@odla-ai/cli 0.32.1 → 0.33.0

package/dist/index.cjs

@@ -1075,6 +1075,111 @@ function safeText(value2, max) {
   return typeof value2 === "string" && value2.trim().length > 0 && value2.length <= max && !/[\u0000-\u001f\u007f]/.test(value2);
 }
 
+// src/calendar-config.ts
+function calendarServiceConfig(cfg, env) {
+  if (!cfg.services.includes("calendar")) throw new Error("calendar service is not enabled in config services");
+  if (!cfg.envs.includes(env) && env !== "prod") throw new Error(`calendar env "${env}" is not declared in config envs`);
+  const google = cfg.calendar?.google;
+  if (!google) throw new Error("calendar.google is required when the calendar service is enabled");
+  const configured = google.availabilityCalendars?.[env] ?? google.calendars?.[env];
+  if (!configured?.length) throw new Error(`calendar.google.availabilityCalendars.${env} is required`);
+  const availability = unique(configured.map((id) => id.trim()));
+  return {
+    provider: "google",
+    access: "book",
+    bookingCalendarId: google.bookingCalendar?.[env]?.trim() ?? availability[0],
+    availabilityCalendars: availability
+  };
+}
+function calendarBookingPageUrl(cfg, env) {
+  const value2 = cfg.calendar?.google.bookingPageUrl?.[env];
+  if (value2 === void 0 || value2 === null) return value2;
+  return new URL(value2).toString();
+}
+function validateCalendarConfig(cfg, envs, services, path) {
+  const enabled = services.includes("calendar");
+  if (!cfg.calendar) {
+    if (enabled) throw new Error(`${path}: calendar.google is required when services includes "calendar"`);
+    return;
+  }
+  if (!isRecord5(cfg.calendar)) throw new Error(`${path}: calendar must be an object`);
+  assertOnly2(cfg.calendar, ["google"], `${path}: calendar`);
+  if (!isRecord5(cfg.calendar.google)) throw new Error(`${path}: calendar.google must be an object`);
+  const google = cfg.calendar.google;
+  assertOnly2(
+    google,
+    ["availabilityCalendars", "calendars", "bookingCalendar", "bookingPageUrl"],
+    `${path}: calendar.google`
+  );
+  const availabilityKey = google.availabilityCalendars !== void 0 ? "availabilityCalendars" : google.calendars !== void 0 ? "calendars" : null;
+  if (!availabilityKey || google.availabilityCalendars !== void 0 && google.calendars !== void 0) {
+    throw new Error(`${path}: calendar.google requires exactly one of availabilityCalendars or calendars (legacy)`);
+  }
+  const availability = google[availabilityKey];
+  if (!isRecord5(availability)) throw new Error(`${path}: calendar.google.${availabilityKey} must map env names to calendar ids`);
+  const unknownEnv = Object.keys(availability).find((env) => !envs.includes(env) && env !== "prod");
+  if (unknownEnv) throw new Error(`${path}: calendar.google.${availabilityKey}.${unknownEnv} is not in config envs`);
+  for (const env of envs) {
+    const ids = availability[env];
+    if (!Array.isArray(ids) || ids.length === 0) {
+      throw new Error(`${path}: calendar.google.${availabilityKey}.${env} must be a non-empty array`);
+    }
+  }
+  for (const [env, ids] of Object.entries(availability)) {
+    if (!Array.isArray(ids) || ids.length === 0) {
+      throw new Error(`${path}: calendar.google.${availabilityKey}.${env} must be a non-empty array`);
+    }
+    if (ids.length > 10) {
+      throw new Error(`${path}: calendar.google.${availabilityKey}.${env} must contain at most 10 calendar ids`);
+    }
+    if (ids.some((id) => !safeText2(id, 1024))) {
+      throw new Error(`${path}: calendar.google.${availabilityKey}.${env} contains an invalid calendar id`);
+    }
+  }
+  if (google.bookingCalendar !== void 0) {
+    if (!isRecord5(google.bookingCalendar)) throw new Error(`${path}: calendar.google.bookingCalendar must map env names to one calendar id`);
+    const unknownBookingEnv = Object.keys(google.bookingCalendar).find((env) => !envs.includes(env) && env !== "prod");
+    if (unknownBookingEnv) throw new Error(`${path}: calendar.google.bookingCalendar.${unknownBookingEnv} is not in config envs`);
+    for (const [env, value2] of Object.entries(google.bookingCalendar)) {
+      if (!safeText2(value2, 1024)) {
+        throw new Error(`${path}: calendar.google.bookingCalendar.${env} must be a calendar id`);
+      }
+    }
+  }
+  if (google.bookingPageUrl !== void 0) {
+    if (!isRecord5(google.bookingPageUrl)) throw new Error(`${path}: calendar.google.bookingPageUrl must map env names to HTTPS URLs or null`);
+    const unknownBookingEnv = Object.keys(google.bookingPageUrl).find((env) => !envs.includes(env) && env !== "prod");
+    if (unknownBookingEnv) throw new Error(`${path}: calendar.google.bookingPageUrl.${unknownBookingEnv} is not in config envs`);
+    for (const [env, value2] of Object.entries(google.bookingPageUrl)) {
+      if (value2 !== null && !safeHttpsUrl(value2)) {
+        throw new Error(`${path}: calendar.google.bookingPageUrl.${env} must be an HTTPS URL without credentials or fragment`);
+      }
+    }
+  }
+}
+function assertOnly2(value2, allowed, label) {
+  const extra = Object.keys(value2).find((key) => !allowed.includes(key));
+  if (extra) throw new Error(`${label}.${extra} is not supported`);
+}
+function isRecord5(value2) {
+  return value2 !== null && typeof value2 === "object" && !Array.isArray(value2);
+}
+function safeText2(value2, max) {
+  return typeof value2 === "string" && value2.trim().length > 0 && value2.length <= max && !/[\u0000-\u001f\u007f]/.test(value2);
+}
+function safeHttpsUrl(value2) {
+  if (typeof value2 !== "string" || value2.length > 2048) return false;
+  try {
+    const url = new URL(value2);
+    return url.protocol === "https:" && !url.username && !url.password && !url.hash;
+  } catch {
+    return false;
+  }
+}
+function unique(values) {
+  return [...new Set(values.filter(Boolean))];
+}
+
 // src/integration-validation.ts
 function validateIntegrations(cfg, path, defaultServices) {
   if (cfg.integrations === void 0) return;
@@ -1082,36 +1187,61 @@ function validateIntegrations(cfg, path, defaultServices) {
   const ids = /* @__PURE__ */ new Set();
   for (const [index, integration] of cfg.integrations.entries()) {
