@odla-ai/cli 0.32.1 → 0.33.0

package/dist/index.d.cts

@@ -419,6 +419,35 @@ interface IntegrationProbe {
     /** Expected unauthenticated HTTP status, normally 401. */
     expectedStatus: number;
 }
+/**
+ * One tenant-vault secret a capability or app needs in order to work.
+ *
+ * This is the declaration half of the declaration/storage split: the contract
+ * is committed, the value never is. Declaring a secret does not store, read, or
+ * transmit it — `odla-ai secrets set` remains the only write path and values
+ * stay write-only afterwards. Declarations exist so `doctor` can tell "not set
+ * yet" apart from "not needed", so an agent can discover what to ask a human
+ * for instead of learning it from prose, and so `check:secrets` can prove the
+ * declared name is the name the runtime actually reads.
+ */
+interface IntegrationSecret {
+    /** Vault name, byte-identical to what `odla-ai secrets set <name>` writes and
+     * what the runtime passes to `getSecret`. Reserved slots keep their `$`. */
+    name: string;
+    /** What the secret is for, and what breaks without it. */
+    description: string;
+    /** Expected value prefix, e.g. `whsec_`. Advisory: never matched against a
+     * stored value (the CLI cannot read one back), only against a value on its
+     * way in. */
+    pattern?: string;
+    /** Platform-managed `$`-prefixed slot. Reserved secrets are never readable by
+     * an app key and are written by a dedicated command, not `secrets set`. */
+    reserved?: boolean;
+    /** Whether the capability is broken without it. Defaults to `true`; set
+     * `false` for secrets only some configurations need, so `doctor` reports them
+     * as available rather than missing. */
+    required?: boolean;
+}
 /** Structural, data-only capability descriptor consumed from
  * `odla.config.mjs`. Capability packages do not depend on the CLI; their
  * descriptors only need to conform to this shape. */
@@ -440,6 +469,8 @@ interface OdlaIntegration {
     seeds?: IntegrationSeed[];
     /** Read-only unauthenticated checks run against `links.<env>`. */
     probes?: IntegrationProbe[];
+    /** Tenant-vault secrets this capability reads. Names only — never values. */
+    secrets?: IntegrationSecret[];
 }
 interface ClerkAuthConfig {
     publishableKey?: string;
@@ -486,6 +517,9 @@ interface OdlaProjectConfig {
     /** App capabilities composed into schema/rules/seeds. Integrations are npm
      * modules, not hosted platform services, so they do not belong in services. */
     integrations?: OdlaIntegration[];
+    /** Vault secrets this app needs beyond the ones its capabilities declare.
+     * Names and descriptions only; values are never authored here. */
+    secrets?: IntegrationSecret[];
     db?: {
         /** Inline SerializedSchema, JSON file, or JS module path exporting default/schema. */
         schema?: unknown;
@@ -624,13 +658,22 @@ interface SmokeOptions {
     stdout?: Pick<typeof console, "log" | "error">;
 }
 
-/** The Google OAuth scope that authorizes booking writes (events read/write). */
-declare const GOOGLE_CALENDAR_EVENTS_SCOPE = "https://www.googleapis.com/auth/calendar.events";
+/**
+ * The calendar half of `odla.config.mjs`: resolving the checked-in Google
+ * booking block into a controller payload, and validating it.
+ *
+ * Split out of config.ts because calendar validation and its four value
+ * guards are used by nothing else in config loading — the guards were private
+ * to this one validator already.
+ */
 /** Resolve the checked-in calendar block into one controller-safe env payload. */
 declare function calendarServiceConfig(cfg: LoadedProjectConfig, env: string): CalendarServiceConfig;
 /** Public Appointment Schedule URL to apply separately from connector config. */
 declare function calendarBookingPageUrl(cfg: LoadedProjectConfig, env: string): string | null | undefined;
 
+/** The Google OAuth scope that authorizes booking writes (events read/write). */
+declare const GOOGLE_CALENDAR_EVENTS_SCOPE = "https://www.googleapis.com/auth/calendar.events";
+
 /** Canonical SHA-256 identifier for normalized configuration or a frozen plan. */
 type ConfigDigest = `sha256:${string}`;
 /** Overall relationship between repository-managed intent and observed state. */

