@rikalabs/akter-cli 0.1.0-alpha.4 → 0.1.0-alpha.6

package/CHANGELOG.md

@@ -1,5 +1,17 @@
 # Changelog
 
+## 0.1.0-alpha.6 (2026-10-11)
+
+The CLI and framework release together on the `alpha` and `latest` npm dist-tags. CLI credential storage is unchanged; the matching framework adds `0034_cold_tier`, `0035_hot_table_foreign_keys` and opt-in cold objects. Rolling-upgrade safety from alpha.5 is **not established**; see the [framework changelog](https://github.com/Rika-Labs/akter/blob/main/packages/akter/CHANGELOG.md) and [alpha upgrade notes](https://docs.akter.dev/operations/alpha-upgrades) before upgrading runners.
+
+- Adds the environment application-key contract to `@rikalabs/akter-cli/cloud-api`: `EnvironmentApiKeysGroup`, `EnvironmentApiKeyTenant`, `EnvironmentApiKey`, `CreateEnvironmentApiKey` and `CreatedEnvironmentApiKey`, composed into `CloudApi`. The additive routes create, list and revoke keys under `/api/projects/:projectId/environments/:environment/api-keys`; only creation returns `{ key, secret }`, while list returns metadata including revoked keys and revoke returns 204. These keys authenticate the deployed application, not the control plane; see the [environment API keys contract](https://docs.akter.dev/api/09-environment-api-keys).
+- Adds `akter keys create <name> [--tenant <tenant>]`, `akter keys list` and `akter keys revoke <keyId>`, using stored control-plane credentials, `--project` (default `AKTER_PROJECT`) and `--env` (default `production`). An omitted tenant selects `default`; supplied tenants are validated. Create writes only the one-time secret to stdout and a save-now warning to stderr. List prints tab-separated metadata, never secrets; revoke confirms only server success. Metadata output strips terminal escapes and replaces control, line-separator and bidirectional characters without changing requests. Protect redirected secret output and keep it out of shared logs; see [CLI usage](https://docs.akter.dev/api/06-cli#akter-keys).
+- Clarifies the cloud database report's four-session runner budget and rollout overlap; its wire schema is unchanged. Environment-key contract and CLI tests establish public client encoding, decoding and output, not cloud database authorization or edge authentication. Logs-follow interruption tests now wait for an actual outstanding HTTP poll before checking cancellation; production follow behavior is unchanged.
+
+## 0.1.0-alpha.5 (2026-10-09)
+
+- Releases with the matching alpha.5 framework, which adds the supported four-session `Database.postgres({ url, preset: "low-connection" })` preset. CLI behavior and the bundled `@rikalabs/akter-cli/cloud-api` contract are unchanged from alpha.4.
+
 ## 0.1.0-alpha.4 (2026-10-09)
 
 - **Breaking cloud contract:** every environment uses customer Postgres through `DATABASE_URL`. `Environment.database`, when reported, is `{ source: "customer", state: "missing" | "reachable" | "unreachable", latency, latencyWarning, runnerCap }`. Latency is nullable p50 milliseconds; runner cap is a nullable integer. The managed source and provisioning, ready, read-only and failed states are removed.

