@odla-ai/cli 0.29.0 → 0.30.0

package/README.md

@@ -482,8 +482,8 @@ commands continue to default to the sandbox.
 `provision` performs the standard safe setup flow:
 
 When using `--push-secrets`, create the Worker and its Wrangler config first.
-The CLI checks that config and `wrangler whoami` before it issues or rotates a
-shown-once credential.
+The CLI checks that config and `wrangler whoami` before it issues a shown-once
+credential set.
 
 1. Gets an `odla_dev_...` token by email-bound device handshake, or reuses
    `ODLA_DEV_TOKEN` / `.odla/dev-token.json`. A fresh handshake requires
@@ -521,8 +521,9 @@ shown-once credential.
    reservation approved in step 1; it is not ambient project-creation authority.
 3. Enables configured services in every configured environment. Calendar
    config is normalized per env and fixed to Google read-only access.
-4. Mints or reuses each env's configured service credentials: an odla-db app
-   key for `db` and an ingest token for `o11y`.
+4. For local development, mints or reuses that developer's configured service
+   credentials. Multiple developers may hold independent DB/o11y credentials
+   for the same shared sandbox tenant.
 5. Collision-checks and merges declared integration schema/rule fragments,
    pushes the composed database contract, and creates integration seeds only
    when their natural-key rows are absent.
@@ -533,23 +534,40 @@ shown-once credential.
    exact Google OAuth endpoint (or a same-platform interstitial). The human completes consent there;
    provision follows the exact attempt through initial sync. OAuth codes and
    refresh tokens never enter the CLI, repo, chat, or app.
-8. Writes `.odla/credentials.local.json` with mode `0600`.
+8. Local-only provisioning writes `.odla/credentials.local.json` with mode
+   `0600`. A deployment run with `--push-secrets` does not write runtime
+   credential plaintext there.
 9. With `--write-dev-vars`, writes the local Worker values to `.dev.vars`; with
-   `--push-secrets`, transfers the configured service secrets to the matching
-   deployed Worker environment over Wrangler stdin.
-
-Plain reruns are idempotent. Pass `--rotate-o11y-token` only when deliberately
-invalidating and replacing the o11y token; combine it with `--push-secrets` so
-the replacement reaches the Worker in the same run. `--rotate-keys` remains the
-broader credential rotation. Production mutation or secret transfer requires
-`--yes`. Pass `--no-write-credentials` to skip writing the local credentials
-file; it cannot be combined with an operation that would issue a shown-once
-credential.
-
-Rotation and Wrangler secret replacement are not a distributed transaction.
-The CLI preflights Wrangler first and persists the replacement before pushing;
-if that final push still fails, follow the printed `secrets push --env ...`
-retry. Do not run the rotation flag again.
+   `--push-secrets`, binds a fresh additive credential set to the exact
+   Cloudflare account/script/environment, transfers both values in one
+   `wrangler secret bulk` stdin payload, and commits a receipt. A failed push
+   aborts the session and revokes partial issuance.
+
+Plain reruns are idempotent at the tenant/configuration layer. Each deployment
+receives new, independently revocable runtime credentials; it never rotates a
+sibling developer or Worker. `--rotate-o11y-token` remains a destructive legacy
+recovery operation for locally cached credentials, and `--rotate-keys` remains
+the broader local rotation. Neither rotation flag may be combined with
+`--push-secrets`. Production mutation or secret transfer requires
+`--yes`. `--no-write-credentials` is valid with `--push-secrets` because the
+deployment path is memory-only by design.
+
+Registry staging and Wrangler installation use a short-lived receipt protocol.
+The CLI preflights the exact target, issues additive credentials, sends one
+bulk payload, and commits only after Wrangler succeeds. Failure revokes staged
+credentials; retrying creates a new bounded session and never invalidates a
+working sibling runtime.
+
+Inventory and retire one successful deployment without disturbing any sibling:
+
+```sh
+npx @odla-ai/cli credentials list --env dev
+npx @odla-ai/cli credentials revoke <receipt-id>
+```
+
+The inventory contains only receipt, target, state, and timestamp metadata.
+Revocation uses the receipt's exact DB and o11y credential ids; no value is
+retrieved or rotated.
 
