@almyty/credentials 1.5.1 → 1.5.3

package/README.md

@@ -6,10 +6,11 @@ registries then use the credential. Model providers, deployment clouds,
 buckets, chat platforms: all of them are services in the same catalog.
 
 ```sh
-npx @almyty/auth login
-npx @almyty/credentials services --kind inference
-npx @almyty/credentials add openrouter --open
-npx @almyty/credentials list
+npm i -g @almyty/cli
+almyty login
+almyty credentials services --kind inference
+almyty credentials add openrouter --open
+almyty credentials list
 ```
 
 ## What a credential is
@@ -43,7 +44,7 @@ Every read command takes `--json` and writes undecorated JSON to stdout.
 
 | Command | What it does |
 |---|---|
-| `add <service> [--method m] [--owner org\|user\|private] [--name n] [--headless] [--open]` | Add a credential |
+| `add <service> [--method m] [--owner org\|team\|user\|private] [--team id\|slug] [--name n] [--headless] [--open]` | Add a credential |
 | `complete <key> --state s --code c` | Finish a headless sign-in by pasting the code |
 | `validate <id>` | Re-check against the provider; refreshes health and the account label |
 | `rotate <id> [--headless] [--open]` | Replace the secret in place, so everything using the credential keeps working |
@@ -55,14 +56,14 @@ unless `--method` names another. `services` lists them.
 **Sign-in** (OpenRouter and Slack today) is the best path: nothing to paste.
 
 ```sh
-npx @almyty/credentials add openrouter --open
+almyty credentials add openrouter --open
 ```
 
 On a machine with no browser, ask for the headless flow and the provider shows
 a code:
 
 ```sh
-npx @almyty/credentials add openrouter --headless
+almyty credentials add openrouter --headless
 # -> Open this URL to continue: https://…
 #    The provider will show you a code. Paste it with:
 #      almyty credentials complete openrouter --state st-… --code <code>
@@ -76,7 +77,7 @@ whose state the redirect has already consumed.
 the page where the key is created:
 
 ```sh
-npx @almyty/credentials add huggingface --owner user
+almyty credentials add huggingface --owner user
 # Get a key at: https://huggingface.co/settings/tokens
 # Access token: ······
 ```
@@ -106,6 +107,10 @@ narrows that to a principal.
 `--owner org` (the default) makes the credential the organization's: this is
 what agents and deployments use, and it needs `connections:manage` (admin or
 owner). `--owner user` makes it yours, and you can grant it to others.
+`--owner team --team <id|slug>` makes it the organization's for one team:
+only that team's members (and admins) see or use it. The slug is the team's
+name in lowercase with dashes (`Customer Support` is `customer-support`); a
+member can pick only a team they are on.
 `--owner private` makes it yours alone: nobody else sees or uses it, org admins
 included, and it cannot be granted. Free and personal organizations allow
 personal and private credentials by default; paid organizations start with them off until
@@ -125,9 +130,9 @@ In order of preference:
 4. **`--input-stdin`** — the same object on stdin.
 
 ```sh
-npx @almyty/credentials add channel-telegram --input-file bot.json
+almyty credentials add channel-telegram --input-file bot.json
 pass show telegram/bot | jq -Rn '{bot_token: input}' \
-  | npx @almyty/credentials add channel-telegram --input-stdin
+  | almyty credentials add channel-telegram --input-stdin
 ```
 
 `--input '<json>'` still works for the fields a service does **not** mark
@@ -161,9 +166,9 @@ Every chat channel is a service like any other, so a Slack, Discord or
 Telegram token is added here instead of pasted into a gateway form:
 
