@astram/frontend-core 0.3.0 → 0.4.0

package/dist/auth/index.d.ts

@@ -13,6 +13,8 @@ export { createRecordPolicyService } from './recordPolicyService.js';
 export type { RecordPolicyService, GuidedPolicy, PolicyCondition, PolicyOperator, PolicyRow, PolicyTypeSchema, PolicyFieldSchema, } from './recordPolicyService.js';
 export { createRecordShareService } from './recordShareService.js';
 export type { RecordShareService, ShareRequest, ShareView, ShareGranteeKind, } from './recordShareService.js';
+export { createServiceAccountService } from './serviceAccountService.js';
+export type { ServiceAccountService, ServiceAccountView, IssuedKey, CreateServiceAccountBody, UpdateServiceAccountBody, AssignableAccess, AssignableRole, AssignableScopeNode, AssignableResult, } from './serviceAccountService.js';
 export { isAuthenticated, accessTokenOf, tenantOf, principalOf } from './session.js';
 export { isRestorablePath, encodeReturnPath, decodeReturnPath } from './returnPath.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/auth/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/auth/index.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AACrD,OAAO,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAC;AAC3D,OAAO,EAAE,qBAAqB,EAAE,MAAM,sBAAsB,CAAC;AAC7D,OAAO,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAC;AACvD,OAAO,EAAE,wBAAwB,EAAE,MAAM,yBAAyB,CAAC;AACnE,OAAO,EAAE,yBAAyB,EAAE,MAAM,0BAA0B,CAAC;AACrE,YAAY,EACV,mBAAmB,EACnB,YAAY,EACZ,eAAe,EACf,cAAc,EACd,SAAS,EACT,gBAAgB,EAChB,iBAAiB,GAClB,MAAM,0BAA0B,CAAC;AAClC,OAAO,EAAE,wBAAwB,EAAE,MAAM,yBAAyB,CAAC;AACnE,YAAY,EACV,kBAAkB,EAClB,YAAY,EACZ,SAAS,EACT,gBAAgB,GACjB,MAAM,yBAAyB,CAAC;AACjC,OAAO,EAAE,eAAe,EAAE,aAAa,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AACrF,OAAO,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/auth/index.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AACrD,OAAO,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAC;AAC3D,OAAO,EAAE,qBAAqB,EAAE,MAAM,sBAAsB,CAAC;AAC7D,OAAO,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAC;AACvD,OAAO,EAAE,wBAAwB,EAAE,MAAM,yBAAyB,CAAC;AACnE,OAAO,EAAE,yBAAyB,EAAE,MAAM,0BAA0B,CAAC;AACrE,YAAY,EACV,mBAAmB,EACnB,YAAY,EACZ,eAAe,EACf,cAAc,EACd,SAAS,EACT,gBAAgB,EAChB,iBAAiB,GAClB,MAAM,0BAA0B,CAAC;AAClC,OAAO,EAAE,wBAAwB,EAAE,MAAM,yBAAyB,CAAC;AACnE,YAAY,EACV,kBAAkB,EAClB,YAAY,EACZ,SAAS,EACT,gBAAgB,GACjB,MAAM,yBAAyB,CAAC;AACjC,OAAO,EAAE,2BAA2B,EAAE,MAAM,4BAA4B,CAAC;AACzE,YAAY,EACV,qBAAqB,EACrB,kBAAkB,EAClB,SAAS,EACT,wBAAwB,EACxB,wBAAwB,EACxB,gBAAgB,EAChB,cAAc,EACd,mBAAmB,EACnB,gBAAgB,GACjB,MAAM,4BAA4B,CAAC;AACpC,OAAO,EAAE,eAAe,EAAE,aAAa,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AACrF,OAAO,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC"}

package/dist/auth/index.js

@@ -11,6 +11,7 @@ export { createAuditService } from './auditService.js';
 export { createCrossTenantService } from './crossTenantService.js';
 export { createRecordPolicyService } from './recordPolicyService.js';
 export { createRecordShareService } from './recordShareService.js';
+export { createServiceAccountService } from './serviceAccountService.js';
 export { isAuthenticated, accessTokenOf, tenantOf, principalOf } from './session.js';