package/dist/cloud-api/contract.d.ts

@@ -629,7 +629,35 @@ declare const CloudApi_base: HttpApi.HttpApi<"akter-cloud", import("effect/http-
         readonly value: import("effect/Schema").String;
     }>>;
     readonly createdAt: import("effect/Schema").DateTimeUtc;
-}>>, import("effect/Schema").toCodecJson<typeof import("./errors.ts").Forbidden | typeof import("./errors.ts").NotFound | typeof import("./errors.ts").Conflict | typeof import("./errors.ts").NotImplemented | typeof import("./errors.ts").Unavailable>, Authentication, never>, false> | import("effect/http-api/HttpApiGroup").HttpApiGroup<"environmentVariables", import("effect/http-api/HttpApiEndpoint").HttpApiEndpoint<"delete", "DELETE", "/api/projects/:projectId/environments/:environment/variables/:name", import("effect/Schema").toCodecStringTree<import("effect/Schema").Struct<{
+}>>, import("effect/Schema").toCodecJson<typeof import("./errors.ts").Forbidden | typeof import("./errors.ts").NotFound | typeof import("./errors.ts").Conflict | typeof import("./errors.ts").NotImplemented | typeof import("./errors.ts").Unavailable>, Authentication, never>, false> | import("effect/http-api/HttpApiGroup").HttpApiGroup<"environmentApiKeys", import("effect/http-api/HttpApiEndpoint").HttpApiEndpoint<"create", "POST", "/api/projects/:projectId/environments/:environment/api-keys", import("effect/Schema").toCodecStringTree<import("effect/Schema").Struct<{
+    projectId: import("effect/Schema").brand<import("effect/Schema").String, "ProjectId">;
+    environment: import("effect/Schema").Literals<readonly ["production", "staging", "dev"]>;
+}>>, never, import("effect/Schema").toCodecJson<import("effect/Schema").Struct<{
+    readonly name: import("effect/Schema").brand<import("effect/Schema").String, "Name">;
+    readonly tenant: import("effect/Schema").optional<import("effect/Schema").String>;
+}>>, never, import("effect/Schema").toCodecJson<import("effect/Schema").Struct<{
+    readonly key: import("effect/Schema").Struct<{
+        readonly id: import("effect/Schema").String;
+        readonly name: import("effect/Schema").String;
+        readonly tenant: import("effect/Schema").String;
+        readonly createdAt: import("effect/Schema").DateTimeUtc;
+        readonly revokedAt: import("effect/Schema").NullOr<import("effect/Schema").DateTimeUtc>;
+    }>;
+    readonly secret: import("effect/Schema").String;
+}>>, import("effect/Schema").toCodecJson<typeof import("./errors.ts").Forbidden | typeof import("./errors.ts").NotFound | typeof import("./errors.ts").Conflict | typeof import("./errors.ts").NotImplemented | typeof import("./errors.ts").Unavailable>, Authentication, never> | import("effect/http-api/HttpApiEndpoint").HttpApiEndpoint<"list", "GET", "/api/projects/:projectId/environments/:environment/api-keys", import("effect/Schema").toCodecStringTree<import("effect/Schema").Struct<{
+    projectId: import("effect/Schema").brand<import("effect/Schema").String, "ProjectId">;
+    environment: import("effect/Schema").Literals<readonly ["production", "staging", "dev"]>;
+}>>, never, never, never, import("effect/Schema").toCodecJson<import("effect/Schema").$Array<import("effect/Schema").Struct<{
+    readonly id: import("effect/Schema").String;
+    readonly name: import("effect/Schema").String;
+    readonly tenant: import("effect/Schema").String;
+    readonly createdAt: import("effect/Schema").DateTimeUtc;
+    readonly revokedAt: import("effect/Schema").NullOr<import("effect/Schema").DateTimeUtc>;
+}>>>, import("effect/Schema").toCodecJson<typeof import("./errors.ts").Forbidden | typeof import("./errors.ts").NotFound | typeof import("./errors.ts").NotImplemented | typeof import("./errors.ts").Unavailable>, Authentication, never> | import("effect/http-api/HttpApiEndpoint").HttpApiEndpoint<"revoke", "DELETE", "/api/projects/:projectId/environments/:environment/api-keys/:keyId", import("effect/Schema").toCodecStringTree<import("effect/Schema").Struct<{
+    projectId: import("effect/Schema").brand<import("effect/Schema").String, "ProjectId">;
+    environment: import("effect/Schema").Literals<readonly ["production", "staging", "dev"]>;
+    keyId: import("effect/Schema").String;
+}>>, never, never, never, import("effect/Schema").toCodecJson<import("effect/http-api/HttpApiSchema").NoContent>, import("effect/Schema").toCodecJson<typeof import("./errors.ts").Forbidden | typeof import("./errors.ts").NotFound | typeof import("./errors.ts").Conflict | typeof import("./errors.ts").NotImplemented | typeof import("./errors.ts").Unavailable>, Authentication, never>, false> | import("effect/http-api/HttpApiGroup").HttpApiGroup<"environmentVariables", import("effect/http-api/HttpApiEndpoint").HttpApiEndpoint<"delete", "DELETE", "/api/projects/:projectId/environments/:environment/variables/:name", import("effect/Schema").toCodecStringTree<import("effect/Schema").Struct<{
     projectId: import("effect/Schema").brand<import("effect/Schema").String, "ProjectId">;
     environment: import("effect/Schema").Literals<readonly ["production", "staging", "dev"]>;
     name: import("effect/Schema").String;

