@contember/cli 2.2.0-alpha.2 → 2.2.0-alpha.4

package/dist/production/src/lib/tenant/clients/TenantApiKeyClient.cjs

@@ -0,0 +1,101 @@
+"use strict";
+Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+const TenantApi = require("@contember/graphql-client-tenant");
+const cliCommon = require("@contember/cli-common");
+const globalApiKeysFetcher = TenantApi.query$.globalApiKeys(TenantApi.apiKey$$.identity(TenantApi.identity$.id.roles));
+const projectApiKeysFetcher = TenantApi.query$.projectBySlug(
+  TenantApi.project$.apiKeys(
+    TenantApi.apiKey$$.identity(
+      TenantApi.identity$.id.projects(
+        TenantApi.identityProjectRelation$.project(TenantApi.project$.slug).memberships(TenantApi.membership$.role.variables(TenantApi.variableEntry$$))
+      )
+    )
+  )
+);
+const createApiKeyFetcher = TenantApi.mutation$.createApiKey(
+  TenantApi.createApiKeyResponse$$.error(TenantApi.createApiKeyError$$).result(TenantApi.createApiKeyResult$.apiKey(TenantApi.apiKeyWithToken$$))
+);
+const createGlobalApiKeyFetcher = TenantApi.mutation$.createGlobalApiKey(
+  TenantApi.createApiKeyResponse$$.error(TenantApi.createApiKeyError$$).result(TenantApi.createApiKeyResult$.apiKey(TenantApi.apiKeyWithToken$$))
+);
+const disableApiKeyFetcher = TenantApi.mutation$.disableApiKey(TenantApi.disableApiKeyResponse$$.error(TenantApi.disableApiKeyError$$));
+class TenantApiKeyClient {
+  constructor(transport) {
+    this.transport = transport;
+  }
+  async listGlobalApiKeys() {
+    const result = await this.transport.exec(globalApiKeysFetcher, {});
+    return result.globalApiKeys.map((it) => ({
+      ...toApiKey(it),
+      globalRoles: it.identity.roles ? [...it.identity.roles] : null
+    }));
+  }
+  async listProjectApiKeys(projectSlug) {
+    const result = await this.transport.exec(projectApiKeysFetcher, { slug: projectSlug });
+    const project = result.projectBySlug;
+    if (!project) {
+      throw new cliCommon.CliError(`Project ${projectSlug} was not found or is not visible to this token.`, {
+        code: "PROJECT_NOT_FOUND",
+        exitCode: cliCommon.ExitCode.NotFound,
+        details: { projectSlug }
+      });
+    }
+    return project.apiKeys.map((it) => ({
+      ...toApiKey(it),
+      memberships: it.identity.projects.find((relation) => relation.project.slug === projectSlug)?.memberships.map((membership) => ({
+        role: membership.role,
+        variables: membership.variables.map((variable) => ({ name: variable.name, values: [...variable.values] }))
+      })) ?? []
+    }));
+  }
+  /** Project-scoped key. The token in the result is shown exactly once — the server does not store or re-expose it. */
+  async createApiKey(args) {
+    const operation = `createApiKey(${args.projectSlug})`;
+    const result = await this.transport.exec(createApiKeyFetcher, {
+      projectSlug: args.projectSlug,
+      memberships: args.memberships,
+      description: args.description,
+      tokenHash: args.tokenHash,
+      options: args.options
+    });
+    this.transport.assertOk(result.createApiKey, operation);
+    return toApiKeyWithToken(result.createApiKey?.result?.apiKey, operation);
+  }
+  /** Global key, tied to no project. The token in the result is shown exactly once. */
+  async createGlobalApiKey(args) {
+    const operation = `createGlobalApiKey(${args.description})`;
+    const result = await this.transport.exec(createGlobalApiKeyFetcher, {
+      description: args.description,
+      roles: args.roles,
+      tokenHash: args.tokenHash,
+      options: args.options
+    });
+    this.transport.assertOk(result.createGlobalApiKey, operation);
+    return toApiKeyWithToken(result.createGlobalApiKey?.result?.apiKey, operation);
+  }
+  async disableApiKey(id) {
+    const result = await this.transport.exec(disableApiKeyFetcher, { id });
+    this.transport.assertOk(result.disableApiKey, `disableApiKey(${id})`);
+  }
+}
+const toApiKey = (it) => ({
+  id: it.id,
+  identityId: it.identity.id,
+  description: it.description ?? null,
+  type: it.type ?? null,
+  enabled: it.enabled ?? null,
+  createdAt: it.createdAt ?? null,
+  lastUsedAt: it.lastUsedAt ?? null,
+  expiresAt: it.expiresAt ?? null
+});
+const toApiKeyWithToken = (apiKey, operation) => {
+  if (!apiKey) {
+    throw new cliCommon.CliError(`${operation} reported success but returned no api key`, {
+      code: "TENANT_API_INVALID_RESPONSE",
+      exitCode: cliCommon.ExitCode.InternalError
+    });
+  }
+  return { id: apiKey.id, token: apiKey.token ?? null };
+};
+exports.TenantApiKeyClient = TenantApiKeyClient;
+//# sourceMappingURL=TenantApiKeyClient.cjs.map

package/dist/production/src/lib/tenant/clients/TenantApiKeyClient.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"TenantApiKeyClient.cjs","sources":["../../../../../../../packages/cli/src/lib/tenant/clients/TenantApiKeyClient.ts"],"sourcesContent":["import {\n\tapiKey$$,\n\tapiKeyWithToken$$,\n\tcreateApiKeyError$$,\n\ttype CreateApiKeyOptions,\n\tcreateApiKeyResponse$$,\n\tcreateApiKeyResult$,\n\tdisableApiKeyError$$,\n\tdisableApiKeyResponse$$,\n\tidentity$,\n\tidentityProjectRelation$,\n\tmembership$,\n\ttype MembershipInput,\n\tmutation$,\n\tproject$,\n\tquery$,\n\tvariableEntry$$,\n} from '@contember/graphql-client-tenant'\nimport { CliError, ExitCode } from '@contember/cli-common'\nimport { TenantApiTransport } from '../TenantApiTransport.js'\n\nexport interface TenantApiKey {\n\tid: string\n\tidentityId: string\n\tdescription: string | null\n\ttype: string | null\n\tenabled: boolean | null\n\tcreatedAt: string | null\n\tlastUsedAt: string | null\n\texpiresAt: string | null\n}\n\nexport interface TenantGlobalApiKey extends TenantApiKey {\n\tglobalRoles: string[] | null\n}\n\nexport interface TenantApiKeyMembership {\n\trole: string\n\tvariables: { name: string; values: string[] }[]\n}\n\nexport interface TenantProjectApiKey extends TenantApiKey {\n\tmemberships: TenantApiKeyMembership[]\n}\n\nexport interface TenantApiKeyWithToken {\n\tid: string\n\t/** Null when the key was provisioned from a caller-supplied `tokenHash` — the server never had a plaintext to return. */\n\ttoken: string | null\n}\n\nexport interface CreateApiKeyArgs {\n\tprojectSlug: string\n\tmemberships: MembershipInput[]\n\tdescription: string\n\ttokenHash?: string\n\toptions?: CreateApiKeyOptions\n}\n\nexport interface CreateGlobalApiKeyArgs {\n\tdescription: string\n\troles?: string[]\n\ttokenHash?: string\n\toptions?: CreateApiKeyOptions\n}\n\n// Fetchers are immutable and reusable, so they are built once at module load.\nconst globalApiKeysFetcher = query$.globalApiKeys(apiKey$$.identity(identity$.id.roles))\nconst projectApiKeysFetcher = query$.projectBySlug(\n\tproject$.apiKeys(\n\t\tapiKey$$.identity(\n\t\t\tidentity$.id.projects(\n\t\t\t\tidentityProjectRelation$.project(project$.slug).memberships(membership$.role.variables(variableEntry$$)),\n\t\t\t),\n\t\t),\n\t),\n)\nconst createApiKeyFetcher = mutation$.createApiKey(\n\tcreateApiKeyResponse$$.error(createApiKeyError$$).result(createApiKeyResult$.apiKey(apiKeyWithToken$$)),\n)\nconst createGlobalApiKeyFetcher = mutation$.createGlobalApiKey(\n\tcreateApiKeyResponse$$.error(createApiKeyError$$).result(createApiKeyResult$.apiKey(apiKeyWithToken$$)),\n)\nconst disableApiKeyFetcher = mutation$.disableApiKey(disableApiKeyResponse$$.error(disableApiKeyError$$))\n\n/** API keys — global permanent keys and per-project ones. */\nexport class TenantApiKeyClient {\n\tconstructor(\n\t\tprivate readonly transport: TenantApiTransport,\n\t) {\n\t}\n\n\tpublic async listGlobalApiKeys(): Promise<TenantGlobalApiKey[]> {\n\t\tconst result = await this.transport.exec(globalApiKeysFetcher, {})\n\t\treturn result.globalApiKeys.map(it => ({\n\t\t\t...toApiKey(it),\n\t\t\tglobalRoles: it.identity.roles ? [...it.identity.roles] : null,\n\t\t}))\n\t}\n\n\tpublic async listProjectApiKeys(projectSlug: string): Promise<TenantProjectApiKey[]> {\n\t\tconst result = await this.transport.exec(projectApiKeysFetcher, { slug: projectSlug })\n\t\tconst project = result.projectBySlug\n\t\tif (!project) {\n\t\t\tthrow new CliError(`Project ${projectSlug} was not found or is not visible to this token.