@odla-ai/cli 0.8.0 → 0.9.0

package/llms.txt

@@ -31,8 +31,8 @@ For a project you keep working in, install it as a dev dependency so the
 shorter `npx odla-ai` form works and the version is pinned by your lockfile:
 
 ```bash
-npm view @odla-ai/cli@0.8.0 version
-npm i -D --save-exact @odla-ai/cli@0.8.0
+npm view @odla-ai/cli@0.9.0 version
+npm i -D --save-exact @odla-ai/cli@0.9.0
 ```
 
 ## Prerequisites
@@ -61,6 +61,8 @@ npx odla-ai provision --dry-run
 npx odla-ai provision --write-dev-vars --push-secrets
 npx odla-ai smoke --env dev
 npx odla-ai secrets push --env dev
+npx odla-ai secrets set clerk_webhook_secret --env dev --stdin
+npx odla-ai secrets set-clerk-key --env dev --from-env CLERK_SECRET_KEY
 npx @odla-ai/cli security run . --env dev --ack-redacted-source
 npx @odla-ai/cli security github connect --env dev # infers owner/name from git origin
 npx @odla-ai/cli security plan --env dev
@@ -268,6 +270,22 @@ redacted plan without spawning anything. For the normal path, use
 `provision --write-dev-vars --push-secrets` so service enablement, credential
 issuance, local config, and deployed secret transfer stay one composition.
 
+`secrets set <name> --env <env>` stores one named secret in that env's tenant
+vault — the same write-only slot Studio's Secrets panel fills (for example
+`clerk_webhook_secret` for synced auth). The value may come only from
+`--from-env <NAME>` or `--stdin`, so a producer command pipes straight into the
+vault without the secret ever appearing on argv, in output, or in an agent's
+transcript; it is encrypted at rest and readable back only by that tenant's
+app API key, never by the CLI, Studio, or the developer token. `$`-prefixed
+names are platform-reserved. `secrets set-clerk-key --env <env>` stores the
+app's Clerk secret key in the reserved `$clerk_secret` slot so the platform can
+resolve the app's users (invites, member lookups); reserved secrets are never
+readable by app keys. It refuses an `sk_test_` key for a prod-named env and
+requires `--yes` to put an `sk_live_` key into a non-prod env, since live users
+would sync into a non-prod tenant. Both commands authenticate with the
+developer token (`$ODLA_DEV_TOKEN`, the cached token, or a fresh device
+approval), and prod-named envs require `--yes`, matching `secrets push`.
+
 ## Who does what
 
 If a change is deterministic from `odla.config.mjs`, the CLI owns it: app and
@@ -357,10 +375,12 @@ If schema is present and rules are omitted, `defaultRules: "deny"` generates
 deny-all rules for every schema entity. That is the safe default for Workers
 that mediate reads and writes with an app key.
 
