anbaric 1.66.1 → 1.67.0

package/docs/api/cli.md

@@ -62,6 +62,18 @@ anbaric app status link-media-brief     # a different app, from anywhere
 | `anbaric jobs kill <job-id>` | Kill a job so it stops progressing. |
 | `anbaric jobs kill-old <age>` | Kill jobs not updated within `<age>` (e.g. `24h`, `7d`; units `s`/`m`/`h`/`d`/`w`). Prompts unless `--yes`. |
 
+## Secrets
+
+Scoped to the app you are in (or `--app <name>`). Values go in and never come
+out: the platform refuses to read a secret back to a person, so the way to check
+one is to set it again.
+
+| Command | Purpose |
+| --- | --- |
+| `anbaric secrets list` | The names of the app's secrets. |
+| `anbaric secrets set <name>` | Set or replace a secret. The value is prompted for without echo, or read whole from stdin (`echo "$KEY" \| anbaric secrets set openai-key`) — never passed on the command line. |
+| `anbaric secrets delete <name>` | Remove a secret. |
+
 ## Flags
 
 Every command accepts these; they supply the answers a prompt would otherwise

package/docs/features/ai-agents.md

@@ -114,8 +114,11 @@ For a provider none of them covers, implement an `Agent.Client` (a class with a
 `generate(request)` method) and pass it to a plain `Agent`. See the [API
 reference](../api/actors-and-agents.md#agents-and-ai) for the client contract.
 
-> Keep model API keys in the [secret store](documents-and-secrets.md), not in
-> source. Locally you can read them from the environment as above.
+> Read model API keys from the [secret store](documents-and-secrets.md) rather
+> than the environment directly - `apiKey: await secrets.retrieve("openai-key", actor)`.
+> Locally that falls back to `OPENAI_KEY` in your shell, so the examples above
+> run on a laptop as written; deployed, set it once with
+> `anbaric secrets set openai-key` and the same line reads the real store.
 
 ## Next
 

package/docs/features/documents-and-secrets.md

@@ -58,6 +58,19 @@ Use the secret store for third-party API keys and other credentials your app
 needs at runtime. Retrieving an unknown name throws `No secret found with name
 "..."`.
 
+**Locally, the environment is the backstop.** With no platform behind it, a
+secret that was never written resolves from the environment under its name
+upper-cased: `retrieve("openai-key")` reads `OPENAI_KEY`, `retrieve("stripe.secret")`
+reads `STRIPE_SECRET`. So the line that reads a key from the store on the
+platform reads it from a shell variable on your laptop, unchanged.
+
+**Deployed, you set secrets once and the app reads them.** There is no
+environment fallback on the platform. Set a secret from the app's directory with
+`anbaric secrets set openai-key` (the value is prompted for, or piped on stdin -
+never on the command line), from the console's **Secrets** page, or with the
+`anbaric_secret_set` tool in Claude Code. Values can be set and replaced but
+never read back: `anbaric secrets list` and the console show names only.
+
 ## Choosing an implementation
 
 You don't — the factories do, from the environment:

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "anbaric",
-  "version": "1.66.1",
+  "version": "1.67.0",
   "description": "Everything needed to write an Anbaric app: state machines, jobs, document and secret stores, local in-memory implementations and the Anbaric Cloud clients",
   "license": "MIT",
   "type": "module",
@@ -24,9 +24,9 @@
     "prepublishOnly": "npm run build"
   },
   "dependencies": {
-    "anbaric-impl-cloud": "^1.66.1",
-    "anbaric-data-store": "^1.66.1",
-    "anbaric-state-machine": "^1.66.1",
-    "anbaric-tsapi": "^1.66.1"
+    "anbaric-impl-cloud": "^1.67.0",
+    "anbaric-data-store": "^1.67.0",
+    "anbaric-state-machine": "^1.67.0",
+    "anbaric-tsapi": "^1.67.0"
   }
 }