@auth-gate/core 0.4.0 → 0.6.0

package/README.md

@@ -15,7 +15,6 @@ import { createAuthGateClient } from "@auth-gate/core";
 
 const client = createAuthGateClient({
   apiKey: process.env.AUTHGATE_API_KEY!,
-  projectId: process.env.AUTHGATE_PROJECT_ID!,
   baseUrl: "https://authgate.dev", // or your self-hosted instance
 });
 ```
@@ -27,8 +26,8 @@ const client = createAuthGateClient({
 Supports Google, GitHub, Discord, Azure (Microsoft), and Apple.
 
 ```ts
-// Generate the authorization URL
-const url = client.getOAuthUrl("google", "https://yourapp.com/auth/callback");
+// Generate the authorization URL (async — resolves project ID from API key)
+const url = await client.getOAuthUrl("google", "https://yourapp.com/auth/callback");
 
 // After callback, verify the JWT token from AuthGate
 const result = await client.verifyToken(token);
@@ -144,8 +143,7 @@ client.getNonceCookieOptions();
 
 | Option | Type | Required | Description |
 |--------|------|----------|-------------|
-| `apiKey` | `string` | Yes | Your AuthGate API key |
-| `projectId` | `string` | Yes | Your AuthGate project ID |
+| `apiKey` | `string` | Yes | Your AuthGate API key (also used to resolve project ID) |
 | `baseUrl` | `string` | Yes | AuthGate instance URL |
 | `cookieName` | `string` | No | Session cookie name (default: `__authgate`) |
 | `sessionMaxAge` | `number` | No | Session TTL in seconds (default: `604800` / 7 days) |

package/dist/index.cjs

@@ -39,6 +39,7 @@ var index_exports = {};
 __export(index_exports, {
   AuthGateClient: () => AuthGateClient,
   AuthGateError: () => AuthGateError,
+  ConfigurationError: () => ConfigurationError,
   DEFAULT_COOKIE_NAME: () => DEFAULT_COOKIE_NAME,
   InvalidStateError: () => InvalidStateError,
   NONCE_COOKIE_NAME: () => NONCE_COOKIE_NAME,
@@ -48,7 +49,9 @@ __export(index_exports, {
   SUPPORTED_PROVIDERS: () => SUPPORTED_PROVIDERS,
   SessionDecryptionError: () => SessionDecryptionError,
   TokenVerificationError: () => TokenVerificationError,
-  createAuthGateClient: () => createAuthGateClient
+  createAuthGateClient: () => createAuthGateClient,
+  hasFeature: () => hasFeature,
+  hasPlan: () => hasPlan
 });
 module.exports = __toCommonJS(index_exports);
 
@@ -296,6 +299,12 @@ var InvalidStateError = class extends AuthGateError {
     this.name = "InvalidStateError";
   }
 };
+var ConfigurationError = class extends AuthGateError {
+  constructor(message) {
+    super(message);
+    this.name = "ConfigurationError";
+  }
+};
 
