@noresponse/node 2.0.10 → 2.0.12

package/CHANGELOG.md

@@ -1,5 +1,17 @@
 # Changelog
 
+## 2.0.12
+
+* `sdk.assessments.create()`: 
+  *  `request.body.issuedCredential` **Added**
+  *  `response.risk` **Changed**
+* `sdk.assessments.get()`:  `response.risk` **Changed**
+* `sdk.assessments.query()`:  `response.items[].risk` **Changed**
+
+## 2.0.11
+
+No changes detected.
+
 ## 2.0.10
 
 No changes detected.

package/README.md

@@ -173,6 +173,15 @@ Override per client with `retryConfig`, or per call with `{ retries }`:
 await nr.assessments.create(params, { retries: { strategy: "none" } });
 ```
 
+## Issued keys
+
+When your signup gate issues an API key to the new account, send only its hash, as `issued_credential.sha256`; the key itself never leaves your backend.
+
+```ts
+import { hashIssuedCredential } from "@noresponse/node";
+const sha256 = hashIssuedCredential(issuedKey); // 64 lower-case hex characters
+```
+
 ## Webhooks
 
 Verify the exact bytes you received, then act on the typed event. `secrets` maps each `whk_` key id we give you to its secret; hold both during a rotation.
@@ -201,6 +210,19 @@ async function handler(req, res) {
 
 `constructEvent(payload, headers, secrets, { toleranceSeconds })` takes the raw body (a `Buffer`, `Uint8Array` or the exact text), any header object (Fetch `Headers`, Node `IncomingHttpHeaders`, a plain object or entries) and refuses a repeated signature header, a delivery older than 300 seconds, an unknown key id or a bad signature with a `WebhookVerificationError` whose `code` says which. Deliveries are at least once: deduplicate on `event.id`. The same functions are on `NoResponse.webhooks` and `nr.webhooks`. This module uses `node:crypto`.
 
+### Late results
+
+An assessment can be revised after you allowed the signup. `handleLateResult` verifies the delivery with `constructEvent`, applies your policy and acts through your auth provider's admin API:
+
+```ts
+import { clerkActions, handleLateResult } from "@noresponse/node"; // or workosActions, auth0Actions
+
+const provider = clerkActions({ secretKey: process.env.CLERK_SECRET_KEY! });
+const result = await handleLateResult(rawBody, request.headers, secrets, provider, { policy: { review: "ban" } });
+```
+
+The default policy revokes sessions on `review` and does nothing otherwise. `ban` blocks the user in Clerk and Auth0; WorkOS has no block, so its ban deletes the user permanently. Pass `userId` when the provider's user id is not your `accountId`. A refused provider call throws `ProviderActionError`; answer the webhook with a 5xx so we retry it.
+
 ## Auth adapters
 
 Map a session your backend has already verified into `authContext`:

package/dist/commonjs/funcs/assessments-create.d.ts

@@ -12,7 +12,7 @@ import { Result } from "../types/fp.js";
  * Assess identifiers for a signup or gateway decision.
  *
  * @remarks
- * Returns within the deadline (500 ms at most) with a complete, partial or pending assessment: 200 carries complete or partial, 202 carries pending with Location and Retry-After. A pending answer has no recommendation; apply your own fallback for pending, 429, 503 or a timeout. Requires the assess scope. Idempotency-Key is required and is bound to the body for 24 hours: the same key with the same body replays the latest assessment with Idempotent-Replayed: true and starts no new work; the same key with a different body answers 409 idempotency_key_reused. response_mode defaults to standard; detailed needs the detailed scope.
+ * Returns within the deadline (500 ms at most) with a complete, partial or pending assessment: 200 carries complete or partial, 202 carries pending with Location and Retry-After. A pending answer has no recommendation; apply your own fallback for pending, 429, 503 or a timeout. risk.block says when your block threshold was reached. Requires the assess scope. Idempotency-Key is required and is bound to the body for 24 hours: the same key with the same body replays the latest assessment with Idempotent-Replayed: true and starts no new work; the same key with a different body answers 409 idempotency_key_reused. response_mode defaults to standard; detailed needs the detailed scope.
  */
 export declare function assessmentsCreate(client: NoResponseCore, request: operations.CreateAssessmentRequest, options?: RequestOptions): APIPromise<Result<operations.CreateAssessmentResponse, errors.BadRequestError | errors.AuthenticationError | errors.PermissionDeniedError | errors.NotFoundError | errors.ConflictError | errors.RateLimitError | NoResponseError | ResponseValidationError | ConnectionError | RequestAbortedError | RequestTimeoutError | InvalidRequestError | UnexpectedClientError | SDKValidationError>>;
 //# sourceMappingURL=assessments-create.d.ts.map

package/dist/commonjs/funcs/assessments-create.js

@@ -49,7 +49,7 @@ const async_js_1 = require("../types/async.js");
  * Assess identifiers for a signup or gateway decision.
  *
  * @remarks
- * Returns within the deadline (500 ms at most) with a complete, partial or pending assessment: 200 carries complete or partial, 202 carries pending with Location and Retry-After. A pending answer has no recommendation; apply your own fallback for pending, 429, 503 or a timeout. Requires the assess scope. Idempotency-Key is required and is bound to the body for 24 hours: the same key with the same body replays the latest assessment with Idempotent-Replayed: true and starts no new work; the same key with a different body answers 409 idempotency_key_reused. response_mode defaults to standard; detailed needs the detailed scope.
+ * Returns within the deadline (500 ms at most) with a complete, partial or pending assessment: 200 carries complete or partial, 202 carries pending with Location and Retry-After. A pending answer has no recommendation; apply your own fallback for pending, 429, 503 or a timeout. risk.block says when your block threshold was reached. Requires the assess scope. Idempotency-Key is required and is bound to the body for 24 hours: the same key with the same body replays the latest assessment with Idempotent-Replayed: true and starts no new work; the same key with a different body answers 409 idempotency_key_reused. response_mode defaults to standard; detailed needs the detailed scope.
