@zincapp/znvault-cli 3.3.1 → 4.0.2

package/dist/index.js

@@ -1,12 +1,13 @@
 #!/usr/bin/env node
 import { Command } from 'commander';
+import { applyTenantContextPatch } from './lib/command-context.js';
 import { registerAuthCommands } from './commands/auth.js';
+// Apply the global Commander patch that gates `--tenant` options by registration
+// context. Must run before any command registration.
+applyTenantContextPatch(Command.prototype);
 import { registerHealthCommands } from './commands/health.js';
-import { registerClusterCommands } from './commands/cluster.js';
-import { registerTenantCommands } from './commands/tenant.js';
 import { registerUserCommands } from './commands/user.js';
-import { registerSuperadminCommands } from './commands/superadmin.js';
-import { registerLockdownCommands } from './commands/lockdown.js';
+import { registerSuperadminCommands } from './commands/superadmin/index.js';
 import { registerQuarantineCommands } from './commands/quarantine.js';
 import { registerAuditCommands } from './commands/audit.js';
 import { registerEmergencyCommands } from './commands/emergency.js';
@@ -19,9 +20,7 @@ import { registerPolicyCommands } from './commands/policy.js';
 import { registerPermissionsCommands } from './commands/permissions.js';
 import { registerSecretCommands } from './commands/secret.js';
 import { registerKmsCommands } from './commands/kms/index.js';
-import { registerLmkCommands } from './commands/lmk.js';
 import { registerRoleCommands } from './commands/role.js';
-import { registerBackupCommands } from './commands/backup/index.js';
 import { registerNotificationCommands } from './commands/notification.js';
 import { registerTuiCommands } from './commands/tui.js';
 import { registerSelfUpdateCommands } from './commands/self-update.js';
@@ -84,14 +83,20 @@ program
     const config = getConfig();
     profileIndicator(getActiveProfileName(), config.url);
 });
-// Register all command groups
+// Register all top-level command groups (tenant context by default).
+//
+// In v4, the following groups moved entirely under `znvault superadmin <...>`
+// and are no longer registered at the top level:
+//   - tenant, cluster, lockdown, lmk, backup (pure-superadmin)
+//   - superadmin account management → `superadmin accounts <...>`
+//
+// Dual-purpose groups (user, audit, quarantine, advisor, agent, apikey, host,
+// kms, policy, role, sso, ssh, group) are registered here in tenant context
+// (no --tenant flag) AND again under the superadmin namespace with
+// `context: 'superadmin'` (--tenant accepted).
 registerAuthCommands(program);
 registerHealthCommands(program);
-registerClusterCommands(program);
-registerTenantCommands(program);
 registerUserCommands(program);
-registerSuperadminCommands(program);
-registerLockdownCommands(program);
 registerQuarantineCommands(program);
 registerAuditCommands(program);
 registerEmergencyCommands(program);
@@ -104,9 +109,7 @@ registerPolicyCommands(program);
 registerPermissionsCommands(program);
 registerSecretCommands(program);
 registerKmsCommands(program);
-registerLmkCommands(program);
 registerRoleCommands(program);
-registerBackupCommands(program);
 registerNotificationCommands(program);
 registerTuiCommands(program);
 registerSelfUpdateCommands(program);
@@ -121,6 +124,8 @@ registerGroupCommands(program);
 registerDynamicSecretsCommands(program);
 registerSSHCommands(program);
 registerSSHCACommands(program);
+// Superadmin namespace (must come last so all referenced groups are loaded).
+registerSuperadminCommands(program);
 // Configure context-aware help (hides superadmin-only commands for regular users)
 configureContextHelp(program);
 // Run background update check (non-blocking)

