@witnium-tech/witniumchain 0.5.0 → 0.6.0

package/dist/index.d.ts

@@ -915,6 +915,139 @@ interface paths$1 {
         patch?: never;
         trace?: never;
     };
+    "/v1/orgs": {
+        parameters: {
+            query?: never;
+            header?: never;
+            path?: never;
+            cookie?: never;
+        };
+        get?: never;
+        put?: never;
+        /**
+         * Create an organisation with client-generated keys
+         * @description Phase RBAC Thread D — explicit org creation. The caller generates the owner key and the initial signing key client-side; Witnium never holds the private bytes. The response includes the freshly-deployed contract address and a one-time email-verify token.
+         */
+        post: {
+            parameters: {
+                query?: never;
+                header?: never;
+                path?: never;
+                cookie?: never;
+            };
+            requestBody?: {
+                content: {
+                    "application/json": {
+                        /** @description Display name of the organisation. */
+                        orgName: string;
+                        /**
+                         * Format: email
+                         * @description Email of the founding org-admin. Receives the email-verify link.
+                         * @example user@example.com
+                         */
+                        adminEmail: string;
+                        /** @description Password for the founding org-admin. argon2id-hashed server-side. Minimum 12 chars; callers are expected to gate via a strength meter. */
+                        adminPassword: string;
+                        /**
+                         * @description Client-generated Ed25519 public key that controls signing-key add/revoke on the new contract. Witnium never sees the private bytes (non-custodial).
+                         * @example 4cdde7a3e3a1d8a48d2b9eaf2bcbe2db1d57d3e1a8d6c20e0a86c0f9c4b6cf2e
+                         */
+                        ownerPublicKey: string;
+                        /**
+                         * @description First signing key registered on the contract. Often the same identity as the org-admin's browser-held key (Mode 1) but may also be the public half of a separately-registered Vault-Transit delegated key (Mode 3).
+                         * @example 4cdde7a3e3a1d8a48d2b9eaf2bcbe2db1d57d3e1a8d6c20e0a86c0f9c4b6cf2e
+                         */
+                        initialSigningPublicKey: string;
+                        /** @description Captcha proof. Not yet wired (no captcha provider configured); reserved for when one is added. Public endpoint without it relies on downstream billing/credit-ledger gates against abuse. */
+                        captchaToken?: string;
+                    };
+                };
+            };
+            responses: {
+                /** @description Success */
+                200: {
+                    headers: {
+                        [name: string]: unknown;
+                    };
+                    content: {
+                        "application/json": {
+                            /**
+                             * @description UUID v4
+                             * @example 550e8400-e29b-41d4-a716-446655440000
+                             */
+                            orgId: string;
+                            /**
+                             * @description UUID v4
+                             * @example 550e8400-e29b-41d4-a716-446655440000
+                             */
+                            userId: string;
+                            /** @description Address of the freshly-deployed contract. */
+                            contractAddress: string;
+                            /** @description Semantic on-chain Solidity version (e.g. "5.0.0"). */
+                            contractVersion: string;
+                            /** @description Email-verify token. Already sent to adminEmail; echoed here for flows that prefer to surface a "click this link" in their own UI. */
+                            emailVerifyToken: string;
+                        };
+                    };
+                };
+                /** @description Bad Request — validation failed */
+                400: {
+                    headers: {
+                        [name: string]: unknown;
+                    };
+                    content: {
+                        "application/json": {
+                            /**
+                             * @description HTTP status code
+                             * @example 400
+                             */
+                            statusCode?: number;
+                            /**
+                             * @description Short error label
+                             * @example Bad Request
+                             */
+                            error?: string;
+                            /**
+                             * @description Human-readable error message. Validation errors from `ZodError.flatten()` may be returned as an array.
