@proappstore/cli 2.6.3 → 2.6.5

package/dist/index.js

@@ -10,6 +10,9 @@ import { loginCommand } from './login.js';
 import { logoutCommand } from './logout.js';
 import { whoamiCommand } from './whoami.js';
 import { publishApp } from './publish.js';
+import { secretCommand } from './secret.js';
+import { proxyCommand } from './proxy.js';
+import { integrateCommand } from './integrate.js';
 const __dirname = dirname(fileURLToPath(import.meta.url));
 const pkg = JSON.parse(readFileSync(join(__dirname, '..', 'package.json'), 'utf8'));
 const program = new Command();
@@ -46,6 +49,9 @@ program
 });
 program.addCommand(checkCommand);
 program.addCommand(domainCommand);
+program.addCommand(secretCommand);
+program.addCommand(proxyCommand);
+program.addCommand(integrateCommand);
 program.parseAsync().catch((err) => {
     const msg = err instanceof Error ? err.message : String(err);
     process.stderr.write(`pas: ${msg}\n`);

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";AACA,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAC1C,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AACxC,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAC5C,OAAO,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAC1C,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAC5C,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAC5C,OAAO,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAE1C,MAAM,SAAS,GAAG,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;AAC1D,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,CAAC,SAAS,EAAE,IAAI,EAAE,cAAc,CAAC,EAAE,MAAM,CAAC,CAAwB,CAAC;AAE3G,MAAM,OAAO,GAAG,IAAI,OAAO,EAAE,CAAC;AAE9B,OAAO;KACJ,IAAI,CAAC,KAAK,CAAC;KACX,WAAW,CAAC,0DAA0D,CAAC;KACvE,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;AAExB,OAAO;KACJ,OAAO,CAAC,iBAAiB,CAAC;KAC1B,WAAW,CAAC,4FAA4F,CAAC;KACzG,MAAM,CAAC,gBAAgB,EAAE,mBAAmB,CAAC;KAC7C,MAAM,CAAC,YAAY,EAAE,eAAe,CAAC;KACrC,MAAM,CAAC,kBAAkB,EAAE,iCAAiC,CAAC;KAC7D,MAAM,CAAC,iBAAiB,EAAE,kDAAkD,CAAC;KAC7E,MAAM,CAAC,qBAAqB,EAAE,oDAAoD,CAAC;KACnF,MAAM,CAAC,KAAK,EAAE,KAAa,EAAE,IAA0G,EAAE,EAAE;IAC1I,MAAM,SAAS,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;AAC/B,CAAC,CAAC,CAAC;AAEL,OAAO,CAAC,UAAU,CAAC,YAAY,CAAC,CAAC;AACjC,OAAO,CAAC,UAAU,CAAC,aAAa,CAAC,CAAC;AAClC,OAAO,CAAC,UAAU,CAAC,aAAa,CAAC,CAAC;AAElC,OAAO;KACJ,OAAO,CAAC,SAAS,CAAC;KAClB,WAAW,CAAC,iFAAiF,CAAC;KAC9F,MAAM,CAAC,eAAe,EAAE,4DAA4D,CAAC;KACrF,MAAM,CAAC,uBAAuB,EAAE,iDAAiD,CAAC;KAClF,MAAM,CAAC,6BAA6B,EAAE,8CAA8C,CAAC;KACrF,MAAM,CAAC,eAAe,EAAE,oCAAoC,CAAC;KAC7D,MAAM,CAAC,mBAAmB,EAAE,2BAA2B,CAAC;KACxD,MAAM,CAAC,uBAAuB,EAAE,+DAA+D,CAAC;KAChG,MAAM,CAAC,iBAAiB,EAAE,kDAAkD,CAAC;KAC7E,MAAM,CAAC,KAAK,EAAE,IAAsI,EAAE,EAAE;IACvJ,MAAM,UAAU,CAAC,IAAI,CAAC,CAAC;AACzB,CAAC,CAAC,CAAC;AAEL,OAAO,CAAC,UAAU,CAAC,YAAY,CAAC,CAAC;AACjC,OAAO,CAAC,UAAU,CAAC,aAAa,CAAC,CAAC;AAElC,OAAO,CAAC,UAAU,EAAE,CAAC,KAAK,CAAC,CAAC,GAAY,EAAE,EAAE;IAC1C,MAAM,GAAG,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IAC7D,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,QAAQ,GAAG,IAAI,CAAC,CAAC;IACtC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC,CAAC,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";AACA,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAC1C,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AACxC,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAC5C,OAAO,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAC1C,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAC5C,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAC5C,OAAO,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAC1C,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAC5C,OAAO,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAC1C,OAAO,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AAElD,MAAM,SAAS,GAAG,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;AAC1D,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,CAAC,SAAS,EAAE,IAAI,EAAE,cAAc,CAAC,EAAE,MAAM,CAAC,CAAwB,CAAC;AAE3G,MAAM,OAAO,GAAG,IAAI,OAAO,EAAE,CAAC;AAE9B,OAAO;KACJ,IAAI,CAAC,KAAK,CAAC;KACX,WAAW,CAAC,0DAA0D,CAAC;KACvE,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;AAExB,OAAO;KACJ,OAAO,CAAC,iBAAiB,CAAC;KAC1B,WAAW,CAAC,4FAA4F,CAAC;KACzG,MAAM,CAAC,gBAAgB,EAAE,mBAAmB,CAAC;KAC7C,MAAM,CAAC,YAAY,EAAE,eAAe,CAAC;KACrC,MAAM,CAAC,kBAAkB,EAAE,iCAAiC,CAAC;KAC7D,MAAM,CAAC,iBAAiB,EAAE,kDAAkD,CAAC;KAC7E,MAAM,CAAC,qBAAqB,EAAE,oDAAoD,CAAC;KACnF,MAAM,CAAC,KAAK,EAAE,KAAa,EAAE,IAA0G,EAAE,EAAE;IAC1I,MAAM,SAAS,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;AAC/B,CAAC,CAAC,CAAC;AAEL,OAAO,CAAC,UAAU,CAAC,YAAY,CAAC,CAAC;AACjC,OAAO,CAAC,UAAU,CAAC,aAAa,CAAC,CAAC;AAClC,OAAO,CAAC,UAAU,CAAC,aAAa,CAAC,CAAC;AAElC,OAAO;KACJ,OAAO,CAAC,SAAS,CAAC;KAClB,WAAW,CAAC,iFAAiF,CAAC;KAC9F,MAAM,CAAC,eAAe,EAAE,4DAA4D,CAAC;KACrF,MAAM,CAAC,uBAAuB,EAAE,iDAAiD,CAAC;KAClF,MAAM,CAAC,6BAA6B,EAAE,8CAA8C,CAAC;KACrF,MAAM,CAAC,eAAe,EAAE,oCAAoC,CAAC;KAC7D,MAAM,CAAC,mBAAmB,EAAE,2BAA2B,CAAC;KACxD,MAAM,CAAC,uBAAuB,EAAE,+DAA+D,CAAC;KAChG,MAAM,CAAC,iBAAiB,EAAE,kDAAkD,CAAC;KAC7E,MAAM,CAAC,KAAK,EAAE,IAAsI,EAAE,EAAE;IACvJ,MAAM,UAAU,CAAC,IAAI,CAAC,CAAC;AACzB,CAAC,CAAC,CAAC;AAEL,OAAO,CAAC,UAAU,CAAC,YAAY,CAAC,CAAC;AACjC,OAAO,CAAC,UAAU,CAAC,aAAa,CAAC,CAAC;AAClC,OAAO,CAAC,UAAU,CAAC,aAAa,CAAC,CAAC;AAClC,OAAO,CAAC,UAAU,CAAC,YAAY,CAAC,CAAC;AACjC,OAAO,CAAC,UAAU,CAAC,gBAAgB,CAAC,CAAC;AAErC,OAAO,CAAC,UAAU,EAAE,CAAC,KAAK,CAAC,CAAC,GAAY,EAAE,EAAE;IAC1C,MAAM,GAAG,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IAC7D,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,QAAQ,GAAG,IAAI,CAAC,CAAC;IACtC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC,CAAC,CAAC"}

