@inf-monkeys-tech/monkeys-cli 0.12.13 → 0.12.15

package/dist/data/workflow-columns.js

@@ -0,0 +1,218 @@
+import { createHash, randomUUID } from 'node:crypto';
+import { mkdir, writeFile } from 'node:fs/promises';
+import { dirname, resolve } from 'node:path';
+import { Ajv } from 'ajv';
+import { parseWorkflowColumnBinding } from '@inf-monkeys-tech/monkeys';
+import { z } from 'zod';
+import { resolveApiOperation } from '../api-operation/resolver.js';
+import { CliError, EXIT_CODES } from '../errors/cli-error.js';
+import { requestSemantic, requireSemanticTeam, unwrapServerData } from '../semantic/runtime.js';
+import { requireExactId } from './policy.js';
+import { normalizeOpenApiSchema } from '../openapi/schema.js';
+const base = '/api/kernel/data-v2/feature-columns/{columnId}/workflow-binding';
+const permissions = ['data_management:access', 'data_asset:write'];
+function define(id, method, suffix = '') {
+    return {
+        id,
+        method,
+        path: base + suffix,
+        command: ['data', 'field', 'workflow'],
+        risk: method === 'GET' ? 'read' : 'bounded-write',
+        apiBindings: [{ apiOperationId: id, adapter: 'workflow-column-v1' }],
+    };
+}
+export const WORKFLOW_COLUMN_OPERATIONS = {
+    get: define('getWorkflowColumnBinding', 'GET'),
+    configure: define('configureWorkflowColumnBinding', 'PUT'),
+    recompute: define('recomputeWorkflowColumn', 'POST', '/recompute'),
+    inputContract: define('getWorkflowColumnInputContract', 'GET', '/input-contract'),
+};
+const statusSchema = z.object({
+    id: z.string().min(1),
+    teamId: z.string().min(1),
+    ontologyId: z.string().min(1),
+    columnId: z.string().min(1),
+    state: z.enum(['preparing', 'active', 'paused', 'disabled', 'invalid']),
+    binding: z.unknown(),
+    definitionVersion: z.string().regex(/^[1-9][0-9]*$/),
+    initializing: z.boolean(),
+    lastError: z.string().nullable(),
+    counts: z.record(z.string(), z.number().int().nonnegative()),
+    failures: z.array(z.object({ assetId: z.string(), error: z.string().nullable(), updatedTimestamp: z.number().finite() })).max(10),
+});
+const inputContractSchema = z.object({
+    workflowId: z.string(),
+    workflowVersion: z.number().int().positive(),
+    schemaHash: z.string().regex(/^[a-f0-9]{64}$/),
+    variables: z.array(z.record(z.string(), z.unknown())),
+});
+const hash = (value) => {
+    const canonical = (item) => Array.isArray(item)
+        ? item.map(canonical)
+        : item && typeof item === 'object'
+            ? Object.fromEntries(Object.entries(item)
+                .sort(([a], [b]) => a.localeCompare(b))
+                .map(([key, child]) => [key, canonical(child)]))
+            : item;
+    return createHash('sha256')
+        .update(JSON.stringify(canonical(value)))
+        .digest('hex');
+};
+function fail(code, message, exitCode = EXIT_CODES.validation) {
+    throw new CliError(message, { code, exitCode });
+}
+export function workflowColumnBinding(value) {
+    try {
+        return parseWorkflowColumnBinding(value);
+    }
+    catch (cause) {
+        throw new CliError('Input must be a valid WorkflowColumnBinding v1.', {
+            cause,
+            code: 'WORKFLOW_COLUMN_INPUT_INVALID',
+            exitCode: EXIT_CODES.validation,
+        });
+    }
+}
+export class WorkflowColumnClient {
+    runtime;
+    columnId;
+    executionTeamId;
+    resourceTeamId;
+    constructor(runtime, columnId, resourceTeam) {
+        this.runtime = runtime;
+        this.columnId = columnId;
+        this.executionTeamId = requireSemanticTeam(runtime, 'data field workflow');
+        if (this.executionTeamId === '0')
+            fail('WORKFLOW_COLUMN_EXECUTION_TEAM_REQUIRED', 'Select a real execution Team with --team; use --resource-team 0 for public data.');
+        requireExactId(columnId, 'Field');
+        this.resourceTeamId = requireExactId(resourceTeam ?? this.executionTeamId, 'Resource Team');
+        if (this.resourceTeamId !== '0' && this.resourceTeamId !== this.executionTeamId)
+            fail('WORKFLOW_COLUMN_RESOURCE_TEAM_INVALID', 'Resource Team must be the execution Team or public Team 0.');
+    }
+    validate(key, body) {
+        const definition = WORKFLOW_COLUMN_OPERATIONS[key];
+        const binding = resolveApiOperation(definition, this.runtime.index);
+        const operation = this.runtime.index.byOperationId[definition.id];
+        if (!operation ||
+            operation.method !== definition.method ||
+            operation.pathTemplate !== definition.path ||
+            operation.published !== true ||
+            operation.stability !== 'stable' ||
+            operation.authSurfaces?.join(',') !== 'kernel' ||
+            operation.risk !== definition.risk ||
+            operation.resourcePolicyEnforced !== true ||
+            [...(operation.requiredPermissions ?? [])].sort().join(',') !== [...permissions].sort().join(','))
+            fail('WORKFLOW_COLUMN_CONTRACT_UNAVAILABLE', 'Deployment must publish the exact guarded Workflow column contract; refresh after deployment.', EXIT_CODES.compatibility);
+        if (definition.method !== 'GET' && (!this.runtime.schemaFresh || !this.runtime.document))
+            fail('WORKFLOW_COLUMN_FRESH_SCHEMA_REQUIRED', 'Writes require a fresh published schema; repeat preflight with --refresh.', EXIT_CODES.compatibility);