+                             * @example Validation failed
+                             */
+                            message: string | string[];
+                        };
+                    };
+                };
+                /** @description Conflict */
+                409: {
+                    headers: {
+                        [name: string]: unknown;
+                    };
+                    content: {
+                        "application/json": {
+                            /**
+                             * @description HTTP status code
+                             * @example 400
+                             */
+                            statusCode?: number;
+                            /**
+                             * @description Short error label
+                             * @example Bad Request
+                             */
+                            error?: string;
+                            /**
+                             * @description Human-readable error message. Validation errors from `ZodError.flatten()` may be returned as an array.
+                             * @example Validation failed
+                             */
+                            message: string | string[];
+                        };
+                    };
+                };
+            };
+        };
+        delete?: never;
+        options?: never;
+        head?: never;
+        patch?: never;
+        trace?: never;
+    };
     "/v1/orgs/me": {
         parameters: {
             query?: never;
@@ -9142,6 +9275,8 @@ type PublicOrgResponse = Res<'/v1/orgs/me', 'get'>;
 type CreateUserRequest = Req<'/v1/orgs/me/users', 'post'>;
 type CreateUserResponse = Res<'/v1/orgs/me/users', 'post'>;
 type ListUsersResponse = Res<'/v1/orgs/me/users', 'get'>;
+type CreateOrgRequest = Req<'/v1/orgs', 'post'>;
+type CreateOrgResponse = Res<'/v1/orgs', 'post'>;
 type CreateOrganizationRequest = Req<'/v1/admin/organizations', 'post'>;
 type CreateOrganizationResponse = Res<'/v1/admin/organizations', 'post'>;
 type SetAccountTypeRequest = Req<'/v1/admin/organizations/{id}/account-type', 'patch'>;
@@ -9160,11 +9295,11 @@ type SignRequest = Req<'/v1/sign', 'post'>;
 type SignResponse = Res<'/v1/sign', 'post'>;
 type ProvisionContractRequest = Req<'/v1/contracts/provision', 'post'>;
 type ProvisionContractResponse = Res<'/v1/contracts/provision', 'post'>;
-type AddSigningKeyRequest = Req<'/v1/keys', 'post'>;
+type AddSigningKeyRequest$1 = Req<'/v1/keys', 'post'>;
 type AddSigningKeyResponse = Res<'/v1/keys', 'post'>;
-type RevokeSigningKeyRequest = Req<'/v1/keys/revoke', 'post'>;
+type RevokeSigningKeyRequest$1 = Req<'/v1/keys/revoke', 'post'>;
 type RevokeSigningKeyResponse = Res<'/v1/keys/revoke', 'post'>;
-type PauseRequest = Req<'/v1/contracts/pause', 'post'>;
+type PauseRequest$1 = Req<'/v1/contracts/pause', 'post'>;
 type PauseResponse = Res<'/v1/contracts/pause', 'post'>;
 type UnpauseRequest = Req<'/v1/contracts/unpause', 'post'>;
 type UnpauseResponse = Res<'/v1/contracts/unpause', 'post'>;
@@ -9441,6 +9576,17 @@ declare class WitniumchainClient {
      */
     me(): Promise<AccountResponse>;
     signup(body: SignupRequest): Promise<SignupResponse>;
+    /**
+     * Self-serve org creation (Phase RBAC Thread D). One public call that
+     * creates the admin user, the org, the org-admin membership, and deploys
+     * the contract with the caller's client-generated `ownerPublicKey` +
+     * `initialSigningPublicKey`. Witnium never sees the private bytes.
+     *
+     * Returns `{ orgId, userId, contractAddress, contractVersion,
+     * emailVerifyToken }`. The verify token is also emailed; it's echoed here
+     * for UIs that prefer to render the verify link themselves.