  */
 function assessmentsCreate(client, request, options) {
     return new async_js_1.APIPromise($do(client, request, options));

package/dist/commonjs/index.d.ts

@@ -5,8 +5,10 @@
 export { NoResponse, Assessments, Keys, DEFAULT_BASE_URL, DEFAULT_TIMEOUT_MS, type NoResponseOptions, type CreateOptions, type GetOptions, type AssessmentPage, type ResponseMeta, type WithMeta, type WaitOptions, } from "./client.js";
 export * from "./errors.js";
 export { constructEvent, verificationResponse, isExpiredEvent, WebhookVerificationError, DEFAULT_TOLERANCE_SECONDS, type WebhookEvent, type AssessmentUpdatedEvent, type AssessmentExpiredEvent, type EndpointVerificationEvent, type AssessmentExpired, type EndpointVerification, type ConstructEventOptions, type HeaderInput, type WebhookSecrets, type WebhookErrorCode, } from "./webhooks.js";
-export { fromAuth0, fromClerk, fromCognito, fromEntra, fromFirebase, fromKeycloak, fromOIDC, fromOry, fromOryOAuth2, fromSupabase, fromWorkOS, type VerifiedClaims, type AuthContextOverrides } from "./auth.js";
+export { handleLateResult, lateResultAction, clerkActions, workosActions, auth0Actions, ProviderActionError, DEFAULT_LATE_RESULT_POLICY, type LateResult, type LateResultAction, type LateResultOptions, type LateResultPolicy, type LateResultProvider, type ClerkActionsOptions, type WorkOSActionsOptions, type Auth0ActionsOptions, } from "./late-results.js";
+export { fromAuth0, fromClerk, fromCognito, fromEntra, fromFirebase, fromKeycloak, fromOIDC, fromOry, fromOryOAuth2, fromSupabase, fromWorkOS, type VerifiedClaims, type AuthContextOverrides, } from "./auth.js";
 export { DEFAULT_WAIT_TIMEOUT_MS, MIN_POLL_INTERVAL_MS } from "./wait.js";
+export { hashIssuedCredential } from "./issued-credential.js";
 export * from "./models/index.js";
 export type { CreateAssessmentRequest, GetAssessmentRequest, RecordAssessmentOutcomeRequest } from "./models/operations/index.js";
 export { SDK_METADATA, ServerList, type SDKOptions } from "./lib/config.js";

package/dist/commonjs/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,OAAO,EACL,UAAU,EACV,WAAW,EACX,IAAI,EACJ,gBAAgB,EAChB,kBAAkB,EAClB,KAAK,iBAAiB,EACtB,KAAK,aAAa,EAClB,KAAK,UAAU,EACf,KAAK,cAAc,EACnB,KAAK,YAAY,EACjB,KAAK,QAAQ,EACb,KAAK,WAAW,GACjB,MAAM,aAAa,CAAC;AACrB,cAAc,aAAa,CAAC;AAC5B,OAAO,EACL,cAAc,EACd,oBAAoB,EACpB,cAAc,EACd,wBAAwB,EACxB,yBAAyB,EACzB,KAAK,YAAY,EACjB,KAAK,sBAAsB,EAC3B,KAAK,sBAAsB,EAC3B,KAAK,yBAAyB,EAC9B,KAAK,iBAAiB,EACtB,KAAK,oBAAoB,EACzB,KAAK,qBAAqB,EAC1B,KAAK,WAAW,EAChB,KAAK,cAAc,EACnB,KAAK,gBAAgB,GACtB,MAAM,eAAe,CAAC;AACvB,OAAO,EACL,SAAS,EACT,SAAS,EACT,WAAW,EACX,SAAS,EACT,YAAY,EACZ,YAAY,EACZ,QAAQ,EACR,OAAO,EACP,aAAa,EACb,YAAY,EACZ,UAAU,EACV,KAAK,cAAc,EAAE,KAAK,oBAAoB,EAAE,MAAM,WAAW,CAAC;AACpE,OAAO,EAAE,uBAAuB,EAAE,oBAAoB,EAAE,MAAM,WAAW,CAAC;AAC1E,cAAc,mBAAmB,CAAC;AAClC,YAAY,EAAE,uBAAuB,EAAE,oBAAoB,EAAE,8BAA8B,EAAE,MAAM,8BAA8B,CAAC;AAClI,OAAO,EAAE,YAAY,EAAE,UAAU,EAAE,KAAK,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAC5E,OAAO,EAAE,UAAU,EAAE,KAAK,OAAO,EAAE,KAAK,iBAAiB,EAAE,MAAM,eAAe,CAAC;AACjF,YAAY,EAAE,MAAM,EAAE,MAAM,iBAAiB,CAAC;AAC9C,YAAY,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AACpD,YAAY,EAAE,WAAW,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AACrE,OAAO,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,OAAO,EACL,UAAU,EACV,WAAW,EACX,IAAI,EACJ,gBAAgB,EAChB,kBAAkB,EAClB,KAAK,iBAAiB,EACtB,KAAK,aAAa,EAClB,KAAK,UAAU,EACf,KAAK,cAAc,EACnB,KAAK,YAAY,EACjB,KAAK,QAAQ,EACb,KAAK,WAAW,GACjB,MAAM,aAAa,CAAC;AACrB,cAAc,aAAa,CAAC;AAC5B,OAAO,EACL,cAAc,EACd,oBAAoB,EACpB,cAAc,EACd,wBAAwB,EACxB,yBAAyB,EACzB,KAAK,YAAY,EACjB,KAAK,sBAAsB,EAC3B,KAAK,sBAAsB,EAC3B,KAAK,yBAAyB,EAC9B,KAAK,iBAAiB,EACtB,KAAK,oBAAoB,EACzB,KAAK,qBAAqB,EAC1B,KAAK,WAAW,EAChB,KAAK,cAAc,EACnB,KAAK,gBAAgB,GACtB,MAAM,eAAe,CAAC;AACvB,OAAO,EACL,gBAAgB,EAChB,gBAAgB,EAChB,YAAY,EACZ,aAAa,EACb,YAAY,EACZ,mBAAmB,EACnB,0BAA0B,EAC1B,KAAK,UAAU,EACf,KAAK,gBAAgB,EACrB,KAAK,iBAAiB,EACtB,KAAK,gBAAgB,EACrB,KAAK,kBAAkB,EACvB,KAAK,mBAAmB,EACxB,KAAK,oBAAoB,EACzB,KAAK,mBAAmB,GACzB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EACL,SAAS,EACT,SAAS,EACT,WAAW,EACX,SAAS,EACT,YAAY,EACZ,YAAY,EACZ,QAAQ,EACR,OAAO,EACP,aAAa,EACb,YAAY,EACZ,UAAU,EACV,KAAK,cAAc,EACnB,KAAK,oBAAoB,GAC1B,MAAM,WAAW,CAAC;AACnB,OAAO,EAAE,uBAAuB,EAAE,oBAAoB,EAAE,MAAM,WAAW,CAAC;AAC1E,OAAO,EAAE,oBAAoB,EAAE,MAAM,wBAAwB,CAAC;AAC9D,cAAc,mBAAmB,CAAC;AAClC,YAAY,EAAE,uBAAuB,EAAE,oBAAoB,EAAE,8BAA8B,EAAE,MAAM,8BAA8B,CAAC;AAClI,OAAO,EAAE,YAAY,EAAE,UAAU,EAAE,KAAK,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAC5E,OAAO,EAAE,UAAU,EAAE,KAAK,OAAO,EAAE,KAAK,iBAAiB,EAAE,MAAM,eAAe,CAAC;AACjF,YAAY,EAAE,MAAM,EAAE,MAAM,iBAAiB,CAAC;AAC9C,YAAY,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AACpD,YAAY,EAAE,WAAW,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AACrE,OAAO,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC"}

package/dist/commonjs/index.js

@@ -14,7 +14,7 @@ var __exportStar = (this && this.__exportStar) || function(m, exports) {
     for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.NoResponseCore = exports.HTTPClient = exports.ServerList = exports.SDK_METADATA = exports.MIN_POLL_INTERVAL_MS = exports.DEFAULT_WAIT_TIMEOUT_MS = exports.fromWorkOS = exports.fromSupabase = exports.fromOryOAuth2 = exports.fromOry = exports.fromOIDC = exports.fromKeycloak = exports.fromFirebase = exports.fromEntra = exports.fromCognito = exports.fromClerk = exports.fromAuth0 = exports.DEFAULT_TOLERANCE_SECONDS = exports.WebhookVerificationError = exports.isExpiredEvent = exports.verificationResponse = exports.constructEvent = exports.DEFAULT_TIMEOUT_MS = exports.DEFAULT_BASE_URL = exports.Keys = exports.Assessments = exports.NoResponse = void 0;
+exports.NoResponseCore = exports.HTTPClient = exports.ServerList = exports.SDK_METADATA = exports.hashIssuedCredential = exports.MIN_POLL_INTERVAL_MS = exports.DEFAULT_WAIT_TIMEOUT_MS = exports.fromWorkOS = exports.fromSupabase = exports.fromOryOAuth2 = exports.fromOry = exports.fromOIDC = exports.fromKeycloak = exports.fromFirebase = exports.fromEntra = exports.fromCognito = exports.fromClerk = exports.fromAuth0 = exports.DEFAULT_LATE_RESULT_POLICY = exports.ProviderActionError = exports.auth0Actions = exports.workosActions = exports.clerkActions = exports.lateResultAction = exports.handleLateResult = exports.DEFAULT_TOLERANCE_SECONDS = exports.WebhookVerificationError = exports.isExpiredEvent = exports.verificationResponse = exports.constructEvent = exports.DEFAULT_TIMEOUT_MS = exports.DEFAULT_BASE_URL = exports.Keys = exports.Assessments = exports.NoResponse = void 0;
 /**
  * @noresponse/node entry point. Hand-written (listed in .genignore); the
  * generated client lives under ./sdk, ./funcs, ./models and ./lib.