+        if (key === 'configure') {
+            const request = operation.requestBody;
+            const schema = request?.content?.['application/json']?.schema;
+            if (!schema)
+                fail('WORKFLOW_COLUMN_SCHEMA_MISSING', 'Published binding request schema is missing.', EXIT_CODES.compatibility);
+            const validate = new Ajv({ strict: false }).compile(normalizeOpenApiSchema({ ...schema, components: this.runtime.document?.components }));
+            if (!validate(body))
+                fail('WORKFLOW_COLUMN_INPUT_INVALID', 'Input does not match the published request schema.');
+        }
+        return binding;
+    }
+    async call(key, query = {}, body) {
+        this.validate(key, body);
+        const result = await requestSemantic(this.runtime, WORKFLOW_COLUMN_OPERATIONS[key], {
+            pathParameters: { columnId: this.columnId },
+            query: { ...query, teamId: this.resourceTeamId },
+            dataPerspective: 'kernel',
+            timeoutMs: 60000,
+            ...(body === undefined ? {} : { body }),
+        });
+        return unwrapServerData(result.response.data);
+    }
+    parseStatus(value) {
+        const parsed = statusSchema.safeParse(value);
+        if (!parsed.success)
+            fail('WORKFLOW_COLUMN_RESPONSE_INVALID', 'Deployment returned an invalid column status.', EXIT_CODES.compatibility);
+        const status = parsed.data;
+        if (status.teamId !== this.resourceTeamId || status.columnId !== this.columnId)
+            fail('WORKFLOW_COLUMN_RESPONSE_SCOPE_MISMATCH', 'Returned column status belongs to a different resource scope.', EXIT_CODES.compatibility);
+        return { ...status, binding: workflowColumnBinding(status.binding) };
+    }
+    async get() {
+        return this.parseStatus(await this.call('get'));
+    }
+    async inputContract(ontologyId, workflowId, workflowVersion) {
+        requireExactId(ontologyId, 'Ontology');
+        requireExactId(workflowId, 'Workflow');
+        if (!Number.isSafeInteger(workflowVersion) || workflowVersion < 1)
+            fail('WORKFLOW_COLUMN_VERSION_INVALID', 'Workflow version must be a positive integer.');
+        const parsed = inputContractSchema.safeParse(await this.call('inputContract', { ontologyId, workflowId, workflowVersion }));
+        if (!parsed.success || parsed.data.workflowId !== workflowId || parsed.data.workflowVersion !== workflowVersion)
+            fail('WORKFLOW_COLUMN_INPUT_CONTRACT_INVALID', 'Deployment returned a different or invalid Workflow input contract.', EXIT_CODES.compatibility);
+        return parsed.data;
+    }
+    async mutate(input) {
+        if (!input.dryRun && !input.yes)
+            fail('CONFIRMATION_REQUIRED', 'Use --dry-run to inspect or --yes to apply this column change.', EXIT_CODES.confirmation);
+        const desired = input.action === 'configure' ? workflowColumnBinding(input.binding) : undefined;
+        this.validate(input.action, desired ? { binding: desired } : undefined);
+        let before = null;
+        try {
+            before = await this.get();
+        }
+        catch (error) {
+            if (!(input.action === 'configure' && error instanceof CliError && error.code === 'HTTP_404'))
+                throw error;
+        }
+        const ontologyId = input.action === 'configure' ? requireExactId(input.ontologyId ?? '', 'Ontology') : before.ontologyId;
+        const binding = desired ?? before.binding;
+        if (before && before.ontologyId !== ontologyId)
+            fail('WORKFLOW_COLUMN_SCOPE_MISMATCH', 'Existing binding belongs to a different Ontology.');
+        if (binding.enabled && !binding.paused) {
+            const contract = await this.inputContract(ontologyId, binding.workflow.id, binding.workflow.version);
+            if (contract.schemaHash !== binding.workflow.inputSchemaHash)
+                fail('WORKFLOW_COLUMN_INPUT_SCHEMA_CHANGED', 'Workflow variables changed; update input bindings before saving.');
+        }
+        const common = {
+            action: input.action,
+            executionTeamId: this.executionTeamId,
+            resourceTeamId: this.resourceTeamId,
+            columnId: this.columnId,
+            ontologyId,
+            binding,
+            before,
+        };
+        if (input.dryRun)
+            return { ...common, dryRun: true, writeRequestSent: false };
+        const snapshotPath = resolve(input.snapshot ?? `.monkeys-workflow-column-snapshots/${Date.now()}-${randomUUID()}.json`);
+        await mkdir(dirname(snapshotPath), { recursive: true });
+        await writeFile(snapshotPath, JSON.stringify({ ...common, binding: before?.binding ?? null }, null, 2) + '\n', {
+            flag: 'wx',
+            mode: 0o600,
+        });
+        try {
+            const written = this.parseStatus(await this.call(input.action, input.action === 'configure' ? { ontologyId } : {}, desired ? { binding: desired } : undefined));
+            const after = await this.get();
+            if (hash(after.binding) !== hash(binding) ||
+                hash(after.binding) !== hash(written.binding) ||
+                after.ontologyId !== ontologyId ||
+                after.state !== (!binding.enabled ? 'disabled' : binding.paused ? 'paused' : 'active'))
