@atlasauth/js 0.24.0 → 0.26.0

package/CHANGELOG.md

@@ -1,6 +1,21 @@
 # @atlasauth/js changelog
 
-## Unreleased
+## 0.26.0 — 2026-10-28
+
+- CIBA approvals and PIN (`listCibaRequests`, `decideCibaRequest`, `getCibaPin`, `setCibaPin`, `clearCibaPin`)
+- Cross-device magic link (`prepareFactor(..., { crossDevice: true })`, `previewCrossDeviceLink`, `confirmCrossDeviceLink`)
+- Passkey hints, conditional create and `getClientCapabilities`
+- Resource sharing client and connector directory facets
+
+## 0.25.0 — 2026-10-27
+
+- `signInWithSrp` and `srpClientStart`: SRP-6a password sign-in (RFC 5054, 3072-bit group, SHA-256), so the password never leaves the browser.
+- `listAuthorizedApps`, `disconnectAuthorizedApp` and `revokeAppGrant`: the apps a user authorized, with the OpenID Grant Management grants each holds.
+- Identity governance for the signed-in user: `listAccessCatalog`, `requestAccess`, `listMyAccess`, `listMyAccessRequests`, `getAccessRequest`, `cancelAccessRequest`, `listPendingApprovals`, `decideAccessRequest`, `listAccessReviews`, `decideAccessReview`, `listAccessDelegations`, `delegateApprovals` and `endDelegation`.
+- Connections: `revokeMyConnection` and `revokeOrganizationConnection` return `provider_revoked` (true, false or `'unsupported'`), `provider_status`, `provider_error` and `local_cleared`; `AppConnection.last_error` carries the provider's code and HTTP status and `refresh_failures`.
+- Connections: `setOrganizationConnectionCredentials` takes every credential field (bearer token, basic username and password, custom header value, HMAC secret, signing key, OAuth 1.0a keys), `expiresAt` and `config`; `AppConnection.kind` lists the new kinds and carries `secret_expires_at`. There is still no call that reads a credential back.
+- Connections: `connectMyConnection`, `connectOrganizationConnection`, `revokeOrganizationConnection`, `listOrganizationOAuthClients`, `setOrganizationOAuthClient`, `deleteOrganizationOAuthClient`; `AppConnection` carries `environment`, `external_id`, `host_params`, `scopes`, `metadata` and `last_error`, and its status adds `revoked` and `error`.
+- User-managed access for resource owners: `listUmaResources`, `shareUmaResource`, `unshareUmaResource`, `listUmaAccessRequests` and `decideUmaAccessRequest`, with a typed `UmaError`, plus `umaClaimsUrl` and `parseUmaClaimsRedirect` for the claims-gathering redirect.
 
 ## 0.24.0 — 2026-10-26
 

package/dist/app-launcher.d.ts

@@ -9,3 +9,8 @@ export interface LauncherApp {
 }
 /** The apps the signed-in user may launch. Rejects when nobody is signed in. */
 export declare function listLauncherApps(client: FapiClient): Promise<LauncherApp[]>;
+/**
+ * Where to send the browser to sign out of Atlas and every SAML app it signed in to (single logout).
+ * Navigate to it; apps that publish a logout endpoint are told, then a signed-out page is shown.
+ */
+export declare function samlLogoutUrl(client: FapiClient): string;

package/dist/app-launcher.js

@@ -1,6 +1,7 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.listLauncherApps = listLauncherApps;
+exports.samlLogoutUrl = samlLogoutUrl;
 /** The apps the signed-in user may launch. Rejects when nobody is signed in. */
 async function listLauncherApps(client) {
     const res = await client.request('/v1/saml/idp/apps', { method: 'GET' });
@@ -9,4 +10,11 @@ async function listLauncherApps(client) {
     }
     return res.data.data.map((a) => ({ id: a.id, name: a.name, presetId: a.preset_id, launchUrl: a.launch_url }));
 }
+/**
+ * Where to send the browser to sign out of Atlas and every SAML app it signed in to (single logout).
+ * Navigate to it; apps that publish a logout endpoint are told, then a signed-out page is shown.
+ */
+function samlLogoutUrl(client) {
+    return client.urlFor(`/v1/saml/idp/slo/start?pk=${encodeURIComponent(client.publishableKey)}`);
+}
 //# sourceMappingURL=app-launcher.js.map

package/dist/app-launcher.js.map

@@ -1 +1 @@
-{"version":3,"file":"app-launcher.js","sourceRoot":"","sources":["../src/app-launcher.ts"],"names":[],"mappings":";;AAmBA,4CAMC;AAPD,gFAAgF;AACzE,KAAK,UAAU,gBAAgB,CAAC,MAAkB;IACvD,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,OAAO,CAA8B,mBAAmB,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;IACtG,IAAI,CAAC,GAAG,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;QACzB,MAAM,IAAI,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,OAAO,IAAI,2BAA2B,CAAC,CAAC;IACzE,CAAC;IACD,OAAO,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAC,SAAS,EAAE,SAAS,EAAE,CAAC,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC;AAChH,CAAC"}
+{"version":3,"file":"app-launcher.js","sourceRoot":"","sources":["../src/app-launcher.ts"],"names":[],"mappings":";;AAmBA,4CAMC;AAMD,sCAEC;AAfD,gFAAgF;AACzE,KAAK,UAAU,gBAAgB,CAAC,MAAkB;IACvD,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,OAAO,CAA8B,mBAAmB,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;IACtG,IAAI,CAAC,GAAG,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;QACzB,MAAM,IAAI,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,OAAO,IAAI,2BAA2B,CAAC,CAAC;IACzE,CAAC;IACD,OAAO,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAC,SAAS,EAAE,SAAS,EAAE,CAAC,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC;AAChH,CAAC;AAED;;;GAGG;AACH,SAAgB,aAAa,CAAC,MAAkB;IAC9C,OAAO,MAAM,CAAC,MAAM,CAAC,6BAA6B,kBAAkB,CAAC,MAAM,CAAC,cAAc,CAAC,EAAE,CAAC,CAAC;AACjG,CAAC"}

