@lead-routing/cli 0.2.0 → 0.3.0

package/dist/index.js

@@ -5,6 +5,8 @@ import { Command } from "commander";
 
 // src/commands/init.ts
 import { promises as dns } from "dns";
+import { readFileSync as readFileSync5, writeFileSync as writeFileSync4 } from "fs";
+import { join as join6 } from "path";
 import { intro, outro, note as note4, log as log9, confirm as confirm2, cancel as cancel3, isCancel as isCancel4, password as promptPassword } from "@clack/prompts";
 import chalk2 from "chalk";
 
@@ -170,8 +172,9 @@ async function collectConfig(opts = {}) {
   const dbPassword = generateSecret(16);
   const managedDb = !opts.externalDb;
   const databaseUrl = opts.externalDb ?? `postgresql://leadrouting:${dbPassword}@postgres:5432/leadrouting`;
+  const redisPassword = generateSecret(16);
   const managedRedis = !opts.externalRedis;
-  const redisUrl = opts.externalRedis ?? "redis://redis:6379";
+  const redisUrl = opts.externalRedis ?? `redis://:${redisPassword}@redis:6379`;
   note2("This creates the first admin user for the web app.", "Admin Account");
   const adminEmail = await text2({
     message: "Admin email address",
@@ -193,6 +196,7 @@ async function collectConfig(opts = {}) {
   const sessionSecret = generateSecret(32);
   const engineWebhookSecret = generateSecret(32);
   const adminSecret = generateSecret(16);
+  const internalApiKey = generateSecret(32);
   return {
     appUrl: appUrl.trim().replace(/\/+$/, ""),
     engineUrl: engineUrl.trim().replace(/\/+$/, ""),
@@ -204,13 +208,15 @@ async function collectConfig(opts = {}) {
     dbPassword: managedDb ? dbPassword : "",
     managedRedis,
     redisUrl,
+    redisPassword: managedRedis ? redisPassword : "",
     adminEmail,
     adminPassword,
     resendApiKey: "",
     feedbackToEmail: "",
     sessionSecret,
     engineWebhookSecret,
-    adminSecret
+    adminSecret,
+    internalApiKey
   };
 }
 
@@ -243,14 +249,16 @@ function renderDockerCompose(c) {
       timeout: 5s
       retries: 10
 ` : "";
+  const redisPassword = c.redisPassword ?? "";
   const redisService = c.managedRedis ? `
   redis:
     image: redis:7-alpine
-    restart: unless-stopped
+    restart: unless-stopped${redisPassword ? `
+    command: redis-server --requirepass ${redisPassword}` : ""}
     volumes:
       - redis_data:/data
     healthcheck:
-      test: ["CMD", "redis-cli", "ping"]
+      test: ["CMD-SHELL", "redis-cli${redisPassword ? ` -a ${redisPassword}` : ""} ping | grep PONG"]
       interval: 5s
       timeout: 3s
       retries: 10
@@ -366,6 +374,9 @@ function renderEnvWeb(c) {
     `ADMIN_EMAIL=${c.adminEmail}`,
     `ADMIN_PASSWORD=${c.adminPassword}`,
     ``,
+    `# Internal API key (shared with engine for analytics)`,
+    `INTERNAL_API_KEY=${c.internalApiKey}`,
+    ``,
     `# Email (optional)`,
     `RESEND_API_KEY=${c.resendApiKey ?? ""}`,
     `FEEDBACK_TO_EMAIL=${c.feedbackToEmail ?? ""}`
@@ -395,7 +406,10 @@ function renderEnvEngine(c) {
     `SFDC_LOGIN_URL=${c.sfdcLoginUrl}`,
     ``,
     `# Webhook`,
-    `ENGINE_WEBHOOK_SECRET=${c.engineWebhookSecret}`
+    `ENGINE_WEBHOOK_SECRET=${c.engineWebhookSecret}`,
+    ``,
+    `# Internal API key (Bearer token for analytics endpoints)`,
+    `INTERNAL_API_KEY=${c.internalApiKey}`
   ].join("\n");
 }
 
