@envsync-cloud/envsync-ts-sdk 0.20.0 → 0.20.3

package/dist/index.js

@@ -44,6 +44,7 @@ __export(src_exports, {
   DynamicSecretEngineResponse: () => DynamicSecretEngineResponse,
   DynamicSecretsService: () => DynamicSecretsService,
   EffectiveAccessEntry: () => EffectiveAccessEntry,
+  EnterpriseCmkService: () => EnterpriseCmkService,
   EnterpriseProviderProfile: () => EnterpriseProviderProfile,
   EnterpriseService: () => EnterpriseService,
   EnvSyncAPISDK: () => EnvSyncAPISDK,
@@ -66,9 +67,14 @@ __export(src_exports, {
   OidcProvidersService: () => OidcProvidersService,
   OnboardingService: () => OnboardingService,
   OpenAPI: () => OpenAPI,
+  OrgFeaturesService: () => OrgFeaturesService,
+  OrgKmsConfigResponse: () => OrgKmsConfigResponse,
+  OrgKmsJobResponse: () => OrgKmsJobResponse,
+  OrgKmsVerifyResponse: () => OrgKmsVerifyResponse,
   OrganizationsService: () => OrganizationsService,
   PermissionsService: () => PermissionsService,
   ProviderConnection: () => ProviderConnection,
+  PutOrgFeatureGrantRequest: () => PutOrgFeatureGrantRequest,
   RevokeAccessRequest: () => RevokeAccessRequest,
   RolesService: () => RolesService,
   RotateGpgKeyRequest: () => RotateGpgKeyRequest,
@@ -90,13 +96,15 @@ __export(src_exports, {
   SystemService: () => SystemService,
   SystemStatusState: () => SystemStatusState,
   TeamsService: () => TeamsService,
+  UpdateOrgKmsConfigRequest: () => UpdateOrgKmsConfigRequest,
   UpdateProviderConnectionRequest: () => UpdateProviderConnectionRequest,
   UpdateTrustLevelRequest: () => UpdateTrustLevelRequest,
   UpdateWebhookRequest: () => UpdateWebhookRequest,
   UsersService: () => UsersService,
   VariableRollbackResponse: () => VariableRollbackResponse,
   WebhookResponse: () => WebhookResponse,
-  WebhooksService: () => WebhooksService
+  WebhooksService: () => WebhooksService,
+  WhoAmIResponse: () => WhoAmIResponse
 });
 module.exports = __toCommonJS(src_exports);
 
@@ -1764,6 +1772,190 @@ var EnterpriseService = class {
   }
 };
 
+// src/services/EnterpriseCmkService.ts
+var EnterpriseCmkService = class {
+  constructor(httpRequest) {
+    this.httpRequest = httpRequest;
+  }
+  /**
+   * Break-glass detach organization CMK
+   * Hosted platform API. Enqueues detach-to-managed even if the org lost the kms grant or status is unavailable. Does not call ensureTenantKek.
+   * @param xEnvSyncPlatformToken
+   * @param orgId
+   * @returns OrgKmsJobResponse Already on managed wrapping
+   * @throws ApiError
+   */
+  breakGlassDetachOrgKms(xEnvSyncPlatformToken, orgId) {
+    return this.httpRequest.request({
+      method: "POST",
+      url: "/api/v1/manage/kms/{orgId}/break-glass-detach",
+      path: {
+        "orgId": orgId
+      },
+      headers: {
+        "X-EnvSync-Platform-Token": xEnvSyncPlatformToken
+      },
+      errors: {
+        401: `Invalid platform token`,
+        403: `Not hosted`,
+        500: `Internal server error`
+      }
+    });
+  }
+  /**
+   * Get organization KMS config
+   * Returns implicit managed/active when no org_kms_config row exists. Never returns key material.
+   * @returns OrgKmsConfigResponse Organization KMS config
+   * @throws ApiError
+   */
+  getOrgKmsConfig() {
+    return this.httpRequest.request({
+      method: "GET",
+      url: "/api/v1/manage/kms",
+      errors: {
+        500: `Internal server error`
+      }
+    });
+  }
+  /**
+   * Update organization KMS config
+   * Self-host cloud sources return 403 CMK_HOSTED_ONLY. Hosted persists cloud source as pending until attach.
