@contember/cli 2.1.0-rc.3 → 2.2.0-alpha.10

package/dist/types/lib/tenant/clients/TenantMemberClient.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"TenantMemberClient.d.ts","sourceRoot":"","sources":["../../../../../src/lib/tenant/clients/TenantMemberClient.ts"],"names":[],"mappings":"AACA,OAAO,EAKN,KAAK,aAAa,EAIlB,KAAK,eAAe,EAKpB,KAAK,oBAAoB,EAIzB,KAAK,sBAAsB,EAI3B,MAAM,kCAAkC,CAAA;AACzC,OAAO,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAA;AAE7D,MAAM,WAAW,wBAAwB;IACxC,IAAI,EAAE,MAAM,CAAA;IACZ,MAAM,EAAE,MAAM,EAAE,CAAA;CAChB;AAED,MAAM,WAAW,gBAAgB;IAChC,IAAI,EAAE,MAAM,CAAA;IACZ,SAAS,EAAE,wBAAwB,EAAE,CAAA;CACrC;AAED,2GAA2G;AAC3G,MAAM,WAAW,mBAAmB;IACnC,UAAU,EAAE,MAAM,CAAA;IAClB,yDAAyD;IACzD,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAA;IACvB,KAAK,EAAE,MAAM,GAAG,IAAI,CAAA;IACpB,IAAI,EAAE,MAAM,GAAG,IAAI,CAAA;IACnB,0EAA0E;IAC1E,WAAW,EAAE,MAAM,GAAG,IAAI,CAAA;IAC1B,WAAW,EAAE,gBAAgB,EAAE,CAAA;CAC/B;AAED,MAAM,WAAW,sBAAsB;IACtC,MAAM,CAAC,EAAE,oBAAoB,CAAA;IAC7B,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,MAAM,CAAC,EAAE,MAAM,CAAA;CACf;AAED,MAAM,WAAW,UAAU;IAC1B,WAAW,EAAE,MAAM,CAAA;IACnB,KAAK,EAAE,MAAM,CAAA;IACb,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,WAAW,EAAE,SAAS,eAAe,EAAE,CAAA;IACvC,OAAO,CAAC,EAAE,aAAa,CAAA;CACvB;AAED,MAAM,WAAW,mBAAmB;IACnC,WAAW,EAAE,MAAM,CAAA;IACnB,KAAK,EAAE,MAAM,CAAA;IACb,WAAW,EAAE,SAAS,eAAe,EAAE,CAAA;IACvC,OAAO,CAAC,EAAE,sBAAsB,CAAA;CAChC;AAED,MAAM,WAAW,kBAAkB;IAClC,QAAQ,EAAE,MAAM,CAAA;IAChB,UAAU,EAAE,MAAM,CAAA;IAClB,KAAK,EAAE,MAAM,GAAG,IAAI,CAAA;IACpB,IAAI,EAAE,MAAM,GAAG,IAAI,CAAA;IACnB,+EAA+E;IAC/E,KAAK,EAAE,OAAO,CAAA;CACd;AAkCD,uCAAuC;AACvC,qBAAa,kBAAkB;IAE7B,OAAO,CAAC,QAAQ,CAAC,SAAS;IAD3B,YACkB,SAAS,EAAE,kBAAkB,EAE9C;IAEY,sBAAsB,CAAC,WAAW,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,EAAE,CAAC,CAGxG;IAED;;;OAGG;IACU,kBAAkB,CAAC,WAAW,EAAE,MAAM,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,GAAE,sBAA2B,GAAG,OAAO,CAAC,mBAAmB,EAAE,CAAC,CAkB3I;IAED,4EAA4E;IAC/D,MAAM,CAAC,EAAE,WAAW,EAAE,KAAK,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,EAAE,UAAU,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAG/G;IAED,oGAAoG;IACvF,eAAe,CAAC,EAAE,WAAW,EAAE,KAAK,EAAE,WAAW,EAAE,OAAO,EAAE,EAAE,mBAAmB,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAG3H;IAEY,gBAAgB,CAAC,WAAW,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,WAAW,EAAE,SAAS,eAAe,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAG7H;IAED,uFAAuF;IAC1E,mBAAmB,CAAC,WAAW,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,WAAW,EAAE,SAAS,eAAe,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAGhI;IAEY,mBAAmB,CAAC,WAAW,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAGvF;IAED,OAAO,CAAC,cAAc;CAmBtB"}

package/dist/types/lib/tenant/clients/TenantPersonClient.d.ts

@@ -0,0 +1,97 @@
+import { type CreateResetPasswordRequestOptions, type PersonsFilter, type SignInOptions } from '@contember/graphql-client-tenant';
+import { TenantApiTransport } from '../TenantApiTransport.js';
+export interface TenantPerson {
+    id: string;
+    identityId: string;
+    email: string | null;
+    name: string | null;
+    otpEnabled: boolean;
+    emailOtpEnabled: boolean;
+    emailVerified: boolean;
+}
+export interface TenantPersonSession {
+    id: string;
+    createdAt: string;
+    expiresAt: string | null;
+    lastUsedAt: string | null;
+    lastIp: string | null;
+    lastUserAgent: string | null;
+    createdIp: string | null;
+    createdUserAgent: string | null;
+    isCurrent: boolean;
+    trustForwardedClientInfo: boolean;
+}
+export interface TenantPersonIdentityProvider {
+    id: string;
+    slug: string;
+    type: string;
+    externalIdentifier: string;
+    createdAt: string;
+}
+/**
+ * Everything `personById` exposes about a single person. `roles` is null when the caller may not read
+ * them, and `sessions` / `identityProviders` come back empty (never an error) for the same reason.
+ */
+export interface TenantPersonDetail extends TenantPerson {
+    passwordlessEnabled: boolean | null;
+    roles: string[] | null;
+    sessions: TenantPersonSession[];
+    identityProviders: TenantPersonIdentityProvider[];
+}
+export interface ListPersonsArgs {
+    filter?: PersonsFilter;
+    limit?: number;
+    offset?: number;
+}
+export interface SignUpPersonArgs {
+    email: string;
+    /** Plaintext password. Mutually exclusive with {@link passwordHash}; omit both to create a person without one. */
+    password?: string;
+    /** Pre-computed bcrypt hash — the tenant API accepts `$2b$` only. */
+    passwordHash?: string;
+    name?: string;
+    roles?: readonly string[];
+    captchaToken?: string;
+}
+export interface CreateSessionTokenArgs {
+    email?: string;
+    personId?: string;
+    expiration?: number;
+    options?: SignInOptions;
+}
+export interface TenantCreatedSessionToken {
+    token: string;
+    personId: string;
+    identityId: string;
+    email: string | null;
+    name: string | null;
+}
+export interface ChangeProfileArgs {
+    email?: string;
+    name?: string;
+}
+/** Persons, their global identity roles and their sessions. */
+export declare class TenantPersonClient {
+    private readonly transport;
+    constructor(transport: TenantApiTransport);
+    listPersons({ filter, limit, offset }?: ListPersonsArgs): Promise<TenantPerson[]>;
+    /** Null both when the person does not exist and when the caller may not see them — the API does not distinguish. */
+    getPerson(id: string): Promise<TenantPersonDetail | null>;
+    /**
+     * Creates a person through `signUp`. Needs the `PERSON_SIGN_UP` permission, consumes the tenant's
+     * per-IP sign-up rate limit and triggers the verification mail when the tenant requires it.
+     */
+    signUp({ email, password, passwordHash, name, roles, captchaToken }: SignUpPersonArgs): Promise<TenantPerson>;
+    changeProfile(personId: string, { email, name }: ChangeProfileArgs): Promise<void>;
+    changePassword(personId: string, password: string): Promise<void>;
+    disablePerson(personId: string): Promise<void>;
+    forceSignOutPerson(personId: string, reason?: string): Promise<void>;
+    resetPersonMfa(personId: string): Promise<void>;
+    createResetPasswordRequest(email: string, options?: CreateResetPasswordRequestOptions, captchaToken?: string): Promise<void>;
+    createSessionToken({ email, personId, expiration, options }: CreateSessionTokenArgs): Promise<TenantCreatedSessionToken>;
+    /** Returns the identity's roles after the change, or null when the caller may not read them. */
+    addGlobalIdentityRoles(identityId: string, roles: readonly string[]): Promise<string[] | null>;
+    /** Returns the identity's roles after the change, or null when the caller may not read them. */
+    removeGlobalIdentityRoles(identityId: string, roles: readonly string[]): Promise<string[] | null>;
+}
+//# sourceMappingURL=TenantPersonClient.d.ts.map

