@hardfin/cli 0.1.0-dev.30 → 0.1.0-dev.32

package/README.md

@@ -77,6 +77,15 @@ hardfin file get file_7hq2mx9pkr4stz8w --output photo.jpg
 hardfin file get file_7hq2mx9pkr4stz8w --output - | wc -c
 ```
 
+Send a whole body as JSON with `--input`, from a file or from standard input. A flag given as
+well replaces its field, and a required field the body carries needs no flag. A value with a
+comma in it, which a `key=value` flag cannot carry, goes through `--input`.
+
+```sh
+hardfin location create --input location.json
+echo '{"name": "Dock 4, north side"}' | hardfin location create --input -
+```
+
 Clear a field with `--unset`, naming the flag:
 
 ```sh
@@ -159,8 +168,18 @@ hardfin status           # what the CLI is configured with and signed in as
 hardfin logout           # forget this machine, and ask Hardfin to revoke it
 ```
 
-An API key is still the way to run unattended. `HARDFIN_API_KEY` wins over a stored sign in,
-so CI and an agent sandbox need no browser.
+An API key is still the way to run unattended. `--api-key`, or `HARDFIN_API_KEY`, wins over
+a stored sign in, so CI and an agent sandbox need no browser. The flag beats the variable.
+
+An API key is held to two rules before it is sent:
+
+| Rule                                                                                                                                    | Why                                                                     |
+| --------------------------------------------------------------------------------------------------------------------------------------- | ----------------------------------------------------------------------- |
+| It goes only over https, or to this machine                                                                                             | Anything between here and the host could read it                        |
+| A key you set, by flag or exported variable, never goes to an API URL that `config.local.json` or `.env` in the working directory chose | A repository you cloned could otherwise send your key to its own server |
+
+A key and an API URL that come from the same folder's files still work together, which is
+how a local build is set up. Pass `--api-url` to send a key you set to that folder's address.
 
 ### What login does
 
@@ -373,7 +392,7 @@ settings, and the one nearest the top wins.
 
 | Layer       | Where                                                                 | Beats            |
 | ----------- | --------------------------------------------------------------------- | ---------------- |
-| Flag        | `--api-url`                                                           | everything below |
+| Flag        | `--api-url`, `--api-key`, `--issuer-url`                              | everything below |
 | Environment | an exported `HARDFIN_*` variable                                      | the files below  |
 | Env file    | `.env` in the working directory, or the file `HARDFIN_ENV_FILE` names | the config file  |
 | Config file | `config.local.json` in the working directory                          | the defaults     |

package/dist/cli.js

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 
-!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="29560915-e7ae-5a74-b5f6-f4a6988e1b43")}catch(e){}}();
+!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="62437fed-ab84-53c5-9984-9bbadc0f2e15")}catch(e){}}();
 import module from "node:module";
 //#region src/cli.ts
 module.enableCompileCache?.();
@@ -14,7 +14,7 @@ process.on("unhandledRejection", (error) => void toCrash(error));
 try {
 	const answer = await toQuickAnswer(process.argv.slice(2));
 	if (answer === void 0) {
-		const { toCli, toParseExitCode, wasReportAttempted } = await import("./program-BZW_50HP.js");
+		const { toCli, toParseExitCode, wasReportAttempted } = await import("./program-B02z-kNH.js");
 		try {
 			await toCli().parseAsync(process.argv);
 		} catch (error) {
@@ -33,7 +33,7 @@ async function toCrash(error) {
 	isCrashing = true;
 	process.stderr.write(`error: ${error instanceof Error ? error.message : String(error)}\n`);
 	try {
-		const { toReported } = await import("./program-BZW_50HP.js");
+		const { toReported } = await import("./program-B02z-kNH.js");
 		await toReported(error, false, void 0, "fatal");
 	} finally {
 		process.exit(1);
@@ -51,4 +51,4 @@ async function toQuickAnswer(args) {
 export {};
 
 //# sourceMappingURL=cli.js.map
-//# debugId=29560915-e7ae-5a74-b5f6-f4a6988e1b43
+//# debugId=62437fed-ab84-53c5-9984-9bbadc0f2e15

package/dist/completion-tree.json

@@ -5,6 +5,11 @@
       "description": "The API to call, whose host also holds the authorization server",
       "valueName": "url"
     },
+    {
+      "name": "api-key",
+      "description": "An API key to call with, in place of HARDFIN_API_KEY or a sign in",
+      "valueName": "key"
+    },
     {
       "name": "issuer-url",
       "description": "The authorization server, when it does not sit at the API's host",
@@ -346,6 +351,11 @@
               "valueName": "field",
               "repeatable": true
             },
+            {
+              "name": "input",
+              "description": "A file holding the JSON request body, or - for standard input. A flag given as well replaces its field",
