@lifestreamdynamics/vault-cli 1.2.0 → 1.3.0

package/dist/commands/saml.js

@@ -0,0 +1,220 @@
+import chalk from 'chalk';
+import { getClientAsync } from '../client.js';
+import { addGlobalFlags, resolveFlags } from '../utils/flags.js';
+import { createOutput, handleError } from '../utils/output.js';
+export function registerSamlCommands(program) {
+    const saml = program.command('saml').description('SAML SSO configuration management (requires admin role)');
+    // ── list-configs ─────────────────────────────────────────────────────────
+    addGlobalFlags(saml.command('list-configs')
+        .description('List all SSO configurations'))
+        .action(async (_opts) => {
+        const flags = resolveFlags(_opts);
+        const out = createOutput(flags);
+        out.startSpinner('Fetching SSO configs...');
+        try {
+            const client = await getClientAsync();
+            const configs = await client.saml.listConfigs();
+            out.stopSpinner();
+            if (configs.length === 0 && flags.output !== 'json') {
+                out.raw('No SSO configurations found.\n');
+            }
+            else {
+                out.list(configs.map((c) => ({
+                    id: c.id,
+                    domain: c.domain,
+                    slug: c.slug,
+                    entityId: c.entityId,
+                    ssoUrl: c.ssoUrl,
+                })), {
+                    columns: [
+                        { key: 'id', header: 'ID' },
+                        { key: 'domain', header: 'Domain' },
+                        { key: 'slug', header: 'Slug' },
+                        { key: 'entityId', header: 'Entity ID' },
+                        { key: 'ssoUrl', header: 'SSO URL' },
+                    ],
+                    textFn: (c) => `${chalk.cyan(String(c.domain))} ${chalk.dim(`[${String(c.slug)}]`)} — ${chalk.dim(String(c.ssoUrl))}`,
+                });
+            }
+        }
+        catch (err) {
+            handleError(out, err, 'Failed to fetch SSO configs');
+        }
+    });
+    // ── get-config ───────────────────────────────────────────────────────────
+    addGlobalFlags(saml.command('get-config')
+        .description('Get a single SSO configuration by ID')
+        .argument('<id>', 'SSO config ID'))
+        .action(async (id, _opts) => {
+        const flags = resolveFlags(_opts);
+        const out = createOutput(flags);
+        out.startSpinner('Fetching SSO config...');
+        try {
+            const client = await getClientAsync();
+            const config = await client.saml.getConfig(id);
+            out.stopSpinner();
+            out.record({
+                id: config.id,
+                domain: config.domain,
+                slug: config.slug,
+                entityId: config.entityId,
+                ssoUrl: config.ssoUrl,
+                spEntityId: config.spEntityId,
+                createdAt: config.createdAt,
+                updatedAt: config.updatedAt,
+            });
+        }
+        catch (err) {
+            handleError(out, err, 'Failed to fetch SSO config');
+        }
+    });
+    // ── create-config ─────────────────────────────────────────────────────────
+    addGlobalFlags(saml.command('create-config')
+        .description('Create a new SSO configuration')
+        .requiredOption('--domain <domain>', 'Customer/tenant domain (e.g. acmecorp.com)')
+        .requiredOption('--slug <slug>', 'URL slug for SAML endpoints (e.g. acmecorp)')
+        .requiredOption('--entity-id <entityId>', 'Identity Provider entity ID URI')
+        .requiredOption('--sso-url <ssoUrl>', 'Identity Provider Single Sign-On URL')
+        .requiredOption('--certificate <cert>', 'X.509 certificate (PEM-encoded)')
+        .option('--sp-entity-id <spEntityId>', 'Optional Service Provider entity ID override'))
+        .action(async (_opts) => {
+        const flags = resolveFlags(_opts);
+        const out = createOutput(flags);
+        out.startSpinner('Creating SSO config...');
+        try {
+            const client = await getClientAsync();
+            const created = await client.saml.createConfig({
+                domain: _opts.domain,
+                slug: _opts.slug,
+                entityId: _opts.entityId,
+                ssoUrl: _opts.ssoUrl,
+                certificate: _opts.certificate,
+                spEntityId: _opts.spEntityId,
+            });
+            out.stopSpinner();
+            if (flags.output === 'json') {
+                out.raw(JSON.stringify(created, null, 2) + '\n');
+            }
+            else {
+                out.raw(chalk.green(`SSO config created for ${created.domain} (${created.id})`) + '\n');
+            }
+        }
+        catch (err) {
+            handleError(out, err, 'Failed to create SSO config');
