@bussolabs/closeyourit-cli 0.0.25 → 0.0.27

package/README.md

@@ -24,6 +24,17 @@ closeyourit projects list
 URL (and opens it in your browser), then polls until you approve. The resulting token, account and
 organization are stored locally.
 
+### Headless / CI / agents
+
+Set `CLOSEYOURIT_TOKEN` to a user token (`cyi_u_…`) to authenticate non-interactively, without the
+device-flow login. It overrides the stored config token. Ideal for a **service account** token driving
+an agent or CI job:
+
+```bash
+CLOSEYOURIT_TOKEN=cyi_u_… CLOSEYOURIT_API_URL=https://www.closeyour.it \
+  closeyourit secrets bundle -p KEY -e development
+```
+
 ## Commands
 
 | Command | Description |
@@ -70,6 +81,11 @@ organization are stored locally.
 | `tokens create --project <id\|key> --name <name> --environment-id <id>` | Create a token (secret shown once). |
 | `tokens rotate <id> --project <id\|key>` | Rotate a token (new secret shown once). |
 | `tokens revoke <id> --project <id\|key>` | Revoke a token. |
+| `secrets assets list --project <id\|key>` | List encrypted secret-file metadata (never contents). |
+| `secrets assets upload --project <id\|key> --name <name> --file <path> [--environment]` | Encrypt and upload `.p8`, `.p12`, keystore or service-account JSON. |
+| `secrets assets download <id> --project <id\|key> --output <path> [--version] [--force]` | Decrypt to an explicit `0600` file; refuses overwrite by default. |
+| `secrets assets versions\|rollback\|archive\|purge …` | Manage immutable versions, restore, archive or owner-only permanent purge. |
+| `secrets assets shared-list\|shared-upload\|delegate\|undelegate …` | Manage one organization-level ciphertext and delegate it to authorized projects. |
 | `tickets list --project <id\|key> [--page]` | List tickets. |
 | `tickets show <id> --project <id\|key>` | Show one ticket. |
 | `tickets create --project <id\|key> --title <t> [--kind] [--step-*] [--description] [--status-id] [--priority-id]` | Create a ticket. |
@@ -120,6 +136,11 @@ organization are stored locally.
 | `agents tokens list [--page]` | List the org automator tokens (cyi_a_). |
 | `agents tokens create <name>` | Create an org automator token (secret shown only once). |
 | `agents tokens revoke <id> --confirm` | Revoke an org automator token. |
+| `service-accounts list [--page]` | List the service accounts (AI members, CLI-only) in your org. |
+| `service-accounts create --name [--handle] [--project <id\|key>…] [--group <id\|name>…] [--role <id\|name>…] [--grant-secrets] [--secret-environment <code>…]` | Create a service account (optionally granting read+write secrets, limited to environment codes). |
+| `service-accounts delete <id> --confirm` | Delete a service account (revokes tokens + removes access; secrets audit kept). |
+| `service-accounts tokens create <account-id> <name>` | Mint a CLI token (cyi_u_) for a service account (secret shown only once). |
+| `service-accounts tokens revoke <account-id> <token-id> --confirm` | Revoke a service account token. |
 | `monitors create --project <id\|key> --url <url> [--environment] [--http-method] [--interval-seconds] [--expected-status] [--timeout-seconds] [--expected-body-keyword] [--ssl-expiry-warn-days] [--group-id]` | Create an uptime monitor (one per environment). |
 | `monitors update <id> --project <id\|key> [--url] [--http-method] [--interval-seconds] [--expected-status] [--timeout-seconds] [--expected-body-keyword] [--ssl-expiry-warn-days] [--group-id]` | Update an uptime monitor. |
 | `monitors publish\|unpublish <id> --project <id\|key>` | Publish / unpublish the monitor's public status page. |
@@ -189,6 +210,7 @@ to clear it locally; revoke the token on the server at `/account/cli/tokens`.
 
