@gapi/gcli 1.8.241 → 1.8.242

package/README-CLI.md

@@ -29,6 +29,10 @@ Commands:
   cron:create [options]                                Create cron
   cron:delete [options]                                Delete cron
   cron:list [options]                                  List of all cron jobs for project
+  mq-trigger:list [options]                            List the message-queue triggers of a project
+  mq-trigger:create [options]                          Run a lambda for every message on a RabbitMQ queue
+  mq-trigger:update [options]                          Change a message-queue trigger (same flags as create)
+  mq-trigger:delete [options]                          Delete a message-queue trigger
   cluster:create [options]                             Provision a private Talos cluster for a project (runs in the background - takes several minutes; use --wait to block)
   cluster:apply [options]                              Make a private cluster match the `cluster:` section of lambforge.yaml: creates it if missing, then applies topology, workers, control planes, load balancer and autoscaling
   cluster:list [options]                               List every private cluster this project has (it may have several - dev/stage/prod, ...)
@@ -502,6 +506,69 @@ Options:
   -p, --project <project>
   -h, --help               display help for command
 
+--- Subcommand: mq-trigger:list ---
+Usage: gcli mq-trigger:list [options]
+
+List the message-queue triggers of a project
+
+Options:
+  -p, --project <project>
+  -h, --help               display help for command
+
+--- Subcommand: mq-trigger:create ---
+Usage: gcli mq-trigger:create [options]
+
+Run a lambda for every message on a RabbitMQ queue
+
+Options:
+  -p, --project <project>
+  -n, --name <name>             Trigger name
+  -l, --lambda <lambda>         Lambda the trigger runs per message
+  --request-topic <queue>       Queue the trigger consumes
+  --response-topic <queue>      Queue for the lambda response
+  --error-topic <queue>         Queue for failed messages
+  --broker <rabbitMqId>         RabbitMQ broker id (see rabbitmq:list) - needed
+                                when several brokers share queue names
+  --max-retries <n>
+  --cool-down-period <seconds>
+  --polling-interval <seconds>
+  --min-replicas <n>
+  --max-replicas <n>
+  --threshold <n>               Messages per replica before scaling out
+  -h, --help                    display help for command
+
+--- Subcommand: mq-trigger:update ---
+Usage: gcli mq-trigger:update [options]
+
+Change a message-queue trigger (same flags as create)
+
+Options:
+  -p, --project <project>
+  -n, --name <name>             Trigger name
+  -l, --lambda <lambda>         Lambda the trigger runs per message
+  --request-topic <queue>       Queue the trigger consumes
+  --response-topic <queue>      Queue for the lambda response
+  --error-topic <queue>         Queue for failed messages
+  --broker <rabbitMqId>         RabbitMQ broker id (see rabbitmq:list) - needed
+                                when several brokers share queue names
+  --max-retries <n>
+  --cool-down-period <seconds>
+  --polling-interval <seconds>
+  --min-replicas <n>
+  --max-replicas <n>
+  --threshold <n>               Messages per replica before scaling out
+  -h, --help                    display help for command
+
+--- Subcommand: mq-trigger:delete ---
+Usage: gcli mq-trigger:delete [options]
+
+Delete a message-queue trigger
+
+Options:
+  -p, --project <project>
+  -n, --name <name>        Trigger name
+  -h, --help               display help for command
+
 --- Subcommand: cluster:create ---
 Usage: gcli cluster:create [options]
 

package/README.md

@@ -47,6 +47,20 @@ For automated pipelines (e.g., GitHub Actions), you can use `npx` with a long-li
   run: npx gcli login --ci --token ${{ secrets.GCLI_AUTH_TOKEN }}
 ```
 
+Create the token in the dashboard (Project → CI/CD) with only the permissions the pipeline needs. Every project command has a permission:
+
+| Permission | Commands |
+|---|---|
+| Lambdas: read / deploy / create / delete | `lambda:get/list/log/build:log/test`, `lambda:update`, `lambda:create`, `lambda:delete` |
+| Environments: read / write / delete | `environment:list/get`, `environment:create/update`, `environment:delete` |
+| Schedules: read / write | `cron:list`, `cron:create/delete` |
+| RabbitMQ: read / install / uninstall | `rabbitmq:list`, `rabbitmq:create`, `rabbitmq:delete` |
+| Queue triggers: read / manage | `mq-trigger:list`, `mq-trigger:create/update/delete` |
+| Plugins: read / install | `plugin:list/installed`, `plugin:install/uninstall` |
+| Clusters: read / scale / create / tear down / kubeconfig | `cluster:list/status/health/scale-events/cost`, `cluster:scale/autoscale/multi-node/single-node/load-balancer/apply`, `cluster:create/apply`, `cluster:teardown`, `cluster:kubeconfig` |
+
+A token can also be limited to some lambdas (lambda, schedule and queue-trigger commands). Typical tokens: *Deploy only* (`lambda:update`), or *DevOps (clusters)* for an infra repo that runs `gcli cluster:apply`. A command the token may not run fails with `ci-token-missing-scope: <operation> needs <permission>`. `runner:*` and `project:list` are personal and not available to CI tokens.
+
 ## Authentication
 
 Before interacting with the platform, you must authenticate. You can log in using an API key or a personal access token.
@@ -225,6 +239,21 @@ storage:
   size: SMALL
 ```
 