@@ -412,7 +426,18 @@ function renderCaddyfile(appUrl, engineUrl) {
       `# Generated by lead-routing CLI`,
       `# Caddy auto-provisions SSL certificates via Let's Encrypt`,
       ``,
+      `(security_headers) {`,
+      `  header {`,
+      `    X-Content-Type-Options nosniff`,
+      `    X-Frame-Options DENY`,
+      `    Referrer-Policy strict-origin-when-cross-origin`,
+      `    Permissions-Policy interest-cohort=()`,
+      `    Strict-Transport-Security "max-age=31536000; includeSubDomains"`,
+      `  }`,
+      `}`,
+      ``,
       `${appHost} {`,
+      `  import security_headers`,
       `  reverse_proxy web:3000 {`,
       `    health_uri /api/health`,
       `    health_interval 15s`,
@@ -420,6 +445,7 @@ function renderCaddyfile(appUrl, engineUrl) {
       `}`,
       ``,
       `${appHost}:${enginePort} {`,
+      `  import security_headers`,
       `  reverse_proxy engine:3001 {`,
       `    health_uri /health`,
       `    health_interval 15s`,
@@ -432,7 +458,18 @@ function renderCaddyfile(appUrl, engineUrl) {
     `# Generated by lead-routing CLI`,
     `# Caddy auto-provisions SSL certificates via Let's Encrypt`,
     ``,
+    `(security_headers) {`,
+    `  header {`,
+    `    X-Content-Type-Options nosniff`,
+    `    X-Frame-Options DENY`,
+    `    Referrer-Policy strict-origin-when-cross-origin`,
+    `    Permissions-Policy interest-cohort=()`,
+    `    Strict-Transport-Security "max-age=31536000; includeSubDomains"`,
+    `  }`,
+    `}`,
+    ``,
     `${appHost} {`,
+    `  import security_headers`,
     `  reverse_proxy web:3000 {`,
     `    health_uri /api/health`,
     `    health_interval 15s`,
@@ -440,6 +477,7 @@ function renderCaddyfile(appUrl, engineUrl) {
     `}`,
     ``,
     `${engineHost} {`,
+    `  import security_headers`,
     `  reverse_proxy engine:3001 {`,
     `    health_uri /health`,
     `    health_interval 15s`,
@@ -491,7 +529,8 @@ function generateFiles(cfg, sshCfg) {
   const composeContent = renderDockerCompose({
     managedDb: cfg.managedDb,
     managedRedis: cfg.managedRedis,
-    dbPassword: cfg.dbPassword
+    dbPassword: cfg.dbPassword,
+    redisPassword: cfg.redisPassword
   });
   const composeFile = join2(dir, "docker-compose.yml");
   writeFileSync2(composeFile, composeContent, "utf8");
@@ -513,6 +552,7 @@ function generateFiles(cfg, sshCfg) {
     adminSecret: cfg.adminSecret,
     adminEmail: cfg.adminEmail,
     adminPassword: cfg.adminPassword,
+    internalApiKey: cfg.internalApiKey,
     resendApiKey: cfg.resendApiKey || void 0,
     feedbackToEmail: cfg.feedbackToEmail || void 0
   });
@@ -525,7 +565,8 @@ function generateFiles(cfg, sshCfg) {
     sfdcClientId: cfg.sfdcClientId,
     sfdcClientSecret: cfg.sfdcClientSecret,
     sfdcLoginUrl: cfg.sfdcLoginUrl,
-    engineWebhookSecret: cfg.engineWebhookSecret
+    engineWebhookSecret: cfg.engineWebhookSecret,
+    internalApiKey: cfg.internalApiKey
   });
   const envEngine = join2(dir, ".env.engine");
   writeFileSync2(envEngine, envEngineContent, "utf8");
@@ -549,6 +590,7 @@ function generateFiles(cfg, sshCfg) {
     // Stored so `lead-routing sfdc deploy` can re-authenticate without re-prompting
     sfdcClientId: cfg.sfdcClientId,
     sfdcLoginUrl: cfg.sfdcLoginUrl,
+    engineWebhookSecret: cfg.engineWebhookSecret,
     installedAt: (/* @__PURE__ */ new Date()).toISOString(),
     version: getCliVersion()
   });
@@ -894,7 +936,7 @@ function sleep2(ms) {
 }
 
