@zincapp/znvault-cli 2.16.5 → 2.17.0

package/dist/commands/apikey/conditions.d.ts

@@ -0,0 +1,6 @@
+/**
+ * API key conditions update command
+ */
+import type { Command } from 'commander';
+export declare function registerConditionsCommand(apiKeyCmd: Command): void;
+//# sourceMappingURL=conditions.d.ts.map

package/dist/commands/apikey/conditions.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"conditions.d.ts","sourceRoot":"","sources":["../../../src/commands/apikey/conditions.ts"],"names":[],"mappings":"AAEA;;GAEG;AAEH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAOzC,wBAAgB,yBAAyB,CAAC,SAAS,EAAE,OAAO,GAAG,IAAI,CAsDlE"}

package/dist/commands/apikey/conditions.js

@@ -0,0 +1,57 @@
+// Path: src/commands/apikey/conditions.ts
+import ora from 'ora';
+import { client } from '../../lib/client.js';
+import * as output from '../../lib/output.js';
+import { displayConditions, parseConditionsFromOptions } from './helpers.js';
+export function registerConditionsCommand(apiKeyCmd) {
+    apiKeyCmd
+        .command('update-conditions <id>')
+        .description('Update API key inline ABAC conditions')
+        .option('--ip <ips>', 'Comma-separated IP allowlist (CIDR supported)')
+        .option('--time-range <range>', 'Time range: "HH:MM-HH:MM [TIMEZONE]" or "clear"')
+        .option('--methods <methods>', 'Comma-separated HTTP methods or "clear"')
+        .option('--resources <ids>', 'Resource IDs (type:id,...) or "clear"')
+        .option('--aliases <patterns>', 'Alias patterns (glob) or "clear"')
+        .option('--tags <tags>', 'Resource tags (key=value,...) or "clear"')
+        .option('--clear-all', 'Remove all conditions')
+        .option('-t, --tenant <id>', 'Tenant ID')
+        .option('--json', 'Output as JSON')
+        .action(async (id, options) => {
+        let conditions = {};
+        // Handle --clear-all
+        if (!options.clearAll) {
+            // Validate time range format before parsing
+            if (options.timeRange && options.timeRange !== 'clear') {
+                const match = /^(\d{2}:\d{2})-(\d{2}:\d{2})(?:\s+(.+))?$/.exec(options.timeRange);
+                if (!match) {
+                    output.error('Invalid time range format. Use: "HH:MM-HH:MM [TIMEZONE]"');
+                    process.exit(1);
+                }
+            }
+            conditions = parseConditionsFromOptions(options);
+        }
+        const spinner = ora('Updating conditions...').start();
+        try {
+            const key = await client.updateApiKeyConditions(id, conditions, options.tenant);
+            spinner.succeed('Conditions updated');
+            if (options.json) {
+                output.json(key);
+                return;
+            }
+            const keyConditions = key.conditions;
+            if (keyConditions && Object.keys(keyConditions).length > 0) {
+                console.log('\nUpdated conditions:');
+                displayConditions(keyConditions);
+            }
+            else {
+                console.log('\nAll conditions cleared.');
+            }
+        }
+        catch (err) {
+            spinner.fail('Failed to update conditions');
+            output.error(err instanceof Error ? err.message : String(err));
+            process.exit(1);
+        }
+    });
+}
+//# sourceMappingURL=conditions.js.map

package/dist/commands/apikey/conditions.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"conditions.js","sourceRoot":"","sources":["../../../src/commands/apikey/conditions.ts"],"names":[],"mappings":"AAAA,0CAA0C;AAO1C,OAAO,GAAG,MAAM,KAAK,CAAC;AACtB,OAAO,EAAE,MAAM,EAAE,MAAM,qBAAqB,CAAC;AAC7C,OAAO,KAAK,MAAM,MAAM,qBAAqB,CAAC;AAE9C,OAAO,EAAE,iBAAiB,EAAE,0BAA0B,EAAE,MAAM,cAAc,CAAC;AAE7E,MAAM,UAAU,yBAAyB,CAAC,SAAkB;IAC1D,SAAS;SACN,OAAO,CAAC,wBAAwB,CAAC;SACjC,WAAW,CAAC,uCAAuC,CAAC;SACpD,MAAM,CAAC,YAAY,EAAE,+CAA+C,CAAC;SACrE,MAAM,CAAC,sBAAsB,EAAE,iDAAiD,CAAC;SACjF,MAAM,CAAC,qBAAqB,EAAE,yCAAyC,CAAC;SACxE,MAAM,CAAC,mBAAmB,EAAE,uCAAuC,CAAC;SACpE,MAAM,CAAC,sBAAsB,EAAE,kCAAkC,CAAC;SAClE,MAAM,CAAC,eAAe,EAAE,0CAA0C,CAAC;SACnE,MAAM,CAAC,aAAa,EAAE,uBAAuB,CAAC;SAC9C,MAAM,CAAC,mBAAmB,EAAE,WAAW,CAAC;SACxC,MAAM,CAAC,QAAQ,EAAE,gBAAgB,CAAC;SAClC,MAAM,CAAC,KAAK,EAAE,EAAU,EAAE,OAAgC,EAAE,EAAE;QAC7D,IAAI,UAAU,GAAqB,EAAE,CAAC;QAEtC,qBAAqB;QACrB,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC;YACtB,4CAA4C;YAC5C,IAAI,OAAO,CAAC,SAAS,IAAI,OAAO,CAAC,SAAS,KAAK,OAAO,EAAE,CAAC;gBACvD,MAAM,KAAK,GAAG,2CAA2C,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;gBAClF,IAAI,CAAC,KAAK,EAAE,CAAC;oBACX,MAAM,CAAC,KAAK,CAAC,0DAA0D,CAAC,CAAC;oBACzE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;gBAClB,CAAC;YACH,CAAC;YAED,UAAU,GAAG,0BAA0B,CAAC,OAAO,CAAC,CAAC;QACnD,CAAC;QAED,MAAM,OAAO,GAAG,GAAG,CAAC,wBAAwB,CAAC,CAAC,KAAK,EAAE,CAAC;QAEtD,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,sBAAsB,CAAC,EAAE,EAAE,UAAU,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;YAChF,OAAO,CAAC,OAAO,CAAC,oBAAoB,CAAC,CAAC;YAEtC,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC;gBACjB,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;gBACjB,OAAO;YACT,CAAC;YAED,MAAM,aAAa,GAAG,GAAG,CAAC,UAA0C,CAAC;YACrE,IAAI,aAAa,IAAI,MAAM,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAC3D,OAAO,CAAC,GAAG,CAAC,uBAAuB,CAAC,CAAC;gBACrC,iBAAiB,CAAC,aAAa,CAAC,CAAC;YACnC,CAAC;iBAAM,CAAC;gBACN,OAAO,CAAC,GAAG,CAAC,2BAA2B,CAAC,CAAC;YAC3C,CAAC;QACH,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,CAAC,IAAI,CAAC,6BAA6B,CAAC,CAAC;YAC5C,MAAM,CAAC,KAAK,CAAC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;YAC/D,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;IACH,CAAC,CAAC,CAAC;AACP,CAAC"}

