@contember/cli 2.1.0-rc.3 → 2.2.0-alpha.10

package/dist/production/src/lib/tenant/clients/TenantApiKeyClient.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"TenantApiKeyClient.js","sources":["../../../../../../../packages/cli/src/lib/tenant/clients/TenantApiKeyClient.ts"],"sourcesContent":["import {\n\tapiKey$$,\n\tapiKeyWithToken$$,\n\tcreateApiKeyError$$,\n\ttype CreateApiKeyOptions,\n\tcreateApiKeyResponse$$,\n\tcreateApiKeyResult$,\n\tdisableApiKeyError$$,\n\tdisableApiKeyResponse$$,\n\tidentity$,\n\tidentityProjectRelation$,\n\tmembership$,\n\ttype MembershipInput,\n\tmutation$,\n\tproject$,\n\tquery$,\n\tvariableEntry$$,\n} from '@contember/graphql-client-tenant'\nimport { CliError, ExitCode } from '@contember/cli-common'\nimport { TenantApiTransport } from '../TenantApiTransport.js'\n\nexport interface TenantApiKey {\n\tid: string\n\tidentityId: string\n\tdescription: string | null\n\ttype: string | null\n\tenabled: boolean | null\n\tcreatedAt: string | null\n\tlastUsedAt: string | null\n\texpiresAt: string | null\n}\n\nexport interface TenantGlobalApiKey extends TenantApiKey {\n\tglobalRoles: string[] | null\n}\n\nexport interface TenantApiKeyMembership {\n\trole: string\n\tvariables: { name: string; values: string[] }[]\n}\n\nexport interface TenantProjectApiKey extends TenantApiKey {\n\tmemberships: TenantApiKeyMembership[]\n}\n\nexport interface TenantApiKeyWithToken {\n\tid: string\n\t/** Null when the key was provisioned from a caller-supplied `tokenHash` — the server never had a plaintext to return. */\n\ttoken: string | null\n}\n\nexport interface CreateApiKeyArgs {\n\tprojectSlug: string\n\tmemberships: MembershipInput[]\n\tdescription: string\n\ttokenHash?: string\n\toptions?: CreateApiKeyOptions\n}\n\nexport interface CreateGlobalApiKeyArgs {\n\tdescription: string\n\troles?: string[]\n\ttokenHash?: string\n\toptions?: CreateApiKeyOptions\n}\n\n// Fetchers are immutable and reusable, so they are built once at module load.\nconst globalApiKeysFetcher = query$.globalApiKeys(apiKey$$.identity(identity$.id.roles))\nconst projectApiKeysFetcher = query$.projectBySlug(\n\tproject$.apiKeys(\n\t\tapiKey$$.identity(\n\t\t\tidentity$.id.projects(\n\t\t\t\tidentityProjectRelation$.project(project$.slug).memberships(membership$.role.variables(variableEntry$$)),\n\t\t\t),\n\t\t),\n\t),\n)\nconst createApiKeyFetcher = mutation$.createApiKey(\n\tcreateApiKeyResponse$$.error(createApiKeyError$$).result(createApiKeyResult$.apiKey(apiKeyWithToken$$)),\n)\nconst createGlobalApiKeyFetcher = mutation$.createGlobalApiKey(\n\tcreateApiKeyResponse$$.error(createApiKeyError$$).result(createApiKeyResult$.apiKey(apiKeyWithToken$$)),\n)\nconst disableApiKeyFetcher = mutation$.disableApiKey(disableApiKeyResponse$$.error(disableApiKeyError$$))\n\n/** API keys — global permanent keys and per-project ones. */\nexport class TenantApiKeyClient {\n\tconstructor(\n\t\tprivate readonly transport: TenantApiTransport,\n\t) {\n\t}\n\n\tpublic async listGlobalApiKeys(): Promise<TenantGlobalApiKey[]> {\n\t\tconst result = await this.transport.exec(globalApiKeysFetcher, {})\n\t\treturn result.globalApiKeys.map(it => ({\n\t\t\t...toApiKey(it),\n\t\t\tglobalRoles: it.identity.roles ? [...it.identity.roles] : null,\n\t\t}))\n\t}\n\n\tpublic async listProjectApiKeys(projectSlug: string): Promise<TenantProjectApiKey[]> {\n\t\tconst result = await this.transport.exec(projectApiKeysFetcher, { slug: projectSlug })\n\t\tconst project = result.projectBySlug\n\t\tif (!project) {\n\t\t\tthrow new CliError(`Project ${projectSlug} was not found or is not visible to this token.`, {\n\t\t\t\tcode: 'PROJECT_NOT_FOUND',\n\t\t\t\texitCode: ExitCode.NotFound,\n\t\t\t\tdetails: { projectSlug },\n\t\t\t})\n\t\t}\n\t\treturn project.apiKeys.map(it => ({\n\t\t\t...toApiKey(it),\n\t\t\tmemberships: it.identity.projects.find(relation => relation.project.slug === projectSlug)?.memberships.map(membership => ({\n\t\t\t\trole: membership.role,\n\t\t\t\tvariables: membership.variables.map(variable => ({ name: variable.name, values: [...variable.values] })),\n\t\t\t})) ?? [],\n\t\t}))\n\t}\n\n\t/** Project-scoped key. The token in the result is shown exactly once — the server does not store or re-expose it. */\n\tpublic async createApiKey(args: CreateApiKeyArgs): Promise<TenantApiKeyWithToken> {\n\t\tconst operation = `createApiKey(${args.projectSlug})`\n\t\tconst result = await this.transport.exec(createApiKeyFetcher, {\n\t\t\tprojectSlug: args.projectSlug,\n\t\t\tmemberships: args.memberships,\n\t\t\tdescription: args.description,\n\t\t\ttokenHash: args.tokenHash,\n\t\t\toptions: args.options,\n\t\t})\n\t\tthis.transport.assertOk(result.createApiKey, operation)\n\t\treturn toApiKeyWithToken(result.createApiKey?.result?.apiKey, operation)\n\t}\n\n\t/** Global key, tied to no project. The token in the result is shown exactly once. */\n\tpublic async createGlobalApiKey(args: CreateGlobalApiKeyArgs): Promise<TenantApiKeyWithToken> {\n\t\tconst operation = `createGlobalApiKey(${args.description})`\n\t\tconst result = await this.transport.exec(createGlobalApiKeyFetcher, {\n\t\t\tdescription: args.description,\n\t\t\troles: args.roles,\n\t\t\ttokenHash: args.tokenHash,\n\t\t\toptions: args.options,\n\t\t})\n\t\tthis.transport.assertOk(result.createGlobalApiKey, operation)\n\t\treturn toApiKeyWithToken(result.createGlobalApiKey?.result?.apiKey, operation)\n\t}\n\n\tpublic async disableApiKey(id: string): Promise<void> {\n\t\tconst result = await this.transport.exec(disableApiKeyFetcher, { id })\n\t\tthis.transport.assertOk(result.disableApiKey, `disableApiKey(${id})`)\n\t}\n}\n\nconst toApiKey = (it: {\n\treadonly id: string\n\treadonly identity: { readonly id: string }\n\treadonly description?: string\n\treadonly type?: string\n\treadonly enabled?: boolean\n\treadonly createdAt?: string\n\treadonly lastUsedAt?: string\n\treadonly expiresAt?: string\n}): TenantApiKey => ({\n\tid: it.id,\n\tidentityId: it.identity.id,\n\tdescription: it.description ?? null,\n\ttype: it.type ?? null,\n\tenabled: it.enabled ?? null,\n\tcreatedAt: it.createdAt ?? null,\n\tlastUsedAt: it.lastUsedAt ?? null,\n\texpiresAt: it.expiresAt ?? null,\n})\n\n/** `assertOk` only proves `ok`/`error` are consistent — `result` is still typed optional, so this guards the actual payload. */\nconst toApiKeyWithToken = (apiKey: { id: string; token?: string } | undefined, operation: string): TenantApiKeyWithToken => {\n\tif (!apiKey) {\n\t\tthrow new CliError(`${operation} reported success but returned no api key`, {\n\t\t\tcode: 'TENANT_API_INVALID_RESPONSE',\n\t\t\texitCode: ExitCode.InternalError,\n\t\t})\n\t}\n\treturn { id: apiKey.id, token: apiKey.token ?? null }\n}\n"],"names":[],"mappings":";;AAmEA,MAAM,uBAAuB,OAAO,cAAc,SAAS,SAAS,UAAU,GAAG,KAAK,CAAC;AACvF,MAAM,wBAAwB,OAAO;AAAA,EACpC,SAAS;AAAA,IACR,SAAS;AAAA,MACR,UAAU,GAAG;AAAA,QACZ,yBAAyB,QAAQ,SAAS,IAAI,EAAE,YAAY,YAAY,KAAK,UAAU,eAAe,CAAC;AAAA,MAAA;AAAA,IACxG;AAAA,EACD;AAEF;AACA,MAAM,sBAAsB,UAAU;AAAA,EACrC,uBAAuB,MAAM,mBAAmB,EAAE,OAAO,oBAAoB,OAAO,iBAAiB,CAAC;AACvG;AACA,MAAM,4BAA4B,UAAU;AAAA,EAC3C,uBAAuB,MAAM,mBAAmB,EAAE,OAAO,oBAAoB,OAAO,iBAAiB,CAAC;AACvG;AACA,MAAM,uBAAuB,UAAU,cAAc,wBAAwB,MAAM,oBAAoB,CAAC;AAGjG,MAAM,mBAAmB;AAAA,EAC/B,YACkB,WAChB;AADgB,SAAA,YAAA;AAAA,EAElB;AAAA,EAEA,MAAa,oBAAmD;AAC/D,UAAM,SAAS,MAAM,KAAK,UAAU,KAAK,sBAAsB,EAAE;AACjE,WAAO,OAAO,cAAc,IAAI,CAAA,QAAO;AAAA,MACtC,GAAG,SAAS,EAAE;AAAA,MACd,aAAa,GAAG,SAAS,QAAQ,CAAC,GAAG,GAAG,SAAS,KAAK,IAAI;AAAA,IAAA,EACzD;AAAA,EACH;AAAA,EAEA,MAAa,mBAAmB,aAAqD;AACpF,UAAM,SAAS,MAAM,KAAK,UAAU,KAAK,uBAAuB,EAAE,MAAM,aAAa;AACrF,UAAM,UAAU,OAAO;AACvB,QAAI,CAAC,SAAS;AACb,YAAM,IAAI,SAAS,WAAW,WAAW,mDAAmD;AAAA,QAC3F,MAAM;AAAA,QACN,UAAU,SAAS;AAAA,QACnB,SAAS,EAAE,YAAA;AAAA,MAAY,CACvB;AAAA,IACF;AACA,WAAO,QAAQ,QAAQ,IAAI,CAAA,QAAO;AAAA,MACjC,GAAG,SAAS,EAAE;AAAA,MACd,aAAa,GAAG,SAAS,SAAS,KAAK,CAAA,aAAY,SAAS,QAAQ,SAAS,WAAW,GAAG,YAAY,IAAI,CAAA,gBAAe;AAAA,QACzH,MAAM,WAAW;AAAA,QACjB,WAAW,WAAW,UAAU,IAAI,eAAa,EAAE,MAAM,SAAS,MAAM,QAAQ,CAAC,GAAG,SAAS,MAAM,IAAI;AAAA,MAAA,EACtG,KAAK,CAAA;AAAA,IAAC,EACP;AAAA,EACH;AAAA;AAAA,EAGA,MAAa,aAAa,MAAwD;AACjF,UAAM,YAAY,gBAAgB,KAAK,WAAW;AAClD,UAAM,SAAS,MAAM,KAAK,UAAU,KAAK,qBAAqB;AAAA,MAC7D,aAAa,KAAK;AAAA,MAClB,aAAa,KAAK;AAAA,MAClB,aAAa,KAAK;AAAA,MAClB,WAAW,KAAK;AAAA,MAChB,SAAS,KAAK;AAAA,IAAA,CACd;AACD,SAAK,UAAU,SAAS,OAAO,cAAc,SAAS;AACtD,WAAO,kBAAkB,OAAO,cAAc,QAAQ,QAAQ,SAAS;AAAA,EACxE;AAAA;AAAA,EAGA,MAAa,mBAAmB,MAA8D;AAC7F,UAAM,YAAY,sBAAsB,KAAK,WAAW;AACxD,UAAM,SAAS,MAAM,KAAK,UAAU,KAAK,2BAA2B;AAAA,MACnE,aAAa,KAAK;AAAA,MAClB,OAAO,KAAK;AAAA,MACZ,WAAW,KAAK;AAAA,MAChB,SAAS,KAAK;AAAA,IAAA,CACd;AACD,SAAK,UAAU,SAAS,OAAO,oBAAoB,SAAS;AAC5D,WAAO,kBAAkB,OAAO,oBAAoB,QAAQ,QAAQ,SAAS;AAAA,EAC9E;AAAA,EAEA,MAAa,cAAc,IAA2B;AACrD,UAAM,SAAS,MAAM,KAAK,UAAU,KAAK,sBAAsB,EAAE,IAAI;AACrE,SAAK,UAAU,SAAS,OAAO,eAAe,iBAAiB,EAAE,GAAG;AAAA,EACrE;AACD;AAEA,MAAM,WAAW,CAAC,QASG;AAAA,EACpB,IAAI,GAAG;AAAA,EACP,YAAY,GAAG,SAAS;AAAA,EACxB,aAAa,GAAG,eAAe;AAAA,EAC/B,MAAM,GAAG,QAAQ;AAAA,EACjB,SAAS,GAAG,WAAW;AAAA,EACvB,WAAW,GAAG,aAAa;AAAA,EAC3B,YAAY,GAAG,cAAc;AAAA,EAC7B,WAAW,GAAG,aAAa;AAC5B;AAGA,MAAM,oBAAoB,CAAC,QAAoD,cAA6C;AAC3H,MAAI,CAAC,QAAQ;AACZ,UAAM,IAAI,SAAS,GAAG,SAAS,6CAA6C;AAAA,MAC3E,MAAM;AAAA,MACN,UAAU,SAAS;AAAA,IAAA,CACnB;AAAA,EACF;AACA,SAAO,EAAE,IAAI,OAAO,IAAI,OAAO,OAAO,SAAS,KAAA;AAChD;"}

package/dist/production/src/lib/tenant/clients/TenantMemberClient.cjs

@@ -0,0 +1,96 @@
+"use strict";
+Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+const cliCommon = require("@contember/cli-common");
+const TenantApi = require("@contember/graphql-client-tenant");
+const membershipFetcher = TenantApi.membership$.role.variables(TenantApi.variableEntry$$);
+const projectMembershipsFetcher = TenantApi.query$.projectMemberships(membershipFetcher);
+const projectMembersFetcher = TenantApi.query$.projectBySlug(
+  TenantApi.project$.members(
+    TenantApi.projectIdentityRelation$.identity(TenantApi.identity$.id.description.person(TenantApi.person$.id.email.name)).memberships(membershipFetcher)
+  )
+);
+const inviteResultFetcher = TenantApi.inviteResult$.isNew.person(TenantApi.person$.id.email.name.identity(TenantApi.identity$.id));
+const inviteFetcher = TenantApi.mutation$.invite(TenantApi.inviteResponse$$.error(TenantApi.inviteError$$).result(inviteResultFetcher));
+const unmanagedInviteFetcher = TenantApi.mutation$.unmanagedInvite(TenantApi.inviteResponse$$.error(TenantApi.inviteError$$).result(inviteResultFetcher));
+const addProjectMemberFetcher = TenantApi.mutation$.addProjectMember(TenantApi.addProjectMemberResponse$$.error(TenantApi.addProjectMemberError$$));
+const updateProjectMemberFetcher = TenantApi.mutation$.updateProjectMember(TenantApi.updateProjectMemberResponse$$.error(TenantApi.updateProjectMemberError$$));
+const removeProjectMemberFetcher = TenantApi.mutation$.removeProjectMember(TenantApi.removeProjectMemberResponse$$.error(TenantApi.removeProjectMemberError$$));
+class TenantMemberClient {
+  constructor(transport) {
+    this.transport = transport;
+  }
+  async listProjectMemberships(projectSlug, identityId) {
+    const result = await this.transport.exec(projectMembershipsFetcher, { projectSlug, identityId });
+    return result.projectMemberships.map(toMembership);
+  }
+  /**
+   * Lists every member of a project. The tenant API answers with an empty list — not an error — when the
+   * caller lacks the `project.view members` permission, so an empty result is not proof the project is empty.
