@dashai/cli 0.4.0 → 0.5.0

package/dist/bin.js

@@ -231,6 +231,30 @@ async function destroyDevInstallation(installationId, options = {}) {
     options
   );
 }
+async function createApiKey(installationId, body, options = {}) {
+  return apiRequest(
+    "POST",
+    `/api/installations/${installationId}/api-keys`,
+    body,
+    options
+  );
+}
+async function listApiKeys(installationId, options = {}) {
+  return apiRequest(
+    "GET",
+    `/api/installations/${installationId}/api-keys`,
+    void 0,
+    options
+  );
+}
+async function revokeApiKey(installationId, keyId, options = {}) {
+  return apiRequest(
+    "DELETE",
+    `/api/installations/${installationId}/api-keys/${keyId}`,
+    void 0,
+    options
+  );
+}
 async function createTable(installationId, body, options = {}) {
   return apiRequest(
     "POST",
@@ -2912,7 +2936,7 @@ async function devCommand(options) {
     pipeWithPrefix(child.stderr, process.stderr, prefix);
   }
   let manifestPoll = null;
-  const enablePoll = !options.noRemotePoll && moduleEntry !== void 0 && manifestSlug !== void 0;
+  const enablePoll = !options.noRemotePoll && moduleEntry !== null && manifestSlug !== void 0;
   if (enablePoll) {
     const intervalSec = Math.max(
       MIN_REMOTE_POLL_INTERVAL_SEC,
@@ -5219,6 +5243,371 @@ function surfacePullFailure(err) {
   return 1;
 }
 
+// src/commands/api-keys.ts
+init_api_client();
+init_config();
+init_manifest_io();
+init_output();
+function loadContext(opts) {
+  const manifest = readManifestOrThrow(opts.dir);
+  const slug = manifest.module?.slug;
+  if (!slug) {
+    throw new Error(
+      `module.json has no module.slug \u2014 the manifest is malformed.`
+    );
+  }
+  const cfg = readConfig();
+  if (!cfg) {
+    throw new Error("Not logged in. Run `dashwise login` first.");
+  }
+  const entry = readModuleEntry(slug);
+  if (!entry) {
+    throw new Error(
+      `No dev install cached for module "${slug}". Run \`dashwise init ${slug} --force\` to provision one.`
+    );
+  }
+  return {
+    installationId: entry.installationId,
+    slug,
+    requestOptions: {
+      baseUrl: resolveApiUrl(),
+      auth: { token: cfg.token }
+    }
+  };
+}
+async function apiKeysListCommand(options) {
+  let ctx;
+  try {
+    ctx = loadContext(options);
+  } catch (err) {
+    fail(err.message);
+    return 1;
+  }
+  let keys;
+  try {
+    const resp = await listApiKeys(ctx.installationId, ctx.requestOptions);
+    keys = resp.api_keys;
+  } catch (err) {
+    return surfaceApiKeysError(err);
+  }
+  const filtered = options.all ? keys : keys.filter((k) => k.revoked_at === null);
+  if (options.json) {
+    process.stdout.write(`${JSON.stringify(filtered, null, 2)}
+`);
+    return 0;
+  }
+  if (filtered.length === 0) {
+    info(
+      options.all ? `No API keys (active or revoked) for ${code(ctx.slug)}.` : `No active API keys for ${code(ctx.slug)}. Run ${code("dashwise api-keys create <name>")} to mint one, or ${code("dashwise api-keys list --all")} to include revoked.`
+    );
+    return 0;
+  }
+  info(`API keys for ${code(ctx.slug)} (install id=${ctx.installationId}):`);
+  for (const k of filtered) {
+    const status = formatKeyStatus(k);
+    const lastUsed = k.last_used_at ? `last used ${formatRelative(new Date(k.last_used_at))}` : "never used";
+    process.stdout.write(
+      `  ${code(`#${k.id}`)} ${k.name} ${dim(`dwk_${k.key_prefix}\u2026`)} ${status} ${dim(`(${lastUsed})`)}
+`
+    );
+  }
+  return 0;
+}
+async function apiKeysCreateCommand(nameArg, options) {
+  const name = nameArg ?? options.name;
+  if (!name) {
+    fail("Usage: `dashwise api-keys create <name>` (e.g. `dashwise api-keys create production`)");
+    return 1;
+  }
+  let ctx;
+  try {
+    ctx = loadContext(options);
+  } catch (err) {
+    fail(err.message);
+    return 1;
+  }
+  const body = { name };
+  if (options.scopes !== void 0) {
+    body.scopes = options.scopes.split(",").map((s) => s.trim()).filter(Boolean);
+  }
+  if (options.expiresAt !== void 0) {
+    body.expires_at = options.expiresAt;
+  }
+  let resp;
+  try {
+    resp = await createApiKey(ctx.installationId, body, ctx.requestOptions);
+  } catch (err) {
+    return surfaceApiKeysError(err);
+  }
+  if (options.rawOnly) {
+    process.stderr.write(
+      `Created API key #${resp.api_key.id} (${resp.api_key.name}) for install ${ctx.installationId}.
