@bussolabs/closeyourit-cli 0.0.22 → 0.0.27

package/dist/commands/secrets/assets/undelegate.d.ts

@@ -0,0 +1,10 @@
+import { BaseCommand } from '../../../base';
+export default class SecretsAssetsUndelegate extends BaseCommand {
+    static args: {
+        id: import("@oclif/core/lib/interfaces").Arg<string, Record<string, unknown>>;
+    };
+    static flags: {
+        project: import("@oclif/core/lib/interfaces").OptionFlag<string, import("@oclif/core/lib/interfaces").CustomOptions>;
+    };
+    run(): Promise<unknown>;
+}

package/dist/commands/secrets/assets/undelegate.js

@@ -0,0 +1,17 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const core_1 = require("@oclif/core");
+const base_1 = require("../../../base");
+class SecretsAssetsUndelegate extends base_1.BaseCommand {
+    static args = { id: core_1.Args.string({ required: true }) };
+    static flags = { project: core_1.Flags.string({ char: 'p', required: true }) };
+    async run() {
+        const { args, flags } = await this.parse(SecretsAssetsUndelegate);
+        const projectId = await this.resolveProjectId(flags.project);
+        await this.api.delete(`/cli/v1/shared_secret_assets/${encodeURIComponent(args.id)}/undelegate?project_id=${encodeURIComponent(projectId)}`);
+        if (!this.jsonEnabled())
+            this.log(`Removed shared-asset delegation from ${flags.project}`);
+        return { undelegated: true, project_id: projectId };
+    }
+}
+exports.default = SecretsAssetsUndelegate;

package/dist/commands/secrets/assets/upload.d.ts

@@ -0,0 +1,12 @@
+import { BaseCommand } from '../../../base';
+export default class SecretsAssetsUpload extends BaseCommand {
+    static description: string;
+    static flags: {
+        file: import("@oclif/core/lib/interfaces").OptionFlag<string, import("@oclif/core/lib/interfaces").CustomOptions>;
+        name: import("@oclif/core/lib/interfaces").OptionFlag<string, import("@oclif/core/lib/interfaces").CustomOptions>;
+        environment: import("@oclif/core/lib/interfaces").OptionFlag<string | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
+        description: import("@oclif/core/lib/interfaces").OptionFlag<string | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
+        project: import("@oclif/core/lib/interfaces").OptionFlag<string, import("@oclif/core/lib/interfaces").CustomOptions>;
+    };
+    run(): Promise<unknown>;
+}

package/dist/commands/secrets/assets/upload.js

@@ -0,0 +1,25 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const promises_1 = require("node:fs/promises");
+const node_path_1 = require("node:path");
+const core_1 = require("@oclif/core");
+const base_1 = require("../../../base");
+class SecretsAssetsUpload extends base_1.BaseCommand {
+    static description = 'Encrypt and upload a mobile CI secret file (never prints its contents)';
+    static flags = { ...base_1.projectFlag, file: core_1.Flags.string({ required: true }), name: core_1.Flags.string({ required: true }), environment: core_1.Flags.string(), description: core_1.Flags.string() };
+    async run() {
+        const { flags } = await this.parse(SecretsAssetsUpload);
+        const info = await (0, promises_1.stat)(flags.file).catch(() => undefined);
+        if (!info?.isFile())
+            this.error(`File not found or unreadable: ${flags.file}`, { exit: 2 });
+        if (info.size > 10 * 1024 * 1024)
+            this.error('Secret file exceeds 10 MiB', { exit: 2 });
+        const projectId = await this.resolveProjectId(flags.project);
+        const data = await (0, promises_1.readFile)(flags.file);
+        const res = await this.api.upload('POST', `/cli/v1/projects/${encodeURIComponent(projectId)}/secret_assets`, [{ field: 'file', filename: (0, node_path_1.basename)(flags.file), data: new Blob([data]) }], { body: { name: flags.name, environment: flags.environment, description: flags.description } });
+        if (!this.jsonEnabled())
+            this.log(`Encrypted and uploaded ${flags.name}`);
+        return res;
+    }
+}
+exports.default = SecretsAssetsUpload;

