@atlasauth/backend 0.1.0

package/dist/client/branding.d.ts

@@ -0,0 +1,140 @@
+import type { RequestFn } from './request';
+/**
+ * The hosted-page / email appearance bag (`authConfig.branding`). Every field is
+ * optional and authored by a customer; the render paths only ever read the
+ * SANITIZED resolution of it, never these raw values. The flat colour/logo
+ * fields feed both email and the hosted page; the deeper fields (`layout`,
+ * `interaction`, `card`, …) shape the hosted page only.
+ */
+export interface Branding {
+    applicationName?: string;
+    logoUrl?: string;
+    colorPrimary?: string;
+    colorBackground?: string;
+    colorText?: string;
+    /** Shown in the email footer; falls back to the application name. */
+    supportEmail?: string;
+    colorAccent?: string;
+    colorCard?: string;
+    colorBorder?: string;
+    /** A CSS length like `12px` or `0.75rem`. */
+    borderRadius?: string;
+    theme?: 'light' | 'dark' | 'auto';
+    /** A curated stack name or `custom`. */
+    fontFamily?: string;
+    /** When `fontFamily === 'custom'`, an https URL to a @font-face stylesheet. */
+    fontUrl?: string;
+    layout?: 'centered' | 'split' | 'wall';
+    background?: HostedBackground;
+    /** Provider display order + which social providers to hide. */
+    providers?: {
+        order?: string[];
+        hidden?: string[];
+    };
+    copy?: {
+        headline?: string;
+        subheadline?: string;
+        footer?: string;
+    };
+    socialButtons?: {
+        variant?: 'block' | 'compact' | 'icon';
+        size?: 'sm' | 'md' | 'lg';
+        layout?: 'list' | 'grid' | 'carousel';
+        labels?: Record<string, string>;
+        search?: 'auto' | 'always' | 'never';
+        /** Per-provider colour overrides, keyed by provider id. */
+        styles?: Record<string, {
+            bg?: string;
+            fg?: string;
+        }>;
+    };
+    /** How a verification code is entered — segmented `boxes` (default) or `single`. */
+    codeInput?: 'boxes' | 'single';
+    card?: {
+        width?: 'narrow' | 'default' | 'wide';
+        align?: 'left' | 'center';
+        logoSize?: 'sm' | 'md' | 'lg';
+    };
+    typography?: {
+        headingSize?: 'sm' | 'md' | 'lg' | 'xl';
+        headingWeight?: 'normal' | 'medium' | 'semibold' | 'bold';
+    };
+    buttonShape?: 'default' | 'rounded' | 'pill' | 'square';
+    cardBorder?: 'default' | 'none' | 'bold';
+    inputSize?: 'sm' | 'md' | 'lg';
+    interaction?: {
+        buttonStyle?: 'solid' | 'outline' | 'soft' | 'ghost';
+        buttonEffect?: 'none' | 'scale' | 'lift' | 'glow' | 'ripple';
+        shadow?: 'none' | 'sm' | 'md' | 'lg';
+        density?: 'comfortable' | 'compact' | 'spacious';
+        inputStyle?: 'outline' | 'filled' | 'underline';
+        animations?: boolean;
+        motionSpeed?: 'slow' | 'normal' | 'fast';
+        motionEasing?: 'ease' | 'linear' | 'smooth' | 'spring';
+        loading?: 'spinner' | 'skeleton' | 'dots' | 'bar';
+    };
+    backgroundPattern?: 'none' | 'dots' | 'grid' | 'stripes';
+    cardStyle?: 'default' | 'glass';
+    textScale?: 'sm' | 'md' | 'lg';
+    socialPlacement?: 'top' | 'bottom';
+    /** A permutation of `['logo','heading','social','form']`. */
+    sectionOrder?: string[];
+    legal?: {
+        termsUrl?: string;
+        privacyUrl?: string;
+        required?: boolean;
+    };
+    signUpFields?: Array<{
+        key?: string;
+        label?: string;
+        type?: 'text' | 'email' | 'tel' | 'url' | 'number' | 'date' | 'textarea' | 'checkbox' | 'select' | 'radio' | 'multiselect';
+        required?: boolean;
+        placeholder?: string;
+        options?: string[];
+    }>;
+    /** Raw CSS, injected after sanitization. */
+    customCss?: string;
+    /** Sanitized HTML slot above the card. */
+    customHtmlHeader?: string;
+    /** Sanitized HTML slot below the card. */
+    customHtmlFooter?: string;
+}
+export interface HostedBackground {
+    type: 'solid' | 'gradient' | 'image' | 'wall';
+    color?: string;
+    from?: string;
+    to?: string;
+    angle?: number;
+    imageUrl?: string;
+}
+/** What the renderers actually use — everything already escaped or dropped. */
+export interface ResolvedBranding {
+    applicationName: string;
+    escapedName: string;
+    logoUrl: string | null;
+    colorPrimary: string;
+    colorBackground: string;
+    colorText: string;
+    supportEmail: string | null;
+}
+/**
+ * A read/update echoes the stored branding plus `resolved` — the sanitized shape
+ * the page will actually render, so a value silently dropped shows up here
+ * rather than being discovered on a live page.
+ */
+export interface BrandingResponse extends Branding {
+    object: 'branding';
+    resolved: ResolvedBranding;
+}
+/** A draft rendered through the real hosted-page renderer, returned as HTML. */
+export interface HostedPagePreview {
+    object: 'hosted_page_preview';
+    html: string;
+}
+export declare function brandingResource(request: RequestFn): {
+    get(): Promise<BrandingResponse>;
+    /** A PARTIAL merge — one field changes, the rest is preserved. */
+    update(body: Partial<Branding>): Promise<BrandingResponse>;
+    /** Render a draft through the live sign-in renderer without saving it. */
+    preview(body: Partial<Branding>): Promise<HostedPagePreview>;
+};

