@eide/foir-cli 0.6.1 → 0.7.0

package/dist/cli.js

@@ -2949,12 +2949,14 @@ function createOperationsMethods(client) {
           timeoutMs: params.timeoutMs,
           inputSchema: params.inputSchema,
           outputSchema: params.outputSchema,
-          streamConfig: params.streamConfig,
           quotas: params.quotas,
           retryPolicy: params.retryPolicy,
+          callbackTimeoutRetryPolicy: params.callbackTimeoutRetryPolicy,
           allowedRoles: params.allowedRoles ?? [],
           precondition: params.precondition,
-          configId: params.configId
+          configId: params.configId,
+          supportsAsyncCallback: params.supportsAsyncCallback,
+          callbackTtlSeconds: params.callbackTtlSeconds
         })
       );
       return resp.operation ?? null;
@@ -2969,11 +2971,13 @@ function createOperationsMethods(client) {
           timeoutMs: params.timeoutMs,
           inputSchema: params.inputSchema,
           outputSchema: params.outputSchema,
-          streamConfig: params.streamConfig,
           quotas: params.quotas,
           retryPolicy: params.retryPolicy,
+          callbackTimeoutRetryPolicy: params.callbackTimeoutRetryPolicy,
           precondition: params.precondition,
-          isActive: params.isActive
+          isActive: params.isActive,
+          supportsAsyncCallback: params.supportsAsyncCallback,
+          callbackTtlSeconds: params.callbackTtlSeconds
         })
       );
       return resp.operation ?? null;
@@ -4969,6 +4973,12 @@ async function reconcileOperations(client, configId, operations, operationBaseUr
     }
     const ex = existingByKey.get(op.key);
     const endpoint = resolveEndpoint(op.endpoint, operationBaseUrl);
+    const supportsAsyncCallback = op.mode === "async";
+    if (supportsAsyncCallback && op.timeoutMs && op.timeoutMs > 1e4) {
+      console.warn(
+        `\u26A0 operation "${op.key}": mode=async but timeoutMs=${op.timeoutMs} \u2014 ack should return in <10s; long timeouts mask slow extensions`
+      );
+    }
     if (ex) {
       const empty = {};
       await client.operations.updateOperation({
@@ -4979,11 +4989,13 @@ async function reconcileOperations(client, configId, operations, operationBaseUr
         timeoutMs: op.timeoutMs,
         inputSchema: op.inputSchema ?? empty,
         outputSchema: op.outputSchema ?? empty,
-        streamConfig: op.streamConfig ?? empty,
         quotas: op.quotas ?? empty,
         retryPolicy: op.retryPolicy ?? empty,
+        callbackTimeoutRetryPolicy: op.callbackTimeoutRetryPolicy ?? empty,
         precondition: op.precondition ?? empty,
-        isActive: op.isActive
+        isActive: op.isActive,
+        supportsAsyncCallback,
+        callbackTtlSeconds: op.callbackTtlSeconds
       });
       summary.operations.updated++;
     } else {
@@ -4997,12 +5009,14 @@ async function reconcileOperations(client, configId, operations, operationBaseUr
         timeoutMs: op.timeoutMs,
         inputSchema: op.inputSchema,
         outputSchema: op.outputSchema,
-        streamConfig: op.streamConfig,
         quotas: op.quotas,
         retryPolicy: op.retryPolicy,
+        callbackTimeoutRetryPolicy: op.callbackTimeoutRetryPolicy,
         allowedRoles: op.allowedRoles,
         precondition: op.precondition,
-        configId
+        configId,
+        supportsAsyncCallback,
+        callbackTtlSeconds: op.callbackTtlSeconds
       });
       summary.operations.created++;
     }
@@ -5238,6 +5252,7 @@ async function reconcileApiKeys(client, configKey, apiKeys, summary) {
   for (const key of apiKeys) {
     if (!key.name || !key.keyType || !key.envVar) continue;
     const existingKey = existingByName.get(key.name);
+    let rawKey;
