adapty 0.8.5 → 0.8.6

package/dist/sdk/adapty/auth/poll-token.js

@@ -0,0 +1,58 @@
+import { ApiError } from '../../core/errors.js';
+import { CLIENT_ID } from './model.js';
+/** A 400 carrying one of these codes is a state of the protocol, not a failure. */
+const pollResultByCode = {
+    access_denied: { status: 'denied' },
+    authorization_pending: { status: 'pending' },
+    expired_token: { status: 'expired' },
+    slow_down: { status: 'slow_down' },
+};
+/** A protocol code as a state, or a real error when the code is not one of the protocol's. */
+const toPollResult = (code, body) => {
+    const result = pollResultByCode[code];
+    if (result === undefined) {
+        throw new ApiError({
+            code,
+            details: body,
+            message: `Unexpected device flow response: ${code}`,
+            status: 200,
+        });
+    }
+    return result;
+};
+/**
+ * Step two, asked over and over until the user is done: the answer is a token, a state of the
+ * protocol, or a failure — and telling the three apart is the whole of this operation.
+ */
+export const pollToken = async (http, deviceCode) => {
+    try {
+        const response = await http.post('/auth/token', {
+            client_id: CLIENT_ID,
+            device_code: deviceCode,
+            grant_type: 'urn:ietf:params:oauth:grant-type:device_code',
+        });
+        // A protocol state normally arrives as a 400 and lands in the catch below, but the
+        // shipped CLI's types also anticipate a 200 whose body is { error: <code> }, and
+        // reading only the thrown case would call a pending login authorized.
+        if (!('access_token' in response)) {
+            return toPollResult(response.error, response);
+        }
+        return {
+            status: 'authorized',
+            token: {
+                accessToken: response.access_token,
+                expiresInSec: response.expires_in,
+                user: response.user,
+            },
+        };
+    }
+    catch (error) {
+        if (error instanceof ApiError && error.code !== undefined) {
+            const result = pollResultByCode[error.code];
+            if (result) {
+                return result;
+            }
+        }
+        throw error;
+    }
+};

package/dist/sdk/adapty/auth/resource.d.ts

@@ -0,0 +1,17 @@
+import type { IssuedToken } from './model.js';
+import type { Http } from '../../core/http/index.js';
+/**
+ * The auth resource: core's DeviceAuthApi port filled in by the two device flow steps, plus the
+ * endpoints that only need a path. A missing or stale token surfaces as AuthRequiredError.
+ *
+ * Unlike apps, not every path is listed here: a device flow step is its path and the reading of
+ * its answer together, so each keeps its own. What is left in this file is the shape of the
+ * resource — which port it satisfies, and what else it answers.
+ */
+export declare const auth: (http: Http) => {
+    me: () => Promise<Record<string, unknown>>;
+    revokeToken: (token: string) => Promise<undefined>;
+    pollToken(deviceCode: string): Promise<import("../../core/auth/device-flow.js").PollResult<IssuedToken>>;
+    requestDeviceCode(): Promise<import("../../core/auth/device-flow.js").DeviceCode>;
+};
+export type AuthApi = ReturnType<typeof auth>;

package/dist/sdk/adapty/auth/resource.js

@@ -0,0 +1,21 @@
+import { requestDeviceCode } from './device-code.js';
+import { pollToken } from './poll-token.js';
+/**
+ * The auth resource: core's DeviceAuthApi port filled in by the two device flow steps, plus the
+ * endpoints that only need a path. A missing or stale token surfaces as AuthRequiredError.
+ *
+ * Unlike apps, not every path is listed here: a device flow step is its path and the reading of
+ * its answer together, so each keeps its own. What is left in this file is the shape of the
+ * resource — which port it satisfies, and what else it answers.
+ */
+export const auth = (http) => {
+    const deviceAuth = {
+        pollToken: (deviceCode) => pollToken(http, deviceCode),
+        requestDeviceCode: () => requestDeviceCode(http),
+    };
+    return {
+        ...deviceAuth,
+        me: () => http.get('/me'),
+        revokeToken: (token) => http.post('/auth/tokens/revoke', { token }),
+    };
+};

