA48361C55D39A69163FA8FD24CF5F83655D23DCA3AD961C62F356208552BB9ED529077096966D670C354E4ABC9804F1746C08CA18217C32905E462E36CE3BE39E772C180E86039B2783A2EC07A28FB5C55DF06F4C52C9DE2BCBF6955817183995497CEA956AE515D2261898FA051015728E5A8AAAC42DAD33170D04507A33A85521ABDF1CBA64ECFB850458DBEF0A8AEA71575D060C7DB3970F85A6E1E4C7ABF5AE8CDB0933D71E8C94E04A25619DCEE3D2261AD2EE6BF12FFA06D98A0864D87602733EC86A64521F2B18177B200CBBE117577A615D6C770988C0BAD946E208E24FA074E5AB3143DB5BFCE0FD108E4B82D120A93AD2CAFFFFFFFFFFFFFFFF';
+const N = BigInt('0x' + N_HEX);
+// BigInt() calls, not literals: the embed bundle targets ES2019 syntax.
+const ZERO = BigInt(0);
+const ONE = BigInt(1);
+const G = BigInt(5);
+const N_LEN = N_HEX.length / 2;
+const enc = new TextEncoder();
+const toHex = (b) => Array.from(b, (v) => v.toString(16).padStart(2, '0')).join('');
+const fromHex = (h) => Uint8Array.from((h.length % 2 ? '0' + h : h).match(/../g) ?? [], (x) => parseInt(x, 16));
+const big = (b) => (b.length ? BigInt('0x' + toHex(b)) : ZERO);
+const bytes = (n) => fromHex(n.toString(16));
+const pad = (n) => {
+    const b = bytes(n);
+    const out = new Uint8Array(Math.max(N_LEN, b.length));
+    out.set(b, out.length - b.length);
+    return out;
+};
+const concat = (...parts) => {
+    const out = new Uint8Array(parts.reduce((s, p) => s + p.length, 0));
+    let o = 0;
+    for (const p of parts) {
+        out.set(p, o);
+        o += p.length;
+    }
+    return out;
+};
+const sha256 = async (...parts) => new Uint8Array(await crypto.subtle.digest('SHA-256', concat(...parts)));
+function modPow(base, exp, mod) {
+    let result = ONE;
+    let b = ((base % mod) + mod) % mod;
+    for (let e = exp; e > ZERO; e >>= ONE) {
+        if (e & ONE)
+            result = (result * b) % mod;
+        b = (b * b) % mod;
+    }
+    return result;
+}
+/** Start the client side of an exchange. `privateKey` is for tests; leave it unset. */
+function srpClientStart(privateKey) {
+    const a = privateKey ?? big(crypto.getRandomValues(new Uint8Array(64)));
+    const A = modPow(G, a, N);
+    return {
+        A: A.toString(16),
+        async respond(ch, password) {
+            const B = BigInt('0x' + ch.srp_b);
+            if (B % N === ZERO)
+                throw new Error('The server sent an invalid SRP value.');
+            const k = big(await sha256(bytes(N), pad(G)));
+            const u = big(await sha256(pad(A), pad(B)));
+            const inner = await sha256(enc.encode(`${ch.user_id_for_srp}:${password}`));
+            const x = big(await sha256(fromHex(ch.salt), inner));
+            const base = (((B - k * modPow(G, x, N)) % N) + N) % N;
+            const S = modPow(base, a + u * x, N);
+            const K = await sha256(bytes(S));
+            const hn = await sha256(bytes(N));
+            const hg = await sha256(bytes(G));
+            const xored = hn.map((v, i) => v ^ hg[i]);
+            const M1 = await sha256(xored, await sha256(enc.encode(ch.user_id_for_srp)), fromHex(ch.salt), pad(A), pad(B), K);
+            const M2 = await sha256(pad(A), M1, K);
+            return { M1: toHex(M1), M2: toHex(M2) };
+        },
+    };
+}
+const SRP_CHALLENGE_PATH = (attemptId) => `/v1/client/sign_ins/${encodeURIComponent(attemptId)}/srp_challenge`;
+exports.SRP_CHALLENGE_PATH = SRP_CHALLENGE_PATH;
