@fonderie/client 1.4.0 → 1.6.0

package/brain/signatures.md

@@ -240,6 +240,7 @@ interface ISetConfigInput {
     description?: string;
     active?: boolean;
     ifVersion?: number;
+    allowTypeChange?: boolean;
 }
 
 interface ISetSecretInput {
@@ -266,7 +267,7 @@ new ConfigAdminClient(opts: IConfigAdminClientOptions): ConfigAdminClient
 
 interface IAdminClientOptions {
     baseUrl: string;
-    adminToken: string;
+    adminToken?: string;
     prefix?: string;
     actor?: string;
 }
@@ -288,6 +289,21 @@ new AdminClient(opts: IAdminClientOptions): AdminClient
   .revokeToken(id: string): Promise<IApiResponse<undefined>>
   .migrations(): Promise<IApiResponse<IAdminMigrationsReport>>
   .applyMigrations(module: string, expect: readonly string[]): Promise<IApiResponse<IAdminMigrationModule>>
+  .session(): Promise<IApiResponse<IAdminSession>>
+  .claim(input: { email: string; password: string; name?: string; }): Promise<IApiResponse<IAdminSession>>
+  .login(input: { email: string; password: string; }): Promise<IApiResponse<IAdminSession>>
+  .enrollment(): Promise<IApiResponse<IAdminEnrollment>>
+  .confirmEnrollment(code: string): Promise<IApiResponse<IAdminSession>>
+  .verify(factor: IAdminSecondFactor): Promise<IApiResponse<IAdminSession>>
+  .stepUp(factor: IAdminSecondFactor): Promise<IApiResponse<{ stepUpFresh: boolean; backupCodesLeft?: number; }>>
+  .logout(): Promise<IApiResponse<undefined>>
+  .inspectLink(token: string): Promise<IApiResponse<{ kind: "invite" | "recovery"; email: string; }>>
+  .redeemLink(input: { token: string; password: string; name?: string; }): Promise<IApiResponse<IAdminSession>>
+  .operators(): Promise<IApiResponse<IAdminOperatorsReport>>
+  .inviteOperator(input: { email: string; scopes: AdminScope[]; expiresInHours?: number; }): Promise<IApiResponse<IAdminCreatedLink>>
+  .recoverOperator(id: string): Promise<IApiResponse<IAdminCreatedLink>>
+  .updateOperator(id: string, input: { scopes?: AdminScope[]; name?: string; disabled?: boolean; }): Promise<IApiResponse<IAdminOperator>>
+  .revokeOperatorLink(id: string): Promise<IApiResponse<undefined>>
 
 interface IAuthAdminClientOptions {
     baseUrl: string;
@@ -877,6 +893,68 @@ interface IAdminTokenRecord {
     lastUsedAt: string | null;
 }
 
+interface IAdminOperator {
+    id: string;
+    email: string;
+    name: string | null;
+    scopes: AdminScope[];
+    enrolled: boolean;
+    backupCodesLeft: number;
+    locked: boolean;
+    createdBy: string;
+    createdAt: string;
+    lastLoginAt: string | null;
+    disabledAt: string | null;
+}
+
+interface IAdminOperatorLink {
+    id: string;
+    kind: 'invite' | 'recovery';
+    email: string;
+    scopes: AdminScope[];
+    createdBy: string;
+    createdAt: string;
+    expiresAt: string;
+}
+
+interface IAdminOperatorsReport {
+    operators: IAdminOperator[];
+    links: IAdminOperatorLink[];
+}
+
+interface IAdminCreatedLink {
+    id: string;
+    email: string;
+    scopes?: AdminScope[];
+    expiresAt: string;
+    token: string;
+    url: string;
+}
+
+type AdminSessionState = 'signed-out' | 'needs-2fa' | 'needs-enrollment' | 'signed-in';
+
+interface IAdminSession {
+    state: AdminSessionState;
+    operator: IAdminOperator | null;
+    claimable?: boolean;
+    stepUpFresh?: boolean;
+    backupCodes?: string[];
+    backupCodesLeft?: number;
+}
+
+interface IAdminEnrollment {
+    secret: string;
+    uri: string;
+    account: string;
+    issuer: string;
+}
+
+type IAdminSecondFactor = {
+    code: string;
+} | {
+    backupCode: string;
+};
+
 interface IAdminIssueTokenInput {
     name: string;
     scopes: AdminScope[];
@@ -1602,10 +1680,14 @@ function castConfigValue(type: ConfigValueType, raw: string): CastResult
 
 function configKeyProblem(key: string): string | null
 
+function configValueLabel(value: unknown): string
+
 function configValueType(value: unknown): ConfigValueType
 
 function formatConfigValue(value: unknown, type?: ConfigValueType): string
 
+function inferConfigValue(raw: string): IInferredConfigValue
+
 type CastResult = {
     ok: true;
     value: unknown;
@@ -1616,6 +1698,13 @@ type CastResult = {
 
 type ConfigValueType = 'string' | 'number' | 'boolean' | 'json';
 
