@signstack/cli 0.1.1

package/dist/libs/signstack/base/src/lib/models/asset.d.ts

@@ -0,0 +1,101 @@
+import { ActorRef, AssetType, ListResp, ResourceListItemBase, ResourceMetadata, VersionType } from './base';
+export interface AssetResource {
+    metadata: ResourceMetadata;
+    spec: AssetSpec;
+}
+export interface AssetSpec {
+    type: AssetType;
+    fileId?: string;
+    content?: string;
+    htmlConfig?: AssetHtmlConfigRefs;
+}
+export interface AssetHtmlConfigData {
+    schemaKey?: string;
+    schemaVersion?: string;
+}
+export interface AssetHtmlConfigRefs {
+    partials?: {
+        key: string;
+        version: string;
+        alias: string;
+        roleMap?: Record<string, string>;
+    }[];
+    images?: {
+        key: string;
+        version: string;
+        alias: string;
+    }[];
+    styles?: {
+        key: string;
+        version: string;
+    }[];
+    data?: AssetHtmlConfigData;
+    pdfSettings?: PdfSettings;
+}
+export interface PdfSettings {
+    paperSize?: PaperSize;
+}
+export declare enum PaperSize {
+    Letter = "Letter",
+    Legal = "Legal",
+    A4 = "A4",
+    A3 = "A3"
+}
+export interface AssetFormData {
+    type: AssetType;
+    content?: string;
+}
+export interface ListAssetsReq {
+    offset?: number;
+    limit?: number;
+    type?: AssetType;
+    skipDraft?: boolean;
+    search?: string;
+    labels?: Record<string, string>;
+}
+export type ListAssetsResp = ListResp<AssetListItem>;
+export type ListAssetVersionsResp = ListResp<AssetListItem>;
+export interface AssetListItem extends ResourceListItemBase {
+    spec: {
+        type: AssetType;
+    };
+}
+/**
+ * Full asset — returned by `GET /assets/{key}`, `POST /assets`,
+ * `PUT .../versions/draft`, and `POST .../versions/draft/publish`. The
+ * optimistic-locking handle is returned in the HTTP `ETag` response header
+ * (RFC 7232) — pass it back as `If-Match` on the next `PUT` / `DELETE`.
+ */
+export interface AssetResp extends AssetResource {
+    createdAt: Date;
+    updatedAt: Date;
+    createdBy: ActorRef;
+    publishedAt?: Date;
+    publishedBy?: ActorRef;
+    contentHash?: string;
+}
+export interface BatchGetAssetsReq {
+    identifiers: {
+        key: string;
+        version?: string;
+    }[];
+}
+export interface BatchGetAssetItem extends AssetResp {
+    _eTag?: string;
+}
+export interface BatchGetAssetsResp {
+    data: BatchGetAssetItem[];
+}
+export interface CreateAssetReq {
+    apiVersion?: string;
+    metadata: ResourceMetadata;
+    spec: AssetSpec;
+}
+export interface UpdateAssetReq {
+    metadata: ResourceMetadata;
+    spec: AssetSpec;
+}
+export interface PublishAssetReq {
+    versionType?: VersionType;
+    version?: string;
+}

package/dist/libs/signstack/base/src/lib/models/asset.js

@@ -0,0 +1,11 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.PaperSize = void 0;
+var PaperSize;
+(function (PaperSize) {
+    PaperSize["Letter"] = "Letter";
+    PaperSize["Legal"] = "Legal";
+    PaperSize["A4"] = "A4";
+    PaperSize["A3"] = "A3";
+})(PaperSize || (exports.PaperSize = PaperSize = {}));
+//# sourceMappingURL=asset.js.map

