requestshield 0.1.5 → 0.1.6

package/src/cli.mjs

@@ -4,26 +4,34 @@
 import { parseArgs } from "./args.mjs";
 import { ManagementApiClient } from "./api-client.mjs";
 import { SessionStore } from "./session-store.mjs";
+import { OAuthClient } from "./oauth-client.mjs";
 
 import { signin } from "./commands/signin.mjs";
 import { createKeys } from "./commands/keys-create.mjs";
-import { showIntegrationContract } from "./commands/contract.mjs";
+import { renameApp, setAppEnabled } from "./commands/application-mutations.mjs";
+import { rotateSecret, revealSecret, revokeSecret } from "./commands/secret-commands.mjs";
+import { showAuthStatus } from "./commands/auth-status.mjs";
+import { signout } from "./commands/signout.mjs";
 import { listApps } from "./commands/apps-list.mjs";
 import { getApp } from "./commands/apps-get.mjs";
-import { showChallengeVolume } from "./commands/challenge-volume.mjs";
-import { showBilling } from "./commands/billing-get.mjs";
 import { setupAgent } from "./commands/agent-setup.mjs";
 import { checkForUpdate } from "./commands/update-check.mjs";
 
 import packageJson from "../package.json" with { type: "json" };
-import { DEFAULT_MANAGEMENT_API_URL } from "./config.mjs";
+import { getApiUrl, getAuthorizationIssuer, getCommandInvocation, getCommandName, getOAuthConfig } from "./config.mjs";
 
 /**
  * @typedef {{
  *   log: (message: string) => void,
+ *   warn?: (message: string) => void,
  *   api?: ManagementApiClient,
  *   sessions?: SessionStore,
+ *   oauth?: OAuthClient,
+ *   authorizationIssuer?: string,
+ *   openBrowser?: typeof import('./browser-opener.mjs').openBrowser,
+ *   signal?: AbortSignal,
  *   env?: NodeJS.ProcessEnv,
+ *   profile?: import('./config.mjs').Profile,
  *   homeDir?: string,
  *   sourceDir?: string,
  *   executablePath?: string,
@@ -68,19 +76,20 @@ const COMMAND_HANDLERS = {
   "help": {
     requiresApiSession: false,
     handler: (parsed, context) =>
-      context.log(parsed.help),
+      context.log(parsed.help.replace(/^  requestshield /gm, `  ${getCommandInvocation(context.profile)} `)),
   },
 
   "version": {
     requiresApiSession: false,
     handler: (_parsed, context) =>
-      context.log(`requestshield ${packageJson.version}`),
+      context.log(`${getCommandName(context.profile)} ${packageJson.version}`),
   },
 
   "update-check": {
     requiresApiSession: false,
     handler: (_parsed, context) =>
       checkForUpdate({
+        profile: context.profile,
         currentVersion: packageJson.version,
         packageName: packageJson.name,
         log: context.log,
@@ -97,9 +106,15 @@ const COMMAND_HANDLERS = {
   },
 
   "signin": {
-    requiresApiSession: true,
-    handler: (_parsed, context) =>
-      signin(requireApiSession(context)),
+    requiresApiSession: false,
+    handler: (parsed, context) => {
+      const env = context.env ?? process.env;
+      const oauth = context.oauth ?? new OAuthClient({config: getOAuthConfig(context.profile), fetchImpl: context.fetchImpl});
+      const authorizationIssuer = context.authorizationIssuer ?? (context.oauth
+        ? oauth.config.issuer : getAuthorizationIssuer(context.profile, oauth.config.issuer));
+      const sessions = context.sessions ?? new SessionStore({env, homeDir: context.homeDir, oauth, config: oauth.config, profile: context.profile});
+      return signin(parsed, {...context, oauth, sessions, authorizationIssuer});
+    },
   },
 
   "keys-create": {
@@ -108,11 +123,14 @@ const COMMAND_HANDLERS = {
       createKeys(parsed, requireApiSession(context)),
   },
 