+`
+    );
+    process.stdout.write(`${resp.raw_key}
+`);
+    return 0;
+  }
+  success(
+    `Created API key ${code(`#${resp.api_key.id}`)} (${resp.api_key.name}) for ${code(ctx.slug)}.`
+  );
+  info("");
+  warn(
+    "This is the ONLY time the full key is displayed. Save it now \u2014 the backend stores a hash, not the plaintext."
+  );
+  info("");
+  process.stdout.write(`  ${code(resp.raw_key)}
+`);
+  info("");
+  info(`Use in a deployed module's env:`);
+  info(`  ${code(`DASHWISE_API_KEY=${resp.raw_key.slice(0, 12)}\u2026`)}`);
+  info(
+    `  ${code(`DASHWISE_INSTALLATION_ID=${ctx.installationId}`)}`
+  );
+  info(
+    `  ${code(`DASHWISE_API_URL=${resolveApiUrl()}`)}`
+  );
+  return 0;
+}
+async function apiKeysRevokeCommand(keyIdArg, options) {
+  if (!keyIdArg) {
+    fail("Usage: `dashwise api-keys revoke <key-id>` \u2014 id from `dashwise api-keys list`");
+    return 1;
+  }
+  const keyId = Number.parseInt(keyIdArg, 10);
+  if (!Number.isFinite(keyId) || keyId <= 0) {
+    fail(`Invalid key id "${keyIdArg}" \u2014 expected a positive integer.`);
+    return 1;
+  }
+  let ctx;
+  try {
+    ctx = loadContext(options);
+  } catch (err) {
+    fail(err.message);
+    return 1;
+  }
+  if (!options.yes) {
+    info(
+      `Revoking API key #${keyId} for ${code(ctx.slug)} (install ${ctx.installationId}). Pass ${code("--yes")} to skip this confirmation in scripts.`
+    );
+  }
+  let resp;
+  try {
+    resp = await revokeApiKey(ctx.installationId, keyId, ctx.requestOptions);
+  } catch (err) {
+    return surfaceApiKeysError(err);
+  }
+  success(
+    `Revoked API key #${resp.api_key.id} (${resp.api_key.name}). Future requests with this key will return 401.`
+  );
+  return 0;
+}
+function surfaceApiKeysError(err) {
+  if (err instanceof ApiError) {
+    switch (err.code) {
+      case "UNAUTHENTICATED":
+        fail(
+          `Auth rejected by backend. Your CLI token may be stale \u2014 run ${code("dashwise login")} then retry.`
+        );
+        return 1;
+      case "NOT_WORKSPACE_MEMBER":
+        fail(
+          `You're not a member of this installation's workspace. API-key management requires workspace membership.`
+        );
+        return 1;
+      case "INSTALLATION_NOT_FOUND":
+        fail(
+          `Installation not found. It may have been destroyed; re-provision via ${code("dashwise init <slug>")}.`
+        );
+        return 1;
+      case "API_KEY_NOT_FOUND":
+        fail(
+          `API key not found for this installation. Use ${code("dashwise api-keys list")} to see valid ids.`
+        );
+        return 1;
+      default:
+        fail(`Backend rejected: ${err.code} ${err.status} \u2014 ${err.message}`);
+        return 1;
+    }
+  }
+  fail(`API-key operation failed: ${err.message}`);
+  return 1;
+}
+function formatKeyStatus(k) {
