impel-cli 0.14.2 → 0.14.3

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "impel-cli",
-  "version": "0.14.2",
+  "version": "0.14.3",
   "description": "Configure Claude Code and Codex CLI to talk to Impel's gateway, authenticated by an Impel Personal Access Token",
   "type": "module",
   "bin": {

package/src/gateway/index.js

@@ -11,6 +11,7 @@ const SAFE_NAMESPACE = /^[a-z][a-z0-9_-]{1,31}$/u;
 const SAFE_PREFIX = /^[a-z][a-z0-9_]{2,31}_$/u;
 const SAFE_ENVIRONMENT_PREFIX = /^[A-Z][A-Z0-9_]{1,31}$/u;
 const SAFE_ROUTE = /^\/[A-Za-z0-9._~!$&'()*+,;=:@%/-]*$/u;
+const SAFE_TENANT_ID = /^[A-Za-z0-9_.-]{1,128}$/u;
 const ANSI_ESCAPE_RE = /\u001B(?:\][^\u0007\u001B]*(?:\u0007|\u001B\\)|\[[0-?]*[ -/]*[@-~]|[@-_])/gu;
 const CONTROL_TEST_RE = /[\u0000-\u001F\u007F-\u009F]/u;
 const CONTROL_RE = /[\u0000-\u001F\u007F-\u009F]/gu;
@@ -29,6 +30,15 @@ function validateRoute(name, value) {
   return value;
 }
 
+function validateTenantID(value) {
+  if (value == null) return null;
+  const tenantID = String(value || "").trim();
+  if (!SAFE_TENANT_ID.test(tenantID) || tenantID === "." || tenantID === ".." || CONTROL_TEST_RE.test(tenantID)) {
+    throw new Error("gateway CLI tenant.defaultId is invalid");
+  }
+  return tenantID;
+}
+
 function validateBrand(input) {
   if (!input || Array.isArray(input) || typeof input !== "object" || input.schemaVersion !== 1) {
     throw new Error("gateway CLI brand schemaVersion must be 1");
@@ -40,6 +50,8 @@ function validateBrand(input) {
   const managedMarker = String(input.cli?.managedMarker || "");
   const environmentPrefix = String(input.cli?.environmentPrefix || command.toUpperCase().replace(/-/gu, "_"));
   const patPrefix = String(input.auth?.patPrefix || "");
+  const tenantPrefix = input.auth?.tenantPrefix == null ? null : String(input.auth.tenantPrefix);
+  const defaultTenantID = validateTenantID(input.tenant?.defaultId);
   if (!SAFE_ID.test(productID)) throw new Error("gateway CLI product.id is invalid");
   if (!SAFE_ID.test(command)) throw new Error("gateway CLI command is invalid");
   if (!SAFE_NAMESPACE.test(configNamespace)) throw new Error("gateway CLI configNamespace is invalid");
@@ -47,13 +59,16 @@ function validateBrand(input) {
   if (!SAFE_NAMESPACE.test(managedMarker)) throw new Error("gateway CLI managedMarker is invalid");
   if (!SAFE_ENVIRONMENT_PREFIX.test(environmentPrefix)) throw new Error("gateway CLI environmentPrefix is invalid");
   if (!SAFE_PREFIX.test(patPrefix)) throw new Error("gateway CLI PAT prefix is invalid");
+  if (tenantPrefix != null && !SAFE_PREFIX.test(tenantPrefix)) throw new Error("gateway CLI tenant prefix is invalid");
+  if (defaultTenantID && !tenantPrefix) throw new Error("gateway CLI tenant prefix is required when tenant.defaultId is set");
 
   const defaultOrigin = input.gateway?.defaultOrigin == null ? null : normalizeGatewayUrl(input.gateway.defaultOrigin);
   return Object.freeze({
     schemaVersion: 1,
     product: Object.freeze({ id: productID, displayName: validateText("product.displayName", input.product?.displayName) }),
     cli: Object.freeze({ command, configNamespace, providerId: providerID, managedMarker, environmentPrefix }),
-    auth: Object.freeze({ patPrefix }),
+    auth: Object.freeze({ patPrefix, tenantPrefix }),
+    tenant: Object.freeze({ defaultId: defaultTenantID }),
     gateway: Object.freeze({
       defaultOrigin,
       healthPath: validateRoute("healthPath", input.gateway?.healthPath),
@@ -183,9 +198,21 @@ export function createGatewayCli(options) {
     return `${secret.slice(0, brand.auth.patPrefix.length + 4)}...${secret.slice(-4)}`;
   }
 
