autotouch-cli 0.2.41__tar.gz → 0.2.42__tar.gz

{autotouch_cli-0.2.41 → autotouch_cli-0.2.42}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: autotouch-cli
-Version: 0.2.41
+Version: 0.2.42
 Summary: Autotouch Smart Table CLI
 Requires-Python: >=3.9
 Description-Content-Type: text/markdown
@@ -137,7 +137,7 @@ Use a dedicated `AUTOTOUCH_CONFIG_PATH` if you want a clean local account instea
 
 ## Docs
 
-- Full CLI reference: https://github.com/nicolonic/autotouch_main/blob/autotouch-cli-v0.2.41/docs/research-table/reference/autotouch-cli.md
-- Agent playbook: https://github.com/nicolonic/autotouch_main/blob/autotouch-cli-v0.2.41/docs/research-table/guides/autotouch-cli-agent-playbook.md
-- Tables/API reference: https://github.com/nicolonic/autotouch_main/blob/autotouch-cli-v0.2.41/docs/research-table/reference/tables-api.md
-- Authentication/scopes: https://github.com/nicolonic/autotouch_main/blob/autotouch-cli-v0.2.41/docs/platform/authentication.md
+- Full CLI reference: https://github.com/nicolonic/autotouch_main/blob/autotouch-cli-v0.2.42/docs/research-table/reference/autotouch-cli.md
+- Agent playbook: https://github.com/nicolonic/autotouch_main/blob/autotouch-cli-v0.2.42/docs/research-table/guides/autotouch-cli-agent-playbook.md
+- Tables/API reference: https://github.com/nicolonic/autotouch_main/blob/autotouch-cli-v0.2.42/docs/research-table/reference/tables-api.md
+- Authentication/scopes: https://github.com/nicolonic/autotouch_main/blob/autotouch-cli-v0.2.42/docs/platform/authentication.md

{autotouch_cli-0.2.41 → autotouch_cli-0.2.42}/README.md

@@ -128,7 +128,7 @@ Use a dedicated `AUTOTOUCH_CONFIG_PATH` if you want a clean local account instea
 
 ## Docs
 
-- Full CLI reference: https://github.com/nicolonic/autotouch_main/blob/autotouch-cli-v0.2.41/docs/research-table/reference/autotouch-cli.md
-- Agent playbook: https://github.com/nicolonic/autotouch_main/blob/autotouch-cli-v0.2.41/docs/research-table/guides/autotouch-cli-agent-playbook.md
-- Tables/API reference: https://github.com/nicolonic/autotouch_main/blob/autotouch-cli-v0.2.41/docs/research-table/reference/tables-api.md
-- Authentication/scopes: https://github.com/nicolonic/autotouch_main/blob/autotouch-cli-v0.2.41/docs/platform/authentication.md
+- Full CLI reference: https://github.com/nicolonic/autotouch_main/blob/autotouch-cli-v0.2.42/docs/research-table/reference/autotouch-cli.md
+- Agent playbook: https://github.com/nicolonic/autotouch_main/blob/autotouch-cli-v0.2.42/docs/research-table/guides/autotouch-cli-agent-playbook.md
+- Tables/API reference: https://github.com/nicolonic/autotouch_main/blob/autotouch-cli-v0.2.42/docs/research-table/reference/tables-api.md
+- Authentication/scopes: https://github.com/nicolonic/autotouch_main/blob/autotouch-cli-v0.2.42/docs/platform/authentication.md