     const at = `${path}: integrations[${index}]`;
-    if (!isRecord5(integration)) throw new Error(`${at} must be an object`);
+    if (!isRecord6(integration)) throw new Error(`${at} must be an object`);
     if (!validId(integration.id)) throw new Error(`${at}.id must be lowercase letters, numbers, and hyphens`);
     if (ids.has(integration.id)) throw new Error(`${path}: duplicate integration id "${integration.id}"`);
     ids.add(integration.id);
-    if (!safeText2(integration.title, 200)) throw new Error(`${at}.title is required`);
-    if (!safeText2(integration.npm, 200)) throw new Error(`${at}.npm is required`);
-    if (integration.schema !== void 0 && (!isRecord5(integration.schema) || !isRecord5(integration.schema.entities))) {
+    if (!safeText3(integration.title, 200)) throw new Error(`${at}.title is required`);
+    if (!safeText3(integration.npm, 200)) throw new Error(`${at}.npm is required`);
+    if (integration.schema !== void 0 && (!isRecord6(integration.schema) || !isRecord6(integration.schema.entities))) {
       throw new Error(`${at}.schema must contain an entities object`);
     }
-    if (integration.rules !== void 0 && !isRecord5(integration.rules)) throw new Error(`${at}.rules must be an object`);
+    if (integration.rules !== void 0 && !isRecord6(integration.rules)) throw new Error(`${at}.rules must be an object`);
     validateSeeds(integration, at);
     validateProbes(integration, at);
+    validateSecrets(integration.secrets, at);
   }
   const needsDb = cfg.integrations.some((integration) => integration.schema || integration.rules || integration.seeds?.length);
-  const services = unique(cfg.services?.length ? cfg.services : defaultServices);
+  const services = unique2(cfg.services?.length ? cfg.services : defaultServices);
   if (needsDb && !services.includes("db")) throw new Error(`${path}: schema/rules/seed integrations require the db service`);
 }
+var SECRET_NAME = /^\$?[a-z][a-z0-9_]*$/;
+function validateSecrets(value2, at) {
+  if (value2 === void 0) return;
+  if (!Array.isArray(value2)) throw new Error(`${at}.secrets must be an array`);
+  const names = /* @__PURE__ */ new Set();
+  for (const [index, secret] of value2.entries()) {
+    const sat = `${at}.secrets[${index}]`;
+    if (!isRecord6(secret)) throw new Error(`${sat} must be an object`);
+    if (typeof secret.name !== "string" || !SECRET_NAME.test(secret.name) || secret.name.length > 64) {
+      throw new Error(`${sat}.name must be lowercase snake_case (optionally "$"-prefixed when reserved), e.g. "clerk_webhook_secret"`);
+    }
+    const dollar = secret.name.startsWith("$");
+    if (dollar !== (secret.reserved === true)) {
+      throw new Error(
+        dollar ? `${sat}.name is "$"-prefixed, so it must also set reserved: true` : `${sat} sets reserved: true, so its name must be "$"-prefixed`
+      );
+    }
+    if (!safeText3(secret.description, 500)) throw new Error(`${sat}.description is required \u2014 it is what doctor and the docs show`);
+    if (secret.pattern !== void 0 && !safeText3(secret.pattern, 64)) throw new Error(`${sat}.pattern must be a non-empty prefix string`);
+    if (secret.required !== void 0 && typeof secret.required !== "boolean") throw new Error(`${sat}.required must be a boolean`);
+    if (names.has(secret.name)) throw new Error(`${at} declares secret "${secret.name}" twice`);
+    names.add(secret.name);
+  }
+}
 function validateSeeds(integration, at) {
   if (integration.seeds === void 0) return;
   if (!Array.isArray(integration.seeds)) throw new Error(`${at}.seeds must be an array`);
   const ids = /* @__PURE__ */ new Set();
   for (const [index, seed] of integration.seeds.entries()) {
     const sat = `${at}.seeds[${index}]`;
-    if (!isRecord5(seed) || !safeText2(seed.id, 200) || !safeText2(seed.ns, 200)) throw new Error(`${sat} requires id and ns`);
+    if (!isRecord6(seed) || !safeText3(seed.id, 200) || !safeText3(seed.ns, 200)) throw new Error(`${sat} requires id and ns`);
     if (ids.has(seed.id)) throw new Error(`${at} has duplicate seed id "${seed.id}"`);
     ids.add(seed.id);
-    if (!isRecord5(seed.key) || !safeText2(seed.key.attr, 200) || !safeText2(seed.key.value, 2048)) {
+    if (!isRecord6(seed.key) || !safeText3(seed.key.attr, 200) || !safeText3(seed.key.value, 2048)) {
       throw new Error(`${sat}.key requires string attr and value`);
     }
-    if (!isRecord5(seed.attrs)) throw new Error(`${sat}.attrs must be an object`);
+    if (!isRecord6(seed.attrs)) throw new Error(`${sat}.attrs must be an object`);
     if (Object.hasOwn(seed.attrs, seed.key.attr) && seed.attrs[seed.key.attr] !== seed.key.value) {
       throw new Error(`${sat}.attrs.${seed.key.attr} conflicts with its natural key`);
     }
@@ -1122,16 +1252,16 @@ function validateProbes(integration, at) {
   if (!Array.isArray(integration.probes)) throw new Error(`${at}.probes must be an array`);
   for (const [index, probe] of integration.probes.entries()) {
     const pat = `${at}.probes[${index}]`;
-    if (!isRecord5(probe) || !safeProbePath(probe.path)) throw new Error(`${pat}.path must be an absolute path without query or fragment`);
+    if (!isRecord6(probe) || !safeProbePath(probe.path)) throw new Error(`${pat}.path must be an absolute path without query or fragment`);
     if (!Number.isInteger(probe.expectedStatus) || probe.expectedStatus < 100 || probe.expectedStatus > 599) {
       throw new Error(`${pat}.expectedStatus must be an HTTP status`);
     }
   }
 }
-function isRecord5(value2) {
+function isRecord6(value2) {
   return value2 !== null && typeof value2 === "object" && !Array.isArray(value2);
 }
-function safeText2(value2, max) {
+function safeText3(value2, max) {
   return typeof value2 === "string" && value2.trim().length > 0 && value2.length <= max && !/[\u0000-\u001f\u007f]/.test(value2);
 }
 function safeProbePath(value2) {
@@ -1140,7 +1270,7 @@ function safeProbePath(value2) {
 function validId(value2) {
   return typeof value2 === "string" && /^[a-z0-9][a-z0-9-]*$/.test(value2);
 }
-function unique(values) {
+function unique2(values) {
   return [...new Set(values.filter(Boolean))];
 }
 