 ### Application capability integrations
 
@@ -797,9 +815,10 @@ in an agent's transcript. It preflights `wrangler whoami` and the presence of a
 wrangler config file. The env `prod`/`production` targets the top-level
 wrangler environment (no `--env` flag is passed to Wrangler) and requires
 `--yes`; every other env maps to `wrangler --env <name>`. `--dry-run` prints a
-redacted plan without spawning anything. For the normal path, use
-`provision --write-dev-vars --push-secrets` so service enablement, credential
-issuance, local config, and deployed secret transfer stay one composition.
+redacted plan without spawning anything. It is only for an already-saved local
+credential. For a new Worker or a lost local plaintext, use
+`provision --push-secrets`: the handshake authorizes new target-bound
+credentials and no local production cache is required.
 
 `secrets set <name> --env <env>` stores one named secret in that env's tenant
 vault — the same write-only slot Studio's Secrets panel fills (for example

package/dist/bin.cjs

@@ -4376,6 +4376,41 @@ async function wranglerLoggedIn(run, cwd) {
     return false;
   }
 }
+async function wranglerRuntimeTarget(run, opts) {
+  const configPath = findWranglerConfig(opts.cwd);
+  if (!configPath) throw new Error(`no wrangler config found in ${opts.cwd}`);
+  const config = readWranglerConfig(configPath);
+  if (!config) throw new Error("runtime credential delivery requires wrangler.json or wrangler.jsonc");
+  const baseName = typeof config.name === "string" ? config.name : "";
+  const envs = config.env && typeof config.env === "object" && !Array.isArray(config.env) ? config.env : {};
+  const envConfig = opts.env && envs[opts.env] && typeof envs[opts.env] === "object" ? envs[opts.env] : {};
+  const explicitName = typeof envConfig.name === "string" ? envConfig.name : "";
+  const serviceEnvironments = config.legacy_env === false;
+  if (serviceEnvironments && explicitName) {
+    throw new Error("env.<name>.name is not allowed when wrangler legacy_env is false");
+  }
+  const scriptName = serviceEnvironments ? baseName : explicitName || (opts.env ? `${baseName}-${opts.env}` : baseName);
+  if (!/^[a-z0-9][a-z0-9_-]{0,62}$/.test(scriptName)) {
+    throw new Error("wrangler config must resolve an exact Worker name before credentials are issued");
+  }
+  const configuredAccount = typeof envConfig.account_id === "string" ? envConfig.account_id : typeof config.account_id === "string" ? config.account_id : "";
+  const whoami = await run("npx", ["wrangler", "whoami"], { cwd: opts.cwd });
+  if (whoami.code !== 0 || /not authenticated/i.test(`${whoami.stdout}${whoami.stderr}`)) {
+    throw new Error(`wrangler is not logged in \u2014 run "wrangler login" (a browser step for the human)`);
+  }
+  const discovered = [...new Set(`${whoami.stdout}
+${whoami.stderr}`.match(/\b[a-f0-9]{32}\b/gi)?.map((id) => id.toLowerCase()) ?? [])];
+  const accountId = configuredAccount.toLowerCase() || (discovered.length === 1 ? discovered[0] : "");
+  if (!/^[a-f0-9]{32}$/.test(accountId) || configuredAccount && discovered.length > 0 && !discovered.includes(accountId)) {
+    throw new Error("Wrangler account is ambiguous or does not match account_id in the config");
+  }
+  return {
+    provider: "cloudflare",
+    accountId,
+    scriptName,
+    ...opts.env ? { environment: opts.env } : {}
+  };
+}
 function wranglerPutSecret(run, opts) {
   const args = [
     "wrangler",
@@ -4387,6 +4422,16 @@ function wranglerPutSecret(run, opts) {
   ];
   return run("npx", args, { input: opts.value, cwd: opts.cwd });
 }
+function wranglerBulkSecrets(run, opts) {
+  const args = [
+    "wrangler",
+    "secret",
+    "bulk",
+    ...opts.env ? ["--env", opts.env] : [],
+    ...opts.configPath ? ["--config", opts.configPath] : []
+  ];
+  return run("npx", args, { input: JSON.stringify(opts.secrets), cwd: opts.cwd });
+}
 var import_node_child_process2, import_node_fs12, import_node_path11, defaultRunner, WRANGLER_CONFIG_FILES;
 var init_wrangler = __esm({
   "src/wrangler.ts"() {
@@ -4947,9 +4992,6 @@ var init_init = __esm({
 async function secretsPush(options) {
   await secretsPushImpl(options, true);
 }
-async function secretsPushAfterPreflight(options) {
-  await secretsPushImpl(options, false);
-}
 async function secretsPushImpl(options, preflight) {
   const out = options.stdout ?? console;
   const cfg = await loadProjectConfig(options.configPath);
@@ -9501,6 +9543,65 @@ var init_context_command = __esm({
   }
 });
 