@@ -32,6 +32,14 @@ Object.defineProperty(exports, "verificationResponse", { enumerable: true, get:
 Object.defineProperty(exports, "isExpiredEvent", { enumerable: true, get: function () { return webhooks_js_1.isExpiredEvent; } });
 Object.defineProperty(exports, "WebhookVerificationError", { enumerable: true, get: function () { return webhooks_js_1.WebhookVerificationError; } });
 Object.defineProperty(exports, "DEFAULT_TOLERANCE_SECONDS", { enumerable: true, get: function () { return webhooks_js_1.DEFAULT_TOLERANCE_SECONDS; } });
+const late_results_js_1 = require("./late-results.js");
+Object.defineProperty(exports, "handleLateResult", { enumerable: true, get: function () { return late_results_js_1.handleLateResult; } });
+Object.defineProperty(exports, "lateResultAction", { enumerable: true, get: function () { return late_results_js_1.lateResultAction; } });
+Object.defineProperty(exports, "clerkActions", { enumerable: true, get: function () { return late_results_js_1.clerkActions; } });
+Object.defineProperty(exports, "workosActions", { enumerable: true, get: function () { return late_results_js_1.workosActions; } });
+Object.defineProperty(exports, "auth0Actions", { enumerable: true, get: function () { return late_results_js_1.auth0Actions; } });
+Object.defineProperty(exports, "ProviderActionError", { enumerable: true, get: function () { return late_results_js_1.ProviderActionError; } });
+Object.defineProperty(exports, "DEFAULT_LATE_RESULT_POLICY", { enumerable: true, get: function () { return late_results_js_1.DEFAULT_LATE_RESULT_POLICY; } });
 const auth_js_1 = require("./auth.js");
 Object.defineProperty(exports, "fromAuth0", { enumerable: true, get: function () { return auth_js_1.fromAuth0; } });
 Object.defineProperty(exports, "fromClerk", { enumerable: true, get: function () { return auth_js_1.fromClerk; } });
@@ -47,6 +55,8 @@ Object.defineProperty(exports, "fromWorkOS", { enumerable: true, get: function (
 const wait_js_1 = require("./wait.js");
 Object.defineProperty(exports, "DEFAULT_WAIT_TIMEOUT_MS", { enumerable: true, get: function () { return wait_js_1.DEFAULT_WAIT_TIMEOUT_MS; } });
 Object.defineProperty(exports, "MIN_POLL_INTERVAL_MS", { enumerable: true, get: function () { return wait_js_1.MIN_POLL_INTERVAL_MS; } });
+const issued_credential_js_1 = require("./issued-credential.js");
+Object.defineProperty(exports, "hashIssuedCredential", { enumerable: true, get: function () { return issued_credential_js_1.hashIssuedCredential; } });
 __exportStar(require("./models/index.js"), exports);
 const config_js_1 = require("./lib/config.js");
 Object.defineProperty(exports, "SDK_METADATA", { enumerable: true, get: function () { return config_js_1.SDK_METADATA; } });

package/dist/commonjs/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;AAAA;;;GAGG;AACH,2CAaqB;AAZnB,uGAAA,UAAU,OAAA;AACV,wGAAA,WAAW,OAAA;AACX,iGAAA,IAAI,OAAA;AACJ,6GAAA,gBAAgB,OAAA;AAChB,+GAAA,kBAAkB,OAAA;AASpB,8CAA4B;AAC5B,+CAgBuB;AAfrB,6GAAA,cAAc,OAAA;AACd,mHAAA,oBAAoB,OAAA;AACpB,6GAAA,cAAc,OAAA;AACd,uHAAA,wBAAwB,OAAA;AACxB,wHAAA,yBAAyB,OAAA;AAY3B,uCAYoE;AAXlE,oGAAA,SAAS,OAAA;AACT,oGAAA,SAAS,OAAA;AACT,sGAAA,WAAW,OAAA;AACX,oGAAA,SAAS,OAAA;AACT,uGAAA,YAAY,OAAA;AACZ,uGAAA,YAAY,OAAA;AACZ,mGAAA,QAAQ,OAAA;AACR,kGAAA,OAAO,OAAA;AACP,wGAAA,aAAa,OAAA;AACb,uGAAA,YAAY,OAAA;AACZ,qGAAA,UAAU,OAAA;AAEZ,uCAA0E;AAAjE,kHAAA,uBAAuB,OAAA;AAAE,+GAAA,oBAAoB,OAAA;AACtD,oDAAkC;AAElC,+CAA4E;AAAnE,yGAAA,YAAY,OAAA;AAAE,uGAAA,UAAU,OAAA;AACjC,2CAAiF;AAAxE,qGAAA,UAAU,OAAA;AAInB,uCAA2C;AAAlC,yGAAA,cAAc,OAAA"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;AAAA;;;GAGG;AACH,2CAaqB;AAZnB,uGAAA,UAAU,OAAA;AACV,wGAAA,WAAW,OAAA;AACX,iGAAA,IAAI,OAAA;AACJ,6GAAA,gBAAgB,OAAA;AAChB,+GAAA,kBAAkB,OAAA;AASpB,8CAA4B;AAC5B,+CAgBuB;AAfrB,6GAAA,cAAc,OAAA;AACd,mHAAA,oBAAoB,OAAA;AACpB,6GAAA,cAAc,OAAA;AACd,uHAAA,wBAAwB,OAAA;AACxB,wHAAA,yBAAyB,OAAA;AAY3B,uDAgB2B;AAfzB,mHAAA,gBAAgB,OAAA;AAChB,mHAAA,gBAAgB,OAAA;AAChB,+GAAA,YAAY,OAAA;AACZ,gHAAA,aAAa,OAAA;AACb,+GAAA,YAAY,OAAA;AACZ,sHAAA,mBAAmB,OAAA;AACnB,6HAAA,0BAA0B,OAAA;AAU5B,uCAcmB;AAbjB,oGAAA,SAAS,OAAA;AACT,oGAAA,SAAS,OAAA;AACT,sGAAA,WAAW,OAAA;AACX,oGAAA,SAAS,OAAA;AACT,uGAAA,YAAY,OAAA;AACZ,uGAAA,YAAY,OAAA;AACZ,mGAAA,QAAQ,OAAA;AACR,kGAAA,OAAO,OAAA;AACP,wGAAA,aAAa,OAAA;AACb,uGAAA,YAAY,OAAA;AACZ,qGAAA,UAAU,OAAA;AAIZ,uCAA0E;AAAjE,kHAAA,uBAAuB,OAAA;AAAE,+GAAA,oBAAoB,OAAA;AACtD,iEAA8D;AAArD,4HAAA,oBAAoB,OAAA;AAC7B,oDAAkC;AAElC,+CAA4E;AAAnE,yGAAA,YAAY,OAAA;AAAE,uGAAA,UAAU,OAAA;AACjC,2CAAiF;AAAxE,qGAAA,UAAU,OAAA;AAInB,uCAA2C;AAAlC,yGAAA,cAAc,OAAA"}

package/dist/commonjs/issued-credential.d.ts

@@ -0,0 +1,9 @@
+/**
+ * SHA-256 of an API key your signup gate issued to the new account, as 64
+ * lower-case hex characters. The key never leaves your backend: send only this
+ * hash, as `issuedCredential.sha256` on the assessment request. The key is
+ * hashed as its UTF-8 bytes exactly as given, with no trimming or
+ * normalisation. An empty key throws a TypeError.
