@epilot/cli 0.1.138 → 0.1.140

package/README.md

@@ -29,7 +29,7 @@ npm install -g @epilot/cli
 
 <!-- usage-help -->
 ```
-epilot v0.1.138 — CLI for epilot APIs
+epilot v0.1.140 — CLI for epilot APIs
 
 USAGE
   epilot <api> <operationId> [params...] [flags]

package/definitions/blueprint-manifest.json

@@ -2617,7 +2617,7 @@
       "post": {
         "operationId": "continueInstallationJob",
         "summary": "continueInstallationJob",
-        "description": "Resume an installation job that is paused at `status: \"WAITING_USER_ACTION\"` after\nplanning. Works for both Terraform and V3 jobs. Not needed for V3 installs created\nwith `auto_apply: true` (including all bulk-install child jobs), which apply\nwithout pausing.\n",
+        "description": "Resume an installation job that is paused at `status: \"WAITING_USER_ACTION\"` after\nplanning. Works for both Terraform and V3 jobs. Not needed for V3 installs created\nwith `auto_apply: true` (including all bulk-install child jobs), which apply\nwithout pausing.\n\nAlso resumes a V3 install paused at `status: \"REAUTH_REQUIRED\"`, where the\ncaller's credentials could not safely cover another run. The job keeps its\n`job_id`, so resuming continues from the operation-log checkpoint rather than\nre-applying completed work. The request's bearer token becomes the destination\ncredential; for a cross-org install whose SOURCE credential also expired, send a\nfreshly scoped source token as `source_auth_token` — the destination bearer is not\na valid substitute for it.\n",
         "tags": [
           "Jobs"
         ],
@@ -2636,7 +2636,7 @@
           "content": {
             "application/json": {
               "schema": {
-                "$ref": "#/components/schemas/BlueprintInstallationJobOptions"
+                "$ref": "#/components/schemas/ContinueInstallationJobRequest"
               }
             }
           }
@@ -2655,6 +2655,60 @@
         }
       }
     },
+    "/v2/blueprint-manifest/jobs/{job_id}:retry": {
+      "post": {
+        "operationId": "retryInstallationJob",
+        "summary": "retryInstallationJob",
+        "description": "Retry a finished V3 installation job whose status is `FAILED` or\n`PARTIAL_SUCCESS`. Starts a fresh install job (new `job_id`) with the same\nsource/destination and `auto_apply: true` — no `:continue` call is needed.\nThe plan phase re-resolves every resource: already-synced resources no-op,\nso effectively only the failed resources are re-applied.\n\nMust be called by a user of the destination org (where the job lives); the\ncaller's bearer token is used as the destination token. The plan reuses the\nmanifest persisted by the original install, so no source-org access is\nrequired. The original job's `options` (ignored resources, sync_notes) are\nreused when present; older jobs without persisted options fall back to the\ndestination blueprint's `ignored_resource_addresses`.\n",
+        "tags": [
+          "Jobs"
+        ],
+        "parameters": [
+          {
+            "in": "path",
+            "required": true,
+            "name": "job_id",
+            "schema": {
+              "$ref": "#/components/schemas/BlueprintJobID"
+            }
+          }
+        ],
+        "responses": {
+          "202": {
+            "description": "Retry install job started",
+            "headers": {
+              "Location": {
+                "description": "Path to poll the resulting job: GET /v2/blueprint-manifest/jobs/{job_id}",
+                "schema": {
+                  "type": "string"
+                }
+              }
+            },
+            "content": {
+              "application/json": {
+                "schema": {
+                  "type": "object",
+                  "properties": {
+                    "job_id": {
+                      "$ref": "#/components/schemas/BlueprintJobID"
+                    },
+                    "destination_blueprint_id": {
+                      "$ref": "#/components/schemas/BlueprintID"
+                    }
+                  }
+                }
+              }
+            }
+          },
+          "400": {
+            "description": "Job is not a retryable V3 installation job"
+          },
+          "404": {
+            "description": "Job not found"
+          }
+        }
+      }
+    },
     "/v2/blueprint-manifest/jobs/{job_id}:cancel": {
       "post": {
         "operationId": "cancelBlueprintJob",
@@ -3354,6 +3408,29 @@
                     "type": "boolean",
                     "description": "When `true`, the install skips the manual plan-approval step and applies\nstraight after plan + snapshot succeed (no `:continue` call needed).\nDefaults to `false`. Used internally by the bulk-install worker.\n",
                     "default": false
+                  },
+                  "session_credentials": {
+                    "type": "object",
+                    "description": "Lets the install refresh the caller's session on its own, so a run that\noutlives the ~60 minute token lifetime continues without the user present.\nHeld server-side for the job's lifetime, referenced from the state machine\nrather than embedded in it, and deleted when the job finishes.\n\nOptional. Without it an install that outruns its token pauses at\n`status: \"REAUTH_REQUIRED\"` and waits to be resumed through\n`POST /v2/blueprint-manifest/jobs/{job_id}:continue`.\n\nBounded by the refresh token itself (18 hours), not unlimited.\n",
+                    "required": [
+                      "refresh_token",
+                      "client_id"
+                    ],
+                    "properties": {
+                      "refresh_token": {
+                        "type": "string",
+                        "format": "password",
+                        "description": "Cognito refresh token for the caller, scoped to the source org."