+// src/credential-command.ts
+async function responseError(response2) {
+  return redactSecrets((await response2.text()).slice(0, 1e3));
+}
+async function credentialCommand(parsed, deps = {}) {
+  const action2 = parsed.positionals[1] ?? "list";
+  if (action2 !== "list" && action2 !== "revoke") {
+    throw new Error(`unknown credentials action "${action2}". Try "odla-ai credentials list".`);
+  }
+  assertArgs(parsed, ["config", "env", "all", "json", "token", "email", "open"], action2 === "revoke" ? 3 : 2);
+  const cfg = await loadProjectConfig(stringOpt(parsed.options.config) ?? "odla.config.mjs");
+  const doFetch = deps.fetch ?? fetch;
+  const out = deps.stdout ?? console;
+  const token = await getDeveloperToken(cfg, {
+    configPath: cfg.configPath,
+    token: stringOpt(parsed.options.token),
+    email: stringOpt(parsed.options.email),
+    open: parsed.options.open === false ? false : parsed.options.open === true ? true : void 0,
+    openApprovalUrl: deps.openUrl
+  }, doFetch, out, { optionalProjectCapabilities: ["app.manage"] });
+  const base = `${cfg.platformUrl}/registry/apps/${encodeURIComponent(cfg.app.id)}/runtime-credentials`;
+  if (action2 === "revoke") {
+    const id = parsed.positionals[2];
+    if (!id) throw new Error("credentials revoke requires the exact receipt id from credentials list");
+    const response3 = await doFetch(`${base}/${encodeURIComponent(id)}`, {
+      method: "DELETE",
+      headers: { authorization: `Bearer ${token}` }
+    });
+    if (!response3.ok) throw new Error(`runtime credential revoke failed (${response3.status}): ${await responseError(response3)}`);
+    const body2 = await response3.json();
+    return out.log(parsed.options.json === true ? JSON.stringify(body2, null, 2) : `revoked ${body2.receipt.id} (${body2.receipt.env} ${body2.receipt.target.scriptName})`);
+  }
+  const query = new URLSearchParams();
+  const requestedEnv = stringOpt(parsed.options.env);
+  if (requestedEnv) query.set("env", requestedEnv);
+  const response2 = await doFetch(`${base}${query.size ? `?${query}` : ""}`, {
+    headers: { authorization: `Bearer ${token}` }
+  });
+  if (!response2.ok) throw new Error(`runtime credential inventory failed (${response2.status}): ${await responseError(response2)}`);
+  const body = await response2.json();
+  const credentials = parsed.options.all === true ? body.credentials : body.credentials.filter((item) => item.state === "committed");
+  if (parsed.options.json === true) return out.log(JSON.stringify({ credentials }, null, 2));
+  if (!credentials.length) return out.log("no active runtime credential receipts");
+  out.log("RECEIPT	ENV	TARGET	CREATED");
+  for (const item of credentials) {
+    out.log(`${item.id}	${item.env}	${item.target.accountId ?? "local"}/${item.target.scriptName}	${new Date(item.createdAt).toISOString()}`);
+  }
+}
+var init_credential_command = __esm({
+  "src/credential-command.ts"() {
+    "use strict";
+    init_cjs_shims();
+    init_argv();
+    init_config();
+    init_redact();
+    init_token();
+  }
+});
+
 // src/help-usage.ts
 var USAGE_SECTION;
 var init_help_usage = __esm({
@@ -9624,6 +9725,8 @@ Usage:
   odla-ai security run [target] --ack-redacted-source [--env dev] [--profile odla] [--fail-on high]
   odla-ai security run [target] --self --ack-redacted-source
   odla-ai provision [--live] [--config odla.config.mjs] [--email <odla-account>] [--request-grant] [--wait <seconds>] [--dry-run] [--push-secrets] [--rotate-o11y-token] [--write-dev-vars[=path]] [--yes]
+  odla-ai credentials list [--config odla.config.mjs] [--env dev] [--all] [--json]
+  odla-ai credentials revoke <receipt-id> [--config odla.config.mjs] [--json]
   odla-ai smoke [--config odla.config.mjs] [--env dev] [--email <odla-account>] [--no-open]
   odla-ai skill install [--dir <project>] [--agent <name>] [--global] [--force]
   odla-ai secrets push --env <env> [--config odla.config.mjs] [--dry-run] [--yes]
@@ -9748,9 +9851,13 @@ Safety:
   pinned versions of every external @odla-ai runtime module before importing
   the command graph. A stale workspace module blocks with its resolved path and
   tells the agent to update/rebase, npm ci, and rebuild.
-  Provision caches the approved developer token and service credentials under
-  .odla/ with mode 0600, and init adds those paths to .gitignore. Secret push
-  preflights Wrangler before any shown-once issuance or destructive rotation.
+  Provision caches the approved developer token under .odla/ with mode 0600.
+  Local-only development provisioning may also cache that developer's service
+  credentials there. \`provision --push-secrets\` instead stages a fresh,
+  independently revocable credential set through the approved handshake,
+  transfers the complete set to the exact Worker with \`wrangler secret bulk\`
+  over stdin, and never writes its plaintext under .odla. Secret push preflights
+  Wrangler before shown-once issuance; it never rotates sibling credentials.
   Projectless PM, Discussions, o11y, runbook, and identity commands use
   --platform/--app/--env, ODLA_PLATFORM_URL/ODLA_APP_ID/ODLA_ENV, and
   ODLA_DEV_TOKEN. Save non-secret scope metadata with "context save", then
@@ -11829,7 +11936,7 @@ async function issueO11yToken(opts) {
   );
   if (res.status === 409 && !opts.rotateO11y) {
     throw new Error(
-      `o11y token already exists for env "${opts.env}", but its shown-once value is not in the local credentials file; run "odla-ai provision --rotate-o11y-token --push-secrets" to replace it explicitly`
+      `o11y token already exists for env "${opts.env}", but its shown-once value is not in the local credentials file; run "odla-ai provision --push-secrets" to install a separate runtime credential without rotating siblings`
     );
   }
   if (!res.ok) throw new Error(`o11y token ${opts.rotateO11y ? "rotation" : "issue"} (${opts.env}) failed: ${res.status} ${await safeText7(res)}`);
@@ -11855,6 +11962,97 @@ var init_provision_credentials = __esm({
   }
 });
 
