@willyim/idp 0.2.0 → 0.3.0

package/README.md

@@ -340,6 +340,28 @@ const { members } = await api.request("get", "/api/v1/apps/{app}/members", {
 })
 ```
 
+### Admin keys
+
+Most management endpoints take a scoped `wim_` key, which is bound to one
+application and carries an explicit permission set. IdP-level work — registering
+an application, listing users across apps — needs superadmin instead, and for
+that there are **admin keys**: `/api/v1/admin-keys` mints a named, optionally
+expiring, revocable credential that holds every permission on every app. Mint
+one per agent, so the audit trail records `adminkey:<id>` rather than an
+anonymous shared secret, and revoke it when that agent is done.
+
+```ts
+const { token } = await api.request("post", "/api/v1/admin-keys", {
+  body: { name: "release-bot", expiresAt: "2026-12-31T00:00:00.000Z" },
+})
+// Shown exactly once. Presented like any other key:
+//   Authorization: Bearer wim_…
+```
+
+The IdP's static `ADMIN_API_TOKEN` still works and still grants superadmin, but
+it is break-glass only: one shared secret, no name, no expiry, and no way to
+revoke it short of a redeploy.
+
 The OIDC endpoints are not in that document and never will be: they are
 standards-defined and discovered at runtime from `.well-known`.
 

package/dist/src/schemas/index.d.ts

@@ -14,6 +14,8 @@ export declare const ApplicationSchema: z.ZodObject<{
     clientId: z.ZodString;
     name: z.ZodNullable<z.ZodString>;
     app: z.ZodNullable<z.ZodString>;
+    allowSignup: z.ZodBoolean;
+    permissions: z.ZodArray<z.ZodString>;
     redirectUris: z.ZodArray<z.ZodString>;
     disabled: z.ZodBoolean;
     createdAt: z.ZodString;
@@ -37,11 +39,44 @@ export declare const ApplicationListSchema: z.ZodObject<{
         clientId: z.ZodString;
         name: z.ZodNullable<z.ZodString>;
         app: z.ZodNullable<z.ZodString>;
+        allowSignup: z.ZodBoolean;
+        permissions: z.ZodArray<z.ZodString>;
         redirectUris: z.ZodArray<z.ZodString>;
         disabled: z.ZodBoolean;
         createdAt: z.ZodString;
     }, z.core.$strip>>;
 }, z.core.$strip>;
+/**
+ * Register an application. Superadmin only — there is no app to scope it to
+ * yet, so no per-app permission could authorize it.
+ */
+export declare const CreateApplicationInput: z.ZodObject<{
+    name: z.ZodString;
+    app: z.ZodString;
+    redirectUris: z.ZodArray<z.ZodString>;
+    firstAdminUserId: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+}, z.core.$strip>;
+export declare const ApplicationCreatedSchema: z.ZodObject<{
+    clientId: z.ZodString;
+    clientSecret: z.ZodString;
+    app: z.ZodString;
+}, z.core.$strip>;
+/** Partial update of an application. Omitted fields are left alone. */
+export declare const UpdateApplicationInput: z.ZodObject<{
+    name: z.ZodOptional<z.ZodString>;
+    redirectUris: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    allowSignup: z.ZodOptional<z.ZodBoolean>;
+}, z.core.$strip>;
+export declare const ClientSecretSchema: z.ZodObject<{
+    clientSecret: z.ZodString;
+}, z.core.$strip>;
+/** Replaces the app's product-permission catalog wholesale. */
+export declare const SetAppPermissionsInput: z.ZodObject<{
+    permissions: z.ZodArray<z.ZodString>;
+}, z.core.$strip>;
+export declare const AppPermissionsSchema: z.ZodObject<{