+                      },
+                      "client_id": {
+                        "type": "string",
+                        "description": "The Cognito app client the refresh token was issued for. Required because\nepilot provisions one user pool and app client per organization at\nruntime, so the service cannot derive it.\n"
+                      },
+                      "pipeline_id": {
+                        "type": "string",
+                        "description": "Cross-org installs only. The destination credential is not a Cognito\nsession — it is minted from the refreshed source session through\nsandbox-api, so it is re-derived per continuation instead of stored.\n"
+                      }
+                    }
                   }
                 }
               },
@@ -5284,11 +5361,15 @@
                   "$ref": "#/components/schemas/V3ResourceProgressEntry"
                 }
               },
+              "options": {
+                "$ref": "#/components/schemas/BlueprintInstallationJobOptions"
+              },
               "status": {
                 "type": "string",
                 "enum": [
                   "IN_PROGRESS",
                   "WAITING_USER_ACTION",
+                  "REAUTH_REQUIRED",
                   "CANCELED",
                   "SUCCESS",
                   "PARTIAL_SUCCESS",
@@ -6440,6 +6521,23 @@
           }
         }
       },
+      "ContinueInstallationJobRequest": {
+        "allOf": [
+          {
+            "$ref": "#/components/schemas/BlueprintInstallationJobOptions"
+          },
+          {
+            "type": "object",
+            "properties": {
+              "source_auth_token": {
+                "description": "A freshly issued bearer for the SOURCE organization, used only when resuming a\njob paused at `REAUTH_REQUIRED` whose source credential also expired. Applies to\ncross-org installs: apply-time reads such as the authenticated File API fallback\nfor private source files run against the source org, so the destination bearer\ncannot stand in for them. Omit it to keep the source token the job already has.\n",
+                "type": "string",
+                "format": "password"
+              }
+            }
+          }
+        ]
+      },
       "ManifestID": {
         "type": "string",
         "description": "ID of an imported / installed manifest",
@@ -6512,6 +6610,7 @@
           "PENDING",
           "STARTED",
           "WAITING_USER_ACTION",
+          "REAUTH_REQUIRED",
           "CANCELED",
           "IN_PROGRESS",
           "SUCCESS",

package/definitions/environments.json

@@ -20,7 +20,7 @@
     "/v1/environments": {
       "get": {
         "operationId": "listEnvironmentVariables",
-        "summary": "List environment variables",
+        "summary": "listEnvironmentVariables",
         "description": "List all environment variables for the organization. Returns metadata only, no secret values.",
         "tags": [
           "environments"
@@ -49,8 +49,8 @@
       },
       "post": {
         "operationId": "createEnvironmentVariable",
-        "summary": "Create environment variable",
-        "description": "Create a new environment variable or secret for the organization.",
+        "summary": "createEnvironmentVariable",
+        "description": "Create a new environment variable or secret for the organization. If `group` is provided and the group does not yet exist, it is created automatically.",
         "tags": [
           "environments"
         ],
@@ -96,7 +96,7 @@
     "/v1/environments/groups": {
       "get": {
         "operationId": "listEnvironmentGroups",
-        "summary": "List environment groups",
+        "summary": "listEnvironmentGroups",
         "description": "List all environment groups for the organization.",
         "tags": [
           "environments"
@@ -138,6 +138,7 @@
       "put": {
         "operationId": "putEnvironmentGroup",
         "summary": "putEnvironmentGroup",
+        "description": "Create or update an environment group by name. Acts as an upsert — creates the group if it does not exist.",
         "tags": [
           "environments"
         ],
@@ -185,7 +186,7 @@
       },
       "delete": {
         "operationId": "deleteEnvironmentGroup",
-        "summary": "Delete an environment group",
+        "summary": "deleteEnvironmentGroup",
         "description": "Deletes a group. Variables assigned to this group become ungrouped.",
         "tags": [
           "environments"
@@ -224,8 +225,8 @@
       ],
       "get": {
         "operationId": "getEnvironmentVariable",
-        "summary": "Get environment variable",
-        "description": "Get an environment variable by key. Returns value only for String type, omitted for SecretString.",
+        "summary": "getEnvironmentVariable",
+        "description": "Get an environment variable by key. Returns value for non-secret types, omitted for SecretString.",
         "tags": [
           "environments"
         ],
@@ -256,8 +257,8 @@
       },
       "put": {
