@cubist-labs/cubesigner-sdk 0.4.276 → 0.4.279

package/package.json

@@ -5,7 +5,7 @@
     "url": "git+https://github.com/cubist-labs/CubeSigner-TypeScript-SDK.git",
     "directory": "packages/sdk"
   },
-  "version": "0.4.276",
+  "version": "0.4.279",
   "type": "module",
   "description": "CubeSigner TypeScript SDK",
   "license": "MIT OR Apache-2.0",

package/src/acl.ts

@@ -7,7 +7,9 @@ export type Ace<TAction, TCtx> = {
   subjects: AceAttribute<string>;
   /** The actions being performed */
   actions: AceAttribute<TAction>;
+  /** The effect of this access control entry. */
+  effect?: "Allow" | "Deny";
 } & TCtx;
 
 /** An attribute of an access control entry. */
-export type AceAttribute<T> = "*" | T | T[];
+export type AceAttribute<T> = "*" | T | T[] | { except: T[] };

package/src/client/api_client.ts

@@ -224,6 +224,55 @@ export type SessionSelector =
       role?: string;
     };
 
+/**
+ * Options for listing the users in an org.
+ */
+export interface ListUsersOptions {
+  /** Pagination options. Defaults to fetching the entire result set. */
+  page?: PageOpts;
+
+  /**
+   * If defined, all returned users will contain this string in their name or email.
+   */
+  searchQuery?: string;
+
+  /**
+   * If defined, only users with one of these roles in the org are returned,
+   * grouped by role in descending role order (owners first, aliens last).
+   */
+  membership?: MemberRole[];
+}
+
+/**
+ * Options for listing the pending invitations in an org.
+ */
+export interface ListInvitationsOptions {
+  /** Pagination options. Defaults to fetching the entire result set. */
+  page?: PageOpts;
+
+  /**
+   * If defined, only invitations for one of these roles are returned,
+   * grouped by role in descending role order (owners first, aliens last).
+   */
+  membership?: MemberRole[];
+}
+
+/**
+ * Distinguishes the `ListUsersOptions` argument of {@link ApiClient.orgUsersList}
+ * from its deprecated leading `PageOpts` argument. This works because the two types
+ * have disjoint keys: any of the `PageOpts` keys being present identifies a `PageOpts`,
+ * so everything else is a `ListUsersOptions`. An argument with none of those keys
+ * (e.g. `{}`) is reported as `ListUsersOptions`, which is harmless: neither
+ * interpretation restricts the result set.
+ *
+ * @param arg The first argument passed to `orgUsersList`.
+ * @returns Whether `arg` is a `ListUsersOptions` (as opposed to `PageOpts`).
+ */
+function isListUsersOptions(arg: ListUsersOptions | PageOpts | undefined): arg is ListUsersOptions {
+  if (arg === undefined) return false;
+  return !("size" in arg || "start" in arg || "all" in arg);
+}
+
 /**
  * An extension of BaseClient that adds specialized methods for api endpoints
  */
@@ -785,17 +834,18 @@ export class ApiClient extends BaseClient {
    * List pending invitations in the org, i.e., those that have neither been
    * accepted nor canceled, and have not expired.
    *
-   * @param page Pagination options. Defaults to fetching the entire result set.
+   * @param opts Pagination and filtering options. Defaults to fetching the entire result set.
    * @returns Paginator for iterating over the pending invitations in the org.
    */
   orgInvitationsList(
-    page?: PageOpts,
+    opts?: ListInvitationsOptions,
   ): Paginator<PaginatedListInvitationsResponse, InvitationInfo[]> {
     const o = op("/v0/org/{org_id}/invitations", "get");
 
