gravity-cli 0.4.1__tar.gz → 0.4.2__tar.gz

gravity_cli-0.4.1/README.md → gravity_cli-0.4.2/PKG-INFO

@@ -1,3 +1,20 @@
+Metadata-Version: 2.5
+Name: gravity-cli
+Version: 0.4.2
+Summary: gravity cli — init, run, and push python agents to the Gravity marketplace
+License-Expression: Apache-2.0
+License-File: LICENSE
+License-File: NOTICE
+Requires-Python: >=3.12
+Requires-Dist: gravity-schema==0.4.2
+Requires-Dist: httpx>=0.27.0
+Requires-Dist: keyring>=25.0.0
+Requires-Dist: python-dotenv>=1.0.0
+Requires-Dist: rich>=13.9.0
+Requires-Dist: typer>=0.15.0
+Requires-Dist: uv>=0.8.0
+Description-Content-Type: text/markdown
+
 <h1 align="center">Gravity CLI</h1>
 
 <p align="center">
@@ -625,7 +642,7 @@ outputs:                          # extra formats the platform renders and deliv
 | `runtime.timeout_seconds` | no | `300` | 10 to 28800. |
 | `dependencies.lockfile` | no | `requirements.lock` | Compiled by `gravity validate`; ships with the agent. |
 | `inputs[]` | no | none | Up to 50. Each has `name` (a lowercase identifier, the key in `state["inputs"]`), `type`, `label`, and optionally `required`, `default`, `options`, `accept`. |
-| `inputs[].type` | **yes** | | `text`, `textarea`, `number`, `boolean`, `static-dropdown` (needs `options`), `email`, `url`, `date` or `file` (no `default`; `accept` lists extensions such as `[pdf, csv]`). |
+| `inputs[].type` | **yes** | | `text`, `textarea`, `number`, `boolean`, `static-dropdown` (needs `options`), `email`, `url`, `date`, `secret` (an API key or password: masked, sealed with KMS, never shown back; no `default`) or `file` (no `default`; `accept` lists extensions such as `[pdf, csv]`). |
 | `permissions.tools` | no | none | Up to 50 catalog names, such as `gmail.read`. Run `gravity tools` for the list. |
 | `permissions.models.tier` | no | `standard` | `standard` or `premium`. |
 | `approvals.required_for` | no | none | Tools that pause until a person approves. Each must also be declared under `permissions.tools` or a slot adapter. |
@@ -639,6 +656,27 @@ outputs:                          # extra formats the platform renders and deliv
 
 Unknown fields are rejected rather than ignored, so a typo is reported instead of silently dropped.
 
