@proappstore/cli 2.6.3 → 2.6.4

package/dist/index.js

@@ -10,6 +10,8 @@ import { loginCommand } from './login.js';
 import { logoutCommand } from './logout.js';
 import { whoamiCommand } from './whoami.js';
 import { publishApp } from './publish.js';
+import { secretCommand } from './secret.js';
+import { proxyCommand } from './proxy.js';
 const __dirname = dirname(fileURLToPath(import.meta.url));
 const pkg = JSON.parse(readFileSync(join(__dirname, '..', 'package.json'), 'utf8'));
 const program = new Command();
@@ -46,6 +48,8 @@ program
 });
 program.addCommand(checkCommand);
 program.addCommand(domainCommand);
+program.addCommand(secretCommand);
+program.addCommand(proxyCommand);
 program.parseAsync().catch((err) => {
     const msg = err instanceof Error ? err.message : String(err);
     process.stderr.write(`pas: ${msg}\n`);

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";AACA,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAC1C,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AACxC,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAC5C,OAAO,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAC1C,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAC5C,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAC5C,OAAO,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAE1C,MAAM,SAAS,GAAG,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;AAC1D,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,CAAC,SAAS,EAAE,IAAI,EAAE,cAAc,CAAC,EAAE,MAAM,CAAC,CAAwB,CAAC;AAE3G,MAAM,OAAO,GAAG,IAAI,OAAO,EAAE,CAAC;AAE9B,OAAO;KACJ,IAAI,CAAC,KAAK,CAAC;KACX,WAAW,CAAC,0DAA0D,CAAC;KACvE,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;AAExB,OAAO;KACJ,OAAO,CAAC,iBAAiB,CAAC;KAC1B,WAAW,CAAC,4FAA4F,CAAC;KACzG,MAAM,CAAC,gBAAgB,EAAE,mBAAmB,CAAC;KAC7C,MAAM,CAAC,YAAY,EAAE,eAAe,CAAC;KACrC,MAAM,CAAC,kBAAkB,EAAE,iCAAiC,CAAC;KAC7D,MAAM,CAAC,iBAAiB,EAAE,kDAAkD,CAAC;KAC7E,MAAM,CAAC,qBAAqB,EAAE,oDAAoD,CAAC;KACnF,MAAM,CAAC,KAAK,EAAE,KAAa,EAAE,IAA0G,EAAE,EAAE;IAC1I,MAAM,SAAS,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;AAC/B,CAAC,CAAC,CAAC;AAEL,OAAO,CAAC,UAAU,CAAC,YAAY,CAAC,CAAC;AACjC,OAAO,CAAC,UAAU,CAAC,aAAa,CAAC,CAAC;AAClC,OAAO,CAAC,UAAU,CAAC,aAAa,CAAC,CAAC;AAElC,OAAO;KACJ,OAAO,CAAC,SAAS,CAAC;KAClB,WAAW,CAAC,iFAAiF,CAAC;KAC9F,MAAM,CAAC,eAAe,EAAE,4DAA4D,CAAC;KACrF,MAAM,CAAC,uBAAuB,EAAE,iDAAiD,CAAC;KAClF,MAAM,CAAC,6BAA6B,EAAE,8CAA8C,CAAC;KACrF,MAAM,CAAC,eAAe,EAAE,oCAAoC,CAAC;KAC7D,MAAM,CAAC,mBAAmB,EAAE,2BAA2B,CAAC;KACxD,MAAM,CAAC,uBAAuB,EAAE,+DAA+D,CAAC;KAChG,MAAM,CAAC,iBAAiB,EAAE,kDAAkD,CAAC;KAC7E,MAAM,CAAC,KAAK,EAAE,IAAsI,EAAE,EAAE;IACvJ,MAAM,UAAU,CAAC,IAAI,CAAC,CAAC;AACzB,CAAC,CAAC,CAAC;AAEL,OAAO,CAAC,UAAU,CAAC,YAAY,CAAC,CAAC;AACjC,OAAO,CAAC,UAAU,CAAC,aAAa,CAAC,CAAC;AAElC,OAAO,CAAC,UAAU,EAAE,CAAC,KAAK,CAAC,CAAC,GAAY,EAAE,EAAE;IAC1C,MAAM,GAAG,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IAC7D,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,QAAQ,GAAG,IAAI,CAAC,CAAC;IACtC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC,CAAC,