@baseworks/iam 1.3.0 → 1.5.0

package/dist/{chunk-26XPWBFV.js → chunk-NAVQMKZ3.js}

@@ -17,6 +17,13 @@ var UserEvents = defineAggregate("user", {
     name: z.string().nullable(),
     picture: z.string().nullable(),
     at: z.number().int()
+  }),
+  // The person chose what they are called here (iam-service 0.5). Kept apart
+  // from `name`, which the identity provider sends on every sign-in and would
+  // otherwise overwrite it. `null` means "back to what the provider says".
+  UserRenamed: z.object({
+    displayName: z.string().min(1).nullable(),
+    at: z.number().int()
   })
 });
 var TOKEN_TYPES = ["user", "service", "cli", "agent"];

package/dist/client.d.ts

@@ -10,6 +10,8 @@ interface UserRow {
     email: string;
     name: string | null;
     picture: string | null;
+    /** What the person chose to be called here; null or absent: the provider's `name`. */
+    display_name?: string | null;
     created_at: number;
     updated_at: number;
 }
@@ -38,12 +40,27 @@ interface User {
     created_at: number;
     updated_at: number;
 }
-/** Public-safe identity projection (returned by /me and /users/lookup). */
+/**
+ * Public-safe identity projection (returned by /users/lookup and
+ * /users/resolve). `name` is what the person chose to be called, else what
+ * their identity provider says.
+ */
 interface PublicUser {
     id: string;
     email: string;
     name: string | null;
 }
+/** A person's own account, as `/me` gives it to them and to nobody else. */
+interface Me extends PublicUser {
+    /** The name the identity provider sends; what `name` falls back to. */
+    provider_name: string | null;
+    /** True when `name` is one the person set here. */
+    name_is_own: boolean;
+    picture: string | null;
+    /** The identity provider this account signs in with. */
+    issuer: string;
+    created_at: number;
+}
 /** An OIDC identity presented to POST /sync (before a user id exists). */
 interface OidcIdentity {
     subject: string;
@@ -137,8 +154,15 @@ declare class IamClient {
     api<T>(method: string, path: string, body?: unknown, extra?: Record<string, string>): Promise<T>;
     /** Generic ApiClient (get/post/del) — used by the CLI plugin. */
     get http(): HttpClient;
-    /** The signed-in user's own identity (no orgs — those live in @baseworks/org). */
-    me(): Promise<PublicUser>;
+    /** The signed-in user's own account (no orgs — those live in @baseworks/org). */
+    me(): Promise<Me>;
+    /**
+     * Set what the signed-in person is called here. `null` goes back to the name
+     * their identity provider sends. Email and picture are the provider's.
+     */
+    updateMe(input: {
+        name: string | null;
+    }): Promise<Me>;
     /** Upsert an OIDC identity → the platform user. Called by auth-service (no auth). */
     sync(identity: OidcIdentity): Promise<{
         id: string;
@@ -169,10 +193,32 @@ declare class IamClient {
         org_id?: string;
     }): Promise<ApiToken[]>;
     revokeToken(id: string): Promise<void>;
+    /**
+     * The keys that belong to an organization. Needs `iam:org_key.read` there,
+     * which org-service decides; the answer says whether the caller may also
+     * manage them. A person's token: a service uses `listTokens({ org_id })`.
+     */
+    listOrgKeys(orgRef: string): Promise<{
+        org_id: string;
+        role: string;
+        can_manage: boolean;
+        keys: ApiToken[];
+    }>;
+    /** Create a key for an organization; the secret is returned once. Needs `iam:org_key.manage`. */
+    createOrgKey(orgRef: string, input: {
+        name: string;
+        type?: 'service' | 'agent';
+        access?: 'read' | 'write';
+        /** The role the key acts with; never above the caller's, never owner. Default `member`. */
+        role?: 'viewer' | 'member' | 'admin';
+        expires_at?: number | null;
+    }): Promise<IssuedToken>;
+    /** Revoke one of an organization's keys. Needs `iam:org_key.manage`. */
+    revokeOrgKey(orgRef: string, id: string): Promise<void>;
     /** Verify a raw token secret → its principal, or throw IamError(401). */
     verifyToken(secret: string): Promise<TokenPrincipal>;
 }
 /** Factory used by the SDK capability registry. */
 declare function createIamClient(opts: IamClientOptions): IamClient;
 
-export { type ApiToken, type ApiTokenRow, type AuthContext, type HttpClient, IamClient, type IamClientOptions, IamError, type IssuedToken, type OidcIdentity, type PublicUser, type TokenPrincipal, TokenType, type User, type UserRow, createIamClient };
+export { type ApiToken, type ApiTokenRow, type AuthContext, type HttpClient, IamClient, type IamClientOptions, IamError, type IssuedToken, type Me, type OidcIdentity, type PublicUser, type TokenPrincipal, TokenType, type User, type UserRow, createIamClient };

package/dist/client.js

@@ -1,6 +1,6 @@
 import {
   TOKEN_TYPES
-} from "./chunk-26XPWBFV.js";
+} from "./chunk-NAVQMKZ3.js";
 
