@baseworks/iam 1.4.0 → 1.5.0

package/dist/client.d.ts

@@ -193,6 +193,28 @@ declare class IamClient {
         org_id?: string;
     }): Promise<ApiToken[]>;
     revokeToken(id: string): Promise<void>;
+    /**
+     * The keys that belong to an organization. Needs `iam:org_key.read` there,
+     * which org-service decides; the answer says whether the caller may also
+     * manage them. A person's token: a service uses `listTokens({ org_id })`.
+     */
+    listOrgKeys(orgRef: string): Promise<{
+        org_id: string;
+        role: string;
+        can_manage: boolean;
+        keys: ApiToken[];
+    }>;
+    /** Create a key for an organization; the secret is returned once. Needs `iam:org_key.manage`. */
+    createOrgKey(orgRef: string, input: {
+        name: string;
+        type?: 'service' | 'agent';
+        access?: 'read' | 'write';
+        /** The role the key acts with; never above the caller's, never owner. Default `member`. */
+        role?: 'viewer' | 'member' | 'admin';
+        expires_at?: number | null;
+    }): Promise<IssuedToken>;
+    /** Revoke one of an organization's keys. Needs `iam:org_key.manage`. */
+    revokeOrgKey(orgRef: string, id: string): Promise<void>;
     /** Verify a raw token secret → its principal, or throw IamError(401). */
     verifyToken(secret: string): Promise<TokenPrincipal>;
 }

package/dist/client.js

@@ -112,6 +112,23 @@ var IamClient = class _IamClient {
   async revokeToken(id) {
     await this.api("DELETE", `/tokens/${encodeURIComponent(id)}`);
   }
+  // ── an organization's keys (a realm with an org-service only) ───────────────
+  /**
+   * The keys that belong to an organization. Needs `iam:org_key.read` there,
+   * which org-service decides; the answer says whether the caller may also
+   * manage them. A person's token: a service uses `listTokens({ org_id })`.
+   */
+  async listOrgKeys(orgRef) {
+    return this.api("GET", `/orgs/${encodeURIComponent(orgRef)}/keys`);
+  }
+  /** Create a key for an organization; the secret is returned once. Needs `iam:org_key.manage`. */
+  async createOrgKey(orgRef, input) {
+    return this.api("POST", `/orgs/${encodeURIComponent(orgRef)}/keys`, input);
+  }
+  /** Revoke one of an organization's keys. Needs `iam:org_key.manage`. */
+  async revokeOrgKey(orgRef, id) {
+    await this.api("DELETE", `/orgs/${encodeURIComponent(orgRef)}/keys/${encodeURIComponent(id)}`);
+  }
   /** Verify a raw token secret → its principal, or throw IamError(401). */
   async verifyToken(secret) {
     const { principal } = await this.api("POST", "/tokens/verify", { token: secret });

package/dist/events.d.ts

@@ -25,17 +25,17 @@ declare const UserEvents: _baseworks_foldbase.EventCatalog<{
         picture: z.ZodNullable<z.ZodString>;
         at: z.ZodNumber;
     }, "strip", z.ZodTypeAny, {
-        email: string;
         at: number;
         subject: string;
         issuer: string;
+        email: string;
         name: string | null;
         picture: string | null;
     }, {
-        email: string;
         at: number;
         subject: string;
         issuer: string;
+        email: string;
         name: string | null;
         picture: string | null;
     }>;
@@ -45,13 +45,13 @@ declare const UserEvents: _baseworks_foldbase.EventCatalog<{
         picture: z.ZodNullable<z.ZodString>;
         at: z.ZodNumber;
     }, "strip", z.ZodTypeAny, {
-        email: string;
         at: number;
+        email: string;
         name: string | null;
         picture: string | null;
     }, {
-        email: string;
         at: number;
+        email: string;
         name: string | null;
         picture: string | null;
     }>;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@baseworks/iam",
-  "version": "1.4.0",
+  "version": "1.5.0",
   "description": "IAM capability: identity (users) + credentials (api tokens). Typed HTTP client, foldbase event catalog, projections, and CLI plugin for iam-service. Contract-first, versioned with the service. Roles/PDP live in @baseworks/org.",
   "type": "module",
   "publishConfig": {

package/src/client.ts

@@ -180,6 +180,34 @@ export class IamClient {
     await this.api('DELETE', `/tokens/${encodeURIComponent(id)}`)
   }
 
+  // ── an organization's keys (a realm with an org-service only) ───────────────
+
+  /**
+   * The keys that belong to an organization. Needs `iam:org_key.read` there,
+   * which org-service decides; the answer says whether the caller may also
+   * manage them. A person's token: a service uses `listTokens({ org_id })`.
+   */
+  async listOrgKeys(orgRef: string): Promise<{ org_id: string; role: string; can_manage: boolean; keys: ApiToken[] }> {
+    return this.api('GET', `/orgs/${encodeURIComponent(orgRef)}/keys`)
+  }
+
+  /** Create a key for an organization; the secret is returned once. Needs `iam:org_key.manage`. */
+  async createOrgKey(orgRef: string, input: {
+    name: string
+    type?: 'service' | 'agent'
+    access?: 'read' | 'write'
+    /** The role the key acts with; never above the caller's, never owner. Default `member`. */
+    role?: 'viewer' | 'member' | 'admin'
+    expires_at?: number | null
+  }): Promise<IssuedToken> {
+    return this.api<IssuedToken>('POST', `/orgs/${encodeURIComponent(orgRef)}/keys`, input)
+  }
+
+  /** Revoke one of an organization's keys. Needs `iam:org_key.manage`. */
+  async revokeOrgKey(orgRef: string, id: string): Promise<void> {
+    await this.api('DELETE', `/orgs/${encodeURIComponent(orgRef)}/keys/${encodeURIComponent(id)}`)
+  }
+
   /** Verify a raw token secret → its principal, or throw IamError(401). */
   async verifyToken(secret: string): Promise<TokenPrincipal> {
     const { principal } = await this.api<{ principal: TokenPrincipal }>('POST', '/tokens/verify', { token: secret })