@atlasauth/backend 0.5.0 → 0.6.0

package/dist/client/platform.d.ts

@@ -0,0 +1,328 @@
+import { type AtlasRequestSettings, type RequestFn, type UnknownFieldsEvent } from './request';
+import type { ListPage } from './types';
+import type { AtlasDesign, AtlasDesignPatch, DeletedDesignAsset, DesignAsset, DesignAssetData, DesignPreview, ResolvedAtlasDesign, UploadDesignAssetOptions } from './design';
+/**
+ * The platform client: the platform-key (`psk_...`) surface for provisioning and
+ * managing apps you own, and for registering Sign in with Atlas apps.
+ *
+ * A separate client from `createAtlasClient`, because the key is different: a
+ * platform key manages many apps, a secret key manages exactly one instance.
+ */
+export interface AtlasPlatformClientConfig {
+    /** The platform key (`psk_...`). Sent as `Authorization: Bearer <key>`; never logged. */
+    platformKey: string;
+    /** Base URL of the API, e.g. `https://api.atlasauth.net`. */
+    apiUrl?: string;
+    /** Injectable `fetch`, for tests and non-global-fetch runtimes. */
+    fetch?: typeof fetch;
+    /** `true` sends `Atlas-Strict: true` on every write (unknown body fields → 422). */
+    strict?: boolean;
+    /** Called with the body fields Atlas ignored on a successful write. */
+    onUnknownFields?: (event: UnknownFieldsEvent) => void;
+}
+/** An app (instance) a platform owns. Never carries a secret. */
+export interface PlatformApp {
+    object: 'app';
+    id: string;
+    name: string;
+    environment: 'production' | 'development';
+    publishable_key: string;
+    allowed_origins: string[];
+    /** Housekeeping labels (up to 20, each up to 40 chars). */
+    tags: string[];
+    /** Hidden from the default listing. A visibility flag only: the app still serves auth. */
+    archived: boolean;
+    /** Epoch ms the app was archived, or null. */
+    archived_at: number | null;
+    disabled: boolean;
+    created_at: number;
+    updated_at: number;
+}
+/** An app plus its secret key (`sk_...`), revealed exactly once. */
+export interface PlatformAppWithSecret extends PlatformApp {
+    secret: string;
+    note?: string;
+}
+/** The create response: the app, its secret and (by default) its test-mode sibling. */
+export interface CreatedPlatformApp extends PlatformAppWithSecret {
+    /**
+     * The sibling instance in the opposite environment (development for a
+     * production app) with its own publishable key and reveal-once secret.
+     * Absent when `create_development_sibling: false`.
+     */
+    sibling_instance?: PlatformAppWithSecret;
+}
+export interface CreatePlatformAppBody {
+    name?: string;
+    environment?: 'production' | 'development';
+    allowed_origins?: string[];
+    /** Default true: also provision a test-mode sibling instance. */
+    create_development_sibling?: boolean;
+    tags?: string[];
+}
+export interface UpdatePlatformAppBody {
+    name?: string;
+    allowed_origins?: string[];
+    tags?: string[];
+}
+export interface ListPlatformAppsParams {
+    /** Only apps carrying this tag. */
+    tag?: string;
+    /** `true`: only archived apps. */
+    archived?: boolean;
+    /** `true`: include archived apps alongside active ones. */
+    include_archived?: boolean;
+}
+export interface CreatePlatformInstanceBody {
+    environment?: 'production' | 'development';
+    allowed_origins?: string[];
+}
+export interface PlatformAppSecretRotation {
+    object: 'app_secret';
+    app_id: string;
+    /** The new secret key, revealed exactly once. */
+    secret: string;
+    overlap_seconds: number;
+    /** When the prior keys stop working (epoch ms); null on a hard cut. */
+    previous_keys_expire_at?: number | null;
+    note: string;
+}
+export interface PlatformInstanceSecretRotation {
+    object: 'app_secret';
+    id: string;
+    secret: string;
+    note: string;
+}
+/** Metadata of a currently-valid secret key. Never the secret itself. */
+export interface PlatformSecretKey {
+    object: 'secret_key';
+    id: string;
+    prefix: string;
+    created_at: number;
+    expires_at?: number | null;
+}
+export interface PlatformAppTransfer {
+    object: 'app_transfer';
+    id: string;
+    /** One-time token for the receiving platform's `apps.acceptTransfer`. */
