@vibiz/cli 0.2.0 → 0.2.1

package/dist/{chunk-GSHNECVT.js → chunk-J4RTAA72.js}

@@ -1,6 +1,16 @@
 #!/usr/bin/env node
 
 // packages/sdk/src/client.ts
+function noBodyMessage(status) {
+  if (status === 401) return "Not signed in (401): the API key is missing or was revoked.";
+  if (status === 404) return "Not found (404): check the API URL and the id.";
+  if (status === 413) return "Too large (413): send less at once.";
+  if (status === 429) return "Too many requests (429): wait a moment and retry.";
+  if (status >= 500) {
+    return `The Vibiz API did not answer properly (${status}). It is usually brief: retry in a minute.`;
+  }
+  return `The request failed with ${status} and no explanation from the API.`;
+}
 var VibizApiError = class extends Error {
   constructor(status, code, message, details) {
     super(message);
@@ -32,6 +42,7 @@ var Vibiz = class {
     if (init.raw) headers["content-type"] = init.contentType ?? "application/octet-stream";
     if (init.idempotencyKey) headers["idempotency-key"] = init.idempotencyKey;
     if (this.options.user) headers["x-vibiz-user"] = endUserHeader(this.options.user);
+    if (this.options.client) headers["x-vibiz-client"] = this.options.client;
     return this.fetchImpl(`${this.baseUrl}/v1${path}`, {
       method: init.method ?? "GET",
       headers,
@@ -44,7 +55,7 @@ var Vibiz = class {
     throw new VibizApiError(
       res.status,
       e?.code ?? "http_error",
-      e?.message ?? `HTTP ${res.status}`,
+      e?.message ?? noBodyMessage(res.status),
       e?.details
     );
   }
@@ -63,7 +74,7 @@ var Vibiz = class {
       throw new VibizApiError(
         res.status,
         e?.code ?? "http_error",
-        e?.message ?? `HTTP ${res.status}`,
+        e?.message ?? noBodyMessage(res.status),
         e?.details
       );
     }
@@ -104,7 +115,7 @@ var Vibiz = class {
       `/projects/${id}/actions/${name}`,
       { method: "POST", body: { input }, ...opts }
     ),
-    /** The production env. Owner keys only: an agent key gets `forbidden` (use `dev`). */
+    /** The production env. Full-access keys only: a Limited key gets `forbidden` (use `dev`). */
     env: (id) => this.request(`/projects/${id}/env`).then((r) => r.env),
     /** The production env's variable names, without values. Any key. */
     envNames: (id) => this.request(`/projects/${id}/env?names=1`).then((r) => r.names),
@@ -156,10 +167,10 @@ var Vibiz = class {
     /** The app key (`vz_app_…`), per environment. The secret itself only ever travels in the env. */
     appKeys: {
       list: (id) => this.request(`/projects/${id}/app-keys`).then((r) => r.data),
-      /** Production's needs an owner key. The old key works for `grace_seconds` (default 3600). */
+      /** Production's needs a full-access key. The old key works for `grace_seconds` (default 3600). */
       rotate: (id, opts = {}) => this.request(`/projects/${id}/app-keys/rotate`, { method: "POST", body: opts })
     },
-    /** Hosts outside Vibiz that receive the env server to server. Connecting needs an owner key. */
+    /** Hosts outside Vibiz that receive the env server to server. Connecting needs a full-access key. */
     hosts: {
       list: (id) => this.request(`/projects/${id}/hosts`).then((r) => r.data),
       add: (id, input) => this.request(`/projects/${id}/hosts`, { method: "POST", body: input }),
@@ -173,7 +184,7 @@ var Vibiz = class {
       )
     },
     /**
-     * The app's own database. `production` needs an owner key (it holds the
+     * The app's own database. `production` needs a full-access key (it holds the
      * app's users' data); agents read `development`, the default for them.
      */
     database: {
@@ -188,7 +199,7 @@ var Vibiz = class {
     },
     /**
      * How people sign in to the app (docs/SIGN-IN.md). `production` needs an
-     * owner key; agents work on `development`, the default for them.
+     * full-access key; agents work on `development`, the default for them.
      */
     auth: {
       get: (id, env) => this.request(`/projects/${id}/auth/settings${env ? `?env=${env}` : ""}`),
@@ -214,7 +225,7 @@ var Vibiz = class {
     /**
      * The business behind the project (docs/COMPANY.md). `env` defaults like
      * the API: production for owners, development for agents. Production
-     * submit, signing, actions and documents need an owner key.
+     * submit, signing, actions and documents need a full-access key.
