@dench.com/cli 2.2.6 → 2.2.7

package/cron.ts

@@ -33,6 +33,7 @@
  *   enable <jobId>                       Re-arm a paused cron.
  *   disable <jobId>                      Soft-pause without delete.
  *   run <jobId> [--wait]                 Manual fire; --wait blocks.
+ *   secret <jobId>                       Mint/rotate a signing secret (any type).
  *   runs <jobId> [--limit N] [--status]  Run history per trigger.
  *   history [--limit N]                  Flat history across all crons.
  *   help                                 Print this help.
@@ -196,7 +197,9 @@ export type CronScheduleSpec =
  *
  * `--at` implicitly drops `--every` / `--cron` if both are passed.
  */
-export function consumeScheduleFlags(args: string[]): CronScheduleSpec | undefined {
+export function consumeScheduleFlags(
+  args: string[],
+): CronScheduleSpec | undefined {
   const at = getFlag(args, "--at");
   if (at) {
     const ts = new Date(at).getTime();
@@ -335,10 +338,15 @@ async function runGet(ctx: CronCliContext): Promise<void> {
 }
 
 async function runCreate(ctx: CronCliContext): Promise<void> {
-  const name = shift(ctx.args, "name (positional, e.g. dench cron create \"Daily standup digest\" --prompt … --every 1d)");
+  const name = shift(
+    ctx.args,
+    'name (positional, e.g. dench cron create "Daily standup digest" --prompt … --every 1d)',
+  );
   const prompt = getFlag(ctx.args, "--prompt");
   if (!prompt || !prompt.trim()) {
-    throw new CronCliError("--prompt is required (becomes the user message of each cron-fired chat thread)");
+    throw new CronCliError(
+      "--prompt is required (becomes the user message of each cron-fired chat thread)",
+    );
   }
   const description = getFlag(ctx.args, "--description");
   const overlapPolicy = getFlag(ctx.args, "--overlap") as
@@ -346,10 +354,7 @@ async function runCreate(ctx: CronCliContext): Promise<void> {
     | "queue"
     | "kill_old"
     | undefined;
-  if (
-    overlapPolicy &&
-    !["skip", "queue", "kill_old"].includes(overlapPolicy)
-  ) {
+  if (overlapPolicy && !["skip", "queue", "kill_old"].includes(overlapPolicy)) {
     throw new CronCliError(
       `--overlap must be one of skip|queue|kill_old (got "${overlapPolicy}")`,
     );
@@ -360,26 +365,86 @@ async function runCreate(ctx: CronCliContext): Promise<void> {
   if (target && target !== "chat_turn") {
     throw new CronCliError(`--target must be chat_turn (got "${target}")`);
   }
-  const schedule = consumeScheduleFlags(ctx.args);
-  if (!schedule) {
+  const triggerType = (getFlag(ctx.args, "--type") ?? "schedule") as
+    | "schedule"
+    | "webhook";
+  if (triggerType !== "schedule" && triggerType !== "webhook") {
     throw new CronCliError(
-      "One of --every / --cron / --at is required. Examples:\n" +
-        "  dench cron create \"Hourly health check\" --prompt 'Check uptime…' --every 1h\n" +
-        '  dench cron create "Weekday digest" --prompt \'Pull yesterday…\' --cron "0 9 * * 1-5"\n' +
-        '  dench cron create "May 4 launch" --prompt \'Send launch tweet\' --at 2026-05-04T09:00:00Z',
+      `--type must be schedule|webhook (got "${triggerType}"). app-event / CRM automations are created from the dashboard.`,
     );
   }
-  const result = await callMutation(ctx, createCronTriggerRef, {
+  const isWebhook = triggerType === "webhook";
+
+  let schedule: CronScheduleSpec | undefined;
+  if (isWebhook) {
+    // Webhook automations fire on demand / via their signed URL — no schedule.
+    if (consumeScheduleFlags(ctx.args)) {
+      throw new CronCliError(
+        "Webhook automations don't take a schedule. Omit --every/--cron/--at.",
+      );
+    }
+  } else {
+    schedule = consumeScheduleFlags(ctx.args);
+    if (!schedule) {
+      throw new CronCliError(
+        "One of --every / --cron / --at is required for schedule automations. Examples:\n" +
+          "  dench cron create \"Hourly health check\" --prompt 'Check uptime…' --every 1h\n" +
+          '  dench cron create "Weekday digest" --prompt \'Pull yesterday…\' --cron "0 9 * * 1-5"\n' +
+          "  dench cron create \"Inbound lead\" --prompt 'Triage the lead…' --type webhook",
+      );
+    }
+  }
+  const created = (await callMutation(ctx, createCronTriggerRef, {
     name,
     prompt,
+    triggerType,
     schedule,
     description,
     overlapPolicy,
     enabled: disabled ? false : undefined,
     deleteAfterRun: deleteAfterRun ? true : undefined,
     target,
+  })) as { jobId?: string };
+
+  // Webhook automations need a signing secret to be externally callable. Mint
+  // one now (unless --no-secret) so `create` hands back a working URL+secret.
+  if (isWebhook && !hasFlag(ctx.args, "--no-secret") && created.jobId) {
+    const secret = await mintAutomationSecret(ctx, created.jobId);
+    out(ctx, { ...created, ...secret });
+    return;
+  }
+  out(ctx, created);
+}
+
+/**
+ * Mint (or rotate) a signing secret for an automation via the Next REST route
+ * (secret encryption runs in the Node route, not Convex's V8 runtime). Returns
+ * the plaintext secret + callable URL — shown once.
+ */
+async function mintAutomationSecret(
+  ctx: CronCliContext,
+  jobId: string,
+): Promise<{ webhookUrl: string | null; webhookSecret: string | null }> {
+  const url = `${getApiBase()}/api/cron/jobs/${encodeURIComponent(jobId)}/regenerate-secret`;
+  const res = (await postJson(
+    url,
+    apiKeyHeaders(ctx.sessionToken ?? ""),
+    {},
+  )) as { webhookUrl?: string | null; webhookSecret?: string | null };
+  return {
+    webhookUrl: res.webhookUrl ?? null,
+    webhookSecret: res.webhookSecret ?? null,
+  };
+}
+
+async function runSecret(ctx: CronCliContext): Promise<void> {
+  const jobId = shift(ctx.args, "job id");
+  const secret = await mintAutomationSecret(ctx, jobId);
+  out(ctx, {
+    jobId,
+    ...secret,
+    note: "Secret shown once — store it now. Re-running rotates it (invalidates the old one).",
   });
-  out(ctx, result);
 }
 
