@contember/cli 2.1.0-rc.3 → 2.2.0-alpha.10

package/src/commands/misc/index.ts

@@ -1 +1,2 @@
-export * from './VersionCommand'
+export * from './CommandsCommand.js'
+export * from './VersionCommand.js'

package/src/commands/project/ProjectGenerateDocumentationCommand.ts

@@ -1,9 +1,9 @@
-import { Command, CommandConfiguration, Input } from '@contember/cli-common'
-import { renderProjectInfoHtml } from '../../lib/project/docs/projectDescribe'
+import { CliError, Command, CommandConfiguration, ExitCode, Input, Output } from '@contember/cli-common'
+import { renderProjectInfoHtml } from '../../lib/project/docs/projectDescribe.js'
 import { writeFile } from 'node:fs/promises'
 import { join } from 'node:path'
-import { SchemaLoader } from '../../lib/schema/SchemaLoader'
-import { validateSchemaAndPrintErrors } from '../../lib/schema/SchemaValidationHelper'
+import { SchemaLoader } from '../../lib/schema/SchemaLoader.js'
+import { validateSchemaAndPrintErrors } from '../../lib/schema/SchemaValidationHelper.js'
 import { SchemaVersionBuilder } from '@contember/migrations-client'
 
 type Args = {}
@@ -18,6 +18,7 @@ export class ProjectGenerateDocumentationCommand extends Command<Args, Options>
 	constructor(
 		private readonly schemaLoader: SchemaLoader,
 		private readonly schemaVersionBuilder: SchemaVersionBuilder,
+		private readonly renderDocumentation: typeof renderProjectInfoHtml = renderProjectInfoHtml,
 	) {
 		super()
 	}
@@ -29,24 +30,22 @@ export class ProjectGenerateDocumentationCommand extends Command<Args, Options>
 		configuration.option('name').valueRequired().description('project name (for the title)')
 	}
 
-	protected async execute(input: Input<Args, Options>): Promise<number> {
+	protected async execute(input: Input<Args, Options>, output: Output): Promise<void> {
 		const schema = input.getOption('source') === 'migrations'
 			? await this.schemaVersionBuilder.buildSchema()
 			: await this.schemaLoader.loadSchema()
-		if (!validateSchemaAndPrintErrors(schema, 'Defined schema is invalid:')) {
-			return 1
+		if (!validateSchemaAndPrintErrors(schema, 'Defined schema is invalid:', undefined, output)) {
+			throw new CliError('Defined schema is invalid', { code: 'SCHEMA_INVALID', exitCode: ExitCode.InputError })
 		}
 		const name = input.getOption('name') ?? 'Contember project'
 
-		const html = await renderProjectInfoHtml(schema, name)
-		const output = input.getOption('output') ?? `${name.toLowerCase().replace(/\s+/g, '-')}.html`
-		if (output === '-') {
-			console.log(html)
-		} else {
-			console.log(`Documentation saved to ${output}`)
-			await writeFile(join(process.cwd(), output), html)
+		const html = await this.renderDocumentation(schema, name)
+		const destination = input.getOption('output') ?? `${name.toLowerCase().replace(/\s+/g, '-')}.html`
+		if (destination === '-') {
+			output.data(html, { human: value => value, quiet: () => destination })
+			return
 		}
-
-		return 0
+		await writeFile(join(process.cwd(), destination), html)
+		output.data({ path: destination }, { human: it => `Documentation saved to ${it.path}`, quiet: it => it.path })
 	}
 }

package/src/commands/project/ProjectPrintSchemaCommand.ts

@@ -1,4 +1,4 @@
-import { Command, CommandConfiguration, Input } from '@contember/cli-common'
+import { CliError, Command, CommandConfiguration, ExitCode, Input, Output } from '@contember/cli-common'
 import {
 	Authorizator,
 	EntityRulesResolver,
@@ -10,9 +10,9 @@ import {
 import { printSchema } from 'graphql'
 import { mergeSchemas } from '@graphql-tools/schema'
 import { emptySchema, normalizeSchema } from '@contember/schema-utils'
-import { SchemaLoader } from '../../lib/schema/SchemaLoader'
+import { SchemaLoader } from '../../lib/schema/SchemaLoader.js'
 import { SchemaVersionBuilder } from '@contember/migrations-client'
-import { validateSchemaAndPrintErrors } from '../../lib/schema/SchemaValidationHelper'
+import { validateSchemaAndPrintErrors } from '../../lib/schema/SchemaValidationHelper.js'
 
 type Args = {}
 
@@ -47,7 +47,7 @@ export class ProjectPrintSchemaCommand extends Command<Args, Options> {
 		configuration.option('omit-settings').valueNone()
 	}
 