`, {\n\t\t\t\tcode: 'PROJECT_NOT_FOUND',\n\t\t\t\texitCode: ExitCode.NotFound,\n\t\t\t\tdetails: { projectSlug },\n\t\t\t})\n\t\t}\n\t\treturn project.apiKeys.map(it => ({\n\t\t\t...toApiKey(it),\n\t\t\tmemberships: it.identity.projects.find(relation => relation.project.slug === projectSlug)?.memberships.map(membership => ({\n\t\t\t\trole: membership.role,\n\t\t\t\tvariables: membership.variables.map(variable => ({ name: variable.name, values: [...variable.values] })),\n\t\t\t})) ?? [],\n\t\t}))\n\t}\n\n\t/** Project-scoped key. The token in the result is shown exactly once — the server does not store or re-expose it. */\n\tpublic async createApiKey(args: CreateApiKeyArgs): Promise<TenantApiKeyWithToken> {\n\t\tconst operation = `createApiKey(${args.projectSlug})`\n\t\tconst result = await this.transport.exec(createApiKeyFetcher, {\n\t\t\tprojectSlug: args.projectSlug,\n\t\t\tmemberships: args.memberships,\n\t\t\tdescription: args.description,\n\t\t\ttokenHash: args.tokenHash,\n\t\t\toptions: args.options,\n\t\t})\n\t\tthis.transport.assertOk(result.createApiKey, operation)\n\t\treturn toApiKeyWithToken(result.createApiKey?.result?.apiKey, operation)\n\t}\n\n\t/** Global key, tied to no project. The token in the result is shown exactly once. */\n\tpublic async createGlobalApiKey(args: CreateGlobalApiKeyArgs): Promise<TenantApiKeyWithToken> {\n\t\tconst operation = `createGlobalApiKey(${args.description})`\n\t\tconst result = await this.transport.exec(createGlobalApiKeyFetcher, {\n\t\t\tdescription: args.description,\n\t\t\troles: args.roles,\n\t\t\ttokenHash: args.tokenHash,\n\t\t\toptions: args.options,\n\t\t})\n\t\tthis.transport.assertOk(result.createGlobalApiKey, operation)\n\t\treturn toApiKeyWithToken(result.createGlobalApiKey?.result?.apiKey, operation)\n\t}\n\n\tpublic async disableApiKey(id: string): Promise<void> {\n\t\tconst result = await this.transport.exec(disableApiKeyFetcher, { id })\n\t\tthis.transport.assertOk(result.disableApiKey, `disableApiKey(${id})`)\n\t}\n}\n\nconst toApiKey = (it: {\n\treadonly id: string\n\treadonly identity: { readonly id: string }\n\treadonly description?: string\n\treadonly type?: string\n\treadonly enabled?: boolean\n\treadonly createdAt?: string\n\treadonly lastUsedAt?: string\n\treadonly expiresAt?: string\n}): TenantApiKey => ({\n\tid: it.id,\n\tidentityId: it.identity.id,\n\tdescription: it.description ?? null,\n\ttype: it.type ?? null,\n\tenabled: it.enabled ?? null,\n\tcreatedAt: it.createdAt ?? null,\n\tlastUsedAt: it.lastUsedAt ?? null,\n\texpiresAt: it.expiresAt ?? null,\n})\n\n/** `assertOk` only proves `ok`/`error` are consistent — `result` is still typed optional, so this guards the actual payload. */\nconst toApiKeyWithToken = (apiKey: { id: string; token?: string } | undefined, operation: string): TenantApiKeyWithToken => {\n\tif (!apiKey) {\n\t\tthrow new CliError(`${operation} reported success but returned no api key`, {\n\t\t\tcode: 'TENANT_API_INVALID_RESPONSE',\n\t\t\texitCode: ExitCode.InternalError,\n\t\t})\n\t}\n\treturn { id: apiKey.id, token: apiKey.token ?? null }\n}\n"],"names":["query$","apiKey$$","identity$","project$","identityProjectRelation$","membership$","variableEntry$$","mutation$","createApiKeyResponse$$","createApiKeyError$$","createApiKeyResult$","apiKeyWithToken$$","disableApiKeyResponse$$","disableApiKeyError$$","CliError","ExitCode"],"mappings":";;;;AAmEA,MAAM,uBAAuBA,UAAAA,OAAO,cAAcC,UAAAA,SAAS,SAASC,oBAAU,GAAG,KAAK,CAAC;AACvF,MAAM,wBAAwBF,UAAAA,OAAO;AAAA,EACpCG,UAAAA,SAAS;AAAA,IACRF,UAAAA,SAAS;AAAA,MACRC,UAAAA,UAAU,GAAG;AAAA,QACZE,mCAAyB,QAAQD,UAAAA,SAAS,IAAI,EAAE,YAAYE,sBAAY,KAAK,UAAUC,yBAAe,CAAC;AAAA,MAAA;AAAA,IACxG;AAAA,EACD;AAEF;AACA,MAAM,sBAAsBC,UAAAA,UAAU;AAAA,EACrCC,UAAAA,uBAAuB,MAAMC,6BAAmB,EAAE,OAAOC,UAAAA,oBAAoB,OAAOC,2BAAiB,CAAC;AACvG;AACA,MAAM,4BAA4BJ,UAAAA,UAAU;AAAA,EAC3CC,UAAAA,uBAAuB,MAAMC,6BAAmB,EAAE,OAAOC,UAAAA,oBAAoB,OAAOC,2BAAiB,CAAC;AACvG;AACA,MAAM,uBAAuBJ,UAAAA,UAAU,cAAcK,UAAAA,wBAAwB,MAAMC,UAAAA,oBAAoB,CAAC;AAGjG,MAAM,mBAAmB;AAAA,EAC/B,YACkB,WAChB;AADgB,SAAA,YAAA;AAAA,EAElB;AAAA,EAEA,MAAa,oBAAmD;AAC/D,UAAM,SAAS,MAAM,KAAK,UAAU,KAAK,sBAAsB,EAAE;AACjE,WAAO,OAAO,cAAc,IAAI,CAAA,QAAO;AAAA,MACtC,GAAG,SAAS,EAAE;AAAA,MACd,aAAa,GAAG,SAAS,QAAQ,CAAC,GAAG,GAAG,SAAS,KAAK,IAAI;AAAA,IAAA,EACzD;AAAA,EACH;AAAA,EAEA,MAAa,mBAAmB,aAAqD;AACpF,UAAM,SAAS,MAAM,KAAK,UAAU,KAAK,uBAAuB,EAAE,MAAM,aAAa;AACrF,UAAM,UAAU,OAAO;AACvB,QAAI,CAAC,SAAS;AACb,YAAM,IAAIC,UAAAA,SAAS,WAAW,WAAW,mDAAmD;AAAA,QAC3F,MAAM;AAAA,QACN,UAAUC,UAAAA,SAAS;AAAA,QACnB,SAAS,EAAE,YAAA;AAAA,MAAY,CACvB;AAAA,IACF;AACA,WAAO,QAAQ,QAAQ,IAAI,CAAA,QAAO;AAAA,MACjC,GAAG,SAAS,EAAE;AAAA,MACd,aAAa,GAAG,SAAS,SAAS,KAAK,CAAA,aAAY,SAAS,QAAQ,SAAS,WAAW,GAAG,YAAY,IAAI,CAAA,gBAAe;AAAA,QACzH,MAAM,WAAW;AAAA,QACjB,WAAW,WAAW,UAAU,IAAI,eAAa,EAAE,MAAM,SAAS,MAAM,QAAQ,CAAC,GAAG,SAAS,MAAM,IAAI;AAAA,MAAA,EACtG,KAAK,CAAA;AAAA,IAAC,EACP;AAAA,EACH;AAAA;AAAA,EAGA,MAAa,aAAa,MAAwD;AACjF,UAAM,YAAY,gBAAgB,KAAK,WAAW;AAClD,UAAM,SAAS,MAAM,KAAK,UAAU,KAAK,qBAAqB;AAAA,MAC7D,aAAa,KAAK;AAAA,MAClB,aAAa,KAAK;AAAA,MAClB,aAAa,KAAK;AAAA,MAClB,WAAW,KAAK;AAAA,MAChB,SAAS,KAAK;AAAA,IAAA,CACd;AACD,SAAK,UAAU,SAAS,OAAO,cAAc,SAAS;AACtD,WAAO,kBAAkB,OAAO,cAAc,QAAQ,QAAQ,SAAS;AAAA,EACxE;AAAA;AAAA,EAGA,MAAa,mBAAmB,MAA8D;AAC7F,UAAM,YAAY,sBAAsB,KAAK,WAAW;AACxD,UAAM,SAAS,MAAM,KAAK,UAAU,KAAK,2BAA2B;AAAA,MACnE,aAAa,KAAK;AAAA,MAClB,OAAO,KAAK;AAAA,MACZ,WAAW,KAAK;AAAA,MAChB,SAAS,KAAK;AAAA,IAAA,CACd;AACD,SAAK,UAAU,SAAS,OAAO,oBAAoB,SAAS;AAC5D,WAAO,kBAAkB,OAAO,oBAAoB,QAAQ,QAAQ,SAAS;AAAA,EAC9E;AAAA,EAEA,MAAa,cAAc,IAA2B;AACrD,UAAM,SAAS,MAAM,KAAK,UAAU,KAAK,sBAAsB,EAAE,IAAI;AACrE,SAAK,UAAU,SAAS,OAAO,eAAe,iBAAiB,EAAE,GAAG;AAAA,EACrE;AACD;AAEA,MAAM,WAAW,CAAC,QASG;AAAA,EACpB,IAAI,GAAG;AAAA,EACP,YAAY,GAAG,SAAS;AAAA,EACxB,aAAa,GAAG,eAAe;AAAA,EAC/B,MAAM,GAAG,QAAQ;AAAA,EACjB,SAAS,GAAG,WAAW;AAAA,EACvB,WAAW,GAAG,aAAa;AAAA,EAC3B,YAAY,GAAG,cAAc;AAAA,EAC7B,WAAW,GAAG,aAAa;AAC5B;AAGA,MAAM,oBAAoB,CAAC,QAAoD,cAA6C;AAC3H,MAAI,CAAC,QAAQ;AACZ,UAAM,IAAID,UAAAA,SAAS,GAAG,SAAS,6CAA6C;AAAA,MAC3E,MAAM;AAAA,MACN,UAAUC,UAAAA,SAAS;AAAA,IAAA,CACnB;AAAA,EACF;AACA,SAAO,EAAE,IAAI,OAAO,IAAI,OAAO,OAAO,SAAS,KAAA;AAChD;;"}

package/dist/production/src/lib/tenant/clients/TenantApiKeyClient.js

@@ -0,0 +1,101 @@
+import { query$, apiKey$$, identity$, project$, identityProjectRelation$, membership$, variableEntry$$, mutation$, createApiKeyResponse$$, createApiKeyError$$, createApiKeyResult$, apiKeyWithToken$$, disableApiKeyResponse$$, disableApiKeyError$$ } from "@contember/graphql-client-tenant";
+import { CliError, ExitCode } from "@contember/cli-common";
+const globalApiKeysFetcher = query$.globalApiKeys(apiKey$$.identity(identity$.id.roles));
+const projectApiKeysFetcher = query$.projectBySlug(
+  project$.apiKeys(
+    apiKey$$.identity(
+      identity$.id.projects(
+        identityProjectRelation$.project(project$.slug).memberships(membership$.role.variables(variableEntry$$))
+      )
