@getpara/cli 2.15.0

package/dist/commands/keys/config/webhooks.d.ts

@@ -0,0 +1,18 @@
+import type { Command } from 'commander';
+import { ParaApiClient } from '../../../api/client.js';
+import type { ApiKey } from '../../../api/types.js';
+import type { OutputFormatter } from '../../../output/formatter.js';
+interface WebhooksFlags {
+    url?: string;
+    events?: string;
+    enabled?: boolean;
+    status?: boolean;
+    test?: boolean;
+    rotateSecret?: boolean;
+    delete?: boolean;
+    yes?: boolean;
+}
+export declare function registerWebhooksConfigCommand(parent: Command): void;
+export declare function runWebhooksAction(client: ParaApiClient, orgId: string, projectId: string, environment: string, keyId: string, _currentKey: ApiKey, formatter: OutputFormatter, flags?: WebhooksFlags): Promise<void>;
+export {};
+//# sourceMappingURL=webhooks.d.ts.map

package/dist/commands/keys/config/webhooks.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"webhooks.d.ts","sourceRoot":"","sources":["../../../../src/commands/keys/config/webhooks.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAIzC,OAAO,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAC;AAEvD,OAAO,KAAK,EAAE,MAAM,EAAiB,MAAM,uBAAuB,CAAC;AAEnE,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,8BAA8B,CAAC;AAKpE,UAAU,aAAa;IACrB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,GAAG,CAAC,EAAE,OAAO,CAAC;CACf;AAED,wBAAgB,6BAA6B,CAAC,MAAM,EAAE,OAAO,GAAG,IAAI,CAgEnE;AA0BD,wBAAsB,iBAAiB,CACrC,MAAM,EAAE,aAAa,EACrB,KAAK,EAAE,MAAM,EACb,SAAS,EAAE,MAAM,EACjB,WAAW,EAAE,MAAM,EACnB,KAAK,EAAE,MAAM,EACb,WAAW,EAAE,MAAM,EACnB,SAAS,EAAE,eAAe,EAC1B,KAAK,CAAC,EAAE,aAAa,GACpB,OAAO,CAAC,IAAI,CAAC,CA6Of"}