+   */
+  async listProjectMembers(projectSlug, { filter, limit, offset } = {}) {
+    const result = await this.transport.exec(projectMembersFetcher, { slug: projectSlug, input: { filter, limit, offset } });
+    const project = result.projectBySlug;
+    if (!project) {
+      throw new cliCommon.CliError(`Project ${projectSlug} was not found or is not visible to this token.`, {
+        code: "PROJECT_NOT_FOUND",
+        exitCode: cliCommon.ExitCode.NotFound,
+        details: { projectSlug }
+      });
+    }
+    return project.members.map((member) => ({
+      identityId: member.identity.id,
+      personId: member.identity.person?.id ?? null,
+      email: member.identity.person?.email ?? null,
+      name: member.identity.person?.name ?? null,
+      description: member.identity.description ?? null,
+      memberships: member.memberships.map(toMembership)
+    }));
+  }
+  /** Invites a person, letting the tenant deliver the credentials by mail. */
+  async invite({ projectSlug, email, name, memberships, options }) {
+    const result = await this.transport.exec(inviteFetcher, { projectSlug, email, name, memberships, options });
+    return this.toInviteResult(result.invite, `invite(${email})`);
+  }
+  /** Invites a person without any mail — the caller supplies the password or the reset token hash. */
+  async unmanagedInvite({ projectSlug, email, memberships, options }) {
+    const result = await this.transport.exec(unmanagedInviteFetcher, { projectSlug, email, memberships, options });
+    return this.toInviteResult(result.unmanagedInvite, `unmanagedInvite(${email})`);
+  }
+  async addProjectMember(projectSlug, identityId, memberships) {
+    const result = await this.transport.exec(addProjectMemberFetcher, { projectSlug, identityId, memberships });
+    this.transport.assertOk(result.addProjectMember, `addProjectMember(${identityId})`);
+  }
+  /** Replaces all memberships of an existing member — anything not passed is removed. */
+  async updateProjectMember(projectSlug, identityId, memberships) {
+    const result = await this.transport.exec(updateProjectMemberFetcher, { projectSlug, identityId, memberships });
+    this.transport.assertOk(result.updateProjectMember, `updateProjectMember(${identityId})`);
+  }
+  async removeProjectMember(projectSlug, identityId) {
+    const result = await this.transport.exec(removeProjectMemberFetcher, { projectSlug, identityId });
+    this.transport.assertOk(result.removeProjectMember, `removeProjectMember(${identityId})`);
+  }
+  toInviteResult(response, operation) {
+    this.transport.assertOk(response, operation);
+    const result = response?.result;
+    if (!result) {
+      throw new cliCommon.CliError(`${operation} reported success but returned no result.`, {
+        code: "TENANT_API_INVALID_RESPONSE",
+        exitCode: cliCommon.ExitCode.InternalError,
+        details: { operation }
+      });
+    }
+    return {
+      personId: result.person.id,
+      identityId: result.person.identity.id,
+      email: result.person.email ?? null,
+      name: result.person.name ?? null,
+      isNew: result.isNew
+    };
+  }
+}
+const toMembership = (membership) => ({
+  role: membership.role,
+  variables: membership.variables.map((variable) => ({ name: variable.name, values: [...variable.values] }))
+});
+exports.TenantMemberClient = TenantMemberClient;
+//# sourceMappingURL=TenantMemberClient.cjs.map

package/dist/production/src/lib/tenant/clients/TenantMemberClient.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"TenantMemberClient.cjs","sources":["../../../../../../../packages/cli/src/lib/tenant/clients/TenantMemberClient.ts"],"sourcesContent":["import { CliError, ExitCode } from '@contember/cli-common'\nimport {\n\taddProjectMemberError$$,\n\taddProjectMemberResponse$$,\n\tidentity$,\n\tinviteError$$,\n\ttype InviteOptions,\n\tinviteResponse$$,\n\tinviteResult$,\n\tmembership$,\n\ttype MembershipInput,\n\tmutation$,\n\tperson$,\n\tproject$,\n\tprojectIdentityRelation$,\n\ttype ProjectMembersFilter,\n\tquery$,\n\tremoveProjectMemberError$$,\n\tremoveProjectMemberResponse$$,\n\ttype UnmanagedInviteOptions,\n\tupdateProjectMemberError$$,\n\tupdateProjectMemberResponse$$,\n\tvariableEntry$$,\n} from '@contember/graphql-client-tenant'\nimport { TenantApiTransport } from '../TenantApiTransport.js'\n\nexport interface TenantMembershipVariable {\n\tname: string\n\tvalues: string[]\n}\n\nexport interface TenantMembership {\n\trole: string\n\tvariables: TenantMembershipVariable[]\n}\n\n/** One member of a project — the identity, the person behind it when there is one, and its memberships. */\nexport interface TenantProjectMember {\n\tidentityId: string\n\t/** Null for an API key member — those have no person. */\n\tpersonId: string | null\n\temail: string | null\n\tname: string | null\n\t/** Identity label, the only human-readable name an API key member has. */\n\tdescription: string | null\n\tmemberships: TenantMembership[]\n}\n\nexport interface ListProjectMembersArgs {\n\tfilter?: ProjectMembersFilter\n\tlimit?: number\n\toffset?: number\n}\n\nexport interface InviteArgs {\n\tprojectSlug: string\n\temail: string\n\tname?: string\n\tmemberships: readonly MembershipInput[]\n\toptions?: InviteOptions\n}\n\nexport interface UnmanagedInviteArgs {\n\tprojectSlug: string\n\temail: string\n\tmemberships: readonly MembershipInput[]\n\toptions?: UnmanagedInviteOptions\n}\n\nexport interface TenantInviteResult {\n\tpersonId: string\n\tidentityId: string\n\temail: string | null\n\tname: string | null\n\t/** False when the person already existed and was only added to the project. */\n\tisNew: boolean\n}\n\n/** The part of an `InviteResponse` selection this client reads — shared by `invite` and `unmanagedInvite`. */\ninterface InviteResponsePayload {\n\treadonly ok: boolean\n\treadonly error?: { readonly code: string; readonly developerMessage: string } | null\n\treadonly result?: {\n\t\treadonly isNew: boolean\n\t\treadonly person: {\n\t\t\treadonly id: string\n\t\t\treadonly email?: string\n\t\t\treadonly name?: string\n\t\t\treadonly identity: { readonly id: string }\n\t\t}\n\t} | null\n}\n\n// Fetchers are immutable and reusable, so they are built once at module load.\nconst membershipFetcher = membership$.role.variables(variableEntry$$)\nconst projectMembershipsFetcher = query$.projectMemberships(membershipFetcher)\nconst projectMembersFetcher = query$.projectBySlug(\n\tproject$.members(\n\t\tprojectIdentityRelation$\n\t\t\t.identity(identity$.id.description.person(person$.id.email.name))\n\t\t\t.memberships(membershipFetcher),\n\t),\n)\nconst inviteResultFetcher = inviteResult$.isNew.person(person$.id.email.name.identity(identity$.id))\nconst inviteFetcher = mutation$.invite(inviteResponse$$.error(inviteError$$).result(inviteResultFetcher))\nconst unmanagedInviteFetcher = mutation$.unmanagedInvite(inviteResponse$$.error(inviteError$$).result(inviteResultFetcher))\nconst addProjectMemberFetcher = mutation$.addProjectMember(addProjectMemberResponse$$.error(addProjectMemberError$$))\nconst updateProjectMemberFetcher = mutation$.updateProjectMember(updateProjectMemberResponse$$.error(updateProjectMemberError$$))\nconst removeProjectMemberFetcher = mutation$.removeProjectMember(removeProjectMemberResponse$$.error(removeProjectMemberError$$))\n\n/** Project memberships and invites. */\nexport class TenantMemberClient {\n\tconstructor(\n\t\tprivate readonly transport: TenantApiTransport,\n\t) {\n\t}\n\n\tpublic async listProjectMemberships(projectSlug: string, identityId: string): Promise<TenantMembership[]> {\n\t\tconst result = await this.transport.exec(projectMembershipsFetcher, { projectSlug, identityId })\n\t\treturn result.projectMemberships.map(toMembership)\n\t}\n\n\t/**\n\t * Lists every member of a project. The tenant API answers with an empty list — not an error — when the\n\t * caller lacks the `project.view members` permission, so an empty result is not proof the project is empty.\n\t */\n\tpublic async listProjectMembers(projectSlug: string, { filter, limit, offset }: ListProjectMembersArgs = {}): Promise<TenantProjectMember[]> {\n\t\tconst result = await this.transport.exec(projectMembersFetcher, { slug: projectSlug, input: { filter, limit, offset } })\n\t\tconst project = result.projectBySlug\n\t\tif (!project) {\n\t\t\tthrow new CliError(`Project ${projectSlug} was not found or is not visible to this token.