@bentoforge/umami-iam 0.1.0

package/README.md

@@ -0,0 +1,60 @@
+# @bentoforge/umami-iam
+
+Typed TypeScript client SDK for the [umami](../../README.md) micro-IAM service. It holds the access
+token **in memory only** and silently refreshes it via the `HttpOnly` cookie on a 401 — the refresh
+token's value is never touched by JS.
+
+```bash
+npm install @bentoforge/umami-iam
+```
+
+```ts
+import { UmamiClient } from "@bentoforge/umami-iam";
+
+const umami = new UmamiClient({
+  baseUrl: "https://umami.example.com",
+  onTokenChange: (token) => {
+    /* update app state */
+  },
+});
+
+// Password login (handles the MFA challenge shape)
+const res = await umami.login("owner@acme.test", "secret");
+if (res.mfaRequired) {
+  await umami.login("owner@acme.test", "secret", "123456"); // with the TOTP code
+}
+
+const me = await umami.getMe();
+umami.hasPermission("write:members"); // decodes the token's claims
+
+// Passwordless passkey login (browser)
+await umami.loginWithPasskey("owner@acme.test");
+
+// Silent refresh on page reload
+await umami.refresh();
+```
+
+## What it covers
+
+- **Auth**: `login`, `refresh`, `logout`, `logoutAll`, `getMe`, `getClaims`, `hasPermission`
+- **MFA**: `totpSetup` / `totpVerify` / `totpDisable`; `registerPasskey` / `loginWithPasskey`
+  (wrapping `navigator.credentials`)
+- **API keys**: `exchangeApiKey` (M2M/BFF), plus `createApiKey` / `listApiKeys` / `deleteApiKey`
+- **Tenants**: signup, get/patch, status/license, packages, features, entitlements, usage
+- **Users**: `createUser` / `listUsers` / `patchUser`
+- **Config**: `getConfig` / `putConfig`
+
+All request/response types mirror the Rust server contract (see [`src/types.ts`](src/types.ts));
+errors throw `UmamiError` with the HTTP `status` and parsed `body`.
+
+## Build
+
+```bash
+npm install
+npm run build      # tsc → dist/
+npm run typecheck
+```
+
+> API keys are **server-side credentials** — never ship an `umk_…` key in browser JS. In a browser
+> use `login`/`loginWithPasskey` (user auth); use `exchangeApiKey` only from a backend/BFF. See
+> [docs/API-KEYS.md](../../docs/API-KEYS.md).

package/dist/client.d.ts

@@ -0,0 +1,180 @@
+import type { AccessClaims, ApiErrorBody, ApiKeyView, AuditEntry, Config, CreateApiKeyRequest, CreateApiKeyResponse, CreatePatRequest, CreateTenantRequest, CreateTenantResponse, CreateUserRequest, CustomFieldsSchema, EntitlementsResponse, ExchangeResponse, FeatureToggle, LoginResponse, MeResponse, MessagingCodeResponse, MessagingLink, MetricUsage, MfaStatus, PatchUserRequest, ResetPasswordResponse, ResolvedMessagingUser, Tenant, TenantStatus, TotpSetup, UsageResponse, UserView } from "./types.js";
+/** An error carrying the server's HTTP status and (parsed) body. */
+export declare class UmamiError extends Error {
+    readonly status: number;
+    readonly body?: ApiErrorBody;
+    constructor(status: number, message: string, body?: ApiErrorBody);
+}
+export interface UmamiClientOptions {
+    /** Base URL of the umami service, e.g. `https://umami.example.com`. */
+    baseUrl: string;
+    /** Called whenever the in-memory access token changes (login/refresh/logout). */
+    onTokenChange?: (token: string | null) => void;
+}
+/**
+ * Typed client for the umami API. Holds the access token **in memory only** and silently refreshes
+ * it via the `HttpOnly` cookie on a 401. Never touches the refresh cookie's value.