package/dist/commands/apikey/create.d.ts

@@ -0,0 +1,6 @@
+/**
+ * API key create command
+ */
+import type { Command } from 'commander';
+export declare function registerCreateCommand(apiKeyCmd: Command): void;
+//# sourceMappingURL=create.d.ts.map

package/dist/commands/apikey/create.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"create.d.ts","sourceRoot":"","sources":["../../../src/commands/apikey/create.ts"],"names":[],"mappings":"AAEA;;GAEG;AAEH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAOzC,wBAAgB,qBAAqB,CAAC,SAAS,EAAE,OAAO,GAAG,IAAI,CAgH9D"}

package/dist/commands/apikey/create.js

@@ -0,0 +1,106 @@
+// Path: src/commands/apikey/create.ts
+import ora from 'ora';
+import { client } from '../../lib/client.js';
+import * as output from '../../lib/output.js';
+import { formatDate, displayConditions, parseConditionsFromOptions } from './helpers.js';
+export function registerCreateCommand(apiKeyCmd) {
+    apiKeyCmd
+        .command('create <name>')
+        .description('Create a new API key with direct permissions')
+        .option('-e, --expires <days>', 'Days until expiration (1-3650, default: 90)', '90')
+        .option('-p, --permissions <perms>', 'Comma-separated permissions (required)')
+        .option('-d, --description <desc>', 'Description')
+        .option('--ip <ips>', 'Comma-separated IP allowlist (CIDR supported)')
+        .option('--time-range <range>', 'Time range restriction: "HH:MM-HH:MM [TIMEZONE]"')
+        .option('--methods <methods>', 'Comma-separated allowed HTTP methods: GET,POST,etc')
+        .option('--resources <ids>', 'Specific resource IDs (type:id,...): secrets:id1,certificates:id2')
+        .option('--aliases <patterns>', 'Comma-separated alias patterns (glob): prod/*,api/*')
+        .option('--tags <tags>', 'Required resource tags: key=value,key2=value2')
+        .option('-t, --tenant <id>', 'Tenant ID (superadmin only)')
+        .option('--json', 'Output as JSON')
+        .action(async (name, options) => {
+        // Validate permissions
+        if (!options.permissions) {
+            output.error('--permissions is required. Use comma-separated permission strings.');
+            output.info('Example: --permissions "secret:read:value,secret:list:values"');
+            process.exit(1);
+        }
+        const permissions = options.permissions.split(',').map((p) => p.trim());
+        const spinner = ora('Creating API key...').start();
+        try {
+            // Parse options
+            const expiresInDays = parseInt(options.expires, 10);
+            if (isNaN(expiresInDays) || expiresInDays < 1 || expiresInDays > 3650) {
+                spinner.fail('Invalid expiration');
+                output.error('Expiration must be between 1 and 3650 days');
+                process.exit(1);
+            }
+            let ipAllowlist;
+            if (options.ip) {
+                ipAllowlist = options.ip.split(',').map((ip) => ip.trim());
+            }
+            // Validate time range format
+            if (options.timeRange) {
+                const match = /^(\d{2}:\d{2})-(\d{2}:\d{2})(?:\s+(.+))?$/.exec(options.timeRange);
+                if (!match) {
+                    spinner.fail('Invalid time range format');
+                    output.error('Use format: "HH:MM-HH:MM [TIMEZONE]"');
+                    output.info('Example: --time-range "09:00-17:00 America/New_York"');
+                    process.exit(1);
+                }
+            }
+            // Parse conditions
+            const conditions = parseConditionsFromOptions(options);
+            // Add IP to conditions as well (for backward compatibility)
+            if (ipAllowlist) {
+                conditions.ip = ipAllowlist;
+            }
+            const result = await client.createApiKey({
+                name,
+                description: options.description,
+                expiresInDays,
+                permissions,
+                ipAllowlist,
+                conditions: Object.keys(conditions).length > 0 ? conditions : undefined,
+                tenantId: options.tenant,
+            });
+            spinner.succeed('API key created');
+            if (options.json) {
+                output.json(result);
+                return;
+            }
+            console.log('\n⚠️  IMPORTANT: Save this key now - it will not be shown again!\n');
+            console.log('────────────────────────────────────────────────────────────────');
+            console.log(`API Key: ${result.key}`);
+            console.log('────────────────────────────────────────────────────────────────\n');
+            output.keyValue({
+                'Key ID': result.apiKey.id,
+                'Name': result.apiKey.name,
+                'Prefix': result.apiKey.prefix,
+                'Status': result.apiKey.enabled ? '\x1b[32m●\x1b[0m Active' : '\x1b[31m○\x1b[0m Disabled',
+                'Tenant': result.apiKey.tenant_id,
+                'Description': result.apiKey.description ?? 'None',
+                'Expires': formatDate(result.apiKey.expires_at),
+                'IP Allowlist': result.apiKey.ip_allowlist?.join(', ') ?? 'None',
+            });
+            if (result.apiKey.permissions.length > 0) {
+                console.log('\nPermissions:');
+                for (const perm of result.apiKey.permissions) {
+                    console.log(`  - ${perm}`);
+                }
+            }
+            // Display conditions if any
+            const apiKeyConditions = result.apiKey.conditions;
+            if (apiKeyConditions && Object.keys(apiKeyConditions).length > 0) {
+                console.log('\nConditions:');
+                displayConditions(apiKeyConditions);
+            }
+        }
+        catch (err) {
+            spinner.fail('Failed to create API key');
+            output.error(err instanceof Error ? err.message : String(err));
+            process.exit(1);
+        }
+    });
+}
+//# sourceMappingURL=create.js.map