 export { isRestorablePath, encodeReturnPath, decodeReturnPath } from './returnPath.js';
 //# sourceMappingURL=index.js.map

package/dist/auth/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/auth/index.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AACrD,OAAO,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAC;AAC3D,OAAO,EAAE,qBAAqB,EAAE,MAAM,sBAAsB,CAAC;AAC7D,OAAO,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAC;AACvD,OAAO,EAAE,wBAAwB,EAAE,MAAM,yBAAyB,CAAC;AACnE,OAAO,EAAE,yBAAyB,EAAE,MAAM,0BAA0B,CAAC;AAUrE,OAAO,EAAE,wBAAwB,EAAE,MAAM,yBAAyB,CAAC;AAOnE,OAAO,EAAE,eAAe,EAAE,aAAa,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AACrF,OAAO,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/auth/index.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AACrD,OAAO,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAC;AAC3D,OAAO,EAAE,qBAAqB,EAAE,MAAM,sBAAsB,CAAC;AAC7D,OAAO,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAC;AACvD,OAAO,EAAE,wBAAwB,EAAE,MAAM,yBAAyB,CAAC;AACnE,OAAO,EAAE,yBAAyB,EAAE,MAAM,0BAA0B,CAAC;AAUrE,OAAO,EAAE,wBAAwB,EAAE,MAAM,yBAAyB,CAAC;AAOnE,OAAO,EAAE,2BAA2B,EAAE,MAAM,4BAA4B,CAAC;AAYzE,OAAO,EAAE,eAAe,EAAE,aAAa,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AACrF,OAAO,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC"}

package/dist/auth/serviceAccountService.d.ts

@@ -0,0 +1,143 @@
+/**
+ * createServiceAccountService — platform-agnostic calls to the identity feature's SERVICE ACCOUNTS
+ * surface (ADR-0033): list/create/edit machine accounts + issue/rotate/revoke their `ask_…` API
+ * keys. Like {@link createCrossTenantService}, it takes an injected HTTP client and carries no
+ * platform code, so web + mobile share it. The bearer token is passed per call (the UI holds the
+ * session; the shared logic stays stateless).
+ *
+ * Every method resolves to a plain result object (never throws): `{ ok:true, ... }` on success,
+ * `{ ok:false, status, error }` on any non-2xx (401 = not authenticated, 403 = denied by policy /
+ * over the ADR-0029 ceiling, 404 = not in your tenant, 400 = the server's message, else generic).
+ *
+ * The server routes these hit (all `@Classified service_account:*`):
+ *   GET   /identity/service-accounts                       (read — list)
+ *   GET   /identity/service-accounts/assignable            (create — picker source: what I may grant)
+ *   GET   /identity/service-accounts/:id                   (read — one)
+ *   POST  /identity/service-accounts                       (create)
+ *   PATCH /identity/service-accounts/:id                   (update)
+ *   POST  /identity/service-accounts/:id/keys              (manage_keys — issue)
+ *   POST  /identity/service-accounts/:id/keys/rotate       (manage_keys — rotate)
+ *   POST  /identity/service-accounts/:id/keys/revoke       (manage_keys — revoke)
+ *
+ * ⛔ The tenant/actor are NEVER sent by the client — the server stamps them from the authenticated
+ * principal. An account is shown by LABEL (+ `createdByName`); its `id` rides only as the route key
+ * (never a display value). ⛔ The raw `ask_…` key comes back EXACTLY ONCE from issue/rotate — the
+ * view must reveal it immediately (it is never retrievable again).
