@numa-tech/numa 1.12.10 → 1.12.11

package/dist/authorization/access-request-client.js

@@ -0,0 +1,93 @@
+import { resolveBackendUrl } from "../backend.js";
+import { ensureAccessToken, fetchWithKeycloakIdentity } from "../oauth.js";
+import { AuthorizationError, authorizationHttpErrorCode } from "./errors.js";
+import { AccessRequestApiErrorSchema, AccessRequestListSchema, AccessRequestOptionsSchema, AccessRequestSchema } from "./access-request-schemas.js";
+const ACCESS_REQUEST_ROOT = "/api/v1/me/access-requests";
+export class AccessRequestClient {
+    config;
+    fetchImpl;
+    tokenProvider;
+    constructor(config, dependencies = {}) {
+        this.config = config;
+        this.fetchImpl = dependencies.fetch ?? fetch;
+        this.tokenProvider = dependencies.tokenProvider ?? ensureAccessToken;
+    }
+    options() {
+        return this.json(`${ACCESS_REQUEST_ROOT}/options`, AccessRequestOptionsSchema);
+    }
+    create(input) {
+        const { idempotencyKey, ...body } = input;
+        return this.json(ACCESS_REQUEST_ROOT, AccessRequestSchema, {
+            method: "POST",
+            headers: { "Idempotency-Key": idempotencyKey },
+            body: JSON.stringify(body)
+        }, [201]);
+    }
+    list(input) {
+        const query = new URLSearchParams({ view: input.view });
+        if (input.state)
+            query.set("state", input.state);
+        if (input.cursor)
+            query.set("cursor", input.cursor);
+        if (input.limit != null)
+            query.set("limit", String(input.limit));
+        return this.json(`${ACCESS_REQUEST_ROOT}?${query}`, AccessRequestListSchema);
+    }
+    get(requestId) {
+        return this.json(`${ACCESS_REQUEST_ROOT}/${encodeURIComponent(requestId)}`, AccessRequestSchema);
+    }
+    cancel(requestId, version) {
+        return this.json(`${ACCESS_REQUEST_ROOT}/${encodeURIComponent(requestId)}/cancel`, AccessRequestSchema, {
+            method: "POST",
+            body: JSON.stringify({ version })
+        });
+    }
+    review(requestId, input) {
+        return this.json(`${ACCESS_REQUEST_ROOT}/${encodeURIComponent(requestId)}/review`, AccessRequestSchema, {
+            method: "POST",
+            body: JSON.stringify(input)
+        });
+    }
+    async json(path, schema, init = {}, expectedStatuses = [200]) {
+        const url = resolveBackendUrl(this.config, { method: "GET", path });
+        const headers = new Headers(init.headers);
+        headers.set("Accept", "application/json");
+        if (init.body != null)
+            headers.set("Content-Type", "application/json");
+        const response = await fetchWithKeycloakIdentity(this.config, url, () => ({ ...init, headers }), { fetch: this.fetchImpl, tokenProvider: this.tokenProvider });
+        const body = await responseBody(response);
+        if (!response.ok)
+            throw apiFailure(response, body);
+        if (!expectedStatuses.includes(response.status)) {
+            throw new AuthorizationError(`Access request API returned HTTP ${response.status}; expected ${expectedStatuses.join(" or ")}.`, "authorization_invalid_response", response.status);
+        }
+        const parsed = schema.safeParse(body);
+        if (!parsed.success) {
+            throw new AuthorizationError("Access request API returned a response that does not match the safe CLI contract.", "authorization_invalid_response", response.status);
+        }
+        return parsed.data;
+    }
+}
+async function responseBody(response) {
+    const text = await response.text();
+    if (!text)
+        return {};
+    try {
+        return JSON.parse(text);
+    }
+    catch {
+        return text;
+    }
+}
+function apiFailure(response, body) {
+    const parsed = AccessRequestApiErrorSchema.safeParse(body);
+    const messages = {
+        400: "The access request input was invalid.",
+        401: "Access requests require a valid Numa login.",
+        403: "The platform denied this access request operation.",
+        404: "The access request was not found.",
+        409: "The access request changed or conflicts with this operation."
+    };
+    return new AuthorizationError(`Access request API HTTP ${response.status}: ${messages[response.status] ?? "Request failed."}`, authorizationHttpErrorCode(response.status), response.status, undefined, parsed.success ? parsed.data.code : undefined);
+}
+//# sourceMappingURL=access-request-client.js.map

