@almyty/credentials 1.5.0 → 1.5.2

package/README.md

@@ -43,7 +43,7 @@ Every read command takes `--json` and writes undecorated JSON to stdout.
 
 | Command | What it does |
 |---|---|
-| `add <service> [--method m] [--owner org\|user\|private] [--name n] [--headless] [--open]` | Add a credential |
+| `add <service> [--method m] [--owner org\|team\|user\|private] [--team id\|slug] [--name n] [--headless] [--open]` | Add a credential |
 | `complete <key> --state s --code c` | Finish a headless sign-in by pasting the code |
 | `validate <id>` | Re-check against the provider; refreshes health and the account label |
 | `rotate <id> [--headless] [--open]` | Replace the secret in place, so everything using the credential keeps working |
@@ -106,6 +106,10 @@ narrows that to a principal.
 `--owner org` (the default) makes the credential the organization's: this is
 what agents and deployments use, and it needs `connections:manage` (admin or
 owner). `--owner user` makes it yours, and you can grant it to others.
+`--owner team --team <id|slug>` makes it the organization's for one team:
+only that team's members (and admins) see or use it. The slug is the team's
+name in lowercase with dashes (`Customer Support` is `customer-support`); a
+member can pick only a team they are on.
 `--owner private` makes it yours alone: nobody else sees or uses it, org admins
 included, and it cannot be granted. Free and personal organizations allow
 personal and private credentials by default; paid organizations start with them off until

package/dist/index.d.ts

@@ -10,7 +10,23 @@ export declare function parseArgs(argv: string[]): ParsedArgs;
  * which came back as an opaque 400. Say what is missing instead.
  */
 export declare function needArg(positional: string[], index: number, name: string, usage: string): string;
-export declare function connectBody(flags: ParsedArgs['flags'], input?: Record<string, unknown>): Record<string, unknown>;
+export declare function connectBody(flags: ParsedArgs['flags'], input?: Record<string, unknown>, teamId?: string): Record<string, unknown>;
+/** A team's name as a slug: "Customer Support" is customer-support. */
+export declare function teamSlug(name: string): string;
+/** Whether --team is an id already (sent as is; the API checks it). */
+export declare function isTeamId(ref: string): boolean;
+/** The team --team <slug> names, out of the organization's teams. */
+export declare function pickTeam(teams: Array<{
+    id: string;
+    name: string;
+}>, ref: string): string;
+/** The organization a slug is looked up in: the one the key acts in, or the only one. */
+export declare function organizationOf(profile: {
+    currentOrganizationId?: string;
+    organizations?: Array<{
+        id: string;
+    }>;
+}): string;
 export declare function grantBody(flags: ParsedArgs['flags']): Record<string, unknown>;
 /** A JSON object, or a message naming which flag was wrong. */
 export declare function parseInputObject(raw: string, flag: string): Record<string, unknown>;
@@ -62,3 +78,10 @@ export declare function unscreenableInputMessage(): string;
  * provider then rejected for a reason that had nothing to do with the key.
  */
 export declare function requireTty(what: string, isTty?: boolean): void;
+/**
+ * True when `argv1` is this module, directly or through the npm bin
+ * symlink. The old check matched the path against a regex and bailed out
+ * when VITEST was set, so a smoke test that spawned the built CLI from
+ * vitest inherited VITEST and got no output at all.
+ */
+export declare function isEntrypoint(argv1: string | undefined, moduleUrl: string): boolean;

package/dist/index.js

@@ -15,7 +15,8 @@
  * `--input` stays for non-secret fields and is refused for secret ones.
  */
 import { createInterface } from 'readline';
-import { readFileSync } from 'fs';
+import { readFileSync, realpathSync } from 'fs';
+import { fileURLToPath } from 'url';
 import { AlmytyClient, resolveCredentialsOrExit } from '@almyty/client';
 import { EXIT, EXIT_CODE_HELP, UsageError, describeError, exitCodeFor } from './exit-codes.js';
 import { VERSION } from './version.js';
@@ -91,7 +92,7 @@ Read:
   grants <id>                           Who may use this credential
 