+        }
+    });
+    // ── update-config ─────────────────────────────────────────────────────────
+    addGlobalFlags(saml.command('update-config')
+        .description('Update an existing SSO configuration')
+        .argument('<id>', 'SSO config ID')
+        .option('--domain <domain>', 'Updated customer domain')
+        .option('--slug <slug>', 'Updated URL slug')
+        .option('--entity-id <entityId>', 'Updated Identity Provider entity ID')
+        .option('--sso-url <ssoUrl>', 'Updated Identity Provider SSO URL')
+        .option('--certificate <cert>', 'Updated X.509 certificate')
+        .option('--sp-entity-id <spEntityId>', 'Updated Service Provider entity ID'))
+        .action(async (id, _opts) => {
+        const flags = resolveFlags(_opts);
+        const out = createOutput(flags);
+        const data = {};
+        if (_opts.domain)
+            data.domain = _opts.domain;
+        if (_opts.slug)
+            data.slug = _opts.slug;
+        if (_opts.entityId)
+            data.entityId = _opts.entityId;
+        if (_opts.ssoUrl)
+            data.ssoUrl = _opts.ssoUrl;
+        if (_opts.certificate)
+            data.certificate = _opts.certificate;
+        if (_opts.spEntityId)
+            data.spEntityId = _opts.spEntityId;
+        if (Object.keys(data).length === 0) {
+            out.error('No updates specified. Use --domain, --slug, --entity-id, --sso-url, --certificate, or --sp-entity-id.');
+            process.exitCode = 2;
+            return;
+        }
+        out.startSpinner('Updating SSO config...');
+        try {
+            const client = await getClientAsync();
+            const updated = await client.saml.updateConfig(id, data);
+            out.stopSpinner();
+            if (flags.output === 'json') {
+                out.raw(JSON.stringify(updated, null, 2) + '\n');
+            }
+            else {
+                out.raw(chalk.green(`SSO config updated: ${updated.domain} (${updated.id})`) + '\n');
+            }
+        }
+        catch (err) {
+            handleError(out, err, 'Failed to update SSO config');
+        }
+    });
+    // ── delete-config ─────────────────────────────────────────────────────────
+    addGlobalFlags(saml.command('delete-config')
+        .description('Delete an SSO configuration')
+        .argument('<id>', 'SSO config ID')
+        .option('--force', 'Skip confirmation prompt'))
+        .action(async (id, _opts) => {
+        const flags = resolveFlags(_opts);
+        const out = createOutput(flags);
+        if (!_opts.force) {
+            out.raw(chalk.yellow(`Pass --force to delete SSO config ${id}.`) + '\n');
+            return;
+        }
+        out.startSpinner('Deleting SSO config...');
+        try {
+            const client = await getClientAsync();
+            await client.saml.deleteConfig(id);
+            out.stopSpinner();
+            out.raw(chalk.green(`SSO config ${id} deleted.`) + '\n');
+        }
+        catch (err) {
+            handleError(out, err, 'Failed to delete SSO config');
+        }
+    });
+    // ── metadata ──────────────────────────────────────────────────────────────
+    addGlobalFlags(saml.command('metadata')
+        .description('Show Service Provider metadata XML for an IdP slug')
+        .argument('<slug>', 'IdP slug'))
+        .action(async (slug, _opts) => {
+        const flags = resolveFlags(_opts);
+        const out = createOutput(flags);
+        out.startSpinner('Fetching SP metadata...');
+        try {
+            const client = await getClientAsync();
+            const xml = await client.saml.getMetadata(slug);
+            out.stopSpinner();
+            if (flags.output === 'json') {
+                out.raw(JSON.stringify({ xml }, null, 2) + '\n');
+            }
+            else {
+                out.raw(xml + '\n');
+            }
+        }
+        catch (err) {
+            handleError(out, err, 'Failed to fetch SP metadata');
+        }
+    });
+    // ── login-url ─────────────────────────────────────────────────────────────
+    addGlobalFlags(saml.command('login-url')
+        .description('Show the IdP login redirect URL for a slug')
+        .argument('<slug>', 'IdP slug'))
+        .action(async (slug, _opts) => {
+        const flags = resolveFlags(_opts);
+        const out = createOutput(flags);
+        try {
+            const client = await getClientAsync();
+            const url = client.saml.getLoginUrl(slug);
+            if (flags.output === 'json') {
+                out.raw(JSON.stringify({ url }, null, 2) + '\n');
+            }
+            else {
+                out.raw(url + '\n');
+            }
+        }
+        catch (err) {
+            handleError(out, err, 'Failed to build login URL');
+        }
+    });
+}

