@bussolabs/closeyourit-cli 0.0.25 → 0.1.0

package/dist/commands/secrets/assets/undelegate.js

@@ -0,0 +1,17 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const core_1 = require("@oclif/core");
+const base_1 = require("../../../base");
+class SecretsAssetsUndelegate extends base_1.BaseCommand {
+    static args = { id: core_1.Args.string({ required: true }) };
+    static flags = { project: core_1.Flags.string({ char: 'p', required: true }) };
+    async run() {
+        const { args, flags } = await this.parse(SecretsAssetsUndelegate);
+        const projectId = await this.resolveProjectId(flags.project);
+        await this.api.delete(`/cli/v1/shared_secret_assets/${encodeURIComponent(args.id)}/undelegate?project_id=${encodeURIComponent(projectId)}`);
+        if (!this.jsonEnabled())
+            this.log(`Removed shared-asset delegation from ${flags.project}`);
+        return { undelegated: true, project_id: projectId };
+    }
+}
+exports.default = SecretsAssetsUndelegate;

package/dist/commands/secrets/assets/upload.d.ts

@@ -0,0 +1,12 @@
+import { BaseCommand } from '../../../base';
+export default class SecretsAssetsUpload extends BaseCommand {
+    static description: string;
+    static flags: {
+        file: import("@oclif/core/lib/interfaces").OptionFlag<string, import("@oclif/core/lib/interfaces").CustomOptions>;
+        name: import("@oclif/core/lib/interfaces").OptionFlag<string, import("@oclif/core/lib/interfaces").CustomOptions>;
+        environment: import("@oclif/core/lib/interfaces").OptionFlag<string | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
+        description: import("@oclif/core/lib/interfaces").OptionFlag<string | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
+        project: import("@oclif/core/lib/interfaces").OptionFlag<string, import("@oclif/core/lib/interfaces").CustomOptions>;
+    };
+    run(): Promise<unknown>;
+}

package/dist/commands/secrets/assets/upload.js

@@ -0,0 +1,25 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const promises_1 = require("node:fs/promises");
+const node_path_1 = require("node:path");
+const core_1 = require("@oclif/core");
+const base_1 = require("../../../base");
+class SecretsAssetsUpload extends base_1.BaseCommand {
+    static description = 'Encrypt and upload a mobile CI secret file (never prints its contents)';
+    static flags = { ...base_1.projectFlag, file: core_1.Flags.string({ required: true }), name: core_1.Flags.string({ required: true }), environment: core_1.Flags.string(), description: core_1.Flags.string() };
+    async run() {
+        const { flags } = await this.parse(SecretsAssetsUpload);
+        const info = await (0, promises_1.stat)(flags.file).catch(() => undefined);
+        if (!info?.isFile())
+            this.error(`File not found or unreadable: ${flags.file}`, { exit: 2 });
+        if (info.size > 10 * 1024 * 1024)
+            this.error('Secret file exceeds 10 MiB', { exit: 2 });
+        const projectId = await this.resolveProjectId(flags.project);
+        const data = await (0, promises_1.readFile)(flags.file);
+        const res = await this.api.upload('POST', `/cli/v1/projects/${encodeURIComponent(projectId)}/secret_assets`, [{ field: 'file', filename: (0, node_path_1.basename)(flags.file), data: new Blob([data]) }], { body: { name: flags.name, environment: flags.environment, description: flags.description } });
+        if (!this.jsonEnabled())
+            this.log(`Encrypted and uploaded ${flags.name}`);
+        return res;
+    }
+}
+exports.default = SecretsAssetsUpload;

package/dist/commands/secrets/assets/versions.d.ts

@@ -0,0 +1,10 @@
+import { BaseCommand } from '../../../base';
+export default class SecretsAssetsVersions extends BaseCommand {
+    static args: {
+        id: import("@oclif/core/lib/interfaces").Arg<string, Record<string, unknown>>;
+    };
+    static flags: {
+        project: import("@oclif/core/lib/interfaces").OptionFlag<string, import("@oclif/core/lib/interfaces").CustomOptions>;
+    };
+    run(): Promise<unknown>;
+}

