initialize interfaces package

ts/request/admin.ts

@@ -0,0 +1,130 @@
+import * as plugins from '../plugins.js';
+import * as data from '../data/index.js';
+
+/**
+ * Check if the current user is a global admin
+ */
+export interface IReq_CheckGlobalAdmin
+  extends plugins.typedRequestInterfaces.implementsTR<
+    plugins.typedRequestInterfaces.ITypedRequest,
+    IReq_CheckGlobalAdmin
+  > {
+  method: 'checkGlobalAdmin';
+  request: {
+    jwt: string;
+  };
+  response: {
+    isGlobalAdmin: boolean;
+  };
+}
+
+/**
+ * Get all global apps with statistics (admin only)
+ */
+export interface IReq_GetGlobalAppStats
+  extends plugins.typedRequestInterfaces.implementsTR<
+    plugins.typedRequestInterfaces.ITypedRequest,
+    IReq_GetGlobalAppStats
+  > {
+  method: 'getGlobalAppStats';
+  request: {
+    jwt: string;
+  };
+  response: {
+    apps: Array<{
+      app: data.IGlobalApp;
+      connectionCount: number;
+    }>;
+  };
+}
+
+/**
+ * Create a new global app (admin only)
+ */
+export interface IReq_CreateGlobalApp
+  extends plugins.typedRequestInterfaces.implementsTR<
+    plugins.typedRequestInterfaces.ITypedRequest,
+    IReq_CreateGlobalApp
+  > {
+  method: 'createGlobalApp';
+  request: {
+    jwt: string;
+    name: string;
+    description: string;
+    logoUrl: string;
+    appUrl: string;
+    category: string;
+    redirectUris: string[];
+    allowedScopes: string[];
+  };
+  response: {
+    app: data.IGlobalApp;
+    clientSecret: string; // Only shown once on creation
+  };
+}
+
+/**
+ * Update an existing global app (admin only)
+ */
+export interface IReq_UpdateGlobalApp
+  extends plugins.typedRequestInterfaces.implementsTR<
+    plugins.typedRequestInterfaces.ITypedRequest,
+    IReq_UpdateGlobalApp
+  > {
+  method: 'updateGlobalApp';
+  request: {
+    jwt: string;
+    appId: string;
+    updates: {
+      name?: string;
+      description?: string;
+      logoUrl?: string;
+      appUrl?: string;
+      category?: string;
+      isActive?: boolean;
+      redirectUris?: string[];
+      allowedScopes?: string[];
+    };
+  };
+  response: {
+    app: data.IGlobalApp;
+  };
+}
+
+/**
+ * Delete a global app (admin only)
+ */
+export interface IReq_DeleteGlobalApp
+  extends plugins.typedRequestInterfaces.implementsTR<
+    plugins.typedRequestInterfaces.ITypedRequest,
+    IReq_DeleteGlobalApp
+  > {
+  method: 'deleteGlobalApp';
+  request: {
+    jwt: string;
+    appId: string;
+  };
+  response: {
+    success: boolean;
+    disconnectedOrganizations: number;
+  };
+}
+
+/**
+ * Regenerate OAuth credentials for a global app (admin only)
+ */
+export interface IReq_RegenerateAppCredentials
+  extends plugins.typedRequestInterfaces.implementsTR<
+    plugins.typedRequestInterfaces.ITypedRequest,
+    IReq_RegenerateAppCredentials
+  > {
+  method: 'regenerateAppCredentials';
+  request: {
+    jwt: string;
+    appId: string;
+  };
+  response: {
+    clientId: string;
+    clientSecret: string; // Only shown once
+  };
+}

ts/request/alert.ts

@@ -0,0 +1,113 @@
+import * as plugins from '../plugins.js';
+import * as data from '../data/index.js';
+import type { IPassportDeviceSignedRequest } from './passport.js';
+
+export interface IReq_ListPassportAlerts
+  extends plugins.typedRequestInterfaces.implementsTR<
+    plugins.typedRequestInterfaces.ITypedRequest,
+    IReq_ListPassportAlerts
+  > {
+  method: 'listPassportAlerts';
+  request: IPassportDeviceSignedRequest & {
+    includeDismissed?: boolean;
+  };
+  response: {
+    alerts: data.IAlert[];
+  };
+}
+
+export interface IReq_GetPassportAlertByHint
+  extends plugins.typedRequestInterfaces.implementsTR<
+    plugins.typedRequestInterfaces.ITypedRequest,
+    IReq_GetPassportAlertByHint
+  > {
+  method: 'getPassportAlertByHint';
+  request: IPassportDeviceSignedRequest & {
+    hintId: string;
+  };
+  response: {
+    alert?: data.IAlert;
+  };
+}
+
+export interface IReq_MarkPassportAlertSeen
+  extends plugins.typedRequestInterfaces.implementsTR<
+    plugins.typedRequestInterfaces.ITypedRequest,
+    IReq_MarkPassportAlertSeen
+  > {
+  method: 'markPassportAlertSeen';
+  request: IPassportDeviceSignedRequest & {
+    hintId: string;
+  };
+  response: {
+    success: boolean;
+  };
+}
+
+export interface IReq_DismissPassportAlert
+  extends plugins.typedRequestInterfaces.implementsTR<
+    plugins.typedRequestInterfaces.ITypedRequest,
+    IReq_DismissPassportAlert
+  > {
+  method: 'dismissPassportAlert';
+  request: IPassportDeviceSignedRequest & {
+    hintId: string;
+  };
+  response: {
+    success: boolean;
+  };
+}
+
+export interface IReq_UpsertAlertRule
+  extends plugins.typedRequestInterfaces.implementsTR<
+    plugins.typedRequestInterfaces.ITypedRequest,
+    IReq_UpsertAlertRule
+  > {
+  method: 'upsertAlertRule';
+  request: {
+    jwt: string;
+    ruleId?: string;
+    scope: data.TAlertRuleScope;
+    organizationId?: string;
+    eventType: string;
+    minimumSeverity: data.TAlertSeverity;
+    recipientMode: data.TAlertRuleRecipientMode;
+    recipientUserIds?: string[];
+    push: boolean;
+    enabled: boolean;
+  };
+  response: {
+    rule: data.IAlertRule;
+  };
+}
+
+export interface IReq_GetAlertRules
+  extends plugins.typedRequestInterfaces.implementsTR<
+    plugins.typedRequestInterfaces.ITypedRequest,
+    IReq_GetAlertRules
+  > {
+  method: 'getAlertRules';
+  request: {
+    jwt: string;
+    scope?: data.TAlertRuleScope;
+    organizationId?: string;
+  };
+  response: {
+    rules: data.IAlertRule[];
+  };
+}
+
+export interface IReq_DeleteAlertRule
+  extends plugins.typedRequestInterfaces.implementsTR<
+    plugins.typedRequestInterfaces.ITypedRequest,
+    IReq_DeleteAlertRule
+  > {
+  method: 'deleteAlertRule';
+  request: {
+    jwt: string;
+    ruleId: string;
+  };
+  response: {
+    success: boolean;
+  };
+}

