@odla-ai/cli 0.1.0 → 0.2.0

package/dist/{chunk-AXCZKIVY.js → chunk-5J4LKP37.js}

@@ -1,5 +1,23 @@
 #!/usr/bin/env node
 
+// src/redact.ts
+var REPLACEMENTS = [
+  [/odla_(sk|dev)_[A-Za-z0-9._-]+/g, "odla_$1_[redacted]"],
+  [/\bsk_(live|test)_[A-Za-z0-9]+/g, "sk_$1_[redacted]"],
+  [/\bsk-[A-Za-z0-9._-]+/g, "sk-[redacted]"],
+  [/\bwhsec_[A-Za-z0-9+/=]+/g, "whsec_[redacted]"],
+  [/\b(ghp|gho|github_pat)_[A-Za-z0-9_]+/g, "$1_[redacted]"],
+  [/\bAKIA[A-Z0-9]{12,}/g, "AKIA[redacted]"]
+];
+function redactSecrets(value) {
+  let result = value;
+  for (const [pattern, replacement] of REPLACEMENTS) result = result.replace(pattern, replacement);
+  return result;
+}
+function looksSecret(value) {
+  return redactSecrets(value) !== value || value.includes("-----BEGIN");
+}
+
 // src/config.ts
 import { existsSync, readFileSync } from "fs";
 import { dirname, isAbsolute, resolve } from "path";
@@ -105,6 +123,163 @@ function unique(values) {
   return [...new Set(values.filter(Boolean))];
 }
 
