@certen.io/cli 0.5.0 → 0.7.0

package/dist/commands/init.js

@@ -0,0 +1,307 @@
+import { CertenClient, CertenError } from '@certen.io/sdk';
+import { getApiKey, getApiUrl, getPortalUrl, setApiKey, readConfig, rememberIdentity, lastIdentity, } from '../config.js';
+import { printOutput, hint, human, isJsonMode } from '../output.js';
+import { CliError, UsageError, EXIT } from '../errors.js';
+import { listKeys, generateKey, keyExists } from '../keystore.js';
+import { resolveSigner } from '../signer.js';
+import { isInteractive, promptSecret, readSecretFromStdin, resolveNewPassphrase } from '../passphrase.js';
+import { assertChains, normalizeChain } from '../chains.js';
+import { waitForIdentity, parseWaitBudget, IDENTITY_WAIT } from '../wait.js';
+import { faucetFor } from '../funding-guard.js';
+import { runDeviceFlow } from './signup.js';
+async function askLine(prompt, fallback) {
+    if (!isInteractive())
+        return fallback;
+    process.stdout.write(`${prompt} [${fallback}]: `);
+    const answer = await new Promise((resolve) => {
+        const onData = (chunk) => {
+            process.stdin.pause();
+            process.stdin.removeListener('data', onData);
+            resolve(chunk.toString('utf8').trim());
+        };
+        process.stdin.resume();
+        process.stdin.once('data', onData);
+    });
+    return answer.length > 0 ? answer : fallback;
+}
+/** A default identity name that is valid (3-63 chars) and unlikely to collide on a retry. */
+function suggestedName() {
+    return `bot-${Math.floor(Date.now() / 1000) % 1_000_000}`;
+}
+export function registerInitCommands(program) {
+    program
+        .command('init')
+        .description('Set up everything: credential, signing key, identity — and check it works')
+        .option('--name <name>', 'Identity name (prompted, or generated with --yes)')
+        .option('--key <name>', 'Local signing key name to use or create', 'dev')
+        .option('--chains <chains>', 'Chains to link', 'base-sepolia')
+        .option('--yes', 'Accept every default without prompting (for CI)')
+        .option('--payer <address>', 'Wallet you will pay from. Deposits from it credit you automatically, with no payment intent.')
+        .option('--timeout <minutes>', `How long to wait for provisioning (default ${IDENTITY_WAIT.timeoutMin})`)
+        .option('--poll-interval <seconds>', `How often to check (default ${IDENTITY_WAIT.intervalSec})`)
+        .action(async (opts) => {
+        const steps = [];
+        const chains = assertChains(opts.chains);
+        const budget = parseWaitBudget(opts.timeout, opts.pollInterval, IDENTITY_WAIT);
+        const apiUrl = getApiUrl();
+        const say = (message) => { if (!isJsonMode())
+            human(message); };
+        say('');
+        say(`  Setting up against ${apiUrl}`);
+        say('');
+        // ── 1. Credential ─────────────────────────────────────────────────────────────────────────
+        let apiKey = null;
+        try {
+            apiKey = await getApiKey();
+            steps.push({ step: 'api key', status: 'skipped', detail: `${apiKey.substring(0, 12)}... already configured` });
+            say(`  1. API key      already configured (${apiKey.substring(0, 12)}...)`);
+        }
+        catch {
+            // No key. This is the step that still requires a human, and the only one.
+            if (opts.yes || !isInteractive()) {
+                throw new UsageError('No API key configured, and there is no TTY to ask on. '
+                    + `Mint one at ${getPortalUrl()} and either set CERTEN_API_KEY or run `
+                    + '`certen auth login`, then run `certen init` again.', 'NO_API_KEY');
+            }
+            say('  1. API key      none found — authorizing this machine in the portal.');
+            // The device flow, not a paste prompt. This is the step that used to send people to a
+            // browser to copy a secret back by hand; running it here is the whole point of Phase 5.
+            // Falls back to a hidden paste prompt only when the gateway cannot do device auth.
+            try {
+                const granted = await runDeviceFlow({ browser: true, keyring: readConfig().storage === 'keyring' });
+                apiKey = await getApiKey();
+                steps.push({ step: 'api key', status: 'created', detail: `${granted.prefix}... authorized` });
+                say('                  authorized.');
+            }
+            catch (err) {
+                const code = err.code;
+                if (code !== 'DEVICE_FLOW_UNSUPPORTED' && code !== 'SELF_SERVICE_DISABLED')
+                    throw err;
+                say(`                  this gateway cannot authorize devices. Mint a key at ${getPortalUrl()}`);
+                const entered = process.stdin.isTTY
+                    ? await promptSecret('     Paste your API key (hidden): ')
+                    : await readSecretFromStdin();
+                if (!entered)
+                    throw new UsageError('No API key entered.', 'NO_API_KEY');
+                // Verified before it is stored, exactly as `auth login` does — a key that does not work
+                // must not be written and then tripped over by every step below.
+                const probe = new CertenClient({ apiKey: entered, baseUrl: apiUrl });
+                try {
+                    await probe.billing.balance();
+                }
+                catch (probeErr) {
+                    if (probeErr instanceof CertenError && probeErr.status === 401) {
+                        throw new UsageError(`That API key was rejected by ${apiUrl}. Nothing was saved.`, 'INVALID_API_KEY');
+                    }
+                    if (probeErr instanceof CertenError && probeErr.status === 0)
+                        throw probeErr;
+                    // 403 and other statuses mean the credential is real; carry on.
+                }
+                await setApiKey(entered, readConfig().storage === 'keyring');
+                apiKey = entered;
+                steps.push({ step: 'api key', status: 'created', detail: `${entered.substring(0, 12)}... saved` });
+                say('     saved.');
+            }
+        }
+        const client = new CertenClient({ apiKey, baseUrl: apiUrl });
+        // ── 2. Signing key ────────────────────────────────────────────────────────────────────────
+        const existing = listKeys();
+        let keyName = opts.key;
+        if (keyExists(keyName)) {
+            steps.push({ step: 'signing key', status: 'skipped', detail: `${keyName} already exists` });
+            say(`  2. Signing key  "${keyName}" already exists`);
+        }
+        else if (existing.length > 0 && !opts.yes) {
+            // Reuse rather than proliferate: a machine with keys already on it usually wants one of
+            // them, and quietly creating another is how people end up unsure which key owns what.
+            keyName = await askLine(`  2. Signing key  use existing "${existing[0].name}" or name a new one`, existing[0].name);
+            if (!keyExists(keyName)) {
+                const passphrase = await resolveNewPassphrase(false);
+                generateKey(keyName, passphrase);
+                steps.push({ step: 'signing key', status: 'created', detail: keyName });
+            }
+            else {
+                steps.push({ step: 'signing key', status: 'skipped', detail: `${keyName} already exists` });
+            }
+        }
+        else {
+            // `--yes` implies CI, where a passphrase prompt cannot be answered. An unencrypted key is
+            // the honest option there, and the warning says so rather than hiding it.
+            const passphrase = opts.yes ? null : await resolveNewPassphrase(false);
+            const info = generateKey(keyName, passphrase);
+            steps.push({ step: 'signing key', status: 'created', detail: keyName });
+            say(`  2. Signing key  created "${keyName}"`);
+            if (passphrase === null) {
+                hint(`     Warning: "${keyName}" is stored UNENCRYPTED. Anyone who can read that file can sign as you.`);
+            }
+            void info;
+        }
+        // ── 3. Identity ───────────────────────────────────────────────────────────────────────────
+        // An existing active identity is reused. Creating one per `init` run would burn org quota
+        // every time someone re-ran the command to check their setup.
+        const portfolio = await client.portfolio.get().catch(() => null);
+        let identityId;
+        let adiUrl;
+        let accounts = [];
+        // Reuse is keyed on what THIS machine recorded, not on what the organization happens to
+        // own. An org with 39 identities from other machines and CI runs tells us nothing about
+        // which one this user meant, and the portfolio cannot supply a UUID anyway — so reusing
+        // from it produced a closing command with an unfillable `<id>` placeholder.
+        const remembered = opts.name ? undefined : lastIdentity();