+    )
+  )
+);
+const createApiKeyFetcher = mutation$.createApiKey(
+  createApiKeyResponse$$.error(createApiKeyError$$).result(createApiKeyResult$.apiKey(apiKeyWithToken$$))
+);
+const createGlobalApiKeyFetcher = mutation$.createGlobalApiKey(
+  createApiKeyResponse$$.error(createApiKeyError$$).result(createApiKeyResult$.apiKey(apiKeyWithToken$$))
+);
+const disableApiKeyFetcher = mutation$.disableApiKey(disableApiKeyResponse$$.error(disableApiKeyError$$));
+class TenantApiKeyClient {
+  constructor(transport) {
+    this.transport = transport;
+  }
+  async listGlobalApiKeys() {
+    const result = await this.transport.exec(globalApiKeysFetcher, {});
+    return result.globalApiKeys.map((it) => ({
+      ...toApiKey(it),
+      globalRoles: it.identity.roles ? [...it.identity.roles] : null
+    }));
+  }
+  async listProjectApiKeys(projectSlug) {
+    const result = await this.transport.exec(projectApiKeysFetcher, { slug: projectSlug });
+    const project = result.projectBySlug;
+    if (!project) {
+      throw new CliError(`Project ${projectSlug} was not found or is not visible to this token.`, {
+        code: "PROJECT_NOT_FOUND",
+        exitCode: ExitCode.NotFound,
+        details: { projectSlug }
+      });
+    }
+    return project.apiKeys.map((it) => ({
+      ...toApiKey(it),
+      memberships: it.identity.projects.find((relation) => relation.project.slug === projectSlug)?.memberships.map((membership) => ({
+        role: membership.role,
+        variables: membership.variables.map((variable) => ({ name: variable.name, values: [...variable.values] }))
+      })) ?? []
+    }));
+  }
+  /** Project-scoped key. The token in the result is shown exactly once — the server does not store or re-expose it. */
+  async createApiKey(args) {
+    const operation = `createApiKey(${args.projectSlug})`;
+    const result = await this.transport.exec(createApiKeyFetcher, {
+      projectSlug: args.projectSlug,
+      memberships: args.memberships,
+      description: args.description,
+      tokenHash: args.tokenHash,
+      options: args.options
+    });
+    this.transport.assertOk(result.createApiKey, operation);
+    return toApiKeyWithToken(result.createApiKey?.result?.apiKey, operation);
+  }
+  /** Global key, tied to no project. The token in the result is shown exactly once. */
+  async createGlobalApiKey(args) {
+    const operation = `createGlobalApiKey(${args.description})`;
+    const result = await this.transport.exec(createGlobalApiKeyFetcher, {
+      description: args.description,
+      roles: args.roles,
+      tokenHash: args.tokenHash,
+      options: args.options
+    });
+    this.transport.assertOk(result.createGlobalApiKey, operation);
+    return toApiKeyWithToken(result.createGlobalApiKey?.result?.apiKey, operation);
+  }
+  async disableApiKey(id) {
+    const result = await this.transport.exec(disableApiKeyFetcher, { id });
+    this.transport.assertOk(result.disableApiKey, `disableApiKey(${id})`);
+  }
+}
+const toApiKey = (it) => ({
+  id: it.id,
+  identityId: it.identity.id,
+  description: it.description ?? null,
+  type: it.type ?? null,
+  enabled: it.enabled ?? null,
+  createdAt: it.createdAt ?? null,
+  lastUsedAt: it.lastUsedAt ?? null,
+  expiresAt: it.expiresAt ?? null
+});
+const toApiKeyWithToken = (apiKey, operation) => {
+  if (!apiKey) {
+    throw new CliError(`${operation} reported success but returned no api key`, {
+      code: "TENANT_API_INVALID_RESPONSE",
+      exitCode: ExitCode.InternalError
+    });
+  }
+  return { id: apiKey.id, token: apiKey.token ?? null };
+};
+export {
+  TenantApiKeyClient
+};
+//# sourceMappingURL=TenantApiKeyClient.js.map

package/dist/production/src/lib/tenant/clients/TenantApiKeyClient.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"TenantApiKeyClient.js","sources":["../../../../../../../packages/cli/src/lib/tenant/clients/TenantApiKeyClient.ts"],"sourcesContent":["import {\n\tapiKey$$,\n\tapiKeyWithToken$$,\n\tcreateApiKeyError$$,\n\ttype CreateApiKeyOptions,\n\tcreateApiKeyResponse$$,\n\tcreateApiKeyResult$,\n\tdisableApiKeyError$$,\n\tdisableApiKeyResponse$$,\n\tidentity$,\n\tidentityProjectRelation$,\n\tmembership$,\n\ttype MembershipInput,\n\tmutation$,\n\tproject$,\n\tquery$,\n\tvariableEntry$$,\n} from '@contember/graphql-client-tenant'\nimport { CliError, ExitCode } from '@contember/cli-common'\nimport { TenantApiTransport } from '../TenantApiTransport.js'\n\nexport interface TenantApiKey {\n\tid: string\n\tidentityId: string\n\tdescription: string | null\n\ttype: string | null\n\tenabled: boolean | null\n\tcreatedAt: string | null\n\tlastUsedAt: string | null\n\texpiresAt: string | null\n}\n\nexport interface TenantGlobalApiKey extends TenantApiKey {\n\tglobalRoles: string[] | null\n}\n\nexport interface TenantApiKeyMembership {\n\trole: string\n\tvariables: { name: string; values: string[] }[]\n}\n\nexport interface TenantProjectApiKey extends TenantApiKey {\n\tmemberships: TenantApiKeyMembership[]\n}\n\nexport interface TenantApiKeyWithToken {\n\tid: string\n\t/** Null when the key was provisioned from a caller-supplied `tokenHash` — the server never had a plaintext to return. */\n\ttoken: string | null\n}\n\nexport interface CreateApiKeyArgs {\n\tprojectSlug: string\n\tmemberships: MembershipInput[]\n\tdescription: string\n\ttokenHash?: string\n\toptions?: CreateApiKeyOptions\n}\n\nexport interface CreateGlobalApiKeyArgs {\n\tdescription: string\n\troles?: string[]\n\ttokenHash?: string\n\toptions?: CreateApiKeyOptions\n}\n\n// Fetchers are immutable and reusable, so they are built once at module load.\nconst globalApiKeysFetcher = query$.globalApiKeys(apiKey$$.identity(identity$.id.roles))\nconst projectApiKeysFetcher = query$.projectBySlug(\n\tproject$.apiKeys(\n\t\tapiKey$$.identity(\n\t\t\tidentity$.id.projects(\n\t\t\t\tidentityProjectRelation$.project(project$.slug).memberships(membership$.role.variables(variableEntry$$)),\n\t\t\t),\n\t\t),\n\t),\n)\nconst createApiKeyFetcher = mutation$.createApiKey(\n\tcreateApiKeyResponse$$.error(createApiKeyError$$).result(createApiKeyResult$.apiKey(apiKeyWithToken$$)),\n)\nconst createGlobalApiKeyFetcher = mutation$.createGlobalApiKey(\n\tcreateApiKeyResponse$$.error(createApiKeyError$$).result(createApiKeyResult$.apiKey(apiKeyWithToken$$)),\n)\nconst disableApiKeyFetcher = mutation$.disableApiKey(disableApiKeyResponse$$.error(disableApiKeyError$$))\n\n/** API keys — global permanent keys and per-project ones. */\nexport class TenantApiKeyClient {\n\tconstructor(\n\t\tprivate readonly transport: TenantApiTransport,\n\t) {\n\t}\n\n\tpublic async listGlobalApiKeys(): Promise<TenantGlobalApiKey[]> {\n\t\tconst result = await this.transport.exec(globalApiKeysFetcher, {})\n\t\treturn result.globalApiKeys.map(it => ({\n\t\t\t...toApiKey(it),\n\t\t\tglobalRoles: it.identity.roles ? [...it.identity.roles] : null,\n\t\t}))\n\t}\n\n\tpublic async listProjectApiKeys(projectSlug: string): Promise<TenantProjectApiKey[]> {\n\t\tconst result = await this.transport.exec(projectApiKeysFetcher, { slug: projectSlug })\n\t\tconst project = result.projectBySlug\n\t\tif (!project) {\n\t\t\tthrow new CliError(`Project ${projectSlug} was not found or is not visible to this token.