@autohq/cli 0.1.382 → 0.1.383

package/dist/agent-bridge.js

@@ -23492,7 +23492,7 @@ Object.assign(lookup, {
 // package.json
 var package_default = {
   name: "@autohq/cli",
-  version: "0.1.382",
+  version: "0.1.383",
   license: "SEE LICENSE IN README.md",
   publishConfig: {
     access: "public"
@@ -26299,35 +26299,35 @@ var SecretDescriptionSchema = external_exports.string().trim().max(1024);
 var SECRET_IDLE_EXPIRY_MAX_SECONDS = 10 * 365 * 24 * 60 * 60;
 var SecretExpiresAtSchema = external_exports.string().datetime({ offset: true });
 var SecretIdleExpirySecondsSchema = external_exports.number().int().min(1).max(SECRET_IDLE_EXPIRY_MAX_SECONDS);
-var SECRET_BINDING_HOST_PATTERN = /^(?=.{1,253}$)([a-z0-9]([a-z0-9-]{0,61}[a-z0-9])?\.)+[a-z]([a-z0-9-]{0,61}[a-z0-9])?$/;
-var SECRET_BINDING_HEADER_PATTERN = /^[!#$%&'*+.^_`|~0-9A-Za-z-]+$/;
-var SECRET_BINDING_FORBIDDEN_HEADERS = /* @__PURE__ */ new Set([
+var SECRET_INJECTION_HOST_PATTERN = /^(?=.{1,253}$)([a-z0-9]([a-z0-9-]{0,61}[a-z0-9])?\.)+[a-z]([a-z0-9-]{0,61}[a-z0-9])?$/;
+var SECRET_INJECTION_HEADER_PATTERN = /^[!#$%&'*+.^_`|~0-9A-Za-z-]+$/;
+var SECRET_INJECTION_FORBIDDEN_HEADERS = /* @__PURE__ */ new Set([
   "connection",
   "content-length",
   "host",
   "transfer-encoding"
 ]);
-var SecretBindingHostSchema = external_exports.string().trim().toLowerCase().regex(
-  SECRET_BINDING_HOST_PATTERN,
-  "Binding hosts must be exact lowercase hostnames (no wildcards, schemes, ports, or paths)"
+var SecretInjectionHostSchema = external_exports.string().trim().toLowerCase().regex(
+  SECRET_INJECTION_HOST_PATTERN,
+  "Injection hosts must be exact lowercase hostnames (no wildcards, schemes, ports, or paths)"
 );
-var SecretBindingHeaderSchema = external_exports.string().trim().min(1).max(128).regex(SECRET_BINDING_HEADER_PATTERN, "Invalid HTTP header name").refine(
-  (header) => !SECRET_BINDING_FORBIDDEN_HEADERS.has(header.toLowerCase()),
-  "This header cannot carry a secret binding"
+var SecretInjectionHeaderSchema = external_exports.string().trim().min(1).max(128).regex(SECRET_INJECTION_HEADER_PATTERN, "Invalid HTTP header name").refine(
+  (header) => !SECRET_INJECTION_FORBIDDEN_HEADERS.has(header.toLowerCase()),
+  "This header cannot carry an injected secret"
 );
-var SecretBindingSchema = external_exports.object({
-  hosts: external_exports.array(SecretBindingHostSchema).min(1).max(16),
-  header: SecretBindingHeaderSchema,
+var SecretInjectionSchema = external_exports.object({
+  hosts: external_exports.array(SecretInjectionHostSchema).min(1).max(16),
+  header: SecretInjectionHeaderSchema,
   format: external_exports.string().min(1).max(256).refine(
     (format) => format.includes("{value}"),
-    "Binding format must contain the {value} placeholder"
+    "Injection format must contain the {value} placeholder"
   ).optional()
 });
 var SecretSetRequestSchema = external_exports.object({
   value: external_exports.string(),
   description: SecretDescriptionSchema.nullable().optional(),
   protected: external_exports.boolean().optional(),
-  binding: SecretBindingSchema.nullable().optional(),
+  injection: SecretInjectionSchema.nullable().optional(),
   expiresAt: SecretExpiresAtSchema.nullable().optional(),
   idleExpirySeconds: SecretIdleExpirySecondsSchema.nullable().optional()
 });
@@ -26349,13 +26349,14 @@ var SecretMetadataSchema = external_exports.object({
   description: external_exports.string().nullable(),
   protected: external_exports.boolean(),
   // Defaulted rather than required so a newer client parsing an older
-  // server's metadata (deploy skew) treats an absent binding as unbound.