package/dist/commands/apikey/create.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"create.js","sourceRoot":"","sources":["../../../src/commands/apikey/create.ts"],"names":[],"mappings":"AAAA,sCAAsC;AAOtC,OAAO,GAAG,MAAM,KAAK,CAAC;AACtB,OAAO,EAAE,MAAM,EAAE,MAAM,qBAAqB,CAAC;AAC7C,OAAO,KAAK,MAAM,MAAM,qBAAqB,CAAC;AAE9C,OAAO,EAAE,UAAU,EAAE,iBAAiB,EAAE,0BAA0B,EAAE,MAAM,cAAc,CAAC;AAEzF,MAAM,UAAU,qBAAqB,CAAC,SAAkB;IACtD,SAAS;SACN,OAAO,CAAC,eAAe,CAAC;SACxB,WAAW,CAAC,8CAA8C,CAAC;SAC3D,MAAM,CAAC,sBAAsB,EAAE,6CAA6C,EAAE,IAAI,CAAC;SACnF,MAAM,CAAC,2BAA2B,EAAE,wCAAwC,CAAC;SAC7E,MAAM,CAAC,0BAA0B,EAAE,aAAa,CAAC;SACjD,MAAM,CAAC,YAAY,EAAE,+CAA+C,CAAC;SACrE,MAAM,CAAC,sBAAsB,EAAE,kDAAkD,CAAC;SAClF,MAAM,CAAC,qBAAqB,EAAE,oDAAoD,CAAC;SACnF,MAAM,CAAC,mBAAmB,EAAE,mEAAmE,CAAC;SAChG,MAAM,CAAC,sBAAsB,EAAE,qDAAqD,CAAC;SACrF,MAAM,CAAC,eAAe,EAAE,+CAA+C,CAAC;SACxE,MAAM,CAAC,mBAAmB,EAAE,6BAA6B,CAAC;SAC1D,MAAM,CAAC,QAAQ,EAAE,gBAAgB,CAAC;SAClC,MAAM,CAAC,KAAK,EAAE,IAAY,EAAE,OAAsB,EAAE,EAAE;QACrD,uBAAuB;QACvB,IAAI,CAAC,OAAO,CAAC,WAAW,EAAE,CAAC;YACzB,MAAM,CAAC,KAAK,CAAC,oEAAoE,CAAC,CAAC;YACnF,MAAM,CAAC,IAAI,CAAC,+DAA+D,CAAC,CAAC;YAC7E,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;QAED,MAAM,WAAW,GAAG,OAAO,CAAC,WAAW,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;QAExE,MAAM,OAAO,GAAG,GAAG,CAAC,qBAAqB,CAAC,CAAC,KAAK,EAAE,CAAC;QAEnD,IAAI,CAAC;YACH,gBAAgB;YAChB,MAAM,aAAa,GAAG,QAAQ,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;YACpD,IAAI,KAAK,CAAC,aAAa,CAAC,IAAI,aAAa,GAAG,CAAC,IAAI,aAAa,GAAG,IAAI,EAAE,CAAC;gBACtE,OAAO,CAAC,IAAI,CAAC,oBAAoB,CAAC,CAAC;gBACnC,MAAM,CAAC,KAAK,CAAC,4CAA4C,CAAC,CAAC;gBAC3D,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAClB,CAAC;YAED,IAAI,WAAiC,CAAC;YACtC,IAAI,OAAO,CAAC,EAAE,EAAE,CAAC;gBACf,WAAW,GAAG,OAAO,CAAC,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,IAAI,EAAE,CAAC,CAAC;YAC7D,CAAC;YAED,6BAA6B;YAC7B,IAAI,OAAO,CAAC,SAAS,EAAE,CAAC;gBACtB,MAAM,KAAK,GAAG,2CAA2C,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;gBAClF,IAAI,CAAC,KAAK,EAAE,CAAC;oBACX,OAAO,CAAC,IAAI,CAAC,2BAA2B,CAAC,CAAC;oBAC1C,MAAM,CAAC,KAAK,CAAC,sCAAsC,CAAC,CAAC;oBACrD,MAAM,CAAC,IAAI,CAAC,sDAAsD,CAAC,CAAC;oBACpE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;gBAClB,CAAC;YACH,CAAC;YAED,mBAAmB;YACnB,MAAM,UAAU,GAAG,0BAA0B,CAAC,OAAO,CAAC,CAAC;YAEvD,4DAA4D;YAC5D,IAAI,WAAW,EAAE,CAAC;gBAChB,UAAU,CAAC,EAAE,GAAG,WAAW,CAAC;YAC9B,CAAC;YAED,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,YAAY,CAAC;gBACvC,IAAI;gBACJ,WAAW,EAAE,OAAO,CAAC,WAAW;gBAChC,aAAa;gBACb,WAAW;gBACX,WAAW;gBACX,UAAU,EAAE,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,SAAS;gBACvE,QAAQ,EAAE,OAAO,CAAC,MAAM;aACzB,CAAC,CAAC;YAEH,OAAO,CAAC,OAAO,CAAC,iBAAiB,CAAC,CAAC;YAEnC,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC;gBACjB,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;gBACpB,OAAO;YACT,CAAC;YAED,OAAO,CAAC,GAAG,CAAC,oEAAoE,CAAC,CAAC;YAClF,OAAO,CAAC,GAAG,CAAC,kEAAkE,CAAC,CAAC;YAChF,OAAO,CAAC,GAAG,CAAC,YAAY,MAAM,CAAC,GAAG,EAAE,CAAC,CAAC;YACtC,OAAO,CAAC,GAAG,CAAC,oEAAoE,CAAC,CAAC;YAElF,MAAM,CAAC,QAAQ,CAAC;gBACd,QAAQ,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE;gBAC1B,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,IAAI;gBAC1B,QAAQ,EAAE,MAAM,CAAC,MAAM,CAAC,MAAM;gBAC9B,QAAQ,EAAE,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,yBAAyB,CAAC,CAAC,CAAC,2BAA2B;gBACzF,QAAQ,EAAE,MAAM,CAAC,MAAM,CAAC,SAAS;gBACjC,aAAa,EAAE,MAAM,CAAC,MAAM,CAAC,WAAW,IAAI,MAAM;gBAClD,SAAS,EAAE,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC;gBAC/C,cAAc,EAAE,MAAM,CAAC,MAAM,CAAC,YAAY,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI,MAAM;aACjE,CAAC,CAAC;YAEH,IAAI,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACzC,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC;gBAC9B,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC;oBAC7C,OAAO,CAAC,GAAG,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC;gBAC7B,CAAC;YACH,CAAC;YAED,4BAA4B;YAC5B,MAAM,gBAAgB,GAAG,MAAM,CAAC,MAAM,CAAC,UAA0C,CAAC;YAClF,IAAI,gBAAgB,IAAI,MAAM,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACjE,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;gBAC7B,iBAAiB,CAAC,gBAAgB,CAAC,CAAC;YACtC,CAAC;QACH,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,CAAC,IAAI,CAAC,0BAA0B,CAAC,CAAC;YACzC,MAAM,CAAC,KAAK,CAAC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;YAC/D,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;IACH,CAAC,CAAC,CAAC;AACP,CAAC"}

