@zincapp/znvault-cli 3.3.1 → 4.0.2

package/dist/lib/client/policies.js

@@ -11,14 +11,14 @@
 import { HttpClient } from './http.js';
 const TENANT_BASE = '/v1/policies';
 const ADMIN_BASE = '/v1/superadmin/policies';
-function basePath(tenantId) {
-    return tenantId ? ADMIN_BASE : TENANT_BASE;
+function basePath(tenantId, asSuperadmin) {
+    return tenantId || asSuperadmin ? ADMIN_BASE : TENANT_BASE;
 }
 export class PoliciesClient extends HttpClient {
     async list(options) {
         return this.request({
             method: 'GET',
-            path: basePath(options?.tenantId),
+            path: basePath(options?.tenantId, options?.asSuperadmin),
             query: {
                 tenantId: options?.tenantId,
                 enabled: options?.enabled,
@@ -29,10 +29,10 @@ export class PoliciesClient extends HttpClient {
             },
         });
     }
-    async getById(id, tenantId) {
+    async getById(id, tenantId, opts) {
         return this.request({
             method: 'GET',
-            path: `${basePath(tenantId)}/${id}`,
+            path: `${basePath(tenantId, opts?.asSuperadmin)}/${id}`,
             query: tenantId ? { tenantId } : undefined,
         });
     }
@@ -42,30 +42,30 @@ export class PoliciesClient extends HttpClient {
         const tenantId = data.tenantId;
         return this.request({
             method: 'POST',
-            path: basePath(tenantId),
+            path: basePath(tenantId, data.asSuperadmin),
             query: tenantId ? { tenantId } : undefined,
             body: data,
         });
     }
-    async update(id, data, tenantId) {
+    async update(id, data, tenantId, opts) {
         return this.request({
             method: 'PATCH',
-            path: `${basePath(tenantId)}/${id}`,
+            path: `${basePath(tenantId, opts?.asSuperadmin)}/${id}`,
             query: tenantId ? { tenantId } : undefined,
             body: data,
         });
     }
-    async deleteById(id, tenantId) {
+    async deleteById(id, tenantId, opts) {
         await this.request({
             method: 'DELETE',
-            path: `${basePath(tenantId)}/${id}`,
+            path: `${basePath(tenantId, opts?.asSuperadmin)}/${id}`,
             query: tenantId ? { tenantId } : undefined,
         });
     }
-    async toggle(id, enabled, tenantId) {
+    async toggle(id, enabled, tenantId, opts) {
         return this.request({
             method: 'POST',
-            path: `${basePath(tenantId)}/${id}/toggle`,
+            path: `${basePath(tenantId, opts?.asSuperadmin)}/${id}/toggle`,
             query: tenantId ? { tenantId } : undefined,
             body: { enabled },
         });
@@ -77,40 +77,40 @@ export class PoliciesClient extends HttpClient {
             body: policy,
         });
     }
-    async getAttachments(policyId, tenantId) {
+    async getAttachments(policyId, tenantId, opts) {
         return this.request({
             method: 'GET',
-            path: `${basePath(tenantId)}/${policyId}/attachments`,
+            path: `${basePath(tenantId, opts?.asSuperadmin)}/${policyId}/attachments`,
             query: tenantId ? { tenantId } : undefined,
         });
     }
-    async attachToUser(policyId, userId, tenantId) {
+    async attachToUser(policyId, userId, tenantId, opts) {
         return this.request({
             method: 'POST',
-            path: `${basePath(tenantId)}/${policyId}/attach/user`,
+            path: `${basePath(tenantId, opts?.asSuperadmin)}/${policyId}/attach/user`,
             query: tenantId ? { tenantId } : undefined,
             body: { userId },
         });
     }
-    async attachToRole(policyId, roleId, tenantId) {
+    async attachToRole(policyId, roleId, tenantId, opts) {
         return this.request({
             method: 'POST',
-            path: `${basePath(tenantId)}/${policyId}/attach/role`,
+            path: `${basePath(tenantId, opts?.asSuperadmin)}/${policyId}/attach/role`,
             query: tenantId ? { tenantId } : undefined,
             body: { roleId },
         });
     }
-    async detachFromUser(policyId, userId, tenantId) {
+    async detachFromUser(policyId, userId, tenantId, opts) {
         return this.request({
             method: 'DELETE',
-            path: `${basePath(tenantId)}/${policyId}/attach/user/${userId}`,
+            path: `${basePath(tenantId, opts?.asSuperadmin)}/${policyId}/attach/user/${userId}`,
             query: tenantId ? { tenantId } : undefined,
         });
     }
-    async detachFromRole(policyId, roleId, tenantId) {
+    async detachFromRole(policyId, roleId, tenantId, opts) {
         return this.request({
             method: 'DELETE',
-            path: `${basePath(tenantId)}/${policyId}/attach/role/${roleId}`,
+            path: `${basePath(tenantId, opts?.asSuperadmin)}/${policyId}/attach/role/${roleId}`,
             query: tenantId ? { tenantId } : undefined,
         });
     }

