@capuchoo/cli 0.8.0 → 0.9.1

package/dist/commands/app/grant.d.ts

@@ -0,0 +1,11 @@
+import { BaseCommand } from "../../base-command.js";
+export default class AppGrant extends BaseCommand {
+    static description: string;
+    static examples: string[];
+    static args: {
+        email: import("@oclif/core/interfaces").Arg<string, Record<string, unknown>>;
+        role: import("@oclif/core/interfaces").Arg<string, Record<string, unknown>>;
+    };
+    run(): Promise<void>;
+}
+//# sourceMappingURL=grant.d.ts.map

package/dist/commands/app/grant.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"grant.d.ts","sourceRoot":"","sources":["../../../src/commands/app/grant.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAC;AAKpD,MAAM,CAAC,OAAO,OAAO,QAAS,SAAQ,WAAW;IAC/C,OAAgB,WAAW,SAAqC;IAEhE,OAAgB,QAAQ,WAGtB;IAEF,OAAgB,IAAI;;;MAOlB;IAEI,GAAG,IAAI,OAAO,CAAC,IAAI,CAAC;CAkB3B"}

package/dist/commands/app/grant.js

@@ -0,0 +1,31 @@
+import { Args } from "@oclif/core";
+import chalk from "chalk";
+import { BaseCommand } from "../../base-command.js";
+import { whileWaiting } from "../../cli/prompts.js";
+import { APP_ROLES, requireLinkedApp } from "../../cli/team.js";
+export default class AppGrant extends BaseCommand {
+    static description = "Give someone a role on this app";
+    static examples = [
+        "<%= config.bin %> app grant dev@company.com developer",
+        "<%= config.bin %> app grant qa@company.com tester",
+    ];
+    static args = {
+        email: Args.string({ description: "Account to grant", required: true }),
+        role: Args.string({
+            description: `One of ${APP_ROLES.join(", ")}`,
+            required: true,
+            options: [...APP_ROLES],
+        }),
+    };
+    async run() {
+        const { args } = await this.parse(AppGrant);
+        const { cloud, project } = requireLinkedApp(this);
+        await whileWaiting("Granting...", cloud.grantAppRole(project.cloudAppId, args.email.trim(), args.role));
+        const publishes = args.role === "admin" || args.role === "developer";
+        this.log("");
+        this.log(`  ${chalk.green("Granted")} ${args.email} is now ${chalk.bold(args.role)}`);
+        this.log(chalk.dim(publishes ? "  They can publish releases." : "  They cannot publish releases."));
+        this.log("");
+    }
+}
+//# sourceMappingURL=grant.js.map

package/dist/commands/app/grant.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"grant.js","sourceRoot":"","sources":["../../../src/commands/app/grant.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,aAAa,CAAC;AACnC,OAAO,KAAK,MAAM,OAAO,CAAC;AAC1B,OAAO,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAC;AACpD,OAAO,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AACpD,OAAO,EAAE,SAAS,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AAGhE,MAAM,CAAC,OAAO,OAAO,QAAS,SAAQ,WAAW;IAC/C,MAAM,CAAU,WAAW,GAAG,iCAAiC,CAAC;IAEhE,MAAM,CAAU,QAAQ,GAAG;QACzB,uDAAuD;QACvD,mDAAmD;KACpD,CAAC;IAEF,MAAM,CAAU,IAAI,GAAG;QACrB,KAAK,EAAE,IAAI,CAAC,MAAM,CAAC,EAAE,WAAW,EAAE,kBAAkB,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;QACvE,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC;YAChB,WAAW,EAAE,UAAU,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;YAC7C,QAAQ,EAAE,IAAI;YACd,OAAO,EAAE,CAAC,GAAG,SAAS,CAAC;SACxB,CAAC;KACH,CAAC;IAEF,KAAK,CAAC,GAAG;QACP,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;QAC5C,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC;QAElD,MAAM,YAAY,CAChB,aAAa,EACb,KAAK,CAAC,YAAY,CAAC,OAAO,CAAC,UAAU,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,EAAE,IAAI,CAAC,IAAe,CAAC,CAChF,CAAC;QAEF,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,KAAK,OAAO,IAAI,IAAI,CAAC,IAAI,KAAK,WAAW,CAAC;QAErE,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACb,IAAI,CAAC,GAAG,CAAC,KAAK,KAAK,CAAC,KAAK,CAAC,SAAS,CAAC,IAAI,IAAI,CAAC,KAAK,WAAW,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACtF,IAAI,CAAC,GAAG,CACN,KAAK,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,8BAA8B,CAAC,CAAC,CAAC,iCAAiC,CAAC,CAC1F,CAAC;QACF,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IACf,CAAC"}

package/dist/commands/app/revoke.d.ts

@@ -0,0 +1,13 @@
+import { BaseCommand } from "../../base-command.js";
+export default class AppRevoke extends BaseCommand {
+    static description: string;
+    static examples: string[];
+    static args: {
+        email: import("@oclif/core/interfaces").Arg<string, Record<string, unknown>>;
+    };
+    static flags: {
+        yes: import("@oclif/core/interfaces").BooleanFlag<boolean>;
+    };
+    run(): Promise<void>;
+}
+//# sourceMappingURL=revoke.d.ts.map

package/dist/commands/app/revoke.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"revoke.d.ts","sourceRoot":"","sources":["../../../src/commands/app/revoke.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAC;AAKpD,MAAM,CAAC,OAAO,OAAO,SAAU,SAAQ,WAAW;IAChD,OAAgB,WAAW,SAAuC;IAElE,OAAgB,QAAQ,WAAoD;IAE5E,OAAgB,IAAI;;MAElB;IAEF,OAAgB,KAAK;;MAEnB;IAEI,GAAG,IAAI,OAAO,CAAC,IAAI,CAAC;CA+B3B"}

package/dist/commands/app/revoke.js

@@ -0,0 +1,40 @@
+import { Args, Flags } from "@oclif/core";
+import chalk from "chalk";
+import { BaseCommand } from "../../base-command.js";
+import { resolveByEmail } from "../../cli/members.js";
+import { confirm, isInteractive, whileWaiting } from "../../cli/prompts.js";
+import { requireLinkedApp } from "../../cli/team.js";
+export default class AppRevoke extends BaseCommand {
+    static description = "Remove someone's role on this app";
+    static examples = ["<%= config.bin %> app revoke dev@company.com"];
+    static args = {
+        email: Args.string({ description: "Account to revoke", required: true }),
+    };
+    static flags = {
+        yes: Flags.boolean({ char: "y", default: false, description: "Skip the confirmation" }),
+    };
+    async run() {
+        const { args, flags } = await this.parse(AppRevoke);
+        const { cloud, project } = requireLinkedApp(this);
+        const members = await whileWaiting("Reading permissions...", cloud.appPermissions(project.cloudAppId));
+        const found = resolveByEmail(members, args.email);
+        if (!found.ok)
+            this.error(found.problem);
+        if (!flags.yes) {
+            if (!isInteractive()) {
+                this.error(`Refusing to revoke ${args.email} unattended. Pass --yes.`);
+            }
+            const proceed = await confirm(`Revoke ${args.email} on ${project.appName}?`, {
+                default: false,
+            });
+            if (!proceed)
+                return;
+        }
+        await whileWaiting("Revoking...", cloud.revokeAppRole(project.cloudAppId, found.userId));
+        this.log("");
+        this.log(`  ${chalk.green("Revoked")} ${args.email}`);
+        this.log(chalk.dim("  Organisation owners and admins keep access - remove them from the org instead."));
+        this.log("");
+    }
+}
+//# sourceMappingURL=revoke.js.map

