@atlasauth/backend 0.1.0

package/dist/client/users.d.ts

@@ -0,0 +1,204 @@
+import { type RequestFn } from './request';
+import type { CursorPage, CursorParams, DeletedObject, ListPage, Metadata } from './types';
+/** A user as the BAPI serves it. `private_metadata` is never returned. */
+export interface User {
+    object: 'user';
+    id: string;
+    username: string | null;
+    first_name: string | null;
+    last_name: string | null;
+    image_url: string | null;
+    public_metadata: Metadata;
+    mfa_enabled: boolean;
+    banned: boolean;
+    locked: boolean;
+    /** Epoch milliseconds, or null if never signed in. */
+    last_sign_in_at: number | null;
+    created_at: number;
+    updated_at: number;
+}
+export interface EmailAddress {
+    object: 'email_address';
+    id: string;
+    email_address: string;
+    verified: boolean;
+    primary: boolean;
+    created_at: number;
+}
+export interface UserSession {
+    object: 'session';
+    id: string;
+    user_id: string;
+    status: string;
+    last_active_at: number;
+    expire_at: number;
+    abandon_at: number;
+    created_at: number;
+}
+export type ListUsersParams = CursorParams;
+export interface CreateUserBody {
+    email_address: string;
+    password?: string;
+    first_name?: string;
+    last_name?: string;
+    email_verified?: boolean;
+    public_metadata?: Metadata;
+    private_metadata?: Metadata;
+    unsafe_metadata?: Metadata;
+}
+export interface UpdateUserBody {
+    first_name?: string;
+    last_name?: string;
+    public_metadata?: Metadata;
+    private_metadata?: Metadata;
+}
+export interface ReplaceUserMetadataBody {
+    public_metadata?: Metadata;
+    private_metadata?: Metadata;
+    unsafe_metadata?: Metadata;
+}
+export declare function usersResource(request: RequestFn): {
+    /** `GET /v1/users` — cursor-paginated. */
+    list(params?: ListUsersParams): Promise<CursorPage<User>>;
+    get(id: string): Promise<User>;
+    create(body: CreateUserBody, idempotencyKey?: string): Promise<User>;
+    update(id: string, body: UpdateUserBody): Promise<User>;
+    /** `PUT /v1/users/:id/metadata` — replaces the named bags wholesale. */
+    replaceMetadata(id: string, body: ReplaceUserMetadataBody): Promise<User>;
+    ban(id: string): Promise<User>;
+    unban(id: string): Promise<User>;
+    lock(id: string, body?: {
+        duration_in_seconds?: number;
+    }): Promise<User>;
+    unlock(id: string): Promise<User>;
+    delete(id: string): Promise<DeletedObject>;
+    resetMfa(id: string): Promise<{
+        object: "user";
+        id: string;
+        mfa_enabled: false;
+    }>;
+    deleteMfaFactor(id: string, factorId: string): Promise<{
+        object: "mfa_factor";
+        id: string;
+        deleted: true;
+    }>;
+    listSessions(id: string): Promise<ListPage<UserSession>>;
+    revokeSessions(id: string): Promise<{
+        object: "user";
+        id: string;
+        sessions_revoked: number;
+    }>;
+    addEmail(id: string, body: {
+        email_address: string;
+    }): Promise<EmailAddress>;
+    verifyEmail(id: string, emailId: string): Promise<EmailAddress>;
+    setPrimaryEmail(id: string, emailId: string): Promise<EmailAddress>;
+    /** `GET /v1/users/:id/oauth_access_tokens/:provider` — a live provider credential. */
+    getOAuthAccessToken(id: string, provider: string): Promise<OAuthAccessToken>;
+    /**
+     * `GET /v1/users/:id/identities` — the base Atlas identity plus one entry per
+     * linked external account. Tokens are never included.
+     */
+    listIdentities(id: string): Promise<ListPage<Identity>>;
+    /**
+     * `POST /v1/users/:id/identities` — merge a secondary user INTO this one