package/dist/authorization/access-request-client.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"access-request-client.js","sourceRoot":"","sources":["../../src/authorization/access-request-client.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,iBAAiB,EAAE,MAAM,eAAe,CAAC;AAClD,OAAO,EAAE,iBAAiB,EAAE,yBAAyB,EAA8B,MAAM,aAAa,CAAC;AACvG,OAAO,EAAE,kBAAkB,EAAE,0BAA0B,EAAE,MAAM,aAAa,CAAC;AAC7E,OAAO,EACL,2BAA2B,EAC3B,uBAAuB,EACvB,0BAA0B,EAC1B,mBAAmB,EAKpB,MAAM,6BAA6B,CAAC;AAErC,MAAM,mBAAmB,GAAG,4BAA4B,CAAC;AA0CzD,MAAM,OAAO,mBAAmB;IAID,MAAM;IAHlB,SAAS,CAAe;IACxB,aAAa,CAAwB;IAEtD,YAA6B,MAAkB,EAAE,YAAY,GAAoC,EAAE;sBAAtE,MAAM;QACjC,IAAI,CAAC,SAAS,GAAG,YAAY,CAAC,KAAK,IAAI,KAAK,CAAC;QAC7C,IAAI,CAAC,aAAa,GAAG,YAAY,CAAC,aAAa,IAAI,iBAAiB,CAAC;IACvE,CAAC;IAED,OAAO;QACL,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,mBAAmB,UAAU,EAAE,0BAA0B,CAAC,CAAC;IACjF,CAAC;IAED,MAAM,CAAC,KAA+B;QACpC,MAAM,EAAE,cAAc,EAAE,GAAG,IAAI,EAAE,GAAG,KAAK,CAAC;QAC1C,OAAO,IAAI,CAAC,IAAI,CAAC,mBAAmB,EAAE,mBAAmB,EAAE;YACzD,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,iBAAiB,EAAE,cAAc,EAAE;YAC9C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;SAC3B,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACZ,CAAC;IAED,IAAI,CAAC,KAA8B;QACjC,MAAM,KAAK,GAAG,IAAI,eAAe,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;QACxD,IAAI,KAAK,CAAC,KAAK;YAAE,KAAK,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC;QACjD,IAAI,KAAK,CAAC,MAAM;YAAE,KAAK,CAAC,GAAG,CAAC,QAAQ,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;QACpD,IAAI,KAAK,CAAC,KAAK,IAAI,IAAI;YAAE,KAAK,CAAC,GAAG,CAAC,OAAO,EAAE,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC;QACjE,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,mBAAmB,IAAI,KAAK,EAAE,EAAE,uBAAuB,CAAC,CAAC;IAC/E,CAAC;IAED,GAAG,CAAC,SAAiB;QACnB,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,mBAAmB,IAAI,kBAAkB,CAAC,SAAS,CAAC,EAAE,EAAE,mBAAmB,CAAC,CAAC;IACnG,CAAC;IAED,MAAM,CAAC,SAAiB,EAAE,OAAe;QACvC,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,mBAAmB,IAAI,kBAAkB,CAAC,SAAS,CAAC,SAAS,EAAE,mBAAmB,EAAE;YACtG,MAAM,EAAE,MAAM;YACd,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,CAAC;SAClC,CAAC,CAAC;IACL,CAAC;IAED,MAAM,CAAC,SAAiB,EAAE,KAA+B;QACvD,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,mBAAmB,IAAI,kBAAkB,CAAC,SAAS,CAAC,SAAS,EAAE,mBAAmB,EAAE;YACtG,MAAM,EAAE,MAAM;YACd,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC;SAC5B,CAAC,CAAC;IACL,CAAC;IAEO,KAAK,CAAC,IAAI,CAChB,IAAY,EACZ,MAAiB,EACjB,IAAI,GAAgB,EAAE,EACtB,gBAAgB,GAAa,CAAC,GAAG,CAAC;QAElC,MAAM,GAAG,GAAG,iBAAiB,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QACpE,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAC1C,OAAO,CAAC,GAAG,CAAC,QAAQ,EAAE,kBAAkB,CAAC,CAAC;QAC1C,IAAI,IAAI,CAAC,IAAI,IAAI,IAAI;YAAE,OAAO,CAAC,GAAG,CAAC,cAAc,EAAE,kBAAkB,CAAC,CAAC;QACvE,MAAM,QAAQ,GAAG,MAAM,yBAAyB,CAC9C,IAAI,CAAC,MAAM,EACX,GAAG,EACH,GAAG,EAAE,CAAC,CAAC,EAAE,GAAG,IAAI,EAAE,OAAO,EAAE,CAAC,EAC5B,EAAE,KAAK,EAAE,IAAI,CAAC,SAAS,EAAE,aAAa,EAAE,IAAI,CAAC,aAAa,EAAE,CAC7D,CAAC;QACF,MAAM,IAAI,GAAG,MAAM,YAAY,CAAC,QAAQ,CAAC,CAAC;QAC1C,IAAI,CAAC,QAAQ,CAAC,EAAE;YAAE,MAAM,UAAU,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;QACnD,IAAI,CAAC,gBAAgB,CAAC,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;YAChD,MAAM,IAAI,kBAAkB,CAC1B,oCAAoC,QAAQ,CAAC,MAAM,cAAc,gBAAgB,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,EACjG,gCAAgC,EAChC,QAAQ,CAAC,MAAM,CAChB,CAAC;QACJ,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;QACtC,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YACpB,MAAM,IAAI,kBAAkB,CAC1B,mFAAmF,EACnF,gCAAgC,EAChC,QAAQ,CAAC,MAAM,CAChB,CAAC;QACJ,CAAC;QACD,OAAO,MAAM,CAAC,IAAI,CAAC;IACrB,CAAC;CACF;AAED,KAAK,UAAU,YAAY,CAAC,QAAkB;IAC5C,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;IACnC,IAAI,CAAC,IAAI;QAAE,OAAO,EAAE,CAAC;IACrB,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAY,CAAC;IACrC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAS,UAAU,CAAC,QAAkB,EAAE,IAAa;IACnD,MAAM,MAAM,GAAG,2BAA2B,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;IAC3D,MAAM,QAAQ,GAAoC;QAChD,GAAG,EAAE,uCAAuC;QAC5C,GAAG,EAAE,6CAA6C;QAClD,GAAG,EAAE,oDAAoD;QACzD,GAAG,EAAE,mCAAmC;QACxC,GAAG,EAAE,8DAA8D;KACpE,CAAC;IACF,OAAO,IAAI,kBAAkB,CAC3B,2BAA2B,QAAQ,CAAC,MAAM,KAAK,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,iBAAiB,EAAE,EAC/F,0BAA0B,CAAC,QAAQ,CAAC,MAAM,CAAC,EAC3C,QAAQ,CAAC,MAAM,EACf,SAAS,EACT,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAC9C,CAAC;AACJ,CAAC"}

package/dist/authorization/access-request-commands.d.ts

@@ -0,0 +1,25 @@
+import type { Command } from "commander";
+import type { AccessRequestApi, CreateAccessRequestInput, ListAccessRequestsInput, ReviewAccessRequestInput } from "./access-request-client.js";
+export interface AccessRequestCommandDependencies {
+    clientFactory: () => AccessRequestApi;
+}
+export declare function registerAccessRequestCommands(authorization: Command, dependencies: AccessRequestCommandDependencies): void;
+export declare function parseCreateAccessRequestInput(options: {
+    role: string;
+    reason: string;
+    idempotencyKey: string;
+    namespaceId?: string;
+}): CreateAccessRequestInput;
+export declare function parseListAccessRequestsInput(options: {
+    view: string;
+    state?: string;
+    cursor?: string;
+    limit: string;
+}): ListAccessRequestsInput;
+export declare function parseReviewAccessRequestInput(options: {
+    decision: string;
+    reason: string;
+    version: string;
+}): ReviewAccessRequestInput;
+export declare function parseAccessRequestId(value: string): string;
+export declare function parseVersion(value: string): number;