+### Secret inputs
+
+**API keys and passwords: use `type: secret`**, never `text`. The user types it into a masked box;
+the platform seals it with AWS KMS the moment it is submitted, keeps it out of every API response,
+log and stored checkpoint, and decrypts it only to hand it to your running agent as
+`state["inputs"]["<name>"]`, exactly like any other input. A secret input cannot have a `default`,
+holds at most 4096 bytes, and is meant for the user's own credential for a service your agent
+calls (their Supadata or Notion key), not for a key of yours: yours never goes in the agent or its
+manifest. Two rules for your code: don't put the key in `result` or `corpus` (they are shown
+to the user and stored in clear), and don't copy it into your own objects or logs: the platform
+can hide it in the state it checkpoints, not wherever your code sends it. When the user schedules
+the agent, they re-enter the key to change it; it is never shown back.
+
+```yaml
+inputs:
+  - name: supadata_api_key
+    type: secret
+    label: "Your Supadata API key"
+    required: true
+```
+
 ## An agent project
 
 ```
@@ -712,6 +750,11 @@ Real tools act on a connected account. Connect one with `gravity-gateway connect
 | `✗ requirements.lock` in `gravity validate` | A dependency has no prebuilt package for the platform image (ARM64 Linux). Pick a version that publishes one, or a different package. |
 | A tool row shows `refused — not in permissions.tools` | The agent called a tool its manifest does not declare. Add it under `permissions.tools`, then run again. |
 
+## What's new
+
+- **0.4.2** Documents `type: secret` (below) and the `supadata.get_transcript` tool.
+- **0.4.1** `type: secret` inputs: API keys and passwords the user enters are sealed with AWS KMS on the platform, never shown back, and handed only to the running agent. New built-in tool `supadata.get_transcript` (`gravity tools supadata`).
+
 ## Limitations
 
 - **No offline mode.** `gravity run` always talks to a real gateway. There is no mock-tool mode.

gravity_cli-0.4.1/PKG-INFO → gravity_cli-0.4.2/README.md

@@ -1,20 +1,3 @@
-Metadata-Version: 2.5
-Name: gravity-cli
-Version: 0.4.1
-Summary: gravity cli — init, run, and push python agents to the Gravity marketplace
-License-Expression: Apache-2.0
-License-File: LICENSE
-License-File: NOTICE
-Requires-Python: >=3.12
-Requires-Dist: gravity-schema==0.4.1
-Requires-Dist: httpx>=0.27.0
-Requires-Dist: keyring>=25.0.0
-Requires-Dist: python-dotenv>=1.0.0
-Requires-Dist: rich>=13.9.0
-Requires-Dist: typer>=0.15.0
-Requires-Dist: uv>=0.8.0
-Description-Content-Type: text/markdown
-
 <h1 align="center">Gravity CLI</h1>
 
 <p align="center">
@@ -642,7 +625,7 @@ outputs:                          # extra formats the platform renders and deliv
 | `runtime.timeout_seconds` | no | `300` | 10 to 28800. |
 | `dependencies.lockfile` | no | `requirements.lock` | Compiled by `gravity validate`; ships with the agent. |
 | `inputs[]` | no | none | Up to 50. Each has `name` (a lowercase identifier, the key in `state["inputs"]`), `type`, `label`, and optionally `required`, `default`, `options`, `accept`. |
-| `inputs[].type` | **yes** | | `text`, `textarea`, `number`, `boolean`, `static-dropdown` (needs `options`), `email`, `url`, `date` or `file` (no `default`; `accept` lists extensions such as `[pdf, csv]`). |
+| `inputs[].type` | **yes** | | `text`, `textarea`, `number`, `boolean`, `static-dropdown` (needs `options`), `email`, `url`, `date`, `secret` (an API key or password: masked, sealed with KMS, never shown back; no `default`) or `file` (no `default`; `accept` lists extensions such as `[pdf, csv]`). |
 | `permissions.tools` | no | none | Up to 50 catalog names, such as `gmail.read`. Run `gravity tools` for the list. |
 | `permissions.models.tier` | no | `standard` | `standard` or `premium`. |
 | `approvals.required_for` | no | none | Tools that pause until a person approves. Each must also be declared under `permissions.tools` or a slot adapter. |
@@ -656,6 +639,27 @@ outputs:                          # extra formats the platform renders and deliv
 
 Unknown fields are rejected rather than ignored, so a typo is reported instead of silently dropped.
 
+### Secret inputs
+
+**API keys and passwords: use `type: secret`**, never `text`. The user types it into a masked box;
+the platform seals it with AWS KMS the moment it is submitted, keeps it out of every API response,
+log and stored checkpoint, and decrypts it only to hand it to your running agent as
+`state["inputs"]["<name>"]`, exactly like any other input. A secret input cannot have a `default`,
+holds at most 4096 bytes, and is meant for the user's own credential for a service your agent
+calls (their Supadata or Notion key), not for a key of yours: yours never goes in the agent or its
+manifest. Two rules for your code: don't put the key in `result` or `corpus` (they are shown
+to the user and stored in clear), and don't copy it into your own objects or logs: the platform
+can hide it in the state it checkpoints, not wherever your code sends it. When the user schedules
+the agent, they re-enter the key to change it; it is never shown back.
+
+```yaml
+inputs:
+  - name: supadata_api_key
+    type: secret
+    label: "Your Supadata API key"
+    required: true
+```
+
 ## An agent project
 
