@odla-ai/cli 0.1.0 → 0.2.0

package/dist/index.cjs

@@ -33,8 +33,11 @@ var index_exports = {};
 __export(index_exports, {
   doctor: () => doctor,
   initProject: () => initProject,
+  installSkill: () => installSkill,
   provision: () => provision,
+  redactSecrets: () => redactSecrets,
   runCli: () => runCli,
+  secretsPush: () => secretsPush,
   smoke: () => smoke
 });
 module.exports = __toCommonJS(index_exports);
@@ -44,7 +47,7 @@ var getImportMetaUrl = () => typeof document === "undefined" ? new URL(`file:${_
 var importMetaUrl = /* @__PURE__ */ getImportMetaUrl();
 
 // src/cli.ts
-var import_node_fs4 = require("fs");
+var import_node_fs7 = require("fs");
 
 // src/config.ts
 var import_node_fs = require("fs");
@@ -151,6 +154,181 @@ function unique(values) {
   return [...new Set(values.filter(Boolean))];
 }
 
+// src/doctor-checks.ts
+var import_node_child_process2 = require("child_process");
+var import_node_fs3 = require("fs");
+var import_node_path3 = require("path");
+
+// src/redact.ts
+var REPLACEMENTS = [
+  [/odla_(sk|dev)_[A-Za-z0-9._-]+/g, "odla_$1_[redacted]"],
+  [/\bsk_(live|test)_[A-Za-z0-9]+/g, "sk_$1_[redacted]"],
+  [/\bsk-[A-Za-z0-9._-]+/g, "sk-[redacted]"],
+  [/\bwhsec_[A-Za-z0-9+/=]+/g, "whsec_[redacted]"],
+  [/\b(ghp|gho|github_pat)_[A-Za-z0-9_]+/g, "$1_[redacted]"],
+  [/\bAKIA[A-Z0-9]{12,}/g, "AKIA[redacted]"]
+];
+function redactSecrets(value) {
+  let result = value;
+  for (const [pattern, replacement] of REPLACEMENTS) result = result.replace(pattern, replacement);
+  return result;
+}
+function looksSecret(value) {
+  return redactSecrets(value) !== value || value.includes("-----BEGIN");
+}
+
+// src/wrangler.ts
+var import_node_child_process = require("child_process");
+var import_node_fs2 = require("fs");
+var import_node_path2 = require("path");
+var defaultRunner = (cmd, args, opts) => new Promise((resolvePromise, reject) => {
+  const child = (0, import_node_child_process.spawn)(cmd, args, { cwd: opts?.cwd, stdio: ["pipe", "pipe", "pipe"] });
+  let stdout = "";
+  let stderr = "";
+  child.stdout.on("data", (chunk) => stdout += chunk.toString());
+  child.stderr.on("data", (chunk) => stderr += chunk.toString());
+  child.on("error", reject);
+  child.on("close", (code) => resolvePromise({ code: code ?? 1, stdout, stderr }));
+  child.stdin.end(opts?.input ?? "");
+});
+var WRANGLER_CONFIG_FILES = ["wrangler.jsonc", "wrangler.json", "wrangler.toml"];
+function findWranglerConfig(rootDir) {
+  for (const name of WRANGLER_CONFIG_FILES) {
+    const path = (0, import_node_path2.join)(rootDir, name);
+    if ((0, import_node_fs2.existsSync)(path)) return path;
+  }
+  return null;
+}
+function readWranglerConfig(path) {
+  if (path.endsWith(".toml")) return null;
+  try {
+    return JSON.parse(stripJsonComments((0, import_node_fs2.readFileSync)(path, "utf8")));
+  } catch {
+    return null;
+  }
+}
+function stripJsonComments(text) {
+  let result = "";
+  let inString = false;
+  for (let i = 0; i < text.length; i++) {
+    const ch = text[i];
+    if (inString) {
+      result += ch;
+      if (ch === "\\") {
+        result += text[i + 1] ?? "";
+        i++;
+      } else if (ch === '"') {
+        inString = false;
+      }
+      continue;
+    }
+    if (ch === '"') {
+      inString = true;
+      result += ch;
+      continue;
+    }
+    if (ch === "/" && text[i + 1] === "/") {
+      while (i < text.length && text[i] !== "\n") i++;
+      result += "\n";
+      continue;
+    }
+    if (ch === "/" && text[i + 1] === "*") {
+      i += 2;
+      while (i < text.length && !(text[i] === "*" && text[i + 1] === "/")) i++;
+      i++;
+      continue;
+    }
+    result += ch;
+  }
+  return result;
+}
+async function wranglerLoggedIn(run, cwd) {
+  try {
+    const result = await run("npx", ["wrangler", "whoami"], { cwd });
+    return result.code === 0 && !/not authenticated/i.test(`${result.stdout}${result.stderr}`);
+  } catch {
+    return false;
+  }
+}
+function wranglerPutSecret(run, opts) {
+  const args = ["wrangler", "secret", "put", opts.name, ...opts.env ? ["--env", opts.env] : []];