+const SRP_VERIFY_PATH = (attemptId) => `/v1/client/sign_ins/${encodeURIComponent(attemptId)}/srp_verify`;
+exports.SRP_VERIFY_PATH = SRP_VERIFY_PATH;
+const fail = (status, message) => ({
+    ok: false,
+    status,
+    data: null,
+    errors: [{ code: 'SRP_FAILED', message }],
+    serverVerified: false,
+    attemptId: null,
+    method: 'srp',
+});
+/** Sign in with SRP. On success `data` is the attempt view (with `ticket` when complete). */
+async function signInWithSrp(client, opts) {
+    let attemptId = opts.attemptId ?? null;
+    if (!attemptId) {
+        const start = await client.post('/v1/client/sign_ins', { identifier: opts.identifier });
+        if (!start.ok || !start.data)
+            return { ...start, serverVerified: false, attemptId: null, method: 'srp' };
+        attemptId = start.data.id;
+    }
+    const passwordFallback = async () => {
+        const res = await client.post(`/v1/client/sign_ins/${encodeURIComponent(attemptId)}/attempt_first_factor`, {
+            strategy: 'password',
+            password: opts.password,
+        });
+        return { ...res, serverVerified: false, attemptId, method: 'password' };
+    };
+    const proof = srpClientStart(opts.privateKey);
+    const challenge = await client.post((0, exports.SRP_CHALLENGE_PATH)(attemptId), { srp_a: proof.A });
+    if (!challenge.ok || !challenge.data)
+        return opts.fallbackToPassword && challenge.status === 422 ? passwordFallback() : { ...challenge, serverVerified: false, attemptId, method: 'srp' };
+    let answer;
+    try {
+        answer = await proof.respond(challenge.data, opts.password);
+    }
+    catch (e) {
+        return fail(400, e.message);
+    }
+    const verified = await client.post((0, exports.SRP_VERIFY_PATH)(attemptId), { srp_session: challenge.data.srp_session, srp_m1: answer.M1 });
+    if (!verified.ok) {
+        // The attempt has used its failure budget on this try; the fallback is a second, ordinary attempt.
+        return opts.fallbackToPassword ? passwordFallback() : { ...verified, serverVerified: false, attemptId, method: 'srp' };
+    }
+    const serverVerified = verified.data?.srp_m2 === answer.M2;
+    if (!serverVerified)
+        return { ...fail(400, 'The server did not prove it knows the verifier.'), attemptId };
+    return { ...verified, serverVerified, attemptId, method: 'srp' };
+}
+//# sourceMappingURL=srp.js.map

package/dist/srp.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"srp.js","sourceRoot":"","sources":["../src/srp.ts"],"names":[],"mappings":";;;AAkEA,wCAuBC;AAsCD,sCAiCC;AA/ID,MAAM,KAAK,GACT,kwBAAkwB,CAAC;AACrwB,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,GAAG,KAAK,CAAC,CAAC;AAC/B,wEAAwE;AACxE,MAAM,IAAI,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC;AACvB,MAAM,GAAG,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC;AACtB,MAAM,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC;AACpB,MAAM,KAAK,GAAG,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC;AAE/B,MAAM,GAAG,GAAG,IAAI,WAAW,EAAE,CAAC;AAC9B,MAAM,KAAK,GAAG,CAAC,CAAa,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;AAChG,MAAM,OAAO,GAAG,CAAC,CAAS,EAAE,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;AACxH,MAAM,GAAG,GAAG,CAAC,CAAa,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