 Add:
-  add <service> [--method m] [--owner org|user|private] [--name n] [--headless] [--open]
+  add <service> [--method m] [--owner org|team|user|private] [--team id|slug] [--name n] [--headless] [--open]
                                         A sign-in prints an authorize URL (--open launches a
                                         browser, --headless asks the service for a code to paste).
                                         A key form prompts for each field, secrets not echoed.
@@ -145,10 +146,18 @@ export function needArg(positional, index, name, usage) {
         throw new UsageError(`${name} is required\n  usage: almyty credentials ${usage}`);
     return v;
 }
-export function connectBody(flags, input) {
+export function connectBody(flags, input, teamId) {
     const body = { owner: str(flags, 'owner') ?? 'org' };
-    if (!['org', 'user', 'private'].includes(body.owner))
-        throw new UsageError('--owner must be org, user or private');
+    if (!['org', 'team', 'user', 'private'].includes(body.owner))
+        throw new UsageError('--owner must be org, team, user or private');
+    if (body.owner === 'team') {
+        if (!teamId)
+            throw new UsageError('--owner team needs the team: --team <id|slug>');
+        body.teamId = teamId;
+    }
+    else if (str(flags, 'team')) {
+        throw new UsageError('--team goes with --owner team');
+    }
     if (str(flags, 'method'))
         body.method = str(flags, 'method');
     if (str(flags, 'name'))
@@ -157,6 +166,35 @@ export function connectBody(flags, input) {
         body.input = input;
     return body;
 }
+const UUID = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+/** A team's name as a slug: "Customer Support" is customer-support. */
+export function teamSlug(name) {
+    return name.trim().toLowerCase().replace(/[^a-z0-9]+/g, '-').replace(/^-+|-+$/g, '');
+}
+/** Whether --team is an id already (sent as is; the API checks it). */
+export function isTeamId(ref) {
+    return UUID.test(ref);
+}
+/** The team --team <slug> names, out of the organization's teams. */
+export function pickTeam(teams, ref) {
+    const wanted = teamSlug(ref);
+    const matches = teams.filter((t) => teamSlug(t.name) === wanted);
+    if (matches.length === 1)
+        return matches[0].id;
+    if (matches.length > 1)
+        throw new UsageError(`more than one team is called ${ref}; pass its id with --team`);
+    const known = teams.map((t) => teamSlug(t.name)).join(', ') || 'none';
+    throw new UsageError(`no team ${ref} in this organization (teams: ${known})`);
+}
+/** The organization a slug is looked up in: the one the key acts in, or the only one. */
+export function organizationOf(profile) {
+    if (profile.currentOrganizationId)
+        return profile.currentOrganizationId;
+    const orgs = profile.organizations ?? [];
+    if (orgs.length === 1)
+        return orgs[0].id;
+    throw new UsageError('this login reaches more than one organization; pass the team id with --team');
+}
 export function grantBody(flags) {
     const principalType = need(flags, 'principal');
     if (!['user', 'team', 'role', 'agent', 'workspace'].includes(principalType))
@@ -269,7 +307,7 @@ export function formatConnectionDetail(c) {
         `${c.name ?? c.connectorKey}`,
         `  id          ${c.id}`,
         `  service     ${c.connectorKey}${c.connectorDisplayName ? ` (${c.connectorDisplayName})` : ''}${c.kind ? `  [${c.kind}]` : ''}`,
-        `  owner       ${c.owner}${c.ownerUserId ? ` (${c.ownerUserId})` : ''}`,
+        `  owner       ${c.owner}${c.owner === 'team' && c.teamId ? ` (${c.teamId})` : c.ownerUserId ? ` (${c.ownerUserId})` : ''}`,
         `  method      ${c.method ?? 'unknown'}`,
         `  account     ${c.accountLabel ?? '(the provider named none)'}`,
         `  health      ${c.health?.status ?? 'unknown'}${c.health?.checkedAt ? `, checked ${c.health.checkedAt}` : ', never checked'}`,
@@ -480,7 +518,20 @@ async function main() {
                 requireTty(`connect ${key} via ${method.type}`);
                 input = await promptForSchema(method.schema);
             }
-            const body = connectBody({ ...args.flags, method: method.type }, input);
+            const teamRef = str(args.flags, 'team');
+            let teamId;
+            if (teamRef && str(args.flags, 'owner') === 'team') {
+                if (isTeamId(teamRef)) {
+                    teamId = teamRef;
+                }
+                else {
+                    const profile = await q('/auth/profile');
+                    const orgId = organizationOf(profile.data ?? {});
+                    const teams = await q(`/organizations/${orgId}/teams`);
+                    teamId = pickTeam(teams.data ?? [], teamRef);
+                }
+            }
+            const body = connectBody({ ...args.flags, method: method.type }, input, teamId);
             if (isRedirect)
                 body.mode = connectMode(args.flags);
             const res = await post(`/credentials/connect/${key}`, body);
@@ -580,8 +631,23 @@ async function main() {
             process.exit(EXIT.USAGE);
     }
 }
-const invokedDirectly = process.argv[1] && /credentials-cli|almyty-credentials|dist\/index\.js|src\/index\.ts/.test(process.argv[1]) && !process.env.VITEST;
-if (invokedDirectly) {
+/**
+ * True when `argv1` is this module, directly or through the npm bin
+ * symlink. The old check matched the path against a regex and bailed out
+ * when VITEST was set, so a smoke test that spawned the built CLI from
+ * vitest inherited VITEST and got no output at all.
+ */
+export function isEntrypoint(argv1, moduleUrl) {
+    if (!argv1)
+        return false;
+    try {
+        return realpathSync(argv1) === realpathSync(fileURLToPath(moduleUrl));
+    }
+    catch {
+        return false;
+    }
+}
+if (isEntrypoint(process.argv[1], import.meta.url)) {
     main().catch((err) => {
         console.error(describeError(err, process.env.ALMYTY_URL));
         process.exit(exitCodeFor(err));

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@almyty/credentials",
-  "version": "1.5.0",
+  "version": "1.5.2",
   "publishConfig": {
     "access": "public"
   },
@@ -28,7 +28,7 @@
   "author": "almyty",
   "license": "Apache-2.0",
   "dependencies": {
-    "@almyty/client": "^1.2.0"
+    "@almyty/client": "^1.5.1"
   },
   "devDependencies": {
     "@types/node": "^25.4.0",