-	protected async execute(input: Input<Args, Options>): Promise<number> {
+	protected async execute(input: Input<Args, Options>, output: Output): Promise<void> {
 		const format = input.getOption('format') || 'graphql'
 
 		const schema = input.getOption('source') === 'migrations'
@@ -62,8 +62,8 @@ export class ProjectPrintSchemaCommand extends Command<Args, Options> {
 			settings: input.getOption('omit-settings') ? emptySchema.settings : schema.settings,
 		}
 
-		if (!validateSchemaAndPrintErrors(filteredSchema, 'Defined schema is invalid:')) {
-			return 1
+		if (!validateSchemaAndPrintErrors(filteredSchema, 'Defined schema is invalid:', undefined, output)) {
+			throw new CliError('Defined schema is invalid', { code: 'SCHEMA_INVALID', exitCode: ExitCode.InputError })
 		}
 
 		const permissionFactory = new PermissionFactory()
@@ -82,19 +82,20 @@ export class ProjectPrintSchemaCommand extends Command<Args, Options> {
 			authorizator,
 		)
 
-		const printByLine = (out: string) => {
-			out.split('\n').forEach(line => {
-				process.stdout.write(line + '\n')
-			})
-		}
 		if (format === 'schema') {
 			if (inputRoles) {
-				throw `--roles option is not supported for "schema" format`
+				throw new CliError('The --role option is not supported for the "schema" format', { code: 'UNSUPPORTED_OPTION', exitCode: ExitCode.InputError })
 			}
-			const jsonString = JSON.stringify(schemaNormalized, null, '\t')
-			printByLine(jsonString)
+			// human mode keeps the tab-indented rendering; --json is a single JSON.stringify of the same value, not a re-encoding of this string
+			output.data(schemaNormalized, {
+				human: value => JSON.stringify(value, null, '\t'),
+				quiet: value => JSON.stringify(value),
+			})
 		} else if (format === 'introspection') {
-			printByLine(JSON.stringify(introspection.create(), null, '\t'))
+			output.data(introspection.create(), {
+				human: value => JSON.stringify(value, null, '\t'),
+				quiet: value => JSON.stringify(value),
+			})
 		} else if (format === 'graphql') {
 			const contentSchema = schemaBuilderFactory.create(schemaNormalized.model, authorizator).build()
 			const introspectionSchemaFactory = new IntrospectionSchemaDefinitionFactory(introspection)
@@ -104,11 +105,12 @@ export class ProjectPrintSchemaCommand extends Command<Args, Options> {
 			})
 			gqlSchema.description = '' // this enforces schema definition print
 			const printedSchema = printSchema(gqlSchema).replace('""""""\n', '') // remove empty comment
-			printByLine(printedSchema)
+			output.data(printedSchema, {
+				human: value => value,
+				quiet: value => value.split('\n'),
+			})
 		} else {
-			throw `Unknown format ${format}`
+			throw new CliError(`Unknown schema format "${format}"`, { code: 'UNKNOWN_FORMAT', exitCode: ExitCode.InputError })
 		}
-
-		return 0
 	}
 }

package/src/commands/project/ProjectValidateCommand.ts

@@ -1,15 +1,21 @@
-import { Command, CommandConfiguration } from '@contember/cli-common'
-import { emptySchema } from '@contember/schema-utils'
-import { SchemaLoader } from '../../lib/schema/SchemaLoader'
-import { validateSchemaAndPrintErrors } from '../../lib/schema/SchemaValidationHelper'
-import { MigrationsValidator } from '../../lib/migrations/MigrationsValidator'
+import { CliError, Command, CommandConfiguration, ExitCode, Input, Output } from '@contember/cli-common'
+import { emptySchema, SchemaValidator } from '@contember/schema-utils'
+import { MigrationsValidator } from '../../lib/migrations/MigrationsValidator.js'
 import { MigrationsResolver, SchemaVersionBuilder } from '@contember/migrations-client'
 import { SchemaDiffer } from '@contember/schema-migrations'
+import { SchemaLoader } from '../../lib/schema/SchemaLoader.js'
 