package/dist/commands/apikey/delete.d.ts

@@ -0,0 +1,6 @@
+/**
+ * API key delete command
+ */
+import type { Command } from 'commander';
+export declare function registerDeleteCommand(apiKeyCmd: Command): void;
+//# sourceMappingURL=delete.d.ts.map

package/dist/commands/apikey/delete.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"delete.d.ts","sourceRoot":"","sources":["../../../src/commands/apikey/delete.ts"],"names":[],"mappings":"AAEA;;GAEG;AAEH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAMzC,wBAAgB,qBAAqB,CAAC,SAAS,EAAE,OAAO,GAAG,IAAI,CAwB9D"}

package/dist/commands/apikey/delete.js

@@ -0,0 +1,29 @@
+// Path: src/commands/apikey/delete.ts
+import ora from 'ora';
+import { client } from '../../lib/client.js';
+import * as output from '../../lib/output.js';
+export function registerDeleteCommand(apiKeyCmd) {
+    apiKeyCmd
+        .command('delete <id>')
+        .alias('rm')
+        .description('Delete an API key')
+        .option('-t, --tenant <id>', 'Tenant ID')
+        .option('-f, --force', 'Skip confirmation')
+        .action(async (id, options) => {
+        if (!options.force) {
+            output.warn(`This will permanently delete API key: ${id}`);
+            output.warn('The key will stop working immediately.');
+        }
+        const spinner = ora('Deleting API key...').start();
+        try {
+            await client.deleteApiKey(id, options.tenant);
+            spinner.succeed(`API key deleted: ${id}`);
+        }
+        catch (err) {
+            spinner.fail('Failed to delete API key');
+            output.error(err instanceof Error ? err.message : String(err));
+            process.exit(1);
+        }
+    });
+}
+//# sourceMappingURL=delete.js.map

package/dist/commands/apikey/delete.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"delete.js","sourceRoot":"","sources":["../../../src/commands/apikey/delete.ts"],"names":[],"mappings":"AAAA,sCAAsC;AAOtC,OAAO,GAAG,MAAM,KAAK,CAAC;AACtB,OAAO,EAAE,MAAM,EAAE,MAAM,qBAAqB,CAAC;AAC7C,OAAO,KAAK,MAAM,MAAM,qBAAqB,CAAC;AAG9C,MAAM,UAAU,qBAAqB,CAAC,SAAkB;IACtD,SAAS;SACN,OAAO,CAAC,aAAa,CAAC;SACtB,KAAK,CAAC,IAAI,CAAC;SACX,WAAW,CAAC,mBAAmB,CAAC;SAChC,MAAM,CAAC,mBAAmB,EAAE,WAAW,CAAC;SACxC,MAAM,CAAC,aAAa,EAAE,mBAAmB,CAAC;SAC1C,MAAM,CAAC,KAAK,EAAE,EAAU,EAAE,OAAsB,EAAE,EAAE;QACnD,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;YACnB,MAAM,CAAC,IAAI,CAAC,yCAAyC,EAAE,EAAE,CAAC,CAAC;YAC3D,MAAM,CAAC,IAAI,CAAC,wCAAwC,CAAC,CAAC;QACxD,CAAC;QAED,MAAM,OAAO,GAAG,GAAG,CAAC,qBAAqB,CAAC,CAAC,KAAK,EAAE,CAAC;QAEnD,IAAI,CAAC;YACH,MAAM,MAAM,CAAC,YAAY,CAAC,EAAE,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;YAC9C,OAAO,CAAC,OAAO,CAAC,oBAAoB,EAAE,EAAE,CAAC,CAAC;QAC5C,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,CAAC,IAAI,CAAC,0BAA0B,CAAC,CAAC;YACzC,MAAM,CAAC,KAAK,CAAC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;YAC/D,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;IACH,CAAC,CAAC,CAAC;AACP,CAAC"}

package/dist/commands/apikey/enable-disable.d.ts

@@ -0,0 +1,6 @@
+/**
+ * API key enable/disable commands
+ */
+import type { Command } from 'commander';
+export declare function registerEnableDisableCommands(apiKeyCmd: Command): void;
+//# sourceMappingURL=enable-disable.d.ts.map

package/dist/commands/apikey/enable-disable.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"enable-disable.d.ts","sourceRoot":"","sources":["../../../src/commands/apikey/enable-disable.ts"],"names":[],"mappings":"AAEA;;GAEG;AAEH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAMzC,wBAAgB,6BAA6B,CAAC,SAAS,EAAE,OAAO,GAAG,IAAI,CAuCtE"}

package/dist/commands/apikey/enable-disable.js

@@ -0,0 +1,44 @@
+// Path: src/commands/apikey/enable-disable.ts
+import ora from 'ora';
+import { client } from '../../lib/client.js';
+import * as output from '../../lib/output.js';
+export function registerEnableDisableCommands(apiKeyCmd) {
+    // Enable API key
+    apiKeyCmd
+        .command('enable <id>')
+        .description('Enable an API key (allow authentication)')
+        .option('-t, --tenant <id>', 'Tenant ID')
+        .action(async (id, options) => {
+        const spinner = ora('Enabling API key...').start();
+        try {
+            const key = await client.setApiKeyEnabled(id, true, options.tenant);
+            spinner.succeed(`API key enabled: ${key.name}`);
+            console.log('\nThe key can now be used for authentication.');
+        }
+        catch (err) {
+            spinner.fail('Failed to enable API key');
+            output.error(err instanceof Error ? err.message : String(err));
+            process.exit(1);
+        }
+    });
+    // Disable API key
+    apiKeyCmd
+        .command('disable <id>')
+        .description('Disable an API key (block authentication without deleting)')
+        .option('-t, --tenant <id>', 'Tenant ID')
+        .action(async (id, options) => {
+        const spinner = ora('Disabling API key...').start();
+        try {
+            const key = await client.setApiKeyEnabled(id, false, options.tenant);
+            spinner.succeed(`API key disabled: ${key.name}`);
+            console.log('\nThe key is now blocked from authentication.');
+            console.log('Use "znvault apikey enable" to re-enable it.');
+        }
+        catch (err) {
+            spinner.fail('Failed to disable API key');
+            output.error(err instanceof Error ? err.message : String(err));
+            process.exit(1);
+        }
+    });
+}
+//# sourceMappingURL=enable-disable.js.map

