@eigenpal/cli 0.5.9 → 0.5.10

package/CHANGELOG.md

@@ -1,5 +1,11 @@
 # @eigenpal/cli
 
+## 0.5.10
+
+### Patch Changes
+
+- aee7e0c: Add hidden Git source commands for editing trigger policy and encrypted secrets.
+
 ## 0.5.9
 
 ### Major Changes

package/dist/cli.js

@@ -68021,7 +68021,63 @@ var init_eval = __esm(() => {
   init_workflow_tool_metadata();
 });
 
+// ../types/src/git-source/cutover.ts
+function resolveAgentSourceCutover(settings) {
+  const parsed = AgentSourceCutoverSettingsSchema.safeParse(settings ?? {});
+  if (!parsed.success)
+    return { mode: "legacy", reason: "invalid_settings" };
+  const agents = parsed.data.gitBackedSource?.agents;
+  if (!agents)
+    return { mode: "legacy", reason: "settings_missing" };
+  if (agents.migrationState === "rolled_back")
+    return { mode: "legacy", reason: "rolled_back" };
+  if (agents.runtime !== "git")
+    return { mode: "legacy", reason: "runtime_legacy" };
+  if (agents.migrationState !== "cutover") {
+    return { mode: "legacy", reason: "migration_not_cutover" };
+  }
+  return { mode: "git", reason: "cutover_enabled" };
+}
+function isGitBackedAgentSourceEnabled(settings) {
+  return resolveAgentSourceCutover(settings).mode === "git";
+}
+var AgentSourceRuntimeModeSchema, AgentSourceMigrationStateSchema, AgentSourceCutoverSettingsSchema;
+var init_cutover = __esm(() => {
+  init_zod();
+  AgentSourceRuntimeModeSchema = exports_external.enum(["legacy", "git"]);
+  AgentSourceMigrationStateSchema = exports_external.enum([
+    "disabled",
+    "shadow",
+    "validated",
+    "cutover",
+    "rolled_back"
+  ]);
+  AgentSourceCutoverSettingsSchema = exports_external.object({
+    gitBackedSource: exports_external.object({
+      agents: exports_external.object({
+        runtime: AgentSourceRuntimeModeSchema.optional(),
+        migrationState: AgentSourceMigrationStateSchema.optional(),
+        legacySourceRetained: exports_external.boolean().optional(),
+        rollbackReason: exports_external.string().optional()
+      }).passthrough().optional()
+    }).passthrough().optional()
+  }).passthrough();
+});
+
 // ../types/src/git-source/grammar.ts
+function parseAutomationTarget(target) {
+  const parsed = AutomationTargetSchema.parse(target);
+  const [rawPackageName, rawRef] = parsed.split("@");
+  const packagePath = dottedPackageNameToPath(rawPackageName);
+  const [type, ...slugParts] = packagePath.split("/");
+  return {
+    packageName: DottedPackageNameSchema.parse(rawPackageName),
+    packagePath,
+    type,
+    slug: slugParts.join("/"),
+    ref: SourceVersionRefSchema.parse(rawRef ?? "latest")
+  };
+}
 function pathToDottedPackageName(path2) {
   const parsed = SourcePackagePathSchema.parse(path2);
   return DottedPackageNameSchema.parse(parsed.split("/").join("."));
@@ -68353,7 +68409,16 @@ var init_manifests = __esm(() => {
     api: exports_external.boolean().optional(),
     email: exports_external.object({
       enabled: exports_external.boolean().default(true),
-      aliases: exports_external.array(exports_external.string().email()).default([])
+      aliases: exports_external.array(exports_external.union([
+        exports_external.string().includes("@"),
+        exports_external.object({
+          address: exports_external.string().includes("@"),
+          allowlist: exports_external.array(exports_external.string()).default([]),
+          replyConfig: exports_external.record(exports_external.string(), exports_external.unknown()).default({}),
+          requireSenderAuth: exports_external.boolean().default(true),
+          enabled: exports_external.boolean().optional()
+        }).strict()
+      ])).default([])
     }).strict().optional()
   }).strict();
   CommonPackageManifestFields = {
@@ -68422,10 +68487,63 @@ var init_manifests = __esm(() => {
   SOURCE_TEMPLATE_FILE_PATTERN = /\.(?:docx|xlsx)$/i;
 });
 
