@contember/cli 2.2.0-alpha.3 → 2.2.0-alpha.5

package/dist/production/src/lib/tenant/clients/TenantPolicyClient.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"TenantPolicyClient.js","sources":["../../../../../../../packages/cli/src/lib/tenant/clients/TenantPolicyClient.ts"],"sourcesContent":["import { CliError, ExitCode } from '@contember/cli-common'\nimport {\n\taddMailTemplateError$$,\n\taddMailTemplateResponse$$,\n\tauthLogEntry$$,\n\ttype AuthLogFilter,\n\tauthLogPage$,\n\tauthPolicy$$,\n\ttype AuthPolicyInput,\n\ttype AuthPolicyScope,\n\tcreateAuthPolicyError$$,\n\tcreateAuthPolicyResponse$$,\n\tcreateAuthPolicyResult$$,\n\tdeleteAuthPolicyError$$,\n\tdeleteAuthPolicyResponse$$,\n\tmailTemplateData$$,\n\ttype MailTemplateIdentifier,\n\ttype MailType,\n\tmutation$,\n\tquery$,\n\tremoveMailTemplateError$$,\n\tremoveMailTemplateResponse$$,\n\tupdateAuthPolicyError$$,\n\tupdateAuthPolicyResponse$$,\n} from '@contember/graphql-client-tenant'\nimport { describeAuthPolicy } from '../authPolicy.js'\nimport { TenantApiTransport } from '../TenantApiTransport.js'\nimport { TenantMailTemplate } from '../tenantConfig.js'\n\n/** A policy as it exists server-side. The config-side counterpart is `TenantAuthPolicy` in `tenantConfig.ts`. */\nexport interface RemoteAuthPolicy {\n\tid: string\n\tscope: AuthPolicyScope\n\t/** Project slug, `null` for a global policy. */\n\tproject: string | null\n\troles: string[]\n\tmfaRequired: boolean | null\n\t/** ISO 8601 duration, e.g. `PT1H`. */\n\ttokenExpiration: string | null\n\tidleTimeout: string | null\n\tmfaGraceDuration: string | null\n\trememberMeAllowed: boolean | null\n}\n\nexport interface TenantMailTemplateData {\n\tprojectSlug: string | null\n\ttype: MailType\n\tvariant: string | null\n\tsubject: string\n\tcontent: string\n\tuseLayout: boolean\n\treplyTo: string | null\n}\n\nexport interface TenantAuthLogEntry {\n\tid: string\n\tcreatedAt: string\n\ttype: string\n\tsuccess: boolean\n\tinvokedByIdentityId: string | null\n\tpersonId: string | null\n\ttargetPersonId: string | null\n\tpersonInputIdentifier: string | null\n\terrorCode: string | null\n\terrorMessage: string | null\n\tipAddress: string | null\n\tuserAgent: string | null\n\tidentityProviderId: string | null\n\tmetadata: unknown\n\teventData: unknown\n}\n\nexport interface TenantAuthLogPage {\n\tentries: TenantAuthLogEntry[]\n\t/** True when more rows exist past `offset + entries.length`. */\n\thasMore: boolean\n}\n\nexport interface ReadAuthLogArgs {\n\tfilter?: AuthLogFilter\n\tlimit?: number\n\toffset?: number\n}\n\n// Fetchers are immutable and reusable, so they are built once at module load.\nconst authPoliciesFetcher = query$.authPolicies(authPolicy$$)\nconst createAuthPolicyFetcher = mutation$.createAuthPolicy(\n\tcreateAuthPolicyResponse$$.error(createAuthPolicyError$$).result(createAuthPolicyResult$$),\n)\nconst updateAuthPolicyFetcher = mutation$.updateAuthPolicy(updateAuthPolicyResponse$$.error(updateAuthPolicyError$$))\nconst deleteAuthPolicyFetcher = mutation$.deleteAuthPolicy(deleteAuthPolicyResponse$$.error(deleteAuthPolicyError$$))\nconst mailTemplatesFetcher = query$.mailTemplates(mailTemplateData$$)\nconst addMailTemplateFetcher = mutation$.addMailTemplate(addMailTemplateResponse$$.error(addMailTemplateError$$))\nconst removeMailTemplateFetcher = mutation$.removeMailTemplate(removeMailTemplateResponse$$.error(removeMailTemplateError$$))\nconst authLogFetcher = query$.authLog(authLogPage$.hasMore.entries(authLogEntry$$))\n\n/** Auth policies, mail templates and the auth log. */\nexport class TenantPolicyClient {\n\tconstructor(\n\t\tprivate readonly transport: TenantApiTransport,\n\t) {\n\t}\n\n\tpublic async listAuthPolicies(): Promise<RemoteAuthPolicy[]> {\n\t\tconst result = await this.transport.exec(authPoliciesFetcher, {})\n\t\treturn result.authPolicies.map(it => ({\n\t\t\tid: it.id,\n\t\t\tscope: it.scope,\n\t\t\tproject: it.project ?? null,\n\t\t\troles: [...it.roles],\n\t\t\tmfaRequired: it.mfaRequired ?? null,\n\t\t\ttokenExpiration: it.tokenExpiration ?? null,\n\t\t\tidleTimeout: it.idleTimeout ?? null,\n\t\t\tmfaGraceDuration: it.mfaGraceDuration ?? null,\n\t\t\trememberMeAllowed: it.rememberMeAllowed ?? null,\n\t\t}))\n\t}\n\n\t/** Returns the id of the created policy — the only thing `createAuthPolicy` hands back. */\n\tpublic async createAuthPolicy(policy: AuthPolicyInput): Promise<string> {\n\t\tconst result = await this.transport.exec(createAuthPolicyFetcher, { policy })\n\t\t// a policy has no slug, so the target is the only thing that identifies it in an error\n\t\tthis.transport.assertOk(result.createAuthPolicy, `createAuthPolicy(${describeAuthPolicy(policy)})`)\n\t\tconst id = result.createAuthPolicy?.result?.id\n\t\tif (id === undefined) {\n\t\t\t// ok without a result breaks the schema contract, so there is nothing sensible to report back\n\t\t\tthrow new CliError(`createAuthPolicy(${describeAuthPolicy(policy)}) reported success without returning an id.`, {\n\t\t\t\tcode: 'TENANT_API_INVALID_RESPONSE',\n\t\t\t\texitCode: ExitCode.InternalError,\n\t\t\t})\n\t\t}\n\t\treturn id\n\t}\n\n\tpublic async updateAuthPolicy(id: string, policy: AuthPolicyInput): Promise<void> {\n\t\tconst result = await this.transport.exec(updateAuthPolicyFetcher, { id, policy })\n\t\tthis.transport.assertOk(result.updateAuthPolicy, `updateAuthPolicy(${id}: ${describeAuthPolicy(policy)})`)\n\t}\n\n\tpublic async deleteAuthPolicy(id: string): Promise<void> {\n\t\tconst result = await this.transport.exec(deleteAuthPolicyFetcher, { id })\n\t\tthis.transport.assertOk(result.deleteAuthPolicy, `deleteAuthPolicy(${id})`)\n\t}\n\n\tpublic async listMailTemplates(): Promise<TenantMailTemplateData[]> {\n\t\tconst result = await this.transport.exec(mailTemplatesFetcher, {})\n\t\treturn result.mailTemplates.map(it => ({\n\t\t\tprojectSlug: it.projectSlug ?? null,\n\t\t\ttype: it.type,\n\t\t\tvariant: it.variant ?? null,\n\t\t\tsubject: it.subject,\n\t\t\tcontent: it.content,\n\t\t\tuseLayout: it.useLayout,\n\t\t\treplyTo: it.replyTo ?? null,\n\t\t}))\n\t}\n\n\tpublic async addMailTemplate(template: TenantMailTemplate): Promise<void> {\n\t\tconst result = await this.transport.exec(addMailTemplateFetcher, { template })\n\t\tthis.transport.assertOk(result.addMailTemplate, `addMailTemplate(${template.type}/${template.variant ?? ''})`)\n\t}\n\n\t/** A template is addressed by the `projectSlug`/`type`/`variant` triple — it has no id of its own. */\n\tpublic async removeMailTemplate(templateIdentifier: MailTemplateIdentifier): Promise<void> {\n\t\tconst result = await this.transport.exec(removeMailTemplateFetcher, { templateIdentifier })\n\t\tthis.transport.assertOk(result.removeMailTemplate, `removeMailTemplate(${templateIdentifier.type}/${templateIdentifier.variant ?? ''})`)\n\t}\n\n\tpublic async readAuthLog({ filter, limit, offset }: ReadAuthLogArgs = {}): Promise<TenantAuthLogPage> {\n\t\tconst result = await this.transport.exec(authLogFetcher, { filter, limit, offset })\n\t\treturn {\n\t\t\thasMore: result.authLog.hasMore,\n\t\t\tentries: result.authLog.entries.map(it => ({\n\t\t\t\tid: it.id,\n\t\t\t\tcreatedAt: it.createdAt,\n\t\t\t\ttype: it.type,\n\t\t\t\tsuccess: it.success,\n\t\t\t\tinvokedByIdentityId: it.invokedByIdentityId ?? null,\n\t\t\t\tpersonId: it.personId ?? null,\n\t\t\t\ttargetPersonId: it.targetPersonId ?? null,\n\t\t\t\tpersonInputIdentifier: it.personInputIdentifier ?? null,\n\t\t\t\terrorCode: it.errorCode ?? null,\n\t\t\t\terrorMessage: it.errorMessage ?? null,\n\t\t\t\tipAddress: it.ipAddress ?? null,\n\t\t\t\tuserAgent: it.userAgent ?? null,\n\t\t\t\tidentityProviderId: it.identityProviderId ?? null,\n\t\t\t\tmetadata: it.metadata ?? null,\n\t\t\t\teventData: it.eventData ?? null,\n\t\t\t})),\n\t\t}\n\t}\n}\n"],"names":[],"mappings":";;;AAqFA,MAAM,sBAAsB,OAAO,aAAa,YAAY;AAC5D,MAAM,0BAA0B,UAAU;AAAA,EACzC,2BAA2B,MAAM,uBAAuB,EAAE,OAAO,wBAAwB;AAC1F;AACA,MAAM,0BAA0B,UAAU,iBAAiB,2BAA2B,MAAM,uBAAuB,CAAC;AACpH,MAAM,0BAA0B,UAAU,iBAAiB,2BAA2B,MAAM,uBAAuB,CAAC;AACpH,MAAM,uBAAuB,OAAO,cAAc,kBAAkB;AACpE,MAAM,yBAAyB,UAAU,gBAAgB,0BAA0B,MAAM,sBAAsB,CAAC;AAChH,MAAM,4BAA4B,UAAU,mBAAmB,6BAA6B,MAAM,yBAAyB,CAAC;AAC5H,MAAM,iBAAiB,OAAO,QAAQ,aAAa,QAAQ,QAAQ,cAAc,CAAC;AAG3E,MAAM,mBAAmB;AAAA,EAC/B,YACkB,WAChB;AADgB,SAAA,YAAA;AAAA,EAElB;AAAA,EAEA,MAAa,mBAAgD;AAC5D,UAAM,SAAS,MAAM,KAAK,UAAU,KAAK,qBAAqB,EAAE;AAChE,WAAO,OAAO,aAAa,IAAI,CAAA,QAAO;AAAA,MACrC,IAAI,GAAG;AAAA,MACP,OAAO,GAAG;AAAA,MACV,SAAS,GAAG,WAAW;AAAA,MACvB,OAAO,CAAC,GAAG,GAAG,KAAK;AAAA,MACnB,aAAa,GAAG,eAAe;AAAA,MAC/B,iBAAiB,GAAG,mBAAmB;AAAA,MACvC,aAAa,GAAG,eAAe;AAAA,MAC/B,kBAAkB,GAAG,oBAAoB;AAAA,MACzC,mBAAmB,GAAG,qBAAqB;AAAA,IAAA,EAC1C;AAAA,EACH;AAAA;AAAA,EAGA,MAAa,iBAAiB,QAA0C;AACvE,UAAM,SAAS,MAAM,KAAK,UAAU,KAAK,yBAAyB,EAAE,QAAQ;AAE5E,SAAK,UAAU,SAAS,OAAO,kBAAkB,oBAAoB,mBAAmB,MAAM,CAAC,GAAG;AAClG,UAAM,KAAK,OAAO,kBAAkB,QAAQ;AAC5C,QAAI,OAAO,QAAW;AAErB,YAAM,IAAI,SAAS,oBAAoB,mBAAmB,MAAM,CAAC,+CAA+C;AAAA,QAC/G,MAAM;AAAA,QACN,UAAU,SAAS;AAAA,MAAA,CACnB;AAAA,IACF;AACA,WAAO;AAAA,EACR;AAAA,EAEA,MAAa,iBAAiB,IAAY,QAAwC;AACjF,UAAM,SAAS,MAAM,KAAK,UAAU,KAAK,yBAAyB,EAAE,IAAI,QAAQ;AAChF,SAAK,UAAU,SAAS,OAAO,kBAAkB,oBAAoB,EAAE,KAAK,mBAAmB,MAAM,CAAC,GAAG;AAAA,EAC1G;AAAA,EAEA,MAAa,iBAAiB,IAA2B;AACxD,UAAM,SAAS,MAAM,KAAK,UAAU,KAAK,yBAAyB,EAAE,IAAI;AACxE,SAAK,UAAU,SAAS,OAAO,kBAAkB,oBAAoB,EAAE,GAAG;AAAA,EAC3E;AAAA,EAEA,MAAa,oBAAuD;AACnE,UAAM,SAAS,MAAM,KAAK,UAAU,KAAK,sBAAsB,EAAE;AACjE,WAAO,OAAO,cAAc,IAAI,CAAA,QAAO;AAAA,MACtC,aAAa,GAAG,eAAe;AAAA,MAC/B,MAAM,GAAG;AAAA,MACT,SAAS,GAAG,WAAW;AAAA,MACvB,SAAS,GAAG;AAAA,MACZ,SAAS,GAAG;AAAA,MACZ,WAAW,GAAG;AAAA,MACd,SAAS,GAAG,WAAW;AAAA,IAAA,EACtB;AAAA,EACH;AAAA,EAEA,MAAa,gBAAgB,UAA6C;AACzE,UAAM,SAAS,MAAM,KAAK,UAAU,KAAK,wBAAwB,EAAE,UAAU;AAC7E,SAAK,UAAU,SAAS,OAAO,iBAAiB,mBAAmB,SAAS,IAAI,IAAI,SAAS,WAAW,EAAE,GAAG;AAAA,EAC9G;AAAA;AAAA,EAGA,MAAa,mBAAmB,oBAA2D;AAC1F,UAAM,SAAS,MAAM,KAAK,UAAU,KAAK,2BAA2B,EAAE,oBAAoB;AAC1F,SAAK,UAAU,SAAS,OAAO,oBAAoB,sBAAsB,mBAAmB,IAAI,IAAI,mBAAmB,WAAW,EAAE,GAAG;AAAA,EACxI;AAAA,EAEA,MAAa,YAAY,EAAE,QAAQ,OAAO,OAAA,IAA4B,CAAA,GAAgC;AACrG,UAAM,SAAS,MAAM,KAAK,UAAU,KAAK,gBAAgB,EAAE,QAAQ,OAAO,QAAQ;AAClF,WAAO;AAAA,MACN,SAAS,OAAO,QAAQ;AAAA,MACxB,SAAS,OAAO,QAAQ,QAAQ,IAAI,CAAA,QAAO;AAAA,QAC1C,IAAI,GAAG;AAAA,QACP,WAAW,GAAG;AAAA,QACd,MAAM,GAAG;AAAA,QACT,SAAS,GAAG;AAAA,QACZ,qBAAqB,GAAG,uBAAuB;AAAA,QAC/C,UAAU,GAAG,YAAY;AAAA,QACzB,gBAAgB,GAAG,kBAAkB;AAAA,QACrC,uBAAuB,GAAG,yBAAyB;AAAA,QACnD,WAAW,GAAG,aAAa;AAAA,QAC3B,cAAc,GAAG,gBAAgB;AAAA,QACjC,WAAW,GAAG,aAAa;AAAA,QAC3B,WAAW,GAAG,aAAa;AAAA,QAC3B,oBAAoB,GAAG,sBAAsB;AAAA,QAC7C,UAAU,GAAG,YAAY;AAAA,QACzB,WAAW,GAAG,aAAa;AAAA,MAAA,EAC1B;AAAA,IAAA;AAAA,EAEJ;AACD;"}

