@atlasauth/backend 0.1.0

package/dist/client/actions.d.ts

@@ -0,0 +1,86 @@
+import { type RequestFn } from './request';
+import type { ListPage } from './types';
+/** The fixed point in the auth pipeline an action runs at. */
+export type ActionTrigger = 'post_login' | 'pre_user_registration' | 'post_user_registration';
+/**
+ * Tenant code run in the hardened isolate at a trigger. Secret VALUES are
+ * write-only and never returned — a read reports only `secret_names`. Timestamps
+ * are epoch milliseconds.
+ */
+export interface Action {
+    object: 'action';
+    id: string;
+    name: string;
+    trigger: ActionTrigger;
+    code: string;
+    runtime: string;
+    enabled: boolean;
+    secret_names: string[];
+    created_at: number;
+    updated_at: number;
+}
+export interface CreateActionBody {
+    name: string;
+    trigger: ActionTrigger;
+    code: string;
+    enabled?: boolean;
+    /** Write-only, encrypted at rest, never read back. */
+    secrets?: Record<string, string>;
+}
+export interface UpdateActionBody {
+    name?: string;
+    code?: string;
+    enabled?: boolean;
+    secrets?: Record<string, string>;
+}
+/** The sample event a dry-run runs against; every field has a stand-in default. */
+export interface ActionTestEvent {
+    user?: {
+        id?: string;
+        email?: string;
+        emailVerified?: boolean;
+        metadata?: Record<string, unknown>;
+    };
+    connection?: {
+        strategy?: string;
+    };
+    request?: {
+        ip?: string;
+        user_agent?: string;
+    };
+}
+/** What an action produced against a sample event — no real data is touched. */
+export interface ActionTestResult {
+    object: 'action_test_result';
+    id: string;
+    denied: boolean;
+    deny_reason: string | null;
+    access_token_claims: Record<string, unknown>;
+    id_token_claims: Record<string, unknown>;
+    app_metadata: Record<string, unknown>;
+    logs: string[];
+    error: string | null;
+}
+/** The ordered binding list for a trigger, replaced atomically as a set. */
+export interface ActionBindingList {
+    object: 'action_binding_list';
+    trigger: ActionTrigger;
+    action_ids: string[];
+}
+export declare function actionsResource(request: RequestFn): {
+    list(): Promise<ListPage<Action>>;
+    create(body: CreateActionBody, idempotencyKey?: string): Promise<Action>;
+    get(id: string): Promise<Action>;
+    update(id: string, body: UpdateActionBody): Promise<Action>;
+    delete(id: string): Promise<{
+        object: "action";
+        id: string;
+        deleted: true;
+    }>;
+    /** Dry-run against a sample event in the sandbox; nothing is persisted. */
+    test(id: string, event?: ActionTestEvent): Promise<ActionTestResult>;
+    /** The actions bound to a trigger, in run order. */
+    getBindings(trigger: ActionTrigger): Promise<ActionBindingList>;
+    /** Replace a trigger's ordered binding set. */
+    setBindings(trigger: ActionTrigger, actionIds: string[]): Promise<ActionBindingList>;
+};

package/dist/client/actions.js

@@ -0,0 +1,40 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.actionsResource = actionsResource;
+const request_1 = require("./request");
+function actionsResource(request) {
+    return {
+        list() {
+            return request({ method: 'GET', path: '/v1/actions' });
+        },
+        create(body, idempotencyKey) {
+            return request({ method: 'POST', path: '/v1/actions', body, idempotencyKey });
+        },
+        get(id) {
+            return request({ method: 'GET', path: `/v1/actions/${(0, request_1.enc)(id)}` });
+        },
+        update(id, body) {
+            return request({ method: 'PATCH', path: `/v1/actions/${(0, request_1.enc)(id)}`, body });
+        },
+        delete(id) {
+            return request({ method: 'DELETE', path: `/v1/actions/${(0, request_1.enc)(id)}` });
+        },
+        /** Dry-run against a sample event in the sandbox; nothing is persisted. */
+        test(id, event = {}) {
+            return request({ method: 'POST', path: `/v1/actions/${(0, request_1.enc)(id)}/test`, body: { event } });
+        },
+        /** The actions bound to a trigger, in run order. */
+        getBindings(trigger) {
+            return request({ method: 'GET', path: `/v1/actions/bindings/${(0, request_1.enc)(trigger)}` });
+        },
+        /** Replace a trigger's ordered binding set. */
+        setBindings(trigger, actionIds) {
+            return request({
+                method: 'PUT',
+                path: `/v1/actions/bindings/${(0, request_1.enc)(trigger)}`,
+                body: { action_ids: actionIds },
+            });
+        },
+    };
+}
+//# sourceMappingURL=actions.js.map