ts/request/apitoken.ts

@@ -0,0 +1 @@
+export {};

ts/request/app.ts

@@ -0,0 +1,71 @@
+import * as data from '../data/index.js';
+import * as plugins from '../plugins.js';
+
+// Get all global apps
+export interface IReq_GetGlobalApps
+  extends plugins.typedRequestInterfaces.implementsTR<
+    plugins.typedRequestInterfaces.ITypedRequest,
+    IReq_GetGlobalApps
+  > {
+  method: 'getGlobalApps';
+  request: {
+    jwt: string;
+  };
+  response: {
+    apps: data.IGlobalApp[];
+  };
+}
+
+// Get app connections for an organization
+export interface IReq_GetAppConnections
+  extends plugins.typedRequestInterfaces.implementsTR<
+    plugins.typedRequestInterfaces.ITypedRequest,
+    IReq_GetAppConnections
+  > {
+  method: 'getAppConnections';
+  request: {
+    jwt: string;
+    organizationId: string;
+  };
+  response: {
+    connections: data.IAppConnection[];
+  };
+}
+
+// Connect/disconnect an app for an organization
+export interface IReq_ToggleAppConnection
+  extends plugins.typedRequestInterfaces.implementsTR<
+    plugins.typedRequestInterfaces.ITypedRequest,
+    IReq_ToggleAppConnection
+  > {
+  method: 'toggleAppConnection';
+  request: {
+    jwt: string;
+    organizationId: string;
+    appId: string;
+    action: 'connect' | 'disconnect';
+  };
+  response: {
+    success: boolean;
+    connection?: data.IAppConnection;
+  };
+}
+
+export interface IReq_UpdateAppRoleMappings
+  extends plugins.typedRequestInterfaces.implementsTR<
+    plugins.typedRequestInterfaces.ITypedRequest,
+    IReq_UpdateAppRoleMappings
+  > {
+  method: 'updateAppRoleMappings';
+  request: {
+    jwt: string;
+    organizationId: string;
+    appId: string;
+    roleMappings: data.IAppRoleMapping[];
+  };
+  response: {
+    success: boolean;
+    connection: data.IAppConnection;
+    message?: string;
+  };
+}

ts/request/authorization.ts

@@ -0,0 +1,72 @@
+import * as plugins from '../plugins.js';
+import { type IUser, type IRole } from '../data/index.js';
+import { type TOidcScope } from '../data/index.js';
+
+export interface IReq_InternalAuthorization
+  extends plugins.typedRequestInterfaces.implementsTR<
+    plugins.typedRequestInterfaces.ITypedRequest,
+    IReq_InternalAuthorization
+  > {
+  method: '';
+  request: {
+    accountData: IUser;
+    jwt: string;
+  };
+  response: {
+    accountData: IUser;
+    jwt: string;
+    relevantRoles: IRole[];
+  };
+}
+
+export interface IReq_CompleteOidcAuthorization
+  extends plugins.typedRequestInterfaces.implementsTR<
+    plugins.typedRequestInterfaces.ITypedRequest,
+    IReq_CompleteOidcAuthorization
+  > {
+  method: 'completeOidcAuthorization';
+  request: {
+    jwt: string;
+    clientId: string;
+    redirectUri: string;
+    scope: string;
+    state: string;
+    prompt?: 'none' | 'login' | 'consent';
+    codeChallenge?: string;
+    codeChallengeMethod?: 'S256';
+    nonce?: string;
+    consentApproved?: boolean;
+  };
+  response: {
+    code: string;
+    redirectUrl: string;
+  };
+}
+
+export interface IReq_PrepareOidcAuthorization
+  extends plugins.typedRequestInterfaces.implementsTR<
+    plugins.typedRequestInterfaces.ITypedRequest,
+    IReq_PrepareOidcAuthorization
+  > {
+  method: 'prepareOidcAuthorization';
+  request: {
+    jwt: string;
+    clientId: string;
+    redirectUri: string;
+    scope: string;
+    state: string;
+    prompt?: 'none' | 'login' | 'consent';
+    codeChallenge?: string;
+    codeChallengeMethod?: 'S256';
+    nonce?: string;
+  };
+  response: {
+    status: 'ready' | 'consent_required';
+    clientId: string;
+    appName: string;
+    appUrl: string;
+    logoUrl?: string;
+    requestedScopes: TOidcScope[];
+    grantedScopes: TOidcScope[];
+  };
+}