+     * (Auth0 `post_identities` parity). The secondary is retired by soft-delete;
+     * collisions (a provider/email the primary already holds) are reported, never
+     * clobbered.
+     */
+    linkIdentity(id: string, body: {
+        secondary_user_id: string;
+    }, idempotencyKey?: string): Promise<ListPage<Identity> & {
+        collisions: Array<{
+            type: string;
+            detail: string;
+        }>;
+    }>;
+    /**
+     * `POST /v1/users/:id/external_accounts/connect` — start an OAuth flow that
+     * links a NEW provider identity to THIS user (backend-initiated connect). For
+     * an app whose own backend knows the current user (not an Atlas session
+     * cookie): call this with the user's id, then redirect the browser to the
+     * returned `authorization_url`. The callback links the provider to this user
+     * WITHOUT creating a session, returning `__atlas_status=connected`. The
+     * `IDENTITY_ALREADY_LINKED` guard refuses an identity owned by another user.
+     */
+    connectExternalAccount(id: string, body: {
+        provider: string;
+        redirect_url: string;
+        additional_scopes?: string[];
+    }, idempotencyKey?: string): Promise<{
+        object: "external_account_connection";
+        provider: string;
+        user_id: string;
+        attempt_id: string;
+        authorization_url: string;
+        scopes: string[];
+    }>;
+    /**
+     * `DELETE /v1/users/:id/identities/:identityId` — extract a linked provider
+     * identity into a brand-new standalone user. The base identity and a user's
+     * sole remaining sign-in identity cannot be unlinked.
+     */
+    unlinkIdentity(id: string, identityId: string): Promise<{
+        object: "identity";
+        id: string;
+        provider: string;
+        unlinked: true;
+        new_user_id: string;
+    }>;
+    /** `GET /v1/users/:id/grants` — the OAuth clients this user has authorized. */
+    listGrants(id: string): Promise<ListPage<Grant>>;
+    /**
+     * `DELETE /v1/users/:id/grants` — revoke every consent grant the user holds,
+     * cascading to the associated access/refresh tokens so de-authorized apps
+     * stop on their next call.
+     */
+    revokeAllGrants(id: string): Promise<{
+        object: "user";
+        id: string;
+        grants_revoked: number;
+        tokens_revoked: number;
+    }>;
+    /**
+     * `DELETE /v1/grants/:id` — revoke ONE consent grant (and its live tokens).
+     * Grants are instance-scoped, so this is not nested under a user id.
+     */
+    revokeGrant(grantId: string): Promise<{
+        object: "grant";
+        id: string;
+        deleted: true;
+        tokens_revoked: number;
+    }>;
+};
+/** One sign-in identity on a user: the base Atlas anchor, or a linked provider. */
+export interface Identity {
+    object: 'identity';
+    id: string;
+    type: 'atlas' | 'oauth';
+    provider: string;
+    provider_user_id?: string;
+    email?: string | null;
+    email_verified?: boolean;
+    is_primary: boolean;
+    has_password?: boolean;
+}
+/** An OAuth consent grant — the scopes a user authorized a client for. Never a token. */
+export interface Grant {
+    object: 'grant';
+    id: string;
+    client_id: string | null;
+    client_name: string | null;
+    scopes: string[];
+    granted_at: number;
+    updated_at: number;
+}
+export interface OAuthAccessToken {
+    object: 'oauth_access_token';
+    provider: string;
+    /** The provider access token itself. Field is `token`, not `access_token`. */
+    token: string;
+    expires_at: number | null;
+    scopes: string[];
+    refreshed: boolean;
+}