package/dist/libs/signstack/base/src/lib/models/asset.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"asset.js","sourceRoot":"","sources":["../../../../../../../../../libs/signstack/base/src/lib/models/asset.ts"],"names":[],"mappings":";;;AAsCA,IAAY,SAKX;AALD,WAAY,SAAS;IACnB,8BAAiB,CAAA;IACjB,4BAAe,CAAA;IACf,sBAAS,CAAA;IACT,sBAAS,CAAA;AACX,CAAC,EALW,SAAS,yBAAT,SAAS,QAKpB"}

package/dist/libs/signstack/base/src/lib/models/auth.d.ts

@@ -0,0 +1,142 @@
+import { ScopeLevel } from './api-key';
+import { NamespaceRole } from './membership';
+import { NamespaceMode } from './namespace';
+export declare enum GrantType {
+    ApiKey = "api_key",
+    Firebase = "firebase"
+}
+export { NamespaceMode } from './namespace';
+export type TokenExchangeRequest = ApiKeyExchangeRequest | FirebaseExchangeRequest;
+export interface ApiKeyExchangeRequest {
+    grantType: GrantType.ApiKey;
+    apiKey: string;
+}
+export interface FirebaseExchangeRequest {
+    grantType: GrantType.Firebase;
+    idToken: string;
+    orgId?: string;
+    namespaceKey?: string;
+}
+export declare enum SubjectType {
+    User = "user",
+    ServiceAccount = "service_account",
+    Embed = "embed"
+}
+export interface Subject {
+    type: SubjectType;
+    id: string;
+    orgId?: string;
+    namespaceKey?: string;
+    mode?: NamespaceMode;
+    scopeLevel?: ScopeLevel;
+}
+export type TokenExchangeResponse = ApiKeyTokenResponse | FirebaseTokenResponse;
+interface BaseTokenResponse {
+    accessToken: string;
+    tokenType: 'Bearer';
+    expiresIn: number;
+    expiresAt: string;
+    scopes: string[];
+}
+export interface ApiKeyTokenResponse extends BaseTokenResponse {
+    subject: Subject & {
+        type: SubjectType.ServiceAccount;
+    };
+}
+export interface FirebaseTokenResponse extends BaseTokenResponse {
+    refreshToken: string;
+    subject: Subject & {
+        type: SubjectType.User;
+    } & {
+        email: string;
+        firstName: string;
+        lastName: string;
+    };
+}
+/** JWT Payload structure - used by all token types (Firebase, API Key, Embed) */
+export interface JWTPayload {
+    sub: string;
+    org_id: string;
+    exp?: number;
+    iat?: number;
+    namespace_key?: string;
+    mode?: NamespaceMode;
+    scope_level?: ScopeLevel;
+    scopes: string[];
+    org_roles?: string[];
+    /**
+     * Namespace roles the caller holds on the bound namespace (`namespace_key`).
+     * Populated only on namespace-tier tokens; omitted on org-tier tokens.
+     * Combined with `org_roles` + `namespace_key` this is the full unified-
+     * membership claim — `auth.guard` reassembles `OrgAccessClaim` from these
+     * fields for the request context.
+     */
+    namespace_roles?: NamespaceRole[];
+    embed_type?: EmbedIntent;
+    workflow_id?: string;
+    resource_kind?: string;
+    resource_key?: string;
+    resource_version?: string;
+    step_key?: string;
+    allowed_origins?: string[];
+}
+export declare enum EmbedIntent {
+    /** Participant signing session (powers `<signstack-participant>`). */
+    Participant = "participant",
+    /** Workflow editor + monitor in a single intent (powers `<signstack-workflow>`).
+     *  The token's granted scopes (capability) combined with the workflow's live
+     *  status (fetched by the component on mount) decide which view to render
+     *  and whether to expose operator actions. */
+    Workflow = "workflow",
+    /** Resource (blueprint/template/etc.) editor (powers `<signstack-builder>`). */
+    Builder = "builder"
+}
+export interface EmbedContext {
+    recipientEmail: string;
+    recipientName?: string;
+    metadata?: Record<string, any>;
+}
+export interface BaseEmbedRequest {
+    workflowId?: string;
+    expiresIn?: number;
+    allowedOrigins: string[];
+    context?: EmbedContext;
+    intent?: EmbedIntent;
+}
+export interface ParticipantEmbedRequest extends BaseEmbedRequest {
+    intent: EmbedIntent.Participant;
+    workflowId: string;
+    stepKey: string;
+}
+export interface WorkflowEmbedRequest extends BaseEmbedRequest {
+    intent: EmbedIntent.Workflow;
+    workflowId: string;
+}
+export interface BuilderEmbedRequest extends BaseEmbedRequest {
+    intent: EmbedIntent.Builder;
+    resourceKind: string;
+    resourceKey: string;
+    resourceVersion?: string;
+}
+export interface EmbedResource {
+    type: ResourceType;
+    id: string;
+    steps?: string[];
+    actions: string[];
+}
+export declare enum ResourceType {
+    Workflow = "workflow",
+    Blueprint = "blueprint"
+}
+export interface EmbedTokenResponse {
+    accessToken: string;
+    orgId: string;
+    tokenType: 'Bearer';
+    expiresIn: number;
+    expiresAt: string;
+    scopes: string[];
+    subject: Subject & {
+        type: SubjectType.Embed;
+    };
+    resources: EmbedResource[];
+}

