@plantops/iam-client 0.1.0

package/dist/endpoints/audit.d.ts

@@ -0,0 +1,43 @@
+/**
+ * `/iam/audit` — the queryable side of governance, Doc 06 §12.
+ *
+ * The last gap in "every Doc 06 endpoint has a typed method". `client.ts` used
+ * to explain why it was open: Session 25 had not built the endpoint and
+ * `@plantops/contracts` typed no audit record, so a method here would have had
+ * to invent both. Both exist now, so this closes it.
+ *
+ * ## One route, two tiers, and no tier parameter
+ *
+ * `iam.platform.audit.read` and `iam.client.audit.read` both admit, and which of
+ * them the caller holds decides nothing about the request. What a reader sees is
+ * decided by the `audit_trail_read` policy alone (Doc 07 §6, Doc 10 §7): a client
+ * admin their own tenant's rows, a platform admin everything including the
+ * `client_id IS NULL` rows that record platform-level acts. So there is no
+ * `?tier=`, and `client_id` only ever *narrows* what RLS already allows — a
+ * tenant the caller may not see is an empty page, never a 403.
+ *
+ * ## The export answers CSV, and says so
+ *
+ * It takes the same filters and no page: it is the whole of the filter or it is
+ * refused, because a truncated compliance export is indistinguishable from a
+ * complete one. `accept: 'text'` is what lets it come back through the same
+ * transport as everything else — same token, same error mapping — rather than
+ * being fetched around the outside of this library.
+ *
+ * There is no mutating route here and there is not meant to be (Doc 10 §7).
+ */
+import type { AuditExportQuery, AuditQuery, AuditRecordDTO, Paginated } from '@plantops/contracts';
+import type { Requester } from '../http.js';
+export interface AuditApi {
+    list(query?: AuditQuery): Promise<Paginated<AuditRecordDTO>>;
+    /**
+     * The same filter as a CSV document, which the export itself audits
+     * (`audit.exported`, Doc 10 §7).
+     *
+     * Returns the CSV text. Handing it to the browser as a file is the caller's
+     * job — this library runs in Node too, where there is nothing to download to.
+     */
+    export(query?: AuditExportQuery): Promise<string>;
+}
+export declare function auditEndpoints(request: Requester): AuditApi;
+//# sourceMappingURL=audit.d.ts.map

package/dist/endpoints/audit.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"audit.d.ts","sourceRoot":"","sources":["../../src/endpoints/audit.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AAEH,OAAO,KAAK,EACV,gBAAgB,EAChB,UAAU,EACV,cAAc,EACd,SAAS,EACV,MAAM,qBAAqB,CAAC;AAG7B,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAE5C,MAAM,WAAW,QAAQ;IACvB,IAAI,CAAC,KAAK,CAAC,EAAE,UAAU,GAAG,OAAO,CAAC,SAAS,CAAC,cAAc,CAAC,CAAC,CAAC;IAC7D;;;;;;OAMG;IACH,MAAM,CAAC,KAAK,CAAC,EAAE,gBAAgB,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;CACnD;AAED,wBAAgB,cAAc,CAAC,OAAO,EAAE,SAAS,GAAG,QAAQ,CAa3D"}

package/dist/endpoints/audit.js

@@ -0,0 +1,41 @@
+/**
+ * `/iam/audit` — the queryable side of governance, Doc 06 §12.
+ *
+ * The last gap in "every Doc 06 endpoint has a typed method". `client.ts` used
+ * to explain why it was open: Session 25 had not built the endpoint and
+ * `@plantops/contracts` typed no audit record, so a method here would have had
+ * to invent both. Both exist now, so this closes it.
+ *
+ * ## One route, two tiers, and no tier parameter
+ *
+ * `iam.platform.audit.read` and `iam.client.audit.read` both admit, and which of
+ * them the caller holds decides nothing about the request. What a reader sees is
+ * decided by the `audit_trail_read` policy alone (Doc 07 §6, Doc 10 §7): a client
+ * admin their own tenant's rows, a platform admin everything including the
+ * `client_id IS NULL` rows that record platform-level acts. So there is no
+ * `?tier=`, and `client_id` only ever *narrows* what RLS already allows — a
+ * tenant the caller may not see is an empty page, never a 403.
+ *
+ * ## The export answers CSV, and says so
+ *
+ * It takes the same filters and no page: it is the whole of the filter or it is
+ * refused, because a truncated compliance export is indistinguishable from a
+ * complete one. `accept: 'text'` is what lets it come back through the same
+ * transport as everything else — same token, same error mapping — rather than
+ * being fetched around the outside of this library.
+ *
+ * There is no mutating route here and there is not meant to be (Doc 10 §7).
+ */
+import { IAM_ROUTE_PREFIX } from '@plantops/contracts';
+export function auditEndpoints(request) {
+    const base = `${IAM_ROUTE_PREFIX}/audit`;
+    return {
+        list: (query) => request({ method: 'GET', path: base, query: { ...query } }),
+        export: (query) => request({
+            method: 'GET',
+            path: `${base}/export`,
+            query: { ...query },
+            accept: 'text',
+        }),
+    };
+}