         "operationId": "updateEnvironmentVariable",
-        "summary": "Update environment variable",
-        "description": "Create or update an environment variable. Acts as an upsert — creates the variable if it does not exist.",
+        "summary": "updateEnvironmentVariable",
+        "description": "Create or update an environment variable. Acts as an upsert — creates the variable if it does not exist. If `group` is provided and the group does not yet exist, it is created automatically.",
         "tags": [
           "environments"
         ],
@@ -301,6 +302,9 @@
           "403": {
             "description": "Forbidden"
           },
+          "409": {
+            "description": "Cannot change the type of a variable that currently holds a value"
+          },
           "500": {
             "description": "Internal server error"
           }
@@ -308,7 +312,7 @@
       },
       "delete": {
         "operationId": "deleteEnvironmentVariable",
-        "summary": "Delete environment variable",
+        "summary": "deleteEnvironmentVariable",
         "description": "Delete an environment variable by key.",
         "tags": [
           "environments"
@@ -344,9 +348,99 @@
     "schemas": {
       "EnvironmentValueType": {
         "type": "string",
+        "description": "The structure a variable's value holds. `SecretString` is encrypted at rest and\nits value is never returned. `Text`, `Number`, `Boolean` and `Options` may be\nserved to browser-facing consumers; `String` and `SecretString` may not.\n",
         "enum": [
           "String",
-          "SecretString"
+          "SecretString",
+          "Text",
+          "Number",
+          "Boolean",
+          "Options"
+        ]
+      },
+      "EnvironmentOption": {
+        "oneOf": [
+          {
+            "type": "object",
+            "required": [
+              "value",
+              "label"
+            ],
+            "additionalProperties": false,
+            "properties": {
+              "value": {
+                "type": "string",
+                "minLength": 1
+              },
+              "label": {
+                "type": "string",
+                "minLength": 1
+              }
+            }
+          },
+          {
+            "type": "object",
+            "required": [
+              "value",
+              "labels"
+            ],
+            "additionalProperties": false,
+            "properties": {
+              "value": {
+                "type": "string",
+                "minLength": 1
+              },
+              "labels": {
+                "type": "object",
+                "minProperties": 1,
+                "propertyNames": {
+                  "pattern": "^[a-z]{2,3}(-[A-Za-z0-9]+)*$"
+                },
+                "additionalProperties": {
+                  "type": "string",
+                  "minLength": 1
+                }
+              }
+            }
+          }
+        ]
+      },
+      "OptionsValue": {
+        "type": "object",
+        "required": [
+          "options"
+        ],
+        "additionalProperties": false,
+        "properties": {
+          "fallbackLanguage": {
+            "type": "string",
+            "minLength": 2,
+            "default": "de"
+          },
+          "options": {
+            "type": "array",
+            "minItems": 1,
+            "items": {
+              "$ref": "#/components/schemas/EnvironmentOption"
+            }
+          }
+        }
+      },
+      "EnvironmentValue": {
+        "description": "A variable's value. The JSON type corresponds to the variable's `type`:\n`String`, `SecretString` and `Text` are strings, `Number` is a number,\n`Boolean` is a boolean, and `Options` is an object. Numbers are IEEE 754\ndoubles; integers above 2^53 may lose precision on round-trip.\n",
+        "oneOf": [
+          {
+            "type": "string"
+          },
+          {
+            "type": "number"
+          },
+          {
+            "type": "boolean"
+          },
+          {
+            "$ref": "#/components/schemas/OptionsValue"
+          }
         ]
       },
       "EnvironmentVariable": {
@@ -373,8 +467,16 @@
             "description": "Optional group name for organising variables in the UI"
           },
           "value": {
-            "type": "string",
-            "description": "Value is returned for String type, omitted for SecretString"
+            "allOf": [
+              {
+                "$ref": "#/components/schemas/EnvironmentValue"
+              }
+            ],
+            "description": "Returned for non-secret types, omitted for SecretString. Also omitted when\nthe variable has been created without a value — for example by a blueprint\ninstall, which syncs a variable's key and type but never its value.\n"
+          },
+          "protected": {
+            "type": "boolean",
+            "description": "Whether the variable is protected from editing"
           },
           "created_at": {
             "type": "string",
@@ -409,8 +511,16 @@
