@pisti-paypiller/backend 0.0.0-stage → 0.7.1

package/dist/management.d.ts

@@ -0,0 +1,162 @@
+import type { AcceptsToken, AuthenticateRequestOptions, AuthObjectFor, RequestState, SessionClaims, VerifyTokenOptions } from "./types.js";
+import type { ManagementClientOptions, ManagementRequestOptions, ManagedInstance, ManagementListOptions, ManagementPage, User, EmailAddress, CreateUserInput, UpdateUserInput, UserStatus, DirectoryExternalAccount, Session, SessionListOptions, ApiKey, ApiKeyListOptions, UpdateApiKeyInput, Metadata, ManagedOrganization, CreateOrganizationInput, UpdateOrganizationInput, ManagedOrganizationMember, ManagedInvitation, InvitationResult, ManagedRole, RoleInput, ManagedPermission, DeletionBlocker, ManagedExternalProvider, CreateExternalProviderInput, UpdateExternalProviderInput, WebhookEndpointInput, UpdateWebhookEndpointInput, ManagedWebhookEndpoint, WebhookSecretResult, WebhookEventType, WebhookDeliveryListOptions, ManagedWebhookDelivery, WebhookDeliveryDetails } from "./management-types.js";
+export type * from "./management-types.js";
+/** Structured service failure. No credentials or raw requests are retained. */
+export declare class PistiManagementError extends Error {
+    readonly status: number;
+    readonly requestId: string | null;
+    readonly code: string | null;
+    readonly retryAfterSeconds: number | null;
+    readonly fieldErrors: Readonly<Record<string, string[]>>;
+    readonly blockers: readonly DeletionBlocker[];
+    constructor(message: string, status: number, requestId?: string | null, code?: string | null, retryAfterSeconds?: number | null, fieldErrors?: Readonly<Record<string, string[]>>, blockers?: readonly DeletionBlocker[]);
+}
+type RequestResource = <T>(method: string, path: string, body?: unknown, options?: ManagementRequestOptions) => Promise<T>;
+/** Server-side client for one environment: request authentication and the management API. */
+export declare class PistiClient {
+    #private;
+    readonly users: ManagementUsers;
+    readonly organizations: ManagementOrganizations;
+    readonly sessions: ManagementSessions;
+    readonly externalProviders: ManagementExternalProviders;
+    readonly webhooks: ManagementWebhooks;
+    readonly apiKeys: ManagementApiKeys;
+    constructor(options?: ManagementClientOptions);
+    /**
+     * Authenticates a Fetch API `Request` using this client's publishable key. Never throws for a
+     * missing or bad token; check `isAuthenticated` and call `toAuth()`.
+     */
+    authenticateRequest<T extends AcceptsToken = "session_token">(request: Request, options?: AuthenticateRequestOptions & {
+        acceptsToken?: T;
+    }): Promise<RequestState<AuthObjectFor<T>>>;
+    /** Verifies a session token and returns its claims. */
+    verifyToken(token: string, options?: VerifyTokenOptions): Promise<SessionClaims>;
+    /** The environment the secret key belongs to. */
+    getInstance(options?: ManagementRequestOptions): Promise<ManagedInstance>;
+}
+export declare class ManagementUsers {
+    private readonly request;
+    constructor(request: RequestResource);
+    getUserList: (options?: ManagementListOptions & {
+        status?: UserStatus;
+    }) => Promise<ManagementPage<User>>;
+    getUserListAll(options?: Omit<ManagementListOptions, "cursor"> & {
+        status?: UserStatus;
+    }): AsyncGenerator<User>;
+    /** The number of users matching `search` and `status`. */
+    getCount: (options?: Omit<ManagementListOptions, "cursor" | "limit"> & {
+        status?: UserStatus;
+    }) => Promise<number>;
+    getUser: (id: string, options?: ManagementRequestOptions) => Promise<User>;
+    createUser: (input: CreateUserInput, options?: ManagementRequestOptions) => Promise<User>;
+    updateUser: (id: string, input: UpdateUserInput, options?: ManagementRequestOptions) => Promise<void>;
+    private setStatus;
+    /** Disables the account and ends its sessions. */
+    banUser: (id: string, options?: ManagementRequestOptions) => Promise<void>;
+    unbanUser: (id: string, options?: ManagementRequestOptions) => Promise<void>;
+    lockUser: (id: string, options?: ManagementRequestOptions) => Promise<void>;
+    unlockUser: (id: string, options?: ManagementRequestOptions) => Promise<void>;
+    deleteUser: (id: string, options?: ManagementRequestOptions) => Promise<void>;
+    getUserEmailAddressList: (id: string, options?: ManagementRequestOptions) => Promise<EmailAddress[]>;
+    addEmailAddress: (id: string, input: {
+        email: string;
+        status: "verified" | "unverified";
+        isPrimary?: boolean;
+        verificationReason?: string;
+    }, options?: ManagementRequestOptions) => Promise<{
+        id: string;
+    }>;
+    setEmailVerification: (id: string, emailId: string, status: "verified" | "unverified", options?: ManagementRequestOptions & {
+        verificationReason?: string;
+    }) => Promise<void>;
+    setPrimaryEmail: (id: string, emailId: string, options?: ManagementRequestOptions) => Promise<void>;
+    removeEmailAddress: (id: string, emailId: string, options?: ManagementRequestOptions) => Promise<void>;
+    getUserExternalAccountList: (id: string, options?: ManagementRequestOptions) => Promise<DirectoryExternalAccount[]>;
+}
+export declare class ManagementExternalProviders {
+    private readonly request;
+    constructor(request: RequestResource);
+    list: (options?: ManagementRequestOptions) => Promise<ManagedExternalProvider[]>;
