@autohq/cli 0.1.364 → 0.1.366

package/dist/agent-bridge.js

@@ -23492,7 +23492,7 @@ Object.assign(lookup, {
 // package.json
 var package_default = {
   name: "@autohq/cli",
-  version: "0.1.364",
+  version: "0.1.366",
   license: "SEE LICENSE IN README.md",
   publishConfig: {
     access: "public"
@@ -26200,11 +26200,48 @@ var EncryptedSecretValueSchema = external_exports.object({
   dekAuthTag: SecretAesGcmAuthTagSchema
 });
 var SecretDescriptionSchema = external_exports.string().trim().max(1024);
+var SECRET_IDLE_EXPIRY_MAX_SECONDS = 10 * 365 * 24 * 60 * 60;
+var SecretExpiresAtSchema = external_exports.string().datetime({ offset: true });
+var SecretIdleExpirySecondsSchema = external_exports.number().int().min(1).max(SECRET_IDLE_EXPIRY_MAX_SECONDS);
+var SECRET_BINDING_HOST_PATTERN = /^(?=.{1,253}$)([a-z0-9]([a-z0-9-]{0,61}[a-z0-9])?\.)+[a-z]([a-z0-9-]{0,61}[a-z0-9])?$/;
+var SECRET_BINDING_HEADER_PATTERN = /^[!#$%&'*+.^_`|~0-9A-Za-z-]+$/;
+var SECRET_BINDING_FORBIDDEN_HEADERS = /* @__PURE__ */ new Set([
+  "connection",
+  "content-length",
+  "host",
+  "transfer-encoding"
+]);
+var SecretBindingHostSchema = external_exports.string().trim().toLowerCase().regex(
+  SECRET_BINDING_HOST_PATTERN,
+  "Binding hosts must be exact lowercase hostnames (no wildcards, schemes, ports, or paths)"
+);
+var SecretBindingHeaderSchema = external_exports.string().trim().min(1).max(128).regex(SECRET_BINDING_HEADER_PATTERN, "Invalid HTTP header name").refine(
+  (header) => !SECRET_BINDING_FORBIDDEN_HEADERS.has(header.toLowerCase()),
+  "This header cannot carry a secret binding"
+);
+var SecretBindingSchema = external_exports.object({
+  hosts: external_exports.array(SecretBindingHostSchema).min(1).max(16),
+  header: SecretBindingHeaderSchema,
+  format: external_exports.string().min(1).max(256).refine(
+    (format) => format.includes("{value}"),
+    "Binding format must contain the {value} placeholder"
+  ).optional()
+});
 var SecretSetRequestSchema = external_exports.object({
   value: external_exports.string(),
   description: SecretDescriptionSchema.nullable().optional(),
-  protected: external_exports.boolean().optional()
-});
+  protected: external_exports.boolean().optional(),
+  binding: SecretBindingSchema.nullable().optional(),
+  expiresAt: SecretExpiresAtSchema.nullable().optional(),
+  idleExpirySeconds: SecretIdleExpirySecondsSchema.nullable().optional()
+});
+var SecretExpiryUpdateRequestSchema = external_exports.object({
+  expiresAt: SecretExpiresAtSchema.nullable().optional(),
+  idleExpirySeconds: SecretIdleExpirySecondsSchema.nullable().optional()
+}).refine(
+  (input) => input.expiresAt !== void 0 || input.idleExpirySeconds !== void 0,
+  { message: "Provide expiresAt and/or idleExpirySeconds" }
+);
 var SecretRotateRequestSchema = external_exports.object({
   value: external_exports.string()
 });
@@ -26215,10 +26252,21 @@ var SecretMetadataSchema = external_exports.object({
   name: ResourceNameSchema,
   description: external_exports.string().nullable(),
   protected: external_exports.boolean(),
+  // Defaulted rather than required so a newer client parsing an older
+  // server's metadata (deploy skew) treats an absent binding as unbound.
+  binding: SecretBindingSchema.nullable().default(null),
   createdAt: external_exports.string().datetime(),
   updatedAt: external_exports.string().datetime(),
   lastRotatedAt: external_exports.string().datetime().nullable(),
-  lastAccessedAt: external_exports.string().datetime().nullable()
+  lastAccessedAt: external_exports.string().datetime().nullable(),
+  // Like binding, defaulted for deploy skew: an older server that never sends
+  // expiry fields parses as a secret that never expires.
+  expiresAt: external_exports.string().datetime().nullable().default(null),
+  idleExpirySeconds: external_exports.number().int().nullable().default(null),
+  // Computed server-side: true when expiresAt has passed or the secret has
+  // been unused past idleExpirySeconds. Expired secrets resolve as absent
+  // everywhere but stay listed so operators can see and delete them.
