@thinger-io/cli-core 0.4.2 → 0.5.1

package/lib/mcp/types/product-api.js

@@ -0,0 +1,44 @@
+// @ts-check
+import api from '../../api.js';
+import { TIMEOUTS } from '../../constants.js';
+import { apiError } from '../../errors.js';
+import { v1 } from '../../paths.js';
+
+/**
+ * A product API resource called for the product as a whole: an action of
+ * the catalog type product_profile_api.
+ *
+ * @type {import('../tools-resource.js').LocalAction}
+ */
+export const apiCall = {
+    description:
+        "Call a product API resource for the product as a whole, as an external system feeding data in would, with `body` as its payload. The entry needs a `device_id_resolver` (a function of the product code that returns each payload's device); the body may be an array, one payload per device. To call it for one device, use {op:device_resource.call}.",
+    op: 'Product_AccessResources',
+    examples: [
+        {
+            tool: 'resource_call',
+            arguments: {
+                type: 'product_profile_api',
+                action: 'call',
+                ids: { product: 'boiler_kit', resource: 'uplink' },
+
+                body: [{ dev_eui: 'a1b2c3', temperature: 21.5 }],
+            },
+            does: 'Feed one payload in; the device_id_resolver of the entry finds its device.',
+        },
+    ],
+    async run(body, ctx) {
+        try {
+            const res = await api.post(
+                `${v1(ctx.user)}/products/${encodeURIComponent(String(ctx.parent))}/resources/${encodeURIComponent(String(ctx.id))}`,
+                body ?? {},
+                { timeout: TIMEOUTS.API_LONG_MS },
+            );
+            return res.data ?? null;
+        } catch (e) {
+            throw apiError(e, {
+                notFound: `Not found: product ${ctx.parent} or its resource ${ctx.id}`,
+            });
+        }
+    },
+};

package/lib/mcp/types/profile.js

@@ -0,0 +1,37 @@
+// @ts-check
+import { getActiveProfile, getProfile, listProfiles } from '../../config.js';
+
+/**
+ * The profiles of this CLI as a type of the resource tools: the lookup of
+ * the profiles themselves, so it takes no `profile` (nor `user`).
+ *
+ * @type {import('../tools-resource.js').LocalType}
+ */
+export const profile = {
+    description:
+        'Profiles of this CLI: each one a server with its own credentials. Pass its name as `profile` to any tool to use that server for one call.',
+    id: 'profile',
+    profile: false,
+    user: false,
+    local: true,
+    notes: 'Profiles are not accounts: another account on the same server is reached with `user` (admin only), not with a profile.',
+    examples: [
+        {
+            tool: 'resource_list',
+            arguments: { type: 'profile' },
+            does: 'The configured servers, the default one marked active.',
+        },
+    ],
+    list() {
+        const active = getActiveProfile();
+        return listProfiles().map((name) => {
+            const data = getProfile(name) || {};
+            return {
+                profile: name,
+                server: data.server || name,
+                username: data.username || '',
+                active: name === active,
+            };
+        });
+    },
+};