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";AAEA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAC;AAC1D,OAAO,EAAE,sBAAsB,EAAE,MAAM,sBAAsB,CAAC;AAC9D,OAAO,EAAE,uBAAuB,EAAE,MAAM,uBAAuB,CAAC;AAChE,OAAO,EAAE,sBAAsB,EAAE,MAAM,sBAAsB,CAAC;AAC9D,OAAO,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAC;AAC1D,OAAO,EAAE,0BAA0B,EAAE,MAAM,0BAA0B,CAAC;AACtE,OAAO,EAAE,wBAAwB,EAAE,MAAM,wBAAwB,CAAC;AAClE,OAAO,EAAE,0BAA0B,EAAE,MAAM,0BAA0B,CAAC;AACtE,OAAO,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAC;AAC5D,OAAO,EAAE,yBAAyB,EAAE,MAAM,yBAAyB,CAAC;AACpE,OAAO,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAC;AAC1D,OAAO,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAC;AAC5D,OAAO,EAAE,oBAAoB,EAAE,MAAM,0BAA0B,CAAC;AAChE,OAAO,EAAE,sBAAsB,EAAE,MAAM,sBAAsB,CAAC;AAC9D,OAAO,EAAE,sBAAsB,EAAE,MAAM,sBAAsB,CAAC;AAC9D,OAAO,EAAE,sBAAsB,EAAE,MAAM,sBAAsB,CAAC;AAC9D,OAAO,EAAE,2BAA2B,EAAE,MAAM,2BAA2B,CAAC;AACxE,OAAO,EAAE,sBAAsB,EAAE,MAAM,sBAAsB,CAAC;AAC9D,OAAO,EAAE,mBAAmB,EAAE,MAAM,yBAAyB,CAAC;AAC9D,OAAO,EAAE,mBAAmB,EAAE,MAAM,mBAAmB,CAAC;AACxD,OAAO,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAC;AAC1D,OAAO,EAAE,sBAAsB,EAAE,MAAM,4BAA4B,CAAC;AACpE,OAAO,EAAE,4BAA4B,EAAE,MAAM,4BAA4B,CAAC;AAC1E,OAAO,EAAE,mBAAmB,EAAE,MAAM,mBAAmB,CAAC;AACxD,OAAO,EAAE,0BAA0B,EAAE,MAAM,2BAA2B,CAAC;AACvE,OAAO,EAAE,uBAAuB,EAAE,MAAM,uBAAuB,CAAC;AAChE,OAAO,EAAE,0BAA0B,EAAE,MAAM,0BAA0B,CAAC;AACtE,OAAO,EAAE,sBAAsB,EAAE,MAAM,sBAAsB,CAAC;AAC9D,OAAO,EAAE,sBAAsB,EAAE,MAAM,sBAAsB,CAAC;AAC9D,OAAO,EAAE,sBAAsB,EAAE,MAAM,sBAAsB,CAAC;AAC9D,OAAO,EAAE,sBAAsB,EAAE,MAAM,4BAA4B,CAAC;AACpE,OAAO,EAAE,mBAAmB,EAAE,MAAM,yBAAyB,CAAC;AAC9D,OAAO,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAC;AAC5D,OAAO,EAAE,8BAA8B,EAAE,MAAM,+BAA+B,CAAC;AAC/E,OAAO,EAAE,mBAAmB,EAAE,MAAM,yBAAyB,CAAC;AAC9D,OAAO,EAAE,qBAAqB,EAAE,MAAM,sBAAsB,CAAC;AAC7D,OAAO,EAAE,MAAM,EAAE,MAAM,iBAAiB,CAAC;AACzC,OAAO,EACL,iBAAiB,EACjB,oBAAoB,EACpB,SAAS,EACT,UAAU,EACV,cAAc,EACd,SAAS,EACT,mBAAmB,GACpB,MAAM,iBAAiB,CAAC;AACzB,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,gBAAgB,EAAE,aAAa,EAAsB,MAAM,iBAAiB,CAAC;AAC3G,OAAO,EAAE,wBAAwB,EAAE,MAAM,qBAAqB,CAAC;AAC/D,OAAO,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AACnE,OAAO,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AACnD,OAAO,EAAE,oBAAoB,EAAE,MAAM,uBAAuB,CAAC;AAC7D,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAC9C,OAAO,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAC;AAU5D,MAAM,OAAO,GAAG,IAAI,OAAO,EAAE,CAAC;AAE9B,OAAO;KACJ,IAAI,CAAC,SAAS,CAAC;KACf,WAAW,CAAC,4BAA4B,CAAC;KACzC,OAAO,CAAC,UAAU,EAAE,CAAC;KACrB,MAAM,CAAC,aAAa,EAAE,kBAAkB,CAAC;KACzC,MAAM,CAAC,YAAY,EAAE,mCAAmC,CAAC;KACzD,MAAM,CAAC,kBAAkB,EAAE,sCAAsC,CAAC;KAClE,MAAM,CAAC,SAAS,EAAE,0CAA0C,CAAC;KAC7D,MAAM,CAAC,aAAa,EAAE,kEAAkE,CAAC;KACzF,IAAI,CAAC,WAAW,EAAE,CAAC,WAAW,EAAE,aAAa,EAAE,EAAE;IAChD,uBAAuB;IACvB,MAAM,IAAI,GAAG,WAAW,CAAC,IAAI,EAAiB,CAAC;IAE/C,4CAA4C;IAC5C,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;QACf,aAAa,CAAC,OAAO,CAAC,CAAC;IACzB,CAAC;IAED,+DAA+D;IAC/D,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;QACf,YAAY,CAAC,IAAI,CAAC,CAAC;IACrB,CAAC;IAED,kDAAkD;IAClD,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;QACjB,iBAAiB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAClC,CAAC;IAED,+BAA+B;IAC/B,IAAI,IAAI,CAAC,GAAG,KAAK,SAAS,IAAI,IAAI,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;QAC1D,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC;IAC5C,CAAC;IAED,gFAAgF;IAChF,MAAM,OAAO,GAAG,aAAa,CAAC,IAAI,EAAE,CAAC;IACrC,MAAM,UAAU,GAAG,aAAa,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC;IAChD,IAAI,UAAU,KAAK,YAAY,IAAI,OAAO,KAAK,YAAY,EAAE,CAAC;QAC5D,OAAO;IACT,CAAC;IAED,iCAAiC;IACjC,MAAM,MAAM,GAAG,SAAS,EAAE,CAAC;IAC3B,gBAAgB,CAAC,oBAAoB,EAAE,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC;AACvD,CAAC,CAAC,CAAC;AAEL,8BAA8B;AAC9B,oBAAoB,CAAC,OAAO,CAAC,CAAC;AAC9B,sBAAsB,CAAC,OAAO,CAAC,CAAC;AAChC,uBAAuB,CAAC,OAAO,CAAC,CAAC;AACjC,sBAAsB,CAAC,OAAO,CAAC,CAAC;AAChC,oBAAoB,CAAC,OAAO,CAAC,CAAC;AAC9B,0BAA0B,CAAC,OAAO,CAAC,CAAC;AACpC,wBAAwB,CAAC,OAAO,CAAC,CAAC;AAClC,0BAA0B,CAAC,OAAO,CAAC,CAAC;AACpC,qBAAqB,CAAC,OAAO,CAAC,CAAC;AAC/B,yBAAyB,CAAC,OAAO,CAAC,CAAC;AACnC,oBAAoB,CAAC,OAAO,CAAC,CAAC;AAC9B,qBAAqB,CAAC,OAAO,CAAC,CAAC;AAC/B,oBAAoB,CAAC,OAAO,CAAC,CAAC;AAC9B,sBAAsB,CAAC,OAAO,CAAC,CAAC;AAChC,sBAAsB,CAAC,OAAO,CAAC,CAAC;AAChC,sBAAsB,CAAC,OAAO,CAAC,CAAC;AAChC,2BAA2B,CAAC,OAAO,CAAC,CAAC;AACrC,sBAAsB,CAAC,OAAO,CAAC,CAAC;AAChC,mBAAmB,CAAC,OAAO,CAAC,CAAC;AAC7B,mBAAmB,CAAC,OAAO,CAAC,CAAC;AAC7B,oBAAoB,CAAC,OAAO,CAAC,CAAC;AAC9B,sBAAsB,CAAC,OAAO,CAAC,CAAC;AAChC,4BAA4B,CAAC,OAAO,CAAC,CAAC;AACtC,mBAAmB,CAAC,OAAO,CAAC,CAAC;AAC7B,0BAA0B,CAAC,OAAO,CAAC,CAAC;AACpC,uBAAuB,CAAC,OAAO,CAAC,CAAC;AACjC,0BAA0B,CAAC,OAAO,CAAC,CAAC;AACpC,sBAAsB,CAAC,OAAO,CAAC,CAAC;AAChC,sBAAsB,CAAC,OAAO,CAAC,CAAC;AAChC,sBAAsB,CAAC,OAAO,CAAC,CAAC;AAChC,sBAAsB,CAAC,OAAO,CAAC,CAAC;AAChC,mBAAmB,CAAC,OAAO,CAAC,CAAC;AAC7B,qBAAqB,CAAC,OAAO,CAAC,CAAC;AAC/B,8BAA8B,CAAC,OAAO,CAAC,CAAC;AACxC,mBAAmB,CAAC,OAAO,CAAC,CAAC;AAC7B,qBAAqB,CAAC,OAAO,CAAC,CAAC;AAE/B,kFAAkF;AAClF,oBAAoB,CAAC,OAAO,CAAC,CAAC;AAE9B,6CAA6C;AAC7C,wBAAwB,EAAE,CAAC;AAE3B;;GAEG;AACH,SAAS,YAAY;IACnB,MAAM,MAAM,GAAG,SAAS,EAAE,CAAC;IAC3B,MAAM,OAAO,GAAG,oBAAoB,EAAE,CAAC;IACvC,MAAM,WAAW,GAAG,cAAc,EAAE,CAAC;IACrC,MAAM,UAAU,GAAG,mBAAmB,EAAE,CAAC;IAEzC,IAAI,UAAU,GAA8B,MAAM,CAAC;IACnD,IAAI,QAA4B,CAAC;IACjC,IAAI,UAA8B,CAAC;IACnC,IAAI,YAAgC,CAAC;IAErC,IAAI,SAAS,EAAE,EAAE,CAAC;QAChB,UAAU,GAAG,QAAQ,CAAC;QACtB,IAAI,UAAU,EAAE,CAAC;YACf,UAAU,GAAG,UAAU,CAAC,IAAI,CAAC;YAC7B,YAAY,GAAG,UAAU,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,KAAK,CAAC;QACzD,CAAC;IACH,CAAC;SAAM,IAAI,WAAW,EAAE,WAAW,EAAE,CAAC;QACpC,UAAU,GAAG,KAAK,CAAC;QACnB,2CAA2C;QAC3C,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,WAAW,CAAC,WAAW,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;YACtD,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC,QAAQ,EAAE,CAAwC,CAAC;YAC7G,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,OAAO,CAAC,GAAG,CAAC;QAC7C,CAAC;QAAC,MAAM,CAAC;YACP,QAAQ,GAAG,eAAe,CAAC;QAC7B,CAAC;IACH,CAAC;IAED,OAAO;QACL,OAAO,EAAE,UAAU,EAAE;QACrB,OAAO;QACP,QAAQ,EAAE,MAAM,CAAC,GAAG;QACpB,UAAU;QACV,QAAQ;QACR,UAAU;QACV,YAAY;KACb,CAAC;AACJ,CAAC;AAED,yBAAyB;AACzB,KAAK,UAAU,IAAI;IACjB,mDAAmD;IACnD,IAAI,OAAO,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC9B,MAAM,MAAM,GAAG,YAAY,EAAE,CAAC;QAC9B,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC;QACvC,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,MAAM,CAAC,CAAC,CAAC;QACtC,OAAO,CAAC,GAAG,CAAC,aAAa,EAAE,CAAC,CAAC;QAC7B,OAAO,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC,CAAC;QACxB,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,6DAA6D;IAC7D,IAAI,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QACpE,YAAY,CAAC,IAAI,CAAC,CAAC;IACrB,CAAC;IAED,mBAAmB;IACnB,MAAM,aAAa,GAAG,UAAU,EAAE,CAAC;IACnC,IAAI,aAAa,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC7B,IAAI,CAAC;YACH,MAAM,YAAY,GAAG,MAAM,qBAAqB,CAC9C,aAAa,EACb,MAAM,EACN,SAAS,EACT,oBAAoB,CACrB,CAAC;YACF,YAAY,CAAC,gBAAgB,CAAC,OAAO,CAAC,CAAC;QACzC,CAAC;QAAC,MAAM,CAAC;YACP,iEAAiE;QACnE,CAAC;IACH,CAAC;IAED,oBAAoB;IACpB,OAAO,CAAC,KAAK,EAAE,CAAC;AAClB,CAAC;AAED,WAAW;AACX,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;IACnB,OAAO,CAAC,KAAK,CAAC,YAAY,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;IAC9E,