@atlasauth/backend 0.5.0 → 0.7.0

package/dist/client/design.d.ts

@@ -0,0 +1,295 @@
+import { type RequestFn } from './request';
+import type { ListPage } from './types';
+/**
+ * The structured sign-in page design, shared by the instance's hosted pages,
+ * per-organization overrides and Sign in with Atlas app pages.
+ *
+ * Every leaf is a closed set of values, a bounded number, a `#RRGGBB` hex colour,
+ * a catalog id (preset, font) or an uploaded image id (`dasset_…`) — there is no
+ * field for CSS, HTML or arbitrary URLs. A stored design is a set of OVERRIDES:
+ * every section and field is optional and falls back to the chosen preset, then
+ * the defaults. Unknown keys are refused by the API with their full path.
+ */
+export type DesignHexColor = string;
+export type DesignPresetId = 'minimal' | 'atlas' | 'glass' | 'midnight' | 'editorial' | 'terminal' | 'sunrise' | 'forest' | 'grape' | 'slate' | 'split-photo' | 'bold';
+export type DesignColorScheme = 'auto' | 'light' | 'dark';
+export type DesignTypeScale = 'minor-second' | 'major-second' | 'minor-third' | 'major-third' | 'perfect-fourth' | 'augmented-fourth' | 'perfect-fifth' | 'golden' | 'minor-seventh' | 'octave';
+export type DesignImagePosition = 'top-left' | 'top' | 'top-right' | 'left' | 'center' | 'right' | 'bottom-left' | 'bottom' | 'bottom-right';
+/** Colour slots, each a `#RRGGBB` hex. */
+export interface DesignPalette {
+    primary?: DesignHexColor;
+    /** Text/icon colour on a primary fill (button label). */
+    primaryInk?: DesignHexColor;
+    accent?: DesignHexColor;
+    background?: DesignHexColor;
+    surface?: DesignHexColor;
+    text?: DesignHexColor;
+    muted?: DesignHexColor;
+    border?: DesignHexColor;
+    danger?: DesignHexColor;
+    success?: DesignHexColor;
+    inputBackground?: DesignHexColor;
+    inputText?: DesignHexColor;
+}
+export interface DesignTypography {
+    /** A font id from the design catalog (`design.catalog().fonts`). */
+    font?: string;
+    headingFont?: string;
+    /** Body text size in px (12–20). */
+    baseSize?: number;
+    /** 400–800, in steps of 100. */
+    headingWeight?: number;
+    /** 300–600, in steps of 100. */
+    bodyWeight?: number;
+    /** Letter case of button labels. */
+    letterCase?: 'none' | 'uppercase';
+    scale?: DesignTypeScale;
+}
+export interface DesignShape {
+    /** Card corner radius, px (0–32). */
+    radius?: number;
+    /** Button + input corner radius, px (0–999; 999 = pill). */
+    controlRadius?: number;
+    /** 0–3 px. */
+    borderWidth?: number;
+}
+export interface DesignElevation {
+    cardShadow?: 'none' | 'sm' | 'md' | 'lg' | 'xl';
+}
+export interface DesignSpacing {
+    density?: 'compact' | 'comfortable' | 'spacious';
+}
+export interface DesignCard {
+    style?: 'solid' | 'glass' | 'outline' | 'none';
+    /** Backdrop blur, px (0–40). Only applied when `style` is `glass`. */
+    blur?: number;
+    width?: 'narrow' | 'normal' | 'wide';
+}
+export interface DesignLayout {
+    position?: 'center' | 'left' | 'right' | 'split';
+    /** Which side the image panel sits on. Only applied when `position` is `split`. */
+    splitImageSide?: 'left' | 'right';
+    /** `hidden` is refused on Sign in with Atlas app pages. */
+    logoPlacement?: 'card' | 'page' | 'hidden';
+    logoSize?: 'sm' | 'md' | 'lg';
+}
+export interface DesignButtons {
+    style?: 'solid' | 'outline' | 'soft' | 'gradient';
+    socialLayout?: 'list' | 'grid' | 'icons';
+}
+export interface DesignInputs {
+    style?: 'outline' | 'filled' | 'underline';
+}
+export interface DesignGradient {
+    type: 'linear' | 'radial';
+    /** Degrees (0–360); linear only. */
+    angle?: number;
+    /** 2–4 stops; `at` is a percentage (0–100). */
+    stops: Array<{
+        color: DesignHexColor;
+        at: number;
+    }>;