 // src/client.ts
 var AuthGateClient = class {
@@ -306,6 +315,28 @@ var AuthGateClient = class {
     this.encryptionKey = null;
     this.stateKey = null;
     var _a, _b, _c;
+    if (!config.apiKey || typeof config.apiKey !== "string" || config.apiKey.trim() === "") {
+      throw new ConfigurationError(
+        "[AuthGate] Missing or empty `apiKey`. Get your API key from the AuthGate dashboard \u2192 Project \u2192 API Key."
+      );
+    }
+    if (!config.baseUrl || typeof config.baseUrl !== "string" || config.baseUrl.trim() === "") {
+      throw new ConfigurationError(
+        '[AuthGate] Missing or empty `baseUrl`. Set this to your AuthGate service URL (e.g. "https://authgate.dev").'
+      );
+    }
+    try {
+      new URL(config.baseUrl);
+    } catch (e) {
+      throw new ConfigurationError(
+        `[AuthGate] Invalid \`baseUrl\`: "${config.baseUrl}". Must be a valid URL (e.g. "https://authgate.dev").`
+      );
+    }
+    if (config.callbackPath !== void 0 && !config.callbackPath.startsWith("/")) {
+      throw new ConfigurationError(
+        `[AuthGate] Invalid \`callbackPath\`: "${config.callbackPath}". Must start with "/" (e.g. "/api/auth/callback").`
+      );
+    }
     this.config = __spreadProps(__spreadValues({}, config), {
       cookieName: (_a = config.cookieName) != null ? _a : DEFAULT_COOKIE_NAME,
       sessionMaxAge: (_b = config.sessionMaxAge) != null ? _b : SESSION_MAX_AGE,
@@ -453,17 +484,28 @@ var AuthGateClient = class {
    * @returns The full authorization URL to redirect the user to.
    * @throws {@link AuthGateError} if the provider is not in {@link SUPPORTED_PROVIDERS}.
    */
-  getOAuthUrl(provider, callbackUrl, options) {
+  async getOAuthUrl(provider, callbackUrl, options) {
     if (!SUPPORTED_PROVIDERS.includes(provider)) {
       throw new AuthGateError(`Unsupported provider: ${provider}`);
     }
-    const url = new URL(`/api/proxy/${provider}`, this.config.baseUrl);
-    url.searchParams.set("project_id", this.config.projectId);
-    url.searchParams.set("callback_url", callbackUrl);
-    if (options == null ? void 0 : options.linkTo) {
-      url.searchParams.set("link_to", options.linkTo);
+    const response = await fetch(`${this.config.baseUrl}/api/proxy/${provider}`, {
+      method: "POST",
+      headers: {
+        Authorization: `Bearer ${this.config.apiKey}`,
+        "Content-Type": "application/json"
+      },
+      body: JSON.stringify({
+        callback_url: callbackUrl,
+        state: options == null ? void 0 : options.state,
+        link_to: options == null ? void 0 : options.linkTo
+      })
+    });
+    if (!response.ok) {
+      const error = await response.json().catch(() => ({}));
+      throw new AuthGateError(error.error || `OAuth initiation failed: ${response.status}`);
     }
-    return url.toString();
+    const data = await response.json();
+    return data.redirect_url;
   }
   // ---------------------------------------------------------------------------
   // Email auth
@@ -477,12 +519,14 @@ var AuthGateClient = class {
   async emailSignup(data) {
     return fetch(`${this.config.baseUrl}/api/proxy/email/signup`, {
       method: "POST",
-      headers: { "Content-Type": "application/json" },
+      headers: {
+        Authorization: `Bearer ${this.config.apiKey}`,
+        "Content-Type": "application/json"
+      },
       body: JSON.stringify({
         email: data.email,
         password: data.password,
         name: data.name,
-        project_id: this.config.projectId,
         callback_url: data.callbackUrl
       })
     });
@@ -499,11 +543,13 @@ var AuthGateClient = class {
   async emailSignin(data) {
     return fetch(`${this.config.baseUrl}/api/proxy/email/signin`, {
       method: "POST",
-      headers: { "Content-Type": "application/json" },
+      headers: {
+        Authorization: `Bearer ${this.config.apiKey}`,
+        "Content-Type": "application/json"
+      },
       body: JSON.stringify({
         email: data.email,
         password: data.password,
-        project_id: this.config.projectId,
         callback_url: data.callbackUrl
       })
     });
@@ -517,10 +563,12 @@ var AuthGateClient = class {
   async emailForgotPassword(data) {
     return fetch(`${this.config.baseUrl}/api/proxy/email/reset-password`, {
       method: "POST",
-      headers: { "Content-Type": "application/json" },
+      headers: {
+        Authorization: `Bearer ${this.config.apiKey}`,
+        "Content-Type": "application/json"
+      },
       body: JSON.stringify({
         email: data.email,
-        project_id: this.config.projectId,
         callback_url: data.callbackUrl
       })
     });
@@ -536,11 +584,13 @@ var AuthGateClient = class {
       `${this.config.baseUrl}/api/proxy/email/reset-password/confirm`,
       {
         method: "POST",
-        headers: { "Content-Type": "application/json" },
+        headers: {
+          Authorization: `Bearer ${this.config.apiKey}`,
+          "Content-Type": "application/json"
+        },
         body: JSON.stringify({
           token: data.token,
-          password: data.password,
-          project_id: this.config.projectId
+          password: data.password
         })
       }
     );
@@ -559,10 +609,12 @@ var AuthGateClient = class {
       `${this.config.baseUrl}/api/proxy/email/magic-link/send`,
       {
         method: "POST",
-        headers: { "Content-Type": "application/json" },
+        headers: {
+          Authorization: `Bearer ${this.config.apiKey}`,
+          "Content-Type": "application/json"
+        },
         body: JSON.stringify({
           email: data.email,
-          project_id: this.config.projectId,
           callback_url: data.callbackUrl
         })
       }
@@ -580,11 +632,13 @@ var AuthGateClient = class {
   async emailVerifyCode(data) {
     return fetch(`${this.config.baseUrl}/api/proxy/email/verify`, {
       method: "POST",
-      headers: { "Content-Type": "application/json" },
+      headers: {
+        Authorization: `Bearer ${this.config.apiKey}`,
+        "Content-Type": "application/json"
+      },
       body: JSON.stringify({
         email: data.email,
-        code: data.code,
-        project_id: this.config.projectId
+        code: data.code
       })
     });
   }
@@ -600,10 +654,12 @@ var AuthGateClient = class {
   async smsSendCode(data) {