+  expired: external_exports.boolean().default(false)
 });
 var SecretSetResponseSchema = external_exports.object({
   secret: SecretMetadataSchema
@@ -26229,6 +26277,9 @@ var SecretListResponseSchema = external_exports.object({
 var SecretDeleteResponseSchema = external_exports.object({
   secret: SecretMetadataSchema
 });
+var SecretExpiryUpdateResponseSchema = external_exports.object({
+  secret: SecretMetadataSchema
+});
 var SecretRevealResponseSchema = external_exports.object({
   secret: SecretMetadataSchema,
   value: external_exports.string()

package/dist/index.js

@@ -17599,7 +17599,7 @@ var init_mounts = __esm({
 });
 
 // ../../packages/schemas/src/secrets.ts
-var SECRET_ENCRYPTION_ALGORITHM, SecretEnvNameSchema, SecretCiphertextFieldSchema, SecretAesGcmIvSchema, SecretAesGcmAuthTagSchema, SecretEnvValueSchema, SecretEnvSchema, EncryptedSecretValueSchema, SecretDescriptionSchema, SecretSetRequestSchema, SecretRotateRequestSchema, SecretMetadataSchema, SecretSetResponseSchema, SecretListResponseSchema, SecretDeleteResponseSchema, SecretRevealResponseSchema;
+var SECRET_ENCRYPTION_ALGORITHM, SecretEnvNameSchema, SecretCiphertextFieldSchema, SecretAesGcmIvSchema, SecretAesGcmAuthTagSchema, SecretEnvValueSchema, SecretEnvSchema, EncryptedSecretValueSchema, SecretDescriptionSchema, SECRET_IDLE_EXPIRY_MAX_SECONDS, SecretExpiresAtSchema, SecretIdleExpirySecondsSchema, SECRET_BINDING_HOST_PATTERN, SECRET_BINDING_HEADER_PATTERN, SECRET_BINDING_FORBIDDEN_HEADERS, SecretBindingHostSchema, SecretBindingHeaderSchema, SecretBindingSchema, SecretSetRequestSchema, SecretExpiryUpdateRequestSchema, SecretRotateRequestSchema, SecretMetadataSchema, SecretSetResponseSchema, SecretListResponseSchema, SecretDeleteResponseSchema, SecretExpiryUpdateResponseSchema, SecretRevealResponseSchema;
 var init_secrets = __esm({
   "../../packages/schemas/src/secrets.ts"() {
     "use strict";
@@ -17632,11 +17632,48 @@ var init_secrets = __esm({
       dekAuthTag: SecretAesGcmAuthTagSchema
     });
     SecretDescriptionSchema = external_exports.string().trim().max(1024);
+    SECRET_IDLE_EXPIRY_MAX_SECONDS = 10 * 365 * 24 * 60 * 60;
+    SecretExpiresAtSchema = external_exports.string().datetime({ offset: true });
+    SecretIdleExpirySecondsSchema = external_exports.number().int().min(1).max(SECRET_IDLE_EXPIRY_MAX_SECONDS);
+    SECRET_BINDING_HOST_PATTERN = /^(?=.{1,253}$)([a-z0-9]([a-z0-9-]{0,61}[a-z0-9])?\.)+[a-z]([a-z0-9-]{0,61}[a-z0-9])?$/;
+    SECRET_BINDING_HEADER_PATTERN = /^[!#$%&'*+.^_`|~0-9A-Za-z-]+$/;
+    SECRET_BINDING_FORBIDDEN_HEADERS = /* @__PURE__ */ new Set([
+      "connection",
+      "content-length",
+      "host",
+      "transfer-encoding"
+    ]);
+    SecretBindingHostSchema = external_exports.string().trim().toLowerCase().regex(
+      SECRET_BINDING_HOST_PATTERN,
+      "Binding hosts must be exact lowercase hostnames (no wildcards, schemes, ports, or paths)"
+    );
+    SecretBindingHeaderSchema = external_exports.string().trim().min(1).max(128).regex(SECRET_BINDING_HEADER_PATTERN, "Invalid HTTP header name").refine(
+      (header) => !SECRET_BINDING_FORBIDDEN_HEADERS.has(header.toLowerCase()),
+      "This header cannot carry a secret binding"
+    );
+    SecretBindingSchema = external_exports.object({
+      hosts: external_exports.array(SecretBindingHostSchema).min(1).max(16),
+      header: SecretBindingHeaderSchema,
+      format: external_exports.string().min(1).max(256).refine(
+        (format) => format.includes("{value}"),
+        "Binding format must contain the {value} placeholder"
+      ).optional()
+    });
     SecretSetRequestSchema = external_exports.object({
       value: external_exports.string(),
       description: SecretDescriptionSchema.nullable().optional(),
-      protected: external_exports.boolean().optional()
-    });
+      protected: external_exports.boolean().optional(),
+      binding: SecretBindingSchema.nullable().optional(),