 ```
@@ -729,6 +733,11 @@ Real tools act on a connected account. Connect one with `gravity-gateway connect
 | `✗ requirements.lock` in `gravity validate` | A dependency has no prebuilt package for the platform image (ARM64 Linux). Pick a version that publishes one, or a different package. |
 | A tool row shows `refused — not in permissions.tools` | The agent called a tool its manifest does not declare. Add it under `permissions.tools`, then run again. |
 
+## What's new
+
+- **0.4.2** Documents `type: secret` (below) and the `supadata.get_transcript` tool.
+- **0.4.1** `type: secret` inputs: API keys and passwords the user enters are sealed with AWS KMS on the platform, never shown back, and handed only to the running agent. New built-in tool `supadata.get_transcript` (`gravity tools supadata`).
+
 ## Limitations
 
 - **No offline mode.** `gravity run` always talks to a real gateway. There is no mock-tool mode.

{gravity_cli-0.4.1 → gravity_cli-0.4.2}/packages/gravity-schema/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "gravity-schema"
-version = "0.4.1"
+version = "0.4.2"
 description = "Gravity agent manifest contract — models, validation, and JSON Schema export"
 readme = "README.md"
 license = "Apache-2.0"

{gravity_cli-0.4.1 → gravity_cli-0.4.2}/pyproject.toml

@@ -1,13 +1,13 @@
 [project]
 name = "gravity-cli"
-version = "0.4.1"
+version = "0.4.2"
 description = "gravity cli — init, run, and push python agents to the Gravity marketplace"
 readme = "README.md"
 license = "Apache-2.0"
 license-files = ["LICENSE", "NOTICE"]
 requires-python = ">=3.12"
 dependencies = [
-    "gravity-schema==0.4.1",  # released in lockstep: always the same version as this package
+    "gravity-schema==0.4.2",  # released in lockstep: always the same version as this package
     "typer>=0.15.0",
     "httpx>=0.27.0",
     "rich>=13.9.0",

{gravity_cli-0.4.1 → gravity_cli-0.4.2}/src/gravity_cli/BUILDER_GUIDE.md

@@ -81,7 +81,7 @@ dependencies:
 
 inputs:                             # becomes the user's form; arrives as state["inputs"]
   - name: send_to
-    type: email                     # text | textarea | number | boolean | static-dropdown | email | url | date | file
+    type: email                     # text | textarea | number | boolean | static-dropdown | email | url | date | secret | file
     label: "Where to send the digest"
     required: true
 
@@ -127,6 +127,17 @@ keeps the digest as a draft for the user to send. That's why the fallback in §3
 Other input fields you can use: `default:` (a value if the user leaves it blank; not for `file`),
 `options: [a, b]` (for `static-dropdown`), `accept: [pdf, csv]` (for `file`).
 
+**API keys and passwords: use `type: secret`**, never `text`. The user types it into a masked box;
+the platform seals it with AWS KMS the moment it is submitted, keeps it out of every API response,
+log and stored checkpoint, and decrypts it only to hand it to your running agent as
+`state["inputs"]["<name>"]`, exactly like any other input. A secret input cannot have a `default`,
+holds at most 4096 bytes, and is meant for the user's own credential for a service your agent
+calls (their Supadata or Notion key), not for a key of yours: yours never goes in the agent or its
+manifest. Two rules for your code: don't put the key in `result` or `corpus` (they are shown
+to the user and stored in clear), and don't copy it into your own objects or logs: the platform
+can hide it in the state it checkpoints, not wherever your code sends it. When the user schedules
+the agent, they re-enter the key to change it; it is never shown back.
+
 ### 3.2 `requirements.txt`
 
 ```

{gravity_cli-0.4.1 → gravity_cli-0.4.2}/uv.lock

@@ -164,7 +164,7 @@ wheels = [
 
 [[package]]
 name = "gravity-cli"
-version = "0.4.1"
+version = "0.4.2"
 source = { editable = "." }
 dependencies = [
     { name = "gravity-schema" },
@@ -201,7 +201,7 @@ dev = [
 
 [[package]]
 name = "gravity-schema"
-version = "0.4.1"
+version = "0.4.2"
 source = { editable = "packages/gravity-schema" }
 dependencies = [
     { name = "pydantic" },