package/dist/client/users.js

@@ -0,0 +1,135 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.usersResource = usersResource;
+const request_1 = require("./request");
+function usersResource(request) {
+    return {
+        /** `GET /v1/users` — cursor-paginated. */
+        list(params = {}) {
+            return request({ method: 'GET', path: '/v1/users', query: { ...params } });
+        },
+        get(id) {
+            return request({ method: 'GET', path: `/v1/users/${(0, request_1.enc)(id)}` });
+        },
+        create(body, idempotencyKey) {
+            return request({ method: 'POST', path: '/v1/users', body, idempotencyKey });
+        },
+        update(id, body) {
+            return request({ method: 'PATCH', path: `/v1/users/${(0, request_1.enc)(id)}`, body });
+        },
+        /** `PUT /v1/users/:id/metadata` — replaces the named bags wholesale. */
+        replaceMetadata(id, body) {
+            return request({ method: 'PUT', path: `/v1/users/${(0, request_1.enc)(id)}/metadata`, body });
+        },
+        ban(id) {
+            return request({ method: 'POST', path: `/v1/users/${(0, request_1.enc)(id)}/ban` });
+        },
+        unban(id) {
+            return request({ method: 'POST', path: `/v1/users/${(0, request_1.enc)(id)}/unban` });
+        },
+        lock(id, body = {}) {
+            return request({ method: 'POST', path: `/v1/users/${(0, request_1.enc)(id)}/lock`, body });
+        },
+        unlock(id) {
+            return request({ method: 'POST', path: `/v1/users/${(0, request_1.enc)(id)}/unlock` });
+        },
+        delete(id) {
+            return request({ method: 'DELETE', path: `/v1/users/${(0, request_1.enc)(id)}` });
+        },
+        resetMfa(id) {
+            return request({ method: 'POST', path: `/v1/users/${(0, request_1.enc)(id)}/reset_mfa` });
+        },
+        deleteMfaFactor(id, factorId) {
+            return request({ method: 'DELETE', path: `/v1/users/${(0, request_1.enc)(id)}/mfa/${(0, request_1.enc)(factorId)}` });
+        },
+        listSessions(id) {
+            return request({ method: 'GET', path: `/v1/users/${(0, request_1.enc)(id)}/sessions` });
+        },
+        revokeSessions(id) {
+            return request({ method: 'POST', path: `/v1/users/${(0, request_1.enc)(id)}/sessions/revoke` });
+        },
+        addEmail(id, body) {
+            return request({ method: 'POST', path: `/v1/users/${(0, request_1.enc)(id)}/email_addresses`, body });
+        },
+        verifyEmail(id, emailId) {
+            return request({
+                method: 'POST',
+                path: `/v1/users/${(0, request_1.enc)(id)}/email_addresses/${(0, request_1.enc)(emailId)}/verify`,
+            });
+        },
+        setPrimaryEmail(id, emailId) {
+            return request({
+                method: 'POST',
+                path: `/v1/users/${(0, request_1.enc)(id)}/email_addresses/${(0, request_1.enc)(emailId)}/primary`,
+            });
+        },
+        /** `GET /v1/users/:id/oauth_access_tokens/:provider` — a live provider credential. */
+        getOAuthAccessToken(id, provider) {
+            return request({
+                method: 'GET',
+                path: `/v1/users/${(0, request_1.enc)(id)}/oauth_access_tokens/${(0, request_1.enc)(provider)}`,
+            });
+        },
+        /**
+         * `GET /v1/users/:id/identities` — the base Atlas identity plus one entry per
+         * linked external account. Tokens are never included.
+         */
+        listIdentities(id) {
+            return request({ method: 'GET', path: `/v1/users/${(0, request_1.enc)(id)}/identities` });
+        },
+        /**
+         * `POST /v1/users/:id/identities` — merge a secondary user INTO this one
+         * (Auth0 `post_identities` parity). The secondary is retired by soft-delete;
+         * collisions (a provider/email the primary already holds) are reported, never
+         * clobbered.
+         */
+        linkIdentity(id, body, idempotencyKey) {
+            return request({ method: 'POST', path: `/v1/users/${(0, request_1.enc)(id)}/identities`, body, idempotencyKey });
+        },
+        /**
+         * `POST /v1/users/:id/external_accounts/connect` — start an OAuth flow that
+         * links a NEW provider identity to THIS user (backend-initiated connect). For
+         * an app whose own backend knows the current user (not an Atlas session
+         * cookie): call this with the user's id, then redirect the browser to the
+         * returned `authorization_url`. The callback links the provider to this user
+         * WITHOUT creating a session, returning `__atlas_status=connected`. The
+         * `IDENTITY_ALREADY_LINKED` guard refuses an identity owned by another user.
+         */
+        connectExternalAccount(id, body, idempotencyKey) {
+            return request({
+                method: 'POST',
+                path: `/v1/users/${(0, request_1.enc)(id)}/external_accounts/connect`,
+                body,
+                idempotencyKey,
+            });
+        },
+        /**
+         * `DELETE /v1/users/:id/identities/:identityId` — extract a linked provider
+         * identity into a brand-new standalone user. The base identity and a user's
+         * sole remaining sign-in identity cannot be unlinked.
+         */
+        unlinkIdentity(id, identityId) {
+            return request({ method: 'DELETE', path: `/v1/users/${(0, request_1.enc)(id)}/identities/${(0, request_1.enc)(identityId)}` });
+        },
+        /** `GET /v1/users/:id/grants` — the OAuth clients this user has authorized. */
+        listGrants(id) {
+            return request({ method: 'GET', path: `/v1/users/${(0, request_1.enc)(id)}/grants` });
+        },
+        /**
+         * `DELETE /v1/users/:id/grants` — revoke every consent grant the user holds,
+         * cascading to the associated access/refresh tokens so de-authorized apps
+         * stop on their next call.
+         */
+        revokeAllGrants(id) {
+            return request({ method: 'DELETE', path: `/v1/users/${(0, request_1.enc)(id)}/grants` });
+        },
+        /**
+         * `DELETE /v1/grants/:id` — revoke ONE consent grant (and its live tokens).
+         * Grants are instance-scoped, so this is not nested under a user id.
+         */
+        revokeGrant(grantId) {
+            return request({ method: 'DELETE', path: `/v1/grants/${(0, request_1.enc)(grantId)}` });
+        },
+    };
+}
+//# sourceMappingURL=users.js.map

