dirigent-cli 0.16.5__tar.gz → 0.16.6__tar.gz

{dirigent_cli-0.16.5 → dirigent_cli-0.16.6}/PKG-INFO

@@ -1,18 +1,18 @@
 Metadata-Version: 2.4
 Name: dirigent-cli
-Version: 0.16.5
+Version: 0.16.6
 Summary: The dirigent command line interface (dirigent / dg).
 License-Expression: LicenseRef-Proprietary
 License-File: LICENSE
 Classifier: Programming Language :: Python :: 3
 Classifier: Programming Language :: Python :: 3.13
-Requires-Dist: dirigent-blocks==0.16.5
-Requires-Dist: dirigent-client==0.16.5
-Requires-Dist: dirigent-common==0.16.5
-Requires-Dist: dirigent-core==0.16.5
-Requires-Dist: dirigent-examples==0.16.5
-Requires-Dist: dirigent-plugin==0.16.5
-Requires-Dist: dirigent-server==0.16.5
+Requires-Dist: dirigent-blocks==0.16.6
+Requires-Dist: dirigent-client==0.16.6
+Requires-Dist: dirigent-common==0.16.6
+Requires-Dist: dirigent-core==0.16.6
+Requires-Dist: dirigent-examples==0.16.6
+Requires-Dist: dirigent-plugin==0.16.6
+Requires-Dist: dirigent-server==0.16.6
 Requires-Dist: httpx2>=2.12.0
 Requires-Dist: python-dotenv>=1.1.0
 Requires-Dist: pyyaml>=6.0.3

{dirigent_cli-0.16.5 → dirigent_cli-0.16.6}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "dirigent-cli"
-version = "0.16.5"
+version = "0.16.6"
 description = "The dirigent command line interface (dirigent / dg)."
 readme = "README.md"
 requires-python = ">=3.13"
@@ -11,13 +11,13 @@ classifiers = [
     "Programming Language :: Python :: 3.13",
 ]
 dependencies = [
-    "dirigent-blocks==0.16.5",
-    "dirigent-client==0.16.5",
-    "dirigent-common==0.16.5",
-    "dirigent-core==0.16.5",
-    "dirigent-examples==0.16.5",
-    "dirigent-plugin==0.16.5",
-    "dirigent-server==0.16.5",
+    "dirigent-blocks==0.16.6",
+    "dirigent-client==0.16.6",
+    "dirigent-common==0.16.6",
+    "dirigent-core==0.16.6",
+    "dirigent-examples==0.16.6",
+    "dirigent-plugin==0.16.6",
+    "dirigent-server==0.16.6",
     "httpx2>=2.12.0",
     "python-dotenv>=1.1.0",
     "pyyaml>=6.0.3",

{dirigent_cli-0.16.5 → dirigent_cli-0.16.6}/pyproject.toml.orig

@@ -1,6 +1,6 @@
 [project]
 name = "dirigent-cli"
-version = "0.16.5"
+version = "0.16.6"
 description = "The dirigent command line interface (dirigent / dg)."
 readme = "README.md"
 requires-python = ">=3.13"
@@ -11,13 +11,13 @@ classifiers = [
     "Programming Language :: Python :: 3.13",
 ]
 dependencies = [
-    "dirigent-blocks==0.16.5",
-    "dirigent-client==0.16.5",
-    "dirigent-common==0.16.5",
-    "dirigent-core==0.16.5",
-    "dirigent-examples==0.16.5",
-    "dirigent-plugin==0.16.5",
-    "dirigent-server==0.16.5",
+    "dirigent-blocks==0.16.6",
+    "dirigent-client==0.16.6",
+    "dirigent-common==0.16.6",
+    "dirigent-core==0.16.6",
+    "dirigent-examples==0.16.6",
+    "dirigent-plugin==0.16.6",
+    "dirigent-server==0.16.6",
     "httpx2>=2.12.0",
     "python-dotenv>=1.1.0",
     "pyyaml>=6.0.3",