 | Variable | Purpose | Default |
 | --- | --- | --- |
+| `CLOSEYOURIT_TOKEN` | User token (`cyi_u_…`) for headless/CI/agent use; overrides the stored config token. | — |
 | `CLOSEYOURIT_API_URL` | Default backend base URL (overridden by a persisted `--api-url`). | `https://www.closeyour.it` |
 | `CLOSEYOURIT_CONFIG_DIR` | Directory holding `config.json`. | `~/.config/closeyourit` |
 

package/dist/base.d.ts

@@ -19,7 +19,11 @@ export declare abstract class BaseCommand extends Command {
     protected cfg: CliConfig;
     protected api: CliApi;
     init(): Promise<void>;
-    /** Resolve a project reference (UUID passes through; otherwise matched by key). */
+    /**
+     * Resolve a project reference (UUID passes through; otherwise matched by key, case-insensitive).
+     * Walks every page of `/cli/v1/projects`: a key can live past the first page, so a single-page
+     * lookup would 404 keys like legalbloom LBRA/LBWB while their UUID (and first-page keys) worked (CYCL-1).
+     */
     protected resolveProjectId(value: string): Promise<string>;
     /** Resolve a role reference (UUID passes through; otherwise matched by name, case-insensitive). */
     protected resolveRoleId(value: string): Promise<string>;
@@ -33,6 +37,10 @@ export declare abstract class BaseCommand extends Command {
     protected resolveAll(values: string[], resolve: (value: string) => Promise<string>): Promise<string[]>;
     /** Resolve an `{id, name}` reference by name (UUID passes through). */
     private resolveByName;
-    /** Print `code: message` for API errors, then exit non-zero. */
+    /**
+     * Surface API errors, then exit non-zero. In `--json` mode `logToStderr` is a no-op, so emit the
+     * structured `{ error: { code, message } }` envelope on stdout instead — otherwise the failure is
+     * swallowed (empty stdout, exit looks like a silent success) for machine consumers (CYCL-1).
+     */
     protected catch(error: Interfaces.CommandError): Promise<unknown>;
 }

package/dist/base.js

@@ -27,17 +27,26 @@ class BaseCommand extends core_1.Command {
         this.cfg = (0, config_1.loadConfig)();
         this.api = new api_1.CliApi(this.cfg);
     }
-    /** Resolve a project reference (UUID passes through; otherwise matched by key). */
+    /**
+     * Resolve a project reference (UUID passes through; otherwise matched by key, case-insensitive).
+     * Walks every page of `/cli/v1/projects`: a key can live past the first page, so a single-page
+     * lookup would 404 keys like legalbloom LBRA/LBWB while their UUID (and first-page keys) worked (CYCL-1).
+     */
     async resolveProjectId(value) {
         if (exports.UUID_RE.test(value))
             return value;
-        const res = await this.api.get('/cli/v1/projects');
-        const projects = res.data ?? [];
-        const match = projects.find((project) => (project.key ?? '').toLowerCase() === value.toLowerCase());
-        if (!match) {
-            throw new api_1.ApiRequestError(404, error_codes_1.ErrorCodes.Project.notFound, `Project not found: ${value}`);
-        }
-        return match.id;
+        let page = 1;
+        let totalPages = 1;
+        do {
+            // eslint-disable-next-line no-await-in-loop
+            const res = await this.api.get(`/cli/v1/projects?page=${page}&per=100`);
+            const match = (res.data ?? []).find((project) => (project.key ?? '').toLowerCase() === value.toLowerCase());
+            if (match)
+                return match.id;
+            totalPages = Number(res.meta?.total_pages ?? 1);
+            page += 1;
+        } while (page <= totalPages);
+        throw new api_1.ApiRequestError(404, error_codes_1.ErrorCodes.Project.notFound, `Project not found: ${value}`);
     }
     /** Resolve a role reference (UUID passes through; otherwise matched by name, case-insensitive). */
     resolveRoleId(value) {
@@ -77,10 +86,19 @@ class BaseCommand extends core_1.Command {
         }
         return match.id;
     }
-    /** Print `code: message` for API errors, then exit non-zero. */
+    /**
+     * Surface API errors, then exit non-zero. In `--json` mode `logToStderr` is a no-op, so emit the
+     * structured `{ error: { code, message } }` envelope on stdout instead — otherwise the failure is
+     * swallowed (empty stdout, exit looks like a silent success) for machine consumers (CYCL-1).
+     */
     async catch(error) {
         if (error instanceof api_1.ApiRequestError) {
-            this.logToStderr(`${error.code}: ${error.message}`);
+            if (this.jsonEnabled()) {
+                this.logJson({ error: { code: error.code, message: error.message } });
+            }
+            else {
+                this.logToStderr(`${error.code}: ${error.message}`);
+            }
             return this.exit(1);
         }
         return super.catch(error);

