@managemint-solutions/sdk 0.53.0 → 0.55.0

package/dist/staff/index.js

@@ -0,0 +1,139 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __exportStar = (this && this.__exportStar) || function(m, exports) {
+    for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.StaffPermissionsResource = exports.StaffResource = void 0;
+const audit_1 = require("../audit");
+const errors_1 = require("../errors");
+const permissions_1 = require("../permissions");
+__exportStar(require("./dto"), exports);
+const STAFF_SELECT = 'mms_id, email, name, active, created_at, created_by, deactivated_at, deactivated_by';
+/**
+ * The `staff` table. Staff read it on their own client; every write is the service role's (staff
+ * hold SELECT only), so `preRegister`, `removePending` and `setActive` belong to the service
+ * client. Unaudited: an `audit_logs` row belongs to an organization, and staff have none.
+ */
+class StaffResource {
+    supabase;
+    constructor(supabase) {
+        this.supabase = supabase;
+    }
+    /** Every staff member, by name. A pending pre-registration is not one yet. */
+    async list() {
+        const { data, error } = await this.supabase
+            .from('staff')
+            .select(STAFF_SELECT)
+            .not('mms_id', 'is', null)
+            .order('name');
+        if (error)
+            throw (0, errors_1.mapPostgrestError)(error);
+        return (data ?? []);
+    }
+    async getById(staffId) {
+        const { data, error } = await this.supabase
+            .from('staff')
+            .select(STAFF_SELECT)
+            .eq('mms_id', staffId)
+            .single();
+        if (error)
+            throw (0, errors_1.mapPostgrestError)(error);
+        return data;
+    }
+    /**
+     * The address, written before its auth user exists - the first half of creating a staff
+     * member. `mms_id` stays null until GoTrue creates the auth user with the `staff` role and
+     * `handle_auth_user_role_set` links the two.
+     */
+    async preRegister(input) {
+        const { error } = await this.supabase.from('staff').insert(input);
+        if (error)
+            throw (0, errors_1.mapPostgrestError)(error);
+    }
+    /** Undoes a pre-registration whose auth user was never created. A linked row is never touched. */
+    async removePending(email) {
+        const { error } = await this.supabase
+            .from('staff')
+            .delete()
+            .eq('email', email)
+            .is('mms_id', null);
+        if (error)
+            throw (0, errors_1.mapPostgrestError)(error);
+    }
+    /** Deactivates, stamping who and when, or reactivates, clearing them. */
+    async setActive(staffId, active, by) {
+        const { data, error } = await this.supabase
+            .from('staff')
+            .update({
+            active,
+            deactivated_at: active ? null : new Date().toISOString(),
+            deactivated_by: active ? null : by,
+        })
+            .eq('mms_id', staffId)
+            .select(STAFF_SELECT)
+            .single();
+        if (error)
+            throw (0, errors_1.mapPostgrestError)(error);
+        return data;
+    }
+}
+exports.StaffResource = StaffResource;
+/**
+ * The `staff_permissions` table: one row per staff member, made by the role trigger alongside
+ * the link. Staff read it on their own client; `updateForStaff` is the service client's.
+ */
+class StaffPermissionsResource {
+    supabase;
+    constructor(supabase) {
+        this.supabase = supabase;
+    }
+    /**
+     * The one lookup the admin api's guard makes per gated request: the flag the route asked for,
+     * plus the admin bypass. Null when there is no row, which the guard treats as a denial.
+     */
+    async flagsFor(staffId, flag) {
+        (0, permissions_1.checkPermissionFlag)(flag);
+        const { data, error } = await this.supabase
+            .from('staff_permissions')
+            .select(`is_admin, ${flag}`)
+            .eq('staff_id', staffId)
+            .maybeSingle();
+        if (error)
+            throw (0, errors_1.mapPostgrestError)(error);
+        return (data ?? null);
+    }
+    /** The whole row. `*`: every flag, so a new flag column needs no select edit. */
+    async getForStaff(staffId) {
+        const { data, error } = await this.supabase
+            .from('staff_permissions')
+            .select('*')
+            .eq('staff_id', staffId)
+            .single();
+        if (error)
+            throw (0, errors_1.mapPostgrestError)(error);
+        return (0, audit_1.withoutInternalId)(data);
+    }
+    async updateForStaff(staffId, patch, by) {
+        const { data, error } = await this.supabase
+            .from('staff_permissions')
+            .update({ ...patch, updated_at: new Date().toISOString(), last_updated_by: by })
+            .eq('staff_id', staffId)
+            .select('*')
+            .single();
+        if (error)
+            throw (0, errors_1.mapPostgrestError)(error);
+        return (0, audit_1.withoutInternalId)(data);
+    }
+}
+exports.StaffPermissionsResource = StaffPermissionsResource;