 type Args = {}
 
 type Options = {}
 
+type ValidationIssue = {
+	source: 'schema' | 'built-schema' | 'migrations' | 'diff'
+	path: string
+	code: string
+	message: string
+}
+
 export class ProjectValidateCommand extends Command<Args, Options> {
 	constructor(
 		private readonly schemaLoader: SchemaLoader,
@@ -25,33 +31,61 @@ export class ProjectValidateCommand extends Command<Args, Options> {
 		configuration.description('Validates project schema')
 	}
 
-	protected async execute(): Promise<number> {
-		let projectValid = true
+	protected async execute(input: Input<Args, Options>, output: Output): Promise<void> {
+		const issues: ValidationIssue[] = []
 
+		// prints its own itemized diagnostics per offending migration; here we only need the pass/fail
 		const migrations = await this.migrationsResolver.getSchemaMigrations()
-		projectValid = this.migrationValidator.validate(emptySchema, migrations)
-			&& projectValid
+		if (!this.migrationValidator.validate(emptySchema, migrations)) {
+			issues.push({
+				source: 'migrations',
+				path: '',
+				code: 'MIGRATIONS_INVALID_SCHEMA',
+				message: 'One or more migrations produce an invalid schema; see the diagnostics above for details',
+			})
+		}
 
 		const schema = await this.schemaLoader.loadSchema()
-		projectValid = validateSchemaAndPrintErrors(schema, 'Defined schema is invalid:')
-			&& projectValid
+		for (const err of SchemaValidator.validate(schema)) {
+			issues.push({ source: 'schema', path: err.path.join('.'), code: err.code, message: err.message })
+		}
 
 		const builtSchema = await this.schemaVersionBuilder.buildSchema()
-		projectValid = validateSchemaAndPrintErrors(builtSchema, 'Schema built from migrations is invalid:')
-			&& projectValid
+		for (const err of SchemaValidator.validate(builtSchema)) {
+			issues.push({ source: 'built-schema', path: err.path.join('.'), code: err.code, message: err.message })
+		}
 
-		if (projectValid) {
+		// comparing an already-invalid schema against migrations is meaningless — only diff once both sides are valid
+		if (issues.length === 0) {
 			const diff = await this.schemaDiffer.diffSchemas(builtSchema, schema)
 			if (diff.length > 0) {
-				console.log('Migrations are not in sync with a defined schema')
-				projectValid = false
+				issues.push({
+					source: 'diff',
+					path: '',
+					code: 'SCHEMA_MIGRATIONS_DIFF',
+					message: 'Migrations are not in sync with the defined schema',
+				})
 			}
 		}
 
-		if (projectValid) {
-			console.log('Project schema is valid')
+		const columns: { field: keyof ValidationIssue & string; name: string }[] = [
+			{ field: 'source', name: 'Source' },
+			{ field: 'path', name: 'Path' },
+			{ field: 'code', name: 'Code' },
+			{ field: 'message', name: 'Message' },
+		]
+		if (issues.length > 0) {
+			if (!output.isJson && !output.isQuiet) {
+				output.table(columns, issues, 'message')
+			}
+			throw new CliError(`Project schema is invalid: found ${issues.length} issue(s)`, {
+				code: 'SCHEMA_INVALID',
+				exitCode: ExitCode.InputError,
+				details: issues,
+			})
 		}
 
