@atlasauth/backend 0.15.0 → 0.16.0

package/dist/client/billing-plans.d.ts

@@ -15,11 +15,22 @@ export interface BillingPlan {
     amount: string | null;
     currency: string;
     features: string[];
+    /** Numeric limits the plan grants (the `ent.limits` claim); `-1` = unlimited. */
+    limits?: Record<string, unknown>;
     audience: string;
     active: boolean;
+    /** stripe | polar | dodo | creem | chargebee | autumn | commet */
+    provider?: BillingProviderName;
+    /** The plan's price reference on its provider. */
+    provider_price_id?: string | null;
+    /** `base`: the subject's main plan. `addon`: bought alongside it; several may be live. */
+    kind?: 'base' | 'addon';
+    /** Autumn plans: the feature whose usage tracks the org's member count. */
+    seat_feature_id?: string | null;
     created_at: number;
     updated_at: number;
 }
+export type BillingProviderName = 'stripe' | 'polar' | 'dodo' | 'creem' | 'chargebee' | 'autumn' | 'commet';
 /**
  * A read view of who is subscribed. `status` is written ONLY by the verified
  * Stripe webhook, never through this SDK.
@@ -34,9 +45,55 @@ export interface BillingSubscription {
     stripe_subscription_id: string | null;
     stripe_customer_id: string | null;
     current_period_end: number | null;
+    provider?: BillingProviderName;
+    provider_subscription_id?: string | null;
+    provider_customer_id?: string | null;
+    quantity?: number;
+    cancel_at_period_end?: boolean;
+    /** What an entitlement provider (Autumn, Commet) reports this subscription grants. */
+    entitlements?: {
+        features: string[];
+        limits: Record<string, number>;
+    } | null;
     created_at: number;
     updated_at: number;
 }
+/** How numeric limits merge when a subject holds several entitling subscriptions. */
+export interface BillingSettings {
+    object: 'billing_settings';
+    default_limit_merge: 'max' | 'sum';
+    limit_merge: Record<string, 'max' | 'sum'>;
+}
+export interface UpdateBillingSettingsBody {
+    default_limit_merge?: 'max' | 'sum';
+    /** Limit key → `max` | `sum`; replaces the stored map. */
+    limit_merge?: Record<string, 'max' | 'sum'>;
+}
+/** May a subject use a feature? */
+export interface CheckBillingFeatureBody {
+    subject_type: 'user' | 'org';
+    subject_id: string;
+    feature: string;
+    /** Units about to be used (default 1). */
+    required?: number;
+}
+export interface BillingFeatureCheck {
+    object: 'billing_feature_check';
+    feature: string;
+    allowed: boolean;
+    /** `provider`: asked live of Autumn/Commet; `atlas`: from the resolved entitlement. */
+    source: 'provider' | 'atlas';
+    provider: string | null;
+    remaining: number | null;
+    granted: number | null;
+    usage: number | null;
+    unlimited: boolean;
+}
+export interface ChangeBillingSubscriptionBody {
+    plan_id: string;
+    interval?: 'month' | 'year';
+    schedule_at_period_end?: boolean;
+}
 export interface CreateBillingPlanBody {
     name: string;
     slug: string;
@@ -49,6 +106,13 @@ export interface CreateBillingPlanBody {
     /** One of `user`, `org`. Defaults to `user`. */
     audience?: string;
     active?: boolean;
+    limits?: Record<string, unknown>;
+    provider?: BillingProviderName;
+    provider_price_id?: string;
+    /** `base` (default) or `addon`. */
+    kind?: 'base' | 'addon';
+    /** Autumn: one of the plan's features; its usage follows the org's member count. */
+    seat_feature_id?: string | null;
 }
 export interface UpdateBillingPlanBody {
     name?: string;
@@ -60,6 +124,12 @@ export interface UpdateBillingPlanBody {
     features?: string[];
     audience?: string;
     active?: boolean;
+    limits?: Record<string, unknown>;
+    provider?: BillingProviderName;
+    provider_price_id?: string;
+    kind?: 'base' | 'addon';
+    /** `null` clears it. */
+    seat_feature_id?: string | null;
 }
 /** Filter the subscription read view to one subject. */
 export interface ListSubscriptionsParams {
@@ -83,6 +153,10 @@ export interface ReportBillingUsageBody {
     /** Non-negative. */
     quantity: number;