package/dist/commands/apikey/enable-disable.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"enable-disable.js","sourceRoot":"","sources":["../../../src/commands/apikey/enable-disable.ts"],"names":[],"mappings":"AAAA,8CAA8C;AAO9C,OAAO,GAAG,MAAM,KAAK,CAAC;AACtB,OAAO,EAAE,MAAM,EAAE,MAAM,qBAAqB,CAAC;AAC7C,OAAO,KAAK,MAAM,MAAM,qBAAqB,CAAC;AAG9C,MAAM,UAAU,6BAA6B,CAAC,SAAkB;IAC9D,iBAAiB;IACjB,SAAS;SACN,OAAO,CAAC,aAAa,CAAC;SACtB,WAAW,CAAC,0CAA0C,CAAC;SACvD,MAAM,CAAC,mBAAmB,EAAE,WAAW,CAAC;SACxC,MAAM,CAAC,KAAK,EAAE,EAAU,EAAE,OAA6B,EAAE,EAAE;QAC1D,MAAM,OAAO,GAAG,GAAG,CAAC,qBAAqB,CAAC,CAAC,KAAK,EAAE,CAAC;QAEnD,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,gBAAgB,CAAC,EAAE,EAAE,IAAI,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;YACpE,OAAO,CAAC,OAAO,CAAC,oBAAoB,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC;YAChD,OAAO,CAAC,GAAG,CAAC,+CAA+C,CAAC,CAAC;QAC/D,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,CAAC,IAAI,CAAC,0BAA0B,CAAC,CAAC;YACzC,MAAM,CAAC,KAAK,CAAC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;YAC/D,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;IACH,CAAC,CAAC,CAAC;IAEL,kBAAkB;IAClB,SAAS;SACN,OAAO,CAAC,cAAc,CAAC;SACvB,WAAW,CAAC,4DAA4D,CAAC;SACzE,MAAM,CAAC,mBAAmB,EAAE,WAAW,CAAC;SACxC,MAAM,CAAC,KAAK,EAAE,EAAU,EAAE,OAA6B,EAAE,EAAE;QAC1D,MAAM,OAAO,GAAG,GAAG,CAAC,sBAAsB,CAAC,CAAC,KAAK,EAAE,CAAC;QAEpD,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,gBAAgB,CAAC,EAAE,EAAE,KAAK,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;YACrE,OAAO,CAAC,OAAO,CAAC,qBAAqB,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC;YACjD,OAAO,CAAC,GAAG,CAAC,+CAA+C,CAAC,CAAC;YAC7D,OAAO,CAAC,GAAG,CAAC,8CAA8C,CAAC,CAAC;QAC9D,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,CAAC,IAAI,CAAC,2BAA2B,CAAC,CAAC;YAC1C,MAAM,CAAC,KAAK,CAAC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;YAC/D,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;IACH,CAAC,CAAC,CAAC;AACP,CAAC"}

package/dist/commands/apikey/helpers.d.ts

@@ -0,0 +1,23 @@
+/**
+ * Helper functions for API key commands
+ */
+import type { ApiKeyConditions } from './types.js';
+export declare function formatDate(dateStr: string): string;
+export declare function getDaysUntilExpiry(expiresAt: string): number;
+export declare function formatSecondsToHuman(seconds: number): string;
+export declare function formatExpiry(expiresAt: string): string;
+export declare function formatPermissions(permissions: string[]): string;
+export declare function formatConditionsSummary(conditions?: ApiKeyConditions): string;
+export declare function displayConditions(cond: ApiKeyConditions): void;
+/**
+ * Parse conditions from command options into ApiKeyConditions object
+ */
+export declare function parseConditionsFromOptions(options: {
+    ip?: string;
+    timeRange?: string;
+    methods?: string;
+    resources?: string;
+    aliases?: string;
+    tags?: string;
+}): ApiKeyConditions;
+//# sourceMappingURL=helpers.d.ts.map

package/dist/commands/apikey/helpers.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"helpers.d.ts","sourceRoot":"","sources":["../../../src/commands/apikey/helpers.ts"],"names":[],"mappings":"AAEA;;GAEG;AAEH,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AAEnD,wBAAgB,UAAU,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAElD;AAED,wBAAgB,kBAAkB,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,CAI5D;AAED,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAK5D;AAED,wBAAgB,YAAY,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,CAQtD;AAED,wBAAgB,iBAAiB,CAAC,WAAW,EAAE,MAAM,EAAE,GAAG,MAAM,CAI/D;AAED,wBAAgB,uBAAuB,CAAC,UAAU,CAAC,EAAE,gBAAgB,GAAG,MAAM,CAc7E;AAED,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,gBAAgB,GAAG,IAAI,CAU9D;AAED;;GAEG;AACH,wBAAgB,0BAA0B,CAAC,OAAO,EAAE;IAClD,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,IAAI,CAAC,EAAE,MAAM,CAAC;CACf,GAAG,gBAAgB,CA4DnB"}

