@odla-ai/cli 0.8.0 → 0.9.0

package/README.md

@@ -29,8 +29,8 @@ For a project you keep working in, install it as a dev dependency so the
 shorter `npx odla-ai` form works and the version is pinned by your lockfile:
 
 ```bash
-npm view @odla-ai/cli@0.8.0 version
-npm i -D --save-exact @odla-ai/cli@0.8.0
+npm view @odla-ai/cli@0.9.0 version
+npm i -D --save-exact @odla-ai/cli@0.9.0
 ```
 
 ## Prerequisites
@@ -59,6 +59,8 @@ npx odla-ai provision --dry-run
 npx odla-ai provision --write-dev-vars --push-secrets
 npx odla-ai smoke --env dev
 npx odla-ai secrets push --env dev
+npx odla-ai secrets set clerk_webhook_secret --env dev --stdin
+npx odla-ai secrets set-clerk-key --env dev --from-env CLERK_SECRET_KEY
 npx odla-ai security run . --env dev --ack-redacted-source
 npx odla-ai security github connect --env dev # infers owner/name from git origin
 npx odla-ai security plan --env dev
@@ -261,6 +263,22 @@ redacted plan without spawning anything. For the normal path, use
 `provision --write-dev-vars --push-secrets` so service enablement, credential
 issuance, local config, and deployed secret transfer stay one composition.
 
+`secrets set <name> --env <env>` stores one named secret in that env's tenant
+vault — the same write-only slot Studio's Secrets panel fills (for example
+`clerk_webhook_secret` for synced auth). The value may come only from
+`--from-env <NAME>` or `--stdin`, so a producer command pipes straight into the
+vault without the secret ever appearing on argv, in output, or in an agent's
+transcript; it is encrypted at rest and readable back only by that tenant's
+app API key, never by the CLI, Studio, or the developer token. `$`-prefixed
+names are platform-reserved. `secrets set-clerk-key --env <env>` stores the
+app's Clerk secret key in the reserved `$clerk_secret` slot so the platform can
+resolve the app's users (invites, member lookups); reserved secrets are never
+readable by app keys. It refuses an `sk_test_` key for a prod-named env and
+requires `--yes` to put an `sk_live_` key into a non-prod env, since live users
+would sync into a non-prod tenant. Both commands authenticate with the
+developer token (`$ODLA_DEV_TOKEN`, the cached token, or a fresh device
+approval), and prod-named envs require `--yes`, matching `secrets push`.
+
 ## Who does what
 
 If a change is deterministic from `odla.config.mjs`, the CLI owns it: app and

package/dist/bin.cjs

@@ -28,7 +28,7 @@ var getImportMetaUrl = () => typeof document === "undefined" ? new URL(`file:${_
 var importMetaUrl = /* @__PURE__ */ getImportMetaUrl();
 
 // src/admin-ai.ts
-var import_node_process4 = __toESM(require("process"), 1);
+var import_node_process5 = __toESM(require("process"), 1);
 
 // src/token.ts
 var import_db = require("@odla-ai/db");
@@ -258,9 +258,32 @@ function platformAudience(value) {
   return url.origin;
 }
 