+                fail('WORKFLOW_COLUMN_READBACK_MISMATCH', 'Binding write did not reach the expected active, paused or disabled state.', EXIT_CODES.partial);
+            return {
+                ...common,
+                snapshotPath,
+                after,
+                dryRun: false,
+                writeRequestSent: true,
+                readBack: { matches: true, sha256: hash(after.binding) },
+            };
+        }
+        catch (cause) {
+            throw new CliError('Binding write or readback did not complete. Inspect data field workflow get before retrying; the saved snapshot can restore the prior binding.', {
+                cause,
+                code: 'WORKFLOW_COLUMN_MUTATION_UNVERIFIED',
+                exitCode: EXIT_CODES.partial,
+                safeDetails: { columnId: this.columnId, resourceTeamId: this.resourceTeamId, snapshotPath, requestState: 'sent_or_unknown' },
+            });
+        }
+    }
+}
+//# sourceMappingURL=workflow-columns.js.map

package/dist/data/workflow-columns.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"workflow-columns.js","sourceRoot":"","sources":["../../src/data/workflow-columns.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACrD,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AACpD,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAC7C,OAAO,EAAE,GAAG,EAAkB,MAAM,KAAK,CAAC;AAC1C,OAAO,EAAE,0BAA0B,EAA8B,MAAM,2BAA2B,CAAC;AACnG,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,mBAAmB,EAAE,MAAM,8BAA8B,CAAC;AACnE,OAAO,EAAE,QAAQ,EAAE,UAAU,EAAiB,MAAM,wBAAwB,CAAC;AAC7E,OAAO,EAAE,eAAe,EAAE,mBAAmB,EAAE,gBAAgB,EAAwB,MAAM,wBAAwB,CAAC;AACtH,OAAO,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAC7C,OAAO,EAAE,sBAAsB,EAAE,MAAM,sBAAsB,CAAC;AAE9D,MAAM,IAAI,GAAG,iEAAiE,CAAC;AAC/E,MAAM,WAAW,GAAG,CAAC,wBAAwB,EAAE,kBAAkB,CAAC,CAAC;AACnE,SAAS,MAAM,CAAC,EAAU,EAAE,MAA8B,EAAE,MAAM,GAAG,EAAE;IACrE,OAAO;QACL,EAAE;QACF,MAAM;QACN,IAAI,EAAE,IAAI,GAAG,MAAM;QACnB,OAAO,EAAE,CAAC,MAAM,EAAE,OAAO,EAAE,UAAU,CAAC;QACtC,IAAI,EAAE,MAAM,KAAK,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,eAAe;QACjD,WAAW,EAAE,CAAC,EAAE,cAAc,EAAE,EAAE,EAAE,OAAO,EAAE,oBAAoB,EAAE,CAAC;KACE,CAAC;AAC3E,CAAC;AACD,MAAM,CAAC,MAAM,0BAA0B,GAAG;IACxC,GAAG,EAAE,MAAM,CAAC,0BAA0B,EAAE,KAAK,CAAC;IAC9C,SAAS,EAAE,MAAM,CAAC,gCAAgC,EAAE,KAAK,CAAC;IAC1D,SAAS,EAAE,MAAM,CAAC,yBAAyB,EAAE,MAAM,EAAE,YAAY,CAAC;IAClE,aAAa,EAAE,MAAM,CAAC,gCAAgC,EAAE,KAAK,EAAE,iBAAiB,CAAC;CAClF,CAAC;AAEF,MAAM,YAAY,GAAG,CAAC,CAAC,MAAM,CAAC;IAC5B,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACrB,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACzB,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC7B,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC3B,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,WAAW,EAAE,QAAQ,EAAE,QAAQ,EAAE,UAAU,EAAE,SAAS,CAAC,CAAC;IACvE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE;IACpB,iBAAiB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,eAAe,CAAC;IACpD,YAAY,EAAE,CAAC,CAAC,OAAO,EAAE;IACzB,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAChC,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE,CAAC;IAC5D,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,EAAE,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC;CAClI,CAAC,CAAC;AACH,MAAM,mBAAmB,GAAG,CAAC,CAAC,MAAM,CAAC;IACnC,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE;IACtB,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;IAC5C,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,gBAAgB,CAAC;IAC9C,SAAS,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC;CACtD,CAAC,CAAC;AACH,MAAM,IAAI,GAAG,CAAC,KAAc,EAAU,EAAE;IACtC,MAAM,SAAS,GAAG,CAAC,IAAa,EAAW,EAAE,CAC3C,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC;QACjB,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC;QACrB,CAAC,CAAC,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ;YAChC,CAAC,CAAC,MAAM,CAAC,WAAW,CAChB,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC;iBACjB,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC;iBACtC,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,EAAE,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,CAClD;YACH,CAAC,CAAC,IAAI,CAAC;IACb,OAAO,UAAU,CAAC,QAAQ,CAAC;SACxB,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC;SACxC,MAAM,CAAC,KAAK,CAAC,CAAC;AACnB,CAAC,CAAC;AACF,SAAS,IAAI,CAAC,IAAY,EAAE,OAAe,EAAE,QAAQ,GAAa,UAAU,CAAC,UAAU;IACrF,MAAM,IAAI,QAAQ,CAAC,OAAO,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAC;AAClD,CAAC;AACD,MAAM,UAAU,qBAAqB,CAAC,KAAc;IAClD,IAAI,CAAC;QACH,OAAO,0BAA0B,CAAC,KAAK,CAAC,CAAC;IAC3C,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,QAAQ,CAAC,iDAAiD,EAAE;YACpE,KAAK;YACL,IAAI,EAAE,+BAA+B;YACrC,QAAQ,EAAE,UAAU,CAAC,UAAU;SAChC,CAAC,CAAC;IACL,CAAC;AACH,CAAC;AAED,MAAM,OAAO,oBAAoB;IAIpB,OAAO;IACP,QAAQ;IAJV,eAAe,CAAS;IACxB,cAAc,CAAS;IAChC,YACW,OAAwB,EACxB,QAAgB,EACzB,YAAqB;uBAFZ,OAAO;wBACP,QAAQ;QAGjB,IAAI,CAAC,eAAe,GAAG,mBAAmB,CAAC,OAAO,EAAE,qBAAqB,CAAC,CAAC;QAC3E,IAAI,IAAI,CAAC,eAAe,KAAK,GAAG;YAC9B,IAAI,CAAC,yCAAyC,EAAE,kFAAkF,CAAC,CAAC;QACtI,cAAc,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;QAClC,IAAI,CAAC,cAAc,GAAG,cAAc,CAAC,YAAY,IAAI,IAAI,CAAC,eAAe,EAAE,eAAe,CAAC,CAAC;QAC5F,IAAI,IAAI,CAAC,cAAc,KAAK,GAAG,IAAI,IAAI,CAAC,cAAc,KAAK,IAAI,CAAC,eAAe;YAC7E,IAAI,CAAC,uCAAuC,EAAE,4DAA4D,CAAC,CAAC;IAChH,CAAC;IACD,QAAQ,CAAC,GAAc,EAAE,IAAc;QACrC,MAAM,UAAU,GAAG,0BAA0B,CAAC,GAAG