`, {\n\t\t\t\tcode: 'PROJECT_NOT_FOUND',\n\t\t\t\texitCode: ExitCode.NotFound,\n\t\t\t\tdetails: { projectSlug },\n\t\t\t})\n\t\t}\n\t\treturn project.members.map(member => ({\n\t\t\tidentityId: member.identity.id,\n\t\t\tpersonId: member.identity.person?.id ?? null,\n\t\t\temail: member.identity.person?.email ?? null,\n\t\t\tname: member.identity.person?.name ?? null,\n\t\t\tdescription: member.identity.description ?? null,\n\t\t\tmemberships: member.memberships.map(toMembership),\n\t\t}))\n\t}\n\n\t/** Invites a person, letting the tenant deliver the credentials by mail. */\n\tpublic async invite({ projectSlug, email, name, memberships, options }: InviteArgs): Promise<TenantInviteResult> {\n\t\tconst result = await this.transport.exec(inviteFetcher, { projectSlug, email, name, memberships, options })\n\t\treturn this.toInviteResult(result.invite, `invite(${email})`)\n\t}\n\n\t/** Invites a person without any mail — the caller supplies the password or the reset token hash. */\n\tpublic async unmanagedInvite({ projectSlug, email, memberships, options }: UnmanagedInviteArgs): Promise<TenantInviteResult> {\n\t\tconst result = await this.transport.exec(unmanagedInviteFetcher, { projectSlug, email, memberships, options })\n\t\treturn this.toInviteResult(result.unmanagedInvite, `unmanagedInvite(${email})`)\n\t}\n\n\tpublic async addProjectMember(projectSlug: string, identityId: string, memberships: readonly MembershipInput[]): Promise<void> {\n\t\tconst result = await this.transport.exec(addProjectMemberFetcher, { projectSlug, identityId, memberships })\n\t\tthis.transport.assertOk(result.addProjectMember, `addProjectMember(${identityId})`)\n\t}\n\n\t/** Replaces all memberships of an existing member — anything not passed is removed. */\n\tpublic async updateProjectMember(projectSlug: string, identityId: string, memberships: readonly MembershipInput[]): Promise<void> {\n\t\tconst result = await this.transport.exec(updateProjectMemberFetcher, { projectSlug, identityId, memberships })\n\t\tthis.transport.assertOk(result.updateProjectMember, `updateProjectMember(${identityId})`)\n\t}\n\n\tpublic async removeProjectMember(projectSlug: string, identityId: string): Promise<void> {\n\t\tconst result = await this.transport.exec(removeProjectMemberFetcher, { projectSlug, identityId })\n\t\tthis.transport.assertOk(result.removeProjectMember, `removeProjectMember(${identityId})`)\n\t}\n\n\tprivate toInviteResult(response: InviteResponsePayload | undefined, operation: string): TenantInviteResult {\n\t\tthis.transport.assertOk(response, operation)\n\t\tconst result = response?.result\n\t\tif (!result) {\n\t\t\t// assertOk throws on every failure, so an ok payload without a result is a broken response, not a user error\n\t\t\tthrow new CliError(`${operation} reported success but returned no result.`, {\n\t\t\t\tcode: 'TENANT_API_INVALID_RESPONSE',\n\t\t\t\texitCode: ExitCode.InternalError,\n\t\t\t\tdetails: { operation },\n\t\t\t})\n\t\t}\n\t\treturn {\n\t\t\tpersonId: result.person.id,\n\t\t\tidentityId: result.person.identity.id,\n\t\t\temail: result.person.email ?? null,\n\t\t\tname: result.person.name ?? null,\n\t\t\tisNew: result.isNew,\n\t\t}\n\t}\n}\n\nconst toMembership = (membership: { role: string; variables: readonly { name: string; values: readonly string[] }[] }): TenantMembership => ({\n\trole: membership.role,\n\tvariables: membership.variables.map(variable => ({ name: variable.name, values: [...variable.values] })),\n})\n"],"names":["membership$","variableEntry$$","query$","project$","projectIdentityRelation$","identity$","person$","inviteResult$","mutation$","inviteResponse$$","inviteError$$","addProjectMemberResponse$$","addProjectMemberError$$","updateProjectMemberResponse$$","updateProjectMemberError$$","removeProjectMemberResponse$$","removeProjectMemberError$$","CliError","ExitCode"],"mappings":";;;;AA8FA,MAAM,oBAAoBA,UAAAA,YAAY,KAAK,UAAUC,UAAAA,eAAe;AACpE,MAAM,4BAA4BC,UAAAA,OAAO,mBAAmB,iBAAiB;AAC7E,MAAM,wBAAwBA,UAAAA,OAAO;AAAA,EACpCC,UAAAA,SAAS;AAAA,IACRC,UAAAA,yBACE,SAASC,UAAAA,UAAU,GAAG,YAAY,OAAOC,kBAAQ,GAAG,MAAM,IAAI,CAAC,EAC/D,YAAY,iBAAiB;AAAA,EAAA;AAEjC;AACA,MAAM,sBAAsBC,UAAAA,cAAc,MAAM,OAAOD,UAAAA,QAAQ,GAAG,MAAM,KAAK,SAASD,UAAAA,UAAU,EAAE,CAAC;AACnG,MAAM,gBAAgBG,UAAAA,UAAU,OAAOC,UAAAA,iBAAiB,MAAMC,uBAAa,EAAE,OAAO,mBAAmB,CAAC;AACxG,MAAM,yBAAyBF,UAAAA,UAAU,gBAAgBC,UAAAA,iBAAiB,MAAMC,uBAAa,EAAE,OAAO,mBAAmB,CAAC;AAC1H,MAAM,0BAA0BF,UAAAA,UAAU,iBAAiBG,UAAAA,2BAA2B,MAAMC,UAAAA,uBAAuB,CAAC;AACpH,MAAM,6BAA6BJ,UAAAA,UAAU,oBAAoBK,UAAAA,8BAA8B,MAAMC,UAAAA,0BAA0B,CAAC;AAChI,MAAM,6BAA6BN,UAAAA,UAAU,oBAAoBO,UAAAA,8BAA8B,MAAMC,UAAAA,0BAA0B,CAAC;AAGzH,MAAM,mBAAmB;AAAA,EAC/B,YACkB,WAChB;AADgB,SAAA,YAAA;AAAA,EAElB;AAAA,EAEA,MAAa,uBAAuB,aAAqB,YAAiD;AACzG,UAAM,SAAS,MAAM,KAAK,UAAU,KAAK,2BAA2B,EAAE,aAAa,YAAY;AAC/F,WAAO,OAAO,mBAAmB,IAAI,YAAY;AAAA,EAClD;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,MAAa,mBAAmB,aAAqB,EAAE,QAAQ,OAAO,OAAA,IAAmC,IAAoC;AAC5I,UAAM,SAAS,MAAM,KAAK,UAAU,KAAK,uBAAuB,EAAE,MAAM,aAAa,OAAO,EAAE,QAAQ,OAAO,OAAA,GAAU;AACvH,UAAM,UAAU,OAAO;AACvB,QAAI,CAAC,SAAS;AACb,YAAM,IAAIC,UAAAA,SAAS,WAAW,WAAW,mDAAmD;AAAA,QAC3F,MAAM;AAAA,QACN,UAAUC,UAAAA,SAAS;AAAA,QACnB,SAAS,EAAE,YAAA;AAAA,MAAY,CACvB;AAAA,IACF;AACA,WAAO,QAAQ,QAAQ,IAAI,CAAA,YAAW;AAAA,MACrC,YAAY,OAAO,SAAS;AAAA,MAC5B,UAAU,OAAO,SAAS,QAAQ,MAAM;AAAA,MACxC,OAAO,OAAO,SAAS,QAAQ,SAAS;AAAA,MACxC,MAAM,OAAO,SAAS,QAAQ,QAAQ;AAAA,MACtC,aAAa,OAAO,SAAS,eAAe;AAAA,MAC5C,aAAa,OAAO,YAAY,IAAI,YAAY;AAAA,IAAA,EAC/C;AAAA,EACH;AAAA;AAAA,EAGA,MAAa,OAAO,EAAE,aAAa,OAAO,MAAM,aAAa,WAAoD;AAChH,UAAM,SAAS,MAAM,KAAK,UAAU,KAAK,eAAe,EAAE,aAAa,OAAO,MAAM,aAAa,QAAA,CAAS;AAC1G,WAAO,KAAK,eAAe,OAAO,QAAQ,UAAU,KAAK,GAAG;AAAA,EAC7D;AAAA;AAAA,EAGA,MAAa,gBAAgB,EAAE,aAAa,OAAO,aAAa,WAA6D;AAC5H,UAAM,SAAS,MAAM,KAAK,UAAU,KAAK,wBAAwB,EAAE,aAAa,OAAO,aAAa,QAAA,CAAS;AAC7G,WAAO,KAAK,eAAe,OAAO,iBAAiB,mBAAmB,KAAK,GAAG;AAAA,EAC/E;AAAA,EAEA,MAAa,iBAAiB,aAAqB,YAAoB,aAAwD;AAC9H,UAAM,SAAS,MAAM,KAAK,UAAU,KAAK,yBAAyB,EAAE,aAAa,YAAY,aAAa;AAC1G,SAAK,UAAU,SAAS,OAAO,kBAAkB,oBAAoB,UAAU,GAAG;AAAA,EACnF;AAAA;AAAA,EAGA,MAAa,oBAAoB,aAAqB,YAAoB,aAAwD;AACjI,UAAM,SAAS,MAAM,KAAK,UAAU,KAAK,4BAA4B,EAAE,aAAa,YAAY,aAAa;AAC7G,SAAK,UAAU,SAAS,OAAO,qBAAqB,uBAAuB,UAAU,GAAG;AAAA,EACzF;AAAA,EAEA,MAAa,oBAAoB,aAAqB,YAAmC;AACxF,UAAM,SAAS,MAAM,KAAK,UAAU,KAAK,4BAA4B,EAAE,aAAa,YAAY;AAChG,SAAK,UAAU,SAAS,OAAO,qBAAqB,uBAAuB,UAAU,GAAG;AAAA,EACzF;AAAA,EAEQ,eAAe,UAA6C,WAAuC;AAC1G,SAAK,UAAU,SAAS,UAAU,SAAS;AAC3C,UAAM,SAAS,UAAU;AACzB,QAAI,CAAC,QAAQ;AAEZ,YAAM,IAAID,UAAAA,SAAS,GAAG,SAAS,6CAA6C;AAAA,QAC3E,MAAM;AAAA,QACN,UAAUC,UAAAA,SAAS;AAAA,QACnB,SAAS,EAAE,UAAA;AAAA,MAAU,CACrB;AAAA,IACF;AACA,WAAO;AAAA,MACN,UAAU,OAAO,OAAO;AAAA,MACxB,YAAY,OAAO,OAAO,SAAS;AAAA,MACnC,OAAO,OAAO,OAAO,SAAS;AAAA,MAC9B,MAAM,OAAO,OAAO,QAAQ;AAAA,MAC5B,OAAO,OAAO;AAAA,IAAA;AAAA,EAEhB;AACD;AAEA,MAAM,eAAe,CAAC,gBAAuH;AAAA,EAC5I,MAAM,WAAW;AAAA,EACjB,WAAW,WAAW,UAAU,IAAI,eAAa,EAAE,MAAM,SAAS,MAAM,QAAQ,CAAC,GAAG,SAAS,MAAM,IAAI;AACxG;;"}

package/dist/production/src/lib/tenant/clients/TenantMemberClient.js

@@ -0,0 +1,96 @@
+import { CliError, ExitCode } from "@contember/cli-common";
+import { membership$, variableEntry$$, query$, project$, projectIdentityRelation$, identity$, person$, inviteResult$, mutation$, inviteResponse$$, inviteError$$, addProjectMemberResponse$$, addProjectMemberError$$, updateProjectMemberResponse$$, updateProjectMemberError$$, removeProjectMemberResponse$$, removeProjectMemberError$$ } from "@contember/graphql-client-tenant";
+const membershipFetcher = membership$.role.variables(variableEntry$$);
+const projectMembershipsFetcher = query$.projectMemberships(membershipFetcher);
+const projectMembersFetcher = query$.projectBySlug(
+  project$.members(
+    projectIdentityRelation$.identity(identity$.id.description.person(person$.id.email.name)).memberships(membershipFetcher)
+  )
+);
+const inviteResultFetcher = inviteResult$.isNew.person(person$.id.email.name.identity(identity$.id));
+const inviteFetcher = mutation$.invite(inviteResponse$$.error(inviteError$$).result(inviteResultFetcher));
+const unmanagedInviteFetcher = mutation$.unmanagedInvite(inviteResponse$$.error(inviteError$$).result(inviteResultFetcher));
+const addProjectMemberFetcher = mutation$.addProjectMember(addProjectMemberResponse$$.error(addProjectMemberError$$));
+const updateProjectMemberFetcher = mutation$.updateProjectMember(updateProjectMemberResponse$$.error(updateProjectMemberError$$));
+const removeProjectMemberFetcher = mutation$.removeProjectMember(removeProjectMemberResponse$$.error(removeProjectMemberError$$));
+class TenantMemberClient {
+  constructor(transport) {
+    this.transport = transport;
+  }
+  async listProjectMemberships(projectSlug, identityId) {
+    const result = await this.transport.exec(projectMembershipsFetcher, { projectSlug, identityId });
+    return result.projectMemberships.map(toMembership);
+  }
+  /**
+   * Lists every member of a project. The tenant API answers with an empty list — not an error — when the
+   * caller lacks the `project.view members` permission, so an empty result is not proof the project is empty.
