@odla-ai/cli 0.32.1 → 0.33.0

package/dist/{chunk-L6YTOTWU.js → chunk-YSQORU5J.js}

@@ -990,6 +990,111 @@ function safeText(value2, max) {
   return typeof value2 === "string" && value2.trim().length > 0 && value2.length <= max && !/[\u0000-\u001f\u007f]/.test(value2);
 }
 
+// src/calendar-config.ts
+function calendarServiceConfig(cfg, env) {
+  if (!cfg.services.includes("calendar")) throw new Error("calendar service is not enabled in config services");
+  if (!cfg.envs.includes(env) && env !== "prod") throw new Error(`calendar env "${env}" is not declared in config envs`);
+  const google = cfg.calendar?.google;
+  if (!google) throw new Error("calendar.google is required when the calendar service is enabled");
+  const configured = google.availabilityCalendars?.[env] ?? google.calendars?.[env];
+  if (!configured?.length) throw new Error(`calendar.google.availabilityCalendars.${env} is required`);
+  const availability = unique(configured.map((id) => id.trim()));
+  return {
+    provider: "google",
+    access: "book",
+    bookingCalendarId: google.bookingCalendar?.[env]?.trim() ?? availability[0],
+    availabilityCalendars: availability
+  };
+}
+function calendarBookingPageUrl(cfg, env) {
+  const value2 = cfg.calendar?.google.bookingPageUrl?.[env];
+  if (value2 === void 0 || value2 === null) return value2;
+  return new URL(value2).toString();
+}
+function validateCalendarConfig(cfg, envs, services, path) {
+  const enabled = services.includes("calendar");
+  if (!cfg.calendar) {
+    if (enabled) throw new Error(`${path}: calendar.google is required when services includes "calendar"`);
+    return;
+  }
+  if (!isRecord5(cfg.calendar)) throw new Error(`${path}: calendar must be an object`);
+  assertOnly2(cfg.calendar, ["google"], `${path}: calendar`);
+  if (!isRecord5(cfg.calendar.google)) throw new Error(`${path}: calendar.google must be an object`);
+  const google = cfg.calendar.google;
+  assertOnly2(
+    google,
+    ["availabilityCalendars", "calendars", "bookingCalendar", "bookingPageUrl"],
+    `${path}: calendar.google`
+  );
+  const availabilityKey = google.availabilityCalendars !== void 0 ? "availabilityCalendars" : google.calendars !== void 0 ? "calendars" : null;
+  if (!availabilityKey || google.availabilityCalendars !== void 0 && google.calendars !== void 0) {
+    throw new Error(`${path}: calendar.google requires exactly one of availabilityCalendars or calendars (legacy)`);
+  }
+  const availability = google[availabilityKey];
+  if (!isRecord5(availability)) throw new Error(`${path}: calendar.google.${availabilityKey} must map env names to calendar ids`);
+  const unknownEnv = Object.keys(availability).find((env) => !envs.includes(env) && env !== "prod");
+  if (unknownEnv) throw new Error(`${path}: calendar.google.${availabilityKey}.${unknownEnv} is not in config envs`);
+  for (const env of envs) {
+    const ids = availability[env];
+    if (!Array.isArray(ids) || ids.length === 0) {
+      throw new Error(`${path}: calendar.google.${availabilityKey}.${env} must be a non-empty array`);
+    }
+  }
+  for (const [env, ids] of Object.entries(availability)) {
+    if (!Array.isArray(ids) || ids.length === 0) {
+      throw new Error(`${path}: calendar.google.${availabilityKey}.${env} must be a non-empty array`);
+    }
+    if (ids.length > 10) {
+      throw new Error(`${path}: calendar.google.${availabilityKey}.${env} must contain at most 10 calendar ids`);
+    }
+    if (ids.some((id) => !safeText2(id, 1024))) {
+      throw new Error(`${path}: calendar.google.${availabilityKey}.${env} contains an invalid calendar id`);
+    }
+  }
+  if (google.bookingCalendar !== void 0) {
+    if (!isRecord5(google.bookingCalendar)) throw new Error(`${path}: calendar.google.bookingCalendar must map env names to one calendar id`);
+    const unknownBookingEnv = Object.keys(google.bookingCalendar).find((env) => !envs.includes(env) && env !== "prod");
+    if (unknownBookingEnv) throw new Error(`${path}: calendar.google.bookingCalendar.${unknownBookingEnv} is not in config envs`);
+    for (const [env, value2] of Object.entries(google.bookingCalendar)) {
+      if (!safeText2(value2, 1024)) {
+        throw new Error(`${path}: calendar.google.bookingCalendar.${env} must be a calendar id`);
+      }
+    }
+  }
+  if (google.bookingPageUrl !== void 0) {
+    if (!isRecord5(google.bookingPageUrl)) throw new Error(`${path}: calendar.google.bookingPageUrl must map env names to HTTPS URLs or null`);
+    const unknownBookingEnv = Object.keys(google.bookingPageUrl).find((env) => !envs.includes(env) && env !== "prod");
+    if (unknownBookingEnv) throw new Error(`${path}: calendar.google.bookingPageUrl.${unknownBookingEnv} is not in config envs`);
+    for (const [env, value2] of Object.entries(google.bookingPageUrl)) {
+      if (value2 !== null && !safeHttpsUrl(value2)) {
+        throw new Error(`${path}: calendar.google.bookingPageUrl.${env} must be an HTTPS URL without credentials or fragment`);
+      }
+    }
+  }
+}
+function assertOnly2(value2, allowed, label) {
+  const extra = Object.keys(value2).find((key) => !allowed.includes(key));
+  if (extra) throw new Error(`${label}.${extra} is not supported`);
+}
+function isRecord5(value2) {
+  return value2 !== null && typeof value2 === "object" && !Array.isArray(value2);
+}
+function safeText2(value2, max) {
+  return typeof value2 === "string" && value2.trim().length > 0 && value2.length <= max && !/[\u0000-\u001f\u007f]/.test(value2);
+}
+function safeHttpsUrl(value2) {
+  if (typeof value2 !== "string" || value2.length > 2048) return false;
+  try {
+    const url = new URL(value2);
+    return url.protocol === "https:" && !url.username && !url.password && !url.hash;
+  } catch {
+    return false;
+  }
+}
+function unique(values) {
+  return [...new Set(values.filter(Boolean))];
+}
+
 // src/integration-validation.ts
 function validateIntegrations(cfg, path, defaultServices) {
   if (cfg.integrations === void 0) return;
@@ -997,36 +1102,61 @@ function validateIntegrations(cfg, path, defaultServices) {
   const ids = /* @__PURE__ */ new Set();
   for (const [index, integration] of cfg.integrations.entries()) {