+    permissions: z.ZodArray<z.ZodString>;
+}, z.core.$strip>;
 export declare const UserListSchema: z.ZodObject<{
     users: z.ZodArray<z.ZodObject<{
         id: z.ZodString;
@@ -204,4 +239,85 @@ export declare const AuditListSchema: z.ZodObject<{
         createdAt: z.ZodString;
     }, z.core.$strip>>;
 }, z.core.$strip>;
+export declare const ApiKeySchema: z.ZodObject<{
+    id: z.ZodString;
+    name: z.ZodString;
+    prefix: z.ZodString;
+    permissions: z.ZodArray<z.ZodString>;
+    status: z.ZodEnum<{
+        active: "active";
+        expired: "expired";
+        revoked: "revoked";
+    }>;
+    createdAt: z.ZodString;
+    lastUsedAt: z.ZodNullable<z.ZodString>;
+    expiresAt: z.ZodNullable<z.ZodString>;
+    revokedAt: z.ZodNullable<z.ZodString>;
+}, z.core.$strip>;
+export declare const ApiKeyListSchema: z.ZodObject<{
+    keys: z.ZodArray<z.ZodObject<{
+        id: z.ZodString;
+        name: z.ZodString;
+        prefix: z.ZodString;
+        permissions: z.ZodArray<z.ZodString>;
+        status: z.ZodEnum<{
+            active: "active";
+            expired: "expired";
+            revoked: "revoked";
+        }>;
+        createdAt: z.ZodString;
+        lastUsedAt: z.ZodNullable<z.ZodString>;
+        expiresAt: z.ZodNullable<z.ZodString>;
+        revokedAt: z.ZodNullable<z.ZodString>;
+    }, z.core.$strip>>;
+}, z.core.$strip>;
+export declare const CreateApiKeyInput: z.ZodObject<{
+    name: z.ZodString;
+    permissions: z.ZodArray<z.ZodString>;
+    expiresAt: z.ZodOptional<z.ZodISODateTime>;
+}, z.core.$strip>;
+export declare const ApiKeyCreatedSchema: z.ZodObject<{
+    id: z.ZodString;
+    token: z.ZodString;
+    prefix: z.ZodString;
+}, z.core.$strip>;
+export declare const AdminKeySchema: z.ZodObject<{
+    id: z.ZodString;
+    name: z.ZodString;
+    prefix: z.ZodString;
+    status: z.ZodEnum<{
+        active: "active";
+        expired: "expired";
+        revoked: "revoked";
+    }>;
+    createdAt: z.ZodString;
+    lastUsedAt: z.ZodNullable<z.ZodString>;
+    expiresAt: z.ZodNullable<z.ZodString>;
+    revokedAt: z.ZodNullable<z.ZodString>;
+}, z.core.$strip>;
+export declare const AdminKeyListSchema: z.ZodObject<{
+    keys: z.ZodArray<z.ZodObject<{
+        id: z.ZodString;
+        name: z.ZodString;
+        prefix: z.ZodString;
+        status: z.ZodEnum<{
+            active: "active";
+            expired: "expired";
+            revoked: "revoked";
+        }>;
+        createdAt: z.ZodString;
+        lastUsedAt: z.ZodNullable<z.ZodString>;
+        expiresAt: z.ZodNullable<z.ZodString>;
+        revokedAt: z.ZodNullable<z.ZodString>;
+    }, z.core.$strip>>;
+}, z.core.$strip>;
+export declare const CreateAdminKeyInput: z.ZodObject<{
+    name: z.ZodString;
+    expiresAt: z.ZodOptional<z.ZodISODateTime>;
+}, z.core.$strip>;
+export declare const AdminKeyCreatedSchema: z.ZodObject<{
+    id: z.ZodString;
+    token: z.ZodString;
+    prefix: z.ZodString;
+}, z.core.$strip>;
 //# sourceMappingURL=index.d.ts.map