+ */
+export declare function hashIssuedCredential(key: string): string;
+//# sourceMappingURL=issued-credential.d.ts.map

package/dist/commonjs/issued-credential.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"issued-credential.d.ts","sourceRoot":"","sources":["../../src/issued-credential.ts"],"names":[],"mappings":"AAEA;;;;;;GAMG;AACH,wBAAgB,oBAAoB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAKxD"}

package/dist/commonjs/issued-credential.js

@@ -0,0 +1,18 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.hashIssuedCredential = hashIssuedCredential;
+const node_crypto_1 = require("node:crypto");
+/**
+ * SHA-256 of an API key your signup gate issued to the new account, as 64
+ * lower-case hex characters. The key never leaves your backend: send only this
+ * hash, as `issuedCredential.sha256` on the assessment request. The key is
+ * hashed as its UTF-8 bytes exactly as given, with no trimming or
+ * normalisation. An empty key throws a TypeError.
+ */
+function hashIssuedCredential(key) {
+    if (typeof key !== "string" || key.length === 0) {
+        throw new TypeError("issued key must be a non-empty string");
+    }
+    return (0, node_crypto_1.createHash)("sha256").update(key, "utf8").digest("hex");
+}
+//# sourceMappingURL=issued-credential.js.map

package/dist/commonjs/issued-credential.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"issued-credential.js","sourceRoot":"","sources":["../../src/issued-credential.ts"],"names":[],"mappings":";;;AAAA,6CAAyC;AAEzC;;;;;;GAMG;AACH,8BAAqC,GAAW,EAAU;IACxD,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAChD,MAAM,IAAI,SAAS,CAAC,uCAAuC,CAAC,CAAC;IAC/D,CAAC;IACD,OAAO,IAAA,wBAAU,EAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAAA,CAC/D"}

package/dist/commonjs/late-results.d.ts

@@ -0,0 +1,111 @@
+/**
+ * Late-result handlers. Hand-written; not generated.
+ *
+ * An assessment can be revised after the signup was allowed: a slow source
+ * settles and the recommendation rises. NoResponse sends the new version as a
+ * signed assessment.updated webhook. handleLateResult verifies that delivery
+ * with constructEvent, picks an action from your policy, and acts through the
+ * auth provider's admin API: revoke the user's sessions or ban the user.
+ *
+ * The handler verifies the delivery itself, so it never acts on an unverified
+ * event. The provider calls are thin: you pass the credentials, and each
+ * action is the provider's documented admin endpoint.
+ */
+import { type ConstructEventOptions, type HeaderInput, type WebhookEvent, type WebhookSecrets } from "./webhooks.js";
+/** What to do to the user. "ban" also ends every session. */
+export type LateResultAction = "none" | "revoke_sessions" | "ban";
+/** The action for each recommendation. A recommendation you leave out does nothing. */
+export type LateResultPolicy = Readonly<Partial<Record<"allow" | "step_up" | "review", LateResultAction>>>;
+/** Revoke sessions on review; do nothing on allow or step_up. Banning is opt-in. */
+export declare const DEFAULT_LATE_RESULT_POLICY: LateResultPolicy;
+/** The two admin actions, for one auth provider. Build one with clerkActions, workosActions or auth0Actions. */
+export interface LateResultProvider {
+    readonly name: string;
+    /** End every active session of the user. */
+    revokeSessions(userId: string): Promise<void>;
+    /** Stop the user signing in again and end their sessions. */
+    ban(userId: string): Promise<void>;
+}
+export type LateResultOptions = ConstructEventOptions & {
+    /** Recommendation to action. Defaults to DEFAULT_LATE_RESULT_POLICY. */
+    policy?: LateResultPolicy;
+    /**
+     * The provider user id for the assessment's account_id. Defaults to the
+     * account_id itself, as when you assess with the provider's user id.
+     * Return null or undefined to take no action.
+     */
+    userId?: (accountId: string, event: WebhookEvent) => string | null | undefined | Promise<string | null | undefined>;
+};
+export type LateResult = {
+    /** The verified event. Answer an endpoint.verification with verificationResponse(event). */
+    event: WebhookEvent;
+    /** The action taken. "none" when the policy, the event or the user id called for nothing. */
+    action: LateResultAction;
+    /** The provider user id acted on, when an action was taken. */
+    userId?: string;
+};
+/** Thrown when the provider's admin API refuses a call. Answer the webhook with a 5xx so NoResponse retries it. */
+export declare class ProviderActionError extends Error {
+    readonly provider: string;
+    readonly status: number;
+    constructor(provider: string, status: number, message: string);
+}
+/** The action your policy names for a verified event. Only a served assessment with a recommendation can act. */
+export declare function lateResultAction(event: WebhookEvent, policy?: LateResultPolicy): LateResultAction;
+/**
+ * Verify a webhook delivery and apply your policy to it.
+ *
+ * `payload`, `headers`, `secrets` and the tolerance options are exactly what
+ * constructEvent takes; a delivery that fails verification throws
+ * WebhookVerificationError before any provider call. Deduplicate on
+ * `result.event.id` and ignore versions older than one you have acted on.
+ */
+export declare function handleLateResult(payload: Uint8Array | string, headers: HeaderInput, secrets: WebhookSecrets, provider: LateResultProvider, options?: LateResultOptions): Promise<LateResult>;
+type Fetch = typeof fetch;
+export type ClerkActionsOptions = {
+    /** Clerk secret key (sk_...). */
+    secretKey: string;
+    /** Default https://api.clerk.com/v1. */
+    baseUrl?: string;
+    fetch?: Fetch;
+};
+/**
+ * Clerk Backend API. revokeSessions lists the user's active sessions
+ * (GET /sessions?user_id&status=active) and revokes each
+ * (POST /sessions/{id}/revoke). ban is POST /users/{id}/ban, which revokes
+ * every session and blocks sign-in.
+ */
+export declare function clerkActions(options: ClerkActionsOptions): LateResultProvider;
+export type WorkOSActionsOptions = {
+    /** WorkOS API key (sk_...). */
+    apiKey: string;
+    /** Default https://api.workos.com. */
+    baseUrl?: string;
+    fetch?: Fetch;
+};
+/**
+ * WorkOS User Management. revokeSessions pages through
+ * GET /user_management/users/{id}/sessions and revokes each active one with
+ * POST /user_management/sessions/revoke. WorkOS has no block or ban, so ban
+ * revokes the sessions and then deletes the user
+ * (DELETE /user_management/users/{id}); deletion is permanent.
+ */
+export declare function workosActions(options: WorkOSActionsOptions): LateResultProvider;
+export type Auth0ActionsOptions = {
+    /** Your Auth0 tenant domain, such as example.eu.auth0.com. The Management API is https://{domain}/api/v2. */
+    domain?: string;
+    /** The Management API base URL in place of domain. */
+    baseUrl?: string;
+    /** A Management API access token with update:users, delete:sessions and delete:refresh_tokens. */
+    token: string;
+    fetch?: Fetch;
+};
+/**
+ * Auth0 Management API. revokeSessions deletes every session
+ * (DELETE /users/{id}/sessions) and refresh token
+ * (DELETE /users/{id}/refresh-tokens). ban first sets blocked: true
+ * (PATCH /users/{id}), then does the same.