+}
+export interface DesignBackgroundImage {
+    /** An uploaded background image (`dasset_…`). */
+    assetId: string;
+    fit?: 'cover' | 'contain';
+    position?: DesignImagePosition;
+    /** `opacity` is 0–1. */
+    overlay?: {
+        color: DesignHexColor;
+        opacity: number;
+    };
+    /** 0–20 px. */
+    blur?: number;
+}
+/**
+ * A page background: a colour, a gradient, an uploaded image and a pattern,
+ * painted bottom to top. Setting `background` replaces the preset's background
+ * as a whole.
+ */
+export interface DesignBackground {
+    color?: DesignHexColor;
+    gradient?: DesignGradient;
+    image?: DesignBackgroundImage;
+    pattern?: 'none' | 'dots' | 'grid' | 'noise';
+}
+export interface DesignLogo {
+    /** Uploaded logo for light mode (`dasset_…`). */
+    assetId?: string;
+    /** Uploaded logo for dark mode; falls back to `assetId`. */
+    darkAssetId?: string;
+}
+/** A stored design: overrides on top of a preset. Every field is optional. */
+export interface AtlasDesign {
+    version?: 1;
+    preset?: DesignPresetId;
+    colorScheme?: DesignColorScheme;
+    palette?: DesignPalette;
+    paletteDark?: DesignPalette;
+    typography?: DesignTypography;
+    shape?: DesignShape;
+    elevation?: DesignElevation;
+    spacing?: DesignSpacing;
+    card?: DesignCard;
+    layout?: DesignLayout;
+    buttons?: DesignButtons;
+    inputs?: DesignInputs;
+    background?: DesignBackground;
+    backgroundDark?: DesignBackground;
+    logo?: DesignLogo;
+}
+type DeepPatch<T> = {
+    [K in keyof T]?: NonNullable<T[K]> extends readonly unknown[] ? T[K] | null : NonNullable<T[K]> extends object ? DeepPatch<NonNullable<T[K]>> | null : T[K] | null;
+};
+/**
+ * A partial design update: nested objects merge, arrays (gradient stops) and
+ * values replace, and `null` removes a setting (falling back to the preset).
+ */
+export type AtlasDesignPatch = DeepPatch<AtlasDesign>;
+/** The fully resolved design every surface renders (defaults ← preset ← overrides). */
+export interface ResolvedAtlasDesign {
+    version: 1;
+    preset: DesignPresetId;
+    colorScheme: DesignColorScheme;
+    palette: Required<DesignPalette>;
+    paletteDark: Required<DesignPalette>;
+    typography: Required<DesignTypography>;
+    shape: Required<DesignShape>;
+    elevation: Required<DesignElevation>;
+    spacing: Required<DesignSpacing>;
+    card: Required<DesignCard>;
+    layout: Required<DesignLayout>;
+    buttons: Required<DesignButtons>;
+    inputs: Required<DesignInputs>;
+    background: DesignBackground;
+    backgroundDark: DesignBackground;
+    logo: DesignLogo;
+}
+/** A colour pair that fails its contrast target. */
+export interface DesignWarning {
+    code: 'low_contrast';
+    mode: 'light' | 'dark';
+    pair: string[];
+    ratio: number;
+    required: number;
+    /** The setting to change, e.g. `palette.primaryInk`. */
+    path: string;
+    message: string;
+}
+/** A stored design (instance or organization) with its resolved result. */
+export interface DesignSettings {
+    object: 'design' | 'organization_design';
+    /** Organization designs only. */
+    organization_id?: string;
+    design: AtlasDesign;
+    resolved: ResolvedAtlasDesign;
+    warnings: DesignWarning[];
+    /** True when nothing is stored and the page is drawn from the older branding settings. */
+    legacy: boolean;
+    /** When `legacy`: the design derived from the older branding settings. */
+    legacy_design?: AtlasDesign | null;
+}
+/** A compiled, unsaved design. Nothing is stored. */
+export interface DesignPreview {
+    object: 'design_preview';
+    /** The selector the CSS is scoped to: `.atlas-root`. */
+    scope: string;
+    /** CSS custom properties (`--atlas-*`) for the scope, including light/dark blocks. */
+    css: string;
