@noresponse/node 7.1.5 → 7.1.7

package/CHANGELOG.md

@@ -1,5 +1,22 @@
 # Changelog
 
+## 7.1.7
+
+* `sdk.assessments.create()`:  `response.account.risk.reasons[].code` **Changed**
+* `sdk.assessments.get()`:  `response.account.risk.reasons[].code` **Changed**
+* `sdk.assessments.query()`:  `response.items[].risk.reasons[].code` **Changed**
+* `sdk.accounts.listChanged()`:  `response.items[].risk.reasons[].code` **Changed**
+* `sdk.accounts.get()`:  `response.risk.reasons[].code` **Changed**
+* `sdk.accounts.listAssessments()`:  `response.items[].risk.reasons[].code` **Changed**
+
+## 7.1.6
+
+* `sdk.integrations.create()`: 
+  *  `request.platform.enum(supabase)` **Added**
+  *  `response.platform.enum(supabase)` **Added**
+* `sdk.integrations.list()`:  `response.items[].platform.enum(supabase)` **Added**
+* `sdk.integrations.rotate()`:  `response.platform.enum(supabase)` **Added**
+
 ## 7.1.5
 
 * `sdk.assessments.create()`:  `response.account.risk.reasons[].code` **Changed**

package/dist/commonjs/funcs/integrations-create.d.ts

@@ -13,7 +13,7 @@ import { Result } from "../types/fp.js";
  * Register a hosted provider integration.
  *
  * @remarks
- * Registers a WorkOS or Auth0 integration and returns its hosted endpoint, url, so a sign-up or sign-in is scored with no server of your own. For WorkOS, send the Actions signing secret from the WorkOS dashboard and point the user registration and authentication Actions at url. For Auth0, the answer's secret is the shared secret of the NoResponse Auth0 Action, shown once: store it as an Action secret. hook_points defaults to both pre_registration and post_login; an event that is not listed is allowed without an assessment. The endpoint waits for the full assessment for at most 2.5 seconds (WorkOS) or 4.5 seconds (Auth0), denies only when risk.block is true and allows on any failure. Requires the integrations scope; at most 10 per account. Not idempotent: a retry after a lost answer registers another integration.
+ * Registers a WorkOS, Auth0 or Supabase integration and returns its hosted endpoint, url, so a sign-up or sign-in is scored with no server of your own. For WorkOS, send the Actions signing secret from the WorkOS dashboard and point the user registration and authentication Actions at url. For Supabase, send the hook secret Supabase generates (v1,whsec_...) and set url as the Before User Created hook's HTTPS endpoint. For Auth0, the answer's secret is the shared secret of the NoResponse Auth0 Action, shown once: store it as an Action secret. hook_points defaults to every hook point the platform has (Supabase has only pre_registration); an event that is not listed is allowed without an assessment. The endpoint waits for the full assessment for at most 2.5 seconds (WorkOS, Supabase) or 4.5 seconds (Auth0), denies only when risk.block is true and allows on any failure. Requires the integrations scope; at most 10 per account. Not idempotent: a retry after a lost answer registers another integration.
  */
 export declare function integrationsCreate(client: NoResponseCore, request: models.IntegrationRequest, options?: RequestOptions): APIPromise<Result<operations.CreateIntegrationResponse, errors.BadRequestError | errors.AuthenticationError | errors.PermissionDeniedError | errors.NotFoundError | errors.ConflictError | errors.RateLimitError | NoResponseError | ResponseValidationError | ConnectionError | RequestAbortedError | RequestTimeoutError | InvalidRequestError | UnexpectedClientError | SDKValidationError>>;
 //# sourceMappingURL=integrations-create.d.ts.map

package/dist/commonjs/funcs/integrations-create.js

@@ -50,7 +50,7 @@ const async_js_1 = require("../types/async.js");
  * Register a hosted provider integration.
  *
  * @remarks
- * Registers a WorkOS or Auth0 integration and returns its hosted endpoint, url, so a sign-up or sign-in is scored with no server of your own. For WorkOS, send the Actions signing secret from the WorkOS dashboard and point the user registration and authentication Actions at url. For Auth0, the answer's secret is the shared secret of the NoResponse Auth0 Action, shown once: store it as an Action secret. hook_points defaults to both pre_registration and post_login; an event that is not listed is allowed without an assessment. The endpoint waits for the full assessment for at most 2.5 seconds (WorkOS) or 4.5 seconds (Auth0), denies only when risk.block is true and allows on any failure. Requires the integrations scope; at most 10 per account. Not idempotent: a retry after a lost answer registers another integration.
+ * Registers a WorkOS, Auth0 or Supabase integration and returns its hosted endpoint, url, so a sign-up or sign-in is scored with no server of your own. For WorkOS, send the Actions signing secret from the WorkOS dashboard and point the user registration and authentication Actions at url. For Supabase, send the hook secret Supabase generates (v1,whsec_...) and set url as the Before User Created hook's HTTPS endpoint. For Auth0, the answer's secret is the shared secret of the NoResponse Auth0 Action, shown once: store it as an Action secret. hook_points defaults to every hook point the platform has (Supabase has only pre_registration); an event that is not listed is allowed without an assessment. The endpoint waits for the full assessment for at most 2.5 seconds (WorkOS, Supabase) or 4.5 seconds (Auth0), denies only when risk.block is true and allows on any failure. Requires the integrations scope; at most 10 per account. Not idempotent: a retry after a lost answer registers another integration.
  */
 function integrationsCreate(client, request, options) {
     return new async_js_1.APIPromise($do(client, request, options));

package/dist/commonjs/funcs/integrations-rotate.d.ts

@@ -12,7 +12,7 @@ import { Result } from "../types/fp.js";
  * Replace an integration's secret.
  *
  * @remarks
- * For Auth0, send {} and the answer's secret is the new shared secret, shown once. For WorkOS, regenerate the Actions secret in the WorkOS dashboard and send it as signing_secret. The replaced secret is still accepted for 24 hours (previous_secret_expires_at). Requires the integrations scope. Not idempotent: a retry after a lost answer rotates again.
+ * For Auth0, send {} and the answer's secret is the new shared secret, shown once. For WorkOS, regenerate the Actions secret in the WorkOS dashboard and send it as signing_secret; for Supabase, generate a new hook secret in the Supabase dashboard and send it as signing_secret. The replaced secret is still accepted for 24 hours (previous_secret_expires_at). Requires the integrations scope. Not idempotent: a retry after a lost answer rotates again.
  */
 export declare function integrationsRotate(client: NoResponseCore, request: operations.RotateIntegrationSecretRequest, options?: RequestOptions): APIPromise<Result<operations.RotateIntegrationSecretResponse, errors.BadRequestError | errors.AuthenticationError | errors.PermissionDeniedError | errors.NotFoundError | errors.ConflictError | errors.RateLimitError | NoResponseError | ResponseValidationError | ConnectionError | RequestAbortedError | RequestTimeoutError | InvalidRequestError | UnexpectedClientError | SDKValidationError>>;
 //# sourceMappingURL=integrations-rotate.d.ts.map

package/dist/commonjs/funcs/integrations-rotate.js

@@ -49,7 +49,7 @@ const async_js_1 = require("../types/async.js");
  * Replace an integration's secret.
  *
  * @remarks
- * For Auth0, send {} and the answer's secret is the new shared secret, shown once. For WorkOS, regenerate the Actions secret in the WorkOS dashboard and send it as signing_secret. The replaced secret is still accepted for 24 hours (previous_secret_expires_at). Requires the integrations scope. Not idempotent: a retry after a lost answer rotates again.
+ * For Auth0, send {} and the answer's secret is the new shared secret, shown once. For WorkOS, regenerate the Actions secret in the WorkOS dashboard and send it as signing_secret; for Supabase, generate a new hook secret in the Supabase dashboard and send it as signing_secret. The replaced secret is still accepted for 24 hours (previous_secret_expires_at). Requires the integrations scope. Not idempotent: a retry after a lost answer rotates again.
  */
 function integrationsRotate(client, request, options) {
     return new async_js_1.APIPromise($do(client, request, options));

package/dist/commonjs/lib/config.d.ts

@@ -31,8 +31,8 @@ export declare function serverURLFromOptions(options: SDKOptions): URL | null;
 export declare const SDK_METADATA: {
     readonly language: "typescript";
     readonly openapiDocVersion: "1";
-    readonly sdkVersion: "7.1.5";
+    readonly sdkVersion: "7.1.7";
     readonly genVersion: "internal";
-    readonly userAgent: "noresponse-sdk/typescript 7.1.5 internal 1 @noresponse/node";
+    readonly userAgent: "noresponse-sdk/typescript 7.1.7 internal 1 @noresponse/node";
 };
 //# sourceMappingURL=config.d.ts.map

