@contember/cli 2.1.0-rc.3 → 2.2.0-alpha.10

package/dist/production/src/lib/tenant/clients/TenantPersonClient.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"TenantPersonClient.js","sources":["../../../../../../../packages/cli/src/lib/tenant/clients/TenantPersonClient.ts"],"sourcesContent":["import { CliError, ExitCode } from '@contember/cli-common'\nimport {\n\taddGlobalIdentityRolesError$$,\n\taddGlobalIdentityRolesResponse$$,\n\taddGlobalIdentityRolesResult$,\n\tchangePasswordError$$,\n\tchangePasswordResponse$$,\n\tchangeProfileError$$,\n\tchangeProfileResponse$$,\n\tcreatePasswordResetRequestError$$,\n\tcreatePasswordResetRequestResponse$$,\n\ttype CreateResetPasswordRequestOptions,\n\tcreateSessionTokenError$$,\n\tcreateSessionTokenResponse$$,\n\tcreateSessionTokenResult$,\n\tdisablePersonError$$,\n\tdisablePersonResponse$$,\n\tforceSignOutPersonError$$,\n\tforceSignOutPersonResponse$$,\n\tidentity$,\n\tidentityProviderListItem$$,\n\tmutation$,\n\tperson$$,\n\tpersonIdentityProvider$,\n\ttype PersonsFilter,\n\tquery$,\n\tremoveGlobalIdentityRolesError$$,\n\tremoveGlobalIdentityRolesResponse$$,\n\tremoveGlobalIdentityRolesResult$,\n\tresetPersonMfaError$$,\n\tresetPersonMfaResponse$$,\n\tsessionInfo$$,\n\ttype SignInOptions,\n\tsignUpError$$,\n\tsignUpResponse$$,\n\tsignUpResult$,\n} from '@contember/graphql-client-tenant'\nimport { TenantApiTransport } from '../TenantApiTransport.js'\n\nexport interface TenantPerson {\n\tid: string\n\tidentityId: string\n\temail: string | null\n\tname: string | null\n\totpEnabled: boolean\n\temailOtpEnabled: boolean\n\temailVerified: boolean\n}\n\nexport interface TenantPersonSession {\n\tid: string\n\tcreatedAt: string\n\texpiresAt: string | null\n\tlastUsedAt: string | null\n\tlastIp: string | null\n\tlastUserAgent: string | null\n\tcreatedIp: string | null\n\tcreatedUserAgent: string | null\n\tisCurrent: boolean\n\ttrustForwardedClientInfo: boolean\n}\n\nexport interface TenantPersonIdentityProvider {\n\tid: string\n\tslug: string\n\ttype: string\n\texternalIdentifier: string\n\tcreatedAt: string\n}\n\n/**\n * Everything `personById` exposes about a single person. `roles` is null when the caller may not read\n * them, and `sessions` / `identityProviders` come back empty (never an error) for the same reason.\n */\nexport interface TenantPersonDetail extends TenantPerson {\n\tpasswordlessEnabled: boolean | null\n\troles: string[] | null\n\tsessions: TenantPersonSession[]\n\tidentityProviders: TenantPersonIdentityProvider[]\n}\n\nexport interface ListPersonsArgs {\n\tfilter?: PersonsFilter\n\tlimit?: number\n\toffset?: number\n}\n\nexport interface SignUpPersonArgs {\n\temail: string\n\t/** Plaintext password. Mutually exclusive with {@link passwordHash}; omit both to create a person without one. */\n\tpassword?: string\n\t/** Pre-computed bcrypt hash — the tenant API accepts `$2b$` only. */\n\tpasswordHash?: string\n\tname?: string\n\troles?: readonly string[]\n\tcaptchaToken?: string\n}\n\nexport interface CreateSessionTokenArgs {\n\temail?: string\n\tpersonId?: string\n\texpiration?: number\n\toptions?: SignInOptions\n}\n\nexport interface TenantCreatedSessionToken {\n\ttoken: string\n\tpersonId: string\n\tidentityId: string\n\temail: string | null\n\tname: string | null\n}\n\nexport interface ChangeProfileArgs {\n\temail?: string\n\tname?: string\n}\n\n/** The subset of a `person$$` selection the CLI maps — an actual row carries more, which is fine. */\ninterface PersonRow {\n\treadonly id: string\n\treadonly email?: string\n\treadonly name?: string\n\treadonly otpEnabled: boolean\n\treadonly emailOtpEnabled: boolean\n\treadonly emailVerified: boolean\n\treadonly identity: { readonly id: string }\n}\n\n// Fetchers are immutable and reusable, so they are built once at module load.\nconst personsFetcher = query$.persons(person$$.identity(identity$.id))\nconst personByIdFetcher = query$.personById(\n\tperson$$\n\t\t.identity(identity$.id.roles.sessions(sessionInfo$$))\n\t\t.identityProviders(personIdentityProvider$.id.createdAt.externalIdentifier.identityProvider(identityProviderListItem$$)),\n)\nconst signUpFetcher = mutation$.signUp(\n\tsignUpResponse$$.error(signUpError$$.weakPasswordReasons.recommendedAction).result(signUpResult$.person(person$$.identity(identity$.id))),\n)\nconst changeProfileFetcher = mutation$.changeProfile(changeProfileResponse$$.error(changeProfileError$$))\nconst changePasswordFetcher = mutation$.changePassword(changePasswordResponse$$.error(changePasswordError$$.weakPasswordReasons))\nconst disablePersonFetcher = mutation$.disablePerson(disablePersonResponse$$.error(disablePersonError$$))\nconst forceSignOutPersonFetcher = mutation$.forceSignOutPerson(forceSignOutPersonResponse$$.error(forceSignOutPersonError$$))\nconst resetPersonMfaFetcher = mutation$.resetPersonMfa(resetPersonMfaResponse$$.error(resetPersonMfaError$$))\nconst createResetPasswordRequestFetcher = mutation$.createResetPasswordRequest(\n\tcreatePasswordResetRequestResponse$$.error(createPasswordResetRequestError$$),\n)\nconst createSessionTokenFetcher = mutation$.createSessionToken(\n\tcreateSessionTokenResponse$$\n\t\t.error(createSessionTokenError$$)\n\t\t.result(createSessionTokenResult$.token.person(person$$.id.email.name.identity(identity$.id))),\n)\nconst addGlobalIdentityRolesFetcher = mutation$.addGlobalIdentityRoles(\n\taddGlobalIdentityRolesResponse$$.error(addGlobalIdentityRolesError$$).result(addGlobalIdentityRolesResult$.identity(identity$.id.roles)),\n)\nconst removeGlobalIdentityRolesFetcher = mutation$.removeGlobalIdentityRoles(\n\tremoveGlobalIdentityRolesResponse$$.error(removeGlobalIdentityRolesError$$).result(\n\t\tremoveGlobalIdentityRolesResult$.identity(identity$.id.roles),\n\t),\n)\n\nconst toTenantPerson = (person: PersonRow): TenantPerson => ({\n\tid: person.id,\n\tidentityId: person.identity.id,\n\temail: person.email ?? null,\n\tname: person.name ?? null,\n\totpEnabled: person.otpEnabled,\n\temailOtpEnabled: person.emailOtpEnabled,\n\temailVerified: person.emailVerified,\n})\n\n/** Persons, their global identity roles and their sessions. */\nexport class TenantPersonClient {\n\tconstructor(\n\t\tprivate readonly transport: TenantApiTransport,\n\t) {\n\t}\n\n\tpublic async listPersons({ filter, limit, offset }: ListPersonsArgs = {}): Promise<TenantPerson[]> {\n\t\tconst result = await this.transport.exec(personsFetcher, { filter, limit, offset })\n\t\treturn result.persons.map(it => ({\n\t\t\tid: it.id,\n\t\t\tidentityId: it.identity.id,\n\t\t\temail: it.email ?? null,\n\t\t\tname: it.name ?? null,\n\t\t\totpEnabled: it.otpEnabled,\n\t\t\temailOtpEnabled: it.emailOtpEnabled,\n\t\t\temailVerified: it.emailVerified,\n\t\t}))\n\t}\n\n\t/** Null both when the person does not exist and when the caller may not see them — the API does not distinguish. */\n\tpublic async getPerson(id: string): Promise<TenantPersonDetail | null> {\n\t\tconst result = await this.transport.exec(personByIdFetcher, { id })\n\t\tconst person = result.personById\n\t\tif (!person) {\n\t\t\treturn null\n\t\t}\n\t\treturn {\n\t\t\t...toTenantPerson(person),\n\t\t\tpasswordlessEnabled: person.passwordlessEnabled ?? null,\n\t\t\troles: person.identity.roles ? [...person.identity.roles] : null,\n\t\t\tsessions: person.identity.sessions.map(it => ({\n\t\t\t\tid: it.id,\n\t\t\t\tcreatedAt: it.createdAt,\n\t\t\t\texpiresAt: it.expiresAt ?? null,\n\t\t\t\tlastUsedAt: it.lastUsedAt ?? null,\n\t\t\t\tlastIp: it.lastIp ?? null,\n\t\t\t\tlastUserAgent: it.lastUserAgent ?? null,\n\t\t\t\tcreatedIp: it.createdIp ?? null,\n\t\t\t\tcreatedUserAgent: it.createdUserAgent ?? null,\n\t\t\t\tisCurrent: it.isCurrent,\n\t\t\t\ttrustForwardedClientInfo: it.trustForwardedClientInfo,\n\t\t\t})),\n\t\t\tidentityProviders: person.identityProviders.map(it => ({\n\t\t\t\tid: it.id,\n\t\t\t\tslug: it.identityProvider.slug,\n\t\t\t\ttype: it.identityProvider.type,\n\t\t\t\texternalIdentifier: it.externalIdentifier,\n\t\t\t\tcreatedAt: it.createdAt,\n\t\t\t})),\n\t\t}\n\t}\n\n\t/**\n\t * Creates a person through `signUp`. Needs the `PERSON_SIGN_UP` permission, consumes the tenant's\n\t * per-IP sign-up rate limit and triggers the verification mail when the tenant requires it.\n\t */\n\tpublic async signUp({ email, password, passwordHash, name, roles, captchaToken }: SignUpPersonArgs): Promise<TenantPerson> {\n\t\tconst result = await this.transport.exec(signUpFetcher, { email, password, passwordHash, name, roles, captchaToken })\n\t\tthis.transport.assertOk(result.signUp, `signUp(${email})`)\n\t\tconst person = result.signUp?.result?.person\n\t\tif (!person) {\n\t\t\tthrow new CliError(`signUp(${email}) reported success but returned no person`, {\n\t\t\t\tcode: 'TENANT_API_INVALID_RESPONSE',\n\t\t\t\texitCode: ExitCode.InternalError,\n\t\t\t})\n\t\t}\n\t\treturn toTenantPerson(person)\n\t}\n\n\tpublic async changeProfile(personId: string, { email, name }: ChangeProfileArgs): Promise<void> {\n\t\tconst result = await this.transport.exec(changeProfileFetcher, { personId, email, name })\n\t\tthis.transport.assertOk(result.changeProfile, `changeProfile(${personId})`)\n\t}\n\n\tpublic async changePassword(personId: string, password: string): Promise<void> {\n\t\tconst result = await this.transport.exec(changePasswordFetcher, { personId, password })\n\t\tthis.transport.assertOk(result.changePassword, `changePassword(${personId})`)\n\t}\n\n\tpublic async disablePerson(personId: string): Promise<void> {\n\t\tconst result = await this.transport.exec(disablePersonFetcher, { personId })\n\t\tthis.transport.assertOk(result.disablePerson, `disablePerson(${personId})`)\n\t}\n\n\tpublic async forceSignOutPerson(personId: string, reason?: string): Promise<void> {\n\t\tconst result = await this.transport.exec(forceSignOutPersonFetcher, { personId, reason })\n\t\tthis.transport.assertOk(result.forceSignOutPerson, `forceSignOutPerson(${personId})`)\n\t}\n\n\tpublic async resetPersonMfa(personId: string): Promise<void> {\n\t\tconst result = await this.transport.exec(resetPersonMfaFetcher, { personId })\n\t\tthis.transport.assertOk(result.resetPersonMfa, `resetPersonMfa(${personId})`)\n\t}\n\n\tpublic async createResetPasswordRequest(email: string, options?: CreateResetPasswordRequestOptions, captchaToken?: string): Promise<void> {\n\t\tconst result = await this.transport.exec(createResetPasswordRequestFetcher, { email, options, captchaToken })\n\t\tthis.transport.assertOk(result.createResetPasswordRequest, `createResetPasswordRequest(${email})`)\n\t}\n\n\tpublic async createSessionToken({ email, personId, expiration, options }: CreateSessionTokenArgs): Promise<TenantCreatedSessionToken> {\n\t\tconst result = await this.transport.exec(createSessionTokenFetcher, { email, personId, expiration, options })\n\t\tthis.transport.assertOk(result.createSessionToken, 'createSessionToken')\n\t\tconst tokenResult = result.createSessionToken?.result\n\t\tif (!tokenResult) {\n\t\t\tthrow new CliError('createSessionToken reported success but returned no token.', {\n\t\t\t\tcode: 'TENANT_API_INVALID_RESPONSE',\n\t\t\t\texitCode: ExitCode.InternalError,\n\t\t\t})\n\t\t}\n\t\treturn {\n\t\t\ttoken: tokenResult.token,\n\t\t\tpersonId: tokenResult.person.id,\n\t\t\tidentityId: tokenResult.person.identity.id,\n\t\t\temail: tokenResult.person.email ?? null,\n\t\t\tname: tokenResult.person.name ?? null,\n\t\t}\n\t}\n\n\t/** Returns the identity's roles after the change, or null when the caller may not read them. */\n\tpublic async addGlobalIdentityRoles(identityId: string, roles: readonly string[]): Promise<string[] | null> {\n\t\tconst result = await this.transport.exec(addGlobalIdentityRolesFetcher, { identityId, roles })\n\t\tthis.transport.assertOk(result.addGlobalIdentityRoles, `addGlobalIdentityRoles(${identityId})`)\n\t\tconst resultRoles = result.addGlobalIdentityRoles?.result?.identity.roles\n\t\treturn resultRoles ? [...resultRoles] : null\n\t}\n\n\t/** Returns the identity's roles after the change, or null when the caller may not read them. */\n\tpublic async removeGlobalIdentityRoles(identityId: string, roles: readonly string[]): Promise<string[] | null> {\n\t\tconst result = await this.transport.exec(removeGlobalIdentityRolesFetcher, { identityId, roles })\n\t\tthis.transport.assertOk(result.removeGlobalIdentityRoles, `removeGlobalIdentityRoles(${identityId})`)\n\t\tconst resultRoles = result.removeGlobalIdentityRoles?.result?.identity.roles\n\t\treturn resultRoles ? [...resultRoles] : null\n\t}\n}\n"],"names":[],"mappings":";;AAkIA,MAAM,iBAAiB,OAAO,QAAQ,SAAS,SAAS,UAAU,EAAE,CAAC;AACrE,MAAM,oBAAoB,OAAO;AAAA,EAChC,SACE,SAAS,UAAU,GAAG,MAAM,SAAS,aAAa,CAAC,EACnD,kBAAkB,wBAAwB,GAAG,UAAU,mBAAmB,iBAAiB,0BAA0B,CAAC;AACzH;AACA,MAAM,gBAAgB,UAAU;AAAA,EAC/B,iBAAiB,MAAM,cAAc,oBAAoB,iBAAiB,EAAE,OAAO,cAAc,OAAO,SAAS,SAAS,UAAU,EAAE,CAAC,CAAC;AACzI;AACA,MAAM,uBAAuB,UAAU,cAAc,wBAAwB,MAAM,oBAAoB,CAAC;AACxG,MAAM,wBAAwB,UAAU,eAAe,yBAAyB,MAAM,sBAAsB,mBAAmB,CAAC;AAChI,MAAM,uBAAuB,UAAU,cAAc,wBAAwB,MAAM,oBAAoB,CAAC;AACxG,MAAM,4BAA4B,UAAU,mBAAmB,6BAA6B,MAAM,yBAAyB,CAAC;AAC5H,MAAM,wBAAwB,UAAU,eAAe,yBAAyB,MAAM,qBAAqB,CAAC;AAC5G,MAAM,oCAAoC,UAAU;AAAA,EACnD,qCAAqC,MAAM,iCAAiC;AAC7E;AACA,MAAM,4BAA4B,UAAU;AAAA,EAC3C,6BACE,MAAM,yBAAyB,EAC/B,OAAO,0BAA0B,MAAM,OAAO,SAAS,GAAG,MAAM,KAAK,SAAS,UAAU,EAAE,CAAC,CAAC;AAC/F;AACA,MAAM,gCAAgC,UAAU;AAAA,EAC/C,iCAAiC,MAAM,6BAA6B,EAAE,OAAO,8BAA8B,SAAS,UAAU,GAAG,KAAK,CAAC;AACxI;AACA,MAAM,mCAAmC,UAAU;AAAA,EAClD,oCAAoC,MAAM,gCAAgC,EAAE;AAAA,IAC3E,iCAAiC,SAAS,UAAU,GAAG,KAAK;AAAA,EAAA;AAE9D;AAEA,MAAM,iBAAiB,CAAC,YAAqC;AAAA,EAC5D,IAAI,OAAO;AAAA,EACX,YAAY,OAAO,SAAS;AAAA,EAC5B,OAAO,OAAO,SAAS;AAAA,EACvB,MAAM,OAAO,QAAQ;AAAA,EACrB,YAAY,OAAO;AAAA,EACnB,iBAAiB,OAAO;AAAA,EACxB,eAAe,OAAO;AACvB;AAGO,MAAM,mBAAmB;AAAA,EAC/B,YACkB,WAChB;AADgB,SAAA,YAAA;AAAA,EAElB;AAAA,EAEA,MAAa,YAAY,EAAE,QAAQ,OAAO,OAAA,IAA4B,CAAA,GAA6B;AAClG,UAAM,SAAS,MAAM,KAAK,UAAU,KAAK,gBAAgB,EAAE,QAAQ,OAAO,QAAQ;AAClF,WAAO,OAAO,QAAQ,IAAI,CAAA,QAAO;AAAA,MAChC,IAAI,GAAG;AAAA,MACP,YAAY,GAAG,SAAS;AAAA,MACxB,OAAO,GAAG,SAAS;AAAA,MACnB,MAAM,GAAG,QAAQ;AAAA,MACjB,YAAY,GAAG;AAAA,MACf,iBAAiB,GAAG;AAAA,MACpB,eAAe,GAAG;AAAA,IAAA,EACjB;AAAA,EACH;AAAA;AAAA,EAGA,MAAa,UAAU,IAAgD;AACtE,UAAM,SAAS,MAAM,KAAK,UAAU,KAAK,mBAAmB,EAAE,IAAI;AAClE,UAAM,SAAS,OAAO;AACtB,QAAI,CAAC,QAAQ;AACZ,aAAO;AAAA,IACR;AACA,WAAO;AAAA,MACN,GAAG,eAAe,MAAM;AAAA,MACxB,qBAAqB,OAAO,uBAAuB;AAAA,MACnD,OAAO,OAAO,SAAS,QAAQ,CAAC,GAAG,OAAO,SAAS,KAAK,IAAI;AAAA,MAC5D,UAAU,OAAO,SAAS,SAAS,IAAI,CAAA,QAAO;AAAA,QAC7C,IAAI,GAAG;AAAA,QACP,WAAW,GAAG;AAAA,QACd,WAAW,GAAG,aAAa;AAAA,QAC3B,YAAY,GAAG,cAAc;AAAA,QAC7B,QAAQ,GAAG,UAAU;AAAA,QACrB,eAAe,GAAG,iBAAiB;AAAA,QACnC,WAAW,GAAG,aAAa;AAAA,QAC3B,kBAAkB,GAAG,oBAAoB;AAAA,QACzC,WAAW,GAAG;AAAA,QACd,0BAA0B,GAAG;AAAA,MAAA,EAC5B;AAAA,MACF,mBAAmB,OAAO,kBAAkB,IAAI,CAAA,QAAO;AAAA,QACtD,IAAI,GAAG;AAAA,QACP,MAAM,GAAG,iBAAiB;AAAA,QAC1B,MAAM,GAAG,iBAAiB;AAAA,QAC1B,oBAAoB,GAAG;AAAA,QACvB,WAAW,GAAG;AAAA,MAAA,EACb;AAAA,IAAA;AAAA,EAEJ;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,MAAa,OAAO,EAAE,OAAO,UAAU,cAAc,MAAM,OAAO,gBAAyD;AAC1H,UAAM,SAAS,MAAM,KAAK,UAAU,KAAK,eAAe,EAAE,OAAO,UAAU,cAAc,MAAM,OAAO,cAAc;AACpH,SAAK,UAAU,SAAS,OAAO,QAAQ,UAAU,KAAK,GAAG;AACzD,UAAM,SAAS,OAAO,QAAQ,QAAQ;AACtC,QAAI,CAAC,QAAQ;AACZ,YAAM,IAAI,SAAS,UAAU,KAAK,6CAA6C;AAAA,QAC9E,MAAM;AAAA,QACN,UAAU,SAAS;AAAA,MAAA,CACnB;AAAA,IACF;AACA,WAAO,eAAe,MAAM;AAAA,EAC7B;AAAA,EAEA,MAAa,cAAc,UAAkB,EAAE,OAAO,QAA0C;AAC/F,UAAM,SAAS,MAAM,KAAK,UAAU,KAAK,sBAAsB,EAAE,UAAU,OAAO,MAAM;AACxF,SAAK,UAAU,SAAS,OAAO,eAAe,iBAAiB,QAAQ,GAAG;AAAA,EAC3E;AAAA,EAEA,MAAa,eAAe,UAAkB,UAAiC;AAC9E,UAAM,SAAS,MAAM,KAAK,UAAU,KAAK,uBAAuB,EAAE,UAAU,UAAU;AACtF,SAAK,UAAU,SAAS,OAAO,gBAAgB,kBAAkB,QAAQ,GAAG;AAAA,EAC7E;AAAA,EAEA,MAAa,cAAc,UAAiC;AAC3D,UAAM,SAAS,MAAM,KAAK,UAAU,KAAK,sBAAsB,EAAE,UAAU;AAC3E,SAAK,UAAU,SAAS,OAAO,eAAe,iBAAiB,QAAQ,GAAG;AAAA,EAC3E;AAAA,EAEA,MAAa,mBAAmB,UAAkB,QAAgC;AACjF,UAAM,SAAS,MAAM,KAAK,UAAU,KAAK,2BAA2B,EAAE,UAAU,QAAQ;AACxF,SAAK,UAAU,SAAS,OAAO,oBAAoB,sBAAsB,QAAQ,GAAG;AAAA,EACrF;AAAA,EAEA,MAAa,eAAe,UAAiC;AAC5D,UAAM,SAAS,MAAM,KAAK,UAAU,KAAK,uBAAuB,EAAE,UAAU;AAC5E,SAAK,UAAU,SAAS,OAAO,gBAAgB,kBAAkB,QAAQ,GAAG;AAAA,EAC7E;AAAA,EAEA,MAAa,2BAA2B,OAAe,SAA6C,cAAsC;AACzI,UAAM,SAAS,MAAM,KAAK,UAAU,KAAK,mCAAmC,EAAE,OAAO,SAAS,cAAc;AAC5G,SAAK,UAAU,SAAS,OAAO,4BAA4B,8BAA8B,KAAK,GAAG;AAAA,EAClG;AAAA,EAEA,MAAa,mBAAmB,EAAE,OAAO,UAAU,YAAY,WAAuE;AACrI,UAAM,SAAS,MAAM,KAAK,UAAU,KAAK,2BAA2B,EAAE,OAAO,UAAU,YAAY,QAAA,CAAS;AAC5G,SAAK,UAAU,SAAS,OAAO,oBAAoB,oBAAoB;AACvE,UAAM,cAAc,OAAO,oBAAoB;AAC/C,QAAI,CAAC,aAAa;AACjB,YAAM,IAAI,SAAS,8DAA8D;AAAA,QAChF,MAAM;AAAA,QACN,UAAU,SAAS;AAAA,MAAA,CACnB;AAAA,IACF;AACA,WAAO;AAAA,MACN,OAAO,YAAY;AAAA,MACnB,UAAU,YAAY,OAAO;AAAA,MAC7B,YAAY,YAAY,OAAO,SAAS;AAAA,MACxC,OAAO,YAAY,OAAO,SAAS;AAAA,MACnC,MAAM,YAAY,OAAO,QAAQ;AAAA,IAAA;AAAA,EAEnC;AAAA;AAAA,EAGA,MAAa,uBAAuB,YAAoB,OAAoD;AAC3G,UAAM,SAAS,MAAM,KAAK,UAAU,KAAK,+BAA+B,EAAE,YAAY,OAAO;AAC7F,SAAK,UAAU,SAAS,OAAO,wBAAwB,0BAA0B,UAAU,GAAG;AAC9F,UAAM,cAAc,OAAO,wBAAwB,QAAQ,SAAS;AACpE,WAAO,cAAc,CAAC,GAAG,WAAW,IAAI;AAAA,EACzC;AAAA;AAAA,EAGA,MAAa,0BAA0B,YAAoB,OAAoD;AAC9G,UAAM,SAAS,MAAM,KAAK,UAAU,KAAK,kCAAkC,EAAE,YAAY,OAAO;AAChG,SAAK,UAAU,SAAS,OAAO,2BAA2B,6BAA6B,UAAU,GAAG;AACpG,UAAM,cAAc,OAAO,2BAA2B,QAAQ,SAAS;AACvE,WAAO,cAAc,CAAC,GAAG,WAAW,IAAI;AAAA,EACzC;AACD;"}

package/dist/production/src/lib/tenant/clients/TenantPolicyClient.cjs

@@ -0,0 +1,135 @@
+"use strict";
+Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+const cliCommon = require("@contember/cli-common");
+const TenantApi = require("@contember/graphql-client-tenant");
+const authPolicy = require("../authPolicy.cjs");
+const authPoliciesFetcher = TenantApi.query$.authPolicies(TenantApi.authPolicy$$);
+const createAuthPolicyFetcher = TenantApi.mutation$.createAuthPolicy(
+  TenantApi.createAuthPolicyResponse$$.error(TenantApi.createAuthPolicyError$$).result(TenantApi.createAuthPolicyResult$$)
+);
+const updateAuthPolicyFetcher = TenantApi.mutation$.updateAuthPolicy(TenantApi.updateAuthPolicyResponse$$.error(TenantApi.updateAuthPolicyError$$));
+const deleteAuthPolicyFetcher = TenantApi.mutation$.deleteAuthPolicy(TenantApi.deleteAuthPolicyResponse$$.error(TenantApi.deleteAuthPolicyError$$));
+const mailTemplatesFetcher = TenantApi.query$.mailTemplates(TenantApi.mailTemplateData$$);
+const addMailTemplateFetcher = TenantApi.mutation$.addMailTemplate(TenantApi.addMailTemplateResponse$$.error(TenantApi.addMailTemplateError$$));
+const removeMailTemplateFetcher = TenantApi.mutation$.removeMailTemplate(TenantApi.removeMailTemplateResponse$$.error(TenantApi.removeMailTemplateError$$));
+const authLogFetcher = TenantApi.query$.authLog(TenantApi.authLogPage$.hasMore.entries(TenantApi.authLogEntry$$));
+const customRolesFetcher = TenantApi.query$.customRoles(TenantApi.customRole$.slug);
+const createCustomRoleFetcher = TenantApi.mutation$.createCustomRole(TenantApi.createCustomRoleResponse$$.error(TenantApi.createCustomRoleError$$));
+const updateCustomRoleFetcher = TenantApi.mutation$.updateCustomRole(TenantApi.updateCustomRoleResponse$$.error(TenantApi.updateCustomRoleError$$));
+const clearCustomRoleDescriptionMutation = `
+	mutation updateCustomRoleDescription($slug: String!, $grants: [CustomRoleGrantInput!]) {
+		updateCustomRole(slug: $slug, grants: $grants, description: null) {
+			ok
+			error {
+				code
+				developerMessage
+			}
+		}
+	}
+`;
+class TenantPolicyClient {
+  constructor(transport) {
+    this.transport = transport;
+  }
+  async listAuthPolicies() {
+    const result = await this.transport.exec(authPoliciesFetcher, {});
+    return result.authPolicies.map((it) => ({
+      id: it.id,
+      scope: it.scope,
+      project: it.project ?? null,
+      roles: [...it.roles],
+      mfaRequired: it.mfaRequired ?? null,
+      tokenExpiration: it.tokenExpiration ?? null,
+      idleTimeout: it.idleTimeout ?? null,
+      mfaGraceDuration: it.mfaGraceDuration ?? null,
+      rememberMeAllowed: it.rememberMeAllowed ?? null
+    }));
+  }
+  /** Returns the id of the created policy — the only thing `createAuthPolicy` hands back. */
+  async createAuthPolicy(policy) {
+    const result = await this.transport.exec(createAuthPolicyFetcher, { policy });
+    this.transport.assertOk(result.createAuthPolicy, `createAuthPolicy(${authPolicy.describeAuthPolicy(policy)})`);
+    const id = result.createAuthPolicy?.result?.id;
+    if (id === void 0) {
+      throw new cliCommon.CliError(`createAuthPolicy(${authPolicy.describeAuthPolicy(policy)}) reported success without returning an id.`, {
+        code: "TENANT_API_INVALID_RESPONSE",
+        exitCode: cliCommon.ExitCode.InternalError
+      });
+    }
+    return id;
+  }
+  async updateAuthPolicy(id, policy) {
+    const result = await this.transport.exec(updateAuthPolicyFetcher, { id, policy });
+    this.transport.assertOk(result.updateAuthPolicy, `updateAuthPolicy(${id}: ${authPolicy.describeAuthPolicy(policy)})`);
+  }
+  async deleteAuthPolicy(id) {
+    const result = await this.transport.exec(deleteAuthPolicyFetcher, { id });
+    this.transport.assertOk(result.deleteAuthPolicy, `deleteAuthPolicy(${id})`);
+  }
+  async listMailTemplates() {
+    const result = await this.transport.exec(mailTemplatesFetcher, {});
+    return result.mailTemplates.map((it) => ({
+      projectSlug: it.projectSlug ?? null,
+      type: it.type,
+      variant: it.variant ?? null,
+      subject: it.subject,
+      content: it.content,
+      useLayout: it.useLayout,
+      replyTo: it.replyTo ?? null
+    }));
+  }
+  async addMailTemplate(template) {
+    const result = await this.transport.exec(addMailTemplateFetcher, { template });
+    this.transport.assertOk(result.addMailTemplate, `addMailTemplate(${template.type}/${template.variant ?? ""})`);
+  }
+  /** A template is addressed by the `projectSlug`/`type`/`variant` triple — it has no id of its own. */
+  async removeMailTemplate(templateIdentifier) {
+    const result = await this.transport.exec(removeMailTemplateFetcher, { templateIdentifier });
+    this.transport.assertOk(result.removeMailTemplate, `removeMailTemplate(${templateIdentifier.type}/${templateIdentifier.variant ?? ""})`);
+  }
+  async listCustomRoles() {
+    const result = await this.transport.exec(customRolesFetcher, {});
+    return result.customRoles.map((role) => ({ slug: role.slug }));
+  }
+  async createCustomRole(slug, role) {
+    const result = await this.transport.exec(createCustomRoleFetcher, {
+      slug,
+      description: role.description ?? void 0,
+      grants: role.grants
+    });
+    this.transport.assertOk(result.createCustomRole, `createCustomRole(${slug})`);
+  }
+  async updateCustomRole(slug, role) {
+    const result = role.description === null ? await this.transport.execDocument(clearCustomRoleDescriptionMutation, { slug, grants: role.grants }) : await this.transport.exec(updateCustomRoleFetcher, {
+      slug,
+      description: role.description,
+      grants: role.grants
+    });
+    this.transport.assertOk(result.updateCustomRole, `updateCustomRole(${slug})`);
+  }
+  async readAuthLog({ filter, limit, offset } = {}) {
+    const result = await this.transport.exec(authLogFetcher, { filter, limit, offset });
+    return {
+      hasMore: result.authLog.hasMore,
+      entries: result.authLog.entries.map((it) => ({
+        id: it.id,
+        createdAt: it.createdAt,
+        type: it.type,
+        success: it.success,
+        invokedByIdentityId: it.invokedByIdentityId ?? null,