package/dist/endpoints/auth.d.ts

@@ -0,0 +1,56 @@
+/**
+ * `/auth/*` — Doc 06 §3.
+ *
+ * The only endpoint module that touches state: a login, a refresh and a service
+ * token all produce credentials, and dropping them into {@link TokenSession} is
+ * the whole reason a consumer never has to think about the `Authorization`
+ * header. Logout does the reverse on both sides of the wire — the server
+ * revokes the session, the client forgets the tokens — and both happen even if
+ * the call fails, because a caller who asked to be logged out is logged out.
+ */
+import type { AccessTokenResponse, LoginRequest, ServiceTokenRequest, SessionDTO, TokenPairResponse } from '@plantops/contracts';
+import type { TokenSession } from '../auth.js';
+import type { Requester } from '../http.js';
+/**
+ * `POST /auth/login`, plus the device label.
+ *
+ * The label is what makes the session list of Doc 06 §3 actionable — "Gate-3
+ * Terminal" rather than a uuid — and the endpoint has always accepted it. It is
+ * absent from `LoginRequest` in `@plantops/contracts`, so it is added here
+ * rather than silently dropped.
+ */
+export interface LoginInput extends LoginRequest {
+    device_label?: string;
+}
+/** `POST /auth/password/reset-request` (Doc 06 §3). */
+export interface PasswordResetRequestInput {
+    email: string;
+    client_slug: string;
+}
+/** `POST /auth/password/reset` (Doc 06 §3). */
+export interface PasswordResetInput {
+    token: string;
+    new_password: string;
+}
+export interface AuthApi {
+    /** Human login. Stores the pair; the client is authenticated when it returns. */
+    login(input: LoginInput): Promise<TokenPairResponse>;
+    /**
+     * Renews explicitly. Shares the single in-flight exchange with the automatic
+     * refresh, so calling it during a burst costs nothing extra.
+     */
+    refresh(): Promise<TokenPairResponse>;
+    /** Service-account client-credentials exchange. No refresh token by design. */
+    serviceToken(input: ServiceTokenRequest): Promise<AccessTokenResponse>;
+    /** Revokes the current session server-side and forgets the tokens locally. */
+    logout(): Promise<void>;
+    /** The caller's own sessions — never anybody else's (Doc 03 §6). */
+    sessions(): Promise<SessionDTO[]>;
+    revokeSession(sessionId: string): Promise<void>;
+    requestPasswordReset(input: PasswordResetRequestInput): Promise<void>;
+    resetPassword(input: PasswordResetInput): Promise<void>;
+}
+export declare function authEndpoints(request: Requester, session: TokenSession, 
+/** Fired whenever the subject behind the tokens may have changed. */
+onIdentityChange: () => void): AuthApi;
+//# sourceMappingURL=auth.d.ts.map

package/dist/endpoints/auth.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../../src/endpoints/auth.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,KAAK,EACV,mBAAmB,EACnB,YAAY,EACZ,mBAAmB,EACnB,UAAU,EACV,iBAAiB,EAClB,MAAM,qBAAqB,CAAC;AAG7B,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAC/C,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAE5C;;;;;;;GAOG;AACH,MAAM,WAAW,UAAW,SAAQ,YAAY;IAC9C,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED,uDAAuD;AACvD,MAAM,WAAW,yBAAyB;IACxC,KAAK,EAAE,MAAM,CAAC;IACd,WAAW,EAAE,MAAM,CAAC;CACrB;AAED,+CAA+C;AAC/C,MAAM,WAAW,kBAAkB;IACjC,KAAK,EAAE,MAAM,CAAC;IACd,YAAY,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,OAAO;IACtB,iFAAiF;IACjF,KAAK,CAAC,KAAK,EAAE,UAAU,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAAC;IACrD;;;OAGG;IACH,OAAO,IAAI,OAAO,CAAC,iBAAiB,CAAC,CAAC;IACtC,+EAA+E;IAC/E,YAAY,CAAC,KAAK,EAAE,mBAAmB,GAAG,OAAO,CAAC,mBAAmB,CAAC,CAAC;IACvE,8EAA8E;IAC9E,MAAM,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IACxB,oEAAoE;IACpE,QAAQ,IAAI,OAAO,CAAC,UAAU,EAAE,CAAC,CAAC;IAClC,aAAa,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAChD,oBAAoB,CAAC,KAAK,EAAE,yBAAyB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACtE,aAAa,CAAC,KAAK,EAAE,kBAAkB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACzD;AAED,wBAAgB,aAAa,CAC3B,OAAO,EAAE,SAAS,EAClB,OAAO,EAAE,YAAY;AACrB,qEAAqE;AACrE,gBAAgB,EAAE,MAAM,IAAI,GAC3B,OAAO,CAgFT"}