package/dist/commands/secrets/assets/versions.js

@@ -0,0 +1,18 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const core_1 = require("@oclif/core");
+const base_1 = require("../../../base");
+const output_1 = require("../../../lib/output");
+class SecretsAssetsVersions extends base_1.BaseCommand {
+    static args = { id: core_1.Args.string({ required: true }) };
+    static flags = { ...base_1.projectFlag };
+    async run() {
+        const { args, flags } = await this.parse(SecretsAssetsVersions);
+        const projectId = await this.resolveProjectId(flags.project);
+        const res = await this.api.get(`/cli/v1/projects/${encodeURIComponent(projectId)}/secret_assets/${encodeURIComponent(args.id)}/versions`);
+        if (!this.jsonEnabled())
+            this.log((0, output_1.renderTable)(['VERSION', 'FILENAME', 'BYTES', 'CREATED'], (res.data ?? []).map((v) => [String(v.number ?? ''), String(v.filename ?? ''), String(v.byte_size ?? ''), String(v.created_at ?? '')])));
+        return res;
+    }
+}
+exports.default = SecretsAssetsVersions;

package/dist/commands/service-accounts/create.d.ts

@@ -0,0 +1,15 @@
+import { BaseCommand } from '../../base';
+export default class ServiceAccountsCreate extends BaseCommand {
+    static description: string;
+    static examples: string[];
+    static flags: {
+        name: import("@oclif/core/lib/interfaces").OptionFlag<string, import("@oclif/core/lib/interfaces").CustomOptions>;
+        handle: import("@oclif/core/lib/interfaces").OptionFlag<string | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
+        project: import("@oclif/core/lib/interfaces").OptionFlag<string[] | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
+        group: import("@oclif/core/lib/interfaces").OptionFlag<string[] | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
+        role: import("@oclif/core/lib/interfaces").OptionFlag<string[] | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
+        'grant-secrets': import("@oclif/core/lib/interfaces").BooleanFlag<boolean>;
+        'secret-environment': import("@oclif/core/lib/interfaces").OptionFlag<string[] | undefined, import("@oclif/core/lib/interfaces").CustomOptions>;
+    };
+    run(): Promise<unknown>;
+}

package/dist/commands/service-accounts/create.js

@@ -0,0 +1,46 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const core_1 = require("@oclif/core");
+const base_1 = require("../../base");
+class ServiceAccountsCreate extends base_1.BaseCommand {
+    static description = 'Create a service account (AI member, CLI-only)';
+    static examples = [
+        '<%= config.bin %> service-accounts create --name "Deploy bot" --project CYI --grant-secrets --secret-environment staging',
+    ];
+    static flags = {
+        name: core_1.Flags.string({ description: 'Display name', required: true }),
+        handle: core_1.Flags.string({ description: 'Handle (a-z, 0-9, underscore); derived from name if omitted' }),
+        project: core_1.Flags.string({ description: 'Grant visibility on a project key/id (repeatable)', multiple: true }),
+        group: core_1.Flags.string({ description: 'Grant visibility on a group name/id (repeatable)', multiple: true }),
+        role: core_1.Flags.string({ description: 'Assign a role name/id (repeatable)', multiple: true }),
+        'grant-secrets': core_1.Flags.boolean({ description: 'Grant read+write secrets on the visible projects', default: false }),
+        'secret-environment': core_1.Flags.string({
+            description: 'Restrict secret access to these environment codes (repeatable; empty = all environments)',
+            multiple: true,
+        }),
+    };
+    async run() {
+        const { flags } = await this.parse(ServiceAccountsCreate);
+        const projectIds = await Promise.all((flags.project ?? []).map((value) => this.resolveProjectId(value)));
+        const groupIds = await Promise.all((flags.group ?? []).map((value) => this.resolveGroupId(value)));
+        const roleIds = await Promise.all((flags.role ?? []).map((value) => this.resolveRoleId(value)));
+        const body = {
+            name: flags.name,
+            project_ids: projectIds,
+            group_ids: groupIds,
+            role_ids: roleIds,
+            grant_secrets: flags['grant-secrets'],
+            secret_environment_codes: flags['secret-environment'] ?? [],
+        };
+        if (flags.handle)
+            body.handle = flags.handle;
+        const res = await this.api.post('/cli/v1/service/accounts', body);
+        if (!this.jsonEnabled()) {
+            const id = res.data?.id ?? '<id>';
+            this.log(`Created service account ${id} (@${res.data?.handle ?? ''}).`);
+            this.log(`Mint a token with: service-accounts tokens create ${id} <name>`);
+        }
+        return res;
+    }
+}
+exports.default = ServiceAccountsCreate;