package/dist/commands/keys/config/webhooks.js

@@ -0,0 +1,279 @@
+import { getGlobalOptions, createFormatter, helpText } from "../../../cli.js";
+import { ensureAuthenticated } from "../../../auth/session-manager.js";
+import { resolveConfig } from "../../../config/config-manager.js";
+import { ParaApiClient } from "../../../api/client.js";
+import { CliError } from "../../../core/error-handler.js";
+import { SUBSCRIBABLE_WEBHOOK_EVENTS } from "../../../api/types.js";
+import { text, multiselect, select, confirm, p } from "../../../output/prompts.js";
+import { resolveKeyId } from "./categories.js";
+import { validateWebhookUrl, validateWebhookEvents } from "../../../validation/index.js";
+function registerWebhooksConfigCommand(parent) {
+  parent.command("webhooks").description("Configure webhook settings for an API key").argument("[key-id]", "API key ID (prompted if not given)").option("--url <url>", "Webhook endpoint URL (HTTPS)").option("--events <types>", "Comma-separated event types").option("--enabled", "Enable the webhook").option("--no-enabled", "Disable the webhook").option("--status", "Show current webhook configuration").option("--test", "Send a test webhook to the configured URL").option("--rotate-secret", "Rotate the webhook signing secret").option("--delete", "Remove webhook configuration").option("-y, --yes", "Skip confirmation for destructive operations").addHelpText(
+    "after",
+    helpText(`Examples:
+  $ para keys config webhooks                                         Interactive webhook settings
+  $ para keys config webhooks --status                                Show current config
+  $ para keys config webhooks --url "https://example.com/hook" --events "user.created,wallet.created" --enabled
+  $ para keys config webhooks --no-enabled                            Disable webhook
+  $ para keys config webhooks --test                                  Send test webhook
+  $ para keys config webhooks --rotate-secret                         Rotate signing secret
+  $ para keys config webhooks --delete                                Remove webhook config
+
+Event types: user.created, wallet.created, transaction.signed, send.broadcasted,
+  send.confirmed, send.failed, wallet.pregen_claimed, user.external_wallet_verified`)
+  ).action(async (keyIdArg, cmdOpts, cmd) => {
+    const opts = await getGlobalOptions(cmd);
+    const formatter = createFormatter(opts);
+    const config = await resolveConfig(opts);
+    const session = await ensureAuthenticated(config.environment);
+    if (!config.organizationId || !config.projectId) {
+      throw new CliError(
+        "Organization and project required. Run `para orgs switch` and `para projects switch`, or pass --org and --project."
+      );
+    }
+    const client = new ParaApiClient({
+      environment: config.environment,
+      sessionId: session.sessionId
+    });
+    const { keyId, key } = await resolveKeyId(
+      client,
+      config.organizationId,
+      config.projectId,
+      config.environment,
+      keyIdArg
+    );
+    await runWebhooksAction(
+      client,
+      config.organizationId,
+      config.projectId,
+      config.environment,
+      keyId,
+      key,
+      formatter,
+      cmdOpts
+    );
+  });
+}
+function hasConfigFlag(flags) {
+  if (!flags) return false;
+  return flags.url !== void 0 || flags.events !== void 0;
+}
+function hasOperationFlag(flags) {
+  if (!flags) return false;
+  return flags.status === true || flags.test === true || flags.rotateSecret === true || flags.delete === true;
+}
+function hasAnyFlag(flags) {
+  return hasConfigFlag(flags) || hasOperationFlag(flags) || flags?.enabled !== void 0;
+}
+function formatWebhookStatus(webhook) {
+  if (!webhook) {
+    p.log.info("No webhook configured.");
+    return;
+  }
+  p.log.info(`URL:     ${webhook.url}`);
+  p.log.info(`Enabled: ${webhook.enabled ? "yes" : "no"}`);
+  p.log.info(`Events:  ${webhook.events.length ? webhook.events.join(", ") : "(none)"}`);
+}
+async function runWebhooksAction(client, orgId, projectId, environment, keyId, _currentKey, formatter, flags) {
+  const isInteractive = !hasAnyFlag(flags);
+  if (hasOperationFlag(flags)) {
+    const ops = [flags?.status, flags?.test, flags?.rotateSecret, flags?.delete].filter(Boolean);
+    if (ops.length > 1) {
+      throw new CliError("Only one operation flag can be used at a time (--status, --test, --rotate-secret, --delete).");
+    }
+    if (flags?.status) {
+      const webhook2 = await client.getWebhookConfig(orgId, projectId, environment, keyId);
+      if (formatter["opts"]?.json) {
+        formatter.json({ webhook: webhook2 });
+        formatter.flush();
+      } else {
+        formatWebhookStatus(webhook2);
+      }
+      return;
+    }
+    if (flags?.test) {
+      const result = await client.testWebhook(orgId, projectId, environment, keyId);
+      formatter.json({ success: result.success, timestamp: result.timestamp });
+      if (result.success) {
+        formatter.success("Test webhook sent successfully.");
+      } else {
+        formatter.error("Test webhook delivery failed.");
+      }
+      formatter.flush();
+      return;
+    }
+    if (flags?.rotateSecret) {
+      if (!flags.yes) {
+        const confirmed = await confirm("Rotate webhook signing secret? The old secret will remain valid for 24 hours.");
+        if (!confirmed) {
+          formatter.info("Cancelled.");
+          return;
+        }
+      }
+      const result = await client.rotateWebhookSecret(orgId, projectId, environment, keyId);
+      formatter.json({ secret: result.secret });
+      formatter.success("Rotated webhook signing secret.");
+      p.log.warn(`New secret: ${result.secret}`);
+      p.log.warn("Save this now \u2014 it will not be shown again.");
+      formatter.flush();
+      return;
+    }
+    if (flags?.delete) {
+      if (!flags.yes) {
+        const confirmed = await confirm("Delete webhook configuration? This is irreversible.");
+        if (!confirmed) {
+          formatter.info("Cancelled.");
