gravity-cli 0.4.0__tar.gz → 0.4.2__tar.gz

gravity_cli-0.4.0/README.md → gravity_cli-0.4.2/PKG-INFO

@@ -1,3 +1,20 @@
+Metadata-Version: 2.5
+Name: gravity-cli
+Version: 0.4.2
+Summary: gravity cli — init, run, and push python agents to the Gravity marketplace
+License-Expression: Apache-2.0
+License-File: LICENSE
+License-File: NOTICE
+Requires-Python: >=3.12
+Requires-Dist: gravity-schema==0.4.2
+Requires-Dist: httpx>=0.27.0
+Requires-Dist: keyring>=25.0.0
+Requires-Dist: python-dotenv>=1.0.0
+Requires-Dist: rich>=13.9.0
+Requires-Dist: typer>=0.15.0
+Requires-Dist: uv>=0.8.0
+Description-Content-Type: text/markdown
+
 <h1 align="center">Gravity CLI</h1>
 
 <p align="center">
@@ -625,7 +642,7 @@ outputs:                          # extra formats the platform renders and deliv
 | `runtime.timeout_seconds` | no | `300` | 10 to 28800. |
 | `dependencies.lockfile` | no | `requirements.lock` | Compiled by `gravity validate`; ships with the agent. |
 | `inputs[]` | no | none | Up to 50. Each has `name` (a lowercase identifier, the key in `state["inputs"]`), `type`, `label`, and optionally `required`, `default`, `options`, `accept`. |
-| `inputs[].type` | **yes** | | `text`, `textarea`, `number`, `boolean`, `static-dropdown` (needs `options`), `email`, `url`, `date` or `file` (no `default`; `accept` lists extensions such as `[pdf, csv]`). |
+| `inputs[].type` | **yes** | | `text`, `textarea`, `number`, `boolean`, `static-dropdown` (needs `options`), `email`, `url`, `date`, `secret` (an API key or password: masked, sealed with KMS, never shown back; no `default`) or `file` (no `default`; `accept` lists extensions such as `[pdf, csv]`). |
 | `permissions.tools` | no | none | Up to 50 catalog names, such as `gmail.read`. Run `gravity tools` for the list. |
 | `permissions.models.tier` | no | `standard` | `standard` or `premium`. |
 | `approvals.required_for` | no | none | Tools that pause until a person approves. Each must also be declared under `permissions.tools` or a slot adapter. |
@@ -639,6 +656,27 @@ outputs:                          # extra formats the platform renders and deliv
 
 Unknown fields are rejected rather than ignored, so a typo is reported instead of silently dropped.
 