+// src/doctor-checks.ts
+import { execFileSync } from "child_process";
+import { existsSync as existsSync3, readFileSync as readFileSync3 } from "fs";
+import { join as join2, resolve as resolve2 } from "path";
+
+// src/wrangler.ts
+import { spawn } from "child_process";
+import { existsSync as existsSync2, readFileSync as readFileSync2 } from "fs";
+import { join } from "path";
+var defaultRunner = (cmd, args, opts) => new Promise((resolvePromise, reject) => {
+  const child = spawn(cmd, args, { cwd: opts?.cwd, stdio: ["pipe", "pipe", "pipe"] });
+  let stdout = "";
+  let stderr = "";
+  child.stdout.on("data", (chunk) => stdout += chunk.toString());
+  child.stderr.on("data", (chunk) => stderr += chunk.toString());
+  child.on("error", reject);
+  child.on("close", (code) => resolvePromise({ code: code ?? 1, stdout, stderr }));
+  child.stdin.end(opts?.input ?? "");
+});
+var WRANGLER_CONFIG_FILES = ["wrangler.jsonc", "wrangler.json", "wrangler.toml"];
+function findWranglerConfig(rootDir) {
+  for (const name of WRANGLER_CONFIG_FILES) {
+    const path = join(rootDir, name);
+    if (existsSync2(path)) return path;
+  }
+  return null;
+}
+function readWranglerConfig(path) {
+  if (path.endsWith(".toml")) return null;
+  try {
+    return JSON.parse(stripJsonComments(readFileSync2(path, "utf8")));
+  } catch {
+    return null;
+  }
+}
+function stripJsonComments(text) {
+  let result = "";
+  let inString = false;
+  for (let i = 0; i < text.length; i++) {
+    const ch = text[i];
+    if (inString) {
+      result += ch;
+      if (ch === "\\") {
+        result += text[i + 1] ?? "";
+        i++;
+      } else if (ch === '"') {
+        inString = false;
+      }
+      continue;
+    }
+    if (ch === '"') {
+      inString = true;
+      result += ch;
+      continue;
+    }
+    if (ch === "/" && text[i + 1] === "/") {
+      while (i < text.length && text[i] !== "\n") i++;
+      result += "\n";
+      continue;
+    }
+    if (ch === "/" && text[i + 1] === "*") {
+      i += 2;
+      while (i < text.length && !(text[i] === "*" && text[i + 1] === "/")) i++;
+      i++;
+      continue;
+    }
+    result += ch;
+  }
+  return result;
+}
+async function wranglerLoggedIn(run, cwd) {
+  try {
+    const result = await run("npx", ["wrangler", "whoami"], { cwd });
+    return result.code === 0 && !/not authenticated/i.test(`${result.stdout}${result.stderr}`);
+  } catch {
+    return false;
+  }
+}
+function wranglerPutSecret(run, opts) {
+  const args = ["wrangler", "secret", "put", opts.name, ...opts.env ? ["--env", opts.env] : []];
+  return run("npx", args, { input: opts.value, cwd: opts.cwd });
+}
+
+// src/doctor-checks.ts
+function lintRules(rules, entities, publicRead) {
+  const warnings = [];
+  if (!rules) return warnings;
+  for (const [ns, actions] of Object.entries(rules)) {
+    for (const [action, expr] of Object.entries(actions)) {
+      if (typeof expr !== "string" || expr.trim() !== "true") continue;
+      if (action === "view" && publicRead.includes(ns)) continue;
+      warnings.push(
+        action === "view" ? `rules.${ns}.view is "true" \u2014 public read; add "${ns}" to db.publicRead if intended` : `rules.${ns}.${action} is "true" \u2014 any client can ${action} ${ns} rows`