+interface IInferredConfigValue {
+    type: ConfigValueType;
+    value: unknown;
+    label: string;
+    ambiguous: boolean;
+}
+
 new ConfigClient(http: HttpClient, tokens: TokenStore): ConfigClient
   .load(): Promise<IRemoteConfigState>
   .get<T>(key: string, fallback: T): T

package/dist/index.cjs

@@ -40,10 +40,12 @@ __export(index_exports, {
   WorkspacesClient: () => WorkspacesClient,
   castConfigValue: () => castConfigValue,
   configKeyProblem: () => configKeyProblem,
+  configValueLabel: () => configValueLabel,
   configValueType: () => configValueType,
   createMemoryCache: () => createMemoryCache,
   describeLocation: () => describeLocation,
   formatConfigValue: () => formatConfigValue,
+  inferConfigValue: () => inferConfigValue,
   isMfaRequired: () => isMfaRequired
 });
 module.exports = __toCommonJS(index_exports);
@@ -1915,6 +1917,75 @@ var AdminClient = class {
       { expect }
     );
   }
+  // ── operator sign-in (the served console's gate) ──────────────────────
+  // Cookie-based: the server sets an HttpOnly session cookie; nothing here
+  // ever holds it. Omit adminToken on this client — except for claim().
+  /** Who is signed in, and whether the console can still be claimed. */
+  session() {
+    return this.get("/session");
+  }
+  /** The one-time claim. Needs the ROOT token as this client's adminToken. */
+  claim(input) {
+    return this.call("POST", "/session/claim", input);
+  }
+  login(input) {
+    return this.call("POST", "/session/login", input);
+  }
+  /** The authenticator secret and otpauth URI to scan while enrolling. */
+  enrollment() {
+    return this.get("/session/enrollment");
+  }
+  /** Confirms the first code. The response carries the backup codes, once. */
+  confirmEnrollment(code) {
+    return this.call("POST", "/session/enrollment", { code });
+  }
+  /** The second factor after the password: an authenticator code or a backup code. */
+  verify(factor) {
+    return this.call("POST", "/session/verify", factor);
+  }
+  /** A fresh code for the next five minutes of dangerous actions. */
+  stepUp(factor) {
+    return this.call(
+      "POST",
+      "/session/step-up",
+      factor
+    );
+  }
+  logout() {
+    return this.call("DELETE", "/session");
+  }
+  /** What an invite or recovery link is for, before setting a password. */
+  inspectLink(token) {
+    return this.call(
+      "POST",
+      "/session/link/inspect",
+      { token }
+    );
+  }
+  redeemLink(input) {
+    return this.call("POST", "/session/link", input);
+  }
+  // ── managing operators ─────────────────────────────────────────────────
+  operators() {
+    return this.get("/access/operators");
+  }
+  /** An invite link, shown once. Needs the highest scope and a fresh code. */
+  inviteOperator(input) {
+    return this.call("POST", "/access/operators/invites", input);
+  }
+  /** Lost password or authenticator: a single-use link; signs them out everywhere. */
+  recoverOperator(id) {
+    return this.call(
+      "POST",
+      `/access/operators/${encodeURIComponent(id)}/recovery`
+    );
+  }
+  updateOperator(id, input) {
+    return this.call("PUT", `/access/operators/${encodeURIComponent(id)}`, input);
+  }
+  revokeOperatorLink(id) {
+    return this.call("DELETE", `/access/operators/links/${encodeURIComponent(id)}`);
+  }
 };
 
 // src/modules/auth-admin.ts
@@ -2230,6 +2301,35 @@ function configKeyProblem(key) {
   if (!key) return "Enter a key.";
   return CONFIG_KEY_PATTERN.test(key) ? null : 'Start with a letter; use letters, digits, ".", "_" or "-" (max 128).';
 }
+var PLAIN_NUMBER = /^-?(0|[1-9]\d*)(\.\d+)?$/;
+function configValueLabel(value) {
+  if (typeof value === "string") return "Text";
+  if (typeof value === "number") return "Number";
+  if (typeof value === "boolean") return "On/off";
+  if (Array.isArray(value)) return "List";
+  if (value === null) return "Empty";
+  return "Object";
+}
+function inferConfigValue(raw) {
+  const t = raw.trim();
+  if (t === "true" || t === "false") {
+    return { type: "boolean", value: t === "true", label: "On/off", ambiguous: true };
+  }
+  if (PLAIN_NUMBER.test(t)) {
+    const n = Number(t);
+    if (Number.isFinite(n) && String(n) === t) return { type: "number", value: n, label: "Number", ambiguous: true };
+  }
+  if (t.startsWith("{") || t.startsWith("[")) {
+    try {
+      const parsed = JSON.parse(t);
+      if (parsed !== null && typeof parsed === "object") {
+        return { type: "json", value: parsed, label: Array.isArray(parsed) ? "List" : "Object", ambiguous: false };
+      }
+    } catch {
+    }
+  }
+  return { type: "string", value: raw, label: "Text", ambiguous: false };
+}
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
   AdminClient,
@@ -2252,10 +2352,12 @@ function configKeyProblem(key) {
   WorkspacesClient,
   castConfigValue,
   configKeyProblem,
+  configValueLabel,
   configValueType,
   createMemoryCache,
   describeLocation,
   formatConfigValue,
+  inferConfigValue,
   isMfaRequired
 });
 //# sourceMappingURL=index.cjs.map