+     */
+    createOrg(body: CreateOrgRequest): Promise<CreateOrgResponse>;
     verifyEmail(token: string): Promise<VerifyEmailResponse>;
     login(body: LoginRequest): Promise<LoginResponse>;
     logout(): Promise<LogoutResponse>;
@@ -9465,9 +9611,9 @@ declare class WitniumchainClient {
     revokeDelegatedKey(id: string): Promise<RevokeDelegatedKeyResponse>;
     sign(body: SignRequest, requestId?: string): Promise<SignResponse>;
     provisionContract(body: ProvisionContractRequest): Promise<ProvisionContractResponse>;
-    addSigningKey(body: AddSigningKeyRequest): Promise<AddSigningKeyResponse>;
-    revokeSigningKey(body: RevokeSigningKeyRequest): Promise<RevokeSigningKeyResponse>;
-    pauseContract(body: PauseRequest): Promise<PauseResponse>;
+    addSigningKey(body: AddSigningKeyRequest$1): Promise<AddSigningKeyResponse>;
+    revokeSigningKey(body: RevokeSigningKeyRequest$1): Promise<RevokeSigningKeyResponse>;
+    pauseContract(body: PauseRequest$1): Promise<PauseResponse>;
     unpauseContract(body: UnpauseRequest): Promise<UnpauseResponse>;
     proposeWitness(contractAddress: string, body: ProposeWitnessRequest, idempotencyKey?: string): Promise<ProposeWitnessResponse>;
     signWitness(contractAddress: string, witnessId: string, body: SignWitnessRequest): Promise<SignWitnessResponse>;
@@ -9690,8 +9836,8 @@ declare class SigningKeys {
      * WitniumchainClient.getAccount} and returns the `signingKeys` slice.
      */
     list(): Promise<AccountResponse['signingKeys']>;
-    add(body: AddSigningKeyRequest): Promise<AddSigningKeyResponse>;
-    revoke(body: RevokeSigningKeyRequest): Promise<RevokeSigningKeyResponse>;
+    add(body: AddSigningKeyRequest$1): Promise<AddSigningKeyResponse>;
+    revoke(body: RevokeSigningKeyRequest$1): Promise<RevokeSigningKeyResponse>;
 }
 /** `client.oauth.sessions.*` — list and revoke active OAuth sessions. */
 declare class OauthNamespace {
@@ -9792,6 +9938,66 @@ declare class WitniumchainAdminClient {
     adjustCredits(orgId: string, delta: number, note?: string): Promise<AdjustCreditsResponse>;
 }
 
+type Body<T> = T extends {
+    content: {
+        'application/json': infer J;
+    };
+} ? J : never;
+type Resp<T> = T extends {
+    content: {
+        'application/json': infer J;
+    };
+} ? J : never;
+type DeployContractRequest = Body<NonNullable<paths['/v5/contracts/deploy']['post']['requestBody']>>;
+type DeployContractResponse = Resp<paths['/v5/contracts/deploy']['post']['responses']['200']>;
+type AddSigningKeyRequest = Body<NonNullable<paths['/v5/contracts/{contractAddress}/keys']['post']['requestBody']>>;
+type OwnerOpResponse = Resp<paths['/v5/contracts/{contractAddress}/keys']['post']['responses']['200']>;
+type RevokeSigningKeyRequest = {
+    keyToRevoke: string;
+    ownerNonce: number;
+    ownerSignature: string;
+};
+type PauseRequest = {
+    ownerNonce: number;
+    ownerSignature: string;
+};
+interface WitniumchainChainAdminClientConfig {
+    /** chain-api base URL, e.g. https://api.witniumchain.com. Trailing slash optional. */
+    baseUrl: string;
+    /**
+     * Static bearer token (legacy `BEARER_TOKEN`). Mutually exclusive with
+     * `adminTokenProvider`. Phase RBAC checkpoint 3 retires this in favour of
+     * the provider.
+     */
+    adminToken?: string;
+    /**
+     * Async function that yields a fresh accounts-minted service-principal JWT
+     * with `aud=https://api.witniumchain.com/admin` + `role=org-admin` on each
+     * call. Implementations typically cache against the token's `exp`. Returned
+     * tokens MUST satisfy chain-api's DashboardJwtGuard.