+      );
+    }
+  }
+  for (const entity of entities) {
+    if (!(entity in rules)) warnings.push(`schema entity "${entity}" has no rules entry (all client access denied)`);
+  }
+  return warnings;
+}
+var defaultExec = (cmd, args, cwd) => execFileSync(cmd, args, { cwd, encoding: "utf8", stdio: ["ignore", "pipe", "ignore"] });
+function trackedSecretFiles(rootDir, exec = defaultExec) {
+  let output;
+  try {
+    output = exec("git", ["ls-files", "--", ".dev.vars", ".odla"], rootDir);
+  } catch {
+    return [];
+  }
+  return output.split(/\r?\n/).filter(Boolean).map((path) => `${path} is tracked by git \u2014 run "git rm --cached ${path}" and commit; it belongs in .gitignore`);
+}
+function wranglerWarnings(rootDir) {
+  const configPath = findWranglerConfig(rootDir);
+  if (!configPath) return [];
+  const config = readWranglerConfig(configPath);
+  if (!config) return [];
+  const warnings = [];
+  const blocks = [{ label: "", block: config }];
+  const envs = config.env;
+  if (envs && typeof envs === "object") {
+    for (const [name, block] of Object.entries(envs)) {
+      if (block && typeof block === "object") blocks.push({ label: `env.${name}.`, block });
+    }
+  }
+  for (const { label, block } of blocks) {
+    const assets = block.assets;
+    if (assets?.directory) {
+      const dir = resolve2(rootDir, assets.directory);
+      if (dir === resolve2(rootDir)) {
+        warnings.push(`${label}assets.directory is the project root \u2014 point it at a dedicated build dir (wrangler dev fails with "spawn EBADF")`);
+      } else if (existsSync3(join2(dir, "node_modules"))) {
+        warnings.push(`${label}assets.directory contains node_modules \u2014 wrangler dev's watcher will exhaust file descriptors`);
+      }
+    }
+    const vars = block.vars;
+    if (vars && typeof vars === "object") {
+      for (const [name, value] of Object.entries(vars)) {
+        if (name === "ODLA_API_KEY" || typeof value === "string" && looksSecret(value)) {
+          warnings.push(`wrangler ${label}vars.${name} looks like a secret \u2014 use "odla-ai secrets push" / wrangler secret put, never vars`);
+        }
+      }
+    }
+  }
+  const pkg = readPackageJson(rootDir);
+  if (pkg && typeof pkg.scripts === "object" && pkg.scripts && "deploy" in pkg.scripts) {
+    warnings.push(`package.json has a script named "deploy" \u2014 CI may auto-deploy it; rename to deploy:app`);
+  }
+  return warnings;
+}
+function readPackageJson(rootDir) {
+  try {
+    return JSON.parse(readFileSync3(join2(rootDir, "package.json"), "utf8"));
+  } catch {
+    return null;
+  }
+}
+
 // src/doctor.ts
 async function doctor(options) {
   const out = options.stdout ?? console;
@@ -137,6 +312,9 @@ async function doctor(options) {
     }
   }
   if (cfg.ai?.keyEnv && !process.env[cfg.ai.keyEnv]) warnings.push(`${cfg.ai.keyEnv} is not set; provision will skip provider key storage`);
+  warnings.push(...lintRules(rules, entities, cfg.db?.publicRead ?? []));
+  warnings.push(...trackedSecretFiles(cfg.rootDir));
+  warnings.push(...wranglerWarnings(cfg.rootDir));
   if (warnings.length) {
     out.log("");
     out.log("warnings:");
@@ -147,16 +325,16 @@ async function doctor(options) {
 }
 