package/lib/mcp/types/storage-file.js

@@ -0,0 +1,170 @@
+// @ts-check
+import fs from 'node:fs';
+import nodePath from 'node:path';
+import api from '../../api.js';
+import { collectFiles, uploadFiles } from '../../dashboard.js';
+import { apiError, inputError } from '../../errors.js';
+import { identity } from '../../identity.js';
+import { v1, v2 } from '../../paths.js';
+import { decodeBody } from '../../raw-api.js';
+import { deleteStorageFile, storageFilePath, writeStorageFile } from '../../storage.js';
+
+/** Files of a storage (the storages themselves are the catalog type "storage"). */
+
+/** A path inside the storage, without leading slashes (they would double up in the URL). */
+const clean = (p) => String(p).replace(/^\/+/, '');
+
+/** Largest single local file uploaded at once. */
+const MAX_FILE = 50 * 1024 * 1024;
+/** Largest local folder uploaded in one call. */
+const MAX_FOLDER = 200 * 1024 * 1024;
+
+/** Upload a local file (to `path`, default its name) or folder (under `path`). */
+async function uploadLocal(body, ctx) {
+    if (body.content !== undefined) throw inputError('pass body.content or body.local, not both');
+    const local = nodePath.resolve(String(body.local));
+    if (!fs.existsSync(local)) throw inputError(`No such local file or folder: ${body.local}`);
+    const path = ctx.id;
+    /** @type {Record<string, Buffer>} */
+    let files;
+    if (fs.statSync(local).isDirectory()) {
+        const prefix = path ? `${clean(path).replace(/\/+$/, '')}/` : '';
+        files = Object.fromEntries(
+            Object.entries(
+                collectFiles(local, {
+                    skip: new Set(['.git']),
+                    maxBytes: MAX_FOLDER,
+                    tooLarge: 'upload its subfolders or files in separate calls',
+                }),
+            ).map(([f, c]) => [prefix + f, c]),
+        );
+        if (!Object.keys(files).length) throw inputError(`${body.local} has no files`);
+    } else {
+        if (fs.statSync(local).size > MAX_FILE) {
+            throw inputError(`${body.local} is larger than ${MAX_FILE / 1024 / 1024} MB`);
+        }
+        files = { [path ? clean(path) : nodePath.basename(local)]: fs.readFileSync(local) };
+    }
+    await uploadFiles(String(ctx.parent), files, ctx.user);
+    const names = Object.keys(files);
+    const bytes = Object.values(files).reduce((n, c) => n + c.length, 0);
+    return { storage: ctx.parent, files: names, bytes };
+}
+
+/** Write `content` (text) at the path, or upload `local`. */
+async function write(body, ctx) {
+    if (body.local !== undefined) return uploadLocal(body, ctx);
+    if (!ctx.id) throw inputError('missing file: the path to write (or body.local)');
+    if (typeof body.content !== 'string') {
+        throw inputError('body.content (text) or body.local (a local file or folder) is required');
+    }
+    const path = clean(ctx.id);
+    await writeStorageFile(String(ctx.parent), path, body.content, ctx.user);
+    return { storage: ctx.parent, files: [path], bytes: Buffer.byteLength(body.content) };
+}
+
+/** @type {import('../tools-resource.js').LocalType} */
+export const storageFile = {
+    description:
+        'Files of a file storage: list a folder, read, write (text, or files and folders of this machine) and delete.',
+    parent: 'storage',
+    id: 'file',
+    recordId: 'path',
+
+    optionalId: ['create', 'update'],
+    ops: {
+        list: 'Storage_ListFiles',
+        get: 'Storage_ReadFilesFiles(?<file>.*$)',
+        create: 'Storage_UpdateFilesFiles(?<file>.*$)',
+        update: 'Storage_UpdateFilesFiles(?<file>.*$)',
+        delete: 'Storage_DeleteFilesFiles(?<file>.*$)',
+    },
+    filter: {
+        type: 'object',
+        additionalProperties: false,
+        properties: { path: { type: 'string', description: 'Folder to list.' } },
+    },
+    schema: {
+        type: 'object',
