@atlasauth/backend 0.5.0 → 0.7.0

package/dist/client/request.js

@@ -4,6 +4,7 @@ exports.DEFAULT_API_URL = void 0;
 exports.serializeQuery = serializeQuery;
 exports.enc = enc;
 exports.createRequest = createRequest;
+exports.createKeyedRequest = createKeyedRequest;
 const error_1 = require("./error");
 /** The default BAPI origin, overridable per instance via `apiUrl`. */
 exports.DEFAULT_API_URL = 'https://api.atlasauth.net';
@@ -35,6 +36,13 @@ function createRequest(config) {
     if (!config.secretKey) {
         throw new Error('createAtlasClient requires a secretKey.');
     }
+    return createKeyedRequest(config.secretKey, config);
+}
+/**
+ * The request core for any bearer key: the secret key (`sk_...`) of the
+ * management client or the platform key (`psk_...`) of the platform client.
+ */
+function createKeyedRequest(key, config) {
     const base = config.apiUrl ?? exports.DEFAULT_API_URL;
     const fetchImpl = config.fetch ?? globalThis.fetch;
     if (typeof fetchImpl !== 'function') {
@@ -43,21 +51,46 @@ function createRequest(config) {
     return async function request(options) {
         const url = joinUrl(base, options.path) + serializeQuery(options.query);
         const headers = {
-            authorization: `Bearer ${config.secretKey}`,
+            authorization: `Bearer ${key}`,
             accept: 'application/json',
         };
         let body;
-        if (options.body !== undefined) {
+        if (options.rawBody !== undefined) {
+            const { data, contentType } = options.rawBody;
+            const type = contentType ?? (typeof Blob !== 'undefined' && data instanceof Blob ? data.type : '');
+            if (!type) {
+                throw new Error('A raw upload needs a contentType (for example image/png).');
+            }
+            headers['content-type'] = type;
+            body = data;
+        }
+        else if (options.body !== undefined) {
             headers['content-type'] = 'application/json';
             body = JSON.stringify(options.body);
         }
         if (options.idempotencyKey) {
             headers['idempotency-key'] = options.idempotencyKey;
         }
+        const strict = options.strict ?? config.strict;
+        if (strict !== undefined && options.method !== 'GET') {
+            headers['atlas-strict'] = strict ? 'true' : 'false';
+        }
         const response = await fetchImpl(url, { method: options.method, headers, body });
         if (!response.ok) {
             throw await toApiError(response);
         }
+        if (config.onUnknownFields) {
+            const ignored = response.headers?.get?.('atlas-unknown-fields');
+            if (ignored) {
+                const fields = ignored
+                    .split(',')
+                    .map((f) => f.trim())
+                    .filter(Boolean);
+                if (fields.length) {
+                    config.onUnknownFields({ method: options.method, path: options.path, fields });
+                }
+            }
+        }
         // 204 and other empty bodies: nothing to parse.
         if (response.status === 204)
             return undefined;

