tines 0.0.285 → 0.0.287

package/dist/index.js

@@ -3598,6 +3598,136 @@ var RUN_OUTCOME_BUCKETS = [
 ];
 var LIBRARY_MAX_BYTES = 5 * 1024 * 1024;
 
+// ../shared/src/permissions.ts
+var ACCESS_LEVELS = ["none", "read", "write", "delete"];
+var MAX_PERMISSION_PROJECTS = 1e4;
+var MAX_PERMISSION_PROJECT_ID_LENGTH = 100;
+var FULL_API_KEY_PERMISSIONS = Object.freeze({
+  version: 1,
+  projects: Object.freeze({ access: "delete", scope: "all" }),
+  workspace: "delete",
+  control_plane: "delete"
+});
+var READ_ONLY_API_KEY_PERMISSIONS = Object.freeze({
+  version: 1,
+  projects: Object.freeze({ access: "read", scope: "all" }),
+  workspace: "read",
+  control_plane: "read"
+});
+var PROJECT_AUTOMATION_API_KEY_PERMISSIONS = Object.freeze({
+  version: 1,
+  projects: Object.freeze({ access: "write", scope: Object.freeze([]) }),
+  workspace: "read",
+  control_plane: "none"
+});
+var RUNNER_SETUP_API_KEY_PERMISSIONS = Object.freeze({
+  version: 1,
+  projects: Object.freeze({ access: "write", scope: "all" }),
+  workspace: "write",
+  control_plane: "write"
+});
+var ApiKeyPermissionsValidationError = class extends Error {
+  constructor(message3, field = "permissions") {
+    super(message3);
+    this.field = field;
+    this.name = "ApiKeyPermissionsValidationError";
+  }
+  field;
+};
+function objectAt(value, field) {
+  if (typeof value !== "object" || value === null || Array.isArray(value)) {
+    throw new ApiKeyPermissionsValidationError(`"${field}" must be an object`, field);
+  }
+  return value;
+}
+function rejectUnknownKeys(value, allowed, field) {
+  const unknown = Object.keys(value).find((key) => !allowed.includes(key));
+  if (unknown !== void 0) {
+    throw new ApiKeyPermissionsValidationError(
+      `"${field}.${unknown}" is not a supported permission field`,
+      `${field}.${unknown}`
+    );
+  }
+}
+function accessAt(value, field, allowNone) {
+  if (typeof value !== "string" || !ACCESS_LEVELS.includes(value) || !allowNone && value === "none") {
+    const levels = allowNone ? ACCESS_LEVELS : ACCESS_LEVELS.slice(1);
+    throw new ApiKeyPermissionsValidationError(
+      `"${field}" must be one of ${levels.join(", ")}`,
+      field
+    );
+  }
+  return value;
+}
+function projectScopeAt(value) {
+  if (value === "all") return "all";
+  if (!Array.isArray(value)) {
+    throw new ApiKeyPermissionsValidationError(
+      '"permissions.projects.scope" must be "all" or an array of project IDs',
+      "permissions.projects.scope"
+    );
+  }
+  if (value.length > MAX_PERMISSION_PROJECTS) {
+    throw new ApiKeyPermissionsValidationError(
+      `"permissions.projects.scope" must contain at most ${MAX_PERMISSION_PROJECTS} project IDs`,
+      "permissions.projects.scope"
+    );
+  }
+  const seen = /* @__PURE__ */ new Set();
+  for (const id2 of value) {
+    if (typeof id2 !== "string" || id2.length > MAX_PERMISSION_PROJECT_ID_LENGTH || !/^prj_[A-Za-z0-9_-]+$/.test(id2)) {
+      throw new ApiKeyPermissionsValidationError(
+        '"permissions.projects.scope" entries must be valid project IDs',
+        "permissions.projects.scope"
+      );
+    }
+    if (seen.has(id2)) {
+      throw new ApiKeyPermissionsValidationError(
+        `"permissions.projects.scope" contains duplicate project ID "${id2}"`,
+        "permissions.projects.scope"
+      );
+    }
+    seen.add(id2);
+  }
+  return [...seen].sort();
+}
+function parseApiKeyPermissions(value) {
+  const policy = objectAt(value, "permissions");
+  rejectUnknownKeys(policy, ["version", "projects", "workspace", "control_plane"], "permissions");
+  if (policy.version !== void 0 && policy.version !== 1) {
+    throw new ApiKeyPermissionsValidationError(
+      '"permissions.version" must be 1',
+      "permissions.version"
+    );
+  }
+  for (const field of ["projects", "workspace", "control_plane"]) {
+    if (!(field in policy)) {
+      throw new ApiKeyPermissionsValidationError(
+        `"permissions.${field}" is required`,
+        `permissions.${field}`
+      );
+    }
+  }