+      expiresAt: SecretExpiresAtSchema.nullable().optional(),
+      idleExpirySeconds: SecretIdleExpirySecondsSchema.nullable().optional()
+    });
+    SecretExpiryUpdateRequestSchema = external_exports.object({
+      expiresAt: SecretExpiresAtSchema.nullable().optional(),
+      idleExpirySeconds: SecretIdleExpirySecondsSchema.nullable().optional()
+    }).refine(
+      (input) => input.expiresAt !== void 0 || input.idleExpirySeconds !== void 0,
+      { message: "Provide expiresAt and/or idleExpirySeconds" }
+    );
     SecretRotateRequestSchema = external_exports.object({
       value: external_exports.string()
     });
@@ -17647,10 +17684,21 @@ var init_secrets = __esm({
       name: ResourceNameSchema,
       description: external_exports.string().nullable(),
       protected: external_exports.boolean(),
+      // Defaulted rather than required so a newer client parsing an older
+      // server's metadata (deploy skew) treats an absent binding as unbound.
+      binding: SecretBindingSchema.nullable().default(null),
       createdAt: external_exports.string().datetime(),
       updatedAt: external_exports.string().datetime(),
       lastRotatedAt: external_exports.string().datetime().nullable(),
-      lastAccessedAt: external_exports.string().datetime().nullable()
+      lastAccessedAt: external_exports.string().datetime().nullable(),
+      // Like binding, defaulted for deploy skew: an older server that never sends
+      // expiry fields parses as a secret that never expires.
+      expiresAt: external_exports.string().datetime().nullable().default(null),
+      idleExpirySeconds: external_exports.number().int().nullable().default(null),
+      // Computed server-side: true when expiresAt has passed or the secret has
+      // been unused past idleExpirySeconds. Expired secrets resolve as absent
+      // everywhere but stay listed so operators can see and delete them.
+      expired: external_exports.boolean().default(false)
     });
     SecretSetResponseSchema = external_exports.object({
       secret: SecretMetadataSchema
@@ -17661,6 +17709,9 @@ var init_secrets = __esm({
     SecretDeleteResponseSchema = external_exports.object({
       secret: SecretMetadataSchema
     });
+    SecretExpiryUpdateResponseSchema = external_exports.object({
+      secret: SecretMetadataSchema
+    });
     SecretRevealResponseSchema = external_exports.object({
       secret: SecretMetadataSchema,
       value: external_exports.string()
@@ -30511,6 +30562,25 @@ function createApiClient(input) {
       }
       return SecretSetResponseSchema.parse(await response.json());
     },
+    async updateSecretExpiry(name, request, options = {}) {
+      const organization = await activeOrganization();
+      const path2 = `${secretPath(organization.organizationId, options.projectId, name)}/expiry`;
+      const response = await authenticatedFetch(
+        apiUrl(path2, options.apiBaseUrl),
+        {
+          method: "PATCH",
+          headers: {
+            "content-type": "application/json"
+          },
+          body: JSON.stringify(request)
+        },
+        options.apiBaseUrl
+      );
+      if (!response.ok) {
+        throw new Error(await responseErrorMessage(response));
+      }
+      return SecretExpiryUpdateResponseSchema.parse(await response.json());
+    },
     async revealSecret(name, options = {}) {
       const organization = await activeOrganization();
       const path2 = `${secretPath(organization.organizationId, options.projectId, name)}/value`;
@@ -31577,7 +31647,7 @@ var init_package = __esm({
   "package.json"() {
     package_default = {
       name: "@autohq/cli",
-      version: "0.1.364",
+      version: "0.1.366",
       license: "SEE LICENSE IN README.md",
       publishConfig: {
         access: "public"
@@ -50019,6 +50089,7 @@ function memberLine2(member, style) {
 }
 
 // src/commands/secrets/actions.ts
+init_src();
 async function setSecret(input) {
   const value = await secretValue({