package/dist/client/users.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"users.js","sourceRoot":"","sources":["../../src/client/users.ts"],"names":[],"mappings":";;AAmEA,sCA4JC;AA/ND,uCAAgD;AAmEhD,SAAgB,aAAa,CAAC,OAAkB;IAC9C,OAAO;QACL,0CAA0C;QAC1C,IAAI,CAAC,SAA0B,EAAE;YAC/B,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,WAAW,EAAE,KAAK,EAAE,EAAE,GAAG,MAAM,EAAE,EAAE,CAAC,CAAC;QAC7E,CAAC;QACD,GAAG,CAAC,EAAU;YACZ,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,aAAa,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;QAClE,CAAC;QACD,MAAM,CAAC,IAAoB,EAAE,cAAuB;YAClD,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC;QAC9E,CAAC;QACD,MAAM,CAAC,EAAU,EAAE,IAAoB;YACrC,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,aAAa,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;QAC1E,CAAC;QACD,wEAAwE;QACxE,eAAe,CAAC,EAAU,EAAE,IAA6B;YACvD,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,aAAa,IAAA,aAAG,EAAC,EAAE,CAAC,WAAW,EAAE,IAAI,EAAE,CAAC,CAAC;QACjF,CAAC;QACD,GAAG,CAAC,EAAU;YACZ,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,aAAa,IAAA,aAAG,EAAC,EAAE,CAAC,MAAM,EAAE,CAAC,CAAC;QACvE,CAAC;QACD,KAAK,CAAC,EAAU;YACd,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,aAAa,IAAA,aAAG,EAAC,EAAE,CAAC,QAAQ,EAAE,CAAC,CAAC;QACzE,CAAC;QACD,IAAI,CAAC,EAAU,EAAE,OAAyC,EAAE;YAC1D,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,aAAa,IAAA,aAAG,EAAC,EAAE,CAAC,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;QAC9E,CAAC;QACD,MAAM,CAAC,EAAU;YACf,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,aAAa,IAAA,aAAG,EAAC,EAAE,CAAC,SAAS,EAAE,CAAC,CAAC;QAC1E,CAAC;QACD,MAAM,CAAC,EAAU;YACf,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,aAAa,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;QACrE,CAAC;QACD,QAAQ,CAAC,EAAU;YACjB,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,aAAa,IAAA,aAAG,EAAC,EAAE,CAAC,YAAY,EAAE,CAAC,CAAC;QAC7E,CAAC;QACD,eAAe,CACb,EAAU,EACV,QAAgB;YAEhB,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,aAAa,IAAA,aAAG,EAAC,EAAE,CAAC,QAAQ,IAAA,aAAG,EAAC,QAAQ,CAAC,EAAE,EAAE,CAAC,CAAC;QAC1F,CAAC;QACD,YAAY,CAAC,EAAU;YACrB,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,aAAa,IAAA,aAAG,EAAC,EAAE,CAAC,WAAW,EAAE,CAAC,CAAC;QAC3E,CAAC;QACD,cAAc,CACZ,EAAU;YAEV,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,aAAa,IAAA,aAAG,EAAC,EAAE,CAAC,kBAAkB,EAAE,CAAC,CAAC;QACnF,CAAC;QACD,QAAQ,CAAC,EAAU,EAAE,IAA+B;YAClD,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,aAAa,IAAA,aAAG,EAAC,EAAE,CAAC,kBAAkB,EAAE,IAAI,EAAE,CAAC,CAAC;QACzF,CAAC;QACD,WAAW,CAAC,EAAU,EAAE,OAAe;YACrC,OAAO,OAAO,CAAC;gBACb,MAAM,EAAE,MAAM;gBACd,IAAI,EAAE,aAAa,IAAA,aAAG,EAAC,EAAE,CAAC,oBAAoB,IAAA,aAAG,EAAC,OAAO,CAAC,SAAS;aACpE,CAAC,CAAC;QACL,CAAC;QACD,eAAe,CAAC,EAAU,EAAE,OAAe;YACzC,OAAO,OAAO,CAAC;gBACb,MAAM,EAAE,MAAM;gBACd,IAAI,EAAE,aAAa,IAAA,aAAG,EAAC,EAAE,CAAC,oBAAoB,IAAA,aAAG,EAAC,OAAO,CAAC,UAAU;aACrE,CAAC,CAAC;QACL,CAAC;QACD,sFAAsF;QACtF,mBAAmB,CAAC,EAAU,EAAE,QAAgB;YAC9C,OAAO,OAAO,CAAC;gBACb,MAAM,EAAE,KAAK;gBACb,IAAI,EAAE,aAAa,IAAA,aAAG,EAAC,EAAE,CAAC,wBAAwB,IAAA,aAAG,EAAC,QAAQ,CAAC,EAAE;aAClE,CAAC,CAAC;QACL,CAAC;QACD;;;WAGG;QACH,cAAc,CAAC,EAAU;YACvB,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,aAAa,IAAA,aAAG,EAAC,EAAE,CAAC,aAAa,EAAE,CAAC,CAAC;QAC7E,CAAC;QACD;;;;;WAKG;QACH,YAAY,CACV,EAAU,EACV,IAAmC,EACnC,cAAuB;YAEvB,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,aAAa,IAAA,aAAG,EAAC,EAAE,CAAC,aAAa,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC;QACpG,CAAC;QACD;;;;;;;;WAQG;QACH,sBAAsB,CACpB,EAAU,EACV,IAA8E,EAC9E,cAAuB;YASvB,OAAO,OAAO,CAAC;gBACb,MAAM,EAAE,MAAM;gBACd,IAAI,EAAE,aAAa,IAAA,aAAG,EAAC,EAAE,CAAC,4BAA4B;gBACtD,IAAI;gBACJ,cAAc;aACf,CAAC,CAAC;QACL,CAAC;QACD;;;;WAIG;QACH,cAAc,CACZ,EAAU,EACV,UAAkB;YAElB,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,aAAa,IAAA,aAAG,EAAC,EAAE,CAAC,eAAe,IAAA,aAAG,EAAC,UAAU,CAAC,EAAE,EAAE,CAAC,CAAC;QACnG,CAAC;QACD,+EAA+E;QAC/E,UAAU,CAAC,EAAU;YACnB,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,aAAa,IAAA,aAAG,EAAC,EAAE,CAAC,SAAS,EAAE,CAAC,CAAC;QACzE,CAAC;QACD;;;;WAIG;QACH,eAAe,CACb,EAAU;YAEV,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,aAAa,IAAA,aAAG,EAAC,EAAE,CAAC,SAAS,EAAE,CAAC,CAAC;QAC5E,CAAC;QACD;;;WAGG;QACH,WAAW,CACT,OAAe;YAEf,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,cAAc,IAAA,aAAG,EAAC,OAAO,CAAC,EAAE,EAAE,CAAC,CAAC;QAC3E,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/client/waitlist.d.ts