+        personId: it.personId ?? null,
+        targetPersonId: it.targetPersonId ?? null,
+        personInputIdentifier: it.personInputIdentifier ?? null,
+        errorCode: it.errorCode ?? null,
+        errorMessage: it.errorMessage ?? null,
+        ipAddress: it.ipAddress ?? null,
+        userAgent: it.userAgent ?? null,
+        identityProviderId: it.identityProviderId ?? null,
+        metadata: it.metadata ?? null,
+        eventData: it.eventData ?? null
+      }))
+    };
+  }
+}
+exports.TenantPolicyClient = TenantPolicyClient;
+//# sourceMappingURL=TenantPolicyClient.cjs.map

package/dist/production/src/lib/tenant/clients/TenantPolicyClient.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"TenantPolicyClient.cjs","sources":["../../../../../../../packages/cli/src/lib/tenant/clients/TenantPolicyClient.ts"],"sourcesContent":["import { CliError, ExitCode } from '@contember/cli-common'\nimport {\n\taddMailTemplateError$$,\n\taddMailTemplateResponse$$,\n\tauthLogEntry$$,\n\ttype AuthLogFilter,\n\tauthLogPage$,\n\tauthPolicy$$,\n\ttype AuthPolicyInput,\n\ttype AuthPolicyScope,\n\tcreateAuthPolicyError$$,\n\tcreateAuthPolicyResponse$$,\n\tcreateAuthPolicyResult$$,\n\tcreateCustomRoleError$$,\n\tcreateCustomRoleResponse$$,\n\tcustomRole$,\n\tdeleteAuthPolicyError$$,\n\tdeleteAuthPolicyResponse$$,\n\tmailTemplateData$$,\n\ttype MailTemplateIdentifier,\n\ttype MailType,\n\tmutation$,\n\tquery$,\n\tremoveMailTemplateError$$,\n\tremoveMailTemplateResponse$$,\n\tupdateAuthPolicyError$$,\n\tupdateAuthPolicyResponse$$,\n\tupdateCustomRoleError$$,\n\tupdateCustomRoleResponse$$,\n} from '@contember/graphql-client-tenant'\nimport { describeAuthPolicy } from '../authPolicy.js'\nimport { TenantApiTransport, TenantMutationResult } from '../TenantApiTransport.js'\nimport { TenantCustomRoleConfig, TenantMailTemplate } from '../tenantConfig.js'\n\n/** A policy as it exists server-side. The config-side counterpart is `TenantAuthPolicy` in `tenantConfig.ts`. */\nexport interface RemoteAuthPolicy {\n\tid: string\n\tscope: AuthPolicyScope\n\t/** Project slug, `null` for a global policy. */\n\tproject: string | null\n\troles: string[]\n\tmfaRequired: boolean | null\n\t/** ISO 8601 duration, e.g. `PT1H`. */\n\ttokenExpiration: string | null\n\tidleTimeout: string | null\n\tmfaGraceDuration: string | null\n\trememberMeAllowed: boolean | null\n}\n\nexport interface TenantMailTemplateData {\n\tprojectSlug: string | null\n\ttype: MailType\n\tvariant: string | null\n\tsubject: string\n\tcontent: string\n\tuseLayout: boolean\n\treplyTo: string | null\n}\n\nexport interface TenantAuthLogEntry {\n\tid: string\n\tcreatedAt: string\n\ttype: string\n\tsuccess: boolean\n\tinvokedByIdentityId: string | null\n\tpersonId: string | null\n\ttargetPersonId: string | null\n\tpersonInputIdentifier: string | null\n\terrorCode: string | null\n\terrorMessage: string | null\n\tipAddress: string | null\n\tuserAgent: string | null\n\tidentityProviderId: string | null\n\tmetadata: unknown\n\teventData: unknown\n}\n\nexport interface TenantAuthLogPage {\n\tentries: TenantAuthLogEntry[]\n\t/** True when more rows exist past `offset + entries.length`. */\n\thasMore: boolean\n}\n\nexport interface ReadAuthLogArgs {\n\tfilter?: AuthLogFilter\n\tlimit?: number\n\toffset?: number\n}\n\nexport interface RemoteCustomRole {\n\tslug: string\n}\n\ninterface UpdateCustomRoleResult {\n\tupdateCustomRole?: TenantMutationResult\n}\n\n// Fetchers are immutable and reusable, so they are built once at module load.\nconst authPoliciesFetcher = query$.authPolicies(authPolicy$$)\nconst createAuthPolicyFetcher = mutation$.createAuthPolicy(\n\tcreateAuthPolicyResponse$$.error(createAuthPolicyError$$).result(createAuthPolicyResult$$),\n)\nconst updateAuthPolicyFetcher = mutation$.updateAuthPolicy(updateAuthPolicyResponse$$.error(updateAuthPolicyError$$))\nconst deleteAuthPolicyFetcher = mutation$.deleteAuthPolicy(deleteAuthPolicyResponse$$.error(deleteAuthPolicyError$$))\nconst mailTemplatesFetcher = query$.mailTemplates(mailTemplateData$$)\nconst addMailTemplateFetcher = mutation$.addMailTemplate(addMailTemplateResponse$$.error(addMailTemplateError$$))\nconst removeMailTemplateFetcher = mutation$.removeMailTemplate(removeMailTemplateResponse$$.error(removeMailTemplateError$$))\nconst authLogFetcher = query$.authLog(authLogPage$.hasMore.entries(authLogEntry$$))\nconst customRolesFetcher = query$.customRoles(customRole$.slug)\nconst createCustomRoleFetcher = mutation$.createCustomRole(createCustomRoleResponse$$.error(createCustomRoleError$$))\nconst updateCustomRoleFetcher = mutation$.updateCustomRole(updateCustomRoleResponse$$.error(updateCustomRoleError$$))\nconst clearCustomRoleDescriptionMutation = `\n\tmutation updateCustomRoleDescription($slug: String!, $grants: [CustomRoleGrantInput!]) {\n\t\tupdateCustomRole(slug: $slug, grants: $grants, description: null) {\n\t\t\tok\n\t\t\terror {\n\t\t\t\tcode\n\t\t\t\tdeveloperMessage\n\t\t\t}\n\t\t}\n\t}\n`\n\n/** Auth policies, mail templates, custom roles and the auth log. */\nexport class TenantPolicyClient {\n\tconstructor(\n\t\tprivate readonly transport: TenantApiTransport,\n\t) {\n\t}\n\n\tpublic async listAuthPolicies(): Promise<RemoteAuthPolicy[]> {\n\t\tconst result = await this.transport.exec(authPoliciesFetcher, {})\n\t\treturn result.authPolicies.map(it => ({\n\t\t\tid: it.id,\n\t\t\tscope: it.scope,\n\t\t\tproject: it.project ?? null,\n\t\t\troles: [...it.roles],\n\t\t\tmfaRequired: it.mfaRequired ?? null,\n\t\t\ttokenExpiration: it.tokenExpiration ?? null,\n\t\t\tidleTimeout: it.idleTimeout ?? null,\n\t\t\tmfaGraceDuration: it.mfaGraceDuration ?? null,\n\t\t\trememberMeAllowed: it.rememberMeAllowed ?? null,\n\t\t}))\n\t}\n\n\t/** Returns the id of the created policy — the only thing `createAuthPolicy` hands back. */\n\tpublic async createAuthPolicy(policy: AuthPolicyInput): Promise<string> {\n\t\tconst result = await this.transport.exec(createAuthPolicyFetcher, { policy })\n\t\t// a policy has no slug, so the target is the only thing that identifies it in an error\n\t\tthis.transport.assertOk(result.createAuthPolicy, `createAuthPolicy(${describeAuthPolicy(policy)})`)\n\t\tconst id = result.createAuthPolicy?.result?.id\n\t\tif (id === undefined) {\n\t\t\t// ok without a result breaks the schema contract, so there is nothing sensible to report back\n\t\t\tthrow new CliError(`createAuthPolicy(${describeAuthPolicy(policy)}) reported success without returning an id.`, {\n\t\t\t\tcode: 'TENANT_API_INVALID_RESPONSE',\n\t\t\t\texitCode: ExitCode.InternalError,\n\t\t\t})\n\t\t}\n\t\treturn id\n\t}\n\n\tpublic async updateAuthPolicy(id: string, policy: AuthPolicyInput): Promise<void> {\n\t\tconst result = await this.transport.exec(updateAuthPolicyFetcher, { id, policy })\n\t\tthis.transport.assertOk(result.updateAuthPolicy, `updateAuthPolicy(${id}: ${describeAuthPolicy(policy)})`)\n\t}\n\n\tpublic async deleteAuthPolicy(id: string): Promise<void> {\n\t\tconst result = await this.transport.exec(deleteAuthPolicyFetcher, { id })\n\t\tthis.transport.assertOk(result.deleteAuthPolicy, `deleteAuthPolicy(${id})`)\n\t}\n\n\tpublic async listMailTemplates(): Promise<TenantMailTemplateData[]> {\n\t\tconst result = await this.transport.exec(mailTemplatesFetcher, {})\n\t\treturn result.mailTemplates.map(it => ({\n\t\t\tprojectSlug: it.projectSlug ?? null,\n\t\t\ttype: it.type,\n\t\t\tvariant: it.variant ?? null,\n\t\t\tsubject: it.subject,\n\t\t\tcontent: it.content,\n\t\t\tuseLayout: it.useLayout,\n\t\t\treplyTo: it.replyTo ?? null,\n\t\t}))\n\t}\n\n\tpublic async addMailTemplate(template: TenantMailTemplate): Promise<void> {\n\t\tconst result = await this.transport.exec(addMailTemplateFetcher, { template })\n\t\tthis.transport.assertOk(result.addMailTemplate, `addMailTemplate(${template.type}/${template.variant ?? ''})`)\n\t}\n\n\t/** A template is addressed by the `projectSlug`/`type`/`variant` triple — it has no id of its own. */\n\tpublic async removeMailTemplate(templateIdentifier: MailTemplateIdentifier): Promise<void> {\n\t\tconst result = await this.transport.exec(removeMailTemplateFetcher, { templateIdentifier })\n\t\tthis.transport.assertOk(result.removeMailTemplate, `removeMailTemplate(${templateIdentifier.type}/${templateIdentifier.variant ?? ''})`)\n\t}\n\n\tpublic async listCustomRoles(): Promise<RemoteCustomRole[]> {\n\t\tconst result = await this.transport.exec(customRolesFetcher, {})\n\t\treturn result.customRoles.map(role => ({ slug: role.slug }))\n\t}\n\n\tpublic async createCustomRole(slug: string, role: TenantCustomRoleConfig): Promise<void> {\n\t\tconst result = await this.transport.exec(createCustomRoleFetcher, {\n\t\t\tslug,\n\t\t\tdescription: role.description ?? undefined,\n\t\t\tgrants: role.grants,\n\t\t})\n\t\tthis.transport.assertOk(result.createCustomRole, `createCustomRole(${slug})`)\n\t}\n\n\tpublic async updateCustomRole(slug: string, role: TenantCustomRoleConfig): Promise<void> {\n\t\tconst result = role.description === null\n\t\t\t? await this.transport.execDocument<UpdateCustomRoleResult>(clearCustomRoleDescriptionMutation, { slug, grants: role.grants })\n\t\t\t: await this.transport.exec(updateCustomRoleFetcher, {\n\t\t\t\tslug,\n\t\t\t\tdescription: role.description,\n\t\t\t\tgrants: role.grants,\n\t\t\t})\n\t\tthis.transport.assertOk(result.updateCustomRole, `updateCustomRole(${slug})`)\n\t}\n\n\tpublic async readAuthLog({ filter, limit, offset }: ReadAuthLogArgs = {}): Promise<TenantAuthLogPage> {\n\t\tconst result = await this.transport.exec(authLogFetcher, { filter, limit, offset })\n\t\treturn {\n\t\t\thasMore: result.authLog.hasMore,\n\t\t\tentries: result.authLog.entries.map(it => ({\n\t\t\t\tid: it.id,\n\t\t\t\tcreatedAt: it.createdAt,\n\t\t\t\ttype: it.type,\n\t\t\t\tsuccess: it.success,\n\t\t\t\tinvokedByIdentityId: it.invokedByIdentityId ?? null,\n\t\t\t\tpersonId: it.personId ?? null,\n\t\t\t\ttargetPersonId: it.targetPersonId ?? null,\n\t\t\t\tpersonInputIdentifier: it.personInputIdentifier ?? null,\n\t\t\t\terrorCode: it.errorCode ?? null,\n\t\t\t\terrorMessage: it.errorMessage ?? null,\n\t\t\t\tipAddress: it.ipAddress ?? null,\n\t\t\t\tuserAgent: it.userAgent ?? null,\n\t\t\t\tidentityProviderId: it.identityProviderId ?? null,\n\t\t\t\tmetadata: it.metadata ?? null,\n\t\t\t\teventData: it.eventData ?? null,\n\t\t\t})),\n\t\t}\n\t}\n}\n"],"names":["query$","authPolicy$$","mutation$","createAuthPolicyResponse$$","createAuthPolicyError$$","createAuthPolicyResult$$","updateAuthPolicyResponse$$","updateAuthPolicyError$$","deleteAuthPolicyResponse$$","deleteAuthPolicyError$$","mailTemplateData$$","addMailTemplateResponse$$","addMailTemplateError$$","removeMailTemplateResponse$$","removeMailTemplateError$$","authLogPage$","authLogEntry$$","customRole$","createCustomRoleResponse$$","createCustomRoleError$$","updateCustomRoleResponse$$","updateCustomRoleError$$","describeAuthPolicy","CliError","ExitCode"],"mappings":";;;;;AAkGA,MAAM,sBAAsBA,UAAAA,OAAO,aAAaC,sBAAY;AAC5D,MAAM,0BAA0BC,UAAAA,UAAU;AAAA,EACzCC,UAAAA,2BAA2B,MAAMC,iCAAuB,EAAE,OAAOC,UAAAA,wBAAwB;AAC1F;AACA,MAAM,0BAA0BH,UAAAA,UAAU,iBAAiBI,UAAAA,2BAA2B,MAAMC,UAAAA,uBAAuB,CAAC;AACpH,MAAM,0BAA0BL,UAAAA,UAAU,iBAAiBM,UAAAA,2BAA2B,MAAMC,UAAAA,uBAAuB,CAAC;AACpH,MAAM,uBAAuBT,UAAAA,OAAO,cAAcU,4BAAkB;AACpE,MAAM,yBAAyBR,UAAAA,UAAU,gBAAgBS,UAAAA,0BAA0B,MAAMC,UAAAA,sBAAsB,CAAC;AAChH,MAAM,4BAA4BV,UAAAA,UAAU,mBAAmBW,UAAAA,6BAA6B,MAAMC,UAAAA,yBAAyB,CAAC;AAC5H,MAAM,iBAAiBd,UAAAA,OAAO,QAAQe,UAAAA,aAAa,QAAQ,QAAQC,UAAAA,cAAc,CAAC;AAClF,MAAM,qBAAqBhB,UAAAA,OAAO,YAAYiB,UAAAA,YAAY,IAAI;AAC9D,MAAM,0BAA0Bf,UAAAA,UAAU,iBAAiBgB,UAAAA,2BAA2B,MAAMC,UAAAA,uBAAuB,CAAC;AACpH,MAAM,0BAA0BjB,UAAAA,UAAU,iBAAiBkB,UAAAA,2BAA2B,MAAMC,UAAAA,uBAAuB,CAAC;AACpH,MAAM,qCAAqC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAapC,MAAM,mBAAmB;AAAA,EAC/B,YACkB,WAChB;AADgB,SAAA,YAAA;AAAA,EAElB;AAAA,EAEA,MAAa,mBAAgD;AAC5D,UAAM,SAAS,MAAM,KAAK,UAAU,KAAK,qBAAqB,EAAE;AAChE,WAAO,OAAO,aAAa,IAAI,CAAA,QAAO;AAAA,MACrC,IAAI,GAAG;AAAA,MACP,OAAO,GAAG;AAAA,MACV,SAAS,GAAG,WAAW;AAAA,MACvB,OAAO,CAAC,GAAG,GAAG,KAAK;AAAA,MACnB,aAAa,GAAG,eAAe;AAAA,MAC/B,iBAAiB,GAAG,mBAAmB;AAAA,MACvC,aAAa,GAAG,eAAe;AAAA,MAC/B,kBAAkB,GAAG,oBAAoB;AAAA,MACzC,mBAAmB,GAAG,qBAAqB;AAAA,IAAA,EAC1C;AAAA,EACH;AAAA;AAAA,EAGA,MAAa,iBAAiB,QAA0C;AACvE,UAAM,SAAS,MAAM,KAAK,UAAU,KAAK,yBAAyB,EAAE,QAAQ;AAE5E,SAAK,UAAU,SAAS,OAAO,kBAAkB,oBAAoBC,8BAAmB,MAAM,CAAC,GAAG;AAClG,UAAM,KAAK,OAAO,kBAAkB,QAAQ;AAC5C,QAAI,OAAO,QAAW;AAErB,YAAM,IAAIC,UAAAA,SAAS,oBAAoBD,WAAAA,mBAAmB,MAAM,CAAC,+CAA+C;AAAA,QAC/G,MAAM;AAAA,QACN,UAAUE,UAAAA,SAAS;AAAA,MAAA,CACnB;AAAA,IACF;AACA,WAAO;AAAA,EACR;AAAA,EAEA,MAAa,iBAAiB,IAAY,QAAwC;AACjF,UAAM,SAAS,MAAM,KAAK,UAAU,KAAK,yBAAyB,EAAE,IAAI,QAAQ;AAChF,SAAK,UAAU,SAAS,OAAO,kBAAkB,oBAAoB,EAAE,KAAKF,WAAAA,mBAAmB,MAAM,CAAC,GAAG;AAAA,EAC1G;AAAA,EAEA,MAAa,iBAAiB,IAA2B;AACxD,UAAM,SAAS,MAAM,KAAK,UAAU,KAAK,yBAAyB,EAAE,IAAI;AACxE,SAAK,UAAU,SAAS,OAAO,kBAAkB,oBAAoB,EAAE,GAAG;AAAA,EAC3E;AAAA,EAEA,MAAa,oBAAuD;AACnE,UAAM,SAAS,MAAM,KAAK,UAAU,KAAK,sBAAsB,EAAE;AACjE,WAAO,OAAO,cAAc,IAAI,CAAA,QAAO;AAAA,MACtC,aAAa,GAAG,eAAe;AAAA,MAC/B,MAAM,GAAG;AAAA,MACT,SAAS,GAAG,WAAW;AAAA,MACvB,SAAS,GAAG;AAAA,MACZ,SAAS,GAAG;AAAA,MACZ,WAAW,GAAG;AAAA,MACd,SAAS,GAAG,WAAW;AAAA,IAAA,EACtB;AAAA,EACH;AAAA,EAEA,MAAa,gBAAgB,UAA6C;AACzE,UAAM,SAAS,MAAM,KAAK,UAAU,KAAK,wBAAwB,EAAE,UAAU;AAC7E,SAAK,UAAU,SAAS,OAAO,iBAAiB,mBAAmB,SAAS,IAAI,IAAI,SAAS,WAAW,EAAE,GAAG;AAAA,EAC9G;AAAA;AAAA,EAGA,MAAa,mBAAmB,oBAA2D;AAC1F,UAAM,SAAS,MAAM,KAAK,UAAU,KAAK,2BAA2B,EAAE,oBAAoB;AAC1F,SAAK,UAAU,SAAS,OAAO,oBAAoB,sBAAsB,mBAAmB,IAAI,IAAI,mBAAmB,WAAW,EAAE,GAAG;AAAA,EACxI;AAAA,EAEA,MAAa,kBAA+C;AAC3D,UAAM,SAAS,MAAM,KAAK,UAAU,KAAK,oBAAoB,EAAE;AAC/D,WAAO,OAAO,YAAY,IAAI,CAAA,UAAS,EAAE,MAAM,KAAK,OAAO;AAAA,EAC5D;AAAA,EAEA,MAAa,iBAAiB,MAAc,MAA6C;AACxF,UAAM,SAAS,MAAM,KAAK,UAAU,KAAK,yBAAyB;AAAA,MACjE;AAAA,MACA,aAAa,KAAK,eAAe;AAAA,MACjC,QAAQ,KAAK;AAAA,IAAA,CACb;AACD,SAAK,UAAU,SAAS,OAAO,kBAAkB,oBAAoB,IAAI,GAAG;AAAA,EAC7E;AAAA,EAEA,MAAa,iBAAiB,MAAc,MAA6C;AACxF,UAAM,SAAS,KAAK,gBAAgB,OACjC,MAAM,KAAK,UAAU,aAAqC,oCAAoC,EAAE,MAAM,QAAQ,KAAK,QAAQ,IAC3H,MAAM,KAAK,UAAU,KAAK,yBAAyB;AAAA,MACpD;AAAA,MACA,aAAa,KAAK;AAAA,MAClB,QAAQ,KAAK;AAAA,IAAA,CACb;AACF,SAAK,UAAU,SAAS,OAAO,kBAAkB,oBAAoB,IAAI,GAAG;AAAA,EAC7E;AAAA,EAEA,MAAa,YAAY,EAAE,QAAQ,OAAO,OAAA,IAA4B,CAAA,GAAgC;AACrG,UAAM,SAAS,MAAM,KAAK,UAAU,KAAK,gBAAgB,EAAE,QAAQ,OAAO,QAAQ;AAClF,WAAO;AAAA,MACN,SAAS,OAAO,QAAQ;AAAA,MACxB,SAAS,OAAO,QAAQ,QAAQ,IAAI,CAAA,QAAO;AAAA,QAC1C,IAAI,GAAG;AAAA,QACP,WAAW,GAAG;AAAA,QACd,MAAM,GAAG;AAAA,QACT,SAAS,GAAG;AAAA,QACZ,qBAAqB,GAAG,uBAAuB;AAAA,QAC/C,UAAU,GAAG,YAAY;AAAA,QACzB,gBAAgB,GAAG,kBAAkB;AAAA,QACrC,uBAAuB,GAAG,yBAAyB;AAAA,QACnD,WAAW,GAAG,aAAa;AAAA,QAC3B,cAAc,GAAG,gBAAgB;AAAA,QACjC,WAAW,GAAG,aAAa;AAAA,QAC3B,WAAW,GAAG,aAAa;AAAA,QAC3B,oBAAoB,GAAG,sBAAsB;AAAA,QAC7C,UAAU,GAAG,YAAY;AAAA,QACzB,WAAW,GAAG,aAAa;AAAA,MAAA,EAC1B;AAAA,IAAA;AAAA,EAEJ;AACD;;"}

package/dist/production/src/lib/tenant/clients/TenantPolicyClient.js

@@ -0,0 +1,135 @@
+import { CliError, ExitCode } from "@contember/cli-common";
+import { query$, authPolicy$$, mutation$, createAuthPolicyResponse$$, createAuthPolicyError$$, createAuthPolicyResult$$, updateAuthPolicyResponse$$, updateAuthPolicyError$$, deleteAuthPolicyResponse$$, deleteAuthPolicyError$$, mailTemplateData$$, addMailTemplateResponse$$, addMailTemplateError$$, removeMailTemplateResponse$$, removeMailTemplateError$$, authLogPage$, authLogEntry$$, customRole$, createCustomRoleResponse$$, createCustomRoleError$$, updateCustomRoleResponse$$, updateCustomRoleError$$ } from "@contember/graphql-client-tenant";
+import { describeAuthPolicy } from "../authPolicy.js";
+const authPoliciesFetcher = query$.authPolicies(authPolicy$$);
+const createAuthPolicyFetcher = mutation$.createAuthPolicy(
+  createAuthPolicyResponse$$.error(createAuthPolicyError$$).result(createAuthPolicyResult$$)
+);
+const updateAuthPolicyFetcher = mutation$.updateAuthPolicy(updateAuthPolicyResponse$$.error(updateAuthPolicyError$$));
+const deleteAuthPolicyFetcher = mutation$.deleteAuthPolicy(deleteAuthPolicyResponse$$.error(deleteAuthPolicyError$$));
+const mailTemplatesFetcher = query$.mailTemplates(mailTemplateData$$);
+const addMailTemplateFetcher = mutation$.addMailTemplate(addMailTemplateResponse$$.error(addMailTemplateError$$));
+const removeMailTemplateFetcher = mutation$.removeMailTemplate(removeMailTemplateResponse$$.error(removeMailTemplateError$$));
+const authLogFetcher = query$.authLog(authLogPage$.hasMore.entries(authLogEntry$$));
+const customRolesFetcher = query$.customRoles(customRole$.slug);
+const createCustomRoleFetcher = mutation$.createCustomRole(createCustomRoleResponse$$.error(createCustomRoleError$$));
+const updateCustomRoleFetcher = mutation$.updateCustomRole(updateCustomRoleResponse$$.error(updateCustomRoleError$$));
+const clearCustomRoleDescriptionMutation = `
+	mutation updateCustomRoleDescription($slug: String!, $grants: [CustomRoleGrantInput!]) {
+		updateCustomRole(slug: $slug, grants: $grants, description: null) {
+			ok
+			error {
+				code
+				developerMessage
+			}
+		}
+	}
+`;
+class TenantPolicyClient {
+  constructor(transport) {
+    this.transport = transport;
+  }
+  async listAuthPolicies() {
+    const result = await this.transport.exec(authPoliciesFetcher, {});
+    return result.authPolicies.map((it) => ({
+      id: it.id,
+      scope: it.scope,
+      project: it.project ?? null,
+      roles: [...it.roles],
+      mfaRequired: it.mfaRequired ?? null,
+      tokenExpiration: it.tokenExpiration ?? null,
+      idleTimeout: it.idleTimeout ?? null,
+      mfaGraceDuration: it.mfaGraceDuration ?? null,
+      rememberMeAllowed: it.rememberMeAllowed ?? null
+    }));
+  }
+  /** Returns the id of the created policy — the only thing `createAuthPolicy` hands back. */
+  async createAuthPolicy(policy) {
+    const result = await this.transport.exec(createAuthPolicyFetcher, { policy });
+    this.transport.assertOk(result.createAuthPolicy, `createAuthPolicy(${describeAuthPolicy(policy)})`);
+    const id = result.createAuthPolicy?.result?.id;
+    if (id === void 0) {
+      throw new CliError(`createAuthPolicy(${describeAuthPolicy(policy)}) reported success without returning an id.`, {
+        code: "TENANT_API_INVALID_RESPONSE",
+        exitCode: ExitCode.InternalError
+      });
+    }
+    return id;
+  }
+  async updateAuthPolicy(id, policy) {
+    const result = await this.transport.exec(updateAuthPolicyFetcher, { id, policy });
+    this.transport.assertOk(result.updateAuthPolicy, `updateAuthPolicy(${id}: ${describeAuthPolicy(policy)})`);
+  }
+  async deleteAuthPolicy(id) {
+    const result = await this.transport.exec(deleteAuthPolicyFetcher, { id });
+    this.transport.assertOk(result.deleteAuthPolicy, `deleteAuthPolicy(${id})`);
+  }
+  async listMailTemplates() {
+    const result = await this.transport.exec(mailTemplatesFetcher, {});
+    return result.mailTemplates.map((it) => ({
+      projectSlug: it.projectSlug ?? null,
+      type: it.type,
+      variant: it.variant ?? null,
+      subject: it.subject,
+      content: it.content,
+      useLayout: it.useLayout,
+      replyTo: it.replyTo ?? null
+    }));
+  }
+  async addMailTemplate(template) {
+    const result = await this.transport.exec(addMailTemplateFetcher, { template });
+    this.transport.assertOk(result.addMailTemplate, `addMailTemplate(${template.type}/${template.variant ?? ""})`);
+  }
+  /** A template is addressed by the `projectSlug`/`type`/`variant` triple — it has no id of its own. */
+  async removeMailTemplate(templateIdentifier) {
+    const result = await this.transport.exec(removeMailTemplateFetcher, { templateIdentifier });
+    this.transport.assertOk(result.removeMailTemplate, `removeMailTemplate(${templateIdentifier.type}/${templateIdentifier.variant ?? ""})`);
+  }
+  async listCustomRoles() {
+    const result = await this.transport.exec(customRolesFetcher, {});
+    return result.customRoles.map((role) => ({ slug: role.slug }));
+  }
+  async createCustomRole(slug, role) {
+    const result = await this.transport.exec(createCustomRoleFetcher, {
+      slug,
+      description: role.description ?? void 0,
+      grants: role.grants
+    });
+    this.transport.assertOk(result.createCustomRole, `createCustomRole(${slug})`);
+  }
+  async updateCustomRole(slug, role) {
+    const result = role.description === null ? await this.transport.execDocument(clearCustomRoleDescriptionMutation, { slug, grants: role.grants }) : await this.transport.exec(updateCustomRoleFetcher, {
+      slug,
+      description: role.description,
+      grants: role.grants
+    });
+    this.transport.assertOk(result.updateCustomRole, `updateCustomRole(${slug})`);
+  }
+  async readAuthLog({ filter, limit, offset } = {}) {
+    const result = await this.transport.exec(authLogFetcher, { filter, limit, offset });
+    return {
+      hasMore: result.authLog.hasMore,
+      entries: result.authLog.entries.map((it) => ({
+        id: it.id,
+        createdAt: it.createdAt,
+        type: it.type,
+        success: it.success,
+        invokedByIdentityId: it.invokedByIdentityId ?? null,
+        personId: it.personId ?? null,
+        targetPersonId: it.targetPersonId ?? null,
+        personInputIdentifier: it.personInputIdentifier ?? null,
+        errorCode: it.errorCode ?? null,
+        errorMessage: it.errorMessage ?? null,
+        ipAddress: it.ipAddress ?? null,
+        userAgent: it.userAgent ?? null,
+        identityProviderId: it.identityProviderId ?? null,
+        metadata: it.metadata ?? null,
+        eventData: it.eventData ?? null
+      }))
+    };
+  }
+}
+export {
+  TenantPolicyClient
+};
+//# sourceMappingURL=TenantPolicyClient.js.map

