@odla-ai/cli 0.1.0 → 0.2.0

package/README.md

@@ -46,6 +46,8 @@ npx odla-ai doctor
 npx odla-ai provision --dry-run
 npx odla-ai provision --write-dev-vars
 npx odla-ai smoke --env dev
+npx odla-ai secrets push --env dev
+npx odla-ai skill install
 npx odla-ai version
 ```
 
@@ -81,6 +83,30 @@ odla-db schema with the tenant key, compares expected schema entities, and runs
 a count aggregate against the first entity. It fails early with a clear message
 when provisioning has not written `.odla/credentials.local.json`.
 
+`secrets push --env <env>` moves the env's odla-db key from
+`.odla/credentials.local.json` into the deployed Worker by piping it over
+stdin to `wrangler secret put ODLA_API_KEY` — the value never appears on
+argv, in output, or in an agent's transcript. It preflights `wrangler whoami`
+and the presence of a wrangler config file. The env `prod`/`production`
+targets the top-level wrangler environment (no `--env` flag is passed to
+wrangler) and requires `--yes`; every other env maps to wrangler's
+`--env <name>`. `--dry-run` prints a redacted plan without spawning anything.
+
+`skill install` copies the Claude Code skills bundled with this package
+(currently `odla-migrate`, the phased GitHub Pages → odla migration
+procedure) into the project's `.claude/skills/`, or into `~/.claude/skills/`
+with `--global`. Re-runs are idempotent; a locally modified skill file is
+never overwritten without `--force`.
+
+`doctor` also lints for common footguns: permission rules that are literally
+`"true"` (public writes always warn; a public `view` warns unless the
+namespace is listed in `db.publicRead`), schema entities missing from the
+rules map, credential files (`.dev.vars`, `.odla/*`) tracked by git, a
+wrangler assets directory pointed at the project root or at a directory
+containing `node_modules` (the `wrangler dev` "spawn EBADF" footgun),
+secret-shaped values in wrangler `vars`, and a package.json script literally
+named `deploy` (CI may auto-deploy it).
+
 ## Config
 
 ```js
@@ -94,6 +120,7 @@ export default {
     schema: "./src/odla/schema.mjs",
     rules: "./src/odla/rules.mjs",
     defaultRules: "deny",
+    publicRead: [], // namespaces where a `view: "true"` rule is intentional
   },
   ai: {
     provider: process.env.ODLA_AI_PROVIDER ?? "anthropic",

package/dist/bin.cjs

@@ -28,7 +28,7 @@ var getImportMetaUrl = () => typeof document === "undefined" ? new URL(`file:${_
 var importMetaUrl = /* @__PURE__ */ getImportMetaUrl();
 
 // src/cli.ts
-var import_node_fs4 = require("fs");
+var import_node_fs7 = require("fs");
 
 // src/config.ts
 var import_node_fs = require("fs");
@@ -135,6 +135,181 @@ function unique(values) {
   return [...new Set(values.filter(Boolean))];
 }
 