package/dist/commands/environments/create.d.ts

@@ -10,6 +10,9 @@ export default class EnvironmentsCreate extends BaseCommand {
         color: import("@oclif/core/lib/interfaces").OptionFlag<string, import("@oclif/core/lib/interfaces").CustomOptions>;
         position: import("@oclif/core/lib/interfaces").OptionFlag<number | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
         active: import("@oclif/core/lib/interfaces").BooleanFlag<boolean>;
+        servers: import("@oclif/core/lib/interfaces").BooleanFlag<boolean>;
+        uptime: import("@oclif/core/lib/interfaces").BooleanFlag<boolean>;
+        secrets: import("@oclif/core/lib/interfaces").BooleanFlag<boolean>;
     };
     run(): Promise<unknown>;
 }

package/dist/commands/environments/create.js

@@ -11,6 +11,7 @@ class EnvironmentsCreate extends base_1.BaseCommand {
     static examples = [
         '<%= config.bin %> environments create production --label Production',
         '<%= config.bin %> environments create staging --label Staging --color amber',
+        '<%= config.bin %> environments create staging --label Staging --no-uptime',
     ];
     static flags = {
         label: core_1.Flags.string({ description: 'Human-readable label', required: true }),
@@ -18,6 +19,10 @@ class EnvironmentsCreate extends base_1.BaseCommand {
         color: core_1.Flags.string({ description: 'Color label', default: 'emerald' }),
         position: core_1.Flags.integer({ description: 'Sort position' }),
         active: core_1.Flags.boolean({ description: 'Whether the environment is active', allowNo: true }),
+        // Default capabilities projects can enable on this environment (each project can override).
+        servers: core_1.Flags.boolean({ description: 'Servers capability default', allowNo: true }),
+        uptime: core_1.Flags.boolean({ description: 'Uptime capability default', allowNo: true }),
+        secrets: core_1.Flags.boolean({ description: 'Secrets capability default', allowNo: true }),
     };
     async run() {
         const { args, flags } = await this.parse(EnvironmentsCreate);
@@ -26,6 +31,12 @@ class EnvironmentsCreate extends base_1.BaseCommand {
             body.position = flags.position;
         if (flags.active !== undefined)
             body.active = flags.active;
+        if (flags.servers !== undefined)
+            body.servers_enabled = flags.servers;
+        if (flags.uptime !== undefined)
+            body.uptime_enabled = flags.uptime;
+        if (flags.secrets !== undefined)
+            body.secrets_enabled = flags.secrets;
         const res = await this.api.post('/cli/v1/environments', body);
         if (!this.jsonEnabled()) {
             this.log('Environment created:');

package/dist/commands/environments/update.d.ts

@@ -11,6 +11,9 @@ export default class EnvironmentsUpdate extends BaseCommand {
         color: import("@oclif/core/lib/interfaces").OptionFlag<string | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
         position: import("@oclif/core/lib/interfaces").OptionFlag<number | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
         active: import("@oclif/core/lib/interfaces").BooleanFlag<boolean>;
+        servers: import("@oclif/core/lib/interfaces").BooleanFlag<boolean>;
+        uptime: import("@oclif/core/lib/interfaces").BooleanFlag<boolean>;
+        secrets: import("@oclif/core/lib/interfaces").BooleanFlag<boolean>;
     };
     run(): Promise<unknown>;
 }

package/dist/commands/environments/update.js

@@ -12,6 +12,7 @@ class EnvironmentsUpdate extends base_1.BaseCommand {
         '<%= config.bin %> environments update staging --label "Staging env"',
         '<%= config.bin %> environments update production --color indigo',
         '<%= config.bin %> environments update staging --no-active',
+        '<%= config.bin %> environments update staging --no-uptime --servers',
     ];
     static flags = {
         code: core_1.Flags.string({ description: 'New code (lowercase)' }),
@@ -19,6 +20,10 @@ class EnvironmentsUpdate extends base_1.BaseCommand {
         color: core_1.Flags.string({ description: 'Color label' }),
         position: core_1.Flags.integer({ description: 'Sort position' }),
         active: core_1.Flags.boolean({ description: 'Whether the environment is active', allowNo: true }),
+        // Default capabilities projects can enable on this environment (each project can override).
+        servers: core_1.Flags.boolean({ description: 'Servers capability default', allowNo: true }),
+        uptime: core_1.Flags.boolean({ description: 'Uptime capability default', allowNo: true }),
+        secrets: core_1.Flags.boolean({ description: 'Secrets capability default', allowNo: true }),
     };
     async run() {
         const { args, flags } = await this.parse(EnvironmentsUpdate);
@@ -33,6 +38,12 @@ class EnvironmentsUpdate extends base_1.BaseCommand {
             body.position = flags.position;
         if (flags.active !== undefined)
             body.active = flags.active;
+        if (flags.servers !== undefined)
+            body.servers_enabled = flags.servers;
+        if (flags.uptime !== undefined)
+            body.uptime_enabled = flags.uptime;
+        if (flags.secrets !== undefined)
+            body.secrets_enabled = flags.secrets;
         // Identifier (id or code) goes straight in the path — the backend resolves id-or-code.
         const res = await this.api.put(`/cli/v1/environments/${encodeURIComponent(args.environment)}`, body);
         if (!this.jsonEnabled()) {