+          return;
+        }
+      }
+      await client.deleteWebhookConfig(orgId, projectId, environment, keyId);
+      formatter.json({ deleted: true });
+      formatter.success("Deleted webhook configuration.");
+      formatter.flush();
+      return;
+    }
+  }
+  if (hasConfigFlag(flags) || flags?.enabled !== void 0 && !isInteractive) {
+    const existing = await client.getWebhookConfig(orgId, projectId, environment, keyId);
+    let url = existing?.url ?? "";
+    let events = existing?.events ?? [];
+    let enabled = existing?.enabled ?? false;
+    if (flags?.url !== void 0) {
+      const err = validateWebhookUrl(flags.url);
+      if (err) throw new CliError(err);
+      url = flags.url;
+    }
+    if (flags?.events !== void 0) {
+      const parsed = flags.events.split(",").map((s) => s.trim()).filter(Boolean);
+      const err = validateWebhookEvents(parsed);
+      if (err) throw new CliError(err);
+      events = parsed;
+    }
+    if (flags?.enabled !== void 0) {
+      enabled = flags.enabled;
+    }
+    if (enabled && !url) {
+      throw new CliError("A webhook URL is required when enabling the webhook. Pass --url.");
+    }
+    if (enabled && events.length === 0) {
+      throw new CliError("At least one event type is required when enabling the webhook. Pass --events.");
+    }
+    const result = await client.updateWebhookConfig(orgId, projectId, environment, keyId, { url, events, enabled });
+    formatter.json({ webhook: result.webhook, ...result.secret ? { secret: result.secret } : {} });
+    formatter.success("Updated webhook settings.");
+    if (result.secret) {
+      p.log.warn(`Webhook signing secret: ${result.secret}`);
+      p.log.warn("Save this now \u2014 it will not be shown again.");
+    }
+    formatter.flush();
+    return;
+  }
+  const webhook = await client.getWebhookConfig(orgId, projectId, environment, keyId);
+  formatWebhookStatus(webhook);
+  console.log("");
+  if (!webhook) {
+    const shouldSetup = await confirm("Set up a webhook?");
+    if (!shouldSetup) return;
+    const url = await text("Webhook URL (HTTPS):", {
+      placeholder: "https://example.com/webhook",
+      validate: (v) => validateWebhookUrl(v)
+    });
+    const events = await multiselect(
+      "Event types to subscribe:",
+      SUBSCRIBABLE_WEBHOOK_EVENTS.map((e) => ({ value: e, label: e }))
+    );
+    if (events.length === 0) {
+      throw new CliError("At least one event type is required.");
+    }
+    const enabled = await confirm("Enable webhook now?");
+    const result = await client.updateWebhookConfig(orgId, projectId, environment, keyId, {
+      url,
+      events,
+      enabled
+    });
+    formatter.json({ webhook: result.webhook, ...result.secret ? { secret: result.secret } : {} });
+    formatter.success("Created webhook configuration.");
+    if (result.secret) {
+      p.log.warn(`Webhook signing secret: ${result.secret}`);
+      p.log.warn("Save this now \u2014 it will not be shown again.");
+    }
+    formatter.flush();
+    return;
+  }
+  while (true) {
+    const action = await select("Webhook action:", [
+      { value: "configure", label: "Configure", hint: "Edit URL, events, enabled" },
+      { value: "test", label: "Test", hint: "Send a test webhook" },
+      { value: "rotate", label: "Rotate secret", hint: "Generate new signing secret" },
+      { value: "delete", label: "Delete", hint: "Remove webhook configuration" },
+      { value: "done", label: "Done", hint: "Exit" }
+    ]);
+    if (action === "done") break;
+    if (action === "configure") {
+      const currentWebhook = await client.getWebhookConfig(orgId, projectId, environment, keyId);
+      if (!currentWebhook) {
+        p.log.warn("Webhook was deleted externally.");
+        break;
+      }
+      const url = await text("Webhook URL (HTTPS):", {
+        placeholder: "https://example.com/webhook",
+        initialValue: currentWebhook.url,
+        validate: (v) => validateWebhookUrl(v)
+      });
+      const events = await multiselect(
+        "Event types to subscribe:",
+        SUBSCRIBABLE_WEBHOOK_EVENTS.map((e) => ({
+          value: e,
+          label: e
+        })),
+        { initialValues: currentWebhook.events }
+      );
+      if (events.length === 0) {
+        throw new CliError("At least one event type is required.");
+      }
+      const enabled = await confirm("Enable webhook?");
+      const result = await client.updateWebhookConfig(orgId, projectId, environment, keyId, {
+        url,
+        events,
+        enabled
+      });
+      formatter.success("Updated webhook settings.");
+      if (result.secret) {
+        p.log.warn(`Webhook signing secret: ${result.secret}`);
+        p.log.warn("Save this now \u2014 it will not be shown again.");
+      }
+    }
+    if (action === "test") {
+      const result = await client.testWebhook(orgId, projectId, environment, keyId);
+      if (result.success) {
+        formatter.success("Test webhook sent successfully.");
+      } else {
+        formatter.error("Test webhook delivery failed.");
+      }
+    }
+    if (action === "rotate") {
+      p.log.warn("The old secret will remain valid for 24 hours.");
+      const confirmed = await confirm("Rotate webhook signing secret?");
+      if (confirmed) {
+        const result = await client.rotateWebhookSecret(orgId, projectId, environment, keyId);
+        formatter.success("Rotated webhook signing secret.");
+        p.log.warn(`New secret: ${result.secret}`);
+        p.log.warn("Save this now \u2014 it will not be shown again.");
+      }
+    }
+    if (action === "delete") {
+      p.log.warn("This will permanently remove your webhook configuration.");
+      const confirmed = await confirm("Delete webhook?");
+      if (confirmed) {
+        await client.deleteWebhookConfig(orgId, projectId, environment, keyId);
+        formatter.success("Deleted webhook configuration.");
+        break;
+      }
+    }
+    console.log("");
+  }
+}
+export {
+  registerWebhooksConfigCommand,
+  runWebhooksAction
+};