     idempotency_key: string;
+    /** Count against this provider feature (an Autumn feature id / Commet feature code). */
+    feature?: string;
+    /** Attribute to this subscription when the subject holds several. */
+    subscription_id?: string;
 }
 export interface BillingUsageReport {
     object: 'billing_usage';
@@ -109,6 +183,25 @@ export declare function billingResource(request: RequestFn): {
         deleted: true;
     }>;
     listSubscriptions(params?: ListSubscriptionsParams): Promise<ListPage<BillingSubscription>>;
+    /** One subscription by id (a subject may hold several: a base plan + add-ons). */
+    getSubscription(id: string): Promise<BillingSubscription>;
+    /** Move one subscription to another plan or interval (now, or at the period end). */
+    changeSubscription(id: string, body: ChangeBillingSubscriptionBody): Promise<BillingSubscription & {
+        scheduled: boolean;
+    }>;
+    /** Cancel one subscription at the period end (default) or now. */
+    cancelSubscription(id: string, body?: {
+        immediately?: boolean;
+    }): Promise<BillingSubscription>;
+    /** Undo a cancellation scheduled for the period end. */
+    restoreSubscription(id: string): Promise<BillingSubscription>;
+    /** Mirror a plan's features/limits from its provider (Autumn, Commet). */
+    syncPlanEntitlements(id: string): Promise<BillingPlan>;
+    /** How limits merge across a subject's several subscriptions. */
+    getSettings(): Promise<BillingSettings>;
+    updateSettings(body: UpdateBillingSettingsBody): Promise<BillingSettings>;
+    /** May a subject use a feature? Live from Autumn/Commet when the subject is on one. */
+    checkFeature(body: CheckBillingFeatureBody): Promise<BillingFeatureCheck>;
     /**
      * Adopt an EXISTING Stripe subscription onto a user/org + plan, for
      * migrating billing into Atlas without re-charging. Read-only on Stripe.

package/dist/client/billing-plans.js

@@ -22,6 +22,37 @@ function billingResource(request) {
         listSubscriptions(params) {
             return request({ method: 'GET', path: '/v1/billing/subscriptions', query: { ...params } });
         },
+        /** One subscription by id (a subject may hold several: a base plan + add-ons). */
+        getSubscription(id) {
+            return request({ method: 'GET', path: `/v1/billing/subscriptions/${(0, request_1.enc)(id)}` });
+        },
+        /** Move one subscription to another plan or interval (now, or at the period end). */
+        changeSubscription(id, body) {
+            return request({ method: 'POST', path: `/v1/billing/subscriptions/${(0, request_1.enc)(id)}/change`, body });
+        },
+        /** Cancel one subscription at the period end (default) or now. */
+        cancelSubscription(id, body = {}) {
+            return request({ method: 'POST', path: `/v1/billing/subscriptions/${(0, request_1.enc)(id)}/cancel`, body });
+        },
+        /** Undo a cancellation scheduled for the period end. */
+        restoreSubscription(id) {
+            return request({ method: 'POST', path: `/v1/billing/subscriptions/${(0, request_1.enc)(id)}/restore` });
+        },
+        /** Mirror a plan's features/limits from its provider (Autumn, Commet). */
+        syncPlanEntitlements(id) {
+            return request({ method: 'POST', path: `/v1/billing/plans/${(0, request_1.enc)(id)}/sync_entitlements` });
+        },
+        /** How limits merge across a subject's several subscriptions. */
+        getSettings() {
+            return request({ method: 'GET', path: '/v1/billing/settings' });
+        },
+        updateSettings(body) {
+            return request({ method: 'PUT', path: '/v1/billing/settings', body });
+        },
+        /** May a subject use a feature? Live from Autumn/Commet when the subject is on one. */
+        checkFeature(body) {
+            return request({ method: 'POST', path: '/v1/billing/check', body });
+        },
         /**
          * Adopt an EXISTING Stripe subscription onto a user/org + plan, for
          * migrating billing into Atlas without re-charging. Read-only on Stripe.

