@contember/cli 2.2.0-alpha.3 → 2.2.0-alpha.4

package/src/commands/tenant/TenantApplyCommand.ts

@@ -1,8 +1,10 @@
-import { Command, CommandConfiguration, Input } from '@contember/cli-common'
+import { CliError, Command, CommandConfiguration, ExitCode, Input, Output } from '@contember/cli-common'
 import { RemoteProjectResolver } from '../../lib/project/RemoteProjectResolver.js'
-import { TenantClient } from '../../lib/tenant/TenantClient.js'
+import { TenantApiTransport } from '../../lib/tenant/TenantApiTransport.js'
+import { createTenantClients } from '../../lib/tenant/clients/index.js'
 import { TenantConfigLoader } from '../../lib/tenant/TenantConfigLoader.js'
-import { TenantConfigApplier } from '../../lib/tenant/TenantConfigApplier.js'
+import { TenantConfigAction, TenantConfigApplier, TenantConfigWarning } from '../../lib/tenant/TenantConfigApplier.js'
+import { humanText } from './tenantOutput.js'
 
 type Args = {
 	config?: string
@@ -31,27 +33,57 @@ export class TenantApplyCommand extends Command<Args, Options> {
 		configuration.option('dry-run').valueNone().description('Print the actions that would be performed without executing them.')
 	}
 
-	protected async execute(input: Input<Args, Options>): Promise<void | number> {
+	protected async execute(input: Input<Args, Options>, output: Output): Promise<void> {
 		const configPath = input.getArgument('config') ?? DEFAULT_CONFIG_PATH
 		const dsn = input.getOption('dsn')
 		const dryRun = input.getOption('dry-run') === true
 
 		const remoteProject = this.remoteProjectResolver.resolve(dsn)
 		if (!remoteProject) {
-			throw `Project not defined. Please provide a DSN (--dsn) or set CONTEMBER_* environment variables.`
+			throw new CliError('Project not defined. Please provide a DSN (--dsn) or set CONTEMBER_* environment variables.', {
+				code: 'PROJECT_NOT_DEFINED',
+				exitCode: ExitCode.InputError,
+			})
 		}
 
 		const config = await this.tenantConfigLoader.loadConfig(configPath)
-		const client = TenantClient.create(remoteProject.endpoint, remoteProject.token)
+		const clients = createTenantClients(TenantApiTransport.create(remoteProject.endpoint, remoteProject.token))
 
-		console.log(`Applying tenant config from ${configPath}`)
-		console.log(`API URL: ${remoteProject.endpoint}`)
-		console.log('')
+		output.info(`Applying tenant config from ${configPath}`)
+		output.info(`API URL: ${remoteProject.endpoint}`)
 
-		await this.tenantConfigApplier.apply(client, config, { dryRun })
+		const { actions, warnings } = await this.tenantConfigApplier.apply(clients, config, { dryRun })
 
-		console.log('')
-		console.log(dryRun ? 'Dry run complete. No changes were made.' : 'Tenant configuration applied.')
-		return 0
+		const result: TenantConfigApplyResult = { configPath, dryRun, actions, warnings }
+		output.data(result, {
+			human: renderApplyResult,
+			// deliberately actions only: quiet is a scalar stream meant for piping, and the applier
+			// already printed the warnings on stderr wherever they are not suppressed
+			quiet: value => value.actions.map(formatAction),
+		})
+
+		if (actions.length === 0) {
+			output.info('Nothing to apply, the config declares no actions.')
+		} else {
+			output.info(dryRun ? 'Dry run complete. No changes were made.' : 'Tenant configuration applied.')
+		}
+	}
+}
+
+export interface TenantConfigApplyResult {
+	configPath: string
+	dryRun: boolean
+	actions: TenantConfigAction[]
+	/** Reachable in `--json` only; `output.warn` writes nothing outside human mode. */
+	warnings: TenantConfigWarning[]
+}
+
+const formatAction = (action: TenantConfigAction): string =>
+	action.target === null ? humanText(action.action) : `${humanText(action.action)}:${humanText(action.target)}`
+
+const renderApplyResult = (result: TenantConfigApplyResult): string => {
+	if (result.actions.length === 0) {
+		return 'No tenant configuration actions.'
 	}
+	return result.actions.map(formatAction).join('\n')
 }