+        const reusable = remembered
+            // Only `can_sign`, `id` and `adi_url` are read below, none of which are enrichments.
+            ? await client.identity.get(remembered.id, { include: [] }).catch(() => null)
+            : null;
+        if (reusable && reusable.can_sign === true) {
+            identityId = reusable.id;
+            adiUrl = reusable.adi_url;
+            accounts = (reusable.chain_accounts ?? [])
+                .filter((a) => a.address)
+                .map((a) => ({ chain_id: a.chain_id, address: a.address }));
+            steps.push({ step: 'identity', status: 'skipped', detail: `${adiUrl} (${identityId})` });
+            say(`  3. Identity     reusing ${adiUrl}`);
+        }
+        else {
+            const name = opts.name ?? (opts.yes ? suggestedName() : await askLine('  3. Identity     name', suggestedName()));
+            const signer = await resolveSigner(keyName);
+            say(`  3. Identity     creating "${name}" on ${chains.join(', ')}...`);
+            const created = await client.identity.create({
+                name,
+                publicKey: signer.publicKey,
+                publicKeyHash: signer.publicKeyHash,
+                chains,
+            });
+            const id = created.id;
+            if (!id) {
+                throw new CliError('The gateway accepted the identity but returned no id.', 'NO_IDENTITY_ID', EXIT.FAILED);
+            }
+            // Waits for `can_sign`, not merely for a terminal status. An identity that provisioned but
+            // cannot sign is the failure this whole command exists to avoid handing someone.
+            const identity = await waitForIdentity(client, id, budget);
+            identityId = identity.id;
+            adiUrl = identity.adi_url;
+            accounts = (identity.chain_accounts ?? [])
+                .filter((a) => a.address)
+                .map((a) => ({ chain_id: a.chain_id, address: a.address }));
+            // Written down immediately: this is the only moment the UUID is knowable, and without a
+            // record it is unrecoverable from any endpoint.
+            rememberIdentity({ id: identityId, adi_url: adiUrl, chains });
+            steps.push({ step: 'identity', status: 'created', detail: `${adiUrl} (${identityId})` });
+            say(`                  ${adiUrl} is active and can sign`);
+        }
+        // ── 4. Funding ────────────────────────────────────────────────────────────────────────────
+        const unfunded = [];
+        for (const account of accounts) {
+            const chain = normalizeChain(account.chain_id);
+            const balances = portfolio?.identities
+                ?.flatMap((i) => i.chains ?? [])
+                .find((c) => normalizeChain(c.chain_id) === chain && c.address === account.address);
+            const native = (balances?.balances ?? [])
+                .find((b) => !b.token || b.token === 'ETH' || b.token === 'native');
+            // A freshly created identity is not in the portfolio snapshot taken above, so treat an
+            // unknown balance as unfunded here: a new abstract account is empty by definition, and
+            // telling someone to fund it costs them nothing if it turns out to be funded already.
+            if (!native || Number(native.balance) === 0)
+                unfunded.push(chain);
+        }
+        steps.push(unfunded.length === 0
+            ? { step: 'funding', status: 'done', detail: 'abstract accounts have gas' }
+            : { step: 'funding', status: 'done', detail: `needs gas on ${[...new Set(unfunded)].join(', ')}` });
+        // ── 4b. Where the money will come from ────────────────────────────────────────────────────
+        //
+        // Registering the wallet you pay from is what makes a deposit credit you ON SIGHT — no
+        // payment intent, no exact-amount match, no TTL to beat. Without it every top-up is a
+        // three-step dance: open an intent, send precisely that amount, wait for attribution.
+        //
+        // It is one API call and it was reachable only by knowing that `certen payers add` exists,
+        // which nothing in the setup flow said. Folding it in here removes a step a user could only
+        // take after learning it was available.
+        if (opts.payer) {
+            if (!/^0x[0-9a-fA-F]{40}$/.test(opts.payer)) {
+                throw new UsageError(`"${opts.payer}" is not an address. Expected 0x followed by 40 hex characters.`, 'INVALID_PAYER_ADDRESS');
+            }
+            const registered = await client.billing
+                .registerPayerAddress({ chain: chains[0], address: opts.payer })
+                .then(() => ({ ok: true }))
+                // A 409 means this address is already attributed — to this org, in which case there is
+                // nothing to do, or to another, which is a genuine conflict the user must resolve. Either
+                // way it must not fail the whole setup: everything above it already succeeded.
+                .catch((err) => ({
+                ok: false,
+                why: err instanceof CertenError && err.status === 409
+                    ? 'already registered — to this organization, or to another one'
+                    : err instanceof Error ? err.message : String(err),
+            }));
+            steps.push(registered.ok
+                ? { step: 'payer', status: 'done', detail: `${opts.payer} on ${chains[0]}` }
+                : { step: 'payer', status: 'done', detail: `not registered: ${registered.why}` });
+            say(registered.ok
+                ? `  Deposits from ${opts.payer} will credit you automatically.`
+                : `  Could not register ${opts.payer}: ${registered.why}`);
+        }
+        // ── 5. Balance ────────────────────────────────────────────────────────────────────────────
+        const balance = await client.billing.balance().catch(() => null);
+        // The balance carries `remaining_usd` now, so the separate obligations read is gone — it was
+        // fetched for that one field, sequentially, on the command a new user runs first. Falls back
+        // against a gateway that predates the change rather than treating `spendable_usd` as safe.
+        const commitments = balance?.remaining_usd !== undefined
+            ? { remaining_usd: balance.remaining_usd }
+            : await client.billing.obligations().catch(() => null);
+        steps.push({
+            step: 'billing',
+            status: 'done',
+            detail: balance
+                ? `${balance.spendable_usd} spendable, account ${balance.status}`
+                : 'could not read the balance (no billing:read scope?)',
+        });
+        // ── Report ────────────────────────────────────────────────────────────────────────────────
+        if (isJsonMode()) {
+            printOutput({
+                api_url: apiUrl,
+                key_name: keyName,
+                identity_id: identityId ?? null,
+                adi_url: adiUrl ?? null,
+                chains,
+                abstract_accounts: accounts,
+                unfunded_chains: [...new Set(unfunded)],
+                spendable_usd: balance?.spendable_usd ?? null,
+                account_status: balance?.status ?? null,
+                steps,
+            });
+            return;
+        }
+        human('');
+        if (accounts.length > 0) {
+            human('  Abstract accounts (msg.sender on chain):');
+            for (const account of accounts) {
+                human(`    ${normalizeChain(account.chain_id).padEnd(18)} ${account.address}`);
+            }
+            human('');
+        }
+        if (unfunded.length > 0) {
+            // Named as the remaining blocker rather than buried: an unfunded abstract account is the
+            // difference between a call that executes and one that parks at `anchoring` forever.
+            human('  These need testnet gas before they can execute anything:');
+            for (const chain of [...new Set(unfunded)]) {
+                const faucet = faucetFor(chain);
+                human(`    ${chain.padEnd(18)} ${faucet ?? '(no faucet known)'}`);
+            }
+            human('');
+        }
+        if (balance && Number(commitments?.remaining_usd ?? balance.spendable_usd) <= 0) {
+            human('  You have nothing left to commit to new work.');
+            hint(`certen fund <amount> --chain ${chains[0]}`);
+            human('');
+        }
+        human('  Done. Your next command:');
+        human('');
+        human(identityId
+            ? `    certen call --identity ${identityId} --chain ${chains[0]} \\`
+            : '    certen call --identity <id> --chain ' + chains[0] + ' \\');
+        human(`        --to 0xYourContract --fn 'confirm(bytes32)' --arg 0x${'00'.repeat(32)} \\`);
+        human(`        --sign-with ${keyName} --wait`);
+        human('');
+        hint('Check everything at any time: certen doctor');
+    });
+}
+//# sourceMappingURL=init.js.map