 // src/steps/sfdc-deploy-inline.ts
-import { readFileSync as readFileSync3, writeFileSync as writeFileSync3, existsSync as existsSync3, cpSync, rmSync } from "fs";
+import { readFileSync as readFileSync4, writeFileSync as writeFileSync3, existsSync as existsSync4, cpSync, rmSync } from "fs";
 import { join as join5, dirname as dirname2 } from "path";
 import { tmpdir } from "os";
 import { fileURLToPath as fileURLToPath2 } from "url";
@@ -983,8 +1025,7 @@ var SalesforceApi = class {
     const deployOptions = JSON.stringify({
       deployOptions: {
         rollbackOnError: true,
-        singlePackage: true,
-        rest: true
+        singlePackage: true
       }
     });
     const parts = [];
@@ -1064,21 +1105,116 @@ var DuplicateError = class extends Error {
 
 // src/utils/zip-source.ts
 import { join as join4 } from "path";
+import { readdirSync, readFileSync as readFileSync3, existsSync as existsSync3 } from "fs";
 import archiver from "archiver";
+var META_TYPE_MAP = {
+  applications: "CustomApplication",
+  classes: "ApexClass",
+  triggers: "ApexTrigger",
+  lwc: "LightningComponentBundle",
+  permissionsets: "PermissionSet",
+  namedCredentials: "NamedCredential",
+  remoteSiteSettings: "RemoteSiteSetting",
+  tabs: "CustomTab"
+};
 async function zipSourcePackage(packageDir) {
+  const forceAppDefault = join4(packageDir, "force-app", "main", "default");
+  let apiVersion = "59.0";
+  try {
+    const proj = JSON.parse(readFileSync3(join4(packageDir, "sfdx-project.json"), "utf8"));
+    if (proj.sourceApiVersion) apiVersion = proj.sourceApiVersion;
+  } catch {
+  }
+  const members = /* @__PURE__ */ new Map();
+  const addMember = (type, name) => {
+    if (!members.has(type)) members.set(type, /* @__PURE__ */ new Set());
+    members.get(type).add(name);
+  };
   return new Promise((resolve, reject) => {
     const chunks = [];
     const archive = archiver("zip", { zlib: { level: 9 } });
     archive.on("data", (chunk) => chunks.push(chunk));
     archive.on("end", () => resolve(Buffer.concat(chunks)));
     archive.on("error", reject);
-    archive.directory(join4(packageDir, "force-app"), "force-app");
-    archive.file(join4(packageDir, "sfdx-project.json"), {
-      name: "sfdx-project.json"
-    });
+    for (const [dirName, metaType] of Object.entries(META_TYPE_MAP)) {
+      const srcDir = join4(forceAppDefault, dirName);
+      if (!existsSync3(srcDir)) continue;
+      const entries = readdirSync(srcDir, { withFileTypes: true });
+      for (const entry of entries) {
+        if (dirName === "lwc" && entry.isDirectory()) {
+          addMember(metaType, entry.name);
+          archive.directory(join4(srcDir, entry.name), `${dirName}/${entry.name}`);
+        } else if (entry.isFile()) {
