@abraca/dabra 2.5.0 → 2.6.0

package/dist/abracadabra-provider.cjs

@@ -11092,6 +11092,49 @@ var AbracadabraClient = class {
 		return this.request("GET", `/admin/users/${encodeURIComponent(userId)}/docs${qs}`);
 	}
 	/**
+	* List `service`-role users (runners, demo seeders, automation
+	* identities). Requires Service role. Admins can see service users via
+	* `/admin/users` too but cannot mint or rotate them.
+	*/
+	async adminListServiceAccounts() {
+		return this.request("GET", "/admin/service-accounts");
+	}
+	/**
+	* Create a new `service`-role user. When `public_key` is omitted the
+	* server generates a keypair and returns the private half in the
+	* response — show it to the operator **once** and discard; the server
+	* never persists it. Requires Service role.
+	*/
+	async adminCreateServiceAccount(body) {
+		return this.request("POST", "/admin/service-accounts", { body });
+	}
+	/**
+	* Rotate the active keypair on a service account. Old JWTs are
+	* invalidated; old device keys are marked revoked; the canonical
+	* `users.public_key` swaps to the new value. `users.id` stays put so
+	* existing permission rows keep matching. Returns the new pubkey (and
+	* private half when the server generated it). Requires Service role.
+	*/
+	async adminRotateServiceAccountKey(userId, body = {}) {
+		return this.request("POST", `/admin/service-accounts/${encodeURIComponent(userId)}/rotate-key`, { body });
+	}
+	/**
+	* Lock a service account and revoke all of its device keys. Idempotent.
+	* Refuses targets whose `users.role` isn't `"service"`. Requires
+	* Service role.
+	*/
+	async adminRevokeServiceAccount(userId) {
+		await this.request("DELETE", `/admin/service-accounts/${encodeURIComponent(userId)}`);
+	}
+	/**
+	* Revoke a single device key on a user (any role). Bumps
+	* `tokens_invalid_before` so open WS sessions tied to the key must
+	* re-auth. Requires elevated role (Service or Admin@root).
+	*/
+	async adminRevokeDeviceKey(userId, keyId) {
+		await this.request("POST", `/admin/users/${encodeURIComponent(userId)}/device-keys/${encodeURIComponent(keyId)}/revoke`);
+	}
+	/**
 	* Page through the audit log. Filters AND-combine; `limit` defaults to
 	* 100 server-side. Requires elevated role.
 	*/