+              "valueName": "path"
+            },
             {
               "name": "json",
               "description": "Print machine-readable output, which is the default when stdout is not a terminal"
@@ -379,6 +389,11 @@
                       "valueName": "assetId=,deliverAt=,deliverAtTimezone=,destinationId=,originId=,shipAt=,shipAtTimezone=",
                       "repeatable": true
                     },
+                    {
+                      "name": "input",
+                      "description": "A file holding the JSON request body, or - for standard input. A flag given as well replaces its field",
+                      "valueName": "path"
+                    },
                     {
                       "name": "json",
                       "description": "Print machine-readable output, which is the default when stdout is not a terminal"
@@ -407,6 +422,11 @@
                       "valueName": "assetId=,deliverAt=,id=,shipAt=",
                       "repeatable": true
                     },
+                    {
+                      "name": "input",
+                      "description": "A file holding the JSON request body, or - for standard input. A flag given as well replaces its field",
+                      "valueName": "path"
+                    },
                     {
                       "name": "json",
                       "description": "Print machine-readable output, which is the default when stdout is not a terminal"
@@ -482,6 +502,11 @@
               "valueName": "field",
               "repeatable": true
             },
+            {
+              "name": "input",
+              "description": "A file holding the JSON request body, or - for standard input. A flag given as well replaces its field",
+              "valueName": "path"
+            },
             {
               "name": "json",
               "description": "Print machine-readable output, which is the default when stdout is not a terminal"
@@ -591,6 +616,11 @@
                   "valueName": "field",
                   "repeatable": true
                 },
+                {
+                  "name": "input",
+                  "description": "A file holding the JSON request body, or - for standard input. A flag given as well replaces its field",
+                  "valueName": "path"
+                },
                 {
                   "name": "json",
                   "description": "Print machine-readable output, which is the default when stdout is not a terminal"
@@ -618,6 +648,11 @@
                       "description": "Whether Hardfin sets the asset's in-service date itself",
                       "negatable": true
                     },
+                    {
+                      "name": "input",
+                      "description": "A file holding the JSON request body, or - for standard input. A flag given as well replaces its field",
+                      "valueName": "path"
+                    },
                     {
                       "name": "json",
                       "description": "Print machine-readable output, which is the default when stdout is not a terminal"
@@ -690,6 +725,11 @@
                   "valueName": "field",
                   "repeatable": true
                 },
+                {
+                  "name": "input",
+                  "description": "A file holding the JSON request body, or - for standard input. A flag given as well replaces its field",
+                  "valueName": "path"
+                },
                 {
                   "name": "json",
                   "description": "Print machine-readable output, which is the default when stdout is not a terminal"
@@ -888,6 +928,11 @@
                   "valueName": "field",
                   "repeatable": true
                 },
+                {
+                  "name": "input",
+                  "description": "A file holding the JSON request body, or - for standard input. A flag given as well replaces its field",
+                  "valueName": "path"
+                },
                 {
                   "name": "json",
                   "description": "Print machine-readable output, which is the default when stdout is not a terminal"
@@ -908,6 +953,11 @@
                   "description": "The day your organization takes the asset back, which cannot be in the future",
                   "valueName": "value"
                 },
+                {
+                  "name": "input",
+                  "description": "A file holding the JSON request body, or - for standard input. A flag given as well replaces its field",
+                  "valueName": "path"
+                },
                 {
                   "name": "json",
                   "description": "Print machine-readable output, which is the default when stdout is not a terminal"
@@ -960,6 +1010,11 @@
                   "valueName": "field",
                   "repeatable": true
                 },
+                {
+                  "name": "input",
+                  "description": "A file holding the JSON request body, or - for standard input. A flag given as well replaces its field",
