@clawscarf/cli 0.1.0-alpha.1

package/services/access/generated/types.gen.d.ts

@@ -0,0 +1,349 @@
+export type ClientOptions = {
+    baseUrl: `${string}://services` | (string & {});
+};
+/**
+ * Client input failures return 400 (including malformed JSON), 413 for oversized bodies, or 415 for unsupported media types. Native request_rejected returns 409 for a confirmed rejection; outcome_unknown returns 503 when a mutation result cannot be established. Request IDs correlate service failures with sanitized diagnostics.
+ */
+export type Problem = {
+    type: string;
+    title: string;
+    status: number;
+    code: string;
+    detail: string;
+    requestId: string;
+};
+export type User = {
+    id: string;
+    identity: string;
+    name: string;
+    email: string;
+};
+export type NavigationLink = {
+    label: string;
+    href: string;
+};
+export type Role = {
+    id: string;
+    administrator: boolean;
+};
+export type Person = {
+    id: string;
+    identity: string;
+    name: string;
+    email: string;
+    role: string | null;
+};
+export type Invitation = {
+    id: string;
+    email: string;
+    expiresAt: string;
+    status: 'pending' | 'accepted' | 'revoked' | 'expired';
+};
+export type HealthData = {
+    body?: never;
+    path?: never;
+    query?: never;
+    url: '/_clawscarf/health';
+};
+export type HealthErrors = {
+    /**
+     * Failure
+     */
+    default: Problem;
+};
+export type HealthError = HealthErrors[keyof HealthErrors];
+export type HealthResponses = {
+    /**
+     * Success
+     */
+    200: {
+        status: 'ok';
+    };
+};
+export type HealthResponse = HealthResponses[keyof HealthResponses];
+export type StartLoginData = {
+    body?: never;
+    path?: never;
+    query?: {
+        returnTo?: string;
+        /**
+         * Private, one-use first-administrator setup token.
+         */
+        setup?: string;
+        /**
+         * Private, one-use member invitation token.
+         */
+        invitation?: string;
+    };
+    url: '/_clawscarf/login';
+};
+export type StartLoginErrors = {
+    /**
+     * Failure. Browser requests accepting text/html receive a sign-in error page; API clients receive Problem Details.
+     */
+    default: Problem;
+};
+export type StartLoginError = StartLoginErrors[keyof StartLoginErrors];
+export type StartLoginResponses = {
+    /**
+     * Failure. Browser requests accepting text/html receive a sign-in error page; API clients receive Problem Details.
+     */
+    default: Problem;
+};
+export type StartLoginResponse = StartLoginResponses[keyof StartLoginResponses];
+export type CompleteLoginData = {
+    body?: never;
+    path?: never;
+    query: {
+        state: string;
+        code?: string;
+        error?: string;
+        error_description?: string;
+        iss?: string;
+    };
+    url: '/_clawscarf/callback';
+};
+export type CompleteLoginErrors = {
+    /**
+     * Failure. Browser requests accepting text/html receive a sign-in error page; API clients receive Problem Details.
+     */
+    default: Problem;
+};
+export type CompleteLoginError = CompleteLoginErrors[keyof CompleteLoginErrors];
+export type CompleteLoginResponses = {
+    /**
+     * Failure. Browser requests accepting text/html receive a sign-in error page; API clients receive Problem Details.
+     */
+    default: Problem;
+};
+export type CompleteLoginResponse = CompleteLoginResponses[keyof CompleteLoginResponses];
+export type SessionData = {
+    body?: never;
+    path?: never;
+    query?: never;
+    url: '/_clawscarf/session';
+};
+export type SessionErrors = {
+    /**
+     * Failure
+     */
+    default: Problem;
+};
+export type SessionError = SessionErrors[keyof SessionErrors];
+export type SessionResponses = {
+    /**
+     * Success
+     */
+    200: {
+        user: User;
+        csrfToken: string;
+        enrollmentEnabled: boolean;
+        links: Array<NavigationLink>;
+    };
+};
+export type SessionResponse = SessionResponses[keyof SessionResponses];
+export type LogoutData = {
+    body?: never;
+    path?: never;
+    query?: never;
+    url: '/_clawscarf/logout';
+};
+export type LogoutErrors = {
+    /**
+     * Failure
+     */
+    default: Problem;
+};
+export type LogoutError = LogoutErrors[keyof LogoutErrors];
+export type LogoutResponses = {
+    /**
+     * Success
+     */
+    200: {