package/dist/client/branding.js

@@ -0,0 +1,19 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.brandingResource = brandingResource;
+function brandingResource(request) {
+    return {
+        get() {
+            return request({ method: 'GET', path: '/v1/branding' });
+        },
+        /** A PARTIAL merge — one field changes, the rest is preserved. */
+        update(body) {
+            return request({ method: 'PATCH', path: '/v1/branding', body });
+        },
+        /** Render a draft through the live sign-in renderer without saving it. */
+        preview(body) {
+            return request({ method: 'POST', path: '/v1/branding/preview', body });
+        },
+    };
+}
+//# sourceMappingURL=branding.js.map

package/dist/client/branding.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"branding.js","sourceRoot":"","sources":["../../src/client/branding.ts"],"names":[],"mappings":";;AAyIA,4CAcC;AAdD,SAAgB,gBAAgB,CAAC,OAAkB;IACjD,OAAO;QACL,GAAG;YACD,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC;QAC1D,CAAC;QACD,kEAAkE;QAClE,MAAM,CAAC,IAAuB;YAC5B,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,cAAc,EAAE,IAAI,EAAE,CAAC,CAAC;QAClE,CAAC;QACD,0EAA0E;QAC1E,OAAO,CAAC,IAAuB;YAC7B,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,sBAAsB,EAAE,IAAI,EAAE,CAAC,CAAC;QACzE,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/client/data-subject-requests.d.ts

@@ -0,0 +1,40 @@
+import { type RequestFn } from './request';
+import type { CursorPage, CursorParams } from './types';
+/**
+ * §13.4 GDPR/DSAR admin surface — the Data Protection Officer's console over
+ * data-subject requests. A user files export/erasure requests from the FAPI;
+ * this lets an operator SEE every request and ACTION it out of band: fulfil it
+ * now, ahead of its grace window, or reject it with a recorded reason. A
+ * fulfilled or rejected request is terminal — a second action is a 409.
+ */
+export interface DataSubjectRequest {
+    object: 'data_subject_request';
+    id: string;
+    type: string;
+    status: string;
+    user_id: string;
+    requested_by_type: string | null;
+    requested_by_id: string | null;
+    reason: string | null;
+    scheduled_for: number | null;
+    requested_at: number;
+    updated_at: number;
+    completed_at: number | null;
+    /** The export package — present on `get` and on a fulfilled export. */
+    result?: unknown;
+}
+export interface ListDataSubjectRequestsParams extends CursorParams {
+    type?: string;
+    status?: string;
+    user_id?: string;
+}
+export declare function dataSubjectRequestsResource(request: RequestFn): {
+    list(params?: ListDataSubjectRequestsParams): Promise<CursorPage<DataSubjectRequest>>;
+    get(id: string): Promise<DataSubjectRequest>;
+    /** Fulfil a request now — build the export package, or run the erasure — ahead of schedule. */
+    fulfill(id: string, idempotencyKey?: string): Promise<DataSubjectRequest>;
+    /** Reject a request with a recorded reason. Terminal — it cannot be re-actioned. */
+    reject(id: string, body?: {
+        reason?: string;
+    }, idempotencyKey?: string): Promise<DataSubjectRequest>;
+};

