@odla-ai/cli 0.7.1 → 0.9.0

package/dist/index.d.cts

@@ -1,31 +1,28 @@
 import { SecurityReport, PlatformSecurityRun } from '@odla-ai/security';
+import { HostedSecurityJob, GitHubConnectionStatus, GitHubSecuritySource, HostedSecurityIntentResponse, HostedSecurityPlan, HostedSecurityReport, HostedSecurityJobStatus } from '@odla-ai/security/hosted';
+export { GitHubConnectionAttempt, GitHubConnectionStatus, GitHubSecuritySource, HostedSecurityCounts, HostedSecurityCoverage, HostedSecurityIntent, HostedSecurityIntentResponse, HostedSecurityJob, HostedSecurityJobStatus, HostedSecurityPlan, HostedSecurityPlanRoute, HostedSecurityReport, HostedSecurityReportFinding, HostedSecurityRoute } from '@odla-ai/security/hosted';
 
+/** Injectable side-effect boundaries used to run and test the command dispatcher. */
+interface CliDependencies {
+    fetch?: typeof fetch;
+    openUrl?: (url: string) => Promise<void>;
+    pollWait?: (milliseconds: number, signal?: AbortSignal) => Promise<void>;
+    readGitOrigin?: (cwd: string) => Promise<string>;
+    confirm?: (message: string) => Promise<boolean>;
+    stdout?: Pick<typeof console, "log" | "error">;
+}
 /**
- * Parse CLI arguments and dispatch to the matching command — the entry point
- * `bin.ts` invokes. `argv` defaults to `process.argv.slice(2)`; the first
- * positional selects the command and the rest are parsed into flags (supporting
- * `--flag value`, `--flag=value`, boolean `--flag`, `--no-flag`, and repeated
- * flags collected into arrays).
+ * Parse CLI arguments and dispatch the matching odla command.
  *
- * Recognized commands: `version`/`-v`/`--version` and `help`/`-h`/`--help` print
- * and return; `init` scaffolds a project (requires `--app-id` and `--name`);
- * `doctor` validates config offline; `capabilities` prints the responsibility
- * boundary; `admin ai` reads/updates purpose-specific platform AI policies,
- * transfers write-only credentials, and reads metadata-only attributed usage
- * through separate short-lived exact-scope device grants;
- * `security run` performs an explicitly acknowledged, app-attributed hosted
- * reasoning pass; `provision` runs the full provision (including optional secret
- * rotation, local vars, and deployed secret push); `smoke` checks a live env;
- * `setup` and `skill install` install the bundled offline runbooks for Claude
- * Code, Codex, Cursor, Copilot, Gemini, and `AGENTS.md`-aware agents; and
- * `secrets push` pipes the env's configured db/o11y secrets into the Worker via
- * Wrangler (requires `--env`). Throws on an unknown command/subcommand, unsupported option, extra
- * positional argument, missing required value, or a dispatched command error.
+ * The dispatcher covers project setup, platform AI administration, hosted and
+ * local security, provisioning, smoke checks, skill installation, and secret
+ * pushes. It rejects unknown commands, unsupported options, extra positionals,
+ * missing values, and errors returned by the selected command.
  *
- * @param argv Argument vector without the node/script prefix (default
- *   `process.argv.slice(2)`).
+ * @param argv Argument vector without the node/script prefix.
+ * @param dependencies Optional side-effect overrides for embedding and tests.
  */
-declare function runCli(argv?: string[]): Promise<void>;
+declare function runCli(argv?: string[], dependencies?: CliDependencies): Promise<void>;
 