+                  "valueName": "path"
+                },
                 {
                   "name": "json",
                   "description": "Print machine-readable output, which is the default when stdout is not a terminal"
@@ -1022,6 +1077,11 @@
                   "valueName": "field",
                   "repeatable": true
                 },
+                {
+                  "name": "input",
+                  "description": "A file holding the JSON request body, or - for standard input. A flag given as well replaces its field",
+                  "valueName": "path"
+                },
                 {
                   "name": "json",
                   "description": "Print machine-readable output, which is the default when stdout is not a terminal"
@@ -1101,6 +1161,11 @@
                   "valueName": "field",
                   "repeatable": true
                 },
+                {
+                  "name": "input",
+                  "description": "A file holding the JSON request body, or - for standard input. A flag given as well replaces its field",
+                  "valueName": "path"
+                },
                 {
                   "name": "json",
                   "description": "Print machine-readable output, which is the default when stdout is not a terminal"
@@ -1160,6 +1225,11 @@
                   "valueName": "field",
                   "repeatable": true
                 },
+                {
+                  "name": "input",
+                  "description": "A file holding the JSON request body, or - for standard input. A flag given as well replaces its field",
+                  "valueName": "path"
+                },
                 {
                   "name": "json",
                   "description": "Print machine-readable output, which is the default when stdout is not a terminal"
@@ -1308,6 +1378,11 @@
               "valueName": "field",
               "repeatable": true
             },
+            {
+              "name": "input",
+              "description": "A file holding the JSON request body, or - for standard input. A flag given as well replaces its field",
+              "valueName": "path"
+            },
             {
               "name": "json",
               "description": "Print machine-readable output, which is the default when stdout is not a terminal"
@@ -1397,6 +1472,11 @@
               "valueName": "field",
               "repeatable": true
             },
+            {
+              "name": "input",
+              "description": "A file holding the JSON request body, or - for standard input. A flag given as well replaces its field",
+              "valueName": "path"
+            },
             {
               "name": "json",
               "description": "Print machine-readable output, which is the default when stdout is not a terminal"
@@ -1659,6 +1739,11 @@
               "valueName": "field",
               "repeatable": true
             },
+            {
+              "name": "input",
+              "description": "A file holding the JSON request body, or - for standard input. A flag given as well replaces its field",
+              "valueName": "path"
+            },
             {
               "name": "json",
               "description": "Print machine-readable output, which is the default when stdout is not a terminal"
@@ -1734,6 +1819,11 @@
               "valueName": "field",
               "repeatable": true
             },
+            {
+              "name": "input",
+              "description": "A file holding the JSON request body, or - for standard input. A flag given as well replaces its field",
+              "valueName": "path"
+            },
             {
               "name": "json",
               "description": "Print machine-readable output, which is the default when stdout is not a terminal"
@@ -1833,6 +1923,11 @@
                   "valueName": "field",
                   "repeatable": true
                 },
+                {
+                  "name": "input",
+                  "description": "A file holding the JSON request body, or - for standard input. A flag given as well replaces its field",
+                  "valueName": "path"
+                },
                 {
                   "name": "json",
                   "description": "Print machine-readable output, which is the default when stdout is not a terminal"
@@ -1893,6 +1988,11 @@
                   "valueName": "field",
                   "repeatable": true
                 },
+                {
+                  "name": "input",
+                  "description": "A file holding the JSON request body, or - for standard input. A flag given as well replaces its field",
+                  "valueName": "path"
+                },
                 {
                   "name": "json",
                   "description": "Print machine-readable output, which is the default when stdout is not a terminal"
@@ -1919,6 +2019,11 @@
                   "valueName": "field",
                   "repeatable": true
                 },
+                {
+                  "name": "input",
