@helloaigent-dev/cli - npm Package Compare versions

Comparing version 0.1.0 to 0.2.0

dist/index.js

@@ -8,5 +8,9 @@ #!/usr/bin/env node
 // Config (flags win over env):
-//   --api    / HELLOAIGENT_API           API base (default https://api.helloaigent.dev)
-//   --admin-token / HELLOAIGENT_ADMIN_TOKEN   admin token — required to create/list feeds
-//   --token  / HELLOAIGENT_TOKEN          publish token (a feed's publisher token, or the admin token)
+//   --api      / HELLOAIGENT_API            API base (default https://api.helloaigent.dev)
+//   --api-key  / HELLOAIGENT_API_KEY        workspace API key (hak_...) — required to create/list
+//                                            feeds, unless using the admin token; preferred over it
+//                                            when both are set
+//   --admin-token / HELLOAIGENT_ADMIN_TOKEN admin token — alternative to --api-key (ops/dogfood only)
+//   --token    / HELLOAIGENT_TOKEN          publish token (a feed's own publisher token); falls back
+//                                            to --api-key / HELLOAIGENT_API_KEY if unset
 import { readFileSync } from 'node:fs';
@@ -89,8 +93,9 @@ import { writeFileSync } from 'node:fs';
   helloaigent feed create   --title <t> --publisher <name> --site <url> --description <d>
-                            [--topics a,b,c] [--id <slug>]   (needs admin token)
-  helloaigent feed list                                       (needs admin token)
+                            [--topics a,b,c] [--id <slug>]   (needs a workspace API key or admin token)
+  helloaigent feed list                                       (needs a workspace API key or admin token)
   helloaigent feed discovery <feed-id> [--out <file>]         (public)
   helloaigent publish       --feed <id> --type <offer|announcement|restock|content>
                             --title <t> --summary <s> (--body <md> | --body-file <path>)
-                            [--data <json>] [--action <json> ...]   (needs publish token)
+                            [--data <json>] [--action <json> ...]   (needs publish token,
+                            or a workspace API key for a feed you own)
   helloaigent health <feed-id>                                (public) discovery reachable,
@@ -101,4 +106,7 @@ key present, schema sanity — exits 1 if degraded
   --api <url>            API base            (env HELLOAIGENT_API, default ${DEFAULT_API})
-  --admin-token <tok>    create/list feeds   (env HELLOAIGENT_ADMIN_TOKEN)
-  --token <tok>          publish             (env HELLOAIGENT_TOKEN)
+  --api-key <key>        workspace API key   (env HELLOAIGENT_API_KEY, a hak_... key — see
+                          "helloaigent-publisher" / the console's API keys screen; preferred
+                          over --admin-token when both are set)
+  --admin-token <tok>    admin token, ops/dogfood only (env HELLOAIGENT_ADMIN_TOKEN)
+  --token <tok>          publish             (env HELLOAIGENT_TOKEN; falls back to --api-key)
 
@@ -112,12 +120,26 @@ Examples:
 `;
-function adminToken(flags) {
-    const t = str(flags, 'admin-token') ?? process.env.HELLOAIGENT_ADMIN_TOKEN;
-    if (!t)
-        die('admin token required — pass --admin-token or set HELLOAIGENT_ADMIN_TOKEN');
-    return t;
+function apiKey(flags) {
+    return str(flags, 'api-key') ?? process.env.HELLOAIGENT_API_KEY;
 }
+/**
+ * Feed create/list are "operate this workspace" calls — a workspace API key
+ * authorizes exactly what that workspace's owner can do, which includes
+ * creating and listing its own feeds. Prefer the workspace key over the
+ * global admin token when both are set, since the key is what a self-serve
+ * user can actually be handed — the admin token is a global ops credential
+ * no self-serve user is ever given.
+ */
+function consoleCredential(flags) {
+    const key = apiKey(flags);
+    if (key)
+        return key;
+    const admin = str(flags, 'admin-token') ?? process.env.HELLOAIGENT_ADMIN_TOKEN;
+    if (admin)
+        return admin;
+    die('a credential is required — pass --api-key or --admin-token (or set HELLOAIGENT_API_KEY / HELLOAIGENT_ADMIN_TOKEN)');
+}
 function publishToken(flags) {
-    const t = str(flags, 'token') ?? process.env.HELLOAIGENT_TOKEN;
+    const t = str(flags, 'token') ?? process.env.HELLOAIGENT_TOKEN ?? apiKey(flags);
     if (!t)
-        die('publish token required — pass --token or set HELLOAIGENT_TOKEN');
+        die('publish token required — pass --token/--api-key or set HELLOAIGENT_TOKEN/HELLOAIGENT_API_KEY');
     return t;
@@ -145,3 +167,3 @@ }
         body.id = id;
-    const out = await call('POST', `${apiBase(flags)}/v0/feeds`, adminToken(flags), body);
+    const out = await call('POST', `${apiBase(flags)}/v0/feeds`, consoleCredential(flags), body);
     process.stdout.write(`✅ feed created: ${out.feed_id}\n\n`);
@@ -156,3 +178,3 @@ process.stdout.write(`  publisher token (shown once — save it now):\n    ${out.publisher_token}\n\n`);
 async function feedList(flags) {
-    const out = await call('GET', `${apiBase(flags)}/v0/feeds`, adminToken(flags));
+    const out = await call('GET', `${apiBase(flags)}/v0/feeds`, consoleCredential(flags));
     const feeds = out.feeds ?? [];
@@ -159,0 +181,0 @@ if (!feeds.length) {