package/dist/lib/client/policies.js.map

@@ -1 +1 @@
-{"version":3,"file":"policies.js","sourceRoot":"","sources":["../../../src/lib/client/policies.ts"],"names":[],"mappings":"AAAA,mCAAmC;AAEnC;;;;;;;;GAQG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AAiBvC,MAAM,WAAW,GAAG,cAAc,CAAC;AACnC,MAAM,UAAU,GAAG,yBAAyB,CAAC;AAE7C,SAAS,QAAQ,CAAC,QAAiB;IACjC,OAAO,QAAQ,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,WAAW,CAAC;AAC7C,CAAC;AAED,MAAM,OAAO,cAAe,SAAQ,UAAU;IAC5C,KAAK,CAAC,IAAI,CAAC,OAOV;QACC,OAAO,IAAI,CAAC,OAAO,CAAqB;YACtC,MAAM,EAAE,KAAK;YACb,IAAI,EAAE,QAAQ,CAAC,OAAO,EAAE,QAAQ,CAAC;YACjC,KAAK,EAAE;gBACL,QAAQ,EAAE,OAAO,EAAE,QAAQ;gBAC3B,OAAO,EAAE,OAAO,EAAE,OAAO;gBACzB,MAAM,EAAE,OAAO,EAAE,MAAM;gBACvB,MAAM,EAAE,OAAO,EAAE,MAAM;gBACvB,IAAI,EAAE,OAAO,EAAE,IAAI;gBACnB,QAAQ,EAAE,OAAO,EAAE,QAAQ,IAAI,GAAG;aACnC;SACF,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,OAAO,CAAC,EAAU,EAAE,QAAiB;QACzC,OAAO,IAAI,CAAC,OAAO,CAAS;YAC1B,MAAM,EAAE,KAAK;YACb,IAAI,EAAE,GAAG,QAAQ,CAAC,QAAQ,CAAC,IAAI,EAAE,EAAE;YACnC,KAAK,EAAE,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,SAAS;SAC3C,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,IAAuB;QAClC,wEAAwE;QACxE,uEAAuE;QACvE,MAAM,QAAQ,GAAI,IAA8B,CAAC,QAAQ,CAAC;QAC1D,OAAO,IAAI,CAAC,OAAO,CAAS;YAC1B,MAAM,EAAE,MAAM;YACd,IAAI,EAAE,QAAQ,CAAC,QAAQ,CAAC;YACxB,KAAK,EAAE,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,SAAS;YAC1C,IAAI,EAAE,IAAI;SACX,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,EAAU,EAAE,IAAuB,EAAE,QAAiB;QACjE,OAAO,IAAI,CAAC,OAAO,CAAS;YAC1B,MAAM,EAAE,OAAO;YACf,IAAI,EAAE,GAAG,QAAQ,CAAC,QAAQ,CAAC,IAAI,EAAE,EAAE;YACnC,KAAK,EAAE,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,SAAS;YAC1C,IAAI,EAAE,IAAI;SACX,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,UAAU,CAAC,EAAU,EAAE,QAAiB;QAC5C,MAAM,IAAI,CAAC,OAAO,CAAU;YAC1B,MAAM,EAAE,QAAQ;YAChB,IAAI,EAAE,GAAG,QAAQ,CAAC,QAAQ,CAAC,IAAI,EAAE,EAAE;YACnC,KAAK,EAAE,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,SAAS;SAC3C,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,EAAU,EAAE,OAAgB,EAAE,QAAiB;QAC1D,OAAO,IAAI,CAAC,OAAO,CAAS;YAC1B,MAAM,EAAE,MAAM;YACd,IAAI,EAAE,GAAG,QAAQ,CAAC,QAAQ,CAAC,IAAI,EAAE,SAAS;YAC1C,KAAK,EAAE,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,SAAS;YAC1C,IAAI,EAAE,EAAE,OAAO,EAAE;SAClB,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,QAAQ,CAAC,MAAyB;QACtC,OAAO,IAAI,CAAC,OAAO,CAAyB;YAC1C,MAAM,EAAE,MAAM;YACd,IAAI,EAAE,uBAAuB;YAC7B,IAAI,EAAE,MAAM;SACb,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,cAAc,CAAC,QAAgB,EAAE,QAAiB;QACtD,OAAO,IAAI,CAAC,OAAO,CAA4B;YAC7C,MAAM,EAAE,KAAK;YACb,IAAI,EAAE,GAAG,QAAQ,CAAC,QAAQ,CAAC,IAAI,QAAQ,cAAc;YACrD,KAAK,EAAE,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,SAAS;SAC3C,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,YAAY,CAAC,QAAgB,EAAE,MAAc,EAAE,QAAiB;QACpE,OAAO,IAAI,CAAC,OAAO,CAAkB;YACnC,MAAM,EAAE,MAAM;YACd,IAAI,EAAE,GAAG,QAAQ,CAAC,QAAQ,CAAC,IAAI,QAAQ,cAAc;YACrD,KAAK,EAAE,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,SAAS;YAC1C,IAAI,EAAE,EAAE,MAAM,EAAE;SACjB,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,YAAY,CAAC,QAAgB,EAAE,MAAc,EAAE,QAAiB;QACpE,OAAO,IAAI,CAAC,OAAO,CAAkB;YACnC,MAAM,EAAE,MAAM;YACd,IAAI,EAAE,GAAG,QAAQ,CAAC,QAAQ,CAAC,IAAI,QAAQ,cAAc;YACrD,KAAK,EAAE,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,SAAS;YAC1C,IAAI,EAAE,EAAE,MAAM,EAAE;SACjB,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,cAAc,CAAC,QAAgB,EAAE,MAAc,EAAE,QAAiB;QACtE,OAAO,IAAI,CAAC,OAAO,CAAkB;YACnC,MAAM,EAAE,QAAQ;YAChB,IAAI,EAAE,GAAG,QAAQ,CAAC,QAAQ,CAAC,IAAI,QAAQ,gBAAgB,MAAM,EAAE;YAC/D,KAAK,EAAE,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,SAAS;SAC3C,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,cAAc,CAAC,QAAgB,EAAE,MAAc,EAAE,QAAiB;QACtE,OAAO,IAAI,CAAC,OAAO,CAAkB;YACnC,MAAM,EAAE,QAAQ;YAChB,IAAI,EAAE,GAAG,QAAQ,CAAC,QAAQ,CAAC,IAAI,QAAQ,gBAAgB,MAAM,EAAE;YAC/D,KAAK,EAAE,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,SAAS;SAC3C,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,eAAe,CAAC,MAAc;QAClC,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,OAAO,CAAyB;YAC1D,MAAM,EAAE,KAAK;YACb,IAAI,EAAE,aAAa,MAAM,WAAW;SACrC,CAAC,CAAC;QACH,OAAO,QAAQ,CAAC,QAAQ,CAAC;IAC3B,CAAC;IAED,KAAK,CAAC,eAAe,CAAC,MAAc;QAClC,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,OAAO,CAAyB;YAC1D,MAAM,EAAE,KAAK;YACb,IAAI,EAAE,aAAa,MAAM,WAAW;SACrC,CAAC,CAAC;QACH,OAAO,QAAQ,CAAC,QAAQ,CAAC;IAC3B,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,OAA0B;QACnC,OAAO,IAAI,CAAC,OAAO,CAAmB;YACpC,MAAM,EAAE,MAAM;YACd,IAAI,EAAE,mBAAmB;YACzB,IAAI,EAAE,OAAO;SACd,CAAC,CAAC;IACL,CAAC;CACF;AAED,MAAM,OAAO,iBAAkB,SAAQ,UAAU;IAC/C,KAAK,CAAC,IAAI,CAAC,QAAiB;QAC1B,OAAO,IAAI,CAAC,OAAO,CAAsB;YACvC,MAAM,EAAE,KAAK;YACb,IAAI,EAAE,iBAAiB;YACvB,KAAK,EAAE,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,SAAS;SAC3C,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,QAAQ,CAAC,WAAqB;QAClC,OAAO,IAAI,CAAC,OAAO,CAA8B;YAC/C,MAAM,EAAE,MAAM;YACd,IAAI,EAAE,0BAA0B;YAChC,IAAI,EAAE,EAAE,WAAW,EAAE;SACtB,CAAC,CAAC;IACL,CAAC;CACF"}
+{"version":3,"file":"policies.js","sourceRoot":"","sources":["../../../src/lib/client/policies.ts"],"names":[],"mappings":"AAAA,mCAAmC;AAEnC;;;;;;;;GAQG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AAiBvC,MAAM,WAAW,GAAG,cAAc,CAAC;AACnC,MAAM,UAAU,GAAG,yBAAyB,CAAC;AAM7C,SAAS,QAAQ,CAAC,QAAiB,EAAE,YAAsB;IACzD,OAAO,QAAQ,IAAI,YAAY,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,WAAW,CAAC;AAC7D,CAAC;AAED,MAAM,OAAO,cAAe,SAAQ,UAAU;IAC5C,KAAK,CAAC,IAAI,CAAC,OAQV;QACC,OAAO,IAAI,CAAC,OAAO,CAAqB;YACtC,MAAM,EAAE,KAAK;YACb,IAAI,EAAE,QAAQ,CAAC,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,YAAY,CAAC;YACxD,KAAK,EAAE;gBACL,QAAQ,EAAE,OAAO,EAAE,QAAQ;gBAC3B,OAAO,EAAE,OAAO,EAAE,OAAO;gBACzB,MAAM,EAAE,OAAO,EAAE,MAAM;gBACvB,MAAM,EAAE,OAAO,EAAE,MAAM;gBACvB,IAAI,EAAE,OAAO,EAAE,IAAI;gBACnB,QAAQ,EAAE,OAAO,EAAE,QAAQ,IAAI,GAAG;aACnC;SACF,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,OAAO,CAAC,EAAU,EAAE,QAAiB,EAAE,IAAkB;QAC7D,OAAO,IAAI,CAAC,OAAO,CAAS;YAC1B,MAAM,EAAE,KAAK;YACb,IAAI,EAAE,GAAG,QAAQ,CAAC,QAAQ,EAAE,IAAI,EAAE,YAAY,CAAC,IAAI,EAAE,EAAE;YACvD,KAAK,EAAE,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,SAAS;SAC3C,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,IAAqC;QAChD,wEAAwE;QACxE,uEAAuE;QACvE,MAAM,QAAQ,GAAI,IAA8B,CAAC,QAAQ,CAAC;QAC1D,OAAO,IAAI,CAAC,OAAO,CAAS;YAC1B,MAAM,EAAE,MAAM;YACd,IAAI,EAAE,QAAQ,CAAC,QAAQ,EAAE,IAAI,CAAC,YAAY,CAAC;YAC3C,KAAK,EAAE,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,SAAS;YAC1C,IAAI,EAAE,IAAI;SACX,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,EAAU,EAAE,IAAuB,EAAE,QAAiB,EAAE,IAAkB;QACrF,OAAO,IAAI,CAAC,OAAO,CAAS;YAC1B,MAAM,EAAE,OAAO;YACf,IAAI,EAAE,GAAG,QAAQ,CAAC,QAAQ,EAAE,IAAI,EAAE,YAAY,CAAC,IAAI,EAAE,EAAE;YACvD,KAAK,EAAE,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,SAAS;YAC1C,IAAI,EAAE,IAAI;SACX,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,UAAU,CAAC,EAAU,EAAE,QAAiB,EAAE,IAAkB;QAChE,MAAM,IAAI,CAAC,OAAO,CAAU;YAC1B,MAAM,EAAE,QAAQ;YAChB,IAAI,EAAE,GAAG,QAAQ,CAAC,QAAQ,EAAE,IAAI,EAAE,YAAY,CAAC,IAAI,EAAE,EAAE;YACvD,KAAK,EAAE,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,SAAS;SAC3C,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,EAAU,EAAE,OAAgB,EAAE,QAAiB,EAAE,IAAkB;QAC9E,OAAO,IAAI,CAAC,OAAO,CAAS;YAC1B,MAAM,EAAE,MAAM;YACd,IAAI,EAAE,GAAG,QAAQ,CAAC,QAAQ,EAAE,IAAI,EAAE,YAAY,CAAC,IAAI,EAAE,SAAS;YAC9D,KAAK,EAAE,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,SAAS;YAC1C,IAAI,EAAE,EAAE,OAAO,EAAE;SAClB,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,QAAQ,CAAC,MAAyB;QACtC,OAAO,IAAI,CAAC,OAAO,CAAyB;YAC1C,MAAM,EAAE,MAAM;YACd,IAAI,EAAE,uBAAuB;YAC7B,IAAI,EAAE,MAAM;SACb,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,cAAc,CAAC,QAAgB,EAAE,QAAiB,EAAE,IAAkB;QAC1E,OAAO,IAAI,CAAC,OAAO,CAA4B;YAC7C,MAAM,EAAE,KAAK;YACb,IAAI,EAAE,GAAG,QAAQ,CAAC,QAAQ,EAAE,IAAI,EAAE,YAAY,CAAC,IAAI,QAAQ,cAAc;YACzE,KAAK,EAAE,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,SAAS;SAC3C,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,YAAY,CAAC,QAAgB,EAAE,MAAc,EAAE,QAAiB,EAAE,IAAkB;QACxF,OAAO,IAAI,CAAC,OAAO,CAAkB;YACnC,MAAM,EAAE,MAAM;YACd,IAAI,EAAE,GAAG,QAAQ,CAAC,QAAQ,EAAE,IAAI,EAAE,YAAY,CAAC,IAAI,QAAQ,cAAc;YACzE,KAAK,EAAE,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,SAAS;YAC1C,IAAI,EAAE,EAAE,MAAM,EAAE;SACjB,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,YAAY,CAAC,QAAgB,EAAE,MAAc,EAAE,QAAiB,EAAE,IAAkB;QACxF,OAAO,IAAI,CAAC,OAAO,CAAkB;YACnC,MAAM,EAAE,MAAM;YACd,IAAI,EAAE,GAAG,QAAQ,CAAC,QAAQ,EAAE,IAAI,EAAE,YAAY,CAAC,IAAI,QAAQ,cAAc;YACzE,KAAK,EAAE,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,SAAS;YAC1C,IAAI,EAAE,EAAE,MAAM,EAAE;SACjB,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,cAAc,CAAC,QAAgB,EAAE,MAAc,EAAE,QAAiB,EAAE,IAAkB;QAC1F,OAAO,IAAI,CAAC,OAAO,CAAkB;YACnC,MAAM,EAAE,QAAQ;YAChB,IAAI,EAAE,GAAG,QAAQ,CAAC,QAAQ,EAAE,IAAI,EAAE,YAAY,CAAC,IAAI,QAAQ,gBAAgB,MAAM,EAAE;YACnF,KAAK,EAAE,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,SAAS;SAC3C,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,cAAc,CAAC,QAAgB,EAAE,MAAc,EAAE,QAAiB,EAAE,IAAkB;QAC1F,OAAO,IAAI,CAAC,OAAO,CAAkB;YACnC,MAAM,EAAE,QAAQ;YAChB,IAAI,EAAE,GAAG,QAAQ,CAAC,QAAQ,EAAE,IAAI,EAAE,YAAY,CAAC,IAAI,QAAQ,gBAAgB,MAAM,EAAE;YACnF,KAAK,EAAE,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,SAAS;SAC3C,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,eAAe,CAAC,MAAc;QAClC,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,OAAO,CAAyB;YAC1D,MAAM,EAAE,KAAK;YACb,IAAI,EAAE,aAAa,MAAM,WAAW;SACrC,CAAC,CAAC;QACH,OAAO,QAAQ,CAAC,QAAQ,CAAC;IAC3B,CAAC;IAED,KAAK,CAAC,eAAe,CAAC,MAAc;QAClC,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,OAAO,CAAyB;YAC1D,MAAM,EAAE,KAAK;YACb,IAAI,EAAE,aAAa,MAAM,WAAW;SACrC,CAAC,CAAC;QACH,OAAO,QAAQ,CAAC,QAAQ,CAAC;IAC3B,CAAC;IAED,KAAK,CAAC,IAAI,CAAC,OAA0B;QACnC,OAAO,IAAI,CAAC,OAAO,CAAmB;YACpC,MAAM,EAAE,MAAM;YACd,IAAI,EAAE,mBAAmB;YACzB,IAAI,EAAE,OAAO;SACd,CAAC,CAAC;IACL,CAAC;CACF;AAED,MAAM,OAAO,iBAAkB,SAAQ,UAAU;IAC/C,KAAK,CAAC,IAAI,CAAC,QAAiB;QAC1B,OAAO,IAAI,CAAC,OAAO,CAAsB;YACvC,MAAM,EAAE,KAAK;YACb,IAAI,EAAE,iBAAiB;YACvB,KAAK,EAAE,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,SAAS;SAC3C,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,QAAQ,CAAC,WAAqB;QAClC,OAAO,IAAI,CAAC,OAAO,CAA8B;YAC/C,MAAM,EAAE,MAAM;YACd,IAAI,EAAE,0BAA0B;YAChC,IAAI,EAAE,EAAE,WAAW,EAAE;SACtB,CAAC,CAAC;IACL,CAAC;CACF"}

