ninepm 0.58.0 → 0.60.0

package/README.md

@@ -23,6 +23,8 @@ Authenticate in your own browser. The CLI stores the token in native protected s
 
 For CI, set `NINEPM_API_KEY` yourself in the CI secret store. `--token` and `NINEPM_API_KEY` still override the stored login token.
 
+A key for CI or a server is minted from a signed-in machine with `9pm api-key create --name <name>`; the token is printed once. `9pm api-key ls` lists your active keys and `9pm api-key revoke <key-id>` retires one. Each account holds at most 10 such keys at a time (login tokens do not count). Store the key under any name but `NINEPM_*` when it lives in a 9pm app's own environment, and pass it with `--token`.
+
 ## Inventory
 
 List the apps you have on 9pm.ai before deploying or modifying:

package/dist/index.d.ts

@@ -116,7 +116,7 @@ export interface CreatedServiceToken {
     clientSecret: string;
 }
 export type FetchLike = (input: string | URL | Request, init?: RequestInit) => Promise<Response>;
-export declare const CLI_VERSION = "0.58.0";
+export declare const CLI_VERSION = "0.60.0";
 type CredentialBackend = "macos-keychain" | "windows-dpapi" | "linux-secret-service" | "file-plaintext" | "none";
 export interface StoredCredentialEntry {
     token: string;
@@ -453,6 +453,21 @@ type CliCommand = {
     site?: string;
     apiUrl: string;
     token: string;
+} | {
+    kind: "api-key";
+    action: {
+        kind: "create";
+        name?: string;
+        json: boolean;
+    } | {
+        kind: "ls";
+        json: boolean;
+    } | {
+        kind: "revoke";
+        keyId: string;
+    };
+    apiUrl: string;
+    token: string;
 } | {
     kind: "files";
     action: {