package/dist/commands/init.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"init.js","sourceRoot":"","sources":["../../src/commands/init.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAC3D,OAAO,EACL,SAAS,EAAE,SAAS,EAAE,YAAY,EAAE,SAAS,EAAE,UAAU,EAAE,gBAAgB,EAAE,YAAY,GAC1F,MAAM,cAAc,CAAC;AACtB,OAAO,EAAE,WAAW,EAAE,IAAI,EAAE,KAAK,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AACpE,OAAO,EAAE,QAAQ,EAAE,UAAU,EAAE,IAAI,EAAE,MAAM,cAAc,CAAC;AAC1D,OAAO,EAAE,QAAQ,EAAE,WAAW,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAClE,OAAO,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAC7C,OAAO,EAAE,aAAa,EAAE,YAAY,EAAE,mBAAmB,EAAE,oBAAoB,EAAE,MAAM,kBAAkB,CAAC;AAC1G,OAAO,EAAE,YAAY,EAAoB,cAAc,EAAE,MAAM,cAAc,CAAC;AAC9E,OAAO,EAAE,eAAe,EAAE,eAAe,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAC7E,OAAO,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AAChD,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AA0B5C,KAAK,UAAU,OAAO,CAAC,MAAc,EAAE,QAAgB;IACrD,IAAI,CAAC,aAAa,EAAE;QAAE,OAAO,QAAQ,CAAC;IACtC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,MAAM,KAAK,QAAQ,KAAK,CAAC,CAAC;IAClD,MAAM,MAAM,GAAG,MAAM,IAAI,OAAO,CAAS,CAAC,OAAO,EAAE,EAAE;QACnD,MAAM,MAAM,GAAG,CAAC,KAAa,EAAQ,EAAE;YACrC,OAAO,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;YACtB,OAAO,CAAC,KAAK,CAAC,cAAc,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;YAC7C,OAAO,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;QACzC,CAAC,CAAC;QACF,OAAO,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC;QACvB,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACrC,CAAC,CAAC,CAAC;IACH,OAAO,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC;AAC/C,CAAC;AAED,6FAA6F;AAC7F,SAAS,aAAa;IACpB,OAAO,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,GAAG,SAAS,EAAE,CAAC;AAC5D,CAAC;AAED,MAAM,UAAU,oBAAoB,CAAC,OAAgB;IACnD,OAAO;SACJ,OAAO,CAAC,MAAM,CAAC;SACf,WAAW,CAAC,2EAA2E,CAAC;SACxF,MAAM,CAAC,eAAe,EAAE,mDAAmD,CAAC;SAC5E,MAAM,CAAC,cAAc,EAAE,yCAAyC,EAAE,KAAK,CAAC;SACxE,MAAM,CAAC,mBAAmB,EAAE,gBAAgB,EAAE,cAAc,CAAC;SAC7D,MAAM,CAAC,OAAO,EAAE,iDAAiD,CAAC;SAClE,MAAM,CACL,mBAAmB,EACnB,8FAA8F,CAC/F;SACA,MAAM,CAAC,qBAAqB,EAAE,8CAA8C,aAAa,CAAC,UAAU,GAAG,CAAC;SACxG,MAAM,CAAC,2BAA2B,EAAE,+BAA+B,aAAa,CAAC,WAAW,GAAG,CAAC;SAChG,MAAM,CAAC,KAAK,EAAE,IAGd,EAAE,EAAE;QACH,MAAM,KAAK,GAAiB,EAAE,CAAC;QAC/B,MAAM,MAAM,GAAG,YAAY,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACzC,MAAM,MAAM,GAAG,eAAe,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,YAAY,EAAE,aAAa,CAAC,CAAC;QAC/E,MAAM,MAAM,GAAG,SAAS,EAAE,CAAC;QAE3B,MAAM,GAAG,GAAG,CAAC,OAAe,EAAQ,EAAE,GAAG,IAAI,CAAC,UAAU,EAAE;YAAE,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC;QAE9E,GAAG,CAAC,EAAE,CAAC,CAAC;QACR,GAAG,CAAC,wBAAwB,MAAM,EAAE,CAAC,CAAC;QACtC,GAAG,CAAC,EAAE,CAAC,CAAC;QAER,6FAA6F;QAC7F,IAAI,MAAM,GAAkB,IAAI,CAAC;QACjC,IAAI,CAAC;YACH,MAAM,GAAG,MAAM,SAAS,EAAE,CAAC;YAC3B,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,MAAM,CAAC,SAAS,CAAC,CAAC,EAAE,EAAE,CAAC,wBAAwB,EAAE,CAAC,CAAC;YAC/G,GAAG,CAAC,yCAAyC,MAAM,CAAC,SAAS,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC;QAC9E,CAAC;QAAC,MAAM,CAAC;YACP,0EAA0E;YAC1E,IAAI,IAAI,CAAC,GAAG,IAAI,CAAC,aAAa,EAAE,EAAE,CAAC;gBACjC,MAAM,IAAI,UAAU,CAClB,wDAAwD;sBACtD,eAAe,YAAY,EAAE,wCAAwC;sBACrE,oDAAoD,EACtD,YAAY,CACb,CAAC;YACJ,CAAC;YACD,GAAG,CAAC,wEAAwE,CAAC,CAAC;YAE9E,sFAAsF;YACtF,wFAAwF;YACxF,mFAAmF;YACnF,IAAI,CAAC;gBACH,MAAM,OAAO,GAAG,MAAM,aAAa,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,UAAU,EAAE,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC,CAAC;gBACpG,MAAM,GAAG,MAAM,SAAS,EAAE,CAAC;gBAC3B,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,MAAM,gBAAgB,EAAE,CAAC,CAAC;gBAC9F,GAAG,CAAC,+BAA+B,CAAC,CAAC;YACvC,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,MAAM,IAAI,GAAI,GAAyB,CAAC,IAAI,CAAC;gBAC7C,IAAI,IAAI,KAAK,yBAAyB,IAAI,IAAI,KAAK,uBAAuB;oBAAE,MAAM,GAAG,CAAC;gBAEtF,GAAG,CAAC,0EAA0E,YAAY,EAAE,EAAE,CAAC,CAAC;gBAChG,MAAM,OAAO,GAAG,OAAO,CAAC,KAAK,CAAC,KAAK;oBACjC,CAAC,CAAC,MAAM,YAAY,CAAC,oCAAoC,CAAC;oBAC1D,CAAC,CAAC,MAAM,mBAAmB,EAAE,CAAC;gBAChC,IAAI,CAAC,OAAO;oBAAE,MAAM,IAAI,UAAU,CAAC,qBAAqB,EAAE,YAAY,CAAC,CAAC;gBAExE,wFAAwF;gBACxF,iEAAiE;gBACjE,MAAM,KAAK,GAAG,IAAI,YAAY,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC,CAAC;gBACrE,IAAI,CAAC;oBACH,MAAM,KAAK,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC;gBAChC,CAAC;gBAAC,OAAO,QAAQ,EAAE,CAAC;oBAClB,IAAI,QAAQ,YAAY,WAAW,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;wBAC/D,MAAM,IAAI,UAAU,CAClB,gCAAgC,MAAM,sBAAsB,EAC5D,iBAAiB,CAClB,CAAC;oBACJ,CAAC;oBACD,IAAI,QAAQ,YAAY,WAAW,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;wBAAE,MAAM,QAAQ,CAAC;oBAC7E,gEAAgE;gBAClE,CAAC;gBACD,MAAM,SAAS,CAAC,OAAO,EAAE,UAAU,EAAE,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC;gBAC7D,MAAM,GAAG,OAAO,CAAC;gBACjB,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC,EAAE,EAAE,CAAC,WAAW,EAAE,CAAC,CAAC;gBACnG,GAAG,CAAC,aAAa,CAAC,CAAC;YACrB,CAAC;QACH,CAAC;QAED,MAAM,MAAM,GAAG,IAAI,YAAY,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC,CAAC;QAE7D,6FAA6F;QAC7F,MAAM,QAAQ,GAAG,QAAQ,EAAE,CAAC;QAC5B,IAAI,OAAO,GAAG,IAAI,CAAC,GAAG,CAAC;QAEvB,IAAI,SAAS,CAAC,OAAO,CAAC,EAAE,CAAC;YACvB,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,aAAa,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,OAAO,iBAAiB,EAAE,CAAC,CAAC;YAC5F,GAAG,CAAC,sBAAsB,OAAO,kBAAkB,CAAC,CAAC;QACvD,CAAC;aAAM,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC;YAC5C,wFAAwF;YACxF,sFAAsF;YACtF,OAAO,GAAG,MAAM,OAAO,CAAC,mCAAmC,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI,qBAAqB,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;YACpH,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE,CAAC;gBACxB,MAAM,UAAU,GAAG,MAAM,oBAAoB,CAAC,KAAK,CAAC,CAAC;gBACrD,WAAW,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC;gBACjC,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,aAAa,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC;YAC1E,CAAC;iBAAM,CAAC;gBACN,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,aAAa,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,OAAO,iBAAiB,EAAE,CAAC,CAAC;YAC9F,CAAC;QACH,CAAC;aAAM,CAAC;YACN,0FAA0F;YAC1F,0EAA0E;YAC1E,MAAM,UAAU,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,oBAAoB,CAAC,KAAK,CAAC,CAAC;YACvE,MAAM,IAAI,GAAG,WAAW,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC;YAC9C,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,aAAa,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC;YACxE,GAAG,CAAC,8BAA8B,OAAO,GAAG,CAAC,CAAC;YAC9C,IAAI,UAAU,KAAK,IAAI,EAAE,CAAC;gBACxB,IAAI,CAAC,kBAAkB,OAAO,yEAAyE,CAAC,CAAC;YAC3G,CAAC;YACD,KAAK,IAAI,CAAC;QACZ,CAAC;QAED,6FAA6F;QAC7F,0FAA0F;QAC1F,8DAA8D;QAC9D,MAAM,SAAS,GAAG,MAAM,MAAM,CAAC,SAAS,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;QAEjE,IAAI,UAA8B,CAAC;QACnC,IAAI,MAA0B,CAAC;QAC/B,IAAI,QAAQ,GAAiD,EAAE,CAAC;QAEhE,wFAAwF;QACxF,wFAAwF;QACxF,wFAAwF;QACxF,4EAA4E;