@distilled.cloud/auth0 0.0.0 → 1.0.0-rc.9

package/lib/services/index.d.ts

@@ -0,0 +1,2 @@
+export * as auth0 from "./auth0.ts";
+//# sourceMappingURL=index.d.ts.map

package/lib/services/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/services/index.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,KAAK,MAAM,YAAY,CAAC"}

package/lib/services/index.js

@@ -0,0 +1,3 @@
+// AUTO-GENERATED by scripts/generate.ts. Do not edit.
+export * as auth0 from "./auth0.js";
+//# sourceMappingURL=index.js.map

package/lib/services/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/services/index.ts"],"names":[],"mappings":"AAAA,sDAAsD;AACtD,OAAO,KAAK,KAAK,MAAM,YAAY,CAAC"}

package/lib/traits.d.ts

@@ -0,0 +1,11 @@
+/**
+ * Auth0 SDK trait surface — hand-written.
+ *
+ * Re-exports the generic protocol traits from core (so generated operations
+ * import everything from one place). Auth0 has no envelope of its own; the
+ * REST-protocol traits (SensitiveValue / RawResponse) come from
+ * `core/protocol-rest`.
+ */
+export { Body, Header, Query, Label, Http, ResponseCode, HttpBody, FormDataFile, KeyDictionary, UnionCases, applyErrorMatchers, getErrorMatchers, type HttpTrait, type ErrorMatcher, bodySymbol, headerSymbol, querySymbol, labelSymbol, httpSymbol, responseCodeSymbol, httpBodySymbol, formDataFileSymbol, keyDictionarySymbol, unionCasesSymbol, errorMatchersSymbol, } from "@distilled.cloud/core/trait";
+export { SensitiveValue, RawResponse, RawResponseRoot, sensitiveValueSymbol, rawResponseSymbol, rawResponseRootSymbol, } from "@distilled.cloud/core/protocol-rest";
+//# sourceMappingURL=traits.d.ts.map

package/lib/traits.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"traits.d.ts","sourceRoot":"","sources":["../src/traits.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,OAAO,EACL,IAAI,EACJ,MAAM,EACN,KAAK,EACL,KAAK,EACL,IAAI,EACJ,YAAY,EACZ,QAAQ,EACR,YAAY,EACZ,aAAa,EACb,UAAU,EACV,kBAAkB,EAClB,gBAAgB,EAChB,KAAK,SAAS,EACd,KAAK,YAAY,EACjB,UAAU,EACV,YAAY,EACZ,WAAW,EACX,WAAW,EACX,UAAU,EACV,kBAAkB,EAClB,cAAc,EACd,kBAAkB,EAClB,mBAAmB,EACnB,gBAAgB,EAChB,mBAAmB,GACpB,MAAM,6BAA6B,CAAC;AAErC,OAAO,EACL,cAAc,EACd,WAAW,EACX,eAAe,EACf,oBAAoB,EACpB,iBAAiB,EACjB,qBAAqB,GACtB,MAAM,qCAAqC,CAAC"}

package/lib/traits.js

@@ -0,0 +1,11 @@
+/**
+ * Auth0 SDK trait surface — hand-written.
+ *
+ * Re-exports the generic protocol traits from core (so generated operations
+ * import everything from one place). Auth0 has no envelope of its own; the
+ * REST-protocol traits (SensitiveValue / RawResponse) come from
+ * `core/protocol-rest`.
+ */
+export { Body, Header, Query, Label, Http, ResponseCode, HttpBody, FormDataFile, KeyDictionary, UnionCases, applyErrorMatchers, getErrorMatchers, bodySymbol, headerSymbol, querySymbol, labelSymbol, httpSymbol, responseCodeSymbol, httpBodySymbol, formDataFileSymbol, keyDictionarySymbol, unionCasesSymbol, errorMatchersSymbol, } from "@distilled.cloud/core/trait";
+export { SensitiveValue, RawResponse, RawResponseRoot, sensitiveValueSymbol, rawResponseSymbol, rawResponseRootSymbol, } from "@distilled.cloud/core/protocol-rest";
+//# sourceMappingURL=traits.js.map

