@autohq/cli 0.1.365 → 0.1.366

package/dist/agent-bridge.js

@@ -23492,7 +23492,7 @@ Object.assign(lookup, {
 // package.json
 var package_default = {
   name: "@autohq/cli",
-  version: "0.1.365",
+  version: "0.1.366",
   license: "SEE LICENSE IN README.md",
   publishConfig: {
     access: "public"
@@ -26200,6 +26200,9 @@ var EncryptedSecretValueSchema = external_exports.object({
   dekAuthTag: SecretAesGcmAuthTagSchema
 });
 var SecretDescriptionSchema = external_exports.string().trim().max(1024);
+var SECRET_IDLE_EXPIRY_MAX_SECONDS = 10 * 365 * 24 * 60 * 60;
+var SecretExpiresAtSchema = external_exports.string().datetime({ offset: true });
+var SecretIdleExpirySecondsSchema = external_exports.number().int().min(1).max(SECRET_IDLE_EXPIRY_MAX_SECONDS);
 var SECRET_BINDING_HOST_PATTERN = /^(?=.{1,253}$)([a-z0-9]([a-z0-9-]{0,61}[a-z0-9])?\.)+[a-z]([a-z0-9-]{0,61}[a-z0-9])?$/;
 var SECRET_BINDING_HEADER_PATTERN = /^[!#$%&'*+.^_`|~0-9A-Za-z-]+$/;
 var SECRET_BINDING_FORBIDDEN_HEADERS = /* @__PURE__ */ new Set([
@@ -26228,8 +26231,17 @@ var SecretSetRequestSchema = external_exports.object({
   value: external_exports.string(),
   description: SecretDescriptionSchema.nullable().optional(),
   protected: external_exports.boolean().optional(),
-  binding: SecretBindingSchema.nullable().optional()
+  binding: SecretBindingSchema.nullable().optional(),
+  expiresAt: SecretExpiresAtSchema.nullable().optional(),
+  idleExpirySeconds: SecretIdleExpirySecondsSchema.nullable().optional()
 });
+var SecretExpiryUpdateRequestSchema = external_exports.object({
+  expiresAt: SecretExpiresAtSchema.nullable().optional(),
+  idleExpirySeconds: SecretIdleExpirySecondsSchema.nullable().optional()
+}).refine(
+  (input) => input.expiresAt !== void 0 || input.idleExpirySeconds !== void 0,
+  { message: "Provide expiresAt and/or idleExpirySeconds" }
+);
 var SecretRotateRequestSchema = external_exports.object({
   value: external_exports.string()
 });
@@ -26246,7 +26258,15 @@ var SecretMetadataSchema = external_exports.object({
   createdAt: external_exports.string().datetime(),
   updatedAt: external_exports.string().datetime(),
   lastRotatedAt: external_exports.string().datetime().nullable(),
-  lastAccessedAt: external_exports.string().datetime().nullable()
+  lastAccessedAt: external_exports.string().datetime().nullable(),
+  // Like binding, defaulted for deploy skew: an older server that never sends
+  // expiry fields parses as a secret that never expires.
+  expiresAt: external_exports.string().datetime().nullable().default(null),
+  idleExpirySeconds: external_exports.number().int().nullable().default(null),
+  // Computed server-side: true when expiresAt has passed or the secret has
+  // been unused past idleExpirySeconds. Expired secrets resolve as absent
+  // everywhere but stay listed so operators can see and delete them.