package/dist/sdk/adapty/errors.d.ts

@@ -0,0 +1,10 @@
+import type { ErrorParser } from '../core/http/index.js';
+/**
+ * How this service words a rejection: `{ error_code, errors: { field: [message] } }`, sometimes
+ * just `{ error: 'code' }`. Ported from src/lib/errors.ts so a migrated command keeps saying
+ * "apple_bundle_id: already used" instead of "POST /apps failed with HTTP 400".
+ *
+ * Wired once in createAdapty: which shapes a service speaks is product knowledge, and ASA speaks
+ * another — which is why the transport takes the parser as a parameter.
+ */
+export declare const developerErrorParser: ErrorParser;

package/dist/sdk/adapty/errors.js

@@ -0,0 +1,38 @@
+/**
+ * How this service words a rejection: `{ error_code, errors: { field: [message] } }`, sometimes
+ * just `{ error: 'code' }`. Ported from src/lib/errors.ts so a migrated command keeps saying
+ * "apple_bundle_id: already used" instead of "POST /apps failed with HTTP 400".
+ *
+ * Wired once in createAdapty: which shapes a service speaks is product knowledge, and ASA speaks
+ * another — which is why the transport takes the parser as a parameter.
+ */
+export const developerErrorParser = (_status, body) => {
+    if (typeof body !== 'object' || body === null) {
+        return {};
+    }
+    const { error, error_code: errorCode, errors } = body;
+    if (typeof errorCode === 'string' && errorCode !== '') {
+        // The bare code as the fallback message: what the published CLI prints, and still better
+        // than an HTTP status when the server sends no field errors
+        return { code: errorCode, message: fieldMessages(errors) ?? errorCode };
+    }
+    if (typeof error === 'string' && error !== '') {
+        return { code: error, message: error };
+    }
+    return {};
+};
+/** `non_field_errors` is the server's name for "about the request as a whole": printed bare. */
+const fieldMessages = (errors) => {
+    if (typeof errors !== 'object' || errors === null) {
+        return undefined;
+    }
+    const parts = [];
+    for (const [field, messages] of Object.entries(errors)) {
+        for (const message of Array.isArray(messages) ? messages : [messages]) {
+            if (typeof message === 'string') {
+                parts.push(field === 'non_field_errors' ? message : `${field}: ${message}`);
+            }
+        }
+    }
+    return parts.length > 0 ? parts.join('; ') : undefined;
+};

package/dist/sdk/adapty/index.d.ts

@@ -0,0 +1,36 @@
+import type { AccessLevelsApi } from './access-levels.js';
+import type { AppsApi } from './apps/index.js';
+import type { AuthApi } from './auth/index.js';
+import type { Clock } from '../core/clock.js';
+import type { RetryAttempt } from '../core/http/index.js';
+export { platforms } from './apps/index.js';
+export { developerErrorParser } from './errors.js';
+export type { AccessLevel, AccessLevelList, AccessLevelsApi } from './access-levels.js';
+export type { AppDetail, AppsApi, AppSummary, CreateAppInput, UpdateAppInput } from './apps/index.js';
+export type { AuthApi, AuthUser, IssuedToken } from './auth/index.js';
+export type { PageParams, Paginated, Pagination } from './pagination.js';
+/** Exported because the adapter compares the resolved URL with it and warns when they differ. */
+export declare const DEFAULT_ADAPTY_API_URL = "https://api-admin.adapty.io/api/v1/developer";
+/**
+ * Narrower than HttpOptions on purpose: the transport seams (parseError, shouldRetry, the retry
+ * policy, trailingSlash) are product knowledge, and two adapters overriding them would read the
+ * same answers differently. What is left is what a consumer really owns.
+ */
+export type AdaptyOptions = {
+    baseUrl?: string | undefined;
+    clock?: Clock | undefined;
+    fetch?: typeof globalThis.fetch | undefined;
+    onRetry?: ((info: RetryAttempt) => void) | undefined;
+    signal?: AbortSignal | undefined;
+    /** Without a token only auth is usable — that is how login builds the sdk. */
+    token?: string | undefined;
+    /** Comes from the adapter, so server logs can tell the CLI from an MCP server. */
+    userAgent?: string | undefined;
+};
+export type Adapty = {
+    accessLevels: AccessLevelsApi;
+    apps: AppsApi;
+    auth: AuthApi;
+};
+/** The assembly point of the developer API: one transport, resources on top of it. */
+export declare const createAdapty: (options?: AdaptyOptions) => Adapty;