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC,CAAC,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";AAEA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,uBAAuB,EAAE,MAAM,0BAA0B,CAAC;AACnE,OAAO,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAC;AAE1D,iFAAiF;AACjF,qDAAqD;AACrD,uBAAuB,CAAC,OAAO,CAAC,SAAqE,CAAC,CAAC;AACvG,OAAO,EAAE,sBAAsB,EAAE,MAAM,sBAAsB,CAAC;AAC9D,OAAO,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAC;AAC1D,OAAO,EAAE,0BAA0B,EAAE,MAAM,gCAAgC,CAAC;AAC5E,OAAO,EAAE,0BAA0B,EAAE,MAAM,0BAA0B,CAAC;AACtE,OAAO,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAC;AAC5D,OAAO,EAAE,yBAAyB,EAAE,MAAM,yBAAyB,CAAC;AACpE,OAAO,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAC;AAC1D,OAAO,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAC;AAC5D,OAAO,EAAE,oBAAoB,EAAE,MAAM,0BAA0B,CAAC;AAChE,OAAO,EAAE,sBAAsB,EAAE,MAAM,sBAAsB,CAAC;AAC9D,OAAO,EAAE,sBAAsB,EAAE,MAAM,sBAAsB,CAAC;AAC9D,OAAO,EAAE,sBAAsB,EAAE,MAAM,sBAAsB,CAAC;AAC9D,OAAO,EAAE,2BAA2B,EAAE,MAAM,2BAA2B,CAAC;AACxE,OAAO,EAAE,sBAAsB,EAAE,MAAM,sBAAsB,CAAC;AAC9D,OAAO,EAAE,mBAAmB,EAAE,MAAM,yBAAyB,CAAC;AAC9D,OAAO,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAC;AAC1D,OAAO,EAAE,4BAA4B,EAAE,MAAM,4BAA4B,CAAC;AAC1E,OAAO,EAAE,mBAAmB,EAAE,MAAM,mBAAmB,CAAC;AACxD,OAAO,EAAE,0BAA0B,EAAE,MAAM,2BAA2B,CAAC;AACvE,OAAO,EAAE,uBAAuB,EAAE,MAAM,uBAAuB,CAAC;AAChE,OAAO,EAAE,0BAA0B,EAAE,MAAM,0BAA0B,CAAC;AACtE,OAAO,EAAE,sBAAsB,EAAE,MAAM,sBAAsB,CAAC;AAC9D,OAAO,EAAE,sBAAsB,EAAE,MAAM,sBAAsB,CAAC;AAC9D,OAAO,EAAE,sBAAsB,EAAE,MAAM,sBAAsB,CAAC;AAC9D,OAAO,EAAE,sBAAsB,EAAE,MAAM,4BAA4B,CAAC;AACpE,OAAO,EAAE,mBAAmB,EAAE,MAAM,yBAAyB,CAAC;AAC9D,OAAO,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAC;AAC5D,OAAO,EAAE,8BAA8B,EAAE,MAAM,+BAA+B,CAAC;AAC/E,OAAO,EAAE,mBAAmB,EAAE,MAAM,yBAAyB,CAAC;AAC9D,OAAO,EAAE,qBAAqB,EAAE,MAAM,sBAAsB,CAAC;AAC7D,OAAO,EAAE,MAAM,EAAE,MAAM,iBAAiB,CAAC;AACzC,OAAO,EACL,iBAAiB,EACjB,oBAAoB,EACpB,SAAS,EACT,UAAU,EACV,cAAc,EACd,SAAS,EACT,mBAAmB,GACpB,MAAM,iBAAiB,CAAC;AACzB,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,gBAAgB,EAAE,aAAa,EAAsB,MAAM,iBAAiB,CAAC;AAC3G,OAAO,EAAE,wBAAwB,EAAE,MAAM,qBAAqB,CAAC;AAC/D,OAAO,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AACnE,OAAO,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AACnD,OAAO,EAAE,oBAAoB,EAAE,MAAM,uBAAuB,CAAC;AAC7D,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAC9C,OAAO,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAC;AAU5D,MAAM,OAAO,GAAG,IAAI,OAAO,EAAE,CAAC;AAE9B,OAAO;KACJ,IAAI,CAAC,SAAS,CAAC;KACf,WAAW,CAAC,4BAA4B,CAAC;KACzC,OAAO,CAAC,UAAU,EAAE,CAAC;KACrB,MAAM,CAAC,aAAa,EAAE,kBAAkB,CAAC;KACzC,MAAM,CAAC,YAAY,EAAE,mCAAmC,CAAC;KACzD,MAAM,CAAC,kBAAkB,EAAE,sCAAsC,CAAC;KAClE,MAAM,CAAC,SAAS,EAAE,0CAA0C,CAAC;KAC7D,MAAM,CAAC,aAAa,EAAE,kEAAkE,CAAC;KACzF,IAAI,CAAC,WAAW,EAAE,CAAC,WAAW,EAAE,aAAa,EAAE,EAAE;IAChD,uBAAuB;IACvB,MAAM,IAAI,GAAG,WAAW,CAAC,IAAI,EAAiB,CAAC;IAE/C,4CAA4C;IAC5C,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;QACf,aAAa,CAAC,OAAO,CAAC,CAAC;IACzB,CAAC;IAED,+DAA+D;IAC/D,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;QACf,YAAY,CAAC,IAAI,CAAC,CAAC;IACrB,CAAC;IAED,kDAAkD;IAClD,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;QACjB,iBAAiB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAClC,CAAC;IAED,+BAA+B;IAC/B,IAAI,IAAI,CAAC,GAAG,KAAK,SAAS,IAAI,IAAI,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;QAC1D,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC;IAC5C,CAAC;IAED,gFAAgF;IAChF,MAAM,OAAO,GAAG,aAAa,CAAC,IAAI,EAAE,CAAC;IACrC,MAAM,UAAU,GAAG,aAAa,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC;IAChD,IAAI,UAAU,KAAK,YAAY,IAAI,OAAO,KAAK,YAAY,EAAE,CAAC;QAC5D,OAAO;IACT,CAAC;IAED,iCAAiC;IACjC,MAAM,MAAM,GAAG,SAAS,EAAE,CAAC;IAC3B,gBAAgB,CAAC,oBAAoB,EAAE,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC;AACvD,CAAC,CAAC,CAAC;AAEL,qEAAqE;AACrE,EAAE;AACF,8EAA8E;AAC9E,iDAAiD;AACjD,+DAA+D;AAC/D,kEAAkE;AAClE,EAAE;AACF,8EAA8E;AAC9E,4EAA4E;AAC5E,mEAAmE;AACnE,+CAA+C;AAC/C,oBAAoB,CAAC,OAAO,CAAC,CAAC;AAC9B,sBAAsB,CAAC,OAAO,CAAC,CAAC;AAChC,oBAAoB,CAAC,OAAO,CAAC,CAAC;AAC9B,0BAA0B,CAAC,OAAO,CAAC,CAAC;AACpC,qBAAqB,CAAC,OAAO,CAAC,CAAC;AAC/B,yBAAyB,CAAC,OAAO,CAAC,CAAC;AACnC,oBAAoB,CAAC,OAAO,CAAC,CAAC;AAC9B,qBAAqB,CAAC,OAAO,CAAC,CAAC;AAC/B,oBAAoB,CAAC,OAAO,CAAC,CAAC;AAC9B,sBAAsB,CAAC,OAAO,CAAC,CAAC;AAChC,sBAAsB,CAAC,OAAO,CAAC,CAAC;AAChC,sBAAsB,CAAC,OAAO,CAAC,CAAC;AAChC,2BAA2B,CAAC,OAAO,CAAC,CAAC;AACrC,sBAAsB,CAAC,OAAO,CAAC,CAAC;AAChC,mBAAmB,CAAC,OAAO,CAAC,CAAC;AAC7B,oBAAoB,CAAC,OAAO,CAAC,CAAC;AAC9B,4BAA4B,CAAC,OAAO,CAAC,CAAC;AACtC,mBAAmB,CAAC,OAAO,CAAC,CAAC;AAC7B,0BAA0B,CAAC,OAAO,CAAC,CAAC;AACpC,uBAAuB,CAAC,OAAO,CAAC,CAAC;AACjC,0BAA0B,CAAC,OAAO,CAAC,CAAC;AACpC,sBAAsB,CAAC,OAAO,CAAC,CAAC;AAChC,sBAAsB,CAAC,OAAO,CAAC,CAAC;AAChC,sBAAsB,CAAC,OAAO,CAAC,CAAC;AAChC,sBAAsB,CAAC,OAAO,CAAC,CAAC;AAChC,mBAAmB,CAAC,OAAO,CAAC,CAAC;AAC7B,qBAAqB,CAAC,OAAO,CAAC,CAAC;AAC/B,8BAA8B,CAAC,OAAO,CAAC,CAAC;AACxC,mBAAmB,CAAC,OAAO,CAAC,CAAC;AAC7B,qBAAqB,CAAC,OAAO,CAAC,CAAC;AAE/B,6EAA6E;AAC7E,0BAA0B,CAAC,OAAO,CAAC,CAAC;AAEpC,kFAAkF;AAClF,oBAAoB,CAAC,OAAO,CAAC,CAAC;AAE9B,6CAA6C;AAC7C,wBAAwB,EAAE,CAAC;AAE3B;;GAEG;AACH,SAAS,YAAY;IACnB,MAAM,MAAM,GAAG,SAAS,EAAE,CAAC;IAC3B,MAAM,OAAO,GAAG,oBAAoB,EAAE,CAAC;IACvC,MAAM,WAAW,GAAG,cAAc,EAAE,CAAC;IACrC,MAAM,UAAU,GAAG,mBAAmB,EAAE,CAAC;IAEzC,IAAI,UAAU,GAA8B,MAAM,CAAC;IACnD,IAAI,QAA4B,CAAC;IACjC,IAAI,UAA8B,CAAC;IACnC,IAAI,YAAgC,CAAC;IAErC,IAAI,SAAS,EAAE,EAAE,CAAC;QAChB,UAAU,GAAG,QAAQ,CAAC;QACtB,IAAI,UAAU,EAAE,CAAC;YACf,UAAU,GAAG,UAAU,CAAC,IAAI,CAAC;YAC7B,YAAY,GAAG,UAAU,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,KAAK,CAAC;QACzD,CAAC;IACH,CAAC;SAAM,IAAI,WAAW,EAAE,WAAW,EAAE,CAAC;QACpC,UAAU,GAAG,KAAK,CAAC;QACnB,2CAA2C;QAC3C,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,WAAW,CAAC,WAAW,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;YACtD,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC,QAAQ,EAAE,CAAwC,CAAC;YAC7G,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,OAAO,CAAC,GAAG,CAAC;QAC7C,CAAC;QAAC,MAAM,CAAC;YACP,QAAQ,GAAG,eAAe,CAAC;QAC7B,CAAC;IACH,CAAC;IAED,OAAO;QACL,OAAO,EAAE,UAAU,EAAE;QACrB,OAAO;QACP,QAAQ,EAAE,MAAM,CAAC,GAAG;QACpB,UAAU;QACV,QAAQ;QACR,UAAU;QACV,YAAY;KACb,CAAC;AACJ,CAAC;AAED,yBAAyB;AACzB,KAAK,UAAU,IAAI;IACjB,mDAAmD;IACnD,IAAI,OAAO,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC9B,MAAM,MAAM,GAAG,YAAY,EAAE,CAAC;QAC9B,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC;QACvC,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,MAAM,CAAC,CAAC,CAAC;QACtC,OAAO,CAAC,GAAG,CAAC,aAAa,EAAE,CAAC,CAAC;QAC7B,OAAO,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC,CAAC;QACxB,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,6DAA6D;IAC7D,IAAI,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QACpE,YAAY,CAAC,IAAI,CAAC,CAAC;IACrB,CAAC;IAED,mBAAmB;IACnB,MAAM,aAAa,GAAG,UAAU,EAAE,CAAC;IACnC,IAAI,aAAa,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC7B,IAAI,CAAC;YACH,MAAM,YAAY,GAAG,MAAM,qBAAqB,CAC9C,aAAa,EACb,MAAM,EACN,SAAS,EACT,oBAAoB,CACrB,CAAC;YACF,YAAY,CAAC,gBAAgB,CAAC,OAAO,CAAC,CAAC;QACzC,CAAC;QAAC,MAAM,CAAC;YACP,iEAAiE;QACnE,CAAC;IACH,CAAC;IAED,oBAAoB;IACpB,OAAO,CAAC,KAAK,EAAE,CAAC;AAClB,CAAC;AAED,WAAW;AACX,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;IACnB,OAAO,CAAC,KAAK,CAAC,YAAY,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;IAC9E,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC,CAAC,CAAC"}