 /** One exact platform scope obtainable through the admin device flow. */
 type ScopedPlatformScope = "platform:ai:policy:read" | "platform:ai:policy:write" | "platform:ai:credential:read" | "platform:ai:credential:write" | "platform:ai:usage:read" | "platform:ai:audit:read" | "platform:security:self";
@@ -94,10 +91,10 @@ declare function adminAi(options: AdminAiOptions): Promise<void>;
 /** Stable, machine-readable division of work between the CLI, coding agent,
  * human operator, and Studio. Printed by `odla-ai capabilities --json`. */
 declare const CAPABILITIES: {
-    readonly cli: readonly ["register the app and enable configured services per environment", "issue, persist, and explicitly rotate configured service credentials", "write local Worker values and push deployed Worker secrets through Wrangler stdin", "push db schema/rules and configure platform AI, auth, and deployment links", "validate config offline and smoke-test a provisioned db environment", "run app-attributed hosted security discovery and independent validation without provider keys", "let admins manage system AI policy and credentials, inspect attributed usage, and read immutable admin changes through separate short-lived capability-only approvals"];
+    readonly cli: readonly ["register the app and enable configured services per environment", "issue, persist, and explicitly rotate configured service credentials", "write local Worker values and push deployed Worker secrets through Wrangler stdin", "store tenant-vault secrets (including the Clerk webhook secret and reserved Clerk secret key) write-only from stdin or an env var", "push db schema/rules and configure platform AI, auth, and deployment links", "validate config offline and smoke-test a provisioned db environment", "run app-attributed hosted security discovery and independent validation without provider keys", "connect/revoke source-read-only GitHub sources and drive commit-pinned hosted security jobs without PATs or provider keys", "let admins manage system AI policy and credentials, inspect attributed usage, and read immutable admin changes through separate short-lived capability-only approvals"];
     readonly agent: readonly ["install and import the selected odla SDKs", "wrap the Worker with withObservability and choose useful telemetry", "make application-specific schema, rules, auth, UI, and migration decisions"];
-    readonly human: readonly ["approve the odla device code and one-off third-party logins", "consent to production changes with --yes", "request destructive credential rotation explicitly", "review application semantics, security findings, releases, and merges", "approve redacted-source disclosure before hosted security reasoning"];
-    readonly studio: readonly ["view telemetry and environment state", "perform manual credential recovery when the CLI's local shown-once copy is unavailable", "configure system AI purposes and view app/environment/run-attributed usage"];
+    readonly human: readonly ["approve the odla device code and one-off third-party logins", "consent to production changes with --yes", "request destructive credential rotation explicitly", "review application semantics, security findings, releases, and merges", "approve redacted-source disclosure before hosted security reasoning", "approve GitHub App repository access separately from redacted-snippet disclosure"];
+    readonly studio: readonly ["view telemetry and environment state", "perform manual credential recovery when the CLI's local shown-once copy is unavailable", "configure system AI purposes and view app/environment/run-attributed usage", "connect/revoke GitHub security sources and inspect ref-to-SHA jobs, routes, retention, coverage, and normalized reports"];
 };
 type Output = Pick<typeof console, "log">;
 /** Print the stable responsibility boundary for humans or agent tooling. */
@@ -370,6 +367,47 @@ interface SecretsPushOptions {
  */
 declare function secretsPush(options: SecretsPushOptions): Promise<void>;
 
+/**
+ * Inputs for one write-only tenant-vault transfer (`secrets set` /
+ * `secrets set-clerk-key`). Values may come only from a named environment
+ * variable or stdin, so a producer command can be piped straight into the
+ * vault without the secret ever being displayed or stored on disk.
+ */
+interface SecretsSetOptions {
+    configPath: string;
+    env: string;
+    /** Vault secret name (`secrets set` only; `$`-prefixed names are reserved). */
+    name?: string;
+    fromEnv?: string;
+    stdin?: boolean;
+    /** Explicit consent for a prod-named env (and for sk_live_ into a non-prod env). */
+    yes?: boolean;
+    /** Developer token override; defaults to $ODLA_DEV_TOKEN, the cached token, or a device handshake. */
+    token?: string;
+    open?: boolean;
+    interactive?: boolean;
+    openApprovalUrl?: (url: string) => Promise<void>;
+    fetch?: typeof fetch;
+    readStdin?: () => Promise<string>;
+    stdout?: Pick<typeof console, "log" | "error">;
+}
+/**
+ * Store one named secret in the env's tenant vault (the same write-only slot
+ * Studio's Secrets panel fills), e.g. `clerk_webhook_secret` for synced auth.
+ * The value is encrypted at rest and can be read back only by that tenant's
+ * app API key — never by this CLI, Studio, or the developer token.
+ */
+declare function secretsSet(options: SecretsSetOptions): Promise<void>;
+/**
+ * Store the app's Clerk secret key under the reserved `$clerk_secret` slot so
+ * odla-db can resolve the app's users (invites, member lookups). Reserved
+ * secrets are never readable by app keys; the dedicated endpoint is the only
+ * way to set one. Guards against instance/env mismatches: an sk_test_ key
+ * never belongs in a prod-named env, and an sk_live_ key entering a non-prod
+ * env requires `--yes` (live users would sync into a non-prod tenant).
+ */
+declare function secretsSetClerkKey(options: SecretsSetOptions): Promise<void>;
+
 /** Built-in security coverage profile selected for a hosted reasoning run. */
 type HostedSecurityProfile = "odla" | "cloudflare-app" | "generic";
 /** Exact attribution and authorization need supplied to a lazy token callback. */
@@ -425,6 +463,130 @@ interface HostedSecurityResult {
  */
 declare function runHostedSecurity(options: RunHostedSecurityOptions): Promise<HostedSecurityResult>;
 