             "description": "Optional group name for organising variables in the UI"
           },
           "value": {
-            "type": "string",
-            "description": "Value is returned for String type, omitted for SecretString"
+            "allOf": [
+              {
+                "$ref": "#/components/schemas/EnvironmentValue"
+              }
+            ],
+            "description": "Returned for non-secret types, omitted for SecretString. Also omitted when\nthe variable has been created without a value — for example by a blueprint\ninstall, which syncs a variable's key and type but never its value.\n"
+          },
+          "protected": {
+            "type": "boolean",
+            "description": "Whether the variable is protected from editing"
           },
           "created_at": {
             "type": "string",
@@ -457,7 +567,11 @@
             "type": "string"
           },
           "value": {
-            "type": "string"
+            "$ref": "#/components/schemas/EnvironmentValue"
+          },
+          "protected": {
+            "type": "boolean",
+            "description": "Whether the variable is protected from editing"
           }
         }
       },
@@ -473,13 +587,17 @@
             ]
           },
           "value": {
-            "type": "string"
+            "$ref": "#/components/schemas/EnvironmentValue"
           },
           "description": {
             "type": "string"
           },
           "group": {
             "type": "string"
+          },
+          "protected": {
+            "type": "boolean",
+            "description": "Whether the variable is protected from editing"
           }
         }
       },

package/dist/bin/epilot.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import {
   API_LIST
-} from "../chunk-4A3TISYH.js";
+} from "../chunk-TPJG2M3D.js";
 
 // bin/epilot.ts
 import { runMain } from "citty";
@@ -11,7 +11,7 @@ import { defineCommand } from "citty";
 var main = defineCommand({
   meta: {
     name: "epilot",
-    version: "0.1.138",
+    version: "0.1.140",
     description: "CLI for epilot APIs"
   },
   args: {
@@ -30,8 +30,8 @@ var main = defineCommand({
     auth: () => import("../auth-WMXFMPWE.js").then((m) => m.default),
     profile: () => import("../profile-OZJL5ZPT.js").then((m) => m.default),
     config: () => import("../config-DGZIMLZK.js").then((m) => m.default),
-    completion: () => import("../completion-MSAMXF3P.js").then((m) => m.default),
-    upgrade: () => import("../upgrade-LKIX3SHS.js").then((m) => m.default),
+    completion: () => import("../completion-6OBSXXHS.js").then((m) => m.default),
+    upgrade: () => import("../upgrade-NKZ2JL4M.js").then((m) => m.default),
     "access-token": () => import("../access-token-WWE6BDJH.js").then((m) => m.default),
     address: () => import("../address-EH3C4CVB.js").then((m) => m.default),
     "address-suggestions": () => import("../address-suggestions-RRSLOBFW.js").then((m) => m.default),
@@ -134,13 +134,13 @@ process.stderr.on("error", (err) => {
   if (err.code === "EPIPE") process.exit(0);
   throw err;
 });
-var VERSION = true ? "0.1.138" : (await null).default.version;
+var VERSION = true ? "0.1.140" : (await null).default.version;
 var reorderedArgv = hoistFlagsAfterSubcommand(process.argv.slice(2));
 process.argv = [process.argv[0], process.argv[1], ...reorderedArgv];
 var args = process.argv.slice(2);
 var completionsIdx = args.indexOf("--_completions");
 if (completionsIdx >= 0) {
-  const { handleCompletions } = await import("../completion-MSAMXF3P.js");
+  const { handleCompletions } = await import("../completion-6OBSXXHS.js");
   handleCompletions(args[completionsIdx + 1], args[completionsIdx + 2]);
   process.exit(0);
 }

package/dist/{chunk-4A3TISYH.js → chunk-TPJG2M3D.js}

@@ -173,7 +173,7 @@ var API_LIST = [
     kebabName: "blueprint-manifest",
     title: "Blueprint Manifest API",
     serverUrl: "https://blueprint-manifest.sls.epilot.io",
-    operationCount: 72,
+    operationCount: 73,
     operationIds: [
       "getJob",
       "createExport",
@@ -220,6 +220,7 @@ var API_LIST = [
       "listBlueprintJobs",
       "getBlueprintJob",
       "continueInstallationJob",
+      "retryInstallationJob",
       "cancelBlueprintJob",
       "getMarketplaceListing",
       "createMarketplaceListing",

package/dist/{completion-MSAMXF3P.js → completion-6OBSXXHS.js}

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import {
   API_LIST
-} from "./chunk-4A3TISYH.js";
+} from "./chunk-TPJG2M3D.js";
 import {
   DIM,
   GREEN,

package/dist/{upgrade-LKIX3SHS.js → upgrade-NKZ2JL4M.js}

@@ -72,7 +72,7 @@ ${GREEN}${BOLD}Upgraded to @epilot/cli@${latest}${RESET}
   }
 });
 var getCurrentVersion = () => {
-  if (true) return "0.1.138";
+  if (true) return "0.1.140";
   try {
     const output = execSync("npm ls -g @epilot/cli --depth=0 --json 2>/dev/null", {
       encoding: "utf-8",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@epilot/cli",
-  "version": "0.1.138",
+  "version": "0.1.140",
   "description": "CLI for epilot APIs",
   "type": "module",
   "bin": {