@epilot/cli 0.1.93 → 0.1.95

package/README.md

@@ -29,7 +29,7 @@ npm install -g @epilot/cli
 
 <!-- usage-help -->
 ```
-epilot v0.1.93 — CLI for epilot APIs
+epilot v0.1.95 — CLI for epilot APIs
 
 USAGE
   epilot <api> <operationId> [params...] [flags]

package/definitions/file.json

@@ -557,7 +557,7 @@
       "get": {
         "operationId": "downloadFile",
         "summary": "downloadFile",
-        "description": "Generate a pre-signed download URL for a file.\n\nThe returned URL is valid for a limited time (typically 15 minutes) and can be used to download the file directly.\n",
+        "description": "Generate a pre-signed download URL for a file.\n\nThe returned URL is valid for a limited time (typically 15 minutes) and can be used to download the file directly.\n\n**Download attribution (`x-track-*`):** any query parameter whose name starts with\n`x-track-` is treated as opaque tracking metadata and signed into the returned URL, so it\nshows up in the S3 access logs / CloudTrail data events when the link is actually opened.\nThis is a generic, service-agnostic channel — e.g. the customer portal sends\n`x-track-portal-id` and `x-track-contact-id`. Only the `x-track-` namespace is forwarded;\nthe values cannot affect how S3 resolves or serves the object. Parameter names must match\n`^x-track-[a-z0-9](?:[a-z0-9_-]{0,38}[a-z0-9])?$`, values are capped at 256 characters, and\nat most 10 such parameters are honoured (see the `x-track` parameter below).\n",
         "tags": [
           "File"
         ],
@@ -588,6 +588,20 @@
               "type": "boolean",
               "default": true
             }
+          },
+          {
+            "name": "x-track",
+            "in": "query",
+            "required": false,
+            "style": "form",
+            "explode": true,
+            "description": "Download-attribution channel. Provide any number of query parameters whose names\nstart with `x-track-` (e.g. `x-track-portal-id`, `x-track-contact-id`); each is signed\ninto the pre-signed URL verbatim so the download is recorded in the S3 access logs /\nCloudTrail data events. Only the `x-track-` namespace is forwarded — values cannot\naffect how S3 resolves or serves the object. Parameter names must match\n`^x-track-[a-z0-9](?:[a-z0-9_-]{0,38}[a-z0-9])?$`, values are capped at 256 characters,\nand at most 10 such parameters are honoured.\n",
+            "schema": {
+              "type": "object",
+              "additionalProperties": {
+                "type": "string"
+              }
+            }
           }
         ],
         "responses": {
@@ -1243,6 +1257,9 @@
           "401": {
             "$ref": "#/components/responses/UnauthorizedError"
           },
+          "403": {
+            "$ref": "#/components/responses/ForbiddenError"
+          },
           "404": {
             "$ref": "#/components/responses/NotFoundError"
           },

package/definitions/user.json

@@ -2443,6 +2443,10 @@
           "passkey_enabled": {
             "type": "boolean",
             "description": "Whether passkey login is enabled for this organization"
+          },
+          "passkeys_registered": {
+            "type": "boolean",
+            "description": "Whether the user has at least one passkey registered. Lets the login\nUI offer passkey authentication as an alternative to an MFA code.\nDiscloses nothing that :beginPasskeyAuthentication doesn't already\nreveal for a known email address.\n"
           }
         }
       },

package/dist/{auth-4HG7B2GC.js → auth-WMXFMPWE.js}

@@ -21,7 +21,7 @@ var auth_default = defineCommand({
     description: "Manage authentication"
   },
   subCommands: {
-    login: () => import("./auth-login-7EWYCAZ7.js").then((m) => m.default),
+    login: () => import("./auth-login-3AY5U4JU.js").then((m) => m.default),
     token: () => import("./auth-token-APXLIQAO.js").then((m) => m.default),
     logout: defineCommand({
       meta: { name: "logout", description: "Remove stored credentials" },
@@ -61,6 +61,7 @@ var auth_default = defineCommand({
         const tokenUse = claims?.token_use;
         const roles = claims?.assume_roles;
         const readOnly = claims?.read_only === true;
+        const anonymize = claims?.anonymize === true;
         if (name) process.stdout.write(`  Name:    ${name}
 `);
         if (adminEmail && adminEmail !== name) process.stdout.write(`  Email:   ${adminEmail}
@@ -76,6 +77,8 @@ var auth_default = defineCommand({
         if (roles?.length) process.stdout.write(`  Roles:   ${roles.join(", ")}
 `);
         process.stdout.write(`  Access:  ${readOnly ? `${YELLOW}read-only${RESET}` : `${GREEN}read-write${RESET}`}
+`);
+        if (anonymize) process.stdout.write(`  Data:    ${YELLOW}anonymized${RESET}
 `);
         if (creds.expires_at) {
           const expiry = new Date(creds.expires_at);

package/dist/{auth-login-7EWYCAZ7.js → auth-login-3AY5U4JU.js}

@@ -40,6 +40,10 @@ var auth_login_default = defineCommand({
     token: { type: "string", description: "Manually provide a token instead of browser login" },
