@heyditto/cli 2.5.2 → 2.7.0

package/README.md

@@ -406,9 +406,10 @@ heyditto endpoints set <endpoint> --model … --system-prompt … --spend-limit
                                    --record on|off --memory-depth <n>
 heyditto endpoints delete <endpoint> [--yes]
 heyditto endpoints keys <endpoint>         list keys
-heyditto endpoints keys create <endpoint> --gh-secret <NAME> [--repo owner/repo] [--env <env>] [--org <org>]
+heyditto endpoints keys create <endpoint> --store <destination> --secret <NAME> [scoping flags]
                                    [--name <label>] [--expires <1h…never>] [--budget <tokens>]
                                    [--spend-period <p>] [--yes]
+heyditto endpoints keys stores              which destinations this machine can write to
 heyditto endpoints keys revoke <endpoint> <keyId> [--yes]
 ```
 
@@ -416,30 +417,57 @@ Endpoints spend your Ditto credits, so deleting one, revoking a key or raising a
 spend limit asks you to type the slug back; pass `--yes` in scripts. `--output
 json` is available everywhere and includes the gateway base URL.
 
-#### Put a key in GitHub Actions
-
-`keys create --gh-secret` mints a long-lived key on an endpoint and stores it as
-a GitHub Actions secret through the [`gh` CLI](https://cli.github.com) — **the
-key is never shown**. The plaintext goes to `gh secret set` over stdin, so it
-does not appear in argv, `ps`, shell history, logs or the CLI's own output, and
-the CLI does not keep a copy. If `gh` fails to store it, the freshly minted key
-is revoked again.
+#### Put a key straight into a secret manager
+
+`keys create` mints a long-lived key on an endpoint and stores it in a secret
+manager by delegating to that platform's own CLI — **the key is never shown**.
+The plaintext goes to the platform CLI over stdin (or through `/dev/stdin`, for
+the CLIs that read a file instead), so it does not appear in argv, `ps`, shell
+history, logs or the CLI's own output, and nothing is kept locally. If the
+platform CLI fails, the freshly minted key is revoked again.
+
+| Destination | Shorthand | Scoping flags | CLI it delegates to |
+| --- | --- | --- | --- |
+| GitHub Actions | `--gh-secret NAME` | `--repo` `--env` `--org` | `gh secret set` |
+| GitLab CI/CD | `--gitlab-var NAME` | `--project` `--org` `--env` | `glab variable set --masked` |
+| AWS Secrets Manager | `--aws-secret NAME` | `--region` | `aws secretsmanager create-secret` (then `put-secret-value`) |
+| Google Secret Manager | `--gcp-secret NAME` | `--project` | `gcloud secrets create` (then `versions add`) |
+| Azure Key Vault | `--az-secret NAME` | `--key-vault` (required) | `az keyvault secret set --file` |
+| 1Password | `--op-item TITLE` | `--op-vault` | `op item create` (JSON template on stdin) |
+| HashiCorp Vault | `--vault-secret PATH` | `--mount` `--field` | `vault kv patch` (then `kv put`) |
+| Doppler | `--doppler-secret NAME` | `--project` `--doppler-config` | `doppler secrets set` |
+| Cloudflare Workers | `--cf-secret NAME` | `--worker` | `wrangler secret put` |
+| Vercel | `--vercel-env NAME` | `--vercel-target` | `vercel env add --sensitive` |
+| Kubernetes | `--k8s-secret NAME` | `--namespace` `--k8s-key` | `kubectl patch secret` (then `apply`) |
+| Fly.io | `--fly-secret NAME` | `--app` | `fly secrets import` |
+
+Every shorthand is sugar for `--store <id> --secret <NAME>`; use whichever
+reads better. `heyditto endpoints keys stores` lists the destinations with the
+CLI each one needs and whether it is installed here (`--output json` for
+scripts).
