@atlasauth/backend 0.1.0

package/dist/client/oauth-providers.js

@@ -0,0 +1,48 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.oauthProvidersResource = oauthProvidersResource;
+const request_1 = require("./request");
+function oauthProvidersResource(request) {
+    return {
+        /** The whole catalog, configured or not — a not-yet-set-up provider is exactly the one a setup agent wants. */
+        list() {
+            return request({ method: 'GET', path: '/v1/oauth_providers' });
+        },
+        get(provider) {
+            return request({ method: 'GET', path: `/v1/oauth_providers/${(0, request_1.enc)(provider)}` });
+        },
+        /** Set (or replace) this instance's own credentials for a provider. */
+        upsert(provider, body, idempotencyKey) {
+            return request({
+                method: 'PUT',
+                path: `/v1/oauth_providers/${(0, request_1.enc)(provider)}`,
+                body,
+                idempotencyKey,
+            });
+        },
+        delete(provider) {
+            return request({ method: 'DELETE', path: `/v1/oauth_providers/${(0, request_1.enc)(provider)}` });
+        },
+        /** Turn a configured provider on or off. Refused if it has no usable credentials. */
+        setEnabled(provider, enabled) {
+            return request({
+                method: 'POST',
+                path: `/v1/oauth_providers/${(0, request_1.enc)(provider)}/enabled`,
+                body: { enabled },
+            });
+        },
+        /** §6.5 which screens this provider serves. At least one must be true. */
+        setScope(provider, body) {
+            return request({
+                method: 'POST',
+                path: `/v1/oauth_providers/${(0, request_1.enc)(provider)}/scope`,
+                body,
+            });
+        },
+        /** Verify the stored credentials against the provider's token endpoint, without enabling it. */
+        test(provider) {
+            return request({ method: 'POST', path: `/v1/oauth_providers/${(0, request_1.enc)(provider)}/test` });
+        },
+    };
+}
+//# sourceMappingURL=oauth-providers.js.map

package/dist/client/oauth-providers.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth-providers.js","sourceRoot":"","sources":["../../src/client/oauth-providers.ts"],"names":[],"mappings":";;AAgFA,wDA2DC;AA3ID,uCAAgD;AAgFhD,SAAgB,sBAAsB,CAAC,OAAkB;IACvD,OAAO;QACL,+GAA+G;QAC/G,IAAI;YACF,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,qBAAqB,EAAE,CAAC,CAAC;QACjE,CAAC;QACD,GAAG,CAAC,QAAgB;YAClB,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,uBAAuB,IAAA,aAAG,EAAC,QAAQ,CAAC,EAAE,EAAE,CAAC,CAAC;QAClF,CAAC;QACD,uEAAuE;QACvE,MAAM,CACJ,QAAgB,EAChB,IAA6B,EAC7B,cAAuB;YAEvB,OAAO,OAAO,CAAC;gBACb,MAAM,EAAE,KAAK;gBACb,IAAI,EAAE,uBAAuB,IAAA,aAAG,EAAC,QAAQ,CAAC,EAAE;gBAC5C,IAAI;gBACJ,cAAc;aACf,CAAC,CAAC;QACL,CAAC;QACD,MAAM,CACJ,QAAgB;YAEhB,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,uBAAuB,IAAA,aAAG,EAAC,QAAQ,CAAC,EAAE,EAAE,CAAC,CAAC;QACrF,CAAC;QACD,qFAAqF;QACrF,UAAU,CACR,QAAgB,EAChB,OAAgB;YAEhB,OAAO,OAAO,CAAC;gBACb,MAAM,EAAE,MAAM;gBACd,IAAI,EAAE,uBAAuB,IAAA,aAAG,EAAC,QAAQ,CAAC,UAAU;gBACpD,IAAI,EAAE,EAAE,OAAO,EAAE;aAClB,CAAC,CAAC;QACL,CAAC;QACD,0EAA0E;QAC1E,QAAQ,CACN,QAAgB,EAChB,IAAwD;YAOxD,OAAO,OAAO,CAAC;gBACb,MAAM,EAAE,MAAM;gBACd,IAAI,EAAE,uBAAuB,IAAA,aAAG,EAAC,QAAQ,CAAC,QAAQ;gBAClD,IAAI;aACL,CAAC,CAAC;QACL,CAAC;QACD,gGAAgG;QAChG,IAAI,CAAC,QAAgB;YACnB,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,uBAAuB,IAAA,aAAG,EAAC,QAAQ,CAAC,OAAO,EAAE,CAAC,CAAC;QACxF,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/client/organizations.d.ts