+ */
+export declare function auth0Actions(options: Auth0ActionsOptions): LateResultProvider;
+export {};
+//# sourceMappingURL=late-results.d.ts.map

package/dist/commonjs/late-results.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"late-results.d.ts","sourceRoot":"","sources":["../../src/late-results.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AACH,OAAO,EAAkB,KAAK,qBAAqB,EAAE,KAAK,WAAW,EAAE,KAAK,YAAY,EAAE,KAAK,cAAc,EAAE,MAAM,eAAe,CAAC;AAErI,6DAA6D;AAC7D,MAAM,MAAM,gBAAgB,GAAG,MAAM,GAAG,iBAAiB,GAAG,KAAK,CAAC;AAElE,uFAAuF;AACvF,MAAM,MAAM,gBAAgB,GAAG,QAAQ,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,GAAG,SAAS,GAAG,QAAQ,EAAE,gBAAgB,CAAC,CAAC,CAAC,CAAC;AAE3G,oFAAoF;AACpF,eAAO,MAAM,0BAA0B,EAAE,gBAA+F,CAAC;AAEzI,gHAAgH;AAChH,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,4CAA4C;IAC5C,cAAc,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC9C,6DAA6D;IAC7D,GAAG,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACpC;AAED,MAAM,MAAM,iBAAiB,GAAG,qBAAqB,GAAG;IACtD,wEAAwE;IACxE,MAAM,CAAC,EAAE,gBAAgB,CAAC;IAC1B;;;;OAIG;IACH,MAAM,CAAC,EAAE,CAAC,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,YAAY,KAAK,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,GAAG,SAAS,CAAC,CAAC;CACrH,CAAC;AAEF,MAAM,MAAM,UAAU,GAAG;IACvB,4FAA4F;IAC5F,KAAK,EAAE,YAAY,CAAC;IACpB,6FAA6F;IAC7F,MAAM,EAAE,gBAAgB,CAAC;IACzB,+DAA+D;IAC/D,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB,CAAC;AAEF,mHAAmH;AACnH,qBAAa,mBAAoB,SAAQ,KAAK;IAC5C,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,YAAY,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAK5D;CACF;AAID,iHAAiH;AACjH,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,YAAY,EAAE,MAAM,GAAE,gBAA6C,GAAG,gBAAgB,CAS7H;AAED;;;;;;;GAOG;AACH,wBAAsB,gBAAgB,CACpC,OAAO,EAAE,UAAU,GAAG,MAAM,EAC5B,OAAO,EAAE,WAAW,EACpB,OAAO,EAAE,cAAc,EACvB,QAAQ,EAAE,kBAAkB,EAC5B,OAAO,GAAE,iBAAsB,GAC9B,OAAO,CAAC,UAAU,CAAC,CAWrB;AAED,KAAK,KAAK,GAAG,OAAO,KAAK,CAAC;AAmC1B,MAAM,MAAM,mBAAmB,GAAG;IAChC,iCAAiC;IACjC,SAAS,EAAE,MAAM,CAAC;IAClB,wCAAwC;IACxC,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,KAAK,CAAC,EAAE,KAAK,CAAC;CACf,CAAC;AAEF;;;;;GAKG;AACH,wBAAgB,YAAY,CAAC,OAAO,EAAE,mBAAmB,GAAG,kBAAkB,CAsB7E;AAED,MAAM,MAAM,oBAAoB,GAAG;IACjC,+BAA+B;IAC/B,MAAM,EAAE,MAAM,CAAC;IACf,sCAAsC;IACtC,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,KAAK,CAAC,EAAE,KAAK,CAAC;CACf,CAAC;AAEF;;;;;;GAMG;AACH,wBAAgB,aAAa,CAAC,OAAO,EAAE,oBAAoB,GAAG,kBAAkB,CA0B/E;AAED,MAAM,MAAM,mBAAmB,GAAG;IAChC,6GAA6G;IAC7G,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,sDAAsD;IACtD,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,kGAAkG;IAClG,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,CAAC,EAAE,KAAK,CAAC;CACf,CAAC;AAEF;;;;;GAKG;AACH,wBAAgB,YAAY,CAAC,OAAO,EAAE,mBAAmB,GAAG,kBAAkB,CAkB7E"}

package/dist/commonjs/late-results.js

@@ -0,0 +1,213 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ProviderActionError = exports.DEFAULT_LATE_RESULT_POLICY = void 0;
+exports.lateResultAction = lateResultAction;
+exports.handleLateResult = handleLateResult;
+exports.clerkActions = clerkActions;
+exports.workosActions = workosActions;
+exports.auth0Actions = auth0Actions;
+/**
+ * Late-result handlers. Hand-written; not generated.
+ *
+ * An assessment can be revised after the signup was allowed: a slow source
+ * settles and the recommendation rises. NoResponse sends the new version as a
+ * signed assessment.updated webhook. handleLateResult verifies that delivery
+ * with constructEvent, picks an action from your policy, and acts through the
+ * auth provider's admin API: revoke the user's sessions or ban the user.
+ *
+ * The handler verifies the delivery itself, so it never acts on an unverified
+ * event. The provider calls are thin: you pass the credentials, and each
+ * action is the provider's documented admin endpoint.
+ */
+const webhooks_js_1 = require("./webhooks.js");
+/** Revoke sessions on review; do nothing on allow or step_up. Banning is opt-in. */
+exports.DEFAULT_LATE_RESULT_POLICY = Object.freeze({ allow: "none", step_up: "none", review: "revoke_sessions" });
+/** Thrown when the provider's admin API refuses a call. Answer the webhook with a 5xx so NoResponse retries it. */
+class ProviderActionError extends Error {
+    provider;
+    status;
+    constructor(provider, status, message) {
+        super(message);
+        this.name = "ProviderActionError";
+        this.provider = provider;
+        this.status = status;
+    }
+}
+exports.ProviderActionError = ProviderActionError;
+const ACTIONS = ["none", "revoke_sessions", "ban"];
+/** The action your policy names for a verified event. Only a served assessment with a recommendation can act. */
+function lateResultAction(event, policy = exports.DEFAULT_LATE_RESULT_POLICY) {
+    if (event.type !== "assessment.updated" || event.data.status === "expired")
+        return "none";
+    const data = event.data;
+    const recommendation = data.recommendation ?? data.risk?.recommendation;
+    if (recommendation !== "allow" && recommendation !== "step_up" && recommendation !== "review")
+        return "none";
+    const action = Object.prototype.hasOwnProperty.call(policy, recommendation) ? policy[recommendation] : undefined;
+    if (action === undefined)
+        return "none";
+    if (!ACTIONS.includes(action))
+        throw new TypeError(`unknown late result action ${String(action)}`);
+    return action;
+}
+/**
+ * Verify a webhook delivery and apply your policy to it.
+ *
+ * `payload`, `headers`, `secrets` and the tolerance options are exactly what
+ * constructEvent takes; a delivery that fails verification throws
+ * WebhookVerificationError before any provider call. Deduplicate on
+ * `result.event.id` and ignore versions older than one you have acted on.
