@myapihq/sdk 2.1.0 → 2.2.0

package/dist/auth.d.ts

@@ -32,11 +32,17 @@ export interface AuthUsage {
     period: string;
     active_users: number;
     price_cents_each: number;
+    as_of?: string;
 }
 export interface AuthDomain {
     domain: string;
-    status: 'pending' | 'active';
-    dns: {
+    status: 'awaiting_verification' | 'pending' | 'active';
+    verification?: {
+        type: string;
+        name: string;
+        value: string;
+    };
+    dns?: {
         type: string;
         name: string;
         value: string;
@@ -49,9 +55,15 @@ export declare function createTenant(apiKey: string, orgId: string, input?: Crea
 export declare function getTenant(apiKey: string, orgId: string): Promise<Tenant>;
 export declare function createClient(apiKey: string, orgId: string, input: CreateClientInput): Promise<AuthClient>;
 export declare function listClients(apiKey: string, orgId: string): Promise<ListClientsResponse>;
+export declare function deleteClient(apiKey: string, orgId: string, clientId: string): Promise<{
+    client_id: string;
+    deleted: boolean;
+}>;
+export declare function rotateClient(apiKey: string, orgId: string, clientId: string): Promise<AuthClient>;
 export declare function getUsage(apiKey: string, orgId: string): Promise<AuthUsage>;
 export declare function registerDomain(apiKey: string, orgId: string, domain: string): Promise<AuthDomain>;
 export declare function getDomain(apiKey: string, orgId: string): Promise<AuthDomain>;
+export declare function verifyDomain(apiKey: string, orgId: string): Promise<AuthDomain>;
 export declare function deleteDomain(apiKey: string, orgId: string, domain: string): Promise<{
     domain: string;
     status: string;

package/dist/auth.js

@@ -5,9 +5,12 @@ exports.createTenant = createTenant;
 exports.getTenant = getTenant;
 exports.createClient = createClient;
 exports.listClients = listClients;
+exports.deleteClient = deleteClient;
+exports.rotateClient = rotateClient;
 exports.getUsage = getUsage;
 exports.registerDomain = registerDomain;
 exports.getDomain = getDomain;
+exports.verifyDomain = verifyDomain;
 exports.deleteDomain = deleteDomain;
 const client_1 = require("./client");
 const config_1 = require("./config");
@@ -29,9 +32,12 @@ exports.EXPOSES = [
     'GET /auth/orgs/{org_id}/tenant',
     'POST /auth/orgs/{org_id}/clients',
     'GET /auth/orgs/{org_id}/clients',
+    'DELETE /auth/orgs/{org_id}/clients/{client_id}',
+    'POST /auth/orgs/{org_id}/clients/{client_id}/rotate',
     'GET /auth/orgs/{org_id}/usage',
     'POST /auth/orgs/{org_id}/domain',
     'GET /auth/orgs/{org_id}/domain',
+    'POST /auth/orgs/{org_id}/domain/verify',
     'DELETE /auth/orgs/{org_id}/domain',
 ];
 // Create (or update) the org's auth tenant. Idempotent. `connections` selects
@@ -57,6 +63,17 @@ async function createClient(apiKey, orgId, input) {
 async function listClients(apiKey, orgId) {
     return (0, client_1.request)('GET', `${config_1.AUTH_BASE}/auth/orgs/${encodeURIComponent(orgId)}/clients`, apiKey);
 }
+// Delete (revoke) an OIDC client. Irreversible — the client_id stops
+// authenticating immediately.
+async function deleteClient(apiKey, orgId, clientId) {
+    return (0, client_1.request)('DELETE', `${config_1.AUTH_BASE}/auth/orgs/${encodeURIComponent(orgId)}/clients/${encodeURIComponent(clientId)}`, apiKey);
+}
+// Rotate a confidential ('web') client's secret. Returns the NEW secret exactly
+// once; the previous secret stops working immediately. (SPA clients have no
+// secret — rotating one is rejected by the backend.)
+async function rotateClient(apiKey, orgId, clientId) {
+    return (0, client_1.request)('POST', `${config_1.AUTH_BASE}/auth/orgs/${encodeURIComponent(orgId)}/clients/${encodeURIComponent(clientId)}/rotate`, apiKey);
+}
 // Monthly-active-user usage for the current period (auth is billed per MAU).
 async function getUsage(apiKey, orgId) {
     return (0, client_1.request)('GET', `${config_1.AUTH_BASE}/auth/orgs/${encodeURIComponent(orgId)}/usage`, apiKey);
@@ -71,6 +88,13 @@ async function registerDomain(apiKey, orgId, domain) {
 async function getDomain(apiKey, orgId) {
     return (0, client_1.request)('GET', `${config_1.AUTH_BASE}/auth/orgs/${encodeURIComponent(orgId)}/domain`, apiKey);
 }
+// Verify ownership of the org's custom auth domain by checking the published
+// TXT challenge. On success the domain advances awaiting_verification → pending
+// (and the response carries the A record). Rejects with 422 DOMAIN_NOT_VERIFIED
+// if the TXT record isn't found yet. Idempotent once already pending/active.
+async function verifyDomain(apiKey, orgId) {
+    return (0, client_1.request)('POST', `${config_1.AUTH_BASE}/auth/orgs/${encodeURIComponent(orgId)}/domain/verify`, apiKey);
+}
 async function deleteDomain(apiKey, orgId, domain) {
     return (0, client_1.request)('DELETE', `${config_1.AUTH_BASE}/auth/orgs/${encodeURIComponent(orgId)}/domain`, apiKey, { domain });
 }