@@ -0,0 +1,211 @@
+import { type RequestFn } from './request';
+import type { CursorPage, CursorParams, DataList, DeletedObject, ListPage, Metadata } from './types';
+export interface Organization {
+    object: 'organization';
+    id: string;
+    name: string;
+    slug: string;
+    image_url: string | null;
+    public_metadata: Metadata;
+    max_allowed_memberships: number;
+    created_by: string;
+    created_at: number;
+    updated_at: number;
+}
+export interface OrganizationMembership {
+    object: 'organization_membership';
+    id: string;
+    organization_id: string;
+    user_id: string;
+    role: string;
+    created_at: number;
+}
+export interface OrganizationInvitation {
+    object: 'organization_invitation';
+    id: string;
+    organization_id: string;
+    email: string;
+    role: string;
+    status: string;
+    inviter_user_id: string;
+    expires_at: number;
+    created_at: number;
+}
+export interface OrgDomain {
+    object: 'org_domain';
+    id: string;
+    organization_id: string;
+    domain: string;
+    status: string;
+    auto_join: boolean;
+    default_role_id: string | null;
+    verification: {
+        record_name: string;
+        record_type: 'TXT';
+        record_value: string;
+    };
+    verified_at: number | null;
+    last_checked_at: number | null;
+    created_at: number;
+}
+export interface OrganizationPolicy {
+    object: 'organization_policy';
+    organization_id: string;
+    policy: Record<string, unknown>;
+}
+export interface OrganizationHierarchy {
+    object: 'organization_hierarchy';
+    organization_id: string;
+    ancestors: Array<{
+        id: string;
+        name: string;
+        slug: string;
+    }>;
+    children: Array<{
+        id: string;
+        name: string;
+        slug: string;
+    }>;
+}
+export interface OrganizationEntitlements {
+    object: 'organization_entitlements';
+    organization_id: string;
+    plan: string | null;
+    features: Record<string, unknown>;
+    catalog: {
+        features: unknown;
+        plans: unknown;
+    };
+}
+export interface CreateOrganizationBody {
+    name: string;
+    slug: string;
+    created_by: string;
+    max_allowed_memberships?: number;
+}
+export interface UpdateOrganizationBody {
+    name?: string;
+    slug?: string;
+    image_url?: string;
+    max_allowed_memberships?: number;
+    public_metadata?: Metadata;
+    private_metadata?: Metadata;
+}
+export interface ReplaceOrganizationMetadataBody {
+    public_metadata?: Metadata;
+    private_metadata?: Metadata;
+}
+/** The org security policy patch (§4.4). Fields are camelCase on this route. */
+export interface OrganizationPolicyPatch {
+    requireMfa?: boolean;
+    ssoRequired?: boolean;
+    sessionIdleOverrideMs?: number | null;
+    [key: string]: unknown;
+}
+export declare function organizationsResource(request: RequestFn): {
+    list(params?: CursorParams): Promise<CursorPage<Organization>>;
+    get(id: string): Promise<Organization>;
+    create(body: CreateOrganizationBody, idempotencyKey?: string): Promise<Organization>;
+    update(id: string, body: UpdateOrganizationBody): Promise<Organization>;
+    delete(id: string): Promise<DeletedObject>;
+    /** `PUT /v1/organizations/:id/metadata` — replaces the named bags wholesale. */
+    updateMetadata(id: string, body: ReplaceOrganizationMetadataBody): Promise<Organization>;
+    /** `PATCH /v1/organizations/:id/policy`. */
+    updatePolicy(id: string, body: OrganizationPolicyPatch): Promise<OrganizationPolicy>;
+    /**
+     * `PUT /v1/organizations/:id/parent` — set (or clear, with null) the org's
+     * parent in the B2B2B hierarchy. A cycle is refused; clearing re-parents to
+     * top level.
+     */
+    setParent(id: string, body: {
+        parent_organization_id: string | null;
+    }): Promise<Organization>;
+    /** `GET /v1/organizations/:id/hierarchy` — ancestor chain (nearest first) + direct children. */
+    hierarchy(id: string): Promise<OrganizationHierarchy>;
+    /**
+     * `GET /v1/organizations/:id/entitlements` — the org's active feature set,
+     * resolved from its assigned plan + overrides against the instance catalog.
+     */
+    entitlements(id: string): Promise<OrganizationEntitlements>;
+    memberships: {
+        list(orgId: string): Promise<{
+            data: OrganizationMembership[];
+            has_more: boolean;
+        }>;
+        add(orgId: string, body: {
+            user_id: string;
+            role?: string;
+        }, idempotencyKey?: string): Promise<{
+            object: "organization_membership";
+            organization_id: string;
+            user_id: string;
+            role: string;
+        }>;
+        update(orgId: string, userId: string, body: {
+            role: string;
+        }): Promise<{
+            object: "organization_membership";
+            role: string;
+            updated: true;
+        }>;
+        remove(orgId: string, userId: string): Promise<{
+            object: "organization_membership";
+            deleted: true;
+        }>;
+    };
+    invitations: {
+        list(orgId: string): Promise<ListPage<OrganizationInvitation>>;
+        create(orgId: string, body: {
+            email: string;
+            role: string;
+            inviter_user_id: string;
+        }, idempotencyKey?: string): Promise<{
+            object: "organization_invitation";
+            id: string;
+            organization_id: string;
+            email: string;
+            status: string;
+            expires_at: number;
+        }>;
+        revoke(orgId: string, invitationId: string): Promise<{
+            object: "organization_invitation";
+            id: string;
+            status: "revoked";
+        }>;
+    };
+    domains: {
+        list(orgId: string): Promise<DataList<OrgDomain> & {
+            object: "list";
+        }>;
+        create(orgId: string, body: {
+            domain: string;
+            auto_join?: boolean;
+            default_role_id?: string | null;
+        }, idempotencyKey?: string): Promise<OrgDomain>;
+        verify(orgId: string, domainId: string): Promise<OrgDomain & {
+            verified: boolean;
+        }>;
+        delete(orgId: string, domainId: string): Promise<{
+            object: "org_domain";
+            id: string;
+            deleted: true;
+        }>;
+    };
+    /** Directory-group → role grants that augment members' permissions. */
+    groupRoles: {
+        grant(orgId: string, groupId: string, roleId: string): Promise<{
+            object: "group_role_grant";
+            organization_id: string;
+            group_id: string;
+            role_id: string;
+            granted: true;
+        }>;
+        revoke(orgId: string, groupId: string, roleId: string): Promise<{
+            object: "group_role_grant";
+            organization_id: string;
+            group_id: string;
+            role_id: string;
+            deleted: boolean;
+        }>;
+    };
+};