+ */
+async function handleLateResult(payload, headers, secrets, provider, options = {}) {
+    const { policy, userId: resolve, ...verify } = options;
+    const event = (0, webhooks_js_1.constructEvent)(payload, headers, secrets, verify);
+    const action = lateResultAction(event, policy);
+    if (action === "none" || event.type !== "assessment.updated")
+        return { event, action: "none" };
+    const accountId = event.data.accountId;
+    const userId = resolve ? await resolve(accountId, event) : accountId;
+    if (userId === null || userId === undefined || userId === "")
+        return { event, action: "none" };
+    if (action === "ban")
+        await provider.ban(userId);
+    else
+        await provider.revokeSessions(userId);
+    return { event, action, userId };
+}
+function caller(name, baseUrl, authorization, fetcher) {
+    const base = baseUrl.replace(/\/+$/, "");
+    const run = fetcher ?? globalThis.fetch;
+    return async ({ method, path, query, body, allow404 }) => {
+        const url = new URL(base + path);
+        for (const [key, value] of Object.entries(query ?? {}))
+            url.searchParams.set(key, value);
+        const headers = { authorization, accept: "application/json" };
+        if (body !== undefined)
+            headers["content-type"] = "application/json";
+        const response = await run(url, { method, headers, ...(body !== undefined ? { body: JSON.stringify(body) } : {}) });
+        const text = await response.text();
+        if (allow404 && response.status === 404)
+            return undefined;
+        if (!response.ok)
+            throw new ProviderActionError(name, response.status, `${name} ${method} ${path} answered ${response.status}`);
+        if (!text)
+            return undefined;
+        try {
+            return JSON.parse(text);
+        }
+        catch {
+            return undefined;
+        }
+    };
+}
+const segment = (id) => {
+    if (typeof id !== "string" || id === "")
+        throw new TypeError("user id must be a non-empty string");
+    return encodeURIComponent(id);
+};
+function sessions(body) {
+    if (Array.isArray(body))
+        return body;
+    const data = body?.data;
+    return Array.isArray(data) ? data : [];
+}
+/**
+ * Clerk Backend API. revokeSessions lists the user's active sessions
+ * (GET /sessions?user_id&status=active) and revokes each
+ * (POST /sessions/{id}/revoke). ban is POST /users/{id}/ban, which revokes
+ * every session and blocks sign-in.
+ */
+function clerkActions(options) {
+    if (!options?.secretKey)
+        throw new TypeError("clerkActions needs secretKey");
+    const call = caller("clerk", options.baseUrl ?? "https://api.clerk.com/v1", `Bearer ${options.secretKey}`, options.fetch);
+    const PAGE = 100;
+    return {
+        name: "clerk",
+        async revokeSessions(userId) {
+            segment(userId);
+            const active = [];
+            for (let offset = 0; offset < PAGE * 1000; offset += PAGE) {
+                const page = sessions(await call({ method: "GET", path: "/sessions", query: { user_id: userId, status: "active", limit: String(PAGE), offset: String(offset) } }));
+                for (const s of page)
+                    if (s.status === "active" && typeof s.id === "string" && s.id)
+                        active.push(s.id);
+                if (page.length < PAGE)
+                    break;
+            }
+            for (const id of active)
+                await call({ method: "POST", path: `/sessions/${encodeURIComponent(id)}/revoke` });
+        },
+        async ban(userId) {
+            await call({ method: "POST", path: `/users/${segment(userId)}/ban` });
+        },
+    };
+}
+/**
+ * WorkOS User Management. revokeSessions pages through
+ * GET /user_management/users/{id}/sessions and revokes each active one with
+ * POST /user_management/sessions/revoke. WorkOS has no block or ban, so ban
+ * revokes the sessions and then deletes the user
+ * (DELETE /user_management/users/{id}); deletion is permanent.
+ */
+function workosActions(options) {
+    if (!options?.apiKey)
+        throw new TypeError("workosActions needs apiKey");
+    const call = caller("workos", options.baseUrl ?? "https://api.workos.com", `Bearer ${options.apiKey}`, options.fetch);
+    const revokeSessions = async (userId) => {
+        const user = segment(userId);
+        const active = [];
+        let after;
+        for (let round = 0; round < 1000; round++) {
+            const query = { limit: "100" };
+            if (after)
+                query["after"] = after;
+            const body = (await call({ method: "GET", path: `/user_management/users/${user}/sessions`, query }));
+            for (const s of sessions(body))
+                if (s.status === "active" && typeof s.id === "string" && s.id)
+                    active.push(s.id);
+            const next = body?.list_metadata?.after;
+            if (typeof next !== "string" || next === "")
+                break;
+            after = next;
+        }
+        for (const id of active)
+            await call({ method: "POST", path: "/user_management/sessions/revoke", body: { session_id: id } });
+    };
+    return {
+        name: "workos",
+        revokeSessions,
+        async ban(userId) {
+            await revokeSessions(userId);
+            await call({ method: "DELETE", path: `/user_management/users/${segment(userId)}`, allow404: true });
+        },
+    };
+}
+/**
+ * Auth0 Management API. revokeSessions deletes every session
+ * (DELETE /users/{id}/sessions) and refresh token
+ * (DELETE /users/{id}/refresh-tokens). ban first sets blocked: true
+ * (PATCH /users/{id}), then does the same.
+ */
+function auth0Actions(options) {
+    if (!options?.token)
+        throw new TypeError("auth0Actions needs token");
+    const base = options.baseUrl ?? (options.domain ? `https://${options.domain}/api/v2` : undefined);
+    if (!base)
+        throw new TypeError("auth0Actions needs domain or baseUrl");
+    const call = caller("auth0", base, `Bearer ${options.token}`, options.fetch);
+    const revokeSessions = async (userId) => {
+        const user = segment(userId);
+        await call({ method: "DELETE", path: `/users/${user}/sessions` });