package/dist/production/src/lib/tenant/clients/TenantProjectClient.cjs

@@ -0,0 +1,209 @@
+"use strict";
+Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+const TenantApi = require("@contember/graphql-client-tenant");
+const cliCommon = require("@contember/cli-common");
+const createProjectFetcher = TenantApi.mutation$.createProject(
+  TenantApi.createProjectResponse$$.error(TenantApi.createProjectResponseError$$).result(TenantApi.createProjectResult$.deployerApiKey(TenantApi.apiKeyWithToken$$))
+);
+const setProjectSecretFetcher = TenantApi.mutation$.setProjectSecret(TenantApi.setProjectSecretResponse$$.error(TenantApi.setProjectSecretError$$));
+const updateProjectFetcher = TenantApi.mutation$.updateProject(TenantApi.updateProjectResponse$$.error(TenantApi.updateProjectError$$));
+const configureFetcher = TenantApi.mutation$.configure(TenantApi.configureResponse$$.error(TenantApi.configureError$$));
+const configurationFetcher = TenantApi.query$.configuration(
+  TenantApi.config$.signup(TenantApi.configSignup$$).emailChange(TenantApi.configEmailChange$$).passwordless(TenantApi.configPasswordless$$).password(TenantApi.configPassword$$).login(TenantApi.configLogin$$.anomalyDetection(TenantApi.configLoginAnomalyDetection$$)).captcha(TenantApi.configCaptcha$$.protect(TenantApi.configCaptchaProtect$$)).rateLimits(
+    TenantApi.configRateLimits$.signUpPerIp(TenantApi.configRateLimitWindow$$).loginPerIp(TenantApi.configRateLimitWindow$$).passwordResetPerIp(TenantApi.configRateLimitWindow$$).passwordlessInitPerIp(TenantApi.configRateLimitWindow$$).emailOtpPerPerson(TenantApi.configRateLimitWindow$$).emailVerificationPerIp(TenantApi.configRateLimitWindow$$)
+  )
+);
+const projectsFetcher = TenantApi.query$.projects(TenantApi.project$.id.name.slug);
+const roleVariableFetcher = TenantApi.roleVariableDefinition$$.on(TenantApi.roleConditionVariableDefinition$$).on(TenantApi.roleEntityVariableDefinition$$).on(TenantApi.rolePredefinedVariableDefinition$$);
+const toRoleVariableDefinition = (variable) => {
+  switch (variable.__typename) {
+    case "RoleEntityVariableDefinition":
+      return { type: "entity", name: variable.name, entityName: variable.entityName };
+    case "RolePredefinedVariableDefinition":
+      return { type: "predefined", name: variable.name, value: variable.value };
+    case "RoleConditionVariableDefinition":
+      return { type: "condition", name: variable.name };
+    case "RoleVariableDefinition":
+      throw new cliCommon.CliError(`Tenant API returned an abstract role variable definition for "${variable.name}".`, {
+        code: "TENANT_API_INVALID_RESPONSE",
+        exitCode: cliCommon.ExitCode.InternalError
+      });
+  }
+};
+const projectBySlugFetcher = TenantApi.query$.projectBySlug(
+  TenantApi.project$.id.name.slug.config.roles(TenantApi.roleDefinition$.name.variables(roleVariableFetcher)).secrets(TenantApi.projectSecretInfo$$)
+);
+const identityProvidersFetcher = TenantApi.query$.identityProviders(TenantApi.identityProvider$.slug.type.disabledAt);
+const addIdpFetcher = TenantApi.mutation$.addIDP(TenantApi.addIDPResponse$$.error(TenantApi.addIDPError$$));
+const updateIdpFetcher = TenantApi.mutation$.updateIDP(TenantApi.updateIDPResponse$$.error(TenantApi.updateIDPError$$));
+const enableIdpFetcher = TenantApi.mutation$.enableIDP(TenantApi.enableIDPResponse$$.error(TenantApi.enableIDPError$$));
+const disableIdpFetcher = TenantApi.mutation$.disableIDP(TenantApi.disableIDPResponse$$.error(TenantApi.disableIDPError$$));
+const meFetcher = TenantApi.query$.me(
+  TenantApi.identity$$.permissions(TenantApi.identityGlobalPermissions$$).projects(TenantApi.identityProjectRelation$.project(TenantApi.project$.slug.name).memberships(TenantApi.membership$$))
+);
+const toRateLimitWindow = (it) => ({ limit: it.limit, window: it.window });
+class TenantProjectClient {
+  constructor(transport) {
+    this.transport = transport;
+  }
+  async listProjects() {
+    const result = await this.transport.exec(projectsFetcher, {});
+    return result.projects.map((it) => ({ id: it.id, name: it.name, slug: it.slug }));
+  }
+  /** Null both when the project does not exist and when the caller may not see it — the API does not distinguish. */
+  async getProjectBySlug(slug) {
+    const result = await this.transport.exec(projectBySlugFetcher, { slug });
+    const project = result.projectBySlug;
+    if (!project) {
+      return null;
+    }
+    return {
+      id: project.id,
+      name: project.name,
+      slug: project.slug,
+      config: project.config,
+      roles: project.roles.map((role) => ({
+        name: role.name,
+        variables: role.variables.map((it) => it.name),
+        variableDefinitions: role.variables.map(toRoleVariableDefinition)
+      })),
+      secrets: project.secrets.map((it) => ({ key: it.key, createdAt: it.createdAt, updatedAt: it.updatedAt }))
+    };
+  }
+  /** Returns `null` (nothing created) when `ignoreExisting` swallowed an `ALREADY_EXISTS`. */
+  async createProject(slug, ignoreExisting = false, details) {
+    const result = await this.transport.exec(createProjectFetcher, {
+      projectSlug: slug,
+      name: details?.name,
+      config: details?.config,
+      options: details?.noDeployToken ? { noDeployToken: true } : void 0
+    });
+    if (ignoreExisting && result.createProject?.error?.code === "ALREADY_EXISTS") {
+      return null;
+    }
+    this.transport.assertOk(result.createProject, `createProject(${slug})`);
+    const deployerApiKey = result.createProject?.result?.deployerApiKey;
+    return { deployerApiKey: deployerApiKey ? { id: deployerApiKey.id, token: deployerApiKey.token ?? null } : null };
+  }
+  async updateProject(slug, changes) {
+    const result = await this.transport.exec(updateProjectFetcher, {
+      projectSlug: slug,
+      name: changes.name,
+      config: changes.config,
+      mergeConfig: changes.mergeConfig
+    });
+    this.transport.assertOk(result.updateProject, `updateProject(${slug})`);
+  }
+  async setProjectSecret(slug, key, value) {
+    const result = await this.transport.exec(setProjectSecretFetcher, { projectSlug: slug, key, value });
+    this.transport.assertOk(result.setProjectSecret, `setProjectSecret(${slug}/${key})`);
+  }
+  async configure(config) {
+    const result = await this.transport.exec(configureFetcher, { config });
+    this.transport.assertOk(result.configure, "configure");
+  }
+  async configuration() {
+    const result = await this.transport.exec(configurationFetcher, {});
+    const config = result.configuration;
+    return {
+      signup: { requireEmailVerification: config.signup.requireEmailVerification },
+      emailChange: { requireVerification: config.emailChange.requireVerification },
+      passwordless: {
+        enabled: config.passwordless.enabled,
+        url: config.passwordless.url ?? null,
+        expiration: config.passwordless.expiration
+      },
+      password: {
+        minLength: config.password.minLength,
+        requireUppercase: config.password.requireUppercase,
+        requireLowercase: config.password.requireLowercase,
+        requireDigit: config.password.requireDigit,
+        requireSpecial: config.password.requireSpecial,
+        pattern: config.password.pattern ?? null,
+        checkBlacklist: config.password.checkBlacklist,
+        checkHibp: config.password.checkHibp
+      },
+      login: {
+        baseBackoff: config.login.baseBackoff,
+        maxBackoff: config.login.maxBackoff,
+        attemptWindow: config.login.attemptWindow,
+        revealUserExists: config.login.revealUserExists,
+        revealLoginMethod: config.login.revealLoginMethod,
+        defaultTokenExpiration: config.login.defaultTokenExpiration,
+        maxTokenExpiration: config.login.maxTokenExpiration ?? null,
+        mfaGraceDuration: config.login.mfaGraceDuration,
+        anomalyDetection: {
+          enabled: config.login.anomalyDetection.enabled,
+          historySize: config.login.anomalyDetection.historySize,
+          emailThreshold: config.login.anomalyDetection.emailThreshold,
+          stepUpThreshold: config.login.anomalyDetection.stepUpThreshold
+        }
+      },
+      captcha: {
+        provider: config.captcha.provider ?? null,
+        threshold: config.captcha.threshold ?? null,
+        protect: {
+          signUp: config.captcha.protect.signUp,
+          passwordReset: config.captcha.protect.passwordReset,
+          passwordlessInit: config.captcha.protect.passwordlessInit,
+          emailVerification: config.captcha.protect.emailVerification
+        }
+      },
+      rateLimits: {
+        signUpPerIp: toRateLimitWindow(config.rateLimits.signUpPerIp),
+        loginPerIp: toRateLimitWindow(config.rateLimits.loginPerIp),
+        passwordResetPerIp: toRateLimitWindow(config.rateLimits.passwordResetPerIp),
+        passwordlessInitPerIp: toRateLimitWindow(config.rateLimits.passwordlessInitPerIp),
+        emailOtpPerPerson: toRateLimitWindow(config.rateLimits.emailOtpPerPerson),
+        emailVerificationPerIp: toRateLimitWindow(config.rateLimits.emailVerificationPerIp)
+      }
+    };
+  }
+  async listIdentityProviders() {
+    const result = await this.transport.exec(identityProvidersFetcher, {});
+    return result.identityProviders.map((it) => ({
+      slug: it.slug,
+      type: it.type,
+      disabledAt: it.disabledAt ?? null
+    }));
+  }
+  async addIdp(slug, type, configuration, options) {
+    const result = await this.transport.exec(addIdpFetcher, { identityProvider: slug, type, configuration, options });
+    this.transport.assertOk(result.addIDP, `addIDP(${slug})`);
+  }
+  async updateIdp(slug, type, configuration, options) {
+    const result = await this.transport.exec(updateIdpFetcher, {
+      identityProvider: slug,
+      type,
+      configuration,
+      options,
+      mergeConfiguration: false
+    });
+    this.transport.assertOk(result.updateIDP, `updateIDP(${slug})`);
+  }
+  async enableIdp(slug) {
+    const result = await this.transport.exec(enableIdpFetcher, { identityProvider: slug });
+    this.transport.assertOk(result.enableIDP, `enableIDP(${slug})`);
+  }
+  async disableIdp(slug) {
+    const result = await this.transport.exec(disableIdpFetcher, { identityProvider: slug });
+    this.transport.assertOk(result.disableIDP, `disableIDP(${slug})`);
+  }
+  async whoAmI() {
+    const result = await this.transport.exec(meFetcher, {});
+    const me = result.me;
+    return {
+      id: me.id,
+      description: me.description ?? null,
+      roles: me.roles ? [...me.roles] : [],
+      permissions: me.permissions ? { canCreateProject: me.permissions.canCreateProject, canDeployEntrypoint: me.permissions.canDeployEntrypoint } : null,
+      projects: me.projects.map((it) => ({
+        slug: it.project.slug,
+        name: it.project.name,
+        roles: it.memberships.map((m) => m.role)
+      }))
+    };
+  }
+}
+exports.TenantProjectClient = TenantProjectClient;
+//# sourceMappingURL=TenantProjectClient.cjs.map