@@ -0,0 +1,31 @@
+import { type RequestFn } from './request';
+import type { CursorParams } from './types';
+export interface WaitlistEntry {
+    object: 'waitlist_entry';
+    id: string;
+    email_address: string;
+    status: string;
+    note: string | null;
+    decided_by: string | null;
+    decided_at: number | null;
+    created_at: number;
+}
+export interface ListWaitlistParams extends CursorParams {
+    status?: string;
+    query?: string;
+}
+export interface ListWaitlistResponse {
+    object: 'list';
+    data: WaitlistEntry[];
+    counts: Record<string, number>;
+    has_more: boolean;
+    next_cursor: string | null;
+}
+export declare function waitlistResource(request: RequestFn): {
+    list(params?: ListWaitlistParams): Promise<ListWaitlistResponse>;
+    /** Approve or deny a waitlist entry. */
+    decide(id: string, body: {
+        status: "approved" | "denied";
+        note?: string;
+    }): Promise<WaitlistEntry>;
+};

package/dist/client/waitlist.js

@@ -0,0 +1,16 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.waitlistResource = waitlistResource;
+const request_1 = require("./request");
+function waitlistResource(request) {
+    return {
+        list(params = {}) {
+            return request({ method: 'GET', path: '/v1/waitlist_entries', query: { ...params } });
+        },
+        /** Approve or deny a waitlist entry. */
+        decide(id, body) {
+            return request({ method: 'POST', path: `/v1/waitlist_entries/${(0, request_1.enc)(id)}/decide`, body });
+        },
+    };
+}
+//# sourceMappingURL=waitlist.js.map

package/dist/client/waitlist.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"waitlist.js","sourceRoot":"","sources":["../../src/client/waitlist.ts"],"names":[],"mappings":";;AA2BA,4CAaC;AAxCD,uCAAgD;AA2BhD,SAAgB,gBAAgB,CAAC,OAAkB;IACjD,OAAO;QACL,IAAI,CAAC,SAA6B,EAAE;YAClC,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,sBAAsB,EAAE,KAAK,EAAE,EAAE,GAAG,MAAM,EAAE,EAAE,CAAC,CAAC;QACxF,CAAC;QACD,wCAAwC;QACxC,MAAM,CACJ,EAAU,EACV,IAAsD;YAEtD,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,wBAAwB,IAAA,aAAG,EAAC,EAAE,CAAC,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAC3F,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/client/webhooks.d.ts

@@ -0,0 +1,50 @@
+import { type RequestFn } from './request';
+export interface WebhookEndpoint {
+    object: 'webhook_endpoint';
+    id: string;
+    url: string;
+    enabled_events: string[];
+    active: boolean;
+    disabled_at: number | null;
+    created_at: number;
+}
+/** Create reveals the signing secret (`whsec_...`) exactly once. */
+export interface WebhookEndpointWithSecret extends WebhookEndpoint {
+    secret: string;
+}
+export interface WebhookDelivery {
+    object: 'webhook_delivery';
+    id: string;
+    event_id: string;
+    attempt_number: number;
+    status: string;
+    http_status: number | null;
+    response_snippet: string | null;
+    next_retry_at: number | null;
+    delivered_at: number | null;
+    created_at: number;
+}
+export interface CreateWebhookEndpointBody {
+    url: string;
+    /** Each entry is `"*"` or a known event name. */
+    enabled_events?: string[];
+}
+export declare function webhooksResource(request: RequestFn): {
+    endpoints: {
+        list(): Promise<{
+            data: WebhookEndpoint[];
+            has_more: false;
+        }>;
+        create(body: CreateWebhookEndpointBody, idempotencyKey?: string): Promise<WebhookEndpointWithSecret>;
+        delete(id: string): Promise<{
+            object: "webhook_endpoint";
+            id: string;
+            deleted: true;
+        }>;
+    };
+    /** Delivery log for an endpoint. */
+    deliveries(id: string): Promise<{
+        data: WebhookDelivery[];
+        has_more: false;
+    }>;
+};