package/dist/commands/secrets/assets/versions.d.ts

@@ -0,0 +1,10 @@
+import { BaseCommand } from '../../../base';
+export default class SecretsAssetsVersions extends BaseCommand {
+    static args: {
+        id: import("@oclif/core/lib/interfaces").Arg<string, Record<string, unknown>>;
+    };
+    static flags: {
+        project: import("@oclif/core/lib/interfaces").OptionFlag<string, import("@oclif/core/lib/interfaces").CustomOptions>;
+    };
+    run(): Promise<unknown>;
+}

package/dist/commands/secrets/assets/versions.js

@@ -0,0 +1,18 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const core_1 = require("@oclif/core");
+const base_1 = require("../../../base");
+const output_1 = require("../../../lib/output");
+class SecretsAssetsVersions extends base_1.BaseCommand {
+    static args = { id: core_1.Args.string({ required: true }) };
+    static flags = { ...base_1.projectFlag };
+    async run() {
+        const { args, flags } = await this.parse(SecretsAssetsVersions);
+        const projectId = await this.resolveProjectId(flags.project);
+        const res = await this.api.get(`/cli/v1/projects/${encodeURIComponent(projectId)}/secret_assets/${encodeURIComponent(args.id)}/versions`);
+        if (!this.jsonEnabled())
+            this.log((0, output_1.renderTable)(['VERSION', 'FILENAME', 'BYTES', 'CREATED'], (res.data ?? []).map((v) => [String(v.number ?? ''), String(v.filename ?? ''), String(v.byte_size ?? ''), String(v.created_at ?? '')])));
+        return res;
+    }
+}
+exports.default = SecretsAssetsVersions;

package/dist/commands/secrets/delete.d.ts

@@ -0,0 +1,13 @@
+import { BaseCommand } from '../../base';
+export default class SecretsDelete extends BaseCommand {
+    static args: {
+        name: import("@oclif/core/lib/interfaces").Arg<string, Record<string, unknown>>;
+    };
+    static description: string;
+    static examples: string[];
+    static flags: {
+        environment: import("@oclif/core/lib/interfaces").OptionFlag<string, import("@oclif/core/lib/interfaces").CustomOptions>;
+        project: import("@oclif/core/lib/interfaces").OptionFlag<string, import("@oclif/core/lib/interfaces").CustomOptions>;
+    };
+    run(): Promise<unknown>;
+}

package/dist/commands/secrets/delete.js

@@ -0,0 +1,26 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const core_1 = require("@oclif/core");
+const base_1 = require("../../base");
+class SecretsDelete extends base_1.BaseCommand {
+    static args = {
+        name: core_1.Args.string({ description: 'Secret name', required: true }),
+    };
+    static description = 'Delete a secret from a project environment';
+    static examples = ['<%= config.bin %> secrets delete -p acme-api -e production API_KEY'];
+    static flags = {
+        ...base_1.projectFlag,
+        ...base_1.environmentFlag,
+    };
+    async run() {
+        const { args, flags } = await this.parse(SecretsDelete);
+        const projectId = await this.resolveProjectId(flags.project);
+        const name = args.name.toUpperCase();
+        await this.api.delete(`/cli/v1/projects/${encodeURIComponent(projectId)}/secrets/${encodeURIComponent(name)}?environment=${encodeURIComponent(flags.environment)}`);
+        if (!this.jsonEnabled()) {
+            this.log(`Secret ${name} deleted (${flags.environment}).`);
+        }
+        return { deleted: name };
+    }
+}
+exports.default = SecretsDelete;

package/dist/commands/secrets/download.d.ts

@@ -0,0 +1,12 @@
+import { BaseCommand } from '../../base';
+export default class SecretsDownload extends BaseCommand {
+    static description: string;
+    static examples: string[];
+    static flags: {
+        format: import("@oclif/core/lib/interfaces").OptionFlag<string, import("@oclif/core/lib/interfaces").CustomOptions>;
+        out: import("@oclif/core/lib/interfaces").OptionFlag<string | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
+        environment: import("@oclif/core/lib/interfaces").OptionFlag<string, import("@oclif/core/lib/interfaces").CustomOptions>;
+        project: import("@oclif/core/lib/interfaces").OptionFlag<string, import("@oclif/core/lib/interfaces").CustomOptions>;
+    };
+    run(): Promise<unknown>;
+}