package/dist/lib/client/apikeys.d.ts

@@ -2,14 +2,21 @@
  * API Key management client
  *
  * Routing policy:
- *   - When `tenantId` is supplied, the caller is acting as a superadmin and
+ *   - When `tenantId` is supplied OR the caller passes `asSuperadmin: true`,
  *     we target `/v1/superadmin/api-keys/*` (the cross-tenant surface).
- *   - When `tenantId` is omitted, the caller is a tenant principal and we
- *     target `/auth/api-keys/*` (tenant derived from JWT).
+ *   - Otherwise, we target `/auth/api-keys/*` (tenant principal; tenant
+ *     derived from JWT).
+ *
+ * The explicit `asSuperadmin` flag is required for `znvault superadmin
+ * apikey list` (no `--tenant`): the tenant surface rejects pure superadmin
+ * principals with "Superadmins must use /v1/superadmin/* routes".
  */
 import { HttpClient } from './http.js';
 import type { APIKey, CreateAPIKeyResponse, ListAPIKeysResponse, RotateAPIKeyResponse, APIKeySelfResponse, APIKeyPolicyAttachment } from '../../types/index.js';
 import type { MessageResponse } from './types.js';
+export interface ApiKeyScope {
+    asSuperadmin?: boolean;
+}
 export declare class ApiKeysClient extends HttpClient {
     create(data: {
         name: string;
@@ -19,19 +26,20 @@ export declare class ApiKeysClient extends HttpClient {
         tenantId?: string;
         ipAllowlist?: string[];
         conditions?: Record<string, unknown>;
+        asSuperadmin?: boolean;
     }): Promise<CreateAPIKeyResponse>;
-    list(tenantId?: string): Promise<ListAPIKeysResponse>;
-    getById(id: string, tenantId?: string): Promise<APIKey>;
-    deleteById(id: string, tenantId?: string): Promise<void>;
-    rotate(id: string, name?: string, tenantId?: string): Promise<RotateAPIKeyResponse>;
-    updatePermissions(id: string, permissions: string[], tenantId?: string): Promise<APIKey>;
-    updateConditions(id: string, conditions: Record<string, unknown>, tenantId?: string): Promise<APIKey>;
-    setEnabled(id: string, enabled: boolean, tenantId?: string): Promise<APIKey>;
-    getPolicies(id: string, tenantId?: string): Promise<{
+    list(tenantId?: string, opts?: ApiKeyScope): Promise<ListAPIKeysResponse>;
+    getById(id: string, tenantId?: string, opts?: ApiKeyScope): Promise<APIKey>;
+    deleteById(id: string, tenantId?: string, opts?: ApiKeyScope): Promise<void>;
+    rotate(id: string, name?: string, tenantId?: string, opts?: ApiKeyScope): Promise<RotateAPIKeyResponse>;
+    updatePermissions(id: string, permissions: string[], tenantId?: string, opts?: ApiKeyScope): Promise<APIKey>;
+    updateConditions(id: string, conditions: Record<string, unknown>, tenantId?: string, opts?: ApiKeyScope): Promise<APIKey>;
+    setEnabled(id: string, enabled: boolean, tenantId?: string, opts?: ApiKeyScope): Promise<APIKey>;
+    getPolicies(id: string, tenantId?: string, opts?: ApiKeyScope): Promise<{
         policies: APIKeyPolicyAttachment[];
     }>;
-    attachPolicy(keyId: string, policyId: string, tenantId?: string): Promise<MessageResponse>;
-    detachPolicy(keyId: string, policyId: string, tenantId?: string): Promise<MessageResponse>;
+    attachPolicy(keyId: string, policyId: string, tenantId?: string, opts?: ApiKeyScope): Promise<MessageResponse>;
+    detachPolicy(keyId: string, policyId: string, tenantId?: string, opts?: ApiKeyScope): Promise<MessageResponse>;
     getSelf(): Promise<APIKeySelfResponse>;
     rotateSelf(name?: string): Promise<RotateAPIKeyResponse & {
         expiresInDays: number;

package/dist/lib/client/apikeys.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"apikeys.d.ts","sourceRoot":"","sources":["../../../src/lib/client/apikeys.ts"],"names":[],"mappings":"AAEA;;;;;;;;GAQG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AACvC,OAAO,KAAK,EACV,MAAM,EACN,oBAAoB,EACpB,mBAAmB,EACnB,oBAAoB,EACpB,kBAAkB,EAClB,sBAAsB,EACvB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AASlD,qBAAa,aAAc,SAAQ,UAAU;IACrC,MAAM,CAAC,IAAI,EAAE;QACjB,IAAI,EAAE,MAAM,CAAC;QACb,WAAW,CAAC,EAAE,MAAM,CAAC;QACrB,aAAa,CAAC,EAAE,MAAM,CAAC;QACvB,WAAW,EAAE,MAAM,EAAE,CAAC;QACtB,QAAQ,CAAC,EAAE,MAAM,CAAC;QAClB,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;QACvB,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;KACtC,GAAG,OAAO,CAAC,oBAAoB,CAAC;IAgB3B,IAAI,CAAC,QAAQ,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,mBAAmB,CAAC;IAQrD,OAAO,CAAC,EAAE,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAQvD,UAAU,CAAC,EAAE,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAQxD,MAAM,CAAC,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,oBAAoB,CAAC;IASnF,iBAAiB,CAAC,EAAE,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,EAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAUxF,gBAAgB,CAAC,EAAE,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAUrG,UAAU,CAAC,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAU5E,WAAW,CAAC,EAAE,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,QAAQ,EAAE,sBAAsB,EAAE,CAAA;KAAE,CAAC;IAQ3F,YAAY,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,CAAC;IAQ1F,YAAY,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,CAAC;IAQ1F,OAAO,IAAI,OAAO,CAAC,kBAAkB,CAAC;IAOtC,UAAU,CAAC,IAAI,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,oBAAoB,GAAG;QAAE,aAAa,EAAE,MAAM,CAAA;KAAE,CAAC;CAO3F"}
+{"version":3,"file":"apikeys.d.ts","sourceRoot":"","sources":["../../../src/lib/client/apikeys.ts"],"names":[],"mappings":"AAEA;;;;;;;;;;;;GAYG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AACvC,OAAO,KAAK,EACV,MAAM,EACN,oBAAoB,EACpB,mBAAmB,EACnB,oBAAoB,EACpB,kBAAkB,EAClB,sBAAsB,EACvB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AASlD,MAAM,WAAW,WAAW;IAC1B,YAAY,CAAC,EAAE,OAAO,CAAC;CACxB;AAED,qBAAa,aAAc,SAAQ,UAAU;IACrC,MAAM,CAAC,IAAI,EAAE;QACjB,IAAI,EAAE,MAAM,CAAC;QACb,WAAW,CAAC,EAAE,MAAM,CAAC;QACrB,aAAa,CAAC,EAAE,MAAM,CAAC;QACvB,WAAW,EAAE,MAAM,EAAE,CAAC;QACtB,QAAQ,CAAC,EAAE,MAAM,CAAC;QAClB,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;QACvB,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QACrC,YAAY,CAAC,EAAE,OAAO,CAAC;KACxB,GAAG,OAAO,CAAC,oBAAoB,CAAC;IAgB3B,IAAI,CAAC,QAAQ,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,mBAAmB,CAAC;IAQzE,OAAO,CAAC,EAAE,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,MAAM,CAAC;IAQ3E,UAAU,CAAC,EAAE,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC;IAQ5E,MAAM,CAAC,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,oBAAoB,CAAC;IASvG,iBAAiB,CAAC,EAAE,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,EAAE,QAAQ,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,MAAM,CAAC;IAU5G,gBAAgB,CAAC,EAAE,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,QAAQ,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,MAAM,CAAC;IAUzH,UAAU,CAAC,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,QAAQ,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,MAAM,CAAC;IAUhG,WAAW,CAAC,EAAE,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC;QAAE,QAAQ,EAAE,sBAAsB,EAAE,CAAA;KAAE,CAAC;IAQ/G,YAAY,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,eAAe,CAAC;IAQ9G,YAAY,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,eAAe,CAAC;IAQ9G,OAAO,IAAI,OAAO,CAAC,kBAAkB,CAAC;IAOtC,UAAU,CAAC,IAAI,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,oBAAoB,GAAG;QAAE,aAAa,EAAE,MAAM,CAAA;KAAE,CAAC;CAO3F"}