package/dist/staff-client.d.ts

@@ -0,0 +1,37 @@
+import { type StaffContext } from './auth';
+import { AuditResource } from './audit';
+import type { SupabaseClientConfig, TypedSupabaseClient } from './client';
+import { ClientsResource } from './clients';
+import { LeadsResource } from './leads';
+import { OrganizationsResource } from './organizations';
+import { ProjectsResource } from './projects';
+import { StaffPermissionsResource, StaffResource } from './staff';
+import { TasksResource } from './tasks';
+import { UserApiCredentialsReads } from './user-api-credentials';
+import { UsersResource } from './users';
+type SupabaseStaffClientConfig = Omit<SupabaseClientConfig, 'auth' | 'onAuditError'> & {
+    auth: StaffContext;
+};
+/**
+ * A staff member's data client, for the admin api: every query carries the staff token, so the
+ * `staff` role's policies decide what comes back. Reads span every organization and every write
+ * is refused with a 403. A resource not listed here is simply not available to staff.
+ */
+export declare class SupabaseStaffClient {
+    readonly supabase: TypedSupabaseClient;
+    /** The staff member the token belongs to - the caller, for a service that records who acted. */
+    readonly auth: StaffContext;
+    readonly audit: AuditResource;
+    readonly clients: ClientsResource;
+    readonly leads: LeadsResource;
+    readonly projects: ProjectsResource;
+    readonly tasks: TasksResource;
+    readonly users: UsersResource;
+    readonly organizations: OrganizationsResource;
+    readonly staff: StaffResource;
+    readonly staffPermissions: StaffPermissionsResource;
+    readonly userApiCredentials: UserApiCredentialsReads;
+    constructor({ url, key, accessToken, auth, client }: SupabaseStaffClientConfig);
+}
+export declare const createSupabaseStaffClient: (config: SupabaseStaffClientConfig) => SupabaseStaffClient;
+export {};

package/dist/staff-client.js

@@ -0,0 +1,52 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.createSupabaseStaffClient = exports.SupabaseStaffClient = void 0;
+const auth_1 = require("./auth");
+const audit_1 = require("./audit");
+const additional_details_1 = require("./additional-details");
+const clients_1 = require("./clients");
+const leads_1 = require("./leads");
+const organizations_1 = require("./organizations");
+const projects_1 = require("./projects");
+const staff_1 = require("./staff");
+const tasks_1 = require("./tasks");
+const user_api_credentials_1 = require("./user-api-credentials");
+const users_1 = require("./users");
+/**
+ * A staff member's data client, for the admin api: every query carries the staff token, so the
+ * `staff` role's policies decide what comes back. Reads span every organization and every write
+ * is refused with a 403. A resource not listed here is simply not available to staff.
+ */
+class SupabaseStaffClient {
+    supabase; // escape hatch for not-yet-migrated queries
+    /** The staff member the token belongs to - the caller, for a service that records who acted. */
+    auth;
+    audit;
+    clients;
+    leads;
+    projects;
+    tasks;
+    users;
+    organizations;
+    staff;
+    staffPermissions;
+    userApiCredentials;
+    constructor({ url, key, accessToken, auth, client }) {
+        this.supabase = client ?? (0, auth_1.createRawClient)(url, key, accessToken);
+        this.auth = auth;
+        this.audit = new audit_1.AuditResource(this.supabase, auth);
+        this.clients = new clients_1.ClientsResource(this.supabase, auth, this.audit);
+        const additionalDetails = new additional_details_1.AdditionalDetailsResource(this.supabase, auth, this.audit);
+        this.leads = new leads_1.LeadsResource(this.supabase, auth, this.audit, additionalDetails);
+        this.projects = new projects_1.ProjectsResource(this.supabase, auth, this.audit);
+        this.tasks = new tasks_1.TasksResource(this.supabase, auth, this.audit);
+        this.users = new users_1.UsersResource(this.supabase, auth, this.audit);
+        this.organizations = new organizations_1.OrganizationsResource(this.supabase, auth, this.audit);
+        this.staff = new staff_1.StaffResource(this.supabase);
+        this.staffPermissions = new staff_1.StaffPermissionsResource(this.supabase);
+        this.userApiCredentials = new user_api_credentials_1.UserApiCredentialsReads(this.supabase);
+    }
+}
+exports.SupabaseStaffClient = SupabaseStaffClient;
+const createSupabaseStaffClient = (config) => new SupabaseStaffClient(config);
+exports.createSupabaseStaffClient = createSupabaseStaffClient;