+// src/secret-input.ts
+var import_node_process3 = __toESM(require("process"), 1);
+var MAX_BYTES = 64 * 1024;
+async function secretInputValue(options, kind = "credential") {
+  if (options.fromEnv && options.stdin) throw new Error("choose exactly one of --from-env or --stdin");
+  let value;
+  if (options.fromEnv) value = import_node_process3.default.env[options.fromEnv];
+  else if (options.stdin) value = await (options.readStdin ?? (() => readSecretStream(kind)))();
+  else throw new Error(`${kind} input required: use --from-env <NAME> or --stdin; values are never accepted as arguments`);
+  value = value?.replace(/[\r\n]+$/, "");
+  if (!value) throw new Error(options.fromEnv ? `environment variable ${options.fromEnv} is empty or unset` : `stdin ${kind} is empty`);
+  if (new TextEncoder().encode(value).byteLength > MAX_BYTES) throw new Error(`${kind} exceeds 64 KiB`);
+  return value;
+}
+async function readSecretStream(kind, stream = import_node_process3.default.stdin) {
+  let value = "";
+  for await (const chunk of stream) {
+    value += String(chunk);
+    if (value.length > MAX_BYTES) throw new Error(`${kind} exceeds 64 KiB`);
+  }
+  return value;
+}
+
 // src/admin-ai-auth.ts
 var import_node_fs2 = require("fs");
-var import_node_process3 = __toESM(require("process"), 1);
+var import_node_process4 = __toESM(require("process"), 1);
 var import_db2 = require("@odla-ai/db");
 async function getScopedPlatformToken(options) {
   return resolveAdminPlatformToken(options);
@@ -268,7 +291,7 @@ async function getScopedPlatformToken(options) {
 async function resolveAdminPlatformToken(options) {
   const audience = platformAudience(options.platform);
   if (options.token) return options.token;
-  const fromEnv = import_node_process3.default.env.ODLA_ADMIN_TOKEN;
+  const fromEnv = import_node_process4.default.env.ODLA_ADMIN_TOKEN;
   if (fromEnv) return audienceBoundEnvToken(fromEnv, audience);
   return scopedToken(
     audience,
@@ -280,7 +303,7 @@ async function resolveAdminPlatformToken(options) {
 }
 function audienceBoundEnvToken(token, platform) {
   const audience = platformAudience(platform);
-  const declared = import_node_process3.default.env.ODLA_ADMIN_TOKEN_AUDIENCE;
+  const declared = import_node_process4.default.env.ODLA_ADMIN_TOKEN_AUDIENCE;
   if (declared) {
     if (platformAudience(declared) !== audience) throw new Error("ODLA_ADMIN_TOKEN_AUDIENCE does not match the configured platform");
   } else if (audience !== "https://odla.ai") {
@@ -290,7 +313,7 @@ function audienceBoundEnvToken(token, platform) {
 }
 async function scopedToken(platform, scope, options, doFetch, out) {
   const audience = platformAudience(platform);
-  const tokenFile = options.tokenFile ?? `${import_node_process3.default.cwd()}/.odla/admin-token.local.json`;
+  const tokenFile = options.tokenFile ?? `${import_node_process4.default.cwd()}/.odla/admin-token.local.json`;
   const cache = readJsonFile(tokenFile);
   const cached = cache?.platform === audience ? cache.tokens?.[scope] : void 0;
   if (cached?.token && (cached.expiresAt ?? 0) > Date.now() + 6e4) {
@@ -305,13 +328,13 @@ async function scopedToken(platform, scope, options, doFetch, out) {
     onCode: async ({ userCode, expiresIn }) => {
       const approvalUrl = handshakeUrl(audience, userCode);
       out.log(`Approve scoped request ${userCode} at ${approvalUrl} within ${Math.floor(expiresIn / 60)}m.`);
-      const shouldOpen = options.open === true || options.open !== false && !import_node_process3.default.env.CI && Boolean(import_node_process3.default.stdin.isTTY && import_node_process3.default.stdout.isTTY);
+      const shouldOpen = options.open === true || options.open !== false && !import_node_process4.default.env.CI && Boolean(import_node_process4.default.stdin.isTTY && import_node_process4.default.stdout.isTTY);
       if (shouldOpen) await (options.openApprovalUrl ?? openUrl)(approvalUrl).catch(() => void 0);
     }
   });
   const tokens = cache?.platform === audience ? { ...cache.tokens ?? {} } : {};
   tokens[scope] = { token, expiresAt };
-  if ((0, import_node_fs2.existsSync)(`${import_node_process3.default.cwd()}/.git`)) ensureGitignore(import_node_process3.default.cwd(), [tokenFile]);
+  if ((0, import_node_fs2.existsSync)(`${import_node_process4.default.cwd()}/.git`)) ensureGitignore(import_node_process4.default.cwd(), [tokenFile]);
   writePrivateJson(tokenFile, { platform: audience, tokens });
   out.log(`auth: cached ${scope} grant (${tokenFile}; mode 0600)`);
   return token;
@@ -472,7 +495,7 @@ function isRecord2(value) {
 
