@epilot/cli 0.1.130 → 0.1.131

package/README.md

@@ -29,7 +29,7 @@ npm install -g @epilot/cli
 
 <!-- usage-help -->
 ```
-epilot v0.1.130 — CLI for epilot APIs
+epilot v0.1.131 — CLI for epilot APIs
 
 USAGE
   epilot <api> <operationId> [params...] [flags]

package/definitions/app.json

@@ -1438,6 +1438,70 @@
         }
       }
     },
+    "/v1/app/{appId}/options/resolve": {
+      "post": {
+        "summary": "resolveOptions",
+        "description": "Resolve the effective app-level options of an installation, including decrypted sensitive values (secrets). This endpoint accepts epilot internal-auth tokens exclusively (internal service calls, e.g. automation-workers or the customer portal API) — no user token, API key, or app token can call it, regardless of roles. Every call is audit-logged with the caller identity.",
+        "operationId": "resolveOptions",
+        "tags": [
+          "App Installation"
+        ],
+        "parameters": [
+          {
+            "name": "appId",
+            "in": "path",
+            "required": true,
+            "schema": {
+              "type": "string"
+            }
+          }
+        ],
+        "requestBody": {
+          "content": {
+            "application/json": {
+              "schema": {
+                "type": "object",
+                "properties": {
+                  "keys": {
+                    "type": "array",
+                    "items": {
+                      "type": "string"
+                    },
+                    "description": "Narrow the response to these option keys"
+                  }
+                }
+              }
+            }
+          }
+        },
+        "responses": {
+          "200": {
+            "description": "Effective options with resolved values",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "type": "object",
+                  "properties": {
+                    "options": {
+                      "type": "array",
+                      "items": {
+                        "$ref": "#/components/schemas/Options"
+                      }
+                    }
+                  }
+                }
+              }
+            }
+          },
+          "403": {
+            "description": "Caller is not authenticated with an internal-auth token"
+          },
+          "404": {
+            "description": "App installation not found"
+          }
+        }
+      }
+    },
     "/v1/app-events": {
       "post": {
         "summary": "ingestEvent",
@@ -1831,6 +1895,13 @@
                     "$ref": "#/components/schemas/FunctionDefinition"
                   },
                   "description": "Replaces the full set of server-side functions for this version"
+                },
+                "options": {
+                  "type": "array",
+                  "items": {
+                    "$ref": "#/components/schemas/Options"
+                  },
+                  "description": "Replaces the full set of app-level option declarations for this version.\nOption keys must be unique app-wide; `secret`-touching options are always\nsensitive and must not declare `sensitive: false`.\n"
                 }
               }
             }
@@ -1984,6 +2055,25 @@
               "object"
             ],
             "description": "The type of this option. `object` declares a structured value whose fields are listed\nunder `fields`. Combine with `repeatable: true` to express a list of these objects.\n"
+          },
+          "sensitive": {
+            "type": "boolean",
+            "description": "Write-only, server-side only value — like a sensitive environment variable\n(app-level options only). Sensitive values are never serialized in any response;\nthey are resolvable only via server-side channels (API proxy injection, function\n`secrets` allowlist, the internal options/resolve endpoint). Non-sensitive values\nare readable wherever the app runs, including the end-customer browser (journey and\nportal runtime). Forced to true for `secret`-touching options. Default: false.\n"
+          },
+          "configured": {
+            "type": "boolean",
+            "readOnly": true,
+            "description": "Serialized instead of `value` for sensitive options (secrets): true when a\nvalue is stored.\n"
+          },
+          "lifted": {
+            "type": "boolean",
+            "readOnly": true,
+            "description": "Compatibility marker: this option is declared at app level and folded back\ninto the component's options so existing consumers (journey runtime, portal\nblocks, older services) keep working unchanged. New consumers should read\napp-level options from the installation's `options` array instead.\n"
+          },
+          "value_updated_at": {
+            "type": "string",
+            "readOnly": true,
+            "description": "Timestamp of the last value change. Only returned for sensitive options\n(alongside `configured`) so installers can see when a secret was last rotated.\n"
           }
         }
       },
@@ -2048,7 +2138,7 @@
         "properties": {
           "component_id": {
             "type": "string",
-            "description": "ID of the component these values are for"
+            "description": "ID of the component these values are for. Use the sentinel `$app` for\napp-level option values (options declared at the manifest top level).\n"
           },
           "options": {
