palbase 0.18.0 → 0.18.2

package/types/internal/src/modules/stores.d.ts

@@ -467,6 +467,10 @@ export type AppleChangedEvent = {
      * What Apple said of the key (connected, checked).
      */
     status?: "active" | "agreement" | "refused";
+    /**
+     * The key was made at Apple by Palbase, with the environment's Apple ID session (connected).
+     */
+    made?: boolean;
 };
 /**
  * A one-time grant to connect an Apple key: the key goes from the person's browser (connect_url) or terminal (POST /stores/connect with the grant) straight to the module.
@@ -2532,6 +2536,7 @@ export type AppleSession = {
      */
     status?: "active" | "expired";
     team?: AppleTeam;
+    shared_from?: SharedEnvironment;
 };
 /**
  * stores.apple.session.changed: an Apple ID was signed in for the project, or disconnected. Never the session.
@@ -2885,6 +2890,125 @@ export type AppleSessionEndedEvent = {
      */
     connected_by: string;
 };
+/**
+ * A key Palbase made at Apple for the environment: never its .p8.
+ */
+export type MadeKey = {
+    /**
+     * The apps it is for (APNs, In-App Purchase).
+     */
+    bundles?: string[];
+    /**
+     * An APNs key's environment.
+     */
+    environment?: "sandbox" | "prod";
+    /**
+     * The key's id at Apple.
+     */
+    key_id: string;
+    /**
+     * `asc` (App Store Connect API), `apns` or `iap` (In-App Purchase).
+     */
+    kind: "asc" | "apns" | "iap";
+    /**
+     * When it was made.
+     */
+    made_at: string;
+    /**
+     * Who asked for it: a developer's id, or the key's.
+     */
+    made_by: string;
+    /**
+     * The module it is for: notify (APNs), purchases (In-App Purchase).
+     */
+    module?: "notify" | "purchases";
+    /**
+     * What became of it, when it was not simply taken.
+     */
+    note?: string;
+    /**
+     * When its module took it, refused it, or it was revoked.
+     */
+    settled_at?: string;
+    /**
+     * `waiting` for its module to take it, `taken`, `refused` (its module keeps a key of its own and it could not be revoked at Apple), or `revoked`.
+     */
+    state: "waiting" | "taken" | "refused" | "revoked";
+};
+/**
+ * Keys Palbase made at Apple for the environment.
+ */
+export type MadeKeys = {
+    keys: MadeKey[];
+};
+/**
+ * The key to make at Apple.
+ */
+export type MakeKeyRequest = {
+    /**
+     * The iOS app an In-App Purchase key is for; required when the environment has more than one.
+     */
+    bundle?: string;
+    /**
+     * `asc` (App Store Connect API), `apns` or `iap` (In-App Purchase).
+     */
+    kind: "asc" | "apns" | "iap";
+};
+/**
+ * The environment of the organization whose Apple ID session the project uses, having none of its own: signed in to the project's App Store Connect team.
+ */
+export type SharedEnvironment = {
+    /**
+     * Its project's name.
+     */
+    name?: string;
+    /**
+     * Its platform project's id.
+     */
+    project_id: string;
+    /**
+     * Its ref.
+     */
+    ref?: string;
+};
+/**
+ * stores.apple.key.made: keys were made at Apple for another module of the environment (notify's APNs keys, purchases' In-App Purchase key), which takes them. Never a key.
+ */
+export type AppleKeyMadeEvent = {
+    /**
+     * The keys' handover: what the module takes at once.
+     */
+    handover: string;
+    /**
+     * The keys' ids at Apple.
+     */
+    key_ids: string[];
+    /**
+     * `apns` or `iap`.
+     */
+    kind: "apns" | "iap";
+    /**
+     * The module the keys are for.
+     */
+    module: "notify" | "purchases";
+};
+/**
+ * stores.apple.key.revoked: a key Palbase made at Apple for the environment was revoked there. Never the key.
+ */
+export type AppleKeyRevokedEvent = {
+    /**
+     * The key's id at Apple.
+     */
+    key_id: string;
+    /**
+     * `apns` or `iap`.
+     */
+    kind: "asc" | "apns" | "iap";
+    /**
+     * The module it was for.
+     */
+    module?: string;
+};
 /** The events this module sends the project's webhooks (x-palbase-events), by type: each one's payload, the event's data. */
 export interface Events {
     /**
@@ -2971,6 +3095,14 @@ export interface Events {
      * stores.apple.session.ended: Palbase's own project's copy of an Apple ID session Apple ended in a customer's project, whose Studio mails the person who connected it.
      */
     "stores.apple.session.ended": AppleSessionEndedEvent;
+    /**
+     * stores.apple.key.made: keys were made at Apple for another module of the environment (notify's APNs keys, purchases' In-App Purchase key), which takes them. Never a key.
+     */
+    "stores.apple.key.made": AppleKeyMadeEvent;
+    /**
+     * stores.apple.key.revoked: a key Palbase made at Apple for the environment was revoked there. Never the key.
+     */
+    "stores.apple.key.revoked": AppleKeyRevokedEvent;
 }
 /** Palbase Stores */
 export declare function client(t: Transport): {
@@ -3914,5 +4046,39 @@ export declare function client(t: Transport): {
         }; /** Stops the call: the request in flight, a wait before a retry, a proof-of-work being solved. */
         signal?: AbortSignal;
     }): Promise<Reply<204, undefined>>;
+    /**
+     * Keys made at Apple
+     *
+     * The keys Palbase made at Apple for the environment with its Apple ID session (`POST /stores/apple/keys`), the newest first — never a key itself: its App Store Connect API key, its APNs keys (notify's) and its In-App Purchase key (purchases'), and where each stands.
+     */
+    listMadeAppleKeys(input?: {
+        signal?: AbortSignal;
+    }): Promise<Reply<200, MadeKeys>>;
+    /**
+     * Make a key at Apple
+     *
+     * Makes one key at Apple with the Apple ID session the environment uses, and connects it: no one downloads a .p8. `asc` — the environment's App Store Connect API key (Admin, every app), connected as `POST /stores/connect` connects one (409 `key_connected` when one is). `apns` — two APNs keys, one for each APNs environment (Apple makes a key scoped to apps for one environment), scoped to the environment's iOS apps, which the notify module takes as its APNs provider. `iap` — an In-App Purchase key for one of its iOS apps (`bundle`, required with more than one), which the purchases module connects. A module that keeps a key the environment connected itself refuses the one made, and it is revoked at Apple. One a request (each well inside the edge's time); 409 `key_made` for a kind Palbase made already. The Apple ID must be an Admin or the Account Holder (409 `apple_role_insufficient`). An owner's or an admin's, or the project's secret key's (403 `admin_required` for a member); never an environment's token's (403 `token_out_of_scope`): a key outlives it. Emits `stores.apple.changed` (asc) or `stores.apple.key.made` (apns, iap).
+     */
+    makeAppleKey(input: {
+        headers?: {
+            "Idempotency-Key"?: string;
+        };
+        body: MakeKeyRequest; /** Stops the call: the request in flight, a wait before a retry, a proof-of-work being solved. */
+        signal?: AbortSignal;
+    }): Promise<Reply<201, MadeKeys>>;
+    /**
+     * Revoke a key made at Apple
+     *
+     * Revokes at Apple an APNs or In-App Purchase key Palbase made for the environment: its module keeps it, and it no longer works. The App Store Connect key is revoked as it is disconnected (`DELETE /stores/apple`; 409 `key_connected` here). An owner's or an admin's, or the project's secret key's. Emits `stores.apple.key.revoked`.
+     */
+    revokeMadeAppleKey(input: {
+        path: {
+            key_id: string;
+        };
+        headers?: {
+            "Idempotency-Key"?: string;
+        }; /** Stops the call: the request in flight, a wait before a retry, a proof-of-work being solved. */
+        signal?: AbortSignal;
+    }): Promise<Reply<200, MadeKey>>;
 };
 export type Client = ReturnType<typeof client>;