+ */
+import type { HttpClient } from '../http/types.js';
+/** A service-account row as returned by the list/get/create/update endpoints (label-only). */
+export interface ServiceAccountView {
+    id: string;
+    label: string;
+    scopeSubtreeNodeIds: string[];
+    /** Resolved company names, same order as `scopeSubtreeNodeIds` (show these, never the ids). */
+    scopeLabels: string[];
+    roleIds: string[];
+    /** Resolved role names, same order as `roleIds` (show these, never the ids). */
+    roleLabels: string[];
+    status: string;
+    createdByName: string | null;
+    createdAtMs: number;
+    updatedAtMs: number | null;
+}
+/** A role the caller may grant (picker option). `id` is the value sent back; show `name`. */
+export interface AssignableRole {
+    id: string;
+    name: string;
+}
+/** A scope node (company) the caller may grant. `parentId` is set only when the parent is also assignable. */
+export interface AssignableScopeNode {
+    id: string;
+    name: string;
+    parentId: string | null;
+}
+/**
+ * What the caller may grant an agent — computed server-side from the SAME ceiling the create/update
+ * write enforces (ADR-0029), so the picker never offers what the save would reject. Nodes arrive
+ * tree-ordered (parent before children). An agent's existing role/node that is NOT in this set was
+ * assigned by someone with more access: show it checked + locked, and never send it — a non-root
+ * PATCH keeps it automatically (sending it is a 403).
+ */
+export interface AssignableAccess {
+    roles: AssignableRole[];
+    scopeNodes: AssignableScopeNode[];
+}
+/** The ONE-TIME key reveal returned by issue/rotate — the only time the raw key exists. */
+export interface IssuedKey {
+    apiKey: string;
+    accountLabel: string;
+    version: number;
+    expiresAtMs: number | null;
+}
+/** The create body — label + optional scope/roles (all ⊆ the caller's own, server-enforced). */
+export interface CreateServiceAccountBody {
+    label: string;
+    scopeSubtreeNodeIds?: string[];
+    roleIds?: string[];
+}
+/**
+ * The update patch — any subset of label/scope/roles/status. `scopeSubtreeNodeIds: []` is a 400
+ * (an agent needs at least one node). For a non-root caller, `roleIds` / `scopeSubtreeNodeIds` list
+ * only items from {@link AssignableAccess}; the agent's locked (out-of-ceiling) items are preserved.
+ */
+export interface UpdateServiceAccountBody {
+    label?: string;
+    scopeSubtreeNodeIds?: string[];
+    roleIds?: string[];
+    status?: 'active' | 'disabled';
+}
+export type ListResult = {
+    ok: true;
+    accounts: ServiceAccountView[];
+} | {
+    ok: false;
+    status: number;
+    error: string;
+};
+export type AccountResult = {
+    ok: true;
+    account: ServiceAccountView;
+} | {
+    ok: false;
+    status: number;
+    error: string;
+};
+export type KeyResult = {
+    ok: true;
+    key: IssuedKey;
+} | {
+    ok: false;
+    status: number;
+    error: string;
+};
+export type OkResult = {
+    ok: true;
+} | {
+    ok: false;
+    status: number;
+    error: string;
+};
+export type AssignableResult = ({
+    ok: true;
+} & AssignableAccess) | {
+    ok: false;
+    status: number;
+    error: string;
+};
+export interface ServiceAccountService {
+    list(accessToken: string): Promise<ListResult>;