package/dist/commands/apikey/helpers.js

@@ -0,0 +1,135 @@
+// Path: src/commands/apikey/helpers.ts
+export function formatDate(dateStr) {
+    return new Date(dateStr).toLocaleString();
+}
+export function getDaysUntilExpiry(expiresAt) {
+    const expires = new Date(expiresAt);
+    const now = new Date();
+    return Math.ceil((expires.getTime() - now.getTime()) / (1000 * 60 * 60 * 24));
+}
+export function formatSecondsToHuman(seconds) {
+    if (seconds < 60)
+        return `${seconds}s`;
+    if (seconds < 3600)
+        return `${Math.floor(seconds / 60)}m`;
+    if (seconds < 86400)
+        return `${Math.floor(seconds / 3600)}h`;
+    return `${Math.floor(seconds / 86400)}d`;
+}
+export function formatExpiry(expiresAt) {
+    const days = getDaysUntilExpiry(expiresAt);
+    if (days < 0)
+        return `Expired ${Math.abs(days)} days ago`;
+    if (days === 0)
+        return 'Expires today';
+    if (days === 1)
+        return 'Expires tomorrow';
+    if (days <= 7)
+        return `Expires in ${days} days (!)`;
+    if (days <= 30)
+        return `Expires in ${days} days`;
+    return `Expires in ${days} days`;
+}
+export function formatPermissions(permissions) {
+    if (permissions.length === 0)
+        return 'None';
+    if (permissions.length <= 3)
+        return permissions.join(', ');
+    return `${permissions.slice(0, 2).join(', ')} +${permissions.length - 2} more`;
+}
+export function formatConditionsSummary(conditions) {
+    if (!conditions || Object.keys(conditions).length === 0)
+        return '-';
+    const parts = [];
+    if (conditions.ip)
+        parts.push('IP');
+    if (conditions.timeRange)
+        parts.push('Time');
+    if (conditions.methods)
+        parts.push('Methods');
+    if (conditions.resources)
+        parts.push('Resources');
+    if (conditions.aliases)
+        parts.push('Aliases');
+    if (conditions.resourceTags)
+        parts.push('Tags');
+    if (parts.length === 0)
+        return '-';
+    if (parts.length <= 2)
+        return parts.join(', ');
+    return `${parts.slice(0, 2).join(', ')} +${parts.length - 2}`;
+}
+export function displayConditions(cond) {
+    if (cond.ip)
+        console.log(`  - IP Allowlist: ${cond.ip.join(', ')}`);
+    if (cond.timeRange) {
+        const tr = cond.timeRange;
+        console.log(`  - Time Range: ${tr.start}-${tr.end} ${tr.timezone ?? 'UTC'}`);
+    }
+    if (cond.methods)
+        console.log(`  - Methods: ${cond.methods.join(', ')}`);
+    if (cond.resources)
+        console.log(`  - Resources: ${JSON.stringify(cond.resources)}`);
+    if (cond.aliases)
+        console.log(`  - Aliases: ${cond.aliases.join(', ')}`);
+    if (cond.resourceTags)
+        console.log(`  - Tags: ${JSON.stringify(cond.resourceTags)}`);
+}
+/**
+ * Parse conditions from command options into ApiKeyConditions object
+ */
+export function parseConditionsFromOptions(options) {
+    const conditions = {};
+    // IP condition
+    if (options.ip && options.ip !== 'clear') {
+        conditions.ip = options.ip.split(',').map((ip) => ip.trim());
+    }
+    // Time range condition
+    if (options.timeRange && options.timeRange !== 'clear') {
+        const match = /^(\d{2}:\d{2})-(\d{2}:\d{2})(?:\s+(.+))?$/.exec(options.timeRange);
+        if (match) {
+            conditions.timeRange = {
+                start: match[1],
+                end: match[2],
+                timezone: match[3] || 'UTC',
+            };
+        }
+    }
+    // HTTP methods condition
+    if (options.methods && options.methods !== 'clear') {
+        conditions.methods = options.methods.split(',').map((m) => m.trim().toUpperCase());
+    }
+    // Resource IDs condition
+    if (options.resources && options.resources !== 'clear') {
+        const resources = {};
+        for (const part of options.resources.split(',')) {
+            const [type, id] = part.split(':');
+            if (type && id) {
+                resources[type] = resources[type] ?? [];
+                resources[type].push(id);
+            }
+        }
+        if (Object.keys(resources).length > 0) {
+            conditions.resources = resources;
+        }
+    }
+    // Alias patterns condition
+    if (options.aliases && options.aliases !== 'clear') {
+        conditions.aliases = options.aliases.split(',').map((a) => a.trim());
+    }
+    // Resource tags condition
+    if (options.tags && options.tags !== 'clear') {
+        const tags = {};
+        for (const part of options.tags.split(',')) {
+            const [key, value] = part.split('=');
+            if (key && value) {
+                tags[key.trim()] = value.trim();
+            }
+        }
+        if (Object.keys(tags).length > 0) {
+            conditions.resourceTags = tags;
+        }
+    }
+    return conditions;
+}
+//# sourceMappingURL=helpers.js.map