+                  "description": "A file holding the JSON request body, or - for standard input. A flag given as well replaces its field",
+                  "valueName": "path"
+                },
                 {
                   "name": "json",
                   "description": "Print machine-readable output, which is the default when stdout is not a terminal"
@@ -2136,6 +2241,11 @@
               "valueName": "field",
               "repeatable": true
             },
+            {
+              "name": "input",
+              "description": "A file holding the JSON request body, or - for standard input. A flag given as well replaces its field",
+              "valueName": "path"
+            },
             {
               "name": "json",
               "description": "Print machine-readable output, which is the default when stdout is not a terminal"
@@ -2255,6 +2365,11 @@
               "valueName": "field",
               "repeatable": true
             },
+            {
+              "name": "input",
+              "description": "A file holding the JSON request body, or - for standard input. A flag given as well replaces its field",
+              "valueName": "path"
+            },
             {
               "name": "json",
               "description": "Print machine-readable output, which is the default when stdout is not a terminal"
@@ -2366,6 +2481,11 @@
               "valueName": "field",
               "repeatable": true
             },
+            {
+              "name": "input",
+              "description": "A file holding the JSON request body, or - for standard input. A flag given as well replaces its field",
+              "valueName": "path"
+            },
             {
               "name": "json",
               "description": "Print machine-readable output, which is the default when stdout is not a terminal"

package/dist/{program-BZW_50HP.js → program-B02z-kNH.js}

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 
-!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="5c189832-33ce-5032-b0e0-fc3a33cf5b1d")}catch(e){}}();
-import { a as defineCommand, i as GLOBAL_FLAGS, r as ExitCode, t as toInvocation } from "./scrub-VtQmxap1.js";
+!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="b1928379-e7e3-5a7e-9ade-d45695e05814")}catch(e){}}();
+import { a as defineCommand, i as GLOBAL_FLAGS, r as ExitCode, t as toInvocation } from "./scrub-BN3gyBpR.js";
 import { n as toCompletion, t as toAnswer$1 } from "./completion-tree-rR_Rmeij.js";
 import { createRequire } from "node:module";
 import { Command, CommanderError, Option } from "commander";
@@ -694,12 +694,15 @@ const held = /* @__PURE__ */ new Map();
 * unattended caller sets it deliberately, and otherwise the stored refresh token buys an
 * access token that lives only in memory.
 */
-async function toRequestCredential(settings) {
-	if (settings.apiKey) return {
-		header: "X-API-Key",
-		value: settings.apiKey,
-		kind: "api key"
-	};
+async function toRequestCredential(settings, sources) {
+	if (settings.apiKey) {
+		refuseForeignKey(settings, sources);
+		return {
+			header: "X-API-Key",
+			value: settings.apiKey,
+			kind: "api key"
+		};
+	}
 	refuseForeignHost(settings);
 	const stored = toCredential(settings.issuerUrl);
 	if (!stored) throw new NoCredential("not authenticated. Run hardfin login, or set HARDFIN_API_KEY");
@@ -775,6 +778,20 @@ function refuseForeignHost(settings) {
 	if (api.host !== issuer.host) throw new NoCredential(`this sign in belongs to ${issuer.host}, so it is not sent to ${api.host}. Set HARDFIN_API_KEY to call another host, or point --issuer-url at the server that signs you in`);
 	if (api.protocol !== "https:" && !isLoopback(api.hostname)) throw new NoCredential(`${settings.apiUrl} is not https, so a sign in is not sent to it`);
 }
+/** The layers a file in the working directory sets, which a cloned repository can carry. */
+const DIRECTORY_SOURCES = /* @__PURE__ */ new Set(["config file", "env file"]);
+/** refuseForeignKey keeps an API key off plain connections and off hosts a stray file chose. */
+function refuseForeignKey(settings, sources) {
+	const api = toHost$1(settings.apiUrl);
+	if (api === void 0) throw new NoCredential(`${settings.apiUrl} is not a URL this CLI can call`);
+	if (api.protocol !== "https:" && !isLoopback(api.hostname)) throw new NoCredential(`Your API key was not sent, because ${api.host} does not use a secure connection.`);
+	const isKeyChosen = sources?.apiKey !== void 0 && !DIRECTORY_SOURCES.has(sources.apiKey);
+	const isUrlFromFolder = sources?.apiUrl !== void 0 && DIRECTORY_SOURCES.has(sources.apiUrl);
+	if (isKeyChosen && isUrlFromFolder) {
+		const file = sources.apiUrl === "config file" ? CONFIG_FILE : ".env";
+		throw new NoCredential(`Your API key was not sent to ${api.host}, because that address comes from a file in this folder, not from you.\nDetails: the API URL is set in ${file}. Pass --api-url to use it anyway`);
+	}
+}
 function toHost$1(url) {
 	try {
 		return new URL(url);
@@ -790,12 +807,15 @@ function isLoopback(hostname) {
 * an access token this process already holds. An error report uses it, because a refresh
 * cut short by the process ending would spend the refresh token and sign the person out.