+    /** Attributes to set on the scoped element (`data-atlas-layout`, …). */
+    data_attributes: Record<string, string>;
+    /** Absolute URLs of the self-hosted font stylesheets to link. */
+    font_stylesheets: string[];
+    resolved: ResolvedAtlasDesign;
+    warnings: DesignWarning[];
+    /** The sign-in page rendered with the draft design (inert, for a sandboxed frame). */
+    html: string;
+}
+export type DesignAssetKind = 'background' | 'logo';
+/** An uploaded design image. Use `asset_id` in a design (`logo.assetId`, …). */
+export interface DesignAsset {
+    object: 'design_asset';
+    /** `dasset_…` */
+    asset_id: string;
+    kind: DesignAssetKind;
+    /** Where Atlas serves the stored image. */
+    url: string;
+    width: number;
+    height: number;
+    /** `#rrggbb` for an opaque image, else null. */
+    dominant_color: string | null;
+    /** Size of the stored (WebP) image. */
+    bytes: number;
+    created_at: string;
+}
+export interface DeletedDesignAsset {
+    object: 'design_asset';
+    asset_id: string;
+    deleted: true;
+}
+/** Image bytes to upload: PNG, JPEG, GIF or WebP, up to 8 MB and 40 megapixels. */
+export type DesignAssetData = Blob | ArrayBuffer | ArrayBufferView;
+export interface UploadDesignAssetOptions {
+    /** What the image is for (default `background`). */
+    kind?: DesignAssetKind;
+    /** e.g. `image/png`. Required unless `data` is a Blob with a type. */
+    contentType?: string;
+}
+/** The public design-system catalog: presets, curated fonts and CSS variables. */
+export interface DesignCatalog {
+    object: 'design_catalog';
+    version: 1;
+    presets: Array<{
+        id: DesignPresetId;
+        label: string;
+        description: string;
+        resolved: ResolvedAtlasDesign;
+    }>;
+    fonts: Array<{
+        id: string;
+        label: string;
+        family: string | null;
+        category: string;
+        web_font: boolean;
+        stylesheet: string | null;
+    }>;
+    css_variables: Array<{
+        name: string;
+        type: string;
+        perMode?: boolean;
+        description: string;
+    }>;
+}
+export declare function designResource(request: RequestFn): {
+    /** The instance's sign-in page design: stored overrides, resolved design, warnings. */
+    get(): Promise<DesignSettings>;
+    /** Replace the whole instance design. */
+    replace(design: AtlasDesign): Promise<DesignSettings>;
+    /** Change part of the instance design; `null` removes a setting. */
+    update(design: AtlasDesignPatch): Promise<DesignSettings>;
+    /** Compile an unsaved design (CSS, attributes, fonts, rendered page). Nothing is saved. */
+    preview(design: AtlasDesign): Promise<DesignPreview>;
+    /** Per-organization design overrides, layered over the instance design. */
+    organizations: {
+        get(organizationId: string): Promise<DesignSettings>;
+        /** Replace the override; `{}` removes it. */
+        replace(organizationId: string, design: AtlasDesign): Promise<DesignSettings>;
+        update(organizationId: string, design: AtlasDesignPatch): Promise<DesignSettings>;
+    };
+    /** The instance's uploaded design images. */
+    assets: {
+        /**
+         * Upload a background or logo image as raw bytes. Atlas checks it,
+         * re-encodes it as WebP and serves it.
+         */
+        upload(data: DesignAssetData, options?: UploadDesignAssetOptions): Promise<DesignAsset>;
+        /** Newest first (up to 100). */
+        list(): Promise<ListPage<DesignAsset>>;
+        /** Refused with 409 (`meta.used_by`) while a saved design still uses it. */
+        delete(assetId: string): Promise<DeletedDesignAsset>;
+    };
+    /** The public catalog: presets (resolved), curated fonts, the CSS variable set. */
+    catalog(): Promise<DesignCatalog>;
+};
+export {};