package/lib/traits.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"traits.js","sourceRoot":"","sources":["../src/traits.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,OAAO,EACL,IAAI,EACJ,MAAM,EACN,KAAK,EACL,KAAK,EACL,IAAI,EACJ,YAAY,EACZ,QAAQ,EACR,YAAY,EACZ,aAAa,EACb,UAAU,EACV,kBAAkB,EAClB,gBAAgB,EAGhB,UAAU,EACV,YAAY,EACZ,WAAW,EACX,WAAW,EACX,UAAU,EACV,kBAAkB,EAClB,cAAc,EACd,kBAAkB,EAClB,mBAAmB,EACnB,gBAAgB,EAChB,mBAAmB,GACpB,MAAM,6BAA6B,CAAC;AAErC,OAAO,EACL,cAAc,EACd,WAAW,EACX,eAAe,EACf,oBAAoB,EACpB,iBAAiB,EACjB,qBAAqB,GACtB,MAAM,qCAAqC,CAAC"}

package/package.json

@@ -1,14 +1,85 @@
 {
   "name": "@distilled.cloud/auth0",
-  "version": "0.0.0",
-  "description": "Placeholder package for an upcoming distilled SDK.",
-  "license": "Apache-2.0",
+  "version": "1.0.0-rc.9",
   "repository": {
     "type": "git",
     "url": "https://github.com/alchemy-run/distilled",
     "directory": "packages/auth0"
   },
-  "publishConfig": {
-    "access": "public"
+  "license": "Apache-2.0",
+  "type": "module",
+  "sideEffects": false,
+  "files": [
+    "lib",
+    "src"
+  ],
+  "exports": {
+    ".": {
+      "types": "./lib/index.d.ts",
+      "bun": "./src/index.ts",
+      "worker": "./src/index.ts",
+      "default": "./lib/index.js"
+    },
+    "./Credentials": {
+      "types": "./lib/credentials.d.ts",
+      "bun": "./src/credentials.ts",
+      "worker": "./src/credentials.ts",
+      "default": "./lib/credentials.js"
+    },
+    "./Errors": {
+      "types": "./lib/errors.d.ts",
+      "bun": "./src/errors.ts",
+      "worker": "./src/errors.ts",
+      "default": "./lib/errors.js"
+    },
+    "./Traits": {
+      "types": "./lib/traits.d.ts",
+      "bun": "./src/traits.ts",
+      "worker": "./src/traits.ts",
+      "default": "./lib/traits.js"
+    },
+    "./Pagination": {
+      "types": "./lib/pagination.d.ts",
+      "bun": "./src/pagination.ts",
+      "worker": "./src/pagination.ts",
+      "default": "./lib/pagination.js"
+    },
+    "./Protocol": {
+      "types": "./lib/protocol.d.ts",
+      "bun": "./src/protocol.ts",
+      "worker": "./src/protocol.ts",
+      "default": "./lib/protocol.js"
+    },
+    "./Retry": {
+      "types": "./lib/retry.d.ts",
+      "bun": "./src/retry.ts",
+      "worker": "./src/retry.ts",
+      "default": "./lib/retry.js"
+    },
+    "./*": {
+      "types": "./lib/services/*.d.ts",
+      "bun": "./src/services/*.ts",
+      "worker": "./src/services/*.ts",
+      "default": "./lib/services/*.js"
+    }
+  },
+  "dependencies": {
+    "@distilled.cloud/core": "1.0.0-rc.9"
+  },
+  "devDependencies": {
+    "@types/bun": "latest",
+    "@types/node": "latest",
+    "@effect/platform-bun": ">=4.0.0-rc.112 || >=4.0.0"
+  },
+  "peerDependencies": {
+    "effect": ">=4.0.0-rc.112 || >=4.0.0"
+  },
+  "scripts": {
+    "build": "tsc -b",
+    "convert": "bun scripts/convert.ts",
+    "generate": "bun scripts/convert.ts && bun scripts/generate.ts",
+    "typecheck": "tsc -p tsconfig.json",
+    "specs:fetch": "git submodule update --force --init --depth=1 specs/spec-mirror-auth0",
+    "specs:update": "git submodule update --remote --force --depth=1 specs/spec-mirror-auth0"
   }
-}
+}