package/dist/commands/app/revoke.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"revoke.js","sourceRoot":"","sources":["../../../src/commands/app/revoke.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,KAAK,MAAM,OAAO,CAAC;AAC1B,OAAO,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAC;AACpD,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AACtD,OAAO,EAAE,OAAO,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AAC5E,OAAO,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AAErD,MAAM,CAAC,OAAO,OAAO,SAAU,SAAQ,WAAW;IAChD,MAAM,CAAU,WAAW,GAAG,mCAAmC,CAAC;IAElE,MAAM,CAAU,QAAQ,GAAG,CAAC,8CAA8C,CAAC,CAAC;IAE5E,MAAM,CAAU,IAAI,GAAG;QACrB,KAAK,EAAE,IAAI,CAAC,MAAM,CAAC,EAAE,WAAW,EAAE,mBAAmB,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;KACzE,CAAC;IAEF,MAAM,CAAU,KAAK,GAAG;QACtB,GAAG,EAAE,KAAK,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,OAAO,EAAE,KAAK,EAAE,WAAW,EAAE,uBAAuB,EAAE,CAAC;KACxF,CAAC;IAEF,KAAK,CAAC,GAAG;QACP,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;QACpD,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC;QAElD,MAAM,OAAO,GAAG,MAAM,YAAY,CAChC,wBAAwB,EACxB,KAAK,CAAC,cAAc,CAAC,OAAO,CAAC,UAAU,CAAC,CACzC,CAAC;QAEF,MAAM,KAAK,GAAG,cAAc,CAAC,OAAO,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;QAClD,IAAI,CAAC,KAAK,CAAC,EAAE;YAAE,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,OAAQ,CAAC,CAAC;QAE1C,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC;YACf,IAAI,CAAC,aAAa,EAAE,EAAE,CAAC;gBACrB,IAAI,CAAC,KAAK,CAAC,sBAAsB,IAAI,CAAC,KAAK,0BAA0B,CAAC,CAAC;YACzE,CAAC;YACD,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,UAAU,IAAI,CAAC,KAAK,OAAO,OAAO,CAAC,OAAO,GAAG,EAAE;gBAC3E,OAAO,EAAE,KAAK;aACf,CAAC,CAAC;YACH,IAAI,CAAC,OAAO;gBAAE,OAAO;QACvB,CAAC;QAED,MAAM,YAAY,CAAC,aAAa,EAAE,KAAK,CAAC,aAAa,CAAC,OAAO,CAAC,UAAU,EAAE,KAAK,CAAC,MAAO,CAAC,CAAC,CAAC;QAE1F,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACb,IAAI,CAAC,GAAG,CAAC,KAAK,KAAK,CAAC,KAAK,CAAC,SAAS,CAAC,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC;QACtD,IAAI,CAAC,GAAG,CACN,KAAK,CAAC,GAAG,CAAC,kFAAkF,CAAC,CAC9F,CAAC;QACF,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IACf,CAAC"}

package/dist/commands/app/roles.d.ts

@@ -0,0 +1,7 @@
+import { BaseCommand } from "../../base-command.js";
+export default class AppRoles extends BaseCommand {
+    static description: string;
+    static examples: string[];
+    run(): Promise<void>;
+}
+//# sourceMappingURL=roles.d.ts.map

package/dist/commands/app/roles.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"roles.d.ts","sourceRoot":"","sources":["../../../src/commands/app/roles.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAC;AAKpD,MAAM,CAAC,OAAO,OAAO,QAAS,SAAQ,WAAW;IAC/C,OAAgB,WAAW,SAAsC;IAEjE,OAAgB,QAAQ,WAAmC;IAErD,GAAG,IAAI,OAAO,CAAC,IAAI,CAAC;CA8B3B"}

package/dist/commands/app/roles.js

@@ -0,0 +1,30 @@
+import chalk from "chalk";
+import { BaseCommand } from "../../base-command.js";
+import { membershipRows } from "../../cli/members.js";
+import { whileWaiting } from "../../cli/prompts.js";
+import { requireLinkedApp } from "../../cli/team.js";
+export default class AppRoles extends BaseCommand {
+    static description = "Show who can do what on this app";
+    static examples = ["<%= config.bin %> app roles"];
+    async run() {
+        const { cloud, project } = requireLinkedApp(this);
+        const members = await whileWaiting("Reading permissions...", cloud.appPermissions(project.cloudAppId));
+        this.log("");
+        this.log(`  ${chalk.bold(project.appName)} ${chalk.dim(`(${project.appId})`)}`);
+        this.log("");
+        if (members.length === 0) {
+            this.log(chalk.dim("  No direct grants. Organisation owners and admins still have access."));
+            this.log("");
+            return;
+        }
+        const width = Math.max(...membershipRows(members).map((row) => row.email.length));
+        for (const row of membershipRows(members)) {
+            const canPublish = row.role === "admin" || row.role === "developer";
+            this.log(`  ${row.email.padEnd(width)}  ${canPublish ? chalk.green(row.role) : chalk.dim(row.role)}`);
+        }
+        this.log("");
+        this.log(chalk.dim("  Green roles may publish. Grant with: capuchoo app grant <email> <role>"));
+        this.log("");
+    }
+}
+//# sourceMappingURL=roles.js.map

package/dist/commands/app/roles.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"roles.js","sourceRoot":"","sources":["../../../src/commands/app/roles.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,MAAM,OAAO,CAAC;AAC1B,OAAO,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAC;AACpD,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AACtD,OAAO,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AACpD,OAAO,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AAErD,MAAM,CAAC,OAAO,OAAO,QAAS,SAAQ,WAAW;IAC/C,MAAM,CAAU,WAAW,GAAG,kCAAkC,CAAC;IAEjE,MAAM,CAAU,QAAQ,GAAG,CAAC,6BAA6B,CAAC,CAAC;IAE3D,KAAK,CAAC,GAAG;QACP,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC;QAElD,MAAM,OAAO,GAAG,MAAM,YAAY,CAChC,wBAAwB,EACxB,KAAK,CAAC,cAAc,CAAC,OAAO,CAAC,UAAU,CAAC,CACzC,CAAC;QAEF,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACb,IAAI,CAAC,GAAG,CAAC,KAAK,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,KAAK,CAAC,GAAG,CAAC,IAAI,OAAO,CAAC,KAAK,GAAG,CAAC,EAAE,CAAC,CAAC;QAChF,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAEb,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACzB,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,uEAAuE,CAAC,CAAC,CAAC;YAC7F,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YACb,OAAO;QACT,CAAC;QAED,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,cAAc,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC;QAClF,KAAK,MAAM,GAAG,IAAI,cAAc,CAAC,OAAO,CAAC,EAAE,CAAC;YAC1C,MAAM,UAAU,GAAG,GAAG,CAAC,IAAI,KAAK,OAAO,IAAI,GAAG,CAAC,IAAI,KAAK,WAAW,CAAC;YACpE,IAAI,CAAC,GAAG,CACN,KAAK,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,UAAU,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAC5F,CAAC;QACJ,CAAC;QAED,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACb,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,0EAA0E,CAAC,CAAC,CAAC;QAChG,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IACf,CAAC"}

