@baseworks/iam 1.2.0 → 1.4.0

package/dist/{chunk-26XPWBFV.js → chunk-NAVQMKZ3.js}

@@ -17,6 +17,13 @@ var UserEvents = defineAggregate("user", {
     name: z.string().nullable(),
     picture: z.string().nullable(),
     at: z.number().int()
+  }),
+  // The person chose what they are called here (iam-service 0.5). Kept apart
+  // from `name`, which the identity provider sends on every sign-in and would
+  // otherwise overwrite it. `null` means "back to what the provider says".
+  UserRenamed: z.object({
+    displayName: z.string().min(1).nullable(),
+    at: z.number().int()
   })
 });
 var TOKEN_TYPES = ["user", "service", "cli", "agent"];

package/dist/cli.js

@@ -17,21 +17,10 @@ function buildIamCommand(deps) {
       ["id", user.id]
     ]);
   });
-  const users = iam.command("users").description("user directory");
-  users.command("find <email>").description("resolve a user id by exact email (for invites)").action(async (email) => {
-    const { user } = await http.get(
-      `/users/lookup?email=${encodeURIComponent(email)}`
-    ).catch(die);
-    kv([
-      ["id", user.id],
-      ["email", user.email],
-      ["name", user.name ?? "\u2014"]
-    ]);
-  });
   const token = iam.command("token").description("api tokens (service / cli / agent credentials)");
   outputOpt(token.command("list")).description("active tokens you can see").action(async (opts) => {
     const { tokens } = await http.get(
-      "/v1/tokens"
+      "/tokens"
     ).catch(die);
     printOutput(
       tokens,
@@ -45,7 +34,7 @@ function buildIamCommand(deps) {
     );
   });
   token.command("issue <name>").description("issue a token; the secret is printed once").option("--type <type>", "user | service | cli | agent", "service").option("--org <id>", "bind to an organization (opaque context)").option("--scope <scope...>", "grant scopes").action(async (name, opts) => {
-    const res = await http.post("/v1/tokens", {
+    const res = await http.post("/tokens", {
       name,
       type: opts.type,
       org_id: opts.org ?? null,
@@ -58,7 +47,7 @@ function buildIamCommand(deps) {
     ]);
   });
   token.command("revoke <id>").description("revoke a token by id").action(async (id) => {
-    await http.del(`/v1/tokens/${encodeURIComponent(id)}`).catch(die);
+    await http.del(`/tokens/${encodeURIComponent(id)}`).catch(die);
     success(`token revoked: ${id}`);
   });
   return iam;

package/dist/client.d.ts

@@ -10,6 +10,8 @@ interface UserRow {
     email: string;
     name: string | null;
     picture: string | null;
+    /** What the person chose to be called here; null or absent: the provider's `name`. */
+    display_name?: string | null;
     created_at: number;
     updated_at: number;
 }
@@ -38,12 +40,27 @@ interface User {
     created_at: number;
     updated_at: number;
 }
-/** Public-safe identity projection (returned by /me and /users/lookup). */
+/**
+ * Public-safe identity projection (returned by /users/lookup and
+ * /users/resolve). `name` is what the person chose to be called, else what
+ * their identity provider says.
+ */
 interface PublicUser {
     id: string;
     email: string;
     name: string | null;
 }
+/** A person's own account, as `/me` gives it to them and to nobody else. */
+interface Me extends PublicUser {
+    /** The name the identity provider sends; what `name` falls back to. */
+    provider_name: string | null;
+    /** True when `name` is one the person set here. */
+    name_is_own: boolean;
+    picture: string | null;
+    /** The identity provider this account signs in with. */
+    issuer: string;
+    created_at: number;
+}
 /** An OIDC identity presented to POST /sync (before a user id exists). */
 interface OidcIdentity {
     subject: string;
@@ -137,8 +154,15 @@ declare class IamClient {
     api<T>(method: string, path: string, body?: unknown, extra?: Record<string, string>): Promise<T>;
     /** Generic ApiClient (get/post/del) — used by the CLI plugin. */
     get http(): HttpClient;
-    /** The signed-in user's own identity (no orgs — those live in @baseworks/org). */
-    me(): Promise<PublicUser>;
+    /** The signed-in user's own account (no orgs — those live in @baseworks/org). */
+    me(): Promise<Me>;
+    /**
+     * Set what the signed-in person is called here. `null` goes back to the name
+     * their identity provider sends. Email and picture are the provider's.
+     */
+    updateMe(input: {
+        name: string | null;
+    }): Promise<Me>;
     /** Upsert an OIDC identity → the platform user. Called by auth-service (no auth). */
     sync(identity: OidcIdentity): Promise<{
         id: string;
@@ -175,4 +199,4 @@ declare class IamClient {
 /** Factory used by the SDK capability registry. */
 declare function createIamClient(opts: IamClientOptions): IamClient;
 
