xapi-to 0.1.21 → 0.1.22

package/dist/index.js

@@ -49,7 +49,7 @@ import {
   saveConfig,
   scheme,
   showConfig
-} from "./chunk-UEQCIJ7T.js";
+} from "./chunk-2YRWNREY.js";
 
 // src/codegen.ts
 var TARGET_MAP = {
@@ -1192,24 +1192,97 @@ function bindingChangedAfter(binding, startedAtMs, existingBindingIds) {
   if (!Number.isFinite(changedAt)) return !existingBindingIds.has(binding.id);
   return changedAt >= startedAtMs;
 }
+var POLL_DEADLINE = /* @__PURE__ */ Symbol("oauth poll deadline");
+function waitForPollInterval(ms, signal) {
+  return new Promise((resolve4) => {
+    if (signal.aborted) {
+      resolve4(false);
+      return;
+    }
+    let timer;
+    const cleanup = () => signal.removeEventListener("abort", onAbort);
+    const onAbort = () => {
+      if (timer !== void 0) clearTimeout(timer);
+      cleanup();
+      resolve4(false);
+    };
+    timer = setTimeout(() => {
+      cleanup();
+      resolve4(true);
+    }, Math.max(0, ms));
+    signal.addEventListener("abort", onAbort, { once: true });
+    if (signal.aborted) onAbort();
+  });
+}
+function resolveOnPollAbort(operation, signal) {
+  return new Promise((resolve4, reject) => {
+    let settled = false;
+    const cleanup = () => signal.removeEventListener("abort", onAbort);
+    const onAbort = () => {
+      if (settled) return;
+      settled = true;
+      cleanup();
+      resolve4(POLL_DEADLINE);
+    };
+    const resolveOperation = (value) => {
+      if (settled) return;
+      settled = true;
+      cleanup();
+      resolve4(value);
+    };
+    const rejectOperation = (error) => {
+      if (settled) return;
+      settled = true;
+      cleanup();
+      reject(error);
+    };
+    signal.addEventListener("abort", onAbort, { once: true });
+    operation.then(resolveOperation, rejectOperation);
+    if (signal.aborted) {
+      onAbort();
+      return;
+    }
+  });
+}
 async function pollForBinding(apiKeyId, providerId, jwtToken, startedAt, existingBindingIds = /* @__PURE__ */ new Set(), timeoutMs = 5 * 60 * 1e3, intervalMs = 3e3) {
   const deadline = Date.now() + timeoutMs;
   const isTTY = process.stdout.isTTY;
   const startedAtMs = startedAt.getTime() - 5e3;
-  while (Date.now() < deadline) {
-    await new Promise((r) => setTimeout(r, intervalMs));
-    try {
-      const bindings = await listOAuthBindings(jwtToken, XAPI_API_HOST);
-      const match = Array.isArray(bindings) ? bindings.find(
-        (b) => b.apiKeyId === apiKeyId && b.providerId === providerId && bindingChangedAfter(b, startedAtMs, existingBindingIds)
-      ) : null;
-      if (match) return match;
-    } catch {
-    }
-    if (isTTY) {
-      const remaining = Math.ceil((deadline - Date.now()) / 1e3);
-      process.stdout.write(`\r  Waiting for authorization... (${remaining}s remaining)  `);
+  const controller = new AbortController();
+  const deadlineTimer = setTimeout(
+    () => controller.abort(),
+    Math.max(0, deadline - Date.now())
+  );
+  try {
+    while (Date.now() < deadline) {
+      const remaining = deadline - Date.now();
+      const intervalElapsed = await waitForPollInterval(
+        Math.min(Math.max(0, intervalMs), remaining),
+        controller.signal
+      );
+      if (!intervalElapsed || Date.now() >= deadline || controller.signal.aborted) break;
+      try {
+        const bindings = await resolveOnPollAbort(
+          listOAuthBindings(jwtToken, XAPI_API_HOST, controller.signal),
+          controller.signal
+        );
+        if (bindings === POLL_DEADLINE || Date.now() >= deadline) break;
+        const match = Array.isArray(bindings) ? bindings.find(
+          (b) => b.apiKeyId === apiKeyId && b.providerId === providerId && bindingChangedAfter(b, startedAtMs, existingBindingIds)
+        ) : null;
+        if (match) return match;
+      } catch (e) {
+        if (controller.signal.aborted || Date.now() >= deadline) break;
+        if (!isRetryableRequestError(e)) throw e;
+      }
+      if (isTTY) {
+        const remaining2 = Math.ceil((deadline - Date.now()) / 1e3);
