tapimo 0.15.0 → 0.18.0

package/dist/cli/ApiKeys.d.ts

@@ -0,0 +1,120 @@
+import type * as Auth from './commands/auth.js';
+import type * as Credentials from './Credentials.js';
+/** Resolves a private, session-bound API key without replacing explicit credentials. */
+export declare function resolve(context: Auth.Context, options: resolve.Options): Promise<string | import("hono/client").ClientResponse<{
+    error: {
+        code: "api_key_malformed";
+        details?: readonly import("../internal/Response.js").error.Detail[] | undefined;
+        message: string;
+    };
+    requestId: string;
+}, 400, "json"> | import("hono/client").ClientResponse<{
+    error: {
+        code: "api_key_invalid" | "api_key_missing";
+        details?: readonly import("../internal/Response.js").error.Detail[] | undefined;
+        message: string;
+    };
+    requestId: string;
+}, 401, "json"> | import("hono/client").ClientResponse<{
+    error: {
+        code: "api_key_forbidden" | "api_key_ip_forbidden";
+        details?: readonly import("../internal/Response.js").error.Detail[] | undefined;
+        message: string;
+    };
+    requestId: string;
+}, 403, "json"> | import("hono/client").ClientResponse<{
+    error: {
+        code: "payment_required" | "rate_limit_exceeded";
+        details?: readonly import("../internal/Response.js").error.Detail[] | undefined;
+        message: string;
+    };
+    requestId: string;
+}, 429, "json"> | import("hono/client").ClientResponse<{
+    error: {
+        code: "query_invalid";
+        details?: readonly import("../internal/Response.js").error.Detail[] | undefined;
+        message: string;
+    };
+    requestId: string;
+}, 400, "json"> | import("hono/client").ClientResponse<{
+    error: {
+        code: "upstream_error";
+        details?: readonly import("../internal/Response.js").error.Detail[] | undefined;
+        message: string;
+    };
+    requestId: string;
+}, 502, "json"> | import("hono/client").ClientResponse<{
+    error: {
+        code: "body_invalid";
+        details?: readonly import("../internal/Response.js").error.Detail[] | undefined;
+        message: string;
+    };
+    requestId: string;
+}, 400, "json"> | import("hono/client").ClientResponse<{
+    error: {
+        code: "param_invalid";
+        details?: readonly import("../internal/Response.js").error.Detail[] | undefined;
+        message: string;
+    };
+    requestId: string;
+}, 400, "json"> | import("hono/client").ClientResponse<{
+    error: {
+        code: "forbidden";
+        details?: readonly import("../internal/Response.js").error.Detail[] | undefined;
+        message: string;
+    };
+    requestId: string;
+}, 403, "json"> | import("hono/client").ClientResponse<{
+    error: {
+        code: "organization_not_found" | "project_not_found";
+        details?: readonly import("../internal/Response.js").error.Detail[] | undefined;
+        message: string;
+    };
+    requestId: string;
+}, 404, "json"> | import("hono/client").ClientResponse<{
+    error: {
+        code: "api_keys_not_enabled";
+        details?: readonly import("../internal/Response.js").error.Detail[] | undefined;
+        message: string;
+    };
+    requestId: string;
+}, 404, "json"> | import("hono/client").ClientResponse<{
+    error: {
+        code: "scope_not_issuable";
+        details?: readonly import("../internal/Response.js").error.Detail[] | undefined;
+        message: string;
+    };
+    requestId: string;
+}, 403, "json"> | import("hono/client").ClientResponse<{
+    error: {
+        code: "api_key_limit_reached";
+        details?: readonly import("../internal/Response.js").error.Detail[] | undefined;
+        message: string;
+    };
+    requestId: string;
+}, 409, "json"> | import("hono/client").ClientResponse<{
+    error: {
+        code: "user_not_found";
+        details?: readonly import("../internal/Response.js").error.Detail[] | undefined;
+        message: string;
+    };
+    requestId: string;
+}, 404, "json"> | Response | undefined>;
+export declare namespace resolve {
+    /** Context and permissions required by the generated operation. */
+    type Options = {
+        /** API-key environment. Defaults to production. */
+        environment?: 'production' | 'sandbox' | undefined;
+        /** Owning organization; inferred only when unambiguous. */
+        orgId?: string | undefined;
+        /** Attributed project; inferred only when unambiguous. */
+        projectId?: string | undefined;
+        /** Scopes required by the operation. */
+        scopes: readonly string[];
+        /** Approved source key when more than one can delegate the required scopes. */
+        sourceKeyId?: string | undefined;