package/src/credentials.ts

@@ -0,0 +1,70 @@
+/**
+ * Auth0 credentials — hand-written.
+ *
+ * The `Credentials` service holds an *effect* that resolves the current
+ * credentials on every request (the protocol layer resolves it per request
+ * on the calling fiber). Management API auth is a bearer token sent as
+ * `Authorization: Bearer <token>` against `https://{domain}/api/v2`.
+ */
+import * as Context from "effect/Context";
+import * as Effect from "effect/Effect";
+import * as Layer from "effect/Layer";
+import * as Redacted from "effect/Redacted";
+import { ConfigError } from "@distilled.cloud/core/errors";
+
+/** Build the Management API base URL for a tenant domain. */
+export const apiBaseUrlForDomain = (domain: string): string => {
+  const host = domain.replace(/^https?:\/\//, "").replace(/\/+$/, "");
+  return `https://${host}/api/v2`;
+};
+
+export interface Config {
+  readonly token: Redacted.Redacted<string>;
+  readonly domain: string;
+  readonly apiBaseUrl: string;
+}
+
+export class Credentials extends Context.Service<
+  Credentials,
+  Effect.Effect<Config>
+>()("Auth0Credentials") {}
+
+/** Layer from a Management API token + tenant domain. */
+export const fromToken = (config: {
+  readonly token: string;
+  readonly domain: string;
+  readonly apiBaseUrl?: string;
+}): Layer.Layer<Credentials> =>
+  Layer.succeed(
+    Credentials,
+    Effect.succeed({
+      token: Redacted.make(config.token),
+      domain: config.domain,
+      apiBaseUrl: config.apiBaseUrl ?? apiBaseUrlForDomain(config.domain),
+    }),
+  );
+
+/**
+ * Reads AUTH0_DOMAIN and AUTH0_MANAGEMENT_TOKEN (required) and
+ * AUTH0_API_BASE_URL (optional override of `https://{domain}/api/v2`).
+ */
+export const CredentialsFromEnv: Layer.Layer<Credentials> = Layer.succeed(
+  Credentials,
+  Effect.gen(function* () {
+    const domain = process.env.AUTH0_DOMAIN;
+    const token = process.env.AUTH0_MANAGEMENT_TOKEN;
+
+    if (!domain || !token) {
+      return yield* new ConfigError({
+        message:
+          "AUTH0_DOMAIN and AUTH0_MANAGEMENT_TOKEN environment variables are required",
+      });
+    }
+
+    return {
+      token: Redacted.make(token),
+      domain,
+      apiBaseUrl: process.env.AUTH0_API_BASE_URL ?? apiBaseUrlForDomain(domain),
+    };
+  }).pipe(Effect.orDie),
+);