`, {\n\t\t\t\tcode: 'PROJECT_NOT_FOUND',\n\t\t\t\texitCode: ExitCode.NotFound,\n\t\t\t\tdetails: { projectSlug },\n\t\t\t})\n\t\t}\n\t\treturn project.apiKeys.map(it => ({\n\t\t\t...toApiKey(it),\n\t\t\tmemberships: it.identity.projects.find(relation => relation.project.slug === projectSlug)?.memberships.map(membership => ({\n\t\t\t\trole: membership.role,\n\t\t\t\tvariables: membership.variables.map(variable => ({ name: variable.name, values: [...variable.values] })),\n\t\t\t})) ?? [],\n\t\t}))\n\t}\n\n\t/** Project-scoped key. The token in the result is shown exactly once — the server does not store or re-expose it. */\n\tpublic async createApiKey(args: CreateApiKeyArgs): Promise<TenantApiKeyWithToken> {\n\t\tconst operation = `createApiKey(${args.projectSlug})`\n\t\tconst result = await this.transport.exec(createApiKeyFetcher, {\n\t\t\tprojectSlug: args.projectSlug,\n\t\t\tmemberships: args.memberships,\n\t\t\tdescription: args.description,\n\t\t\ttokenHash: args.tokenHash,\n\t\t\toptions: args.options,\n\t\t})\n\t\tthis.transport.assertOk(result.createApiKey, operation)\n\t\treturn toApiKeyWithToken(result.createApiKey?.result?.apiKey, operation)\n\t}\n\n\t/** Global key, tied to no project. The token in the result is shown exactly once. */\n\tpublic async createGlobalApiKey(args: CreateGlobalApiKeyArgs): Promise<TenantApiKeyWithToken> {\n\t\tconst operation = `createGlobalApiKey(${args.description})`\n\t\tconst result = await this.transport.exec(createGlobalApiKeyFetcher, {\n\t\t\tdescription: args.description,\n\t\t\troles: args.roles,\n\t\t\ttokenHash: args.tokenHash,\n\t\t\toptions: args.options,\n\t\t})\n\t\tthis.transport.assertOk(result.createGlobalApiKey, operation)\n\t\treturn toApiKeyWithToken(result.createGlobalApiKey?.result?.apiKey, operation)\n\t}\n\n\tpublic async disableApiKey(id: string): Promise<void> {\n\t\tconst result = await this.transport.exec(disableApiKeyFetcher, { id })\n\t\tthis.transport.assertOk(result.disableApiKey, `disableApiKey(${id})`)\n\t}\n}\n\nconst toApiKey = (it: {\n\treadonly id: string\n\treadonly identity: { readonly id: string }\n\treadonly description?: string\n\treadonly type?: string\n\treadonly enabled?: boolean\n\treadonly createdAt?: string\n\treadonly lastUsedAt?: string\n\treadonly expiresAt?: string\n}): TenantApiKey => ({\n\tid: it.id,\n\tidentityId: it.identity.id,\n\tdescription: it.description ?? null,\n\ttype: it.type ?? null,\n\tenabled: it.enabled ?? null,\n\tcreatedAt: it.createdAt ?? null,\n\tlastUsedAt: it.lastUsedAt ?? null,\n\texpiresAt: it.expiresAt ?? null,\n})\n\n/** `assertOk` only proves `ok`/`error` are consistent — `result` is still typed optional, so this guards the actual payload. */\nconst toApiKeyWithToken = (apiKey: { id: string; token?: string } | undefined, operation: string): TenantApiKeyWithToken => {\n\tif (!apiKey) {\n\t\tthrow new CliError(`${operation} reported success but returned no api key`, {\n\t\t\tcode: 'TENANT_API_INVALID_RESPONSE',\n\t\t\texitCode: ExitCode.InternalError,\n\t\t})\n\t}\n\treturn { id: apiKey.id, token: apiKey.token ?? null }\n}\n"],"names":[],"mappings":";;AAmEA,MAAM,uBAAuB,OAAO,cAAc,SAAS,SAAS,UAAU,GAAG,KAAK,CAAC;AACvF,MAAM,wBAAwB,OAAO;AAAA,EACpC,SAAS;AAAA,IACR,SAAS;AAAA,MACR,UAAU,GAAG;AAAA,QACZ,yBAAyB,QAAQ,SAAS,IAAI,EAAE,YAAY,YAAY,KAAK,UAAU,eAAe,CAAC;AAAA,MAAA;AAAA,IACxG;AAAA,EACD;AAEF;AACA,MAAM,sBAAsB,UAAU;AAAA,EACrC,uBAAuB,MAAM,mBAAmB,EAAE,OAAO,oBAAoB,OAAO,iBAAiB,CAAC;AACvG;AACA,MAAM,4BAA4B,UAAU;AAAA,EAC3C,uBAAuB,MAAM,mBAAmB,EAAE,OAAO,oBAAoB,OAAO,iBAAiB,CAAC;AACvG;AACA,MAAM,uBAAuB,UAAU,cAAc,wBAAwB,MAAM,oBAAoB,CAAC;AAGjG,MAAM,mBAAmB;AAAA,EAC/B,YACkB,WAChB;AADgB,SAAA,YAAA;AAAA,EAElB;AAAA,EAEA,MAAa,oBAAmD;AAC/D,UAAM,SAAS,MAAM,KAAK,UAAU,KAAK,sBAAsB,EAAE;AACjE,WAAO,OAAO,cAAc,IAAI,CAAA,QAAO;AAAA,MACtC,GAAG,SAAS,EAAE;AAAA,MACd,aAAa,GAAG,SAAS,QAAQ,CAAC,GAAG,GAAG,SAAS,KAAK,IAAI;AAAA,IAAA,EACzD;AAAA,EACH;AAAA,EAEA,MAAa,mBAAmB,aAAqD;AACpF,UAAM,SAAS,MAAM,KAAK,UAAU,KAAK,uBAAuB,EAAE,MAAM,aAAa;AACrF,UAAM,UAAU,OAAO;AACvB,QAAI,CAAC,SAAS;AACb,YAAM,IAAI,SAAS,WAAW,WAAW,mDAAmD;AAAA,QAC3F,MAAM;AAAA,QACN,UAAU,SAAS;AAAA,QACnB,SAAS,EAAE,YAAA;AAAA,MAAY,CACvB;AAAA,IACF;AACA,WAAO,QAAQ,QAAQ,IAAI,CAAA,QAAO;AAAA,MACjC,GAAG,SAAS,EAAE;AAAA,MACd,aAAa,GAAG,SAAS,SAAS,KAAK,CAAA,aAAY,SAAS,QAAQ,SAAS,WAAW,GAAG,YAAY,IAAI,CAAA,gBAAe;AAAA,QACzH,MAAM,WAAW;AAAA,QACjB,WAAW,WAAW,UAAU,IAAI,eAAa,EAAE,MAAM,SAAS,MAAM,QAAQ,CAAC,GAAG,SAAS,MAAM,IAAI;AAAA,MAAA,EACtG,KAAK,CAAA;AAAA,IAAC,EACP;AAAA,EACH;AAAA;AAAA,EAGA,MAAa,aAAa,MAAwD;AACjF,UAAM,YAAY,gBAAgB,KAAK,WAAW;AAClD,UAAM,SAAS,MAAM,KAAK,UAAU,KAAK,qBAAqB;AAAA,MAC7D,aAAa,KAAK;AAAA,MAClB,aAAa,KAAK;AAAA,MAClB,aAAa,KAAK;AAAA,MAClB,WAAW,KAAK;AAAA,MAChB,SAAS,KAAK;AAAA,IAAA,CACd;AACD,SAAK,UAAU,SAAS,OAAO,cAAc,SAAS;AACtD,WAAO,kBAAkB,OAAO,cAAc,QAAQ,QAAQ,SAAS;AAAA,EACxE;AAAA;AAAA,EAGA,MAAa,mBAAmB,MAA8D;AAC7F,UAAM,YAAY,sBAAsB,KAAK,WAAW;AACxD,UAAM,SAAS,MAAM,KAAK,UAAU,KAAK,2BAA2B;AAAA,MACnE,aAAa,KAAK;AAAA,MAClB,OAAO,KAAK;AAAA,MACZ,WAAW,KAAK;AAAA,MAChB,SAAS,KAAK;AAAA,IAAA,CACd;AACD,SAAK,UAAU,SAAS,OAAO,oBAAoB,SAAS;AAC5D,WAAO,kBAAkB,OAAO,oBAAoB,QAAQ,QAAQ,SAAS;AAAA,EAC9E;AAAA,EAEA,MAAa,cAAc,IAA2B;AACrD,UAAM,SAAS,MAAM,KAAK,UAAU,KAAK,sBAAsB,EAAE,IAAI;AACrE,SAAK,UAAU,SAAS,OAAO,eAAe,iBAAiB,EAAE,GAAG;AAAA,EACrE;AACD;AAEA,MAAM,WAAW,CAAC,QASG;AAAA,EACpB,IAAI,GAAG;AAAA,EACP,YAAY,GAAG,SAAS;AAAA,EACxB,aAAa,GAAG,eAAe;AAAA,EAC/B,MAAM,GAAG,QAAQ;AAAA,EACjB,SAAS,GAAG,WAAW;AAAA,EACvB,WAAW,GAAG,aAAa;AAAA,EAC3B,YAAY,GAAG,cAAc;AAAA,EAC7B,WAAW,GAAG,aAAa;AAC5B;AAGA,MAAM,oBAAoB,CAAC,QAAoD,cAA6C;AAC3H,MAAI,CAAC,QAAQ;AACZ,UAAM,IAAI,SAAS,GAAG,SAAS,6CAA6C;AAAA,MAC3E,MAAM;AAAA,MACN,UAAU,SAAS;AAAA,IAAA,CACnB;AAAA,EACF;AACA,SAAO,EAAE,IAAI,OAAO,IAAI,OAAO,OAAO,SAAS,KAAA;AAChD;"}

package/dist/production/src/lib/tenant/clients/TenantMemberClient.cjs

@@ -0,0 +1,96 @@
+"use strict";
+Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+const cliCommon = require("@contember/cli-common");
+const TenantApi = require("@contember/graphql-client-tenant");
+const membershipFetcher = TenantApi.membership$.role.variables(TenantApi.variableEntry$$);
+const projectMembershipsFetcher = TenantApi.query$.projectMemberships(membershipFetcher);
+const projectMembersFetcher = TenantApi.query$.projectBySlug(
+  TenantApi.project$.members(
+    TenantApi.projectIdentityRelation$.identity(TenantApi.identity$.id.description.person(TenantApi.person$.id.email.name)).memberships(membershipFetcher)
+  )
+);
+const inviteResultFetcher = TenantApi.inviteResult$.isNew.person(TenantApi.person$.id.email.name.identity(TenantApi.identity$.id));
+const inviteFetcher = TenantApi.mutation$.invite(TenantApi.inviteResponse$$.error(TenantApi.inviteError$$).result(inviteResultFetcher));
+const unmanagedInviteFetcher = TenantApi.mutation$.unmanagedInvite(TenantApi.inviteResponse$$.error(TenantApi.inviteError$$).result(inviteResultFetcher));
+const addProjectMemberFetcher = TenantApi.mutation$.addProjectMember(TenantApi.addProjectMemberResponse$$.error(TenantApi.addProjectMemberError$$));
+const updateProjectMemberFetcher = TenantApi.mutation$.updateProjectMember(TenantApi.updateProjectMemberResponse$$.error(TenantApi.updateProjectMemberError$$));
+const removeProjectMemberFetcher = TenantApi.mutation$.removeProjectMember(TenantApi.removeProjectMemberResponse$$.error(TenantApi.removeProjectMemberError$$));
+class TenantMemberClient {
+  constructor(transport) {
+    this.transport = transport;
+  }
+  async listProjectMemberships(projectSlug, identityId) {
+    const result = await this.transport.exec(projectMembershipsFetcher, { projectSlug, identityId });
+    return result.projectMemberships.map(toMembership);
+  }
+  /**
+   * Lists every member of a project. The tenant API answers with an empty list — not an error — when the
+   * caller lacks the `project.view members` permission, so an empty result is not proof the project is empty.