+  expired: external_exports.boolean().default(false)
 });
 var SecretSetResponseSchema = external_exports.object({
   secret: SecretMetadataSchema
@@ -26257,6 +26277,9 @@ var SecretListResponseSchema = external_exports.object({
 var SecretDeleteResponseSchema = external_exports.object({
   secret: SecretMetadataSchema
 });
+var SecretExpiryUpdateResponseSchema = external_exports.object({
+  secret: SecretMetadataSchema
+});
 var SecretRevealResponseSchema = external_exports.object({
   secret: SecretMetadataSchema,
   value: external_exports.string()

package/dist/index.js

@@ -17599,7 +17599,7 @@ var init_mounts = __esm({
 });
 
 // ../../packages/schemas/src/secrets.ts
-var SECRET_ENCRYPTION_ALGORITHM, SecretEnvNameSchema, SecretCiphertextFieldSchema, SecretAesGcmIvSchema, SecretAesGcmAuthTagSchema, SecretEnvValueSchema, SecretEnvSchema, EncryptedSecretValueSchema, SecretDescriptionSchema, SECRET_BINDING_HOST_PATTERN, SECRET_BINDING_HEADER_PATTERN, SECRET_BINDING_FORBIDDEN_HEADERS, SecretBindingHostSchema, SecretBindingHeaderSchema, SecretBindingSchema, SecretSetRequestSchema, SecretRotateRequestSchema, SecretMetadataSchema, SecretSetResponseSchema, SecretListResponseSchema, SecretDeleteResponseSchema, SecretRevealResponseSchema;
+var SECRET_ENCRYPTION_ALGORITHM, SecretEnvNameSchema, SecretCiphertextFieldSchema, SecretAesGcmIvSchema, SecretAesGcmAuthTagSchema, SecretEnvValueSchema, SecretEnvSchema, EncryptedSecretValueSchema, SecretDescriptionSchema, SECRET_IDLE_EXPIRY_MAX_SECONDS, SecretExpiresAtSchema, SecretIdleExpirySecondsSchema, SECRET_BINDING_HOST_PATTERN, SECRET_BINDING_HEADER_PATTERN, SECRET_BINDING_FORBIDDEN_HEADERS, SecretBindingHostSchema, SecretBindingHeaderSchema, SecretBindingSchema, SecretSetRequestSchema, SecretExpiryUpdateRequestSchema, SecretRotateRequestSchema, SecretMetadataSchema, SecretSetResponseSchema, SecretListResponseSchema, SecretDeleteResponseSchema, SecretExpiryUpdateResponseSchema, SecretRevealResponseSchema;
 var init_secrets = __esm({
   "../../packages/schemas/src/secrets.ts"() {
     "use strict";
@@ -17632,6 +17632,9 @@ var init_secrets = __esm({
       dekAuthTag: SecretAesGcmAuthTagSchema
     });
     SecretDescriptionSchema = external_exports.string().trim().max(1024);
+    SECRET_IDLE_EXPIRY_MAX_SECONDS = 10 * 365 * 24 * 60 * 60;
+    SecretExpiresAtSchema = external_exports.string().datetime({ offset: true });
+    SecretIdleExpirySecondsSchema = external_exports.number().int().min(1).max(SECRET_IDLE_EXPIRY_MAX_SECONDS);
     SECRET_BINDING_HOST_PATTERN = /^(?=.{1,253}$)([a-z0-9]([a-z0-9-]{0,61}[a-z0-9])?\.)+[a-z]([a-z0-9-]{0,61}[a-z0-9])?$/;
     SECRET_BINDING_HEADER_PATTERN = /^[!#$%&'*+.^_`|~0-9A-Za-z-]+$/;
     SECRET_BINDING_FORBIDDEN_HEADERS = /* @__PURE__ */ new Set([
@@ -17660,8 +17663,17 @@ var init_secrets = __esm({
       value: external_exports.string(),
       description: SecretDescriptionSchema.nullable().optional(),
       protected: external_exports.boolean().optional(),
-      binding: SecretBindingSchema.nullable().optional()
+      binding: SecretBindingSchema.nullable().optional(),
+      expiresAt: SecretExpiresAtSchema.nullable().optional(),
+      idleExpirySeconds: SecretIdleExpirySecondsSchema.nullable().optional()
     });
+    SecretExpiryUpdateRequestSchema = external_exports.object({
+      expiresAt: SecretExpiresAtSchema.nullable().optional(),
+      idleExpirySeconds: SecretIdleExpirySecondsSchema.nullable().optional()
+    }).refine(
+      (input) => input.expiresAt !== void 0 || input.idleExpirySeconds !== void 0,
+      { message: "Provide expiresAt and/or idleExpirySeconds" }
+    );
     SecretRotateRequestSchema = external_exports.object({
       value: external_exports.string()
     });
@@ -17678,7 +17690,15 @@ var init_secrets = __esm({
       createdAt: external_exports.string().datetime(),
       updatedAt: external_exports.string().datetime(),
       lastRotatedAt: external_exports.string().datetime().nullable(),
-      lastAccessedAt: external_exports.string().datetime().nullable()
+      lastAccessedAt: external_exports.string().datetime().nullable(),
+      // Like binding, defaulted for deploy skew: an older server that never sends
+      // expiry fields parses as a secret that never expires.
+      expiresAt: external_exports.string().datetime().nullable().default(null),
+      idleExpirySeconds: external_exports.number().int().nullable().default(null),
+      // Computed server-side: true when expiresAt has passed or the secret has
+      // been unused past idleExpirySeconds. Expired secrets resolve as absent
+      // everywhere but stay listed so operators can see and delete them.