+        additionalProperties: false,
+        properties: {
+            content: { type: 'string', description: 'Text of the file at ids.file.' },
+            local: {
+                type: 'string',
+                description:
+                    'Or a file or folder of the machine running this CLI, uploaded as is (binary too; up to 50 MB per file and 200 MB per call): a file goes to ids.file (default its own name), a folder under ids.file (default the root).',
+            },
+        },
+    },
+    notes: 'ids.file is the path inside the storage ("web/index.html"). create and update both write the file whether it exists or not, creating the folders on the path. body.local runs on the machine of this CLI: use it for anything big or binary (CSV to import, images, product code with its node_modules). A get of a binary file says how to download it instead of returning it.',
+    examples: [
+        {
+            tool: 'resource_create',
+            arguments: {
+                type: 'storage_file',
+                ids: { storage: 'web_app' },
+                body: { local: './site' },
+            },
+            does: 'Upload the local folder ./site (binary files too) to the root of the storage.',
+        },
+        {
+            tool: 'resource_get',
+            arguments: {
+                type: 'storage_file',
+                ids: { storage: 'web_app', file: 'web/index.html' },
+            },
+            does: 'Read a text file.',
+        },
+    ],
+    async list(ctx) {
+        const path = ctx.filter?.path;
+        try {
+            const res = await api.get(
+                `${v1(ctx.user)}/storages/${encodeURIComponent(String(ctx.parent))}/files`,
+                { params: path ? { path: clean(path) } : undefined },
+            );
+            if (!Array.isArray(res.data)) return [];
+            // The server answers paths relative to the folder listed: make
+            // them whole, so a record's ids.file reads and writes that file.
+            const folder = path ? clean(path).replace(/\/+$/, '') : '';
+            if (!folder) return res.data;
+            return res.data.map((f) =>
+                typeof f?.path === 'string' && !f.path.startsWith(`${folder}/`)
+                    ? { ...f, path: `${folder}/${f.path.replace(/^\/+/, '')}` }
+                    : f,
+            );
+        } catch (e) {
+            // The server keeps files on disk and creates a storage's folder
+            // with its first file: an empty storage answers 404 too.
+            if (e.response?.status === 404) return [];
+            throw apiError(e);
+        }
+    },
+    async get(ctx) {
+        const path = clean(String(ctx.id));
+        try {
+            const res = await api.get(
+                `${v2(ctx.user)}/storages/${encodeURIComponent(String(ctx.parent))}/files/${storageFilePath(path)}`,
+                { responseType: 'arraybuffer', transformResponse: [(x) => x] },
+            );
+            const raw = Buffer.from(res.data ?? []);
+            const type = String(res.headers?.['content-type'] || '');
+            const { kind } = decodeBody(raw, type);
+            if (kind === 'binary') {
+                return `Binary file of ${raw.length} bytes (${type || 'unknown type'}): download it with \`${identity().name} storage file download ${ctx.parent} ${path} -o <file>\`.`;
+            }
+            return raw.toString('utf8');
+        } catch (e) {
+            throw apiError(e, { notFound: `File not found in storage "${ctx.parent}": ${path}` });
+        }
+    },
+    create: write,
+    update: write,
+    async delete(ctx) {
+        const path = clean(String(ctx.id));
+        if (!(await deleteStorageFile(String(ctx.parent), path, ctx.user))) {
+            throw Object.assign(inputError(`No such file: ${path}`), { code: 'not_found' });
+        }
+        return { path, deleted: true };
+    },
+};