-## API reference (generated from dist/index.d.ts, v0.8.0)
+## API reference (generated from dist/index.d.ts, v0.9.0)
 
 ```ts
 import { SecurityReport, PlatformSecurityRun } from '@odla-ai/security';
+import { HostedSecurityJob, GitHubConnectionStatus, GitHubSecuritySource, HostedSecurityIntentResponse, HostedSecurityPlan, HostedSecurityReport, HostedSecurityJobStatus } from '@odla-ai/security/hosted';
+export { GitHubConnectionAttempt, GitHubConnectionStatus, GitHubSecuritySource, HostedSecurityCounts, HostedSecurityCoverage, HostedSecurityIntent, HostedSecurityIntentResponse, HostedSecurityJob, HostedSecurityJobStatus, HostedSecurityPlan, HostedSecurityPlanRoute, HostedSecurityReport, HostedSecurityReportFinding, HostedSecurityRoute } from '@odla-ai/security/hosted';
 
 /** Injectable side-effect boundaries used to run and test the command dispatcher. */
 interface CliDependencies {
@@ -451,7 +471,7 @@ declare function adminAi(options: AdminAiOptions): Promise<void>;
 /** Stable, machine-readable division of work between the CLI, coding agent,
  * human operator, and Studio. Printed by `odla-ai capabilities --json`. */
 declare const CAPABILITIES: {
-    readonly cli: readonly ["register the app and enable configured services per environment", "issue, persist, and explicitly rotate configured service credentials", "write local Worker values and push deployed Worker secrets through Wrangler stdin", "push db schema/rules and configure platform AI, auth, and deployment links", "validate config offline and smoke-test a provisioned db environment", "run app-attributed hosted security discovery and independent validation without provider keys", "connect/revoke source-read-only GitHub sources and drive commit-pinned hosted security jobs without PATs or provider keys", "let admins manage system AI policy and credentials, inspect attributed usage, and read immutable admin changes through separate short-lived capability-only approvals"];
+    readonly cli: readonly ["register the app and enable configured services per environment", "issue, persist, and explicitly rotate configured service credentials", "write local Worker values and push deployed Worker secrets through Wrangler stdin", "store tenant-vault secrets (including the Clerk webhook secret and reserved Clerk secret key) write-only from stdin or an env var", "push db schema/rules and configure platform AI, auth, and deployment links", "validate config offline and smoke-test a provisioned db environment", "run app-attributed hosted security discovery and independent validation without provider keys", "connect/revoke source-read-only GitHub sources and drive commit-pinned hosted security jobs without PATs or provider keys", "let admins manage system AI policy and credentials, inspect attributed usage, and read immutable admin changes through separate short-lived capability-only approvals"];
     readonly agent: readonly ["install and import the selected odla SDKs", "wrap the Worker with withObservability and choose useful telemetry", "make application-specific schema, rules, auth, UI, and migration decisions"];
     readonly human: readonly ["approve the odla device code and one-off third-party logins", "consent to production changes with --yes", "request destructive credential rotation explicitly", "review application semantics, security findings, releases, and merges", "approve redacted-source disclosure before hosted security reasoning", "approve GitHub App repository access separately from redacted-snippet disclosure"];
     readonly studio: readonly ["view telemetry and environment state", "perform manual credential recovery when the CLI's local shown-once copy is unavailable", "configure system AI purposes and view app/environment/run-attributed usage", "connect/revoke GitHub security sources and inspect ref-to-SHA jobs, routes, retention, coverage, and normalized reports"];
@@ -727,6 +747,47 @@ interface SecretsPushOptions {
  */
 declare function secretsPush(options: SecretsPushOptions): Promise<void>;
 
+/**
+ * Inputs for one write-only tenant-vault transfer (`secrets set` /
+ * `secrets set-clerk-key`). Values may come only from a named environment
+ * variable or stdin, so a producer command can be piped straight into the
+ * vault without the secret ever being displayed or stored on disk.
+ */
+interface SecretsSetOptions {
+    configPath: string;
+    env: string;
+    /** Vault secret name (`secrets set` only; `$`-prefixed names are reserved). */