package/dist/lib/client/quarantine.d.ts

@@ -1,9 +1,19 @@
 /**
  * IP Quarantine management client
  *
- * Routing: if `tenantId` is provided we hit `/v1/superadmin/quarantine/*`
- * (cross-tenant; requires superadmin role). Otherwise we hit `/v1/quarantine/*`
- * (tenant-scoped; tenant is derived from the JWT).
+ * Routing:
+ *   - `asSuperadmin: true` → `/v1/superadmin/quarantine/*` (cross-tenant;
+ *     used under `znvault superadmin quarantine`). Optional `tenantId`
+ *     filters to a specific tenant; omitting it targets the system
+ *     (null-tenant) scope.
+ *   - otherwise → `/v1/quarantine/*` (tenant-scoped; tenant derived from
+ *     the JWT).
+ *
+ * Pre-v4.0.1 the routing used `tenantId` truthiness as the discriminator;
+ * that broke `znvault superadmin quarantine list` (no `--tenant`) because
+ * the request fell through to `/v1/quarantine`, which the server rejects
+ * for superadmin principals with "Superadmins must use /v1/superadmin/*
+ * routes".
  */
 import { HttpClient } from './http.js';
 import type { IpQuarantine, IpQuarantineStats, IpQuarantineConfig, IpFailureHistory, PaginatedResponse } from '../../types/index.js';
@@ -13,27 +23,33 @@ export interface ListQuarantineOptions {
     includeExpired?: boolean;
     limit?: number;
     offset?: number;
+    asSuperadmin?: boolean;
 }
 export interface ReleaseResult {
     success: boolean;
     message: string;
     releasedCount?: number;
 }
+export interface QuarantineScope {
+    asSuperadmin?: boolean;
+    tenantId?: string;
+}
 export declare class QuarantineClient extends HttpClient {
     list(options?: ListQuarantineOptions): Promise<PaginatedResponse<IpQuarantine>>;
-    getById(id: string, tenantId?: string): Promise<IpQuarantine>;
-    release(id: string, reason: string, tenantId?: string): Promise<ReleaseResult>;
-    releaseIp(ip: string, reason: string, tenantId?: string): Promise<ReleaseResult>;
+    getById(id: string, scope?: QuarantineScope): Promise<IpQuarantine>;
+    release(id: string, reason: string, scope?: QuarantineScope): Promise<ReleaseResult>;
+    releaseIp(ip: string, reason: string, scope?: QuarantineScope): Promise<ReleaseResult>;
     getHistory(ip: string, options?: {
         limit?: number;
         tenantId?: string;
+        asSuperadmin?: boolean;
     }): Promise<{
         ip: string;
         failures: IpFailureHistory[];
     }>;
-    getStats(tenantId?: string): Promise<IpQuarantineStats>;
-    getConfig(tenantId?: string): Promise<IpQuarantineConfig>;
-    updateConfig(config: Partial<Omit<IpQuarantineConfig, 'id' | 'tenantId' | 'createdAt' | 'updatedAt'>>, tenantId?: string): Promise<{
+    getStats(scope?: QuarantineScope): Promise<IpQuarantineStats>;
+    getConfig(scope?: QuarantineScope): Promise<IpQuarantineConfig>;
+    updateConfig(config: Partial<Omit<IpQuarantineConfig, 'id' | 'tenantId' | 'createdAt' | 'updatedAt'>>, scope?: QuarantineScope): Promise<{
         success: boolean;
         config: IpQuarantineConfig;
     }>;

package/dist/lib/client/quarantine.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"quarantine.d.ts","sourceRoot":"","sources":["../../../src/lib/client/quarantine.ts"],"names":[],"mappings":"AAEA;;;;;;GAMG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AACvC,OAAO,KAAK,EACV,YAAY,EACZ,iBAAiB,EACjB,kBAAkB,EAClB,gBAAgB,EAChB,iBAAiB,EAClB,MAAM,sBAAsB,CAAC;AAE9B,MAAM,WAAW,qBAAqB;IACpC,MAAM,CAAC,EAAE,QAAQ,GAAG,UAAU,GAAG,SAAS,CAAC;IAC3C,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,aAAa;IAC5B,OAAO,EAAE,OAAO,CAAC;IACjB,OAAO,EAAE,MAAM,CAAC;IAChB,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AAMD,qBAAa,gBAAiB,SAAQ,UAAU;IACxC,IAAI,CAAC,OAAO,CAAC,EAAE,qBAAqB,GAAG,OAAO,CAAC,iBAAiB,CAAC,YAAY,CAAC,CAAC;IAc/E,OAAO,CAAC,EAAE,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,CAAC;IAQ7D,OAAO,CAAC,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,CAAC;IAS9E,SAAS,CAAC,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,CAAC;IAShF,UAAU,CACd,EAAE,EAAE,MAAM,EACV,OAAO,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;KAAE,GAC9C,OAAO,CAAC;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,gBAAgB,EAAE,CAAA;KAAE,CAAC;IAWlD,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,iBAAiB,CAAC;IAQvD,SAAS,CAAC,QAAQ,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,CAAC;IAQzD,YAAY,CAChB,MAAM,EAAE,OAAO,CAAC,IAAI,CAAC,kBAAkB,EAAE,IAAI,GAAG,UAAU,GAAG,WAAW,GAAG,WAAW,CAAC,CAAC,EACxF,QAAQ,CAAC,EAAE,MAAM,GAChB,OAAO,CAAC;QAAE,OAAO,EAAE,OAAO,CAAC;QAAC,MAAM,EAAE,kBAAkB,CAAA;KAAE,CAAC;CAQ7D"}
+{"version":3,"file":"quarantine.d.ts","sourceRoot":"","sources":["../../../src/lib/client/quarantine.ts"],"names":[],"mappings":"AAEA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AACvC,OAAO,KAAK,EACV,YAAY,EACZ,iBAAiB,EACjB,kBAAkB,EAClB,gBAAgB,EAChB,iBAAiB,EAClB,MAAM,sBAAsB,CAAC;AAE9B,MAAM,WAAW,qBAAqB;IACpC,MAAM,CAAC,EAAE,QAAQ,GAAG,UAAU,GAAG,SAAS,CAAC;IAC3C,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,YAAY,CAAC,EAAE,OAAO,CAAC;CACxB;AAED,MAAM,WAAW,aAAa;IAC5B,OAAO,EAAE,OAAO,CAAC;IACjB,OAAO,EAAE,MAAM,CAAC;IAChB,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AAED,MAAM,WAAW,eAAe;IAC9B,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAaD,qBAAa,gBAAiB,SAAQ,UAAU;IACxC,IAAI,CAAC,OAAO,CAAC,EAAE,qBAAqB,GAAG,OAAO,CAAC,iBAAiB,CAAC,YAAY,CAAC,CAAC;IAc/E,OAAO,CAAC,EAAE,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,eAAe,GAAG,OAAO,CAAC,YAAY,CAAC;IAQnE,OAAO,CAAC,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,eAAe,GAAG,OAAO,CAAC,aAAa,CAAC;IASpF,SAAS,CAAC,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,eAAe,GAAG,OAAO,CAAC,aAAa,CAAC;IAStF,UAAU,CACd,EAAE,EAAE,MAAM,EACV,OAAO,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;QAAC,YAAY,CAAC,EAAE,OAAO,CAAA;KAAE,GACtE,OAAO,CAAC;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,gBAAgB,EAAE,CAAA;KAAE,CAAC;IAWlD,QAAQ,CAAC,KAAK,CAAC,EAAE,eAAe,GAAG,OAAO,CAAC,iBAAiB,CAAC;IAQ7D,SAAS,CAAC,KAAK,CAAC,EAAE,eAAe,GAAG,OAAO,CAAC,kBAAkB,CAAC;IAQ/D,YAAY,CAChB,MAAM,EAAE,OAAO,CAAC,IAAI,CAAC,kBAAkB,EAAE,IAAI,GAAG,UAAU,GAAG,WAAW,GAAG,WAAW,CAAC,CAAC,EACxF,KAAK,CAAC,EAAE,eAAe,GACtB,OAAO,CAAC;QAAE,OAAO,EAAE,OAAO,CAAC;QAAC,MAAM,EAAE,kBAAkB,CAAA;KAAE,CAAC;CAQ7D"}