     const at = `${path}: integrations[${index}]`;
-    if (!isRecord5(integration)) throw new Error(`${at} must be an object`);
+    if (!isRecord6(integration)) throw new Error(`${at} must be an object`);
     if (!validId(integration.id)) throw new Error(`${at}.id must be lowercase letters, numbers, and hyphens`);
     if (ids.has(integration.id)) throw new Error(`${path}: duplicate integration id "${integration.id}"`);
     ids.add(integration.id);
-    if (!safeText2(integration.title, 200)) throw new Error(`${at}.title is required`);
-    if (!safeText2(integration.npm, 200)) throw new Error(`${at}.npm is required`);
-    if (integration.schema !== void 0 && (!isRecord5(integration.schema) || !isRecord5(integration.schema.entities))) {
+    if (!safeText3(integration.title, 200)) throw new Error(`${at}.title is required`);
+    if (!safeText3(integration.npm, 200)) throw new Error(`${at}.npm is required`);
+    if (integration.schema !== void 0 && (!isRecord6(integration.schema) || !isRecord6(integration.schema.entities))) {
       throw new Error(`${at}.schema must contain an entities object`);
     }
-    if (integration.rules !== void 0 && !isRecord5(integration.rules)) throw new Error(`${at}.rules must be an object`);
+    if (integration.rules !== void 0 && !isRecord6(integration.rules)) throw new Error(`${at}.rules must be an object`);
     validateSeeds(integration, at);
     validateProbes(integration, at);
+    validateSecrets(integration.secrets, at);
   }
   const needsDb = cfg.integrations.some((integration) => integration.schema || integration.rules || integration.seeds?.length);
-  const services = unique(cfg.services?.length ? cfg.services : defaultServices);
+  const services = unique2(cfg.services?.length ? cfg.services : defaultServices);
   if (needsDb && !services.includes("db")) throw new Error(`${path}: schema/rules/seed integrations require the db service`);
 }
+var SECRET_NAME = /^\$?[a-z][a-z0-9_]*$/;
+function validateSecrets(value2, at) {
+  if (value2 === void 0) return;
+  if (!Array.isArray(value2)) throw new Error(`${at}.secrets must be an array`);
+  const names = /* @__PURE__ */ new Set();
+  for (const [index, secret] of value2.entries()) {
+    const sat = `${at}.secrets[${index}]`;
+    if (!isRecord6(secret)) throw new Error(`${sat} must be an object`);
+    if (typeof secret.name !== "string" || !SECRET_NAME.test(secret.name) || secret.name.length > 64) {
+      throw new Error(`${sat}.name must be lowercase snake_case (optionally "$"-prefixed when reserved), e.g. "clerk_webhook_secret"`);
+    }
+    const dollar = secret.name.startsWith("$");
+    if (dollar !== (secret.reserved === true)) {
+      throw new Error(
+        dollar ? `${sat}.name is "$"-prefixed, so it must also set reserved: true` : `${sat} sets reserved: true, so its name must be "$"-prefixed`
+      );
+    }
+    if (!safeText3(secret.description, 500)) throw new Error(`${sat}.description is required \u2014 it is what doctor and the docs show`);
+    if (secret.pattern !== void 0 && !safeText3(secret.pattern, 64)) throw new Error(`${sat}.pattern must be a non-empty prefix string`);
+    if (secret.required !== void 0 && typeof secret.required !== "boolean") throw new Error(`${sat}.required must be a boolean`);
+    if (names.has(secret.name)) throw new Error(`${at} declares secret "${secret.name}" twice`);
+    names.add(secret.name);
+  }
+}
 function validateSeeds(integration, at) {
   if (integration.seeds === void 0) return;
   if (!Array.isArray(integration.seeds)) throw new Error(`${at}.seeds must be an array`);
   const ids = /* @__PURE__ */ new Set();
   for (const [index, seed] of integration.seeds.entries()) {
     const sat = `${at}.seeds[${index}]`;
-    if (!isRecord5(seed) || !safeText2(seed.id, 200) || !safeText2(seed.ns, 200)) throw new Error(`${sat} requires id and ns`);
+    if (!isRecord6(seed) || !safeText3(seed.id, 200) || !safeText3(seed.ns, 200)) throw new Error(`${sat} requires id and ns`);
     if (ids.has(seed.id)) throw new Error(`${at} has duplicate seed id "${seed.id}"`);
     ids.add(seed.id);
-    if (!isRecord5(seed.key) || !safeText2(seed.key.attr, 200) || !safeText2(seed.key.value, 2048)) {
+    if (!isRecord6(seed.key) || !safeText3(seed.key.attr, 200) || !safeText3(seed.key.value, 2048)) {
       throw new Error(`${sat}.key requires string attr and value`);
     }
-    if (!isRecord5(seed.attrs)) throw new Error(`${sat}.attrs must be an object`);
+    if (!isRecord6(seed.attrs)) throw new Error(`${sat}.attrs must be an object`);
     if (Object.hasOwn(seed.attrs, seed.key.attr) && seed.attrs[seed.key.attr] !== seed.key.value) {
       throw new Error(`${sat}.attrs.${seed.key.attr} conflicts with its natural key`);
     }
@@ -1037,16 +1167,16 @@ function validateProbes(integration, at) {
   if (!Array.isArray(integration.probes)) throw new Error(`${at}.probes must be an array`);
   for (const [index, probe] of integration.probes.entries()) {
     const pat = `${at}.probes[${index}]`;
-    if (!isRecord5(probe) || !safeProbePath(probe.path)) throw new Error(`${pat}.path must be an absolute path without query or fragment`);
+    if (!isRecord6(probe) || !safeProbePath(probe.path)) throw new Error(`${pat}.path must be an absolute path without query or fragment`);
     if (!Number.isInteger(probe.expectedStatus) || probe.expectedStatus < 100 || probe.expectedStatus > 599) {
       throw new Error(`${pat}.expectedStatus must be an HTTP status`);
     }
   }
 }
-function isRecord5(value2) {
+function isRecord6(value2) {
   return value2 !== null && typeof value2 === "object" && !Array.isArray(value2);
 }
-function safeText2(value2, max) {
+function safeText3(value2, max) {
   return typeof value2 === "string" && value2.trim().length > 0 && value2.length <= max && !/[\u0000-\u001f\u007f]/.test(value2);
 }
 function safeProbePath(value2) {
@@ -1055,7 +1185,7 @@ function safeProbePath(value2) {
 function validId(value2) {
   return typeof value2 === "string" && /^[a-z0-9][a-z0-9-]*$/.test(value2);
 }
-function unique(values) {
+function unique2(values) {
   return [...new Set(values.filter(Boolean))];
 }
 