+   * @param requestBody
+   * @returns OrgKmsConfigResponse Organization KMS config updated
+   * @throws ApiError
+   */
+  updateOrgKmsConfig(requestBody) {
+    return this.httpRequest.request({
+      method: "PUT",
+      url: "/api/v1/manage/kms",
+      body: requestBody,
+      mediaType: "application/json",
+      errors: {
+        403: `Cloud CMK is Hosted-only`,
+        409: `A rewrap job is already running`,
+        500: `Internal server error`
+      }
+    });
+  }
+  /**
+   * Create a purpose=kms org secret
+   * Encrypts the value under scope __kms_config__ before insert. Does not require the integrations feature.
+   * @param requestBody
+   * @returns OrgKmsCredentialResponse Credential created (value redacted)
+   * @throws ApiError
+   */
+  createOrgKmsCredential(requestBody) {
+    return this.httpRequest.request({
+      method: "POST",
+      url: "/api/v1/manage/kms/credentials",
+      body: requestBody,
+      mediaType: "application/json",
+      errors: {
+        500: `Internal server error`
+      }
+    });
+  }
+  /**
+   * Verify organization KMS
+   * Managed source succeeds immediately. Cloud verify unwraps or first-wraps the tenant KEK.
+   * @returns OrgKmsVerifyResponse Verify result
+   * @throws ApiError
+   */
+  verifyOrgKms() {
+    return this.httpRequest.request({
+      method: "POST",
+      url: "/api/v1/manage/kms/verify",
+      errors: {
+        500: `Internal server error`,
+        503: `CMK unavailable`
+      }
+    });
+  }
+  /**
+   * Rotate organization KEK
+   * Re-wraps wrapped_kek under the current key_ref. Hosted cloud-only; does not rewrap DEKs.
+   * @returns OrgKmsConfigResponse KEK rotated
+   * @throws ApiError
+   */
+  rotateOrgKmsKek() {
+    return this.httpRequest.request({
+      method: "POST",
+      url: "/api/v1/manage/kms/rotate-kek",
+      errors: {
+        500: `Internal server error`
+      }
+    });
+  }
+  /**
+   * Attach organization CMK
+   * Enqueues DEK rewrap under the tenant KEK with allow_root_unwrap during the attach window. Hosted only.
+   * @returns OrgKmsJobResponse Attach job enqueued
+   * @throws ApiError
+   */
+  attachOrgKms() {
+    return this.httpRequest.request({
+      method: "POST",
+      url: "/api/v1/manage/kms/attach",
+      errors: {
+        403: `Cloud CMK is Hosted-only`,
+        409: `A rewrap job is already running`,
+        500: `Internal server error`
+      }
+    });
+  }
+  /**
+   * Detach organization CMK to managed
+   * Enqueues detach_managed. Does not call ensureTenantKek when status is unavailable.
+   * @returns OrgKmsJobResponse Detach job enqueued
+   * @throws ApiError
+   */
+  detachOrgKms() {
+    return this.httpRequest.request({
+      method: "POST",
+      url: "/api/v1/manage/kms/detach",
+      errors: {
+        409: `A rewrap job is already running`,
+        500: `Internal server error`
+      }
+    });
+  }
+  /**
+   * Get organization KMS job
+   * @param id
+   * @returns OrgKmsJobResponse KMS job
+   * @throws ApiError
+   */
+  getOrgKmsJob(id) {
+    return this.httpRequest.request({
+      method: "GET",
+      url: "/api/v1/manage/kms/jobs/{id}",
+      path: {
+        "id": id
+      },
+      errors: {
+        404: `Job not found`,
+        500: `Internal server error`
+      }
+    });
+  }
+  /**
+   * List per-app KMS key info
+   * Calls GetKeyInfo per app. Never returns key material.
+   * @returns OrgKmsAppsResponse Per-app key metadata
+   * @throws ApiError
+   */
+  listOrgKmsApps() {
+    return this.httpRequest.request({
+      method: "GET",
+      url: "/api/v1/manage/kms/apps",
+      errors: {
+        500: `Internal server error`,
+        503: `CMK unavailable`
+      }
+    });
+  }
+};
+
 // src/services/EnvironmentTypesService.ts
 var EnvironmentTypesService = class {
   constructor(httpRequest) {
@@ -3171,6 +3363,91 @@ var OrganizationsService = class {
   }
 };
 
+// src/services/OrgFeaturesService.ts
+var OrgFeaturesService = class {
+  constructor(httpRequest) {
+    this.httpRequest = httpRequest;
+  }
+  /**
+   * Get Organization Feature Grant
+   * Hosted platform API. No row means unrestricted (full catalog).