     return Paginator.items(
-      page ?? Page.default(),
-      (pageQuery) => this.exec(o, { params: { query: { ...pageQuery } } }),
+      opts?.page ?? Page.default(),
+      (pageQuery) =>
+        this.exec(o, { params: { query: { membership: opts?.membership, ...pageQuery } } }),
       (r) => r.invitations,
       (r) => r.last_evaluated_key,
     );
@@ -840,19 +890,44 @@ export class ApiClient extends BaseClient {
   /**
    * List users in the org.
    *
+   * @overload
+   * @param opts Pagination and filtering options. Defaults to fetching the entire result set.
+   * @returns Paginator for iterating over the users in the org.
+   */
+  orgUsersList(opts?: ListUsersOptions): Paginator<GetUsersInOrgResponse, UserInOrgInfo[]>;
+  /**
+   * List users in the org.
+   *
+   * @overload
    * @param page Pagination options. Defaults to fetching the entire result set.
-   * @param searchQuery Optional query string. If defined, all returned users will contain this string in their name or email.
+   * @param searchQuery Query string. If defined, all returned users will contain this string in their name or email.
    * @returns Paginator for iterating over the users in the org.
+   * @deprecated Use the `ListUsersOptions` parameter overload instead.
    */
   orgUsersList(
     page?: PageOpts,
     searchQuery?: string,
+  ): Paginator<GetUsersInOrgResponse, UserInOrgInfo[]>;
+  /**
+   * List users in the org.
+   *
+   * @param opts Either pagination and filtering options, or (deprecated) just pagination options.
+   * @param searchQuery Deprecated search query string; only used with the deprecated overload.
+   * @returns Paginator for iterating over the users in the org.
+   */
+  orgUsersList(
+    opts?: ListUsersOptions | PageOpts,
+    searchQuery?: string,
   ): Paginator<GetUsersInOrgResponse, UserInOrgInfo[]> {
+    const luOpts: ListUsersOptions = isListUsersOptions(opts) ? opts : { page: opts, searchQuery };
     const o = op("/v0/org/{org_id}/users", "get");
 
     return Paginator.items(
-      page ?? Page.default(),
-      (pageQuery) => this.exec(o, { params: { query: { q: searchQuery, ...pageQuery } } }),
+      luOpts.page ?? Page.default(),
+      (pageQuery) =>
+        this.exec(o, {
+          params: { query: { q: luOpts.searchQuery, membership: luOpts.membership, ...pageQuery } },
+        }),
       (r) => r.users.map(ApiClient.#processUserInOrgInfo),
       (r) => r.last_evaluated_key,
     );
@@ -2232,6 +2307,9 @@ export class ApiClient extends BaseClient {
   /**
    * List pending MFA requests accessible to the current user.
    *
+   * Note that legacy MFA requests are not paginated: every accessible one is
+   * returned in the first page, on top of the requested page limit.
+   *
    * @param page Pagination options. Defaults to fetching the entire result set.
    * @returns Paginator for iterating over the MFA requests.
    */

package/src/org.ts

@@ -32,6 +32,8 @@ import type {
   AuditLogRequest,
   MfaReceipts,
   InvitationInfo,
+  ListUsersOptions,
+  ListInvitationsOptions,
 } from "./index.ts";
 import { Contact } from "./contact.ts";
 import { C2FFunction, Key, MfaRequest, Role } from "./index.ts";
@@ -541,10 +543,11 @@ export class Org {
    * List all pending invitations in the organization, i.e., those that have
    * neither been accepted nor canceled, and have not expired.
    *
+   * @param opts Pagination and filtering options. Defaults to fetching the entire result set.
    * @returns The list of pending invitations
    */
-  async invitations(): Promise<InvitationInfo[]> {
-    return await this.#apiClient.orgInvitationsList().fetchAll();
+  async invitations(opts?: ListInvitationsOptions): Promise<InvitationInfo[]> {
+    return await this.#apiClient.orgInvitationsList(opts).fetchAll();
   }
 