package/dist/commands/secrets/download.js

@@ -0,0 +1,41 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const promises_1 = require("node:fs/promises");
+const core_1 = require("@oclif/core");
+const base_1 = require("../../base");
+class SecretsDownload extends base_1.BaseCommand {
+    static description = 'Download all secrets of an environment as .env or JSON (to a file or stdout). Values with newlines: use --format json. Prefer `cyi run` to avoid writing plaintext to disk.';
+    static examples = [
+        '<%= config.bin %> secrets download -p acme-api -e production --out .env',
+        '<%= config.bin %> secrets download -p acme-api -e production --format json',
+    ];
+    static flags = {
+        ...base_1.projectFlag,
+        ...base_1.environmentFlag,
+        format: core_1.Flags.string({ default: 'env', description: 'Output format', options: ['env', 'json'] }),
+        out: core_1.Flags.string({ description: 'Write to this file instead of stdout' }),
+    };
+    async run() {
+        const { flags } = await this.parse(SecretsDownload);
+        const projectId = await this.resolveProjectId(flags.project);
+        const res = await this.api.get(`/cli/v1/projects/${encodeURIComponent(projectId)}/secrets/bundle?environment=${encodeURIComponent(flags.environment)}`);
+        const map = res.data ?? {};
+        const body = flags.format === 'json'
+            ? JSON.stringify(map, null, 2)
+            : Object.entries(map)
+                .map(([key, value]) => `${key}=${value}`)
+                .join('\n');
+        if (flags.out) {
+            await (0, promises_1.writeFile)(flags.out, `${body}\n`);
+            if (!this.jsonEnabled()) {
+                this.log(`Wrote ${Object.keys(map).length} secrets → ${flags.out}`);
+                this.warn('The file contains plaintext secrets. Prefer `cyi run` to inject them without touching disk.');
+            }
+        }
+        else if (!this.jsonEnabled()) {
+            this.log(body);
+        }
+        return { count: Object.keys(map).length, format: flags.format, out: flags.out ?? null };
+    }
+}
+exports.default = SecretsDownload;

package/dist/commands/secrets/get.d.ts

@@ -0,0 +1,13 @@
+import { BaseCommand } from '../../base';
+export default class SecretsGet extends BaseCommand {
+    static args: {
+        name: import("@oclif/core/lib/interfaces").Arg<string, Record<string, unknown>>;
+    };
+    static description: string;
+    static examples: string[];
+    static flags: {
+        environment: import("@oclif/core/lib/interfaces").OptionFlag<string, import("@oclif/core/lib/interfaces").CustomOptions>;
+        project: import("@oclif/core/lib/interfaces").OptionFlag<string, import("@oclif/core/lib/interfaces").CustomOptions>;
+    };
+    run(): Promise<unknown>;
+}

package/dist/commands/secrets/get.js

@@ -0,0 +1,30 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const core_1 = require("@oclif/core");
+const base_1 = require("../../base");
+class SecretsGet extends base_1.BaseCommand {
+    static args = {
+        name: core_1.Args.string({ description: 'Secret name', required: true }),
+    };
+    static description = 'Print the value of a single secret (pipeable). Requires the secrets.read permission.';
+    static examples = ['<%= config.bin %> secrets get -p acme-api -e production DATABASE_URL'];
+    static flags = {
+        ...base_1.projectFlag,
+        ...base_1.environmentFlag,
+    };
+    async run() {
+        const { args, flags } = await this.parse(SecretsGet);
+        const projectId = await this.resolveProjectId(flags.project);
+        const res = await this.api.get(`/cli/v1/projects/${encodeURIComponent(projectId)}/secrets/bundle?environment=${encodeURIComponent(flags.environment)}`);
+        const map = res.data ?? {};
+        const key = args.name.toUpperCase();
+        if (!(key in map)) {
+            this.error(`Secret not found: ${key} (${flags.environment})`, { exit: 1 });
+        }
+        if (!this.jsonEnabled()) {
+            this.log(map[key]);
+        }
+        return { name: key, value: map[key] };
+    }
+}
+exports.default = SecretsGet;