package/dist/client/design.js

@@ -0,0 +1,76 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.designResource = designResource;
+const request_1 = require("./request");
+function designResource(request) {
+    return {
+        /** The instance's sign-in page design: stored overrides, resolved design, warnings. */
+        get() {
+            return request({ method: 'GET', path: '/v1/instance/design' });
+        },
+        /** Replace the whole instance design. */
+        replace(design) {
+            return request({ method: 'PUT', path: '/v1/instance/design', body: { design } });
+        },
+        /** Change part of the instance design; `null` removes a setting. */
+        update(design) {
+            return request({ method: 'PATCH', path: '/v1/instance/design', body: { design } });
+        },
+        /** Compile an unsaved design (CSS, attributes, fonts, rendered page). Nothing is saved. */
+        preview(design) {
+            return request({ method: 'POST', path: '/v1/instance/design/preview', body: { design } });
+        },
+        /** Per-organization design overrides, layered over the instance design. */
+        organizations: {
+            get(organizationId) {
+                return request({
+                    method: 'GET',
+                    path: `/v1/organizations/${(0, request_1.enc)(organizationId)}/design`,
+                });
+            },
+            /** Replace the override; `{}` removes it. */
+            replace(organizationId, design) {
+                return request({
+                    method: 'PUT',
+                    path: `/v1/organizations/${(0, request_1.enc)(organizationId)}/design`,
+                    body: { design },
+                });
+            },
+            update(organizationId, design) {
+                return request({
+                    method: 'PATCH',
+                    path: `/v1/organizations/${(0, request_1.enc)(organizationId)}/design`,
+                    body: { design },
+                });
+            },
+        },
+        /** The instance's uploaded design images. */
+        assets: {
+            /**
+             * Upload a background or logo image as raw bytes. Atlas checks it,
+             * re-encodes it as WebP and serves it.
+             */
+            upload(data, options = {}) {
+                return request({
+                    method: 'POST',
+                    path: '/v1/design/assets',
+                    query: { kind: options.kind },
+                    rawBody: { data, contentType: options.contentType },
+                });
+            },
+            /** Newest first (up to 100). */
+            list() {
+                return request({ method: 'GET', path: '/v1/design/assets' });
+            },
+            /** Refused with 409 (`meta.used_by`) while a saved design still uses it. */
+            delete(assetId) {
+                return request({ method: 'DELETE', path: `/v1/design/assets/${(0, request_1.enc)(assetId)}` });
+            },
+        },
+        /** The public catalog: presets (resolved), curated fonts, the CSS variable set. */
+        catalog() {
+            return request({ method: 'GET', path: '/v1/design/catalog' });
+        },
+    };
+}
+//# sourceMappingURL=design.js.map

package/dist/client/design.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"design.js","sourceRoot":"","sources":["../../src/client/design.ts"],"names":[],"mappings":";;AAoUA,wCAsEC;AA1YD,uCAAgD;AAoUhD,SAAgB,cAAc,CAAC,OAAkB;IAC/C,OAAO;QACL,uFAAuF;QACvF,GAAG;YACD,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,qBAAqB,EAAE,CAAC,CAAC;QACjE,CAAC;QACD,yCAAyC;QACzC,OAAO,CAAC,MAAmB;YACzB,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,qBAAqB,EAAE,IAAI,EAAE,EAAE,MAAM,EAAE,EAAE,CAAC,CAAC;QACnF,CAAC;QACD,oEAAoE;QACpE,MAAM,CAAC,MAAwB;YAC7B,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,qBAAqB,EAAE,IAAI,EAAE,EAAE,MAAM,EAAE,EAAE,CAAC,CAAC;QACrF,CAAC;QACD,2FAA2F;QAC3F,OAAO,CAAC,MAAmB;YACzB,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,6BAA6B,EAAE,IAAI,EAAE,EAAE,MAAM,EAAE,EAAE,CAAC,CAAC;QAC5F,CAAC;QACD,2EAA2E;QAC3E,aAAa,EAAE;YACb,GAAG,CAAC,cAAsB;gBACxB,OAAO,OAAO,CAAC;oBACb,MAAM,EAAE,KAAK;oBACb,IAAI,EAAE,qBAAqB,IAAA,aAAG,EAAC,cAAc,CAAC,SAAS;iBACxD,CAAC,CAAC;YACL,CAAC;YACD,6CAA6C;YAC7C,OAAO,CAAC,cAAsB,EAAE,MAAmB;gBACjD,OAAO,OAAO,CAAC;oBACb,MAAM,EAAE,KAAK;oBACb,IAAI,EAAE,qBAAqB,IAAA,aAAG,EAAC,cAAc,CAAC,SAAS;oBACvD,IAAI,EAAE,EAAE,MAAM,EAAE;iBACjB,CAAC,CAAC;YACL,CAAC;YACD,MAAM,CAAC,cAAsB,EAAE,MAAwB;gBACrD,OAAO,OAAO,CAAC;oBACb,MAAM,EAAE,OAAO;oBACf,IAAI,EAAE,qBAAqB,IAAA,aAAG,EAAC,cAAc,CAAC,SAAS;oBACvD,IAAI,EAAE,EAAE,MAAM,EAAE;iBACjB,CAAC,CAAC;YACL,CAAC;SACF;QACD,6CAA6C;QAC7C,MAAM,EAAE;YACN;;;eAGG;YACH,MAAM,CAAC,IAAqB,EAAE,UAAoC,EAAE;gBAClE,OAAO,OAAO,CAAC;oBACb,MAAM,EAAE,MAAM;oBACd,IAAI,EAAE,mBAAmB;oBACzB,KAAK,EAAE,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE;oBAC7B,OAAO,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,CAAC,WAAW,EAAE;iBACpD,CAAC,CAAC;YACL,CAAC;YACD,gCAAgC;YAChC,IAAI;gBACF,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,mBAAmB,EAAE,CAAC,CAAC;YAC/D,CAAC;YACD,4EAA4E;YAC5E,MAAM,CAAC,OAAe;gBACpB,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,qBAAqB,IAAA,aAAG,EAAC,OAAO,CAAC,EAAE,EAAE,CAAC,CAAC;YAClF,CAAC;SACF;QACD,mFAAmF;QACnF,OAAO;YACL,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,oBAAoB,EAAE,CAAC,CAAC;QAChE,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/client/diagnostics.d.ts