package/dist/authorization/access-request-commands.js

@@ -0,0 +1,196 @@
+import process from "node:process";
+import { loadAppConfig } from "../app-config.js";
+import { sanitizeAuthorizationOutput } from "./errors.js";
+import { AuthorizationError } from "./errors.js";
+const ROLE_PREFIX = "mci-devops-platform-";
+const REQUEST_ID = /^ar_[A-Za-z0-9_-]{8,76}$/u;
+const CONTROL_CHARACTERS = /[\u0000-\u001f\u007f]/u;
+export function registerAccessRequestCommands(authorization, dependencies) {
+    const accessRequest = authorization.command("access-request")
+        .description("申请角色权限、查询申请清单并执行双人审批")
+        .addHelpText("after", `
+安全边界:
+  create 只提交申请，不会直接授权。
+  review 只向 DevOps 提交审批决定；Keycloak 管理凭据不会进入 CLI。
+  审批人不能审批自己的申请，最终授权状态以服务端返回为准。
+`);
+    addExamples(accessRequest.command("options")
+        .description("列出可申请角色、namespace 和当前用户的审批能力")
+        .action(async (_options, command) => {
+        const options = await dependencies.clientFactory().options();
+        const lines = [
+            ...options.roles.map((role) => `${role.roleCode}\t${role.scopeType}\t${role.roleName}`),
+            ...options.namespaces.map((namespace) => `${namespace.id}\t${namespace.namespaceKey}\t${namespace.environment}\t${namespace.displayName}`)
+        ];
+        await output(command, { ok: true, options }, lines.join("\n") || "没有可申请的角色或 namespace");
+    }), ["numa authorization access-request options --json"]);
+    addExamples(accessRequest.command("create")
+        .description("提交角色权限申请；不会直接执行授权")
+        .requiredOption("--role <role-code>", "可申请的完整 Client Role 名称")
+        .requiredOption("--reason <text>", "申请原因（至少 5 个字符）")
+        .requiredOption("--idempotency-key <key>", "8-200 字符；网络重试时复用同一个值")
+        .option("--namespace-id <id>", "namespace 范围角色所需的平台 namespace ID")
+        .action(async (options, command) => {
+        const input = parseCreateAccessRequestInput(options);
+        const request = await dependencies.clientFactory().create(input);
+        await output(command, { ok: true, access_request: request }, requestLine(request));
+    }), [
+        "numa authorization access-request create --role mci-devops-platform-ai-registry-reviewer --namespace-id 7 --reason '负责 team-ai 发布审核' --idempotency-key reviewer-team-ai-20260820 --json"
+    ]);
+    addExamples(accessRequest.command("list")
+        .description("查询自己的申请清单或当前用户可审批的清单")
+        .option("--view <view>", "mine 或 review", "mine")
+        .option("--state <state>", "按状态筛选")
+        .option("--cursor <id>", "上一页返回的 nextCursor")
+        .option("--limit <count>", "每页 1-100 条", "20")
+        .action(async (options, command) => {
+        const input = parseListAccessRequestsInput(options);
+        const result = await dependencies.clientFactory().list(input);
+        await output(command, { ok: true, ...result }, result.items.map(requestLine).join("\n") || (input.view === "mine" ? "没有权限申请" : "没有待审批申请"));
+    }), [
+        "numa authorization access-request list --view mine --json",
+        "numa authorization access-request list --view review --state SUBMITTED --json"
+    ]);
+    addExamples(accessRequest.command("show <request-id>")
+        .description("查询本人申请或有权审批的申请详情")
+        .action(async (requestIdValue, _options, command) => {
+        const request = await dependencies.clientFactory().get(parseAccessRequestId(requestIdValue));
+        await output(command, { ok: true, access_request: request }, requestLine(request));
+    }), ["numa authorization access-request show ar_0123456789abcdef0123456789abcdef --json"]);
+    addExamples(accessRequest.command("cancel <request-id>")
+        .description("申请人撤销仍处于 SUBMITTED 的申请")
+        .requiredOption("--version <version>", "详情或清单返回的乐观锁版本")
+        .action(async (requestIdValue, options, command) => {
+        const request = await dependencies.clientFactory().cancel(parseAccessRequestId(requestIdValue), parseVersion(options.version));
+        await output(command, { ok: true, access_request: request }, requestLine(request));
+    }), ["numa authorization access-request cancel ar_0123456789abcdef0123456789abcdef --version 0 --json"]);
+    addExamples(accessRequest.command("review <request-id>")
+        .description("审批或重试授权；禁止申请人自审")
+        .requiredOption("--decision <decision>", "approve 或 reject")
+        .requiredOption("--reason <text>", "审批依据（至少 3 个字符）")
+        .requiredOption("--version <version>", "详情或审批清单返回的乐观锁版本")
+        .action(async (requestIdValue, options, command) => {
+        const input = parseReviewAccessRequestInput(options);
+        const request = await dependencies.clientFactory().review(parseAccessRequestId(requestIdValue), input);
+        const completed = input.decision === "REJECT"
+            ? request.state === "REJECTED"
+            : request.state === "GRANTED";
+        await output(command, { ok: completed, access_request: request }, requestLine(request));
+        if (!completed)