;AAC3E,MAAM,KAAK,GAAG,CAAC,CAAS,EAAE,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC;AACrD,MAAM,GAAG,GAAG,CAAC,CAAS,EAAE,EAAE;IACxB,MAAM,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;IACnB,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC;IACtD,GAAG,CAAC,GAAG,CAAC,CAAC,EAAE,GAAG,CAAC,MAAM,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC;IAClC,OAAO,GAAG,CAAC;AACb,CAAC,CAAC;AACF,MAAM,MAAM,GAAG,CAAC,GAAG,KAAmB,EAAE,EAAE;IACxC,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,CAAC;IACpE,IAAI,CAAC,GAAG,CAAC,CAAC;IACV,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;QACtB,GAAG,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;QACd,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC;IAChB,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC,CAAC;AACF,MAAM,MAAM,GAAG,KAAK,EAAE,GAAG,KAAmB,EAAE,EAAE,CAAC,IAAI,UAAU,CAAC,MAAM,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,MAAM,CAAC,GAAG,KAAK,CAAiB,CAAC,CAAC,CAAC;AAEzI,SAAS,MAAM,CAAC,IAAY,EAAE,GAAW,EAAE,GAAW;IACpD,IAAI,MAAM,GAAG,GAAG,CAAC;IACjB,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,GAAG,GAAG,CAAC,GAAG,GAAG,CAAC,GAAG,GAAG,CAAC;IACnC,KAAK,IAAI,CAAC,GAAG,GAAG,EAAE,CAAC,GAAG,IAAI,EAAE,CAAC,KAAK,GAAG,EAAE,CAAC;QACtC,IAAI,CAAC,GAAG,GAAG;YAAE,MAAM,GAAG,CAAC,MAAM,GAAG,CAAC,CAAC,GAAG,GAAG,CAAC;QACzC,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,GAAG,CAAC;IACpB,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AASD,uFAAuF;AACvF,SAAgB,cAAc,CAAC,UAAmB;IAChD,MAAM,CAAC,GAAG,UAAU,IAAI,GAAG,CAAC,MAAM,CAAC,eAAe,CAAC,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IACxE,MAAM,CAAC,GAAG,MAAM,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC;IAC1B,OAAO;QACL,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC;QACjB,KAAK,CAAC,OAAO,CAAC,EAAE,EAAE,QAAQ;YACxB,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,GAAG,EAAE,CAAC,KAAK,CAAC,CAAC;YAClC,IAAI,CAAC,GAAG,CAAC,KAAK,IAAI;gBAAE,MAAM,IAAI,KAAK,CAAC,uCAAuC,CAAC,CAAC;YAC7E,MAAM,CAAC,GAAG,GAAG,CAAC,MAAM,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YAC9C,MAAM,CAAC,GAAG,GAAG,CAAC,MAAM,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YAC5C,MAAM,KAAK,GAAG,MAAM,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC,eAAe,IAAI,QAAQ,EAAE,CAAC,CAAC,CAAC;YAC5E,MAAM,CAAC,GAAG,GAAG,CAAC,MAAM,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC;YACrD,MAAM,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,MAAM,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC;YACvD,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC;YACrC,MAAM,CAAC,GAAG,MAAM,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;YACjC,MAAM,EAAE,GAAG,MAAM,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;YAClC,MAAM,EAAE,GAAG,MAAM,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;YAClC,MAAM,KAAK,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,CAAE,CAAC,CAAC;YAC3C,MAAM,EAAE,GAAG,MAAM,MAAM,CAAC,KAAK,EAAE,MAAM,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,eAAe,CAAC,CAAC,EAAE,OAAO,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;YAClH,MAAM,EAAE,GAAG,MAAM,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC;YACvC,OAAO,EAAE,EAAE,EAAE,KAAK,CAAC,EAAE,CAAC,EAAE,EAAE,EAAE,KAAK,CAAC,EAAE,CAAC,EAAE,CAAC;QAC1C,CAAC;KACF,CAAC;AACJ,CAAC;AAEM,MAAM,kBAAkB,GAAG,CAAC,SAAiB,EAAE,EAAE,CAAC,uBAAuB,kBAAkB,CAAC,SAAS,CAAC,gBAAgB,CAAC;AAAjH,QAAA,kBAAkB,sBAA+F;AACvH,MAAM,eAAe,GAAG,CAAC,SAAiB,EAAE,EAAE,CAAC,uBAAuB,kBAAkB,CAAC,SAAS,CAAC,aAAa,CAAC;AAA3G,QAAA,eAAe,mBAA4F;AAwBxH,MAAM,IAAI,GAAG,CAAC,MAAc,EAAE,OAAe,EAAmB,EAAE,CAAC,CAAC;IAClE,EAAE,EAAE,KAAK;IACT,MAAM;IACN,IAAI,EAAE,IAAI;IACV,MAAM,EAAE,CAAC,EAAE,IAAI,EAAE,YAAY,EAAE,OAAO,EAAE,CAAC;IACzC,cAAc,EAAE,KAAK;IACrB,SAAS,EAAE,IAAI;IACf,MAAM,EAAE,KAAK;CACd,CAAC,CAAC;AAEH,6FAA6F;AACtF,KAAK,UAAU,aAAa,CAAC,MAAkB,EAAE,IAAsB;IAC5E,IAAI,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,IAAI,CAAC;IACvC,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,MAAM,KAAK,GAAG,MAAM,MAAM,CAAC,IAAI,CAAiB,qBAAqB,EAAE,EAAE,UAAU,EAAE,IAAI,CAAC,UAAU,EAAE,CAAC,CAAC;QACxG,IAAI,CAAC,KAAK,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI;YAAE,OAAO,EAAE,GAAG,KAAK,EAAE,cAAc,EAAE,KAAK,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAqB,CAAC;QAC5H,SAAS,GAAG,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;IAC5B,CAAC;IACD,MAAM,gBAAgB,GAAG,KAAK,IAA8B,EAAE;QAC5D,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,IAAI,CAA0B,uBAAuB,kBAAkB,CAAC,SAAU,CAAC,uBAAuB,EAAE;YACnI,QAAQ,EAAE,UAAU;YACpB,QAAQ,EAAE,IAAI,CAAC,QAAQ;SACxB,CAAC,CAAC;QACH,OAAO,EAAE,GAAG,GAAG,EAAE,cAAc,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC;IAC1E,CAAC,CAAC;IAEF,MAAM,KAAK,GAAG,cAAc,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IAC9C,MAAM,SAAS,GAAG,MAAM,MAAM,CAAC,IAAI,CAAgF,IAAA,0BAAkB,EAAC,SAAS,CAAC,EAAE,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC;IACtK,IAAI,CAAC,SAAS,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI;QAAE,OAAO,IAAI,CAAC,kBAAkB,IAAI,SAAS,CAAC,MAAM,KAAK,GAAG,CAAC,CAAC,CAAC,gBAAgB,EAAE,CAAC,CAAC,CAAC,EAAE,GAAG,SAAS,EAAE,cAAc,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,EAAE,KAAK,EAAqB,CAAC;IAE7M,IAAI,MAAkC,CAAC;IACvC,IAAI,CAAC;QACH,MAAM,GAAG,MAAM,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC;IAC9D,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,OAAO,IAAI,CAAC,GAAG,EAAG,CAAW,CAAC,OAAO,CAAC,CAAC;IACzC,CAAC;IACD,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,IAAI,CAA0B,IAAA,uBAAe,EAAC,SAAS,CAAC,EAAE,EAAE,WAAW,EAAE,SAAS,CAAC,IAAI,CAAC,WAAW,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,EAAE,CAAC,CAAC;IACxJ,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,mGAAmG;QACnG,OAAO,IAAI,CAAC,kBAAkB,CAAC,CAAC,CAAC,gBAAgB,EAAE,CAAC,CAAC,CAAE,EAAE,GAAG,QAAQ,EAAE,cAAc,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,EAAE,KAAK,EAAsB,CAAC;IAC9I,CAAC;IACD,MAAM,cAAc,GAAG,QAAQ,CAAC,IAAI,EAAE,MAAM,KAAK,MAAM,CAAC,EAAE,CAAC;IAC3D,IAAI,CAAC,cAAc;QAAE,OAAO,EAAE,GAAG,IAAI,CAAC,GAAG,EAAE,iDAAiD,CAAC,EAAE,SAAS,EAAE,CAAC;IAC3G,OAAO,EAAE,GAAG,QAAQ,EAAE,cAAc,EAAE,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;AACnE,CAAC"}

package/dist/uma.d.ts

@@ -0,0 +1,86 @@
+import type { FapiClient } from './fapi';
+/**
+ * User-Managed Access, from the two browser-side seats.
+ *
+ * The RESOURCE OWNER (signed in, cookie-authenticated through the {@link FapiClient}): list what they own and who
+ * it is shared with, share and stop sharing, and answer access requests (`/v1/client/me/uma/*`).
+ *
+ * The CLIENT acting for a requesting party: build the claims-gathering URL for a `need_info` answer that carries
+ * `redirect_user`, and read the ticket / error from the redirect back.