+// src/runtime-credentials.ts
+function runtimeUrl(cfg, suffix = "") {
+  return `${cfg.platformUrl}/registry/apps/${encodeURIComponent(cfg.app.id)}/runtime-credentials${suffix}`;
+}
+async function safeError(response2) {
+  const text2 = await response2.text();
+  return redactSecrets(text2.slice(0, 1e3));
+}
+async function finish(doFetch, cfg, token, sessionId, method) {
+  return doFetch(runtimeUrl(cfg, `/${encodeURIComponent(sessionId)}`), {
+    method,
+    headers: { authorization: `Bearer ${token}` }
+  });
+}
+async function deliverRuntimeCredentials(cfg, options) {
+  const doFetch = options.fetch ?? fetch;
+  const run = options.runner ?? defaultRunner;
+  const wranglerEnv = options.env === "prod" || options.env === "production" ? void 0 : options.env;
+  const target = await wranglerRuntimeTarget(run, {
+    cwd: cfg.rootDir,
+    env: wranglerEnv
+  });
+  const issue = await doFetch(runtimeUrl(cfg), {
+    method: "POST",
+    headers: {
+      authorization: `Bearer ${options.developerToken}`,
+      "content-type": "application/json"
+    },
+    body: JSON.stringify({
+      env: options.env,
+      idempotencyKey: `wrangler:${(0, import_node_crypto5.randomUUID)()}`,
+      target
+    })
+  });
+  const body = await issue.json().catch(() => null);
+  if (!issue.ok || typeof body?.sessionId !== "string" || !body.secrets || typeof body.secrets !== "object") {
+    const detail = body?.error?.code ?? body?.error?.message ?? issue.status;
+    throw new Error(`runtime credential staging failed: ${String(detail)}`);
+  }
+  const secrets = body.secrets;
+  const values = {};
+  for (const name of ["ODLA_API_KEY", "ODLA_O11Y_TOKEN"]) {
+    const value2 = secrets[name];
+    if (typeof value2 === "string" && value2) values[name] = value2;
+  }
+  if (Object.keys(values).length === 0) {
+    await finish(doFetch, cfg, options.developerToken, body.sessionId, "DELETE");
+    throw new Error("runtime credential staging returned no configured service credentials");
+  }
+  const pushed = await wranglerBulkSecrets(run, {
+    secrets: values,
+    env: wranglerEnv,
+    cwd: cfg.rootDir
+  });
+  if (pushed.code !== 0) {
+    await finish(doFetch, cfg, options.developerToken, body.sessionId, "DELETE");
+    const detail = redactSecrets(`${pushed.stderr || pushed.stdout}`.trim());
+    throw new Error(`wrangler secret bulk failed (exit ${pushed.code}): ${detail}`);
+  }
+  const committed = await finish(
+    doFetch,
+    cfg,
+    options.developerToken,
+    body.sessionId,
+    "POST"
+  );
+  if (!committed.ok) {
+    await finish(doFetch, cfg, options.developerToken, body.sessionId, "DELETE");
+    throw new Error(`runtime credential receipt commit failed: ${await safeError(committed)}`);
+  }
+  options.stdout?.log(
+    `${options.env}: installed ${Object.keys(values).join(" + ")} on ${target.accountId}/${target.scriptName}${target.environment ? ` (${target.environment})` : ""}; plaintext stayed in memory`
+  );
+  return {
+    sessionId: body.sessionId,
+    target,
+    ...values.ODLA_API_KEY ? { dbKey: values.ODLA_API_KEY } : {},
+    ...values.ODLA_O11Y_TOKEN ? { o11yToken: values.ODLA_O11Y_TOKEN } : {}
+  };
+}
+var import_node_crypto5;
+var init_runtime_credentials = __esm({
+  "src/runtime-credentials.ts"() {
+    "use strict";
+    init_cjs_shims();
+    import_node_crypto5 = require("crypto");
+    init_redact();