package/dist/client/actions.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"actions.js","sourceRoot":"","sources":["../../src/client/actions.ts"],"names":[],"mappings":";;AAwEA,0CAkCC;AA1GD,uCAAgD;AAwEhD,SAAgB,eAAe,CAAC,OAAkB;IAChD,OAAO;QACL,IAAI;YACF,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,aAAa,EAAE,CAAC,CAAC;QACzD,CAAC;QACD,MAAM,CAAC,IAAsB,EAAE,cAAuB;YACpD,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,aAAa,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC;QAChF,CAAC;QACD,GAAG,CAAC,EAAU;YACZ,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,eAAe,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;QACpE,CAAC;QACD,MAAM,CAAC,EAAU,EAAE,IAAsB;YACvC,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,eAAe,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;QAC5E,CAAC;QACD,MAAM,CAAC,EAAU;YACf,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,eAAe,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;QACvE,CAAC;QACD,2EAA2E;QAC3E,IAAI,CAAC,EAAU,EAAE,QAAyB,EAAE;YAC1C,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,eAAe,IAAA,aAAG,EAAC,EAAE,CAAC,OAAO,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC;QAC3F,CAAC;QACD,oDAAoD;QACpD,WAAW,CAAC,OAAsB;YAChC,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,wBAAwB,IAAA,aAAG,EAAC,OAAO,CAAC,EAAE,EAAE,CAAC,CAAC;QAClF,CAAC;QACD,+CAA+C;QAC/C,WAAW,CAAC,OAAsB,EAAE,SAAmB;YACrD,OAAO,OAAO,CAAC;gBACb,MAAM,EAAE,KAAK;gBACb,IAAI,EAAE,wBAAwB,IAAA,aAAG,EAAC,OAAO,CAAC,EAAE;gBAC5C,IAAI,EAAE,EAAE,UAAU,EAAE,SAAS,EAAE;aAChC,CAAC,CAAC;QACL,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/client/actor-tokens.d.ts

@@ -0,0 +1,28 @@
+import { type RequestFn } from './request';
+export interface ActorToken {
+    object: 'actor_token';
+    id: string;
+    user_id: string;
+    actor: {
+        sub: string;
+    };
+    /** The one-time opaque secret, revealed once. */
+    token: string;
+    expires_in: number;
+}
+export interface CreateActorTokenBody {
+    user_id: string;
+    actor: {
+        sub: string;
+    };
+    /** Clamped server-side to [1, 3600]; defaults to 60. */
+    expires_in_seconds?: number;
+}
+export declare function actorTokensResource(request: RequestFn): {
+    create(body: CreateActorTokenBody, idempotencyKey?: string): Promise<ActorToken>;
+    revoke(id: string): Promise<{
+        object: "actor_token";
+        id: string;
+        revoked: true;
+    }>;
+};

package/dist/client/actor-tokens.js

@@ -0,0 +1,15 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.actorTokensResource = actorTokensResource;
+const request_1 = require("./request");
+function actorTokensResource(request) {
+    return {
+        create(body, idempotencyKey) {
+            return request({ method: 'POST', path: '/v1/actor_tokens', body, idempotencyKey });
+        },
+        revoke(id) {
+            return request({ method: 'POST', path: `/v1/actor_tokens/${(0, request_1.enc)(id)}/revoke` });
+        },
+    };
+}
+//# sourceMappingURL=actor-tokens.js.map

package/dist/client/actor-tokens.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"actor-tokens.js","sourceRoot":"","sources":["../../src/client/actor-tokens.ts"],"names":[],"mappings":";;AAmBA,kDASC;AA5BD,uCAAgD;AAmBhD,SAAgB,mBAAmB,CAAC,OAAkB;IACpD,OAAO;QACL,MAAM,CAAC,IAA0B,EAAE,cAAuB;YACxD,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,kBAAkB,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC;QACrF,CAAC;QACD,MAAM,CAAC,EAAU;YACf,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,oBAAoB,IAAA,aAAG,EAAC,EAAE,CAAC,SAAS,EAAE,CAAC,CAAC;QACjF,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/client/api-keys.d.ts