-  binding: SecretBindingSchema.nullable().default(null),
+  // server's metadata (deploy skew) treats an absent injection as plain
+  // env delivery.
+  injection: SecretInjectionSchema.nullable().default(null),
   createdAt: external_exports.string().datetime(),
   updatedAt: external_exports.string().datetime(),
   lastRotatedAt: external_exports.string().datetime().nullable(),
   lastAccessedAt: external_exports.string().datetime().nullable(),
-  // Like binding, defaulted for deploy skew: an older server that never sends
+  // Like injection, defaulted for deploy skew: an older server that never sends
   // expiry fields parses as a secret that never expires.
   expiresAt: external_exports.string().datetime().nullable().default(null),
   idleExpirySeconds: external_exports.number().int().nullable().default(null),

package/dist/index.js

@@ -17695,7 +17695,7 @@ var init_mounts = __esm({
 });
 
 // ../../packages/schemas/src/secrets.ts
-var SECRET_ENCRYPTION_ALGORITHM, SecretEnvNameSchema, SecretCiphertextFieldSchema, SecretAesGcmIvSchema, SecretAesGcmAuthTagSchema, SecretEnvValueSchema, SecretEnvSchema, EncryptedSecretValueSchema, SecretDescriptionSchema, SECRET_IDLE_EXPIRY_MAX_SECONDS, SecretExpiresAtSchema, SecretIdleExpirySecondsSchema, SECRET_BINDING_HOST_PATTERN, SECRET_BINDING_HEADER_PATTERN, SECRET_BINDING_FORBIDDEN_HEADERS, SecretBindingHostSchema, SecretBindingHeaderSchema, SecretBindingSchema, SecretSetRequestSchema, SecretExpiryUpdateRequestSchema, SecretRotateRequestSchema, SecretMetadataSchema, SecretSetResponseSchema, SecretListResponseSchema, SecretDeleteResponseSchema, SecretExpiryUpdateResponseSchema, SecretRevealResponseSchema;
+var SECRET_ENCRYPTION_ALGORITHM, SecretEnvNameSchema, SecretCiphertextFieldSchema, SecretAesGcmIvSchema, SecretAesGcmAuthTagSchema, SecretEnvValueSchema, SecretEnvSchema, EncryptedSecretValueSchema, SecretDescriptionSchema, SECRET_IDLE_EXPIRY_MAX_SECONDS, SecretExpiresAtSchema, SecretIdleExpirySecondsSchema, SECRET_INJECTION_HOST_PATTERN, SECRET_INJECTION_HEADER_PATTERN, SECRET_INJECTION_FORBIDDEN_HEADERS, SecretInjectionHostSchema, SecretInjectionHeaderSchema, SecretInjectionSchema, SecretSetRequestSchema, SecretExpiryUpdateRequestSchema, SecretRotateRequestSchema, SecretMetadataSchema, SecretSetResponseSchema, SecretListResponseSchema, SecretDeleteResponseSchema, SecretExpiryUpdateResponseSchema, SecretRevealResponseSchema;
 var init_secrets = __esm({
   "../../packages/schemas/src/secrets.ts"() {
     "use strict";
@@ -17731,35 +17731,35 @@ var init_secrets = __esm({
     SECRET_IDLE_EXPIRY_MAX_SECONDS = 10 * 365 * 24 * 60 * 60;
     SecretExpiresAtSchema = external_exports.string().datetime({ offset: true });
     SecretIdleExpirySecondsSchema = external_exports.number().int().min(1).max(SECRET_IDLE_EXPIRY_MAX_SECONDS);
-    SECRET_BINDING_HOST_PATTERN = /^(?=.{1,253}$)([a-z0-9]([a-z0-9-]{0,61}[a-z0-9])?\.)+[a-z]([a-z0-9-]{0,61}[a-z0-9])?$/;
-    SECRET_BINDING_HEADER_PATTERN = /^[!#$%&'*+.^_`|~0-9A-Za-z-]+$/;
-    SECRET_BINDING_FORBIDDEN_HEADERS = /* @__PURE__ */ new Set([
+    SECRET_INJECTION_HOST_PATTERN = /^(?=.{1,253}$)([a-z0-9]([a-z0-9-]{0,61}[a-z0-9])?\.)+[a-z]([a-z0-9-]{0,61}[a-z0-9])?$/;
+    SECRET_INJECTION_HEADER_PATTERN = /^[!#$%&'*+.^_`|~0-9A-Za-z-]+$/;
+    SECRET_INJECTION_FORBIDDEN_HEADERS = /* @__PURE__ */ new Set([