   /**
@@ -617,11 +620,32 @@ export class Org {
   /**
    * List all users in the organization.
    *
-   * @param searchQuery Optional query string. If defined, all returned users will contain this string in their name or email.
+   * @overload
+   * @param opts Additional options for filtering the users.
    * @returns The list of users
    */
-  async users(searchQuery?: string): Promise<UserInOrgInfo[]> {
-    return await this.#apiClient.orgUsersList(undefined, searchQuery).fetchAll();
+  async users(opts?: ListUsersOptions): Promise<UserInOrgInfo[]>;
+  /**
+   * List all users in the organization.
+   *
+   * @overload
+   * @param searchQuery Query string. If defined, all returned users will contain this string in their name or email.
+   * @returns The list of users
+   * @deprecated Use the `ListUsersOptions` parameter overload instead.
+   */
+  async users(searchQuery?: string): Promise<UserInOrgInfo[]>;
+  /**
+   * List all users in the organization.
+   *
+   * @param optsOrSearchQuery Either additional options for filtering the users, or (deprecated) a search query string.
+   * @returns The list of users
+   */
+  async users(optsOrSearchQuery?: ListUsersOptions | string): Promise<UserInOrgInfo[]> {
+    const opts: ListUsersOptions =
+      typeof optsOrSearchQuery === "string"
+        ? { searchQuery: optsOrSearchQuery }
+        : (optsOrSearchQuery ?? {});
+    return await this.#apiClient.orgUsersList(opts).fetchAll();
   }
 
   /**

package/src/policy.ts

@@ -78,7 +78,7 @@ export type PolicyCtx = {
    * The resources (keys, roles, and key-in-roles) that the access control entry
    * applies to.
    */
-  resources: AceAttribute<PolicyResource>;
+  resources?: AceAttribute<PolicyResource>;
 };
 