+    /** The roles + scope nodes the caller may grant (picker source; `service_account:create`). */
+    listAssignable(accessToken: string): Promise<AssignableResult>;
+    get(accessToken: string, id: string): Promise<AccountResult>;
+    create(accessToken: string, body: CreateServiceAccountBody): Promise<AccountResult>;
+    update(accessToken: string, id: string, body: UpdateServiceAccountBody): Promise<AccountResult>;
+    issueKey(accessToken: string, id: string, opts?: {
+        expiresAtMs?: number;
+    }): Promise<KeyResult>;
+    rotateKey(accessToken: string, id: string, opts?: {
+        expiresAtMs?: number;
+    }): Promise<KeyResult>;
+    revokeKeys(accessToken: string, id: string): Promise<OkResult>;
+}
+export declare function createServiceAccountService(http: HttpClient): ServiceAccountService;
+//# sourceMappingURL=serviceAccountService.d.ts.map

package/dist/auth/serviceAccountService.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"serviceAccountService.d.ts","sourceRoot":"","sources":["../../src/auth/serviceAccountService.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAEnD,8FAA8F;AAC9F,MAAM,WAAW,kBAAkB;IACjC,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;IACd,mBAAmB,EAAE,MAAM,EAAE,CAAC;IAC9B,+FAA+F;IAC/F,WAAW,EAAE,MAAM,EAAE,CAAC;IACtB,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,gFAAgF;IAChF,UAAU,EAAE,MAAM,EAAE,CAAC;IACrB,MAAM,EAAE,MAAM,CAAC;IACf,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;CAC5B;AAED,6FAA6F;AAC7F,MAAM,WAAW,cAAc;IAC7B,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;CACd;AAED,8GAA8G;AAC9G,MAAM,WAAW,mBAAmB;IAClC,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;CACzB;AAED;;;;;;GAMG;AACH,MAAM,WAAW,gBAAgB;IAC/B,KAAK,EAAE,cAAc,EAAE,CAAC;IACxB,UAAU,EAAE,mBAAmB,EAAE,CAAC;CACnC;AAED,2FAA2F;AAC3F,MAAM,WAAW,SAAS;IACxB,MAAM,EAAE,MAAM,CAAC;IACf,YAAY,EAAE,MAAM,CAAC;IACrB,OAAO,EAAE,MAAM,CAAC;IAChB,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;CAC5B;AAED,gGAAgG;AAChG,MAAM,WAAW,wBAAwB;IACvC,KAAK,EAAE,MAAM,CAAC;IACd,mBAAmB,CAAC,EAAE,MAAM,EAAE,CAAC;IAC/B,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;CACpB;AAED;;;;GAIG;AACH,MAAM,WAAW,wBAAwB;IACvC,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,mBAAmB,CAAC,EAAE,MAAM,EAAE,CAAC;IAC/B,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;IACnB,MAAM,CAAC,EAAE,QAAQ,GAAG,UAAU,CAAC;CAChC;AAED,MAAM,MAAM,UAAU,GAClB;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,QAAQ,EAAE,kBAAkB,EAAE,CAAA;CAAE,GAC5C;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC;AACjD,MAAM,MAAM,aAAa,GACrB;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,OAAO,EAAE,kBAAkB,CAAA;CAAE,GACzC;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC;AACjD,MAAM,MAAM,SAAS,GACjB;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,GAAG,EAAE,SAAS,CAAA;CAAE,GAC5B;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC;AACjD,MAAM,MAAM,QAAQ,GAAG;IAAE,EAAE,EAAE,IAAI,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC;AACnF,MAAM,MAAM,gBAAgB,GACxB,CAAC;IAAE,EAAE,EAAE,IAAI,CAAA;CAAE,GAAG,gBAAgB,CAAC,GACjC;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC;AAEjD,MAAM,WAAW,qBAAqB;IACpC,IAAI,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC;IAC/C,8FAA8F;IAC9F,cAAc,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAAC;IAC/D,GAAG,CAAC,WAAW,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,CAAC,CAAC