-export { type ApiToken, type ApiTokenRow, type AuthContext, type HttpClient, IamClient, type IamClientOptions, IamError, type IssuedToken, type OidcIdentity, type PublicUser, type TokenPrincipal, TokenType, type User, type UserRow, createIamClient };
+export { type ApiToken, type ApiTokenRow, type AuthContext, type HttpClient, IamClient, type IamClientOptions, IamError, type IssuedToken, type Me, type OidcIdentity, type PublicUser, type TokenPrincipal, TokenType, type User, type UserRow, createIamClient };

package/dist/client.js

@@ -1,6 +1,6 @@
 import {
   TOKEN_TYPES
-} from "./chunk-26XPWBFV.js";
+} from "./chunk-NAVQMKZ3.js";
 
 // src/client.ts
 var IamError = class extends Error {
@@ -62,11 +62,19 @@ var IamClient = class _IamClient {
     };
   }
   // ── identity ────────────────────────────────────────────────────────────────
-  /** The signed-in user's own identity (no orgs — those live in @baseworks/org). */
+  /** The signed-in user's own account (no orgs — those live in @baseworks/org). */
   async me() {
     const { user } = await this.api("GET", "/me");
     return user;
   }
+  /**
+   * Set what the signed-in person is called here. `null` goes back to the name
+   * their identity provider sends. Email and picture are the provider's.
+   */
+  async updateMe(input) {
+    const { user } = await this.api("PATCH", "/me", input);
+    return user;
+  }
   /** Upsert an OIDC identity → the platform user. Called by auth-service (no auth). */
   async sync(identity) {
     const { user } = await this.api("POST", "/sync", identity);

package/dist/events.d.ts

@@ -55,6 +55,16 @@ declare const UserEvents: _baseworks_foldbase.EventCatalog<{
         name: string | null;
         picture: string | null;
     }>;
+    UserRenamed: z.ZodObject<{
+        displayName: z.ZodNullable<z.ZodString>;
+        at: z.ZodNumber;
+    }, "strip", z.ZodTypeAny, {
+        at: number;
+        displayName: string | null;
+    }, {
+        at: number;
+        displayName: string | null;
+    }>;
 }> & {
     newId(): string;
 };

package/dist/events.js

@@ -3,7 +3,7 @@ import {
   TOKEN_TYPES,
   TokenType,
   UserEvents
-} from "./chunk-26XPWBFV.js";
+} from "./chunk-NAVQMKZ3.js";
 export {
   ApiTokenEvents,
   TOKEN_TYPES,

package/dist/projections.js

@@ -1,7 +1,7 @@
 import {
   ApiTokenEvents,
   UserEvents
-} from "./chunk-26XPWBFV.js";
+} from "./chunk-NAVQMKZ3.js";
 
 // src/projections.ts
 import { defineProjection } from "@baseworks/foldbase";
@@ -18,6 +18,9 @@ var readUsers = defineProjection("users", UserEvents, (on) => ({
     email: e.email,
     name: e.name,
     picture: e.picture
+  })),
+  UserRenamed: on.UserRenamed.upsert((e) => ({
+    display_name: e.displayName
   }))
 }));
 var readApiTokens = defineProjection("api_tokens", ApiTokenEvents, (on) => ({

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@baseworks/iam",
-  "version": "1.2.0",
+  "version": "1.4.0",
   "description": "IAM capability: identity (users) + credentials (api tokens). Typed HTTP client, foldbase event catalog, projections, and CLI plugin for iam-service. Contract-first, versioned with the service. Roles/PDP live in @baseworks/org.",
   "type": "module",
   "publishConfig": {
@@ -20,7 +20,7 @@
     "@baseworks/cli": "^0.2.0",
     "commander": "^15.0.0",
     "zod": "^3.25.76",
-    "@baseworks/foldbase": "0.1.1"
+    "@baseworks/foldbase": "0.2.0"
   },
   "devDependencies": {
     "@types/node": "^22.20.0",

package/src/__tests__/cli.test.ts

@@ -27,15 +27,12 @@ describe('flect iam whoami', () => {
   })
 })
 