package/dist/commands/secrets/import.d.ts

@@ -0,0 +1,22 @@
+import { BaseCommand } from '../../base';
+interface Entry {
+    name: string;
+    value: string;
+    description?: string;
+}
+/** Parse a .env text into entries: `KEY=VALUE` lines, skipping blanks and `#` comments. */
+export declare function parseEnv(text: string): Entry[];
+/** Parse JSON: either `{ "NAME": "value" }` or `[{ "name", "value", "description" }]`. */
+export declare function parseJson(text: string): Entry[];
+export default class SecretsImport extends BaseCommand {
+    static description: string;
+    static examples: string[];
+    static flags: {
+        'from-file': import("@oclif/core/lib/interfaces").OptionFlag<string | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
+        format: import("@oclif/core/lib/interfaces").OptionFlag<string, import("@oclif/core/lib/interfaces").CustomOptions>;
+        environment: import("@oclif/core/lib/interfaces").OptionFlag<string, import("@oclif/core/lib/interfaces").CustomOptions>;
+        project: import("@oclif/core/lib/interfaces").OptionFlag<string, import("@oclif/core/lib/interfaces").CustomOptions>;
+    };
+    run(): Promise<unknown>;
+}
+export {};

package/dist/commands/secrets/import.js

@@ -0,0 +1,71 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.parseEnv = parseEnv;
+exports.parseJson = parseJson;
+const promises_1 = require("node:fs/promises");
+const core_1 = require("@oclif/core");
+const base_1 = require("../../base");
+const stdin_1 = require("../../lib/stdin");
+/** Parse a .env text into entries: `KEY=VALUE` lines, skipping blanks and `#` comments. */
+function parseEnv(text) {
+    const entries = [];
+    for (const raw of text.split('\n')) {
+        const line = raw.trim();
+        if (line.length === 0 || line.startsWith('#'))
+            continue;
+        const eq = line.indexOf('=');
+        if (eq === -1)
+            continue;
+        entries.push({ name: line.slice(0, eq).trim(), value: line.slice(eq + 1) });
+    }
+    return entries;
+}
+/** Parse JSON: either `{ "NAME": "value" }` or `[{ "name", "value", "description" }]`. */
+function parseJson(text) {
+    const data = JSON.parse(text);
+    if (Array.isArray(data)) {
+        return data.map((row) => {
+            const item = row;
+            return { name: String(item.name ?? ''), value: String(item.value ?? ''), description: item.description };
+        });
+    }
+    return Object.entries(data).map(([name, value]) => ({ name, value: String(value) }));
+}
+class SecretsImport extends base_1.BaseCommand {
+    static description = 'Import many secrets at once (all-or-nothing) from a .env or JSON file';
+    static examples = [
+        '<%= config.bin %> secrets import -p acme-api -e production --from-file .env',
+        '<%= config.bin %> secrets import -p acme-api -e production --format json --from-file secrets.json',
+        'doppler secrets download --config production --no-file --format json | <%= config.bin %> secrets import -p acme-api -e production --format json',
+    ];
+    static flags = {
+        ...base_1.projectFlag,
+        ...base_1.environmentFlag,
+        'from-file': core_1.Flags.string({ description: 'Path to a .env or JSON file (default: read from stdin)' }),
+        format: core_1.Flags.string({ default: 'env', description: 'Input format', options: ['env', 'json'] }),
+    };
+    async run() {
+        const { flags } = await this.parse(SecretsImport);
+        const projectId = await this.resolveProjectId(flags.project);
+        let text;
+        if (flags['from-file']) {
+            text = await (0, promises_1.readFile)(flags['from-file'], 'utf8');
+        }
+        else {
+            if (process.stdin.isTTY) {
+                this.error('Provide --from-file or pipe the input via stdin (e.g. `doppler secrets download --format json | cyi secrets import --format json`)', { exit: 1 });
+            }
+            text = await (0, stdin_1.readStream)();
+        }
+        const variables = flags.format === 'json' ? parseJson(text) : parseEnv(text);
+        if (variables.length === 0) {
+            this.error('No variables found in the input', { exit: 1 });
+        }
+        const res = await this.api.post(`/cli/v1/projects/${encodeURIComponent(projectId)}/secrets/import`, { environment: flags.environment, variables });
+        if (!this.jsonEnabled()) {
+            this.log(`Imported ${res.data?.imported ?? variables.length} secrets (${flags.environment}).`);
+        }
+        return res;
+    }
+}
+exports.default = SecretsImport;

package/dist/commands/secrets/list.d.ts

@@ -0,0 +1,10 @@
+import { BaseCommand } from '../../base';
+export default class SecretsList extends BaseCommand {
+    static description: string;
+    static examples: string[];
+    static flags: {
+        environment: import("@oclif/core/lib/interfaces").OptionFlag<string | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
+        project: import("@oclif/core/lib/interfaces").OptionFlag<string, import("@oclif/core/lib/interfaces").CustomOptions>;
+    };
+    run(): Promise<unknown>;
+}