package/dist/commands/auth/issue.d.ts

@@ -0,0 +1,12 @@
+import { BaseCommand } from "../../base-command.js";
+export default class AuthIssue extends BaseCommand {
+    static description: string;
+    static examples: string[];
+    static flags: {
+        name: import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
+        role: import("@oclif/core/interfaces").OptionFlag<string | undefined, import("@oclif/core/interfaces").CustomOptions>;
+        "this-app": import("@oclif/core/interfaces").BooleanFlag<boolean>;
+    };
+    run(): Promise<void>;
+}
+//# sourceMappingURL=issue.d.ts.map

package/dist/commands/auth/issue.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"issue.d.ts","sourceRoot":"","sources":["../../../src/commands/auth/issue.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAC;AAKpD,MAAM,CAAC,OAAO,OAAO,SAAU,SAAQ,WAAW;IAChD,OAAgB,WAAW,SAAmE;IAE9F,OAAgB,QAAQ,WAGtB;IAEF,OAAgB,KAAK;;;;MAUnB;IAEI,GAAG,IAAI,OAAO,CAAC,IAAI,CAAC;CA+B3B"}

package/dist/commands/auth/issue.js

@@ -0,0 +1,52 @@
+import { APP_ROLE_ORDER, describeCap } from "@capuchoo/core";
+import { Flags } from "@oclif/core";
+import chalk from "chalk";
+import { hostname } from "node:os";
+import { BaseCommand } from "../../base-command.js";
+import { whileWaiting } from "../../cli/prompts.js";
+import { requireCloud } from "../../cli/team.js";
+import { readProjectConfig } from "../../utils/config.js";
+export default class AuthIssue extends BaseCommand {
+    static description = "Create an API key, optionally limited to one app and one role";
+    static examples = [
+        "<%= config.bin %> auth issue --name ci --role developer --this-app",
+        "<%= config.bin %> auth issue --name readonly --role viewer",
+    ];
+    static flags = {
+        name: Flags.string({ description: "Label shown in capuchoo auth keys" }),
+        role: Flags.string({
+            description: `Ceiling on what the key may do: ${APP_ROLE_ORDER.join(", ")}`,
+            options: [...APP_ROLE_ORDER],
+        }),
+        "this-app": Flags.boolean({
+            default: false,
+            description: "Restrict the key to the app this directory is linked to",
+        }),
+    };
+    async run() {
+        const { flags } = await this.parse(AuthIssue);
+        const cloud = requireCloud(this);
+        let appId;
+        if (flags["this-app"]) {
+            const project = readProjectConfig(process.cwd());
+            if (!project) {
+                this.error("--this-app needs a linked directory. Run capuchoo init, or drop the flag.");
+            }
+            appId = project.cloudAppId;
+        }
+        const name = flags.name?.trim() || `capuchoo-cli ${hostname()}`;
+        const role = flags.role;
+        const { key } = await whileWaiting("Creating...", cloud.createApiKey({ name, appId, role }));
+        this.log("");
+        this.log(`  ${chalk.bold(name)}`);
+        this.log(`    scope   ${appId ? chalk.yellow("this app only") : chalk.dim("all apps")}`);
+        this.log(`    role    ${role ? chalk.yellow(describeCap(role)) : chalk.dim(describeCap(null))}`);
+        this.log("");
+        // Shown once, because only its hash is stored.
+        this.log(`  ${key}`);
+        this.log("");
+        this.log(chalk.yellow("  Copy it now - it is not stored and cannot be shown again."));
+        this.log("");
+    }
+}
+//# sourceMappingURL=issue.js.map

package/dist/commands/auth/issue.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"issue.js","sourceRoot":"","sources":["../../../src/commands/auth/issue.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,WAAW,EAAgB,MAAM,gBAAgB,CAAC;AAC3E,OAAO,EAAE,KAAK,EAAE,MAAM,aAAa,CAAC;AACpC,OAAO,KAAK,MAAM,OAAO,CAAC;AAC1B,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AACnC,OAAO,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAC;AACpD,OAAO,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AACpD,OAAO,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AACjD,OAAO,EAAE,iBAAiB,EAAE,MAAM,uBAAuB,CAAC;AAE1D,MAAM,CAAC,OAAO,OAAO,SAAU,SAAQ,WAAW;IAChD,MAAM,CAAU,WAAW,GAAG,+DAA+D,CAAC;IAE9F,MAAM,CAAU,QAAQ,GAAG;QACzB,oEAAoE;QACpE,4DAA4D;KAC7D,CAAC;IAEF,MAAM,CAAU,KAAK,GAAG;QACtB,IAAI,EAAE,KAAK,CAAC,MAAM,CAAC,EAAE,WAAW,EAAE,mCAAmC,EAAE,CAAC;QACxE,IAAI,EAAE,KAAK,CAAC,MAAM,CAAC;YACjB,WAAW,EAAE,mCAAmC,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;YAC3E,OAAO,EAAE,CAAC,GAAG,cAAc,CAAC;SAC7B,CAAC;QACF,UAAU,EAAE,KAAK,CAAC,OAAO,CAAC;YACxB,OAAO,EAAE,KAAK;YACd,WAAW,EAAE,yDAAyD;SACvE,CAAC;KACH,CAAC;IAEF,KAAK,CAAC,GAAG;QACP,MAAM,EAAE,KAAK,EAAE,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;QAC9C,MAAM,KAAK,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC;QAEjC,IAAI,KAAyB,CAAC;QAC9B,IAAI,KAAK,CAAC,UAAU,CAAC,EAAE,CAAC;YACtB,MAAM,OAAO,GAAG,iBAAiB,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;YACjD,IAAI,CAAC,OAAO,EAAE,CAAC;gBACb,IAAI,CAAC,KAAK,CAAC,2EAA2E,CAAC,CAAC;YAC1F,CAAC;YACD,KAAK,GAAG,OAAO,CAAC,UAAU,CAAC;QAC7B,CAAC;QAED,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,gBAAgB,QAAQ,EAAE,EAAE,CAAC;QAChE,MAAM,IAAI,GAAG,KAAK,CAAC,IAA2B,CAAC;QAE/C,MAAM,EAAE,GAAG,EAAE,GAAG,MAAM,YAAY,CAAC,aAAa,EAAE,KAAK,CAAC,YAAY,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;QAE7F,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACb,IAAI,CAAC,GAAG,CAAC,KAAK,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAClC,IAAI,CAAC,GAAG,CAAC,eAAe,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;QACzF,IAAI,CAAC,GAAG,CACN,eAAe,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,EAAE,CACvF,CAAC;QACF,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACb,+CAA+C;QAC/C,IAAI,CAAC,GAAG,CAAC,KAAK,GAAG,EAAE,CAAC,CAAC;QACrB,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACb,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,6DAA6D,CAAC,CAAC,CAAC;QACtF,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IACf,CAAC"}