+ */
+export declare class UmamiClient {
+    private readonly baseUrl;
+    private readonly onTokenChange?;
+    private accessToken;
+    constructor(options: UmamiClientOptions);
+    /** The current in-memory access token, if any. */
+    getAccessToken(): string | null;
+    /** Decodes the current access token's claims (no signature verification). */
+    getClaims(): AccessClaims | null;
+    /** Whether the current token grants a permission. */
+    hasPermission(permission: string): boolean;
+    private setToken;
+    private doFetch;
+    /** Performs a request, refreshing once on a 401 for authenticated calls. */
+    private request;
+    private handle;
+    /** Password login by username. On success the access token is stored; if MFA is enabled and no
+     * `totpCode` is given, the response has `mfaRequired: true` and no token. Pass `api` to mint the
+     * token for a product API directly (default: the umami admin API); the session keeps that
+     * audience across refreshes. */
+    login(username: string, password: string, totpCode?: string, api?: string): Promise<LoginResponse>;
+    /** Silent refresh via the cookie. Returns whether a fresh token was obtained. */
+    refresh(): Promise<boolean>;
+    /** Logs out this device and clears the in-memory token. */
+    logout(): Promise<void>;
+    /** Revokes all of the user's sessions (bumps `tokenVersion`). */
+    logoutAll(): Promise<void>;
+    /** Current profile (user + tenant). */
+    getMe(): Promise<MeResponse>;
+    /** Update the caller's own profile (name/locale). Blocked for `self:readonly` users. */
+    patchMe(body: {
+        name?: string;
+        locale?: string;
+    }): Promise<MeResponse>;
+    /** Re-scope the access token to another tenant (requires `admin:system`). Access-token only —
+     * a later silent refresh returns to the home tenant. Returns the active tenant id. */
+    switchTenant(tenantId: string): Promise<string>;
+    totpSetup(): Promise<TotpSetup>;
+    totpVerify(code: string): Promise<MfaStatus>;
+    totpDisable(code: string): Promise<MfaStatus>;
+    /** Enrols a passkey for the authenticated user via `navigator.credentials.create`. */
+    registerPasskey(): Promise<{
+        credentialId: string;
+    }>;
+    /** Passwordless login with a passkey via `navigator.credentials.get`; stores the token. Pass
+     * `api` to mint the token for a product API directly (default: umami); the session keeps that
+     * audience across refreshes. */
+    loginWithPasskey(username: string, api?: string): Promise<void>;
+    /** Exchanges an `umk_…` API key for a short-lived token (stores it). Server-side/BFF use.
+     * `api` selects the target API when the key allows more than one (see `docs/AUDIENCES.md`). */
+    exchangeApiKey(apiKey: string, api?: string): Promise<ExchangeResponse>;
+    /** Downstream token exchange: mints a token for a product API (`api` from the config catalog)
+     * for the currently-logged-in user, WITHOUT replacing the stored umami token. Returns the
+     * downstream token for the caller to use against that API. */
+    exchange(api: string): Promise<ExchangeResponse>;
+    /** List every tenant (system-admin only; sorted newest-updated first, capped at 250). `q` is an
+     * optional case-insensitive search: whitespace-separated terms must all match (over name / slug /
+     * custom fields). `truncated` is true when more than 250 matched. */
+    listTenants(q?: string): Promise<{
+        tenants: Tenant[];
+        truncated: boolean;
+    }>;
+    /** Create a tenant and its first owner (system-admin only). */
+    createTenant(request: CreateTenantRequest): Promise<CreateTenantResponse>;
+    /** Delete a tenant — only succeeds when it has no users (system-admin only). */
+    deleteTenant(tenantId: string): Promise<{
+        status: string;
+    }>;
+    getTenant(tenantId: string): Promise<Tenant>;
+    patchTenant(tenantId: string, body: Partial<Pick<Tenant, "name" | "plan" | "customFields">>): Promise<Tenant>;
+    patchStatus(tenantId: string, status: TenantStatus): Promise<Tenant>;
+    patchLicense(tenantId: string, body: {
+        plan?: string;
+        billedUntil?: string;
+        seatsLimit?: number;
+    }): Promise<Tenant>;
+    getEntitlements(tenantId: string): Promise<EntitlementsResponse>;
+    assignPackage(tenantId: string, request: {