package/lib/openapi.js

@@ -136,7 +136,25 @@ export function findOperation(doc, method, template) {
     return best;
 }
 
+/**
+ * Find an operation by its operationId (the core's types name the
+ * operations they run, not their paths).
+ *
+ * @param {any} doc
+ * @param {string} operationId
+ * @returns {any} The operation, or null.
+ */
+export function findOperationById(doc, operationId) {
+    for (const item of Object.values(doc?.paths || {})) {
+        for (const operation of Object.values(item || {})) {
+            if (operation?.operationId === operationId) return operation;
+        }
+    }
+    return null;
+}
+
 const SCALARS = new Set(['string', 'number', 'integer', 'boolean']);
+
 const VERBOSE = new Set(['description', 'example', 'examples', 'title']);
 
 /**

package/lib/product-apply.js

@@ -0,0 +1,121 @@
+// @ts-check
+import api from './api.js';
+import { apiError, inputError } from './errors.js';
+import { v1 } from './paths.js';
+
+/** Fields of an export the server sets itself. */
+const SERVER_FIELDS = ['created', 'modified', 'user', '_id'];
+
+/** What a product update (PUT) takes; the rest is written apart. */
+const UPDATE_FIELDS = ['name', 'description', 'enabled', 'config'];
+
+/** Profile categories written whole with PUT …/profile/{category}. */
+const PROFILE_CATEGORIES = ['properties', 'buckets', 'flows', 'endpoints', 'api', 'autoprovisions'];
+
+const exists = async (url) => {
+    try {
+        await api.get(url);
+        return true;
+    } catch (e) {
+        if (e.response?.status === 404) return false;
+        throw apiError(e);
+    }
+};
+
+/**
+ * Make a product match a document as `product export` writes it (the
+ * product, its profile and, under `_resources.properties`, its properties):
+ * created when missing, updated when it exists. Each profile category the
+ * document has replaces the product's (entries it leaves out are removed);
+ * product properties and services it leaves out are kept.
+ *
+ * @param {Record<string, any>} doc
+ * @param {string | null} [user]
+ * @returns {Promise<{ product: string, created: boolean, properties: { created: string[], updated: string[] }, ignored?: string[] }>}
+ */
+export async function applyProduct(doc, user) {
+    if (!doc || typeof doc !== 'object' || Array.isArray(doc)) {
+        throw inputError('the product document must be a JSON object');
+    }
+    const id = doc.product;
+    if (typeof id !== 'string' || !/^[A-Za-z0-9_-]{1,64}$/.test(id)) {
+        throw inputError('the document needs its "product" id (letters, digits, _ and -)');
+    }
+    const { _resources, ...rest } = doc;
+    const product = Object.fromEntries(
+        Object.entries(rest).filter(([k]) => !SERVER_FIELDS.includes(k)),
+    );
+    const properties = _resources?.properties ?? [];
+    if (!Array.isArray(properties)) throw inputError('_resources.properties must be an array');
+    for (const p of properties) {
+        if (!p || typeof p.property !== 'string' || !p.property) {
+            throw inputError('every entry of _resources.properties needs its "property" id');
+        }
+    }
+
+    const base = `${v1(user)}/products`;
+    const item = `${base}/${encodeURIComponent(id)}`;
+    const found = await exists(item);
+    /** One request, its 404 named after what it wrote. */
+    const write = async (method, url, body, what) => {
+        try {
+            await api.request({ method, url, data: body });
+        } catch (e) {
+            throw apiError(e, { notFound: `Not found: ${what} (${method.toUpperCase()} ${url})` });
+        }
+    };
+    /** Profile categories this server takes no PUT for: left as they are. */
+    const ignored = [];
+    if (!found) {
+        await write('post', base, product, `products of the account`);
+    } else {
+        // An update takes the record's own fields; the profile goes
+        // category by category (each PUT replaces the whole category),
+        // and the services one by one.
+        const fields = Object.fromEntries(
+            UPDATE_FIELDS.filter((k) => k in product).map((k) => [k, product[k]]),
+        );
+        if (Object.keys(fields).length) await write('put', item, fields, `product ${id}`);
+        for (const [category, value] of Object.entries(product.profile || {})) {
+            if (!PROFILE_CATEGORIES.includes(category) && category !== 'code') {
+                ignored.push(`profile.${category}`);
+                continue;
+            }
+            await write('put', `${item}/profile/${category}`, value ?? {}, `profile ${category}`);
+        }
+        for (const [service, value] of Object.entries(product.services || {})) {
+            await write(
+                'put',
+                `${item}/services/${encodeURIComponent(service)}`,
+                value,
+                `service ${service}`,
+            );
+        }
+    }
+
+    const done = { created: [], updated: [] };
+    for (const p of properties) {
+        const record = Object.fromEntries(
+            Object.entries(p).filter(([k]) => !SERVER_FIELDS.includes(k)),
+        );
+        const url = `${item}/properties/${encodeURIComponent(p.property)}`;
+        try {
+            if (found && (await exists(url))) {
+                const { property: _id, ...fields } = record;
+                await api.put(url, fields);
+                done.updated.push(p.property);
+            } else {
+                await api.post(`${item}/properties`, record);
+                done.created.push(p.property);
+            }
+        } catch (e) {
+            throw apiError(e, { notFound: `Product property not found: ${p.property}` });
+        }
+    }
+    return {
+        product: id,
+        created: !found,
+        properties: done,
+        ...(ignored.length ? { ignored } : {}),
+    };
+}