package/dist/lib/client/quarantine.js

@@ -2,80 +2,97 @@
 /**
  * IP Quarantine management client
  *
- * Routing: if `tenantId` is provided we hit `/v1/superadmin/quarantine/*`
- * (cross-tenant; requires superadmin role). Otherwise we hit `/v1/quarantine/*`
- * (tenant-scoped; tenant is derived from the JWT).
+ * Routing:
+ *   - `asSuperadmin: true` → `/v1/superadmin/quarantine/*` (cross-tenant;
+ *     used under `znvault superadmin quarantine`). Optional `tenantId`
+ *     filters to a specific tenant; omitting it targets the system
+ *     (null-tenant) scope.
+ *   - otherwise → `/v1/quarantine/*` (tenant-scoped; tenant derived from
+ *     the JWT).
+ *
+ * Pre-v4.0.1 the routing used `tenantId` truthiness as the discriminator;
+ * that broke `znvault superadmin quarantine list` (no `--tenant`) because
+ * the request fell through to `/v1/quarantine`, which the server rejects
+ * for superadmin principals with "Superadmins must use /v1/superadmin/*
+ * routes".
  */
 import { HttpClient } from './http.js';
-function adminBase(tenantId) {
-    return tenantId !== undefined && tenantId !== '' ? '/v1/superadmin/quarantine' : '/v1/quarantine';
+function basePath(asSuperadmin) {
+    return asSuperadmin ? '/v1/superadmin/quarantine' : '/v1/quarantine';
+}
+function tenantQuery(scope) {
+    if (!scope?.asSuperadmin)
+        return undefined;
+    return scope.tenantId !== undefined && scope.tenantId !== ''
+        ? { tenantId: scope.tenantId }
+        : undefined;
 }
 export class QuarantineClient extends HttpClient {
     async list(options) {
         return this.request({
             method: 'GET',
-            path: adminBase(options?.tenantId),
+            path: basePath(options?.asSuperadmin),
             query: {
                 status: options?.status,
-                tenantId: options?.tenantId,
+                tenantId: options?.asSuperadmin ? options.tenantId : undefined,
                 includeExpired: options?.includeExpired,
                 limit: options?.limit ?? 50,
                 offset: options?.offset ?? 0,
             },
         });
     }
-    async getById(id, tenantId) {
+    async getById(id, scope) {
         return this.request({
             method: 'GET',
-            path: `${adminBase(tenantId)}/${id}`,
-            query: tenantId ? { tenantId } : undefined,
+            path: `${basePath(scope?.asSuperadmin)}/${id}`,
+            query: tenantQuery(scope),
         });
     }
-    async release(id, reason, tenantId) {
+    async release(id, reason, scope) {
         return this.request({
             method: 'POST',
-            path: `${adminBase(tenantId)}/${id}/release`,
-            query: tenantId ? { tenantId } : undefined,
+            path: `${basePath(scope?.asSuperadmin)}/${id}/release`,
+            query: tenantQuery(scope),
             body: { reason },
         });
     }
-    async releaseIp(ip, reason, tenantId) {
+    async releaseIp(ip, reason, scope) {
         return this.request({
             method: 'POST',
-            path: `${adminBase(tenantId)}/ip/${encodeURIComponent(ip)}/release`,
-            query: tenantId ? { tenantId } : undefined,
+            path: `${basePath(scope?.asSuperadmin)}/ip/${encodeURIComponent(ip)}/release`,
+            query: tenantQuery(scope),
             body: { reason },
         });
     }
     async getHistory(ip, options) {
         return this.request({
             method: 'GET',
-            path: `${adminBase(options?.tenantId)}/ip/${encodeURIComponent(ip)}/history`,
+            path: `${basePath(options?.asSuperadmin)}/ip/${encodeURIComponent(ip)}/history`,
             query: {
                 limit: options?.limit ?? 100,
-                tenantId: options?.tenantId,
+                tenantId: options?.asSuperadmin ? options.tenantId : undefined,
             },
         });
     }
-    async getStats(tenantId) {
+    async getStats(scope) {
         return this.request({
             method: 'GET',
-            path: `${adminBase(tenantId)}/stats`,
-            query: tenantId ? { tenantId } : undefined,
+            path: `${basePath(scope?.asSuperadmin)}/stats`,
+            query: tenantQuery(scope),
         });
     }
-    async getConfig(tenantId) {
+    async getConfig(scope) {
         return this.request({
             method: 'GET',
-            path: `${adminBase(tenantId)}/config`,
-            query: tenantId ? { tenantId } : undefined,
+            path: `${basePath(scope?.asSuperadmin)}/config`,
+            query: tenantQuery(scope),
         });
     }
-    async updateConfig(config, tenantId) {
+    async updateConfig(config, scope) {
         return this.request({
             method: 'PUT',
-            path: `${adminBase(tenantId)}/config`,
-            query: tenantId ? { tenantId } : undefined,
+            path: `${basePath(scope?.asSuperadmin)}/config`,
+            query: tenantQuery(scope),
             body: config,
         });
     }