+    create: (input: CreateExternalProviderInput, options?: ManagementRequestOptions) => Promise<ManagedExternalProvider>;
+    update: (id: string, input: UpdateExternalProviderInput, options?: ManagementRequestOptions) => Promise<ManagedExternalProvider>;
+    delete: (id: string, options?: ManagementRequestOptions) => Promise<void>;
+}
+export declare class ManagementWebhooks {
+    private readonly request;
+    constructor(request: RequestResource);
+    catalog: (options?: ManagementRequestOptions) => Promise<WebhookEventType[]>;
+    endpoints: (options?: ManagementRequestOptions) => Promise<ManagedWebhookEndpoint[]>;
+    createEndpoint: (input: WebhookEndpointInput, options?: ManagementRequestOptions) => Promise<WebhookSecretResult>;
+    updateEndpoint: (id: string, input: UpdateWebhookEndpointInput, options?: ManagementRequestOptions) => Promise<ManagedWebhookEndpoint>;
+    archiveEndpoint: (id: string, expectedUpdatedAt: string, options?: ManagementRequestOptions) => Promise<void>;
+    rotateSecret: (id: string, expectedUpdatedAt: string, options?: ManagementRequestOptions) => Promise<WebhookSecretResult>;
+    sendTest: (id: string, options?: ManagementRequestOptions) => Promise<{
+        id: string;
+        eventId: string;
+    }>;
+    deliveries: (options?: WebhookDeliveryListOptions) => Promise<ManagementPage<ManagedWebhookDelivery>>;
+    delivery: (id: string, options?: ManagementRequestOptions) => Promise<WebhookDeliveryDetails>;
+    replay: (id: string, options?: ManagementRequestOptions) => Promise<void>;
+}
+export declare class ManagementApiKeys {
+    private readonly request;
+    constructor(request: RequestResource);
+    getApiKeyList: (options?: ApiKeyListOptions) => Promise<ManagementPage<ApiKey>>;
+    getApiKey: (id: string, options?: ManagementRequestOptions) => Promise<ApiKey>;
+    /** Sets what a key may do in your API. Only your backend grants scopes and claims; the key's owner cannot. */
+    updateApiKey: (id: string, input: UpdateApiKeyInput, options?: ManagementRequestOptions) => Promise<ApiKey>;
+    revokeApiKey: (id: string, options?: ManagementRequestOptions & {
+        revocationReason?: string;
+    }) => Promise<void>;
+    /** Verifies a presented `ak_` secret. Throws `PistiManagementError` (401) for unknown, expired or revoked keys. */
+    verifySecret: (secret: string, options?: ManagementRequestOptions) => Promise<ApiKey>;
+}
+export declare class ManagementSessions {
+    private readonly request;
+    constructor(request: RequestResource);
+    /** Sessions in the environment, newest first. Filter by `userId` and `status`. */
+    getSessionList: (options?: SessionListOptions) => Promise<ManagementPage<Session>>;
+    getSession: (id: string, options?: ManagementRequestOptions) => Promise<Session>;
+    revokeSession: (id: string, options?: ManagementRequestOptions) => Promise<void>;
+}
+export declare class ManagementOrganizations {
+    private readonly request;
+    constructor(request: RequestResource);
+    getOrganizationList: (options?: ManagementListOptions) => Promise<ManagementPage<ManagedOrganization>>;
+    getOrganization: (id: string, options?: ManagementRequestOptions) => Promise<{
+        organization: ManagedOrganization;
+        privateMetadata: Metadata;
+    }>;
+    createOrganization: (input: CreateOrganizationInput, options?: ManagementRequestOptions) => Promise<{
+        id: string;
+    }>;
+    updateOrganization: (id: string, input: UpdateOrganizationInput, options?: ManagementRequestOptions) => Promise<void>;
+    deleteOrganization: (id: string, options?: ManagementRequestOptions) => Promise<void>;
+    getOrganizationMembershipList: (id: string, options?: ManagementListOptions) => Promise<ManagementPage<ManagedOrganizationMember>>;
+    updateOrganizationMembership: (id: string, memberId: string, roleId: string, options?: ManagementRequestOptions) => Promise<void>;
+    deleteOrganizationMembership: (id: string, memberId: string, options?: ManagementRequestOptions) => Promise<void>;
+    getOrganizationInvitationList: (id: string, options?: ManagementListOptions) => Promise<ManagementPage<ManagedInvitation>>;
+    createOrganizationInvitation: (id: string, input: {
+        email: string;
+        roleId: string;
+        lifetimeDays?: number;
+    }, options?: ManagementRequestOptions) => Promise<InvitationResult>;
+    reissueOrganizationInvitation: (id: string, invitationId: string, input: {
+        expectedExpiresAt: string;
+        lifetimeDays?: number;
+    }, options?: ManagementRequestOptions) => Promise<InvitationResult>;
+    revokeOrganizationInvitation: (id: string, invitationId: string, options?: ManagementRequestOptions) => Promise<void>;
+    getRoleList: (id: string, options?: ManagementRequestOptions) => Promise<ManagedRole[]>;
+    createRole: (id: string, input: RoleInput, options?: ManagementRequestOptions) => Promise<{
+        id: string;
+    }>;
+    updateRole: (id: string, roleId: string, input: RoleInput, options?: ManagementRequestOptions) => Promise<void>;
+    deleteRole: (id: string, roleId: string, options?: ManagementRequestOptions) => Promise<void>;
+    getPermissionList: (options?: ManagementRequestOptions) => Promise<ManagedPermission[]>;
+}
+/**
+ * Creates a backend client, like Clerk's `createClerkClient`. Without options it reads
+ * `PISTI_PUBLISHABLE_KEY`, `PISTI_SECRET_KEY` and `PISTI_AUTHORIZED_PARTIES`.