package/dist/libs/signstack/base/src/lib/models/auth.js

@@ -0,0 +1,35 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ResourceType = exports.EmbedIntent = exports.SubjectType = exports.NamespaceMode = exports.GrantType = void 0;
+var GrantType;
+(function (GrantType) {
+    GrantType["ApiKey"] = "api_key";
+    GrantType["Firebase"] = "firebase";
+})(GrantType || (exports.GrantType = GrantType = {}));
+// Re-export NamespaceMode from namespace.ts for convenience
+var namespace_1 = require("./namespace");
+Object.defineProperty(exports, "NamespaceMode", { enumerable: true, get: function () { return namespace_1.NamespaceMode; } });
+var SubjectType;
+(function (SubjectType) {
+    SubjectType["User"] = "user";
+    SubjectType["ServiceAccount"] = "service_account";
+    SubjectType["Embed"] = "embed";
+})(SubjectType || (exports.SubjectType = SubjectType = {}));
+var EmbedIntent;
+(function (EmbedIntent) {
+    /** Participant signing session (powers `<signstack-participant>`). */
+    EmbedIntent["Participant"] = "participant";
+    /** Workflow editor + monitor in a single intent (powers `<signstack-workflow>`).
+     *  The token's granted scopes (capability) combined with the workflow's live
+     *  status (fetched by the component on mount) decide which view to render
+     *  and whether to expose operator actions. */
+    EmbedIntent["Workflow"] = "workflow";
+    /** Resource (blueprint/template/etc.) editor (powers `<signstack-builder>`). */
+    EmbedIntent["Builder"] = "builder";
+})(EmbedIntent || (exports.EmbedIntent = EmbedIntent = {}));
+var ResourceType;
+(function (ResourceType) {
+    ResourceType["Workflow"] = "workflow";
+    ResourceType["Blueprint"] = "blueprint";
+})(ResourceType || (exports.ResourceType = ResourceType = {}));
+//# sourceMappingURL=auth.js.map