{autotouch_cli-0.2.41 → autotouch_cli-0.2.42}/autotouch_cli/cli.py

@@ -49,6 +49,7 @@ from autotouch_cli.commands.columns import (
     cmd_columns_run as cmd_columns_run_impl,
     cmd_columns_run_next as cmd_columns_run_next_impl,
     cmd_columns_stop as cmd_columns_stop_impl,
+    cmd_columns_test_http_request as cmd_columns_test_http_request_impl,
     cmd_columns_update as cmd_columns_update_impl,
     register_columns_subcommands,
 )
@@ -185,6 +186,13 @@ from autotouch_cli.commands.webhooks import (
     cmd_webhooks_subscriptions_test as cmd_webhooks_subscriptions_test_impl,
     cmd_webhooks_subscriptions_update as cmd_webhooks_subscriptions_update_impl,
 )
+from autotouch_cli.commands.workspace_secrets import (
+    WorkspaceSecretCommandRuntime as WorkspaceSecretCommandHandlerRuntime,
+    cmd_workspace_secrets_delete as cmd_workspace_secrets_delete_impl,
+    cmd_workspace_secrets_list as cmd_workspace_secrets_list_impl,
+    cmd_workspace_secrets_set as cmd_workspace_secrets_set_impl,
+    register_workspace_secrets_subcommands,
+)
 from autotouch_cli.core.auth import (
     auth_headers as auth_headers_impl,
     env_api_key as env_api_key_impl,
@@ -263,6 +271,7 @@ from autotouch_cli.templates import (
     ONBOARDING_SCHEMA_TYPES,
     ORG_CONTEXT_SCHEMA_TYPES,
     PERSONAL_CONTEXT_SCHEMA_TYPES,
+    WORKSPACE_SECRET_SCHEMA_TYPES,
     ROW_SCHEMA_TYPES,
     SEQUENCE_RECIPE_TYPES,
     SHARED_SCHEMA_TYPES,
@@ -279,6 +288,7 @@ from autotouch_cli.templates import (
     emit_onboarding_schema,
     emit_org_context_schema,
     emit_personal_context_schema,
+    emit_workspace_secrets_schema,
     emit_rows_schema,
     emit_schema,
     emit_sequences_recipe,
@@ -2252,6 +2262,18 @@ def cmd_auth_clear(args: argparse.Namespace) -> None:
     cmd_auth_clear_impl(args, runtime=_auth_command_runtime())
 
 
+def cmd_workspace_secrets_list(args: argparse.Namespace) -> None:
+    cmd_workspace_secrets_list_impl(args, runtime=_workspace_secret_command_runtime())
+
+
+def cmd_workspace_secrets_set(args: argparse.Namespace) -> None:
+    cmd_workspace_secrets_set_impl(args, runtime=_workspace_secret_command_runtime())
+
+
+def cmd_workspace_secrets_delete(args: argparse.Namespace) -> None:
+    cmd_workspace_secrets_delete_impl(args, runtime=_workspace_secret_command_runtime())
+
+
 def _coerce_string_list(values: Any) -> List[str]:
     if values is None:
         return []
@@ -2626,6 +2648,10 @@ def cmd_personal_context_schema(args: argparse.Namespace) -> None:
     emit_personal_context_schema(args, _template_runtime())
 
 
+def cmd_workspace_secrets_schema(args: argparse.Namespace) -> None:
+    emit_workspace_secrets_schema(args, _template_runtime())
+
+
 def cmd_tables_schema(args: argparse.Namespace) -> None:
     emit_tables_schema(args, _template_runtime())
 
@@ -2774,6 +2800,16 @@ def _auth_command_runtime() -> AuthCommandHandlerRuntime:
     )
 
 
+def _workspace_secret_command_runtime() -> WorkspaceSecretCommandHandlerRuntime:
+    return WorkspaceSecretCommandHandlerRuntime(
+        resolve_token=_resolve_token,
+        request_api=_request_api,
+        print_json=lambda data, compact=False: _print_json(data, compact=compact),
+        load_json_input=_load_json_input,
+        normalize_string_value=_normalize_string_value,
+    )
+
+
 def _job_command_runtime() -> JobCommandHandlerRuntime:
     return JobCommandHandlerRuntime(
         resolve_token=_resolve_token,
@@ -3211,6 +3247,10 @@ def cmd_columns_projections(args: argparse.Namespace) -> None:
     cmd_columns_projections_impl(args, runtime=_column_command_runtime())
 
 
+def cmd_columns_test_http_request(args: argparse.Namespace) -> None:
+    cmd_columns_test_http_request_impl(args, runtime=_column_command_runtime())
+
+
 def cmd_columns_run(args: argparse.Namespace) -> None:
     cmd_columns_run_impl(args, runtime=_column_command_runtime())
 