package.json

 {
   "name": "@helloaigent-dev/cli",
-  "version": "0.1.0",
+  "version": "0.2.0",
   "description": "Hello Aigent publisher CLI — create feeds and publish signed updates from the terminal (or your agent).",
@@ -5,0 +5,0 @@ "license": "MIT",

README.md

@@ -27,8 +27,9 @@ # @helloaigent-dev/cli
 helloaigent feed create   --title <t> --publisher <name> --site <url> --description <d>
-                          [--topics a,b,c] [--id <slug>]   (needs admin token)
-helloaigent feed list                                       (needs admin token)
+                          [--topics a,b,c] [--id <slug>]   (needs a workspace API key or admin token)
+helloaigent feed list                                       (needs a workspace API key or admin token)
 helloaigent feed discovery <feed-id> [--out <file>]         (public)
 helloaigent publish       --feed <id> --type <offer|announcement|restock|content>
                           --title <t> --summary <s> (--body <md> | --body-file <path>)
-                          [--data <json>] [--action <json> ...]   (needs publish token)
+                          [--data <json>] [--action <json> ...]   (needs a publish token, or a
+                          workspace API key for a feed you own)
 helloaigent health <feed-id>                                (public) discovery reachable,
@@ -41,3 +42,4 @@ key present, schema sanity — exits 1 if degraded
   token is shown **once** in the response — save it immediately.
-- `feed list` — list feeds owned by the admin token.
+- `feed list` — with a workspace API key, lists only your workspace's feeds; with
+  the admin token, lists every feed.
 - `feed discovery <feed-id>` — fetch the generated `hello-aigent.json` discovery
@@ -62,2 +64,3 @@ document for a feed. Public, no auth needed. `--out <file>` writes it to disk
 | `--api <url>` | `HELLOAIGENT_API` | all commands | `https://api.helloaigent.dev` |
+| `--api-key <key>` | `HELLOAIGENT_API_KEY` | `feed create`, `feed list`, `publish` (fallback) | — |
 | `--admin-token <tok>` | `HELLOAIGENT_ADMIN_TOKEN` | `feed create`, `feed list` | — |
@@ -68,6 +71,17 @@ | `--token <tok>` | `HELLOAIGENT_TOKEN` | `publish` | — |
 
+**Workspace API key vs. admin token:** `--api-key` / `HELLOAIGENT_API_KEY` is a
+`hak_...` **workspace API key**, minted from the Hello Aigent console (Settings →
+API keys) once you've signed up. It scopes `feed create`/`feed list`/`publish` to
+*your own* workspace and is what a self-serve account actually gets — it cannot
+create, list, or revoke API keys (that requires signing in to the console itself).
+`--admin-token` / `HELLOAIGENT_ADMIN_TOKEN` is a separate, unrestricted, ops-only
+credential not handed out to self-serve accounts. Where both `feed create`/`feed
+list` accept either, the workspace API key is preferred when both are set; `publish`
+prefers `--token` (a feed's own publisher token) first, then falls back to
+`--api-key`.
+
 ## Example
 
 ```bash
-export HELLOAIGENT_ADMIN_TOKEN=admin_...
+export HELLOAIGENT_API_KEY=hak_...   # from the console's API keys screen
 
@@ -74,0 +88,0 @@ helloaigent feed create --title "Acme Roast Drops" --publisher "Acme Coffee" \

New alerts

Environment variable access

Supply chain risk

Package accesses environment variables, which may be a sign of credential stuffing or data theft.

Improved metrics

Total package byte prevSize

19859

14.68%

Lines of code

291

8.18%

Number of lines in readme file

112

14.29%

Worsened metrics

Number of low supply chain risk alerts

7

16.67%

No dependency changes