-  "contract": {
-    requiresApiSession: true,
-    handler: (_parsed, context) =>
-      showIntegrationContract(requireApiSession(context)),
-  },
+  "keys-rotate": {requiresApiSession: true, handler: (parsed, context) => rotateSecret(parsed, requireApiSession(context))},
+  "keys-reveal": {requiresApiSession: true, handler: (parsed, context) => revealSecret(parsed, requireApiSession(context))},
+  "keys-revoke": {requiresApiSession: true, handler: (parsed, context) => revokeSecret(parsed, requireApiSession(context))},
+  "apps-rename": {requiresApiSession: true, handler: (parsed, context) => renameApp(parsed, requireApiSession(context))},
+  "apps-enable": {requiresApiSession: true, handler: (parsed, context) => setAppEnabled(parsed, requireApiSession(context))},
+  "apps-disable": {requiresApiSession: true, handler: (parsed, context) => setAppEnabled(parsed, requireApiSession(context))},
+  "auth-status": {requiresApiSession: false, handler: (parsed, context) => showAuthStatus(parsed, {...context, sessions: localSessions(context)})},
+  "signout": {requiresApiSession: false, handler: (parsed, context) => signout(parsed, {...context, sessions: localSessions(context)})},
 
   "apps-list": {
     requiresApiSession: true,
@@ -126,19 +144,13 @@ const COMMAND_HANDLERS = {
       getApp(parsed, requireApiSession(context)),
   },
 
-  "challenge-volume": {
-    requiresApiSession: true,
-    handler: (parsed, context) =>
-      showChallengeVolume(parsed, requireApiSession(context)),
-  },
-
-  "billing-get": {
-    requiresApiSession: true,
-    handler: (parsed, context) =>
-      showBilling(parsed, requireApiSession(context)),
-  },
 };
 
+/** @param {CommandContext} context */
+function localSessions(context) {
+  return context.sessions ?? new SessionStore({env: context.env, homeDir: context.homeDir, profile: context.profile});
+}
+
 /**
  * Narrow the shared context before an authenticated handler can use it.
  *
@@ -161,9 +173,15 @@ function requireApiSession(context) {
  * @param {string[]} argv
  * @param {{
  *   log?: (message: string) => void,
+ *   warn?: (message: string) => void,
  *   api?: ManagementApiClient,
  *   sessions?: SessionStore,
+ *   oauth?: OAuthClient,
+ *   authorizationIssuer?: string,
+ *   openBrowser?: typeof import('./browser-opener.mjs').openBrowser,
+ *   signal?: AbortSignal,
  *   env?: NodeJS.ProcessEnv,
+ *   profile?: import('./config.mjs').Profile,
  *   homeDir?: string,
  *   sourceDir?: string,
  *   executablePath?: string,
@@ -182,6 +200,8 @@ function requireApiSession(context) {
  * }} [deps]
  */
 export async function run(argv, deps = {}) {
+  const profile = deps.profile ?? "prod";
+  getCommandName(profile);
   const parsed = parseArgs(argv);
 
   const log =
@@ -205,7 +225,9 @@ export async function run(argv, deps = {}) {
   /** @type {CommandContext} */
   const context = {
     ...deps,
+    profile,
     log,
+    warn: deps.warn ?? ((message) => console.error(message)),
   };
 
   /*
@@ -220,9 +242,8 @@ export async function run(argv, deps = {}) {
     const api =
       deps.api ??
       new ManagementApiClient({
-        baseUrl:
-          env.REQUESTSHIELD_API_URL ??
-          DEFAULT_MANAGEMENT_API_URL,
+        baseUrl: getApiUrl(profile),
+        fetchImpl: deps.fetchImpl,
       });
 
     const sessions =
@@ -230,6 +251,7 @@ export async function run(argv, deps = {}) {
       new SessionStore({
         env,
         homeDir: deps.homeDir,
+        profile,
       });
 
     const authenticatedContext = {

package/src/commands/agent-setup.mjs

@@ -1,15 +1,13 @@
 // @ts-check
 
-import { cp, lstat, mkdir, realpath, rename, rm, writeFile } from "node:fs/promises";
+import { cp, lstat, mkdir, readFile, realpath, rename, rm } from "node:fs/promises";
 import os from "node:os";
 import path from "node:path";
 import { randomUUID } from "node:crypto";
 import { createInterface } from "node:readline/promises";
+import { fileURLToPath } from "node:url";
 import { CliError } from "../errors.mjs";
 import { detectAgents } from "../agent-detector.mjs";
-import { getAsset, isSea } from "node:sea";
-
-const skillAsset = "requestshield-skill.md";
 