 
 ```bash
 cd my-repo
 heyditto endpoints keys create my-endpoint --gh-secret DITTO_KEY               # repo from the current directory (like gh)
 heyditto endpoints keys create my-endpoint --gh-secret DITTO_KEY --repo acme/app --budget 5000000
-heyditto endpoints keys create my-endpoint --gh-secret DITTO_KEY --repo acme/app --env production --yes
 heyditto endpoints keys create my-endpoint --gh-secret DITTO_KEY --org acme --expires 6mo --output json
-```
-
-Requirements: `gh` on `PATH` and signed in (`gh auth status`) — both are checked
-before anything is minted. Without a terminal the command needs `--yes`;
-interactively it shows what it will do and asks you to type the secret name.
-Defaults: key name `gh:<owner>/<repo>:<NAME>`, expiry `1y`; `--budget` caps the
-key's spend (`--spend-period` defaults to `monthly`). The output shows the key's
-last four characters, expiry, budget, where the secret was set, and a workflow
-snippet:
+heyditto endpoints keys create my-endpoint --store aws --secret DITTO_KEY --region us-east-1
+heyditto endpoints keys create my-endpoint --gcp-secret ditto-key --project my-gcp-project
+heyditto endpoints keys create my-endpoint --az-secret ditto-key --key-vault my-vault
+heyditto endpoints keys create my-endpoint --op-item "Ditto inference" --op-vault Engineering
+heyditto endpoints keys create my-endpoint --vault-secret ditto/inference --mount secret --field token
+heyditto endpoints keys create my-endpoint --k8s-secret ditto-inference --namespace prod
+```
+
+Requirements: the platform CLI on `PATH` and signed in — both are checked
+*before* anything is minted, so a missing CLI costs you nothing. Without a
+terminal the command needs `--yes`; interactively it shows what it will do and
+asks you to type the secret name back. Defaults: expiry `1y`, key label
+`<store>:<target>:<NAME>` (GitHub keeps its original `gh:<owner>/<repo>:<NAME>`);
+`--budget` caps the key's spend (`--spend-period` defaults to `monthly`). A
+scoping flag that belongs to another destination is an error rather than being
+ignored. The output shows the key's last four characters, expiry, budget, where
+it was stored, and how to consume it — for GitHub Actions:
 
 ```yaml
 env:

package/dist/api.d.ts

@@ -39,6 +39,8 @@ export interface InferenceEndpoint {
     recordAttachments?: boolean;
     recallEnabled?: boolean;
     recordEnabled?: boolean;
+    /** Free-form per-provider settings, including the coding-agent keys. */
+    providerOptions?: Record<string, unknown>;
     tools?: string[];
     modelMode?: string;
     billingMode?: string;
@@ -59,7 +61,18 @@ export interface EndpointInput {
     recallEnabled?: boolean;
     recordEnabled?: boolean;
     memoryDepth?: number;
+    providerOptions?: Record<string, unknown>;
 }
+/**
+ * providerOptions keys that configure a coding agent on this endpoint. The
+ * gateway reads them per harness: `codex_models` puts the endpoint's models in
+ * Codex's `/model` picker, and the prompt keys decide what system prompt the
+ * agent runs on. `<harness>_system_prompt` replaces the vendored baseline
+ * (the harness's own prompt); an empty string means "send no prompt".
+ * Auto-update is on by default so an endpoint tracks the harness's current
+ * prompt; turning it off pins the endpoint where it is.
+ */
+export declare const CODING_AGENT_OPTION_KEYS: readonly ["codex_models", "codex_catalog", "codex_catalog_limit", "codex_system_prompt", "codex_prompt_autoupdate", "codex_prompt_version", "claude_system_prompt", "claude_prompt_autoupdate", "claude_prompt_version"];
 export declare function isEndpointPending(e: InferenceEndpoint): boolean;
 export interface InferenceEndpointsResponse {
     baseUrl: string;

package/dist/api.js

@@ -63,6 +63,26 @@ export async function apiFetch(path, init = {}) {
         return undefined;
     return (await response.json());
 }
+/**
+ * providerOptions keys that configure a coding agent on this endpoint. The
+ * gateway reads them per harness: `codex_models` puts the endpoint's models in
+ * Codex's `/model` picker, and the prompt keys decide what system prompt the
+ * agent runs on. `<harness>_system_prompt` replaces the vendored baseline
+ * (the harness's own prompt); an empty string means "send no prompt".