package/dist/client/data-subject-requests.js

@@ -0,0 +1,32 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.dataSubjectRequestsResource = dataSubjectRequestsResource;
+const request_1 = require("./request");
+function dataSubjectRequestsResource(request) {
+    return {
+        list(params = {}) {
+            return request({ method: 'GET', path: '/v1/data_subject_requests', query: { ...params } });
+        },
+        get(id) {
+            return request({ method: 'GET', path: `/v1/data_subject_requests/${(0, request_1.enc)(id)}` });
+        },
+        /** Fulfil a request now — build the export package, or run the erasure — ahead of schedule. */
+        fulfill(id, idempotencyKey) {
+            return request({
+                method: 'POST',
+                path: `/v1/data_subject_requests/${(0, request_1.enc)(id)}/fulfill`,
+                idempotencyKey,
+            });
+        },
+        /** Reject a request with a recorded reason. Terminal — it cannot be re-actioned. */
+        reject(id, body = {}, idempotencyKey) {
+            return request({
+                method: 'POST',
+                path: `/v1/data_subject_requests/${(0, request_1.enc)(id)}/reject`,
+                body,
+                idempotencyKey,
+            });
+        },
+    };
+}
+//# sourceMappingURL=data-subject-requests.js.map

package/dist/client/data-subject-requests.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"data-subject-requests.js","sourceRoot":"","sources":["../../src/client/data-subject-requests.ts"],"names":[],"mappings":";;AAiCA,kEAgCC;AAjED,uCAAgD;AAiChD,SAAgB,2BAA2B,CAAC,OAAkB;IAC5D,OAAO;QACL,IAAI,CACF,SAAwC,EAAE;YAE1C,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,2BAA2B,EAAE,KAAK,EAAE,EAAE,GAAG,MAAM,EAAE,EAAE,CAAC,CAAC;QAC7F,CAAC;QACD,GAAG,CAAC,EAAU;YACZ,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,6BAA6B,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;QAClF,CAAC;QACD,+FAA+F;QAC/F,OAAO,CAAC,EAAU,EAAE,cAAuB;YACzC,OAAO,OAAO,CAAC;gBACb,MAAM,EAAE,MAAM;gBACd,IAAI,EAAE,6BAA6B,IAAA,aAAG,EAAC,EAAE,CAAC,UAAU;gBACpD,cAAc;aACf,CAAC,CAAC;QACL,CAAC;QACD,oFAAoF;QACpF,MAAM,CACJ,EAAU,EACV,OAA4B,EAAE,EAC9B,cAAuB;YAEvB,OAAO,OAAO,CAAC;gBACb,MAAM,EAAE,MAAM;gBACd,IAAI,EAAE,6BAA6B,IAAA,aAAG,EAAC,EAAE,CAAC,SAAS;gBACnD,IAAI;gBACJ,cAAc;aACf,CAAC,CAAC;QACL,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/client/domains.d.ts

@@ -0,0 +1,45 @@
+import { type RequestFn } from './request';
+export interface CustomDomain {
+    object: 'custom_domain';
+    id: string;
+    role: 'fapi' | 'accounts';
+    host: string;
+    status: string;
+    action: string;
+    live: boolean;
+    cname_target: string;
+    last_checked_at: number | null;
+    last_observed_target: string | null;
+    failure_reason: string | null;
+    certificate_expires_at: number | null;
+    cookie_domain: string | null;
+}
+export interface ListDomainsResponse {
+    object: 'list';
+    data: CustomDomain[];
+    cname_target: string;
+    instructions: Record<string, unknown>;
+    cookie_checks: Array<{
+        origin: string;
+        first_party: boolean;
+    }>;
+    required: boolean;
+    environment: string | undefined;
+}
+export declare function domainsResource(request: RequestFn): {
+    list(): Promise<ListDomainsResponse>;
+    create(body: {
+        host: string;
+        role?: "fapi" | "accounts";
+    }, idempotencyKey?: string): Promise<CustomDomain & {
+        instructions: Record<string, unknown>;
+    }>;
+    verify(id: string): Promise<CustomDomain & {
+        verified: boolean;
+    }>;
+    delete(id: string): Promise<{
+        object: "custom_domain";
+        id: string;
+        deleted: true;
+    }>;
+};