 // src/admin-ai.ts
 async function adminAi(options) {
-  const platform = platformAudience(options.platform ?? import_node_process4.default.env.ODLA_PLATFORM ?? "https://odla.ai");
+  const platform = platformAudience(options.platform ?? import_node_process5.default.env.ODLA_PLATFORM ?? "https://odla.ai");
   const doFetch = options.fetch ?? fetch;
   const out = options.stdout ?? console;
   const usageQuery = options.action === "usage" ? adminAiUsageQuery(options) : void 0;
@@ -511,7 +534,7 @@ async function adminAi(options) {
   }
   if (options.action === "credential-set") {
     const provider = requireProvider(options.credentialProvider);
-    const value = await credentialValue(options);
+    const value = await secretInputValue(options);
     const res2 = await doFetch(`${platform}/registry/platform/ai-credentials/${encodeURIComponent(provider)}`, {
       method: "PUT",
       headers,
@@ -621,25 +644,6 @@ function requireProvider(value) {
   }
   return value;
 }
-async function credentialValue(options) {
-  if (options.fromEnv && options.stdin) throw new Error("choose exactly one of --from-env or --stdin");
-  let value;
-  if (options.fromEnv) value = import_node_process4.default.env[options.fromEnv];
-  else if (options.stdin) value = await (options.readStdin ?? readStdin)();
-  else throw new Error("credential input required: use --from-env <NAME> or --stdin; values are never accepted as arguments");
-  value = value?.replace(/[\r\n]+$/, "");
-  if (!value) throw new Error(options.fromEnv ? `environment variable ${options.fromEnv} is empty or unset` : "stdin credential is empty");
-  if (new TextEncoder().encode(value).byteLength > 64 * 1024) throw new Error("credential exceeds 64 KiB");
-  return value;
-}
-async function readStdin() {
-  let value = "";
-  for await (const chunk of import_node_process4.default.stdin) {
-    value += String(chunk);
-    if (value.length > 64 * 1024) throw new Error("credential exceeds 64 KiB");
-  }
-  return value;
-}
 function policyArray(body) {
   if (isRecord3(body) && Array.isArray(body.policies)) return body.policies.filter(isRecord3);
   if (isRecord3(body) && isRecord3(body.policies)) return Object.values(body.policies).filter(isRecord3);
@@ -809,6 +813,7 @@ var CAPABILITIES = {
     "register the app and enable configured services per environment",
     "issue, persist, and explicitly rotate configured service credentials",
     "write local Worker values and push deployed Worker secrets through Wrangler stdin",
+    "store tenant-vault secrets (including the Clerk webhook secret and reserved Clerk secret key) write-only from stdin or an env var",
     "push db schema/rules and configure platform AI, auth, and deployment links",
     "validate config offline and smoke-test a provisioned db environment",
     "run app-attributed hosted security discovery and independent validation without provider keys",
@@ -1265,6 +1270,8 @@ Usage:
   odla-ai smoke [--config odla.config.mjs] [--env dev]
   odla-ai skill install [--dir <project>] [--agent <name>] [--global] [--force]
   odla-ai secrets push --env <env> [--config odla.config.mjs] [--dry-run] [--yes]
+  odla-ai secrets set <name> --env <env> (--from-env <NAME>|--stdin) [--config odla.config.mjs] [--yes]
+  odla-ai secrets set-clerk-key --env <env> (--from-env <NAME>|--stdin) [--config odla.config.mjs] [--yes]
   odla-ai version
 
 Commands:
@@ -1278,7 +1285,9 @@ Commands:
   smoke        Verify local credentials, public-config, live schema, and db aggregate.
   skill        Same installer; --agent accepts all, claude, codex, cursor,
                copilot, gemini, or agents (repeatable or comma-separated).
-  secrets      Push configured db/o11y secrets into the Worker via wrangler stdin.
+  secrets      Push configured db/o11y secrets into the Worker via wrangler
+               stdin; set stores a tenant-vault secret and set-clerk-key the
+               reserved Clerk secret key, write-only from stdin or an env var.
   version      Print the CLI version.
 
 Safety:
@@ -1436,7 +1445,7 @@ function relativeDisplay(path, rootDir) {
 // src/provision.ts
 var import_apps2 = require("@odla-ai/apps");
 var import_ai = require("@odla-ai/ai");
-var import_node_process5 = __toESM(require("process"), 1);
+var import_node_process6 = __toESM(require("process"), 1);
 
 // src/provision-credentials.ts
 var import_apps = require("@odla-ai/apps");
@@ -1740,7 +1749,7 @@ ${env}: credentials are already saved; retry "odla-ai secrets push --env ${env}$
       out.log(`${env}: rules pushed (${Object.keys(rules).length} namespaces)`);
     }
     if (cfg.services.includes("ai") && cfg.ai?.provider && cfg.ai.keyEnv) {
-      const key = import_node_process5.default.env[cfg.ai.keyEnv];
+      const key = import_node_process6.default.env[cfg.ai.keyEnv];
       if (key) {
         const secretName = cfg.ai.secretName ?? defaultSecretName(cfg.ai.provider);
         await (0, import_ai.putSecret)({ endpoint: cfg.dbEndpoint, token, fetch: doFetch }, tenantId, secretName, key);
@@ -1800,6 +1809,63 @@ async function safeText2(res) {
   }
 }
 