package/dist/commands/scim.d.ts

@@ -0,0 +1,2 @@
+import type { Command } from 'commander';
+export declare function registerScimCommands(program: Command): void;

package/dist/commands/scim.js

@@ -0,0 +1,238 @@
+import chalk from 'chalk';
+import { getClientAsync } from '../client.js';
+import { addGlobalFlags, resolveFlags } from '../utils/flags.js';
+import { createOutput, handleError } from '../utils/output.js';
+export function registerScimCommands(program) {
+    const scim = program.command('scim').description('SCIM 2.0 user provisioning management (requires scimToken)');
+    // ── list-users ────────────────────────────────────────────────────────────
+    addGlobalFlags(scim.command('list-users')
+        .description('List SCIM-provisioned users')
+        .option('--filter <expr>', 'SCIM filter expression (e.g. \'userName eq "user@example.com"\')')
+        .option('--start-index <n>', 'Pagination start index (1-based)', parseInt)
+        .option('--count <n>', 'Number of results per page (max 100)', parseInt))
+        .action(async (_opts) => {
+        const flags = resolveFlags(_opts);
+        const out = createOutput(flags);
+        out.startSpinner('Fetching SCIM users...');
+        try {
+            const client = await getClientAsync();
+            if (!client.scim) {
+                out.error('SCIM resource is not configured. Provide a scimToken when creating the client.');
+                process.exitCode = 1;
+                return;
+            }
+            const result = await client.scim.listUsers({
+                filter: _opts.filter,
+                startIndex: _opts.startIndex,
+                count: _opts.count,
+            });
+            out.stopSpinner();
+            if (flags.output !== 'json') {
+                out.status(chalk.dim(`Total: ${result.totalResults}  Start: ${result.startIndex}  Page: ${result.itemsPerPage}`));
+            }
+            out.list(result.Resources.map((u) => ({
+                id: u.id,
+                userName: u.userName,
+                name: u.name.formatted,
+                active: u.active ? 'yes' : 'no',
+                externalId: u.externalId ?? '',
+            })), {
+                emptyMessage: 'No SCIM users found.',
+                columns: [
+                    { key: 'id', header: 'ID' },
+                    { key: 'userName', header: 'Username' },
+                    { key: 'name', header: 'Name' },
+                    { key: 'active', header: 'Active' },
+                    { key: 'externalId', header: 'External ID' },
+                ],
+                textFn: (u) => `${chalk.cyan(String(u.userName))} ${chalk.dim(`(${String(u.id)})`)} — ${u.name} — ${u.active === 'yes' ? chalk.green('active') : chalk.red('inactive')}`,
+            });
+        }
+        catch (err) {
+            handleError(out, err, 'Failed to list SCIM users');
+        }
+    });
+    // ── get-user ──────────────────────────────────────────────────────────────
+    addGlobalFlags(scim.command('get-user')
+        .description('Get a SCIM user by internal ID')
+        .argument('<id>', 'Internal user ID'))
+        .action(async (id, _opts) => {
+        const flags = resolveFlags(_opts);
+        const out = createOutput(flags);
+        out.startSpinner('Fetching SCIM user...');
+        try {
+            const client = await getClientAsync();
+            if (!client.scim) {
+                out.error('SCIM resource is not configured. Provide a scimToken when creating the client.');
+                process.exitCode = 1;
+                return;
+            }