+   */
+  async listProjectMembers(projectSlug, { filter, limit, offset } = {}) {
+    const result = await this.transport.exec(projectMembersFetcher, { slug: projectSlug, input: { filter, limit, offset } });
+    const project = result.projectBySlug;
+    if (!project) {
+      throw new CliError(`Project ${projectSlug} was not found or is not visible to this token.`, {
+        code: "PROJECT_NOT_FOUND",
+        exitCode: ExitCode.NotFound,
+        details: { projectSlug }
+      });
+    }
+    return project.members.map((member) => ({
+      identityId: member.identity.id,
+      personId: member.identity.person?.id ?? null,
+      email: member.identity.person?.email ?? null,
+      name: member.identity.person?.name ?? null,
+      description: member.identity.description ?? null,
+      memberships: member.memberships.map(toMembership)
+    }));
+  }
+  /** Invites a person, letting the tenant deliver the credentials by mail. */
+  async invite({ projectSlug, email, name, memberships, options }) {
+    const result = await this.transport.exec(inviteFetcher, { projectSlug, email, name, memberships, options });
+    return this.toInviteResult(result.invite, `invite(${email})`);
+  }
+  /** Invites a person without any mail — the caller supplies the password or the reset token hash. */
+  async unmanagedInvite({ projectSlug, email, memberships, options }) {
+    const result = await this.transport.exec(unmanagedInviteFetcher, { projectSlug, email, memberships, options });
+    return this.toInviteResult(result.unmanagedInvite, `unmanagedInvite(${email})`);
+  }
+  async addProjectMember(projectSlug, identityId, memberships) {
+    const result = await this.transport.exec(addProjectMemberFetcher, { projectSlug, identityId, memberships });
+    this.transport.assertOk(result.addProjectMember, `addProjectMember(${identityId})`);
+  }
+  /** Replaces all memberships of an existing member — anything not passed is removed. */
+  async updateProjectMember(projectSlug, identityId, memberships) {
+    const result = await this.transport.exec(updateProjectMemberFetcher, { projectSlug, identityId, memberships });
+    this.transport.assertOk(result.updateProjectMember, `updateProjectMember(${identityId})`);
+  }
+  async removeProjectMember(projectSlug, identityId) {
+    const result = await this.transport.exec(removeProjectMemberFetcher, { projectSlug, identityId });
+    this.transport.assertOk(result.removeProjectMember, `removeProjectMember(${identityId})`);
+  }
+  toInviteResult(response, operation) {
+    this.transport.assertOk(response, operation);
+    const result = response?.result;
+    if (!result) {
+      throw new CliError(`${operation} reported success but returned no result.`, {
+        code: "TENANT_API_INVALID_RESPONSE",
+        exitCode: ExitCode.InternalError,
+        details: { operation }
+      });
+    }
+    return {
+      personId: result.person.id,
+      identityId: result.person.identity.id,
+      email: result.person.email ?? null,
+      name: result.person.name ?? null,
+      isNew: result.isNew
+    };
+  }
+}
+const toMembership = (membership) => ({
+  role: membership.role,
+  variables: membership.variables.map((variable) => ({ name: variable.name, values: [...variable.values] }))
+});
+export {
+  TenantMemberClient
+};
+//# sourceMappingURL=TenantMemberClient.js.map

package/dist/production/src/lib/tenant/clients/TenantMemberClient.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"TenantMemberClient.js","sources":["../../../../../../../packages/cli/src/lib/tenant/clients/TenantMemberClient.ts"],"sourcesContent":["import { CliError, ExitCode } from '@contember/cli-common'\nimport {\n\taddProjectMemberError$$,\n\taddProjectMemberResponse$$,\n\tidentity$,\n\tinviteError$$,\n\ttype InviteOptions,\n\tinviteResponse$$,\n\tinviteResult$,\n\tmembership$,\n\ttype MembershipInput,\n\tmutation$,\n\tperson$,\n\tproject$,\n\tprojectIdentityRelation$,\n\ttype ProjectMembersFilter,\n\tquery$,\n\tremoveProjectMemberError$$,\n\tremoveProjectMemberResponse$$,\n\ttype UnmanagedInviteOptions,\n\tupdateProjectMemberError$$,\n\tupdateProjectMemberResponse$$,\n\tvariableEntry$$,\n} from '@contember/graphql-client-tenant'\nimport { TenantApiTransport } from '../TenantApiTransport.js'\n\nexport interface TenantMembershipVariable {\n\tname: string\n\tvalues: string[]\n}\n\nexport interface TenantMembership {\n\trole: string\n\tvariables: TenantMembershipVariable[]\n}\n\n/** One member of a project — the identity, the person behind it when there is one, and its memberships. */\nexport interface TenantProjectMember {\n\tidentityId: string\n\t/** Null for an API key member — those have no person. */\n\tpersonId: string | null\n\temail: string | null\n\tname: string | null\n\t/** Identity label, the only human-readable name an API key member has. */\n\tdescription: string | null\n\tmemberships: TenantMembership[]\n}\n\nexport interface ListProjectMembersArgs {\n\tfilter?: ProjectMembersFilter\n\tlimit?: number\n\toffset?: number\n}\n\nexport interface InviteArgs {\n\tprojectSlug: string\n\temail: string\n\tname?: string\n\tmemberships: readonly MembershipInput[]\n\toptions?: InviteOptions\n}\n\nexport interface UnmanagedInviteArgs {\n\tprojectSlug: string\n\temail: string\n\tmemberships: readonly MembershipInput[]\n\toptions?: UnmanagedInviteOptions\n}\n\nexport interface TenantInviteResult {\n\tpersonId: string\n\tidentityId: string\n\temail: string | null\n\tname: string | null\n\t/** False when the person already existed and was only added to the project. */\n\tisNew: boolean\n}\n\n/** The part of an `InviteResponse` selection this client reads — shared by `invite` and `unmanagedInvite`. */\ninterface InviteResponsePayload {\n\treadonly ok: boolean\n\treadonly error?: { readonly code: string; readonly developerMessage: string } | null\n\treadonly result?: {\n\t\treadonly isNew: boolean\n\t\treadonly person: {\n\t\t\treadonly id: string\n\t\t\treadonly email?: string\n\t\t\treadonly name?: string\n\t\t\treadonly identity: { readonly id: string }\n\t\t}\n\t} | null\n}\n\n// Fetchers are immutable and reusable, so they are built once at module load.\nconst membershipFetcher = membership$.role.variables(variableEntry$$)\nconst projectMembershipsFetcher = query$.projectMemberships(membershipFetcher)\nconst projectMembersFetcher = query$.projectBySlug(\n\tproject$.members(\n\t\tprojectIdentityRelation$\n\t\t\t.identity(identity$.id.description.person(person$.id.email.name))\n\t\t\t.memberships(membershipFetcher),\n\t),\n)\nconst inviteResultFetcher = inviteResult$.isNew.person(person$.id.email.name.identity(identity$.id))\nconst inviteFetcher = mutation$.invite(inviteResponse$$.error(inviteError$$).result(inviteResultFetcher))\nconst unmanagedInviteFetcher = mutation$.unmanagedInvite(inviteResponse$$.error(inviteError$$).result(inviteResultFetcher))\nconst addProjectMemberFetcher = mutation$.addProjectMember(addProjectMemberResponse$$.error(addProjectMemberError$$))\nconst updateProjectMemberFetcher = mutation$.updateProjectMember(updateProjectMemberResponse$$.error(updateProjectMemberError$$))\nconst removeProjectMemberFetcher = mutation$.removeProjectMember(removeProjectMemberResponse$$.error(removeProjectMemberError$$))\n\n/** Project memberships and invites. */\nexport class TenantMemberClient {\n\tconstructor(\n\t\tprivate readonly transport: TenantApiTransport,\n\t) {\n\t}\n\n\tpublic async listProjectMemberships(projectSlug: string, identityId: string): Promise<TenantMembership[]> {\n\t\tconst result = await this.transport.exec(projectMembershipsFetcher, { projectSlug, identityId })\n\t\treturn result.projectMemberships.map(toMembership)\n\t}\n\n\t/**\n\t * Lists every member of a project. The tenant API answers with an empty list — not an error — when the\n\t * caller lacks the `project.view members` permission, so an empty result is not proof the project is empty.\n\t */\n\tpublic async listProjectMembers(projectSlug: string, { filter, limit, offset }: ListProjectMembersArgs = {}): Promise<TenantProjectMember[]> {\n\t\tconst result = await this.transport.exec(projectMembersFetcher, { slug: projectSlug, input: { filter, limit, offset } })\n\t\tconst project = result.projectBySlug\n\t\tif (!project) {\n\t\t\tthrow new CliError(`Project ${projectSlug} was not found or is not visible to this token.`, {\n\t\t\t\tcode: 'PROJECT_NOT_FOUND',\n\t\t\t\texitCode: ExitCode.NotFound,\n\t\t\t\tdetails: { projectSlug },\n\t\t\t})\n\t\t}\n\t\treturn project.members.map(member => ({\n\t\t\tidentityId: member.identity.id,\n\t\t\tpersonId: member.identity.person?.id ?? null,\n\t\t\temail: member.identity.person?.email ?? null,\n\t\t\tname: member.identity.person?.name ?? null,\n\t\t\tdescription: member.identity.description ?? null,\n\t\t\tmemberships: member.memberships.map(toMembership),\n\t\t}))\n\t}\n\n\t/** Invites a person, letting the tenant deliver the credentials by mail. */\n\tpublic async invite({ projectSlug, email, name, memberships, options }: InviteArgs): Promise<TenantInviteResult> {\n\t\tconst result = await this.transport.exec(inviteFetcher, { projectSlug, email, name, memberships, options })\n\t\treturn this.toInviteResult(result.invite, `invite(${email})`)\n\t}\n\n\t/** Invites a person without any mail — the caller supplies the password or the reset token hash. */\n\tpublic async unmanagedInvite({ projectSlug, email, memberships, options }: UnmanagedInviteArgs): Promise<TenantInviteResult> {\n\t\tconst result = await this.transport.exec(unmanagedInviteFetcher, { projectSlug, email, memberships, options })\n\t\treturn this.toInviteResult(result.unmanagedInvite, `unmanagedInvite(${email})`)\n\t}\n\n\tpublic async addProjectMember(projectSlug: string, identityId: string, memberships: readonly MembershipInput[]): Promise<void> {\n\t\tconst result = await this.transport.exec(addProjectMemberFetcher, { projectSlug, identityId, memberships })\n\t\tthis.transport.assertOk(result.addProjectMember, `addProjectMember(${identityId})`)\n\t}\n\n\t/** Replaces all memberships of an existing member — anything not passed is removed. */\n\tpublic async updateProjectMember(projectSlug: string, identityId: string, memberships: readonly MembershipInput[]): Promise<void> {\n\t\tconst result = await this.transport.exec(updateProjectMemberFetcher, { projectSlug, identityId, memberships })\n\t\tthis.transport.assertOk(result.updateProjectMember, `updateProjectMember(${identityId})`)\n\t}\n\n\tpublic async removeProjectMember(projectSlug: string, identityId: string): Promise<void> {\n\t\tconst result = await this.transport.exec(removeProjectMemberFetcher, { projectSlug, identityId })\n\t\tthis.transport.assertOk(result.removeProjectMember, `removeProjectMember(${identityId})`)\n\t}\n\n\tprivate toInviteResult(response: InviteResponsePayload | undefined, operation: string): TenantInviteResult {\n\t\tthis.transport.assertOk(response, operation)\n\t\tconst result = response?.result\n\t\tif (!result) {\n\t\t\t// assertOk throws on every failure, so an ok payload without a result is a broken response, not a user error\n\t\t\tthrow new CliError(`${operation} reported success but returned no result.