@@ -3794,6 +3834,19 @@ def build_parser() -> argparse.ArgumentParser:
     _add_output_formatting_arguments(ppersonalschema)
     ppersonalschema.set_defaults(func=cmd_personal_context_schema)
 
+    register_workspace_secrets_subcommands(
+        sub,
+        add_api_common_arguments=_add_api_common_arguments,
+        add_output_formatting_arguments=_add_output_formatting_arguments,
+        handlers={
+            "list": cmd_workspace_secrets_list,
+            "set": cmd_workspace_secrets_set,
+            "delete": cmd_workspace_secrets_delete,
+            "schema": cmd_workspace_secrets_schema,
+        },
+        workspace_secret_schema_types=WORKSPACE_SECRET_SCHEMA_TYPES,
+    )
+
     # resolved context
     pctx = sub.add_parser("context", help="Resolved requester context used by enrichment/runtime")
     ctx_sub = pctx.add_subparsers(dest="context_cmd", required=True)
@@ -3959,6 +4012,7 @@ def build_parser() -> argparse.ArgumentParser:
             "update": cmd_columns_update,
             "delete": cmd_columns_delete,
             "projections": cmd_columns_projections,
+            "test_http_request": cmd_columns_test_http_request,
             "run": cmd_columns_run,
             "stop": cmd_columns_stop,
             "run_next": cmd_columns_run_next,

{autotouch_cli-0.2.41 → autotouch_cli-0.2.42}/autotouch_cli/cli_contracts.py

@@ -33,6 +33,7 @@ _AUTH_MODE_PREFIXES: Tuple[Tuple[str, str], ...] = (
     ("org-context.", "user_session"),
     ("personal-context.", "user_session"),
     ("context.", "user_session"),
+    ("workspace-secrets.", "developer_key_or_user_session"),
     ("tables.", "developer_key_or_user_session"),
     ("blacklist.", "developer_key_or_user_session"),
     ("rows.", "developer_key_or_user_session"),

{autotouch_cli-0.2.41 → autotouch_cli-0.2.42}/autotouch_cli/commands/columns.py

@@ -22,6 +22,38 @@ class ColumnCommandRuntime:
     select_next_row_ids: Callable[..., Dict[str, Any]]
 
 
+def _normalize_http_request_test_payload(payload: Dict[str, Any]) -> Dict[str, Any]:
+    candidate = payload
+    config = payload.get("config")
+    if isinstance(config, dict):
+        candidate = config
+    if candidate.get("provider") and str(candidate.get("provider")) != "http_request":
+        print("ERROR: columns test-http-request only accepts http_request payloads", file=sys.stderr)
+        sys.exit(2)
+
+    url = candidate.get("url")
+    if not isinstance(url, str) or not url.strip():
+        print("ERROR: HTTP request preview requires url", file=sys.stderr)
+        sys.exit(2)
+
+    headers = candidate.get("headers")
+    if headers is None:
+        headers = {}
+    if not isinstance(headers, dict):
+        print("ERROR: HTTP request preview requires headers to be a JSON object", file=sys.stderr)
+        sys.exit(2)
+
+    timeout = candidate.get("timeout_seconds", candidate.get("timeoutSeconds", 30))
+    normalized: Dict[str, Any] = {
+        "method": str(candidate.get("method") or "GET").upper(),
+        "url": url,
+        "headers": headers,
+        "body": candidate.get("body"),
+        "timeoutSeconds": timeout,
+    }
+    return normalized
+
+
 def cmd_columns_list(args: argparse.Namespace, *, runtime: ColumnCommandRuntime) -> None:
     token = runtime.resolve_token(args.token, required=True)
     data = runtime.request_api(
@@ -168,6 +200,30 @@ def cmd_columns_projections(args: argparse.Namespace, *, runtime: ColumnCommandR
     runtime.print_json(data, args.compact)
 