@@ -0,0 +1,77 @@
+import { type RequestFn } from './request';
+import type { ListPage } from './types';
+export type ApiKeySubjectType = 'user' | 'organization';
+/**
+ * An end-user API key — Clerk `api_keys` parity. A tenant mints these for ITS OWN
+ * users/organizations and later asks Atlas to {@link ApiKeysResource.verify} one a
+ * subject presented. Only a hash is stored, so the `ak_` secret is shown exactly
+ * once at mint (see {@link ApiKeyWithSecret}); a read reports only the `prefix`.
+ */
+export interface ApiKey {
+    object: 'api_key';
+    id: string;
+    subject_type: ApiKeySubjectType;
+    subject_id: string;
+    name: string | null;
+    /** Enough to tell two keys apart in a listing; not enough to use one. */
+    prefix: string;
+    claims: Record<string, unknown>;
+    last_used_at: number | null;
+    expires_at: number | null;
+    revoked_at: number | null;
+    created_at: number;
+}
+/** The mint response: the key plus its secret, revealed exactly once. */
+export interface ApiKeyWithSecret extends ApiKey {
+    secret: string;
+    note: string;
+}
+export interface CreateApiKeyBody {
+    subject_type: ApiKeySubjectType;
+    subject_id: string;
+    name?: string;
+    claims?: Record<string, unknown>;
+    /** Epoch ms; null (or omitted) never expires. */
+    expires_at?: number | null;
+}
+export interface UpdateApiKeyBody {
+    name?: string | null;
+    claims?: Record<string, unknown>;
+    expires_at?: number | null;
+}
+/**
+ * The verify verdict. Every negative — unknown, malformed, revoked, expired, or a
+ * key whose subject was since deleted — resolves to the SAME `{ valid: false }`,
+ * so a caller learns nothing about which keys exist.
+ */
+export type ApiKeyVerification = {
+    object: 'api_key_verification';
+    valid: false;
+} | {
+    object: 'api_key_verification';
+    valid: true;
+    id: string;
+    subject_type: ApiKeySubjectType;
+    subject_id: string;
+    claims: Record<string, unknown>;
+    last_used_at: number | null;
+};
+export declare function apiKeysResource(request: RequestFn): {
+    /** Optionally narrowed to one subject. */
+    list(query?: {
+        subject_type?: ApiKeySubjectType;
+        subject_id?: string;
+    }): Promise<ListPage<ApiKey>>;
+    /** Mint a key. The secret is returned once, here. */
+    create(body: CreateApiKeyBody, idempotencyKey?: string): Promise<ApiKeyWithSecret>;
+    /** Check a presented secret. Rate-limited — it is an online credential check. */
+    verify(secret: string): Promise<ApiKeyVerification>;
+    get(id: string): Promise<ApiKey>;
+    update(id: string, body: UpdateApiKeyBody): Promise<ApiKey>;
+    /** Revoke a key. It stays queryable but never authenticates again. */
+    delete(id: string): Promise<{
+        object: "api_key";
+        id: string;
+        revoked: true;
+    }>;
+};