+ */
+export declare function createPistiClient(options?: ManagementClientOptions): PistiClient;
+//# sourceMappingURL=management.d.ts.map

package/dist/management.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"management.d.ts","sourceRoot":"","sources":["../src/management.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,YAAY,EAAE,0BAA0B,EAAE,aAAa,EAAE,YAAY,EAAE,aAAa,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAC;AAC3I,OAAO,KAAK,EACR,uBAAuB,EACvB,wBAAwB,EACxB,eAAe,EACf,qBAAqB,EACrB,cAAc,EACd,IAAI,EACJ,YAAY,EACZ,eAAe,EACf,eAAe,EACf,UAAU,EACV,wBAAwB,EACxB,OAAO,EACP,kBAAkB,EAClB,MAAM,EACN,iBAAiB,EACjB,iBAAiB,EACjB,QAAQ,EACR,mBAAmB,EACnB,uBAAuB,EACvB,uBAAuB,EACvB,yBAAyB,EACzB,iBAAiB,EACjB,gBAAgB,EAChB,WAAW,EACX,SAAS,EACT,iBAAiB,EACjB,eAAe,EACf,uBAAuB,EACvB,2BAA2B,EAC3B,2BAA2B,EAC3B,oBAAoB,EACpB,0BAA0B,EAC1B,sBAAsB,EACtB,mBAAmB,EACnB,gBAAgB,EAChB,0BAA0B,EAC1B,sBAAsB,EACtB,sBAAsB,EACzB,MAAM,uBAAuB,CAAC;AAE/B,mBAAmB,uBAAuB,CAAC;AAE3C,+EAA+E;AAC/E,qBAAa,oBAAqB,SAAQ,KAAK;IAGvC,QAAQ,CAAC,MAAM,EAAE,MAAM;IACvB,QAAQ,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI;IACjC,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI;IAC5B,QAAQ,CAAC,iBAAiB,EAAE,MAAM,GAAG,IAAI;IACzC,QAAQ,CAAC,WAAW,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;IACxD,QAAQ,CAAC,QAAQ,EAAE,SAAS,eAAe,EAAE;IAPjD,YACI,OAAO,EAAE,MAAM,EACN,MAAM,EAAE,MAAM,EACd,SAAS,GAAE,MAAM,GAAG,IAAW,EAC/B,IAAI,GAAE,MAAM,GAAG,IAAW,EAC1B,iBAAiB,GAAE,MAAM,GAAG,IAAW,EACvC,WAAW,GAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAM,EACpD,QAAQ,GAAE,SAAS,eAAe,EAAO,EAIrD;CACJ;AAyFD,KAAK,eAAe,GAAG,CAAC,CAAC,EACrB,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,MAAM,EACZ,IAAI,CAAC,EAAE,OAAO,EACd,OAAO,CAAC,EAAE,wBAAwB,KACjC,OAAO,CAAC,CAAC,CAAC,CAAC;AAEhB,6FAA6F;AAC7F,qBAAa,WAAW;;IAQpB,QAAQ,CAAC,KAAK,EAAE,eAAe,CAAC;IAChC,QAAQ,CAAC,aAAa,EAAE,uBAAuB,CAAC;IAChD,QAAQ,CAAC,QAAQ,EAAE,kBAAkB,CAAC;IACtC,QAAQ,CAAC,iBAAiB,EAAE,2BAA2B,CAAC;IACxD,QAAQ,CAAC,QAAQ,EAAE,kBAAkB,CAAC;IACtC,QAAQ,CAAC,OAAO,EAAE,iBAAiB,CAAC;IAEpC,YAAY,OAAO,GAAE,uBAA4B,EAuChD;IAED;;;OAGG;IACH,mBAAmB,CAAC,CAAC,SAAS,YAAY,GAAG,eAAe,EACxD,OAAO,EAAE,OAAO,EAChB,OAAO,GAAE,0BAA0B,GAAG;QAAE,YAAY,CAAC,EAAE,CAAC,CAAA;KAAO,GAChE,OAAO,CAAC,YAAY,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC,CAOzC;IAED,uDAAuD;IACvD,WAAW,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,GAAE,kBAAuB,GAAG,OAAO,CAAC,aAAa,CAAC,CAMnF;IAED,iDAAiD;IACjD,WAAW,CAAC,OAAO,GAAE,wBAA6B,GAAG,OAAO,CAAC,eAAe,CAAC,CAE5E;CAsIJ;AAED,qBAAa,eAAe;IACZ,OAAO,CAAC,QAAQ,CAAC,OAAO;IAApC,YAA6B,OAAO,EAAE,eAAe,EAAI;IACzD,WAAW,aACE,qBAAqB,GAAG;QAAE,MAAM,CAAC,EAAE,UAAU,CAAA;KAAE,KACzD,OAAO,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC,CAC2C;IACpE,cAAc,CACjB,OAAO,GAAE,IAAI,CAAC,qBAAqB,EAAE,QAAQ,CAAC,GAAG;QAC7C,MAAM,CAAC,EAAE,UAAU,CAAC;KAClB,GACP,cAAc,CAAC,IAAI,CAAC,CAkBtB;IACD,0DAA0D;IAC1D,QAAQ,aACK,IAAI,CAAC,qBAAqB,EAAE,QAAQ,GAAG,OAAO,CAAC,GAAG;QAAE,MAAM,CAAC,EAAE,UAAU,CAAA;KAAE,KACnF,OAAO,CAAC,MAAM,CAAC,CAQD;IACjB,OAAO,OACC,MAAM,YACA,wBAAwB,KACnC,OAAO,CAAC,IAAI,CAAC,CACoD;IACpE,UAAU,UACC,eAAe,YACZ,wBAAwB,KACnC,OAAO,CAAC,IAAI,CAAC,CACmC;IACnD,UAAU,OACF,MAAM,SACH,eAAe,YACZ,wBAAwB,KACnC,OAAO,CAAC,IAAI,CAAC,CACgD;IAChE,OAAO,CAAC,SAAS,CAK2D;IAC5E,kDAAkD;IAClD,OAAO,OAAQ,MAAM,YAAY,wBAAwB,KAAG,OAAO,CAAC,IAAI,CAAC,CAC7B;IAC5C,SAAS,OAAQ,MAAM,YAAY,wBAAwB,KAAG,OAAO,CAAC,IAAI,CAAC,CACjC;IAC1C,QAAQ,OAAQ,MAAM,YAAY,wBAAwB,KAAG,OAAO,CAAC,IAAI,CAAC,CAChC;IAC1C,UAAU,OAAQ,MAAM,YAAY,wBAAwB,KAAG,OAAO,CAAC,IAAI,CAAC,CAClC;IAC1C,UAAU,OAAQ,MAAM,YAAY,wBAAwB,KAAG,OAAO,CAAC,IAAI,CAAC,CACL;IACvE,uBAAuB,OACf,MAAM,YACA,wBAAwB,KACnC,OAAO,CAAC,YAAY,EAAE,CAAC,CAMpB;IACN,eAAe,OACP,MAAM,SACH;QACH,KAAK,EAAE,MAAM,CAAC;QACd,MAAM,EAAE,UAAU,GAAG,YAAY,CAAC;QAClC,SAAS,CAAC,EAAE,OAAO,CAAC;QACpB,kBAAkB,CAAC,EAAE,MAAM,CAAC;KAC/B,YACS,wBAAwB,KACnC,OAAO,CAAC;QAAE,EAAE,EAAE,MAAM,CAAA;KAAE,CAAC,CAMpB;IACN,oBAAoB,OACZ,MAAM,WACD,MAAM,UACP,UAAU,GAAG,YAAY,YACvB,wBAAwB,GAAG;QAAE,kBAAkB,CAAC,EAAE,MAAM,CAAA;KAAE,KACrE,OAAO,CAAC,IAAI,CAAC,CAWV;IACN,eAAe,OACP,MAAM,WACD,MAAM,YACL,wBAAwB,KACnC,OAAO,CAAC,IAAI,CAAC,CAMV;IACN,kBAAkB,OACV,MAAM,WACD,MAAM,YACL,wBAAwB,KACnC,OAAO,CAAC,IAAI,CAAC,CAMV;IACN,0BAA0B,OAClB,MAAM,YACA,wBAAwB,KACnC,OAAO,CAAC,wBAAwB,EAAE,CAAC,CAMhC;CACT;AAED,qBAAa,2BAA2B;IACxB,