 */
-function toHeldCredential(settings) {
-	if (settings.apiKey) return {
-		header: "X-API-Key",
-		value: settings.apiKey,
-		kind: "api key"
-	};
+function toHeldCredential(settings, sources) {
+	if (settings.apiKey) {
+		refuseForeignKey(settings, sources);
+		return {
+			header: "X-API-Key",
+			value: settings.apiKey,
+			kind: "api key"
+		};
+	}
 	const current = held.get(settings.issuerUrl);
 	if (!current || (current.expiresAt ?? 0) - EXPIRY_MARGIN_MS <= Date.now()) return;
 	return {
@@ -966,7 +986,7 @@ function toGuide(commands, version) {
 		"",
 		"## Before calling",
 		"",
-		"- Authenticate by setting `HARDFIN_API_KEY`, or by running `hardfin login`",
+		"- Authenticate with `--api-key`, by setting `HARDFIN_API_KEY`, or by running `hardfin login`",
 		"- Every command prints JSON on stdout and diagnostics on stderr",
 		"- Output is JSON whenever stdout is not a terminal, so no flag is needed when calling from code",
 		"",
@@ -1045,6 +1065,31 @@ function toSummary(command) {
 		subcommands: command.subcommands?.filter((entry) => !entry.hidden).map(toSummary)
 	};
 }
+//#endregion
+//#region src/command/input.ts
+/** InputFailure is a body given with --input that cannot be used, and says why. */
+var InputFailure = class extends Error {
+	constructor(message) {
+		super(message);
+		this.name = "InputFailure";
+	}
+};
+/** toJSONInput reads the JSON a command was given with --input, from a file or from standard input. */
+function toJSONInput(source) {
+	const name = source === "-" ? "standard input" : source;
+	let text;
+	try {
+		text = readFileSync(source === "-" ? 0 : source, "utf8");
+	} catch {
+		return new InputFailure(`${name} cannot be read`);
+	}
+	if (text.trim() === "") return new InputFailure(`${name} is empty, and a body needs JSON`);
+	try {
+		return JSON.parse(text);
+	} catch {
+		return new InputFailure(`${name} does not hold JSON`);
+	}
+}
 const apiCommand = defineCommand({
 	name: "api",
 	summary: "Call a Hardfin API endpoint and print what it answers",
@@ -1122,16 +1167,16 @@ async function runApi(input) {
 	}
 	let body;
 	if (typeof input.flags["input"] === "string") {
-		body = toBody$1(input.flags["input"]);
-		if (body === void 0) {
-			writeFailure("invalid_input", `${input.flags["input"]} does not hold JSON`, input.isJSON);
+		body = toJSONInput(input.flags["input"]);
+		if (body instanceof InputFailure) {
+			writeFailure("invalid_input", body.message, input.isJSON);
 			return ExitCode.USAGE;
 		}
 	}
 	try {
 		writeData((await request$1({
 			apiUrl: input.resolved.settings.apiUrl,
-			credential: await toRequestCredential(input.resolved.settings),
+			credential: await toRequestCredential(input.resolved.settings, input.resolved.sources),
 			method: toText(input.flags["method"] ?? "GET").toUpperCase(),
 			path,
 			query,
@@ -1160,14 +1205,6 @@ function toQuery$1(fields) {
 	}
 	return query;
 }
-function toBody$1(source) {
-	const text = source === "-" ? readFileSync(0, "utf8") : readFileSync(source, "utf8");
-	try {
-		return JSON.parse(text);
-	} catch {
-		return;
-	}
-}
 //#endregion
 //#region src/auth/browser.ts
 /** isWSL reports whether this Linux is running under Windows. */
@@ -2543,7 +2580,7 @@ function toServerReport(metadata) {
 async function toApiReport(resolved, options) {
 	const settings = resolved.settings;
 	try {
-		const credential = options.isHeldOnly ? toHeldCredential(settings) : await toRequestCredential(settings);
+		const credential = options.isHeldOnly ? toHeldCredential(settings, resolved.sources) : await toRequestCredential(settings, resolved.sources);
 		if (!credential) return {
 			checked: false,
 			url: settings.apiUrl,
@@ -2675,7 +2712,7 @@ async function report(error, occasion, resolved) {
 		const settings = resolved ?? toResolved();
 		const status = settings ? await toStatus(settings) : void 0;
 		const secrets = [settings?.settings.apiKey, settings ? toCredential(settings.settings.issuerUrl)?.refreshToken : void 0];
-		return await (await import("./sentry-D5lKx0nm.js")).send({
+		return await (await import("./sentry-CLaeAWNa.js")).send({
 			error,
 			occasion,
 			telemetry,
@@ -2867,7 +2904,7 @@ const REFUSED_COMMANDS = /* @__PURE__ */ new Set([
 	"mcp"
 ]);
 /** The global options, which sit before a command and take a value of their own. */
-const GLOBAL_OPTIONS_WITH_VALUES = /* @__PURE__ */ new Set(["--api-url", "--issuer-url"]);
+const GLOBAL_OPTIONS_WITH_VALUES = new Set(GLOBAL_FLAGS.filter((flag) => flag.valueName).map((flag) => `--${flag.name}`));
 /**
 * toCommandName reads which command a call names. A global option sits before it, so
 * reading the first argument alone would let --issuer-url x logout through.