+// src/doctor-checks.ts
+var import_node_child_process2 = require("child_process");
+var import_node_fs3 = require("fs");
+var import_node_path3 = require("path");
+
+// src/redact.ts
+var REPLACEMENTS = [
+  [/odla_(sk|dev)_[A-Za-z0-9._-]+/g, "odla_$1_[redacted]"],
+  [/\bsk_(live|test)_[A-Za-z0-9]+/g, "sk_$1_[redacted]"],
+  [/\bsk-[A-Za-z0-9._-]+/g, "sk-[redacted]"],
+  [/\bwhsec_[A-Za-z0-9+/=]+/g, "whsec_[redacted]"],
+  [/\b(ghp|gho|github_pat)_[A-Za-z0-9_]+/g, "$1_[redacted]"],
+  [/\bAKIA[A-Z0-9]{12,}/g, "AKIA[redacted]"]
+];
+function redactSecrets(value) {
+  let result = value;
+  for (const [pattern, replacement] of REPLACEMENTS) result = result.replace(pattern, replacement);
+  return result;
+}
+function looksSecret(value) {
+  return redactSecrets(value) !== value || value.includes("-----BEGIN");
+}
+
+// src/wrangler.ts
+var import_node_child_process = require("child_process");
+var import_node_fs2 = require("fs");
+var import_node_path2 = require("path");
+var defaultRunner = (cmd, args, opts) => new Promise((resolvePromise, reject) => {
+  const child = (0, import_node_child_process.spawn)(cmd, args, { cwd: opts?.cwd, stdio: ["pipe", "pipe", "pipe"] });
+  let stdout = "";
+  let stderr = "";
+  child.stdout.on("data", (chunk) => stdout += chunk.toString());
+  child.stderr.on("data", (chunk) => stderr += chunk.toString());
+  child.on("error", reject);
+  child.on("close", (code) => resolvePromise({ code: code ?? 1, stdout, stderr }));
+  child.stdin.end(opts?.input ?? "");
+});
+var WRANGLER_CONFIG_FILES = ["wrangler.jsonc", "wrangler.json", "wrangler.toml"];
+function findWranglerConfig(rootDir) {
+  for (const name of WRANGLER_CONFIG_FILES) {
+    const path = (0, import_node_path2.join)(rootDir, name);
+    if ((0, import_node_fs2.existsSync)(path)) return path;
+  }
+  return null;
+}
+function readWranglerConfig(path) {
+  if (path.endsWith(".toml")) return null;
+  try {
+    return JSON.parse(stripJsonComments((0, import_node_fs2.readFileSync)(path, "utf8")));
+  } catch {
+    return null;
+  }
+}
+function stripJsonComments(text) {
+  let result = "";
+  let inString = false;
+  for (let i = 0; i < text.length; i++) {
+    const ch = text[i];
+    if (inString) {
+      result += ch;
+      if (ch === "\\") {
+        result += text[i + 1] ?? "";
+        i++;
+      } else if (ch === '"') {
+        inString = false;
+      }
+      continue;
+    }
+    if (ch === '"') {
+      inString = true;
+      result += ch;
+      continue;
+    }
+    if (ch === "/" && text[i + 1] === "/") {
+      while (i < text.length && text[i] !== "\n") i++;
+      result += "\n";
+      continue;
+    }
+    if (ch === "/" && text[i + 1] === "*") {
+      i += 2;
+      while (i < text.length && !(text[i] === "*" && text[i + 1] === "/")) i++;
+      i++;
+      continue;
+    }
+    result += ch;
+  }
+  return result;
+}
+async function wranglerLoggedIn(run, cwd) {
+  try {
+    const result = await run("npx", ["wrangler", "whoami"], { cwd });
+    return result.code === 0 && !/not authenticated/i.test(`${result.stdout}${result.stderr}`);
+  } catch {
+    return false;
+  }
+}
+function wranglerPutSecret(run, opts) {
+  const args = ["wrangler", "secret", "put", opts.name, ...opts.env ? ["--env", opts.env] : []];
+  return run("npx", args, { input: opts.value, cwd: opts.cwd });
+}
+
+// src/doctor-checks.ts
+function lintRules(rules, entities, publicRead) {
+  const warnings = [];
+  if (!rules) return warnings;
+  for (const [ns, actions] of Object.entries(rules)) {
+    for (const [action, expr] of Object.entries(actions)) {
+      if (typeof expr !== "string" || expr.trim() !== "true") continue;