@@ -0,0 +1,53 @@
+import type { RequestFn } from './request';
+export interface LoginReadinessParams {
+    /** The app origin to probe, e.g. `https://app.acme.com`. */
+    origin: string;
+    /** Round-trip the published JWKS for the signing check instead of inferring it. */
+    live?: boolean;
+}
+export interface LoginReadinessCheck {
+    name: string;
+    pass: boolean;
+    observed: unknown;
+    /** What was seen, and the fix when it fails. */
+    detail: string;
+}
+export interface LoginReadiness {
+    object: 'login_readiness';
+    origin: string;
+    live: boolean;
+    data_region?: string | null;
+    ready: boolean;
+    checks: LoginReadinessCheck[];
+}
+export interface RequestInspectorParams {
+    /** The browser origin making the request. */
+    origin: string;
+    /** Default `POST`. */
+    method?: string;
+    /** Default `/v1/client/sign_ins`. */
+    path?: string;
+    /** A session JWT to verify against this instance. */
+    token?: string;
+}
+export interface RequestInspectionFinding {
+    check: string;
+    /** Whether this finding alone rejects the request. */
+    blocks: boolean;
+    observed: unknown;
+    detail: string;
+}
+export interface RequestInspection {
+    object: 'request_inspection';
+    origin: string;
+    method: string;
+    path: string;
+    would_be_rejected: boolean;
+    findings: RequestInspectionFinding[];
+}
+export declare function diagnosticsResource(request: RequestFn): {
+    /** Will a browser sign-in from `origin` work? CORS, cookie, email claim and signing, each with a fix. */
+    loginReadiness(params: LoginReadinessParams): Promise<LoginReadiness>;
+    /** Why would this browser request be rejected? Each finding says whether it blocks. */
+    requestInspector(params: RequestInspectorParams): Promise<RequestInspection>;
+};

package/dist/client/diagnostics.js

@@ -0,0 +1,24 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.diagnosticsResource = diagnosticsResource;
+function diagnosticsResource(request) {
+    return {
+        /** Will a browser sign-in from `origin` work? CORS, cookie, email claim and signing, each with a fix. */
+        loginReadiness(params) {
+            return request({
+                method: 'GET',
+                path: '/v1/diagnostics/login_readiness',
+                query: { origin: params.origin, live: params.live },
+            });
+        },
+        /** Why would this browser request be rejected? Each finding says whether it blocks. */
+        requestInspector(params) {
+            return request({
+                method: 'GET',
+                path: '/v1/diagnostics/request_inspector',
+                query: { ...params },
+            });
+        },
+    };
+}
+//# sourceMappingURL=diagnostics.js.map