OAAO,CAAC,QAAQ,CAAC,OAAO;IAApC,YAA6B,OAAO,EAAE,eAAe,EAAI;IAEzD,IAAI,aACU,wBAAwB,KACnC,OAAO,CAAC,uBAAuB,EAAE,CAAC,CAC8B;IAEnE,MAAM,UACK,2BAA2B,YACxB,wBAAwB,KACnC,OAAO,CAAC,uBAAuB,CAAC,CAC6B;IAEhE,MAAM,OACE,MAAM,SACH,2BAA2B,YACxB,wBAAwB,KACnC,OAAO,CAAC,uBAAuB,CAAC,CAM7B;IAEN,MAAM,OAAQ,MAAM,YAAY,wBAAwB,KAAG,OAAO,CAAC,IAAI,CAAC,CAMlE;CACT;AAED,qBAAa,kBAAkB;IACf,OAAO,CAAC,QAAQ,CAAC,OAAO;IAApC,YAA6B,OAAO,EAAE,eAAe,EAAI;IACzD,OAAO,aACO,wBAAwB,KACnC,OAAO,CAAC,gBAAgB,EAAE,CAAC,CACmC;IACjE,SAAS,aACK,wBAAwB,KACnC,OAAO,CAAC,sBAAsB,EAAE,CAAC,CAC+B;IACnE,cAAc,UACH,oBAAoB,YACjB,wBAAwB,KACnC,OAAO,CAAC,mBAAmB,CAAC,CACiC;IAChE,cAAc,OACN,MAAM,SACH,0BAA0B,YACvB,wBAAwB,KACnC,OAAO,CAAC,sBAAsB,CAAC,CAM5B;IACN,eAAe,OACP,MAAM,qBACS,MAAM,YACf,wBAAwB,KACnC,OAAO,CAAC,IAAI,CAAC,CAMV;IACN,YAAY,OACJ,MAAM,qBACS,MAAM,YACf,wBAAwB,KACnC,OAAO,CAAC,mBAAmB,CAAC,CAMzB;IACN,QAAQ,OACA,MAAM,YACA,wBAAwB,KACnC,OAAO,CAAC;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC,CAMrC;IACN,UAAU,aACG,0BAA0B,KACpC,OAAO,CAAC,cAAc,CAAC,sBAAsB,CAAC,CAAC,CAoBhD;IACF,QAAQ,OACA,MAAM,YACA,wBAAwB,KACnC,OAAO,CAAC,sBAAsB,CAAC,CAM5B;IACN,MAAM,OAAQ,MAAM,YAAY,wBAAwB,KAAG,OAAO,CAAC,IAAI,CAAC,CAMlE;CACT;AAED,qBAAa,iBAAiB;IACd,OAAO,CAAC,QAAQ,CAAC,OAAO;IAApC,YAA6B,OAAO,EAAE,eAAe,EAAI;IACzD,aAAa,aAAa,iBAAiB,KAAQ,OAAO,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC,CAWhF;IACF,SAAS,OAAQ,MAAM,YAAY,wBAAwB,KAAG,OAAO,CAAC,MAAM,CAAC,CACH;IAC1E,8GAA8G;IAC9G,YAAY,OAAQ,MAAM,SAAS,iBAAiB,YAAY,wBAAwB,KAAG,OAAO,CAAC,MAAM,CAAC,CACa;IACvH,YAAY,OAAQ,MAAM,YAAW,wBAAwB,GAAG;QAAE,gBAAgB,CAAC,EAAE,MAAM,CAAA;KAAE,KAAQ,OAAO,CAAC,IAAI,CAAC,CAM5G;IACN,mHAAmH;IACnH,YAAY,WAAY,MAAM,YAAY,wBAAwB,KAAG,OAAO,CAAC,MAAM,CAAC,CAClB;CACrE;AAED,qBAAa,kBAAkB;IACf,OAAO,CAAC,QAAQ,CAAC,OAAO;IAApC,YAA6B,OAAO,EAAE,eAAe,EAAI;IACzD,kFAAkF;IAClF,cAAc,aAAa,kBAAkB,KAAQ,OAAO,CAAC,cAAc,CAAC,OAAO,CAAC,CAAC,CAWnF;IACF,UAAU,OAAQ,MAAM,YAAY,wBAAwB,KAAG,OAAO,CAAC,OAAO,CAAC,CACL;IAC1E,aAAa,OAAQ,MAAM,YAAY,wBAAwB,KAAG,OAAO,CAAC,IAAI,CAAC,CAMzE;CACT;AAED,qBAAa,uBAAuB;IACpB,OAAO,CAAC,QAAQ,CAAC,OAAO;IAApC,YAA6B,OAAO,EAAE,eAAe,EAAI;IACzD,mBAAmB,aACN,qBAAqB,KAC/B,OAAO,CAAC,cAAc,CAAC,mBAAmB,CAAC,CAAC,CAMzC;IACN,eAAe,OACP,MAAM,YACA,wBAAwB,KACnC,OAAO,CAAC;QACP,YAAY,EAAE,mBAAmB,CAAC;QAClC,eAAe,EAAE,QAAQ,CAAC;KAC7B,CAAC,CAMI;IACN,kBAAkB,UACP,uBAAuB,YACpB,wBAAwB,KACnC,OAAO,CAAC;QAAE,EAAE,EAAE,MAAM,CAAA;KAAE,CAAC,CACiC;IAC3D,kBAAkB,OACV,MAAM,SACH,uBAAuB,YACpB,wBAAwB,KACnC,OAAO,CAAC,IAAI,CAAC,CAC2D;IAC3E,kBAAkB,OAAQ,MAAM,YAAY,wBAAwB,KAAG,OAAO,CAAC,IAAI,CAAC,CAM9E;IACN,6BAA6B,OACrB,MAAM,YACD,qBAAqB,KAC/B,OAAO,CAAC,cAAc,CAAC,yBAAyB,CAAC,CAAC,CAM/C;IACN,4BAA4B,OACpB,MAAM,YACA,MAAM,UACR,MAAM,YACJ,wBAAwB,KACnC,OAAO,CAAC,IAAI,CAAC,CAMV;IACN,4BAA4B,OACpB,MAAM,YACA,MAAM,YACN,wBAAwB,KACnC,OAAO,CAAC,IAAI,CAAC,CAMV;IACN,6BAA6B,OACrB,MAAM,YACD,qBAAqB,KAC/B,OAAO,CAAC,cAAc,CAAC,iBAAiB,CAAC,CAAC,CAMvC;IACN,4BAA4B,OACpB,MAAM,SACH;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,YAAY,CAAC,EAAE,MAAM,CAAA;KAAE,YACrD,wBAAwB,KACnC,OAAO,CAAC,gBAAgB,CAAC,CAMtB;IACN,6BAA6B,OACrB,MAAM,gBACI,MAAM,SACb;QAAE,iBAAiB,EAAE,MAAM,CAAC;QAAC,YAAY,CAAC,EAAE,MAAM,CAAA;KAAE,YACjD,wBAAwB,KACnC,OAAO,CAAC,gBAAgB,CAAC,CAMtB;IACN,4BAA4B,OACpB,MAAM,gBACI,MAAM,YACV,wBAAwB,KACnC,OAAO,CAAC,IAAI,CAAC,CAMV;IACN,WAAW,OACH,MAAM,YACA,wBAAwB,KACnC,OAAO,CAAC,WAAW,EAAE,CAAC,CAMnB;IACN,UAAU,OACF,MAAM,SACH,SAAS,YACN,wBAAwB,KACnC,OAAO,CAAC;QAAE,EAAE,EAAE,MAAM,CAAA;KAAE,CAAC,CAMpB;IACN,UAAU,OACF,MAAM,UACF,MAAM,SACP,SAAS,YACN,wBAAwB,KACnC,OAAO,CAAC,IAAI,CAAC,CAMV;IACN,UAAU,OACF,MAAM,UACF,MAAM,YACJ,wBAAwB,KACnC,OAAO,CAAC,IAAI,CAAC,CAMV;IACN,iBAAiB,aACH,wBAAwB,KACnC,OAAO,CAAC,iBAAiB,EAAE,CAAC,CAC6B;CAC/D;AAED;;;GAGG;AACH,wBAAgB,iBAAiB,CAAC,OAAO,CAAC,EAAE,uBAAuB,GAAG,WAAW,CAEhF"}

package/dist/management.js

@@ -0,0 +1,432 @@
+import { parsePublishableKey } from "./keys.js";
+import { authenticateRequest, verifyToken } from "./tokens.js";
+/** Structured service failure. No credentials or raw requests are retained. */
+export class PistiManagementError extends Error {
+    status;
+    requestId;
+    code;
+    retryAfterSeconds;
+    fieldErrors;
+    blockers;
+    constructor(message, status, requestId = null, code = null, retryAfterSeconds = null, fieldErrors = {}, blockers = []) {
+        super(message);