package/dist/commonjs/lib/config.js

@@ -28,8 +28,8 @@ function serverURLFromOptions(options) {
 exports.SDK_METADATA = {
     language: "typescript",
     openapiDocVersion: "1",
-    sdkVersion: "7.1.5",
+    sdkVersion: "7.1.7",
     genVersion: "internal",
-    userAgent: "noresponse-sdk/typescript 7.1.5 internal 1 @noresponse/node",
+    userAgent: "noresponse-sdk/typescript 7.1.7 internal 1 @noresponse/node",
 };
 //# sourceMappingURL=config.js.map

package/dist/commonjs/models/assessment-request-identifiers.d.ts

@@ -16,7 +16,7 @@ export type AssessmentRequestIdentifiers = {
      */
     phone?: string | undefined;
     /**
-     * The full name as the user typed it, 1 to 128 characters with no control or invisible characters. It is used only to match names in the evidence.
+     * The full name as the user typed it, 1 to 128 characters with no control or invisible characters. It is searched in breach data and matched against names in the evidence. A row holding the signup's own email or username confirms the name; rows sharing another identifier add to the identity's history.
      */
     name?: string | undefined;
     /**

package/dist/commonjs/models/breach-selector.d.ts

@@ -1,7 +1,7 @@
 import * as z from "zod/v4-mini";
 import { OpenEnum } from "../types/enums.js";
 /**
- * The submitted identifier a breach table matched on: email or username. Phone and name are not breach selectors.
+ * The submitted email or username whose own search matched the table. A submitted full name is searched as well, and what it finds feeds the identity's reasons rather than this list.
  */
 export declare const BreachSelector: {
     readonly Email: "email";
@@ -9,7 +9,7 @@ export declare const BreachSelector: {
     readonly Ip: "ip";
 };
 /**
- * The submitted identifier a breach table matched on: email or username. Phone and name are not breach selectors.
+ * The submitted email or username whose own search matched the table. A submitted full name is searched as well, and what it finds feeds the identity's reasons rather than this list.
  */
 export type BreachSelector = OpenEnum<typeof BreachSelector>;
 /** @internal */

package/dist/commonjs/models/breach-selector.js

@@ -36,7 +36,7 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.BreachSelector$outboundSchema = exports.BreachSelector$inboundSchema = exports.BreachSelector = void 0;
 const openEnums = __importStar(require("../types/enums.js"));
 /**
- * The submitted identifier a breach table matched on: email or username. Phone and name are not breach selectors.
+ * The submitted email or username whose own search matched the table. A submitted full name is searched as well, and what it finds feeds the identity's reasons rather than this list.
  */
 exports.BreachSelector = {
     Email: "email",

package/dist/commonjs/models/breach.d.ts

@@ -30,7 +30,7 @@ export type Breach = {
      */
     month?: number | undefined;
     /**
-     * The submitted identifier a breach table matched on: email or username. Phone and name are not breach selectors.
+     * The submitted email or username whose own search matched the table. A submitted full name is searched as well, and what it finds feeds the identity's reasons rather than this list.
      */
     matchedOn: BreachSelector;
     exposed?: Array<BreachExposed> | undefined;

package/dist/commonjs/models/integration-platform.d.ts

@@ -6,6 +6,7 @@ import { OpenEnum } from "../types/enums.js";
 export declare const IntegrationPlatform: {
     readonly Workos: "workos";
     readonly Auth0: "auth0";
+    readonly Supabase: "supabase";
 };
 /**
  * The authentication provider that calls the endpoint.

package/dist/commonjs/models/integration-platform.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"integration-platform.d.ts","sourceRoot":"","sources":["../../../src/models/integration-platform.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,CAAC,MAAM,aAAa,CAAC;AAEjC,OAAO,EAAE,QAAQ,EAAE,MAAM,mBAAmB,CAAC;AAE7C;;GAEG;AACH,eAAO,MAAM,mBAAmB;;;CAGtB,CAAC;AACX;;GAEG;AACH,MAAM,MAAM,mBAAmB,GAAG,QAAQ,CAAC,OAAO,mBAAmB,CAAC,CAAC;AAEvE,gBAAgB;AAChB,eAAO,MAAM,iCAAiC,EAAE,CAAC,CAAC,WAAW,CAC3D,mBAAmB,EACnB,OAAO,CACuC,CAAC;AACjD,gBAAgB;AAChB,eAAO,MAAM,kCAAkC,EAAE,CAAC,CAAC,WAAW,CAC5D,MAAM,EACN,mBAAmB,CAC4B,CAAC"}
+{"version":3,"file":"integration-platform.d.ts","sourceRoot":"","sources":["../../../src/models/integration-platform.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,CAAC,MAAM,aAAa,CAAC;AAEjC,OAAO,EAAE,QAAQ,EAAE,MAAM,mBAAmB,CAAC;AAE7C;;GAEG;AACH,eAAO,MAAM,mBAAmB;;;;CAItB,CAAC;AACX;;GAEG;AACH,MAAM,MAAM,mBAAmB,GAAG,QAAQ,CAAC,OAAO,mBAAmB,CAAC,CAAC;AAEvE,gBAAgB;AAChB,eAAO,MAAM,iCAAiC,EAAE,CAAC,CAAC,WAAW,CAC3D,mBAAmB,EACnB,OAAO,CACuC,CAAC;AACjD,gBAAgB;AAChB,eAAO,MAAM,kCAAkC,EAAE,CAAC,CAAC,WAAW,CAC5D,MAAM,EACN,mBAAmB,CAC4B,CAAC"}

package/dist/commonjs/models/integration-platform.js

@@ -41,6 +41,7 @@ const openEnums = __importStar(require("../types/enums.js"));
 exports.IntegrationPlatform = {
     Workos: "workos",
     Auth0: "auth0",
+    Supabase: "supabase",
 };
 /** @internal */
 exports.IntegrationPlatform$inboundSchema = openEnums.inboundSchema(exports.IntegrationPlatform);

package/dist/commonjs/models/integration-platform.js.map

@@ -1 +1 @@
-{"version":3,"file":"integration-platform.js","sourceRoot":"","sources":["../../../src/models/integration-platform.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AACA,MAAY,SAAS,8CAA0B;AAG/C;;GAEG;AACU,QAAA,mBAAmB,GAAG;IACjC,MAAM,EAAE,QAAQ;IAChB,KAAK,EAAE,OAAO;CACN,CAAC;AAMX,gBAAgB;AACH,QAAA,iCAAiC,GAG1C,SAAS,CAAC,aAAa,CAAC,QAAA,mBAAmB,CAAC,CAAC;AACjD,gBAAgB;AACH,QAAA,kCAAkC,GAG3C,SAAS,CAAC,cAAc,CAAC,QAAA,mBAAmB,CAAC,CAAC"}
+{"version":3,"file":"integration-platform.js","sourceRoot":"","sources":["../../../src/models/integration-platform.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AACA,MAAY,SAAS,8CAA0B;AAG/C;;GAEG;AACU,QAAA,mBAAmB,GAAG;IACjC,MAAM,EAAE,QAAQ;IAChB,KAAK,EAAE,OAAO;IACd,QAAQ,EAAE,UAAU;CACZ,CAAC;AAMX,gBAAgB;AACH,QAAA,iCAAiC,GAG1C,SAAS,CAAC,aAAa,CAAC,QAAA,mBAAmB,CAAC,CAAC;AACjD,gBAAgB;AACH,QAAA,kCAAkC,GAG3C,SAAS,CAAC,cAAc,CAAC,QAAA,mBAAmB,CAAC,CAAC"}

package/dist/commonjs/models/integration-request.d.ts

@@ -2,7 +2,7 @@ import * as z from "zod/v4-mini";
 import { IntegrationHookPoint } from "./integration-hook-point.js";
 import { IntegrationPlatform } from "./integration-platform.js";
 /**
- * POST /v1/integrations body. Registers a hosted endpoint for one authentication provider. The workspace is the API key that signs the request, so the body has no workspace field and refuses one like any other unknown member. A WorkOS integration needs signing_secret, the Actions secret shown in the WorkOS dashboard, which NoResponse uses to verify each Action request and to sign its answer. An Auth0 integration sends no signing_secret: NoResponse generates the shared secret and returns it once.
+ * POST /v1/integrations body. Registers a hosted endpoint for one authentication provider. The workspace is the API key that signs the request, so the body has no workspace field and refuses one like any other unknown member. A WorkOS integration needs signing_secret, the Actions secret shown in the WorkOS dashboard, which NoResponse uses to verify each Action request and to sign its answer. A Supabase integration needs signing_secret, the hook secret Supabase generates for a Before User Created HTTPS hook (v1,whsec_ and base64), which NoResponse uses to verify each call. An Auth0 integration sends no signing_secret: NoResponse generates the shared secret and returns it once.
  */
 export type IntegrationRequest = {
     /**
@@ -10,11 +10,11 @@ export type IntegrationRequest = {
      */
     platform: IntegrationPlatform;
     /**
-     * The provider events the endpoint scores. Default both: pre_registration (WorkOS user registration Action, Auth0 pre-user-registration trigger) and post_login (WorkOS authentication Action, Auth0 post-login trigger). An event that is not listed is answered allow without an assessment.
+     * The provider events the endpoint scores. Default every hook point the platform has: pre_registration (WorkOS user registration Action, Auth0 pre-user-registration trigger, Supabase Before User Created hook) and post_login (WorkOS authentication Action, Auth0 post-login trigger). Supabase has only pre_registration, so a Supabase integration that lists post_login is refused. An event that is not listed is answered allow without an assessment.
      */
     hookPoints?: Array<IntegrationHookPoint> | undefined;
     /**
-     * The WorkOS Actions signing secret, as the WorkOS dashboard shows it: 16 to 256 printable ASCII characters with no spaces. It is stored sealed and is not returned.
+     * The WorkOS Actions signing secret or the Supabase hook secret, as the provider's dashboard shows it: 16 to 256 printable ASCII characters with no spaces. It is stored sealed and is not returned.
      */
     signingSecret?: string | undefined;
 };