 /**
  * @param {{ agent?: "codex" | "claude", force: boolean }} options
@@ -39,39 +37,11 @@ export async function setupAgent(options, deps) {
   const staging = path.join(skillsRoot, `.requestshield-${randomUUID()}.tmp`);
   const backup = `${destination}.${randomUUID()}.backup`;
   try {
-    if (deps.sourceDir) {
-      // Tests and alternate packagers can provide an explicit skill source.
-      await cp(deps.sourceDir, staging, {
-        recursive: true,
-        errorOnExist: true,
-      });
-    } else if (isSea()) {
-      // A single-executable build reads the skill from its embedded assets.
-      await mkdir(staging);
-
-      await writeFile(
-          path.join(staging, "SKILL.md"),
-          Buffer.from(getAsset(skillAsset)),
-      );
-    } else {
-      // Source, npm, and on-disk CJS builds keep the skill beside the program.
-      //
-      // src/main.mjs                 -> ../skills/requestshield
-      // dist/requestshield.cjs      -> ../skills/requestshield
-      // npm link and global npm installs expose a symlink in their bin folder.
-      // Follow it before resolving the adjacent packaged skills directory.
-      const executable = await realpath(deps.executablePath ?? process.argv[1]);
-      const executableDir = path.dirname(executable);
-      const source = path.resolve(
-          executableDir,
-          "../skills/requestshield",
-      );
-
-      await cp(source, staging, {
-        recursive: true,
-        errorOnExist: true,
-      });
-    }
+    const source = deps.sourceDir ?? await resolveSkillSource(deps.executablePath);
+    await cp(source, staging, {
+      recursive: true,
+      errorOnExist: true,
+    });
 
     // Keep the old installation recoverable until the staged copy is in place.
     if (exists) await rename(destination, backup);
@@ -90,6 +60,33 @@ export async function setupAgent(options, deps) {
   deps.log(`Restart ${agentLabel} or start a new task before using the skill.`);
 }
 
+/** @param {string} [executablePath] */
+async function resolveSkillSource(executablePath) {
+  // Resolve from this module, not the user's cwd or the shell's argv. Following
+  // the executable also supports explicitly supplied npm-link test fixtures.
+  const executable = await realpath(
+    executablePath ?? fileURLToPath(new URL("../main.mjs", import.meta.url)),
+  );
+  const packageRoot = path.resolve(path.dirname(executable), "..");
+  const bundled = path.join(packageRoot, "skills", "requestshield");
+  if (await pathExists(path.join(bundled, "SKILL.md"))) return bundled;
+
+  // Only a source checkout has both the private runner manifest and packaging
+  // script. Installed packages must never pick up an unrelated sibling skill.
+  const devManifestPath = path.join(packageRoot, "dev", "package.json");
+  if (await pathExists(devManifestPath)
+    && await pathExists(path.join(packageRoot, "scripts", "package-skill.mjs"))) {
+    const devManifest = JSON.parse(await readFile(devManifestPath, "utf8"));
+    const canonical = path.resolve(packageRoot, "../skills/requestshield");
+    if (devManifest.private === true
+      && devManifest.name === "@intellifend/requestshield-dev"
+      && await pathExists(path.join(canonical, "SKILL.md"))) return canonical;
+  }
+  throw new CliError("The RequestShield skill is missing. Restore this source checkout or reinstall the published package.", {
+    code: "SKILL_SOURCE_MISSING",
+  });
+}
+
 /**
  * Explicit selection bypasses detection. Automatic setup selects a single
  * detected agent or asks the user when both agents are present.