+    };
+}
+/** Revokes inferred keys before forgetting or replacing a CLI session. */
+export declare function revoke(context: Auth.Context, session: Credentials.Session): Promise<boolean>;
+//# sourceMappingURL=ApiKeys.d.ts.map

package/dist/cli/ApiKeys.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ApiKeys.d.ts","sourceRoot":"","sources":["../../src/cli/ApiKeys.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,KAAK,IAAI,MAAM,oBAAoB,CAAA;AAC/C,OAAO,KAAK,KAAK,WAAW,MAAM,kBAAkB,CAAA;AAIpD,wFAAwF;AACxF,wBAAgB,OAAO,CAAC,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;wCAetE;AAwHD,MAAM,CAAC,OAAO,WAAW,OAAO,CAAC;IAC/B,mEAAmE;IACnE,KAAK,OAAO,GAAG;QACb,mDAAmD;QACnD,WAAW,CAAC,EAAE,YAAY,GAAG,SAAS,GAAG,SAAS,CAAA;QAClD,2DAA2D;QAC3D,KAAK,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;QAC1B,0DAA0D;QAC1D,SAAS,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;QAC9B,wCAAwC;QACxC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAA;QACzB,+EAA+E;QAC/E,WAAW,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;KACjC,CAAA;CACF;AAED,0EAA0E;AAC1E,wBAAsB,MAAM,CAAC,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,OAAO,EAAE,WAAW,CAAC,OAAO,oBAmB/E"}

package/dist/cli/ApiKeys.js

@@ -0,0 +1,138 @@
+import * as Scope from '../Scope.js';
+const resolutions = new WeakMap();
+/** Resolves a private, session-bound API key without replacing explicit credentials. */
+export function resolve(context, options) {
+    const previous = resolutions.get(context) ?? Promise.resolve();
+    const pending = previous
+        .catch(() => undefined)
+        .then(() => context.credentials.withLock
+        ? context.credentials.withLock((credentials) => resolveKey({ ...context, credentials }, options))
+        : resolveKey(context, options));
+    resolutions.set(context, pending);
+    return pending.finally(() => {
+        if (resolutions.get(context) === pending)
+            resolutions.delete(context);
+    });
+}
+async function resolveKey(context, options) {
+    const { api, apiUrl, credentials } = context;
+    const session = await credentials.get(apiUrl);
+    if (!session)
+        return undefined;
+    const approved = session.scopes;
+    if (!approved || !options.scopes.every((scope) => approved.includes(scope)))
+        return failure('scope_not_approved', 'Run login again and enable the required scopes under “Modify auth scopes”.');
+    const request = { headers: { authorization: `Bearer ${session.token}` } };
+    const me = await api.v1.me.$get(undefined, request);
+    if (me.status !== 200)
+        return me;
+    const orgs = await api.v1.orgs.$get(undefined, request);
+    if (orgs.status !== 200)
+        return orgs;
+    const organizations = (await orgs.json()).data;
+    const orgId = options.orgId ?? (organizations.length === 1 ? organizations[0].id : undefined);
+    if (!orgId)
+        return failure('organization_required', `Set TEMPO_API_ORG to one of: ${describe(organizations)}.`);
+    const org = api.v1.orgs[':orgId{org_[A-Za-z0-9_-]+}'];
+    const projects = await org.projects.$get({ param: { orgId } }, request);
+    if (projects.status !== 200)
+        return projects;
+    const choices = (await projects.json()).data;
+    const projectId = options.projectId ?? (choices.length === 1 ? choices[0].id : undefined);
+    if (!projectId)
+        return failure('project_required', `Set TEMPO_API_PROJECT to one of: ${describe(choices)}.`);
+    if (!choices.some(({ id }) => id === projectId))
+        return failure('project_not_found', 'The selected project does not belong to this organization.');
+    const environment = options.environment ?? 'production';
+    const catalog = await api.v1.scopes.$get({}, request);
+    if (catalog.status !== 200)
+        return catalog;
+    const entries = (await catalog.json()).data;
+    const selfServe = entries.filter(({ selfServe }) => selfServe).map(({ scope }) => scope);
+    const scopes = [...new Set(options.scopes)];
+    if (scopes.includes('routes:write') &&
+        !scopes.includes('routes:read') &&
+        approved.includes('routes:read'))
+        scopes.push('routes:read');
+    const project = org.projects[':projectId{prj_[A-Za-z0-9_-]+}'];
+    const restricted = scopes.filter((scope) => !selfServe.includes(scope));
+    const sourceKeyId = await (async () => {
+        if (restricted.length === 0 && !options.sourceKeyId)
+            return undefined;
+        const listed = await project['api-keys'].$get({ param: { orgId, projectId }, query: { environment, include: '' } }, request);
+        if (listed.status !== 200)
+            return listed;
+        // Locally inferred credentials are destinations, not additional provisioned source choices.