+   * @param xEnvSyncPlatformToken
+   * @param orgId
+   * @returns OrgFeatureGrantResponse Organization feature grant
+   * @throws ApiError
+   */
+  getOrgFeatureGrant(xEnvSyncPlatformToken, orgId) {
+    return this.httpRequest.request({
+      method: "GET",
+      url: "/api/v1/manage/org-features/{orgId}",
+      path: {
+        "orgId": orgId
+      },
+      headers: {
+        "X-EnvSync-Platform-Token": xEnvSyncPlatformToken
+      },
+      errors: {
+        401: `Invalid platform token`,
+        403: `Not hosted`,
+        500: `Internal server error`
+      }
+    });
+  }
+  /**
+   * Replace Organization Feature Grant
+   * Full replace. Empty features[] denies every EE feature. Unknown catalog keys are dropped.
+   * @param xEnvSyncPlatformToken
+   * @param orgId
+   * @param requestBody
+   * @returns OrgFeatureGrantResponse Organization feature grant replaced
+   * @throws ApiError
+   */
+  putOrgFeatureGrant(xEnvSyncPlatformToken, orgId, requestBody) {
+    return this.httpRequest.request({
+      method: "PUT",
+      url: "/api/v1/manage/org-features/{orgId}",
+      path: {
+        "orgId": orgId
+      },
+      headers: {
+        "X-EnvSync-Platform-Token": xEnvSyncPlatformToken
+      },
+      body: requestBody,
+      mediaType: "application/json",
+      errors: {
+        401: `Invalid platform token`,
+        403: `Not hosted`,
+        500: `Internal server error`
+      }
+    });
+  }
+  /**
+   * Delete Organization Feature Grant
+   * Drops the grant row so the organization is unrestricted.
+   * @param xEnvSyncPlatformToken
+   * @param orgId
+   * @returns OrgFeatureGrantResponse Grant deleted; organization unrestricted
+   * @throws ApiError
+   */
+  deleteOrgFeatureGrant(xEnvSyncPlatformToken, orgId) {
+    return this.httpRequest.request({
+      method: "DELETE",
+      url: "/api/v1/manage/org-features/{orgId}",
+      path: {
+        "orgId": orgId
+      },
+      headers: {
+        "X-EnvSync-Platform-Token": xEnvSyncPlatformToken
+      },
+      errors: {
+        401: `Invalid platform token`,
+        403: `Not hosted`,
+        500: `Internal server error`
+      }
+    });
+  }
+};
+
 // src/services/PermissionsService.ts
 var PermissionsService = class {
   constructor(httpRequest) {
@@ -3657,7 +3934,7 @@ var SamlProvidersService = class {
   }
   /**
    * Get SAML Provider
-   * Retrieve a specific SAML provider
+   * Retrieve a specific SAML provider. Certificate PEM is omitted unless include=certificate.