package/dist/types/lib/tenant/clients/TenantPersonClient.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"TenantPersonClient.d.ts","sourceRoot":"","sources":["../../../../../src/lib/tenant/clients/TenantPersonClient.ts"],"names":[],"mappings":"AACA,OAAO,EAUN,KAAK,iCAAiC,EAatC,KAAK,aAAa,EAQlB,KAAK,aAAa,EAIlB,MAAM,kCAAkC,CAAA;AACzC,OAAO,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAA;AAE7D,MAAM,WAAW,YAAY;IAC5B,EAAE,EAAE,MAAM,CAAA;IACV,UAAU,EAAE,MAAM,CAAA;IAClB,KAAK,EAAE,MAAM,GAAG,IAAI,CAAA;IACpB,IAAI,EAAE,MAAM,GAAG,IAAI,CAAA;IACnB,UAAU,EAAE,OAAO,CAAA;IACnB,eAAe,EAAE,OAAO,CAAA;IACxB,aAAa,EAAE,OAAO,CAAA;CACtB;AAED,MAAM,WAAW,mBAAmB;IACnC,EAAE,EAAE,MAAM,CAAA;IACV,SAAS,EAAE,MAAM,CAAA;IACjB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAA;IACxB,UAAU,EAAE,MAAM,GAAG,IAAI,CAAA;IACzB,MAAM,EAAE,MAAM,GAAG,IAAI,CAAA;IACrB,aAAa,EAAE,MAAM,GAAG,IAAI,CAAA;IAC5B,SAAS,EAAE,MAAM,GAAG,IAAI,CAAA;IACxB,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAA;IAC/B,SAAS,EAAE,OAAO,CAAA;IAClB,wBAAwB,EAAE,OAAO,CAAA;CACjC;AAED,MAAM,WAAW,4BAA4B;IAC5C,EAAE,EAAE,MAAM,CAAA;IACV,IAAI,EAAE,MAAM,CAAA;IACZ,IAAI,EAAE,MAAM,CAAA;IACZ,kBAAkB,EAAE,MAAM,CAAA;IAC1B,SAAS,EAAE,MAAM,CAAA;CACjB;AAED;;;GAGG;AACH,MAAM,WAAW,kBAAmB,SAAQ,YAAY;IACvD,mBAAmB,EAAE,OAAO,GAAG,IAAI,CAAA;IACnC,KAAK,EAAE,MAAM,EAAE,GAAG,IAAI,CAAA;IACtB,QAAQ,EAAE,mBAAmB,EAAE,CAAA;IAC/B,iBAAiB,EAAE,4BAA4B,EAAE,CAAA;CACjD;AAED,MAAM,WAAW,eAAe;IAC/B,MAAM,CAAC,EAAE,aAAa,CAAA;IACtB,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,MAAM,CAAC,EAAE,MAAM,CAAA;CACf;AAED,MAAM,WAAW,gBAAgB;IAChC,KAAK,EAAE,MAAM,CAAA;IACb,kHAAkH;IAClH,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,qEAAqE;IACrE,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,KAAK,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;IACzB,YAAY,CAAC,EAAE,MAAM,CAAA;CACrB;AAED,MAAM,WAAW,sBAAsB;IACtC,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,OAAO,CAAC,EAAE,aAAa,CAAA;CACvB;AAED,MAAM,WAAW,yBAAyB;IACzC,KAAK,EAAE,MAAM,CAAA;IACb,QAAQ,EAAE,MAAM,CAAA;IAChB,UAAU,EAAE,MAAM,CAAA;IAClB,KAAK,EAAE,MAAM,GAAG,IAAI,CAAA;IACpB,IAAI,EAAE,MAAM,GAAG,IAAI,CAAA;CACnB;AAED,MAAM,WAAW,iBAAiB;IACjC,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,IAAI,CAAC,EAAE,MAAM,CAAA;CACb;AAuDD,+DAA+D;AAC/D,qBAAa,kBAAkB;IAE7B,OAAO,CAAC,QAAQ,CAAC,SAAS;IAD3B,YACkB,SAAS,EAAE,kBAAkB,EAE9C;IAEY,WAAW,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,GAAE,eAAoB,GAAG,OAAO,CAAC,YAAY,EAAE,CAAC,CAWjG;IAED,oHAAoH;IACvG,SAAS,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,GAAG,IAAI,CAAC,CA8BrE;IAED;;;OAGG;IACU,MAAM,CAAC,EAAE,KAAK,EAAE,QAAQ,EAAE,YAAY,EAAE,IAAI,EAAE,KAAK,EAAE,YAAY,EAAE,EAAE,gBAAgB,GAAG,OAAO,CAAC,YAAY,CAAC,CAWzH;IAEY,aAAa,CAAC,QAAQ,EAAE,MAAM,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE,iBAAiB,GAAG,OAAO,CAAC,IAAI,CAAC,CAG9F;IAEY,cAAc,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAG7E;IAEY,aAAa,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAG1D;IAEY,kBAAkB,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAGhF;IAEY,cAAc,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAG3D;IAEY,0BAA0B,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,iCAAiC,EAAE,YAAY,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAGxI;IAEY,kBAAkB,CAAC,EAAE,KAAK,EAAE,QAAQ,EAAE,UAAU,EAAE,OAAO,EAAE,EAAE,sBAAsB,GAAG,OAAO,CAAC,yBAAyB,CAAC,CAiBpI;IAED,gGAAgG;IACnF,sBAAsB,CAAC,UAAU,EAAE,MAAM,EAAE,KAAK,EAAE,SAAS,MAAM,EAAE,GAAG,OAAO,CAAC,MAAM,EAAE,GAAG,IAAI,CAAC,CAK1G;IAED,gGAAgG;IACnF,yBAAyB,CAAC,UAAU,EAAE,MAAM,EAAE,KAAK,EAAE,SAAS,MAAM,EAAE,GAAG,OAAO,CAAC,MAAM,EAAE,GAAG,IAAI,CAAC,CAK7G;CACD"}