package/dist/commonjs/models/integration-rotation-request.d.ts

@@ -1,10 +1,10 @@
 import * as z from "zod/v4-mini";
 /**
- * POST /v1/integrations/{integration_id}/rotate body. For an Auth0 integration send {}: NoResponse generates a new shared secret and returns it once. For a WorkOS integration send the new signing_secret after regenerating it in the WorkOS dashboard. Either way the previous secret is still accepted for 24 hours, so the provider can be switched over without a refused call.
+ * POST /v1/integrations/{integration_id}/rotate body. For an Auth0 integration send {}: NoResponse generates a new shared secret and returns it once. For a WorkOS or Supabase integration send the new signing_secret after regenerating it in the provider's dashboard. Either way the previous secret is still accepted for 24 hours, so the provider can be switched over without a refused call.
  */
 export type IntegrationRotationRequest = {
     /**
-     * The WorkOS Actions signing secret, as the WorkOS dashboard shows it: 16 to 256 printable ASCII characters with no spaces. It is stored sealed and is not returned.
+     * The WorkOS Actions signing secret or the Supabase hook secret, as the provider's dashboard shows it: 16 to 256 printable ASCII characters with no spaces. It is stored sealed and is not returned.
      */
     signingSecret?: string | undefined;
 };

package/dist/commonjs/models/reason-code.d.ts

@@ -46,6 +46,12 @@ export declare const ReasonCode: {
     readonly EmailDomainNonexistent: "email_domain_nonexistent";
     readonly ForumSanctioned: "forum_sanctioned";
     readonly PriorPaymentAbuse: "prior_payment_abuse";
+    readonly IpHistoryMatch: "ip_history_match";
+    readonly IdentityAttributeConflict: "identity_attribute_conflict";
+    readonly ImpossibleIdentityAge: "impossible_identity_age";
+    readonly BreachSharedIp: "breach_shared_ip";
+    readonly NationalityMismatch: "nationality_mismatch";
+    readonly MinorIdentity: "minor_identity";
 };
 /**
  * A stable reason code. New codes may appear; ignore any you do not know.

package/dist/commonjs/models/reason-code.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"reason-code.d.ts","sourceRoot":"","sources":["../../../src/models/reason-code.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,CAAC,MAAM,aAAa,CAAC;AAEjC,OAAO,EAAE,QAAQ,EAAE,MAAM,mBAAmB,CAAC;AAE7C;;GAEG;AACH,eAAO,MAAM,UAAU;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA2Cb,CAAC;AACX;;GAEG;AACH,MAAM,MAAM,UAAU,GAAG,QAAQ,CAAC,OAAO,UAAU,CAAC,CAAC;AAErD,gBAAgB;AAChB,eAAO,MAAM,wBAAwB,EAAE,CAAC,CAAC,WAAW,CAAC,UAAU,EAAE,OAAO,CACnC,CAAC;AACtC,gBAAgB;AAChB,eAAO,MAAM,yBAAyB,EAAE,CAAC,CAAC,WAAW,CAAC,MAAM,EAAE,UAAU,CAClC,CAAC"}
+{"version":3,"file":"reason-code.d.ts","sourceRoot":"","sources":["../../../src/models/reason-code.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,CAAC,MAAM,aAAa,CAAC;AAEjC,OAAO,EAAE,QAAQ,EAAE,MAAM,mBAAmB,CAAC;AAE7C;;GAEG;AACH,eAAO,MAAM,UAAU;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAiDb,CAAC;AACX;;GAEG;AACH,MAAM,MAAM,UAAU,GAAG,QAAQ,CAAC,OAAO,UAAU,CAAC,CAAC;AAErD,gBAAgB;AAChB,eAAO,MAAM,wBAAwB,EAAE,CAAC,CAAC,WAAW,CAAC,UAAU,EAAE,OAAO,CACnC,CAAC;AACtC,gBAAgB;AAChB,eAAO,MAAM,yBAAyB,EAAE,CAAC,CAAC,WAAW,CAAC,MAAM,EAAE,UAAU,CAClC,CAAC"}

package/dist/commonjs/models/reason-code.js

@@ -81,6 +81,12 @@ exports.ReasonCode = {
     EmailDomainNonexistent: "email_domain_nonexistent",
     ForumSanctioned: "forum_sanctioned",
     PriorPaymentAbuse: "prior_payment_abuse",
+    IpHistoryMatch: "ip_history_match",
+    IdentityAttributeConflict: "identity_attribute_conflict",
+    ImpossibleIdentityAge: "impossible_identity_age",
+    BreachSharedIp: "breach_shared_ip",
+    NationalityMismatch: "nationality_mismatch",
+    MinorIdentity: "minor_identity",
 };
 /** @internal */
 exports.ReasonCode$inboundSchema = openEnums.inboundSchema(exports.ReasonCode);