-// ── users find ────────────────────────────────────────────────────────────────
+// ── no users find ─────────────────────────────────────────────────────────────
 
-describe('flect iam users find', () => {
-  it('resolves a user id by email', async () => {
-    mocks.mockGet('/users/lookup', { user: USER })
+describe('flect iam users', () => {
+  it('is gone: looking a person up by email is for services, not for a CLI', async () => {
     const r = await run(['iam', 'users', 'find', 'ali@acme.test'])
-    expect(r.exitCode).toBe(0)
-    expect(r.stdout).toContain(USER.id)
-    expect(r.stdout).toContain('ali@acme.test')
+    expect(r.stdout + r.stderr).toMatch(/unknown command/)
   })
 })
 
@@ -43,7 +40,7 @@ describe('flect iam users find', () => {
 
 describe('flect iam token', () => {
   it('list renders NAME / TYPE / PREFIX columns', async () => {
-    mocks.mockGet('/v1/tokens', {
+    mocks.mockGet('/tokens', {
       tokens: [{ id: 't1', name: 'ci', type: 'service', key_prefix: 'bwt_abc12345', expires_at: null }],
     })
     const r = await run(['iam', 'token', 'list'])
@@ -54,14 +51,14 @@ describe('flect iam token', () => {
   })
 
   it('issue prints the one-time secret', async () => {
-    mocks.mockPost('/v1/tokens', { token: { id: 't1', key_prefix: 'bwt_secret1234' }, secret: 'bwt_secret1234_rest' })
+    mocks.mockPost('/tokens', { token: { id: 't1', key_prefix: 'bwt_secret1234' }, secret: 'bwt_secret1234_rest' })
     const r = await run(['iam', 'token', 'issue', 'ci', '--type', 'service'])
     expect(r.exitCode).toBe(0)
     expect(r.stdout).toContain('bwt_secret1234_rest')
   })
 
   it('revoke calls DELETE and reports success', async () => {
-    mocks.mockDelete('/v1/tokens/t1')
+    mocks.mockDelete('/tokens/t1')
     const r = await run(['iam', 'token', 'revoke', 't1'])
     expect(r.exitCode).toBe(0)
     expect(r.stdout).toContain('t1')

package/src/cli.ts

@@ -41,24 +41,11 @@ export function buildIamCommand(deps: IamCliDeps): Command {
       ])
     })
 
-  // ── users ─────────────────────────────────────────────────────────────────--
-  const users = iam.command('users').description('user directory')
-
-  users
-    .command('find <email>')
-    .description('resolve a user id by exact email (for invites)')
-    .action(async (email: string) => {
-      const { user } = await http
-        .get<{ user: { id: string; email: string; name: string | null } }>(
-          `/users/lookup?email=${encodeURIComponent(email)}`,
-        )
-        .catch(die)
-      kv([
-        ['id', user.id],
-        ['email', user.email],
-        ['name', user.name ?? '—'],
-      ])
-    })
+  // There is no `users find <email>`. It asked iam "does this address have an
+  // account here?" with a person's token, which is an account-existence oracle;
+  // iam answers that to services only now. Invite by email instead
+  // (`org invite <email>`): the invitation reaches the person without anyone
+  // learning their user id first.
 
   // ── token (credentials) ───────────────────────────────────────────────────--
   const token = iam.command('token').description('api tokens (service / cli / agent credentials)')
@@ -68,7 +55,7 @@ export function buildIamCommand(deps: IamCliDeps): Command {
     .action(async (opts: { output?: string }) => {
       const { tokens } = await http
         .get<{ tokens: Array<{ id: string; name: string; type: string; key_prefix: string; expires_at: number | null }> }>(
-          '/v1/tokens',
+          '/tokens',
         )
         .catch(die)
       printOutput(tokens as unknown as Record<string, unknown>[], opts.output, () =>
@@ -89,7 +76,7 @@ export function buildIamCommand(deps: IamCliDeps): Command {
     .option('--scope <scope...>', 'grant scopes')
     .action(async (name: string, opts: { type?: string; org?: string; scope?: string[] }) => {
       const res = await http
-        .post<{ token: { id: string; key_prefix: string }; secret: string }>('/v1/tokens', {
+        .post<{ token: { id: string; key_prefix: string }; secret: string }>('/tokens', {
           name,
           type: opts.type,
           org_id: opts.org ?? null,
@@ -107,7 +94,7 @@ export function buildIamCommand(deps: IamCliDeps): Command {
     .command('revoke <id>')
     .description('revoke a token by id')
     .action(async (id: string) => {
-      await http.del(`/v1/tokens/${encodeURIComponent(id)}`).catch(die)
+      await http.del(`/tokens/${encodeURIComponent(id)}`).catch(die)
       success(`token revoked: ${id}`)
     })
 