+  return run("npx", args, { input: opts.value, cwd: opts.cwd });
+}
+
+// src/doctor-checks.ts
+function lintRules(rules, entities, publicRead) {
+  const warnings = [];
+  if (!rules) return warnings;
+  for (const [ns, actions] of Object.entries(rules)) {
+    for (const [action, expr] of Object.entries(actions)) {
+      if (typeof expr !== "string" || expr.trim() !== "true") continue;
+      if (action === "view" && publicRead.includes(ns)) continue;
+      warnings.push(
+        action === "view" ? `rules.${ns}.view is "true" \u2014 public read; add "${ns}" to db.publicRead if intended` : `rules.${ns}.${action} is "true" \u2014 any client can ${action} ${ns} rows`
+      );
+    }
+  }
+  for (const entity of entities) {
+    if (!(entity in rules)) warnings.push(`schema entity "${entity}" has no rules entry (all client access denied)`);
+  }
+  return warnings;
+}
+var defaultExec = (cmd, args, cwd) => (0, import_node_child_process2.execFileSync)(cmd, args, { cwd, encoding: "utf8", stdio: ["ignore", "pipe", "ignore"] });
+function trackedSecretFiles(rootDir, exec = defaultExec) {
+  let output;
+  try {
+    output = exec("git", ["ls-files", "--", ".dev.vars", ".odla"], rootDir);
+  } catch {
+    return [];
+  }
+  return output.split(/\r?\n/).filter(Boolean).map((path) => `${path} is tracked by git \u2014 run "git rm --cached ${path}" and commit; it belongs in .gitignore`);
+}
+function wranglerWarnings(rootDir) {
+  const configPath = findWranglerConfig(rootDir);
+  if (!configPath) return [];
+  const config = readWranglerConfig(configPath);
+  if (!config) return [];
+  const warnings = [];
+  const blocks = [{ label: "", block: config }];
+  const envs = config.env;
+  if (envs && typeof envs === "object") {
+    for (const [name, block] of Object.entries(envs)) {
+      if (block && typeof block === "object") blocks.push({ label: `env.${name}.`, block });
+    }
+  }
+  for (const { label, block } of blocks) {
+    const assets = block.assets;
+    if (assets?.directory) {
+      const dir = (0, import_node_path3.resolve)(rootDir, assets.directory);
+      if (dir === (0, import_node_path3.resolve)(rootDir)) {
+        warnings.push(`${label}assets.directory is the project root \u2014 point it at a dedicated build dir (wrangler dev fails with "spawn EBADF")`);
+      } else if ((0, import_node_fs3.existsSync)((0, import_node_path3.join)(dir, "node_modules"))) {
+        warnings.push(`${label}assets.directory contains node_modules \u2014 wrangler dev's watcher will exhaust file descriptors`);
+      }
+    }
+    const vars = block.vars;
+    if (vars && typeof vars === "object") {
+      for (const [name, value] of Object.entries(vars)) {
+        if (name === "ODLA_API_KEY" || typeof value === "string" && looksSecret(value)) {
+          warnings.push(`wrangler ${label}vars.${name} looks like a secret \u2014 use "odla-ai secrets push" / wrangler secret put, never vars`);
+        }
+      }
+    }
+  }
+  const pkg = readPackageJson(rootDir);
+  if (pkg && typeof pkg.scripts === "object" && pkg.scripts && "deploy" in pkg.scripts) {
+    warnings.push(`package.json has a script named "deploy" \u2014 CI may auto-deploy it; rename to deploy:app`);
+  }
+  return warnings;
+}
+function readPackageJson(rootDir) {
+  try {
+    return JSON.parse((0, import_node_fs3.readFileSync)((0, import_node_path3.join)(rootDir, "package.json"), "utf8"));
+  } catch {
+    return null;
+  }
+}
+
 // src/doctor.ts
 async function doctor(options) {
   const out = options.stdout ?? console;
@@ -183,6 +361,9 @@ async function doctor(options) {
     }
   }
   if (cfg.ai?.keyEnv && !process.env[cfg.ai.keyEnv]) warnings.push(`${cfg.ai.keyEnv} is not set; provision will skip provider key storage`);
+  warnings.push(...lintRules(rules, entities, cfg.db?.publicRead ?? []));
+  warnings.push(...trackedSecretFiles(cfg.rootDir));
+  warnings.push(...wranglerWarnings(cfg.rootDir));
   if (warnings.length) {
     out.log("");
     out.log("warnings:");
@@ -193,25 +374,25 @@ async function doctor(options) {
 }
 
