@revturbine/cli 0.17.1 → 0.17.2

package/README.md

@@ -83,10 +83,24 @@ Commands that read a config name the version explicitly — there is no default:
 | `evaluate` | Run a config version's placement/entitlement decisions locally for a user context. Use `--slot` with optional `--component-type`; deprecated `--surface-type` remains an alias. |
 | `generate types` | Generate a TypeScript module of typed Playbook handles from any config version — `Entitlements` (namespaced by type, with the `EntitlementHandle` union for type-safe `can()`/`gate()`/`checkEntitlement()` call sites), plus `Plans`, `Segments`, `SurfaceTemplates`, and `UiPathActionTypes`. Const objects + literal-union types (erasable — no enums). `--out <path>` writes the file; the generated header records the exact command to regenerate it. `--json` for the raw handle map. |
 | `analytics catalog\|templates\|views\|view\|create\|preview\|query` | Work with the hosted Semantic Catalog and canonical analytics-view documents. Create and preview pass the document through unchanged to the same server contract used by the web editor and MCP tools; preview remains subject to the server's query limits. |
+| `ingest-keys create` (alias `mint`) | Mint a tenant-bound public ingest token for browser SDK use. Requires one or more `--origin` values; optional `--ip` restrictions. The full token is returned once. `ingest-keys list` shows ids/previews and `ingest-keys revoke <id>` invalidates one. |
 
 `--json` on read commands emits machine-readable output. Results go to stdout,
 diagnostics to stderr.
 
+### Mint a publishable ingest token
+
+```bash
+revturbine login
+revturbine ingest-keys mint --origin https://app.example.com --json
+# Store the once-only token, then use the returned id when it is no longer needed:
+revturbine ingest-keys revoke <ingest-key-id> --yes
+```
+
+Public ingest tokens are intentionally embeddable but remain tenant-bound,
+origin-restricted, and optionally IP-restricted. They cannot mint other tokens
+or access private control-plane APIs.
+
 ## Exit-code classes
 
 ```

package/dist/cli.js

@@ -11878,7 +11878,7 @@ Command groups:
   Inspect       status, history, preview, evaluate
   Codegen       generate types
   Analytics     analytics catalog|templates|views|view|create|preview|query
-  Keys          ingest-keys create|list|revoke
+  Keys          ingest-keys create (alias: mint)|list|revoke
 
 Version selectors (no defaults \u2014 a command that reads a config requires one):
   <file>            a local Playbook file (positional, or --file <path>)
@@ -11908,6 +11908,11 @@ Common workflows:
   revturbine history
   revturbine restore <playbook-version-id> --launch
 
+  # Mint an origin-restricted browser token (shown once), then revoke it
+  revturbine ingest-keys mint --origin https://app.example.com --json
+  revturbine ingest-keys list
+  revturbine ingest-keys revoke <ingest-key-id> --yes
+
 Exit-code classes: 0 ok \xB7 1 unexpected \xB7 2 usage \xB7 3 auth \xB7 4 validation
 blocked \xB7 5 conflict/stale \xB7 6 network \xB7 7 server error.
 
@@ -12579,7 +12584,18 @@ analyticsConnectionOptions(
   emitAnalyticsResult(conn, "analytics query", result, opts.json);
 });
 var ingestKeys = program.command("ingest-keys").description("Manage public ingest keys (embeddable SDK telemetry credentials) for the tenant.");
-ingestKeys.command("create").description("Mint a public ingest key. The full token is printed ONCE and cannot be retrieved again.").requiredOption("--origin <url...>", "Allowed browser origin(s), e.g. https://app.example.com (repeatable; at least one required)").option("--ip <cidr...>", "Optional IP / CIDR allowlist (empty = no IP restriction)").option("-u, --url <url>", "RevTurbine instance URL", DEFAULT_URL).option("-t, --tenant-id <id>", "x-tenant-id (defaults to the stored token tenant)").option("--json", "Machine-readable output (token on stdout for scripted capture)").action(async (opts) => {
+ingestKeys.command("create").alias("mint").description("Mint a public ingest key. The full token is printed ONCE and cannot be retrieved again.").requiredOption("--origin <url...>", "Allowed browser origin(s), e.g. https://app.example.com (repeatable; at least one required)").option("--ip <cidr...>", "Optional IP / CIDR allowlist (empty = no IP restriction)").option("-u, --url <url>", "RevTurbine instance URL", DEFAULT_URL).option("-t, --tenant-id <id>", "x-tenant-id (defaults to the stored token tenant)").option("--json", "Machine-readable output (token on stdout for scripted capture)").addHelpText(
+  "after",
+  [
+    "",
+    "Examples:",
+    "  revturbine ingest-keys mint --origin https://app.example.com",
+    "  revturbine ingest-keys create --origin https://app.example.com --ip 203.0.113.0/24 --json",
+    "",
+    "The full token is returned only by this command. Store it securely or",
+    "capture --json output, and revoke it by id when the integration or test ends."
+  ].join("\n")
+).action(async (opts) => {
   const conn = connect(opts.url, opts.tenantId);
   const result = await createIngestKey(conn.url, conn.headers, { originAllowlist: opts.origin, ipAllowlist: opts.ip });
   if (!result.ok || !result.key) httpFail(conn, "ingest-keys create", result.status, result.error);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@revturbine/cli",
-  "version": "0.17.1",
+  "version": "0.17.2",
   "description": "revturbine — validate RevTurbine Playbooks and ship them to a RevTurbine instance through the playbook-version lifecycle (draft → Release).",
   "license": "MIT",
   "repository": {