+          archive.file(join4(srcDir, entry.name), { name: `${dirName}/${entry.name}` });
+          if (!entry.name.endsWith("-meta.xml")) {
+            const memberName = entry.name.replace(/\.[^.]+$/, "");
+            addMember(metaType, memberName);
+          }
+        }
+      }
+    }
+    const objectsDir = join4(forceAppDefault, "objects");
+    if (existsSync3(objectsDir)) {
+      for (const objEntry of readdirSync(objectsDir, { withFileTypes: true })) {
+        if (!objEntry.isDirectory()) continue;
+        const objName = objEntry.name;
+        addMember("CustomObject", objName);
+        const objDir = join4(objectsDir, objName);
+        const objectXml = mergeObjectXml(objDir, objName, apiVersion);
+        archive.append(Buffer.from(objectXml, "utf8"), {
+          name: `objects/${objName}.object`
+        });
+      }
+    }
+    const packageXml = generatePackageXml(members, apiVersion);
+    archive.append(Buffer.from(packageXml, "utf8"), { name: "package.xml" });
     archive.finalize();
   });
 }
+function mergeObjectXml(objDir, objName, apiVersion) {
+  const lines = [
+    '<?xml version="1.0" encoding="UTF-8"?>',
+    '<CustomObject xmlns="http://soap.sforce.com/2006/04/metadata">'
+  ];
+  const objMetaPath = join4(objDir, `${objName}.object-meta.xml`);
+  if (existsSync3(objMetaPath)) {
+    const content = readFileSync3(objMetaPath, "utf8");
+    const inner = content.replace(/<\?xml[^?]*\?>\s*/g, "").replace(/<CustomObject[^>]*>/g, "").replace(/<\/CustomObject>/g, "").trim();
+    if (inner) lines.push(inner);
+  }
+  const fieldsDir = join4(objDir, "fields");
+  if (existsSync3(fieldsDir)) {
+    for (const fieldFile of readdirSync(fieldsDir).sort()) {
+      if (!fieldFile.endsWith(".field-meta.xml")) continue;
+      const content = readFileSync3(join4(fieldsDir, fieldFile), "utf8");
+      const inner = content.replace(/<\?xml[^?]*\?>\s*/g, "").replace(/<CustomField[^>]*>/g, "").replace(/<\/CustomField>/g, "").trim();
+      if (inner) {
+        lines.push("    <fields>");
+        lines.push(`        ${inner}`);
+        lines.push("    </fields>");
+      }
+    }
+  }
+  lines.push("</CustomObject>");
+  return lines.join("\n");
+}
+function generatePackageXml(members, apiVersion) {
+  const lines = [
+    '<?xml version="1.0" encoding="UTF-8"?>',
+    '<Package xmlns="http://soap.sforce.com/2006/04/metadata">'
+  ];
+  for (const [metaType, names] of [...members.entries()].sort((a, b) => a[0].localeCompare(b[0]))) {
+    lines.push("    <types>");
+    for (const name of [...names].sort()) {
+      lines.push(`        <members>${name}</members>`);
+    }
+    lines.push(`        <name>${metaType}</name>`);
+    lines.push("    </types>");
+  }
+  lines.push(`    <version>${apiVersion}</version>`);
+  lines.push("</Package>");
+  return lines.join("\n");
+}
 
