@atlasauth/backend 0.4.0 → 0.6.0

package/README.md

@@ -0,0 +1,187 @@
+# @atlasauth/backend
+
+Server-side Atlas for Node, Deno, Bun and edge runtimes. It does three things:
+
+- verifies Atlas session tokens, webhooks and back-channel logout tokens
+- gives you a typed client for the Backend API, using your secret key (`sk_...`)
+- gives you a typed client for the Platform API, using your platform key (`psk_...`)
+
+It needs nothing but `fetch`.
+
+```sh
+npm install @atlasauth/backend
+```
+
+## Verify a session
+
+```ts
+import { AtlasBackend } from '@atlasauth/backend';
+
+const atlas = new AtlasBackend({ issuer: 'https://clerk.example.com' });
+const result = await atlas.verify(sessionToken);
+if (result.ok) console.log(result.claims.sub);
+```
+
+The JWKS is found from the issuer and cached. Instances on the shared host also pass `instanceId` (or `publishableKey`).
+
+## Management client (secret key)
+
+```ts
+import { createAtlasClient, paginate } from '@atlasauth/backend';
+
+const atlas = createAtlasClient({ secretKey: process.env.ATLAS_SECRET_KEY! });
+
+const user = await atlas.users.create({ email_address: 'ada@example.com' });
+for await (const u of paginate(atlas.users.list)) console.log(u.id);
+```
+
+Every Backend API operation has a method, grouped by resource. The groups are:
+
+| Area | Namespaces |
+| --- | --- |
+| Users and sessions | `users`, `emailAddresses`, `sessions`, `signInTokens`, `actorTokens` |
+| Organizations | `organizations`, `invitations` |
+| Roles and authorization | `roles`, `permissions`, `fga`, `openfga` |
+| Access and sign-up control | `waitlist`, `allowlist`, `blocklist`, `domains`, `redirectUrls` |
+| Instance settings | `instance`, `instanceSecurity`, `design`, `branding`, `localizations` |
+| Templates and messaging | `emailTemplates`, `smsTemplates`, `messaging`, `notifications` |
+| Social and enterprise sign-in | `oauthProviders`, `connectors`, `ssoConnections`, `ssoOnboarding`, `orgLdapConnections`, `scimTokens`, `scimProvisioning`, `legacyAuthConnection` |
+| OAuth and tokens | `oauthClients`, `resourceServers`, `jwtTemplates`, `apiKeys`, `machines`, `tokens`, `sessionExchangeApps`, `tickets` |
+| Webhooks and audit | `webhooks`, `auditLogs`, `auditEvents`, `events`, `usage`, `configChangelog`, `logStreams` |
+| Security | `attackProtection`, `rateLimitPolicy`, `riskBasedMfa`, `botSignals`, `captcha`, `networkAcls`, `managedWaf`, `radiusClients` |
+| Billing and entitlements | `billing`, `entitlementOverrides`, `organizationSettingsSchema` |
+| Privacy | `dataSubjectRequests`, `importExport` |
+| Agents and integrations | `actions`, `pca`, `mcp`, `mcpConnector`, `ltiPlatforms` |
+| Development tools | `testMode`, `diagnostics` |
+
+### Check your setup
+
+```ts
+const report = await atlas.instance.preflight();
+for (const f of report.findings) console.log(f.severity, f.message, '→', f.fix);
+```
+
+### Design the sign-in page
+
+```ts
+import { readFile } from 'node:fs/promises';
+
+const logo = await atlas.design.assets.upload(await readFile('logo.png'), {
+  kind: 'logo',
+  contentType: 'image/png',
+});
+await atlas.design.update({
+  palette: { primary: '#4f46e5' },
+  logo: { assetId: logo.asset_id },
+});
+// Per-organization override; null removes a setting.
+await atlas.design.organizations.update('org_123', { palette: { primary: null } });
+```
+
+Uploads send the raw image bytes with their content type. A `Blob` brings its own type.
+
+### Strict request bodies
+
+By default Atlas ignores a body field an endpoint does not accept. It lists the ignored fields in the `Atlas-Unknown-Fields` response header.
+
+```ts
+const atlas = createAtlasClient({
+  secretKey,
+  strict: true, // refuse unknown fields with 422 UNKNOWN_FIELD instead