package/dist/integrate.d.ts

@@ -0,0 +1,3 @@
+import { Command } from 'commander';
+export declare const integrateCommand: Command;
+//# sourceMappingURL=integrate.d.ts.map

package/dist/integrate.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"integrate.d.ts","sourceRoot":"","sources":["../src/integrate.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAqBpC,eAAO,MAAM,gBAAgB,SA6FzB,CAAC"}

package/dist/integrate.js

@@ -0,0 +1,125 @@
+import { Command } from 'commander';
+import { bearer, dieFromHttp, requireSession, resolveAppIdOrExit } from './secret.js';
+import catalog from './integrations.json' with { type: 'json' };
+const integrations = catalog;
+export const integrateCommand = new Command('integrate')
+    .description('Connect a third-party API using pre-configured proxy rules.')
+    .argument('<name>', `integration name (${Object.keys(integrations).join(', ')})`)
+    .option('--app <id>', 'app id (defaults to package.json name in cwd)')
+    .option('--list', 'list all available integrations')
+    .action(async (name, opts) => {
+    if (name === 'list' || opts.list) {
+        process.stdout.write('\nAvailable integrations:\n\n');
+        for (const [id, int] of Object.entries(integrations)) {
+            process.stdout.write(`  ${id.padEnd(20)} ${int.name}\n`);
+        }
+        process.stdout.write(`\nUsage: pas integrate <name> --app <id>\n`);
+        process.stdout.write(`Then follow the prompts to enter your API credentials.\n\n`);
+        return;
+    }
+    const integration = integrations[name];
+    if (!integration) {
+        process.stderr.write(`pas: unknown integration "${name}".\n`);
+        process.stderr.write(`Available: ${Object.keys(integrations).join(', ')}\n`);
+        process.stderr.write(`Run: pas integrate list\n`);
+        process.exit(1);
+    }
+    const cfg = await requireSession();
+    const appId = await resolveAppIdOrExit(opts.app);
+    const prefix = name.toUpperCase().replace(/-/g, '_');
+    process.stdout.write(`\n  Integrating ${integration.name} for ${appId}\n\n`);
+    if (integration.note) {
+        process.stdout.write(`  Note: ${integration.note}\n\n`);
+    }
+    // Collect secrets interactively
+    const secretValues = {};
+    for (const secretSuffix of integration.secrets) {
+        const secretName = `${prefix}_${secretSuffix}`;
+        process.stdout.write(`  ${secretName}: `);
+        const value = await readLine();
+        if (!value.trim()) {
+            process.stderr.write(`\n  Aborted — ${secretName} is required.\n`);
+            process.stderr.write(`  Get yours at: ${integration.docs}\n\n`);
+            process.exit(1);
+        }
+        secretValues[secretName] = value.trim();
+    }
+    // Store secrets
+    for (const [secretName, value] of Object.entries(secretValues)) {
+        const res = await fetch(`${cfg.apiBase}/v1/apps/${appId}/secrets/${secretName}`, {
+            method: 'PUT',
+            headers: bearer(cfg),
+            body: JSON.stringify({ value }),
+        });
+        if (!res.ok)
+            await dieFromHttp(res, `store ${secretName}`);
+        process.stdout.write(`  [+] Stored ${secretName}\n`);
+    }
+    // Create proxy allowlist rules
+    if (integration.patterns.length === 0) {
+        process.stdout.write(`\n  Secrets stored. Add proxy rules for your specific API hosts:\n`);
+        process.stdout.write(`    pas proxy allow 'https://<host>/' --inject ${mapAuth(integration)} --secret ${prefix}_${integration.secrets[0]} --app ${appId}\n\n`);
+        return;
+    }
+    const secretNames = Object.keys(secretValues);
+    for (const pattern of integration.patterns) {
+        const body = {
+            pattern,
+            injectKind: mapInjectKind(integration),
+            injectName: mapInjectName(integration),
+            secretName: secretNames[0],
+            methods: integration.methods,
+        };
+        if (integration.auth === 'oauth2_cc' && secretNames[1]) {
+            body.secretName2 = secretNames[1];
+            body.tokenUrl = integration.tokenUrl;
+        }
+        const res = await fetch(`${cfg.apiBase}/v1/apps/${appId}/allowlist`, {
+            method: 'PUT',
+            headers: bearer(cfg),
+            body: JSON.stringify(body),
+        });
+        if (!res.ok)
+            await dieFromHttp(res, `add rule for ${pattern}`);
+        process.stdout.write(`  [+] Proxy rule: ${pattern}\n`);
+    }
+    process.stdout.write(`\n  Done! Use in your app:\n`);
+    const exampleHost = new URL(integration.patterns[0]).host;
+    const examplePath = new URL(integration.patterns[0]).pathname;
+    process.stdout.write(`    const res = await app.proxy.fetch('${exampleHost}${examplePath}...')\n\n`);
+});
+function mapInjectKind(int) {
+    switch (int.auth) {
+        case 'bearer': return 'bearer';
+        case 'header': return 'header';
+        case 'query': return 'query';
+        case 'oauth2_cc': return 'oauth2_cc';
+        default: return 'bearer';
+    }
+}
+function mapInjectName(int) {
+    if (int.auth === 'header')
+        return int.headerName ?? 'X-API-Key';
+    if (int.auth === 'query')
+        return int.queryParam ?? 'key';
+    return '';
+}
+function mapAuth(int) {
+    if (int.auth === 'header')
+        return `header:${int.headerName ?? 'X-API-Key'}`;
+    if (int.auth === 'query')
+        return `query:${int.queryParam ?? 'key'}`;
+    return int.auth;
+}
+function readLine() {
+    return new Promise((resolve) => {
+        let data = '';
+        process.stdin.setEncoding('utf8');
+        process.stdin.once('data', (chunk) => {
+            data = String(chunk).replace(/\n$/, '');
+            resolve(data);
+        });
+        process.stdin.resume();
+    });
+}
+//# sourceMappingURL=integrate.js.map

