ninepm 0.59.0 → 0.61.0

package/README.md

@@ -23,6 +23,8 @@ Authenticate in your own browser. The CLI stores the token in native protected s
 
 For CI, set `NINEPM_API_KEY` yourself in the CI secret store. `--token` and `NINEPM_API_KEY` still override the stored login token.
 
+A key for CI or a server is minted from a signed-in machine with `9pm api-key create --name <name>`; the token is printed once. `9pm api-key ls` lists your active keys and `9pm api-key revoke <key-id>` retires one. Each account holds at most 10 such keys at a time (login tokens do not count). Store the key under any name but `NINEPM_*` when it lives in a 9pm app's own environment, and pass it with `--token`.
+
 ## Inventory
 
 List the apps you have on 9pm.ai before deploying or modifying:

package/dist/index.d.ts

@@ -116,7 +116,7 @@ export interface CreatedServiceToken {
     clientSecret: string;
 }
 export type FetchLike = (input: string | URL | Request, init?: RequestInit) => Promise<Response>;
-export declare const CLI_VERSION = "0.59.0";
+export declare const CLI_VERSION = "0.61.0";
 type CredentialBackend = "macos-keychain" | "windows-dpapi" | "linux-secret-service" | "file-plaintext" | "none";
 export interface StoredCredentialEntry {
     token: string;
@@ -396,6 +396,7 @@ export interface DeviceAuthProgressReporter {
 export declare function createDeviceAuthProgressReporter(stream?: NodeJS.WriteStream): DeviceAuthProgressReporter;
 export declare function noteCliOutdatedAdvisory(response: Response, log?: (line: string) => void): void;
 export declare function resetCliOutdatedAdvisoryForTests(): void;
+export declare function dashboardUrlForApiUrl(apiUrl: string): string;
 type CliCommand = {
     kind: "deploy";
     options: DeployOptions;
@@ -453,6 +454,21 @@ type CliCommand = {
     site?: string;
     apiUrl: string;
     token: string;
+} | {
+    kind: "api-key";
+    action: {
+        kind: "create";
+        name?: string;
+        json: boolean;
+    } | {
+        kind: "ls";
+        json: boolean;
+    } | {
+        kind: "revoke";
+        keyId: string;
+    };
+    apiUrl: string;
+    token: string;
 } | {
     kind: "files";
     action: {