package/dist/production/src/lib/tenant/clients/TenantProjectClient.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"TenantProjectClient.cjs","sources":["../../../../../../../packages/cli/src/lib/tenant/clients/TenantProjectClient.ts"],"sourcesContent":["import {\n\taddIDPError$$,\n\taddIDPResponse$$,\n\tapiKeyWithToken$$,\n\ttype CaptchaProvider,\n\tconfig$,\n\tconfigCaptcha$$,\n\tconfigCaptchaProtect$$,\n\tconfigEmailChange$$,\n\tconfigLogin$$,\n\tconfigLoginAnomalyDetection$$,\n\tconfigPassword$$,\n\tconfigPasswordless$$,\n\ttype ConfigPolicy,\n\tconfigRateLimits$,\n\tconfigRateLimitWindow$$,\n\tconfigSignup$$,\n\tconfigureError$$,\n\tconfigureResponse$$,\n\tcreateProjectResponse$$,\n\tcreateProjectResponseError$$,\n\tcreateProjectResult$,\n\tdisableIDPError$$,\n\tdisableIDPResponse$$,\n\tenableIDPError$$,\n\tenableIDPResponse$$,\n\tidentity$$,\n\tidentityGlobalPermissions$$,\n\tidentityProjectRelation$,\n\tidentityProvider$,\n\tmembership$$,\n\tmutation$,\n\tproject$,\n\tprojectSecretInfo$$,\n\tquery$,\n\troleConditionVariableDefinition$$,\n\troleDefinition$,\n\troleEntityVariableDefinition$$,\n\trolePredefinedVariableDefinition$$,\n\troleVariableDefinition$$,\n\tsetProjectSecretError$$,\n\tsetProjectSecretResponse$$,\n\tupdateIDPError$$,\n\tupdateIDPResponse$$,\n\tupdateProjectError$$,\n\tupdateProjectResponse$$,\n} from '@contember/graphql-client-tenant'\nimport { CliError, ExitCode } from '@contember/cli-common'\nimport type { ModelType } from 'graphql-ts-client-api'\nimport { TenantApiTransport } from '../TenantApiTransport.js'\nimport { TenantGlobalConfig, TenantIdpOptions } from '../tenantConfig.js'\n\nexport interface RemoteIdentityProvider {\n\tslug: string\n\ttype: string\n\tdisabledAt: string | null\n}\n\nexport interface TenantProjectSummary {\n\tid: string\n\tname: string\n\tslug: string\n}\n\nexport interface TenantProjectRole {\n\tname: string\n\t/** Variable names the role expects, retained for compatibility. */\n\tvariables: string[]\n\tvariableDefinitions: TenantProjectRoleVariableDefinition[]\n}\n\nexport type TenantProjectRoleVariableDefinition =\n\t| { type: 'entity'; name: string; entityName: string }\n\t| { type: 'predefined'; name: string; value: string }\n\t| { type: 'condition'; name: string }\n\nexport interface TenantProjectSecret {\n\tkey: string\n\tcreatedAt: string\n\tupdatedAt: string\n}\n\nexport interface TenantProjectDetail {\n\tid: string\n\tname: string\n\tslug: string\n\tconfig: unknown\n\troles: TenantProjectRole[]\n\tsecrets: TenantProjectSecret[]\n}\n\nexport interface TenantCreateProjectDetails {\n\tname?: string\n\tconfig?: unknown\n\t/** Skip issuing a deploy API key for the project. */\n\tnoDeployToken?: boolean\n}\n\nexport interface TenantCreateProjectResult {\n\t/** Null when {@link TenantCreateProjectDetails.noDeployToken} was requested. */\n\tdeployerApiKey: { id: string; token: string | null } | null\n}\n\nexport interface TenantUpdateProjectChanges {\n\tname?: string\n\tconfig?: unknown\n\tmergeConfig?: boolean\n}\n\nexport interface TenantRateLimitWindowState {\n\tlimit: number\n\twindow: string\n}\n\n/** The tenant-wide configuration returned by `Query.configuration` — the read side of {@link TenantGlobalConfig}. */\nexport interface TenantConfigState {\n\tsignup: { requireEmailVerification: boolean }\n\temailChange: { requireVerification: boolean }\n\tpasswordless: { enabled: ConfigPolicy; url: string | null; expiration: string }\n\tpassword: {\n\t\tminLength: number\n\t\trequireUppercase: number\n\t\trequireLowercase: number\n\t\trequireDigit: number\n\t\trequireSpecial: number\n\t\tpattern: string | null\n\t\tcheckBlacklist: boolean\n\t\tcheckHibp: boolean\n\t}\n\tlogin: {\n\t\tbaseBackoff: string\n\t\tmaxBackoff: string\n\t\tattemptWindow: string\n\t\trevealUserExists: boolean\n\t\trevealLoginMethod: boolean\n\t\tdefaultTokenExpiration: string\n\t\tmaxTokenExpiration: string | null\n\t\tmfaGraceDuration: string\n\t\tanomalyDetection: {\n\t\t\tenabled: boolean\n\t\t\thistorySize: number\n\t\t\temailThreshold: number\n\t\t\tstepUpThreshold: number\n\t\t}\n\t}\n\tcaptcha: {\n\t\tprovider: CaptchaProvider | null\n\t\tthreshold: number | null\n\t\tprotect: {\n\t\t\tsignUp: boolean\n\t\t\tpasswordReset: boolean\n\t\t\tpasswordlessInit: boolean\n\t\t\temailVerification: boolean\n\t\t}\n\t}\n\trateLimits: {\n\t\tsignUpPerIp: TenantRateLimitWindowState\n\t\tloginPerIp: TenantRateLimitWindowState\n\t\tpasswordResetPerIp: TenantRateLimitWindowState\n\t\tpasswordlessInitPerIp: TenantRateLimitWindowState\n\t\temailOtpPerPerson: TenantRateLimitWindowState\n\t\temailVerificationPerIp: TenantRateLimitWindowState\n\t}\n}\n\nexport interface TenantWhoAmIProject {\n\tslug: string\n\tname: string\n\troles: string[]\n}\n\n/** `Query.me` — the identity behind the token the CLI is using. */\nexport interface TenantWhoAmI {\n\tid: string\n\tdescription: string | null\n\t/** Global (tenant-wide) roles — empty for an identity whose access is entirely project-scoped. */\n\troles: string[]\n\tpermissions: { canCreateProject: boolean; canDeployEntrypoint: boolean } | null\n\tprojects: TenantWhoAmIProject[]\n}\n\n// Fetchers are immutable and reusable, so they are built once at module load.\nconst createProjectFetcher = mutation$.createProject(\n\tcreateProjectResponse$$.error(createProjectResponseError$$).result(createProjectResult$.deployerApiKey(apiKeyWithToken$$)),\n)\nconst setProjectSecretFetcher = mutation$.setProjectSecret(setProjectSecretResponse$$.error(setProjectSecretError$$))\nconst updateProjectFetcher = mutation$.updateProject(updateProjectResponse$$.error(updateProjectError$$))\nconst configureFetcher = mutation$.configure(configureResponse$$.error(configureError$$))\nconst configurationFetcher = query$.configuration(\n\tconfig$\n\t\t.signup(configSignup$$)\n\t\t.emailChange(configEmailChange$$)\n\t\t.passwordless(configPasswordless$$)\n\t\t.password(configPassword$$)\n\t\t.login(configLogin$$.anomalyDetection(configLoginAnomalyDetection$$))\n\t\t.captcha(configCaptcha$$.protect(configCaptchaProtect$$))\n\t\t.rateLimits(\n\t\t\tconfigRateLimits$\n\t\t\t\t.signUpPerIp(configRateLimitWindow$$)\n\t\t\t\t.loginPerIp(configRateLimitWindow$$)\n\t\t\t\t.passwordResetPerIp(configRateLimitWindow$$)\n\t\t\t\t.passwordlessInitPerIp(configRateLimitWindow$$)\n\t\t\t\t.emailOtpPerPerson(configRateLimitWindow$$)\n\t\t\t\t.emailVerificationPerIp(configRateLimitWindow$$),\n\t\t),\n)\nconst projectsFetcher = query$.projects(project$.id.name.slug)\nconst roleVariableFetcher = roleVariableDefinition$$\n\t.on(roleConditionVariableDefinition$$)\n\t.on(roleEntityVariableDefinition$$)\n\t.on(rolePredefinedVariableDefinition$$)\nconst toRoleVariableDefinition = (variable: ModelType<typeof roleVariableFetcher>): TenantProjectRoleVariableDefinition => {\n\tswitch (variable.__typename) {\n\t\tcase 'RoleEntityVariableDefinition':\n\t\t\treturn { type: 'entity', name: variable.name, entityName: variable.entityName }\n\t\tcase 'RolePredefinedVariableDefinition':\n\t\t\treturn { type: 'predefined', name: variable.name, value: variable.value }\n\t\tcase 'RoleConditionVariableDefinition':\n\t\t\treturn { type: 'condition', name: variable.name }\n\t\tcase 'RoleVariableDefinition':\n\t\t\tthrow new CliError(`Tenant API returned an abstract role variable definition for \"${variable.name}\".`, {\n\t\t\t\tcode: 'TENANT_API_INVALID_RESPONSE',\n\t\t\t\texitCode: ExitCode.InternalError,\n\t\t\t})\n\t}\n}\nconst projectBySlugFetcher = query$.projectBySlug(\n\tproject$\n\t\t.id.name.slug.config\n\t\t.roles(roleDefinition$.name.variables(roleVariableFetcher))\n\t\t.secrets(projectSecretInfo$$),\n)\nconst identityProvidersFetcher = query$.identityProviders(identityProvider$.slug.type.disabledAt)\nconst addIdpFetcher = mutation$.addIDP(addIDPResponse$$.error(addIDPError$$))\nconst updateIdpFetcher = mutation$.updateIDP(updateIDPResponse$$.error(updateIDPError$$))\nconst enableIdpFetcher = mutation$.enableIDP(enableIDPResponse$$.error(enableIDPError$$))\nconst disableIdpFetcher = mutation$.disableIDP(disableIDPResponse$$.error(disableIDPError$$))\nconst meFetcher = query$.me(\n\tidentity$$\n\t\t.permissions(identityGlobalPermissions$$)\n\t\t.projects(identityProjectRelation$.project(project$.slug.name).memberships(membership$$)),\n)\n\nconst toRateLimitWindow = (it: { limit: number; window: string }): TenantRateLimitWindowState => ({ limit: it.limit, window: it.window })\n\n/** Projects, project secrets, global tenant configuration, identity providers and `me`. */\nexport class TenantProjectClient {\n\tconstructor(\n\t\tprivate readonly transport: TenantApiTransport,\n\t) {\n\t}\n\n\tpublic async listProjects(): Promise<TenantProjectSummary[]> {\n\t\tconst result = await this.transport.exec(projectsFetcher, {})\n\t\treturn result.projects.map(it => ({ id: it.id, name: it.name, slug: it.slug }))\n\t}\n\n\t/** Null both when the project does not exist and when the caller may not see it — the API does not distinguish. */\n\tpublic async getProjectBySlug(slug: string): Promise<TenantProjectDetail | null> {\n\t\tconst result = await this.transport.exec(projectBySlugFetcher, { slug })\n\t\tconst project = result.projectBySlug\n\t\tif (!project) {\n\t\t\treturn null\n\t\t}\n\t\treturn {\n\t\t\tid: project.id,\n\t\t\tname: project.name,\n\t\t\tslug: project.slug,\n\t\t\tconfig: project.config,\n\t\t\troles: project.roles.map(role => ({\n\t\t\t\tname: role.name,\n\t\t\t\tvariables: role.variables.map(it => it.name),\n\t\t\t\tvariableDefinitions: role.variables.map(toRoleVariableDefinition),\n\t\t\t})),\n\t\t\tsecrets: project.secrets.map(it => ({ key: it.key, createdAt: it.createdAt, updatedAt: it.updatedAt })),\n\t\t}\n\t}\n\n\t/** Returns `null` (nothing created) when `ignoreExisting` swallowed an `ALREADY_EXISTS`. */\n\tpublic async createProject(slug: string, ignoreExisting = false, details?: TenantCreateProjectDetails): Promise<TenantCreateProjectResult | null> {\n\t\tconst result = await this.transport.exec(createProjectFetcher, {\n\t\t\tprojectSlug: slug,\n\t\t\tname: details?.name,\n\t\t\tconfig: details?.config,\n\t\t\toptions: details?.noDeployToken ? { noDeployToken: true } : undefined,\n\t\t})\n\t\tif (ignoreExisting && result.createProject?.error?.code === 'ALREADY_EXISTS') {\n\t\t\treturn null\n\t\t}\n\t\tthis.transport.assertOk(result.createProject, `createProject(${slug})`)\n\t\tconst deployerApiKey = result.createProject?.result?.deployerApiKey\n\t\treturn { deployerApiKey: deployerApiKey ? { id: deployerApiKey.id, token: deployerApiKey.token ?? null } : null }\n\t}\n\n\tpublic async updateProject(slug: string, changes: TenantUpdateProjectChanges): Promise<void> {\n\t\tconst result = await this.transport.exec(updateProjectFetcher, {\n\t\t\tprojectSlug: slug,\n\t\t\tname: changes.name,\n\t\t\tconfig: changes.config,\n\t\t\tmergeConfig: changes.mergeConfig,\n\t\t})\n\t\tthis.transport.assertOk(result.updateProject, `updateProject(${slug})`)\n\t}\n\n\tpublic async setProjectSecret(slug: string, key: string, value: string): Promise<void> {\n\t\tconst result = await this.transport.exec(setProjectSecretFetcher, { projectSlug: slug, key, value })\n\t\tthis.transport.assertOk(result.setProjectSecret, `setProjectSecret(${slug}/${key})`)\n\t}\n\n\tpublic async configure(config: TenantGlobalConfig): Promise<void> {\n\t\tconst result = await this.transport.exec(configureFetcher, { config })\n\t\tthis.transport.assertOk(result.configure, 'configure')\n\t}\n\n\tpublic async configuration(): Promise<TenantConfigState> {\n\t\tconst result = await this.transport.exec(configurationFetcher, {})\n\t\tconst config = result.configuration\n\t\treturn {\n\t\t\tsignup: { requireEmailVerification: config.signup.requireEmailVerification },\n\t\t\temailChange: { requireVerification: config.emailChange.requireVerification },\n\t\t\tpasswordless: {\n\t\t\t\tenabled: config.passwordless.enabled,\n\t\t\t\turl: config.passwordless.url ?? null,\n\t\t\t\texpiration: config.passwordless.expiration,\n\t\t\t},\n\t\t\tpassword: {\n\t\t\t\tminLength: config.password.minLength,\n\t\t\t\trequireUppercase: config.password.requireUppercase,\n\t\t\t\trequireLowercase: config.password.requireLowercase,\n\t\t\t\trequireDigit: config.password.requireDigit,\n\t\t\t\trequireSpecial: config.password.requireSpecial,\n\t\t\t\tpattern: config.password.pattern ?? null,\n\t\t\t\tcheckBlacklist: config.password.checkBlacklist,\n\t\t\t\tcheckHibp: config.password.checkHibp,\n\t\t\t},\n\t\t\tlogin: {\n\t\t\t\tbaseBackoff: config.login.baseBackoff,\n\t\t\t\tmaxBackoff: config.login.maxBackoff,\n\t\t\t\tattemptWindow: config.login.attemptWindow,\n\t\t\t\trevealUserExists: config.login.revealUserExists,\n\t\t\t\trevealLoginMethod: config.login.revealLoginMethod,\n\t\t\t\tdefaultTokenExpiration: config.login.defaultTokenExpiration,\n\t\t\t\tmaxTokenExpiration: config.login.maxTokenExpiration ?? null,\n\t\t\t\tmfaGraceDuration: config.login.mfaGraceDuration,\n\t\t\t\tanomalyDetection: {\n\t\t\t\t\tenabled: config.login.anomalyDetection.enabled,\n\t\t\t\t\thistorySize: config.login.anomalyDetection.historySize,\n\t\t\t\t\temailThreshold: config.login.anomalyDetection.emailThreshold,\n\t\t\t\t\tstepUpThreshold: config.login.anomalyDetection.stepUpThreshold,\n\t\t\t\t},\n\t\t\t},\n\t\t\tcaptcha: {\n\t\t\t\tprovider: config.captcha.provider ?? null,\n\t\t\t\tthreshold: config.captcha.threshold ?? null,\n\t\t\t\tprotect: {\n\t\t\t\t\tsignUp: config.captcha.protect.signUp,\n\t\t\t\t\tpasswordReset: config.captcha.protect.passwordReset,\n\t\t\t\t\tpasswordlessInit: config.captcha.protect.passwordlessInit,\n\t\t\t\t\temailVerification: config.captcha.protect.emailVerification,\n\t\t\t\t},\n\t\t\t},\n\t\t\trateLimits: {\n\t\t\t\tsignUpPerIp: toRateLimitWindow(config.rateLimits.signUpPerIp),\n\t\t\t\tloginPerIp: toRateLimitWindow(config.rateLimits.loginPerIp),\n\t\t\t\tpasswordResetPerIp: toRateLimitWindow(config.rateLimits.passwordResetPerIp),\n\t\t\t\tpasswordlessInitPerIp: toRateLimitWindow(config.rateLimits.passwordlessInitPerIp),\n\t\t\t\temailOtpPerPerson: toRateLimitWindow(config.rateLimits.emailOtpPerPerson),\n\t\t\t\temailVerificationPerIp: toRateLimitWindow(config.rateLimits.emailVerificationPerIp),\n\t\t\t},\n\t\t}\n\t}\n\n\tpublic async listIdentityProviders(): Promise<RemoteIdentityProvider[]> {\n\t\tconst result = await this.transport.exec(identityProvidersFetcher, {})\n\t\treturn result.identityProviders.map(it => ({\n\t\t\tslug: it.slug,\n\t\t\ttype: it.type,\n\t\t\tdisabledAt: it.disabledAt ?? null,\n\t\t}))\n\t}\n\n\tpublic async addIdp(slug: string, type: string, configuration: unknown, options?: TenantIdpOptions): Promise<void> {\n\t\tconst result = await this.transport.exec(addIdpFetcher, { identityProvider: slug, type, configuration, options })\n\t\tthis.transport.assertOk(result.addIDP, `addIDP(${slug})`)\n\t}\n\n\tpublic async updateIdp(slug: string, type: string, configuration: unknown, options?: TenantIdpOptions): Promise<void> {\n\t\tconst result = await this.transport.exec(updateIdpFetcher, {\n\t\t\tidentityProvider: slug,\n\t\t\ttype,\n\t\t\tconfiguration,\n\t\t\toptions,\n\t\t\tmergeConfiguration: false,\n\t\t})\n\t\tthis.transport.assertOk(result.updateIDP, `updateIDP(${slug})`)\n\t}\n\n\tpublic async enableIdp(slug: string): Promise<void> {\n\t\tconst result = await this.transport.exec(enableIdpFetcher, { identityProvider: slug })\n\t\tthis.transport.assertOk(result.enableIDP, `enableIDP(${slug})`)\n\t}\n\n\tpublic async disableIdp(slug: string): Promise<void> {\n\t\tconst result = await this.transport.exec(disableIdpFetcher, { identityProvider: slug })\n\t\tthis.transport.assertOk(result.disableIDP, `disableIDP(${slug})`)\n\t}\n\n\tpublic async whoAmI(): Promise<TenantWhoAmI> {\n\t\tconst result = await this.transport.exec(meFetcher, {})\n\t\tconst me = result.me\n\t\treturn {\n\t\t\tid: me.id,\n\t\t\tdescription: me.description ?? null,\n\t\t\troles: me.roles ? [...me.roles] : [],\n\t\t\tpermissions: me.permissions\n\t\t\t\t? { canCreateProject: me.permissions.canCreateProject, canDeployEntrypoint: me.permissions.canDeployEntrypoint }\n\t\t\t\t: null,\n\t\t\tprojects: me.projects.map(it => ({\n\t\t\t\tslug: it.project.slug,\n\t\t\t\tname: it.project.name,\n\t\t\t\troles: it.memberships.map(m => m.role),\n\t\t\t})),\n\t\t}\n\t}\n}\n"],"names":["mutation$","createProjectResponse$$","createProjectResponseError$$","createProjectResult$","apiKeyWithToken$$","setProjectSecretResponse$$","setProjectSecretError$$","updateProjectResponse$$","updateProjectError$$","configureResponse$$","configureError$$","query$","config$","configSignup$$","configEmailChange$$","configPasswordless$$","configPassword$$","configLogin$$","configLoginAnomalyDetection$$","configCaptcha$$","configCaptchaProtect$$","configRateLimits$","configRateLimitWindow$$","project$","roleVariableDefinition$$","roleConditionVariableDefinition$$","roleEntityVariableDefinition$$","rolePredefinedVariableDefinition$$","CliError","ExitCode","roleDefinition$","projectSecretInfo$$","identityProvider$","addIDPResponse$$","addIDPError$$","updateIDPResponse$$","updateIDPError$$","enableIDPResponse$$","enableIDPError$$","disableIDPResponse$$","disableIDPError$$","identity$$","identityGlobalPermissions$$","identityProjectRelation$","membership$$"],"mappings":";;;;AAsLA,MAAM,uBAAuBA,UAAAA,UAAU;AAAA,EACtCC,UAAAA,wBAAwB,MAAMC,sCAA4B,EAAE,OAAOC,UAAAA,qBAAqB,eAAeC,2BAAiB,CAAC;AAC1H;AACA,MAAM,0BAA0BJ,UAAAA,UAAU,iBAAiBK,UAAAA,2BAA2B,MAAMC,UAAAA,uBAAuB,CAAC;AACpH,MAAM,uBAAuBN,UAAAA,UAAU,cAAcO,UAAAA,wBAAwB,MAAMC,UAAAA,oBAAoB,CAAC;AACxG,MAAM,mBAAmBR,UAAAA,UAAU,UAAUS,UAAAA,oBAAoB,MAAMC,UAAAA,gBAAgB,CAAC;AACxF,MAAM,uBAAuBC,UAAAA,OAAO;AAAA,EACnCC,kBACE,OAAOC,UAAAA,cAAc,EACrB,YAAYC,6BAAmB,EAC/B,aAAaC,UAAAA,oBAAoB,EACjC,SAASC,UAAAA,gBAAgB,EACzB,MAAMC,UAAAA,cAAc,iBAAiBC,UAAAA,6BAA6B,CAAC,EACnE,QAAQC,UAAAA,gBAAgB,QAAQC,gCAAsB,CAAC,EACvD;AAAA,IACAC,UAAAA,kBACE,YAAYC,UAAAA,uBAAuB,EACnC,WAAWA,UAAAA,uBAAuB,EAClC,mBAAmBA,UAAAA,uBAAuB,EAC1C,sBAAsBA,UAAAA,uBAAuB,EAC7C,kBAAkBA,UAAAA,uBAAuB,EACzC,uBAAuBA,UAAAA,uBAAuB;AAAA,EAAA;AAEnD;AACA,MAAM,kBAAkBX,UAAAA,OAAO,SAASY,UAAAA,SAAS,GAAG,KAAK,IAAI;AAC7D,MAAM,sBAAsBC,UAAAA,yBAC1B,GAAGC,UAAAA,iCAAiC,EACpC,GAAGC,UAAAA,8BAA8B,EACjC,GAAGC,4CAAkC;AACvC,MAAM,2BAA2B,CAAC,aAAyF;AAC1H,UAAQ,SAAS,YAAA;AAAA,IAChB,KAAK;AACJ,aAAO,EAAE,MAAM,UAAU,MAAM,SAAS,MAAM,YAAY,SAAS,WAAA;AAAA,IACpE,KAAK;AACJ,aAAO,EAAE,MAAM,cAAc,MAAM,SAAS,MAAM,OAAO,SAAS,MAAA;AAAA,IACnE,KAAK;AACJ,aAAO,EAAE,MAAM,aAAa,MAAM,SAAS,KAAA;AAAA,IAC5C,KAAK;AACJ,YAAM,IAAIC,UAAAA,SAAS,iEAAiE,SAAS,IAAI,MAAM;AAAA,QACtG,MAAM;AAAA,QACN,UAAUC,UAAAA,SAAS;AAAA,MAAA,CACnB;AAAA,EAAA;AAEJ;AACA,MAAM,uBAAuBlB,UAAAA,OAAO;AAAA,EACnCY,UAAAA,SACE,GAAG,KAAK,KAAK,OACb,MAAMO,0BAAgB,KAAK,UAAU,mBAAmB,CAAC,EACzD,QAAQC,UAAAA,mBAAmB;AAC9B;AACA,MAAM,2BAA2BpB,UAAAA,OAAO,kBAAkBqB,UAAAA,kBAAkB,KAAK,KAAK,UAAU;AAChG,MAAM,gBAAgBhC,UAAAA,UAAU,OAAOiC,UAAAA,iBAAiB,MAAMC,UAAAA,aAAa,CAAC;AAC5E,MAAM,mBAAmBlC,UAAAA,UAAU,UAAUmC,UAAAA,oBAAoB,MAAMC,UAAAA,gBAAgB,CAAC;AACxF,MAAM,mBAAmBpC,UAAAA,UAAU,UAAUqC,UAAAA,oBAAoB,MAAMC,UAAAA,gBAAgB,CAAC;AACxF,MAAM,oBAAoBtC,UAAAA,UAAU,WAAWuC,UAAAA,qBAAqB,MAAMC,UAAAA,iBAAiB,CAAC;AAC5F,MAAM,YAAY7B,UAAAA,OAAO;AAAA,EACxB8B,UAAAA,WACE,YAAYC,qCAA2B,EACvC,SAASC,UAAAA,yBAAyB,QAAQpB,UAAAA,SAAS,KAAK,IAAI,EAAE,YAAYqB,UAAAA,YAAY,CAAC;AAC1F;AAEA,MAAM,oBAAoB,CAAC,QAAuE,EAAE,OAAO,GAAG,OAAO,QAAQ,GAAG;AAGzH,MAAM,oBAAoB;AAAA,EAChC,YACkB,WAChB;AADgB,SAAA,YAAA;AAAA,EAElB;AAAA,EAEA,MAAa,eAAgD;AAC5D,UAAM,SAAS,MAAM,KAAK,UAAU,KAAK,iBAAiB,EAAE;AAC5D,WAAO,OAAO,SAAS,IAAI,CAAA,QAAO,EAAE,IAAI,GAAG,IAAI,MAAM,GAAG,MAAM,MAAM,GAAG,OAAO;AAAA,EAC/E;AAAA;AAAA,EAGA,MAAa,iBAAiB,MAAmD;AAChF,UAAM,SAAS,MAAM,KAAK,UAAU,KAAK,sBAAsB,EAAE,MAAM;AACvE,UAAM,UAAU,OAAO;AACvB,QAAI,CAAC,SAAS;AACb,aAAO;AAAA,IACR;AACA,WAAO;AAAA,MACN,IAAI,QAAQ;AAAA,MACZ,MAAM,QAAQ;AAAA,MACd,MAAM,QAAQ;AAAA,MACd,QAAQ,QAAQ;AAAA,MAChB,OAAO,QAAQ,MAAM,IAAI,CAAA,UAAS;AAAA,QACjC,MAAM,KAAK;AAAA,QACX,WAAW,KAAK,UAAU,IAAI,CAAA,OAAM,GAAG,IAAI;AAAA,QAC3C,qBAAqB,KAAK,UAAU,IAAI,wBAAwB;AAAA,MAAA,EAC/D;AAAA,MACF,SAAS,QAAQ,QAAQ,IAAI,SAAO,EAAE,KAAK,GAAG,KAAK,WAAW,GAAG,WAAW,WAAW,GAAG,YAAY;AAAA,IAAA;AAAA,EAExG;AAAA;AAAA,EAGA,MAAa,cAAc,MAAc,iBAAiB,OAAO,SAAiF;AACjJ,UAAM,SAAS,MAAM,KAAK,UAAU,KAAK,sBAAsB;AAAA,MAC9D,aAAa;AAAA,MACb,MAAM,SAAS;AAAA,MACf,QAAQ,SAAS;AAAA,MACjB,SAAS,SAAS,gBAAgB,EAAE,eAAe,SAAS;AAAA,IAAA,CAC5D;AACD,QAAI,kBAAkB,OAAO,eAAe,OAAO,SAAS,kBAAkB;AAC7E,aAAO;AAAA,IACR;AACA,SAAK,UAAU,SAAS,OAAO,eAAe,iBAAiB,IAAI,GAAG;AACtE,UAAM,iBAAiB,OAAO,eAAe,QAAQ;AACrD,WAAO,EAAE,gBAAgB,iBAAiB,EAAE,IAAI,eAAe,IAAI,OAAO,eAAe,SAAS,KAAA,IAAS,KAAA;AAAA,EAC5G;AAAA,EAEA,MAAa,cAAc,MAAc,SAAoD;AAC5F,UAAM,SAAS,MAAM,KAAK,UAAU,KAAK,sBAAsB;AAAA,MAC9D,aAAa;AAAA,MACb,MAAM,QAAQ;AAAA,MACd,QAAQ,QAAQ;AAAA,MAChB,aAAa,QAAQ;AAAA,IAAA,CACrB;AACD,SAAK,UAAU,SAAS,OAAO,eAAe,iBAAiB,IAAI,GAAG;AAAA,EACvE;AAAA,EAEA,MAAa,iBAAiB,MAAc,KAAa,OAA8B;AACtF,UAAM,SAAS,MAAM,KAAK,UAAU,KAAK,yBAAyB,EAAE,aAAa,MAAM,KAAK,MAAA,CAAO;AACnG,SAAK,UAAU,SAAS,OAAO,kBAAkB,oBAAoB,IAAI,IAAI,GAAG,GAAG;AAAA,EACpF;AAAA,EAEA,MAAa,UAAU,QAA2C;AACjE,UAAM,SAAS,MAAM,KAAK,UAAU,KAAK,kBAAkB,EAAE,QAAQ;AACrE,SAAK,UAAU,SAAS,OAAO,WAAW,WAAW;AAAA,EACtD;AAAA,EAEA,MAAa,gBAA4C;AACxD,UAAM,SAAS,MAAM,KAAK,UAAU,KAAK,sBAAsB,EAAE;AACjE,UAAM,SAAS,OAAO;AACtB,WAAO;AAAA,MACN,QAAQ,EAAE,0BAA0B,OAAO,OAAO,yBAAA;AAAA,MAClD,aAAa,EAAE,qBAAqB,OAAO,YAAY,oBAAA;AAAA,MACvD,cAAc;AAAA,QACb,SAAS,OAAO,aAAa;AAAA,QAC7B,KAAK,OAAO,aAAa,OAAO;AAAA,QAChC,YAAY,OAAO,aAAa;AAAA,MAAA;AAAA,MAEjC,UAAU;AAAA,QACT,WAAW,OAAO,SAAS;AAAA,QAC3B,kBAAkB,OAAO,SAAS;AAAA,QAClC,kBAAkB,OAAO,SAAS;AAAA,QAClC,cAAc,OAAO,SAAS;AAAA,QAC9B,gBAAgB,OAAO,SAAS;AAAA,QAChC,SAAS,OAAO,SAAS,WAAW;AAAA,QACpC,gBAAgB,OAAO,SAAS;AAAA,QAChC,WAAW,OAAO,SAAS;AAAA,MAAA;AAAA,MAE5B,OAAO;AAAA,QACN,aAAa,OAAO,MAAM;AAAA,QAC1B,YAAY,OAAO,MAAM;AAAA,QACzB,eAAe,OAAO,MAAM;AAAA,QAC5B,kBAAkB,OAAO,MAAM;AAAA,QAC/B,mBAAmB,OAAO,MAAM;AAAA,QAChC,wBAAwB,OAAO,MAAM;AAAA,QACrC,oBAAoB,OAAO,MAAM,sBAAsB;AAAA,QACvD,kBAAkB,OAAO,MAAM;AAAA,QAC/B,kBAAkB;AAAA,UACjB,SAAS,OAAO,MAAM,iBAAiB;AAAA,UACvC,aAAa,OAAO,MAAM,iBAAiB;AAAA,UAC3C,gBAAgB,OAAO,MAAM,iBAAiB;AAAA,UAC9C,iBAAiB,OAAO,MAAM,iBAAiB;AAAA,QAAA;AAAA,MAChD;AAAA,MAED,SAAS;AAAA,QACR,UAAU,OAAO,QAAQ,YAAY;AAAA,QACrC,WAAW,OAAO,QAAQ,aAAa;AAAA,QACvC,SAAS;AAAA,UACR,QAAQ,OAAO,QAAQ,QAAQ;AAAA,UAC/B,eAAe,OAAO,QAAQ,QAAQ;AAAA,UACtC,kBAAkB,OAAO,QAAQ,QAAQ;AAAA,UACzC,mBAAmB,OAAO,QAAQ,QAAQ;AAAA,QAAA;AAAA,MAC3C;AAAA,MAED,YAAY;AAAA,QACX,aAAa,kBAAkB,OAAO,WAAW,WAAW;AAAA,QAC5D,YAAY,kBAAkB,OAAO,WAAW,UAAU;AAAA,QAC1D,oBAAoB,kBAAkB,OAAO,WAAW,kBAAkB;AAAA,QAC1E,uBAAuB,kBAAkB,OAAO,WAAW,qBAAqB;AAAA,QAChF,mBAAmB,kBAAkB,OAAO,WAAW,iBAAiB;AAAA,QACxE,wBAAwB,kBAAkB,OAAO,WAAW,sBAAsB;AAAA,MAAA;AAAA,IACnF;AAAA,EAEF;AAAA,EAEA,MAAa,wBAA2D;AACvE,UAAM,SAAS,MAAM,KAAK,UAAU,KAAK,0BAA0B,EAAE;AACrE,WAAO,OAAO,kBAAkB,IAAI,CAAA,QAAO;AAAA,MAC1C,MAAM,GAAG;AAAA,MACT,MAAM,GAAG;AAAA,MACT,YAAY,GAAG,cAAc;AAAA,IAAA,EAC5B;AAAA,EACH;AAAA,EAEA,MAAa,OAAO,MAAc,MAAc,eAAwB,SAA2C;AAClH,UAAM,SAAS,MAAM,KAAK,UAAU,KAAK,eAAe,EAAE,kBAAkB,MAAM,MAAM,eAAe,QAAA,CAAS;AAChH,SAAK,UAAU,SAAS,OAAO,QAAQ,UAAU,IAAI,GAAG;AAAA,EACzD;AAAA,EAEA,MAAa,UAAU,MAAc,MAAc,eAAwB,SAA2C;AACrH,UAAM,SAAS,MAAM,KAAK,UAAU,KAAK,kBAAkB;AAAA,MAC1D,kBAAkB;AAAA,MAClB;AAAA,MACA;AAAA,MACA;AAAA,MACA,oBAAoB;AAAA,IAAA,CACpB;AACD,SAAK,UAAU,SAAS,OAAO,WAAW,aAAa,IAAI,GAAG;AAAA,EAC/D;AAAA,EAEA,MAAa,UAAU,MAA6B;AACnD,UAAM,SAAS,MAAM,KAAK,UAAU,KAAK,kBAAkB,EAAE,kBAAkB,MAAM;AACrF,SAAK,UAAU,SAAS,OAAO,WAAW,aAAa,IAAI,GAAG;AAAA,EAC/D;AAAA,EAEA,MAAa,WAAW,MAA6B;AACpD,UAAM,SAAS,MAAM,KAAK,UAAU,KAAK,mBAAmB,EAAE,kBAAkB,MAAM;AACtF,SAAK,UAAU,SAAS,OAAO,YAAY,cAAc,IAAI,GAAG;AAAA,EACjE;AAAA,EAEA,MAAa,SAAgC;AAC5C,UAAM,SAAS,MAAM,KAAK,UAAU,KAAK,WAAW,EAAE;AACtD,UAAM,KAAK,OAAO;AAClB,WAAO;AAAA,MACN,IAAI,GAAG;AAAA,MACP,aAAa,GAAG,eAAe;AAAA,MAC/B,OAAO,GAAG,QAAQ,CAAC,GAAG,GAAG,KAAK,IAAI,CAAA;AAAA,MAClC,aAAa,GAAG,cACb,EAAE,kBAAkB,GAAG,YAAY,kBAAkB,qBAAqB,GAAG,YAAY,oBAAA,IACzF;AAAA,MACH,UAAU,GAAG,SAAS,IAAI,CAAA,QAAO;AAAA,QAChC,MAAM,GAAG,QAAQ;AAAA,QACjB,MAAM,GAAG,QAAQ;AAAA,QACjB,OAAO,GAAG,YAAY,IAAI,CAAA,MAAK,EAAE,IAAI;AAAA,MAAA,EACpC;AAAA,IAAA;AAAA,EAEJ;AACD;;"}