package/dist/client/billing-plans.js.map

@@ -1 +1 @@
-{"version":3,"file":"billing-plans.js","sourceRoot":"","sources":["../../src/client/billing-plans.ts"],"names":[],"mappings":";;AA8GA,0CAkDC;AAhKD,uCAAgD;AA8GhD,SAAgB,eAAe,CAAC,OAAkB;IAChD,OAAO;QACL,SAAS;YACP,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,mBAAmB,EAAE,CAAC,CAAC;QAC/D,CAAC;QACD,UAAU,CAAC,IAA2B,EAAE,cAAuB;YAC7D,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,mBAAmB,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC;QACtF,CAAC;QACD,OAAO,CAAC,EAAU;YAChB,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,qBAAqB,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;QAC1E,CAAC;QACD,UAAU,CAAC,EAAU,EAAE,IAA2B;YAChD,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,qBAAqB,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;QAClF,CAAC;QACD,UAAU,CAAC,EAAU;YACnB,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,qBAAqB,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;QAC7E,CAAC;QACD,iBAAiB,CAAC,MAAgC;YAChD,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,2BAA2B,EAAE,KAAK,EAAE,EAAE,GAAG,MAAM,EAAE,EAAE,CAAC,CAAC;QAC7F,CAAC;QACD;;;WAGG;QACH,kBAAkB,CAChB,IAAmC,EACnC,cAAuB;YAEvB,OAAO,OAAO,CAAC;gBACb,MAAM,EAAE,MAAM;gBACd,IAAI,EAAE,kCAAkC;gBACxC,IAAI;gBACJ,cAAc;aACf,CAAC,CAAC;QACL,CAAC;QACD,wFAAwF;QACxF,WAAW,CAAC,IAA4B;YACtC,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,mBAAmB,EAAE,IAAI,EAAE,CAAC,CAAC;QACtE,CAAC;QACD;;;WAGG;QACH,SAAS,CAAC,WAA2B,EAAE,SAAiB;YACtD,OAAO,OAAO,CAAC;gBACb,MAAM,EAAE,MAAM;gBACd,IAAI,EAAE,wBAAwB,IAAA,aAAG,EAAC,WAAW,CAAC,IAAI,IAAA,aAAG,EAAC,SAAS,CAAC,aAAa;aAC9E,CAAC,CAAC;QACL,CAAC;KACF,CAAC;AACJ,CAAC"}
+{"version":3,"file":"billing-plans.js","sourceRoot":"","sources":["../../src/client/billing-plans.ts"],"names":[],"mappings":";;AA2LA,0CAiFC;AA5QD,uCAAgD;AA2LhD,SAAgB,eAAe,CAAC,OAAkB;IAChD,OAAO;QACL,SAAS;YACP,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,mBAAmB,EAAE,CAAC,CAAC;QAC/D,CAAC;QACD,UAAU,CAAC,IAA2B,EAAE,cAAuB;YAC7D,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,mBAAmB,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC;QACtF,CAAC;QACD,OAAO,CAAC,EAAU;YAChB,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,qBAAqB,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;QAC1E,CAAC;QACD,UAAU,CAAC,EAAU,EAAE,IAA2B;YAChD,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,qBAAqB,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;QAClF,CAAC;QACD,UAAU,CAAC,EAAU;YACnB,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,qBAAqB,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;QAC7E,CAAC;QACD,iBAAiB,CAAC,MAAgC;YAChD,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,2BAA2B,EAAE,KAAK,EAAE,EAAE,GAAG,MAAM,EAAE,EAAE,CAAC,CAAC;QAC7F,CAAC;QACD,kFAAkF;QAClF,eAAe,CAAC,EAAU;YACxB,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,6BAA6B,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;QAClF,CAAC;QACD,qFAAqF;QACrF,kBAAkB,CAAC,EAAU,EAAE,IAAmC;YAChE,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,6BAA6B,IAAA,aAAG,EAAC,EAAE,CAAC,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAChG,CAAC;QACD,kEAAkE;QAClE,kBAAkB,CAAC,EAAU,EAAE,OAAkC,EAAE;YACjE,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,6BAA6B,IAAA,aAAG,EAAC,EAAE,CAAC,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAChG,CAAC;QACD,wDAAwD;QACxD,mBAAmB,CAAC,EAAU;YAC5B,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,6BAA6B