@fonderie/client 1.5.0 → 1.7.0

package/brain/signatures.md

@@ -267,7 +267,7 @@ new ConfigAdminClient(opts: IConfigAdminClientOptions): ConfigAdminClient
 
 interface IAdminClientOptions {
     baseUrl: string;
-    adminToken: string;
+    adminToken?: string;
     prefix?: string;
     actor?: string;
 }
@@ -289,6 +289,21 @@ new AdminClient(opts: IAdminClientOptions): AdminClient
   .revokeToken(id: string): Promise<IApiResponse<undefined>>
   .migrations(): Promise<IApiResponse<IAdminMigrationsReport>>
   .applyMigrations(module: string, expect: readonly string[]): Promise<IApiResponse<IAdminMigrationModule>>
+  .session(): Promise<IApiResponse<IAdminSession>>
+  .claim(input: { email: string; password: string; name?: string; }): Promise<IApiResponse<IAdminSession>>
+  .login(input: { email: string; password: string; }): Promise<IApiResponse<IAdminSession>>
+  .enrollment(): Promise<IApiResponse<IAdminEnrollment>>
+  .confirmEnrollment(code: string): Promise<IApiResponse<IAdminSession>>
+  .verify(factor: IAdminSecondFactor): Promise<IApiResponse<IAdminSession>>
+  .stepUp(factor: IAdminSecondFactor): Promise<IApiResponse<{ stepUpFresh: boolean; backupCodesLeft?: number; }>>
+  .logout(): Promise<IApiResponse<undefined>>
+  .inspectLink(token: string): Promise<IApiResponse<{ kind: "invite" | "recovery"; email: string; }>>
+  .redeemLink(input: { token: string; password: string; name?: string; }): Promise<IApiResponse<IAdminSession>>
+  .operators(): Promise<IApiResponse<IAdminOperatorsReport>>
+  .inviteOperator(input: { email: string; scopes: AdminScope[]; expiresInHours?: number; }): Promise<IApiResponse<IAdminCreatedLink>>
+  .recoverOperator(id: string): Promise<IApiResponse<IAdminCreatedLink>>
+  .updateOperator(id: string, input: { scopes?: AdminScope[]; name?: string; disabled?: boolean; }): Promise<IApiResponse<IAdminOperator>>
+  .revokeOperatorLink(id: string): Promise<IApiResponse<undefined>>
 
 interface IAuthAdminClientOptions {
     baseUrl: string;
@@ -305,6 +320,7 @@ interface IAdminLoginHistoryQuery {
 interface IAdminUsersQuery {
     limit?: number;
     cursor?: string;
+    deleted?: boolean;
 }
 
 new AuthAdminClient(opts: IAuthAdminClientOptions): AuthAdminClient
@@ -878,6 +894,68 @@ interface IAdminTokenRecord {
     lastUsedAt: string | null;
 }
 
+interface IAdminOperator {
+    id: string;
+    email: string;
+    name: string | null;
+    scopes: AdminScope[];
+    enrolled: boolean;
+    backupCodesLeft: number;
+    locked: boolean;
+    createdBy: string;
+    createdAt: string;
+    lastLoginAt: string | null;
+    disabledAt: string | null;
+}
+
+interface IAdminOperatorLink {
+    id: string;
+    kind: 'invite' | 'recovery';
+    email: string;
+    scopes: AdminScope[];
+    createdBy: string;
+    createdAt: string;
+    expiresAt: string;
+}
+
+interface IAdminOperatorsReport {
+    operators: IAdminOperator[];
+    links: IAdminOperatorLink[];
+}
+
+interface IAdminCreatedLink {
+    id: string;
+    email: string;
+    scopes?: AdminScope[];
+    expiresAt: string;
+    token: string;
+    url: string;
+}
+
+type AdminSessionState = 'signed-out' | 'needs-2fa' | 'needs-enrollment' | 'signed-in';
+
+interface IAdminSession {
+    state: AdminSessionState;
+    operator: IAdminOperator | null;
+    claimable?: boolean;
+    stepUpFresh?: boolean;
+    backupCodes?: string[];
+    backupCodesLeft?: number;
+}
+
+interface IAdminEnrollment {
+    secret: string;
+    uri: string;
+    account: string;
+    issuer: string;
+}
+
+type IAdminSecondFactor = {
+    code: string;
+} | {
+    backupCode: string;
+};
+
 interface IAdminIssueTokenInput {
     name: string;
     scopes: AdminScope[];

package/dist/index.cjs

@@ -1917,6 +1917,75 @@ var AdminClient = class {
       { expect }
     );
   }
+  // ── operator sign-in (the served console's gate) ──────────────────────
+  // Cookie-based: the server sets an HttpOnly session cookie; nothing here
+  // ever holds it. Omit adminToken on this client — except for claim().
+  /** Who is signed in, and whether the console can still be claimed. */
+  session() {
+    return this.get("/session");
+  }
+  /** The one-time claim. Needs the ROOT token as this client's adminToken. */
+  claim(input) {
+    return this.call("POST", "/session/claim", input);
+  }
+  login(input) {
+    return this.call("POST", "/session/login", input);
+  }
+  /** The authenticator secret and otpauth URI to scan while enrolling. */
+  enrollment() {
+    return this.get("/session/enrollment");
+  }
+  /** Confirms the first code. The response carries the backup codes, once. */
+  confirmEnrollment(code) {
+    return this.call("POST", "/session/enrollment", { code });
+  }
+  /** The second factor after the password: an authenticator code or a backup code. */
+  verify(factor) {
+    return this.call("POST", "/session/verify", factor);
+  }
+  /** A fresh code for the next five minutes of dangerous actions. */
+  stepUp(factor) {
+    return this.call(
+      "POST",
+      "/session/step-up",
+      factor
+    );
+  }
+  logout() {
+    return this.call("DELETE", "/session");
+  }
+  /** What an invite or recovery link is for, before setting a password. */
+  inspectLink(token) {
+    return this.call(
+      "POST",
+      "/session/link/inspect",
+      { token }
+    );
+  }
+  redeemLink(input) {
+    return this.call("POST", "/session/link", input);
+  }
+  // ── managing operators ─────────────────────────────────────────────────
+  operators() {
+    return this.get("/access/operators");
+  }
+  /** An invite link, shown once. Needs the highest scope and a fresh code. */
+  inviteOperator(input) {
+    return this.call("POST", "/access/operators/invites", input);
+  }
+  /** Lost password or authenticator: a single-use link; signs them out everywhere. */
+  recoverOperator(id) {
+    return this.call(
+      "POST",
+      `/access/operators/${encodeURIComponent(id)}/recovery`
+    );
+  }
+  updateOperator(id, input) {
+    return this.call("PUT", `/access/operators/${encodeURIComponent(id)}`, input);
+  }
+  revokeOperatorLink(id) {
+    return this.call("DELETE", `/access/operators/links/${encodeURIComponent(id)}`);
+  }
 };
 
 // src/modules/auth-admin.ts
@@ -1945,6 +2014,7 @@ var AuthAdminClient = class {
     const q = new URLSearchParams();
     if (query.limit) q.set("limit", String(query.limit));
     if (query.cursor) q.set("cursor", query.cursor);
+    if (query.deleted) q.set("deleted", "1");
     const qs = q.toString();
     return this.call("GET", qs ? `?${qs}` : "");
   }