package/dist/commands/secrets/list.js

@@ -0,0 +1,32 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const core_1 = require("@oclif/core");
+const base_1 = require("../../base");
+const output_1 = require("../../lib/output");
+class SecretsList extends base_1.BaseCommand {
+    static description = 'List secret names for a project (optionally filtered by environment). Never prints values.';
+    static examples = [
+        '<%= config.bin %> secrets list -p acme-api',
+        '<%= config.bin %> secrets list -p acme-api -e production',
+    ];
+    static flags = {
+        ...base_1.projectFlag,
+        environment: core_1.Flags.string({ char: 'e', description: 'Filter by environment code or id' }),
+    };
+    async run() {
+        const { flags } = await this.parse(SecretsList);
+        const projectId = await this.resolveProjectId(flags.project);
+        const query = flags.environment ? `?environment=${encodeURIComponent(flags.environment)}` : '';
+        const res = await this.api.get(`/cli/v1/projects/${encodeURIComponent(projectId)}/secrets${query}`);
+        if (!this.jsonEnabled()) {
+            const rows = (res.data ?? []).map((secret) => [
+                String(secret.name ?? ''),
+                String(secret.environment?.code ?? ''),
+                String(secret.description ?? ''),
+            ]);
+            this.log((0, output_1.renderTable)(['NAME', 'ENVIRONMENT', 'DESCRIPTION'], rows));
+        }
+        return res;
+    }
+}
+exports.default = SecretsList;

package/dist/commands/secrets/set.d.ts

@@ -0,0 +1,15 @@
+import { BaseCommand } from '../../base';
+export default class SecretsSet extends BaseCommand {
+    static args: {
+        assignment: import("@oclif/core/lib/interfaces").Arg<string, Record<string, unknown>>;
+    };
+    static description: string;
+    static examples: string[];
+    static flags: {
+        value: import("@oclif/core/lib/interfaces").OptionFlag<string | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
+        description: import("@oclif/core/lib/interfaces").OptionFlag<string | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
+        environment: import("@oclif/core/lib/interfaces").OptionFlag<string, import("@oclif/core/lib/interfaces").CustomOptions>;
+        project: import("@oclif/core/lib/interfaces").OptionFlag<string, import("@oclif/core/lib/interfaces").CustomOptions>;
+    };
+    run(): Promise<unknown>;
+}

package/dist/commands/secrets/set.js

@@ -0,0 +1,36 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const core_1 = require("@oclif/core");
+const base_1 = require("../../base");
+class SecretsSet extends base_1.BaseCommand {
+    static args = {
+        assignment: core_1.Args.string({ description: 'NAME=VALUE, or just NAME with --value', required: true }),
+    };
+    static description = 'Set (create or update) a secret for a project environment';
+    static examples = [
+        '<%= config.bin %> secrets set -p acme-api -e production DATABASE_URL=postgres://user:pass@host/db',
+        '<%= config.bin %> secrets set -p acme-api -e production API_KEY --value s3cr3t --description "Stripe key"',
+    ];
+    static flags = {
+        ...base_1.projectFlag,
+        ...base_1.environmentFlag,
+        value: core_1.Flags.string({ description: 'Secret value (use when the arg is just NAME)' }),
+        description: core_1.Flags.string({ description: 'Optional description' }),
+    };
+    async run() {
+        const { args, flags } = await this.parse(SecretsSet);
+        const projectId = await this.resolveProjectId(flags.project);
+        const eq = args.assignment.indexOf('=');
+        const name = eq === -1 ? args.assignment : args.assignment.slice(0, eq);
+        const value = eq === -1 ? flags.value : args.assignment.slice(eq + 1);
+        if (value === undefined) {
+            this.error('Provide a value: use NAME=VALUE or pass --value', { exit: 1 });
+        }
+        const res = await this.api.post(`/cli/v1/projects/${encodeURIComponent(projectId)}/secrets`, { environment: flags.environment, name, value, description: flags.description });
+        if (!this.jsonEnabled()) {
+            this.log(`Secret ${String(name).toUpperCase()} saved (${flags.environment}).`);
+        }
+        return res;
+    }
+}
+exports.default = SecretsSet;