+        process.stdout.write(`\r  Waiting for authorization... (${remaining2}s remaining)  `);
+      }
     }
+  } finally {
+    clearTimeout(deadlineTimer);
+    controller.abort();
   }
   if (process.stdout.isTTY) process.stdout.write("\n");
   return null;
@@ -1923,11 +1996,11 @@ COMMON
 }
 function validateFlags(flags, command, allowed = []) {
   const valid = /* @__PURE__ */ new Set([...COMMON_FLAGS, ...allowed]);
-  const unknown = Object.keys(flags).filter((flag) => !valid.has(flag));
+  const unknown = Object.keys(flags).filter((flag2) => !valid.has(flag2));
   if (unknown.length) {
-    err(`unknown flag${unknown.length > 1 ? "s" : ""} for sandbox ${command}: ${unknown.map((flag) => `--${flag}`).join(", ")}`, {
+    err(`unknown flag${unknown.length > 1 ? "s" : ""} for sandbox ${command}: ${unknown.map((flag2) => `--${flag2}`).join(", ")}`, {
       hint: `run xapi-to sandbox ${command} --help`,
-      validFlags: [...valid].sort().map((flag) => `--${flag}`)
+      validFlags: [...valid].sort().map((flag2) => `--${flag2}`)
     });
   }
   if (flags.format && !["json", "pretty", "table"].includes(flags.format)) {
@@ -2608,17 +2681,349 @@ async function sandboxRun(args, flags) {
 }
 
 // src/commands/provider.ts
-import { mkdir, open as open2, readFile as readFile2 } from "fs/promises";
+import { mkdir, open as open2, readFile as readFile3 } from "fs/promises";
 import { dirname, resolve as resolve2 } from "path";
+
+// src/commands/provider-onboarding.ts
+import { readFile as readFile2 } from "fs/promises";
+
+// src/provider-client.ts
+function providerRequest(path, apiKey, method = "GET", body, timeoutMs = 3e4, retries = method === "GET" ? 2 : 0) {
+  return request(`${scheme(XAPI_API_HOST)}://${XAPI_API_HOST}/api/api-services/agent/${path}`, {
+    method,
+    headers: {
+      "Content-Type": "application/json",
+      ...apiKey ? { "XAPI-KEY": apiKey } : {}
+    },
+    ...body === void 0 ? {} : { body: JSON.stringify(body) }
+  }, Math.min(timeoutMs, 3e4), retries);
+}
+function object(value) {
+  return value !== null && typeof value === "object" && !Array.isArray(value) ? value : void 0;
+}
+var SECRET_FIELD = /^(authConfig|privateHeaders|authorization|proxy-authorization|api[-_]?key|xapi[-_]?key|x-api-key|access[-_]?token|refresh[-_]?token|client[-_]?secret|password|secret|token|cookie|set-cookie)$/i;
+var CONTRACT_FIELD = /* @__PURE__ */ new Set([
+  "openApiSpec",
+  "bodySchema",
+  "schema",
+  "schemas",
+  "properties",
+  "definitions",
+  "$defs",
+  "params",
+  "pathParams",
+  "responses",
+  "securitySchemes"
+]);
+function isContract(key, value, parent) {
+  if (CONTRACT_FIELD.has(key)) return true;
+  const obj = object(value);
+  if (typeof obj?.openapi === "string") return true;
+  return parent === "headers" && !!obj && ("type" in obj || "schema" in obj || "$ref" in obj);
+}
+function collectProviderSecrets(value) {
+  const secrets = [];
+  function visit(item, sensitive = false, contract = false, parent) {
+    if (typeof item === "string" && sensitive && item) secrets.push(item);
+    else if (Array.isArray(item)) item.forEach((v) => visit(v, sensitive, contract, parent));
+    else if (object(item)) {
+      for (const [key, val] of Object.entries(item)) {
+        const definition = !sensitive && (contract || isContract(key, val, parent));
+        visit(val, sensitive || !definition && SECRET_FIELD.test(key), definition, key);
+      }
+    }
+  }
+  visit(value);
+  return secrets;
+}
+function redactProvider(value, knownSecrets = []) {
+  const secrets = [.../* @__PURE__ */ new Set([...knownSecrets, ...collectProviderSecrets(value)])].filter(Boolean).sort((a, b) => b.length - a.length);
+  function visit(item, contract = false, parent) {
+    if (typeof item === "string") {
+      return secrets.reduce((text, secret) => text.split(secret).join("[REDACTED]"), item);
+    }
+    if (Array.isArray(item)) return item.map((val) => visit(val, contract, parent));
+    if (object(item)) return Object.fromEntries(Object.entries(item).map(([key, val]) => {