+    transfer_token: string;
+    expires_at: number;
+    note: string;
+}
+export interface PlatformAppBulkDeleteResult {
+    object: 'bulk_delete_result';
+    results: Array<{
+        id: string;
+        deleted: boolean;
+        reason?: string;
+    }>;
+}
+export interface AccountlessApp {
+    object: 'accountless_app';
+    id: string;
+    name: string;
+    environment: string;
+    publishable_key: string;
+    /** One-time token the new owner passes to `apps.claim`. */
+    claim_token: string;
+    expires_at: number;
+    note: string;
+}
+export interface CreateAccountlessAppBody {
+    name?: string;
+    environment?: 'production' | 'development';
+    allowed_origins?: string[];
+}
+/** Page text on the Sign in with Atlas page. Plain text; null or empty uses the default. */
+export interface AtlasIdAppCopy {
+    /** Default "Sign in to continue to {app}". */
+    sign_in_title?: string | null;
+    sign_in_subtitle?: string | null;
+    /** Default "Create your account to continue to {app}". */
+    sign_up_title?: string | null;
+    sign_up_subtitle?: string | null;
+    /** Shown on the consent screen above the list of permissions. */
+    consent_message?: string | null;
+    /** https URL, linked in the page footer. */
+    support_url?: string | null;
+    /** Text of the support link. Default "Help". */
+    support_label?: string | null;
+}
+/** How the Sign in with Atlas page and consent screen look for an app. */
+export interface AtlasIdAppBranding {
+    theme: 'auto' | 'light' | 'dark';
+    accent_color: string | null;
+    background_color: string | null;
+    privacy_policy_url: string | null;
+    terms_of_service_url: string | null;
+    /** The stored design overrides (null = none). */
+    design?: AtlasDesign | null;
+    resolved_design?: ResolvedAtlasDesign;
+    copy: AtlasIdAppCopy;
+}
+/**
+ * Branding input. On update each field merges with what is stored; `null`
+ * clears a field, and `branding: null` clears all of it.
+ */
+export interface AtlasIdAppBrandingInput {
+    /** Default `auto` (follows the visitor's system setting). */
+    theme?: 'auto' | 'light' | 'dark' | null;
+    /** Button colour, `#RRGGBB`. */
+    accent_color?: string | null;
+    /** Page background behind the card, `#RRGGBB`. */
+    background_color?: string | null;
+    /** https URL, linked in the page footer. */
+    privacy_policy_url?: string | null;
+    terms_of_service_url?: string | null;
+    /** Merged like a design patch over what is stored; `null` removes the design. */
+    design?: AtlasDesignPatch | null;
+    copy?: AtlasIdAppCopy;
+}
+/** A Sign in with Atlas app: an OpenID Connect client on the Atlas issuer. */
+export interface AtlasIdApp {
+    object: 'atlas_id_app';
+    id: string;
+    client_id: string;
+    name: string;
+    logo_url?: string | null;
+    homepage_url?: string | null;
+    branding?: AtlasIdAppBranding;
+    redirect_uris: string[];
+    post_logout_redirect_uris: string[];
+    backchannel_logout_uri: string | null;
+    backchannel_logout_session_required: boolean;
+    frontchannel_logout_uri: string | null;
+    frontchannel_logout_session_required: boolean;
+    allowed_scopes: string[];
+    type: 'confidential' | 'public';
+    secret_prefix?: string | null;
+    managed_by_instance_id?: string | null;
+    created_at: number;
+    updated_at: number;
+    /** On `get` only: people who have approved the app. */
+    user_count?: number;
+}
+/** Create / rotate response: confidential apps carry the client secret exactly once. */
+export interface AtlasIdAppWithSecret extends AtlasIdApp {
+    client_secret?: string;
+    note?: string;
+}
+export interface AtlasIdAppList {
+    object: 'list';
+    data: AtlasIdApp[];
+    /** The issuer every app's tokens carry. */
+    issuer: string;
+    discovery_url: string;
+    /** How many apps the account may register. */
+    limit: number;
+}
+interface AtlasIdAppFields {
+    /** Where `/oauth2/logout` may send the user after sign-out (exact match). */
+    post_logout_redirect_uris?: string[];
+    /** Back-Channel Logout: a signed `logout_token` is POSTed here when the user signs out. */
+    backchannel_logout_uri?: string | null;
+    /** Whether the app needs `sid` in the logout_token (Atlas always includes it). */