package/src/errors.ts

@@ -0,0 +1,50 @@
+/**
+ * Auth0-specific error types.
+ *
+ * Re-exports the common HTTP errors from core and adds the Auth0 fallback
+ * errors. Note the generated service module additionally defines its own
+ * per-status matcher classes (BadRequest/NotFound/…) for the statuses each
+ * operation declares — those share `_tag`s with the core classes here, so
+ * `catchTag` works against either.
+ */
+export {
+  BadGateway,
+  BadRequest,
+  Conflict,
+  ConfigError,
+  Forbidden,
+  GatewayTimeout,
+  InternalServerError,
+  Locked,
+  NotFound,
+  ServiceUnavailable,
+  TooManyRequests,
+  Unauthorized,
+  UnprocessableEntity,
+  HTTP_STATUS_MAP,
+  DEFAULT_ERRORS,
+  API_ERRORS,
+} from "@distilled.cloud/core/errors";
+export type { DefaultErrors } from "@distilled.cloud/core/errors";
+
+import * as Schema from "effect/Schema";
+import * as Category from "@distilled.cloud/core/category";
+
+/** Unknown Auth0 error — returned when nothing else matches the failure. */
+export class UnknownAuth0Error extends Schema.TaggedError<UnknownAuth0Error>()(
+  "UnknownAuth0Error",
+  {
+    code: Schema.optional(Schema.String),
+    message: Schema.optional(Schema.String),
+    body: Schema.Unknown,
+  },
+).pipe(Category.withServerError) {}
+
+/** Schema parse error wrapper. */
+export class Auth0ParseError extends Schema.TaggedError<Auth0ParseError>()(
+  "Auth0ParseError",
+  {
+    body: Schema.Unknown,
+    cause: Schema.Unknown,
+  },
+).pipe(Category.withParseError) {}

package/src/index.ts

@@ -0,0 +1,37 @@
+/**
+ * @distilled.cloud/auth0 — Auth0 Management API SDK for Effect.
+ *
+ * `./services` is generated by `scripts/generate.ts` from the Smithy model
+ * in `.generated-specs` (written by `scripts/convert.ts` from the OpenAPI
+ * spec). Everything else in this folder is hand-written.
+ *
+ * @example
+ * ```ts
+ * import * as Auth0 from "@distilled.cloud/auth0";
+ *
+ * const actions = yield* Auth0.Services.auth0.getActions({});
+ * ```
+ */
+export * from "./credentials.ts";
+export * from "./errors.ts";
+export * as T from "./traits.ts";
+export {
+  Auth0Protocol,
+  type Auth0OpError,
+  type Auth0OpContext,
+} from "./protocol.ts";
+export { paginateCursor, paginatePageNumber } from "./pagination.ts";
+export * as Retry from "./retry.ts";
+export * as Services from "./services/index.ts";
+// Operations (and their request/response types) are importable straight off
+// the package root. The service-local typed error classes shadow the
+// same-named shared ones from ./errors.ts — the ops actually raise the
+// service-local classes.
+export * from "./services/auth0.ts";
+export {
+  BadRequest,
+  Conflict,
+  Forbidden,
+  NotFound,
+  UnprocessableEntity,
+} from "./services/auth0.ts";

package/src/pagination.ts

@@ -0,0 +1,12 @@
+/**
+ * Auth0 pagination — hand-written.
+ *
+ * Auth0's paginated list operations are typically page-number mode (`page`
+ * / `per_page` in); some endpoints also use checkpoint/cursor style
+ * (`from` / `take`). Generated operations pass the matching core strategy
+ * to `API.makePaginated`.
+ */
+export {
+  paginateCursor,
+  paginatePageNumber,
+} from "@distilled.cloud/core/pagination";