ts/request/billingplan.ts

@@ -0,0 +1,55 @@
+import * as plugins from '../plugins.js';
+import * as data from '../data/index.js';
+
+export interface IReq_UpdatePaymentMethod
+  extends plugins.typedRequestInterfaces.implementsTR<
+    plugins.typedRequestInterfaces.ITypedRequest,
+    IReq_UpdatePaymentMethod
+  > {
+  method: 'updatePaymentMethod';
+  request: {
+    jwtString: string;
+    orgId: string;
+    paddle?: {
+      checkoutId: string;
+    };
+  };
+  response: {
+    billingPlan: plugins.tsclass.typeFest.PartialDeep<data.IBillingPlan>;
+  };
+}
+
+/**
+ * allows getting the billing plan for a user
+ */
+export interface IReq_GetBillingPlan
+  extends plugins.typedRequestInterfaces.implementsTR<
+    plugins.typedRequestInterfaces.ITypedRequest,
+    IReq_GetBillingPlan
+  > {
+  method: 'getBillingPlan';
+  request: {
+    jwtString: string;
+    orgId: string;
+    billingPlanId: string;
+  };
+  response: {
+    billingPlan: data.IBillingPlan;
+  };
+}
+
+/**
+ * Returns Paddle configuration from environment variables
+ */
+export interface IReq_GetPaddleConfig
+  extends plugins.typedRequestInterfaces.implementsTR<
+    plugins.typedRequestInterfaces.ITypedRequest,
+    IReq_GetPaddleConfig
+  > {
+  method: 'getPaddleConfig';
+  request: {};
+  response: {
+    paddleToken: string;
+    paddlePriceId: string;
+  };
+}

ts/request/index.ts

@@ -0,0 +1,14 @@
+export * from './admin.js';
+export * from './apitoken.js';
+export * from './alert.js';
+export * from './app.js';
+export * from './authorization.js';
+export * from './billingplan.js';
+export * from './jwt.js';
+export * from './login.js';
+export * from './organization.js';
+export * from './passport.js';
+export * from './plan.js';
+export * from './registration.js';
+export * from './user.js';
+export * from './userinvitation.js';

ts/request/jwt.ts

@@ -0,0 +1,79 @@
+import * as data from '../data/index.js';
+import * as plugins from '../plugins.js';
+
+/**
+ * Request to get the public key for JWT validation.
+ *
+ * **Direction:** Client → idp.global
+ * **Requester:** Backend services that need to verify JWTs
+ * **Handler:** idp.global
+ *
+ * Use this to fetch the current public key for verifying JWT signatures.
+ * The backend token authenticates the requesting service.
+ */
+export interface IReq_GetPublicKeyForValidation
+  extends plugins.typedRequestInterfaces.implementsTR<
+    plugins.typedRequestInterfaces.ITypedRequest,
+    IReq_GetPublicKeyForValidation
+  > {
+  method: 'getPublicKeyForValidation';
+  request: {
+    backendToken: string;
+  };
+  response: {
+    publicKeyPem: string;
+  };
+}
+
+/**
+ * Push public key to connected backend services for JWT validation.
+ *
+ * **Direction:** idp.global → Client
+ * **Requester:** idp.global (pushes when the JWT signing key rotates)
+ * **Handler:** Backend services - must register a TypedHandler for this method
+ *
+ * Backend services should register a handler using `IdpClient.onPublicKeyPush()`
+ * to receive key rotation updates and update their local key cache.
+ */
+export interface IReq_PushPublicKeyForValidation
+  extends plugins.typedRequestInterfaces.implementsTR<
+    plugins.typedRequestInterfaces.ITypedRequest,
+    IReq_PushPublicKeyForValidation
+  > {
+  method: 'pushPublicKeyForValidation';
+  request: {
+    publicKeyPem: string;
+  };
+  response: {};
+}
+
+/**
+ * Push or get JWT ID blocklist for revoked tokens.
+ *
+ * **Bidirectional:**
+ * - **GET direction:** Client → idp.global - Client requests current blocklist
+ * - **PUSH direction:** idp.global → Client - Server pushes new blocklisted IDs
+ *
+ * **For GET (client fires):**
+ * - Fire with empty/undefined `blockedJwtIds` to request the full blocklist
+ * - Response contains the complete list of blocked JWT IDs
+ * - Use `IdpClient.requests.getJwtIdBlocklist` for this direction
+ *
+ * **For PUSH (idp.global fires):**
+ * - idp.global sends newly blocklisted JWT IDs to connected clients
+ * - Clients must register a handler using `IdpClient.onBlocklistPush()`
+ * - Store received IDs locally to reject revoked tokens
+ */
+export interface IReq_PushOrGetJwtIdBlocklist
+  extends plugins.typedRequestInterfaces.implementsTR<
+    plugins.typedRequestInterfaces.ITypedRequest,
+    IReq_PushOrGetJwtIdBlocklist
+  > {
+  method: 'pushOrGetJwtIdBlocklist';
+  request: {
+    blockedJwtIds?: string[];
+  };
+  response: {
+    blockedJwtIds?: string[];
+  };
+}