package/dist/lib/client/quarantine.js.map

@@ -1 +1 @@
-{"version":3,"file":"quarantine.js","sourceRoot":"","sources":["../../../src/lib/client/quarantine.ts"],"names":[],"mappings":"AAAA,qCAAqC;AAErC;;;;;;GAMG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AAuBvC,SAAS,SAAS,CAAC,QAA4B;IAC7C,OAAO,QAAQ,KAAK,SAAS,IAAI,QAAQ,KAAK,EAAE,CAAC,CAAC,CAAC,2BAA2B,CAAC,CAAC,CAAC,gBAAgB,CAAC;AACpG,CAAC;AAED,MAAM,OAAO,gBAAiB,SAAQ,UAAU;IAC9C,KAAK,CAAC,IAAI,CAAC,OAA+B;QACxC,OAAO,IAAI,CAAC,OAAO,CAAkC;YACnD,MAAM,EAAE,KAAK;YACb,IAAI,EAAE,SAAS,CAAC,OAAO,EAAE,QAAQ,CAAC;YAClC,KAAK,EAAE;gBACL,MAAM,EAAE,OAAO,EAAE,MAAM;gBACvB,QAAQ,EAAE,OAAO,EAAE,QAAQ;gBAC3B,cAAc,EAAE,OAAO,EAAE,cAAc;gBACvC,KAAK,EAAE,OAAO,EAAE,KAAK,IAAI,EAAE;gBAC3B,MAAM,EAAE,OAAO,EAAE,MAAM,IAAI,CAAC;aAC7B;SACF,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,OAAO,CAAC,EAAU,EAAE,QAAiB;QACzC,OAAO,IAAI,CAAC,OAAO,CAAe;YAChC,MAAM,EAAE,KAAK;YACb,IAAI,EAAE,GAAG,SAAS,CAAC,QAAQ,CAAC,IAAI,EAAE,EAAE;YACpC,KAAK,EAAE,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,SAAS;SAC3C,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,OAAO,CAAC,EAAU,EAAE,MAAc,EAAE,QAAiB;QACzD,OAAO,IAAI,CAAC,OAAO,CAAgB;YACjC,MAAM,EAAE,MAAM;YACd,IAAI,EAAE,GAAG,SAAS,CAAC,QAAQ,CAAC,IAAI,EAAE,UAAU;YAC5C,KAAK,EAAE,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,SAAS;YAC1C,IAAI,EAAE,EAAE,MAAM,EAAE;SACjB,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,SAAS,CAAC,EAAU,EAAE,MAAc,EAAE,QAAiB;QAC3D,OAAO,IAAI,CAAC,OAAO,CAAgB;YACjC,MAAM,EAAE,MAAM;YACd,IAAI,EAAE,GAAG,SAAS,CAAC,QAAQ,CAAC,OAAO,kBAAkB,CAAC,EAAE,CAAC,UAAU;YACnE,KAAK,EAAE,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,SAAS;YAC1C,IAAI,EAAE,EAAE,MAAM,EAAE;SACjB,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,UAAU,CACd,EAAU,EACV,OAA+C;QAE/C,OAAO,IAAI,CAAC,OAAO,CAAC;YAClB,MAAM,EAAE,KAAK;YACb,IAAI,EAAE,GAAG,SAAS,CAAC,OAAO,EAAE,QAAQ,CAAC,OAAO,kBAAkB,CAAC,EAAE,CAAC,UAAU;YAC5E,KAAK,EAAE;gBACL,KAAK,EAAE,OAAO,EAAE,KAAK,IAAI,GAAG;gBAC5B,QAAQ,EAAE,OAAO,EAAE,QAAQ;aAC5B;SACF,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,QAAQ,CAAC,QAAiB;QAC9B,OAAO,IAAI,CAAC,OAAO,CAAoB;YACrC,MAAM,EAAE,KAAK;YACb,IAAI,EAAE,GAAG,SAAS,CAAC,QAAQ,CAAC,QAAQ;YACpC,KAAK,EAAE,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,SAAS;SAC3C,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,SAAS,CAAC,QAAiB;QAC/B,OAAO,IAAI,CAAC,OAAO,CAAqB;YACtC,MAAM,EAAE,KAAK;YACb,IAAI,EAAE,GAAG,SAAS,CAAC,QAAQ,CAAC,SAAS;YACrC,KAAK,EAAE,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,SAAS;SAC3C,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,YAAY,CAChB,MAAwF,EACxF,QAAiB;QAEjB,OAAO,IAAI,CAAC,OAAO,CAAC;YAClB,MAAM,EAAE,KAAK;YACb,IAAI,EAAE,GAAG,SAAS,CAAC,QAAQ,CAAC,SAAS;YACrC,KAAK,EAAE,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,SAAS;YAC1C,IAAI,EAAE,MAAM;SACb,CAAC,CAAC;IACL,CAAC;CACF"}
+{"version":3,"file":"quarantine.js","sourceRoot":"","sources":["../../../src/lib/client/quarantine.ts"],"names":[],"mappings":"AAAA,qCAAqC;AAErC;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AA6BvC,SAAS,QAAQ,CAAC,YAAsB;IACtC,OAAO,YAAY,CAAC,CAAC,CAAC,2BAA2B,CAAC,CAAC,CAAC,gBAAgB,CAAC;AACvE,CAAC;AAED,SAAS,WAAW,CAAC,KAAuB;IAC1C,IAAI,CAAC,KAAK,EAAE,YAAY;QAAE,OAAO,SAAS,CAAC;IAC3C,OAAO,KAAK,CAAC,QAAQ,KAAK,SAAS,IAAI,KAAK,CAAC,QAAQ,KAAK,EAAE;QAC1D,CAAC,CAAC,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE;QAC9B,CAAC,CAAC,SAAS,CAAC;AAChB,CAAC;AAED,MAAM,OAAO,gBAAiB,SAAQ,UAAU;IAC9C,KAAK,CAAC,IAAI,CAAC,OAA+B;QACxC,OAAO,IAAI,CAAC,OAAO,CAAkC;YACnD,MAAM,EAAE,KAAK;YACb,IAAI,EAAE,QAAQ,CAAC,OAAO,EAAE,YAAY,CAAC;YACrC,KAAK,EAAE;gBACL,MAAM,EAAE,OAAO,EAAE,MAAM;gBACvB,QAAQ,EAAE,OAAO,EAAE,YAAY,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS;gBAC9D,cAAc,EAAE,OAAO,EAAE,cAAc;gBACvC,KAAK,EAAE,OAAO,EAAE,KAAK,IAAI,EAAE;gBAC3B,MAAM,EAAE,OAAO,EAAE,MAAM,IAAI,CAAC;aAC7B;SACF,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,OAAO,CAAC,EAAU,EAAE,KAAuB;QAC/C,OAAO,IAAI,CAAC,OAAO,CAAe;YAChC,MAAM,EAAE,KAAK;YACb,IAAI,EAAE,GAAG,QAAQ,CAAC,KAAK,EAAE,YAAY,CAAC,IAAI,EAAE,EAAE;YAC9C,KAAK,EAAE,WAAW,CAAC,KAAK,CAAC;SAC1B,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,OAAO,CAAC,EAAU,EAAE,MAAc,EAAE,KAAuB;QAC/D,OAAO,IAAI,CAAC,OAAO,CAAgB;YACjC,MAAM,EAAE,MAAM;YACd,IAAI,EAAE,GAAG,QAAQ,CAAC,KAAK,EAAE,YAAY,CAAC,IAAI,EAAE,UAAU;YACtD,KAAK,EAAE,WAAW,CAAC,KAAK,CAAC;YACzB,IAAI,EAAE,EAAE,MAAM,EAAE;SACjB,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,SAAS,CAAC,EAAU,EAAE,MAAc,EAAE,KAAuB;QACjE,OAAO,IAAI,CAAC,OAAO,CAAgB;YACjC,MAAM,EAAE,MAAM;YACd,IAAI,EAAE,GAAG,QAAQ,CAAC,KAAK,EAAE,YAAY,CAAC,OAAO,kBAAkB,CAAC,EAAE,CAAC,UAAU;YAC7E,KAAK,EAAE,WAAW,CAAC,KAAK,CAAC;YACzB,IAAI,EAAE,EAAE,MAAM,EAAE;SACjB,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,UAAU,CACd,EAAU,EACV,OAAuE;QAEvE,OAAO,IAAI,CAAC,OAAO,CAAC;YAClB,MAAM,EAAE,KAAK;YACb,IAAI,EAAE,GAAG,QAAQ,CAAC,OAAO,EAAE,YAAY,CAAC,OAAO,kBAAkB,CAAC,EAAE,CAAC,UAAU;YAC/E,KAAK,EAAE;gBACL,KAAK,EAAE,OAAO,EAAE,KAAK,IAAI,GAAG;gBAC5B,QAAQ,EAAE,OAAO,EAAE,YAAY,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS;aAC/D;SACF,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,QAAQ,CAAC,KAAuB;QACpC,OAAO,IAAI,CAAC,OAAO,CAAoB;YACrC,MAAM,EAAE,KAAK;YACb,IAAI,EAAE,GAAG,QAAQ,CAAC,KAAK,EAAE,YAAY,CAAC,QAAQ;YAC9C,KAAK,EAAE,WAAW,CAAC,KAAK,CAAC;SAC1B,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,SAAS,CAAC,KAAuB;QACrC,OAAO,IAAI,CAAC,OAAO,CAAqB;YACtC,MAAM,EAAE,KAAK;YACb,IAAI,EAAE,GAAG,QAAQ,CAAC,KAAK,EAAE,YAAY,CAAC,SAAS;YAC/C,KAAK,EAAE,WAAW,CAAC,KAAK,CAAC;SAC1B,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,YAAY,CAChB,MAAwF,EACxF,KAAuB;QAEvB,OAAO,IAAI,CAAC,OAAO,CAAC;YAClB,MAAM,EAAE,KAAK;YACb,IAAI,EAAE,GAAG,QAAQ,CAAC,KAAK,EAAE,YAAY,CAAC,SAAS;YAC/C,KAAK,EAAE,WAAW,CAAC,KAAK,CAAC;YACzB,IAAI,EAAE,MAAM;SACb,CAAC,CAAC;IACL,CAAC;CACF"}

package/dist/lib/client/users.d.ts

@@ -1,5 +1,15 @@
 /**
  * User and superadmin management client
+ *
+ * Routing:
+ *   - `asSuperadmin: true` → `/v1/superadmin/users*` (cross-tenant; used
+ *     under `znvault superadmin user`).
+ *   - otherwise → `/v1/users*` (tenant principal; tenant derived from JWT).
+ *
+ * The server rejects superadmin principals on `/v1/users*` with
+ * "Superadmins must use /v1/superadmin/* routes" — so every method that can
+ * be invoked from the superadmin namespace accepts an explicit
+ * `asSuperadmin` switch rather than relying on tenant-id truthiness.
  */
 import { HttpClient } from './http.js';
 import type { User, Superadmin } from '../../types/index.js';
@@ -9,6 +19,7 @@ export declare class UsersClient extends HttpClient {
         tenantId?: string;
         role?: string;
         status?: string;
+        asSuperadmin?: boolean;
     }): Promise<User[]>;
     create(data: {
         username: string;
@@ -16,16 +27,25 @@ export declare class UsersClient extends HttpClient {
         email?: string;
         tenantId?: string;
         role?: 'user' | 'admin';
+        asSuperadmin?: boolean;
+    }): Promise<User>;
+    getById(id: string, opts?: {
+        asSuperadmin?: boolean;
     }): Promise<User>;
-    getById(id: string): Promise<User>;
     update(id: string, data: {
         email?: string;
         password?: string;
         role?: 'user' | 'admin';
         status?: 'active' | 'disabled';
+    }, opts?: {
+        asSuperadmin?: boolean;
     }): Promise<User>;
-    deleteById(id: string): Promise<void>;
-    unlock(id: string): Promise<MessageResponse>;
+    deleteById(id: string, opts?: {
+        asSuperadmin?: boolean;
+    }): Promise<void>;
+    unlock(id: string, opts?: {
+        asSuperadmin?: boolean;
+    }): Promise<MessageResponse>;
     /**
      * Reset a user's password.
      *
@@ -36,6 +56,13 @@ export declare class UsersClient extends HttpClient {
     resetPassword(id: string, newPassword: string, opts?: {
         asSuperadmin?: boolean;
     }): Promise<MessageResponse>;
+    /**
+     * Disable TOTP/2FA for a user.
+     *
+     * Only the tenant route (`/v1/users/:id/totp/disable`) exists today; the
+     * server enforces tenant scoping. Superadmins disabling TOTP across
+     * tenants must do so via dashboard or local-mode CLI.
+     */
     disableTotp(id: string): Promise<MessageResponse>;
 }
 export declare class SuperadminsClient extends HttpClient {