package/dist/endpoints/auth.js

@@ -0,0 +1,88 @@
+/**
+ * `/auth/*` — Doc 06 §3.
+ *
+ * The only endpoint module that touches state: a login, a refresh and a service
+ * token all produce credentials, and dropping them into {@link TokenSession} is
+ * the whole reason a consumer never has to think about the `Authorization`
+ * header. Logout does the reverse on both sides of the wire — the server
+ * revokes the session, the client forgets the tokens — and both happen even if
+ * the call fails, because a caller who asked to be logged out is logged out.
+ */
+import { AUTH_ROUTE_PREFIX } from '@plantops/contracts';
+export function authEndpoints(request, session, 
+/** Fired whenever the subject behind the tokens may have changed. */
+onIdentityChange) {
+    return {
+        async login(input) {
+            const pair = await request({
+                method: 'POST',
+                path: `${AUTH_ROUTE_PREFIX}/login`,
+                body: input,
+                auth: 'none',
+            });
+            await session.adopt(pair);
+            onIdentityChange();
+            return pair;
+        },
+        async refresh() {
+            const pair = await session.refresh();
+            onIdentityChange();
+            return pair;
+        },
+        async serviceToken(input) {
+            const token = await request({
+                method: 'POST',
+                path: `${AUTH_ROUTE_PREFIX}/token`,
+                body: input,
+                auth: 'none',
+            });
+            await session.adopt(token);
+            onIdentityChange();
+            return token;
+        },
+        async logout() {
+            try {
+                await request({
+                    method: 'POST',
+                    path: `${AUTH_ROUTE_PREFIX}/logout`,
+                    body: {},
+                });
+            }
+            finally {
+                // Local state is cleared even when the revocation call failed. The
+                // alternative — staying "logged in" because the network was down —
+                // leaves a token in a store the user believes they have emptied.
+                await session.clear();
+                onIdentityChange();
+            }
+        },
+        sessions() {
+            return request({
+                method: 'GET',
+                path: `${AUTH_ROUTE_PREFIX}/sessions`,
+            });
+        },
+        revokeSession(sessionId) {
+            return request({
+                method: 'POST',
+                path: `${AUTH_ROUTE_PREFIX}/sessions/${encodeURIComponent(sessionId)}/revoke`,
+            });
+        },
+        requestPasswordReset(input) {
+            return request({
+                method: 'POST',
+                path: `${AUTH_ROUTE_PREFIX}/password/reset-request`,
+                body: input,
+                auth: 'none',
+            });
+        },
+        resetPassword(input) {
+            return request({
+                method: 'POST',
+                path: `${AUTH_ROUTE_PREFIX}/password/reset`,
+                body: input,
+                auth: 'none',
+            });
+        },
+    };
+}

package/dist/endpoints/authz.d.ts

@@ -0,0 +1,31 @@
+/**
+ * `/iam/permissions/*`, `/iam/introspect`, `/iam/.well-known/jwks.json` — the
+ * resolution endpoints of Doc 06 §11.
+ *
+ * These are the contract every future PlantOps module depends on, and the only
+ * part of this library that is on a hot path. `resolve` here is the *uncached*
+ * call; the cached one a module should actually use is `IamClient.grants()`,
+ * which puts {@link ResolveCache} in front of it.
+ *
+ * `jwks` is deliberately unauthenticated: it is the public half of the signing
+ * key, fetched by anyone verifying a token locally — which Doc 06 §11 says
+ * modules should prefer over `introspect`, so that the IAM stays off the
+ * per-request critical path.
+ */
+import type { IntrospectResponse, JwksResponse, PermissionCheckRequest, PermissionCheckResponse, ResolvedGrants, ResolveQuery } from '@plantops/contracts';
+import type { Requester } from '../http.js';
+export interface PermissionsApi {
+    /**
+     * The bearer's complete grant set, minimized per Doc 04 §4.1. Not paginated —
+     * it is one cacheable unit. `applicationId` narrows it to one app's slice.
+     */
+    resolve(query?: ResolveQuery): Promise<ResolvedGrants>;
+    /** The point check: does this subject hold this permission over this node? */
+    check(body: PermissionCheckRequest): Promise<PermissionCheckResponse>;
+    /** For modules verifying an opaque or edge-case token. */
+    introspect(token: string): Promise<IntrospectResponse>;
+    /** The public keys, for local JWT verification. Needs no bearer token. */
+    jwks(): Promise<JwksResponse>;
+}
+export declare function permissionsEndpoints(request: Requester): PermissionsApi;
+//# sourceMappingURL=authz.d.ts.map