package/dist/commonjs/models/reason-code.js.map

@@ -1 +1 @@
-{"version":3,"file":"reason-code.js","sourceRoot":"","sources":["../../../src/models/reason-code.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AACA,MAAY,SAAS,8CAA0B;AAG/C;;GAEG;AACU,QAAA,UAAU,GAAG;IACxB,kBAAkB,EAAE,sBAAsB;IAC1C,UAAU,EAAE,aAAa;IACzB,eAAe,EAAE,kBAAkB;IACnC,QAAQ,EAAE,WAAW;IACrB,WAAW,EAAE,cAAc;IAC3B,SAAS,EAAE,YAAY;IACvB,gBAAgB,EAAE,mBAAmB;IACrC,eAAe,EAAE,kBAAkB;IACnC,OAAO,EAAE,UAAU;IACnB,UAAU,EAAE,aAAa;IACzB,QAAQ,EAAE,WAAW;IACrB,kBAAkB,EAAE,sBAAsB;IAC1C,mBAAmB,EAAE,sBAAsB;IAC3C,YAAY,EAAE,eAAe;IAC7B,eAAe,EAAE,mBAAmB;IACpC,kBAAkB,EAAE,qBAAqB;IACzC,kBAAkB,EAAE,sBAAsB;IAC1C,mBAAmB,EAAE,uBAAuB;IAC5C,sBAAsB,EAAE,0BAA0B;IAClD,sBAAsB,EAAE,0BAA0B;IAClD,oBAAoB,EAAE,wBAAwB;IAC9C,eAAe,EAAE,mBAAmB;IACpC,oBAAoB,EAAE,wBAAwB;IAC9C,eAAe,EAAE,mBAAmB;IACpC,eAAe,EAAE,mBAAmB;IACpC,iBAAiB,EAAE,qBAAqB;IACxC,iBAAiB,EAAE,qBAAqB;IACxC,aAAa,EAAE,iBAAiB;IAChC,cAAc,EAAE,kBAAkB;IAClC,cAAc,EAAE,kBAAkB;IAClC,gBAAgB,EAAE,mBAAmB;IACrC,uBAAuB,EAAE,2BAA2B;IACpD,qBAAqB,EAAE,yBAAyB;IAChD,0BAA0B,EAAE,+BAA+B;IAC3D,cAAc,EAAE,kBAAkB;IAClC,YAAY,EAAE,eAAe;IAC7B,YAAY,EAAE,gBAAgB;IAC9B,gBAAgB,EAAE,oBAAoB;IACtC,eAAe,EAAE,oBAAoB;IACrC,sBAAsB,EAAE,0BAA0B;IAClD,eAAe,EAAE,kBAAkB;IACnC,iBAAiB,EAAE,qBAAqB;CAChC,CAAC;AAMX,gBAAgB;AACH,QAAA,wBAAwB,GACnC,SAAS,CAAC,aAAa,CAAC,QAAA,UAAU,CAAC,CAAC;AACtC,gBAAgB;AACH,QAAA,yBAAyB,GACpC,SAAS,CAAC,cAAc,CAAC,QAAA,UAAU,CAAC,CAAC"}
+{"version":3,"file":"reason-code.js","sourceRoot":"","sources":["../../../src/models/reason-code.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AACA,MAAY,SAAS,8CAA0B;AAG/C;;GAEG;AACU,QAAA,UAAU,GAAG;IACxB,kBAAkB,EAAE,sBAAsB;IAC1C,UAAU,EAAE,aAAa;IACzB,eAAe,EAAE,kBAAkB;IACnC,QAAQ,EAAE,WAAW;IACrB,WAAW,EAAE,cAAc;IAC3B,SAAS,EAAE,YAAY;IACvB,gBAAgB,EAAE,mBAAmB;IACrC,eAAe,EAAE,kBAAkB;IACnC,OAAO,EAAE,UAAU;IACnB,UAAU,EAAE,aAAa;IACzB,QAAQ,EAAE,WAAW;IACrB,kBAAkB,EAAE,sBAAsB;IAC1C,mBAAmB,EAAE,sBAAsB;IAC3C,YAAY,EAAE,eAAe;IAC7B,eAAe,EAAE,mBAAmB;IACpC,kBAAkB,EAAE,qBAAqB;IACzC,kBAAkB,EAAE,sBAAsB;IAC1C,mBAAmB,EAAE,uBAAuB;IAC5C,sBAAsB,EAAE,0BAA0B;IAClD,sBAAsB,EAAE,0BAA0B;IAClD,oBAAoB,EAAE,wBAAwB;IAC9C,eAAe,EAAE,mBAAmB;IACpC,oBAAoB,EAAE,wBAAwB;IAC9C,eAAe,EAAE,mBAAmB;IACpC,eAAe,EAAE,mBAAmB;IACpC,iBAAiB,EAAE,qBAAqB;IACxC,iBAAiB,EAAE,qBAAqB;IACxC,aAAa,EAAE,iBAAiB;IAChC,cAAc,EAAE,kBAAkB;IAClC,cAAc,EAAE,kBAAkB;IAClC,gBAAgB,EAAE,mBAAmB;IACrC,uBAAuB,EAAE,2BAA2B;IACpD,qBAAqB,EAAE,yBAAyB;IAChD,0BAA0B,EAAE,+BAA+B;IAC3D,cAAc,EAAE,kBAAkB;IAClC,YAAY,EAAE,eAAe;IAC7B,YAAY,EAAE,gBAAgB;IAC9B,gBAAgB,EAAE,oBAAoB;IACtC,eAAe,EAAE,oBAAoB;IACrC,sBAAsB,EAAE,0BAA0B;IAClD,eAAe,EAAE,kBAAkB;IACnC,iBAAiB,EAAE,qBAAqB;IACxC,cAAc,EAAE,kBAAkB;IAClC,yBAAyB,EAAE,6BAA6B;IACxD,qBAAqB,EAAE,yBAAyB;IAChD,cAAc,EAAE,kBAAkB;IAClC,mBAAmB,EAAE,sBAAsB;IAC3C,aAAa,EAAE,gBAAgB;CACvB,CAAC;AAMX,gBAAgB;AACH,QAAA,wBAAwB,GACnC,SAAS,CAAC,aAAa,CAAC,QAAA,UAAU,CAAC,CAAC;AACtC,gBAAgB;AACH,QAAA,yBAAyB,GACpC,SAAS,CAAC,cAAc,CAAC,QAAA,UAAU,CAAC,CAAC"}

package/dist/commonjs/sdk/integrations.d.ts

@@ -6,7 +6,7 @@ export declare class Integrations extends ClientSDK {
      * Register a hosted provider integration.
      *
      * @remarks
-     * Registers a WorkOS or Auth0 integration and returns its hosted endpoint, url, so a sign-up or sign-in is scored with no server of your own. For WorkOS, send the Actions signing secret from the WorkOS dashboard and point the user registration and authentication Actions at url. For Auth0, the answer's secret is the shared secret of the NoResponse Auth0 Action, shown once: store it as an Action secret. hook_points defaults to both pre_registration and post_login; an event that is not listed is allowed without an assessment. The endpoint waits for the full assessment for at most 2.5 seconds (WorkOS) or 4.5 seconds (Auth0), denies only when risk.block is true and allows on any failure. Requires the integrations scope; at most 10 per account. Not idempotent: a retry after a lost answer registers another integration.
+     * Registers a WorkOS, Auth0 or Supabase integration and returns its hosted endpoint, url, so a sign-up or sign-in is scored with no server of your own. For WorkOS, send the Actions signing secret from the WorkOS dashboard and point the user registration and authentication Actions at url. For Supabase, send the hook secret Supabase generates (v1,whsec_...) and set url as the Before User Created hook's HTTPS endpoint. For Auth0, the answer's secret is the shared secret of the NoResponse Auth0 Action, shown once: store it as an Action secret. hook_points defaults to every hook point the platform has (Supabase has only pre_registration); an event that is not listed is allowed without an assessment. The endpoint waits for the full assessment for at most 2.5 seconds (WorkOS, Supabase) or 4.5 seconds (Auth0), denies only when risk.block is true and allows on any failure. Requires the integrations scope; at most 10 per account. Not idempotent: a retry after a lost answer registers another integration.
      */
     create(request: models.IntegrationRequest, options?: RequestOptions): Promise<operations.CreateIntegrationResponse>;
     /**
@@ -27,7 +27,7 @@ export declare class Integrations extends ClientSDK {
      * Replace an integration's secret.
      *
      * @remarks
-     * For Auth0, send {} and the answer's secret is the new shared secret, shown once. For WorkOS, regenerate the Actions secret in the WorkOS dashboard and send it as signing_secret. The replaced secret is still accepted for 24 hours (previous_secret_expires_at). Requires the integrations scope. Not idempotent: a retry after a lost answer rotates again.
+     * For Auth0, send {} and the answer's secret is the new shared secret, shown once. For WorkOS, regenerate the Actions secret in the WorkOS dashboard and send it as signing_secret; for Supabase, generate a new hook secret in the Supabase dashboard and send it as signing_secret. The replaced secret is still accepted for 24 hours (previous_secret_expires_at). Requires the integrations scope. Not idempotent: a retry after a lost answer rotates again.
      */
     rotate(request: operations.RotateIntegrationSecretRequest, options?: RequestOptions): Promise<operations.RotateIntegrationSecretResponse>;
 }

package/dist/commonjs/sdk/integrations.js

@@ -12,7 +12,7 @@ class Integrations extends sdks_js_1.ClientSDK {
      * Register a hosted provider integration.
      *
      * @remarks
-     * Registers a WorkOS or Auth0 integration and returns its hosted endpoint, url, so a sign-up or sign-in is scored with no server of your own. For WorkOS, send the Actions signing secret from the WorkOS dashboard and point the user registration and authentication Actions at url. For Auth0, the answer's secret is the shared secret of the NoResponse Auth0 Action, shown once: store it as an Action secret. hook_points defaults to both pre_registration and post_login; an event that is not listed is allowed without an assessment. The endpoint waits for the full assessment for at most 2.5 seconds (WorkOS) or 4.5 seconds (Auth0), denies only when risk.block is true and allows on any failure. Requires the integrations scope; at most 10 per account. Not idempotent: a retry after a lost answer registers another integration.
+     * Registers a WorkOS, Auth0 or Supabase integration and returns its hosted endpoint, url, so a sign-up or sign-in is scored with no server of your own. For WorkOS, send the Actions signing secret from the WorkOS dashboard and point the user registration and authentication Actions at url. For Supabase, send the hook secret Supabase generates (v1,whsec_...) and set url as the Before User Created hook's HTTPS endpoint. For Auth0, the answer's secret is the shared secret of the NoResponse Auth0 Action, shown once: store it as an Action secret. hook_points defaults to every hook point the platform has (Supabase has only pre_registration); an event that is not listed is allowed without an assessment. The endpoint waits for the full assessment for at most 2.5 seconds (WorkOS, Supabase) or 4.5 seconds (Auth0), denies only when risk.block is true and allows on any failure. Requires the integrations scope; at most 10 per account. Not idempotent: a retry after a lost answer registers another integration.
      */
     async create(request, options) {
         return (0, fp_js_1.unwrapAsync)((0, integrations_create_js_1.integrationsCreate)(this, request, options));
@@ -39,7 +39,7 @@ class Integrations extends sdks_js_1.ClientSDK {
      * Replace an integration's secret.
      *
      * @remarks
-     * For Auth0, send {} and the answer's secret is the new shared secret, shown once. For WorkOS, regenerate the Actions secret in the WorkOS dashboard and send it as signing_secret. The replaced secret is still accepted for 24 hours (previous_secret_expires_at). Requires the integrations scope. Not idempotent: a retry after a lost answer rotates again.
+     * For Auth0, send {} and the answer's secret is the new shared secret, shown once. For WorkOS, regenerate the Actions secret in the WorkOS dashboard and send it as signing_secret; for Supabase, generate a new hook secret in the Supabase dashboard and send it as signing_secret. The replaced secret is still accepted for 24 hours (previous_secret_expires_at). Requires the integrations scope. Not idempotent: a retry after a lost answer rotates again.
      */
     async rotate(request, options) {
         return (0, fp_js_1.unwrapAsync)((0, integrations_rotate_js_1.integrationsRotate)(this, request, options));