package/dist/commands/projects/set-environment-capabilities.d.ts

@@ -0,0 +1,13 @@
+import { BaseCommand } from '../../base';
+export default class ProjectsSetEnvironmentCapabilities extends BaseCommand {
+    static description: string;
+    static examples: string[];
+    static flags: {
+        servers: import("@oclif/core/lib/interfaces").OptionFlag<string | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
+        uptime: import("@oclif/core/lib/interfaces").OptionFlag<string | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
+        secrets: import("@oclif/core/lib/interfaces").OptionFlag<string | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
+        environment: import("@oclif/core/lib/interfaces").OptionFlag<string, import("@oclif/core/lib/interfaces").CustomOptions>;
+        project: import("@oclif/core/lib/interfaces").OptionFlag<string, import("@oclif/core/lib/interfaces").CustomOptions>;
+    };
+    run(): Promise<unknown>;
+}

package/dist/commands/projects/set-environment-capabilities.js

@@ -0,0 +1,39 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const core_1 = require("@oclif/core");
+const base_1 = require("../../base");
+const output_1 = require("../../lib/output");
+class ProjectsSetEnvironmentCapabilities extends base_1.BaseCommand {
+    static description = 'Override the servers/uptime/secrets capabilities of a project environment (inherit = follow the environment default)';
+    static examples = [
+        '<%= config.bin %> projects set-environment-capabilities -p LBRA -e production --uptime off',
+        '<%= config.bin %> projects set-environment-capabilities -p legalbloom-rails -e staging --uptime off --secrets inherit',
+    ];
+    static flags = {
+        ...base_1.projectFlag,
+        ...base_1.environmentFlag,
+        // inherit = clear the override (follow the environment default); on/off = force it for this project.
+        servers: core_1.Flags.string({ description: 'Servers capability', options: ['inherit', 'on', 'off'] }),
+        uptime: core_1.Flags.string({ description: 'Uptime capability', options: ['inherit', 'on', 'off'] }),
+        secrets: core_1.Flags.string({ description: 'Secrets capability', options: ['inherit', 'on', 'off'] }),
+    };
+    async run() {
+        const { flags } = await this.parse(ProjectsSetEnvironmentCapabilities);
+        const projectId = await this.resolveProjectId(flags.project);
+        // Only the provided capabilities are sent — the others keep their current override.
+        const body = {};
+        if (flags.servers !== undefined)
+            body.servers = flags.servers;
+        if (flags.uptime !== undefined)
+            body.uptime = flags.uptime;
+        if (flags.secrets !== undefined)
+            body.secrets = flags.secrets;
+        const res = await this.api.put(`/cli/v1/projects/${projectId}/environments/${encodeURIComponent(flags.environment)}/capabilities`, body);
+        if (!this.jsonEnabled()) {
+            this.log('Capabilities updated:');
+            this.log((0, output_1.renderRecord)(res.data ?? {}));
+        }
+        return res;
+    }
+}
+exports.default = ProjectsSetEnvironmentCapabilities;

package/dist/commands/secrets/assets/archive.d.ts

@@ -0,0 +1,11 @@
+import { BaseCommand } from '../../../base';
+export default class SecretsAssetsArchive extends BaseCommand {
+    static args: {
+        id: import("@oclif/core/lib/interfaces").Arg<string, Record<string, unknown>>;
+    };
+    static flags: {
+        confirm: import("@oclif/core/lib/interfaces").BooleanFlag<boolean>;
+        project: import("@oclif/core/lib/interfaces").OptionFlag<string, import("@oclif/core/lib/interfaces").CustomOptions>;
+    };
+    run(): Promise<unknown>;
+}