package/src/commands/application-mutations.mjs

@@ -0,0 +1,33 @@
+// @ts-check
+import { parseApplicationResponse } from "./application-response.mjs";
+import { confirmAction, mutationKey, parseAccepted, printAccepted, validateHttpStatus, withMutationRecovery } from "./mutation-support.mjs";
+
+/** @typedef {import('./mutation-support.mjs').MutationResponse} MutationResponse */
+/** @typedef {import('./mutation-support.mjs').CommandOutput & {sessions: {loadToken(): Promise<string>}}} Dependencies */
+
+/** @param {{appKey: string, name: string, yes?: boolean, idempotencyKey?: string}} options
+ * @param {Dependencies & {api: {renameApp(token: string, appKey: string, options: {name: string, idempotencyKey: string}): Promise<MutationResponse>}}} deps
+ */
+export async function renameApp(options, deps) {
+  const idempotencyKey = mutationKey(options.idempotencyKey);
+  const token = await deps.sessions.loadToken();
+  const application = await withMutationRecovery(idempotencyKey, deps, async () => {
+    const result = await deps.api.renameApp(token, options.appKey, {name: options.name, idempotencyKey});
+    validateHttpStatus(result, 200);
+    return parseApplicationResponse(result.body, options.appKey);
+  });
+  deps.log(JSON.stringify({data: application}, null, 2));
+}
+
+/** @param {{appKey: string, enabled: boolean, yes?: boolean, idempotencyKey?: string}} options
+ * @param {Dependencies & {api: {setAppEnabled(token: string, appKey: string, options: {enabled: boolean, idempotencyKey: string}): Promise<MutationResponse>}}} deps
+ */
+export async function setAppEnabled(options, deps) {
+  if (!options.enabled) await confirmAction(options, deps, `Disable application ${options.appKey}?`, "DISABLE");
+  const idempotencyKey = mutationKey(options.idempotencyKey);
+  const token = await deps.sessions.loadToken();
+  await withMutationRecovery(idempotencyKey, deps, async () => {
+    parseAccepted(await deps.api.setAppEnabled(token, options.appKey, {enabled: options.enabled, idempotencyKey}));
+  });
+  printAccepted(options.enabled ? "Application enable" : "Application disable", options.appKey, deps);
+}

package/src/commands/application-response.mjs

@@ -0,0 +1,55 @@
+// @ts-check
+import { CliError } from "../errors.mjs";
+
+export const APPLICATION_STATUSES = new Set(["attention_required", "pending", "disabled", "revoked", "enabled"]);
+
+/** @typedef {{appKey: string, name: string, status: string, createdAt: string, updatedAt: string}} Application */
+
+/** Construct metadata from the implemented API schema; never relay extra fields.
+ * @param {unknown} value @param {string} [requestedAppKey] @returns {Application}
+ */
+export function parseApplication(value, requestedAppKey) {
+  const data = responseObject(value);
+  const {appKey, name, status, createdAt, updatedAt} = data;
+  if (typeof appKey !== "string" || !/^[A-Za-z0-9._~-]{1,128}$/.test(appKey)) {
+    throw invalidResponse("The application response contained an invalid App Key");
+  }
+  if (requestedAppKey !== undefined && appKey !== requestedAppKey) {
+    throw invalidResponse("The application response did not match the requested App Key");
+  }
+  if (typeof name !== "string" || !name.trim() || [...name].length > 100 || /[\p{Cc}\p{Cs}]/u.test(name)) {
+    throw invalidResponse("The application response contained an invalid name");
+  }
+  if (typeof status !== "string" || !APPLICATION_STATUSES.has(status)) {
+    throw invalidResponse("The application response contained an unsupported status");
+  }
+  if (!isTimestamp(createdAt) || !isTimestamp(updatedAt)) {
+    throw invalidResponse("The application response contained invalid timestamps");
+  }
+  return {appKey, name, status, createdAt, updatedAt};
+}
+
+/** @param {unknown} body @param {string} requestedAppKey */
+export function parseApplicationResponse(body, requestedAppKey) {
+  return parseApplication(responseObject(body).data, requestedAppKey);
+}
+
+/** @param {unknown} value @returns {Record<string, unknown>} */
+export function responseObject(value) {
+  if (!value || typeof value !== "object" || Array.isArray(value)) {
+    throw invalidResponse("The API response did not contain the expected object");
+  }
+  return /** @type {Record<string, unknown>} */ (value);
+}
+
+/** @param {unknown} value @returns {value is string} */
+function isTimestamp(value) {
+  return typeof value === "string"
+    && /^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}(?:\.\d+)?(?:Z|[+-]\d{2}:\d{2})$/.test(value)
+    && Number.isFinite(Date.parse(value));
+}
+
+/** @param {string} message */
+export function invalidResponse(message) {
+  return new CliError(message, {code: "INVALID_RESPONSE"});
+}

package/src/commands/apps-get.mjs

@@ -1,9 +1,6 @@
 // @ts-check
 
-import { CliError } from "../errors.mjs";
-import { objectString } from "../api-client.mjs";
-
-const APPLICATION_STATUSES = new Set(["ready", "active", "deactivated"]);
+import { parseApplicationResponse } from "./application-response.mjs";
 