package/dist/esm/funcs/integrations-create.d.ts

@@ -13,7 +13,7 @@ import { Result } from "../types/fp.js";
  * Register a hosted provider integration.
  *
  * @remarks
- * Registers a WorkOS or Auth0 integration and returns its hosted endpoint, url, so a sign-up or sign-in is scored with no server of your own. For WorkOS, send the Actions signing secret from the WorkOS dashboard and point the user registration and authentication Actions at url. For Auth0, the answer's secret is the shared secret of the NoResponse Auth0 Action, shown once: store it as an Action secret. hook_points defaults to both pre_registration and post_login; an event that is not listed is allowed without an assessment. The endpoint waits for the full assessment for at most 2.5 seconds (WorkOS) or 4.5 seconds (Auth0), denies only when risk.block is true and allows on any failure. Requires the integrations scope; at most 10 per account. Not idempotent: a retry after a lost answer registers another integration.
+ * Registers a WorkOS, Auth0 or Supabase integration and returns its hosted endpoint, url, so a sign-up or sign-in is scored with no server of your own. For WorkOS, send the Actions signing secret from the WorkOS dashboard and point the user registration and authentication Actions at url. For Supabase, send the hook secret Supabase generates (v1,whsec_...) and set url as the Before User Created hook's HTTPS endpoint. For Auth0, the answer's secret is the shared secret of the NoResponse Auth0 Action, shown once: store it as an Action secret. hook_points defaults to every hook point the platform has (Supabase has only pre_registration); an event that is not listed is allowed without an assessment. The endpoint waits for the full assessment for at most 2.5 seconds (WorkOS, Supabase) or 4.5 seconds (Auth0), denies only when risk.block is true and allows on any failure. Requires the integrations scope; at most 10 per account. Not idempotent: a retry after a lost answer registers another integration.
  */
 export declare function integrationsCreate(client: NoResponseCore, request: models.IntegrationRequest, options?: RequestOptions): APIPromise<Result<operations.CreateIntegrationResponse, errors.BadRequestError | errors.AuthenticationError | errors.PermissionDeniedError | errors.NotFoundError | errors.ConflictError | errors.RateLimitError | NoResponseError | ResponseValidationError | ConnectionError | RequestAbortedError | RequestTimeoutError | InvalidRequestError | UnexpectedClientError | SDKValidationError>>;
 //# sourceMappingURL=integrations-create.d.ts.map

package/dist/esm/funcs/integrations-create.js

@@ -14,7 +14,7 @@ import { APIPromise } from "../types/async.js";
  * Register a hosted provider integration.
  *
  * @remarks
- * Registers a WorkOS or Auth0 integration and returns its hosted endpoint, url, so a sign-up or sign-in is scored with no server of your own. For WorkOS, send the Actions signing secret from the WorkOS dashboard and point the user registration and authentication Actions at url. For Auth0, the answer's secret is the shared secret of the NoResponse Auth0 Action, shown once: store it as an Action secret. hook_points defaults to both pre_registration and post_login; an event that is not listed is allowed without an assessment. The endpoint waits for the full assessment for at most 2.5 seconds (WorkOS) or 4.5 seconds (Auth0), denies only when risk.block is true and allows on any failure. Requires the integrations scope; at most 10 per account. Not idempotent: a retry after a lost answer registers another integration.
+ * Registers a WorkOS, Auth0 or Supabase integration and returns its hosted endpoint, url, so a sign-up or sign-in is scored with no server of your own. For WorkOS, send the Actions signing secret from the WorkOS dashboard and point the user registration and authentication Actions at url. For Supabase, send the hook secret Supabase generates (v1,whsec_...) and set url as the Before User Created hook's HTTPS endpoint. For Auth0, the answer's secret is the shared secret of the NoResponse Auth0 Action, shown once: store it as an Action secret. hook_points defaults to every hook point the platform has (Supabase has only pre_registration); an event that is not listed is allowed without an assessment. The endpoint waits for the full assessment for at most 2.5 seconds (WorkOS, Supabase) or 4.5 seconds (Auth0), denies only when risk.block is true and allows on any failure. Requires the integrations scope; at most 10 per account. Not idempotent: a retry after a lost answer registers another integration.
  */
 export function integrationsCreate(client, request, options) {
     return new APIPromise($do(client, request, options));

package/dist/esm/funcs/integrations-rotate.d.ts

@@ -12,7 +12,7 @@ import { Result } from "../types/fp.js";
  * Replace an integration's secret.
  *
  * @remarks
- * For Auth0, send {} and the answer's secret is the new shared secret, shown once. For WorkOS, regenerate the Actions secret in the WorkOS dashboard and send it as signing_secret. The replaced secret is still accepted for 24 hours (previous_secret_expires_at). Requires the integrations scope. Not idempotent: a retry after a lost answer rotates again.
+ * For Auth0, send {} and the answer's secret is the new shared secret, shown once. For WorkOS, regenerate the Actions secret in the WorkOS dashboard and send it as signing_secret; for Supabase, generate a new hook secret in the Supabase dashboard and send it as signing_secret. The replaced secret is still accepted for 24 hours (previous_secret_expires_at). Requires the integrations scope. Not idempotent: a retry after a lost answer rotates again.
  */
 export declare function integrationsRotate(client: NoResponseCore, request: operations.RotateIntegrationSecretRequest, options?: RequestOptions): APIPromise<Result<operations.RotateIntegrationSecretResponse, errors.BadRequestError | errors.AuthenticationError | errors.PermissionDeniedError | errors.NotFoundError | errors.ConflictError | errors.RateLimitError | NoResponseError | ResponseValidationError | ConnectionError | RequestAbortedError | RequestTimeoutError | InvalidRequestError | UnexpectedClientError | SDKValidationError>>;
 //# sourceMappingURL=integrations-rotate.d.ts.map

package/dist/esm/funcs/integrations-rotate.js

@@ -13,7 +13,7 @@ import { APIPromise } from "../types/async.js";
  * Replace an integration's secret.
  *
  * @remarks
- * For Auth0, send {} and the answer's secret is the new shared secret, shown once. For WorkOS, regenerate the Actions secret in the WorkOS dashboard and send it as signing_secret. The replaced secret is still accepted for 24 hours (previous_secret_expires_at). Requires the integrations scope. Not idempotent: a retry after a lost answer rotates again.
+ * For Auth0, send {} and the answer's secret is the new shared secret, shown once. For WorkOS, regenerate the Actions secret in the WorkOS dashboard and send it as signing_secret; for Supabase, generate a new hook secret in the Supabase dashboard and send it as signing_secret. The replaced secret is still accepted for 24 hours (previous_secret_expires_at). Requires the integrations scope. Not idempotent: a retry after a lost answer rotates again.
  */
 export function integrationsRotate(client, request, options) {
     return new APIPromise($do(client, request, options));

package/dist/esm/lib/config.d.ts

@@ -31,8 +31,8 @@ export declare function serverURLFromOptions(options: SDKOptions): URL | null;
 export declare const SDK_METADATA: {
     readonly language: "typescript";
     readonly openapiDocVersion: "1";
-    readonly sdkVersion: "7.1.5";
+    readonly sdkVersion: "7.1.7";
     readonly genVersion: "internal";
-    readonly userAgent: "noresponse-sdk/typescript 7.1.5 internal 1 @noresponse/node";
+    readonly userAgent: "noresponse-sdk/typescript 7.1.7 internal 1 @noresponse/node";
 };
 //# sourceMappingURL=config.d.ts.map

package/dist/esm/lib/config.js

@@ -24,8 +24,8 @@ export function serverURLFromOptions(options) {
 export const SDK_METADATA = {
     language: "typescript",
     openapiDocVersion: "1",
-    sdkVersion: "7.1.5",
+    sdkVersion: "7.1.7",
     genVersion: "internal",
-    userAgent: "noresponse-sdk/typescript 7.1.5 internal 1 @noresponse/node",
+    userAgent: "noresponse-sdk/typescript 7.1.7 internal 1 @noresponse/node",
 };
 //# sourceMappingURL=config.js.map