+            process.exitCode = 1;
+    }), [
+        "numa authorization access-request review ar_0123456789abcdef0123456789abcdef --decision approve --reason '职责确认无误' --version 0 --json",
+        "numa authorization access-request review ar_0123456789abcdef0123456789abcdef --decision reject --reason '职责范围不符' --version 0 --json"
+    ]);
+}
+export function parseCreateAccessRequestInput(options) {
+    const roleCode = boundedText(options.role, "role", 120, 1);
+    if (!roleCode.startsWith(ROLE_PREFIX) || !/^[A-Za-z0-9][A-Za-z0-9._-]*$/u.test(roleCode)) {
+        throw invalid(`role must be a complete Client Role beginning with '${ROLE_PREFIX}'.`);
+    }
+    const reason = boundedText(options.reason, "reason", 2_000, 5);
+    const idempotencyKey = boundedText(options.idempotencyKey, "idempotency-key", 200, 8);
+    if (!/^[A-Za-z0-9._:-]+$/u.test(idempotencyKey)) {
+        throw invalid("idempotency-key may contain only letters, numbers, dot, underscore, colon, or dash.");
+    }
+    return {
+        roleCode,
+        reason,
+        idempotencyKey,
+        ...(options.namespaceId == null ? {} : { namespaceId: parsePositiveInteger(options.namespaceId, "namespace-id") })
+    };
+}
+export function parseListAccessRequestsInput(options) {
+    const view = options.view.trim().toLowerCase();
+    if (view !== "mine" && view !== "review")
+        throw invalid("view must be mine or review.");
+    const state = options.state == null ? undefined : options.state.trim().toUpperCase();
+    const allowedStates = ["SUBMITTED", "GRANTING", "GRANTED", "REJECTED", "GRANT_FAILED", "CANCELLED"];
+    if (state != null && !allowedStates.includes(state))
+        throw invalid("state is invalid.");
+    const limit = parsePositiveInteger(options.limit, "limit");
+    if (limit > 100)
+        throw invalid("limit must be between 1 and 100.");
+    const cursor = options.cursor == null ? undefined : String(parsePositiveInteger(options.cursor, "cursor"));
+    return {
+        view,
+        ...(state == null ? {} : { state: state }),
+        ...(cursor == null ? {} : { cursor }),
+        limit
+    };
+}
+export function parseReviewAccessRequestInput(options) {
+    const decision = options.decision.trim().toUpperCase();
+    if (decision !== "APPROVE" && decision !== "REJECT") {
+        throw invalid("decision must be approve or reject.");
+    }
+    return {
+        decision,
+        reason: boundedText(options.reason, "reason", 2_000, 3),
+        version: parseVersion(options.version)
+    };
+}
+export function parseAccessRequestId(value) {
+    const normalized = value.trim();
+    if (!REQUEST_ID.test(normalized))
+        throw invalid("request-id is invalid.");
+    return normalized;
+}
+export function parseVersion(value) {
+    const parsed = Number(value);
+    if (!Number.isSafeInteger(parsed) || parsed < 0 || String(parsed) !== value.trim()) {
+        throw invalid("version must be a non-negative integer.");
+    }
+    return parsed;
+}
+function parsePositiveInteger(value, label) {
+    const parsed = Number(value);
+    if (!Number.isSafeInteger(parsed) || parsed < 1 || String(parsed) !== value.trim()) {
+        throw invalid(`${label} must be a positive integer.`);
+    }
+    return parsed;
+}
+function boundedText(value, label, maximum, minimum) {
+    const normalized = value.trim();
+    if (normalized.length < minimum || normalized.length > maximum || CONTROL_CHARACTERS.test(normalized)) {
+        throw invalid(`${label} must be ${minimum}-${maximum} characters and contain no control characters.`);
+    }
+    return normalized;
+}
+function requestLine(request) {
+    return [
+        request.requestId,
+        request.state,
+        request.roleCode,
+        request.namespaceKey ?? "GLOBAL",
+        `v${request.version}`
+    ].join("\t");
+}
+function addExamples(command, examples) {
+    return command.addHelpText("after", `\nExamples:\n${examples.map((item) => `  ${item}`).join("\n")}\n`);
+}
+async function output(command, payload, textValue) {
+    const config = await loadAppConfig();
+    if (command.optsWithGlobals().json || config.output === "json") {
+        process.stdout.write(`${JSON.stringify(stableOutput(payload), null, 2)}\n`);
+    }
+    else {
+        process.stdout.write(`${String(sanitizeAuthorizationOutput(textValue))}\n`);
+    }
+}
+function stableOutput(value) {
+    const safe = sanitizeAuthorizationOutput(value);
+    if (Array.isArray(safe))
+        return safe.map(stableOutput);
+    if (safe && typeof safe === "object") {
+        return Object.fromEntries(Object.entries(safe).map(([key, item]) => [
+            key.replace(/([a-z0-9])([A-Z])/gu, "$1_$2").toLowerCase(),
+            stableOutput(item)
+        ]));
+    }
+    return safe;
+}
+function invalid(message) {
+    return new AuthorizationError(message, "authorization_input_invalid");
+}
+//# sourceMappingURL=access-request-commands.js.map