 // src/init.ts
-var import_node_fs3 = require("fs");
-var import_node_path3 = require("path");
+var import_node_fs5 = require("fs");
+var import_node_path5 = require("path");
 
 // src/local.ts
-var import_node_fs2 = require("fs");
-var import_node_path2 = require("path");
+var import_node_fs4 = require("fs");
+var import_node_path4 = require("path");
 var GITIGNORE_LINES = [".odla/*.local.json", ".odla/dev-token.json", ".dev.vars"];
 function readJsonFile(path) {
   try {
-    return JSON.parse((0, import_node_fs2.readFileSync)(path, "utf8"));
+    return JSON.parse((0, import_node_fs4.readFileSync)(path, "utf8"));
   } catch {
     return null;
   }
 }
 function writePrivateJson(path, value) {
-  (0, import_node_fs2.mkdirSync)((0, import_node_path2.dirname)(path), { recursive: true });
-  (0, import_node_fs2.writeFileSync)(path, `${JSON.stringify(value, null, 2)}
+  (0, import_node_fs4.mkdirSync)((0, import_node_path4.dirname)(path), { recursive: true });
+  (0, import_node_fs4.writeFileSync)(path, `${JSON.stringify(value, null, 2)}
 `);
-  (0, import_node_fs2.chmodSync)(path, 384);
+  (0, import_node_fs4.chmodSync)(path, 384);
 }
 function readCredentials(path) {
   return readJsonFile(path);
@@ -236,12 +417,12 @@ function mergeCredential(current, update) {
   return next;
 }
 function ensureGitignore(rootDir) {
-  const path = (0, import_node_path2.resolve)(rootDir, ".gitignore");
-  const existing = (0, import_node_fs2.existsSync)(path) ? (0, import_node_fs2.readFileSync)(path, "utf8") : "";
+  const path = (0, import_node_path4.resolve)(rootDir, ".gitignore");
+  const existing = (0, import_node_fs4.existsSync)(path) ? (0, import_node_fs4.readFileSync)(path, "utf8") : "";
   const missing = GITIGNORE_LINES.filter((line) => !existing.split(/\r?\n/).includes(line));
   if (missing.length === 0) return;
   const prefix = existing && !existing.endsWith("\n") ? "\n" : "";
-  (0, import_node_fs2.writeFileSync)(path, `${existing}${prefix}${missing.join("\n")}
+  (0, import_node_fs4.writeFileSync)(path, `${existing}${prefix}${missing.join("\n")}
 `);
 }
 function writeDevVars(path, credentials, env) {
@@ -255,22 +436,22 @@ function writeDevVars(path, credentials, env) {
     `ODLA_TENANT="${entry.tenantId}"`,
     `ODLA_API_KEY="${entry.dbKey}"`
   ];
-  (0, import_node_fs2.mkdirSync)((0, import_node_path2.dirname)(path), { recursive: true });
-  (0, import_node_fs2.writeFileSync)(path, `${lines.join("\n")}
+  (0, import_node_fs4.mkdirSync)((0, import_node_path4.dirname)(path), { recursive: true });
+  (0, import_node_fs4.writeFileSync)(path, `${lines.join("\n")}
 `);
-  (0, import_node_fs2.chmodSync)(path, 384);
+  (0, import_node_fs4.chmodSync)(path, 384);
 }
 function displayPath(path, rootDir = process.cwd()) {
-  const rel = (0, import_node_path2.relative)(rootDir, path);
+  const rel = (0, import_node_path4.relative)(rootDir, path);
   return rel && !rel.startsWith("..") ? rel : path;
 }
 