+     */
+    adminTokenProvider?: () => Promise<string>;
+    /** Per-request timeout in milliseconds. Default 30000. */
+    timeout?: number;
+    /** Alternate fetch implementation, e.g. for tests. Default globalThis.fetch. */
+    fetch?: typeof fetch;
+}
+declare class WitniumchainChainAdminClient {
+    private readonly baseUrl;
+    private readonly adminToken;
+    private readonly adminTokenProvider;
+    private readonly timeout;
+    private readonly fetchImpl;
+    constructor(config: WitniumchainChainAdminClientConfig);
+    deployContract(body: DeployContractRequest): Promise<DeployContractResponse>;
+    addSigningKey(contractAddress: string, body: AddSigningKeyRequest): Promise<OwnerOpResponse>;
+    revokeSigningKey(contractAddress: string, body: RevokeSigningKeyRequest): Promise<OwnerOpResponse>;
+    pauseContract(contractAddress: string, body: PauseRequest): Promise<OwnerOpResponse>;
+    unpauseContract(contractAddress: string, body: PauseRequest): Promise<OwnerOpResponse>;
+    private resolveToken;
+    private req;
+}
+
 /**
  * WitniumchainOrgClient — org-admin facade over the accounts API.
  *
@@ -9864,4 +10070,4 @@ declare class WitniumchainApiError extends Error {
     });
 }
 
-export { type AccountResponse, type AccountType, type paths$1 as AccountsPaths, type AddSigningKeyRequest, type AddSigningKeyResponse, type AdjustCreditsRequest, type AdjustCreditsResponse, type BeginOAuthLoginArgs, type BeginOAuthLoginResult, type paths as ChainPaths, type CheckoutRequest, type CheckoutResponse, type CreateOrganizationRequest, type CreateOrganizationResponse, type CreateUserRequest, type CreateUserResponse, DelegatedKeys, type FinalizeWitnessResponse, type ForgotPasswordRequest, type ForgotPasswordResponse, type GetWitnessResponse, type HealthLiveResponse, type HealthReadyResponse, type LedgerResponse, type ListDelegatedKeysResponse, type ListOauthSessionsResponse, type ListUsersResponse, type LoginRequest, type LoginResponse, type LogoutResponse, MfaNamespace, MfaRecoveryCodes, MfaTotp, type OAuthTokenSnapshot, OauthNamespace, OauthSessions, OrgUsers, type OwnerSigner, type PauseRequest, type PauseResponse, type PkceVerifierStorage, type PortalResponse, type PrepareDelegatedKeyRequest, type PreparedDelegatedKeyResponse, type ProposeWitnessRequest, type ProposeWitnessResponse, type ProvisionContractRequest, type ProvisionContractResponse, type ProvisionDelegatedKeyArgs, type ProvisionDelegatedKeyResult, type PublicOrgResponse, type RecoveryCodesRegenerateResponse, type ResetPasswordRequest, type ResetPasswordResponse, type RevokeDelegatedKeyResponse, type RevokeSigningKeyRequest, type RevokeSigningKeyResponse, type RevokeWitnessRequest, type RevokeWitnessResponse, type RotateApiKeyResponse, type SetAccountTypeRequest, type SetAccountTypeResponse, type SignRequest, type SignResponse, type SignWitnessRequest, type SignWitnessResponse, type SignedRequestSigner, SigningKeys, type SignupRequest, type SignupResponse, type SubmitDelegatedKeyRequest, type SubmitDelegatedKeyResponse, Subscriptions, type TotpConfirmRequest, type TotpConfirmResponse, type TotpDisableResponse, type TotpEnrollResponse, type UnpauseRequest, type UnpauseResponse, type VerifyEmailResponse, type VerifyOrganizationResponse, WitniumchainAdminClient, type WitniumchainAdminClientConfig, WitniumchainApiError, WitniumchainClient, type WitniumchainClientConfig, WitniumchainOrgClient, type WitniumchainOrgClientConfig, defaultVerifierStorage };
