@atlasauth/backend 0.5.0 → 0.6.0

package/dist/client/diagnostics.d.ts

@@ -0,0 +1,53 @@
+import type { RequestFn } from './request';
+export interface LoginReadinessParams {
+    /** The app origin to probe, e.g. `https://app.acme.com`. */
+    origin: string;
+    /** Round-trip the published JWKS for the signing check instead of inferring it. */
+    live?: boolean;
+}
+export interface LoginReadinessCheck {
+    name: string;
+    pass: boolean;
+    observed: unknown;
+    /** What was seen, and the fix when it fails. */
+    detail: string;
+}
+export interface LoginReadiness {
+    object: 'login_readiness';
+    origin: string;
+    live: boolean;
+    data_region?: string | null;
+    ready: boolean;
+    checks: LoginReadinessCheck[];
+}
+export interface RequestInspectorParams {
+    /** The browser origin making the request. */
+    origin: string;
+    /** Default `POST`. */
+    method?: string;
+    /** Default `/v1/client/sign_ins`. */
+    path?: string;
+    /** A session JWT to verify against this instance. */
+    token?: string;
+}
+export interface RequestInspectionFinding {
+    check: string;
+    /** Whether this finding alone rejects the request. */
+    blocks: boolean;
+    observed: unknown;
+    detail: string;
+}
+export interface RequestInspection {
+    object: 'request_inspection';
+    origin: string;
+    method: string;
+    path: string;
+    would_be_rejected: boolean;
+    findings: RequestInspectionFinding[];
+}
+export declare function diagnosticsResource(request: RequestFn): {
+    /** Will a browser sign-in from `origin` work? CORS, cookie, email claim and signing, each with a fix. */
+    loginReadiness(params: LoginReadinessParams): Promise<LoginReadiness>;
+    /** Why would this browser request be rejected? Each finding says whether it blocks. */
+    requestInspector(params: RequestInspectorParams): Promise<RequestInspection>;
+};

package/dist/client/diagnostics.js

@@ -0,0 +1,24 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.diagnosticsResource = diagnosticsResource;
+function diagnosticsResource(request) {
+    return {
+        /** Will a browser sign-in from `origin` work? CORS, cookie, email claim and signing, each with a fix. */
+        loginReadiness(params) {
+            return request({
+                method: 'GET',
+                path: '/v1/diagnostics/login_readiness',
+                query: { origin: params.origin, live: params.live },
+            });
+        },
+        /** Why would this browser request be rejected? Each finding says whether it blocks. */
+        requestInspector(params) {
+            return request({
+                method: 'GET',
+                path: '/v1/diagnostics/request_inspector',
+                query: { ...params },
+            });
+        },
+    };
+}
+//# sourceMappingURL=diagnostics.js.map

package/dist/client/diagnostics.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"diagnostics.js","sourceRoot":"","sources":["../../src/client/diagnostics.ts"],"names":[],"mappings":";;AAsDA,kDAmBC;AAnBD,SAAgB,mBAAmB,CAAC,OAAkB;IACpD,OAAO;QACL,yGAAyG;QACzG,cAAc,CAAC,MAA4B;YACzC,OAAO,OAAO,CAAC;gBACb,MAAM,EAAE,KAAK;gBACb,IAAI,EAAE,iCAAiC;gBACvC,KAAK,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE;aACpD,CAAC,CAAC;QACL,CAAC;QACD,uFAAuF;QACvF,gBAAgB,CAAC,MAA8B;YAC7C,OAAO,OAAO,CAAC;gBACb,MAAM,EAAE,KAAK;gBACb,IAAI,EAAE,mCAAmC;gBACzC,KAAK,EAAE,EAAE,GAAG,MAAM,EAAE;aACrB,CAAC,CAAC;QACL,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/client/email-addresses.d.ts

@@ -0,0 +1,22 @@
+import { type RequestFn } from './request';
+/**
+ * An email address addressed by its own id. The owning user is derived from
+ * the address, so these calls need no user id (the `users.verifyEmail` /
+ * `users.setPrimaryEmail` forms do the same with one).
+ */
+export interface EmailAddressRecord {
+    object: 'email_address';
+    id: string;
+    email_address: string;
+    verification: {
+        status: 'verified' | 'unverified';
+    };
+    verified: boolean;
+    primary: boolean;
+}
+export declare function emailAddressesResource(request: RequestFn): {
+    /** `POST /v1/email_addresses/:id/verify` — mark the address verified. */
+    verify(id: string): Promise<EmailAddressRecord>;
+    /** `POST /v1/email_addresses/:id/primary` — make a verified address the user's primary. */
+    setPrimary(id: string): Promise<EmailAddressRecord>;
+};