-		return projectValid ? 0 : 1
+		output.table(columns, issues, 'message')
+		output.info('Project schema is valid')
 	}
 }

package/src/commands/project/index.ts

@@ -1,3 +1,3 @@
-export * from './ProjectGenerateDocumentationCommand'
-export * from './ProjectPrintSchemaCommand'
-export * from './ProjectValidateCommand'
+export * from './ProjectGenerateDocumentationCommand.js'
+export * from './ProjectPrintSchemaCommand.js'
+export * from './ProjectValidateCommand.js'

package/src/commands/tenant/TenantApplyCommand.ts

@@ -0,0 +1,89 @@
+import { CliError, Command, CommandConfiguration, ExitCode, Input, Output } from '@contember/cli-common'
+import { RemoteProjectResolver } from '../../lib/project/RemoteProjectResolver.js'
+import { TenantApiTransport } from '../../lib/tenant/TenantApiTransport.js'
+import { createTenantClients } from '../../lib/tenant/clients/index.js'
+import { TenantConfigLoader } from '../../lib/tenant/TenantConfigLoader.js'
+import { TenantConfigAction, TenantConfigApplier, TenantConfigWarning } from '../../lib/tenant/TenantConfigApplier.js'
+import { humanText } from './tenantOutput.js'
+
+type Args = {
+	config?: string
+}
+
+type Options = {
+	dsn?: string
+	['dry-run']?: boolean
+}
+
+const DEFAULT_CONFIG_PATH = 'tenant.config.ts'
+
+export class TenantApplyCommand extends Command<Args, Options> {
+	constructor(
+		private readonly remoteProjectResolver: RemoteProjectResolver,
+		private readonly tenantConfigLoader: TenantConfigLoader,
+		private readonly tenantConfigApplier: TenantConfigApplier,
+	) {
+		super()
+	}
+
+	protected configure(configuration: CommandConfiguration<Args, Options>): void {
+		configuration.description('Apply declarative tenant configuration (global config, identity providers, mail templates, custom roles)')
+		configuration.argument('config').optional().description(`Path to the tenant config file (default: ${DEFAULT_CONFIG_PATH})`)
+		configuration.option('dsn').valueRequired().description('Project DSN. Falls back to CONTEMBER_* environment variables.')
+		configuration.option('dry-run').valueNone().description('Print the actions that would be performed without executing them.')
+	}
+
+	protected async execute(input: Input<Args, Options>, output: Output): Promise<void> {
+		const configPath = input.getArgument('config') ?? DEFAULT_CONFIG_PATH
+		const dsn = input.getOption('dsn')
+		const dryRun = input.getOption('dry-run') === true
+
+		const remoteProject = this.remoteProjectResolver.resolve(dsn)
+		if (!remoteProject) {
+			throw new CliError('Project not defined. Please provide a DSN (--dsn) or set CONTEMBER_* environment variables.', {
+				code: 'PROJECT_NOT_DEFINED',
+				exitCode: ExitCode.InputError,
+			})
+		}
+
+		const config = await this.tenantConfigLoader.loadConfig(configPath)
+		const clients = createTenantClients(TenantApiTransport.create(remoteProject.endpoint, remoteProject.token))
+
+		output.info(`Applying tenant config from ${configPath}`)
+		output.info(`API URL: ${remoteProject.endpoint}`)
+
+		const { actions, warnings } = await this.tenantConfigApplier.apply(clients, config, { dryRun })
+
+		const result: TenantConfigApplyResult = { configPath, dryRun, actions, warnings }
+		output.data(result, {
+			human: renderApplyResult,
+			// deliberately actions only: quiet is a scalar stream meant for piping, and the applier
+			// already printed the warnings on stderr wherever they are not suppressed
+			quiet: value => value.actions.map(formatAction),
+		})
+
+		if (actions.length === 0) {
+			output.info('Nothing to apply, the config declares no actions.')
+		} else {
+			output.info(dryRun ? 'Dry run complete. No changes were made.' : 'Tenant configuration applied.')
+		}
+	}
+}
+
+export interface TenantConfigApplyResult {
+	configPath: string
+	dryRun: boolean
+	actions: TenantConfigAction[]
+	/** Reachable in `--json` only; `output.warn` writes nothing outside human mode. */
+	warnings: TenantConfigWarning[]
+}
+
+const formatAction = (action: TenantConfigAction): string =>
+	action.target === null ? humanText(action.action) : `${humanText(action.action)}:${humanText(action.target)}`
+
+const renderApplyResult = (result: TenantConfigApplyResult): string => {
+	if (result.actions.length === 0) {
+		return 'No tenant configuration actions.'
+	}
+	return result.actions.map(formatAction).join('\n')
+}