package/dist/lib/client/apikeys.js

@@ -3,22 +3,26 @@
  * API Key management client
  *
  * Routing policy:
- *   - When `tenantId` is supplied, the caller is acting as a superadmin and
+ *   - When `tenantId` is supplied OR the caller passes `asSuperadmin: true`,
  *     we target `/v1/superadmin/api-keys/*` (the cross-tenant surface).
- *   - When `tenantId` is omitted, the caller is a tenant principal and we
- *     target `/auth/api-keys/*` (tenant derived from JWT).
+ *   - Otherwise, we target `/auth/api-keys/*` (tenant principal; tenant
+ *     derived from JWT).
+ *
+ * The explicit `asSuperadmin` flag is required for `znvault superadmin
+ * apikey list` (no `--tenant`): the tenant surface rejects pure superadmin
+ * principals with "Superadmins must use /v1/superadmin/* routes".
  */
 import { HttpClient } from './http.js';
 const TENANT_BASE = '/auth/api-keys';
 const ADMIN_BASE = '/v1/superadmin/api-keys';
-function basePath(tenantId) {
-    return tenantId ? ADMIN_BASE : TENANT_BASE;
+function basePath(tenantId, asSuperadmin) {
+    return tenantId || asSuperadmin ? ADMIN_BASE : TENANT_BASE;
 }
 export class ApiKeysClient extends HttpClient {
     async create(data) {
         return this.request({
             method: 'POST',
-            path: basePath(data.tenantId),
+            path: basePath(data.tenantId, data.asSuperadmin),
             query: data.tenantId ? { tenantId: data.tenantId } : undefined,
             body: {
                 name: data.name,
@@ -30,80 +34,80 @@ export class ApiKeysClient extends HttpClient {
             },
         });
     }
-    async list(tenantId) {
+    async list(tenantId, opts) {
         return this.request({
             method: 'GET',
-            path: basePath(tenantId),
+            path: basePath(tenantId, opts?.asSuperadmin),
             query: tenantId ? { tenantId } : undefined,
         });
     }
-    async getById(id, tenantId) {
+    async getById(id, tenantId, opts) {
         return this.request({
             method: 'GET',
-            path: `${basePath(tenantId)}/${id}`,
+            path: `${basePath(tenantId, opts?.asSuperadmin)}/${id}`,
             query: tenantId ? { tenantId } : undefined,
         });
     }
-    async deleteById(id, tenantId) {
+    async deleteById(id, tenantId, opts) {
         await this.request({
             method: 'DELETE',
-            path: `${basePath(tenantId)}/${id}`,
+            path: `${basePath(tenantId, opts?.asSuperadmin)}/${id}`,
             query: tenantId ? { tenantId } : undefined,
         });
     }
-    async rotate(id, name, tenantId) {
+    async rotate(id, name, tenantId, opts) {
         return this.request({
             method: 'POST',
-            path: `${basePath(tenantId)}/${id}/rotate`,
+            path: `${basePath(tenantId, opts?.asSuperadmin)}/${id}/rotate`,
             query: tenantId ? { tenantId } : undefined,
             body: name ? { name } : {},
         });
     }
-    async updatePermissions(id, permissions, tenantId) {
+    async updatePermissions(id, permissions, tenantId, opts) {
         const response = await this.request({
             method: 'PATCH',
-            path: `${basePath(tenantId)}/${id}/permissions`,
+            path: `${basePath(tenantId, opts?.asSuperadmin)}/${id}/permissions`,
             query: tenantId ? { tenantId } : undefined,
             body: { permissions },
         });
         return response.apiKey;
     }
-    async updateConditions(id, conditions, tenantId) {
+    async updateConditions(id, conditions, tenantId, opts) {
         const response = await this.request({
             method: 'PATCH',
-            path: `${basePath(tenantId)}/${id}/conditions`,
+            path: `${basePath(tenantId, opts?.asSuperadmin)}/${id}/conditions`,
             query: tenantId ? { tenantId } : undefined,
             body: { conditions },
         });
         return response.apiKey;
     }
-    async setEnabled(id, enabled, tenantId) {
+    async setEnabled(id, enabled, tenantId, opts) {
         const response = await this.request({
             method: 'PATCH',
-            path: `${basePath(tenantId)}/${id}/enabled`,
+            path: `${basePath(tenantId, opts?.asSuperadmin)}/${id}/enabled`,
             query: tenantId ? { tenantId } : undefined,
             body: { enabled },
         });
         return response.apiKey;
     }
-    async getPolicies(id, tenantId) {
+    async getPolicies(id, tenantId, opts) {
         return this.request({
             method: 'GET',
-            path: `${basePath(tenantId)}/${id}/policies`,
+            path: `${basePath(tenantId, opts?.asSuperadmin)}/${id}/policies`,
             query: tenantId ? { tenantId } : undefined,
         });
     }
-    async attachPolicy(keyId, policyId, tenantId) {
+    async attachPolicy(keyId, policyId, tenantId, opts) {
         return this.request({
             method: 'POST',
-            path: `${basePath(tenantId)}/${keyId}/policies/${policyId}`,
+            path: `${basePath(tenantId, opts?.asSuperadmin)}/${keyId}/policies/${policyId}`,
             query: tenantId ? { tenantId } : undefined,
         });
     }
-    async detachPolicy(keyId, policyId, tenantId) {
+    async detachPolicy(keyId, policyId, tenantId, opts) {
         return this.request({
             method: 'DELETE',
-            path: `${basePath(tenantId)}/${keyId}/policies/${policyId}`,
+            path: `${basePath(tenantId, opts?.asSuperadmin)}/${keyId}/policies/${policyId}`,
             query: tenantId ? { tenantId } : undefined,
         });
     }