      */
     company: {
       get: (id, env) => this.request(`/projects/${id}/company${envQuery(env)}`),
@@ -233,7 +244,7 @@ var Vibiz = class {
         { method: "DELETE" }
       ),
       /**
-       * Production files for real and charges the price: an owner key, `confirm: true`,
+       * Production files for real and charges the price: a full-access key, `confirm: true`,
        * and the `quote.total_cents` and `updated_at` of the draft that was reviewed
        * (a draft or price changed since is refused with a 409, not filed).
        */
@@ -242,7 +253,7 @@ var Vibiz = class {
         body: input
       }),
       /**
-       * Pay a live filing by card instead of from the balance (owner keys): the same
+       * Pay a live filing by card instead of from the balance (full-access keys): the same
        * body as `submit`; it is filed when the payment arrives (docs/BILLING.md "Company").
        */
       checkout: (id, input) => this.request(`/projects/${id}/company/checkout?env=production`, {
@@ -356,7 +367,7 @@ var Vibiz = class {
      * Payments (docs/PAYMENTS.md): Vibiz is the merchant, so an app sells from
      * its first call. `env` defaults like the API: production for owners,
      * development for agents. On production, refunds, cancels, withdrawing,
-     * payout setup and webhook settings need an owner key.
+     * payout setup and webhook settings need a full-access key.
      */
     payments: {
       get: (id, env) => this.request(`/projects/${id}/payments${envQuery(env)}`),
@@ -468,7 +479,7 @@ var Vibiz = class {
      * Custom connectors (docs/CONNECTORS.md): any HTTP API from one manifest,
      * called through Vibiz, which holds the key. `env` defaults like the API:
      * production for owners, development for agents. Production keys, and
-     * approving an agent's dangerous call, need an owner key.
+     * approving an agent's dangerous call, need a full-access key.
      */
     connectors: {
       list: (id) => this.request(`/projects/${id}/connectors`).then((r) => r.data),
@@ -487,7 +498,7 @@ var Vibiz = class {
       delete: (id, name) => this.request(`/projects/${id}/connectors/${encodeURIComponent(name)}`, {
         method: "DELETE"
       }),
-      /** Set values (`null` removes). Production: owner keys. Values are never read back. */
+      /** Set values (`null` removes). Production: full-access keys. Values are never read back. */
       setSecrets: (id, name, values, env) => this.request(
         `/projects/${id}/connectors/${encodeURIComponent(name)}/secrets${envQuery(env)}`,
         { method: "PUT", body: { values } }
@@ -496,7 +507,7 @@ var Vibiz = class {
         `/projects/${id}/connectors/${encodeURIComponent(name)}/check${envQuery(env)}`,
         { method: "POST", body: {} }
       ),
-      /** One operation. A dangerous one (or a production write) by an agent key answers 403 approval_required. */
+      /** One operation. A dangerous one (or a production write) by a Limited key answers 403 approval_required. */
       call: (id, name, input, opts = {}) => this.request(
         `/projects/${id}/connectors/${encodeURIComponent(name)}/call${envQuery(opts.env)}`,
         {
@@ -514,12 +525,12 @@ var Vibiz = class {
       approval: (id, approvalId) => this.request(
         `/projects/${id}/connectors/approvals/${encodeURIComponent(approvalId)}`
       ),
-      /** Owner keys. */
+      /** Full-access keys. */
       approve: (id, approvalId) => this.request(
         `/projects/${id}/connectors/approvals/${encodeURIComponent(approvalId)}/approve`,
         { method: "POST", body: {} }
       ),
-      /** Owner keys. */
+      /** Full-access keys. */
       deny: (id, approvalId) => this.request(
         `/projects/${id}/connectors/approvals/${encodeURIComponent(approvalId)}/deny`,
         { method: "POST", body: {} }
@@ -528,7 +539,7 @@ var Vibiz = class {
     /**
      * The owner's own domains: served by Vibiz hosting (with HTTPS once DNS
      * points at it) or trusted for a host elsewhere. Adding and removing need
-     * an owner key; any key reads status and asks for a re-check.
+     * a full-access key; any key reads status and asks for a re-check.
      */
     domains: {
       list: (id) => this.request(`/projects/${id}/domains`),
@@ -546,8 +557,8 @@ var Vibiz = class {
         method: "DELETE"
       }),
       /**
-       * Owner keys: buy a domain from the account's credits; it serves on this
-       * project once registered. An agent key answers `owner_only` with the
+       * Full-access keys: buy a domain from the account's credits; it serves on this
+       * project once registered. A Limited key answers `owner_only` with the
        * console link to hand the owner.