     return fetch(`${this.config.baseUrl}/api/proxy/sms/send-code`, {
       method: "POST",
-      headers: { "Content-Type": "application/json" },
+      headers: {
+        Authorization: `Bearer ${this.config.apiKey}`,
+        "Content-Type": "application/json"
+      },
       body: JSON.stringify({
         phone: data.phone,
-        project_id: this.config.projectId,
         callback_url: data.callbackUrl
       })
     });
@@ -617,11 +673,13 @@ var AuthGateClient = class {
   async smsVerifyCode(data) {
     return fetch(`${this.config.baseUrl}/api/proxy/sms/verify-code`, {
       method: "POST",
-      headers: { "Content-Type": "application/json" },
+      headers: {
+        Authorization: `Bearer ${this.config.apiKey}`,
+        "Content-Type": "application/json"
+      },
       body: JSON.stringify({
         phone: data.phone,
         code: data.code,
-        project_id: this.config.projectId,
         callback_url: data.callbackUrl
       })
     });
@@ -644,10 +702,12 @@ var AuthGateClient = class {
         `${this.config.baseUrl}/api/proxy/token/refresh`,
         {
           method: "POST",
-          headers: { "Content-Type": "application/json" },
+          headers: {
+            Authorization: `Bearer ${this.config.apiKey}`,
+            "Content-Type": "application/json"
+          },
           body: JSON.stringify({
-            refresh_token: refreshToken,
-            project_id: this.config.projectId
+            refresh_token: refreshToken
           })
         }
       );
@@ -672,10 +732,12 @@ var AuthGateClient = class {
         `${this.config.baseUrl}/api/proxy/sessions/revoke`,
         {
           method: "POST",
-          headers: { "Content-Type": "application/json" },
+          headers: {
+            Authorization: `Bearer ${this.config.apiKey}`,
+            "Content-Type": "application/json"
+          },
           body: JSON.stringify({
-            refresh_token: refreshToken,
-            project_id: this.config.projectId
+            refresh_token: refreshToken
           })
         }
       );
@@ -698,10 +760,11 @@ var AuthGateClient = class {
   async mfaVerify(data) {
     return fetch(`${this.config.baseUrl}/api/proxy/mfa/verify`, {
       method: "POST",
-      headers: { "Content-Type": "application/json" },
-      body: JSON.stringify(__spreadProps(__spreadValues({}, data), {
-        project_id: this.config.projectId
-      }))
+      headers: {
+        Authorization: `Bearer ${this.config.apiKey}`,
+        "Content-Type": "application/json"
+      },
+      body: JSON.stringify(data)
     });
   }
   /**
@@ -832,11 +895,11 @@ var AuthGateClient = class {
   async mfaSmsSendCode(challenge) {
     return fetch(`${this.config.baseUrl}/api/proxy/mfa/sms/send-code`, {
       method: "POST",
-      headers: { "Content-Type": "application/json" },
-      body: JSON.stringify({
-        challenge,
-        project_id: this.config.projectId
-      })
+      headers: {
+        Authorization: `Bearer ${this.config.apiKey}`,
+        "Content-Type": "application/json"
+      },
+      body: JSON.stringify({ challenge })
     });
   }
   // ---------------------------------------------------------------------------
@@ -858,10 +921,6 @@ var AuthGateClient = class {
   get callbackPath() {
     return this.config.callbackPath;
   }
-  /** The AuthGate project ID. */
-  get projectId() {
-    return this.config.projectId;
-  }
   /** The AuthGate service base URL. */
   get baseUrl() {
     return this.config.baseUrl;
@@ -899,7 +958,71 @@ var AuthGateClient = class {
       path: "/"
     };
   }
+  // ---------------------------------------------------------------------------
+  // Config validation (async, called by framework factories)
+  // ---------------------------------------------------------------------------
+  /**
+   * Validate the SDK configuration against the AuthGate server.
+   *
+   * Checks that the API key is valid and (optionally) that a callback URL
+   * is registered for the project. This is called automatically by framework
+   * factories (`createAuthGate`, `createAuthRoutes`) and logs errors to the
+   * console — it does NOT throw.
+   *
+   * @param callbackUrl - The full callback URL to check registration for.
+   * @internal
+   */
+  async validateConfig(callbackUrl) {
+    try {
+      const response = await fetch(
+        `${this.config.baseUrl}/api/v1/config/validate`,
+        {
+          method: "POST",
+          headers: {
+            Authorization: `Bearer ${this.config.apiKey}`,
+            "Content-Type": "application/json"
+          },
+          body: JSON.stringify({
+            callback_url: callbackUrl
+          })
+        }
+      );
+      if (response.status === 401) {
+        console.error(
+          "\n[AuthGate] \u2717 Invalid API key.\n  The API key you provided is not recognized or has been revoked.\n  \u2192 Go to your AuthGate dashboard \u2192 Project \u2192 API Key to get a valid key.\n"
+        );
+        return;
+      }
+      if (!response.ok) {
+        console.warn(
+          "[AuthGate] Could not validate config (server returned " + response.status + "). Auth flows may fail."
+        );
+        return;
+      }
+      const data = await response.json();
+      if (callbackUrl && data.callback_url_registered === false) {
+        console.error(
+          "\n[AuthGate] \u2717 Callback URL not registered: " + callbackUrl + "\n  This URL must be added to your project's allowed callback URLs.\n  \u2192 Go to your AuthGate dashboard \u2192 Project \u2192 Callback URLs \u2192 Add URL.\n"
+        );
+      }
+    } catch (e) {
+      console.warn(
+        "[AuthGate] Could not reach AuthGate server at " + this.config.baseUrl + " to validate config. Auth flows may fail if the URL is wrong."
+      );
+    }
+  }
 };
 function createAuthGateClient(config) {
   return new AuthGateClient(config);
 }
+
+// src/billing.ts
+function hasPlan(entitlements, plan) {
+  if (!(entitlements == null ? void 0 : entitlements.plan)) return false;
+  return entitlements.plan.toLowerCase() === plan.toLowerCase();
+}
+function hasFeature(entitlements, feature) {
+  if (!(entitlements == null ? void 0 : entitlements.features)) return false;
+  const lower = feature.toLowerCase();
+  return entitlements.features.some((f) => f.toLowerCase() === lower);
+}