package/dist/authorization/access-request-commands.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"access-request-commands.js","sourceRoot":"","sources":["../../src/authorization/access-request-commands.ts"],"names":[],"mappings":"AAAA,OAAO,OAAO,MAAM,cAAc,CAAC;AAEnC,OAAO,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AACjD,OAAO,EAAE,2BAA2B,EAAE,MAAM,aAAa,CAAC;AAQ1D,OAAO,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAC;AAEjD,MAAM,WAAW,GAAG,sBAAsB,CAAC;AAC3C,MAAM,UAAU,GAAG,2BAA2B,CAAC;AAC/C,MAAM,kBAAkB,GAAG,wBAAwB,CAAC;AAMpD,MAAM,UAAU,6BAA6B,CAC3C,aAAsB,EACtB,YAA8C;IAE9C,MAAM,aAAa,GAAG,aAAa,CAAC,OAAO,CAAC,gBAAgB,CAAC;SAC1D,WAAW,CAAC,sBAAsB,CAAC;SACnC,WAAW,CAAC,OAAO,EAAE;;;;;CAKzB,CAAC,CAAC;IAED,WAAW,CAAC,aAAa,CAAC,OAAO,CAAC,SAAS,CAAC;SACzC,WAAW,CAAC,8BAA8B,CAAC;SAC3C,MAAM,CAAC,KAAK,EAAE,QAAiB,EAAE,OAAgB,EAAE,EAAE;QACpD,MAAM,OAAO,GAAG,MAAM,YAAY,CAAC,aAAa,EAAE,CAAC,OAAO,EAAE,CAAC;QAC7D,MAAM,KAAK,GAAG;YACZ,GAAG,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,GAAG,IAAI,CAAC,QAAQ,KAAK,IAAI,CAAC,SAAS,KAAK,IAAI,CAAC,QAAQ,EAAE,CAAC;YACvF,GAAG,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,SAAS,EAAE,EAAE,CACtC,GAAG,SAAS,CAAC,EAAE,KAAK,SAAS,CAAC,YAAY,KAAK,SAAS,CAAC,WAAW,KAAK,SAAS,CAAC,WAAW,EAAE,CACjG;SACF,CAAC;QACF,MAAM,MAAM,CAAC,OAAO,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,qBAAqB,CAAC,CAAC;IAC1F,CAAC,CAAC,EAAE,CAAC,kDAAkD,CAAC,CAAC,CAAC;IAE5D,WAAW,CAAC,aAAa,CAAC,OAAO,CAAC,QAAQ,CAAC;SACxC,WAAW,CAAC,mBAAmB,CAAC;SAChC,cAAc,CAAC,oBAAoB,EAAE,uBAAuB,CAAC;SAC7D,cAAc,CAAC,iBAAiB,EAAE,gBAAgB,CAAC;SACnD,cAAc,CAAC,yBAAyB,EAAE,sBAAsB,CAAC;SACjE,MAAM,CAAC,qBAAqB,EAAE,kCAAkC,CAAC;SACjE,MAAM,CAAC,KAAK,EACX,OAAuF,EACvF,OAAgB,EAChB,EAAE;QACF,MAAM,KAAK,GAAG,6BAA6B,CAAC,OAAO,CAAC,CAAC;QACrD,MAAM,OAAO,GAAG,MAAM,YAAY,CAAC,aAAa,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACjE,MAAM,MAAM,CAAC,OAAO,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,cAAc,EAAE,OAAO,EAAE,EAAE,WAAW,CAAC,OAAO,CAAC,CAAC,CAAC;IACrF,CAAC,CAAC,EAAE;QACF,yLAAyL;KAC1L,CAAC,CAAC;IAEL,WAAW,CAAC,aAAa,CAAC,OAAO,CAAC,MAAM,CAAC;SACtC,WAAW,CAAC,sBAAsB,CAAC;SACnC,MAAM,CAAC,eAAe,EAAE,eAAe,EAAE,MAAM,CAAC;SAChD,MAAM,CAAC,iBAAiB,EAAE,OAAO,CAAC;SAClC,MAAM,CAAC,eAAe,EAAE,mBAAmB,CAAC;SAC5C,MAAM,CAAC,iBAAiB,EAAE,YAAY,EAAE,IAAI,CAAC;SAC7C,MAAM,CAAC,KAAK,EAAE,OAAyE,EAAE,OAAgB,EAAE,EAAE;QAC5G,MAAM,KAAK,GAAG,4BAA4B,CAAC,OAAO,CAAC,CAAC;QACpD,MAAM,MAAM,GAAG,MAAM,YAAY,CAAC,aAAa,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC9D,MAAM,MAAM,CACV,OAAO,EACP,EAAE,EAAE,EAAE,IAAI,EAAE,GAAG,MAAM,EAAE,EACvB,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,KAAK,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,CAC3F,CAAC;IACJ,CAAC,CAAC,EAAE;QACF,2DAA2D;QAC3D,+EAA+E;KAChF,CAAC,CAAC;IAEL,WAAW,CAAC,aAAa,CAAC,OAAO,CAAC,mBAAmB,CAAC;SACnD,WAAW,CAAC,kBAAkB,CAAC;SAC/B,MAAM,CAAC,KAAK,EAAE,cAAsB,EAAE,QAAiB,EAAE,OAAgB,EAAE,EAAE;QAC5E,MAAM,OAAO,GAAG,MAAM,YAAY,CAAC,aAAa,EAAE,CAAC,GAAG,CAAC,oBAAoB,CAAC,cAAc,CAAC,CAAC,CAAC;QAC7F,MAAM,MAAM,CAAC,OAAO,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,cAAc,EAAE,OAAO,EAAE,EAAE,WAAW,CAAC,OAAO,CAAC,CAAC,CAAC;IACrF,CAAC,CAAC,EAAE,CAAC,mFAAmF,CAAC,CAAC,CAAC;IAE7F,WAAW,CAAC,aAAa,CAAC,OAAO,CAAC,qBAAqB,CAAC;SACrD,WAAW,CAAC,wBAAwB,CAAC;SACrC,cAAc,CAAC,qBAAqB,EAAE,eAAe,CAAC;SACtD,MAAM,CAAC,KAAK,EAAE,cAAsB,EAAE,OAA4B,EAAE,OAAgB,EAAE,EAAE;QACvF,MAAM,OAAO,GAAG,MAAM,YAAY,CAAC,aAAa,EAAE,CAAC,MAAM,CACvD,oBAAoB,CAAC,cAAc,CAAC,EACpC,YAAY,CAAC,OAAO,CAAC,OAAO,CAAC,CAC9B,CAAC;QACF,MAAM,MAAM,CAAC,OAAO,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,cAAc,EAAE,OAAO,EAAE,EAAE,WAAW,CAAC,OAAO,CAAC,CAAC,CAAC;IACrF,CAAC,CAAC,EAAE,CAAC,iGAAiG,CAAC,CAAC,CAAC;IAE3G,WAAW,CAAC,aAAa,CAAC,OAAO,CAAC,qBAAqB,CAAC;SACrD,WAAW,CAAC,iBAAiB,CAAC;SAC9B,cAAc,CAAC,uBAAuB,EAAE,kBAAkB,CAAC;SAC3D,cAAc,CAAC,iBAAiB,EAAE,gBAAgB,CAAC;SACnD,cAAc,CAAC,qBAAqB,EAAE,iBAAiB,CAAC;SACxD,MAAM,CAAC,KAAK,EACX,cAAsB,EACtB,OAA8D,EAC9D,OAAgB,EAChB,EAAE;QACF,MAAM,KAAK,GAAG,6BAA6B,CAAC,OAAO,CAAC,CAAC;QACrD,MAAM,OAAO,GAAG,MAAM,YAAY,CAAC,aAAa,EAAE,CAAC,MAAM,CAAC,oBAAoB,CAAC,cAAc,CAAC,EAAE,KAAK,CAAC,CAAC;QACvG,MAAM,SAAS,GAAG,KAAK,CAAC,QAAQ,KAAK,QAAQ;YAC3C,CAAC,CAAC,OAAO,CAAC,KAAK,KAAK,UAAU;YAC9B,CAAC,CAAC,OAAO,CAAC,KAAK,KAAK,SAAS,CAAC;QAChC,MAAM,MAAM,CAAC,OAAO,EAAE,EAAE,EAAE,EAAE,SAAS,EAAE,cAAc,EAAE,OAAO,EAAE,EAAE,WAAW,CAAC,OAAO,CAAC,CAAC,CAAC;QACxF,IAAI,CAAC,SAAS;YAAE,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;IACvC,CAAC,CAAC,EAAE;QACF,sIAAsI;QACtI,qIAAqI;KACtI,CAAC,CAAC;AACP,CAAC;AAED,MAAM,UAAU,6BAA6B,CAAC,OAK7C;IACC,MAAM,QAAQ,GAAG,WAAW,CAAC,OAAO,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC;IAC3D,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,WAAW,CAAC,IAAI,CAAC,+BAA+B,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