,CAAC,CAAC;QACnD,MAAM,OAAO,GAAG,mBAAmB,CAAC,UAAU,EAAE,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;QACpE,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,aAAa,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;QAClE,IACE,CAAC,SAAS;YACV,SAAS,CAAC,MAAM,KAAK,UAAU,CAAC,MAAM;YACtC,SAAS,CAAC,YAAY,KAAK,UAAU,CAAC,IAAI;YAC1C,SAAS,CAAC,SAAS,KAAK,IAAI;YAC5B,SAAS,CAAC,SAAS,KAAK,QAAQ;YAChC,SAAS,CAAC,YAAY,EAAE,IAAI,CAAC,GAAG,CAAC,KAAK,QAAQ;YAC9C,SAAS,CAAC,IAAI,KAAK,UAAU,CAAC,IAAI;YAClC,SAAS,CAAC,sBAAsB,KAAK,IAAI;YACzC,CAAC,GAAG,CAAC,SAAS,CAAC,mBAAmB,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,WAAW,CAAC,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC;YAEjG,IAAI,CACF,sCAAsC,EACtC,+FAA+F,EAC/F,UAAU,CAAC,aAAa,CACzB,CAAC;QACJ,IAAI,UAAU,CAAC,MAAM,KAAK,KAAK,IAAI,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,WAAW,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC;YACtF,IAAI,CACF,uCAAuC,EACvC,2EAA2E,EAC3E,UAAU,CAAC,aAAa,CACzB,CAAC;QACJ,IAAI,GAAG,KAAK,WAAW,EAAE,CAAC;YACxB,MAAM,OAAO,GAAG,SAAS,CAAC,WAAqF,CAAC;YAChH,MAAM,MAAM,GAAG,OAAO,EAAE,OAAO,EAAE,CAAC,kBAAkB,CAAC,EAAE,MAAM,CAAC;YAC9D,IAAI,CAAC,MAAM;gBAAE,IAAI,CAAC,gCAAgC,EAAE,8CAA8C,EAAE,UAAU,CAAC,aAAa,CAAC,CAAC;YAC9H,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC,OAAO,CACjD,sBAAsB,CAAC,EAAE,GAAG,MAAM,EAAE,UAAU,EAAE,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,UAAU,EAAE,CAAc,CAClG,CAAC;YACF,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC;gBAAE,IAAI,CAAC,+BAA+B,EAAE,oDAAoD,CAAC,CAAC;QACnH,CAAC;QACD,OAAO,OAAO,CAAC;IACjB,CAAC;IACO,KAAK,CAAC,IAAI,CAAC,GAAc,EAAE,KAAK,GAAoC,EAAE,EAAE,IAAc;QAC5F,IAAI,CAAC,QAAQ,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;QACzB,MAAM,MAAM,GAAG,MAAM,eAAe,CAAU,IAAI,CAAC,OAAO,EAAE,0BAA0B,CAAC,GAAG,CAAC,EAAE;YAC3F,cAAc,EAAE,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE;YAC3C,KAAK,EAAE,EAAE,GAAG,KAAK,EAAE,MAAM,EAAE,IAAI,CAAC,cAAc,EAAE;YAChD,eAAe,EAAE,QAAQ;YACzB,SAAS,EAAE,KAAK;YAChB,GAAG,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC;SACxC,CAAC,CAAC;QACH,OAAO,gBAAgB,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;IAChD,CAAC;IACO,WAAW,CAAC,KAAc;QAChC,MAAM,MAAM,GAAG,YAAY,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;QAC7C,IAAI,CAAC,MAAM,CAAC,OAAO;YACjB,IAAI,CAAC,kCAAkC,EAAE,+CAA+C,EAAE,UAAU,CAAC,aAAa,CAAC,CAAC;QACtH,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC;QAC3B,IAAI,MAAM,CAAC,MAAM,KAAK,IAAI,CAAC,cAAc,IAAI,MAAM,CAAC,QAAQ,KAAK,IAAI,CAAC,QAAQ;YAC5E,IAAI,CACF,yCAAyC,EACzC,+DAA+D,EAC/D,UAAU,CAAC,aAAa,CACzB,CAAC;QACJ,OAAO,EAAE,GAAG,MAAM,EAAE,OAAO,EAAE,qBAAqB,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC;IACvE,CAAC;IACD,KAAK,CAAC,GAAG;QACP,OAAO,IAAI,CAAC,WAAW,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;IAClD,CAAC;IACD,KAAK,CAAC,aAAa,CAAC,UAAkB,EAAE,UAAkB,EAAE,eAAuB;QACjF,cAAc,CAAC,UAAU,EAAE,UAAU,CAAC,CAAC;QACvC,cAAc,CAAC,UAAU,EAAE,UAAU,CAAC,CAAC;QACvC,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,eAAe,CAAC,IAAI,eAAe,GAAG,CAAC;YAC/D,IAAI,CAAC,iCAAiC,EAAE,8CAA8C,CAAC,CAAC;QAC1F,MAAM,MAAM,GAAG,mBAAmB,CAAC,SAAS,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,eAAe,EAAE,EAAE,UAAU,EAAE,UAAU,EAAE,eAAe,EAAE,CAAC,CAAC,CAAC;QAC5H,IAAI,CAAC,MAAM,CAAC,OAAO,IAAI,MAAM,CAAC,IAAI,CAAC,UAAU,KAAK,UAAU,IAAI,MAAM,CAAC,IAAI,CAAC,eAAe,KAAK,eAAe;YAC7G,IAAI,CACF,wCAAwC,EACxC,qEAAqE,EACrE,UAAU,CAAC,aAAa,CACzB,CAAC;QACJ,OAAO,MAAM,CAAC,IAAI,CAAC;IACrB,CAAC;IACD,KAAK,CAAC,MAAM,CAAC,KAOZ;QACC,IAAI,CAAC,KAAK,CAAC,MAAM,IAAI,CAAC,KAAK,CAAC,GAAG;YAC7B,IAAI,CAAC,uBAAuB,EAAE,gEAAgE,EAAE,UAAU,CAAC,YAAY,CAAC,CAAC;QAC3H,MAAM,OAAO,GAAG,KAAK,CAAC,MAAM,KAAK,WAAW,CAAC,CAAC,CAAC,qBAAqB,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QAChG,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;QACxE,IAAI,MAAM,GAA4D,IAAI,CAAC;QAC3E,IAAI,CAAC;YACH,MAAM,GAAG,MAAM,IAAI,CAAC,GAAG,EAAE,CAAC;QAC5B,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,CAAC,KAAK,CAAC,MAAM,KAAK,WAAW,IAAI,KAAK,YAAY,QAAQ,IAAI,KAAK,CAAC,IAAI,KAAK,UAAU,CAAC;gBAAE,MAAM,KAAK,CAAC;QAC7G,CAAC;QACD,MAAM,UAAU,GAAG,KAAK,CAAC,MAAM,KAAK,WAAW,CAAC,CAAC,CAAC,cAAc,CAAC,KAAK,CAAC,UAAU,IAAI,EAAE,EAAE,UAAU,CAAC,CAAC,CAAC,CAAC,MAAO,CAAC,UAAU,CAAC;QAC1H,MAAM,OAAO,GAAG,OAAO,IAAI,MAAO,CAAC,OAAO,CAAC;QAC3C,IAAI,MAAM,IAAI,MAAM,CAAC,UAAU,KAAK,UAAU;YAC5C,IAAI,CAAC,gCAAgC,EAAE,mDAAmD,CAAC,CAAC;QAC9F,IAAI,OAAO,CAAC,OAAO,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC;YACvC,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,UAAU,EAAE,OAAO,CAAC,QAAQ,CAAC,EAAE,EAAE,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;YACrG,IAAI,QAAQ,CAAC,UAAU,KAAK,OAAO,CAAC,QAAQ,CAAC,eAAe;gBAC1D,IAAI,CAAC,sCAAsC,EAAE,kEAAkE,CAAC,CAAC;QACrH,CAAC;QACD,MAAM,MAAM,GAAG;YACb,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,eAAe,EAAE,IAAI,CAAC,eAAe;YACrC,cAAc,EAAE,IAAI,CAAC,cAAc;YACnC,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,UAAU;YACV,OAAO;YACP,MAAM;SACP,CAAC;QACF,IAAI,KAAK,CAAC,MAAM;YAAE,OAAO,EAAE,GAAG,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,gBAAgB,EAAE,KAAK,EAAE,CAAC;QAC9E,MAAM,YAAY,GAAG,OAAO,CAAC,KAAK,CAAC,QAAQ,IAAI,sCAAsC,IAAI,CAAC,GAAG,EAAE,IAAI,UAAU,EAAE,OAAO,CAAC,CAAC;QACxH,MAAM,KAAK,CAAC,OAAO,CAAC,YAAY,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACxD,MAAM,SAAS,CAAC,YAAY,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,GAAG,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,IAAI,IAAI,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