 /** A resource a policy is invoked with or attached to. */

package/src/schema.ts

@@ -755,6 +755,8 @@ export interface paths {
      *
      * NOTE that if pagination is used and a page limit is set, the returned result
      * set may contain either FEWER or MORE elements than the requested page limit.
+     * In particular, legacy MFA requests are not paginated: every accessible one
+     * is returned in the first page, on top of the page limit.
      */
     get: operations["mfaList"];
   };
@@ -2880,6 +2882,9 @@ export interface components {
     /** @enum {string} */
     BadRequestErrorCode:
       | "GenericBadRequest"
+      | "CannotVoteOnRedeemedRequest"
+      | "PendingOpAlreadyVetoed"
+      | "MultiplePendingOpsReferenced"
       | "DisallowedAllowRuleReference"
       | "InvalidPaginationToken"
       | "InvalidEmail"
@@ -7018,10 +7023,10 @@ export interface components {
       | "SessionPossiblyStolenToken"
       | "MfaDisallowedIdentity"
       | "MfaDisallowedApprover"
+      | "PendingOpDisallowedApprover"
       | "MfaTypeNotAllowed"
       | "MfaNotApprovedYet"
       | "MfaConfirmationCodeMismatch"
-      | "MfaHttpRequestMismatch"
       | "MfaRemoveBelowMin"
       | "MfaOrgRequirementNotMet"
       | "MfaRegistrationDisallowed"
@@ -7985,13 +7990,16 @@ export interface components {
      * }
      */
     MfaPolicy: {
-      /** @description Users who are allowed to approve. If empty at creation time, default to the current user. */
+      /**
+       * @description Users who are allowed to approve. If empty, the current user
+       * will be inserted by default.
+       */
       allowed_approvers?: string[];
       /** @description Allowed approval types. When omitted, defaults to any. */
       allowed_mfa_types?: components["schemas"]["MfaType"][] | null;
       /**
        * Format: int32
-       * @description How many users to require to approve (defaults to 1).
+       * @description How many users must approve (defaults to 1).
        */
       count?: number;
       lifetime?: components["schemas"]["Seconds"];
@@ -8054,7 +8062,7 @@ export interface components {
     MfaRequiredArgs: {
       /** @description Always set to first MFA id from `Self::ids` */
       id: string;
-      /** @description Non-empty MFA request IDs */
+      /** @description Non-empty MFA request IDs or [`PendingOpPolicyRef`]-form refs */
       ids: string[];
       /** @description Organization id */
       org_id: string;
@@ -9347,6 +9355,8 @@ export interface components {
       | components["schemas"]["EvmTxDepositErrorCode"];
     /** @enum {string} */
     PolicyErrorOwnCodes:
+      | "MfaHttpRequestMismatch"
+      | "MfaExpired"
       | "Inapplicable"
       | "SuiTxReceiversDisallowedTransactionKind"
       | "SuiTxReceiversDisallowedTransferAddress"
@@ -9423,6 +9433,7 @@ export interface components {
       | "WasmPolicyFailed"
       | "WebhookPoliciesDisabled"
       | "DeniedByWebhook"
+      | "MfaApprovalsNotYetValid"
       | "ExplicitlyDenied";
     /** @description A struct containing all the information about a specific version of a policy. */
     PolicyInfo: {
@@ -9523,8 +9534,7 @@ export interface components {
       | "ConcurrentSigningWhenTimeLimitPolicyIsDefined"
       | "BabylonEotsConcurrentSigning"
       | "TendermintStateError"
-      | "TendermintConcurrentSigning"
-      | "MfaApprovalsNotYetValid";
+      | "TendermintConcurrentSigning";
     /** @description Contains outputs of previous transactions. */
     PrevOutputs: OneOf<
       [
@@ -10676,28 +10686,36 @@ export interface components {
        */
       created_validator_key_id: string;
     };
+    /**
+     * @description Approval state for a [`MfaRequest`] in [`MfaRequestSource::Legacy`] mode:
+     * the per-policy [`ApprovalConstraints`] plus an inline `approved_by` map.
+     * Pooled MfaRequests carry only [`ApprovalConstraints`] — their approvals live
+     * on the linked [`PendingOp`] — so the type system enforces "no pooled
+     * MfaRequest has an `approved_by`."
+     */
     Status: {
       /** @description Users who are allowed to approve. Must be non-empty. */
       allowed_approvers: string[];
       /** @description Allowed approval types. When omitted, defaults to any. */
       allowed_mfa_types?: components["schemas"]["MfaType"][] | null;
-      /** @description Users who have already approved */
-      approved_by: {
-        [key: string]: {
-          [key: string]: components["schemas"]["ApprovalInfo"];
-        };
-      };
       /**
        * Format: int32
-       * @description How many users must approve
+       * @description How many users must approve (defaults to 1).
        */
       count: number;
       /**
        * Format: int32
-       * @description How many auth factors to require per user
+       * @description How many auth factors to require per user (defaults to 1).
        */
       num_auth_factors: number;
       request_comparer?: components["schemas"]["HttpRequestCmp"];
+    } & {
+      /** @description Users who have already approved. */
+      approved_by: {
+        [key: string]: {
+          [key: string]: components["schemas"]["ApprovalInfo"];
+        };
+      };
     };
     /**
      * @description A single asset balance entry returned by [`SubAccountAssetsResponse`].
@@ -16229,6 +16247,8 @@ export interface operations {
          * the exact value previously returned as 'last_evaluated_key' from the same endpoint.
          */
         "page.start"?: string | null;
+        /** @description Membership roles. If defined, only invitations for one of these roles are returned, grouped by role in descending role order (owners first, aliens last). */
+        membership?: components["schemas"]["MemberRole"][] | null;
       };
       path: {
         /**
@@ -16735,6 +16755,8 @@ export interface operations {
    *
    * NOTE that if pagination is used and a page limit is set, the returned result
    * set may contain either FEWER or MORE elements than the requested page limit.
+   * In particular, legacy MFA requests are not paginated: every accessible one
+   * is returned in the first page, on top of the page limit.
    */
   mfaList: {
     parameters: {
@@ -19691,6 +19713,8 @@ export interface operations {
         "page.start"?: string | null;
         /** @description A query string. If defined, all returned users will contain this string in their name or email. */
         q?: string | null;
+        /** @description Membership roles. If defined, only users with one of these roles in the org are returned, grouped by role in descending role order (owners first, aliens last). */
+        membership?: components["schemas"]["MemberRole"][] | null;
       };
       path: {
         /**