package/dist/client/email-addresses.js

@@ -0,0 +1,17 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.emailAddressesResource = emailAddressesResource;
+const request_1 = require("./request");
+function emailAddressesResource(request) {
+    return {
+        /** `POST /v1/email_addresses/:id/verify` — mark the address verified. */
+        verify(id) {
+            return request({ method: 'POST', path: `/v1/email_addresses/${(0, request_1.enc)(id)}/verify` });
+        },
+        /** `POST /v1/email_addresses/:id/primary` — make a verified address the user's primary. */
+        setPrimary(id) {
+            return request({ method: 'POST', path: `/v1/email_addresses/${(0, request_1.enc)(id)}/primary` });
+        },
+    };
+}
+//# sourceMappingURL=email-addresses.js.map

package/dist/client/email-addresses.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"email-addresses.js","sourceRoot":"","sources":["../../src/client/email-addresses.ts"],"names":[],"mappings":";;AAgBA,wDAWC;AA3BD,uCAAgD;AAgBhD,SAAgB,sBAAsB,CAAC,OAAkB;IACvD,OAAO;QACL,yEAAyE;QACzE,MAAM,CAAC,EAAU;YACf,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,uBAAuB,IAAA,aAAG,EAAC,EAAE,CAAC,SAAS,EAAE,CAAC,CAAC;QACpF,CAAC;QACD,2FAA2F;QAC3F,UAAU,CAAC,EAAU;YACnB,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,uBAAuB,IAAA,aAAG,EAAC,EAAE,CAAC,UAAU,EAAE,CAAC,CAAC;QACrF,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/client/entitlement-overrides.d.ts

@@ -0,0 +1,50 @@
+import { type RequestFn } from './request';
+import type { ListPage } from './types';
+export type EntitlementOverrideSubjectType = 'user' | 'org';
+/**
+ * A sales-led entitlement override: a plan / features / limits pinned onto a
+ * user or organization without Stripe (e.g. an Enterprise contract). A
+ * non-expired override wins over the Stripe-derived entitlement and reaches the
+ * session claims on the next session.
+ */
+export interface EntitlementOverride {
+    object: 'entitlement_override';
+    id: string;
+    subject_type: EntitlementOverrideSubjectType;
+    subject_id: string;
+    /** Pinned plan slug, or null when only features/limits are overridden. */
+    plan: string | null;
+    features: string[] | null;
+    limits: Record<string, unknown> | null;
+    /** Epoch ms when the override lapses, or null for open-ended. */
+    expires_at: number | null;
+    created_by: string | null;
+    created_at: number;
+}
+/** At least one of `plan`, `features` or `limits` is required. */
+export interface CreateEntitlementOverrideBody {
+    subject_type: EntitlementOverrideSubjectType;
+    subject_id: string;
+    plan?: string | null;
+    /** Replaces (does not add to) the resolved feature set. */
+    features?: string[] | null;
+    /** Numeric limits, e.g. `{ max_devices: 50 }`. */
+    limits?: Record<string, unknown> | null;
+    /** Epoch ms; omit or null for open-ended. */
+    expires_at?: number | null;
+}
+export interface ListEntitlementOverridesParams {
+    subject_type?: EntitlementOverrideSubjectType;
+    subject_id?: string;
+}
+export declare function entitlementOverridesResource(request: RequestFn): {
+    create(body: CreateEntitlementOverrideBody, idempotencyKey?: string): Promise<EntitlementOverride>;
+    /** Includes expired overrides (kept for audit; they no longer apply). */
+    list(params?: ListEntitlementOverridesParams): Promise<ListPage<EntitlementOverride>>;
+    /** Revoke: the subject reverts to its Stripe-derived entitlement on the next session. */
+    delete(id: string): Promise<{
+        object: "entitlement_override";
+        id: string;
+        deleted: true;
+    }>;
+};

package/dist/client/entitlement-overrides.js

@@ -0,0 +1,20 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.entitlementOverridesResource = entitlementOverridesResource;
+const request_1 = require("./request");
+function entitlementOverridesResource(request) {
+    return {
+        create(body, idempotencyKey) {
+            return request({ method: 'POST', path: '/v1/entitlement_overrides', body, idempotencyKey });
+        },
+        /** Includes expired overrides (kept for audit; they no longer apply). */
+        list(params = {}) {
+            return request({ method: 'GET', path: '/v1/entitlement_overrides', query: { ...params } });
+        },
+        /** Revoke: the subject reverts to its Stripe-derived entitlement on the next session. */
+        delete(id) {
+            return request({ method: 'DELETE', path: `/v1/entitlement_overrides/${(0, request_1.enc)(id)}` });
+        },
+    };
+}
+//# sourceMappingURL=entitlement-overrides.js.map