     if (existingKey) {
       const wantScopes = (key.scopes ?? []).slice().sort();
       const haveScopes = (existingKey.scopes ?? []).slice().sort();
@@ -5249,16 +5264,18 @@ async function reconcileApiKeys(client, configKey, apiKeys, summary) {
           updateScopes: true
         });
       }
-      continue;
+      const rotated = await client.identity.rotateApiKey(existingKey.id);
+      rawKey = rotated?.apiKey?.rawKey;
+    } else {
+      const result = await client.identity.createApiKey({
+        name: key.name,
+        keyType: key.keyType === "secret" ? 2 : 1,
+        allowedModels: key.allowedModels,
+        allowedFileTypes: key.allowedFileTypes,
+        scopes: key.scopes
+      });
+      rawKey = result?.apiKey?.rawKey;
     }
-    const result = await client.identity.createApiKey({
-      name: key.name,
-      keyType: key.keyType === "secret" ? 2 : 1,
-      allowedModels: key.allowedModels,
-      allowedFileTypes: key.allowedFileTypes,
-      scopes: key.scopes
-    });
-    const rawKey = result?.apiKey?.rawKey;
     if (rawKey) {
       summary.apiKeys.push({
         name: key.name,
@@ -5568,6 +5585,24 @@ function discoverConfigFile() {
   }
   return null;
 }
+function syncEnvVar(envPath, key, value) {
+  const envContent = existsSync4(envPath) ? readFileSync(envPath, "utf-8") : "";
+  const pattern = new RegExp(`^${key}=(.*)$`, "m");
+  const currentMatch = envContent.match(pattern);
+  const currentValue = currentMatch?.[1];
+  if (currentValue === value) {
+    return "unchanged";
+  }
+  if (currentMatch) {
+    const updated = envContent.replace(new RegExp(`^${key}=.*$`, "m"), `${key}=${value}`);
+    writeFileSync2(envPath, updated, "utf-8");
+    return "replaced";
+  }
+  const needsNewline = envContent && !envContent.endsWith("\n");
+  writeFileSync2(envPath, (needsNewline ? envContent + "\n" : envContent) + `${key}=${value}
+`, "utf-8");
+  return "written";
+}
 function writeEnvVar(envPath, key, value) {
   let content = "";
   if (existsSync4(envPath)) {
@@ -5669,31 +5704,22 @@ function registerPushCommand(program2, globalOpts) {
         const { secret: signingSecret } = await client.operations.getSigningSecret();
         if (signingSecret) {
           const envPath2 = resolve4(opts.env ?? ".env");
-          const envContent = existsSync4(envPath2) ? readFileSync(envPath2, "utf-8") : "";
-          const currentMatch = envContent.match(/^FOIR_WEBHOOK_SECRET=(.*)$/m);
-          const currentValue = currentMatch?.[1];
-          if (currentValue !== signingSecret) {
-            if (currentMatch) {
-              const updated = envContent.replace(
-                /^FOIR_WEBHOOK_SECRET=.*$/m,
-                `FOIR_WEBHOOK_SECRET=${signingSecret}`
-              );
-              writeFileSync2(envPath2, updated, "utf-8");
+          const syncAndLog = (key, label) => {
+            const result = syncEnvVar(envPath2, key, signingSecret);
+            if (result === "unchanged") {
+              console.log(chalk6.dim(`  ${label}: ${key} already up to date, skipped`));
+            } else if (result === "replaced") {
               console.log(
-                chalk6.yellow("\u27F3 Webhook signing secret") + chalk6.dim(` \u2192 FOIR_WEBHOOK_SECRET updated in ${envPath2}`)
+                chalk6.yellow(`\u27F3 ${label}`) + chalk6.dim(` \u2192 ${key} updated in ${envPath2}`)
               );
             } else {
-              envWrites.push({
-                key: "FOIR_WEBHOOK_SECRET",
-                value: signingSecret,
-                label: "Webhook signing secret"
-              });
+              console.log(
+                chalk6.green(`\u2713 ${label}`) + chalk6.dim(` \u2192 ${key} written to ${envPath2}`)