package/dist/libs/signstack/base/src/lib/models/auth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.js","sourceRoot":"","sources":["../../../../../../../../../libs/signstack/base/src/lib/models/auth.ts"],"names":[],"mappings":";;;AAIA,IAAY,SAGX;AAHD,WAAY,SAAS;IACnB,+BAAkB,CAAA;IAClB,kCAAqB,CAAA;AACvB,CAAC,EAHW,SAAS,yBAAT,SAAS,QAGpB;AAED,4DAA4D;AAC5D,yCAA4C;AAAnC,0GAAA,aAAa,OAAA;AAmBtB,IAAY,WAIX;AAJD,WAAY,WAAW;IACrB,4BAAa,CAAA;IACb,iDAAkC,CAAA;IAClC,8BAAe,CAAA;AACjB,CAAC,EAJW,WAAW,2BAAX,WAAW,QAItB;AA2ED,IAAY,WAUX;AAVD,WAAY,WAAW;IACrB,sEAAsE;IACtE,0CAA2B,CAAA;IAC3B;;;kDAG8C;IAC9C,oCAAqB,CAAA;IACrB,gFAAgF;IAChF,kCAAmB,CAAA;AACrB,CAAC,EAVW,WAAW,2BAAX,WAAW,QAUtB;AAyCD,IAAY,YAGX;AAHD,WAAY,YAAY;IACtB,qCAAqB,CAAA;IACrB,uCAAuB,CAAA;AACzB,CAAC,EAHW,YAAY,4BAAZ,YAAY,QAGvB"}

package/dist/libs/signstack/base/src/lib/models/base.d.ts

@@ -0,0 +1,134 @@
+import * as bunyan from 'bunyan';
+import { EmbedIntent } from './auth';
+import { OrgAccessClaim } from './membership';
+import { NamespaceMode } from './namespace';
+import { ScopeLevel } from './api-key';
+export declare const DRAFT_VERSION = "draft";
+export declare const INITIAL_VERSION = "1.0.0";
+export declare enum AssetType {
+    Html = "html",// Layout, Headers, Footers
+    Image = "image",// Logos, Stamps
+    Pdf = "pdf",
+    Css = "css"
+}
+export declare const BASE_TEST = "Signstack";
+export declare enum MLS {
+    Nwmls = "Nwmls"
+}
+export declare enum LiteralOrExpressionKind {
+    Literal = "literal",
+    Expression = "expression"
+}
+export interface Expression {
+    expression: string;
+}
+export type LiteralOrExpression<T extends string | number | boolean | Date> = T | Expression;
+export declare class SSContext {
+    subject?: string;
+    traceId: string;
+    logger: bunyan;
+    requestHost?: string;
+    orgId?: string;
+    scopes?: string[];
+    namespaceKey?: string;
+    mode?: NamespaceMode;
+    scopeLevel?: ScopeLevel;
+    /**
+     * Unified-membership claim assembled by the auth guard from the JWT's
+     * flat `org_id` / `org_roles` / `namespace_key` / `namespace_roles`
+     * fields. Absent on non-User actors and on tokens without an org claim.
+     * `ScopesGuard` reads this on the hot path to skip the Mongo round-trip.
+     */
+    orgAccess?: OrgAccessClaim;
+    clientIp?: string;
+    userAgent?: string;
+    embedType?: EmbedIntent;
+    workflowId?: string;
+    stepId?: string;
+    allowedOrigins?: string[];
+    actor?: ActorRef;
+    ifMatch?: number;
+}
+export interface ListOrganizationsReq {
+    firebaseToken: string;
+}
+export interface PaginationDto {
+    total: number;
+    offset: number;
+    limit: number;
+}
+/**
+ * Standard response wrapper for list operations
+ * Provides consistent structure: { data, pagination }
+ */
+export interface ListResp<T> {
+    data: T[];
+    pagination: PaginationDto;
+}
+export declare enum GenerateJsonataExpressionMode {
+    VALUE_EXPRESSION = "value_expression",
+    INCLUDE_IF = "include_if"
+}
+export interface GenerateJsonataExpressionReq {
+    mode: GenerateJsonataExpressionMode;
+    prompt: string;
+    inputs: {
+        entityKey: string;
+        schemaKey: string;
+    }[];
+}
+export interface GenerateJsonataExpressionResp {
+    expression: string;
+}
+export interface WebComponentConfig {
+    embedToken: string;
+}
+export interface UploadFile {
+    fileContent: Blob;
+    type: string;
+    fileName: string;
+    originalFileName?: string;
+}
+/**
+ * Identity fields shared by every resource type — `key` plus human-facing
+ * descriptors. Versioned resources extend this with `version` (see
+ * `ResourceMetadata`); non-versioned resources (scenarios) use this shape
+ * directly as their metadata.
+ */
+export interface ResourceIdentity {
+    key: string;
+    name: string;
+    description?: string;
+    labels?: Record<string, string>;
+}
+export interface ResourceMetadata extends ResourceIdentity {
+    version: string;
+}
+export declare enum ActorType {
+    User = "user",
+    ApiKey = "api_key"
+}
+export interface ActorRef {
+    type: ActorType;
+    id: string;
+}
+export interface ResourceListItemBase {
+    metadata: ResourceMetadata;
+    createdAt: Date;
+    updatedAt: Date;
+    createdBy: ActorRef;
+    publishedAt?: Date;
+    publishedBy?: ActorRef;
+    contentHash?: string;
+    /**
+     * Per-item entity tag for optimistic concurrency control. List responses
+     * carry it in the body since the HTTP `ETag` header can only express a
+     * single value per response. For single-object GETs, use the `ETag` header.
+     */
+    _eTag?: string;
+}
+export declare enum VersionType {
+    Patch = "patch",
+    Minor = "minor",
+    Major = "major"
+}