+  onUnknownFields: ({ method, path, fields }) => console.warn(method, path, 'ignored', fields),
+});
+
+// Override for some calls:
+await atlas.withOptions({ strict: false }).users.update('user_123', body);
+```
+
+### Errors
+
+Every failed call throws `AtlasApiError`, which has `status`, `code` and the full `errors` list. `AtlasErrorCodes` names the codes worth branching on:
+
+```ts
+import { AtlasApiError, AtlasErrorCodes } from '@atlasauth/backend';
+
+try {
+  await atlas.notifications.send(body);
+} catch (e) {
+  if (e instanceof AtlasApiError && e.hasCode(AtlasErrorCodes.EMAIL_DELIVERY_NOT_CONFIGURED)) {
+    // set up an email provider first
+  }
+}
+```
+
+## Platform client (platform key)
+
+```ts
+import { createAtlasPlatformClient } from '@atlasauth/backend';
+
+const platform = createAtlasPlatformClient({ platformKey: process.env.ATLAS_PLATFORM_KEY! });
+
+const app = await platform.apps.create({ name: 'Acme' });
+const signIn = await platform.atlasIdApps.create({
+  name: 'Acme',
+  redirect_uris: ['https://acme.example/callback'],
+  post_logout_redirect_uris: ['https://acme.example/'],
+  backchannel_logout_uri: 'https://acme.example/backchannel-logout',
+  branding: { theme: 'dark', accent_color: '#4f46e5' },
+});
+console.log(signIn.client_id, signIn.client_secret); // the secret is shown once
+```
+
+The platform client has these namespaces:
+
+- `apps`: create, update, archive, transfer, claim and delete apps, manage their instances, rotate and list secrets
+- `accountlessApps`
+- `atlasIdApps`: Sign in with Atlas apps, including design preview and secret rotation
+- `designAssets`
+
+It accepts the same `strict`, `onUnknownFields` and `withOptions` settings.
+
+## Back-channel logout
+
+When a user signs out of Atlas, Atlas POSTs a `logout_token` to your `backchannel_logout_uri`. Verify it before you end the matching local sessions:
+
+```ts
+import { LogoutTokenVerifier, memoryLogoutReplayStore } from '@atlasauth/backend';
+
+const logoutTokens = new LogoutTokenVerifier({
+  issuer: 'https://atlasauth.net', // or your instance's issuer
+  clientId: process.env.ATLAS_CLIENT_ID!,
+  replayStore: memoryLogoutReplayStore(), // use a shared store across processes
+});
+
+// Framework-agnostic handler: (form body) -> { status, headers }
+export async function handleBackchannelLogout(form: URLSearchParams) {
+  const headers = { 'Cache-Control': 'no-store' };
+  const token = form.get('logout_token');
+  if (!token) return { status: 400, headers };
+
+  const result = await logoutTokens.verify(token);
+  if (!result.ok) return { status: 400, headers };
+
+  const { sid, sub } = result.claims;
+  if (sid) await sessions.deleteByAtlasSid(sid); // your session store
+  else if (sub) await sessions.deleteAllForUser(sub);
+  return { status: 200, headers };
+}
+```
+
+The verifier checks the following:
+
+- the RS256 signature
+- `iss`, and that `aud` contains your client id
+- `iat`, which must be present, not in the future and not too old, and `exp` if present
+- `jti`
+- the back-channel logout event
+- that `sid` or `sub` is present
+- that there is no `nonce`
+- that `typ` is `logout+jwt`, when the header has one
+
+For tokens signed by your own instance, `new AtlasBackend({ issuer }).verifyLogoutToken(token, { clientId })` reuses the instance's cached keys.
+
+To refuse replays across several servers, implement `LogoutReplayStore.remember(jti, expiresAtMs)` on a shared store, for example Redis `SET NX PX`.
+
+## Webhooks
+
+`verifyWebhook` checks the signature on events Atlas sends to your webhook endpoints. You manage endpoints with `atlas.webhooks.endpoints`: create, update, reveal or rotate a secret, send a test event, and redeliver a past delivery.