;QACzF,MAAM,OAAO,CAAC,uDAAuD,WAAW,IAAI,CAAC,CAAC;IACxF,CAAC;IACD,MAAM,MAAM,GAAG,WAAW,CAAC,OAAO,CAAC,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC;IAC/D,MAAM,cAAc,GAAG,WAAW,CAAC,OAAO,CAAC,cAAc,EAAE,iBAAiB,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC;IACtF,IAAI,CAAC,qBAAqB,CAAC,IAAI,CAAC,cAAc,CAAC,EAAE,CAAC;QAChD,MAAM,OAAO,CAAC,qFAAqF,CAAC,CAAC;IACvG,CAAC;IACD,OAAO;QACL,QAAQ;QACR,MAAM;QACN,cAAc;QACd,GAAG,CAAC,OAAO,CAAC,WAAW,IAAI,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,oBAAoB,CAAC,OAAO,CAAC,WAAW,EAAE,cAAc,CAAC,EAAE,CAAC;KACnH,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,4BAA4B,CAAC,OAK5C;IACC,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAC/C,IAAI,IAAI,KAAK,MAAM,IAAI,IAAI,KAAK,QAAQ;QAAE,MAAM,OAAO,CAAC,8BAA8B,CAAC,CAAC;IACxF,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,IAAI,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IACrF,MAAM,aAAa,GAAG,CAAC,WAAW,EAAE,UAAU,EAAE,SAAS,EAAE,UAAU,EAAE,cAAc,EAAE,WAAW,CAAC,CAAC;IACpG,IAAI,KAAK,IAAI,IAAI,IAAI,CAAC,aAAa,CAAC,QAAQ,CAAC,KAAK,CAAC;QAAE,MAAM,OAAO,CAAC,mBAAmB,CAAC,CAAC;IACxF,MAAM,KAAK,GAAG,oBAAoB,CAAC,OAAO,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;IAC3D,IAAI,KAAK,GAAG,GAAG;QAAE,MAAM,OAAO,CAAC,kCAAkC,CAAC,CAAC;IACnE,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,oBAAoB,CAAC,OAAO,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC;IAC3G,OAAO;QACL,IAAI;QACJ,GAAG,CAAC,KAAK,IAAI,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,KAA2B,EAAE,CAAC;QAChE,GAAG,CAAC,MAAM,IAAI,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC;QACrC,KAAK;KACN,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,6BAA6B,CAAC,OAI7C;IACC,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IACvD,IAAI,QAAQ,KAAK,SAAS,IAAI,QAAQ,KAAK,QAAQ,EAAE,CAAC;QACpD,MAAM,OAAO,CAAC,qCAAqC,CAAC,CAAC;IACvD,CAAC;IACD,OAAO;QACL,QAAQ;QACR,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,CAAC;QACvD,OAAO,EAAE,YAAY,CAAC,OAAO,CAAC,OAAO,CAAC;KACvC,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,oBAAoB,CAAC,KAAa;IAChD,MAAM,UAAU,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;IAChC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,UAAU,CAAC;QAAE,MAAM,OAAO,CAAC,wBAAwB,CAAC,CAAC;IAC1E,OAAO,UAAU,CAAC;AACpB,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,KAAa;IACxC,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;IAC7B,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,MAAM,GAAG,CAAC,IAAI,MAAM,CAAC,MAAM,CAAC,KAAK,KAAK,CAAC,IAAI,EAAE,EAAE,CAAC;QACnF,MAAM,OAAO,CAAC,yCAAyC,CAAC,CAAC;IAC3D,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,oBAAoB,CAAC,KAAa,EAAE,KAAa;IACxD,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;IAC7B,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,MAAM,GAAG,CAAC,IAAI,MAAM,CAAC,MAAM,CAAC,KAAK,KAAK,CAAC,IAAI,EAAE,EAAE,CAAC;QACnF,MAAM,OAAO,CAAC,GAAG,KAAK,8BAA8B,CAAC,CAAC;IACxD,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,WAAW,CAAC,KAAa,EAAE,KAAa,EAAE,OAAe,EAAE,OAAe;IACjF,MAAM,UAAU,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;IAChC,IAAI,UAAU,CAAC,MAAM,GAAG,OAAO,IAAI,UAAU,CAAC,MAAM,GAAG,OAAO,IAAI,kBAAkB,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC;QACtG,MAAM,OAAO,CAAC,GAAG,KAAK,YAAY,OAAO,IAAI,OAAO,gDAAgD,CAAC,CAAC;IACxG,CAAC;IACD,OAAO,UAAU,CAAC;AACpB,CAAC;AAED,SAAS,WAAW,CAAC,OAAsB;IACzC,OAAO;QACL,OAAO,CAAC,SAAS;QACjB,OAAO,CAAC,KAAK;QACb,OAAO,CAAC,QAAQ;QAChB,OAAO,CAAC,YAAY,IAAI,QAAQ;QAChC,IAAI,OAAO,CAAC,OAAO,EAAE;KACtB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACf,CAAC;AAED,SAAS,WAAW,CAAC,OAAgB,EAAE,QAAkB;IACvD,OAAO,OAAO,CAAC,WAAW,CAAC,OAAO,EAAE,gBAAgB,QAAQ,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC1G,CAAC;AAED,KAAK,UAAU,MAAM,CAAC,OAAgB,EAAE,OAAgB,EAAE,SAAiB;IACzE,MAAM,MAAM,GAAG,MAAM,aAAa,EAAE,CAAC;IACrC,IAAI,OAAO,CAAC,eAAe,EAAsB,CAAC,IAAI,IAAI,MAAM,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;QACnF,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,YAAY,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC;IAC9E,CAAC;SAAM,CAAC;QACN,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,MAAM,CAAC,2BAA2B,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,CAAC;IAC9E,CAAC;AACH,CAAC;AAED,SAAS,YAAY,CAAC,KAAc;IAClC,MAAM,IAAI,GAAG,2BAA2B,CAAC,KAAK,CAAC,CAAC;IAChD,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;IACvD,IAAI,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;QACrC,OAAO,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC;YAClE,GAAG,CAAC,OAAO,CAAC,qBAAqB,EAAE,OAAO,CAAC,CAAC,WAAW,EAAE;YACzD,YAAY,CAAC,IAAI,CAAC;SACnB,CAAC,CAAC,CAAC;IACN,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,OAAO,CAAC,OAAe;IAC9B,OAAO,IAAI,kBAAkB,CAAC,OAAO,EAAE,6BAA6B,CAAC,CAAC;AACxE,CAAC"}