 // src/steps/sfdc-deploy-inline.ts
 var __dirname2 = dirname2(fileURLToPath2(import.meta.url));
@@ -1094,16 +1230,16 @@ async function sfdcDeployInline(params) {
   s.start("Copying Salesforce package\u2026");
   const inDist = join5(__dirname2, "sfdc-package");
   const nextToDist = join5(__dirname2, "..", "sfdc-package");
-  const bundledPkg = existsSync3(inDist) ? inDist : nextToDist;
+  const bundledPkg = existsSync4(inDist) ? inDist : nextToDist;
   const destPkg = join5(installDir ?? tmpdir(), "lead-routing-sfdc-package");
-  if (!existsSync3(bundledPkg)) {
+  if (!existsSync4(bundledPkg)) {
     s.stop("sfdc-package not found in CLI bundle");
     throw new Error(
       `Expected bundle at: ${inDist}
 The CLI may need to be reinstalled: npm i -g @lead-routing/cli`
     );
   }
-  if (existsSync3(destPkg)) rmSync(destPkg, { recursive: true, force: true });
+  if (existsSync4(destPkg)) rmSync(destPkg, { recursive: true, force: true });
   cpSync(bundledPkg, destPkg, { recursive: true });
   s.stop("Package copied");
   const ncPath = join5(
@@ -1114,8 +1250,8 @@ The CLI may need to be reinstalled: npm i -g @lead-routing/cli`
     "namedCredentials",
     "RoutingEngine.namedCredential-meta.xml"
   );
-  if (existsSync3(ncPath)) {
-    const nc = patchXml(readFileSync3(ncPath, "utf8"), "endpoint", engineUrl);
+  if (existsSync4(ncPath)) {
+    const nc = patchXml(readFileSync4(ncPath, "utf8"), "endpoint", engineUrl);
     writeFileSync3(ncPath, nc, "utf8");
   }
   const rssEnginePath = join5(
@@ -1126,8 +1262,8 @@ The CLI may need to be reinstalled: npm i -g @lead-routing/cli`
     "remoteSiteSettings",
     "LeadRouterEngine.remoteSite-meta.xml"
   );
-  if (existsSync3(rssEnginePath)) {
-    let rss = patchXml(readFileSync3(rssEnginePath, "utf8"), "url", engineUrl);
+  if (existsSync4(rssEnginePath)) {
+    let rss = patchXml(readFileSync4(rssEnginePath, "utf8"), "url", engineUrl);
     rss = patchXml(rss, "description", "Lead Router Engine endpoint");
     writeFileSync3(rssEnginePath, rss, "utf8");
   }
@@ -1139,8 +1275,8 @@ The CLI may need to be reinstalled: npm i -g @lead-routing/cli`
     "remoteSiteSettings",
     "LeadRouterApp.remoteSite-meta.xml"
   );
-  if (existsSync3(rssAppPath)) {
-    let rss = patchXml(readFileSync3(rssAppPath, "utf8"), "url", appUrl);
+  if (existsSync4(rssAppPath)) {
+    let rss = patchXml(readFileSync4(rssAppPath, "utf8"), "url", appUrl);
     rss = patchXml(rss, "description", "Lead Router App URL");
     writeFileSync3(rssAppPath, rss, "utf8");
   }
@@ -1210,16 +1346,17 @@ ${failureMsg || result.errorMessage || "Unknown error"}`
     const existing = await sf.query(
       "SELECT Id FROM Routing_Settings__c LIMIT 1"
     );
+    const settingsData = {
+      App_Url__c: appUrl,
+      Engine_Endpoint__c: engineUrl
+    };
+    if (params.webhookSecret) {
+      settingsData.Webhook_Secret__c = params.webhookSecret;
+    }
     if (existing.length > 0) {
-      await sf.update("Routing_Settings__c", existing[0].Id, {
-        App_Url__c: appUrl,
-        Engine_Endpoint__c: engineUrl
-      });
+      await sf.update("Routing_Settings__c", existing[0].Id, settingsData);
     } else {
-      await sf.create("Routing_Settings__c", {
-        App_Url__c: appUrl,
-        Engine_Endpoint__c: engineUrl
-      });
+      await sf.create("Routing_Settings__c", settingsData);
     }
     s.stop("Org settings written");
   } catch (err) {
@@ -1521,7 +1658,8 @@ async function runInit(options = {}) {
         orgAlias: "lead-routing",
         sfdcClientId: saved.sfdcClientId ?? "",
         sfdcLoginUrl: saved.sfdcLoginUrl ?? "https://login.salesforce.com",
-        installDir: dir
+        installDir: dir,
+        webhookSecret: saved.engineWebhookSecret
       });
       await guideAppLauncherSetup(saved.appUrl);
       outro(
@@ -1597,6 +1735,14 @@ Files created: docker-compose.yml, Caddyfile, .env.web, .env.engine, lead-routin
     await startServices(ssh, remoteDir);
     log9.step("Step 7/8  Verifying health");
     await verifyHealth(cfg.appUrl, cfg.engineUrl, ssh, remoteDir);
+    try {
+      const envWebPath = join6(dir, ".env.web");
+      const envContent = readFileSync5(envWebPath, "utf-8");
+      const cleaned = envContent.split("\n").filter((line) => !line.startsWith("ADMIN_PASSWORD=")).join("\n");
+      writeFileSync4(envWebPath, cleaned, "utf-8");
+      log9.success("Removed ADMIN_PASSWORD from .env.web (no longer needed after seed)");
+    } catch {
+    }
     log9.step("Step 8/8  Deploying Salesforce package");
     await sfdcDeployInline({
       appUrl: cfg.appUrl,
@@ -1604,7 +1750,8 @@ Files created: docker-compose.yml, Caddyfile, .env.web, .env.engine, lead-routin
       orgAlias: "lead-routing",
       sfdcClientId: cfg.sfdcClientId,
       sfdcLoginUrl: cfg.sfdcLoginUrl,
-      installDir: dir
+      installDir: dir,
+      webhookSecret: cfg.engineWebhookSecret
     });
     await guideAppLauncherSetup(cfg.appUrl);
     outro(
@@ -1633,8 +1780,8 @@ Files created: docker-compose.yml, Caddyfile, .env.web, .env.engine, lead-routin
 }
 