package/dist/cloud-api/groups/projects.d.ts

@@ -105,6 +105,37 @@ declare const ProjectsGroup_base: HttpApiGroup.HttpApiGroup<"projects", HttpApiE
 }>>, Schema.toCodecJson<typeof import("../errors.ts").Forbidden | typeof import("../errors.ts").NotFound | typeof import("../errors.ts").Conflict | typeof import("../errors.ts").NotImplemented | typeof import("../errors.ts").Unavailable>, never, never>, false>;
 export declare class ProjectsGroup extends ProjectsGroup_base {
 }
+declare const EnvironmentApiKeysGroup_base: HttpApiGroup.HttpApiGroup<"environmentApiKeys", HttpApiEndpoint.HttpApiEndpoint<"create", "POST", "/projects/:projectId/environments/:environment/api-keys", Schema.toCodecStringTree<Schema.Struct<{
+    projectId: Schema.brand<Schema.String, "ProjectId">;
+    environment: Schema.Literals<readonly ["production", "staging", "dev"]>;
+}>>, never, Schema.toCodecJson<Schema.Struct<{
+    readonly name: Schema.brand<Schema.String, "Name">;
+    readonly tenant: Schema.optional<Schema.String>;
+}>>, never, Schema.toCodecJson<Schema.Struct<{
+    readonly key: Schema.Struct<{
+        readonly id: Schema.String;
+        readonly name: Schema.String;
+        readonly tenant: Schema.String;
+        readonly createdAt: Schema.DateTimeUtc;
+        readonly revokedAt: Schema.NullOr<Schema.DateTimeUtc>;
+    }>;
+    readonly secret: Schema.String;
+}>>, Schema.toCodecJson<typeof import("../errors.ts").Forbidden | typeof import("../errors.ts").NotFound | typeof import("../errors.ts").Conflict | typeof import("../errors.ts").NotImplemented | typeof import("../errors.ts").Unavailable>, never, never> | HttpApiEndpoint.HttpApiEndpoint<"list", "GET", "/projects/:projectId/environments/:environment/api-keys", Schema.toCodecStringTree<Schema.Struct<{
+    projectId: Schema.brand<Schema.String, "ProjectId">;
+    environment: Schema.Literals<readonly ["production", "staging", "dev"]>;
+}>>, never, never, never, Schema.toCodecJson<Schema.$Array<Schema.Struct<{
+    readonly id: Schema.String;
+    readonly name: Schema.String;
+    readonly tenant: Schema.String;
+    readonly createdAt: Schema.DateTimeUtc;
+    readonly revokedAt: Schema.NullOr<Schema.DateTimeUtc>;
+}>>>, Schema.toCodecJson<typeof import("../errors.ts").Forbidden | typeof import("../errors.ts").NotFound | typeof import("../errors.ts").NotImplemented | typeof import("../errors.ts").Unavailable>, never, never> | HttpApiEndpoint.HttpApiEndpoint<"revoke", "DELETE", "/projects/:projectId/environments/:environment/api-keys/:keyId", Schema.toCodecStringTree<Schema.Struct<{
+    projectId: Schema.brand<Schema.String, "ProjectId">;
+    environment: Schema.Literals<readonly ["production", "staging", "dev"]>;
+    keyId: Schema.String;
+}>>, never, never, never, Schema.toCodecJson<import("effect/http-api/HttpApiSchema").NoContent>, Schema.toCodecJson<typeof import("../errors.ts").Forbidden | typeof import("../errors.ts").NotFound | typeof import("../errors.ts").Conflict | typeof import("../errors.ts").NotImplemented | typeof import("../errors.ts").Unavailable>, never, never>, false>;
+export declare class EnvironmentApiKeysGroup extends EnvironmentApiKeysGroup_base {
+}
 declare const EnvironmentVariablesGroup_base: HttpApiGroup.HttpApiGroup<"environmentVariables", HttpApiEndpoint.HttpApiEndpoint<"delete", "DELETE", "/projects/:projectId/environments/:environment/variables/:name", Schema.toCodecStringTree<Schema.Struct<{
     projectId: Schema.brand<Schema.String, "ProjectId">;
     environment: Schema.Literals<readonly ["production", "staging", "dev"]>;