+      expired: external_exports.boolean().default(false)
     });
     SecretSetResponseSchema = external_exports.object({
       secret: SecretMetadataSchema
@@ -17689,6 +17709,9 @@ var init_secrets = __esm({
     SecretDeleteResponseSchema = external_exports.object({
       secret: SecretMetadataSchema
     });
+    SecretExpiryUpdateResponseSchema = external_exports.object({
+      secret: SecretMetadataSchema
+    });
     SecretRevealResponseSchema = external_exports.object({
       secret: SecretMetadataSchema,
       value: external_exports.string()
@@ -30539,6 +30562,25 @@ function createApiClient(input) {
       }
       return SecretSetResponseSchema.parse(await response.json());
     },
+    async updateSecretExpiry(name, request, options = {}) {
+      const organization = await activeOrganization();
+      const path2 = `${secretPath(organization.organizationId, options.projectId, name)}/expiry`;
+      const response = await authenticatedFetch(
+        apiUrl(path2, options.apiBaseUrl),
+        {
+          method: "PATCH",
+          headers: {
+            "content-type": "application/json"
+          },
+          body: JSON.stringify(request)
+        },
+        options.apiBaseUrl
+      );
+      if (!response.ok) {
+        throw new Error(await responseErrorMessage(response));
+      }
+      return SecretExpiryUpdateResponseSchema.parse(await response.json());
+    },
     async revealSecret(name, options = {}) {
       const organization = await activeOrganization();
       const path2 = `${secretPath(organization.organizationId, options.projectId, name)}/value`;
@@ -31605,7 +31647,7 @@ var init_package = __esm({
   "package.json"() {
     package_default = {
       name: "@autohq/cli",
-      version: "0.1.365",
+      version: "0.1.366",
       license: "SEE LICENSE IN README.md",
       publishConfig: {
         access: "public"
@@ -50047,6 +50089,7 @@ function memberLine2(member, style) {
 }
 
 // src/commands/secrets/actions.ts
+init_src();
 async function setSecret(input) {
   const value = await secretValue({
     options: input.commandOptions,
@@ -50059,6 +50102,7 @@ async function setSecret(input) {
       value,
       ...input.commandOptions.description === void 0 ? {} : { description: input.commandOptions.description },
       ...resolveProtectedFlag(input.commandOptions),
+      ...resolveExpiryFields(input.commandOptions),
       ...resolveBindingFlags(input.commandOptions)
     },
     {
@@ -50084,6 +50128,17 @@ async function rotateSecret(input) {
   );
   writeRotateResponse(response, input);
 }
+async function updateSecretExpiry(input) {
+  const fields = resolveExpiryFields(input.commandOptions);
+  if (fields.expiresAt === void 0 && fields.idleExpirySeconds === void 0) {
+    throw new Error("Provide --expires-at and/or --idle-expiry.");
+  }
+  const response = await input.client.updateSecretExpiry(input.name, fields, {
+    projectId: await secretProjectId(input),
+    apiBaseUrl: input.commandOptions.apiBaseUrl
+  });
+  writeExpiryResponse(response, input);
+}
 async function revealSecret(input) {
   const response = await input.client.revealSecret(input.name, {
     projectId: await secretProjectId(input),
@@ -50106,9 +50161,23 @@ async function listSecrets(input) {
   }
   for (const secret of response.secrets) {
     const flags = secret.protected ? "protected" : "revealable";
-    input.context.writeOutput(
-      `${secret.name}  ${scopeLabel(secret.projectId)}  ${flags}  updated ${secret.updatedAt}`
-    );
+    const parts = [
+      secret.name,
+      scopeLabel(secret.projectId),
+      flags,
+      `updated ${secret.updatedAt}`
+    ];
+    if (secret.expired) {
+      parts.push("expired");
+    } else {
+      if (secret.expiresAt !== null) {
+        parts.push(`expires ${secret.expiresAt}`);
+      }
+      if (secret.idleExpirySeconds !== null) {
+        parts.push(`idle-expiry ${secret.idleExpirySeconds}s`);
+      }
+    }
+    input.context.writeOutput(parts.join("  "));
   }
 }
 function resolveProtectedFlag(options) {
@@ -50123,6 +50192,43 @@ function resolveProtectedFlag(options) {
   }
   return {};
 }
+function parseExpiresAt(input) {
+  if (input === "never") {
+    return null;
+  }
+  const parsed = new Date(input);
+  if (Number.isNaN(parsed.getTime())) {
+    throw new Error(
+      `Invalid --expires-at value "${input}". Use an ISO 8601 timestamp or "never".`
+    );
+  }
+  return parsed.toISOString();
+}
+function parseIdleExpiry(input) {
+  if (input === "never") {
+    return null;
+  }
+  const match = /^(\d+)(s|m|h|d)?$/.exec(input);