package/dist/commands/keys/create.d.ts

@@ -0,0 +1,3 @@
+import type { Command } from 'commander';
+export declare function registerKeysCreateCommand(parent: Command): void;
+//# sourceMappingURL=create.d.ts.map

package/dist/commands/keys/create.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"create.d.ts","sourceRoot":"","sources":["../../../src/commands/keys/create.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAQzC,wBAAgB,yBAAyB,CAAC,MAAM,EAAE,OAAO,GAAG,IAAI,CAoE/D"}

package/dist/commands/keys/create.js

@@ -0,0 +1,64 @@
+import { getGlobalOptions, createFormatter, helpText } from "../../cli.js";
+import { ensureAuthenticated } from "../../auth/session-manager.js";
+import { resolveConfig } from "../../config/config-manager.js";
+import { ParaApiClient } from "../../api/client.js";
+import { CliError } from "../../core/error-handler.js";
+import { text } from "../../output/prompts.js";
+function registerKeysCreateCommand(parent) {
+  parent.command("create").description("Create a new API key").option("-n, --name <name>", "Internal key name").option("--display-name <name>", "Display name shown to users").addHelpText(
+    "after",
+    helpText(`Examples:
+  $ para keys create                  Prompts for a key name, then shows the new key pair
+  $ para keys create -n "prod-key"    Skip the prompt and name it directly
+
+The secret key is only shown once on creation \u2014 save it immediately.`)
+  ).action(async (cmdOpts, cmd) => {
+    const opts = await getGlobalOptions(cmd);
+    const formatter = createFormatter(opts);
+    const config = await resolveConfig(opts);
+    const session = await ensureAuthenticated(config.environment);
+    if (!config.organizationId || !config.projectId) {
+      throw new CliError(
+        "Organization and project required. Run `para orgs switch` and `para projects switch`, or pass --org and --project."
+      );
+    }
+    const name = cmdOpts.name || await text("Key name:", {
+      validate: (v) => {
+        if (!v.trim()) return "Name is required.";
+      }
+    });
+    const client = new ParaApiClient({
+      environment: config.environment,
+      sessionId: session.sessionId
+    });
+    const key = await client.createApiKey(config.organizationId, config.projectId, config.environment, {
+      name,
+      displayName: cmdOpts.displayName
+    });
+    if (opts.json) {
+      formatter.json({
+        id: key.id,
+        name: key.name,
+        displayName: key.displayName,
+        apiKey: key.apiKey,
+        secretApiKey: key.secretApiKey,
+        environment: key.environment
+      });
+    } else {
+      formatter.success(`Created API key "${key.name}"`);
+      formatter.detail([
+        { label: "ID", value: key.id },
+        { label: "API Key", value: key.apiKey },
+        {
+          label: "Secret Key",
+          value: key.secretApiKey || "N/A"
+        }
+      ]);
+      formatter.warn("Save the secret key now -- it will be masked in future commands.");
+    }
+    formatter.flush();
+  });
+}
+export {
+  registerKeysCreateCommand
+};