+   */
+  async listProjectMembers(projectSlug, { filter, limit, offset } = {}) {
+    const result = await this.transport.exec(projectMembersFetcher, { slug: projectSlug, input: { filter, limit, offset } });
+    const project = result.projectBySlug;
+    if (!project) {
+      throw new cliCommon.CliError(`Project ${projectSlug} was not found or is not visible to this token.`, {
+        code: "PROJECT_NOT_FOUND",
+        exitCode: cliCommon.ExitCode.NotFound,
+        details: { projectSlug }
+      });
+    }
+    return project.members.map((member) => ({
+      identityId: member.identity.id,
+      personId: member.identity.person?.id ?? null,
+      email: member.identity.person?.email ?? null,
+      name: member.identity.person?.name ?? null,
+      description: member.identity.description ?? null,
+      memberships: member.memberships.map(toMembership)
+    }));
+  }
+  /** Invites a person, letting the tenant deliver the credentials by mail. */
+  async invite({ projectSlug, email, name, memberships, options }) {
+    const result = await this.transport.exec(inviteFetcher, { projectSlug, email, name, memberships, options });
+    return this.toInviteResult(result.invite, `invite(${email})`);
+  }
+  /** Invites a person without any mail — the caller supplies the password or the reset token hash. */
+  async unmanagedInvite({ projectSlug, email, memberships, options }) {
+    const result = await this.transport.exec(unmanagedInviteFetcher, { projectSlug, email, memberships, options });
+    return this.toInviteResult(result.unmanagedInvite, `unmanagedInvite(${email})`);
+  }
+  async addProjectMember(projectSlug, identityId, memberships) {
+    const result = await this.transport.exec(addProjectMemberFetcher, { projectSlug, identityId, memberships });
+    this.transport.assertOk(result.addProjectMember, `addProjectMember(${identityId})`);
+  }
+  /** Replaces all memberships of an existing member — anything not passed is removed. */
+  async updateProjectMember(projectSlug, identityId, memberships) {
+    const result = await this.transport.exec(updateProjectMemberFetcher, { projectSlug, identityId, memberships });
+    this.transport.assertOk(result.updateProjectMember, `updateProjectMember(${identityId})`);
+  }
+  async removeProjectMember(projectSlug, identityId) {
+    const result = await this.transport.exec(removeProjectMemberFetcher, { projectSlug, identityId });
+    this.transport.assertOk(result.removeProjectMember, `removeProjectMember(${identityId})`);
+  }
+  toInviteResult(response, operation) {
+    this.transport.assertOk(response, operation);
+    const result = response?.result;
+    if (!result) {
+      throw new cliCommon.CliError(`${operation} reported success but returned no result.`, {
+        code: "TENANT_API_INVALID_RESPONSE",
+        exitCode: cliCommon.ExitCode.InternalError,
+        details: { operation }
+      });
+    }
+    return {
+      personId: result.person.id,
+      identityId: result.person.identity.id,
+      email: result.person.email ?? null,
+      name: result.person.name ?? null,
+      isNew: result.isNew
+    };
+  }
+}
+const toMembership = (membership) => ({
+  role: membership.role,
+  variables: membership.variables.map((variable) => ({ name: variable.name, values: [...variable.values] }))
+});
+exports.TenantMemberClient = TenantMemberClient;
+//# sourceMappingURL=TenantMemberClient.cjs.map

package/dist/production/src/lib/tenant/clients/TenantMemberClient.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"TenantMemberClient.cjs","sources":["../../../../../../../packages/cli/src/lib/tenant/clients/TenantMemberClient.ts"],"sourcesContent":["import { CliError, ExitCode } from '@contember/cli-common'\nimport {\n\taddProjectMemberError$$,\n\taddProjectMemberResponse$$,\n\tidentity$,\n\tinviteError$$,\n\ttype InviteOptions,\n\tinviteResponse$$,\n\tinviteResult$,\n\tmembership$,\n\ttype MembershipInput,\n\tmutation$,\n\tperson$,\n\tproject$,\n\tprojectIdentityRelation$,\n\ttype ProjectMembersFilter,\n\tquery$,\n\tremoveProjectMemberError$$,\n\tremoveProjectMemberResponse$$,\n\ttype UnmanagedInviteOptions,\n\tupdateProjectMemberError$$,\n\tupdateProjectMemberResponse$$,\n\tvariableEntry$$,\n} from '@contember/graphql-client-tenant'\nimport { TenantApiTransport } from '../TenantApiTransport.js'\n\nexport interface TenantMembershipVariable {\n\tname: string\n\tvalues: string[]\n}\n\nexport interface TenantMembership {\n\trole: string\n\tvariables: TenantMembershipVariable[]\n}\n\n/** One member of a project — the identity, the person behind it when there is one, and its memberships. */\nexport interface TenantProjectMember {\n\tidentityId: string\n\t/** Null for an API key member — those have no person. */\n\tpersonId: string | null\n\temail: string | null\n\tname: string | null\n\t/** Identity label, the only human-readable name an API key member has. */\n\tdescription: string | null\n\tmemberships: TenantMembership[]\n}\n\nexport interface ListProjectMembersArgs {\n\tfilter?: ProjectMembersFilter\n\tlimit?: number\n\toffset?: number\n}\n\nexport interface InviteArgs {\n\tprojectSlug: string\n\temail: string\n\tname?: string\n\tmemberships: readonly MembershipInput[]\n\toptions?: InviteOptions\n}\n\nexport interface UnmanagedInviteArgs {\n\tprojectSlug: string\n\temail: string\n\tmemberships: readonly MembershipInput[]\n\toptions?: UnmanagedInviteOptions\n}\n\nexport interface TenantInviteResult {\n\tpersonId: string\n\tidentityId: string\n\temail: string | null\n\tname: string | null\n\t/** False when the person already existed and was only added to the project. */\n\tisNew: boolean\n}\n\n/** The part of an `InviteResponse` selection this client reads — shared by `invite` and `unmanagedInvite`. */\ninterface InviteResponsePayload {\n\treadonly ok: boolean\n\treadonly error?: { readonly code: string; readonly developerMessage: string } | null\n\treadonly result?: {\n\t\treadonly isNew: boolean\n\t\treadonly person: {\n\t\t\treadonly id: string\n\t\t\treadonly email?: string\n\t\t\treadonly name?: string\n\t\t\treadonly identity: { readonly id: string }\n\t\t}\n\t} | null\n}\n\n// Fetchers are immutable and reusable, so they are built once at module load.\nconst membershipFetcher = membership$.role.variables(variableEntry$$)\nconst projectMembershipsFetcher = query$.projectMemberships(membershipFetcher)\nconst projectMembersFetcher = query$.projectBySlug(\n\tproject$.members(\n\t\tprojectIdentityRelation$\n\t\t\t.identity(identity$.id.description.person(person$.id.email.name))\n\t\t\t.memberships(membershipFetcher),\n\t),\n)\nconst inviteResultFetcher = inviteResult$.isNew.person(person$.id.email.name.identity(identity$.id))\nconst inviteFetcher = mutation$.invite(inviteResponse$$.error(inviteError$$).result(inviteResultFetcher))\nconst unmanagedInviteFetcher = mutation$.unmanagedInvite(inviteResponse$$.error(inviteError$$).result(inviteResultFetcher))\nconst addProjectMemberFetcher = mutation$.addProjectMember(addProjectMemberResponse$$.error(addProjectMemberError$$))\nconst updateProjectMemberFetcher = mutation$.updateProjectMember(updateProjectMemberResponse$$.error(updateProjectMemberError$$))\nconst removeProjectMemberFetcher = mutation$.removeProjectMember(removeProjectMemberResponse$$.error(removeProjectMemberError$$))\n\n/** Project memberships and invites. */\nexport class TenantMemberClient {\n\tconstructor(\n\t\tprivate readonly transport: TenantApiTransport,\n\t) {\n\t}\n\n\tpublic async listProjectMemberships(projectSlug: string, identityId: string): Promise<TenantMembership[]> {\n\t\tconst result = await this.transport.exec(projectMembershipsFetcher, { projectSlug, identityId })\n\t\treturn result.projectMemberships.map(toMembership)\n\t}\n\n\t/**\n\t * Lists every member of a project. The tenant API answers with an empty list — not an error — when the\n\t * caller lacks the `project.view members` permission, so an empty result is not proof the project is empty.\n\t */\n\tpublic async listProjectMembers(projectSlug: string, { filter, limit, offset }: ListProjectMembersArgs = {}): Promise<TenantProjectMember[]> {\n\t\tconst result = await this.transport.exec(projectMembersFetcher, { slug: projectSlug, input: { filter, limit, offset } })\n\t\tconst project = result.projectBySlug\n\t\tif (!project) {\n\t\t\tthrow new CliError(`Project ${projectSlug} was not found or is not visible to this token.