package/dist/types/lib/tenant/clients/TenantPolicyClient.d.ts

@@ -0,0 +1,75 @@
+import { type AuthLogFilter, type AuthPolicyInput, type AuthPolicyScope, type MailTemplateIdentifier, type MailType } from '@contember/graphql-client-tenant';
+import { TenantApiTransport } from '../TenantApiTransport.js';
+import { TenantCustomRoleConfig, TenantMailTemplate } from '../tenantConfig.js';
+/** A policy as it exists server-side. The config-side counterpart is `TenantAuthPolicy` in `tenantConfig.ts`. */
+export interface RemoteAuthPolicy {
+    id: string;
+    scope: AuthPolicyScope;
+    /** Project slug, `null` for a global policy. */
+    project: string | null;
+    roles: string[];
+    mfaRequired: boolean | null;
+    /** ISO 8601 duration, e.g. `PT1H`. */
+    tokenExpiration: string | null;
+    idleTimeout: string | null;
+    mfaGraceDuration: string | null;
+    rememberMeAllowed: boolean | null;
+}
+export interface TenantMailTemplateData {
+    projectSlug: string | null;
+    type: MailType;
+    variant: string | null;
+    subject: string;
+    content: string;
+    useLayout: boolean;
+    replyTo: string | null;
+}
+export interface TenantAuthLogEntry {
+    id: string;
+    createdAt: string;
+    type: string;
+    success: boolean;
+    invokedByIdentityId: string | null;
+    personId: string | null;
+    targetPersonId: string | null;
+    personInputIdentifier: string | null;
+    errorCode: string | null;
+    errorMessage: string | null;
+    ipAddress: string | null;
+    userAgent: string | null;
+    identityProviderId: string | null;
+    metadata: unknown;
+    eventData: unknown;
+}
+export interface TenantAuthLogPage {
+    entries: TenantAuthLogEntry[];
+    /** True when more rows exist past `offset + entries.length`. */
+    hasMore: boolean;
+}
+export interface ReadAuthLogArgs {
+    filter?: AuthLogFilter;
+    limit?: number;
+    offset?: number;
+}
+export interface RemoteCustomRole {
+    slug: string;
+}
+/** Auth policies, mail templates, custom roles and the auth log. */
+export declare class TenantPolicyClient {
+    private readonly transport;
+    constructor(transport: TenantApiTransport);
+    listAuthPolicies(): Promise<RemoteAuthPolicy[]>;
+    /** Returns the id of the created policy — the only thing `createAuthPolicy` hands back. */
+    createAuthPolicy(policy: AuthPolicyInput): Promise<string>;
+    updateAuthPolicy(id: string, policy: AuthPolicyInput): Promise<void>;
+    deleteAuthPolicy(id: string): Promise<void>;
+    listMailTemplates(): Promise<TenantMailTemplateData[]>;
+    addMailTemplate(template: TenantMailTemplate): Promise<void>;
+    /** A template is addressed by the `projectSlug`/`type`/`variant` triple — it has no id of its own. */
+    removeMailTemplate(templateIdentifier: MailTemplateIdentifier): Promise<void>;
+    listCustomRoles(): Promise<RemoteCustomRole[]>;
+    createCustomRole(slug: string, role: TenantCustomRoleConfig): Promise<void>;
+    updateCustomRole(slug: string, role: TenantCustomRoleConfig): Promise<void>;
+    readAuthLog({ filter, limit, offset }?: ReadAuthLogArgs): Promise<TenantAuthLogPage>;
+}
+//# sourceMappingURL=TenantPolicyClient.d.ts.map

package/dist/types/lib/tenant/clients/TenantPolicyClient.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"TenantPolicyClient.d.ts","sourceRoot":"","sources":["../../../../../src/lib/tenant/clients/TenantPolicyClient.ts"],"names":[],"mappings":"AACA,OAAO,EAIN,KAAK,aAAa,EAGlB,KAAK,eAAe,EACpB,KAAK,eAAe,EAUpB,KAAK,sBAAsB,EAC3B,KAAK,QAAQ,EASb,MAAM,kCAAkC,CAAA;AAEzC,OAAO,EAAE,kBAAkB,EAAwB,MAAM,0BAA0B,CAAA;AACnF,OAAO,EAAE,sBAAsB,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAA;AAE/E,iHAAiH;AACjH,MAAM,WAAW,gBAAgB;IAChC,EAAE,EAAE,MAAM,CAAA;IACV,KAAK,EAAE,eAAe,CAAA;IACtB,gDAAgD;IAChD,OAAO,EAAE,MAAM,GAAG,IAAI,CAAA;IACtB,KAAK,EAAE,MAAM,EAAE,CAAA;IACf,WAAW,EAAE,OAAO,GAAG,IAAI,CAAA;IAC3B,sCAAsC;IACtC,eAAe,EAAE,MAAM,GAAG,IAAI,CAAA;IAC9B,WAAW,EAAE,MAAM,GAAG,IAAI,CAAA;IAC1B,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAA;IAC/B,iBAAiB,EAAE,OAAO,GAAG,IAAI,CAAA;CACjC;AAED,MAAM,WAAW,sBAAsB;IACtC,WAAW,EAAE,MAAM,GAAG,IAAI,CAAA;IAC1B,IAAI,EAAE,QAAQ,CAAA;IACd,OAAO,EAAE,MAAM,GAAG,IAAI,CAAA;IACtB,OAAO,EAAE,MAAM,CAAA;IACf,OAAO,EAAE,MAAM,CAAA;IACf,SAAS,EAAE,OAAO,CAAA;IAClB,OAAO,EAAE,MAAM,GAAG,IAAI,CAAA;CACtB;AAED,MAAM,WAAW,kBAAkB;IAClC,EAAE,EAAE,MAAM,CAAA;IACV,SAAS,EAAE,MAAM,CAAA;IACjB,IAAI,EAAE,MAAM,CAAA;IACZ,OAAO,EAAE,OAAO,CAAA;IAChB,mBAAmB,EAAE,MAAM,GAAG,IAAI,CAAA;IAClC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAA;IACvB,cAAc,EAAE,MAAM,GAAG,IAAI,CAAA;IAC7B,qBAAqB,EAAE,MAAM,GAAG,IAAI,CAAA;IACpC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAA;IACxB,YAAY,EAAE,MAAM,GAAG,IAAI,CAAA;IAC3B,SAAS,EAAE,MAAM,GAAG,IAAI,CAAA;IACxB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAA;IACxB,kBAAkB,EAAE,MAAM,GAAG,IAAI,CAAA;IACjC,QAAQ,EAAE,OAAO,CAAA;IACjB,SAAS,EAAE,OAAO,CAAA;CAClB;AAED,MAAM,WAAW,iBAAiB;IACjC,OAAO,EAAE,kBAAkB,EAAE,CAAA;IAC7B,gEAAgE;IAChE,OAAO,EAAE,OAAO,CAAA;CAChB;AAED,MAAM,WAAW,eAAe;IAC/B,MAAM,CAAC,EAAE,aAAa,CAAA;IACtB,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,MAAM,CAAC,EAAE,MAAM,CAAA;CACf;AAED,MAAM,WAAW,gBAAgB;IAChC,IAAI,EAAE,MAAM,CAAA;CACZ;AAgCD,oEAAoE;AACpE,qBAAa,kBAAkB;IAE7B,OAAO,CAAC,QAAQ,CAAC,SAAS;IAD3B,YACkB,SAAS,EAAE,kBAAkB,EAE9C;IAEY,gBAAgB,IAAI,OAAO,CAAC,gBAAgB,EAAE,CAAC,CAa3D;IAED,2FAA2F;IAC9E,gBAAgB,CAAC,MAAM,EAAE,eAAe,GAAG,OAAO,CAAC,MAAM,CAAC,CAatE;IAEY,gBAAgB,CAAC,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,eAAe,GAAG,OAAO,CAAC,IAAI,CAAC,CAGhF;IAEY,gBAAgB,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAGvD;IAEY,iBAAiB,IAAI,OAAO,CAAC,sBAAsB,EAAE,CAAC,CAWlE;IAEY,eAAe,CAAC,QAAQ,EAAE,kBAAkB,GAAG,OAAO,CAAC,IAAI,CAAC,CAGxE;IAED,sGAAsG;IACzF,kBAAkB,CAAC,kBAAkB,EAAE,sBAAsB,GAAG,OAAO,CAAC,IAAI,CAAC,CAGzF;IAEY,eAAe,IAAI,OAAO,CAAC,gBAAgB,EAAE,CAAC,CAG1D;IAEY,gBAAgB,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,sBAAsB,GAAG,OAAO,CAAC,IAAI,CAAC,CAOvF;IAEY,gBAAgB,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,sBAAsB,GAAG,OAAO,CAAC,IAAI,CAAC,CASvF;IAEY,WAAW,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,GAAE,eAAoB,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAsBpG;CACD"}