+ */
+export interface UmaPolicy {
+    object: 'uma_policy';
+    id: string;
+    resource_id: string;
+    subject: {
+        type: 'user' | 'group' | 'org';
+        id: string;
+    };
+    scopes: string[];
+    created_at: number;
+}
+export interface UmaOwnedResource {
+    object: 'uma_resource';
+    id: string;
+    name: string;
+    type: string | null;
+    uri: string | null;
+    resource_scopes: string[];
+    app: string | null;
+    policies: UmaPolicy[];
+}
+export interface UmaAccessRequest {
+    object: 'uma_access_request';
+    id: string;
+    resource_id: string;
+    resource_name?: string;
+    requester_user_id: string;
+    /** The requester's email address. */
+    requester?: string | null;
+    scopes: string[];
+    status: 'pending' | 'approved' | 'denied';
+    created_at: number;
+    decided_at: number | null;
+}
+/** A refused request; `code` is the server's stable error code. */
+export declare class UmaError extends Error {
+    readonly status: number;
+    readonly code: string;
+    constructor(status: number, code: string, message: string);
+}
+/** The resources the signed-in user owns, with who each is shared with. */
+export declare function listUmaResources(client: FapiClient): Promise<UmaOwnedResource[]>;
+/** Share a resource with a person (verified `email`) or a `subject` (user, group, org). Replaces an earlier share to the same subject. */
+export declare function shareUmaResource(client: FapiClient, resourceId: string, target: {
+    email: string;
+} | {
+    subject: {
+        type: 'user' | 'group' | 'org';
+        id: string;
+    };
+}, scopes: string[]): Promise<UmaPolicy>;
+export declare function unshareUmaResource(client: FapiClient, resourceId: string, subject: {
+    type: string;
+    id: string;
+}): Promise<void>;
+/** Access requests for the user's resources (the owner-approval queue). */
+export declare function listUmaAccessRequests(client: FapiClient, status?: UmaAccessRequest['status']): Promise<UmaAccessRequest[]>;
+/** Approve (optionally narrowing `scopes`) or deny a pending request. A request is decided once. */
+export declare function decideUmaAccessRequest(client: FapiClient, requestId: string, decision: 'approve' | 'deny', scopes?: string[]): Promise<UmaAccessRequest>;
+/**
+ * The URL to send the requesting party to for interactive claims gathering. `redirectUser` is the `redirect_user`
+ * from the `need_info` answer; `ticket` is that answer's (rotated) ticket. `claimsRedirectUri` must be one of the
+ * client's registered claims redirect URIs.
+ */
+export declare function umaClaimsUrl(redirectUser: string, params: {
+    clientId: string;
+    ticket: string;
+    claimsRedirectUri?: string;
+    state?: string;
+}): string;
+/** Read the redirect back from claims gathering: a new `ticket`, or an `error` (the person cancelled). */
+export declare function parseUmaClaimsRedirect(redirectUrl: string): {
+    ticket?: string;
+    error?: string;
+    state?: string;
+};

package/dist/uma.js

@@ -0,0 +1,73 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.UmaError = void 0;
+exports.listUmaResources = listUmaResources;
+exports.shareUmaResource = shareUmaResource;
+exports.unshareUmaResource = unshareUmaResource;
+exports.listUmaAccessRequests = listUmaAccessRequests;
+exports.decideUmaAccessRequest = decideUmaAccessRequest;
+exports.umaClaimsUrl = umaClaimsUrl;
+exports.parseUmaClaimsRedirect = parseUmaClaimsRedirect;
+/** A refused request; `code` is the server's stable error code. */
+class UmaError extends Error {
+    status;
+    code;
+    constructor(status, code, message) {
+        super(message);
+        this.name = 'UmaError';