package/dist/esm/models/assessment-request-identifiers.d.ts

@@ -16,7 +16,7 @@ export type AssessmentRequestIdentifiers = {
      */
     phone?: string | undefined;
     /**
-     * The full name as the user typed it, 1 to 128 characters with no control or invisible characters. It is used only to match names in the evidence.
+     * The full name as the user typed it, 1 to 128 characters with no control or invisible characters. It is searched in breach data and matched against names in the evidence. A row holding the signup's own email or username confirms the name; rows sharing another identifier add to the identity's history.
      */
     name?: string | undefined;
     /**

package/dist/esm/models/breach-selector.d.ts

@@ -1,7 +1,7 @@
 import * as z from "zod/v4-mini";
 import { OpenEnum } from "../types/enums.js";
 /**
- * The submitted identifier a breach table matched on: email or username. Phone and name are not breach selectors.
+ * The submitted email or username whose own search matched the table. A submitted full name is searched as well, and what it finds feeds the identity's reasons rather than this list.
  */
 export declare const BreachSelector: {
     readonly Email: "email";
@@ -9,7 +9,7 @@ export declare const BreachSelector: {
     readonly Ip: "ip";
 };
 /**
- * The submitted identifier a breach table matched on: email or username. Phone and name are not breach selectors.
+ * The submitted email or username whose own search matched the table. A submitted full name is searched as well, and what it finds feeds the identity's reasons rather than this list.
  */
 export type BreachSelector = OpenEnum<typeof BreachSelector>;
 /** @internal */

package/dist/esm/models/breach-selector.js

@@ -1,6 +1,6 @@
 import * as openEnums from "../types/enums.js";
 /**
- * The submitted identifier a breach table matched on: email or username. Phone and name are not breach selectors.
+ * The submitted email or username whose own search matched the table. A submitted full name is searched as well, and what it finds feeds the identity's reasons rather than this list.
  */
 export const BreachSelector = {
     Email: "email",

package/dist/esm/models/breach.d.ts

@@ -30,7 +30,7 @@ export type Breach = {
      */
     month?: number | undefined;
     /**
-     * The submitted identifier a breach table matched on: email or username. Phone and name are not breach selectors.
+     * The submitted email or username whose own search matched the table. A submitted full name is searched as well, and what it finds feeds the identity's reasons rather than this list.
      */
     matchedOn: BreachSelector;
     exposed?: Array<BreachExposed> | undefined;

package/dist/esm/models/integration-platform.d.ts

@@ -6,6 +6,7 @@ import { OpenEnum } from "../types/enums.js";
 export declare const IntegrationPlatform: {
     readonly Workos: "workos";
     readonly Auth0: "auth0";
+    readonly Supabase: "supabase";
 };
 /**
  * The authentication provider that calls the endpoint.

package/dist/esm/models/integration-platform.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"integration-platform.d.ts","sourceRoot":"","sources":["../../../src/models/integration-platform.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,CAAC,MAAM,aAAa,CAAC;AAEjC,OAAO,EAAE,QAAQ,EAAE,MAAM,mBAAmB,CAAC;AAE7C;;GAEG;AACH,eAAO,MAAM,mBAAmB;;;CAGtB,CAAC;AACX;;GAEG;AACH,MAAM,MAAM,mBAAmB,GAAG,QAAQ,CAAC,OAAO,mBAAmB,CAAC,CAAC;AAEvE,gBAAgB;AAChB,eAAO,MAAM,iCAAiC,EAAE,CAAC,CAAC,WAAW,CAC3D,mBAAmB,EACnB,OAAO,CACuC,CAAC;AACjD,gBAAgB;AAChB,eAAO,MAAM,kCAAkC,EAAE,CAAC,CAAC,WAAW,CAC5D,MAAM,EACN,mBAAmB,CAC4B,CAAC"}
+{"version":3,"file":"integration-platform.d.ts","sourceRoot":"","sources":["../../../src/models/integration-platform.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,CAAC,MAAM,aAAa,CAAC;AAEjC,OAAO,EAAE,QAAQ,EAAE,MAAM,mBAAmB,CAAC;AAE7C;;GAEG;AACH,eAAO,MAAM,mBAAmB;;;;CAItB,CAAC;AACX;;GAEG;AACH,MAAM,MAAM,mBAAmB,GAAG,QAAQ,CAAC,OAAO,mBAAmB,CAAC,CAAC;AAEvE,gBAAgB;AAChB,eAAO,MAAM,iCAAiC,EAAE,CAAC,CAAC,WAAW,CAC3D,mBAAmB,EACnB,OAAO,CACuC,CAAC;AACjD,gBAAgB;AAChB,eAAO,MAAM,kCAAkC,EAAE,CAAC,CAAC,WAAW,CAC5D,MAAM,EACN,mBAAmB,CAC4B,CAAC"}

package/dist/esm/models/integration-platform.js

@@ -5,6 +5,7 @@ import * as openEnums from "../types/enums.js";
 export const IntegrationPlatform = {
     Workos: "workos",
     Auth0: "auth0",
+    Supabase: "supabase",
 };
 /** @internal */
 export const IntegrationPlatform$inboundSchema = openEnums.inboundSchema(IntegrationPlatform);

package/dist/esm/models/integration-platform.js.map

@@ -1 +1 @@
-{"version":3,"file":"integration-platform.js","sourceRoot":"","sources":["../../../src/models/integration-platform.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,SAAS,MAAM,mBAAmB,CAAC;AAG/C;;GAEG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG;IACjC,MAAM,EAAE,QAAQ;IAChB,KAAK,EAAE,OAAO;CACN,CAAC;AAMX,gBAAgB;AAChB,MAAM,CAAC,MAAM,iCAAiC,GAG1C,SAAS,CAAC,aAAa,CAAC,mBAAmB,CAAC,CAAC;AACjD,gBAAgB;AAChB,MAAM,CAAC,MAAM,kCAAkC,GAG3C,SAAS,CAAC,cAAc,CAAC,mBAAmB,CAAC,CAAC"}
+{"version":3,"file":"integration-platform.js","sourceRoot":"","sources":["../../../src/models/integration-platform.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,SAAS,MAAM,mBAAmB,CAAC;AAG/C;;GAEG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG;IACjC,MAAM,EAAE,QAAQ;IAChB,KAAK,EAAE,OAAO;IACd,QAAQ,EAAE,UAAU;CACZ,CAAC;AAMX,gBAAgB;AAChB,MAAM,CAAC,MAAM,iCAAiC,GAG1C,SAAS,CAAC,aAAa,CAAC,mBAAmB,CAAC,CAAC;AACjD,gBAAgB;AAChB,MAAM,CAAC,MAAM,kCAAkC,GAG3C,SAAS,CAAC,cAAc,CAAC,mBAAmB,CAAC,CAAC"}

package/dist/esm/models/integration-request.d.ts

@@ -2,7 +2,7 @@ import * as z from "zod/v4-mini";
 import { IntegrationHookPoint } from "./integration-hook-point.js";
 import { IntegrationPlatform } from "./integration-platform.js";
 /**
- * POST /v1/integrations body. Registers a hosted endpoint for one authentication provider. The workspace is the API key that signs the request, so the body has no workspace field and refuses one like any other unknown member. A WorkOS integration needs signing_secret, the Actions secret shown in the WorkOS dashboard, which NoResponse uses to verify each Action request and to sign its answer. An Auth0 integration sends no signing_secret: NoResponse generates the shared secret and returns it once.
+ * POST /v1/integrations body. Registers a hosted endpoint for one authentication provider. The workspace is the API key that signs the request, so the body has no workspace field and refuses one like any other unknown member. A WorkOS integration needs signing_secret, the Actions secret shown in the WorkOS dashboard, which NoResponse uses to verify each Action request and to sign its answer. A Supabase integration needs signing_secret, the hook secret Supabase generates for a Before User Created HTTPS hook (v1,whsec_ and base64), which NoResponse uses to verify each call. An Auth0 integration sends no signing_secret: NoResponse generates the shared secret and returns it once.
  */
 export type IntegrationRequest = {
     /**
@@ -10,11 +10,11 @@ export type IntegrationRequest = {
      */
     platform: IntegrationPlatform;
     /**
-     * The provider events the endpoint scores. Default both: pre_registration (WorkOS user registration Action, Auth0 pre-user-registration trigger) and post_login (WorkOS authentication Action, Auth0 post-login trigger). An event that is not listed is answered allow without an assessment.
+     * The provider events the endpoint scores. Default every hook point the platform has: pre_registration (WorkOS user registration Action, Auth0 pre-user-registration trigger, Supabase Before User Created hook) and post_login (WorkOS authentication Action, Auth0 post-login trigger). Supabase has only pre_registration, so a Supabase integration that lists post_login is refused. An event that is not listed is answered allow without an assessment.
      */
     hookPoints?: Array<IntegrationHookPoint> | undefined;
     /**
-     * The WorkOS Actions signing secret, as the WorkOS dashboard shows it: 16 to 256 printable ASCII characters with no spaces. It is stored sealed and is not returned.
+     * The WorkOS Actions signing secret or the Supabase hook secret, as the provider's dashboard shows it: 16 to 256 printable ASCII characters with no spaces. It is stored sealed and is not returned.
      */
     signingSecret?: string | undefined;
 };

