@wrangled/cli 0.3.46 → 0.3.47

package/dist/guide.js

@@ -142,6 +142,10 @@ A webhook address lets a tool such as a form or webinar platform push events int
 5. \`${cli} creatives list\` and \`${cli} creatives show <sku>\` read the ledger. \`${cli} creatives download <sku>\` saves a creative's image or video as \`<sku>.<ext>\` in the current folder; \`--out <path>\` names the file or a folder, and \`--open\` opens it. It also takes an asset path or link, such as a \`meta_ad_creatives\` \`image_path\`. \`--format json\` prints \`{ path, bytes, contentType }\`. Copy has no file; its text is in \`${cli} creatives show\`. For performance, query the \`creatives\` table or the \`creative_performance_daily\` view with \`${cli} warehouse query\`.
 6. \`${cli} media list\` lists every image and video the tools made, newest first, whether or not it became a creative: its media id (\`<run id>:<index>\`), tool, prompt, cost and SKU, if any. Narrow it with \`--sku <sku>\`, \`--run <run-id>\` (one batch), \`--tool kie:nano-banana\`, \`--kind image|video\`, \`--since\` and \`--until\` (a day such as \`2026-10-08\`, which \`--until\` counts through its end in UTC, or an ISO time), and \`--limit <n>\` (default 50, at most 200). When more remain it prints the \`--cursor <media-id>\` that shows the next page. A run's cost is split evenly across its outputs and marked as an estimate when the provider did not report a charge. \`${cli} media get <media-id>\` shows the full input that made one, to reuse a good prompt; \`${cli} media download <media-id>\` saves its file, named by its SKU when it has one (\`${cli} creatives download\` takes a media id too). \`--format json\` prints \`{ media, nextCursor }\`.
 
+### The client's own provider keys
+
+A run bills the shared account unless the client has its own key for that provider. A key whose "Can manage settings" switch an admin turned on (Keys page) saves one: \`${cli} secrets set kie < key.txt\`, or \`--file <path>\`. Never type the key on the command line; it stays in the shell history, so the command refuses it. A key with several fields (genesis, vercel) is a JSON object, such as \`{"token": "...", "teamId": "..."}\`. \`${cli} secrets list\` shows which key each provider's runs use (the client's own, the shared one, or none), its field names, when and by whom it was saved, and when a run last read it, never the key itself. \`${cli} secrets remove kie\` puts runs back on the shared key. Meta's key is its source's, changed by connecting the Meta Ads source. A hand's run key can never save or remove keys.
+
 ## Landing pages
 
 The warehouse's content library keeps each landing page's words in order, read about once a day: one \`landing_page\` item per page in \`content_items\`, its versions in \`content_versions\` (\`fields->'blocks'\` holds the headings, paragraphs, lists, buttons, image descriptions and form field labels), and the list of pages with when each was last read in \`content_pages\`. Pages come from Meta ad links and GA4 landing pages. Add any other page with \`${cli} content add-page <url>\`: it is read at once, and the output shows its key, whether it could be read (\`ok\`, \`not_found\`, \`blocked\` by robots.txt, \`failed\`, \`not_html\`), and its version. A link that redirects, such as a link shortener, is recorded under the page it leads to.
@@ -325,6 +329,9 @@ ${cli} import remove --table <name> --yes   drop the table import_<name> and its
 ${cli} tools list                   list generation and research tools
 ${cli} tools run <tool> --input '<json>' [--idempotency-key <key>] [--wait <seconds>]
 ${cli} tools get <run-id>           show a tool run, waiting for it to finish (--wait)
+${cli} secrets list                 which provider keys the client has and which key runs use; never the keys themselves
+${cli} secrets set <provider> [--file <path>]   save the client's own provider key from stdin or a file (keys with "Can manage settings")
+${cli} secrets remove <provider>    remove it, so runs use the shared key again
 ${cli} creatives list               list creatives (--status, --kind, --limit)
 ${cli} creatives show <sku>         show one creative with its spec and lineage
 ${cli} creatives download <sku | media-id | asset-path | asset-link> [--out <path>] [--open]   save a creative's image or video