             "type": "array",
@@ -2118,7 +2208,7 @@
           "label": {
             "allOf": [
               {
-                "description": null
+                "description": "Human-readable display name of the function, shown to installing organizations (e.g. in the scheduled-functions summary)\n"
               },
               {
                 "$ref": "#/components/schemas/TranslatedString"
@@ -2164,7 +2254,8 @@
             "items": {
               "type": "string"
             },
-            "description": "Keys of installation options of type secret made available to the function via input.app_options\n"
+            "deprecated": true,
+            "description": "DEPRECATED and ignored — functions receive the app's full effective option keyspace (sensitive values included) via input.app_options. Kept for manifest compatibility.\n"
           }
         }
       },
@@ -2254,6 +2345,13 @@
             },
             "description": "List of options for the app component"
           },
+          "uses_options": {
+            "type": "array",
+            "items": {
+              "type": "string"
+            },
+            "description": "Keys of app-level options this component uses. Narrows which options are\nfolded back into `options` for legacy consumers (e.g. which values a journey\nblock receives in its public args) — a scoping hint, never a security\nboundary. Stamped automatically by the component-options migration; may also\nbe declared by the app developer.\n"
+          },
           "surfaces": {
             "type": "object"
           }
@@ -4840,6 +4938,14 @@
             "minItems": 0,
             "description": "Server-side functions of the app, including scheduled functions"
           },
+          "options": {
+            "type": "array",
+            "items": {
+              "$ref": "#/components/schemas/Options"
+            },
+            "minItems": 0,
+            "description": "App-level option declarations (with sensitivity) of this version"
+          },
           "visibility": {
             "type": "string",
             "enum": [
@@ -5077,6 +5183,14 @@
             },
             "readOnly": true
           },
+          "options": {
+            "description": "Effective app-level options of the installation: declared top-level options plus\ncomponent-level options lifted to the app keyspace, each with its configured\n`value`. Values of sensitive options (secrets) are never included — they carry\n`configured` and `value_updated_at` instead.\n",
+            "type": "array",
+            "items": {
+              "$ref": "#/components/schemas/Options"
+            },
+            "readOnly": true
+          },
           "installed_version": {
             "type": "string",
             "description": "Version of the app that is installed",
@@ -5192,6 +5306,14 @@
             "minItems": 0,
             "description": "Server-side functions of the app, including scheduled functions"
           },
+          "options": {
+            "type": "array",
+            "items": {
+              "$ref": "#/components/schemas/Options"
+            },
+            "minItems": 0,
+            "description": "App-level option declarations (with sensitivity) of this version"
+          },
           "is_beta": {
             "type": "boolean",
             "description": "Flag to indicate if the app is in beta.",
@@ -5442,6 +5564,11 @@
               "correlation_id": {
                 "type": "string",
                 "description": "Filter by correlation ID for tracing"
+              },
+              "search": {
+                "type": "string",
+                "maxLength": 200,
+                "description": "Case-insensitive substring match over event details and component id"
               }
             }
           },
@@ -5492,6 +5619,11 @@
                 "minimum": 1,
                 "maximum": 1000,
                 "default": 100
+              },
+              "before": {
+                "type": "string",
+                "format": "date-time",
+                "description": "Cursor: only return events strictly older than this timestamp. Use the timestamp of the last received event to fetch the next page; more efficient than increasing page/page_size.\n"
               }
             }
           },

package/definitions/entity.json

@@ -2,7 +2,7 @@
   "openapi": "3.0.2",
   "info": {
     "title": "Entity API",
-    "version": "2.9.0",
+    "version": "2.10.0",
     "description": "Flexible data layer for epilot Entities.\n\nUse this API configure and access your business objects like Contacts, Opportunities and Products.\n\n[Feature Documentation](https://docs.epilot.io/docs/entities/flexible-entities)\n"
   },
   "tags": [
@@ -5072,7 +5072,8 @@
               },
               "grid_layout": {
                 "type": "object",
-                "description": "Widget-grid layout for the entity-details page (builder-authored); columns/cells drive the grid geometry.",
+                "deprecated": true,
+                "description": "Superseded by `widget_widths`. A whole-grid layout preset that assigned each widget a width by its POSITION, so a widget that rendered nothing shifted every width after it. Neither the entity app nor the entity builder reads it any more; values stored before it was replaced are left in place rather than migrated.",