+// src/secrets-set.ts
+var import_ai2 = require("@odla-ai/ai");
+var import_apps3 = require("@odla-ai/apps");
+var PROD_ENV_NAMES2 = /* @__PURE__ */ new Set(["prod", "production"]);
+async function secretsSet(options) {
+  const name = (options.name ?? "").trim();
+  if (!name) throw new Error('secret name is required, e.g. "odla-ai secrets set clerk_webhook_secret --env dev --stdin"');
+  if (name.startsWith("$")) {
+    throw new Error('"$"-prefixed vault names are platform-reserved; for the Clerk secret key use "odla-ai secrets set-clerk-key"');
+  }
+  const { cfg, tenantId, value, doFetch, out } = await resolveVaultWrite(options);
+  const token = await getDeveloperToken(cfg, options, doFetch, out);
+  try {
+    await (0, import_ai2.putSecret)({ endpoint: cfg.dbEndpoint, token, fetch: doFetch }, tenantId, name, value);
+  } catch (err) {
+    throw new Error(scrubValue(err instanceof Error ? err.message : String(err), value));
+  }
+  out.log(`${name} stored in the ${tenantId} vault (write-only; the value was never echoed and cannot be read back here)`);
+}
+async function secretsSetClerkKey(options) {
+  const { cfg, tenantId, value, doFetch, out } = await resolveVaultWrite(options);
+  if (!value.startsWith("sk_")) throw new Error("the Clerk secret key must start with sk_ (sk_test_\u2026 or sk_live_\u2026)");
+  if (value.startsWith("sk_test_") && PROD_ENV_NAMES2.has(options.env)) {
+    throw new Error(`refusing to store an sk_test_ Clerk key for "${options.env}" \u2014 use the production instance's sk_live_ key`);
+  }
+  if (value.startsWith("sk_live_") && !PROD_ENV_NAMES2.has(options.env) && !options.yes) {
+    throw new Error(`refusing to store an sk_live_ Clerk key for "${options.env}" without --yes (live users would sync into a non-prod tenant)`);
+  }
+  const token = await getDeveloperToken(cfg, options, doFetch, out);
+  const res = await doFetch(`${cfg.dbEndpoint}/admin/apps/${encodeURIComponent(tenantId)}/clerk-secret`, {
+    method: "POST",
+    headers: { authorization: `Bearer ${token}`, "content-type": "application/json" },
+    body: JSON.stringify({ value })
+  });
+  if (!res.ok) {
+    const text = scrubValue((await res.text().catch(() => "")).slice(0, 300), value);
+    throw new Error(`store Clerk secret key failed (${res.status}): ${text || "request failed"}`);
+  }
+  out.log(`Clerk secret key stored for ${tenantId} ($clerk_secret, reserved + write-only; the value was never echoed)`);
+}
+function scrubValue(text, value) {
+  return redactSecrets(text).split(value).join("[value redacted]");
+}
+async function resolveVaultWrite(options) {
+  const out = options.stdout ?? console;
+  const doFetch = options.fetch ?? fetch;
+  const cfg = await loadProjectConfig(options.configPath);
+  if (!cfg.envs.includes(options.env)) {
+    throw new Error(`env "${options.env}" is not in config envs (${cfg.envs.join(", ")})`);
+  }
+  if (PROD_ENV_NAMES2.has(options.env) && !options.yes) {
+    throw new Error(`refusing to store a secret for "${options.env}" without --yes`);
+  }
+  const value = await secretInputValue(options, "secret");
+  return { cfg, tenantId: (0, import_apps3.tenantIdFor)(cfg.app.id, options.env), value, doFetch, out };
+}
+
 // src/security-command-context.ts
 var import_promises = require("readline/promises");
 async function hostedSecurityContext(parsed, dependencies) {
@@ -3130,8 +3196,26 @@ async function runCli(argv = process.argv.slice(2), dependencies = {}) {
   }
   if (command === "secrets") {
     const sub = parsed.positionals[1];
+    if (sub === "set" || sub === "set-clerk-key") {
+      assertArgs(parsed, ["config", "env", "from-env", "stdin", "token", "yes"], sub === "set" ? 3 : 2);
+      const options = {
+        configPath: stringOpt(parsed.options.config) ?? "odla.config.mjs",
+        name: parsed.positionals[2],
+        env: requiredString(parsed.options.env, "--env"),
+        fromEnv: stringOpt(parsed.options["from-env"]),
+        stdin: parsed.options.stdin === true,
+        token: stringOpt(parsed.options.token),
+        yes: parsed.options.yes === true,
+        fetch: dependencies.fetch,
+        stdout: dependencies.stdout
+      };
+      await (sub === "set" ? secretsSet(options) : secretsSetClerkKey(options));
+      return;
+    }
     if (sub !== "push") {
-      throw new Error(`unknown secrets subcommand "${sub ?? ""}". Try "odla-ai secrets push --env dev".`);
+      throw new Error(
+        `unknown secrets subcommand "${sub ?? ""}". Try "odla-ai secrets push --env dev", "odla-ai secrets set <name> --env dev --stdin", or "odla-ai secrets set-clerk-key --env dev --stdin".`
+      );
     }
     assertArgs(parsed, ["config", "env", "dry-run", "yes"], 2);
     await secretsPush({