package/dist/client/request.js.map

@@ -1 +1 @@
-{"version":3,"file":"request.js","sourceRoot":"","sources":["../../src/client/request.ts"],"names":[],"mappings":";;;AAiDA,wCAYC;AAGD,kBAEC;AAYD,sCA6CC;AA3HD,mCAA6D;AA6B7D,sEAAsE;AACzD,QAAA,eAAe,GAAG,2BAA2B,CAAC;AAkB3D,uFAAuF;AACvF,SAAgB,cAAc,CAAC,KAA8B;IAC3D,IAAI,CAAC,KAAK;QAAE,OAAO,EAAE,CAAC;IACtB,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACjD,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,IAAI;YAAE,SAAS;QACpD,MAAM,MAAM,GAAG,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;QACtD,KAAK,MAAM,CAAC,IAAI,MAAM,EAAE,CAAC;YACvB,IAAI,CAAC,KAAK,SAAS,IAAI,CAAC,KAAK,IAAI;gBAAE,SAAS;YAC5C,KAAK,CAAC,IAAI,CAAC,GAAG,kBAAkB,CAAC,GAAG,CAAC,IAAI,kBAAkB,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QAC5E,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;AACnD,CAAC;AAED,yEAAyE;AACzE,SAAgB,GAAG,CAAC,OAAe;IACjC,OAAO,kBAAkB,CAAC,OAAO,CAAC,CAAC;AACrC,CAAC;AAED,SAAS,OAAO,CAAC,IAAY,EAAE,IAAY;IACzC,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,GAAG,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,IAAI,EAAE,EAAE,CAAC;AAClF,CAAC;AAQD,SAAgB,aAAa,CAAC,MAAyB;IACrD,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE,CAAC;QACtB,MAAM,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAC;IAC7D,CAAC;IACD,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,IAAI,uBAAe,CAAC;IAC9C,MAAM,SAAS,GAAG,MAAM,CAAC,KAAK,IAAI,UAAU,CAAC,KAAK,CAAC;IACnD,IAAI,OAAO,SAAS,KAAK,UAAU,EAAE,CAAC;QACpC,MAAM,IAAI,KAAK,CACb,yGAAyG,CAC1G,CAAC;IACJ,CAAC;IAED,OAAO,KAAK,UAAU,OAAO,CAAI,OAAuB;QACtD,MAAM,GAAG,GAAG,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,IAAI,CAAC,GAAG,cAAc,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;QAExE,MAAM,OAAO,GAA2B;YACtC,aAAa,EAAE,UAAU,MAAM,CAAC,SAAS,EAAE;YAC3C,MAAM,EAAE,kBAAkB;SAC3B,CAAC;QACF,IAAI,IAAwB,CAAC;QAC7B,IAAI,OAAO,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;YAC/B,OAAO,CAAC,cAAc,CAAC,GAAG,kBAAkB,CAAC;YAC7C,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QACtC,CAAC;QACD,IAAI,OAAO,CAAC,cAAc,EAAE,CAAC;YAC3B,OAAO,CAAC,iBAAiB,CAAC,GAAG,OAAO,CAAC,cAAc,CAAC;QACtD,CAAC;QAED,MAAM,QAAQ,GAAG,MAAM,SAAS,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;QAEjF,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,MAAM,MAAM,UAAU,CAAC,QAAQ,CAAC,CAAC;QACnC,CAAC;QAED,gDAAgD;QAChD,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG;YAAE,OAAO,SAAc,CAAC;QAEnD,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC;YAChB,OAAO,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAiB,CAAC;QACjD,CAAC;QAED,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;QACnC,IAAI,CAAC,IAAI;YAAE,OAAO,SAAc,CAAC;QACjC,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAM,CAAC;IAC/B,CAAC,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,UAAU,CAAC,QAAkB;IAC1C,IAAI,MAAM,GAAqB,EAAE,CAAC;IAClC,IAAI,OAA2B,CAAC;IAChC,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC;IACnD,IAAI,IAAI,EAAE,CAAC;QACT,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAkC,CAAC;YACjE,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC;gBACzD,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC;YACzB,CAAC;iBAAM,CAAC;gBACN,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;YAC/B,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,wEAAwE;YACxE,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;QAC/B,CAAC;IACH,CAAC;IACD,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC;QACnB,MAAM,GAAG;YACP;gBACE,IAAI,EAAE,SAAS;gBACf,OAAO,EAAE,OAAO,IAAI,wCAAwC,QAAQ,CAAC,MAAM,EAAE;aAC9E;SACF,CAAC;IACJ,CAAC;IACD,OAAO,IAAI,qBAAa,CAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;AACpD,CAAC"}