package/dist/src/schemas/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/schemas/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AAEvB,eAAO,MAAM,iBAAiB;;;;;;;iBAO5B,CAAA;AAEF,eAAO,MAAM,UAAU;;;;;;iBAMrB,CAAA;AAEF,eAAO,MAAM,eAAe;;;;;;iBAM1B,CAAA;AAEF,eAAO,MAAM,qBAAqB;;;;;;;;;iBAAyD,CAAA;AAC3F,eAAO,MAAM,cAAc;;;;;;;;iBAA2C,CAAA;AACtE,eAAO,MAAM,mBAAmB;;;;;;;;iBAAqD,CAAA;AAIrF,eAAO,MAAM,UAAU;;;EAA8B,CAAA;AAErD,eAAO,MAAM,YAAY;;;;;;;;;iBAMvB,CAAA;AACF,eAAO,MAAM,gBAAgB;;;;;;;;;;;iBAA+C,CAAA;AAE5E,+DAA+D;AAC/D,eAAO,MAAM,iBAAiB;;;;;;;iBAI5B,CAAA;AACF,eAAO,MAAM,kBAAkB;;;;;iBAG7B,CAAA;AAEF,eAAO,MAAM,iBAAiB;;;;;;iBAG5B,CAAA;AAEF,eAAO,MAAM,oBAAoB;;;iBAM/B,CAAA;AACF,eAAO,MAAM,sBAAsB;;;;iBAIjC,CAAA;AAEF,eAAO,MAAM,QAAQ;;iBAAoC,CAAA;AAIzD,eAAO,MAAM,gBAAgB;;;;;;;;;;;;;;;iBAW3B,CAAA;AACF,eAAO,MAAM,oBAAoB;;;;;;;;;;;;;;;;;iBAAgD,CAAA;AAEjF,eAAO,MAAM,qBAAqB;;;;;;iBAMhC,CAAA;AACF,eAAO,MAAM,uBAAuB;;;;iBAIlC,CAAA;AAEF,eAAO,MAAM,uBAAuB;;iBAAyC,CAAA;AAC7E,eAAO,MAAM,0BAA0B;;;;;;;;;;;;;;mBAUrC,CAAA;AAEF,eAAO,MAAM,gBAAgB;;;;;;;;iBAQ3B,CAAA;AACF,eAAO,MAAM,eAAe;;;;;;;;;;iBAAmD,CAAA"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/schemas/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AAEvB,eAAO,MAAM,iBAAiB;;;;;;;;;iBAS5B,CAAA;AAEF,eAAO,MAAM,UAAU;;;;;;iBAMrB,CAAA;AAEF,eAAO,MAAM,eAAe;;;;;;iBAM1B,CAAA;AAEF,eAAO,MAAM,qBAAqB;;;;;;;;;;;iBAAyD,CAAA;AAE3F;;;GAGG;AACH,eAAO,MAAM,sBAAsB;;;;;iBAejC,CAAA;AACF,eAAO,MAAM,wBAAwB;;;;iBAInC,CAAA;AAEF,uEAAuE;AACvE,eAAO,MAAM,sBAAsB;;;;iBAIjC,CAAA;AAEF,eAAO,MAAM,kBAAkB;;iBAE7B,CAAA;AAEF,+DAA+D;AAC/D,eAAO,MAAM,sBAAsB;;iBAEjC,CAAA;AACF,eAAO,MAAM,oBAAoB;;iBAAiD,CAAA;AAClF,eAAO,MAAM,cAAc;;;;;;;;iBAA2C,CAAA;AACtE,eAAO,MAAM,mBAAmB;;;;;;;;iBAAqD,CAAA;AAIrF,eAAO,MAAM,UAAU;;;EAA8B,CAAA;AAErD,eAAO,MAAM,YAAY;;;;;;;;;iBAMvB,CAAA;AACF,eAAO,MAAM,gBAAgB;;;;;;;;;;;iBAA+C,CAAA;AAE5E,+DAA+D;AAC/D,eAAO,MAAM,iBAAiB;;;;;;;iBAI5B,CAAA;AACF,eAAO,MAAM,kBAAkB;;;;;iBAG7B,CAAA;AAEF,eAAO,MAAM,iBAAiB;;;;;;iBAG5B,CAAA;AAEF,eAAO,MAAM,oBAAoB;;;iBAM/B,CAAA;AACF,eAAO,MAAM,sBAAsB;;;;iBAIjC,CAAA;AAEF,eAAO,MAAM,QAAQ;;iBAAoC,CAAA;AAIzD,eAAO,MAAM,gBAAgB;;;;;;;;;;;;;;;iBAW3B,CAAA;AACF,eAAO,MAAM,oBAAoB;;;;;;;;;;;;;;;;;iBAAgD,CAAA;AAEjF,eAAO,MAAM,qBAAqB;;;;;;iBAMhC,CAAA;AACF,eAAO,MAAM,uBAAuB;;;;iBAIlC,CAAA;AAEF,eAAO,MAAM,uBAAuB;;iBAAyC,CAAA;AAC7E,eAAO,MAAM,0BAA0B;;;;;;;;;;;;;;mBAUrC,CAAA;AAEF,eAAO,MAAM,gBAAgB;;;;;;;;iBAQ3B,CAAA;AACF,eAAO,MAAM,eAAe;;;;;;;;;;iBAAmD,CAAA;AAI/E,eAAO,MAAM,YAAY;;;;;;;;;;;;;;iBAUvB,CAAA;AACF,eAAO,MAAM,gBAAgB;;;;;;;;;;;;;;;;iBAA4C,CAAA;AAEzE,eAAO,MAAM,iBAAiB;;;;iBAM5B,CAAA;AACF,eAAO,MAAM,mBAAmB;;;;iBAI9B,CAAA;AAIF,eAAO,MAAM,cAAc;;;;;;;;;;;;;iBASzB,CAAA;AACF,eAAO,MAAM,kBAAkB;;;;;;;;;;;;;;;iBAA8C,CAAA;AAE7E,eAAO,MAAM,mBAAmB;;;iBAG9B,CAAA;AACF,eAAO,MAAM,qBAAqB;;;;iBAIhC,CAAA"}

package/dist/src/schemas/index.js

@@ -14,6 +14,8 @@ export const ApplicationSchema = z.object({
     clientId: z.string(),
     name: z.string().nullable(),
     app: z.string().nullable().describe("Application key; consumer workspace claims are filtered by this"),
+    allowSignup: z.boolean().describe("Whether unknown users may sign themselves up"),
+    permissions: z.array(z.string()).describe("The app's declared product-permission catalog"),
     redirectUris: z.array(z.string()),
     disabled: z.boolean(),
     createdAt: z.string().describe("ISO 8601 timestamp"),
@@ -33,6 +35,43 @@ export const WorkspaceSchema = z.object({
     createdAt: z.string(),
 });
 export const ApplicationListSchema = z.object({ applications: z.array(ApplicationSchema) });
+/**
+ * Register an application. Superadmin only — there is no app to scope it to
+ * yet, so no per-app permission could authorize it.