package/dist/index.js

@@ -15,7 +15,7 @@ import { managedHostnamesIn, siblingCallWarning, siblingsOf } from "./sibling-ho
 import { MAX_STATIC_ASSET_FILE_BYTES, MAX_WORKER_ENTRY_COMPRESSED_BYTES, MAX_WORKER_SCRIPT_COMPRESSED_BYTES, WORKER_ENTRY_COMPRESSED_WARN_BYTES, assetFileTooLargeMessage, formatMebibytes, formatMegabytes, oversizedAssets, workerBundleNearLimitMessage, workerBundleTooLargeMessage, workerEntryNearLimitMessage, workerEntryTooLargeMessage, } from "./deploy-limits.js";
 import { buildFileManifest, readManifestFile } from "./manifest.js";
 import { API_KEY_HELP, API_URL_HELP, CLI_CLIENT_ID, DEFAULT_API_URL, reportCliError } from "./cli-config.js";
-export const CLI_VERSION = "0.59.0";
+export const CLI_VERSION = "0.61.0";
 const PUBLIC_DASHBOARD_URL = "https://9pm.ai/dashboard";
 const TOKEN_SERVICE = "9pm";
 const TOKEN_ACCOUNT = "default";
@@ -2178,6 +2178,22 @@ function withFetchDiagnostics(fetchFn) {
 function normalizeApiUrl(value) {
     return value.replace(/\/+$/g, "");
 }
+// The dashboard that manages what this CLI just deployed lives on the same
+// control plane as the API it talked to: api-<env>.9pm.ai is served beside
+// <env>.9pm.ai, and api.9pm.ai beside the public site. An origin outside that
+// shape (local dev, an unparseable URL) names production, the only dashboard a
+// tester could hold an account on.
+export function dashboardUrlForApiUrl(apiUrl) {
+    let host;
+    try {
+        host = new URL(normalizeApiUrl(apiUrl)).hostname.toLowerCase();
+    }
+    catch {
+        return PUBLIC_DASHBOARD_URL;
+    }
+    const environment = /^api-([a-z0-9-]+)\.9pm\.ai$/.exec(host);
+    return environment ? `https://${environment[1]}.9pm.ai/dashboard` : PUBLIC_DASHBOARD_URL;
+}
 function pathFromUpload(upload, deploymentId) {
     const marker = `/v1/uploads/${encodeURIComponent(deploymentId)}/`;
     const index = upload.path.indexOf(marker);
@@ -2291,6 +2307,9 @@ export function parseArgs(argv) {
     if (command === "support") {
         return parseSupportArgs(argv.slice(1));
     }
+    if (command === "api-key" || command === "api-keys") {
+        return parseApiKeyArgs(argv.slice(1));
+    }
     if (command !== "deploy") {
         throw new Error(`Unknown command: ${command}`);
     }
@@ -2975,6 +2994,30 @@ function readBaseApiOptions(flags) {
 function readApiToken(flags) {
     return readStringFlag(flags, "token") ?? process.env.NINEPM_API_KEY ?? readStoredCredential();
 }
+function parseApiKeyArgs(argv) {
+    const subcommand = argv[0];
+    if (!subcommand || subcommand === "help" || subcommand === "--help") {
+        throw new UsageError();
+    }
+    const flags = parseFlags(argv);
+    const base = readBaseApiOptions(flags);
+    const json = flags.has("json");
+    if (subcommand === "create") {
+        const name = readStringFlag(flags, "name");
+        return { kind: "api-key", ...base, action: { kind: "create", ...(name ? { name } : {}), json } };
+    }
+    if (subcommand === "ls" || subcommand === "list") {
+        return { kind: "api-key", ...base, action: { kind: "ls", json } };
+    }
+    if (subcommand === "revoke") {
+        const keyId = argv[1];
+        if (!keyId || keyId.startsWith("--")) {
+            throw new Error("Usage: 9pm api-key revoke <key-id>");
+        }
+        return { kind: "api-key", ...base, action: { kind: "revoke", keyId } };
+    }
+    throw new Error(`Unknown api-key subcommand: ${subcommand}`);
+}
 function parseSupportArgs(argv) {
     // Normalize the -m short flag so parseFlags (which only handles --flags) sees it.
     const normalized = argv.map((arg) => (arg === "-m" ? "--message" : arg));
@@ -3999,7 +4042,7 @@ async function main() {
             if (queued) {
                 console.log(`Status: ${result.deployment.status}. Run 9pm apps to check when it becomes active.`);
             }
-            console.log(`Manage: ${PUBLIC_DASHBOARD_URL}${command.options.owner ? `?owner=${encodeURIComponent(command.options.owner)}` : ""}`);
+            console.log(`Manage: ${dashboardUrlForApiUrl(command.options.apiUrl)}${command.options.owner ? `?owner=${encodeURIComponent(command.options.owner)}` : ""}`);
             // Gated the same way as the reachability probe above: a programmatic
             // caller injecting fetchFn opted out of the CLI's own network side trips.
             if (!command.options.fetchFn) {
@@ -4234,6 +4277,10 @@ async function main() {
             await runSupportCommand(command);
             return;
         }
+        if (command.kind === "api-key") {
+            await runApiKeyCommand(command);
+            return;
+        }
         await runAccessCommand(command);
     }
     catch (error) {
@@ -4246,6 +4293,42 @@ async function main() {
         process.exitCode = 1;
     }
 }
+async function runApiKeyCommand(command) {
+    const base = { apiUrl: command.apiUrl, token: command.token };
+    const action = command.action;
+    if (action.kind === "create") {
+        const result = await apiRequest(base, "/v1/me/api-keys", {
+            method: "POST",
+            body: JSON.stringify(action.name ? { name: action.name } : {}),
+        });
+        if (action.json) {
+            console.log(JSON.stringify({ apiKey: result.apiKey, token: result.token }));
+            return;
+        }
+        console.log(`Created API key ${result.apiKey.id} (${result.apiKey.name}). The token is shown once:`);
+        console.log(result.token);
+        console.log("Store it in your CI or server secret store under any name but NINEPM_*, and pass it as --token or NINEPM_API_KEY.");
+        return;
+    }
+    if (action.kind === "ls") {
+        const result = await apiRequest(base, "/v1/me/api-keys", { method: "GET" });
+        const live = result.apiKeys.filter((key) => !key.revokedAt);
+        if (action.json) {
+            console.log(JSON.stringify({ apiKeys: live }));
+            return;
+        }
+        if (live.length === 0) {
+            console.log("No active API keys.");
+            return;
+        }
+        for (const key of live) {
+            console.log(`${key.id}\t${key.name}\t${key.prefix}...\tcreated ${key.createdAt.slice(0, 10)}\tlast used ${key.lastUsedAt ? key.lastUsedAt.slice(0, 10) : "never"}`);
+        }
+        return;
+    }
+    const revoked = await apiRequest(base, `/v1/me/api-keys/${encodeURIComponent(action.keyId)}/revoke`, { method: "POST" });
+    console.log(`Revoked API key ${revoked.apiKey.id} (${revoked.apiKey.name}).`);
+}
 async function runSupportCommand(command) {
     const subject = command.subject ?? (command.message.split("\n")[0] ?? command.message).slice(0, 200);
     const body = {
@@ -4487,6 +4570,9 @@ function printUsage() {
   9pm access service revoke <site> <service-token-id>
   9pm access token create <site> [--name <name>]
   9pm access token revoke <site> <token-id>
+  9pm api-key create [--name <name>] [--json]   mint a platform API key for CI or a server; the token is shown once
+  9pm api-key ls [--json]
+  9pm api-key revoke <key-id>
 
 Environment:
   NINEPM_API_URL   ${API_URL_HELP}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ninepm",
-  "version": "0.59.0",
+  "version": "0.61.0",
   "description": "CLI for deploying built apps to 9pm.ai.",
   "homepage": "https://9pm.ai",
   "keywords": [