package/dist/production/src/lib/tenant/clients/TenantProjectClient.js

@@ -0,0 +1,209 @@
+import { mutation$, createProjectResponse$$, createProjectResponseError$$, createProjectResult$, apiKeyWithToken$$, setProjectSecretResponse$$, setProjectSecretError$$, updateProjectResponse$$, updateProjectError$$, configureResponse$$, configureError$$, query$, config$, configSignup$$, configEmailChange$$, configPasswordless$$, configPassword$$, configLogin$$, configLoginAnomalyDetection$$, configCaptcha$$, configCaptchaProtect$$, configRateLimits$, configRateLimitWindow$$, project$, roleVariableDefinition$$, roleConditionVariableDefinition$$, roleEntityVariableDefinition$$, rolePredefinedVariableDefinition$$, roleDefinition$, projectSecretInfo$$, identityProvider$, addIDPResponse$$, addIDPError$$, updateIDPResponse$$, updateIDPError$$, enableIDPResponse$$, enableIDPError$$, disableIDPResponse$$, disableIDPError$$, identity$$, identityGlobalPermissions$$, identityProjectRelation$, membership$$ } from "@contember/graphql-client-tenant";
+import { CliError, ExitCode } from "@contember/cli-common";
+const createProjectFetcher = mutation$.createProject(
+  createProjectResponse$$.error(createProjectResponseError$$).result(createProjectResult$.deployerApiKey(apiKeyWithToken$$))
+);
+const setProjectSecretFetcher = mutation$.setProjectSecret(setProjectSecretResponse$$.error(setProjectSecretError$$));
+const updateProjectFetcher = mutation$.updateProject(updateProjectResponse$$.error(updateProjectError$$));
+const configureFetcher = mutation$.configure(configureResponse$$.error(configureError$$));
+const configurationFetcher = query$.configuration(
+  config$.signup(configSignup$$).emailChange(configEmailChange$$).passwordless(configPasswordless$$).password(configPassword$$).login(configLogin$$.anomalyDetection(configLoginAnomalyDetection$$)).captcha(configCaptcha$$.protect(configCaptchaProtect$$)).rateLimits(
+    configRateLimits$.signUpPerIp(configRateLimitWindow$$).loginPerIp(configRateLimitWindow$$).passwordResetPerIp(configRateLimitWindow$$).passwordlessInitPerIp(configRateLimitWindow$$).emailOtpPerPerson(configRateLimitWindow$$).emailVerificationPerIp(configRateLimitWindow$$)
+  )
+);
+const projectsFetcher = query$.projects(project$.id.name.slug);
+const roleVariableFetcher = roleVariableDefinition$$.on(roleConditionVariableDefinition$$).on(roleEntityVariableDefinition$$).on(rolePredefinedVariableDefinition$$);
+const toRoleVariableDefinition = (variable) => {
+  switch (variable.__typename) {
+    case "RoleEntityVariableDefinition":
+      return { type: "entity", name: variable.name, entityName: variable.entityName };
+    case "RolePredefinedVariableDefinition":
+      return { type: "predefined", name: variable.name, value: variable.value };
+    case "RoleConditionVariableDefinition":
+      return { type: "condition", name: variable.name };
+    case "RoleVariableDefinition":
+      throw new CliError(`Tenant API returned an abstract role variable definition for "${variable.name}".`, {
+        code: "TENANT_API_INVALID_RESPONSE",
+        exitCode: ExitCode.InternalError
+      });
+  }
+};
+const projectBySlugFetcher = query$.projectBySlug(
+  project$.id.name.slug.config.roles(roleDefinition$.name.variables(roleVariableFetcher)).secrets(projectSecretInfo$$)
+);
+const identityProvidersFetcher = query$.identityProviders(identityProvider$.slug.type.disabledAt);
+const addIdpFetcher = mutation$.addIDP(addIDPResponse$$.error(addIDPError$$));
+const updateIdpFetcher = mutation$.updateIDP(updateIDPResponse$$.error(updateIDPError$$));
+const enableIdpFetcher = mutation$.enableIDP(enableIDPResponse$$.error(enableIDPError$$));
+const disableIdpFetcher = mutation$.disableIDP(disableIDPResponse$$.error(disableIDPError$$));
+const meFetcher = query$.me(
+  identity$$.permissions(identityGlobalPermissions$$).projects(identityProjectRelation$.project(project$.slug.name).memberships(membership$$))
+);
+const toRateLimitWindow = (it) => ({ limit: it.limit, window: it.window });
+class TenantProjectClient {
+  constructor(transport) {
+    this.transport = transport;
+  }
+  async listProjects() {
+    const result = await this.transport.exec(projectsFetcher, {});
+    return result.projects.map((it) => ({ id: it.id, name: it.name, slug: it.slug }));
+  }
+  /** Null both when the project does not exist and when the caller may not see it — the API does not distinguish. */
+  async getProjectBySlug(slug) {
+    const result = await this.transport.exec(projectBySlugFetcher, { slug });
+    const project = result.projectBySlug;
+    if (!project) {
+      return null;
+    }
+    return {
+      id: project.id,
+      name: project.name,
+      slug: project.slug,
+      config: project.config,
+      roles: project.roles.map((role) => ({
+        name: role.name,
+        variables: role.variables.map((it) => it.name),
+        variableDefinitions: role.variables.map(toRoleVariableDefinition)
+      })),
+      secrets: project.secrets.map((it) => ({ key: it.key, createdAt: it.createdAt, updatedAt: it.updatedAt }))
+    };
+  }
+  /** Returns `null` (nothing created) when `ignoreExisting` swallowed an `ALREADY_EXISTS`. */
+  async createProject(slug, ignoreExisting = false, details) {
+    const result = await this.transport.exec(createProjectFetcher, {
+      projectSlug: slug,
+      name: details?.name,
+      config: details?.config,
+      options: details?.noDeployToken ? { noDeployToken: true } : void 0
+    });
+    if (ignoreExisting && result.createProject?.error?.code === "ALREADY_EXISTS") {
+      return null;
+    }
+    this.transport.assertOk(result.createProject, `createProject(${slug})`);
+    const deployerApiKey = result.createProject?.result?.deployerApiKey;
+    return { deployerApiKey: deployerApiKey ? { id: deployerApiKey.id, token: deployerApiKey.token ?? null } : null };
+  }
+  async updateProject(slug, changes) {
+    const result = await this.transport.exec(updateProjectFetcher, {
+      projectSlug: slug,
+      name: changes.name,
+      config: changes.config,
+      mergeConfig: changes.mergeConfig
+    });
+    this.transport.assertOk(result.updateProject, `updateProject(${slug})`);
+  }
+  async setProjectSecret(slug, key, value) {
+    const result = await this.transport.exec(setProjectSecretFetcher, { projectSlug: slug, key, value });
+    this.transport.assertOk(result.setProjectSecret, `setProjectSecret(${slug}/${key})`);
+  }
+  async configure(config) {
+    const result = await this.transport.exec(configureFetcher, { config });
+    this.transport.assertOk(result.configure, "configure");
+  }
+  async configuration() {
+    const result = await this.transport.exec(configurationFetcher, {});
+    const config = result.configuration;
+    return {
+      signup: { requireEmailVerification: config.signup.requireEmailVerification },
+      emailChange: { requireVerification: config.emailChange.requireVerification },
+      passwordless: {
+        enabled: config.passwordless.enabled,
+        url: config.passwordless.url ?? null,
+        expiration: config.passwordless.expiration
+      },
+      password: {
+        minLength: config.password.minLength,
+        requireUppercase: config.password.requireUppercase,
+        requireLowercase: config.password.requireLowercase,
+        requireDigit: config.password.requireDigit,
+        requireSpecial: config.password.requireSpecial,
+        pattern: config.password.pattern ?? null,
+        checkBlacklist: config.password.checkBlacklist,
+        checkHibp: config.password.checkHibp
+      },
+      login: {
+        baseBackoff: config.login.baseBackoff,
+        maxBackoff: config.login.maxBackoff,
+        attemptWindow: config.login.attemptWindow,
+        revealUserExists: config.login.revealUserExists,
+        revealLoginMethod: config.login.revealLoginMethod,
+        defaultTokenExpiration: config.login.defaultTokenExpiration,
+        maxTokenExpiration: config.login.maxTokenExpiration ?? null,
+        mfaGraceDuration: config.login.mfaGraceDuration,
+        anomalyDetection: {
+          enabled: config.login.anomalyDetection.enabled,
+          historySize: config.login.anomalyDetection.historySize,
+          emailThreshold: config.login.anomalyDetection.emailThreshold,
+          stepUpThreshold: config.login.anomalyDetection.stepUpThreshold
+        }
+      },
+      captcha: {
+        provider: config.captcha.provider ?? null,
+        threshold: config.captcha.threshold ?? null,
+        protect: {
+          signUp: config.captcha.protect.signUp,
+          passwordReset: config.captcha.protect.passwordReset,
+          passwordlessInit: config.captcha.protect.passwordlessInit,
+          emailVerification: config.captcha.protect.emailVerification
+        }
+      },
+      rateLimits: {
+        signUpPerIp: toRateLimitWindow(config.rateLimits.signUpPerIp),
+        loginPerIp: toRateLimitWindow(config.rateLimits.loginPerIp),
+        passwordResetPerIp: toRateLimitWindow(config.rateLimits.passwordResetPerIp),
+        passwordlessInitPerIp: toRateLimitWindow(config.rateLimits.passwordlessInitPerIp),
+        emailOtpPerPerson: toRateLimitWindow(config.rateLimits.emailOtpPerPerson),
+        emailVerificationPerIp: toRateLimitWindow(config.rateLimits.emailVerificationPerIp)
+      }
+    };
+  }
+  async listIdentityProviders() {
+    const result = await this.transport.exec(identityProvidersFetcher, {});
+    return result.identityProviders.map((it) => ({
+      slug: it.slug,
+      type: it.type,
+      disabledAt: it.disabledAt ?? null
+    }));
+  }
+  async addIdp(slug, type, configuration, options) {
+    const result = await this.transport.exec(addIdpFetcher, { identityProvider: slug, type, configuration, options });
+    this.transport.assertOk(result.addIDP, `addIDP(${slug})`);
+  }
+  async updateIdp(slug, type, configuration, options) {
+    const result = await this.transport.exec(updateIdpFetcher, {
+      identityProvider: slug,
+      type,
+      configuration,
+      options,
+      mergeConfiguration: false
+    });
+    this.transport.assertOk(result.updateIDP, `updateIDP(${slug})`);
+  }
+  async enableIdp(slug) {
+    const result = await this.transport.exec(enableIdpFetcher, { identityProvider: slug });
+    this.transport.assertOk(result.enableIDP, `enableIDP(${slug})`);
+  }
+  async disableIdp(slug) {
+    const result = await this.transport.exec(disableIdpFetcher, { identityProvider: slug });
+    this.transport.assertOk(result.disableIDP, `disableIDP(${slug})`);
+  }
+  async whoAmI() {
+    const result = await this.transport.exec(meFetcher, {});
+    const me = result.me;
+    return {
+      id: me.id,
+      description: me.description ?? null,
+      roles: me.roles ? [...me.roles] : [],
+      permissions: me.permissions ? { canCreateProject: me.permissions.canCreateProject, canDeployEntrypoint: me.permissions.canDeployEntrypoint } : null,
+      projects: me.projects.map((it) => ({
+        slug: it.project.slug,
+        name: it.project.name,
+        roles: it.memberships.map((m) => m.role)
+      }))
+    };
+  }
+}
+export {
+  TenantProjectClient
+};
+//# sourceMappingURL=TenantProjectClient.js.map