ts/request/login.ts

@@ -0,0 +1,181 @@
+import * as plugins from '../plugins.js';
+import * as data from '../data/index.js';
+
+export interface IReq_LoginWithEmailOrUsernameAndPassword
+  extends plugins.typedRequestInterfaces.implementsTR<
+    plugins.typedRequestInterfaces.ITypedRequest,
+    IReq_LoginWithEmailOrUsernameAndPassword
+  > {
+  method: 'loginWithEmailOrUsernameAndPassword';
+  request: {
+    username: string;
+    password: string;
+  };
+  response: {
+    refreshToken?: string;
+    twoFaNeeded: boolean;
+  };
+}
+
+export interface IReq_LoginWithEmail
+  extends plugins.typedRequestInterfaces.implementsTR<
+    plugins.typedRequestInterfaces.ITypedRequest,
+    IReq_LoginWithEmailOrUsernameAndPassword
+  > {
+  method: 'loginWithEmail';
+  request: {
+    email: string;
+  };
+  response: {
+    status: 'ok' | 'not ok';
+    testOnlyToken?: string;
+  };
+}
+
+export interface IReq_LoginWithEmailAfterEmailTokenAquired
+  extends plugins.typedRequestInterfaces.implementsTR<
+    plugins.typedRequestInterfaces.ITypedRequest,
+    IReq_LoginWithEmailOrUsernameAndPassword
+  > {
+  method: 'loginWithEmailAfterEmailTokenAquired';
+  request: {
+    email: string;
+    token: string;
+  };
+  response: {
+    refreshToken: string;
+  };
+}
+
+/**
+ * in case you authenticate with a long lived api token
+ */
+export interface IReq_LoginWithApiToken
+  extends plugins.typedRequestInterfaces.implementsTR<
+    plugins.typedRequestInterfaces.ITypedRequest,
+    IReq_LoginWithApiToken
+  > {
+  method: 'loginWithApiToken';
+  request: {
+    apiToken: string;
+  };
+  response: {
+    jwt?: string;
+  };
+}
+
+export interface ILogoutRequest
+  extends plugins.typedRequestInterfaces.implementsTR<
+    plugins.typedRequestInterfaces.ITypedRequest,
+    ILogoutRequest
+  > {
+  method: 'logout';
+  request: {
+    refreshToken: string;
+  };
+  response: {};
+}
+
+export interface IReq_RefreshJwt
+  extends plugins.typedRequestInterfaces.implementsTR<
+    plugins.typedRequestInterfaces.ITypedRequest,
+    IReq_RefreshJwt
+  > {
+  method: 'refreshJwt';
+  request: {
+    refreshToken: string;
+  };
+  response: {
+    status: data.TLoginStatus;
+    jwt?: string;
+    refreshToken?: string;
+  };
+}
+
+/**
+ * allows the exchange between refreshToken and transferTokens
+ */
+export interface IReq_ExchangeRefreshTokenAndTransferToken
+  extends plugins.typedRequestInterfaces.implementsTR<
+    plugins.typedRequestInterfaces.ITypedRequest,
+    IReq_ExchangeRefreshTokenAndTransferToken
+  > {
+  method: 'exchangeRefreshTokenAndTransferToken';
+  request: {
+    transferToken?: string;
+    refreshToken?: string;
+    appData: data.IAppLegacy;
+  };
+  response: {
+    refreshToken?: string;
+    transferToken?: string;
+  };
+}
+
+/**
+ * in case you authenticate with a long lived api token
+ */
+export interface IReq_ResetPassword
+  extends plugins.typedRequestInterfaces.implementsTR<
+    plugins.typedRequestInterfaces.ITypedRequest,
+    IReq_ResetPassword
+  > {
+  method: 'resetPassword';
+  request: {
+    email: string;
+  };
+  response: {
+    status: 'ok' | 'not ok';
+  };
+}
+
+/**
+ * in cse you authenticate with a long lived api token
+ */
+export interface IReq_SetNewPassword
+  extends plugins.typedRequestInterfaces.implementsTR<
+    plugins.typedRequestInterfaces.ITypedRequest,
+    IReq_SetNewPassword
+  > {
+  method: 'setNewPassword';
+  request: {
+    email: string;
+    oldPassword?: string;
+    tokenArg?: string;
+    newPassword: string;
+  };
+  response: {
+    status: 'ok' | 'not ok';
+  };
+}
+
+export interface IReq_ObtainDeviceId
+  extends plugins.typedRequestInterfaces.implementsTR<
+    plugins.typedRequestInterfaces.ITypedRequest,
+    IReq_ObtainDeviceId
+  > {
+  method: 'obtainDeviceId';
+  request: {};
+  response: {
+    deviceId: data.IDevice;
+  };
+}
+
+/**
+ * allows attaching a device id to a login session
+ * to share a login session across contexts
+ */
+export interface IReq_AttachDeviceId
+  extends plugins.typedRequestInterfaces.implementsTR<
+    plugins.typedRequestInterfaces.ITypedRequest,
+    IReq_AttachDeviceId
+  > {
+  method: 'attachDeviceId';
+  request: {
+    jwt: string;
+    deviceId: string;
+  };
+  response: {
+    ok: boolean;
+  };
+}