+    backchannel_logout_session_required?: boolean;
+    /** Front-Channel Logout: loaded in a hidden iframe on the Atlas sign-out page. */
+    frontchannel_logout_uri?: string | null;
+    /** Add `sid` to the front-channel logout URL. */
+    frontchannel_logout_session_required?: boolean;
+    logo_url?: string | null;
+    homepage_url?: string | null;
+    allowed_scopes?: string[];
+    branding?: AtlasIdAppBrandingInput | null;
+}
+export interface CreateAtlasIdAppBody extends AtlasIdAppFields {
+    name: string;
+    redirect_uris: string[];
+    /** Default `confidential`. */
+    type?: 'confidential' | 'public';
+}
+export interface UpdateAtlasIdAppBody extends AtlasIdAppFields {
+    name?: string;
+    redirect_uris?: string[];
+}
+declare function platformNamespaces(request: RequestFn): {
+    apps: {
+        /** Archived apps are hidden unless `include_archived` or `archived` is set. */
+        list(params?: ListPlatformAppsParams): Promise<ListPage<PlatformApp>>;
+        /** Provision an app; its secret key is revealed exactly once. */
+        create(body?: CreatePlatformAppBody, idempotencyKey?: string): Promise<CreatedPlatformApp>;
+        get(id: string): Promise<PlatformApp>;
+        update(id: string, body: UpdatePlatformAppBody): Promise<PlatformApp>;
+        /** Disable the app (sign-ins and sign-ups refused). Soft and reversible. */
+        delete(id: string): Promise<{
+            object: "app";
+            id: string;
+            disabled: true;
+            note: string;
+        }>;
+        /** Disable up to 100 apps; ids you do not own are skipped as `not_found`. */
+        bulkDelete(ids: string[]): Promise<PlatformAppBulkDeleteResult>;
+        /** Hide from the default listing. Does not disable the app. */
+        archive(id: string): Promise<PlatformApp>;
+        unarchive(id: string): Promise<PlatformApp>;
+        /**
+         * Mint a new secret key while the prior keys stay valid for
+         * `overlap_seconds` (default 72h, max 7 days; 0 = immediate cut).
+         */
+        rotateSecret(id: string, body?: {
+            overlap_seconds?: number;
+        }, idempotencyKey?: string): Promise<PlatformAppSecretRotation>;
+        /** Currently-valid secret keys (metadata only). */
+        secretKeys(id: string): Promise<ListPage<PlatformSecretKey>>;
+        instances: {
+            list(appId: string): Promise<ListPage<PlatformApp>>;
+            /** Add an instance (e.g. development beside production); secret revealed once. */
+            create(appId: string, body?: CreatePlatformInstanceBody, idempotencyKey?: string): Promise<PlatformAppWithSecret>;
+            /** Revoke the instance's prior keys and mint a new one, revealed once. */
+            rotateSecret(appId: string, instanceId: string, idempotencyKey?: string): Promise<PlatformInstanceSecretRotation>;
+        };
+        /** Start a transfer: a one-time token the receiving platform accepts. */
+        transfer(id: string, idempotencyKey?: string): Promise<PlatformAppTransfer>;
+        /** Take ownership of an app by its transfer token. */
+        acceptTransfer(transferToken: string, idempotencyKey?: string): Promise<PlatformApp & {
+            note: string;
+        }>;
+        /** Claim an accountless app by its claim token; mints its first secret key. */
+        claim(claimToken: string, idempotencyKey?: string): Promise<PlatformAppWithSecret>;
+    };
+    accountlessApps: {
+        /** Mint an app owned by no platform, with a one-time claim token. No secret until claimed. */
+        create(body?: CreateAccountlessAppBody, idempotencyKey?: string): Promise<AccountlessApp>;
+    };
+    /** Sign in with Atlas apps registered to the platform's account. */
+    atlasIdApps: {
+        list(): Promise<AtlasIdAppList>;
+        /** Register an app. A confidential app's `client_secret` is returned exactly once. */
+        create(body: CreateAtlasIdAppBody, idempotencyKey?: string): Promise<AtlasIdAppWithSecret>;
+        get(id: string): Promise<AtlasIdApp>;
+        /** `[]` clears a URI list; `null` clears a logout URI. */
+        update(id: string, body: UpdateAtlasIdAppBody): Promise<AtlasIdApp>;
+        /** The client_id stops working immediately. */