 /**
  * @param {{ appKey: string }} options
@@ -17,48 +14,7 @@ export async function getApp(options, deps) {
     await deps.api.getApp(accessToken, options.appKey);
   
   const app =
-    parseApp(result.body, options.appKey);
-  
-  deps.log(JSON.stringify({ ok: true, data: app }, null, 2));
-}
-
-/** @param {unknown} body @param {string} requestedAppKey */
-function parseApp(body, requestedAppKey) {
-  const ok = body && typeof body === "object" ?
-    Reflect.get(body, "ok") : undefined;
-  
-  const data = body && typeof body === "object" ?
-    Reflect.get(body, "data") : undefined;
+    parseApplicationResponse(result.body, options.appKey);
   
-  if (ok !== true || !data || typeof data !== "object" || Array.isArray(data)) {
-    throw invalidResponse(
-      "The application response did not contain ok=true and data"
-    );
-  }
-
-  const appKey = objectString(data, "app_key");
-  const appName = objectString(data, "name");
-  const status = objectString(data, "status");
-
-  if (appKey !== requestedAppKey) {
-    throw invalidResponse("The application response did not match the requested App Key");
-  }
-
-  if (!appName) {
-    throw invalidResponse("The application response did not contain name");
-  }
-
-  if (!status || !APPLICATION_STATUSES.has(status)) {
-    throw invalidResponse(
-      "The application response status must be ready, active, or deactivated",
-    );
-  }
-
-  // Construct a new object so unexpected response fields, especially secrets, cannot be printed.
-  return { app_key: appKey, name: appName, status };
-}
-
-/** @param {string} message */
-function invalidResponse(message) {
-  return new CliError(message, { code: "INVALID_RESPONSE" });
+  deps.log(JSON.stringify({ data: app }, null, 2));
 }

package/src/commands/apps-list.mjs

@@ -1,24 +1,45 @@
 // @ts-check
 
 import { CliError } from "../errors.mjs";
-import { objectString } from "../api-client.mjs";
+import { getCommandInvocation } from "../config.mjs";
+import { invalidResponse, parseApplication, responseObject } from "./application-response.mjs";
 
 const HEADERS = ["APP KEY", "NAME", "STATUS"];
+const MAX_PAGES = 100;
 
 /** @typedef {{ appKey: string, name: string, status: string, createdAt: string, updatedAt: string }} App */
 
 /**
- * @param {{ json: boolean }} options
- * @param {{ api: { listApps(accessToken: string): Promise<{body: unknown}> }, sessions: { loadToken(): Promise<string> }, log: (message: string) => void }} deps
+ * @param {{json: boolean, limit?: number, cursor?: string, all?: boolean}} options
+ * @param {{api: {listApps(accessToken: string, options: {limit?: number, cursor?: string}): Promise<{body: unknown}>}, sessions: {loadToken(): Promise<string>}, log: (message: string) => void, profile?: import('../config.mjs').Profile}} deps
  */
 export async function listApps(options, deps) {
-  const accessToken =
-    await deps.sessions.loadToken();
-  
-  const result =
-    await deps.api.listApps(accessToken);
-  
-  const { data: apps, nextCursor } = parseApps(result.body);
+  /** @type {App[]} */
+  const apps = [];
+  let cursor = options.cursor;
+  let nextCursor = null;
+  const seen = new Set(cursor ? [cursor] : []);
+  for (let page = 0; page < MAX_PAGES; page++) {
+    // Long traversals can cross token expiry; each page may refresh safely.
+    const accessToken = await deps.sessions.loadToken();
+    const result = await deps.api.listApps(accessToken, {
+      ...(options.limit !== undefined ? {limit: options.limit} : {}),
+      ...(cursor !== undefined ? {cursor} : {}),
+    });
+    const parsed = parseApps(result.body);
+    if (parsed.data.length > (options.limit ?? 50)) throw invalidResponse("The applications response exceeded the requested page size");
+    apps.push(...parsed.data);
+    nextCursor = parsed.nextCursor;
+    if (nextCursor !== null && seen.has(nextCursor)) {
+      throw new CliError("The API repeated an application cursor; pagination stopped without returning partial results", {code: "PAGINATION_STALLED"});
+    }
+    if (!options.all || nextCursor === null) break;
+    seen.add(nextCursor);
+    cursor = nextCursor;
+    if (page === MAX_PAGES - 1) {
+      throw new CliError("Application pagination exceeded 100 pages; use --limit and --cursor to retrieve individual pages", {code: "PAGINATION_LIMIT"});
+    }
+  }
 