ts/request/organization.ts

@@ -0,0 +1,131 @@
+import * as data from '../data/index.js';
+import * as plugins from '../plugins.js';
+
+export interface IReq_GetOrganizationById
+  extends plugins.typedRequestInterfaces.implementsTR<
+    plugins.typedRequestInterfaces.ITypedRequest,
+    IReq_GetOrganizationById
+  > {
+  method: 'getOrganizationById';
+  request: {
+    jwt: string;
+    id: string;
+  };
+  response: {
+    organization: data.IOrganization;
+  };
+}
+
+export interface IReq_CreateOrganization
+  extends plugins.typedRequestInterfaces.implementsTR<
+    plugins.typedRequestInterfaces.ITypedRequest,
+    IReq_CreateOrganization
+  > {
+  method: 'createOrganization';
+  request: {
+    jwt: string;
+    userId: string;
+    organizationName: string;
+    organizationSlug: string;
+    action: 'checkAvailability' | 'manifest';
+  };
+  response: {
+    nameAvailable: boolean;
+    resultingOrganization?: data.IOrganization;
+    role?: data.IRole;
+  };
+}
+
+export interface IReq_UpdateOrganization
+  extends plugins.typedRequestInterfaces.implementsTR<
+    plugins.typedRequestInterfaces.ITypedRequest,
+    IReq_UpdateOrganization
+  > {
+  method: 'updateOrganization';
+  request: {
+    jwt: string;
+    organizationId: string;
+    name?: string;
+    slug?: string;
+    confirmationText: string;
+  };
+  response: {
+    success: boolean;
+    organization: data.IOrganization;
+    message?: string;
+  };
+}
+
+export interface IReq_DeleteOrganization
+  extends plugins.typedRequestInterfaces.implementsTR<
+    plugins.typedRequestInterfaces.ITypedRequest,
+    IReq_DeleteOrganization
+  > {
+  method: 'deleteOrganization';
+  request: {
+    jwt: string;
+    organizationId: string;
+    confirmationText: string;
+  };
+  response: {
+    success: boolean;
+    deletedOrganizationId: string;
+    message?: string;
+  };
+}
+
+export interface IReq_GetOrgRoleDefinitions
+  extends plugins.typedRequestInterfaces.implementsTR<
+    plugins.typedRequestInterfaces.ITypedRequest,
+    IReq_GetOrgRoleDefinitions
+  > {
+  method: 'getOrgRoleDefinitions';
+  request: {
+    jwt: string;
+    organizationId: string;
+  };
+  response: {
+    roleDefinitions: data.IOrgRoleDefinition[];
+  };
+}
+
+export interface IReq_UpsertOrgRoleDefinition
+  extends plugins.typedRequestInterfaces.implementsTR<
+    plugins.typedRequestInterfaces.ITypedRequest,
+    IReq_UpsertOrgRoleDefinition
+  > {
+  method: 'upsertOrgRoleDefinition';
+  request: {
+    jwt: string;
+    organizationId: string;
+    roleDefinition: {
+      key: string;
+      name: string;
+      description?: string;
+    };
+  };
+  response: {
+    success: boolean;
+    roleDefinitions: data.IOrgRoleDefinition[];
+    message?: string;
+  };
+}
+
+export interface IReq_DeleteOrgRoleDefinition
+  extends plugins.typedRequestInterfaces.implementsTR<
+    plugins.typedRequestInterfaces.ITypedRequest,
+    IReq_DeleteOrgRoleDefinition
+  > {
+  method: 'deleteOrgRoleDefinition';
+  request: {
+    jwt: string;
+    organizationId: string;
+    roleKey: string;
+    confirmationText: string;
+  };
+  response: {
+    success: boolean;
+    roleDefinitions: data.IOrgRoleDefinition[];
+    message?: string;
+  };
+}