package/dist/tasks/dto.d.ts

@@ -1,4 +1,4 @@
-import type { AddTaskLinkDto as AddTaskLinkDtoType, CreateTaskDto as CreateTaskDtoType, GetTasksDto as GetTasksDtoType, TaskIdDto as TaskIdDtoType, TaskLinkIdDto as TaskLinkIdDtoType, UpdateTaskDto as UpdateTaskDtoType } from '@managemint-solutions/entities/tasks/dto';
+import type { AddTaskLinkDto as AddTaskLinkDtoType, CreateTaskDto as CreateTaskDtoType, GetTasksDto as GetTasksDtoType, StaffGetTasksDto as StaffGetTasksDtoType, TaskIdDto as TaskIdDtoType, TaskLinkIdDto as TaskLinkIdDtoType, UpdateTaskDto as UpdateTaskDtoType } from '@managemint-solutions/entities/tasks/dto';
 import { TaskLinkType } from '@managemint-solutions/entities/tasks/enum';
 export declare class TaskIdDto implements TaskIdDtoType {
     readonly taskId: string;
@@ -31,6 +31,10 @@ export declare class GetTasksDto implements Omit<GetTasksDtoType, 'status_id_in'
     readonly priority_in?: number[] | null;
     readonly archive: boolean;
 }
+/** A staff read across organizations, optionally narrowed to one of them. */
+export declare class StaffGetTasksDto extends GetTasksDto implements Omit<StaffGetTasksDtoType, 'status_id_in' | 'status_id_not_in' | 'label_id_in' | 'priority_in'> {
+    readonly organization_id?: string | null;
+}
 export declare class CreateTaskDto implements CreateTaskDtoType {
     readonly name: string;
     readonly description?: string | null;

package/dist/tasks/dto.js

@@ -9,7 +9,7 @@ var __metadata = (this && this.__metadata) || function (k, v) {
     if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.UpdateTaskDto = exports.CreateTaskDto = exports.GetTasksDto = exports.AddTaskLinkDto = exports.TaskLinkIdDto = exports.TaskIdDto = void 0;
+exports.UpdateTaskDto = exports.CreateTaskDto = exports.StaffGetTasksDto = exports.GetTasksDto = exports.AddTaskLinkDto = exports.TaskLinkIdDto = exports.TaskIdDto = void 0;
 const class_validator_1 = require("class-validator");
 const class_transformer_1 = require("class-transformer");
 const enum_1 = require("@managemint-solutions/entities/tasks/enum");
@@ -206,6 +206,17 @@ __decorate([
     (0, class_validator_1.IsBoolean)({ message: 'Include archived must be a boolean' }),
     __metadata("design:type", Boolean)
 ], GetTasksDto.prototype, "archive", void 0);
+/** A staff read across organizations, optionally narrowed to one of them. */
+class StaffGetTasksDto extends GetTasksDto {
+    organization_id;
+}
+exports.StaffGetTasksDto = StaffGetTasksDto;
+__decorate([
+    (0, class_validator_1.IsOptional)(),
+    (0, validators_1.IsNullable)(),
+    (0, class_validator_1.IsUUID)('7', { message: 'Invalid organization ID format' }),
+    __metadata("design:type", Object)
+], StaffGetTasksDto.prototype, "organization_id", void 0);
 class CreateTaskDto {
     name;
     description;