package/dist/endpoints/authz.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"authz.d.ts","sourceRoot":"","sources":["../../src/endpoints/authz.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,KAAK,EACV,kBAAkB,EAClB,YAAY,EACZ,sBAAsB,EACtB,uBAAuB,EACvB,cAAc,EACd,YAAY,EACb,MAAM,qBAAqB,CAAC;AAG7B,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAE5C,MAAM,WAAW,cAAc;IAC7B;;;OAGG;IACH,OAAO,CAAC,KAAK,CAAC,EAAE,YAAY,GAAG,OAAO,CAAC,cAAc,CAAC,CAAC;IACvD,8EAA8E;IAC9E,KAAK,CAAC,IAAI,EAAE,sBAAsB,GAAG,OAAO,CAAC,uBAAuB,CAAC,CAAC;IACtE,0DAA0D;IAC1D,UAAU,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAAC;IACvD,0EAA0E;IAC1E,IAAI,IAAI,OAAO,CAAC,YAAY,CAAC,CAAC;CAC/B;AAED,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,SAAS,GAAG,cAAc,CA2BvE"}

package/dist/endpoints/authz.js

@@ -0,0 +1,39 @@
+/**
+ * `/iam/permissions/*`, `/iam/introspect`, `/iam/.well-known/jwks.json` — the
+ * resolution endpoints of Doc 06 §11.
+ *
+ * These are the contract every future PlantOps module depends on, and the only
+ * part of this library that is on a hot path. `resolve` here is the *uncached*
+ * call; the cached one a module should actually use is `IamClient.grants()`,
+ * which puts {@link ResolveCache} in front of it.
+ *
+ * `jwks` is deliberately unauthenticated: it is the public half of the signing
+ * key, fetched by anyone verifying a token locally — which Doc 06 §11 says
+ * modules should prefer over `introspect`, so that the IAM stays off the
+ * per-request critical path.
+ */
+import { IAM_ROUTE_PREFIX } from '@plantops/contracts';
+export function permissionsEndpoints(request) {
+    return {
+        resolve: (query) => request({
+            method: 'GET',
+            path: `${IAM_ROUTE_PREFIX}/permissions/resolve`,
+            query: { ...query },
+        }),
+        check: (body) => request({
+            method: 'POST',
+            path: `${IAM_ROUTE_PREFIX}/permissions/check`,
+            body,
+        }),
+        introspect: (token) => request({
+            method: 'POST',
+            path: `${IAM_ROUTE_PREFIX}/introspect`,
+            body: { token },
+        }),
+        jwks: () => request({
+            method: 'GET',
+            path: `${IAM_ROUTE_PREFIX}/.well-known/jwks.json`,
+            auth: 'none',
+        }),
+    };
+}

package/dist/endpoints/bindings.d.ts

@@ -0,0 +1,17 @@
+/**
+ * `/iam/role-bindings/*` — where WHO, WHAT and WHERE meet, Doc 06 §9.
+ *
+ * A binding is the only object in the system that grants anything: subject ×
+ * role × scope node, optionally until a date. Everything the resolution engine
+ * answers is a fold over these rows (Doc 04 §4).
+ */
+import type { CreateRoleBindingRequest, Paginated, RoleBindingDTO, RoleBindingsQuery } from '@plantops/contracts';
+import type { Requester } from '../http.js';
+export interface RoleBindingsApi {
+    /** Subject is user XOR service account; the scope node must be the tenant's. */
+    create(body: CreateRoleBindingRequest): Promise<RoleBindingDTO>;
+    list(query?: RoleBindingsQuery): Promise<Paginated<RoleBindingDTO>>;
+    remove(id: string): Promise<void>;
+}
+export declare function roleBindingsEndpoints(request: Requester): RoleBindingsApi;
+//# sourceMappingURL=bindings.d.ts.map

package/dist/endpoints/bindings.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"bindings.d.ts","sourceRoot":"","sources":["../../src/endpoints/bindings.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,KAAK,EACV,wBAAwB,EACxB,SAAS,EACT,cAAc,EACd,iBAAiB,EAClB,MAAM,qBAAqB,CAAC;AAG7B,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAE5C,MAAM,WAAW,eAAe;IAC9B,gFAAgF;IAChF,MAAM,CAAC,IAAI,EAAE,wBAAwB,GAAG,OAAO,CAAC,cAAc,CAAC,CAAC;IAChE,IAAI,CAAC,KAAK,CAAC,EAAE,iBAAiB,GAAG,OAAO,CAAC,SAAS,CAAC,cAAc,CAAC,CAAC,CAAC;IACpE,MAAM,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACnC;AAED,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,SAAS,GAAG,eAAe,CASzE"}