+// ../types/src/git-source/secrets.ts
+var SOURCE_SECRETS_FILENAME = "secrets.enc.yaml", SecretNameSchema, Base64LikeSchema, EncryptedSecretValueSchema, SourceSecretEntrySchema, SourceSecretsFileSchema;
+var init_secrets = __esm(() => {
+  init_zod();
+  init_manifests();
+  SecretNameSchema = exports_external.string().regex(/^[A-Z][A-Z0-9_]*$/, "Secret names must be uppercase env-style identifiers");
+  Base64LikeSchema = exports_external.string().min(1).regex(/^[A-Za-z0-9+/=_-]+$/, {
+    message: "Encrypted secret fields must be encoded strings"
+  });
+  EncryptedSecretValueSchema = exports_external.object({
+    algorithm: exports_external.literal("aes-256-gcm"),
+    keyId: exports_external.string().min(1),
+    nonce: Base64LikeSchema,
+    ciphertext: Base64LikeSchema,
+    tag: Base64LikeSchema
+  }).strict();
+  SourceSecretEntrySchema = exports_external.object({
+    description: exports_external.string().optional(),
+    encrypted: EncryptedSecretValueSchema.optional()
+  }).passthrough().superRefine((entry, ctx) => {
+    const raw = entry;
+    if ("value" in raw || "plaintext" in raw || "secret" in raw) {
+      ctx.addIssue({
+        code: "custom",
+        message: "secrets.enc.yaml must not contain plaintext secret values"
+      });
+    }
+    if (!raw.encrypted) {
+      ctx.addIssue({
+        code: "custom",
+        path: ["encrypted"],
+        message: "Encrypted secret values are required"
+      });
+    }
+    const extraKeys = Object.keys(raw).filter((key) => key !== "description" && key !== "encrypted");
+    for (const key of extraKeys) {
+      if (key === "value" || key === "plaintext" || key === "secret")
+        continue;
+      ctx.addIssue({
+        code: "custom",
+        path: [key],
+        message: `Unknown secret metadata field: ${key}`
+      });
+    }
+  });
+  SourceSecretsFileSchema = exports_external.object({
+    schemaVersion: SourceManifestSchemaVersionSchema,
+    secrets: exports_external.record(SecretNameSchema, SourceSecretEntrySchema)
+  }).strict();
+});
+
 // ../types/src/git-source/index.ts
 var init_git_source = __esm(() => {
+  init_cutover();
   init_grammar();
   init_manifests();
+  init_secrets();
 });
 