+/**
+ * The hosted-security client surface. The WIRE types live in @odla-ai/security/hosted — one
+ * definition shared with the dashboard and the server that produces them. Re-exported here so
+ * this module stays the single import path for the rest of the CLI.
+ *
+ * What remains below is what is genuinely the CLI's own: transport controls (platform origin,
+ * token, fetch, AbortSignal) that no other client shares.
+ */
+
+/** Common authenticated transport controls for hosted-security requests. */
+interface HostedSecurityRequestOptions {
+    platform: string;
+    token: string;
+    fetch?: typeof fetch;
+    signal?: AbortSignal;
+}
+/** Options for browser-mediated connection of one exact GitHub repository. */
+interface ConnectGitHubSecuritySourceOptions extends HostedSecurityRequestOptions {
+    appId: string;
+    env: string;
+    /** Exact owner/name repository requested before GitHub approval. */
+    repository: string;
+    /** false prints but does not launch the install URL. Defaults to true. */
+    open?: boolean;
+    openInstallUrl?: (url: string) => Promise<void>;
+    /** Poll interval. The server attempt expiry remains authoritative. */
+    pollIntervalMs?: number;
+    pollTimeoutMs?: number;
+    wait?: (milliseconds: number, signal?: AbortSignal) => Promise<void>;
+    now?: () => number;
+    stdout?: Pick<typeof console, "log">;
+}
+/** Options for listing GitHub sources or reading the plan for one app environment. */
+interface ListGitHubSecuritySourcesOptions extends HostedSecurityRequestOptions {
+    appId: string;
+    env: string;
+}
+/** Inputs for fetching the server-authored execution preview before enqueue. */
+interface GetHostedSecurityIntentOptions extends HostedSecurityRequestOptions {
+    appId: string;
+    env: string;
+    sourceId: string;
+    ref?: string;
+    profile?: "odla" | "cloudflare-app" | "generic";
+}
+/** Options for revoking odla access to one saved GitHub source. */
+interface DisconnectGitHubSecuritySourceOptions extends HostedSecurityRequestOptions {
+    appId: string;
+    sourceId: string;
+}
+/** Options for enqueueing a commit-pinned hosted security review. */
+interface StartHostedSecurityJobOptions extends HostedSecurityRequestOptions {
+    appId: string;
+    env: string;
+    sourceId: string;
+    ref?: string;
+    profile?: "odla" | "cloudflare-app" | "generic";
+    clientRequestId?: string;
+    /** Versions shown in the disclosure preflight. The server rejects stale consent. */
+    expectedPolicyVersions: {
+        discovery: number;
+        validation: number;
+    };
+    /** Digest copied from the plan the app owner explicitly reviewed. */
+    expectedPlanDigest: `sha256:${string}`;
+    /** Digest copied from the exact server-authored source/ref/profile preview. */
+    expectedExecutionDigest: `sha256:${string}`;
+    /** Explicit disclosure acknowledgement; GitHub read access alone is not consent. */
+    sourceDisclosureAck?: "redacted";
+}
+/** Options for reading one hosted security job or its report. */
+interface GetHostedSecurityJobOptions extends HostedSecurityRequestOptions {
+    appId: string;
+    jobId: string;
+}
+/** Options for listing hosted security jobs in one app environment. */
+interface ListHostedSecurityJobsOptions extends HostedSecurityRequestOptions {
+    appId: string;
+    env: string;
+}
+/** Polling controls for following one hosted job to a terminal state. */
+interface FollowHostedSecurityJobOptions extends GetHostedSecurityJobOptions {
+    pollIntervalMs?: number;
+    pollTimeoutMs?: number;
+    wait?: (milliseconds: number, signal?: AbortSignal) => Promise<void>;
+    now?: () => number;
+    onUpdate?: (job: Readonly<HostedSecurityJob>) => void;
+}
+
+/** Begin GitHub App installation, launch its server-issued GitHub URL, and
+ * poll the exact attempt until the callback has connected a source. */
+declare function connectGitHubSecuritySource(options: ConnectGitHubSecuritySourceOptions): Promise<GitHubConnectionStatus>;
+/** List repository sources the current app owner connected for one environment. */
+declare function listGitHubSecuritySources(options: ListGitHubSecuritySourcesOptions): Promise<GitHubSecuritySource[]>;
+/** Revoke odla's use of one saved source without requiring a GitHub-side App
+ * uninstall. The server marks the source deleted and rejects new jobs. */
+declare function disconnectGitHubSecuritySource(options: DisconnectGitHubSecuritySourceOptions): Promise<void>;
+/** Parse an HTTPS, ssh://, or git@github.com origin without retaining embedded
+ * credentials. Only github.com owner/name remotes are accepted. */
+declare function repositoryFromGitRemote(remoteInput: string): string;
+/** Read the current repository's origin without invoking a shell. */
+declare function inferGitHubRepository(cwd?: string, readOrigin?: (cwd: string) => Promise<string>): Promise<string>;
+
+/** Fetch the atomic processing-plan and source/ref/profile execution preview. */
+declare function getHostedSecurityIntent(options: GetHostedSecurityIntentOptions): Promise<HostedSecurityIntentResponse>;
+
+/** Read the admin-selected routes, budgets, readiness, disclosure boundary,
+ * and digest that must be acknowledged when a hosted review is enqueued. */
+declare function getHostedSecurityPlan(options: ListGitHubSecuritySourcesOptions): Promise<HostedSecurityPlan>;
+/** Enqueue a commit-pinned server-side review. The server resolves sourceId to
+ * its saved GitHub App installation; clients cannot choose an installation or
+ * pass a PAT. */
+declare function startHostedSecurityJob(options: StartHostedSecurityJobOptions): Promise<HostedSecurityJob>;
+/** Read one bounded hosted job status without an archive or explicit source excerpt. */
+declare function getHostedSecurityJob(options: GetHostedSecurityJobOptions): Promise<HostedSecurityJob>;
+/** List bounded, newest-first job metadata for an app environment. */
+declare function listHostedSecurityJobs(options: ListHostedSecurityJobsOptions): Promise<HostedSecurityJob[]>;
+/** Poll one exact job until it reaches a terminal state. */
+declare function followHostedSecurityJob(options: FollowHostedSecurityJobOptions): Promise<HostedSecurityJob>;
+/** Fetch the bounded normalized report projection for a completed hosted job. */
+declare function getHostedSecurityReport(options: GetHostedSecurityJobOptions): Promise<HostedSecurityReport>;
+/** Return whether a hosted job status can no longer transition. */
+declare function isTerminalHostedSecurityStatus(status: HostedSecurityJobStatus): boolean;
+
 /** Agent harnesses with a first-class local adapter. */
 declare const AGENT_HARNESSES: readonly ["claude", "codex", "cursor", "copilot", "gemini", "agents"];
 /** A supported coding-agent harness. `agents` is the portable `AGENTS.md` adapter. */
@@ -504,4 +666,4 @@ declare function installSkill(options?: SkillInstallOptions): SkillInstallResult
  */
 declare function smoke(options: SmokeOptions): Promise<void>;
 