package/dist/client/domains.js

@@ -0,0 +1,21 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.domainsResource = domainsResource;
+const request_1 = require("./request");
+function domainsResource(request) {
+    return {
+        list() {
+            return request({ method: 'GET', path: '/v1/domains' });
+        },
+        create(body, idempotencyKey) {
+            return request({ method: 'POST', path: '/v1/domains', body, idempotencyKey });
+        },
+        verify(id) {
+            return request({ method: 'POST', path: `/v1/domains/${(0, request_1.enc)(id)}/verify` });
+        },
+        delete(id) {
+            return request({ method: 'DELETE', path: `/v1/domains/${(0, request_1.enc)(id)}` });
+        },
+    };
+}
+//# sourceMappingURL=domains.js.map

package/dist/client/domains.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"domains.js","sourceRoot":"","sources":["../../src/client/domains.ts"],"names":[],"mappings":";;AA4BA,0CAkBC;AA9CD,uCAAgD;AA4BhD,SAAgB,eAAe,CAAC,OAAkB;IAChD,OAAO;QACL,IAAI;YACF,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,aAAa,EAAE,CAAC,CAAC;QACzD,CAAC;QACD,MAAM,CACJ,IAAkD,EAClD,cAAuB;YAEvB,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,aAAa,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC;QAChF,CAAC;QACD,MAAM,CAAC,EAAU;YACf,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,eAAe,IAAA,aAAG,EAAC,EAAE,CAAC,SAAS,EAAE,CAAC,CAAC;QAC5E,CAAC;QACD,MAAM,CAAC,EAAU;YACf,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,eAAe,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;QACvE,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/client/email-templates.d.ts

@@ -0,0 +1,51 @@
+import { type RequestFn } from './request';
+import type { ListPage } from './types';
+/** The transactional email a template drives. */
+export type EmailTemplateName = 'verification_code' | 'magic_link' | 'password_reset' | 'password_changed' | 'account_exists_notice' | 'organization_invitation' | 'new_device_sign_in' | 'session_revoked_token_reuse' | 'account_locked' | 'team_member_added' | 'team_role_changed';
+/** The customizable body of a template: a subject line and a text body. */
+export interface EmailTemplateBody {
+    subject?: string;
+    text?: string;
+}
+/**
+ * A list row: the built-in `default` and the stored `override` are both returned
+ * so a caller can show a diff rather than guess what changed.
+ */
+export interface EmailTemplate {
+    object: 'email_template';
+    name: EmailTemplateName;
+    default: {
+        subject: string;
+        text: string;
+    };
+    override: EmailTemplateBody | null;
+    customised: boolean;
+}
+/** The lean shape an update/delete acknowledges with (no `default`). */
+export interface EmailTemplateResult {
+    object: 'email_template';
+    name: EmailTemplateName;
+    override: EmailTemplateBody | null;
+    customised: boolean;
+}
+/**
+ * A rendered template with SAMPLE variables (never a real code). `valid` is false
+ * with a `problem` when the draft would be dropped by the renderer.
+ */
+export interface EmailTemplatePreview {
+    object: 'email_preview';
+    template: EmailTemplateName;
+    valid: boolean;
+    problem: string | null;
+    html: string | null;
+    variables: Record<string, string>;
+}
+export declare function emailTemplatesResource(request: RequestFn): {
+    list(): Promise<ListPage<EmailTemplate>>;
+    /** Render an unsaved draft (if a body is given) or the stored template. */
+    preview(name: string, body?: EmailTemplateBody): Promise<EmailTemplatePreview>;
+    /** Save an override. Keyed by template name, not an id. */
+    update(name: string, body: EmailTemplateBody): Promise<EmailTemplateResult>;
+    /** Revert to the built-in. */
+    delete(name: string): Promise<EmailTemplateResult>;
+};