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";AACA,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAC1C,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AACxC,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAC5C,OAAO,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAC1C,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAC5C,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAC5C,OAAO,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAC1C,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAC5C,OAAO,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAE1C,MAAM,SAAS,GAAG,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;AAC1D,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,CAAC,SAAS,EAAE,IAAI,EAAE,cAAc,CAAC,EAAE,MAAM,CAAC,CAAwB,CAAC;AAE3G,MAAM,OAAO,GAAG,IAAI,OAAO,EAAE,CAAC;AAE9B,OAAO;KACJ,IAAI,CAAC,KAAK,CAAC;KACX,WAAW,CAAC,0DAA0D,CAAC;KACvE,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;AAExB,OAAO;KACJ,OAAO,CAAC,iBAAiB,CAAC;KAC1B,WAAW,CAAC,4FAA4F,CAAC;KACzG,MAAM,CAAC,gBAAgB,EAAE,mBAAmB,CAAC;KAC7C,MAAM,CAAC,YAAY,EAAE,eAAe,CAAC;KACrC,MAAM,CAAC,kBAAkB,EAAE,iCAAiC,CAAC;KAC7D,MAAM,CAAC,iBAAiB,EAAE,kDAAkD,CAAC;KAC7E,MAAM,CAAC,qBAAqB,EAAE,oDAAoD,CAAC;KACnF,MAAM,CAAC,KAAK,EAAE,KAAa,EAAE,IAA0G,EAAE,EAAE;IAC1I,MAAM,SAAS,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;AAC/B,CAAC,CAAC,CAAC;AAEL,OAAO,CAAC,UAAU,CAAC,YAAY,CAAC,CAAC;AACjC,OAAO,CAAC,UAAU,CAAC,aAAa,CAAC,CAAC;AAClC,OAAO,CAAC,UAAU,CAAC,aAAa,CAAC,CAAC;AAElC,OAAO;KACJ,OAAO,CAAC,SAAS,CAAC;KAClB,WAAW,CAAC,iFAAiF,CAAC;KAC9F,MAAM,CAAC,eAAe,EAAE,4DAA4D,CAAC;KACrF,MAAM,CAAC,uBAAuB,EAAE,iDAAiD,CAAC;KAClF,MAAM,CAAC,6BAA6B,EAAE,8CAA8C,CAAC;KACrF,MAAM,CAAC,eAAe,EAAE,oCAAoC,CAAC;KAC7D,MAAM,CAAC,mBAAmB,EAAE,2BAA2B,CAAC;KACxD,MAAM,CAAC,uBAAuB,EAAE,+DAA+D,CAAC;KAChG,MAAM,CAAC,iBAAiB,EAAE,kDAAkD,CAAC;KAC7E,MAAM,CAAC,KAAK,EAAE,IAAsI,EAAE,EAAE;IACvJ,MAAM,UAAU,CAAC,IAAI,CAAC,CAAC;AACzB,CAAC,CAAC,CAAC;AAEL,OAAO,CAAC,UAAU,CAAC,YAAY,CAAC,CAAC;AACjC,OAAO,CAAC,UAAU,CAAC,aAAa,CAAC,CAAC;AAClC,OAAO,CAAC,UAAU,CAAC,aAAa,CAAC,CAAC;AAClC,OAAO,CAAC,UAAU,CAAC,YAAY,CAAC,CAAC;AAEjC,OAAO,CAAC,UAAU,EAAE,CAAC,KAAK,CAAC,CAAC,GAAY,EAAE,EAAE;IAC1C,MAAM,GAAG,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IAC7D,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,QAAQ,GAAG,IAAI,CAAC,CAAC;IACtC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC,CAAC,CAAC"}

package/dist/proxy.d.ts

@@ -0,0 +1,7 @@
+import { Command } from 'commander';
+export declare function parseInject(s: string): {
+    kind: 'query' | 'header' | 'bearer' | 'oauth2_cc';
+    name: string;
+};
+export declare const proxyCommand: Command;
+//# sourceMappingURL=proxy.d.ts.map

package/dist/proxy.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"proxy.d.ts","sourceRoot":"","sources":["../src/proxy.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAcpC,wBAAgB,WAAW,CAAC,CAAC,EAAE,MAAM,GAAG;IACtC,IAAI,EAAE,OAAO,GAAG,QAAQ,GAAG,QAAQ,GAAG,WAAW,CAAC;IAClD,IAAI,EAAE,MAAM,CAAC;CACd,CAQA;AAED,eAAO,MAAM,YAAY,SAoGtB,CAAC"}