 
+def cmd_columns_test_http_request(args: argparse.Namespace, *, runtime: ColumnCommandRuntime) -> None:
+    token = runtime.resolve_token(args.token, required=True)
+    payload = runtime.load_json_input(
+        inline_json=args.data_json,
+        file_path=args.data_file,
+        context="data",
+        default=None,
+    )
+    if not isinstance(payload, dict):
+        print("ERROR: HTTP request preview requires --data-json/--data-file with a JSON object", file=sys.stderr)
+        sys.exit(2)
+    data = runtime.request_api(
+        "POST",
+        f"/api/tables/{args.table_id}/test-http-request",
+        base_url=args.base_url,
+        token=token,
+        use_x_api_key=args.use_x_api_key,
+        payload=_normalize_http_request_test_payload(payload),
+        timeout=args.timeout,
+        verbose=args.verbose,
+    )
+    runtime.print_json(data, args.compact)
+
+
 def cmd_columns_run(args: argparse.Namespace, *, runtime: ColumnCommandRuntime) -> None:
     token = runtime.resolve_token(args.token, required=True)
     payload = runtime.normalize_run_payload(args)
@@ -317,6 +373,34 @@ def register_columns_subcommands(
     add_api_common_arguments(pcpj)
     pcpj.set_defaults(func=handlers["projections"])
 
+    pcht = col_sub.add_parser(
+        "test-http-request",
+        help="Preview an HTTP Request column against the first table row",
+        description=(
+            "Resolve and execute one HTTP request using the first row in the table.\n"
+            "This preview does not write cells.\n"
+            "Pass either a full http_request column payload or a direct request config object."
+        ),
+        epilog=(
+            "Recommended flow:\n\n"
+            "autotouch columns recipe --type http_request --out-file column.json\n"
+            "autotouch columns test-http-request --table-id <TABLE_ID> --data-file column.json\n"
+            "autotouch columns create --table-id <TABLE_ID> --data-file column.json\n\n"
+            "Template syntax:\n"
+            "- {{column_key}} -> row value from the first table row\n"
+            "- {{secrets.name}} -> workspace secret or active org integration credential by provider slug"
+        ),
+        formatter_class=argparse.RawDescriptionHelpFormatter,
+    )
+    pcht.add_argument("--table-id", required=True)
+    pcht.add_argument("--data-json", help="HTTP request column payload JSON or direct preview payload JSON")
+    pcht.add_argument("--data-file", help="HTTP request column payload file path or direct preview payload file path")
+    add_api_common_arguments(pcht)
+    pcht.set_defaults(func=handlers["test_http_request"])
+    pcht._codex_examples = [
+        "autotouch columns test-http-request --table-id <TABLE_ID> --data-file column.json",
+    ]
+
     pcr = col_sub.add_parser("run", help="Run a column")
     pcr.add_argument("--table-id", required=True)
     pcr.add_argument("--column-id", required=True)

