@pmate/cli 0.25.8 → 0.25.9

package/dist/index.d.ts

@@ -452,6 +452,47 @@ type AccountCommandArgs = {
     role?: "practitioner" | "mate";
     baseUrl?: string;
     json: boolean;
+} | {
+    type: Command.Account;
+    action: "access-key-create";
+    app: string;
+    name: string;
+    namespace?: string;
+    scopes: string[];
+    expiresAt: string;
+    out?: string;
+    baseUrl?: string;
+    json: boolean;
+} | {
+    type: Command.Account;
+    action: "access-key-list";
+    app?: string;
+    namespace?: string;
+    baseUrl?: string;
+    json: boolean;
+} | {
+    type: Command.Account;
+    action: "access-key-disable";
+    id: string;
+    baseUrl?: string;
+    json: boolean;
+} | {
+    type: Command.Account;
+    action: "access-key-rotate";
+    id: string;
+    expiresAt: string;
+    gracePeriodSeconds?: number;
+    out?: string;
+    baseUrl?: string;
+    json: boolean;
+} | {
+    type: Command.Account;
+    action: "access-key-login";
+    app: string;
+    key?: string;
+    keyFile?: string;
+    baseUrl?: string;
+    json: boolean;
 };
 type OrgCommandArgs = {
     type: Command.Org;

package/dist/index.js

@@ -22303,6 +22303,88 @@ var AccountCommandHandler = class {
         this.renderJson(profile, args.json);
         return;
       }
+      case "access-key-create": {
+        const token = this.readToken();
+        const baseUrl = this.resolveAuthBaseUrl(args.baseUrl);
+        const result = await this.request(
+          baseUrl,
+          token,
+          "POST",
+          "/access-keys",
+          {
+            app: args.app,
+            name: args.name,
+            namespace: args.namespace,
+            scopes: args.scopes,
+            expiresAt: args.expiresAt
+          }
+        );
+        this.persistAccessKeySecret(result, args.out);
+        this.renderAccessKeyCreateResult(result, args.json, args.out);
+        return;
+      }
+      case "access-key-list": {
+        const token = this.readToken();
+        const baseUrl = this.resolveAuthBaseUrl(args.baseUrl);
+        const result = await this.request(
+          baseUrl,
+          token,
+          "GET",
+          `/access-keys?${this.buildAccessKeyListQuery(args)}`
+        );
+        this.renderAccessKeys(result.items, args.json);
+        return;
+      }
+      case "access-key-disable": {
+        const token = this.readToken();
+        const baseUrl = this.resolveAuthBaseUrl(args.baseUrl);
+        const item = await this.request(
+          baseUrl,
+          token,
+          "DELETE",
+          `/access-keys/${encodeURIComponent(args.id)}`
+        );
+        if (!args.json) {
+          ui.success(`Disabled access key ${item.id}`);
+        }
+        this.renderJson(item, args.json);
+        return;
+      }
+      case "access-key-rotate": {
+        const token = this.readToken();
+        const baseUrl = this.resolveAuthBaseUrl(args.baseUrl);
+        const result = await this.request(
+          baseUrl,
+          token,
+          "POST",
+          `/access-keys/${encodeURIComponent(args.id)}/rotate`,
+          {
+            expiresAt: args.expiresAt,
+            gracePeriodSeconds: args.gracePeriodSeconds
+          }
+        );
+        this.persistAccessKeySecret(result, args.out);
+        this.renderAccessKeyCreateResult(result, args.json, args.out);
+        return;
+      }
+      case "access-key-login": {
+        const baseUrl = this.resolveAuthBaseUrl(args.baseUrl);
+        const secret = args.key ?? this.readAccessKeyFile(args.keyFile, args.app).secret;
+        const login = await this.request(
+          baseUrl,
+          secret,
+          "POST",
+          "/access-keys/session",
+          { app: args.app }
+        );
+        const profileId = await this.resolveLoginProfileId(login, args.app, baseUrl);