package/dist/proxy.js

@@ -0,0 +1,107 @@
+import { Command } from 'commander';
+import { bearer, dieFromHttp, requireSession, resolveAppIdOrExit } from './secret.js';
+export function parseInject(s) {
+    if (s === 'bearer')
+        return { kind: 'bearer', name: '' };
+    if (s === 'oauth2_cc')
+        return { kind: 'oauth2_cc', name: '' };
+    const m = /^(query|header):(.+)$/.exec(s);
+    if (!m) {
+        throw new Error(`--inject must be 'bearer', 'oauth2_cc', 'query:<name>', or 'header:<name>' (got ${s})`);
+    }
+    return { kind: m[1], name: m[2] };
+}
+export const proxyCommand = new Command('proxy')
+    .description('Manage the URL allowlist for the per-app secret-injecting proxy.')
+    .addCommand(new Command('allow')
+    .description('Allow the proxy to inject <secret> when calling URLs starting with <pattern>.')
+    .argument('<pattern>', 'URL prefix (must start with https://)')
+    .requiredOption('--secret <name>', 'name of a previously stored secret')
+    .requiredOption('--inject <spec>', "how to inject: 'query:<name>', 'header:<name>', 'bearer', or 'oauth2_cc'")
+    .option('--secret2 <name>', 'second secret (client_secret for oauth2_cc)')
+    .option('--token-url <url>', 'OAuth2 token endpoint (required for oauth2_cc)')
+    .option('--methods <list>', 'comma-separated HTTP methods', 'GET')
+    .option('--app <id>', 'app id (defaults to package.json name in cwd)')
+    .action(async (pattern, opts) => {
+    const cfg = await requireSession();
+    const appId = await resolveAppIdOrExit(opts.app);
+    let inject;
+    try {
+        inject = parseInject(opts.inject);
+    }
+    catch (err) {
+        process.stderr.write(`pas: ${err.message}\n`);
+        process.exit(1);
+    }
+    const res = await fetch(`${cfg.apiBase}/v1/apps/${appId}/allowlist`, {
+        method: 'PUT',
+        headers: bearer(cfg),
+        body: JSON.stringify({
+            pattern,
+            injectKind: inject.kind,
+            injectName: inject.name,
+            secretName: opts.secret,
+            ...(opts.secret2 ? { secretName2: opts.secret2 } : {}),
+            ...(opts.tokenUrl ? { tokenUrl: opts.tokenUrl } : {}),
+            methods: opts.methods
+                .split(',')
+                .map((m) => m.trim())
+                .filter(Boolean),
+        }),
+    });
+    if (!res.ok)
+        await dieFromHttp(res, 'add allowlist rule');
+    process.stdout.write(`✓ allowed ${pattern} for ${appId}\n`);
+}))
+    .addCommand(new Command('list')
+    .alias('ls')
+    .description('Show the proxy allowlist for an app.')
+    .option('--app <id>', 'app id (defaults to package.json name in cwd)')
+    .option('--json', 'Output JSON.')
+    .action(async (opts) => {
+    const cfg = await requireSession();
+    const appId = await resolveAppIdOrExit(opts.app);
+    const res = await fetch(`${cfg.apiBase}/v1/apps/${appId}/allowlist`, {
+        headers: bearer(cfg),
+    });
+    if (!res.ok)
+        await dieFromHttp(res, 'list allowlist');
+    const { rules } = (await res.json());
+    if (opts.json) {
+        process.stdout.write(`${JSON.stringify(rules, null, 2)}\n`);
+        return;
+    }
+    if (rules.length === 0) {
+        process.stdout.write(`No allowlist rules for ${appId}.\n`);
+        return;
+    }
+    for (const r of rules) {
+        const inject = r.injectKind === 'bearer' || r.injectKind === 'oauth2_cc'
+            ? r.injectKind
+            : `${r.injectKind}:${r.injectName}`;
+        let line = `${r.pattern}\n  secret=${r.secretName}  inject=${inject}  methods=${r.methods.join(',')}`;
+        if (r.secretName2)
+            line += `  secret2=${r.secretName2}`;
+        if (r.tokenUrl)
+            line += `\n  token-url=${r.tokenUrl}`;
+        process.stdout.write(`${line}\n`);
+    }
+}))
+    .addCommand(new Command('deny')
+    .alias('rm')
+    .description('Remove an allowlist rule by pattern.')
+    .argument('<pattern>', 'exact pattern to remove')
+    .option('--app <id>', 'app id (defaults to package.json name in cwd)')
+    .action(async (pattern, opts) => {
+    const cfg = await requireSession();
+    const appId = await resolveAppIdOrExit(opts.app);
+    const res = await fetch(`${cfg.apiBase}/v1/apps/${appId}/allowlist`, {
+        method: 'DELETE',
+        headers: bearer(cfg),
+        body: JSON.stringify({ pattern }),
+    });
+    if (!res.ok)
+        await dieFromHttp(res, 'remove allowlist rule');
+    process.stdout.write(`✓ removed ${pattern} from ${appId}\n`);
+}));
+//# sourceMappingURL=proxy.js.map