+        code: string;
+        monthlyPrice?: string;
+    }): Promise<Tenant>;
+    removePackage(tenantId: string, assignmentId: string): Promise<Tenant>;
+    setFeature(tenantId: string, code: string, value: FeatureToggle): Promise<Tenant>;
+    /** Role codes assignable to a user given their tenant's features (feeds the UI role picker). */
+    assignableRoles(userId: string): Promise<{
+        codes: string[];
+    }>;
+    /** Scope codes assignable to a service key in the given tenant. */
+    assignableScopes(tenantId: string): Promise<{
+        codes: string[];
+    }>;
+    /** Authorization features grantable to the given tenant right now (system admin). */
+    assignableFeatures(tenantId: string): Promise<{
+        codes: string[];
+    }>;
+    /** Grant an authorization feature to a tenant (system admin). */
+    grantFeature(tenantId: string, code: string): Promise<{
+        status: string;
+    }>;
+    /** Revoke an authorization feature from a tenant (system admin). */
+    revokeFeature(tenantId: string, code: string): Promise<{
+        status: string;
+    }>;
+    getUsage(tenantId: string): Promise<UsageResponse>;
+    incrementUsage(tenantId: string, metric: string, amount?: number): Promise<MetricUsage>;
+    createUser(request: CreateUserRequest): Promise<UserView>;
+    /** List the caller's tenant's users (sorted by recent activity, capped at 250). `q` is an
+     * optional case-insensitive search over username / email / name / custom fields. */
+    listUsers(q?: string): Promise<{
+        users: UserView[];
+        truncated: boolean;
+    }>;
+    patchUser(userId: string, body: PatchUserRequest): Promise<UserView>;
+    /** Hard-delete a user in the caller's tenant (cannot delete your own account). */
+    deleteUser(userId: string): Promise<{
+        status: string;
+    }>;
+    /** Admin reset of a user's password. Omit `newPassword` to have a temporary one generated and
+     * returned once. Invalidates the user's existing sessions/tokens. */
+    resetPassword(userId: string, newPassword?: string): Promise<ResetPasswordResponse>;
+    /** Change the current user's own password (verifies the current one; logs out other sessions). */
+    changePassword(currentPassword: string, newPassword: string): Promise<void>;
+    /** The current user's own audit trail (newest first). */
+    myAudit(limit?: number): Promise<AuditEntry[]>;
+    /** A tenant's audit trail (requires `admin:tenant`; own tenant). */
+    tenantAudit(tenantId: string, limit?: number): Promise<AuditEntry[]>;
+    /** The caller's current link code (rotated if expired), with deep links when configured. */
+    getMessagingCode(): Promise<MessagingCodeResponse>;
+    /** Replace the caller's link code (invalidates the old). */
+    regenerateMessagingCode(): Promise<MessagingCodeResponse>;
+    /** The caller's linked external identities. */
+    listMessagingLinks(): Promise<{
+        links: MessagingLink[];
+    }>;
+    /** Remove one of the caller's linked identities. */
+    deleteMessagingLink(platform: string, externalId: string): Promise<{
+        status: string;
+    }>;
+    /** Machine (`messaging:link`): claim a `(platform, externalId)` mapping from a link code. */
+    createMessagingLink(code: string, platform: string, externalId: string): Promise<{
+        userId: string;
+        tenantId: string;
+    }>;
+    /** Machine (`messaging:resolve`): resolve an identity to user info. */
+    resolveMessaging(platform: string, externalId: string): Promise<ResolvedMessagingUser>;
+    /** Machine (`messaging:resolve`): resolve an identity to a minted token for `api`. */
+    resolveMessagingToken(platform: string, externalId: string, api: string): Promise<{
+        accessToken: string;
+        expiresIn: number;
+    }>;
+    getConfig(): Promise<Config>;
+    putConfig(config: Config): Promise<Config>;
+    /** The user + tenant custom-field schemas (any authenticated admin; no `manage:config` needed). */
+    getCustomFields(): Promise<CustomFieldsSchema>;
+    createApiKey(tenantId: string, request: CreateApiKeyRequest): Promise<CreateApiKeyResponse>;
+    listApiKeys(tenantId: string): Promise<ApiKeyView[]>;
+    deleteApiKey(tenantId: string, keyId: string): Promise<void>;
+    /** Create a personal access token that acts as the current user (optionally down-scoped).