package/dist/client/diagnostics.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"diagnostics.js","sourceRoot":"","sources":["../../src/client/diagnostics.ts"],"names":[],"mappings":";;AAsDA,kDAmBC;AAnBD,SAAgB,mBAAmB,CAAC,OAAkB;IACpD,OAAO;QACL,yGAAyG;QACzG,cAAc,CAAC,MAA4B;YACzC,OAAO,OAAO,CAAC;gBACb,MAAM,EAAE,KAAK;gBACb,IAAI,EAAE,iCAAiC;gBACvC,KAAK,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE;aACpD,CAAC,CAAC;QACL,CAAC;QACD,uFAAuF;QACvF,gBAAgB,CAAC,MAA8B;YAC7C,OAAO,OAAO,CAAC;gBACb,MAAM,EAAE,KAAK;gBACb,IAAI,EAAE,mCAAmC;gBACzC,KAAK,EAAE,EAAE,GAAG,MAAM,EAAE;aACrB,CAAC,CAAC;QACL,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/client/email-addresses.d.ts

@@ -0,0 +1,22 @@
+import { type RequestFn } from './request';
+/**
+ * An email address addressed by its own id. The owning user is derived from
+ * the address, so these calls need no user id (the `users.verifyEmail` /
+ * `users.setPrimaryEmail` forms do the same with one).
+ */
+export interface EmailAddressRecord {
+    object: 'email_address';
+    id: string;
+    email_address: string;
+    verification: {
+        status: 'verified' | 'unverified';
+    };
+    verified: boolean;
+    primary: boolean;
+}
+export declare function emailAddressesResource(request: RequestFn): {
+    /** `POST /v1/email_addresses/:id/verify` — mark the address verified. */
+    verify(id: string): Promise<EmailAddressRecord>;
+    /** `POST /v1/email_addresses/:id/primary` — make a verified address the user's primary. */
+    setPrimary(id: string): Promise<EmailAddressRecord>;
+};

package/dist/client/email-addresses.js

@@ -0,0 +1,17 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.emailAddressesResource = emailAddressesResource;
+const request_1 = require("./request");
+function emailAddressesResource(request) {
+    return {
+        /** `POST /v1/email_addresses/:id/verify` — mark the address verified. */
+        verify(id) {
+            return request({ method: 'POST', path: `/v1/email_addresses/${(0, request_1.enc)(id)}/verify` });
+        },
+        /** `POST /v1/email_addresses/:id/primary` — make a verified address the user's primary. */
+        setPrimary(id) {
+            return request({ method: 'POST', path: `/v1/email_addresses/${(0, request_1.enc)(id)}/primary` });
+        },
+    };
+}
+//# sourceMappingURL=email-addresses.js.map

package/dist/client/email-addresses.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"email-addresses.js","sourceRoot":"","sources":["../../src/client/email-addresses.ts"],"names":[],"mappings":";;AAgBA,wDAWC;AA3BD,uCAAgD;AAgBhD,SAAgB,sBAAsB,CAAC,OAAkB;IACvD,OAAO;QACL,yEAAyE;QACzE,MAAM,CAAC,EAAU;YACf,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,uBAAuB,IAAA,aAAG,EAAC,EAAE,CAAC,SAAS,EAAE,CAAC,CAAC;QACpF,CAAC;QACD,2FAA2F;QAC3F,UAAU,CAAC,EAAU;YACnB,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,uBAAuB,IAAA,aAAG,EAAC,EAAE,CAAC,UAAU,EAAE,CAAC,CAAC;QACrF,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/client/entitlement-overrides.d.ts