`, {\n\t\t\t\tcode: 'TENANT_API_INVALID_RESPONSE',\n\t\t\t\texitCode: ExitCode.InternalError,\n\t\t\t\tdetails: { operation },\n\t\t\t})\n\t\t}\n\t\treturn {\n\t\t\tpersonId: result.person.id,\n\t\t\tidentityId: result.person.identity.id,\n\t\t\temail: result.person.email ?? null,\n\t\t\tname: result.person.name ?? null,\n\t\t\tisNew: result.isNew,\n\t\t}\n\t}\n}\n\nconst toMembership = (membership: { role: string; variables: readonly { name: string; values: readonly string[] }[] }): TenantMembership => ({\n\trole: membership.role,\n\tvariables: membership.variables.map(variable => ({ name: variable.name, values: [...variable.values] })),\n})\n"],"names":[],"mappings":";;AA8FA,MAAM,oBAAoB,YAAY,KAAK,UAAU,eAAe;AACpE,MAAM,4BAA4B,OAAO,mBAAmB,iBAAiB;AAC7E,MAAM,wBAAwB,OAAO;AAAA,EACpC,SAAS;AAAA,IACR,yBACE,SAAS,UAAU,GAAG,YAAY,OAAO,QAAQ,GAAG,MAAM,IAAI,CAAC,EAC/D,YAAY,iBAAiB;AAAA,EAAA;AAEjC;AACA,MAAM,sBAAsB,cAAc,MAAM,OAAO,QAAQ,GAAG,MAAM,KAAK,SAAS,UAAU,EAAE,CAAC;AACnG,MAAM,gBAAgB,UAAU,OAAO,iBAAiB,MAAM,aAAa,EAAE,OAAO,mBAAmB,CAAC;AACxG,MAAM,yBAAyB,UAAU,gBAAgB,iBAAiB,MAAM,aAAa,EAAE,OAAO,mBAAmB,CAAC;AAC1H,MAAM,0BAA0B,UAAU,iBAAiB,2BAA2B,MAAM,uBAAuB,CAAC;AACpH,MAAM,6BAA6B,UAAU,oBAAoB,8BAA8B,MAAM,0BAA0B,CAAC;AAChI,MAAM,6BAA6B,UAAU,oBAAoB,8BAA8B,MAAM,0BAA0B,CAAC;AAGzH,MAAM,mBAAmB;AAAA,EAC/B,YACkB,WAChB;AADgB,SAAA,YAAA;AAAA,EAElB;AAAA,EAEA,MAAa,uBAAuB,aAAqB,YAAiD;AACzG,UAAM,SAAS,MAAM,KAAK,UAAU,KAAK,2BAA2B,EAAE,aAAa,YAAY;AAC/F,WAAO,OAAO,mBAAmB,IAAI,YAAY;AAAA,EAClD;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,MAAa,mBAAmB,aAAqB,EAAE,QAAQ,OAAO,OAAA,IAAmC,IAAoC;AAC5I,UAAM,SAAS,MAAM,KAAK,UAAU,KAAK,uBAAuB,EAAE,MAAM,aAAa,OAAO,EAAE,QAAQ,OAAO,OAAA,GAAU;AACvH,UAAM,UAAU,OAAO;AACvB,QAAI,CAAC,SAAS;AACb,YAAM,IAAI,SAAS,WAAW,WAAW,mDAAmD;AAAA,QAC3F,MAAM;AAAA,QACN,UAAU,SAAS;AAAA,QACnB,SAAS,EAAE,YAAA;AAAA,MAAY,CACvB;AAAA,IACF;AACA,WAAO,QAAQ,QAAQ,IAAI,CAAA,YAAW;AAAA,MACrC,YAAY,OAAO,SAAS;AAAA,MAC5B,UAAU,OAAO,SAAS,QAAQ,MAAM;AAAA,MACxC,OAAO,OAAO,SAAS,QAAQ,SAAS;AAAA,MACxC,MAAM,OAAO,SAAS,QAAQ,QAAQ;AAAA,MACtC,aAAa,OAAO,SAAS,eAAe;AAAA,MAC5C,aAAa,OAAO,YAAY,IAAI,YAAY;AAAA,IAAA,EAC/C;AAAA,EACH;AAAA;AAAA,EAGA,MAAa,OAAO,EAAE,aAAa,OAAO,MAAM,aAAa,WAAoD;AAChH,UAAM,SAAS,MAAM,KAAK,UAAU,KAAK,eAAe,EAAE,aAAa,OAAO,MAAM,aAAa,QAAA,CAAS;AAC1G,WAAO,KAAK,eAAe,OAAO,QAAQ,UAAU,KAAK,GAAG;AAAA,EAC7D;AAAA;AAAA,EAGA,MAAa,gBAAgB,EAAE,aAAa,OAAO,aAAa,WAA6D;AAC5H,UAAM,SAAS,MAAM,KAAK,UAAU,KAAK,wBAAwB,EAAE,aAAa,OAAO,aAAa,QAAA,CAAS;AAC7G,WAAO,KAAK,eAAe,OAAO,iBAAiB,mBAAmB,KAAK,GAAG;AAAA,EAC/E;AAAA,EAEA,MAAa,iBAAiB,aAAqB,YAAoB,aAAwD;AAC9H,UAAM,SAAS,MAAM,KAAK,UAAU,KAAK,yBAAyB,EAAE,aAAa,YAAY,aAAa;AAC1G,SAAK,UAAU,SAAS,OAAO,kBAAkB,oBAAoB,UAAU,GAAG;AAAA,EACnF;AAAA;AAAA,EAGA,MAAa,oBAAoB,aAAqB,YAAoB,aAAwD;AACjI,UAAM,SAAS,MAAM,KAAK,UAAU,KAAK,4BAA4B,EAAE,aAAa,YAAY,aAAa;AAC7G,SAAK,UAAU,SAAS,OAAO,qBAAqB,uBAAuB,UAAU,GAAG;AAAA,EACzF;AAAA,EAEA,MAAa,oBAAoB,aAAqB,YAAmC;AACxF,UAAM,SAAS,MAAM,KAAK,UAAU,KAAK,4BAA4B,EAAE,aAAa,YAAY;AAChG,SAAK,UAAU,SAAS,OAAO,qBAAqB,uBAAuB,UAAU,GAAG;AAAA,EACzF;AAAA,EAEQ,eAAe,UAA6C,WAAuC;AAC1G,SAAK,UAAU,SAAS,UAAU,SAAS;AAC3C,UAAM,SAAS,UAAU;AACzB,QAAI,CAAC,QAAQ;AAEZ,YAAM,IAAI,SAAS,GAAG,SAAS,6CAA6C;AAAA,QAC3E,MAAM;AAAA,QACN,UAAU,SAAS;AAAA,QACnB,SAAS,EAAE,UAAA;AAAA,MAAU,CACrB;AAAA,IACF;AACA,WAAO;AAAA,MACN,UAAU,OAAO,OAAO;AAAA,MACxB,YAAY,OAAO,OAAO,SAAS;AAAA,MACnC,OAAO,OAAO,OAAO,SAAS;AAAA,MAC9B,MAAM,OAAO,OAAO,QAAQ;AAAA,MAC5B,OAAO,OAAO;AAAA,IAAA;AAAA,EAEhB;AACD;AAEA,MAAM,eAAe,CAAC,gBAAuH;AAAA,EAC5I,MAAM,WAAW;AAAA,EACjB,WAAW,WAAW,UAAU,IAAI,eAAa,EAAE,MAAM,SAAS,MAAM,QAAQ,CAAC,GAAG,SAAS,MAAM,IAAI;AACxG;"}

package/dist/production/src/lib/tenant/clients/TenantPersonClient.cjs

@@ -0,0 +1,162 @@
+"use strict";
+Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+const cliCommon = require("@contember/cli-common");
+const TenantApi = require("@contember/graphql-client-tenant");
+const personsFetcher = TenantApi.query$.persons(TenantApi.person$$.identity(TenantApi.identity$.id));
+const personByIdFetcher = TenantApi.query$.personById(
+  TenantApi.person$$.identity(TenantApi.identity$.id.roles.sessions(TenantApi.sessionInfo$$)).identityProviders(TenantApi.personIdentityProvider$.id.createdAt.externalIdentifier.identityProvider(TenantApi.identityProviderListItem$$))
+);
+const signUpFetcher = TenantApi.mutation$.signUp(
+  TenantApi.signUpResponse$$.error(TenantApi.signUpError$$.weakPasswordReasons.recommendedAction).result(TenantApi.signUpResult$.person(TenantApi.person$$.identity(TenantApi.identity$.id)))
+);
+const changeProfileFetcher = TenantApi.mutation$.changeProfile(TenantApi.changeProfileResponse$$.error(TenantApi.changeProfileError$$));
+const changePasswordFetcher = TenantApi.mutation$.changePassword(TenantApi.changePasswordResponse$$.error(TenantApi.changePasswordError$$.weakPasswordReasons));
+const disablePersonFetcher = TenantApi.mutation$.disablePerson(TenantApi.disablePersonResponse$$.error(TenantApi.disablePersonError$$));
+const forceSignOutPersonFetcher = TenantApi.mutation$.forceSignOutPerson(TenantApi.forceSignOutPersonResponse$$.error(TenantApi.forceSignOutPersonError$$));
+const resetPersonMfaFetcher = TenantApi.mutation$.resetPersonMfa(TenantApi.resetPersonMfaResponse$$.error(TenantApi.resetPersonMfaError$$));
+const createResetPasswordRequestFetcher = TenantApi.mutation$.createResetPasswordRequest(
+  TenantApi.createPasswordResetRequestResponse$$.error(TenantApi.createPasswordResetRequestError$$)
+);
+const createSessionTokenFetcher = TenantApi.mutation$.createSessionToken(
+  TenantApi.createSessionTokenResponse$$.error(TenantApi.createSessionTokenError$$).result(TenantApi.createSessionTokenResult$.token.person(TenantApi.person$$.id.email.name.identity(TenantApi.identity$.id)))
+);
+const addGlobalIdentityRolesFetcher = TenantApi.mutation$.addGlobalIdentityRoles(
+  TenantApi.addGlobalIdentityRolesResponse$$.error(TenantApi.addGlobalIdentityRolesError$$).result(TenantApi.addGlobalIdentityRolesResult$.identity(TenantApi.identity$.id.roles))
+);
+const removeGlobalIdentityRolesFetcher = TenantApi.mutation$.removeGlobalIdentityRoles(
+  TenantApi.removeGlobalIdentityRolesResponse$$.error(TenantApi.removeGlobalIdentityRolesError$$).result(
+    TenantApi.removeGlobalIdentityRolesResult$.identity(TenantApi.identity$.id.roles)
+  )
+);
+const toTenantPerson = (person) => ({
+  id: person.id,
+  identityId: person.identity.id,
+  email: person.email ?? null,
+  name: person.name ?? null,
+  otpEnabled: person.otpEnabled,
+  emailOtpEnabled: person.emailOtpEnabled,
+  emailVerified: person.emailVerified
+});
+class TenantPersonClient {
+  constructor(transport) {
+    this.transport = transport;
+  }
+  async listPersons({ filter, limit, offset } = {}) {
+    const result = await this.transport.exec(personsFetcher, { filter, limit, offset });
+    return result.persons.map((it) => ({
+      id: it.id,
+      identityId: it.identity.id,
+      email: it.email ?? null,
+      name: it.name ?? null,
+      otpEnabled: it.otpEnabled,
+      emailOtpEnabled: it.emailOtpEnabled,
+      emailVerified: it.emailVerified
+    }));
+  }
+  /** Null both when the person does not exist and when the caller may not see them — the API does not distinguish. */
+  async getPerson(id) {
+    const result = await this.transport.exec(personByIdFetcher, { id });
+    const person = result.personById;
+    if (!person) {
+      return null;
+    }
+    return {
+      ...toTenantPerson(person),
+      passwordlessEnabled: person.passwordlessEnabled ?? null,
+      roles: person.identity.roles ? [...person.identity.roles] : null,
+      sessions: person.identity.sessions.map((it) => ({
+        id: it.id,
+        createdAt: it.createdAt,
+        expiresAt: it.expiresAt ?? null,
+        lastUsedAt: it.lastUsedAt ?? null,
+        lastIp: it.lastIp ?? null,
+        lastUserAgent: it.lastUserAgent ?? null,
+        createdIp: it.createdIp ?? null,
+        createdUserAgent: it.createdUserAgent ?? null,
+        isCurrent: it.isCurrent,
+        trustForwardedClientInfo: it.trustForwardedClientInfo
+      })),
+      identityProviders: person.identityProviders.map((it) => ({
+        id: it.id,
+        slug: it.identityProvider.slug,
+        type: it.identityProvider.type,
+        externalIdentifier: it.externalIdentifier,
+        createdAt: it.createdAt
+      }))
+    };
+  }
+  /**
+   * Creates a person through `signUp`. Needs the `PERSON_SIGN_UP` permission, consumes the tenant's
+   * per-IP sign-up rate limit and triggers the verification mail when the tenant requires it.