+  if (k.revoked_at) return dim("[revoked]");
+  if (k.expires_at && new Date(k.expires_at).getTime() <= Date.now()) {
+    return dim("[expired]");
+  }
+  return dim("[active]");
+}
+function formatRelative(d) {
+  const deltaMs = Date.now() - d.getTime();
+  const sec = Math.floor(deltaMs / 1e3);
+  if (sec < 60) return `${sec}s ago`;
+  const min = Math.floor(sec / 60);
+  if (min < 60) return `${min}m ago`;
+  const hr = Math.floor(min / 60);
+  if (hr < 24) return `${hr}h ago`;
+  const day = Math.floor(hr / 24);
+  return `${day}d ago`;
+}
+
+// src/commands/env-export.ts
+init_api_client();
+init_config();
+init_manifest_io();
+init_output();
+var PLACEHOLDER = "<run-`dashwise-api-keys-create-<name>`-and-paste-here>";
+async function envExportCommand(options) {
+  const format = options.format ?? "env";
+  if (!["env", "json", "railway", "vercel", "fly"].includes(format)) {
+    fail(
+      `Unknown --format "${format}". Allowed: env | json | railway | vercel | fly.`
+    );
+    return 1;
+  }
+  if (options.newKey && options.key) {
+    fail(
+      `Pass either --new-key (mint fresh) or --key (paste existing). Not both.`
+    );
+    return 1;
+  }
+  let manifest;
+  try {
+    manifest = readManifestOrThrow(options.dir);
+  } catch (err) {
+    fail(err.message);
+    return 1;
+  }
+  const slug = manifest.module?.slug;
+  if (!slug) {
+    fail("module.json has no module.slug \u2014 the manifest is malformed.");
+    return 1;
+  }
+  const cfg = readConfig();
+  if (!cfg) {
+    fail("Not logged in. Run `dashwise login` first.");
+    return 1;
+  }
+  const entry = readModuleEntry(slug);
+  if (!entry) {
+    fail(
+      `No dev install cached for module "${slug}". Run \`dashwise init ${slug} --force\` to provision one.`
+    );
+    return 1;
+  }
+  const apiUrl = resolveApiUrl();
+  const installationId = entry.installationId;
+  let apiKey;
+  let apiKeyComment = null;
+  if (options.key !== void 0) {
+    if (!options.key.startsWith("dwk_")) {
+      fail(`--key value must start with \`dwk_\` (got "${options.key.slice(0, 8)}\u2026").`);
+      return 1;
+    }
+    apiKey = options.key;
+    apiKeyComment = "# DASHWISE_API_KEY supplied via --key";
+  } else if (options.newKey !== void 0) {
+    try {
+      const resp = await createApiKey(
+        installationId,
+        { name: options.newKey },
+        {
+          baseUrl: apiUrl,
+          auth: { token: cfg.token }
+        }
+      );
+      apiKey = resp.raw_key;
+      apiKeyComment = `# DASHWISE_API_KEY minted by --new-key (id=${resp.api_key.id}, name="${resp.api_key.name}")`;
+      process.stderr.write(
+        `${dim("[env export]")} Minted API key #${resp.api_key.id} (${resp.api_key.name}). The plaintext below is the ONLY time it's shown \u2014 save the file or paste it now.