-export { AGENT_HARNESSES, type AdminAiOptions, type AgentHarness, type AgentHarnessSelector, CAPABILITIES, type HarnessInstallResult, type HostedSecurityProfile, type HostedSecurityResult, type HostedSecurityTokenRequest, type LoadedProjectConfig, type LocalCredentials, type OdlaProjectConfig, type ProvisionOptions, type ProvisionPlan, type RunHostedSecurityOptions, SYSTEM_AI_PURPOSES, type ScopedPlatformTokenOptions, type SecretsPushOptions, type SkillInstallOptions, type SkillInstallResult, type SmokeOptions, type SystemAiPurpose, adminAi, doctor, getScopedPlatformToken, initProject, installSkill, printCapabilities, provision, redactSecrets, runCli, runHostedSecurity, secretsPush, smoke };
+export { AGENT_HARNESSES, type AdminAiOptions, type AgentHarness, type AgentHarnessSelector, CAPABILITIES, type CliDependencies, type ConnectGitHubSecuritySourceOptions, type DisconnectGitHubSecuritySourceOptions, type FollowHostedSecurityJobOptions, type GetHostedSecurityIntentOptions, type GetHostedSecurityJobOptions, type HarnessInstallResult, type HostedSecurityProfile, type HostedSecurityResult, type HostedSecurityTokenRequest, type ListGitHubSecuritySourcesOptions, type ListHostedSecurityJobsOptions, type LoadedProjectConfig, type LocalCredentials, type OdlaProjectConfig, type ProvisionOptions, type ProvisionPlan, type RunHostedSecurityOptions, SYSTEM_AI_PURPOSES, type ScopedPlatformTokenOptions, type SecretsPushOptions, type SecretsSetOptions, type SkillInstallOptions, type SkillInstallResult, type SmokeOptions, type StartHostedSecurityJobOptions, type SystemAiPurpose, adminAi, connectGitHubSecuritySource, disconnectGitHubSecuritySource, doctor, followHostedSecurityJob, getHostedSecurityIntent, getHostedSecurityJob, getHostedSecurityPlan, getHostedSecurityReport, getScopedPlatformToken, inferGitHubRepository, initProject, installSkill, isTerminalHostedSecurityStatus, listGitHubSecuritySources, listHostedSecurityJobs, printCapabilities, provision, redactSecrets, repositoryFromGitRemote, runCli, runHostedSecurity, secretsPush, secretsSet, secretsSetClerkKey, smoke, startHostedSecurityJob };

package/dist/index.d.ts

@@ -1,31 +1,28 @@
 import { SecurityReport, PlatformSecurityRun } from '@odla-ai/security';
+import { HostedSecurityJob, GitHubConnectionStatus, GitHubSecuritySource, HostedSecurityIntentResponse, HostedSecurityPlan, HostedSecurityReport, HostedSecurityJobStatus } from '@odla-ai/security/hosted';
+export { GitHubConnectionAttempt, GitHubConnectionStatus, GitHubSecuritySource, HostedSecurityCounts, HostedSecurityCoverage, HostedSecurityIntent, HostedSecurityIntentResponse, HostedSecurityJob, HostedSecurityJobStatus, HostedSecurityPlan, HostedSecurityPlanRoute, HostedSecurityReport, HostedSecurityReportFinding, HostedSecurityRoute } from '@odla-ai/security/hosted';
 