+export { type AccountResponse, type AccountType, type paths$1 as AccountsPaths, type AddSigningKeyRequest$1 as AddSigningKeyRequest, type AddSigningKeyResponse, type AdjustCreditsRequest, type AdjustCreditsResponse, type BeginOAuthLoginArgs, type BeginOAuthLoginResult, type paths as ChainPaths, type CheckoutRequest, type CheckoutResponse, type CreateOrgRequest, type CreateOrgResponse, type CreateOrganizationRequest, type CreateOrganizationResponse, type CreateUserRequest, type CreateUserResponse, DelegatedKeys, type FinalizeWitnessResponse, type ForgotPasswordRequest, type ForgotPasswordResponse, type GetWitnessResponse, type HealthLiveResponse, type HealthReadyResponse, type LedgerResponse, type ListDelegatedKeysResponse, type ListOauthSessionsResponse, type ListUsersResponse, type LoginRequest, type LoginResponse, type LogoutResponse, MfaNamespace, MfaRecoveryCodes, MfaTotp, type OAuthTokenSnapshot, OauthNamespace, OauthSessions, OrgUsers, type OwnerSigner, type PauseRequest$1 as PauseRequest, type PauseResponse, type PkceVerifierStorage, type PortalResponse, type PrepareDelegatedKeyRequest, type PreparedDelegatedKeyResponse, type ProposeWitnessRequest, type ProposeWitnessResponse, type ProvisionContractRequest, type ProvisionContractResponse, type ProvisionDelegatedKeyArgs, type ProvisionDelegatedKeyResult, type PublicOrgResponse, type RecoveryCodesRegenerateResponse, type ResetPasswordRequest, type ResetPasswordResponse, type RevokeDelegatedKeyResponse, type RevokeSigningKeyRequest$1 as RevokeSigningKeyRequest, type RevokeSigningKeyResponse, type RevokeWitnessRequest, type RevokeWitnessResponse, type RotateApiKeyResponse, type SetAccountTypeRequest, type SetAccountTypeResponse, type SignRequest, type SignResponse, type SignWitnessRequest, type SignWitnessResponse, type SignedRequestSigner, SigningKeys, type SignupRequest, type SignupResponse, type SubmitDelegatedKeyRequest, type SubmitDelegatedKeyResponse, Subscriptions, type TotpConfirmRequest, type TotpConfirmResponse, type TotpDisableResponse, type TotpEnrollResponse, type UnpauseRequest, type UnpauseResponse, type VerifyEmailResponse, type VerifyOrganizationResponse, WitniumchainAdminClient, type WitniumchainAdminClientConfig, WitniumchainApiError, WitniumchainChainAdminClient, type WitniumchainChainAdminClientConfig, WitniumchainClient, type WitniumchainClientConfig, WitniumchainOrgClient, type WitniumchainOrgClientConfig, defaultVerifierStorage };

package/dist/index.js

@@ -157,6 +157,19 @@ var WitniumchainClient = class {
   signup(body) {
     return this.req("POST", "/v1/auth/signup", { auth: "Public", body });
   }
+  /**
+   * Self-serve org creation (Phase RBAC Thread D). One public call that
+   * creates the admin user, the org, the org-admin membership, and deploys
+   * the contract with the caller's client-generated `ownerPublicKey` +
+   * `initialSigningPublicKey`. Witnium never sees the private bytes.
+   *
+   * Returns `{ orgId, userId, contractAddress, contractVersion,
+   * emailVerifyToken }`. The verify token is also emailed; it's echoed here
+   * for UIs that prefer to render the verify link themselves.