+ * Auto-update is on by default so an endpoint tracks the harness's current
+ * prompt; turning it off pins the endpoint where it is.
+ */
+export const CODING_AGENT_OPTION_KEYS = [
+    "codex_models",
+    "codex_catalog",
+    "codex_catalog_limit",
+    "codex_system_prompt",
+    "codex_prompt_autoupdate",
+    "codex_prompt_version",
+    "claude_system_prompt",
+    "claude_prompt_autoupdate",
+    "claude_prompt_version",
+];
 export function isEndpointPending(e) {
     return e.status === "pending_plan" || (e.status !== undefined && e.status !== "active");
 }

package/dist/api.js.map

@@ -1 +1 @@
-{"version":3,"file":"api.js","sourceRoot":"","sources":["../src/api.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,EAAE,WAAW,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAEzE,sEAAsE;AAEtE,MAAM,OAAO,QAAS,SAAQ,KAAK;IACjC,MAAM,CAAS;IACf,IAAI,CAAS;IACb,YAAY,OAAe,EAAE,MAAc,EAAE,IAAY;QACvD,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,UAAU,CAAC;QACvB,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QACrB,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;IACnB,CAAC;CACF;AAED,MAAM,UAAU,OAAO;IACrB,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,IAAI,yBAAyB,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;AACvF,CAAC;AAED,SAAS,SAAS;IAChB,OAAO,GAAG,WAAW,IAAI,cAAc,EAAE,CAAC;AAC5C,CAAC;AAED,kFAAkF;AAClF,MAAM,CAAC,MAAM,cAAc,GACzB,kCAAkC;IAClC,8DAA8D;IAC9D,gEAAgE;IAChE,wFAAwF,CAAC;AAE3F,KAAK,UAAU,UAAU;IACvB,MAAM,EAAE,GAAG,EAAE,GAAG,MAAM,aAAa,EAAE,CAAC;IACtC,IAAI,CAAC,GAAG;QAAE,MAAM,IAAI,KAAK,CAAC,cAAc,CAAC,CAAC;IAC1C,OAAO,GAAG,CAAC;AACb,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,QAAQ,CAC5B,IAAY,EACZ,OAA4D,EAAE;IAE9D,MAAM,OAAO,GAA2B;QACtC,MAAM,EAAE,kBAAkB;QAC1B,YAAY,EAAE,SAAS,EAAE;KAC1B,CAAC;IACF,IAAI,IAAI,CAAC,IAAI,KAAK,SAAS;QAAE,OAAO,CAAC,cAAc,CAAC,GAAG,kBAAkB,CAAC;IAC1E,IAAI,IAAI,CAAC,IAAI,KAAK,KAAK;QAAE,OAAO,CAAC,aAAa,GAAG,UAAU,MAAM,UAAU,EAAE,EAAE,CAAC;IAChF,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,OAAO,EAAE,GAAG,IAAI,EAAE,EAAE;QAClD,MAAM,EAAE,IAAI,CAAC,MAAM,IAAI,KAAK;QAC5B,OAAO;QACP,IAAI,EAAE,IAAI,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC;KACtE,CAAC,CAAC;IACH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC;QACnD,IAAI,MAAM,GAAG,IAAI,CAAC;QAClB,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAyC,CAAC;YACxE,MAAM,GAAG,MAAM,CAAC,OAAO,IAAI,MAAM,CAAC,KAAK,IAAI,IAAI,CAAC;QAClD,CAAC;QAAC,MAAM,CAAC;YACP,cAAc;QAChB,CAAC;QACD,MAAM,IAAI,GACR,QAAQ,CAAC,MAAM,KAAK,GAAG;YACrB,CAAC,CAAC,iDAAiD;YACnD,CAAC,CAAC,QAAQ,CAAC,MAAM,KAAK,GAAG;gBACvB,CAAC,CAAC,yDAAyD;gBAC3D,CAAC,CAAC,EAAE,CAAC;QACX,MAAM,IAAI,QAAQ,CAChB,GAAG,IAAI,CAAC,MAAM,IAAI,KAAK,IAAI,IAAI,iBAAiB,QAAQ,CAAC,MAAM,GAAG,MAAM,CAAC,CAAC,CAAC,MAAM,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,GAAG,IAAI,EAAE,EACrH,QAAQ,CAAC,MAAM,EACf,IAAI,CACL,CAAC;IACJ,CAAC;IACD,