package/dist/tasks/index.d.ts

@@ -1,6 +1,6 @@
 import type { MmsList } from '@managemint-solutions/entities/common';
 import type { TaskEntity, TaskSummary } from '@managemint-solutions/entities/tasks';
-import type { AuthContext } from '../auth';
+import type { ClientContext } from '../auth';
 import { EntityAuditTrail, type AuditResource } from '../audit';
 import type { TypedSupabaseClient } from '../client';
 import type { AddTaskLinkDto, CreateTaskDto, GetTasksDto, UpdateTaskDto } from './dto';
@@ -12,8 +12,10 @@ export declare class TasksResource {
     private readonly table;
     /** This record's history - its own rows and the rows that hang off it. */
     readonly audit: EntityAuditTrail;
-    constructor(supabase: TypedSupabaseClient, auth: AuthContext, auditLog: AuditResource);
-    list(query: GetTasksDto): Promise<MmsList<TaskSummary>>;
+    constructor(supabase: TypedSupabaseClient, auth: ClientContext, auditLog: AuditResource);
+    list(query: GetTasksDto & {
+        organization_id?: string | null;
+    }): Promise<MmsList<TaskSummary>>;
     getById(taskId: string): Promise<TaskEntity>;
     create(input: CreateTaskDto): Promise<TaskEntity>;
     update(taskId: string, input: UpdateTaskDto): Promise<TaskEntity>;