+  const projects = objectAt(policy.projects, "permissions.projects");
+  rejectUnknownKeys(projects, ["access", "scope"], "permissions.projects");
+  if (!("access" in projects) || !("scope" in projects)) {
+    const missing = !("access" in projects) ? "access" : "scope";
+    throw new ApiKeyPermissionsValidationError(
+      `"permissions.projects.${missing}" is required`,
+      `permissions.projects.${missing}`
+    );
+  }
+  return {
+    version: 1,
+    projects: {
+      access: accessAt(projects.access, "permissions.projects.access", false),
+      scope: projectScopeAt(projects.scope)
+    },
+    workspace: accessAt(policy.workspace, "permissions.workspace", true),
+    control_plane: accessAt(policy.control_plane, "permissions.control_plane", true)
+  };
+}
+
 // ../shared/src/events.ts
 var text = (t) => ({ kind: "text", text: t });
 var name = (t) => ({ kind: "name", text: str(t) });
@@ -3690,6 +3820,10 @@ var DESCRIBERS = {
   "workflow.updated": (ev, p) => [text(`${action(ev.type)} workflow`), name(p.name)],
   "workflow.deleted": (ev, p) => [text(`${action(ev.type)} workflow`), name(p.name)],
   "api_key.created": (_ev, p) => [text("created API key"), name(p.name)],
+  "api_key.permissions_updated": (_ev, p) => [
+    text("updated permissions for API key"),
+    name(p.name)
+  ],
   "api_key.revoked": (_ev, p) => [text("revoked API key"), name(p.name)],
   "scheduled_task.created": (ev, p) => [text(`${action(ev.type)} schedule`), name(p.name)],
   "scheduled_task.updated": (ev, p) => [text(`${action(ev.type)} schedule`), name(p.name)],
@@ -4229,9 +4363,14 @@ function createApiClient(options) {
     createSupervisorRate: (body) => request("POST", "/api/v1/supervisor/rates", body),
     repriceSupervisorRate: (model, cursor = null) => request("POST", "/api/v1/supervisor/rates/reprice", { model, cursor }),
     deleteSupervisorRate: (id2) => request("DELETE", `/api/v1/supervisor/rates/${id2}`),
-    // API keys (create/revoke require a browser session, not a key)
+    // API keys
     listApiKeys: (filters = {}) => get(`/api/v1/api-keys${query(filters)}`),
+    getApiKey: (id2) => get(`/api/v1/api-keys/${id2}`),
+    getCurrentApiKeyAuthority: () => get(
+      "/api/v1/api-keys/current"
+    ),
     createApiKey: (body) => request("POST", "/api/v1/api-keys", body),
+    updateApiKey: (id2, body) => request("PATCH", `/api/v1/api-keys/${id2}`, body),
     revokeApiKey: (id2) => request("DELETE", `/api/v1/api-keys/${id2}`),
     exportWorkflowPackage: (id2, opts = {}) => {
       const params = new URLSearchParams();
@@ -6536,6 +6675,142 @@ function register(program3) {
   });
 }
 
+// src/commands/api-keys.ts
+var PRESETS = {
+  full: FULL_API_KEY_PERMISSIONS,
+  "read-only": READ_ONLY_API_KEY_PERMISSIONS,
+  "project-automation": PROJECT_AUTOMATION_API_KEY_PERMISSIONS,
+  "runner-setup": RUNNER_SETUP_API_KEY_PERMISSIONS
+};
+function clonePolicy(policy) {
+  return parseApiKeyPermissions(JSON.parse(JSON.stringify(policy)));
+}
+function policyFromOptions(opts) {
+  if (Boolean(opts.permissions) === Boolean(opts.preset)) {
+    die("pass exactly one of --permissions or --preset");
+  }
+  if (opts.permissions) {
+    if (opts.projects || opts.allProjects) die("--projects/--all-projects require --preset");
+    try {
+      return parseApiKeyPermissions(JSON.parse(readBodyValue(opts.permissions)));
+    } catch (error) {
+      die(error instanceof Error ? error.message : "invalid permission JSON");
+    }
+  }
+  const preset2 = opts.preset;
+  const policy = clonePolicy(PRESETS[preset2]);
+  if (opts.projects && opts.allProjects) die("pass only one of --projects or --all-projects");
+  if (opts.projects) {
+    policy.projects.scope = opts.projects.split(",").map((id2) => id2.trim()).filter(Boolean);
+    return parseApiKeyPermissions(policy);
+  }
+  if (opts.allProjects) policy.projects.scope = "all";
+  if (preset2 === "project-automation" && policy.projects.scope.length === 0) {
+    die("project-automation requires --projects <id,...> or --all-projects");
+  }
+  return policy;
+}