package/types/web/src/auth.d.ts

@@ -1,6 +1,6 @@
 import { auth as authModule } from '../../internal/src/modules/index.js';
 import type { Transport } from '../../internal/src/transport.js';
-import type { AuthEvent, Session, SessionEndReason, SessionManager } from './session.js';
+import { type AuthEvent, type Session, type SessionEndReason, type SessionManager } from './session.js';
 type A = typeof authModule;
 export type User = authModule.User;
 export type SignupRequest = authModule.SignupRequest;
@@ -62,6 +62,13 @@ export declare class Auth {
         /** Removes a factor; the account's password confirms it. */
         removeFactor: (id: string, currentPassword: string) => Promise<void>;
         regenerateRecoveryCodes: () => Promise<authModule.MFARecoveryCodesResponse>;
+        /**
+         * Raises the signed-in session to aal2 with a code the authenticator app
+         * shows — what a route marked auth { aal: 'aal2' } asks for (401
+         * insufficient_user_authentication). The session holds the new token from
+         * here on; its refreshes stay at aal2.
+         */
+        stepUp: (code: string) => Promise<Session>;
     };
     readonly passkey: {
         /** Adds a passkey to the signed-in user. */
@@ -79,6 +86,8 @@ export declare class Auth {
          * it (the sign-up answers no tokens). The identifier is the user's email.
          */
         signUp: (identifier: string, userName?: string) => Promise<User>;
+        /** Raises the signed-in session to aal2 with one of the user's passkeys (as mfa.stepUp does with a code). */
+        stepUp: () => Promise<Session>;
         list: () => Promise<authModule.WebAuthnCredentialList>;
         remove: (id: string) => Promise<void>;
     };
@@ -156,6 +165,7 @@ export declare class Auth {
     }): Promise<User>;
     /** Starts the session from a token pair; the user is the answer's, or read once when it carries none. */
     private signedIn;
+    private steppedUp;
     private authenticator;
 }
 type Json = Record<string, unknown>;

package/types/web/src/purchases.d.ts

@@ -12,6 +12,7 @@ export type OfferView = purchasesModule.OfferView;
 export type GrantInfo = purchasesModule.GrantInfo;
 export type Redeemed = purchasesModule.Redeemed;
 export type RedemptionLink = purchasesModule.RedemptionLink;
+export type RefundDataConsent = purchasesModule.RefundDataConsent;
 /** Where a checkout is opened: an app linking out to buy on the web says its platform and its store's storefront (ISO 3166-1 alpha-3: `USA`). */
 export type CheckoutSource = purchasesModule.CheckoutSource;
 /** Told what the customer has: on the first read, then each time it changes; null while no one is signed in. */
@@ -156,6 +157,16 @@ export declare class Purchases {
      * grant, it is the same merge.
      */
     merge(grant: MergeGrant | string): Promise<CustomerInfo>;
+    /**
+     * What the signed-in customer said, as the app asked them: whether, when
+     * they ask the App Store for a refund, Apple is told what they had of the
+     * purchase — whether it was given, whether a free trial came first, how
+     * much of a pack of credits was spent. With it, Palbase answers Apple's
+     * question within its 12 hours and states no preference of its own;
+     * without it — never asked, or false — Apple is told nothing. The latest
+     * word counts.
+     */
+    setRefundDataConsent(consented: boolean): Promise<RefundDataConsent>;
     /** Where this tab keeps a checkout's redemption key. */
     private keyName;
     /**