+        redirect: string;
+    };
+};
+export type LogoutResponse = LogoutResponses[keyof LogoutResponses];
+export type ListPeopleData = {
+    body?: never;
+    path?: never;
+    query?: never;
+    url: '/_clawscarf/people';
+};
+export type ListPeopleErrors = {
+    /**
+     * Failure
+     */
+    default: Problem;
+};
+export type ListPeopleError = ListPeopleErrors[keyof ListPeopleErrors];
+export type ListPeopleResponses = {
+    /**
+     * Success
+     */
+    200: {
+        people: Array<Person>;
+        /**
+         * Current native enrollment configuration, observed without mutation after administrator authorization.
+         */
+        enrollment: 'ready' | 'preparation_required' | 'configuration_required';
+        roles: Array<Role>;
+    };
+};
+export type ListPeopleResponse = ListPeopleResponses[keyof ListPeopleResponses];
+export type EnrollPersonData = {
+    body: {
+        subject: string;
+        email: string;
+        name: string;
+    };
+    path?: never;
+    query?: never;
+    url: '/_clawscarf/people';
+};
+export type EnrollPersonErrors = {
+    /**
+     * Failure
+     */
+    default: Problem;
+};
+export type EnrollPersonError = EnrollPersonErrors[keyof EnrollPersonErrors];
+export type EnrollPersonResponses = {
+    /**
+     * Success
+     */
+    200: User;
+};
+export type EnrollPersonResponse = EnrollPersonResponses[keyof EnrollPersonResponses];
+export type RemovePersonData = {
+    body?: never;
+    path: {
+        userId: string;
+    };
+    query?: never;
+    url: '/_clawscarf/people/{userId}';
+};
+export type RemovePersonErrors = {
+    /**
+     * Failure
+     */
+    default: Problem;
+};
+export type RemovePersonError = RemovePersonErrors[keyof RemovePersonErrors];
+export type RemovePersonResponses = {
+    /**
+     * Success
+     */
+    200: unknown;
+};
+export type PrepareTeamData = {
+    body?: never;
+    path?: never;
+    query?: never;
+    url: '/_clawscarf/team';
+};
+export type PrepareTeamErrors = {
+    /**
+     * Failure
+     */
+    default: Problem;
+};
+export type PrepareTeamError = PrepareTeamErrors[keyof PrepareTeamErrors];
+export type PrepareTeamResponses = {
+    /**
+     * Success
+     */
+    200: unknown;
+};
+export type SetPersonRoleData = {
+    body: {
+        role: string;
+        expectedRole: string | null;
+    };
+    path: {
+        userId: string;
+    };
+    query?: never;
+    url: '/_clawscarf/people/{userId}/role';
+};
+export type SetPersonRoleErrors = {
+    /**
+     * Failure
+     */
+    default: Problem;
+};
+export type SetPersonRoleError = SetPersonRoleErrors[keyof SetPersonRoleErrors];
+export type SetPersonRoleResponses = {
+    /**
+     * Success
+     */
+    200: unknown;
+};
+export type ListInvitationsData = {
+    body?: never;
+    path?: never;
+    query?: never;
+    url: '/_clawscarf/invitations';
+};
+export type ListInvitationsErrors = {
+    /**
+     * Failure
+     */
+    default: Problem;
+};
+export type ListInvitationsError = ListInvitationsErrors[keyof ListInvitationsErrors];
+export type ListInvitationsResponses = {
+    /**
+     * Success
+     */
+    200: {
+        invitations: Array<Invitation>;
+    };
+};
+export type ListInvitationsResponse = ListInvitationsResponses[keyof ListInvitationsResponses];
+export type CreateInvitationData = {
+    body: {
+        email: string;
+    };
+    path?: never;
+    query?: never;
+    url: '/_clawscarf/invitations';
+};
+export type CreateInvitationErrors = {
+    /**
+     * Failure
+     */
+    default: Problem;
+};
+export type CreateInvitationError = CreateInvitationErrors[keyof CreateInvitationErrors];
+export type CreateInvitationResponses = {
+    /**
+     * Success
+     */
+    200: {
+        invitation: Invitation;
+        url: string;
+    };
+};
+export type CreateInvitationResponse = CreateInvitationResponses[keyof CreateInvitationResponses];
+export type RevokeInvitationData = {
+    body?: never;
+    path: {
+        invitationId: string;
+    };
+    query?: never;
+    url: '/_clawscarf/invitations/{invitationId}';
+};
+export type RevokeInvitationErrors = {
+    /**
+     * Failure
+     */
+    default: Problem;
+};
+export type RevokeInvitationError = RevokeInvitationErrors[keyof RevokeInvitationErrors];
+export type RevokeInvitationResponses = {
+    /**
+     * Success
+     */
+    200: unknown;
+};