+  if (!match) {
+    throw new Error(
+      `Invalid --idle-expiry value "${input}". Use seconds or a duration like 30d, 12h, 90m, 3600s, or "never".`
+    );
+  }
+  const unitSeconds = { s: 1, m: 60, h: 3600, d: 86400 }[match[2] ?? "s"] ?? 1;
+  const seconds = Number(match[1]) * unitSeconds;
+  if (seconds < 1 || seconds > SECRET_IDLE_EXPIRY_MAX_SECONDS) {
+    throw new Error(
+      `--idle-expiry must be between 1 second and ${SECRET_IDLE_EXPIRY_MAX_SECONDS} seconds (10 years).`
+    );
+  }
+  return seconds;
+}
+function resolveExpiryFields(options) {
+  return {
+    ...options.expiresAt === void 0 ? {} : { expiresAt: parseExpiresAt(options.expiresAt) },
+    ...options.idleExpiry === void 0 ? {} : { idleExpirySeconds: parseIdleExpiry(options.idleExpiry) }
+  };
+}
 function resolveBindingFlags(options) {
   const hasBindingFlags = (options.bindHost?.length ?? 0) > 0 || options.bindHeader !== void 0 || options.bindFormat !== void 0;
   if (options.unbind) {
@@ -50228,6 +50334,16 @@ function writeRotateResponse(response, input) {
     `secret ${response.secret.name} rotated scope=${scopeLabel(response.secret.projectId)}`
   );
 }
+function writeExpiryResponse(response, input) {
+  if (input.commandOptions.json) {
+    input.context.writeOutput(JSON.stringify(response));
+    return;
+  }
+  const idle = response.secret.idleExpirySeconds === null ? "never" : `${response.secret.idleExpirySeconds}s`;
+  input.context.writeOutput(
+    `secret ${response.secret.name} expiry updated scope=${scopeLabel(response.secret.projectId)} expires=${response.secret.expiresAt ?? "never"} idle=${idle}`
+  );
+}
 function writeRevealResponse(response, input) {
   if (input.commandOptions.json) {
     input.context.writeOutput(JSON.stringify(response));
@@ -50315,7 +50431,13 @@ function registerSecretCommands(program, context) {
   ).option("--unbind", "clear an existing destination binding").option("--protected", "mark write-only: refuse plaintext reveal (default)").option(
     "--unprotected",
     "allow scope-gated plaintext reveal of this secret"
-  ).option("--raw", "allow empty values and preserve stdin exactly").option("--json", "print the updated secret metadata as JSON").option("--api-url <url>", "Auto API base URL").option("--api-base-url <url>", "Auto API base URL").action(async (name, commandOptions) => {
+  ).option("--raw", "allow empty values and preserve stdin exactly").option(
+    "--expires-at <timestamp>",
+    'absolute expiry as an ISO 8601 timestamp, or "never" to clear'
+  ).option(
+    "--idle-expiry <duration>",
+    'expire after this long unused (seconds or 30d/12h/90m/3600s), or "never" to clear'
+  ).option("--json", "print the updated secret metadata as JSON").option("--api-url <url>", "Auto API base URL").option("--api-base-url <url>", "Auto API base URL").action(async (name, commandOptions) => {
     await setSecret({
       client: createContextApiClient(context),
       commandOptions: withApiBaseUrl(context, commandOptions),
@@ -50334,6 +50456,20 @@ function registerSecretCommands(program, context) {
       name
     });
   });
+  secrets.command("expiry").description("Update a secret's expiry without changing its value.").argument("<name>", "secret name").option("--project <project>", "project id; defaults to organization scope").option(
+    "--expires-at <timestamp>",
+    'absolute expiry as an ISO 8601 timestamp, or "never" to clear'
+  ).option(
+    "--idle-expiry <duration>",
+    'expire after this long unused (seconds or 30d/12h/90m/3600s), or "never" to clear'
+  ).option("--json", "print the updated secret metadata as JSON").option("--api-url <url>", "Auto API base URL").option("--api-base-url <url>", "Auto API base URL").action(async (name, commandOptions) => {
+    await updateSecretExpiry({
+      client: createContextApiClient(context),
+      commandOptions: withApiBaseUrl(context, commandOptions),
+      context,
+      name
+    });
+  });
   secrets.command("reveal").description(
     "Print the decrypted value of a non-protected secret (audited)."
   ).argument("<name>", "secret name").option("--project <project>", "project id; defaults to organization scope").option("--json", "print the secret value and metadata as JSON").option("--api-url <url>", "Auto API base URL").option("--api-base-url <url>", "Auto API base URL").action(async (name, commandOptions) => {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@autohq/cli",
-  "version": "0.1.365",
+  "version": "0.1.366",
   "license": "SEE LICENSE IN README.md",
   "publishConfig": {
     "access": "public"