@@ -1160,10 +1290,10 @@ async function loadProjectConfig(configPath = "odla.config.mjs", options = {}) {
   validateRawConfig(raw, resolved);
   const platformUrl = trimSlash(process.env.ODLA_PLATFORM_URL || raw.platformUrl || DEFAULT_PLATFORM);
   const dbEndpoint = trimSlash(process.env.ODLA_DB_ENDPOINT || raw.dbEndpoint || platformUrl);
-  const envs = unique2(raw.envs?.length ? raw.envs : DEFAULT_ENVS);
-  const services = unique2(raw.services?.length ? raw.services : DEFAULT_SERVICES);
+  const envs = unique3(raw.envs?.length ? raw.envs : DEFAULT_ENVS);
+  const services = unique3(raw.services?.length ? raw.services : DEFAULT_SERVICES);
   validateServices(services, resolved);
-  validateCalendarConfig(raw, unique2([...envs, ...options.additionalEnvs ?? []]), services, resolved);
+  validateCalendarConfig(raw, unique3([...envs, ...options.additionalEnvs ?? []]), services, resolved);
   const local = {
     tokenFile: (0, import_node_path4.resolve)(rootDir, raw.local?.tokenFile ?? ".odla/dev-token.json"),
     credentialsFile: (0, import_node_path4.resolve)(rootDir, raw.local?.credentialsFile ?? ".odla/credentials.local.json"),
@@ -1211,26 +1341,6 @@ function buildPlan(cfg) {
     aiProvider: cfg.ai?.provider
   };
 }
-function calendarServiceConfig(cfg, env) {
-  if (!cfg.services.includes("calendar")) throw new Error("calendar service is not enabled in config services");
-  if (!cfg.envs.includes(env) && env !== "prod") throw new Error(`calendar env "${env}" is not declared in config envs`);
-  const google = cfg.calendar?.google;
-  if (!google) throw new Error("calendar.google is required when the calendar service is enabled");
-  const configured = google.availabilityCalendars?.[env] ?? google.calendars?.[env];
-  if (!configured?.length) throw new Error(`calendar.google.availabilityCalendars.${env} is required`);
-  const availability = unique2(configured.map((id) => id.trim()));
-  return {
-    provider: "google",
-    access: "book",
-    bookingCalendarId: google.bookingCalendar?.[env]?.trim() ?? availability[0],
-    availabilityCalendars: availability
-  };
-}
-function calendarBookingPageUrl(cfg, env) {
-  const value2 = cfg.calendar?.google.bookingPageUrl?.[env];
-  if (value2 === void 0 || value2 === null) return value2;
-  return new URL(value2).toString();
-}
 function rulesFromSchema(schema) {
   const entities = serializedEntities(schema);
   return Object.fromEntries(
@@ -1262,69 +1372,9 @@ function validateRawConfig(raw, path) {
     throw new Error(`${path}: services must be an array of non-empty names`);
   }
   validateAiConfig(cfg, path);
+  validateSecrets(cfg.secrets, `${path}: config`);
   validateIntegrations(cfg, path, DEFAULT_SERVICES);
 }
-function validateCalendarConfig(cfg, envs, services, path) {
-  const enabled = services.includes("calendar");
-  if (!cfg.calendar) {
-    if (enabled) throw new Error(`${path}: calendar.google is required when services includes "calendar"`);
-    return;
-  }
-  if (!isRecord6(cfg.calendar)) throw new Error(`${path}: calendar must be an object`);
-  assertOnly2(cfg.calendar, ["google"], `${path}: calendar`);
-  if (!isRecord6(cfg.calendar.google)) throw new Error(`${path}: calendar.google must be an object`);
-  const google = cfg.calendar.google;
-  assertOnly2(
-    google,
-    ["availabilityCalendars", "calendars", "bookingCalendar", "bookingPageUrl"],
-    `${path}: calendar.google`
-  );
-  const availabilityKey = google.availabilityCalendars !== void 0 ? "availabilityCalendars" : google.calendars !== void 0 ? "calendars" : null;
-  if (!availabilityKey || google.availabilityCalendars !== void 0 && google.calendars !== void 0) {
-    throw new Error(`${path}: calendar.google requires exactly one of availabilityCalendars or calendars (legacy)`);
-  }
-  const availability = google[availabilityKey];