package/src/commands/tenant/apikey/TenantApiKeyCreateCommand.ts

@@ -0,0 +1,102 @@
+import { CliError, Command, CommandConfiguration, ExitCode, Input, Output } from '@contember/cli-common'
+import { TenantClientProvider } from '../../../lib/TenantClientProvider.js'
+import { TenantApiKeyWithToken } from '../../../lib/tenant/clients/TenantApiKeyClient.js'
+import { readStdinText, StdinReader } from '../../../lib/tenant/stdin.js'
+import { configureMembershipOptions, MembershipOptions, readMembershipInputSource, resolveNonEmptyMemberships } from '../member/membershipInput.js'
+import { assertGeneratedTenantToken, assertTenantCredentialContract, humanText } from '../tenantOutput.js'
+
+type Args = {}
+
+type Options = MembershipOptions & {
+	project?: string
+	global?: true
+	description: string
+	['token-hash']?: string
+	['trust-forwarded-client-info']?: true
+}
+
+/** `tenant api-key create` — a project-scoped key (`--project`) or a global one (`--global`); exactly one is required. */
+export class TenantApiKeyCreateCommand extends Command<Args, Options> {
+	constructor(
+		private readonly tenantClientProvider: TenantClientProvider,
+		private readonly readStdin: StdinReader = readStdinText,
+	) {
+		super()
+	}
+
+	protected configure(configuration: CommandConfiguration<Args, Options>): void {
+		configuration.description('Create a permanent API key, scoped to a project or global. Prints the token — it is shown exactly once.')
+		configuration //
+			.option('project')
+			.valueRequired()
+			.description('Create a key as a member of this project (slug). Mutually exclusive with --global.')
+		configuration //
+			.option('global')
+			.valueNone()
+			.description('Create a key tied to no project, carrying global tenant roles. Mutually exclusive with --project.')
+		configuration //
+			.option('description')
+			.valueRequired()
+			.required()
+			.description('Human-readable label for the key.')
+		configureMembershipOptions(configuration, {
+			roleDescription: 'A role to grant, repeatable. With --project a membership role without variables, with --global a tenant role.',
+		})
+		configuration //
+			.option('token-hash')
+			.valueRequired()
+			.description('Provision the key from a caller-supplied hex-encoded sha256 token hash instead of generating a token.')
+		configuration //
+			.option('trust-forwarded-client-info')
+			.valueNone()
+			.description(
+				'Trust X-Contember-Client-IP and X-Contember-Client-User-Agent on requests made with this key. Enable only behind a trusted proxy that strips client-supplied values and sets the real ones; otherwise clients can spoof audit metadata.',
+			)
+	}
+
+	protected async execute(input: Input<Args, Options>, output: Output): Promise<void> {
+		const project = input.getOption('project')
+		const global = input.getOption('global') === true
+		const description = input.getOption('description')
+		const membershipSource = readMembershipInputSource(input)
+		const tokenHash = input.getOption('token-hash')
+		const trustForwardedClientInfo = input.getOption('trust-forwarded-client-info') === true
+
+		if (project !== undefined && global) {
+			throw new CliError('Options --project and --global are mutually exclusive.', { code: 'CONFLICTING_TARGET', exitCode: ExitCode.InputError })
+		}
+		if (project === undefined && !global) {
+			throw new CliError('Specify either --project <slug> or --global.', { code: 'TARGET_REQUIRED', exitCode: ExitCode.InputError })
+		}
+		if (global && (membershipSource.json !== undefined || membershipSource.fromStdin)) {
+			throw new CliError('--memberships and --memberships-stdin only apply to --project.', {
+				code: 'CONFLICTING_OPTION',
+				exitCode: ExitCode.InputError,
+			})
+		}
+
+		const options = trustForwardedClientInfo ? { trustForwardedClientInfo: true } : undefined
+
+		const apiKey = project !== undefined
+			? await this.tenantClientProvider.apiKey().createApiKey({
+				projectSlug: project,
+				memberships: await resolveNonEmptyMemberships(membershipSource, this.readStdin),
+				description,
+				tokenHash,
+				options,
+			})
+			: await this.tenantClientProvider.apiKey().createGlobalApiKey({ description, roles: membershipSource.roles, tokenHash, options })
+		assertTenantCredentialContract((apiKey.token !== null) === (tokenHash === undefined), 'API key')
+		const generatedToken = apiKey.token === null ? null : assertGeneratedTenantToken(apiKey.token, 'API key')
+
+		if (apiKey.token !== null) {
+			output.warn('This token is shown exactly once and cannot be retrieved again — store it now.')
+		} else {
+			output.info('No token was returned: the key was provisioned from --token-hash, so the server never held the plaintext.')
+		}
+		output.data<TenantApiKeyWithToken>(apiKey, {
+			human: it => `Created API key ${humanText(it.id)}` + (generatedToken !== null ? `\nToken: ${generatedToken}` : ''),
+			quiet: it => generatedToken ?? it.id,
+		})
+	}
+}

package/src/commands/tenant/apikey/TenantApiKeyDisableCommand.ts

@@ -0,0 +1,47 @@
+import { Command, CommandConfiguration, Input, Output } from '@contember/cli-common'
+import { TenantClientProvider } from '../../../lib/TenantClientProvider.js'
+import { requireConfirmation } from '../../../lib/tenant/confirmation.js'
+import { humanText } from '../tenantOutput.js'
+
+type Args = {
+	id: string
+}
+
+type Options = {
+	yes?: true
+}
+
+/** `tenant api-key disable <id>` — destructive: the key's token stops working immediately. */
+export class TenantApiKeyDisableCommand extends Command<Args, Options> {
+	constructor(
+		private readonly tenantClientProvider: TenantClientProvider,
+	) {
+		super()
+	}
+
+	protected configure(configuration: CommandConfiguration<Args, Options>): void {
+		configuration.description('Disable a permanent API key, revoking its token immediately')
+		configuration.argument('id').description('The api key id (ApiKey.id — not the token).')
+		configuration //
+			.option('yes')
+			.valueNone()
+			.description('Do not ask for confirmation.')
+	}
+
+	protected async execute(input: Input<Args, Options>, output: Output): Promise<void> {
+		const id = input.getArgument('id')
+
+		await requireConfirmation({
+			yes: input.getOption('yes') === true,
+			output,
+			warning: `API key ${id} will be disabled and its token will stop working immediately.`,
+		})
+
+		await this.tenantClientProvider.apiKey().disableApiKey(id)
+
+		output.data({ id }, {
+			human: it => `API key ${humanText(it.id)} disabled`,
+			quiet: it => it.id,
+		})
+	}
+}