package/dist/commands/secrets/sync.d.ts

@@ -0,0 +1,9 @@
+import { BaseCommand } from '../../base';
+export default class SecretsSync extends BaseCommand {
+    static description: string;
+    static examples: string[];
+    static flags: {
+        project: import("@oclif/core/lib/interfaces").OptionFlag<string, import("@oclif/core/lib/interfaces").CustomOptions>;
+    };
+    run(): Promise<unknown>;
+}

package/dist/commands/secrets/sync.js

@@ -0,0 +1,20 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const base_1 = require("../../base");
+class SecretsSync extends base_1.BaseCommand {
+    static description = "Push the project's vault secrets to its connected GitHub repo Environment secrets (enqueues a background sync). Requires the github.manage permission.";
+    static examples = ['<%= config.bin %> secrets sync -p acme-api'];
+    static flags = {
+        ...base_1.projectFlag,
+    };
+    async run() {
+        const { flags } = await this.parse(SecretsSync);
+        const projectId = await this.resolveProjectId(flags.project);
+        const res = await this.api.post(`/cli/v1/projects/${encodeURIComponent(projectId)}/secrets/sync`);
+        if (!this.jsonEnabled()) {
+            this.log(`Secret sync enqueued for project ${flags.project}.`);
+        }
+        return res;
+    }
+}
+exports.default = SecretsSync;

package/dist/commands/service-accounts/create.d.ts

@@ -0,0 +1,15 @@
+import { BaseCommand } from '../../base';
+export default class ServiceAccountsCreate extends BaseCommand {
+    static description: string;
+    static examples: string[];
+    static flags: {
+        name: import("@oclif/core/lib/interfaces").OptionFlag<string, import("@oclif/core/lib/interfaces").CustomOptions>;
+        handle: import("@oclif/core/lib/interfaces").OptionFlag<string | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
+        project: import("@oclif/core/lib/interfaces").OptionFlag<string[] | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
+        group: import("@oclif/core/lib/interfaces").OptionFlag<string[] | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
+        role: import("@oclif/core/lib/interfaces").OptionFlag<string[] | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
+        'grant-secrets': import("@oclif/core/lib/interfaces").BooleanFlag<boolean>;
+        'secret-environment': import("@oclif/core/lib/interfaces").OptionFlag<string[] | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
+    };
+    run(): Promise<unknown>;
+}

package/dist/commands/service-accounts/create.js

@@ -0,0 +1,46 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const core_1 = require("@oclif/core");
+const base_1 = require("../../base");
+class ServiceAccountsCreate extends base_1.BaseCommand {
+    static description = 'Create a service account (AI member, CLI-only)';
+    static examples = [
+        '<%= config.bin %> service-accounts create --name "Deploy bot" --project CYI --grant-secrets --secret-environment staging',
+    ];
+    static flags = {
+        name: core_1.Flags.string({ description: 'Display name', required: true }),
+        handle: core_1.Flags.string({ description: 'Handle (a-z, 0-9, underscore); derived from name if omitted' }),
+        project: core_1.Flags.string({ description: 'Grant visibility on a project key/id (repeatable)', multiple: true }),
+        group: core_1.Flags.string({ description: 'Grant visibility on a group name/id (repeatable)', multiple: true }),
+        role: core_1.Flags.string({ description: 'Assign a role name/id (repeatable)', multiple: true }),
+        'grant-secrets': core_1.Flags.boolean({ description: 'Grant read+write secrets on the visible projects', default: false }),
+        'secret-environment': core_1.Flags.string({
+            description: 'Restrict secret access to these environment codes (repeatable; empty = all environments)',
+            multiple: true,
+        }),
+    };
+    async run() {
+        const { flags } = await this.parse(ServiceAccountsCreate);
+        const projectIds = await Promise.all((flags.project ?? []).map((value) => this.resolveProjectId(value)));
+        const groupIds = await Promise.all((flags.group ?? []).map((value) => this.resolveGroupId(value)));
+        const roleIds = await Promise.all((flags.role ?? []).map((value) => this.resolveRoleId(value)));
+        const body = {
+            name: flags.name,
+            project_ids: projectIds,
+            group_ids: groupIds,
+            role_ids: roleIds,
+            grant_secrets: flags['grant-secrets'],
+            secret_environment_codes: flags['secret-environment'] ?? [],
+        };
+        if (flags.handle)
+            body.handle = flags.handle;
+        const res = await this.api.post('/cli/v1/service/accounts', body);
+        if (!this.jsonEnabled()) {
+            const id = res.data?.id ?? '<id>';
+            this.log(`Created service account ${id} (@${res.data?.handle ?? ''}).`);
+            this.log(`Mint a token with: service-accounts tokens create ${id} <name>`);
+        }
+        return res;
+    }
+}
+exports.default = ServiceAccountsCreate;

