@roxyon/api-client 0.3.0 → 0.5.0

package/dist/index.cjs

@@ -23,13 +23,20 @@ __export(index_exports, {
   AccountApi: () => AccountApi,
   ApplicationsApi: () => ApplicationsApi,
   AuthApi: () => AuthApi,
+  BAAS_MAX_BATCH: () => BAAS_MAX_BATCH,
+  BAAS_MAX_PAGE: () => BAAS_MAX_PAGE,
+  BILLING_CYCLES: () => BILLING_CYCLES,
+  BaasDataApi: () => BaasDataApi,
+  BillingApi: () => BillingApi,
   DEFAULT_APP: () => DEFAULT_APP,
   DEFAULT_BAAS_URL: () => DEFAULT_BAAS_URL,
+  DEFAULT_BAAS_V2_URL: () => DEFAULT_BAAS_V2_URL,
   DEFAULT_CONSOLE_URL: () => DEFAULT_CONSOLE_URL,
   DatabasesApi: () => DatabasesApi,
   DomainsApi: () => DomainsApi,
   EmailApi: () => EmailApi,
   LUMEN_BUILD: () => LUMEN_BUILD,
+  PAYABLE_STATUSES: () => PAYABLE_STATUSES,
   RUNTIMES: () => RUNTIMES,
   Roxyon: () => Roxyon,
   RoxyonApiError: () => RoxyonApiError,
@@ -42,6 +49,7 @@ __export(index_exports, {
   envFromStored: () => envFromStored,
   formatEnv: () => formatEnv,
   isAuthError: () => isAuthError,
+  isPayable: () => isPayable,
   parseEnv: () => parseEnv,
   rxError: () => rxError,
   toQueryString: () => toQueryString
@@ -450,6 +458,156 @@ var AuthApi = class {
   }
 };
 
+// src/billing.ts
+var BILLING_CYCLES = ["monthly", "quarterly", "yearly", "biennial"];
+var RESELLER_RESOLD_SERVICE_ID = "bjMqdLqAKl";
+var PAYABLE_STATUSES = ["pending", "overdue", "failed"];
+function isPayable(status) {
+  return PAYABLE_STATUSES.includes(status.toLowerCase());
+}
+function json(v, fallback) {
+  if (v && typeof v === "object") return v;
+  if (typeof v !== "string" || v === "") return fallback;
+  try {
+    return JSON.parse(v);
+  } catch {
+    return fallback;
+  }
+}
+function numbers(v) {
+  const out = {};
+  const src = json(v, {});
+  for (const c of BILLING_CYCLES) {
+    const n = Number(src[c]);
+    if (src[c] !== void 0 && src[c] !== "" && Number.isFinite(n)) out[c] = n;
+  }
+  return out;
+}
+var BillingApi = class {
+  constructor(client, pub = client.publicClient()) {
+    this.client = client;
+    this.pub = pub;
+  }
+  client;
+  pub;
+  async catalog() {
+    const r = await this.pub.get("/Plans", {
+      fields: "*",
+      limit: -1,
+      order: "objectId",
+      where: { Status: "active", Service: { nin: RESELLER_RESOLD_SERVICE_ID } },
+      include: [
+        { className: "Services", field: "Service", fields: "Type" },
+        {
+          className: "Pricing",
+          field: "Plan",
+          fields: "Prices,SetupFee,MetaData,IsActive",
+          reverse: 1
+        }
+      ]
+    });
+    if (!Array.isArray(r.results)) {
+      throw new RoxyonApiError(r.error || "Could not load the catalog.", { body: r });
+    }
+    const out = [];
+    for (const p of r.results) {
+      const pricing = p._Pricing?.results?.[0];
+      if (!p.Code || !pricing || Number(pricing.IsActive) === 0) continue;
+      const limits = json(p.Limits, {});
+      const features = json(p.Features, {});
+      const meta = json(pricing.MetaData, {});
+      const network = json(features.Network, {});
+      const setup = numbers(pricing.SetupFee);
+      const pricesUSD = numbers(pricing.Prices);
+      if (pricesUSD.monthly === void 0) continue;
+      const product = {
+        planId: p.objectId,
+        sku: p.Code ?? "",
+        name: p.Name ?? "",
+        category: p._Service?.results?.[0]?.Type ?? "",
+        pricesUSD,
+        stock: String(meta.stock ?? "in").toLowerCase() === "out" ? "out" : "in"
+      };
+      if (limits.vcpu != null) {
+        product.vcpu = Number(limits.vcpu);
+        product.ramGb = limits.memory_mb ? Math.round(Number(limits.memory_mb) / 1024) : 0;
+        product.diskGb = Number(limits.disk_gb ?? 0);
+        product.cpuType = String(limits.cpu_type ?? "");
+      }
+      if (network["Dedicated IPv4"] != null)
+        product.ipv4Included = Number(network["Dedicated IPv4"]);
+      if (Object.values(setup).some((n) => n > 0)) product.setupFeeUSD = setup;