package/dist/endpoints/bindings.js

@@ -0,0 +1,16 @@
+/**
+ * `/iam/role-bindings/*` — where WHO, WHAT and WHERE meet, Doc 06 §9.
+ *
+ * A binding is the only object in the system that grants anything: subject ×
+ * role × scope node, optionally until a date. Everything the resolution engine
+ * answers is a fold over these rows (Doc 04 §4).
+ */
+import { IAM_ROUTE_PREFIX } from '@plantops/contracts';
+export function roleBindingsEndpoints(request) {
+    const base = `${IAM_ROUTE_PREFIX}/role-bindings`;
+    return {
+        create: (body) => request({ method: 'POST', path: base, body }),
+        list: (query) => request({ method: 'GET', path: base, query: { ...query } }),
+        remove: (id) => request({ method: 'DELETE', path: `${base}/${encodeURIComponent(id)}` }),
+    };
+}

package/dist/endpoints/clients.d.ts

@@ -0,0 +1,35 @@
+/**
+ * `/iam/clients/*` — tenant provisioning, Doc 06 §5.
+ *
+ * Platform-admin surface: creating a tenant, enabling applications for it, and
+ * minting the first client-admin who can then do everything else themselves
+ * (Doc 02 §5).
+ */
+import type { BillableSiteRequest, BillableSitesRequest, ClientAdminDTO, ClientApplicationDTO, ClientDTO, CreateClientAdminRequest, CreateClientRequest, EnableApplicationsRequest, Paginated, PaginationQuery, ScopeNodeDTO, UpdateClientApplicationRequest, UpdateClientRequest } from '@plantops/contracts';
+import type { Requester } from '../http.js';
+export interface ClientsApi {
+    create(body: CreateClientRequest): Promise<ClientDTO>;
+    list(query?: PaginationQuery): Promise<Paginated<ClientDTO>>;
+    /** Update, or suspend. */
+    update(id: string, body: UpdateClientRequest): Promise<ClientDTO>;
+    enableApplications(id: string, body: EnableApplicationsRequest): Promise<ClientApplicationDTO[]>;
+    listApplications(id: string): Promise<ClientApplicationDTO[]>;
+    /** The per-tenant on/off switch; disabling drops that app's grants (Doc 02 §7). */
+    updateApplication(id: string, applicationId: string, body: UpdateClientApplicationRequest): Promise<ClientApplicationDTO>;
+    /**
+     * Marks or clears one node as a billable site — the meter of Doc 11 §10.1.
+     * Platform-tier, and never derived from `scope_node.kind`.
+     */
+    setBillableSite(id: string, scopeNodeId: string, body: BillableSiteRequest): Promise<ScopeNodeDTO>;
+    /**
+     * The same meter over many nodes — one call when provisioning a tenant.
+     *
+     * All-or-nothing: a batch breaching `max_sites` is refused entire. Ids
+     * outside this tenant are absent from the result rather than an error.
+     */
+    setBillableSites(id: string, body: BillableSitesRequest): Promise<ScopeNodeDTO[]>;
+    /** The initial client-admin user and its binding, in one call. */
+    createAdmin(id: string, body: CreateClientAdminRequest): Promise<ClientAdminDTO>;
+}
+export declare function clientsEndpoints(request: Requester): ClientsApi;
+//# sourceMappingURL=clients.d.ts.map