;IAC7D,MAAM,CAAC,WAAW,EAAE,MAAM,EAAE,IAAI,EAAE,wBAAwB,GAAG,OAAO,CAAC,aAAa,CAAC,CAAC;IACpF,MAAM,CAAC,WAAW,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,wBAAwB,GAAG,OAAO,CAAC,aAAa,CAAC,CAAC;IAChG,QAAQ,CAAC,WAAW,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE;QAAE,WAAW,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC;IAC/F,SAAS,CAAC,WAAW,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE;QAAE,WAAW,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC;IAChG,UAAU,CAAC,WAAW,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;CAChE;AAID,wBAAgB,2BAA2B,CAAC,IAAI,EAAE,UAAU,GAAG,qBAAqB,CAkGnF"}

package/dist/auth/serviceAccountService.js

@@ -0,0 +1,91 @@
+const BASE = '/identity/service-accounts';
+export function createServiceAccountService(http) {
+    /** Map a non-2xx response to a `{ ok:false }` with a friendly, status-specific message. */
+    function fail(r, generic) {
+        if (r.status === 401)
+            return { ok: false, status: 401, error: 'Not authenticated (no/invalid token).' };
+        if (r.status === 403) {
+            return { ok: false, status: 403, error: msgOf(r.data) || 'You do not have access to do this.' };
+        }
+        if (r.status === 404)
+            return { ok: false, status: 404, error: 'Service account not found.' };
+        if (r.status === 400)
+            return { ok: false, status: 400, error: msgOf(r.data) || generic };
+        if (r.status === 409) {
+            return { ok: false, status: 409, error: msgOf(r.data) || 'Someone else changed this just now — reload and try again.' };
+        }
+        return { ok: false, status: r.status, error: generic };
+    }
+    /** Pull a server error message (`{ message }`) when present. */
+    function msgOf(data) {
+        if (data && typeof data === 'object' && 'message' in data) {
+            const m = data.message;
+            if (typeof m === 'string')
+                return m;
+        }
+        return null;
+    }
+    const auth = (accessToken) => ({ bearerToken: accessToken });
+    return {
+        async list(accessToken) {
+            const r = await http.get(BASE, auth(accessToken));
+            if (r.ok) {
+                const accounts = r.data?.accounts ?? [];
+                return { ok: true, accounts };
+            }
+            return fail(r, 'Could not load service accounts.');
+        },
+        async listAssignable(accessToken) {
+            const r = await http.get(`${BASE}/assignable`, auth(accessToken));
+            if (r.ok) {
+                const d = (r.data ?? {});
+                return {
+                    ok: true,
+                    roles: Array.isArray(d.roles) ? d.roles : [],
+                    scopeNodes: Array.isArray(d.scopeNodes) ? d.scopeNodes : [],
+                };
+            }
+            // 404 here is not "account not found" — the route itself is missing/denied; keep it generic.
+            if (r.status === 404)
+                return { ok: false, status: 404, error: 'Could not load what you can assign.' };
+            return fail(r, 'Could not load what you can assign.');
+        },
+        async get(accessToken, id) {
+            const r = await http.get(`${BASE}/${encodeURIComponent(id)}`, auth(accessToken));
+            if (r.ok)
+                return { ok: true, account: r.data.account };