package/dist/integrate.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"integrate.js","sourceRoot":"","sources":["../src/integrate.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,cAAc,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAC;AACtF,OAAO,OAAO,MAAM,qBAAqB,CAAC,OAAO,IAAI,EAAE,MAAM,EAAE,CAAC;AAiBhE,MAAM,YAAY,GAAG,OAAsC,CAAC;AAE5D,MAAM,CAAC,MAAM,gBAAgB,GAAG,IAAI,OAAO,CAAC,WAAW,CAAC;KACrD,WAAW,CAAC,6DAA6D,CAAC;KAC1E,QAAQ,CAAC,QAAQ,EAAE,qBAAqB,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC;KAChF,MAAM,CAAC,YAAY,EAAE,+CAA+C,CAAC;KACrE,MAAM,CAAC,QAAQ,EAAE,iCAAiC,CAAC;KACnD,MAAM,CAAC,KAAK,EAAE,IAAY,EAAE,IAAsC,EAAE,EAAE;IACrE,IAAI,IAAI,KAAK,MAAM,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;QACjC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,+BAA+B,CAAC,CAAC;QACtD,KAAK,MAAM,CAAC,EAAE,EAAE,GAAG,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,YAAY,CAAC,EAAE,CAAC;YACrD,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC,IAAI,GAAG,CAAC,IAAI,IAAI,CAAC,CAAC;QAC3D,CAAC;QACD,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,4CAA4C,CAAC,CAAC;QACnE,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,4DAA4D,CAAC,CAAC;QACnF,OAAO;IACT,CAAC;IAED,MAAM,WAAW,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC;IACvC,IAAI,CAAC,WAAW,EAAE,CAAC;QACjB,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,6BAA6B,IAAI,MAAM,CAAC,CAAC;QAC9D,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,cAAc,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC7E,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,2BAA2B,CAAC,CAAC;QAClD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,MAAM,GAAG,GAAG,MAAM,cAAc,EAAE,CAAC;IACnC,MAAM,KAAK,GAAG,MAAM,kBAAkB,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACjD,MAAM,MAAM,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IAErD,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,mBAAmB,WAAW,CAAC,IAAI,QAAQ,KAAK,MAAM,CAAC,CAAC;IAE7E,IAAI,WAAW,CAAC,IAAI,EAAE,CAAC;QACrB,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,WAAW,WAAW,CAAC,IAAI,MAAM,CAAC,CAAC;IAC1D,CAAC;IAED,gCAAgC;IAChC,MAAM,YAAY,GAA2B,EAAE,CAAC;IAChD,KAAK,MAAM,YAAY,IAAI,WAAW,CAAC,OAAO,EAAE,CAAC;QAC/C,MAAM,UAAU,GAAG,GAAG,MAAM,IAAI,YAAY,EAAE,CAAC;QAC/C,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,UAAU,IAAI,CAAC,CAAC;QAC1C,MAAM,KAAK,GAAG,MAAM,QAAQ,EAAE,CAAC;QAC/B,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,EAAE,CAAC;YAClB,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,iBAAiB,UAAU,iBAAiB,CAAC,CAAC;YACnE,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,mBAAmB,WAAW,CAAC,IAAI,MAAM,CAAC,CAAC;YAChE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;QACD,YAAY,CAAC,UAAU,CAAC,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;IAC1C,CAAC;IAED,gBAAgB;IAChB,KAAK,MAAM,CAAC,UAAU,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,YAAY,CAAC,EAAE,CAAC;QAC/D,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,GAAG,CAAC,OAAO,YAAY,KAAK,YAAY,UAAU,EAAE,EAAE;YAC/E,MAAM,EAAE,KAAK;YACb,OAAO,EAAE,MAAM,CAAC,GAAG,CAAC;YACpB,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,CAAC;SAChC,CAAC,CAAC;QACH,IAAI,CAAC,GAAG,CAAC,EAAE;YAAE,MAAM,WAAW,CAAC,GAAG,EAAE,SAAS,UAAU,EAAE,CAAC,CAAC;QAC3D,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,gBAAgB,UAAU,IAAI,CAAC,CAAC;IACvD,CAAC;IAED,+BAA+B;IAC/B,IAAI,WAAW,CAAC,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACtC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,oEAAoE,CAAC,CAAC;QAC3F,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,kDAAkD,OAAO,CAAC,WAAW,CAAC,aAAa,MAAM,IAAI,WAAW,CAAC,OAAO,CAAC,CAAC,CAAC,UAAU,KAAK,MAAM,CAAC,CAAC;QAC/J,OAAO;IACT,CAAC;IAED,MAAM,WAAW,GAAG,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;IAC9C,KAAK,MAAM,OAAO,IAAI,WAAW,CAAC,QAAQ,EAAE,CAAC;QAC3C,MAAM,IAAI,GAA4B;YACpC,OAAO;YACP,UAAU,EAAE,aAAa,CAAC,WAAW,CAAC;YACtC,UAAU,EAAE,aAAa,CAAC,WAAW,CAAC;YACtC,UAAU,EAAE,WAAW,CAAC,CAAC,CAAC;YAC1B,OAAO,EAAE,WAAW,CAAC,OAAO;SAC7B,CAAC;QACF,IAAI,WAAW,CAAC,IAAI,KAAK,WAAW,IAAI,WAAW,CAAC,CAAC,CAAC,EAAE,CAAC;YACvD,IAAI,CAAC,WAAW,GAAG,WAAW,CAAC,CAAC,CAAC,CAAC;YAClC,IAAI,CAAC,QAAQ,GAAG,WAAW,CAAC,QAAQ,CAAC;QACvC,CAAC;QAED,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,GAAG,CAAC,OAAO,YAAY,KAAK,YAAY,EAAE;YACnE,MAAM,EAAE,KAAK;YACb,OAAO,EAAE,MAAM,CAAC,GAAG,CAAC;YACpB,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;SAC3B,CAAC,CAAC;QACH,IAAI,CAAC,GAAG,CAAC,EAAE;YAAE,MAAM,WAAW,CAAC,GAAG,EAAE,gBAAgB,OAAO,EAAE,CAAC,CAAC;QAC/D,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,qBAAqB,OAAO,IAAI,CAAC,CAAC;IACzD,CAAC;IAED,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,8BAA8B,CAAC,CAAC;IACrD,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAC,CAAE,CAAC,CAAC,IAAI,CAAC;IAC3D,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAC,CAAE,CAAC,CAAC,QAAQ,CAAC;IAC/D,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,0CAA0C,WAAW,GAAG,WAAW,WAAW,CAAC,CAAC;AACvG,CAAC,CAAC,CAAC;AAEL,SAAS,aAAa,CAAC,GAAgB;IACrC,QAAQ,GAAG,CAAC,IAAI,EAAE,CAAC;QACjB,KAAK,QAAQ,CAAC,CAAC,OAAO,QAAQ,CAAC;QAC/B,KAAK,QAAQ,CAAC,CAAC,OAAO,QAAQ,CAAC;QAC/B,KAAK,OAAO,CAAC,CAAC,OAAO,OAAO,CAAC;QAC7B,KAAK,WAAW,CAAC,CAAC,OAAO,WAAW,CAAC;QACrC,OAAO,CAAC,CAAC,OAAO,QAAQ,CAAC;IAC3B,CAAC;AACH,CAAC;AAED,SAAS,aAAa,CAAC,GAAgB;IACrC,IAAI,GAAG,CAAC,IAAI,KAAK,QAAQ;QAAE,OAAO,GAAG,CAAC,UAAU,IAAI,WAAW,CAAC;IAChE,IAAI,GAAG,CAAC,IAAI,KAAK,OAAO;QAAE,OAAO,GAAG,CAAC,UAAU,IAAI,KAAK,CAAC;IACzD,OAAO,EAAE,CAAC;AACZ,CAAC;AAED,SAAS,OAAO,CAAC,GAAgB;IAC/B,IAAI,GAAG,CAAC,IAAI,KAAK,QAAQ;QAAE,OAAO,UAAU,GAAG,CAAC,UAAU,IAAI,WAAW,EAAE,CAAC;IAC5E,IAAI,GAAG,CAAC,IAAI,KAAK,OAAO;QAAE,OAAO,SAAS,GAAG,CAAC,UAAU,IAAI,KAAK,EAAE,CAAC;IACpE,OAAO,GAAG,CAAC,IAAI,CAAC;AAClB,CAAC;AAED,SAAS,QAAQ;IACf,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;QAC7B,IAAI,IAAI,GAAG,EAAE,CAAC;QACd,OAAO,CAAC,KAAK,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC;QAClC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,KAAK,EAAE,EAAE;YACnC,IAAI,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;YACxC,OAAO,CAAC,IAAI,CAAC,CAAC;QAChB,CAAC,CAAC,CAAC;QACH,OAAO,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC;IACzB,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/integrations.json