package/dist/client/entitlement-overrides.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"entitlement-overrides.js","sourceRoot":"","sources":["../../src/client/entitlement-overrides.ts"],"names":[],"mappings":";;AA4CA,oEAmBC;AA/DD,uCAAgD;AA4ChD,SAAgB,4BAA4B,CAAC,OAAkB;IAC7D,OAAO;QACL,MAAM,CACJ,IAAmC,EACnC,cAAuB;YAEvB,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,2BAA2B,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC;QAC9F,CAAC;QACD,yEAAyE;QACzE,IAAI,CACF,SAAyC,EAAE;YAE3C,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,2BAA2B,EAAE,KAAK,EAAE,EAAE,GAAG,MAAM,EAAE,EAAE,CAAC,CAAC;QAC7F,CAAC;QACD,yFAAyF;QACzF,MAAM,CAAC,EAAU;YACf,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,6BAA6B,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;QACrF,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/client/error.d.ts

@@ -29,3 +29,31 @@ export declare class AtlasApiError extends Error {
     /** True when any error in the envelope carries the given stable code. */
     hasCode(code: string): boolean;
 }
+/**
+ * Stable error codes worth branching on, as named constants. Any `code` string
+ * Atlas returns can be compared with `error.code` / `error.hasCode()` directly;
+ * these just save typing them.
+ */
+export declare const AtlasErrorCodes: {
+    /** Emails cannot be sent: no email provider is configured for the instance. */
+    readonly EMAIL_DELIVERY_NOT_CONFIGURED: "EMAIL_DELIVERY_NOT_CONFIGURED";
+    /** This setting needs your own email provider configured first. */
+    readonly EMAIL_PROVIDER_REQUIRED: "EMAIL_PROVIDER_REQUIRED";
+    /** Strict mode: the body had a field this endpoint does not accept (`param` names it). */
+    readonly UNKNOWN_FIELD: "UNKNOWN_FIELD";
+    /** The billing plan still has subscribers and cannot be removed. */
+    readonly PLAN_IN_USE: "PLAN_IN_USE";
+    /** The key is valid but for another API surface (e.g. a platform key on the Backend API). */
+    readonly WRONG_KEY_SURFACE: "WRONG_KEY_SURFACE";
+    /** The key is unknown, revoked or malformed. */
+    readonly INVALID_KEY: "INVALID_KEY";
+    readonly NOT_FOUND: "NOT_FOUND";
+    readonly VALIDATION_FAILED: "VALIDATION_FAILED";
+    readonly RATE_LIMITED: "RATE_LIMITED";
+    readonly IDEMPOTENCY_CONFLICT: "IDEMPOTENCY_CONFLICT";
+    readonly SCOPE_MISSING: "SCOPE_MISSING";
+    readonly FORBIDDEN: "FORBIDDEN";
+    readonly CONFLICT: "CONFLICT";
+};
+/** One of the named {@link AtlasErrorCodes}. */
+export type AtlasErrorCode = (typeof AtlasErrorCodes)[keyof typeof AtlasErrorCodes];

package/dist/client/error.js

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.AtlasApiError = void 0;
+exports.AtlasErrorCodes = exports.AtlasApiError = void 0;
 class AtlasApiError extends Error {
     name = 'AtlasApiError';
     /** HTTP status of the failed response. */
@@ -25,4 +25,30 @@ class AtlasApiError extends Error {
     }
 }
 exports.AtlasApiError = AtlasApiError;
+/**
+ * Stable error codes worth branching on, as named constants. Any `code` string
+ * Atlas returns can be compared with `error.code` / `error.hasCode()` directly;
+ * these just save typing them.
+ */
+exports.AtlasErrorCodes = {
+    /** Emails cannot be sent: no email provider is configured for the instance. */
+    EMAIL_DELIVERY_NOT_CONFIGURED: 'EMAIL_DELIVERY_NOT_CONFIGURED',
+    /** This setting needs your own email provider configured first. */
+    EMAIL_PROVIDER_REQUIRED: 'EMAIL_PROVIDER_REQUIRED',
+    /** Strict mode: the body had a field this endpoint does not accept (`param` names it). */
+    UNKNOWN_FIELD: 'UNKNOWN_FIELD',
+    /** The billing plan still has subscribers and cannot be removed. */
+    PLAN_IN_USE: 'PLAN_IN_USE',
+    /** The key is valid but for another API surface (e.g. a platform key on the Backend API). */
+    WRONG_KEY_SURFACE: 'WRONG_KEY_SURFACE',
+    /** The key is unknown, revoked or malformed. */
+    INVALID_KEY: 'INVALID_KEY',
+    NOT_FOUND: 'NOT_FOUND',
+    VALIDATION_FAILED: 'VALIDATION_FAILED',
+    RATE_LIMITED: 'RATE_LIMITED',
+    IDEMPOTENCY_CONFLICT: 'IDEMPOTENCY_CONFLICT',
+    SCOPE_MISSING: 'SCOPE_MISSING',
+    FORBIDDEN: 'FORBIDDEN',
+    CONFLICT: 'CONFLICT',
+};
 //# sourceMappingURL=error.js.map