+     * The `apiKey` secret in the response is shown only once. */
+    createMyPat(request: CreatePatRequest): Promise<CreateApiKeyResponse>;
+    listMyPats(): Promise<ApiKeyView[]>;
+    deleteMyPat(keyId: string): Promise<void>;
+}

package/dist/client.js

@@ -0,0 +1,429 @@
+import { assertionToJSON, b64urlToBuffer, registrationToJSON, toCreationOptions, toRequestOptions, } from "./webauthn.js";
+/** An error carrying the server's HTTP status and (parsed) body. */
+export class UmamiError extends Error {
+    constructor(status, message, body) {
+        super(message);
+        this.name = "UmamiError";
+        this.status = status;
+        this.body = body;
+    }
+}
+/**
+ * Typed client for the umami API. Holds the access token **in memory only** and silently refreshes
+ * it via the `HttpOnly` cookie on a 401. Never touches the refresh cookie's value.
+ */
+export class UmamiClient {
+    constructor(options) {
+        this.accessToken = null;
+        this.baseUrl = options.baseUrl.replace(/\/+$/, "");
+        this.onTokenChange = options.onTokenChange;
+    }
+    /** The current in-memory access token, if any. */
+    getAccessToken() {
+        return this.accessToken;
+    }
+    /** Decodes the current access token's claims (no signature verification). */
+    getClaims() {
+        if (!this.accessToken)
+            return null;
+        const parts = this.accessToken.split(".");
+        if (parts.length < 2)
+            return null;
+        try {
+            const json = new TextDecoder().decode(b64urlToBuffer(parts[1]));
+            return JSON.parse(json);
+        }
+        catch {
+            return null;
+        }
+    }
+    /** Whether the current token grants a permission. */
+    hasPermission(permission) {
+        return this.getClaims()?.permissions?.includes(permission) ?? false;
+    }
+    setToken(token) {
+        this.accessToken = token;
+        this.onTokenChange?.(token);
+    }
+    // ── transport ───────────────────────────────────────────────────────────────
+    doFetch(path, init, useAuth) {
+        const headers = new Headers(init.headers);
+        if (init.body != null && !headers.has("content-type")) {
+            headers.set("content-type", "application/json");
+        }
+        if (useAuth && this.accessToken) {
+            headers.set("authorization", `Bearer ${this.accessToken}`);
+        }
+        return fetch(`${this.baseUrl}${path}`, { ...init, headers, credentials: "include" });
+    }
+    /** Performs a request, refreshing once on a 401 for authenticated calls. */
+    async request(path, init = {}, useAuth = true) {
+        let response = await this.doFetch(path, init, useAuth);
+        if (response.status === 401 && useAuth) {
+            const refreshed = await this.refresh().catch(() => false);
+            if (refreshed)
+                response = await this.doFetch(path, init, useAuth);
+        }
+        return this.handle(response);
+    }
+    async handle(response) {
+        if (!response.ok) {
+            let body;
+            try {
+                body = (await response.json());
+            }
+            catch {
+                // non-JSON error body
+            }
+            throw new UmamiError(response.status, body?.message ?? response.statusText, body);
+        }
+        if (response.status === 204)
+            return undefined;
+        const text = await response.text();
+        return (text ? JSON.parse(text) : undefined);
+    }
+    // ── auth ────────────────────────────────────────────────────────────────────
+    /** Password login by username. On success the access token is stored; if MFA is enabled and no
+     * `totpCode` is given, the response has `mfaRequired: true` and no token. Pass `api` to mint the
+     * token for a product API directly (default: the umami admin API); the session keeps that
+     * audience across refreshes. */
+    async login(username, password, totpCode, api) {
+        const data = await this.request("/auth/login", { method: "POST", body: JSON.stringify({ username, password, totpCode, api }) }, false);
+        if (data.accessToken)
+            this.setToken(data.accessToken);
+        return data;