+        this.status = status;
+        this.requestId = requestId;
+        this.code = code;
+        this.retryAfterSeconds = retryAfterSeconds;
+        this.fieldErrors = fieldErrors;
+        this.blockers = blockers;
+        this.name = "PistiManagementError";
+    }
+}
+function integerId(value) {
+    if (!/^[1-9]\d{0,9}$/.test(value) || Number(value) > 2_147_483_647)
+        throw new Error("Provide a positive resource ID.");
+    return value;
+}
+function sessionId(value) {
+    if (!/^[1-9]\d{0,18}$/.test(value) ||
+        BigInt(value) > 9223372036854775807n)
+        throw new Error("Provide a valid session ID.");
+    return value;
+}
+function userId(value) {
+    if (!/^[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}$/i.test(value))
+        throw new Error("Provide a valid user ID.");
+    return value;
+}
+function listQuery(options = {}) {
+    const query = new URLSearchParams({ paged: "true" });
+    if (options.limit !== undefined) {
+        if (!Number.isInteger(options.limit) ||
+            options.limit < 1 ||
+            options.limit > 100)
+            throw new Error("Use a page limit between 1 and 100.");
+        query.set("limit", String(options.limit));
+    }
+    if (options.cursor !== undefined) {
+        if (options.cursor.length > 128)
+            throw new Error("The pagination cursor is too long.");
+        query.set("cursor", options.cursor);
+    }
+    if (options.search !== undefined) {
+        if (options.search.length > 200)
+            throw new Error("Search must be at most 200 characters.");
+        query.set("search", options.search);
+    }
+    if (options.status !== undefined)
+        query.set("status", options.status);
+    return "?" + query;
+}
+async function readJson(response) {
+    const reader = response.body?.getReader();
+    if (!reader)
+        return null;
+    const chunks = [];
+    let length = 0;
+    try {
+        while (true) {
+            const part = await reader.read();
+            if (part.done)
+                break;
+            length += part.value.byteLength;
+            if (length > 1_048_576) {
+                await reader.cancel();
+                throw new PistiManagementError("The service response is too large.", 502);
+            }
+            chunks.push(part.value);
+        }
+    }
+    finally {
+        reader.releaseLock();
+    }
+    try {
+        return JSON.parse(Buffer.concat(chunks).toString("utf8"));
+    }
+    catch {
+        return null;
+    }
+}
+function object(value) {
+    return value !== null && typeof value === "object" && !Array.isArray(value)
+        ? value
+        : null;
+}
+/** Server-side client for one environment: request authentication and the management API. */
+export class PistiClient {
+    #issuer;
+    #secretKey;
+    #publishableKey;
+    #authorizedParties;
+    #basePath;
+    #timeoutMs;
+    users;
+    organizations;
+    sessions;
+    externalProviders;
+    webhooks;
+    apiKeys;
+    constructor(options = {}) {
+        if (typeof window !== "undefined" && typeof document !== "undefined")
+            throw new Error("The Pisti backend client belongs only in your server environment.");
+        const secretKey = options.secretKey ?? process.env.PISTI_SECRET_KEY;
+        const publishableKey = options.publishableKey ?? process.env.PISTI_PUBLISHABLE_KEY;
+        if (!publishableKey)
+            throw new Error("Missing Pisti publishable key. Set PISTI_PUBLISHABLE_KEY (copy it from your application's Home page in the Pisti console) or pass { publishableKey }.");
+        const key = parsePublishableKey(publishableKey);
+        if (secretKey !== undefined) {
+            if (!/^sk_(?:test|live)_[a-f0-9]{16}\.[a-f0-9]{64}$/.test(secretKey))
+                throw new Error("PISTI_SECRET_KEY doesn’t look like a Pisti secret key (sk_test_… or sk_live_…).");
+            if ((key.environment === "live") !== secretKey.startsWith("sk_live_"))
+                throw new Error("The secret key and publishable key belong to different environments.");
+            if (key.issuer.protocol === "http:" && secretKey.startsWith("sk_live_"))