package/dist/commands/auth/keys.d.ts

@@ -0,0 +1,7 @@
+import { BaseCommand } from "../../base-command.js";
+export default class AuthKeys extends BaseCommand {
+    static description: string;
+    static examples: string[];
+    run(): Promise<void>;
+}
+//# sourceMappingURL=keys.d.ts.map

package/dist/commands/auth/keys.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"keys.d.ts","sourceRoot":"","sources":["../../../src/commands/auth/keys.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAC;AAKpD,MAAM,CAAC,OAAO,OAAO,QAAS,SAAQ,WAAW;IAC/C,OAAgB,WAAW,SAAuC;IAElE,OAAgB,QAAQ,WAAmC;IAErD,GAAG,IAAI,OAAO,CAAC,IAAI,CAAC;CAsC3B"}

package/dist/commands/auth/keys.js

@@ -0,0 +1,39 @@
+import { describeCap, isAppRole } from "@capuchoo/core";
+import chalk from "chalk";
+import { BaseCommand } from "../../base-command.js";
+import { whileWaiting } from "../../cli/prompts.js";
+import { requireCloud } from "../../cli/team.js";
+import { resolveCredentials } from "../../utils/config.js";
+export default class AuthKeys extends BaseCommand {
+    static description = "List the API keys on this account";
+    static examples = ["<%= config.bin %> auth keys"];
+    async run() {
+        const cloud = requireCloud(this);
+        const current = resolveCredentials();
+        const keys = await whileWaiting("Reading keys...", cloud.apiKeys());
+        this.log("");
+        if (keys.length === 0) {
+            this.log(chalk.dim("  No keys."));
+            this.log("");
+            return;
+        }
+        for (const key of keys) {
+            // A key is shown once, at creation, so the prefix is the only way to tell
+            // which stored credential a row corresponds to.
+            const mine = key.key_prefix ? current?.apiKey.startsWith(key.key_prefix) : false;
+            const scope = key.app_id ? chalk.yellow("one app") : chalk.dim("all apps");
+            this.log(`  ${chalk.bold(key.name)} ${chalk.dim(key.key_prefix ?? "")}` +
+                `${mine ? chalk.green("  (this machine)") : ""}`);
+            const cap = isAppRole(key.role)
+                ? chalk.yellow(describeCap(key.role))
+                : chalk.dim(describeCap(null));
+            this.log(`    ${scope}   ${cap}`);
+            this.log(`    ${chalk.dim(`id ${key.id}`)}`);
+        }
+        this.log("");
+        this.log(chalk.dim("  Revoke one with: capuchoo auth revoke <id>"));
+        this.log(chalk.dim("  Issue a limited one with: capuchoo auth issue --role developer --this-app"));
+        this.log("");
+    }
+}
+//# sourceMappingURL=keys.js.map

package/dist/commands/auth/keys.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"keys.js","sourceRoot":"","sources":["../../../src/commands/auth/keys.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AACxD,OAAO,KAAK,MAAM,OAAO,CAAC;AAC1B,OAAO,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAC;AACpD,OAAO,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AACpD,OAAO,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AACjD,OAAO,EAAE,kBAAkB,EAAE,MAAM,uBAAuB,CAAC;AAE3D,MAAM,CAAC,OAAO,OAAO,QAAS,SAAQ,WAAW;IAC/C,MAAM,CAAU,WAAW,GAAG,mCAAmC,CAAC;IAElE,MAAM,CAAU,QAAQ,GAAG,CAAC,6BAA6B,CAAC,CAAC;IAE3D,KAAK,CAAC,GAAG;QACP,MAAM,KAAK,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC;QACjC,MAAM,OAAO,GAAG,kBAAkB,EAAE,CAAC;QAErC,MAAM,IAAI,GAAG,MAAM,YAAY,CAAC,iBAAiB,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;QAEpE,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAEb,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACtB,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC;YAClC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YACb,OAAO;QACT,CAAC;QAED,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;YACvB,0EAA0E;YAC1E,gDAAgD;YAChD,MAAM,IAAI,GAAG,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,OAAO,EAAE,MAAM,CAAC,UAAU,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;YACjF,MAAM,KAAK,GAAG,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;YAE3E,IAAI,CAAC,GAAG,CACN,KAAK,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,UAAU,IAAI,EAAE,CAAC,EAAE;gBAC5D,GAAG,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,kBAAkB,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,CACnD,CAAC;YACF,MAAM,GAAG,GAAG,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC;gBAC7B,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;gBACrC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC;YACjC,IAAI,CAAC,GAAG,CAAC,OAAO,KAAK,MAAM,GAAG,EAAE,CAAC,CAAC;YAClC,IAAI,CAAC,GAAG,CAAC,OAAO,KAAK,CAAC,GAAG,CAAC,MAAM,GAAG,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC,CAAC;QAC/C,CAAC;QAED,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACb,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,8CAA8C,CAAC,CAAC,CAAC;QACpE,IAAI,CAAC,GAAG,CACN,KAAK,CAAC,GAAG,CAAC,6EAA6E,CAAC,CACzF,CAAC;QACF,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IACf,CAAC"}

package/dist/commands/auth/login.d.ts

@@ -15,5 +15,25 @@ export default class AuthLogin extends BaseCommand {
      * whether a failed login ends the process or just ends the login step.
      */
     static performLogin(flagEndpoint?: string, flagApiKey?: string): Promise<void>;
+    /**
+     * Turns a sign-in failure into something actionable.
+     *
+     * There is deliberately no `capuchoo auth register`: confirming an email is a
+     * browser round-trip, so a CLI signup could only ever end with "now go and
+     * check your email". Accounts are created in the dashboard, and an unconfirmed
+     * one is the state most likely to bring someone here confused.
+     */
+    static explainSignInFailure(error: unknown): string;
+    /**
+     * Gets an API key, by signing in or by being handed one.
+     *
+     * Signing in is the default because pasting a key could not be the first step:
+     * keys are made in the dashboard, and an app-scoped one cannot create apps -
+     * so a new user had no way to reach a working state from the terminal at all.
+     *
+     * The token from `/auth/login` is used once, to mint a key, and then dropped.
+     * A JWT expires; a key does not, so you sign in once per machine.
+     */
+    private static obtainKey;
 }
 //# sourceMappingURL=login.d.ts.map