package/dist/authorized-apps.d.ts

@@ -0,0 +1,42 @@
+import type { FapiClient } from './fapi';
+/**
+ * The signed-in user's authorized apps: the third-party OAuth clients they signed
+ * in to with this application, and the grants (OpenID Grant Management `grant_id`s)
+ * each holds. Cookie-authenticated through the {@link FapiClient}
+ * (`/v1/client/me/oauth_grants`, `/v1/client/me/managed_grants`).
+ */
+/** One grant an app holds for the user; withdrawing it ends every token issued under it. */
+export interface AppGrant {
+    id: string;
+    scopes: string[];
+    /** The API the grant covers, when it is for one. */
+    resource: string | null;
+    created_at: number;
+    updated_at: number;
+}
+export interface AuthorizedApp {
+    object: 'oauth_grant';
+    /** The remembered consent's id; pass it to {@link disconnectAuthorizedApp}. */
+    id: string;
+    client_id: string | null;
+    name: string;
+    logo_url: string | null;
+    first_party: boolean;
+    scopes: string[];
+    grants: AppGrant[];
+    created_at: number;
+}
+/** A refused request; `code` is the server's stable error code. */
+export declare class AuthorizedAppsError extends Error {
+    readonly status: number;
+    readonly code: string;
+    constructor(status: number, code: string, message: string);
+}
+/** The apps this user authorized, each with the grants it holds. */
+export declare function listAuthorizedApps(client: FapiClient): Promise<AuthorizedApp[]>;
+/** Forget an app entirely: its consent, every grant and every live token. */
+export declare function disconnectAuthorizedApp(client: FapiClient, consentId: string): Promise<void>;
+/** Withdraw one grant of an app, leaving its other grants alone. Every token issued under it ends at once. */
+export declare function revokeAppGrant(client: FapiClient, grantId: string): Promise<{
+    tokensEnded: number;
+}>;

package/dist/authorized-apps.js

@@ -0,0 +1,41 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AuthorizedAppsError = void 0;
+exports.listAuthorizedApps = listAuthorizedApps;
+exports.disconnectAuthorizedApp = disconnectAuthorizedApp;
+exports.revokeAppGrant = revokeAppGrant;
+/** A refused request; `code` is the server's stable error code. */
+class AuthorizedAppsError extends Error {
+    status;
+    code;
+    constructor(status, code, message) {
+        super(message);
+        this.name = 'AuthorizedAppsError';
+        this.status = status;
+        this.code = code;
+    }
+}
+exports.AuthorizedAppsError = AuthorizedAppsError;
+async function call(client, path, init) {
+    const res = await client.request(path, init);
+    if (!res.ok || !res.data) {
+        const first = res.errors[0];
+        throw new AuthorizedAppsError(res.status, first?.code ?? 'UNKNOWN', first?.message ?? 'The request failed.');
+    }
+    return res.data;
+}
+/** The apps this user authorized, each with the grants it holds. */
+async function listAuthorizedApps(client) {
+    const body = await call(client, '/v1/client/me/oauth_grants', { method: 'GET' });
+    return (body.data ?? []).map((app) => ({ ...app, grants: app.grants ?? [] }));
+}
+/** Forget an app entirely: its consent, every grant and every live token. */
+async function disconnectAuthorizedApp(client, consentId) {
+    await call(client, `/v1/client/me/oauth_grants/${encodeURIComponent(consentId)}`, { method: 'DELETE' });
+}
+/** Withdraw one grant of an app, leaving its other grants alone. Every token issued under it ends at once. */
+async function revokeAppGrant(client, grantId) {
+    const body = await call(client, `/v1/client/me/managed_grants/${encodeURIComponent(grantId)}`, { method: 'DELETE' });
+    return { tokensEnded: body.tokens_ended ?? 0 };
+}
+//# sourceMappingURL=authorized-apps.js.map

package/dist/authorized-apps.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"authorized-apps.js","sourceRoot":"","sources":["../src/authorized-apps.ts"],"names":[],"mappings":";;;AAsDA,gDAGC;AAGD,0DAEC;AAGD,wCAGC;AApCD,mEAAmE;AACnE,MAAa,mBAAoB,SAAQ,KAAK;IACnC,MAAM,CAAS;IACf,IAAI,CAAS;IACtB,YAAY,MAAc,EAAE,IAAY,EAAE,OAAe;QACvD,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,qBAAqB,CAAC;QAClC,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QACrB,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;IACnB,CAAC;CACF;AATD,kDASC;AAED,KAAK,UAAU,IAAI,CAAI,MAAkB,EAAE,IAAY,EAAE,IAAiB;IACxE,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,OAAO,CAAI,IAAI,EAAE,IAAI,CAAC,CAAC;IAChD,IAAI,CAAC,GAAG,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;QACzB,MAAM,KAAK,GAAG,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;QAC5B,MAAM,IAAI,mBAAmB,CAAC,GAAG,CAAC,MAAM,EAAE,KAAK,EAAE,IAAI,IAAI,SAAS,EAAE,KAAK,EAAE,OAAO,IAAI,qBAAqB,CAAC,CAAC;IAC/G,CAAC;IACD,OAAO,GAAG,CAAC,IAAI,CAAC;AAClB,CAAC;AAED,oEAAoE;AAC7D,KAAK,UAAU,kBAAkB,CAAC,MAAkB;IACzD,MAAM,IAAI,GAAG,MAAM,IAAI,CAA6B,MAAM,EAAE,4BAA4B,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;IAC7G,OAAO,CAAC,IAAI,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,GAAG,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC;AAChF,CAAC;AAED,6EAA6E;AACtE,KAAK,UAAU,uBAAuB,CAAC,MAAkB,EAAE,SAAiB;IACjF,MAAM,IAAI,CAAC,MAAM,EAAE,8BAA8B,kBAAkB,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,CAAC;AAC1G,CAAC;AAED,8GAA8G;AACvG,KAAK,UAAU,cAAc,CAAC,MAAkB,EAAE,OAAe;IACtE,MAAM,IAAI,GAAG,MAAM,IAAI,CAA4B,MAAM,EAAE,gCAAgC,kBAAkB,CAAC,OAAO,CAAC,EAAE,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,CAAC;IAChJ,OAAO,EAAE,WAAW,EAAE,IAAI,CAAC,YAAY,IAAI,CAAC,EAAE,CAAC;AACjD,CAAC"}

package/dist/ciba.d.ts

@@ -0,0 +1,38 @@
+import type { FapiClient } from './fapi';
+/**
+ * CIBA self-service for the signed-in user: the backchannel requests waiting for their decision, and the
+ * optional CIBA PIN apps must send as the `user_code`. Cookie-authenticated through the {@link FapiClient}
+ * (`/v1/client/me/backchannel_requests`, `/v1/client/me/ciba_pin`); a bearer token is refused by the server.
+ */
+export interface CibaRequest {
+    id: string;
+    client_name: string;
+    scope: string[];
+    binding_message: string | null;
+    created_at: number;
+    expires_at: number;
+}
+export interface CibaPinStatus {
+    set: boolean;
+    updated_at: number | null;
+    /** Some app on this instance can start CIBA requests, so showing the PIN form is worthwhile. */
+    available: boolean;
+}
+export declare class CibaError extends Error {
+    readonly status: number;
+    readonly code: string;
+    constructor(status: number, code: string, message: string);
+}
+/** Requests from apps waiting for this user to approve or deny. */
+export declare function listCibaRequests(client: FapiClient): Promise<CibaRequest[]>;
+/** Approve or deny one request. */
+export declare function decideCibaRequest(client: FapiClient, id: string, decision: 'approve' | 'deny'): Promise<'approved' | 'denied'>;
+export declare function getCibaPin(client: FapiClient): Promise<CibaPinStatus>;
+/** Set or change the PIN (6 to 12 digits). Needs the current password and a recent sign-in. */
+export declare function setCibaPin(client: FapiClient, input: {
+    pin: string;
+    currentPassword?: string;
+}): Promise<void>;
+export declare function clearCibaPin(client: FapiClient, input?: {
+    currentPassword?: string;
+}): Promise<void>;