+ */
+export const CreateApplicationInput = z.object({
+    name: z.string().min(1),
+    app: z
+        .string()
+        .min(1)
+        .regex(/^[a-z0-9][a-z0-9-]*$/, "lowercase letters, numbers and dashes only")
+        .describe("Stable application key — the join key for members, workspaces and keys"),
+    redirectUris: z.array(z.string().min(1)).min(1),
+    firstAdminUserId: z
+        .string()
+        .nullable()
+        .optional()
+        .describe("Who becomes the app's first IdP admin. Defaults to the calling user; null leaves the app with no members (superadmin-managed)."),
+});
+export const ApplicationCreatedSchema = z.object({
+    clientId: z.string(),
+    clientSecret: z.string().describe("Plaintext client secret — shown exactly once, never stored"),
+    app: z.string(),
+});
+/** Partial update of an application. Omitted fields are left alone. */
+export const UpdateApplicationInput = z.object({
+    name: z.string().min(1).optional(),
+    redirectUris: z.array(z.string().min(1)).min(1).optional(),
+    allowSignup: z.boolean().optional(),
+});
+export const ClientSecretSchema = z.object({
+    clientSecret: z.string().describe("Plaintext client secret — shown exactly once, never stored"),
+});
+/** Replaces the app's product-permission catalog wholesale. */
+export const SetAppPermissionsInput = z.object({
+    permissions: z.array(z.string().min(1)),
+});
+export const AppPermissionsSchema = z.object({ permissions: z.array(z.string()) });
 export const UserListSchema = z.object({ users: z.array(UserSchema) });
 export const WorkspaceListSchema = z.object({ workspaces: z.array(WorkspaceSchema) });
 // --- Write management API (scoped-key authenticated, per-app) ---
@@ -120,3 +159,49 @@ export const AuditEntrySchema = z.object({
     createdAt: z.string(),
 });
 export const AuditListSchema = z.object({ entries: z.array(AuditEntrySchema) });
+// --- Scoped management API keys (drive this API for one app) ---
+export const ApiKeySchema = z.object({
+    id: z.string(),
+    name: z.string(),
+    prefix: z.string().describe("Non-secret token prefix (wim_…) for display"),
+    permissions: z.array(z.string()).describe("IdP management permissions this key holds"),
+    status: z.enum(["active", "expired", "revoked"]),
+    createdAt: z.string(),
+    lastUsedAt: z.string().nullable(),
+    expiresAt: z.string().nullable(),
+    revokedAt: z.string().nullable(),
+});
+export const ApiKeyListSchema = z.object({ keys: z.array(ApiKeySchema) });
+export const CreateApiKeyInput = z.object({
+    name: z.string().min(1),
+    permissions: z
+        .array(z.string().min(1))
+        .describe("IdP management permissions; must be a subset of the caller's own on this app"),
+    expiresAt: z.iso.datetime().optional().describe("ISO 8601; omit for non-expiring"),
+});
+export const ApiKeyCreatedSchema = z.object({
+    id: z.string(),
+    token: z.string().describe("Plaintext key — shown exactly once, never stored"),
+    prefix: z.string(),
+});
+// --- IdP-level admin keys (superadmin over every app) ---
+export const AdminKeySchema = z.object({
+    id: z.string(),
+    name: z.string(),
+    prefix: z.string().describe("Non-secret token prefix (wim_…) for display"),
+    status: z.enum(["active", "expired", "revoked"]),
+    createdAt: z.string(),
+    lastUsedAt: z.string().nullable(),
+    expiresAt: z.string().nullable(),
+    revokedAt: z.string().nullable(),
+});
+export const AdminKeyListSchema = z.object({ keys: z.array(AdminKeySchema) });
+export const CreateAdminKeyInput = z.object({
+    name: z.string().min(1).describe("Who holds it — one key per agent, so the audit log reads"),
+    expiresAt: z.iso.datetime().optional().describe("ISO 8601; omit for non-expiring"),
+});
+export const AdminKeyCreatedSchema = z.object({
+    id: z.string(),
+    token: z.string().describe("Plaintext key — shown exactly once, never stored"),
+    prefix: z.string(),
+});

package/dist/src/schemas/openapi.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"openapi.d.ts","sourceRoot":"","sources":["../../../src/schemas/openapi.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAoFH,wBAAgB,oBAAoB,CAAC,KAAK,EAAE;IAAE,OAAO,EAAE,MAAM,CAAA;CAAE;;;;;;;;;;;;;;;;;;;;EA6B9D"}
+{"version":3,"file":"openapi.d.ts","sourceRoot":"","sources":["../../../src/schemas/openapi.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAqFH,wBAAgB,oBAAoB,CAAC,KAAK,EAAE;IAAE,OAAO,EAAE,MAAM,CAAA;CAAE;;;;;;;;;;;;;;;;;;;;EA6B9D"}

package/dist/src/schemas/openapi.js

@@ -16,7 +16,7 @@ import { lookup, operations } from "./operations.js";
  */
 const json = (schema) => z.toJSONSchema(schema);
 const jsonInput = (schema) => z.toJSONSchema(schema, { io: "input" });