   if (options.json) {
     deps.log(JSON.stringify({ data: apps, nextCursor }, null, 2));
@@ -26,20 +47,18 @@ export async function listApps(options, deps) {
   }
 
   if (apps.length === 0) {
-    deps.log("No applications are available to this account.");
-    return;
+    deps.log(nextCursor === null && !options.cursor
+      ? "No applications are available to this account."
+      : "No applications were returned on this page.");
+  } else {
+    for (const line of formatTable(apps)) deps.log(line);
   }
-
-  for (const line of formatTable(apps)) deps.log(line);
+  if (nextCursor !== null) deps.log(`More applications are available. Continue with \`${getCommandInvocation(deps.profile)} apps list --cursor ${nextCursor}\` or use --all.`);
 }
 
 /** @param {unknown} body @returns {{ data: App[], nextCursor: string | null }} */
 function parseApps(body) {
-  const data = body && typeof body === "object" ?
-    Reflect.get(body, "data") : undefined;
-
-  const nextCursor = body && typeof body === "object" ?
-    Reflect.get(body, "nextCursor") : undefined;
+  const {data, nextCursor} = responseObject(body);
 
   if (!Array.isArray(data)) {
     throw new CliError("The applications response did not contain a data array", {
@@ -47,29 +66,14 @@ function parseApps(body) {
     });
   }
 
-  if (nextCursor !== null && (typeof nextCursor !== "string" || nextCursor.length === 0)) {
+  if (nextCursor !== null && (typeof nextCursor !== "string" || !/^[A-Za-z0-9_-]{1,1024}$/.test(nextCursor))) {
     throw new CliError("The applications response contained an invalid nextCursor", {
       code: "INVALID_RESPONSE",
     });
   }
 
   // Rebuild every item from approved metadata so unexpected API fields never reach output.
-  const apps = data.map((entry, index) => {
-    const appKey = objectString(entry, "appKey");
-    const name = objectString(entry, "name");
-    const status = objectString(entry, "status");
-    const createdAt = objectString(entry, "createdAt");
-    const updatedAt = objectString(entry, "updatedAt");
-
-    if (!appKey || !name || !status || !createdAt || !updatedAt) {
-      throw new CliError(
-        `Application at position ${index + 1} is missing appKey, name, status, createdAt, or updatedAt`,
-        { code: "INVALID_RESPONSE" },
-      );
-    }
-
-    return { appKey, name, status, createdAt, updatedAt };
-  });
+  const apps = data.map(entry => parseApplication(entry));
 