package/src/commands/tenant/apikey/TenantApiKeyCreateCommand.ts

@@ -0,0 +1,102 @@
+import { CliError, Command, CommandConfiguration, ExitCode, Input, Output } from '@contember/cli-common'
+import { TenantClientProvider } from '../../../lib/TenantClientProvider.js'
+import { TenantApiKeyWithToken } from '../../../lib/tenant/clients/TenantApiKeyClient.js'
+import { readStdinText, StdinReader } from '../../../lib/tenant/stdin.js'
+import { configureMembershipOptions, MembershipOptions, readMembershipInputSource, resolveNonEmptyMemberships } from '../member/membershipInput.js'
+import { assertGeneratedTenantToken, assertTenantCredentialContract, humanText } from '../tenantOutput.js'
+
+type Args = {}
+
+type Options = MembershipOptions & {
+	project?: string
+	global?: true
+	description: string
+	['token-hash']?: string
+	['trust-forwarded-client-info']?: true
+}
+
+/** `tenant api-key create` — a project-scoped key (`--project`) or a global one (`--global`); exactly one is required. */
+export class TenantApiKeyCreateCommand extends Command<Args, Options> {
+	constructor(
+		private readonly tenantClientProvider: TenantClientProvider,
+		private readonly readStdin: StdinReader = readStdinText,
+	) {
+		super()
+	}
+
+	protected configure(configuration: CommandConfiguration<Args, Options>): void {
+		configuration.description('Create a permanent API key, scoped to a project or global. Prints the token — it is shown exactly once.')
+		configuration //
+			.option('project')
+			.valueRequired()
+			.description('Create a key as a member of this project (slug). Mutually exclusive with --global.')
+		configuration //
+			.option('global')
+			.valueNone()
+			.description('Create a key tied to no project, carrying global tenant roles. Mutually exclusive with --project.')
+		configuration //
+			.option('description')
+			.valueRequired()
+			.required()
+			.description('Human-readable label for the key.')
+		configureMembershipOptions(configuration, {
+			roleDescription: 'A role to grant, repeatable. With --project a membership role without variables, with --global a tenant role.',
+		})
+		configuration //
+			.option('token-hash')
+			.valueRequired()
+			.description('Provision the key from a caller-supplied hex-encoded sha256 token hash instead of generating a token.')
+		configuration //
+			.option('trust-forwarded-client-info')
+			.valueNone()
+			.description(
+				'Trust X-Contember-Client-IP and X-Contember-Client-User-Agent on requests made with this key. Enable only behind a trusted proxy that strips client-supplied values and sets the real ones; otherwise clients can spoof audit metadata.',
+			)
+	}
+
+	protected async execute(input: Input<Args, Options>, output: Output): Promise<void> {
+		const project = input.getOption('project')
+		const global = input.getOption('global') === true
+		const description = input.getOption('description')
+		const membershipSource = readMembershipInputSource(input)
+		const tokenHash = input.getOption('token-hash')
+		const trustForwardedClientInfo = input.getOption('trust-forwarded-client-info') === true
+
+		if (project !== undefined && global) {
+			throw new CliError('Options --project and --global are mutually exclusive.', { code: 'CONFLICTING_TARGET', exitCode: ExitCode.InputError })
+		}
+		if (project === undefined && !global) {
+			throw new CliError('Specify either --project <slug> or --global.', { code: 'TARGET_REQUIRED', exitCode: ExitCode.InputError })
+		}
+		if (global && (membershipSource.json !== undefined || membershipSource.fromStdin)) {
+			throw new CliError('--memberships and --memberships-stdin only apply to --project.', {
+				code: 'CONFLICTING_OPTION',
+				exitCode: ExitCode.InputError,
+			})
+		}
+
+		const options = trustForwardedClientInfo ? { trustForwardedClientInfo: true } : undefined
+
+		const apiKey = project !== undefined
+			? await this.tenantClientProvider.apiKey().createApiKey({
+				projectSlug: project,
+				memberships: await resolveNonEmptyMemberships(membershipSource, this.readStdin),
+				description,
+				tokenHash,
+				options,
+			})
+			: await this.tenantClientProvider.apiKey().createGlobalApiKey({ description, roles: membershipSource.roles, tokenHash, options })
+		assertTenantCredentialContract((apiKey.token !== null) === (tokenHash === undefined), 'API key')
+		const generatedToken = apiKey.token === null ? null : assertGeneratedTenantToken(apiKey.token, 'API key')
+
+		if (apiKey.token !== null) {
+			output.warn('This token is shown exactly once and cannot be retrieved again — store it now.')
+		} else {
+			output.info('No token was returned: the key was provisioned from --token-hash, so the server never held the plaintext.')
+		}
+		output.data<TenantApiKeyWithToken>(apiKey, {
+			human: it => `Created API key ${humanText(it.id)}` + (generatedToken !== null ? `\nToken: ${generatedToken}` : ''),
+			quiet: it => generatedToken ?? it.id,
+		})
+	}
+}