 // src/client.ts
 var IamError = class extends Error {
@@ -62,11 +62,19 @@ var IamClient = class _IamClient {
     };
   }
   // ── identity ────────────────────────────────────────────────────────────────
-  /** The signed-in user's own identity (no orgs — those live in @baseworks/org). */
+  /** The signed-in user's own account (no orgs — those live in @baseworks/org). */
   async me() {
     const { user } = await this.api("GET", "/me");
     return user;
   }
+  /**
+   * Set what the signed-in person is called here. `null` goes back to the name
+   * their identity provider sends. Email and picture are the provider's.
+   */
+  async updateMe(input) {
+    const { user } = await this.api("PATCH", "/me", input);
+    return user;
+  }
   /** Upsert an OIDC identity → the platform user. Called by auth-service (no auth). */
   async sync(identity) {
     const { user } = await this.api("POST", "/sync", identity);
@@ -104,6 +112,23 @@ var IamClient = class _IamClient {
   async revokeToken(id) {
     await this.api("DELETE", `/tokens/${encodeURIComponent(id)}`);
   }
+  // ── an organization's keys (a realm with an org-service only) ───────────────
+  /**
+   * The keys that belong to an organization. Needs `iam:org_key.read` there,
+   * which org-service decides; the answer says whether the caller may also
+   * manage them. A person's token: a service uses `listTokens({ org_id })`.
+   */
+  async listOrgKeys(orgRef) {
+    return this.api("GET", `/orgs/${encodeURIComponent(orgRef)}/keys`);
+  }
+  /** Create a key for an organization; the secret is returned once. Needs `iam:org_key.manage`. */
+  async createOrgKey(orgRef, input) {
+    return this.api("POST", `/orgs/${encodeURIComponent(orgRef)}/keys`, input);
+  }
+  /** Revoke one of an organization's keys. Needs `iam:org_key.manage`. */
+  async revokeOrgKey(orgRef, id) {
+    await this.api("DELETE", `/orgs/${encodeURIComponent(orgRef)}/keys/${encodeURIComponent(id)}`);
+  }
   /** Verify a raw token secret → its principal, or throw IamError(401). */
   async verifyToken(secret) {
     const { principal } = await this.api("POST", "/tokens/verify", { token: secret });

package/dist/events.d.ts

@@ -55,6 +55,16 @@ declare const UserEvents: _baseworks_foldbase.EventCatalog<{
         name: string | null;
         picture: string | null;
     }>;
+    UserRenamed: z.ZodObject<{
+        displayName: z.ZodNullable<z.ZodString>;
+        at: z.ZodNumber;
+    }, "strip", z.ZodTypeAny, {
+        at: number;
+        displayName: string | null;
+    }, {
+        at: number;
+        displayName: string | null;
+    }>;
 }> & {
     newId(): string;
 };

package/dist/events.js

@@ -3,7 +3,7 @@ import {
   TOKEN_TYPES,
   TokenType,
   UserEvents
-} from "./chunk-26XPWBFV.js";
+} from "./chunk-NAVQMKZ3.js";
 export {
   ApiTokenEvents,
   TOKEN_TYPES,

package/dist/projections.js

@@ -1,7 +1,7 @@
 import {
   ApiTokenEvents,
   UserEvents
-} from "./chunk-26XPWBFV.js";
+} from "./chunk-NAVQMKZ3.js";
 
 // src/projections.ts
 import { defineProjection } from "@baseworks/foldbase";
@@ -18,6 +18,9 @@ var readUsers = defineProjection("users", UserEvents, (on) => ({
     email: e.email,
     name: e.name,
     picture: e.picture
+  })),
+  UserRenamed: on.UserRenamed.upsert((e) => ({
+    display_name: e.displayName
   }))
 }));
 var readApiTokens = defineProjection("api_tokens", ApiTokenEvents, (on) => ({

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@baseworks/iam",
-  "version": "1.3.0",
+  "version": "1.5.0",
   "description": "IAM capability: identity (users) + credentials (api tokens). Typed HTTP client, foldbase event catalog, projections, and CLI plugin for iam-service. Contract-first, versioned with the service. Roles/PDP live in @baseworks/org.",
   "type": "module",
   "publishConfig": {
@@ -20,7 +20,7 @@
     "@baseworks/cli": "^0.2.0",
     "commander": "^15.0.0",
     "zod": "^3.25.76",
-    "@baseworks/foldbase": "0.1.1"
+    "@baseworks/foldbase": "0.2.0"
   },
   "devDependencies": {
     "@types/node": "^22.20.0",

package/src/client.ts

@@ -1,4 +1,4 @@
-import type { PublicUser, OidcIdentity, ApiToken, IssuedToken, TokenPrincipal, TokenType } from './types.js'
+import type { PublicUser, Me, OidcIdentity, ApiToken, IssuedToken, TokenPrincipal, TokenType } from './types.js'
 
 // Value re-export (a runtime const, not just a type) so consumers can build
 // validators from it, e.g. `z.enum(TOKEN_TYPES)`.
@@ -7,6 +7,7 @@ export { TOKEN_TYPES } from './types.js'
 export type {
   User,
   PublicUser,
+  Me,
   OidcIdentity,
   ApiToken,
   IssuedToken,
@@ -112,9 +113,18 @@ export class IamClient {
 