+        const inferredIds = new Set(session.apiKeys?.map(({ id }) => id));
+        const sources = (await listed.json()).data.filter((key) => !inferredIds.has(key.id) &&
+            restricted.every((scope) => key.scopes.includes(scope) || key.scopes.includes(Scope.wildcard)));
+        const source = options.sourceKeyId
+            ? sources.find(({ id }) => id === options.sourceKeyId)
+            : sources.length === 1
+                ? sources[0]
+                : undefined;
+        if (!source)
+            return failure('api_key_required', sources.length === 0
+                ? 'This project needs a Tempo-approved key with the required scopes. Set TEMPO_API_KEY to an approved key, or ask Tempo to provision this project.'
+                : `Set TEMPO_API_SOURCE_KEY to one of: ${sources.map(({ id }) => id).join(', ')}.`);
+        return source.id;
+    })();
+    if (sourceKeyId && typeof sourceKeyId !== 'string')
+        return sourceKeyId;
+    // Resolve the live source grant before reusing a key so caching never hides new ambiguity.
+    const cached = session.apiKeys?.find((key) => key.orgId === orgId &&
+        key.projectId === projectId &&
+        key.environment === environment &&
+        (!key.expiresAt || Date.parse(key.expiresAt) > Date.now()) &&
+        (!sourceKeyId || key.sourceKeyId === sourceKeyId) &&
+        options.scopes.every((scope) => key.scopes.includes(scope)));
+    if (cached)
+        return cached.token;
+    const minted = await project['api-keys'].$post({
+        json: { environment, name: 'Tempo CLI', scopes, ...(sourceKeyId ? { sourceKeyId } : {}) },
+        param: { orgId, projectId },
+    }, request);
+    if (minted.status !== 200)
+        return minted;
+    const key = await minted.json();
+    await credentials.set(apiUrl, {
+        ...session,
+        apiKeys: [
+            ...(session.apiKeys ?? []),
+            {
+                environment,
+                ...(key.expiresAt ? { expiresAt: key.expiresAt } : {}),
+                id: key.id,
+                orgId,
+                projectId,
+                scopes: key.scopes,
+                ...(sourceKeyId ? { sourceKeyId } : {}),
+                token: key.token,
+            },
+        ],
+    });
+    return key.token;
+}
+/** Revokes inferred keys before forgetting or replacing a CLI session. */
+export async function revoke(context, session) {
+    const keys = session.apiKeys ?? [];
+    const request = { headers: { authorization: `Bearer ${session.token}` } };
+    const results = await Promise.all(keys.map(async (key) => {
+        const response = await context.api.v1.orgs[':orgId{org_[A-Za-z0-9_-]+}'].projects[':projectId{prj_[A-Za-z0-9_-]+}']['api-keys'][':keyId{key_[A-Za-z0-9_-]+}']
+            .$delete({
+            param: { keyId: key.id, orgId: key.orgId, projectId: key.projectId },
+        }, request)
+            .catch(() => undefined);
+        return response?.status === 200 || response?.status === 404;
+    }));
+    return results.every(Boolean);
+}
+function failure(code, message) {
+    return Response.json({ error: { code, message } }, { status: 403 });
+}
+function describe(choices) {
+    return choices.length
+        ? choices.map(({ id, name }) => `${id} (${name})`).join(', ')
+        : 'none; create one in the Tempo console first';