package/src/protocol.ts

@@ -0,0 +1,69 @@
+/**
+ * Auth0Protocol — hand-written.
+ *
+ * Auth0's Management API speaks plain bearer-authenticated JSON REST (no
+ * response envelope), so the whole protocol is one `makeRestProtocol` call
+ * from `core/protocol-rest`:
+ *
+ *   request:  credentials → `Authorization: Bearer <token>` + base URL
+ *             (`https://{domain}/api/v2`), resolved from the calling fiber
+ *             on every request
+ *
+ *   response: 2xx JSON is the payload (sensitive members delivered as
+ *             `Redacted`); non-2xx `{ statusCode?, error?, errorCode?,
+ *             message }` bodies map to the operation's typed error classes
+ *             by status, then the shared HTTP-status classes, then
+ *             {@link UnknownAuth0Error}.
+ */
+import * as Effect from "effect/Effect";
+import type * as Layer from "effect/Layer";
+import * as Redacted from "effect/Redacted";
+import type * as HttpClient from "effect/unstable/http/HttpClient";
+import type * as HttpClientError from "effect/unstable/http/HttpClientError";
+import type * as API from "@distilled.cloud/core/api";
+import { makeRestProtocol } from "@distilled.cloud/core/protocol-rest";
+import type { API_ERRORS, ConfigError } from "@distilled.cloud/core/errors";
+import { Credentials, type Config } from "./credentials.ts";
+import { UnknownAuth0Error } from "./errors.ts";
+
+/**
+ * Error channel shared by every generated Auth0 operation. Generated service
+ * files annotate operations with `API.OperationMethod<I, O, Auth0OpError,
+ * Auth0OpContext>` explicitly so the compiler never infers these back out of
+ * the schema generics.
+ */
+export type Auth0OpError =
+  | InstanceType<(typeof API_ERRORS)[number]>
+  | UnknownAuth0Error
+  | ConfigError
+  | HttpClientError.HttpClientError;
+
+/** Context (requirements) shared by every generated Auth0 operation. */
+export type Auth0OpContext = Credentials | HttpClient.HttpClient;
+
+export const Auth0Protocol: Layer.Layer<API.Protocol> =
+  makeRestProtocol<Config>({
+    // The Credentials service holds an effect — resolving it here (per
+    // request, on the calling fiber) picks up context-provided credentials.
+    credentials: Effect.gen(function* () {
+      const resolve = yield* Credentials;
+      return yield* resolve;
+    }),
+    baseUrl: (creds) => creds.apiBaseUrl,
+    headers: (creds) => ({
+      Authorization: `Bearer ${Redacted.value(creds.token)}`,
+    }),
+    // Auth0's error body is `{ statusCode?, error?, errorCode?, message }` —
+    // the factory's default lenient envelope covers it.
+    unknownError: ({ code, message, body }) =>
+      new UnknownAuth0Error({
+        code:
+          typeof code === "string"
+            ? code
+            : code !== undefined
+              ? String(code)
+              : undefined,
+        message,
+        body,
+      }),
+  });

package/src/retry.ts

@@ -0,0 +1,54 @@
+/**
+ * Auth0 retry configuration.
+ *
+ * Defines the per-SDK `Retry` Context.Service tag that generated operations
+ * wire into `API.make`. Callers can install a blanket retry policy at the
+ * layer level and have every Auth0 API call below it pick it up:
+ *
+ * @example
+ * ```ts
+ * import * as Auth0 from "@distilled.cloud/auth0";
+ *
+ * myEffect.pipe(Auth0.Retry.transient);
+ * Effect.provide(myEffect, Layer.succeed(Auth0.Retry.Retry, customPolicy));
+ * ```
+ */
+import * as Context from "effect/Context";
+import * as Effect from "effect/Effect";
+import * as Layer from "effect/Layer";
+import {
+  type Policy,
+  throttlingFactory,
+  transientFactory,
+} from "@distilled.cloud/core/retry";
+
+export {
+  type Options,
+  type Factory,
+  type Policy,
+  makeDefault,
+  jittered,
+  capped,
+  throttlingOptions,
+  transientOptions,
+  throttlingFactory,
+  transientFactory,
+} from "@distilled.cloud/core/retry";
+
+/** Context tag for configuring retry behavior of Auth0 API calls. */
+export class Retry extends Context.Service<Retry, Policy>()("Auth0Retry") {}
+
+/** Provides a custom retry policy to every Auth0 API call below it. */
+export const policy = (optionsOrFactory: Policy) =>
+  Effect.provide(Layer.succeed(Retry, optionsOrFactory));
+
+/** Disables all automatic retries. */
+export const none = Effect.provide(
+  Layer.succeed(Retry, { while: () => false }),
+);
+
+/** Apply the throttling retry policy (retries throttling errors indefinitely). */
+export const throttling = policy(throttlingFactory);
+
+/** Apply the transient retry policy (retries all transient errors indefinitely). */
+export const transient = policy(transientFactory);