package/dist/libs/signstack/base/src/lib/models/base.js

@@ -0,0 +1,71 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.VersionType = exports.ActorType = exports.GenerateJsonataExpressionMode = exports.SSContext = exports.LiteralOrExpressionKind = exports.MLS = exports.BASE_TEST = exports.AssetType = exports.INITIAL_VERSION = exports.DRAFT_VERSION = void 0;
+exports.DRAFT_VERSION = 'draft';
+exports.INITIAL_VERSION = '1.0.0';
+var AssetType;
+(function (AssetType) {
+    AssetType["Html"] = "html";
+    AssetType["Image"] = "image";
+    AssetType["Pdf"] = "pdf";
+    AssetType["Css"] = "css";
+})(AssetType || (exports.AssetType = AssetType = {}));
+exports.BASE_TEST = 'Signstack';
+var MLS;
+(function (MLS) {
+    MLS["Nwmls"] = "Nwmls";
+})(MLS || (exports.MLS = MLS = {}));
+var LiteralOrExpressionKind;
+(function (LiteralOrExpressionKind) {
+    LiteralOrExpressionKind["Literal"] = "literal";
+    LiteralOrExpressionKind["Expression"] = "expression";
+})(LiteralOrExpressionKind || (exports.LiteralOrExpressionKind = LiteralOrExpressionKind = {}));
+class SSContext {
+    subject;
+    traceId;
+    logger;
+    requestHost;
+    orgId; // Organization UUID (primary identifier for queries)
+    scopes;
+    // Namespace fields
+    namespaceKey; // Namespace key (unique within org)
+    mode; // Namespace mode (test or live)
+    scopeLevel;
+    /**
+     * Unified-membership claim assembled by the auth guard from the JWT's
+     * flat `org_id` / `org_roles` / `namespace_key` / `namespace_roles`
+     * fields. Absent on non-User actors and on tokens without an org claim.
+     * `ScopesGuard` reads this on the hot path to skip the Mongo round-trip.
+     */
+    orgAccess;
+    // Client info for audit trail (ESIGN/UETA compliance)
+    clientIp;
+    userAgent;
+    // Embed token specific fields (only present if token is an embed token)
+    embedType;
+    workflowId; // For embed tokens: the workflow being accessed
+    stepId; // For document-signing embed tokens: the participant step being signed
+    allowedOrigins;
+    // Structured actor identity (set by auth guard)
+    actor;
+    // Used to handled concurrent update calls
+    ifMatch;
+}
+exports.SSContext = SSContext;
+var GenerateJsonataExpressionMode;
+(function (GenerateJsonataExpressionMode) {
+    GenerateJsonataExpressionMode["VALUE_EXPRESSION"] = "value_expression";
+    GenerateJsonataExpressionMode["INCLUDE_IF"] = "include_if";
+})(GenerateJsonataExpressionMode || (exports.GenerateJsonataExpressionMode = GenerateJsonataExpressionMode = {}));
+var ActorType;
+(function (ActorType) {
+    ActorType["User"] = "user";
+    ActorType["ApiKey"] = "api_key";
+})(ActorType || (exports.ActorType = ActorType = {}));
+var VersionType;
+(function (VersionType) {
+    VersionType["Patch"] = "patch";
+    VersionType["Minor"] = "minor";
+    VersionType["Major"] = "major";
+})(VersionType || (exports.VersionType = VersionType = {}));
+//# sourceMappingURL=base.js.map