     options: input.commandOptions,
@@ -50030,7 +50101,9 @@ async function setSecret(input) {
     {
       value,
       ...input.commandOptions.description === void 0 ? {} : { description: input.commandOptions.description },
-      ...resolveProtectedFlag(input.commandOptions)
+      ...resolveProtectedFlag(input.commandOptions),
+      ...resolveExpiryFields(input.commandOptions),
+      ...resolveBindingFlags(input.commandOptions)
     },
     {
       projectId: await secretProjectId(input),
@@ -50055,6 +50128,17 @@ async function rotateSecret(input) {
   );
   writeRotateResponse(response, input);
 }
+async function updateSecretExpiry(input) {
+  const fields = resolveExpiryFields(input.commandOptions);
+  if (fields.expiresAt === void 0 && fields.idleExpirySeconds === void 0) {
+    throw new Error("Provide --expires-at and/or --idle-expiry.");
+  }
+  const response = await input.client.updateSecretExpiry(input.name, fields, {
+    projectId: await secretProjectId(input),
+    apiBaseUrl: input.commandOptions.apiBaseUrl
+  });
+  writeExpiryResponse(response, input);
+}
 async function revealSecret(input) {
   const response = await input.client.revealSecret(input.name, {
     projectId: await secretProjectId(input),
@@ -50077,9 +50161,23 @@ async function listSecrets(input) {
   }
   for (const secret of response.secrets) {
     const flags = secret.protected ? "protected" : "revealable";
-    input.context.writeOutput(
-      `${secret.name}  ${scopeLabel(secret.projectId)}  ${flags}  updated ${secret.updatedAt}`
-    );
+    const parts = [
+      secret.name,
+      scopeLabel(secret.projectId),
+      flags,
+      `updated ${secret.updatedAt}`
+    ];
+    if (secret.expired) {
+      parts.push("expired");
+    } else {
+      if (secret.expiresAt !== null) {
+        parts.push(`expires ${secret.expiresAt}`);
+      }
+      if (secret.idleExpirySeconds !== null) {
+        parts.push(`idle-expiry ${secret.idleExpirySeconds}s`);
+      }
+    }
+    input.context.writeOutput(parts.join("  "));
   }
 }
 function resolveProtectedFlag(options) {
@@ -50094,6 +50192,67 @@ function resolveProtectedFlag(options) {
   }
   return {};
 }
+function parseExpiresAt(input) {
+  if (input === "never") {
+    return null;
+  }
+  const parsed = new Date(input);
+  if (Number.isNaN(parsed.getTime())) {
+    throw new Error(
+      `Invalid --expires-at value "${input}". Use an ISO 8601 timestamp or "never".`
+    );
+  }
+  return parsed.toISOString();
+}
+function parseIdleExpiry(input) {
+  if (input === "never") {
+    return null;
+  }
+  const match = /^(\d+)(s|m|h|d)?$/.exec(input);
+  if (!match) {
+    throw new Error(
+      `Invalid --idle-expiry value "${input}". Use seconds or a duration like 30d, 12h, 90m, 3600s, or "never".`
+    );
+  }
+  const unitSeconds = { s: 1, m: 60, h: 3600, d: 86400 }[match[2] ?? "s"] ?? 1;
+  const seconds = Number(match[1]) * unitSeconds;
+  if (seconds < 1 || seconds > SECRET_IDLE_EXPIRY_MAX_SECONDS) {
+    throw new Error(
+      `--idle-expiry must be between 1 second and ${SECRET_IDLE_EXPIRY_MAX_SECONDS} seconds (10 years).`
+    );
+  }
+  return seconds;
+}
+function resolveExpiryFields(options) {
+  return {
+    ...options.expiresAt === void 0 ? {} : { expiresAt: parseExpiresAt(options.expiresAt) },
+    ...options.idleExpiry === void 0 ? {} : { idleExpirySeconds: parseIdleExpiry(options.idleExpiry) }
+  };
+}
+function resolveBindingFlags(options) {
+  const hasBindingFlags = (options.bindHost?.length ?? 0) > 0 || options.bindHeader !== void 0 || options.bindFormat !== void 0;
+  if (options.unbind) {
+    if (hasBindingFlags) {
+      throw new Error("Use either --unbind or the --bind-* flags, not both.");
+    }
+    return { binding: null };
+  }
+  if (!hasBindingFlags) {
+    return {};
+  }
+  if (!options.bindHost?.length || options.bindHeader === void 0) {
+    throw new Error(
+      "Binding a secret requires at least one --bind-host and a --bind-header."