@@ -0,0 +1,131 @@
+{
+    "openai": {
+        "name": "OpenAI (GPT, DALL-E, Whisper)",
+        "auth": "bearer",
+        "patterns": ["https://api.openai.com/"],
+        "methods": ["GET", "POST"],
+        "secrets": ["API_KEY"],
+        "docs": "https://platform.openai.com/api-keys"
+    },
+    "anthropic": {
+        "name": "Anthropic (Claude)",
+        "auth": "header",
+        "headerName": "x-api-key",
+        "patterns": ["https://api.anthropic.com/"],
+        "methods": ["GET", "POST"],
+        "secrets": ["API_KEY"],
+        "docs": "https://console.anthropic.com/settings/keys"
+    },
+    "google-ai": {
+        "name": "Google AI (Gemini)",
+        "auth": "query",
+        "queryParam": "key",
+        "patterns": ["https://generativelanguage.googleapis.com/"],
+        "methods": ["GET", "POST"],
+        "secrets": ["API_KEY"],
+        "docs": "https://aistudio.google.com/apikey"
+    },
+    "openrouter": {
+        "name": "OpenRouter (multi-model gateway)",
+        "auth": "bearer",
+        "patterns": ["https://openrouter.ai/api/"],
+        "methods": ["GET", "POST"],
+        "secrets": ["API_KEY"],
+        "docs": "https://openrouter.ai/keys"
+    },
+    "replicate": {
+        "name": "Replicate (open source models)",
+        "auth": "bearer",
+        "patterns": ["https://api.replicate.com/"],
+        "methods": ["GET", "POST"],
+        "secrets": ["API_KEY"],
+        "docs": "https://replicate.com/account/api-tokens"
+    },
+    "stability": {
+        "name": "Stability AI (image generation)",
+        "auth": "bearer",
+        "patterns": ["https://api.stability.ai/"],
+        "methods": ["GET", "POST"],
+        "secrets": ["API_KEY"],
+        "docs": "https://platform.stability.ai/account/keys"
+    },
+    "elevenlabs": {
+        "name": "ElevenLabs (text-to-speech)",
+        "auth": "header",
+        "headerName": "xi-api-key",
+        "patterns": ["https://api.elevenlabs.io/"],
+        "methods": ["GET", "POST"],
+        "secrets": ["API_KEY"],
+        "docs": "https://elevenlabs.io/app/settings/api-keys"
+    },
+    "amadeus": {
+        "name": "Amadeus (flights & hotels)",
+        "auth": "oauth2_cc",
+        "tokenUrl": "https://test.api.amadeus.com/v1/security/oauth2/token",
+        "patterns": ["https://test.api.amadeus.com/v2/"],
+        "methods": ["GET", "POST"],
+        "secrets": ["CLIENT_ID", "CLIENT_SECRET"],
+        "docs": "https://developers.amadeus.com/register"
+    },
+    "amadeus-prod": {
+        "name": "Amadeus Production (flights & hotels)",
+        "auth": "oauth2_cc",
+        "tokenUrl": "https://api.amadeus.com/v1/security/oauth2/token",
+        "patterns": ["https://api.amadeus.com/v2/"],
+        "methods": ["GET", "POST"],
+        "secrets": ["CLIENT_ID", "CLIENT_SECRET"],
+        "docs": "https://developers.amadeus.com/register"
+    },
+    "spotify": {
+        "name": "Spotify (music, playlists)",
+        "auth": "oauth2_cc",
+        "tokenUrl": "https://accounts.spotify.com/api/token",
+        "patterns": ["https://api.spotify.com/v1/"],
+        "methods": ["GET", "POST", "PUT", "DELETE"],
+        "secrets": ["CLIENT_ID", "CLIENT_SECRET"],
+        "docs": "https://developer.spotify.com/dashboard"
+    },
+    "github": {
+        "name": "GitHub API",
+        "auth": "bearer",
+        "patterns": ["https://api.github.com/"],
+        "methods": ["GET", "POST", "PUT", "PATCH", "DELETE"],
+        "secrets": ["TOKEN"],
+        "docs": "https://github.com/settings/tokens"
+    },
+    "openweathermap": {
+        "name": "OpenWeatherMap",
+        "auth": "query",
+        "queryParam": "appid",
+        "patterns": ["https://api.openweathermap.org/data/2.5/", "https://api.openweathermap.org/data/3.0/"],
+        "methods": ["GET"],
+        "secrets": ["API_KEY"],
+        "docs": "https://home.openweathermap.org/api_keys"
+    },
+    "rapidapi": {
+        "name": "RapidAPI (any API on the hub)",
+        "auth": "header",
+        "headerName": "X-RapidAPI-Key",
+        "patterns": [],
+        "methods": ["GET", "POST"],
+        "secrets": ["API_KEY"],
+        "docs": "https://rapidapi.com/developer/dashboard",
+        "note": "After integrating, add proxy rules for the specific RapidAPI host(s) you use."
+    },
+    "resend": {
+        "name": "Resend (email API)",
+        "auth": "bearer",
+        "patterns": ["https://api.resend.com/"],
+        "methods": ["GET", "POST"],
+        "secrets": ["API_KEY"],
+        "docs": "https://resend.com/api-keys"
+    },
+    "stripe": {
+        "name": "Stripe API",
+        "auth": "bearer",
+        "patterns": ["https://api.stripe.com/"],
+        "methods": ["GET", "POST", "DELETE"],
+        "secrets": ["SECRET_KEY"],
+        "docs": "https://dashboard.stripe.com/apikeys"
+    }
+}