package/src/commands/tenant/apikey/TenantApiKeyListCommand.ts

@@ -0,0 +1,64 @@
+import { Command, CommandConfiguration, Input, Output } from '@contember/cli-common'
+import { TenantClientProvider } from '../../../lib/TenantClientProvider.js'
+import type { TenantGlobalApiKey, TenantProjectApiKey } from '../../../lib/tenant/clients/TenantApiKeyClient.js'
+import { formatMemberships } from '../member/memberOptions.js'
+import { humanText } from '../tenantOutput.js'
+
+type Args = {}
+type Options = {
+	project?: string
+}
+
+/** `tenant api-key list` — global keys by default, or project-scoped keys selected by `--project`. */
+export class TenantApiKeyListCommand extends Command<Args, Options> {
+	constructor(
+		private readonly tenantClientProvider: TenantClientProvider,
+	) {
+		super()
+	}
+
+	protected configure(configuration: CommandConfiguration<Args, Options>): void {
+		configuration.description('List global permanent API keys, or project-scoped keys with --project')
+		configuration.option('project').valueRequired().description('List permanent API keys scoped to this project slug instead of global keys.')
+	}
+
+	protected async execute(input: Input<Args, Options>, output: Output): Promise<void> {
+		const project = input.getOption('project')
+		if (project === undefined) {
+			const apiKeys = await this.tenantClientProvider.apiKey().listGlobalApiKeys()
+			output.table<TenantGlobalApiKey>(
+				[
+					{ field: 'id', name: 'ID' },
+					{ field: 'identityId', name: 'Identity' },
+					{ field: 'description', name: 'Description' },
+					{ field: 'globalRoles', name: 'Global Roles', format: value => value === null ? '(not visible)' : value.map(humanText).join(', ') || '-' },
+					{ field: 'type', name: 'Type' },
+					{ field: 'enabled', name: 'Enabled' },
+					{ field: 'createdAt', name: 'Created At' },
+					{ field: 'lastUsedAt', name: 'Last Used At', format: value => value === null ? 'never used' : humanText(value) },
+					{ field: 'expiresAt', name: 'Expires At', format: value => value === null ? 'never expires' : humanText(value) },
+				],
+				apiKeys,
+				'id',
+			)
+			return
+		}
+
+		const apiKeys = await this.tenantClientProvider.apiKey().listProjectApiKeys(project)
+		output.table<TenantProjectApiKey>(
+			[
+				{ field: 'id', name: 'ID' },
+				{ field: 'identityId', name: 'Identity' },
+				{ field: 'description', name: 'Description' },
+				{ field: 'memberships', name: 'Memberships', format: formatMemberships },
+				{ field: 'type', name: 'Type' },
+				{ field: 'enabled', name: 'Enabled' },
+				{ field: 'createdAt', name: 'Created At' },
+				{ field: 'lastUsedAt', name: 'Last Used At', format: value => value === null ? 'never used' : humanText(value) },
+				{ field: 'expiresAt', name: 'Expires At', format: value => value === null ? 'never expires' : humanText(value) },
+			],
+			apiKeys,
+			'id',
+		)
+	}
+}

package/src/commands/tenant/apikey/index.ts

@@ -0,0 +1,4 @@
+// Commands of `tenant api-key`. Add one file per command here and re-export it below.
+export * from './TenantApiKeyListCommand.js'
+export * from './TenantApiKeyCreateCommand.js'
+export * from './TenantApiKeyDisableCommand.js'

package/src/commands/tenant/index.ts

@@ -1 +1,6 @@
 export * from './TenantApplyCommand.js'
+export * from './project/index.js'
+export * from './person/index.js'
+export * from './member/index.js'
+export * from './apikey/index.js'
+export * from './policy/index.js'

package/src/commands/tenant/member/TenantMemberAddCommand.ts

@@ -0,0 +1,48 @@
+import { Command, CommandConfiguration, Input, Output } from '@contember/cli-common'
+import { TenantClientProvider } from '../../../lib/TenantClientProvider.js'
+import { formatMemberships, requireOptionValue } from './memberOptions.js'
+import { configureMembershipOptions, MembershipOptions, readMembershipInputSource, resolveNonEmptyMemberships } from './membershipInput.js'
+import { readStdinText, StdinReader } from '../../../lib/tenant/stdin.js'
+import { humanText } from '../tenantOutput.js'
+
+type Args = {}
+
+type Options = MembershipOptions & {
+	project?: string
+	identity?: string
+}
+
+/** `tenant member add` */
+export class TenantMemberAddCommand extends Command<Args, Options> {
+	constructor(
+		private readonly tenantClientProvider: TenantClientProvider,
+		private readonly readStdin: StdinReader = readStdinText,
+	) {
+		super()
+	}
+
+	protected configure(configuration: CommandConfiguration<Args, Options>): void {
+		configuration.description('Add an existing identity to a project')
+		configuration.option('project').valueRequired().required().description('Project slug.')
+		configuration.option('identity').valueRequired().required().description('Identity id of the new member.')
+		configureMembershipOptions(configuration)
+	}
+
+	protected async execute(input: Input<Args, Options>, output: Output): Promise<void> {
+		const projectSlug = requireOptionValue(input.getOption('project'), 'project')
+		const identityId = requireOptionValue(input.getOption('identity'), 'identity')
+		const memberships = await resolveNonEmptyMemberships(readMembershipInputSource(input), this.readStdin)
+
+		// reported before the call so a CI log records the attempt even when the mutation fails
+		output.info(`Adding identity ${identityId} to project ${projectSlug} as ${formatMemberships(memberships)}`)
+		await this.tenantClientProvider.member().addProjectMember(projectSlug, identityId, memberships)
+
+		output.data(
+			{ projectSlug, identityId, memberships },
+			{
+				human: it => `Identity ${humanText(it.identityId)} is now a member of ${humanText(it.projectSlug)}: ${formatMemberships(it.memberships)}`,
+				quiet: it => it.identityId,
+			},
+		)
+	}
+}