+    name?: string;
+    fromEnv?: string;
+    stdin?: boolean;
+    /** Explicit consent for a prod-named env (and for sk_live_ into a non-prod env). */
+    yes?: boolean;
+    /** Developer token override; defaults to $ODLA_DEV_TOKEN, the cached token, or a device handshake. */
+    token?: string;
+    open?: boolean;
+    interactive?: boolean;
+    openApprovalUrl?: (url: string) => Promise<void>;
+    fetch?: typeof fetch;
+    readStdin?: () => Promise<string>;
+    stdout?: Pick<typeof console, "log" | "error">;
+}
+/**
+ * Store one named secret in the env's tenant vault (the same write-only slot
+ * Studio's Secrets panel fills), e.g. `clerk_webhook_secret` for synced auth.
+ * The value is encrypted at rest and can be read back only by that tenant's
+ * app API key — never by this CLI, Studio, or the developer token.
+ */
+declare function secretsSet(options: SecretsSetOptions): Promise<void>;
+/**
+ * Store the app's Clerk secret key under the reserved `$clerk_secret` slot so
+ * odla-db can resolve the app's users (invites, member lookups). Reserved
+ * secrets are never readable by app keys; the dedicated endpoint is the only
+ * way to set one. Guards against instance/env mismatches: an sk_test_ key
+ * never belongs in a prod-named env, and an sk_live_ key entering a non-prod
+ * env requires `--yes` (live users would sync into a non-prod tenant).
+ */
+declare function secretsSetClerkKey(options: SecretsSetOptions): Promise<void>;
+
 /** Built-in security coverage profile selected for a hosted reasoning run. */
 type HostedSecurityProfile = "odla" | "cloudflare-app" | "generic";
 /** Exact attribution and authorization need supplied to a lazy token callback. */
@@ -782,223 +843,15 @@ interface HostedSecurityResult {
  */
 declare function runHostedSecurity(options: RunHostedSecurityOptions): Promise<HostedSecurityResult>;
 
-/** GitHub repository connection persisted by odla.ai. GitHub credentials and
- * installation identifiers are deliberately absent from this client view. */
-interface GitHubSecuritySource {
-    sourceId: string;
-    repository: string;
-    installationAccount: string;
-    defaultBranch: string;
-    env: string;
-    status: "active" | "disabled" | "deleted";
-    connectedAt: string;
-}
-/** One browser-mediated GitHub App installation attempt. */
-interface GitHubConnectionAttempt {
-    attemptId: string;
-    installUrl: string;
-    expiresAt: string;
-}
-/** Poll-safe state for a GitHub App installation attempt. */
-interface GitHubConnectionStatus {
-    attemptId: string;
-    status: "pending" | "connected" | "expired" | "failed";
-    connectionId?: string;
-    sourceId?: string;
-    repository?: string;
-    installationAccount?: string;
-    failureCode?: string;
-}
-/** Model identity selected by platform policy. No provider credential is
- * returned to the CLI. */
-interface HostedSecurityRoute {
-    provider: string;
-    model: string;
-    policyVersion?: number;
-}
-/** One purpose-specific System AI route disclosed before a hosted review. */
-interface HostedSecurityPlanRoute extends HostedSecurityRoute {
-    purpose: "security.discovery" | "security.validation";
-    policyVersion: number;
-    enabled: boolean;
-    credentialReady: boolean;
-    maxCallsPerRun: number;
-    maxInputBytes: number;
-    maxOutputTokens: number;
-}
-/** Owner-readable, versioned disclosure preflight. Provider/model identities
- * and bounds are non-secret; the full plan digest binds subsequent consent so
- * an admin edit or processing-contract release cannot silently change it. */
-interface HostedSecurityPlan {
-    env: string;
-    /** Versioned disclosure and processing contract covered by `planDigest`. */
-    consentContract: "odla.hosted-security-consent.v1";
-    /** Versioned private report projection covered by `planDigest`. */
-    reportProjection: "odla.hosted-security-report.v1";
-    /** Best-effort credential-pattern redaction contract covered by `planDigest`. */
-    redactionContract: "odla.best-effort-credential-pattern-redaction.v1";
-    /** Server-owned prompt bundle covered by `planDigest`. */
-    promptBundle: string;
-    /** Digest binding this exact disclosure plan to a later enqueue request. */
-    planDigest: `sha256:${string}`;
-    ready: boolean;
-    independent: boolean;
-    sourceDisclosure: "redacted";
-    targetExecution: false;
-    reportRetentionDays: number;
