@odla-ai/cli 0.8.0 → 0.9.0

package/dist/bin.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import {
   runCli
-} from "./chunk-BHAEDEL2.js";
+} from "./chunk-MJYQ7YDH.js";
 
 // src/bin.ts
 runCli().catch((err) => {

package/dist/{chunk-BHAEDEL2.js → chunk-MJYQ7YDH.js}

@@ -297,7 +297,30 @@ function requireSystemAiPurpose(value) {
 }
 
 // src/admin-ai.ts
+import process6 from "process";
+
+// src/secret-input.ts
 import process5 from "process";
+var MAX_BYTES = 64 * 1024;
+async function secretInputValue(options, kind = "credential") {
+  if (options.fromEnv && options.stdin) throw new Error("choose exactly one of --from-env or --stdin");
+  let value;
+  if (options.fromEnv) value = process5.env[options.fromEnv];
+  else if (options.stdin) value = await (options.readStdin ?? (() => readSecretStream(kind)))();
+  else throw new Error(`${kind} input required: use --from-env <NAME> or --stdin; values are never accepted as arguments`);
+  value = value?.replace(/[\r\n]+$/, "");
+  if (!value) throw new Error(options.fromEnv ? `environment variable ${options.fromEnv} is empty or unset` : `stdin ${kind} is empty`);
+  if (new TextEncoder().encode(value).byteLength > MAX_BYTES) throw new Error(`${kind} exceeds 64 KiB`);
+  return value;
+}
+async function readSecretStream(kind, stream = process5.stdin) {
+  let value = "";
+  for await (const chunk of stream) {
+    value += String(chunk);
+    if (value.length > MAX_BYTES) throw new Error(`${kind} exceeds 64 KiB`);
+  }
+  return value;
+}
 
 // src/admin-ai-audit.ts
 function adminAiAuditQuery(filters) {
@@ -445,7 +468,7 @@ function isRecord2(value) {
 
 // src/admin-ai.ts
 async function adminAi(options) {
-  const platform = platformAudience(options.platform ?? process5.env.ODLA_PLATFORM ?? "https://odla.ai");
+  const platform = platformAudience(options.platform ?? process6.env.ODLA_PLATFORM ?? "https://odla.ai");
   const doFetch = options.fetch ?? fetch;
   const out = options.stdout ?? console;
   const usageQuery = options.action === "usage" ? adminAiUsageQuery(options) : void 0;
@@ -484,7 +507,7 @@ async function adminAi(options) {
   }
   if (options.action === "credential-set") {
     const provider = requireProvider(options.credentialProvider);
-    const value = await credentialValue(options);
+    const value = await secretInputValue(options);
     const res2 = await doFetch(`${platform}/registry/platform/ai-credentials/${encodeURIComponent(provider)}`, {
       method: "PUT",
       headers,
@@ -594,25 +617,6 @@ function requireProvider(value) {
   }
   return value;
 }
-async function credentialValue(options) {
-  if (options.fromEnv && options.stdin) throw new Error("choose exactly one of --from-env or --stdin");
-  let value;
-  if (options.fromEnv) value = process5.env[options.fromEnv];
-  else if (options.stdin) value = await (options.readStdin ?? readStdin)();
-  else throw new Error("credential input required: use --from-env <NAME> or --stdin; values are never accepted as arguments");
-  value = value?.replace(/[\r\n]+$/, "");
-  if (!value) throw new Error(options.fromEnv ? `environment variable ${options.fromEnv} is empty or unset` : "stdin credential is empty");
-  if (new TextEncoder().encode(value).byteLength > 64 * 1024) throw new Error("credential exceeds 64 KiB");
-  return value;
-}
-async function readStdin() {
-  let value = "";
-  for await (const chunk of process5.stdin) {
-    value += String(chunk);
-    if (value.length > 64 * 1024) throw new Error("credential exceeds 64 KiB");
-  }
-  return value;
-}
 function policyArray(body) {
   if (isRecord3(body) && Array.isArray(body.policies)) return body.policies.filter(isRecord3);
   if (isRecord3(body) && isRecord3(body.policies)) return Object.values(body.policies).filter(isRecord3);
@@ -648,6 +652,7 @@ var CAPABILITIES = {
     "register the app and enable configured services per environment",
     "issue, persist, and explicitly rotate configured service credentials",
     "write local Worker values and push deployed Worker secrets through Wrangler stdin",
+    "store tenant-vault secrets (including the Clerk webhook secret and reserved Clerk secret key) write-only from stdin or an env var",
     "push db schema/rules and configure platform AI, auth, and deployment links",
     "validate config offline and smoke-test a provisioned db environment",
     "run app-attributed hosted security discovery and independent validation without provider keys",
@@ -1259,7 +1264,7 @@ function assertWranglerConfig(cfg) {
 // src/provision.ts
 import { createAppsClient, tenantIdFor as tenantIdFor2 } from "@odla-ai/apps";
 import { DEFAULT_SECRET_NAMES, putSecret } from "@odla-ai/ai";
-import process6 from "process";
+import process7 from "process";
 