       "connection",
       "content-length",
       "host",
       "transfer-encoding"
     ]);
-    SecretBindingHostSchema = external_exports.string().trim().toLowerCase().regex(
-      SECRET_BINDING_HOST_PATTERN,
-      "Binding hosts must be exact lowercase hostnames (no wildcards, schemes, ports, or paths)"
+    SecretInjectionHostSchema = external_exports.string().trim().toLowerCase().regex(
+      SECRET_INJECTION_HOST_PATTERN,
+      "Injection hosts must be exact lowercase hostnames (no wildcards, schemes, ports, or paths)"
     );
-    SecretBindingHeaderSchema = external_exports.string().trim().min(1).max(128).regex(SECRET_BINDING_HEADER_PATTERN, "Invalid HTTP header name").refine(
-      (header) => !SECRET_BINDING_FORBIDDEN_HEADERS.has(header.toLowerCase()),
-      "This header cannot carry a secret binding"
+    SecretInjectionHeaderSchema = external_exports.string().trim().min(1).max(128).regex(SECRET_INJECTION_HEADER_PATTERN, "Invalid HTTP header name").refine(
+      (header) => !SECRET_INJECTION_FORBIDDEN_HEADERS.has(header.toLowerCase()),
+      "This header cannot carry an injected secret"
     );
-    SecretBindingSchema = external_exports.object({
-      hosts: external_exports.array(SecretBindingHostSchema).min(1).max(16),
-      header: SecretBindingHeaderSchema,
+    SecretInjectionSchema = external_exports.object({
+      hosts: external_exports.array(SecretInjectionHostSchema).min(1).max(16),
+      header: SecretInjectionHeaderSchema,
       format: external_exports.string().min(1).max(256).refine(
         (format) => format.includes("{value}"),
-        "Binding format must contain the {value} placeholder"
+        "Injection format must contain the {value} placeholder"
       ).optional()
     });
     SecretSetRequestSchema = external_exports.object({
       value: external_exports.string(),
       description: SecretDescriptionSchema.nullable().optional(),
       protected: external_exports.boolean().optional(),
-      binding: SecretBindingSchema.nullable().optional(),
+      injection: SecretInjectionSchema.nullable().optional(),
       expiresAt: SecretExpiresAtSchema.nullable().optional(),
       idleExpirySeconds: SecretIdleExpirySecondsSchema.nullable().optional()
     });
@@ -17781,13 +17781,14 @@ var init_secrets = __esm({
       description: external_exports.string().nullable(),
       protected: external_exports.boolean(),
       // Defaulted rather than required so a newer client parsing an older
-      // server's metadata (deploy skew) treats an absent binding as unbound.
-      binding: SecretBindingSchema.nullable().default(null),
+      // server's metadata (deploy skew) treats an absent injection as plain
+      // env delivery.
+      injection: SecretInjectionSchema.nullable().default(null),
       createdAt: external_exports.string().datetime(),
       updatedAt: external_exports.string().datetime(),
       lastRotatedAt: external_exports.string().datetime().nullable(),
       lastAccessedAt: external_exports.string().datetime().nullable(),
-      // Like binding, defaulted for deploy skew: an older server that never sends
+      // Like injection, defaulted for deploy skew: an older server that never sends
       // expiry fields parses as a secret that never expires.