-  if (!isRecord6(availability)) throw new Error(`${path}: calendar.google.${availabilityKey} must map env names to calendar ids`);
-  const unknownEnv = Object.keys(availability).find((env) => !envs.includes(env) && env !== "prod");
-  if (unknownEnv) throw new Error(`${path}: calendar.google.${availabilityKey}.${unknownEnv} is not in config envs`);
-  for (const env of envs) {
-    const ids = availability[env];
-    if (!Array.isArray(ids) || ids.length === 0) {
-      throw new Error(`${path}: calendar.google.${availabilityKey}.${env} must be a non-empty array`);
-    }
-  }
-  for (const [env, ids] of Object.entries(availability)) {
-    if (!Array.isArray(ids) || ids.length === 0) {
-      throw new Error(`${path}: calendar.google.${availabilityKey}.${env} must be a non-empty array`);
-    }
-    if (ids.length > 10) {
-      throw new Error(`${path}: calendar.google.${availabilityKey}.${env} must contain at most 10 calendar ids`);
-    }
-    if (ids.some((id) => !safeText3(id, 1024))) {
-      throw new Error(`${path}: calendar.google.${availabilityKey}.${env} contains an invalid calendar id`);
-    }
-  }
-  if (google.bookingCalendar !== void 0) {
-    if (!isRecord6(google.bookingCalendar)) throw new Error(`${path}: calendar.google.bookingCalendar must map env names to one calendar id`);
-    const unknownBookingEnv = Object.keys(google.bookingCalendar).find((env) => !envs.includes(env) && env !== "prod");
-    if (unknownBookingEnv) throw new Error(`${path}: calendar.google.bookingCalendar.${unknownBookingEnv} is not in config envs`);
-    for (const [env, value2] of Object.entries(google.bookingCalendar)) {
-      if (!safeText3(value2, 1024)) {
-        throw new Error(`${path}: calendar.google.bookingCalendar.${env} must be a calendar id`);
-      }
-    }
-  }
-  if (google.bookingPageUrl !== void 0) {
-    if (!isRecord6(google.bookingPageUrl)) throw new Error(`${path}: calendar.google.bookingPageUrl must map env names to HTTPS URLs or null`);
-    const unknownBookingEnv = Object.keys(google.bookingPageUrl).find((env) => !envs.includes(env) && env !== "prod");
-    if (unknownBookingEnv) throw new Error(`${path}: calendar.google.bookingPageUrl.${unknownBookingEnv} is not in config envs`);
-    for (const [env, value2] of Object.entries(google.bookingPageUrl)) {
-      if (value2 !== null && !safeHttpsUrl(value2)) {
-        throw new Error(`${path}: calendar.google.bookingPageUrl.${env} must be an HTTPS URL without credentials or fragment`);
-      }
-    }
-  }
-}
 function validateServices(services, path) {
   for (const service of services) {
     const definition = (0, import_apps.appServiceDefinition)(service);
@@ -1338,25 +1388,6 @@ function validateServices(services, path) {
     }
   }
 }
-function assertOnly2(value2, allowed, label) {
-  const extra = Object.keys(value2).find((key) => !allowed.includes(key));
-  if (extra) throw new Error(`${label}.${extra} is not supported`);
-}
-function isRecord6(value2) {
-  return value2 !== null && typeof value2 === "object" && !Array.isArray(value2);
-}
-function safeText3(value2, max) {
-  return typeof value2 === "string" && value2.trim().length > 0 && value2.length <= max && !/[\u0000-\u001f\u007f]/.test(value2);
-}
-function safeHttpsUrl(value2) {
-  if (typeof value2 !== "string" || value2.length > 2048) return false;
-  try {
-    const url = new URL(value2);
-    return url.protocol === "https:" && !url.username && !url.password && !url.hash;
-  } catch {
-    return false;
-  }
-}
 function validId2(value2) {
   return typeof value2 === "string" && /^[a-z0-9][a-z0-9-]*$/.test(value2);
 }
@@ -1371,7 +1402,7 @@ async function loadConfigModule(path) {
 function trimSlash(value2) {
   return value2.replace(/\/+$/, "");
 }
-function unique2(values) {
+function unique3(values) {
   return [...new Set(values.filter(Boolean))];
 }
 