+        delete(id: string): Promise<{
+            object: "atlas_id_app";
+            id: string;
+            deleted: true;
+        }>;
+        /** New client secret, returned exactly once. Public apps have none (409). */
+        rotateSecret(id: string): Promise<AtlasIdAppWithSecret>;
+        /** Preview a design on the Sign in with Atlas page without saving it. */
+        previewDesign(design: AtlasDesign): Promise<DesignPreview>;
+    };
+    /** Design images owned by the platform's account, for Sign in with Atlas app designs. */
+    designAssets: {
+        upload(data: DesignAssetData, options?: UploadDesignAssetOptions): Promise<DesignAsset>;
+        list(): Promise<ListPage<DesignAsset>>;
+        /** Refused with 409 while a saved app design still uses it. */
+        delete(assetId: string): Promise<DeletedDesignAsset>;
+    };
+};
+/** Every namespace of the platform client. */
+export type AtlasPlatformNamespaces = ReturnType<typeof platformNamespaces>;
+export interface AtlasPlatformClient extends AtlasPlatformNamespaces {
+    /** A copy of this client with some settings changed, e.g. `{ strict: true }`. */
+    withOptions(overrides: AtlasRequestSettings): AtlasPlatformClient;
+}
+export declare function createAtlasPlatformClient(config: AtlasPlatformClientConfig): AtlasPlatformClient;
+export {};

package/dist/client/platform.js

@@ -0,0 +1,187 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.createAtlasPlatformClient = createAtlasPlatformClient;
+const request_1 = require("./request");
+// ---- the client ----------------------------------------------------------------
+function platformNamespaces(request) {
+    return {
+        apps: {
+            /** Archived apps are hidden unless `include_archived` or `archived` is set. */
+            list(params = {}) {
+                return request({ method: 'GET', path: '/v1/platform/apps', query: { ...params } });
+            },
+            /** Provision an app; its secret key is revealed exactly once. */
+            create(body = {}, idempotencyKey) {
+                return request({ method: 'POST', path: '/v1/platform/apps', body, idempotencyKey });
+            },
+            get(id) {
+                return request({ method: 'GET', path: `/v1/platform/apps/${(0, request_1.enc)(id)}` });
+            },
+            update(id, body) {
+                return request({ method: 'PATCH', path: `/v1/platform/apps/${(0, request_1.enc)(id)}`, body });
+            },
+            /** Disable the app (sign-ins and sign-ups refused). Soft and reversible. */
+            delete(id) {
+                return request({ method: 'DELETE', path: `/v1/platform/apps/${(0, request_1.enc)(id)}` });
+            },
+            /** Disable up to 100 apps; ids you do not own are skipped as `not_found`. */
+            bulkDelete(ids) {
+                return request({ method: 'POST', path: '/v1/platform/apps/bulk_delete', body: { ids } });
+            },
+            /** Hide from the default listing. Does not disable the app. */
+            archive(id) {
+                return request({ method: 'POST', path: `/v1/platform/apps/${(0, request_1.enc)(id)}/archive` });
+            },
+            unarchive(id) {
+                return request({ method: 'POST', path: `/v1/platform/apps/${(0, request_1.enc)(id)}/unarchive` });
+            },
+            /**
+             * Mint a new secret key while the prior keys stay valid for
+             * `overlap_seconds` (default 72h, max 7 days; 0 = immediate cut).
+             */
+            rotateSecret(id, body = {}, idempotencyKey) {
+                return request({
+                    method: 'POST',
+                    path: `/v1/platform/apps/${(0, request_1.enc)(id)}/rotate_secret`,
+                    body,
+                    idempotencyKey,
+                });
+            },
+            /** Currently-valid secret keys (metadata only). */
+            secretKeys(id) {
+                return request({ method: 'GET', path: `/v1/platform/apps/${(0, request_1.enc)(id)}/secret_keys` });
+            },
+            instances: {
+                list(appId) {
+                    return request({ method: 'GET', path: `/v1/platform/apps/${(0, request_1.enc)(appId)}/instances` });