package/dist/client/organizations.js

@@ -0,0 +1,136 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.organizationsResource = organizationsResource;
+const request_1 = require("./request");
+function organizationsResource(request) {
+    return {
+        list(params = {}) {
+            return request({ method: 'GET', path: '/v1/organizations', query: { ...params } });
+        },
+        get(id) {
+            return request({ method: 'GET', path: `/v1/organizations/${(0, request_1.enc)(id)}` });
+        },
+        create(body, idempotencyKey) {
+            return request({ method: 'POST', path: '/v1/organizations', body, idempotencyKey });
+        },
+        update(id, body) {
+            return request({ method: 'PATCH', path: `/v1/organizations/${(0, request_1.enc)(id)}`, body });
+        },
+        delete(id) {
+            return request({ method: 'DELETE', path: `/v1/organizations/${(0, request_1.enc)(id)}` });
+        },
+        /** `PUT /v1/organizations/:id/metadata` — replaces the named bags wholesale. */
+        updateMetadata(id, body) {
+            return request({ method: 'PUT', path: `/v1/organizations/${(0, request_1.enc)(id)}/metadata`, body });
+        },
+        /** `PATCH /v1/organizations/:id/policy`. */
+        updatePolicy(id, body) {
+            return request({ method: 'PATCH', path: `/v1/organizations/${(0, request_1.enc)(id)}/policy`, body });
+        },
+        /**
+         * `PUT /v1/organizations/:id/parent` — set (or clear, with null) the org's
+         * parent in the B2B2B hierarchy. A cycle is refused; clearing re-parents to
+         * top level.
+         */
+        setParent(id, body) {
+            return request({ method: 'PUT', path: `/v1/organizations/${(0, request_1.enc)(id)}/parent`, body });
+        },
+        /** `GET /v1/organizations/:id/hierarchy` — ancestor chain (nearest first) + direct children. */
+        hierarchy(id) {
+            return request({ method: 'GET', path: `/v1/organizations/${(0, request_1.enc)(id)}/hierarchy` });
+        },
+        /**
+         * `GET /v1/organizations/:id/entitlements` — the org's active feature set,
+         * resolved from its assigned plan + overrides against the instance catalog.
+         */
+        entitlements(id) {
+            return request({ method: 'GET', path: `/v1/organizations/${(0, request_1.enc)(id)}/entitlements` });
+        },
+        memberships: {
+            list(orgId) {
+                return request({ method: 'GET', path: `/v1/organizations/${(0, request_1.enc)(orgId)}/memberships` });
+            },
+            add(orgId, body, idempotencyKey) {
+                return request({
+                    method: 'POST',
+                    path: `/v1/organizations/${(0, request_1.enc)(orgId)}/memberships`,
+                    body,
+                    idempotencyKey,
+                });
+            },
+            update(orgId, userId, body) {
+                return request({
+                    method: 'PATCH',
+                    path: `/v1/organizations/${(0, request_1.enc)(orgId)}/memberships/${(0, request_1.enc)(userId)}`,
+                    body,
+                });
+            },
+            remove(orgId, userId) {
+                return request({
+                    method: 'DELETE',
+                    path: `/v1/organizations/${(0, request_1.enc)(orgId)}/memberships/${(0, request_1.enc)(userId)}`,
+                });
+            },
+        },
+        invitations: {
+            list(orgId) {
+                return request({ method: 'GET', path: `/v1/organizations/${(0, request_1.enc)(orgId)}/invitations` });
+            },
+            create(orgId, body, idempotencyKey) {
+                return request({
+                    method: 'POST',
+                    path: `/v1/organizations/${(0, request_1.enc)(orgId)}/invitations`,
+                    body,
+                    idempotencyKey,
+                });
+            },
+            revoke(orgId, invitationId) {
+                return request({
+                    method: 'POST',
+                    path: `/v1/organizations/${(0, request_1.enc)(orgId)}/invitations/${(0, request_1.enc)(invitationId)}/revoke`,
+                });
+            },
+        },
+        domains: {
+            list(orgId) {
+                return request({ method: 'GET', path: `/v1/organizations/${(0, request_1.enc)(orgId)}/domains` });
+            },
+            create(orgId, body, idempotencyKey) {
+                return request({
+                    method: 'POST',
+                    path: `/v1/organizations/${(0, request_1.enc)(orgId)}/domains`,
+                    body,
+                    idempotencyKey,
+                });
+            },
+            verify(orgId, domainId) {
+                return request({
+                    method: 'POST',
+                    path: `/v1/organizations/${(0, request_1.enc)(orgId)}/domains/${(0, request_1.enc)(domainId)}/verify`,
+                });
+            },
+            delete(orgId, domainId) {
+                return request({
+                    method: 'DELETE',
+                    path: `/v1/organizations/${(0, request_1.enc)(orgId)}/domains/${(0, request_1.enc)(domainId)}`,
+                });
+            },
+        },
+        /** Directory-group → role grants that augment members' permissions. */
+        groupRoles: {
+            grant(orgId, groupId, roleId) {
+                return request({
+                    method: 'PUT',
+                    path: `/v1/organizations/${(0, request_1.enc)(orgId)}/groups/${(0, request_1.enc)(groupId)}/roles/${(0, request_1.enc)(roleId)}`,
+                });
+            },
+            revoke(orgId, groupId, roleId) {
+                return request({
+                    method: 'DELETE',
+                    path: `/v1/organizations/${(0, request_1.enc)(orgId)}/groups/${(0, request_1.enc)(groupId)}/roles/${(0, request_1.enc)(roleId)}`,
+                });
+            },
+        },
+    };
+}
+//# sourceMappingURL=organizations.js.map