package/dist/index.d.ts

@@ -419,6 +419,35 @@ interface IntegrationProbe {
     /** Expected unauthenticated HTTP status, normally 401. */
     expectedStatus: number;
 }
+/**
+ * One tenant-vault secret a capability or app needs in order to work.
+ *
+ * This is the declaration half of the declaration/storage split: the contract
+ * is committed, the value never is. Declaring a secret does not store, read, or
+ * transmit it — `odla-ai secrets set` remains the only write path and values
+ * stay write-only afterwards. Declarations exist so `doctor` can tell "not set
+ * yet" apart from "not needed", so an agent can discover what to ask a human
+ * for instead of learning it from prose, and so `check:secrets` can prove the
+ * declared name is the name the runtime actually reads.
+ */
+interface IntegrationSecret {
+    /** Vault name, byte-identical to what `odla-ai secrets set <name>` writes and
+     * what the runtime passes to `getSecret`. Reserved slots keep their `$`. */
+    name: string;
+    /** What the secret is for, and what breaks without it. */
+    description: string;
+    /** Expected value prefix, e.g. `whsec_`. Advisory: never matched against a
+     * stored value (the CLI cannot read one back), only against a value on its
+     * way in. */
+    pattern?: string;
+    /** Platform-managed `$`-prefixed slot. Reserved secrets are never readable by
+     * an app key and are written by a dedicated command, not `secrets set`. */
+    reserved?: boolean;
+    /** Whether the capability is broken without it. Defaults to `true`; set
+     * `false` for secrets only some configurations need, so `doctor` reports them
+     * as available rather than missing. */
+    required?: boolean;
+}
 /** Structural, data-only capability descriptor consumed from
  * `odla.config.mjs`. Capability packages do not depend on the CLI; their
  * descriptors only need to conform to this shape. */
@@ -440,6 +469,8 @@ interface OdlaIntegration {
     seeds?: IntegrationSeed[];
     /** Read-only unauthenticated checks run against `links.<env>`. */
     probes?: IntegrationProbe[];
+    /** Tenant-vault secrets this capability reads. Names only — never values. */
+    secrets?: IntegrationSecret[];
 }
 interface ClerkAuthConfig {
     publishableKey?: string;
@@ -486,6 +517,9 @@ interface OdlaProjectConfig {
     /** App capabilities composed into schema/rules/seeds. Integrations are npm
      * modules, not hosted platform services, so they do not belong in services. */
     integrations?: OdlaIntegration[];
+    /** Vault secrets this app needs beyond the ones its capabilities declare.
+     * Names and descriptions only; values are never authored here. */
+    secrets?: IntegrationSecret[];
     db?: {
         /** Inline SerializedSchema, JSON file, or JS module path exporting default/schema. */
         schema?: unknown;
@@ -624,13 +658,22 @@ interface SmokeOptions {
     stdout?: Pick<typeof console, "log" | "error">;
 }
 
-/** The Google OAuth scope that authorizes booking writes (events read/write). */
-declare const GOOGLE_CALENDAR_EVENTS_SCOPE = "https://www.googleapis.com/auth/calendar.events";
+/**
+ * The calendar half of `odla.config.mjs`: resolving the checked-in Google
+ * booking block into a controller payload, and validating it.
+ *
+ * Split out of config.ts because calendar validation and its four value
+ * guards are used by nothing else in config loading — the guards were private
+ * to this one validator already.
+ */
 /** Resolve the checked-in calendar block into one controller-safe env payload. */
 declare function calendarServiceConfig(cfg: LoadedProjectConfig, env: string): CalendarServiceConfig;
 /** Public Appointment Schedule URL to apply separately from connector config. */
 declare function calendarBookingPageUrl(cfg: LoadedProjectConfig, env: string): string | null | undefined;
 
+/** The Google OAuth scope that authorizes booking writes (events read/write). */
+declare const GOOGLE_CALENDAR_EVENTS_SCOPE = "https://www.googleapis.com/auth/calendar.events";
+
 /** Canonical SHA-256 identifier for normalized configuration or a frozen plan. */
 type ConfigDigest = `sha256:${string}`;
 /** Overall relationship between repository-managed intent and observed state. */

package/dist/index.js

@@ -54,7 +54,7 @@ import {
   startHostedSecurityJob,
   surfacePaths,
   validateInvocation
-} from "./chunk-L6YTOTWU.js";
+} from "./chunk-YSQORU5J.js";
 import {
   exitCodeFor,
   redactSecrets

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@odla-ai/cli",
-  "version": "0.32.1",
+  "version": "0.33.0",
   "description": "Agent-operable CLI for odla provisioning, calendar consent and connection lifecycle, System AI administration, Worker secrets, security jobs, and smoke checks.",
   "license": "MIT",
   "homepage": "https://odla.ai/docs/packages/cli",