@odla-ai/chapter 0.28.2 → 0.30.0

package/dist/index.d.cts

@@ -1406,15 +1406,25 @@ interface IntegrationSetting {
     /** Where the value is stored and read from. */
     source: string;
 }
-/** A secret the capability needs, held in the tenant vault. */
+/**
+ * A secret the capability needs, held in the tenant vault.
+ *
+ * Structurally the odla CLI's `IntegrationSecret`: `name` is the vault name
+ * byte-for-byte, so `odla-ai doctor`, `odla-ai secrets status`, and the
+ * repo's `check:secrets` gate can hold this declaration against the name the
+ * platform actually reads. `mode` is chapter's own addition and the CLI
+ * ignores it.
+ */
 interface IntegrationSecret {
-    key: string;
+    /** Vault name, exactly as `odla-ai secrets set <name>` writes it. */
+    name: string;
     description: string;
     pattern?: string;
     /** Auth mode that requires this secret ("full" pulls user profiles). */
     mode: SecretMode;
-    /** Stored in the tenant vault (never in graph rows or wrangler vars)? */
-    vault: boolean;
+    /** Whether the capability is broken without it. Both Clerk secrets are
+     *  needed only by auth mode "full", so both are optional. */
+    required?: boolean;
 }
 /** One data-sync contract. A capability may declare several (e.g. an inbound
  *  webhook mirror AND an outbound write), so {@link IntegrationDescriptor.syncs}

package/dist/index.d.ts

@@ -1406,15 +1406,25 @@ interface IntegrationSetting {
     /** Where the value is stored and read from. */
     source: string;
 }
-/** A secret the capability needs, held in the tenant vault. */
+/**
+ * A secret the capability needs, held in the tenant vault.
+ *
+ * Structurally the odla CLI's `IntegrationSecret`: `name` is the vault name
+ * byte-for-byte, so `odla-ai doctor`, `odla-ai secrets status`, and the
+ * repo's `check:secrets` gate can hold this declaration against the name the
+ * platform actually reads. `mode` is chapter's own addition and the CLI
+ * ignores it.
+ */
 interface IntegrationSecret {
-    key: string;
+    /** Vault name, exactly as `odla-ai secrets set <name>` writes it. */
+    name: string;
     description: string;
     pattern?: string;
     /** Auth mode that requires this secret ("full" pulls user profiles). */
     mode: SecretMode;
-    /** Stored in the tenant vault (never in graph rows or wrangler vars)? */
-    vault: boolean;
+    /** Whether the capability is broken without it. Both Clerk secrets are
+     *  needed only by auth mode "full", so both are optional. */
+    required?: boolean;
 }
 /** One data-sync contract. A capability may declare several (e.g. an inbound
  *  webhook mirror AND an outbound write), so {@link IntegrationDescriptor.syncs}

package/dist/index.js

@@ -2051,18 +2051,22 @@ var clerkIntegration = {
   ],
   secrets: [
     {
-      key: "CLERK_WEBHOOK_SECRET",
+      // odla-db reads this exact name (CLERK_WEBHOOK_SECRET_NAME in the
+      // platform's clerk-webhook.ts); it is also what `odla-ai secrets set`
+      // writes. It read "CLERK_WEBHOOK_SECRET" until 0.30.0, which sent
+      // adopters to store the value under a name nothing looks up.
+      name: "clerk_webhook_secret",
       description: "Svix signing secret for Clerk user webhooks \u2014 verifies $users sync events.",
       pattern: "whsec_",
       mode: "full",
-      vault: true
+      required: false
     },
     {
-      key: "clerk_secret_key",
+      name: "clerk_secret_key",
       description: "Clerk backend key (sk_*) \u2014 powers account creation, the public role claim, and backend-only private profile signals; it also lets odla-db resolve user email/name via the Clerk API.",
       pattern: "sk_",
       mode: "full",
-      vault: true
+      required: false
     }
   ],
   syncs: [