package/dist/commands/keys/get.d.ts

@@ -0,0 +1,3 @@
+import type { Command } from 'commander';
+export declare function registerKeysGetCommand(parent: Command): void;
+//# sourceMappingURL=get.d.ts.map

package/dist/commands/keys/get.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"get.d.ts","sourceRoot":"","sources":["../../../src/commands/keys/get.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AA2BzC,wBAAgB,sBAAsB,CAAC,MAAM,EAAE,OAAO,GAAG,IAAI,CA+E5D"}

package/dist/commands/keys/get.js

@@ -0,0 +1,91 @@
+import { getGlobalOptions, createFormatter, helpText } from "../../cli.js";
+import { ensureAuthenticated } from "../../auth/session-manager.js";
+import { resolveConfig } from "../../config/config-manager.js";
+import { ParaApiClient } from "../../api/client.js";
+import { CliError } from "../../core/error-handler.js";
+import { maskSecret } from "../../output/mask.js";
+async function copyToClipboard(value) {
+  try {
+    const { execFileSync } = await import("node:child_process");
+    if (process.platform === "darwin") {
+      execFileSync("pbcopy", [], { input: value });
+      return true;
+    } else if (process.platform === "win32") {
+      execFileSync("clip", [], { input: value });
+      return true;
+    } else if (process.platform === "linux") {
+      execFileSync("xclip", ["-selection", "clipboard"], { input: value });
+      return true;
+    }
+    return false;
+  } catch {
+    return false;
+  }
+}
+function registerKeysGetCommand(parent) {
+  parent.command("get").description("Get details of a specific API key").argument("<key-id>", "API key ID").option("--show-secret", "Show the full secret API key").option("--copy", "Copy the public API key to clipboard").option("--copy-secret", "Copy the secret API key to clipboard").addHelpText(
+    "after",
+    helpText(`Examples:
+  $ para keys get abc-123             Show name, public key, masked secret, env, origins
+  $ para keys get abc-123 --copy      Copy the public API key to your clipboard
+  $ para keys get abc-123 --copy-secret  Copy the secret key (for .env files)
+  $ para keys get abc-123 --show-secret  Print the full unmasked secret key`)
+  ).action(async (keyId, cmdOpts, cmd) => {
+    const opts = await getGlobalOptions(cmd);
+    const formatter = createFormatter(opts);
+    const config = await resolveConfig(opts);
+    const session = await ensureAuthenticated(config.environment);
+    if (!config.organizationId || !config.projectId) {
+      throw new CliError(
+        "Organization and project required. Run `para orgs switch` and `para projects switch`, or pass --org and --project."
+      );
+    }
+    const client = new ParaApiClient({
+      environment: config.environment,
+      sessionId: session.sessionId
+    });
+    const key = await client.getApiKey(config.organizationId, config.projectId, config.environment, keyId);
+    if (cmdOpts.copy || cmdOpts.copySecret) {
+      const valueToCopy = cmdOpts.copySecret ? key.secretApiKey : key.apiKey;
+      if (valueToCopy) {
+        const copied = await copyToClipboard(valueToCopy);
+        if (copied) {
+          formatter.success(`${cmdOpts.copySecret ? "Secret API key" : "API key"} copied to clipboard.`);
+          formatter.flush();
+          return;
+        }
+        formatter.warn("Could not copy to clipboard. Displaying instead.");
+      }
+    }
+    if (opts.json) {
+      formatter.json({
+        id: key.id,
+        name: key.name,
+        displayName: key.displayName,
+        apiKey: key.apiKey,
+        secretApiKey: cmdOpts.showSecret ? key.secretApiKey : key.secretApiKey ? maskSecret(key.secretApiKey) : void 0,
+        environment: key.environment,
+        archived: key.archived,
+        origins: key.origins
+      });
+    } else {
+      formatter.detail([
+        { label: "Name", value: key.displayName || key.name },
+        { label: "ID", value: key.id },
+        { label: "API Key", value: key.apiKey },
+        {
+          label: "Secret Key",
+          value: key.secretApiKey || "N/A",
+          mask: !cmdOpts.showSecret
+        },
+        { label: "Environment", value: key.environment },
+        { label: "Status", value: key.archived ? "archived" : "active" },
+        ...key.origins?.length ? [{ label: "Origins", value: key.origins.join(", ") }] : []
+      ]);
+    }
+    formatter.flush();
+  });
+}
+export {
+  registerKeysGetCommand
+};