package/dist/client/activity.d.ts

@@ -0,0 +1,104 @@
+import { type RequestFn } from './request';
+import type { CursorPage, CursorParams } from './types';
+/** One entry of the product activity feed — the same envelope a webhook carries. */
+export interface ActivityEvent {
+    object: 'event';
+    id: string;
+    type: string;
+    payload: {
+        id: string;
+        type: string;
+        /** Emitted (epoch ms). */
+        timestamp: number;
+        instance_id: string;
+        data: unknown;
+    };
+    /** Occurred (epoch ms). */
+    created_at: number;
+}
+export interface ListActivityEventsParams extends CursorParams {
+    /** Only this event type, e.g. `user.created`. */
+    type?: string;
+    /** Lower time bound: epoch ms or an ISO-8601 date. */
+    from?: number | string;
+    /** Upper time bound: epoch ms or an ISO-8601 date. */
+    to?: number | string;
+}
+export interface ActivityEventsPage extends CursorPage<ActivityEvent> {
+    object: 'list';
+    /** Event types this instance has actually emitted. */
+    available_types?: string[];
+}
+export interface UsageMetric {
+    metric: string;
+    label: string;
+    description: string;
+    /** False for metrics with no meaningful sum (active users). */
+    additive: boolean;
+    points: unknown[];
+    peak: unknown;
+    total: number | null;
+    /** Change versus the previous window. */
+    trend: number | null;
+}
+export interface UsageReport {
+    object: 'usage';
+    window: {
+        from: string;
+        to: string;
+        days: number;
+    };
+    previous_window?: {
+        from: string;
+        to: string;
+    };
+    metrics: UsageMetric[];
+    monthly_active_users?: {
+        value: number | null;
+        window_days: number;
+        trend: number | null;
+    };
+}
+/** One config change: who changed what, when, with a before/after where recorded. */
+export interface ConfigChangelogEntry {
+    id: string;
+    /** Occurred (epoch ms). */
+    at: number;
+    actor: {
+        type: string;
+        id: string | null;
+    };
+    action: string;
+    ip?: string | null;
+    changes?: Array<{
+        section: string;
+        before: unknown;
+        after: unknown;
+    }>;
+    /** Changed field names, when no before/after was recorded. */
+    fields?: string[];
+}
+export interface ListConfigChangelogParams extends CursorParams {
+    /** Only this config action. */
+    action?: string;
+    /** Only changes at or after this ISO-8601 date. */
+    since?: string;
+}
+export declare function eventsResource(request: RequestFn): {
+    /** The activity feed, newest first, cursor-paginated (limit up to 100). */
+    list(params?: ListActivityEventsParams): Promise<ActivityEventsPage>;
+};
+export declare function usageResource(request: RequestFn): {
+    /** Daily sign-in / active-user series over the last `days`, plus monthly active users. */
+    get(params?: {
+        days?: number;
+    }): Promise<UsageReport>;
+};
+export declare function configChangelogResource(request: RequestFn): {
+    list(params?: ListConfigChangelogParams): Promise<{
+        object: "config_changelog";
+        data: ConfigChangelogEntry[];
+        has_more: boolean;
+        next_cursor: string | null;
+    }>;
+};

package/dist/client/activity.js

@@ -0,0 +1,29 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.eventsResource = eventsResource;
+exports.usageResource = usageResource;
+exports.configChangelogResource = configChangelogResource;
+function eventsResource(request) {
+    return {
+        /** The activity feed, newest first, cursor-paginated (limit up to 100). */
+        list(params = {}) {
+            return request({ method: 'GET', path: '/v1/events', query: { ...params } });
+        },
+    };
+}
+function usageResource(request) {
+    return {
+        /** Daily sign-in / active-user series over the last `days`, plus monthly active users. */
+        get(params = {}) {
+            return request({ method: 'GET', path: '/v1/usage', query: { ...params } });
+        },
+    };
+}
+function configChangelogResource(request) {
+    return {
+        list(params = {}) {
+            return request({ method: 'GET', path: '/v1/config_changelog', query: { ...params } });
+        },
+    };
+}
+//# sourceMappingURL=activity.js.map