package/dist/proxy.d.ts

@@ -0,0 +1,7 @@
+import { Command } from 'commander';
+export declare function parseInject(s: string): {
+    kind: 'query' | 'header' | 'bearer' | 'oauth2_cc';
+    name: string;
+};
+export declare const proxyCommand: Command;
+//# sourceMappingURL=proxy.d.ts.map

package/dist/proxy.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"proxy.d.ts","sourceRoot":"","sources":["../src/proxy.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAcpC,wBAAgB,WAAW,CAAC,CAAC,EAAE,MAAM,GAAG;IACtC,IAAI,EAAE,OAAO,GAAG,QAAQ,GAAG,QAAQ,GAAG,WAAW,CAAC;IAClD,IAAI,EAAE,MAAM,CAAC;CACd,CAQA;AAED,eAAO,MAAM,YAAY,SAoGtB,CAAC"}

package/dist/proxy.js

@@ -0,0 +1,107 @@
+import { Command } from 'commander';
+import { bearer, dieFromHttp, requireSession, resolveAppIdOrExit } from './secret.js';
+export function parseInject(s) {
+    if (s === 'bearer')
+        return { kind: 'bearer', name: '' };
+    if (s === 'oauth2_cc')
+        return { kind: 'oauth2_cc', name: '' };
+    const m = /^(query|header):(.+)$/.exec(s);
+    if (!m) {
+        throw new Error(`--inject must be 'bearer', 'oauth2_cc', 'query:<name>', or 'header:<name>' (got ${s})`);
+    }
+    return { kind: m[1], name: m[2] };
+}
+export const proxyCommand = new Command('proxy')
+    .description('Manage the URL allowlist for the per-app secret-injecting proxy.')
+    .addCommand(new Command('allow')
+    .description('Allow the proxy to inject <secret> when calling URLs starting with <pattern>.')
+    .argument('<pattern>', 'URL prefix (must start with https://)')
+    .requiredOption('--secret <name>', 'name of a previously stored secret')
+    .requiredOption('--inject <spec>', "how to inject: 'query:<name>', 'header:<name>', 'bearer', or 'oauth2_cc'")
+    .option('--secret2 <name>', 'second secret (client_secret for oauth2_cc)')
+    .option('--token-url <url>', 'OAuth2 token endpoint (required for oauth2_cc)')
+    .option('--methods <list>', 'comma-separated HTTP methods', 'GET')
+    .option('--app <id>', 'app id (defaults to package.json name in cwd)')
+    .action(async (pattern, opts) => {
+    const cfg = await requireSession();
+    const appId = await resolveAppIdOrExit(opts.app);
+    let inject;
+    try {
+        inject = parseInject(opts.inject);
+    }
+    catch (err) {
+        process.stderr.write(`pas: ${err.message}\n`);
+        process.exit(1);
+    }
+    const res = await fetch(`${cfg.apiBase}/v1/apps/${appId}/allowlist`, {
+        method: 'PUT',
+        headers: bearer(cfg),
+        body: JSON.stringify({
+            pattern,
+            injectKind: inject.kind,
+            injectName: inject.name,
+            secretName: opts.secret,
+            ...(opts.secret2 ? { secretName2: opts.secret2 } : {}),
+            ...(opts.tokenUrl ? { tokenUrl: opts.tokenUrl } : {}),
+            methods: opts.methods
+                .split(',')
+                .map((m) => m.trim())
+                .filter(Boolean),
+        }),
+    });
+    if (!res.ok)
+        await dieFromHttp(res, 'add allowlist rule');
+    process.stdout.write(`✓ allowed ${pattern} for ${appId}\n`);
+}))
+    .addCommand(new Command('list')
+    .alias('ls')
+    .description('Show the proxy allowlist for an app.')
+    .option('--app <id>', 'app id (defaults to package.json name in cwd)')
+    .option('--json', 'Output JSON.')
+    .action(async (opts) => {
+    const cfg = await requireSession();
+    const appId = await resolveAppIdOrExit(opts.app);
+    const res = await fetch(`${cfg.apiBase}/v1/apps/${appId}/allowlist`, {
+        headers: bearer(cfg),
+    });
+    if (!res.ok)
+        await dieFromHttp(res, 'list allowlist');
+    const { rules } = (await res.json());
+    if (opts.json) {
+        process.stdout.write(`${JSON.stringify(rules, null, 2)}\n`);
+        return;
+    }
+    if (rules.length === 0) {
+        process.stdout.write(`No allowlist rules for ${appId}.\n`);
+        return;
+    }
+    for (const r of rules) {
+        const inject = r.injectKind === 'bearer' || r.injectKind === 'oauth2_cc'
+            ? r.injectKind
+            : `${r.injectKind}:${r.injectName}`;
+        let line = `${r.pattern}\n  secret=${r.secretName}  inject=${inject}  methods=${r.methods.join(',')}`;
+        if (r.secretName2)
+            line += `  secret2=${r.secretName2}`;
+        if (r.tokenUrl)
+            line += `\n  token-url=${r.tokenUrl}`;
+        process.stdout.write(`${line}\n`);
+    }
+}))
+    .addCommand(new Command('deny')
+    .alias('rm')
+    .description('Remove an allowlist rule by pattern.')
+    .argument('<pattern>', 'exact pattern to remove')
+    .option('--app <id>', 'app id (defaults to package.json name in cwd)')
+    .action(async (pattern, opts) => {
+    const cfg = await requireSession();
+    const appId = await resolveAppIdOrExit(opts.app);
+    const res = await fetch(`${cfg.apiBase}/v1/apps/${appId}/allowlist`, {
+        method: 'DELETE',
+        headers: bearer(cfg),
+        body: JSON.stringify({ pattern }),
+    });
+    if (!res.ok)
+        await dieFromHttp(res, 'remove allowlist rule');
+    process.stdout.write(`✓ removed ${pattern} from ${appId}\n`);
+}));
+//# sourceMappingURL=proxy.js.map