 ```sh
-npx @almyty/credentials services --kind channel
-npx @almyty/credentials add channel-slack --open
-npx @almyty/credentials add channel-telegram
+almyty credentials services --kind channel
+almyty credentials add channel-slack --open
+almyty credentials add channel-telegram
 ```
 
 The service key is `channel-<gateway type>` with underscores dasherized
@@ -187,7 +192,7 @@ to get it, and how it is validated.
 | 0 | success |
 | 1 | unexpected error |
 | 2 | usage error (bad flags, missing argument, unknown command, a secret on argv) |
-| 3 | not authenticated — run `npx @almyty/auth login` |
+| 3 | not authenticated — run `almyty login` |
 | 4 | not found |
 | 5 | the operation ran and failed (a `validate` whose health is not `valid`) |
 
@@ -202,6 +207,6 @@ turned into tools, served over MCP, A2A, UTCP and Agent Skills.
 - Design notes: `docs/connections.md` in the almyty repository
 - Source: https://github.com/almyty-inc/almyty
 
-Run `npx @almyty/credentials --help` for the full surface.
+Run `almyty credentials --help` for the full surface.
 
 Apache-2.0 © Almyty Inc.

package/dist/index.d.ts

@@ -10,7 +10,23 @@ export declare function parseArgs(argv: string[]): ParsedArgs;
  * which came back as an opaque 400. Say what is missing instead.
  */
 export declare function needArg(positional: string[], index: number, name: string, usage: string): string;
-export declare function connectBody(flags: ParsedArgs['flags'], input?: Record<string, unknown>): Record<string, unknown>;
+export declare function connectBody(flags: ParsedArgs['flags'], input?: Record<string, unknown>, teamId?: string): Record<string, unknown>;
+/** A team's name as a slug: "Customer Support" is customer-support. */
+export declare function teamSlug(name: string): string;
+/** Whether --team is an id already (sent as is; the API checks it). */
+export declare function isTeamId(ref: string): boolean;
+/** The team --team <slug> names, out of the organization's teams. */
+export declare function pickTeam(teams: Array<{
+    id: string;
+    name: string;
+}>, ref: string): string;
+/** The organization a slug is looked up in: the one the key acts in, or the only one. */
+export declare function organizationOf(profile: {
+    currentOrganizationId?: string;
+    organizations?: Array<{
+        id: string;
+    }>;
+}): string;
 export declare function grantBody(flags: ParsedArgs['flags']): Record<string, unknown>;
 /** A JSON object, or a message naming which flag was wrong. */
 export declare function parseInputObject(raw: string, flag: string): Record<string, unknown>;

package/dist/index.js

@@ -92,7 +92,7 @@ Read:
   grants <id>                           Who may use this credential
 
 Add:
-  add <service> [--method m] [--owner org|user|private] [--name n] [--headless] [--open]
+  add <service> [--method m] [--owner org|team|user|private] [--team id|slug] [--name n] [--headless] [--open]
                                         A sign-in prints an authorize URL (--open launches a
                                         browser, --headless asks the service for a code to paste).
                                         A key form prompts for each field, secrets not echoed.
@@ -146,10 +146,18 @@ export function needArg(positional, index, name, usage) {
         throw new UsageError(`${name} is required\n  usage: almyty credentials ${usage}`);
     return v;
 }
-export function connectBody(flags, input) {
+export function connectBody(flags, input, teamId) {
     const body = { owner: str(flags, 'owner') ?? 'org' };
-    if (!['org', 'user', 'private'].includes(body.owner))
-        throw new UsageError('--owner must be org, user or private');
+    if (!['org', 'team', 'user', 'private'].includes(body.owner))
+        throw new UsageError('--owner must be org, team, user or private');
+    if (body.owner === 'team') {
+        if (!teamId)
+            throw new UsageError('--owner team needs the team: --team <id|slug>');
+        body.teamId = teamId;
+    }
+    else if (str(flags, 'team')) {
+        throw new UsageError('--team goes with --owner team');