package/dist/endpoints/clients.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"clients.d.ts","sourceRoot":"","sources":["../../src/endpoints/clients.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,KAAK,EACV,mBAAmB,EACnB,oBAAoB,EACpB,cAAc,EACd,oBAAoB,EACpB,SAAS,EACT,wBAAwB,EACxB,mBAAmB,EACnB,yBAAyB,EACzB,SAAS,EACT,eAAe,EACf,YAAY,EACZ,8BAA8B,EAC9B,mBAAmB,EACpB,MAAM,qBAAqB,CAAC;AAG7B,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAE5C,MAAM,WAAW,UAAU;IACzB,MAAM,CAAC,IAAI,EAAE,mBAAmB,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC;IACtD,IAAI,CAAC,KAAK,CAAC,EAAE,eAAe,GAAG,OAAO,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC,CAAC;IAC7D,0BAA0B;IAC1B,MAAM,CAAC,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,mBAAmB,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC;IAElE,kBAAkB,CAChB,EAAE,EAAE,MAAM,EACV,IAAI,EAAE,yBAAyB,GAC9B,OAAO,CAAC,oBAAoB,EAAE,CAAC,CAAC;IACnC,gBAAgB,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,oBAAoB,EAAE,CAAC,CAAC;IAC9D,mFAAmF;IACnF,iBAAiB,CACf,EAAE,EAAE,MAAM,EACV,aAAa,EAAE,MAAM,EACrB,IAAI,EAAE,8BAA8B,GACnC,OAAO,CAAC,oBAAoB,CAAC,CAAC;IAEjC;;;OAGG;IACH,eAAe,CACb,EAAE,EAAE,MAAM,EACV,WAAW,EAAE,MAAM,EACnB,IAAI,EAAE,mBAAmB,GACxB,OAAO,CAAC,YAAY,CAAC,CAAC;IACzB;;;;;OAKG;IACH,gBAAgB,CAAC,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,oBAAoB,GAAG,OAAO,CAAC,YAAY,EAAE,CAAC,CAAC;IAElF,kEAAkE;IAClE,WAAW,CAAC,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,wBAAwB,GAAG,OAAO,CAAC,cAAc,CAAC,CAAC;CAClF;AAED,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,SAAS,GAAG,UAAU,CAgC/D"}

package/dist/endpoints/clients.js

@@ -0,0 +1,31 @@
+/**
+ * `/iam/clients/*` — tenant provisioning, Doc 06 §5.
+ *
+ * Platform-admin surface: creating a tenant, enabling applications for it, and
+ * minting the first client-admin who can then do everything else themselves
+ * (Doc 02 §5).
+ */
+import { IAM_ROUTE_PREFIX } from '@plantops/contracts';
+export function clientsEndpoints(request) {
+    const base = `${IAM_ROUTE_PREFIX}/clients`;
+    const at = (id, suffix = '') => `${base}/${encodeURIComponent(id)}${suffix}`;
+    return {
+        create: (body) => request({ method: 'POST', path: base, body }),
+        list: (query) => request({ method: 'GET', path: base, query: { ...query } }),
+        update: (id, body) => request({ method: 'PATCH', path: at(id), body }),
+        setBillableSite: (id, scopeNodeId, body) => request({
+            method: 'PATCH',
+            path: at(id, `/scopes/${encodeURIComponent(scopeNodeId)}/billable-site`),
+            body,
+        }),
+        setBillableSites: (id, body) => request({ method: 'PATCH', path: at(id, '/billable-sites'), body }),
+        enableApplications: (id, body) => request({ method: 'POST', path: at(id, '/applications'), body }),
+        listApplications: (id) => request({ method: 'GET', path: at(id, '/applications') }),
+        updateApplication: (id, applicationId, body) => request({
+            method: 'PATCH',
+            path: at(id, `/applications/${encodeURIComponent(applicationId)}`),
+            body,
+        }),
+        createAdmin: (id, body) => request({ method: 'POST', path: at(id, '/admins'), body }),
+    };
+}

package/dist/endpoints/entitlements.d.ts

@@ -0,0 +1,40 @@
+/**
+ * `/iam/entitlements` and `/iam/licence` — what this tenant is entitled to.
+ *
+ * Both are readable by any authenticated subject of the tenant, so neither
+ * needs a platform credential. They answer different questions and a consumer
+ * usually wants the first:
+ *
+ * - {@link EntitlementsApi.view} is the whole picture — the tenant's term and
+ *   ceilings, live usage counts, and one row per application with its own term.
+ * - {@link EntitlementsApi.licence} is the date alone, which is what a console
+ *   header renders. It predates the other and is kept because it has consumers.
+ *
+ * ## Cache this on a clock, never on the grants counter
+ *
+ * `IamClient.grants()` is cached against a `(client, subject)` version counter
+ * that moves whenever access changes. Entitlement state has no such counter and
+ * cannot have one: **nothing writes at the moment a term expires**. Cache it
+ * against {@link EntitlementsView.as_of} with a bound of your choosing — five
+ * minutes is the documented suggestion — and never against `ResolvedGrants`.
+ *
+ * Getting this wrong does not produce a briefly-stale value. It produces
+ * `expired: false` forever.
+ *
+ * ## Nothing here is enforced by the IAM
+ *
+ * An application past its term still resolves grants and still appears in
+ * navigation. Refusing is the consuming module's job, and Doc 12 states that
+ * obligation normatively. Reading `expired` and doing nothing with it is the
+ * same as not reading it.
+ */
+import type { EntitlementsView, LicenceView } from '@plantops/contracts';
+import type { Requester } from '../http.js';
+export interface EntitlementsApi {
+    /** Term, ceilings, live usage, and one row per application. */
+    view(): Promise<EntitlementsView>;
+    /** The effective term alone — licence file and subscription, whichever is sooner. */
+    licence(): Promise<LicenceView>;
+}
+export declare function entitlementsEndpoints(request: Requester): EntitlementsApi;
+//# sourceMappingURL=entitlements.d.ts.map

