@ait-co/console-cli 0.1.38 → 0.1.39

package/README.en.md

@@ -223,6 +223,28 @@ The following command groups are implemented end-to-end:
 
 `app logs` is deferred until the backend endpoint is available. See the [organization landing page](https://aitc.dev/) for the full roadmap.
 
+## Issuing a Deploy Key
+
+Issue a workspace-scoped credential (Deploy Key) for deploy automation:
+
+```sh
+aitcc keys create --name ci-deploy
+```
+
+The key is automatically saved to `~/.ait/credentials` under the `ci-deploy` profile as soon as it is issued — no separate `ait token add` step required:
+
+```sh
+ait deploy --profile ci-deploy ./bundle.ait
+```
+
+Only the plaintext key is written to stdout (pipe-friendly). stderr confirms which profile was saved. If you are piping the key into an external secret manager and do not need a local profile, pass `--no-save-profile`:
+
+```sh
+aitcc keys create --name ci-deploy --no-save-profile | secret-tool store --label=… key password
+```
+
+To save the profile under a different name than `--name`, pass `--save-profile <other-name>`. The plaintext key is exposed once at issuance and cannot be retrieved later — if you lose it, revoke it with `aitcc keys revoke <id>` and issue a new one.
+
 ## Pre-commit hook
 
 Optional but recommended. After cloning, activate the standard pre-commit hook (runs `biome check` on staged files):

package/README.md

@@ -223,6 +223,28 @@ aitcc telemetry tier0-on        # Tier 0 다시 활성화
 
 `app logs`는 백엔드 endpoint 확보 후 구현 예정입니다. 전체 로드맵은 [organization landing page](https://aitc.dev/) 참조.
 
+## Deploy Key 발급
+
+배포 자동화를 위한 워크스페이스-scope 자격증명(Deploy Key)을 발급합니다.
+
+```sh
+aitcc keys create --name ci-deploy
+```
+
+키 발급 즉시 `~/.ait/credentials`에 `ci-deploy` 프로파일로 저장되므로, 별도 `ait token add` 단계 없이 바로 사용할 수 있습니다:
+
+```sh
+ait deploy --profile ci-deploy ./bundle.ait
+```
+
+stdout에는 plaintext 키 한 줄만 나옵니다 (파이프 친화적). stderr는 저장된 프로파일 이름을 확인해줍니다. CI 파이프에서 키를 외부 secret manager에 직접 주입할 때처럼 로컬 저장이 필요 없다면 `--no-save-profile`로 저장을 건너뜁니다:
+
+```sh
+aitcc keys create --name ci-deploy --no-save-profile | secret-tool store --label=… key password
+```
+
+프로파일 이름을 `--name`과 다르게 지정하려면 `--save-profile <other-name>`을 사용합니다. plaintext 키는 발급 시 한 번만 노출되며 목록 endpoint에서 다시 확인할 수 없습니다 — 분실 시 `aitcc keys revoke <id>`로 무효화하고 재발급합니다.
+
 ## Pre-commit hook
 
 선택 사항이지만 권장합니다. clone 후 표준 pre-commit hook을 활성화하면 staged 파일에 `biome check`가 자동으로 돕니다 (push 전 빠른 피드백):

package/dist/cli.mjs

@@ -6833,8 +6833,11 @@ function readCredentials(path) {
 }
 function writeCredentials(path, map) {
 	const dir = join(path, "..");
-	if (!existsSync(dir)) mkdirSync(dir, { recursive: true });
-	writeFileSync(path, JSON.stringify(map, null, 2) + "\n", {
+	if (!existsSync(dir)) mkdirSync(dir, {
+		recursive: true,
+		mode: 448
+	});
+	writeFileSync(path, `${JSON.stringify(map, null, 2)}\n`, {
 		encoding: "utf8",
 		mode: 384
 	});
@@ -6952,6 +6955,20 @@ function validateKeyName(raw) {
 	if (!NAME_REGEX.test(raw)) return "bad-chars";
 	return null;
 }
+/**
+* Resolve the ait profile name to save the Deploy Key under.
+*
+* - `noSaveProfile: true` → undefined (skip saving)
+* - `saveProfileOverride` present → use that name
+* - default → use `name` (the --name value)
+*
+* Exported for unit testing.
+*/
+function resolveProfileName(name, opts) {
+	if (opts.noSaveProfile) return void 0;
+	if (opts.saveProfileOverride) return opts.saveProfileOverride;
+	return name;
+}
 function parseAppsFlag(raw) {
 	const slugs = raw.split(",").map((s) => s.trim()).filter((s) => s.length > 0);
 	if (slugs.length === 0) return {
@@ -7045,7 +7062,12 @@ const createCommand = defineCommand({
 		},
 		"save-profile": {
 			type: "string",
-			description: "After issuing, save the key as an `ait` token profile (written to `~/.ait/credentials`). The named profile can then be used with `ait deploy --profile <name>` immediately. If omitted, the key is printed to stdout once and not persisted locally."
+			description: "Profile name for the ait token (defaults to --name). The key is written to `~/.ait/credentials` so `ait deploy --profile <name>` works immediately. Use --no-save-profile to skip."
+		},
+		"no-save-profile": {
+			type: "boolean",
+			default: false,
+			description: "Do not save the issued key to an ait token profile — print to stdout only (for CI pipes that store it elsewhere)."
 		},
 		json: {
 			type: "boolean",
@@ -7096,7 +7118,10 @@ const createCommand = defineCommand({
 				name,
 				target
 			}, session.cookies);
-			const saveProfileName = args["save-profile"] ? String(args["save-profile"]) : void 0;
+			const saveProfileName = resolveProfileName(name, {
+				noSaveProfile: args["no-save-profile"],
+				...args["save-profile"] ? { saveProfileOverride: String(args["save-profile"]) } : {}
+			});
 			let savedProfile;
 			let saveProfileWarning;
 			if (saveProfileName !== void 0) {
@@ -9167,7 +9192,7 @@ function resolveVersion() {
 		if (typeof injected === "string" && injected.length > 0) return injected;
 	} catch {}
 	try {
-		return "0.1.38";
+		return "0.1.39";
 	} catch {}
 	return "0.0.0-dev";
 }