package/lib/raw-api.js

@@ -0,0 +1,111 @@
+// @ts-check
+import api from './api.js';
+import { resolveUser } from './config.js';
+import { TIMEOUTS } from './constants.js';
+import { apiError, inputError } from './errors.js';
+
+const METHODS = new Set(['GET', 'POST', 'PUT', 'PATCH', 'DELETE']);
+
+/**
+ * The path of a raw API call, with `{user}` replaced by the account (the
+ * profile's, or `user`). Only paths on the profile's server: a full URL
+ * would send its token to another host.
+ *
+ * @param {string} path
+ * @param {string | null} [user]
+ */
+export function apiPath(path, user) {
+    const p = String(path ?? '').trim();
+    if (!p.startsWith('/') || p.startsWith('//')) {
+        throw inputError(`the path must start with "/" (e.g. /v1/users/{user}/devices): ${p}`);
+    }
+    // eslint-disable-next-line no-control-regex -- control characters are what it looks for
+    if (/[\x00-\x1f\s]/.test(p))
+        throw inputError('the path cannot hold spaces or control characters');
+    return p.includes('{user}') ? p.replaceAll('{user}', encodeURIComponent(resolveUser(user))) : p;
+}
+
+/**
+ * Method of a raw call: the one given, else POST when it carries a body
+ * and GET otherwise (as `gh api` does).
+ *
+ * @param {string | undefined} method
+ * @param {boolean} hasBody
+ */
+export function apiMethod(method, hasBody) {
+    const m = (method || (hasBody ? 'POST' : 'GET')).toUpperCase();
+    if (!METHODS.has(m))
+        throw inputError(`unknown method ${method}: use ${[...METHODS].join(', ')}`);
+    return m;
+}
+
+/**
+ * The answer's body as the caller should see it: parsed JSON, text, or the
+ * raw bytes when it is neither.
+ *
+ * @param {Buffer} data
+ * @param {string} [contentType]
+ * @returns {{ kind: 'json' | 'text' | 'binary' | 'empty', body: any }}
+ */
+export function decodeBody(data, contentType = '') {
+    if (!data || !data.length) return { kind: 'empty', body: null };
+    const type = contentType.toLowerCase();
+    const textual =
+        type.includes('json') || type.startsWith('text/') || type.includes('xml') || !type;
+    if (!textual) return { kind: 'binary', body: data };
+    const text = data.toString('utf8');
+    if (type.includes('json') || !type) {
+        try {
+            return { kind: 'json', body: JSON.parse(text) };
+        } catch {
+            // Streamed answers (one JSON object per line) and plain text.
+        }
+    }
+    // Without a content type, bytes that are not text stay bytes.
+    if (!type && text.includes('�')) return { kind: 'binary', body: data };
+    return { kind: 'text', body: text };
+}
+
+/**
+ * Send a request to the profile's server as is: the escape hatch for what
+ * no command covers.
+ *
+ * @param {{
+ *   method?: string,
+ *   path: string,
+ *   query?: Record<string, any>,
+ *   body?: any,
+ *   user?: string | null,
+ *   timeout?: number,
+ * }} opts
+ */
+export async function rawApiCall({ method, path, query, body, user, timeout }) {
+    const url = apiPath(path, user);
+    const m = apiMethod(method, body !== undefined);
+    try {
+        const res = await api.request({
+            method: m,
+            url,
+            params: query,
+            data: body,
+            responseType: 'arraybuffer',
+            timeout: timeout ?? TIMEOUTS.API_LONG_MS,
+            // Plain bodies (a string) go as text; objects as JSON.
+            headers: typeof body === 'string' ? { 'Content-Type': 'text/plain' } : undefined,
+        });
+        const raw = Buffer.from(res.data);
+        const decoded = decodeBody(raw, String(res.headers['content-type'] || ''));
+        // `raw`: the bytes as they came, for files (decoding is for showing).
+        return { status: res.status, contentType: res.headers['content-type'], ...decoded, raw };
+    } catch (e) {
+        // The error body arrives as bytes too: decode it so its message shows.
+        if (e?.response?.data instanceof ArrayBuffer || Buffer.isBuffer(e?.response?.data)) {
+            const { body: errBody } = decodeBody(
+                Buffer.from(e.response.data),
+                String(e.response.headers?.['content-type'] || ''),
+            );
+            e.response.data = errBody;
+        }
+        throw apiError(e, { notFound: `Not found: ${m} ${url}` });
+    }
+}