package/dist/endpoints/entitlements.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"entitlements.d.ts","sourceRoot":"","sources":["../../src/endpoints/entitlements.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AAEH,OAAO,KAAK,EAAE,gBAAgB,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AAGzE,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAE5C,MAAM,WAAW,eAAe;IAC9B,+DAA+D;IAC/D,IAAI,IAAI,OAAO,CAAC,gBAAgB,CAAC,CAAC;IAClC,qFAAqF;IACrF,OAAO,IAAI,OAAO,CAAC,WAAW,CAAC,CAAC;CACjC;AAED,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,SAAS,GAAG,eAAe,CAazE"}

package/dist/endpoints/entitlements.js

@@ -0,0 +1,43 @@
+/**
+ * `/iam/entitlements` and `/iam/licence` — what this tenant is entitled to.
+ *
+ * Both are readable by any authenticated subject of the tenant, so neither
+ * needs a platform credential. They answer different questions and a consumer
+ * usually wants the first:
+ *
+ * - {@link EntitlementsApi.view} is the whole picture — the tenant's term and
+ *   ceilings, live usage counts, and one row per application with its own term.
+ * - {@link EntitlementsApi.licence} is the date alone, which is what a console
+ *   header renders. It predates the other and is kept because it has consumers.
+ *
+ * ## Cache this on a clock, never on the grants counter
+ *
+ * `IamClient.grants()` is cached against a `(client, subject)` version counter
+ * that moves whenever access changes. Entitlement state has no such counter and
+ * cannot have one: **nothing writes at the moment a term expires**. Cache it
+ * against {@link EntitlementsView.as_of} with a bound of your choosing — five
+ * minutes is the documented suggestion — and never against `ResolvedGrants`.
+ *
+ * Getting this wrong does not produce a briefly-stale value. It produces
+ * `expired: false` forever.
+ *
+ * ## Nothing here is enforced by the IAM
+ *
+ * An application past its term still resolves grants and still appears in
+ * navigation. Refusing is the consuming module's job, and Doc 12 states that
+ * obligation normatively. Reading `expired` and doing nothing with it is the
+ * same as not reading it.
+ */
+import { IAM_ROUTE_PREFIX } from '@plantops/contracts';
+export function entitlementsEndpoints(request) {
+    return {
+        view: () => request({
+            method: 'GET',
+            path: `${IAM_ROUTE_PREFIX}/entitlements`,
+        }),
+        licence: () => request({
+            method: 'GET',
+            path: `${IAM_ROUTE_PREFIX}/licence`,
+        }),
+    };
+}

package/dist/endpoints/index.d.ts

@@ -0,0 +1,22 @@
+/**
+ * The endpoint modules, one per section of Doc 06.
+ *
+ * Each exports an interface and a factory that takes a {@link Requester} and
+ * nothing else. That shape is what keeps `client.ts` from becoming a
+ * thousand-line class, and it is what lets a consumer that wants only one
+ * surface — a migration script that talks to the registry, say — build it
+ * without a token store or a cache.
+ */
+export * from './applications.js';
+export * from './audit.js';
+export * from './auth.js';
+export * from './authz.js';
+export * from './bindings.js';
+export * from './clients.js';
+export * from './entitlements.js';
+export * from './navigation.js';
+export * from './roles.js';
+export * from './scopes.js';
+export * from './service-accounts.js';
+export * from './users.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/endpoints/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/endpoints/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,cAAc,mBAAmB,CAAC;AAClC,cAAc,YAAY,CAAC;AAC3B,cAAc,WAAW,CAAC;AAC1B,cAAc,YAAY,CAAC;AAC3B,cAAc,eAAe,CAAC;AAC9B,cAAc,cAAc,CAAC;AAC7B,cAAc,mBAAmB,CAAC;AAClC,cAAc,iBAAiB,CAAC;AAChC,cAAc,YAAY,CAAC;AAC3B,cAAc,aAAa,CAAC;AAC5B,cAAc,uBAAuB,CAAC;AACtC,cAAc,YAAY,CAAC"}

package/dist/endpoints/index.js

@@ -0,0 +1,21 @@
+/**
+ * The endpoint modules, one per section of Doc 06.
+ *
+ * Each exports an interface and a factory that takes a {@link Requester} and
+ * nothing else. That shape is what keeps `client.ts` from becoming a
+ * thousand-line class, and it is what lets a consumer that wants only one
+ * surface — a migration script that talks to the registry, say — build it
+ * without a token store or a cache.
+ */
+export * from './applications.js';
+export * from './audit.js';
+export * from './auth.js';
+export * from './authz.js';
+export * from './bindings.js';
+export * from './clients.js';
+export * from './entitlements.js';
+export * from './navigation.js';
+export * from './roles.js';
+export * from './scopes.js';
+export * from './service-accounts.js';
+export * from './users.js';