package/dist/client/webhooks.js

@@ -0,0 +1,24 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.webhooksResource = webhooksResource;
+const request_1 = require("./request");
+function webhooksResource(request) {
+    return {
+        endpoints: {
+            list() {
+                return request({ method: 'GET', path: '/v1/webhook_endpoints' });
+            },
+            create(body, idempotencyKey) {
+                return request({ method: 'POST', path: '/v1/webhook_endpoints', body, idempotencyKey });
+            },
+            delete(id) {
+                return request({ method: 'DELETE', path: `/v1/webhook_endpoints/${(0, request_1.enc)(id)}` });
+            },
+        },
+        /** Delivery log for an endpoint. */
+        deliveries(id) {
+            return request({ method: 'GET', path: `/v1/webhook_endpoints/${(0, request_1.enc)(id)}/deliveries` });
+        },
+    };
+}
+//# sourceMappingURL=webhooks.js.map

package/dist/client/webhooks.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"webhooks.js","sourceRoot":"","sources":["../../src/client/webhooks.ts"],"names":[],"mappings":";;AAoCA,4CAuBC;AA3DD,uCAAgD;AAoChD,SAAgB,gBAAgB,CAAC,OAAkB;IACjD,OAAO;QACL,SAAS,EAAE;YACT,IAAI;gBACF,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,uBAAuB,EAAE,CAAC,CAAC;YACnE,CAAC;YACD,MAAM,CACJ,IAA+B,EAC/B,cAAuB;gBAEvB,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,uBAAuB,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC;YAC1F,CAAC;YACD,MAAM,CACJ,EAAU;gBAEV,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,yBAAyB,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;YACjF,CAAC;SACF;QACD,oCAAoC;QACpC,UAAU,CAAC,EAAU;YACnB,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,yBAAyB,IAAA,aAAG,EAAC,EAAE,CAAC,aAAa,EAAE,CAAC,CAAC;QACzF,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/handshake.d.ts

@@ -0,0 +1,76 @@
+/**
+ * Cross-property SSO handshake — the second property's server-side redeem step.
+ *
+ * When a satellite (a property on a DIFFERENT registrable domain than the main
+ * app) has no local session, the SDK middleware bounces the browser through
+ * `GET {fapiOrigin}/v1/client/handshake`, which — if the user has an Atlas
+ * session — redirects back with `?__atlas_hs=ok&__atlas_hu=<userId>&__atlas_hn=
+ * <nonce>`. This helper exchanges that single-use nonce for a fresh session,
+ * server-to-server, so the tokens are returned in the response BODY (never a
+ * URL). The caller sets them as its OWN first-party cookies:
+ *
+ *   const s = await redeemHandshake({ fapiOrigin, publishableKey, userId, nonce });
+ *   if (s) {
+ *     res.cookies.set('__session', s.jwt, { path: '/', sameSite: 'lax', secure: true });
+ *     res.cookies.set('__atlas_rt', s.refreshToken, { path: '/', httpOnly: true, sameSite: 'lax', secure: true });
+ *   }
+ *
+ * (Same-registrable-domain SUBDOMAINS don't need this — the handshake sets a
+ * parent-domain cookie directly; this is only the cross-domain path.)
+ */
+export interface RedeemHandshakeOptions {
+    /** Origin of the Atlas Frontend API, e.g. `https://id.atlasauth.net`. */
+    fapiOrigin: string;
+    /** The instance publishable key (`pk_…`). */
+    publishableKey: string;
+    /**
+     * The `__atlas_hu` value from the return URL. Advisory only — the server
+     * issues the session for the subject the nonce was bound to, not this value.
+     */
+    userId: string;
+    /** The single-use `__atlas_hn` nonce from the return URL. */
+    nonce: string;
+    /**
+     * The PKCE `code_verifier` this server generated (with {@link createPkcePair})
+     * BEFORE bouncing the browser to the handshake, stashed server-side (a
+     * short-lived HttpOnly cookie). Proves possession of the challenge the nonce
+     * was bound to — a stolen nonce without it is inert.
+     */
+    codeVerifier: string;
+    fetchImpl?: typeof fetch;
+}
+export interface PkcePair {
+    /** Kept server-side; never leaves the redeeming server. */
+    verifier: string;
+    /** base64url(SHA-256(verifier)); the only half that reaches the handshake. */
+    challenge: string;
+}
+/**
+ * Generate a PKCE (RFC 7636, S256) pair for a cross-domain handshake. Uses only
+ * Web Crypto globals so it runs unchanged on the edge/worker runtimes the SDK
+ * middleware targets — no `node:crypto`. Send `challenge` on the handshake URL
+ * as `code_challenge`; stash `verifier` server-side and pass it to
+ * {@link redeemHandshake}.
+ */
+export declare function createPkcePair(): Promise<PkcePair>;
+export interface HandshakeSession {
+    /** The `__session` JWT value to set as a cookie (script-readable, short-lived). */
+    jwt: string;
+    /** The `__atlas_rt` refresh value to set as an HttpOnly cookie. */
+    refreshToken: string;
+    sessionId: string;
+    /** Seconds until the `__session` JWT expires. */
+    expiresIn: number;
+}
+/**
+ * Redeem a handshake nonce for a fresh session. Returns `null` when the nonce is
+ * missing/expired/already used (the caller should then fall back to sign-in).
+ * Never throws on an auth failure — a bad nonce is a signed-out signal, not an
+ * error that should take the page down.
+ */
+export declare function redeemHandshake(options: RedeemHandshakeOptions): Promise<HandshakeSession | null>;
+/** Extract the handshake params from a return URL (or its query string). */
+export declare function readHandshakeParams(urlOrSearch: string): {
+    userId: string;
+    nonce: string;
+} | null;