package/dist/lib/client/apikeys.js.map

@@ -1 +1 @@
-{"version":3,"file":"apikeys.js","sourceRoot":"","sources":["../../../src/lib/client/apikeys.ts"],"names":[],"mappings":"AAAA,kCAAkC;AAElC;;;;;;;;GAQG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AAWvC,MAAM,WAAW,GAAG,gBAAgB,CAAC;AACrC,MAAM,UAAU,GAAG,yBAAyB,CAAC;AAE7C,SAAS,QAAQ,CAAC,QAAiB;IACjC,OAAO,QAAQ,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,WAAW,CAAC;AAC7C,CAAC;AAED,MAAM,OAAO,aAAc,SAAQ,UAAU;IAC3C,KAAK,CAAC,MAAM,CAAC,IAQZ;QACC,OAAO,IAAI,CAAC,OAAO,CAAuB;YACxC,MAAM,EAAE,MAAM;YACd,IAAI,EAAE,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC;YAC7B,KAAK,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,SAAS;YAC9D,IAAI,EAAE;gBACJ,IAAI,EAAE,IAAI,CAAC,IAAI;gBACf,WAAW,EAAE,IAAI,CAAC,WAAW;gBAC7B,aAAa,EAAE,IAAI,CAAC,aAAa;gBACjC,WAAW,EAAE,IAAI,CAAC,WAAW;gBAC7B,WAAW,EAAE,IAAI,CAAC,WAAW;gBAC7B,UAAU,EAAE,IAAI,CAAC,UAAU;aAC5B;SACF,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,QAAiB;QAC1B,OAAO,IAAI,CAAC,OAAO,CAAsB;YACvC,MAAM,EAAE,KAAK;YACb,IAAI,EAAE,QAAQ,CAAC,QAAQ,CAAC;YACxB,KAAK,EAAE,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,SAAS;SAC3C,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,OAAO,CAAC,EAAU,EAAE,QAAiB;QACzC,OAAO,IAAI,CAAC,OAAO,CAAS;YAC1B,MAAM,EAAE,KAAK;YACb,IAAI,EAAE,GAAG,QAAQ,CAAC,QAAQ,CAAC,IAAI,EAAE,EAAE;YACnC,KAAK,EAAE,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,SAAS;SAC3C,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,UAAU,CAAC,EAAU,EAAE,QAAiB;QAC5C,MAAM,IAAI,CAAC,OAAO,CAAU;YAC1B,MAAM,EAAE,QAAQ;YAChB,IAAI,EAAE,GAAG,QAAQ,CAAC,QAAQ,CAAC,IAAI,EAAE,EAAE;YACnC,KAAK,EAAE,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,SAAS;SAC3C,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,EAAU,EAAE,IAAa,EAAE,QAAiB;QACvD,OAAO,IAAI,CAAC,OAAO,CAAuB;YACxC,MAAM,EAAE,MAAM;YACd,IAAI,EAAE,GAAG,QAAQ,CAAC,QAAQ,CAAC,IAAI,EAAE,SAAS;YAC1C,KAAK,EAAE,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,SAAS;YAC1C,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE;SAC3B,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,iBAAiB,CAAC,EAAU,EAAE,WAAqB,EAAE,QAAiB;QAC1E,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,OAAO,CAAsC;YACvE,MAAM,EAAE,OAAO;YACf,IAAI,EAAE,GAAG,QAAQ,CAAC,QAAQ,CAAC,IAAI,EAAE,cAAc;YAC/C,KAAK,EAAE,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,SAAS;YAC1C,IAAI,EAAE,EAAE,WAAW,EAAE;SACtB,CAAC,CAAC;QACH,OAAO,QAAQ,CAAC,MAAM,CAAC;IACzB,CAAC;IAED,KAAK,CAAC,gBAAgB,CAAC,EAAU,EAAE,UAAmC,EAAE,QAAiB;QACvF,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,OAAO,CAAsC;YACvE,MAAM,EAAE,OAAO;YACf,IAAI,EAAE,GAAG,QAAQ,CAAC,QAAQ,CAAC,IAAI,EAAE,aAAa;YAC9C,KAAK,EAAE,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,SAAS;YAC1C,IAAI,EAAE,EAAE,UAAU,EAAE;SACrB,CAAC,CAAC;QACH,OAAO,QAAQ,CAAC,MAAM,CAAC;IACzB,CAAC;IAED,KAAK,CAAC,UAAU,CAAC,EAAU,EAAE,OAAgB,EAAE,QAAiB;QAC9D,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,OAAO,CAAsC;YACvE,MAAM,EAAE,OAAO;YACf,IAAI,EAAE,GAAG,QAAQ,CAAC,QAAQ,CAAC,IAAI,EAAE,UAAU;YAC3C,KAAK,EAAE,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,SAAS;YAC1C,IAAI,EAAE,EAAE,OAAO,EAAE;SAClB,CAAC,CAAC;QACH,OAAO,QAAQ,CAAC,MAAM,CAAC;IACzB,CAAC;IAED,KAAK,CAAC,WAAW,CAAC,EAAU,EAAE,QAAiB;QAC7C,OAAO,IAAI,CAAC,OAAO,CAAyC;YAC1D,MAAM,EAAE,KAAK;YACb,IAAI,EAAE,GAAG,QAAQ,CAAC,QAAQ,CAAC,IAAI,EAAE,WAAW;YAC5C,KAAK,EAAE,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,SAAS;SAC3C,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,YAAY,CAAC,KAAa,EAAE,QAAgB,EAAE,QAAiB;QACnE,OAAO,IAAI,CAAC,OAAO,CAAkB;YACnC,MAAM,EAAE,MAAM;YACd,IAAI,EAAE,GAAG,QAAQ,CAAC,QAAQ,CAAC,IAAI,KAAK,aAAa,QAAQ,EAAE;YAC3D,KAAK,EAAE,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,SAAS;SAC3C,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,YAAY,CAAC,KAAa,EAAE,QAAgB,EAAE,QAAiB;QACnE,OAAO,IAAI,CAAC,OAAO,CAAkB;YACnC,MAAM,EAAE,QAAQ;YAChB,IAAI,EAAE,GAAG,QAAQ,CAAC,QAAQ,CAAC,IAAI,KAAK,aAAa,QAAQ,EAAE;YAC3D,KAAK,EAAE,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,SAAS;SAC3C,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,OAAO;QACX,OAAO,IAAI,CAAC,OAAO,CAAqB;YACtC,MAAM,EAAE,KAAK;YACb,IAAI,EAAE,qBAAqB;SAC5B,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,UAAU,CAAC,IAAa;QAC5B,OAAO,IAAI,CAAC,OAAO,CAAmD;YACpE,MAAM,EAAE,MAAM;YACd,IAAI,EAAE,4BAA4B;YAClC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE;SAC3B,CAAC,CAAC;IACL,CAAC;CACF"}
+{"version":3,"file":"apikeys.js","sourceRoot":"","sources":["../../../src/lib/client/apikeys.ts"],"names":[],"mappings":"AAAA,kCAAkC;AAElC;;;;;;;;;;;;GAYG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AAWvC,MAAM,WAAW,GAAG,gBAAgB,CAAC;AACrC,MAAM,UAAU,GAAG,yBAAyB,CAAC;AAE7C,SAAS,QAAQ,CAAC,QAAiB,EAAE,YAAsB;IACzD,OAAO,QAAQ,IAAI,YAAY,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,WAAW,CAAC;AAC7D,CAAC;AAMD,MAAM,OAAO,aAAc,SAAQ,UAAU;IAC3C,KAAK,CAAC,MAAM,CAAC,IASZ;QACC,OAAO,IAAI,CAAC,OAAO,CAAuB;YACxC,MAAM,EAAE,MAAM;YACd,IAAI,EAAE,QAAQ,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,YAAY,CAAC;YAChD,KAAK,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,SAAS;YAC9D,IAAI,EAAE;gBACJ,IAAI,EAAE,IAAI,CAAC,IAAI;gBACf,WAAW,EAAE,IAAI,CAAC,WAAW;gBAC7B,aAAa,EAAE,IAAI,CAAC,aAAa;gBACjC,WAAW,EAAE,IAAI,CAAC,WAAW;gBAC7B,WAAW,EAAE,IAAI,CAAC,WAAW;gBAC7B,UAAU,EAAE,IAAI,CAAC,UAAU;aAC5B;SACF,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,QAAiB,EAAE,IAAkB;QAC9C,OAAO,IAAI,CAAC,OAAO,CAAsB;YACvC,MAAM,EAAE,KAAK;YACb,IAAI,EAAE,QAAQ,CAAC,QAAQ,EAAE,IAAI,EAAE,YAAY,CAAC;YAC5C,KAAK,EAAE,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,SAAS;SAC3C,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,OAAO,CAAC,EAAU,EAAE,QAAiB,EAAE,IAAkB;QAC7D,OAAO,IAAI,CAAC,OAAO,CAAS;YAC1B,MAAM,EAAE,KAAK;YACb,IAAI,EAAE,GAAG,QAAQ,CAAC,QAAQ,EAAE,IAAI,EAAE,YAAY,CAAC,IAAI,EAAE,EAAE;YACvD,KAAK,EAAE,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,SAAS;SAC3C,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,UAAU,CAAC,EAAU,EAAE,QAAiB,EAAE,IAAkB;QAChE,MAAM,IAAI,CAAC,OAAO,CAAU;YAC1B,MAAM,EAAE,QAAQ;YAChB,IAAI,EAAE,GAAG,QAAQ,CAAC,QAAQ,EAAE,IAAI,EAAE,YAAY,CAAC,IAAI,EAAE,EAAE;YACvD,KAAK,EAAE,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,SAAS;SAC3C,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,EAAU,EAAE,IAAa,EAAE,QAAiB,EAAE,IAAkB;QAC3E,OAAO,IAAI,CAAC,OAAO,CAAuB;YACxC,MAAM,EAAE,MAAM;YACd,IAAI,EAAE,GAAG,QAAQ,CAAC,QAAQ,EAAE,IAAI,EAAE,YAAY,CAAC,IAAI,EAAE,SAAS;YAC9D,KAAK,EAAE,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,SAAS;YAC1C,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE;SAC3B,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,iBAAiB,CAAC,EAAU,EAAE,WAAqB,EAAE,QAAiB,EAAE,IAAkB;QAC9F,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,OAAO,CAAsC;YACvE,MAAM,EAAE,OAAO;YACf,IAAI,EAAE,GAAG,QAAQ,CAAC,QAAQ,EAAE,IAAI,EAAE,YAAY,CAAC,IAAI,EAAE,cAAc;YACnE,KAAK,EAAE,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,SAAS;YAC1C,IAAI,EAAE,EAAE,WAAW,EAAE;SACtB,CAAC,CAAC;QACH,OAAO,QAAQ,CAAC,MAAM,CAAC;IACzB,CAAC;IAED,KAAK,CAAC,gBAAgB,CAAC,EAAU,EAAE,UAAmC,EAAE,QAAiB,EAAE,IAAkB;QAC3G,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,OAAO,CAAsC;YACvE,MAAM,EAAE,OAAO;YACf,IAAI,EAAE,GAAG,QAAQ,CAAC,QAAQ,EAAE,IAAI,EAAE,YAAY,CAAC,IAAI,EAAE,aAAa;YAClE,KAAK,EAAE,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,SAAS;YAC1C,IAAI,EAAE,EAAE,UAAU,EAAE;SACrB,CAAC,CAAC;QACH,OAAO,QAAQ,CAAC,MAAM,CAAC;IACzB,CAAC;IAED,KAAK,CAAC,UAAU,CAAC,EAAU,EAAE,OAAgB,EAAE,QAAiB,EAAE,IAAkB;QAClF,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,OAAO,CAAsC;YACvE,MAAM,EAAE,OAAO;YACf,IAAI,EAAE,GAAG,QAAQ,CAAC,QAAQ,EAAE,IAAI,EAAE,YAAY,CAAC,IAAI,EAAE,UAAU;YAC/D,KAAK,EAAE,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,SAAS;YAC1C,IAAI,EAAE,EAAE,OAAO,EAAE;SAClB,CAAC,CAAC;QACH,OAAO,QAAQ,CAAC,MAAM,CAAC;IACzB,CAAC;IAED,KAAK,CAAC,WAAW,CAAC,EAAU,EAAE,QAAiB,EAAE,IAAkB;QACjE,OAAO,IAAI,CAAC,OAAO,CAAyC;YAC1D,MAAM,EAAE,KAAK;YACb,IAAI,EAAE,GAAG,QAAQ,CAAC,QAAQ,EAAE,IAAI,EAAE,YAAY,CAAC,IAAI,EAAE,WAAW;YAChE,KAAK,EAAE,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,SAAS;SAC3C,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,YAAY,CAAC,KAAa,EAAE,QAAgB,EAAE,QAAiB,EAAE,IAAkB;QACvF,OAAO,IAAI,CAAC,OAAO,CAAkB;YACnC,MAAM,EAAE,MAAM;YACd,IAAI,EAAE,GAAG,QAAQ,CAAC,QAAQ,EAAE,IAAI,EAAE,YAAY,CAAC,IAAI,KAAK,aAAa,QAAQ,EAAE;YAC/E,KAAK,EAAE,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,SAAS;SAC3C,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,YAAY,CAAC,KAAa,EAAE,QAAgB,EAAE,QAAiB,EAAE,IAAkB;QACvF,OAAO,IAAI,CAAC,OAAO,CAAkB;YACnC,MAAM,EAAE,QAAQ;YAChB,IAAI,EAAE,GAAG,QAAQ,CAAC,QAAQ,EAAE,IAAI,EAAE,YAAY,CAAC,IAAI,KAAK,aAAa,QAAQ,EAAE;YAC/E,KAAK,EAAE,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,SAAS;SAC3C,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,OAAO;QACX,OAAO,IAAI,CAAC,OAAO,CAAqB;YACtC,MAAM,EAAE,KAAK;YACb,IAAI,EAAE,qBAAqB;SAC5B,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,UAAU,CAAC,IAAa;QAC5B,OAAO,IAAI,CAAC,OAAO,CAAmD;YACpE,MAAM,EAAE,MAAM;YACd,IAAI,EAAE,4BAA4B;YAClC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE;SAC3B,CAAC,CAAC;IACL,CAAC;CACF"}