package/lib/storage.js

@@ -1,8 +1,37 @@
 import api from './api.js';
 import { TIMEOUTS } from './constants.js';
-import { apiError } from './errors.js';
+import { apiError, inputError } from './errors.js';
 import { v1, v2 } from './paths.js';
 
+/**
+ * A file path inside a storage as a URL path: each segment escaped, and
+ * none empty, `.` or `..` (the URL would point at another file, or at the
+ * storage itself).
+ *
+ * @param {string} filePath
+ */
+export function storageFilePath(filePath) {
+    const parts = String(filePath ?? '')
+        .replace(/^\/+/, '')
+        .split('/');
+    if (!parts.length || parts.some((p) => !p || p === '.' || p === '..')) {
+        throw inputError(`invalid file path: "${filePath}"`);
+    }
+    return parts.map(encodeURIComponent).join('/');
+}
+
+/** A storage id, checked: it is a segment of every URL here. */
+function sid(storageId) {
+    if (!/^[A-Za-z0-9_-]{1,64}$/.test(String(storageId ?? ''))) {
+        throw inputError(`invalid storage id: "${storageId}"`);
+    }
+    return storageId;
+}
+
+/** `/v2/users/{user}/storages/{storage}/files/{path}`, escaped. */
+const fileUrl = (storageId, filePath, user) =>
+    `${v2(user)}/storages/${sid(storageId)}/files/${storageFilePath(filePath)}`;
+
 /**
  * Helpers for file storages — independent buckets that the
  * platform exposes alongside products. The product script workflow
@@ -16,7 +45,7 @@ import { v1, v2 } from './paths.js';
 
 export async function getStorage(storageId, user) {
     try {
-        const res = await api.get(`${v1(user)}/storages/${storageId}`);
+        const res = await api.get(`${v1(user)}/storages/${sid(storageId)}`);
         return res.data || {};
     } catch (e) {
         throw apiError(e, { notFound: `Storage not found: ${storageId}` });
@@ -25,7 +54,7 @@ export async function getStorage(storageId, user) {
 
 export async function storageExists(storageId, user) {
     try {
-        await api.get(`${v1(user)}/storages/${storageId}`);
+        await api.get(`${v1(user)}/storages/${sid(storageId)}`);
         return true;
     } catch (e) {
         if (e.response?.status === 404) return false;
@@ -52,7 +81,7 @@ export async function createStorage(
 
 export async function deleteStorage(storageId, user) {
     try {
-        await api.delete(`${v1(user)}/storages/${storageId}`);
+        await api.delete(`${v1(user)}/storages/${sid(storageId)}`);
         return true;
     } catch (e) {
         if (e.response?.status === 404) return false;
@@ -62,7 +91,7 @@ export async function deleteStorage(storageId, user) {
 