-const DESCRIPTION = "Management API for the willy.im identity provider. Authenticate with `Authorization: Bearer <token>`. Two kinds of token: the superadmin `ADMIN_API_TOKEN` (every app) and per-app **scoped API keys** minted in the admin console (one app, a fixed permission set). The cross-app list endpoints below require the superadmin token. Application registration is done in the admin console (better-auth ties client creation to an admin session).";
+const DESCRIPTION = "Management API for the willy.im identity provider. Authenticate with `Authorization: Bearer <token>`. Two kinds of token: the superadmin `ADMIN_API_TOKEN` (every app) and per-app **scoped API keys** minted in the admin console (one app, a fixed permission set). The cross-app endpoints below require the superadmin token.";
 function pathParamNames(path) {
     return [...path.matchAll(/\{([^}]+)\}/g)].map((match) => match[1]);
 }
@@ -74,6 +74,7 @@ function operationObject(method, path, def) {
                     "409": { description: "Conflict (already a member, last admin, slug taken, …)" },
                 }
                 : {}),
+            ...(def.notFound ? { "404": { description: def.notFound } } : {}),
             ...(def.input ? { "422": { description: "Body failed validation" } } : {}),
         },
     };

package/dist/src/schemas/operations.d.ts

@@ -26,6 +26,8 @@ export type OperationDef = {
     query?: readonly QueryParam[];
     /** Path-parameter descriptions, keyed by name. Purely documentation. */
     params?: Readonly<Record<string, string>>;
+    /** Set when the operation addresses a single row that may not exist. */
+    notFound?: string;
     input?: z.ZodType;
     successCode: "200" | "201";
     success: z.ZodType;
@@ -39,12 +41,215 @@ export declare const operations: {
                 clientId: z.ZodString;
                 name: z.ZodNullable<z.ZodString>;
                 app: z.ZodNullable<z.ZodString>;
+                allowSignup: z.ZodBoolean;
+                permissions: z.ZodArray<z.ZodString>;
                 redirectUris: z.ZodArray<z.ZodString>;
                 disabled: z.ZodBoolean;
                 createdAt: z.ZodString;
             }, z.core.$strip>>;
         }, z.core.$strip>;
     };
+    readonly "post /api/v1/applications": {
+        readonly summary: "Register an application (client secret returned once)";
+        readonly description: "Requires the superadmin token. Creating an application is an IdP-level act — there is no app to scope a permission to yet.";
+        readonly input: z.ZodObject<{
+            name: z.ZodString;
+            app: z.ZodString;
+            redirectUris: z.ZodArray<z.ZodString>;
+            firstAdminUserId: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+        }, z.core.$strip>;
+        readonly successCode: "201";
+        readonly success: z.ZodObject<{
+            clientId: z.ZodString;
+            clientSecret: z.ZodString;
+            app: z.ZodString;
+        }, z.core.$strip>;
+    };
+    readonly "get /api/v1/applications/{clientId}": {
+        readonly summary: "Get one application";
+        readonly permission: "app:read";
+        readonly params: {
+            readonly clientId: "OAuth client id of the application.";
+        };
+        readonly notFound: "No application with that client id";
+        readonly successCode: "200";
+        readonly success: z.ZodObject<{
+            clientId: z.ZodString;
+            name: z.ZodNullable<z.ZodString>;
+            app: z.ZodNullable<z.ZodString>;
+            allowSignup: z.ZodBoolean;
+            permissions: z.ZodArray<z.ZodString>;
+            redirectUris: z.ZodArray<z.ZodString>;
+            disabled: z.ZodBoolean;
+            createdAt: z.ZodString;
+        }, z.core.$strip>;
+    };
+    readonly "patch /api/v1/applications/{clientId}": {
+        readonly summary: "Update an application";
+        readonly permission: "app:update";
+        readonly params: {
+            readonly clientId: "OAuth client id of the application.";
+        };
+        readonly notFound: "No application with that client id";
+        readonly input: z.ZodObject<{
+            name: z.ZodOptional<z.ZodString>;
+            redirectUris: z.ZodOptional<z.ZodArray<z.ZodString>>;
+            allowSignup: z.ZodOptional<z.ZodBoolean>;
+        }, z.core.$strip>;
+        readonly successCode: "200";
+        readonly success: z.ZodObject<{
+            clientId: z.ZodString;
+            name: z.ZodNullable<z.ZodString>;
+            app: z.ZodNullable<z.ZodString>;
+            allowSignup: z.ZodBoolean;
+            permissions: z.ZodArray<z.ZodString>;
+            redirectUris: z.ZodArray<z.ZodString>;
+            disabled: z.ZodBoolean;
+            createdAt: z.ZodString;
+        }, z.core.$strip>;
+    };
+    readonly "delete /api/v1/applications/{clientId}": {
+        readonly summary: "Deregister an application";