+      if (Object.keys(features).length) product.features = features;
+      out.push(product);
+    }
+    return out;
+  }
+  /** What checkout would charge for a new subscription: the server's own pricing (GET /_payment/quote). */
+  async quote(input) {
+    if (!/^[A-Za-z0-9]{1,40}$/.test(input.planId))
+      throw new Error(`Invalid planId "${input.planId}".`);
+    if (!BILLING_CYCLES.includes(input.cycle))
+      throw new Error(`Unsupported cycle "${input.cycle}".`);
+    const q = {
+      type: "subscription.new",
+      planId: input.planId,
+      cycle: input.cycle,
+      setup: 1
+    };
+    if (input.currency) q.currency = input.currency.toUpperCase();
+    if (input.country) q.country = input.country.toUpperCase();
+    const r = await this.pub.get("/_payment/quote", q);
+    if (!r?.ok) throw new RoxyonApiError(r?.error || "Could not price this plan.", { body: r });
+    return {
+      planId: String(r.planId ?? input.planId),
+      cycle: String(r.cycle ?? input.cycle),
+      currency: String(r.currency ?? ""),
+      lineItems: (r.lineItems ?? []).map((l) => ({
+        label: l.label,
+        amount: l.amount,
+        amountUSD: l.amountUSD
+      })),
+      subtotal: String(r.subtotal ?? ""),
+      taxRate: String(r.taxRate ?? ""),
+      taxLabel: String(r.taxLabel ?? ""),
+      taxAmount: String(r.taxAmount ?? ""),
+      discountAmount: String(r.discountAmount ?? ""),
+      total: String(r.total ?? ""),
+      fxRate: String(r.fxRate ?? ""),
+      baseAmountUSD: String(r.baseAmount ?? "")
+    };
+  }
+  /**
+   * A new order for the caller (POST /account/order): dry run unless `confirm`. The engine prices and creates it
+   * (Subscription in payment + pending invoice); a person pays at `payUrl`. Needs a session or a PAT with the
+   * `billing:order` scope, within that token's monthly budget and allowed SKUs.
+   */
+  async order(input) {
+    const r = await this.client.console("POST", "/account/order", { body: input, tolerateHttpError: true });
+    if (!r?.ok) throw new RoxyonApiError(r?.error || "The order was not placed.", { body: r });
+    return r;
+  }
+  /** The caller's own subscriptions (rows they own), newest first. */
+  async subscriptions() {
+    const r = await this.client.console("GET", "/account/subscriptions", { tolerateHttpError: true });
+    if (!r?.ok) throw new RoxyonApiError(r?.error || "Could not load subscriptions.", { body: r });
+    return r.subscriptions ?? [];
+  }
+  /** The caller's own invoices, newest first. */
+  async invoices(opts = {}) {
+    const q = {};
+    if (opts.status) q.status = opts.status;
+    if (opts.limit) q.limit = String(opts.limit);
+    const r = await this.client.console(
+      "GET",
+      "/account/invoices",
+      { tolerateHttpError: true, query: q }
+    );
+    if (!r?.ok) throw new RoxyonApiError(r?.error || "Could not load invoices.", { body: r });
+    return (r.invoices ?? []).map((i) => ({ ...i, payUrl: isPayable(i.status) ? i.payUrl : null }));
+  }
+};
+
 // src/constants.ts
 var DEFAULT_BAAS_URL = "https://www.beaapis.com/1";
 var DEFAULT_CONSOLE_URL = "https://console.roxyon.com";
@@ -499,7 +657,7 @@ function toQueryString(query) {
 }
 
 // src/client.ts
-var RoxyonClient = class {
+var RoxyonClient = class _RoxyonClient {
   baseUrl;
   consoleUrl;
   appId;
@@ -520,6 +678,17 @@ var RoxyonClient = class {
       throw new Error("No fetch implementation available (need Node >= 20 or pass opts.fetch).");
     }
   }
+  /** Same endpoints and app, no user credentials: for public reads (catalog, quotes)
+   * that must work for PAT callers too, whose token the BaaS does not accept. */
+  publicClient() {
+    return new _RoxyonClient({
+      baseUrl: this.baseUrl,
+      consoleUrl: this.consoleUrl,
+      appId: this.appId,
+      javascriptKey: this.javascriptKey,
+      fetch: this._fetch
+    });
+  }
   getSessionToken() {
     return this.sessionToken;
   }