package/dist/client/organizations.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"organizations.js","sourceRoot":"","sources":["../../src/client/organizations.ts"],"names":[],"mappings":";;AAyGA,sDA+LC;AAxSD,uCAAgD;AAyGhD,SAAgB,qBAAqB,CAAC,OAAkB;IACtD,OAAO;QACL,IAAI,CAAC,SAAuB,EAAE;YAC5B,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,mBAAmB,EAAE,KAAK,EAAE,EAAE,GAAG,MAAM,EAAE,EAAE,CAAC,CAAC;QACrF,CAAC;QACD,GAAG,CAAC,EAAU;YACZ,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,qBAAqB,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;QAC1E,CAAC;QACD,MAAM,CAAC,IAA4B,EAAE,cAAuB;YAC1D,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,mBAAmB,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC;QACtF,CAAC;QACD,MAAM,CAAC,EAAU,EAAE,IAA4B;YAC7C,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,qBAAqB,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;QAClF,CAAC;QACD,MAAM,CAAC,EAAU;YACf,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,qBAAqB,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;QAC7E,CAAC;QACD,gFAAgF;QAChF,cAAc,CAAC,EAAU,EAAE,IAAqC;YAC9D,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,qBAAqB,IAAA,aAAG,EAAC,EAAE,CAAC,WAAW,EAAE,IAAI,EAAE,CAAC,CAAC;QACzF,CAAC;QACD,4CAA4C;QAC5C,YAAY,CAAC,EAAU,EAAE,IAA6B;YACpD,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,qBAAqB,IAAA,aAAG,EAAC,EAAE,CAAC,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACzF,CAAC;QACD;;;;WAIG;QACH,SAAS,CAAC,EAAU,EAAE,IAA+C;YACnE,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,qBAAqB,IAAA,aAAG,EAAC,EAAE,CAAC,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACvF,CAAC;QACD,gGAAgG;QAChG,SAAS,CAAC,EAAU;YAClB,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,qBAAqB,IAAA,aAAG,EAAC,EAAE,CAAC,YAAY,EAAE,CAAC,CAAC;QACpF,CAAC;QACD;;;WAGG;QACH,YAAY,CAAC,EAAU;YACrB,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,qBAAqB,IAAA,aAAG,EAAC,EAAE,CAAC,eAAe,EAAE,CAAC,CAAC;QACvF,CAAC;QAED,WAAW,EAAE;YACX,IAAI,CAAC,KAAa;gBAChB,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,qBAAqB,IAAA,aAAG,EAAC,KAAK,CAAC,cAAc,EAAE,CAAC,CAAC;YACzF,CAAC;YACD,GAAG,CACD,KAAa,EACb,IAAwC,EACxC,cAAuB;gBAOvB,OAAO,OAAO,CAAC;oBACb,MAAM,EAAE,MAAM;oBACd,IAAI,EAAE,qBAAqB,IAAA,aAAG,EAAC,KAAK,CAAC,cAAc;oBACnD,IAAI;oBACJ,cAAc;iBACf,CAAC,CAAC;YACL,CAAC;YACD,MAAM,CACJ,KAAa,EACb,MAAc,EACd,IAAsB;gBAEtB,OAAO,OAAO,CAAC;oBACb,MAAM,EAAE,OAAO;oBACf,IAAI,EAAE,qBAAqB,IAAA,aAAG,EAAC,KAAK,CAAC,gBAAgB,IAAA,aAAG,EAAC,MAAM,CAAC,EAAE;oBAClE,IAAI;iBACL,CAAC,CAAC;YACL,CAAC;YACD,MAAM,CACJ,KAAa,EACb,MAAc;gBAEd,OAAO,OAAO,CAAC;oBACb,MAAM,EAAE,QAAQ;oBAChB,IAAI,EAAE,qBAAqB,IAAA,aAAG,EAAC,KAAK,CAAC,gBAAgB,IAAA,aAAG,EAAC,MAAM,CAAC,EAAE;iBACnE,CAAC,CAAC;YACL,CAAC;SACF;QAED,WAAW,EAAE;YACX,IAAI,CAAC,KAAa;gBAChB,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,qBAAqB,IAAA,aAAG,EAAC,KAAK,CAAC,cAAc,EAAE,CAAC,CAAC;YACzF,CAAC;YACD,MAAM,CACJ,KAAa,EACb,IAA8D,EAC9D,cAAuB;gBASvB,OAAO,OAAO,CAAC;oBACb,MAAM,EAAE,MAAM;oBACd,IAAI,EAAE,qBAAqB,IAAA,aAAG,EAAC,KAAK,CAAC,cAAc;oBACnD,IAAI;oBACJ,cAAc;iBACf,CAAC,CAAC;YACL,CAAC;YACD,MAAM,CACJ,KAAa,EACb,YAAoB;gBAEpB,OAAO,OAAO,CAAC;oBACb,MAAM,EAAE,MAAM;oBACd,IAAI,EAAE,qBAAqB,IAAA,aAAG,EAAC,KAAK,CAAC,gBAAgB,IAAA,aAAG,EAAC,YAAY,CAAC,SAAS;iBAChF,CAAC,CAAC;YACL,CAAC;SACF;QAED,OAAO,EAAE;YACP,IAAI,CAAC,KAAa;gBAChB,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,qBAAqB,IAAA,aAAG,EAAC,KAAK,CAAC,UAAU,EAAE,CAAC,CAAC;YACrF,CAAC;YACD,MAAM,CACJ,KAAa,EACb,IAA8E,EAC9E,cAAuB;gBAEvB,OAAO,OAAO,CAAC;oBACb,MAAM,EAAE,MAAM;oBACd,IAAI,EAAE,qBAAqB,IAAA,aAAG,EAAC,KAAK,CAAC,UAAU;oBAC/C,IAAI;oBACJ,cAAc;iBACf,CAAC,CAAC;YACL,CAAC;YACD,MAAM,CAAC,KAAa,EAAE,QAAgB;gBACpC,OAAO,OAAO,CAAC;oBACb,MAAM,EAAE,MAAM;oBACd,IAAI,EAAE,qBAAqB,IAAA,aAAG,EAAC,KAAK,CAAC,YAAY,IAAA,aAAG,EAAC,QAAQ,CAAC,SAAS;iBACxE,CAAC,CAAC;YACL,CAAC;YACD,MAAM,CACJ,KAAa,EACb,QAAgB;gBAEhB,OAAO,OAAO,CAAC;oBACb,MAAM,EAAE,QAAQ;oBAChB,IAAI,EAAE,qBAAqB,IAAA,aAAG,EAAC,KAAK,CAAC,YAAY,IAAA,aAAG,EAAC,QAAQ,CAAC,EAAE;iBACjE,CAAC,CAAC;YACL,CAAC;SACF;QAED,uEAAuE;QACvE,UAAU,EAAE;YACV,KAAK,CACH,KAAa,EACb,OAAe,EACf,MAAc;gBAQd,OAAO,OAAO,CAAC;oBACb,MAAM,EAAE,KAAK;oBACb,IAAI,EAAE,qBAAqB,IAAA,aAAG,EAAC,KAAK,CAAC,WAAW,IAAA,aAAG,EAAC,OAAO,CAAC,UAAU,IAAA,aAAG,EAAC,MAAM,CAAC,EAAE;iBACpF,CAAC,CAAC;YACL,CAAC;YACD,MAAM,CACJ,KAAa,EACb,OAAe,EACf,MAAc;gBAQd,OAAO,OAAO,CAAC;oBACb,MAAM,EAAE,QAAQ;oBAChB,IAAI,EAAE,qBAAqB,IAAA,aAAG,EAAC,KAAK,CAAC,WAAW,IAAA,aAAG,EAAC,OAAO,CAAC,UAAU,IAAA,aAAG,EAAC,MAAM,CAAC,EAAE;iBACpF,CAAC,CAAC;YACL,CAAC;SACF;KACF,CAAC;AACJ,CAAC"}