+      const definition = contract || isContract(key, val, parent);
+      return [key, !definition && SECRET_FIELD.test(key) ? "[REDACTED]" : visit(val, definition, key)];
+    }));
+    return item;
+  }
+  return visit(value);
+}
+
+// src/commands/provider-onboarding.ts
+var PROVIDER_ONBOARDING_HELP = `xapi-to provider - Import and publish your API services
+
+COMMANDS
+  spec-rules                       Read current OpenAPI rules (public)
+  import --file openapi.json        Create a DRAFT service from OpenAPI JSON
+    --private-headers-file <path>   Upstream credentials as a JSON object
+  update <service-id> --revision <id> --file config.json
+    --mode merge|replace           PATCH merge (default) or PUT replacement
+    --allow-new-endpoints          Allow merge entries without IDs to create endpoints
+  submit <service-id> --revision <id>
+    --changelog <text>             Submit for review; this alone is not publication
+  review <service-id> --revision <id>
+                                   Read latest review and previous attempts
+  wait <service-id> --revision <id>
+    --interval <duration>          Poll interval (default: 2s; ms/s/m/h)
+    --timeout <duration>           Overall deadline (default: 10m; ms/s/m/h)
+    --max-attempts <number>         Optional cap, including transient failures
+
+COMMON FLAGS
+  --format json|pretty|table
+  --help
+
+Files must contain JSON objects; --file - reads stdin. Import reads a raw
+OpenAPI spec; update reads version configuration (not a raw OpenAPI spec).
+Merge updates to existing endpoints require their IDs. Use --mode replace
+to replace the endpoint list, or --allow-new-endpoints to intentionally add.
+Saving a draft configuration moves it to SANDBOX, ready for submit.
+
+PERMISSIONS
+  import: service:create (legacy allowRegister also accepted)
+  list/get/review/wait: service:read; update: service:update
+  submit: service:publish. Grant scopes in the xAPI Console API Keys settings.
+
+wait succeeds only for PUBLISHED. Rejection, unpublished terminal states,
+manual review, invalid responses, and timeouts exit nonzero with details.
+Writes are not retried automatically. Credentials are redacted from output.
+`;
+var FLAGS = {
+  "spec-rules": [],
+  import: ["file", "private-headers-file"],
+  update: ["revision", "file", "mode", "allow-new-endpoints"],
+  submit: ["revision", "changelog"],
+  review: ["revision"],
+  wait: ["revision", "interval", "timeout", "max-attempts"]
+};
+var SCOPES = {
+  import: "service:create",
+  update: "service:update",
+  submit: "service:publish",
+  review: "service:read",
+  wait: "service:read"
+};
+function flag(flags, name, required3 = false) {
+  const value = flags[name];
+  if (required3 && value === void 0 || value === "" || value === "true") {
+    throw new Error(`--${name} requires a value`);
+  }
+  return value;
+}
+function duration(raw, name) {
+  const match = /^(\d+)(ms|s|m|h)?$/.exec(raw);
+  const units = { ms: 1, s: 1e3, m: 6e4, h: 36e5 };
+  const ms = match ? Number(match[1]) * units[match[2] || "ms"] : NaN;
+  if (!Number.isSafeInteger(ms) || ms <= 0 || ms > 2147483647) {
+    throw new Error(`--${name} must be a positive duration (ms/s/m/h), at most 2147483647ms`);
+  }
+  return ms;
+}
+async function jsonFile(path) {
+  let text;
+  try {
+    if (path === "-") {
+      const chunks = [];
+      for await (const chunk of process.stdin) chunks.push(Buffer.from(chunk));
+      text = Buffer.concat(chunks).toString("utf8");
+    } else text = await readFile2(path, "utf8");
+  } catch {
+    throw new Error("Could not read JSON input file");
+  }
+  let value;
+  try {
+    value = JSON.parse(text);
+  } catch {
+    throw new Error("Input must be valid JSON (JSON objects only; YAML is not supported)");
+  }
+  const result = object(value);
+  if (!result) throw new Error("Input must be a JSON object");
+  return result;
+}
+function segment(value) {
+  const normalized = value.trim();
+  if (!normalized || normalized === "." || normalized === "..") {