+function scopeLabel(policy) {
+  return policy.projects.scope === "all" ? "all" : policy.projects.scope.length === 0 ? "none" : policy.projects.scope.join(",");
+}
+function printKey(key) {
+  table([
+    ["ID", "NAME", "PROJECTS", "WORKSPACE", "CONTROL", "USABLE"],
+    [
+      key.id,
+      key.name,
+      `${key.permissions.projects.access}:${scopeLabel(key.permissions)}`,
+      key.permissions.workspace,
+      key.permissions.control_plane,
+      key.usable === false ? "no" : "yes"
+    ]
+  ]);
+  if (key.run_restrictions) {
+    console.log(
+      `also restricted to run ${key.run_restrictions.run_id}, issue ${key.run_restrictions.issue_id}, project ${key.run_restrictions.project_id}`
+    );
+  }
+}
+function addPolicyOptions(command, includePreset) {
+  command.option(
+    "--permissions <json|@file|->",
+    "complete permission policy as JSON, @file, or stdin"
+  );
+  if (includePreset) {
+    command.addOption(
+      new Option("--preset <name>", "permission preset").choices([
+        "full",
+        "read-only",
+        "project-automation",
+        "runner-setup"
+      ])
+    );
+    command.option("--projects <ids>", "comma-separated explicit project IDs");
+    command.option("--all-projects", "explicitly use all projects");
+  }
+  return command;
+}
+function register2(program3) {
+  const keys = program3.command("api-keys").description("Manage scoped API keys");
+  withCommon(
+    keys.command("list").addOption(
+      new Option("--run-keys <mode>", "run keys to include").choices(["none", "active", "all"])
+    )
+  ).action(async (opts) => {
+    const response = await client(opts).listApiKeys({ run_keys: opts.runKeys });
+    if (opts.json) return printJson(response);
+    if (response.items.length === 0) return console.log("no API keys");
+    for (const key of response.items) printKey(key);
+  });
+  withCommon(keys.command("show <id>").description("Show stored and effective authority")).action(
+    async (id2, opts) => {
+      const key = await client(opts).getApiKey(id2);
+      if (opts.json) return printJson(key);
+      printKey(key);
+    }
+  );
+  withCommon(keys.command("current").description("Inspect the acting credential authority")).action(
+    async (opts) => {
+      const current = await client(opts).getCurrentApiKeyAuthority();
+      if (opts.json) return printJson(current);
+      console.log(current.key ? `${current.key.name} (${current.key.id})` : "browser session");
+      const policy = current.authority.effective_permissions;
+      console.log(
+        `projects ${policy.projects.access}:${scopeLabel(policy)}; workspace ${policy.workspace}; control ${policy.control_plane}`
+      );
+    }
+  );
+  withCommon(
+    addPolicyOptions(keys.command("create <name>").description("Create a scoped key"), true)
+  ).action(async (name2, opts) => {
+    const created = await client(opts).createApiKey({ name: name2, permissions: policyFromOptions(opts) });
+    if (opts.json) return printJson(created);
+    console.log(created.key);
+    printKey(created);
+  });
+  withCommon(
+    addPolicyOptions(keys.command("update <id>").description("Replace key permissions"), false)
+  ).action(async (id2, opts) => {
+    if (!opts.permissions) die("--permissions is required");
+    const api = client(opts);
+    const current = await api.getApiKey(id2);
+    const permissions = policyFromOptions(opts);
+    const updated = await api.updateApiKey(id2, {
+      permissions,
+      expected_permissions: current.permissions
+    });
+    if (opts.json) return printJson(updated);
+    printKey(updated);
+  });
+  withCommon(keys.command("revoke <id>").description("Revoke a key")).action(
+    async (id2, opts) => {
+      await client(opts).revokeApiKey(id2);
+      if (opts.json) return printJson({ revoked: id2 });
+      console.log(`revoked ${id2}`);
+    }
+  );
+}
+
 // src/commands/issues.ts
 import { existsSync as existsSync4, mkdirSync as mkdirSync3, readdirSync, readFileSync as readFileSync5, statSync as statSync2, writeFileSync as writeFileSync3 } from "node:fs";