+            const user = await client.scim.getUser(id);
+            out.stopSpinner();
+            out.record({
+                id: user.id,
+                userName: user.userName,
+                givenName: user.name.givenName,
+                familyName: user.name.familyName,
+                email: user.emails[0]?.value ?? '',
+                active: user.active,
+                externalId: user.externalId,
+                created: user.meta.created,
+                lastModified: user.meta.lastModified,
+            });
+        }
+        catch (err) {
+            handleError(out, err, 'Failed to fetch SCIM user');
+        }
+    });
+    // ── create-user ───────────────────────────────────────────────────────────
+    addGlobalFlags(scim.command('create-user')
+        .description('Provision a new user via SCIM')
+        .requiredOption('--user-name <userName>', 'Login name (email address)')
+        .requiredOption('--email <email>', 'Primary email address')
+        .option('--given-name <name>', 'First/given name')
+        .option('--family-name <name>', 'Last/family name')
+        .option('--external-id <id>', 'External IdP subject ID'))
+        .action(async (_opts) => {
+        const flags = resolveFlags(_opts);
+        const out = createOutput(flags);
+        out.startSpinner('Creating SCIM user...');
+        try {
+            const client = await getClientAsync();
+            if (!client.scim) {
+                out.error('SCIM resource is not configured. Provide a scimToken when creating the client.');
+                process.exitCode = 1;
+                return;
+            }
+            const created = await client.scim.createUser({
+                userName: _opts.userName,
+                emails: [{ value: _opts.email, primary: true }],
+                name: {
+                    givenName: _opts.givenName,
+                    familyName: _opts.familyName,
+                },
+                externalId: _opts.externalId,
+            });
+            out.stopSpinner();
+            if (flags.output === 'json') {
+                out.raw(JSON.stringify(created, null, 2) + '\n');
+            }
+            else {
+                out.raw(chalk.green(`SCIM user created: ${created.userName} (${created.id})`) + '\n');
+            }
+        }
+        catch (err) {
+            handleError(out, err, 'Failed to create SCIM user');
+        }
+    });
+    // ── update-user ───────────────────────────────────────────────────────────
+    addGlobalFlags(scim.command('update-user')
+        .description('Update a SCIM user (full replace)')
+        .argument('<id>', 'Internal user ID')
+        .option('--user-name <userName>', 'Updated login name')
+        .option('--email <email>', 'Updated primary email')
+        .option('--given-name <name>', 'Updated first/given name')
+        .option('--family-name <name>', 'Updated last/family name'))
+        .action(async (id, _opts) => {
+        const flags = resolveFlags(_opts);
+        const out = createOutput(flags);
+        const data = {};
+        if (_opts.userName)
+            data.userName = _opts.userName;
+        if (_opts.email)
+            data.emails = [{ value: _opts.email, primary: true }];
+        if (_opts.givenName || _opts.familyName) {
+            data.name = {
+                givenName: _opts.givenName,
+                familyName: _opts.familyName,
+            };
+        }
+        if (Object.keys(data).length === 0) {
+            out.error('No updates specified. Use --user-name, --email, --given-name, or --family-name.');