+        await call({ method: "DELETE", path: `/users/${user}/refresh-tokens` });
+    };
+    return {
+        name: "auth0",
+        revokeSessions,
+        async ban(userId) {
+            await call({ method: "PATCH", path: `/users/${segment(userId)}`, body: { blocked: true } });
+            await revokeSessions(userId);
+        },
+    };
+}
+//# sourceMappingURL=late-results.js.map

package/dist/commonjs/late-results.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"late-results.js","sourceRoot":"","sources":["../../src/late-results.ts"],"names":[],"mappings":";;;;;;;;AAAA;;;;;;;;;;;;GAYG;AACH,+CAAqI;AAQrI,oFAAoF;AACvE,QAAA,0BAA0B,GAAqB,MAAM,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,iBAAiB,EAAE,CAAC,CAAC;AA+BzI,mHAAmH;AACnH,yBAAiC,SAAQ,KAAK;IACnC,QAAQ,CAAS;IACjB,MAAM,CAAS;IACxB,YAAY,QAAgB,EAAE,MAAc,EAAE,OAAe,EAAE;QAC7D,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,qBAAqB,CAAC;QAClC,IAAI,CAAC,QAAQ,GAAG,QAAQ,CAAC;QACzB,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;IAAA,CACtB;CACF;;AAED,MAAM,OAAO,GAAsB,CAAC,MAAM,EAAE,iBAAiB,EAAE,KAAK,CAAC,CAAC;AAEtE,iHAAiH;AACjH,0BAAiC,KAAmB,EAAE,MAAM,GAAqB,QAAA,0BAA0B,EAAoB;IAC7H,IAAI,KAAK,CAAC,IAAI,KAAK,oBAAoB,IAAI,KAAK,CAAC,IAAI,CAAC,MAAM,KAAK,SAAS;QAAE,OAAO,MAAM,CAAC;IAC1F,MAAM,IAAI,GAAG,KAAK,CAAC,IAAuE,CAAC;IAC3F,MAAM,cAAc,GAAG,IAAI,CAAC,cAAc,IAAI,IAAI,CAAC,IAAI,EAAE,cAAc,CAAC;IACxE,IAAI,cAAc,KAAK,OAAO,IAAI,cAAc,KAAK,SAAS,IAAI,cAAc,KAAK,QAAQ;QAAE,OAAO,MAAM,CAAC;IAC7G,MAAM,MAAM,GAAG,MAAM,CAAC,SAAS,CAAC,cAAc,CAAC,IAAI,CAAC,MAAM,EAAE,cAAc,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IACjH,IAAI,MAAM,KAAK,SAAS;QAAE,OAAO,MAAM,CAAC;IACxC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC;QAAE,MAAM,IAAI,SAAS,CAAC,8BAA8B,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;IACnG,OAAO,MAAM,CAAC;AAAA,CACf;AAED;;;;;;;GAOG;AACI,KAAK,2BACV,OAA4B,EAC5B,OAAoB,EACpB,OAAuB,EACvB,QAA4B,EAC5B,OAAO,GAAsB,EAAE,EACV;IACrB,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,EAAE,GAAG,OAAO,CAAC;IACvD,MAAM,KAAK,GAAG,IAAA,4BAAc,EAAC,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;IAChE,MAAM,MAAM,GAAG,gBAAgB,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;IAC/C,IAAI,MAAM,KAAK,MAAM,IAAI,KAAK,CAAC,IAAI,KAAK,oBAAoB;QAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;IAC/F,MAAM,SAAS,GAAG,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC;IACvC,MAAM,MAAM,GAAG,OAAO,CAAC,CAAC,CAAC,MAAM,OAAO,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IACrE,IAAI,MAAM,KAAK,IAAI,IAAI,MAAM,KAAK,SAAS,IAAI,MAAM,KAAK,EAAE;QAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;IAC/F,IAAI,MAAM,KAAK,KAAK;QAAE,MAAM,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;;QAC5C,MAAM,QAAQ,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC;IAC3C,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;AAAA,CAClC;AAKD,SAAS,MAAM,CAAC,IAAY,EAAE,OAAe,EAAE,aAAqB,EAAE,OAA0B,EAAE;IAChG,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IACzC,MAAM,GAAG,GAAG,OAAO,IAAI,UAAU,CAAC,KAAK,CAAC;IACxC,OAAO,KAAK,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,QAAQ,EAAQ,EAAoB,EAAE,CAAC;QAChF,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,IAAI,GAAG,IAAI,CAAC,CAAC;QACjC,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,IAAI,EAAE,CAAC;YAAE,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QACzF,MAAM,OAAO,GAA2B,EAAE,aAAa,EAAE,MAAM,EAAE,kBAAkB,EAAE,CAAC;QACtF,IAAI,IAAI,KAAK,SAAS;YAAE,OAAO,CAAC,cAAc,CAAC,GAAG,kBAAkB,CAAC;QACrE,MAAM,QAAQ,GAAG,MAAM,GAAG,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;QACpH,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;QACnC,IAAI,QAAQ,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG;YAAE,OAAO,SAAS,CAAC;QAC1D,IAAI,CAAC,QAAQ,CAAC,EAAE;YAAE,MAAM,IAAI,mBAAmB,CAAC,IAAI,EAAE,QAAQ,CAAC,MAAM,EAAE,GAAG,IAAI,IAAI,MAAM,IAAI,IAAI,aAAa,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC;QAChI,IAAI,CAAC,IAAI;YAAE,OAAO,SAAS,CAAC;QAC5B,IAAI,CAAC;YACH,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAC1B,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,SAAS,CAAC;QACnB,CAAC;IAAA,CACF,CAAC;AAAA,CACH;AAED,MAAM,OAAO,GAAG,CAAC,EAAU,EAAU,EAAE,CAAC;IACtC,IAAI,OAAO,EAAE,KAAK,QAAQ,IAAI,EAAE,KAAK,EAAE;QAAE,MAAM,IAAI,SAAS,CAAC,oCAAoC,CAAC,CAAC;IACnG,OAAO,kBAAkB,CAAC,EAAE,CAAC,CAAC;AAAA,CAC/B,CAAC;AAEF,SAAS,QAAQ,CAAC,IAAa,EAA6C;IAC1E,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IACrC,MAAM,IAAI,GAAI,IAAuC,EAAE,IAAI,CAAC;IAC5D,OAAO,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;AAAA,CACxC;AAUD;;;;;GAKG;AACH,sBAA6B,OAA4B,EAAsB;IAC7E,IAAI,CAAC,OAAO,EAAE,SAAS;QAAE,MAAM,IAAI,SAAS,CAAC,8BAA8B,CAAC,CAAC;IAC7E,MAAM,IAAI,GAAG,MAAM,CAAC,OAAO,EAAE,OAAO,CAAC,OAAO,IAAI,0BAA0B,EAAE,UAAU,OAAO,CAAC,SAAS,EAAE,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC;IAC1H,MAAM,IAAI,GAAG,GAAG,CAAC;IACjB,OAAO;QACL,IAAI,EAAE,OAAO;QACb,KAAK,CAAC,cAAc,CAAC,MAAM,EAAE;YAC3B,OAAO,CAAC,MAAM,CAAC,CAAC;YAChB,MAAM,MAAM,GAAa,EAAE,CAAC;YAC5B,KAAK,IAAI,MAAM,GAAG,CAAC,EAAE,MAAM,GAAG,IAAI,GAAG,IAAI,EAAE,MAAM,IAAI,IAAI,EAAE,CAAC;gBAC1D,MAAM,IAAI,GAAG,QAAQ,CACnB,MAAM,IAAI,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,WAAW,EAAE,KAAK,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC,CAC5I,CAAC;gBACF,KAAK,MAAM,CAAC,IAAI,IAAI;oBAAE,IAAI,CAAC,CAAC,MAAM,KAAK,QAAQ,IAAI,OAAO,CAAC,CAAC,EAAE,KAAK,QAAQ,IAAI,CAAC,CAAC,EAAE;wBAAE,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;gBACvG,IAAI,IAAI,CAAC,MAAM,GAAG,IAAI;oBAAE,MAAM;YAChC,CAAC;YACD,KAAK,MAAM,EAAE,IAAI,MAAM;gBAAE,MAAM,IAAI,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,aAAa,kBAAkB,CAAC,EAAE,CAAC,SAAS,EAAE,CAAC,CAAC;QAAA,CAC7G;QACD,KAAK,CAAC,GAAG,CAAC,MAAM,EAAE;YAChB,MAAM,IAAI,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,UAAU,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC;QAAA,CACvE;KACF,CAAC;AAAA,CACH;AAUD;;;;;;GAMG;AACH,uBAA8B,OAA6B,EAAsB;IAC/E,IAAI,CAAC,OAAO,EAAE,MAAM;QAAE,MAAM,IAAI,SAAS,CAAC,4BAA4B,CAAC,CAAC;IACxE,MAAM,IAAI,GAAG,MAAM,CAAC,QAAQ,EAAE,OAAO,CAAC,OAAO,IAAI,wBAAwB,EAAE,UAAU,OAAO,CAAC,MAAM,EAAE,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC;IACtH,MAAM,cAAc,GAAG,KAAK,EAAE,MAAc,EAAiB,EAAE,CAAC;QAC9D,MAAM,IAAI,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;QAC7B,MAAM,MAAM,GAAa,EAAE,CAAC;QAC5B,IAAI,KAAyB,CAAC;QAC9B,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;YAC1C,MAAM,KAAK,GAA2B,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;YACvD,IAAI,KAAK;gBAAE,KAAK,CAAC,OAAO,CAAC,GAAG,KAAK,CAAC;YAClC,MAAM,IAAI,GAAG,CAAC,MAAM,IAAI,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,0BAA0B,IAAI,WAAW,EAAE,KAAK,EAAE,CAAC,CAAwD,CAAC;YAC5J,KAAK,MAAM,CAAC,IAAI,QAAQ,CAAC,IAAI,CAAC;gBAAE,IAAI,CAAC,CAAC,MAAM,KAAK,QAAQ,IAAI,OAAO,CAAC,CAAC,EAAE,KAAK,QAAQ,IAAI,CAAC,CAAC,EAAE;oBAAE,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;YACjH,MAAM,IAAI,GAAG,IAAI,EAAE,aAAa,EAAE,KAAK,CAAC;YACxC,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,EAAE;gBAAE,MAAM;YACnD,KAAK,GAAG,IAAI,CAAC;QACf,CAAC;QACD,KAAK,MAAM,EAAE,IAAI,MAAM;YAAE,MAAM,IAAI,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,kCAAkC,EAAE,IAAI,EAAE,EAAE,UAAU,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC;IAAA,CAC7H,CAAC;IACF,OAAO;QACL,IAAI,EAAE,QAAQ;QACd,cAAc;QACd,KAAK,CAAC,GAAG,CAAC,MAAM,EAAE;YAChB,MAAM,cAAc,CAAC,MAAM,CAAC,CAAC;YAC7B,MAAM,IAAI,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,0BAA0B,OAAO,CAAC,MAAM,CAAC,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC;QAAA,CACrG;KACF,CAAC;AAAA,CACH;AAYD;;;;;GAKG;AACH,sBAA6B,OAA4B,EAAsB;IAC7E,IAAI,CAAC,OAAO,EAAE,KAAK;QAAE,MAAM,IAAI,SAAS,CAAC,0BAA0B,CAAC,CAAC;IACrE,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,WAAW,OAAO,CAAC,MAAM,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;IAClG,IAAI,CAAC,IAAI;QAAE,MAAM,IAAI,SAAS,CAAC,sCAAsC,CAAC,CAAC;IACvE,MAAM,IAAI,GAAG,MAAM,CAAC,OAAO,EAAE,IAAI,EAAE,UAAU,OAAO,CAAC,KAAK,EAAE,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC;IAC7E,MAAM,cAAc,GAAG,KAAK,EAAE,MAAc,EAAiB,EAAE,CAAC;QAC9D,MAAM,IAAI,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;QAC7B,MAAM,IAAI,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,UAAU,IAAI,WAAW,EAAE,CAAC,CAAC;QAClE,MAAM,IAAI,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,UAAU,IAAI,iBAAiB,EAAE,CAAC,CAAC;IAAA,CACzE,CAAC;IACF,OAAO;QACL,IAAI,EAAE,OAAO;QACb,cAAc;QACd,KAAK,CAAC,GAAG,CAAC,MAAM,EAAE;YAChB,MAAM,IAAI,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,UAAU,OAAO,CAAC,MAAM,CAAC,EAAE,EAAE,IAAI,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC;YAC5F,MAAM,cAAc,CAAC,MAAM,CAAC,CAAC;QAAA,CAC9B;KACF,CAAC;AAAA,CACH"}

package/dist/commonjs/lib/config.d.ts

@@ -31,8 +31,8 @@ export declare function serverURLFromOptions(options: SDKOptions): URL | null;
 export declare const SDK_METADATA: {
     readonly language: "typescript";
     readonly openapiDocVersion: "1";
-    readonly sdkVersion: "2.0.10";
+    readonly sdkVersion: "2.0.12";
     readonly genVersion: "internal";
-    readonly userAgent: "noresponse-sdk/typescript 2.0.10 internal 1 @noresponse/node";
+    readonly userAgent: "noresponse-sdk/typescript 2.0.12 internal 1 @noresponse/node";
 };
 //# sourceMappingURL=config.d.ts.map

package/dist/commonjs/lib/config.js

@@ -28,8 +28,8 @@ function serverURLFromOptions(options) {
 exports.SDK_METADATA = {
     language: "typescript",
     openapiDocVersion: "1",
-    sdkVersion: "2.0.10",
+    sdkVersion: "2.0.12",
     genVersion: "internal",
-    userAgent: "noresponse-sdk/typescript 2.0.10 internal 1 @noresponse/node",
+    userAgent: "noresponse-sdk/typescript 2.0.12 internal 1 @noresponse/node",
 };
 //# sourceMappingURL=config.js.map

package/dist/commonjs/models/assessment-request-issued-credential.d.ts

@@ -0,0 +1,18 @@
+import * as z from "zod/v4-mini";
+/**
+ * Optional. When the signup gate issues an API key to the new account, send SHA-256 of that key, so later usage of the key, or a leaked copy, ties back to this assessment. Each SDK has a helper that computes it. Send only the hash: customer keys are high-entropy, so the hash reveals nothing about them. The assessment stores it, and no response, webhook or log carries it.
+ */
+export type AssessmentRequestIssuedCredential = {
+    /**
+     * SHA-256 of the issued key's UTF-8 bytes, as 64 lower-case hex characters.
+     */
+    sha256: string;
+};
+/** @internal */
+export type AssessmentRequestIssuedCredential$Outbound = {
+    sha256: string;
+};
+/** @internal */
+export declare const AssessmentRequestIssuedCredential$outboundSchema: z.ZodMiniType<AssessmentRequestIssuedCredential$Outbound, AssessmentRequestIssuedCredential>;
+export declare function assessmentRequestIssuedCredentialToJSON(assessmentRequestIssuedCredential: AssessmentRequestIssuedCredential): string;
+//# sourceMappingURL=assessment-request-issued-credential.d.ts.map

package/dist/commonjs/models/assessment-request-issued-credential.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"assessment-request-issued-credential.d.ts","sourceRoot":"","sources":["../../../src/models/assessment-request-issued-credential.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,CAAC,MAAM,aAAa,CAAC;AAEjC;;GAEG;AACH,MAAM,MAAM,iCAAiC,GAAG;IAC9C;;OAEG;IACH,MAAM,EAAE,MAAM,CAAC;CAChB,CAAC;AAEF,gBAAgB;AAChB,MAAM,MAAM,0CAA0C,GAAG;IACvD,MAAM,EAAE,MAAM,CAAC;CAChB,CAAC;AAEF,gBAAgB;AAChB,eAAO,MAAM,gDAAgD,EAAE,CAAC,CAAC,WAAW,CAC1E,0CAA0C,EAC1C,iCAAiC,CAGjC,CAAC;AAEH,wBAAgB,uCAAuC,CACrD,iCAAiC,EAAE,iCAAiC,GACnE,MAAM,CAMR"}

package/dist/commonjs/models/assessment-request-issued-credential.js

@@ -0,0 +1,46 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AssessmentRequestIssuedCredential$outboundSchema = void 0;
+exports.assessmentRequestIssuedCredentialToJSON = assessmentRequestIssuedCredentialToJSON;
+const z = __importStar(require("zod/v4-mini"));
+/** @internal */
+exports.AssessmentRequestIssuedCredential$outboundSchema = z.object({
+    sha256: z.string(),
+});
+function assessmentRequestIssuedCredentialToJSON(assessmentRequestIssuedCredential) {
+    return JSON.stringify(exports.AssessmentRequestIssuedCredential$outboundSchema.parse(assessmentRequestIssuedCredential));
+}
+//# sourceMappingURL=assessment-request-issued-credential.js.map

package/dist/commonjs/models/assessment-request-issued-credential.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"assessment-request-issued-credential.js","sourceRoot":"","sources":["../../../src/models/assessment-request-issued-credential.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,MAAY,CAAC,wCAAoB;AAiBjC,gBAAgB;AACH,QAAA,gDAAgD,GAGzD,CAAC,CAAC,MAAM,CAAC;IACX,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE;CACnB,CAAC,CAAC;AAEH,iDACE,iCAAoE,EAC5D;IACR,OAAO,IAAI,CAAC,SAAS,CACnB,QAAA,gDAAgD,CAAC,KAAK,CACpD,iCAAiC,CAClC,CACF,CAAC;AAAA,CACH"}