package/src/commands/tenant/apikey/TenantApiKeyDisableCommand.ts

@@ -0,0 +1,47 @@
+import { Command, CommandConfiguration, Input, Output } from '@contember/cli-common'
+import { TenantClientProvider } from '../../../lib/TenantClientProvider.js'
+import { requireConfirmation } from '../../../lib/tenant/confirmation.js'
+import { humanText } from '../tenantOutput.js'
+
+type Args = {
+	id: string
+}
+
+type Options = {
+	yes?: true
+}
+
+/** `tenant api-key disable <id>` — destructive: the key's token stops working immediately. */
+export class TenantApiKeyDisableCommand extends Command<Args, Options> {
+	constructor(
+		private readonly tenantClientProvider: TenantClientProvider,
+	) {
+		super()
+	}
+
+	protected configure(configuration: CommandConfiguration<Args, Options>): void {
+		configuration.description('Disable a permanent API key, revoking its token immediately')
+		configuration.argument('id').description('The api key id (ApiKey.id — not the token).')
+		configuration //
+			.option('yes')
+			.valueNone()
+			.description('Do not ask for confirmation.')
+	}
+
+	protected async execute(input: Input<Args, Options>, output: Output): Promise<void> {
+		const id = input.getArgument('id')
+
+		await requireConfirmation({
+			yes: input.getOption('yes') === true,
+			output,
+			warning: `API key ${id} will be disabled and its token will stop working immediately.`,
+		})
+
+		await this.tenantClientProvider.apiKey().disableApiKey(id)
+
+		output.data({ id }, {
+			human: it => `API key ${humanText(it.id)} disabled`,
+			quiet: it => it.id,
+		})
+	}
+}

package/src/commands/tenant/apikey/TenantApiKeyListCommand.ts

@@ -0,0 +1,64 @@
+import { Command, CommandConfiguration, Input, Output } from '@contember/cli-common'
+import { TenantClientProvider } from '../../../lib/TenantClientProvider.js'
+import type { TenantGlobalApiKey, TenantProjectApiKey } from '../../../lib/tenant/clients/TenantApiKeyClient.js'
+import { formatMemberships } from '../member/memberOptions.js'
+import { humanText } from '../tenantOutput.js'
+
+type Args = {}
+type Options = {
+	project?: string
+}
+
+/** `tenant api-key list` — global keys by default, or project-scoped keys selected by `--project`. */
+export class TenantApiKeyListCommand extends Command<Args, Options> {
+	constructor(
+		private readonly tenantClientProvider: TenantClientProvider,
+	) {
+		super()
+	}
+
+	protected configure(configuration: CommandConfiguration<Args, Options>): void {
+		configuration.description('List global permanent API keys, or project-scoped keys with --project')
+		configuration.option('project').valueRequired().description('List permanent API keys scoped to this project slug instead of global keys.')
+	}
+
+	protected async execute(input: Input<Args, Options>, output: Output): Promise<void> {
+		const project = input.getOption('project')
+		if (project === undefined) {
+			const apiKeys = await this.tenantClientProvider.apiKey().listGlobalApiKeys()
+			output.table<TenantGlobalApiKey>(
+				[
+					{ field: 'id', name: 'ID' },
+					{ field: 'identityId', name: 'Identity' },
+					{ field: 'description', name: 'Description' },
+					{ field: 'globalRoles', name: 'Global Roles', format: value => value === null ? '(not visible)' : value.map(humanText).join(', ') || '-' },
+					{ field: 'type', name: 'Type' },
+					{ field: 'enabled', name: 'Enabled' },
+					{ field: 'createdAt', name: 'Created At' },
+					{ field: 'lastUsedAt', name: 'Last Used At', format: value => value === null ? 'never used' : humanText(value) },
+					{ field: 'expiresAt', name: 'Expires At', format: value => value === null ? 'never expires' : humanText(value) },
+				],
+				apiKeys,
+				'id',
+			)
+			return
+		}
+
+		const apiKeys = await this.tenantClientProvider.apiKey().listProjectApiKeys(project)
+		output.table<TenantProjectApiKey>(
+			[
+				{ field: 'id', name: 'ID' },
+				{ field: 'identityId', name: 'Identity' },
+				{ field: 'description', name: 'Description' },
+				{ field: 'memberships', name: 'Memberships', format: formatMemberships },
+				{ field: 'type', name: 'Type' },
+				{ field: 'enabled', name: 'Enabled' },
+				{ field: 'createdAt', name: 'Created At' },
+				{ field: 'lastUsedAt', name: 'Last Used At', format: value => value === null ? 'never used' : humanText(value) },
+				{ field: 'expiresAt', name: 'Expires At', format: value => value === null ? 'never expires' : humanText(value) },
+			],
+			apiKeys,
+			'id',
+		)
+	}
+}