package/dist/tasks/index.js

@@ -20,6 +20,7 @@ const enum_2 = require("@managemint-solutions/entities/labels/enum");
 const enum_3 = require("@managemint-solutions/entities/audit-trail/enum");
 const audit_1 = require("../audit");
 const errors_1 = require("../errors");
+const tenancy_1 = require("../tenancy");
 const transforms_1 = require("../transforms");
 __exportStar(require("./dto"), exports);
 // The public contract is the shared TaskSummary / TaskEntity from @managemint-solutions/entities;
@@ -146,17 +147,17 @@ class TasksResource {
         const labelIdIn = query.label_id_in && query.label_id_in.length > 0 ? query.label_id_in : null;
         // `order`/`range` return `this`, so the builder stays a filter builder and the conditional
         // filters below can be reassigned onto it without a cast.
-        let tasksQuery = this.supabase
+        let tasksQuery = (0, tenancy_1.scopeToOrganization)(this.supabase
             .from('tasks')
-            .select(labelIdIn ? `${TASK_LIST_SELECT}, ${LABEL_FILTER_SELECT}` : TASK_LIST_SELECT, {
-            count: 'estimated',
-        })
-            .eq('organization_id', this.auth.organization_id)
+            .select((0, tenancy_1.withOrganization)(labelIdIn ? `${TASK_LIST_SELECT}, ${LABEL_FILTER_SELECT}` : TASK_LIST_SELECT, this.auth), { count: 'estimated' }), this.auth)
             .eq('archived', query.archive)
             .eq('deleted', false)
             .order('priority', { ascending: false })
             .order('created_at', { ascending: false })
             .range(offset, offset + pageSize - 1);
+        if (query.organization_id) {
+            tasksQuery = tasksQuery.eq('organization_id', query.organization_id);
+        }
         if (trimmedSearch) {
             // "TASK-12", "#12" or "12" also finds task number 12; anything else is a text search only.
             const taskNumber = trimmedSearch.match(/^(?:[a-z]+-|#)?(\d+)$/i)?.[1];
@@ -220,11 +221,7 @@ class TasksResource {
         return (0, transforms_1.toMmsList)(rows, page, pageSize, count);
     }
     async getById(taskId) {
-        const { data, error } = await this.supabase
-            .from('tasks')
-            .select(TASK_DETAIL_SELECT)
-            .eq('mms_id', taskId)
-            .eq('organization_id', this.auth.organization_id)
+        const { data, error } = await (0, tenancy_1.scopeToOrganization)(this.supabase.from('tasks').select((0, tenancy_1.withOrganization)(TASK_DETAIL_SELECT, this.auth)).eq('mms_id', taskId), this.auth)
             .order('created_at', { referencedTable: 'links_out' })
             .order('created_at', { referencedTable: 'links_in' })
             .single();
@@ -250,7 +247,7 @@ class TasksResource {
         // BEFORE INSERT trigger fills it in when it arrives null.
         const row = await this.table.insert({
             ...fields,
-            organization_id: this.auth.organization_id,
+            organization_id: (0, tenancy_1.requireOrganization)(this.auth),
             created_by: this.auth.mms_id,
             created_at: new Date().toISOString(),
         });
@@ -300,6 +297,7 @@ class TasksResource {
      * made from.
      */
     async linkTask(taskId, input) {
+        const organizationId = (0, tenancy_1.requireOrganization)(this.auth);
         const refuse = (status, message, cause) => new errors_1.SupabaseClientError({ status, error: 'Database Error', message }, { cause });
         if (input.linked_task_id === taskId) {
             throw refuse(400, 'A task cannot be linked to itself');
@@ -307,7 +305,7 @@ class TasksResource {
         const { data: tasks, error: tasksError } = await this.supabase
             .from('tasks')
             .select('mms_id, task_number:task_id')
-            .eq('organization_id', this.auth.organization_id)
+            .eq('organization_id', organizationId)
             .eq('deleted', false)
             .in('mms_id', [taskId, input.linked_task_id]);
         if (tasksError)
@@ -328,7 +326,7 @@ class TasksResource {
                 const { data: parentLink, error: parentError } = await this.supabase
                     .from('task_links')
                     .select('task_id')
-                    .eq('organization_id', this.auth.organization_id)
+                    .eq('organization_id', organizationId)
                     .eq('linked_task_id', child)
                     .eq('link_type', enum_1.TaskLinkType.CHILD)
                     .maybeSingle();
@@ -344,7 +342,7 @@ class TasksResource {
             task_id: taskId,
             linked_task_id: input.linked_task_id,
             link_type: input.link_type,
-            organization_id: this.auth.organization_id,
+            organization_id: organizationId,
             created_by: this.auth.mms_id,
         });
         if (error) {
@@ -376,7 +374,7 @@ class TasksResource {
         const { data, error } = await this.supabase
             .from('task_links')
             .delete()
-            .eq('organization_id', this.auth.organization_id)
+            .eq('organization_id', (0, tenancy_1.requireOrganization)(this.auth))
             .or(`and(task_id.eq.${taskId},linked_task_id.eq.${linkedTaskId}),and(task_id.eq.${linkedTaskId},linked_task_id.eq.${taskId})`)
             .select('task_id, link_type, from:tasks!task_id ( task_number:task_id ), to:tasks!linked_task_id ( task_number:task_id )');
         if (error)
@@ -409,7 +407,7 @@ class TasksResource {
         const { count, error } = await this.supabase
             .from('labels')
             .select('mms_id', { count: 'exact', head: true })
-            .eq('organization_id', this.auth.organization_id)
+            .eq('organization_id', (0, tenancy_1.requireOrganization)(this.auth))
             .eq('entity_type', enum_2.LabelEntityTypes.TASK)
             .in('mms_id', labelIds);
         if (error)
@@ -432,11 +430,12 @@ class TasksResource {
      * across an edit keeps its place.
      */
     async setLabels(taskId, labelIds) {
+        const organizationId = (0, tenancy_1.requireOrganization)(this.auth);
         const { data: current, error: readError } = await this.supabase
             .from('task_labels')
             .select(PINNED_LABEL_SELECT)
             .eq('task_id', taskId)
-            .eq('organization_id', this.auth.organization_id)
+            .eq('organization_id', organizationId)
             .order('created_at');
         if (readError)
             throw (0, errors_1.mapPostgrestError)(readError);
@@ -453,7 +452,7 @@ class TasksResource {
                 .insert(added.map((labelId) => ({
                 task_id: taskId,
                 label_id: labelId,
-                organization_id: this.auth.organization_id,
+                organization_id: organizationId,
                 created_by: this.auth.mms_id,
             })))
                 .select(PINNED_LABEL_SELECT);
@@ -466,7 +465,7 @@ class TasksResource {
                 .from('task_labels')
                 .delete()
                 .eq('task_id', taskId)
-                .eq('organization_id', this.auth.organization_id)
+                .eq('organization_id', organizationId)
                 .in('label_id', dropped.map((row) => row.label_id));
             if (error)
                 throw (0, errors_1.mapPostgrestError)(error);