package/services/access/generated/types.gen.js

@@ -0,0 +1,2 @@
+// This file is auto-generated by @hey-api/openapi-ts
+export {};

package/services/access/migrations/001_access.sql

@@ -0,0 +1,39 @@
+-- Up Migration
+CREATE SCHEMA clawscarf_access;
+CREATE TABLE clawscarf_access.users (
+ id uuid PRIMARY KEY,
+ issuer text NOT NULL,
+ subject text NOT NULL,
+ email text NOT NULL,
+ name text NOT NULL,
+ admitted boolean NOT NULL DEFAULT false,
+ revision bigint NOT NULL DEFAULT 1 CHECK (revision > 0),
+ UNIQUE(issuer,subject)
+);
+CREATE TABLE clawscarf_access.server (
+ singleton boolean PRIMARY KEY DEFAULT true CHECK(singleton),
+ id uuid NOT NULL UNIQUE,
+ administrator_id uuid NOT NULL REFERENCES clawscarf_access.users(id)
+);
+CREATE TABLE clawscarf_access.login_transactions (
+ cookie_hash text PRIMARY KEY,
+ state_hash text NOT NULL,
+ payload text NOT NULL,
+ expires_at timestamptz NOT NULL DEFAULT now()+interval '10 minutes'
+);
+CREATE TABLE clawscarf_access.browser_sessions (
+ hash text PRIMARY KEY,
+ purpose text NOT NULL DEFAULT 'browser' CHECK(purpose IN ('browser','management','enrollment')),
+ parent_hash text REFERENCES clawscarf_access.browser_sessions(hash) ON DELETE CASCADE,
+ user_id uuid NOT NULL REFERENCES clawscarf_access.users(id),
+ admission_revision bigint NOT NULL,
+ csrf text NOT NULL,
+ logout_redirect text,
+ expires_at timestamptz NOT NULL DEFAULT now()+interval '12 hours'
+);
+CREATE TABLE clawscarf_access.local_tokens (
+ hash text PRIMARY KEY,
+ expires_at timestamptz NOT NULL DEFAULT now()+interval '5 minutes'
+);
+-- Down Migration
+DROP SCHEMA clawscarf_access CASCADE;

package/services/access/migrations/002_administrator_setup.sql

@@ -0,0 +1,16 @@
+-- Up Migration
+ALTER TABLE clawscarf_access.server
+ ADD COLUMN setup_complete boolean NOT NULL DEFAULT true,
+ ADD COLUMN setup_token_hash text,
+ ADD COLUMN setup_expires_at timestamptz,
+ ADD COLUMN setup_subject text;
+ALTER TABLE clawscarf_access.browser_sessions DROP CONSTRAINT browser_sessions_purpose_check;
+ALTER TABLE clawscarf_access.browser_sessions ADD CONSTRAINT browser_sessions_purpose_check
+ CHECK (purpose IN ('browser','management','enrollment','setup'));
+-- Down Migration
+DELETE FROM clawscarf_access.browser_sessions WHERE purpose='setup';
+ALTER TABLE clawscarf_access.browser_sessions DROP CONSTRAINT browser_sessions_purpose_check;
+ALTER TABLE clawscarf_access.browser_sessions ADD CONSTRAINT browser_sessions_purpose_check
+ CHECK (purpose IN ('browser','management','enrollment'));
+ALTER TABLE clawscarf_access.server DROP COLUMN setup_complete,
+ DROP COLUMN setup_token_hash, DROP COLUMN setup_expires_at, DROP COLUMN setup_subject;

package/services/access/migrations/003_local_login_completion.sql

@@ -0,0 +1,5 @@
+-- Up Migration
+ALTER TABLE clawscarf_access.local_tokens ADD COLUMN consumed_at timestamptz;
+-- Down Migration
+DELETE FROM clawscarf_access.local_tokens WHERE consumed_at IS NOT NULL;
+ALTER TABLE clawscarf_access.local_tokens DROP COLUMN consumed_at;

package/services/access/migrations/004_invitations.sql

@@ -0,0 +1,21 @@
+-- Up Migration
+CREATE TABLE clawscarf_access.invitations (
+ id uuid PRIMARY KEY,
+ token_hash text NOT NULL UNIQUE,
+ email text NOT NULL,
+ sponsor_id uuid NOT NULL REFERENCES clawscarf_access.users(id),
+ sponsor_revision bigint NOT NULL,
+ subject text,
+ expires_at timestamptz NOT NULL DEFAULT now()+interval '7 days',
+ accepted_at timestamptz,
+ revoked_at timestamptz
+);
+ALTER TABLE clawscarf_access.browser_sessions DROP CONSTRAINT browser_sessions_purpose_check;
+ALTER TABLE clawscarf_access.browser_sessions ADD CONSTRAINT browser_sessions_purpose_check
+ CHECK(purpose IN ('browser','management','enrollment','setup','invitation'));
+-- Down Migration
+DELETE FROM clawscarf_access.browser_sessions WHERE purpose='invitation';
+ALTER TABLE clawscarf_access.browser_sessions DROP CONSTRAINT browser_sessions_purpose_check;
+ALTER TABLE clawscarf_access.browser_sessions ADD CONSTRAINT browser_sessions_purpose_check
+ CHECK(purpose IN ('browser','management','enrollment','setup'));
+DROP TABLE clawscarf_access.invitations;