+            return fail(r, 'Could not load the service account.');
+        },
+        async create(accessToken, body) {
+            const r = await http.post(BASE, body, auth(accessToken));
+            if (r.ok)
+                return { ok: true, account: r.data.account };
+            return fail(r, 'Could not create the service account.');
+        },
+        async update(accessToken, id, body) {
+            const r = await http.patch(`${BASE}/${encodeURIComponent(id)}`, body, auth(accessToken));
+            if (r.ok)
+                return { ok: true, account: r.data.account };
+            return fail(r, 'Could not update the service account.');
+        },
+        async issueKey(accessToken, id, opts = {}) {
+            const r = await http.post(`${BASE}/${encodeURIComponent(id)}/keys`, opts.expiresAtMs !== undefined ? { expiresAtMs: opts.expiresAtMs } : {}, auth(accessToken));
+            if (r.ok)
+                return { ok: true, key: r.data.key };
+            return fail(r, 'Could not issue a key.');
+        },
+        async rotateKey(accessToken, id, opts = {}) {
+            const r = await http.post(`${BASE}/${encodeURIComponent(id)}/keys/rotate`, opts.expiresAtMs !== undefined ? { expiresAtMs: opts.expiresAtMs } : {}, auth(accessToken));
+            if (r.ok)
+                return { ok: true, key: r.data.key };
+            return fail(r, 'Could not rotate the key.');
+        },
+        async revokeKeys(accessToken, id) {
+            const r = await http.post(`${BASE}/${encodeURIComponent(id)}/keys/revoke`, {}, auth(accessToken));
+            if (r.ok)
+                return { ok: true };
+            return fail(r, 'Could not revoke the keys.');
+        },
+    };
+}
+//# sourceMappingURL=serviceAccountService.js.map

package/dist/auth/serviceAccountService.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"serviceAccountService.js","sourceRoot":"","sources":["../../src/auth/serviceAccountService.ts"],"names":[],"mappings":"AA0HA,MAAM,IAAI,GAAG,4BAA4B,CAAC;AAE1C,MAAM,UAAU,2BAA2B,CAAC,IAAgB;IAC1D,2FAA2F;IAC3F,SAAS,IAAI,CACX,CAAoC,EACpC,OAAe;QAEf,IAAI,CAAC,CAAC,MAAM,KAAK,GAAG;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,uCAAuC,EAAE,CAAC;QACxG,IAAI,CAAC,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;YACrB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,oCAAoC,EAAE,CAAC;QAClG,CAAC;QACD,IAAI,CAAC,CAAC,MAAM,KAAK,GAAG;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,4BAA4B,EAAE,CAAC;QAC7F,IAAI,CAAC,CAAC,MAAM,KAAK,GAAG;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,OAAO,EAAE,CAAC;QACzF,IAAI,CAAC,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;YACrB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,4DAA4D,EAAE,CAAC;QAC1H,CAAC;QACD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC;IACzD,CAAC;IAED,gEAAgE;IAChE,SAAS,KAAK,CAAC,IAAa;QAC1B,IAAI,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,SAAS,IAAI,IAAI,EAAE,CAAC;YAC1D,MAAM,CAAC,GAAI,IAA8B,CAAC,OAAO,CAAC;YAClD,IAAI,OAAO,CAAC,KAAK,QAAQ;gBAAE,OAAO,CAAC,CAAC;QACtC,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,IAAI,GAAG,CAAC,WAAmB,EAAE,EAAE,CAAC,CAAC,EAAE,WAAW,EAAE,WAAW,EAAE,CAAC,CAAC;IAErE,OAAO;QACL,KAAK,CAAC,IAAI,CAAC,WAAW;YACpB,MAAM,CAAC,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC;YAClD,IAAI,CAAC,CAAC,EAAE,EAAE,CAAC;gBACT,MAAM,