 import { basename, dirname as dirname2, join as join3 } from "node:path";
@@ -7286,7 +7561,7 @@ function printIssueDetail(issue) {
   console.log(`${issue.project_name}/#${issue.number}  ${issue.title}`);
   const dup = issue.duplicate_of;
   console.log(
-    `state: ${issue.effective_state.name} (${issue.effective_state.category})${dup ? ` (via ${issueRef(dup)} \u2014 duplicate)` : ""}  workflow: ${issue.workflow.name}  updated: ${timestamp(issue.updated_at)}`
+    `state: ${issue.effective_state.name} (${issue.effective_state.category})${dup ? ` (via ${issueRef(dup)} \u2014 duplicate)` : ""}  workflow: ${issue.workflow?.name ?? "restricted"}  updated: ${timestamp(issue.updated_at)}`
   );
   if (dup) {
     console.log(
@@ -7419,7 +7694,7 @@ matched rule: ${ex.matched_rule.scope_label}`);
     );
   }
 }
-function register2(program3) {
+function register3(program3) {
   const issues = program3.command("issues").description("Work with issues");
   withList(
     issues.command("list").description("List issues across projects (hides done and duplicate issues unless included)").option("-p, --project <name>", "filter by project name or id").option("-s, --state <name>", "filter by state name or id").option("-c, --category <cat>", "filter by state category").option("-w, --workflow <id-or-name>", "filter by workflow").option("-a, --all", "include issues in done states").option("--show-duplicates", "include issues marked as duplicates").option(
@@ -7584,7 +7859,8 @@ function register2(program3) {
       const notes = [];
       if (body.title !== void 0) notes.push(`title "${updated.title}"`);
       if (body.description !== void 0) notes.push("description");
-      if (body.workflow_id !== void 0) notes.push(`workflow "${updated.workflow.name}"`);
+      if (body.workflow_id !== void 0)
+        notes.push(`workflow "${updated.workflow?.name ?? body.workflow_id}"`);
       if (updated.state.id !== issue.state.id) {
         notes.push(`state ${issue.state.name} \u2192 ${updated.state.name}`);
       }
@@ -8282,6 +8558,15 @@ async function resolveJournal(api, ref, stateRef2) {
     return { issue, scope, note, item };
   } catch (err) {
     if (!(err instanceof ApiError) || err.status !== 404) throw err;
+    if (!issue.workflow)
+      throw new ApiError(
+        403,
+        {
+          code: "insufficient_permissions",
+          message: "Journal fallback requires workspace read access"
+        },
+        "Journal fallback requires workspace read access"
+      );
     const scope = stateScope(issue, issue.state, issue.workflow);
     return { issue, scope, note: null, item: await journalItemAt(api, scope) };
   }
@@ -8289,7 +8574,7 @@ async function resolveJournal(api, ref, stateRef2) {
 function printNote(note) {
   if (note) console.error(`note: ${note}`);
 }
-function register3(program3) {
+function register4(program3) {
   const journal = program3.command("journal").description(
     "An issue's stage journal: shared notes for its project + the stage your run was launched in"
   );
@@ -8376,7 +8661,7 @@ function parseLabelColor(value) {
   }
   return value;
 }
-function register4(program3) {
+function register5(program3) {
   const labels = program3.command("labels").description("Manage the label library");
   withCommon(
     labels.command("list").description("List labels with how many issues carry each")
@@ -8473,7 +8758,7 @@ function readKeyArg(value) {
   if (!key) die("no API key on stdin");
   return key;
 }
-function register5(program3) {
+function register6(program3) {
   program3.command("login").description("Store the API URL and key for this machine, so commands need no env vars").option("-u, --url <url>", `base URL of the Tines API to store (default ${DEFAULT_URL})`).option("--api-key <key>", 'API key from Settings \u2192 API keys ("-" reads it from stdin)').option("--no-verify", "store without checking the key against the API").action(async (opts) => {
     if (!opts.url && !opts.apiKey) die("pass --url and/or --api-key");
     const dir = defaultConfigDir();