@@ -4196,6 +4227,67 @@ function isRecord7(value2) {
   return value2 !== null && typeof value2 === "object" && !Array.isArray(value2);
 }
 
+// src/secret-contract.ts
+var APP_SOURCE = "app";
+function resolveSecretContract(cfg) {
+  const byName = /* @__PURE__ */ new Map();
+  const declarations = [
+    ...(cfg.secrets ?? []).map((secret) => ({ source: APP_SOURCE, secret })),
+    ...(cfg.integrations ?? []).flatMap(
+      (integration) => (integration.secrets ?? []).map((secret) => ({ source: integration.id, secret }))
+    )
+  ];
+  for (const { source, secret } of declarations) {
+    const existing = byName.get(secret.name);
+    if (!existing) {
+      byName.set(secret.name, { ...secret, required: secret.required !== false, sources: [source] });
+      continue;
+    }
+    existing.sources.push(source);
+    existing.required = existing.required || secret.required !== false;
+    existing.pattern ??= secret.pattern;
+  }
+  return [...byName.values()].sort((a, b) => a.name.localeCompare(b.name));
+}
+function secretContractWarnings(contract, cfg) {
+  const warnings = [];
+  const declaredPatterns = /* @__PURE__ */ new Map();
+  for (const integration of cfg.integrations ?? []) {
+    for (const secret of integration.secrets ?? []) {
+      if (!secret.pattern) continue;
+      const seen = declaredPatterns.get(secret.name) ?? /* @__PURE__ */ new Map();
+      seen.set(integration.id, secret.pattern);
+      declaredPatterns.set(secret.name, seen);
+    }
+  }
+  for (const secret of cfg.secrets ?? []) {
+    if (!secret.pattern) continue;
+    const seen = declaredPatterns.get(secret.name) ?? /* @__PURE__ */ new Map();
+    seen.set(APP_SOURCE, secret.pattern);
+    declaredPatterns.set(secret.name, seen);
+  }
+  for (const [name, seen] of declaredPatterns) {
+    const distinct = [...new Set(seen.values())];
+    if (distinct.length > 1) {
+      const detail = [...seen].map(([source, pattern]) => `${source} expects "${pattern}"`).join(", ");
+      warnings.push(`secret "${name}" has conflicting patterns \u2014 ${detail}; one of them will reject a valid value`);
+    }
+  }
+  if (contract.length > 0 && !cfg.services.includes("db")) {
+    const names = contract.map((secret) => secret.name).join(", ");
+    warnings.push(`secrets are declared (${names}) but the db service is off \u2014 nothing can read the tenant vault`);
+  }
+  return warnings;
+}
+function formatSecretContract(contract) {
+  return contract.map((secret) => {
+    const flags = [secret.required ? "required" : "optional"];
+    if (secret.reserved) flags.push("reserved");
+    if (secret.pattern) flags.push(`${secret.pattern}\u2026`);
+    return `  ${secret.name} (${flags.join(", ")}) \u2014 ${secret.sources.join(", ")}`;
+  });
+}
+
 // src/doctor.ts
 async function doctor(options) {
   const out = options.stdout ?? console;
@@ -4212,6 +4304,9 @@ async function doctor(options) {
   out.log(`schema: ${schema ? `${entities.length} entities` : "none"}`);
   out.log(`rules:  ${rules ? `${Object.keys(rules).length} namespaces` : "none"}`);
   out.log(`ai:     ${cfg.services.includes("ai") ? cfg.ai?.provider ? `byok/${cfg.ai.provider}` : "hosted" : "not enabled"}`);
+  const contract = resolveSecretContract(cfg);
+  out.log(`secrets: ${contract.length ? `${contract.length} declared` : "none declared"}`);
+  for (const line of formatSecretContract(contract)) out.log(line);
   if (cfg.services.includes("calendar")) {
     const calendar = cfg.envs.map((env) => {
       const resolved = calendarServiceConfig(cfg, env);
@@ -4232,6 +4327,7 @@ async function doctor(options) {
     }
   }
   warnings.push(...integrationWarnings(database.integrations, schema, rules));
+  warnings.push(...secretContractWarnings(contract, cfg));
   if (cfg.services.includes("ai") && cfg.ai?.mode === "byok" && !cfg.ai.provider) {
     warnings.push("ai.mode is byok but ai.provider is not set");
   }
@@ -4558,6 +4654,71 @@ async function resolveVaultWrite(options) {
   return { cfg, tenantId: (0, import_apps10.tenantIdFor)(cfg.app.id, env), value: value2, doFetch, out };
 }
 