+    throw new Error("Invalid service or revision ID");
+  }
+  return encodeURIComponent(normalized);
+}
+async function providerOnboarding(args, flags) {
+  const [command, ...rest] = args;
+  if (flags.help || !command) {
+    console.log(PROVIDER_ONBOARDING_HELP);
+    return;
+  }
+  const secrets = [];
+  const emit = (value) => output(redactProvider(value, secrets), flags.format);
+  try {
+    if (!Object.hasOwn(FLAGS, command)) throw new Error(`Unknown provider command: ${command}`);
+    for (const key of Object.keys(flags)) {
+      if (!["format", ...FLAGS[command]].includes(key)) throw new Error(`Unknown flag for provider ${command}: --${key}`);
+    }
+    const needsService = !["spec-rules", "import"].includes(command);
+    if (rest.length !== (needsService ? 1 : 0)) throw new Error(`provider ${command} expects ${needsService ? "one service ID" : "no positional arguments"}`);
+    const serviceId = rest[0];
+    const base = serviceId ? `services/${segment(serviceId)}` : "services";
+    const revisionId = flag(flags, "revision", ["update", "submit", "review", "wait"].includes(command));
+    const revisionPath = revisionId ? `${base}/revisions/${segment(revisionId)}` : "";
+    const cfg = getConfig();
+    if (cfg.apiKey) secrets.push(cfg.apiKey);
+    if (command !== "spec-rules") requireApiKey(cfg);
+    const read = (path) => providerRequest(path, cfg.apiKey);
+    if (command === "spec-rules") {
+      emit(await providerRequest("spec-rules", void 0));
+      return;
+    }
+    if (command === "import") {
+      const file = flag(flags, "file", true);
+      const headersFile = flag(flags, "private-headers-file");
+      if (file === "-" && headersFile === "-") throw new Error("Only one input may read stdin");
+      const spec = await jsonFile(file);
+      const body = { openApiSpec: spec };
+      if (headersFile) {
+        body.privateHeaders = await jsonFile(headersFile);
+        if (Object.values(body.privateHeaders).some((v) => typeof v !== "string")) {
+          throw new Error("Private header values must be strings");
+        }
+      }
+      secrets.push(...collectProviderSecrets(body));
+      const result = await providerRequest("register-api-service", cfg.apiKey, "POST", body);
+      if (result?.success === false) {
+        emit(result);
+        process.exitCode = 1;
+        return;
+      }
+      const service = object(result?.apiService);
+      if (result?.success !== true || typeof service?.id !== "string") {
+        throw new Error("Unexpected import response; creation may have succeeded. Check provider list before retrying");
+      }
+      const active = object(service.activeVersion);
+      const revision = active ?? (Array.isArray(service.versions) ? object(service.versions[0]) : void 0);
+      emit({
+        ...result,
+        serviceId: service.id,
+        revisionId: revision?.id ?? service.activeVersionId ?? null,
+        state: revision?.state ?? service.status ?? null
+      });
+      return;
+    }
+    if (command === "update") {
+      const mode = flag(flags, "mode") ?? "merge";
+      if (!["merge", "replace"].includes(mode)) throw new Error("--mode must be merge or replace");
+      if (flags["allow-new-endpoints"] !== void 0 && flags["allow-new-endpoints"] !== "true") {
+        throw new Error("--allow-new-endpoints is a boolean flag");
+      }
+      const body = await jsonFile(flag(flags, "file", true));
+      secrets.push(...collectProviderSecrets(body));
+      if ("openapi" in body) throw new Error("update expects version configuration, not a raw OpenAPI spec");
+      if (body.endpoints !== void 0) {
+        if (!Array.isArray(body.endpoints) || body.endpoints.some((ep) => !object(ep))) throw new Error("endpoints must be an array of objects");
+        if (mode === "merge" && !flags["allow-new-endpoints"] && body.endpoints.some((ep) => typeof ep.id !== "string" || !ep.id.trim())) {
+          throw new Error("Merge endpoints require IDs. Use --mode replace for a full list, or --allow-new-endpoints to intentionally create endpoints");