package/src/commands/tenant/apikey/index.ts

@@ -0,0 +1,4 @@
+// Commands of `tenant api-key`. Add one file per command here and re-export it below.
+export * from './TenantApiKeyListCommand.js'
+export * from './TenantApiKeyCreateCommand.js'
+export * from './TenantApiKeyDisableCommand.js'

package/src/commands/tenant/index.ts

@@ -0,0 +1,6 @@
+export * from './TenantApplyCommand.js'
+export * from './project/index.js'
+export * from './person/index.js'
+export * from './member/index.js'
+export * from './apikey/index.js'
+export * from './policy/index.js'

package/src/commands/tenant/member/TenantMemberAddCommand.ts

@@ -0,0 +1,48 @@
+import { Command, CommandConfiguration, Input, Output } from '@contember/cli-common'
+import { TenantClientProvider } from '../../../lib/TenantClientProvider.js'
+import { formatMemberships, requireOptionValue } from './memberOptions.js'
+import { configureMembershipOptions, MembershipOptions, readMembershipInputSource, resolveNonEmptyMemberships } from './membershipInput.js'
+import { readStdinText, StdinReader } from '../../../lib/tenant/stdin.js'
+import { humanText } from '../tenantOutput.js'
+
+type Args = {}
+
+type Options = MembershipOptions & {
+	project?: string
+	identity?: string
+}
+
+/** `tenant member add` */
+export class TenantMemberAddCommand extends Command<Args, Options> {
+	constructor(
+		private readonly tenantClientProvider: TenantClientProvider,
+		private readonly readStdin: StdinReader = readStdinText,
+	) {
+		super()
+	}
+
+	protected configure(configuration: CommandConfiguration<Args, Options>): void {
+		configuration.description('Add an existing identity to a project')
+		configuration.option('project').valueRequired().required().description('Project slug.')
+		configuration.option('identity').valueRequired().required().description('Identity id of the new member.')
+		configureMembershipOptions(configuration)
+	}
+
+	protected async execute(input: Input<Args, Options>, output: Output): Promise<void> {
+		const projectSlug = requireOptionValue(input.getOption('project'), 'project')
+		const identityId = requireOptionValue(input.getOption('identity'), 'identity')
+		const memberships = await resolveNonEmptyMemberships(readMembershipInputSource(input), this.readStdin)
+
+		// reported before the call so a CI log records the attempt even when the mutation fails
+		output.info(`Adding identity ${identityId} to project ${projectSlug} as ${formatMemberships(memberships)}`)
+		await this.tenantClientProvider.member().addProjectMember(projectSlug, identityId, memberships)
+
+		output.data(
+			{ projectSlug, identityId, memberships },
+			{
+				human: it => `Identity ${humanText(it.identityId)} is now a member of ${humanText(it.projectSlug)}: ${formatMemberships(it.memberships)}`,
+				quiet: it => it.identityId,
+			},
+		)
+	}
+}