package/dist/client/email-templates.js

@@ -0,0 +1,24 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.emailTemplatesResource = emailTemplatesResource;
+const request_1 = require("./request");
+function emailTemplatesResource(request) {
+    return {
+        list() {
+            return request({ method: 'GET', path: '/v1/email_templates' });
+        },
+        /** Render an unsaved draft (if a body is given) or the stored template. */
+        preview(name, body = {}) {
+            return request({ method: 'POST', path: `/v1/email_templates/${(0, request_1.enc)(name)}/preview`, body });
+        },
+        /** Save an override. Keyed by template name, not an id. */
+        update(name, body) {
+            return request({ method: 'PUT', path: `/v1/email_templates/${(0, request_1.enc)(name)}`, body });
+        },
+        /** Revert to the built-in. */
+        delete(name) {
+            return request({ method: 'DELETE', path: `/v1/email_templates/${(0, request_1.enc)(name)}` });
+        },
+    };
+}
+//# sourceMappingURL=email-templates.js.map

package/dist/client/email-templates.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"email-templates.js","sourceRoot":"","sources":["../../src/client/email-templates.ts"],"names":[],"mappings":";;AAwDA,wDAkBC;AA1ED,uCAAgD;AAwDhD,SAAgB,sBAAsB,CAAC,OAAkB;IACvD,OAAO;QACL,IAAI;YACF,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,qBAAqB,EAAE,CAAC,CAAC;QACjE,CAAC;QACD,2EAA2E;QAC3E,OAAO,CAAC,IAAY,EAAE,OAA0B,EAAE;YAChD,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,uBAAuB,IAAA,aAAG,EAAC,IAAI,CAAC,UAAU,EAAE,IAAI,EAAE,CAAC,CAAC;QAC7F,CAAC;QACD,2DAA2D;QAC3D,MAAM,CAAC,IAAY,EAAE,IAAuB;YAC1C,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,uBAAuB,IAAA,aAAG,EAAC,IAAI,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;QACpF,CAAC;QACD,8BAA8B;QAC9B,MAAM,CAAC,IAAY;YACjB,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,uBAAuB,IAAA,aAAG,EAAC,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC;QACjF,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/client/error.d.ts

@@ -0,0 +1,31 @@
+/**
+ * The single error type every management-client call throws on a non-2xx.
+ *
+ * Atlas answers a failed BAPI call with the §9.1 envelope:
+ *
+ *   { errors: [{ code, message, param?, meta? }] }
+ *
+ * `code` is the stable, machine-readable part of that contract — integrators
+ * branch on it (`LAST_ADMIN`, `NOT_FOUND`, `SCOPE_MISSING`, …) — so it is
+ * surfaced first-class here rather than buried in a parsed body. The raw
+ * `errors` array and the HTTP `status` are both kept so a caller can inspect
+ * `param`/`meta` (e.g. a rate limit's `retry_after`) when they need to.
+ */
+export interface AtlasErrorItem {
+    code: string;
+    message: string;
+    param?: string;
+    meta?: Record<string, unknown>;
+}
+export declare class AtlasApiError extends Error {
+    readonly name = "AtlasApiError";
+    /** HTTP status of the failed response. */
+    readonly status: number;
+    /** The full §9.1 error envelope, in order. */
+    readonly errors: AtlasErrorItem[];
+    constructor(status: number, errors: AtlasErrorItem[], message?: string);
+    /** The first error's stable code, the field callers branch on most. */
+    get code(): string | undefined;
+    /** True when any error in the envelope carries the given stable code. */
+    hasCode(code: string): boolean;
+}

package/dist/client/error.js

@@ -0,0 +1,28 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AtlasApiError = void 0;
+class AtlasApiError extends Error {
+    name = 'AtlasApiError';
+    /** HTTP status of the failed response. */
+    status;
+    /** The full §9.1 error envelope, in order. */
+    errors;
+    constructor(status, errors, message) {
+        super(message ?? errors[0]?.message ?? `Atlas API request failed with status ${status}`);
+        this.status = status;
+        this.errors = errors;
+        // Restore the prototype chain when compiled down to ES5-era targets so
+        // `instanceof AtlasApiError` holds for callers branching on the type.
+        Object.setPrototypeOf(this, AtlasApiError.prototype);
+    }
+    /** The first error's stable code, the field callers branch on most. */
+    get code() {
+        return this.errors[0]?.code;
+    }
+    /** True when any error in the envelope carries the given stable code. */
+    hasCode(code) {
+        return this.errors.some((e) => e.code === code);
+    }
+}
+exports.AtlasApiError = AtlasApiError;
+//# sourceMappingURL=error.js.map