 async function runUpdate(ctx: CronCliContext): Promise<void> {
@@ -458,7 +523,11 @@ async function runRunNow(ctx: CronCliContext): Promise<void> {
     })) as { entries: Array<{ ts: number; status?: string }> };
     const matching = runs.entries.find(() => true);
     if (matching && matching.status) {
-      out(ctx, { ...fired, finalStatus: matching.status, durationMs: Date.now() - start });
+      out(ctx, {
+        ...fired,
+        finalStatus: matching.status,
+        durationMs: Date.now() - start,
+      });
       return;
     }
     await new Promise((resolve) => setTimeout(resolve, 3000));
@@ -510,9 +579,10 @@ Browse:
   dench cron history [--limit 50] [--status ok|error|skipped] [--json]
   dench cron runs <jobId> [--limit 50] [--status ok|error|skipped] [--json]
 
-Create / update (one of --every / --cron / --at is required for create):
+Create / update:
   dench cron create "Daily standup digest" \\
       --prompt "Pull yesterday's commits + Slack #standup msgs and post a summary…" \\
+      --type schedule                     # default; or --type webhook (no schedule)
       --every 1d                          # or --cron "0 9 * * 1-5"  or --at 2026-05-04T09:00:00Z
       [--description "..."]               # human-readable note shown in dashboard / list
       [--overlap skip|queue|kill_old]     # default: skip
@@ -521,6 +591,10 @@ Create / update (one of --every / --cron / --at is required for create):
       [--target chat_turn]                # default: chat_turn (fires a fresh chat thread)
       [--json]
 
+  # Webhook automation (fires on demand or via a signed URL). Mints + prints a
+  # signing secret unless --no-secret. The secret is shown ONCE.
+  dench cron create "Inbound lead triage" --prompt "Triage the lead…" --type webhook
+
   dench cron update <jobId> [--name N] [--prompt P] [--description D] \\
       [--every X | --cron EXPR | --at ISO] [--enabled true|false] [--overlap …]
 
@@ -529,6 +603,7 @@ Lifecycle:
   dench cron disable <jobId>
   dench cron delete  <jobId>
   dench cron run     <jobId> [--wait] [--json]   # manual fire; --wait blocks until run finishes
+  dench cron secret  <jobId> [--json]            # mint/rotate a signing secret → callable signed URL (any automation type)
 
 Schedule formats:
   --every <duration>   Repeat every N. Accepts 30s, 5m, 2h, 1d, 12h, etc.
@@ -599,6 +674,8 @@ export async function runCronCommand(opts: {
       return await runEnable(ctx, false);
     case "run":
       return await runRunNow(ctx);
+    case "secret":
+      return await runSecret(ctx);
     case "runs":
       return await runRuns(ctx);
     case "history":

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@dench.com/cli",
-  "version": "2.2.6",
+  "version": "2.2.7",
   "description": "Dench agent workspace CLI. v2 unifies auth behind `dench signin`; the legacy `dench login` / `dench onboard` / `dench setup` / `dench what-can-i-do` / `dench register` commands now error with a redirect.",
   "type": "module",
   "bin": {