package/dist/production/src/lib/tenant/clients/TenantPolicyClient.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"TenantPolicyClient.js","sources":["../../../../../../../packages/cli/src/lib/tenant/clients/TenantPolicyClient.ts"],"sourcesContent":["import { CliError, ExitCode } from '@contember/cli-common'\nimport {\n\taddMailTemplateError$$,\n\taddMailTemplateResponse$$,\n\tauthLogEntry$$,\n\ttype AuthLogFilter,\n\tauthLogPage$,\n\tauthPolicy$$,\n\ttype AuthPolicyInput,\n\ttype AuthPolicyScope,\n\tcreateAuthPolicyError$$,\n\tcreateAuthPolicyResponse$$,\n\tcreateAuthPolicyResult$$,\n\tcreateCustomRoleError$$,\n\tcreateCustomRoleResponse$$,\n\tcustomRole$,\n\tdeleteAuthPolicyError$$,\n\tdeleteAuthPolicyResponse$$,\n\tmailTemplateData$$,\n\ttype MailTemplateIdentifier,\n\ttype MailType,\n\tmutation$,\n\tquery$,\n\tremoveMailTemplateError$$,\n\tremoveMailTemplateResponse$$,\n\tupdateAuthPolicyError$$,\n\tupdateAuthPolicyResponse$$,\n\tupdateCustomRoleError$$,\n\tupdateCustomRoleResponse$$,\n} from '@contember/graphql-client-tenant'\nimport { describeAuthPolicy } from '../authPolicy.js'\nimport { TenantApiTransport, TenantMutationResult } from '../TenantApiTransport.js'\nimport { TenantCustomRoleConfig, TenantMailTemplate } from '../tenantConfig.js'\n\n/** A policy as it exists server-side. The config-side counterpart is `TenantAuthPolicy` in `tenantConfig.ts`. */\nexport interface RemoteAuthPolicy {\n\tid: string\n\tscope: AuthPolicyScope\n\t/** Project slug, `null` for a global policy. */\n\tproject: string | null\n\troles: string[]\n\tmfaRequired: boolean | null\n\t/** ISO 8601 duration, e.g. `PT1H`. */\n\ttokenExpiration: string | null\n\tidleTimeout: string | null\n\tmfaGraceDuration: string | null\n\trememberMeAllowed: boolean | null\n}\n\nexport interface TenantMailTemplateData {\n\tprojectSlug: string | null\n\ttype: MailType\n\tvariant: string | null\n\tsubject: string\n\tcontent: string\n\tuseLayout: boolean\n\treplyTo: string | null\n}\n\nexport interface TenantAuthLogEntry {\n\tid: string\n\tcreatedAt: string\n\ttype: string\n\tsuccess: boolean\n\tinvokedByIdentityId: string | null\n\tpersonId: string | null\n\ttargetPersonId: string | null\n\tpersonInputIdentifier: string | null\n\terrorCode: string | null\n\terrorMessage: string | null\n\tipAddress: string | null\n\tuserAgent: string | null\n\tidentityProviderId: string | null\n\tmetadata: unknown\n\teventData: unknown\n}\n\nexport interface TenantAuthLogPage {\n\tentries: TenantAuthLogEntry[]\n\t/** True when more rows exist past `offset + entries.length`. */\n\thasMore: boolean\n}\n\nexport interface ReadAuthLogArgs {\n\tfilter?: AuthLogFilter\n\tlimit?: number\n\toffset?: number\n}\n\nexport interface RemoteCustomRole {\n\tslug: string\n}\n\ninterface UpdateCustomRoleResult {\n\tupdateCustomRole?: TenantMutationResult\n}\n\n// Fetchers are immutable and reusable, so they are built once at module load.\nconst authPoliciesFetcher = query$.authPolicies(authPolicy$$)\nconst createAuthPolicyFetcher = mutation$.createAuthPolicy(\n\tcreateAuthPolicyResponse$$.error(createAuthPolicyError$$).result(createAuthPolicyResult$$),\n)\nconst updateAuthPolicyFetcher = mutation$.updateAuthPolicy(updateAuthPolicyResponse$$.error(updateAuthPolicyError$$))\nconst deleteAuthPolicyFetcher = mutation$.deleteAuthPolicy(deleteAuthPolicyResponse$$.error(deleteAuthPolicyError$$))\nconst mailTemplatesFetcher = query$.mailTemplates(mailTemplateData$$)\nconst addMailTemplateFetcher = mutation$.addMailTemplate(addMailTemplateResponse$$.error(addMailTemplateError$$))\nconst removeMailTemplateFetcher = mutation$.removeMailTemplate(removeMailTemplateResponse$$.error(removeMailTemplateError$$))\nconst authLogFetcher = query$.authLog(authLogPage$.hasMore.entries(authLogEntry$$))\nconst customRolesFetcher = query$.customRoles(customRole$.slug)\nconst createCustomRoleFetcher = mutation$.createCustomRole(createCustomRoleResponse$$.error(createCustomRoleError$$))\nconst updateCustomRoleFetcher = mutation$.updateCustomRole(updateCustomRoleResponse$$.error(updateCustomRoleError$$))\nconst clearCustomRoleDescriptionMutation = `\n\tmutation updateCustomRoleDescription($slug: String!, $grants: [CustomRoleGrantInput!]) {\n\t\tupdateCustomRole(slug: $slug, grants: $grants, description: null) {\n\t\t\tok\n\t\t\terror {\n\t\t\t\tcode\n\t\t\t\tdeveloperMessage\n\t\t\t}\n\t\t}\n\t}\n`\n\n/** Auth policies, mail templates, custom roles and the auth log. */\nexport class TenantPolicyClient {\n\tconstructor(\n\t\tprivate readonly transport: TenantApiTransport,\n\t) {\n\t}\n\n\tpublic async listAuthPolicies(): Promise<RemoteAuthPolicy[]> {\n\t\tconst result = await this.transport.exec(authPoliciesFetcher, {})\n\t\treturn result.authPolicies.map(it => ({\n\t\t\tid: it.id,\n\t\t\tscope: it.scope,\n\t\t\tproject: it.project ?? null,\n\t\t\troles: [...it.roles],\n\t\t\tmfaRequired: it.mfaRequired ?? null,\n\t\t\ttokenExpiration: it.tokenExpiration ?? null,\n\t\t\tidleTimeout: it.idleTimeout ?? null,\n\t\t\tmfaGraceDuration: it.mfaGraceDuration ?? null,\n\t\t\trememberMeAllowed: it.rememberMeAllowed ?? null,\n\t\t}))\n\t}\n\n\t/** Returns the id of the created policy — the only thing `createAuthPolicy` hands back. */\n\tpublic async createAuthPolicy(policy: AuthPolicyInput): Promise<string> {\n\t\tconst result = await this.transport.exec(createAuthPolicyFetcher, { policy })\n\t\t// a policy has no slug, so the target is the only thing that identifies it in an error\n\t\tthis.transport.assertOk(result.createAuthPolicy, `createAuthPolicy(${describeAuthPolicy(policy)})`)\n\t\tconst id = result.createAuthPolicy?.result?.id\n\t\tif (id === undefined) {\n\t\t\t// ok without a result breaks the schema contract, so there is nothing sensible to report back\n\t\t\tthrow new CliError(`createAuthPolicy(${describeAuthPolicy(policy)}) reported success without returning an id.`, {\n\t\t\t\tcode: 'TENANT_API_INVALID_RESPONSE',\n\t\t\t\texitCode: ExitCode.InternalError,\n\t\t\t})\n\t\t}\n\t\treturn id\n\t}\n\n\tpublic async updateAuthPolicy(id: string, policy: AuthPolicyInput): Promise<void> {\n\t\tconst result = await this.transport.exec(updateAuthPolicyFetcher, { id, policy })\n\t\tthis.transport.assertOk(result.updateAuthPolicy, `updateAuthPolicy(${id}: ${describeAuthPolicy(policy)})`)\n\t}\n\n\tpublic async deleteAuthPolicy(id: string): Promise<void> {\n\t\tconst result = await this.transport.exec(deleteAuthPolicyFetcher, { id })\n\t\tthis.transport.assertOk(result.deleteAuthPolicy, `deleteAuthPolicy(${id})`)\n\t}\n\n\tpublic async listMailTemplates(): Promise<TenantMailTemplateData[]> {\n\t\tconst result = await this.transport.exec(mailTemplatesFetcher, {})\n\t\treturn result.mailTemplates.map(it => ({\n\t\t\tprojectSlug: it.projectSlug ?? null,\n\t\t\ttype: it.type,\n\t\t\tvariant: it.variant ?? null,\n\t\t\tsubject: it.subject,\n\t\t\tcontent: it.content,\n\t\t\tuseLayout: it.useLayout,\n\t\t\treplyTo: it.replyTo ?? null,\n\t\t}))\n\t}\n\n\tpublic async addMailTemplate(template: TenantMailTemplate): Promise<void> {\n\t\tconst result = await this.transport.exec(addMailTemplateFetcher, { template })\n\t\tthis.transport.assertOk(result.addMailTemplate, `addMailTemplate(${template.type}/${template.variant ?? ''})`)\n\t}\n\n\t/** A template is addressed by the `projectSlug`/`type`/`variant` triple — it has no id of its own. */\n\tpublic async removeMailTemplate(templateIdentifier: MailTemplateIdentifier): Promise<void> {\n\t\tconst result = await this.transport.exec(removeMailTemplateFetcher, { templateIdentifier })\n\t\tthis.transport.assertOk(result.removeMailTemplate, `removeMailTemplate(${templateIdentifier.type}/${templateIdentifier.variant ?? ''})`)\n\t}\n\n\tpublic async listCustomRoles(): Promise<RemoteCustomRole[]> {\n\t\tconst result = await this.transport.exec(customRolesFetcher, {})\n\t\treturn result.customRoles.map(role => ({ slug: role.slug }))\n\t}\n\n\tpublic async createCustomRole(slug: string, role: TenantCustomRoleConfig): Promise<void> {\n\t\tconst result = await this.transport.exec(createCustomRoleFetcher, {\n\t\t\tslug,\n\t\t\tdescription: role.description ?? undefined,\n\t\t\tgrants: role.grants,\n\t\t})\n\t\tthis.transport.assertOk(result.createCustomRole, `createCustomRole(${slug})`)\n\t}\n\n\tpublic async updateCustomRole(slug: string, role: TenantCustomRoleConfig): Promise<void> {\n\t\tconst result = role.description === null\n\t\t\t? await this.transport.execDocument<UpdateCustomRoleResult>(clearCustomRoleDescriptionMutation, { slug, grants: role.grants })\n\t\t\t: await this.transport.exec(updateCustomRoleFetcher, {\n\t\t\t\tslug,\n\t\t\t\tdescription: role.description,\n\t\t\t\tgrants: role.grants,\n\t\t\t})\n\t\tthis.transport.assertOk(result.updateCustomRole, `updateCustomRole(${slug})`)\n\t}\n\n\tpublic async readAuthLog({ filter, limit, offset }: ReadAuthLogArgs = {}): Promise<TenantAuthLogPage> {\n\t\tconst result = await this.transport.exec(authLogFetcher, { filter, limit, offset })\n\t\treturn {\n\t\t\thasMore: result.authLog.hasMore,\n\t\t\tentries: result.authLog.entries.map(it => ({\n\t\t\t\tid: it.id,\n\t\t\t\tcreatedAt: it.createdAt,\n\t\t\t\ttype: it.type,\n\t\t\t\tsuccess: it.success,\n\t\t\t\tinvokedByIdentityId: it.invokedByIdentityId ?? null,\n\t\t\t\tpersonId: it.personId ?? null,\n\t\t\t\ttargetPersonId: it.targetPersonId ?? null,\n\t\t\t\tpersonInputIdentifier: it.personInputIdentifier ?? null,\n\t\t\t\terrorCode: it.errorCode ?? null,\n\t\t\t\terrorMessage: it.errorMessage ?? null,\n\t\t\t\tipAddress: it.ipAddress ?? null,\n\t\t\t\tuserAgent: it.userAgent ?? null,\n\t\t\t\tidentityProviderId: it.identityProviderId ?? null,\n\t\t\t\tmetadata: it.metadata ?? null,\n\t\t\t\teventData: it.eventData ?? null,\n\t\t\t})),\n\t\t}\n\t}\n}\n"],"names":[],"mappings":";;;AAkGA,MAAM,sBAAsB,OAAO,aAAa,YAAY;AAC5D,MAAM,0BAA0B,UAAU;AAAA,EACzC,2BAA2B,MAAM,uBAAuB,EAAE,OAAO,wBAAwB;AAC1F;AACA,MAAM,0BAA0B,UAAU,iBAAiB,2BAA2B,MAAM,uBAAuB,CAAC;AACpH,MAAM,0BAA0B,UAAU,iBAAiB,2BAA2B,MAAM,uBAAuB,CAAC;AACpH,MAAM,uBAAuB,OAAO,cAAc,kBAAkB;AACpE,MAAM,yBAAyB,UAAU,gBAAgB,0BAA0B,MAAM,sBAAsB,CAAC;AAChH,MAAM,4BAA4B,UAAU,mBAAmB,6BAA6B,MAAM,yBAAyB,CAAC;AAC5H,MAAM,iBAAiB,OAAO,QAAQ,aAAa,QAAQ,QAAQ,cAAc,CAAC;AAClF,MAAM,qBAAqB,OAAO,YAAY,YAAY,IAAI;AAC9D,MAAM,0BAA0B,UAAU,iBAAiB,2BAA2B,MAAM,uBAAuB,CAAC;AACpH,MAAM,0BAA0B,UAAU,iBAAiB,2BAA2B,MAAM,uBAAuB,CAAC;AACpH,MAAM,qCAAqC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAapC,MAAM,mBAAmB;AAAA,EAC/B,YACkB,WAChB;AADgB,SAAA,YAAA;AAAA,EAElB;AAAA,EAEA,MAAa,mBAAgD;AAC5D,UAAM,SAAS,MAAM,KAAK,UAAU,KAAK,qBAAqB,EAAE;AAChE,WAAO,OAAO,aAAa,IAAI,CAAA,QAAO;AAAA,MACrC,IAAI,GAAG;AAAA,MACP,OAAO,GAAG;AAAA,MACV,SAAS,GAAG,WAAW;AAAA,MACvB,OAAO,CAAC,GAAG,GAAG,KAAK;AAAA,MACnB,aAAa,GAAG,eAAe;AAAA,MAC/B,iBAAiB,GAAG,mBAAmB;AAAA,MACvC,aAAa,GAAG,eAAe;AAAA,MAC/B,kBAAkB,GAAG,oBAAoB;AAAA,MACzC,mBAAmB,GAAG,qBAAqB;AAAA,IAAA,EAC1C;AAAA,EACH;AAAA;AAAA,EAGA,MAAa,iBAAiB,QAA0C;AACvE,UAAM,SAAS,MAAM,KAAK,UAAU,KAAK,yBAAyB,EAAE,QAAQ;AAE5E,SAAK,UAAU,SAAS,OAAO,kBAAkB,oBAAoB,mBAAmB,MAAM,CAAC,GAAG;AAClG,UAAM,KAAK,OAAO,kBAAkB,QAAQ;AAC5C,QAAI,OAAO,QAAW;AAErB,YAAM,IAAI,SAAS,oBAAoB,mBAAmB,MAAM,CAAC,+CAA+C;AAAA,QAC/G,MAAM;AAAA,QACN,UAAU,SAAS;AAAA,MAAA,CACnB;AAAA,IACF;AACA,WAAO;AAAA,EACR;AAAA,EAEA,MAAa,iBAAiB,IAAY,QAAwC;AACjF,UAAM,SAAS,MAAM,KAAK,UAAU,KAAK,yBAAyB,EAAE,IAAI,QAAQ;AAChF,SAAK,UAAU,SAAS,OAAO,kBAAkB,oBAAoB,EAAE,KAAK,mBAAmB,MAAM,CAAC,GAAG;AAAA,EAC1G;AAAA,EAEA,MAAa,iBAAiB,IAA2B;AACxD,UAAM,SAAS,MAAM,KAAK,UAAU,KAAK,yBAAyB,EAAE,IAAI;AACxE,SAAK,UAAU,SAAS,OAAO,kBAAkB,oBAAoB,EAAE,GAAG;AAAA,EAC3E;AAAA,EAEA,MAAa,oBAAuD;AACnE,UAAM,SAAS,MAAM,KAAK,UAAU,KAAK,sBAAsB,EAAE;AACjE,WAAO,OAAO,cAAc,IAAI,CAAA,QAAO;AAAA,MACtC,aAAa,GAAG,eAAe;AAAA,MAC/B,MAAM,GAAG;AAAA,MACT,SAAS,GAAG,WAAW;AAAA,MACvB,SAAS,GAAG;AAAA,MACZ,SAAS,GAAG;AAAA,MACZ,WAAW,GAAG;AAAA,MACd,SAAS,GAAG,WAAW;AAAA,IAAA,EACtB;AAAA,EACH;AAAA,EAEA,MAAa,gBAAgB,UAA6C;AACzE,UAAM,SAAS,MAAM,KAAK,UAAU,KAAK,wBAAwB,EAAE,UAAU;AAC7E,SAAK,UAAU,SAAS,OAAO,iBAAiB,mBAAmB,SAAS,IAAI,IAAI,SAAS,WAAW,EAAE,GAAG;AAAA,EAC9G;AAAA;AAAA,EAGA,MAAa,mBAAmB,oBAA2D;AAC1F,UAAM,SAAS,MAAM,KAAK,UAAU,KAAK,2BAA2B,EAAE,oBAAoB;AAC1F,SAAK,UAAU,SAAS,OAAO,oBAAoB,sBAAsB,mBAAmB,IAAI,IAAI,mBAAmB,WAAW,EAAE,GAAG;AAAA,EACxI;AAAA,EAEA,MAAa,kBAA+C;AAC3D,UAAM,SAAS,MAAM,KAAK,UAAU,KAAK,oBAAoB,EAAE;AAC/D,WAAO,OAAO,YAAY,IAAI,CAAA,UAAS,EAAE,MAAM,KAAK,OAAO;AAAA,EAC5D;AAAA,EAEA,MAAa,iBAAiB,MAAc,MAA6C;AACxF,UAAM,SAAS,MAAM,KAAK,UAAU,KAAK,yBAAyB;AAAA,MACjE;AAAA,MACA,aAAa,KAAK,eAAe;AAAA,MACjC,QAAQ,KAAK;AAAA,IAAA,CACb;AACD,SAAK,UAAU,SAAS,OAAO,kBAAkB,oBAAoB,IAAI,GAAG;AAAA,EAC7E;AAAA,EAEA,MAAa,iBAAiB,MAAc,MAA6C;AACxF,UAAM,SAAS,KAAK,gBAAgB,OACjC,MAAM,KAAK,UAAU,aAAqC,oCAAoC,EAAE,MAAM,QAAQ,KAAK,QAAQ,IAC3H,MAAM,KAAK,UAAU,KAAK,yBAAyB;AAAA,MACpD;AAAA,MACA,aAAa,KAAK;AAAA,MAClB,QAAQ,KAAK;AAAA,IAAA,CACb;AACF,SAAK,UAAU,SAAS,OAAO,kBAAkB,oBAAoB,IAAI,GAAG;AAAA,EAC7E;AAAA,EAEA,MAAa,YAAY,EAAE,QAAQ,OAAO,OAAA,IAA4B,CAAA,GAAgC;AACrG,UAAM,SAAS,MAAM,KAAK,UAAU,KAAK,gBAAgB,EAAE,QAAQ,OAAO,QAAQ;AAClF,WAAO;AAAA,MACN,SAAS,OAAO,QAAQ;AAAA,MACxB,SAAS,OAAO,QAAQ,QAAQ,IAAI,CAAA,QAAO;AAAA,QAC1C,IAAI,GAAG;AAAA,QACP,WAAW,GAAG;AAAA,QACd,MAAM,GAAG;AAAA,QACT,SAAS,GAAG;AAAA,QACZ,qBAAqB,GAAG,uBAAuB;AAAA,QAC/C,UAAU,GAAG,YAAY;AAAA,QACzB,gBAAgB,GAAG,kBAAkB;AAAA,QACrC,uBAAuB,GAAG,yBAAyB;AAAA,QACnD,WAAW,GAAG,aAAa;AAAA,QAC3B,cAAc,GAAG,gBAAgB;AAAA,QACjC,WAAW,GAAG,aAAa;AAAA,QAC3B,WAAW,GAAG,aAAa;AAAA,QAC3B,oBAAoB,GAAG,sBAAsB;AAAA,QAC7C,UAAU,GAAG,YAAY;AAAA,QACzB,WAAW,GAAG,aAAa;AAAA,MAAA,EAC1B;AAAA,IAAA;AAAA,EAEJ;AACD;"}