package/dist/client/activity.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"activity.js","sourceRoot":"","sources":["../../src/client/activity.ts"],"names":[],"mappings":";;AA4EA,wCAOC;AAED,sCAOC;AAED,0DAaC;AA/BD,SAAgB,cAAc,CAAC,OAAkB;IAC/C,OAAO;QACL,2EAA2E;QAC3E,IAAI,CAAC,SAAmC,EAAE;YACxC,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,YAAY,EAAE,KAAK,EAAE,EAAE,GAAG,MAAM,EAAE,EAAE,CAAC,CAAC;QAC9E,CAAC;KACF,CAAC;AACJ,CAAC;AAED,SAAgB,aAAa,CAAC,OAAkB;IAC9C,OAAO;QACL,0FAA0F;QAC1F,GAAG,CAAC,SAA4B,EAAE;YAChC,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,WAAW,EAAE,KAAK,EAAE,EAAE,GAAG,MAAM,EAAE,EAAE,CAAC,CAAC;QAC7E,CAAC;KACF,CAAC;AACJ,CAAC;AAED,SAAgB,uBAAuB,CAAC,OAAkB;IACxD,OAAO;QACL,IAAI,CACF,SAAoC,EAAE;YAOtC,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,sBAAsB,EAAE,KAAK,EAAE,EAAE,GAAG,MAAM,EAAE,EAAE,CAAC,CAAC;QACxF,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/client/audit-events.d.ts

@@ -0,0 +1,103 @@
+import { type RequestFn } from './request';
+import type { CursorPage, CursorParams } from './types';
+/**
+ * Your OWN audit events — actions in your product you want on an audit trail
+ * (e.g. `invoice.sent`). Org-scoped events are streamed to that organization's
+ * audit streams. Separate from `auditLogs`, which records what happened in Atlas.
+ */
+export interface CustomAuditEvent {
+    object: 'audit_event';
+    id: string;
+    /** The org this event is scoped to, if any. */
+    organization_id?: string | null;
+    /** Your own actor vocabulary, e.g. `user`, `service`. */
+    actor: {
+        type?: string;
+        id?: string | null;
+    };
+    /** Your own action string, e.g. `invoice.sent`. */
+    action: string;
+    target: {
+        type?: string | null;
+        id?: string | null;
+        name?: string | null;
+    };
+    /** When it happened in your system (epoch ms). */
+    occurred_at: number;
+    metadata: unknown;
+    /** When Atlas received it (epoch ms). */
+    created_at: number;
+}
+export interface CreateCustomAuditEventBody {
+    actor: {
+        type: string;
+        id?: string;
+    };
+    action: string;
+    target?: {
+        type?: string;
+        id?: string;
+        name?: string;
+    };
+    /** Scope to an org (and stream to its SIEM). An unknown org id is a 404. */
+    organization_id?: string;
+    /** Epoch ms NUMBER; defaults to now. */
+    occurred_at?: number;
+    /** Non-secret structured context. */
+    metadata?: Record<string, unknown>;
+}
+/** Shared filters of the list and export endpoints. */
+export interface CustomAuditEventFilters {
+    /** Omit to query across all organizations (a blank value is a 400). */
+    organization_id?: string;
+    /** One id, or a comma-separated list (matches any). */
+    actor_id?: string;
+    /** One action, or a comma-separated list. */
+    action?: string;
+    /** One type, or a comma-separated list. */
+    target_type?: string;
+    /** One id, or a comma-separated list. */
+    target_id?: string;
+    /** Inclusive lower bound of occurred_at (epoch ms). */
+    from?: number;
+    /** Upper bound of occurred_at (epoch ms). */
+    to?: number;
+    /** OR the actor_id / target_type / target_id filters instead of AND. */
+    any_of?: boolean;
+    /** Give together with `metadata_value`: match events whose metadata[key] equals the value. */
+    metadata_key?: string;
+    metadata_value?: string;
+}
+export interface ListCustomAuditEventsParams extends CustomAuditEventFilters, CursorParams {
+}
+export interface ExportCustomAuditEventsParams extends CustomAuditEventFilters {
+    /** `jsonl` (default) or `csv`. */
+    format?: 'jsonl' | 'csv';
+    starting_after?: string;
+}
+export declare function auditEventsResource(request: RequestFn): {
+    create(body: CreateCustomAuditEventBody, idempotencyKey?: string): Promise<CustomAuditEvent>;
+    /** Up to 100 events, stored atomically (one bad org id fails the whole batch). */
+    createBatch(events: CreateCustomAuditEventBody[], idempotencyKey?: string): Promise<{
+        object: "list";
+        data: CustomAuditEvent[];
+    }>;
+    /** Newest first, cursor-paginated. */
+    list(params?: ListCustomAuditEventsParams): Promise<CursorPage<CustomAuditEvent>>;
+    /**
+     * Every matching event in one response, as text: JSONL (one event per line;
+     * a capped export ends with a `{"truncated":true,…}` line) or CSV.
+     */
+    export(params?: ExportCustomAuditEventsParams): Promise<string>;
+    /**
+     * Test-mode reset: delete the custom audit events of a DEVELOPMENT instance,
+     * optionally only one org's and/or one action's. A production instance is a 403.
+     */
+    deleteAll(params?: {
+        organization_id?: string;
+        action?: string;
+    }): Promise<{
+        object: "audit_events.bulk_delete";
+        deleted: number;
+    }>;
+};