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@myapihq/sdk",
   "license": "Apache-2.0",
-  "version": "2.1.0",
+  "version": "2.2.0",
   "description": "TypeScript SDK for the MyAPI ecosystem",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",

package/src/auth.ts

@@ -20,9 +20,12 @@ export const EXPOSES: Exposes = [
   'GET /auth/orgs/{org_id}/tenant',
   'POST /auth/orgs/{org_id}/clients',
   'GET /auth/orgs/{org_id}/clients',
+  'DELETE /auth/orgs/{org_id}/clients/{client_id}',
+  'POST /auth/orgs/{org_id}/clients/{client_id}/rotate',
   'GET /auth/orgs/{org_id}/usage',
   'POST /auth/orgs/{org_id}/domain',
   'GET /auth/orgs/{org_id}/domain',
+  'POST /auth/orgs/{org_id}/domain/verify',
   'DELETE /auth/orgs/{org_id}/domain',
 ];
 
@@ -70,13 +73,21 @@ export interface AuthUsage {
   period: string;            // 'YYYY-MM'
   active_users: number;
   price_cents_each: number;
+  as_of?: string;            // RFC3339 freshness marker — MAU is aggregated, not real-time
 }
 
-// A custom auth domain (e.g. auth.acme.com) for the tenant's hosted login + issuer.
+// A custom auth domain (e.g. auth.acme.com) for the tenant's hosted login +
+// issuer. Lifecycle: awaiting_verification (publish the TXT challenge, then
+// `verify`) → pending (publish the A record, TLS provisions) → active.
 export interface AuthDomain {
   domain: string;
-  status: 'pending' | 'active';
-  dns: { type: string; name: string; value: string };
+  status: 'awaiting_verification' | 'pending' | 'active';
+  // Present while `awaiting_verification` — the ownership-challenge TXT record
+  // to publish, then call verifyDomain().
+  verification?: { type: string; name: string; value: string };
+  // Present once `pending`/`active` — the A record to publish (withheld until
+  // ownership is verified).
+  dns?: { type: string; name: string; value: string };
   next?: string;
   issuer?: string;     // present once active
   login_url?: string;  // present once active
@@ -107,6 +118,19 @@ export async function listClients(apiKey: string, orgId: string): Promise<ListCl
   return request('GET', `${BASE_URL}/auth/orgs/${encodeURIComponent(orgId)}/clients`, apiKey);
 }
 
+// Delete (revoke) an OIDC client. Irreversible — the client_id stops
+// authenticating immediately.
+export async function deleteClient(apiKey: string, orgId: string, clientId: string): Promise<{ client_id: string; deleted: boolean }> {
+  return request('DELETE', `${BASE_URL}/auth/orgs/${encodeURIComponent(orgId)}/clients/${encodeURIComponent(clientId)}`, apiKey);
+}
+
+// Rotate a confidential ('web') client's secret. Returns the NEW secret exactly
+// once; the previous secret stops working immediately. (SPA clients have no
+// secret — rotating one is rejected by the backend.)
+export async function rotateClient(apiKey: string, orgId: string, clientId: string): Promise<AuthClient> {
+  return request('POST', `${BASE_URL}/auth/orgs/${encodeURIComponent(orgId)}/clients/${encodeURIComponent(clientId)}/rotate`, apiKey);
+}
+
 // Monthly-active-user usage for the current period (auth is billed per MAU).
 export async function getUsage(apiKey: string, orgId: string): Promise<AuthUsage> {
   return request('GET', `${BASE_URL}/auth/orgs/${encodeURIComponent(orgId)}/usage`, apiKey);
@@ -124,6 +148,14 @@ export async function getDomain(apiKey: string, orgId: string): Promise<AuthDoma
   return request('GET', `${BASE_URL}/auth/orgs/${encodeURIComponent(orgId)}/domain`, apiKey);
 }
 
+// Verify ownership of the org's custom auth domain by checking the published
+// TXT challenge. On success the domain advances awaiting_verification → pending
+// (and the response carries the A record). Rejects with 422 DOMAIN_NOT_VERIFIED
+// if the TXT record isn't found yet. Idempotent once already pending/active.
+export async function verifyDomain(apiKey: string, orgId: string): Promise<AuthDomain> {
+  return request('POST', `${BASE_URL}/auth/orgs/${encodeURIComponent(orgId)}/domain/verify`, apiKey);
+}
+
 export async function deleteDomain(apiKey: string, orgId: string, domain: string): Promise<{ domain: string; status: string }> {
   return request('DELETE', `${BASE_URL}/auth/orgs/${encodeURIComponent(orgId)}/domain`, apiKey, { domain });
 }