package/dist/client/error.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"error.js","sourceRoot":"","sources":["../../src/client/error.ts"],"names":[],"mappings":";;;AAoBA,MAAa,aAAc,SAAQ,KAAK;IACpB,IAAI,GAAG,eAAe,CAAC;IACzC,0CAA0C;IACjC,MAAM,CAAS;IACxB,8CAA8C;IACrC,MAAM,CAAmB;IAElC,YAAY,MAAc,EAAE,MAAwB,EAAE,OAAgB;QACpE,KAAK,CAAC,OAAO,IAAI,MAAM,CAAC,CAAC,CAAC,EAAE,OAAO,IAAI,wCAAwC,MAAM,EAAE,CAAC,CAAC;QACzF,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QACrB,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QACrB,uEAAuE;QACvE,sEAAsE;QACtE,MAAM,CAAC,cAAc,CAAC,IAAI,EAAE,aAAa,CAAC,SAAS,CAAC,CAAC;IACvD,CAAC;IAED,uEAAuE;IACvE,IAAI,IAAI;QACN,OAAO,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC;IAC9B,CAAC;IAED,yEAAyE;IACzE,OAAO,CAAC,IAAY;QAClB,OAAO,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC;IAClD,CAAC;CACF;AAzBD,sCAyBC"}