@@ -3077,6 +3114,12 @@ const UNSET_FLAG = {
 	repeatable: true,
 	schema: z.array(z.string())
 };
+const INPUT_FLAG = {
+	name: "input",
+	description: "A file holding the JSON request body, or - for standard input. A flag given as well replaces its field",
+	valueName: "path",
+	schema: z.string()
+};
 const FILE_FLAG = {
 	name: "file",
 	description: "The file to upload",
@@ -3100,6 +3143,7 @@ function defineOperation(operation) {
 		...operation.queryFlags,
 		...operation.bodyFlags,
 		...operation.bodyFlags.some((flag) => flag.nullable) ? [UNSET_FLAG] : [],
+		...operation.bodyFlags.length > 0 ? [INPUT_FLAG] : [],
 		...operation.upload ? [...operation.upload.fields, FILE_FLAG] : [],
 		...operation.downloads ? [OUTPUT_FLAG] : [],
 		JSON_FLAG
@@ -3127,12 +3171,17 @@ async function runOperation(operation, input) {
 		writeFailure("invalid_arguments", `this command takes ${operation.pathParameters.length} argument(s)`, input.isJSON);
 		return ExitCode.USAGE;
 	}
-	const missing = operation.bodyFlags.concat(operation.upload?.fields ?? []).filter((flag) => flag.required && input.flags[toOptionKey(flag.name)] === void 0);
+	const given = toGivenBody(input.flags["input"]);
+	if (given instanceof InputFailure) {
+		writeFailure("invalid_input", given.message, input.isJSON);
+		return ExitCode.USAGE;
+	}
+	const missing = operation.bodyFlags.concat(operation.upload?.fields ?? []).filter((flag) => flag.required && input.flags[toOptionKey(flag.name)] === void 0 && !hasPath(given, flag.jsonPath));
 	if (missing.length > 0) {
 		writeFailure("missing_flag", `this command needs ${missing.map((flag) => `--${flag.name}`).join(", ")}`, input.isJSON);
 		return ExitCode.USAGE;
 	}
-	const body = toBody(operation, input.flags);
+	const body = toBody(operation, input.flags, given);
 	if (body instanceof Error) {
 		writeFailure("invalid_flag", body.message, input.isJSON);
 		return ExitCode.USAGE;
@@ -3153,7 +3202,7 @@ async function runOperation(operation, input) {
 	try {
 		const envelope = await request$1({
 			apiUrl: input.resolved.settings.apiUrl,
-			credential: await toRequestCredential(input.resolved.settings),
+			credential: await toRequestCredential(input.resolved.settings, input.resolved.sources),
 			method: operation.method,
 			path,
 			query: toQuery(operation, input.flags),
@@ -3241,10 +3290,27 @@ async function toForm(upload, flags) {
 	}
 	return form;
 }
-/** toBody builds the request body from the flags, one field at a time. */
-function toBody(operation, flags) {
-	const body = {};
-	let hasField = false;
+/** toGivenBody reads the --input body, which a generated command takes only as a JSON object. */
+function toGivenBody(source) {
+	if (typeof source !== "string") return;
+	const read = toJSONInput(source);
+	if (read instanceof InputFailure) return read;
+	if (typeof read !== "object" || read === null || Array.isArray(read)) return new InputFailure(`the body in ${source === "-" ? "standard input" : source} must be a JSON object, such as {"name": "Acme"}`);
+	return read;
+}
+/** hasPath reports whether a body already holds a value at a field's path. */
+function hasPath(body, path) {
+	let holder = body;
+	for (const name of path) {
+		if (typeof holder !== "object" || holder === null || !(name in holder)) return false;
+		holder = holder[name];
+	}
+	return true;
+}
+/** toBody builds the request body from the --input body and the flags, a flag winning over its field. */
+function toBody(operation, flags, given) {
+	const body = given ? structuredClone(given) : {};
+	let hasField = given !== void 0;
 	for (const flag of operation.bodyFlags) {