+{"version":3,"file":"request.js","sourceRoot":"","sources":["../../src/client/request.ts"],"names":[],"mappings":";;;AAuFA,wCAYC;AAGD,kBAEC;AAYD,sCAKC;AAYD,gDAoEC;AAzMD,mCAA6D;AA+D7D,sEAAsE;AACzD,QAAA,eAAe,GAAG,2BAA2B,CAAC;AAsB3D,uFAAuF;AACvF,SAAgB,cAAc,CAAC,KAA8B;IAC3D,IAAI,CAAC,KAAK;QAAE,OAAO,EAAE,CAAC;IACtB,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACjD,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,IAAI;YAAE,SAAS;QACpD,MAAM,MAAM,GAAG,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;QACtD,KAAK,MAAM,CAAC,IAAI,MAAM,EAAE,CAAC;YACvB,IAAI,CAAC,KAAK,SAAS,IAAI,CAAC,KAAK,IAAI;gBAAE,SAAS;YAC5C,KAAK,CAAC,IAAI,CAAC,GAAG,kBAAkB,CAAC,GAAG,CAAC,IAAI,kBAAkB,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QAC5E,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;AACnD,CAAC;AAED,yEAAyE;AACzE,SAAgB,GAAG,CAAC,OAAe;IACjC,OAAO,kBAAkB,CAAC,OAAO,CAAC,CAAC;AACrC,CAAC;AAED,SAAS,OAAO,CAAC,IAAY,EAAE,IAAY;IACzC,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,GAAG,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,IAAI,EAAE,EAAE,CAAC;AAClF,CAAC;AAQD,SAAgB,aAAa,CAAC,MAAyB;IACrD,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE,CAAC;QACtB,MAAM,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAC;IAC7D,CAAC;IACD,OAAO,kBAAkB,CAAC,MAAM,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;AACtD,CAAC;AAQD;;;GAGG;AACH,SAAgB,kBAAkB,CAAC,GAAW,EAAE,MAA0B;IACxE,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,IAAI,uBAAe,CAAC;IAC9C,MAAM,SAAS,GAAG,MAAM,CAAC,KAAK,IAAI,UAAU,CAAC,KAAK,CAAC;IACnD,IAAI,OAAO,SAAS,KAAK,UAAU,EAAE,CAAC;QACpC,MAAM,IAAI,KAAK,CACb,yGAAyG,CAC1G,CAAC;IACJ,CAAC;IAED,OAAO,KAAK,UAAU,OAAO,CAAI,OAAuB;QACtD,MAAM,GAAG,GAAG,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,IAAI,CAAC,GAAG,cAAc,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;QAExE,MAAM,OAAO,GAA2B;YACtC,aAAa,EAAE,UAAU,GAAG,EAAE;YAC9B,MAAM,EAAE,kBAAkB;SAC3B,CAAC;QACF,IAAI,IAAyB,CAAC;QAC9B,IAAI,OAAO,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;YAClC,MAAM,EAAE,IAAI,EAAE,WAAW,EAAE,GAAG,OAAO,CAAC,OAAO,CAAC;YAC9C,MAAM,IAAI,GACR,WAAW,IAAI,CAAC,OAAO,IAAI,KAAK,WAAW,IAAI,IAAI,YAAY,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;YACxF,IAAI,CAAC,IAAI,EAAE,CAAC;gBACV,MAAM,IAAI,KAAK,CAAC,2DAA2D,CAAC,CAAC;YAC/E,CAAC;YACD,OAAO,CAAC,cAAc,CAAC,GAAG,IAAI,CAAC;YAC/B,IAAI,GAAG,IAA2B,CAAC;QACrC,CAAC;aAAM,IAAI,OAAO,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;YACtC,OAAO,CAAC,cAAc,CAAC,GAAG,kBAAkB,CAAC;YAC7C,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QACtC,CAAC;QACD,IAAI,OAAO,CAAC,cAAc,EAAE,CAAC;YAC3B,OAAO,CAAC,iBAAiB,CAAC,GAAG,OAAO,CAAC,cAAc,CAAC;QACtD,CAAC;QACD,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,MAAM,CAAC,MAAM,CAAC;QAC/C,IAAI,MAAM,KAAK,SAAS,IAAI,OAAO,CAAC,MAAM,KAAK,KAAK,EAAE,CAAC;YACrD,OAAO,CAAC,cAAc,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC;QACtD,CAAC;QAED,MAAM,QAAQ,GAAG,MAAM,SAAS,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;QAEjF,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,MAAM,MAAM,UAAU,CAAC,QAAQ,CAAC,CAAC;QACnC,CAAC;QAED,IAAI,MAAM,CAAC,eAAe,EAAE,CAAC;YAC3B,MAAM,OAAO,GAAG,QAAQ,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,sBAAsB,CAAC,CAAC;YAChE,IAAI,OAAO,EAAE,CAAC;gBACZ,MAAM,MAAM,GAAG,OAAO;qBACnB,KAAK,CAAC,GAAG,CAAC;qBACV,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;qBACpB,MAAM,CAAC,OAAO,CAAC,CAAC;gBACnB,IAAI,MAAM,CAAC,MAAM,EAAE,CAAC;oBAClB,MAAM,CAAC,eAAe,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC;gBACjF,CAAC;YACH,CAAC;QACH,CAAC;QAED,gDAAgD;QAChD,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG;YAAE,OAAO,SAAc,CAAC;QAEnD,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC;YAChB,OAAO,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAiB,CAAC;QACjD,CAAC;QAED,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;QACnC,IAAI,CAAC,IAAI;YAAE,OAAO,SAAc,CAAC;QACjC,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAM,CAAC;IAC/B,CAAC,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,UAAU,CAAC,QAAkB;IAC1C,IAAI,MAAM,GAAqB,EAAE,CAAC;IAClC,IAAI,OAA2B,CAAC;IAChC,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC;IACnD,IAAI,IAAI,EAAE,CAAC;QACT,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAkC,CAAC;YACjE,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC;gBACzD,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC;YACzB,CAAC;iBAAM,CAAC;gBACN,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;YAC/B,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,wEAAwE;YACxE,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;QAC/B,CAAC;IACH,CAAC;IACD,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC;QACnB,MAAM,GAAG;YACP;gBACE,IAAI,EAAE,SAAS;gBACf,OAAO,EAAE,OAAO,IAAI,wCAAwC,QAAQ,CAAC,MAAM,EAAE;aAC9E;SACF,CAAC;IACJ,CAAC;IACD,OAAO,IAAI,qBAAa,CAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;AACpD,CAAC"}