+        }
+      }
+      const revision = await providerRequest(`${base}/versions/${segment(revisionId)}`, cfg.apiKey, mode === "merge" ? "PATCH" : "PUT", body);
+      emit({ serviceId, revisionId, state: revision?.state ?? null, revision });
+      return;
+    }
+    if (command === "submit") {
+      const changelog = flag(flags, "changelog");
+      if (changelog !== void 0 && changelog.length > 2e3) {
+        throw new Error("--changelog must be at most 2000 characters");
+      }
+      const submission = await providerRequest(`${revisionPath}/submit`, cfg.apiKey, "POST", changelog ? { changelog } : {});
+      emit({ serviceId, revisionId, submission });
+      return;
+    }
+    if (command === "review") {
+      emit(await read(`${revisionPath}/review`));
+      return;
+    }
+    const intervalMs = duration(flag(flags, "interval") ?? "2s", "interval");
+    const timeoutMs = duration(flag(flags, "timeout") ?? "10m", "timeout");
+    const attemptsFlag = flag(flags, "max-attempts");
+    const maxAttempts = attemptsFlag === void 0 ? Infinity : Number(attemptsFlag);
+    if (attemptsFlag !== void 0 && (!/^\d+$/.test(attemptsFlag) || !Number.isSafeInteger(maxAttempts) || maxAttempts <= 0)) {
+      throw new Error("--max-attempts must be a positive integer");
+    }
+    const deadline = Date.now() + timeoutMs;
+    let attempts = 0;
+    let last;
+    while (true) {
+      if (Date.now() >= deadline) {
+        emit({ serviceId, revisionId, success: false, reason: "timeout", attempts, last });
+        process.exitCode = 1;
+        return;
+      }
+      let delay = intervalMs;
+      let report;
+      let received = false;
+      attempts++;
+      try {
+        report = await providerRequest(`${revisionPath}/review`, cfg.apiKey, "GET", void 0, Math.max(1, deadline - Date.now()), 0);
+        received = true;
+      } catch (e) {
+        if (!isRetryableRequestError(e)) throw e;
+        if (e instanceof HttpError && e.retryAfterMs !== void 0) delay = Math.max(intervalMs, e.retryAfterMs);
+      }
+      if (Date.now() >= deadline) continue;
+      if (received) {
+        const revision = object(report?.revision);
+        const state = revision?.state;
+        if (revision?.id !== revisionId || !["DRAFT", "SANDBOX", "IN_REVIEW", "PUBLISHED", "SUSPENDED"].includes(String(state))) {
+          throw new Error("Invalid review response: expected requested revision ID and known state");
+        }
+        last = report;
+        const review = object(report?.review);
+        const manual = review?.outcome === "pending_human" || review?.status === "PENDING_HUMAN";
+        const rejected = review?.outcome === "rejected" || ["REJECTED", "AUTO_FAILED"].includes(String(review?.status));
+        if (state === "PUBLISHED" || state !== "IN_REVIEW" || manual || rejected) {
+          const success = state === "PUBLISHED";
+          emit({ ...report, serviceId, revisionId, success, reason: success ? "published" : manual ? "manual_review_required" : rejected ? "rejected" : "not_published" });
+          if (!success) process.exitCode = 1;
+          return;
+        }
+      }
+      if (attempts >= maxAttempts) {
+        emit({ serviceId, revisionId, success: false, reason: "max_attempts", attempts, last });
+        process.exitCode = 1;
+        return;
+      }
+      await new Promise((resolve4) => setTimeout(resolve4, Math.min(delay, Math.max(0, deadline - Date.now()))));
+    }
+  } catch (e) {
+    let message;
+    if (e instanceof HttpError) {
+      message = `HTTP ${e.status}`;
+      if (e.status === 403) message += `: requires ${SCOPES[command]}; check key permissions, service ownership, and IP restrictions in the xAPI Console`;
+      else if (e.status === 401) message += ": invalid or expired API key";
+      else if (e.status === 400) message += ": request rejected; check spec-rules, configuration, and revision state";
+      else if (e.status === 409 && /"code"\s*:\s*"REVISION_NOT_EDITABLE"/.test(e.message)) {