@@ -0,0 +1,50 @@
+import { type RequestFn } from './request';
+import type { ListPage } from './types';
+export type EntitlementOverrideSubjectType = 'user' | 'org';
+/**
+ * A sales-led entitlement override: a plan / features / limits pinned onto a
+ * user or organization without Stripe (e.g. an Enterprise contract). A
+ * non-expired override wins over the Stripe-derived entitlement and reaches the
+ * session claims on the next session.
+ */
+export interface EntitlementOverride {
+    object: 'entitlement_override';
+    id: string;
+    subject_type: EntitlementOverrideSubjectType;
+    subject_id: string;
+    /** Pinned plan slug, or null when only features/limits are overridden. */
+    plan: string | null;
+    features: string[] | null;
+    limits: Record<string, unknown> | null;
+    /** Epoch ms when the override lapses, or null for open-ended. */
+    expires_at: number | null;
+    created_by: string | null;
+    created_at: number;
+}
+/** At least one of `plan`, `features` or `limits` is required. */
+export interface CreateEntitlementOverrideBody {
+    subject_type: EntitlementOverrideSubjectType;
+    subject_id: string;
+    plan?: string | null;
+    /** Replaces (does not add to) the resolved feature set. */
+    features?: string[] | null;
+    /** Numeric limits, e.g. `{ max_devices: 50 }`. */
+    limits?: Record<string, unknown> | null;
+    /** Epoch ms; omit or null for open-ended. */
+    expires_at?: number | null;
+}
+export interface ListEntitlementOverridesParams {
+    subject_type?: EntitlementOverrideSubjectType;
+    subject_id?: string;
+}
+export declare function entitlementOverridesResource(request: RequestFn): {
+    create(body: CreateEntitlementOverrideBody, idempotencyKey?: string): Promise<EntitlementOverride>;
+    /** Includes expired overrides (kept for audit; they no longer apply). */
+    list(params?: ListEntitlementOverridesParams): Promise<ListPage<EntitlementOverride>>;
+    /** Revoke: the subject reverts to its Stripe-derived entitlement on the next session. */
+    delete(id: string): Promise<{
+        object: "entitlement_override";
+        id: string;
+        deleted: true;
+    }>;
+};

package/dist/client/entitlement-overrides.js

@@ -0,0 +1,20 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.entitlementOverridesResource = entitlementOverridesResource;
+const request_1 = require("./request");
+function entitlementOverridesResource(request) {
+    return {
+        create(body, idempotencyKey) {
+            return request({ method: 'POST', path: '/v1/entitlement_overrides', body, idempotencyKey });
+        },
+        /** Includes expired overrides (kept for audit; they no longer apply). */
+        list(params = {}) {
+            return request({ method: 'GET', path: '/v1/entitlement_overrides', query: { ...params } });
+        },
+        /** Revoke: the subject reverts to its Stripe-derived entitlement on the next session. */
+        delete(id) {
+            return request({ method: 'DELETE', path: `/v1/entitlement_overrides/${(0, request_1.enc)(id)}` });
+        },
+    };
+}
+//# sourceMappingURL=entitlement-overrides.js.map

package/dist/client/entitlement-overrides.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"entitlement-overrides.js","sourceRoot":"","sources":["../../src/client/entitlement-overrides.ts"],"names":[],"mappings":";;AA4CA,oEAmBC;AA/DD,uCAAgD;AA4ChD,SAAgB,4BAA4B,CAAC,OAAkB;IAC7D,OAAO;QACL,MAAM,CACJ,IAAmC,EACnC,cAAuB;YAEvB,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,2BAA2B,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC;QAC9F,CAAC;QACD,yEAAyE;QACzE,IAAI,CACF,SAAyC,EAAE;YAE3C,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,2BAA2B,EAAE,KAAK,EAAE,EAAE,GAAG,MAAM,EAAE,EAAE,CAAC,CAAC;QAC7F,CAAC;QACD,yFAAyF;QACzF,MAAM,CAAC,EAAU;YACf,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,6BAA6B,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;QACrF,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/client/error.d.ts