 // src/init.ts
 function initProject(options) {
   const out = options.stdout ?? console;
-  const rootDir = (0, import_node_path3.resolve)(options.rootDir ?? process.cwd());
-  const configPath = (0, import_node_path3.resolve)(rootDir, options.configPath ?? "odla.config.mjs");
-  if ((0, import_node_fs3.existsSync)(configPath) && !options.force) {
+  const rootDir = (0, import_node_path5.resolve)(options.rootDir ?? process.cwd());
+  const configPath = (0, import_node_path5.resolve)(rootDir, options.configPath ?? "odla.config.mjs");
+  if ((0, import_node_fs5.existsSync)(configPath) && !options.force) {
     throw new Error(`${configPath} already exists. Pass --force to overwrite.`);
   }
   if (!/^[a-z0-9][a-z0-9-]*$/.test(options.appId)) {
@@ -279,20 +460,20 @@ function initProject(options) {
   const envs = options.envs?.length ? options.envs : ["prod", "dev"];
   const services = options.services?.length ? options.services : ["db", "ai"];
   const aiProvider = options.aiProvider ?? "anthropic";
-  (0, import_node_fs3.mkdirSync)((0, import_node_path3.dirname)(configPath), { recursive: true });
-  (0, import_node_fs3.mkdirSync)((0, import_node_path3.resolve)(rootDir, "src/odla"), { recursive: true });
-  (0, import_node_fs3.mkdirSync)((0, import_node_path3.resolve)(rootDir, ".odla"), { recursive: true });
-  (0, import_node_fs3.writeFileSync)(configPath, configTemplate({ appId: options.appId, name: options.name, envs, services, aiProvider }));
-  writeIfMissing((0, import_node_path3.resolve)(rootDir, "src/odla/schema.mjs"), schemaTemplate());
-  writeIfMissing((0, import_node_path3.resolve)(rootDir, "src/odla/rules.mjs"), rulesTemplate());
+  (0, import_node_fs5.mkdirSync)((0, import_node_path5.dirname)(configPath), { recursive: true });
+  (0, import_node_fs5.mkdirSync)((0, import_node_path5.resolve)(rootDir, "src/odla"), { recursive: true });
+  (0, import_node_fs5.mkdirSync)((0, import_node_path5.resolve)(rootDir, ".odla"), { recursive: true });
+  (0, import_node_fs5.writeFileSync)(configPath, configTemplate({ appId: options.appId, name: options.name, envs, services, aiProvider }));
+  writeIfMissing((0, import_node_path5.resolve)(rootDir, "src/odla/schema.mjs"), schemaTemplate());
+  writeIfMissing((0, import_node_path5.resolve)(rootDir, "src/odla/rules.mjs"), rulesTemplate());
   ensureGitignore(rootDir);
   out.log(`created ${relativeDisplay(configPath, rootDir)}`);
   out.log("created src/odla/schema.mjs and src/odla/rules.mjs");
   out.log("updated .gitignore for local odla credentials");
 }
 function writeIfMissing(path, text) {
-  if ((0, import_node_fs3.existsSync)(path)) return;
-  (0, import_node_fs3.writeFileSync)(path, text);
+  if ((0, import_node_fs5.existsSync)(path)) return;
+  (0, import_node_fs5.writeFileSync)(path, text);
 }
 function configTemplate(input) {
   return `export default {
@@ -375,7 +556,7 @@ function relativeDisplay(path, rootDir) {
 // src/provision.ts
 var import_apps = require("@odla-ai/apps");
 var import_ai = require("@odla-ai/ai");
-var import_node_path4 = require("path");
+var import_node_path6 = require("path");
 var import_node_process3 = __toESM(require("process"), 1);
 