+  function bearerCredential(pat) {
+    if (!brand.tenant.defaultId) return pat;
+    const encodedTenant = Buffer.from(brand.tenant.defaultId, "utf8").toString("base64url");
+    return `${brand.auth.tenantPrefix}${encodedTenant}.${pat}`;
+  }
+
   function redactSecretText(value) {
     const escapedPrefix = brand.auth.patPrefix.replace(/[.*+?^${}()|[\]\\]/gu, "\\$&");
-    const tokenPattern = new RegExp(`${escapedPrefix}[A-Za-z0-9_-]+(?:\\.[A-Za-z0-9_-]+)?`, "gu");
+    const escapedTenantPrefix = brand.auth.tenantPrefix?.replace(/[.*+?^${}()|[\]\\]/gu, "\\$&");
+    const tokenPattern = new RegExp(
+      escapedTenantPrefix
+        ? `(?:${escapedTenantPrefix}[A-Za-z0-9_-]+\\.)?${escapedPrefix}[A-Za-z0-9_-]+(?:\\.[A-Za-z0-9_-]+)?`
+        : `${escapedPrefix}[A-Za-z0-9_-]+(?:\\.[A-Za-z0-9_-]+)?`,
+      "gu",
+    );
     return String(value ?? "")
       .replace(tokenPattern, "[REDACTED GATEWAY CREDENTIAL]")
       .replace(ANSI_ESCAPE_RE, "")
@@ -244,7 +271,7 @@ export function createGatewayCli(options) {
     if (!health.ok) throw new Error(`gateway health returned HTTP ${health.status}`);
     const models = await fetch(gatewayRoutes.models(gatewayUrl), {
       ...requestOptions,
-      headers: { authorization: `Bearer ${pat}` },
+      headers: { authorization: `Bearer ${bearerCredential(pat)}` },
     });
     if (!models.ok) throw new Error(`gateway authentication returned HTTP ${models.status}`);
     const body = await models.json();
@@ -353,6 +380,7 @@ export function createGatewayCli(options) {
     const config = loadConfig();
     if (!config?.pat || !config?.gatewayUrl) throw new Error(`not configured; run \`${brand.cli.command} setup\``);
     print(`Gateway: ${config.gatewayUrl}`);
+    if (brand.tenant.defaultId) print(`Tenant:  ${brand.tenant.defaultId}`);
     print(`PAT:     ${maskSecret(config.pat)}`);
     print(`Profiles: ${profileRoot}`);
     try {
@@ -367,7 +395,7 @@ export function createGatewayCli(options) {
   async function cmdToken() {
     const config = loadConfig();
     if (!config?.pat) throw new Error(`not authenticated; run \`${brand.cli.command} setup\` or \`${brand.cli.command} auth\``);
-    output.write(`${config.pat}\n`);
+    output.write(`${bearerCredential(config.pat)}\n`);
     return 0;
   }
 
@@ -408,7 +436,7 @@ export function createGatewayCli(options) {
       const profile = ensureClaudeProfile(config.gatewayUrl);
       childEnvironment.CLAUDE_CONFIG_DIR = profile.configDir;
       childEnvironment.ANTHROPIC_BASE_URL = gatewayRoutes.anthropic(config.gatewayUrl);
-      childEnvironment.ANTHROPIC_AUTH_TOKEN = config.pat;
+      childEnvironment.ANTHROPIC_AUTH_TOKEN = bearerCredential(config.pat);
     } else if (tool === "codex") {
       const profile = ensureCodexProfile(config.gatewayUrl);
       childEnvironment.CODEX_HOME = profile.codexHome;