package/dist/types/lib/tenant/clients/TenantProjectClient.d.ts

@@ -0,0 +1,162 @@
+import { type CaptchaProvider, type ConfigPolicy } from '@contember/graphql-client-tenant';
+import { TenantApiTransport } from '../TenantApiTransport.js';
+import { TenantGlobalConfig, TenantIdpOptions } from '../tenantConfig.js';
+export interface RemoteIdentityProvider {
+    slug: string;
+    type: string;
+    disabledAt: string | null;
+}
+export interface TenantProjectSummary {
+    id: string;
+    name: string;
+    slug: string;
+}
+export interface TenantProjectRole {
+    name: string;
+    /** Variable names the role expects, retained for compatibility. */
+    variables: string[];
+    variableDefinitions: TenantProjectRoleVariableDefinition[];
+}
+export type TenantProjectRoleVariableDefinition = {
+    type: 'entity';
+    name: string;
+    entityName: string;
+} | {
+    type: 'predefined';
+    name: string;
+    value: string;
+} | {
+    type: 'condition';
+    name: string;
+};
+export interface TenantProjectSecret {
+    key: string;
+    createdAt: string;
+    updatedAt: string;
+}
+export interface TenantProjectDetail {
+    id: string;
+    name: string;
+    slug: string;
+    config: unknown;
+    roles: TenantProjectRole[];
+    secrets: TenantProjectSecret[];
+}
+export interface TenantCreateProjectDetails {
+    name?: string;
+    config?: unknown;
+    /** Skip issuing a deploy API key for the project. */
+    noDeployToken?: boolean;
+}
+export interface TenantCreateProjectResult {
+    /** Null when {@link TenantCreateProjectDetails.noDeployToken} was requested. */
+    deployerApiKey: {
+        id: string;
+        token: string | null;
+    } | null;
+}
+export interface TenantUpdateProjectChanges {
+    name?: string;
+    config?: unknown;
+    mergeConfig?: boolean;
+}
+export interface TenantRateLimitWindowState {
+    limit: number;
+    window: string;
+}
+/** The tenant-wide configuration returned by `Query.configuration` — the read side of {@link TenantGlobalConfig}. */
+export interface TenantConfigState {
+    signup: {
+        requireEmailVerification: boolean;
+    };
+    emailChange: {
+        requireVerification: boolean;
+    };
+    passwordless: {
+        enabled: ConfigPolicy;
+        url: string | null;
+        expiration: string;
+    };
+    password: {
+        minLength: number;
+        requireUppercase: number;
+        requireLowercase: number;
+        requireDigit: number;
+        requireSpecial: number;
+        pattern: string | null;
+        checkBlacklist: boolean;
+        checkHibp: boolean;
+    };
+    login: {
+        baseBackoff: string;
+        maxBackoff: string;
+        attemptWindow: string;
+        revealUserExists: boolean;
+        revealLoginMethod: boolean;
+        defaultTokenExpiration: string;
+        maxTokenExpiration: string | null;
+        mfaGraceDuration: string;
+        anomalyDetection: {
+            enabled: boolean;
+            historySize: number;
+            emailThreshold: number;
+            stepUpThreshold: number;
+        };
+    };
+    captcha: {
+        provider: CaptchaProvider | null;
+        threshold: number | null;
+        protect: {
+            signUp: boolean;
+            passwordReset: boolean;
+            passwordlessInit: boolean;
+            emailVerification: boolean;
+        };
+    };
+    rateLimits: {
+        signUpPerIp: TenantRateLimitWindowState;
+        loginPerIp: TenantRateLimitWindowState;
+        passwordResetPerIp: TenantRateLimitWindowState;
+        passwordlessInitPerIp: TenantRateLimitWindowState;
+        emailOtpPerPerson: TenantRateLimitWindowState;
+        emailVerificationPerIp: TenantRateLimitWindowState;
+    };
+}
+export interface TenantWhoAmIProject {
+    slug: string;
+    name: string;
+    roles: string[];
+}
+/** `Query.me` — the identity behind the token the CLI is using. */
+export interface TenantWhoAmI {
+    id: string;
+    description: string | null;
+    /** Global (tenant-wide) roles — empty for an identity whose access is entirely project-scoped. */
+    roles: string[];
+    permissions: {
+        canCreateProject: boolean;
+        canDeployEntrypoint: boolean;
+    } | null;
+    projects: TenantWhoAmIProject[];
+}
+/** Projects, project secrets, global tenant configuration, identity providers and `me`. */
+export declare class TenantProjectClient {
+    private readonly transport;
+    constructor(transport: TenantApiTransport);
+    listProjects(): Promise<TenantProjectSummary[]>;
+    /** Null both when the project does not exist and when the caller may not see it — the API does not distinguish. */
+    getProjectBySlug(slug: string): Promise<TenantProjectDetail | null>;
+    /** Returns `null` (nothing created) when `ignoreExisting` swallowed an `ALREADY_EXISTS`. */
+    createProject(slug: string, ignoreExisting?: boolean, details?: TenantCreateProjectDetails): Promise<TenantCreateProjectResult | null>;
+    updateProject(slug: string, changes: TenantUpdateProjectChanges): Promise<void>;
+    setProjectSecret(slug: string, key: string, value: string): Promise<void>;
+    configure(config: TenantGlobalConfig): Promise<void>;
+    configuration(): Promise<TenantConfigState>;
+    listIdentityProviders(): Promise<RemoteIdentityProvider[]>;
+    addIdp(slug: string, type: string, configuration: unknown, options?: TenantIdpOptions): Promise<void>;
+    updateIdp(slug: string, type: string, configuration: unknown, options?: TenantIdpOptions): Promise<void>;
+    enableIdp(slug: string): Promise<void>;
+    disableIdp(slug: string): Promise<void>;
+    whoAmI(): Promise<TenantWhoAmI>;
+}
+//# sourceMappingURL=TenantProjectClient.d.ts.map