@@ -540,16 +709,16 @@ var RoxyonClient = class {
       },
       body: JSON.stringify({ scope: "public" })
     });
-    const json = await res.json().catch(() => ({}));
-    if (!json.access_token && !json.session_token) {
+    const json2 = await res.json().catch(() => ({}));
+    if (!json2.access_token && !json2.session_token) {
       throw new RoxyonApiError("Could not obtain an anonymous BaaS token.", {
         status: res.status,
-        body: json
+        body: json2
       });
     }
-    json._expiresAt = Date.now() + (json.expires_in ? json.expires_in * 1e3 : 36e5);
-    this.anon = json;
-    return json;
+    json2._expiresAt = Date.now() + (json2.expires_in ? json2.expires_in * 1e3 : 36e5);
+    this.anon = json2;
+    return json2;
   }
   /** A Personal Access Token (`roxp_…`) authenticates the console endpoints via
    * `Authorization: Bearer`; it is not a BaaS session token. */
@@ -599,17 +768,21 @@ var RoxyonClient = class {
       throw new RoxyonApiError(`Network error calling ${method} ${url}`, { body: cause });
     }
     const text = await res.text();
-    let json;
+    let json2;
     try {
-      json = text ? JSON.parse(text) : {};
+      json2 = text ? JSON.parse(text) : {};
     } catch {
-      json = { error: text || `HTTP ${res.status}`, _raw: text };
+      const html = /^\s*</.test(text);
+      json2 = {
+        error: html ? `${method} ${path} is not available on this server yet (got a web page instead of the API).` : text || `HTTP ${res.status}`,
+        _raw: html ? "" : text
+      };
     }
     if (!res.ok && !opts.tolerateHttpError) {
-      const msg = json && typeof json === "object" && "error" in json && json.error || `HTTP ${res.status} calling ${method} ${path}`;
-      throw new RoxyonApiError(String(msg), { status: res.status, body: json });
+      const msg = json2 && typeof json2 === "object" && "error" in json2 && json2.error || `HTTP ${res.status} calling ${method} ${path}`;
+      throw new RoxyonApiError(String(msg), { status: res.status, body: json2 });
     }
-    return json;
+    return json2;
   }
   get(path, query, opts) {
     return this.request("GET", path, { ...opts, query });
@@ -872,7 +1045,9 @@ var TokensApi = class {
         body: {
           name,
           scopes: opts.scopes ?? ["deploy", "logs"],
-          ...opts.expiresInDays ? { expiresInDays: opts.expiresInDays } : {}
+          ...opts.expiresInDays ? { expiresInDays: opts.expiresInDays } : {},
+          ...opts.monthlyBudgetUSD ? { monthlyBudgetUSD: opts.monthlyBudgetUSD } : {},
+          ...opts.allowedSkus?.length ? { allowedSkus: opts.allowedSkus } : {}
         },
         tolerateHttpError: true
       }
@@ -892,6 +1067,112 @@ var TokensApi = class {
   }
 };
 
+// src/baas-data.ts
+var DEFAULT_BAAS_V2_URL = "https://www.beaapis.com/2";
+var BAAS_MAX_PAGE = 200;
+var BAAS_MAX_BATCH = 50;
+var CLASS_RE = /^[A-Za-z][A-Za-z0-9_]{0,63}$/;
+var ID_RE = /^[A-Za-z0-9]{1,40}$/;
+function checkClass(name) {
+  if (!CLASS_RE.test(name)) throw new Error(`Invalid class name "${name}".`);
+  return name;
+}
+function checkId(id) {
+  if (!ID_RE.test(id)) throw new Error(`Invalid objectId "${id}".`);
+  return id;
+}
+var BaasDataApi = class _BaasDataApi {
+  baseUrl;
+  secretKey;
+  _fetch;
+  constructor(opts) {
+    if (!opts.secretKey.startsWith("rxsk_")) {
+      throw new Error("BaaS V2 needs the app secret key (starts with rxsk_).");
+    }
+    this.secretKey = opts.secretKey;
+    this.baseUrl = (opts.baseUrl ?? DEFAULT_BAAS_V2_URL).replace(/\/+$/, "");
+    this._fetch = opts.fetch ?? globalThis.fetch.bind(globalThis);
+  }
+  async call(method, path, opts = {}) {
+    const qs = opts.query && Object.keys(opts.query).length ? `?${new URLSearchParams(opts.query)}` : "";
+    const headers = { "x-rx-secret-key": this.secretKey };
+    if (opts.body !== void 0) headers["content-type"] = "application/json";
+    let res;
+    try {