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG;QAAE,OAAO,SAAc,CAAC;IACnD,OAAO,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAM,CAAC;AACtC,CAAC;AAwDD,MAAM,UAAU,iBAAiB,CAAC,CAAoB;IACpD,OAAO,CAAC,CAAC,MAAM,KAAK,cAAc,IAAI,CAAC,CAAC,CAAC,MAAM,KAAK,SAAS,IAAI,CAAC,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC;AAC1F,CAAC;AASD,MAAM,CAAC,KAAK,UAAU,aAAa;IACjC,MAAM,GAAG,GAAG,MAAM,QAAQ,CAA6B,6BAA6B,CAAC,CAAC;IACtF,OAAO;QACL,OAAO,EAAE,CAAC,GAAG,CAAC,OAAO,IAAI,GAAG,OAAO,EAAE,KAAK,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC;QAC/D,SAAS,EAAE,GAAG,CAAC,SAAS,IAAI,EAAE;QAC9B,KAAK,EAAE,GAAG,CAAC,KAAK;QAChB,IAAI,EAAE,GAAG,CAAC,IAAI;KACf,CAAC;AACJ,CAAC;AAED,MAAM,aAAa,GAAG,6BAA6B,CAAC;AAEpD,SAAS,YAAY,CAAC,EAAU;IAC9B,OAAO,GAAG,aAAa,IAAI,kBAAkB,CAAC,EAAE,CAAC,EAAE,CAAC;AACtD,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,QAAuB,EAAE;IAC5D,OAAO,QAAQ,CAAoB,aAAa,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;AACrF,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,EAAU,EAAE,KAAoB;IACnE,OAAO,QAAQ,CAAoB,YAAY,CAAC,EAAE,CAAC,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;AACzF,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,EAAU;IAC7C,MAAM,QAAQ,CAAO,YAAY,CAAC,EAAE,CAAC,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,CAAC;AAC/D,CAAC;AAED,uFAAuF;AACvF,MAAM,UAAU,YAAY,CAAC,SAA8B,EAAE,GAAW;IACtE,MAAM,MAAM,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;IAC1B,OAAO,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,MAAM,IAAI,CAAC,CAAC,EAAE,KAAK,MAAM,CAAC,CAAC;AACrE,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,GAAW;IAC3C,MAAM,OAAO,GAAG,MAAM,aAAa,EAAE,CAAC;IACtC,MAAM,QAAQ,GAAG,YAAY,CAAC,OAAO,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC;IACtD,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,MAAM,IAAI,KAAK,CACb,sBAAsB,GAAG,CAAC,IAAI,EAAE,iBAAiB,OAAO,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,sDAAsD,EAAE,CAC7J,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC;AAC/B,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,QAAQ,CAAC,UAAkB;IAC/C,MAAM,GAAG,GAAG,MAAM,QAAQ,CAA6C,GAAG,YAAY,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;IAC3G,OAAO,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC;AACrD,CAAC;AAwBD,MAAM,CAAC,KAAK,UAAU,SAAS,CAAC,UAAkB,EAAE,KAAqB;IACvE,MAAM,GAAG,GAAG,MAAM,QAAQ,CACxB,+BAA+B,kBAAkB,CAAC,UAAU,CAAC,OAAO,EACpE,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,CAChC,CAAC;IACF,IAAI,CAAC,GAAG,CAAC,GAAG;QAAE,MAAM,IAAI,KAAK,CAAC,0DAA0D,CAAC,CAAC;IAC1F,OAAO,GAAG,CAAC;AACb,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,SAAS,CAAC,UAAkB,EAAE,KAAa;IAC/D,MAAM,QAAQ,CACZ,+BAA+B,kBAAkB,CAAC,UAAU,CAAC,SAAS,kBAAkB,CAAC,KAAK,CAAC,EAAE,EACjG,EAAE,MAAM,EAAE,QAAQ,EAAE,CACrB,CAAC;AACJ,CAAC;AAcD,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,UAAkB;IACzD,MAAM,GAAG,GAAG,MAAM,QAAQ,CACxB,+BAA+B,kBAAkB,CAAC,UAAU,CAAC,WAAW,CACzE,CAAC;IACF,OAAO,GAAG,CAAC,QAAQ,IAAI,EAAE,CAAC;AAC5B,CAAC;AAOD,MAAM,CAAC,MAAM,aAAa,GAAG,cAAc,CAAC;AAY5C,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,KAA+B;IACrE,MAAM,GAAG,GAAG,MAAM,QAAQ,CAAa,yBAAyB,EAAE;QAChE,MAAM,EAAE,MAAM;QACd,IAAI,EAAE;YACJ,MAAM,EAAE,aAAa;YACrB,cAAc,EAAE,cAAc;YAC9B,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,QAAQ,EAAE,EAAE,CAAC,QAAQ,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC;SACtC;QACD,IAAI,EAAE,KAAK;KACZ,CAAC,CAAC;IACH,IAAI,CAAC,GAAG,CAAC,WAAW,IAAI,CAAC,GAAG,CAAC,SAAS,IAAI,CAAC,GAAG,CAAC,gBAAgB,EAAE,CAAC;QAChE,MAAM,IAAI,KAAK,CAAC,4EAA4E,CAAC,CAAC;IAChG,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAiBD,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,UAAkB;IACtD,MAAM,GAAG,GAAG,MAAM,QAAQ,CAMvB,0BAA0B,EAAE;QAC7B,MAAM,EAAE,MAAM;QACd,IAAI,EAAE,KAAK;QACX,IAAI,EAAE,EAAE,WAAW,EAAE,UAAU,EAAE,UAAU,EAAE,8CAA8C,EAAE;KAC9F,CAAC,CAAC;IACH,IAAI,GAAG,CAAC,YAAY,EAAE,CAAC;QACrB,MAAM,QAAQ,GAAG,GAAG,CAAC,QAAQ,IAAI,GAAG,CAAC,QAAQ,CAAC,EAAE,IAAI,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC;QACjG,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,WAAW,EAAE,GAAG,CAAC,YAAY,EAAE,QAAQ,EAAE,UAAU,EAAE,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC,EAAE,CAAC;IACzG,CAAC;IACD,QAAQ,GAAG,CAAC,KAAK,EAAE,CAAC;QAClB,KAAK,uBAAuB;YAC1B,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;QAC/B,KAAK,WAAW;YACd,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC;QACjC,KAAK,eAAe;YAClB,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC;QAC9B;YACE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;IACjC,CAAC;AACH,CAAC;AAkCD,MAAM,CAAC,KAAK,UAAU,cAAc;IAClC,MAAM,GAAG,GAAG,MAAM,QAAQ,CAA2B,qBAAqB,CAAC,CAAC;IAC5E,OAAO,GAAG,CAAC,MAAM,IAAI,EAAE,CAAC;AAC1B,CAAC"}
+{"version":3,"file":"api.js","sourceRoot":"","sources":["../src/api.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,EAAE,WAAW,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAEzE,sEAAsE;AAEtE,MAAM,OAAO,QAAS,SAAQ,KAAK;IACjC,MAAM,CAAS;IACf,IAAI,CAAS;IACb,YAAY,OAAe,EAAE,MAAc,EAAE,IAAY;QACvD,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,UAAU,CAAC;QACvB,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QACrB,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;IACnB,CAAC;CACF;AAED,MAAM,UAAU,OAAO;IACrB,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,IAAI,yBAAyB,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;AACvF,CAAC;AAED,SAAS,SAAS;IAChB,OAAO,GAAG,WAAW,IAAI,cAAc,EAAE,CAAC;AAC5C,CAAC;AAED,kFAAkF;AAClF,MAAM,CAAC,MAAM,cAAc,GACzB,kCAAkC;IAClC,8DAA8D;IAC9D,gEAAgE;IAChE,wFAAwF,CAAC;AAE3F,KAAK,UAAU,UAAU;IACvB,MAAM,EAAE,GAAG,EAAE,GAAG,MAAM,aAAa,EAAE,CAAC;IACtC,IAAI,CAAC,GAAG;QAAE,MAAM,IAAI,KAAK,CAAC,cAAc,CAAC,CAAC;IAC1C,OAAO,GAAG,CAAC;AACb,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,QAAQ,CAC5B,IAAY,EACZ,OAA4D,EAAE;IAE9D,MAAM,OAAO,GAA2B;QACtC,MAAM,EAAE,kBAAkB;QAC