package/dist/tenancy.d.ts

@@ -0,0 +1,13 @@
+import type { PostgrestFilterBuilder } from '@supabase/postgrest-js';
+/** A read filtered to the caller's organization, or left across every organization for staff. */
+export declare const scopeToOrganization: <Q extends PostgrestFilterBuilder<any, any, any, any, any, any, any>>(query: Q, actor: {
+    organization_id: string | null;
+}) => Q;
+/** The caller's organization id, for a write; staff have none and are refused with a 403. */
+export declare const requireOrganization: (actor: {
+    organization_id: string | null;
+}) => string;
+/** A select, plus the row's organization on a staff read so the row says whose it is. */
+export declare const withOrganization: (select: string, actor: {
+    organization_id: string | null;
+}) => string;

package/dist/tenancy.js

@@ -0,0 +1,25 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.withOrganization = exports.requireOrganization = exports.scopeToOrganization = void 0;
+const errors_1 = require("./errors");
+// How a resource scopes itself to the caller's organization. A tenant (`AuthContext`) reads and
+// writes inside their own; staff (`StaffContext`, `organization_id: null`) read across every
+// organization, as their role's policies allow, and write nothing.
+/** A read filtered to the caller's organization, or left across every organization for staff. */
+const scopeToOrganization = (query, actor) => (actor.organization_id === null ? query : query.eq('organization_id', actor.organization_id));
+exports.scopeToOrganization = scopeToOrganization;
+/** The caller's organization id, for a write; staff have none and are refused with a 403. */
+const requireOrganization = (actor) => {
+    if (actor.organization_id === null) {
+        throw new errors_1.SupabaseClientError({
+            status: 403,
+            error: 'Permission Error',
+            message: 'Organization required',
+        });
+    }
+    return actor.organization_id;
+};
+exports.requireOrganization = requireOrganization;
+/** A select, plus the row's organization on a staff read so the row says whose it is. */
+const withOrganization = (select, actor) => actor.organization_id === null ? `${select}, organization:organizations!organization_id(mms_id, name)` : select;
+exports.withOrganization = withOrganization;

package/dist/user-api-credentials/dto.d.ts

@@ -0,0 +1,12 @@
+import type { CreateUserApiCredentialDto as CreateUserApiCredentialDtoType, MintEmulationTokenDto as MintEmulationTokenDtoType, UserApiCredentialIdDto as UserApiCredentialIdDtoType } from '@managemint-solutions/entities/user-api-credentials/dto';
+export declare class UserApiCredentialIdDto implements UserApiCredentialIdDtoType {
+    readonly credentialId: string;
+}
+export declare class CreateUserApiCredentialDto implements CreateUserApiCredentialDtoType {
+    readonly label: string;
+    readonly expires_at?: string | null;
+}
+export declare class MintEmulationTokenDto implements MintEmulationTokenDtoType {
+    readonly client_id: string;
+    readonly client_secret: string;
+}

