@replayio/app-building 1.16.0 → 1.17.0

package/README.md

@@ -77,7 +77,7 @@ exec-secrets NETLIFY_AUTH_TOKEN NETLIFY_ACCOUNT_SLUG -- netlify deploy --prod
 
 The secrets server spawns the command with the requested secrets in its environment and **redacts all secret values** from the output.
 
-The agent can also run `list-secrets` to see which secrets are available.
+The agent can also run `list-secrets` to see which secrets are available, and `set-branch-secret` to store new branch-level secrets (e.g., `DATABASE_URL` created at deploy time). The server rejects values that have already appeared in logs.
 
 ## Exported API
 
@@ -149,9 +149,11 @@ The agent can also run `list-secrets` to see which secrets are available.
 
 | Export | Description |
 |---|---|
+| `infisicalLogin(clientId, clientSecret)` | Log in via Universal Auth, returns a short-lived access token. |
 | `getInfisicalConfig(envVars)` | Extract `InfisicalConfig` from env vars and log in. Requires `INFISICAL_CLIENT_ID`, `INFISICAL_CLIENT_SECRET`, `INFISICAL_PROJECT_ID`, `INFISICAL_ENVIRONMENT`. |
 | `fetchGlobalSecrets(config)` | Fetch secrets from the `/global/` path. |
 | `fetchBranchSecrets(config, branch)` | Fetch secrets from `/branches/<branch>/`. |
+| `createBranchSecret(config, branch, name, value)` | Create or update a secret in `/branches/<branch>/`. |
 | `fetchInfisicalSecrets(config, path)` | Raw fetch from any Infisical folder path. |
 
 **Types:** `InfisicalConfig`

package/dist/secrets.d.ts

@@ -21,6 +21,11 @@ export declare function fetchGlobalSecrets(config: InfisicalConfig): Promise<Rec
  * Fetch per-branch deployment secrets from `/branches/<branch>/`.
  */
 export declare function fetchBranchSecrets(config: InfisicalConfig, branch: string): Promise<Record<string, string>>;
+/**
+ * Create or update a branch secret in Infisical.
+ * Uses POST to create, falls back to PATCH if it already exists.
+ */
+export declare function createBranchSecret(config: InfisicalConfig, branch: string, name: string, value: string): Promise<void>;
 /**
  * Extract Infisical config from environment variables and log in.
  * Reads INFISICAL_CLIENT_ID, INFISICAL_CLIENT_SECRET, INFISICAL_PROJECT_ID,

package/dist/secrets.js

@@ -59,6 +59,46 @@ export async function fetchGlobalSecrets(config) {
 export async function fetchBranchSecrets(config, branch) {
     return fetchInfisicalSecrets(config, `/branches/${branch}/`);
 }
+/**
+ * Create or update a branch secret in Infisical.
+ * Uses POST to create, falls back to PATCH if it already exists.
+ */
+export async function createBranchSecret(config, branch, name, value) {
+    const secretPath = `/branches/${branch}/`;
+    const url = `${INFISICAL_API_BASE}/api/v3/secrets/raw/${encodeURIComponent(name)}`;
+    const body = {
+        workspaceId: config.projectId,
+        environment: config.environment,
+        secretPath,
+        secretValue: value,
+        type: "shared",
+    };
+    const headers = {
+        Authorization: `Bearer ${config.token}`,
+        "Content-Type": "application/json",
+    };
+    const res = await fetch(url, {
+        method: "POST",
+        headers,
+        body: JSON.stringify(body),
+    });
+    if (res.ok)
+        return;
+    // If conflict (already exists), try PATCH to update
+    if (res.status === 400 || res.status === 409) {
+        const patchRes = await fetch(url, {
+            method: "PATCH",
+            headers,
+            body: JSON.stringify(body),
+        });
+        if (patchRes.ok)
+            return;
+        const text = await patchRes.text().catch(() => "");
+        throw new Error(`Infisical PATCH ${name} → ${patchRes.status}: ${text}`);
+    }
+    const text = await res.text().catch(() => "");
+    throw new Error(`Infisical POST ${name} → ${res.status}: ${text}`);
+}
 /**
  * Extract Infisical config from environment variables and log in.
  * Reads INFISICAL_CLIENT_ID, INFISICAL_CLIENT_SECRET, INFISICAL_PROJECT_ID,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@replayio/app-building",
-  "version": "1.16.0",
+  "version": "1.17.0",
   "description": "Library for managing agentic app-building containers",
   "type": "module",
   "exports": {