+// src/secrets-status.ts
+var import_apps11 = require("@odla-ai/apps");
+async function secretsStatus(options) {
+  const out = options.stdout ?? console;
+  const doFetch = options.fetch ?? fetch;
+  const cfg = await loadProjectConfig(options.configPath);
+  if (!cfg.envs.includes(options.env)) {
+    throw new Error(`env "${options.env}" is not in config envs (${cfg.envs.join(", ")})`);
+  }
+  const tenantId = (0, import_apps11.tenantIdFor)(cfg.app.id, options.env);
+  const contract = resolveSecretContract(cfg);
+  const token = await getDeveloperToken(cfg, options, doFetch, out);
+  const res = await doFetch(`${cfg.dbEndpoint}/admin/apps/${encodeURIComponent(tenantId)}/secrets`, {
+    headers: { authorization: `Bearer ${token}` }
+  });
+  if (!res.ok) {
+    const detail = (await res.text().catch(() => "")).slice(0, 300);
+    throw new Error(`list secrets for ${tenantId} failed (${res.status}): ${detail || "request failed"}`);
+  }
+  const body = await res.json();
+  const stored = new Set((body.secrets ?? []).map((entry) => String(entry.name)));
+  const report4 = buildReport(cfg.app.id, options.env, tenantId, contract, stored);
+  if (options.json) out.log(JSON.stringify(report4, null, 2));
+  else printReport(report4, out);
+  return report4;
+}
+function buildReport(appId, env, tenant, contract, stored) {
+  const declared = new Set(contract.map((secret) => secret.name));
+  const rows = contract.map((secret) => ({
+    name: secret.name,
+    state: secret.reserved ? "reserved" : stored.has(secret.name) ? "set" : "missing",
+    required: secret.required,
+    sources: secret.sources,
+    description: secret.description
+  }));
+  for (const name of [...stored].sort()) {
+    if (!declared.has(name)) rows.push({ name, state: "undeclared", required: false, sources: [] });
+  }
+  const ok = rows.every((row) => row.state !== "missing" || !row.required);
+  return { app: appId, env, tenant, secrets: rows, ok };
+}
+function printReport(report4, out) {
+  out.log(`${report4.app} (${report4.tenant})`);
+  if (report4.secrets.length === 0) {
+    out.log("  no secrets declared and none stored");
+    return;
+  }
+  for (const row of report4.secrets) {
+    const label = row.state === "missing" && !row.required ? "missing (optional)" : row.state;
+    const suffix = row.sources.length ? ` \u2014 ${row.sources.join(", ")}` : "";
+    out.log(`  ${label.padEnd(18)} ${row.name}${suffix}`);
+  }
+  const missing = report4.secrets.filter((row) => row.state === "missing" && row.required);
+  if (missing.length) {
+    out.log("");
+    for (const row of missing) {
+      out.log(`${row.name} is required but not set \u2014 "odla-ai secrets set ${row.name} --env ${report4.env} --stdin"`);
+    }
+  }
+  if (report4.secrets.some((row) => row.state === "reserved")) {
+    out.log("");
+    out.log('"reserved" slots are never enumerated by the vault; presence cannot be confirmed here.');
+  }
+}
+
 // src/skill.ts
 var import_node_fs13 = require("fs");
 var import_node_os2 = require("os");
@@ -5027,9 +5188,22 @@ async function secretsCommand(parsed, deps) {
     await (sub === "set" ? secretsSet(options) : secretsSetClerkKey(options));
     return;
   }
+  if (sub === "status") {
+    assertArgs(parsed, ["config", "env", "token", "email", "json"], 2);
+    await secretsStatus({
+      configPath: stringOpt(parsed.options.config) ?? "odla.config.mjs",
+      env: requiredString(parsed.options.env, "--env"),
+      json: parsed.options.json === true,
+      token: stringOpt(parsed.options.token),
+      email: stringOpt(parsed.options.email),
+      fetch: deps.fetch,
+      stdout: deps.stdout
+    });
+    return;
+  }
   if (sub !== "push") {
     throw new Error(
-      `unknown secrets subcommand "${sub ?? ""}". Try "odla-ai secrets push --env dev", "odla-ai secrets set <name> --env dev --stdin", or "odla-ai secrets set-clerk-key --env dev --stdin".`
+      `unknown secrets subcommand "${sub ?? ""}". Try "odla-ai secrets push --env dev", "odla-ai secrets status --env dev", "odla-ai secrets set <name> --env dev --stdin", or "odla-ai secrets set-clerk-key --env dev --stdin".`
     );
   }
   assertArgs(parsed, ["config", "env", "dry-run", "yes"], 2);
@@ -5553,7 +5727,7 @@ async function stageWorkspacePair(baselineSource, workspaceSource, options = {})
   }
 }
 