package/dist/client/api-keys.js

@@ -0,0 +1,31 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.apiKeysResource = apiKeysResource;
+const request_1 = require("./request");
+function apiKeysResource(request) {
+    return {
+        /** Optionally narrowed to one subject. */
+        list(query) {
+            return request({ method: 'GET', path: '/v1/api_keys', query });
+        },
+        /** Mint a key. The secret is returned once, here. */
+        create(body, idempotencyKey) {
+            return request({ method: 'POST', path: '/v1/api_keys', body, idempotencyKey });
+        },
+        /** Check a presented secret. Rate-limited — it is an online credential check. */
+        verify(secret) {
+            return request({ method: 'POST', path: '/v1/api_keys/verify', body: { secret } });
+        },
+        get(id) {
+            return request({ method: 'GET', path: `/v1/api_keys/${(0, request_1.enc)(id)}` });
+        },
+        update(id, body) {
+            return request({ method: 'PATCH', path: `/v1/api_keys/${(0, request_1.enc)(id)}`, body });
+        },
+        /** Revoke a key. It stays queryable but never authenticates again. */
+        delete(id) {
+            return request({ method: 'DELETE', path: `/v1/api_keys/${(0, request_1.enc)(id)}` });
+        },
+    };
+}
+//# sourceMappingURL=api-keys.js.map

package/dist/client/api-keys.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"api-keys.js","sourceRoot":"","sources":["../../src/client/api-keys.ts"],"names":[],"mappings":";;AAgEA,0CA4BC;AA5FD,uCAAgD;AAgEhD,SAAgB,eAAe,CAAC,OAAkB;IAChD,OAAO;QACL,0CAA0C;QAC1C,IAAI,CAAC,KAGJ;YACC,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,cAAc,EAAE,KAAK,EAAE,CAAC,CAAC;QACjE,CAAC;QACD,qDAAqD;QACrD,MAAM,CAAC,IAAsB,EAAE,cAAuB;YACpD,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,cAAc,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC;QACjF,CAAC;QACD,iFAAiF;QACjF,MAAM,CAAC,MAAc;YACnB,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,qBAAqB,EAAE,IAAI,EAAE,EAAE,MAAM,EAAE,EAAE,CAAC,CAAC;QACpF,CAAC;QACD,GAAG,CAAC,EAAU;YACZ,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,gBAAgB,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;QACrE,CAAC;QACD,MAAM,CAAC,EAAU,EAAE,IAAsB;YACvC,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,gBAAgB,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;QAC7E,CAAC;QACD,sEAAsE;QACtE,MAAM,CAAC,EAAU;YACf,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,gBAAgB,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;QACxE,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/client/attack-protection.d.ts

@@ -0,0 +1,41 @@
+import type { RequestFn } from './request';
+export interface AttackProtection {
+    object: 'attack_protection';
+    brute_force: {
+        enabled: boolean;
+        tiers: Array<{
+            threshold: number;
+            window_ms: number;
+            lock_ms: number;
+            notify_user: boolean;
+            flag_for_admin: boolean;
+        }>;
+    };
+    breached_password: {
+        enabled: boolean;
+    };
+    suspicious_ip: {
+        enabled: boolean;
+        ip_allowlist: string[];
+        managed_by: 'dashboard_security';
+    };
+    captcha: {
+        provider: string;
+        site_key_set: boolean;
+        secret_set: boolean;
+        managed_by: 'auth_config_and_captcha_secret';
+    };
+}
+/** Only the two flags are writable; the rest of the object is read-only. */
+export interface UpdateAttackProtectionBody {
+    brute_force?: {
+        enabled?: boolean;
+    };
+    breached_password?: {
+        enabled?: boolean;
+    };
+}
+export declare function attackProtectionResource(request: RequestFn): {
+    get(): Promise<AttackProtection>;
+    update(body: UpdateAttackProtectionBody): Promise<AttackProtection>;
+};

package/dist/client/attack-protection.js

@@ -0,0 +1,14 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.attackProtectionResource = attackProtectionResource;
+function attackProtectionResource(request) {
+    return {
+        get() {
+            return request({ method: 'GET', path: '/v1/attack_protection' });
+        },
+        update(body) {
+            return request({ method: 'PATCH', path: '/v1/attack_protection', body });
+        },
+    };
+}
+//# sourceMappingURL=attack-protection.js.map

package/dist/client/attack-protection.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"attack-protection.js","sourceRoot":"","sources":["../../src/client/attack-protection.ts"],"names":[],"mappings":";;AAkCA,4DASC;AATD,SAAgB,wBAAwB,CAAC,OAAkB;IACzD,OAAO;QACL,GAAG;YACD,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,uBAAuB,EAAE,CAAC,CAAC;QACnE,CAAC;QACD,MAAM,CAAC,IAAgC;YACrC,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,uBAAuB,EAAE,IAAI,EAAE,CAAC,CAAC;QAC3E,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/client/audit-logs.d.ts