package/dist/client/audit-events.js

@@ -0,0 +1,43 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.auditEventsResource = auditEventsResource;
+function auditEventsResource(request) {
+    return {
+        create(body, idempotencyKey) {
+            return request({ method: 'POST', path: '/v1/audit_events', body, idempotencyKey });
+        },
+        /** Up to 100 events, stored atomically (one bad org id fails the whole batch). */
+        createBatch(events, idempotencyKey) {
+            return request({
+                method: 'POST',
+                path: '/v1/audit_events/batch',
+                body: { events },
+                idempotencyKey,
+            });
+        },
+        /** Newest first, cursor-paginated. */
+        list(params = {}) {
+            return request({ method: 'GET', path: '/v1/audit_events', query: { ...params } });
+        },
+        /**
+         * Every matching event in one response, as text: JSONL (one event per line;
+         * a capped export ends with a `{"truncated":true,…}` line) or CSV.
+         */
+        export(params = {}) {
+            return request({
+                method: 'GET',
+                path: '/v1/audit_events/export',
+                query: { ...params },
+                raw: true,
+            });
+        },
+        /**
+         * Test-mode reset: delete the custom audit events of a DEVELOPMENT instance,
+         * optionally only one org's and/or one action's. A production instance is a 403.
+         */
+        deleteAll(params = {}) {
+            return request({ method: 'DELETE', path: '/v1/audit_events', query: { ...params } });
+        },
+    };
+}
+//# sourceMappingURL=audit-events.js.map

package/dist/client/audit-events.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"audit-events.js","sourceRoot":"","sources":["../../src/client/audit-events.ts"],"names":[],"mappings":";;AAoEA,kDA2CC;AA3CD,SAAgB,mBAAmB,CAAC,OAAkB;IACpD,OAAO;QACL,MAAM,CAAC,IAAgC,EAAE,cAAuB;YAC9D,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,kBAAkB,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC;QACrF,CAAC;QACD,kFAAkF;QAClF,WAAW,CACT,MAAoC,EACpC,cAAuB;YAEvB,OAAO,OAAO,CAAC;gBACb,MAAM,EAAE,MAAM;gBACd,IAAI,EAAE,wBAAwB;gBAC9B,IAAI,EAAE,EAAE,MAAM,EAAE;gBAChB,cAAc;aACf,CAAC,CAAC;QACL,CAAC;QACD,sCAAsC;QACtC,IAAI,CAAC,SAAsC,EAAE;YAC3C,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,kBAAkB,EAAE,KAAK,EAAE,EAAE,GAAG,MAAM,EAAE,EAAE,CAAC,CAAC;QACpF,CAAC;QACD;;;WAGG;QACH,MAAM,CAAC,SAAwC,EAAE;YAC/C,OAAO,OAAO,CAAC;gBACb,MAAM,EAAE,KAAK;gBACb,IAAI,EAAE,yBAAyB;gBAC/B,KAAK,EAAE,EAAE,GAAG,MAAM,EAAE;gBACpB,GAAG,EAAE,IAAI;aACV,CAAC,CAAC;QACL,CAAC;QACD;;;WAGG;QACH,SAAS,CACP,SAAwD,EAAE;YAE1D,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,kBAAkB,EAAE,KAAK,EAAE,EAAE,GAAG,MAAM,EAAE,EAAE,CAAC,CAAC;QACvF,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/client/billing-plans.d.ts