    * @param id
    * @returns SamlProviderResponse SAML provider retrieved successfully
    * @throws ApiError
@@ -3717,9 +3994,9 @@ var SamlProvidersService = class {
   }
   /**
    * Get SAML SP Metadata
-   * Retrieve SAML Service Provider metadata XML for the organization
+   * Redirects to the public SP metadata URL for this organization
    * @param id
-   * @returns string SP metadata XML
+   * @returns void
    * @throws ApiError
    */
   getSamlMetadata(id) {
@@ -3728,6 +4005,9 @@ var SamlProvidersService = class {
       url: "/api/v1/manage/saml/{id}/metadata",
       path: {
         "id": id
+      },
+      errors: {
+        302: `Redirect to /api/saml/metadata/{orgId}`
       }
     });
   }
@@ -3739,42 +4019,85 @@ var SamlSsoService = class {
     this.httpRequest = httpRequest;
   }
   /**
-   * Initiate SAML SSO
-   * Start SP-initiated SAML SSO flow by generating an AuthnRequest redirect URL
-   * @param requestBody
-   * @returns SamlSsoResponse Redirect URL generated
+   * Get public SAML SP metadata
+   * Unauthenticated SP metadata XML for the organization
+   * @param orgId
+   * @returns string SP metadata XML
    * @throws ApiError
    */
-  initiateSamlSso(requestBody) {
+  getPublicSamlMetadata(orgId) {
     return this.httpRequest.request({
-      method: "POST",
-      url: "/api/v1/manage/saml/sso",
-      body: requestBody,
-      mediaType: "application/json",
+      method: "GET",
+      url: "/api/saml/metadata/{orgId}",
+      path: {
+        "orgId": orgId
+      },
       errors: {
-        500: `Internal server error`
+        404: `SSO is not available`
       }
     });
   }
   /**
    * SAML Assertion Consumer Service
-   * Receive and validate SAML Response from the identity provider (ACS endpoint)
+   * Receive and validate a SAML Response from the identity provider
    * @param orgId
-   * @returns any Authentication successful
+   * @returns void
    * @throws ApiError
    */
-  handleSamlAcs(orgId) {
+  handlePublicSamlAcs(orgId) {
     return this.httpRequest.request({
       method: "POST",
-      url: "/api/v1/manage/saml/acs/{orgId}",
+      url: "/api/saml/acs/{orgId}",
       path: {
         "orgId": orgId
       },
       errors: {
+        302: `Authentication successful`,
         401: `Authentication failed`
       }
     });
   }
+  /**
+   * Start SAML SSO
+   * Unauthenticated SP-initiated start. Returns a redirect URL for the login page or CLI.
+   * @param orgSlug
+   * @param requestBody
+   * @returns SamlSsoResponse Redirect URL generated
+   * @throws ApiError
+   */
+  startPublicSamlSso(orgSlug, requestBody) {
+    return this.httpRequest.request({
+      method: "POST",
+      url: "/api/saml/sso/{orgSlug}",
+      path: {
+        "orgSlug": orgSlug
+      },
+      body: requestBody,
+      mediaType: "application/json",
+      errors: {
+        404: `SSO is not available`
+      }
+    });
+  }
+  /**
+   * Bookmark SAML SSO start
+   * Success redirects to the IdP. Any error redirects to the dashboard login page.
+   * @param orgSlug
+   * @returns void
+   * @throws ApiError
+   */
+  startPublicSamlSsoRedirect(orgSlug) {
+    return this.httpRequest.request({
+      method: "GET",
+      url: "/api/saml/sso/{orgSlug}",
+      path: {
+        "orgSlug": orgSlug
+      },
+      errors: {
+        302: `Redirect to the IdP or /login?sso=failed`
+      }
+    });
+  }
 };
 
 // src/services/SecretsService.ts
@@ -4747,6 +5070,7 @@ var EnvSyncAPISDK = class {
   changeRequests;
   dynamicSecrets;
   enterprise;
+  enterpriseCmk;
   environmentTypes;
   environmentVariables;
   environmentVariablesPointInTime;
@@ -4758,6 +5082,7 @@ var EnvSyncAPISDK = class {
   oidcProviders;