+        const saved = saveLoginSession({ ...login, profileId }, args.app);
+        if (!args.json) {
+          ui.success(`Logged in access key ${login.session.identity.accessKeyId ?? "unknown"} to ${saved.app}`);
+        }
+        this.renderJson(login, args.json);
+        return;
+      }
     }
   }
   resolveAuthBaseUrl(baseUrl) {
@@ -22344,6 +22426,12 @@ var AccountCommandHandler = class {
     if (args.namespace) params.set("namespace", args.namespace);
     return params.toString();
   }
+  buildAccessKeyListQuery(args) {
+    const params = new URLSearchParams();
+    if (args.app) params.set("app", args.app);
+    if (args.namespace) params.set("namespace", args.namespace);
+    return params.toString();
+  }
   async request(baseUrl, token, method, pathname, body) {
     const response = await fetch(`${baseUrl}${pathname}`, {
       method,
@@ -22501,6 +22589,9 @@ var AccountCommandHandler = class {
   resolveDefaultBotKeyPath(app, name) {
     return import_node_path26.default.join(this.homeDir(), ".pmate", "bots", app, `${name}.bot-key.json`);
   }
+  resolveDefaultAccessKeyPath(app, name) {
+    return import_node_path26.default.join(this.homeDir(), ".pmate", "access-keys", app, `${name}.access-key.json`);
+  }
   homeDir() {
     return process.env.HOME || process.env.USERPROFILE || process.cwd();
   }
@@ -22537,6 +22628,89 @@ var AccountCommandHandler = class {
     }
     return parsed;
   }
+  readAccessKeyFile(filePath, expectedApp) {
+    if (!filePath) {
+      throw new Error("Missing access key file");
+    }
+    const absolutePath = this.resolveFilePath(filePath);
+    if (!(0, import_node_fs22.existsSync)(absolutePath)) {
+      throw new Error(`Access key file not found: ${absolutePath}`);
+    }
+    const parsed = JSON.parse((0, import_node_fs22.readFileSync)(absolutePath, "utf8"));
+    if (parsed.type !== "pmate-access-key" || parsed.version !== 1 || !parsed.id || !parsed.app || !parsed.secret || !parsed.expiresAt) {
+      throw new Error(`Invalid PMate access key file: ${absolutePath}`);
+    }
+    if (expectedApp && parsed.app !== expectedApp) {
+      throw new Error(`Access key app mismatch. expected=${expectedApp}, received=${parsed.app}`);
+    }
+    return parsed;
+  }
+  persistAccessKeySecret(result, out) {
+    const keyFile = {
+      type: "pmate-access-key",
+      version: 1,
+      id: result.key.id,
+      app: result.key.app,
+      name: result.key.name,
+      namespace: result.key.namespace,
+      secret: result.secret,
+      expiresAt: result.key.expiresAt,
+      createdAt: result.key.createdAt
+    };
+    const outPath = out ? this.resolveFilePath(out) : this.resolveDefaultAccessKeyPath(result.key.app, result.key.name);
+    (0, import_node_fs22.mkdirSync)(import_node_path26.default.dirname(outPath), { recursive: true });
+    (0, import_node_fs22.writeFileSync)(outPath, JSON.stringify(keyFile, null, 2), { mode: 384 });
+    (0, import_node_fs22.chmodSync)(outPath, 384);
+  }
+  renderAccessKeyCreateResult(result, asJson, out) {
+    if (asJson) {
+      this.renderJson(result, true);
+      return;
+    }
+    const outPath = out ? this.resolveFilePath(out) : this.resolveDefaultAccessKeyPath(result.key.app, result.key.name);
+    ui.success(`Access key saved to ${outPath}`);
+    ui.info(result.key.id, {
+      app: result.key.app,
+      name: result.key.name,
+      namespace: result.key.namespace,
+      scopes: result.key.scopes,
+      expiresAt: result.key.expiresAt
+    });
+  }
+  renderAccessKeys(items, asJson) {
+    if (asJson) {
+      this.renderJson({ items }, true);
+      return;
+    }
+    if (items.length === 0) {
+      ui.warn("No access keys found.");
+      return;
+    }
+    for (const item of items) {