+   */
+  async signUp({ email, password, passwordHash, name, roles, captchaToken }) {
+    const result = await this.transport.exec(signUpFetcher, { email, password, passwordHash, name, roles, captchaToken });
+    this.transport.assertOk(result.signUp, `signUp(${email})`);
+    const person = result.signUp?.result?.person;
+    if (!person) {
+      throw new cliCommon.CliError(`signUp(${email}) reported success but returned no person`, {
+        code: "TENANT_API_INVALID_RESPONSE",
+        exitCode: cliCommon.ExitCode.InternalError
+      });
+    }
+    return toTenantPerson(person);
+  }
+  async changeProfile(personId, { email, name }) {
+    const result = await this.transport.exec(changeProfileFetcher, { personId, email, name });
+    this.transport.assertOk(result.changeProfile, `changeProfile(${personId})`);
+  }
+  async changePassword(personId, password) {
+    const result = await this.transport.exec(changePasswordFetcher, { personId, password });
+    this.transport.assertOk(result.changePassword, `changePassword(${personId})`);
+  }
+  async disablePerson(personId) {
+    const result = await this.transport.exec(disablePersonFetcher, { personId });
+    this.transport.assertOk(result.disablePerson, `disablePerson(${personId})`);
+  }
+  async forceSignOutPerson(personId, reason) {
+    const result = await this.transport.exec(forceSignOutPersonFetcher, { personId, reason });
+    this.transport.assertOk(result.forceSignOutPerson, `forceSignOutPerson(${personId})`);
+  }
+  async resetPersonMfa(personId) {
+    const result = await this.transport.exec(resetPersonMfaFetcher, { personId });
+    this.transport.assertOk(result.resetPersonMfa, `resetPersonMfa(${personId})`);
+  }
+  async createResetPasswordRequest(email, options, captchaToken) {
+    const result = await this.transport.exec(createResetPasswordRequestFetcher, { email, options, captchaToken });
+    this.transport.assertOk(result.createResetPasswordRequest, `createResetPasswordRequest(${email})`);
+  }
+  async createSessionToken({ email, personId, expiration, options }) {
+    const result = await this.transport.exec(createSessionTokenFetcher, { email, personId, expiration, options });
+    this.transport.assertOk(result.createSessionToken, "createSessionToken");
+    const tokenResult = result.createSessionToken?.result;
+    if (!tokenResult) {
+      throw new cliCommon.CliError("createSessionToken reported success but returned no token.", {
+        code: "TENANT_API_INVALID_RESPONSE",
+        exitCode: cliCommon.ExitCode.InternalError
+      });
+    }
+    return {
+      token: tokenResult.token,
+      personId: tokenResult.person.id,
+      identityId: tokenResult.person.identity.id,
+      email: tokenResult.person.email ?? null,
+      name: tokenResult.person.name ?? null
+    };
+  }
+  /** Returns the identity's roles after the change, or null when the caller may not read them. */
+  async addGlobalIdentityRoles(identityId, roles) {
+    const result = await this.transport.exec(addGlobalIdentityRolesFetcher, { identityId, roles });
+    this.transport.assertOk(result.addGlobalIdentityRoles, `addGlobalIdentityRoles(${identityId})`);
+    const resultRoles = result.addGlobalIdentityRoles?.result?.identity.roles;
+    return resultRoles ? [...resultRoles] : null;
+  }
+  /** Returns the identity's roles after the change, or null when the caller may not read them. */
+  async removeGlobalIdentityRoles(identityId, roles) {
+    const result = await this.transport.exec(removeGlobalIdentityRolesFetcher, { identityId, roles });
+    this.transport.assertOk(result.removeGlobalIdentityRoles, `removeGlobalIdentityRoles(${identityId})`);
+    const resultRoles = result.removeGlobalIdentityRoles?.result?.identity.roles;
+    return resultRoles ? [...resultRoles] : null;
+  }
+}
+exports.TenantPersonClient = TenantPersonClient;
+//# sourceMappingURL=TenantPersonClient.cjs.map

package/dist/production/src/lib/tenant/clients/TenantPersonClient.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"TenantPersonClient.cjs","sources":["../../../../../../../packages/cli/src/lib/tenant/clients/TenantPersonClient.ts"],"sourcesContent":["import { CliError, ExitCode } from '@contember/cli-common'\nimport {\n\taddGlobalIdentityRolesError$$,\n\taddGlobalIdentityRolesResponse$$,\n\taddGlobalIdentityRolesResult$,\n\tchangePasswordError$$,\n\tchangePasswordResponse$$,\n\tchangeProfileError$$,\n\tchangeProfileResponse$$,\n\tcreatePasswordResetRequestError$$,\n\tcreatePasswordResetRequestResponse$$,\n\ttype CreateResetPasswordRequestOptions,\n\tcreateSessionTokenError$$,\n\tcreateSessionTokenResponse$$,\n\tcreateSessionTokenResult$,\n\tdisablePersonError$$,\n\tdisablePersonResponse$$,\n\tforceSignOutPersonError$$,\n\tforceSignOutPersonResponse$$,\n\tidentity$,\n\tidentityProviderListItem$$,\n\tmutation$,\n\tperson$$,\n\tpersonIdentityProvider$,\n\ttype PersonsFilter,\n\tquery$,\n\tremoveGlobalIdentityRolesError$$,\n\tremoveGlobalIdentityRolesResponse$$,\n\tremoveGlobalIdentityRolesResult$,\n\tresetPersonMfaError$$,\n\tresetPersonMfaResponse$$,\n\tsessionInfo$$,\n\ttype SignInOptions,\n\tsignUpError$$,\n\tsignUpResponse$$,\n\tsignUpResult$,\n} from '@contember/graphql-client-tenant'\nimport { TenantApiTransport } from '../TenantApiTransport.js'\n\nexport interface TenantPerson {\n\tid: string\n\tidentityId: string\n\temail: string | null\n\tname: string | null\n\totpEnabled: boolean\n\temailOtpEnabled: boolean\n\temailVerified: boolean\n}\n\nexport interface TenantPersonSession {\n\tid: string\n\tcreatedAt: string\n\texpiresAt: string | null\n\tlastUsedAt: string | null\n\tlastIp: string | null\n\tlastUserAgent: string | null\n\tcreatedIp: string | null\n\tcreatedUserAgent: string | null\n\tisCurrent: boolean\n\ttrustForwardedClientInfo: boolean\n}\n\nexport interface TenantPersonIdentityProvider {\n\tid: string\n\tslug: string\n\ttype: string\n\texternalIdentifier: string\n\tcreatedAt: string\n}\n\n/**\n * Everything `personById` exposes about a single person. `roles` is null when the caller may not read\n * them, and `sessions` / `identityProviders` come back empty (never an error) for the same reason.\n */\nexport interface TenantPersonDetail extends TenantPerson {\n\tpasswordlessEnabled: boolean | null\n\troles: string[] | null\n\tsessions: TenantPersonSession[]\n\tidentityProviders: TenantPersonIdentityProvider[]\n}\n\nexport interface ListPersonsArgs {\n\tfilter?: PersonsFilter\n\tlimit?: number\n\toffset?: number\n}\n\nexport interface SignUpPersonArgs {\n\temail: string\n\t/** Plaintext password. Mutually exclusive with {@link passwordHash}; omit both to create a person without one. */\n\tpassword?: string\n\t/** Pre-computed bcrypt hash — the tenant API accepts `$2b$` only. */\n\tpasswordHash?: string\n\tname?: string\n\troles?: readonly string[]\n\tcaptchaToken?: string\n}\n\nexport interface CreateSessionTokenArgs {\n\temail?: string\n\tpersonId?: string\n\texpiration?: number\n\toptions?: SignInOptions\n}\n\nexport interface TenantCreatedSessionToken {\n\ttoken: string\n\tpersonId: string\n\tidentityId: string\n\temail: string | null\n\tname: string | null\n}\n\nexport interface ChangeProfileArgs {\n\temail?: string\n\tname?: string\n}\n\n/** The subset of a `person$$` selection the CLI maps — an actual row carries more, which is fine. */\ninterface PersonRow {\n\treadonly id: string\n\treadonly email?: string\n\treadonly name?: string\n\treadonly otpEnabled: boolean\n\treadonly emailOtpEnabled: boolean\n\treadonly emailVerified: boolean\n\treadonly identity: { readonly id: string }\n}\n\n// Fetchers are immutable and reusable, so they are built once at module load.\nconst personsFetcher = query$.persons(person$$.identity(identity$.id))\nconst personByIdFetcher = query$.personById(\n\tperson$$\n\t\t.identity(identity$.id.roles.sessions(sessionInfo$$))\n\t\t.identityProviders(personIdentityProvider$.id.createdAt.externalIdentifier.identityProvider(identityProviderListItem$$)),\n)\nconst signUpFetcher = mutation$.signUp(\n\tsignUpResponse$$.error(signUpError$$.weakPasswordReasons.recommendedAction).result(signUpResult$.person(person$$.identity(identity$.id))),\n)\nconst changeProfileFetcher = mutation$.changeProfile(changeProfileResponse$$.error(changeProfileError$$))\nconst changePasswordFetcher = mutation$.changePassword(changePasswordResponse$$.error(changePasswordError$$.weakPasswordReasons))\nconst disablePersonFetcher = mutation$.disablePerson(disablePersonResponse$$.error(disablePersonError$$))\nconst forceSignOutPersonFetcher = mutation$.forceSignOutPerson(forceSignOutPersonResponse$$.error(forceSignOutPersonError$$))\nconst resetPersonMfaFetcher = mutation$.resetPersonMfa(resetPersonMfaResponse$$.error(resetPersonMfaError$$))\nconst createResetPasswordRequestFetcher = mutation$.createResetPasswordRequest(\n\tcreatePasswordResetRequestResponse$$.error(createPasswordResetRequestError$$),\n)\nconst createSessionTokenFetcher = mutation$.createSessionToken(\n\tcreateSessionTokenResponse$$\n\t\t.error(createSessionTokenError$$)\n\t\t.result(createSessionTokenResult$.token.person(person$$.id.email.name.identity(identity$.id))),\n)\nconst addGlobalIdentityRolesFetcher = mutation$.addGlobalIdentityRoles(\n\taddGlobalIdentityRolesResponse$$.error(addGlobalIdentityRolesError$$).result(addGlobalIdentityRolesResult$.identity(identity$.id.roles)),\n)\nconst removeGlobalIdentityRolesFetcher = mutation$.removeGlobalIdentityRoles(\n\tremoveGlobalIdentityRolesResponse$$.error(removeGlobalIdentityRolesError$$).result(\n\t\tremoveGlobalIdentityRolesResult$.identity(identity$.id.roles),\n\t),\n)\n\nconst toTenantPerson = (person: PersonRow): TenantPerson => ({\n\tid: person.id,\n\tidentityId: person.identity.id,\n\temail: person.email ?? null,\n\tname: person.name ?? null,\n\totpEnabled: person.otpEnabled,\n\temailOtpEnabled: person.emailOtpEnabled,\n\temailVerified: person.emailVerified,\n})\n\n/** Persons, their global identity roles and their sessions. */\nexport class TenantPersonClient {\n\tconstructor(\n\t\tprivate readonly transport: TenantApiTransport,\n\t) {\n\t}\n\n\tpublic async listPersons({ filter, limit, offset }: ListPersonsArgs = {}): Promise<TenantPerson[]> {\n\t\tconst result = await this.transport.exec(personsFetcher, { filter, limit, offset })\n\t\treturn result.persons.map(it => ({\n\t\t\tid: it.id,\n\t\t\tidentityId: it.identity.id,\n\t\t\temail: it.email ?? null,\n\t\t\tname: it.name ?? null,\n\t\t\totpEnabled: it.otpEnabled,\n\t\t\temailOtpEnabled: it.emailOtpEnabled,\n\t\t\temailVerified: it.emailVerified,\n\t\t}))\n\t}\n\n\t/** Null both when the person does not exist and when the caller may not see them — the API does not distinguish. */\n\tpublic async getPerson(id: string): Promise<TenantPersonDetail | null> {\n\t\tconst result = await this.transport.exec(personByIdFetcher, { id })\n\t\tconst person = result.personById\n\t\tif (!person) {\n\t\t\treturn null\n\t\t}\n\t\treturn {\n\t\t\t...toTenantPerson(person),\n\t\t\tpasswordlessEnabled: person.passwordlessEnabled ?? null,\n\t\t\troles: person.identity.roles ? [...person.identity.roles] : null,\n\t\t\tsessions: person.identity.sessions.map(it => ({\n\t\t\t\tid: it.id,\n\t\t\t\tcreatedAt: it.createdAt,\n\t\t\t\texpiresAt: it.expiresAt ?? null,\n\t\t\t\tlastUsedAt: it.lastUsedAt ?? null,\n\t\t\t\tlastIp: it.lastIp ?? null,\n\t\t\t\tlastUserAgent: it.lastUserAgent ?? null,\n\t\t\t\tcreatedIp: it.createdIp ?? null,\n\t\t\t\tcreatedUserAgent: it.createdUserAgent ?? null,\n\t\t\t\tisCurrent: it.isCurrent,\n\t\t\t\ttrustForwardedClientInfo: it.trustForwardedClientInfo,\n\t\t\t})),\n\t\t\tidentityProviders: person.identityProviders.map(it => ({\n\t\t\t\tid: it.id,\n\t\t\t\tslug: it.identityProvider.slug,\n\t\t\t\ttype: it.identityProvider.type,\n\t\t\t\texternalIdentifier: it.externalIdentifier,\n\t\t\t\tcreatedAt: it.createdAt,\n\t\t\t})),\n\t\t}\n\t}\n\n\t/**\n\t * Creates a person through `signUp`. Needs the `PERSON_SIGN_UP` permission, consumes the tenant's\n\t * per-IP sign-up rate limit and triggers the verification mail when the tenant requires it.\n\t */\n\tpublic async signUp({ email, password, passwordHash, name, roles, captchaToken }: SignUpPersonArgs): Promise<TenantPerson> {\n\t\tconst result = await this.transport.exec(signUpFetcher, { email, password, passwordHash, name, roles, captchaToken })\n\t\tthis.transport.assertOk(result.signUp, `signUp(${email})`)\n\t\tconst person = result.signUp?.result?.person\n\t\tif (!person) {\n\t\t\tthrow new CliError(`signUp(${email}) reported success but returned no person`, {\n\t\t\t\tcode: 'TENANT_API_INVALID_RESPONSE',\n\t\t\t\texitCode: ExitCode.InternalError,\n\t\t\t})\n\t\t}\n\t\treturn toTenantPerson(person)\n\t}\n\n\tpublic async changeProfile(personId: string, { email, name }: ChangeProfileArgs): Promise<void> {\n\t\tconst result = await this.transport.exec(changeProfileFetcher, { personId, email, name })\n\t\tthis.transport.assertOk(result.changeProfile, `changeProfile(${personId})`)\n\t}\n\n\tpublic async changePassword(personId: string, password: string): Promise<void> {\n\t\tconst result = await this.transport.exec(changePasswordFetcher, { personId, password })\n\t\tthis.transport.assertOk(result.changePassword, `changePassword(${personId})`)\n\t}\n\n\tpublic async disablePerson(personId: string): Promise<void> {\n\t\tconst result = await this.transport.exec(disablePersonFetcher, { personId })\n\t\tthis.transport.assertOk(result.disablePerson, `disablePerson(${personId})`)\n\t}\n\n\tpublic async forceSignOutPerson(personId: string, reason?: string): Promise<void> {\n\t\tconst result = await this.transport.exec(forceSignOutPersonFetcher, { personId, reason })\n\t\tthis.transport.assertOk(result.forceSignOutPerson, `forceSignOutPerson(${personId})`)\n\t}\n\n\tpublic async resetPersonMfa(personId: string): Promise<void> {\n\t\tconst result = await this.transport.exec(resetPersonMfaFetcher, { personId })\n\t\tthis.transport.assertOk(result.resetPersonMfa, `resetPersonMfa(${personId})`)\n\t}\n\n\tpublic async createResetPasswordRequest(email: string, options?: CreateResetPasswordRequestOptions, captchaToken?: string): Promise<void> {\n\t\tconst result = await this.transport.exec(createResetPasswordRequestFetcher, { email, options, captchaToken })\n\t\tthis.transport.assertOk(result.createResetPasswordRequest, `createResetPasswordRequest(${email})`)\n\t}\n\n\tpublic async createSessionToken({ email, personId, expiration, options }: CreateSessionTokenArgs): Promise<TenantCreatedSessionToken> {\n\t\tconst result = await this.transport.exec(createSessionTokenFetcher, { email, personId, expiration, options })\n\t\tthis.transport.assertOk(result.createSessionToken, 'createSessionToken')\n\t\tconst tokenResult = result.createSessionToken?.result\n\t\tif (!tokenResult) {\n\t\t\tthrow new CliError('createSessionToken reported success but returned no token.', {\n\t\t\t\tcode: 'TENANT_API_INVALID_RESPONSE',\n\t\t\t\texitCode: ExitCode.InternalError,\n\t\t\t})\n\t\t}\n\t\treturn {\n\t\t\ttoken: tokenResult.token,\n\t\t\tpersonId: tokenResult.person.id,\n\t\t\tidentityId: tokenResult.person.identity.id,\n\t\t\temail: tokenResult.person.email ?? null,\n\t\t\tname: tokenResult.person.name ?? null,\n\t\t}\n\t}\n\n\t/** Returns the identity's roles after the change, or null when the caller may not read them. */\n\tpublic async addGlobalIdentityRoles(identityId: string, roles: readonly string[]): Promise<string[] | null> {\n\t\tconst result = await this.transport.exec(addGlobalIdentityRolesFetcher, { identityId, roles })\n\t\tthis.transport.assertOk(result.addGlobalIdentityRoles, `addGlobalIdentityRoles(${identityId})`)\n\t\tconst resultRoles = result.addGlobalIdentityRoles?.result?.identity.roles\n\t\treturn resultRoles ? [...resultRoles] : null\n\t}\n\n\t/** Returns the identity's roles after the change, or null when the caller may not read them. */\n\tpublic async removeGlobalIdentityRoles(identityId: string, roles: readonly string[]): Promise<string[] | null> {\n\t\tconst result = await this.transport.exec(removeGlobalIdentityRolesFetcher, { identityId, roles })\n\t\tthis.transport.assertOk(result.removeGlobalIdentityRoles, `removeGlobalIdentityRoles(${identityId})`)\n\t\tconst resultRoles = result.removeGlobalIdentityRoles?.result?.identity.roles\n\t\treturn resultRoles ? [...resultRoles] : null\n\t}\n}\n"],"names":["query$","person$$","identity$","sessionInfo$$","personIdentityProvider$","identityProviderListItem$$","mutation$","signUpResponse$$","signUpError$$","signUpResult$","changeProfileResponse$$","changeProfileError$$","changePasswordResponse$$","changePasswordError$$","disablePersonResponse$$","disablePersonError$$","forceSignOutPersonResponse$$","forceSignOutPersonError$$","resetPersonMfaResponse$$","resetPersonMfaError$$","createPasswordResetRequestResponse$$","createPasswordResetRequestError$$","createSessionTokenResponse$$","createSessionTokenError$$","createSessionTokenResult$","addGlobalIdentityRolesResponse$$","addGlobalIdentityRolesError$$","addGlobalIdentityRolesResult$","removeGlobalIdentityRolesResponse$$","removeGlobalIdentityRolesError$$","removeGlobalIdentityRolesResult$","CliError","ExitCode"],"mappings":";;;;AAkIA,MAAM,iBAAiBA,UAAAA,OAAO,QAAQC,UAAAA,SAAS,SAASC,UAAAA,UAAU,EAAE,CAAC;AACrE,MAAM,oBAAoBF,UAAAA,OAAO;AAAA,EAChCC,UAAAA,SACE,SAASC,UAAAA,UAAU,GAAG,MAAM,SAASC,UAAAA,aAAa,CAAC,EACnD,kBAAkBC,UAAAA,wBAAwB,GAAG,UAAU,mBAAmB,iBAAiBC,oCAA0B,CAAC;AACzH;AACA,MAAM,gBAAgBC,UAAAA,UAAU;AAAA,EAC/BC,UAAAA,iBAAiB,MAAMC,UAAAA,cAAc,oBAAoB,iBAAiB,EAAE,OAAOC,UAAAA,cAAc,OAAOR,UAAAA,SAAS,SAASC,UAAAA,UAAU,EAAE,CAAC,CAAC;AACzI;AACA,MAAM,uBAAuBI,UAAAA,UAAU,cAAcI,UAAAA,wBAAwB,MAAMC,UAAAA,oBAAoB,CAAC;AACxG,MAAM,wBAAwBL,UAAAA,UAAU,eAAeM,UAAAA,yBAAyB,MAAMC,UAAAA,sBAAsB,mBAAmB,CAAC;AAChI,MAAM,uBAAuBP,UAAAA,UAAU,cAAcQ,UAAAA,wBAAwB,MAAMC,UAAAA,oBAAoB,CAAC;AACxG,MAAM,4BAA4BT,UAAAA,UAAU,mBAAmBU,UAAAA,6BAA6B,MAAMC,UAAAA,yBAAyB,CAAC;AAC5H,MAAM,wBAAwBX,UAAAA,UAAU,eAAeY,UAAAA,yBAAyB,MAAMC,UAAAA,qBAAqB,CAAC;AAC5G,MAAM,oCAAoCb,UAAAA,UAAU;AAAA,EACnDc,UAAAA,qCAAqC,MAAMC,UAAAA,iCAAiC;AAC7E;AACA,MAAM,4BAA4Bf,UAAAA,UAAU;AAAA,EAC3CgB,UAAAA,6BACE,MAAMC,UAAAA,yBAAyB,EAC/B,OAAOC,UAAAA,0BAA0B,MAAM,OAAOvB,UAAAA,SAAS,GAAG,MAAM,KAAK,SAASC,UAAAA,UAAU,EAAE,CAAC,CAAC;AAC/F;AACA,MAAM,gCAAgCI,UAAAA,UAAU;AAAA,EAC/CmB,2CAAiC,MAAMC,UAAAA,6BAA6B,EAAE,OAAOC,UAAAA,8BAA8B,SAASzB,UAAAA,UAAU,GAAG,KAAK,CAAC;AACxI;AACA,MAAM,mCAAmCI,UAAAA,UAAU;AAAA,EAClDsB,8CAAoC,MAAMC,UAAAA,gCAAgC,EAAE;AAAA,IAC3EC,UAAAA,iCAAiC,SAAS5B,oBAAU,GAAG,KAAK;AAAA,EAAA;AAE9D;AAEA,MAAM,iBAAiB,CAAC,YAAqC;AAAA,EAC5D,IAAI,OAAO;AAAA,EACX,YAAY,OAAO,SAAS;AAAA,EAC5B,OAAO,OAAO,SAAS;AAAA,EACvB,MAAM,OAAO,QAAQ;AAAA,EACrB,YAAY,OAAO;AAAA,EACnB,iBAAiB,OAAO;AAAA,EACxB,eAAe,OAAO;AACvB;AAGO,MAAM,mBAAmB;AAAA,EAC/B,YACkB,WAChB;AADgB,SAAA,YAAA;AAAA,EAElB;AAAA,EAEA,MAAa,YAAY,EAAE,QAAQ,OAAO,OAAA,IAA4B,CAAA,GAA6B;AAClG,UAAM,SAAS,MAAM,KAAK,UAAU,KAAK,gBAAgB,EAAE,QAAQ,OAAO,QAAQ;AAClF,WAAO,OAAO,QAAQ,IAAI,CAAA,QAAO;AAAA,MAChC,IAAI,GAAG;AAAA,MACP,YAAY,GAAG,SAAS;AAAA,MACxB,OAAO,GAAG,SAAS;AAAA,MACnB,MAAM,GAAG,QAAQ;AAAA,MACjB,YAAY,GAAG;AAAA,MACf,iBAAiB,GAAG;AAAA,MACpB,eAAe,GAAG;AAAA,IAAA,EACjB;AAAA,EACH;AAAA;AAAA,EAGA,MAAa,UAAU,IAAgD;AACtE,UAAM,SAAS,MAAM,KAAK,UAAU,KAAK,mBAAmB,EAAE,IAAI;AAClE,UAAM,SAAS,OAAO;AACtB,QAAI,CAAC,QAAQ;AACZ,aAAO;AAAA,IACR;AACA,WAAO;AAAA,MACN,GAAG,eAAe,MAAM;AAAA,MACxB,qBAAqB,OAAO,uBAAuB;AAAA,MACnD,OAAO,OAAO,SAAS,QAAQ,CAAC,GAAG,OAAO,SAAS,KAAK,IAAI;AAAA,MAC5D,UAAU,OAAO,SAAS,SAAS,IAAI,CAAA,QAAO;AAAA,QAC7C,IAAI,GAAG;AAAA,QACP,WAAW,GAAG;AAAA,QACd,WAAW,GAAG,aAAa;AAAA,QAC3B,YAAY,GAAG,cAAc;AAAA,QAC7B,QAAQ,GAAG,UAAU;AAAA,QACrB,eAAe,GAAG,iBAAiB;AAAA,QACnC,WAAW,GAAG,aAAa;AAAA,QAC3B,kBAAkB,GAAG,oBAAoB;AAAA,QACzC,WAAW,GAAG;AAAA,QACd,0BAA0B,GAAG;AAAA,MAAA,EAC5B;AAAA,MACF,mBAAmB,OAAO,kBAAkB,IAAI,CAAA,QAAO;AAAA,QACtD,IAAI,GAAG;AAAA,QACP,MAAM,GAAG,iBAAiB;AAAA,QAC1B,MAAM,GAAG,iBAAiB;AAAA,QAC1B,oBAAoB,GAAG;AAAA,QACvB,WAAW,GAAG;AAAA,MAAA,EACb;AAAA,IAAA;AAAA,EAEJ;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,MAAa,OAAO,EAAE,OAAO,UAAU,cAAc,MAAM,OAAO,gBAAyD;AAC1H,UAAM,SAAS,MAAM,KAAK,UAAU,KAAK,eAAe,EAAE,OAAO,UAAU,cAAc,MAAM,OAAO,cAAc;AACpH,SAAK,UAAU,SAAS,OAAO,QAAQ,UAAU,KAAK,GAAG;AACzD,UAAM,SAAS,OAAO,QAAQ,QAAQ;AACtC,QAAI,CAAC,QAAQ;AACZ,YAAM,IAAI6B,UAAAA,SAAS,UAAU,KAAK,6CAA6C;AAAA,QAC9E,MAAM;AAAA,QACN,UAAUC,UAAAA,SAAS;AAAA,MAAA,CACnB;AAAA,IACF;AACA,WAAO,eAAe,MAAM;AAAA,EAC7B;AAAA,EAEA,MAAa,cAAc,UAAkB,EAAE,OAAO,QAA0C;AAC/F,UAAM,SAAS,MAAM,KAAK,UAAU,KAAK,sBAAsB,EAAE,UAAU,OAAO,MAAM;AACxF,SAAK,UAAU,SAAS,OAAO,eAAe,iBAAiB,QAAQ,GAAG;AAAA,EAC3E;AAAA,EAEA,MAAa,eAAe,UAAkB,UAAiC;AAC9E,UAAM,SAAS,MAAM,KAAK,UAAU,KAAK,uBAAuB,EAAE,UAAU,UAAU;AACtF,SAAK,UAAU,SAAS,OAAO,gBAAgB,kBAAkB,QAAQ,GAAG;AAAA,EAC7E;AAAA,EAEA,MAAa,cAAc,UAAiC;AAC3D,UAAM,SAAS,MAAM,KAAK,UAAU,KAAK,sBAAsB,EAAE,UAAU;AAC3E,SAAK,UAAU,SAAS,OAAO,eAAe,iBAAiB,QAAQ,GAAG;AAAA,EAC3E;AAAA,EAEA,MAAa,mBAAmB,UAAkB,QAAgC;AACjF,UAAM,SAAS,MAAM,KAAK,UAAU,KAAK,2BAA2B,EAAE,UAAU,QAAQ;AACxF,SAAK,UAAU,SAAS,OAAO,oBAAoB,sBAAsB,QAAQ,GAAG;AAAA,EACrF;AAAA,EAEA,MAAa,eAAe,UAAiC;AAC5D,UAAM,SAAS,MAAM,KAAK,UAAU,KAAK,uBAAuB,EAAE,UAAU;AAC5E,SAAK,UAAU,SAAS,OAAO,gBAAgB,kBAAkB,QAAQ,GAAG;AAAA,EAC7E;AAAA,EAEA,MAAa,2BAA2B,OAAe,SAA6C,cAAsC;AACzI,UAAM,SAAS,MAAM,KAAK,UAAU,KAAK,mCAAmC,EAAE,OAAO,SAAS,cAAc;AAC5G,SAAK,UAAU,SAAS,OAAO,4BAA4B,8BAA8B,KAAK,GAAG;AAAA,EAClG;AAAA,EAEA,MAAa,mBAAmB,EAAE,OAAO,UAAU,YAAY,WAAuE;AACrI,UAAM,SAAS,MAAM,KAAK,UAAU,KAAK,2BAA2B,EAAE,OAAO,UAAU,YAAY,QAAA,CAAS;AAC5G,SAAK,UAAU,SAAS,OAAO,oBAAoB,oBAAoB;AACvE,UAAM,cAAc,OAAO,oBAAoB;AAC/C,QAAI,CAAC,aAAa;AACjB,YAAM,IAAID,UAAAA,SAAS,8DAA8D;AAAA,QAChF,MAAM;AAAA,QACN,UAAUC,UAAAA,SAAS;AAAA,MAAA,CACnB;AAAA,IACF;AACA,WAAO;AAAA,MACN,OAAO,YAAY;AAAA,MACnB,UAAU,YAAY,OAAO;AAAA,MAC7B,YAAY,YAAY,OAAO,SAAS;AAAA,MACxC,OAAO,YAAY,OAAO,SAAS;AAAA,MACnC,MAAM,YAAY,OAAO,QAAQ;AAAA,IAAA;AAAA,EAEnC;AAAA;AAAA,EAGA,MAAa,uBAAuB,YAAoB,OAAoD;AAC3G,UAAM,SAAS,MAAM,KAAK,UAAU,KAAK,+BAA+B,EAAE,YAAY,OAAO;AAC7F,SAAK,UAAU,SAAS,OAAO,wBAAwB,0BAA0B,UAAU,GAAG;AAC9F,UAAM,cAAc,OAAO,wBAAwB,QAAQ,SAAS;AACpE,WAAO,cAAc,CAAC,GAAG,WAAW,IAAI;AAAA,EACzC;AAAA;AAAA,EAGA,MAAa,0BAA0B,YAAoB,OAAoD;AAC9G,UAAM,SAAS,MAAM,KAAK,UAAU,KAAK,kCAAkC,EAAE,YAAY,OAAO;AAChG,SAAK,UAAU,SAAS,OAAO,2BAA2B,6BAA6B,UAAU,GAAG;AACpG,UAAM,cAAc,OAAO,2BAA2B,QAAQ,SAAS;AACvE,WAAO,cAAc,CAAC,GAAG,WAAW,IAAI;AAAA,EACzC;AACD;;"}