   onboarding;
   organizations;
+  orgFeatures;
   permissions;
   roles;
   rotation;
@@ -4775,8 +5100,8 @@ var EnvSyncAPISDK = class {
   request;
   constructor(config, HttpRequest = FetchHttpRequest) {
     this.request = new HttpRequest({
-      BASE: config?.BASE ?? "http://localhost:4000",
-      VERSION: config?.VERSION ?? "0.20.0",
+      BASE: config?.BASE ?? "http://localhost:0",
+      VERSION: config?.VERSION ?? "0.20.1",
       WITH_CREDENTIALS: config?.WITH_CREDENTIALS ?? false,
       CREDENTIALS: config?.CREDENTIALS ?? "include",
       TOKEN: config?.TOKEN,
@@ -4794,6 +5119,7 @@ var EnvSyncAPISDK = class {
     this.changeRequests = new ChangeRequestsService(this.request);
     this.dynamicSecrets = new DynamicSecretsService(this.request);
     this.enterprise = new EnterpriseService(this.request);
+    this.enterpriseCmk = new EnterpriseCmkService(this.request);
     this.environmentTypes = new EnvironmentTypesService(this.request);
     this.environmentVariables = new EnvironmentVariablesService(this.request);
     this.environmentVariablesPointInTime = new EnvironmentVariablesPointInTimeService(this.request);
@@ -4805,6 +5131,7 @@ var EnvSyncAPISDK = class {
     this.oidcProviders = new OidcProvidersService(this.request);
     this.onboarding = new OnboardingService(this.request);
     this.organizations = new OrganizationsService(this.request);
+    this.orgFeatures = new OrgFeaturesService(this.request);
     this.permissions = new PermissionsService(this.request);
     this.roles = new RolesService(this.request);
     this.rotation = new RotationService(this.request);
@@ -4824,8 +5151,8 @@ var EnvSyncAPISDK = class {
 
 // src/core/OpenAPI.ts
 var OpenAPI = {
-  BASE: "http://localhost:4000",
-  VERSION: "0.20.0",
+  BASE: "http://localhost:0",
+  VERSION: "0.20.1",
   WITH_CREDENTIALS: false,
   CREDENTIALS: "include",
   TOKEN: void 0,
@@ -5158,6 +5485,64 @@ var OidcProviderResponse;
   })(provider_type = OidcProviderResponse2.provider_type || (OidcProviderResponse2.provider_type = {}));
 })(OidcProviderResponse || (OidcProviderResponse = {}));
 
+// src/models/OrgKmsConfigResponse.ts
+var OrgKmsConfigResponse;
+((OrgKmsConfigResponse2) => {
+  let source;
+  ((source2) => {
+    source2["MANAGED"] = "managed";
+    source2["AWS_KMS"] = "aws-kms";
+    source2["GCP_KMS"] = "gcp-kms";
+    source2["AZURE_KV"] = "azure-kv";
+  })(source = OrgKmsConfigResponse2.source || (OrgKmsConfigResponse2.source = {}));
+  let status;
+  ((status2) => {
+    status2["ACTIVE"] = "active";
+    status2["PENDING"] = "pending";
+    status2["ROTATING"] = "rotating";
+    status2["UNAVAILABLE"] = "unavailable";
+    status2["DISABLED"] = "disabled";
+  })(status = OrgKmsConfigResponse2.status || (OrgKmsConfigResponse2.status = {}));
+})(OrgKmsConfigResponse || (OrgKmsConfigResponse = {}));
+
+// src/models/OrgKmsJobResponse.ts
+var OrgKmsJobResponse;
+((OrgKmsJobResponse2) => {
+  let kind;
+  ((kind2) => {
+    kind2["KEK_REWRAP"] = "kek_rewrap";
+    kind2["DEK_REWRAP"] = "dek_rewrap";
+    kind2["DETACH_MANAGED"] = "detach_managed";
+  })(kind = OrgKmsJobResponse2.kind || (OrgKmsJobResponse2.kind = {}));
+  let status;
+  ((status2) => {
+    status2["PENDING"] = "pending";
+    status2["RUNNING"] = "running";
+    status2["SUCCEEDED"] = "succeeded";
+    status2["FAILED"] = "failed";
+  })(status = OrgKmsJobResponse2.status || (OrgKmsJobResponse2.status = {}));
+})(OrgKmsJobResponse || (OrgKmsJobResponse = {}));
+
+// src/models/OrgKmsVerifyResponse.ts
+var OrgKmsVerifyResponse;
+((OrgKmsVerifyResponse2) => {
+  let source;
+  ((source2) => {
+    source2["MANAGED"] = "managed";
+    source2["AWS_KMS"] = "aws-kms";
+    source2["GCP_KMS"] = "gcp-kms";