@@ -1075,10 +1205,10 @@ async function loadProjectConfig(configPath = "odla.config.mjs", options = {}) {
   validateRawConfig(raw, resolved);
   const platformUrl = trimSlash(process.env.ODLA_PLATFORM_URL || raw.platformUrl || DEFAULT_PLATFORM);
   const dbEndpoint = trimSlash(process.env.ODLA_DB_ENDPOINT || raw.dbEndpoint || platformUrl);
-  const envs = unique2(raw.envs?.length ? raw.envs : DEFAULT_ENVS);
-  const services = unique2(raw.services?.length ? raw.services : DEFAULT_SERVICES);
+  const envs = unique3(raw.envs?.length ? raw.envs : DEFAULT_ENVS);
+  const services = unique3(raw.services?.length ? raw.services : DEFAULT_SERVICES);
   validateServices(services, resolved);
-  validateCalendarConfig(raw, unique2([...envs, ...options.additionalEnvs ?? []]), services, resolved);
+  validateCalendarConfig(raw, unique3([...envs, ...options.additionalEnvs ?? []]), services, resolved);
   const local = {
     tokenFile: resolve2(rootDir, raw.local?.tokenFile ?? ".odla/dev-token.json"),
     credentialsFile: resolve2(rootDir, raw.local?.credentialsFile ?? ".odla/credentials.local.json"),
@@ -1126,26 +1256,6 @@ function buildPlan(cfg) {
     aiProvider: cfg.ai?.provider
   };
 }
-function calendarServiceConfig(cfg, env) {
-  if (!cfg.services.includes("calendar")) throw new Error("calendar service is not enabled in config services");
-  if (!cfg.envs.includes(env) && env !== "prod") throw new Error(`calendar env "${env}" is not declared in config envs`);
-  const google = cfg.calendar?.google;
-  if (!google) throw new Error("calendar.google is required when the calendar service is enabled");
-  const configured = google.availabilityCalendars?.[env] ?? google.calendars?.[env];
-  if (!configured?.length) throw new Error(`calendar.google.availabilityCalendars.${env} is required`);
-  const availability = unique2(configured.map((id) => id.trim()));
-  return {
-    provider: "google",
-    access: "book",
-    bookingCalendarId: google.bookingCalendar?.[env]?.trim() ?? availability[0],
-    availabilityCalendars: availability
-  };
-}
-function calendarBookingPageUrl(cfg, env) {
-  const value2 = cfg.calendar?.google.bookingPageUrl?.[env];
-  if (value2 === void 0 || value2 === null) return value2;
-  return new URL(value2).toString();
-}
 function rulesFromSchema(schema) {
   const entities = serializedEntities(schema);
   return Object.fromEntries(
@@ -1177,69 +1287,9 @@ function validateRawConfig(raw, path) {
     throw new Error(`${path}: services must be an array of non-empty names`);
   }
   validateAiConfig(cfg, path);
+  validateSecrets(cfg.secrets, `${path}: config`);
   validateIntegrations(cfg, path, DEFAULT_SERVICES);
 }
-function validateCalendarConfig(cfg, envs, services, path) {
-  const enabled = services.includes("calendar");
-  if (!cfg.calendar) {
-    if (enabled) throw new Error(`${path}: calendar.google is required when services includes "calendar"`);
-    return;
-  }
-  if (!isRecord6(cfg.calendar)) throw new Error(`${path}: calendar must be an object`);
-  assertOnly2(cfg.calendar, ["google"], `${path}: calendar`);
-  if (!isRecord6(cfg.calendar.google)) throw new Error(`${path}: calendar.google must be an object`);
-  const google = cfg.calendar.google;
-  assertOnly2(
-    google,
-    ["availabilityCalendars", "calendars", "bookingCalendar", "bookingPageUrl"],
-    `${path}: calendar.google`
-  );
-  const availabilityKey = google.availabilityCalendars !== void 0 ? "availabilityCalendars" : google.calendars !== void 0 ? "calendars" : null;
-  if (!availabilityKey || google.availabilityCalendars !== void 0 && google.calendars !== void 0) {
-    throw new Error(`${path}: calendar.google requires exactly one of availabilityCalendars or calendars (legacy)`);
-  }
-  const availability = google[availabilityKey];