QAC5E,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,YAAY,EAAE,CAAC;QAC1D,MAAM,QAAQ,GAAG,UAAU;YACzB,qFAAqF;YACrF,CAAC,CAAC,MAAM,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC;YAC7E,CAAC,CAAC,IAAI,CAAC;QAET,IAAI,QAAQ,IAAI,QAAQ,CAAC,QAAQ,KAAK,IAAI,EAAE,CAAC;YAC3C,UAAU,GAAG,QAAQ,CAAC,EAAE,CAAC;YACzB,MAAM,GAAG,QAAQ,CAAC,OAAO,CAAC;YAC1B,QAAQ,GAAG,CAAC,QAAQ,CAAC,cAAc,IAAI,EAAE,CAAC;iBACvC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC;iBACxB,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,QAAQ,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;YAC9D,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,MAAM,KAAK,UAAU,GAAG,EAAE,CAAC,CAAC;YACzF,GAAG,CAAC,6BAA6B,MAAM,EAAE,CAAC,CAAC;QAC7C,CAAC;aAAM,CAAC;YACN,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC,MAAM,OAAO,CAAC,wBAAwB,EAAE,aAAa,EAAE,CAAC,CAAC,CAAC;YAClH,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,OAAO,CAAC,CAAC;YAE5C,GAAG,CAAC,+BAA+B,IAAI,QAAQ,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YACvE,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC;gBAC3C,IAAI;gBACJ,SAAS,EAAE,MAAM,CAAC,SAAS;gBAC3B,aAAa,EAAE,MAAM,CAAC,aAAa;gBACnC,MAAM;aACP,CAAC,CAAC;YAEH,MAAM,EAAE,GAAG,OAAO,CAAC,EAAE,CAAC;YACtB,IAAI,CAAC,EAAE,EAAE,CAAC;gBACR,MAAM,IAAI,QAAQ,CAAC,uDAAuD,EAAE,gBAAgB,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;YAC7G,CAAC;YAED,2FAA2F;YAC3F,iFAAiF;YACjF,MAAM,QAAQ,GAAG,MAAM,eAAe,CAAC,MAAM,EAAE,EAAE,EAAE,MAAM,CAAC,CAAC;YAC3D,UAAU,GAAG,QAAQ,CAAC,EAAE,CAAC;YACzB,MAAM,GAAG,QAAQ,CAAC,OAAO,CAAC;YAC1B,QAAQ,GAAG,CAAC,QAAQ,CAAC,cAAc,IAAI,EAAE,CAAC;iBACvC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC;iBACxB,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,QAAQ,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;YAC9D,wFAAwF;YACxF,gDAAgD;YAChD,gBAAgB,CAAC,EAAE,EAAE,EAAE,UAAU,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;YAC9D,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,MAAM,KAAK,UAAU,GAAG,EAAE,CAAC,CAAC;YACzF,GAAG,CAAC,qBAAqB,MAAM,yBAAyB,CAAC,CAAC;QAC5D,CAAC;QAED,6FAA6F;QAC7F,MAAM,QAAQ,GAAa,EAAE,CAAC;QAC9B,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;YAC/B,MAAM,KAAK,GAAG,cAAc,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;YAC/C,MAAM,QAAQ,GAAG,SAAS,EAAE,UAAU;gBACpC,EAAE,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,IAAI,EAAE,CAAC;iBAC/B,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,cAAc,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,KAAK,IAAI,CAAC,CAAC,OAAO,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;YACtF,MAAM,MAAM,GAAG,CAAC,QAAQ,EAAE,QAAQ,IAAI,EAAE,CAAC;iBACtC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,KAAK,KAAK,KAAK,IAAI,CAAC,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC;YACtE,uFAAuF;YACvF,uFAAuF;YACvF,sFAAsF;YACtF,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC;gBAAE,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACpE,CAAC;QAED,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,KAAK,CAAC;YAC9B,CAAC,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,4BAA4B,EAAE;YAC3E,CAAC,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,gBAAgB,CAAC,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC;QAEtG,6FAA6F;QAC7F,EAAE;QACF,uFAAuF;QACvF,sFAAsF;QACtF,sFAAsF;QACtF,EAAE;QACF,2FAA2F;QAC3F,4FAA4F;QAC5F,wCAAwC;QACxC,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,qBAAqB,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;gBAC5C,MAAM,IAAI,UAAU,CAClB,IAAI,IAAI,CAAC,KAAK,iEAAiE,EAC/E,uBAAuB,CACxB,CAAC;YACJ,CAAC;YACD,MAAM,UAAU,GAAG,MAAM,MAAM,CAAC,OAAO;iBACpC,oBAAoB,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC;iBAC/D,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,EAAE,EAAE,IAAa,EAAE,CAAC,CAAC;gBACpC,uFAAuF;gBACvF,0FAA0F;gBAC1F,+EAA+E;iBAC9E,KAAK,CAAC,CAAC,GAAY,EAAE,EAAE,CAAC,CAAC;gBACxB,EAAE,EAAE,KAAc;gBAClB,GAAG,EAAE,GAAG,YAAY,WAAW,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG;oBACnD,CAAC,CAAC,8DAA8D;oBAChE,CAAC,CAAC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;aACrD,CAAC,CAAC,CAAC;YAEN,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE;gBACtB,CAAC,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC,KAAK,OAAO,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE;gBAC5E,CAAC,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,mBAAmB,UAAU,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;YACpF,GAAG,CAAC,UAAU,CAAC,EAAE;gBACf,CAAC,CAAC,mBAAmB,IAAI,CAAC,KAAK,iCAAiC;gBAChE,CAAC,CAAC,wBAAwB,IAAI,CAAC,KAAK,KAAK,UAAU,CAAC,GAAG,EAAE,CAAC,CAAC;QAC/D,CAAC;QAED,6FAA6F;QAC7F,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;QACjE,6FAA6F;QAC7F,6FAA6F;QAC7F,2FAA2F;QAC3F,MAAM,WAAW,GAAG,OAAO,EAAE,aAAa,KAAK,SAAS;YACtD,CAAC,CAAC,EAAE,aAAa,EAAE,OAAO,CAAC,aAAa,EAAE;YAC1C,CAAC,CAAC,MAAM,MAAM,CAAC,OAAO,CAAC,WAAW,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;QACzD,KAAK,CAAC,IAAI,CAAC;YACT,IAAI,EAAE,SAAS;YACf,MAAM,EAAE,MAAM;YACd,MAAM,EAAE,OAAO;gBACb,CAAC,CAAC,GAAG,OAAO,CAAC,aAAa,uBAAuB,OAAO,CAAC,MAAM,EAAE;gBACjE,CAAC,CAAC,qDAAqD;SAC1D,CAAC,CAAC;QAEH,6FAA6F;QAC7F,IAAI,UAAU,EAAE,EAAE,CAAC;YACjB,WAAW,CAAC;gBACZ,OAAO,EAAE,MAAM;gBACf,QAAQ,EAAE,OAAO;gBACjB,WAAW,EAAE,UAAU,IAAI,IAAI;gBAC/B,OAAO,EAAE,MAAM,IAAI,IAAI;gBACvB,MAAM;gBACN,iBAAiB,EAAE,QAAQ;gBAC3B,eAAe,EAAE,CAAC,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,CAAC;gBACvC,aAAa,EAAE,OAAO,EAAE,aAAa,IAAI,IAAI;gBAC7C,cAAc,EAAE,OAAO,EAAE,MAAM,IAAI,IAAI;gBACvC,KAAK;aACJ,CAAC,CAAC;YACH,OAAO;QACT,CAAC;QAED,KAAK,CAAC,EAAE,CAAC,CAAC;QACV,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACxB,KAAK,CAAC,4CAA4C,CAAC,CAAC;YACpD,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;gBAC/B,KAAK,CAAC,OAAO,cAAc,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC;YACjF,CAAC;YACD,KAAK,CAAC,EAAE,CAAC,CAAC;QACZ,CAAC;QAED,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACxB,yFAAyF;YACzF,qFAAqF;YACrF,KAAK,CAAC,4DAA4D,CAAC,CAAC;YACpE,KAAK,MAAM,KAAK,IAAI,CAAC,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC;gBAC3C,MAAM,MAAM,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC;gBAChC,KAAK,CAAC,OAAO,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,IAAI,MAAM,IAAI,mBAAmB,EAAE,CAAC,CAAC;YACpE,CAAC;YACD,KAAK,CAAC,EAAE,CAAC,CAAC;QACZ,CAAC;QAED,IAAI,OAAO,IAAI,MAAM,CAAC,WAAW,EAAE,aAAa,IAAI,OAAO,CAAC,aAAa,CAAC,IAAI,CAAC,EAAE,CAAC;YAChF,KAAK,CAAC,gDAAgD,CAAC,CAAC;YACxD,IAAI,CAAC,gCAAgC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;YAClD,KAAK,CAAC,EAAE,CAAC,CAAC;QACZ,CAAC;QAED,KAAK,CAAC,4BAA4B,CAAC,CAAC;QACpC,KAAK,CAAC,EAAE,CAAC,CAAC;QACV,KAAK,CAAC,UAAU;YACd,CAAC,CAAC,8BAA8B,UAAU,YAAY,MAAM,CAAC,CAAC,CAAC,KAAK;YACpE,CAAC,CAAC,0CAA0C,GAAG,MAAM,CAAC,CAAC,CAAC,GAAG,KAAK,CAAC,CAAC;QACpE,KAAK,CAAC,+DAA+D,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC;QAC3F,KAAK,CAAC,uBAAuB,OAAO,SAAS,CAAC,CAAC;QAC/C,KAAK,CAAC,EAAE,CAAC,CAAC;QACV,IAAI,CAAC,6CAA6C,CAAC,CAAC;IACtD,CAAC,CAAC,CAAC;AACP,CAAC"}