`, {\n\t\t\t\tcode: 'PROJECT_NOT_FOUND',\n\t\t\t\texitCode: ExitCode.NotFound,\n\t\t\t\tdetails: { projectSlug },\n\t\t\t})\n\t\t}\n\t\treturn project.members.map(member => ({\n\t\t\tidentityId: member.identity.id,\n\t\t\tpersonId: member.identity.person?.id ?? null,\n\t\t\temail: member.identity.person?.email ?? null,\n\t\t\tname: member.identity.person?.name ?? null,\n\t\t\tdescription: member.identity.description ?? null,\n\t\t\tmemberships: member.memberships.map(toMembership),\n\t\t}))\n\t}\n\n\t/** Invites a person, letting the tenant deliver the credentials by mail. */\n\tpublic async invite({ projectSlug, email, name, memberships, options }: InviteArgs): Promise<TenantInviteResult> {\n\t\tconst result = await this.transport.exec(inviteFetcher, { projectSlug, email, name, memberships, options })\n\t\treturn this.toInviteResult(result.invite, `invite(${email})`)\n\t}\n\n\t/** Invites a person without any mail — the caller supplies the password or the reset token hash. */\n\tpublic async unmanagedInvite({ projectSlug, email, memberships, options }: UnmanagedInviteArgs): Promise<TenantInviteResult> {\n\t\tconst result = await this.transport.exec(unmanagedInviteFetcher, { projectSlug, email, memberships, options })\n\t\treturn this.toInviteResult(result.unmanagedInvite, `unmanagedInvite(${email})`)\n\t}\n\n\tpublic async addProjectMember(projectSlug: string, identityId: string, memberships: readonly MembershipInput[]): Promise<void> {\n\t\tconst result = await this.transport.exec(addProjectMemberFetcher, { projectSlug, identityId, memberships })\n\t\tthis.transport.assertOk(result.addProjectMember, `addProjectMember(${identityId})`)\n\t}\n\n\t/** Replaces all memberships of an existing member — anything not passed is removed. */\n\tpublic async updateProjectMember(projectSlug: string, identityId: string, memberships: readonly MembershipInput[]): Promise<void> {\n\t\tconst result = await this.transport.exec(updateProjectMemberFetcher, { projectSlug, identityId, memberships })\n\t\tthis.transport.assertOk(result.updateProjectMember, `updateProjectMember(${identityId})`)\n\t}\n\n\tpublic async removeProjectMember(projectSlug: string, identityId: string): Promise<void> {\n\t\tconst result = await this.transport.exec(removeProjectMemberFetcher, { projectSlug, identityId })\n\t\tthis.transport.assertOk(result.removeProjectMember, `removeProjectMember(${identityId})`)\n\t}\n\n\tprivate toInviteResult(response: InviteResponsePayload | undefined, operation: string): TenantInviteResult {\n\t\tthis.transport.assertOk(response, operation)\n\t\tconst result = response?.result\n\t\tif (!result) {\n\t\t\t// assertOk throws on every failure, so an ok payload without a result is a broken response, not a user error\n\t\t\tthrow new CliError(`${operation} reported success but returned no result.`, {\n\t\t\t\tcode: 'TENANT_API_INVALID_RESPONSE',\n\t\t\t\texitCode: ExitCode.InternalError,\n\t\t\t\tdetails: { operation },\n\t\t\t})\n\t\t}\n\t\treturn {\n\t\t\tpersonId: result.person.id,\n\t\t\tidentityId: result.person.identity.id,\n\t\t\temail: result.person.email ?? null,\n\t\t\tname: result.person.name ?? null,\n\t\t\tisNew: result.isNew,\n\t\t}\n\t}\n}\n\nconst toMembership = (membership: { role: string; variables: readonly { name: string; values: readonly string[] }[] }): TenantMembership => ({\n\trole: membership.role,\n\tvariables: membership.variables.map(variable => ({ name: variable.name, values: [...variable.values] })),\n})\n"],"names":["membership$","variableEntry$$","query$","project$","projectIdentityRelation$","identity$","person$","inviteResult$","mutation$","inviteResponse$$","inviteError$$","addProjectMemberResponse$$","addProjectMemberError$$","updateProjectMemberResponse$$","updateProjectMemberError$$","removeProjectMemberResponse$$","removeProjectMemberError$$","CliError","ExitCode"],"mappings":";;;;AA8FA,MAAM,oBAAoBA,UAAAA,YAAY,KAAK,UAAUC,UAAAA,eAAe;AACpE,MAAM,4BAA4BC,UAAAA,OAAO,mBAAmB,iBAAiB;AAC7E,MAAM,wBAAwBA,UAAAA,OAAO;AAAA,EACpCC,UAAAA,SAAS;AAAA,IACRC,UAAAA,yBACE,SAASC,UAAAA,UAAU,GAAG,YAAY,OAAOC,kBAAQ,GAAG,MAAM,IAAI,CAAC,EAC/D,YAAY,iBAAiB;AAAA,EAAA;AAEjC;AACA,MAAM,sBAAsBC,UAAAA,cAAc,MAAM,OAAOD,UAAAA,QAAQ,GAAG,MAAM,KAAK,SAASD,UAAAA,UAAU,EAAE,CAAC;AACnG,MAAM,gBAAgBG,UAAAA,UAAU,OAAOC,UAAAA,iBAAiB,MAAMC,uBAAa,EAAE,OAAO,mBAAmB,CAAC;AACxG,MAAM,yBAAyBF,UAAAA,UAAU,gBAAgBC,UAAAA,iBAAiB,MAAMC,uBAAa,EAAE,OAAO,mBAAmB,CAAC;AAC1H,MAAM,0BAA0BF,UAAAA,UAAU,iBAAiBG,UAAAA,2BAA2B,MAAMC,UAAAA,uBAAuB,CAAC;AACpH,MAAM,6BAA6BJ,UAAAA,UAAU,oBAAoBK,UAAAA,8BAA8B,MAAMC,UAAAA,0BAA0B,CAAC;AAChI,MAAM,6BAA6BN,UAAAA,UAAU,oBAAoBO,UAAAA,8BAA8B,MAAMC,UAAAA,0BAA0B,CAAC;AAGzH,MAAM,mBAAmB;AAAA,EAC/B,YACkB,WAChB;AADgB,SAAA,YAAA;AAAA,EAElB;AAAA,EAEA,MAAa,uBAAuB,aAAqB,YAAiD;AACzG,UAAM,SAAS,MAAM,KAAK,UAAU,KAAK,2BAA2B,EAAE,aAAa,YAAY;AAC/F,WAAO,OAAO,mBAAmB,IAAI,YAAY;AAAA,EAClD;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,MAAa,mBAAmB,aAAqB,EAAE,QAAQ,OAAO,OAAA,IAAmC,IAAoC;AAC5I,UAAM,SAAS,MAAM,KAAK,UAAU,KAAK,uBAAuB,EAAE,MAAM,aAAa,OAAO,EAAE,QAAQ,OAAO,OAAA,GAAU;AACvH,UAAM,UAAU,OAAO;AACvB,QAAI,CAAC,SAAS;AACb,YAAM,IAAIC,UAAAA,SAAS,WAAW,WAAW,mDAAmD;AAAA,QAC3F,MAAM;AAAA,QACN,UAAUC,UAAAA,SAAS;AAAA,QACnB,SAAS,EAAE,YAAA;AAAA,MAAY,CACvB;AAAA,IACF;AACA,WAAO,QAAQ,QAAQ,IAAI,CAAA,YAAW;AAAA,MACrC,YAAY,OAAO,SAAS;AAAA,MAC5B,UAAU,OAAO,SAAS,QAAQ,MAAM;AAAA,MACxC,OAAO,OAAO,SAAS,QAAQ,SAAS;AAAA,MACxC,MAAM,OAAO,SAAS,QAAQ,QAAQ;AAAA,MACtC,aAAa,OAAO,SAAS,eAAe;AAAA,MAC5C,aAAa,OAAO,YAAY,IAAI,YAAY;AAAA,IAAA,EAC/C;AAAA,EACH;AAAA;AAAA,EAGA,MAAa,OAAO,EAAE,aAAa,OAAO,MAAM,aAAa,WAAoD;AAChH,UAAM,SAAS,MAAM,KAAK,UAAU,KAAK,eAAe,EAAE,aAAa,OAAO,MAAM,aAAa,QAAA,CAAS;AAC1G,WAAO,KAAK,eAAe,OAAO,QAAQ,UAAU,KAAK,GAAG;AAAA,EAC7D;AAAA;AAAA,EAGA,MAAa,gBAAgB,EAAE,aAAa,OAAO,aAAa,WAA6D;AAC5H,UAAM,SAAS,MAAM,KAAK,UAAU,KAAK,wBAAwB,EAAE,aAAa,OAAO,aAAa,QAAA,CAAS;AAC7G,WAAO,KAAK,eAAe,OAAO,iBAAiB,mBAAmB,KAAK,GAAG;AAAA,EAC/E;AAAA,EAEA,MAAa,iBAAiB,aAAqB,YAAoB,aAAwD;AAC9H,UAAM,SAAS,MAAM,KAAK,UAAU,KAAK,yBAAyB,EAAE,aAAa,YAAY,aAAa;AAC1G,SAAK,UAAU,SAAS,OAAO,kBAAkB,oBAAoB,UAAU,GAAG;AAAA,EACnF;AAAA;AAAA,EAGA,MAAa,oBAAoB,aAAqB,YAAoB,aAAwD;AACjI,UAAM,SAAS,MAAM,KAAK,UAAU,KAAK,4BAA4B,EAAE,aAAa,YAAY,aAAa;AAC7G,SAAK,UAAU,SAAS,OAAO,qBAAqB,uBAAuB,UAAU,GAAG;AAAA,EACzF;AAAA,EAEA,MAAa,oBAAoB,aAAqB,YAAmC;AACxF,UAAM,SAAS,MAAM,KAAK,UAAU,KAAK,4BAA4B,EAAE,aAAa,YAAY;AAChG,SAAK,UAAU,SAAS,OAAO,qBAAqB,uBAAuB,UAAU,GAAG;AAAA,EACzF;AAAA,EAEQ,eAAe,UAA6C,WAAuC;AAC1G,SAAK,UAAU,SAAS,UAAU,SAAS;AAC3C,UAAM,SAAS,UAAU;AACzB,QAAI,CAAC,QAAQ;AAEZ,YAAM,IAAID,UAAAA,SAAS,GAAG,SAAS,6CAA6C;AAAA,QAC3E,MAAM;AAAA,QACN,UAAUC,UAAAA,SAAS;AAAA,QACnB,SAAS,EAAE,UAAA;AAAA,MAAU,CACrB;AAAA,IACF;AACA,WAAO;AAAA,MACN,UAAU,OAAO,OAAO;AAAA,MACxB,YAAY,OAAO,OAAO,SAAS;AAAA,MACnC,OAAO,OAAO,OAAO,SAAS;AAAA,MAC9B,MAAM,OAAO,OAAO,QAAQ;AAAA,MAC5B,OAAO,OAAO;AAAA,IAAA;AAAA,EAEhB;AACD;AAEA,MAAM,eAAe,CAAC,gBAAuH;AAAA,EAC5I,MAAM,WAAW;AAAA,EACjB,WAAW,WAAW,UAAU,IAAI,eAAa,EAAE,MAAM,SAAS,MAAM,QAAQ,CAAC,GAAG,SAAS,MAAM,IAAI;AACxG;;"}

package/dist/production/src/lib/tenant/clients/TenantMemberClient.js

@@ -0,0 +1,96 @@
+import { CliError, ExitCode } from "@contember/cli-common";
+import { membership$, variableEntry$$, query$, project$, projectIdentityRelation$, identity$, person$, inviteResult$, mutation$, inviteResponse$$, inviteError$$, addProjectMemberResponse$$, addProjectMemberError$$, updateProjectMemberResponse$$, updateProjectMemberError$$, removeProjectMemberResponse$$, removeProjectMemberError$$ } from "@contember/graphql-client-tenant";
+const membershipFetcher = membership$.role.variables(variableEntry$$);
+const projectMembershipsFetcher = query$.projectMemberships(membershipFetcher);
+const projectMembersFetcher = query$.projectBySlug(
+  project$.members(
+    projectIdentityRelation$.identity(identity$.id.description.person(person$.id.email.name)).memberships(membershipFetcher)
+  )
+);
+const inviteResultFetcher = inviteResult$.isNew.person(person$.id.email.name.identity(identity$.id));
+const inviteFetcher = mutation$.invite(inviteResponse$$.error(inviteError$$).result(inviteResultFetcher));
+const unmanagedInviteFetcher = mutation$.unmanagedInvite(inviteResponse$$.error(inviteError$$).result(inviteResultFetcher));
+const addProjectMemberFetcher = mutation$.addProjectMember(addProjectMemberResponse$$.error(addProjectMemberError$$));
+const updateProjectMemberFetcher = mutation$.updateProjectMember(updateProjectMemberResponse$$.error(updateProjectMemberError$$));
+const removeProjectMemberFetcher = mutation$.removeProjectMember(removeProjectMemberResponse$$.error(removeProjectMemberError$$));
+class TenantMemberClient {
+  constructor(transport) {
+    this.transport = transport;
+  }
+  async listProjectMemberships(projectSlug, identityId) {
+    const result = await this.transport.exec(projectMembershipsFetcher, { projectSlug, identityId });
+    return result.projectMemberships.map(toMembership);
+  }
+  /**
+   * Lists every member of a project. The tenant API answers with an empty list — not an error — when the
+   * caller lacks the `project.view members` permission, so an empty result is not proof the project is empty.