package/dist/production/src/lib/tenant/clients/TenantProjectClient.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"TenantProjectClient.js","sources":["../../../../../../../packages/cli/src/lib/tenant/clients/TenantProjectClient.ts"],"sourcesContent":["import {\n\taddIDPError$$,\n\taddIDPResponse$$,\n\tapiKeyWithToken$$,\n\ttype CaptchaProvider,\n\tconfig$,\n\tconfigCaptcha$$,\n\tconfigCaptchaProtect$$,\n\tconfigEmailChange$$,\n\tconfigLogin$$,\n\tconfigLoginAnomalyDetection$$,\n\tconfigPassword$$,\n\tconfigPasswordless$$,\n\ttype ConfigPolicy,\n\tconfigRateLimits$,\n\tconfigRateLimitWindow$$,\n\tconfigSignup$$,\n\tconfigureError$$,\n\tconfigureResponse$$,\n\tcreateProjectResponse$$,\n\tcreateProjectResponseError$$,\n\tcreateProjectResult$,\n\tdisableIDPError$$,\n\tdisableIDPResponse$$,\n\tenableIDPError$$,\n\tenableIDPResponse$$,\n\tidentity$$,\n\tidentityGlobalPermissions$$,\n\tidentityProjectRelation$,\n\tidentityProvider$,\n\tmembership$$,\n\tmutation$,\n\tproject$,\n\tprojectSecretInfo$$,\n\tquery$,\n\troleConditionVariableDefinition$$,\n\troleDefinition$,\n\troleEntityVariableDefinition$$,\n\trolePredefinedVariableDefinition$$,\n\troleVariableDefinition$$,\n\tsetProjectSecretError$$,\n\tsetProjectSecretResponse$$,\n\tupdateIDPError$$,\n\tupdateIDPResponse$$,\n\tupdateProjectError$$,\n\tupdateProjectResponse$$,\n} from '@contember/graphql-client-tenant'\nimport { CliError, ExitCode } from '@contember/cli-common'\nimport type { ModelType } from 'graphql-ts-client-api'\nimport { TenantApiTransport } from '../TenantApiTransport.js'\nimport { TenantGlobalConfig, TenantIdpOptions } from '../tenantConfig.js'\n\nexport interface RemoteIdentityProvider {\n\tslug: string\n\ttype: string\n\tdisabledAt: string | null\n}\n\nexport interface TenantProjectSummary {\n\tid: string\n\tname: string\n\tslug: string\n}\n\nexport interface TenantProjectRole {\n\tname: string\n\t/** Variable names the role expects, retained for compatibility. */\n\tvariables: string[]\n\tvariableDefinitions: TenantProjectRoleVariableDefinition[]\n}\n\nexport type TenantProjectRoleVariableDefinition =\n\t| { type: 'entity'; name: string; entityName: string }\n\t| { type: 'predefined'; name: string; value: string }\n\t| { type: 'condition'; name: string }\n\nexport interface TenantProjectSecret {\n\tkey: string\n\tcreatedAt: string\n\tupdatedAt: string\n}\n\nexport interface TenantProjectDetail {\n\tid: string\n\tname: string\n\tslug: string\n\tconfig: unknown\n\troles: TenantProjectRole[]\n\tsecrets: TenantProjectSecret[]\n}\n\nexport interface TenantCreateProjectDetails {\n\tname?: string\n\tconfig?: unknown\n\t/** Skip issuing a deploy API key for the project. */\n\tnoDeployToken?: boolean\n}\n\nexport interface TenantCreateProjectResult {\n\t/** Null when {@link TenantCreateProjectDetails.noDeployToken} was requested. */\n\tdeployerApiKey: { id: string; token: string | null } | null\n}\n\nexport interface TenantUpdateProjectChanges {\n\tname?: string\n\tconfig?: unknown\n\tmergeConfig?: boolean\n}\n\nexport interface TenantRateLimitWindowState {\n\tlimit: number\n\twindow: string\n}\n\n/** The tenant-wide configuration returned by `Query.configuration` — the read side of {@link TenantGlobalConfig}. */\nexport interface TenantConfigState {\n\tsignup: { requireEmailVerification: boolean }\n\temailChange: { requireVerification: boolean }\n\tpasswordless: { enabled: ConfigPolicy; url: string | null; expiration: string }\n\tpassword: {\n\t\tminLength: number\n\t\trequireUppercase: number\n\t\trequireLowercase: number\n\t\trequireDigit: number\n\t\trequireSpecial: number\n\t\tpattern: string | null\n\t\tcheckBlacklist: boolean\n\t\tcheckHibp: boolean\n\t}\n\tlogin: {\n\t\tbaseBackoff: string\n\t\tmaxBackoff: string\n\t\tattemptWindow: string\n\t\trevealUserExists: boolean\n\t\trevealLoginMethod: boolean\n\t\tdefaultTokenExpiration: string\n\t\tmaxTokenExpiration: string | null\n\t\tmfaGraceDuration: string\n\t\tanomalyDetection: {\n\t\t\tenabled: boolean\n\t\t\thistorySize: number\n\t\t\temailThreshold: number\n\t\t\tstepUpThreshold: number\n\t\t}\n\t}\n\tcaptcha: {\n\t\tprovider: CaptchaProvider | null\n\t\tthreshold: number | null\n\t\tprotect: {\n\t\t\tsignUp: boolean\n\t\t\tpasswordReset: boolean\n\t\t\tpasswordlessInit: boolean\n\t\t\temailVerification: boolean\n\t\t}\n\t}\n\trateLimits: {\n\t\tsignUpPerIp: TenantRateLimitWindowState\n\t\tloginPerIp: TenantRateLimitWindowState\n\t\tpasswordResetPerIp: TenantRateLimitWindowState\n\t\tpasswordlessInitPerIp: TenantRateLimitWindowState\n\t\temailOtpPerPerson: TenantRateLimitWindowState\n\t\temailVerificationPerIp: TenantRateLimitWindowState\n\t}\n}\n\nexport interface TenantWhoAmIProject {\n\tslug: string\n\tname: string\n\troles: string[]\n}\n\n/** `Query.me` — the identity behind the token the CLI is using. */\nexport interface TenantWhoAmI {\n\tid: string\n\tdescription: string | null\n\t/** Global (tenant-wide) roles — empty for an identity whose access is entirely project-scoped. */\n\troles: string[]\n\tpermissions: { canCreateProject: boolean; canDeployEntrypoint: boolean } | null\n\tprojects: TenantWhoAmIProject[]\n}\n\n// Fetchers are immutable and reusable, so they are built once at module load.\nconst createProjectFetcher = mutation$.createProject(\n\tcreateProjectResponse$$.error(createProjectResponseError$$).result(createProjectResult$.deployerApiKey(apiKeyWithToken$$)),\n)\nconst setProjectSecretFetcher = mutation$.setProjectSecret(setProjectSecretResponse$$.error(setProjectSecretError$$))\nconst updateProjectFetcher = mutation$.updateProject(updateProjectResponse$$.error(updateProjectError$$))\nconst configureFetcher = mutation$.configure(configureResponse$$.error(configureError$$))\nconst configurationFetcher = query$.configuration(\n\tconfig$\n\t\t.signup(configSignup$$)\n\t\t.emailChange(configEmailChange$$)\n\t\t.passwordless(configPasswordless$$)\n\t\t.password(configPassword$$)\n\t\t.login(configLogin$$.anomalyDetection(configLoginAnomalyDetection$$))\n\t\t.captcha(configCaptcha$$.protect(configCaptchaProtect$$))\n\t\t.rateLimits(\n\t\t\tconfigRateLimits$\n\t\t\t\t.signUpPerIp(configRateLimitWindow$$)\n\t\t\t\t.loginPerIp(configRateLimitWindow$$)\n\t\t\t\t.passwordResetPerIp(configRateLimitWindow$$)\n\t\t\t\t.passwordlessInitPerIp(configRateLimitWindow$$)\n\t\t\t\t.emailOtpPerPerson(configRateLimitWindow$$)\n\t\t\t\t.emailVerificationPerIp(configRateLimitWindow$$),\n\t\t),\n)\nconst projectsFetcher = query$.projects(project$.id.name.slug)\nconst roleVariableFetcher = roleVariableDefinition$$\n\t.on(roleConditionVariableDefinition$$)\n\t.on(roleEntityVariableDefinition$$)\n\t.on(rolePredefinedVariableDefinition$$)\nconst toRoleVariableDefinition = (variable: ModelType<typeof roleVariableFetcher>): TenantProjectRoleVariableDefinition => {\n\tswitch (variable.__typename) {\n\t\tcase 'RoleEntityVariableDefinition':\n\t\t\treturn { type: 'entity', name: variable.name, entityName: variable.entityName }\n\t\tcase 'RolePredefinedVariableDefinition':\n\t\t\treturn { type: 'predefined', name: variable.name, value: variable.value }\n\t\tcase 'RoleConditionVariableDefinition':\n\t\t\treturn { type: 'condition', name: variable.name }\n\t\tcase 'RoleVariableDefinition':\n\t\t\tthrow new CliError(`Tenant API returned an abstract role variable definition for \"${variable.name}\".`, {\n\t\t\t\tcode: 'TENANT_API_INVALID_RESPONSE',\n\t\t\t\texitCode: ExitCode.InternalError,\n\t\t\t})\n\t}\n}\nconst projectBySlugFetcher = query$.projectBySlug(\n\tproject$\n\t\t.id.name.slug.config\n\t\t.roles(roleDefinition$.name.variables(roleVariableFetcher))\n\t\t.secrets(projectSecretInfo$$),\n)\nconst identityProvidersFetcher = query$.identityProviders(identityProvider$.slug.type.disabledAt)\nconst addIdpFetcher = mutation$.addIDP(addIDPResponse$$.error(addIDPError$$))\nconst updateIdpFetcher = mutation$.updateIDP(updateIDPResponse$$.error(updateIDPError$$))\nconst enableIdpFetcher = mutation$.enableIDP(enableIDPResponse$$.error(enableIDPError$$))\nconst disableIdpFetcher = mutation$.disableIDP(disableIDPResponse$$.error(disableIDPError$$))\nconst meFetcher = query$.me(\n\tidentity$$\n\t\t.permissions(identityGlobalPermissions$$)\n\t\t.projects(identityProjectRelation$.project(project$.slug.name).memberships(membership$$)),\n)\n\nconst toRateLimitWindow = (it: { limit: number; window: string }): TenantRateLimitWindowState => ({ limit: it.limit, window: it.window })\n\n/** Projects, project secrets, global tenant configuration, identity providers and `me`. */\nexport class TenantProjectClient {\n\tconstructor(\n\t\tprivate readonly transport: TenantApiTransport,\n\t) {\n\t}\n\n\tpublic async listProjects(): Promise<TenantProjectSummary[]> {\n\t\tconst result = await this.transport.exec(projectsFetcher, {})\n\t\treturn result.projects.map(it => ({ id: it.id, name: it.name, slug: it.slug }))\n\t}\n\n\t/** Null both when the project does not exist and when the caller may not see it — the API does not distinguish. */\n\tpublic async getProjectBySlug(slug: string): Promise<TenantProjectDetail | null> {\n\t\tconst result = await this.transport.exec(projectBySlugFetcher, { slug })\n\t\tconst project = result.projectBySlug\n\t\tif (!project) {\n\t\t\treturn null\n\t\t}\n\t\treturn {\n\t\t\tid: project.id,\n\t\t\tname: project.name,\n\t\t\tslug: project.slug,\n\t\t\tconfig: project.config,\n\t\t\troles: project.roles.map(role => ({\n\t\t\t\tname: role.name,\n\t\t\t\tvariables: role.variables.map(it => it.name),\n\t\t\t\tvariableDefinitions: role.variables.map(toRoleVariableDefinition),\n\t\t\t})),\n\t\t\tsecrets: project.secrets.map(it => ({ key: it.key, createdAt: it.createdAt, updatedAt: it.updatedAt })),\n\t\t}\n\t}\n\n\t/** Returns `null` (nothing created) when `ignoreExisting` swallowed an `ALREADY_EXISTS`. */\n\tpublic async createProject(slug: string, ignoreExisting = false, details?: TenantCreateProjectDetails): Promise<TenantCreateProjectResult | null> {\n\t\tconst result = await this.transport.exec(createProjectFetcher, {\n\t\t\tprojectSlug: slug,\n\t\t\tname: details?.name,\n\t\t\tconfig: details?.config,\n\t\t\toptions: details?.noDeployToken ? { noDeployToken: true } : undefined,\n\t\t})\n\t\tif (ignoreExisting && result.createProject?.error?.code === 'ALREADY_EXISTS') {\n\t\t\treturn null\n\t\t}\n\t\tthis.transport.assertOk(result.createProject, `createProject(${slug})`)\n\t\tconst deployerApiKey = result.createProject?.result?.deployerApiKey\n\t\treturn { deployerApiKey: deployerApiKey ? { id: deployerApiKey.id, token: deployerApiKey.token ?? null } : null }\n\t}\n\n\tpublic async updateProject(slug: string, changes: TenantUpdateProjectChanges): Promise<void> {\n\t\tconst result = await this.transport.exec(updateProjectFetcher, {\n\t\t\tprojectSlug: slug,\n\t\t\tname: changes.name,\n\t\t\tconfig: changes.config,\n\t\t\tmergeConfig: changes.mergeConfig,\n\t\t})\n\t\tthis.transport.assertOk(result.updateProject, `updateProject(${slug})`)\n\t}\n\n\tpublic async setProjectSecret(slug: string, key: string, value: string): Promise<void> {\n\t\tconst result = await this.transport.exec(setProjectSecretFetcher, { projectSlug: slug, key, value })\n\t\tthis.transport.assertOk(result.setProjectSecret, `setProjectSecret(${slug}/${key})`)\n\t}\n\n\tpublic