+                },
+                /** Add an instance (e.g. development beside production); secret revealed once. */
+                create(appId, body = {}, idempotencyKey) {
+                    return request({
+                        method: 'POST',
+                        path: `/v1/platform/apps/${(0, request_1.enc)(appId)}/instances`,
+                        body,
+                        idempotencyKey,
+                    });
+                },
+                /** Revoke the instance's prior keys and mint a new one, revealed once. */
+                rotateSecret(appId, instanceId, idempotencyKey) {
+                    return request({
+                        method: 'POST',
+                        path: `/v1/platform/apps/${(0, request_1.enc)(appId)}/instances/${(0, request_1.enc)(instanceId)}/rotate_secret`,
+                        idempotencyKey,
+                    });
+                },
+            },
+            /** Start a transfer: a one-time token the receiving platform accepts. */
+            transfer(id, idempotencyKey) {
+                return request({
+                    method: 'POST',
+                    path: `/v1/platform/apps/${(0, request_1.enc)(id)}/transfer`,
+                    idempotencyKey,
+                });
+            },
+            /** Take ownership of an app by its transfer token. */
+            acceptTransfer(transferToken, idempotencyKey) {
+                return request({
+                    method: 'POST',
+                    path: '/v1/platform/apps/accept_transfer',
+                    body: { transfer_token: transferToken },
+                    idempotencyKey,
+                });
+            },
+            /** Claim an accountless app by its claim token; mints its first secret key. */
+            claim(claimToken, idempotencyKey) {
+                return request({
+                    method: 'POST',
+                    path: '/v1/platform/apps/claim',
+                    body: { claim_token: claimToken },
+                    idempotencyKey,
+                });
+            },
+        },
+        accountlessApps: {
+            /** Mint an app owned by no platform, with a one-time claim token. No secret until claimed. */
+            create(body = {}, idempotencyKey) {
+                return request({
+                    method: 'POST',
+                    path: '/v1/platform/accountless_apps',
+                    body,
+                    idempotencyKey,
+                });
+            },
+        },
+        /** Sign in with Atlas apps registered to the platform's account. */
+        atlasIdApps: {
+            list() {
+                return request({ method: 'GET', path: '/v1/platform/atlas_id_apps' });
+            },
+            /** Register an app. A confidential app's `client_secret` is returned exactly once. */
+            create(body, idempotencyKey) {
+                return request({
+                    method: 'POST',
+                    path: '/v1/platform/atlas_id_apps',
+                    body,
+                    idempotencyKey,
+                });
+            },
+            get(id) {
+                return request({ method: 'GET', path: `/v1/platform/atlas_id_apps/${(0, request_1.enc)(id)}` });
+            },
+            /** `[]` clears a URI list; `null` clears a logout URI. */
+            update(id, body) {
+                return request({ method: 'PATCH', path: `/v1/platform/atlas_id_apps/${(0, request_1.enc)(id)}`, body });
+            },
+            /** The client_id stops working immediately. */
+            delete(id) {
+                return request({ method: 'DELETE', path: `/v1/platform/atlas_id_apps/${(0, request_1.enc)(id)}` });
+            },
+            /** New client secret, returned exactly once. Public apps have none (409). */
+            rotateSecret(id) {
+                return request({
+                    method: 'POST',
+                    path: `/v1/platform/atlas_id_apps/${(0, request_1.enc)(id)}/rotate_secret`,
+                });
+            },
+            /** Preview a design on the Sign in with Atlas page without saving it. */
+            previewDesign(design) {
+                return request({
+                    method: 'POST',