package/src/commands/tenant/member/TenantMemberInviteCommand.ts

@@ -0,0 +1,88 @@
+import { CliError, Command, CommandConfiguration, ExitCode, Input, Output } from '@contember/cli-common'
+import type { InviteMethod } from '@contember/graphql-client-tenant'
+import { TenantClientProvider } from '../../../lib/TenantClientProvider.js'
+import { formatMemberships, requireOptionValue } from './memberOptions.js'
+import { configureMembershipOptions, MembershipOptions, readMembershipInputSource, resolveNonEmptyMemberships } from './membershipInput.js'
+import { readStdinText, StdinReader } from '../../../lib/tenant/stdin.js'
+import { humanText, requireNonEmptyTenantName } from '../tenantOutput.js'
+
+type Args = {}
+
+type Options = MembershipOptions & {
+	project?: string
+	email?: string
+	name?: string
+	method?: string
+	['mail-variant']?: string
+}
+
+const inviteMethods: InviteMethod[] = ['CREATE_PASSWORD', 'RESET_PASSWORD']
+
+/**
+ * `tenant member invite`
+ *
+ * The mail-sending half of the invite pair. `tenant member invite-unmanaged` is a separate command rather
+ * than a flag here: the two mutations share no options at all (mail method and variant versus a password
+ * or a reset token hash), and only one of them handles a secret.
+ */
+export class TenantMemberInviteCommand extends Command<Args, Options> {
+	constructor(
+		private readonly tenantClientProvider: TenantClientProvider,
+		private readonly readStdin: StdinReader = readStdinText,
+	) {
+		super()
+	}
+
+	protected configure(configuration: CommandConfiguration<Args, Options>): void {
+		configuration.description('Invite a person to a project by e-mail')
+		configuration.option('project').valueRequired().required().description('Project slug.')
+		configuration.option('email').valueRequired().required().description('E-mail address of the invited person.')
+		configuration.option('name').valueRequired().description('Name of the invited person. Used only when the person does not exist yet.')
+		configuration.option('method').valueRequired().description(
+			`How the person gets their credentials: ${inviteMethods.join(' or ')} (default ${inviteMethods[0]}).`,
+		)
+		configuration.option('mail-variant').valueRequired().description('Mail template variant to use.')
+		configureMembershipOptions(configuration)
+	}
+
+	protected async execute(input: Input<Args, Options>, output: Output): Promise<void> {
+		const projectSlug = requireOptionValue(input.getOption('project'), 'project')
+		const email = requireOptionValue(input.getOption('email'), 'email')
+		const name = requireNonEmptyTenantName(input.getOption('name'), 'Person')
+		const memberships = await resolveNonEmptyMemberships(readMembershipInputSource(input), this.readStdin)
+
+		output.info(`Inviting ${email} to project ${projectSlug} as ${formatMemberships(memberships)}`)
+		const result = await this.tenantClientProvider.member().invite({
+			projectSlug,
+			email,
+			name,
+			memberships,
+			options: { method: parseInviteMethod(input.getOption('method')), mailVariant: input.getOption('mail-variant') },
+		})
+
+		output.data(
+			{ projectSlug, ...result },
+			{
+				human: it =>
+					it.isNew
+						? `Invited ${humanText(it.email ?? email)} to ${humanText(it.projectSlug)}. Identity: ${humanText(it.identityId)}`
+						: `${humanText(it.email ?? email)} already existed and was added to ${humanText(it.projectSlug)}. Identity: ${humanText(it.identityId)}`,
+				quiet: it => it.identityId,
+			},
+		)
+	}
+}
+
+const parseInviteMethod = (value: string | undefined): InviteMethod | undefined => {
+	if (value === undefined) {
+		return undefined
+	}
+	const method = inviteMethods.find(it => it === value.toUpperCase())
+	if (method === undefined) {
+		throw new CliError(`Option --method must be one of ${inviteMethods.join(', ')}, got "${value}".`, {
+			code: 'INVALID_INPUT',
+			exitCode: ExitCode.InputError,
+		})
+	}
+	return method
+}