package/dist/libs/signstack/base/src/lib/models/base.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"base.js","sourceRoot":"","sources":["../../../../../../../../../libs/signstack/base/src/lib/models/base.ts"],"names":[],"mappings":";;;AAMa,QAAA,aAAa,GAAG,OAAO,CAAC;AACxB,QAAA,eAAe,GAAG,OAAO,CAAC;AAEvC,IAAY,SAKX;AALD,WAAY,SAAS;IACnB,0BAAa,CAAA;IACb,4BAAe,CAAA;IACf,wBAAW,CAAA;IACX,wBAAW,CAAA;AACb,CAAC,EALW,SAAS,yBAAT,SAAS,QAKpB;AAEY,QAAA,SAAS,GAAG,WAAW,CAAC;AACrC,IAAY,GAEX;AAFD,WAAY,GAAG;IACb,sBAAe,CAAA;AACjB,CAAC,EAFW,GAAG,mBAAH,GAAG,QAEd;AAED,IAAY,uBAGX;AAHD,WAAY,uBAAuB;IACjC,8CAAmB,CAAA;IACnB,oDAAyB,CAAA;AAC3B,CAAC,EAHW,uBAAuB,uCAAvB,uBAAuB,QAGlC;AAUD,MAAa,SAAS;IACpB,OAAO,CAAU;IACjB,OAAO,CAAU;IACjB,MAAM,CAAU;IAChB,WAAW,CAAU;IACrB,KAAK,CAAU,CAAC,qDAAqD;IACrE,MAAM,CAAY;IAElB,mBAAmB;IACnB,YAAY,CAAU,CAAC,oCAAoC;IAC3D,IAAI,CAAiB,CAAC,gCAAgC;IAEtD,UAAU,CAAc;IAExB;;;;;OAKG;IACH,SAAS,CAAkB;IAE3B,sDAAsD;IACtD,QAAQ,CAAU;IAClB,SAAS,CAAU;IAEnB,wEAAwE;IACxE,SAAS,CAAe;IACxB,UAAU,CAAU,CAAC,gDAAgD;IACrE,MAAM,CAAU,CAAC,uEAAuE;IACxF,cAAc,CAAY;IAE1B,gDAAgD;IAChD,KAAK,CAAY;IAEjB,0CAA0C;IAC1C,OAAO,CAAU;CAClB;AArCD,8BAqCC;AAqBD,IAAY,6BAGX;AAHD,WAAY,6BAA6B;IACvC,sEAAqC,CAAA;IACrC,0DAAyB,CAAA;AAC3B,CAAC,EAHW,6BAA6B,6CAA7B,6BAA6B,QAGxC;AA2CD,IAAY,SAGX;AAHD,WAAY,SAAS;IACnB,0BAAa,CAAA;IACb,+BAAkB,CAAA;AACpB,CAAC,EAHW,SAAS,yBAAT,SAAS,QAGpB;AAuBD,IAAY,WAIX;AAJD,WAAY,WAAW;IACrB,8BAAe,CAAA;IACf,8BAAe,CAAA;IACf,8BAAe,CAAA;AACjB,CAAC,EAJW,WAAW,2BAAX,WAAW,QAItB"}