@bussolabs/closeyourit-cli 0.0.22 → 0.0.27

package/dist/commands/service-accounts/tokens/create.js

@@ -0,0 +1,27 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const core_1 = require("@oclif/core");
+const base_1 = require("../../../base");
+class ServiceAccountsTokensCreate extends base_1.BaseCommand {
+    static args = {
+        account: core_1.Args.string({ description: 'Service account id', required: true }),
+        name: core_1.Args.string({ description: 'Token name (e.g. ci-deploy)', required: true }),
+    };
+    static description = 'Create a CLI token (cyi_u_) for a service account (the secret is shown only once)';
+    static examples = ['<%= config.bin %> service-accounts tokens create <account-id> ci-deploy'];
+    async run() {
+        const { args } = await this.parse(ServiceAccountsTokensCreate);
+        const res = await this.api.post(`/cli/v1/service/accounts/${encodeURIComponent(args.account)}/tokens`, { name: args.name });
+        const token = res.data ?? {};
+        if (!this.jsonEnabled()) {
+            this.log('Service account token created. Store the secret now — it is shown only once:');
+            this.log('');
+            this.log(`  secret: ${token.secret ?? '-'}`);
+            this.log('');
+            this.log('Use it headless: CLOSEYOURIT_TOKEN=<secret> closeyourit secrets bundle -p KEY -e development');
+            this.warn('The secret cannot be retrieved again. If you lose it, revoke and create a new one.');
+        }
+        return res;
+    }
+}
+exports.default = ServiceAccountsTokensCreate;

package/dist/commands/service-accounts/tokens/revoke.d.ts

@@ -0,0 +1,13 @@
+import { BaseCommand } from '../../../base';
+export default class ServiceAccountsTokensRevoke extends BaseCommand {
+    static args: {
+        account: import("@oclif/core/lib/interfaces").Arg<string, Record<string, unknown>>;
+        id: import("@oclif/core/lib/interfaces").Arg<string, Record<string, unknown>>;
+    };
+    static description: string;
+    static examples: string[];
+    static flags: {
+        confirm: import("@oclif/core/lib/interfaces").BooleanFlag<boolean>;
+    };
+    run(): Promise<unknown>;
+}

package/dist/commands/service-accounts/tokens/revoke.js

@@ -0,0 +1,26 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const core_1 = require("@oclif/core");
+const base_1 = require("../../../base");
+class ServiceAccountsTokensRevoke extends base_1.BaseCommand {
+    static args = {
+        account: core_1.Args.string({ description: 'Service account id', required: true }),
+        id: core_1.Args.string({ description: 'Token id', required: true }),
+    };
+    static description = 'Revoke a service account CLI token (the agent using it loses access)';
+    static examples = ['<%= config.bin %> service-accounts tokens revoke <account-id> <token-id> --confirm'];
+    static flags = {
+        confirm: core_1.Flags.boolean({ description: 'Required: confirm the revocation' }),
+    };
+    async run() {
+        const { args, flags } = await this.parse(ServiceAccountsTokensRevoke);
+        if (!flags.confirm) {
+            this.error('Refusing to revoke without --confirm.', { exit: 2 });
+        }
+        await this.api.delete(`/cli/v1/service/accounts/${encodeURIComponent(args.account)}/tokens/${encodeURIComponent(args.id)}`);
+        if (!this.jsonEnabled())
+            this.log(`Revoked token ${args.id}`);
+        return { revoked: args.id };
+    }
+}
+exports.default = ServiceAccountsTokensRevoke;

package/dist/lib/api.js

@@ -47,6 +47,12 @@ class CliApi {
         const form = new FormData();
         for (const file of files)
             form.append(file.field, file.data, file.filename);
+        if (opts.body && typeof opts.body === 'object') {
+            for (const [key, value] of Object.entries(opts.body)) {
+                if (value !== undefined && value !== null)
+                    form.append(key, String(value));
+            }
+        }
         const url = this.resolveUrl(path);
         let res;
         try {

package/dist/lib/config.js

@@ -56,6 +56,15 @@ function defaultApiUrl() {
     const fromEnv = process.env.CLOSEYOURIT_API_URL;
     return fromEnv && fromEnv.trim() !== '' ? fromEnv : DEFAULT_API_URL;
 }
+/**
+ * Token from CLOSEYOURIT_TOKEN env, for headless/CI/agent use (overrides the stored config token).
+ * Lets a service account (cyi_u_) authenticate non-interactively without the device-flow login:
+ *   CLOSEYOURIT_TOKEN=cyi_u_... cyi secrets bundle -p KEY -e development
+ */
+function envToken() {
+    const fromEnv = process.env.CLOSEYOURIT_TOKEN;
+    return fromEnv && fromEnv.trim() !== '' ? fromEnv.trim() : undefined;
+}
 function loadConfig() {
     const file = configPath();
     let parsed = {};
@@ -70,7 +79,7 @@ function loadConfig() {
     }
     return {
         apiUrl: parsed.apiUrl && parsed.apiUrl.trim() !== '' ? parsed.apiUrl : defaultApiUrl(),
-        token: parsed.token,
+        token: envToken() ?? parsed.token,
         account: parsed.account,
         organization: parsed.organization,
     };

package/dist/lib/stdin.d.ts

@@ -0,0 +1,3 @@
+/** Read a whole stream (default: process.stdin) into a UTF-8 string. Used by `secrets import` to accept
+ * piped input, e.g. `doppler secrets download --format json | cyi secrets import --format json`. */
+export declare function readStream(stream?: AsyncIterable<Buffer | string>): Promise<string>;

package/dist/lib/stdin.js

@@ -0,0 +1,11 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.readStream = readStream;
+/** Read a whole stream (default: process.stdin) into a UTF-8 string. Used by `secrets import` to accept
+ * piped input, e.g. `doppler secrets download --format json | cyi secrets import --format json`. */
+async function readStream(stream = process.stdin) {
+    const chunks = [];
+    for await (const chunk of stream)
+        chunks.push(Buffer.from(chunk));
+    return Buffer.concat(chunks).toString('utf8');
+}

package/dist/lib/subprocess.d.ts

@@ -0,0 +1,6 @@
+/**
+ * Run a child process inheriting stdio, resolving with its exit code. Unlike `openUrl` (browser.ts)
+ * this is NOT detached/unref'd: `cyi run` must stay attached and propagate the child's exit code
+ * (like `doppler run`). A terminating signal maps to a non-zero code.
+ */
+export declare function runCommand(command: string, args: string[], env: NodeJS.ProcessEnv): Promise<number>;

package/dist/lib/subprocess.js

@@ -0,0 +1,16 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.runCommand = runCommand;
+const node_child_process_1 = require("node:child_process");
+/**
+ * Run a child process inheriting stdio, resolving with its exit code. Unlike `openUrl` (browser.ts)
+ * this is NOT detached/unref'd: `cyi run` must stay attached and propagate the child's exit code
+ * (like `doppler run`). A terminating signal maps to a non-zero code.
+ */
+function runCommand(command, args, env) {
+    return new Promise((resolve, reject) => {
+        const child = (0, node_child_process_1.spawn)(command, args, { stdio: 'inherit', env });
+        child.on('error', reject);
+        child.on('exit', (code, signal) => resolve(code ?? (signal ? 1 : 0)));
+    });
+}