-  if (!isRecord6(availability)) throw new Error(`${path}: calendar.google.${availabilityKey} must map env names to calendar ids`);
-  const unknownEnv = Object.keys(availability).find((env) => !envs.includes(env) && env !== "prod");
-  if (unknownEnv) throw new Error(`${path}: calendar.google.${availabilityKey}.${unknownEnv} is not in config envs`);
-  for (const env of envs) {
-    const ids = availability[env];
-    if (!Array.isArray(ids) || ids.length === 0) {
-      throw new Error(`${path}: calendar.google.${availabilityKey}.${env} must be a non-empty array`);
-    }
-  }
-  for (const [env, ids] of Object.entries(availability)) {
-    if (!Array.isArray(ids) || ids.length === 0) {
-      throw new Error(`${path}: calendar.google.${availabilityKey}.${env} must be a non-empty array`);
-    }
-    if (ids.length > 10) {
-      throw new Error(`${path}: calendar.google.${availabilityKey}.${env} must contain at most 10 calendar ids`);
-    }
-    if (ids.some((id) => !safeText3(id, 1024))) {
-      throw new Error(`${path}: calendar.google.${availabilityKey}.${env} contains an invalid calendar id`);
-    }
-  }
-  if (google.bookingCalendar !== void 0) {
-    if (!isRecord6(google.bookingCalendar)) throw new Error(`${path}: calendar.google.bookingCalendar must map env names to one calendar id`);
-    const unknownBookingEnv = Object.keys(google.bookingCalendar).find((env) => !envs.includes(env) && env !== "prod");
-    if (unknownBookingEnv) throw new Error(`${path}: calendar.google.bookingCalendar.${unknownBookingEnv} is not in config envs`);
-    for (const [env, value2] of Object.entries(google.bookingCalendar)) {
-      if (!safeText3(value2, 1024)) {
-        throw new Error(`${path}: calendar.google.bookingCalendar.${env} must be a calendar id`);
-      }
-    }
-  }
-  if (google.bookingPageUrl !== void 0) {
-    if (!isRecord6(google.bookingPageUrl)) throw new Error(`${path}: calendar.google.bookingPageUrl must map env names to HTTPS URLs or null`);
-    const unknownBookingEnv = Object.keys(google.bookingPageUrl).find((env) => !envs.includes(env) && env !== "prod");
-    if (unknownBookingEnv) throw new Error(`${path}: calendar.google.bookingPageUrl.${unknownBookingEnv} is not in config envs`);
-    for (const [env, value2] of Object.entries(google.bookingPageUrl)) {
-      if (value2 !== null && !safeHttpsUrl(value2)) {
-        throw new Error(`${path}: calendar.google.bookingPageUrl.${env} must be an HTTPS URL without credentials or fragment`);
-      }
-    }
-  }
-}
 function validateServices(services, path) {
   for (const service of services) {
     const definition = appServiceDefinition(service);
@@ -1253,25 +1303,6 @@ function validateServices(services, path) {
     }
   }
 }
-function assertOnly2(value2, allowed, label) {
-  const extra = Object.keys(value2).find((key) => !allowed.includes(key));
-  if (extra) throw new Error(`${label}.${extra} is not supported`);
-}
-function isRecord6(value2) {
-  return value2 !== null && typeof value2 === "object" && !Array.isArray(value2);
-}
-function safeText3(value2, max) {
-  return typeof value2 === "string" && value2.trim().length > 0 && value2.length <= max && !/[\u0000-\u001f\u007f]/.test(value2);
-}
-function safeHttpsUrl(value2) {
-  if (typeof value2 !== "string" || value2.length > 2048) return false;
-  try {
-    const url = new URL(value2);
-    return url.protocol === "https:" && !url.username && !url.password && !url.hash;
-  } catch {
-    return false;
-  }
-}
 function validId2(value2) {
   return typeof value2 === "string" && /^[a-z0-9][a-z0-9-]*$/.test(value2);
 }
@@ -1286,7 +1317,7 @@ async function loadConfigModule(path) {
 function trimSlash(value2) {
   return value2.replace(/\/+$/, "");
 }
-function unique2(values) {
+function unique3(values) {
   return [...new Set(values.filter(Boolean))];
 }
 