,IAAA,aAAG,EAAC,EAAE,CAAC,UAAU,EAAE,CAAC,CAAC;QAC3F,CAAC;QACD,0EAA0E;QAC1E,oBAAoB,CAAC,EAAU;YAC7B,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,qBAAqB,IAAA,aAAG,EAAC,EAAE,CAAC,oBAAoB,EAAE,CAAC,CAAC;QAC7F,CAAC;QACD,iEAAiE;QACjE,WAAW;YACT,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,sBAAsB,EAAE,CAAC,CAAC;QAClE,CAAC;QACD,cAAc,CAAC,IAA+B;YAC5C,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,sBAAsB,EAAE,IAAI,EAAE,CAAC,CAAC;QACxE,CAAC;QACD,uFAAuF;QACvF,YAAY,CAAC,IAA6B;YACxC,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,mBAAmB,EAAE,IAAI,EAAE,CAAC,CAAC;QACtE,CAAC;QACD;;;WAGG;QACH,kBAAkB,CAChB,IAAmC,EACnC,cAAuB;YAEvB,OAAO,OAAO,CAAC;gBACb,MAAM,EAAE,MAAM;gBACd,IAAI,EAAE,kCAAkC;gBACxC,IAAI;gBACJ,cAAc;aACf,CAAC,CAAC;QACL,CAAC;QACD,wFAAwF;QACxF,WAAW,CAAC,IAA4B;YACtC,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,mBAAmB,EAAE,IAAI,EAAE,CAAC,CAAC;QACtE,CAAC;QACD;;;WAGG;QACH,SAAS,CAAC,WAA2B,EAAE,SAAiB;YACtD,OAAO,OAAO,CAAC;gBACb,MAAM,EAAE,MAAM;gBACd,IAAI,EAAE,wBAAwB,IAAA,aAAG,EAAC,WAAW,CAAC,IAAI,IAAA,aAAG,EAAC,SAAS,CAAC,aAAa;aAC9E,CAAC,CAAC;QACL,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/client/custom-oauth-providers.d.ts

@@ -0,0 +1,243 @@
+import { type RequestFn } from './request';
+import type { ListPage } from './types';
+/**
+ * Custom (generic) OAuth 2.0 / OpenID Connect login providers — your own
+ * upstream identity provider, with Atlas as the relying party. Configure the
+ * endpoints (or just an OIDC issuer), the token-endpoint client authentication
+ * (incl. private_key_jwt with an Atlas-held key), a declarative profile
+ * mapping, upstream logout and third-party initiated login. The provider then
+ * signs users in like any built-in one: `provider: <provider_key>`.
+ */
+/** A claim path, a `{{template}}`, or a rule. */
+export type ProfileMappingExpr = string | {
+    /** A path, or paths tried in order (the first non-empty wins). */
+    from?: string | string[];
+    template?: string;
+    /** A constant. */
+    value?: string | number | boolean | null;
+    transforms?: Array<'lowercase' | 'uppercase' | 'trim' | 'first' | 'last' | 'compact' | 'unique' | 'to_string' | 'to_number' | 'to_boolean' | {
+        split: string;
+    } | {
+        join: string;
+    } | {
+        index: number;
+    } | {
+        replace: {
+            find: string;
+            with: string;
+        };
+    } | {
+        prefix: string;
+    } | {
+        suffix: string;
+    } | {
+        default: string | number | boolean | null;
+    }>;
+};
+export interface ProfileMapping {
+    fields?: Partial<Record<'id' | 'email' | 'email_verified' | 'first_name' | 'last_name' | 'full_name' | 'username' | 'image_url' | 'phone_number' | 'external_id', ProfileMappingExpr>>;
+    public_metadata?: Record<string, ProfileMappingExpr>;
+    private_metadata?: Record<string, ProfileMappingExpr>;
+    /** Re-apply names, image and metadata on every sign-in (default: at account creation). */
+    update_on_sign_in?: boolean;
+}
+export type TokenEndpointAuthMethod = 'client_secret_basic' | 'client_secret_post' | 'client_secret_jwt' | 'private_key_jwt' | 'none';
+export interface UpstreamLogoutSettings {
+    /** On Atlas sign-out, hand back the provider end-session URL to send the browser to. */
+    rp_initiated?: boolean;
+    post_logout_redirect_url?: string | null;
+    /** Accept OIDC Back-Channel Logout tokens and end the matching Atlas sessions. */