+/** Injectable side-effect boundaries used to run and test the command dispatcher. */
+interface CliDependencies {
+    fetch?: typeof fetch;
+    openUrl?: (url: string) => Promise<void>;
+    pollWait?: (milliseconds: number, signal?: AbortSignal) => Promise<void>;
+    readGitOrigin?: (cwd: string) => Promise<string>;
+    confirm?: (message: string) => Promise<boolean>;
+    stdout?: Pick<typeof console, "log" | "error">;
+}
 /**
- * Parse CLI arguments and dispatch to the matching command — the entry point
- * `bin.ts` invokes. `argv` defaults to `process.argv.slice(2)`; the first
- * positional selects the command and the rest are parsed into flags (supporting
- * `--flag value`, `--flag=value`, boolean `--flag`, `--no-flag`, and repeated
- * flags collected into arrays).
+ * Parse CLI arguments and dispatch the matching odla command.
  *
- * Recognized commands: `version`/`-v`/`--version` and `help`/`-h`/`--help` print
- * and return; `init` scaffolds a project (requires `--app-id` and `--name`);
- * `doctor` validates config offline; `capabilities` prints the responsibility
- * boundary; `admin ai` reads/updates purpose-specific platform AI policies,
- * transfers write-only credentials, and reads metadata-only attributed usage
- * through separate short-lived exact-scope device grants;
- * `security run` performs an explicitly acknowledged, app-attributed hosted
- * reasoning pass; `provision` runs the full provision (including optional secret
- * rotation, local vars, and deployed secret push); `smoke` checks a live env;
- * `setup` and `skill install` install the bundled offline runbooks for Claude
- * Code, Codex, Cursor, Copilot, Gemini, and `AGENTS.md`-aware agents; and
- * `secrets push` pipes the env's configured db/o11y secrets into the Worker via
- * Wrangler (requires `--env`). Throws on an unknown command/subcommand, unsupported option, extra
- * positional argument, missing required value, or a dispatched command error.
+ * The dispatcher covers project setup, platform AI administration, hosted and
+ * local security, provisioning, smoke checks, skill installation, and secret
+ * pushes. It rejects unknown commands, unsupported options, extra positionals,
+ * missing values, and errors returned by the selected command.
  *
- * @param argv Argument vector without the node/script prefix (default
- *   `process.argv.slice(2)`).
+ * @param argv Argument vector without the node/script prefix.
+ * @param dependencies Optional side-effect overrides for embedding and tests.
  */
-declare function runCli(argv?: string[]): Promise<void>;
+declare function runCli(argv?: string[], dependencies?: CliDependencies): Promise<void>;
 
 /** One exact platform scope obtainable through the admin device flow. */
 type ScopedPlatformScope = "platform:ai:policy:read" | "platform:ai:policy:write" | "platform:ai:credential:read" | "platform:ai:credential:write" | "platform:ai:usage:read" | "platform:ai:audit:read" | "platform:security:self";
@@ -94,10 +91,10 @@ declare function adminAi(options: AdminAiOptions): Promise<void>;
 /** Stable, machine-readable division of work between the CLI, coding agent,
  * human operator, and Studio. Printed by `odla-ai capabilities --json`. */
 declare const CAPABILITIES: {
-    readonly cli: readonly ["register the app and enable configured services per environment", "issue, persist, and explicitly rotate configured service credentials", "write local Worker values and push deployed Worker secrets through Wrangler stdin", "push db schema/rules and configure platform AI, auth, and deployment links", "validate config offline and smoke-test a provisioned db environment", "run app-attributed hosted security discovery and independent validation without provider keys", "let admins manage system AI policy and credentials, inspect attributed usage, and read immutable admin changes through separate short-lived capability-only approvals"];
+    readonly cli: readonly ["register the app and enable configured services per environment", "issue, persist, and explicitly rotate configured service credentials", "write local Worker values and push deployed Worker secrets through Wrangler stdin", "store tenant-vault secrets (including the Clerk webhook secret and reserved Clerk secret key) write-only from stdin or an env var", "push db schema/rules and configure platform AI, auth, and deployment links", "validate config offline and smoke-test a provisioned db environment", "run app-attributed hosted security discovery and independent validation without provider keys", "connect/revoke source-read-only GitHub sources and drive commit-pinned hosted security jobs without PATs or provider keys", "let admins manage system AI policy and credentials, inspect attributed usage, and read immutable admin changes through separate short-lived capability-only approvals"];
     readonly agent: readonly ["install and import the selected odla SDKs", "wrap the Worker with withObservability and choose useful telemetry", "make application-specific schema, rules, auth, UI, and migration decisions"];
-    readonly human: readonly ["approve the odla device code and one-off third-party logins", "consent to production changes with --yes", "request destructive credential rotation explicitly", "review application semantics, security findings, releases, and merges", "approve redacted-source disclosure before hosted security reasoning"];
-    readonly studio: readonly ["view telemetry and environment state", "perform manual credential recovery when the CLI's local shown-once copy is unavailable", "configure system AI purposes and view app/environment/run-attributed usage"];
+    readonly human: readonly ["approve the odla device code and one-off third-party logins", "consent to production changes with --yes", "request destructive credential rotation explicitly", "review application semantics, security findings, releases, and merges", "approve redacted-source disclosure before hosted security reasoning", "approve GitHub App repository access separately from redacted-snippet disclosure"];
+    readonly studio: readonly ["view telemetry and environment state", "perform manual credential recovery when the CLI's local shown-once copy is unavailable", "configure system AI purposes and view app/environment/run-attributed usage", "connect/revoke GitHub security sources and inspect ref-to-SHA jobs, routes, retention, coverage, and normalized reports"];
 };
 type Output = Pick<typeof console, "log">;
 /** Print the stable responsibility boundary for humans or agent tooling. */
@@ -370,6 +367,47 @@ interface SecretsPushOptions {
  */
 declare function secretsPush(options: SecretsPushOptions): Promise<void>;
 