package/dist/commands/auth/login.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"login.d.ts","sourceRoot":"","sources":["../../../src/commands/auth/login.ts"],"names":[],"mappings":"AAMA,OAAO,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAC;AAIpD,MAAM,CAAC,OAAO,OAAO,SAAU,SAAQ,WAAW;IAChD,OAAgB,WAAW,SAA+C;IAE1E,OAAgB,QAAQ,WAGtB;IAEF,OAAgB,KAAK;;;MAMnB;IAEI,GAAG,IAAI,OAAO,CAAC,IAAI,CAAC;IAK1B;;;;;;OAMG;WACU,YAAY,CAAC,YAAY,CAAC,EAAE,MAAM,EAAE,UAAU,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;CAiDrF"}
+{"version":3,"file":"login.d.ts","sourceRoot":"","sources":["../../../src/commands/auth/login.ts"],"names":[],"mappings":"AAQA,OAAO,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAC;AAIpD,MAAM,CAAC,OAAO,OAAO,SAAU,SAAQ,WAAW;IAChD,OAAgB,WAAW,SAAmC;IAE9D,OAAgB,QAAQ,WAGtB;IAEF,OAAgB,KAAK;;;MAMnB;IAEI,GAAG,IAAI,OAAO,CAAC,IAAI,CAAC;IAK1B;;;;;;OAMG;WACU,YAAY,CAAC,YAAY,CAAC,EAAE,MAAM,EAAE,UAAU,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAuCpF;;;;;;;OAOG;IACH,MAAM,CAAC,oBAAoB,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM;IAqBnD;;;;;;;;;OASG;mBACkB,SAAS;CAmE/B"}

package/dist/commands/auth/login.js

@@ -1,13 +1,15 @@
-import { askSecret, askText } from "../../cli/prompts.js";
+import { hostname } from "node:os";
+import { askSecret, askText, isInteractive, selectOne } from "../../cli/prompts.js";
 import { Flags } from "@oclif/core";
 import chalk from "chalk";
 import ora from "ora";
 import { CloudClient } from "../../services/cloud.js";
+import { TimeoutError } from "../../utils/http.js";
 import { readGlobalConfig, updateGlobalConfig } from "../../utils/config.js";
 import { BaseCommand } from "../../base-command.js";
 const DEFAULT_ENDPOINT = "https://capuchoo-back.onrender.com";
 export default class AuthLogin extends BaseCommand {
-    static description = "Store an API key for the Capuchoo backend";
+    static description = "Sign in to a Capuchoo backend";
     static examples = [
         "<%= config.bin %> auth login",
         "<%= config.bin %> auth login --endpoint https://capucho.internal --api-key cap_...",
@@ -40,15 +42,7 @@ export default class AuthLogin extends BaseCommand {
             })))
             .trim()
             .replace(/\/+$/, "");
-        let apiKey = flagApiKey;
-        if (!apiKey) {
-            process.stderr.write(chalk.dim(`\n  Create a key under Settings > API Keys at ${endpoint}\n\n`));
-            // Only a length check. The previous version required the key to start with
-            // "cap_", which is a server-side format decision the CLI has no business
-            // enforcing - a rotated prefix would have locked users out.
-            apiKey = await askSecret("API key");
-        }
-        apiKey = apiKey.trim();
+        const apiKey = (flagApiKey ?? (await AuthLogin.obtainKey(endpoint))).trim();
         const spinner = ora({ text: "Verifying", stream: process.stderr }).start();
         const profile = await new CloudClient(endpoint, apiKey).whoami();
         if (!profile) {
@@ -67,5 +61,90 @@ export default class AuthLogin extends BaseCommand {
             authenticatedAt: new Date().toISOString(),
         });
     }
+    /**
+     * Turns a sign-in failure into something actionable.
+     *
+     * There is deliberately no `capuchoo auth register`: confirming an email is a
+     * browser round-trip, so a CLI signup could only ever end with "now go and
+     * check your email". Accounts are created in the dashboard, and an unconfirmed
+     * one is the state most likely to bring someone here confused.
+     */
+    static explainSignInFailure(error) {
+        const message = error instanceof Error ? error.message : String(error);
+        if (/not confirmed/i.test(message)) {
+            return ("That account exists but its email has not been confirmed yet. Open the " +
+                "link in the sign-up email, then run this again.");
+        }
+        if (/invalid login credentials/i.test(message)) {
+            return ("That email and password were not accepted. If you have not signed up yet, " +
+                "create the account in the dashboard first - there is no signup here, " +
+                "because confirming an email needs a browser.");
+        }
+        return message;
+    }
+    /**
+     * Gets an API key, by signing in or by being handed one.
+     *
+     * Signing in is the default because pasting a key could not be the first step:
+     * keys are made in the dashboard, and an app-scoped one cannot create apps -
+     * so a new user had no way to reach a working state from the terminal at all.
+     *
+     * The token from `/auth/login` is used once, to mint a key, and then dropped.
+     * A JWT expires; a key does not, so you sign in once per machine.
+     */
+    static async obtainKey(endpoint) {
+        if (!isInteractive()) {
+            throw new Error("Not a terminal, so there is nobody to ask. Pass --api-key, or set " +
+                "CAPUCHOO_ENDPOINT and CAPUCHOO_API_KEY.");
+        }
+        const method = await selectOne("How would you like to sign in?", [
+            { value: "password", label: "Email and password", hint: "creates a key for this machine" },
+            { value: "key", label: "Paste an API key", hint: "from the dashboard" },
+        ], "--api-key");
+        if (method === "key") {
+            process.stderr.write(chalk.dim(`\n  Create a key under Settings > API Keys at ${endpoint}\n\n`));
+            // Length only. Requiring a "cap_" prefix is a server-side format decision
+            // the CLI has no business enforcing.
+            return askSecret("API key");
+        }
+        const email = await askText("Email", { flag: "--api-key" });
+        // Never a flag: a password in argv is a password in shell history and CI logs.
+        const password = await askSecret("Password");
+        const spinner = ora({ text: "Signing in", stream: process.stderr }).start();
+        let session;
+        try {
+            session = await CloudClient.login(endpoint, email.trim(), password);
+        }
+        catch (error) {
+            // A sign-in is usually the first request of a session, so it meets the
+            // backend at its coldest - and a host that sleeps when idle can take
+            // longer than the default timeout to answer. The second attempt lands on
+            // a service that is now awake.
+            if (!(error instanceof TimeoutError)) {
+                spinner.fail("Sign-in failed");
+                throw new Error(AuthLogin.explainSignInFailure(error));
+            }
+            spinner.text = "The backend was asleep - waking it and retrying";
+            try {
+                session = await CloudClient.login(endpoint, email.trim(), password, 120_000);
+            }
+            catch (retried) {
+                spinner.fail("Sign-in failed");
+                throw new Error(AuthLogin.explainSignInFailure(retried));
+            }
+        }
+        spinner.text = "Creating a key for this machine";
+        try {
+            const { key } = await new CloudClient(endpoint, session.token).createApiKey({
+                name: `capuchoo-cli ${hostname()}`,
+            });
+            spinner.succeed("Created a key for this machine");
+            return key;
+        }
+        catch (error) {
+            spinner.fail("Signed in, but could not create an API key");
+            throw new Error(error instanceof Error ? error.message : String(error));
+        }
+    }
 }
 //# sourceMappingURL=login.js.map

