| 660 | } |
| 661 | |
| 662 | function tokenHelp(): string { |
| 663 | return `usage: artifacts token <subcommand> [<args>] |
| 664 | |
| 665 | Tokens authenticate git operations against a repository's remote. |
| 666 | The <repo> argument is a session-scoped local name. |
| 667 | |
| 668 | token create <repo> [--scope read|write] [--ttl <dur>] |
| 669 | Mint a token. Prints JSON: { id, plaintext, scope, expiresAt }. |
| 670 | The plaintext is shown ONCE here and nowhere else — capture it. |
| 671 | --scope defaults to write. --ttl accepts seconds or a unit- |
| 672 | suffixed duration (30s, 5m, 1h, 2h30m); defaults to the |
| 673 | service default. |
| 674 | |
| 675 | token list <repo> |
| 676 | Print JSON: { total, tokens: [{ id, scope, state, ... }] }. |
| 677 | Metadata only; no plaintext. |
| 678 | |
| 679 | token get <repo> <id> |
| 680 | Print a single token's metadata by id. No plaintext. |
| 681 | |
| 682 | token delete <repo> <id|plaintext> (alias: revoke) |
| 683 | Revoke a token. Prints a one-line confirmation. |
| 684 | |
| 685 | Example: |
| 686 | artifacts token create build-cache --scope read --ttl 3600 |
| 687 | `; |
| 688 | } |
| 689 | |
| 690 | // --------------------------------------------------------------- |
| 691 | // result + error helpers |