 		const value = flags[toOptionKey(flag.name)];
 		if (value === void 0) continue;
@@ -6060,6 +6126,7 @@ async function toExitCode(root, command, args, flags) {
 	try {
 		resolved = toSettings({
 			apiUrl: root.opts()["apiUrl"],
+			apiKey: root.opts()["apiKey"],
 			issuerUrl: root.opts()["issuerUrl"]
 		});
 		return await command.run?.({
@@ -6101,5 +6168,5 @@ async function toReported(error, isJSON, resolved, level = "error") {
 //#endregion
 export { toCli, toParseExitCode, toReported, wasReportAttempted };
 
-//# sourceMappingURL=program-BZW_50HP.js.map
-//# debugId=5c189832-33ce-5032-b0e0-fc3a33cf5b1d
+//# sourceMappingURL=program-B02z-kNH.js.map
+//# debugId=b1928379-e7e3-5a7e-9ade-d45695e05814

package/dist/{scrub-VtQmxap1.js → scrub-BN3gyBpR.js}

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 
-!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="9fab3688-8d6c-599c-94b2-64daa75cd233")}catch(e){}}();
+!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="3af5060a-b6fe-5f2e-9661-01f4460a7b04")}catch(e){}}();
 import { z } from "zod";
 import { homedir } from "node:os";
 //#region src/command/registry.ts
@@ -17,17 +17,26 @@ function defineCommand(command) {
 	return command;
 }
 /** GLOBAL_FLAGS are the options the CLI takes before any command. */
-const GLOBAL_FLAGS = [{
-	name: "api-url",
-	description: "The API to call, whose host also holds the authorization server",
-	valueName: "url",
-	schema: z.string()
-}, {
-	name: "issuer-url",
-	description: "The authorization server, when it does not sit at the API's host",
-	valueName: "url",
-	schema: z.string()
-}];
+const GLOBAL_FLAGS = [
+	{
+		name: "api-url",
+		description: "The API to call, whose host also holds the authorization server",
+		valueName: "url",
+		schema: z.string()
+	},
+	{
+		name: "api-key",
+		description: "An API key to call with, in place of HARDFIN_API_KEY or a sign in",
+		valueName: "key",
+		schema: z.string()
+	},
+	{
+		name: "issuer-url",
+		description: "The authorization server, when it does not sit at the API's host",
+		valueName: "url",
+		schema: z.string()
+	}
+];
 //#endregion
 //#region src/report/scrub.ts
 const REDACTED = "[redacted]";
@@ -109,5 +118,5 @@ function toFlag(flags, word) {
 //#endregion
 export { defineCommand as a, GLOBAL_FLAGS as i, toScrubbed as n, ExitCode as r, toInvocation as t };
 
-//# sourceMappingURL=scrub-VtQmxap1.js.map
-//# debugId=9fab3688-8d6c-599c-94b2-64daa75cd233
+//# sourceMappingURL=scrub-BN3gyBpR.js.map
+//# debugId=3af5060a-b6fe-5f2e-9661-01f4460a7b04

package/dist/{sentry-D5lKx0nm.js → sentry-CLaeAWNa.js}

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 
-!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="a251c173-a448-5d16-93ea-bc9547e82365")}catch(e){}}();
-import { n as toScrubbed } from "./scrub-VtQmxap1.js";
+!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="853940c3-9e72-566b-ad70-9f043e6aba8d")}catch(e){}}();
+import { n as toScrubbed } from "./scrub-BN3gyBpR.js";
 import { dirname } from "node:path";
 import { request } from "node:http";
 import { fileURLToPath } from "node:url";
@@ -4385,5 +4385,5 @@ function toTags(delivery) {
 //#endregion
 export { send };
 
-//# sourceMappingURL=sentry-D5lKx0nm.js.map
-//# debugId=a251c173-a448-5d16-93ea-bc9547e82365
+//# sourceMappingURL=sentry-CLaeAWNa.js.map
+//# debugId=853940c3-9e72-566b-ad70-9f043e6aba8d

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@hardfin/cli",
-    "version": "0.1.0-dev.30",
+    "version": "0.1.0-dev.32",
     "description": "Command line interface for the Hardfin API",
     "license": "Apache-2.0",
     "author": "Hardfin, Inc.",