package/dist/ciba.js

@@ -0,0 +1,53 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.CibaError = void 0;
+exports.listCibaRequests = listCibaRequests;
+exports.decideCibaRequest = decideCibaRequest;
+exports.getCibaPin = getCibaPin;
+exports.setCibaPin = setCibaPin;
+exports.clearCibaPin = clearCibaPin;
+class CibaError extends Error {
+    status;
+    code;
+    constructor(status, code, message) {
+        super(message);
+        this.name = 'CibaError';
+        this.status = status;
+        this.code = code;
+    }
+}
+exports.CibaError = CibaError;
+async function call(client, path, init) {
+    const res = await client.request(path, init);
+    if (!res.ok || !res.data) {
+        const first = res.errors[0];
+        throw new CibaError(res.status, first?.code ?? 'UNKNOWN', first?.message ?? 'The request failed.');
+    }
+    return res.data;
+}
+const json = (method, body) => ({
+    method,
+    ...(body === undefined ? {} : { headers: { 'content-type': 'application/json' }, body: JSON.stringify(body) }),
+});
+/** Requests from apps waiting for this user to approve or deny. */
+async function listCibaRequests(client) {
+    const body = await call(client, '/v1/client/me/backchannel_requests', json('GET'));
+    return body.data ?? [];
+}
+/** Approve or deny one request. */
+async function decideCibaRequest(client, id, decision) {
+    const body = await call(client, `/v1/client/me/backchannel_requests/${encodeURIComponent(id)}`, json('POST', { decision }));
+    return body.status;
+}
+async function getCibaPin(client) {
+    const body = await call(client, '/v1/client/me/ciba_pin', json('GET'));
+    return { set: body.set, updated_at: body.updated_at ?? null, available: body.available ?? false };
+}
+/** Set or change the PIN (6 to 12 digits). Needs the current password and a recent sign-in. */
+async function setCibaPin(client, input) {
+    await call(client, '/v1/client/me/ciba_pin', json('PUT', { pin: input.pin, current_password: input.currentPassword }));
+}
+async function clearCibaPin(client, input = {}) {
+    await call(client, '/v1/client/me/ciba_pin', json('DELETE', { current_password: input.currentPassword }));
+}
+//# sourceMappingURL=ciba.js.map

package/dist/ciba.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ciba.js","sourceRoot":"","sources":["../src/ciba.ts"],"names":[],"mappings":";;;AAiDA,4CAGC;AAGD,8CAGC;AAED,gCAGC;AAGD,gCAEC;AAED,oCAEC;AAjDD,MAAa,SAAU,SAAQ,KAAK;IACzB,MAAM,CAAS;IACf,IAAI,CAAS;IACtB,YAAY,MAAc,EAAE,IAAY,EAAE,OAAe;QACvD,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,WAAW,CAAC;QACxB,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QACrB,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;IACnB,CAAC;CACF;AATD,8BASC;AAED,KAAK,UAAU,IAAI,CAAI,MAAkB,EAAE,IAAY,EAAE,IAAiB;IACxE,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,OAAO,CAAI,IAAI,EAAE,IAAI,CAAC,CAAC;IAChD,IAAI,CAAC,GAAG,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;QACzB,MAAM,KAAK,GAAG,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;QAC5B,MAAM,IAAI,SAAS,CAAC,GAAG,CAAC,MAAM,EAAE,KAAK,EAAE,IAAI,IAAI,SAAS,EAAE,KAAK,EAAE,OAAO,IAAI,qBAAqB,CAAC,CAAC;IACrG,CAAC;IACD,OAAO,GAAG,CAAC,IAAI,CAAC;AAClB,CAAC;AAED,MAAM,IAAI,GAAG,CAAC,MAAc,EAAE,IAAc,EAAe,EAAE,CAAC,CAAC;IAC7D,MAAM;IACN,GAAG,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC;CAC/G,CAAC,CAAC;AAEH,mEAAmE;AAC5D,KAAK,UAAU,gBAAgB,CAAC,MAAkB;IACvD,MAAM,IAAI,GAAG,MAAM,IAAI,CAA2B,MAAM,EAAE,oCAAoC,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;IAC7G,OAAO,IAAI,CAAC,IAAI,IAAI,EAAE,CAAC;AACzB,CAAC;AAED,mCAAmC;AAC5B,KAAK,UAAU,iBAAiB,CAAC,MAAkB,EAAE,EAAU,EAAE,QAA4B;IAClG,MAAM,IAAI,GAAG,MAAM,IAAI,CAAoC,MAAM,EAAE,sCAAsC,kBAAkB,CAAC,EAAE,CAAC,EAAE,EAAE,IAAI,CAAC,MAAM,EAAE,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC;IAC/J,OAAO,IAAI,CAAC,MAAM,CAAC;AACrB,CAAC;AAEM,KAAK,UAAU,UAAU,CAAC,MAAkB;IACjD,MAAM,IAAI,GAAG,MAAM,IAAI,CAAoE,MAAM,EAAE,wBAAwB,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;IAC1I,OAAO,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,UAAU,EAAE,IAAI,CAAC,UAAU,IAAI,IAAI,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,IAAI,KAAK,EAAE,CAAC;AACpG,CAAC;AAED,+FAA+F;AACxF,KAAK,UAAU,UAAU,CAAC,MAAkB,EAAE,KAAgD;IACnG,MAAM,IAAI,CAAC,MAAM,EAAE,wBAAwB,EAAE,IAAI,CAAC,KAAK,EAAE,EAAE,GAAG,EAAE,KAAK,CAAC,GAAG,EAAE,gBAAgB,EAAE,KAAK,CAAC,eAAe,EAAE,CAAC,CAAC,CAAC;AACzH,CAAC;AAEM,KAAK,UAAU,YAAY,CAAC,MAAkB,EAAE,QAAsC,EAAE;IAC7F,MAAM,IAAI,CAAC,MAAM,EAAE,wBAAwB,EAAE,IAAI,CAAC,QAAQ,EAAE,EAAE,gBAAgB,EAAE,KAAK,CAAC,eAAe,EAAE,CAAC,CAAC,CAAC;AAC5G,CAAC"}