+/**
+ * Inputs for one write-only tenant-vault transfer (`secrets set` /
+ * `secrets set-clerk-key`). Values may come only from a named environment
+ * variable or stdin, so a producer command can be piped straight into the
+ * vault without the secret ever being displayed or stored on disk.
+ */
+interface SecretsSetOptions {
+    configPath: string;
+    env: string;
+    /** Vault secret name (`secrets set` only; `$`-prefixed names are reserved). */
+    name?: string;
+    fromEnv?: string;
+    stdin?: boolean;
+    /** Explicit consent for a prod-named env (and for sk_live_ into a non-prod env). */
+    yes?: boolean;
+    /** Developer token override; defaults to $ODLA_DEV_TOKEN, the cached token, or a device handshake. */
+    token?: string;
+    open?: boolean;
+    interactive?: boolean;
+    openApprovalUrl?: (url: string) => Promise<void>;
+    fetch?: typeof fetch;
+    readStdin?: () => Promise<string>;
+    stdout?: Pick<typeof console, "log" | "error">;
+}
+/**
+ * Store one named secret in the env's tenant vault (the same write-only slot
+ * Studio's Secrets panel fills), e.g. `clerk_webhook_secret` for synced auth.
+ * The value is encrypted at rest and can be read back only by that tenant's
+ * app API key — never by this CLI, Studio, or the developer token.
+ */
+declare function secretsSet(options: SecretsSetOptions): Promise<void>;
+/**
+ * Store the app's Clerk secret key under the reserved `$clerk_secret` slot so
+ * odla-db can resolve the app's users (invites, member lookups). Reserved
+ * secrets are never readable by app keys; the dedicated endpoint is the only
+ * way to set one. Guards against instance/env mismatches: an sk_test_ key
+ * never belongs in a prod-named env, and an sk_live_ key entering a non-prod
+ * env requires `--yes` (live users would sync into a non-prod tenant).
+ */
+declare function secretsSetClerkKey(options: SecretsSetOptions): Promise<void>;
+
 /** Built-in security coverage profile selected for a hosted reasoning run. */
 type HostedSecurityProfile = "odla" | "cloudflare-app" | "generic";
 /** Exact attribution and authorization need supplied to a lazy token callback. */
@@ -425,6 +463,130 @@ interface HostedSecurityResult {
  */
 declare function runHostedSecurity(options: RunHostedSecurityOptions): Promise<HostedSecurityResult>;
 