   return { data: apps, nextCursor };
 }

package/src/commands/auth-status.mjs

@@ -0,0 +1,37 @@
+// @ts-check
+
+/** @param {{json?: boolean}} options
+ * @param {{sessions: {status(): Promise<import('../session-store.mjs').SessionStatus>}, log: (message: string) => void}} deps
+ */
+export async function showAuthStatus({ json = false }, deps) {
+  const status = await deps.sessions.status();
+  // Rebuild the output so future storage fields can never expose credentials.
+  const result = {
+    profile: status.profile, apiUrl: status.apiUrl, issuer: status.issuer,
+    clientId: status.clientId, state: status.state, localOnly: true,
+    ...(["valid", "expired", "refresh_uncertain"].includes(status.state) ? {
+      expiresAt: status.expiresAt, scopes: status.scopes ? [...status.scopes] : [],
+    } : {}),
+  };
+  if (json) {
+    deps.log(JSON.stringify(result, null, 2));
+    return;
+  }
+  const descriptions = {
+    signed_out: "signed out",
+    valid: "locally valid",
+    expired: "access token expired; the next authenticated command will attempt refresh",
+    refresh_uncertain: "refresh outcome uncertain; sign in again",
+    config_mismatch: "saved session belongs to different configuration; sign in again",
+    invalid: "saved session is invalid; sign in again",
+    configuration_error: "selected profile configuration is incomplete or invalid",
+  };
+  deps.log(`Profile: ${result.profile}`);
+  deps.log(`Session (local): ${descriptions[result.state]}`);
+  deps.log(`API: ${result.apiUrl ?? "not configured"}`);
+  deps.log(`OAuth issuer: ${result.issuer ?? "not configured"}`);
+  deps.log(`OAuth client: ${result.clientId ?? "not configured"}`);
+  if (result.expiresAt !== undefined) deps.log(`Access token expires at: ${new Date(result.expiresAt).toUTCString()}`);
+  if (result.scopes) deps.log(`Granted scopes: ${result.scopes.join(" ")}`);
+  deps.log("This is local status; provider validity was not checked.");
+}

package/src/commands/keys-create.mjs

@@ -1,46 +1,15 @@
 // @ts-check
 
-import readline from "node:readline/promises";
-import { stdin, stdout } from "node:process";
-import { CliError } from "../errors.mjs";
-import { objectString } from "../api-client.mjs";
+import { mutationKey, parseIssuance, printIssuance, withMutationRecovery } from "./mutation-support.mjs";
 
 /**
- * @param {{ yes: boolean }} options
- * @param {{ api: { rotateKeys(accessToken: string): Promise<{body: unknown}> }, sessions: { loadToken(): Promise<string> }, log: (message: string) => void, confirm?: () => Promise<boolean> }} deps
+ * @param {{appName: string, yes?: boolean, idempotencyKey?: string}} options
+ * @param {import('./mutation-support.mjs').CommandOutput & {api: {createApp(token: string, options: {name: string, idempotencyKey: string}): Promise<import('./mutation-support.mjs').MutationResponse>}, sessions: {loadToken(): Promise<string>}}} deps
  */
 export async function createKeys(options, deps) {
-  if (!options.yes) {
-    const accepted = await (deps.confirm ?? confirmRotation)();
-    if (!accepted) throw new CliError("Key rotation cancelled", { code: "CANCELLED", exitCode: 2 });
-  }
+  const idempotencyKey = mutationKey(options.idempotencyKey);
   const token = await deps.sessions.loadToken();
-  const result = await deps.api.rotateKeys(token);
-  const appKey = objectString(result.body, "appKey");
-  const apiSecret = objectString(result.body, "apiSecret");
-  if (!appKey || !apiSecret) {
-    throw new CliError("The key rotation response did not contain appKey and apiSecret", {
-      code: "INVALID_RESPONSE",
-    });
-  }
-  deps.log("New RequestShield keys are active. Previous keys are deactivated.");
-  deps.log(`App Key: ${appKey}`);
-  deps.log(`Secret Key (shown once): ${apiSecret}`);
-  deps.log("Store the Secret Key in your backend secret manager now. The CLI did not save it.");
-}
-
-async function confirmRotation() {
-  if (!stdin.isTTY || !stdout.isTTY) {
-    throw new CliError("Refusing non-interactive key rotation without --yes", {
-      code: "CONFIRMATION_REQUIRED",
-      exitCode: 2,
-    });
-  }
-  const prompt = readline.createInterface({ input: stdin, output: stdout });
-  try {
-    const answer = await prompt.question("This deactivates the current keys. Type ROTATE to continue: ");
-    return answer === "ROTATE";
-  } finally {
-    prompt.close();
-  }
+  const issuance = await withMutationRecovery(idempotencyKey, deps, async () =>
+    parseIssuance(await deps.api.createApp(token, {name: options.appName, idempotencyKey}), 201));
+  printIssuance(issuance, deps);
 }