+        message += ": revision is not editable. Only DRAFT or SANDBOX can be updated; use a working revision for changes to a published API";
+      }
+      if (["import", "update", "submit"].includes(command)) message += ". No automatic retry was made; inspect provider list/get/review before retrying";
+    } else message = e instanceof SyntaxError ? "Invalid JSON response from provider API" : e instanceof Error ? e.message : "Unknown error";
+    err(`provider ${command} failed`, redactProvider(message, secrets));
+  }
+}
+
+// src/commands/provider.ts
 var READ_RETRIES3 = 2;
 var BASE = "/api/api-services/agent";
 var PROVIDER_HELP = `xapi-to provider - Manage provider services and their content
 
 USAGE
+  xapi-to provider spec-rules
+  xapi-to provider import --file <openapi.json> [--private-headers-file <path>]
+  xapi-to provider update <service-id> --revision <id> --file <contract.json>
+  xapi-to provider submit <service-id> --revision <id> [--changelog <text>]
+  xapi-to provider wait <service-id> --revision <id> [--interval 2s] [--timeout 10m]
   xapi-to provider list
   xapi-to provider get <service-id> [--version <version>]
-  xapi-to provider create --file <service.json>
-  xapi-to provider update <service-id> [metadata flags]
+  xapi-to provider create --file <service.json> [rate-limit flags]
+  xapi-to provider update <service-id> [metadata/rate-limit flags]
   xapi-to provider versions <service-id>
   xapi-to provider version update <service-id> <version-id> --file <contract.json> [--replace]
   xapi-to provider major create <service-id>
@@ -2651,6 +3056,14 @@ METADATA FLAGS
   --logo-url <url>                 Service logo URL
   --category <category>            Marketplace category
 
+SERVICE RATE-LIMIT FLAGS
+  --rate-limit-requests <count>          Allowed requests per period (1-1000000)
+  --rate-limit-period-seconds <seconds>  Period length in seconds (1-86400)
+  --clear-rate-limit                     Disable the service rate limit
+
+Set both numeric flags together. Limits apply only to PROXY services and use
+one shared quota for each user and service, including all API keys of that user.
+
 SCOPES
   list/get/versions/review/diff/skill context: service:read
   create: service:create
@@ -2688,6 +3101,26 @@ function positiveInt(raw, name, max) {
 function boolFlag(flags, name) {
   return ["true", "1", "yes"].includes((flags[name] || "").toLowerCase());
 }
+function applyRateLimitFlags(body, flags) {
+  const requests = flags["rate-limit-requests"];
+  const periodSeconds = flags["rate-limit-period-seconds"];
+  const clear = boolFlag(flags, "clear-rate-limit");
+  if (clear && (requests !== void 0 || periodSeconds !== void 0)) {
+    err("--clear-rate-limit cannot be combined with --rate-limit-requests or --rate-limit-period-seconds");
+  }
+  if (requests === void 0 !== (periodSeconds === void 0)) {
+    err("--rate-limit-requests and --rate-limit-period-seconds must be provided together");
+  }
+  if (clear) {
+    body.rateLimitConfig = null;
+  } else if (requests !== void 0) {
+    body.rateLimitConfig = {
+      requests: positiveInt(requests, "--rate-limit-requests", 1e6),
+      periodSeconds: positiveInt(periodSeconds, "--rate-limit-period-seconds", 86400)
+    };
+  }
+  return body;
+}
 async function readText(path, flagName) {
   if (path === "true") err(`${flagName} requires a path or - for stdin`);
   if (path === "-") {
@@ -2697,7 +3130,7 @@ async function readText(path, flagName) {
     }
     return Buffer.concat(chunks).toString("utf8");
   }
-  return readFile2(resolve2(path), "utf8");
+  return readFile3(resolve2(path), "utf8");
 }
 async function textOption(flags, directName, fileName) {
   const direct = flags[directName];
@@ -2711,11 +3144,12 @@ async function textOption(flags, directName, fileName) {
 }
 async function readJsonObject(path, flagName = "--file") {
   if (!path || path === "true") err(`${flagName} requires a JSON file path or - for stdin`);
+  const text = await readText(path, flagName);
   let parsed;
   try {