package/dist/cloud-api/index.d.ts

@@ -2,14 +2,14 @@ export { Conflict, Forbidden, NotFound, NotFoundResource, NotImplemented, Payloa
 export { ApiKeyIdentity, Authentication, CurrentIdentity, Identity, SessionIdentity, apiKeyHeaderName, secureSessionCookieName, sessionCookieName, } from "./auth.ts";
 export { ActorAddress, ActorReference, ApiKeyId, BillingPeriod, CalendarDay, CommitSha, DeadLetterId, DeploymentId, DomainId, Email, EnvironmentName, InvitationId, InviteRole, EnvironmentId, InvoiceId, MemberId, Name, NonNegative, NonNegativeInt, OrganizationId, Page, ProjectId, RegionId, Role, SeriesPoint, Slug, Timestamp, UserId, pageQuery, } from "./primitives.ts";
 export { ApiKey, ApiKeyPermission, CreateApiKey, CreateInvitation, CreateOrganization, CreatedApiKey, DeleteAccount, Invitation, InvitationPreview, KnownPlan, InvitationStatus, Me, Member, MemberUser, NotificationEvent, NotificationPreference, NotificationSettings, Organization, OrganizationDeletion, OrganizationMembership, OrganizationPlan, PinActor, PersonalDataExport, PinnedActor, PlanId, Preferences, SetActiveOrganization, Theme, UpdateMemberRole, UpdateOrganization, UpdatePreferences, UnboundPlan, UnknownPlan, UpdateProfile, User, } from "./identity.ts";
-export { AddDomain, AddRegion, ConnectIntegration, CreateEnvironment, CreateProject, DnsRecord, Domain, DomainStatus, EnvVariable, EnvVariableName, Environment, Hostname, ImportEnvVariables, ImportEnvVariablesResult, Integration, IntegrationConnection, IntegrationKind, OwnedTable, Project, ProjectEndpoints, ProjectRegion, ProjectStatus, Region, SetEnvVariable, SetHomeRegion, UpdateProject, } from "./projects.ts";
+export { AddDomain, AddRegion, ConnectIntegration, CreateEnvironment, CreateEnvironmentApiKey, CreatedEnvironmentApiKey, CreateProject, DnsRecord, Domain, DomainStatus, EnvVariable, EnvVariableName, Environment, EnvironmentApiKey, EnvironmentApiKeyTenant, Hostname, ImportEnvVariables, ImportEnvVariablesResult, Integration, IntegrationConnection, IntegrationKind, OwnedTable, Project, ProjectEndpoints, ProjectRegion, ProjectStatus, Region, SetEnvVariable, SetHomeRegion, UpdateProject, } from "./projects.ts";
 export { BuildLog, BuildLogLine, CreateDeployment, DeploymentAuthor, DeploymentDetail, DeploymentRunner, DeploymentSource, DeploymentStatus, DeploymentSummary, ImageDigest, MAX_SOURCE_BYTES, RecordBuild, FailBuild, RolloutStep, RolloutStepName, SOURCE_ENTRY, SourceArchive, SourceDigest, } from "./deployments.ts";
 export { ActorEvent, ActorInspector, ActorInstance, ActorJob, ActorTimelineEntry, ActorTypeActivity, ActorTypeSummary, CommandCaller, CommandFailed, CommandRefused, CommandExpired, RunnerDefect, CommandStreamGap, CommandLogEntry, QuotaErrors, QuotaExceeded, QuotaUnbound, CommandOutcome, CommandSent, CommandVolume, ConnectionsSummary, DeadLetter, JobStatus, JobTypeStats, JobsSummary, LatencyBucket, Overview, OwnedTableRows, Receipt, Schedule, SearchResult, SendCommand, SeriesWindow, SidebarCounts, TimersSummary, TurnLatency, Workflow, } from "./runtime.ts";
 export { AuditEntry, BillingSummary, CapState, CardPaymentMethod, CatalogPlan, ComputeSize, ComputeUsage, PlanCatalog, PlanFeature, HostedSession, Invoice, LinkPaymentMethod, PaymentMethod, Plan, SetSpendLimit, SpendLimit, StartCheckout, PlanChange, Usage, UsageMeter, UsageMeterName, UsagePricing, } from "./billing.ts";
 export { CloudApi } from "./contract.ts";
 export { LogCursor, LogLimit, LogWait, MAX_LOG_LINES, MAX_LOG_TEXT_BYTES, MAX_LOG_WAIT_SECONDS, MAX_LOG_WINDOW_SECONDS, RunnerLogLine, RunnerLogPage, logQuery, } from "./logs.ts";
 export { AccountGroup, ApiKeysGroup, InvitationsGroup, MembersGroup, OrganizationsGroup, } from "./groups/account.ts";
-export { DomainsGroup, EnvironmentVariablesGroup, IntegrationsGroup, ProjectsGroup, RegionsGroup, } from "./groups/projects.ts";
+export { DomainsGroup, EnvironmentApiKeysGroup, EnvironmentVariablesGroup, IntegrationsGroup, ProjectsGroup, RegionsGroup, } from "./groups/projects.ts";
 export { DeploymentsGroup } from "./groups/deployments.ts";
 export { AuditGroup, BillingGroup, UsageGroup } from "./groups/billing.ts";
 export { RuntimeGroup } from "./groups/runtime.ts";

package/dist/cloud-api/index.js

@@ -318,6 +318,22 @@ var Environment = Schema5.Struct({
   }))
 });
 var CreateEnvironment = Schema5.Struct({ name: EnvironmentName });
+var EnvironmentApiKeyTenant = Schema5.String.check(Schema5.isPattern(/^[A-Za-z0-9._:-]{1,128}$/u));
+var EnvironmentApiKey = Schema5.Struct({
+  id: Schema5.String,
+  name: Schema5.String,
+  tenant: Schema5.String,
+  createdAt: Timestamp,
+  revokedAt: Schema5.NullOr(Timestamp)
+});
+var CreateEnvironmentApiKey = Schema5.Struct({
+  name: Name,
+  tenant: Schema5.optional(EnvironmentApiKeyTenant)
+});
+var CreatedEnvironmentApiKey = Schema5.Struct({
+  key: EnvironmentApiKey,
+  secret: Schema5.String
+});
 var EnvVariable = Schema5.Struct({
   name: Schema5.String,
   usedBy: Schema5.Array(Schema5.String),
@@ -1233,6 +1249,21 @@ class ProjectsGroup extends HttpApiGroup4.make("projects").add(HttpApiEndpoint4.
 })) {
 }
 