@@ -4068,6 +4099,67 @@ function isRecord7(value2) {
   return value2 !== null && typeof value2 === "object" && !Array.isArray(value2);
 }
 
+// src/secret-contract.ts
+var APP_SOURCE = "app";
+function resolveSecretContract(cfg) {
+  const byName = /* @__PURE__ */ new Map();
+  const declarations = [
+    ...(cfg.secrets ?? []).map((secret) => ({ source: APP_SOURCE, secret })),
+    ...(cfg.integrations ?? []).flatMap(
+      (integration) => (integration.secrets ?? []).map((secret) => ({ source: integration.id, secret }))
+    )
+  ];
+  for (const { source, secret } of declarations) {
+    const existing = byName.get(secret.name);
+    if (!existing) {
+      byName.set(secret.name, { ...secret, required: secret.required !== false, sources: [source] });
+      continue;
+    }
+    existing.sources.push(source);
+    existing.required = existing.required || secret.required !== false;
+    existing.pattern ??= secret.pattern;
+  }
+  return [...byName.values()].sort((a, b) => a.name.localeCompare(b.name));
+}
+function secretContractWarnings(contract, cfg) {
+  const warnings = [];
+  const declaredPatterns = /* @__PURE__ */ new Map();
+  for (const integration of cfg.integrations ?? []) {
+    for (const secret of integration.secrets ?? []) {
+      if (!secret.pattern) continue;
+      const seen = declaredPatterns.get(secret.name) ?? /* @__PURE__ */ new Map();
+      seen.set(integration.id, secret.pattern);
+      declaredPatterns.set(secret.name, seen);
+    }
+  }
+  for (const secret of cfg.secrets ?? []) {
+    if (!secret.pattern) continue;
+    const seen = declaredPatterns.get(secret.name) ?? /* @__PURE__ */ new Map();
+    seen.set(APP_SOURCE, secret.pattern);
+    declaredPatterns.set(secret.name, seen);
+  }
+  for (const [name, seen] of declaredPatterns) {
+    const distinct = [...new Set(seen.values())];
+    if (distinct.length > 1) {
+      const detail = [...seen].map(([source, pattern]) => `${source} expects "${pattern}"`).join(", ");
+      warnings.push(`secret "${name}" has conflicting patterns \u2014 ${detail}; one of them will reject a valid value`);
+    }
+  }
+  if (contract.length > 0 && !cfg.services.includes("db")) {
+    const names = contract.map((secret) => secret.name).join(", ");
+    warnings.push(`secrets are declared (${names}) but the db service is off \u2014 nothing can read the tenant vault`);
+  }
+  return warnings;
+}
+function formatSecretContract(contract) {
+  return contract.map((secret) => {
+    const flags = [secret.required ? "required" : "optional"];
+    if (secret.reserved) flags.push("reserved");
+    if (secret.pattern) flags.push(`${secret.pattern}\u2026`);
+    return `  ${secret.name} (${flags.join(", ")}) \u2014 ${secret.sources.join(", ")}`;
+  });
+}
+
 // src/doctor.ts
 async function doctor(options) {
   const out = options.stdout ?? console;
@@ -4084,6 +4176,9 @@ async function doctor(options) {
   out.log(`schema: ${schema ? `${entities.length} entities` : "none"}`);
   out.log(`rules:  ${rules ? `${Object.keys(rules).length} namespaces` : "none"}`);
   out.log(`ai:     ${cfg.services.includes("ai") ? cfg.ai?.provider ? `byok/${cfg.ai.provider}` : "hosted" : "not enabled"}`);
+  const contract = resolveSecretContract(cfg);
+  out.log(`secrets: ${contract.length ? `${contract.length} declared` : "none declared"}`);
+  for (const line of formatSecretContract(contract)) out.log(line);
   if (cfg.services.includes("calendar")) {
     const calendar = cfg.envs.map((env) => {
       const resolved = calendarServiceConfig(cfg, env);
@@ -4104,6 +4199,7 @@ async function doctor(options) {
     }
   }
   warnings.push(...integrationWarnings(database.integrations, schema, rules));
+  warnings.push(...secretContractWarnings(contract, cfg));
   if (cfg.services.includes("ai") && cfg.ai?.mode === "byok" && !cfg.ai.provider) {
     warnings.push("ai.mode is byok but ai.provider is not set");
   }
@@ -4430,6 +4526,71 @@ async function resolveVaultWrite(options) {
   return { cfg, tenantId: tenantIdFor3(cfg.app.id, env), value: value2, doFetch, out };
 }
 