 // src/provision-credentials.ts
 import { tenantIdFor } from "@odla-ai/apps";
@@ -1490,7 +1495,7 @@ ${env}: credentials are already saved; retry "odla-ai secrets push --env ${env}$
       out.log(`${env}: rules pushed (${Object.keys(rules).length} namespaces)`);
     }
     if (cfg.services.includes("ai") && cfg.ai?.provider && cfg.ai.keyEnv) {
-      const key = process6.env[cfg.ai.keyEnv];
+      const key = process7.env[cfg.ai.keyEnv];
       if (key) {
         const secretName = cfg.ai.secretName ?? defaultSecretName(cfg.ai.provider);
         await putSecret({ endpoint: cfg.dbEndpoint, token, fetch: doFetch }, tenantId, secretName, key);
@@ -1550,6 +1555,63 @@ async function safeText2(res) {
   }
 }
 
+// src/secrets-set.ts
+import { putSecret as putSecret2 } from "@odla-ai/ai";
+import { tenantIdFor as tenantIdFor3 } from "@odla-ai/apps";
+var PROD_ENV_NAMES2 = /* @__PURE__ */ new Set(["prod", "production"]);
+async function secretsSet(options) {
+  const name = (options.name ?? "").trim();
+  if (!name) throw new Error('secret name is required, e.g. "odla-ai secrets set clerk_webhook_secret --env dev --stdin"');
+  if (name.startsWith("$")) {
+    throw new Error('"$"-prefixed vault names are platform-reserved; for the Clerk secret key use "odla-ai secrets set-clerk-key"');
+  }
+  const { cfg, tenantId, value, doFetch, out } = await resolveVaultWrite(options);
+  const token = await getDeveloperToken(cfg, options, doFetch, out);
+  try {
+    await putSecret2({ endpoint: cfg.dbEndpoint, token, fetch: doFetch }, tenantId, name, value);
+  } catch (err) {
+    throw new Error(scrubValue(err instanceof Error ? err.message : String(err), value));
+  }
+  out.log(`${name} stored in the ${tenantId} vault (write-only; the value was never echoed and cannot be read back here)`);
+}
+async function secretsSetClerkKey(options) {
+  const { cfg, tenantId, value, doFetch, out } = await resolveVaultWrite(options);
+  if (!value.startsWith("sk_")) throw new Error("the Clerk secret key must start with sk_ (sk_test_\u2026 or sk_live_\u2026)");
+  if (value.startsWith("sk_test_") && PROD_ENV_NAMES2.has(options.env)) {
+    throw new Error(`refusing to store an sk_test_ Clerk key for "${options.env}" \u2014 use the production instance's sk_live_ key`);
+  }
+  if (value.startsWith("sk_live_") && !PROD_ENV_NAMES2.has(options.env) && !options.yes) {
+    throw new Error(`refusing to store an sk_live_ Clerk key for "${options.env}" without --yes (live users would sync into a non-prod tenant)`);
+  }
+  const token = await getDeveloperToken(cfg, options, doFetch, out);
+  const res = await doFetch(`${cfg.dbEndpoint}/admin/apps/${encodeURIComponent(tenantId)}/clerk-secret`, {
+    method: "POST",
+    headers: { authorization: `Bearer ${token}`, "content-type": "application/json" },
+    body: JSON.stringify({ value })
+  });
+  if (!res.ok) {
+    const text = scrubValue((await res.text().catch(() => "")).slice(0, 300), value);
+    throw new Error(`store Clerk secret key failed (${res.status}): ${text || "request failed"}`);
+  }
+  out.log(`Clerk secret key stored for ${tenantId} ($clerk_secret, reserved + write-only; the value was never echoed)`);
+}
+function scrubValue(text, value) {
+  return redactSecrets(text).split(value).join("[value redacted]");
+}
+async function resolveVaultWrite(options) {
+  const out = options.stdout ?? console;
+  const doFetch = options.fetch ?? fetch;
+  const cfg = await loadProjectConfig(options.configPath);
+  if (!cfg.envs.includes(options.env)) {
+    throw new Error(`env "${options.env}" is not in config envs (${cfg.envs.join(", ")})`);
+  }
+  if (PROD_ENV_NAMES2.has(options.env) && !options.yes) {
+    throw new Error(`refusing to store a secret for "${options.env}" without --yes`);
+  }
+  const value = await secretInputValue(options, "secret");
+  return { cfg, tenantId: tenantIdFor3(cfg.app.id, options.env), value, doFetch, out };
+}
+
 // src/security.ts
 import { isAbsolute as isAbsolute3, relative as relative2, resolve as resolve5, sep } from "path";
 import {
@@ -2542,6 +2604,8 @@ Usage:
   odla-ai smoke [--config odla.config.mjs] [--env dev]
   odla-ai skill install [--dir <project>] [--agent <name>] [--global] [--force]
   odla-ai secrets push --env <env> [--config odla.config.mjs] [--dry-run] [--yes]
+  odla-ai secrets set <name> --env <env> (--from-env <NAME>|--stdin) [--config odla.config.mjs] [--yes]
+  odla-ai secrets set-clerk-key --env <env> (--from-env <NAME>|--stdin) [--config odla.config.mjs] [--yes]
   odla-ai version
 