+class EnvironmentApiKeysGroup extends HttpApiGroup4.make("environmentApiKeys").add(HttpApiEndpoint4.get("list", "/projects/:projectId/environments/:environment/api-keys", {
+  params: environmentParams,
+  success: Schema13.Array(EnvironmentApiKey),
+  error: ReadErrors
+}), HttpApiEndpoint4.post("create", "/projects/:projectId/environments/:environment/api-keys", {
+  params: environmentParams,
+  payload: CreateEnvironmentApiKey,
+  success: CreatedEnvironmentApiKey,
+  error: WriteErrors
+}), HttpApiEndpoint4.delete("revoke", "/projects/:projectId/environments/:environment/api-keys/:keyId", {
+  params: { ...environmentParams, keyId: Schema13.String },
+  error: WriteErrors
+})) {
+}
+
 class EnvironmentVariablesGroup extends HttpApiGroup4.make("environmentVariables").add(HttpApiEndpoint4.get("list", "/projects/:projectId/environments/:environment/variables", {
   params: environmentParams,
   success: Schema13.Array(EnvVariable),
@@ -1418,7 +1449,7 @@ class RuntimeGroup extends HttpApiGroup5.make("runtime").add(HttpApiEndpoint5.ge
 }
 
 // ../../packages/cloud-api/src/contract.ts
-class CloudApi extends HttpApi.make("akter-cloud").add(AccountGroup, OrganizationsGroup, MembersGroup, InvitationsGroup, ApiKeysGroup, ProjectsGroup, EnvironmentVariablesGroup, DomainsGroup, RegionsGroup, IntegrationsGroup, DeploymentsGroup, RuntimeGroup, BillingGroup, UsageGroup, AuditGroup).middleware(Authentication).prefix("/api").annotateMerge(OpenApi3.annotations({ title: "Akter Cloud API" })) {
+class CloudApi extends HttpApi.make("akter-cloud").add(AccountGroup, OrganizationsGroup, MembersGroup, InvitationsGroup, ApiKeysGroup, ProjectsGroup, EnvironmentApiKeysGroup, EnvironmentVariablesGroup, DomainsGroup, RegionsGroup, IntegrationsGroup, DeploymentsGroup, RuntimeGroup, BillingGroup, UsageGroup, AuditGroup).middleware(Authentication).prefix("/api").annotateMerge(OpenApi3.annotations({ title: "Akter Cloud API" })) {
 }
 export {
   AccountGroup,
@@ -1469,10 +1500,12 @@ export {
   CreateApiKey,
   CreateDeployment,
   CreateEnvironment,
+  CreateEnvironmentApiKey,
   CreateInvitation,
   CreateOrganization,
   CreateProject,
   CreatedApiKey,
+  CreatedEnvironmentApiKey,
   CurrentIdentity,
   DeadLetter,
   DeadLetterId,
@@ -1494,6 +1527,9 @@ export {
   EnvVariable,
   EnvVariableName,
   Environment,
+  EnvironmentApiKey,
+  EnvironmentApiKeyTenant,
+  EnvironmentApiKeysGroup,
   EnvironmentId,
   EnvironmentName,
   EnvironmentVariablesGroup,

package/dist/cloud-api/projects.d.ts

@@ -31,7 +31,7 @@ export type UpdateProject = typeof UpdateProject.Type;
  * Every environment uses the customer's Postgres through `DATABASE_URL`.
  * `latency` is the deploy probe's p50 in milliseconds from the runner region,
  * null when unmeasured. Above 5 ms, `latencyWarning` warns without refusing.
- * `runnerCap` is floor((max_connections - in_use - 10) / 9), null when unknown;
+ * `runnerCap` is floor((max_connections - in_use - 10) / 4), null when unknown;
  * a non-positive cap means no runner fits the available connection budget.
  * The status carries no URL or URL-derived field.
  */
@@ -52,6 +52,36 @@ export declare const CreateEnvironment: Schema.Struct<{
     readonly name: Schema.Literals<readonly ["production", "staging", "dev"]>;
 }>;
 export type CreateEnvironment = typeof CreateEnvironment.Type;
+/** The tenant a deployed application's key acts in. */
+export declare const EnvironmentApiKeyTenant: Schema.String;
+export type EnvironmentApiKeyTenant = typeof EnvironmentApiKeyTenant.Type;
+/** An environment key's metadata; its secret is readable only at creation. */
+export declare const EnvironmentApiKey: Schema.Struct<{
+    readonly id: Schema.String;
+    readonly name: Schema.String;
+    readonly tenant: Schema.String;
+    readonly createdAt: Schema.DateTimeUtc;
+    readonly revokedAt: Schema.NullOr<Schema.DateTimeUtc>;
+}>;
+export type EnvironmentApiKey = typeof EnvironmentApiKey.Type;
+/** Omitting tenant creates a key for the default tenant. */
+export declare const CreateEnvironmentApiKey: Schema.Struct<{
+    readonly name: Schema.brand<Schema.String, "Name">;
+    readonly tenant: Schema.optional<Schema.String>;
+}>;
+export type CreateEnvironmentApiKey = typeof CreateEnvironmentApiKey.Type;
+/** The only environment-key response carrying the one-time secret. */
+export declare const CreatedEnvironmentApiKey: Schema.Struct<{
+    readonly key: Schema.Struct<{
+        readonly id: Schema.String;
+        readonly name: Schema.String;
+        readonly tenant: Schema.String;
+        readonly createdAt: Schema.DateTimeUtc;
+        readonly revokedAt: Schema.NullOr<Schema.DateTimeUtc>;
+    }>;
+    readonly secret: Schema.String;
+}>;
+export type CreatedEnvironmentApiKey = typeof CreatedEnvironmentApiKey.Type;
 /** An environment variable as readable: its name and provenance, never its value or any part of it. */
 export declare const EnvVariable: Schema.Struct<{
     readonly name: Schema.String;
@@ -156,6 +186,7 @@ export declare const SetHomeRegion: Schema.Struct<{
     readonly region: Schema.Literals<readonly ["us-east-1", "us-west-2"]>;
 }>;
 export type SetHomeRegion = typeof SetHomeRegion.Type;
+/** Public environment URLs; OpenAPI and MCP paths are empty when not advertised. */
 export declare const ProjectEndpoints: Schema.Struct<{
     readonly httpBaseUrl: Schema.String;
     readonly webSocketUrl: Schema.String;