 // ../types/src/storage/paths.ts
@@ -68729,11 +68847,13 @@ __export(exports_src, {
   runInputKey: () => runInputKey,
   rootS3Path: () => rootS3Path,
   resolveEffectiveMimeType: () => resolveEffectiveMimeType,
+  resolveAgentSourceCutover: () => resolveAgentSourceCutover,
   requiresSpecializedParser: () => requiresSpecializedParser,
   pathToDottedPackageName: () => pathToDottedPackageName,
   parseStepType: () => parseStepType,
   parseReleaseTag: () => parseReleaseTag,
   parseFileKey: () => parseFileKey,
+  parseAutomationTarget: () => parseAutomationTarget,
   noopTracingContext: () => noopTracingContext,
   mapOCRAttributes: () => mapOCRAttributes,
   mapLLMAttributes: () => mapLLMAttributes,
@@ -68748,6 +68868,7 @@ __export(exports_src, {
   isOutputSchemaUnknown: () => isOutputSchemaUnknown,
   isNonSuccessTerminalExecutionStatus: () => isNonSuccessTerminalExecutionStatus,
   isLocalAgentResourcePath: () => isLocalAgentResourcePath,
+  isGitBackedAgentSourceEnabled: () => isGitBackedAgentSourceEnabled,
   isFilePathDescriptor: () => isFilePathDescriptor,
   isFileOutput: () => isFileOutput,
   hasTriggerMethod: () => hasTriggerMethod,
@@ -68863,6 +68984,7 @@ __export(exports_src, {
   SpanKindMap: () => SpanKindMap,
   SpanKind: () => import_api.SpanKind,
   SourceVersionRefSchema: () => SourceVersionRefSchema,
+  SourceSecretsFileSchema: () => SourceSecretsFileSchema,
   SourcePackageTypeSchema: () => SourcePackageTypeSchema,
   SourcePackageSegmentSchema: () => SourcePackageSegmentSchema,
   SourcePackagePathSchema: () => SourcePackagePathSchema,
@@ -68872,6 +68994,7 @@ __export(exports_src, {
   SharedResourcePackageManifestSchema: () => SharedResourcePackageManifestSchema,
   SharedEvaluatorReferenceSchema: () => SharedEvaluatorReferenceSchema,
   SharedEvaluatorCompositionItemSchema: () => SharedEvaluatorCompositionItemSchema,
+  SecretNameSchema: () => SecretNameSchema,
   ScopeStackSchema: () => ScopeStackSchema,
   ScopeEntryTypeSchema: () => ScopeEntryTypeSchema,
   ScopeEntrySchema: () => ScopeEntrySchema,
@@ -68880,6 +69003,7 @@ __export(exports_src, {
   STEP_EXECUTION_STATUSES: () => STEP_EXECUTION_STATUSES,
   SOURCE_VERSION_RANGE_PATTERN: () => SOURCE_VERSION_RANGE_PATTERN,
   SOURCE_SEMVER_PATTERN: () => SOURCE_SEMVER_PATTERN,
+  SOURCE_SECRETS_FILENAME: () => SOURCE_SECRETS_FILENAME,
   SOURCE_PACKAGE_SEGMENT_PATTERN: () => SOURCE_PACKAGE_SEGMENT_PATTERN,
   SOURCE_MANIFEST_FILENAME: () => SOURCE_MANIFEST_FILENAME,
   SOURCE_COMMIT_SHA_PATTERN: () => SOURCE_COMMIT_SHA_PATTERN,
@@ -68963,6 +69087,7 @@ __export(exports_src, {
   EvalOverridesSchema: () => EvalOverridesSchema,
   EvalExampleMetaSchema: () => EvalExampleMetaSchema,
   EvalConfigYamlSchema: () => EvalConfigYamlSchema,
+  EncryptedSecretValueSchema: () => EncryptedSecretValueSchema,
   EmailTriggerMethodSchema: () => EmailTriggerMethodSchema,
   Eigenpal: () => Eigenpal,
   EXECUTION_TYPES: () => EXECUTION_TYPES,
@@ -69025,6 +69150,9 @@ __export(exports_src, {
   AiParseConfigSchema: () => AiParseConfigSchema,
   AiExtractOutputSchema: () => AiExtractOutputSchema,
   AiExtractConfigSchema: () => AiExtractConfigSchema,
+  AgentSourceRuntimeModeSchema: () => AgentSourceRuntimeModeSchema,
+  AgentSourceMigrationStateSchema: () => AgentSourceMigrationStateSchema,
+  AgentSourceCutoverSettingsSchema: () => AgentSourceCutoverSettingsSchema,
   AgentPackageManifestSchema: () => AgentPackageManifestSchema,
   ActionTypeValue: () => ActionTypeValue,
   ActionTypeSchema: () => ActionTypeSchema,
@@ -181610,7 +181738,7 @@ import { fileURLToPath as fileURLToPath6 } from "url";
 // package.json
 var package_default = {
   name: "@eigenpal/cli",
-  version: "0.5.9",
+  version: "0.5.10",
   description: "Eigenpal CLI — author and run document workflows from your terminal. Agent-ready.",
   keywords: [
     "eigenpal",
@@ -184117,7 +184245,7 @@ init_src();
 init_zod();
 var import_yaml2 = __toESM(require_dist(), 1);
 import { spawnSync as spawnSync2 } from "node:child_process";
-import { createHash as createHash2 } from "node:crypto";