@@ -29,3 +29,37 @@ export declare class AtlasApiError extends Error {
     /** True when any error in the envelope carries the given stable code. */
     hasCode(code: string): boolean;
 }
+/**
+ * Stable error codes worth branching on, as named constants. Any `code` string
+ * Atlas returns can be compared with `error.code` / `error.hasCode()` directly;
+ * these just save typing them.
+ */
+export declare const AtlasErrorCodes: {
+    /** Emails cannot be sent: no email provider is configured for the instance. */
+    readonly EMAIL_DELIVERY_NOT_CONFIGURED: "EMAIL_DELIVERY_NOT_CONFIGURED";
+    /** This setting needs your own email provider configured first. */
+    readonly EMAIL_PROVIDER_REQUIRED: "EMAIL_PROVIDER_REQUIRED";
+    /** Strict mode: the body had a field this endpoint does not accept (`param` names it). */
+    readonly UNKNOWN_FIELD: "UNKNOWN_FIELD";
+    /** The billing plan still has subscribers and cannot be removed. */
+    readonly PLAN_IN_USE: "PLAN_IN_USE";
+    /** The key is valid but for another API surface (e.g. a platform key on the Backend API). */
+    readonly WRONG_KEY_SURFACE: "WRONG_KEY_SURFACE";
+    /** The key is unknown, revoked or malformed. */
+    readonly INVALID_KEY: "INVALID_KEY";
+    readonly NOT_FOUND: "NOT_FOUND";
+    readonly VALIDATION_FAILED: "VALIDATION_FAILED";
+    readonly RATE_LIMITED: "RATE_LIMITED";
+    /** An idempotency key was reused with a different request (e.g. another unit or amount). */
+    readonly IDEMPOTENCY_CONFLICT: "IDEMPOTENCY_CONFLICT";
+    /** A usage debit would exceed an API key's spend cap (`allowed: false` on the debit). */
+    readonly LIMIT_EXCEEDED: "LIMIT_EXCEEDED";
+    readonly SESSION_REVOKED: "SESSION_REVOKED";
+    readonly SESSION_IDLE_EXPIRED: "SESSION_IDLE_EXPIRED";
+    readonly SESSION_EXPIRED: "SESSION_EXPIRED";
+    readonly SCOPE_MISSING: "SCOPE_MISSING";
+    readonly FORBIDDEN: "FORBIDDEN";
+    readonly CONFLICT: "CONFLICT";
+};
+/** One of the named {@link AtlasErrorCodes}. */
+export type AtlasErrorCode = (typeof AtlasErrorCodes)[keyof typeof AtlasErrorCodes];

package/dist/client/error.js

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.AtlasApiError = void 0;
+exports.AtlasErrorCodes = exports.AtlasApiError = void 0;
 class AtlasApiError extends Error {
     name = 'AtlasApiError';
     /** HTTP status of the failed response. */
@@ -25,4 +25,36 @@ class AtlasApiError extends Error {
     }
 }
 exports.AtlasApiError = AtlasApiError;
+/**
+ * Stable error codes worth branching on, as named constants. Any `code` string
+ * Atlas returns can be compared with `error.code` / `error.hasCode()` directly;
+ * these just save typing them.
+ */
+exports.AtlasErrorCodes = {
+    /** Emails cannot be sent: no email provider is configured for the instance. */
+    EMAIL_DELIVERY_NOT_CONFIGURED: 'EMAIL_DELIVERY_NOT_CONFIGURED',
+    /** This setting needs your own email provider configured first. */
+    EMAIL_PROVIDER_REQUIRED: 'EMAIL_PROVIDER_REQUIRED',
+    /** Strict mode: the body had a field this endpoint does not accept (`param` names it). */
+    UNKNOWN_FIELD: 'UNKNOWN_FIELD',
+    /** The billing plan still has subscribers and cannot be removed. */
+    PLAN_IN_USE: 'PLAN_IN_USE',
+    /** The key is valid but for another API surface (e.g. a platform key on the Backend API). */
+    WRONG_KEY_SURFACE: 'WRONG_KEY_SURFACE',
+    /** The key is unknown, revoked or malformed. */
+    INVALID_KEY: 'INVALID_KEY',
+    NOT_FOUND: 'NOT_FOUND',
+    VALIDATION_FAILED: 'VALIDATION_FAILED',
+    RATE_LIMITED: 'RATE_LIMITED',
+    /** An idempotency key was reused with a different request (e.g. another unit or amount). */
+    IDEMPOTENCY_CONFLICT: 'IDEMPOTENCY_CONFLICT',
+    /** A usage debit would exceed an API key's spend cap (`allowed: false` on the debit). */
+    LIMIT_EXCEEDED: 'LIMIT_EXCEEDED',
+    SESSION_REVOKED: 'SESSION_REVOKED',
+    SESSION_IDLE_EXPIRED: 'SESSION_IDLE_EXPIRED',
+    SESSION_EXPIRED: 'SESSION_EXPIRED',
+    SCOPE_MISSING: 'SCOPE_MISSING',
+    FORBIDDEN: 'FORBIDDEN',
+    CONFLICT: 'CONFLICT',
+};
 //# sourceMappingURL=error.js.map