package/dist/index.d.cts

@@ -47,16 +47,13 @@ interface TokenVerifyResult {
  *
  * const client = createAuthGateClient({
  *   apiKey: process.env.AUTHGATE_API_KEY!,
- *   projectId: process.env.AUTHGATE_PROJECT_ID!,
  *   baseUrl: "https://authgate.dev",
  * });
  * ```
  */
 interface AuthGateConfig {
-    /** Server-side API key for your AuthGate project. Found in the dashboard under API Keys. */
+    /** Server-side API key for your AuthGate project. Found in the dashboard under API Key. */
     apiKey: string;
-    /** The project ID from your AuthGate dashboard. */
-    projectId: string;
     /** Base URL of the AuthGate service (e.g. `"https://authgate.dev"`). */
     baseUrl: string;
     /**
@@ -172,7 +169,6 @@ interface BackupCodesResponse {
  * ```ts
  * const client = new AuthGateClient({
  *   apiKey: process.env.AUTHGATE_API_KEY!,
- *   projectId: process.env.AUTHGATE_PROJECT_ID!,
  *   baseUrl: "https://authgate.dev",
  * });
  * ```
@@ -262,8 +258,9 @@ declare class AuthGateClient {
      * @throws {@link AuthGateError} if the provider is not in {@link SUPPORTED_PROVIDERS}.
      */
     getOAuthUrl(provider: OAuthProvider, callbackUrl: string, options?: {
+        state?: string;
         linkTo?: string;
-    }): string;
+    }): Promise<string>;
     /**
      * Register a new user with email and password.
      *
@@ -459,8 +456,6 @@ declare class AuthGateClient {
     get refreshTokenCookieName(): string;
     /** The callback path where OAuth redirects are handled (default: `"/api/auth/callback"`). */
     get callbackPath(): string;
-    /** The AuthGate project ID. */
-    get projectId(): string;
     /** The AuthGate service base URL. */
     get baseUrl(): string;
     /** Session lifetime in seconds. */
@@ -477,6 +472,18 @@ declare class AuthGateClient {
      * Short-lived (10 minutes) to match the state TTL.
      */
     getNonceCookieOptions(): CookieOptions;
+    /**
+     * Validate the SDK configuration against the AuthGate server.
+     *
+     * Checks that the API key is valid and (optionally) that a callback URL
+     * is registered for the project. This is called automatically by framework
+     * factories (`createAuthGate`, `createAuthRoutes`) and logs errors to the
+     * console — it does NOT throw.
+     *
+     * @param callbackUrl - The full callback URL to check registration for.
+     * @internal
+     */
+    validateConfig(callbackUrl?: string): Promise<void>;
 }
 /**
  * Create an {@link AuthGateClient} instance.
@@ -557,5 +564,79 @@ declare class SessionDecryptionError extends AuthGateError {
 declare class InvalidStateError extends AuthGateError {
     constructor(message?: string);
 }
+/**
+ * Thrown when the AuthGate SDK is initialized with invalid configuration.
+ *
+ * Check the error message for details on which config field is invalid
+ * and how to fix it.
+ */
+declare class ConfigurationError extends AuthGateError {
+    constructor(message: string);
+}
+
+/** A product/plan in the billing catalog. */
+interface BillingPlan {
+    id: string;
+    name: string;
+    description: string | null;
+    features: string[];
+    prices: BillingPrice[];
+}
+/** A price attached to a plan. */
+interface BillingPrice {
+    id: string;
+    type: "recurring" | "metered" | "tiered";
+    amount: number | null;
+    currency: string;
+    interval: "daily" | "weekly" | "monthly" | "yearly";
+    intervalCount: number;
+}
+/** An active subscription for an end user. */
+interface BillingSubscription {
+    id: string;
+    status: "active" | "past_due" | "canceled" | "paused" | "trialing" | "unpaid";
+    plan: {
+        id: string;
+        name: string;
+    } | null;
+    price: BillingPrice | null;
+    currentPeriodStart: string;
+    currentPeriodEnd: string;
+    cancelAtPeriodEnd: boolean;
+    trialEnd: string | null;
+}
+/** Entitlement data for an end user — what plan they're on and what features they have. */
+interface BillingEntitlement {
+    plan: string | null;
+    features: string[];
+    status: string | null;
+    subscription: {
+        id: string;
+        currentPeriodEnd: string;
+    } | null;
+}
+/** A single usage event to report. */
+interface UsageEvent {
+    metric: string;
+    quantity: number;
+    idempotencyKey?: string;
+    timestamp?: string;
+}
+/**
+ * Check whether the user's entitlements include a specific plan.
+ *
+ * @param entitlements - The entitlement object from the billing API.
+ * @param plan - The plan name to check (case-insensitive).
+ * @returns `true` if the user is on the given plan.
+ */
+declare function hasPlan(entitlements: BillingEntitlement | null | undefined, plan: string): boolean;
+/**
+ * Check whether the user's entitlements include a specific feature.
+ *
+ * @param entitlements - The entitlement object from the billing API.
+ * @param feature - The feature name to check (case-insensitive).
+ * @returns `true` if the user has the given feature.
+ */
+declare function hasFeature(entitlements: BillingEntitlement | null | undefined, feature: string): boolean;
 
-export { AuthGateClient, type AuthGateConfig, AuthGateError, type AuthGateUser, type BackupCodesResponse, type CookieOptions, DEFAULT_COOKIE_NAME, InvalidStateError, type MfaChallengeResponse, type MfaStatus, NONCE_COOKIE_NAME, type OAuthProvider, REFRESH_TOKEN_COOKIE_NAME, SESSION_MAX_AGE, STATE_TTL_MS, SUPPORTED_PROVIDERS, SessionDecryptionError, type SessionPayload, TokenVerificationError, type TokenVerifyResult, type TotpSetupResponse, createAuthGateClient };