+    }
+    /** Silent refresh via the cookie. Returns whether a fresh token was obtained. */
+    async refresh() {
+        const response = await this.doFetch("/auth/refresh", { method: "POST" }, false);
+        if (!response.ok) {
+            this.setToken(null);
+            return false;
+        }
+        const data = (await response.json());
+        this.setToken(data.accessToken);
+        return true;
+    }
+    /** Logs out this device and clears the in-memory token. */
+    async logout() {
+        await this.request("/auth/logout", { method: "POST" }, false).catch(() => undefined);
+        this.setToken(null);
+    }
+    /** Revokes all of the user's sessions (bumps `tokenVersion`). */
+    async logoutAll() {
+        await this.request("/auth/logout-all", { method: "POST" }, true);
+    }
+    /** Current profile (user + tenant). */
+    getMe() {
+        return this.request("/auth/me");
+    }
+    /** Update the caller's own profile (name/locale). Blocked for `self:readonly` users. */
+    patchMe(body) {
+        return this.request("/auth/me", { method: "PATCH", body: JSON.stringify(body) });
+    }
+    /** Re-scope the access token to another tenant (requires `admin:system`). Access-token only —
+     * a later silent refresh returns to the home tenant. Returns the active tenant id. */
+    async switchTenant(tenantId) {
+        const data = await this.request("/auth/switch-tenant", {
+            method: "POST",
+            body: JSON.stringify({ tenantId }),
+        });
+        this.setToken(data.accessToken);
+        return this.getClaims()?.tenant ?? tenantId;
+    }
+    // ── MFA: TOTP ─────────────────────────────────────────────────────────────────
+    totpSetup() {
+        return this.request("/auth/mfa/totp/setup", { method: "POST" });
+    }
+    totpVerify(code) {
+        return this.request("/auth/mfa/totp/verify", {
+            method: "POST",
+            body: JSON.stringify({ code }),
+        });
+    }
+    totpDisable(code) {
+        return this.request("/auth/mfa/totp/disable", {
+            method: "POST",
+            body: JSON.stringify({ code }),
+        });
+    }
+    // ── MFA: WebAuthn (passkeys) ──────────────────────────────────────────────────
+    /** Enrols a passkey for the authenticated user via `navigator.credentials.create`. */
+    async registerPasskey() {
+        const start = await this.request("/auth/webauthn/register/start", { method: "POST" });
+        const publicKey = toCreationOptions(start.options.publicKey);
+        const credential = (await navigator.credentials.create({
+            publicKey,
+        }));
+        if (!credential)
+            throw new Error("Passkey registration was cancelled");
+        return this.request("/auth/webauthn/register/finish", {
+            method: "POST",
+            body: JSON.stringify({
+                ceremonyId: start.ceremonyId,
+                credential: registrationToJSON(credential),
+            }),
+        });
+    }
+    /** Passwordless login with a passkey via `navigator.credentials.get`; stores the token. Pass
+     * `api` to mint the token for a product API directly (default: umami); the session keeps that
+     * audience across refreshes. */
+    async loginWithPasskey(username, api) {
+        const start = await this.request("/auth/webauthn/login/start", { method: "POST", body: JSON.stringify({ username }) }, false);
+        const publicKey = toRequestOptions(start.options.publicKey);
+        const credential = (await navigator.credentials.get({
+            publicKey,
+        }));
+        if (!credential)
+            throw new Error("Passkey login was cancelled");
+        const data = await this.request("/auth/webauthn/login/finish", {
+            method: "POST",
+            body: JSON.stringify({
+                ceremonyId: start.ceremonyId,
+                credential: assertionToJSON(credential),
+                api,
+            }),
+        }, false);
+        this.setToken(data.accessToken);
+    }
+    // ── API-key exchange (M2M / BFF) ──────────────────────────────────────────────
+    /** Exchanges an `umk_…` API key for a short-lived token (stores it). Server-side/BFF use.