package/dist/client/fga.d.ts

@@ -0,0 +1,191 @@
+import { type RequestFn } from './request';
+import type { ListPage } from './types';
+/**
+ * Fine-grained relationship-based authorization (Zanzibar / OpenFGA), in-house.
+ * A tenant owns STORES; each store holds immutable, versioned authorization
+ * MODELS and the relationship TUPLES the engine resolves. Every store is scoped
+ * to the calling instance — a store from another instance reads as a 404.
+ */
+export interface FgaStore {
+    object: 'fga.store';
+    id: string;
+    name: string;
+    created_at: number;
+    updated_at: number;
+}
+export interface FgaAuthorizationModel {
+    object: 'fga.authorization_model';
+    id: string;
+    store_id: string;
+    schema_version: string;
+    /** The OpenFGA model. Present on get/create; omitted from list rows. */
+    model?: Record<string, unknown>;
+    created_at: number;
+}
+export interface FgaTuple {
+    object: 'fga.tuple';
+    /** `type:id` or `type:id#relation` for a userset. */
+    user: string;
+    relation: string;
+    /** The object of the tuple as `type:id`. */
+    target: string;
+    created_at: number;
+}
+/** A tuple key. `object` is the target as `type:id`; `target` is accepted too. */
+export interface FgaTupleKey {
+    user: string;
+    relation: string;
+    object: string;
+}
+/** An OpenFGA authorization model to persist. Validated before storage. */
+export interface FgaAuthorizationModelInput {
+    type_definitions: unknown[];
+    /** Defaults to `1.1` when omitted. */
+    schema_version?: string;
+    conditions?: Record<string, unknown>;
+}
+/** Both `{ tuple_keys: [...] }` (OpenFGA shape) and a bare array are accepted. */
+export type FgaTupleKeys = FgaTupleKey[] | {
+    tuple_keys: FgaTupleKey[];
+};
+export interface FgaCheckBody {
+    user: string;
+    relation: string;
+    object: string;
+    /** Defaults to the store's latest model. */
+    authorization_model_id?: string;
+    contextual_tuples?: FgaTupleKeys;
+}
+export interface FgaListObjectsBody {
+    user: string;
+    relation: string;
+    type: string;
+    authorization_model_id?: string;
+    contextual_tuples?: FgaTupleKeys;
+}
+/** One item in a batch check; `correlation_id` is echoed back to match results. */
+export interface FgaBatchCheckItem {
+    user: string;
+    relation: string;
+    object: string;
+    correlation_id?: string;
+    contextual_tuples?: FgaTupleKeys;
+}
+export interface FgaBatchCheckResult {
+    object: 'fga.batch_check';
+    authorization_model_id: string;
+    result: Array<{
+        correlation_id: string;
+        allowed: boolean;
+    }>;
+}
+export declare function fgaResource(request: RequestFn): {
+    stores: {
+        list(): Promise<ListPage<FgaStore>>;
+        create(body: {
+            name: string;
+        }, idempotencyKey?: string): Promise<FgaStore>;
+        get(id: string): Promise<FgaStore>;
+        delete(id: string): Promise<{
+            object: "fga.store";
+            id: string;
+            deleted: true;
+        }>;
+    };
+    models: {
+        list(storeId: string): Promise<ListPage<FgaAuthorizationModel>>;
+        create(storeId: string, body: FgaAuthorizationModelInput, idempotencyKey?: string): Promise<FgaAuthorizationModel>;
+        get(storeId: string, modelId: string): Promise<FgaAuthorizationModel>;
+    };
+    /** Write and/or delete tuples in one atomic call. */
+    write(storeId: string, body: {
+        writes?: FgaTupleKeys;
+        deletes?: FgaTupleKeys;
+    }, idempotencyKey?: string): Promise<{
+        object: "fga.write_result";
+        writes: number;
+        deletes: number;
+    }>;
+    /** Query stored tuples by any of user / relation / object. */
+    read(storeId: string, body: {
+        user?: string;
+        relation?: string;
+        object?: string;
+    }): Promise<ListPage<FgaTuple>>;
+    /** Resolve a single access question against the model. */
+    check(storeId: string, body: FgaCheckBody): Promise<{
+        object: "fga.check";
+        allowed: boolean;
+        authorization_model_id: string;
+    }>;
+    /** Resolve MANY access questions in one round trip (list-authorization UIs). */
+    batchCheck(storeId: string, body: {
+        checks: FgaBatchCheckItem[];
+        authorization_model_id?: string;
+    }): Promise<FgaBatchCheckResult>;
+    /** List the objects of a type a user has a relation to. */
+    listObjects(storeId: string, body: FgaListObjectsBody): Promise<{
+        object: "fga.list_objects";
+        objects: string[];
+        authorization_model_id: string;
+    }>;
+    /** Expand the full userset tree for an object#relation. */
+    expand(storeId: string, body: {
+        object: string;
+        relation: string;
+        authorization_model_id?: string;
+    }): Promise<{
+        object: "fga.expand";
+        tree: unknown;
+        authorization_model_id: string;
+    }>;
+    /**
+     * Bind a default store so an app that uses one store (the common case) can
+     * call `fga.store(id).check({ user, relation, object })` instead of threading
+     * the store id through every call — the ergonomic OpenFGA/Auth0-FGA SDKs
+     * offer. Returns the same operations with `storeId` pre-applied.
+     */
+    store(storeId: string): {
+        write: (body: {
+            writes?: FgaTupleKeys;
+            deletes?: FgaTupleKeys;
+        }, idempotencyKey?: string) => Promise<{
+            object: "fga.write_result";
+            writes: number;
+            deletes: number;
+        }>;
+        read: (body: {
+            user?: string;
+            relation?: string;
+            object?: string;
+        }) => Promise<ListPage<FgaTuple>>;
+        check: (body: FgaCheckBody) => Promise<{
+            object: "fga.check";
+            allowed: boolean;
+            authorization_model_id: string;
+        }>;
+        batchCheck: (body: {
+            checks: FgaBatchCheckItem[];
+            authorization_model_id?: string;
+        }) => Promise<FgaBatchCheckResult>;
+        listObjects: (body: FgaListObjectsBody) => Promise<{
+            object: "fga.list_objects";
+            objects: string[];
+            authorization_model_id: string;
+        }>;
+        expand: (body: {
+            object: string;
+            relation: string;
+            authorization_model_id?: string;
+        }) => Promise<{
+            object: "fga.expand";
+            tree: unknown;
+            authorization_model_id: string;
+        }>;
+        models: {
+            list: () => Promise<ListPage<FgaAuthorizationModel>>;
+            create: (body: FgaAuthorizationModelInput, idempotencyKey?: string) => Promise<FgaAuthorizationModel>;
+            get: (modelId: string) => Promise<FgaAuthorizationModel>;
+        };
+    };
+};