package/dist/proxy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"proxy.js","sourceRoot":"","sources":["../src/proxy.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,cAAc,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAC;AAatF,MAAM,UAAU,WAAW,CAAC,CAAS;IAInC,IAAI,CAAC,KAAK,QAAQ;QAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC;IACxD,IAAI,CAAC,KAAK,WAAW;QAAE,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC;IAC9D,MAAM,CAAC,GAAG,uBAAuB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC1C,IAAI,CAAC,CAAC,EAAE,CAAC;QACP,MAAM,IAAI,KAAK,CAAC,mFAAmF,CAAC,GAAG,CAAC,CAAC;IAC3G,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAuB,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAE,EAAE,CAAC;AAC3D,CAAC;AAED,MAAM,CAAC,MAAM,YAAY,GAAG,IAAI,OAAO,CAAC,OAAO,CAAC;KAC7C,WAAW,CAAC,kEAAkE,CAAC;KAC/E,UAAU,CACT,IAAI,OAAO,CAAC,OAAO,CAAC;KACjB,WAAW,CAAC,+EAA+E,CAAC;KAC5F,QAAQ,CAAC,WAAW,EAAE,uCAAuC,CAAC;KAC9D,cAAc,CAAC,iBAAiB,EAAE,oCAAoC,CAAC;KACvE,cAAc,CACb,iBAAiB,EACjB,0EAA0E,CAC3E;KACA,MAAM,CAAC,kBAAkB,EAAE,6CAA6C,CAAC;KACzE,MAAM,CAAC,mBAAmB,EAAE,gDAAgD,CAAC;KAC7E,MAAM,CAAC,kBAAkB,EAAE,8BAA8B,EAAE,KAAK,CAAC;KACjE,MAAM,CAAC,YAAY,EAAE,+CAA+C,CAAC;KACrE,MAAM,CACL,KAAK,EACH,OAAe,EACf,IAA4G,EAC5G,EAAE;IACF,MAAM,GAAG,GAAG,MAAM,cAAc,EAAE,CAAC;IACnC,MAAM,KAAK,GAAG,MAAM,kBAAkB,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACjD,IAAI,MAAM,CAAC;IACX,IAAI,CAAC;QACH,MAAM,GAAG,WAAW,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACpC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,QAAS,GAAa,CAAC,OAAO,IAAI,CAAC,CAAC;QACzD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IACD,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,GAAG,CAAC,OAAO,YAAY,KAAK,YAAY,EAAE;QACnE,MAAM,EAAE,KAAK;QACb,OAAO,EAAE,MAAM,CAAC,GAAG,CAAC;QACpB,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;YACnB,OAAO;YACP,UAAU,EAAE,MAAM,CAAC,IAAI;YACvB,UAAU,EAAE,MAAM,CAAC,IAAI;YACvB,UAAU,EAAE,IAAI,CAAC,MAAM;YACvB,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACtD,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACrD,OAAO,EAAE,IAAI,CAAC,OAAO;iBAClB,KAAK,CAAC,GAAG,CAAC;iBACV,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;iBACpB,MAAM,CAAC,OAAO,CAAC;SACnB,CAAC;KACH,CAAC,CAAC;IACH,IAAI,CAAC,GAAG,CAAC,EAAE;QAAE,MAAM,WAAW,CAAC,GAAG,EAAE,oBAAoB,CAAC,CAAC;IAC1D,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,aAAa,OAAO,QAAQ,KAAK,IAAI,CAAC,CAAC;AAC9D,CAAC,CACF,CACJ;KACA,UAAU,CACT,IAAI,OAAO,CAAC,MAAM,CAAC;KAChB,KAAK,CAAC,IAAI,CAAC;KACX,WAAW,CAAC,sCAAsC,CAAC;KACnD,MAAM,CAAC,YAAY,EAAE,+CAA+C,CAAC;KACrE,MAAM,CAAC,QAAQ,EAAE,cAAc,CAAC;KAChC,MAAM,CAAC,KAAK,EAAE,IAAsC,EAAE,EAAE;IACvD,MAAM,GAAG,GAAG,MAAM,cAAc,EAAE,CAAC;IACnC,MAAM,KAAK,GAAG,MAAM,kBAAkB,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACjD,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,GAAG,CAAC,OAAO,YAAY,KAAK,YAAY,EAAE;QACnE,OAAO,EAAE,MAAM,CAAC,GAAG,CAAC;KACrB,CAAC,CAAC;IACH,IAAI,CAAC,GAAG,CAAC,EAAE;QAAE,MAAM,WAAW,CAAC,GAAG,EAAE,gBAAgB,CAAC,CAAC;IACtD,MAAM,EAAE,KAAK,EAAE,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAA+B,CAAC;IACnE,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;QACd,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC;QAC5D,OAAO;IACT,CAAC;IACD,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACvB,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,0BAA0B,KAAK,KAAK,CAAC,CAAC;QAC3D,OAAO;IACT,CAAC;IACD,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;QACtB,MAAM,MAAM,GAAG,CAAC,CAAC,UAAU,KAAK,QAAQ,IAAI,CAAC,CAAC,UAAU,KAAK,WAAW;YACtE,CAAC,CAAC,CAAC,CAAC,UAAU;YACd,CAAC,CAAC,GAAG,CAAC,CAAC,UAAU,IAAI,CAAC,CAAC,UAAU,EAAE,CAAC;QACtC,IAAI,IAAI,GAAG,GAAG,CAAC,CAAC,OAAO,cAAc,CAAC,CAAC,UAAU,YAAY,MAAM,aAAa,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;QACtG,IAAI,CAAC,CAAC,WAAW;YAAE,IAAI,IAAI,aAAa,CAAC,CAAC,WAAW,EAAE,CAAC;QACxD,IAAI,CAAC,CAAC,QAAQ;YAAE,IAAI,IAAI,iBAAiB,CAAC,CAAC,QAAQ,EAAE,CAAC;QACtD,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,IAAI,IAAI,CAAC,CAAC;IACpC,CAAC;AACH,CAAC,CAAC,CACL;KACA,UAAU,CACT,IAAI,OAAO,CAAC,MAAM,CAAC;KAChB,KAAK,CAAC,IAAI,CAAC;KACX,WAAW,CAAC,sCAAsC,CAAC;KACnD,QAAQ,CAAC,WAAW,EAAE,yBAAyB,CAAC;KAChD,MAAM,CAAC,YAAY,EAAE,+CAA+C,CAAC;KACrE,MAAM,CAAC,KAAK,EAAE,OAAe,EAAE,IAAsB,EAAE,EAAE;IACxD,MAAM,GAAG,GAAG,MAAM,cAAc,EAAE,CAAC;IACnC,MAAM,KAAK,GAAG,MAAM,kBAAkB,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACjD,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,GAAG,CAAC,OAAO,YAAY,KAAK,YAAY,EAAE;QACnE,MAAM,EAAE,QAAQ;QAChB,OAAO,EAAE,MAAM,CAAC,GAAG,CAAC;QACpB,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,CAAC;KAClC,CAAC,CAAC;IACH,IAAI,CAAC,GAAG,CAAC,EAAE;QAAE,MAAM,WAAW,CAAC,GAAG,EAAE,uBAAuB,CAAC,CAAC;IAC7D,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,aAAa,OAAO,SAAS,KAAK,IAAI,CAAC,CAAC;AAC/D,CAAC,CAAC,CACL,CAAC"}