+### Message-Queue Triggers
+
+A trigger runs a lambda for every message on a RabbitMQ queue (and can publish the response and failures to other queues).
+
+```bash
+gcli mq-trigger:create --name orders --lambda order-handler \
+  --request-topic orders --response-topic orders-done --error-topic orders-failed \
+  --broker '<brokerId>'            # see rabbitmq:list; needed when brokers share queue names
+gcli mq-trigger:update --name orders --max-replicas 5 --threshold 20   # only the flags you pass change
+gcli mq-trigger:list
+gcli mq-trigger:delete --name orders
+```
+
+Scaling flags: `--max-retries`, `--cool-down-period`, `--polling-interval`, `--min-replicas`, `--max-replicas`, `--threshold` (messages per replica).
+
 ### Marketplace Plugins
 
 Plugins (Redis, MongoDB, NATS, FalkorDB, ...) can be installed on the shared cluster or on any private cluster - the same plugin can be installed on several clusters at once.

package/docs/changelog.d/2026-10-19-ci-token-scopes-mq-trigger-list-create-update-delete-commands-readme-documen.md

@@ -0,0 +1,21 @@
+## 2026-10-19 - ci-token-scopes: mq-trigger:list/create/update/delete commands; README documents CI token permissions per command
+
+**Feature:** ci-token-scopes · **Type:** feat
+
+- New `mq-trigger:list`, `mq-trigger:create`, `mq-trigger:update`,
+  `mq-trigger:delete` (`src/commands/triggers/message-queue/`) - message-queue
+  triggers had an API and a dashboard page but no CLI. Flags: `--name`,
+  `--lambda`, `--request-topic`, `--response-topic`, `--error-topic`,
+  `--broker` (RabbitMQ id), scaling counts; `update` reads the current
+  trigger and sends it with the passed flags on top (the service needs the
+  full spec).
+- README: CI/CD section lists the permission each command needs (CI token
+  scopes now cover every project command, incl. clusters for DevOps
+  tokens) and a Message-Queue Triggers section; `README-CLI.md`
+  regenerated from the built CLI's `--help`.
+- **Test:** `npx jest test/mq-trigger.spec.ts` (flag mapping, create needs
+  lambda + queue, numbers validated, update merged over the current trigger).
+- **Debug:** `docs/features/ci-token-scopes.md`; `ci-token-missing-scope`
+  comes from the services - reissue the token with that permission.
+- **Verification:** jest 75/75; tsc clean; `gcli mq-trigger:create --help`
+  from a fresh build; `release/index.js` restored after the build.

package/docs/features/README.md

@@ -33,3 +33,4 @@ Outline (drop sections that don't apply):
 | `local-ai-runners` | [local-ai-runners.md](local-ai-runners.md) | `runner:*` commands; canonical doc in graphql-server |
 | `lambforge-agent-skill` | [lambforge-agent-skill.md](lambforge-agent-skill.md) | The agent skill that teaches gcli + `mcp:start`; canonical doc in gql-fission |
 | `dedicated-platform-cluster` | [dedicated-platform-cluster.md](dedicated-platform-cluster.md) | `cluster:status/health/scale/autoscale/...` commands; canonical doc in lambforge-agent |
+| `ci-token-scopes` | [ci-token-scopes.md](ci-token-scopes.md) | Which permission each command needs; `mq-trigger:*` commands; canonical doc in graphql-server |

package/docs/features/ci-token-scopes.md

@@ -0,0 +1,25 @@
+# ci-token-scopes (gcli slice)
+
+**Canonical doc:** `graphql-server/docs/features/ci-token-scopes.md` ·
+**Since:** 2026-10-19
+
+gcli itself enforces nothing - a CI/CD token (`gcli login --ci --token …`)
+is checked by the services. What this package owns:
+
+- Every project command maps to one permission (README → CI/CD
+  Integration has the table). A refused command prints the service error
+  `ci-token-missing-scope: <operation> needs <scope>` /
+  `ci-token-lambda-not-allowed` / `ci-token-wrong-project`.
+- `mq-trigger:list/create/update/delete`
+  (`src/commands/triggers/message-queue/`, `GraphqlClienAPI.
+  listMessageQueueTriggers / saveMessageQueueTrigger / deleteMessageQueueTrigger`)
+  - the `mq-trigger:*` permissions had no CLI before. `update` reads the
+  current trigger and sends it with the given flags on top
+  (`mergeOverExisting`): the service hands the payload to Fission as the
+  whole spec and picks the cluster by `lambdaName`, so a partial payload
+  would drop settings. Counts are validated as whole numbers
+  (`toTriggerInput`). The trigger types are declared in `gql-client.ts`
+  (not in the bundled introspection yet).
+- Not for CI tokens: `runner:*`, `project:list`, `mcp:start`.
+
+**Test:** `npx jest test/mq-trigger.spec.ts`.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@gapi/gcli",
-  "version": "1.8.241",
+  "version": "1.8.242",
   "repository": {
     "type": "git",
     "url": "https://github.com/Stradivario/gapi.git"