package/dist/lib/client/users.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"users.d.ts","sourceRoot":"","sources":["../../../src/lib/client/users.ts"],"names":[],"mappings":"AAEA;;GAEG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AACvC,OAAO,KAAK,EAAE,IAAI,EAAE,UAAU,EAAqB,MAAM,sBAAsB,CAAC;AAChF,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAElD,qBAAa,WAAY,SAAQ,UAAU;IACnC,IAAI,CAAC,OAAO,CAAC,EAAE;QACnB,QAAQ,CAAC,EAAE,MAAM,CAAC;QAClB,IAAI,CAAC,EAAE,MAAM,CAAC;QACd,MAAM,CAAC,EAAE,MAAM,CAAC;KACjB,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC;IAcb,MAAM,CAAC,IAAI,EAAE;QACjB,QAAQ,EAAE,MAAM,CAAC;QACjB,QAAQ,EAAE,MAAM,CAAC;QACjB,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,QAAQ,CAAC,EAAE,MAAM,CAAC;QAClB,IAAI,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC;KACzB,GAAG,OAAO,CAAC,IAAI,CAAC;IAQX,OAAO,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAOlC,MAAM,CAAC,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE;QAC7B,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,QAAQ,CAAC,EAAE,MAAM,CAAC;QAClB,IAAI,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC;QACxB,MAAM,CAAC,EAAE,QAAQ,GAAG,UAAU,CAAC;KAChC,GAAG,OAAO,CAAC,IAAI,CAAC;IAQX,UAAU,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAOrC,MAAM,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,CAAC;IAQlD;;;;;;OAMG;IACG,aAAa,CACjB,EAAE,EAAE,MAAM,EACV,WAAW,EAAE,MAAM,EACnB,IAAI,CAAC,EAAE;QAAE,YAAY,CAAC,EAAE,OAAO,CAAA;KAAE,GAChC,OAAO,CAAC,eAAe,CAAC;IAWrB,WAAW,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,CAAC;CAMxD;AAED,qBAAa,iBAAkB,SAAQ,UAAU;IACzC,IAAI,IAAI,OAAO,CAAC,UAAU,EAAE,CAAC;IAgB7B,MAAM,CAAC,IAAI,EAAE;QACjB,QAAQ,EAAE,MAAM,CAAC;QACjB,QAAQ,EAAE,MAAM,CAAC;QACjB,KAAK,CAAC,EAAE,MAAM,CAAC;KAChB,GAAG,OAAO,CAAC,UAAU,CAAC;IAQjB,aAAa,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,CAAC;IAQ3E,MAAM,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,CAAC;IAOlD,OAAO,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,CAAC;IAOnD,MAAM,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,CAAC;CAMzD"}
+{"version":3,"file":"users.d.ts","sourceRoot":"","sources":["../../../src/lib/client/users.ts"],"names":[],"mappings":"AAEA;;;;;;;;;;;;GAYG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AACvC,OAAO,KAAK,EAAE,IAAI,EAAE,UAAU,EAAqB,MAAM,sBAAsB,CAAC;AAChF,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AASlD,qBAAa,WAAY,SAAQ,UAAU;IACnC,IAAI,CAAC,OAAO,CAAC,EAAE;QACnB,QAAQ,CAAC,EAAE,MAAM,CAAC;QAClB,IAAI,CAAC,EAAE,MAAM,CAAC;QACd,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,YAAY,CAAC,EAAE,OAAO,CAAC;KACxB,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC;IAcb,MAAM,CAAC,IAAI,EAAE;QACjB,QAAQ,EAAE,MAAM,CAAC;QACjB,QAAQ,EAAE,MAAM,CAAC;QACjB,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,QAAQ,CAAC,EAAE,MAAM,CAAC;QAClB,IAAI,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC;QACxB,YAAY,CAAC,EAAE,OAAO,CAAC;KACxB,GAAG,OAAO,CAAC,IAAI,CAAC;IASX,OAAO,CAAC,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE;QAAE,YAAY,CAAC,EAAE,OAAO,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC;IAOrE,MAAM,CAAC,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE;QAC7B,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,QAAQ,CAAC,EAAE,MAAM,CAAC;QAClB,IAAI,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC;QACxB,MAAM,CAAC,EAAE,QAAQ,GAAG,UAAU,CAAC;KAChC,EAAE,IAAI,CAAC,EAAE;QAAE,YAAY,CAAC,EAAE,OAAO,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC;IAQ9C,UAAU,CAAC,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE;QAAE,YAAY,CAAC,EAAE,OAAO,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC;IAOxE,MAAM,CAAC,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE;QAAE,YAAY,CAAC,EAAE,OAAO,CAAA;KAAE,GAAG,OAAO,CAAC,eAAe,CAAC;IAQrF;;;;;;OAMG;IACG,aAAa,CACjB,EAAE,EAAE,MAAM,EACV,WAAW,EAAE,MAAM,EACnB,IAAI,CAAC,EAAE;QAAE,YAAY,CAAC,EAAE,OAAO,CAAA;KAAE,GAChC,OAAO,CAAC,eAAe,CAAC;IAW3B;;;;;;OAMG;IACG,WAAW,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,CAAC;CAMxD;AAED,qBAAa,iBAAkB,SAAQ,UAAU;IACzC,IAAI,IAAI,OAAO,CAAC,UAAU,EAAE,CAAC;IAiB7B,MAAM,CAAC,IAAI,EAAE;QACjB,QAAQ,EAAE,MAAM,CAAC;QACjB,QAAQ,EAAE,MAAM,CAAC;QACjB,KAAK,CAAC,EAAE,MAAM,CAAC;KAChB,GAAG,OAAO,CAAC,UAAU,CAAC;IAQjB,aAAa,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,CAAC;IAQ3E,MAAM,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,CAAC;IAOlD,OAAO,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,CAAC;IAOnD,MAAM,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,CAAC;CAMzD"}

package/dist/lib/client/users.js

@@ -1,13 +1,28 @@
 // Path: src/lib/client/users.ts
 /**
  * User and superadmin management client
+ *
+ * Routing:
+ *   - `asSuperadmin: true` → `/v1/superadmin/users*` (cross-tenant; used
+ *     under `znvault superadmin user`).
+ *   - otherwise → `/v1/users*` (tenant principal; tenant derived from JWT).
+ *
+ * The server rejects superadmin principals on `/v1/users*` with
+ * "Superadmins must use /v1/superadmin/* routes" — so every method that can
+ * be invoked from the superadmin namespace accepts an explicit
+ * `asSuperadmin` switch rather than relying on tenant-id truthiness.
  */
 import { HttpClient } from './http.js';
+const TENANT_BASE = '/v1/users';
+const ADMIN_BASE = '/v1/superadmin/users';
+function basePath(asSuperadmin) {
+    return asSuperadmin ? ADMIN_BASE : TENANT_BASE;
+}
 export class UsersClient extends HttpClient {
     async list(options) {
         const response = await this.request({
             method: 'GET',
-            path: '/v1/users',
+            path: basePath(options?.asSuperadmin),
             query: {
                 tenantId: options?.tenantId,
                 role: options?.role,
@@ -18,35 +33,36 @@ export class UsersClient extends HttpClient {
         return response.items;
     }
     async create(data) {
+        const { asSuperadmin, ...body } = data;
         return this.request({
             method: 'POST',
-            path: '/v1/users',
-            body: data,
+            path: basePath(asSuperadmin),
+            body,
         });
     }
-    async getById(id) {
+    async getById(id, opts) {
         return this.request({
             method: 'GET',
-            path: `/v1/users/${id}`,
+            path: `${basePath(opts?.asSuperadmin)}/${id}`,
         });
     }
-    async update(id, data) {
+    async update(id, data, opts) {
         return this.request({
             method: 'PUT',
-            path: `/v1/users/${id}`,
+            path: `${basePath(opts?.asSuperadmin)}/${id}`,
             body: data,
         });
     }
-    async deleteById(id) {
+    async deleteById(id, opts) {
         await this.request({
             method: 'DELETE',
-            path: `/v1/users/${id}`,
+            path: `${basePath(opts?.asSuperadmin)}/${id}`,
         });
     }
-    async unlock(id) {
+    async unlock(id, opts) {
         return this.request({
             method: 'PUT',
-            path: `/v1/users/${id}`,
+            path: `${basePath(opts?.asSuperadmin)}/${id}`,
             body: { status: 'active', failedAttempts: 0, lockedUntil: null },
         });
     }
@@ -59,25 +75,33 @@ export class UsersClient extends HttpClient {
      */
     async resetPassword(id, newPassword, opts) {
         const path = opts?.asSuperadmin
-            ? `/v1/superadmin/users/${id}/reset-password`
-            : `/v1/users/${id}/reset-password`;
+            ? `${ADMIN_BASE}/${id}/reset-password`
+            : `${TENANT_BASE}/${id}/reset-password`;
         return this.request({
             method: 'POST',
             path,
             body: { newPassword },
         });
     }
+    /**
+     * Disable TOTP/2FA for a user.
+     *
+     * Only the tenant route (`/v1/users/:id/totp/disable`) exists today; the
+     * server enforces tenant scoping. Superadmins disabling TOTP across
+     * tenants must do so via dashboard or local-mode CLI.
+     */
     async disableTotp(id) {
         return this.request({
             method: 'POST',
-            path: `/v1/users/${id}/totp/disable`,
+            path: `${TENANT_BASE}/${id}/totp/disable`,
         });
     }
 }
 export class SuperadminsClient extends HttpClient {
     async list() {
         const usersClient = new UsersClient();
-        const users = await usersClient.list({ role: 'superadmin' });
+        // Listing superadmin role members requires the admin namespace.
+        const users = await usersClient.list({ role: 'superadmin', asSuperadmin: true });
         return users.map(u => ({
             id: u.id,
             username: u.username,