package/dist/commands/secrets/assets/archive.js

@@ -0,0 +1,17 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const core_1 = require("@oclif/core");
+const base_1 = require("../../../base");
+class SecretsAssetsArchive extends base_1.BaseCommand {
+    static args = { id: core_1.Args.string({ required: true }) };
+    static flags = { ...base_1.projectFlag, confirm: core_1.Flags.boolean({ required: true }) };
+    async run() {
+        const { args, flags } = await this.parse(SecretsAssetsArchive);
+        const projectId = await this.resolveProjectId(flags.project);
+        await this.api.delete(`/cli/v1/projects/${encodeURIComponent(projectId)}/secret_assets/${encodeURIComponent(args.id)}`);
+        if (!this.jsonEnabled())
+            this.log(`Archived secret asset ${args.id}`);
+        return { archived: true, id: args.id };
+    }
+}
+exports.default = SecretsAssetsArchive;

package/dist/commands/secrets/assets/delegate.d.ts

@@ -0,0 +1,10 @@
+import { BaseCommand } from '../../../base';
+export default class SecretsAssetsDelegate extends BaseCommand {
+    static args: {
+        id: import("@oclif/core/lib/interfaces").Arg<string, Record<string, unknown>>;
+    };
+    static flags: {
+        project: import("@oclif/core/lib/interfaces").OptionFlag<string, import("@oclif/core/lib/interfaces").CustomOptions>;
+    };
+    run(): Promise<unknown>;
+}

package/dist/commands/secrets/assets/delegate.js

@@ -0,0 +1,17 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const core_1 = require("@oclif/core");
+const base_1 = require("../../../base");
+class SecretsAssetsDelegate extends base_1.BaseCommand {
+    static args = { id: core_1.Args.string({ required: true }) };
+    static flags = { project: core_1.Flags.string({ char: 'p', required: true }) };
+    async run() {
+        const { args, flags } = await this.parse(SecretsAssetsDelegate);
+        const projectId = await this.resolveProjectId(flags.project);
+        const res = await this.api.post(`/cli/v1/shared_secret_assets/${encodeURIComponent(args.id)}/delegate`, { project_id: projectId });
+        if (!this.jsonEnabled())
+            this.log(`Delegated shared asset to ${flags.project}`);
+        return res;
+    }
+}
+exports.default = SecretsAssetsDelegate;

package/dist/commands/secrets/assets/download.d.ts

@@ -0,0 +1,14 @@
+import { BaseCommand } from '../../../base';
+export default class SecretsAssetsDownload extends BaseCommand {
+    static args: {
+        id: import("@oclif/core/lib/interfaces").Arg<string, Record<string, unknown>>;
+    };
+    static description: string;
+    static flags: {
+        output: import("@oclif/core/lib/interfaces").OptionFlag<string, import("@oclif/core/lib/interfaces").CustomOptions>;
+        version: import("@oclif/core/lib/interfaces").OptionFlag<number | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
+        force: import("@oclif/core/lib/interfaces").BooleanFlag<boolean>;
+        project: import("@oclif/core/lib/interfaces").OptionFlag<string, import("@oclif/core/lib/interfaces").CustomOptions>;
+    };
+    run(): Promise<unknown>;
+}

package/dist/commands/secrets/assets/download.js

@@ -0,0 +1,25 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const promises_1 = require("node:fs/promises");
+const core_1 = require("@oclif/core");
+const base_1 = require("../../../base");
+class SecretsAssetsDownload extends base_1.BaseCommand {
+    static args = { id: core_1.Args.string({ required: true }) };
+    static description = 'Download and decrypt a secret file to an explicit path with mode 0600';
+    static flags = { ...base_1.projectFlag, output: core_1.Flags.string({ char: 'o', required: true }), version: core_1.Flags.integer(), force: core_1.Flags.boolean({ default: false }) };
+    async run() {
+        const { args, flags } = await this.parse(SecretsAssetsDownload);
+        const projectId = await this.resolveProjectId(flags.project);
+        const query = flags.version ? `?version=${flags.version}` : '';
+        const { data, filename } = await this.api.download(`/cli/v1/projects/${encodeURIComponent(projectId)}/secret_assets/${encodeURIComponent(args.id)}/download${query}`);
+        await (0, promises_1.writeFile)(flags.output, data, { flag: flags.force ? 'w' : 'wx', mode: 0o600 }).catch((error) => {
+            if (error.code === 'EEXIST')
+                this.error(`Refusing to overwrite ${flags.output}; pass --force`, { exit: 2 });
+            throw error;
+        });
+        if (!this.jsonEnabled())
+            this.log(`Saved ${data.byteLength} encrypted-vault bytes → ${flags.output}`);
+        return { bytes: data.byteLength, filename, path: flags.output, mode: '0600' };
+    }
+}
+exports.default = SecretsAssetsDownload;