@@ -0,0 +1,20 @@
+import type { RequestFn } from './request';
+import type { CursorPage, CursorParams } from './types';
+export interface AuditLog {
+    object: 'audit_log';
+    id: string;
+    actor_type: string;
+    actor_id: string | null;
+    action: string;
+    target_type: string | null;
+    target_id: string | null;
+    metadata: Record<string, unknown> | null;
+    created_at: number;
+}
+export interface ListAuditLogsParams extends CursorParams {
+    actor_id?: string;
+    action?: string;
+}
+export declare function auditLogsResource(request: RequestFn): {
+    list(params?: ListAuditLogsParams): Promise<CursorPage<AuditLog>>;
+};

package/dist/client/audit-logs.js

@@ -0,0 +1,11 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.auditLogsResource = auditLogsResource;
+function auditLogsResource(request) {
+    return {
+        list(params = {}) {
+            return request({ method: 'GET', path: '/v1/audit_logs', query: { ...params } });
+        },
+    };
+}
+//# sourceMappingURL=audit-logs.js.map

package/dist/client/audit-logs.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"audit-logs.js","sourceRoot":"","sources":["../../src/client/audit-logs.ts"],"names":[],"mappings":";;AAoBA,8CAMC;AAND,SAAgB,iBAAiB,CAAC,OAAkB;IAClD,OAAO;QACL,IAAI,CAAC,SAA8B,EAAE;YACnC,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,gBAAgB,EAAE,KAAK,EAAE,EAAE,GAAG,MAAM,EAAE,EAAE,CAAC,CAAC;QAClF,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/client/billing-plans.d.ts

@@ -0,0 +1,81 @@
+import { type RequestFn } from './request';
+import type { ListPage } from './types';
+/**
+ * A plan a tenant defines for their app's users. `stripe_price_id` is the
+ * recurring price a subscriber is charged; `features` are the keys the plan
+ * grants, surfaced to the end user as the `fea` session claim.
+ */
+export interface BillingPlan {
+    object: 'billing_plan';
+    id: string;
+    name: string;
+    slug: string;
+    stripe_price_id: string;
+    interval: string;
+    amount: string | null;
+    currency: string;
+    features: string[];
+    audience: string;
+    active: boolean;
+    created_at: number;
+    updated_at: number;
+}
+/**
+ * A read view of who is subscribed. `status` is written ONLY by the verified
+ * Stripe webhook, never through this SDK.
+ */
+export interface BillingSubscription {
+    object: 'billing_subscription';
+    id: string;
+    subject_type: string;
+    subject_id: string;
+    plan_id: string;
+    status: string;
+    stripe_subscription_id: string | null;
+    stripe_customer_id: string | null;
+    current_period_end: number | null;
+    created_at: number;
+    updated_at: number;
+}
+export interface CreateBillingPlanBody {
+    name: string;
+    slug: string;
+    stripe_price_id: string;
+    /** One of `month`, `year`. Defaults to `month`. */
+    interval?: string;
+    amount?: string;
+    currency?: string;
+    features?: string[];
+    /** One of `user`, `org`. Defaults to `user`. */
+    audience?: string;
+    active?: boolean;
+}
+export interface UpdateBillingPlanBody {
+    name?: string;
+    slug?: string;
+    stripe_price_id?: string;
+    interval?: string;
+    amount?: string;
+    currency?: string;
+    features?: string[];
+    audience?: string;
+    active?: boolean;
+}
+/** Filter the subscription read view to one subject. */
+export interface ListSubscriptionsParams {
+    /** One of `user`, `org`. */
+    subject_type?: string;
+    subject_id?: string;
+}
+export declare function billingResource(request: RequestFn): {
+    listPlans(): Promise<ListPage<BillingPlan>>;
+    createPlan(body: CreateBillingPlanBody, idempotencyKey?: string): Promise<BillingPlan>;
+    getPlan(id: string): Promise<BillingPlan>;
+    updatePlan(id: string, body: UpdateBillingPlanBody): Promise<BillingPlan>;
+    deletePlan(id: string): Promise<{
+        object: "billing_plan";
+        id: string;
+        deleted: true;
+    }>;
+    listSubscriptions(params?: ListSubscriptionsParams): Promise<ListPage<BillingSubscription>>;
+};