autotouch_cli-0.2.42/autotouch_cli/commands/workspace_secrets.py

@@ -0,0 +1,176 @@
+from __future__ import annotations
+
+import argparse
+import sys
+from dataclasses import dataclass
+from typing import Any, Callable, Dict, Optional, Sequence
+
+
+@dataclass(frozen=True)
+class WorkspaceSecretCommandRuntime:
+    resolve_token: Callable[[Optional[str], bool], Optional[str]]
+    request_api: Callable[..., Any]
+    print_json: Callable[[Any, bool], None]
+    load_json_input: Callable[..., Any]
+    normalize_string_value: Callable[[Any], str]
+
+
+def _normalize_secret_name(name: Any) -> str:
+    normalized = str(name or "").strip().lower()
+    if not normalized:
+        print("ERROR: workspace secret name is required", file=sys.stderr)
+        sys.exit(2)
+    return normalized
+
+
+def _build_workspace_secret_payload(
+    args: argparse.Namespace,
+    *,
+    runtime: WorkspaceSecretCommandRuntime,
+) -> Dict[str, Any]:
+    payload = runtime.load_json_input(
+        inline_json=getattr(args, "data_json", None),
+        file_path=getattr(args, "data_file", None),
+        context="data",
+        default=None,
+    )
+    if payload is not None:
+        if not isinstance(payload, dict):
+            print("ERROR: workspace-secrets set payload must be a JSON object", file=sys.stderr)
+            sys.exit(2)
+    else:
+        payload = {
+            "name": _normalize_secret_name(getattr(args, "name", None)),
+            "value": runtime.normalize_string_value(getattr(args, "value", None)),
+        }
+
+    name = _normalize_secret_name(payload.get("name"))
+    value = runtime.normalize_string_value(payload.get("value"))
+    if not value:
+        print("ERROR: workspace secret value is required", file=sys.stderr)
+        sys.exit(2)
+    return {
+        "name": name,
+        "value": value,
+    }
+
+
+def cmd_workspace_secrets_list(
+    args: argparse.Namespace,
+    *,
+    runtime: WorkspaceSecretCommandRuntime,
+) -> None:
+    token = runtime.resolve_token(args.token, required=True)
+    data = runtime.request_api(
+        "GET",
+        "/api/workspace-secrets",
+        base_url=args.base_url,
+        token=token,
+        use_x_api_key=args.use_x_api_key,
+        timeout=args.timeout,
+        verbose=args.verbose,
+    )
+    runtime.print_json(data, args.compact)
+
+
+def cmd_workspace_secrets_set(
+    args: argparse.Namespace,
+    *,
+    runtime: WorkspaceSecretCommandRuntime,
+) -> None:
+    token = runtime.resolve_token(args.token, required=True)
+    payload = _build_workspace_secret_payload(args, runtime=runtime)
+    data = runtime.request_api(
+        "POST",
+        "/api/workspace-secrets",
+        base_url=args.base_url,
+        token=token,
+        use_x_api_key=args.use_x_api_key,
+        payload=payload,
+        timeout=args.timeout,
+        verbose=args.verbose,
+    )
+    runtime.print_json(data, args.compact)
+
+
+def cmd_workspace_secrets_delete(
+    args: argparse.Namespace,
+    *,
+    runtime: WorkspaceSecretCommandRuntime,
+) -> None:
+    if not getattr(args, "yes", False):
+        print(
+            "ERROR: workspace secret delete is destructive. Re-run with --yes to confirm.",
+            file=sys.stderr,
+        )
+        sys.exit(2)
+
+    token = runtime.resolve_token(args.token, required=True)
+    secret_name = _normalize_secret_name(getattr(args, "name", None))
+    data = runtime.request_api(
+        "DELETE",
+        f"/api/workspace-secrets/{secret_name}",
+        base_url=args.base_url,
+        token=token,
+        use_x_api_key=args.use_x_api_key,
+        timeout=args.timeout,
+        verbose=args.verbose,
+    )
+    runtime.print_json(data, args.compact)
+
+
+def register_workspace_secrets_subcommands(
+    subparsers: argparse._SubParsersAction[argparse.ArgumentParser],
+    *,
+    add_api_common_arguments: Callable[[argparse.ArgumentParser], None],
+    add_output_formatting_arguments: Callable[[argparse.ArgumentParser], None],
+    handlers: Dict[str, Callable[[argparse.Namespace], None]],
+    workspace_secret_schema_types: Sequence[str],
+) -> None:
+    pws = subparsers.add_parser(
+        "workspace-secrets",
+        help="Manage reusable org-scoped secrets for HTTP request columns",
+        description=(
+            "Manage reusable org-scoped secrets used by {{secrets.name}} templates in HTTP request columns "
+            "and other templated features."
+        ),
+        epilog=(
+            "Developer API keys need secrets:read / secrets:write scopes (or *) for these endpoints.\n"
+            "Workspace secrets are optional; HTTP request columns can still use literal headers/body values."
+        ),
+        formatter_class=argparse.RawDescriptionHelpFormatter,
+    )
+    pws._codex_examples = [
+        "autotouch workspace-secrets set --name clearbit --value \"$CLEARBIT_API_KEY\"",
+        "autotouch workspace-secrets list",
+        "autotouch workspace-secrets delete --name clearbit --yes",
+    ]
+    ws_sub = pws.add_subparsers(dest="workspace_secret_cmd", required=True)
+
+    pwsl = ws_sub.add_parser("list", help="List workspace secrets (masked values)")
+    add_api_common_arguments(pwsl)
+    pwsl.set_defaults(func=handlers["list"])
+
+    pwss = ws_sub.add_parser(
+        "set",
+        help="Create or update a workspace secret",
+        description="Create or update a workspace secret used by {{secrets.name}} template references.",
+    )
+    pwss.add_argument("--name", help="Secret/provider slug, for example clearbit")
+    pwss.add_argument("--value", help="Secret value (for example an API key or bearer token)")
+    pwss.add_argument("--data-json", help="Explicit workspace secret payload JSON")
+    pwss.add_argument("--data-file", help="Path to workspace secret payload JSON file")
+    add_api_common_arguments(pwss)
+    pwss.set_defaults(func=handlers["set"])
+
+    pwsd = ws_sub.add_parser("delete", help="Delete a workspace secret")
+    pwsd.add_argument("--name", required=True, help="Secret/provider slug to delete")
+    pwsd.add_argument("--yes", action="store_true", help="Confirm deletion")
+    add_api_common_arguments(pwsd)
+    pwsd.set_defaults(func=handlers["delete"])
+
+    pwsschema = ws_sub.add_parser("schema", help="Print workspace-secrets payload schemas")
+    pwsschema.add_argument("--type", choices=["all", *workspace_secret_schema_types], default="all")
+    pwsschema.add_argument("--out-file", help="Write schema JSON to file")
+    add_output_formatting_arguments(pwsschema)
+    pwsschema.set_defaults(func=handlers["schema"])