package/dist/lib/client/users.js.map

@@ -1 +1 @@
-{"version":3,"file":"users.js","sourceRoot":"","sources":["../../../src/lib/client/users.ts"],"names":[],"mappings":"AAAA,gCAAgC;AAEhC;;GAEG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AAIvC,MAAM,OAAO,WAAY,SAAQ,UAAU;IACzC,KAAK,CAAC,IAAI,CAAC,OAIV;QACC,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,OAAO,CAA0B;YAC3D,MAAM,EAAE,KAAK;YACb,IAAI,EAAE,WAAW;YACjB,KAAK,EAAE;gBACL,QAAQ,EAAE,OAAO,EAAE,QAAQ;gBAC3B,IAAI,EAAE,OAAO,EAAE,IAAI;gBACnB,MAAM,EAAE,OAAO,EAAE,MAAM;gBACvB,QAAQ,EAAE,IAAI;aACf;SACF,CAAC,CAAC;QACH,OAAO,QAAQ,CAAC,KAAK,CAAC;IACxB,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,IAMZ;QACC,OAAO,IAAI,CAAC,OAAO,CAAO;YACxB,MAAM,EAAE,MAAM;YACd,IAAI,EAAE,WAAW;YACjB,IAAI,EAAE,IAAI;SACX,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,OAAO,CAAC,EAAU;QACtB,OAAO,IAAI,CAAC,OAAO,CAAO;YACxB,MAAM,EAAE,KAAK;YACb,IAAI,EAAE,aAAa,EAAE,EAAE;SACxB,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,EAAU,EAAE,IAKxB;QACC,OAAO,IAAI,CAAC,OAAO,CAAO;YACxB,MAAM,EAAE,KAAK;YACb,IAAI,EAAE,aAAa,EAAE,EAAE;YACvB,IAAI,EAAE,IAAI;SACX,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,UAAU,CAAC,EAAU;QACzB,MAAM,IAAI,CAAC,OAAO,CAAU;YAC1B,MAAM,EAAE,QAAQ;YAChB,IAAI,EAAE,aAAa,EAAE,EAAE;SACxB,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,EAAU;QACrB,OAAO,IAAI,CAAC,OAAO,CAAkB;YACnC,MAAM,EAAE,KAAK;YACb,IAAI,EAAE,aAAa,EAAE,EAAE;YACvB,IAAI,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,cAAc,EAAE,CAAC,EAAE,WAAW,EAAE,IAAI,EAAE;SACjE,CAAC,CAAC;IACL,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,aAAa,CACjB,EAAU,EACV,WAAmB,EACnB,IAAiC;QAEjC,MAAM,IAAI,GAAG,IAAI,EAAE,YAAY;YAC7B,CAAC,CAAC,wBAAwB,EAAE,iBAAiB;YAC7C,CAAC,CAAC,aAAa,EAAE,iBAAiB,CAAC;QACrC,OAAO,IAAI,CAAC,OAAO,CAAkB;YACnC,MAAM,EAAE,MAAM;YACd,IAAI;YACJ,IAAI,EAAE,EAAE,WAAW,EAAE;SACtB,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,WAAW,CAAC,EAAU;QAC1B,OAAO,IAAI,CAAC,OAAO,CAAkB;YACnC,MAAM,EAAE,MAAM;YACd,IAAI,EAAE,aAAa,EAAE,eAAe;SACrC,CAAC,CAAC;IACL,CAAC;CACF;AAED,MAAM,OAAO,iBAAkB,SAAQ,UAAU;IAC/C,KAAK,CAAC,IAAI;QACR,MAAM,WAAW,GAAG,IAAI,WAAW,EAAE,CAAC;QACtC,MAAM,KAAK,GAAG,MAAM,WAAW,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC,CAAC;QAC7D,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;YACrB,EAAE,EAAE,CAAC,CAAC,EAAE;YACR,QAAQ,EAAE,CAAC,CAAC,QAAQ;YACpB,KAAK,EAAE,CAAC,CAAC,KAAK;YACd,MAAM,EAAE,CAAC,CAAC,MAAM;YAChB,WAAW,EAAE,CAAC,CAAC,WAAW;YAC1B,cAAc,EAAE,CAAC,CAAC,cAAc;YAChC,WAAW,EAAE,CAAC,CAAC,WAAW;YAC1B,SAAS,EAAE,CAAC,CAAC,SAAS;YACtB,SAAS,EAAE,CAAC,CAAC,SAAS;SACvB,CAAC,CAAC,CAAC;IACN,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,IAIZ;QACC,OAAO,IAAI,CAAC,OAAO,CAAa;YAC9B,MAAM,EAAE,MAAM;YACd,IAAI,EAAE,iBAAiB;YACvB,IAAI,EAAE,IAAI;SACX,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,aAAa,CAAC,QAAgB,EAAE,QAAgB;QACpD,OAAO,IAAI,CAAC,OAAO,CAAkB;YACnC,MAAM,EAAE,MAAM;YACd,IAAI,EAAE,mBAAmB,QAAQ,WAAW;YAC5C,IAAI,EAAE,EAAE,QAAQ,EAAE;SACnB,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,QAAgB;QAC3B,OAAO,IAAI,CAAC,OAAO,CAAkB;YACnC,MAAM,EAAE,MAAM;YACd,IAAI,EAAE,mBAAmB,QAAQ,SAAS;SAC3C,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,OAAO,CAAC,QAAgB;QAC5B,OAAO,IAAI,CAAC,OAAO,CAAkB;YACnC,MAAM,EAAE,MAAM;YACd,IAAI,EAAE,mBAAmB,QAAQ,UAAU;SAC5C,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,QAAgB;QAC3B,OAAO,IAAI,CAAC,OAAO,CAAkB;YACnC,MAAM,EAAE,MAAM;YACd,IAAI,EAAE,mBAAmB,QAAQ,SAAS;SAC3C,CAAC,CAAC;IACL,CAAC;CACF"}
+{"version":3,"file":"users.js","sourceRoot":"","sources":["../../../src/lib/client/users.ts"],"names":[],"mappings":"AAAA,gCAAgC;AAEhC;;;;;;;;;;;;GAYG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AAIvC,MAAM,WAAW,GAAG,WAAW,CAAC;AAChC,MAAM,UAAU,GAAG,sBAAsB,CAAC;AAE1C,SAAS,QAAQ,CAAC,YAAsB;IACtC,OAAO,YAAY,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,WAAW,CAAC;AACjD,CAAC;AAED,MAAM,OAAO,WAAY,SAAQ,UAAU;IACzC,KAAK,CAAC,IAAI,CAAC,OAKV;QACC,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,OAAO,CAA0B;YAC3D,MAAM,EAAE,KAAK;YACb,IAAI,EAAE,QAAQ,CAAC,OAAO,EAAE,YAAY,CAAC;YACrC,KAAK,EAAE;gBACL,QAAQ,EAAE,OAAO,EAAE,QAAQ;gBAC3B,IAAI,EAAE,OAAO,EAAE,IAAI;gBACnB,MAAM,EAAE,OAAO,EAAE,MAAM;gBACvB,QAAQ,EAAE,IAAI;aACf;SACF,CAAC,CAAC;QACH,OAAO,QAAQ,CAAC,KAAK,CAAC;IACxB,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,IAOZ;QACC,MAAM,EAAE,YAAY,EAAE,GAAG,IAAI,EAAE,GAAG,IAAI,CAAC;QACvC,OAAO,IAAI,CAAC,OAAO,CAAO;YACxB,MAAM,EAAE,MAAM;YACd,IAAI,EAAE,QAAQ,CAAC,YAAY,CAAC;YAC5B,IAAI;SACL,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,OAAO,CAAC,EAAU,EAAE,IAAiC;QACzD,OAAO,IAAI,CAAC,OAAO,CAAO;YACxB,MAAM,EAAE,KAAK;YACb,IAAI,EAAE,GAAG,QAAQ,CAAC,IAAI,EAAE,YAAY,CAAC,IAAI,EAAE,EAAE;SAC9C,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,EAAU,EAAE,IAKxB,EAAE,IAAiC;QAClC,OAAO,IAAI,CAAC,OAAO,CAAO;YACxB,MAAM,EAAE,KAAK;YACb,IAAI,EAAE,GAAG,QAAQ,CAAC,IAAI,EAAE,YAAY,CAAC,IAAI,EAAE,EAAE;YAC7C,IAAI,EAAE,IAAI;SACX,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,UAAU,CAAC,EAAU,EAAE,IAAiC;QAC5D,MAAM,IAAI,CAAC,OAAO,CAAU;YAC1B,MAAM,EAAE,QAAQ;YAChB,IAAI,EAAE,GAAG,QAAQ,CAAC,IAAI,EAAE,YAAY,CAAC,IAAI,EAAE,EAAE;SAC9C,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,EAAU,EAAE,IAAiC;QACxD,OAAO,IAAI,CAAC,OAAO,CAAkB;YACnC,MAAM,EAAE,KAAK;YACb,IAAI,EAAE,GAAG,QAAQ,CAAC,IAAI,EAAE,YAAY,CAAC,IAAI,EAAE,EAAE;YAC7C,IAAI,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,cAAc,EAAE,CAAC,EAAE,WAAW,EAAE,IAAI,EAAE;SACjE,CAAC,CAAC;IACL,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,aAAa,CACjB,EAAU,EACV,WAAmB,EACnB,IAAiC;QAEjC,MAAM,IAAI,GAAG,IAAI,EAAE,YAAY;YAC7B,CAAC,CAAC,GAAG,UAAU,IAAI,EAAE,iBAAiB;YACtC,CAAC,CAAC,GAAG,WAAW,IAAI,EAAE,iBAAiB,CAAC;QAC1C,OAAO,IAAI,CAAC,OAAO,CAAkB;YACnC,MAAM,EAAE,MAAM;YACd,IAAI;YACJ,IAAI,EAAE,EAAE,WAAW,EAAE;SACtB,CAAC,CAAC;IACL,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,WAAW,CAAC,EAAU;QAC1B,OAAO,IAAI,CAAC,OAAO,CAAkB;YACnC,MAAM,EAAE,MAAM;YACd,IAAI,EAAE,GAAG,WAAW,IAAI,EAAE,eAAe;SAC1C,CAAC,CAAC;IACL,CAAC;CACF;AAED,MAAM,OAAO,iBAAkB,SAAQ,UAAU;IAC/C,KAAK,CAAC,IAAI;QACR,MAAM,WAAW,GAAG,IAAI,WAAW,EAAE,CAAC;QACtC,gEAAgE;QAChE,MAAM,KAAK,GAAG,MAAM,WAAW,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,YAAY,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC;QACjF,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;YACrB,EAAE,EAAE,CAAC,CAAC,EAAE;YACR,QAAQ,EAAE,CAAC,CAAC,QAAQ;YACpB,KAAK,EAAE,CAAC,CAAC,KAAK;YACd,MAAM,EAAE,CAAC,CAAC,MAAM;YAChB,WAAW,EAAE,CAAC,CAAC,WAAW;YAC1B,cAAc,EAAE,CAAC,CAAC,cAAc;YAChC,WAAW,EAAE,CAAC,CAAC,WAAW;YAC1B,SAAS,EAAE,CAAC,CAAC,SAAS;YACtB,SAAS,EAAE,CAAC,CAAC,SAAS;SACvB,CAAC,CAAC,CAAC;IACN,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,IAIZ;QACC,OAAO,IAAI,CAAC,OAAO,CAAa;YAC9B,MAAM,EAAE,MAAM;YACd,IAAI,EAAE,iBAAiB;YACvB,IAAI,EAAE,IAAI;SACX,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,aAAa,CAAC,QAAgB,EAAE,QAAgB;QACpD,OAAO,IAAI,CAAC,OAAO,CAAkB;YACnC,MAAM,EAAE,MAAM;YACd,IAAI,EAAE,mBAAmB,QAAQ,WAAW;YAC5C,IAAI,EAAE,EAAE,QAAQ,EAAE;SACnB,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,QAAgB;QAC3B,OAAO,IAAI,CAAC,OAAO,CAAkB;YACnC,MAAM,EAAE,MAAM;YACd,IAAI,EAAE,mBAAmB,QAAQ,SAAS;SAC3C,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,OAAO,CAAC,QAAgB;QAC5B,OAAO,IAAI,CAAC,OAAO,CAAkB;YACnC,MAAM,EAAE,MAAM;YACd,IAAI,EAAE,mBAAmB,QAAQ,UAAU;SAC5C,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,QAAgB;QAC3B,OAAO,IAAI,CAAC,OAAO,CAAkB;YACnC,MAAM,EAAE,MAAM;YACd,IAAI,EAAE,mBAAmB,QAAQ,SAAS;SAC3C,CAAC,CAAC;IACL,CAAC;CACF"}