package/dist/esm/models/integration-rotation-request.d.ts

@@ -1,10 +1,10 @@
 import * as z from "zod/v4-mini";
 /**
- * POST /v1/integrations/{integration_id}/rotate body. For an Auth0 integration send {}: NoResponse generates a new shared secret and returns it once. For a WorkOS integration send the new signing_secret after regenerating it in the WorkOS dashboard. Either way the previous secret is still accepted for 24 hours, so the provider can be switched over without a refused call.
+ * POST /v1/integrations/{integration_id}/rotate body. For an Auth0 integration send {}: NoResponse generates a new shared secret and returns it once. For a WorkOS or Supabase integration send the new signing_secret after regenerating it in the provider's dashboard. Either way the previous secret is still accepted for 24 hours, so the provider can be switched over without a refused call.
  */
 export type IntegrationRotationRequest = {
     /**
-     * The WorkOS Actions signing secret, as the WorkOS dashboard shows it: 16 to 256 printable ASCII characters with no spaces. It is stored sealed and is not returned.
+     * The WorkOS Actions signing secret or the Supabase hook secret, as the provider's dashboard shows it: 16 to 256 printable ASCII characters with no spaces. It is stored sealed and is not returned.
      */
     signingSecret?: string | undefined;
 };

package/dist/esm/models/reason-code.d.ts

@@ -46,6 +46,12 @@ export declare const ReasonCode: {
     readonly EmailDomainNonexistent: "email_domain_nonexistent";
     readonly ForumSanctioned: "forum_sanctioned";
     readonly PriorPaymentAbuse: "prior_payment_abuse";
+    readonly IpHistoryMatch: "ip_history_match";
+    readonly IdentityAttributeConflict: "identity_attribute_conflict";
+    readonly ImpossibleIdentityAge: "impossible_identity_age";
+    readonly BreachSharedIp: "breach_shared_ip";
+    readonly NationalityMismatch: "nationality_mismatch";
+    readonly MinorIdentity: "minor_identity";
 };
 /**
  * A stable reason code. New codes may appear; ignore any you do not know.

package/dist/esm/models/reason-code.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"reason-code.d.ts","sourceRoot":"","sources":["../../../src/models/reason-code.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,CAAC,MAAM,aAAa,CAAC;AAEjC,OAAO,EAAE,QAAQ,EAAE,MAAM,mBAAmB,CAAC;AAE7C;;GAEG;AACH,eAAO,MAAM,UAAU;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA2Cb,CAAC;AACX;;GAEG;AACH,MAAM,MAAM,UAAU,GAAG,QAAQ,CAAC,OAAO,UAAU,CAAC,CAAC;AAErD,gBAAgB;AAChB,eAAO,MAAM,wBAAwB,EAAE,CAAC,CAAC,WAAW,CAAC,UAAU,EAAE,OAAO,CACnC,CAAC;AACtC,gBAAgB;AAChB,eAAO,MAAM,yBAAyB,EAAE,CAAC,CAAC,WAAW,CAAC,MAAM,EAAE,UAAU,CAClC,CAAC"}
+{"version":3,"file":"reason-code.d.ts","sourceRoot":"","sources":["../../../src/models/reason-code.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,CAAC,MAAM,aAAa,CAAC;AAEjC,OAAO,EAAE,QAAQ,EAAE,MAAM,mBAAmB,CAAC;AAE7C;;GAEG;AACH,eAAO,MAAM,UAAU;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAiDb,CAAC;AACX;;GAEG;AACH,MAAM,MAAM,UAAU,GAAG,QAAQ,CAAC,OAAO,UAAU,CAAC,CAAC;AAErD,gBAAgB;AAChB,eAAO,MAAM,wBAAwB,EAAE,CAAC,CAAC,WAAW,CAAC,UAAU,EAAE,OAAO,CACnC,CAAC;AACtC,gBAAgB;AAChB,eAAO,MAAM,yBAAyB,EAAE,CAAC,CAAC,WAAW,CAAC,MAAM,EAAE,UAAU,CAClC,CAAC"}

package/dist/esm/models/reason-code.js

@@ -45,6 +45,12 @@ export const ReasonCode = {
     EmailDomainNonexistent: "email_domain_nonexistent",
     ForumSanctioned: "forum_sanctioned",
     PriorPaymentAbuse: "prior_payment_abuse",
+    IpHistoryMatch: "ip_history_match",
+    IdentityAttributeConflict: "identity_attribute_conflict",
+    ImpossibleIdentityAge: "impossible_identity_age",
+    BreachSharedIp: "breach_shared_ip",
+    NationalityMismatch: "nationality_mismatch",
+    MinorIdentity: "minor_identity",
 };
 /** @internal */
 export const ReasonCode$inboundSchema = openEnums.inboundSchema(ReasonCode);

package/dist/esm/models/reason-code.js.map

@@ -1 +1 @@
-{"version":3,"file":"reason-code.js","sourceRoot":"","sources":["../../../src/models/reason-code.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,SAAS,MAAM,mBAAmB,CAAC;AAG/C;;GAEG;AACH,MAAM,CAAC,MAAM,UAAU,GAAG;IACxB,kBAAkB,EAAE,sBAAsB;IAC1C,UAAU,EAAE,aAAa;IACzB,eAAe,EAAE,kBAAkB;IACnC,QAAQ,EAAE,WAAW;IACrB,WAAW,EAAE,cAAc;IAC3B,SAAS,EAAE,YAAY;IACvB,gBAAgB,EAAE,mBAAmB;IACrC,eAAe,EAAE,kBAAkB;IACnC,OAAO,EAAE,UAAU;IACnB,UAAU,EAAE,aAAa;IACzB,QAAQ,EAAE,WAAW;IACrB,kBAAkB,EAAE,sBAAsB;IAC1C,mBAAmB,EAAE,sBAAsB;IAC3C,YAAY,EAAE,eAAe;IAC7B,eAAe,EAAE,mBAAmB;IACpC,kBAAkB,EAAE,qBAAqB;IACzC,kBAAkB,EAAE,sBAAsB;IAC1C,mBAAmB,EAAE,uBAAuB;IAC5C,sBAAsB,EAAE,0BAA0B;IAClD,sBAAsB,EAAE,0BAA0B;IAClD,oBAAoB,EAAE,wBAAwB;IAC9C,eAAe,EAAE,mBAAmB;IACpC,oBAAoB,EAAE,wBAAwB;IAC9C,eAAe,EAAE,mBAAmB;IACpC,eAAe,EAAE,mBAAmB;IACpC,iBAAiB,EAAE,qBAAqB;IACxC,iBAAiB,EAAE,qBAAqB;IACxC,aAAa,EAAE,iBAAiB;IAChC,cAAc,EAAE,kBAAkB;IAClC,cAAc,EAAE,kBAAkB;IAClC,gBAAgB,EAAE,mBAAmB;IACrC,uBAAuB,EAAE,2BAA2B;IACpD,qBAAqB,EAAE,yBAAyB;IAChD,0BAA0B,EAAE,+BAA+B;IAC3D,cAAc,EAAE,kBAAkB;IAClC,YAAY,EAAE,eAAe;IAC7B,YAAY,EAAE,gBAAgB;IAC9B,gBAAgB,EAAE,oBAAoB;IACtC,eAAe,EAAE,oBAAoB;IACrC,sBAAsB,EAAE,0BAA0B;IAClD,eAAe,EAAE,kBAAkB;IACnC,iBAAiB,EAAE,qBAAqB;CAChC,CAAC;AAMX,gBAAgB;AAChB,MAAM,CAAC,MAAM,wBAAwB,GACnC,SAAS,CAAC,aAAa,CAAC,UAAU,CAAC,CAAC;AACtC,gBAAgB;AAChB,MAAM,CAAC,MAAM,yBAAyB,GACpC,SAAS,CAAC,cAAc,CAAC,UAAU,CAAC,CAAC"}
+{"version":3,"file":"reason-code.js","sourceRoot":"","sources":["../../../src/models/reason-code.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,SAAS,MAAM,mBAAmB,CAAC;AAG/C;;GAEG;AACH,MAAM,CAAC,MAAM,UAAU,GAAG;IACxB,kBAAkB,EAAE,sBAAsB;IAC1C,UAAU,EAAE,aAAa;IACzB,eAAe,EAAE,kBAAkB;IACnC,QAAQ,EAAE,WAAW;IACrB,WAAW,EAAE,cAAc;IAC3B,SAAS,EAAE,YAAY;IACvB,gBAAgB,EAAE,mBAAmB;IACrC,eAAe,EAAE,kBAAkB;IACnC,OAAO,EAAE,UAAU;IACnB,UAAU,EAAE,aAAa;IACzB,QAAQ,EAAE,WAAW;IACrB,kBAAkB,EAAE,sBAAsB;IAC1C,mBAAmB,EAAE,sBAAsB;IAC3C,YAAY,EAAE,eAAe;IAC7B,eAAe,EAAE,mBAAmB;IACpC,kBAAkB,EAAE,qBAAqB;IACzC,kBAAkB,EAAE,sBAAsB;IAC1C,mBAAmB,EAAE,uBAAuB;IAC5C,sBAAsB,EAAE,0BAA0B;IAClD,sBAAsB,EAAE,0BAA0B;IAClD,oBAAoB,EAAE,wBAAwB;IAC9C,eAAe,EAAE,mBAAmB;IACpC,oBAAoB,EAAE,wBAAwB;IAC9C,eAAe,EAAE,mBAAmB;IACpC,eAAe,EAAE,mBAAmB;IACpC,iBAAiB,EAAE,qBAAqB;IACxC,iBAAiB,EAAE,qBAAqB;IACxC,aAAa,EAAE,iBAAiB;IAChC,cAAc,EAAE,kBAAkB;IAClC,cAAc,EAAE,kBAAkB;IAClC,gBAAgB,EAAE,mBAAmB;IACrC,uBAAuB,EAAE,2BAA2B;IACpD,qBAAqB,EAAE,yBAAyB;IAChD,0BAA0B,EAAE,+BAA+B;IAC3D,cAAc,EAAE,kBAAkB;IAClC,YAAY,EAAE,eAAe;IAC7B,YAAY,EAAE,gBAAgB;IAC9B,gBAAgB,EAAE,oBAAoB;IACtC,eAAe,EAAE,oBAAoB;IACrC,sBAAsB,EAAE,0BAA0B;IAClD,eAAe,EAAE,kBAAkB;IACnC,iBAAiB,EAAE,qBAAqB;IACxC,cAAc,EAAE,kBAAkB;IAClC,yBAAyB,EAAE,6BAA6B;IACxD,qBAAqB,EAAE,yBAAyB;IAChD,cAAc,EAAE,kBAAkB;IAClC,mBAAmB,EAAE,sBAAsB;IAC3C,aAAa,EAAE,gBAAgB;CACvB,CAAC;AAMX,gBAAgB;AAChB,MAAM,CAAC,MAAM,wBAAwB,GACnC,SAAS,CAAC,aAAa,CAAC,UAAU,CAAC,CAAC;AACtC,gBAAgB;AAChB,MAAM,CAAC,MAAM,yBAAyB,GACpC,SAAS,CAAC,cAAc,CAAC,UAAU,CAAC,CAAC"}