+`
+      );
+    } catch (err) {
+      if (err instanceof ApiError) {
+        fail(`Failed to mint API key: ${err.code} ${err.status} \u2014 ${err.message}`);
+      } else {
+        fail(`Failed to mint API key: ${err.message}`);
+      }
+      return 1;
+    }
+  } else {
+    apiKey = PLACEHOLDER;
+    apiKeyComment = "# DASHWISE_API_KEY \u2014 run `dashwise api-keys create <name>` to mint one + paste here.";
+  }
+  const entries = [
+    {
+      key: "DASHWISE_API_URL",
+      value: apiUrl,
+      comment: "# DashWise backend URL \u2014 same value the CLI is logged into."
+    },
+    {
+      key: "NEXT_PUBLIC_DASHWISE_API_URL",
+      value: apiUrl,
+      comment: "# Client-side mirror \u2014 Next.js inlines NEXT_PUBLIC_* into the browser bundle so <AuthProvider> hits the right origin."
+    },
+    {
+      key: "DASHWISE_INSTALLATION_ID",
+      value: String(installationId),
+      comment: `# Per-workspace install id for module "${slug}".`
+    },
+    {
+      key: "DASHWISE_API_KEY",
+      value: apiKey,
+      ...apiKeyComment !== null ? { comment: apiKeyComment } : {}
+    }
+  ];
+  process.stdout.write(render(entries, format));
+  if (format !== "json") process.stdout.write("\n");
+  if (apiKey === PLACEHOLDER) {
+    info("");
+    info(
+      `Next: ${code(`dashwise api-keys create <name>`)} \u2192 paste the plaintext into ${code("DASHWISE_API_KEY")}.`
+    );
+  } else if (options.newKey !== void 0) {
+    info("");
+    warn(
+      "API key plaintext is shown ONLY once. Save the output of this command now."
+    );
+  }
+  return 0;
+}
+function render(entries, format) {
+  switch (format) {
+    case "env": {
+      const lines = [];
+      for (const e of entries) {
+        if (e.comment) lines.push(e.comment);
+        lines.push(`${e.key}=${e.value}`);
+        lines.push("");
+      }
+      return lines.join("\n").trimEnd();
+    }
+    case "json": {
+      const obj = {};
+      for (const e of entries) obj[e.key] = e.value;
+      return JSON.stringify(obj, null, 2);
+    }
+    case "railway": {
+      const parts = entries.map((e) => `${e.key}='${e.value.replace(/'/g, "'\\''")}'`);
+      return `railway variables set ${parts.join(" ")}`;
+    }
+    case "vercel": {
+      const lines = entries.map(
+        (e) => `echo ${shellQuote(e.value)} | vercel env add ${e.key} production`
+      );
+      return lines.join("\n");
+    }
+    case "fly": {
+      const parts = entries.map((e) => `${e.key}=${shellQuote(e.value)}`);
+      return `fly secrets set ${parts.join(" ")}`;
+    }
+  }
+}
+function shellQuote(value) {
+  return `'${value.replace(/'/g, "'\\''")}'`;
+}
+
 // src/commands/query.ts
 init_manifest_io();
 init_output();
@@ -6005,6 +6394,72 @@ program.command("pull").description(
     ...cmdOpts.dryRun !== void 0 ? { dryRun: cmdOpts.dryRun } : {}
   });
 });
+var apiKeysCmd = program.command("api-keys").description(
+  "Manage per-installation API keys (`dwk_*`). Pasted into a deployed module's env for production data-plane auth."
+);
+apiKeysCmd.command("list").description(
+  "List API keys for the current module's installation. Active only by default; pass --all for revoked too."
+).option("--dir <path>", "Project root (default: current directory).").option("--all", "Include revoked + expired keys in the output.").option("--json", "Emit JSON instead of the human-friendly table.").action(async (cmdOpts) => {
+  process.exitCode = await apiKeysListCommand({
+    ...cmdOpts.dir !== void 0 ? { dir: cmdOpts.dir } : {},
+    ...cmdOpts.all !== void 0 ? { all: cmdOpts.all } : {},
+    ...cmdOpts.json !== void 0 ? { json: cmdOpts.json } : {}
+  });
+});
+apiKeysCmd.command("create [name]").description(
+  "Mint a new API key. The plaintext key is displayed ONCE \u2014 save it then."