+    backchannel?: boolean;
+    /** Accept OIDC Front-Channel Logout (the provider frames frontchannel_logout_uri). */
+    frontchannel?: boolean;
+    /** Front-channel: require iss + sid (default true). */
+    frontchannel_session_required?: boolean;
+    end_session_endpoint?: string | null;
+}
+export interface IdpInitiatedLoginSettings {
+    enabled?: boolean;
+    /** Exact URLs or bare origins a third-party initiated login may land on. */
+    allowed_targets?: string[];
+    default_target?: string | null;
+}
+export interface UpstreamSigningKey {
+    object: 'upstream_signing_key';
+    kid: string;
+    alg: 'RS256' | 'PS256' | 'ES256';
+    status: 'active' | 'retiring' | 'retired';
+    public_jwk: Record<string, unknown>;
+    created_at: number;
+    retired_at: number | null;
+}
+export interface UpstreamUrls {
+    /** Register at the provider as the client JWKS URL (private_key_jwt). */
+    client_jwks_uri: string;
+    backchannel_logout_uri: string;
+    frontchannel_logout_uri: string;
+    post_logout_redirect_uri: string;
+    initiate_login_uri: string;
+}
+export interface CustomOAuthProviderSettings {
+    display_name?: string;
+    icon_url?: string | null;
+    protocol?: 'oidc' | 'oauth2';
+    issuer?: string | null;
+    discovery_url?: string | null;
+    authorization_endpoint?: string | null;
+    token_endpoint?: string | null;
+    userinfo_endpoint?: string | null;
+    jwks_uri?: string | null;
+    end_session_endpoint?: string | null;
+    scopes?: string[];
+    scope_separator?: ' ' | ',' | '+';
+    pkce?: boolean;
+    authorization_params?: Record<string, string> | null;
+    token_params?: Record<string, string> | null;
+    userinfo_auth?: 'header' | 'query';
+    token_endpoint_auth_method?: TokenEndpointAuthMethod;
+    client_assertion_audience?: string | null;
+    profile_source?: 'merged' | 'userinfo' | 'id_token';
+    profile_mapping?: ProfileMapping | null;
+    logout?: UpstreamLogoutSettings | null;
+    idp_initiated_login?: IdpInitiatedLoginSettings | null;
+    client_id?: string;
+    /** Write-only; never returned. */
+    client_secret?: string;
+    enabled?: boolean;
+    allow_sign_in?: boolean;
+    allow_sign_up?: boolean;
+}
+export interface CreateCustomOAuthProviderBody extends CustomOAuthProviderSettings {
+    provider_key: string;
+    display_name: string;
+}
+export interface CustomOAuthProvider extends UpstreamUrls {
+    object: 'custom_oauth_provider';
+    id: string;
+    provider_key: string;
+    display_name: string;
+    icon_url: string | null;
+    protocol: 'oidc' | 'oauth2';
+    issuer: string | null;
+    discovery_url: string | null;
+    authorization_endpoint: string | null;
+    token_endpoint: string | null;
+    userinfo_endpoint: string | null;
+    jwks_uri: string | null;
+    end_session_endpoint: string | null;
+    scopes: string[];
+    scope_separator: ' ' | ',' | '+';
+    pkce: boolean;
+    authorization_params: Record<string, string>;
+    token_params: Record<string, string>;
+    userinfo_auth: 'header' | 'query';
+    token_endpoint_auth_method: TokenEndpointAuthMethod;
+    client_assertion_audience: string | null;
+    profile_source: 'merged' | 'userinfo' | 'id_token';
+    profile_mapping: Required<ProfileMapping> | null;
+    logout: Required<UpstreamLogoutSettings>;