,EAAE;YAC7G,IAAI,EAAE,IAAI;YACV,IAAI,EAAE,KAAK;SACZ,CAAC,CAAC;QACH,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,IAAI,CAAC,WAAW,CAC9B,MAAM,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,MAAM,KAAK,WAAW,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAC9H,CAAC;YACF,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,GAAG,EAAE,CAAC;YAC/B,IACE,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,IAAI,CAAC,OAAO,CAAC;gBACrC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC;gBAC7C,KAAK,CAAC,UAAU,KAAK,UAAU;gBAC/B,KAAK,CAAC,KAAK,KAAK,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC;gBAEtF,IAAI,CACF,mCAAmC,EACnC,4EAA4E,EAC5E,UAAU,CAAC,OAAO,CACnB,CAAC;YACJ,OAAO;gBACL,GAAG,MAAM;gBACT,YAAY;gBACZ,KAAK;gBACL,MAAM,EAAE,KAAK;gBACb,gBAAgB,EAAE,IAAI;gBACtB,QAAQ,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE;aACzD,CAAC;QACJ,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,IAAI,QAAQ,CAChB,gJAAgJ,EAChJ;gBACE,KAAK;gBACL,IAAI,EAAE,qCAAqC;gBAC3C,QAAQ,EAAE,UAAU,CAAC,OAAO;gBAC5B,WAAW,EAAE,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,cAAc,EAAE,IAAI,CAAC,cAAc,EAAE,YAAY,EAAE,YAAY,EAAE,iBAAiB,EAAE;aAC7H,CACF,CAAC;QACJ,CAAC;IACH,CAAC;CACF"}

package/dist/identity-governance/client.d.ts

@@ -0,0 +1,217 @@
+import { z } from 'zod';
+import { type PaginationInput } from '../pagination/index.js';
+import type { HttpRequest } from '../transport/types.js';
+import { type IdentityOperation } from './definitions.js';
+import type { IdentityRuntime } from './runtime.js';
+export declare class IdentityClient {
+    readonly runtime: IdentityRuntime;
+    constructor(runtime: IdentityRuntime);
+    binding(key: IdentityOperation): {
+        adapter: string;
+        method: string;
+        operationId?: string;
+        pathTemplate: string;
+        schemaSource: 'builtin' | 'openapi';
+        operation: {
+            authSurfaces?: ("kernel" | "studio")[] | undefined;
+            deprecated?: boolean | undefined;
+            idempotency?: "idempotency-key" | "idempotent" | "non-idempotent" | "safe" | undefined;
+            longRunning?: boolean | undefined;
+            method: string;
+            operationId?: string | undefined;
+            parameters?: unknown;
+            pathTemplate: string;
+            published?: boolean | undefined;
+            requestBodyMode?: "none" | undefined;
+            requiredPermissions?: string[] | undefined;
+            resourcePolicyEnforced?: boolean | undefined;
+            requestBody?: unknown;
+            responses?: unknown;
+            risk?: "bounded-write" | "credential" | "destructive" | "privileged" | "read" | undefined;
+            stability?: "deprecated" | "experimental" | "legacy" | "stable" | undefined;
+            summary?: string | undefined;
+            tags: string[];
+        };
+    };
+    validateRequest(key: IdentityOperation, id?: string, body?: unknown): {
+        adapter: string;
+        method: string;
+        operationId?: string;
+        pathTemplate: string;
+        schemaSource: 'builtin' | 'openapi';
+        operation: {
+            authSurfaces?: ("kernel" | "studio")[] | undefined;
+            deprecated?: boolean | undefined;
+            idempotency?: "idempotency-key" | "idempotent" | "non-idempotent" | "safe" | undefined;
+            longRunning?: boolean | undefined;
+            method: string;
+            operationId?: string | undefined;
+            parameters?: unknown;
+            pathTemplate: string;
+            published?: boolean | undefined;
+            requestBodyMode?: "none" | undefined;
+            requiredPermissions?: string[] | undefined;
+            resourcePolicyEnforced?: boolean | undefined;
+            requestBody?: unknown;
+            responses?: unknown;
+            risk?: "bounded-write" | "credential" | "destructive" | "privileged" | "read" | undefined;
+            stability?: "deprecated" | "experimental" | "legacy" | "stable" | undefined;
+            summary?: string | undefined;
+            tags: string[];
+        };
+    };
+    call<T>(key: IdentityOperation, schema: z.ZodType<T>, input?: {
+        id?: string;
+        body?: unknown;
+        query?: HttpRequest['query'];
+    }): Promise<{
+        data: T;
+        requestId: string | undefined;
+    }>;
+    list<T extends {
+        id: string;
+    }>(key: IdentityOperation, item: z.ZodType<T>, input: PaginationInput, id?: string, filters?: Record<string, string>): Promise<{
+        items: T[];
+        pageInfo: import("../pagination/index.js").PageInfo;
+    }>;
+    users(input: PaginationInput, filters?: Record<string, string>): Promise<{
+        items: {
+            id: string;
+            name?: string | null | undefined;
+            email?: string | null | undefined;
+            nickname?: string | null | undefined;
+            departmentName?: string | null | undefined;
+            verified?: boolean | null | undefined;
+            isBlocked?: boolean | undefined;
+            blockStateVersion?: string | undefined;
+            blockReasons?: {
+                code: string;
+            }[] | undefined;
+            groups: {
+                id: string;
+                code: string;
+                name: string;
+            }[];
+            createdTimestamp?: string | number | undefined;