        */
       buy: (id, input) => this.request(`/projects/${id}/domains/buy`, { method: "POST", body: input })
@@ -655,7 +666,7 @@ var Vibiz = class {
       return res;
     },
     /**
-     * The environment's secret values as `.env` text. Owner keys only; the
+     * The environment's secret values as `.env` text. Full-access keys only; the
      * call itself is the confirmation, so only make it when the person asked.
      */
     envFile: async (projectId, exportId) => {
@@ -1036,7 +1047,7 @@ var Vibiz = class {
    * Your own AI provider keys (docs/AI.md "Your own keys"): calls they can
    * serve run only on them (never falling back to Vibiz) and cost 0 here.
    * Pass `projectId` for a project's override. Setting and removing need an
-   * owner key. Secrets are write-only: no method returns one.
+   * full-access key. Secrets are write-only: no method returns one.
    */
   aiKeys = {
     list: (opts = {}) => this.request(`${aiKeysBase(opts.projectId)}`),
@@ -1067,7 +1078,7 @@ var Vibiz = class {
   /**
    * Buying domains (docs: buying a domain): search and quote with any key;
    * the domains the account owns, auto-renew, renewals, the transfer code and
-   * the owner details (the registrant, saved once) need an owner key.
+   * the owner details (the registrant, saved once) need a full-access key.
    */
   domains = {
     search: (q, opts = {}) => this.request(`/domains/search${qs({ q, project_id: opts.projectId })}`),
@@ -1090,7 +1101,7 @@ var Vibiz = class {
     /**
      * Email forwarding (docs: email ▸ Forwarding): `hello@<domain>` → the
      * owner's inbox, sent "via Vibiz". Anyone reads and verifies; `set` and
-     * `off` need an owner key (an agent gets `owner_only` with a console link
+     * `off` need a full-access key (an agent gets `owner_only` with a console link
      * that has its proposal filled in).
      */
     forwarding: {
@@ -1149,7 +1160,7 @@ var Vibiz = class {
         method: "PATCH",
         body: input
       }),
-      /** Owner keys; only from trash or spam. */
+      /** Full-access keys; only from trash or spam. */
       delete: (id) => this.request(
         `/inbox/threads/${encodeURIComponent(id)}`,
         { method: "DELETE" }
@@ -1180,7 +1191,7 @@ var Vibiz = class {
     }),
     settings: {
       get: () => this.request("/inbox/settings"),
-      /** Owner keys: the new-mail digest. */
+      /** Full-access keys: the new-mail digest. */
       update: (input) => this.request("/inbox/settings", { method: "PATCH", body: input })
     }
   };
@@ -1190,12 +1201,12 @@ var Vibiz = class {
    */
   billing = {
     get: () => this.request("/billing"),
-    /** Owner keys: auto-recharge and the daily safety cap. */
+    /** Full-access keys: auto-recharge and the daily safety cap. */
     update: (input) => this.request("/billing", { method: "PATCH", body: input }),
     /** A payment page for `amount_cents` (500–100000); hand its `url` to a person. */
     checkout: (input) => this.request("/billing/checkout", { method: "POST", body: input }),
     checkoutStatus: (id) => this.request(`/billing/checkout/${encodeURIComponent(id)}`),
-    /** Owner keys: a page to save or replace the card. */
+    /** Full-access keys: a page to save or replace the card. */
     saveCard: () => this.request("/billing/card", { method: "POST", body: {} }),
     removeCard: () => this.request("/billing/card", { method: "DELETE" }),
     ledger: (opts = {}) => this.request(
@@ -1210,12 +1221,20 @@ var Vibiz = class {
   /** Named keys, one per teammate or agent, so spend shows per person. */
   apiKeys = {
     list: () => this.request("/api-keys").then((r) => r.data),
-    /** The secret is returned once, here. */
-    /** `agent` by default: builds and runs, never reads production secrets. Needs an owner key. */
+    /**
+     * The secret is returned once, here. Full access (`owner`) by default;
+     * `access: 'agent'` makes it Limited (builds and runs, never reads
+     * production secrets nor moves live money). Needs a full-access key.
+     */
     create: (name, opts = {}) => this.request("/api-keys", {
       method: "POST",
       body: { name, ...opts.access ? { access: opts.access } : {} }
     }),
+    /** Full access (`owner`) or Limited (`agent`), afterwards. Needs a full-access key, not this one. */
+    setAccess: (id, access) => this.request(`/api-keys/${encodeURIComponent(id)}`, {
+      method: "PATCH",
+      body: { access }
+    }),
     revoke: (id) => this.request(`/api-keys/${id}`, { method: "DELETE" })
   };
   /** A short-lived link to the hosted usage dashboard (admin scope needs an admin key). */