package/dist/types/lib/tenant/clients/TenantProjectClient.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"TenantProjectClient.d.ts","sourceRoot":"","sources":["../../../../../src/lib/tenant/clients/TenantProjectClient.ts"],"names":[],"mappings":"AAAA,OAAO,EAIN,KAAK,eAAe,EASpB,KAAK,YAAY,EAiCjB,MAAM,kCAAkC,CAAA;AAGzC,OAAO,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAA;AAC7D,OAAO,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAA;AAEzE,MAAM,WAAW,sBAAsB;IACtC,IAAI,EAAE,MAAM,CAAA;IACZ,IAAI,EAAE,MAAM,CAAA;IACZ,UAAU,EAAE,MAAM,GAAG,IAAI,CAAA;CACzB;AAED,MAAM,WAAW,oBAAoB;IACpC,EAAE,EAAE,MAAM,CAAA;IACV,IAAI,EAAE,MAAM,CAAA;IACZ,IAAI,EAAE,MAAM,CAAA;CACZ;AAED,MAAM,WAAW,iBAAiB;IACjC,IAAI,EAAE,MAAM,CAAA;IACZ,mEAAmE;IACnE,SAAS,EAAE,MAAM,EAAE,CAAA;IACnB,mBAAmB,EAAE,mCAAmC,EAAE,CAAA;CAC1D;AAED,MAAM,MAAM,mCAAmC,GAC5C;IAAE,IAAI,EAAE,QAAQ,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,CAAA;CAAE,GACpD;IAAE,IAAI,EAAE,YAAY,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,GACnD;IAAE,IAAI,EAAE,WAAW,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAAA;AAEtC,MAAM,WAAW,mBAAmB;IACnC,GAAG,EAAE,MAAM,CAAA;IACX,SAAS,EAAE,MAAM,CAAA;IACjB,SAAS,EAAE,MAAM,CAAA;CACjB;AAED,MAAM,WAAW,mBAAmB;IACnC,EAAE,EAAE,MAAM,CAAA;IACV,IAAI,EAAE,MAAM,CAAA;IACZ,IAAI,EAAE,MAAM,CAAA;IACZ,MAAM,EAAE,OAAO,CAAA;IACf,KAAK,EAAE,iBAAiB,EAAE,CAAA;IAC1B,OAAO,EAAE,mBAAmB,EAAE,CAAA;CAC9B;AAED,MAAM,WAAW,0BAA0B;IAC1C,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,MAAM,CAAC,EAAE,OAAO,CAAA;IAChB,qDAAqD;IACrD,aAAa,CAAC,EAAE,OAAO,CAAA;CACvB;AAED,MAAM,WAAW,yBAAyB;IACzC,gFAAgF;IAChF,cAAc,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,GAAG,IAAI,CAAA;CAC3D;AAED,MAAM,WAAW,0BAA0B;IAC1C,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,MAAM,CAAC,EAAE,OAAO,CAAA;IAChB,WAAW,CAAC,EAAE,OAAO,CAAA;CACrB;AAED,MAAM,WAAW,0BAA0B;IAC1C,KAAK,EAAE,MAAM,CAAA;IACb,MAAM,EAAE,MAAM,CAAA;CACd;AAED,qHAAqH;AACrH,MAAM,WAAW,iBAAiB;IACjC,MAAM,EAAE;QAAE,wBAAwB,EAAE,OAAO,CAAA;KAAE,CAAA;IAC7C,WAAW,EAAE;QAAE,mBAAmB,EAAE,OAAO,CAAA;KAAE,CAAA;IAC7C,YAAY,EAAE;QAAE,OAAO,EAAE,YAAY,CAAC;QAAC,GAAG,EAAE,MAAM,GAAG,IAAI,CAAC;QAAC,UAAU,EAAE,MAAM,CAAA;KAAE,CAAA;IAC/E,QAAQ,EAAE;QACT,SAAS,EAAE,MAAM,CAAA;QACjB,gBAAgB,EAAE,MAAM,CAAA;QACxB,gBAAgB,EAAE,MAAM,CAAA;QACxB,YAAY,EAAE,MAAM,CAAA;QACpB,cAAc,EAAE,MAAM,CAAA;QACtB,OAAO,EAAE,MAAM,GAAG,IAAI,CAAA;QACtB,cAAc,EAAE,OAAO,CAAA;QACvB,SAAS,EAAE,OAAO,CAAA;KAClB,CAAA;IACD,KAAK,EAAE;QACN,WAAW,EAAE,MAAM,CAAA;QACnB,UAAU,EAAE,MAAM,CAAA;QAClB,aAAa,EAAE,MAAM,CAAA;QACrB,gBAAgB,EAAE,OAAO,CAAA;QACzB,iBAAiB,EAAE,OAAO,CAAA;QAC1B,sBAAsB,EAAE,MAAM,CAAA;QAC9B,kBAAkB,EAAE,MAAM,GAAG,IAAI,CAAA;QACjC,gBAAgB,EAAE,MAAM,CAAA;QACxB,gBAAgB,EAAE;YACjB,OAAO,EAAE,OAAO,CAAA;YAChB,WAAW,EAAE,MAAM,CAAA;YACnB,cAAc,EAAE,MAAM,CAAA;YACtB,eAAe,EAAE,MAAM,CAAA;SACvB,CAAA;KACD,CAAA;IACD,OAAO,EAAE;QACR,QAAQ,EAAE,eAAe,GAAG,IAAI,CAAA;QAChC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAA;QACxB,OAAO,EAAE;YACR,MAAM,EAAE,OAAO,CAAA;YACf,aAAa,EAAE,OAAO,CAAA;YACtB,gBAAgB,EAAE,OAAO,CAAA;YACzB,iBAAiB,EAAE,OAAO,CAAA;SAC1B,CAAA;KACD,CAAA;IACD,UAAU,EAAE;QACX,WAAW,EAAE,0BAA0B,CAAA;QACvC,UAAU,EAAE,0BAA0B,CAAA;QACtC,kBAAkB,EAAE,0BAA0B,CAAA;QAC9C,qBAAqB,EAAE,0BAA0B,CAAA;QACjD,iBAAiB,EAAE,0BAA0B,CAAA;QAC7C,sBAAsB,EAAE,0BAA0B,CAAA;KAClD,CAAA;CACD;AAED,MAAM,WAAW,mBAAmB;IACnC,IAAI,EAAE,MAAM,CAAA;IACZ,IAAI,EAAE,MAAM,CAAA;IACZ,KAAK,EAAE,MAAM,EAAE,CAAA;CACf;AAED,mEAAmE;AACnE,MAAM,WAAW,YAAY;IAC5B,EAAE,EAAE,MAAM,CAAA;IACV,WAAW,EAAE,MAAM,GAAG,IAAI,CAAA;IAC1B,kGAAkG;IAClG,KAAK,EAAE,MAAM,EAAE,CAAA;IACf,WAAW,EAAE;QAAE,gBAAgB,EAAE,OAAO,CAAC;QAAC,mBAAmB,EAAE,OAAO,CAAA;KAAE,GAAG,IAAI,CAAA;IAC/E,QAAQ,EAAE,mBAAmB,EAAE,CAAA;CAC/B;AAkED,2FAA2F;AAC3F,qBAAa,mBAAmB;IAE9B,OAAO,CAAC,QAAQ,CAAC,SAAS;IAD3B,YACkB,SAAS,EAAE,kBAAkB,EAE9C;IAEY,YAAY,IAAI,OAAO,CAAC,oBAAoB,EAAE,CAAC,CAG3D;IAED,mHAAmH;IACtG,gBAAgB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,mBAAmB,GAAG,IAAI,CAAC,CAkB/E;IAED,4FAA4F;IAC/E,aAAa,CAAC,IAAI,EAAE,MAAM,EAAE,cAAc,UAAQ,EAAE,OAAO,CAAC,EAAE,0BAA0B,GAAG,OAAO,CAAC,yBAAyB,GAAG,IAAI,CAAC,CAahJ;IAEY,aAAa,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,0BAA0B,GAAG,OAAO,CAAC,IAAI,CAAC,CAQ3F;IAEY,gBAAgB,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAGrF;IAEY,SAAS,CAAC,MAAM,EAAE,kBAAkB,GAAG,OAAO,CAAC,IAAI,CAAC,CAGhE;IAEY,aAAa,IAAI,OAAO,CAAC,iBAAiB,CAAC,CAwDvD;IAEY,qBAAqB,IAAI,OAAO,CAAC,sBAAsB,EAAE,CAAC,CAOtE;IAEY,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,aAAa,EAAE,OAAO,EAAE,OAAO,CAAC,EAAE,gBAAgB,GAAG,OAAO,CAAC,IAAI,CAAC,CAGjH;IAEY,SAAS,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,aAAa,EAAE,OAAO,EAAE,OAAO,CAAC,EAAE,gBAAgB,GAAG,OAAO,CAAC,IAAI,CAAC,CASpH;IAEY,SAAS,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAGlD;IAEY,UAAU,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAGnD;IAEY,MAAM,IAAI,OAAO,CAAC,YAAY,CAAC,CAgB3C;CACD"}