+    }
     if (str(flags, 'method'))
         body.method = str(flags, 'method');
     if (str(flags, 'name'))
@@ -158,6 +166,35 @@ export function connectBody(flags, input) {
         body.input = input;
     return body;
 }
+const UUID = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+/** A team's name as a slug: "Customer Support" is customer-support. */
+export function teamSlug(name) {
+    return name.trim().toLowerCase().replace(/[^a-z0-9]+/g, '-').replace(/^-+|-+$/g, '');
+}
+/** Whether --team is an id already (sent as is; the API checks it). */
+export function isTeamId(ref) {
+    return UUID.test(ref);
+}
+/** The team --team <slug> names, out of the organization's teams. */
+export function pickTeam(teams, ref) {
+    const wanted = teamSlug(ref);
+    const matches = teams.filter((t) => teamSlug(t.name) === wanted);
+    if (matches.length === 1)
+        return matches[0].id;
+    if (matches.length > 1)
+        throw new UsageError(`more than one team is called ${ref}; pass its id with --team`);
+    const known = teams.map((t) => teamSlug(t.name)).join(', ') || 'none';
+    throw new UsageError(`no team ${ref} in this organization (teams: ${known})`);
+}
+/** The organization a slug is looked up in: the one the key acts in, or the only one. */
+export function organizationOf(profile) {
+    if (profile.currentOrganizationId)
+        return profile.currentOrganizationId;
+    const orgs = profile.organizations ?? [];
+    if (orgs.length === 1)
+        return orgs[0].id;
+    throw new UsageError('this login reaches more than one organization; pass the team id with --team');
+}
 export function grantBody(flags) {
     const principalType = need(flags, 'principal');
     if (!['user', 'team', 'role', 'agent', 'workspace'].includes(principalType))
@@ -270,7 +307,7 @@ export function formatConnectionDetail(c) {
         `${c.name ?? c.connectorKey}`,
         `  id          ${c.id}`,
         `  service     ${c.connectorKey}${c.connectorDisplayName ? ` (${c.connectorDisplayName})` : ''}${c.kind ? `  [${c.kind}]` : ''}`,
-        `  owner       ${c.owner}${c.ownerUserId ? ` (${c.ownerUserId})` : ''}`,
+        `  owner       ${c.owner}${c.owner === 'team' && c.teamId ? ` (${c.teamId})` : c.ownerUserId ? ` (${c.ownerUserId})` : ''}`,
         `  method      ${c.method ?? 'unknown'}`,
         `  account     ${c.accountLabel ?? '(the provider named none)'}`,
         `  health      ${c.health?.status ?? 'unknown'}${c.health?.checkedAt ? `, checked ${c.health.checkedAt}` : ', never checked'}`,
@@ -481,7 +518,20 @@ async function main() {
                 requireTty(`connect ${key} via ${method.type}`);
                 input = await promptForSchema(method.schema);
             }
-            const body = connectBody({ ...args.flags, method: method.type }, input);
+            const teamRef = str(args.flags, 'team');
+            let teamId;
+            if (teamRef && str(args.flags, 'owner') === 'team') {
+                if (isTeamId(teamRef)) {
+                    teamId = teamRef;
+                }
+                else {
+                    const profile = await q('/auth/profile');
+                    const orgId = organizationOf(profile.data ?? {});
+                    const teams = await q(`/organizations/${orgId}/teams`);
+                    teamId = pickTeam(teams.data ?? [], teamRef);
+                }
+            }
+            const body = connectBody({ ...args.flags, method: method.type }, input, teamId);
             if (isRedirect)
                 body.mode = connectMode(args.flags);
             const res = await post(`/credentials/connect/${key}`, body);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@almyty/credentials",
-  "version": "1.5.1",
+  "version": "1.5.3",
   "publishConfig": {
     "access": "public"
   },
@@ -28,7 +28,7 @@
   "author": "almyty",
   "license": "Apache-2.0",
   "dependencies": {
-    "@almyty/client": "^1.5.0"
+    "@almyty/client": "^1.5.2"
   },
   "devDependencies": {
     "@types/node": "^25.4.0",