package/dist/proxy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"proxy.js","sourceRoot":"","sources":["../src/proxy.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,cAAc,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAC;AAatF,MAAM,UAAU,WAAW,CAAC,CAAS;IAInC,IAAI,CAAC,KAAK,QAAQ;QAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC;IACxD,IAAI,CAAC,KAAK,WAAW;QAAE,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC;IAC9D,MAAM,CAAC,GAAG,uBAAuB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC1C,IAAI,CAAC,CAAC,EAAE,CAAC;QACP,MAAM,IAAI,KAAK,CAAC,mFAAmF,CAAC,GAAG,CAAC,CAAC;IAC3G,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAuB,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAE,EAAE,CAAC;AAC3D,CAAC;AAED,MAAM,CAAC,MAAM,YAAY,GAAG,IAAI,OAAO,CAAC,OAAO,CAAC;KAC7C,WAAW,CAAC,kEAAkE,CAAC;KAC/E,UAAU,CACT,IAAI,OAAO,CAAC,OAAO,CAAC;KACjB,WAAW,CAAC,+EAA+E,CAAC;KAC5F,QAAQ,CAAC,WAAW,EAAE,uCAAuC,CAAC;KAC9D,cAAc,CAAC,iBAAiB,EAAE,oCAAoC,CAAC;KACvE,cAAc,CACb,iBAAiB,EACjB,0EAA0E,CAC3E;KACA,MAAM,CAAC,kBAAkB,EAAE,6CAA6C,CAAC;KACzE,MAAM,CAAC,mBAAmB,EAAE,gDAAgD,CAAC;KAC7E,MAAM,CAAC,kBAAkB,EAAE,8BAA8B,EAAE,KAAK,CAAC;KACjE,MAAM,CAAC,YAAY,EAAE,+CAA+C,CAAC;KACrE,MAAM,CACL,KAAK,EACH,OAAe,EACf,IAA4G,EAC5G,EAAE;IACF,MAAM,GAAG,GAAG,MAAM,cAAc,EAAE,CAAC;IACnC,MAAM,KAAK,GAAG,MAAM,kBAAkB,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACjD,IAAI,MAAM,CAAC;IACX,IAAI,CAAC;QACH,MAAM,GAAG,WAAW,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACpC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,QAAS,GAAa,CAAC,OAAO,IAAI,CAAC,CAAC;QACzD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IACD,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,GAAG,CAAC,OAAO,YAAY,KAAK,YAAY,EAAE;QACnE,MAAM,EAAE,KAAK;QACb,OAAO,EAAE,MAAM,CAAC,GAAG,CAAC;QACpB,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;YACnB,OAAO;YACP,UAAU,EAAE,MAAM,CAAC,IAAI;YACvB,UAAU,EAAE,MAAM,CAAC,IAAI;YACvB,UAAU,EAAE,IAAI,CAAC,MAAM;YACvB,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACtD,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACrD,OAAO,EAAE,IAAI,CAAC,OAAO;iBAClB,KAAK,CAAC,GAAG,CAAC;iBACV,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;iBACpB,MAAM,CAAC,OAAO,CAAC;SACnB,CAAC;KACH,CAAC,CAAC;IACH,IAAI,CAAC,GAAG,CAAC,EAAE;QAAE,MAAM,WAAW,CAAC,GAAG,EAAE,oBAAoB,CAAC,CAAC;IAC1D,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,aAAa,OAAO,QAAQ,KAAK,IAAI,CAAC,CAAC;AAC9D,CAAC,CACF,CACJ;KACA,UAAU,CACT,IAAI,OAAO,CAAC,MAAM,CAAC;KAChB,KAAK,CAAC,IAAI,CAAC;KACX,WAAW,CAAC,sCAAsC,CAAC;KACnD,MAAM,CAAC,YAAY,EAAE,+CAA+C,CAAC;KACrE,MAAM,CAAC,QAAQ,EAAE,cAAc,CAAC;KAChC,MAAM,CAAC,KAAK,EAAE,IAAsC,EAAE,EAAE;IACvD,MAAM,GAAG,GAAG,MAAM,cAAc,EAAE,CAAC;IACnC,MAAM,KAAK,GAAG,MAAM,kBAAkB,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACjD,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,GAAG,CAAC,OAAO,YAAY,KAAK,YAAY,EAAE;QACnE,OAAO,EAAE,MAAM,CAAC,GAAG,CAAC;KACrB,CAAC,CAAC;IACH,IAAI,CAAC,GAAG,CAAC,EAAE;QAAE,MAAM,WAAW,CAAC,GAAG,EAAE,gBAAgB,CAAC,CAAC;IACtD,MAAM,EAAE,KAAK,EAAE,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAA+B,CAAC;IACnE,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;QACd,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC;QAC5D,OAAO;IACT,CAAC;IACD,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACvB,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,0BAA0B,KAAK,KAAK,CAAC,CAAC;QAC3D,OAAO;IACT,CAAC;IACD,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;QACtB,MAAM,MAAM,GAAG,CAAC,CAAC,UAAU,KAAK,QAAQ,IAAI,CAAC,CAAC,UAAU,KAAK,WAAW;YACtE,CAAC,CAAC,CAAC,CAAC,UAAU;YACd,CAAC,CAAC,GAAG,CAAC,CAAC,UAAU,IAAI,CAAC,CAAC,UAAU,EAAE,CAAC;QACtC,IAAI,IAAI,GAAG,GAAG,CAAC,CAAC,OAAO,cAAc,CAAC,CAAC,UAAU,YAAY,MAAM,aAAa,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;QACtG,IAAI,CAAC,CAAC,WAAW;YAAE,IAAI,IAAI,aAAa,CAAC,CAAC,WAAW,EAAE,CAAC;QACxD,IAAI,CAAC,CAAC,QAAQ;YAAE,IAAI,IAAI,iBAAiB,CAAC,CAAC,QAAQ,EAAE,CAAC;QACtD,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,IAAI,IAAI,CAAC,CAAC;IACpC,CAAC;AACH,CAAC,CAAC,CACL;KACA,UAAU,CACT,IAAI,OAAO,CAAC,MAAM,CAAC;KAChB,KAAK,CAAC,IAAI,CAAC;KACX,WAAW,CAAC,sCAAsC,CAAC;KACnD,QAAQ,CAAC,WAAW,EAAE,yBAAyB,CAAC;KAChD,MAAM,CAAC,YAAY,EAAE,+CAA+C,CAAC;KACrE,MAAM,CAAC,KAAK,EAAE,OAAe,EAAE,IAAsB,EAAE,EAAE;IACxD,MAAM,GAAG,GAAG,MAAM,cAAc,EAAE,CAAC;IACnC,MAAM,KAAK,GAAG,MAAM,kBAAkB,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACjD,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,GAAG,CAAC,OAAO,YAAY,KAAK,YAAY,EAAE;QACnE,MAAM,EAAE,QAAQ;QAChB,OAAO,EAAE,MAAM,CAAC,GAAG,CAAC;QACpB,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,CAAC;KAClC,CAAC,CAAC;IACH,IAAI,CAAC,GAAG,CAAC,EAAE;QAAE,MAAM,WAAW,CAAC,GAAG,EAAE,uBAAuB,CAAC,CAAC;IAC7D,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,aAAa,OAAO,SAAS,KAAK,IAAI,CAAC,CAAC;AAC/D,CAAC,CAAC,CACL,CAAC"}