package/dist/lib/command-context.d.ts

@@ -0,0 +1,64 @@
+/**
+ * Helpers for context-aware command registration.
+ *
+ * In v4.0, dual-purpose command groups are registered twice:
+ *   - At top level (tenant context) — `--tenant` option is omitted; the active
+ *     user's JWT tenant is always used.
+ *   - Under `znvault superadmin <group>` (superadmin context) — `--tenant` is
+ *     accepted to target cross-tenant or system resources.
+ *
+ * Command handlers don't need to branch: when `context === 'tenant'`, the
+ * `--tenant` option simply isn't registered, so `options.tenant` is always
+ * `undefined` and existing client routing falls through to the tenant scope.
+ */
+import type { Command } from 'commander';
+export type CommandContext = 'tenant' | 'superadmin';
+export interface RegisterOptions {
+    context?: CommandContext;
+}
+/**
+ * Add a `--tenant <id>` option to a command only if running in superadmin
+ * context. In tenant context this is a no-op.
+ *
+ * @param cmd The Commander command to extend.
+ * @param ctx The active command context.
+ * @param description Override description (defaults to "Tenant ID (superadmin only)").
+ * @param shortFlag Set to `true` to register as `-t, --tenant <id>` instead of just `--tenant <id>`.
+ */
+export declare function addTenantOption(cmd: Command, ctx: CommandContext, description?: string, shortFlag?: boolean): Command;
+/**
+ * Resolve the registration context from optional opts, defaulting to 'tenant'.
+ */
+export declare function resolveContext(opts?: RegisterOptions): CommandContext;
+/**
+ * Run a registration function with the given context active. The previous
+ * context is restored when `fn` returns.
+ */
+export declare function withRegisterContext(ctx: CommandContext, fn: () => void): void;
+/**
+ * Get the active registration context. Sub-files use this to decide whether
+ * to add a `--tenant` option.
+ */
+export declare function getRegisterContext(): CommandContext;
+export declare function isSuperadminContext(): boolean;
+/**
+ * Walk up a Commander Command's parent chain to detect whether the
+ * currently-invoked command lives under the `superadmin` namespace. This
+ * is the runtime equivalent of `isSuperadminContext()` (which only returns
+ * the registration-time value).
+ *
+ * Handlers receive `this: Command` or `cmd: Command` from Commander; pass
+ * that in (or `this.parent` from an action callback) and we'll detect by
+ * inspecting the chain of `.name()` values.
+ */
+interface CommandWithChain {
+    name(): string;
+    parent: CommandWithChain | null;
+}
+export declare function isInvokedUnderSuperadmin(cmd: CommandWithChain | null | undefined): boolean;
+interface CommandLike {
+    option(flags: string, description?: string, ...rest: unknown[]): CommandLike;
+}
+export declare function applyTenantContextPatch(commandPrototype: CommandLike): void;
+export {};
+//# sourceMappingURL=command-context.d.ts.map

package/dist/lib/command-context.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"command-context.d.ts","sourceRoot":"","sources":["../../src/lib/command-context.ts"],"names":[],"mappings":"AAEA;;;;;;;;;;;;GAYG;AAEH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAEzC,MAAM,MAAM,cAAc,GAAG,QAAQ,GAAG,YAAY,CAAC;AAErD,MAAM,WAAW,eAAe;IAC9B,OAAO,CAAC,EAAE,cAAc,CAAC;CAC1B;AAED;;;;;;;;GAQG;AACH,wBAAgB,eAAe,CAC7B,GAAG,EAAE,OAAO,EACZ,GAAG,EAAE,cAAc,EACnB,WAAW,SAAwC,EACnD,SAAS,UAAQ,GAChB,OAAO,CAMT;AAED;;GAEG;AACH,wBAAgB,cAAc,CAAC,IAAI,CAAC,EAAE,eAAe,GAAG,cAAc,CAErE;AAWD;;;GAGG;AACH,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,cAAc,EAAE,EAAE,EAAE,MAAM,IAAI,GAAG,IAAI,CAQ7E;AAED;;;GAGG;AACH,wBAAgB,kBAAkB,IAAI,cAAc,CAEnD;AAED,wBAAgB,mBAAmB,IAAI,OAAO,CAE7C;AAED;;;;;;;;;GASG;AACH,UAAU,gBAAgB;IACxB,IAAI,IAAI,MAAM,CAAC;IACf,MAAM,EAAE,gBAAgB,GAAG,IAAI,CAAC;CACjC;AAED,wBAAgB,wBAAwB,CAAC,GAAG,EAAE,gBAAgB,GAAG,IAAI,GAAG,SAAS,GAAG,OAAO,CAO1F;AAcD,UAAU,WAAW;IACnB,MAAM,CAAC,KAAK,EAAE,MAAM,EAAE,WAAW,CAAC,EAAE,MAAM,EAAE,GAAG,IAAI,EAAE,OAAO,EAAE,GAAG,WAAW,CAAC;CAC9E;AAED,wBAAgB,uBAAuB,CAAC,gBAAgB,EAAE,WAAW,GAAG,IAAI,CAmB3E"}