       expiresAt: external_exports.string().datetime().nullable().default(null),
       idleExpirySeconds: external_exports.number().int().nullable().default(null),
@@ -33907,7 +33908,7 @@ var init_package = __esm({
   "package.json"() {
     package_default = {
       name: "@autohq/cli",
-      version: "0.1.382",
+      version: "0.1.383",
       license: "SEE LICENSE IN README.md",
       publishConfig: {
         access: "public"
@@ -52439,7 +52440,7 @@ async function setSecret(input) {
       ...input.commandOptions.description === void 0 ? {} : { description: input.commandOptions.description },
       ...resolveProtectedFlag(input.commandOptions),
       ...resolveExpiryFields(input.commandOptions),
-      ...resolveBindingFlags(input.commandOptions)
+      ...resolveInjectionFlags(input.commandOptions)
     },
     {
       projectId: await secretProjectId(input),
@@ -52503,6 +52504,11 @@ async function listSecrets(input) {
       flags,
       `updated ${secret.updatedAt}`
     ];
+    if (secret.injection) {
+      parts.push(
+        `injected ${secret.injection.header}@${secret.injection.hosts.join(",")}`
+      );
+    }
     if (secret.expired) {
       parts.push("expired");
     } else {
@@ -52565,27 +52571,29 @@ function resolveExpiryFields(options) {
     ...options.idleExpiry === void 0 ? {} : { idleExpirySeconds: parseIdleExpiry(options.idleExpiry) }
   };
 }
-function resolveBindingFlags(options) {
-  const hasBindingFlags = (options.bindHost?.length ?? 0) > 0 || options.bindHeader !== void 0 || options.bindFormat !== void 0;
-  if (options.unbind) {
-    if (hasBindingFlags) {
-      throw new Error("Use either --unbind or the --bind-* flags, not both.");
+function resolveInjectionFlags(options) {
+  const hasInjectionFlags = (options.injectHost?.length ?? 0) > 0 || options.injectHeader !== void 0 || options.injectFormat !== void 0;
+  if (options.clearInjection) {
+    if (hasInjectionFlags) {
+      throw new Error(
+        "Use either --clear-injection or the --inject-* flags, not both."
+      );
     }
-    return { binding: null };
+    return { injection: null };
   }
-  if (!hasBindingFlags) {
+  if (!hasInjectionFlags) {
     return {};
   }
-  if (!options.bindHost?.length || options.bindHeader === void 0) {
+  if (!options.injectHost?.length || options.injectHeader === void 0) {
     throw new Error(
-      "Binding a secret requires at least one --bind-host and a --bind-header."
+      "An injected secret requires at least one --inject-host and an --inject-header."
     );
   }
   return {
-    binding: {
-      hosts: options.bindHost,
-      header: options.bindHeader,
-      ...options.bindFormat === void 0 ? {} : { format: options.bindFormat }
+    injection: {
+      hosts: options.injectHost,
+      header: options.injectHeader,
+      ...options.injectFormat === void 0 ? {} : { format: options.injectFormat }
     }
   };
 }
@@ -52754,17 +52762,17 @@ function registerSecretCommands(program, context) {
     "--from-env <name>",
     "read the secret value from an environment variable"
   ).option("--description <text>", "human-readable description for the secret").option(
-    "--bind-host <host>",
-    "bind the secret to an exact destination host (repeatable); bound secrets are injected at the sandbox edge instead of entering the sandbox",
+    "--inject-host <host>",
+    "mark the secret injected for an exact destination host (repeatable); injected secrets are added at the sandbox edge instead of entering the sandbox",
     (host, hosts) => [...hosts, host],
     []
   ).option(
-    "--bind-header <header>",
-    "HTTP header the bound secret is injected into (e.g. Authorization)"
+    "--inject-header <header>",
+    "HTTP header the secret is injected into (e.g. Authorization)"
   ).option(
-    "--bind-format <format>",
+    "--inject-format <format>",
     'header value template around the secret, e.g. "Bearer {value}"'
-  ).option("--unbind", "clear an existing destination binding").option("--protected", "mark write-only: refuse plaintext reveal (default)").option(
+  ).option("--clear-injection", "stop injecting the secret at any destination").option("--protected", "mark write-only: refuse plaintext reveal (default)").option(
     "--unprotected",
     "allow scope-gated plaintext reveal of this secret"
   ).option("--raw", "allow empty values and preserve stdin exactly").option(

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@autohq/cli",
-  "version": "0.1.382",
+  "version": "0.1.383",
   "license": "SEE LICENSE IN README.md",
   "publishConfig": {
     "access": "public"