-    routes: {
-        discovery: HostedSecurityPlanRoute;
-        validation: HostedSecurityPlanRoute;
-    };
-}
-/** Server-authored preview of the exact source/ref/profile execution choice. */
-interface HostedSecurityIntent {
-    executionContract: "odla.hosted-security-execution-consent.v1";
-    executionDigest: `sha256:${string}`;
-    appId: string;
-    env: string;
-    sourceId: string;
-    repository: string;
-    defaultBranch: string;
-    /** Explicit requested ref; omitted requests are canonicalized to the source's current default branch. */
-    requestedRef: string;
-    profile: "odla" | "cloudflare-app" | "generic";
-    sourceDisclosure: "redacted";
-    planDigest: `sha256:${string}`;
-}
-/** Atomic server response used to review both the processing plan and execution intent. */
-interface HostedSecurityIntentResponse {
-    plan: HostedSecurityPlan;
-    intent: HostedSecurityIntent;
-}
-/** Lifecycle state reported for a hosted repository security job. */
-type HostedSecurityJobStatus = "queued" | "acquiring" | "analyzing" | "completed" | "failed" | "cancelled";
-/** Finding totals summarized on hosted job metadata. */
-interface HostedSecurityCounts {
-    confirmed: number;
-    needsReproduction: number;
-    candidates: number;
-}
-/** Coverage-cell totals summarized on hosted job metadata. */
-interface HostedSecurityCoverage {
-    completeCells?: number;
-    totalCells?: number;
-    shallowCells?: number;
-    blockedCells?: number;
-    unscheduledCells?: number;
-    budgetExhaustedCells?: number;
-}
-/** Bounded job metadata returned by odla.ai; it has no archive, file-body, or
- * explicit source-excerpt field. */
-interface HostedSecurityJob {
-    jobId: string;
-    env: string;
-    sourceId: string;
-    repository: string;
-    requestedRef?: string;
-    commitSha?: string;
-    status: HostedSecurityJobStatus;
-    runId?: string;
-    profile: string;
-    routes?: {
-        discovery: HostedSecurityRoute;
-        validation: HostedSecurityRoute;
-    };
-    sourceDisclosure: "redacted";
-    planDigest: `sha256:${string}`;
-    executionContract: "odla.hosted-security-execution-consent.v1";
-    executionDigest: `sha256:${string}`;
-    retentionDays: number;
-    snapshotDigest?: `sha256:${string}`;
-    fileCount?: number;
-    inputBytes?: number;
-    reportDigest?: `sha256:${string}`;
-    coverageStatus?: "not_run" | "complete" | "incomplete";
-    coverage?: HostedSecurityCoverage;
-    counts?: HostedSecurityCounts;
-    errorCode?: string;
-    createdAt: string;
-    updatedAt: string;
-    startedAt?: string;
-    completedAt?: string;
-}
-/** One normalized, bounded finding in a hosted security report. */
-interface HostedSecurityReportFinding {
-    fingerprint: string;
-    kind: string;
-    attackClass: string;
-    title: string;
-    summary: string;
-    impact: string;
-    remediation?: string;
-    validationRationale?: string;
-    validationStatus?: string;
-    confidence: "low" | "medium" | "high";
-    severity: "critical" | "high" | "medium" | "low" | "informational";
-    disposition: string;
-    locations: Array<{
-        path: string;
-        line: number;
-        column?: number;
-    }>;
-}
-/** Bounded report projection with normalized model-derived prose and paths.
- * Its schema has no dedicated raw-source, archive, source-excerpt, context
- * packet, raw-provider-response, credential, execution-trace, or reproduction
- * output field. Model prose may reveal or echo source semantics, so the report
- * must remain private. */
-interface HostedSecurityReport {
-    schemaVersion: 1;
-    jobId: string;
-    runId: string;
-    repository: string;
-    revision: string;
-    snapshotDigest: string;
-    reportDigest: string;
-    startedAt: string;
-    completedAt: string;
-    mode: "passive" | "autonomous";
-    coverageStatus: "not_run" | "complete" | "incomplete";
-    findingsReturned: number;
-    findingsTotal: number;
-    coverageReturned: number;
-    coverageTotal: number;
-    metrics: HostedSecurityCounts & {
-        rejected: number;
-        suppressed: number;
-        coverageCells: number;
-        shallowCells: number;
-        blockedCells: number;
-        unscheduledCells: number;
-        budgetExhaustedCells: number;
-    };
-    provenance: {
-        harnessVersion: string;
-        promptBundle: string;
-        profile: {
-            id: string;