QAAQ,GAAI,CAAC,CAAC,IAAmD,EAAE,QAAQ,IAAI,EAAE,CAAC;gBACxF,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;YAChC,CAAC;YACD,OAAO,IAAI,CAAC,CAAC,EAAE,kCAAkC,CAAC,CAAC;QACrD,CAAC;QAED,KAAK,CAAC,cAAc,CAAC,WAAW;YAC9B,MAAM,CAAC,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,GAAG,IAAI,aAAa,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC;YAClE,IAAI,CAAC,CAAC,EAAE,EAAE,CAAC;gBACT,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,IAAI,EAAE,CAA8B,CAAC;gBACtD,OAAO;oBACL,EAAE,EAAE,IAAI;oBACR,KAAK,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE;oBAC5C,UAAU,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE;iBAC5D,CAAC;YACJ,CAAC;YACD,6FAA6F;YAC7F,IAAI,CAAC,CAAC,MAAM,KAAK,GAAG;gBAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,qCAAqC,EAAE,CAAC;YACtG,OAAO,IAAI,CAAC,CAAC,EAAE,qCAAqC,CAAC,CAAC;QACxD,CAAC;QAED,KAAK,CAAC,GAAG,CAAC,WAAW,EAAE,EAAE;YACvB,MAAM,CAAC,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,GAAG,IAAI,IAAI,kBAAkB,CAAC,EAAE,CAAC,EAAE,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC;YACjF,IAAI,CAAC,CAAC,EAAE;gBAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAG,CAAC,CAAC,IAAwC,CAAC,OAAO,EAAE,CAAC;YAC5F,OAAO,IAAI,CAAC,CAAC,EAAE,qCAAqC,CAAC,CAAC;QACxD,CAAC;QAED,KAAK,CAAC,MAAM,CAAC,WAAW,EAAE,IAAI;YAC5B,MAAM,CAAC,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC;YACzD,IAAI,CAAC,CAAC,EAAE;gBAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAG,CAAC,CAAC,IAAwC,CAAC,OAAO,EAAE,CAAC;YAC5F,OAAO,IAAI,CAAC,CAAC,EAAE,uCAAuC,CAAC,CAAC;QAC1D,CAAC;QAED,KAAK,CAAC,MAAM,CAAC,WAAW,EAAE,EAAE,EAAE,IAAI;YAChC,MAAM,CAAC,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,GAAG,IAAI,IAAI,kBAAkB,CAAC,EAAE,CAAC,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC;YACzF,IAAI,CAAC,CAAC,EAAE;gBAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAG,CAAC,CAAC,IAAwC,CAAC,OAAO,EAAE,CAAC;YAC5F,OAAO,IAAI,CAAC,CAAC,EAAE,uCAAuC,CAAC,CAAC;QAC1D,CAAC;QAED,KAAK,CAAC,QAAQ,CAAC,WAAW,EAAE,EAAE,EAAE,IAAI,GAAG,EAAE;YACvC,MAAM,CAAC,GAAG,MAAM,IAAI,CAAC,IAAI,CACvB,GAAG,IAAI,IAAI,kBAAkB,CAAC,EAAE,CAAC,OAAO,EACxC,IAAI,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,EACvE,IAAI,CAAC,WAAW,CAAC,CAClB,CAAC;YACF,IAAI,CAAC,CAAC,EAAE;gBAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,GAAG,EAAG,CAAC,CAAC,IAA2B,CAAC,GAAG,EAAE,CAAC;YACvE,OAAO,IAAI,CAAC,CAAC,EAAE,wBAAwB,CAAC,CAAC;QAC3C,CAAC;QAED,KAAK,CAAC,SAAS,CAAC,WAAW,EAAE,EAAE,EAAE,IAAI,GAAG,EAAE;YACxC,MAAM,CAAC,GAAG,MAAM,IAAI,CAAC,IAAI,CACvB,GAAG,IAAI,IAAI,kBAAkB,CAAC,EAAE,CAAC,cAAc,EAC/C,IAAI,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,EACvE,IAAI,CAAC,WAAW,CAAC,CAClB,CAAC;YACF,IAAI,CAAC,CAAC,EAAE;gBAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,GAAG,EAAG,CAAC,CAAC,IAA2B,CAAC,GAAG,EAAE,CAAC;YACvE,OAAO,IAAI,CAAC,CAAC,EAAE,2BAA2B,CAAC,CAAC;QAC9C,CAAC;QAED,KAAK,CAAC,UAAU,CAAC,WAAW,EAAE,EAAE;YAC9B,MAAM,CAAC,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,GAAG,IAAI,IAAI,kBAAkB,CAAC,EAAE,CAAC,cAAc,EAAE,EAAE,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC;YAClG,IAAI,CAAC,CAAC,EAAE;gBAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;YAC9B,OAAO,IAAI,CAAC,CAAC,EAAE,4BAA4B,CAAC,CAAC;QAC/C,CAAC;KACF,CAAC;AACJ,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@astram/frontend-core",
-  "version": "0.3.0",
+  "version": "0.4.0",
   "license": "MIT",
   "publishConfig": {
     "access": "public"