 // src/commands/deploy.ts
-import { writeFileSync as writeFileSync4, unlinkSync } from "fs";
-import { join as join6 } from "path";
+import { writeFileSync as writeFileSync5, unlinkSync } from "fs";
+import { join as join7 } from "path";
 import { tmpdir as tmpdir2 } from "os";
 import { intro as intro2, outro as outro2, log as log10, password as promptPassword2 } from "@clack/prompts";
 import chalk3 from "chalk";
@@ -1676,8 +1823,8 @@ async function runDeploy() {
     const remoteDir = await ssh.resolveHome(cfg.remoteDir);
     log10.step("Syncing Caddyfile");
     const caddyContent = renderCaddyfile(cfg.appUrl, cfg.engineUrl);
-    const tmpCaddy = join6(tmpdir2(), "lead-routing-Caddyfile");
-    writeFileSync4(tmpCaddy, caddyContent, "utf8");
+    const tmpCaddy = join7(tmpdir2(), "lead-routing-Caddyfile");
+    writeFileSync5(tmpCaddy, caddyContent, "utf8");
     await ssh.upload([{ local: tmpCaddy, remote: `${remoteDir}/Caddyfile` }]);
     unlinkSync(tmpCaddy);
     await ssh.exec("docker compose restart caddy", remoteDir);
@@ -1839,15 +1986,15 @@ async function runStatus() {
 }
 