-            version: string;
-        };
-        independentValidation: boolean;
-        discovery?: {
-            provider?: string;
-            model?: string;
-        };
-        validation?: {
-            provider?: string;
-            model?: string;
-        };
-    };
-    coverage: Array<{
-        area: string;
-        attackClass: string;
-        attempts: number;
-        candidateCount: number;
-        state: string;
-    }>;
-    limitations: string[];
-    findings: HostedSecurityReportFinding[];
-}
+/**
+ * The hosted-security client surface. The WIRE types live in @odla-ai/security/hosted — one
+ * definition shared with the dashboard and the server that produces them. Re-exported here so
+ * this module stays the single import path for the rest of the CLI.
+ *
+ * What remains below is what is genuinely the CLI's own: transport controls (platform origin,
+ * token, fetch, AbortSignal) that no other client shares.
+ */
+
 /** Common authenticated transport controls for hosted-security requests. */
 interface HostedSecurityRequestOptions {
     platform: string;
@@ -1193,5 +1046,5 @@ declare function installSkill(options?: SkillInstallOptions): SkillInstallResult
  */
 declare function smoke(options: SmokeOptions): Promise<void>;
 
-export { AGENT_HARNESSES, type AdminAiOptions, type AgentHarness, type AgentHarnessSelector, CAPABILITIES, type CliDependencies, type ConnectGitHubSecuritySourceOptions, type DisconnectGitHubSecuritySourceOptions, type FollowHostedSecurityJobOptions, type GetHostedSecurityIntentOptions, type GetHostedSecurityJobOptions, type GitHubConnectionAttempt, type GitHubConnectionStatus, type GitHubSecuritySource, type HarnessInstallResult, type HostedSecurityCounts, type HostedSecurityCoverage, type HostedSecurityIntent, type HostedSecurityIntentResponse, type HostedSecurityJob, type HostedSecurityJobStatus, type HostedSecurityPlan, type HostedSecurityPlanRoute, type HostedSecurityProfile, type HostedSecurityReport, type HostedSecurityReportFinding, type HostedSecurityResult, type HostedSecurityRoute, type HostedSecurityTokenRequest, type ListGitHubSecuritySourcesOptions, type ListHostedSecurityJobsOptions, type LoadedProjectConfig, type LocalCredentials, type OdlaProjectConfig, type ProvisionOptions, type ProvisionPlan, type RunHostedSecurityOptions, SYSTEM_AI_PURPOSES, type ScopedPlatformTokenOptions, type SecretsPushOptions, type SkillInstallOptions, type SkillInstallResult, type SmokeOptions, type StartHostedSecurityJobOptions, type SystemAiPurpose, adminAi, connectGitHubSecuritySource, disconnectGitHubSecuritySource, doctor, followHostedSecurityJob, getHostedSecurityIntent, getHostedSecurityJob, getHostedSecurityPlan, getHostedSecurityReport, getScopedPlatformToken, inferGitHubRepository, initProject, installSkill, isTerminalHostedSecurityStatus, listGitHubSecuritySources, listHostedSecurityJobs, printCapabilities, provision, redactSecrets, repositoryFromGitRemote, runCli, runHostedSecurity, secretsPush, smoke, startHostedSecurityJob };
+export { AGENT_HARNESSES, type AdminAiOptions, type AgentHarness, type AgentHarnessSelector, CAPABILITIES, type CliDependencies, type ConnectGitHubSecuritySourceOptions, type DisconnectGitHubSecuritySourceOptions, type FollowHostedSecurityJobOptions, type GetHostedSecurityIntentOptions, type GetHostedSecurityJobOptions, type HarnessInstallResult, type HostedSecurityProfile, type HostedSecurityResult, type HostedSecurityTokenRequest, type ListGitHubSecuritySourcesOptions, type ListHostedSecurityJobsOptions, type LoadedProjectConfig, type LocalCredentials, type OdlaProjectConfig, type ProvisionOptions, type ProvisionPlan, type RunHostedSecurityOptions, SYSTEM_AI_PURPOSES, type ScopedPlatformTokenOptions, type SecretsPushOptions, type SecretsSetOptions, type SkillInstallOptions, type SkillInstallResult, type SmokeOptions, type StartHostedSecurityJobOptions, type SystemAiPurpose, adminAi, connectGitHubSecuritySource, disconnectGitHubSecuritySource, doctor, followHostedSecurityJob, getHostedSecurityIntent, getHostedSecurityJob, getHostedSecurityPlan, getHostedSecurityReport, getScopedPlatformToken, inferGitHubRepository, initProject, installSkill, isTerminalHostedSecurityStatus, listGitHubSecuritySources, listHostedSecurityJobs, printCapabilities, provision, redactSecrets, repositoryFromGitRemote, runCli, runHostedSecurity, secretsPush, secretsSet, secretsSetClerkKey, smoke, startHostedSecurityJob };
 ```