                 "properties": {
                   "id": {
                     "type": "string",
@@ -5108,6 +5109,23 @@
                   "next_best_action": true,
                   "address_map": false
                 }
+              },
+              "widget_widths": {
+                "type": "object",
+                "description": "Per-widget width in the entity-details widget grid, keyed by widget id (a capability widget's `component`, or `summary` for the synthesized summary card). Spans a 12-column grid: `one_third_width` = 4, `half_width` = 6, `two_third_width` = 8, `full_width` = 12. Holds only the admin's deviations from each widget's declared default: a widget absent from this map falls back to its ui_hook `default_width`, and then to `full_width`. Do not seed this map from migrations — doing so would freeze today's defaults into the schema. Replaces the positional `grid_layout` preset.",
+                "additionalProperties": {
+                  "type": "string",
+                  "enum": [
+                    "one_third_width",
+                    "half_width",
+                    "two_third_width",
+                    "full_width"
+                  ]
+                },
+                "example": {
+                  "address_map": "full_width",
+                  "recent_communications": "one_third_width"
+                }
               }
             }
           },
@@ -7577,6 +7595,17 @@
                   "description": "Whether this widget is switched on by default for entity types that have the capability. Only meaningful on the `EntityDetailsV2:Widget` hook. Defaults to true when omitted. An admin's explicit choice in the entity builder is stored in the schema's `ui_config.widget_visibility` and wins over this.",
                   "example": false
                 },
+                "default_width": {
+                  "type": "string",
+                  "enum": [
+                    "one_third_width",
+                    "half_width",
+                    "two_third_width",
+                    "full_width"
+                  ],
+                  "description": "How wide this widget is by default in the entity-details widget grid. Only meaningful on the `EntityDetailsV2:Widget` and `EntityDetailsV2:Header` hooks. Defaults to `full_width` when omitted — deliberately unlike the attribute layout default of `half_width`, because a full-width widget can never leave a hole in a row. An admin's explicit choice in the entity builder is stored in the schema's `ui_config.widget_widths` and wins over this.",
+                  "example": "half_width"
+                },
                 "pricing_tier_setting": {
                   "type": "string",
                   "description": "The pricing-tier settings key an organisation must have enabled to use this widget. Omit for widgets available to everyone. Resolved against `GET /v2/pricing-tiers/me` as `override_settings[key].enabled ?? settings[key].enabled`. Note this is commercial packaging enforced in the UI, not a security control — the key must also be added to the pricing tier settings list in epilot-admin-portal, or it can never be switched on for a tier.",
@@ -8964,6 +8993,39 @@
                 "description": "Optional array of field names to include in the hydrated entity response for this node.\nWhen specified, only the requested fields plus required internal fields (_id, _schema, _org) will be returned.\nOnly applies when hydrate=true.\n"
               }
             ]
+          },
+          "filter": {
+            "type": "array",
+            "description": "Narrows this node's traversal results to entities matching every filter (AND semantics). Useful for\ndisambiguating among multiple entities reachable via the same graph edge.\n",
+            "items": {
+              "$ref": "#/components/schemas/GraphNodeFilter"
+            }
+          }
+        }
+      },
+      "GraphNodeFilter": {
+        "type": "object",
+        "description": "Entities are included in this node's result only if `attribute` exactly equals the literal `value`.",
+        "required": [
+          "attribute",
+          "value"
+        ],
+        "properties": {
+          "attribute": {
+            "type": "string",
+            "description": "Entity attribute name to match against. Must be a plain attribute name, not an Elasticsearch field path.",
+            "example": "order_number"
+          },
+          "value": {
+            "allOf": [
+              {
+                "$ref": "#/components/schemas/SearchFilterValue"
+              },
+              {
+                "description": "Literal value the attribute must exactly equal for the entity to be included in this node's result."
+              }
+            ],
+            "example": "OR-113"
           }
         }
       },

package/definitions/pricing.json

@@ -4773,6 +4773,9 @@
           "conditions",
           "valid_from",
           "values",
+          "_created_at",
+          "_updated_at",
+          "_revision",
           "warnings"
         ],
         "properties": {
@@ -4805,14 +4808,19 @@
             "$ref": "#/components/schemas/VariantValues"
           },
           "_created_at": {
-            "type": "string"
+            "type": "string",
+            "description": "When the first version was created.",
+            "readOnly": true
           },
           "_updated_at": {