+// src/secrets-status.ts
+import { tenantIdFor as tenantIdFor4 } from "@odla-ai/apps";
+async function secretsStatus(options) {
+  const out = options.stdout ?? console;
+  const doFetch = options.fetch ?? fetch;
+  const cfg = await loadProjectConfig(options.configPath);
+  if (!cfg.envs.includes(options.env)) {
+    throw new Error(`env "${options.env}" is not in config envs (${cfg.envs.join(", ")})`);
+  }
+  const tenantId = tenantIdFor4(cfg.app.id, options.env);
+  const contract = resolveSecretContract(cfg);
+  const token = await getDeveloperToken(cfg, options, doFetch, out);
+  const res = await doFetch(`${cfg.dbEndpoint}/admin/apps/${encodeURIComponent(tenantId)}/secrets`, {
+    headers: { authorization: `Bearer ${token}` }
+  });
+  if (!res.ok) {
+    const detail = (await res.text().catch(() => "")).slice(0, 300);
+    throw new Error(`list secrets for ${tenantId} failed (${res.status}): ${detail || "request failed"}`);
+  }
+  const body = await res.json();
+  const stored = new Set((body.secrets ?? []).map((entry) => String(entry.name)));
+  const report4 = buildReport(cfg.app.id, options.env, tenantId, contract, stored);
+  if (options.json) out.log(JSON.stringify(report4, null, 2));
+  else printReport(report4, out);
+  return report4;
+}
+function buildReport(appId, env, tenant, contract, stored) {
+  const declared = new Set(contract.map((secret) => secret.name));
+  const rows = contract.map((secret) => ({
+    name: secret.name,
+    state: secret.reserved ? "reserved" : stored.has(secret.name) ? "set" : "missing",
+    required: secret.required,
+    sources: secret.sources,
+    description: secret.description
+  }));
+  for (const name of [...stored].sort()) {
+    if (!declared.has(name)) rows.push({ name, state: "undeclared", required: false, sources: [] });
+  }
+  const ok = rows.every((row) => row.state !== "missing" || !row.required);
+  return { app: appId, env, tenant, secrets: rows, ok };
+}
+function printReport(report4, out) {
+  out.log(`${report4.app} (${report4.tenant})`);
+  if (report4.secrets.length === 0) {
+    out.log("  no secrets declared and none stored");
+    return;
+  }
+  for (const row of report4.secrets) {
+    const label = row.state === "missing" && !row.required ? "missing (optional)" : row.state;
+    const suffix = row.sources.length ? ` \u2014 ${row.sources.join(", ")}` : "";
+    out.log(`  ${label.padEnd(18)} ${row.name}${suffix}`);
+  }
+  const missing = report4.secrets.filter((row) => row.state === "missing" && row.required);
+  if (missing.length) {
+    out.log("");
+    for (const row of missing) {
+      out.log(`${row.name} is required but not set \u2014 "odla-ai secrets set ${row.name} --env ${report4.env} --stdin"`);
+    }
+  }
+  if (report4.secrets.some((row) => row.state === "reserved")) {
+    out.log("");
+    out.log('"reserved" slots are never enumerated by the vault; presence cannot be confirmed here.');
+  }
+}
+
 // src/skill.ts
 import { existsSync as existsSync9, lstatSync, mkdirSync as mkdirSync3, readFileSync as readFileSync8, readdirSync, writeFileSync as writeFileSync3 } from "fs";
 import { homedir as homedir2 } from "os";
@@ -4899,9 +5060,22 @@ async function secretsCommand(parsed, deps) {
     await (sub === "set" ? secretsSet(options) : secretsSetClerkKey(options));
     return;
   }
+  if (sub === "status") {
+    assertArgs(parsed, ["config", "env", "token", "email", "json"], 2);
+    await secretsStatus({
+      configPath: stringOpt(parsed.options.config) ?? "odla.config.mjs",
+      env: requiredString(parsed.options.env, "--env"),
+      json: parsed.options.json === true,
+      token: stringOpt(parsed.options.token),
+      email: stringOpt(parsed.options.email),
+      fetch: deps.fetch,
+      stdout: deps.stdout
+    });
+    return;
+  }
   if (sub !== "push") {
     throw new Error(
-      `unknown secrets subcommand "${sub ?? ""}". Try "odla-ai secrets push --env dev", "odla-ai secrets set <name> --env dev --stdin", or "odla-ai secrets set-clerk-key --env dev --stdin".`
+      `unknown secrets subcommand "${sub ?? ""}". Try "odla-ai secrets push --env dev", "odla-ai secrets status --env dev", "odla-ai secrets set <name> --env dev --stdin", or "odla-ai secrets set-clerk-key --env dev --stdin".`
     );
   }
   assertArgs(parsed, ["config", "env", "dry-run", "yes"], 2);
@@ -5425,7 +5599,7 @@ async function stageWorkspacePair(baselineSource, workspaceSource, options = {})
   }
 }
 