+        readonly permission: "app:delete";
+        readonly params: {
+            readonly clientId: "OAuth client id of the application.";
+        };
+        readonly notFound: "No application with that client id";
+        readonly successCode: "200";
+        readonly success: z.ZodObject<{
+            ok: z.ZodLiteral<true>;
+        }, z.core.$strip>;
+    };
+    readonly "post /api/v1/applications/{clientId}/rotate-secret": {
+        readonly summary: "Rotate the client secret (returned once; the old one stops working)";
+        readonly permission: "app:update";
+        readonly params: {
+            readonly clientId: "OAuth client id of the application.";
+        };
+        readonly notFound: "No application with that client id";
+        readonly successCode: "200";
+        readonly success: z.ZodObject<{
+            clientSecret: z.ZodString;
+        }, z.core.$strip>;
+    };
+    readonly "put /api/v1/apps/{app}/permissions": {
+        readonly summary: "Replace the app's product-permission catalog";
+        readonly permission: "app:update";
+        readonly params: {
+            readonly app: "Application key (oauth_client.metadata.app).";
+        };
+        readonly notFound: "No application with that app key";
+        readonly input: z.ZodObject<{
+            permissions: z.ZodArray<z.ZodString>;
+        }, z.core.$strip>;
+        readonly successCode: "200";
+        readonly success: z.ZodObject<{
+            permissions: z.ZodArray<z.ZodString>;
+        }, z.core.$strip>;
+    };
+    readonly "get /api/v1/apps/{app}/keys": {
+        readonly summary: "List scoped management API keys (never the hashes)";
+        readonly permission: "apikey:read";
+        readonly params: {
+            readonly app: "Application key (oauth_client.metadata.app).";
+        };
+        readonly successCode: "200";
+        readonly success: z.ZodObject<{
+            keys: z.ZodArray<z.ZodObject<{
+                id: z.ZodString;
+                name: z.ZodString;
+                prefix: z.ZodString;
+                permissions: z.ZodArray<z.ZodString>;
+                status: z.ZodEnum<{
+                    active: "active";
+                    expired: "expired";
+                    revoked: "revoked";
+                }>;
+                createdAt: z.ZodString;
+                lastUsedAt: z.ZodNullable<z.ZodString>;
+                expiresAt: z.ZodNullable<z.ZodString>;
+                revokedAt: z.ZodNullable<z.ZodString>;
+            }, z.core.$strip>>;
+        }, z.core.$strip>;
+    };
+    readonly "post /api/v1/apps/{app}/keys": {
+        readonly summary: "Mint a scoped management API key (plaintext returned once)";
+        readonly description: "Requires `apikey:create` on the path app (or the superadmin token). The requested permissions must be a subset of the caller's own, otherwise 403 `permissions_exceed_caller` — without that rule any key holding `apikey:create` could mint itself a more powerful successor.";
+        readonly permission: "apikey:create";
+        readonly params: {
+            readonly app: "Application key (oauth_client.metadata.app).";
+        };
+        readonly input: z.ZodObject<{
+            name: z.ZodString;
+            permissions: z.ZodArray<z.ZodString>;
+            expiresAt: z.ZodOptional<z.ZodISODateTime>;
+        }, z.core.$strip>;
+        readonly successCode: "201";
+        readonly success: z.ZodObject<{
+            id: z.ZodString;
+            token: z.ZodString;
+            prefix: z.ZodString;
+        }, z.core.$strip>;
+    };
+    readonly "delete /api/v1/apps/{app}/keys/{id}": {
+        readonly summary: "Revoke a scoped management API key (idempotent)";
+        readonly permission: "apikey:revoke";
+        readonly params: {
+            readonly app: "Application key (oauth_client.metadata.app).";
+        };
+        readonly notFound: "No key with that id on this app";
+        readonly successCode: "200";
+        readonly success: z.ZodObject<{
+            ok: z.ZodLiteral<true>;
+        }, z.core.$strip>;
+    };
+    readonly "get /api/v1/admin-keys": {
+        readonly summary: "List IdP-level admin keys (never the hashes)";
+        readonly description: "Requires the superadmin token or an admin key. Admin keys are `api_key` rows with no application scope, so they hold every permission on every app.";
+        readonly successCode: "200";
+        readonly success: z.ZodObject<{
+            keys: z.ZodArray<z.ZodObject<{
+                id: z.ZodString;
+                name: z.ZodString;
+                prefix: z.ZodString;
+                status: z.ZodEnum<{
+                    active: "active";
+                    expired: "expired";
+                    revoked: "revoked";
+                }>;
+                createdAt: z.ZodString;