package/dist/connections.d.ts

@@ -5,7 +5,7 @@ import type { FapiClient } from './fapi';
  * an OAuth account a member shared), with live status. Authorizing an OAuth
  * connection uses `connectExternalAccount` / `reauthorizeExternalAccount`.
  */
-export type ConnectionStatus = 'connected' | 'not_connected' | 'needs_reauth';
+export type ConnectionStatus = 'connected' | 'not_connected' | 'needs_reauth' | 'revoked' | 'error';
 export interface AppConnection {
     object: 'connection';
     id: string;
@@ -13,20 +13,121 @@ export interface AppConnection {
         type: 'organization' | 'user';
         id: string;
     };
-    kind: 'oauth' | 'api_key' | 'client_credentials';
+    kind: 'oauth' | 'api_key' | 'client_credentials' | 'bearer' | 'basic' | 'custom_header' | 'hmac_secret' | 'jwt_bearer' | 'oauth1' | 'github_app_installation' | 'admin_consent';
     provider: string;
     name: string;
     allowed_hosts: string[];
     status: ConnectionStatus;
+    /** Always `data`: a connection is never a sign-in method. */
+    purpose?: 'data';
+    environment?: 'production' | 'sandbox';
+    sandbox?: boolean;
+    /** The provider-side account the connection covers (a company, a workspace, a user id). */
+    external_id?: string | null;
+    host_params?: Record<string, string>;
+    scopes?: string[];
+    expires_at?: number | null;
+    /** Non-secret provider handles captured with the token (realmId, instance_url, team_id...). */
+    metadata?: Record<string, string>;
+    /** The provider's own error behind the status (`invalid_grant`, ...), with the HTTP status it answered. */
+    last_error?: {
+        code: string;
+        message: string;
+        httpStatus?: number | null;
+        at: number;
+    } | null;
+    /** Consecutive failed refreshes; 0 when healthy. */
+    refresh_failures?: number;
+    /** @deprecated Always null: a connection owns its tokens. */
     external_account_id: string | null;
     has_secret: boolean;
+    /** When the entered credential expires (epoch ms). The credential itself is never readable from the browser. */
+    secret_expires_at?: number | null;
 }
-/** Credential to enter for an api_key or client_credentials connection. Write-only. */
+/** What the provider said when a connection was disconnected. The stored token is cleared in every case. */
+export interface ConnectionRevokeResult {
+    /** `true` the provider confirmed; `'unsupported'` it has no revoke endpoint; `false` it refused or was unreachable (see `provider_error`). */
+    provider_revoked: boolean | 'unsupported' | 'not_connected';
+    provider_status: number | null;
+    provider_error: {
+        code: string;
+        description: string | null;
+    } | null;
+    local_cleared: true;
+}
+/** What to send when starting the provider authorization of a connection. */
+export interface ConnectConnectionInput {
+    /** Where the owner lands afterwards; the URL carries `__atlas_status=connected` and `__atlas_connection=<id>`. */
+    redirectUrl: string;
+    /** Values for the provider's host templates, e.g. `{ subdomain: 'acme' }` or `{ tenant: 'contoso.onmicrosoft.com' }`. */
+    hostParams?: Record<string, string>;
+    environment?: 'production' | 'sandbox';
+    additionalScopes?: string[];
+    loginHint?: string;
+    display?: 'redirect' | 'popup';
+    /** A different provider account than the connection holds creates a sibling instead of failing with 409. */
+    createIfNew?: boolean;
+}
+export interface ConnectionAuthorization {
+    object: 'connection_authorization';
+    connection_id: string;
+    authorization_url: string;
+    attempt_id: string;
+}
+/** An organization's own OAuth client for a provider (the secret is write-only). */
+export interface ConnectionOAuthClient {
+    object: 'connection_oauth_client';
+    id: string;
+    provider: string;
+    environment: 'production' | 'sandbox';
+    client_id: string;
+    has_secret: true;
+    scopes: string[];
+    host_params: Record<string, string>;
+    enabled: boolean;
+    callback_url: string;
+}
+export interface SetConnectionOAuthClientInput {
+    provider: string;
+    environment?: 'production' | 'sandbox';
+    clientId: string;
+    /** Required the first time; omit to keep the stored secret. */
+    clientSecret?: string;
+    scopes?: string[];
+    hostParams?: Record<string, string>;
+    enabled?: boolean;
+}
+/**
+ * Credential to enter for a non-OAuth connection. Write-only: it is sealed server-side and no browser call can read it
+ * back. Which fields apply depends on the connection's kind.
+ */
 export interface ConnectionCredentialsInput {
+    /** api_key */
     apiKey?: string;
+    /** bearer */
+    token?: string;
+    /** basic */
+    username?: string;
+    password?: string;
+    /** custom_header */
+    value?: string;
+    /** hmac_secret */
+    secret?: string;
+    /** client_credentials */
     clientId?: string;
     clientSecret?: string;
     tokenUrl?: string;
+    /** jwt_bearer / github_app_installation: a PEM private key, or (jwt_bearer) a Google service-account JSON key. */
+    privateKey?: string;
+    serviceAccountJson?: string;
+    /** oauth1 */
+    consumerKey?: string;
+    consumerSecret?: string;
+    tokenSecret?: string;
+    /** Epoch milliseconds or an ISO date; reminders go out 30, 7 and 1 days before. */
+    expiresAt?: number | string;
+    /** Non-secret settings of the kind (placement, header name, algorithm...). */
+    config?: Record<string, unknown>;
 }
 export declare class ConnectionRequestError extends Error {
     readonly status: number;
@@ -41,3 +142,20 @@ export declare function listOrganizationConnections(client: FapiClient, organiza
 export declare function setOrganizationConnectionCredentials(client: FapiClient, organizationId: string, connectionId: string, input: ConnectionCredentialsInput): Promise<AppConnection>;
 /** Share the signed-in admin's own linked provider account with the organization. */
 export declare function shareOrganizationConnection(client: FapiClient, organizationId: string, connectionId: string): Promise<AppConnection>;
+/**
+ * Connect (or reconnect) one of the signed-in user's own connections. Navigate to `authorization_url`. This stores the
+ * tokens on the connection: it adds no sign-in method and needs no step-up.
+ */
+export declare function connectMyConnection(client: FapiClient, connectionId: string, input: ConnectConnectionInput): Promise<ConnectionAuthorization>;
+/** Disconnect one of the signed-in user's own connections. The answer says whether the provider confirmed the revoke. */
+export declare function revokeMyConnection(client: FapiClient, connectionId: string): Promise<AppConnection & ConnectionRevokeResult>;
+/** Connect (or reconnect) an organization's connection (needs the org profile-manage permission, not a step-up). */
+export declare function connectOrganizationConnection(client: FapiClient, organizationId: string, connectionId: string, input: ConnectConnectionInput): Promise<ConnectionAuthorization>;
+/** Disconnect an organization's connection. */
+export declare function revokeOrganizationConnection(client: FapiClient, organizationId: string, connectionId: string): Promise<AppConnection & ConnectionRevokeResult>;
+/** The organization's own OAuth clients. */
+export declare function listOrganizationOAuthClients(client: FapiClient, organizationId: string): Promise<ConnectionOAuthClient[]>;
+/** Set the organization's own OAuth client for a provider; it overrides the instance client for its connections. */
+export declare function setOrganizationOAuthClient(client: FapiClient, organizationId: string, input: SetConnectionOAuthClientInput): Promise<ConnectionOAuthClient>;
+/** Delete the organization's OAuth client (refused while its connections hold tokens it issued). */
+export declare function deleteOrganizationOAuthClient(client: FapiClient, organizationId: string, clientId: string): Promise<void>;