+                throw new Error("Production credentials require HTTPS.");
+        }
+        this.#issuer = key.issuer;
+        this.#secretKey = secretKey;
+        this.#publishableKey = publishableKey;
+        this.#authorizedParties = options.authorizedParties;
+        this.#timeoutMs = options.timeoutMs ?? 10_000;
+        if (!Number.isInteger(this.#timeoutMs) ||
+            this.#timeoutMs < 1000 ||
+            this.#timeoutMs > 60_000)
+            throw new Error("Use a timeout between 1000 and 60000 milliseconds.");
+        const request = async (method, path, body, requestOptions) => this.#request(method, (await this.#instancePath()) + path, body, requestOptions);
+        this.users = new ManagementUsers(request);
+        this.organizations = new ManagementOrganizations(request);
+        this.sessions = new ManagementSessions(request);
+        this.externalProviders = new ManagementExternalProviders(request);
+        this.webhooks = new ManagementWebhooks(request);
+        this.apiKeys = new ManagementApiKeys(request);
+    }
+    /**
+     * Authenticates a Fetch API `Request` using this client's publishable key. Never throws for a
+     * missing or bad token; check `isAuthenticated` and call `toAuth()`.
+     */
+    authenticateRequest(request, options = {}) {
+        return authenticateRequest(request, {
+            publishableKey: this.#publishableKey,
+            ...(this.#secretKey ? { secretKey: this.#secretKey } : {}),
+            ...(this.#authorizedParties ? { authorizedParties: this.#authorizedParties } : {}),
+            ...options,
+        });
+    }
+    /** Verifies a session token and returns its claims. */
+    verifyToken(token, options = {}) {
+        return verifyToken(token, {
+            publishableKey: this.#publishableKey,
+            ...(this.#authorizedParties ? { authorizedParties: this.#authorizedParties } : {}),
+            ...options,
+        });
+    }
+    /** The environment the secret key belongs to. */
+    getInstance(options = {}) {
+        return this.#request("GET", "/v1/instance", undefined, options);
+    }
+    #requireSecretKey() {
+        if (!this.#secretKey)
+            throw new Error("Missing Pisti secret key. Create one under API keys in the Pisti console and set PISTI_SECRET_KEY, or pass { secretKey }.");
+        return this.#secretKey;
+    }
+    // The secret key identifies its environment; resolve the management path from it once.
+    #instancePath() {
+        return (this.#basePath ??= this.getInstance()
+            .then((instance) => `/v1/management/instances/${integerId(instance.id)}`)
+            .catch((error) => {
+            this.#basePath = undefined;
+            throw error;
+        }));
+    }
+    async #request(method, path, body, options = {}) {
+        const serialized = body === undefined ? undefined : JSON.stringify(body);
+        if (serialized && Buffer.byteLength(serialized) > 65_536)
+            throw new Error("The management request exceeds 64 KiB.");
+        let response;
+        let payload;
+        const timeout = AbortSignal.timeout(this.#timeoutMs);
+        try {
+            response = await fetch(new URL(path.slice(1), this.#issuer), {
+                method,
+                headers: {
+                    Authorization: "Bearer " + this.#requireSecretKey(),
+                    Accept: "application/json",
+                    ...(serialized === undefined
+                        ? {}
+                        : { "Content-Type": "application/json" }),
+                },
+                ...(serialized === undefined ? {} : { body: serialized }),
+                signal: options.signal
+                    ? AbortSignal.any([timeout, options.signal])
+                    : timeout,
+                redirect: "error",
+            });
+            if (response.status === 204)
+                return undefined;
+            payload = await readJson(response);
+        }
+        catch (error) {
+            if (error instanceof PistiManagementError)
+                throw error;
+            throw new PistiManagementError(options.signal?.aborted
+                ? "The management request was canceled."