package/dist/commands/secrets/assets/list.d.ts

@@ -0,0 +1,10 @@
+import { BaseCommand } from '../../../base';
+export default class SecretsAssetsList extends BaseCommand {
+    static description: string;
+    static flags: {
+        page: import("@oclif/core/lib/interfaces").OptionFlag<number, import("@oclif/core/lib/interfaces").CustomOptions>;
+        per: import("@oclif/core/lib/interfaces").OptionFlag<number, import("@oclif/core/lib/interfaces").CustomOptions>;
+        project: import("@oclif/core/lib/interfaces").OptionFlag<string, import("@oclif/core/lib/interfaces").CustomOptions>;
+    };
+    run(): Promise<unknown>;
+}

package/dist/commands/secrets/assets/list.js

@@ -0,0 +1,18 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const core_1 = require("@oclif/core");
+const base_1 = require("../../../base");
+const output_1 = require("../../../lib/output");
+class SecretsAssetsList extends base_1.BaseCommand {
+    static description = 'List encrypted secret files visible to a project (metadata only)';
+    static flags = { ...base_1.projectFlag, page: core_1.Flags.integer({ default: 1 }), per: core_1.Flags.integer({ default: 50 }) };
+    async run() {
+        const { flags } = await this.parse(SecretsAssetsList);
+        const projectId = await this.resolveProjectId(flags.project);
+        const res = await this.api.get(`/cli/v1/projects/${encodeURIComponent(projectId)}/secret_assets?page=${flags.page}&per=${flags.per}`);
+        if (!this.jsonEnabled())
+            this.log((0, output_1.renderTable)(['ID', 'NAME', 'TYPE', 'ENV', 'VERSION', 'BYTES'], (res.data ?? []).map((a) => [a.id, a.name, a.asset_type, a.environment?.code ?? 'all', a.current_version?.number ?? '', a.current_version?.byte_size ?? ''])));
+        return res;
+    }
+}
+exports.default = SecretsAssetsList;

package/dist/commands/secrets/assets/purge.d.ts

@@ -0,0 +1,12 @@
+import { BaseCommand } from '../../../base';
+export default class SecretsAssetsPurge extends BaseCommand {
+    static args: {
+        id: import("@oclif/core/lib/interfaces").Arg<string, Record<string, unknown>>;
+    };
+    static description: string;
+    static flags: {
+        'confirm-name': import("@oclif/core/lib/interfaces").OptionFlag<string, import("@oclif/core/lib/interfaces").CustomOptions>;
+        project: import("@oclif/core/lib/interfaces").OptionFlag<string, import("@oclif/core/lib/interfaces").CustomOptions>;
+    };
+    run(): Promise<unknown>;
+}

package/dist/commands/secrets/assets/purge.js

@@ -0,0 +1,22 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const core_1 = require("@oclif/core");
+const base_1 = require("../../../base");
+class SecretsAssetsPurge extends base_1.BaseCommand {
+    static args = { id: core_1.Args.string({ required: true }) };
+    static description = 'Permanently delete an archived secret asset and all versions (owner only)';
+    static flags = { ...base_1.projectFlag, 'confirm-name': core_1.Flags.string({ description: 'Exact asset name confirmation', required: true }) };
+    async run() {
+        const { args, flags } = await this.parse(SecretsAssetsPurge);
+        const projectId = await this.resolveProjectId(flags.project);
+        const list = await this.api.get(`/cli/v1/projects/${encodeURIComponent(projectId)}/secret_assets?per=100`);
+        const asset = (list.data ?? []).find((row) => row.id === args.id);
+        if (!asset || asset.name !== flags['confirm-name'])
+            this.error('Confirmation name does not match the asset', { exit: 2 });
+        await this.api.delete(`/cli/v1/projects/${encodeURIComponent(projectId)}/secret_assets/${encodeURIComponent(args.id)}/purge`);
+        if (!this.jsonEnabled())
+            this.log(`Permanently purged ${asset.name}`);
+        return { purged: true, id: args.id };
+    }
+}
+exports.default = SecretsAssetsPurge;

package/dist/commands/secrets/assets/rollback.d.ts

@@ -0,0 +1,11 @@
+import { BaseCommand } from '../../../base';
+export default class SecretsAssetsRollback extends BaseCommand {
+    static args: {
+        id: import("@oclif/core/lib/interfaces").Arg<string, Record<string, unknown>>;
+    };
+    static flags: {
+        version: import("@oclif/core/lib/interfaces").OptionFlag<number, import("@oclif/core/lib/interfaces").CustomOptions>;
+        project: import("@oclif/core/lib/interfaces").OptionFlag<string, import("@oclif/core/lib/interfaces").CustomOptions>;
+    };
+    run(): Promise<unknown>;
+}