+     * `api` selects the target API when the key allows more than one (see `docs/AUDIENCES.md`). */
+    async exchangeApiKey(apiKey, api) {
+        const data = await this.request("/auth/token", { method: "POST", body: JSON.stringify(api ? { apiKey, api } : { apiKey }) }, false);
+        this.setToken(data.accessToken);
+        return data;
+    }
+    /** Downstream token exchange: mints a token for a product API (`api` from the config catalog)
+     * for the currently-logged-in user, WITHOUT replacing the stored umami token. Returns the
+     * downstream token for the caller to use against that API. */
+    exchange(api) {
+        return this.request("/auth/exchange", {
+            method: "POST",
+            body: JSON.stringify({ api }),
+        });
+    }
+    // ── tenants ────────────────────────────────────────────────────────────────────
+    /** List every tenant (system-admin only; sorted newest-updated first, capped at 250). `q` is an
+     * optional case-insensitive search: whitespace-separated terms must all match (over name / slug /
+     * custom fields). `truncated` is true when more than 250 matched. */
+    listTenants(q) {
+        const qs = q ? `?q=${encodeURIComponent(q)}` : "";
+        return this.request(`/tenants${qs}`);
+    }
+    /** Create a tenant and its first owner (system-admin only). */
+    createTenant(request) {
+        return this.request("/tenants", {
+            method: "POST",
+            body: JSON.stringify(request),
+        });
+    }
+    /** Delete a tenant — only succeeds when it has no users (system-admin only). */
+    deleteTenant(tenantId) {
+        return this.request(`/tenants/${enc(tenantId)}`, { method: "DELETE" });
+    }
+    getTenant(tenantId) {
+        return this.request(`/tenants/${enc(tenantId)}`);
+    }
+    patchTenant(tenantId, body) {
+        return this.request(`/tenants/${enc(tenantId)}`, {
+            method: "PATCH",
+            body: JSON.stringify(body),
+        });
+    }
+    patchStatus(tenantId, status) {
+        return this.request(`/tenants/${enc(tenantId)}/status`, {
+            method: "PATCH",
+            body: JSON.stringify({ status }),
+        });
+    }
+    patchLicense(tenantId, body) {
+        return this.request(`/tenants/${enc(tenantId)}/license`, {
+            method: "PATCH",
+            body: JSON.stringify(body),
+        });
+    }
+    getEntitlements(tenantId) {
+        return this.request(`/tenants/${enc(tenantId)}/entitlements`);
+    }
+    assignPackage(tenantId, request) {
+        return this.request(`/tenants/${enc(tenantId)}/packages`, {
+            method: "POST",
+            body: JSON.stringify(request),
+        });
+    }
+    removePackage(tenantId, assignmentId) {
+        return this.request(`/tenants/${enc(tenantId)}/packages/${enc(assignmentId)}`, {
+            method: "DELETE",
+        });
+    }
+    setFeature(tenantId, code, value) {
+        return this.request(`/tenants/${enc(tenantId)}/features/${enc(code)}`, {
+            method: "PUT",
+            body: JSON.stringify({ value }),
+        });
+    }
+    // ── authorization: assignable roles/scopes/features + feature grant/revoke ─────
+    /** Role codes assignable to a user given their tenant's features (feeds the UI role picker). */
+    assignableRoles(userId) {
+        return this.request(`/users/${enc(userId)}/assignable-roles`);
+    }
+    /** Scope codes assignable to a service key in the given tenant. */
+    assignableScopes(tenantId) {
+        return this.request(`/tenants/${enc(tenantId)}/assignable-scopes`);
+    }