+      ui.info(item.id, {
+        app: item.app,
+        name: item.name,
+        namespace: item.namespace,
+        scopes: item.scopes,
+        status: item.status,
+        expiresAt: item.expiresAt,
+        lastUsedAt: item.lastUsedAt,
+        rotationExpiresAt: item.rotationExpiresAt
+      });
+    }
+  }
+  async resolveLoginProfileId(login, app, authApiBaseUrl) {
+    try {
+      return await fetchDefaultProfileId({
+        token: login.token,
+        app,
+        accountId: login.session.identity.accountId,
+        authApiBaseUrl
+      });
+    } catch {
+      return login.session.identity.accessKeyId ?? login.session.identity.accountId;
+    }
+  }
   signBotChallenge(challenge, privateKey) {
     const key = (0, import_node_crypto5.createPrivateKey)({
       key: Buffer.from(privateKey, "base64url"),
@@ -25339,6 +25513,104 @@ function parseAccountArgs(tokens) {
     }
     throw new Error(`Unknown account bot action: ${botAction}`);
   }
+  if (action === "access-key") {
+    const keyAction = rest.shift();
+    if (!keyAction) {
+      throw new Error("Missing account access-key action. Use: account access-key create|list|rotate|disable|login");
+    }
+    let app;
+    let id;
+    let name;
+    let namespace2;
+    const scopes = [];
+    let expiresAt;
+    let out;
+    let key;
+    let keyFile;
+    let gracePeriodSeconds;
+    let baseUrl2;
+    let json2 = false;
+    while (rest.length > 0) {
+      const token = rest.shift();
+      switch (token) {
+        case "--app":
+          app = parseNamespacedRef(requireValue8(rest, token), {
+            entityLabel: "app ref"
+          }).fullId;
+          break;
+        case "--name":
+          name = requireValue8(rest, token);
+          break;
+        case "--namespace":
+          namespace2 = requireValue8(rest, token);
+          break;
+        case "--scope":
+          scopes.push(requireValue8(rest, token));
+          break;
+        case "--expires-at":
+          expiresAt = requireValue8(rest, token);
+          break;
+        case "--expires-in":
+          expiresAt = parseExpiresIn(requireValue8(rest, token));
+          break;
+        case "--grace-period":
+          gracePeriodSeconds = parseDurationSeconds(requireValue8(rest, token), token);
+          break;
+        case "--out":
+          out = requireValue8(rest, token);
+          break;
+        case "--key":
+          key = requireValue8(rest, token);
+          break;
+        case "--key-file":
+          keyFile = requireValue8(rest, token);
+          break;
+        case "--base-url":
+          baseUrl2 = requireValue8(rest, token);
+          break;
+        case "--json":
+          json2 = true;
+          break;
+        default:
+          if ((keyAction === "rotate" || keyAction === "disable") && !token.startsWith("-")) {
+            if (id) {
+              throw new Error(`Unexpected account access-key id: ${token}`);
+            }
+            id = token;
+            continue;
+          }
+          throw new Error(`Unknown account access-key option: ${token}`);
+      }
+    }
+    if (keyAction === "create") {
+      if (!app || !name || scopes.length === 0 || !expiresAt) {
+        throw new Error("Usage: account access-key create --app <ns:app> --name <name> --scope <scope>... (--expires-at <iso> | --expires-in <duration>) [--namespace <ns>] [--out <path>] [--base-url <url>] [--json]");
+      }
+      return { type: "account" /* Account */, action: "access-key-create", app, name, namespace: namespace2, scopes, expiresAt, out, baseUrl: baseUrl2, json: json2 };
+    }
+    if (keyAction === "list") {
+      return { type: "account" /* Account */, action: "access-key-list", app, namespace: namespace2, baseUrl: baseUrl2, json: json2 };