package/dist/authorization/access-request-schemas.d.ts

@@ -0,0 +1,123 @@
+import { z } from "zod";
+export declare const AccessRequestStateSchema: z.ZodEnum<{
+    CANCELLED: "CANCELLED";
+    GRANTED: "GRANTED";
+    GRANTING: "GRANTING";
+    GRANT_FAILED: "GRANT_FAILED";
+    REJECTED: "REJECTED";
+    SUBMITTED: "SUBMITTED";
+}>;
+export declare const AccessRequestSchema: z.ZodObject<{
+    id: z.ZodNumber;
+    requestId: z.ZodString;
+    requesterSubject: z.ZodString;
+    requesterUsername: z.ZodNullable<z.ZodString>;
+    roleCode: z.ZodString;
+    roleName: z.ZodString;
+    scopeType: z.ZodEnum<{
+        AI_REGISTRY_NAMESPACE: "AI_REGISTRY_NAMESPACE";
+        GLOBAL: "GLOBAL";
+    }>;
+    namespaceId: z.ZodNullable<z.ZodNumber>;
+    namespaceKey: z.ZodNullable<z.ZodString>;
+    nacosNamespaceId: z.ZodNullable<z.ZodString>;
+    namespaceName: z.ZodNullable<z.ZodString>;
+    environment: z.ZodNullable<z.ZodString>;
+    reason: z.ZodString;
+    state: z.ZodEnum<{
+        CANCELLED: "CANCELLED";
+        GRANTED: "GRANTED";
+        GRANTING: "GRANTING";
+        GRANT_FAILED: "GRANT_FAILED";
+        REJECTED: "REJECTED";
+        SUBMITTED: "SUBMITTED";
+    }>;
+    reviewedBy: z.ZodNullable<z.ZodString>;
+    reviewedByUsername: z.ZodNullable<z.ZodString>;
+    reviewReason: z.ZodNullable<z.ZodString>;
+    reviewedAt: z.ZodNullable<z.ZodString>;
+    grantedAt: z.ZodNullable<z.ZodString>;
+    grantErrorCode: z.ZodNullable<z.ZodString>;
+    grantErrorSummary: z.ZodNullable<z.ZodString>;
+    grantRetryAt: z.ZodOptional<z.ZodString>;
+    grantRetryable: z.ZodOptional<z.ZodBoolean>;
+    version: z.ZodNumber;
+    createdAt: z.ZodString;
+    updatedAt: z.ZodString;
+}, z.core.$strict>;
+export declare const AccessRequestListSchema: z.ZodObject<{
+    view: z.ZodEnum<{
+        mine: "mine";
+        review: "review";
+    }>;
+    items: z.ZodArray<z.ZodObject<{
+        id: z.ZodNumber;
+        requestId: z.ZodString;
+        requesterSubject: z.ZodString;
+        requesterUsername: z.ZodNullable<z.ZodString>;
+        roleCode: z.ZodString;
+        roleName: z.ZodString;
+        scopeType: z.ZodEnum<{
+            AI_REGISTRY_NAMESPACE: "AI_REGISTRY_NAMESPACE";
+            GLOBAL: "GLOBAL";
+        }>;
+        namespaceId: z.ZodNullable<z.ZodNumber>;
+        namespaceKey: z.ZodNullable<z.ZodString>;
+        nacosNamespaceId: z.ZodNullable<z.ZodString>;
+        namespaceName: z.ZodNullable<z.ZodString>;
+        environment: z.ZodNullable<z.ZodString>;
+        reason: z.ZodString;
+        state: z.ZodEnum<{
+            CANCELLED: "CANCELLED";
+            GRANTED: "GRANTED";
+            GRANTING: "GRANTING";
+            GRANT_FAILED: "GRANT_FAILED";
+            REJECTED: "REJECTED";
+            SUBMITTED: "SUBMITTED";
+        }>;
+        reviewedBy: z.ZodNullable<z.ZodString>;
+        reviewedByUsername: z.ZodNullable<z.ZodString>;
+        reviewReason: z.ZodNullable<z.ZodString>;
+        reviewedAt: z.ZodNullable<z.ZodString>;
+        grantedAt: z.ZodNullable<z.ZodString>;
+        grantErrorCode: z.ZodNullable<z.ZodString>;
+        grantErrorSummary: z.ZodNullable<z.ZodString>;
+        grantRetryAt: z.ZodOptional<z.ZodString>;
+        grantRetryable: z.ZodOptional<z.ZodBoolean>;
+        version: z.ZodNumber;
+        createdAt: z.ZodString;
+        updatedAt: z.ZodString;
+    }, z.core.$strict>>;
+    totalItems: z.ZodNumber;
+    page: z.ZodOptional<z.ZodNumber>;
+    pageSize: z.ZodOptional<z.ZodNumber>;
+    totalPages: z.ZodOptional<z.ZodNumber>;
+    nextCursor: z.ZodOptional<z.ZodString>;
+}, z.core.$strict>;
+export declare const AccessRequestOptionsSchema: z.ZodObject<{
+    roles: z.ZodArray<z.ZodObject<{
+        roleCode: z.ZodString;
+        roleName: z.ZodString;
+        description: z.ZodNullable<z.ZodString>;
+        scopeType: z.ZodEnum<{
+            AI_REGISTRY_NAMESPACE: "AI_REGISTRY_NAMESPACE";
+            GLOBAL: "GLOBAL";
+        }>;
+        canReview: z.ZodBoolean;
+    }, z.core.$strict>>;
+    namespaces: z.ZodArray<z.ZodObject<{
+        id: z.ZodNumber;
+        namespaceKey: z.ZodString;
+        nacosNamespaceId: z.ZodString;
+        displayName: z.ZodString;
+        environment: z.ZodString;
+    }, z.core.$strict>>;
+}, z.core.$strict>;
+export declare const AccessRequestApiErrorSchema: z.ZodObject<{
+    code: z.ZodOptional<z.ZodString>;
+    message: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>;
+export type AccessRequest = z.infer<typeof AccessRequestSchema>;
+export type AccessRequestList = z.infer<typeof AccessRequestListSchema>;
+export type AccessRequestOptions = z.infer<typeof AccessRequestOptionsSchema>;
+export type AccessRequestState = z.infer<typeof AccessRequestStateSchema>;

package/dist/authorization/access-request-schemas.js

@@ -0,0 +1,67 @@
+import { z } from "zod";
+export const AccessRequestStateSchema = z.enum([
+    "SUBMITTED",
+    "GRANTING",
+    "GRANTED",
+    "REJECTED",
+    "GRANT_FAILED",
+    "CANCELLED"
+]);
+export const AccessRequestSchema = z.object({
+    id: z.number().int().positive().max(Number.MAX_SAFE_INTEGER),
+    requestId: z.string().regex(/^ar_[A-Za-z0-9_-]{8,76}$/u),
+    requesterSubject: z.string().trim().min(1).max(256),
+    requesterUsername: z.string().trim().min(1).max(256).nullable(),
+    roleCode: z.string().trim().min(1).max(120),
+    roleName: z.string().trim().min(1).max(160),
+    scopeType: z.enum(["GLOBAL", "AI_REGISTRY_NAMESPACE"]),
+    namespaceId: z.number().int().positive().max(Number.MAX_SAFE_INTEGER).nullable(),
+    namespaceKey: z.string().trim().min(1).max(160).nullable(),
+    nacosNamespaceId: z.string().trim().min(1).max(256).nullable(),
+    namespaceName: z.string().trim().min(1).max(160).nullable(),
+    environment: z.string().trim().min(1).max(32).nullable(),
+    reason: z.string().trim().min(1).max(2_000),
+    state: AccessRequestStateSchema,
+    reviewedBy: z.string().trim().min(1).max(256).nullable(),
+    reviewedByUsername: z.string().trim().min(1).max(256).nullable(),
+    reviewReason: z.string().trim().min(1).max(2_000).nullable(),
+    reviewedAt: z.string().datetime({ offset: true }).nullable(),
+    grantedAt: z.string().datetime({ offset: true }).nullable(),
+    grantErrorCode: z.string().trim().min(1).max(120).nullable(),
+    grantErrorSummary: z.string().trim().min(1).max(500).nullable(),
+    grantRetryAt: z.string().datetime({ offset: true }).optional(),
+    grantRetryable: z.boolean().optional(),
+    version: z.number().int().nonnegative(),
+    createdAt: z.string().datetime({ offset: true }),
+    updatedAt: z.string().datetime({ offset: true })
+}).strict();
+export const AccessRequestListSchema = z.object({
+    view: z.enum(["mine", "review"]),
+    items: z.array(AccessRequestSchema),
+    totalItems: z.number().int().nonnegative().max(Number.MAX_SAFE_INTEGER),
+    page: z.number().int().positive().max(Number.MAX_SAFE_INTEGER).optional(),
+    pageSize: z.number().int().positive().max(100).optional(),
+    totalPages: z.number().int().positive().max(Number.MAX_SAFE_INTEGER).optional(),
+    nextCursor: z.string().regex(/^[1-9][0-9]*$/u).optional()
+}).strict();
+export const AccessRequestOptionsSchema = z.object({
+    roles: z.array(z.object({
+        roleCode: z.string().trim().min(1).max(120),
+        roleName: z.string().trim().min(1).max(160),
+        description: z.string().max(2_000).nullable(),
+        scopeType: z.enum(["GLOBAL", "AI_REGISTRY_NAMESPACE"]),
+        canReview: z.boolean()
+    }).strict()),
+    namespaces: z.array(z.object({
+        id: z.number().int().positive().max(Number.MAX_SAFE_INTEGER),
+        namespaceKey: z.string().trim().min(1).max(160),
+        nacosNamespaceId: z.string().trim().min(1).max(256),
+        displayName: z.string().trim().min(1).max(160),
+        environment: z.string().trim().min(1).max(32)
+    }).strict())
+}).strict();
+export const AccessRequestApiErrorSchema = z.object({
+    code: z.string().trim().min(1).max(160).optional(),
+    message: z.string().optional()
+});
+//# sourceMappingURL=access-request-schemas.js.map