+/**
+ * The hosted-security client surface. The WIRE types live in @odla-ai/security/hosted — one
+ * definition shared with the dashboard and the server that produces them. Re-exported here so
+ * this module stays the single import path for the rest of the CLI.
+ *
+ * What remains below is what is genuinely the CLI's own: transport controls (platform origin,
+ * token, fetch, AbortSignal) that no other client shares.
+ */
+
+/** Common authenticated transport controls for hosted-security requests. */
+interface HostedSecurityRequestOptions {
+    platform: string;
+    token: string;
+    fetch?: typeof fetch;
+    signal?: AbortSignal;
+}
+/** Options for browser-mediated connection of one exact GitHub repository. */
+interface ConnectGitHubSecuritySourceOptions extends HostedSecurityRequestOptions {
+    appId: string;
+    env: string;
+    /** Exact owner/name repository requested before GitHub approval. */
+    repository: string;
+    /** false prints but does not launch the install URL. Defaults to true. */
+    open?: boolean;
+    openInstallUrl?: (url: string) => Promise<void>;
+    /** Poll interval. The server attempt expiry remains authoritative. */
+    pollIntervalMs?: number;
+    pollTimeoutMs?: number;
+    wait?: (milliseconds: number, signal?: AbortSignal) => Promise<void>;
+    now?: () => number;
+    stdout?: Pick<typeof console, "log">;
+}
+/** Options for listing GitHub sources or reading the plan for one app environment. */
+interface ListGitHubSecuritySourcesOptions extends HostedSecurityRequestOptions {
+    appId: string;
+    env: string;
+}
+/** Inputs for fetching the server-authored execution preview before enqueue. */
+interface GetHostedSecurityIntentOptions extends HostedSecurityRequestOptions {
+    appId: string;
+    env: string;
+    sourceId: string;
+    ref?: string;
+    profile?: "odla" | "cloudflare-app" | "generic";
+}
+/** Options for revoking odla access to one saved GitHub source. */
+interface DisconnectGitHubSecuritySourceOptions extends HostedSecurityRequestOptions {
+    appId: string;
+    sourceId: string;
+}
+/** Options for enqueueing a commit-pinned hosted security review. */
+interface StartHostedSecurityJobOptions extends HostedSecurityRequestOptions {
+    appId: string;
+    env: string;
+    sourceId: string;
+    ref?: string;
+    profile?: "odla" | "cloudflare-app" | "generic";
+    clientRequestId?: string;
+    /** Versions shown in the disclosure preflight. The server rejects stale consent. */
+    expectedPolicyVersions: {
+        discovery: number;
+        validation: number;
+    };
+    /** Digest copied from the plan the app owner explicitly reviewed. */
+    expectedPlanDigest: `sha256:${string}`;
+    /** Digest copied from the exact server-authored source/ref/profile preview. */
+    expectedExecutionDigest: `sha256:${string}`;
+    /** Explicit disclosure acknowledgement; GitHub read access alone is not consent. */
+    sourceDisclosureAck?: "redacted";
+}
+/** Options for reading one hosted security job or its report. */
+interface GetHostedSecurityJobOptions extends HostedSecurityRequestOptions {
+    appId: string;
+    jobId: string;
+}
+/** Options for listing hosted security jobs in one app environment. */
+interface ListHostedSecurityJobsOptions extends HostedSecurityRequestOptions {
+    appId: string;
+    env: string;
+}
+/** Polling controls for following one hosted job to a terminal state. */
+interface FollowHostedSecurityJobOptions extends GetHostedSecurityJobOptions {
+    pollIntervalMs?: number;
+    pollTimeoutMs?: number;
+    wait?: (milliseconds: number, signal?: AbortSignal) => Promise<void>;
+    now?: () => number;
+    onUpdate?: (job: Readonly<HostedSecurityJob>) => void;
+}
+
+/** Begin GitHub App installation, launch its server-issued GitHub URL, and
+ * poll the exact attempt until the callback has connected a source. */
+declare function connectGitHubSecuritySource(options: ConnectGitHubSecuritySourceOptions): Promise<GitHubConnectionStatus>;
+/** List repository sources the current app owner connected for one environment. */
+declare function listGitHubSecuritySources(options: ListGitHubSecuritySourcesOptions): Promise<GitHubSecuritySource[]>;
+/** Revoke odla's use of one saved source without requiring a GitHub-side App
+ * uninstall. The server marks the source deleted and rejects new jobs. */
+declare function disconnectGitHubSecuritySource(options: DisconnectGitHubSecuritySourceOptions): Promise<void>;
+/** Parse an HTTPS, ssh://, or git@github.com origin without retaining embedded
+ * credentials. Only github.com owner/name remotes are accepted. */
+declare function repositoryFromGitRemote(remoteInput: string): string;
+/** Read the current repository's origin without invoking a shell. */
+declare function inferGitHubRepository(cwd?: string, readOrigin?: (cwd: string) => Promise<string>): Promise<string>;
+
+/** Fetch the atomic processing-plan and source/ref/profile execution preview. */
+declare function getHostedSecurityIntent(options: GetHostedSecurityIntentOptions): Promise<HostedSecurityIntentResponse>;
+
+/** Read the admin-selected routes, budgets, readiness, disclosure boundary,
+ * and digest that must be acknowledged when a hosted review is enqueued. */
+declare function getHostedSecurityPlan(options: ListGitHubSecuritySourcesOptions): Promise<HostedSecurityPlan>;
+/** Enqueue a commit-pinned server-side review. The server resolves sourceId to
+ * its saved GitHub App installation; clients cannot choose an installation or
+ * pass a PAT. */
+declare function startHostedSecurityJob(options: StartHostedSecurityJobOptions): Promise<HostedSecurityJob>;
+/** Read one bounded hosted job status without an archive or explicit source excerpt. */
+declare function getHostedSecurityJob(options: GetHostedSecurityJobOptions): Promise<HostedSecurityJob>;
+/** List bounded, newest-first job metadata for an app environment. */
+declare function listHostedSecurityJobs(options: ListHostedSecurityJobsOptions): Promise<HostedSecurityJob[]>;
+/** Poll one exact job until it reaches a terminal state. */
+declare function followHostedSecurityJob(options: FollowHostedSecurityJobOptions): Promise<HostedSecurityJob>;
+/** Fetch the bounded normalized report projection for a completed hosted job. */
+declare function getHostedSecurityReport(options: GetHostedSecurityJobOptions): Promise<HostedSecurityReport>;
+/** Return whether a hosted job status can no longer transition. */
+declare function isTerminalHostedSecurityStatus(status: HostedSecurityJobStatus): boolean;
+
 /** Agent harnesses with a first-class local adapter. */
 declare const AGENT_HARNESSES: readonly ["claude", "codex", "cursor", "copilot", "gemini", "agents"];
 /** A supported coding-agent harness. `agents` is the portable `AGENTS.md` adapter. */
@@ -504,4 +666,4 @@ declare function installSkill(options?: SkillInstallOptions): SkillInstallResult
  */
 declare function smoke(options: SmokeOptions): Promise<void>;
 