@@ -8570,7 +8855,7 @@ function registerEvents(program3) {
 }
 
 // src/commands/projects.ts
-function register6(program3) {
+function register7(program3) {
   const projects = program3.command("projects").description("Manage projects");
   withCommon(
     projects.command("starters").description("List built-in project starters and their inputs")
@@ -8821,7 +9106,7 @@ async function resolveRoutingScope(api, opts) {
   if (opts.label) parts.push(`label ${opts.label}`);
   return { projectId, stateId, labelId, label: parts.length > 0 ? parts.join(" \xB7 ") : "global" };
 }
-function register7(program3) {
+function register8(program3) {
   const routing = program3.command("routing").description(
     "Scoped routing rules: which runner takes which issues (most specific scope wins)"
   );
@@ -11910,7 +12195,7 @@ function printTierTable(runner) {
     );
   }
 }
-function register8(program3) {
+function register9(program3) {
   const runners = program3.command("runners").description("Manage the runner registry");
   withCommon(runners.command("list").description("List runners")).action(
     async (opts) => {
@@ -12458,7 +12743,7 @@ title template: ${s.title_template}`);
     for (const line of s.description_template.split("\n")) console.log(`  ${line}`);
   }
 }
-function register9(program3) {
+function register10(program3) {
   const schedules = program3.command("schedules").description("Manage scheduled tasks (addressed as <project>/<name>)");
   withList(
     schedules.command("list").description("List scheduled tasks (hides paused schedules unless --all)").option("-p, --project <name>", "filter by project name or id").option("-a, --all", "include paused schedules")
@@ -12712,7 +12997,7 @@ function statsLevers() {
     "  sent back   tines context show <wf>/<state> instructions"
   ];
 }
-function register10(program3) {
+function register11(program3) {
   const supervisor = program3.command("supervisor").description("The automation kill switch, quota policy, and attempt limit");
   withCommon(
     supervisor.command("status").description("One-screen overview: kill switch, quota, utilization, runners").option("--project <name-or-id>", "filter waiting work to one project")
@@ -13729,7 +14014,7 @@ function printWorkflowDetail(wf, lib) {
   for (const w of wf.warnings ?? []) console.log(`
 warning: ${w}`);
 }
-function register11(program3) {
+function register12(program3) {
   const workflows = program3.command("workflows").description("Manage the workflow library");
   registerPackageCommands(workflows);
   withList(workflows.command("list").description("List the workflow library")).action(
@@ -14351,7 +14636,7 @@ function printReport(report) {
   for (const line of usageAggregateLines("Scope", scope)) console.log(line);
   for (const line of usageAggregateLines("Matching", total)) console.log(line);
 }
-function register12(program3) {
+function register13(program3) {
   withCommon(
     program3.command("usage").description("Compare finalized run spend for a period").addOption(
       new Option("--window <window>", "today, 7d, or 30d").choices(["today", "7d", "30d"])
@@ -14543,18 +14828,19 @@ function register12(program3) {
 var program2 = new Command();
 program2.name("tines").description("CLI for Tines").version(cliVersion()).enablePositionalOptions();
 registerTime(program2);
-register5(program2);
 register6(program2);
-register11(program2);
 register2(program2);
-register4(program2);
-register(program2);
+register7(program2);
+register12(program2);
 register3(program2);
+register5(program2);
+register(program2);
+register4(program2);
+register10(program2);
 register9(program2);
 register8(program2);
-register7(program2);
-register10(program2);
-register12(program2);
+register11(program2);
+register13(program2);
 registerEvents(program2);
 
 // src/index.ts

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "tines",
-  "version": "0.0.285",
+  "version": "0.0.287",
   "description": "CLI for Tines, an orchestration layer for AI agents",
   "repository": {
     "type": "git",