+    /** Authorization features grantable to the given tenant right now (system admin). */
+    assignableFeatures(tenantId) {
+        return this.request(`/tenants/${enc(tenantId)}/assignable-features`);
+    }
+    /** Grant an authorization feature to a tenant (system admin). */
+    grantFeature(tenantId, code) {
+        return this.request(`/tenants/${enc(tenantId)}/features/${enc(code)}`, {
+            method: "POST",
+        });
+    }
+    /** Revoke an authorization feature from a tenant (system admin). */
+    revokeFeature(tenantId, code) {
+        return this.request(`/tenants/${enc(tenantId)}/features/${enc(code)}`, {
+            method: "DELETE",
+        });
+    }
+    getUsage(tenantId) {
+        return this.request(`/tenants/${enc(tenantId)}/usage`);
+    }
+    incrementUsage(tenantId, metric, amount = 1) {
+        return this.request(`/tenants/${enc(tenantId)}/usage/${enc(metric)}`, {
+            method: "POST",
+            body: JSON.stringify({ amount }),
+        });
+    }
+    // ── users ────────────────────────────────────────────────────────────────────
+    createUser(request) {
+        return this.request("/users", { method: "POST", body: JSON.stringify(request) });
+    }
+    /** List the caller's tenant's users (sorted by recent activity, capped at 250). `q` is an
+     * optional case-insensitive search over username / email / name / custom fields. */
+    listUsers(q) {
+        const qs = q ? `?q=${encodeURIComponent(q)}` : "";
+        return this.request(`/users${qs}`);
+    }
+    patchUser(userId, body) {
+        return this.request(`/users/${enc(userId)}`, {
+            method: "PATCH",
+            body: JSON.stringify(body),
+        });
+    }
+    /** Hard-delete a user in the caller's tenant (cannot delete your own account). */
+    deleteUser(userId) {
+        return this.request(`/users/${enc(userId)}`, { method: "DELETE" });
+    }
+    /** Admin reset of a user's password. Omit `newPassword` to have a temporary one generated and
+     * returned once. Invalidates the user's existing sessions/tokens. */
+    resetPassword(userId, newPassword) {
+        return this.request(`/users/${enc(userId)}/password`, {
+            method: "POST",
+            body: JSON.stringify(newPassword ? { newPassword } : {}),
+        });
+    }
+    // ── Self-service password + audit ──────────────────────────────────────────────
+    /** Change the current user's own password (verifies the current one; logs out other sessions). */
+    async changePassword(currentPassword, newPassword) {
+        await this.request("/auth/me/password", {
+            method: "POST",
+            body: JSON.stringify({ currentPassword, newPassword }),
+        });
+    }
+    /** The current user's own audit trail (newest first). */
+    async myAudit(limit) {
+        const qs = limit ? `?limit=${limit}` : "";
+        const data = await this.request(`/auth/me/audit${qs}`);
+        return data.entries;
+    }
+    /** A tenant's audit trail (requires `admin:tenant`; own tenant). */
+    async tenantAudit(tenantId, limit) {
+        const qs = limit ? `?limit=${limit}` : "";
+        const data = await this.request(`/tenants/${enc(tenantId)}/audit${qs}`);
+        return data.entries;
+    }
+    // ── messaging links ─────────────────────────────────────────────────────────
+    /** The caller's current link code (rotated if expired), with deep links when configured. */
+    getMessagingCode() {
+        return this.request("/auth/me/messaging-code");
+    }
+    /** Replace the caller's link code (invalidates the old). */
+    regenerateMessagingCode() {