package/dist/commands/keys/index.d.ts

@@ -0,0 +1,3 @@
+import type { Command } from 'commander';
+export declare function registerKeysCommands(program: Command): void;
+//# sourceMappingURL=index.d.ts.map

package/dist/commands/keys/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/commands/keys/index.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAQzC,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,OAAO,GAAG,IAAI,CAgB3D"}

package/dist/commands/keys/index.js

@@ -0,0 +1,22 @@
+import { registerKeysListCommand } from "./list.js";
+import { registerKeysGetCommand } from "./get.js";
+import { registerKeysCreateCommand } from "./create.js";
+import { registerKeysRotateCommand } from "./rotate.js";
+import { registerKeysArchiveCommand } from "./archive.js";
+import { registerKeysConfigCommand } from "./config/index.js";
+function registerKeysCommands(program) {
+  const keys = program.command("keys").description("API key management").addHelpText(
+    "after",
+    `
+Requires an active org and project. Run "para orgs switch" and "para projects switch" first.`
+  );
+  registerKeysListCommand(keys);
+  registerKeysGetCommand(keys);
+  registerKeysCreateCommand(keys);
+  registerKeysRotateCommand(keys);
+  registerKeysArchiveCommand(keys);
+  registerKeysConfigCommand(keys);
+}
+export {
+  registerKeysCommands
+};

package/dist/commands/keys/list.d.ts

@@ -0,0 +1,3 @@
+import type { Command } from 'commander';
+export declare function registerKeysListCommand(parent: Command): void;
+//# sourceMappingURL=list.d.ts.map

package/dist/commands/keys/list.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"list.d.ts","sourceRoot":"","sources":["../../../src/commands/keys/list.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAQzC,wBAAgB,uBAAuB,CAAC,MAAM,EAAE,OAAO,GAAG,IAAI,CAkE7D"}

package/dist/commands/keys/list.js

@@ -0,0 +1,66 @@
+import { getGlobalOptions, createFormatter, helpText } from "../../cli.js";
+import { ensureAuthenticated } from "../../auth/session-manager.js";
+import { resolveConfig } from "../../config/config-manager.js";
+import { ParaApiClient } from "../../api/client.js";
+import { CliError } from "../../core/error-handler.js";
+import { maskSecret } from "../../output/mask.js";
+function registerKeysListCommand(parent) {
+  parent.command("list").description("List API keys for the active project").option("--include-archived", "Include archived keys").addHelpText(
+    "after",
+    helpText(`Examples:
+  $ para keys list                    Show active keys (name, ID, masked key, env)
+  $ para keys list --include-archived Also show archived/revoked keys
+  $ para keys list --json             Output as JSON for scripting
+
+Requires an active org and project. Run "para orgs switch" and "para projects switch" first.`)
+  ).action(async (cmdOpts, cmd) => {
+    const opts = await getGlobalOptions(cmd);
+    const formatter = createFormatter(opts);
+    const config = await resolveConfig(opts);
+    const session = await ensureAuthenticated(config.environment);
+    if (!config.organizationId || !config.projectId) {
+      throw new CliError(
+        "Organization and project required. Run `para orgs switch` and `para projects switch`, or pass --org and --project."
+      );
+    }
+    const client = new ParaApiClient({
+      environment: config.environment,
+      sessionId: session.sessionId
+    });
+    const keys = await client.getApiKeys(config.organizationId, config.projectId, config.environment);
+    const filtered = cmdOpts.includeArchived ? keys : keys.filter((k) => !k.archived);
+    if (opts.json) {
+      formatter.json(
+        filtered.map((k) => ({
+          id: k.id,
+          name: k.displayName || k.name,
+          apiKey: maskSecret(k.apiKey),
+          secretApiKey: k.secretApiKey ? maskSecret(k.secretApiKey) : void 0,
+          environment: k.environment,
+          archived: k.archived
+        }))
+      );
+    } else {
+      formatter.table(
+        [
+          { key: "name", header: "Name" },
+          { key: "id", header: "ID" },
+          { key: "apiKey", header: "API Key" },
+          { key: "environment", header: "Env" },
+          { key: "status", header: "Status" }
+        ],
+        filtered.map((k) => ({
+          name: k.displayName || k.name,
+          id: k.id,
+          apiKey: maskSecret(k.apiKey),
+          environment: k.environment,
+          status: k.archived ? "archived" : "active"
+        }))
+      );
+    }
+    formatter.flush();
+  });
+}
+export {
+  registerKeysListCommand
+};