{dirigent_cli-0.16.5 → dirigent_cli-0.16.6}/src/dirigent_cli/commands.py

@@ -62,7 +62,7 @@ from dirigent_cli.project import (
     check_choices,
     find_project,
     scaffold,
-    write_token_env,
+    write_instance_env,
 )
 from dirigent_cli.scaffold import ScaffoldedRecord, ScaffoldError, ScaffoldRecord, scaffold_pack
 from dirigent_cli.sources import (
@@ -537,9 +537,10 @@ def init_command(
     stack's services, packs, and the first admin. The flags answer the same questions for a
     script. `--template local` writes the documents and a `pyproject.toml` pinning the running
     dirigent, then creates the state directory, migrates the schema, creates the first admin
-    and mints it a token, kept in `.env`. `--template compose` writes the documents and a
-    container stack instead, and initialises nothing locally: the instance is the containers.
-    `--template documents` writes the documents alone, against an instance somebody else runs.
+    and mints it a token and a secret key, both kept in `.env`. `--template compose` writes the
+    documents and a container stack instead, and initialises nothing locally: the instance is
+    the containers. `--template documents` writes the documents alone, against an instance
+    somebody else runs.
     """
     import asyncio
 
@@ -616,7 +617,7 @@ def init_command(
     migrated = migrations.head_revision(settings) or "none"
     migrations.upgrade("head", settings)
     token = asyncio.run(first_admin(settings, choices.admin, choices.password))
-    env_file = write_token_env(root, token)
+    env_file = write_instance_env(root, token)
     emit_fact(
         "instance.initialised",
         message="initialised",

{dirigent_cli-0.16.5 → dirigent_cli-0.16.6}/src/dirigent_cli/project.py

@@ -821,14 +821,18 @@ ROOT_IGNORE_TEMPLATE = """\
 .venv/
 __pycache__/
 
-# This instance's token, or the stack's key and first password. Never shared.
+# This instance's token and key, or the stack's key and first password. Never shared.
 .env
 """
 
-TOKEN_ENV_TEMPLATE = """\
+INSTANCE_ENV_TEMPLATE = """\
 # The token dg init minted for this instance's first admin. The local profile in
 # .dirigent/profiles.yaml reads it from here when the shell does not export it.
 DG_TOKEN=__TOKEN__
+
+# The key this instance seals connection secrets with, read by every command run in this
+# directory. What is stored under it cannot be opened under another one.
+DIRIGENT_SECRET_KEY=__SECRET_KEY__
 """
 
 PYPROJECT_TEMPLATE = """\
@@ -923,9 +927,10 @@ def scaffold(directory: Path, choices: InitChoices, *, version: str = "0.0.0") -
     return Scaffolded(files=written, skipped=skipped)
 
 
-def write_token_env(directory: Path, token: str) -> Path:
-    """Write the ``.env`` holding a new instance's token, readable by its owner alone."""
-    return _write(directory / ".env", TOKEN_ENV_TEMPLATE.replace("__TOKEN__", token), mode=0o600)
+def write_instance_env(directory: Path, token: str) -> Path:
+    """Write the ``.env`` holding a new instance's token and key, readable by its owner alone."""
+    document = INSTANCE_ENV_TEMPLATE.replace("__TOKEN__", token).replace("__SECRET_KEY__", _an_instance_key())
+    return _write(directory / ".env", document, mode=0o600)
 
 
 def _record(path: Path, content: str, written: list[Path], skipped: list[Path]) -> None:
@@ -953,7 +958,7 @@ def _merge_ignore(path: Path, content: str, written: list[Path], skipped: list[P
 
 
 def _an_instance_key() -> str:
-    """Generate the key the stack seals connection secrets with."""
+    """Generate the key an instance seals connection secrets with."""
     return generate_key()
 
 

{dirigent_cli-0.16.5 → dirigent_cli-0.16.6}/src/dirigent_cli/summaries.py

@@ -316,7 +316,9 @@ def _initialised(record: Record) -> RenderableType | None:
         "\n  [bold]uv run dg examples list --starter[/]"
         "\n  [bold]uv run dg pipeline new <starter>[/]"
         "\n  [bold]uv run dg apply[/]"
-        "\n\n[dim]No DIRIGENT_SECRET_KEY is set, so a connection carrying a credential cannot be stored until it is.[/]"
+        "\n\n[dim]DIRIGENT_SECRET_KEY is in .env beside it, and every command run in"
+        "\nthis directory reads it: it is what connection secrets are sealed with, and"
+        "\nunder another key the instance cannot open what it stored.[/]"
     )
     return Group(*parts)