+import { createCipheriv, createHash as createHash2, randomBytes } from "node:crypto";
 import {
   existsSync as existsSync3,
   mkdirSync as mkdirSync2,
@@ -184280,6 +184408,9 @@ function listRelativeFiles(dir) {
 function readYamlFile(filePath) {
   return import_yaml2.default.parse(readFileSync3(filePath, "utf8"));
 }
+function writeYamlFile(filePath, value) {
+  writeFileSync2(filePath, import_yaml2.default.stringify(value));
+}
 function packageManifestExists(gitRoot, packagePath) {
   return existsSync3(path2.join(gitRoot, packagePath, "eigenpal.yaml"));
 }
@@ -184290,6 +184421,28 @@ function releaseTagExists(gitRoot, packagePath, version2) {
 function readPackageManifest(packageRoot) {
   return SourcePackageManifestSchema.parse(readYamlFile(path2.join(packageRoot, "eigenpal.yaml")));
 }
+function requirePackageContext(opts = {}) {
+  const context = resolveGitSourceContext(opts);
+  if (!context.gitRoot || !context.packageRoot || !context.packagePath) {
+    throw new Error("Run this command inside a source package, or pass --dir.");
+  }
+  return {
+    gitRoot: context.gitRoot,
+    packageRoot: context.packageRoot,
+    packagePath: context.packagePath
+  };
+}
+function readMutablePackageManifest(packageRoot) {
+  const manifest = readYamlFile(path2.join(packageRoot, "eigenpal.yaml"));
+  if (!manifest || typeof manifest !== "object" || Array.isArray(manifest)) {
+    throw new Error("Package eigenpal.yaml must be a YAML object.");
+  }
+  return manifest;
+}
+function writeMutablePackageManifest(packageRoot, manifest) {
+  SourcePackageManifestSchema.parse(manifest);
+  writeYamlFile(path2.join(packageRoot, "eigenpal.yaml"), manifest);
+}
 function parsePackageRef(input) {
   const [rawPackage, rawRef, extra] = input.split("@");
   if (!rawPackage || extra !== undefined) {
@@ -185098,6 +185251,144 @@ async function sync(target, opts) {
   }
   await syncLatestAutomation(new ApiClient(resolveConfig(opts)), packagePath);
 }
+function setEmailTriggerAlias(email3, opts) {
+  const context = requirePackageContext(opts);
+  const manifest = readMutablePackageManifest(context.packageRoot);
+  const triggers = { ...manifest.triggers ?? {} };
+  const emailConfig = { ...triggers.email ?? {} };
+  const aliases = Array.isArray(emailConfig.aliases) ? [...emailConfig.aliases] : [];
+  const nextAlias = {
+    address: email3,
+    enabled: !opts.disabled,
+    allowlist: opts.allow ?? [],
+    replyConfig: {
+      ...opts.replyOn ? { on: opts.replyOn } : {},
+      ...opts.replyMode ? { mode: opts.replyMode } : {}
+    },
+    requireSenderAuth: opts.requireSenderAuth ?? true
+  };
+  const filtered = aliases.filter((alias) => typeof alias === "string" ? alias.toLowerCase() !== email3.toLowerCase() : alias.address?.toLowerCase() !== email3.toLowerCase());
+  manifest.triggers = {
+    ...triggers,
+    email: { ...emailConfig, enabled: true, aliases: [...filtered, nextAlias] }
+  };
+  writeMutablePackageManifest(context.packageRoot, manifest);
+  success2(`Updated email trigger ${ui.bold(email3)} in eigenpal.yaml.`);
+}
+function setApiTrigger(enabled, opts) {
+  const context = requirePackageContext(opts);
+  const manifest = readMutablePackageManifest(context.packageRoot);
+  const triggers = { ...manifest.triggers ?? {} };
+  manifest.triggers = { ...triggers, api: enabled };
+  writeMutablePackageManifest(context.packageRoot, manifest);
+  success2(`${enabled ? "Enabled" : "Disabled"} API trigger in eigenpal.yaml.`);
+}
+function encryptLocalSecret(input) {
+  if (input.key.byteLength !== 32)
+    throw new Error("Secret encryption key must be 32 bytes.");
+  const nonce = randomBytes(12);
+  const cipher = createCipheriv("aes-256-gcm", input.key, nonce);
+  cipher.setAAD(Buffer.from(JSON.stringify({
+    keyId: input.keyId,
+    organizationId: input.organizationId,
+    sourcePath: input.sourcePath,
+    secretName: input.secretName
+  })));
+  const ciphertext = Buffer.concat([cipher.update(input.plaintext, "utf8"), cipher.final()]);
+  return {
+    algorithm: "aes-256-gcm",
+    keyId: input.keyId,