1B,YAAY,EAAE,SAAS,EAAE;KAC1B,CAAC;IACF,IAAI,IAAI,CAAC,IAAI,KAAK,SAAS;QAAE,OAAO,CAAC,cAAc,CAAC,GAAG,kBAAkB,CAAC;IAC1E,IAAI,IAAI,CAAC,IAAI,KAAK,KAAK;QAAE,OAAO,CAAC,aAAa,GAAG,UAAU,MAAM,UAAU,EAAE,EAAE,CAAC;IAChF,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,OAAO,EAAE,GAAG,IAAI,EAAE,EAAE;QAClD,MAAM,EAAE,IAAI,CAAC,MAAM,IAAI,KAAK;QAC5B,OAAO;QACP,IAAI,EAAE,IAAI,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC;KACtE,CAAC,CAAC;IACH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC;QACnD,IAAI,MAAM,GAAG,IAAI,CAAC;QAClB,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAyC,CAAC;YACxE,MAAM,GAAG,MAAM,CAAC,OAAO,IAAI,MAAM,CAAC,KAAK,IAAI,IAAI,CAAC;QAClD,CAAC;QAAC,MAAM,CAAC;YACP,cAAc;QAChB,CAAC;QACD,MAAM,IAAI,GACR,QAAQ,CAAC,MAAM,KAAK,GAAG;YACrB,CAAC,CAAC,iDAAiD;YACnD,CAAC,CAAC,QAAQ,CAAC,MAAM,KAAK,GAAG;gBACvB,CAAC,CAAC,yDAAyD;gBAC3D,CAAC,CAAC,EAAE,CAAC;QACX,MAAM,IAAI,QAAQ,CAChB,GAAG,IAAI,CAAC,MAAM,IAAI,KAAK,IAAI,IAAI,iBAAiB,QAAQ,CAAC,MAAM,GAAG,MAAM,CAAC,CAAC,CAAC,MAAM,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,GAAG,IAAI,EAAE,EACrH,QAAQ,CAAC,MAAM,EACf,IAAI,CACL,CAAC;IACJ,CAAC;IACD,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG;QAAE,OAAO,SAAc,CAAC;IACnD,OAAO,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAM,CAAC;AACtC,CAAC;AA2DD;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAG;IACtC,cAAc;IACd,eAAe;IACf,qBAAqB;IACrB,qBAAqB;IACrB,yBAAyB;IACzB,sBAAsB;IACtB,sBAAsB;IACtB,0BAA0B;IAC1B,uBAAuB;CACf,CAAC;AAEX,MAAM,UAAU,iBAAiB,CAAC,CAAoB;IACpD,OAAO,CAAC,CAAC,MAAM,KAAK,cAAc,IAAI,CAAC,CAAC,CAAC,MAAM,KAAK,SAAS,IAAI,CAAC,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC;AAC1F,CAAC;AASD,MAAM,CAAC,KAAK,UAAU,aAAa;IACjC,MAAM,GAAG,GAAG,MAAM,QAAQ,CAA6B,6BAA6B,CAAC,CAAC;IACtF,OAAO;QACL,OAAO,EAAE,CAAC,GAAG,CAAC,OAAO,IAAI,GAAG,OAAO,EAAE,KAAK,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC;QAC/D,SAAS,EAAE,GAAG,CAAC,SAAS,IAAI,EAAE;QAC9B,KAAK,EAAE,GAAG,CAAC,KAAK;QAChB,IAAI,EAAE,GAAG,CAAC,IAAI;KACf,CAAC;AACJ,CAAC;AAED,MAAM,aAAa,GAAG,6BAA6B,CAAC;AAEpD,SAAS,YAAY,CAAC,EAAU;IAC9B,OAAO,GAAG,aAAa,IAAI,kBAAkB,CAAC,EAAE,CAAC,EAAE,CAAC;AACtD,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,QAAuB,EAAE;IAC5D,OAAO,QAAQ,CAAoB,aAAa,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;AACrF,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,EAAU,EAAE,KAAoB;IACnE,OAAO,QAAQ,CAAoB,YAAY,CAAC,EAAE,CAAC,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;AACzF,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,EAAU;IAC7C,MAAM,QAAQ,CAAO,YAAY,CAAC,EAAE,CAAC,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,CAAC;AAC/D,CAAC;AAED,uFAAuF;AACvF,MAAM,UAAU,YAAY,CAAC,SAA8B,EAAE,GAAW;IACtE,MAAM,MAAM,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;IAC1B,OAAO,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,MAAM,IAAI,CAAC,CAAC,EAAE,KAAK,MAAM,CAAC,CAAC;AACrE,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