package/dist/secret.d.ts

@@ -0,0 +1,8 @@
+import { Command } from 'commander';
+import { type CliConfig } from './lib/config.js';
+export declare const secretCommand: Command;
+export declare function requireSession(): Promise<CliConfig>;
+export declare function bearer(cfg: CliConfig): Record<string, string>;
+export declare function resolveAppIdOrExit(explicit: string | undefined): Promise<string>;
+export declare function dieFromHttp(res: Response, action: string): Promise<never>;
+//# sourceMappingURL=secret.d.ts.map

package/dist/secret.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"secret.d.ts","sourceRoot":"","sources":["../src/secret.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,KAAK,SAAS,EAAc,MAAM,iBAAiB,CAAC;AAQ7D,eAAO,MAAM,aAAa,SAgEvB,CAAC;AAIJ,wBAAsB,cAAc,IAAI,OAAO,CAAC,SAAS,CAAC,CAOzD;AAED,wBAAgB,MAAM,CAAC,GAAG,EAAE,SAAS,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAK7D;AAED,wBAAsB,kBAAkB,CAAC,QAAQ,EAAE,MAAM,GAAG,SAAS,GAAG,OAAO,CAAC,MAAM,CAAC,CAiBtF;AAED,wBAAsB,WAAW,CAAC,GAAG,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC,CAS/E"}

package/dist/secret.js

@@ -0,0 +1,112 @@
+import { readFile } from 'node:fs/promises';
+import { join } from 'node:path';
+import { Command } from 'commander';
+import { readConfig } from './lib/config.js';
+export const secretCommand = new Command('secret')
+    .description('Manage server-side API keys for an app (set/list/rm).')
+    .addCommand(new Command('set')
+    .description('Store or replace an encrypted API key for an app.')
+    .argument('<name>', 'secret name (uppercase + underscores, e.g. AMADEUS_CLIENT_ID)')
+    .argument('<value>', 'plaintext value to encrypt and store')
+    .option('--app <id>', 'app id (defaults to package.json name in cwd)')
+    .action(async (name, value, opts) => {
+    const cfg = await requireSession();
+    const appId = await resolveAppIdOrExit(opts.app);
+    const res = await fetch(`${cfg.apiBase}/v1/apps/${appId}/secrets/${name}`, {
+        method: 'PUT',
+        headers: bearer(cfg),
+        body: JSON.stringify({ value }),
+    });
+    if (!res.ok)
+        await dieFromHttp(res, `set ${name}`);
+    process.stdout.write(`✓ stored ${name} for ${appId}\n`);
+}))
+    .addCommand(new Command('list')
+    .alias('ls')
+    .description('List secret names registered for an app (values are never returned).')
+    .option('--app <id>', 'app id (defaults to package.json name in cwd)')
+    .option('--json', 'Output JSON.')
+    .action(async (opts) => {
+    const cfg = await requireSession();
+    const appId = await resolveAppIdOrExit(opts.app);
+    const res = await fetch(`${cfg.apiBase}/v1/apps/${appId}/secrets`, {
+        headers: bearer(cfg),
+    });
+    if (!res.ok)
+        await dieFromHttp(res, 'list secrets');
+    const { secrets } = (await res.json());
+    if (opts.json) {
+        process.stdout.write(`${JSON.stringify(secrets, null, 2)}\n`);
+        return;
+    }
+    if (secrets.length === 0) {
+        process.stdout.write(`No secrets for ${appId}.\n`);
+        return;
+    }
+    for (const s of secrets) {
+        const last = s.lastUsedAt ? new Date(s.lastUsedAt).toISOString() : 'never';
+        process.stdout.write(`${s.name.padEnd(32)} last used: ${last}\n`);
+    }
+}))
+    .addCommand(new Command('rm')
+    .alias('remove')
+    .description('Delete a stored secret.')
+    .argument('<name>', 'secret name')
+    .option('--app <id>', 'app id (defaults to package.json name in cwd)')
+    .action(async (name, opts) => {
+    const cfg = await requireSession();
+    const appId = await resolveAppIdOrExit(opts.app);
+    const res = await fetch(`${cfg.apiBase}/v1/apps/${appId}/secrets/${name}`, {
+        method: 'DELETE',
+        headers: bearer(cfg),
+    });
+    if (!res.ok)
+        await dieFromHttp(res, `rm ${name}`);
+    process.stdout.write(`✓ removed ${name} from ${appId}\n`);
+}));
+// Shared helpers (also used by proxy.ts)
+export async function requireSession() {
+    const cfg = await readConfig();
+    if (!cfg.session?.token) {
+        process.stdout.write('\n⚠  Not signed in. Run: pas login\n');
+        process.exit(1);
+    }
+    return cfg;
+}
+export function bearer(cfg) {
+    return {
+        Authorization: `Bearer ${cfg.session.token}`,
+        'Content-Type': 'application/json',
+    };
+}
+export async function resolveAppIdOrExit(explicit) {
+    if (explicit) {
+        if (!/^[a-z][a-z0-9-]*$/.test(explicit) || explicit.length > 58) {
+            process.stderr.write(`pas: invalid app id "${explicit}".\n`);
+            process.exit(1);
+        }
+        return explicit;
+    }
+    try {
+        const raw = await readFile(join(process.cwd(), 'package.json'), 'utf8');
+        const name = JSON.parse(raw).name;
+        if (name && /^[a-z][a-z0-9-]*$/.test(name))
+            return name;
+    }
+    catch { }
+    process.stderr.write('pas: no app id. Pass --app <id> or run from a directory whose package.json `name` is the app id.\n');
+    process.exit(1);
+}
+export async function dieFromHttp(res, action) {
+    const text = await res.text();
+    let msg = text;
+    try {
+        const parsed = JSON.parse(text);
+        if (parsed.error)
+            msg = parsed.error;
+    }
+    catch { }
+    process.stderr.write(`pas: ${action} failed (${res.status}): ${msg}\n`);
+    process.exit(1);
+}
+//# sourceMappingURL=secret.js.map