+    nonce: nonce.toString("base64url"),
+    ciphertext: ciphertext.toString("base64url"),
+    tag: cipher.getAuthTag().toString("base64url")
+  };
+}
+function readSecretsFile(packageRoot) {
+  const filePath = path2.join(packageRoot, SOURCE_SECRETS_FILENAME);
+  if (!existsSync3(filePath))
+    return { schemaVersion: 1, secrets: {} };
+  return SourceSecretsFileSchema.parse(readYamlFile(filePath));
+}
+function writeSecretsFile(packageRoot, value) {
+  const secretsFile = SourceSecretsFileSchema.parse(value);
+  writeYamlFile(path2.join(packageRoot, SOURCE_SECRETS_FILENAME), secretsFile);
+}
+async function readSecretInput(opts) {
+  const selected = [opts.stdin, opts.valueFile].filter(Boolean).length;
+  if (selected > 1)
+    throw new Error("Pass only one of --stdin or --value-file.");
+  if (opts.stdin)
+    return readFileSync3(0, "utf8").replace(/\n$/, "");
+  if (opts.valueFile)
+    return readFileSync3(opts.valueFile, "utf8").replace(/\n$/, "");
+  if (process.stdin.isTTY && process.stdout.isTTY) {
+    const { password, isCancel, cancel } = await Promise.resolve().then(() => (init_dist4(), exports_dist));
+    const answer = await password({ message: "Secret value" });
+    if (isCancel(answer)) {
+      cancel("Cancelled");
+      process.exit(1);
+    }
+    return String(answer);
+  }
+  throw new Error("Secret value input is required in noninteractive mode.");
+}
+async function setSecret(name, opts) {
+  const context = requirePackageContext(opts);
+  const sourcePath = `${context.packagePath}/${SOURCE_SECRETS_FILENAME}`;
+  const secretsFile = readSecretsFile(context.packageRoot);
+  const secrets = { ...secretsFile.secrets };
+  secrets[name] = {
+    ...opts.description ? { description: opts.description } : {},
+    encrypted: encryptLocalSecret({
+      plaintext: await readSecretInput(opts),
+      keyId: opts.keyId,
+      key: readSecretKeyFile(opts.keyFile),
+      organizationId: opts.organizationId,
+      sourcePath,
+      secretName: name
+    })
+  };
+  writeSecretsFile(context.packageRoot, { schemaVersion: 1, secrets });
+  success2(`Encrypted ${ui.bold(name)} into secrets.enc.yaml.`);
+}
+function unsetSecret(name, opts) {
+  const context = requirePackageContext(opts);
+  const secretsFile = readSecretsFile(context.packageRoot);
+  const secrets = { ...secretsFile.secrets };
+  delete secrets[name];
+  writeSecretsFile(context.packageRoot, { schemaVersion: 1, secrets });
+  success2(`Removed ${ui.bold(name)} from secrets.enc.yaml.`);
+}
+async function importSecrets(envFile, opts) {
+  const content = readFileSync3(envFile, "utf8");
+  for (const line of content.split(/\r?\n/)) {
+    const trimmed = line.trim();
+    if (!trimmed || trimmed.startsWith("#"))
+      continue;
+    const idx = trimmed.indexOf("=");
+    if (idx === -1)
+      continue;
+    const context = requirePackageContext(opts);
+    const sourcePath = `${context.packagePath}/${SOURCE_SECRETS_FILENAME}`;
+    const secretsFile = readSecretsFile(context.packageRoot);
+    const secrets = { ...secretsFile.secrets };
+    const name = trimmed.slice(0, idx);
+    secrets[name] = {
+      encrypted: encryptLocalSecret({
+        plaintext: trimmed.slice(idx + 1),
+        keyId: opts.keyId,
+        key: readSecretKeyFile(opts.keyFile),
+        organizationId: opts.organizationId,
+        sourcePath,
+        secretName: name
+      })
+    };
+    writeSecretsFile(context.packageRoot, { schemaVersion: 1, secrets });
+  }
+}
+function readSecretKeyFile(keyFile) {
+  return Buffer.from(readFileSync3(keyFile, "utf8").trim(), "base64url");
+}
 async function install(packageRef, opts) {
   const config2 = resolveConfig(opts);
   const context = resolveGitSourceContext();
@@ -185401,6 +185692,16 @@ function parseReleaseVersion(value) {
   }
   return value;
 }
+function parseBoolean(value) {
+  if (value === "true" || value === "enabled" || value === "on")
+    return true;
+  if (value === "false" || value === "disabled" || value === "off")
+    return false;
+  throw new InvalidArgumentError("Expected true/false, enabled/disabled, or on/off");