+   */
+  async listProjectMembers(projectSlug, { filter, limit, offset } = {}) {
+    const result = await this.transport.exec(projectMembersFetcher, { slug: projectSlug, input: { filter, limit, offset } });
+    const project = result.projectBySlug;
+    if (!project) {
+      throw new CliError(`Project ${projectSlug} was not found or is not visible to this token.`, {
+        code: "PROJECT_NOT_FOUND",
+        exitCode: ExitCode.NotFound,
+        details: { projectSlug }
+      });
+    }
+    return project.members.map((member) => ({
+      identityId: member.identity.id,
+      personId: member.identity.person?.id ?? null,
+      email: member.identity.person?.email ?? null,
+      name: member.identity.person?.name ?? null,
+      description: member.identity.description ?? null,
+      memberships: member.memberships.map(toMembership)
+    }));
+  }
+  /** Invites a person, letting the tenant deliver the credentials by mail. */
+  async invite({ projectSlug, email, name, memberships, options }) {
+    const result = await this.transport.exec(inviteFetcher, { projectSlug, email, name, memberships, options });
+    return this.toInviteResult(result.invite, `invite(${email})`);
+  }
+  /** Invites a person without any mail — the caller supplies the password or the reset token hash. */
+  async unmanagedInvite({ projectSlug, email, memberships, options }) {
+    const result = await this.transport.exec(unmanagedInviteFetcher, { projectSlug, email, memberships, options });
+    return this.toInviteResult(result.unmanagedInvite, `unmanagedInvite(${email})`);
+  }
+  async addProjectMember(projectSlug, identityId, memberships) {
+    const result = await this.transport.exec(addProjectMemberFetcher, { projectSlug, identityId, memberships });
+    this.transport.assertOk(result.addProjectMember, `addProjectMember(${identityId})`);
+  }
+  /** Replaces all memberships of an existing member — anything not passed is removed. */
+  async updateProjectMember(projectSlug, identityId, memberships) {
+    const result = await this.transport.exec(updateProjectMemberFetcher, { projectSlug, identityId, memberships });
+    this.transport.assertOk(result.updateProjectMember, `updateProjectMember(${identityId})`);
+  }
+  async removeProjectMember(projectSlug, identityId) {
+    const result = await this.transport.exec(removeProjectMemberFetcher, { projectSlug, identityId });
+    this.transport.assertOk(result.removeProjectMember, `removeProjectMember(${identityId})`);
+  }
+  toInviteResult(response, operation) {
+    this.transport.assertOk(response, operation);
+    const result = response?.result;
+    if (!result) {
+      throw new CliError(`${operation} reported success but returned no result.`, {
+        code: "TENANT_API_INVALID_RESPONSE",
+        exitCode: ExitCode.InternalError,
+        details: { operation }
+      });
+    }
+    return {
+      personId: result.person.id,
+      identityId: result.person.identity.id,
+      email: result.person.email ?? null,
+      name: result.person.name ?? null,
+      isNew: result.isNew
+    };
+  }
+}
+const toMembership = (membership) => ({
+  role: membership.role,
+  variables: membership.variables.map((variable) => ({ name: variable.name, values: [...variable.values] }))
+});
+export {
+  TenantMemberClient
+};
+//# sourceMappingURL=TenantMemberClient.js.map

package/dist/production/src/lib/tenant/clients/TenantMemberClient.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"TenantMemberClient.js","sources":["../../../../../../../packages/cli/src/lib/tenant/clients/TenantMemberClient.ts"],"sourcesContent":["import { CliError, ExitCode } from '@contember/cli-common'\nimport {\n\taddProjectMemberError$$,\n\taddProjectMemberResponse$$,\n\tidentity$,\n\tinviteError$$,\n\ttype InviteOptions,\n\tinviteResponse$$,\n\tinviteResult$,\n\tmembership$,\n\ttype MembershipInput,\n\tmutation$,\n\tperson$,\n\tproject$,\n\tprojectIdentityRelation$,\n\ttype ProjectMembersFilter,\n\tquery$,\n\tremoveProjectMemberError$$,\n\tremoveProjectMemberResponse$$,\n\ttype UnmanagedInviteOptions,\n\tupdateProjectMemberError$$,\n\tupdateProjectMemberResponse$$,\n\tvariableEntry$$,\n} from '@contember/graphql-client-tenant'\nimport { TenantApiTransport } from '../TenantApiTransport.js'\n\nexport interface TenantMembershipVariable {\n\tname: string\n\tvalues: string[]\n}\n\nexport interface TenantMembership {\n\trole: string\n\tvariables: TenantMembershipVariable[]\n}\n\n/** One member of a project — the identity, the person behind it when there is one, and its memberships. */\nexport interface TenantProjectMember {\n\tidentityId: string\n\t/** Null for an API key member — those have no person. */\n\tpersonId: string | null\n\temail: string | null\n\tname: string | null\n\t/** Identity label, the only human-readable name an API key member has. */\n\tdescription: string | null\n\tmemberships: TenantMembership[]\n}\n\nexport interface ListProjectMembersArgs {\n\tfilter?: ProjectMembersFilter\n\tlimit?: number\n\toffset?: number\n}\n\nexport interface InviteArgs {\n\tprojectSlug: string\n\temail: string\n\tname?: string\n\tmemberships: readonly MembershipInput[]\n\toptions?: InviteOptions\n}\n\nexport interface UnmanagedInviteArgs {\n\tprojectSlug: string\n\temail: string\n\tmemberships: readonly MembershipInput[]\n\toptions?: UnmanagedInviteOptions\n}\n\nexport interface TenantInviteResult {\n\tpersonId: string\n\tidentityId: string\n\temail: string | null\n\tname: string | null\n\t/** False when the person already existed and was only added to the project. */\n\tisNew: boolean\n}\n\n/** The part of an `InviteResponse` selection this client reads — shared by `invite` and `unmanagedInvite`. */\ninterface InviteResponsePayload {\n\treadonly ok: boolean\n\treadonly error?: { readonly code: string; readonly developerMessage: string } | null\n\treadonly result?: {\n\t\treadonly isNew: boolean\n\t\treadonly person: {\n\t\t\treadonly id: string\n\t\t\treadonly email?: string\n\t\t\treadonly name?: string\n\t\t\treadonly identity: { readonly id: string }\n\t\t}\n\t} | null\n}\n\n// Fetchers are immutable and reusable, so they are built once at module load.\nconst membershipFetcher = membership$.role.variables(variableEntry$$)\nconst projectMembershipsFetcher = query$.projectMemberships(membershipFetcher)\nconst projectMembersFetcher = query$.projectBySlug(\n\tproject$.members(\n\t\tprojectIdentityRelation$\n\t\t\t.identity(identity$.id.description.person(person$.id.email.name))\n\t\t\t.memberships(membershipFetcher),\n\t),\n)\nconst inviteResultFetcher = inviteResult$.isNew.person(person$.id.email.name.identity(identity$.id))\nconst inviteFetcher = mutation$.invite(inviteResponse$$.error(inviteError$$).result(inviteResultFetcher))\nconst unmanagedInviteFetcher = mutation$.unmanagedInvite(inviteResponse$$.error(inviteError$$).result(inviteResultFetcher))\nconst addProjectMemberFetcher = mutation$.addProjectMember(addProjectMemberResponse$$.error(addProjectMemberError$$))\nconst updateProjectMemberFetcher = mutation$.updateProjectMember(updateProjectMemberResponse$$.error(updateProjectMemberError$$))\nconst removeProjectMemberFetcher = mutation$.removeProjectMember(removeProjectMemberResponse$$.error(removeProjectMemberError$$))\n\n/** Project memberships and invites. */\nexport class TenantMemberClient {\n\tconstructor(\n\t\tprivate readonly transport: TenantApiTransport,\n\t) {\n\t}\n\n\tpublic async listProjectMemberships(projectSlug: string, identityId: string): Promise<TenantMembership[]> {\n\t\tconst result = await this.transport.exec(projectMembershipsFetcher, { projectSlug, identityId })\n\t\treturn result.projectMemberships.map(toMembership)\n\t}\n\n\t/**\n\t * Lists every member of a project. The tenant API answers with an empty list — not an error — when the\n\t * caller lacks the `project.view members` permission, so an empty result is not proof the project is empty.