package/dist/client/billing-plans.js

@@ -0,0 +1,27 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.billingResource = billingResource;
+const request_1 = require("./request");
+function billingResource(request) {
+    return {
+        listPlans() {
+            return request({ method: 'GET', path: '/v1/billing/plans' });
+        },
+        createPlan(body, idempotencyKey) {
+            return request({ method: 'POST', path: '/v1/billing/plans', body, idempotencyKey });
+        },
+        getPlan(id) {
+            return request({ method: 'GET', path: `/v1/billing/plans/${(0, request_1.enc)(id)}` });
+        },
+        updatePlan(id, body) {
+            return request({ method: 'PATCH', path: `/v1/billing/plans/${(0, request_1.enc)(id)}`, body });
+        },
+        deletePlan(id) {
+            return request({ method: 'DELETE', path: `/v1/billing/plans/${(0, request_1.enc)(id)}` });
+        },
+        listSubscriptions(params) {
+            return request({ method: 'GET', path: '/v1/billing/subscriptions', query: { ...params } });
+        },
+    };
+}
+//# sourceMappingURL=billing-plans.js.map

package/dist/client/billing-plans.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"billing-plans.js","sourceRoot":"","sources":["../../src/client/billing-plans.ts"],"names":[],"mappings":";;AA2EA,0CAqBC;AAhGD,uCAAgD;AA2EhD,SAAgB,eAAe,CAAC,OAAkB;IAChD,OAAO;QACL,SAAS;YACP,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,mBAAmB,EAAE,CAAC,CAAC;QAC/D,CAAC;QACD,UAAU,CAAC,IAA2B,EAAE,cAAuB;YAC7D,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,mBAAmB,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC;QACtF,CAAC;QACD,OAAO,CAAC,EAAU;YAChB,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,qBAAqB,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;QAC1E,CAAC;QACD,UAAU,CAAC,EAAU,EAAE,IAA2B;YAChD,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,qBAAqB,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;QAClF,CAAC;QACD,UAAU,CAAC,EAAU;YACnB,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,qBAAqB,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;QAC7E,CAAC;QACD,iBAAiB,CAAC,MAAgC;YAChD,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,2BAA2B,EAAE,KAAK,EAAE,EAAE,GAAG,MAAM,EAAE,EAAE,CAAC,CAAC;QAC7F,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/client/bot-signals.d.ts