+        return this.request("/auth/me/messaging-code/regenerate", {
+            method: "POST",
+        });
+    }
+    /** The caller's linked external identities. */
+    listMessagingLinks() {
+        return this.request("/auth/me/messaging-links");
+    }
+    /** Remove one of the caller's linked identities. */
+    deleteMessagingLink(platform, externalId) {
+        return this.request(`/auth/me/messaging-links/${enc(platform)}/${enc(externalId)}`, { method: "DELETE" });
+    }
+    /** Machine (`messaging:link`): claim a `(platform, externalId)` mapping from a link code. */
+    createMessagingLink(code, platform, externalId) {
+        return this.request("/messaging/links", {
+            method: "POST",
+            body: JSON.stringify({ code, platform, externalId }),
+        });
+    }
+    /** Machine (`messaging:resolve`): resolve an identity to user info. */
+    resolveMessaging(platform, externalId) {
+        const qs = `?platform=${encodeURIComponent(platform)}&externalId=${encodeURIComponent(externalId)}`;
+        return this.request(`/messaging/resolve${qs}`);
+    }
+    /** Machine (`messaging:resolve`): resolve an identity to a minted token for `api`. */
+    resolveMessagingToken(platform, externalId, api) {
+        const qs = `?platform=${encodeURIComponent(platform)}&externalId=${encodeURIComponent(externalId)}` +
+            `&format=jwt&api=${encodeURIComponent(api)}`;
+        return this.request(`/messaging/resolve${qs}`);
+    }
+    // ── config ────────────────────────────────────────────────────────────────────
+    getConfig() {
+        return this.request("/config");
+    }
+    putConfig(config) {
+        return this.request("/config", { method: "PUT", body: JSON.stringify(config) });
+    }
+    /** The user + tenant custom-field schemas (any authenticated admin; no `manage:config` needed). */
+    getCustomFields() {
+        return this.request("/config/custom-fields");
+    }
+    // ── API keys: tenant service keys (write:members) ──────────────────────────────
+    createApiKey(tenantId, request) {
+        return this.request(`/tenants/${enc(tenantId)}/api-keys`, {
+            method: "POST",
+            body: JSON.stringify(request),
+        });
+    }
+    async listApiKeys(tenantId) {
+        const data = await this.request(`/tenants/${enc(tenantId)}/api-keys`);
+        return data.keys;
+    }
+    async deleteApiKey(tenantId, keyId) {
+        await this.request(`/tenants/${enc(tenantId)}/api-keys/${enc(keyId)}`, { method: "DELETE" });
+    }
+    // ── Personal access tokens: your own (self-service) ────────────────────────────
+    /** Create a personal access token that acts as the current user (optionally down-scoped).
+     * The `apiKey` secret in the response is shown only once. */
+    createMyPat(request) {
+        return this.request("/auth/me/api-keys", {
+            method: "POST",
+            body: JSON.stringify(request),
+        });
+    }
+    async listMyPats() {
+        const data = await this.request("/auth/me/api-keys");
+        return data.keys;
+    }
+    async deleteMyPat(keyId) {
+        await this.request(`/auth/me/api-keys/${enc(keyId)}`, { method: "DELETE" });
+    }
+}
+function enc(value) {
+    return encodeURIComponent(value);
+}

package/dist/index.d.ts

@@ -0,0 +1,4 @@
+export type { UmamiClientOptions } from "./client.js";
+export { UmamiClient, UmamiError } from "./client.js";
+export * from "./types.js";
+export { assertionToJSON, b64urlToBuffer, bufferToB64url, registrationToJSON, toCreationOptions, toRequestOptions, } from "./webauthn.js";