+    );
+  }
+  return {
+    binding: {
+      hosts: options.bindHost,
+      header: options.bindHeader,
+      ...options.bindFormat === void 0 ? {} : { format: options.bindFormat }
+    }
+  };
+}
 async function removeSecret(input) {
   await confirmDestructiveAction(input.context, {
     message: `This will remove secret "${input.name}".`,
@@ -50175,6 +50334,16 @@ function writeRotateResponse(response, input) {
     `secret ${response.secret.name} rotated scope=${scopeLabel(response.secret.projectId)}`
   );
 }
+function writeExpiryResponse(response, input) {
+  if (input.commandOptions.json) {
+    input.context.writeOutput(JSON.stringify(response));
+    return;
+  }
+  const idle = response.secret.idleExpirySeconds === null ? "never" : `${response.secret.idleExpirySeconds}s`;
+  input.context.writeOutput(
+    `secret ${response.secret.name} expiry updated scope=${scopeLabel(response.secret.projectId)} expires=${response.secret.expiresAt ?? "never"} idle=${idle}`
+  );
+}
 function writeRevealResponse(response, input) {
   if (input.commandOptions.json) {
     input.context.writeOutput(JSON.stringify(response));
@@ -50248,10 +50417,27 @@ function registerSecretCommands(program, context) {
   secrets.command("set").description("Create or update a secret without printing its value.").argument("<name>", "secret name").option("--project <project>", "project id; defaults to organization scope").option("--stdin", "read the secret value from stdin").option("--value <value>", "secret value").option(
     "--from-env <name>",
     "read the secret value from an environment variable"
-  ).option("--description <text>", "human-readable description for the secret").option("--protected", "mark write-only: refuse plaintext reveal (default)").option(
+  ).option("--description <text>", "human-readable description for the secret").option(
+    "--bind-host <host>",
+    "bind the secret to an exact destination host (repeatable); bound secrets are injected at the sandbox edge instead of entering the sandbox",
+    (host, hosts) => [...hosts, host],
+    []
+  ).option(
+    "--bind-header <header>",
+    "HTTP header the bound secret is injected into (e.g. Authorization)"
+  ).option(
+    "--bind-format <format>",
+    'header value template around the secret, e.g. "Bearer {value}"'
+  ).option("--unbind", "clear an existing destination binding").option("--protected", "mark write-only: refuse plaintext reveal (default)").option(
     "--unprotected",
     "allow scope-gated plaintext reveal of this secret"
-  ).option("--raw", "allow empty values and preserve stdin exactly").option("--json", "print the updated secret metadata as JSON").option("--api-url <url>", "Auto API base URL").option("--api-base-url <url>", "Auto API base URL").action(async (name, commandOptions) => {
+  ).option("--raw", "allow empty values and preserve stdin exactly").option(
+    "--expires-at <timestamp>",
+    'absolute expiry as an ISO 8601 timestamp, or "never" to clear'
+  ).option(
+    "--idle-expiry <duration>",
+    'expire after this long unused (seconds or 30d/12h/90m/3600s), or "never" to clear'
+  ).option("--json", "print the updated secret metadata as JSON").option("--api-url <url>", "Auto API base URL").option("--api-base-url <url>", "Auto API base URL").action(async (name, commandOptions) => {
     await setSecret({
       client: createContextApiClient(context),
       commandOptions: withApiBaseUrl(context, commandOptions),
@@ -50270,6 +50456,20 @@ function registerSecretCommands(program, context) {
       name
     });
   });
+  secrets.command("expiry").description("Update a secret's expiry without changing its value.").argument("<name>", "secret name").option("--project <project>", "project id; defaults to organization scope").option(
+    "--expires-at <timestamp>",
+    'absolute expiry as an ISO 8601 timestamp, or "never" to clear'
+  ).option(
+    "--idle-expiry <duration>",
+    'expire after this long unused (seconds or 30d/12h/90m/3600s), or "never" to clear'
+  ).option("--json", "print the updated secret metadata as JSON").option("--api-url <url>", "Auto API base URL").option("--api-base-url <url>", "Auto API base URL").action(async (name, commandOptions) => {
+    await updateSecretExpiry({
+      client: createContextApiClient(context),
+      commandOptions: withApiBaseUrl(context, commandOptions),
+      context,
+      name
+    });
+  });
   secrets.command("reveal").description(
     "Print the decrypted value of a non-protected secret (audited)."
   ).argument("<name>", "secret name").option("--project <project>", "project id; defaults to organization scope").option("--json", "print the secret value and metadata as JSON").option("--api-url <url>", "Auto API base URL").option("--api-base-url <url>", "Auto API base URL").action(async (name, commandOptions) => {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@autohq/cli",
-  "version": "0.1.364",
+  "version": "0.1.366",
   "license": "SEE LICENSE IN README.md",
   "publishConfig": {
     "access": "public"