package/dist/commands/apikey/helpers.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"helpers.js","sourceRoot":"","sources":["../../../src/commands/apikey/helpers.ts"],"names":[],"mappings":"AAAA,uCAAuC;AAQvC,MAAM,UAAU,UAAU,CAAC,OAAe;IACxC,OAAO,IAAI,IAAI,CAAC,OAAO,CAAC,CAAC,cAAc,EAAE,CAAC;AAC5C,CAAC;AAED,MAAM,UAAU,kBAAkB,CAAC,SAAiB;IAClD,MAAM,OAAO,GAAG,IAAI,IAAI,CAAC,SAAS,CAAC,CAAC;IACpC,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC;IACvB,OAAO,IAAI,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,OAAO,EAAE,GAAG,GAAG,CAAC,OAAO,EAAE,CAAC,GAAG,CAAC,IAAI,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC;AAChF,CAAC;AAED,MAAM,UAAU,oBAAoB,CAAC,OAAe;IAClD,IAAI,OAAO,GAAG,EAAE;QAAE,OAAO,GAAG,OAAO,GAAG,CAAC;IACvC,IAAI,OAAO,GAAG,IAAI;QAAE,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,GAAG,EAAE,CAAC,GAAG,CAAC;IAC1D,IAAI,OAAO,GAAG,KAAK;QAAE,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,GAAG,IAAI,CAAC,GAAG,CAAC;IAC7D,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,GAAG,KAAK,CAAC,GAAG,CAAC;AAC3C,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,SAAiB;IAC5C,MAAM,IAAI,GAAG,kBAAkB,CAAC,SAAS,CAAC,CAAC;IAC3C,IAAI,IAAI,GAAG,CAAC;QAAE,OAAO,WAAW,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,WAAW,CAAC;IAC1D,IAAI,IAAI,KAAK,CAAC;QAAE,OAAO,eAAe,CAAC;IACvC,IAAI,IAAI,KAAK,CAAC;QAAE,OAAO,kBAAkB,CAAC;IAC1C,IAAI,IAAI,IAAI,CAAC;QAAE,OAAO,cAAc,IAAI,WAAW,CAAC;IACpD,IAAI,IAAI,IAAI,EAAE;QAAE,OAAO,cAAc,IAAI,OAAO,CAAC;IACjD,OAAO,cAAc,IAAI,OAAO,CAAC;AACnC,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,WAAqB;IACrD,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,MAAM,CAAC;IAC5C,IAAI,WAAW,CAAC,MAAM,IAAI,CAAC;QAAE,OAAO,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC3D,OAAO,GAAG,WAAW,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,WAAW,CAAC,MAAM,GAAG,CAAC,OAAO,CAAC;AACjF,CAAC;AAED,MAAM,UAAU,uBAAuB,CAAC,UAA6B;IACnE,IAAI,CAAC,UAAU,IAAI,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,GAAG,CAAC;IAEpE,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,IAAI,UAAU,CAAC,EAAE;QAAE,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACpC,IAAI,UAAU,CAAC,SAAS;QAAE,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IAC7C,IAAI,UAAU,CAAC,OAAO;QAAE,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IAC9C,IAAI,UAAU,CAAC,SAAS;QAAE,KAAK,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;IAClD,IAAI,UAAU,CAAC,OAAO;QAAE,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IAC9C,IAAI,UAAU,CAAC,YAAY;QAAE,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IAEhD,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,GAAG,CAAC;IACnC,IAAI,KAAK,CAAC,MAAM,IAAI,CAAC;QAAE,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC/C,OAAO,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;AAChE,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,IAAsB;IACtD,IAAI,IAAI,CAAC,EAAE;QAAE,OAAO,CAAC,GAAG,CAAC,qBAAqB,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACpE,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC;QACnB,MAAM,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC;QAC1B,OAAO,CAAC,GAAG,CAAC,mBAAmB,EAAE,CAAC,KAAK,IAAI,EAAE,CAAC,GAAG,IAAI,EAAE,CAAC,QAAQ,IAAI,KAAK,EAAE,CAAC,CAAC;IAC/E,CAAC;IACD,IAAI,IAAI,CAAC,OAAO;QAAE,OAAO,CAAC,GAAG,CAAC,gBAAgB,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACzE,IAAI,IAAI,CAAC,SAAS;QAAE,OAAO,CAAC,GAAG,CAAC,kBAAkB,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;IACpF,IAAI,IAAI,CAAC,OAAO;QAAE,OAAO,CAAC,GAAG,CAAC,gBAAgB,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACzE,IAAI,IAAI,CAAC,YAAY;QAAE,OAAO,CAAC,GAAG,CAAC,aAAa,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC;AACvF,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,0BAA0B,CAAC,OAO1C;IACC,MAAM,UAAU,GAAqB,EAAE,CAAC;IAExC,eAAe;IACf,IAAI,OAAO,CAAC,EAAE,IAAI,OAAO,CAAC,EAAE,KAAK,OAAO,EAAE,CAAC;QACzC,UAAU,CAAC,EAAE,GAAG,OAAO,CAAC,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,IAAI,EAAE,CAAC,CAAC;IAC/D,CAAC;IAED,uBAAuB;IACvB,IAAI,OAAO,CAAC,SAAS,IAAI,OAAO,CAAC,SAAS,KAAK,OAAO,EAAE,CAAC;QACvD,MAAM,KAAK,GAAG,2CAA2C,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;QAClF,IAAI,KAAK,EAAE,CAAC;YACV,UAAU,CAAC,SAAS,GAAG;gBACrB,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC;gBACf,GAAG,EAAE,KAAK,CAAC,CAAC,CAAC;gBACb,QAAQ,EAAE,KAAK,CAAC,CAAC,CAAC,IAAI,KAAK;aAC5B,CAAC;QACJ,CAAC;IACH,CAAC;IAED,yBAAyB;IACzB,IAAI,OAAO,CAAC,OAAO,IAAI,OAAO,CAAC,OAAO,KAAK,OAAO,EAAE,CAAC;QACnD,UAAU,CAAC,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,CAAC;IACrF,CAAC;IAED,yBAAyB;IACzB,IAAI,OAAO,CAAC,SAAS,IAAI,OAAO,CAAC,SAAS,KAAK,OAAO,EAAE,CAAC;QACvD,MAAM,SAAS,GAA6B,EAAE,CAAC;QAC/C,KAAK,MAAM,IAAI,IAAI,OAAO,CAAC,SAAS,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;YAChD,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YACnC,IAAI,IAAI,IAAI,EAAE,EAAE,CAAC;gBACf,SAAS,CAAC,IAAI,CAAC,GAAG,SAAS,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;gBACxC,SAAS,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YAC3B,CAAC;QACH,CAAC;QACD,IAAI,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACtC,UAAU,CAAC,SAAS,GAAG,SAAS,CAAC;QACnC,CAAC;IACH,CAAC;IAED,2BAA2B;IAC3B,IAAI,OAAO,CAAC,OAAO,IAAI,OAAO,CAAC,OAAO,KAAK,OAAO,EAAE,CAAC;QACnD,UAAU,CAAC,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;IACvE,CAAC;IAED,0BAA0B;IAC1B,IAAI,OAAO,CAAC,IAAI,IAAI,OAAO,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;QAC7C,MAAM,IAAI,GAA2B,EAAE,CAAC;QACxC,KAAK,MAAM,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;YAC3C,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YACrC,IAAI,GAAG,IAAI,KAAK,EAAE,CAAC;gBACjB,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;YAClC,CAAC;QACH,CAAC;QACD,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACjC,UAAU,CAAC,YAAY,GAAG,IAAI,CAAC;QACjC,CAAC;IACH,CAAC;IAED,OAAO,UAAU,CAAC;AACpB,CAAC"}

package/dist/commands/apikey/index.d.ts

@@ -0,0 +1,10 @@
+/**
+ * API key commands - main entry point
+ *
+ * This module provides the command registration function that combines
+ * all API key subcommands into a single command group.
+ */
+import type { Command } from 'commander';
+export declare function registerApiKeyCommands(program: Command): void;
+export * from './types.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/commands/apikey/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/commands/apikey/index.ts"],"names":[],"mappings":"AAEA;;;;;GAKG;AAEH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAazC,wBAAgB,sBAAsB,CAAC,OAAO,EAAE,OAAO,GAAG,IAAI,CAkB7D;AAGD,cAAc,YAAY,CAAC"}

package/dist/commands/apikey/index.js

@@ -0,0 +1,33 @@
+// Path: src/commands/apikey/index.ts
+import { registerListCommand } from './list.js';
+import { registerCreateCommand } from './create.js';
+import { registerShowCommand } from './show.js';
+import { registerDeleteCommand } from './delete.js';
+import { registerRotateCommand } from './rotate.js';
+import { registerEnableDisableCommands } from './enable-disable.js';
+import { registerPermissionsCommand } from './permissions.js';
+import { registerConditionsCommand } from './conditions.js';
+import { registerPolicyCommands } from './policies.js';
+import { registerSelfCommands } from './self.js';
+import { registerManagedCommands } from './managed/index.js';
+export function registerApiKeyCommands(program) {
+    const apiKeyCmd = program
+        .command('apikey')
+        .alias('api-key')
+        .description('API key management (independent, tenant-scoped)');
+    // Register all subcommands
+    registerListCommand(apiKeyCmd);
+    registerCreateCommand(apiKeyCmd);
+    registerShowCommand(apiKeyCmd);
+    registerDeleteCommand(apiKeyCmd);
+    registerRotateCommand(apiKeyCmd);
+    registerEnableDisableCommands(apiKeyCmd);
+    registerPermissionsCommand(apiKeyCmd);
+    registerConditionsCommand(apiKeyCmd);
+    registerPolicyCommands(apiKeyCmd);
+    registerSelfCommands(apiKeyCmd);
+    registerManagedCommands(apiKeyCmd);
+}
+// Re-export types for external use
+export * from './types.js';
+//# sourceMappingURL=index.js.map