package/dist/sdk/adapty/index.js

@@ -0,0 +1,27 @@
+import { createHttp } from '../core/http/index.js';
+import { accessLevels } from './access-levels.js';
+import { apps } from './apps/index.js';
+import { auth } from './auth/index.js';
+import { developerErrorParser } from './errors.js';
+export { platforms } from './apps/index.js';
+export { developerErrorParser } from './errors.js';
+/** Exported because the adapter compares the resolved URL with it and warns when they differ. */
+export const DEFAULT_ADAPTY_API_URL = 'https://api-admin.adapty.io/api/v1/developer';
+/** The assembly point of the developer API: one transport, resources on top of it. */
+export const createAdapty = (options = {}) => {
+    const http = createHttp({
+        baseUrl: options.baseUrl ?? DEFAULT_ADAPTY_API_URL,
+        clock: options.clock,
+        fetch: options.fetch,
+        headers: options.userAgent === undefined ? undefined : { 'user-agent': options.userAgent },
+        onRetry: options.onRetry,
+        parseError: developerErrorParser,
+        signal: options.signal,
+        token: options.token,
+    });
+    return {
+        accessLevels: accessLevels(http),
+        apps: apps(http),
+        auth: auth(http),
+    };
+};

package/dist/sdk/adapty/pagination.d.ts

@@ -0,0 +1,23 @@
+import type { QueryParams } from '../core/http/index.js';
+/**
+ * The paginated answer, and the query that asks for a page. Product and not core: `meta.pagination`
+ * and the bracketed `page[...]` names are this API's convention, not the transport's business. ASA
+ * follows the same convention today, so sdk/asa can import this until the two actually diverge.
+ */
+export type Pagination = {
+    count: number;
+    page: number;
+    pages: number;
+};
+export type Paginated<T> = {
+    data: T[];
+    meta: {
+        pagination: Pagination;
+    };
+};
+/** Page selection as we take it: camelCase in, the server's names on the wire. */
+export type PageParams = {
+    page?: number | undefined;
+    pageSize?: number | undefined;
+};
+export declare const pageQuery: (params: PageParams | undefined) => QueryParams;

package/dist/sdk/adapty/pagination.js

@@ -0,0 +1 @@
+export const pageQuery = (params) => ({ 'page[number]': params?.page, 'page[size]': params?.pageSize });

package/dist/sdk/core/auth/device-flow.d.ts

@@ -0,0 +1,46 @@
+import type { Clock } from '../clock.js';
+export type DeviceCode = {
+    deviceCode: string;
+    expiresInSec: number;
+    intervalSec: number;
+    userCode: string;
+    verificationUri: string;
+    verificationUriComplete: string | undefined;
+};
+export type PollResult<TToken> = {
+    status: 'authorized';
+    token: TToken;
+} | {
+    status: 'denied';
+} | {
+    status: 'expired';
+} | {
+    status: 'pending';
+} | {
+    status: 'slow_down';
+};
+/**
+ * The device flow port (RFC 8628) — all the orchestration below knows. What sits inside a token
+ * (for Adapty, an access_token plus the user) is the port's business.
+ */
+export type DeviceAuthApi<TToken> = {
+    pollToken(deviceCode: string): Promise<PollResult<TToken>>;
+    requestDeviceCode(): Promise<DeviceCode>;
+};
+export type DeviceFlowDeps = {
+    clock: Clock;
+    maxConsecutiveErrors?: number | undefined;
+    /** Do not poll faster than this, even if the server allows it. */
+    minIntervalMs?: number | undefined;
+    /** Show the code and the link to the user. Sdk prints nothing itself. */
+    onCode: (code: DeviceCode) => void;
+    /** One poll failed (network, odd answer). The flow goes on up to maxConsecutiveErrors. */
+    onTransientError?: ((error: unknown, consecutive: number) => void) | undefined;
+    signal?: AbortSignal | undefined;
+};
+/**
+ * Device flow orchestration with every effect kept outside: the network behind the api port, time
+ * behind clock, cancellation behind signal. That is what makes expiry, slow_down, poll failures
+ * and Ctrl+C unit-testable.
+ */
+export declare const runDeviceFlow: <TToken>(api: DeviceAuthApi<TToken>, deps: DeviceFlowDeps) => Promise<TToken>;