+                : "The management service could not be reached. Try again shortly.", 0, null, options.signal?.aborted
+                ? "request_cancelled"
+                : timeout.aborted
+                    ? "request_timeout"
+                    : "service_unavailable");
+        }
+        const value = object(payload);
+        const meta = object(value?.meta);
+        const requestId = typeof value?.requestId === "string"
+            ? value.requestId
+            : typeof meta?.requestId === "string"
+                ? meta.requestId
+                : response.headers.get("X-Request-ID");
+        if (!response.ok) {
+            const fields = Object.create(null);
+            for (const [name, messages] of Object.entries(object(value?.errors) ?? {}))
+                if (Array.isArray(messages))
+                    fields[name] = messages.filter((message) => typeof message === "string");
+            const blockers = Array.isArray(value?.blockers)
+                ? value.blockers.flatMap((item) => {
+                    const blocker = object(item);
+                    return blocker &&
+                        typeof blocker.resource === "string" &&
+                        typeof blocker.count === "number" &&
+                        typeof blocker.resolution === "string"
+                        ? [
+                            {
+                                resource: blocker.resource,
+                                count: blocker.count,
+                                resolution: blocker.resolution,
+                            },
+                        ]
+                        : [];
+                })
+                : [];
+            const retry = response.headers.get("Retry-After");
+            const retrySeconds = retry && /^\d{1,10}$/.test(retry) ? Number(retry) : null;
+            throw new PistiManagementError(typeof value?.detail === "string"
+                ? value.detail
+                : typeof value?.title === "string"
+                    ? value.title
+                    : "The management request failed.", response.status, requestId, typeof value?.code === "string" ? value.code : null, retrySeconds, fields, blockers);
+        }
+        if (!value ||
+            !("data" in value) ||
+            !meta ||
+            typeof meta.requestId !== "string")
+            throw new PistiManagementError("The management service returned an invalid response.", 502, requestId);
+        return value.data;
+    }
+}
+export class ManagementUsers {
+    request;
+    constructor(request) {
+        this.request = request;
+    }
+    getUserList = (options = {}) => this.request("GET", "/users" + listQuery(options), undefined, options);
+    async *getUserListAll(options = {}) {
+        let cursor;
+        const seen = new Set();
+        do {
+            const page = await this.getUserList({
+                ...options,
+                ...(cursor ? { cursor } : {}),
+            });
+            for (const user of page.items)
+                yield user;
+            if (!page.hasMore)
+                return;
+            if (!page.nextCursor || seen.has(page.nextCursor))
+                throw new PistiManagementError("The service returned an invalid pagination cursor.", 502);
+            cursor = page.nextCursor;
+            seen.add(cursor);
+        } while (true);
+    }
+    /** The number of users matching `search` and `status`. */
+    getCount = async (options = {}) => (await this.request("GET", "/users/count" + listQuery(options), undefined, options)).totalCount;
+    getUser = (id, options) => this.request("GET", `/users/${userId(id)}`, undefined, options);
+    createUser = (input, options) => this.request("POST", "/users", input, options);
+    updateUser = (id, input, options) => this.request("PUT", `/users/${userId(id)}`, input, options);
+    setStatus = (id, status, options) => this.request("PUT", `/users/${userId(id)}/status`, { status }, options);
+    /** Disables the account and ends its sessions. */
+    banUser = (id, options) => this.setStatus(id, "disabled", options);
+    unbanUser = (id, options) => this.setStatus(id, "active", options);
+    lockUser = (id, options) => this.setStatus(id, "locked", options);
+    unlockUser = (id, options) => this.setStatus(id, "active", options);
+    deleteUser = (id, options) => this.request("DELETE", `/users/${userId(id)}`, undefined, options);
+    getUserEmailAddressList = (id, options) => this.request("GET", `/users/${userId(id)}/email-addresses`, undefined, options);
+    addEmailAddress = (id, input, options) => this.request("POST", `/users/${userId(id)}/email-addresses`, input, options);
+    setEmailVerification = (id, emailId, status, options) => this.request("PUT", `/users/${userId(id)}/email-addresses/${integerId(emailId)}`, {
+        status,
+        ...(options?.verificationReason
+            ? { verificationReason: options.verificationReason }
+            : {}),
+    }, options);
+    setPrimaryEmail = (id, emailId, options) => this.request("PUT", `/users/${userId(id)}/email-addresses/${integerId(emailId)}/primary`, undefined, options);
+    removeEmailAddress = (id, emailId, options) => this.request("DELETE", `/users/${userId(id)}/email-addresses/${integerId(emailId)}`, undefined, options);
+    getUserExternalAccountList = (id, options) => this.request("GET", `/users/${userId(id)}/external-accounts`, undefined, options);
+}
+export class ManagementExternalProviders {
+    request;
+    constructor(request) {
+        this.request = request;
+    }
+    list = (options) => this.request("GET", "/external-providers", undefined, options);
+    create = (input, options) => this.request("POST", "/external-providers", input, options);
+    update = (id, input, options) => this.request("PUT", `/external-providers/${integerId(id)}`, input, options);
+    delete = (id, options) => this.request("DELETE", `/external-providers/${integerId(id)}`, undefined, options);
+}
+export class ManagementWebhooks {
+    request;
+    constructor(request) {
+        this.request = request;
+    }
+    catalog = (options) => this.request("GET", "/webhooks/catalog", undefined, options);
+    endpoints = (options) => this.request("GET", "/webhooks/endpoints", undefined, options);
+    createEndpoint = (input, options) => this.request("POST", "/webhooks/endpoints", input, options);
+    updateEndpoint = (id, input, options) => this.request("PUT", `/webhooks/endpoints/${integerId(id)}`, input, options);
+    archiveEndpoint = (id, expectedUpdatedAt, options) => this.request("POST", `/webhooks/endpoints/${integerId(id)}/archive`, { expectedUpdatedAt }, options);
+    rotateSecret = (id, expectedUpdatedAt, options) => this.request("POST", `/webhooks/endpoints/${integerId(id)}/rotate-secret`, { expectedUpdatedAt }, options);