-export { AGENT_HARNESSES, type AdminAiOptions, type AgentHarness, type AgentHarnessSelector, CAPABILITIES, type HarnessInstallResult, type HostedSecurityProfile, type HostedSecurityResult, type HostedSecurityTokenRequest, type LoadedProjectConfig, type LocalCredentials, type OdlaProjectConfig, type ProvisionOptions, type ProvisionPlan, type RunHostedSecurityOptions, SYSTEM_AI_PURPOSES, type ScopedPlatformTokenOptions, type SecretsPushOptions, type SkillInstallOptions, type SkillInstallResult, type SmokeOptions, type SystemAiPurpose, adminAi, doctor, getScopedPlatformToken, initProject, installSkill, printCapabilities, provision, redactSecrets, runCli, runHostedSecurity, secretsPush, smoke };
+export { AGENT_HARNESSES, type AdminAiOptions, type AgentHarness, type AgentHarnessSelector, CAPABILITIES, type CliDependencies, type ConnectGitHubSecuritySourceOptions, type DisconnectGitHubSecuritySourceOptions, type FollowHostedSecurityJobOptions, type GetHostedSecurityIntentOptions, type GetHostedSecurityJobOptions, type HarnessInstallResult, type HostedSecurityProfile, type HostedSecurityResult, type HostedSecurityTokenRequest, type ListGitHubSecuritySourcesOptions, type ListHostedSecurityJobsOptions, type LoadedProjectConfig, type LocalCredentials, type OdlaProjectConfig, type ProvisionOptions, type ProvisionPlan, type RunHostedSecurityOptions, SYSTEM_AI_PURPOSES, type ScopedPlatformTokenOptions, type SecretsPushOptions, type SecretsSetOptions, type SkillInstallOptions, type SkillInstallResult, type SmokeOptions, type StartHostedSecurityJobOptions, type SystemAiPurpose, adminAi, connectGitHubSecuritySource, disconnectGitHubSecuritySource, doctor, followHostedSecurityJob, getHostedSecurityIntent, getHostedSecurityJob, getHostedSecurityPlan, getHostedSecurityReport, getScopedPlatformToken, inferGitHubRepository, initProject, installSkill, isTerminalHostedSecurityStatus, listGitHubSecuritySources, listHostedSecurityJobs, printCapabilities, provision, redactSecrets, repositoryFromGitRemote, runCli, runHostedSecurity, secretsPush, secretsSet, secretsSetClerkKey, smoke, startHostedSecurityJob };

package/dist/index.js

@@ -4,33 +4,63 @@ import {
   CAPABILITIES,
   SYSTEM_AI_PURPOSES,
   adminAi,
+  connectGitHubSecuritySource,
+  disconnectGitHubSecuritySource,
   doctor,
+  followHostedSecurityJob,
+  getHostedSecurityIntent,
+  getHostedSecurityJob,
+  getHostedSecurityPlan,
+  getHostedSecurityReport,
   getScopedPlatformToken,
+  inferGitHubRepository,
   initProject,
   installSkill,
+  isTerminalHostedSecurityStatus,
+  listGitHubSecuritySources,
+  listHostedSecurityJobs,
   printCapabilities,
   provision,
   redactSecrets,
+  repositoryFromGitRemote,
   runCli,
   runHostedSecurity,
   secretsPush,
-  smoke
-} from "./chunk-643B2AKG.js";
+  secretsSet,
+  secretsSetClerkKey,
+  smoke,
+  startHostedSecurityJob
+} from "./chunk-MJYQ7YDH.js";
 export {
   AGENT_HARNESSES,
   CAPABILITIES,
   SYSTEM_AI_PURPOSES,
   adminAi,
+  connectGitHubSecuritySource,
+  disconnectGitHubSecuritySource,
   doctor,
+  followHostedSecurityJob,
+  getHostedSecurityIntent,
+  getHostedSecurityJob,
+  getHostedSecurityPlan,
+  getHostedSecurityReport,
   getScopedPlatformToken,
+  inferGitHubRepository,
   initProject,
   installSkill,
+  isTerminalHostedSecurityStatus,
+  listGitHubSecuritySources,
+  listHostedSecurityJobs,
   printCapabilities,
   provision,
   redactSecrets,
+  repositoryFromGitRemote,
   runCli,
   runHostedSecurity,
   secretsPush,
-  smoke
+  secretsSet,
+  secretsSetClerkKey,
+  smoke,
+  startHostedSecurityJob
 };
 //# sourceMappingURL=index.js.map