package/dist/sdk/core/auth/device-flow.js

@@ -0,0 +1,62 @@
+import { throwIfAborted } from '../clock.js';
+import { CancelledError, DeviceFlowDeniedError, DeviceFlowExpiredError } from '../errors.js';
+/** RFC 8628, 3.5: on slow_down the interval grows by 5 seconds. */
+const SLOW_DOWN_STEP_MS = 5000;
+const DEFAULT_MIN_INTERVAL_MS = 5000;
+const DEFAULT_MAX_CONSECUTIVE_ERRORS = 10;
+/**
+ * Device flow orchestration with every effect kept outside: the network behind the api port, time
+ * behind clock, cancellation behind signal. That is what makes expiry, slow_down, poll failures
+ * and Ctrl+C unit-testable.
+ */
+export const runDeviceFlow = async (api, deps) => {
+    const { clock, signal } = deps;
+    const maxConsecutiveErrors = deps.maxConsecutiveErrors ?? DEFAULT_MAX_CONSECUTIVE_ERRORS;
+    throwIfAborted(signal);
+    const code = await api.requestDeviceCode();
+    deps.onCode(code);
+    const deadline = clock.now() + code.expiresInSec * 1000;
+    let intervalMs = Math.max(code.intervalSec * 1000, deps.minIntervalMs ?? DEFAULT_MIN_INTERVAL_MS);
+    let consecutiveErrors = 0;
+    for (;;) {
+        if (clock.now() >= deadline) {
+            throw new DeviceFlowExpiredError();
+        }
+        await clock.sleep(intervalMs, signal);
+        throwIfAborted(signal);
+        let result;
+        try {
+            result = await api.pollToken(code.deviceCode);
+            consecutiveErrors = 0;
+        }
+        catch (error) {
+            if (error instanceof CancelledError) {
+                throw error;
+            }
+            consecutiveErrors += 1;
+            if (consecutiveErrors >= maxConsecutiveErrors) {
+                throw error;
+            }
+            deps.onTransientError?.(error, consecutiveErrors);
+            continue;
+        }
+        switch (result.status) {
+            case 'authorized': {
+                return result.token;
+            }
+            case 'pending': {
+                break;
+            }
+            case 'slow_down': {
+                intervalMs += SLOW_DOWN_STEP_MS;
+                break;
+            }
+            case 'expired': {
+                throw new DeviceFlowExpiredError();
+            }
+            case 'denied': {
+                throw new DeviceFlowDeniedError();
+            }
+        }
+    }
+};

package/dist/sdk/core/clock.d.ts

@@ -0,0 +1,7 @@
+/** Time as a dependency: device flow and retry take a Clock, so tests never wait for real. */
+export type Clock = {
+    now(): number;
+    sleep(ms: number, signal?: AbortSignal): Promise<void>;
+};
+export declare const systemClock: Clock;
+export declare const throwIfAborted: (signal: AbortSignal | undefined) => void;

package/dist/sdk/core/clock.js

@@ -0,0 +1,21 @@
+import { setTimeout as delay } from 'node:timers/promises';
+import { CancelledError, isAbortError } from './errors.js';
+export const systemClock = {
+    now: () => Date.now(),
+    sleep: async (ms, signal) => {
+        try {
+            await delay(ms, undefined, signal ? { signal } : {});
+        }
+        catch (error) {
+            if (isAbortError(error)) {
+                throw new CancelledError();
+            }
+            throw error;
+        }
+    },
+};
+export const throwIfAborted = (signal) => {
+    if (signal?.aborted === true) {
+        throw new CancelledError();
+    }
+};