+            updatedTimestamp?: string | number | undefined;
+        }[];
+        pageInfo: import("../pagination/index.js").PageInfo;
+    }>;
+    groups(input: PaginationInput): Promise<{
+        items: {
+            id: string;
+            code: string;
+            name: string;
+            description?: string | null | undefined;
+            isSystem: boolean;
+            membershipEditable: boolean;
+            permissions: {
+                id: string;
+                code: string;
+                name: string;
+                resource: string;
+                action: string;
+                description?: string | null | undefined;
+                createdTimestamp?: string | number | undefined;
+                updatedTimestamp?: string | number | undefined;
+            }[];
+            createdTimestamp?: string | number | undefined;
+            updatedTimestamp?: string | number | undefined;
+        }[];
+        pageInfo: import("../pagination/index.js").PageInfo;
+    }>;
+    permissions(input: PaginationInput): Promise<{
+        items: {
+            id: string;
+            code: string;
+            name: string;
+            resource: string;
+            action: string;
+            description?: string | null | undefined;
+            createdTimestamp?: string | number | undefined;
+            updatedTimestamp?: string | number | undefined;
+        }[];
+        pageInfo: import("../pagination/index.js").PageInfo;
+    }>;
+    members(id: string, input: PaginationInput, keyword?: string): Promise<{
+        items: {
+            id: string;
+            name: string;
+            email: string;
+            source: "direct";
+        }[];
+        pageInfo: import("../pagination/index.js").PageInfo;
+    }>;
+    user(id: string): Promise<{
+        id: string;
+        name?: string | null | undefined;
+        email?: string | null | undefined;
+        nickname?: string | null | undefined;
+        departmentName?: string | null | undefined;
+        verified?: boolean | null | undefined;
+        isBlocked?: boolean | undefined;
+        blockStateVersion?: string | undefined;
+        blockReasons?: {
+            code: string;
+        }[] | undefined;
+        groups: {
+            id: string;
+            code: string;
+            name: string;
+        }[];
+        createdTimestamp?: string | number | undefined;
+        updatedTimestamp?: string | number | undefined;
+    }>;
+    group(id: string): Promise<{
+        id: string;
+        code: string;
+        name: string;
+        description?: string | null | undefined;
+        isSystem: boolean;
+        membershipEditable: boolean;
+        permissions: {
+            id: string;
+            code: string;
+            name: string;
+            resource: string;
+            action: string;
+            description?: string | null | undefined;
+            createdTimestamp?: string | number | undefined;
+            updatedTimestamp?: string | number | undefined;
+        }[];
+        createdTimestamp?: string | number | undefined;
+        updatedTimestamp?: string | number | undefined;
+    }>;
+    userGroups(id: string): Promise<{
+        userId: string;
+        direct: {
+            id: string;
+            code: string;
+            name: string;
+            protected: boolean;
+        }[];
+        mapped: {
+            id: string;
+            code: string;
+            name: string;
+            protected: boolean;
+        }[];
+    }>;
+    change(body: unknown): Promise<{
+        data: {
+            changed: number;
+            scope: {
+                kind: "group" | "user";
+                id: string;
+            };
+        };
+        requestId: string | undefined;
+    }>;
+}
+export declare function requireComplete<T>(page: {
+    items: T[];
+    pageInfo: {
+        hasMore: boolean;
+    };
+}): T[];
+//# sourceMappingURL=client.d.ts.map

package/dist/identity-governance/client.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"client.d.ts","sourceRoot":"","sources":["../../src/identity-governance/client.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAGxB,OAAO,EAA2C,KAAK,eAAe,EAAE,MAAM,wBAAwB,CAAC;AAEvG,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAC;AACzD,OAAO,EAAuB,KAAK,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AAa/E,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAEpD,qBAAa,cAAc;IACb,QAAQ,CAAC,OAAO,EAAE,eAAe;IAA7C,YAAqB,OAAO,EAAE,eAAe,EAAI;IAEjD,OAAO,CAAC,GAAG,EAAE,iBAAiB;;;;;;;;;;;;;;;;;;;;;;;;;;MA8B7B;IAED,eAAe,CAAC,GAAG,EAAE,iBAAiB,EAAE,EAAE,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,OAAO;;;;;;;;;;;;;;;;;;;;;;;;;;MAiClE;IAEK,IAAI,CAAC,CAAC,EAAE,GAAG,EAAE,iBAAiB,EAAE,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,KAAK,GAAE;QAAE,EAAE,CAAC,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,OAAO,CAAC;QAAC,KAAK,CAAC,EAAE,WAAW,CAAC,OAAO,CAAC,CAAA;KAAO;;;OAmCpI;IAEK,IAAI,CAAC,CAAC,SAAS;QAAE,EAAE,EAAE,MAAM,CAAA;KAAE,EACjC,GAAG,EAAE,iBAAiB,EACtB,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EAClB,KAAK,EAAE,eAAe,EACtB,EAAE,CAAC,EAAE,MAAM,EACX,OAAO,GAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAM;;;OAsCrC;IAED,KAAK,CAAC,KAAK,EAAE,eAAe,EAAE,OAAO,GAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAM;;;;;;;;;;;;;;;;;;;;;;OAEjE;IACD,MAAM,CAAC,KAAK,EAAE,eAAe;;;;;;;;;;;;;;;;;;;;;;OAE5B;IACD,WAAW,CAAC,KAAK,EAAE,eAAe;;;;;;;;;;;;OAEjC;IACD,OAAO,CAAC,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,eAAe,EAAE,OAAO,CAAC,EAAE,MAAM;;;;;;;;OAE3D;IACK,IAAI,CAAC,EAAE,EAAE,MAAM;;;;;;;;;;;;;;;;;;;OAIpB;IACK,KAAK,CAAC,EAAE,EAAE,MAAM;;;;;;;;;;;;;;;;;;;OAIrB;IACK,UAAU,CAAC,EAAE,EAAE,MAAM;;;;;;;;;;;;;;OAK1B;IACD,MAAM,CAAC,IAAI,EAAE,OAAO;;;;;;;;;OAEnB;CACF;AAED,wBAAgB,eAAe,CAAC,CAAC,EAAE,IAAI,EAAE;IAAE,KAAK,EAAE,CAAC,EAAE,CAAC;IAAC,QAAQ,EAAE;QAAE,OAAO,EAAE,OAAO,CAAA;KAAE,CAAA;CAAE,GAAG,CAAC,EAAE,CAQ5F"}