package/dist/commands/secrets/assets/rollback.js

@@ -0,0 +1,17 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const core_1 = require("@oclif/core");
+const base_1 = require("../../../base");
+class SecretsAssetsRollback extends base_1.BaseCommand {
+    static args = { id: core_1.Args.string({ required: true }) };
+    static flags = { ...base_1.projectFlag, version: core_1.Flags.integer({ required: true }) };
+    async run() {
+        const { args, flags } = await this.parse(SecretsAssetsRollback);
+        const projectId = await this.resolveProjectId(flags.project);
+        const res = await this.api.post(`/cli/v1/projects/${encodeURIComponent(projectId)}/secret_assets/${encodeURIComponent(args.id)}/rollback`, { version: flags.version });
+        if (!this.jsonEnabled())
+            this.log(`Restored version ${flags.version} as a new encrypted version`);
+        return res;
+    }
+}
+exports.default = SecretsAssetsRollback;

package/dist/commands/secrets/assets/shared-list.d.ts

@@ -0,0 +1,5 @@
+import { BaseCommand } from '../../../base';
+export default class SecretsAssetsSharedList extends BaseCommand {
+    static description: string;
+    run(): Promise<unknown>;
+}

package/dist/commands/secrets/assets/shared-list.js

@@ -0,0 +1,15 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const base_1 = require("../../../base");
+const output_1 = require("../../../lib/output");
+class SecretsAssetsSharedList extends base_1.BaseCommand {
+    static description = 'List organization-level encrypted secret files and delegated projects';
+    async run() {
+        await this.parse(SecretsAssetsSharedList);
+        const res = await this.api.get('/cli/v1/shared_secret_assets?per=100');
+        if (!this.jsonEnabled())
+            this.log((0, output_1.renderTable)(['ID', 'NAME', 'TYPE', 'ENV'], (res.data ?? []).map((a) => [a.id, a.name, a.asset_type, a.environment?.code ?? 'all'])));
+        return res;
+    }
+}
+exports.default = SecretsAssetsSharedList;

package/dist/commands/secrets/assets/shared-upload.d.ts

@@ -0,0 +1,11 @@
+import { BaseCommand } from '../../../base';
+export default class SecretsAssetsSharedUpload extends BaseCommand {
+    static description: string;
+    static flags: {
+        file: import("@oclif/core/lib/interfaces").OptionFlag<string, import("@oclif/core/lib/interfaces").CustomOptions>;
+        name: import("@oclif/core/lib/interfaces").OptionFlag<string, import("@oclif/core/lib/interfaces").CustomOptions>;
+        environment: import("@oclif/core/lib/interfaces").OptionFlag<string | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
+        description: import("@oclif/core/lib/interfaces").OptionFlag<string | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
+    };
+    run(): Promise<unknown>;
+}

package/dist/commands/secrets/assets/shared-upload.js

@@ -0,0 +1,24 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const promises_1 = require("node:fs/promises");
+const node_path_1 = require("node:path");
+const core_1 = require("@oclif/core");
+const base_1 = require("../../../base");
+class SecretsAssetsSharedUpload extends base_1.BaseCommand {
+    static description = 'Encrypt and upload one organization-level secret file';
+    static flags = { file: core_1.Flags.string({ required: true }), name: core_1.Flags.string({ required: true }), environment: core_1.Flags.string(), description: core_1.Flags.string() };
+    async run() {
+        const { flags } = await this.parse(SecretsAssetsSharedUpload);
+        const info = await (0, promises_1.stat)(flags.file).catch(() => undefined);
+        if (!info?.isFile())
+            this.error(`File not found or unreadable: ${flags.file}`, { exit: 2 });
+        if (info.size > 10 * 1024 * 1024)
+            this.error('Secret file exceeds 10 MiB', { exit: 2 });
+        const data = await (0, promises_1.readFile)(flags.file);
+        const res = await this.api.upload('POST', '/cli/v1/shared_secret_assets', [{ field: 'file', filename: (0, node_path_1.basename)(flags.file), data: new Blob([data]) }], { body: { name: flags.name, environment: flags.environment, description: flags.description } });
+        if (!this.jsonEnabled())
+            this.log(`Encrypted and uploaded shared asset ${flags.name}`);
+        return res;
+    }
+}
+exports.default = SecretsAssetsSharedUpload;