+export { AuthGateClient, type AuthGateConfig, AuthGateError, type AuthGateUser, type BackupCodesResponse, type BillingEntitlement, type BillingPlan, type BillingPrice, type BillingSubscription, ConfigurationError, type CookieOptions, DEFAULT_COOKIE_NAME, InvalidStateError, type MfaChallengeResponse, type MfaStatus, NONCE_COOKIE_NAME, type OAuthProvider, REFRESH_TOKEN_COOKIE_NAME, SESSION_MAX_AGE, STATE_TTL_MS, SUPPORTED_PROVIDERS, SessionDecryptionError, type SessionPayload, TokenVerificationError, type TokenVerifyResult, type TotpSetupResponse, type UsageEvent, createAuthGateClient, hasFeature, hasPlan };

package/dist/index.d.ts

@@ -47,16 +47,13 @@ interface TokenVerifyResult {
  *
  * const client = createAuthGateClient({
  *   apiKey: process.env.AUTHGATE_API_KEY!,
- *   projectId: process.env.AUTHGATE_PROJECT_ID!,
  *   baseUrl: "https://authgate.dev",
  * });
  * ```
  */
 interface AuthGateConfig {
-    /** Server-side API key for your AuthGate project. Found in the dashboard under API Keys. */
+    /** Server-side API key for your AuthGate project. Found in the dashboard under API Key. */
     apiKey: string;
-    /** The project ID from your AuthGate dashboard. */
-    projectId: string;
     /** Base URL of the AuthGate service (e.g. `"https://authgate.dev"`). */
     baseUrl: string;
     /**
@@ -172,7 +169,6 @@ interface BackupCodesResponse {
  * ```ts
  * const client = new AuthGateClient({
  *   apiKey: process.env.AUTHGATE_API_KEY!,
- *   projectId: process.env.AUTHGATE_PROJECT_ID!,
  *   baseUrl: "https://authgate.dev",
  * });
  * ```
@@ -262,8 +258,9 @@ declare class AuthGateClient {
      * @throws {@link AuthGateError} if the provider is not in {@link SUPPORTED_PROVIDERS}.
      */
     getOAuthUrl(provider: OAuthProvider, callbackUrl: string, options?: {
+        state?: string;
         linkTo?: string;
-    }): string;
+    }): Promise<string>;
     /**
      * Register a new user with email and password.
      *
@@ -459,8 +456,6 @@ declare class AuthGateClient {
     get refreshTokenCookieName(): string;
     /** The callback path where OAuth redirects are handled (default: `"/api/auth/callback"`). */
     get callbackPath(): string;
-    /** The AuthGate project ID. */
-    get projectId(): string;
     /** The AuthGate service base URL. */
     get baseUrl(): string;
     /** Session lifetime in seconds. */
@@ -477,6 +472,18 @@ declare class AuthGateClient {
      * Short-lived (10 minutes) to match the state TTL.
      */
     getNonceCookieOptions(): CookieOptions;
+    /**
+     * Validate the SDK configuration against the AuthGate server.
+     *
+     * Checks that the API key is valid and (optionally) that a callback URL
+     * is registered for the project. This is called automatically by framework
+     * factories (`createAuthGate`, `createAuthRoutes`) and logs errors to the
+     * console — it does NOT throw.
+     *
+     * @param callbackUrl - The full callback URL to check registration for.
+     * @internal
+     */
+    validateConfig(callbackUrl?: string): Promise<void>;
 }
 /**
  * Create an {@link AuthGateClient} instance.
@@ -557,5 +564,79 @@ declare class SessionDecryptionError extends AuthGateError {
 declare class InvalidStateError extends AuthGateError {
     constructor(message?: string);
 }
+/**
+ * Thrown when the AuthGate SDK is initialized with invalid configuration.
+ *
+ * Check the error message for details on which config field is invalid
+ * and how to fix it.
+ */
+declare class ConfigurationError extends AuthGateError {
+    constructor(message: string);
+}
+
+/** A product/plan in the billing catalog. */
+interface BillingPlan {
+    id: string;
+    name: string;
+    description: string | null;
+    features: string[];
+    prices: BillingPrice[];
+}
+/** A price attached to a plan. */
+interface BillingPrice {
+    id: string;
+    type: "recurring" | "metered" | "tiered";
+    amount: number | null;
+    currency: string;
+    interval: "daily" | "weekly" | "monthly" | "yearly";
+    intervalCount: number;
+}
+/** An active subscription for an end user. */
+interface BillingSubscription {
+    id: string;
+    status: "active" | "past_due" | "canceled" | "paused" | "trialing" | "unpaid";
+    plan: {
+        id: string;
+        name: string;
+    } | null;
+    price: BillingPrice | null;
+    currentPeriodStart: string;
+    currentPeriodEnd: string;
+    cancelAtPeriodEnd: boolean;
+    trialEnd: string | null;
+}
+/** Entitlement data for an end user — what plan they're on and what features they have. */
+interface BillingEntitlement {
+    plan: string | null;
+    features: string[];
+    status: string | null;
+    subscription: {
+        id: string;
+        currentPeriodEnd: string;
+    } | null;
+}
+/** A single usage event to report. */
+interface UsageEvent {
+    metric: string;
+    quantity: number;
+    idempotencyKey?: string;
+    timestamp?: string;
+}
+/**
+ * Check whether the user's entitlements include a specific plan.
+ *
+ * @param entitlements - The entitlement object from the billing API.
+ * @param plan - The plan name to check (case-insensitive).
+ * @returns `true` if the user is on the given plan.
+ */
+declare function hasPlan(entitlements: BillingEntitlement | null | undefined, plan: string): boolean;
+/**
+ * Check whether the user's entitlements include a specific feature.
+ *
+ * @param entitlements - The entitlement object from the billing API.
+ * @param feature - The feature name to check (case-insensitive).
+ * @returns `true` if the user has the given feature.
+ */
+declare function hasFeature(entitlements: BillingEntitlement | null | undefined, feature: string): boolean;
 