package/dist/commands/keys.js

@@ -42,6 +42,8 @@ export function registerKeysCommands(program) {
         const all = listKeys();
         if (all.length === 0) {
             human(`(no keys in ${KEYS_DIR})`);
+            console.error('');
+            console.error('Next: certen keys generate --name dev');
             return;
         }
         printOutput(all.map((k) => ({

package/dist/commands/keys.js.map

@@ -1 +1 @@
-{"version":3,"file":"keys.js","sourceRoot":"","sources":["../../src/commands/keys.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,WAAW,EAAE,KAAK,EAAE,MAAM,cAAc,CAAC;AAClD,OAAO,EAAE,iBAAiB,EAAE,oBAAoB,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;AAC/F,OAAO,EACL,WAAW,EAAE,QAAQ,EAAE,UAAU,EAAE,SAAS,EAAE,QAAQ,EAAE,QAAQ,EAAE,OAAO,EAAE,QAAQ,GACpF,MAAM,gBAAgB,CAAC;AAExB;;;;;;GAMG;AACH,MAAM,UAAU,oBAAoB,CAAC,OAAgB;IACnD,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,WAAW,CAAC,uDAAuD,CAAC,CAAC;IAE1G,IAAI;SACD,OAAO,CAAC,UAAU,CAAC;SACnB,WAAW,CAAC,wDAAwD,CAAC;SACrE,cAAc,CAAC,eAAe,EAAE,yBAAyB,CAAC;SAC1D,MAAM,CAAC,iBAAiB,EAAE,wDAAwD,CAAC;SACnF,MAAM,CAAC,KAAK,EAAE,IAA2C,EAAE,EAAE;QAC5D,MAAM,UAAU,GAAG,MAAM,oBAAoB,CAAC,IAAI,CAAC,UAAU,KAAK,KAAK,CAAC,CAAC;QACzE,MAAM,IAAI,GAAG,WAAW,CAAC,IAAI,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC;QAEhD,IAAI,UAAU,KAAK,IAAI,EAAE,CAAC;YACxB,OAAO,CAAC,KAAK,CACX,iBAAiB,IAAI,CAAC,IAAI,8BAA8B,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI;kBAC5E,gDAAgD,CACnD,CAAC;QACJ,CAAC;QAED,WAAW,CAAC;YACV,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,UAAU,EAAE,IAAI,CAAC,SAAS;YAC1B,eAAe,EAAE,IAAI,CAAC,aAAa;YACnC,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,IAAI,EAAE,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC;YACxB,UAAU,EAAE,IAAI,CAAC,SAAS;SAC3B,CAAC,CAAC;QAEH,2FAA2F;QAC3F,0FAA0F;QAC1F,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QAClB,OAAO,CAAC,KAAK,CAAC,8DAA8D,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;IAC3F,CAAC,CAAC,CAAC;IAEL,IAAI;SACD,OAAO,CAAC,MAAM,CAAC;SACf,WAAW,CAAC,0DAA0D,CAAC;SACvE,MAAM,CAAC,GAAG,EAAE;QACX,MAAM,GAAG,GAAG,QAAQ,EAAE,CAAC;QACvB,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACrB,KAAK,CAAC,eAAe,QAAQ,GAAG,CAAC,CAAC;YAClC,OAAO;QACT,CAAC;QACD,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YAC1B,IAAI,EAAE,CAAC,CAAC,IAAI;YACZ,eAAe,EAAE,CAAC,CAAC,aAAa;YAChC,SAAS,EAAE,CAAC,CAAC,SAAS;YACtB,UAAU,EAAE,CAAC,CAAC,SAAS;SACxB,CAAC,CAAC,CAAC,CAAC;IACP,CAAC,CAAC,CAAC;IAEL,IAAI;SACD,OAAO,CAAC,aAAa,CAAC;SACtB,WAAW,CAAC,iCAAiC,CAAC;SAC9C,MAAM,CAAC,CAAC,IAAY,EAAE,EAAE;QACvB,MAAM,CAAC,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC;QAC3B,WAAW,CAAC;YACV,IAAI,EAAE,CAAC,CAAC,IAAI;YACZ,UAAU,EAAE,CAAC,CAAC,SAAS;YACvB,eAAe,EAAE,CAAC,CAAC,aAAa;YAChC,SAAS,EAAE,CAAC,CAAC,SAAS;YACtB,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC;YACrB,UAAU,EAAE,CAAC,CAAC,SAAS;SACxB,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEL,IAAI;SACD,OAAO,CAAC,MAAM,CAAC;SACf,WAAW,CAAC,oEAAoE,CAAC;SACjF,cAAc,CAAC,eAAe,EAAE,kBAAkB,CAAC;SACnD,cAAc,CAAC,cAAc,EAAE,gDAAgD,CAAC;SAChF,MAAM,CAAC,KAAK,EAAE,IAAoC,EAAE,EAAE;QACrD,MAAM,IAAI,GAAG,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACnC,MAAM,UAAU,GAAG,MAAM,iBAAiB,CAAC,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;QACtE,MAAM,SAAS,GAAG,QAAQ,CAAC,IAAI,CAAC,IAAI,EAAE,UAAU,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;QAC7D,WAAW,CAAC,EAAE,SAAS,EAAE,UAAU,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC;IACzD,CAAC,CAAC,CAAC;IAEL,IAAI;SACD,OAAO,CAAC,eAAe,CAAC;SACxB,WAAW,CAAC,4EAA4E,CAAC;SACzF,MAAM,CAAC,KAAK,EAAE,IAAY,EAAE,EAAE;QAC7B,MAAM,IAAI,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC;QAC9B,MAAM,UAAU,GAAG,MAAM,iBAAiB,CAAC,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;QACjE,MAAM,EAAE,GAAG,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC;QACtC,WAAW,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,eAAe,EAAE,IAAI,CAAC,aAAa,EAAE,CAAC,CAAC;QAC/D,IAAI,CAAC,EAAE;YAAE,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;IAChC,CAAC,CAAC,CAAC;IAEL,IAAI;SACD,OAAO,CAAC,eAAe,CAAC;SACxB,WAAW,CAAC,wCAAwC,CAAC;SACrD,cAAc,CAAC,OAAO,EAAE,kBAAkB,CAAC;SAC3C,MAAM,CAAC,CAAC,IAAY,EAAE,EAAE;QACvB,yFAAyF;QACzF,kEAAkE;QAClE,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;QAC3B,SAAS,CAAC,IAAI,CAAC,CAAC;QAChB,KAAK,CAAC,WAAW,IAAI,EAAE,CAAC,CAAC;QACzB,OAAO,CAAC,KAAK,CAAC,gFAAgF,CAAC,CAAC;IAClG,CAAC,CAAC,CAAC;IAEL,IAAI;SACD,OAAO,CAAC,MAAM,CAAC;SACf,WAAW,CAAC,6BAA6B,CAAC;SAC1C,MAAM,CAAC,GAAG,EAAE;QACX,WAAW,CAAC,EAAE,QAAQ,EAAE,QAAQ,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAC;IAC1E,CAAC,CAAC,CAAC;AACP,CAAC"}
+{"version":3,"file":"keys.js","sourceRoot":"","sources":["../../src/commands/keys.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,WAAW,EAAE,KAAK,EAAE,MAAM,cAAc,CAAC;AAClD,OAAO,EAAE,iBAAiB,EAAE,oBAAoB,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;AAC/F,OAAO,EACL,WAAW,EAAE,QAAQ,EAAE,UAAU,EAAE,SAAS,EAAE,QAAQ,EAAE,QAAQ,EAAE,OAAO,EAAE,QAAQ,GACpF,MAAM,gBAAgB,CAAC;AAExB;;;;;;GAMG;AACH,MAAM,UAAU,oBAAoB,CAAC,OAAgB;IACnD,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,WAAW,CAAC,uDAAuD,CAAC,CAAC;IAE1G,IAAI;SACD,OAAO,CAAC,UAAU,CAAC;SACnB,WAAW,CAAC,wDAAwD,CAAC;SACrE,cAAc,CAAC,eAAe,EAAE,yBAAyB,CAAC;SAC1D,MAAM,CAAC,iBAAiB,EAAE,wDAAwD,CAAC;SACnF,MAAM,CAAC,KAAK,EAAE,IAA2C,EAAE,EAAE;QAC5D,MAAM,UAAU,GAAG,MAAM,oBAAoB,CAAC,IAAI,CAAC,UAAU,KAAK,KAAK,CAAC,CAAC;QACzE,MAAM,IAAI,GAAG,WAAW,CAAC,IAAI,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC;QAEhD,IAAI,UAAU,KAAK,IAAI,EAAE,CAAC;YACxB,OAAO,CAAC,KAAK,CACX,iBAAiB,IAAI,CAAC,IAAI,8BAA8B,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI;kBAC5E,gDAAgD,CACnD,CAAC;QACJ,CAAC;QAED,WAAW,CAAC;YACV,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,UAAU,EAAE,IAAI,CAAC,SAAS;YAC1B,eAAe,EAAE,IAAI,CAAC,aAAa;YACnC,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,IAAI,EAAE,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC;YACxB,UAAU,EAAE,IAAI,CAAC,SAAS;SAC3B,CAAC,CAAC;QAEH,2FAA2F;QAC3F,0FAA0F;QAC1F,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QAClB,OAAO,CAAC,KAAK,CAAC,8DAA8D,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;IAC3F,CAAC,CAAC,CAAC;IAEL,IAAI;SACD,OAAO,CAAC,MAAM,CAAC;SACf,WAAW,CAAC,0DAA0D,CAAC;SACvE,MAAM,CAAC,GAAG,EAAE;QACX,MAAM,GAAG,GAAG,QAAQ,EAAE,CAAC;QACvB,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACrB,KAAK,CAAC,eAAe,QAAQ,GAAG,CAAC,CAAC;YAClC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;YAClB,OAAO,CAAC,KAAK,CAAC,uCAAuC,CAAC,CAAC;YACvD,OAAO;QACT,CAAC;QACD,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YAC1B,IAAI,EAAE,CAAC,CAAC,IAAI;YACZ,eAAe,EAAE,CAAC,CAAC,aAAa;YAChC,SAAS,EAAE,CAAC,CAAC,SAAS;YACtB,UAAU,EAAE,CAAC,CAAC,SAAS;SACxB,CAAC,CAAC,CAAC,CAAC;IACP,CAAC,CAAC,CAAC;IAEL,IAAI;SACD,OAAO,CAAC,aAAa,CAAC;SACtB,WAAW,CAAC,iCAAiC,CAAC;SAC9C,MAAM,CAAC,CAAC,IAAY,EAAE,EAAE;QACvB,MAAM,CAAC,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC;QAC3B,WAAW,CAAC;YACV,IAAI,EAAE,CAAC,CAAC,IAAI;YACZ,UAAU,EAAE,CAAC,CAAC,SAAS;YACvB,eAAe,EAAE,CAAC,CAAC,aAAa;YAChC,SAAS,EAAE,CAAC,CAAC,SAAS;YACtB,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC;YACrB,UAAU,EAAE,CAAC,CAAC,SAAS;SACxB,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEL,IAAI;SACD,OAAO,CAAC,MAAM,CAAC;SACf,WAAW,CAAC,oEAAoE,CAAC;SACjF,cAAc,CAAC,eAAe,EAAE,kBAAkB,CAAC;SACnD,cAAc,CAAC,cAAc,EAAE,gDAAgD,CAAC;SAChF,MAAM,CAAC,KAAK,EAAE,IAAoC,EAAE,EAAE;QACrD,MAAM,IAAI,GAAG,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACnC,MAAM,UAAU,GAAG,MAAM,iBAAiB,CAAC,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;QACtE,MAAM,SAAS,GAAG,QAAQ,CAAC,IAAI,CAAC,IAAI,EAAE,UAAU,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;QAC7D,WAAW,CAAC,EAAE,SAAS,EAAE,UAAU,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC;IACzD,CAAC,CAAC,CAAC;IAEL,IAAI;SACD,OAAO,CAAC,eAAe,CAAC;SACxB,WAAW,CAAC,4EAA4E,CAAC;SACzF,MAAM,CAAC,KAAK,EAAE,IAAY,EAAE,EAAE;QAC7B,MAAM,IAAI,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC;QAC9B,MAAM,UAAU,GAAG,MAAM,iBAAiB,CAAC,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;QACjE,MAAM,EAAE,GAAG,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC;QACtC,WAAW,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,eAAe,EAAE,IAAI,CAAC,aAAa,EAAE,CAAC,CAAC;QAC/D,IAAI,CAAC,EAAE;YAAE,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;IAChC,CAAC,CAAC,CAAC;IAEL,IAAI;SACD,OAAO,CAAC,eAAe,CAAC;SACxB,WAAW,CAAC,wCAAwC,CAAC;SACrD,cAAc,CAAC,OAAO,EAAE,kBAAkB,CAAC;SAC3C,MAAM,CAAC,CAAC,IAAY,EAAE,EAAE;QACvB,yFAAyF;QACzF,kEAAkE;QAClE,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;QAC3B,SAAS,CAAC,IAAI,CAAC,CAAC;QAChB,KAAK,CAAC,WAAW,IAAI,EAAE,CAAC,CAAC;QACzB,OAAO,CAAC,KAAK,CAAC,gFAAgF,CAAC,CAAC;IAClG,CAAC,CAAC,CAAC;IAEL,IAAI;SACD,OAAO,CAAC,MAAM,CAAC;SACf,WAAW,CAAC,6BAA6B,CAAC;SAC1C,MAAM,CAAC,GAAG,EAAE;QACX,WAAW,CAAC,EAAE,QAAQ,EAAE,QAAQ,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAC;IAC1E,CAAC,CAAC,CAAC;AACP,CAAC"}