package/dist/client/error.js.map

@@ -1 +1 @@
-{"version":3,"file":"error.js","sourceRoot":"","sources":["../../src/client/error.ts"],"names":[],"mappings":";;;AAoBA,MAAa,aAAc,SAAQ,KAAK;IACpB,IAAI,GAAG,eAAe,CAAC;IACzC,0CAA0C;IACjC,MAAM,CAAS;IACxB,8CAA8C;IACrC,MAAM,CAAmB;IAElC,YAAY,MAAc,EAAE,MAAwB,EAAE,OAAgB;QACpE,KAAK,CAAC,OAAO,IAAI,MAAM,CAAC,CAAC,CAAC,EAAE,OAAO,IAAI,wCAAwC,MAAM,EAAE,CAAC,CAAC;QACzF,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QACrB,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QACrB,uEAAuE;QACvE,sEAAsE;QACtE,MAAM,CAAC,cAAc,CAAC,IAAI,EAAE,aAAa,CAAC,SAAS,CAAC,CAAC;IACvD,CAAC;IAED,uEAAuE;IACvE,IAAI,IAAI;QACN,OAAO,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC;IAC9B,CAAC;IAED,yEAAyE;IACzE,OAAO,CAAC,IAAY;QAClB,OAAO,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC;IAClD,CAAC;CACF;AAzBD,sCAyBC"}
+{"version":3,"file":"error.js","sourceRoot":"","sources":["../../src/client/error.ts"],"names":[],"mappings":";;;AAoBA,MAAa,aAAc,SAAQ,KAAK;IACpB,IAAI,GAAG,eAAe,CAAC;IACzC,0CAA0C;IACjC,MAAM,CAAS;IACxB,8CAA8C;IACrC,MAAM,CAAmB;IAElC,YAAY,MAAc,EAAE,MAAwB,EAAE,OAAgB;QACpE,KAAK,CAAC,OAAO,IAAI,MAAM,CAAC,CAAC,CAAC,EAAE,OAAO,IAAI,wCAAwC,MAAM,EAAE,CAAC,CAAC;QACzF,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QACrB,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QACrB,uEAAuE;QACvE,sEAAsE;QACtE,MAAM,CAAC,cAAc,CAAC,IAAI,EAAE,aAAa,CAAC,SAAS,CAAC,CAAC;IACvD,CAAC;IAED,uEAAuE;IACvE,IAAI,IAAI;QACN,OAAO,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC;IAC9B,CAAC;IAED,yEAAyE;IACzE,OAAO,CAAC,IAAY;QAClB,OAAO,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC;IAClD,CAAC;CACF;AAzBD,sCAyBC;AAED;;;;GAIG;AACU,QAAA,eAAe,GAAG;IAC7B,+EAA+E;IAC/E,6BAA6B,EAAE,+BAA+B;IAC9D,mEAAmE;IACnE,uBAAuB,EAAE,yBAAyB;IAClD,0FAA0F;IAC1F,aAAa,EAAE,eAAe;IAC9B,oEAAoE;IACpE,WAAW,EAAE,aAAa;IAC1B,6FAA6F;IAC7F,iBAAiB,EAAE,mBAAmB;IACtC,gDAAgD;IAChD,WAAW,EAAE,aAAa;IAC1B,SAAS,EAAE,WAAW;IACtB,iBAAiB,EAAE,mBAAmB;IACtC,YAAY,EAAE,cAAc;IAC5B,oBAAoB,EAAE,sBAAsB;IAC5C,aAAa,EAAE,eAAe;IAC9B,SAAS,EAAE,WAAW;IACtB,QAAQ,EAAE,UAAU;CACZ,CAAC"}