package/src/commands/tenant/member/TenantMemberInviteUnmanagedCommand.ts

@@ -0,0 +1,135 @@
+import { CliError, Command, CommandConfiguration, ExitCode, Input, Output } from '@contember/cli-common'
+import { TenantClientProvider } from '../../../lib/TenantClientProvider.js'
+import { formatMemberships, requireOptionValue } from './memberOptions.js'
+import { configureMembershipOptions, MembershipOptions, readMembershipInputSource, resolveNonEmptyMemberships } from './membershipInput.js'
+import { readStdinText, StdinReader } from '../../../lib/tenant/stdin.js'
+import { environmentInput, literalInput, resolveRequiredTenantInput, stdinInput, type TenantInputSource } from '../../../lib/tenant/input/index.js'
+import { humanText } from '../tenantOutput.js'
+
+type Args = {}
+
+type Options = MembershipOptions & {
+	project?: string
+	email?: string
+	password?: string
+	['password-env']?: string
+	['password-stdin']?: boolean
+	['reset-token-hash']?: string
+	['reset-token-hash-env']?: string
+	['reset-token-hash-stdin']?: boolean
+}
+
+/**
+ * `tenant member invite-unmanaged`
+ *
+ * The no-mail half of the invite pair — the caller sets the credential itself. Kept apart from
+ * `tenant member invite` because the option sets are disjoint and this one handles a secret.
+ *
+ * The password is never a positional argument. `--password-env` is the safe form: only the variable name
+ * reaches the shell history and the process list.
+ *
+ * `unmanagedInvite` accepts a `name` in the schema but its resolver ignores it, so no `--name` is offered.
+ */
+export class TenantMemberInviteUnmanagedCommand extends Command<Args, Options> {
+	constructor(
+		private readonly tenantClientProvider: TenantClientProvider,
+		private readonly readStdin: StdinReader = readStdinText,
+		private readonly env: NodeJS.ProcessEnv = process.env,
+	) {
+		super()
+	}
+
+	protected configure(configuration: CommandConfiguration<Args, Options>): void {
+		configuration.description('Invite a person to a project without sending any e-mail')
+		configuration.option('project').valueRequired().required().description('Project slug.')
+		configuration.option('email').valueRequired().required().description('E-mail address of the invited person.')
+		configuration.option('password-env').valueRequired().description(
+			'Name of the environment variable holding the initial password. Preferred over --password.',
+		)
+		configuration.option('password').valueRequired().description(
+			'Initial password. Visible in the shell history and in the process list — prefer --password-env.',
+		)
+		configuration.option('password-stdin').valueNone().description('Read the initial password from stdin.')
+		configuration.option('reset-token-hash').valueRequired().description('Hex encoded sha256 of a password reset token to store for the person.')
+		configuration.option('reset-token-hash-env').valueRequired().description('Read the password reset token hash from the named environment variable.')
+		configuration.option('reset-token-hash-stdin').valueNone().description('Read the password reset token hash from stdin.')
+		configureMembershipOptions(configuration)
+	}
+
+	protected async execute(input: Input<Args, Options>, output: Output): Promise<void> {
+		const projectSlug = requireOptionValue(input.getOption('project'), 'project')
+		const email = requireOptionValue(input.getOption('email'), 'email')