package/dist/connections.js

@@ -5,6 +5,13 @@ exports.listMyConnections = listMyConnections;
 exports.listOrganizationConnections = listOrganizationConnections;
 exports.setOrganizationConnectionCredentials = setOrganizationConnectionCredentials;
 exports.shareOrganizationConnection = shareOrganizationConnection;
+exports.connectMyConnection = connectMyConnection;
+exports.revokeMyConnection = revokeMyConnection;
+exports.connectOrganizationConnection = connectOrganizationConnection;
+exports.revokeOrganizationConnection = revokeOrganizationConnection;
+exports.listOrganizationOAuthClients = listOrganizationOAuthClients;
+exports.setOrganizationOAuthClient = setOrganizationOAuthClient;
+exports.deleteOrganizationOAuthClient = deleteOrganizationOAuthClient;
 class ConnectionRequestError extends Error {
     status;
     code;
@@ -35,19 +42,76 @@ async function listOrganizationConnections(client, organizationId) {
 }
 /** Enter the organization's credential for a connection (needs the org profile-manage permission). */
 function setOrganizationConnectionCredentials(client, organizationId, connectionId, input) {
+    const map = [
+        ['apiKey', 'api_key'], ['token', 'token'], ['username', 'username'], ['password', 'password'], ['value', 'value'], ['secret', 'secret'],
+        ['clientId', 'client_id'], ['clientSecret', 'client_secret'], ['tokenUrl', 'token_url'], ['privateKey', 'private_key'],
+        ['serviceAccountJson', 'service_account_json'], ['consumerKey', 'consumer_key'], ['consumerSecret', 'consumer_secret'],
+        ['tokenSecret', 'token_secret'], ['expiresAt', 'expires_at'], ['config', 'config'],
+    ];
     const body = {};
-    if (input.apiKey !== undefined)
-        body.api_key = input.apiKey;
-    if (input.clientId !== undefined)
-        body.client_id = input.clientId;
-    if (input.clientSecret !== undefined)
-        body.client_secret = input.clientSecret;
-    if (input.tokenUrl !== undefined)
-        body.token_url = input.tokenUrl;
+    for (const [from, to] of map)
+        if (input[from] !== undefined)
+            body[to] = input[from];
     return call(client, `${orgBase(organizationId)}/${encodeURIComponent(connectionId)}/credentials`, { method: 'PUT', body: JSON.stringify(body) });
 }
 /** Share the signed-in admin's own linked provider account with the organization. */
 function shareOrganizationConnection(client, organizationId, connectionId) {
     return call(client, `${orgBase(organizationId)}/${encodeURIComponent(connectionId)}/share`, { method: 'POST', body: '{}' });
 }
+const connectBody = (i) => ({
+    redirect_url: i.redirectUrl,
+    ...(i.hostParams ? { host_params: i.hostParams } : {}),
+    ...(i.environment ? { environment: i.environment } : {}),
+    ...(i.additionalScopes ? { additional_scopes: i.additionalScopes } : {}),
+    ...(i.loginHint ? { login_hint: i.loginHint } : {}),
+    ...(i.display ? { display: i.display } : {}),
+    ...(i.createIfNew ? { create_if_new: true } : {}),
+});
+/**
+ * Connect (or reconnect) one of the signed-in user's own connections. Navigate to `authorization_url`. This stores the
+ * tokens on the connection: it adds no sign-in method and needs no step-up.
+ */
+function connectMyConnection(client, connectionId, input) {
+    return call(client, `/v1/client/me/connections/${encodeURIComponent(connectionId)}/connect`, { method: 'POST', body: JSON.stringify(connectBody(input)) });
+}
+/** Disconnect one of the signed-in user's own connections. The answer says whether the provider confirmed the revoke. */
+function revokeMyConnection(client, connectionId) {
+    return call(client, `/v1/client/me/connections/${encodeURIComponent(connectionId)}/revoke`, { method: 'POST', body: '{}' });
+}
+/** Connect (or reconnect) an organization's connection (needs the org profile-manage permission, not a step-up). */
+function connectOrganizationConnection(client, organizationId, connectionId, input) {
+    return call(client, `${orgBase(organizationId)}/${encodeURIComponent(connectionId)}/connect`, { method: 'POST', body: JSON.stringify(connectBody(input)) });
+}
+/** Disconnect an organization's connection. */
+function revokeOrganizationConnection(client, organizationId, connectionId) {
+    return call(client, `${orgBase(organizationId)}/${encodeURIComponent(connectionId)}/revoke`, { method: 'POST', body: '{}' });
+}
+const clientsBase = (organizationId) => `/v1/client/organizations/${encodeURIComponent(organizationId)}/connection_oauth_clients`;
+/** The organization's own OAuth clients. */
+async function listOrganizationOAuthClients(client, organizationId) {
+    return (await call(client, clientsBase(organizationId), { method: 'GET' })).data ?? [];
+}
+/** Set the organization's own OAuth client for a provider; it overrides the instance client for its connections. */
+function setOrganizationOAuthClient(client, organizationId, input) {
+    return call(client, clientsBase(organizationId), {
+        method: 'PUT',
+        body: JSON.stringify({
+            provider: input.provider,
+            ...(input.environment ? { environment: input.environment } : {}),
+            client_id: input.clientId,
+            ...(input.clientSecret ? { client_secret: input.clientSecret } : {}),
+            ...(input.scopes ? { scopes: input.scopes } : {}),
+            ...(input.hostParams ? { host_params: input.hostParams } : {}),
+            ...(input.enabled !== undefined ? { enabled: input.enabled } : {}),
+        }),
+    });
+}
+/** Delete the organization's OAuth client (refused while its connections hold tokens it issued). */
+async function deleteOrganizationOAuthClient(client, organizationId, clientId) {
+    const res = await client.request(`${clientsBase(organizationId)}/${encodeURIComponent(clientId)}`, { method: 'DELETE' });
+    if (!res.ok) {
+        const first = res.errors[0];
+        throw new ConnectionRequestError(res.status, first?.code ?? 'UNKNOWN', first?.message ?? 'The request failed.');
+    }
+}
 //# sourceMappingURL=connections.js.map