ts/request/passport.ts

@@ -0,0 +1,227 @@
+import * as plugins from '../plugins.js';
+import * as data from '../data/index.js';
+
+export interface IPassportDeviceSignedRequest {
+  deviceId: string;
+  timestamp: number;
+  nonce: string;
+  signatureBase64: string;
+  signatureFormat?: data.TPassportSignatureFormat;
+}
+
+export interface IReq_CreatePassportEnrollmentChallenge
+  extends plugins.typedRequestInterfaces.implementsTR<
+    plugins.typedRequestInterfaces.ITypedRequest,
+    IReq_CreatePassportEnrollmentChallenge
+  > {
+  method: 'createPassportEnrollmentChallenge';
+  request: {
+    jwt: string;
+    deviceLabel: string;
+    platform: data.TPassportDevicePlatform;
+    appVersion?: string;
+    capabilities?: Partial<data.IPassportCapabilities>;
+  };
+  response: {
+    challengeId: string;
+    pairingToken: string;
+    pairingPayload: string;
+    signingPayload: string;
+    expiresAt: number;
+  };
+}
+
+export interface IReq_CompletePassportEnrollment
+  extends plugins.typedRequestInterfaces.implementsTR<
+    plugins.typedRequestInterfaces.ITypedRequest,
+    IReq_CompletePassportEnrollment
+  > {
+  method: 'completePassportEnrollment';
+  request: {
+    pairingToken: string;
+    deviceLabel: string;
+    platform: data.TPassportDevicePlatform;
+    publicKeyX963Base64: string;
+    signatureBase64: string;
+    signatureFormat?: data.TPassportSignatureFormat;
+    appVersion?: string;
+    capabilities?: Partial<data.IPassportCapabilities>;
+  };
+  response: {
+    device: data.IPassportDevice;
+  };
+}
+
+export interface IReq_GetPassportDevices
+  extends plugins.typedRequestInterfaces.implementsTR<
+    plugins.typedRequestInterfaces.ITypedRequest,
+    IReq_GetPassportDevices
+  > {
+  method: 'getPassportDevices';
+  request: {
+    jwt: string;
+  };
+  response: {
+    devices: data.IPassportDevice[];
+  };
+}
+
+export interface IReq_RevokePassportDevice
+  extends plugins.typedRequestInterfaces.implementsTR<
+    plugins.typedRequestInterfaces.ITypedRequest,
+    IReq_RevokePassportDevice
+  > {
+  method: 'revokePassportDevice';
+  request: {
+    jwt: string;
+    deviceId: string;
+  };
+  response: {
+    success: boolean;
+  };
+}
+
+export interface IReq_CreatePassportChallenge
+  extends plugins.typedRequestInterfaces.implementsTR<
+    plugins.typedRequestInterfaces.ITypedRequest,
+    IReq_CreatePassportChallenge
+  > {
+  method: 'createPassportChallenge';
+  request: {
+    jwt: string;
+    type?: Exclude<data.TPassportChallengeType, 'device_enrollment'>;
+    preferredDeviceId?: string;
+    audience?: string;
+    notificationTitle?: string;
+    requireLocation?: boolean;
+    requireNfc?: boolean;
+    locationPolicy?: data.IPassportLocationPolicy;
+  };
+  response: {
+    challengeId: string;
+    challenge: string;
+    signingPayload: string;
+    deviceId: string;
+    expiresAt: number;
+  };
+}
+
+export interface IReq_ApprovePassportChallenge
+  extends plugins.typedRequestInterfaces.implementsTR<
+    plugins.typedRequestInterfaces.ITypedRequest,
+    IReq_ApprovePassportChallenge
+  > {
+  method: 'approvePassportChallenge';
+  request: {
+    challengeId: string;
+    deviceId: string;
+    signatureBase64: string;
+    signatureFormat?: data.TPassportSignatureFormat;
+    location?: data.IPassportLocationEvidence;
+    nfc?: data.IPassportNfcEvidence;
+  };
+  response: {
+    success: boolean;
+    challenge: data.IPassportChallenge;
+  };
+}
+
+export interface IReq_RejectPassportChallenge
+  extends plugins.typedRequestInterfaces.implementsTR<
+    plugins.typedRequestInterfaces.ITypedRequest,
+    IReq_RejectPassportChallenge
+  > {
+  method: 'rejectPassportChallenge';
+  request: IPassportDeviceSignedRequest & {
+    challengeId: string;
+  };
+  response: {
+    success: boolean;
+    challenge: data.IPassportChallenge;
+  };
+}
+
+export interface IReq_RegisterPassportPushToken
+  extends plugins.typedRequestInterfaces.implementsTR<
+    plugins.typedRequestInterfaces.ITypedRequest,
+    IReq_RegisterPassportPushToken
+  > {
+  method: 'registerPassportPushToken';
+  request: IPassportDeviceSignedRequest & {
+    provider: data.TPassportPushProvider;
+    token: string;
+    topic: string;
+    environment: data.TPassportPushEnvironment;
+  };
+  response: {
+    success: boolean;
+  };
+}
+
+export interface IReq_ListPendingPassportChallenges
+  extends plugins.typedRequestInterfaces.implementsTR<
+    plugins.typedRequestInterfaces.ITypedRequest,
+    IReq_ListPendingPassportChallenges
+  > {
+  method: 'listPendingPassportChallenges';
+  request: IPassportDeviceSignedRequest;
+  response: {
+    challenges: data.IPassportChallenge[];
+  };
+}
+
+export interface IReq_GetPassportChallengeByHint
+  extends plugins.typedRequestInterfaces.implementsTR<
+    plugins.typedRequestInterfaces.ITypedRequest,
+    IReq_GetPassportChallengeByHint
+  > {
+  method: 'getPassportChallengeByHint';
+  request: IPassportDeviceSignedRequest & {
+    hintId: string;
+  };
+  response: {
+    challenge?: {
+      challenge: data.IPassportChallenge;
+      signingPayload: string;
+    };
+  };
+}
+
+export interface IReq_MarkPassportChallengeSeen
+  extends plugins.typedRequestInterfaces.implementsTR<
+    plugins.typedRequestInterfaces.ITypedRequest,
+    IReq_MarkPassportChallengeSeen
+  > {
+  method: 'markPassportChallengeSeen';
+  request: IPassportDeviceSignedRequest & {
+    hintId: string;
+  };
+  response: {
+    success: boolean;
+  };
+}
+
+export interface IReq_GetPassportDashboard
+  extends plugins.typedRequestInterfaces.implementsTR<
+    plugins.typedRequestInterfaces.ITypedRequest,
+    IReq_GetPassportDashboard
+  > {
+  method: 'getPassportDashboard';
+  request: IPassportDeviceSignedRequest;
+  response: {
+    profile: {
+      userId: string;
+      name: string;
+      handle: string;
+      organizations: Array<{ id: string; name: string }>;
+      deviceCount: number;
+      recoverySummary: string;
+    };
+    devices: data.IPassportDevice[];
+    challenges: Array<{
+      challenge: data.IPassportChallenge;
+      signingPayload: string;
+    }>;
+    alerts: data.IAlert[];
+  };
+}

ts/request/plan.ts

@@ -0,0 +1,17 @@
+import * as data from '../data/index.js';
+import * as plugins from '../plugins.js';
+
+export interface IReq_GetPlansForOrganizationId
+  extends plugins.typedRequestInterfaces.implementsTR<
+    plugins.typedRequestInterfaces.ITypedRequest,
+    IReq_GetPlansForOrganizationId
+  > {
+  method: 'getBillingPlansForOrganizationId';
+  request: {
+    jwt: string;
+    organizationId: string;
+  };
+  response: {
+    billingPlans: data.IBillingPlan[];
+  };
+}