package/dist/commands/secrets/assets/undelegate.d.ts

@@ -0,0 +1,10 @@
+import { BaseCommand } from '../../../base';
+export default class SecretsAssetsUndelegate extends BaseCommand {
+    static args: {
+        id: import("@oclif/core/lib/interfaces").Arg<string, Record<string, unknown>>;
+    };
+    static flags: {
+        project: import("@oclif/core/lib/interfaces").OptionFlag<string, import("@oclif/core/lib/interfaces").CustomOptions>;
+    };
+    run(): Promise<unknown>;
+}

package/dist/commands/secrets/assets/undelegate.js

@@ -0,0 +1,17 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const core_1 = require("@oclif/core");
+const base_1 = require("../../../base");
+class SecretsAssetsUndelegate extends base_1.BaseCommand {
+    static args = { id: core_1.Args.string({ required: true }) };
+    static flags = { project: core_1.Flags.string({ char: 'p', required: true }) };
+    async run() {
+        const { args, flags } = await this.parse(SecretsAssetsUndelegate);
+        const projectId = await this.resolveProjectId(flags.project);
+        await this.api.delete(`/cli/v1/shared_secret_assets/${encodeURIComponent(args.id)}/undelegate?project_id=${encodeURIComponent(projectId)}`);
+        if (!this.jsonEnabled())
+            this.log(`Removed shared-asset delegation from ${flags.project}`);
+        return { undelegated: true, project_id: projectId };
+    }
+}
+exports.default = SecretsAssetsUndelegate;

package/dist/commands/secrets/assets/upload.d.ts

@@ -0,0 +1,12 @@
+import { BaseCommand } from '../../../base';
+export default class SecretsAssetsUpload extends BaseCommand {
+    static description: string;
+    static flags: {
+        file: import("@oclif/core/lib/interfaces").OptionFlag<string, import("@oclif/core/lib/interfaces").CustomOptions>;
+        name: import("@oclif/core/lib/interfaces").OptionFlag<string, import("@oclif/core/lib/interfaces").CustomOptions>;
+        environment: import("@oclif/core/lib/interfaces").OptionFlag<string | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
+        description: import("@oclif/core/lib/interfaces").OptionFlag<string | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
+        project: import("@oclif/core/lib/interfaces").OptionFlag<string, import("@oclif/core/lib/interfaces").CustomOptions>;
+    };
+    run(): Promise<unknown>;
+}

package/dist/commands/secrets/assets/upload.js

@@ -0,0 +1,25 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const promises_1 = require("node:fs/promises");
+const node_path_1 = require("node:path");
+const core_1 = require("@oclif/core");
+const base_1 = require("../../../base");
+class SecretsAssetsUpload extends base_1.BaseCommand {
+    static description = 'Encrypt and upload a mobile CI secret file (never prints its contents)';
+    static flags = { ...base_1.projectFlag, file: core_1.Flags.string({ required: true }), name: core_1.Flags.string({ required: true }), environment: core_1.Flags.string(), description: core_1.Flags.string() };
+    async run() {
+        const { flags } = await this.parse(SecretsAssetsUpload);
+        const info = await (0, promises_1.stat)(flags.file).catch(() => undefined);
+        if (!info?.isFile())
+            this.error(`File not found or unreadable: ${flags.file}`, { exit: 2 });
+        if (info.size > 10 * 1024 * 1024)
+            this.error('Secret file exceeds 10 MiB', { exit: 2 });
+        const projectId = await this.resolveProjectId(flags.project);
+        const data = await (0, promises_1.readFile)(flags.file);
+        const res = await this.api.upload('POST', `/cli/v1/projects/${encodeURIComponent(projectId)}/secret_assets`, [{ field: 'file', filename: (0, node_path_1.basename)(flags.file), data: new Blob([data]) }], { body: { name: flags.name, environment: flags.environment, description: flags.description } });
+        if (!this.jsonEnabled())
+            this.log(`Encrypted and uploaded ${flags.name}`);
+        return res;
+    }
+}
+exports.default = SecretsAssetsUpload;

package/dist/commands/secrets/assets/versions.d.ts

@@ -0,0 +1,10 @@
+import { BaseCommand } from '../../../base';
+export default class SecretsAssetsVersions extends BaseCommand {
+    static args: {
+        id: import("@oclif/core/lib/interfaces").Arg<string, Record<string, unknown>>;
+    };
+    static flags: {
+        project: import("@oclif/core/lib/interfaces").OptionFlag<string, import("@oclif/core/lib/interfaces").CustomOptions>;
+    };
+    run(): Promise<unknown>;
+}