+      if (action === "view" && publicRead.includes(ns)) continue;
+      warnings.push(
+        action === "view" ? `rules.${ns}.view is "true" \u2014 public read; add "${ns}" to db.publicRead if intended` : `rules.${ns}.${action} is "true" \u2014 any client can ${action} ${ns} rows`
+      );
+    }
+  }
+  for (const entity of entities) {
+    if (!(entity in rules)) warnings.push(`schema entity "${entity}" has no rules entry (all client access denied)`);
+  }
+  return warnings;
+}
+var defaultExec = (cmd, args, cwd) => (0, import_node_child_process2.execFileSync)(cmd, args, { cwd, encoding: "utf8", stdio: ["ignore", "pipe", "ignore"] });
+function trackedSecretFiles(rootDir, exec = defaultExec) {
+  let output;
+  try {
+    output = exec("git", ["ls-files", "--", ".dev.vars", ".odla"], rootDir);
+  } catch {
+    return [];
+  }
+  return output.split(/\r?\n/).filter(Boolean).map((path) => `${path} is tracked by git \u2014 run "git rm --cached ${path}" and commit; it belongs in .gitignore`);
+}
+function wranglerWarnings(rootDir) {
+  const configPath = findWranglerConfig(rootDir);
+  if (!configPath) return [];
+  const config = readWranglerConfig(configPath);
+  if (!config) return [];
+  const warnings = [];
+  const blocks = [{ label: "", block: config }];
+  const envs = config.env;
+  if (envs && typeof envs === "object") {
+    for (const [name, block] of Object.entries(envs)) {
+      if (block && typeof block === "object") blocks.push({ label: `env.${name}.`, block });
+    }
+  }
+  for (const { label, block } of blocks) {
+    const assets = block.assets;
+    if (assets?.directory) {
+      const dir = (0, import_node_path3.resolve)(rootDir, assets.directory);
+      if (dir === (0, import_node_path3.resolve)(rootDir)) {
+        warnings.push(`${label}assets.directory is the project root \u2014 point it at a dedicated build dir (wrangler dev fails with "spawn EBADF")`);
+      } else if ((0, import_node_fs3.existsSync)((0, import_node_path3.join)(dir, "node_modules"))) {
+        warnings.push(`${label}assets.directory contains node_modules \u2014 wrangler dev's watcher will exhaust file descriptors`);
+      }
+    }
+    const vars = block.vars;
+    if (vars && typeof vars === "object") {
+      for (const [name, value] of Object.entries(vars)) {
+        if (name === "ODLA_API_KEY" || typeof value === "string" && looksSecret(value)) {
+          warnings.push(`wrangler ${label}vars.${name} looks like a secret \u2014 use "odla-ai secrets push" / wrangler secret put, never vars`);
+        }
+      }
+    }
+  }
+  const pkg = readPackageJson(rootDir);
+  if (pkg && typeof pkg.scripts === "object" && pkg.scripts && "deploy" in pkg.scripts) {
+    warnings.push(`package.json has a script named "deploy" \u2014 CI may auto-deploy it; rename to deploy:app`);
+  }
+  return warnings;
+}
+function readPackageJson(rootDir) {
+  try {
+    return JSON.parse((0, import_node_fs3.readFileSync)((0, import_node_path3.join)(rootDir, "package.json"), "utf8"));
+  } catch {
+    return null;
+  }
+}
+
 // src/doctor.ts
 async function doctor(options) {
   const out = options.stdout ?? console;
@@ -167,6 +342,9 @@ async function doctor(options) {
     }
   }
   if (cfg.ai?.keyEnv && !process.env[cfg.ai.keyEnv]) warnings.push(`${cfg.ai.keyEnv} is not set; provision will skip provider key storage`);
+  warnings.push(...lintRules(rules, entities, cfg.db?.publicRead ?? []));
+  warnings.push(...trackedSecretFiles(cfg.rootDir));
+  warnings.push(...wranglerWarnings(cfg.rootDir));
   if (warnings.length) {
     out.log("");
     out.log("warnings:");
@@ -177,25 +355,25 @@ async function doctor(options) {
 }
 
