@erdoai/cli 0.151.0 → 0.153.0

package/dist/index.js

@@ -331,6 +331,9 @@ var ErdoClient = class {
   listTokens() {
     return this.request("GET", "/v1/tokens");
   }
+  rotateToken(id) {
+    return this.request("POST", `/v1/tokens/${encodeURIComponent(id)}/rotate`, void 0, false);
+  }
   revokeToken(id) {
     return this.request("DELETE", `/v1/tokens/${encodeURIComponent(id)}`);
   }
@@ -3321,6 +3324,25 @@ ${res.from} to ${res.to} (${res.timezone} days)
   }
 );
 var tokenCmd = program.command("token").description("Manage your API tokens (account-level credentials)");
+function printNewToken(res, replacedTokenID) {
+  process.stderr.write("Store this token now \u2014 it is shown only once and cannot be retrieved again.\n");
+  console.log(res.token);
+  const scoped = res.is_scoped === true || res.capabilities !== void 0;
+  const scopeDetails = scoped ? `capabilities: ${res.capabilities?.join(", ") || "(none)"}
+resource slugs: ${res.resource_slugs?.join(", ") || "(none)"}
+` : "";
+  const scopeDescription = scoped ? "This token is pinned to the default org above and can use only its listed capabilities; resource restrictions apply when slugs are listed.\n" : res.access === "read" ? "This token can read as you in any org you belong to and cannot change anything; pass --org on a command to target another.\n" : "This token acts as you in any org you belong to; pass --org on a command to target another.\n";
+  process.stderr.write(
+    `
+id: ${res.id}
+hint: ${res.hint}
+expires: ${res.expires_at}
+default org: ${res.default_org ? `${res.default_org.name} (${res.default_org.id})` : "(none)"}
+access: ${res.access ?? "full"}
+` + scopeDetails + (replacedTokenID ? `replaced token id: ${replacedTokenID}
+` : "") + scopeDescription
+  );
+}
 tokenCmd.command("create").description("Mint a new API token; the secret is printed ONCE").requiredOption("--name <name>", "a label for the token").option("--expires-days <n>", "days until expiry (default: 30)", (v) => parseInt(v, 10)).option("--read-only", "mint a read-only token: it can read through the API in any org you belong to, and never write").addOption(
   orgOption("the token's default org (defaults to your active org; must be one you belong to)")
 ).action(async (opts) => {
@@ -3331,19 +3353,37 @@ tokenCmd.command("create").description("Mint a new API token; the secret is prin
       organization_id: opts.org,
       ...opts.readOnly ? { access: "read" } : {}
     });
-    process.stderr.write(
-      "Store this token now \u2014 it is shown only once and cannot be retrieved again.\n"
-    );
-    console.log(res.token);
-    process.stderr.write(
-      `
-id: ${res.id}
-hint: ${res.hint}
-expires: ${res.expires_at}
-default org: ${res.default_org ? `${res.default_org.name} (${res.default_org.id})` : "(none)"}
-access: ${res.access ?? "full"}
-` + (res.access === "read" ? "This token can read as you in any org you belong to and cannot change anything; pass --org on a command to target another.\n" : "This token acts as you in any org you belong to; pass --org on a command to target another.\n")
-    );
+    printNewToken(res);
+  } catch (e) {
+    fail(e);
+  }
+});
+tokenCmd.command("rotate <id>").description("Replace an API token; the replacement secret is printed ONCE").option("--update-login", "save the new secret when the rotated token is the active account's credential").action(async (id, opts) => {
+  try {
+    let accountKey;
+    let savedToken;
+    if (opts.updateLogin) {
+      const file = loadConfigFile();
+      accountKey = file ? activeAccountKey(file) : void 0;
+      const saved = accountKey ? file?.accounts[accountKey] : void 0;
+      if (!saved?.token) throw new Error("No active saved login to update. Run: erdo auth login");
+      savedToken = saved.token;
+      const me = await fetchMe(saved.token);
+      if (!me.credential_id || me.credential_id !== id) {
+        throw new Error("--update-login requires the rotated token id to match the active saved login's credential id");
+      }
+    }
+    const res = await new ErdoClient().rotateToken(id);
+    printNewToken(res, res.replaced_token_id);
+    if (accountKey) {
+      const current = loadConfigFile();
+      if (!current || activeAccountKey(current) !== accountKey || current.accounts[accountKey]?.token !== savedToken) {
+        throw new Error("Rotation succeeded and the replacement secret was printed above, but the active saved login changed during the request and was not overwritten. Save the new key with erdo login --key if needed");
+      }
+      saveAccount(accountKey, { token: res.token }, false);
+      process.stderr.write(`Updated saved login for ${accountKey}.
+`);
+    }
   } catch (e) {
     fail(e);
   }
@@ -3358,7 +3398,7 @@ tokenCmd.command("list").description("List your API tokens (never shows the secr
     for (const t of tokens) {
       const org2 = t.default_org ? t.default_org.name || t.default_org.id : "-";
       const used = t.last_used_at ?? "never";
-      console.log(`${t.id}	${t.name || "-"}	${t.hint}	access:${t.access ?? "full"}	default-org:${org2}	expires:${t.expires_at}	used:${used}`);
+      console.log(`${t.id}	${t.name || "-"}	${t.hint}	access:${t.access ?? "full"}	default-org:${org2}	expires:${t.expires_at}	last-used:${used}`);
     }
   } catch (e) {
     fail(e);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@erdoai/cli",
-  "version": "0.151.0",
+  "version": "0.153.0",
   "description": "Erdo CLI \u2014 drive datasets, pages, and evals from the terminal or CI",
   "type": "module",
   "bin": {