package/src/client.ts

@@ -1,4 +1,4 @@
-import type { PublicUser, OidcIdentity, ApiToken, IssuedToken, TokenPrincipal, TokenType } from './types.js'
+import type { PublicUser, Me, OidcIdentity, ApiToken, IssuedToken, TokenPrincipal, TokenType } from './types.js'
 
 // Value re-export (a runtime const, not just a type) so consumers can build
 // validators from it, e.g. `z.enum(TOKEN_TYPES)`.
@@ -7,6 +7,7 @@ export { TOKEN_TYPES } from './types.js'
 export type {
   User,
   PublicUser,
+  Me,
   OidcIdentity,
   ApiToken,
   IssuedToken,
@@ -112,9 +113,18 @@ export class IamClient {
 
   // ── identity ────────────────────────────────────────────────────────────────
 
-  /** The signed-in user's own identity (no orgs — those live in @baseworks/org). */
-  async me(): Promise<PublicUser> {
-    const { user } = await this.api<{ user: PublicUser }>('GET', '/me')
+  /** The signed-in user's own account (no orgs — those live in @baseworks/org). */
+  async me(): Promise<Me> {
+    const { user } = await this.api<{ user: Me }>('GET', '/me')
+    return user
+  }
+
+  /**
+   * Set what the signed-in person is called here. `null` goes back to the name
+   * their identity provider sends. Email and picture are the provider's.
+   */
+  async updateMe(input: { name: string | null }): Promise<Me> {
+    const { user } = await this.api<{ user: Me }>('PATCH', '/me', input)
     return user
   }
 

package/src/events.ts

@@ -36,6 +36,13 @@ export const UserEvents = defineAggregate('user', {
     picture: z.string().nullable(),
     at: z.number().int(),
   }),
+  // The person chose what they are called here (iam-service 0.5). Kept apart
+  // from `name`, which the identity provider sends on every sign-in and would
+  // otherwise overwrite it. `null` means "back to what the provider says".
+  UserRenamed: z.object({
+    displayName: z.string().min(1).nullable(),
+    at: z.number().int(),
+  }),
 })
 
 // ── api_token ───────────────────────────────────────────────────────────────

package/src/projections.ts

@@ -25,6 +25,9 @@ export const readUsers = defineProjection('users', UserEvents, (on) => ({
     name: e.name,
     picture: e.picture,
   })),
+  UserRenamed: on.UserRenamed.upsert((e) => ({
+    display_name: e.displayName,
+  })),
 }))
 
 export const readApiTokens = defineProjection('api_tokens', ApiTokenEvents, (on) => ({

package/src/types.ts

@@ -14,6 +14,8 @@ export interface UserRow {
   email: string
   name: string | null
   picture: string | null
+  /** What the person chose to be called here; null or absent: the provider's `name`. */
+  display_name?: string | null
   created_at: number
   updated_at: number
 }
@@ -51,13 +53,29 @@ export interface User {
   updated_at: number
 }
 
-/** Public-safe identity projection (returned by /me and /users/lookup). */
+/**
+ * Public-safe identity projection (returned by /users/lookup and
+ * /users/resolve). `name` is what the person chose to be called, else what
+ * their identity provider says.
+ */
 export interface PublicUser {
   id: string
   email: string
   name: string | null
 }
 
+/** A person's own account, as `/me` gives it to them and to nobody else. */
+export interface Me extends PublicUser {
+  /** The name the identity provider sends; what `name` falls back to. */
+  provider_name: string | null
+  /** True when `name` is one the person set here. */
+  name_is_own: boolean
+  picture: string | null
+  /** The identity provider this account signs in with. */
+  issuer: string
+  created_at: number
+}
+
 /** An OIDC identity presented to POST /sync (before a user id exists). */
 export interface OidcIdentity {
   subject: string