package/dist/commands/keys/rotate.d.ts

@@ -0,0 +1,3 @@
+import type { Command } from 'commander';
+export declare function registerKeysRotateCommand(parent: Command): void;
+//# sourceMappingURL=rotate.d.ts.map

package/dist/commands/keys/rotate.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"rotate.d.ts","sourceRoot":"","sources":["../../../src/commands/keys/rotate.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAQzC,wBAAgB,yBAAyB,CAAC,MAAM,EAAE,OAAO,GAAG,IAAI,CAiE/D"}

package/dist/commands/keys/rotate.js

@@ -0,0 +1,59 @@
+import { getGlobalOptions, createFormatter, helpText } from "../../cli.js";
+import { ensureAuthenticated } from "../../auth/session-manager.js";
+import { resolveConfig } from "../../config/config-manager.js";
+import { ParaApiClient } from "../../api/client.js";
+import { CliError } from "../../core/error-handler.js";
+import { confirm } from "../../output/prompts.js";
+function registerKeysRotateCommand(parent) {
+  parent.command("rotate").description("Rotate an API key").argument("<key-id>", "API key ID to rotate").option("--secret", "Rotate the secret key instead of the public key").option("-y, --yes", "Skip confirmation prompt").addHelpText(
+    "after",
+    helpText(`Examples:
+  $ para keys rotate abc-123          Generates a new public key (asks for confirmation)
+  $ para keys rotate abc-123 --secret Rotate the secret key instead of the public key
+  $ para keys rotate abc-123 -y       Skip the confirmation prompt (for scripts)
+
+This is irreversible \u2014 the old key stops working immediately.`)
+  ).action(async (keyId, cmdOpts, cmd) => {
+    const opts = await getGlobalOptions(cmd);
+    const formatter = createFormatter(opts);
+    const config = await resolveConfig(opts);
+    const session = await ensureAuthenticated(config.environment);
+    if (!config.organizationId || !config.projectId) {
+      throw new CliError(
+        "Organization and project required. Run `para orgs switch` and `para projects switch`, or pass --org and --project."
+      );
+    }
+    const keyType = cmdOpts.secret ? "secret" : "public";
+    if (!cmdOpts.yes) {
+      const confirmed = await confirm(`Are you sure you want to rotate the ${keyType} API key? This cannot be undone.`);
+      if (!confirmed) {
+        formatter.info("Rotation cancelled.");
+        return;
+      }
+    }
+    const client = new ParaApiClient({
+      environment: config.environment,
+      sessionId: session.sessionId
+    });
+    const result = cmdOpts.secret ? await client.rotateSecretApiKey(config.organizationId, config.projectId, config.environment, keyId) : await client.rotateApiKey(config.organizationId, config.projectId, config.environment, keyId);
+    if (opts.json) {
+      formatter.json({
+        id: keyId,
+        newKey: result.newKey,
+        keyType
+      });
+    } else if (opts.quiet) {
+      console.log(result.newKey);
+    } else {
+      formatter.success(`Rotated ${keyType} API key`);
+      formatter.detail([
+        { label: "Key ID", value: keyId },
+        { label: `New ${keyType} key`, value: result.newKey }
+      ]);
+    }
+    formatter.flush();
+  });
+}
+export {
+  registerKeysRotateCommand
+};

package/dist/commands/orgs/index.d.ts

@@ -0,0 +1,3 @@
+import type { Command } from 'commander';
+export declare function registerOrgsCommands(program: Command): void;
+//# sourceMappingURL=index.d.ts.map

package/dist/commands/orgs/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/commands/orgs/index.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAIzC,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,OAAO,GAAG,IAAI,CAa3D"}