-// ../harness/dist/chunk-5FFR7U4L.js
+// ../harness/dist/chunk-ANNX7VGK.js
 import { createHash as createHash3 } from "crypto";
 import { readFile as readFile2, readdir as readdir2 } from "fs/promises";
 import { relative as relative4, resolve as resolve10 } from "path";
@@ -5485,9 +5659,9 @@ function dependenciesOf(values, influence = "data") {
       result.push({ ref, influence, promptSafetyAtUse: value2.label.promptSafety });
     }
   }
-  const unique3 = /* @__PURE__ */ new Map();
-  for (const dep of result) unique3.set(`${dep.ref.kind}\0${dep.ref.id}\0${dep.influence}\0${dep.promptSafetyAtUse}`, dep);
-  return [...unique3.values()];
+  const unique4 = /* @__PURE__ */ new Map();
+  for (const dep of result) unique4.set(`${dep.ref.kind}\0${dep.ref.id}\0${dep.influence}\0${dep.promptSafetyAtUse}`, dep);
+  return [...unique4.values()];
 }
 
 // ../camel/dist/chunk-4DQ6BIHP.js
@@ -5762,7 +5936,7 @@ function validateSnapshot(snapshot, limits) {
   }
 }
 
-// ../harness/dist/chunk-5FFR7U4L.js
+// ../harness/dist/chunk-ANNX7VGK.js
 import { spawn as spawn4 } from "child_process";
 import { lstat as lstat2 } from "fs/promises";
 import { resolve as resolve23, sep as sep3 } from "path";
@@ -6067,7 +6241,7 @@ function looksLikeDestination(value2) {
   return /^(?:[a-z][a-z0-9+.-]*:\/\/|\/|\\\\)/i.test(text2) || /^[\w.-]+\.[a-z]{2,}(?:[/:]|$)/i.test(text2);
 }
 
-// ../harness/dist/chunk-5FFR7U4L.js
+// ../harness/dist/chunk-ANNX7VGK.js
 import { readFile as readFile4, stat as stat2 } from "fs/promises";
 import { readFile as readFile3 } from "fs/promises";
 import { join as join33 } from "path";
@@ -6335,7 +6509,7 @@ async function buildCodeGraph(input) {
   return builder.build();
 }
 