package/dist/main.js

@@ -1,14 +1,14 @@
 #!/usr/bin/env node
 
 // src/main.ts
-import { Context as Context2, Effect as Effect23, Layer as Layer5, Stdio as Stdio2 } from "effect";
+import { Context as Context2, Effect as Effect24, Layer as Layer5, Stdio as Stdio2 } from "effect";
 import { FetchHttpClient } from "effect/http";
 
 // src/cli.ts
-import { Effect as Effect22, Runtime as Runtime2, Schema as Schema29 } from "effect";
-import { CliError, Command as Command19 } from "effect/cli";
+import { Effect as Effect23, Runtime as Runtime2, Schema as Schema29 } from "effect";
+import { CliError, Command as Command20 } from "effect/cli";
 // package.json
-var version = "0.1.0-alpha.4";
+var version = "0.1.0-alpha.6";
 
 // src/commands/adopt/run.ts
 import {
@@ -1312,6 +1312,22 @@ var Environment = Schema13.Struct({
   }))
 });
 var CreateEnvironment = Schema13.Struct({ name: EnvironmentName });
+var EnvironmentApiKeyTenant = Schema13.String.check(Schema13.isPattern(/^[A-Za-z0-9._:-]{1,128}$/u));
+var EnvironmentApiKey = Schema13.Struct({
+  id: Schema13.String,
+  name: Schema13.String,
+  tenant: Schema13.String,
+  createdAt: Timestamp,
+  revokedAt: Schema13.NullOr(Timestamp)
+});
+var CreateEnvironmentApiKey = Schema13.Struct({
+  name: Name,
+  tenant: Schema13.optional(EnvironmentApiKeyTenant)
+});
+var CreatedEnvironmentApiKey = Schema13.Struct({
+  key: EnvironmentApiKey,
+  secret: Schema13.String
+});
 var EnvVariable = Schema13.Struct({
   name: Schema13.String,
   usedBy: Schema13.Array(Schema13.String),
@@ -2227,6 +2243,21 @@ class ProjectsGroup extends HttpApiGroup4.make("projects").add(HttpApiEndpoint4.
 })) {
 }
 
+class EnvironmentApiKeysGroup extends HttpApiGroup4.make("environmentApiKeys").add(HttpApiEndpoint4.get("list", "/projects/:projectId/environments/:environment/api-keys", {
+  params: environmentParams,
+  success: Schema21.Array(EnvironmentApiKey),
+  error: ReadErrors
+}), HttpApiEndpoint4.post("create", "/projects/:projectId/environments/:environment/api-keys", {
+  params: environmentParams,
+  payload: CreateEnvironmentApiKey,
+  success: CreatedEnvironmentApiKey,
+  error: WriteErrors
+}), HttpApiEndpoint4.delete("revoke", "/projects/:projectId/environments/:environment/api-keys/:keyId", {
+  params: { ...environmentParams, keyId: Schema21.String },
+  error: WriteErrors
+})) {
+}
+
 class EnvironmentVariablesGroup extends HttpApiGroup4.make("environmentVariables").add(HttpApiEndpoint4.get("list", "/projects/:projectId/environments/:environment/variables", {
   params: environmentParams,
   success: Schema21.Array(EnvVariable),
@@ -2412,7 +2443,7 @@ class RuntimeGroup extends HttpApiGroup5.make("runtime").add(HttpApiEndpoint5.ge
 }
 