\n\t */\n\tpublic async listProjectMembers(projectSlug: string, { filter, limit, offset }: ListProjectMembersArgs = {}): Promise<TenantProjectMember[]> {\n\t\tconst result = await this.transport.exec(projectMembersFetcher, { slug: projectSlug, input: { filter, limit, offset } })\n\t\tconst project = result.projectBySlug\n\t\tif (!project) {\n\t\t\tthrow new CliError(`Project ${projectSlug} was not found or is not visible to this token.`, {\n\t\t\t\tcode: 'PROJECT_NOT_FOUND',\n\t\t\t\texitCode: ExitCode.NotFound,\n\t\t\t\tdetails: { projectSlug },\n\t\t\t})\n\t\t}\n\t\treturn project.members.map(member => ({\n\t\t\tidentityId: member.identity.id,\n\t\t\tpersonId: member.identity.person?.id ?? null,\n\t\t\temail: member.identity.person?.email ?? null,\n\t\t\tname: member.identity.person?.name ?? null,\n\t\t\tdescription: member.identity.description ?? null,\n\t\t\tmemberships: member.memberships.map(toMembership),\n\t\t}))\n\t}\n\n\t/** Invites a person, letting the tenant deliver the credentials by mail. */\n\tpublic async invite({ projectSlug, email, name, memberships, options }: InviteArgs): Promise<TenantInviteResult> {\n\t\tconst result = await this.transport.exec(inviteFetcher, { projectSlug, email, name, memberships, options })\n\t\treturn this.toInviteResult(result.invite, `invite(${email})`)\n\t}\n\n\t/** Invites a person without any mail — the caller supplies the password or the reset token hash. */\n\tpublic async unmanagedInvite({ projectSlug, email, memberships, options }: UnmanagedInviteArgs): Promise<TenantInviteResult> {\n\t\tconst result = await this.transport.exec(unmanagedInviteFetcher, { projectSlug, email, memberships, options })\n\t\treturn this.toInviteResult(result.unmanagedInvite, `unmanagedInvite(${email})`)\n\t}\n\n\tpublic async addProjectMember(projectSlug: string, identityId: string, memberships: readonly MembershipInput[]): Promise<void> {\n\t\tconst result = await this.transport.exec(addProjectMemberFetcher, { projectSlug, identityId, memberships })\n\t\tthis.transport.assertOk(result.addProjectMember, `addProjectMember(${identityId})`)\n\t}\n\n\t/** Replaces all memberships of an existing member — anything not passed is removed. */\n\tpublic async updateProjectMember(projectSlug: string, identityId: string, memberships: readonly MembershipInput[]): Promise<void> {\n\t\tconst result = await this.transport.exec(updateProjectMemberFetcher, { projectSlug, identityId, memberships })\n\t\tthis.transport.assertOk(result.updateProjectMember, `updateProjectMember(${identityId})`)\n\t}\n\n\tpublic async removeProjectMember(projectSlug: string, identityId: string): Promise<void> {\n\t\tconst result = await this.transport.exec(removeProjectMemberFetcher, { projectSlug, identityId })\n\t\tthis.transport.assertOk(result.removeProjectMember, `removeProjectMember(${identityId})`)\n\t}\n\n\tprivate toInviteResult(response: InviteResponsePayload | undefined, operation: string): TenantInviteResult {\n\t\tthis.transport.assertOk(response, operation)\n\t\tconst result = response?.result\n\t\tif (!result) {\n\t\t\t// assertOk throws on every failure, so an ok payload without a result is a broken response, not a user error\n\t\t\tthrow new CliError(`${operation} reported success but returned no result.`, {\n\t\t\t\tcode: 'TENANT_API_INVALID_RESPONSE',\n\t\t\t\texitCode: ExitCode.InternalError,\n\t\t\t\tdetails: { operation },\n\t\t\t})\n\t\t}\n\t\treturn {\n\t\t\tpersonId: result.person.id,\n\t\t\tidentityId: result.person.identity.id,\n\t\t\temail: result.person.email ?? null,\n\t\t\tname: result.person.name ?? null,\n\t\t\tisNew: result.isNew,\n\t\t}\n\t}\n}\n\nconst toMembership = (membership: { role: string; variables: readonly { name: string; values: readonly string[] }[] }): TenantMembership => ({\n\trole: membership.role,\n\tvariables: membership.variables.map(variable => ({ name: variable.name, values: [...variable.values] })),\n})\n"],"names":[],"mappings":";;AA8FA,MAAM,oBAAoB,YAAY,KAAK,UAAU,eAAe;AACpE,MAAM,4BAA4B,OAAO,mBAAmB,iBAAiB;AAC7E,MAAM,wBAAwB,OAAO;AAAA,EACpC,SAAS;AAAA,IACR,yBACE,SAAS,UAAU,GAAG,YAAY,OAAO,QAAQ,GAAG,MAAM,IAAI,CAAC,EAC/D,YAAY,iBAAiB;AAAA,EAAA;AAEjC;AACA,MAAM,sBAAsB,cAAc,MAAM,OAAO,QAAQ,GAAG,MAAM,KAAK,SAAS,UAAU,EAAE,CAAC;AACnG,MAAM,gBAAgB,UAAU,OAAO,iBAAiB,MAAM,aAAa,EAAE,OAAO,mBAAmB,CAAC;AACxG,MAAM,yBAAyB,UAAU,gBAAgB,iBAAiB,MAAM,aAAa,EAAE,OAAO,mBAAmB,CAAC;AAC1H,MAAM,0BAA0B,UAAU,iBAAiB,2BAA2B,MAAM,uBAAuB,CAAC;AACpH,MAAM,6BAA6B,UAAU,oBAAoB,8BAA8B,MAAM,0BAA0B,CAAC;AAChI,MAAM,6BAA6B,UAAU,oBAAoB,8BAA8B,MAAM,0BAA0B,CAAC;AAGzH,MAAM,mBAAmB;AAAA,EAC/B,YACkB,WAChB;AADgB,SAAA,YAAA;AAAA,EAElB;AAAA,EAEA,MAAa,uBAAuB,aAAqB,YAAiD;AACzG,UAAM,SAAS,MAAM,KAAK,UAAU,KAAK,2BAA2B,EAAE,aAAa,YAAY;AAC/F,WAAO,OAAO,mBAAmB,IAAI,YAAY;AAAA,EAClD;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,MAAa,mBAAmB,aAAqB,EAAE,QAAQ,OAAO,OAAA,IAAmC,IAAoC;AAC5I,UAAM,SAAS,MAAM,KAAK,UAAU,KAAK,uBAAuB,EAAE,MAAM,aAAa,OAAO,EAAE,QAAQ,OAAO,OAAA,GAAU;AACvH,UAAM,UAAU,OAAO;AACvB,QAAI,CAAC,SAAS;AACb,YAAM,IAAI,SAAS,WAAW,WAAW,mDAAmD;AAAA,QAC3F,MAAM;AAAA,QACN,UAAU,SAAS;AAAA,QACnB,SAAS,EAAE,YAAA;AAAA,MAAY,CACvB;AAAA,IACF;AACA,WAAO,QAAQ,QAAQ,IAAI,CAAA,YAAW;AAAA,MACrC,YAAY,OAAO,SAAS;AAAA,MAC5B,UAAU,OAAO,SAAS,QAAQ,MAAM;AAAA,MACxC,OAAO,OAAO,SAAS,QAAQ,SAAS;AAAA,MACxC,MAAM,OAAO,SAAS,QAAQ,QAAQ;AAAA,MACtC,aAAa,OAAO,SAAS,eAAe;AAAA,MAC5C,aAAa,OAAO,YAAY,IAAI,YAAY;AAAA,IAAA,EAC/C;AAAA,EACH;AAAA;AAAA,EAGA,MAAa,OAAO,EAAE,aAAa,OAAO,MAAM,aAAa,WAAoD;AAChH,UAAM,SAAS,MAAM,KAAK,UAAU,KAAK,eAAe,EAAE,aAAa,OAAO,MAAM,aAAa,QAAA,CAAS;AAC1G,WAAO,KAAK,eAAe,OAAO,QAAQ,UAAU,KAAK,GAAG;AAAA,EAC7D;AAAA;AAAA,EAGA,MAAa,gBAAgB,EAAE,aAAa,OAAO,aAAa,WAA6D;AAC5H,UAAM,SAAS,MAAM,KAAK,UAAU,KAAK,wBAAwB,EAAE,aAAa,OAAO,aAAa,QAAA,CAAS;AAC7G,WAAO,KAAK,eAAe,OAAO,iBAAiB,mBAAmB,KAAK,GAAG;AAAA,EAC/E;AAAA,EAEA,MAAa,iBAAiB,aAAqB,YAAoB,aAAwD;AAC9H,UAAM,SAAS,MAAM,KAAK,UAAU,KAAK,yBAAyB,EAAE,aAAa,YAAY,aAAa;AAC1G,SAAK,UAAU,SAAS,OAAO,kBAAkB,oBAAoB,UAAU,GAAG;AAAA,EACnF;AAAA;AAAA,EAGA,MAAa,oBAAoB,aAAqB,YAAoB,aAAwD;AACjI,UAAM,SAAS,MAAM,KAAK,UAAU,KAAK,4BAA4B,EAAE,aAAa,YAAY,aAAa;AAC7G,SAAK,UAAU,SAAS,OAAO,qBAAqB,uBAAuB,UAAU,GAAG;AAAA,EACzF;AAAA,EAEA,MAAa,oBAAoB,aAAqB,YAAmC;AACxF,UAAM,SAAS,MAAM,KAAK,UAAU,KAAK,4BAA4B,EAAE,aAAa,YAAY;AAChG,SAAK,UAAU,SAAS,OAAO,qBAAqB,uBAAuB,UAAU,GAAG;AAAA,EACzF;AAAA,EAEQ,eAAe,UAA6C,WAAuC;AAC1G,SAAK,UAAU,SAAS,UAAU,SAAS;AAC3C,UAAM,SAAS,UAAU;AACzB,QAAI,CAAC,QAAQ;AAEZ,YAAM,IAAI,SAAS,GAAG,SAAS,6CAA6C;AAAA,QAC3E,MAAM;AAAA,QACN,UAAU,SAAS;AAAA,QACnB,SAAS,EAAE,UAAA;AAAA,MAAU,CACrB;AAAA,IACF;AACA,WAAO;AAAA,MACN,UAAU,OAAO,OAAO;AAAA,MACxB,YAAY,OAAO,OAAO,SAAS;AAAA,MACnC,OAAO,OAAO,OAAO,SAAS;AAAA,MAC9B,MAAM,OAAO,OAAO,QAAQ;AAAA,MAC5B,OAAO,OAAO;AAAA,IAAA;AAAA,EAEhB;AACD;AAEA,MAAM,eAAe,CAAC,gBAAuH;AAAA,EAC5I,MAAM,WAAW;AAAA,EACjB,WAAW,WAAW,UAAU,IAAI,eAAa,EAAE,MAAM,SAAS,MAAM,QAAQ,CAAC,GAAG,SAAS,MAAM,IAAI;AACxG;"}