+            process.exitCode = 2;
+            return;
+        }
+        out.startSpinner('Updating SCIM user...');
+        try {
+            const client = await getClientAsync();
+            if (!client.scim) {
+                out.error('SCIM resource is not configured. Provide a scimToken when creating the client.');
+                process.exitCode = 1;
+                return;
+            }
+            const updated = await client.scim.updateUser(id, data);
+            out.stopSpinner();
+            if (flags.output === 'json') {
+                out.raw(JSON.stringify(updated, null, 2) + '\n');
+            }
+            else {
+                out.raw(chalk.green(`SCIM user updated: ${updated.userName} (${updated.id})`) + '\n');
+            }
+        }
+        catch (err) {
+            handleError(out, err, 'Failed to update SCIM user');
+        }
+    });
+    // ── delete-user ───────────────────────────────────────────────────────────
+    addGlobalFlags(scim.command('delete-user')
+        .description('Deprovision a SCIM user (removes SSO bindings)')
+        .argument('<id>', 'Internal user ID')
+        .option('--force', 'Skip confirmation prompt'))
+        .action(async (id, _opts) => {
+        const flags = resolveFlags(_opts);
+        const out = createOutput(flags);
+        if (!_opts.force) {
+            out.raw(chalk.yellow(`Pass --force to deprovision SCIM user ${id}.`) + '\n');
+            return;
+        }
+        out.startSpinner('Deprovisioning SCIM user...');
+        try {
+            const client = await getClientAsync();
+            if (!client.scim) {
+                out.error('SCIM resource is not configured. Provide a scimToken when creating the client.');
+                process.exitCode = 1;
+                return;
+            }
+            await client.scim.deleteUser(id);
+            out.stopSpinner();
+            out.raw(chalk.green(`SCIM user ${id} deprovisioned.`) + '\n');
+        }
+        catch (err) {
+            handleError(out, err, 'Failed to deprovision SCIM user');
+        }
+    });
+    // ── service-config ────────────────────────────────────────────────────────
+    addGlobalFlags(scim.command('service-config')
+        .description('Show SCIM service provider capabilities'))
+        .action(async (_opts) => {
+        const flags = resolveFlags(_opts);
+        const out = createOutput(flags);
+        out.startSpinner('Fetching SCIM service provider config...');
+        try {
+            const client = await getClientAsync();
+            if (!client.scim) {
+                out.error('SCIM resource is not configured. Provide a scimToken when creating the client.');
+                process.exitCode = 1;
+                return;
+            }
+            const config = await client.scim.getServiceProviderConfig();
+            out.stopSpinner();
+            if (flags.output === 'json') {
+                out.raw(JSON.stringify(config, null, 2) + '\n');
+            }
+            else {
+                out.record({
+                    patch: String(config.patch.supported),
+                    bulk: String(config.bulk.supported),
+                    filter: String(config.filter.supported),
+                    filterMaxResults: String(config.filter.maxResults),
+                    changePassword: String(config.changePassword.supported),
+                    sort: String(config.sort.supported),
+                });
+            }
+        }
+        catch (err) {
+            handleError(out, err, 'Failed to fetch SCIM service provider config');
+        }
+    });
+}