 // src/init.ts
-var import_node_fs3 = require("fs");
-var import_node_path3 = require("path");
+var import_node_fs5 = require("fs");
+var import_node_path5 = require("path");
 
 // src/local.ts
-var import_node_fs2 = require("fs");
-var import_node_path2 = require("path");
+var import_node_fs4 = require("fs");
+var import_node_path4 = require("path");
 var GITIGNORE_LINES = [".odla/*.local.json", ".odla/dev-token.json", ".dev.vars"];
 function readJsonFile(path) {
   try {
-    return JSON.parse((0, import_node_fs2.readFileSync)(path, "utf8"));
+    return JSON.parse((0, import_node_fs4.readFileSync)(path, "utf8"));
   } catch {
     return null;
   }
 }
 function writePrivateJson(path, value) {
-  (0, import_node_fs2.mkdirSync)((0, import_node_path2.dirname)(path), { recursive: true });
-  (0, import_node_fs2.writeFileSync)(path, `${JSON.stringify(value, null, 2)}
+  (0, import_node_fs4.mkdirSync)((0, import_node_path4.dirname)(path), { recursive: true });
+  (0, import_node_fs4.writeFileSync)(path, `${JSON.stringify(value, null, 2)}
 `);
-  (0, import_node_fs2.chmodSync)(path, 384);
+  (0, import_node_fs4.chmodSync)(path, 384);
 }
 function readCredentials(path) {
   return readJsonFile(path);
@@ -220,12 +398,12 @@ function mergeCredential(current, update) {
   return next;
 }
 function ensureGitignore(rootDir) {
-  const path = (0, import_node_path2.resolve)(rootDir, ".gitignore");
-  const existing = (0, import_node_fs2.existsSync)(path) ? (0, import_node_fs2.readFileSync)(path, "utf8") : "";
+  const path = (0, import_node_path4.resolve)(rootDir, ".gitignore");
+  const existing = (0, import_node_fs4.existsSync)(path) ? (0, import_node_fs4.readFileSync)(path, "utf8") : "";
   const missing = GITIGNORE_LINES.filter((line) => !existing.split(/\r?\n/).includes(line));
   if (missing.length === 0) return;
   const prefix = existing && !existing.endsWith("\n") ? "\n" : "";
-  (0, import_node_fs2.writeFileSync)(path, `${existing}${prefix}${missing.join("\n")}
+  (0, import_node_fs4.writeFileSync)(path, `${existing}${prefix}${missing.join("\n")}
 `);
 }
 function writeDevVars(path, credentials, env) {
@@ -239,22 +417,22 @@ function writeDevVars(path, credentials, env) {
     `ODLA_TENANT="${entry.tenantId}"`,
     `ODLA_API_KEY="${entry.dbKey}"`
   ];
-  (0, import_node_fs2.mkdirSync)((0, import_node_path2.dirname)(path), { recursive: true });
-  (0, import_node_fs2.writeFileSync)(path, `${lines.join("\n")}
+  (0, import_node_fs4.mkdirSync)((0, import_node_path4.dirname)(path), { recursive: true });
+  (0, import_node_fs4.writeFileSync)(path, `${lines.join("\n")}
 `);
-  (0, import_node_fs2.chmodSync)(path, 384);
+  (0, import_node_fs4.chmodSync)(path, 384);
 }
 function displayPath(path, rootDir = process.cwd()) {
-  const rel = (0, import_node_path2.relative)(rootDir, path);
+  const rel = (0, import_node_path4.relative)(rootDir, path);
   return rel && !rel.startsWith("..") ? rel : path;
 }
 