package/dist/commands/service-accounts/delete.d.ts

@@ -0,0 +1,12 @@
+import { BaseCommand } from '../../base';
+export default class ServiceAccountsDelete extends BaseCommand {
+    static args: {
+        id: import("@oclif/core/lib/interfaces").Arg<string, Record<string, unknown>>;
+    };
+    static description: string;
+    static examples: string[];
+    static flags: {
+        confirm: import("@oclif/core/lib/interfaces").BooleanFlag<boolean>;
+    };
+    run(): Promise<unknown>;
+}

package/dist/commands/service-accounts/delete.js

@@ -0,0 +1,25 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const core_1 = require("@oclif/core");
+const base_1 = require("../../base");
+class ServiceAccountsDelete extends base_1.BaseCommand {
+    static args = {
+        id: core_1.Args.string({ description: 'Service account id', required: true }),
+    };
+    static description = 'Delete a service account (revokes its tokens + removes org access; the secrets audit trail is kept)';
+    static examples = ['<%= config.bin %> service-accounts delete <id> --confirm'];
+    static flags = {
+        confirm: core_1.Flags.boolean({ description: 'Required: confirm the deletion' }),
+    };
+    async run() {
+        const { args, flags } = await this.parse(ServiceAccountsDelete);
+        if (!flags.confirm) {
+            this.error('Refusing to delete without --confirm.', { exit: 2 });
+        }
+        await this.api.delete(`/cli/v1/service/accounts/${encodeURIComponent(args.id)}`);
+        if (!this.jsonEnabled())
+            this.log(`Deleted service account ${args.id}`);
+        return { deleted: args.id };
+    }
+}
+exports.default = ServiceAccountsDelete;

package/dist/commands/service-accounts/list.d.ts

@@ -0,0 +1,9 @@
+import { BaseCommand } from '../../base';
+export default class ServiceAccountsList extends BaseCommand {
+    static description: string;
+    static examples: string[];
+    static flags: {
+        page: import("@oclif/core/lib/interfaces").OptionFlag<number, import("@oclif/core/lib/interfaces").CustomOptions>;
+    };
+    run(): Promise<unknown>;
+}

package/dist/commands/service-accounts/list.js

@@ -0,0 +1,25 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const base_1 = require("../../base");
+const output_1 = require("../../lib/output");
+class ServiceAccountsList extends base_1.BaseCommand {
+    static description = 'List the service accounts (AI members, CLI-only) in your organization';
+    static examples = ['<%= config.bin %> service-accounts list', '<%= config.bin %> service-accounts list --json'];
+    static flags = { ...base_1.pageFlag };
+    async run() {
+        const { flags } = await this.parse(ServiceAccountsList);
+        const res = await this.api.get(`/cli/v1/service/accounts?page=${flags.page}`);
+        const accounts = res.data ?? [];
+        if (!this.jsonEnabled()) {
+            this.log((0, output_1.renderTable)(['NAME', 'HANDLE', 'SECRET ENVS', 'TOKENS', 'ID'], accounts.map((account) => [
+                String(account.name ?? ''),
+                String(account.handle ?? ''),
+                (account.secret_environment_codes ?? []).join(',') || 'all',
+                String(account.active_tokens_count ?? 0),
+                String(account.id ?? ''),
+            ])));
+        }
+        return res;
+    }
+}
+exports.default = ServiceAccountsList;

package/dist/commands/service-accounts/tokens/create.d.ts

@@ -0,0 +1,10 @@
+import { BaseCommand } from '../../../base';
+export default class ServiceAccountsTokensCreate extends BaseCommand {
+    static args: {
+        account: import("@oclif/core/lib/interfaces").Arg<string, Record<string, unknown>>;
+        name: import("@oclif/core/lib/interfaces").Arg<string, Record<string, unknown>>;
+    };
+    static description: string;
+    static examples: string[];
+    run(): Promise<unknown>;
+}