package/dist/lib/client/audit.d.ts

@@ -1,8 +1,31 @@
 /**
  * Audit log client
+ *
+ * Routing:
+ *   - `asSuperadmin: true` → `/v1/superadmin/audit*` (cross-tenant; required
+ *     when the caller is a superadmin under `znvault superadmin audit`).
+ *   - otherwise → `/v1/audit*` (tenant-scoped; tenant derived from JWT).
+ *
+ * Superadmins MUST use the `/v1/superadmin/*` surface; the tenant-scoped
+ * surface rejects superadmin principals with
+ * "Superadmins must use /v1/superadmin/* routes".
+ *
+ * Note: the tenant and superadmin namespaces use different query schemas:
+ *   - tenant `/v1/audit`: snake_case (`client_cn`, `start_date`, `end_date`)
+ *   - admin `/v1/superadmin/audit`: camelCase (`username`, `startDate`,
+ *     `endDate`); also supports `tenantId` filter.
+ * The admin namespace exposes only `GET /v1/superadmin/audit` (list) and
+ * `GET /v1/superadmin/audit/stats`. There is no superadmin /verify or
+ * /export endpoint — so for those operations the client routes through the
+ * superadmin list path with an optional `tenantId` filter when in admin
+ * mode, and through the tenant `/v1/audit/verify` & `/v1/audit/export`
+ * routes otherwise.
  */
 import { HttpClient } from './http.js';
 import type { AuditEntry, AuditVerifyResult } from '../../types/index.js';
+export interface AuditScopeOptions {
+    asSuperadmin?: boolean;
+}
 export declare class AuditClient extends HttpClient {
     list(options?: {
         user?: string;
@@ -10,12 +33,42 @@ export declare class AuditClient extends HttpClient {
         startDate?: string;
         endDate?: string;
         limit?: number;
+        tenantId?: string;
+        asSuperadmin?: boolean;
     }): Promise<AuditEntry[]>;
-    verifyChain(): Promise<AuditVerifyResult>;
+    /**
+     * Verify the HMAC chain integrity of audit logs.
+     *
+     * Only the tenant-scoped surface exposes `/v1/audit/verify`. When called
+     * with `asSuperadmin: true`, the request still targets `/v1/audit/verify`
+     * which will reject a pure superadmin principal — surface that error to
+     * the caller rather than silently no-op.
+     */
+    verifyChain(_opts?: AuditScopeOptions): Promise<AuditVerifyResult>;
+    /**
+     * Export audit logs.
+     *
+     * - In tenant mode, hits `/v1/audit/export` (CSV/JSON download).
+     * - In superadmin mode, the server only exposes `/v1/superadmin/audit`
+     *   (list) — there is no dedicated export endpoint. We hit the list
+     *   endpoint with a high `limit` so the caller can still serialize the
+     *   resulting JSON to disk. CSV is not supported in admin mode.
+     */
     export(options?: {
         format?: 'json' | 'csv';
         startDate?: string;
         endDate?: string;
+        tenantId?: string;
+        asSuperadmin?: boolean;
     }): Promise<string>;
+    /**
+     * Audit statistics summary.
+     *
+     * Available on both tenant (`/v1/audit/stats`) and admin
+     * (`/v1/superadmin/audit/stats`) surfaces.
+     */
+    getStats(opts?: AuditScopeOptions & {
+        tenantId?: string;
+    }): Promise<unknown>;
 }
 //# sourceMappingURL=audit.d.ts.map

package/dist/lib/client/audit.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"audit.d.ts","sourceRoot":"","sources":["../../../src/lib/client/audit.ts"],"names":[],"mappings":"AAEA;;GAEG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AACvC,OAAO,KAAK,EACV,UAAU,EACV,iBAAiB,EAElB,MAAM,sBAAsB,CAAC;AAE9B,qBAAa,WAAY,SAAQ,UAAU;IACnC,IAAI,CAAC,OAAO,CAAC,EAAE;QACnB,IAAI,CAAC,EAAE,MAAM,CAAC;QACd,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,OAAO,CAAC,EAAE,MAAM,CAAC;QACjB,KAAK,CAAC,EAAE,MAAM,CAAC;KAChB,GAAG,OAAO,CAAC,UAAU,EAAE,CAAC;IAenB,WAAW,IAAI,OAAO,CAAC,iBAAiB,CAAC;IAOzC,MAAM,CAAC,OAAO,CAAC,EAAE;QACrB,MAAM,CAAC,EAAE,MAAM,GAAG,KAAK,CAAC;QACxB,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,OAAO,CAAC,EAAE,MAAM,CAAC;KAClB,GAAG,OAAO,CAAC,MAAM,CAAC;CAYpB"}
+{"version":3,"file":"audit.d.ts","sourceRoot":"","sources":["../../../src/lib/client/audit.ts"],"names":[],"mappings":"AAEA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AACvC,OAAO,KAAK,EACV,UAAU,EACV,iBAAiB,EAElB,MAAM,sBAAsB,CAAC;AAK9B,MAAM,WAAW,iBAAiB;IAChC,YAAY,CAAC,EAAE,OAAO,CAAC;CACxB;AAED,qBAAa,WAAY,SAAQ,UAAU;IACnC,IAAI,CAAC,OAAO,CAAC,EAAE;QACnB,IAAI,CAAC,EAAE,MAAM,CAAC;QACd,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,OAAO,CAAC,EAAE,MAAM,CAAC;QACjB,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,QAAQ,CAAC,EAAE,MAAM,CAAC;QAClB,YAAY,CAAC,EAAE,OAAO,CAAC;KACxB,GAAG,OAAO,CAAC,UAAU,EAAE,CAAC;IA0BzB;;;;;;;OAOG;IACG,WAAW,CAAC,KAAK,CAAC,EAAE,iBAAiB,GAAG,OAAO,CAAC,iBAAiB,CAAC;IAOxE;;;;;;;;OAQG;IACG,MAAM,CAAC,OAAO,CAAC,EAAE;QACrB,MAAM,CAAC,EAAE,MAAM,GAAG,KAAK,CAAC;QACxB,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,OAAO,CAAC,EAAE,MAAM,CAAC;QACjB,QAAQ,CAAC,EAAE,MAAM,CAAC;QAClB,YAAY,CAAC,EAAE,OAAO,CAAC;KACxB,GAAG,OAAO,CAAC,MAAM,CAAC;IA0BnB;;;;;OAKG;IACG,QAAQ,CAAC,IAAI,CAAC,EAAE,iBAAiB,GAAG;QAAE,QAAQ,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,OAAO,CAAC;CAOnF"}