 // ../../packages/cloud-api/src/contract.ts
-class CloudApi extends HttpApi.make("akter-cloud").add(AccountGroup, OrganizationsGroup, MembersGroup, InvitationsGroup, ApiKeysGroup, ProjectsGroup, EnvironmentVariablesGroup, DomainsGroup, RegionsGroup, IntegrationsGroup, DeploymentsGroup, RuntimeGroup, BillingGroup, UsageGroup, AuditGroup).middleware(Authentication).prefix("/api").annotateMerge(OpenApi3.annotations({ title: "Akter Cloud API" })) {
+class CloudApi extends HttpApi.make("akter-cloud").add(AccountGroup, OrganizationsGroup, MembersGroup, InvitationsGroup, ApiKeysGroup, ProjectsGroup, EnvironmentApiKeysGroup, EnvironmentVariablesGroup, DomainsGroup, RegionsGroup, IntegrationsGroup, DeploymentsGroup, RuntimeGroup, BillingGroup, UsageGroup, AuditGroup).middleware(Authentication).prefix("/api").annotateMerge(OpenApi3.annotations({ title: "Akter Cloud API" })) {
 }
 // src/commands/cloud/deploy.ts
 import { Clock as Clock3, Config as Config3, Console as Console9, Duration as Duration3, Effect as Effect16, Option as Option8, Schema as Schema26, Stream } from "effect";
@@ -3209,9 +3240,57 @@ var logsCommand = Command18.make("logs", {
   }
 }).pipe(reportFailures)).pipe(Command18.withDescription("Read recent customer runner logs, or follow with resumable long polls"));
 
+// src/commands/cloud/keys.ts
+import { Config as Config7, Console as Console15, DateTime as DateTime4, Effect as Effect22, Option as Option12 } from "effect";
+import { Argument as Argument7, Command as Command19, Flag as Flag16 } from "effect/cli";
+var colourSequence2 = new RegExp(`${String.fromCodePoint(27)}\\[[0-?]*[ -/]*[@-~]`, "gu");
+var metadata = (value) => value.replace(colourSequence2, "").replace(/\p{Cc}|[\u061c\u200e\u200f\u2028\u2029\u202a-\u202e\u2066-\u2069]/gu, "�");
+var scope2 = {
+  project: Flag16.String("project").pipe(Flag16.withFallbackConfig(Config7.String("AKTER_PROJECT")), Flag16.withSchema(ProjectId), Flag16.withDescription("The project (default AKTER_PROJECT)")),
+  environment: Flag16.Literals("env", EnvironmentName.literals).pipe(Flag16.withDefault("production"), Flag16.withDescription("The environment (default production)"))
+};
+var create = Command19.make("create", {
+  ...scope2,
+  name: Argument7.String("name").pipe(Argument7.withSchema(Name), Argument7.withDescription("The key's display name")),
+  tenant: Flag16.String("tenant").pipe(Flag16.withSchema(EnvironmentApiKeyTenant), Flag16.optional, Flag16.withDescription("The application's tenant (default default)"))
+}, ({ project, environment, name, tenant }) => Effect22.gen(function* () {
+  const { client } = yield* signedIn;
+  const created = yield* client.environmentApiKeys.create({
+    params: { projectId: project, environment },
+    payload: Option12.isSome(tenant) ? { name, tenant: tenant.value } : { name }
+  });
+  yield* Console15.error(`Created ${metadata(created.key.id)} in ${metadata(environment)} for tenant ${metadata(created.key.tenant)}. Save the secret printed on stdout now; it cannot be read again.`);
+  yield* Console15.log(created.secret);
+}).pipe(reportFailures)).pipe(Command19.withDescription("Create an environment key; print its one-time secret on stdout"));
+var list3 = Command19.make("list", scope2, ({ project, environment }) => Effect22.gen(function* () {
+  const { client } = yield* signedIn;
+  const keys = yield* client.environmentApiKeys.list({
+    params: { projectId: project, environment }
+  });
+  for (const key of keys)
+    yield* Console15.log([
+      key.id,
+      key.name,
+      key.tenant,
+      DateTime4.formatIso(key.createdAt),
+      key.revokedAt === null ? "active" : DateTime4.formatIso(key.revokedAt)
+    ].map(metadata).join("\t"));
+}).pipe(reportFailures)).pipe(Command19.withDescription("List key metadata, including revoked keys; never print secrets"));
+var revoke2 = Command19.make("revoke", {
+  ...scope2,
+  keyId: Argument7.String("keyId").pipe(Argument7.withDescription("The key id to revoke"))
+}, ({ project, environment, keyId }) => Effect22.gen(function* () {
+  const { client } = yield* signedIn;
+  yield* client.environmentApiKeys.revoke({
+    params: { projectId: project, environment, keyId }
+  });
+  yield* Console15.log(`Revoked ${metadata(keyId)} in ${metadata(environment)}.`);
+}).pipe(reportFailures)).pipe(Command19.withDescription("Revoke an environment key"));
+var keysCommand = Command19.make("keys").pipe(Command19.withDescription("Manage Akter Cloud environment API keys for deployed applications"), Command19.withSubcommands([create, list3, revoke2]));
+
 // src/cli.ts
-var group = (name, description, subcommands) => Command19.make(name).pipe(Command19.withDescription(description), Command19.withSubcommands(subcommands));
-var akter = Command19.make("akter").pipe(Command19.withDescription("Run actors locally, check a deploy against stored data, adopt existing tables, inspect and repair a running deployment, and deploy to Akter Cloud"), Command19.withSubcommands([
+var group = (name, description, subcommands) => Command20.make(name).pipe(Command20.withDescription(description), Command20.withSubcommands(subcommands));
+var akter = Command20.make("akter").pipe(Command20.withDescription("Run actors locally, check a deploy against stored data, adopt existing tables, inspect and repair a running deployment, and deploy to Akter Cloud"), Command20.withSubcommands([
   {
     group: "Develop and check",
     commands: [
@@ -3262,19 +3341,20 @@ var akter = Command19.make("akter").pipe(Command19.withDescription("Run actors l
       whoamiCommand,
       deployCommand,
       envCommand,
+      keysCommand,
       logsCommand
     ]
   }
 ]));
 var isShowHelp = Schema29.is(CliError.ShowHelp);
-var run2 = (args) => Command19.runWith(akter, { version })(args).pipe(Effect22.catchIf((error) => CliError.isCliError(error) && Runtime2.getErrorExitCode(error) !== 0, (error) => Effect22.fail(CommandFailed.make({
+var run2 = (args) => Command20.runWith(akter, { version })(args).pipe(Effect23.catchIf((error) => CliError.isCliError(error) && Runtime2.getErrorExitCode(error) !== 0, (error) => Effect23.fail(CommandFailed.make({
   exitCode: 2,
   reason: isShowHelp(error) ? error.errors[0]?._tag ?? "ShowHelp" : error._tag
 }))));
 