 // src/init.ts
 function initProject(options) {
   const out = options.stdout ?? console;
-  const rootDir = (0, import_node_path3.resolve)(options.rootDir ?? process.cwd());
-  const configPath = (0, import_node_path3.resolve)(rootDir, options.configPath ?? "odla.config.mjs");
-  if ((0, import_node_fs3.existsSync)(configPath) && !options.force) {
+  const rootDir = (0, import_node_path5.resolve)(options.rootDir ?? process.cwd());
+  const configPath = (0, import_node_path5.resolve)(rootDir, options.configPath ?? "odla.config.mjs");
+  if ((0, import_node_fs5.existsSync)(configPath) && !options.force) {
     throw new Error(`${configPath} already exists. Pass --force to overwrite.`);
   }
   if (!/^[a-z0-9][a-z0-9-]*$/.test(options.appId)) {
@@ -263,20 +441,20 @@ function initProject(options) {
   const envs = options.envs?.length ? options.envs : ["prod", "dev"];
   const services = options.services?.length ? options.services : ["db", "ai"];
   const aiProvider = options.aiProvider ?? "anthropic";
-  (0, import_node_fs3.mkdirSync)((0, import_node_path3.dirname)(configPath), { recursive: true });
-  (0, import_node_fs3.mkdirSync)((0, import_node_path3.resolve)(rootDir, "src/odla"), { recursive: true });
-  (0, import_node_fs3.mkdirSync)((0, import_node_path3.resolve)(rootDir, ".odla"), { recursive: true });
-  (0, import_node_fs3.writeFileSync)(configPath, configTemplate({ appId: options.appId, name: options.name, envs, services, aiProvider }));
-  writeIfMissing((0, import_node_path3.resolve)(rootDir, "src/odla/schema.mjs"), schemaTemplate());
-  writeIfMissing((0, import_node_path3.resolve)(rootDir, "src/odla/rules.mjs"), rulesTemplate());
+  (0, import_node_fs5.mkdirSync)((0, import_node_path5.dirname)(configPath), { recursive: true });
+  (0, import_node_fs5.mkdirSync)((0, import_node_path5.resolve)(rootDir, "src/odla"), { recursive: true });
+  (0, import_node_fs5.mkdirSync)((0, import_node_path5.resolve)(rootDir, ".odla"), { recursive: true });
+  (0, import_node_fs5.writeFileSync)(configPath, configTemplate({ appId: options.appId, name: options.name, envs, services, aiProvider }));
+  writeIfMissing((0, import_node_path5.resolve)(rootDir, "src/odla/schema.mjs"), schemaTemplate());
+  writeIfMissing((0, import_node_path5.resolve)(rootDir, "src/odla/rules.mjs"), rulesTemplate());
   ensureGitignore(rootDir);
   out.log(`created ${relativeDisplay(configPath, rootDir)}`);
   out.log("created src/odla/schema.mjs and src/odla/rules.mjs");
   out.log("updated .gitignore for local odla credentials");
 }
 function writeIfMissing(path, text) {
-  if ((0, import_node_fs3.existsSync)(path)) return;
-  (0, import_node_fs3.writeFileSync)(path, text);
+  if ((0, import_node_fs5.existsSync)(path)) return;
+  (0, import_node_fs5.writeFileSync)(path, text);
 }
 function configTemplate(input) {
   return `export default {
@@ -359,7 +537,7 @@ function relativeDisplay(path, rootDir) {
 // src/provision.ts
 var import_apps = require("@odla-ai/apps");
 var import_ai = require("@odla-ai/ai");
-var import_node_path4 = require("path");
+var import_node_path6 = require("path");
 var import_node_process3 = __toESM(require("process"), 1);
 
 // src/token.ts
@@ -367,12 +545,12 @@ var import_db = require("@odla-ai/db");
 var import_node_process2 = __toESM(require("process"), 1);
 