   // ── identity ────────────────────────────────────────────────────────────────
 
-  /** The signed-in user's own identity (no orgs — those live in @baseworks/org). */
-  async me(): Promise<PublicUser> {
-    const { user } = await this.api<{ user: PublicUser }>('GET', '/me')
+  /** The signed-in user's own account (no orgs — those live in @baseworks/org). */
+  async me(): Promise<Me> {
+    const { user } = await this.api<{ user: Me }>('GET', '/me')
+    return user
+  }
+
+  /**
+   * Set what the signed-in person is called here. `null` goes back to the name
+   * their identity provider sends. Email and picture are the provider's.
+   */
+  async updateMe(input: { name: string | null }): Promise<Me> {
+    const { user } = await this.api<{ user: Me }>('PATCH', '/me', input)
     return user
   }
 
@@ -170,6 +180,34 @@ export class IamClient {
     await this.api('DELETE', `/tokens/${encodeURIComponent(id)}`)
   }
 
+  // ── an organization's keys (a realm with an org-service only) ───────────────
+
+  /**
+   * The keys that belong to an organization. Needs `iam:org_key.read` there,
+   * which org-service decides; the answer says whether the caller may also
+   * manage them. A person's token: a service uses `listTokens({ org_id })`.
+   */
+  async listOrgKeys(orgRef: string): Promise<{ org_id: string; role: string; can_manage: boolean; keys: ApiToken[] }> {
+    return this.api('GET', `/orgs/${encodeURIComponent(orgRef)}/keys`)
+  }
+
+  /** Create a key for an organization; the secret is returned once. Needs `iam:org_key.manage`. */
+  async createOrgKey(orgRef: string, input: {
+    name: string
+    type?: 'service' | 'agent'
+    access?: 'read' | 'write'
+    /** The role the key acts with; never above the caller's, never owner. Default `member`. */
+    role?: 'viewer' | 'member' | 'admin'
+    expires_at?: number | null
+  }): Promise<IssuedToken> {
+    return this.api<IssuedToken>('POST', `/orgs/${encodeURIComponent(orgRef)}/keys`, input)
+  }
+
+  /** Revoke one of an organization's keys. Needs `iam:org_key.manage`. */
+  async revokeOrgKey(orgRef: string, id: string): Promise<void> {
+    await this.api('DELETE', `/orgs/${encodeURIComponent(orgRef)}/keys/${encodeURIComponent(id)}`)
+  }
+
   /** Verify a raw token secret → its principal, or throw IamError(401). */
   async verifyToken(secret: string): Promise<TokenPrincipal> {
     const { principal } = await this.api<{ principal: TokenPrincipal }>('POST', '/tokens/verify', { token: secret })

package/src/events.ts

@@ -36,6 +36,13 @@ export const UserEvents = defineAggregate('user', {
     picture: z.string().nullable(),
     at: z.number().int(),
   }),
+  // The person chose what they are called here (iam-service 0.5). Kept apart
+  // from `name`, which the identity provider sends on every sign-in and would
+  // otherwise overwrite it. `null` means "back to what the provider says".
+  UserRenamed: z.object({
+    displayName: z.string().min(1).nullable(),
+    at: z.number().int(),
+  }),
 })
 
 // ── api_token ───────────────────────────────────────────────────────────────

package/src/projections.ts

@@ -25,6 +25,9 @@ export const readUsers = defineProjection('users', UserEvents, (on) => ({
     name: e.name,
     picture: e.picture,
   })),
+  UserRenamed: on.UserRenamed.upsert((e) => ({
+    display_name: e.displayName,
+  })),
 }))
 
 export const readApiTokens = defineProjection('api_tokens', ApiTokenEvents, (on) => ({

package/src/types.ts

@@ -14,6 +14,8 @@ export interface UserRow {
   email: string
   name: string | null
   picture: string | null
+  /** What the person chose to be called here; null or absent: the provider's `name`. */
+  display_name?: string | null
   created_at: number
   updated_at: number
 }
@@ -51,13 +53,29 @@ export interface User {
   updated_at: number
 }
 
-/** Public-safe identity projection (returned by /me and /users/lookup). */
+/**
+ * Public-safe identity projection (returned by /users/lookup and
+ * /users/resolve). `name` is what the person chose to be called, else what
+ * their identity provider says.
+ */
 export interface PublicUser {
   id: string
   email: string
   name: string | null
 }
 
+/** A person's own account, as `/me` gives it to them and to nobody else. */
+export interface Me extends PublicUser {
+  /** The name the identity provider sends; what `name` falls back to. */
+  provider_name: string | null
+  /** True when `name` is one the person set here. */
+  name_is_own: boolean
+  picture: string | null
+  /** The identity provider this account signs in with. */
+  issuer: string
+  created_at: number
+}
+
 /** An OIDC identity presented to POST /sync (before a user id exists). */
 export interface OidcIdentity {
   subject: string