+              );
             }
-          } else {
-            console.log(
-              chalk6.dim("  Webhook signing secret: FOIR_WEBHOOK_SECRET already up to date, skipped")
-            );
-          }
+          };
+          syncAndLog("FOIR_WEBHOOK_SECRET", "Webhook signing secret");
+          syncAndLog("FOIR_SIGNING_SECRET", "Callback signing secret");
         }
         if (envWrites.length > 0) {
           console.log();

package/dist/lib/config-helpers.d.ts

@@ -90,8 +90,6 @@ interface ApplyConfigOperationInput {
     timeoutMs?: number;
     inputSchema?: Record<string, unknown>;
     outputSchema?: Record<string, unknown>;
-    /** Streaming configuration for SSE/chunked responses. */
-    streamConfig?: Record<string, unknown>;
     /** Usage quota rules (rate limits per customer/user/tenant). */
     quotas?: {
         rules: QuotaRule[];
@@ -102,6 +100,45 @@ interface ApplyConfigOperationInput {
     allowedRoles?: string[];
     /** Precondition that must be met before execution (e.g., segment membership). */
     precondition?: Precondition;
+    /**
+     * Execution mode the operation supports. `sync` blocks the platform worker
+     * on the HTTP call (≤30s realistically). `async` dispatches with
+     * 202-ack semantics — the extension returns 202 immediately and calls
+     * back via the typed GraphQL mutation when work completes. Use `async`
+     * for long-running work that exceeds the 30s wall clock.
+     *
+     * There is only one flavour of async on the platform: the callback-based
+     * handshake. The prior "fire-and-forget" meaning of async was retired
+     * in 2026-04 — every ASYNC dispatch now carries a scoped callback token
+     * and the platform tracks the execution to terminal state.
+     *
+     * Default: `sync`. The CLI maps this to `supportsAsyncCallback` on the
+     * platform Operation row — the operation can still be dispatched in SYNC
+     * mode at runtime when callers want a blocking call.
+     */
+    mode?: 'sync' | 'async';
+    /**
+     * How long the platform waits for a callback before marking the execution
+     * `timed_out` and (per retry policy) re-queueing or sending to DLQ. Falls
+     * back to project setting `operations.callback_default_ttl`, then 24h.
+     * Clamped to [5m, 7d]. Only meaningful when `mode === 'async'`.
+     */
+    callbackTtlSeconds?: number;
+    /**
+     * Retry policy applied specifically when the callback times out. Distinct
+     * from `retryPolicy`, which governs HTTP dispatch failures (network, 5xx).
+     * Splitting these lets operators retry dispatch failures aggressively while
+     * being conservative about callback timeouts — re-running an hour-long job
+     * that timed out because the upstream was slow tends to burn another hour
+     * and hit the same slowness.
+     *
+     * Shape mirrors `retryPolicy` (`{ maxRetries }`). Falls back to
+     * `retryPolicy` when unset, then to the watchdog default (3).
+     * Set `{ maxRetries: 0 }` to opt out of retry on timeout entirely.
+     */
+    callbackTimeoutRetryPolicy?: {
+        maxRetries?: number;
+    };
 }
 interface ApplyConfigSegmentInput {
     key: string;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@eide/foir-cli",
-  "version": "0.6.1",
+  "version": "0.7.0",
   "description": "Universal platform CLI for Foir platform",
   "type": "module",
   "publishConfig": {
@@ -50,7 +50,7 @@
     "@bufbuild/protovalidate": "^1.1.1",
     "@connectrpc/connect": "^2.0.0",
     "@connectrpc/connect-node": "^2.0.0",
-    "@eide/foir-proto-ts": "^0.11.0",
+    "@eide/foir-proto-ts": "^0.16.0",
     "chalk": "^5.3.0",
     "commander": "^12.1.0",
     "dotenv": "^16.4.5",