@@ -0,0 +1,88 @@
+import { type RequestFn } from './request';
+/**
+ * One append-only row of the anti-bot signal lake: a fully anonymised feature
+ * vector per auth interaction. IPs are salt-hashed at ingest and behaviour is
+ * timing aggregates only — nothing here is a raw secret.
+ */
+export interface BotSignal {
+    object: 'bot_signal';
+    id: string;
+    attempt_id: string | null;
+    user_id: string | null;
+    /** sign_in | sign_up | telemetry */
+    kind: string;
+    /** client_beacon | server */
+    source: string;
+    ip_hash: string | null;
+    ip_subnet: string | null;
+    asn: number | null;
+    geo_country: string | null;
+    geo_city: string | null;
+    is_datacenter: boolean | null;
+    is_anonymizer: boolean | null;
+    header_fingerprint: string | null;
+    accept_language: string | null;
+    device_id: string | null;
+    device_fingerprint: string | null;
+    device_features: Record<string, unknown>;
+    behavior_features: Record<string, unknown>;
+    captcha_provider: string | null;
+    captcha_score: number | null;
+    risk_level: string | null;
+    risk_score: number | null;
+    risk_signals: Record<string, unknown>;
+    heuristic_score: number | null;
+    heuristic_reasons: unknown[];
+    /** started | completed | failed | challenged | abandoned */
+    outcome: string | null;
+    created_at: number;
+}
+/** A supervised training label, attachable after the interaction. */
+export interface BotLabel {
+    object: 'bot_label';
+    id: string;
+    subject_type: 'user' | 'device' | 'ip_hash' | 'attempt';
+    subject_id: string;
+    label: 'bot' | 'human' | 'suspect';
+    /** admin_ban | captcha_failed | mfa_failed | verified_human | analyst | model */
+    source: string;
+    confidence: number;
+    note: string | null;
+    labeled_by: string | null;
+    created_at: number;
+}
+/**
+ * A newest-first export page: `next_before` is the created-at epoch-ms cursor to
+ * pass back as `before` for the next (older) page, or null at the end.
+ */
+export interface BotExportPage<T> {
+    object: 'list';
+    data: T[];
+    next_before: number | null;
+}
+/** limit (1..500, default 100) and an optional `before` epoch-ms cursor. */
+export interface BotExportParams {
+    limit?: number;
+    /** created-at epoch-ms cursor; returns rows OLDER than this. */
+    before?: number;
+}
+export interface CreateBotLabelBody {
+    subject_type: 'user' | 'device' | 'ip_hash' | 'attempt';
+    subject_id: string;
+    label: 'bot' | 'human' | 'suspect';
+    /** Clamped to 0..1; defaults to 1. */
+    confidence?: number;
+    note?: string;
+}
+/**
+ * Export the anti-bot signal lake and its training labels, and let an analyst
+ * add labels — the surface a tenant pulls to train their own bot-vs-human model.
+ */
+export declare function botSignalsResource(request: RequestFn): {
+    /** Page the signal lake, newest first, for an incremental pull. */
+    list(query?: BotExportParams): Promise<BotExportPage<BotSignal>>;
+    /** Page the training labels, newest first. */
+    listLabels(query?: BotExportParams): Promise<BotExportPage<BotLabel>>;
+    /** Attach a training label to a user / device / ip_hash / attempt. */
+    createLabel(body: CreateBotLabelBody, idempotencyKey?: string): Promise<BotLabel>;
+};

package/dist/client/bot-signals.js

@@ -0,0 +1,24 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.botSignalsResource = botSignalsResource;
+/**
+ * Export the anti-bot signal lake and its training labels, and let an analyst
+ * add labels — the surface a tenant pulls to train their own bot-vs-human model.
+ */
+function botSignalsResource(request) {
+    return {
+        /** Page the signal lake, newest first, for an incremental pull. */
+        list(query) {
+            return request({ method: 'GET', path: '/v1/bot_signals', query: { ...query } });
+        },
+        /** Page the training labels, newest first. */
+        listLabels(query) {
+            return request({ method: 'GET', path: '/v1/bot_labels', query: { ...query } });
+        },
+        /** Attach a training label to a user / device / ip_hash / attempt. */
+        createLabel(body, idempotencyKey) {
+            return request({ method: 'POST', path: '/v1/bot_labels', body, idempotencyKey });
+        },
+    };
+}
+//# sourceMappingURL=bot-signals.js.map

package/dist/client/bot-signals.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"bot-signals.js","sourceRoot":"","sources":["../../src/client/bot-signals.ts"],"names":[],"mappings":";;AAsFA,gDAeC;AAnBD;;;GAGG;AACH,SAAgB,kBAAkB,CAAC,OAAkB;IACnD,OAAO;QACL,mEAAmE;QACnE,IAAI,CAAC,KAAuB;YAC1B,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,iBAAiB,EAAE,KAAK,EAAE,EAAE,GAAG,KAAK,EAAE,EAAE,CAAC,CAAC;QAClF,CAAC;QACD,8CAA8C;QAC9C,UAAU,CAAC,KAAuB;YAChC,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,gBAAgB,EAAE,KAAK,EAAE,EAAE,GAAG,KAAK,EAAE,EAAE,CAAC,CAAC;QACjF,CAAC;QACD,sEAAsE;QACtE,WAAW,CAAC,IAAwB,EAAE,cAAuB;YAC3D,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,gBAAgB,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC;QACnF,CAAC;KACF,CAAC;AACJ,CAAC"}