,GAAW;IAC3C,MAAM,OAAO,GAAG,MAAM,aAAa,EAAE,CAAC;IACtC,MAAM,QAAQ,GAAG,YAAY,CAAC,OAAO,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC;IACtD,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,MAAM,IAAI,KAAK,CACb,sBAAsB,GAAG,CAAC,IAAI,EAAE,iBAAiB,OAAO,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,sDAAsD,EAAE,CAC7J,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC;AAC/B,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,QAAQ,CAAC,UAAkB;IAC/C,MAAM,GAAG,GAAG,MAAM,QAAQ,CAA6C,GAAG,YAAY,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;IAC3G,OAAO,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC;AACrD,CAAC;AAwBD,MAAM,CAAC,KAAK,UAAU,SAAS,CAAC,UAAkB,EAAE,KAAqB;IACvE,MAAM,GAAG,GAAG,MAAM,QAAQ,CACxB,+BAA+B,kBAAkB,CAAC,UAAU,CAAC,OAAO,EACpE,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,CAChC,CAAC;IACF,IAAI,CAAC,GAAG,CAAC,GAAG;QAAE,MAAM,IAAI,KAAK,CAAC,0DAA0D,CAAC,CAAC;IAC1F,OAAO,GAAG,CAAC;AACb,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,SAAS,CAAC,UAAkB,EAAE,KAAa;IAC/D,MAAM,QAAQ,CACZ,+BAA+B,kBAAkB,CAAC,UAAU,CAAC,SAAS,kBAAkB,CAAC,KAAK,CAAC,EAAE,EACjG,EAAE,MAAM,EAAE,QAAQ,EAAE,CACrB,CAAC;AACJ,CAAC;AAcD,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,UAAkB;IACzD,MAAM,GAAG,GAAG,MAAM,QAAQ,CACxB,+BAA+B,kBAAkB,CAAC,UAAU,CAAC,WAAW,CACzE,CAAC;IACF,OAAO,GAAG,CAAC,QAAQ,IAAI,EAAE,CAAC;AAC5B,CAAC;AAOD,MAAM,CAAC,MAAM,aAAa,GAAG,cAAc,CAAC;AAY5C,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,KAA+B;IACrE,MAAM,GAAG,GAAG,MAAM,QAAQ,CAAa,yBAAyB,EAAE;QAChE,MAAM,EAAE,MAAM;QACd,IAAI,EAAE;YACJ,MAAM,EAAE,aAAa;YACrB,cAAc,EAAE,cAAc;YAC9B,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,QAAQ,EAAE,EAAE,CAAC,QAAQ,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC;SACtC;QACD,IAAI,EAAE,KAAK;KACZ,CAAC,CAAC;IACH,IAAI,CAAC,GAAG,CAAC,WAAW,IAAI,CAAC,GAAG,CAAC,SAAS,IAAI,CAAC,GAAG,CAAC,gBAAgB,EAAE,CAAC;QAChE,MAAM,IAAI,KAAK,CAAC,4EAA4E,CAAC,CAAC;IAChG,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAiBD,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,UAAkB;IACtD,MAAM,GAAG,GAAG,MAAM,QAAQ,CAMvB,0BAA0B,EAAE;QAC7B,MAAM,EAAE,MAAM;QACd,IAAI,EAAE,KAAK;QACX,IAAI,EAAE,EAAE,WAAW,EAAE,UAAU,EAAE,UAAU,EAAE,8CAA8C,EAAE;KAC9F,CAAC,CAAC;IACH,IAAI,GAAG,CAAC,YAAY,EAAE,CAAC;QACrB,MAAM,QAAQ,GAAG,GAAG,CAAC,QAAQ,IAAI,GAAG,CAAC,QAAQ,CAAC,EAAE,IAAI,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC;QACjG,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,WAAW,EAAE,GAAG,CAAC,YAAY,EAAE,QAAQ,EAAE,UAAU,EAAE,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC,EAAE,CAAC;IACzG,CAAC;IACD,QAAQ,GAAG,CAAC,KAAK,EAAE,CAAC;QAClB,KAAK,uBAAuB;YAC1B,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;QAC/B,KAAK,WAAW;YACd,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC;QACjC,KAAK,eAAe;YAClB,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC;QAC9B;YACE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;IACjC,CAAC;AACH,CAAC;AAkCD,MAAM,CAAC,KAAK,UAAU,cAAc;IAClC,MAAM,GAAG,GAAG,MAAM,QAAQ,CAA2B,qBAAqB,CAAC,CAAC;IAC5E,OAAO,GAAG,CAAC,MAAM,IAAI,EAAE,CAAC;AAC1B,CAAC"}