package/dist/user-api-credentials/dto.js

@@ -0,0 +1,56 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.MintEmulationTokenDto = exports.CreateUserApiCredentialDto = exports.UserApiCredentialIdDto = void 0;
+const class_validator_1 = require("class-validator");
+const validators_1 = require("../validators");
+class UserApiCredentialIdDto {
+    credentialId;
+}
+exports.UserApiCredentialIdDto = UserApiCredentialIdDto;
+__decorate([
+    (0, class_validator_1.IsUUID)('7', { message: 'Invalid credential ID format' }),
+    __metadata("design:type", String)
+], UserApiCredentialIdDto.prototype, "credentialId", void 0);
+class CreateUserApiCredentialDto {
+    label;
+    expires_at;
+}
+exports.CreateUserApiCredentialDto = CreateUserApiCredentialDto;
+__decorate([
+    (0, class_validator_1.IsString)({ message: 'Label is required' }),
+    (0, class_validator_1.MinLength)(1, { message: 'Label is required' }),
+    (0, class_validator_1.MaxLength)(100, { message: 'Label cannot be longer than 100 characters' }),
+    __metadata("design:type", String)
+], CreateUserApiCredentialDto.prototype, "label", void 0);
+__decorate([
+    (0, class_validator_1.IsOptional)(),
+    (0, validators_1.IsNullable)(),
+    (0, class_validator_1.IsDateString)({}, { message: 'Expiry must be a valid ISO 8601 date string' }),
+    __metadata("design:type", Object)
+], CreateUserApiCredentialDto.prototype, "expires_at", void 0);
+class MintEmulationTokenDto {
+    client_id;
+    client_secret;
+}
+exports.MintEmulationTokenDto = MintEmulationTokenDto;
+__decorate([
+    (0, class_validator_1.IsString)({ message: 'Client ID is required' }),
+    (0, class_validator_1.MinLength)(1, { message: 'Client ID is required' }),
+    (0, class_validator_1.MaxLength)(255, { message: 'Client ID cannot be longer than 255 characters' }),
+    __metadata("design:type", String)
+], MintEmulationTokenDto.prototype, "client_id", void 0);
+__decorate([
+    (0, class_validator_1.IsString)({ message: 'Client secret is required' }),
+    (0, class_validator_1.MinLength)(1, { message: 'Client secret is required' }),
+    (0, class_validator_1.MaxLength)(255, { message: 'Client secret cannot be longer than 255 characters' }),
+    __metadata("design:type", String)
+], MintEmulationTokenDto.prototype, "client_secret", void 0);

package/dist/user-api-credentials/index.d.ts

@@ -0,0 +1,47 @@
+import type { UserApiCredentialEntity } from '@managemint-solutions/entities/user-api-credentials';
+import { type OrganizationTableFactory } from '../audit';
+import type { TypedSupabaseClient } from '../client';
+export * from './dto';
+/** What `create` writes: the secret already hashed, and the staff member who issued it. */
+export type CreateUserApiCredentialRow = {
+    user_id: string;
+    organization_id: string;
+    client_id: string;
+    secret_hash: string;
+    label: string;
+    expires_at: string | null;
+    created_by: string;
+};
+/** The whole row, the secret hash included - what a mint is checked against. */
+export type UserApiCredentialRow = UserApiCredentialEntity & {
+    secret_hash: string;
+};
+/**
+ * Credentials as staff read them, on their own client, through the column grant that leaves the
+ * secret hash out. Tenant users have no grant at all.
+ */
+export declare class UserApiCredentialsReads {
+    private readonly supabase;
+    constructor(supabase: TypedSupabaseClient);
+    /** A user's credentials, newest first. */
+    listForUser(userId: string): Promise<UserApiCredentialEntity[]>;
+}
+/**
+ * The writes and the secret check, on the service client only: every write is the service
+ * role's, and nobody else may read the hash. A credential's writes are audited against its own
+ * organization as the system - the staff member who issued or revoked it is on the row itself
+ * (`created_by`, `revoked_by`), and is not a user an audit row can name.
+ */
+export declare class UserApiCredentialsResource {
+    private readonly supabase;
+    private readonly tableFor;
+    constructor(supabase: TypedSupabaseClient, tableFor: OrganizationTableFactory);
+    /** Issues a credential. Its `secret_hash` is redacted in the audit row and never returned. */
+    create(row: CreateUserApiCredentialRow): Promise<UserApiCredentialEntity>;
+    /** The credential a client id names, with its secret hash. Null when none does. */
+    findByClientId(clientId: string): Promise<UserApiCredentialRow | null>;
+    /** Revokes a live credential. Null when it was revoked already. */
+    revoke(credentialId: string, revokedBy: string): Promise<UserApiCredentialEntity | null>;
+    /** Stamps a successful mint, unaudited: when it was last used, not a change to the credential. */
+    markUsed(credentialId: string): Promise<void>;
+}