 // src/open.ts
-var import_node_child_process = require("child_process");
+var import_node_child_process3 = require("child_process");
 var import_node_process = __toESM(require("process"), 1);
 async function openUrl(url, options = {}) {
   const command = openerFor(options.platform ?? import_node_process.default.platform);
-  const doSpawn = options.spawnImpl ?? import_node_child_process.spawn;
-  await new Promise((resolve5, reject) => {
+  const doSpawn = options.spawnImpl ?? import_node_child_process3.spawn;
+  await new Promise((resolve7, reject) => {
     const child = doSpawn(command.cmd, [...command.args, url], {
       stdio: "ignore",
       detached: true
@@ -380,7 +558,7 @@ async function openUrl(url, options = {}) {
     child.once("error", reject);
     child.once("spawn", () => {
       child.unref();
-      resolve5();
+      resolve7();
     });
   });
 }
@@ -607,17 +785,115 @@ function defaultSecretName(provider) {
 function resolveWriteDevVarsTarget(cfg, requested) {
   if (!requested) return null;
   if (requested === true) return cfg.local.devVarsFile;
-  return (0, import_node_path4.resolve)((0, import_node_path4.dirname)(cfg.configPath), requested);
+  return (0, import_node_path6.resolve)((0, import_node_path6.dirname)(cfg.configPath), requested);
 }
 async function safeText(res) {
   try {
-    return redact((await res.text()).slice(0, 500));
+    return redactSecrets((await res.text()).slice(0, 500));
   } catch {
     return "";
   }
 }
-function redact(value) {
-  return value.replace(/odla_(sk|dev)_[A-Za-z0-9._-]+/g, "odla_$1_[redacted]").replace(/sk-[A-Za-z0-9._-]+/g, "sk-[redacted]");
+
+// src/secrets.ts
+var PROD_ENV_NAMES = /* @__PURE__ */ new Set(["prod", "production"]);
+async function secretsPush(options) {
+  const out = options.stdout ?? console;
+  const cfg = await loadProjectConfig(options.configPath);
+  const env = options.env;
+  if (!cfg.envs.includes(env)) {
+    throw new Error(`env "${env}" is not in config envs (${cfg.envs.join(", ")})`);
+  }
+  if (PROD_ENV_NAMES.has(env) && !options.yes) {
+    throw new Error(`refusing to push a secret to "${env}" without --yes`);
+  }
+  const credentialsPath = displayPath(cfg.local.credentialsFile, cfg.rootDir);
+  const credentials = readCredentials(cfg.local.credentialsFile);
+  if (!credentials) throw new Error(`no credentials at ${credentialsPath} \u2014 run "odla-ai provision" first`);
+  if (credentials.appId !== cfg.app.id) {
+    throw new Error(`credentials at ${credentialsPath} are for "${credentials.appId}", not "${cfg.app.id}"`);
+  }
+  const dbKey = credentials.envs[env]?.dbKey;
+  if (!dbKey) throw new Error(`no db key for env "${env}" in ${credentialsPath} \u2014 run "odla-ai provision" first`);
+  const wranglerConfig = findWranglerConfig(cfg.rootDir);
+  if (!wranglerConfig) {
+    throw new Error(`no wrangler config found in ${cfg.rootDir} (wrangler.jsonc, wrangler.json, or wrangler.toml)`);
+  }
+  const wranglerEnv = PROD_ENV_NAMES.has(env) ? void 0 : env;
+  const target = wranglerEnv ? `wrangler env "${wranglerEnv}"` : "the top-level (prod) wrangler env";
+  if (options.dryRun) {
+    out.log(`dry run: would push ODLA_API_KEY (${redactSecrets(dbKey)}) to ${target}`);
+    return;
+  }
+  const run = options.runner ?? defaultRunner;
+  if (!await wranglerLoggedIn(run, cfg.rootDir)) {
+    throw new Error(`wrangler is not logged in \u2014 run "wrangler login" (a browser step for the human)`);
+  }
+  const result = await wranglerPutSecret(run, { name: "ODLA_API_KEY", value: dbKey, env: wranglerEnv, cwd: cfg.rootDir });
+  if (result.code !== 0) {
+    throw new Error(`wrangler secret put failed (exit ${result.code}): ${redactSecrets(`${result.stderr || result.stdout}`.trim())}`);
+  }
+  out.log(`ODLA_API_KEY pushed to ${target} (value read from ${credentialsPath}, never echoed)`);
+}
+
+// src/skill.ts
+var import_node_fs6 = require("fs");
+var import_node_os = require("os");
+var import_node_path7 = require("path");
+var import_node_url2 = require("url");
+function installSkill(options = {}) {
+  const out = options.stdout ?? console;
+  const sourceDir = options.sourceDir ?? (0, import_node_url2.fileURLToPath)(new URL("../skills", importMetaUrl));
+  const targetDir = options.global ? (0, import_node_path7.join)(options.homeDir ?? (0, import_node_os.homedir)(), ".claude", "skills") : (0, import_node_path7.resolve)(options.dir ?? process.cwd(), ".claude", "skills");
+  const files = listFiles(sourceDir);
+  if (files.length === 0) throw new Error(`no bundled skills found at ${sourceDir}`);
+  const written = [];
+  const unchanged = [];
+  const conflicts = [];
+  for (const rel of files) {
+    const target = (0, import_node_path7.join)(targetDir, rel);
+    const source = (0, import_node_fs6.readFileSync)((0, import_node_path7.join)(sourceDir, rel), "utf8");
+    if ((0, import_node_fs6.existsSync)(target)) {
+      const current = (0, import_node_fs6.readFileSync)(target, "utf8");
+      if (current === source) {
+        unchanged.push(rel);
+        continue;
+      }
+      if (!options.force) {
+        conflicts.push(rel);
+        continue;
+      }
+    }
+    written.push(rel);
+  }
+  if (conflicts.length > 0) {
+    throw new Error(
+      `skill files modified locally (re-run with --force to overwrite):
+${conflicts.map((f) => `  - ${(0, import_node_path7.join)(targetDir, f)}`).join("\n")}`
+    );
+  }
+  for (const rel of written) {
+    const target = (0, import_node_path7.join)(targetDir, rel);
+    (0, import_node_fs6.mkdirSync)((0, import_node_path7.join)(target, ".."), { recursive: true });
+    (0, import_node_fs6.writeFileSync)(target, (0, import_node_fs6.readFileSync)((0, import_node_path7.join)(sourceDir, rel), "utf8"));
+  }
+  const skills = [...new Set(files.map((f) => f.split(/[\\/]/)[0]))].sort();
+  out.log(`skills: ${skills.join(", ")}`);
+  out.log(`installed ${written.length} file(s) to ${targetDir}${unchanged.length ? ` (${unchanged.length} unchanged)` : ""}`);
+  return { targetDir, written, unchanged };
+}
+function listFiles(dir) {
+  if (!(0, import_node_fs6.existsSync)(dir)) return [];
+  const results = [];
+  const walk = (current) => {
+    for (const entry of (0, import_node_fs6.readdirSync)(current, { withFileTypes: true })) {
+      const path = (0, import_node_path7.join)(current, entry.name);
+      if (entry.isDirectory()) walk(path);
+      else results.push((0, import_node_path7.relative)(dir, path));
+    }
+  };
+  walk(dir);
+  return results.sort();
 }
 