package/dist/production/src/lib/tenant/clients/TenantPersonClient.js

@@ -0,0 +1,162 @@
+import { CliError, ExitCode } from "@contember/cli-common";
+import { query$, person$$, identity$, sessionInfo$$, personIdentityProvider$, identityProviderListItem$$, mutation$, signUpResponse$$, signUpError$$, signUpResult$, changeProfileResponse$$, changeProfileError$$, changePasswordResponse$$, changePasswordError$$, disablePersonResponse$$, disablePersonError$$, forceSignOutPersonResponse$$, forceSignOutPersonError$$, resetPersonMfaResponse$$, resetPersonMfaError$$, createPasswordResetRequestResponse$$, createPasswordResetRequestError$$, createSessionTokenResponse$$, createSessionTokenError$$, createSessionTokenResult$, addGlobalIdentityRolesResponse$$, addGlobalIdentityRolesError$$, addGlobalIdentityRolesResult$, removeGlobalIdentityRolesResponse$$, removeGlobalIdentityRolesError$$, removeGlobalIdentityRolesResult$ } from "@contember/graphql-client-tenant";
+const personsFetcher = query$.persons(person$$.identity(identity$.id));
+const personByIdFetcher = query$.personById(
+  person$$.identity(identity$.id.roles.sessions(sessionInfo$$)).identityProviders(personIdentityProvider$.id.createdAt.externalIdentifier.identityProvider(identityProviderListItem$$))
+);
+const signUpFetcher = mutation$.signUp(
+  signUpResponse$$.error(signUpError$$.weakPasswordReasons.recommendedAction).result(signUpResult$.person(person$$.identity(identity$.id)))
+);
+const changeProfileFetcher = mutation$.changeProfile(changeProfileResponse$$.error(changeProfileError$$));
+const changePasswordFetcher = mutation$.changePassword(changePasswordResponse$$.error(changePasswordError$$.weakPasswordReasons));
+const disablePersonFetcher = mutation$.disablePerson(disablePersonResponse$$.error(disablePersonError$$));
+const forceSignOutPersonFetcher = mutation$.forceSignOutPerson(forceSignOutPersonResponse$$.error(forceSignOutPersonError$$));
+const resetPersonMfaFetcher = mutation$.resetPersonMfa(resetPersonMfaResponse$$.error(resetPersonMfaError$$));
+const createResetPasswordRequestFetcher = mutation$.createResetPasswordRequest(
+  createPasswordResetRequestResponse$$.error(createPasswordResetRequestError$$)
+);
+const createSessionTokenFetcher = mutation$.createSessionToken(
+  createSessionTokenResponse$$.error(createSessionTokenError$$).result(createSessionTokenResult$.token.person(person$$.id.email.name.identity(identity$.id)))
+);
+const addGlobalIdentityRolesFetcher = mutation$.addGlobalIdentityRoles(
+  addGlobalIdentityRolesResponse$$.error(addGlobalIdentityRolesError$$).result(addGlobalIdentityRolesResult$.identity(identity$.id.roles))
+);
+const removeGlobalIdentityRolesFetcher = mutation$.removeGlobalIdentityRoles(
+  removeGlobalIdentityRolesResponse$$.error(removeGlobalIdentityRolesError$$).result(
+    removeGlobalIdentityRolesResult$.identity(identity$.id.roles)
+  )
+);
+const toTenantPerson = (person) => ({
+  id: person.id,
+  identityId: person.identity.id,
+  email: person.email ?? null,
+  name: person.name ?? null,
+  otpEnabled: person.otpEnabled,
+  emailOtpEnabled: person.emailOtpEnabled,
+  emailVerified: person.emailVerified
+});
+class TenantPersonClient {
+  constructor(transport) {
+    this.transport = transport;
+  }
+  async listPersons({ filter, limit, offset } = {}) {
+    const result = await this.transport.exec(personsFetcher, { filter, limit, offset });
+    return result.persons.map((it) => ({
+      id: it.id,
+      identityId: it.identity.id,
+      email: it.email ?? null,
+      name: it.name ?? null,
+      otpEnabled: it.otpEnabled,
+      emailOtpEnabled: it.emailOtpEnabled,
+      emailVerified: it.emailVerified
+    }));
+  }
+  /** Null both when the person does not exist and when the caller may not see them — the API does not distinguish. */
+  async getPerson(id) {
+    const result = await this.transport.exec(personByIdFetcher, { id });
+    const person = result.personById;
+    if (!person) {
+      return null;
+    }
+    return {
+      ...toTenantPerson(person),
+      passwordlessEnabled: person.passwordlessEnabled ?? null,
+      roles: person.identity.roles ? [...person.identity.roles] : null,
+      sessions: person.identity.sessions.map((it) => ({
+        id: it.id,
+        createdAt: it.createdAt,
+        expiresAt: it.expiresAt ?? null,
+        lastUsedAt: it.lastUsedAt ?? null,
+        lastIp: it.lastIp ?? null,
+        lastUserAgent: it.lastUserAgent ?? null,
+        createdIp: it.createdIp ?? null,
+        createdUserAgent: it.createdUserAgent ?? null,
+        isCurrent: it.isCurrent,
+        trustForwardedClientInfo: it.trustForwardedClientInfo
+      })),
+      identityProviders: person.identityProviders.map((it) => ({
+        id: it.id,
+        slug: it.identityProvider.slug,
+        type: it.identityProvider.type,
+        externalIdentifier: it.externalIdentifier,
+        createdAt: it.createdAt
+      }))
+    };
+  }
+  /**
+   * Creates a person through `signUp`. Needs the `PERSON_SIGN_UP` permission, consumes the tenant's
+   * per-IP sign-up rate limit and triggers the verification mail when the tenant requires it.
+   */
+  async signUp({ email, password, passwordHash, name, roles, captchaToken }) {
+    const result = await this.transport.exec(signUpFetcher, { email, password, passwordHash, name, roles, captchaToken });
+    this.transport.assertOk(result.signUp, `signUp(${email})`);
+    const person = result.signUp?.result?.person;
+    if (!person) {
+      throw new CliError(`signUp(${email}) reported success but returned no person`, {
+        code: "TENANT_API_INVALID_RESPONSE",
+        exitCode: ExitCode.InternalError
+      });
+    }
+    return toTenantPerson(person);
+  }
+  async changeProfile(personId, { email, name }) {
+    const result = await this.transport.exec(changeProfileFetcher, { personId, email, name });
+    this.transport.assertOk(result.changeProfile, `changeProfile(${personId})`);
+  }
+  async changePassword(personId, password) {
+    const result = await this.transport.exec(changePasswordFetcher, { personId, password });
+    this.transport.assertOk(result.changePassword, `changePassword(${personId})`);
+  }
+  async disablePerson(personId) {
+    const result = await this.transport.exec(disablePersonFetcher, { personId });
+    this.transport.assertOk(result.disablePerson, `disablePerson(${personId})`);
+  }
+  async forceSignOutPerson(personId, reason) {
+    const result = await this.transport.exec(forceSignOutPersonFetcher, { personId, reason });
+    this.transport.assertOk(result.forceSignOutPerson, `forceSignOutPerson(${personId})`);
+  }
+  async resetPersonMfa(personId) {
+    const result = await this.transport.exec(resetPersonMfaFetcher, { personId });
+    this.transport.assertOk(result.resetPersonMfa, `resetPersonMfa(${personId})`);
+  }
+  async createResetPasswordRequest(email, options, captchaToken) {
+    const result = await this.transport.exec(createResetPasswordRequestFetcher, { email, options, captchaToken });
+    this.transport.assertOk(result.createResetPasswordRequest, `createResetPasswordRequest(${email})`);
+  }
+  async createSessionToken({ email, personId, expiration, options }) {
+    const result = await this.transport.exec(createSessionTokenFetcher, { email, personId, expiration, options });
+    this.transport.assertOk(result.createSessionToken, "createSessionToken");
+    const tokenResult = result.createSessionToken?.result;
+    if (!tokenResult) {
+      throw new CliError("createSessionToken reported success but returned no token.", {
+        code: "TENANT_API_INVALID_RESPONSE",
+        exitCode: ExitCode.InternalError
+      });
+    }
+    return {
+      token: tokenResult.token,
+      personId: tokenResult.person.id,
+      identityId: tokenResult.person.identity.id,
+      email: tokenResult.person.email ?? null,
+      name: tokenResult.person.name ?? null
+    };
+  }
+  /** Returns the identity's roles after the change, or null when the caller may not read them. */
+  async addGlobalIdentityRoles(identityId, roles) {
+    const result = await this.transport.exec(addGlobalIdentityRolesFetcher, { identityId, roles });
+    this.transport.assertOk(result.addGlobalIdentityRoles, `addGlobalIdentityRoles(${identityId})`);
+    const resultRoles = result.addGlobalIdentityRoles?.result?.identity.roles;
+    return resultRoles ? [...resultRoles] : null;
+  }
+  /** Returns the identity's roles after the change, or null when the caller may not read them. */
+  async removeGlobalIdentityRoles(identityId, roles) {
+    const result = await this.transport.exec(removeGlobalIdentityRolesFetcher, { identityId, roles });
+    this.transport.assertOk(result.removeGlobalIdentityRoles, `removeGlobalIdentityRoles(${identityId})`);
+    const resultRoles = result.removeGlobalIdentityRoles?.result?.identity.roles;
+    return resultRoles ? [...resultRoles] : null;
+  }
+}
+export {
+  TenantPersonClient
+};
+//# sourceMappingURL=TenantPersonClient.js.map