+}
+//# sourceMappingURL=ApiKeys.js.map

package/dist/cli/ApiKeys.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ApiKeys.js","sourceRoot":"","sources":["../../src/cli/ApiKeys.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,KAAK,MAAM,aAAa,CAAA;AAIpC,MAAM,WAAW,GAAG,IAAI,OAAO,EAAkC,CAAA;AAEjE,wFAAwF;AACxF,MAAM,UAAU,OAAO,CAAC,OAAqB,EAAE,OAAwB;IACrE,MAAM,QAAQ,GAAG,WAAW,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,OAAO,CAAC,OAAO,EAAE,CAAA;IAC9D,MAAM,OAAO,GAAG,QAAQ;SACrB,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC;SACtB,IAAI,CAAC,GAAG,EAAE,CACT,OAAO,CAAC,WAAW,CAAC,QAAQ;QAC1B,CAAC,CAAC,OAAO,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAC,WAAW,EAAE,EAAE,CAC3C,UAAU,CAAC,EAAE,GAAG,OAAO,EAAE,WAAW,EAAE,EAAE,OAAO,CAAC,CACjD;QACH,CAAC,CAAC,UAAU,CAAC,OAAO,EAAE,OAAO,CAAC,CACjC,CAAA;IACH,WAAW,CAAC,GAAG,CAAC,OAAO,EAAE,OAAO,CAAC,CAAA;IACjC,OAAO,OAAO,CAAC,OAAO,CAAC,GAAG,EAAE;QAC1B,IAAI,WAAW,CAAC,GAAG,CAAC,OAAO,CAAC,KAAK,OAAO;YAAE,WAAW,CAAC,MAAM,CAAC,OAAO,CAAC,CAAA;IACvE,CAAC,CAAC,CAAA;AACJ,CAAC;AAED,KAAK,UAAU,UAAU,CAAC,OAAqB,EAAE,OAAwB;IACvE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,WAAW,EAAE,GAAG,OAAO,CAAA;IAC5C,MAAM,OAAO,GAAG,MAAM,WAAW,CAAC,GAAG,CAAC,MAAM,CAAC,CAAA;IAC7C,IAAI,CAAC,OAAO;QAAE,OAAO,SAAS,CAAA;IAC9B,MAAM,QAAQ,GAAG,OAAO,CAAC,MAAM,CAAA;IAC/B,IAAI,CAAC,QAAQ,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;QACzE,OAAO,OAAO,CACZ,oBAAoB,EACpB,4EAA4E,CAC7E,CAAA;IACH,MAAM,OAAO,GAAG,EAAE,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,OAAO,CAAC,KAAK,EAAE,EAAE,EAAE,CAAA;IACzE,MAAM,EAAE,GAAG,MAAM,GAAG,CAAC,EAAE,CAAC,EAAE,CAAC,IAAI,CAAC,SAAS,EAAE,OAAO,CAAC,CAAA;IACnD,IAAI,EAAE,CAAC,MAAM,KAAK,GAAG;QAAE,OAAO,EAAE,CAAA;IAChC,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,OAAO,CAAC,CAAA;IACvD,IAAI,IAAI,CAAC,MAAM,KAAK,GAAG;QAAE,OAAO,IAAI,CAAA;IACpC,MAAM,aAAa,GAAG,CAAC,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAA;IAC9C,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,IAAI,CAAC,aAAa,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAE,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAA;IAC9F,IAAI,CAAC,KAAK;QACR,OAAO,OAAO,CACZ,uBAAuB,EACvB,gCAAgC,QAAQ,CAAC,aAAa,CAAC,GAAG,CAC3D,CAAA;IACH,MAAM,GAAG,GAAG,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,4BAA4B,CAAC,CAAA;IACrD,MAAM,QAAQ,GAAG,MAAM,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,OAAO,CAAC,CAAA;IACvE,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG;QAAE,OAAO,QAAQ,CAAA;IAC5C,MAAM,OAAO,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAA;IAC5C,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAE,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAA;IAC1F,IAAI,CAAC,SAAS;QACZ,OAAO,OAAO,CAAC,kBAAkB,EAAE,oCAAoC,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;IAC9F,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC,EAAE,KAAK,SAAS,CAAC;QAC7C,OAAO,OAAO,CACZ,mBAAmB,EACnB,4DAA4D,CAC7D,CAAA;IACH,MAAM,WAAW,GAAG,OAAO,CAAC,WAAW,IAAI,YAAY,CAAA;IACvD,MAAM,OAAO,GAAG,MAAM,GAAG,CAAC,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,EAAE,OAAO,CAAC,CAAA;IACrD,IAAI,OAAO,CAAC,MAAM,KAAK,GAAG;QAAE,OAAO,OAAO,CAAA;IAC1C,MAAM,OAAO,GAAG,CAAC,MAAM,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAA;IAC3C,MAAM,SAAS,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC,SAAS,CAAC,CAAC,GAAG,CAAC,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC,KAAK,CAAC,CAAA;IACxF,MAAM,MAAM,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAA;IAC3C,IACE,MAAM,CAAC,QAAQ,CAAC,cAAc,CAAC;QAC/B,CAAC,MAAM,CAAC,QAAQ,CAAC,aAAa,CAAC;QAC/B,QAAQ,CAAC,QAAQ,CAAC,aAAa,CAAC;QAEhC,MAAM,CAAC,IAAI,CAAC,aAAa,CAAC,CAAA;IAC5B,MAAM,OAAO,GAAG,GAAG,CAAC,QAAQ,CAAC,gCAAgC,CAAC,CAAA;IAC9D,MAAM,UAAU,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,SAAS,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAA;IACvE,MAAM,WAAW,GAAG,MAAM,CAAC,KAAK,IAAI,EAAE;QACpC,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,WAAW;YAAE,OAAO,SAAS,CAAA;QACrE,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,UAAU,CAAC,CAAC,IAAI,CAC3C,EAAE,KAAK,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,EAAE,KAAK,EAAE,EAAE,WAAW,EAAE,OAAO,EAAE,EAAE,EAAE,EAAE,EACpE,OAAO,CACR,CAAA;QACD,IAAI,MAAM,CAAC,MAAM,KAAK,GAAG;YAAE,OAAO,MAAM,CAAA;QACxC,4FAA4F;QAC5F,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,CAAC,CAAA;QACjE,MAAM,OAAO,GAAG,CAAC,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,MAAM,CAC/C,CAAC,GAAG,EAAE,EAAE,CACN,CAAC,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;YACxB,UAAU,CAAC,KAAK,CACd,CAAC,KAAK,EAAE,EAAE,CAAC,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,QAAQ,CAAC,CAC7E,CACJ,CAAA;QACD,MAAM,MAAM,GAAG,OAAO,CAAC,WAAW;YAChC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC,EAAE,KAAK,OAAO,CAAC,WAAW,CAAC;YACtD,CAAC,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC;gBACpB,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;gBACZ,CAAC,CAAC,SAAS,CAAA;QACf,IAAI,CAAC,MAAM;YACT,OAAO,OAAO,CACZ,kBAAkB,EAClB,OAAO,CAAC,MAAM,KAAK,CAAC;gBAClB,CAAC,CAAC,iJAAiJ;gBACnJ,CAAC,CAAC,uCAAuC,OAAO,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CACrF,CAAA;QACH,OAAO,MAAM,CAAC,EAAE,CAAA;IAClB,CAAC,CAAC,EAAE,CAAA;IACJ,IAAI,WAAW,IAAI,OAAO,WAAW,KAAK,QAAQ;QAAE,OAAO,WAAW,CAAA;IACtE,2FAA2F;IAC3F,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,EAAE,IAAI,CAClC,CAAC,GAAG,EAAE,EAAE,CACN,GAAG,CAAC,KAAK,KAAK,KAAK;QACnB,GAAG,CAAC,SAAS,KAAK,SAAS;QAC3B,GAAG,CAAC,WAAW,KAAK,WAAW;QAC/B,CAAC,CAAC,GAAG,CAAC,SAAS,IAAI,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,SAAS,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAC1D,CAAC,CAAC,WAAW,IAAI,GAAG,CAAC,WAAW,KAAK,WAAW,CAAC;QACjD,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAC9D,CAAA;IACD,IAAI,MAAM;QAAE,OAAO,MAAM,CAAC,KAAK,CAAA;IAC/B,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,UAAU,CAAC,CAAC,KAAK,CAC5C;QACE,IAAI,EAAE,EAAE,WAAW,EAAE,IAAI,EAAE,WAAW,EAAE,MAAM,EAAE,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE;QACzF,KAAK,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE;KAC5B,EACD,OAAO,CACR,CAAA;IACD,IAAI,MAAM,CAAC,MAAM,KAAK,GAAG;QAAE,OAAO,MAAM,CAAA;IACxC,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,IAAI,EAAE,CAAA;IAC/B,MAAM,WAAW,CAAC,GAAG,CAAC,MAAM,EAAE;QAC5B,GAAG,OAAO;QACV,OAAO,EAAE;YACP,GAAG,CAAC,OAAO,CAAC,OAAO,IAAI,EAAE,CAAC;YAC1B;gBACE,WAAW;gBACX,GAAG,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,GAAG,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACtD,EAAE,EAAE,GAAG,CAAC,EAAE;gBACV,KAAK;gBACL,SAAS;gBACT,MAAM,EAAE,GAAG,CAAC,MAAM;gBAClB,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACvC,KAAK,EAAE,GAAG,CAAC,KAAK;aACjB;SACF;KACF,CAAC,CAAA;IACF,OAAO,GAAG,CAAC,KAAK,CAAA;AAClB,CAAC;AAkBD,0EAA0E;AAC1E,MAAM,CAAC,KAAK,UAAU,MAAM,CAAC,OAAqB,EAAE,OAA4B;IAC9E,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,IAAI,EAAE,CAAA;IAClC,MAAM,OAAO,GAAG,EAAE,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,OAAO,CAAC,KAAK,EAAE,EAAE,EAAE,CAAA;IACzE,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,GAAG,CAC/B,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE;QACrB,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,4BAA4B,CAAC,CAAC,QAAQ,CAC/E,gCAAgC,CACjC,CAAC,UAAU,CAAC,CAAC,4BAA4B,CAAC;aACxC,OAAO,CACN;YACE,KAAK,EAAE,EAAE,KAAK,EAAE,GAAG,CAAC,EAAE,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,SAAS,EAAE,GAAG,CAAC,SAAS,EAAE;SACrE,EACD,OAAO,CACR;aACA,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAA;QACzB,OAAO,QAAQ,EAAE,MAAM,KAAK,GAAG,IAAI,QAAQ,EAAE,MAAM,KAAK,GAAG,CAAA;IAC7D,CAAC,CAAC,CACH,CAAA;IACD,OAAO,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,CAAA;AAC/B,CAAC;AAED,SAAS,OAAO,CAAC,IAAY,EAAE,OAAe;IAC5C,OAAO,QAAQ,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAA;AACrE,CAAC;AAED,SAAS,QAAQ,CAAC,OAAgD;IAChE,OAAO,OAAO,CAAC,MAAM;QACnB,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,GAAG,EAAE,KAAK,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC;QAC7D,CAAC,CAAC,6CAA6C,CAAA;AACnD,CAAC"}

package/dist/cli/Cli.d.ts

@@ -1,67 +1,125 @@
-import { Cli as incur_Cli, Fetch, type Openapi } from 'incur';
+import { Cli as incur_Cli, type Fetch, Openapi } from 'incur';
 import type { mcp } from '../apps/mcp.js';
+import * as Credentials from './Credentials.js';
 /**
- * Creates an incur CLI backed by a hosted Tempo API, plus the super admin
- * commands (`<cli> admin …`) and the remote Tempo docs tools (`<cli> docs …`).
+ * Creates an incur CLI backed by a hosted Tempo API: generated API commands,
+ * session commands (`login`, `logout`, `whoami`), `keys create`, and the remote
+ * Tempo docs tools (`<cli> docs …`).
  */
 export declare function from(url: string | URL, options?: from.Options): incur_Cli.Cli<{
-    [x: `${string} ${string} ${string}`]: {
+    login: {
         args: {};
         options: {
-            apply: boolean;
-            chainId: number;
-            databaseUrl?: string | undefined;
-            dbSchema?: string | undefined;
-            tidxAuth?: string | undefined;
-            tidxUrl?: string | undefined;
-            vaultAddress: string;
+            browser?: boolean | undefined;
         };
-    } & {
+    };
+} & {
+    logout: {
+        args: {};
+        options: {};
+    };
+} & {
+    whoami: {
+        args: {};
+        options: {};
+    };
+} & {
+    "keys create": {
         args: {};
         options: {
-            apply: boolean;
-            chainId: number;
-            databaseUrl?: string | undefined;
-            dbSchema?: string | undefined;
-            file: string;
-            reference: string;
-            vaultAddress: string;
+            allowedIps?: string[] | undefined;
+            env: "production" | "sandbox";
+            name?: string | undefined;
+            org?: string | undefined;
+            project?: string | undefined;
+            scopes: string[];
         };
-    } & {
+    };
+}, undefined, undefined, undefined, string>;
+/**
+ * Creates the CLI for the API at `TEMPO_API_URL` (default: hosted), sending
+ * `TEMPO_API_KEY` where sessions do not apply and storing sessions under `TEMPO_HOME`.