     profile: { type: "string", description: "Save credentials to this profile" },
     readonly: { type: "boolean", description: "Generate a read-only token (cannot perform write actions)" },
+    anonymize: {
+      type: "boolean",
+      description: "Generate an anonymized token (personal data is masked in all API responses)"
+    },
     "use-dev": { type: "boolean", description: "Use dev environment (portal.dev.epilot.cloud)" },
     "use-staging": { type: "boolean", description: "Use staging environment (portal.staging.epilot.cloud)" }
   },
@@ -47,6 +51,7 @@ var auth_login_default = defineCommand({
     const profileName = args.profile || process.env.EPILOT_PROFILE;
     const env = resolveEnvironment(args["use-dev"], args["use-staging"]);
     const readonly = Boolean(args.readonly);
+    const anonymize = Boolean(args.anonymize);
     if (args.token) {
       saveCredentials({ token: args.token }, profileName);
       const suffix = profileName ? ` to profile "${profileName}"` : "";
@@ -63,7 +68,7 @@ var auth_login_default = defineCommand({
       );
       process.exit(1);
     }
-    const token = await browserLogin(profileName, env, readonly);
+    const token = await browserLogin(profileName, env, readonly, anonymize);
     if (token) {
       process.stdout.write(`${GREEN}${BOLD}Login successful!${RESET}
 `);
@@ -74,7 +79,7 @@ var auth_login_default = defineCommand({
     }
   }
 });
-var browserLogin = async (profileName, env = "production", readonly = false) => {
+var browserLogin = async (profileName, env = "production", readonly = false, anonymize = false) => {
   const state = randomBytes(32).toString("hex");
   const verificationCode = randomBytes(3).toString("hex").toUpperCase();
   const suffix = profileName ? ` ${DIM}(profile: ${profileName})${RESET}` : "";
@@ -86,6 +91,12 @@ ${BOLD}epilot CLI Login${RESET}${suffix}
   if (readonly) {
     process.stdout.write(
       `${YELLOW}Read-only mode: the CLI session will not be able to perform write actions.${RESET}
+`
+    );
+  }
+  if (anonymize) {
+    process.stdout.write(
+      `${YELLOW}Anonymize mode: personal data will be masked in all API responses for this CLI session.${RESET}
 `
     );
   }
@@ -125,7 +136,7 @@ ${BOLD}epilot CLI Login${RESET}${suffix}
       const port = address.port;
       const callbackUrl = `http://localhost:${port}/callback`;
       const portalUrl = getPortalUrl(env);
-      const loginUrl = `${portalUrl}/login?cli_callback=${encodeURIComponent(callbackUrl)}&state=${state}&code=${verificationCode}` + (readonly ? `&readonly=true` : "");
+      const loginUrl = `${portalUrl}/login?cli_callback=${encodeURIComponent(callbackUrl)}&state=${state}&code=${verificationCode}` + (readonly ? `&readonly=true` : "") + (anonymize ? `&anonymize=true` : "");
       process.stdout.write(`
 ${DIM}Login URL: ${loginUrl}${RESET}
 

package/dist/bin/epilot.js

@@ -11,7 +11,7 @@ import { defineCommand } from "citty";
 var main = defineCommand({
   meta: {
     name: "epilot",
-    version: "0.1.93",
+    version: "0.1.95",
     description: "CLI for epilot APIs"
   },
   args: {
@@ -27,11 +27,11 @@ var main = defineCommand({
     jsonata: { type: "string", description: "JSONata expression" }
   },
   subCommands: {
-    auth: () => import("../auth-4HG7B2GC.js").then((m) => m.default),
+    auth: () => import("../auth-WMXFMPWE.js").then((m) => m.default),
     profile: () => import("../profile-OZJL5ZPT.js").then((m) => m.default),
     config: () => import("../config-DGZIMLZK.js").then((m) => m.default),
     completion: () => import("../completion-IGVIBAFM.js").then((m) => m.default),
-    upgrade: () => import("../upgrade-EMXIHRN3.js").then((m) => m.default),
+    upgrade: () => import("../upgrade-W43OKEIV.js").then((m) => m.default),
     "access-token": () => import("../access-token-WWE6BDJH.js").then((m) => m.default),
     address: () => import("../address-EH3C4CVB.js").then((m) => m.default),
     "address-suggestions": () => import("../address-suggestions-RRSLOBFW.js").then((m) => m.default),
@@ -134,7 +134,7 @@ process.stderr.on("error", (err) => {
   if (err.code === "EPIPE") process.exit(0);
   throw err;
 });
-var VERSION = true ? "0.1.93" : (await null).default.version;
+var VERSION = true ? "0.1.95" : (await null).default.version;
 var reorderedArgv = hoistFlagsAfterSubcommand(process.argv.slice(2));
 process.argv = [process.argv[0], process.argv[1], ...reorderedArgv];
 var args = process.argv.slice(2);

package/dist/{upgrade-EMXIHRN3.js → upgrade-W43OKEIV.js}

@@ -72,7 +72,7 @@ ${GREEN}${BOLD}Upgraded to @epilot/cli@${latest}${RESET}
   }
 });
 var getCurrentVersion = () => {
-  if (true) return "0.1.93";
+  if (true) return "0.1.95";
   try {
     const output = execSync("npm ls -g @epilot/cli --depth=0 --json 2>/dev/null", {
       encoding: "utf-8",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@epilot/cli",
-  "version": "0.1.93",
+  "version": "0.1.95",
   "description": "CLI for epilot APIs",
   "type": "module",
   "bin": {