+### Secret inputs
+
+**API keys and passwords: use `type: secret`**, never `text`. The user types it into a masked box;
+the platform seals it with AWS KMS the moment it is submitted, keeps it out of every API response,
+log and stored checkpoint, and decrypts it only to hand it to your running agent as
+`state["inputs"]["<name>"]`, exactly like any other input. A secret input cannot have a `default`,
+holds at most 4096 bytes, and is meant for the user's own credential for a service your agent
+calls (their Supadata or Notion key), not for a key of yours: yours never goes in the agent or its
+manifest. Two rules for your code: don't put the key in `result` or `corpus` (they are shown
+to the user and stored in clear), and don't copy it into your own objects or logs: the platform
+can hide it in the state it checkpoints, not wherever your code sends it. When the user schedules
+the agent, they re-enter the key to change it; it is never shown back.
+
+```yaml
+inputs:
+  - name: supadata_api_key
+    type: secret
+    label: "Your Supadata API key"
+    required: true
+```
+
 ## An agent project
 
 ```
@@ -712,6 +750,11 @@ Real tools act on a connected account. Connect one with `gravity-gateway connect
 | `✗ requirements.lock` in `gravity validate` | A dependency has no prebuilt package for the platform image (ARM64 Linux). Pick a version that publishes one, or a different package. |
 | A tool row shows `refused — not in permissions.tools` | The agent called a tool its manifest does not declare. Add it under `permissions.tools`, then run again. |
 
+## What's new
+
+- **0.4.2** Documents `type: secret` (below) and the `supadata.get_transcript` tool.
+- **0.4.1** `type: secret` inputs: API keys and passwords the user enters are sealed with AWS KMS on the platform, never shown back, and handed only to the running agent. New built-in tool `supadata.get_transcript` (`gravity tools supadata`).
+
 ## Limitations
 
 - **No offline mode.** `gravity run` always talks to a real gateway. There is no mock-tool mode.

gravity_cli-0.4.0/PKG-INFO → gravity_cli-0.4.2/README.md

@@ -1,20 +1,3 @@
-Metadata-Version: 2.5
-Name: gravity-cli
-Version: 0.4.0
-Summary: gravity cli — init, run, and push python agents to the Gravity marketplace
-License-Expression: Apache-2.0
-License-File: LICENSE
-License-File: NOTICE
-Requires-Python: >=3.12
-Requires-Dist: gravity-schema==0.4.0
-Requires-Dist: httpx>=0.27.0
-Requires-Dist: keyring>=25.0.0
-Requires-Dist: python-dotenv>=1.0.0
-Requires-Dist: rich>=13.9.0
-Requires-Dist: typer>=0.15.0
-Requires-Dist: uv>=0.8.0
-Description-Content-Type: text/markdown
-
 <h1 align="center">Gravity CLI</h1>
 
 <p align="center">
@@ -642,7 +625,7 @@ outputs:                          # extra formats the platform renders and deliv
 | `runtime.timeout_seconds` | no | `300` | 10 to 28800. |
 | `dependencies.lockfile` | no | `requirements.lock` | Compiled by `gravity validate`; ships with the agent. |
 | `inputs[]` | no | none | Up to 50. Each has `name` (a lowercase identifier, the key in `state["inputs"]`), `type`, `label`, and optionally `required`, `default`, `options`, `accept`. |
-| `inputs[].type` | **yes** | | `text`, `textarea`, `number`, `boolean`, `static-dropdown` (needs `options`), `email`, `url`, `date` or `file` (no `default`; `accept` lists extensions such as `[pdf, csv]`). |
+| `inputs[].type` | **yes** | | `text`, `textarea`, `number`, `boolean`, `static-dropdown` (needs `options`), `email`, `url`, `date`, `secret` (an API key or password: masked, sealed with KMS, never shown back; no `default`) or `file` (no `default`; `accept` lists extensions such as `[pdf, csv]`). |
 | `permissions.tools` | no | none | Up to 50 catalog names, such as `gmail.read`. Run `gravity tools` for the list. |
 | `permissions.models.tier` | no | `standard` | `standard` or `premium`. |
 | `approvals.required_for` | no | none | Tools that pause until a person approves. Each must also be declared under `permissions.tools` or a slot adapter. |
@@ -656,6 +639,27 @@ outputs:                          # extra formats the platform renders and deliv
 
 Unknown fields are rejected rather than ignored, so a typo is reported instead of silently dropped.
 
+### Secret inputs
+
+**API keys and passwords: use `type: secret`**, never `text`. The user types it into a masked box;
+the platform seals it with AWS KMS the moment it is submitted, keeps it out of every API response,
+log and stored checkpoint, and decrypts it only to hand it to your running agent as
+`state["inputs"]["<name>"]`, exactly like any other input. A secret input cannot have a `default`,
+holds at most 4096 bytes, and is meant for the user's own credential for a service your agent
+calls (their Supadata or Notion key), not for a key of yours: yours never goes in the agent or its
+manifest. Two rules for your code: don't put the key in `result` or `corpus` (they are shown
+to the user and stored in clear), and don't copy it into your own objects or logs: the platform
+can hide it in the state it checkpoints, not wherever your code sends it. When the user schedules
+the agent, they re-enter the key to change it; it is never shown back.
+
+```yaml
+inputs:
+  - name: supadata_api_key
+    type: secret
+    label: "Your Supadata API key"
+    required: true
+```
+
 ## An agent project
 
 ```
@@ -729,6 +733,11 @@ Real tools act on a connected account. Connect one with `gravity-gateway connect
 | `✗ requirements.lock` in `gravity validate` | A dependency has no prebuilt package for the platform image (ARM64 Linux). Pick a version that publishes one, or a different package. |
 | A tool row shows `refused — not in permissions.tools` | The agent called a tool its manifest does not declare. Add it under `permissions.tools`, then run again. |
 
+## What's new
+
+- **0.4.2** Documents `type: secret` (below) and the `supadata.get_transcript` tool.
+- **0.4.1** `type: secret` inputs: API keys and passwords the user enters are sealed with AWS KMS on the platform, never shown back, and handed only to the running agent. New built-in tool `supadata.get_transcript` (`gravity tools supadata`).
+
 ## Limitations
 
 - **No offline mode.** `gravity run` always talks to a real gateway. There is no mock-tool mode.

gravity_cli-0.4.2/dist-schema/.gitignore

@@ -0,0 +1 @@
+*

{gravity_cli-0.4.0 → gravity_cli-0.4.2}/packages/gravity-schema/gravity_schema/catalog.yaml

@@ -27,6 +27,14 @@
   guarantee: certified
   side_effect: read
 
+- name: supadata.get_transcript
+  slug: null
+  description: fetch the transcript of a YouTube video with the caller's own Supadata API key (api_key argument)
+  scopes: []
+  breadth: niche
+  guarantee: certified
+  side_effect: read
+
 - name: gmail.read
   slug: GMAIL_FETCH_EMAILS
   description: read the connected Gmail inbox

{gravity_cli-0.4.0 → gravity_cli-0.4.2}/packages/gravity-schema/gravity_schema/manifest.py