+		const passwordFromStdin = input.getOption('password-stdin') === true
+		const resetTokenHashFromStdin = input.getOption('reset-token-hash-stdin') === true
+		if (input.getOption('memberships-stdin') === true && (passwordFromStdin || resetTokenHashFromStdin)) {
+			throw new CliError('Only one value can consume stdin. Combine --memberships-stdin with an environment-backed credential instead.', {
+				code: 'AMBIGUOUS_STDIN_INPUT',
+				exitCode: ExitCode.InputError,
+			})
+		}
+		const memberships = await resolveNonEmptyMemberships(readMembershipInputSource(input), this.readStdin)
+		const credentialSources: TenantInputSource<'password' | 'reset-token-hash'>[] = []
+		const password = input.getOption('password')
+		const passwordEnv = input.getOption('password-env')
+		const resetTokenHash = input.getOption('reset-token-hash')
+		const resetTokenHashEnv = input.getOption('reset-token-hash-env')
+		if (password !== undefined) {
+			credentialSources.push(literalInput('password', '--password', password))
+		}
+		if (passwordEnv !== undefined) {
+			credentialSources.push(environmentInput('password', '--password-env', passwordEnv))
+		}
+		if (passwordFromStdin) {
+			credentialSources.push(stdinInput('password', '--password-stdin'))
+		}
+		if (resetTokenHash !== undefined) {
+			credentialSources.push(literalInput('reset-token-hash', '--reset-token-hash', resetTokenHash))
+		}
+		if (resetTokenHashEnv !== undefined) {
+			credentialSources.push(environmentInput('reset-token-hash', '--reset-token-hash-env', resetTokenHashEnv))
+		}
+		if (resetTokenHashFromStdin) {
+			credentialSources.push(stdinInput('reset-token-hash', '--reset-token-hash-stdin'))
+		}
+		const credential = await resolveRequiredTenantInput(credentialSources, { label: 'unmanaged invite credential' }, {
+			readStdin: this.readStdin,
+			readEnvironment: name => this.env[name],
+		})
+		const credentialValue = credential.kind === 'stdin' ? removeOneTrailingLineEnding(credential.value) : credential.value
+		if (credentialValue === '') {
+			throw new CliError('The selected unmanaged invite credential source resolved to an empty value.', {
+				code: 'EMPTY_INPUT_VALUE',
+				exitCode: ExitCode.InputError,
+			})
+		}
+		if (credential.name === 'reset-token-hash' && !/^[0-9a-f]{64}$/.test(credentialValue)) {
+			throw new CliError('The password reset token hash must be a 64-character hexadecimal SHA-256 hash.', {
+				code: 'INVALID_RESET_TOKEN_HASH',
+				exitCode: ExitCode.InputError,
+			})
+		}
+
+		output.info(`Creating an unmanaged membership for ${email} in project ${projectSlug} as ${formatMemberships(memberships)}`)
+		const result = await this.tenantClientProvider.member().unmanagedInvite({
+			projectSlug,
+			email,
+			memberships,
+			options: credential.name === 'password'
+				? { password: credentialValue }
+				: { resetTokenHash: credentialValue },
+		})
+
+		output.data(
+			{ projectSlug, ...result },
+			{
+				human: it =>
+					it.isNew
+						? `Created ${humanText(it.email ?? email)} in ${humanText(it.projectSlug)}. Identity: ${humanText(it.identityId)}`
+						: `${humanText(it.email ?? email)} already existed and was added to ${humanText(it.projectSlug)}. Identity: ${humanText(it.identityId)}`,
+				quiet: it => it.identityId,
+			},
+		)
+	}
+}
+
+const removeOneTrailingLineEnding = (value: string): string => value.replace(/(?:\r\n|\n)$/, '')