-// ../harness/dist/chunk-5FFR7U4L.js
+// ../harness/dist/chunk-ANNX7VGK.js
 var import_crypto = require("crypto");
 var import_promises5 = require("fs/promises");
 var import_path5 = require("path");
@@ -5613,9 +5787,9 @@ function dependenciesOf(values, influence = "data") {
       result.push({ ref, influence, promptSafetyAtUse: value2.label.promptSafety });
     }
   }
-  const unique3 = /* @__PURE__ */ new Map();
-  for (const dep of result) unique3.set(`${dep.ref.kind}\0${dep.ref.id}\0${dep.influence}\0${dep.promptSafetyAtUse}`, dep);
-  return [...unique3.values()];
+  const unique4 = /* @__PURE__ */ new Map();
+  for (const dep of result) unique4.set(`${dep.ref.kind}\0${dep.ref.id}\0${dep.influence}\0${dep.promptSafetyAtUse}`, dep);
+  return [...unique4.values()];
 }
 
 // ../camel/dist/chunk-4DQ6BIHP.js
@@ -5890,7 +6064,7 @@ function validateSnapshot(snapshot, limits) {
   }
 }
 
-// ../harness/dist/chunk-5FFR7U4L.js
+// ../harness/dist/chunk-ANNX7VGK.js
 var import_child_process4 = require("child_process");
 var import_promises6 = require("fs/promises");
 var import_path6 = require("path");
@@ -6192,7 +6366,7 @@ function looksLikeDestination(value2) {
   return /^(?:[a-z][a-z0-9+.-]*:\/\/|\/|\\\\)/i.test(text2) || /^[\w.-]+\.[a-z]{2,}(?:[/:]|$)/i.test(text2);
 }
 
-// ../harness/dist/chunk-5FFR7U4L.js
+// ../harness/dist/chunk-ANNX7VGK.js
 var import_promises10 = require("fs/promises");
 var import_promises11 = require("fs/promises");
 var import_path10 = require("path");
@@ -6460,7 +6634,7 @@ async function buildCodeGraph(input) {
   return builder.build();
 }
 
-// ../harness/dist/chunk-5FFR7U4L.js
+// ../harness/dist/chunk-ANNX7VGK.js
 var import_crypto4 = require("crypto");
 async function digestStagedWorkspace(root, limits) {
   const files = [];
@@ -6647,6 +6821,16 @@ function createCodeRuntimeControlClient(options) {
       }
       await call2(`/registry/code/runtime/sessions/${validSessionId(sessionId)}/chat/events`, { eventId, event });
     },
+    recallMemories: async (sessionId, subjects, limit) => {
+      const response2 = await call2(
+        `/registry/code/runtime/sessions/${validSessionId(sessionId)}/recall`,
+        { subjects: [...subjects], limit }
+      );
+      return Array.isArray(response2.memories) ? response2.memories : [];
+    },
+    rememberMemory: async (sessionId, memory) => {
+      await call2(`/registry/code/runtime/sessions/${validSessionId(sessionId)}/remember`, memory);
+    },
     reportSessionFailure: async (sessionId, message2) => {
       if (!message2.trim() || message2.length > 2e3) throw new TypeError("invalid Code session failure");
       await call2(`/registry/code/runtime/sessions/${validSessionId(sessionId)}/failure`, { message: message2 });
@@ -8341,6 +8525,29 @@ function validateOptions(options) {
     throw new TypeError("Code tool broker read-only prefix is invalid");
   }
 }
+var MAX_MEMORY_BODY = 4e3;
+function validateMemory(memory) {
+  if (!memory.subject.includes(":")) {
+    throw new TypeError(`memory subject must be a graph node id, got "${memory.subject}"`);
+  }
+  const body = memory.body.trim();
+  if (!body) throw new TypeError("a memory needs a body");
+  if (body.length > MAX_MEMORY_BODY) throw new TypeError("memory body exceeds its bound");
+  if (!memory.authorId.trim()) throw new TypeError("a memory needs an author");
+}
+function hazardFromAttempt(input) {
+  const body = [
+    `Attempt ${input.attempt} at "${input.goal.slice(0, 200)}" failed its proof.`,
+    input.feedback.replace(/\s+/g, " ").slice(0, MAX_MEMORY_BODY - 300)
+  ].join(" ");
+  return input.touched.slice(0, 10).map((path) => ({
+    subject: path.includes(":") ? path : `file:${path}`,
+    kind: "hazard",
+    body,
+    evidence: { kind: "gate", ref: input.verificationId },
+    authorId: input.authorId
+  }));
+}
 async function runGoal(spec, attempt) {
   assertBudget(spec.budget);
   const now = spec.now ?? Date.now;
@@ -8532,6 +8739,9 @@ function pursueRuntimeGoal(input) {
         return { gatePassed: false, feedback: "", tokens: outcome.tokens, error: outcome.error };
       }
       const verdict = await input.gate(attempt);
+      if (!verdict.passed && input.memory) {
+        await rememberFailure(input, attempt, verdict.feedback);
+      }
       return {
         gatePassed: verdict.passed,
         feedback: verdict.feedback,
@@ -8542,6 +8752,25 @@ function pursueRuntimeGoal(input) {
     }
   );
 }
+async function rememberFailure(input, attempt, feedback) {
+  if (!input.memory || !feedback.trim()) return;
+  try {
+    const touched = await input.touched?.(attempt) ?? [];
+    if (touched.length === 0) return;
+    for (const memory of hazardFromAttempt({
+      goal: input.spec.goal,
+      attempt,
+      feedback,
+      touched,
+      verificationId: `goal-${attempt}`,
+      authorId: input.memory.authorId
+    })) {
+      validateMemory(memory);
+      await input.memory.store.remember(memory);
+    }
+  } catch {
+  }
+}
 function goalEventLine(event) {
   if (event.type === "attempt_started") return `Goal attempt ${event.attempt} starting.`;
   if (event.type === "attempt_failed") return `Attempt ${event.attempt} did not satisfy the proof.`;
@@ -9806,7 +10035,9 @@ Commands:
                copilot, gemini, or agents (repeatable or comma-separated).
   secrets      Push configured db/o11y secrets into the Worker via wrangler
                stdin; set stores a tenant-vault secret and set-clerk-key the
-               reserved Clerk secret key, write-only from stdin or an env var.
+               reserved Clerk secret key, write-only from stdin or an env var;
+               status compares the secrets the config declares against the
+               names the environment's vault holds (--json for a report).
   version      Print the CLI version.
 