package/dist/identity-governance/client.js

@@ -0,0 +1,185 @@
+import { Ajv } from 'ajv';
+import { resolveApiOperation } from '../api-operation/resolver.js';
+import { CliError, EXIT_CODES } from '../errors/cli-error.js';
+import { collectPaginated, paginationFingerprint } from '../pagination/index.js';
+import { bindSemanticPath, unwrapServerData } from '../semantic/runtime.js';
+import { IDENTITY_OPERATIONS } from './definitions.js';
+import { fail, groupSchema, idSchema, memberSchema, membershipResultSchema, pageSchema, parse, permissionSchema, userGroupsSchema, userSchema, } from './contracts.js';
+export class IdentityClient {
+    runtime;
+    constructor(runtime) {
+        this.runtime = runtime;
+    }
+    binding(key) {
+        const definition = IDENTITY_OPERATIONS[key];
+        if (!this.runtime.context.expectedSurfaces.includes('kernel') || this.runtime.context.team || !this.runtime.principalId)
+            fail('IDENTITY_KERNEL_CONTEXT_REQUIRED', 'An authenticated Kernel/global context is required.', EXIT_CODES.authorization);
+        const matches = this.runtime.index.operations.filter((op) => op.operationId === definition.id);
+        const operation = matches[0];
+        if (matches.length !== 1 ||
+            !operation ||
+            operation.method !== definition.method ||
+            operation.published !== true ||
+            operation.stability !== 'stable' ||
+            operation.authSurfaces?.join(',') !== 'kernel' ||
+            operation.risk !== definition.risk ||
+            [...(operation.requiredPermissions ?? [])].sort().join(',') !== [...definition.permissions].sort().join(',')) {
+            fail('IDENTITY_OPERATION_UNAVAILABLE', 'The deployment must publish the exact compatible Kernel identity-management operation. Refresh the contract after deployment.', EXIT_CODES.compatibility, { operationId: definition.id, requestState: 'not_sent' });
+        }
+        if (definition.method !== 'GET' && (!this.runtime.schemaFresh || !this.runtime.document || !this.runtime.digest))
+            fail('IDENTITY_FRESH_CONTRACT_REQUIRED', 'Identity writes require a fresh published API contract. Retry preflight with --refresh.', EXIT_CODES.compatibility);
+        return { ...resolveApiOperation(definition, this.runtime.index), operation };
+    }
+    validateRequest(key, id, body) {
+        const binding = this.binding(key);
+        if (id !== undefined)
+            parse(idSchema, id);
+        if (binding.method !== 'GET') {
+            if (binding.operation.requestBodyMode === 'none') {
+                if (body !== undefined)
+                    fail('IDENTITY_INPUT_INVALID', 'This operation does not accept a request body.');
+            }
+            else {
+                const request = binding.operation.requestBody;
+                const schema = request?.content?.['application/json']?.schema;
+                if (!schema || request?.required !== true)
+                    fail('IDENTITY_SCHEMA_MISSING', 'The published operation is missing its required JSON request schema.', EXIT_CODES.compatibility);
+                let validate;
+                try {
+                    validate = new Ajv({ strict: false, allErrors: true }).compile({
+                        ...schema,
+                        components: this.runtime.document?.components,
+                    });
+                }
+                catch (cause) {
+                    throw new CliError('The published request schema cannot be validated. Refresh after the deployment contract is corrected.', {
+                        cause,
+                        code: 'IDENTITY_SCHEMA_INCOMPATIBLE',
+                        exitCode: EXIT_CODES.compatibility,
+                        safeDetails: { operationId: binding.operationId, requestState: 'not_sent' },
+                    });
+                }
+                if (!validate(body))
+                    fail('IDENTITY_INPUT_INVALID', 'Input does not match the deployment request schema.', EXIT_CODES.validation, {
+                        issues: validate.errors?.map((error) => ({ keyword: error.keyword, path: error.instancePath })),
+                    });
+            }
+        }
+        return binding;
+    }
+    async call(key, schema, input = {}) {
+        const binding = this.validateRequest(key, input.id, input.body);
+        const path = bindSemanticPath(binding.pathTemplate, input.id === undefined ? {} : { id: input.id });
+        const write = binding.method !== 'GET';
+        let response;
+        try {
+            response = await this.runtime.client.request({
+                method: IDENTITY_OPERATIONS[key].method,
+                path,
+                ...(input.body === undefined ? {} : { body: input.body }),