 // src/init.ts
-import { existsSync as existsSync3, mkdirSync as mkdirSync2, writeFileSync as writeFileSync2 } from "fs";
-import { dirname as dirname3, resolve as resolve3 } from "path";
+import { existsSync as existsSync5, mkdirSync as mkdirSync2, writeFileSync as writeFileSync2 } from "fs";
+import { dirname as dirname3, resolve as resolve4 } from "path";
 
 // src/local.ts
-import { chmodSync, existsSync as existsSync2, mkdirSync, readFileSync as readFileSync2, writeFileSync } from "fs";
-import { dirname as dirname2, relative, resolve as resolve2 } from "path";
+import { chmodSync, existsSync as existsSync4, mkdirSync, readFileSync as readFileSync4, writeFileSync } from "fs";
+import { dirname as dirname2, relative, resolve as resolve3 } from "path";
 var GITIGNORE_LINES = [".odla/*.local.json", ".odla/dev-token.json", ".dev.vars"];
 function readJsonFile(path) {
   try {
-    return JSON.parse(readFileSync2(path, "utf8"));
+    return JSON.parse(readFileSync4(path, "utf8"));
   } catch {
     return null;
   }
@@ -190,8 +368,8 @@ function mergeCredential(current, update) {
   return next;
 }
 function ensureGitignore(rootDir) {
-  const path = resolve2(rootDir, ".gitignore");
-  const existing = existsSync2(path) ? readFileSync2(path, "utf8") : "";
+  const path = resolve3(rootDir, ".gitignore");
+  const existing = existsSync4(path) ? readFileSync4(path, "utf8") : "";
   const missing = GITIGNORE_LINES.filter((line) => !existing.split(/\r?\n/).includes(line));
   if (missing.length === 0) return;
   const prefix = existing && !existing.endsWith("\n") ? "\n" : "";
@@ -222,9 +400,9 @@ function displayPath(path, rootDir = process.cwd()) {
 // src/init.ts
 function initProject(options) {
   const out = options.stdout ?? console;
-  const rootDir = resolve3(options.rootDir ?? process.cwd());
-  const configPath = resolve3(rootDir, options.configPath ?? "odla.config.mjs");
-  if (existsSync3(configPath) && !options.force) {
+  const rootDir = resolve4(options.rootDir ?? process.cwd());
+  const configPath = resolve4(rootDir, options.configPath ?? "odla.config.mjs");
+  if (existsSync5(configPath) && !options.force) {
     throw new Error(`${configPath} already exists. Pass --force to overwrite.`);
   }
   if (!/^[a-z0-9][a-z0-9-]*$/.test(options.appId)) {
@@ -234,18 +412,18 @@ function initProject(options) {
   const services = options.services?.length ? options.services : ["db", "ai"];
   const aiProvider = options.aiProvider ?? "anthropic";
   mkdirSync2(dirname3(configPath), { recursive: true });
-  mkdirSync2(resolve3(rootDir, "src/odla"), { recursive: true });
-  mkdirSync2(resolve3(rootDir, ".odla"), { recursive: true });
+  mkdirSync2(resolve4(rootDir, "src/odla"), { recursive: true });
+  mkdirSync2(resolve4(rootDir, ".odla"), { recursive: true });
   writeFileSync2(configPath, configTemplate({ appId: options.appId, name: options.name, envs, services, aiProvider }));
-  writeIfMissing(resolve3(rootDir, "src/odla/schema.mjs"), schemaTemplate());
-  writeIfMissing(resolve3(rootDir, "src/odla/rules.mjs"), rulesTemplate());
+  writeIfMissing(resolve4(rootDir, "src/odla/schema.mjs"), schemaTemplate());
+  writeIfMissing(resolve4(rootDir, "src/odla/rules.mjs"), rulesTemplate());
   ensureGitignore(rootDir);
   out.log(`created ${relativeDisplay(configPath, rootDir)}`);
   out.log("created src/odla/schema.mjs and src/odla/rules.mjs");
   out.log("updated .gitignore for local odla credentials");
 }
 function writeIfMissing(path, text) {
-  if (existsSync3(path)) return;
+  if (existsSync5(path)) return;
   writeFileSync2(path, text);
 }
 function configTemplate(input) {
@@ -329,7 +507,7 @@ function relativeDisplay(path, rootDir) {
 // src/provision.ts
 import { createAppsClient, tenantIdFor } from "@odla-ai/apps";
 import { DEFAULT_SECRET_NAMES, putSecret } from "@odla-ai/ai";
-import { dirname as dirname4, resolve as resolve4 } from "path";
+import { dirname as dirname4, resolve as resolve5 } from "path";
 import process4 from "process";
 