+    sendTest = (id, options) => this.request("POST", `/webhooks/endpoints/${integerId(id)}/test`, undefined, options);
+    deliveries = (options = {}) => {
+        const query = new URLSearchParams(listQuery({
+            ...(options.limit === undefined
+                ? {}
+                : { limit: options.limit }),
+            ...(options.cursor === undefined
+                ? {}
+                : { cursor: options.cursor }),
+        }).slice(1));
+        if (options.endpointId !== undefined)
+            query.set("endpointId", integerId(options.endpointId));
+        if (options.status !== undefined)
+            query.set("status", options.status);
+        return this.request("GET", "/webhooks/deliveries?" + query, undefined, options);
+    };
+    delivery = (id, options) => this.request("GET", `/webhooks/deliveries/${sessionId(id)}`, undefined, options);
+    replay = (id, options) => this.request("POST", `/webhooks/deliveries/${sessionId(id)}/replay`, undefined, options);
+}
+export class ManagementApiKeys {
+    request;
+    constructor(request) {
+        this.request = request;
+    }
+    getApiKeyList = (options = {}) => {
+        const query = new URLSearchParams();
+        if (options.userId !== undefined)
+            query.set("userId", userId(options.userId));
+        if (options.includeRevoked)
+            query.set("includeRevoked", "true");
+        if (options.limit !== undefined) {
+            if (!Number.isInteger(options.limit) || options.limit < 1 || options.limit > 100)
+                throw new Error("Use a page limit between 1 and 100.");
+            query.set("limit", String(options.limit));
+        }
+        if (options.cursor !== undefined)
+            query.set("cursor", options.cursor);
+        return this.request("GET", "/api-keys" + (query.size ? "?" + query : ""), undefined, options);
+    };
+    getApiKey = (id, options) => this.request("GET", `/api-keys/${sessionId(id)}`, undefined, options);
+    /** Sets what a key may do in your API. Only your backend grants scopes and claims; the key's owner cannot. */
+    updateApiKey = (id, input, options) => this.request("PUT", `/api-keys/${sessionId(id)}`, { scopes: input.scopes, claims: input.claims ?? null }, options);
+    revokeApiKey = (id, options = {}) => this.request("POST", `/api-keys/${sessionId(id)}/revoke`, { revocationReason: options.revocationReason ?? null }, options);
+    /** Verifies a presented `ak_` secret. Throws `PistiManagementError` (401) for unknown, expired or revoked keys. */
+    verifySecret = (secret, options) => this.request("POST", "/api-keys/verify", { secret }, options);
+}
+export class ManagementSessions {
+    request;
+    constructor(request) {
+        this.request = request;
+    }
+    /** Sessions in the environment, newest first. Filter by `userId` and `status`. */
+    getSessionList = (options = {}) => {
+        const query = new URLSearchParams();
+        if (options.userId !== undefined)
+            query.set("userId", userId(options.userId));
+        if (options.status !== undefined)
+            query.set("status", options.status);
+        if (options.limit !== undefined) {
+            if (!Number.isInteger(options.limit) || options.limit < 1 || options.limit > 100)
+                throw new Error("Use a page limit between 1 and 100.");
+            query.set("limit", String(options.limit));
+        }
+        if (options.cursor !== undefined)
+            query.set("cursor", options.cursor);
+        return this.request("GET", "/sessions" + (query.size ? "?" + query : ""), undefined, options);
+    };
+    getSession = (id, options) => this.request("GET", `/sessions/${sessionId(id)}`, undefined, options);
+    revokeSession = (id, options) => this.request("DELETE", `/sessions/${sessionId(id)}`, undefined, options);
+}
+export class ManagementOrganizations {
+    request;
+    constructor(request) {
+        this.request = request;
+    }
+    getOrganizationList = (options = {}) => this.request("GET", "/organizations" + listQuery(options), undefined, options);
+    getOrganization = (id, options) => this.request("GET", `/organizations/${integerId(id)}`, undefined, options);
+    createOrganization = (input, options) => this.request("POST", "/organizations", input, options);
+    updateOrganization = (id, input, options) => this.request("PUT", `/organizations/${integerId(id)}`, input, options);
+    deleteOrganization = (id, options) => this.request("DELETE", `/organizations/${integerId(id)}`, undefined, options);
+    getOrganizationMembershipList = (id, options = {}) => this.request("GET", `/organizations/${integerId(id)}/memberships` + listQuery(options), undefined, options);
+    updateOrganizationMembership = (id, memberId, roleId, options) => this.request("PUT", `/organizations/${integerId(id)}/memberships/${userId(memberId)}`, { roleId: Number(integerId(roleId)) }, options);
+    deleteOrganizationMembership = (id, memberId, options) => this.request("DELETE", `/organizations/${integerId(id)}/memberships/${userId(memberId)}`, undefined, options);
+    getOrganizationInvitationList = (id, options = {}) => this.request("GET", `/organizations/${integerId(id)}/invitations` + listQuery(options), undefined, options);
+    createOrganizationInvitation = (id, input, options) => this.request("POST", `/organizations/${integerId(id)}/invitations`, { ...input, roleId: Number(integerId(input.roleId)) }, options);
+    reissueOrganizationInvitation = (id, invitationId, input, options) => this.request("POST", `/organizations/${integerId(id)}/invitations/${integerId(invitationId)}/reissue`, input, options);
+    revokeOrganizationInvitation = (id, invitationId, options) => this.request("DELETE", `/organizations/${integerId(id)}/invitations/${integerId(invitationId)}`, undefined, options);
+    getRoleList = (id, options) => this.request("GET", `/organizations/${integerId(id)}/roles`, undefined, options);
+    createRole = (id, input, options) => this.request("POST", `/organizations/${integerId(id)}/roles`, input, options);
+    updateRole = (id, roleId, input, options) => this.request("PUT", `/organizations/${integerId(id)}/roles/${integerId(roleId)}`, input, options);
+    deleteRole = (id, roleId, options) => this.request("DELETE", `/organizations/${integerId(id)}/roles/${integerId(roleId)}`, undefined, options);
+    getPermissionList = (options) => this.request("GET", "/permissions", undefined, options);
+}
+/**
+ * Creates a backend client, like Clerk's `createClerkClient`. Without options it reads
+ * `PISTI_PUBLISHABLE_KEY`, `PISTI_SECRET_KEY` and `PISTI_AUTHORIZED_PARTIES`.
+ */
+export function createPistiClient(options) {
+    return new PistiClient(options);
+}
+//# sourceMappingURL=management.js.map