package/dist/secret.d.ts

@@ -0,0 +1,8 @@
+import { Command } from 'commander';
+import { type CliConfig } from './lib/config.js';
+export declare const secretCommand: Command;
+export declare function requireSession(): Promise<CliConfig>;
+export declare function bearer(cfg: CliConfig): Record<string, string>;
+export declare function resolveAppIdOrExit(explicit: string | undefined): Promise<string>;
+export declare function dieFromHttp(res: Response, action: string): Promise<never>;
+//# sourceMappingURL=secret.d.ts.map

package/dist/secret.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"secret.d.ts","sourceRoot":"","sources":["../src/secret.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,KAAK,SAAS,EAAc,MAAM,iBAAiB,CAAC;AAQ7D,eAAO,MAAM,aAAa,SAgEvB,CAAC;AAIJ,wBAAsB,cAAc,IAAI,OAAO,CAAC,SAAS,CAAC,CAOzD;AAED,wBAAgB,MAAM,CAAC,GAAG,EAAE,SAAS,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAK7D;AAED,wBAAsB,kBAAkB,CAAC,QAAQ,EAAE,MAAM,GAAG,SAAS,GAAG,OAAO,CAAC,MAAM,CAAC,CAiBtF;AAED,wBAAsB,WAAW,CAAC,GAAG,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC,CAS/E"}

package/dist/secret.js

@@ -0,0 +1,112 @@
+import { readFile } from 'node:fs/promises';
+import { join } from 'node:path';
+import { Command } from 'commander';
+import { readConfig } from './lib/config.js';
+export const secretCommand = new Command('secret')
+    .description('Manage server-side API keys for an app (set/list/rm).')
+    .addCommand(new Command('set')
+    .description('Store or replace an encrypted API key for an app.')
+    .argument('<name>', 'secret name (uppercase + underscores, e.g. AMADEUS_CLIENT_ID)')
+    .argument('<value>', 'plaintext value to encrypt and store')
+    .option('--app <id>', 'app id (defaults to package.json name in cwd)')
+    .action(async (name, value, opts) => {
+    const cfg = await requireSession();
+    const appId = await resolveAppIdOrExit(opts.app);
+    const res = await fetch(`${cfg.apiBase}/v1/apps/${appId}/secrets/${name}`, {
+        method: 'PUT',
+        headers: bearer(cfg),
+        body: JSON.stringify({ value }),
+    });
+    if (!res.ok)
+        await dieFromHttp(res, `set ${name}`);
+    process.stdout.write(`✓ stored ${name} for ${appId}\n`);
+}))
+    .addCommand(new Command('list')
+    .alias('ls')
+    .description('List secret names registered for an app (values are never returned).')
+    .option('--app <id>', 'app id (defaults to package.json name in cwd)')
+    .option('--json', 'Output JSON.')
+    .action(async (opts) => {
+    const cfg = await requireSession();
+    const appId = await resolveAppIdOrExit(opts.app);
+    const res = await fetch(`${cfg.apiBase}/v1/apps/${appId}/secrets`, {
+        headers: bearer(cfg),
+    });
+    if (!res.ok)
+        await dieFromHttp(res, 'list secrets');
+    const { secrets } = (await res.json());
+    if (opts.json) {
+        process.stdout.write(`${JSON.stringify(secrets, null, 2)}\n`);
+        return;
+    }
+    if (secrets.length === 0) {
+        process.stdout.write(`No secrets for ${appId}.\n`);
+        return;
+    }
+    for (const s of secrets) {
+        const last = s.lastUsedAt ? new Date(s.lastUsedAt).toISOString() : 'never';
+        process.stdout.write(`${s.name.padEnd(32)} last used: ${last}\n`);
+    }
+}))
+    .addCommand(new Command('rm')
+    .alias('remove')
+    .description('Delete a stored secret.')
+    .argument('<name>', 'secret name')
+    .option('--app <id>', 'app id (defaults to package.json name in cwd)')
+    .action(async (name, opts) => {
+    const cfg = await requireSession();
+    const appId = await resolveAppIdOrExit(opts.app);
+    const res = await fetch(`${cfg.apiBase}/v1/apps/${appId}/secrets/${name}`, {
+        method: 'DELETE',
+        headers: bearer(cfg),
+    });
+    if (!res.ok)
+        await dieFromHttp(res, `rm ${name}`);
+    process.stdout.write(`✓ removed ${name} from ${appId}\n`);
+}));
+// Shared helpers (also used by proxy.ts)
+export async function requireSession() {
+    const cfg = await readConfig();
+    if (!cfg.session?.token) {
+        process.stdout.write('\n⚠  Not signed in. Run: pas login\n');
+        process.exit(1);
+    }
+    return cfg;
+}
+export function bearer(cfg) {
+    return {
+        Authorization: `Bearer ${cfg.session.token}`,
+        'Content-Type': 'application/json',
+    };
+}
+export async function resolveAppIdOrExit(explicit) {
+    if (explicit) {
+        if (!/^[a-z][a-z0-9-]*$/.test(explicit) || explicit.length > 58) {
+            process.stderr.write(`pas: invalid app id "${explicit}".\n`);
+            process.exit(1);
+        }
+        return explicit;
+    }
+    try {
+        const raw = await readFile(join(process.cwd(), 'package.json'), 'utf8');
+        const name = JSON.parse(raw).name;
+        if (name && /^[a-z][a-z0-9-]*$/.test(name))
+            return name;
+    }
+    catch { }
+    process.stderr.write('pas: no app id. Pass --app <id> or run from a directory whose package.json `name` is the app id.\n');
+    process.exit(1);
+}
+export async function dieFromHttp(res, action) {
+    const text = await res.text();
+    let msg = text;
+    try {
+        const parsed = JSON.parse(text);
+        if (parsed.error)
+            msg = parsed.error;
+    }
+    catch { }
+    process.stderr.write(`pas: ${action} failed (${res.status}): ${msg}\n`);
+    process.exit(1);
+}
+//# sourceMappingURL=secret.js.map