 // src/smoke.ts
@@ -751,6 +1027,27 @@ async function runCli(argv = process.argv.slice(2)) {
     });
     return;
   }
+  if (command === "skill") {
+    const sub = parsed.positionals[1];
+    if (sub !== "install") throw new Error(`unknown skill subcommand "${sub ?? ""}". Try "odla-ai skill install".`);
+    installSkill({
+      dir: stringOpt(parsed.options.dir),
+      global: parsed.options.global === true,
+      force: parsed.options.force === true
+    });
+    return;
+  }
+  if (command === "secrets") {
+    const sub = parsed.positionals[1];
+    if (sub !== "push") throw new Error(`unknown secrets subcommand "${sub ?? ""}". Try "odla-ai secrets push --env dev".`);
+    await secretsPush({
+      configPath: stringOpt(parsed.options.config) ?? "odla.config.mjs",
+      env: requiredString(parsed.options.env, "--env"),
+      dryRun: parsed.options["dry-run"] === true,
+      yes: parsed.options.yes === true
+    });
+    return;
+  }
   throw new Error(`unknown command "${command}". Run "odla-ai help".`);
 }
 function parseArgv(argv) {
@@ -809,7 +1106,7 @@ function listOpt(value) {
   return values.flatMap((item) => item.split(",")).map((item) => item.trim()).filter(Boolean);
 }
 function cliVersion() {
-  const pkg = JSON.parse((0, import_node_fs4.readFileSync)(new URL("../package.json", importMetaUrl), "utf8"));
+  const pkg = JSON.parse((0, import_node_fs7.readFileSync)(new URL("../package.json", importMetaUrl), "utf8"));
   return pkg.version ?? "unknown";
 }
 function printHelp() {
@@ -820,6 +1117,8 @@ Usage:
   odla-ai doctor [--config odla.config.mjs]
   odla-ai provision [--config odla.config.mjs] [--dry-run] [--open|--no-open] [--rotate-keys] [--write-dev-vars[=path]]
   odla-ai smoke [--config odla.config.mjs] [--env dev]
+  odla-ai skill install [--dir <project>] [--global] [--force]
+  odla-ai secrets push --env <env> [--config odla.config.mjs] [--dry-run] [--yes]
   odla-ai version
 
 Commands:
@@ -827,6 +1126,8 @@ Commands:
   doctor      Validate and summarize the project config without network calls.
   provision   Register the app, enable services, push schema/rules, configure AI/auth.
   smoke       Verify local credentials, public-config, live schema, and db aggregate.
+  skill       Install the bundled Claude Code skills into .claude/skills/.
+  secrets     Push the env's db key into the Worker via wrangler, stdin-piped.
   version     Print the CLI version.
 
 Safety: