@atlasauth/types 0.17.0 → 0.18.0

package/CHANGELOG.md

@@ -1,5 +1,22 @@
 # @atlasauth/types changelog
 
+## 0.18.0
+
+- New `Register` interface: a generated `atlas-types.d.ts` narrows permission, role, plan, feature and metadata types. Without it everything stays `string`.
+
+## 0.17.1 — 2026-11-14
+
+- The published package now carries the release notes for every version.
+
+## 0.17.0 — 2026-11-14
+
+- Webhook events `oauth_tokens.revoked`, `resource_role_assignment.created`, `resource_role_assignment.deleted` and `user.deletion_paused`.
+- Organization memberships carry `public_metadata`, `private_metadata`, `permissions` and `allowed_sign_in_methods`.
+
+## 0.16.0 — 2026-11-14
+
+- Webhook event `user.sessions_revoked`.
+
 ## 0.15.0 — 2026-11-12
 
 - New webhook events (connection.provider_event, connection.owner_changed, impersonation.started/ended, risk.elevated), session device fields, has_passkey.

package/dist/authz.d.ts

@@ -5,6 +5,7 @@
  * That package ships the runtime `evaluate()` / `ForbiddenError`; only the pure
  * types are mirrored here so `@atlasauth/types` stays runtime-free.
  */
+import type { FeatureKey, OrgRoleKey, PermissionKey, PlanKey } from './register';
 /**
  * The minimal, structural view of session claims the authorization primitive
  * needs. Every SDK has its own richer `SessionClaims` (the backend verifier, the
@@ -45,18 +46,18 @@ export interface AuthzClaims {
  */
 export interface ProtectCondition {
     /** A single permission the ACTIVE organization role must hold. */
-    permission?: string;
+    permission?: PermissionKey;
     /** An exact role in the active organization. */
-    role?: string;
+    role?: OrgRoleKey;
     /** Any of these permissions (OR). */
-    anyPermission?: readonly string[];
+    anyPermission?: readonly PermissionKey[];
     /** All of these permissions (AND). */
-    allPermissions?: readonly string[];
+    allPermissions?: readonly PermissionKey[];
     /** The active billing plan (Clerk `has({ plan })`) — matches the `pla` claim.
      *  Needs NO active organization: it is the subject's entitlement. */
-    plan?: string;
+    plan?: PlanKey;
     /** A granted feature (Clerk `has({ feature })`) — an entry in the `fea` claim. */
-    feature?: string;
+    feature?: FeatureKey;
 }
 export type ProtectReason = 'signed_out' | 'no_organization' | 'missing_permission' | 'missing_entitlement';
 export type ProtectOutcome = {

package/dist/authz.js

@@ -1,10 +1,3 @@
 "use strict";
-/**
- * The shared authorization condition every Atlas SDK evaluates.
- *
- * COPIED verbatim from `@atlasauth/authz` (`src/claims.ts`, `src/protect.ts`).
- * That package ships the runtime `evaluate()` / `ForbiddenError`; only the pure
- * types are mirrored here so `@atlasauth/types` stays runtime-free.
- */
 Object.defineProperty(exports, "__esModule", { value: true });
 //# sourceMappingURL=authz.js.map

package/dist/authz.js.map

@@ -1 +1 @@
-{"version":3,"file":"authz.js","sourceRoot":"","sources":["../src/authz.ts"],"names":[],"mappings":";AAAA;;;;;;GAMG"}
+{"version":3,"file":"authz.js","sourceRoot":"","sources":["../src/authz.ts"],"names":[],"mappings":""}

package/dist/index.d.ts

@@ -13,6 +13,7 @@ export type { SessionClaims } from './session';
 export type { AuthzClaims, ProtectCondition, ProtectOutcome, ProtectReason } from './authz';
 export type { VerifiedSessionClaims, AuthorizedSession, VerifyResult } from './verify';
 export type { Metadata, CursorPage, DataList, CursorParams, DeletedObject, User, UserReferral, UserReferralStatus, EmailAddress, Session, Organization, OrganizationMembership, Invitation, ApiKey, ApiKeySubjectType, ApiKeyVerification, } from './resources';
+export type { Register, PermissionKey, OrgRoleKey, AppRoleKey, AppPermissionKey, PlanKey, FeatureKey, ScopeKey, WebhookEventKey, AppEventKey, AuditEventKey, FgaTypeKey, FgaRelationKey, RegisteredSessionClaims, UserPublicMetadata, UserUnsafeMetadata, UserPrivateMetadata, OrganizationPublicMetadata, OrganizationPrivateMetadata, } from './register';
 export type { WebhookEvent, WebhookPayload, WebhookVerifyResult, WebhookVerifyFailure, } from './webhooks';
 export type { Appearance, DesignTokens, ElementKey } from './appearance';
 export type { LocalizationResource, Localization, DeepPartial } from './localization';

package/dist/register.d.ts

@@ -0,0 +1,50 @@
+/**
+ * Type registration. `atlas types generate` writes a file that augments this
+ * interface with the keys your instance really has:
+ *
+ *   declare module '@atlasauth/types' {
+ *     interface Register { permission: 'org:billing:manage' | 'org:docs:read'; }
+ *   }
+ *
+ * Every SDK (`@atlasauth/react`, `@atlasauth/js`, `@atlasauth/backend`,
+ * `@atlasauth/authz`) reads the aliases below, so `has({ permission })` and
+ * `<Protect permission>` are checked against your keys. With no generated file
+ * `Register` is empty and every alias falls back to its loose default
+ * (`string`, `Record<string, unknown>`), so nothing changes for existing code.
+ */
+export interface Register {
+}
+type Registered<K extends string, Fallback> = Register extends Record<K, infer T> ? T : Fallback;
+/** An organization permission key (`org:billing:manage`). */
+export type PermissionKey = Registered<'permission', string>;
+/** An organization role key (`org:admin`). */
+export type OrgRoleKey = Registered<'orgRole', string>;
+/** An app-level (instance-wide) role key. */
+export type AppRoleKey = Registered<'appRole', string>;
+/** An app-level permission key. */
+export type AppPermissionKey = Registered<'appPermission', string>;
+/** A billing plan slug (the `pla` claim). */
+export type PlanKey = Registered<'plan', string>;
+/** A billing feature key (an entry of the `fea` claim). */
+export type FeatureKey = Registered<'feature', string>;
+/** An OAuth scope name. */
+export type ScopeKey = Registered<'scope', string>;
+/** A webhook event type from the instance's catalog. */
+export type WebhookEventKey = Registered<'webhookEvent', string>;
+/** A third-party app event type declared by the instance. */
+export type AppEventKey = Registered<'appEvent', string>;
+/** An audit event action. */
+export type AuditEventKey = Registered<'auditEvent', string>;
+/** A fine-grained authorization object type. */
+export type FgaTypeKey = Registered<'fgaType', string>;
+/** A fine-grained authorization relation name. */
+export type FgaRelationKey = Registered<'fgaRelation', string>;
+/** Extra session claims (templates, opt-in claims) layered over a verified token's claims. */
+export type RegisteredSessionClaims = Registered<'sessionClaims', unknown>;
+/** The shape of each metadata bag (from the instance's metadata schema). */
+export type UserPublicMetadata = Registered<'publicMetadata', Record<string, unknown>>;
+export type UserUnsafeMetadata = Registered<'unsafeMetadata', Record<string, unknown>>;
+export type UserPrivateMetadata = Registered<'privateMetadata', Record<string, unknown>>;
+export type OrganizationPublicMetadata = Registered<'organizationPublicMetadata', Record<string, unknown>>;
+export type OrganizationPrivateMetadata = Registered<'organizationPrivateMetadata', Record<string, unknown>>;
+export {};

package/dist/register.js

@@ -0,0 +1,3 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+//# sourceMappingURL=register.js.map

package/dist/register.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"register.js","sourceRoot":"","sources":["../src/register.ts"],"names":[],"mappings":""}

package/dist/resources.d.ts

@@ -7,6 +7,7 @@
  * camelCase translation), because the SDK's job is to type the BAPI, not to
  * invent a second dialect a reader would then have to reconcile against the docs.
  */
+import type { OrganizationPublicMetadata, UserPublicMetadata } from './register';
 /** A free-form metadata bag. The BAPI stores arbitrary JSON objects here. */
 export type Metadata = Record<string, unknown>;
 /**
@@ -43,7 +44,7 @@ export interface User {
     first_name: string | null;
     last_name: string | null;
     image_url: string | null;
-    public_metadata: Metadata;
+    public_metadata: UserPublicMetadata;
     mfa_enabled: boolean;
     /** Whether the user holds at least one passkey. */
     has_passkey?: boolean;
@@ -130,7 +131,7 @@ export interface Organization {
     name: string;
     slug: string;
     image_url: string | null;
-    public_metadata: Metadata;
+    public_metadata: OrganizationPublicMetadata;
     max_allowed_memberships: number;
     created_by: string;
     created_at: number;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@atlasauth/types",
-  "version": "0.17.0",
+  "version": "0.18.0",
   "description": "Shared public TypeScript types for Atlas — the Atlas peer of @clerk/types. Dependency-free, runtime-free: import type { User } from '@atlasauth/types' pulls in no runtime SDK.",
   "types": "./dist/index.d.ts",
   "exports": {