@@ -26,6 +26,9 @@ class InputType(str, Enum):
     EMAIL = "email"
     URL = "url"
     DATE = "date"
+    # An API key or password. The platform seals it with KMS when it is submitted, keeps it
+    # out of every API response and log, and opens it only to hand it to the running agent.
+    SECRET = "secret"
     # The agent gets a short-lived URL it fetches through the gateway.
     FILE = "file"
 
@@ -40,6 +43,7 @@ _PYTHON_TYPES: dict[InputType, tuple[type, ...]] = {
     InputType.EMAIL: (str,),
     InputType.URL: (str,),
     InputType.DATE: (str,),
+    InputType.SECRET: (str,),
     InputType.FILE: (),  # never has a default
 }
 
@@ -254,6 +258,16 @@ class InputSpec(BaseModel):
                 },
             )
 
+        if self.type is InputType.SECRET:
+            raise PydanticCustomError(
+                ErrorCode.INVALID_INPUT.value,
+                "Secret input '{value}' cannot have a default.",
+                {
+                    "value": self.name,
+                    "remediation": "Remove the default; the consumer enters the secret for each run or schedule.",
+                },
+            )
+
         expected = _PYTHON_TYPES[self.type]
         # bool is an int subclass, so NUMBER needs this guard.
         is_bool = isinstance(self.default, bool)

{gravity_cli-0.4.0 → gravity_cli-0.4.2}/packages/gravity-schema/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "gravity-schema"
-version = "0.4.0"
+version = "0.4.2"
 description = "Gravity agent manifest contract — models, validation, and JSON Schema export"
 readme = "README.md"
 license = "Apache-2.0"

{gravity_cli-0.4.0 → gravity_cli-0.4.2}/packages/gravity-schema/schema/manifest.schema.json

@@ -122,6 +122,7 @@
         "email",
         "url",
         "date",
+        "secret",
         "file"
       ],
       "title": "InputType",

{gravity_cli-0.4.0 → gravity_cli-0.4.2}/pyproject.toml

@@ -1,13 +1,13 @@
 [project]
 name = "gravity-cli"
-version = "0.4.0"
+version = "0.4.2"
 description = "gravity cli — init, run, and push python agents to the Gravity marketplace"
 readme = "README.md"
 license = "Apache-2.0"
 license-files = ["LICENSE", "NOTICE"]
 requires-python = ">=3.12"
 dependencies = [
-    "gravity-schema==0.4.0",  # released in lockstep: always the same version as this package
+    "gravity-schema==0.4.2",  # released in lockstep: always the same version as this package
     "typer>=0.15.0",
     "httpx>=0.27.0",
     "rich>=13.9.0",

{gravity_cli-0.4.0 → gravity_cli-0.4.2}/src/gravity_cli/BUILDER_GUIDE.md

@@ -81,7 +81,7 @@ dependencies:
 
 inputs:                             # becomes the user's form; arrives as state["inputs"]
   - name: send_to
-    type: email                     # text | textarea | number | boolean | static-dropdown | email | url | date | file
+    type: email                     # text | textarea | number | boolean | static-dropdown | email | url | date | secret | file
     label: "Where to send the digest"
     required: true
 
@@ -127,6 +127,17 @@ keeps the digest as a draft for the user to send. That's why the fallback in §3
 Other input fields you can use: `default:` (a value if the user leaves it blank; not for `file`),
 `options: [a, b]` (for `static-dropdown`), `accept: [pdf, csv]` (for `file`).
 
+**API keys and passwords: use `type: secret`**, never `text`. The user types it into a masked box;
+the platform seals it with AWS KMS the moment it is submitted, keeps it out of every API response,
+log and stored checkpoint, and decrypts it only to hand it to your running agent as
+`state["inputs"]["<name>"]`, exactly like any other input. A secret input cannot have a `default`,
+holds at most 4096 bytes, and is meant for the user's own credential for a service your agent
+calls (their Supadata or Notion key), not for a key of yours: yours never goes in the agent or its
+manifest. Two rules for your code: don't put the key in `result` or `corpus` (they are shown
+to the user and stored in clear), and don't copy it into your own objects or logs: the platform
+can hide it in the state it checkpoints, not wherever your code sends it. When the user schedules
+the agent, they re-enter the key to change it; it is never shown back.
+
 ### 3.2 `requirements.txt`
 
 ```

{gravity_cli-0.4.0 → gravity_cli-0.4.2}/uv.lock

@@ -164,7 +164,7 @@ wheels = [
 
 [[package]]
 name = "gravity-cli"
-version = "0.4.0"
+version = "0.4.2"
 source = { editable = "." }
 dependencies = [
     { name = "gravity-schema" },
@@ -201,7 +201,7 @@ dev = [
 
 [[package]]
 name = "gravity-schema"
-version = "0.4.0"
+version = "0.4.2"
 source = { editable = "packages/gravity-schema" }
 dependencies = [
     { name = "pydantic" },