+    }
+    if (keyAction === "disable") {
+      if (!id) {
+        throw new Error("Usage: account access-key disable <id> [--base-url <url>] [--json]");
+      }
+      return { type: "account" /* Account */, action: "access-key-disable", id, baseUrl: baseUrl2, json: json2 };
+    }
+    if (keyAction === "rotate") {
+      if (!id || !expiresAt) {
+        throw new Error("Usage: account access-key rotate <id> (--expires-at <iso> | --expires-in <duration>) [--grace-period <duration>] [--out <path>] [--base-url <url>] [--json]");
+      }
+      return { type: "account" /* Account */, action: "access-key-rotate", id, expiresAt, gracePeriodSeconds, out, baseUrl: baseUrl2, json: json2 };
+    }
+    if (keyAction === "login") {
+      if (!app || !key && !keyFile || key && keyFile) {
+        throw new Error("Usage: account access-key login --app <ns:app> (--key <secret> | --key-file <path>) [--base-url <url>] [--json]");
+      }
+      return { type: "account" /* Account */, action: "access-key-login", app, key, keyFile, baseUrl: baseUrl2, json: json2 };
+    }
+    throw new Error(`Unknown account access-key action: ${keyAction}`);
+  }
   if (action !== "role") {
     throw new Error(`Unknown account action: ${action}`);
   }
@@ -25420,6 +25692,19 @@ function parsePositiveInt(value, optionName) {
   }
   return parsed;
 }
+function parseExpiresIn(value) {
+  return new Date(Date.now() + parseDurationSeconds(value, "--expires-in") * 1e3).toISOString();
+}
+function parseDurationSeconds(value, optionName) {
+  const match = /^(\d+)(s|m|h|d)?$/.exec(value.trim());
+  if (!match) {
+    throw new Error(`${optionName} must be a duration like 3600s, 60m, 24h, or 30d`);
+  }
+  const amount = Number(match[1]);
+  const unit = match[2] ?? "s";
+  const multiplier = unit === "d" ? 86400 : unit === "h" ? 3600 : unit === "m" ? 60 : 1;
+  return amount * multiplier;
+}
 
 // src/orgCommandParser.ts
 init_namespacedRef();
@@ -26173,6 +26458,11 @@ var HELP_TEXT = [
   `  ${import_chalk4.default.gray("                  bot list --app <ns:app> [--base-url <url>] [--json]")}`,
   `  ${import_chalk4.default.gray("                  bot login --app <ns:app> --name <name> (--key-file <path> | --private-key <key>) [--base-url <url>] [--json]")}`,
   `  ${import_chalk4.default.gray("                  bot profile create --app <ns:app> --name <name> --nickname <nickname> [--role <role>] [--base-url <url>] [--json]")}`,
+  `  ${import_chalk4.default.gray("                  access-key create --app <ns:app> --name <name> --scope <scope>... (--expires-at <iso> | --expires-in <duration>) [--namespace <ns>] [--out <path>] [--base-url <url>] [--json]")}`,
+  `  ${import_chalk4.default.gray("                  access-key list [--app <ns:app>] [--namespace <ns>] [--base-url <url>] [--json]")}`,
+  `  ${import_chalk4.default.gray("                  access-key rotate <id> (--expires-at <iso> | --expires-in <duration>) [--grace-period <duration>] [--out <path>] [--base-url <url>] [--json]")}`,
+  `  ${import_chalk4.default.gray("                  access-key disable <id> [--base-url <url>] [--json]")}`,
+  `  ${import_chalk4.default.gray("                  access-key login --app <ns:app> (--key <secret> | --key-file <path>) [--base-url <url>] [--json]")}`,
   `  ${import_chalk4.default.gray("                  default base URL: https://auth-api-v2.pmate.chat")}`,
   `  ${import_chalk4.default.cyan("org")}              Manage orgs, org members, and org visible apps via apps-api`,
   `  ${import_chalk4.default.gray("                  list [--base-url <url>] [--json]")}`,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pmate/cli",
-  "version": "0.25.8",
+  "version": "0.25.9",
   "description": "CLI utilities for the pMate project",
   "license": "MIT",
   "bin": {