async configure(config: TenantGlobalConfig): Promise<void> {\n\t\tconst result = await this.transport.exec(configureFetcher, { config })\n\t\tthis.transport.assertOk(result.configure, 'configure')\n\t}\n\n\tpublic async configuration(): Promise<TenantConfigState> {\n\t\tconst result = await this.transport.exec(configurationFetcher, {})\n\t\tconst config = result.configuration\n\t\treturn {\n\t\t\tsignup: { requireEmailVerification: config.signup.requireEmailVerification },\n\t\t\temailChange: { requireVerification: config.emailChange.requireVerification },\n\t\t\tpasswordless: {\n\t\t\t\tenabled: config.passwordless.enabled,\n\t\t\t\turl: config.passwordless.url ?? null,\n\t\t\t\texpiration: config.passwordless.expiration,\n\t\t\t},\n\t\t\tpassword: {\n\t\t\t\tminLength: config.password.minLength,\n\t\t\t\trequireUppercase: config.password.requireUppercase,\n\t\t\t\trequireLowercase: config.password.requireLowercase,\n\t\t\t\trequireDigit: config.password.requireDigit,\n\t\t\t\trequireSpecial: config.password.requireSpecial,\n\t\t\t\tpattern: config.password.pattern ?? null,\n\t\t\t\tcheckBlacklist: config.password.checkBlacklist,\n\t\t\t\tcheckHibp: config.password.checkHibp,\n\t\t\t},\n\t\t\tlogin: {\n\t\t\t\tbaseBackoff: config.login.baseBackoff,\n\t\t\t\tmaxBackoff: config.login.maxBackoff,\n\t\t\t\tattemptWindow: config.login.attemptWindow,\n\t\t\t\trevealUserExists: config.login.revealUserExists,\n\t\t\t\trevealLoginMethod: config.login.revealLoginMethod,\n\t\t\t\tdefaultTokenExpiration: config.login.defaultTokenExpiration,\n\t\t\t\tmaxTokenExpiration: config.login.maxTokenExpiration ?? null,\n\t\t\t\tmfaGraceDuration: config.login.mfaGraceDuration,\n\t\t\t\tanomalyDetection: {\n\t\t\t\t\tenabled: config.login.anomalyDetection.enabled,\n\t\t\t\t\thistorySize: config.login.anomalyDetection.historySize,\n\t\t\t\t\temailThreshold: config.login.anomalyDetection.emailThreshold,\n\t\t\t\t\tstepUpThreshold: config.login.anomalyDetection.stepUpThreshold,\n\t\t\t\t},\n\t\t\t},\n\t\t\tcaptcha: {\n\t\t\t\tprovider: config.captcha.provider ?? null,\n\t\t\t\tthreshold: config.captcha.threshold ?? null,\n\t\t\t\tprotect: {\n\t\t\t\t\tsignUp: config.captcha.protect.signUp,\n\t\t\t\t\tpasswordReset: config.captcha.protect.passwordReset,\n\t\t\t\t\tpasswordlessInit: config.captcha.protect.passwordlessInit,\n\t\t\t\t\temailVerification: config.captcha.protect.emailVerification,\n\t\t\t\t},\n\t\t\t},\n\t\t\trateLimits: {\n\t\t\t\tsignUpPerIp: toRateLimitWindow(config.rateLimits.signUpPerIp),\n\t\t\t\tloginPerIp: toRateLimitWindow(config.rateLimits.loginPerIp),\n\t\t\t\tpasswordResetPerIp: toRateLimitWindow(config.rateLimits.passwordResetPerIp),\n\t\t\t\tpasswordlessInitPerIp: toRateLimitWindow(config.rateLimits.passwordlessInitPerIp),\n\t\t\t\temailOtpPerPerson: toRateLimitWindow(config.rateLimits.emailOtpPerPerson),\n\t\t\t\temailVerificationPerIp: toRateLimitWindow(config.rateLimits.emailVerificationPerIp),\n\t\t\t},\n\t\t}\n\t}\n\n\tpublic async listIdentityProviders(): Promise<RemoteIdentityProvider[]> {\n\t\tconst result = await this.transport.exec(identityProvidersFetcher, {})\n\t\treturn result.identityProviders.map(it => ({\n\t\t\tslug: it.slug,\n\t\t\ttype: it.type,\n\t\t\tdisabledAt: it.disabledAt ?? null,\n\t\t}))\n\t}\n\n\tpublic async addIdp(slug: string, type: string, configuration: unknown, options?: TenantIdpOptions): Promise<void> {\n\t\tconst result = await this.transport.exec(addIdpFetcher, { identityProvider: slug, type, configuration, options })\n\t\tthis.transport.assertOk(result.addIDP, `addIDP(${slug})`)\n\t}\n\n\tpublic async updateIdp(slug: string, type: string, configuration: unknown, options?: TenantIdpOptions): Promise<void> {\n\t\tconst result = await this.transport.exec(updateIdpFetcher, {\n\t\t\tidentityProvider: slug,\n\t\t\ttype,\n\t\t\tconfiguration,\n\t\t\toptions,\n\t\t\tmergeConfiguration: false,\n\t\t})\n\t\tthis.transport.assertOk(result.updateIDP, `updateIDP(${slug})`)\n\t}\n\n\tpublic async enableIdp(slug: string): Promise<void> {\n\t\tconst result = await this.transport.exec(enableIdpFetcher, { identityProvider: slug })\n\t\tthis.transport.assertOk(result.enableIDP, `enableIDP(${slug})`)\n\t}\n\n\tpublic async disableIdp(slug: string): Promise<void> {\n\t\tconst result = await this.transport.exec(disableIdpFetcher, { identityProvider: slug })\n\t\tthis.transport.assertOk(result.disableIDP, `disableIDP(${slug})`)\n\t}\n\n\tpublic async whoAmI(): Promise<TenantWhoAmI> {\n\t\tconst result = await this.transport.exec(meFetcher, {})\n\t\tconst me = result.me\n\t\treturn {\n\t\t\tid: me.id,\n\t\t\tdescription: me.description ?? null,\n\t\t\troles: me.roles ? [...me.roles] : [],\n\t\t\tpermissions: me.permissions\n\t\t\t\t? { canCreateProject: me.permissions.canCreateProject, canDeployEntrypoint: me.permissions.canDeployEntrypoint }\n\t\t\t\t: null,\n\t\t\tprojects: me.projects.map(it => ({\n\t\t\t\tslug: it.project.slug,\n\t\t\t\tname: it.project.name,\n\t\t\t\troles: it.memberships.map(m => m.role),\n\t\t\t})),\n\t\t}\n\t}\n}\n"],"names":[],"mappings":";;AAsLA,MAAM,uBAAuB,UAAU;AAAA,EACtC,wBAAwB,MAAM,4BAA4B,EAAE,OAAO,qBAAqB,eAAe,iBAAiB,CAAC;AAC1H;AACA,MAAM,0BAA0B,UAAU,iBAAiB,2BAA2B,MAAM,uBAAuB,CAAC;AACpH,MAAM,uBAAuB,UAAU,cAAc,wBAAwB,MAAM,oBAAoB,CAAC;AACxG,MAAM,mBAAmB,UAAU,UAAU,oBAAoB,MAAM,gBAAgB,CAAC;AACxF,MAAM,uBAAuB,OAAO;AAAA,EACnC,QACE,OAAO,cAAc,EACrB,YAAY,mBAAmB,EAC/B,aAAa,oBAAoB,EACjC,SAAS,gBAAgB,EACzB,MAAM,cAAc,iBAAiB,6BAA6B,CAAC,EACnE,QAAQ,gBAAgB,QAAQ,sBAAsB,CAAC,EACvD;AAAA,IACA,kBACE,YAAY,uBAAuB,EACnC,WAAW,uBAAuB,EAClC,mBAAmB,uBAAuB,EAC1C,sBAAsB,uBAAuB,EAC7C,kBAAkB,uBAAuB,EACzC,uBAAuB,uBAAuB;AAAA,EAAA;AAEnD;AACA,MAAM,kBAAkB,OAAO,SAAS,SAAS,GAAG,KAAK,IAAI;AAC7D,MAAM,sBAAsB,yBAC1B,GAAG,iCAAiC,EACpC,GAAG,8BAA8B,EACjC,GAAG,kCAAkC;AACvC,MAAM,2BAA2B,CAAC,aAAyF;AAC1H,UAAQ,SAAS,YAAA;AAAA,IAChB,KAAK;AACJ,aAAO,EAAE,MAAM,UAAU,MAAM,SAAS,MAAM,YAAY,SAAS,WAAA;AAAA,IACpE,KAAK;AACJ,aAAO,EAAE,MAAM,cAAc,MAAM,SAAS,MAAM,OAAO,SAAS,MAAA;AAAA,IACnE,KAAK;AACJ,aAAO,EAAE,MAAM,aAAa,MAAM,SAAS,KAAA;AAAA,IAC5C,KAAK;AACJ,YAAM,IAAI,SAAS,iEAAiE,SAAS,IAAI,MAAM;AAAA,QACtG,MAAM;AAAA,QACN,UAAU,SAAS;AAAA,MAAA,CACnB;AAAA,EAAA;AAEJ;AACA,MAAM,uBAAuB,OAAO;AAAA,EACnC,SACE,GAAG,KAAK,KAAK,OACb,MAAM,gBAAgB,KAAK,UAAU,mBAAmB,CAAC,EACzD,QAAQ,mBAAmB;AAC9B;AACA,MAAM,2BAA2B,OAAO,kBAAkB,kBAAkB,KAAK,KAAK,UAAU;AAChG,MAAM,gBAAgB,UAAU,OAAO,iBAAiB,MAAM,aAAa,CAAC;AAC5E,MAAM,mBAAmB,UAAU,UAAU,oBAAoB,MAAM,gBAAgB,CAAC;AACxF,MAAM,mBAAmB,UAAU,UAAU,oBAAoB,MAAM,gBAAgB,CAAC;AACxF,MAAM,oBAAoB,UAAU,WAAW,qBAAqB,MAAM,iBAAiB,CAAC;AAC5F,MAAM,YAAY,OAAO;AAAA,EACxB,WACE,YAAY,2BAA2B,EACvC,SAAS,yBAAyB,QAAQ,SAAS,KAAK,IAAI,EAAE,YAAY,YAAY,CAAC;AAC1F;AAEA,MAAM,oBAAoB,CAAC,QAAuE,EAAE,OAAO,GAAG,OAAO,QAAQ,GAAG;AAGzH,MAAM,oBAAoB;AAAA,EAChC,YACkB,WAChB;AADgB,SAAA,YAAA;AAAA,EAElB;AAAA,EAEA,MAAa,eAAgD;AAC5D,UAAM,SAAS,MAAM,KAAK,UAAU,KAAK,iBAAiB,EAAE;AAC5D,WAAO,OAAO,SAAS,IAAI,CAAA,QAAO,EAAE,IAAI,GAAG,IAAI,MAAM,GAAG,MAAM,MAAM,GAAG,OAAO;AAAA,EAC/E;AAAA;AAAA,EAGA,MAAa,iBAAiB,MAAmD;AAChF,UAAM,SAAS,MAAM,KAAK,UAAU,KAAK,sBAAsB,EAAE,MAAM;AACvE,UAAM,UAAU,OAAO;AACvB,QAAI,CAAC,SAAS;AACb,aAAO;AAAA,IACR;AACA,WAAO;AAAA,MACN,IAAI,QAAQ;AAAA,MACZ,MAAM,QAAQ;AAAA,MACd,MAAM,QAAQ;AAAA,MACd,QAAQ,QAAQ;AAAA,MAChB,OAAO,QAAQ,MAAM,IAAI,CAAA,UAAS;AAAA,QACjC,MAAM,KAAK;AAAA,QACX,WAAW,KAAK,UAAU,IAAI,CAAA,OAAM,GAAG,IAAI;AAAA,QAC3C,qBAAqB,KAAK,UAAU,IAAI,wBAAwB;AAAA,MAAA,EAC/D;AAAA,MACF,SAAS,QAAQ,QAAQ,IAAI,SAAO,EAAE,KAAK,GAAG,KAAK,WAAW,GAAG,WAAW,WAAW,GAAG,YAAY;AAAA,IAAA;AAAA,EAExG;AAAA;AAAA,EAGA,MAAa,cAAc,MAAc,iBAAiB,OAAO,SAAiF;AACjJ,UAAM,SAAS,MAAM,KAAK,UAAU,KAAK,sBAAsB;AAAA,MAC9D,aAAa;AAAA,MACb,MAAM,SAAS;AAAA,MACf,QAAQ,SAAS;AAAA,MACjB,SAAS,SAAS,gBAAgB,EAAE,eAAe,SAAS;AAAA,IAAA,CAC5D;AACD,QAAI,kBAAkB,OAAO,eAAe,OAAO,SAAS,kBAAkB;AAC7E,aAAO;AAAA,IACR;AACA,SAAK,UAAU,SAAS,OAAO,eAAe,iBAAiB,IAAI,GAAG;AACtE,UAAM,iBAAiB,OAAO,eAAe,QAAQ;AACrD,WAAO,EAAE,gBAAgB,iBAAiB,EAAE,IAAI,eAAe,IAAI,OAAO,eAAe,SAAS,KAAA,IAAS,KAAA;AAAA,EAC5G;AAAA,EAEA,MAAa,cAAc,MAAc,SAAoD;AAC5F,UAAM,SAAS,MAAM,KAAK,UAAU,KAAK,sBAAsB;AAAA,MAC9D,aAAa;AAAA,MACb,MAAM,QAAQ;AAAA,MACd,QAAQ,QAAQ;AAAA,MAChB,aAAa,QAAQ;AAAA,IAAA,CACrB;AACD,SAAK,UAAU,SAAS,OAAO,eAAe,iBAAiB,IAAI,GAAG;AAAA,EACvE;AAAA,EAEA,MAAa,iBAAiB,MAAc,KAAa,OAA8B;AACtF,UAAM,SAAS,MAAM,KAAK,UAAU,KAAK,yBAAyB,EAAE,aAAa,MAAM,KAAK,MAAA,CAAO;AACnG,SAAK,UAAU,SAAS,OAAO,kBAAkB,oBAAoB,IAAI,IAAI,GAAG,GAAG;AAAA,EACpF;AAAA,EAEA,MAAa,UAAU,QAA2C;AACjE,UAAM,SAAS,MAAM,KAAK,UAAU,KAAK,kBAAkB,EAAE,QAAQ;AACrE,SAAK,UAAU,SAAS,OAAO,WAAW,WAAW;AAAA,EACtD;AAAA,EAEA,MAAa,gBAA4C;AACxD,UAAM,SAAS,MAAM,KAAK,UAAU,KAAK,sBAAsB,EAAE;AACjE,UAAM,SAAS,OAAO;AACtB,WAAO;AAAA,MACN,QAAQ,EAAE,0BAA0B,OAAO,OAAO,yBAAA;AAAA,MAClD,aAAa,EAAE,qBAAqB,OAAO,YAAY,oBAAA;AAAA,MACvD,cAAc;AAAA,QACb,SAAS,OAAO,aAAa;AAAA,QAC7B,KAAK,OAAO,aAAa,OAAO;AAAA,QAChC,YAAY,OAAO,aAAa;AAAA,MAAA;AAAA,MAEjC,UAAU;AAAA,QACT,WAAW,OAAO,SAAS;AAAA,QAC3B,kBAAkB,OAAO,SAAS;AAAA,QAClC,kBAAkB,OAAO,SAAS;AAAA,QAClC,cAAc,OAAO,SAAS;AAAA,QAC9B,gBAAgB,OAAO,SAAS;AAAA,QAChC,SAAS,OAAO,SAAS,WAAW;AAAA,QACpC,gBAAgB,OAAO,SAAS;AAAA,QAChC,WAAW,OAAO,SAAS;AAAA,MAAA;AAAA,MAE5B,OAAO;AAAA,QACN,aAAa,OAAO,MAAM;AAAA,QAC1B,YAAY,OAAO,MAAM;AAAA,QACzB,eAAe,OAAO,MAAM;AAAA,QAC5B,kBAAkB,OAAO,MAAM;AAAA,QAC/B,mBAAmB,OAAO,MAAM;AAAA,QAChC,wBAAwB,OAAO,MAAM;AAAA,QACrC,oBAAoB,OAAO,MAAM,sBAAsB;AAAA,QACvD,kBAAkB,OAAO,MAAM;AAAA,QAC/B,kBAAkB;AAAA,UACjB,SAAS,OAAO,MAAM,iBAAiB;AAAA,UACvC,aAAa,OAAO,MAAM,iBAAiB;AAAA,UAC3C,gBAAgB,OAAO,MAAM,iBAAiB;AAAA,UAC9C,iBAAiB,OAAO,MAAM,iBAAiB;AAAA,QAAA;AAAA,MAChD;AAAA,MAED,SAAS;AAAA,QACR,UAAU,OAAO,QAAQ,YAAY;AAAA,QACrC,WAAW,OAAO,QAAQ,aAAa;AAAA,QACvC,SAAS;AAAA,UACR,QAAQ,OAAO,QAAQ,QAAQ;AAAA,UAC/B,eAAe,OAAO,QAAQ,QAAQ;AAAA,UACtC,kBAAkB,OAAO,QAAQ,QAAQ;AAAA,UACzC,mBAAmB,OAAO,QAAQ,QAAQ;AAAA,QAAA;AAAA,MAC3C;AAAA,MAED,YAAY;AAAA,QACX,aAAa,kBAAkB,OAAO,WAAW,WAAW;AAAA,QAC5D,YAAY,kBAAkB,OAAO,WAAW,UAAU;AAAA,QAC1D,oBAAoB,kBAAkB,OAAO,WAAW,kBAAkB;AAAA,QAC1E,uBAAuB,kBAAkB,OAAO,WAAW,qBAAqB;AAAA,QAChF,mBAAmB,kBAAkB,OAAO,WAAW,iBAAiB;AAAA,QACxE,wBAAwB,kBAAkB,OAAO,WAAW,sBAAsB;AAAA,MAAA;AAAA,IACnF;AAAA,EAEF;AAAA,EAEA,MAAa,wBAA2D;AACvE,UAAM,SAAS,MAAM,KAAK,UAAU,KAAK,0BAA0B,EAAE;AACrE,WAAO,OAAO,kBAAkB,IAAI,CAAA,QAAO;AAAA,MAC1C,MAAM,GAAG;AAAA,MACT,MAAM,GAAG;AAAA,MACT,YAAY,GAAG,cAAc;AAAA,IAAA,EAC5B;AAAA,EACH;AAAA,EAEA,MAAa,OAAO,MAAc,MAAc,eAAwB,SAA2C;AAClH,UAAM,SAAS,MAAM,KAAK,UAAU,KAAK,eAAe,EAAE,kBAAkB,MAAM,MAAM,eAAe,QAAA,CAAS;AAChH,SAAK,UAAU,SAAS,OAAO,QAAQ,UAAU,IAAI,GAAG;AAAA,EACzD;AAAA,EAEA,MAAa,UAAU,MAAc,MAAc,eAAwB,SAA2C;AACrH,UAAM,SAAS,MAAM,KAAK,UAAU,KAAK,kBAAkB;AAAA,MAC1D,kBAAkB;AAAA,MAClB;AAAA,MACA;AAAA,MACA;AAAA,MACA,oBAAoB;AAAA,IAAA,CACpB;AACD,SAAK,UAAU,SAAS,OAAO,WAAW,aAAa,IAAI,GAAG;AAAA,EAC/D;AAAA,EAEA,MAAa,UAAU,MAA6B;AACnD,UAAM,SAAS,MAAM,KAAK,UAAU,KAAK,kBAAkB,EAAE,kBAAkB,MAAM;AACrF,SAAK,UAAU,SAAS,OAAO,WAAW,aAAa,IAAI,GAAG;AAAA,EAC/D;AAAA,EAEA,MAAa,WAAW,MAA6B;AACpD,UAAM,SAAS,MAAM,KAAK,UAAU,KAAK,mBAAmB,EAAE,kBAAkB,MAAM;AACtF,SAAK,UAAU,SAAS,OAAO,YAAY,cAAc,IAAI,GAAG;AAAA,EACjE;AAAA,EAEA,MAAa,SAAgC;AAC5C,UAAM,SAAS,MAAM,KAAK,UAAU,KAAK,WAAW,EAAE;AACtD,UAAM,KAAK,OAAO;AAClB,WAAO;AAAA,MACN,IAAI,GAAG;AAAA,MACP,aAAa,GAAG,eAAe;AAAA,MAC/B,OAAO,GAAG,QAAQ,CAAC,GAAG,GAAG,KAAK,IAAI,CAAA;AAAA,MAClC,aAAa,GAAG,cACb,EAAE,kBAAkB,GAAG,YAAY,kBAAkB,qBAAqB,GAAG,YAAY,oBAAA,IACzF;AAAA,MACH,UAAU,GAAG,SAAS,IAAI,CAAA,QAAO;AAAA,QAChC,MAAM,GAAG,QAAQ;AAAA,QACjB,MAAM,GAAG,QAAQ;AAAA,QACjB,OAAO,GAAG,YAAY,IAAI,CAAA,MAAK,EAAE,IAAI;AAAA,MAAA,EACpC;AAAA,IAAA;AAAA,EAEJ;AACD;"}