+                ...(input.query ? { query: input.query } : {}),
+            });
+        }
+        catch (cause) {
+            if (!write || (cause instanceof CliError && /^HTTP_4\d\d$/.test(cause.code)))
+                throw cause;
+            throw new CliError('The write outcome is unknown. Do not replay it; inspect the exact target first.', {
+                cause,
+                code: 'IDENTITY_MUTATION_OUTCOME_UNKNOWN',
+                exitCode: EXIT_CODES.partial,
+                safeDetails: { operationId: binding.operationId, targetId: input.id, requestState: 'result_unknown' },
+            });
+        }
+        try {
+            const expectedStatus = key === 'create' ? 201 : key === 'delete' ? 204 : 200;
+            if (response.status !== expectedStatus)
+                fail('IDENTITY_RESPONSE_INCOMPATIBLE', 'Unexpected success status.', EXIT_CODES.compatibility);
+            return { data: parse(schema, unwrapServerData(response.data), true), requestId: response.requestId };
+        }
+        catch (cause) {
+            if (!write)
+                throw cause;
+            throw new CliError('The write was sent but its response cannot be verified. Do not replay it.', {
+                cause,
+                code: 'IDENTITY_MUTATION_OUTCOME_UNKNOWN',
+                exitCode: EXIT_CODES.partial,
+                safeDetails: { operationId: binding.operationId, targetId: input.id, requestId: response.requestId, requestState: 'sent' },
+            });
+        }
+    }
+    async list(key, item, input, id, filters = {}) {
+        const seen = new Set();
+        const tokens = new Set();
+        let total;
+        const result = await collectPaginated(input, paginationFingerprint({
+            operation: key,
+            context: this.runtime.context.fingerprint,
+            principal: this.runtime.principalId,
+            id,
+            filters,
+        }), async (cursor) => {
+            if (cursor) {
+                if (tokens.has(cursor))
+                    fail('IDENTITY_PAGINATION_INVALID', 'Repeated continuation token.', EXIT_CODES.compatibility);
+                tokens.add(cursor);
+            }
+            const { data } = await this.call(key, pageSchema(item), {
+                ...(id === undefined ? {} : { id }),
+                query: { ...filters, pageSize: input.pageSize, ...(cursor ? { pageToken: cursor } : {}) },
+            });
+            if (data.pageInfo.pageSize !== input.pageSize || (total !== undefined && data.pageInfo.total !== total))
+                fail('IDENTITY_PAGINATION_INVALID', 'Pagination count or total changed while reading.', EXIT_CODES.compatibility);
+            total ??= data.pageInfo.total;
+            for (const entry of data.items) {
+                if (seen.has(entry.id))
+                    fail('IDENTITY_PAGINATION_INVALID', 'Duplicate identity in paginated results.', EXIT_CODES.compatibility);
+                seen.add(entry.id);
+            }
+            if (data.pageInfo.nextPageToken && tokens.has(data.pageInfo.nextPageToken))
+                fail('IDENTITY_PAGINATION_INVALID', 'Repeated continuation token.', EXIT_CODES.compatibility);
+            return { items: data.items, nextCursor: data.pageInfo.nextPageToken, total: data.pageInfo.total };
+        });
+        if (input.pageAll && !input.pageToken && !result.pageInfo.hasMore && total !== undefined && result.items.length !== total)
+            fail('IDENTITY_PAGINATION_INVALID', 'The complete enumeration does not match its total.', EXIT_CODES.compatibility);
+        return result;
+    }
+    users(input, filters = {}) {
+        return this.list('users', userSchema, input, undefined, filters);
+    }
+    groups(input) {
+        return this.list('groups', groupSchema, input);
+    }
+    permissions(input) {
+        return this.list('permissions', permissionSchema, input);
+    }
+    members(id, input, keyword) {
+        return this.list('members', memberSchema, input, id, keyword ? { keyword } : {});
+    }
+    async user(id) {
+        const { data } = await this.call('user', userSchema, { id });
+        if (data.id !== id)
+            fail('IDENTITY_TARGET_MISMATCH', 'User response does not match the requested ID.', EXIT_CODES.compatibility);
+        return data;
+    }
+    async group(id) {
+        const { data } = await this.call('group', groupSchema, { id });
+        if (data.id !== id)
+            fail('IDENTITY_TARGET_MISMATCH', 'Group response does not match the requested ID.', EXIT_CODES.compatibility);
+        return data;
+    }
+    async userGroups(id) {
+        const { data } = await this.call('userGroups', userGroupsSchema, { id });
+        if (data.userId !== id)
+            fail('IDENTITY_TARGET_MISMATCH', 'Membership response does not match the requested user.', EXIT_CODES.compatibility);
+        return data;
+    }
+    change(body) {
+        return this.call('change', membershipResultSchema, { body });
+    }
+}
+export function requireComplete(page) {
+    if (page.pageInfo.hasMore)
+        fail('IDENTITY_ENUMERATION_INCOMPLETE', 'The page limit was reached before enumeration completed. Increase the bounded page limit and repeat preflight.', EXIT_CODES.validation);
+    return page.items;
+}
+//# sourceMappingURL=client.js.map