+                    path: '/v1/platform/atlas_id_apps/design/preview',
+                    body: { design },
+                });
+            },
+        },
+        /** Design images owned by the platform's account, for Sign in with Atlas app designs. */
+        designAssets: {
+            upload(data, options = {}) {
+                return request({
+                    method: 'POST',
+                    path: '/v1/platform/design/assets',
+                    query: { kind: options.kind },
+                    rawBody: { data, contentType: options.contentType },
+                });
+            },
+            list() {
+                return request({ method: 'GET', path: '/v1/platform/design/assets' });
+            },
+            /** Refused with 409 while a saved app design still uses it. */
+            delete(assetId) {
+                return request({ method: 'DELETE', path: `/v1/platform/design/assets/${(0, request_1.enc)(assetId)}` });
+            },
+        },
+    };
+}
+function createAtlasPlatformClient(config) {
+    if (!config.platformKey) {
+        throw new Error('createAtlasPlatformClient requires a platformKey.');
+    }
+    const request = (0, request_1.createKeyedRequest)(config.platformKey, config);
+    return {
+        ...platformNamespaces(request),
+        withOptions(overrides) {
+            return createAtlasPlatformClient({ ...config, ...overrides });
+        },
+    };
+}
+//# sourceMappingURL=platform.js.map

package/dist/client/platform.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"platform.js","sourceRoot":"","sources":["../../src/client/platform.ts"],"names":[],"mappings":";;AAieA,8DAWC;AA5eD,uCAMmB;AAsRnB,mFAAmF;AAEnF,SAAS,kBAAkB,CAAC,OAAkB;IAC5C,OAAO;QACL,IAAI,EAAE;YACJ,+EAA+E;YAC/E,IAAI,CAAC,SAAiC,EAAE;gBACtC,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,mBAAmB,EAAE,KAAK,EAAE,EAAE,GAAG,MAAM,EAAE,EAAE,CAAC,CAAC;YACrF,CAAC;YACD,iEAAiE;YACjE,MAAM,CAAC,OAA8B,EAAE,EAAE,cAAuB;gBAC9D,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,mBAAmB,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC;YACtF,CAAC;YACD,GAAG,CAAC,EAAU;gBACZ,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,qBAAqB,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;YAC1E,CAAC;YACD,MAAM,CAAC,EAAU,EAAE,IAA2B;gBAC5C,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,qBAAqB,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;YAClF,CAAC;YACD,4EAA4E;YAC5E,MAAM,CACJ,EAAU;gBAEV,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,qBAAqB,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;YAC7E,CAAC;YACD,6EAA6E;YAC7E,UAAU,CAAC,GAAa;gBACtB,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,+BAA+B,EAAE,IAAI,EAAE,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC;YAC3F,CAAC;YACD,+DAA+D;YAC/D,OAAO,CAAC,EAAU;gBAChB,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,qBAAqB,IAAA,aAAG,EAAC,EAAE,CAAC,UAAU,EAAE,CAAC,CAAC;YACnF,CAAC;YACD,SAAS,CAAC,EAAU;gBAClB,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,qBAAqB,IAAA,aAAG,EAAC,EAAE,CAAC,YAAY,EAAE,CAAC,CAAC;YACrF,CAAC;YACD;;;eAGG;YACH,YAAY,CACV,EAAU,EACV,OAAqC,EAAE,EACvC,cAAuB;gBAEvB,OAAO,OAAO,CAAC;oBACb,MAAM,EAAE,MAAM;oBACd,IAAI,EAAE,qBAAqB,IAAA,aAAG,EAAC,EAAE,CAAC,gBAAgB;oBAClD,IAAI;oBACJ,cAAc;iBACf,CAAC,CAAC;YACL,CAAC;YACD,mDAAmD;YACnD,UAAU,CAAC,EAAU;gBACnB,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,qBAAqB,IAAA,aAAG,EAAC,EAAE,CAAC,cAAc,EAAE,CAAC,CAAC;YACtF,CAAC;YACD,SAAS,EAAE;gBACT,IAAI,CAAC,KAAa;oBAChB,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,qBAAqB,IAAA,aAAG,EAAC,KAAK,CAAC,YAAY,EAAE,CAAC,CAAC;gBACvF,CAAC;gBACD,kFAAkF;gBAClF,MAAM,CACJ,KAAa,EACb,OAAmC,EAAE,EACrC,cAAuB;oBAEvB,OAAO,OAAO,CAAC;wBACb,MAAM,EAAE,MAAM;wBACd,IAAI,EAAE,qBAAqB,IAAA,aAAG,EAAC,KAAK,CAAC,YAAY;wBACjD,IAAI;wBACJ,cAAc;qBACf,CAAC,CAAC;gBACL,CAAC;gBACD,0EAA0E;gBAC1E,YAAY,CACV,KAAa,EACb,UAAkB,EAClB,cAAuB;oBAEvB,OAAO,OAAO,CAAC;wBACb,MAAM,EAAE,MAAM;wBACd,IAAI,EAAE,qBAAqB,IAAA,aAAG,EAAC,KAAK,CAAC,cAAc,IAAA,aAAG,EAAC,UAAU,CAAC,gBAAgB;wBAClF,cAAc;qBACf,CAAC,CAAC;gBACL,CAAC;aACF;YACD,yEAAyE;YACzE,QAAQ,CAAC,EAAU,EAAE,cAAuB;gBAC1C,OAAO,OAAO,CAAC;oBACb,MAAM,EAAE,MAAM;oBACd,IAAI,EAAE,qBAAqB,IAAA,aAAG,EAAC,EAAE,CAAC,WAAW;oBAC7C,cAAc;iBACf,CAAC,CAAC;YACL,CAAC;YACD,sDAAsD;YACtD,cAAc,CACZ,aAAqB,EACrB,cAAuB;gBAEvB,OAAO,OAAO,CAAC;oBACb,MAAM,EAAE,MAAM;oBACd,IAAI,EAAE,mCAAmC;oBACzC,IAAI,EAAE,EAAE,cAAc,EAAE,aAAa,EAAE;oBACvC,cAAc;iBACf,CAAC,CAAC;YACL,CAAC;YACD,+EAA+E;YAC/E,KAAK,CAAC,UAAkB,EAAE,cAAuB;gBAC/C,OAAO,OAAO,CAAC;oBACb,MAAM,EAAE,MAAM;oBACd,IAAI,EAAE,yBAAyB;oBAC/B,IAAI,EAAE,EAAE,WAAW,EAAE,UAAU,EAAE;oBACjC,cAAc;iBACf,CAAC,CAAC;YACL,CAAC;SACF;QACD,eAAe,EAAE;YACf,8FAA8F;YAC9F,MAAM,CAAC,OAAiC,EAAE,EAAE,cAAuB;gBACjE,OAAO,OAAO,CAAC;oBACb,MAAM,EAAE,MAAM;oBACd,IAAI,EAAE,+BAA+B;oBACrC,IAAI;oBACJ,cAAc;iBACf,CAAC,CAAC;YACL,CAAC;SACF;QACD,oEAAoE;QACpE,WAAW,EAAE;YACX,IAAI;gBACF,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,4BAA4B,EAAE,CAAC,CAAC;YACxE,CAAC;YACD,sFAAsF;YACtF,MAAM,CAAC,IAA0B,EAAE,cAAuB;gBACxD,OAAO,OAAO,CAAC;oBACb,MAAM,EAAE,MAAM;oBACd,IAAI,EAAE,4BAA4B;oBAClC,IAAI;oBACJ,cAAc;iBACf,CAAC,CAAC;YACL,CAAC;YACD,GAAG,CAAC,EAAU;gBACZ,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,8BAA8B,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;YACnF,CAAC;YACD,0DAA0D;YAC1D,MAAM,CAAC,EAAU,EAAE,IAA0B;gBAC3C,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,8BAA8B,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;YAC3F,CAAC;YACD,+CAA+C;YAC/C,MAAM,CAAC,EAAU;gBACf,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,8BAA8B,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;YACtF,CAAC;YACD,6EAA6E;YAC7E,YAAY,CAAC,EAAU;gBACrB,OAAO,OAAO,CAAC;oBACb,MAAM,EAAE,MAAM;oBACd,IAAI,EAAE,8BAA8B,IAAA,aAAG,EAAC,EAAE,CAAC,gBAAgB;iBAC5D,CAAC,CAAC;YACL,CAAC;YACD,yEAAyE;YACzE,aAAa,CAAC,MAAmB;gBAC/B,OAAO,OAAO,CAAC;oBACb,MAAM,EAAE,MAAM;oBACd,IAAI,EAAE,2CAA2C;oBACjD,IAAI,EAAE,EAAE,MAAM,EAAE;iBACjB,CAAC,CAAC;YACL,CAAC;SACF;QACD,yFAAyF;QACzF,YAAY,EAAE;YACZ,MAAM,CAAC,IAAqB,EAAE,UAAoC,EAAE;gBAClE,OAAO,OAAO,CAAC;oBACb,MAAM,EAAE,MAAM;oBACd,IAAI,EAAE,4BAA4B;oBAClC,KAAK,EAAE,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE;oBAC7B,OAAO,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,CAAC,WAAW,EAAE;iBACpD,CAAC,CAAC;YACL,CAAC;YACD,IAAI;gBACF,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,4BAA4B,EAAE,CAAC,CAAC;YACxE,CAAC;YACD,+DAA+D;YAC/D,MAAM,CAAC,OAAe;gBACpB,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,8BAA8B,IAAA,aAAG,EAAC,OAAO,CAAC,EAAE,EAAE,CAAC,CAAC;YAC3F,CAAC;SACF;KACF,CAAC;AACJ,CAAC;AAUD,SAAgB,yBAAyB,CAAC,MAAiC;IACzE,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC;QACxB,MAAM,IAAI,KAAK,CAAC,mDAAmD,CAAC,CAAC;IACvE,CAAC;IACD,MAAM,OAAO,GAAG,IAAA,4BAAkB,EAAC,MAAM,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC;IAC/D,OAAO;QACL,GAAG,kBAAkB,CAAC,OAAO,CAAC;QAC9B,WAAW,CAAC,SAA+B;YACzC,OAAO,yBAAyB,CAAC,EAAE,GAAG,MAAM,EAAE,GAAG,SAAS,EAAE,CAAC,CAAC;QAChE,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/client/redirect-urls.d.ts

@@ -0,0 +1,23 @@
+import { type RequestFn } from './request';
+import type { ListPage } from './types';
+/** An allowlisted OAuth/SSO redirect URL. */
+export interface RedirectUrl {
+    object: 'redirect_url';
+    id: string;
+    url: string;
+    /** Epoch ms. */
+    created_at: number;
+}
+export declare function redirectUrlsResource(request: RequestFn): {
+    list(): Promise<ListPage<RedirectUrl> & {
+        next_cursor?: string | null;
+    }>;
+    /** Add an absolute http(s) URL. Idempotent on the URL. */
+    create(url: string, idempotencyKey?: string): Promise<RedirectUrl>;
+    get(id: string): Promise<RedirectUrl>;
+    delete(id: string): Promise<{
+        object: "redirect_url";
+        id: string;
+        deleted: true;
+    }>;
+};

package/dist/client/redirect-urls.js

@@ -0,0 +1,22 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.redirectUrlsResource = redirectUrlsResource;
+const request_1 = require("./request");
+function redirectUrlsResource(request) {
+    return {
+        list() {
+            return request({ method: 'GET', path: '/v1/redirect_urls' });
+        },
+        /** Add an absolute http(s) URL. Idempotent on the URL. */
+        create(url, idempotencyKey) {
+            return request({ method: 'POST', path: '/v1/redirect_urls', body: { url }, idempotencyKey });
+        },
+        get(id) {
+            return request({ method: 'GET', path: `/v1/redirect_urls/${(0, request_1.enc)(id)}` });
+        },
+        delete(id) {
+            return request({ method: 'DELETE', path: `/v1/redirect_urls/${(0, request_1.enc)(id)}` });