package/dist/types/lib/tenant/clients/index.d.ts

@@ -0,0 +1,21 @@
+import { TenantApiTransport } from '../TenantApiTransport.js';
+import { TenantApiKeyClient } from './TenantApiKeyClient.js';
+import { TenantMemberClient } from './TenantMemberClient.js';
+import { TenantPersonClient } from './TenantPersonClient.js';
+import { TenantPolicyClient } from './TenantPolicyClient.js';
+import { TenantProjectClient } from './TenantProjectClient.js';
+export * from './TenantApiKeyClient.js';
+export * from './TenantMemberClient.js';
+export * from './TenantPersonClient.js';
+export * from './TenantPolicyClient.js';
+export * from './TenantProjectClient.js';
+/** One instance of every tenant domain client, all sharing a single transport. */
+export interface TenantClients {
+    readonly project: TenantProjectClient;
+    readonly person: TenantPersonClient;
+    readonly member: TenantMemberClient;
+    readonly apiKey: TenantApiKeyClient;
+    readonly policy: TenantPolicyClient;
+}
+export declare const createTenantClients: (transport: TenantApiTransport) => TenantClients;
+//# sourceMappingURL=index.d.ts.map

package/dist/types/lib/tenant/clients/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../../src/lib/tenant/clients/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAA;AAC7D,OAAO,EAAE,kBAAkB,EAAE,MAAM,yBAAyB,CAAA;AAC5D,OAAO,EAAE,kBAAkB,EAAE,MAAM,yBAAyB,CAAA;AAC5D,OAAO,EAAE,kBAAkB,EAAE,MAAM,yBAAyB,CAAA;AAC5D,OAAO,EAAE,kBAAkB,EAAE,MAAM,yBAAyB,CAAA;AAC5D,OAAO,EAAE,mBAAmB,EAAE,MAAM,0BAA0B,CAAA;AAE9D,cAAc,yBAAyB,CAAA;AACvC,cAAc,yBAAyB,CAAA;AACvC,cAAc,yBAAyB,CAAA;AACvC,cAAc,yBAAyB,CAAA;AACvC,cAAc,0BAA0B,CAAA;AAExC,kFAAkF;AAClF,MAAM,WAAW,aAAa;IAC7B,QAAQ,CAAC,OAAO,EAAE,mBAAmB,CAAA;IACrC,QAAQ,CAAC,MAAM,EAAE,kBAAkB,CAAA;IACnC,QAAQ,CAAC,MAAM,EAAE,kBAAkB,CAAA;IACnC,QAAQ,CAAC,MAAM,EAAE,kBAAkB,CAAA;IACnC,QAAQ,CAAC,MAAM,EAAE,kBAAkB,CAAA;CACnC;AAED,eAAO,MAAM,mBAAmB,cAAe,kBAAkB,KAAG,aAMlE,CAAA"}

package/dist/types/lib/tenant/confirmation.d.ts

@@ -0,0 +1,14 @@
+import { Output } from '@contember/cli-common';
+export interface ConfirmationArgs {
+    readonly yes: boolean;
+    readonly output: Output;
+    /** What is about to happen, shown above the prompt. */
+    readonly warning: string;
+}
+/**
+ * The one destructive-action guard of the tenant commands. `--yes` skips the prompt; without a TTY there
+ * is nobody to answer it, so the run fails fast instead of hanging a CI job. Declining throws as well, so
+ * a caller never has to turn a boolean into an exit code and an agent always gets a typed error.
+ */
+export declare const requireConfirmation: ({ yes, output, warning }: ConfirmationArgs) => Promise<void>;
+//# sourceMappingURL=confirmation.d.ts.map

package/dist/types/lib/tenant/confirmation.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"confirmation.d.ts","sourceRoot":"","sources":["../../../../src/lib/tenant/confirmation.ts"],"names":[],"mappings":"AAAA,OAAO,EAAsB,MAAM,EAAE,MAAM,uBAAuB,CAAA;AAGlE,MAAM,WAAW,gBAAgB;IAChC,QAAQ,CAAC,GAAG,EAAE,OAAO,CAAA;IACrB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB,uDAAuD;IACvD,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;CACxB;AAED;;;;GAIG;AACH,eAAO,MAAM,mBAAmB,6BAAoC,gBAAgB,KAAG,OAAO,CAAC,IAAI,CAgBlG,CAAA"}

package/dist/types/lib/tenant/input/index.d.ts

@@ -0,0 +1,3 @@
+export * from './pagination.js';
+export * from './value.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/types/lib/tenant/input/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../../src/lib/tenant/input/index.ts"],"names":[],"mappings":"AAAA,cAAc,iBAAiB,CAAA;AAC/B,cAAc,YAAY,CAAA"}

package/dist/types/lib/tenant/input/pagination.d.ts

@@ -0,0 +1,7 @@
+/** GraphQL `Int` is a signed 32-bit integer. Pagination values are non-negative. */
+export declare const GRAPHQL_INT_MAX = 2147483647;
+/** Parses an optional non-negative integer pagination offset. */
+export declare const parsePaginationOffset: (value: string | undefined, flag?: string) => number | undefined;
+/** Parses an optional positive integer pagination limit. */
+export declare const parsePaginationLimit: (value: string | undefined, flag?: string) => number | undefined;
+//# sourceMappingURL=pagination.d.ts.map

package/dist/types/lib/tenant/input/pagination.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"pagination.d.ts","sourceRoot":"","sources":["../../../../../src/lib/tenant/input/pagination.ts"],"names":[],"mappings":"AAEA,oFAAoF;AACpF,eAAO,MAAM,eAAe,aAAgB,CAAA;AAE5C,iEAAiE;AACjE,eAAO,MAAM,qBAAqB,UAAW,MAAM,GAAG,SAAS,oBAAsB,MAAM,GAAG,SAC7C,CAAA;AAEjD,4DAA4D;AAC5D,eAAO,MAAM,oBAAoB,UAAW,MAAM,GAAG,SAAS,oBAAqB,MAAM,GAAG,SAC5C,CAAA"}