+ */
+export declare function fromEnv(env: fromEnv.Env, options?: from.Options): Promise<incur_Cli.Cli<{
+    login: {
         args: {};
         options: {
-            apply: boolean;
-            databaseUrl?: string | undefined;
-            dbSchema?: string | undefined;
-            file: string;
+            browser?: boolean | undefined;
         };
-    } & {
+    };
+} & {
+    logout: {
+        args: {};
+        options: {};
+    };
+} & {
+    whoami: {
+        args: {};
+        options: {};
+    };
+} & {
+    "keys create": {
         args: {};
         options: {
-            clickhouseDatabase?: string | undefined;
-            clickhouseMigratePassword?: string | undefined;
-            clickhouseMigrateUser?: string | undefined;
-            clickhouseUrl?: string | undefined;
-            databaseUrl?: string | undefined;
-            dbSchema?: string | undefined;
+            allowedIps?: string[] | undefined;
+            env: "production" | "sandbox";
+            name?: string | undefined;
+            org?: string | undefined;
+            project?: string | undefined;
+            scopes: string[];
         };
     };
-}, undefined, undefined, undefined>;
+}, undefined, undefined, undefined, string>>;
+export declare namespace fromEnv {
+    /** Environment variables the CLI reads; any other variables are ignored. */
+    type Env = Record<string, string | undefined> & {
+        /** Environment for inferred project credentials. */
+        TEMPO_API_ENV?: string | undefined;
+        /** Explicit API key sent where sessions do not apply. */
+        TEMPO_API_KEY?: string | undefined;
+        /** Organization for inferred project credentials. */
+        TEMPO_API_ORG?: string | undefined;
+        /** Project for inferred project credentials. */
+        TEMPO_API_PROJECT?: string | undefined;
+        /** Approved key to derive restricted scopes from. */
+        TEMPO_API_SOURCE_KEY?: string | undefined;
+        /** Tempo API origin. @default 'https://api.tempo.xyz' */
+        TEMPO_API_URL?: string | undefined;
+        /** Tempo CLI home directory. @default '~/.tempo' */
+        TEMPO_HOME?: string | undefined;
+    };
+}
 export declare namespace from {
     /** Options for creating a Tempo API CLI from a hosted API. */
     type Options = {
+        /** API key sent on operations that do not accept the stored CLI session. */
+        apiKey?: string | undefined;
+        /** Stored CLI sessions. @default Credentials.store() */
+        credentials?: Credentials.Store | undefined;
         /** CLI description. */
         description?: string | undefined;
         /** Remote docs MCP source mounted as the `docs` command group, or `false` to omit it. @default 'https://mcp.tempo.xyz/mcp' */
         docs?: mcp.Source | false | undefined;
+        /** Environment for inferred project credentials. Defaults to production. */
+        environment?: 'production' | 'sandbox' | undefined;
+        /** Sends requests to the Tempo API, such as an in-process app. @default globalThis.fetch */
+        fetch?: ((request: Request) => Promise<Response>) | undefined;
         /** CLI name. */
         name?: string | undefined;
-        /** OpenAPI document source. Relative paths resolve from the API URL. */
+        /** OpenAPI document or its source. Pass a resolved document to avoid fetching it twice. */
         openapi?: Openapi.OpenAPISource | undefined;
-        /** OpenAPI command generation configuration. Defaults to namespace mode. */
+        /** OpenAPI command generation configuration. Defaults to namespace-mode commands for the `/v1` API. */
         openapiConfig?: Openapi.Config | undefined;
+        /** Organization for inferred project credentials. */
+        orgId?: string | undefined;
+        /** Project for inferred project credentials. */
+        projectId?: string | undefined;
         /** Request options applied to API calls. */