package/dist/connections.js.map

@@ -1 +1 @@
-{"version":3,"file":"connections.js","sourceRoot":"","sources":["../src/connections.ts"],"names":[],"mappings":";;;AAsDA,8CAEC;AAGD,kEAEC;AAGD,oFAYC;AAGD,kEAEC;AAlDD,MAAa,sBAAuB,SAAQ,KAAK;IAEpC;IACA;IAFX,YACW,MAAc,EACd,IAAY,EACrB,OAAe;QAEf,KAAK,CAAC,OAAO,CAAC,CAAC;QAJN,WAAM,GAAN,MAAM,CAAQ;QACd,SAAI,GAAJ,IAAI,CAAQ;QAIrB,IAAI,CAAC,IAAI,GAAG,wBAAwB,CAAC;IACvC,CAAC;CACF;AATD,wDASC;AAED,KAAK,UAAU,IAAI,CAAI,MAAkB,EAAE,IAAY,EAAE,IAAiB;IACxE,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,OAAO,CAAI,IAAI,EAAE,IAAI,CAAC,CAAC;IAChD,IAAI,CAAC,GAAG,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;QACzB,MAAM,KAAK,GAAG,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;QAC5B,MAAM,IAAI,sBAAsB,CAAC,GAAG,CAAC,MAAM,EAAE,KAAK,EAAE,IAAI,IAAI,SAAS,EAAE,KAAK,EAAE,OAAO,IAAI,qBAAqB,CAAC,CAAC;IAClH,CAAC;IACD,OAAO,GAAG,CAAC,IAAI,CAAC;AAClB,CAAC;AAED,MAAM,OAAO,GAAG,CAAC,cAAsB,EAAE,EAAE,CAAC,4BAA4B,kBAAkB,CAAC,cAAc,CAAC,cAAc,CAAC;AAEzH,4CAA4C;AACrC,KAAK,UAAU,iBAAiB,CAAC,MAAkB;IACxD,OAAO,CAAC,MAAM,IAAI,CAA4B,MAAM,EAAE,2BAA2B,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,IAAI,EAAE,CAAC;AACpH,CAAC;AAED,6CAA6C;AACtC,KAAK,UAAU,2BAA2B,CAAC,MAAkB,EAAE,cAAsB;IAC1F,OAAO,CAAC,MAAM,IAAI,CAA4B,MAAM,EAAE,OAAO,CAAC,cAAc,CAAC,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,IAAI,EAAE,CAAC;AAChH,CAAC;AAED,sGAAsG;AACtG,SAAgB,oCAAoC,CAClD,MAAkB,EAClB,cAAsB,EACtB,YAAoB,EACpB,KAAiC;IAEjC,MAAM,IAAI,GAA2B,EAAE,CAAC;IACxC,IAAI,KAAK,CAAC,MAAM,KAAK,SAAS;QAAE,IAAI,CAAC,OAAO,GAAG,KAAK,CAAC,MAAM,CAAC;IAC5D,IAAI,KAAK,CAAC,QAAQ,KAAK,SAAS;QAAE,IAAI,CAAC,SAAS,GAAG,KAAK,CAAC,QAAQ,CAAC;IAClE,IAAI,KAAK,CAAC,YAAY,KAAK,SAAS;QAAE,IAAI,CAAC,aAAa,GAAG,KAAK,CAAC,YAAY,CAAC;IAC9E,IAAI,KAAK,CAAC,QAAQ,KAAK,SAAS;QAAE,IAAI,CAAC,SAAS,GAAG,KAAK,CAAC,QAAQ,CAAC;IAClE,OAAO,IAAI,CAAgB,MAAM,EAAE,GAAG,OAAO,CAAC,cAAc,CAAC,IAAI,kBAAkB,CAAC,YAAY,CAAC,cAAc,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;AAClK,CAAC;AAED,qFAAqF;AACrF,SAAgB,2BAA2B,CAAC,MAAkB,EAAE,cAAsB,EAAE,YAAoB;IAC1G,OAAO,IAAI,CAAgB,MAAM,EAAE,GAAG,OAAO,CAAC,cAAc,CAAC,IAAI,kBAAkB,CAAC,YAAY,CAAC,QAAQ,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;AAC7I,CAAC"}
+{"version":3,"file":"connections.js","sourceRoot":"","sources":["../src/connections.ts"],"names":[],"mappings":";;;AAwJA,8CAEC;AAGD,kEAEC;AAGD,oFAeC;AAGD,kEAEC;AAgBD,kDAEC;AAGD,gDAEC;AAGD,sEAEC;AAGD,oEAEC;AAKD,oEAEC;AAGD,gEAaC;AAGD,sEAMC;AAtHD,MAAa,sBAAuB,SAAQ,KAAK;IAEpC;IACA;IAFX,YACW,MAAc,EACd,IAAY,EACrB,OAAe;QAEf,KAAK,CAAC,OAAO,CAAC,CAAC;QAJN,WAAM,GAAN,MAAM,CAAQ;QACd,SAAI,GAAJ,IAAI,CAAQ;QAIrB,IAAI,CAAC,IAAI,GAAG,wBAAwB,CAAC;IACvC,CAAC;CACF;AATD,wDASC;AAED,KAAK,UAAU,IAAI,CAAI,MAAkB,EAAE,IAAY,EAAE,IAAiB;IACxE,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,OAAO,CAAI,IAAI,EAAE,IAAI,CAAC,CAAC;IAChD,IAAI,CAAC,GAAG,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;QACzB,MAAM,KAAK,GAAG,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;QAC5B,MAAM,IAAI,sBAAsB,CAAC,GAAG,CAAC,MAAM,EAAE,KAAK,EAAE,IAAI,IAAI,SAAS,EAAE,KAAK,EAAE,OAAO,IAAI,qBAAqB,CAAC,CAAC;IAClH,CAAC;IACD,OAAO,GAAG,CAAC,IAAI,CAAC;AAClB,CAAC;AAED,MAAM,OAAO,GAAG,CAAC,cAAsB,EAAE,EAAE,CAAC,4BAA4B,kBAAkB,CAAC,cAAc,CAAC,cAAc,CAAC;AAEzH,4CAA4C;AACrC,KAAK,UAAU,iBAAiB,CAAC,MAAkB;IACxD,OAAO,CAAC,MAAM,IAAI,CAA4B,MAAM,EAAE,2BAA2B,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,IAAI,EAAE,CAAC;AACpH,CAAC;AAED,6CAA6C;AACtC,KAAK,UAAU,2BAA2B,CAAC,MAAkB,EAAE,cAAsB;IAC1F,OAAO,CAAC,MAAM,IAAI,CAA4B,MAAM,EAAE,OAAO,CAAC,cAAc,CAAC,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,IAAI,EAAE,CAAC;AAChH,CAAC;AAED,sGAAsG;AACtG,SAAgB,oCAAoC,CAClD,MAAkB,EAClB,cAAsB,EACtB,YAAoB,EACpB,KAAiC;IAEjC,MAAM,GAAG,GAAsD;QAC7D,CAAC,QAAQ,EAAE,SAAS,CAAC,EAAE,CAAC,OAAO,EAAE,OAAO,CAAC,EAAE,CAAC,UAAU,EAAE,UAAU,CAAC,EAAE,CAAC,UAAU,EAAE,UAAU,CAAC,EAAE,CAAC,OAAO,EAAE,OAAO,CAAC,EAAE,CAAC,QAAQ,EAAE,QAAQ,CAAC;QACvI,CAAC,UAAU,EAAE,WAAW,CAAC,EAAE,CAAC,cAAc,EAAE,eAAe,CAAC,EAAE,CAAC,UAAU,EAAE,WAAW,CAAC,EAAE,CAAC,YAAY,EAAE,aAAa,CAAC;QACtH,CAAC,oBAAoB,EAAE,sBAAsB,CAAC,EAAE,CAAC,aAAa,EAAE,cAAc,CAAC,EAAE,CAAC,gBAAgB,EAAE,iBAAiB,CAAC;QACtH,CAAC,aAAa,EAAE,cAAc,CAAC,EAAE,CAAC,WAAW,EAAE,YAAY,CAAC,EAAE,CAAC,QAAQ,EAAE,QAAQ,CAAC;KACnF,CAAC;IACF,MAAM,IAAI,GAA4B,EAAE,CAAC;IACzC,KAAK,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,GAAG;QAAE,IAAI,KAAK,CAAC,IAAI,CAAC,KAAK,SAAS;YAAE,IAAI,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC;IACpF,OAAO,IAAI,CAAgB,MAAM,EAAE,GAAG,OAAO,CAAC,cAAc,CAAC,IAAI,kBAAkB,CAAC,YAAY,CAAC,cAAc,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;AAClK,CAAC;AAED,qFAAqF;AACrF,SAAgB,2BAA2B,CAAC,MAAkB,EAAE,cAAsB,EAAE,YAAoB;IAC1G,OAAO,IAAI,CAAgB,MAAM,EAAE,GAAG,OAAO,CAAC,cAAc,CAAC,IAAI,kBAAkB,CAAC,YAAY,CAAC,QAAQ,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;AAC7I,CAAC;AAED,MAAM,WAAW,GAAG,CAAC,CAAyB,EAAE,EAAE,CAAC,CAAC;IAClD,YAAY,EAAE,CAAC,CAAC,WAAW;IAC3B,GAAG,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IACtD,GAAG,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IACxD,GAAG,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,EAAE,iBAAiB,EAAE,CAAC,CAAC,gBAAgB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IACxE,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IACnD,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IAC5C,GAAG,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;CAClD,CAAC,CAAC;AAEH;;;GAGG;AACH,SAAgB,mBAAmB,CAAC,MAAkB,EAAE,YAAoB,EAAE,KAA6B;IACzG,OAAO,IAAI,CAA0B,MAAM,EAAE,6BAA6B,kBAAkB,CAAC,YAAY,CAAC,UAAU,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC;AACtL,CAAC;AAED,yHAAyH;AACzH,SAAgB,kBAAkB,CAAC,MAAkB,EAAE,YAAoB;IACzE,OAAO,IAAI,CAAyC,MAAM,EAAE,6BAA6B,kBAAkB,CAAC,YAAY,CAAC,SAAS,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;AACtK,CAAC;AAED,oHAAoH;AACpH,SAAgB,6BAA6B,CAAC,MAAkB,EAAE,cAAsB,EAAE,YAAoB,EAAE,KAA6B;IAC3I,OAAO,IAAI,CAA0B,MAAM,EAAE,GAAG,OAAO,CAAC,cAAc,CAAC,IAAI,kBAAkB,CAAC,YAAY,CAAC,UAAU,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC;AACvL,CAAC;AAED,+CAA+C;AAC/C,SAAgB,4BAA4B,CAAC,MAAkB,EAAE,cAAsB,EAAE,YAAoB;IAC3G,OAAO,IAAI,CAAyC,MAAM,EAAE,GAAG,OAAO,CAAC,cAAc,CAAC,IAAI,kBAAkB,CAAC,YAAY,CAAC,SAAS,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;AACvK,CAAC;AAED,MAAM,WAAW,GAAG,CAAC,cAAsB,EAAE,EAAE,CAAC,4BAA4B,kBAAkB,CAAC,cAAc,CAAC,2BAA2B,CAAC;AAE1I,4CAA4C;AACrC,KAAK,UAAU,4BAA4B,CAAC,MAAkB,EAAE,cAAsB;IAC3F,OAAO,CAAC,MAAM,IAAI,CAAoC,MAAM,EAAE,WAAW,CAAC,cAAc,CAAC,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,IAAI,EAAE,CAAC;AAC5H,CAAC;AAED,oHAAoH;AACpH,SAAgB,0BAA0B,CAAC,MAAkB,EAAE,cAAsB,EAAE,KAAoC;IACzH,OAAO,IAAI,CAAwB,MAAM,EAAE,WAAW,CAAC,cAAc,CAAC,EAAE;QACtE,MAAM,EAAE,KAAK;QACb,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;YACnB,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,GAAG,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,KAAK,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAChE,SAAS,EAAE,KAAK,CAAC,QAAQ;YACzB,GAAG,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,KAAK,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACpE,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACjD,GAAG,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,KAAK,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC9D,GAAG,CAAC,KAAK,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACnE,CAAC;KACH,CAAC,CAAC;AACL,CAAC;AAED,oGAAoG;AAC7F,KAAK,UAAU,6BAA6B,CAAC,MAAkB,EAAE,cAAsB,EAAE,QAAgB;IAC9G,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,OAAO,CAAU,GAAG,WAAW,CAAC,cAAc,CAAC,IAAI,kBAAkB,CAAC,QAAQ,CAAC,EAAE,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,CAAC;IAClI,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;QACZ,MAAM,KAAK,GAAG,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;QAC5B,MAAM,IAAI,sBAAsB,CAAC,GAAG,CAAC,MAAM,EAAE,KAAK,EAAE,IAAI,IAAI,SAAS,EAAE,KAAK,EAAE,OAAO,IAAI,qBAAqB,CAAC,CAAC;IAClH,CAAC;AACH,CAAC"}