package/dist/production/src/lib/tenant/clients/index.cjs

@@ -0,0 +1,21 @@
+"use strict";
+Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+const TenantApiKeyClient = require("./TenantApiKeyClient.cjs");
+const TenantMemberClient = require("./TenantMemberClient.cjs");
+const TenantPersonClient = require("./TenantPersonClient.cjs");
+const TenantPolicyClient = require("./TenantPolicyClient.cjs");
+const TenantProjectClient = require("./TenantProjectClient.cjs");
+const createTenantClients = (transport) => ({
+  project: new TenantProjectClient.TenantProjectClient(transport),
+  person: new TenantPersonClient.TenantPersonClient(transport),
+  member: new TenantMemberClient.TenantMemberClient(transport),
+  apiKey: new TenantApiKeyClient.TenantApiKeyClient(transport),
+  policy: new TenantPolicyClient.TenantPolicyClient(transport)
+});
+exports.TenantApiKeyClient = TenantApiKeyClient.TenantApiKeyClient;
+exports.TenantMemberClient = TenantMemberClient.TenantMemberClient;
+exports.TenantPersonClient = TenantPersonClient.TenantPersonClient;
+exports.TenantPolicyClient = TenantPolicyClient.TenantPolicyClient;
+exports.TenantProjectClient = TenantProjectClient.TenantProjectClient;
+exports.createTenantClients = createTenantClients;
+//# sourceMappingURL=index.cjs.map

package/dist/production/src/lib/tenant/clients/index.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.cjs","sources":["../../../../../../../packages/cli/src/lib/tenant/clients/index.ts"],"sourcesContent":["import { TenantApiTransport } from '../TenantApiTransport.js'\nimport { TenantApiKeyClient } from './TenantApiKeyClient.js'\nimport { TenantMemberClient } from './TenantMemberClient.js'\nimport { TenantPersonClient } from './TenantPersonClient.js'\nimport { TenantPolicyClient } from './TenantPolicyClient.js'\nimport { TenantProjectClient } from './TenantProjectClient.js'\n\nexport * from './TenantApiKeyClient.js'\nexport * from './TenantMemberClient.js'\nexport * from './TenantPersonClient.js'\nexport * from './TenantPolicyClient.js'\nexport * from './TenantProjectClient.js'\n\n/** One instance of every tenant domain client, all sharing a single transport. */\nexport interface TenantClients {\n\treadonly project: TenantProjectClient\n\treadonly person: TenantPersonClient\n\treadonly member: TenantMemberClient\n\treadonly apiKey: TenantApiKeyClient\n\treadonly policy: TenantPolicyClient\n}\n\nexport const createTenantClients = (transport: TenantApiTransport): TenantClients => ({\n\tproject: new TenantProjectClient(transport),\n\tperson: new TenantPersonClient(transport),\n\tmember: new TenantMemberClient(transport),\n\tapiKey: new TenantApiKeyClient(transport),\n\tpolicy: new TenantPolicyClient(transport),\n})\n"],"names":["TenantProjectClient","TenantPersonClient","TenantMemberClient","TenantApiKeyClient","TenantPolicyClient"],"mappings":";;;;;;;AAsBO,MAAM,sBAAsB,CAAC,eAAkD;AAAA,EACrF,SAAS,IAAIA,oBAAAA,oBAAoB,SAAS;AAAA,EAC1C,QAAQ,IAAIC,mBAAAA,mBAAmB,SAAS;AAAA,EACxC,QAAQ,IAAIC,mBAAAA,mBAAmB,SAAS;AAAA,EACxC,QAAQ,IAAIC,mBAAAA,mBAAmB,SAAS;AAAA,EACxC,QAAQ,IAAIC,mBAAAA,mBAAmB,SAAS;AACzC;;;;;;;"}

package/dist/production/src/lib/tenant/clients/index.js

@@ -0,0 +1,21 @@
+import { TenantApiKeyClient } from "./TenantApiKeyClient.js";
+import { TenantMemberClient } from "./TenantMemberClient.js";
+import { TenantPersonClient } from "./TenantPersonClient.js";
+import { TenantPolicyClient } from "./TenantPolicyClient.js";
+import { TenantProjectClient } from "./TenantProjectClient.js";
+const createTenantClients = (transport) => ({
+  project: new TenantProjectClient(transport),
+  person: new TenantPersonClient(transport),
+  member: new TenantMemberClient(transport),
+  apiKey: new TenantApiKeyClient(transport),
+  policy: new TenantPolicyClient(transport)
+});
+export {
+  TenantApiKeyClient,
+  TenantMemberClient,
+  TenantPersonClient,
+  TenantPolicyClient,
+  TenantProjectClient,
+  createTenantClients
+};
+//# sourceMappingURL=index.js.map

package/dist/production/src/lib/tenant/clients/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sources":["../../../../../../../packages/cli/src/lib/tenant/clients/index.ts"],"sourcesContent":["import { TenantApiTransport } from '../TenantApiTransport.js'\nimport { TenantApiKeyClient } from './TenantApiKeyClient.js'\nimport { TenantMemberClient } from './TenantMemberClient.js'\nimport { TenantPersonClient } from './TenantPersonClient.js'\nimport { TenantPolicyClient } from './TenantPolicyClient.js'\nimport { TenantProjectClient } from './TenantProjectClient.js'\n\nexport * from './TenantApiKeyClient.js'\nexport * from './TenantMemberClient.js'\nexport * from './TenantPersonClient.js'\nexport * from './TenantPolicyClient.js'\nexport * from './TenantProjectClient.js'\n\n/** One instance of every tenant domain client, all sharing a single transport. */\nexport interface TenantClients {\n\treadonly project: TenantProjectClient\n\treadonly person: TenantPersonClient\n\treadonly member: TenantMemberClient\n\treadonly apiKey: TenantApiKeyClient\n\treadonly policy: TenantPolicyClient\n}\n\nexport const createTenantClients = (transport: TenantApiTransport): TenantClients => ({\n\tproject: new TenantProjectClient(transport),\n\tperson: new TenantPersonClient(transport),\n\tmember: new TenantMemberClient(transport),\n\tapiKey: new TenantApiKeyClient(transport),\n\tpolicy: new TenantPolicyClient(transport),\n})\n"],"names":[],"mappings":";;;;;AAsBO,MAAM,sBAAsB,CAAC,eAAkD;AAAA,EACrF,SAAS,IAAI,oBAAoB,SAAS;AAAA,EAC1C,QAAQ,IAAI,mBAAmB,SAAS;AAAA,EACxC,QAAQ,IAAI,mBAAmB,SAAS;AAAA,EACxC,QAAQ,IAAI,mBAAmB,SAAS;AAAA,EACxC,QAAQ,IAAI,mBAAmB,SAAS;AACzC;"}

package/dist/production/src/lib/tenant/confirmation.cjs

@@ -0,0 +1,23 @@
+"use strict";
+Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+const cliCommon = require("@contember/cli-common");
+const prompt = require("../prompt/prompt.cjs");
+const requireConfirmation = async ({ yes, output, warning }) => {
+  if (yes) {
+    return;
+  }
+  if (!output.canPrompt()) {
+    throw new cliCommon.CliError("TTY not available. Pass --yes to confirm execution.", {
+      code: "TTY_UNAVAILABLE",
+      exitCode: cliCommon.ExitCode.InputError
+    });
+  }
+  output.warn(warning);
+  output.info("(to skip this dialog, you can pass the --yes option)");
+  const confirmed = await prompt.promptConfirm(output, { message: "Do you want to continue?" });
+  if (!confirmed) {
+    throw new cliCommon.CliError("Aborted by the user.", { code: "ABORTED", exitCode: cliCommon.ExitCode.InputError });
+  }
+};
+exports.requireConfirmation = requireConfirmation;
+//# sourceMappingURL=confirmation.cjs.map