 // src/token.ts
@@ -383,12 +564,12 @@ var import_db = require("@odla-ai/db");
 var import_node_process2 = __toESM(require("process"), 1);
 
 // src/open.ts
-var import_node_child_process = require("child_process");
+var import_node_child_process3 = require("child_process");
 var import_node_process = __toESM(require("process"), 1);
 async function openUrl(url, options = {}) {
   const command = openerFor(options.platform ?? import_node_process.default.platform);
-  const doSpawn = options.spawnImpl ?? import_node_child_process.spawn;
-  await new Promise((resolve5, reject) => {
+  const doSpawn = options.spawnImpl ?? import_node_child_process3.spawn;
+  await new Promise((resolve7, reject) => {
     const child = doSpawn(command.cmd, [...command.args, url], {
       stdio: "ignore",
       detached: true
@@ -396,7 +577,7 @@ async function openUrl(url, options = {}) {
     child.once("error", reject);
     child.once("spawn", () => {
       child.unref();
-      resolve5();
+      resolve7();
     });
   });
 }
@@ -623,17 +804,115 @@ function defaultSecretName(provider) {
 function resolveWriteDevVarsTarget(cfg, requested) {
   if (!requested) return null;
   if (requested === true) return cfg.local.devVarsFile;
-  return (0, import_node_path4.resolve)((0, import_node_path4.dirname)(cfg.configPath), requested);
+  return (0, import_node_path6.resolve)((0, import_node_path6.dirname)(cfg.configPath), requested);
 }
 async function safeText(res) {
   try {
-    return redact((await res.text()).slice(0, 500));
+    return redactSecrets((await res.text()).slice(0, 500));
   } catch {
     return "";
   }
 }
-function redact(value) {
-  return value.replace(/odla_(sk|dev)_[A-Za-z0-9._-]+/g, "odla_$1_[redacted]").replace(/sk-[A-Za-z0-9._-]+/g, "sk-[redacted]");
+
+// src/secrets.ts
+var PROD_ENV_NAMES = /* @__PURE__ */ new Set(["prod", "production"]);
+async function secretsPush(options) {
+  const out = options.stdout ?? console;
+  const cfg = await loadProjectConfig(options.configPath);
+  const env = options.env;
+  if (!cfg.envs.includes(env)) {
+    throw new Error(`env "${env}" is not in config envs (${cfg.envs.join(", ")})`);
+  }
+  if (PROD_ENV_NAMES.has(env) && !options.yes) {
+    throw new Error(`refusing to push a secret to "${env}" without --yes`);
+  }
+  const credentialsPath = displayPath(cfg.local.credentialsFile, cfg.rootDir);
+  const credentials = readCredentials(cfg.local.credentialsFile);
+  if (!credentials) throw new Error(`no credentials at ${credentialsPath} \u2014 run "odla-ai provision" first`);
+  if (credentials.appId !== cfg.app.id) {
+    throw new Error(`credentials at ${credentialsPath} are for "${credentials.appId}", not "${cfg.app.id}"`);
+  }
+  const dbKey = credentials.envs[env]?.dbKey;
+  if (!dbKey) throw new Error(`no db key for env "${env}" in ${credentialsPath} \u2014 run "odla-ai provision" first`);
+  const wranglerConfig = findWranglerConfig(cfg.rootDir);
+  if (!wranglerConfig) {
+    throw new Error(`no wrangler config found in ${cfg.rootDir} (wrangler.jsonc, wrangler.json, or wrangler.toml)`);
+  }
+  const wranglerEnv = PROD_ENV_NAMES.has(env) ? void 0 : env;
+  const target = wranglerEnv ? `wrangler env "${wranglerEnv}"` : "the top-level (prod) wrangler env";
+  if (options.dryRun) {
+    out.log(`dry run: would push ODLA_API_KEY (${redactSecrets(dbKey)}) to ${target}`);