+}
+function collect2(value, previous) {
+  return [...previous, value];
+}
 function parseType(value) {
   if (!["agent", "workflow"].includes(value))
     throw new InvalidArgumentError("type must be agent or workflow");
@@ -185431,6 +185732,14 @@ function registerGitCommands(program2) {
   addJsonFlag(withBaseUrl(git.command("versions <package>"))).description("List package release versions.").action(action(versions2));
   withBaseUrl(git.command("release")).description("Create and push a package release tag.").argument("<version>", "Version or bump level", parseReleaseVersion).argument("[dir]", "Package directory").addOption(new Option("-m, --message <message>", "Annotated tag message").makeOptionMandatory()).action(action(async (versionOrBump, dir, opts) => release(versionOrBump, dir, opts)));
   withBaseUrl(git.command("sync [automation]")).description("Sync an automation from the latest Git source release.").option("--dir <dir>", "Directory to inspect").action(action(sync));
+  const trigger = git.command("trigger").description("Edit trigger policy in eigenpal.yaml.");
+  trigger.command("api <enabled>").description("Enable or disable API trigger policy in eigenpal.yaml.").option("--dir <dir>", "Directory to inspect").action(action(async (enabled, opts) => setApiTrigger(parseBoolean(enabled), opts)));
+  const triggerEmail = trigger.command("email").description("Edit email trigger policy.");
+  triggerEmail.command("set <email>").description("Add or update an email trigger alias in eigenpal.yaml.").option("--dir <dir>", "Directory to inspect").option("--disabled", "Write the alias as disabled").option("--allow <entry>", "Allowed sender entry; repeatable", collect2, []).option("--reply-on <never|always>", "Reply behavior").option("--reply-mode <sender|all>", "Reply recipient mode").option("--no-require-sender-auth", "Disable sender-auth checks for this alias").action(action(async (email3, opts) => setEmailTriggerAlias(email3, opts)));
+  const secret = git.command("secret").description("Edit encrypted secrets.enc.yaml.");
+  secret.command("set <name>").description("Encrypt and set a secret value in secrets.enc.yaml.").option("--dir <dir>", "Directory to inspect").option("--stdin", "Read the secret value from stdin").option("--value-file <path>", "Read the secret value from a file").requiredOption("--key-id <id>", "Organization decrypt key id").requiredOption("--key-file <path>", "File containing the base64url-encoded organization key").requiredOption("--organization-id <id>", "Organization id for authenticated data").option("--description <text>", "Secret description").action(action(setSecret));
+  secret.command("unset <name>").description("Remove a secret from secrets.enc.yaml.").option("--dir <dir>", "Directory to inspect").action(action(async (name, opts) => unsetSecret(name, opts)));
+  secret.command("import <env-file>").description("Import KEY=value entries from an env file into secrets.enc.yaml.").option("--dir <dir>", "Directory to inspect").requiredOption("--key-id <id>", "Organization decrypt key id").requiredOption("--key-file <path>", "File containing the base64url-encoded organization key").requiredOption("--organization-id <id>", "Organization id for authenticated data").action(action(importSecrets));
 }
 
 // src/commands/init.ts
@@ -186029,15 +186338,15 @@ function pruneEmptyDirs(root) {
   if (!existsSync5(root))
     return;
   const stack = [];
-  const collect2 = (dir) => {
+  const collect3 = (dir) => {
     for (const entry of readdirSync3(dir)) {
       const full = join3(dir, entry);
       if (lstatSync(full).isDirectory())
-        collect2(full);
+        collect3(full);
     }
     stack.push(dir);
   };
-  collect2(root);
+  collect3(root);
   for (const dir of stack) {
     try {
       if (readdirSync3(dir).length === 0)

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@eigenpal/cli",
-  "version": "0.5.9",
+  "version": "0.5.10",
   "description": "Eigenpal CLI — author and run document workflows from your terminal. Agent-ready.",
   "keywords": [
     "eigenpal",