package/dist/client/session-exchange-apps.d.ts

@@ -0,0 +1,43 @@
+import { type RequestFn } from './request';
+import type { ListPage } from './types';
+/**
+ * A downstream app that exchanges an Atlas session for its own. When the Atlas
+ * session ends, Atlas POSTs a signed `logout_token` to `backchannel_logout_uri`
+ * (verify it with `verifyLogoutToken`).
+ */
+export interface SessionExchangeApp {
+    object: 'session_exchange_app';
+    id: string;
+    name: string;
+    backchannel_logout_uri: string;
+    /** The `aud` claim the logout_token carries. */
+    audience: string;
+    created_at: number;
+    updated_at: number;
+}
+export interface CreateSessionExchangeAppBody {
+    name: string;
+    /** Public https endpoint that receives `logout_token=<jwt>` (form-encoded). */
+    backchannel_logout_uri: string;
+    /** Override for the logout_token `aud`. Defaults to the app id. */
+    audience?: string | null;
+}
+export interface UpdateSessionExchangeAppBody {
+    name?: string;
+    backchannel_logout_uri?: string;
+    audience?: string | null;
+}
+export declare function sessionExchangeAppsResource(request: RequestFn): {
+    list(): Promise<ListPage<SessionExchangeApp> & {
+        next_cursor?: string | null;
+    }>;
+    create(body: CreateSessionExchangeAppBody, idempotencyKey?: string): Promise<SessionExchangeApp>;
+    get(id: string): Promise<SessionExchangeApp>;
+    update(id: string, body: UpdateSessionExchangeAppBody): Promise<SessionExchangeApp>;
+    /** Queued back-channel logout deliveries are deleted with it. */
+    delete(id: string): Promise<{
+        object: "session_exchange_app";
+        id: string;
+        deleted: true;
+    }>;
+};

package/dist/client/session-exchange-apps.js

@@ -0,0 +1,25 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.sessionExchangeAppsResource = sessionExchangeAppsResource;
+const request_1 = require("./request");
+function sessionExchangeAppsResource(request) {
+    return {
+        list() {
+            return request({ method: 'GET', path: '/v1/session_exchange_apps' });
+        },
+        create(body, idempotencyKey) {
+            return request({ method: 'POST', path: '/v1/session_exchange_apps', body, idempotencyKey });
+        },
+        get(id) {
+            return request({ method: 'GET', path: `/v1/session_exchange_apps/${(0, request_1.enc)(id)}` });
+        },
+        update(id, body) {
+            return request({ method: 'PATCH', path: `/v1/session_exchange_apps/${(0, request_1.enc)(id)}`, body });
+        },
+        /** Queued back-channel logout deliveries are deleted with it. */
+        delete(id) {
+            return request({ method: 'DELETE', path: `/v1/session_exchange_apps/${(0, request_1.enc)(id)}` });
+        },
+    };
+}
+//# sourceMappingURL=session-exchange-apps.js.map

package/dist/client/session-exchange-apps.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"session-exchange-apps.js","sourceRoot":"","sources":["../../src/client/session-exchange-apps.ts"],"names":[],"mappings":";;AAiCA,kEAmBC;AApDD,uCAAgD;AAiChD,SAAgB,2BAA2B,CAAC,OAAkB;IAC5D,OAAO;QACL,IAAI;YACF,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,2BAA2B,EAAE,CAAC,CAAC;QACvE,CAAC;QACD,MAAM,CAAC,IAAkC,EAAE,cAAuB;YAChE,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,2BAA2B,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC;QAC9F,CAAC;QACD,GAAG,CAAC,EAAU;YACZ,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,6BAA6B,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;QAClF,CAAC;QACD,MAAM,CAAC,EAAU,EAAE,IAAkC;YACnD,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,6BAA6B,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;QAC1F,CAAC;QACD,iEAAiE;QACjE,MAAM,CAAC,EAAU;YACf,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,6BAA6B,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;QACrF,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/client/sessions.d.ts

@@ -10,8 +10,16 @@ export interface Session {
     last_active_at: number;
     expire_at: number;
     abandon_at: number;
+    /** Epoch ms the session ends from inactivity unless there is activity first (same value as `abandon_at`). */
+    idle_expires_at?: number;
     created_at: number;
 }
+/** The session after a keep-alive {@link sessionsResource} `touch`. */
+export interface TouchedSession extends Session {
+    idle_expires_at: number;
+    /** true when this touch moved the inactivity window; false when one within the last 60 seconds already had. */
+    extended: boolean;
+}
 export interface ListSessionsParams {
     /** Required by the BAPI: sessions are always scoped to one user. */
     user_id: string;
@@ -41,6 +49,13 @@ export interface MintedSession {
         sub: string;
     };
 }
+/** A JWT minted from a named JWT template. */
+export interface SessionTemplateToken {
+    object: string;
+    jwt: string;
+    /** Seconds until the token expires. */
+    expires_in: number;
+}
 export declare function sessionsResource(request: RequestFn): {
     /**
      * `POST /v1/sessions` — mint a session for a user without the sign-in flow.
@@ -55,4 +70,17 @@ export declare function sessionsResource(request: RequestFn): {
         id: string;
         status: "revoked";
     }>;
+    /**
+     * `POST /v1/sessions/:id/touch` — keep a session alive from your backend:
+     * slides its inactivity window as if the user had just loaded a page. Never
+     * extends past the absolute expiry and never revives an ended session (409
+     * `SESSION_REVOKED` / `SESSION_IDLE_EXPIRED` / `SESSION_EXPIRED`). At most one
+     * effective write per minute, so calling it on every request is safe.
+     */
+    touch(id: string): Promise<TouchedSession>;
+    /**
+     * `POST /v1/sessions/:id/tokens/:template` — mint a token from a named JWT
+     * template for this session. The reserved name `session` is refused.
+     */
+    getToken(id: string, template: string): Promise<SessionTemplateToken>;
 };

package/dist/client/sessions.js

@@ -21,6 +21,26 @@ function sessionsResource(request) {
         revoke(id) {
             return request({ method: 'POST', path: `/v1/sessions/${(0, request_1.enc)(id)}/revoke` });
         },
+        /**
+         * `POST /v1/sessions/:id/touch` — keep a session alive from your backend:
+         * slides its inactivity window as if the user had just loaded a page. Never
+         * extends past the absolute expiry and never revives an ended session (409
+         * `SESSION_REVOKED` / `SESSION_IDLE_EXPIRED` / `SESSION_EXPIRED`). At most one
+         * effective write per minute, so calling it on every request is safe.
+         */
+        touch(id) {
+            return request({ method: 'POST', path: `/v1/sessions/${(0, request_1.enc)(id)}/touch` });
+        },
+        /**
+         * `POST /v1/sessions/:id/tokens/:template` — mint a token from a named JWT
+         * template for this session. The reserved name `session` is refused.
+         */
+        getToken(id, template) {
+            return request({
+                method: 'POST',
+                path: `/v1/sessions/${(0, request_1.enc)(id)}/tokens/${(0, request_1.enc)(template)}`,
+            });
+        },
     };
 }
 //# sourceMappingURL=sessions.js.map

package/dist/client/sessions.js.map

@@ -1 +1 @@
-{"version":3,"file":"sessions.js","sourceRoot":"","sources":["../../src/client/sessions.ts"],"names":[],"mappings":";;AA4CA,4CAoBC;AAhED,uCAAgD;AA4ChD,SAAgB,gBAAgB,CAAC,OAAkB;IACjD,OAAO;QACL;;;WAGG;QACH,MAAM,CAAC,MAA2B;YAChC,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,cAAc,EAAE,IAAI,EAAE,EAAE,GAAG,MAAM,EAAE,EAAE,CAAC,CAAC;QAChF,CAAC;QACD,wDAAwD;QACxD,IAAI,CAAC,MAA0B;YAC7B,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,cAAc,EAAE,KAAK,EAAE,EAAE,GAAG,MAAM,EAAE,EAAE,CAAC,CAAC;QAChF,CAAC;QACD,GAAG,CAAC,EAAU;YACZ,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,gBAAgB,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;QACrE,CAAC;QACD,MAAM,CAAC,EAAU;YACf,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,gBAAgB,IAAA,aAAG,EAAC,EAAE,CAAC,SAAS,EAAE,CAAC,CAAC;QAC7E,CAAC;KACF,CAAC;AACJ,CAAC"}
+{"version":3,"file":"sessions.js","sourceRoot":"","sources":["../../src/client/sessions.ts"],"names":[],"mappings":";;AA6DA,4CAwCC;AArGD,uCAAgD;AA6DhD,SAAgB,gBAAgB,CAAC,OAAkB;IACjD,OAAO;QACL;;;WAGG;QACH,MAAM,CAAC,MAA2B;YAChC,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,cAAc,EAAE,IAAI,EAAE,EAAE,GAAG,MAAM,EAAE,EAAE,CAAC,CAAC;QAChF,CAAC;QACD,wDAAwD;QACxD,IAAI,CAAC,MAA0B;YAC7B,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,cAAc,EAAE,KAAK,EAAE,EAAE,GAAG,MAAM,EAAE,EAAE,CAAC,CAAC;QAChF,CAAC;QACD,GAAG,CAAC,EAAU;YACZ,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,gBAAgB,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;QACrE,CAAC;QACD,MAAM,CAAC,EAAU;YACf,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,gBAAgB,IAAA,aAAG,EAAC,EAAE,CAAC,SAAS,EAAE,CAAC,CAAC;QAC7E,CAAC;QACD;;;;;;WAMG;QACH,KAAK,CAAC,EAAU;YACd,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,gBAAgB,IAAA,aAAG,EAAC,EAAE,CAAC,QAAQ,EAAE,CAAC,CAAC;QAC5E,CAAC;QACD;;;WAGG;QACH,QAAQ,CAAC,EAAU,EAAE,QAAgB;YACnC,OAAO,OAAO,CAAC;gBACb,MAAM,EAAE,MAAM;gBACd,IAAI,EAAE,gBAAgB,IAAA,aAAG,EAAC,EAAE,CAAC,WAAW,IAAA,aAAG,EAAC,QAAQ,CAAC,EAAE;aACxD,CAAC,CAAC;QACL,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/client/sign-in-tokens.d.ts

@@ -1,4 +1,4 @@
-import type { RequestFn } from './request';
+import { type RequestFn } from './request';
 export interface SignInToken {
     object: 'sign_in_token';
     user_id: string;
@@ -15,4 +15,16 @@ export interface CreateSignInTokenBody {
 }
 export declare function signInTokensResource(request: RequestFn): {
     create(body: CreateSignInTokenBody, idempotencyKey?: string): Promise<SignInToken>;
+    /**
+     * `POST /v1/sign_in_tokens/:id/revoke` — revoke an unused sign-in token
+     * before its 60-second window elapses.
+     *
+     * @deprecated The sign-in token API is deprecated (sunset 2027-04-01).
+     * Mint a session directly with `sessions.create()` instead.
+     */
+    revoke(id: string): Promise<{
+        object: "sign_in_token";
+        id: string;
+        revoked: true;
+    }>;
 };

package/dist/client/sign-in-tokens.js

@@ -1,11 +1,22 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.signInTokensResource = signInTokensResource;
+const request_1 = require("./request");
 function signInTokensResource(request) {
     return {
         create(body, idempotencyKey) {
             return request({ method: 'POST', path: '/v1/sign_in_tokens', body, idempotencyKey });
         },
+        /**
+         * `POST /v1/sign_in_tokens/:id/revoke` — revoke an unused sign-in token
+         * before its 60-second window elapses.
+         *
+         * @deprecated The sign-in token API is deprecated (sunset 2027-04-01).
+         * Mint a session directly with `sessions.create()` instead.
+         */
+        revoke(id) {
+            return request({ method: 'POST', path: `/v1/sign_in_tokens/${(0, request_1.enc)(id)}/revoke` });
+        },
     };
 }
 //# sourceMappingURL=sign-in-tokens.js.map

package/dist/client/sign-in-tokens.js.map

@@ -1 +1 @@
-{"version":3,"file":"sign-in-tokens.js","sourceRoot":"","sources":["../../src/client/sign-in-tokens.ts"],"names":[],"mappings":";;AAkBA,oDAMC;AAND,SAAgB,oBAAoB,CAAC,OAAkB;IACrD,OAAO;QACL,MAAM,CAAC,IAA2B,EAAE,cAAuB;YACzD,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,oBAAoB,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC;QACvF,CAAC;KACF,CAAC;AACJ,CAAC"}
+{"version":3,"file":"sign-in-tokens.js","sourceRoot":"","sources":["../../src/client/sign-in-tokens.ts"],"names":[],"mappings":";;AAkBA,oDAgBC;AAlCD,uCAAgD;AAkBhD,SAAgB,oBAAoB,CAAC,OAAkB;IACrD,OAAO;QACL,MAAM,CAAC,IAA2B,EAAE,cAAuB;YACzD,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,oBAAoB,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC;QACvF,CAAC;QACD;;;;;;WAMG;QACH,MAAM,CAAC,EAAU;YACf,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,sBAAsB,IAAA,aAAG,EAAC,EAAE,CAAC,SAAS,EAAE,CAAC,CAAC;QACnF,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/client/test-mode.d.ts

@@ -0,0 +1,44 @@
+import type { RequestFn } from './request';
+/** The production instance's paired development (test-mode) sibling. */
+export interface TestInstance {
+    object: 'test_instance';
+    instance_id: string;
+    environment: 'development';
+    publishable_key: string;
+    /** True when this call created the sibling. */
+    created: boolean;
+    /** The `sk_test_…` — returned ONLY on create or rotate. Store it now. */
+    secret_key?: string;
+}
+export interface TestUsersPurgeResult {
+    object: string;
+    purged: number;
+    /** Loop until this is false. */
+    has_more: boolean;
+}
+/** A short-lived token that lets `@atlasauth/testing` skip the sign-in CAPTCHA. */
+export interface TestingToken {
+    object: 'testing_token';
+    jwt: string;
+    token_use: 'testing';
+    /** Lifetime in seconds. */
+    expires_in: number;
+}
+export declare function testModeResource(request: RequestFn): {
+    /**
+     * Get (creating on first call) the paired development instance. Call with
+     * the LIVE instance's secret key. `rotate_secret: true` mints a fresh `sk_test`.
+     */
+    testInstance(body?: {
+        rotate_secret?: boolean;
+    }): Promise<TestInstance>;
+    /**
+     * Soft-delete users whose email carries a reserved test marker
+     * (`+atlas_test`, `+clerk_test`). Development instances only.
+     */
+    purgeTestUsers(body?: {
+        limit?: number;
+    }): Promise<TestUsersPurgeResult>;
+    /** Mint a testing token. Development instances only (403 TESTING_UNAVAILABLE otherwise). */
+    createTestingToken(): Promise<TestingToken>;
+};

package/dist/client/test-mode.js

@@ -0,0 +1,26 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.testModeResource = testModeResource;
+function testModeResource(request) {
+    return {
+        /**
+         * Get (creating on first call) the paired development instance. Call with
+         * the LIVE instance's secret key. `rotate_secret: true` mints a fresh `sk_test`.
+         */
+        testInstance(body = {}) {
+            return request({ method: 'POST', path: '/v1/test_instance', body });
+        },
+        /**
+         * Soft-delete users whose email carries a reserved test marker
+         * (`+atlas_test`, `+clerk_test`). Development instances only.
+         */
+        purgeTestUsers(body = {}) {
+            return request({ method: 'POST', path: '/v1/test_users/purge', body });
+        },
+        /** Mint a testing token. Development instances only (403 TESTING_UNAVAILABLE otherwise). */
+        createTestingToken() {
+            return request({ method: 'POST', path: '/v1/testing_tokens' });
+        },
+    };
+}
+//# sourceMappingURL=test-mode.js.map