+      res = await this._fetch(`${this.baseUrl}${path}${qs}`, {
+        method,
+        headers,
+        body: opts.body === void 0 ? void 0 : JSON.stringify(opts.body)
+      });
+    } catch (e) {
+      throw new RoxyonApiError(`Could not reach ${this.baseUrl}: ${e.message}`);
+    }
+    let body = {};
+    try {
+      body = await res.json() ?? {};
+    } catch {
+    }
+    if (!res.ok || body.ok !== true) {
+      const msg = body.message || body.error || `HTTP ${res.status}`;
+      throw new RoxyonApiError(msg, { status: res.status, type: body.error, body });
+    }
+    return body;
+  }
+  static recordPath(className, id) {
+    return `/records/${checkClass(className)}${id === void 0 ? "" : `/${checkId(id)}`}`;
+  }
+  async query(className, q = {}) {
+    const limit = q.limit ?? 50;
+    if (!Number.isInteger(limit) || limit < 1 || limit > BAAS_MAX_PAGE) {
+      throw new Error(`limit must be 1 to ${BAAS_MAX_PAGE}.`);
+    }
+    const query = { fields: q.fields || "*", limit: String(limit) };
+    if (q.where && Object.keys(q.where).length) query.where = JSON.stringify(q.where);
+    if (q.order) query.order = q.order;
+    if (q.skip) query.skip = String(q.skip);
+    if (q.count) query.count = "1";
+    const r = await this.call("GET", _BaasDataApi.recordPath(className), { query });
+    return {
+      rows: r.results ?? [],
+      ...r.count !== void 0 ? { count: r.count } : {}
+    };
+  }
+  async get(className, objectId) {
+    const r = await this.call("GET", _BaasDataApi.recordPath(className, objectId));
+    return r.result ?? {};
+  }
+  /** Returns the created row as stored. */
+  async create(className, data) {
+    const r = await this.call("POST", _BaasDataApi.recordPath(className), { body: { data } });
+    return r.result ?? {};
+  }
+  async update(className, objectId, data) {
+    const r = await this.call("PUT", _BaasDataApi.recordPath(className, objectId), {
+      body: { data }
+    });
+    return r.result ?? {};
+  }
+  /** The id goes in the URL path, never the body. */
+  async delete(className, objectId) {
+    await this.call("DELETE", _BaasDataApi.recordPath(className, objectId));
+  }
+  /** 1 to 50 record requests in one call; one failing doesn't stop the others. */
+  async batch(requests) {
+    if (requests.length < 1 || requests.length > BAAS_MAX_BATCH) {
+      throw new Error(`A batch takes 1 to ${BAAS_MAX_BATCH} requests.`);
+    }
+    for (const req of requests) {
+      const [cls, id, extra] = req.path.split("/").filter(Boolean);
+      if (!cls || extra !== void 0)
+        throw new Error(`Batch path "${req.path}" must be /Class or /Class/id.`);
+      checkClass(cls);
+      if (id !== void 0) checkId(id);
+    }
+    const r = await this.call("POST", "/batch", { body: { requests } });
+    return r.results ?? [];
+  }
+};
+
 // src/env.ts
 function parseEnv(text) {
   const out = {};
@@ -971,6 +1252,7 @@ var Roxyon = class {
   databases;
   email;
   ssh;
+  billing;
   constructor(options = {}) {
     this.client = options instanceof RoxyonClient ? options : new RoxyonClient(options);
     this.auth = new AuthApi(this.client);
@@ -983,6 +1265,7 @@ var Roxyon = class {
     this.databases = new DatabasesApi(this.client);
     this.email = new EmailApi(this.client);
     this.ssh = new SshApi(this.client);
+    this.billing = new BillingApi(this.client);
   }
   get sessionToken() {
     return this.client.getSessionToken();
@@ -993,13 +1276,20 @@ var Roxyon = class {
   AccountApi,
   ApplicationsApi,
   AuthApi,
+  BAAS_MAX_BATCH,
+  BAAS_MAX_PAGE,
+  BILLING_CYCLES,
+  BaasDataApi,
+  BillingApi,
   DEFAULT_APP,
   DEFAULT_BAAS_URL,
+  DEFAULT_BAAS_V2_URL,
   DEFAULT_CONSOLE_URL,
   DatabasesApi,
   DomainsApi,
   EmailApi,
   LUMEN_BUILD,
+  PAYABLE_STATUSES,
   RUNTIMES,
   Roxyon,
   RoxyonApiError,
@@ -1012,6 +1302,7 @@ var Roxyon = class {
   envFromStored,
   formatEnv,
   isAuthError,
+  isPayable,
   parseEnv,
   rxError,
   toQueryString