ts/request/registration.ts

@@ -0,0 +1,90 @@
+import * as plugins from '../plugins.js';
+import { type IUser } from '../data/index.js';
+
+export interface IReq_FirstRegistration
+  extends plugins.typedRequestInterfaces.implementsTR<
+    plugins.typedRequestInterfaces.ITypedRequest,
+    IReq_FirstRegistration
+  > {
+  method: 'firstRegistrationRequest';
+  request: {
+    email: string;
+    productSlugOfInterest: string;
+  };
+  response: {
+    status: 'ok' | 'not ok';
+    testOnlyToken?: string;
+  };
+}
+
+export interface IReq_AfterRegistrationEmailClicked
+  extends plugins.typedRequestInterfaces.implementsTR<
+    plugins.typedRequestInterfaces.ITypedRequest,
+    IReq_AfterRegistrationEmailClicked
+  > {
+  method: 'afterRegistrationEmailClicked';
+  request: {
+    /**
+     * the token that has been sent with the registation email to verify access
+     */
+    token: string;
+  };
+  response: {
+    status: 'ok' | 'not ok';
+    /**
+     * the email thats associated with the given request token
+     */
+    email: string;
+  };
+}
+
+export interface IReq_SetDataForRegistration
+  extends plugins.typedRequestInterfaces.implementsTR<
+    plugins.typedRequestInterfaces.ITypedRequest,
+    IReq_SetDataForRegistration
+  > {
+  method: 'setDataForRegistration';
+  request: {
+    token: string;
+    userData: IUser['data'];
+  };
+  response: {
+    status: 'ok' | 'not ok';
+  };
+}
+
+/**
+ * Should be used to verify a mobile number for an verifcation
+ */
+export interface IReq_MobileVerificationForRegistration
+  extends plugins.typedRequestInterfaces.implementsTR<
+    plugins.typedRequestInterfaces.ITypedRequest,
+    IReq_MobileVerificationForRegistration
+  > {
+  method: 'mobileVerificationForRegistration';
+  request: {
+    token: string;
+    mobileNumber?: string;
+    verificationCode?: string;
+  };
+  response: {
+    messageSent?: boolean;
+    verficationCodeOk?: boolean;
+    testOnlySmsCode?: string;
+  };
+}
+
+export interface IReq_FinishRegistration
+  extends plugins.typedRequestInterfaces.implementsTR<
+    plugins.typedRequestInterfaces.ITypedRequest,
+    IReq_FinishRegistration
+  > {
+  method: 'finishRegistration';
+  request: {
+    token: string;
+  };
+  response: {
+    status: 'ok' | 'not ok';
+    userData?: IUser['data'];
+  };
+}

ts/request/user.ts

@@ -0,0 +1,142 @@
+import * as data from '../data/index.js';
+import * as plugins from '../plugins.js';
+
+export interface IReq_GetUserData
+  extends plugins.typedRequestInterfaces.implementsTR<
+    plugins.typedRequestInterfaces.ITypedRequest,
+    IReq_GetUserData
+  > {
+  method: 'getUserData';
+  request: {
+    refreshToken: string;
+  };
+  response: {
+    jwt: string;
+  };
+}
+
+export interface IReq_SetUserData
+  extends plugins.typedRequestInterfaces.implementsTR<
+    plugins.typedRequestInterfaces.ITypedRequest,
+    IReq_SetUserData
+  > {
+  method: 'setUserData';
+  request: {
+    refreshToken: string;
+  };
+  response: {
+    oneTimeTransferCode: string;
+  };
+}
+
+export interface IReq_SuspendUser
+  extends plugins.typedRequestInterfaces.implementsTR<
+    plugins.typedRequestInterfaces.ITypedRequest,
+    IReq_SuspendUser
+  > {
+  method: 'suspendUser';
+  request: {
+    jwt: string;
+    userId: string;
+  };
+  response: {
+    publicKeyPem: string;
+  };
+}
+
+export interface IDeleteSuspendedUser
+  extends plugins.typedRequestInterfaces.implementsTR<
+    plugins.typedRequestInterfaces.ITypedRequest,
+    IDeleteSuspendedUser
+  > {
+  method: 'deleteSuspendedUser';
+  request: {
+    backendToken: string;
+  };
+  response: {
+    ok: boolean;
+    errorText?: string;
+  };
+}
+
+export interface IReq_GetRolesAndOrganizationsForUserId
+  extends plugins.typedRequestInterfaces.implementsTR<
+    plugins.typedRequestInterfaces.ITypedRequest,
+    IReq_GetRolesAndOrganizationsForUserId
+  > {
+  method: 'getRolesAndOrganizationsForUserId';
+  request: {
+    jwt: string;
+    userId: string;
+  };
+  response: {
+    roles: data.IRole[];
+    organizations: data.IOrganization[];
+  };
+}
+
+export interface IReq_WhoIs {
+  method: 'whoIs';
+  request: {
+    jwt: string;
+  };
+  response: {
+    user: data.IUser;
+  };
+}
+
+export interface IReq_GetUserSessions
+  extends plugins.typedRequestInterfaces.implementsTR<
+    plugins.typedRequestInterfaces.ITypedRequest,
+    IReq_GetUserSessions
+  > {
+  method: 'getUserSessions';
+  request: {
+    jwt: string;
+  };
+  response: {
+    sessions: Array<{
+      id: string;
+      deviceId: string;
+      deviceName: string;
+      browser: string;
+      os: string;
+      ip: string;
+      lastActive: number;
+      createdAt: number;
+      isCurrent: boolean;
+    }>;
+  };
+}
+
+export interface IReq_RevokeSession
+  extends plugins.typedRequestInterfaces.implementsTR<
+    plugins.typedRequestInterfaces.ITypedRequest,
+    IReq_RevokeSession
+  > {
+  method: 'revokeSession';
+  request: {
+    jwt: string;
+    sessionId: string;
+  };
+  response: {
+    success: boolean;
+  };
+}
+
+export interface IReq_GetUserActivity
+  extends plugins.typedRequestInterfaces.implementsTR<
+    plugins.typedRequestInterfaces.ITypedRequest,
+    IReq_GetUserActivity
+  > {
+  method: 'getUserActivity';
+  request: {
+    jwt: string;
+    limit?: number;
+    offset?: number;
+  };
+  response: {
+    activities: data.IActivityLog[];
+    total: number;
+  };
+}