 export async function listStorageFiles(storageId, user) {
     try {
-        const res = await api.get(`${v1(user)}/storages/${storageId}/files`);
+        const res = await api.get(`${v1(user)}/storages/${sid(storageId)}/files`);
         return res.data || [];
     } catch (e) {
         if (e.response?.status === 404) return [];
@@ -76,7 +105,7 @@ export async function listStorageFiles(storageId, user) {
  */
 export async function readStorageFile(storageId, filePath, user) {
     try {
-        const res = await api.get(`${v2(user)}/storages/${storageId}/files/${filePath}`, {
+        const res = await api.get(fileUrl(storageId, filePath, user), {
             transformResponse: [(x) => x],
         });
         return res.data;
@@ -87,7 +116,7 @@ export async function readStorageFile(storageId, filePath, user) {
 
 export async function storageFileExists(storageId, filePath, user) {
     try {
-        await api.get(`${v2(user)}/storages/${storageId}/files/${filePath}`);
+        await api.get(fileUrl(storageId, filePath, user));
         return true;
     } catch (e) {
         if (e.response?.status === 404) return false;
@@ -97,11 +126,10 @@ export async function storageFileExists(storageId, filePath, user) {
 
 export async function writeStorageFile(storageId, filePath, content, user) {
     try {
-        await api.put(
-            `${v2(user)}/storages/${storageId}/files/${filePath}?overwrite=true`,
-            content,
-            { headers: { 'Content-Type': 'text/plain' }, timeout: TIMEOUTS.API_LONG_MS },
-        );
+        await api.put(`${fileUrl(storageId, filePath, user)}?overwrite=true`, content, {
+            headers: { 'Content-Type': 'text/plain' },
+            timeout: TIMEOUTS.API_LONG_MS,
+        });
     } catch (e) {
         throw apiError(e);
     }
@@ -109,7 +137,7 @@ export async function writeStorageFile(storageId, filePath, content, user) {
 
 export async function deleteStorageFile(storageId, filePath, user) {
     try {
-        await api.delete(`${v2(user)}/storages/${storageId}/files/${filePath}`);
+        await api.delete(fileUrl(storageId, filePath, user));
         return true;
     } catch (e) {
         if (e.response?.status === 404) return false;

package/lib/tokens.js

@@ -105,6 +105,20 @@ export function resolveExpiry(value) {
     return Math.floor(Date.now() / 1000) + n * DURATION_MULT[unit];
 }
 
+/**
+ * The expiry of an account token, which the server takes in unix
+ * milliseconds (device tokens take seconds: resolveExpiry). A duration
+ * ("30d") counts from now; a timestamp is taken as milliseconds, or as
+ * seconds when it is too small to be milliseconds (before 2001), as
+ * earlier versions of this CLI took it.
+ */
+export function resolveExpiryMs(value) {
+    const resolved = resolveExpiry(value);
+    if (resolved === null) return null;
+    const duration = typeof value === 'string' && DURATION_RE.test(value.trim());
+    return duration || resolved < 1e12 ? resolved * 1000 : resolved;
+}
+
 // ─── User-level token validators ────────────────────────────────────
 
 export const TOKEN_ID_RE = /^[a-zA-Z0-9_]{1,50}$/;
@@ -238,7 +252,7 @@ export async function createToken(body, user) {
     };
     if (body.deny) payload.deny = body.deny;
     if (body.description !== undefined) payload.description = String(body.description);
-    const expire = resolveExpiry(body.expire);
+    const expire = resolveExpiryMs(body.expire);
     if (expire !== null && expire !== undefined) payload.expire = expire;
 
     try {
@@ -262,7 +276,7 @@ export async function updateToken(tokenId, patch, user) {
     if (patch.description !== undefined) body.description = String(patch.description);
     if (patch.enabled !== undefined) body.enabled = !!patch.enabled;
     if (patch.expire !== undefined) {
-        const expire = resolveExpiry(patch.expire);
+        const expire = resolveExpiryMs(patch.expire);
         if (expire !== null && expire !== undefined) body.expire = expire;
     }
     if (patch.allow !== undefined) {

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@thinger-io/cli-core",
-    "version": "0.4.2",
+    "version": "0.5.1",
     "description": "Shared core of the Thinger.io CLIs and their MCP servers: API client, auth, profiles, generic commands and MCP tools",
     "type": "module",
     "exports": {