-    parsed = JSON.parse(await readText(path, flagName));
-  } catch (error) {
-    err(`invalid JSON from ${flagName}`, error.message);
+    parsed = JSON.parse(text);
+  } catch {
+    err(`invalid JSON from ${flagName}`, "Input must be valid JSON.");
   }
   if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
     err(`${flagName} must contain a JSON object`);
@@ -2745,8 +3179,9 @@ async function metadataBody(flags) {
   }
   if (boolFlag(flags, "clear-about")) body.aboutMarkdown = null;
   if (boolFlag(flags, "clear-website")) body.website = null;
+  applyRateLimitFlags(body, flags);
   if (Object.keys(body).length === 0) {
-    err("no provider metadata supplied", "Pass --file or at least one metadata flag.");
+    err("no provider settings supplied", "Pass --file or at least one metadata or rate-limit flag.");
   }
   return body;
 }
@@ -2763,9 +3198,12 @@ async function writeExclusive(path, content, force) {
 }
 async function provider(args, flags) {
   if (flags.help || args.length === 0) {
-    console.log(PROVIDER_HELP);
+    console.log(PROVIDER_HELP + "\n" + PROVIDER_ONBOARDING_HELP);
     return;
   }
+  const onboardingCommand = ["spec-rules", "import", "submit", "wait"].includes(args[0]);
+  const revisionAlias = ["update", "review"].includes(args[0]) && flags.revision !== void 0;
+  if (onboardingCommand || revisionAlias) return providerOnboarding(args, flags);
   const cfg = getConfig();
   requireApiKey(cfg);
   const apiKey = cfg.apiKey;
@@ -2784,14 +3222,17 @@ async function provider(args, flags) {
         result = await apiKeyApiRequest(XAPI_API_HOST, apiKey, `${path.pathname}${path.search}`, { retries: READ_RETRIES3 });
         break;
       }
-      case "create":
+      case "create": {
+        const body = await readJsonObject(required(flags.file, "xapi-to provider create --file <service.json>"));
+        applyRateLimitFlags(body, flags);
         result = await apiKeyApiRequest(XAPI_API_HOST, apiKey, `${BASE}/services`, {
           method: "POST",
-          body: await readJsonObject(required(flags.file, "xapi-to provider create --file <service.json>"))
+          body
         });
         break;
+      }
       case "update": {
-        const id = required(rest[0], "xapi-to provider update <service-id> [metadata flags]");
+        const id = required(rest[0], "xapi-to provider update <service-id> [metadata/rate-limit flags]");
         result = await apiKeyApiRequest(XAPI_API_HOST, apiKey, servicePath(id), {
           method: "PATCH",
           body: await metadataBody(flags)
@@ -2930,14 +3371,15 @@ async function provider(args, flags) {
       default:
         err(`unknown provider command: ${command}`, 'Run "xapi-to provider --help".');
     }
-    output(result, flags.format);
+    output(redactProvider(result, [apiKey]), flags.format);
   } catch (error) {
-    err("provider request failed", error.message);
+    const message = error instanceof HttpError ? `HTTP ${error.status}` : String(redactProvider(error instanceof Error ? error.message : "Unknown error", [apiKey]));
+    err("provider request failed", message);
   }
 }
 
 // src/commands/skill.ts
-import { readdir, readFile as readFile3 } from "fs/promises";
+import { readdir, readFile as readFile4 } from "fs/promises";
 import { relative, resolve as resolve3, sep } from "path";
 var READ_RETRIES4 = 2;
 var MAX_FILES = 100;
@@ -3004,7 +3446,7 @@ async function collectInlineFiles(directory) {
       if (files.length >= MAX_FILES) {
         throw new Error(`skill package exceeds ${MAX_FILES} files`);
       }
-      const content = await readFile3(absolute);
+      const content = await readFile4(absolute);
       if (content.byteLength > MAX_FILE_BYTES) {
         throw new Error(`skill file ${entry.name} exceeds ${MAX_FILE_BYTES} bytes`);
       }

package/dist/openai-sandbox-client.js

@@ -7,7 +7,7 @@ import {
   sandboxQuote,
   sandboxStateAction,
   sandboxWait
-} from "./chunk-UEQCIJ7T.js";
+} from "./chunk-2YRWNREY.js";
 
 // src/openai-sandbox-client.ts
 import { randomUUID } from "crypto";