package/dist/client/paginate.d.ts

@@ -0,0 +1,16 @@
+import type { CursorPage, CursorParams } from './types';
+/**
+ * Walk every page of a cursor-paginated BAPI list, yielding items one at a
+ * time. Works with any resource `list` that takes `{ limit?, starting_after? }`
+ * and returns a `{ data, has_more, next_cursor }` page — `users.list`,
+ * `organizations.list`, `invitations.list`, `auditLogs.list`, `waitlist.list`.
+ *
+ *   for await (const user of paginate(atlas.users.list)) { ... }
+ *
+ * Kept as a free function rather than bolted onto every return value: the page
+ * is the primitive most callers want, and a caller who needs the whole set
+ * opts into the extra round trips explicitly.
+ */
+export declare function paginate<T, P extends CursorParams>(list: (params: P) => Promise<CursorPage<T>>, params?: P): AsyncGenerator<T, void, void>;
+/** Collect every page of a cursor-paginated list into a single array. */
+export declare function collect<T, P extends CursorParams>(list: (params: P) => Promise<CursorPage<T>>, params?: P): Promise<T[]>;

package/dist/client/paginate.js

@@ -0,0 +1,35 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.paginate = paginate;
+exports.collect = collect;
+/**
+ * Walk every page of a cursor-paginated BAPI list, yielding items one at a
+ * time. Works with any resource `list` that takes `{ limit?, starting_after? }`
+ * and returns a `{ data, has_more, next_cursor }` page — `users.list`,
+ * `organizations.list`, `invitations.list`, `auditLogs.list`, `waitlist.list`.
+ *
+ *   for await (const user of paginate(atlas.users.list)) { ... }
+ *
+ * Kept as a free function rather than bolted onto every return value: the page
+ * is the primitive most callers want, and a caller who needs the whole set
+ * opts into the extra round trips explicitly.
+ */
+async function* paginate(list, params = {}) {
+    let cursor = params.starting_after;
+    for (;;) {
+        const page = await list({ ...params, starting_after: cursor });
+        for (const item of page.data)
+            yield item;
+        if (!page.has_more || !page.next_cursor)
+            return;
+        cursor = page.next_cursor;
+    }
+}
+/** Collect every page of a cursor-paginated list into a single array. */
+async function collect(list, params = {}) {
+    const out = [];
+    for await (const item of paginate(list, params))
+        out.push(item);
+    return out;
+}
+//# sourceMappingURL=paginate.js.map

package/dist/client/paginate.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"paginate.js","sourceRoot":"","sources":["../../src/client/paginate.ts"],"names":[],"mappings":";;AAcA,4BAWC;AAGD,0BAOC;AAjCD;;;;;;;;;;;GAWG;AACI,KAAK,SAAS,CAAC,CAAC,QAAQ,CAC7B,IAA2C,EAC3C,SAAY,EAAO;IAEnB,IAAI,MAAM,GAAG,MAAM,CAAC,cAAc,CAAC;IACnC,SAAS,CAAC;QACR,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,EAAE,GAAG,MAAM,EAAE,cAAc,EAAE,MAAM,EAAE,CAAC,CAAC;QAC/D,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,IAAI;YAAE,MAAM,IAAI,CAAC;QACzC,IAAI,CAAC,IAAI,CAAC,QAAQ,IAAI,CAAC,IAAI,CAAC,WAAW;YAAE,OAAO;QAChD,MAAM,GAAG,IAAI,CAAC,WAAW,CAAC;IAC5B,CAAC;AACH,CAAC;AAED,yEAAyE;AAClE,KAAK,UAAU,OAAO,CAC3B,IAA2C,EAC3C,SAAY,EAAO;IAEnB,MAAM,GAAG,GAAQ,EAAE,CAAC;IACpB,IAAI,KAAK,EAAE,MAAM,IAAI,IAAI,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;QAAE,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAChE,OAAO,GAAG,CAAC;AACb,CAAC"}