 // src/token.ts
@@ -337,12 +515,12 @@ import { requestToken } from "@odla-ai/db";
 import process3 from "process";
 
 // src/open.ts
-import { spawn } from "child_process";
+import { spawn as spawn2 } from "child_process";
 import process2 from "process";
 async function openUrl(url, options = {}) {
   const command = openerFor(options.platform ?? process2.platform);
-  const doSpawn = options.spawnImpl ?? spawn;
-  await new Promise((resolve5, reject) => {
+  const doSpawn = options.spawnImpl ?? spawn2;
+  await new Promise((resolve7, reject) => {
     const child = doSpawn(command.cmd, [...command.args, url], {
       stdio: "ignore",
       detached: true
@@ -350,7 +528,7 @@ async function openUrl(url, options = {}) {
     child.once("error", reject);
     child.once("spawn", () => {
       child.unref();
-      resolve5();
+      resolve7();
     });
   });
 }
@@ -577,17 +755,115 @@ function defaultSecretName(provider) {
 function resolveWriteDevVarsTarget(cfg, requested) {
   if (!requested) return null;
   if (requested === true) return cfg.local.devVarsFile;
-  return resolve4(dirname4(cfg.configPath), requested);
+  return resolve5(dirname4(cfg.configPath), requested);
 }
 async function safeText(res) {
   try {
-    return redact((await res.text()).slice(0, 500));
+    return redactSecrets((await res.text()).slice(0, 500));
   } catch {
     return "";
   }
 }
-function redact(value) {
-  return value.replace(/odla_(sk|dev)_[A-Za-z0-9._-]+/g, "odla_$1_[redacted]").replace(/sk-[A-Za-z0-9._-]+/g, "sk-[redacted]");
+
+// src/secrets.ts
+var PROD_ENV_NAMES = /* @__PURE__ */ new Set(["prod", "production"]);
+async function secretsPush(options) {
+  const out = options.stdout ?? console;
+  const cfg = await loadProjectConfig(options.configPath);
+  const env = options.env;
+  if (!cfg.envs.includes(env)) {
+    throw new Error(`env "${env}" is not in config envs (${cfg.envs.join(", ")})`);
+  }
+  if (PROD_ENV_NAMES.has(env) && !options.yes) {
+    throw new Error(`refusing to push a secret to "${env}" without --yes`);
+  }
+  const credentialsPath = displayPath(cfg.local.credentialsFile, cfg.rootDir);
+  const credentials = readCredentials(cfg.local.credentialsFile);
+  if (!credentials) throw new Error(`no credentials at ${credentialsPath} \u2014 run "odla-ai provision" first`);
+  if (credentials.appId !== cfg.app.id) {
+    throw new Error(`credentials at ${credentialsPath} are for "${credentials.appId}", not "${cfg.app.id}"`);
+  }
+  const dbKey = credentials.envs[env]?.dbKey;
+  if (!dbKey) throw new Error(`no db key for env "${env}" in ${credentialsPath} \u2014 run "odla-ai provision" first`);
+  const wranglerConfig = findWranglerConfig(cfg.rootDir);
+  if (!wranglerConfig) {
+    throw new Error(`no wrangler config found in ${cfg.rootDir} (wrangler.jsonc, wrangler.json, or wrangler.toml)`);
+  }
+  const wranglerEnv = PROD_ENV_NAMES.has(env) ? void 0 : env;
+  const target = wranglerEnv ? `wrangler env "${wranglerEnv}"` : "the top-level (prod) wrangler env";
+  if (options.dryRun) {
+    out.log(`dry run: would push ODLA_API_KEY (${redactSecrets(dbKey)}) to ${target}`);
+    return;
+  }
+  const run = options.runner ?? defaultRunner;
+  if (!await wranglerLoggedIn(run, cfg.rootDir)) {
+    throw new Error(`wrangler is not logged in \u2014 run "wrangler login" (a browser step for the human)`);
+  }
+  const result = await wranglerPutSecret(run, { name: "ODLA_API_KEY", value: dbKey, env: wranglerEnv, cwd: cfg.rootDir });
+  if (result.code !== 0) {
+    throw new Error(`wrangler secret put failed (exit ${result.code}): ${redactSecrets(`${result.stderr || result.stdout}`.trim())}`);
+  }
+  out.log(`ODLA_API_KEY pushed to ${target} (value read from ${credentialsPath}, never echoed)`);
+}
+
+// src/skill.ts
+import { existsSync as existsSync6, mkdirSync as mkdirSync3, readFileSync as readFileSync5, readdirSync, writeFileSync as writeFileSync3 } from "fs";
+import { homedir } from "os";
+import { join as join3, relative as relative2, resolve as resolve6 } from "path";
+import { fileURLToPath } from "url";
+function installSkill(options = {}) {
+  const out = options.stdout ?? console;
+  const sourceDir = options.sourceDir ?? fileURLToPath(new URL("../skills", import.meta.url));
+  const targetDir = options.global ? join3(options.homeDir ?? homedir(), ".claude", "skills") : resolve6(options.dir ?? process.cwd(), ".claude", "skills");
+  const files = listFiles(sourceDir);
+  if (files.length === 0) throw new Error(`no bundled skills found at ${sourceDir}`);
+  const written = [];
+  const unchanged = [];
+  const conflicts = [];
+  for (const rel of files) {
+    const target = join3(targetDir, rel);
+    const source = readFileSync5(join3(sourceDir, rel), "utf8");
+    if (existsSync6(target)) {
+      const current = readFileSync5(target, "utf8");
+      if (current === source) {
+        unchanged.push(rel);
+        continue;
+      }
+      if (!options.force) {
+        conflicts.push(rel);
+        continue;
+      }
+    }
+    written.push(rel);
+  }
+  if (conflicts.length > 0) {
+    throw new Error(
+      `skill files modified locally (re-run with --force to overwrite):
+${conflicts.map((f) => `  - ${join3(targetDir, f)}`).join("\n")}`
+    );
+  }
+  for (const rel of written) {
+    const target = join3(targetDir, rel);
+    mkdirSync3(join3(target, ".."), { recursive: true });
+    writeFileSync3(target, readFileSync5(join3(sourceDir, rel), "utf8"));
+  }
+  const skills = [...new Set(files.map((f) => f.split(/[\\/]/)[0]))].sort();
+  out.log(`skills: ${skills.join(", ")}`);
+  out.log(`installed ${written.length} file(s) to ${targetDir}${unchanged.length ? ` (${unchanged.length} unchanged)` : ""}`);
+  return { targetDir, written, unchanged };
+}
+function listFiles(dir) {
+  if (!existsSync6(dir)) return [];
+  const results = [];
+  const walk = (current) => {
+    for (const entry of readdirSync(current, { withFileTypes: true })) {
+      const path = join3(current, entry.name);
+      if (entry.isDirectory()) walk(path);
+      else results.push(relative2(dir, path));
+    }
+  };
+  walk(dir);
+  return results.sort();
 }
 