package/dist/sdk/core/errors.d.ts

@@ -0,0 +1,81 @@
+/**
+ * Sdk errors carry no user-facing text and no exit code: the adapter assigns both
+ * (src/cli/errors.ts, and a future MCP server).
+ *
+ * Every error has a stable `kind`, and the adapter switches over it. An instanceof chain would
+ * let a new error class fall through to the fallback and become exit 1 with no readable text.
+ */
+export type SdkErrorKind = 'api' | 'auth_required' | 'cancelled' | 'device_flow_denied' | 'device_flow_expired' | 'network' | 'storage' | 'validation';
+/** Abstract on purpose: `new SdkError(...)` would be an error without a kind, unrecognisable. */
+export declare abstract class SdkError extends Error {
+    abstract readonly kind: SdkErrorKind;
+    constructor(message: string, options?: ErrorOptions);
+}
+/** No response at all: DNS, refused connection, a dropped socket. */
+export declare class NetworkError extends SdkError {
+    readonly kind = "network";
+    readonly url: string;
+    constructor(url: string, cause: unknown);
+}
+/** The server answered with an error. `code` and `details` follow the service's own format. */
+export declare class ApiError extends SdkError {
+    readonly kind = "api";
+    readonly code: string | undefined;
+    readonly details: unknown;
+    readonly retryAfterMs: number | undefined;
+    readonly status: number;
+    constructor(init: {
+        code?: string | undefined;
+        details?: unknown;
+        message: string;
+        retryAfterMs?: number | undefined;
+        status: number;
+    });
+}
+/** missing: no token stored locally. rejected: the server answered 401. */
+export type AuthRequiredReason = 'missing' | 'rejected';
+export declare class AuthRequiredError extends SdkError {
+    readonly kind = "auth_required";
+    readonly reason: AuthRequiredReason;
+    constructor(reason: AuthRequiredReason);
+}
+export declare class CancelledError extends SdkError {
+    readonly kind = "cancelled";
+    constructor();
+}
+export type Issue = {
+    message: string;
+    /** The input field the problem belongs to. No path: the input as a whole is wrong. */
+    path?: string | undefined;
+};
+/** A business rule broken before any network call. */
+export declare class ValidationError extends SdkError {
+    readonly kind = "validation";
+    readonly issues: readonly Issue[];
+    constructor(issues: readonly Issue[]);
+}
+export declare class DeviceFlowExpiredError extends SdkError {
+    readonly kind = "device_flow_expired";
+    constructor();
+}
+export declare class DeviceFlowDeniedError extends SdkError {
+    readonly kind = "device_flow_denied";
+    constructor();
+}
+/** The session file is there but unusable: corrupted JSON, or something else in its place. */
+export declare class StorageError extends SdkError {
+    readonly kind = "storage";
+    readonly path: string;
+    constructor(message: string, path: string, options?: ErrorOptions);
+}
+/**
+ * Every concrete error: a switch over `kind` narrows to the class. instanceof on the abstract
+ * base gives the base, without .status, .url or .issues.
+ */
+export type AnySdkError = ApiError | AuthRequiredError | CancelledError | DeviceFlowDeniedError | DeviceFlowExpiredError | NetworkError | StorageError | ValidationError;
+export declare const isSdkError: (error: unknown) => error is AnySdkError;
+type Assert<T extends true> = T;
+/** Safety net: a kind whose class never made it into AnySdkError breaks the build here. */
+export type AllKindsCovered = Assert<SdkErrorKind extends AnySdkError['kind'] ? true : false>;
+export declare const isAbortError: (error: unknown) => boolean;
+export {};