package/dist/commands/service-accounts/delete.d.ts

@@ -0,0 +1,12 @@
+import { BaseCommand } from '../../base';
+export default class ServiceAccountsDelete extends BaseCommand {
+    static args: {
+        id: import("@oclif/core/lib/interfaces").Arg<string, Record<string, unknown>>;
+    };
+    static description: string;
+    static examples: string[];
+    static flags: {
+        confirm: import("@oclif/core/lib/interfaces").BooleanFlag<boolean>;
+    };
+    run(): Promise<unknown>;
+}

package/dist/commands/service-accounts/delete.js

@@ -0,0 +1,25 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const core_1 = require("@oclif/core");
+const base_1 = require("../../base");
+class ServiceAccountsDelete extends base_1.BaseCommand {
+    static args = {
+        id: core_1.Args.string({ description: 'Service account id', required: true }),
+    };
+    static description = 'Delete a service account (revokes its tokens + removes org access; the secrets audit trail is kept)';
+    static examples = ['<%= config.bin %> service-accounts delete <id> --confirm'];
+    static flags = {
+        confirm: core_1.Flags.boolean({ description: 'Required: confirm the deletion' }),
+    };
+    async run() {
+        const { args, flags } = await this.parse(ServiceAccountsDelete);
+        if (!flags.confirm) {
+            this.error('Refusing to delete without --confirm.', { exit: 2 });
+        }
+        await this.api.delete(`/cli/v1/service/accounts/${encodeURIComponent(args.id)}`);
+        if (!this.jsonEnabled())
+            this.log(`Deleted service account ${args.id}`);
+        return { deleted: args.id };
+    }
+}
+exports.default = ServiceAccountsDelete;

package/dist/commands/service-accounts/list.d.ts

@@ -0,0 +1,9 @@
+import { BaseCommand } from '../../base';
+export default class ServiceAccountsList extends BaseCommand {
+    static description: string;
+    static examples: string[];
+    static flags: {
+        page: import("@oclif/core/lib/interfaces").OptionFlag<number, import("@oclif/core/lib/interfaces").CustomOptions>;
+    };
+    run(): Promise<unknown>;
+}

package/dist/commands/service-accounts/list.js

@@ -0,0 +1,25 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const base_1 = require("../../base");
+const output_1 = require("../../lib/output");
+class ServiceAccountsList extends base_1.BaseCommand {
+    static description = 'List the service accounts (AI members, CLI-only) in your organization';
+    static examples = ['<%= config.bin %> service-accounts list', '<%= config.bin %> service-accounts list --json'];
+    static flags = { ...base_1.pageFlag };
+    async run() {
+        const { flags } = await this.parse(ServiceAccountsList);
+        const res = await this.api.get(`/cli/v1/service/accounts?page=${flags.page}`);
+        const accounts = res.data ?? [];
+        if (!this.jsonEnabled()) {
+            this.log((0, output_1.renderTable)(['NAME', 'HANDLE', 'SECRET ENVS', 'TOKENS', 'ID'], accounts.map((account) => [
+                String(account.name ?? ''),
+                String(account.handle ?? ''),
+                (account.secret_environment_codes ?? []).join(',') || 'all',
+                String(account.active_tokens_count ?? 0),
+                String(account.id ?? ''),
+            ])));
+        }
+        return res;
+    }
+}
+exports.default = ServiceAccountsList;

package/dist/commands/service-accounts/tokens/create.d.ts

@@ -0,0 +1,10 @@
+import { BaseCommand } from '../../../base';
+export default class ServiceAccountsTokensCreate extends BaseCommand {
+    static args: {
+        account: import("@oclif/core/lib/interfaces").Arg<string, Record<string, unknown>>;
+        name: import("@oclif/core/lib/interfaces").Arg<string, Record<string, unknown>>;
+    };
+    static description: string;
+    static examples: string[];
+    run(): Promise<unknown>;
+}