package/dist/authorization/access-request-schemas.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"access-request-schemas.js","sourceRoot":"","sources":["../../src/authorization/access-request-schemas.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,MAAM,CAAC,MAAM,wBAAwB,GAAG,CAAC,CAAC,IAAI,CAAC;IAC7C,WAAW;IACX,UAAU;IACV,SAAS;IACT,UAAU;IACV,cAAc;IACd,WAAW;CACZ,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC1C,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,GAAG,CAAC,MAAM,CAAC,gBAAgB,CAAC;IAC5D,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,2BAA2B,CAAC;IACxD,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;IACnD,iBAAiB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE;IAC/D,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;IAC3C,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;IAC3C,SAAS,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,uBAAuB,CAAC,CAAC;IACtD,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,GAAG,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC,QAAQ,EAAE;IAChF,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE;IAC1D,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE;IAC9D,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE;IAC3D,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,QAAQ,EAAE;IACxD,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC;IAC3C,KAAK,EAAE,wBAAwB;IAC/B,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE;IACxD,kBAAkB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE;IAChE,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,QAAQ,EAAE;IAC5D,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,QAAQ,EAAE;IAC5D,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,QAAQ,EAAE;IAC3D,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE;IAC5D,iBAAiB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE;IAC/D,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,QAAQ,EAAE;IAC9D,cAAc,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IACtC,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE;IACvC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;IAChD,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;CACjD,CAAC,CAAC,MAAM,EAAE,CAAC;AAEZ,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC9C,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;IAChC,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,mBAAmB,CAAC;IACnC,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE,CAAC,GAAG,CAAC,MAAM,CAAC,gBAAgB,CAAC;IACvE,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,GAAG,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC,QAAQ,EAAE;IACzE,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE;IACzD,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,GAAG,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC,QAAQ,EAAE;IAC/E,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC,QAAQ,EAAE;CAC1D,CAAC,CAAC,MAAM,EAAE,CAAC;AAEZ,MAAM,CAAC,MAAM,0BAA0B,GAAG,CAAC,CAAC,MAAM,CAAC;IACjD,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC;QACtB,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;QAC3C,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;QAC3C,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,QAAQ,EAAE;QAC7C,SAAS,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,uBAAuB,CAAC,CAAC;QACtD,SAAS,EAAE,CAAC,CAAC,OAAO,EAAE;KACvB,CAAC,CAAC,MAAM,EAAE,CAAC;IACZ,UAAU,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC;QAC3B,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,GAAG,CAAC,MAAM,CAAC,gBAAgB,CAAC;QAC5D,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;QAC/C,gBAAgB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;QACnD,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;QAC9C,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC;KAC9C,CAAC,CAAC,MAAM,EAAE,CAAC;CACb,CAAC,CAAC,MAAM,EAAE,CAAC;AAEZ,MAAM,CAAC,MAAM,2BAA2B,GAAG,CAAC,CAAC,MAAM,CAAC;IAClD,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE;IAClD,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CAC/B,CAAC,CAAC"}

package/dist/authorization/client.d.ts

@@ -0,0 +1,50 @@
+import type { AuthConfig } from "../config.js";
+import { type KeycloakTokenProvider } from "../oauth.js";
+import { type AuthorizationRole, type KeycloakBootstrapRun, type KeycloakBootstrapStart, type RoleProvisionPreview, type RoleProvisionRun } from "./schemas.js";
+export interface AuthorizationClientDependencies {
+    fetch?: typeof fetch;
+    tokenProvider?: KeycloakTokenProvider;
+}
+export interface CreateAuthorizationRoleInput {
+    code: string;
+    name: string;
+    description?: string;
+    status: "ACTIVE";
+}
+export interface ApplyRoleProvisionInput {
+    expectedRoleVersion: number;
+    expectedRemoteDigest: string;
+    idempotencyKey: string;
+}
+export type StartKeycloakBootstrapInput = {
+    mode: "PLAN";
+} | {
+    mode: "APPLY";
+    expectedPlanDigest: string;
+    idempotencyKey: string;
+    confirmRealm: string;
+};
+export interface AuthorizationApi {
+    listRoles(): Promise<AuthorizationRole[]>;
+    createRole(input: CreateAuthorizationRoleInput): Promise<AuthorizationRole>;
+    previewRole(roleId: number): Promise<RoleProvisionPreview>;
+    applyRole(roleId: number, input: ApplyRoleProvisionInput): Promise<RoleProvisionRun>;
+    getProvisioningRun(runId: number): Promise<RoleProvisionRun>;
+    startKeycloakBootstrap(input: StartKeycloakBootstrapInput): Promise<KeycloakBootstrapStart>;
+    getKeycloakBootstrapRun(runId: number): Promise<KeycloakBootstrapRun>;
+}
+export declare class AuthorizationClient implements AuthorizationApi {
+    private readonly config;
+    private readonly fetchImpl;
+    private readonly tokenProvider;
+    constructor(config: AuthConfig, dependencies?: AuthorizationClientDependencies);
+    private authenticatedFetch;
+    private json;
+    listRoles(): Promise<AuthorizationRole[]>;
+    createRole(input: CreateAuthorizationRoleInput): Promise<AuthorizationRole>;
+    previewRole(roleId: number): Promise<RoleProvisionPreview>;
+    applyRole(roleId: number, input: ApplyRoleProvisionInput): Promise<RoleProvisionRun>;
+    getProvisioningRun(runId: number): Promise<RoleProvisionRun>;
+    startKeycloakBootstrap(input: StartKeycloakBootstrapInput): Promise<KeycloakBootstrapStart>;
+    getKeycloakBootstrapRun(runId: number): Promise<KeycloakBootstrapRun>;
+}