package/dist/commands/apikey/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/commands/apikey/index.ts"],"names":[],"mappings":"AAAA,qCAAqC;AAUrC,OAAO,EAAE,mBAAmB,EAAE,MAAM,WAAW,CAAC;AAChD,OAAO,EAAE,qBAAqB,EAAE,MAAM,aAAa,CAAC;AACpD,OAAO,EAAE,mBAAmB,EAAE,MAAM,WAAW,CAAC;AAChD,OAAO,EAAE,qBAAqB,EAAE,MAAM,aAAa,CAAC;AACpD,OAAO,EAAE,qBAAqB,EAAE,MAAM,aAAa,CAAC;AACpD,OAAO,EAAE,6BAA6B,EAAE,MAAM,qBAAqB,CAAC;AACpE,OAAO,EAAE,0BAA0B,EAAE,MAAM,kBAAkB,CAAC;AAC9D,OAAO,EAAE,yBAAyB,EAAE,MAAM,iBAAiB,CAAC;AAC5D,OAAO,EAAE,sBAAsB,EAAE,MAAM,eAAe,CAAC;AACvD,OAAO,EAAE,oBAAoB,EAAE,MAAM,WAAW,CAAC;AACjD,OAAO,EAAE,uBAAuB,EAAE,MAAM,oBAAoB,CAAC;AAE7D,MAAM,UAAU,sBAAsB,CAAC,OAAgB;IACrD,MAAM,SAAS,GAAG,OAAO;SACtB,OAAO,CAAC,QAAQ,CAAC;SACjB,KAAK,CAAC,SAAS,CAAC;SAChB,WAAW,CAAC,iDAAiD,CAAC,CAAC;IAElE,2BAA2B;IAC3B,mBAAmB,CAAC,SAAS,CAAC,CAAC;IAC/B,qBAAqB,CAAC,SAAS,CAAC,CAAC;IACjC,mBAAmB,CAAC,SAAS,CAAC,CAAC;IAC/B,qBAAqB,CAAC,SAAS,CAAC,CAAC;IACjC,qBAAqB,CAAC,SAAS,CAAC,CAAC;IACjC,6BAA6B,CAAC,SAAS,CAAC,CAAC;IACzC,0BAA0B,CAAC,SAAS,CAAC,CAAC;IACtC,yBAAyB,CAAC,SAAS,CAAC,CAAC;IACrC,sBAAsB,CAAC,SAAS,CAAC,CAAC;IAClC,oBAAoB,CAAC,SAAS,CAAC,CAAC;IAChC,uBAAuB,CAAC,SAAS,CAAC,CAAC;AACrC,CAAC;AAED,mCAAmC;AACnC,cAAc,YAAY,CAAC"}

package/dist/commands/apikey/list.d.ts

@@ -0,0 +1,6 @@
+/**
+ * API key list command
+ */
+import type { Command } from 'commander';
+export declare function registerListCommand(apiKeyCmd: Command): void;
+//# sourceMappingURL=list.d.ts.map

package/dist/commands/apikey/list.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"list.d.ts","sourceRoot":"","sources":["../../../src/commands/apikey/list.ts"],"names":[],"mappings":"AAEA;;GAEG;AAEH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAazC,wBAAgB,mBAAmB,CAAC,SAAS,EAAE,OAAO,GAAG,IAAI,CA0E5D"}

package/dist/commands/apikey/list.js

@@ -0,0 +1,74 @@
+// Path: src/commands/apikey/list.ts
+import ora from 'ora';
+import Table from 'cli-table3';
+import { client } from '../../lib/client.js';
+import * as output from '../../lib/output.js';
+import { formatExpiry, formatPermissions, formatSecondsToHuman, getDaysUntilExpiry, } from './helpers.js';
+export function registerListCommand(apiKeyCmd) {
+    apiKeyCmd
+        .command('list')
+        .alias('ls')
+        .description('List API keys')
+        .option('-t, --tenant <id>', 'Tenant ID (superadmin only)')
+        .option('--json', 'Output as JSON')
+        .action(async (options) => {
+        const spinner = ora('Fetching API keys...').start();
+        try {
+            const result = await client.listApiKeys(options.tenant);
+            spinner.stop();
+            if (options.json) {
+                output.json(result);
+                return;
+            }
+            if (result.items.length === 0) {
+                output.warn('No API keys found');
+                return;
+            }
+            // Show expiring soon warning
+            if (result.expiringSoon.length > 0) {
+                console.log(`\n⚠️  ${result.expiringSoon.length} key(s) expiring within 7 days\n`);
+            }
+            const table = new Table({
+                head: ['Name', 'Prefix', 'Type', 'Status', 'Tenant', 'Permissions', 'Expires', 'Rotations'],
+                style: { head: ['cyan'] },
+            });
+            for (const key of result.items) {
+                const daysLeft = getDaysUntilExpiry(key.expires_at);
+                const expiryColor = daysLeft <= 7 ? '\x1b[31m' : daysLeft <= 30 ? '\x1b[33m' : '';
+                const reset = expiryColor ? '\x1b[0m' : '';
+                const statusIcon = key.enabled ? '\x1b[32m●\x1b[0m' : '\x1b[31m○\x1b[0m';
+                const statusText = key.enabled ? 'Active' : 'Disabled';
+                // Format key type (static vs managed with rotation info)
+                let keyType = 'Static';
+                if (key.is_managed && key.rotation_mode) {
+                    const mode = key.rotation_mode.replace('on-', '');
+                    const interval = key.rotation_interval_seconds
+                        ? formatSecondsToHuman(key.rotation_interval_seconds)
+                        : '';
+                    keyType = interval ? `${mode}/${interval}` : mode;
+                }
+                table.push([
+                    key.name,
+                    key.prefix,
+                    keyType,
+                    `${statusIcon} ${statusText}`,
+                    key.tenant_id,
+                    formatPermissions(key.permissions),
+                    `${expiryColor}${formatExpiry(key.expires_at)}${reset}`,
+                    key.rotation_count > 0 ? `${key.rotation_count}x` : '-',
+                ]);
+            }
+            console.log(table.toString());
+            const showingInfo = result.pagination.hasMore
+                ? `Showing ${result.items.length} of ${result.pagination.total}`
+                : `Total: ${result.pagination.total}`;
+            console.log(`\n${showingInfo} API key(s)`);
+        }
+        catch (err) {
+            spinner.fail('Failed to list API keys');
+            output.error(err instanceof Error ? err.message : String(err));
+            process.exit(1);
+        }
+    });
+}
+//# sourceMappingURL=list.js.map