 Safety:
@@ -11789,7 +12020,7 @@ async function read2(url, headers, doFetch) {
 }
 
 // src/provision.ts
-var import_apps12 = require("@odla-ai/apps");
+var import_apps13 = require("@odla-ai/apps");
 var import_ai5 = require("@odla-ai/ai");
 var import_node_process12 = __toESM(require("process"), 1);
 
@@ -11846,9 +12077,9 @@ async function responseText(res) {
 }
 
 // src/provision-credentials.ts
-var import_apps11 = require("@odla-ai/apps");
+var import_apps12 = require("@odla-ai/apps");
 async function provisionEnvCredentials(opts) {
-  const tenantId = (0, import_apps11.tenantIdFor)(opts.cfg.app.id, opts.env);
+  const tenantId = (0, import_apps12.tenantIdFor)(opts.cfg.app.id, opts.env);
   const prior = opts.credentials?.envs[opts.env];
   let credentials = opts.credentials;
   let dbKey = opts.cfg.services.includes("db") && !opts.rotateDb ? prior?.dbKey : void 0;
@@ -12121,7 +12352,7 @@ async function provision(options) {
     optionalProjectCapabilities: ["app.manage"],
     forceReview: options.requestGrant
   });
-  const apps = (0, import_apps12.createAppsClient)({ endpoint: cfg.platformUrl, token, fetcher: { fetch: doFetch } });
+  const apps = (0, import_apps13.createAppsClient)({ endpoint: cfg.platformUrl, token, fetcher: { fetch: doFetch } });
   const existing = await apps.resolveApp(cfg.app.id);
   if (existing) {
     out.log(`app: ${cfg.app.id} already exists`);
@@ -12133,7 +12364,7 @@ async function provision(options) {
     try {
       await apps.createApp({ name: cfg.app.name, appId: cfg.app.id });
     } catch (error) {
-      if (error instanceof import_apps12.AppsError && error.status === 403) {
+      if (error instanceof import_apps13.AppsError && error.status === 403) {
         throw new Error(
           `app "${cfg.app.id}" does not exist, and this authenticated agent credential has no owner-reviewed app.manage bootstrap grant for that exact id. Run "odla-ai provision --request-grant --email <odla-account>" to open the review URL and continue; developer ownership alone is not agent authority`,
           { cause: error }
@@ -12146,7 +12377,7 @@ async function provision(options) {
   for (const env of cfg.envs) {
     await assertTenantAdminAccess(doFetch, cfg, env, token);
   }
-  const serviceOrder = (0, import_apps12.orderAppServices)(cfg.services);
+  const serviceOrder = (0, import_apps13.orderAppServices)(cfg.services);
   for (const env of cfg.envs) {
     for (const service of serviceOrder) {
       if (service === "ai") {
@@ -12180,7 +12411,7 @@ async function provision(options) {
   }
   let devVarsCredentials = credentials;
   for (const env of cfg.envs) {
-    const tenantId = (0, import_apps12.tenantIdFor)(cfg.app.id, env);
+    const tenantId = (0, import_apps13.tenantIdFor)(cfg.app.id, env);
     let dbKey;
     if (options.pushSecrets) {
       const delivered = await deliverRuntimeCredentials(cfg, {
@@ -12382,7 +12613,7 @@ var COMMAND_SURFACE = {
     rm: {},
     lint: {}
   },
-  secrets: { push: {}, set: {}, "set-clerk-key": {} },
+  secrets: { push: {}, status: {}, set: {}, "set-clerk-key": {} },
   security: {
     plan: {},
     sources: {},