 // src/main.ts
-Effect23.gen(function* () {
+Effect24.gen(function* () {
   const services = yield* Layer5.build(Layer5.mergeAll(PlatformServices.layer, FetchHttpClient.layer));
   const args = yield* Context2.get(services, Stdio2.Stdio).args;
-  return yield* run2(args).pipe(Effect23.provideContext(services));
-}).pipe(Effect23.scoped, PlatformRuntime.runMain);
+  return yield* run2(args).pipe(Effect24.provideContext(services));
+}).pipe(Effect24.scoped, PlatformRuntime.runMain);

package/package.json

@@ -1 +1 @@
-{"name":"@rikalabs/akter-cli","version":"0.1.0-alpha.4","files":["dist","CHANGELOG.md","README.md","LICENSE","NOTICE"],"dependencies":{"@effect/platform-bun":"4.0.2","@effect/platform-node":"4.0.2","@rikalabs/akter":"0.1.0-alpha.4"},"peerDependencies":{"@effect/sql-pg":"^4.0.2","@effect/sql-pglite":"^4.0.2","drizzle-orm":"^1.0.0-rc.5-5935859","effect":"^4.0.2"},"bin":{"akter":"dist/main.js"},"publishConfig":{"access":"public"},"description":"The Akter command-line tool for local development and Akter Cloud","keywords":["actors","akter","durable","effect","pglite","postgres"],"homepage":"https://github.com/Rika-Labs/akter#readme","bugs":"https://github.com/Rika-Labs/akter/issues","license":"Apache-2.0","author":"Rika Labs","repository":{"type":"git","url":"git+https://github.com/Rika-Labs/akter.git","directory":"apps/cli"},"type":"module","types":"./dist/main.d.ts","exports":{".":{"types":"./dist/main.d.ts","default":"./dist/main.js"},"./cloud-api":{"types":"./dist/cloud-api/index.d.ts","default":"./dist/cloud-api/index.js"}},"engines":{"bun":">=1.4.2","node":">=24.0.0"}}
+{"name":"@rikalabs/akter-cli","version":"0.1.0-alpha.6","files":["dist","CHANGELOG.md","README.md","LICENSE","NOTICE"],"dependencies":{"@effect/platform-bun":"4.0.2","@effect/platform-node":"4.0.2","@rikalabs/akter":"0.1.0-alpha.6"},"peerDependencies":{"@effect/sql-pg":"^4.0.2","@effect/sql-pglite":"^4.0.2","drizzle-orm":"^1.0.0-rc.5-5935859","effect":"^4.0.2"},"bin":{"akter":"dist/main.js"},"publishConfig":{"access":"public"},"description":"The Akter command-line tool for local development and Akter Cloud","keywords":["actors","akter","durable","effect","pglite","postgres"],"homepage":"https://github.com/Rika-Labs/akter#readme","bugs":"https://github.com/Rika-Labs/akter/issues","license":"Apache-2.0","author":"Rika Labs","repository":{"type":"git","url":"git+https://github.com/Rika-Labs/akter.git","directory":"apps/cli"},"type":"module","types":"./dist/main.d.ts","exports":{".":{"types":"./dist/main.d.ts","default":"./dist/main.js"},"./cloud-api":{"types":"./dist/cloud-api/index.d.ts","default":"./dist/cloud-api/index.js"}},"engines":{"bun":">=1.4.2","node":">=24.0.0"}}