-export { AuthGateClient, type AuthGateConfig, AuthGateError, type AuthGateUser, type BackupCodesResponse, type CookieOptions, DEFAULT_COOKIE_NAME, InvalidStateError, type MfaChallengeResponse, type MfaStatus, NONCE_COOKIE_NAME, type OAuthProvider, REFRESH_TOKEN_COOKIE_NAME, SESSION_MAX_AGE, STATE_TTL_MS, SUPPORTED_PROVIDERS, SessionDecryptionError, type SessionPayload, TokenVerificationError, type TokenVerifyResult, type TotpSetupResponse, createAuthGateClient };
+export { AuthGateClient, type AuthGateConfig, AuthGateError, type AuthGateUser, type BackupCodesResponse, type BillingEntitlement, type BillingPlan, type BillingPrice, type BillingSubscription, ConfigurationError, type CookieOptions, DEFAULT_COOKIE_NAME, InvalidStateError, type MfaChallengeResponse, type MfaStatus, NONCE_COOKIE_NAME, type OAuthProvider, REFRESH_TOKEN_COOKIE_NAME, SESSION_MAX_AGE, STATE_TTL_MS, SUPPORTED_PROVIDERS, SessionDecryptionError, type SessionPayload, TokenVerificationError, type TokenVerifyResult, type TotpSetupResponse, type UsageEvent, createAuthGateClient, hasFeature, hasPlan };

package/dist/index.mjs

@@ -262,6 +262,12 @@ var InvalidStateError = class extends AuthGateError {
     this.name = "InvalidStateError";
   }
 };
+var ConfigurationError = class extends AuthGateError {
+  constructor(message) {
+    super(message);
+    this.name = "ConfigurationError";
+  }
+};
 