package/dist/commands/shares.js

@@ -2,6 +2,7 @@ import chalk from 'chalk';
 import { getClientAsync } from '../client.js';
 import { addGlobalFlags, resolveFlags } from '../utils/flags.js';
 import { createOutput, handleError } from '../utils/output.js';
+import { promptPassword, readPasswordFromStdin } from '../utils/prompt.js';
 export function registerShareCommands(program) {
     const shares = program.command('shares').description('Create, list, and revoke document share links');
     addGlobalFlags(shares.command('list')
@@ -55,20 +56,41 @@ export function registerShareCommands(program) {
         .argument('<vaultId>', 'Vault ID')
         .argument('<docPath>', 'Document path (e.g., notes/meeting.md)')
         .option('--permission <perm>', 'Permission level: view or edit', 'view')
-        .option('--password <password>', 'Password to protect the link')
+        .option('--protect-with-password', 'Prompt for a password to protect the link (interactive TTY only)')
+        .option('--password-stdin', 'Read link password from stdin for CI usage')
         .option('--expires <date>', 'Expiration date (ISO 8601)')
         .option('--max-views <count>', 'Maximum number of views'))
         .action(async (vaultId, docPath, _opts) => {
         const flags = resolveFlags(_opts);
         const out = createOutput(flags);
+        // Resolve optional link password without exposing it in the process list.
+        let linkPassword;
+        if (_opts.passwordStdin) {
+            const pw = await readPasswordFromStdin();
+            if (!pw) {
+                out.error('--password-stdin was set but no password was provided on stdin.');
+                process.exitCode = 1;
+                return;
+            }
+            linkPassword = pw;
+        }
+        else if (_opts.protectWithPassword) {
+            const pw = await promptPassword('Share link password: ');
+            if (!pw) {
+                out.error('A password is required when --protect-with-password is set.');
+                process.exitCode = 1;
+                return;
+            }
+            linkPassword = pw;
+        }
         out.startSpinner('Creating share link...');
         try {
             const client = await getClientAsync();
             const params = {};
             if (_opts.permission)
                 params.permission = String(_opts.permission);
-            if (_opts.password)
-                params.password = String(_opts.password);
+            if (linkPassword)
+                params.password = linkPassword;
             if (_opts.expires)
                 params.expiresAt = String(_opts.expires);
             if (_opts.maxViews)

package/dist/commands/subscription.js

@@ -3,6 +3,7 @@ import { getClientAsync } from '../client.js';
 import { addGlobalFlags, resolveFlags } from '../utils/flags.js';
 import { createOutput, handleError } from '../utils/output.js';
 import { formatBytes } from '../utils/format.js';
+import { confirmAction } from '../utils/confirm.js';
 export function registerSubscriptionCommands(program) {
     const sub = program.command('subscription').description('View plans, manage subscription, and access billing');
     addGlobalFlags(sub.command('status')
@@ -98,12 +99,18 @@ EXAMPLES
     });
     addGlobalFlags(sub.command('cancel')
         .description('Cancel your current subscription')
-        .option('--reason <text>', 'Reason for cancellation'))
+        .option('--reason <text>', 'Reason for cancellation')
+        .option('-y, --yes', 'Skip confirmation prompt'))
         .action(async (_opts) => {
         const flags = resolveFlags(_opts);
         const out = createOutput(flags);
-        out.startSpinner('Cancelling subscription...');
         try {
+            const confirmed = await confirmAction('Are you sure you want to cancel your subscription?', { yes: _opts.yes });
+            if (!confirmed) {
+                out.status('Cancellation aborted.');
+                return;
+            }
+            out.startSpinner('Cancelling subscription...');
             const client = await getClientAsync();
             await client.subscription.cancel(_opts.reason);
             out.success('Subscription cancelled', { cancelled: true });

package/dist/commands/sync.js

@@ -35,6 +35,9 @@ export function registerSyncCommands(program) {
             const absPath = path.resolve(localPath);
             const mode = _opts.mode ?? 'sync';
             const onConflict = _opts.onConflict ?? 'newer';
+            if (!_opts.onConflict) {
+                out.warn('No --on-conflict strategy specified; defaulting to "newer" (keeps the file with the more recent modification time). Use --on-conflict local|remote|ask to override.');
+            }
             const ignore = _opts.ignore;
             const syncInterval = _opts.interval;
             const autoSync = _opts.autoSync === true;