-            "type": "string"
+            "type": "string",
+            "description": "When the first version was last written.",
+            "readOnly": true
           },
           "_revision": {
             "type": "number",
-            "description": "The revision a later write to this version must carry to be accepted. Genuinely current,\nunlike one read back later from an eventually-consistent read.\n"
+            "description": "The revision a later write to this version must carry to be accepted. Genuinely current,\nunlike one read back later from an eventually-consistent read.\n",
+            "readOnly": true
           },
           "warnings": {
             "type": "array",
@@ -4827,7 +4835,9 @@
         "type": "object",
         "required": [
           "code",
-          "message"
+          "message",
+          "variant_count",
+          "cap"
         ],
         "properties": {
           "code": {
@@ -4890,7 +4900,10 @@
           "schema",
           "conditions",
           "valid_from",
-          "values"
+          "values",
+          "_created_at",
+          "_updated_at",
+          "_revision"
         ],
         "properties": {
           "variant_id": {
@@ -4921,14 +4934,19 @@
             "$ref": "#/components/schemas/VariantValues"
           },
           "_created_at": {
-            "type": "string"
+            "type": "string",
+            "description": "When this version was created.",
+            "readOnly": true
           },
           "_updated_at": {
-            "type": "string"
+            "type": "string",
+            "description": "When this version was last written.",
+            "readOnly": true
           },
           "_revision": {
             "type": "integer",
             "description": "The revision a write to this version must carry to be accepted. Always current: every read\nthat returns one is strongly consistent, so it is never a marker a write would be refused\nfor having read too early.\n",
+            "readOnly": true,
             "example": 3
           }
         }

package/dist/bin/epilot.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import {
   API_LIST
-} from "../chunk-4J5ZADZC.js";
+} from "../chunk-W65MAOR7.js";
 
 // bin/epilot.ts
 import { runMain } from "citty";
@@ -11,7 +11,7 @@ import { defineCommand } from "citty";
 var main = defineCommand({
   meta: {
     name: "epilot",
-    version: "0.1.130",
+    version: "0.1.131",
     description: "CLI for epilot APIs"
   },
   args: {
@@ -30,8 +30,8 @@ var main = defineCommand({
     auth: () => import("../auth-WMXFMPWE.js").then((m) => m.default),
     profile: () => import("../profile-OZJL5ZPT.js").then((m) => m.default),
     config: () => import("../config-DGZIMLZK.js").then((m) => m.default),
-    completion: () => import("../completion-GFINH6YJ.js").then((m) => m.default),
-    upgrade: () => import("../upgrade-QPOYGFSB.js").then((m) => m.default),
+    completion: () => import("../completion-2WQXG7JT.js").then((m) => m.default),
+    upgrade: () => import("../upgrade-KC42PNIK.js").then((m) => m.default),
     "access-token": () => import("../access-token-WWE6BDJH.js").then((m) => m.default),
     address: () => import("../address-EH3C4CVB.js").then((m) => m.default),
     "address-suggestions": () => import("../address-suggestions-RRSLOBFW.js").then((m) => m.default),
@@ -134,13 +134,13 @@ process.stderr.on("error", (err) => {
   if (err.code === "EPIPE") process.exit(0);
   throw err;
 });
-var VERSION = true ? "0.1.130" : (await null).default.version;
+var VERSION = true ? "0.1.131" : (await null).default.version;
 var reorderedArgv = hoistFlagsAfterSubcommand(process.argv.slice(2));
 process.argv = [process.argv[0], process.argv[1], ...reorderedArgv];
 var args = process.argv.slice(2);
 var completionsIdx = args.indexOf("--_completions");
 if (completionsIdx >= 0) {
-  const { handleCompletions } = await import("../completion-GFINH6YJ.js");
+  const { handleCompletions } = await import("../completion-2WQXG7JT.js");
   handleCompletions(args[completionsIdx + 1], args[completionsIdx + 2]);
   process.exit(0);
 }

package/dist/{chunk-4J5ZADZC.js → chunk-W65MAOR7.js}

@@ -71,7 +71,7 @@ var API_LIST = [
     kebabName: "app",
     title: "App API",
     serverUrl: "https://app.sls.epilot.io",
-    operationCount: 35,
+    operationCount: 36,
     operationIds: [
       "getPublicFacingComponent",
       "listConfigurations",
@@ -102,6 +102,7 @@ var API_LIST = [
       "patchInstallation",
       "uninstall",
       "promoteVersion",
+      "resolveOptions",
       "ingestEvent",
       "publicProxyGet",
       "publicProxyPost",

package/dist/{completion-GFINH6YJ.js → completion-2WQXG7JT.js}

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import {
   API_LIST
-} from "./chunk-4J5ZADZC.js";
+} from "./chunk-W65MAOR7.js";
 import {
   DIM,
   GREEN,

package/dist/{upgrade-QPOYGFSB.js → upgrade-KC42PNIK.js}

@@ -72,7 +72,7 @@ ${GREEN}${BOLD}Upgraded to @epilot/cli@${latest}${RESET}
   }
 });
 var getCurrentVersion = () => {
-  if (true) return "0.1.130";
+  if (true) return "0.1.131";
   try {
     const output = execSync("npm ls -g @epilot/cli --depth=0 --json 2>/dev/null", {
       encoding: "utf-8",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@epilot/cli",
-  "version": "0.1.130",
+  "version": "0.1.131",
   "description": "CLI for epilot APIs",
   "type": "module",
   "bin": {