 // src/smoke.ts
@@ -672,7 +948,7 @@ async function safeText2(res) {
 }
 
 // src/cli.ts
-import { readFileSync as readFileSync3 } from "fs";
+import { readFileSync as readFileSync6 } from "fs";
 async function runCli(argv = process.argv.slice(2)) {
   const parsed = parseArgv(argv);
   const command = parsed.positionals[0] ?? "help";
@@ -722,6 +998,27 @@ async function runCli(argv = process.argv.slice(2)) {
     });
     return;
   }
+  if (command === "skill") {
+    const sub = parsed.positionals[1];
+    if (sub !== "install") throw new Error(`unknown skill subcommand "${sub ?? ""}". Try "odla-ai skill install".`);
+    installSkill({
+      dir: stringOpt(parsed.options.dir),
+      global: parsed.options.global === true,
+      force: parsed.options.force === true
+    });
+    return;
+  }
+  if (command === "secrets") {
+    const sub = parsed.positionals[1];
+    if (sub !== "push") throw new Error(`unknown secrets subcommand "${sub ?? ""}". Try "odla-ai secrets push --env dev".`);
+    await secretsPush({
+      configPath: stringOpt(parsed.options.config) ?? "odla.config.mjs",
+      env: requiredString(parsed.options.env, "--env"),
+      dryRun: parsed.options["dry-run"] === true,
+      yes: parsed.options.yes === true
+    });
+    return;
+  }
   throw new Error(`unknown command "${command}". Run "odla-ai help".`);
 }
 function parseArgv(argv) {
@@ -780,7 +1077,7 @@ function listOpt(value) {
   return values.flatMap((item) => item.split(",")).map((item) => item.trim()).filter(Boolean);
 }
 function cliVersion() {
-  const pkg = JSON.parse(readFileSync3(new URL("../package.json", import.meta.url), "utf8"));
+  const pkg = JSON.parse(readFileSync6(new URL("../package.json", import.meta.url), "utf8"));
   return pkg.version ?? "unknown";
 }
 function printHelp() {
@@ -791,6 +1088,8 @@ Usage:
   odla-ai doctor [--config odla.config.mjs]
   odla-ai provision [--config odla.config.mjs] [--dry-run] [--open|--no-open] [--rotate-keys] [--write-dev-vars[=path]]
   odla-ai smoke [--config odla.config.mjs] [--env dev]
+  odla-ai skill install [--dir <project>] [--global] [--force]
+  odla-ai secrets push --env <env> [--config odla.config.mjs] [--dry-run] [--yes]
   odla-ai version
 
 Commands:
@@ -798,6 +1097,8 @@ Commands:
   doctor      Validate and summarize the project config without network calls.
   provision   Register the app, enable services, push schema/rules, configure AI/auth.
   smoke       Verify local credentials, public-config, live schema, and db aggregate.
+  skill       Install the bundled Claude Code skills into .claude/skills/.
+  secrets     Push the env's db key into the Worker via wrangler, stdin-piped.
   version     Print the CLI version.
 
 Safety:
@@ -809,10 +1110,13 @@ Safety:
 }
 
 export {
+  redactSecrets,
   doctor,
   initProject,
   provision,
+  secretsPush,
+  installSkill,
   smoke,
   runCli
 };
-//# sourceMappingURL=chunk-AXCZKIVY.js.map
+//# sourceMappingURL=chunk-5J4LKP37.js.map