package/dist/types/lib/tenant/input/value.d.ts

@@ -0,0 +1,45 @@
+import { type StdinReader } from '../stdin.js';
+interface InputSourceBase<Name extends string> {
+    /** Identifies the semantic value, for example `password` or `password-hash`. */
+    readonly name: Name;
+    /** Identifies the selected option without including its submitted value. */
+    readonly flag: string;
+}
+export interface LiteralInputSource<Name extends string = string> extends InputSourceBase<Name> {
+    readonly kind: 'literal';
+    readonly value: string;
+}
+export interface EnvironmentInputSource<Name extends string = string> extends InputSourceBase<Name> {
+    readonly kind: 'environment';
+    readonly variable: string;
+}
+export interface StdinInputSource<Name extends string = string> extends InputSourceBase<Name> {
+    readonly kind: 'stdin';
+}
+/** One explicitly selected input source. Unselected options must not be included. */
+export type TenantInputSource<Name extends string = string> = LiteralInputSource<Name> | EnvironmentInputSource<Name> | StdinInputSource<Name>;
+export type TrailingLineEnding = 'preserve' | 'remove-one';
+export interface TenantInputOptions {
+    /** A non-sensitive description used in errors, for example `project secret`. */
+    readonly label: string;
+    readonly allowEmpty?: boolean;
+    readonly trailingLineEnding?: TrailingLineEnding;
+}
+export interface TenantInputDependencies {
+    readonly readStdin?: StdinReader;
+    readonly readEnvironment?: (name: string) => string | undefined;
+}
+export interface ResolvedTenantInput<Name extends string = string> {
+    readonly name: Name;
+    readonly kind: TenantInputSource<Name>['kind'];
+    readonly value: string;
+}
+export declare const literalInput: <Name extends string>(name: Name, flag: string, value: string) => LiteralInputSource<Name>;
+export declare const environmentInput: <Name extends string>(name: Name, flag: string, variable: string) => EnvironmentInputSource<Name>;
+export declare const stdinInput: <Name extends string>(name: Name, flag: string) => StdinInputSource<Name>;
+/** Resolves exactly one explicitly selected source. */
+export declare const resolveRequiredTenantInput: <Name extends string>(sources: readonly TenantInputSource<Name>[], options: TenantInputOptions, dependencies?: TenantInputDependencies) => Promise<ResolvedTenantInput<Name>>;
+/** Resolves at most one explicitly selected source without reading stdin when none was selected. */
+export declare const resolveOptionalTenantInput: <Name extends string>(sources: readonly TenantInputSource<Name>[], options: TenantInputOptions, dependencies?: TenantInputDependencies) => Promise<ResolvedTenantInput<Name> | undefined>;
+export {};
+//# sourceMappingURL=value.d.ts.map

package/dist/types/lib/tenant/input/value.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"value.d.ts","sourceRoot":"","sources":["../../../../../src/lib/tenant/input/value.ts"],"names":[],"mappings":"AACA,OAAO,EAAiB,KAAK,WAAW,EAAE,MAAM,aAAa,CAAA;AAE7D,UAAU,eAAe,CAAC,IAAI,SAAS,MAAM;IAC5C,gFAAgF;IAChF,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAA;IACnB,4EAA4E;IAC5E,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;CACrB;AAED,MAAM,WAAW,kBAAkB,CAAC,IAAI,SAAS,MAAM,GAAG,MAAM,CAAE,SAAQ,eAAe,CAAC,IAAI,CAAC;IAC9F,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAA;IACxB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;CACtB;AAED,MAAM,WAAW,sBAAsB,CAAC,IAAI,SAAS,MAAM,GAAG,MAAM,CAAE,SAAQ,eAAe,CAAC,IAAI,CAAC;IAClG,QAAQ,CAAC,IAAI,EAAE,aAAa,CAAA;IAC5B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;CACzB;AAED,MAAM,WAAW,gBAAgB,CAAC,IAAI,SAAS,MAAM,GAAG,MAAM,CAAE,SAAQ,eAAe,CAAC,IAAI,CAAC;IAC5F,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAA;CACtB;AAED,qFAAqF;AACrF,MAAM,MAAM,iBAAiB,CAAC,IAAI,SAAS,MAAM,GAAG,MAAM,IACvD,kBAAkB,CAAC,IAAI,CAAC,GACxB,sBAAsB,CAAC,IAAI,CAAC,GAC5B,gBAAgB,CAAC,IAAI,CAAC,CAAA;AAEzB,MAAM,MAAM,kBAAkB,GAAG,UAAU,GAAG,YAAY,CAAA;AAE1D,MAAM,WAAW,kBAAkB;IAClC,gFAAgF;IAChF,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;IACtB,QAAQ,CAAC,UAAU,CAAC,EAAE,OAAO,CAAA;IAC7B,QAAQ,CAAC,kBAAkB,CAAC,EAAE,kBAAkB,CAAA;CAChD;AAED,MAAM,WAAW,uBAAuB;IACvC,QAAQ,CAAC,SAAS,CAAC,EAAE,WAAW,CAAA;IAChC,QAAQ,CAAC,eAAe,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,MAAM,GAAG,SAAS,CAAA;CAC/D;AAED,MAAM,WAAW,mBAAmB,CAAC,IAAI,SAAS,MAAM,GAAG,MAAM;IAChE,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAA;IACnB,QAAQ,CAAC,IAAI,EAAE,iBAAiB,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,CAAA;IAC9C,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;CACtB;AAED,eAAO,MAAM,YAAY,GAAI,IAAI,SAAS,MAAM,QAAQ,IAAI,QAAQ,MAAM,SAAS,MAAM,KAAG,kBAAkB,CAAC,IAAI,CAKjH,CAAA;AAEF,eAAO,MAAM,gBAAgB,GAAI,IAAI,SAAS,MAAM,QAAQ,IAAI,QAAQ,MAAM,YAAY,MAAM,KAAG,sBAAsB,CAAC,IAAI,CAK5H,CAAA;AAEF,eAAO,MAAM,UAAU,GAAI,IAAI,SAAS,MAAM,QAAQ,IAAI,QAAQ,MAAM,KAAG,gBAAgB,CAAC,IAAI,CAI9F,CAAA;AAEF,uDAAuD;AACvD,eAAO,MAAM,0BAA0B,GAAU,IAAI,SAAS,MAAM,WAC1D,SAAS,iBAAiB,CAAC,IAAI,CAAC,EAAE,WAClC,kBAAkB,iBACb,uBAAuB,KACnC,OAAO,CAAC,mBAAmB,CAAC,IAAI,CAAC,CAGnC,CAAA;AAED,oGAAoG;AACpG,eAAO,MAAM,0BAA0B,GAAU,IAAI,SAAS,MAAM,WAC1D,SAAS,iBAAiB,CAAC,IAAI,CAAC,EAAE,WAClC,kBAAkB,iBACb,uBAAuB,KACnC,OAAO,CAAC,mBAAmB,CAAC,IAAI,CAAC,GAAG,SAAS,CAG/C,CAAA"}

package/dist/types/lib/tenant/stdin.d.ts

@@ -0,0 +1,8 @@
+/** Reads the whole stdin. Injected into the commands so a test never has to touch the real stream. */
+export type StdinReader = () => Promise<string>;
+/**
+ * Reads stdin to the end, verbatim. Only ever reached behind an explicit `--*-stdin` flag, so a normal
+ * run never blocks on it — a command that reads stdin "just in case" hangs every non-TTY caller.
+ */
+export declare const readStdinText: StdinReader;
+//# sourceMappingURL=stdin.d.ts.map

package/dist/types/lib/tenant/stdin.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"stdin.d.ts","sourceRoot":"","sources":["../../../../src/lib/tenant/stdin.ts"],"names":[],"mappings":"AAAA,sGAAsG;AACtG,MAAM,MAAM,WAAW,GAAG,MAAM,OAAO,CAAC,MAAM,CAAC,CAAA;AAE/C;;;GAGG;AACH,eAAO,MAAM,aAAa,EAAE,WAQ3B,CAAA"}