package/dist/secret.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"secret.js","sourceRoot":"","sources":["../src/secret.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC5C,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAkB,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAQ7D,MAAM,CAAC,MAAM,aAAa,GAAG,IAAI,OAAO,CAAC,QAAQ,CAAC;KAC/C,WAAW,CAAC,uDAAuD,CAAC;KACpE,UAAU,CACT,IAAI,OAAO,CAAC,KAAK,CAAC;KACf,WAAW,CAAC,mDAAmD,CAAC;KAChE,QAAQ,CAAC,QAAQ,EAAE,+DAA+D,CAAC;KACnF,QAAQ,CAAC,SAAS,EAAE,sCAAsC,CAAC;KAC3D,MAAM,CAAC,YAAY,EAAE,+CAA+C,CAAC;KACrE,MAAM,CAAC,KAAK,EAAE,IAAY,EAAE,KAAa,EAAE,IAAsB,EAAE,EAAE;IACpE,MAAM,GAAG,GAAG,MAAM,cAAc,EAAE,CAAC;IACnC,MAAM,KAAK,GAAG,MAAM,kBAAkB,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACjD,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,GAAG,CAAC,OAAO,YAAY,KAAK,YAAY,IAAI,EAAE,EAAE;QACzE,MAAM,EAAE,KAAK;QACb,OAAO,EAAE,MAAM,CAAC,GAAG,CAAC;QACpB,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,CAAC;KAChC,CAAC,CAAC;IACH,IAAI,CAAC,GAAG,CAAC,EAAE;QAAE,MAAM,WAAW,CAAC,GAAG,EAAE,OAAO,IAAI,EAAE,CAAC,CAAC;IACnD,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,YAAY,IAAI,QAAQ,KAAK,IAAI,CAAC,CAAC;AAC1D,CAAC,CAAC,CACL;KACA,UAAU,CACT,IAAI,OAAO,CAAC,MAAM,CAAC;KAChB,KAAK,CAAC,IAAI,CAAC;KACX,WAAW,CAAC,sEAAsE,CAAC;KACnF,MAAM,CAAC,YAAY,EAAE,+CAA+C,CAAC;KACrE,MAAM,CAAC,QAAQ,EAAE,cAAc,CAAC;KAChC,MAAM,CAAC,KAAK,EAAE,IAAsC,EAAE,EAAE;IACvD,MAAM,GAAG,GAAG,MAAM,cAAc,EAAE,CAAC;IACnC,MAAM,KAAK,GAAG,MAAM,kBAAkB,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACjD,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,GAAG,CAAC,OAAO,YAAY,KAAK,UAAU,EAAE;QACjE,OAAO,EAAE,MAAM,CAAC,GAAG,CAAC;KACrB,CAAC,CAAC;IACH,IAAI,CAAC,GAAG,CAAC,EAAE;QAAE,MAAM,WAAW,CAAC,GAAG,EAAE,cAAc,CAAC,CAAC;IACpD,MAAM,EAAE,OAAO,EAAE,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAiC,CAAC;IACvE,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;QACd,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC;QAC9D,OAAO;IACT,CAAC;IACD,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,kBAAkB,KAAK,KAAK,CAAC,CAAC;QACnD,OAAO;IACT,CAAC;IACD,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;QACxB,MAAM,IAAI,GAAG,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC;QAC3E,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,eAAe,IAAI,IAAI,CAAC,CAAC;IACpE,CAAC;AACH,CAAC,CAAC,CACL;KACA,UAAU,CACT,IAAI,OAAO,CAAC,IAAI,CAAC;KACd,KAAK,CAAC,QAAQ,CAAC;KACf,WAAW,CAAC,yBAAyB,CAAC;KACtC,QAAQ,CAAC,QAAQ,EAAE,aAAa,CAAC;KACjC,MAAM,CAAC,YAAY,EAAE,+CAA+C,CAAC;KACrE,MAAM,CAAC,KAAK,EAAE,IAAY,EAAE,IAAsB,EAAE,EAAE;IACrD,MAAM,GAAG,GAAG,MAAM,cAAc,EAAE,CAAC;IACnC,MAAM,KAAK,GAAG,MAAM,kBAAkB,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACjD,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,GAAG,CAAC,OAAO,YAAY,KAAK,YAAY,IAAI,EAAE,EAAE;QACzE,MAAM,EAAE,QAAQ;QAChB,OAAO,EAAE,MAAM,CAAC,GAAG,CAAC;KACrB,CAAC,CAAC;IACH,IAAI,CAAC,GAAG,CAAC,EAAE;QAAE,MAAM,WAAW,CAAC,GAAG,EAAE,MAAM,IAAI,EAAE,CAAC,CAAC;IAClD,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,aAAa,IAAI,SAAS,KAAK,IAAI,CAAC,CAAC;AAC5D,CAAC,CAAC,CACL,CAAC;AAEJ,yCAAyC;AAEzC,MAAM,CAAC,KAAK,UAAU,cAAc;IAClC,MAAM,GAAG,GAAG,MAAM,UAAU,EAAE,CAAC;IAC/B,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,EAAE,CAAC;QACxB,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,sCAAsC,CAAC,CAAC;QAC7D,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,MAAM,UAAU,MAAM,CAAC,GAAc;IACnC,OAAO;QACL,aAAa,EAAE,UAAU,GAAG,CAAC,OAAQ,CAAC,KAAK,EAAE;QAC7C,cAAc,EAAE,kBAAkB;KACnC,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,QAA4B;IACnE,IAAI,QAAQ,EAAE,CAAC;QACb,IAAI,CAAC,mBAAmB,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,QAAQ,CAAC,MAAM,GAAG,EAAE,EAAE,CAAC;YAChE,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,wBAAwB,QAAQ,MAAM,CAAC,CAAC;YAC7D,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;QACD,OAAO,QAAQ,CAAC;IAClB,CAAC;IACD,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,cAAc,CAAC,EAAE,MAAM,CAAC,CAAC;QACxE,MAAM,IAAI,GAAI,IAAI,CAAC,KAAK,CAAC,GAAG,CAAuB,CAAC,IAAI,CAAC;QACzD,IAAI,IAAI,IAAI,mBAAmB,CAAC,IAAI,CAAC,IAAI,CAAC;YAAE,OAAO,IAAI,CAAC;IAC1D,CAAC;IAAC,MAAM,CAAC,CAAA,CAAC;IACV,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,oGAAoG,CACrG,CAAC;IACF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,GAAa,EAAE,MAAc;IAC7D,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;IAC9B,IAAI,GAAG,GAAG,IAAI,CAAC;IACf,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAuB,CAAC;QACtD,IAAI,MAAM,CAAC,KAAK;YAAE,GAAG,GAAG,MAAM,CAAC,KAAK,CAAC;IACvC,CAAC;IAAC,MAAM,CAAC,CAAA,CAAC;IACV,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,QAAQ,MAAM,YAAY,GAAG,CAAC,MAAM,MAAM,GAAG,IAAI,CAAC,CAAC;IACxE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@proappstore/cli",
-  "version": "2.6.3",
+  "version": "2.6.5",
   "description": "pas — CLI for publishing paid apps to proappstore.online",
   "license": "MIT",
   "type": "module",