package/dist/client/test-mode.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"test-mode.js","sourceRoot":"","sources":["../../src/client/test-mode.ts"],"names":[],"mappings":";;AA8BA,4CAqBC;AArBD,SAAgB,gBAAgB,CAAC,OAAkB;IACjD,OAAO;QACL;;;WAGG;QACH,YAAY,CAAC,OAAoC,EAAE;YACjD,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,mBAAmB,EAAE,IAAI,EAAE,CAAC,CAAC;QACtE,CAAC;QACD;;;WAGG;QACH,cAAc,CAAC,OAA2B,EAAE;YAC1C,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,sBAAsB,EAAE,IAAI,EAAE,CAAC,CAAC;QACzE,CAAC;QACD,4FAA4F;QAC5F,kBAAkB;YAChB,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,oBAAoB,EAAE,CAAC,CAAC;QACjE,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/client/tickets.d.ts

@@ -0,0 +1,49 @@
+import type { RequestFn } from './request';
+export interface CreateTicketBody {
+    /** Lifetime in seconds; must be positive, clamped to 86400 (24h). */
+    ttl_seconds: number;
+    /** Arbitrary JSON returned to whoever redeems the ticket. Defaults to `{}`. */
+    payload?: unknown;
+    /** Default true: the first successful redeem consumes it. */
+    single_use?: boolean;
+    /** Only a redeemer acting as this user may redeem. */
+    bound_user?: string;
+    /** Only a redeemer acting for this organization may redeem. */
+    bound_org?: string;
+}
+/** A minted capability ticket. `ticket` (the `tkt_…` secret) is returned only here. */
+export interface CapabilityTicket {
+    object: 'ticket';
+    id: string;
+    ticket: string;
+    single_use: boolean;
+    bound_user: string | null;
+    bound_org: string | null;
+    created_at: number;
+    expires_at: number;
+}
+export interface RedeemTicketBody {
+    /** The `tkt_…` secret. */
+    ticket: string;
+    /** Who this redemption is on behalf of (matched against `bound_user`). */
+    for_user?: string;
+    /** The organization it is for (matched against `bound_org`). */
+    for_org?: string;
+}
+export interface TicketRedemption<P = unknown> {
+    object: 'ticket_redemption';
+    /** The redeemed ticket id. */
+    id: string;
+    /** The payload the ticket carried, verbatim. */
+    payload: P;
+    single_use: boolean;
+}
+export declare function ticketsResource(request: RequestFn): {
+    /** Mint a one-time capability ticket. */
+    create(body: CreateTicketBody, idempotencyKey?: string): Promise<CapabilityTicket>;
+    /**
+     * Redeem a ticket server-to-server. Unknown, expired or used tickets are a
+     * 404; a binding mismatch is a 403.
+     */
+    redeem<P = unknown>(body: RedeemTicketBody): Promise<TicketRedemption<P>>;
+};

package/dist/client/tickets.js

@@ -0,0 +1,19 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ticketsResource = ticketsResource;
+function ticketsResource(request) {
+    return {
+        /** Mint a one-time capability ticket. */
+        create(body, idempotencyKey) {
+            return request({ method: 'POST', path: '/v1/tickets', body, idempotencyKey });
+        },
+        /**
+         * Redeem a ticket server-to-server. Unknown, expired or used tickets are a
+         * 404; a binding mismatch is a 403.
+         */
+        redeem(body) {
+            return request({ method: 'POST', path: '/v1/tickets/redeem', body });
+        },
+    };
+}
+//# sourceMappingURL=tickets.js.map

package/dist/client/tickets.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"tickets.js","sourceRoot":"","sources":["../../src/client/tickets.ts"],"names":[],"mappings":";;AA6CA,0CAcC;AAdD,SAAgB,eAAe,CAAC,OAAkB;IAChD,OAAO;QACL,yCAAyC;QACzC,MAAM,CAAC,IAAsB,EAAE,cAAuB;YACpD,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,aAAa,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC;QAChF,CAAC;QACD;;;WAGG;QACH,MAAM,CAAc,IAAsB;YACxC,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,oBAAoB,EAAE,IAAI,EAAE,CAAC,CAAC;QACvE,CAAC;KACF,CAAC;AACJ,CAAC"}