package/dist/commands/auth/login.js.map

@@ -1 +1 @@
-{"version":3,"file":"login.js","sourceRoot":"","sources":["../../../src/commands/auth/login.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,MAAM,sBAAsB,CAAC;AAC1D,OAAO,EAAE,KAAK,EAAE,MAAM,aAAa,CAAC;AACpC,OAAO,KAAK,MAAM,OAAO,CAAC;AAC1B,OAAO,GAAG,MAAM,KAAK,CAAC;AACtB,OAAO,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAC;AACtD,OAAO,EAAE,gBAAgB,EAAE,kBAAkB,EAAE,MAAM,uBAAuB,CAAC;AAC7E,OAAO,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAC;AAEpD,MAAM,gBAAgB,GAAG,oCAAoC,CAAC;AAE9D,MAAM,CAAC,OAAO,OAAO,SAAU,SAAQ,WAAW;IAChD,MAAM,CAAU,WAAW,GAAG,2CAA2C,CAAC;IAE1E,MAAM,CAAU,QAAQ,GAAG;QACzB,8BAA8B;QAC9B,oFAAoF;KACrF,CAAC;IAEF,MAAM,CAAU,KAAK,GAAG;QACtB,SAAS,EAAE,KAAK,CAAC,MAAM,CAAC;YACtB,IAAI,EAAE,GAAG;YACT,WAAW,EAAE,mDAAmD;SACjE,CAAC;QACF,QAAQ,EAAE,KAAK,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,WAAW,EAAE,kBAAkB,EAAE,CAAC;KACvE,CAAC;IAEF,KAAK,CAAC,GAAG;QACP,MAAM,EAAE,KAAK,EAAE,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;QAC9C,MAAM,SAAS,CAAC,YAAY,CAAC,KAAK,CAAC,QAAQ,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC;IACjE,CAAC;IAED;;;;;;OAMG;IACH,MAAM,CAAC,KAAK,CAAC,YAAY,CAAC,YAAqB,EAAE,UAAmB;QAClE,MAAM,QAAQ,GAAG,gBAAgB,EAAE,CAAC;QAEpC,MAAM,QAAQ,GAAG,CACf,YAAY;YACZ,CAAC,MAAM,OAAO,CAAC,aAAa,EAAE;gBAC5B,OAAO,EAAE,QAAQ,CAAC,QAAQ,IAAI,gBAAgB;gBAC9C,IAAI,EAAE,YAAY;gBAClB,QAAQ,EAAE,CAAC,KAAK,EAAE,EAAE,CAClB,gBAAgB,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,qCAAqC;aAC1F,CAAC,CAAC,CACJ;aACE,IAAI,EAAE;aACN,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;QAEvB,IAAI,MAAM,GAAG,UAAU,CAAC;QACxB,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,KAAK,CAAC,GAAG,CAAC,iDAAiD,QAAQ,MAAM,CAAC,CAC3E,CAAC;YACF,2EAA2E;YAC3E,yEAAyE;YACzE,4DAA4D;YAC5D,MAAM,GAAG,MAAM,SAAS,CAAC,SAAS,CAAC,CAAC;QACtC,CAAC;QAED,MAAM,GAAG,MAAM,CAAC,IAAI,EAAE,CAAC;QAEvB,MAAM,OAAO,GAAG,GAAG,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC;QAC3E,MAAM,OAAO,GAAG,MAAM,IAAI,WAAW,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,MAAM,EAAE,CAAC;QAEjE,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,OAAO,CAAC,IAAI,CAAC,iCAAiC,CAAC,CAAC;YAChD,MAAM,IAAI,KAAK,CAAC,GAAG,QAAQ,0DAA0D,CAAC,CAAC;QACzF,CAAC;QAED,OAAO,CAAC,OAAO,CAAC,gBAAgB,OAAO,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC;QAEtD,uEAAuE;QACvE,4EAA4E;QAC5E,2EAA2E;QAC3E,gEAAgE;QAChE,kBAAkB,CAAC;YACjB,QAAQ;YACR,MAAM;YACN,IAAI,EAAE,EAAE,EAAE,EAAE,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,KAAK,EAAE,OAAO,CAAC,IAAI,CAAC,KAAK,EAAE;YACxD,eAAe,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;SAC1C,CAAC,CAAC;IACL,CAAC"}
+{"version":3,"file":"login.js","sourceRoot":"","sources":["../../../src/commands/auth/login.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AACnC,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,aAAa,EAAE,SAAS,EAAE,MAAM,sBAAsB,CAAC;AACpF,OAAO,EAAE,KAAK,EAAE,MAAM,aAAa,CAAC;AACpC,OAAO,KAAK,MAAM,OAAO,CAAC;AAC1B,OAAO,GAAG,MAAM,KAAK,CAAC;AACtB,OAAO,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAC;AACtD,OAAO,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AACnD,OAAO,EAAE,gBAAgB,EAAE,kBAAkB,EAAE,MAAM,uBAAuB,CAAC;AAC7E,OAAO,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAC;AAEpD,MAAM,gBAAgB,GAAG,oCAAoC,CAAC;AAE9D,MAAM,CAAC,OAAO,OAAO,SAAU,SAAQ,WAAW;IAChD,MAAM,CAAU,WAAW,GAAG,+BAA+B,CAAC;IAE9D,MAAM,CAAU,QAAQ,GAAG;QACzB,8BAA8B;QAC9B,oFAAoF;KACrF,CAAC;IAEF,MAAM,CAAU,KAAK,GAAG;QACtB,SAAS,EAAE,KAAK,CAAC,MAAM,CAAC;YACtB,IAAI,EAAE,GAAG;YACT,WAAW,EAAE,mDAAmD;SACjE,CAAC;QACF,QAAQ,EAAE,KAAK,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,WAAW,EAAE,kBAAkB,EAAE,CAAC;KACvE,CAAC;IAEF,KAAK,CAAC,GAAG;QACP,MAAM,EAAE,KAAK,EAAE,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;QAC9C,MAAM,SAAS,CAAC,YAAY,CAAC,KAAK,CAAC,QAAQ,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC;IACjE,CAAC;IAED;;;;;;OAMG;IACH,MAAM,CAAC,KAAK,CAAC,YAAY,CAAC,YAAqB,EAAE,UAAmB;QAClE,MAAM,QAAQ,GAAG,gBAAgB,EAAE,CAAC;QAEpC,MAAM,QAAQ,GAAG,CACf,YAAY;YACZ,CAAC,MAAM,OAAO,CAAC,aAAa,EAAE;gBAC5B,OAAO,EAAE,QAAQ,CAAC,QAAQ,IAAI,gBAAgB;gBAC9C,IAAI,EAAE,YAAY;gBAClB,QAAQ,EAAE,CAAC,KAAK,EAAE,EAAE,CAClB,gBAAgB,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,qCAAqC;aAC1F,CAAC,CAAC,CACJ;aACE,IAAI,EAAE;aACN,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;QAEvB,MAAM,MAAM,GAAG,CAAC,UAAU,IAAI,CAAC,MAAM,SAAS,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QAE5E,MAAM,OAAO,GAAG,GAAG,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC;QAC3E,MAAM,OAAO,GAAG,MAAM,IAAI,WAAW,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,MAAM,EAAE,CAAC;QAEjE,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,OAAO,CAAC,IAAI,CAAC,iCAAiC,CAAC,CAAC;YAChD,MAAM,IAAI,KAAK,CAAC,GAAG,QAAQ,0DAA0D,CAAC,CAAC;QACzF,CAAC;QAED,OAAO,CAAC,OAAO,CAAC,gBAAgB,OAAO,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC;QAEtD,uEAAuE;QACvE,4EAA4E;QAC5E,2EAA2E;QAC3E,gEAAgE;QAChE,kBAAkB,CAAC;YACjB,QAAQ;YACR,MAAM;YACN,IAAI,EAAE,EAAE,EAAE,EAAE,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,KAAK,EAAE,OAAO,CAAC,IAAI,CAAC,KAAK,EAAE;YACxD,eAAe,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;SAC1C,CAAC,CAAC;IACL,CAAC;IAED;;;;;;;OAOG;IACH,MAAM,CAAC,oBAAoB,CAAC,KAAc;QACxC,MAAM,OAAO,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAEvE,IAAI,gBAAgB,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;YACnC,OAAO,CACL,yEAAyE;gBACzE,iDAAiD,CAClD,CAAC;QACJ,CAAC;QAED,IAAI,4BAA4B,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;YAC/C,OAAO,CACL,4EAA4E;gBAC5E,uEAAuE;gBACvE,8CAA8C,CAC/C,CAAC;QACJ,CAAC;QAED,OAAO,OAAO,CAAC;IACjB,CAAC;IAED;;;;;;;;;OASG;IACK,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,QAAgB;QAC7C,IAAI,CAAC,aAAa,EAAE,EAAE,CAAC;YACrB,MAAM,IAAI,KAAK,CACb,oEAAoE;gBAClE,yCAAyC,CAC5C,CAAC;QACJ,CAAC;QAED,MAAM,MAAM,GAAG,MAAM,SAAS,CAC5B,gCAAgC,EAChC;YACE,EAAE,KAAK,EAAE,UAAU,EAAE,KAAK,EAAE,oBAAoB,EAAE,IAAI,EAAE,gCAAgC,EAAE;YAC1F,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,kBAAkB,EAAE,IAAI,EAAE,oBAAoB,EAAE;SACxE,EACD,WAAW,CACZ,CAAC;QAEF,IAAI,MAAM,KAAK,KAAK,EAAE,CAAC;YACrB,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,KAAK,CAAC,GAAG,CAAC,iDAAiD,QAAQ,MAAM,CAAC,CAC3E,CAAC;YACF,0EAA0E;YAC1E,qCAAqC;YACrC,OAAO,SAAS,CAAC,SAAS,CAAC,CAAC;QAC9B,CAAC;QAED,MAAM,KAAK,GAAG,MAAM,OAAO,CAAC,OAAO,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC,CAAC;QAC5D,+EAA+E;QAC/E,MAAM,QAAQ,GAAG,MAAM,SAAS,CAAC,UAAU,CAAC,CAAC;QAE7C,MAAM,OAAO,GAAG,GAAG,CAAC,EAAE,IAAI,EAAE,YAAY,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC;QAE5E,IAAI,OAAO,CAAC;QACZ,IAAI,CAAC;YACH,OAAO,GAAG,MAAM,WAAW,CAAC,KAAK,CAAC,QAAQ,EAAE,KAAK,CAAC,IAAI,EAAE,EAAE,QAAQ,CAAC,CAAC;QACtE,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,uEAAuE;YACvE,qEAAqE;YACrE,yEAAyE;YACzE,+BAA+B;YAC/B,IAAI,CAAC,CAAC,KAAK,YAAY,YAAY,CAAC,EAAE,CAAC;gBACrC,OAAO,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;gBAC/B,MAAM,IAAI,KAAK,CAAC,SAAS,CAAC,oBAAoB,CAAC,KAAK,CAAC,CAAC,CAAC;YACzD,CAAC;YAED,OAAO,CAAC,IAAI,GAAG,iDAAiD,CAAC;YACjE,IAAI,CAAC;gBACH,OAAO,GAAG,MAAM,WAAW,CAAC,KAAK,CAAC,QAAQ,EAAE,KAAK,CAAC,IAAI,EAAE,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAC;YAC/E,CAAC;YAAC,OAAO,OAAO,EAAE,CAAC;gBACjB,OAAO,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;gBAC/B,MAAM,IAAI,KAAK,CAAC,SAAS,CAAC,oBAAoB,CAAC,OAAO,CAAC,CAAC,CAAC;YAC3D,CAAC;QACH,CAAC;QAED,OAAO,CAAC,IAAI,GAAG,iCAAiC,CAAC;QAEjD,IAAI,CAAC;YACH,MAAM,EAAE,GAAG,EAAE,GAAG,MAAM,IAAI,WAAW,CAAC,QAAQ,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC,YAAY,CAAC;gBAC1E,IAAI,EAAE,gBAAgB,QAAQ,EAAE,EAAE;aACnC,CAAC,CAAC;YACH,OAAO,CAAC,OAAO,CAAC,gCAAgC,CAAC,CAAC;YAClD,OAAO,GAAG,CAAC;QACb,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,CAAC,IAAI,CAAC,4CAA4C,CAAC,CAAC;YAC3D,MAAM,IAAI,KAAK,CAAC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;QAC1E,CAAC;IACH,CAAC"}