package/dist/commands/oauth-clients.d.ts

@@ -0,0 +1,2 @@
+import { Command } from 'commander';
+export declare function registerOAuthClientCommands(program: Command): void;

package/dist/commands/oauth-clients.js

@@ -0,0 +1,131 @@
+import { CertenClient } from '@certen.io/sdk';
+import { getApiKey, getApiUrl, getOutputFormat } from '../config.js';
+import { printOutput, human, hint, isJsonMode } from '../output.js';
+/**
+ * OAuth2 clients — the credential a service of yours uses to authenticate.
+ *
+ * `certen auth revoke-token` could kill a token and `fetchOAuthToken` could mint one, but the
+ * client both of those depend on existed only if a human opened the portal and made it. So a
+ * deployment could not provision its own credential, which is the point at which "automated" stops
+ * being true.
+ *
+ * `rotate-secret` is the command that earns this group: it is the only way to change a credential
+ * without an outage, and the grace window is what makes that possible.
+ */
+async function getClient() {
+    return new CertenClient({ apiKey: await getApiKey(), baseUrl: getApiUrl() });
+}
+const machineOutput = () => isJsonMode() || getOutputFormat() === 'json';
+/**
+ * A secret is shown once, so the warning is not optional and not a footnote.
+ *
+ * Deliberately not routed through the table renderer: a secret that lands in a column ends up in
+ * scrollback and CI logs, where it long outlives the moment it was needed.
+ */
+function announceSecret(secret, what) {
+    human('');
+    human(`  ${what}: ${secret}`);
+    human('  SAVE THIS NOW — it is shown once and no endpoint will return it again.');
+}
+export function registerOAuthClientCommands(program) {
+    const clients = program
+        .command('oauth-clients')
+        .description('OAuth2 clients your services authenticate as');
+    clients
+        .command('list', { isDefault: true })
+        .description('Clients this organization owns')
+        .action(async () => {
+        const { clients: rows } = await (await getClient()).oauthClients.list();
+        if (machineOutput()) {
+            printOutput({ clients: rows });
+            return;
+        }
+        human('');
+        if (rows.length === 0) {
+            human('  No OAuth clients — nothing can authenticate with client credentials yet.');
+            hint('certen oauth-clients create --scopes proof:read');
+            return;
+        }
+        for (const c of rows) {
+            human(`  ${c.client_id}`);
+            // `is_active` decides whether any token can be minted at all, so it sits with the id
+            // rather than behind a second lookup.
+            human(`    ${c.id}  (${c.is_active ? 'active' : 'DEACTIVATED'})`);
+            human(`    scopes: ${c.scopes?.length ? c.scopes.join(', ') : 'none — its tokens can do nothing'}`);
+            if (c.last_rotated_at)
+                human(`    secret last rotated: ${c.last_rotated_at}`);
+        }
+        human('');
+    });
+    clients
+        .command('create')
+        .description('Create a client and receive its credentials once')
+        .requiredOption('--scopes <list>', 'Comma-separated scopes its tokens may use')
+        .option('--org <id>', 'Place the client in another organization (operators only)')
+        .action(async (opts) => {
+        const scopes = opts.scopes.split(',').map((s) => s.trim()).filter(Boolean);
+        const created = await (await getClient()).oauthClients.create({
+            scopes,
+            orgId: opts.org,
+        });
+        if (machineOutput()) {
+            printOutput({ ...created });
+            return;
+        }
+        printOutput({ client_id: created.client_id, org_id: created.org_id, scopes: created.scopes });
+        announceSecret(created.client_secret, 'Client secret');
+        human('');
+        human('  A token minted by this client can do exactly what the client may do, so these');
+        human(`  scopes are the ceiling: ${scopes.join(', ')}`);
+        hint('certen oauth-clients rotate-secret <id>   # change it later without an outage');
+    });
+    clients
+        .command('rotate-secret <id>')
+        .description('Issue a new secret, optionally keeping the old one alive while you deploy')
+        .option('--grace <seconds>', 'How long the previous secret keeps working. Default 300; 0 cuts over immediately.')
+        .action(async (id, opts) => {
+        const graceSeconds = opts.grace === undefined ? undefined : Number(opts.grace);
+        const rotated = await (await getClient()).oauthClients.rotateSecret(id, { graceSeconds });
+        if (machineOutput()) {
+            printOutput({ ...rotated });
+            return;
+        }
+        printOutput({
+            client_id: rotated.client_id,
+            grace_seconds: rotated.grace_seconds,
+            previous_secret_expires_at: rotated.previous_secret_expires_at,
+        });
+        announceSecret(rotated.client_secret, 'New client secret');
+        human('');
+        // The grace window is the difference between a rotation and an outage, so what it means is
+        // spelled out rather than left as a number in a table.
+        if (rotated.grace_seconds) {
+            human(`  The previous secret keeps working for ${rotated.grace_seconds}s`
+                + `${rotated.previous_secret_expires_at ? ` (until ${rotated.previous_secret_expires_at})` : ''}.`);
+            human('  Deploy the new one before then; anything still using the old one fails after.');
+        }
+        else {
+            human('  No grace window — the previous secret is dead already.');
+            human('  Anything still holding it is failing now.');
+        }
+        human('');
+        human('  Do not run this again until the deploy lands: a second rotation invalidates the');
+        human('  secret you just received.');
+    });
+    clients
+        .command('remove <id>')
+        .description('Deactivate a client and revoke every token it issued')
+        .action(async (id) => {
+        await (await getClient()).oauthClients.remove(id);
+        printOutput({ id, deactivated: true });
+        if (machineOutput())
+            return;
+        human('');
+        human(`  ${id} is deactivated and all of its outstanding tokens are revoked.`);
+        // Said because the cascade is immediate and total — someone reaching for this to change a
+        // credential wants the other command.
+        human('  Anything authenticating as this client stops working now, including tokens that');
+        human('  had hours left. To change the credential instead, use rotate-secret.');
+    });
+}
+//# sourceMappingURL=oauth-clients.js.map