+    init_wrangler();
+  }
+});
+
 // src/provision-live.ts
 function liveProvisionConfig(cfg) {
   if (!cfg.envs.includes("dev")) {
@@ -11894,8 +12092,10 @@ async function provision(options) {
   if (options.rotateO11yToken && !hasO11y) {
     throw new Error("--rotate-o11y-token requires the o11y service in odla.config.mjs");
   }
-  if (options.pushSecrets && options.writeCredentials === false) {
-    throw new Error("--push-secrets cannot be combined with --no-write-credentials");
+  if (options.pushSecrets && (options.rotateKeys || options.rotateO11yToken)) {
+    throw new Error(
+      "--push-secrets always issues an independent runtime credential set; do not combine it with destructive rotation flags"
+    );
   }
   out.log(`odla-ai: ${plan.appName} (${plan.appId})`);
   out.log(`  platform: ${plan.platformUrl}`);
@@ -11932,7 +12132,7 @@ async function provision(options) {
     out.log(`  secrets: ${options.pushSecrets ? "push configured Worker secrets" : "local only"}`);
     return;
   }
-  let credentials = readCredentials(cfg.local.credentialsFile);
+  let credentials = options.pushSecrets ? null : readCredentials(cfg.local.credentialsFile);
   if (credentials && credentials.appId !== cfg.app.id) {
     throw new Error(
       `credentials at ${displayPath(cfg.local.credentialsFile, cfg.rootDir)} are for "${credentials.appId}", not "${cfg.app.id}"`
@@ -11941,7 +12141,7 @@ async function provision(options) {
   const rotatesO11y = !!(options.rotateKeys || options.rotateO11yToken);
   const missingO11y = cfg.envs.some((env) => !credentials?.envs[env]?.o11yToken);
   const missingDb = cfg.envs.some((env) => !credentials?.envs[env]?.dbKey);
-  const losesShownOnceCredential = hasDb && (!!options.rotateKeys || missingDb) || hasO11y && (rotatesO11y || missingO11y);
+  const losesShownOnceCredential = !options.pushSecrets && (hasDb && (!!options.rotateKeys || missingDb) || hasO11y && (rotatesO11y || missingO11y));
   if (options.writeCredentials === false && losesShownOnceCredential) {
     throw new Error("credential issuance/rotation requires the private credentials file; remove --no-write-credentials");
   }
@@ -12015,38 +12215,42 @@ async function provision(options) {
       await applyCalendarBookingPage(calendarCtx, calendarBookingPageUrl(cfg, env), out);
     }
   }
+  let devVarsCredentials = credentials;
   for (const env of cfg.envs) {
     const tenantId = (0, import_apps12.tenantIdFor)(cfg.app.id, env);
-    credentials = await provisionEnvCredentials({
-      cfg,
-      env,
-      developerToken: token,
-      credentials,
-      rotateDb: !!options.rotateKeys,
-      rotateO11y: rotatesO11y,
-      write: options.writeCredentials !== false,
-      fetch: doFetch,
-      stdout: out
-    });
-    const dbKey = credentials.envs[env]?.dbKey;
+    let dbKey;
     if (options.pushSecrets) {
-      try {
-        await secretsPushAfterPreflight({
-          configPath: cfg.configPath,
-          env,
-          yes: options.yes,
-          runner: options.secretRunner,
-          stdout: out
-        });
-      } catch (error) {
-        const message2 = error instanceof Error ? error.message : String(error);
-        const consent = env === "prod" || env === "production" ? " --yes" : "";
-        throw new Error(
-          `${message2}
-${env}: credentials are already saved; retry "odla-ai secrets push --env ${env}${consent}" without issuing or rotating again`,