@@ -67,6 +67,37 @@ export interface ListSubscriptionsParams {
     subject_type?: string;
     subject_id?: string;
 }
+/** Adopt an existing Stripe subscription (same Stripe account) onto an Atlas subject. */
+export interface ImportBillingSubscriptionBody {
+    subject_type: 'user' | 'org';
+    subject_id: string;
+    stripe_subscription_id: string;
+    stripe_customer_id?: string;
+    /** Resolved from the subscription's price when omitted. */
+    plan_id?: string;
+}
+/** Report metered usage for a subject. Idempotent on `idempotency_key`. */
+export interface ReportBillingUsageBody {
+    subject_type: 'user' | 'org';
+    subject_id: string;
+    /** Non-negative. */
+    quantity: number;
+    idempotency_key: string;
+}
+export interface BillingUsageReport {
+    object: 'billing_usage';
+    /** False when this `idempotency_key` was already recorded. */
+    recorded: boolean;
+    /** Whether it was mirrored to a Stripe meter (the plan is metered and configured). */
+    metered: boolean;
+    total: number;
+}
+export interface BillingSeatSync {
+    object: 'billing_seats';
+    subject_type: string;
+    subject_id: string;
+    quantity: number;
+}
 export declare function billingResource(request: RequestFn): {
     listPlans(): Promise<ListPage<BillingPlan>>;
     createPlan(body: CreateBillingPlanBody, idempotencyKey?: string): Promise<BillingPlan>;
@@ -78,4 +109,16 @@ export declare function billingResource(request: RequestFn): {
         deleted: true;
     }>;
     listSubscriptions(params?: ListSubscriptionsParams): Promise<ListPage<BillingSubscription>>;
+    /**
+     * Adopt an EXISTING Stripe subscription onto a user/org + plan, for
+     * migrating billing into Atlas without re-charging. Read-only on Stripe.
+     */
+    importSubscription(body: ImportBillingSubscriptionBody, idempotencyKey?: string): Promise<BillingSubscription>;
+    /** Report metered usage (mirrored to a Stripe meter event when the plan is metered). */
+    reportUsage(body: ReportBillingUsageBody): Promise<BillingUsageReport>;
+    /**
+     * Sync a per-seat subscription's Stripe quantity to the org's current member
+     * count (prorated). Never changes the paid status.
+     */
+    syncSeats(subjectType: "user" | "org", subjectId: string): Promise<BillingSeatSync>;
 };

package/dist/client/billing-plans.js

@@ -22,6 +22,32 @@ function billingResource(request) {
         listSubscriptions(params) {
             return request({ method: 'GET', path: '/v1/billing/subscriptions', query: { ...params } });
         },
+        /**
+         * Adopt an EXISTING Stripe subscription onto a user/org + plan, for
+         * migrating billing into Atlas without re-charging. Read-only on Stripe.
+         */
+        importSubscription(body, idempotencyKey) {
+            return request({
+                method: 'POST',
+                path: '/v1/billing/subscriptions/import',
+                body,
+                idempotencyKey,
+            });
+        },
+        /** Report metered usage (mirrored to a Stripe meter event when the plan is metered). */
+        reportUsage(body) {
+            return request({ method: 'POST', path: '/v1/billing/usage', body });
+        },
+        /**
+         * Sync a per-seat subscription's Stripe quantity to the org's current member
+         * count (prorated). Never changes the paid status.
+         */
+        syncSeats(subjectType, subjectId) {
+            return request({
+                method: 'POST',
+                path: `/v1/billing/subjects/${(0, request_1.enc)(subjectType)}/${(0, request_1.enc)(subjectId)}/sync_seats`,
+            });
+        },
     };
 }
 //# sourceMappingURL=billing-plans.js.map