+        },
+    };
+}
+//# sourceMappingURL=redirect-urls.js.map

package/dist/client/redirect-urls.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"redirect-urls.js","sourceRoot":"","sources":["../../src/client/redirect-urls.ts"],"names":[],"mappings":";;AAYA,oDAgBC;AA5BD,uCAAgD;AAYhD,SAAgB,oBAAoB,CAAC,OAAkB;IACrD,OAAO;QACL,IAAI;YACF,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,mBAAmB,EAAE,CAAC,CAAC;QAC/D,CAAC;QACD,0DAA0D;QAC1D,MAAM,CAAC,GAAW,EAAE,cAAuB;YACzC,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,mBAAmB,EAAE,IAAI,EAAE,EAAE,GAAG,EAAE,EAAE,cAAc,EAAE,CAAC,CAAC;QAC/F,CAAC;QACD,GAAG,CAAC,EAAU;YACZ,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,qBAAqB,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;QAC1E,CAAC;QACD,MAAM,CAAC,EAAU;YACf,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,qBAAqB,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;QAC7E,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/client/request.d.ts

@@ -23,6 +23,37 @@ export interface AtlasClientConfig {
     apiUrl?: string;
     /** Injectable `fetch`, for tests and non-global-fetch runtimes. */
     fetch?: typeof fetch;
+    /**
+     * Strict request bodies. `true` sends `Atlas-Strict: true` on every write, so
+     * a body field the endpoint does not accept is refused with
+     * `422 UNKNOWN_FIELD` (before anything changes) instead of being ignored.
+     * `false` sends `Atlas-Strict: false`, opting out of an instance-wide strict
+     * default. Unset sends nothing and the instance setting applies. Override it
+     * for a single call with `client.withOptions({ strict })`.
+     */
+    strict?: boolean;
+    /**
+     * Called when a write succeeded but Atlas ignored some body fields (the
+     * `Atlas-Unknown-Fields` response header) — usually a typo or a field from a
+     * newer API version. Not called in strict mode, where the write fails instead.
+     */
+    onUnknownFields?: (event: UnknownFieldsEvent) => void;
+}
+/** What {@link AtlasClientConfig.onUnknownFields} receives. */
+export interface UnknownFieldsEvent {
+    method: RequestOptions['method'];
+    /** The request path, e.g. `/v1/users/user_123`. */
+    path: string;
+    /** Every ignored field; nested fields as `parent.child`. */
+    fields: string[];
+}
+/** Per-client settings `withOptions` can override. */
+export type AtlasRequestSettings = Pick<AtlasClientConfig, 'strict' | 'onUnknownFields'>;
+/** A raw (non-JSON) request body, e.g. image bytes for a design-asset upload. */
+export interface RawBody {
+    data: Blob | ArrayBuffer | ArrayBufferView;
+    /** The body's media type, e.g. `image/png`. Defaults to a Blob's own `type`. */
+    contentType?: string;
 }
 /** The default BAPI origin, overridable per instance via `apiUrl`. */
 export declare const DEFAULT_API_URL = "https://api.atlasauth.net";
@@ -35,10 +66,14 @@ export interface RequestOptions {
     query?: QueryParams;
     /** JSON body; omitted entirely when undefined. */
     body?: unknown;
+    /** A raw body sent as-is with its own content type (instead of `body`). */
+    rawBody?: RawBody;
     /** Idempotency-Key header (§9.1), when a caller supplies one. */
     idempotencyKey?: string;
     /** When true, the raw text body is returned instead of parsed JSON (SAML XML). */
     raw?: boolean;
+    /** Per-request override of {@link AtlasClientConfig.strict}. */
+    strict?: boolean;
 }
 /** Serialize a query object to a string, dropping null/undefined, spreading arrays. */
 export declare function serializeQuery(query: QueryParams | undefined): string;
@@ -50,3 +85,13 @@ export declare function enc(segment: string): string;
  */
 export type RequestFn = <T>(options: RequestOptions) => Promise<T>;
 export declare function createRequest(config: AtlasClientConfig): RequestFn;
+/** Settings shared by every keyed client (secret key or platform key). */
+export interface KeyedRequestConfig extends AtlasRequestSettings {
+    apiUrl?: string;
+    fetch?: typeof fetch;
+}
+/**
+ * The request core for any bearer key: the secret key (`sk_...`) of the
+ * management client or the platform key (`psk_...`) of the platform client.
+ */
+export declare function createKeyedRequest(key: string, config: KeyedRequestConfig): RequestFn;