-          { cause: error }
-        );
-      }
+      const delivered = await deliverRuntimeCredentials(cfg, {
+        env,
+        developerToken: token,
+        fetch: doFetch,
+        runner: options.secretRunner,
+        stdout: out
+      });
+      dbKey = delivered.dbKey;
+      devVarsCredentials = mergeCredential(devVarsCredentials, {
+        appId: cfg.app.id,
+        platformUrl: cfg.platformUrl,
+        dbEndpoint: cfg.dbEndpoint,
+        env,
+        tenantId,
+        ...delivered.dbKey ? { dbKey: delivered.dbKey } : {},
+        ...delivered.o11yToken ? { o11yToken: delivered.o11yToken } : {}
+      });
+    } else {
+      credentials = await provisionEnvCredentials({
+        cfg,
+        env,
+        developerToken: token,
+        credentials,
+        rotateDb: !!options.rotateKeys,
+        rotateO11y: rotatesO11y,
+        write: options.writeCredentials !== false,
+        fetch: doFetch,
+        stdout: out
+      });
+      devVarsCredentials = credentials;
+      dbKey = credentials.envs[env]?.dbKey;
     }
     if (schema && dbKey) {
       await postJson(doFetch, `${cfg.dbEndpoint}/app/${encodeURIComponent(tenantId)}/schema`, dbKey, { schema });
@@ -12070,13 +12274,13 @@ ${env}: credentials are already saved; retry "odla-ai secrets push --env ${env}$
       }
     }
   }
-  if (options.writeCredentials !== false && credentials) {
+  if (!options.pushSecrets && options.writeCredentials !== false && credentials) {
     const ignored = cfg.local.gitignore && gitignoreEntry(cfg.rootDir, cfg.local.credentialsFile);
     out.log(`credentials: wrote ${displayPath(cfg.local.credentialsFile, cfg.rootDir)} (0600${ignored ? ", gitignored" : ""})`);
   }
-  if (devVarsTarget && credentials) {
+  if (devVarsTarget && devVarsCredentials) {
     const env = cfg.envs.includes("dev") ? "dev" : cfg.envs[0] ?? "prod";
-    writeDevVars(devVarsTarget, credentials, env, o11yDevVars(cfg));
+    writeDevVars(devVarsTarget, devVarsCredentials, env, o11yDevVars(cfg));
     out.log(`dev vars: wrote ${displayPath(devVarsTarget, cfg.rootDir)} for ${env}`);
   }
   if (cfg.services.includes("calendar")) {
@@ -12116,6 +12320,7 @@ var init_provision = __esm({
     init_token();
     init_local();
     init_provision_credentials();
+    init_runtime_credentials();
     init_provision_live();
     init_provision_helpers();
     init_secrets();
@@ -12226,6 +12431,7 @@ var init_surface = __esm({
       code: { connect: {} },
       config: { diff: {}, plan: {}, apply: {} },
       context: { show: {}, list: {}, save: {}, remove: {} },
+      credentials: { list: {}, revoke: {} },
       // `watch`, `read`, `reply`, and `resolve` take a topic id from there on.
       discuss: {
         groups: {},
@@ -14022,6 +14228,10 @@ async function runCli(argv2 = process.argv.slice(2), dependencies = {}) {
     await contextCommand(parsed, runtime);
     return;
   }
+  if (command === "credentials") {
+    await credentialCommand(parsed, runtime);
+    return;
+  }
   if (command === "runbook") {
     await runbookCommand(parsed, runtime);
     return;
@@ -14164,6 +14374,7 @@ var init_cli = __esm({
     init_cli_project();
     init_code_command();
     init_context_command();
+    init_credential_command();
     init_help();
     init_version();
     init_discuss_command();