+        this.status = status;
+        this.code = code;
+    }
+}
+exports.UmaError = UmaError;
+async function call(client, path, init) {
+    const res = await client.request(path, init);
+    if (!res.ok) {
+        const first = res.errors[0];
+        throw new UmaError(res.status, first?.code ?? 'UNKNOWN', first?.message ?? 'The request failed.');
+    }
+    return res.data;
+}
+const json = (method, body) => ({ method, body: JSON.stringify(body), headers: { 'content-type': 'application/json' } });
+const enc = encodeURIComponent;
+/** The resources the signed-in user owns, with who each is shared with. */
+async function listUmaResources(client) {
+    return (await call(client, '/v1/client/me/uma/resources', { method: 'GET' })).data ?? [];
+}
+/** Share a resource with a person (verified `email`) or a `subject` (user, group, org). Replaces an earlier share to the same subject. */
+function shareUmaResource(client, resourceId, target, scopes) {
+    return call(client, `/v1/client/me/uma/resources/${enc(resourceId)}/policies`, json('PUT', { ...target, scopes }));
+}
+async function unshareUmaResource(client, resourceId, subject) {
+    await call(client, `/v1/client/me/uma/resources/${enc(resourceId)}/policies/${enc(subject.type)}/${enc(subject.id)}`, { method: 'DELETE' });
+}
+/** Access requests for the user's resources (the owner-approval queue). */
+async function listUmaAccessRequests(client, status) {
+    const q = status ? `?status=${enc(status)}` : '';
+    return (await call(client, `/v1/client/me/uma/requests${q}`, { method: 'GET' })).data ?? [];
+}
+/** Approve (optionally narrowing `scopes`) or deny a pending request. A request is decided once. */
+function decideUmaAccessRequest(client, requestId, decision, scopes) {
+    return call(client, `/v1/client/me/uma/requests/${enc(requestId)}/decision`, json('POST', { decision, ...(scopes ? { scopes } : {}) }));
+}
+/**
+ * The URL to send the requesting party to for interactive claims gathering. `redirectUser` is the `redirect_user`
+ * from the `need_info` answer; `ticket` is that answer's (rotated) ticket. `claimsRedirectUri` must be one of the
+ * client's registered claims redirect URIs.
+ */
+function umaClaimsUrl(redirectUser, params) {
+    const url = new URL(redirectUser);
+    url.searchParams.set('client_id', params.clientId);
+    url.searchParams.set('ticket', params.ticket);
+    if (params.claimsRedirectUri)
+        url.searchParams.set('claims_redirect_uri', params.claimsRedirectUri);
+    if (params.state)
+        url.searchParams.set('state', params.state);
+    return url.toString();
+}
+/** Read the redirect back from claims gathering: a new `ticket`, or an `error` (the person cancelled). */
+function parseUmaClaimsRedirect(redirectUrl) {
+    const p = new URL(redirectUrl).searchParams;
+    return { ticket: p.get('ticket') ?? undefined, error: p.get('error') ?? undefined, state: p.get('state') ?? undefined };
+}
+//# sourceMappingURL=uma.js.map

package/dist/uma.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"uma.js","sourceRoot":"","sources":["../src/uma.ts"],"names":[],"mappings":";;;AAuEA,4CAEC;AAGD,4CAOC;AAED,gDAEC;AAGD,sDAGC;AAGD,wDAEC;AAOD,oCAOC;AAGD,wDAGC;AAxED,mEAAmE;AACnE,MAAa,QAAS,SAAQ,KAAK;IACxB,MAAM,CAAS;IACf,IAAI,CAAS;IACtB,YAAY,MAAc,EAAE,IAAY,EAAE,OAAe;QACvD,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,UAAU,CAAC;QACvB,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QACrB,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;IACnB,CAAC;CACF;AATD,4BASC;AAED,KAAK,UAAU,IAAI,CAAI,MAAkB,EAAE,IAAY,EAAE,IAAiB;IACxE,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,OAAO,CAAI,IAAI,EAAE,IAAI,CAAC