package/dist/commands/oauth-clients.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth-clients.js","sourceRoot":"","sources":["../../src/commands/oauth-clients.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAC9C,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AACrE,OAAO,EAAE,WAAW,EAAE,KAAK,EAAE,IAAI,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAEpE;;;;;;;;;;GAUG;AAEH,KAAK,UAAU,SAAS;IACtB,OAAO,IAAI,YAAY,CAAC,EAAE,MAAM,EAAE,MAAM,SAAS,EAAE,EAAE,OAAO,EAAE,SAAS,EAAE,EAAE,CAAC,CAAC;AAC/E,CAAC;AAED,MAAM,aAAa,GAAG,GAAY,EAAE,CAAC,UAAU,EAAE,IAAI,eAAe,EAAE,KAAK,MAAM,CAAC;AAElF;;;;;GAKG;AACH,SAAS,cAAc,CAAC,MAAc,EAAE,IAAY;IAClD,KAAK,CAAC,EAAE,CAAC,CAAC;IACV,KAAK,CAAC,KAAK,IAAI,KAAK,MAAM,EAAE,CAAC,CAAC;IAC9B,KAAK,CAAC,0EAA0E,CAAC,CAAC;AACpF,CAAC;AAED,MAAM,UAAU,2BAA2B,CAAC,OAAgB;IAC1D,MAAM,OAAO,GAAG,OAAO;SACpB,OAAO,CAAC,eAAe,CAAC;SACxB,WAAW,CAAC,8CAA8C,CAAC,CAAC;IAE/D,OAAO;SACJ,OAAO,CAAC,MAAM,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;SACpC,WAAW,CAAC,gCAAgC,CAAC;SAC7C,MAAM,CAAC,KAAK,IAAI,EAAE;QACjB,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,GAAG,MAAM,CAAC,MAAM,SAAS,EAAE,CAAC,CAAC,YAAY,CAAC,IAAI,EAAE,CAAC;QACxE,IAAI,aAAa,EAAE,EAAE,CAAC;YACpB,WAAW,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;YAC/B,OAAO;QACT,CAAC;QACD,KAAK,CAAC,EAAE,CAAC,CAAC;QACV,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACtB,KAAK,CAAC,4EAA4E,CAAC,CAAC;YACpF,IAAI,CAAC,iDAAiD,CAAC,CAAC;YACxD,OAAO;QACT,CAAC;QACD,KAAK,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC;YACrB,KAAK,CAAC,KAAK,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC;YAC1B,qFAAqF;YACrF,sCAAsC;YACtC,KAAK,CAAC,OAAO,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,aAAa,GAAG,CAAC,CAAC;YAClE,KAAK,CAAC,eAAe,CAAC,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,kCAAkC,EAAE,CAAC,CAAC;YACpG,IAAI,CAAC,CAAC,eAAe;gBAAE,KAAK,CAAC,4BAA4B,CAAC,CAAC,eAAe,EAAE,CAAC,CAAC;QAChF,CAAC;QACD,KAAK,CAAC,EAAE,CAAC,CAAC;IACZ,CAAC,CAAC,CAAC;IAEL,OAAO;SACJ,OAAO,CAAC,QAAQ,CAAC;SACjB,WAAW,CAAC,kDAAkD,CAAC;SAC/D,cAAc,CAAC,iBAAiB,EAAE,2CAA2C,CAAC;SAC9E,MAAM,CAAC,YAAY,EAAE,2DAA2D,CAAC;SACjF,MAAM,CAAC,KAAK,EAAE,IAAsC,EAAE,EAAE;QACvD,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QAC3E,MAAM,OAAO,GAAG,MAAM,CAAC,MAAM,SAAS,EAAE,CAAC,CAAC,YAAY,CAAC,MAAM,CAAC;YAC5D,MAAM;YACN,KAAK,EAAE,IAAI,CAAC,GAAG;SAChB,CAAC,CAAC;QAEH,IAAI,aAAa,EAAE,EAAE,CAAC;YACpB,WAAW,CAAC,EAAE,GAAG,OAAO,EAAE,CAAC,CAAC;YAC5B,OAAO;QACT,CAAC;QACD,WAAW,CAAC,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;QAC9F,cAAc,CAAC,OAAO,CAAC,aAAa,EAAE,eAAe,CAAC,CAAC;QACvD,KAAK,CAAC,EAAE,CAAC,CAAC;QACV,KAAK,CAAC,iFAAiF,CAAC,CAAC;QACzF,KAAK,CAAC,6BAA6B,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACxD,IAAI,CAAC,+EAA+E,CAAC,CAAC;IACxF,CAAC,CAAC,CAAC;IAEL,OAAO;SACJ,OAAO,CAAC,oBAAoB,CAAC;SAC7B,WAAW,CAAC,2EAA2E,CAAC;SACxF,MAAM,CACL,mBAAmB,EACnB,mFAAmF,CACpF;SACA,MAAM,CAAC,KAAK,EAAE,EAAU,EAAE,IAAwB,EAAE,EAAE;QACrD,MAAM,YAAY,GAAG,IAAI,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC/E,MAAM,OAAO,GAAG,MAAM,CAAC,MAAM,SAAS,EAAE,CAAC,CAAC,YAAY,CAAC,YAAY,CAAC,EAAE,EAAE,EAAE,YAAY,EAAE,CAAC,CAAC;QAE1F,IAAI,aAAa,EAAE,EAAE,CAAC;YACpB,WAAW,CAAC,EAAE,GAAG,OAAO,EAAE,CAAC,CAAC;YAC5B,OAAO;QACT,CAAC;QACD,WAAW,CAAC;YACV,SAAS,EAAE,OAAO,CAAC,SAAS;YAC5B,aAAa,EAAE,OAAO,CAAC,aAAa;YACpC,0BAA0B,EAAE,OAAO,CAAC,0BAA0B;SAC/D,CAAC,CAAC;QACH,cAAc,CAAC,OAAO,CAAC,aAAa,EAAE,mBAAmB,CAAC,CAAC;QAC3D,KAAK,CAAC,EAAE,CAAC,CAAC;QACV,2FAA2F;QAC3F,uDAAuD;QACvD,IAAI,OAAO,CAAC,aAAa,EAAE,CAAC;YAC1B,KAAK,CAAC,2CAA2C,OAAO,CAAC,aAAa,GAAG;kBACrE,GAAG,OAAO,CAAC,0BAA0B,CAAC,CAAC,CAAC,WAAW,OAAO,CAAC,0BAA0B,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;YACtG,KAAK,CAAC,iFAAiF,CAAC,CAAC;QAC3F,CAAC;aAAM,CAAC;YACN,KAAK,CAAC,0DAA0D,CAAC,CAAC;YAClE,KAAK,CAAC,6CAA6C,CAAC,CAAC;QACvD,CAAC;QACD,KAAK,CAAC,EAAE,CAAC,CAAC;QACV,KAAK,CAAC,mFAAmF,CAAC,CAAC;QAC3F,KAAK,CAAC,6BAA6B,CAAC,CAAC;IACvC,CAAC,CAAC,CAAC;IAEL,OAAO;SACJ,OAAO,CAAC,aAAa,CAAC;SACtB,WAAW,CAAC,sDAAsD,CAAC;SACnE,MAAM,CAAC,KAAK,EAAE,EAAU,EAAE,EAAE;QAC3B,MAAM,CAAC,MAAM,SAAS,EAAE,CAAC,CAAC,YAAY,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QAClD,WAAW,CAAC,EAAE,EAAE,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC,CAAC;QACvC,IAAI,aAAa,EAAE;YAAE,OAAO;QAC5B,KAAK,CAAC,EAAE,CAAC,CAAC;QACV,KAAK,CAAC,KAAK,EAAE,gEAAgE,CAAC,CAAC;QAC/E,0FAA0F;QAC1F,sCAAsC;QACtC,KAAK,CAAC,mFAAmF,CAAC,CAAC;QAC3F,KAAK,CAAC,wEAAwE,CAAC,CAAC;IAClF,CAAC,CAAC,CAAC;AACP,CAAC"}

package/dist/commands/orgs.d.ts

@@ -0,0 +1,2 @@
+import { Command } from 'commander';
+export declare function registerOrgCommands(program: Command): void;

package/dist/commands/orgs.js

@@ -0,0 +1,117 @@
+import { CertenClient } from '@certen.io/sdk';
+import { getApiKey, getApiUrl, getOutputFormat } from '../config.js';
+import { printOutput, human, hint, isJsonMode } from '../output.js';
+/**
+ * Registration tokens — letting an organization be created without a browser.
+ *
+ * An org could only be born inside a portal login, so a platform could not provision its customers,
+ * a CI job could not create a scratch org, and an agent could not take its first step. Everything
+ * automated stopped and waited for a person.
+ *
+ * This does not remove the human decision, it separates it in time: an owner mints a token now, and
+ * whatever holds it redeems it later, unattended. Redeeming lives on `certen signup --token`,
+ * because that is the command someone reaches for when they have nothing yet.
+ */
+async function getClient() {
+    return new CertenClient({ apiKey: await getApiKey(), baseUrl: getApiUrl() });
+}
+const machineOutput = () => isJsonMode() || getOutputFormat() === 'json';
+/** `24h`, `30m`, `7d`, or a bare number of seconds. */
+function parseDuration(raw) {
+    const m = /^(\d+)\s*([smhd])?$/i.exec(raw.trim());
+    if (!m)
+        return undefined;
+    const n = Number(m[1]);
+    const unit = (m[2] ?? 's').toLowerCase();
+    return n * ({ s: 1, m: 60, h: 3600, d: 86400 }[unit] ?? 1);
+}
+export function registerOrgCommands(program) {
+    const orgs = program
+        .command('orgs')
+        .description('Invite a new organization onto CERTEN, without a browser');
+    orgs
+        .command('invite', { isDefault: true })
+        .description('Mint a one-time token that creates a new organization when redeemed')
+        .option('--name <name>', 'Name for the organization it will create')
+        .option('--scopes <list>', 'Comma-separated scopes for its first API key')
+        .option('--plan <plan>', 'starter, pro or enterprise (default starter)')
+        .option('--expires <duration>', 'How long it stays redeemable, e.g. 24h, 7d (default 24h)')
+        .option('--note <text>', 'For your own records — who this was issued to')
+        .action(async (opts) => {
+        const expiresIn = opts.expires ? parseDuration(opts.expires) : undefined;
+        if (opts.expires && expiresIn === undefined) {
+            // Checked before the request: minting is not retry-safe, so a rejected call is cheaper
+            // than a token issued with a lifetime the user did not mean.
+            throw new Error(`"${opts.expires}" is not a duration. Use 30m, 24h, 7d, or seconds.`);
+        }
+        const minted = await (await getClient()).registrationTokens.mint({
+            orgName: opts.name,
+            plan: opts.plan,
+            permissions: opts.scopes?.split(',').map((s) => s.trim()).filter(Boolean),
+            expiresIn,
+            note: opts.note,
+        });
+        if (machineOutput()) {
+            printOutput({ ...minted });
+            return;
+        }
+        printOutput({
+            id: minted.id,
+            org_name: minted.org_name,
+            plan: minted.plan,
+            permissions: minted.permissions,
+            expires_at: minted.expires_at,
+        });
+        human('');
+        human(`  Registration token: ${minted.token}`);
+        human('  SAVE THIS NOW — it is shown once and no endpoint will return it again.');
+        human('');
+        human('  Whoever holds it can create ONE organization, billed from that point on:');
+        human('');
+        human(`    certen signup --token ${minted.token}`);
+        human('');
+        human(`  It stops working at ${minted.expires_at}.`);
+        hint(`certen orgs revoke ${minted.id}   # if it goes to the wrong place`);
+    });
+    orgs
+        .command('list')
+        .description('Tokens this organization has minted, and what became of them')
+        .action(async () => {
+        const { tokens } = await (await getClient()).registrationTokens.list();
+        if (machineOutput()) {
+            printOutput({ tokens });
+            return;
+        }
+        human('');
+        if (tokens.length === 0) {
+            human('  No registration tokens minted.');
+            hint('certen orgs invite --name "Acme"');
+            return;
+        }
+        for (const t of tokens) {
+            human(`  ${t.token_prefix.padEnd(18)} ${t.state.toUpperCase()}`);
+            human(`    ${t.id}${t.org_name ? `  (${t.org_name})` : ''}`);
+            // What a redeemed token BECAME is the only thing worth knowing afterwards — it is the
+            // link between a decision someone made and an organization now on their bill.
+            if (t.redeemed_org_id)
+                human(`    became org ${t.redeemed_org_id} at ${t.redeemed_at}`);
+            else if (t.state === 'active')
+                human(`    expires ${t.expires_at}`);
+            if (t.note)
+                human(`    note: ${t.note}`);
+        }
+        human('');
+    });
+    orgs
+        .command('revoke <id>')
+        .description('Stop an unredeemed token from being used')
+        .action(async (id) => {
+        const revoked = await (await getClient()).registrationTokens.revoke(id);
+        printOutput({ ...revoked });
+        if (machineOutput())
+            return;
+        human('');
+        human(`  ${id} can no longer be redeemed.`);
+    });
+}
+//# sourceMappingURL=orgs.js.map