package/dist/index.js

@@ -15,7 +15,7 @@ import { managedHostnamesIn, siblingCallWarning, siblingsOf } from "./sibling-ho
 import { MAX_STATIC_ASSET_FILE_BYTES, MAX_WORKER_ENTRY_COMPRESSED_BYTES, MAX_WORKER_SCRIPT_COMPRESSED_BYTES, WORKER_ENTRY_COMPRESSED_WARN_BYTES, assetFileTooLargeMessage, formatMebibytes, formatMegabytes, oversizedAssets, workerBundleNearLimitMessage, workerBundleTooLargeMessage, workerEntryNearLimitMessage, workerEntryTooLargeMessage, } from "./deploy-limits.js";
 import { buildFileManifest, readManifestFile } from "./manifest.js";
 import { API_KEY_HELP, API_URL_HELP, CLI_CLIENT_ID, DEFAULT_API_URL, reportCliError } from "./cli-config.js";
-export const CLI_VERSION = "0.58.0";
+export const CLI_VERSION = "0.60.0";
 const PUBLIC_DASHBOARD_URL = "https://9pm.ai/dashboard";
 const TOKEN_SERVICE = "9pm";
 const TOKEN_ACCOUNT = "default";
@@ -903,15 +903,21 @@ function revocationFailureReason(error) {
     }
     return error instanceof Error ? error.message : String(error);
 }
-// The ONLY refusal that proves anything about the stored credential:
-// requireAuth emits invalid_api_key after looking the presented token up
-// (src/server/routes/guards.ts). Its siblings do not — missing_api_key means no
-// credential arrived at all and malformed_api_key means the header was not a
-// bearer token, both of which a proxy that strips or rewrites Authorization
-// produces for a perfectly live key. Anything else answering 401/403 is an
-// intermediary rather than the control plane judging this credential.
+// The refusals that prove something about the stored credential: requireAuth emits
+// both AFTER looking the presented token up (src/server/routes/guards.ts), so each
+// is the control plane judging this credential. Their siblings do not — missing_api_key
+// means no credential arrived at all and malformed_api_key means the header was not a
+// bearer token, both of which a proxy that strips or rewrites Authorization produces
+// for a perfectly live key. Anything else answering 401/403 is an intermediary rather
+// than the control plane judging this credential.
+//
+// A set rather than a comparison because the list is now open: a key refused for
+// inactivity (#854) is as dead to its holder as a revoked one, and a refusal this
+// function does not recognise turns a clean `9pm logout` into a reported failure
+// blaming an intermediary that was never involved.
+const CREDENTIAL_REFUSAL_CODES = new Set(["invalid_api_key", "expired_api_key"]);
 async function isAuthRefusal(response) {
-    return (await responseErrorCode(response)) === "invalid_api_key";
+    return CREDENTIAL_REFUSAL_CODES.has(await responseErrorCode(response));
 }
 // The `code` from the control plane's {error:{code}} envelope, or "" when the
 // body is not that shape (proxy error page, empty body).
@@ -2285,6 +2291,9 @@ export function parseArgs(argv) {
     if (command === "support") {
         return parseSupportArgs(argv.slice(1));
     }
+    if (command === "api-key" || command === "api-keys") {
+        return parseApiKeyArgs(argv.slice(1));
+    }
     if (command !== "deploy") {
         throw new Error(`Unknown command: ${command}`);
     }
@@ -2969,6 +2978,30 @@ function readBaseApiOptions(flags) {
 function readApiToken(flags) {
     return readStringFlag(flags, "token") ?? process.env.NINEPM_API_KEY ?? readStoredCredential();
 }
+function parseApiKeyArgs(argv) {
+    const subcommand = argv[0];
+    if (!subcommand || subcommand === "help" || subcommand === "--help") {
+        throw new UsageError();
+    }
+    const flags = parseFlags(argv);
+    const base = readBaseApiOptions(flags);
+    const json = flags.has("json");
+    if (subcommand === "create") {
+        const name = readStringFlag(flags, "name");
+        return { kind: "api-key", ...base, action: { kind: "create", ...(name ? { name } : {}), json } };
+    }
+    if (subcommand === "ls" || subcommand === "list") {
+        return { kind: "api-key", ...base, action: { kind: "ls", json } };
+    }
+    if (subcommand === "revoke") {
+        const keyId = argv[1];
+        if (!keyId || keyId.startsWith("--")) {
+            throw new Error("Usage: 9pm api-key revoke <key-id>");
+        }
+        return { kind: "api-key", ...base, action: { kind: "revoke", keyId } };
+    }
+    throw new Error(`Unknown api-key subcommand: ${subcommand}`);
+}
 function parseSupportArgs(argv) {
     // Normalize the -m short flag so parseFlags (which only handles --flags) sees it.
     const normalized = argv.map((arg) => (arg === "-m" ? "--message" : arg));
@@ -4228,6 +4261,10 @@ async function main() {
             await runSupportCommand(command);
             return;
         }
+        if (command.kind === "api-key") {
+            await runApiKeyCommand(command);
+            return;
+        }
         await runAccessCommand(command);
     }
     catch (error) {
@@ -4240,6 +4277,42 @@ async function main() {
         process.exitCode = 1;
     }
 }
+async function runApiKeyCommand(command) {
+    const base = { apiUrl: command.apiUrl, token: command.token };
+    const action = command.action;
+    if (action.kind === "create") {
+        const result = await apiRequest(base, "/v1/me/api-keys", {
+            method: "POST",
+            body: JSON.stringify(action.name ? { name: action.name } : {}),
+        });
+        if (action.json) {
+            console.log(JSON.stringify({ apiKey: result.apiKey, token: result.token }));
+            return;
+        }
+        console.log(`Created API key ${result.apiKey.id} (${result.apiKey.name}). The token is shown once:`);
+        console.log(result.token);
+        console.log("Store it in your CI or server secret store under any name but NINEPM_*, and pass it as --token or NINEPM_API_KEY.");
+        return;
+    }
+    if (action.kind === "ls") {
+        const result = await apiRequest(base, "/v1/me/api-keys", { method: "GET" });
+        const live = result.apiKeys.filter((key) => !key.revokedAt);
+        if (action.json) {
+            console.log(JSON.stringify({ apiKeys: live }));
+            return;
+        }
+        if (live.length === 0) {
+            console.log("No active API keys.");
+            return;
+        }
+        for (const key of live) {
+            console.log(`${key.id}\t${key.name}\t${key.prefix}...\tcreated ${key.createdAt.slice(0, 10)}\tlast used ${key.lastUsedAt ? key.lastUsedAt.slice(0, 10) : "never"}`);
+        }
+        return;
+    }
+    const revoked = await apiRequest(base, `/v1/me/api-keys/${encodeURIComponent(action.keyId)}/revoke`, { method: "POST" });
+    console.log(`Revoked API key ${revoked.apiKey.id} (${revoked.apiKey.name}).`);
+}
 async function runSupportCommand(command) {
     const subject = command.subject ?? (command.message.split("\n")[0] ?? command.message).slice(0, 200);
     const body = {
@@ -4481,6 +4554,9 @@ function printUsage() {
   9pm access service revoke <site> <service-token-id>
   9pm access token create <site> [--name <name>]
   9pm access token revoke <site> <token-id>
+  9pm api-key create [--name <name>] [--json]   mint a platform API key for CI or a server; the token is shown once
+  9pm api-key ls [--json]
+  9pm api-key revoke <key-id>
 
 Environment:
   NINEPM_API_URL   ${API_URL_HELP}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ninepm",
-  "version": "0.58.0",
+  "version": "0.60.0",
   "description": "CLI for deploying built apps to 9pm.ai.",
   "homepage": "https://9pm.ai",
   "keywords": [