+    return;
+  }
+  const run = options.runner ?? defaultRunner;
+  if (!await wranglerLoggedIn(run, cfg.rootDir)) {
+    throw new Error(`wrangler is not logged in \u2014 run "wrangler login" (a browser step for the human)`);
+  }
+  const result = await wranglerPutSecret(run, { name: "ODLA_API_KEY", value: dbKey, env: wranglerEnv, cwd: cfg.rootDir });
+  if (result.code !== 0) {
+    throw new Error(`wrangler secret put failed (exit ${result.code}): ${redactSecrets(`${result.stderr || result.stdout}`.trim())}`);
+  }
+  out.log(`ODLA_API_KEY pushed to ${target} (value read from ${credentialsPath}, never echoed)`);
+}
+
+// src/skill.ts
+var import_node_fs6 = require("fs");
+var import_node_os = require("os");
+var import_node_path7 = require("path");
+var import_node_url2 = require("url");
+function installSkill(options = {}) {
+  const out = options.stdout ?? console;
+  const sourceDir = options.sourceDir ?? (0, import_node_url2.fileURLToPath)(new URL("../skills", importMetaUrl));
+  const targetDir = options.global ? (0, import_node_path7.join)(options.homeDir ?? (0, import_node_os.homedir)(), ".claude", "skills") : (0, import_node_path7.resolve)(options.dir ?? process.cwd(), ".claude", "skills");
+  const files = listFiles(sourceDir);
+  if (files.length === 0) throw new Error(`no bundled skills found at ${sourceDir}`);
+  const written = [];
+  const unchanged = [];
+  const conflicts = [];
+  for (const rel of files) {
+    const target = (0, import_node_path7.join)(targetDir, rel);
+    const source = (0, import_node_fs6.readFileSync)((0, import_node_path7.join)(sourceDir, rel), "utf8");
+    if ((0, import_node_fs6.existsSync)(target)) {
+      const current = (0, import_node_fs6.readFileSync)(target, "utf8");
+      if (current === source) {
+        unchanged.push(rel);
+        continue;
+      }
+      if (!options.force) {
+        conflicts.push(rel);
+        continue;
+      }
+    }
+    written.push(rel);
+  }
+  if (conflicts.length > 0) {
+    throw new Error(
+      `skill files modified locally (re-run with --force to overwrite):
+${conflicts.map((f) => `  - ${(0, import_node_path7.join)(targetDir, f)}`).join("\n")}`
+    );
+  }
+  for (const rel of written) {
+    const target = (0, import_node_path7.join)(targetDir, rel);
+    (0, import_node_fs6.mkdirSync)((0, import_node_path7.join)(target, ".."), { recursive: true });
+    (0, import_node_fs6.writeFileSync)(target, (0, import_node_fs6.readFileSync)((0, import_node_path7.join)(sourceDir, rel), "utf8"));
+  }
+  const skills = [...new Set(files.map((f) => f.split(/[\\/]/)[0]))].sort();
+  out.log(`skills: ${skills.join(", ")}`);
+  out.log(`installed ${written.length} file(s) to ${targetDir}${unchanged.length ? ` (${unchanged.length} unchanged)` : ""}`);
+  return { targetDir, written, unchanged };
+}
+function listFiles(dir) {
+  if (!(0, import_node_fs6.existsSync)(dir)) return [];
+  const results = [];
+  const walk = (current) => {
+    for (const entry of (0, import_node_fs6.readdirSync)(current, { withFileTypes: true })) {
+      const path = (0, import_node_path7.join)(current, entry.name);
+      if (entry.isDirectory()) walk(path);
+      else results.push((0, import_node_path7.relative)(dir, path));
+    }
+  };
+  walk(dir);
+  return results.sort();
 }
 