,CAAC;IAChD,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;QACZ,MAAM,KAAK,GAAG,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;QAC5B,MAAM,IAAI,QAAQ,CAAC,GAAG,CAAC,MAAM,EAAE,KAAK,EAAE,IAAI,IAAI,SAAS,EAAE,KAAK,EAAE,OAAO,IAAI,qBAAqB,CAAC,CAAC;IACpG,CAAC;IACD,OAAO,GAAG,CAAC,IAAS,CAAC;AACvB,CAAC;AAED,MAAM,IAAI,GAAG,CAAC,MAAc,EAAE,IAAa,EAAe,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,EAAE,CAAC,CAAC;AACvJ,MAAM,GAAG,GAAG,kBAAkB,CAAC;AAE/B,2EAA2E;AACpE,KAAK,UAAU,gBAAgB,CAAC,MAAkB;IACvD,OAAO,CAAC,MAAM,IAAI,CAAgC,MAAM,EAAE,6BAA6B,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,IAAI,EAAE,CAAC;AAC1H,CAAC;AAED,0IAA0I;AAC1I,SAAgB,gBAAgB,CAC9B,MAAkB,EAClB,UAAkB,EAClB,MAAuF,EACvF,MAAgB;IAEhB,OAAO,IAAI,CAAC,MAAM,EAAE,+BAA+B,GAAG,CAAC,UAAU,CAAC,WAAW,EAAE,IAAI,CAAC,KAAK,EAAE,EAAE,GAAG,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC;AACrH,CAAC;AAEM,KAAK,UAAU,kBAAkB,CAAC,MAAkB,EAAE,UAAkB,EAAE,OAAqC;IACpH,MAAM,IAAI,CAAC,MAAM,EAAE,+BAA+B,GAAG,CAAC,UAAU,CAAC,aAAa,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC,EAAE,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,CAAC;AAC9I,CAAC;AAED,2EAA2E;AACpE,KAAK,UAAU,qBAAqB,CAAC,MAAkB,EAAE,MAAmC;IACjG,MAAM,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,WAAW,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IACjD,OAAO,CAAC,MAAM,IAAI,CAAgC,MAAM,EAAE,6BAA6B,CAAC,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,IAAI,EAAE,CAAC;AAC7H,CAAC;AAED,oGAAoG;AACpG,SAAgB,sBAAsB,CAAC,MAAkB,EAAE,SAAiB,EAAE,QAA4B,EAAE,MAAiB;IAC3H,OAAO,IAAI,CAAC,MAAM,EAAE,8BAA8B,GAAG,CAAC,SAAS,CAAC,WAAW,EAAE,IAAI,CAAC,MAAM,EAAE,EAAE,QAAQ,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC;AAC1I,CAAC;AAED;;;;GAIG;AACH,SAAgB,YAAY,CAAC,YAAoB,EAAE,MAAwF;IACzI,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,YAAY,CAAC,CAAC;IAClC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,WAAW,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC;IACnD,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,QAAQ,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC;IAC9C,IAAI,MAAM,CAAC,iBAAiB;QAAE,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,qBAAqB,EAAE,MAAM,CAAC,iBAAiB,CAAC,CAAC;IACpG,IAAI,MAAM,CAAC,KAAK;QAAE,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC;IAC9D,OAAO,GAAG,CAAC,QAAQ,EAAE,CAAC;AACxB,CAAC;AAED,0GAA0G;AAC1G,SAAgB,sBAAsB,CAAC,WAAmB;IACxD,MAAM,CAAC,GAAG,IAAI,GAAG,CAAC,WAAW,CAAC,CAAC,YAAY,CAAC;IAC5C,OAAO,EAAE,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,SAAS,EAAE,KAAK,EAAE,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,SAAS,EAAE,KAAK,EAAE,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,SAAS,EAAE,CAAC;AAC1H,CAAC"}

package/dist/version.d.ts

@@ -4,4 +4,4 @@
  * package.json at runtime) so the bundle stays dependency-free and tests stay
  * deterministic; `version.test.ts` fails when it drifts from package.json.
  */
-export declare const ATLAS_JS_VERSION = "0.24.0";
+export declare const ATLAS_JS_VERSION = "0.25.0";

package/dist/version.js

@@ -7,5 +7,5 @@ exports.ATLAS_JS_VERSION = void 0;
  * package.json at runtime) so the bundle stays dependency-free and tests stay
  * deterministic; `version.test.ts` fails when it drifts from package.json.
  */
-exports.ATLAS_JS_VERSION = '0.24.0';
+exports.ATLAS_JS_VERSION = '0.25.0';
 //# sourceMappingURL=version.js.map

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@atlasauth/js",
-  "version": "0.24.0",
+  "version": "0.25.0",
   "main": "./dist/index.js",
   "types": "./dist/index.d.ts",
   "exports": {
@@ -20,7 +20,7 @@
     "vitest": "^2.1.4"
   },
   "dependencies": {
-    "@atlasauth/authz": "0.2.0"
+    "@atlasauth/authz": "0.3.0"
   },
   "publishConfig": {
     "access": "public"