package/dist/endpoints/navigation.d.ts

@@ -0,0 +1,25 @@
+/**
+ * `GET /iam/navigation` — the menu, Doc 06 §11 and Doc 05.
+ *
+ * A pure function of the bearer's grants and the nav catalog: containers with
+ * no visible descendant are pruned, unmapped nodes are hidden unless they opt
+ * in with `is_public`, and disabled applications never appear. Called with no
+ * `applicationId` it returns the cross-application shell — one top-level node
+ * per enabled app.
+ *
+ * Not cached here. The menu changes when the catalog changes as well as when
+ * grants change, and it is fetched once per shell load rather than once per
+ * request, so there is no burst for a cache to absorb — only staleness to
+ * introduce.
+ */
+import type { NavigationResponse } from '@plantops/contracts';
+import type { Requester } from '../http.js';
+/** Doc 05 §5's optional narrowing to one application's menu. */
+export interface NavigationQuery {
+    applicationId?: string;
+}
+export interface NavigationApi {
+    tree(query?: NavigationQuery): Promise<NavigationResponse>;
+}
+export declare function navigationEndpoints(request: Requester): NavigationApi;
+//# sourceMappingURL=navigation.d.ts.map

package/dist/endpoints/navigation.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"navigation.d.ts","sourceRoot":"","sources":["../../src/endpoints/navigation.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,qBAAqB,CAAC;AAG9D,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAE5C,gEAAgE;AAChE,MAAM,WAAW,eAAe;IAC9B,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AAED,MAAM,WAAW,aAAa;IAC5B,IAAI,CAAC,KAAK,CAAC,EAAE,eAAe,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAAC;CAC5D;AAED,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,SAAS,GAAG,aAAa,CASrE"}

package/dist/endpoints/navigation.js

@@ -0,0 +1,24 @@
+/**
+ * `GET /iam/navigation` — the menu, Doc 06 §11 and Doc 05.
+ *
+ * A pure function of the bearer's grants and the nav catalog: containers with
+ * no visible descendant are pruned, unmapped nodes are hidden unless they opt
+ * in with `is_public`, and disabled applications never appear. Called with no
+ * `applicationId` it returns the cross-application shell — one top-level node
+ * per enabled app.
+ *
+ * Not cached here. The menu changes when the catalog changes as well as when
+ * grants change, and it is fetched once per shell load rather than once per
+ * request, so there is no burst for a cache to absorb — only staleness to
+ * introduce.
+ */
+import { IAM_ROUTE_PREFIX } from '@plantops/contracts';
+export function navigationEndpoints(request) {
+    return {
+        tree: (query) => request({
+            method: 'GET',
+            path: `${IAM_ROUTE_PREFIX}/navigation`,
+            query: { ...query },
+        }),
+    };
+}

package/dist/endpoints/roles.d.ts

@@ -0,0 +1,25 @@
+/**
+ * `/iam/roles/*` — the WHAT dimension, Doc 06 §7.
+ *
+ * A role is a bag of permissions drawn from the tenant's *enabled* applications;
+ * `setPermissions` is a PUT because the screen behind it is a checklist, and a
+ * checklist submits a set, not a diff.
+ */
+import type { CreateRoleRequest, Paginated, PaginationQuery, PermissionCatalogResponse, RoleDTO, RolePermissionsResponse, SetRolePermissionsRequest, UpdateRoleRequest } from '@plantops/contracts';
+import type { Requester } from '../http.js';
+export interface RolesApi {
+    create(body: CreateRoleRequest): Promise<RoleDTO>;
+    list(query?: PaginationQuery): Promise<Paginated<RoleDTO>>;
+    update(id: string, body: UpdateRoleRequest): Promise<RoleDTO>;
+    /** Cascades the role's bindings, with an audit record for each (Doc 06 §7). */
+    remove(id: string): Promise<void>;
+    /**
+     * Everything a role of the caller's tenant may be given — the source of
+     * Doc 09 §3.2's picker. Every entry is one `setPermissions` will accept.
+     */
+    permissionCatalog(): Promise<PermissionCatalogResponse>;
+    permissions(id: string): Promise<RolePermissionsResponse>;
+    setPermissions(id: string, body: SetRolePermissionsRequest): Promise<RolePermissionsResponse>;
+}
+export declare function rolesEndpoints(request: Requester): RolesApi;
+//# sourceMappingURL=roles.d.ts.map