+   */
+  createOrg(body) {
+    return this.req("POST", "/v1/orgs", { auth: "Public", body });
+  }
   verifyEmail(token) {
     return this.req("GET", "/v1/auth/verify", {
       auth: "Public",
@@ -1346,6 +1359,106 @@ var WitniumchainAdminClient = class {
   }
 };
 
+// src/chain-admin-client.ts
+var WitniumchainChainAdminClient = class {
+  baseUrl;
+  adminToken;
+  adminTokenProvider;
+  timeout;
+  fetchImpl;
+  constructor(config) {
+    if (!config.baseUrl) {
+      throw new Error("WitniumchainChainAdminClient: baseUrl is required");
+    }
+    if (config.adminToken && config.adminTokenProvider) {
+      throw new Error(
+        "WitniumchainChainAdminClient: pass either adminToken (static) or adminTokenProvider (OAuth), not both"
+      );
+    }
+    if (!config.adminToken && !config.adminTokenProvider) {
+      throw new Error(
+        "WitniumchainChainAdminClient: one of adminToken or adminTokenProvider is required"
+      );
+    }
+    this.baseUrl = config.baseUrl.replace(/\/+$/, "");
+    this.adminToken = config.adminToken;
+    this.adminTokenProvider = config.adminTokenProvider;
+    this.timeout = config.timeout ?? 3e4;
+    this.fetchImpl = config.fetch ?? globalThis.fetch;
+  }
+  async deployContract(body) {
+    return this.req("POST", "/v5/contracts/deploy", body);
+  }
+  async addSigningKey(contractAddress, body) {
+    return this.req(
+      "POST",
+      `/v5/contracts/${encodeURIComponent(contractAddress)}/keys`,
+      body
+    );
+  }
+  async revokeSigningKey(contractAddress, body) {
+    return this.req(
+      "POST",
+      `/v5/contracts/${encodeURIComponent(contractAddress)}/keys/revoke`,
+      body
+    );
+  }
+  async pauseContract(contractAddress, body) {
+    return this.req(
+      "POST",
+      `/v5/contracts/${encodeURIComponent(contractAddress)}/pause`,
+      body
+    );
+  }
+  async unpauseContract(contractAddress, body) {
+    return this.req(
+      "POST",
+      `/v5/contracts/${encodeURIComponent(contractAddress)}/unpause`,
+      body
+    );
+  }
+  async resolveToken() {
+    if (this.adminTokenProvider) return this.adminTokenProvider();
+    return this.adminToken;
+  }
+  async req(method, path, body) {
+    const token = await this.resolveToken();
+    const controller = new AbortController();
+    const timer = setTimeout(() => controller.abort(), this.timeout);
+    try {
+      const response = await this.fetchImpl(`${this.baseUrl}${path}`, {
+        method,
+        headers: {
+          accept: "application/json",
+          "content-type": "application/json",
+          authorization: `Bearer ${token}`
+        },
+        body: JSON.stringify(body),
+        signal: controller.signal
+      });
+      const text = await response.text();
+      const parsed = text ? safeParse(text) : void 0;
+      if (!response.ok) {
+        throw new WitniumchainApiError({
+          status: response.status,
+          message: parsed?.message ?? `${method} ${path} failed: ${response.status}`,
+          body: parsed
+        });
+      }
+      return parsed;
+    } finally {
+      clearTimeout(timer);
+    }
+  }
+};
+function safeParse(text) {
+  try {
+    return JSON.parse(text);
+  } catch {
+    return text;
+  }
+}
+
 // src/org-client.ts
 var WitniumchainOrgClient = class {
   inner;
@@ -1403,6 +1516,7 @@ exports.SigningKeys = SigningKeys;
 exports.Subscriptions = Subscriptions;
 exports.WitniumchainAdminClient = WitniumchainAdminClient;
 exports.WitniumchainApiError = WitniumchainApiError;
+exports.WitniumchainChainAdminClient = WitniumchainChainAdminClient;
 exports.WitniumchainClient = WitniumchainClient;
 exports.WitniumchainOrgClient = WitniumchainOrgClient;
 exports.defaultVerifierStorage = defaultVerifierStorage;