package/dist/lib/client/audit.js

@@ -1,40 +1,114 @@
 // Path: src/lib/client/audit.ts
 /**
  * Audit log client
+ *
+ * Routing:
+ *   - `asSuperadmin: true` → `/v1/superadmin/audit*` (cross-tenant; required
+ *     when the caller is a superadmin under `znvault superadmin audit`).
+ *   - otherwise → `/v1/audit*` (tenant-scoped; tenant derived from JWT).
+ *
+ * Superadmins MUST use the `/v1/superadmin/*` surface; the tenant-scoped
+ * surface rejects superadmin principals with
+ * "Superadmins must use /v1/superadmin/* routes".
+ *
+ * Note: the tenant and superadmin namespaces use different query schemas:
+ *   - tenant `/v1/audit`: snake_case (`client_cn`, `start_date`, `end_date`)
+ *   - admin `/v1/superadmin/audit`: camelCase (`username`, `startDate`,
+ *     `endDate`); also supports `tenantId` filter.
+ * The admin namespace exposes only `GET /v1/superadmin/audit` (list) and
+ * `GET /v1/superadmin/audit/stats`. There is no superadmin /verify or
+ * /export endpoint — so for those operations the client routes through the
+ * superadmin list path with an optional `tenantId` filter when in admin
+ * mode, and through the tenant `/v1/audit/verify` & `/v1/audit/export`
+ * routes otherwise.
  */
 import { HttpClient } from './http.js';
+const TENANT_BASE = '/v1/audit';
+const ADMIN_BASE = '/v1/superadmin/audit';
 export class AuditClient extends HttpClient {
     async list(options) {
-        const response = await this.request({
-            method: 'GET',
-            path: '/v1/audit',
-            query: {
+        const query = options?.asSuperadmin
+            ? {
+                username: options.user,
+                action: options.action,
+                startDate: options.startDate,
+                endDate: options.endDate,
+                limit: options.limit ?? 100,
+                tenantId: options.tenantId,
+            }
+            : {
                 client_cn: options?.user,
                 action: options?.action,
                 start_date: options?.startDate,
                 end_date: options?.endDate,
                 limit: options?.limit ?? 100,
-            },
+            };
+        const response = await this.request({
+            method: 'GET',
+            path: options?.asSuperadmin ? ADMIN_BASE : TENANT_BASE,
+            query,
         });
         return response.items;
     }
-    async verifyChain() {
+    /**
+     * Verify the HMAC chain integrity of audit logs.
+     *
+     * Only the tenant-scoped surface exposes `/v1/audit/verify`. When called
+     * with `asSuperadmin: true`, the request still targets `/v1/audit/verify`
+     * which will reject a pure superadmin principal — surface that error to
+     * the caller rather than silently no-op.
+     */
+    async verifyChain(_opts) {
         return this.request({
             method: 'GET',
-            path: '/v1/audit/verify',
+            path: `${TENANT_BASE}/verify`,
         });
     }
+    /**
+     * Export audit logs.
+     *
+     * - In tenant mode, hits `/v1/audit/export` (CSV/JSON download).
+     * - In superadmin mode, the server only exposes `/v1/superadmin/audit`
+     *   (list) — there is no dedicated export endpoint. We hit the list
+     *   endpoint with a high `limit` so the caller can still serialize the
+     *   resulting JSON to disk. CSV is not supported in admin mode.
+     */
     async export(options) {
+        if (options?.asSuperadmin) {
+            const response = await this.request({
+                method: 'GET',
+                path: ADMIN_BASE,
+                query: {
+                    startDate: options.startDate,
+                    endDate: options.endDate,
+                    tenantId: options.tenantId,
+                    limit: 10000,
+                },
+            });
+            return JSON.stringify(response.items);
+        }
         return this.request({
             method: 'GET',
-            path: '/v1/audit',
+            path: `${TENANT_BASE}/export`,
             query: {
                 format: options?.format ?? 'json',
                 start_date: options?.startDate,
                 end_date: options?.endDate,
-                limit: 10000,
             },
         });
     }
+    /**
+     * Audit statistics summary.
+     *
+     * Available on both tenant (`/v1/audit/stats`) and admin
+     * (`/v1/superadmin/audit/stats`) surfaces.
+     */
+    async getStats(opts) {
+        return this.request({
+            method: 'GET',
+            path: opts?.asSuperadmin ? `${ADMIN_BASE}/stats` : `${TENANT_BASE}/stats`,
+            query: opts?.tenantId ? { tenantId: opts.tenantId } : undefined,
+        });
+    }
 }
 //# sourceMappingURL=audit.js.map

package/dist/lib/client/audit.js.map

@@ -1 +1 @@
-{"version":3,"file":"audit.js","sourceRoot":"","sources":["../../../src/lib/client/audit.ts"],"names":[],"mappings":"AAAA,gCAAgC;AAEhC;;GAEG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AAOvC,MAAM,OAAO,WAAY,SAAQ,UAAU;IACzC,KAAK,CAAC,IAAI,CAAC,OAMV;QACC,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,OAAO,CAAgC;YACjE,MAAM,EAAE,KAAK;YACb,IAAI,EAAE,WAAW;YACjB,KAAK,EAAE;gBACL,SAAS,EAAE,OAAO,EAAE,IAAI;gBACxB,MAAM,EAAE,OAAO,EAAE,MAAM;gBACvB,UAAU,EAAE,OAAO,EAAE,SAAS;gBAC9B,QAAQ,EAAE,OAAO,EAAE,OAAO;gBAC1B,KAAK,EAAE,OAAO,EAAE,KAAK,IAAI,GAAG;aAC7B;SACF,CAAC,CAAC;QACH,OAAO,QAAQ,CAAC,KAAK,CAAC;IACxB,CAAC;IAED,KAAK,CAAC,WAAW;QACf,OAAO,IAAI,CAAC,OAAO,CAAoB;YACrC,MAAM,EAAE,KAAK;YACb,IAAI,EAAE,kBAAkB;SACzB,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,OAIZ;QACC,OAAO,IAAI,CAAC,OAAO,CAAS;YAC1B,MAAM,EAAE,KAAK;YACb,IAAI,EAAE,WAAW;YACjB,KAAK,EAAE;gBACL,MAAM,EAAE,OAAO,EAAE,MAAM,IAAI,MAAM;gBACjC,UAAU,EAAE,OAAO,EAAE,SAAS;gBAC9B,QAAQ,EAAE,OAAO,EAAE,OAAO;gBAC1B,KAAK,EAAE,KAAK;aACb;SACF,CAAC,CAAC;IACL,CAAC;CACF"}
+{"version":3,"file":"audit.js","sourceRoot":"","sources":["../../../src/lib/client/audit.ts"],"names":[],"mappings":"AAAA,gCAAgC;AAEhC;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AAOvC,MAAM,WAAW,GAAG,WAAW,CAAC;AAChC,MAAM,UAAU,GAAG,sBAAsB,CAAC;AAM1C,MAAM,OAAO,WAAY,SAAQ,UAAU;IACzC,KAAK,CAAC,IAAI,CAAC,OAQV;QACC,MAAM,KAAK,GAA0D,OAAO,EAAE,YAAY;YACxF,CAAC,CAAC;gBACE,QAAQ,EAAE,OAAO,CAAC,IAAI;gBACtB,MAAM,EAAE,OAAO,CAAC,MAAM;gBACtB,SAAS,EAAE,OAAO,CAAC,SAAS;gBAC5B,OAAO,EAAE,OAAO,CAAC,OAAO;gBACxB,KAAK,EAAE,OAAO,CAAC,KAAK,IAAI,GAAG;gBAC3B,QAAQ,EAAE,OAAO,CAAC,QAAQ;aAC3B;YACH,CAAC,CAAC;gBACE,SAAS,EAAE,OAAO,EAAE,IAAI;gBACxB,MAAM,EAAE,OAAO,EAAE,MAAM;gBACvB,UAAU,EAAE,OAAO,EAAE,SAAS;gBAC9B,QAAQ,EAAE,OAAO,EAAE,OAAO;gBAC1B,KAAK,EAAE,OAAO,EAAE,KAAK,IAAI,GAAG;aAC7B,CAAC;QAEN,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,OAAO,CAAgC;YACjE,MAAM,EAAE,KAAK;YACb,IAAI,EAAE,OAAO,EAAE,YAAY,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,WAAW;YACtD,KAAK;SACN,CAAC,CAAC;QACH,OAAO,QAAQ,CAAC,KAAK,CAAC;IACxB,CAAC;IAED;;;;;;;OAOG;IACH,KAAK,CAAC,WAAW,CAAC,KAAyB;QACzC,OAAO,IAAI,CAAC,OAAO,CAAoB;YACrC,MAAM,EAAE,KAAK;YACb,IAAI,EAAE,GAAG,WAAW,SAAS;SAC9B,CAAC,CAAC;IACL,CAAC;IAED;;;;;;;;OAQG;IACH,KAAK,CAAC,MAAM,CAAC,OAMZ;QACC,IAAI,OAAO,EAAE,YAAY,EAAE,CAAC;YAC1B,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,OAAO,CAAgC;gBACjE,MAAM,EAAE,KAAK;gBACb,IAAI,EAAE,UAAU;gBAChB,KAAK,EAAE;oBACL,SAAS,EAAE,OAAO,CAAC,SAAS;oBAC5B,OAAO,EAAE,OAAO,CAAC,OAAO;oBACxB,QAAQ,EAAE,OAAO,CAAC,QAAQ;oBAC1B,KAAK,EAAE,KAAK;iBACb;aACF,CAAC,CAAC;YACH,OAAO,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;QACxC,CAAC;QAED,OAAO,IAAI,CAAC,OAAO,CAAS;YAC1B,MAAM,EAAE,KAAK;YACb,IAAI,EAAE,GAAG,WAAW,SAAS;YAC7B,KAAK,EAAE;gBACL,MAAM,EAAE,OAAO,EAAE,MAAM,IAAI,MAAM;gBACjC,UAAU,EAAE,OAAO,EAAE,SAAS;gBAC9B,QAAQ,EAAE,OAAO,EAAE,OAAO;aAC3B;SACF,CAAC,CAAC;IACL,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,QAAQ,CAAC,IAAgD;QAC7D,OAAO,IAAI,CAAC,OAAO,CAAU;YAC3B,MAAM,EAAE,KAAK;YACb,IAAI,EAAE,IAAI,EAAE,YAAY,CAAC,CAAC,CAAC,GAAG,UAAU,QAAQ,CAAC,CAAC,CAAC,GAAG,WAAW,QAAQ;YACzE,KAAK,EAAE,IAAI,EAAE,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,SAAS;SAChE,CAAC,CAAC;IACL,CAAC;CACF"}