package/dist/commands/auth/revoke.d.ts

@@ -0,0 +1,13 @@
+import { BaseCommand } from "../../base-command.js";
+export default class AuthRevoke extends BaseCommand {
+    static description: string;
+    static examples: string[];
+    static args: {
+        id: import("@oclif/core/interfaces").Arg<string, Record<string, unknown>>;
+    };
+    static flags: {
+        yes: import("@oclif/core/interfaces").BooleanFlag<boolean>;
+    };
+    run(): Promise<void>;
+}
+//# sourceMappingURL=revoke.d.ts.map

package/dist/commands/auth/revoke.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"revoke.d.ts","sourceRoot":"","sources":["../../../src/commands/auth/revoke.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAC;AAKpD,MAAM,CAAC,OAAO,OAAO,UAAW,SAAQ,WAAW;IACjD,OAAgB,WAAW,SAAuB;IAElD,OAAgB,QAAQ,WAA0C;IAElE,OAAgB,IAAI;;MAElB;IAEF,OAAgB,KAAK;;MAEnB;IAEI,GAAG,IAAI,OAAO,CAAC,IAAI,CAAC;CAuC3B"}

package/dist/commands/auth/revoke.js

@@ -0,0 +1,48 @@
+import { Args, Flags } from "@oclif/core";
+import chalk from "chalk";
+import { BaseCommand } from "../../base-command.js";
+import { confirm, isInteractive, whileWaiting } from "../../cli/prompts.js";
+import { requireCloud } from "../../cli/team.js";
+import { resolveCredentials } from "../../utils/config.js";
+export default class AuthRevoke extends BaseCommand {
+    static description = "Revoke an API key";
+    static examples = ["<%= config.bin %> auth revoke <id>"];
+    static args = {
+        id: Args.string({ description: "Key id, from capuchoo auth keys", required: true }),
+    };
+    static flags = {
+        yes: Flags.boolean({ char: "y", default: false, description: "Skip the confirmation" }),
+    };
+    async run() {
+        const { args, flags } = await this.parse(AuthRevoke);
+        const cloud = requireCloud(this);
+        const current = resolveCredentials();
+        const keys = await whileWaiting("Reading keys...", cloud.apiKeys());
+        const key = keys.find((candidate) => candidate.id === args.id);
+        if (!key) {
+            this.error(`No key with id "${args.id}". Run ${chalk.cyan("capuchoo auth keys")} to see them.`);
+        }
+        // Revoking the key in use signs this machine out, which is worth saying
+        // before it happens rather than after.
+        const isCurrent = key.key_prefix ? current?.apiKey.startsWith(key.key_prefix) : false;
+        if (!flags.yes) {
+            if (!isInteractive()) {
+                this.error(`Refusing to revoke "${key.name}" unattended. Pass --yes.`);
+            }
+            if (isCurrent) {
+                this.log("");
+                this.log(chalk.yellow("  This is the key this machine uses. Revoking it signs you out here."));
+            }
+            const proceed = await confirm(`Revoke "${key.name}"?`, { default: false });
+            if (!proceed)
+                return;
+        }
+        await whileWaiting("Revoking...", cloud.revokeApiKey(key.id));
+        this.log("");
+        this.log(`  ${chalk.green("Revoked")} ${key.name}`);
+        if (isCurrent)
+            this.log(chalk.dim("  Sign in again with: capuchoo auth login"));
+        this.log("");
+    }
+}
+//# sourceMappingURL=revoke.js.map

package/dist/commands/auth/revoke.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"revoke.js","sourceRoot":"","sources":["../../../src/commands/auth/revoke.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,KAAK,MAAM,OAAO,CAAC;AAC1B,OAAO,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAC;AACpD,OAAO,EAAE,OAAO,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AAC5E,OAAO,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AACjD,OAAO,EAAE,kBAAkB,EAAE,MAAM,uBAAuB,CAAC;AAE3D,MAAM,CAAC,OAAO,OAAO,UAAW,SAAQ,WAAW;IACjD,MAAM,CAAU,WAAW,GAAG,mBAAmB,CAAC;IAElD,MAAM,CAAU,QAAQ,GAAG,CAAC,oCAAoC,CAAC,CAAC;IAElE,MAAM,CAAU,IAAI,GAAG;QACrB,EAAE,EAAE,IAAI,CAAC,MAAM,CAAC,EAAE,WAAW,EAAE,iCAAiC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;KACpF,CAAC;IAEF,MAAM,CAAU,KAAK,GAAG;QACtB,GAAG,EAAE,KAAK,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,OAAO,EAAE,KAAK,EAAE,WAAW,EAAE,uBAAuB,EAAE,CAAC;KACxF,CAAC;IAEF,KAAK,CAAC,GAAG;QACP,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;QACrD,MAAM,KAAK,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC;QACjC,MAAM,OAAO,GAAG,kBAAkB,EAAE,CAAC;QAErC,MAAM,IAAI,GAAG,MAAM,YAAY,CAAC,iBAAiB,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;QACpE,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC,CAAC;QAE/D,IAAI,CAAC,GAAG,EAAE,CAAC;YACT,IAAI,CAAC,KAAK,CACR,mBAAmB,IAAI,CAAC,EAAE,UAAU,KAAK,CAAC,IAAI,CAAC,oBAAoB,CAAC,eAAe,CACpF,CAAC;QACJ,CAAC;QAED,wEAAwE;QACxE,uCAAuC;QACvC,MAAM,SAAS,GAAG,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,OAAO,EAAE,MAAM,CAAC,UAAU,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;QAEtF,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC;YACf,IAAI,CAAC,aAAa,EAAE,EAAE,CAAC;gBACrB,IAAI,CAAC,KAAK,CAAC,uBAAuB,GAAG,CAAC,IAAI,2BAA2B,CAAC,CAAC;YACzE,CAAC;YACD,IAAI,SAAS,EAAE,CAAC;gBACd,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;gBACb,IAAI,CAAC,GAAG,CACN,KAAK,CAAC,MAAM,CAAC,sEAAsE,CAAC,CACrF,CAAC;YACJ,CAAC;YACD,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,WAAW,GAAG,CAAC,IAAI,IAAI,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC;YAC3E,IAAI,CAAC,OAAO;gBAAE,OAAO;QACvB,CAAC;QAED,MAAM,YAAY,CAAC,aAAa,EAAE,KAAK,CAAC,YAAY,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC;QAE9D,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACb,IAAI,CAAC,GAAG,CAAC,KAAK,KAAK,CAAC,KAAK,CAAC,SAAS,CAAC,IAAI,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC;QACpD,IAAI,SAAS;YAAE,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,2CAA2C,CAAC,CAAC,CAAC;QAChF,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IACf,CAAC"}

package/dist/commands/doctor.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"doctor.d.ts","sourceRoot":"","sources":["../../src/commands/doctor.ts"],"names":[],"mappings":"AAWA,OAAO,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AAgBjD;;;;;;;;;GASG;AACH,MAAM,CAAC,OAAO,OAAO,MAAO,SAAQ,WAAW;IAC7C,OAAgB,WAAW,SAAsE;IAEjG,OAAgB,QAAQ,WAAgC;IAElD,GAAG,IAAI,OAAO,CAAC,IAAI,CAAC;IAgO1B;;;;;;OAMG;IACH,OAAO,CAAC,kBAAkB;IA+D1B,qGAAqG;IACrG,OAAO,CAAC,mBAAmB;IA2C3B,8EAA8E;IAC9E,OAAO,CAAC,WAAW;IAanB,OAAO,CAAC,MAAM;CA0Bf"}
+{"version":3,"file":"doctor.d.ts","sourceRoot":"","sources":["../../src/commands/doctor.ts"],"names":[],"mappings":"AAWA,OAAO,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AAgBjD;;;;;;;;;GASG;AACH,MAAM,CAAC,OAAO,OAAO,MAAO,SAAQ,WAAW;IAC7C,OAAgB,WAAW,SAAsE;IAEjG,OAAgB,QAAQ,WAAgC;IAElD,GAAG,IAAI,OAAO,CAAC,IAAI,CAAC;IAiO1B;;;;;;OAMG;IACH,OAAO,CAAC,kBAAkB;IA6D1B,qGAAqG;IACrG,OAAO,CAAC,mBAAmB;IA2C3B,8EAA8E;IAC9E,OAAO,CAAC,WAAW;IAanB,OAAO,CAAC,MAAM;CA0Bf"}

package/dist/commands/doctor.js

@@ -207,6 +207,7 @@ export default class Doctor extends BaseCommand {
             });
         }
         findings.push(...this.checkRuntimeWiring(appDir));
+        findings.push(...this.checkReleaseSigning(appDir));
         this.report(findings);
     }
     /**
@@ -264,7 +265,6 @@ export default class Doctor extends BaseCommand {
                 findings.push({ level: "ok", what: "Capacitor plugin config" });
             }
         }
-        findings.push(...this.checkReleaseSigning(appDir));
         return findings;
     }
     /** Whether a release build could be signed. Never blocking: debug and unsigned are valid choices. */