+                lastUsedAt: z.ZodNullable<z.ZodString>;
+                expiresAt: z.ZodNullable<z.ZodString>;
+                revokedAt: z.ZodNullable<z.ZodString>;
+            }, z.core.$strip>>;
+        }, z.core.$strip>;
+    };
+    readonly "post /api/v1/admin-keys": {
+        readonly summary: "Mint an IdP-level admin key (plaintext returned once)";
+        readonly description: "Requires the superadmin token or an admin key. Mint one per agent: unlike the static ADMIN_API_TOKEN, an admin key has a name, an optional expiry, a revoke switch, and its own `adminkey:<id>` identity in the audit log.";
+        readonly input: z.ZodObject<{
+            name: z.ZodString;
+            expiresAt: z.ZodOptional<z.ZodISODateTime>;
+        }, z.core.$strip>;
+        readonly successCode: "201";
+        readonly success: z.ZodObject<{
+            id: z.ZodString;
+            token: z.ZodString;
+            prefix: z.ZodString;
+        }, z.core.$strip>;
+    };
+    readonly "delete /api/v1/admin-keys/{id}": {
+        readonly summary: "Revoke an IdP-level admin key (idempotent)";
+        readonly description: "A key may revoke itself — an agent cleaning up after itself is legitimate — after which its next request is simply unauthorized.";
+        readonly params: {
+            readonly id: "Admin key id.";
+        };
+        readonly notFound: "No admin key with that id";
+        readonly successCode: "200";
+        readonly success: z.ZodObject<{
+            ok: z.ZodLiteral<true>;
+        }, z.core.$strip>;
+    };
     readonly "get /api/v1/users": {
         readonly summary: "List users";
         readonly successCode: "200";

package/dist/src/schemas/operations.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"operations.d.ts","sourceRoot":"","sources":["../../../src/schemas/operations.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AAqBvB,MAAM,MAAM,UAAU,GAAG,KAAK,GAAG,MAAM,GAAG,OAAO,GAAG,QAAQ,GAAG,KAAK,CAAA;AAEpE,iFAAiF;AACjF,MAAM,MAAM,UAAU,GAAG;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,EAAE,OAAO,CAAA;CAAE,CAAA;AAEnF,MAAM,MAAM,YAAY,GAAG;IACzB,OAAO,EAAE,MAAM,CAAA;IACf;;;OAGG;IACH,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,KAAK,CAAC,EAAE,SAAS,UAAU,EAAE,CAAA;IAC7B,wEAAwE;IACxE,MAAM,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAA;IACzC,KAAK,CAAC,EAAE,CAAC,CAAC,OAAO,CAAA;IACjB,WAAW,EAAE,KAAK,GAAG,KAAK,CAAA;IAC1B,OAAO,EAAE,CAAC,CAAC,OAAO,CAAA;CACnB,CAAA;AAID,eAAO,MAAM,UAAU;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA0G0B,CAAA;AAEjD,MAAM,MAAM,UAAU,GAAG,OAAO,UAAU,CAAA;AAC1C,MAAM,MAAM,YAAY,GAAG,MAAM,UAAU,CAAA;AAE3C,mEAAmE;AACnE,MAAM,MAAM,QAAQ,CAAC,CAAC,SAAS,UAAU,IAAI,YAAY,SAAS,MAAM,CAAC,GACrE,CAAC,SAAS,GAAG,CAAC,IAAI,MAAM,CAAC,EAAE,GACzB,CAAC,GACD,KAAK,GACP,KAAK,CAAA;AAET,MAAM,MAAM,YAAY,CAAC,CAAC,SAAS,UAAU,EAAE,CAAC,SAAS,MAAM,IAAI,GAAG,CAAC,IAAI,CAAC,EAAE,SAAS,YAAY,GAC/F,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,GACvB,KAAK,CAAA;AAET,iFAAiF;AACjF,MAAM,MAAM,cAAc,CAAC,CAAC,SAAS,MAAM,IAAI,CAAC,SAAS,GAAG,MAAM,IAAI,MAAM,IAAI,IAAI,MAAM,IAAI,EAAE,GAC5F,IAAI,GAAG,cAAc,CAAC,IAAI,CAAC,GAC3B,KAAK,CAAA;AAET,wBAAgB,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,YAAY,GAAG,SAAS,CAE7E"}
+{"version":3,"file":"operations.d.ts","sourceRoot":"","sources":["../../../src/schemas/operations.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AAkCvB,MAAM,MAAM,UAAU,GAAG,KAAK,GAAG,MAAM,GAAG,OAAO,GAAG,QAAQ,GAAG,KAAK,CAAA;AAEpE,iFAAiF;AACjF,MAAM,MAAM,UAAU,GAAG;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,EAAE,OAAO,CAAA;CAAE,CAAA;AAEnF,MAAM,MAAM,YAAY,GAAG;IACzB,OAAO,EAAE,MAAM,CAAA;IACf;;;OAGG;IACH,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,KAAK,CAAC,EAAE,SAAS,UAAU,EAAE,CAAA;IAC7B,wEAAwE;IACxE,MAAM,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAA;IACzC,wEAAwE;IACxE,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,KAAK,CAAC,EAAE,CAAC,CAAC,OAAO,CAAA;IACjB,WAAW,EAAE,KAAK,GAAG,KAAK,CAAA;IAC1B,OAAO,EAAE,CAAC,CAAC,OAAO,CAAA;CACnB,CAAA;AAKD,eAAO,MAAM,UAAU;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA6M0B,CAAA;AAEjD,MAAM,MAAM,UAAU,GAAG,OAAO,UAAU,CAAA;AAC1C,MAAM,MAAM,YAAY,GAAG,MAAM,UAAU,CAAA;AAE3C,mEAAmE;AACnE,MAAM,MAAM,QAAQ,CAAC,CAAC,SAAS,UAAU,IAAI,YAAY,SAAS,MAAM,CAAC,GACrE,CAAC,SAAS,GAAG,CAAC,IAAI,MAAM,CAAC,EAAE,GACzB,CAAC,GACD,KAAK,GACP,KAAK,CAAA;AAET,MAAM,MAAM,YAAY,CAAC,CAAC,SAAS,UAAU,EAAE,CAAC,SAAS,MAAM,IAAI,GAAG,CAAC,IAAI,CAAC,EAAE,SAAS,YAAY,GAC/F,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,GACvB,KAAK,CAAA;AAET,iFAAiF;AACjF,MAAM,MAAM,cAAc,CAAC,CAAC,SAAS,MAAM,IAAI,CAAC,SAAS,GAAG,MAAM,IAAI,MAAM,IAAI,IAAI,MAAM,IAAI,EAAE,GAC5F,IAAI,GAAG,cAAc,CAAC,IAAI,CAAC,GAC3B,KAAK,CAAA;AAET,wBAAgB,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,YAAY,GAAG,SAAS,CAE7E"}

package/dist/src/schemas/operations.js

@@ -8,14 +8,109 @@
  * needs to learn about it.