+    source2["AZURE_KV"] = "azure-kv";
+  })(source = OrgKmsVerifyResponse2.source || (OrgKmsVerifyResponse2.source = {}));
+  let status;
+  ((status2) => {
+    status2["ACTIVE"] = "active";
+    status2["PENDING"] = "pending";
+    status2["ROTATING"] = "rotating";
+    status2["UNAVAILABLE"] = "unavailable";
+    status2["DISABLED"] = "disabled";
+  })(status = OrgKmsVerifyResponse2.status || (OrgKmsVerifyResponse2.status = {}));
+})(OrgKmsVerifyResponse || (OrgKmsVerifyResponse = {}));
+
 // src/models/ProviderConnection.ts
 var ProviderConnection;
 ((ProviderConnection2) => {
@@ -5177,6 +5562,17 @@ var ProviderConnection;
   })(status = ProviderConnection2.status || (ProviderConnection2.status = {}));
 })(ProviderConnection || (ProviderConnection = {}));
 
+// src/models/PutOrgFeatureGrantRequest.ts
+var PutOrgFeatureGrantRequest;
+((PutOrgFeatureGrantRequest2) => {
+  let source;
+  ((source2) => {
+    source2["BILLING"] = "billing";
+    source2["SUPPORT"] = "support";
+    source2["SEED"] = "seed";
+  })(source = PutOrgFeatureGrantRequest2.source || (PutOrgFeatureGrantRequest2.source = {}));
+})(PutOrgFeatureGrantRequest || (PutOrgFeatureGrantRequest = {}));
+
 // src/models/RevokeAccessRequest.ts
 var RevokeAccessRequest;
 ((RevokeAccessRequest2) => {
@@ -5328,6 +5724,18 @@ var SystemStatusState;
   })(deployment_mode = SystemStatusState2.deployment_mode || (SystemStatusState2.deployment_mode = {}));
 })(SystemStatusState || (SystemStatusState = {}));
 
+// src/models/UpdateOrgKmsConfigRequest.ts
+var UpdateOrgKmsConfigRequest;
+((UpdateOrgKmsConfigRequest2) => {
+  let source;
+  ((source2) => {
+    source2["MANAGED"] = "managed";
+    source2["AWS_KMS"] = "aws-kms";
+    source2["GCP_KMS"] = "gcp-kms";
+    source2["AZURE_KV"] = "azure-kv";
+  })(source = UpdateOrgKmsConfigRequest2.source || (UpdateOrgKmsConfigRequest2.source = {}));
+})(UpdateOrgKmsConfigRequest || (UpdateOrgKmsConfigRequest = {}));
+
 // src/models/UpdateProviderConnectionRequest.ts
 var UpdateProviderConnectionRequest;
 ((UpdateProviderConnectionRequest2) => {
@@ -5408,6 +5816,18 @@ var WebhookResponse;
     linked_to2["APP"] = "app";
   })(linked_to = WebhookResponse2.linked_to || (WebhookResponse2.linked_to = {}));
 })(WebhookResponse || (WebhookResponse = {}));
+
+// src/models/WhoAmIResponse.ts
+var WhoAmIResponse;
+((WhoAmIResponse2) => {
+  let auth_type;
+  ((auth_type2) => {
+    auth_type2["JWT"] = "jwt";
+    auth_type2["SAML"] = "saml";
+    auth_type2["OIDC"] = "oidc";
+    auth_type2["API_KEY"] = "api_key";
+  })(auth_type = WhoAmIResponse2.auth_type || (WhoAmIResponse2.auth_type = {}));
+})(WhoAmIResponse || (WhoAmIResponse = {}));
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
   AccessService,
@@ -5434,6 +5854,7 @@ var WebhookResponse;
   DynamicSecretEngineResponse,
   DynamicSecretsService,
   EffectiveAccessEntry,
+  EnterpriseCmkService,
   EnterpriseProviderProfile,
   EnterpriseService,
   EnvSyncAPISDK,
@@ -5456,9 +5877,14 @@ var WebhookResponse;
   OidcProvidersService,
   OnboardingService,
   OpenAPI,
+  OrgFeaturesService,
+  OrgKmsConfigResponse,
+  OrgKmsJobResponse,
+  OrgKmsVerifyResponse,
   OrganizationsService,
   PermissionsService,
   ProviderConnection,
+  PutOrgFeatureGrantRequest,
   RevokeAccessRequest,
   RolesService,
   RotateGpgKeyRequest,
@@ -5480,12 +5906,14 @@ var WebhookResponse;
   SystemService,
   SystemStatusState,
   TeamsService,
+  UpdateOrgKmsConfigRequest,
   UpdateProviderConnectionRequest,
   UpdateTrustLevelRequest,
   UpdateWebhookRequest,
   UsersService,
   VariableRollbackResponse,
   WebhookResponse,
-  WebhooksService
+  WebhooksService,
+  WhoAmIResponse
 });
 //# sourceMappingURL=index.js.map