{autotouch_cli-0.2.41 → autotouch_cli-0.2.42}/autotouch_cli/data/CLI_REFERENCE.md

@@ -1,6 +1,6 @@
 # Autotouch CLI Reference
 
-Generated from the installed parser for `autotouch-cli` `0.2.41`.
+Generated from the installed parser for `autotouch-cli` `0.2.42`.
 
 ## Output Modes
 
@@ -609,10 +609,10 @@ Column operations
 - Auth: `varies_by_subcommand`
 - Stability: `stable`
 - Destructive: `no`
-- Subcommands: `list, create, update, delete, projections, run, stop, run-next, estimate, recipe`
+- Subcommands: `list, create, update, delete, projections, test-http-request, run, stop, run-next, estimate, recipe`
 - Example:
   - `autotouch columns [-h]
-                         {list,create,update,delete,projections,run,stop,run-next,estimate,recipe} ...`
+                         {list,create,update,delete,projections,test-http-request,run,stop,run-next,estimate,recipe} ...`
 
 #### `autotouch columns create`
 
@@ -815,13 +815,13 @@ Print copy-ready ColumnCreate payload templates
 - Output modes: `json, ndjson, human`
 - Example:
   - `autotouch columns recipe [-h]
-                                [--type {all,formatter,llm_enrichment,email_finder,phone_finder,lead_finder,add_to_crm,sync_to_table,add_to_sequence}]
+                                [--type {all,formatter,llm_enrichment,email_finder,phone_finder,lead_finder,add_to_crm,sync_to_table,add_to_sequence,http_request}]
                                 [--out-file OUT_FILE]
                                 [--output {json,ndjson,human}] [--compact]
                                 [--select SELECT |
                                 --json-pointer JSON_POINTER]`
 - Options:
-  - `--type` (choices=all,formatter,llm_enrichment,email_finder,phone_finder,lead_finder,add_to_crm,sync_to_table,add_to_sequence; default=all)
+  - `--type` (choices=all,formatter,llm_enrichment,email_finder,phone_finder,lead_finder,add_to_crm,sync_to_table,add_to_sequence,http_request; default=all)
   - `--out-file`: Write template JSON to file (single type writes payload only)
   - `--output` (choices=json,ndjson,human; default=json): Output mode
   - `--compact` (default=False): Print compact JSON
@@ -974,6 +974,48 @@ Stop a running column (cancel active job dispatch)
   - `--json-pointer`: Extract a JSON pointer from the final result (for example: /id)
   - `--verbose` (default=False): Print request metadata to stderr
 