package/dist/handshake.js

@@ -0,0 +1,96 @@
+"use strict";
+/**
+ * Cross-property SSO handshake — the second property's server-side redeem step.
+ *
+ * When a satellite (a property on a DIFFERENT registrable domain than the main
+ * app) has no local session, the SDK middleware bounces the browser through
+ * `GET {fapiOrigin}/v1/client/handshake`, which — if the user has an Atlas
+ * session — redirects back with `?__atlas_hs=ok&__atlas_hu=<userId>&__atlas_hn=
+ * <nonce>`. This helper exchanges that single-use nonce for a fresh session,
+ * server-to-server, so the tokens are returned in the response BODY (never a
+ * URL). The caller sets them as its OWN first-party cookies:
+ *
+ *   const s = await redeemHandshake({ fapiOrigin, publishableKey, userId, nonce });
+ *   if (s) {
+ *     res.cookies.set('__session', s.jwt, { path: '/', sameSite: 'lax', secure: true });
+ *     res.cookies.set('__atlas_rt', s.refreshToken, { path: '/', httpOnly: true, sameSite: 'lax', secure: true });
+ *   }
+ *
+ * (Same-registrable-domain SUBDOMAINS don't need this — the handshake sets a
+ * parent-domain cookie directly; this is only the cross-domain path.)
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.createPkcePair = createPkcePair;
+exports.redeemHandshake = redeemHandshake;
+exports.readHandshakeParams = readHandshakeParams;
+const base64url = (bytes) => {
+    let bin = '';
+    for (const b of bytes)
+        bin += String.fromCharCode(b);
+    // btoa is available in every SDK runtime (edge, workers, browser, Node ≥16).
+    return btoa(bin).replace(/\+/g, '-').replace(/\//g, '_').replace(/=+$/, '');
+};
+/**
+ * Generate a PKCE (RFC 7636, S256) pair for a cross-domain handshake. Uses only
+ * Web Crypto globals so it runs unchanged on the edge/worker runtimes the SDK
+ * middleware targets — no `node:crypto`. Send `challenge` on the handshake URL
+ * as `code_challenge`; stash `verifier` server-side and pass it to
+ * {@link redeemHandshake}.
+ */
+async function createPkcePair() {
+    const raw = new Uint8Array(32);
+    crypto.getRandomValues(raw);
+    const verifier = base64url(raw);
+    const digest = await crypto.subtle.digest('SHA-256', new TextEncoder().encode(verifier));
+    return { verifier, challenge: base64url(new Uint8Array(digest)) };
+}
+/**
+ * Redeem a handshake nonce for a fresh session. Returns `null` when the nonce is
+ * missing/expired/already used (the caller should then fall back to sign-in).
+ * Never throws on an auth failure — a bad nonce is a signed-out signal, not an
+ * error that should take the page down.
+ */
+async function redeemHandshake(options) {
+    const doFetch = options.fetchImpl ?? fetch;
+    const url = new URL('/v1/client/handshake/redeem', options.fapiOrigin).toString();
+    let res;
+    try {
+        res = await doFetch(url, {
+            method: 'POST',
+            headers: {
+                'content-type': 'application/json',
+                'x-publishable-key': options.publishableKey,
+            },
+            body: JSON.stringify({
+                user_id: options.userId,
+                nonce: options.nonce,
+                code_verifier: options.codeVerifier,
+            }),
+        });
+    }
+    catch {
+        return null;
+    }
+    if (!res.ok)
+        return null;
+    const data = (await res.json().catch(() => null));
+    if (!data?.jwt || !data.refresh_token)
+        return null;
+    return {
+        jwt: data.jwt,
+        refreshToken: data.refresh_token,
+        sessionId: data.session_id ?? '',
+        expiresIn: data.expires_in ?? 0,
+    };
+}
+/** Extract the handshake params from a return URL (or its query string). */
+function readHandshakeParams(urlOrSearch) {
+    const q = urlOrSearch.includes('?') ? urlOrSearch.slice(urlOrSearch.indexOf('?')) : urlOrSearch;
+    const params = new URLSearchParams(q.startsWith('?') ? q : `?${q}`);
+    if (params.get('__atlas_hs') !== 'ok')
+        return null;
+    const userId = params.get('__atlas_hu');
+    const nonce = params.get('__atlas_hn');
+    return userId && nonce ? { userId, nonce } : null;
+}
+//# sourceMappingURL=handshake.js.map