 Commands:
@@ -2555,7 +2619,9 @@ Commands:
   smoke        Verify local credentials, public-config, live schema, and db aggregate.
   skill        Same installer; --agent accepts all, claude, codex, cursor,
                copilot, gemini, or agents (repeatable or comma-separated).
-  secrets      Push configured db/o11y secrets into the Worker via wrangler stdin.
+  secrets      Push configured db/o11y secrets into the Worker via wrangler
+               stdin; set stores a tenant-vault secret and set-clerk-key the
+               reserved Clerk secret key, write-only from stdin or an env var.
   version      Print the CLI version.
 
 Safety:
@@ -3119,8 +3185,26 @@ async function runCli(argv = process.argv.slice(2), dependencies = {}) {
   }
   if (command === "secrets") {
     const sub = parsed.positionals[1];
+    if (sub === "set" || sub === "set-clerk-key") {
+      assertArgs(parsed, ["config", "env", "from-env", "stdin", "token", "yes"], sub === "set" ? 3 : 2);
+      const options = {
+        configPath: stringOpt(parsed.options.config) ?? "odla.config.mjs",
+        name: parsed.positionals[2],
+        env: requiredString(parsed.options.env, "--env"),
+        fromEnv: stringOpt(parsed.options["from-env"]),
+        stdin: parsed.options.stdin === true,
+        token: stringOpt(parsed.options.token),
+        yes: parsed.options.yes === true,
+        fetch: dependencies.fetch,
+        stdout: dependencies.stdout
+      };
+      await (sub === "set" ? secretsSet(options) : secretsSetClerkKey(options));
+      return;
+    }
     if (sub !== "push") {
-      throw new Error(`unknown secrets subcommand "${sub ?? ""}". Try "odla-ai secrets push --env dev".`);
+      throw new Error(
+        `unknown secrets subcommand "${sub ?? ""}". Try "odla-ai secrets push --env dev", "odla-ai secrets set <name> --env dev --stdin", or "odla-ai secrets set-clerk-key --env dev --stdin".`
+      );
     }
     assertArgs(parsed, ["config", "env", "dry-run", "yes"], 2);
     await secretsPush({
@@ -3173,6 +3257,8 @@ export {
   initProject,
   secretsPush,
   provision,
+  secretsSet,
+  secretsSetClerkKey,
   runHostedSecurity,
   connectGitHubSecuritySource,
   listGitHubSecuritySources,
@@ -3192,4 +3278,4 @@ export {
   smoke,
   runCli
 };
-//# sourceMappingURL=chunk-BHAEDEL2.js.map
+//# sourceMappingURL=chunk-MJYQ7YDH.js.map