package/dist/commands.d.ts

@@ -36,6 +36,13 @@ interface EndpointSetOptions {
     recall?: string;
     record?: string;
     memoryDepth?: string;
+    codexModels?: string;
+    codexCatalog?: string;
+    codexCatalogLimit?: string;
+    codexPrompt?: string;
+    codexPromptAutoupdate?: string;
+    claudePrompt?: string;
+    claudePromptAutoupdate?: string;
     yes?: boolean;
 }
 export declare function cmdEndpointSet(ref: string, options: EndpointSetOptions): Promise<void>;
@@ -52,10 +59,36 @@ export declare function cmdEndpointKeysRevoke(ref: string, keyId: string, option
 }): Promise<void>;
 interface KeysCreateOptions {
     output?: string;
+    /** Canonical destination selector; every store also has a shorthand flag. */
+    store?: string;
+    secret?: string;
     ghSecret?: string;
+    gitlabVar?: string;
+    awsSecret?: string;
+    gcpSecret?: string;
+    azSecret?: string;
+    opItem?: string;
+    vaultSecret?: string;
+    dopplerSecret?: string;
+    cfSecret?: string;
+    vercelEnv?: string;
+    k8sSecret?: string;
+    flySecret?: string;
     repo?: string;
     env?: string;
     org?: string;
+    region?: string;
+    project?: string;
+    keyVault?: string;
+    opVault?: string;
+    mount?: string;
+    field?: string;
+    dopplerConfig?: string;
+    worker?: string;
+    vercelTarget?: string;
+    namespace?: string;
+    k8sKey?: string;
+    app?: string;
     name?: string;
     expires?: string;
     budget?: string;
@@ -63,11 +96,16 @@ interface KeysCreateOptions {
     yes?: boolean;
 }
 /**
- * Mints a key on an endpoint and hands the plaintext straight to `gh secret
- * set` over stdin. The key is never printed, logged or stored locally; on a
- * failed `gh` call it is revoked again so nothing usable is left behind.
+ * Mints a key on an endpoint and hands the plaintext straight to the platform
+ * CLI over stdin (`gh secret set`, `gcloud secrets create --data-file=-`, …).
+ * The key is never printed, logged or stored locally; when the platform CLI
+ * fails it is revoked again so nothing usable is left behind.
  */
 export declare function cmdEndpointKeysCreate(ref: string, options: KeysCreateOptions): Promise<void>;
+/** Lists every destination and whether this machine can delegate to it. */
+export declare function cmdEndpointKeyStores(options: {
+    output?: string;
+}): Promise<void>;
 /** Registers the `endpoints` group; bare `heyditto endpoints [flags]` still lists. */
 export declare function registerEndpointCommands(program: Command, addExamples: (c: Command, ex: string) => Command, outputOption: () => Option): void;
 interface SessionsOptions {