         request?: Fetch.fromRequest.Options | undefined;
+        /** Approved source key when multiple restricted-scope grants exist. */
+        sourceKeyId?: string | undefined;
+        /** How `--update` installs a new version and whether to check for one. @default npm, inferred from the installed package */
+        update?: incur_Cli.create.Options['update'];
         /** CLI version. */
         version?: string | undefined;
     };

package/dist/cli/Cli.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"Cli.d.ts","sourceRoot":"","sources":["../../src/cli/Cli.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,GAAG,IAAI,SAAS,EAAE,KAAK,EAAE,KAAK,OAAO,EAAE,MAAM,OAAO,CAAA;AAE7D,OAAO,KAAK,EAAE,GAAG,EAAE,MAAM,gBAAgB,CAAA;AAUzC;;;GAGG;AACH,wBAAgB,IAAI,CAAC,GAAG,EAAE,MAAM,GAAG,GAAG,EAAE,OAAO,GAAE,IAAI,CAAC,OAAY;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;oCA4BjE;AAED,MAAM,CAAC,OAAO,WAAW,IAAI,CAAC;IAC5B,8DAA8D;IAC9D,KAAK,OAAO,GAAG;QACb,uBAAuB;QACvB,WAAW,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;QAChC,8HAA8H;QAC9H,IAAI,CAAC,EAAE,GAAG,CAAC,MAAM,GAAG,KAAK,GAAG,SAAS,CAAA;QACrC,gBAAgB;QAChB,IAAI,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;QACzB,wEAAwE;QACxE,OAAO,CAAC,EAAE,OAAO,CAAC,aAAa,GAAG,SAAS,CAAA;QAC3C,4EAA4E;QAC5E,aAAa,CAAC,EAAE,OAAO,CAAC,MAAM,GAAG,SAAS,CAAA;QAC1C,4CAA4C;QAC5C,OAAO,CAAC,EAAE,KAAK,CAAC,WAAW,CAAC,OAAO,GAAG,SAAS,CAAA;QAC/C,mBAAmB;QACnB,OAAO,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;KAC7B,CAAA;CACF"}
+{"version":3,"file":"Cli.d.ts","sourceRoot":"","sources":["../../src/cli/Cli.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,GAAG,IAAI,SAAS,EAAE,KAAK,KAAK,EAAE,OAAO,EAAE,MAAM,OAAO,CAAA;AAE7D,OAAO,KAAK,EAAE,GAAG,EAAE,MAAM,gBAAgB,CAAA;AAKzC,OAAO,KAAK,WAAW,MAAM,kBAAkB,CAAA;AAqB/C;;;;GAIG;AACH,wBAAgB,IAAI,CAAC,GAAG,EAAE,MAAM,GAAG,GAAG,EAAE,OAAO,GAAE,IAAI,CAAC,OAAY;;;;;;;;;;;;;;;;;;;;;;;;;;;;;4CAwEjE;AAED;;;GAGG;AACH,wBAAsB,OAAO,CAAC,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,OAAO,GAAE,IAAI,CAAC,OAAY;;;;;;;;;;;;;;;;;;;;;;;;;;;;;6CAoCzE;AAED,MAAM,CAAC,OAAO,WAAW,OAAO,CAAC;IAC/B,4EAA4E;IAC5E,KAAK,GAAG,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,GAAG;QAC9C,oDAAoD;QACpD,aAAa,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;QAClC,yDAAyD;QACzD,aAAa,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;QAClC,qDAAqD;QACrD,aAAa,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;QAClC,gDAAgD;QAChD,iBAAiB,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;QACtC,qDAAqD;QACrD,oBAAoB,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;QACzC,yDAAyD;QACzD,aAAa,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;QAClC,oDAAoD;QACpD,UAAU,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;KAChC,CAAA;CACF;AAED,MAAM,CAAC,OAAO,WAAW,IAAI,CAAC;IAC5B,8DAA8D;IAC9D,KAAK,OAAO,GAAG;QACb,4EAA4E;QAC5E,MAAM,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;QAC3B,wDAAwD;QACxD,WAAW,CAAC,EAAE,WAAW,CAAC,KAAK,GAAG,SAAS,CAAA;QAC3C,uBAAuB;QACvB,WAAW,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;QAChC,8HAA8H;QAC9H,IAAI,CAAC,EAAE,GAAG,CAAC,MAAM,GAAG,KAAK,GAAG,SAAS,CAAA;QACrC,4EAA4E;QAC5E,WAAW,CAAC,EAAE,YAAY,GAAG,SAAS,GAAG,SAAS,CAAA;QAClD,4FAA4F;QAC5F,KAAK,CAAC,EAAE,CAAC,CAAC,OAAO,EAAE,OAAO,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAC,GAAG,SAAS,CAAA;QAC7D,gBAAgB;QAChB,IAAI,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;QACzB,2FAA2F;QAC3F,OAAO,CAAC,EAAE,OAAO,CAAC,aAAa,GAAG,SAAS,CAAA;QAC3C,uGAAuG;QACvG,aAAa,CAAC,EAAE,OAAO,CAAC,MAAM,GAAG,SAAS,CAAA;QAC1C,qDAAqD;QACrD,KAAK,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;QAC1B,gDAAgD;QAChD,SAAS,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;QAC9B,4CAA4C;QAC5C,OAAO,CAAC,EAAE,KAAK,CAAC,WAAW,CAAC,OAAO,GAAG,SAAS,CAAA;QAC/C,uEAAuE;QACvE,WAAW,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;QAChC,4HAA4H;QAC5H,MAAM,CAAC,EAAE,SAAS,CAAC,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAA;QAC3C,mBAAmB;QACnB,OAAO,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;KAC7B,CAAA;CACF"}