+    idp_initiated_login: Required<IdpInitiatedLoginSettings>;
+    client_id: string | null;
+    has_secret: boolean;
+    enabled: boolean;
+    allow_sign_in: boolean;
+    allow_sign_up: boolean;
+    /** Register at the provider as the redirect / callback URI. */
+    redirect_uri: string;
+    signing_keys: UpstreamSigningKey[];
+    created_at: number;
+    updated_at: number;
+}
+export interface ProfileMappingPreviewBody {
+    profile_mapping?: ProfileMapping;
+    userinfo?: Record<string, unknown>;
+    id_token_claims?: Record<string, unknown>;
+    /** A sample id_token — decoded, not verified. */
+    id_token?: string;
+}
+export interface ProfileMappingPreview {
+    object: 'profile_mapping_preview';
+    profile: {
+        id: string | null;
+        email: string | null;
+        email_verified: boolean;
+        first_name: string | null;
+        last_name: string | null;
+        username: string | null;
+        image_url: string | null;
+        phone_number: string | null;
+        external_id: string | null;
+        public_metadata: Record<string, unknown>;
+        private_metadata: Record<string, unknown>;
+    };
+    trace: Record<string, {
+        value: unknown;
+        source: string | null;
+    }>;
+    warnings: string[];
+}
+export interface OidcDiscoveryResult {
+    object: 'oidc_discovery';
+    issuer: string;
+    authorization_endpoint: string;
+    token_endpoint: string;
+    userinfo_endpoint: string | null;
+    jwks_uri: string;
+    end_session_endpoint: string | null;
+    scopes_supported: string[];
+    claims_supported: string[];
+    token_endpoint_auth_methods_supported: string[];
+    token_endpoint_auth_signing_alg_values_supported: string[];
+    code_challenge_methods_supported: string[];
+    backchannel_logout_supported: boolean;
+    backchannel_logout_session_supported: boolean;
+}
+/** The signing-key operations shared by custom providers and OIDC connections. */
+export declare function upstreamSigningKeys(request: RequestFn, base: string): {
+    list(): Promise<ListPage<UpstreamSigningKey>>;
+    /** Generate a new active key; the previous one turns `retiring` (still published). */
+    rotate(body?: {
+        alg?: "RS256" | "PS256" | "ES256";
+    }, idempotencyKey?: string): Promise<UpstreamSigningKey>;
+    /** Retire a non-active key (it leaves the JWKS). */
+    retire(kid: string): Promise<{
+        object: "upstream_signing_key";
+        kid: string;
+        status: "retired";
+    }>;
+};
+export declare function customOAuthProvidersResource(request: RequestFn): {
+    list(): Promise<ListPage<CustomOAuthProvider>>;
+    get(id: string): Promise<CustomOAuthProvider>;
+    create(body: CreateCustomOAuthProviderBody, idempotencyKey?: string): Promise<CustomOAuthProvider>;
+    update(id: string, body: CustomOAuthProviderSettings, idempotencyKey?: string): Promise<CustomOAuthProvider>;
+    delete(id: string): Promise<{
+        object: "custom_oauth_provider";
+        id: string;
+        provider_key: string;
+        deleted: true;
+    }>;
+    /** Fetch + validate an issuer's OpenID configuration (for autofill). */
+    discover(body: {
+        issuer: string;
+        discovery_url?: string;
+    }): Promise<OidcDiscoveryResult>;
+    /**
+     * Run a mapping against a pasted sample. With `id`, the provider's stored
+     * mapping is used unless the body carries one.