+).option("--dir <path>", "Project root (default: current directory).").option("--name <name>", "Override the positional name arg (e.g. for scripted use).").option(
+  "--scopes <csv>",
+  "Comma-separated scope strings (e.g. `runtime:read,runtime:write`). Default: full install access."
+).option(
+  "--expires-at <iso>",
+  "ISO-8601 expiry timestamp (e.g. 2026-12-31T23:59:59Z). Default: never expires."
+).option(
+  "--raw-only",
+  "Print only the plaintext key on stdout; chatter goes to stderr. Useful for shell capture: `KEY=$(dashwise api-keys create prod --raw-only)`"
+).action(
+  async (nameArg, cmdOpts) => {
+    process.exitCode = await apiKeysCreateCommand(nameArg, {
+      ...cmdOpts.dir !== void 0 ? { dir: cmdOpts.dir } : {},
+      ...cmdOpts.name !== void 0 ? { name: cmdOpts.name } : {},
+      ...cmdOpts.scopes !== void 0 ? { scopes: cmdOpts.scopes } : {},
+      ...cmdOpts.expiresAt !== void 0 ? { expiresAt: cmdOpts.expiresAt } : {},
+      ...cmdOpts.rawOnly !== void 0 ? { rawOnly: cmdOpts.rawOnly } : {}
+    });
+  }
+);
+apiKeysCmd.command("revoke [key-id]").description(
+  "Soft-revoke an API key. Backend keeps the row for audit; further requests return 401."
+).option("--dir <path>", "Project root (default: current directory).").option("-y, --yes", "Skip the per-key confirmation message (for CI / scripts).").action(
+  async (keyIdArg, cmdOpts) => {
+    process.exitCode = await apiKeysRevokeCommand(keyIdArg, {
+      ...cmdOpts.dir !== void 0 ? { dir: cmdOpts.dir } : {},
+      ...cmdOpts.yes !== void 0 ? { yes: cmdOpts.yes } : {}
+    });
+  }
+);
+var envCmd = program.command("env").description("Environment-variable helpers for deploying a module.");
+envCmd.command("export").description(
+  "Emit the env vars a deployed module needs to authenticate against DashWise. By default emits .env-style KEY=value lines; --format = env | json | railway | vercel | fly to wrap in platform-native syntax. Use --new-key <name> to mint + inline an API key in one step."
+).option("--dir <path>", "Project root (default: current directory).").option(
+  "--format <fmt>",
+  "Output format: env | json | railway | vercel | fly (default: env)."
+).option(
+  "--new-key <name>",
+  "Mint a fresh API key with this name and inline the plaintext. (Mutually exclusive with --key.)"
+).option(
+  "--key <dwk_value>",
+  "Use a previously-minted API key (paste plaintext). (Mutually exclusive with --new-key.)"
+).action(
+  async (cmdOpts) => {
+    process.exitCode = await envExportCommand({
+      ...cmdOpts.dir !== void 0 ? { dir: cmdOpts.dir } : {},
+      ...cmdOpts.format !== void 0 ? { format: cmdOpts.format } : {},
+      ...cmdOpts.newKey !== void 0 ? { newKey: cmdOpts.newKey } : {},
+      ...cmdOpts.key !== void 0 ? { key: cmdOpts.key } : {}
+    });
+  }
+);
 moduleCmd.command("publish").description("Pack the current directory + upload it as a new module version.").option("--dir <path>", "Project root (default: current directory).").option("--bump <direction>", "Semver bump: patch | minor | major.").option("--dry-run", "Validate + upload but do not persist the version row.").option("-y, --yes", "Skip the confirmation prompt (for CI / scripted use).").option(
   "--exclude <pattern...>",
   "Extra exclude patterns (segment-matched) appended to the defaults."
@@ -6196,7 +6651,7 @@ fieldCmd.command("set-type <table-slug> <field-slug> <new-type>").description(
   }
 })();
 function getVersion() {
-  return "0.4.0";
+  return "0.5.0";
 }
 function parseIntOption(value) {
   const n = Number.parseInt(value, 10);