+#### `autotouch columns test-http-request`
+
+Preview an HTTP Request column against the first table row
+
+Resolve and execute one HTTP request using the first row in the table.
+This preview does not write cells.
+Pass either a full http_request column payload or a direct request config object.
+
+- Auth: `developer_key_or_user_session`
+- Stability: `stable`
+- Destructive: `no`
+- Required flags: `--table-id`
+- Output modes: `json, ndjson, human`
+- Example:
+  - `autotouch columns test-http-request --table-id <TABLE_ID> --data-file column.json`
+- Notes:
+
+```text
+Recommended flow:
+
+autotouch columns recipe --type http_request --out-file column.json
+autotouch columns test-http-request --table-id <TABLE_ID> --data-file column.json
+autotouch columns create --table-id <TABLE_ID> --data-file column.json
+
+Template syntax:
+- {{column_key}} -> row value from the first table row
+- {{secrets.name}} -> workspace secret or active org integration credential by provider slug
+```
+- Options:
+  - `--table-id` (required)
+  - `--data-json`: HTTP request column payload JSON or direct preview payload JSON
+  - `--data-file`: HTTP request column payload file path or direct preview payload file path
+  - `--base-url` (default=https://app.autotouch.ai): API base URL (default: https://app.autotouch.ai)
+  - `--token`: Developer API key / JWT token
+  - `--use-x-api-key` (default=False): Send token via X-API-Key header
+  - `--timeout` (default=30): HTTP timeout in seconds
+  - `--output` (choices=json,ndjson,human; default=json): Output mode
+  - `--compact` (default=False): Print compact JSON
+  - `--select`: Extract a dotted field path from the final result (for example: id or items.0.id)
+  - `--json-pointer`: Extract a JSON pointer from the final result (for example: /id)
+  - `--verbose` (default=False): Print request metadata to stderr
+
 #### `autotouch columns update`
 