package/dist/commands/service-accounts/tokens/create.js

@@ -0,0 +1,27 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const core_1 = require("@oclif/core");
+const base_1 = require("../../../base");
+class ServiceAccountsTokensCreate extends base_1.BaseCommand {
+    static args = {
+        account: core_1.Args.string({ description: 'Service account id', required: true }),
+        name: core_1.Args.string({ description: 'Token name (e.g. ci-deploy)', required: true }),
+    };
+    static description = 'Create a CLI token (cyi_u_) for a service account (the secret is shown only once)';
+    static examples = ['<%= config.bin %> service-accounts tokens create <account-id> ci-deploy'];
+    async run() {
+        const { args } = await this.parse(ServiceAccountsTokensCreate);
+        const res = await this.api.post(`/cli/v1/service/accounts/${encodeURIComponent(args.account)}/tokens`, { name: args.name });
+        const token = res.data ?? {};
+        if (!this.jsonEnabled()) {
+            this.log('Service account token created. Store the secret now — it is shown only once:');
+            this.log('');
+            this.log(`  secret: ${token.secret ?? '-'}`);
+            this.log('');
+            this.log('Use it headless: CLOSEYOURIT_TOKEN=<secret> closeyourit secrets bundle -p KEY -e development');
+            this.warn('The secret cannot be retrieved again. If you lose it, revoke and create a new one.');
+        }
+        return res;
+    }
+}
+exports.default = ServiceAccountsTokensCreate;

package/dist/commands/service-accounts/tokens/revoke.d.ts

@@ -0,0 +1,13 @@
+import { BaseCommand } from '../../../base';
+export default class ServiceAccountsTokensRevoke extends BaseCommand {
+    static args: {
+        account: import("@oclif/core/lib/interfaces").Arg<string, Record<string, unknown>>;
+        id: import("@oclif/core/lib/interfaces").Arg<string, Record<string, unknown>>;
+    };
+    static description: string;
+    static examples: string[];
+    static flags: {
+        confirm: import("@oclif/core/lib/interfaces").BooleanFlag<boolean>;
+    };
+    run(): Promise<unknown>;
+}

package/dist/commands/service-accounts/tokens/revoke.js

@@ -0,0 +1,26 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const core_1 = require("@oclif/core");
+const base_1 = require("../../../base");
+class ServiceAccountsTokensRevoke extends base_1.BaseCommand {
+    static args = {
+        account: core_1.Args.string({ description: 'Service account id', required: true }),
+        id: core_1.Args.string({ description: 'Token id', required: true }),
+    };
+    static description = 'Revoke a service account CLI token (the agent using it loses access)';
+    static examples = ['<%= config.bin %> service-accounts tokens revoke <account-id> <token-id> --confirm'];
+    static flags = {
+        confirm: core_1.Flags.boolean({ description: 'Required: confirm the revocation' }),
+    };
+    async run() {
+        const { args, flags } = await this.parse(ServiceAccountsTokensRevoke);
+        if (!flags.confirm) {
+            this.error('Refusing to revoke without --confirm.', { exit: 2 });
+        }
+        await this.api.delete(`/cli/v1/service/accounts/${encodeURIComponent(args.account)}/tokens/${encodeURIComponent(args.id)}`);
+        if (!this.jsonEnabled())
+            this.log(`Revoked token ${args.id}`);
+        return { revoked: args.id };
+    }
+}
+exports.default = ServiceAccountsTokensRevoke;

package/dist/lib/api.js

@@ -47,6 +47,12 @@ class CliApi {
         const form = new FormData();
         for (const file of files)
             form.append(file.field, file.data, file.filename);
+        if (opts.body && typeof opts.body === 'object') {
+            for (const [key, value] of Object.entries(opts.body)) {
+                if (value !== undefined && value !== null)
+                    form.append(key, String(value));
+            }
+        }
         const url = this.resolveUrl(path);
         let res;
         try {

package/dist/lib/config.js

@@ -56,6 +56,15 @@ function defaultApiUrl() {
     const fromEnv = process.env.CLOSEYOURIT_API_URL;
     return fromEnv && fromEnv.trim() !== '' ? fromEnv : DEFAULT_API_URL;
 }
+/**
+ * Token from CLOSEYOURIT_TOKEN env, for headless/CI/agent use (overrides the stored config token).
+ * Lets a service account (cyi_u_) authenticate non-interactively without the device-flow login:
+ *   CLOSEYOURIT_TOKEN=cyi_u_... cyi secrets bundle -p KEY -e development
+ */
+function envToken() {
+    const fromEnv = process.env.CLOSEYOURIT_TOKEN;
+    return fromEnv && fromEnv.trim() !== '' ? fromEnv.trim() : undefined;
+}
 function loadConfig() {
     const file = configPath();
     let parsed = {};
@@ -70,7 +79,7 @@ function loadConfig() {
     }
     return {
         apiUrl: parsed.apiUrl && parsed.apiUrl.trim() !== '' ? parsed.apiUrl : defaultApiUrl(),
-        token: parsed.token,
+        token: envToken() ?? parsed.token,
         account: parsed.account,
         organization: parsed.organization,
     };