+     */
+    previewProfileMapping(body: ProfileMappingPreviewBody, id?: string): Promise<ProfileMappingPreview>;
+    signingKeys(id: string): {
+        list(): Promise<ListPage<UpstreamSigningKey>>;
+        /** Generate a new active key; the previous one turns `retiring` (still published). */
+        rotate(body?: {
+            alg?: "RS256" | "PS256" | "ES256";
+        }, idempotencyKey?: string): Promise<UpstreamSigningKey>;
+        /** Retire a non-active key (it leaves the JWKS). */
+        retire(kid: string): Promise<{
+            object: "upstream_signing_key";
+            kid: string;
+            status: "retired";
+        }>;
+    };
+};

package/dist/client/custom-oauth-providers.js

@@ -0,0 +1,60 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.upstreamSigningKeys = upstreamSigningKeys;
+exports.customOAuthProvidersResource = customOAuthProvidersResource;
+const request_1 = require("./request");
+/** The signing-key operations shared by custom providers and OIDC connections. */
+function upstreamSigningKeys(request, base) {
+    return {
+        list() {
+            return request({ method: 'GET', path: `${base}/signing_keys` });
+        },
+        /** Generate a new active key; the previous one turns `retiring` (still published). */
+        rotate(body = {}, idempotencyKey) {
+            return request({ method: 'POST', path: `${base}/signing_keys`, body, idempotencyKey });
+        },
+        /** Retire a non-active key (it leaves the JWKS). */
+        retire(kid) {
+            return request({ method: 'POST', path: `${base}/signing_keys/${(0, request_1.enc)(kid)}/retire` });
+        },
+    };
+}
+function customOAuthProvidersResource(request) {
+    const base = (id) => `/v1/custom_oauth_providers/${(0, request_1.enc)(id)}`;
+    return {
+        list() {
+            return request({ method: 'GET', path: '/v1/custom_oauth_providers' });
+        },
+        get(id) {
+            return request({ method: 'GET', path: base(id) });
+        },
+        create(body, idempotencyKey) {
+            return request({ method: 'POST', path: '/v1/custom_oauth_providers', body, idempotencyKey });
+        },
+        update(id, body, idempotencyKey) {
+            return request({ method: 'PATCH', path: base(id), body, idempotencyKey });
+        },
+        delete(id) {
+            return request({ method: 'DELETE', path: base(id) });
+        },
+        /** Fetch + validate an issuer's OpenID configuration (for autofill). */
+        discover(body) {
+            return request({ method: 'POST', path: '/v1/custom_oauth_providers/discover', body });
+        },
+        /**
+         * Run a mapping against a pasted sample. With `id`, the provider's stored
+         * mapping is used unless the body carries one.
+         */
+        previewProfileMapping(body, id) {
+            return request({
+                method: 'POST',
+                path: id ? `${base(id)}/profile_mapping/preview` : '/v1/custom_oauth_providers/profile_mapping/preview',
+                body,
+            });
+        },
+        signingKeys(id) {
+            return upstreamSigningKeys(request, base(id));
+        },
+    };
+}
+//# sourceMappingURL=custom-oauth-providers.js.map

package/dist/client/custom-oauth-providers.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"custom-oauth-providers.js","sourceRoot":"","sources":["../../src/client/custom-oauth-providers.ts"],"names":[],"mappings":";;AAqOA,kDAcC;AAED,oEAqCC;AA1RD,uCAAgD;AAoOhD,kFAAkF;AAClF,SAAgB,mBAAmB,CAAC,OAAkB,EAAE,IAAY;IAClE,OAAO;QACL,IAAI;YACF,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,IAAI,eAAe,EAAE,CAAC,CAAC;QAClE,CAAC;QACD,sFAAsF;QACtF,MAAM,CAAC,OAA8C,EAAE,EAAE,cAAuB;YAC9E,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,IAAI,eAAe,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC;QACzF,CAAC;QACD,oDAAoD;QACpD,MAAM,CAAC,GAAW;YAChB,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,IAAI,iBAAiB,IAAA,aAAG,EAAC,GAAG,CAAC,SAAS,EAAE,CAAC,CAAC;QACtF,CAAC;KACF,CAAC;AACJ,CAAC;AAED,SAAgB,4BAA4B,CAAC,OAAkB;IAC7D,MAAM,IAAI,GAAG,CAAC,EAAU,EAAE,EAAE,CAAC,8BAA8B,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,CAAC;IACrE,OAAO;QACL,IAAI;YACF,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,4BAA4B,EAAE,CAAC,CAAC;QACxE,CAAC;QACD,GAAG,CAAC,EAAU;YACZ,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;QACpD,CAAC;QACD,MAAM,CAAC,IAAmC,EAAE,cAAuB;YACjE,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,4BAA4B,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC;QAC/F,CAAC;QACD,MAAM,CAAC,EAAU,EAAE,IAAiC,EAAE,cAAuB;YAC3E,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,CAAC,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC;QAC5E,CAAC;QACD,MAAM,CAAC,EAAU;YACf,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;QACvD,CAAC;QACD,wEAAwE;QACxE,QAAQ,CAAC,IAAgD;YACvD,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,qCAAqC,EAAE,IAAI,EAAE,CAAC,CAAC;QACxF,CAAC;QACD;;;WAGG;QACH,qBAAqB,CAAC,IAA+B,EAAE,EAAW;YAChE,OAAO,OAAO,CAAC;gBACb,MAAM,EAAE,MAAM;gBACd,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,EAAE,CAAC,0BAA0B,CAAC,CAAC,CAAC,oDAAoD;gBACvG,IAAI;aACL,CAAC,CAAC;QACL,CAAC;QACD,WAAW,CAAC,EAAU;YACpB,OAAO,mBAAmB,CAAC,OAAO,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC;QAChD,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/client/email-templates.d.ts

@@ -1,7 +1,7 @@
 import { type RequestFn } from './request';
 import type { ListPage } from './types';
 /** The transactional email a template drives. */
-export type EmailTemplateName = 'verification_code' | 'magic_link' | 'password_reset' | 'password_changed' | 'account_exists_notice' | 'organization_invitation' | 'new_device_sign_in' | 'session_revoked_token_reuse' | 'account_locked' | 'account_secured' | 'team_member_added' | 'team_role_changed' | 'email_changed' | 'verification_link' | 'password_reset_link';
+export type EmailTemplateName = 'verification_code' | 'magic_link' | 'password_reset' | 'password_changed' | 'account_exists_notice' | 'organization_invitation' | 'new_device_sign_in' | 'session_revoked_token_reuse' | 'account_locked' | 'account_secured' | 'team_member_added' | 'team_role_changed' | 'email_changed' | 'verification_link' | 'password_reset_link' | 'account_reactivated';
 /** The customizable body of a template: a subject line and a text body. */
 export interface EmailTemplateBody {
     subject?: string;

package/dist/client/email-templates.js.map

@@ -1 +1 @@
-{"version":3,"file":"email-templates.js","sourceRoot":"","sources":["../../src/client/email-templates.ts"],"names":[],"mappings":";;AA4DA,wDAkBC;AA9ED,uCAAgD;AA4DhD,SAAgB,sBAAsB,CAAC,OAAkB;IACvD,OAAO;QACL,IAAI;YACF,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,qBAAqB,EAAE,CAAC,CAAC;QACjE,CAAC;QACD,2EAA2E;QAC3E,OAAO,CAAC,IAAY,EAAE,OAA0B,EAAE;YAChD,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,uBAAuB,IAAA,aAAG,EAAC,IAAI,CAAC,UAAU,EAAE,IAAI,EAAE,CAAC,CAAC;QAC7F,CAAC;QACD,2DAA2D;QAC3D,MAAM,CAAC,IAAY,EAAE,IAAuB;YAC1C,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,uBAAuB,IAAA,aAAG,EAAC,IAAI,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;QACpF,CAAC;QACD,8BAA8B;QAC9B,MAAM,CAAC,IAAY;YACjB,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,uBAAuB,IAAA,aAAG,EAAC,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC;QACjF,CAAC;KACF,CAAC;AACJ,CAAC"}
+{"version":3,"file":"email-templates.js","sourceRoot":"","sources":["../../src/client/email-templates.ts"],"names":[],"mappings":";;AA6DA,wDAkBC;AA/ED,uCAAgD;AA6DhD,SAAgB,sBAAsB,CAAC,OAAkB;IACvD,OAAO;QACL,IAAI;YACF,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,qBAAqB,EAAE,CAAC,CAAC;QACjE,CAAC;QACD,2EAA2E;QAC3E,OAAO,CAAC,IAAY,EAAE,OAA0B,EAAE;YAChD,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,uBAAuB,IAAA,aAAG,EAAC,IAAI,CAAC,UAAU,EAAE,IAAI,EAAE,CAAC,CAAC;QAC7F,CAAC;QACD,2DAA2D;QAC3D,MAAM,CAAC,IAAY,EAAE,IAAuB;YAC1C,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,uBAAuB,IAAA,aAAG,EAAC,IAAI,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;QACpF,CAAC;QACD,8BAA8B;QAC9B,MAAM,CAAC,IAAY;YACjB,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,uBAAuB,IAAA,aAAG,EAAC,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC;QACjF,CAAC;KACF,CAAC;AACJ,CAAC"}