 // src/client.ts
 var AuthGateClient = class {
@@ -272,6 +278,28 @@ var AuthGateClient = class {
     this.encryptionKey = null;
     this.stateKey = null;
     var _a, _b, _c;
+    if (!config.apiKey || typeof config.apiKey !== "string" || config.apiKey.trim() === "") {
+      throw new ConfigurationError(
+        "[AuthGate] Missing or empty `apiKey`. Get your API key from the AuthGate dashboard \u2192 Project \u2192 API Key."
+      );
+    }
+    if (!config.baseUrl || typeof config.baseUrl !== "string" || config.baseUrl.trim() === "") {
+      throw new ConfigurationError(
+        '[AuthGate] Missing or empty `baseUrl`. Set this to your AuthGate service URL (e.g. "https://authgate.dev").'
+      );
+    }
+    try {
+      new URL(config.baseUrl);
+    } catch (e) {
+      throw new ConfigurationError(
+        `[AuthGate] Invalid \`baseUrl\`: "${config.baseUrl}". Must be a valid URL (e.g. "https://authgate.dev").`
+      );
+    }
+    if (config.callbackPath !== void 0 && !config.callbackPath.startsWith("/")) {
+      throw new ConfigurationError(
+        `[AuthGate] Invalid \`callbackPath\`: "${config.callbackPath}". Must start with "/" (e.g. "/api/auth/callback").`
+      );
+    }
     this.config = __spreadProps(__spreadValues({}, config), {
       cookieName: (_a = config.cookieName) != null ? _a : DEFAULT_COOKIE_NAME,
       sessionMaxAge: (_b = config.sessionMaxAge) != null ? _b : SESSION_MAX_AGE,
@@ -419,17 +447,28 @@ var AuthGateClient = class {
    * @returns The full authorization URL to redirect the user to.
    * @throws {@link AuthGateError} if the provider is not in {@link SUPPORTED_PROVIDERS}.
    */
-  getOAuthUrl(provider, callbackUrl, options) {
+  async getOAuthUrl(provider, callbackUrl, options) {
     if (!SUPPORTED_PROVIDERS.includes(provider)) {
       throw new AuthGateError(`Unsupported provider: ${provider}`);
     }
-    const url = new URL(`/api/proxy/${provider}`, this.config.baseUrl);
-    url.searchParams.set("project_id", this.config.projectId);
-    url.searchParams.set("callback_url", callbackUrl);
-    if (options == null ? void 0 : options.linkTo) {
-      url.searchParams.set("link_to", options.linkTo);
+    const response = await fetch(`${this.config.baseUrl}/api/proxy/${provider}`, {
+      method: "POST",
+      headers: {
+        Authorization: `Bearer ${this.config.apiKey}`,
+        "Content-Type": "application/json"
+      },
+      body: JSON.stringify({
+        callback_url: callbackUrl,
+        state: options == null ? void 0 : options.state,
+        link_to: options == null ? void 0 : options.linkTo
+      })
+    });
+    if (!response.ok) {
+      const error = await response.json().catch(() => ({}));
+      throw new AuthGateError(error.error || `OAuth initiation failed: ${response.status}`);
     }
-    return url.toString();
+    const data = await response.json();
+    return data.redirect_url;
   }
   // ---------------------------------------------------------------------------
   // Email auth
@@ -443,12 +482,14 @@ var AuthGateClient = class {
   async emailSignup(data) {
     return fetch(`${this.config.baseUrl}/api/proxy/email/signup`, {
       method: "POST",
-      headers: { "Content-Type": "application/json" },
+      headers: {
+        Authorization: `Bearer ${this.config.apiKey}`,
+        "Content-Type": "application/json"
+      },
       body: JSON.stringify({
         email: data.email,
         password: data.password,
         name: data.name,
-        project_id: this.config.projectId,
         callback_url: data.callbackUrl
       })
     });
@@ -465,11 +506,13 @@ var AuthGateClient = class {
   async emailSignin(data) {
     return fetch(`${this.config.baseUrl}/api/proxy/email/signin`, {
       method: "POST",
-      headers: { "Content-Type": "application/json" },
+      headers: {
+        Authorization: `Bearer ${this.config.apiKey}`,
+        "Content-Type": "application/json"
+      },
       body: JSON.stringify({
         email: data.email,
         password: data.password,
-        project_id: this.config.projectId,
         callback_url: data.callbackUrl
       })
     });
@@ -483,10 +526,12 @@ var AuthGateClient = class {
   async emailForgotPassword(data) {
     return fetch(`${this.config.baseUrl}/api/proxy/email/reset-password`, {
       method: "POST",
-      headers: { "Content-Type": "application/json" },
+      headers: {
+        Authorization: `Bearer ${this.config.apiKey}`,
+        "Content-Type": "application/json"
+      },
       body: JSON.stringify({
         email: data.email,
-        project_id: this.config.projectId,
         callback_url: data.callbackUrl
       })
     });
@@ -502,11 +547,13 @@ var AuthGateClient = class {
       `${this.config.baseUrl}/api/proxy/email/reset-password/confirm`,
       {
         method: "POST",
-        headers: { "Content-Type": "application/json" },
+        headers: {
+          Authorization: `Bearer ${this.config.apiKey}`,
+          "Content-Type": "application/json"
+        },
         body: JSON.stringify({
           token: data.token,
-          password: data.password,
-          project_id: this.config.projectId
+          password: data.password
         })
       }
     );
@@ -525,10 +572,12 @@ var AuthGateClient = class {
       `${this.config.baseUrl}/api/proxy/email/magic-link/send`,
       {
         method: "POST",
-        headers: { "Content-Type": "application/json" },
+        headers: {
+          Authorization: `Bearer ${this.config.apiKey}`,
+          "Content-Type": "application/json"
+        },
         body: JSON.stringify({
           email: data.email,
-          project_id: this.config.projectId,
           callback_url: data.callbackUrl
         })
       }
@@ -546,11 +595,13 @@ var AuthGateClient = class {
   async emailVerifyCode(data) {
     return fetch(`${this.config.baseUrl}/api/proxy/email/verify`, {
       method: "POST",
-      headers: { "Content-Type": "application/json" },
+      headers: {
+        Authorization: `Bearer ${this.config.apiKey}`,
+        "Content-Type": "application/json"
+      },
       body: JSON.stringify({
         email: data.email,
-        code: data.code,
-        project_id: this.config.projectId
+        code: data.code
       })
     });
   }
@@ -566,10 +617,12 @@ var AuthGateClient = class {
   async smsSendCode(data) {
     return fetch(`${this.config.baseUrl}/api/proxy/sms/send-code`, {
       method: "POST",
-      headers: { "Content-Type": "application/json" },
+      headers: {
+        Authorization: `Bearer ${this.config.apiKey}`,
+        "Content-Type": "application/json"