package/dist/sdk/core/errors.js

@@ -0,0 +1,84 @@
+/**
+ * Sdk errors carry no user-facing text and no exit code: the adapter assigns both
+ * (src/cli/errors.ts, and a future MCP server).
+ *
+ * Every error has a stable `kind`, and the adapter switches over it. An instanceof chain would
+ * let a new error class fall through to the fallback and become exit 1 with no readable text.
+ */
+/** Abstract on purpose: `new SdkError(...)` would be an error without a kind, unrecognisable. */
+export class SdkError extends Error {
+    constructor(message, options) {
+        super(message, options);
+        this.name = new.target.name;
+    }
+}
+/** No response at all: DNS, refused connection, a dropped socket. */
+export class NetworkError extends SdkError {
+    kind = 'network';
+    url;
+    constructor(url, cause) {
+        super(`Request to ${url} failed`, { cause });
+        this.url = url;
+    }
+}
+/** The server answered with an error. `code` and `details` follow the service's own format. */
+export class ApiError extends SdkError {
+    kind = 'api';
+    code;
+    details;
+    retryAfterMs;
+    status;
+    constructor(init) {
+        super(init.message);
+        this.status = init.status;
+        this.code = init.code;
+        this.details = init.details;
+        this.retryAfterMs = init.retryAfterMs;
+    }
+}
+export class AuthRequiredError extends SdkError {
+    kind = 'auth_required';
+    reason;
+    constructor(reason) {
+        super(reason === 'missing' ? 'Not authenticated' : 'Token expired or invalid');
+        this.reason = reason;
+    }
+}
+export class CancelledError extends SdkError {
+    kind = 'cancelled';
+    constructor() {
+        super('Operation cancelled');
+    }
+}
+/** A business rule broken before any network call. */
+export class ValidationError extends SdkError {
+    kind = 'validation';
+    issues;
+    constructor(issues) {
+        super(issues.map(issue => (issue.path === undefined ? issue.message : `${issue.path}: ${issue.message}`)).join('; '));
+        this.issues = issues;
+    }
+}
+export class DeviceFlowExpiredError extends SdkError {
+    kind = 'device_flow_expired';
+    constructor() {
+        super('Device code expired before authorization');
+    }
+}
+export class DeviceFlowDeniedError extends SdkError {
+    kind = 'device_flow_denied';
+    constructor() {
+        super('Authorization denied');
+    }
+}
+/** The session file is there but unusable: corrupted JSON, or something else in its place. */
+export class StorageError extends SdkError {
+    kind = 'storage';
+    path;
+    constructor(message, path, options) {
+        super(message, options);
+        this.path = path;
+    }
+}
+export const isSdkError = (error) => error instanceof SdkError;
+export const isAbortError = (error) => error instanceof Error && error.name === 'AbortError';

package/dist/sdk/core/http/client.d.ts

@@ -0,0 +1,46 @@
+import type { Clock } from '../clock.js';
+import type { ErrorParser, ShouldRetry } from './policies.js';
+import type { RetryAttempt, RetryPolicy } from './retry.js';
+import type { QueryParams } from './url.js';
+export type HttpMethod = 'DELETE' | 'GET' | 'PATCH' | 'POST' | 'PUT';
+export type RequestOptions = {
+    /** A JSON-serializable value, or FormData for file uploads. */
+    body?: unknown;
+    headers?: Record<string, string> | undefined;
+    /** Retry on 429, 5xx and network errors. On by default for GET only. */
+    idempotent?: boolean | undefined;
+    /** Response headers, e.g. an ETag for optimistic locking. */
+    onResponse?: ((headers: Headers) => void) | undefined;
+    query?: QueryParams | undefined;
+    signal?: AbortSignal | undefined;
+};
+type BodylessOptions = Omit<RequestOptions, 'body'>;
+export type Http = {
+    delete<T>(path: string, options?: BodylessOptions): Promise<T>;
+    get<T>(path: string, options?: BodylessOptions): Promise<T>;
+    patch<T>(path: string, body?: unknown, options?: BodylessOptions): Promise<T>;
+    post<T>(path: string, body?: unknown, options?: BodylessOptions): Promise<T>;
+    put<T>(path: string, body?: unknown, options?: BodylessOptions): Promise<T>;
+    request<T>(method: HttpMethod, path: string, options?: RequestOptions): Promise<T>;
+};
+export type HttpOptions = {
+    baseUrl: string;
+    clock?: Clock | undefined;
+    fetch?: typeof globalThis.fetch | undefined;
+    headers?: Record<string, string> | undefined;
+    onRetry?: ((info: RetryAttempt) => void) | undefined;
+    parseError?: ErrorParser | undefined;
+    retry?: RetryPolicy | undefined;
+    /** When to retry an idempotent request. */
+    shouldRetry?: ShouldRetry | undefined;
+    signal?: AbortSignal | undefined;
+    token?: string | undefined;
+    /** Trailing slash in paths (Django style). On by default. */
+    trailingSlash?: boolean | undefined;
+};
+/**
+ * The transport: base URL, bearer token, JSON both ways, responses mapped to sdk errors,
+ * retry for idempotent requests. It knows nothing about resources or about the CLI.
+ */
+export declare const createHttp: (options: HttpOptions) => Http;
+export {};