-// ../harness/dist/chunk-5FFR7U4L.js
+// ../harness/dist/chunk-ANNX7VGK.js
 import { createHash as createHash32 } from "crypto";
 async function digestStagedWorkspace(root, limits) {
   const files = [];
@@ -6522,6 +6696,16 @@ function createCodeRuntimeControlClient(options) {
       }
       await call2(`/registry/code/runtime/sessions/${validSessionId(sessionId)}/chat/events`, { eventId, event });
     },
+    recallMemories: async (sessionId, subjects, limit) => {
+      const response2 = await call2(
+        `/registry/code/runtime/sessions/${validSessionId(sessionId)}/recall`,
+        { subjects: [...subjects], limit }
+      );
+      return Array.isArray(response2.memories) ? response2.memories : [];
+    },
+    rememberMemory: async (sessionId, memory) => {
+      await call2(`/registry/code/runtime/sessions/${validSessionId(sessionId)}/remember`, memory);
+    },
     reportSessionFailure: async (sessionId, message2) => {
       if (!message2.trim() || message2.length > 2e3) throw new TypeError("invalid Code session failure");
       await call2(`/registry/code/runtime/sessions/${validSessionId(sessionId)}/failure`, { message: message2 });
@@ -8216,6 +8400,29 @@ function validateOptions(options) {
     throw new TypeError("Code tool broker read-only prefix is invalid");
   }
 }
+var MAX_MEMORY_BODY = 4e3;
+function validateMemory(memory) {
+  if (!memory.subject.includes(":")) {
+    throw new TypeError(`memory subject must be a graph node id, got "${memory.subject}"`);
+  }
+  const body = memory.body.trim();
+  if (!body) throw new TypeError("a memory needs a body");
+  if (body.length > MAX_MEMORY_BODY) throw new TypeError("memory body exceeds its bound");
+  if (!memory.authorId.trim()) throw new TypeError("a memory needs an author");
+}
+function hazardFromAttempt(input) {
+  const body = [
+    `Attempt ${input.attempt} at "${input.goal.slice(0, 200)}" failed its proof.`,
+    input.feedback.replace(/\s+/g, " ").slice(0, MAX_MEMORY_BODY - 300)
+  ].join(" ");
+  return input.touched.slice(0, 10).map((path) => ({
+    subject: path.includes(":") ? path : `file:${path}`,
+    kind: "hazard",
+    body,
+    evidence: { kind: "gate", ref: input.verificationId },
+    authorId: input.authorId
+  }));
+}
 async function runGoal(spec, attempt) {
   assertBudget(spec.budget);
   const now = spec.now ?? Date.now;
@@ -8407,6 +8614,9 @@ function pursueRuntimeGoal(input) {
         return { gatePassed: false, feedback: "", tokens: outcome.tokens, error: outcome.error };
       }
       const verdict = await input.gate(attempt);
+      if (!verdict.passed && input.memory) {
+        await rememberFailure(input, attempt, verdict.feedback);
+      }
       return {
         gatePassed: verdict.passed,
         feedback: verdict.feedback,
@@ -8417,6 +8627,25 @@ function pursueRuntimeGoal(input) {
     }
   );
 }
+async function rememberFailure(input, attempt, feedback) {
+  if (!input.memory || !feedback.trim()) return;
+  try {
+    const touched = await input.touched?.(attempt) ?? [];
+    if (touched.length === 0) return;
+    for (const memory of hazardFromAttempt({
+      goal: input.spec.goal,
+      attempt,
+      feedback,
+      touched,
+      verificationId: `goal-${attempt}`,
+      authorId: input.memory.authorId
+    })) {
+      validateMemory(memory);
+      await input.memory.store.remember(memory);
+    }
+  } catch {
+  }
+}
 function goalEventLine(event) {
   if (event.type === "attempt_started") return `Goal attempt ${event.attempt} starting.`;
   if (event.type === "attempt_failed") return `Attempt ${event.attempt} did not satisfy the proof.`;
@@ -9681,7 +9910,9 @@ Commands:
                copilot, gemini, or agents (repeatable or comma-separated).
   secrets      Push configured db/o11y secrets into the Worker via wrangler
                stdin; set stores a tenant-vault secret and set-clerk-key the
-               reserved Clerk secret key, write-only from stdin or an env var.
+               reserved Clerk secret key, write-only from stdin or an env var;
+               status compares the secrets the config declares against the
+               names the environment's vault holds (--json for a report).
   version      Print the CLI version.
 
 Safety:
@@ -11664,7 +11895,7 @@ async function read2(url, headers, doFetch) {
 }
 
 // src/provision.ts
-import { AppsError as AppsError2, createAppsClient as createAppsClient3, orderAppServices as orderAppServices3, tenantIdFor as tenantIdFor5 } from "@odla-ai/apps";
+import { AppsError as AppsError2, createAppsClient as createAppsClient3, orderAppServices as orderAppServices3, tenantIdFor as tenantIdFor6 } from "@odla-ai/apps";
 import { putSecret as putSecret2 } from "@odla-ai/ai";
 import process13 from "process";
 
@@ -11721,9 +11952,9 @@ async function responseText(res) {
 }
 
 // src/provision-credentials.ts
-import { tenantIdFor as tenantIdFor4 } from "@odla-ai/apps";
+import { tenantIdFor as tenantIdFor5 } from "@odla-ai/apps";
 async function provisionEnvCredentials(opts) {
-  const tenantId = tenantIdFor4(opts.cfg.app.id, opts.env);
+  const tenantId = tenantIdFor5(opts.cfg.app.id, opts.env);
   const prior = opts.credentials?.envs[opts.env];
   let credentials = opts.credentials;
   let dbKey = opts.cfg.services.includes("db") && !opts.rotateDb ? prior?.dbKey : void 0;
@@ -12055,7 +12286,7 @@ async function provision(options) {
   }
   let devVarsCredentials = credentials;
   for (const env of cfg.envs) {
-    const tenantId = tenantIdFor5(cfg.app.id, env);
+    const tenantId = tenantIdFor6(cfg.app.id, env);
     let dbKey;
     if (options.pushSecrets) {
       const delivered = await deliverRuntimeCredentials(cfg, {
@@ -12257,7 +12488,7 @@ var COMMAND_SURFACE = {
     rm: {},
     lint: {}
   },
-  secrets: { push: {}, set: {}, "set-clerk-key": {} },
+  secrets: { push: {}, status: {}, set: {}, "set-clerk-key": {} },
   security: {
     plan: {},
     sources: {},
@@ -14032,9 +14263,9 @@ export {
   getScopedPlatformToken,
   SYSTEM_AI_PURPOSES,
   adminAi,
-  GOOGLE_CALENDAR_EVENTS_SCOPE,
   calendarServiceConfig,
   calendarBookingPageUrl,
+  GOOGLE_CALENDAR_EVENTS_SCOPE,
   calendarStatus,
   calendarCalendars,
   calendarConnect,
@@ -14084,4 +14315,4 @@ export {
   isTerminalHostedSecurityStatus,
   runCli
 };
-//# sourceMappingURL=chunk-L6YTOTWU.js.map
+//# sourceMappingURL=chunk-YSQORU5J.js.map