package/dist/client/radius-clients.d.ts

@@ -0,0 +1,52 @@
+import { type RequestFn } from './request';
+import type { ListPage } from './types';
+/**
+ * A RADIUS NAS client — a VPN concentrator, WiFi controller, or firewall allowed
+ * to authenticate this instance's users against the shared Atlas RADIUS listener.
+ *
+ * The per-NAS `shared_secret` is WRITE-ONLY: it is sent on create/update but no
+ * read ever returns it — a view reports only `has_secret`.
+ */
+export interface RadiusClient {
+    object: 'radius_client';
+    id: string;
+    name: string;
+    nas_identifier: string;
+    ip_address: string | null;
+    /** Whether a shared secret is stored — never the secret itself. */
+    has_secret: boolean;
+    /** Blast-RADIUS (CVE-2024-3596) hardening: require attr 80 on Access-Requests. */
+    require_message_authenticator: boolean;
+    enabled: boolean;
+    created_at: number;
+    updated_at: number;
+}
+export interface CreateRadiusClientBody {
+    name: string;
+    nas_identifier: string;
+    shared_secret: string;
+    /** An optional exact source-IP match — a single address, not a CIDR range. */
+    ip_address?: string | null;
+    require_message_authenticator?: boolean;
+    enabled?: boolean;
+}
+export interface UpdateRadiusClientBody {
+    name?: string;
+    nas_identifier?: string;
+    /** Omit or send empty to keep the stored secret (write-only edit). */
+    shared_secret?: string;
+    ip_address?: string | null;
+    require_message_authenticator?: boolean;
+    enabled?: boolean;
+}
+export declare function radiusClientsResource(request: RequestFn): {
+    list(): Promise<ListPage<RadiusClient>>;
+    create(body: CreateRadiusClientBody, idempotencyKey?: string): Promise<RadiusClient>;
+    get(id: string): Promise<RadiusClient>;
+    update(id: string, body: UpdateRadiusClientBody): Promise<RadiusClient>;
+    delete(id: string): Promise<{
+        object: "radius_client";
+        id: string;
+        deleted: true;
+    }>;
+};

package/dist/client/radius-clients.js

@@ -0,0 +1,24 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.radiusClientsResource = radiusClientsResource;
+const request_1 = require("./request");
+function radiusClientsResource(request) {
+    return {
+        list() {
+            return request({ method: 'GET', path: '/v1/radius_clients' });
+        },
+        create(body, idempotencyKey) {
+            return request({ method: 'POST', path: '/v1/radius_clients', body, idempotencyKey });
+        },
+        get(id) {
+            return request({ method: 'GET', path: `/v1/radius_clients/${(0, request_1.enc)(id)}` });
+        },
+        update(id, body) {
+            return request({ method: 'PATCH', path: `/v1/radius_clients/${(0, request_1.enc)(id)}`, body });
+        },
+        delete(id) {
+            return request({ method: 'DELETE', path: `/v1/radius_clients/${(0, request_1.enc)(id)}` });
+        },
+    };
+}
+//# sourceMappingURL=radius-clients.js.map

package/dist/client/radius-clients.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"radius-clients.js","sourceRoot":"","sources":["../../src/client/radius-clients.ts"],"names":[],"mappings":";;AA6CA,sDAkBC;AA/DD,uCAAgD;AA6ChD,SAAgB,qBAAqB,CAAC,OAAkB;IACtD,OAAO;QACL,IAAI;YACF,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,oBAAoB,EAAE,CAAC,CAAC;QAChE,CAAC;QACD,MAAM,CAAC,IAA4B,EAAE,cAAuB;YAC1D,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,oBAAoB,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC;QACvF,CAAC;QACD,GAAG,CAAC,EAAU;YACZ,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,sBAAsB,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;QAC3E,CAAC;QACD,MAAM,CAAC,EAAU,EAAE,IAA4B;YAC7C,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,sBAAsB,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;QACnF,CAAC;QACD,MAAM,CAAC,EAAU;YACf,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,sBAAsB,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;QAC9E,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/client/rate-limit.d.ts

@@ -0,0 +1,37 @@
+import { type RequestFn } from './request';
+/** The min/max a single knob is clamped to on write. */
+export interface RateLimitBound {
+    min: number;
+    max: number;
+}
+/**
+ * §9.1 per-instance rate-limit policy — tunable budgets over the built-in
+ * request limiter. Both knobs default to the built-in fixed values, so an unset
+ * policy changes nothing.
+ */
+export interface RateLimitPolicy {
+    object: 'rate_limit_policy';
+    /** Sign-in / sign-up CREATE budget, per IP. Sign-in and sign-up share it. */
+    fapi_create_per_min: number;
+    /** Backend-API budget, per secret key. */
+    bapi_per_min: number;
+    /** The floor/ceiling each knob is bounded to when written. */
+    bounds: {
+        fapi_create_per_min: RateLimitBound;
+        bapi_per_min: RateLimitBound;
+    };
+}
+export interface UpdateRateLimitPolicyBody {
+    fapi_create_per_min?: number;
+    bapi_per_min?: number;
+}
+/**
+ * Read and tune the instance's rate-limit policy — the two budgets layered over
+ * the built-in limiter's fixed buckets.
+ */
+export declare function rateLimitPolicyResource(request: RequestFn): {
+    /** Read the current policy and the bounds each knob is clamped to. */
+    get(): Promise<RateLimitPolicy>;
+    /** Adjust either budget; omitted knobs are left unchanged. */
+    update(body: UpdateRateLimitPolicyBody): Promise<RateLimitPolicy>;
+};

package/dist/client/rate-limit.js

@@ -0,0 +1,20 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.rateLimitPolicyResource = rateLimitPolicyResource;
+/**
+ * Read and tune the instance's rate-limit policy — the two budgets layered over
+ * the built-in limiter's fixed buckets.
+ */
+function rateLimitPolicyResource(request) {
+    return {
+        /** Read the current policy and the bounds each knob is clamped to. */
+        get() {
+            return request({ method: 'GET', path: '/v1/rate_limit_policy' });
+        },
+        /** Adjust either budget; omitted knobs are left unchanged. */
+        update(body) {
+            return request({ method: 'PATCH', path: '/v1/rate_limit_policy', body });
+        },
+    };
+}
+//# sourceMappingURL=rate-limit.js.map

package/dist/client/rate-limit.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"rate-limit.js","sourceRoot":"","sources":["../../src/client/rate-limit.ts"],"names":[],"mappings":";;AAmCA,0DAWC;AAfD;;;GAGG;AACH,SAAgB,uBAAuB,CAAC,OAAkB;IACxD,OAAO;QACL,sEAAsE;QACtE,GAAG;YACD,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,uBAAuB,EAAE,CAAC,CAAC;QACnE,CAAC;QACD,8DAA8D;QAC9D,MAAM,CAAC,IAA+B;YACpC,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,uBAAuB,EAAE,IAAI,EAAE,CAAC,CAAC;QAC3E,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/client/request.d.ts

@@ -0,0 +1,52 @@
+/**
+ * The shared HTTP core every resource namespace calls. One place decides how a
+ * BAPI request is authenticated, serialized, and how a failure becomes an
+ * {@link AtlasApiError} — so a namespace method is a one-liner naming a method,
+ * a path, and its shapes.
+ *
+ * Deliberately built on nothing but `fetch`. `@atlasauth/backend` verifies tokens
+ * on customers' hot paths — Node servers, edge workers, serverless — and a
+ * management client that dragged in a Node-only HTTP stack would not run in
+ * half of them. `fetch` is the one primitive present everywhere (Node 18+,
+ * Deno, Bun, browsers, edge) and is injectable so tests need no network.
+ */
+export interface AtlasClientConfig {
+    /**
+     * The instance secret key (`sk_...`). Sent as `Authorization: Bearer <key>`
+     * on every request and never logged, never placed in a URL.
+     */
+    secretKey: string;
+    /**
+     * Base URL of the instance's Backend API, e.g. `https://api.atlas.dev`. The
+     * `/v1/...` path is appended by each method. Trailing slashes are tolerated.
+     */
+    apiUrl?: string;
+    /** Injectable `fetch`, for tests and non-global-fetch runtimes. */
+    fetch?: typeof fetch;
+}
+/** The default BAPI origin, overridable per instance via `apiUrl`. */
+export declare const DEFAULT_API_URL = "https://api.atlas.dev";
+export type QueryValue = string | number | boolean | undefined | null;
+export type QueryParams = Record<string, QueryValue | QueryValue[]>;
+export interface RequestOptions {
+    method: 'GET' | 'POST' | 'PATCH' | 'PUT' | 'DELETE';
+    /** Path beginning with `/v1/...`; already interpolated (no `:params`). */
+    path: string;
+    query?: QueryParams;
+    /** JSON body; omitted entirely when undefined. */
+    body?: unknown;
+    /** Idempotency-Key header (§9.1), when a caller supplies one. */
+    idempotencyKey?: string;
+    /** When true, the raw text body is returned instead of parsed JSON (SAML XML). */
+    raw?: boolean;
+}
+/** Serialize a query object to a string, dropping null/undefined, spreading arrays. */
+export declare function serializeQuery(query: QueryParams | undefined): string;
+/** Percent-encode a single path segment (an id, slug, provider name). */
+export declare function enc(segment: string): string;
+/**
+ * The bound request function each namespace receives. Resolves the config once
+ * (base URL, fetch impl) so per-call sites stay declarative.
+ */
+export type RequestFn = <T>(options: RequestOptions) => Promise<T>;
+export declare function createRequest(config: AtlasClientConfig): RequestFn;