package/dist/connector-directory.d.ts

@@ -0,0 +1,29 @@
+import type { FapiClient } from './fapi';
+/** One entry of the public connector directory. */
+export interface DirectoryConnector {
+    slug: string;
+    displayName: string;
+    category: string;
+    tagline: string | null;
+    logoUrl: string | null;
+    verified: boolean;
+    featured: boolean;
+    installCount: number;
+    source: string;
+}
+export interface DirectoryFacets {
+    categories: {
+        category: string;
+        count: number;
+    }[];
+    total: number;
+}
+/** Search the public connector directory (built-in providers and community connectors) with category facets. */
+export declare function listConnectorDirectory(client: FapiClient, opts?: {
+    q?: string;
+    category?: string;
+    verified?: boolean;
+}): Promise<{
+    connectors: DirectoryConnector[];
+    facets: DirectoryFacets;
+}>;

package/dist/connector-directory.js

@@ -0,0 +1,24 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.listConnectorDirectory = listConnectorDirectory;
+/** Search the public connector directory (built-in providers and community connectors) with category facets. */
+async function listConnectorDirectory(client, opts = {}) {
+    const qs = new URLSearchParams();
+    if (opts.q)
+        qs.set('q', opts.q);
+    if (opts.category)
+        qs.set('category', opts.category);
+    if (opts.verified)
+        qs.set('verified', 'true');
+    const res = await client.request(`/v1/public/connectors${qs.size ? `?${qs}` : ''}`, { method: 'GET' });
+    if (!res.ok || !res.data)
+        throw new Error(res.errors[0]?.message ?? 'Could not load the connector directory.');
+    return {
+        connectors: res.data.data.map((c) => ({
+            slug: c.slug, displayName: c.display_name, category: c.category, tagline: c.tagline ?? null, logoUrl: c.logo_url ?? null,
+            verified: Boolean(c.verified), featured: Boolean(c.featured), installCount: c.install_count ?? 0, source: c.source ?? 'builtin',
+        })),
+        facets: { categories: res.data.facets?.categories ?? [], total: res.data.facets?.total ?? res.data.data.length },
+    };
+}
+//# sourceMappingURL=connector-directory.js.map

package/dist/connector-directory.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"connector-directory.js","sourceRoot":"","sources":["../src/connector-directory.ts"],"names":[],"mappings":";;AAiCA,wDAiBC;AAlBD,gHAAgH;AACzG,KAAK,UAAU,sBAAsB,CAC1C,MAAkB,EAClB,OAA8D,EAAE;IAEhE,MAAM,EAAE,GAAG,IAAI,eAAe,EAAE,CAAC;IACjC,IAAI,IAAI,CAAC,CAAC;QAAE,EAAE,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC;IAChC,IAAI,IAAI,CAAC,QAAQ;QAAE,EAAE,CAAC,GAAG,CAAC,UAAU,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC;IACrD,IAAI,IAAI,CAAC,QAAQ;QAAE,EAAE,CAAC,GAAG,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;IAC9C,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,OAAO,CAA6G,wBAAwB,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;IACnN,IAAI,CAAC,GAAG,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,IAAI;QAAE,MAAM,IAAI,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,OAAO,IAAI,yCAAyC,CAAC,CAAC;IAC/G,OAAO;QACL,UAAU,EAAE,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YACpC,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,WAAW,EAAE,CAAC,CAAC,YAAY,EAAE,QAAQ,EAAE,CAAC,CAAC,QAAQ,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,IAAI,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC,QAAQ,IAAI,IAAI;YACxH,QAAQ,EAAE,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,YAAY,EAAE,CAAC,CAAC,aAAa,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,IAAI,SAAS;SAChI,CAAC,CAAC;QACH,MAAM,EAAE,EAAE,UAAU,EAAE,GAAG,CAAC,IAAI,CAAC,MAAM,EAAE,UAAU,IAAI,EAAE,EAAE,KAAK,EAAE,GAAG,CAAC,IAAI,CAAC,MAAM,EAAE,KAAK,IAAI,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE;KACjH,CAAC;AACJ,CAAC"}

package/dist/fapi.d.ts

@@ -248,6 +248,8 @@ export interface FlowState {
      * server returns a new attempt.
      */
     prepared?: 'email_code' | 'email_link' | null;
+    /** Cross-device link: the code to show on this device; the device that opens the link shows the same one. */
+    matchCode?: string | null;
     /**
      * After a sign-in completed here: true when this browser now holds the
      * session, false when it didn't keep it (its cookie was blocked). Unset while
@@ -328,7 +330,31 @@ export declare function resendSignUpVerification(client: FapiClient, state: Flow
  */
 export declare function awaitingSignUpLink(attempt: AttemptView | null | undefined, emailVerification: string | null | undefined): boolean;
 /** §5.3: ask the server to send a code or a magic link. */
-export declare function prepareFactor(client: FapiClient, state: FlowState, strategy: 'email_code' | 'email_link'): Promise<FlowState>;
+export declare function prepareFactor(client: FapiClient, state: FlowState, strategy: 'email_code' | 'email_link', opts?: {
+    crossDevice?: boolean;
+}): Promise<FlowState>;
+/** What the page the cross-device link opens needs: whether to ask for confirmation, and the code to compare. */
+export interface CrossDeviceLinkPreview {
+    requiresConfirmation: boolean;
+    matchCode: string | null;
+}
+/**
+ * Cross-device magic link, second device: read the code from the opened link (`?attempt=&token=&cross_device=1`)
+ * so the page can show it next to the prompt "does this match the code on your other device?". Completes nothing.
+ */
+export declare function previewCrossDeviceLink(client: FapiClient, link: {
+    attempt: string;
+    token: string;
+}): Promise<CrossDeviceLinkPreview | null>;
+/**
+ * Cross-device magic link, second device: confirm with the code both devices show. The first device's
+ * `pollAttempt` then returns the ticket. One use; a wrong code invalidates the link.
+ */
+export declare function confirmCrossDeviceLink(client: FapiClient, link: {
+    attempt: string;
+    token: string;
+    matchCode: string;
+}): Promise<boolean>;
 /**
  * §5.3 polling. Returns the updated flow, and a ticket once the link has been
  * opened somewhere.