 // src/smoke.ts
@@ -767,6 +1046,27 @@ async function runCli(argv = process.argv.slice(2)) {
     });
     return;
   }
+  if (command === "skill") {
+    const sub = parsed.positionals[1];
+    if (sub !== "install") throw new Error(`unknown skill subcommand "${sub ?? ""}". Try "odla-ai skill install".`);
+    installSkill({
+      dir: stringOpt(parsed.options.dir),
+      global: parsed.options.global === true,
+      force: parsed.options.force === true
+    });
+    return;
+  }
+  if (command === "secrets") {
+    const sub = parsed.positionals[1];
+    if (sub !== "push") throw new Error(`unknown secrets subcommand "${sub ?? ""}". Try "odla-ai secrets push --env dev".`);
+    await secretsPush({
+      configPath: stringOpt(parsed.options.config) ?? "odla.config.mjs",
+      env: requiredString(parsed.options.env, "--env"),
+      dryRun: parsed.options["dry-run"] === true,
+      yes: parsed.options.yes === true
+    });
+    return;
+  }
   throw new Error(`unknown command "${command}". Run "odla-ai help".`);
 }
 function parseArgv(argv) {
@@ -825,7 +1125,7 @@ function listOpt(value) {
   return values.flatMap((item) => item.split(",")).map((item) => item.trim()).filter(Boolean);
 }
 function cliVersion() {
-  const pkg = JSON.parse((0, import_node_fs4.readFileSync)(new URL("../package.json", importMetaUrl), "utf8"));
+  const pkg = JSON.parse((0, import_node_fs7.readFileSync)(new URL("../package.json", importMetaUrl), "utf8"));
   return pkg.version ?? "unknown";
 }
 function printHelp() {
@@ -836,6 +1136,8 @@ Usage:
   odla-ai doctor [--config odla.config.mjs]
   odla-ai provision [--config odla.config.mjs] [--dry-run] [--open|--no-open] [--rotate-keys] [--write-dev-vars[=path]]
   odla-ai smoke [--config odla.config.mjs] [--env dev]
+  odla-ai skill install [--dir <project>] [--global] [--force]
+  odla-ai secrets push --env <env> [--config odla.config.mjs] [--dry-run] [--yes]
   odla-ai version
 
 Commands:
@@ -843,6 +1145,8 @@ Commands:
   doctor      Validate and summarize the project config without network calls.
   provision   Register the app, enable services, push schema/rules, configure AI/auth.
   smoke       Verify local credentials, public-config, live schema, and db aggregate.
+  skill       Install the bundled Claude Code skills into .claude/skills/.
+  secrets     Push the env's db key into the Worker via wrangler, stdin-piped.
   version     Print the CLI version.
 
 Safety:
@@ -856,8 +1160,11 @@ Safety:
 0 && (module.exports = {
   doctor,
   initProject,
+  installSkill,
   provision,
+  redactSecrets,
   runCli,
+  secretsPush,
   smoke
 });
 //# sourceMappingURL=index.cjs.map