 // src/commands/config.ts
-import { readFileSync as readFileSync4, writeFileSync as writeFileSync5, existsSync as existsSync4 } from "fs";
-import { join as join7 } from "path";
+import { readFileSync as readFileSync6, writeFileSync as writeFileSync6, existsSync as existsSync5 } from "fs";
+import { join as join8 } from "path";
 import { intro as intro4, outro as outro4, text as text3, password as password3, spinner as spinner6, log as log14 } from "@clack/prompts";
 import chalk5 from "chalk";
 import { execa as execa4 } from "execa";
 function parseEnv(filePath) {
   const map = /* @__PURE__ */ new Map();
-  if (!existsSync4(filePath)) return map;
-  for (const line of readFileSync4(filePath, "utf8").split("\n")) {
+  if (!existsSync5(filePath)) return map;
+  for (const line of readFileSync6(filePath, "utf8").split("\n")) {
     const trimmed = line.trim();
     if (!trimmed || trimmed.startsWith("#")) continue;
     const eq = trimmed.indexOf("=");
@@ -1857,7 +2004,7 @@ function parseEnv(filePath) {
   return map;
 }
 function writeEnv(filePath, updates) {
-  const lines = existsSync4(filePath) ? readFileSync4(filePath, "utf8").split("\n") : [];
+  const lines = existsSync5(filePath) ? readFileSync6(filePath, "utf8").split("\n") : [];
   const updated = /* @__PURE__ */ new Set();
   const result = lines.map((line) => {
     const trimmed = line.trim();
@@ -1874,7 +2021,7 @@ function writeEnv(filePath, updates) {
   for (const [key, val] of Object.entries(updates)) {
     if (!updated.has(key)) result.push(`${key}=${val}`);
   }
-  writeFileSync5(filePath, result.join("\n"), "utf8");
+  writeFileSync6(filePath, result.join("\n"), "utf8");
 }
 async function runConfigSfdc() {
   intro4("Lead Routing \u2014 Update Salesforce Credentials");
@@ -1884,8 +2031,8 @@ async function runConfigSfdc() {
     log14.info("Run `lead-routing init` first, or cd into your installation directory.");
     process.exit(1);
   }
-  const envWeb = join7(dir, ".env.web");
-  const envEngine = join7(dir, ".env.engine");
+  const envWeb = join8(dir, ".env.web");
+  const envEngine = join8(dir, ".env.engine");
   const currentWeb = parseEnv(envWeb);
   const currentClientId = currentWeb.get("SFDC_CLIENT_ID") ?? "";
   const currentLoginUrl = currentWeb.get("SFDC_LOGIN_URL") ?? "https://login.salesforce.com";
@@ -1938,7 +2085,7 @@ function runConfigShow() {
     console.error("No lead-routing installation found in the current directory.");
     process.exit(1);
   }
-  const envWeb = join7(dir, ".env.web");
+  const envWeb = join8(dir, ".env.web");
   const cfg = parseEnv(envWeb);
   const adminSecret = cfg.get("ADMIN_SECRET") ?? "(not found)";
   const appUrl = cfg.get("APP_URL") ?? "(not found)";
@@ -1996,7 +2143,8 @@ async function runSfdcDeploy() {
       // Read from config if available
       sfdcClientId: config2?.sfdcClientId ?? "",
       sfdcLoginUrl: config2?.sfdcLoginUrl ?? "https://login.salesforce.com",
-      installDir: dir ?? void 0
+      installDir: dir ?? void 0,
+      webhookSecret: config2?.engineWebhookSecret
     });
   } catch (err) {
     log15.error(err instanceof Error ? err.message : String(err));
@@ -2011,7 +2159,7 @@ async function runSfdcDeploy() {
 }
 
 // src/commands/uninstall.ts
-import { rmSync as rmSync2, existsSync as existsSync5 } from "fs";
+import { rmSync as rmSync2, existsSync as existsSync6 } from "fs";
 import { intro as intro6, outro as outro6, log as log16, confirm as confirm3, password as promptPassword3, isCancel as isCancel5 } from "@clack/prompts";
 import chalk7 from "chalk";
 async function runUninstall() {
@@ -2087,7 +2235,7 @@ async function runUninstall() {
     await ssh.disconnect();
   }
   log16.step("Removing local config directory");
-  if (existsSync5(dir)) {
+  if (existsSync6(dir)) {
     rmSync2(dir, { recursive: true, force: true });
     log16.success(`Removed ${dir}`);
   }

package/dist/prisma/migrations/20260310300000_make_branch_assignment_type_nullable/migration.sql

@@ -0,0 +1,2 @@
+-- AlterTable: make assignmentType nullable on routing_branches (allows saving unconfigured branches)
+ALTER TABLE "routing_branches" ALTER COLUMN "assignmentType" DROP NOT NULL;

package/dist/prisma/schema.prisma

@@ -230,7 +230,7 @@ model RoutingBranch {
   rule            RoutingRule    @relation(fields: [ruleId], references: [id], onDelete: Cascade)
   label           String?
   priority        Int            @default(0)
-  assignmentType  AssignmentType
+  assignmentType  AssignmentType?
   assigneeUserId  String?
   assigneeTeamId  String?
   assigneeQueueId String?

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lead-routing/cli",
-  "version": "0.2.0",
+  "version": "0.3.0",
   "description": "Self-hosted deployment CLI for Lead Routing",
   "homepage": "https://github.com/lead-routing/lead-routing",
   "keywords": [