ts/request/userinvitation.ts

@@ -0,0 +1,248 @@
+import * as data from '../data/index.js';
+import * as plugins from '../plugins.js';
+
+/**
+ * Create an invitation to join an organization
+ */
+export interface IReq_CreateInvitation
+  extends plugins.typedRequestInterfaces.implementsTR<
+    plugins.typedRequestInterfaces.ITypedRequest,
+    IReq_CreateInvitation
+  > {
+  method: 'createInvitation';
+  request: {
+    jwt: string;
+    organizationId: string;
+    email: string;
+    roles: string[];
+  };
+  response: {
+    success: boolean;
+    invitation?: data.IUserInvitation;
+    message?: string;
+    /** True if a new invitation was created, false if email was added to existing */
+    isNew: boolean;
+  };
+}
+
+/**
+ * Get pending invitations for an organization
+ */
+export interface IReq_GetOrgInvitations
+  extends plugins.typedRequestInterfaces.implementsTR<
+    plugins.typedRequestInterfaces.ITypedRequest,
+    IReq_GetOrgInvitations
+  > {
+  method: 'getOrgInvitations';
+  request: {
+    jwt: string;
+    organizationId: string;
+  };
+  response: {
+    invitations: data.IUserInvitation[];
+  };
+}
+
+/**
+ * Get members of an organization (users with roles)
+ */
+export interface IReq_GetOrgMembers
+  extends plugins.typedRequestInterfaces.implementsTR<
+    plugins.typedRequestInterfaces.ITypedRequest,
+    IReq_GetOrgMembers
+  > {
+  method: 'getOrgMembers';
+  request: {
+    jwt: string;
+    organizationId: string;
+  };
+  response: {
+    members: Array<{
+      user: data.IUser;
+      role: data.IRole;
+    }>;
+  };
+}
+
+/**
+ * Cancel a pending invitation
+ */
+export interface IReq_CancelInvitation
+  extends plugins.typedRequestInterfaces.implementsTR<
+    plugins.typedRequestInterfaces.ITypedRequest,
+    IReq_CancelInvitation
+  > {
+  method: 'cancelInvitation';
+  request: {
+    jwt: string;
+    organizationId: string;
+    invitationId: string;
+  };
+  response: {
+    success: boolean;
+    message?: string;
+  };
+}
+
+/**
+ * Resend invitation email
+ */
+export interface IReq_ResendInvitation
+  extends plugins.typedRequestInterfaces.implementsTR<
+    plugins.typedRequestInterfaces.ITypedRequest,
+    IReq_ResendInvitation
+  > {
+  method: 'resendInvitation';
+  request: {
+    jwt: string;
+    organizationId: string;
+    invitationId: string;
+  };
+  response: {
+    success: boolean;
+    message?: string;
+  };
+}
+
+/**
+ * Remove a member from an organization
+ */
+export interface IReq_RemoveMember
+  extends plugins.typedRequestInterfaces.implementsTR<
+    plugins.typedRequestInterfaces.ITypedRequest,
+    IReq_RemoveMember
+  > {
+  method: 'removeMember';
+  request: {
+    jwt: string;
+    organizationId: string;
+    userId: string;
+  };
+  response: {
+    success: boolean;
+    message?: string;
+  };
+}
+
+/**
+ * Update a member's roles
+ */
+export interface IReq_UpdateMemberRoles
+  extends plugins.typedRequestInterfaces.implementsTR<
+    plugins.typedRequestInterfaces.ITypedRequest,
+    IReq_UpdateMemberRoles
+  > {
+  method: 'updateMemberRoles';
+  request: {
+    jwt: string;
+    organizationId: string;
+    userId: string;
+    roles: string[];
+  };
+  response: {
+    success: boolean;
+    role?: data.IRole;
+    message?: string;
+  };
+}
+
+/**
+ * Transfer organization ownership to another member
+ */
+export interface IReq_TransferOwnership
+  extends plugins.typedRequestInterfaces.implementsTR<
+    plugins.typedRequestInterfaces.ITypedRequest,
+    IReq_TransferOwnership
+  > {
+  method: 'transferOwnership';
+  request: {
+    jwt: string;
+    organizationId: string;
+    newOwnerId: string;
+    confirmationText: string;
+  };
+  response: {
+    success: boolean;
+    message?: string;
+  };
+}
+
+/**
+ * Accept an invitation (called during registration or email verification)
+ */
+export interface IReq_AcceptInvitation
+  extends plugins.typedRequestInterfaces.implementsTR<
+    plugins.typedRequestInterfaces.ITypedRequest,
+    IReq_AcceptInvitation
+  > {
+  method: 'acceptInvitation';
+  request: {
+    token: string;
+    userId: string;
+  };
+  response: {
+    success: boolean;
+    organizations?: data.IOrganization[];
+    roles?: data.IRole[];
+    message?: string;
+  };
+}
+
+/**
+ * Get invitation by token (for invitation landing page)
+ */
+export interface IReq_GetInvitationByToken
+  extends plugins.typedRequestInterfaces.implementsTR<
+    plugins.typedRequestInterfaces.ITypedRequest,
+    IReq_GetInvitationByToken
+  > {
+  method: 'getInvitationByToken';
+  request: {
+    token: string;
+  };
+  response: {
+    invitation?: data.IUserInvitation;
+    organizations?: Array<{
+      id: string;
+      name: string;
+    }>;
+    isExpired: boolean;
+    requiresRegistration: boolean;
+  };
+}
+
+/**
+ * Bulk create invitations from a list (typically from CSV import)
+ */
+export interface IReq_BulkCreateInvitations
+  extends plugins.typedRequestInterfaces.implementsTR<
+    plugins.typedRequestInterfaces.ITypedRequest,
+    IReq_BulkCreateInvitations
+  > {
+  method: 'bulkCreateInvitations';
+  request: {
+    jwt: string;
+    organizationId: string;
+    invitations: Array<{
+      email: string;
+      roles?: string[];
+    }>;
+    defaultRoles: string[];
+  };
+  response: {
+    success: boolean;
+    results: Array<{
+      email: string;
+      success: boolean;
+      status: 'invited' | 'already_member' | 'invalid_email' | 'error';
+      message?: string;
+    }>;
+    summary: {
+      total: number;
+      invited: number;
+      alreadyMembers: number;
+      invalid: number;
+      errors: number;
+    };
+  };
+}