package/dist/main.js

@@ -7,6 +7,7 @@ import { parseArgs } from "node:util";
 import { api, ApiError, apiDownload, apiText, apiUpload, CliError, exitCodes, getSigned, IMPORT_LIMITS, IMPORT_NAME_PATTERN, putSigned, CLIENT_FILE, parseClientName, readSavedLogins, removeCredentials, resolveApiUrl, resolveConnection, resolveLogin, UnreadableCredentialsError, writeCredentials, entryTagFlags, streamSigned, } from "./api.js";
 import { brand, envPrefix } from "./brand.js";
 import { firstSymlink, inRunFolder, writeFileAtomic } from "./files.js";
+import { secretBody, secretProvider, SECRETS_SET_USAGE } from "./secrets.js";
 import { guide, skill } from "./guide.js";
 import { PULL_STATE_FILE, pullContent } from "./pull.js";
 import { AGENTS_MD_MARKER, metaAdsAgentsMd, PLAYBOOK_CHOICES, playbooks } from "./playbooks.js";
@@ -367,6 +368,57 @@ const commands = {
             console.log(renderTable(["key", "label", "value"], settings.fields.map((f) => ({ key: f.key, label: f.label, value: settings.values[f.key] ?? "" }))));
         },
     },
+    "secrets list": {
+        usage: "secrets list   (which provider keys the client has; never the keys themselves)",
+        async run(args, options) {
+            if (args.length > 0)
+                throw new CliError("Usage: secrets list", exitCodes.usage);
+            const { secrets } = await api(await resolveConnection(options), SECRETS_PATH);
+            if (options.format === "json")
+                return printJson({ secrets });
+            const rows = secrets.map((s) => ({
+                provider: s.provider,
+                "key in use": secretSourceLabel(s),
+                fields: s.fields.join(", "),
+                saved: s.updatedAt ?? "",
+                "saved by": s.updatedBy ?? "",
+                "last used": s.lastUsedAt ?? (s.source === "workspace" && s.changedWith === "secrets" ? "never" : ""),
+            }));
+            console.log(renderTable(["provider", "key in use", "fields", "saved", "saved by", "last used"], rows));
+        },
+    },
+    "secrets set": {
+        usage: SECRETS_SET_USAGE,
+        async run(args, options) {
+            const provider = secretProvider(args);
+            const text = options.file
+                ? await readFile(await inRunFolder(options.file), "utf8")
+                : process.stdin.isTTY
+                    ? await promptHidden(`Paste the ${provider} key: `)
+                    : await readStdin();
+            const connection = await resolveConnection(options);
+            const { secret } = await api(connection, secretPath(provider), secretBody(text), "PUT");
+            if (options.format === "json")
+                return printJson({ secret });
+            console.log(`Saved the client's own ${secret.provider} key. Its ${secret.provider} runs now use it instead of the shared one.`);
+        },
+    },
+    "secrets remove": {
+        usage: "secrets remove <provider>   (runs go back to the shared key)",
+        async run(args, options) {
+            if (args.length !== 1)
+                throw new CliError("Usage: secrets remove <provider>", exitCodes.usage);
+            const result = await api(await resolveConnection(options), secretPath(args[0]), undefined, "DELETE");
+            if (options.format === "json")
+                return printJson(result);
+            const { provider } = result.secret;
+            if (!result.removed)
+                return console.log(`The client had no ${provider} key of its own; nothing changed.`);
+            console.log(result.secret.source === "platform"
+                ? `Removed the client's own ${provider} key. Its runs now use the shared key.`
+                : `Removed the client's own ${provider} key. No shared key is set, so its ${provider} runs fail until a key is saved.`);
+        },
+    },
     "intake list": {
         usage: "intake list",
         async run(args, options) {
@@ -2595,7 +2647,7 @@ Options:
   --days <n>            winners: the last n complete days, ending yesterday, instead of a week (at most 90); or give winners
                         --from and --to for any dates
   --body, --html <text | @file>   the words, or the full HTML, content create, capture and edit save
-  --file <path>         an image, video or audio file, up to 50 MB, content create, capture and edit save; repeat for several
+  --file <path>         an image, video or audio file, up to 50 MB, content create, capture and edit save; repeat for several; for secrets set, the file holding the key
   --transcript <text | @file>   what is said in the first video or audio file content capture saves, so none is paid for
   --language <code>     the spoken language of --transcript, such as en
   --source <text>       where the content content capture saves came from, in words
@@ -2894,6 +2946,15 @@ async function changeCandidate(change, args, options) {
         throw new CliError(`Usage: worker ${change} <skill> --workspace <slug>`, exitCodes.usage);
     return api(await operatorConnection(options), `/api/operator/workers/${change}`, { workspace: options.workspace, skill: args[0] });
 }
+const SECRETS_PATH = "/api/v1/secrets";
+function secretPath(provider) {
+    return `${SECRETS_PATH}/${encodeURIComponent(provider)}`;
+}
+function secretSourceLabel(secret) {
+    if (secret.source === "workspace")
+        return secret.changedWith === "meta_source" ? "the Meta source's" : "the client's own";
+    return secret.source === "platform" ? "the shared key" : "none";
+}
 function findCommand(positionals) {
     const three = positionals.slice(0, 3).join(" ");
     if (Object.hasOwn(commands, three))

package/dist/secrets.js

@@ -0,0 +1,35 @@
+import { CliError, exitCodes } from "./api.js";
+import { brand } from "./brand.js";
+export const SECRETS_SET_USAGE = "secrets set <provider> [--file <path>]   (the key on stdin or in the file; JSON {\"field\": \"...\"} for a key with several fields)";
+/**
+ * The provider `secrets set` names. A second argument is refused without being echoed: it is most likely the key,
+ * which would then sit in the shell's history.
+ */
+export function secretProvider(args) {
+    if (args.length > 1) {
+        throw new CliError(`Never pass the key as an argument: it stays in your shell history. Pipe it on stdin (\`${brand.slug} secrets set <provider> < key.txt\`) or name a file with --file.`, exitCodes.usage);
+    }
+    if (args.length === 0)
+        throw new CliError(`Usage: ${SECRETS_SET_USAGE}`, exitCodes.usage);
+    return args[0];
+}
+/** A JSON object of strings is a multi-field key; anything else is the key itself. Error messages never repeat the text. */
+export function secretBody(text) {
+    const trimmed = text.trim();
+    if (!trimmed)
+        throw new CliError("No key given. Pipe it on stdin or name a file with --file.", exitCodes.usage);
+    if (!trimmed.startsWith("{"))
+        return { value: trimmed };
+    let parsed;
+    try {
+        parsed = JSON.parse(trimmed);
+    }
+    catch {
+        throw new CliError('The key starts with "{" but is not valid JSON. A key with several fields is a JSON object, such as {"token": "...", "teamId": "..."}.', exitCodes.usage);
+    }
+    const fields = parsed;
+    if (typeof parsed !== "object" || parsed === null || Array.isArray(parsed) || Object.values(fields).some((v) => typeof v !== "string")) {
+        throw new CliError('A key with several fields is a JSON object of strings, such as {"token": "...", "teamId": "..."}.', exitCodes.usage);
+    }
+    return { fields: fields };
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@wrangled/cli",
-  "version": "0.3.46",
+  "version": "0.3.47",
   "description": "Command-line access to your marketing data warehouse, for people and coding agents",
   "type": "module",
   "bin": {