  */
 import { z } from "zod";
-import { ApplicationListSchema, AuditListSchema, CreateUserApiKeyInput, CreateWorkspaceInput, InviteMemberInput, InviteMemberResult, MemberListSchema, OkSchema, UpdateMemberInput, UserApiKeyCreatedSchema, UserApiKeyListSchema, UserApiKeyValidationSchema, UserListSchema, ValidateUserApiKeyInput, WorkspaceCreatedSchema, WorkspaceListSchema, } from "./index.js";
+import { AdminKeyCreatedSchema, AdminKeyListSchema, ApiKeyCreatedSchema, ApiKeyListSchema, ApplicationCreatedSchema, ApplicationListSchema, ApplicationSchema, AppPermissionsSchema, AuditListSchema, ClientSecretSchema, CreateAdminKeyInput, CreateApiKeyInput, CreateApplicationInput, CreateUserApiKeyInput, CreateWorkspaceInput, InviteMemberInput, InviteMemberResult, MemberListSchema, OkSchema, SetAppPermissionsInput, UpdateApplicationInput, UpdateMemberInput, UserApiKeyCreatedSchema, UserApiKeyListSchema, UserApiKeyValidationSchema, UserListSchema, ValidateUserApiKeyInput, WorkspaceCreatedSchema, WorkspaceListSchema, } from "./index.js";
 const APP_PARAM = { app: "Application key (oauth_client.metadata.app)." };
+const CLIENT_PARAM = { clientId: "OAuth client id of the application." };
 export const operations = {
     "get /api/v1/applications": {
         summary: "List registered applications",
         successCode: "200",
         success: ApplicationListSchema,
     },
+    "post /api/v1/applications": {
+        summary: "Register an application (client secret returned once)",
+        description: "Requires the superadmin token. Creating an application is an IdP-level act — there is no app to scope a permission to yet.",
+        input: CreateApplicationInput,
+        successCode: "201",
+        success: ApplicationCreatedSchema,
+    },
+    "get /api/v1/applications/{clientId}": {
+        summary: "Get one application",
+        permission: "app:read",
+        params: CLIENT_PARAM,
+        notFound: "No application with that client id",
+        successCode: "200",
+        success: ApplicationSchema,
+    },
+    "patch /api/v1/applications/{clientId}": {
+        summary: "Update an application",
+        permission: "app:update",
+        params: CLIENT_PARAM,
+        notFound: "No application with that client id",
+        input: UpdateApplicationInput,
+        successCode: "200",
+        success: ApplicationSchema,
+    },
+    "delete /api/v1/applications/{clientId}": {
+        summary: "Deregister an application",
+        permission: "app:delete",
+        params: CLIENT_PARAM,
+        notFound: "No application with that client id",
+        successCode: "200",
+        success: OkSchema,
+    },
+    "post /api/v1/applications/{clientId}/rotate-secret": {
+        summary: "Rotate the client secret (returned once; the old one stops working)",
+        permission: "app:update",
+        params: CLIENT_PARAM,
+        notFound: "No application with that client id",
+        successCode: "200",
+        success: ClientSecretSchema,
+    },
+    "put /api/v1/apps/{app}/permissions": {
+        summary: "Replace the app's product-permission catalog",
+        permission: "app:update",
+        params: APP_PARAM,
+        notFound: "No application with that app key",
+        input: SetAppPermissionsInput,
+        successCode: "200",
+        success: AppPermissionsSchema,
+    },
+    "get /api/v1/apps/{app}/keys": {
+        summary: "List scoped management API keys (never the hashes)",
+        permission: "apikey:read",
+        params: APP_PARAM,
+        successCode: "200",
+        success: ApiKeyListSchema,
+    },
+    "post /api/v1/apps/{app}/keys": {
+        summary: "Mint a scoped management API key (plaintext returned once)",
+        description: "Requires `apikey:create` on the path app (or the superadmin token). The requested permissions must be a subset of the caller's own, otherwise 403 `permissions_exceed_caller` — without that rule any key holding `apikey:create` could mint itself a more powerful successor.",
+        permission: "apikey:create",
+        params: APP_PARAM,
+        input: CreateApiKeyInput,
+        successCode: "201",
+        success: ApiKeyCreatedSchema,
+    },
+    "delete /api/v1/apps/{app}/keys/{id}": {
+        summary: "Revoke a scoped management API key (idempotent)",
+        permission: "apikey:revoke",
+        params: APP_PARAM,
+        notFound: "No key with that id on this app",
+        successCode: "200",
+        success: OkSchema,
+    },
+    "get /api/v1/admin-keys": {
+        summary: "List IdP-level admin keys (never the hashes)",
+        description: "Requires the superadmin token or an admin key. Admin keys are `api_key` rows with no application scope, so they hold every permission on every app.",
+        successCode: "200",
+        success: AdminKeyListSchema,
+    },
+    "post /api/v1/admin-keys": {
+        summary: "Mint an IdP-level admin key (plaintext returned once)",
+        description: "Requires the superadmin token or an admin key. Mint one per agent: unlike the static ADMIN_API_TOKEN, an admin key has a name, an optional expiry, a revoke switch, and its own `adminkey:<id>` identity in the audit log.",
+        input: CreateAdminKeyInput,
+        successCode: "201",
+        success: AdminKeyCreatedSchema,
+    },
+    "delete /api/v1/admin-keys/{id}": {
+        summary: "Revoke an IdP-level admin key (idempotent)",
+        description: "A key may revoke itself — an agent cleaning up after itself is legitimate — after which its next request is simply unauthorized.",
+        params: { id: "Admin key id." },
+        notFound: "No admin key with that id",
+        successCode: "200",
+        success: OkSchema,
+    },
     "get /api/v1/users": {
         summary: "List users",
         successCode: "200",