 Update a column
@@ -4742,3 +4784,141 @@ Emit one workflow blueprint payload
   - `--compact` (default=False): Print compact JSON
   - `--select`: Extract a dotted field path from the final result (for example: id or items.0.id)
   - `--json-pointer`: Extract a JSON pointer from the final result (for example: /id)
+
+### `workspace-secrets`
+
+#### `autotouch workspace-secrets`
+
+Manage reusable org-scoped secrets for HTTP request columns
+
+Manage reusable org-scoped secrets used by {{secrets.name}} templates in HTTP request columns and other templated features.
+
+- Auth: `varies_by_subcommand`
+- Stability: `stable`
+- Destructive: `no`
+- Subcommands: `list, set, delete, schema`
+- Example:
+  - `autotouch workspace-secrets set --name clearbit --value "$CLEARBIT_API_KEY"`
+  - `autotouch workspace-secrets list`
+  - `autotouch workspace-secrets delete --name clearbit --yes`
+- Notes:
+
+```text
+Developer API keys need secrets:read / secrets:write scopes (or *) for these endpoints.
+Workspace secrets are optional; HTTP request columns can still use literal headers/body values.
+```
+
+#### `autotouch workspace-secrets delete`
+
+Delete a workspace secret
+
+- Auth: `developer_key_or_user_session`
+- Stability: `stable`
+- Destructive: `yes`
+- Required flags: `--name`
+- Output modes: `json, ndjson, human`
+- Example:
+  - `autotouch workspace-secrets delete [-h] --name NAME [--yes]
+                                          [--base-url BASE_URL]
+                                          [--token TOKEN] [--use-x-api-key]
+                                          [--timeout TIMEOUT]
+                                          [--output {json,ndjson,human}]
+                                          [--compact] [--select SELECT |
+                                          --json-pointer JSON_POINTER]
+                                          [--verbose]`
+- Options:
+  - `--name` (required): Secret/provider slug to delete
+  - `--yes` (default=False): Confirm deletion
+  - `--base-url` (default=https://app.autotouch.ai): API base URL (default: https://app.autotouch.ai)
+  - `--token`: Developer API key / JWT token
+  - `--use-x-api-key` (default=False): Send token via X-API-Key header
+  - `--timeout` (default=30): HTTP timeout in seconds
+  - `--output` (choices=json,ndjson,human; default=json): Output mode
+  - `--compact` (default=False): Print compact JSON
+  - `--select`: Extract a dotted field path from the final result (for example: id or items.0.id)
+  - `--json-pointer`: Extract a JSON pointer from the final result (for example: /id)
+  - `--verbose` (default=False): Print request metadata to stderr
+
+#### `autotouch workspace-secrets list`
+
+List workspace secrets (masked values)
+
+- Auth: `developer_key_or_user_session`
+- Stability: `stable`
+- Destructive: `no`
+- Output modes: `json, ndjson, human`
+- Example:
+  - `autotouch workspace-secrets list [-h] [--base-url BASE_URL]
+                                        [--token TOKEN] [--use-x-api-key]
+                                        [--timeout TIMEOUT]
+                                        [--output {json,ndjson,human}]
+                                        [--compact] [--select SELECT |
+                                        --json-pointer JSON_POINTER]
+                                        [--verbose]`
+- Options:
+  - `--base-url` (default=https://app.autotouch.ai): API base URL (default: https://app.autotouch.ai)
+  - `--token`: Developer API key / JWT token
+  - `--use-x-api-key` (default=False): Send token via X-API-Key header
+  - `--timeout` (default=30): HTTP timeout in seconds
+  - `--output` (choices=json,ndjson,human; default=json): Output mode
+  - `--compact` (default=False): Print compact JSON
+  - `--select`: Extract a dotted field path from the final result (for example: id or items.0.id)
+  - `--json-pointer`: Extract a JSON pointer from the final result (for example: /id)
+  - `--verbose` (default=False): Print request metadata to stderr
+
+#### `autotouch workspace-secrets schema`
+
+Print workspace-secrets payload schemas
+
+- Auth: `none`
+- Stability: `stable`
+- Destructive: `no`
+- Output modes: `json, ndjson, human`
+- Example:
+  - `autotouch workspace-secrets schema [-h] [--type {all,set}]
+                                          [--out-file OUT_FILE]
+                                          [--output {json,ndjson,human}]
+                                          [--compact] [--select SELECT |
+                                          --json-pointer JSON_POINTER]`
+- Options:
+  - `--type` (choices=all,set; default=all)
+  - `--out-file`: Write schema JSON to file
+  - `--output` (choices=json,ndjson,human; default=json): Output mode
+  - `--compact` (default=False): Print compact JSON
+  - `--select`: Extract a dotted field path from the final result (for example: id or items.0.id)
+  - `--json-pointer`: Extract a JSON pointer from the final result (for example: /id)
+
+#### `autotouch workspace-secrets set`
+
+Create or update a workspace secret
+
+Create or update a workspace secret used by {{secrets.name}} template references.
+
+- Auth: `developer_key_or_user_session`
+- Stability: `stable`
+- Destructive: `no`
+- Output modes: `json, ndjson, human`
+- Example:
+  - `autotouch workspace-secrets set [-h] [--name NAME] [--value VALUE]
+                                       [--data-json DATA_JSON]
+                                       [--data-file DATA_FILE]
+                                       [--base-url BASE_URL] [--token TOKEN]
+                                       [--use-x-api-key] [--timeout TIMEOUT]
+                                       [--output {json,ndjson,human}]
+                                       [--compact] [--select SELECT |
+                                       --json-pointer JSON_POINTER]
+                                       [--verbose]`
+- Options:
+  - `--name`: Secret/provider slug, for example clearbit
+  - `--value`: Secret value (for example an API key or bearer token)
+  - `--data-json`: Explicit workspace secret payload JSON
+  - `--data-file`: Path to workspace secret payload JSON file
+  - `--base-url` (default=https://app.autotouch.ai): API base URL (default: https://app.autotouch.ai)
+  - `--token`: Developer API key / JWT token
+  - `--use-x-api-key` (default=False): Send token via X-API-Key header
+  - `--timeout` (default=30): HTTP timeout in seconds
+  - `--output` (choices=json,ndjson,human; default=json): Output mode
+  - `--compact` (default=False): Print compact JSON
+  - `--select`: Extract a dotted field path from the final result (for example: id or items.0.id)
+  - `--json-pointer`: Extract a JSON pointer from the final result (for example: /id)
+  - `--verbose` (default=False): Print request metadata to stderr