package/dist/handshake.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"handshake.js","sourceRoot":"","sources":["../src/handshake.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;;;GAmBG;;AA6CH,wCAMC;AAkBD,0CAqCC;AAGD,kDAOC;AA5FD,MAAM,SAAS,GAAG,CAAC,KAAiB,EAAU,EAAE;IAC9C,IAAI,GAAG,GAAG,EAAE,CAAC;IACb,KAAK,MAAM,CAAC,IAAI,KAAK;QAAE,GAAG,IAAI,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;IACrD,6EAA6E;IAC7E,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;AAC9E,CAAC,CAAC;AASF;;;;;;GAMG;AACI,KAAK,UAAU,cAAc;IAClC,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC;IAC/B,MAAM,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC;IAC5B,MAAM,QAAQ,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC;IAChC,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC;IACzF,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,SAAS,CAAC,IAAI,UAAU,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC;AACpE,CAAC;AAYD;;;;;GAKG;AACI,KAAK,UAAU,eAAe,CAAC,OAA+B;IACnE,MAAM,OAAO,GAAG,OAAO,CAAC,SAAS,IAAI,KAAK,CAAC;IAC3C,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,6BAA6B,EAAE,OAAO,CAAC,UAAU,CAAC,CAAC,QAAQ,EAAE,CAAC;IAElF,IAAI,GAAa,CAAC;IAClB,IAAI,CAAC;QACH,GAAG,GAAG,MAAM,OAAO,CAAC,GAAG,EAAE;YACvB,MAAM,EAAE,MAAM;YACd,OAAO,EAAE;gBACP,cAAc,EAAE,kBAAkB;gBAClC,mBAAmB,EAAE,OAAO,CAAC,cAAc;aAC5C;YACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;gBACnB,OAAO,EAAE,OAAO,CAAC,MAAM;gBACvB,KAAK,EAAE,OAAO,CAAC,KAAK;gBACpB,aAAa,EAAE,OAAO,CAAC,YAAY;aACpC,CAAC;SACH,CAAC,CAAC;IACL,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,CAAC,GAAG,CAAC,EAAE;QAAE,OAAO,IAAI,CAAC;IAEzB,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAKxC,CAAC;IACT,IAAI,CAAC,IAAI,EAAE,GAAG,IAAI,CAAC,IAAI,CAAC,aAAa;QAAE,OAAO,IAAI,CAAC;IAEnD,OAAO;QACL,GAAG,EAAE,IAAI,CAAC,GAAG;QACb,YAAY,EAAE,IAAI,CAAC,aAAa;QAChC,SAAS,EAAE,IAAI,CAAC,UAAU,IAAI,EAAE;QAChC,SAAS,EAAE,IAAI,CAAC,UAAU,IAAI,CAAC;KAChC,CAAC;AACJ,CAAC;AAED,4EAA4E;AAC5E,SAAgB,mBAAmB,CAAC,WAAmB;IACrD,MAAM,CAAC,GAAG,WAAW,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,KAAK,CAAC,WAAW,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC;IAChG,MAAM,MAAM,GAAG,IAAI,eAAe,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACpE,IAAI,MAAM,CAAC,GAAG,CAAC,YAAY,CAAC,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IACnD,MAAM,MAAM,GAAG,MAAM,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;IACxC,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;IACvC,OAAO,MAAM,IAAI,KAAK,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;AACpD,CAAC"}

package/dist/index.d.ts

@@ -0,0 +1,6 @@
+export * from './jwks-cache';
+export * from './verify';
+export * from './handshake';
+export { createAtlasClient } from './client';
+export type { AtlasClient } from './client';
+export * from './client';