package/dist/commands/orgs.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"orgs.js","sourceRoot":"","sources":["../../src/commands/orgs.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAC9C,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AACrE,OAAO,EAAE,WAAW,EAAE,KAAK,EAAE,IAAI,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAEpE;;;;;;;;;;GAUG;AAEH,KAAK,UAAU,SAAS;IACtB,OAAO,IAAI,YAAY,CAAC,EAAE,MAAM,EAAE,MAAM,SAAS,EAAE,EAAE,OAAO,EAAE,SAAS,EAAE,EAAE,CAAC,CAAC;AAC/E,CAAC;AAED,MAAM,aAAa,GAAG,GAAY,EAAE,CAAC,UAAU,EAAE,IAAI,eAAe,EAAE,KAAK,MAAM,CAAC;AAElF,uDAAuD;AACvD,SAAS,aAAa,CAAC,GAAW;IAChC,MAAM,CAAC,GAAG,sBAAsB,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC;IAClD,IAAI,CAAC,CAAC;QAAE,OAAO,SAAS,CAAC;IACzB,MAAM,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACvB,MAAM,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,WAAW,EAAE,CAAC;IACzC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;AAC7D,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,OAAgB;IAClD,MAAM,IAAI,GAAG,OAAO;SACjB,OAAO,CAAC,MAAM,CAAC;SACf,WAAW,CAAC,0DAA0D,CAAC,CAAC;IAE3E,IAAI;SACD,OAAO,CAAC,QAAQ,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;SACtC,WAAW,CAAC,qEAAqE,CAAC;SAClF,MAAM,CAAC,eAAe,EAAE,0CAA0C,CAAC;SACnE,MAAM,CAAC,iBAAiB,EAAE,8CAA8C,CAAC;SACzE,MAAM,CAAC,eAAe,EAAE,8CAA8C,CAAC;SACvE,MAAM,CAAC,sBAAsB,EAAE,0DAA0D,CAAC;SAC1F,MAAM,CAAC,eAAe,EAAE,+CAA+C,CAAC;SACxE,MAAM,CAAC,KAAK,EAAE,IAEd,EAAE,EAAE;QACH,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,aAAa,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QACzE,IAAI,IAAI,CAAC,OAAO,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;YAC5C,uFAAuF;YACvF,6DAA6D;YAC7D,MAAM,IAAI,KAAK,CAAC,IAAI,IAAI,CAAC,OAAO,oDAAoD,CAAC,CAAC;QACxF,CAAC;QAED,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,SAAS,EAAE,CAAC,CAAC,kBAAkB,CAAC,IAAI,CAAC;YAC/D,OAAO,EAAE,IAAI,CAAC,IAAI;YAClB,IAAI,EAAE,IAAI,CAAC,IAAoD;YAC/D,WAAW,EAAE,IAAI,CAAC,MAAM,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC;YACzE,SAAS;YACT,IAAI,EAAE,IAAI,CAAC,IAAI;SAChB,CAAC,CAAC;QAEH,IAAI,aAAa,EAAE,EAAE,CAAC;YACpB,WAAW,CAAC,EAAE,GAAG,MAAM,EAAE,CAAC,CAAC;YAC3B,OAAO;QACT,CAAC;QAED,WAAW,CAAC;YACV,EAAE,EAAE,MAAM,CAAC,EAAE;YACb,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACzB,IAAI,EAAE,MAAM,CAAC,IAAI;YACjB,WAAW,EAAE,MAAM,CAAC,WAAW;YAC/B,UAAU,EAAE,MAAM,CAAC,UAAU;SAC9B,CAAC,CAAC;QACH,KAAK,CAAC,EAAE,CAAC,CAAC;QACV,KAAK,CAAC,yBAAyB,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC;QAC/C,KAAK,CAAC,0EAA0E,CAAC,CAAC;QAClF,KAAK,CAAC,EAAE,CAAC,CAAC;QACV,KAAK,CAAC,4EAA4E,CAAC,CAAC;QACpF,KAAK,CAAC,EAAE,CAAC,CAAC;QACV,KAAK,CAAC,6BAA6B,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC;QACnD,KAAK,CAAC,EAAE,CAAC,CAAC;QACV,KAAK,CAAC,yBAAyB,MAAM,CAAC,UAAU,GAAG,CAAC,CAAC;QACrD,IAAI,CAAC,sBAAsB,MAAM,CAAC,EAAE,oCAAoC,CAAC,CAAC;IAC5E,CAAC,CAAC,CAAC;IAEL,IAAI;SACD,OAAO,CAAC,MAAM,CAAC;SACf,WAAW,CAAC,8DAA8D,CAAC;SAC3E,MAAM,CAAC,KAAK,IAAI,EAAE;QACjB,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,CAAC,MAAM,SAAS,EAAE,CAAC,CAAC,kBAAkB,CAAC,IAAI,EAAE,CAAC;QACvE,IAAI,aAAa,EAAE,EAAE,CAAC;YACpB,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC;YACxB,OAAO;QACT,CAAC;QACD,KAAK,CAAC,EAAE,CAAC,CAAC;QACV,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACxB,KAAK,CAAC,kCAAkC,CAAC,CAAC;YAC1C,IAAI,CAAC,kCAAkC,CAAC,CAAC;YACzC,OAAO;QACT,CAAC;QACD,KAAK,MAAM,CAAC,IAAI,MAAM,EAAE,CAAC;YACvB,KAAK,CAAC,KAAK,CAAC,CAAC,YAAY,CAAC,MAAM,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC;YACjE,KAAK,CAAC,OAAO,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,QAAQ,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YAC7D,sFAAsF;YACtF,8EAA8E;YAC9E,IAAI,CAAC,CAAC,eAAe;gBAAE,KAAK,CAAC,kBAAkB,CAAC,CAAC,eAAe,OAAO,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC;iBACnF,IAAI,CAAC,CAAC,KAAK,KAAK,QAAQ;gBAAE,KAAK,CAAC,eAAe,CAAC,CAAC,UAAU,EAAE,CAAC,CAAC;YACpE,IAAI,CAAC,CAAC,IAAI;gBAAE,KAAK,CAAC,aAAa,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;QAC3C,CAAC;QACD,KAAK,CAAC,EAAE,CAAC,CAAC;IACZ,CAAC,CAAC,CAAC;IAEL,IAAI;SACD,OAAO,CAAC,aAAa,CAAC;SACtB,WAAW,CAAC,0CAA0C,CAAC;SACvD,MAAM,CAAC,KAAK,EAAE,EAAU,EAAE,EAAE;QAC3B,MAAM,OAAO,GAAG,MAAM,CAAC,MAAM,SAAS,EAAE,CAAC,CAAC,kBAAkB,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QACxE,WAAW,CAAC,EAAE,GAAG,OAAO,EAAE,CAAC,CAAC;QAC5B,IAAI,aAAa,EAAE;YAAE,OAAO;QAC5B,KAAK,CAAC,EAAE,CAAC,CAAC;QACV,KAAK,CAAC,KAAK,EAAE,6BAA6B,CAAC,CAAC;IAC9C,CAAC,CAAC,CAAC;AACP,CAAC"}