+      },
       body: JSON.stringify({
         phone: data.phone,
-        project_id: this.config.projectId,
         callback_url: data.callbackUrl
       })
     });
@@ -583,11 +636,13 @@ var AuthGateClient = class {
   async smsVerifyCode(data) {
     return fetch(`${this.config.baseUrl}/api/proxy/sms/verify-code`, {
       method: "POST",
-      headers: { "Content-Type": "application/json" },
+      headers: {
+        Authorization: `Bearer ${this.config.apiKey}`,
+        "Content-Type": "application/json"
+      },
       body: JSON.stringify({
         phone: data.phone,
         code: data.code,
-        project_id: this.config.projectId,
         callback_url: data.callbackUrl
       })
     });
@@ -610,10 +665,12 @@ var AuthGateClient = class {
         `${this.config.baseUrl}/api/proxy/token/refresh`,
         {
           method: "POST",
-          headers: { "Content-Type": "application/json" },
+          headers: {
+            Authorization: `Bearer ${this.config.apiKey}`,
+            "Content-Type": "application/json"
+          },
           body: JSON.stringify({
-            refresh_token: refreshToken,
-            project_id: this.config.projectId
+            refresh_token: refreshToken
           })
         }
       );
@@ -638,10 +695,12 @@ var AuthGateClient = class {
         `${this.config.baseUrl}/api/proxy/sessions/revoke`,
         {
           method: "POST",
-          headers: { "Content-Type": "application/json" },
+          headers: {
+            Authorization: `Bearer ${this.config.apiKey}`,
+            "Content-Type": "application/json"
+          },
           body: JSON.stringify({
-            refresh_token: refreshToken,
-            project_id: this.config.projectId
+            refresh_token: refreshToken
           })
         }
       );
@@ -664,10 +723,11 @@ var AuthGateClient = class {
   async mfaVerify(data) {
     return fetch(`${this.config.baseUrl}/api/proxy/mfa/verify`, {
       method: "POST",
-      headers: { "Content-Type": "application/json" },
-      body: JSON.stringify(__spreadProps(__spreadValues({}, data), {
-        project_id: this.config.projectId
-      }))
+      headers: {
+        Authorization: `Bearer ${this.config.apiKey}`,
+        "Content-Type": "application/json"
+      },
+      body: JSON.stringify(data)
     });
   }
   /**
@@ -798,11 +858,11 @@ var AuthGateClient = class {
   async mfaSmsSendCode(challenge) {
     return fetch(`${this.config.baseUrl}/api/proxy/mfa/sms/send-code`, {
       method: "POST",
-      headers: { "Content-Type": "application/json" },
-      body: JSON.stringify({
-        challenge,
-        project_id: this.config.projectId
-      })
+      headers: {
+        Authorization: `Bearer ${this.config.apiKey}`,
+        "Content-Type": "application/json"
+      },
+      body: JSON.stringify({ challenge })
     });
   }
   // ---------------------------------------------------------------------------
@@ -824,10 +884,6 @@ var AuthGateClient = class {
   get callbackPath() {
     return this.config.callbackPath;
   }
-  /** The AuthGate project ID. */
-  get projectId() {
-    return this.config.projectId;
-  }
   /** The AuthGate service base URL. */
   get baseUrl() {
     return this.config.baseUrl;
@@ -865,13 +921,78 @@ var AuthGateClient = class {
       path: "/"
     };
   }
+  // ---------------------------------------------------------------------------
+  // Config validation (async, called by framework factories)
+  // ---------------------------------------------------------------------------
+  /**
+   * Validate the SDK configuration against the AuthGate server.
+   *
+   * Checks that the API key is valid and (optionally) that a callback URL
+   * is registered for the project. This is called automatically by framework
+   * factories (`createAuthGate`, `createAuthRoutes`) and logs errors to the
+   * console — it does NOT throw.
+   *
+   * @param callbackUrl - The full callback URL to check registration for.
+   * @internal
+   */
+  async validateConfig(callbackUrl) {
+    try {
+      const response = await fetch(
+        `${this.config.baseUrl}/api/v1/config/validate`,
+        {
+          method: "POST",
+          headers: {
+            Authorization: `Bearer ${this.config.apiKey}`,
+            "Content-Type": "application/json"
+          },
+          body: JSON.stringify({
+            callback_url: callbackUrl
+          })
+        }
+      );
+      if (response.status === 401) {
+        console.error(
+          "\n[AuthGate] \u2717 Invalid API key.\n  The API key you provided is not recognized or has been revoked.\n  \u2192 Go to your AuthGate dashboard \u2192 Project \u2192 API Key to get a valid key.\n"
+        );
+        return;
+      }
+      if (!response.ok) {
+        console.warn(
+          "[AuthGate] Could not validate config (server returned " + response.status + "). Auth flows may fail."
+        );
+        return;
+      }
+      const data = await response.json();
+      if (callbackUrl && data.callback_url_registered === false) {
+        console.error(
+          "\n[AuthGate] \u2717 Callback URL not registered: " + callbackUrl + "\n  This URL must be added to your project's allowed callback URLs.\n  \u2192 Go to your AuthGate dashboard \u2192 Project \u2192 Callback URLs \u2192 Add URL.\n"
+        );
+      }
+    } catch (e) {
+      console.warn(
+        "[AuthGate] Could not reach AuthGate server at " + this.config.baseUrl + " to validate config. Auth flows may fail if the URL is wrong."
+      );
+    }
+  }
 };
 function createAuthGateClient(config) {
   return new AuthGateClient(config);
 }
+
+// src/billing.ts
+function hasPlan(entitlements, plan) {
+  if (!(entitlements == null ? void 0 : entitlements.plan)) return false;
+  return entitlements.plan.toLowerCase() === plan.toLowerCase();
+}
+function hasFeature(entitlements, feature) {
+  if (!(entitlements == null ? void 0 : entitlements.features)) return false;
+  const lower = feature.toLowerCase();
+  return entitlements.features.some((f) => f.toLowerCase() === lower);
+}
 export {
   AuthGateClient,
   AuthGateError,
+  ConfigurationError,
   DEFAULT_COOKIE_NAME,
   InvalidStateError,
   NONCE_COOKIE_NAME,
@@ -881,5 +1002,7 @@ export {
   SUPPORTED_PROVIDERS,
   SessionDecryptionError,
   TokenVerificationError,
-  createAuthGateClient
+  createAuthGateClient,
+  hasFeature,
+  hasPlan
 };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@auth-gate/core",
-  "version": "0.4.0",
+  "version": "0.6.0",
   "type": "module",
   "exports": {
     ".": {