package/dist/client/billing-plans.js.map

@@ -1 +1 @@
-{"version":3,"file":"billing-plans.js","sourceRoot":"","sources":["../../src/client/billing-plans.ts"],"names":[],"mappings":";;AA2EA,0CAqBC;AAhGD,uCAAgD;AA2EhD,SAAgB,eAAe,CAAC,OAAkB;IAChD,OAAO;QACL,SAAS;YACP,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,mBAAmB,EAAE,CAAC,CAAC;QAC/D,CAAC;QACD,UAAU,CAAC,IAA2B,EAAE,cAAuB;YAC7D,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,mBAAmB,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC;QACtF,CAAC;QACD,OAAO,CAAC,EAAU;YAChB,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,qBAAqB,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;QAC1E,CAAC;QACD,UAAU,CAAC,EAAU,EAAE,IAA2B;YAChD,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,qBAAqB,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;QAClF,CAAC;QACD,UAAU,CAAC,EAAU;YACnB,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,qBAAqB,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;QAC7E,CAAC;QACD,iBAAiB,CAAC,MAAgC;YAChD,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,2BAA2B,EAAE,KAAK,EAAE,EAAE,GAAG,MAAM,EAAE,EAAE,CAAC,CAAC;QAC7F,CAAC;KACF,CAAC;AACJ,CAAC"}
+{"version":3,"file":"billing-plans.js","sourceRoot":"","sources":["../../src/client/billing-plans.ts"],"names":[],"mappings":";;AA8GA,0CAkDC;AAhKD,uCAAgD;AA8GhD,SAAgB,eAAe,CAAC,OAAkB;IAChD,OAAO;QACL,SAAS;YACP,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,mBAAmB,EAAE,CAAC,CAAC;QAC/D,CAAC;QACD,UAAU,CAAC,IAA2B,EAAE,cAAuB;YAC7D,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,mBAAmB,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC;QACtF,CAAC;QACD,OAAO,CAAC,EAAU;YAChB,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,qBAAqB,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;QAC1E,CAAC;QACD,UAAU,CAAC,EAAU,EAAE,IAA2B;YAChD,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,qBAAqB,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;QAClF,CAAC;QACD,UAAU,CAAC,EAAU;YACnB,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,qBAAqB,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;QAC7E,CAAC;QACD,iBAAiB,CAAC,MAAgC;YAChD,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,2BAA2B,EAAE,KAAK,EAAE,EAAE,GAAG,MAAM,EAAE,EAAE,CAAC,CAAC;QAC7F,CAAC;QACD;;;WAGG;QACH,kBAAkB,CAChB,IAAmC,EACnC,cAAuB;YAEvB,OAAO,OAAO,CAAC;gBACb,MAAM,EAAE,MAAM;gBACd,IAAI,EAAE,kCAAkC;gBACxC,IAAI;gBACJ,cAAc;aACf,CAAC,CAAC;QACL,CAAC;QACD,wFAAwF;QACxF,WAAW,CAAC,IAA4B;YACtC,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,mBAAmB,EAAE,IAAI,EAAE,CAAC,CAAC;QACtE,CAAC;QACD;;;WAGG;QACH,SAAS,CAAC,WAA2B,EAAE,SAAiB;YACtD,OAAO,OAAO,CAAC;gBACb,MAAM,EAAE,MAAM;gBACd,IAAI,EAAE,wBAAwB,IAAA,aAAG,EAAC,WAAW,CAAC,IAAI,IAAA,aAAG,EAAC,SAAS,CAAC,aAAa;aAC9E,CAAC,CAAC;QACL,CAAC;KACF,CAAC;AACJ,CAAC"}