package/dist/types/lib/tenant/tenantConfig.d.ts

@@ -0,0 +1,148 @@
+import type { AuthPolicyInput, ConfigCaptchaInput, ConfigInput, ConfigLoginInput, ConfigPasswordInput, ConfigPasswordlessInput, ConfigRateLimitsInput, ConfigRateLimitWindowInput, IDPOptions, MailTemplate, MailType } from '@contember/graphql-client-tenant';
+export type { AuthPolicyScope, CaptchaProvider, ConfigPolicy, MailType } from '@contember/graphql-client-tenant';
+/**
+ * ISO 8601 duration string, e.g. `"P1D"` (1 day) or `"PT5M"` (5 minutes).
+ */
+export type Interval = string;
+export type TenantPasswordConfig = ConfigPasswordInput;
+export type TenantLoginConfig = ConfigLoginInput;
+export type TenantPasswordlessConfig = ConfigPasswordlessInput;
+/**
+ * `provider: null` disables captcha verification.
+ * `secret` is write-only: `null`/omitted leaves the stored value unchanged, `''` clears it.
+ */
+export type TenantCaptchaConfig = ConfigCaptchaInput;
+export type TenantRateLimitWindow = ConfigRateLimitWindowInput;
+export type TenantRateLimitsConfig = ConfigRateLimitsInput;
+/** Maps to the tenant `configure(config: ConfigInput!)` mutation. */
+export type TenantGlobalConfig = ConfigInput;
+export type TenantIdpOptions = IDPOptions;
+/**
+ * A single identity provider. The record key is used as the provider slug.
+ * `type` is the handler key registered on the server (built-in: `oidc`,
+ * `facebook`, `apple`).
+ *
+ * This is a CLI-specific composite — the `addIDP`/`updateIDP` mutations take
+ * `type`/`configuration`/`options` as separate arguments, not a single input.
+ */
+export interface TenantIdpConfig {
+    type: string;
+    configuration: Record<string, unknown>;
+    options?: TenantIdpOptions;
+    /** When `true`, the provider is disabled (kept, but not usable for sign-in). */
+    disabled?: boolean;
+}
+/** Maps to the `addMailTemplate(template: MailTemplate!)` mutation. */
+export type TenantMailTemplate = MailTemplate;
+/**
+ * A per-role MFA / session policy. `project` is a project slug, required for
+ * `scope: 'project'` and rejected for `scope: 'global'` (validated server-side).
+ *
+ * Unlike identity providers there is no server-side slug, so entries are matched
+ * against existing rows by `scope` + `project` + the `roles` **set** (order does
+ * not matter). Editing `roles` therefore reads as a different policy: a new row
+ * is created and the old one is left in place — see `TenantConfigApplier`.
+ */
+export type TenantAuthPolicy = AuthPolicyInput;
+export interface TenantCustomRoleRoleConstraint {
+    /** Exhaustive: every role observed at the constrained position must appear here. Not a filter, and there is no `denied` counterpart. */
+    readonly allowed: readonly string[];
+}
+export interface TenantCustomRoleTarget {
+    readonly globalRoles: TenantCustomRoleRoleConstraint;
+    readonly projectMemberships: 'none' | 'any';
+}
+export interface TenantCustomRoleRoleInputConfig {
+    readonly roles: TenantCustomRoleRoleConstraint;
+}
+export interface TenantCustomRoleTargetConfig {
+    readonly target: TenantCustomRoleTarget;
+}
+export interface TenantCustomRoleMutationConfig extends TenantCustomRoleRoleInputConfig, TenantCustomRoleTargetConfig {
+    readonly allowSelf: boolean;
+}
+export interface TenantCustomRoleGlobalApiKeyConfig extends TenantCustomRoleRoleInputConfig {
+    /** Custom roles may not create keys trusted to forward client info. */
+    readonly allowTrustForwardedClientInfo: false;
+}
+export interface TenantCustomRoleChangeProfileConfig extends TenantCustomRoleTargetConfig {
+    readonly fields: {
+        readonly allowed: readonly ('name' | 'email')[];
+    };
+}
+export interface TenantCustomRoleCreateSessionTokenConfig extends TenantCustomRoleTargetConfig {
+    readonly session: {
+        readonly maxExpirationMinutes: number;
+        readonly allowTrustForwardedClientInfo: boolean;
+    };
+}
+export interface TenantCustomRoleMailTemplateConfig {
+    readonly global: boolean;
+    readonly projects: readonly string[];
+    readonly types: readonly MailType[];
+}
+export type TenantCustomRoleConfigFreePermission = 'system:configure' | 'system:viewConfig' | 'system:viewAuthLog' | 'person:view' | 'person:list' | 'entrypoint:deployEntrypoint' | 'apiKey:list' | 'idp:disable' | 'idp:enable' | 'idp:list' | 'customRole:view' | 'identity:viewPermissions';
+export type TenantCustomRoleTargetPermission = 'person:disable' | 'person:forceSignOut' | 'person:resetMfa' | 'person:viewSessions' | 'person:viewIdp' | 'person:changePassword';
+export type TenantCustomRoleMutationPermission = 'identity:addGlobalRoles' | 'identity:removeGlobalRoles';
+export type TenantCustomRoleMailTemplatePermission = 'mailTemplate:add' | 'mailTemplate:remove' | 'mailTemplate:list';
+/**
+ * A custom-role grant discriminated by `permission`. Configured permissions
+ * require their exact action-specific config; config-free permissions reject it.
+ */
+export type TenantCustomRoleGrant = {
+    readonly permission: TenantCustomRoleConfigFreePermission;
+    readonly config?: never;
+} | {
+    readonly permission: 'person:signUp';
+    readonly config: TenantCustomRoleRoleInputConfig;
+} | {
+    readonly permission: TenantCustomRoleTargetPermission;
+    readonly config: TenantCustomRoleTargetConfig;
+} | {
+    readonly permission: 'person:changeProfile';
+    readonly config: TenantCustomRoleChangeProfileConfig;
+} | {
+    readonly permission: 'person:createSessionToken';
+    readonly config: TenantCustomRoleCreateSessionTokenConfig;
+} | {
+    readonly permission: TenantCustomRoleMutationPermission;
+    readonly config: TenantCustomRoleMutationConfig;
+} | {
+    readonly permission: 'apiKey:createGlobal';
+    readonly config: TenantCustomRoleGlobalApiKeyConfig;
+} | {
+    readonly permission: TenantCustomRoleMailTemplatePermission;
+    readonly config: TenantCustomRoleMailTemplateConfig;
+};
+export interface TenantCustomRoleConfig {
+    readonly description?: string | null;
+    readonly grants: readonly TenantCustomRoleGrant[];
+}
+/**
+ * Declarative tenant configuration. Applied idempotently by
+ * `contember tenant:apply`.
+ */
+export interface TenantConfig {
+    config?: TenantGlobalConfig;
+    /** Identity providers keyed by slug. */
+    identityProviders?: Record<string, TenantIdpConfig>;
+    mailTemplates?: TenantMailTemplate[];
+    authPolicies?: TenantAuthPolicy[];
+    /** Custom roles keyed by slug. Missing roles are created; existing roles are replaced. */
+    customRoles?: Record<string, TenantCustomRoleConfig>;
+}
+/**
+ * Type-safe helper for authoring a `tenant.config.ts`. Returns the config
+ * unchanged — it exists only to provide editor autocompletion and type
+ * checking.
+ *
+ * ```ts
+ * import { defineTenantConfig } from '@contember/cli'
+ *
+ * export default defineTenantConfig({
+ *   config: { password: { minLength: 8 } },
+ * })
+ * ```
+ */
+export declare const defineTenantConfig: (config: TenantConfig) => TenantConfig;
+//# sourceMappingURL=tenantConfig.d.ts.map