package/dist/production/src/lib/tenant/clients/TenantProjectClient.cjs

@@ -0,0 +1,209 @@
+"use strict";
+Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+const TenantApi = require("@contember/graphql-client-tenant");
+const cliCommon = require("@contember/cli-common");
+const createProjectFetcher = TenantApi.mutation$.createProject(
+  TenantApi.createProjectResponse$$.error(TenantApi.createProjectResponseError$$).result(TenantApi.createProjectResult$.deployerApiKey(TenantApi.apiKeyWithToken$$))
+);
+const setProjectSecretFetcher = TenantApi.mutation$.setProjectSecret(TenantApi.setProjectSecretResponse$$.error(TenantApi.setProjectSecretError$$));
+const updateProjectFetcher = TenantApi.mutation$.updateProject(TenantApi.updateProjectResponse$$.error(TenantApi.updateProjectError$$));
+const configureFetcher = TenantApi.mutation$.configure(TenantApi.configureResponse$$.error(TenantApi.configureError$$));
+const configurationFetcher = TenantApi.query$.configuration(
+  TenantApi.config$.signup(TenantApi.configSignup$$).emailChange(TenantApi.configEmailChange$$).passwordless(TenantApi.configPasswordless$$).password(TenantApi.configPassword$$).login(TenantApi.configLogin$$.anomalyDetection(TenantApi.configLoginAnomalyDetection$$)).captcha(TenantApi.configCaptcha$$.protect(TenantApi.configCaptchaProtect$$)).rateLimits(
+    TenantApi.configRateLimits$.signUpPerIp(TenantApi.configRateLimitWindow$$).loginPerIp(TenantApi.configRateLimitWindow$$).passwordResetPerIp(TenantApi.configRateLimitWindow$$).passwordlessInitPerIp(TenantApi.configRateLimitWindow$$).emailOtpPerPerson(TenantApi.configRateLimitWindow$$).emailVerificationPerIp(TenantApi.configRateLimitWindow$$)
+  )
+);
+const projectsFetcher = TenantApi.query$.projects(TenantApi.project$.id.name.slug);
+const roleVariableFetcher = TenantApi.roleVariableDefinition$$.on(TenantApi.roleConditionVariableDefinition$$).on(TenantApi.roleEntityVariableDefinition$$).on(TenantApi.rolePredefinedVariableDefinition$$);
+const toRoleVariableDefinition = (variable) => {
+  switch (variable.__typename) {
+    case "RoleEntityVariableDefinition":
+      return { type: "entity", name: variable.name, entityName: variable.entityName };
+    case "RolePredefinedVariableDefinition":
+      return { type: "predefined", name: variable.name, value: variable.value };
+    case "RoleConditionVariableDefinition":
+      return { type: "condition", name: variable.name };
+    case "RoleVariableDefinition":
+      throw new cliCommon.CliError(`Tenant API returned an abstract role variable definition for "${variable.name}".`, {
+        code: "TENANT_API_INVALID_RESPONSE",
+        exitCode: cliCommon.ExitCode.InternalError
+      });
+  }
+};
+const projectBySlugFetcher = TenantApi.query$.projectBySlug(
+  TenantApi.project$.id.name.slug.config.roles(TenantApi.roleDefinition$.name.variables(roleVariableFetcher)).secrets(TenantApi.projectSecretInfo$$)
+);
+const identityProvidersFetcher = TenantApi.query$.identityProviders(TenantApi.identityProvider$.slug.type.disabledAt);
+const addIdpFetcher = TenantApi.mutation$.addIDP(TenantApi.addIDPResponse$$.error(TenantApi.addIDPError$$));
+const updateIdpFetcher = TenantApi.mutation$.updateIDP(TenantApi.updateIDPResponse$$.error(TenantApi.updateIDPError$$));
+const enableIdpFetcher = TenantApi.mutation$.enableIDP(TenantApi.enableIDPResponse$$.error(TenantApi.enableIDPError$$));
+const disableIdpFetcher = TenantApi.mutation$.disableIDP(TenantApi.disableIDPResponse$$.error(TenantApi.disableIDPError$$));
+const meFetcher = TenantApi.query$.me(
+  TenantApi.identity$$.permissions(TenantApi.identityGlobalPermissions$$).projects(TenantApi.identityProjectRelation$.project(TenantApi.project$.slug.name).memberships(TenantApi.membership$$))
+);
+const toRateLimitWindow = (it) => ({ limit: it.limit, window: it.window });
+class TenantProjectClient {
+  constructor(transport) {
+    this.transport = transport;
+  }
+  async listProjects() {
+    const result = await this.transport.exec(projectsFetcher, {});
+    return result.projects.map((it) => ({ id: it.id, name: it.name, slug: it.slug }));
+  }
+  /** Null both when the project does not exist and when the caller may not see it — the API does not distinguish. */
+  async getProjectBySlug(slug) {
+    const result = await this.transport.exec(projectBySlugFetcher, { slug });
+    const project = result.projectBySlug;
+    if (!project) {
+      return null;
+    }
+    return {
+      id: project.id,
+      name: project.name,
+      slug: project.slug,
+      config: project.config,
+      roles: project.roles.map((role) => ({
+        name: role.name,
+        variables: role.variables.map((it) => it.name),
+        variableDefinitions: role.variables.map(toRoleVariableDefinition)
+      })),
+      secrets: project.secrets.map((it) => ({ key: it.key, createdAt: it.createdAt, updatedAt: it.updatedAt }))
+    };
+  }
+  /** Returns `null` (nothing created) when `ignoreExisting` swallowed an `ALREADY_EXISTS`. */
+  async createProject(slug, ignoreExisting = false, details) {
+    const result = await this.transport.exec(createProjectFetcher, {
+      projectSlug: slug,
+      name: details?.name,
+      config: details?.config,
+      options: details?.noDeployToken ? { noDeployToken: true } : void 0
+    });
+    if (ignoreExisting && result.createProject?.error?.code === "ALREADY_EXISTS") {
+      return null;
+    }
+    this.transport.assertOk(result.createProject, `createProject(${slug})`);
+    const deployerApiKey = result.createProject?.result?.deployerApiKey;
+    return { deployerApiKey: deployerApiKey ? { id: deployerApiKey.id, token: deployerApiKey.token ?? null } : null };
+  }
+  async updateProject(slug, changes) {
+    const result = await this.transport.exec(updateProjectFetcher, {
+      projectSlug: slug,
+      name: changes.name,
+      config: changes.config,
+      mergeConfig: changes.mergeConfig
+    });
+    this.transport.assertOk(result.updateProject, `updateProject(${slug})`);
+  }
+  async setProjectSecret(slug, key, value) {
+    const result = await this.transport.exec(setProjectSecretFetcher, { projectSlug: slug, key, value });
+    this.transport.assertOk(result.setProjectSecret, `setProjectSecret(${slug}/${key})`);
+  }
+  async configure(config) {
+    const result = await this.transport.exec(configureFetcher, { config });
+    this.transport.assertOk(result.configure, "configure");
+  }
+  async configuration() {
+    const result = await this.transport.exec(configurationFetcher, {});
+    const config = result.configuration;
+    return {
+      signup: { requireEmailVerification: config.signup.requireEmailVerification },
+      emailChange: { requireVerification: config.emailChange.requireVerification },
+      passwordless: {
+        enabled: config.passwordless.enabled,
+        url: config.passwordless.url ?? null,
+        expiration: config.passwordless.expiration
+      },
+      password: {
+        minLength: config.password.minLength,
+        requireUppercase: config.password.requireUppercase,
+        requireLowercase: config.password.requireLowercase,
+        requireDigit: config.password.requireDigit,
+        requireSpecial: config.password.requireSpecial,
+        pattern: config.password.pattern ?? null,
+        checkBlacklist: config.password.checkBlacklist,
+        checkHibp: config.password.checkHibp
+      },
+      login: {
+        baseBackoff: config.login.baseBackoff,
+        maxBackoff: config.login.maxBackoff,
+        attemptWindow: config.login.attemptWindow,
+        revealUserExists: config.login.revealUserExists,
+        revealLoginMethod: config.login.revealLoginMethod,
+        defaultTokenExpiration: config.login.defaultTokenExpiration,
+        maxTokenExpiration: config.login.maxTokenExpiration ?? null,
+        mfaGraceDuration: config.login.mfaGraceDuration,
+        anomalyDetection: {
+          enabled: config.login.anomalyDetection.enabled,
+          historySize: config.login.anomalyDetection.historySize,
+          emailThreshold: config.login.anomalyDetection.emailThreshold,
+          stepUpThreshold: config.login.anomalyDetection.stepUpThreshold
+        }
+      },
+      captcha: {
+        provider: config.captcha.provider ?? null,
+        threshold: config.captcha.threshold ?? null,
+        protect: {
+          signUp: config.captcha.protect.signUp,
+          passwordReset: config.captcha.protect.passwordReset,
+          passwordlessInit: config.captcha.protect.passwordlessInit,
+          emailVerification: config.captcha.protect.emailVerification
+        }
+      },
+      rateLimits: {
+        signUpPerIp: toRateLimitWindow(config.rateLimits.signUpPerIp),
+        loginPerIp: toRateLimitWindow(config.rateLimits.loginPerIp),
+        passwordResetPerIp: toRateLimitWindow(config.rateLimits.passwordResetPerIp),
+        passwordlessInitPerIp: toRateLimitWindow(config.rateLimits.passwordlessInitPerIp),
+        emailOtpPerPerson: toRateLimitWindow(config.rateLimits.emailOtpPerPerson),
+        emailVerificationPerIp: toRateLimitWindow(config.rateLimits.emailVerificationPerIp)
+      }
+    };
+  }
+  async listIdentityProviders() {
+    const result = await this.transport.exec(identityProvidersFetcher, {});
+    return result.identityProviders.map((it) => ({
+      slug: it.slug,
+      type: it.type,
+      disabledAt: it.disabledAt ?? null
+    }));
+  }
+  async addIdp(slug, type, configuration, options) {
+    const result = await this.transport.exec(addIdpFetcher, { identityProvider: slug, type, configuration, options });
+    this.transport.assertOk(result.addIDP, `addIDP(${slug})`);
+  }
+  async updateIdp(slug, type, configuration, options) {
+    const result = await this.transport.exec(updateIdpFetcher, {
+      identityProvider: slug,
+      type,
+      configuration,
+      options,
+      mergeConfiguration: false
+    });
+    this.transport.assertOk(result.updateIDP, `updateIDP(${slug})`);
+  }
+  async enableIdp(slug) {
+    const result = await this.transport.exec(enableIdpFetcher, { identityProvider: slug });
+    this.transport.assertOk(result.enableIDP, `enableIDP(${slug})`);
+  }
+  async disableIdp(slug) {
+    const result = await this.transport.exec(disableIdpFetcher, { identityProvider: slug });
+    this.transport.assertOk(result.disableIDP, `disableIDP(${slug})`);
+  }
+  async whoAmI() {
+    const result = await this.transport.exec(meFetcher, {});
+    const me = result.me;
+    return {
+      id: me.id,
+      description: me.description ?? null,
+      roles: me.roles ? [...me.roles] : [],
+      permissions: me.permissions ? { canCreateProject: me.permissions.canCreateProject, canDeployEntrypoint: me.permissions.canDeployEntrypoint } : null,
+      projects: me.projects.map((it) => ({
+        slug: it.project.slug,
+        name: it.project.name,
+        roles: it.memberships.map((m) => m.role)
+      }))
+    };
+  }
+}
+exports.TenantProjectClient = TenantProjectClient;
+//# sourceMappingURL=TenantProjectClient.cjs.map

package/dist/production/src/lib/tenant/clients/TenantProjectClient.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"TenantProjectClient.cjs","sources":["../../../../../../../packages/cli/src/lib/tenant/clients/TenantProjectClient.ts"],"sourcesContent":["import {\n\taddIDPError$$,\n\taddIDPResponse$$,\n\tapiKeyWithToken$$,\n\ttype CaptchaProvider,\n\tconfig$,\n\tconfigCaptcha$$,\n\tconfigCaptchaProtect$$,\n\tconfigEmailChange$$,\n\tconfigLogin$$,\n\tconfigLoginAnomalyDetection$$,\n\tconfigPassword$$,\n\tconfigPasswordless$$,\n\ttype ConfigPolicy,\n\tconfigRateLimits$,\n\tconfigRateLimitWindow$$,\n\tconfigSignup$$,\n\tconfigureError$$,\n\tconfigureResponse$$,\n\tcreateProjectResponse$$,\n\tcreateProjectResponseError$$,\n\tcreateProjectResult$,\n\tdisableIDPError$$,\n\tdisableIDPResponse$$,\n\tenableIDPError$$,\n\tenableIDPResponse$$,\n\tidentity$$,\n\tidentityGlobalPermissions$$,\n\tidentityProjectRelation$,\n\tidentityProvider$,\n\tmembership$$,\n\tmutation$,\n\tproject$,\n\tprojectSecretInfo$$,\n\tquery$,\n\troleConditionVariableDefinition$$,\n\troleDefinition$,\n\troleEntityVariableDefinition$$,\n\trolePredefinedVariableDefinition$$,\n\troleVariableDefinition$$,\n\tsetProjectSecretError$$,\n\tsetProjectSecretResponse$$,\n\tupdateIDPError$$,\n\tupdateIDPResponse$$,\n\tupdateProjectError$$,\n\tupdateProjectResponse$$,\n} from '@contember/graphql-client-tenant'\nimport { CliError, ExitCode } from '@contember/cli-common'\nimport type { ModelType } from 'graphql-ts-client-api'\nimport { TenantApiTransport } from '../TenantApiTransport.js'\nimport { TenantGlobalConfig, TenantIdpOptions } from '../tenantConfig.js'\n\nexport interface RemoteIdentityProvider {\n\tslug: string\n\ttype: string\n\tdisabledAt: string | null\n}\n\nexport interface TenantProjectSummary {\n\tid: string\n\tname: string\n\tslug: string\n}\n\nexport interface TenantProjectRole {\n\tname: string\n\t/** Variable names the role expects, retained for compatibility. */\n\tvariables: string[]\n\tvariableDefinitions: TenantProjectRoleVariableDefinition[]\n}\n\nexport type TenantProjectRoleVariableDefinition =\n\t| { type: 'entity'; name: string; entityName: string }\n\t| { type: 'predefined'; name: string; value: string }\n\t| { type: 'condition'; name: string }\n\nexport interface TenantProjectSecret {\n\tkey: string\n\tcreatedAt: string\n\tupdatedAt: string\n}\n\nexport interface TenantProjectDetail {\n\tid: string\n\tname: string\n\tslug: string\n\tconfig: unknown\n\troles: TenantProjectRole[]\n\tsecrets: TenantProjectSecret[]\n}\n\nexport interface TenantCreateProjectDetails {\n\tname?: string\n\tconfig?: unknown\n\t/** Skip issuing a deploy API key for the project. */\n\tnoDeployToken?: boolean\n}\n\nexport interface TenantCreateProjectResult {\n\t/** Null when {@link TenantCreateProjectDetails.noDeployToken} was requested. */\n\tdeployerApiKey: { id: string; token: string | null } | null\n}\n\nexport interface TenantUpdateProjectChanges {\n\tname?: string\n\tconfig?: unknown\n\tmergeConfig?: boolean\n}\n\nexport interface TenantRateLimitWindowState {\n\tlimit: number\n\twindow: string\n}\n\n/** The tenant-wide configuration returned by `Query.configuration` — the read side of {@link TenantGlobalConfig}. */\nexport interface TenantConfigState {\n\tsignup: { requireEmailVerification: boolean }\n\temailChange: { requireVerification: boolean }\n\tpasswordless: { enabled: ConfigPolicy; url: string | null; expiration: string }\n\tpassword: {\n\t\tminLength: number\n\t\trequireUppercase: number\n\t\trequireLowercase: number\n\t\trequireDigit: number\n\t\trequireSpecial: number\n\t\tpattern: string | null\n\t\tcheckBlacklist: boolean\n\t\tcheckHibp: boolean\n\t}\n\tlogin: {\n\t\tbaseBackoff: string\n\t\tmaxBackoff: string\n\t\tattemptWindow: string\n\t\trevealUserExists: boolean\n\t\trevealLoginMethod: boolean\n\t\tdefaultTokenExpiration: string\n\t\tmaxTokenExpiration: string | null\n\t\tmfaGraceDuration: string\n\t\tanomalyDetection: {\n\t\t\tenabled: boolean\n\t\t\thistorySize: number\n\t\t\temailThreshold: number\n\t\t\tstepUpThreshold: number\n\t\t}\n\t}\n\tcaptcha: {\n\t\tprovider: CaptchaProvider | null\n\t\tthreshold: number | null\n\t\tprotect: {\n\t\t\tsignUp: boolean\n\t\t\tpasswordReset: boolean\n\t\t\tpasswordlessInit: boolean\n\t\t\temailVerification: boolean\n\t\t}\n\t}\n\trateLimits: {\n\t\tsignUpPerIp: TenantRateLimitWindowState\n\t\tloginPerIp: TenantRateLimitWindowState\n\t\tpasswordResetPerIp: TenantRateLimitWindowState\n\t\tpasswordlessInitPerIp: TenantRateLimitWindowState\n\t\temailOtpPerPerson: TenantRateLimitWindowState\n\t\temailVerificationPerIp: TenantRateLimitWindowState\n\t}\n}\n\nexport interface TenantWhoAmIProject {\n\tslug: string\n\tname: string\n\troles: string[]\n}\n\n/** `Query.me` — the identity behind the token the CLI is using. */\nexport interface TenantWhoAmI {\n\tid: string\n\tdescription: string | null\n\t/** Global (tenant-wide) roles — empty for an identity whose access is entirely project-scoped. */\n\troles: string[]\n\tpermissions: { canCreateProject: boolean; canDeployEntrypoint: boolean } | null\n\tprojects: TenantWhoAmIProject[]\n}\n\n// Fetchers are immutable and reusable, so they are built once at module load.\nconst createProjectFetcher = mutation$.createProject(\n\tcreateProjectResponse$$.error(createProjectResponseError$$).result(createProjectResult$.deployerApiKey(apiKeyWithToken$$)),\n)\nconst setProjectSecretFetcher = mutation$.setProjectSecret(setProjectSecretResponse$$.error(setProjectSecretError$$))\nconst updateProjectFetcher = mutation$.updateProject(updateProjectResponse$$.error(updateProjectError$$))\nconst configureFetcher = mutation$.configure(configureResponse$$.error(configureError$$))\nconst configurationFetcher = query$.configuration(\n\tconfig$\n\t\t.signup(configSignup$$)\n\t\t.emailChange(configEmailChange$$)\n\t\t.passwordless(configPasswordless$$)\n\t\t.password(configPassword$$)\n\t\t.login(configLogin$$.anomalyDetection(configLoginAnomalyDetection$$))\n\t\t.captcha(configCaptcha$$.protect(configCaptchaProtect$$))\n\t\t.rateLimits(\n\t\t\tconfigRateLimits$\n\t\t\t\t.signUpPerIp(configRateLimitWindow$$)\n\t\t\t\t.loginPerIp(configRateLimitWindow$$)\n\t\t\t\t.passwordResetPerIp(configRateLimitWindow$$)\n\t\t\t\t.passwordlessInitPerIp(configRateLimitWindow$$)\n\t\t\t\t.emailOtpPerPerson(configRateLimitWindow$$)\n\t\t\t\t.emailVerificationPerIp(configRateLimitWindow$$),\n\t\t),\n)\nconst projectsFetcher = query$.projects(project$.id.name.slug)\nconst roleVariableFetcher = roleVariableDefinition$$\n\t.on(roleConditionVariableDefinition$$)\n\t.on(roleEntityVariableDefinition$$)\n\t.on(rolePredefinedVariableDefinition$$)\nconst toRoleVariableDefinition = (variable: ModelType<typeof roleVariableFetcher>): TenantProjectRoleVariableDefinition => {\n\tswitch (variable.__typename) {\n\t\tcase 'RoleEntityVariableDefinition':\n\t\t\treturn { type: 'entity', name: variable.name, entityName: variable.entityName }\n\t\tcase 'RolePredefinedVariableDefinition':\n\t\t\treturn { type: 'predefined', name: variable.name, value: variable.value }\n\t\tcase 'RoleConditionVariableDefinition':\n\t\t\treturn { type: 'condition', name: variable.name }\n\t\tcase 'RoleVariableDefinition':\n\t\t\tthrow new CliError(`Tenant API returned an abstract role variable definition for \"${variable.name}\".`, {\n\t\t\t\tcode: 'TENANT_API_INVALID_RESPONSE',\n\t\t\t\texitCode: ExitCode.InternalError,\n\t\t\t})\n\t}\n}\nconst projectBySlugFetcher = query$.projectBySlug(\n\tproject$\n\t\t.id.name.slug.config\n\t\t.roles(roleDefinition$.name.variables(roleVariableFetcher))\n\t\t.secrets(projectSecretInfo$$),\n)\nconst identityProvidersFetcher = query$.identityProviders(identityProvider$.slug.type.disabledAt)\nconst addIdpFetcher = mutation$.addIDP(addIDPResponse$$.error(addIDPError$$))\nconst updateIdpFetcher = mutation$.updateIDP(updateIDPResponse$$.error(updateIDPError$$))\nconst enableIdpFetcher = mutation$.enableIDP(enableIDPResponse$$.error(enableIDPError$$))\nconst disableIdpFetcher = mutation$.disableIDP(disableIDPResponse$$.error(disableIDPError$$))\nconst meFetcher = query$.me(\n\tidentity$$\n\t\t.permissions(identityGlobalPermissions$$)\n\t\t.projects(identityProjectRelation$.project(project$.slug.name).memberships(membership$$)),\n)\n\nconst toRateLimitWindow = (it: { limit: number; window: string }): TenantRateLimitWindowState => ({ limit: it.limit, window: it.window })\n\n/** Projects, project secrets, global tenant configuration, identity providers and `me`. */\nexport class TenantProjectClient {\n\tconstructor(\n\t\tprivate readonly transport: TenantApiTransport,\n\t) {\n\t}\n\n\tpublic async listProjects(): Promise<TenantProjectSummary[]> {\n\t\tconst result = await this.transport.exec(projectsFetcher, {})\n\t\treturn result.projects.map(it => ({ id: it.id, name: it.name, slug: it.slug }))\n\t}\n\n\t/** Null both when the project does not exist and when the caller may not see it — the API does not distinguish. */\n\tpublic async getProjectBySlug(slug: string): Promise<TenantProjectDetail | null> {\n\t\tconst result = await this.transport.exec(projectBySlugFetcher, { slug })\n\t\tconst project = result.projectBySlug\n\t\tif (!project) {\n\t\t\treturn null\n\t\t}\n\t\treturn {\n\t\t\tid: project.id,\n\t\t\tname: project.name,\n\t\t\tslug: project.slug,\n\t\t\tconfig: project.config,\n\t\t\troles: project.roles.map(role => ({\n\t\t\t\tname: role.name,\n\t\t\t\tvariables: role.variables.map(it => it.name),\n\t\t\t\tvariableDefinitions: role.variables.map(toRoleVariableDefinition),\n\t\t\t})),\n\t\t\tsecrets: project.secrets.map(it => ({ key: it.key, createdAt: it.createdAt, updatedAt: it.updatedAt })),\n\t\t}\n\t}\n\n\t/** Returns `null` (nothing created) when `ignoreExisting` swallowed an `ALREADY_EXISTS`. */\n\tpublic async createProject(slug: string, ignoreExisting = false, details?: TenantCreateProjectDetails): Promise<TenantCreateProjectResult | null> {\n\t\tconst result = await this.transport.exec(createProjectFetcher, {\n\t\t\tprojectSlug: slug,\n\t\t\tname: details?.name,\n\t\t\tconfig: details?.config,\n\t\t\toptions: details?.noDeployToken ? { noDeployToken: true } : undefined,\n\t\t})\n\t\tif (ignoreExisting && result.createProject?.error?.code === 'ALREADY_EXISTS') {\n\t\t\treturn null\n\t\t}\n\t\tthis.transport.assertOk(result.createProject, `createProject(${slug})`)\n\t\tconst deployerApiKey = result.createProject?.result?.deployerApiKey\n\t\treturn { deployerApiKey: deployerApiKey ? { id: deployerApiKey.id, token: deployerApiKey.token ?? null } : null }\n\t}\n\n\tpublic async updateProject(slug: string, changes: TenantUpdateProjectChanges): Promise<void> {\n\t\tconst result = await this.transport.exec(updateProjectFetcher, {\n\t\t\tprojectSlug: slug,\n\t\t\tname: changes.name,\n\t\t\tconfig: changes.config,\n\t\t\tmergeConfig: changes.mergeConfig,\n\t\t})\n\t\tthis.transport.assertOk(result.updateProject, `updateProject(${slug})`)\n\t}\n\n\tpublic async setProjectSecret(slug: string, key: string, value: string): Promise<void> {\n\t\tconst result = await this.transport.exec(setProjectSecretFetcher, { projectSlug: slug, key, value })\n\t\tthis.transport.assertOk(result.setProjectSecret, `setProjectSecret(${slug}/${key})`)\n\t}\n\n\tpublic async configure(config: TenantGlobalConfig): Promise<void> {\n\t\tconst result = await this.transport.exec(configureFetcher, { config })\n\t\tthis.transport.assertOk(result.configure, 'configure')\n\t}\n\n\tpublic async configuration(): Promise<TenantConfigState> {\n\t\tconst result = await this.transport.exec(configurationFetcher, {})\n\t\tconst config = result.configuration\n\t\treturn {\n\t\t\tsignup: { requireEmailVerification: config.signup.requireEmailVerification },\n\t\t\temailChange: { requireVerification: config.emailChange.requireVerification },\n\t\t\tpasswordless: {\n\t\t\t\tenabled: config.passwordless.enabled,\n\t\t\t\turl: config.passwordless.url ?? null,\n\t\t\t\texpiration: config.passwordless.expiration,\n\t\t\t},\n\t\t\tpassword: {\n\t\t\t\tminLength: config.password.minLength,\n\t\t\t\trequireUppercase: config.password.requireUppercase,\n\t\t\t\trequireLowercase: config.password.requireLowercase,\n\t\t\t\trequireDigit: config.password.requireDigit,\n\t\t\t\trequireSpecial: config.password.requireSpecial,\n\t\t\t\tpattern: config.password.pattern ?? null,\n\t\t\t\tcheckBlacklist: config.password.checkBlacklist,\n\t\t\t\tcheckHibp: config.password.checkHibp,\n\t\t\t},\n\t\t\tlogin: {\n\t\t\t\tbaseBackoff: config.login.baseBackoff,\n\t\t\t\tmaxBackoff: config.login.maxBackoff,\n\t\t\t\tattemptWindow: config.login.attemptWindow,\n\t\t\t\trevealUserExists: config.login.revealUserExists,\n\t\t\t\trevealLoginMethod: config.login.revealLoginMethod,\n\t\t\t\tdefaultTokenExpiration: config.login.defaultTokenExpiration,\n\t\t\t\tmaxTokenExpiration: config.login.maxTokenExpiration ?? null,\n\t\t\t\tmfaGraceDuration: config.login.mfaGraceDuration,\n\t\t\t\tanomalyDetection: {\n\t\t\t\t\tenabled: config.login.anomalyDetection.enabled,\n\t\t\t\t\thistorySize: config.login.anomalyDetection.historySize,\n\t\t\t\t\temailThreshold: config.login.anomalyDetection.emailThreshold,\n\t\t\t\t\tstepUpThreshold: config.login.anomalyDetection.stepUpThreshold,\n\t\t\t\t},\n\t\t\t},\n\t\t\tcaptcha: {\n\t\t\t\tprovider: config.captcha.provider ?? null,\n\t\t\t\tthreshold: config.captcha.threshold ?? null,\n\t\t\t\tprotect: {\n\t\t\t\t\tsignUp: config.captcha.protect.signUp,\n\t\t\t\t\tpasswordReset: config.captcha.protect.passwordReset,\n\t\t\t\t\tpasswordlessInit: config.captcha.protect.passwordlessInit,\n\t\t\t\t\temailVerification: config.captcha.protect.emailVerification,\n\t\t\t\t},\n\t\t\t},\n\t\t\trateLimits: {\n\t\t\t\tsignUpPerIp: toRateLimitWindow(config.rateLimits.signUpPerIp),\n\t\t\t\tloginPerIp: toRateLimitWindow(config.rateLimits.loginPerIp),\n\t\t\t\tpasswordResetPerIp: toRateLimitWindow(config.rateLimits.passwordResetPerIp),\n\t\t\t\tpasswordlessInitPerIp: toRateLimitWindow(config.rateLimits.passwordlessInitPerIp),\n\t\t\t\temailOtpPerPerson: toRateLimitWindow(config.rateLimits.emailOtpPerPerson),\n\t\t\t\temailVerificationPerIp: toRateLimitWindow(config.rateLimits.emailVerificationPerIp),\n\t\t\t},\n\t\t}\n\t}\n\n\tpublic async listIdentityProviders(): Promise<RemoteIdentityProvider[]> {\n\t\tconst result = await this.transport.exec(identityProvidersFetcher, {})\n\t\treturn result.identityProviders.map(it => ({\n\t\t\tslug: it.slug,\n\t\t\ttype: it.type,\n\t\t\tdisabledAt: it.disabledAt ?? null,\n\t\t}))\n\t}\n\n\tpublic async addIdp(slug: string, type: string, configuration: unknown, options?: TenantIdpOptions): Promise<void> {\n\t\tconst result = await this.transport.exec(addIdpFetcher, { identityProvider: slug, type, configuration, options })\n\t\tthis.transport.assertOk(result.addIDP, `addIDP(${slug})`)\n\t}\n\n\tpublic async updateIdp(slug: string, type: string, configuration: unknown, options?: TenantIdpOptions): Promise<void> {\n\t\tconst result = await this.transport.exec(updateIdpFetcher, {\n\t\t\tidentityProvider: slug,\n\t\t\ttype,\n\t\t\tconfiguration,\n\t\t\toptions,\n\t\t\tmergeConfiguration: false,\n\t\t})\n\t\tthis.transport.assertOk(result.updateIDP, `updateIDP(${slug})`)\n\t}\n\n\tpublic async enableIdp(slug: string): Promise<void> {\n\t\tconst result = await this.transport.exec(enableIdpFetcher, { identityProvider: slug })\n\t\tthis.transport.assertOk(result.enableIDP, `enableIDP(${slug})`)\n\t}\n\n\tpublic async disableIdp(slug: string): Promise<void> {\n\t\tconst result = await this.transport.exec(disableIdpFetcher, { identityProvider: slug })\n\t\tthis.transport.assertOk(result.disableIDP, `disableIDP(${slug})`)\n\t}\n\n\tpublic async whoAmI(): Promise<TenantWhoAmI> {\n\t\tconst result = await this.transport.exec(meFetcher, {})\n\t\tconst me = result.me\n\t\treturn {\n\t\t\tid: me.id,\n\t\t\tdescription: me.description ?? null,\n\t\t\troles: me.roles ? [...me.roles] : [],\n\t\t\tpermissions: me.permissions\n\t\t\t\t? { canCreateProject: me.permissions.canCreateProject, canDeployEntrypoint: me.permissions.canDeployEntrypoint }\n\t\t\t\t: null,\n\t\t\tprojects: me.projects.map(it => ({\n\t\t\t\tslug: it.project.slug,\n\t\t\t\tname: it.project.name,\n\t\t\t\troles: it.memberships.map(m => m.role),\n\t\t\t})),\n\t\t}\n\t}\n}\n"],"names":["mutation$","createProjectResponse$$","createProjectResponseError$$","createProjectResult$","apiKeyWithToken$$","setProjectSecretResponse$$","setProjectSecretError$$","updateProjectResponse$$","updateProjectError$$","configureResponse$$","configureError$$","query$","config$","configSignup$$","configEmailChange$$","configPasswordless$$","configPassword$$","configLogin$$","configLoginAnomalyDetection$$","configCaptcha$$","configCaptchaProtect$$","configRateLimits$","configRateLimitWindow$$","project$","roleVariableDefinition$$","roleConditionVariableDefinition$$","roleEntityVariableDefinition$$","rolePredefinedVariableDefinition$$","CliError","ExitCode","roleDefinition$","projectSecretInfo$$","identityProvider$","addIDPResponse$$","addIDPError$$","updateIDPResponse$$","updateIDPError$$","enableIDPResponse$$","enableIDPError$$","disableIDPResponse$$","disableIDPError$$","identity$$","identityGlobalPermissions$$","identityProjectRelation$","membership$$"],"mappings":";;;;AAsLA,MAAM,uBAAuBA,UAAAA,UAAU;AAAA,EACtCC,UAAAA,wBAAwB,MAAMC,sCAA4B,EAAE,OAAOC,UAAAA,qBAAqB,eAAeC,2BAAiB,CAAC;AAC1H;AACA,MAAM,0BAA0BJ,UAAAA,UAAU,iBAAiBK,UAAAA,2BAA2B,MAAMC,UAAAA,uBAAuB,CAAC;AACpH,MAAM,uBAAuBN,UAAAA,UAAU,cAAcO,UAAAA,wBAAwB,MAAMC,UAAAA,oBAAoB,CAAC;AACxG,MAAM,mBAAmBR,UAAAA,UAAU,UAAUS,UAAAA,oBAAoB,MAAMC,UAAAA,gBAAgB,CAAC;AACxF,MAAM,uBAAuBC,UAAAA,OAAO;AAAA,EACnCC,kBACE,OAAOC,UAAAA,cAAc,EACrB,YAAYC,6BAAmB,EAC/B,aAAaC,UAAAA,oBAAoB,EACjC,SAASC,UAAAA,gBAAgB,EACzB,MAAMC,UAAAA,cAAc,iBAAiBC,UAAAA,6BAA6B,CAAC,EACnE,QAAQC,UAAAA,gBAAgB,QAAQC,gCAAsB,CAAC,EACvD;AAAA,IACAC,UAAAA,kBACE,YAAYC,UAAAA,uBAAuB,EACnC,WAAWA,UAAAA,uBAAuB,EAClC,mBAAmBA,UAAAA,uBAAuB,EAC1C,sBAAsBA,UAAAA,uBAAuB,EAC7C,kBAAkBA,UAAAA,uBAAuB,EACzC,uBAAuBA,UAAAA,uBAAuB;AAAA,EAAA;AAEnD;AACA,MAAM,kBAAkBX,UAAAA,OAAO,SAASY,UAAAA,SAAS,GAAG,KAAK,IAAI;AAC7D,MAAM,sBAAsBC,UAAAA,yBAC1B,GAAGC,UAAAA,iCAAiC,EACpC,GAAGC,UAAAA,8BAA8B,EACjC,GAAGC,4CAAkC;AACvC,MAAM,2BAA2B,CAAC,aAAyF;AAC1H,UAAQ,SAAS,YAAA;AAAA,IAChB,KAAK;AACJ,aAAO,EAAE,MAAM,UAAU,MAAM,SAAS,MAAM,YAAY,SAAS,WAAA;AAAA,IACpE,KAAK;AACJ,aAAO,EAAE,MAAM,cAAc,MAAM,SAAS,MAAM,OAAO,SAAS,MAAA;AAAA,IACnE,KAAK;AACJ,aAAO,EAAE,MAAM,aAAa,MAAM,SAAS,KAAA;AAAA,IAC5C,KAAK;AACJ,YAAM,IAAIC,UAAAA,SAAS,iEAAiE,SAAS,IAAI,MAAM;AAAA,QACtG,MAAM;AAAA,QACN,UAAUC,UAAAA,SAAS;AAAA,MAAA,CACnB;AAAA,EAAA;AAEJ;AACA,MAAM,uBAAuBlB,UAAAA,OAAO;AAAA,EACnCY,UAAAA,SACE,GAAG,KAAK,KAAK,OACb,MAAMO,0BAAgB,KAAK,UAAU,mBAAmB,CAAC,EACzD,QAAQC,UAAAA,mBAAmB;AAC9B;AACA,MAAM,2BAA2BpB,UAAAA,OAAO,kBAAkBqB,UAAAA,kBAAkB,KAAK,KAAK,UAAU;AAChG,MAAM,gBAAgBhC,UAAAA,UAAU,OAAOiC,UAAAA,iBAAiB,MAAMC,UAAAA,aAAa,CAAC;AAC5E,MAAM,mBAAmBlC,UAAAA,UAAU,UAAUmC,UAAAA,oBAAoB,MAAMC,UAAAA,gBAAgB,CAAC;AACxF,MAAM,mBAAmBpC,UAAAA,UAAU,UAAUqC,UAAAA,oBAAoB,MAAMC,UAAAA,gBAAgB,CAAC;AACxF,MAAM,oBAAoBtC,UAAAA,UAAU,WAAWuC,UAAAA,qBAAqB,MAAMC,UAAAA,iBAAiB,CAAC;AAC5F,MAAM,YAAY7B,UAAAA,OAAO;AAAA,EACxB8B,UAAAA,WACE,YAAYC,qCAA2B,EACvC,SAASC,UAAAA,yBAAyB,QAAQpB,UAAAA,SAAS,KAAK,IAAI,EAAE,YAAYqB,UAAAA,YAAY,CAAC;AAC1F;AAEA,MAAM,oBAAoB,CAAC,QAAuE,EAAE,OAAO,GAAG,OAAO,QAAQ,GAAG;AAGzH,MAAM,oBAAoB;AAAA,EAChC,YACkB,WAChB;AADgB,SAAA,YAAA;AAAA,EAElB;AAAA,EAEA,MAAa,eAAgD;AAC5D,UAAM,SAAS,MAAM,KAAK,UAAU,KAAK,iBAAiB,EAAE;AAC5D,WAAO,OAAO,SAAS,IAAI,CAAA,QAAO,EAAE,IAAI,GAAG,IAAI,MAAM,GAAG,MAAM,MAAM,GAAG,OAAO;AAAA,EAC/E;AAAA;AAAA,EAGA,MAAa,iBAAiB,MAAmD;AAChF,UAAM,SAAS,MAAM,KAAK,UAAU,KAAK,sBAAsB,EAAE,MAAM;AACvE,UAAM,UAAU,OAAO;AACvB,QAAI,CAAC,SAAS;AACb,aAAO;AAAA,IACR;AACA,WAAO;AAAA,MACN,IAAI,QAAQ;AAAA,MACZ,MAAM,QAAQ;AAAA,MACd,MAAM,QAAQ;AAAA,MACd,QAAQ,QAAQ;AAAA,MAChB,OAAO,QAAQ,MAAM,IAAI,CAAA,UAAS;AAAA,QACjC,MAAM,KAAK;AAAA,QACX,WAAW,KAAK,UAAU,IAAI,CAAA,OAAM,GAAG,IAAI;AAAA,QAC3C,qBAAqB,KAAK,UAAU,IAAI,wBAAwB;AAAA,MAAA,EAC/D;AAAA,MACF,SAAS,QAAQ,QAAQ,IAAI,SAAO,EAAE,KAAK,GAAG,KAAK,WAAW,GAAG,WAAW,WAAW,GAAG,YAAY;AAAA,IAAA;AAAA,EAExG;AAAA;AAAA,EAGA,MAAa,cAAc,MAAc,iBAAiB,OAAO,SAAiF;AACjJ,UAAM,SAAS,MAAM,KAAK,UAAU,KAAK,sBAAsB;AAAA,MAC9D,aAAa;AAAA,MACb,MAAM,SAAS;AAAA,MACf,QAAQ,SAAS;AAAA,MACjB,SAAS,SAAS,gBAAgB,EAAE,eAAe,SAAS;AAAA,IAAA,CAC5D;AACD,QAAI,kBAAkB,OAAO,eAAe,OAAO,SAAS,kBAAkB;AAC7E,aAAO;AAAA,IACR;AACA,SAAK,UAAU,SAAS,OAAO,eAAe,iBAAiB,IAAI,GAAG;AACtE,UAAM,iBAAiB,OAAO,eAAe,QAAQ;AACrD,WAAO,EAAE,gBAAgB,iBAAiB,EAAE,IAAI,eAAe,IAAI,OAAO,eAAe,SAAS,KAAA,IAAS,KAAA;AAAA,EAC5G;AAAA,EAEA,MAAa,cAAc,MAAc,SAAoD;AAC5F,UAAM,SAAS,MAAM,KAAK,UAAU,KAAK,sBAAsB;AAAA,MAC9D,aAAa;AAAA,MACb,MAAM,QAAQ;AAAA,MACd,QAAQ,QAAQ;AAAA,MAChB,aAAa,QAAQ;AAAA,IAAA,CACrB;AACD,SAAK,UAAU,SAAS,OAAO,eAAe,iBAAiB,IAAI,GAAG;AAAA,EACvE;AAAA,EAEA,MAAa,iBAAiB,MAAc,KAAa,OAA8B;AACtF,UAAM,SAAS,MAAM,KAAK,UAAU,KAAK,yBAAyB,EAAE,aAAa,MAAM,KAAK,MAAA,CAAO;AACnG,SAAK,UAAU,SAAS,OAAO,kBAAkB,oBAAoB,IAAI,IAAI,GAAG,GAAG;AAAA,EACpF;AAAA,EAEA,MAAa,UAAU,QAA2C;AACjE,UAAM,SAAS,MAAM,KAAK,UAAU,KAAK,kBAAkB,EAAE,QAAQ;AACrE,SAAK,UAAU,SAAS,OAAO,WAAW,WAAW;AAAA,EACtD;AAAA,EAEA,MAAa,gBAA4C;AACxD,UAAM,SAAS,MAAM,KAAK,UAAU,KAAK,sBAAsB,EAAE;AACjE,UAAM,SAAS,OAAO;AACtB,WAAO;AAAA,MACN,QAAQ,EAAE,0BAA0B,OAAO,OAAO,yBAAA;AAAA,MAClD,aAAa,EAAE,qBAAqB,OAAO,YAAY,oBAAA;AAAA,MACvD,cAAc;AAAA,QACb,SAAS,OAAO,aAAa;AAAA,QAC7B,KAAK,OAAO,aAAa,OAAO;AAAA,QAChC,YAAY,OAAO,aAAa;AAAA,MAAA;AAAA,MAEjC,UAAU;AAAA,QACT,WAAW,OAAO,SAAS;AAAA,QAC3B,kBAAkB,OAAO,SAAS;AAAA,QAClC,kBAAkB,OAAO,SAAS;AAAA,QAClC,cAAc,OAAO,SAAS;AAAA,QAC9B,gBAAgB,OAAO,SAAS;AAAA,QAChC,SAAS,OAAO,SAAS,WAAW;AAAA,QACpC,gBAAgB,OAAO,SAAS;AAAA,QAChC,WAAW,OAAO,SAAS;AAAA,MAAA;AAAA,MAE5B,OAAO;AAAA,QACN,aAAa,OAAO,MAAM;AAAA,QAC1B,YAAY,OAAO,MAAM;AAAA,QACzB,eAAe,OAAO,MAAM;AAAA,QAC5B,kBAAkB,OAAO,MAAM;AAAA,QAC/B,mBAAmB,OAAO,MAAM;AAAA,QAChC,wBAAwB,OAAO,MAAM;AAAA,QACrC,oBAAoB,OAAO,MAAM,sBAAsB;AAAA,QACvD,kBAAkB,OAAO,MAAM;AAAA,QAC/B,kBAAkB;AAAA,UACjB,SAAS,OAAO,MAAM,iBAAiB;AAAA,UACvC,aAAa,OAAO,MAAM,iBAAiB;AAAA,UAC3C,gBAAgB,OAAO,MAAM,iBAAiB;AAAA,UAC9C,iBAAiB,OAAO,MAAM,iBAAiB;AAAA,QAAA;AAAA,MAChD;AAAA,MAED,SAAS;AAAA,QACR,UAAU,OAAO,QAAQ,YAAY;AAAA,QACrC,WAAW,OAAO,QAAQ,aAAa;AAAA,QACvC,SAAS;AAAA,UACR,QAAQ,OAAO,QAAQ,QAAQ;AAAA,UAC/B,eAAe,OAAO,QAAQ,QAAQ;AAAA,UACtC,kBAAkB,OAAO,QAAQ,QAAQ;AAAA,UACzC,mBAAmB,OAAO,QAAQ,QAAQ;AAAA,QAAA;AAAA,MAC3C;AAAA,MAED,YAAY;AAAA,QACX,aAAa,kBAAkB,OAAO,WAAW,WAAW;AAAA,QAC5D,YAAY,kBAAkB,OAAO,WAAW,UAAU;AAAA,QAC1D,oBAAoB,kBAAkB,OAAO,WAAW,kBAAkB;AAAA,QAC1E,uBAAuB,kBAAkB,OAAO,WAAW,qBAAqB;AAAA,QAChF,mBAAmB,kBAAkB,OAAO,WAAW,iBAAiB;AAAA,QACxE,wBAAwB,kBAAkB,OAAO,WAAW,sBAAsB;AAAA,MAAA;AAAA,IACnF;AAAA,EAEF;AAAA,EAEA,MAAa,wBAA2D;AACvE,UAAM,SAAS,MAAM,KAAK,UAAU,KAAK,0BAA0B,EAAE;AACrE,WAAO,OAAO,kBAAkB,IAAI,CAAA,QAAO;AAAA,MAC1C,MAAM,GAAG;AAAA,MACT,MAAM,GAAG;AAAA,MACT,YAAY,GAAG,cAAc;AAAA,IAAA,EAC5B;AAAA,EACH;AAAA,EAEA,MAAa,OAAO,MAAc,MAAc,eAAwB,SAA2C;AAClH,UAAM,SAAS,MAAM,KAAK,UAAU,KAAK,eAAe,EAAE,kBAAkB,MAAM,MAAM,eAAe,QAAA,CAAS;AAChH,SAAK,UAAU,SAAS,OAAO,QAAQ,UAAU,IAAI,GAAG;AAAA,EACzD;AAAA,EAEA,MAAa,UAAU,MAAc,MAAc,eAAwB,SAA2C;AACrH,UAAM,SAAS,MAAM,KAAK,UAAU,KAAK,kBAAkB;AAAA,MAC1D,kBAAkB;AAAA,MAClB;AAAA,MACA;AAAA,MACA;AAAA,MACA,oBAAoB;AAAA,IAAA,CACpB;AACD,SAAK,UAAU,SAAS,OAAO,WAAW,aAAa,IAAI,GAAG;AAAA,EAC/D;AAAA,EAEA,MAAa,UAAU,MAA6B;AACnD,UAAM,SAAS,MAAM,KAAK,UAAU,KAAK,kBAAkB,EAAE,kBAAkB,MAAM;AACrF,SAAK,UAAU,SAAS,OAAO,WAAW,aAAa,IAAI,GAAG;AAAA,EAC/D;AAAA,EAEA,MAAa,WAAW,MAA6B;AACpD,UAAM,SAAS,MAAM,KAAK,UAAU,KAAK,mBAAmB,EAAE,kBAAkB,MAAM;AACtF,SAAK,UAAU,SAAS,OAAO,YAAY,cAAc,IAAI,GAAG;AAAA,EACjE;AAAA,EAEA,MAAa,SAAgC;AAC5C,UAAM,SAAS,MAAM,KAAK,UAAU,KAAK,WAAW,EAAE;AACtD,UAAM,KAAK,OAAO;AAClB,WAAO;AAAA,MACN,IAAI,GAAG;AAAA,MACP,aAAa,GAAG,eAAe;AAAA,MAC/B,OAAO,GAAG,QAAQ,CAAC,GAAG,GAAG,KAAK,IAAI,CAAA;AAAA,MAClC,aAAa,GAAG,cACb,EAAE,kBAAkB,GAAG,YAAY,kBAAkB,qBAAqB,GAAG,YAAY,oBAAA,IACzF;AAAA,MACH,UAAU,GAAG,SAAS,IAAI,CAAA,QAAO;AAAA,QAChC,MAAM,GAAG,QAAQ;AAAA,QACjB,MAAM,GAAG,QAAQ;AAAA,QACjB,OAAO,GAAG,YAAY,IAAI,CAAA,MAAK,EAAE,IAAI;AAAA,MAAA,EACpC;AAAA,IAAA;AAAA,EAEJ;AACD;;"}