package/dist/secret.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"secret.js","sourceRoot":"","sources":["../src/secret.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC5C,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAkB,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAQ7D,MAAM,CAAC,MAAM,aAAa,GAAG,IAAI,OAAO,CAAC,QAAQ,CAAC;KAC/C,WAAW,CAAC,uDAAuD,CAAC;KACpE,UAAU,CACT,IAAI,OAAO,CAAC,KAAK,CAAC;KACf,WAAW,CAAC,mDAAmD,CAAC;KAChE,QAAQ,CAAC,QAAQ,EAAE,+DAA+D,CAAC;KACnF,QAAQ,CAAC,SAAS,EAAE,sCAAsC,CAAC;KAC3D,MAAM,CAAC,YAAY,EAAE,+CAA+C,CAAC;KACrE,MAAM,CAAC,KAAK,EAAE,IAAY,EAAE,KAAa,EAAE,IAAsB,EAAE,EAAE;IACpE,MAAM,GAAG,GAAG,MAAM,cAAc,EAAE,CAAC;IACnC,MAAM,KAAK,GAAG,MAAM,kBAAkB,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACjD,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,GAAG,CAAC,OAAO,YAAY,KAAK,YAAY,IAAI,EAAE,EAAE;QACzE,MAAM,EAAE,KAAK;QACb,OAAO,EAAE,MAAM,CAAC,GAAG,CAAC;QACpB,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,CAAC;KAChC,CAAC,CAAC;IACH,IAAI,CAAC,GAAG,CAAC,EAAE;QAAE,MAAM,WAAW,CAAC,GAAG,EAAE,OAAO,IAAI,EAAE,CAAC,CAAC;IACnD,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,YAAY,IAAI,QAAQ,KAAK,IAAI,CAAC,CAAC;AAC1D,CAAC,CAAC,CACL;KACA,UAAU,CACT,IAAI,OAAO,CAAC,MAAM,CAAC;KAChB,KAAK,CAAC,IAAI,CAAC;KACX,WAAW,CAAC,sEAAsE,CAAC;KACnF,MAAM,CAAC,YAAY,EAAE,+CAA+C,CAAC;KACrE,MAAM,CAAC,QAAQ,EAAE,cAAc,CAAC;KAChC,MAAM,CAAC,KAAK,EAAE,IAAsC,EAAE,EAAE;IACvD,MAAM,GAAG,GAAG,MAAM,cAAc,EAAE,CAAC;IACnC,MAAM,KAAK,GAAG,MAAM,kBAAkB,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACjD,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,GAAG,CAAC,OAAO,YAAY,KAAK,UAAU,EAAE;QACjE,OAAO,EAAE,MAAM,CAAC,GAAG,CAAC;KACrB,CAAC,CAAC;IACH,IAAI,CAAC,GAAG,CAAC,EAAE;QAAE,MAAM,WAAW,CAAC,GAAG,EAAE,cAAc,CAAC,CAAC;IACpD,MAAM,EAAE,OAAO,EAAE,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAiC,CAAC;IACvE,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;QACd,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC;QAC9D,OAAO;IACT,CAAC;IACD,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,kBAAkB,KAAK,KAAK,CAAC,CAAC;QACnD,OAAO;IACT,CAAC;IACD,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;QACxB,MAAM,IAAI,GAAG,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC;QAC3E,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,eAAe,IAAI,IAAI,CAAC,CAAC;IACpE,CAAC;AACH,CAAC,CAAC,CACL;KACA,UAAU,CACT,IAAI,OAAO,CAAC,IAAI,CAAC;KACd,KAAK,CAAC,QAAQ,CAAC;KACf,WAAW,CAAC,yBAAyB,CAAC;KACtC,QAAQ,CAAC,QAAQ,EAAE,aAAa,CAAC;KACjC,MAAM,CAAC,YAAY,EAAE,+CAA+C,CAAC;KACrE,MAAM,CAAC,KAAK,EAAE,IAAY,EAAE,IAAsB,EAAE,EAAE;IACrD,MAAM,GAAG,GAAG,MAAM,cAAc,EAAE,CAAC;IACnC,MAAM,KAAK,GAAG,MAAM,kBAAkB,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACjD,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,GAAG,CAAC,OAAO,YAAY,KAAK,YAAY,IAAI,EAAE,EAAE;QACzE,MAAM,EAAE,QAAQ;QAChB,OAAO,EAAE,MAAM,CAAC,GAAG,CAAC;KACrB,CAAC,CAAC;IACH,IAAI,CAAC,GAAG,CAAC,EAAE;QAAE,MAAM,WAAW,CAAC,GAAG,EAAE,MAAM,IAAI,EAAE,CAAC,CAAC;IAClD,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,aAAa,IAAI,SAAS,KAAK,IAAI,CAAC,CAAC;AAC5D,CAAC,CAAC,CACL,CAAC;AAEJ,yCAAyC;AAEzC,MAAM,CAAC,KAAK,UAAU,cAAc;IAClC,MAAM,GAAG,GAAG,MAAM,UAAU,EAAE,CAAC;IAC/B,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,EAAE,CAAC;QACxB,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,sCAAsC,CAAC,CAAC;QAC7D,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,MAAM,UAAU,MAAM,CAAC,GAAc;IACnC,OAAO;QACL,aAAa,EAAE,UAAU,GAAG,CAAC,OAAQ,CAAC,KAAK,EAAE;QAC7C,cAAc,EAAE,kBAAkB;KACnC,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,QAA4B;IACnE,IAAI,QAAQ,EAAE,CAAC;QACb,IAAI,CAAC,mBAAmB,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,QAAQ,CAAC,MAAM,GAAG,EAAE,EAAE,CAAC;YAChE,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,wBAAwB,QAAQ,MAAM,CAAC,CAAC;YAC7D,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;QACD,OAAO,QAAQ,CAAC;IAClB,CAAC;IACD,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,cAAc,CAAC,EAAE,MAAM,CAAC,CAAC;QACxE,MAAM,IAAI,GAAI,IAAI,CAAC,KAAK,CAAC,GAAG,CAAuB,CAAC,IAAI,CAAC;QACzD,IAAI,IAAI,IAAI,mBAAmB,CAAC,IAAI,CAAC,IAAI,CAAC;YAAE,OAAO,IAAI,CAAC;IAC1D,CAAC;IAAC,MAAM,CAAC,CAAA,CAAC;IACV,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,oGAAoG,CACrG,CAAC;IACF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,GAAa,EAAE,MAAc;IAC7D,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;IAC9B,IAAI,GAAG,GAAG,IAAI,CAAC;IACf,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAuB,CAAC;QACtD,IAAI,MAAM,CAAC,KAAK;YAAE,GAAG,GAAG,MAAM,CAAC,KAAK,CAAC;IACvC,CAAC;IAAC,MAAM,CAAC,CAAA,CAAC;IACV,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,QAAQ,MAAM,YAAY,GAAG,CAAC,MAAM,MAAM,GAAG,IAAI,CAAC,CAAC;IACxE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@proappstore/cli",
-  "version": "2.6.3",
+  "version": "2.6.4",
   "description": "pas — CLI for publishing paid apps to proappstore.online",
   "license": "MIT",
   "type": "module",