package/dist/esm/sdk/integrations.d.ts

@@ -6,7 +6,7 @@ export declare class Integrations extends ClientSDK {
      * Register a hosted provider integration.
      *
      * @remarks
-     * Registers a WorkOS or Auth0 integration and returns its hosted endpoint, url, so a sign-up or sign-in is scored with no server of your own. For WorkOS, send the Actions signing secret from the WorkOS dashboard and point the user registration and authentication Actions at url. For Auth0, the answer's secret is the shared secret of the NoResponse Auth0 Action, shown once: store it as an Action secret. hook_points defaults to both pre_registration and post_login; an event that is not listed is allowed without an assessment. The endpoint waits for the full assessment for at most 2.5 seconds (WorkOS) or 4.5 seconds (Auth0), denies only when risk.block is true and allows on any failure. Requires the integrations scope; at most 10 per account. Not idempotent: a retry after a lost answer registers another integration.
+     * Registers a WorkOS, Auth0 or Supabase integration and returns its hosted endpoint, url, so a sign-up or sign-in is scored with no server of your own. For WorkOS, send the Actions signing secret from the WorkOS dashboard and point the user registration and authentication Actions at url. For Supabase, send the hook secret Supabase generates (v1,whsec_...) and set url as the Before User Created hook's HTTPS endpoint. For Auth0, the answer's secret is the shared secret of the NoResponse Auth0 Action, shown once: store it as an Action secret. hook_points defaults to every hook point the platform has (Supabase has only pre_registration); an event that is not listed is allowed without an assessment. The endpoint waits for the full assessment for at most 2.5 seconds (WorkOS, Supabase) or 4.5 seconds (Auth0), denies only when risk.block is true and allows on any failure. Requires the integrations scope; at most 10 per account. Not idempotent: a retry after a lost answer registers another integration.
      */
     create(request: models.IntegrationRequest, options?: RequestOptions): Promise<operations.CreateIntegrationResponse>;
     /**
@@ -27,7 +27,7 @@ export declare class Integrations extends ClientSDK {
      * Replace an integration's secret.
      *
      * @remarks
-     * For Auth0, send {} and the answer's secret is the new shared secret, shown once. For WorkOS, regenerate the Actions secret in the WorkOS dashboard and send it as signing_secret. The replaced secret is still accepted for 24 hours (previous_secret_expires_at). Requires the integrations scope. Not idempotent: a retry after a lost answer rotates again.
+     * For Auth0, send {} and the answer's secret is the new shared secret, shown once. For WorkOS, regenerate the Actions secret in the WorkOS dashboard and send it as signing_secret; for Supabase, generate a new hook secret in the Supabase dashboard and send it as signing_secret. The replaced secret is still accepted for 24 hours (previous_secret_expires_at). Requires the integrations scope. Not idempotent: a retry after a lost answer rotates again.
      */
     rotate(request: operations.RotateIntegrationSecretRequest, options?: RequestOptions): Promise<operations.RotateIntegrationSecretResponse>;
 }

package/dist/esm/sdk/integrations.js

@@ -9,7 +9,7 @@ export class Integrations extends ClientSDK {
      * Register a hosted provider integration.
      *
      * @remarks
-     * Registers a WorkOS or Auth0 integration and returns its hosted endpoint, url, so a sign-up or sign-in is scored with no server of your own. For WorkOS, send the Actions signing secret from the WorkOS dashboard and point the user registration and authentication Actions at url. For Auth0, the answer's secret is the shared secret of the NoResponse Auth0 Action, shown once: store it as an Action secret. hook_points defaults to both pre_registration and post_login; an event that is not listed is allowed without an assessment. The endpoint waits for the full assessment for at most 2.5 seconds (WorkOS) or 4.5 seconds (Auth0), denies only when risk.block is true and allows on any failure. Requires the integrations scope; at most 10 per account. Not idempotent: a retry after a lost answer registers another integration.
+     * Registers a WorkOS, Auth0 or Supabase integration and returns its hosted endpoint, url, so a sign-up or sign-in is scored with no server of your own. For WorkOS, send the Actions signing secret from the WorkOS dashboard and point the user registration and authentication Actions at url. For Supabase, send the hook secret Supabase generates (v1,whsec_...) and set url as the Before User Created hook's HTTPS endpoint. For Auth0, the answer's secret is the shared secret of the NoResponse Auth0 Action, shown once: store it as an Action secret. hook_points defaults to every hook point the platform has (Supabase has only pre_registration); an event that is not listed is allowed without an assessment. The endpoint waits for the full assessment for at most 2.5 seconds (WorkOS, Supabase) or 4.5 seconds (Auth0), denies only when risk.block is true and allows on any failure. Requires the integrations scope; at most 10 per account. Not idempotent: a retry after a lost answer registers another integration.
      */
     async create(request, options) {
         return unwrapAsync(integrationsCreate(this, request, options));
@@ -36,7 +36,7 @@ export class Integrations extends ClientSDK {
      * Replace an integration's secret.
      *
      * @remarks
-     * For Auth0, send {} and the answer's secret is the new shared secret, shown once. For WorkOS, regenerate the Actions secret in the WorkOS dashboard and send it as signing_secret. The replaced secret is still accepted for 24 hours (previous_secret_expires_at). Requires the integrations scope. Not idempotent: a retry after a lost answer rotates again.
+     * For Auth0, send {} and the answer's secret is the new shared secret, shown once. For WorkOS, regenerate the Actions secret in the WorkOS dashboard and send it as signing_secret; for Supabase, generate a new hook secret in the Supabase dashboard and send it as signing_secret. The replaced secret is still accepted for 24 hours (previous_secret_expires_at). Requires the integrations scope. Not idempotent: a retry after a lost answer rotates again.
      */
     async rotate(request, options) {
         return unwrapAsync(integrationsRotate(this, request, options));

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@noresponse/node",
-  "version": "7.1.5",
+  "version": "7.1.7",
   "author": "NoResponse",
   "bugs": {
     "url": "https://github.com/noresponsehq/node/issues"