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@odla-ai/cli",
-  "version": "0.8.0",
+  "version": "0.9.0",
   "description": "Agent-operable CLI for odla provisioning, System AI administration, commit-pinned GitHub security jobs, Worker secrets, and smoke checks.",
   "license": "MIT",
   "homepage": "https://odla.ai/docs/packages/cli",

package/skills/odla-migrate/references/phase-3b-user-sync.md

@@ -8,9 +8,10 @@ build the mirror yourself — the platform does it. This phase enables it.
 Goal: signed-in users appear as rows in the app's `$users`, kept in sync with
 Clerk (create/update/delete). Dev first, then prod.
 
-Human obligation: create a Clerk webhook endpoint and paste its signing secret
-(`whsec_…`) into Studio (write-only). That plus the Phase-3 `clerk auth login`
-are the only human Clerk steps.
+Human obligation: create a Clerk webhook endpoint and get its signing secret
+(`whsec_…`) into the tenant vault — piped through `secrets set` when a command
+can print it, or pasted into Studio (both write-only). That plus the Phase-3
+`clerk auth login` are the only human Clerk steps.
 
 ## How `$users` fills — two paths
 
@@ -37,12 +38,18 @@ Enable it here.
    Clerk dashboard → Webhooks → Add Endpoint. (`whsec_` is a real secret — never
    print/commit it; it is the only thing you paste, and it goes into the vault,
    not chat.)
-2. **Store the secret in the tenant vault** as `clerk_webhook_secret`, write-only,
-   via Studio's secret UI (`odla.ai/studio` → the app → the env → secrets). The server
-   decrypts it only to verify inbound events (svix HMAC over `id.timestamp.body`).
+2. **Store the secret in the tenant vault** as `clerk_webhook_secret`, write-only.
+   If any command can print the `whsec_` (Clerk CLI, Svix API), pipe it without
+   it ever being displayed:
+   `<command that prints whsec_…> | npx @odla-ai/cli secrets set clerk_webhook_secret --env dev --stdin`.
+   Otherwise a human pastes it into Studio's secret UI (`odla.ai/studio` → the
+   app → the env → secrets) — same write-only slot. The server decrypts it only
+   to verify inbound events (svix HMAC over `id.timestamp.body`).
 3. **(Optional) `sk_…`** — the webhook payload already carries email/name/image,
-   so the basic mirror needs only `whsec_`. Add the Clerk backend key `sk_…` to
-   the vault only if you later need to resolve data the webhook doesn't send.
+   so the basic mirror needs only `whsec_`. Add the Clerk backend key only if
+   you later need to resolve data the webhook doesn't send (invites, member
+   lookups): `npx @odla-ai/cli secrets set-clerk-key --env dev --from-env CLERK_SECRET_KEY`
+   stores it in the reserved `$clerk_secret` slot, write-only.
 
 ## Verify
 

package/skills/odla-migrate/references/secrets-map.md

@@ -5,8 +5,8 @@
 | Value | Lives in | Handling |
 |---|---|---|
 | Clerk publishable key (`pk_test_`/`pk_live_`) | registry, via provision → setAuth | public by design; the one value a human may paste into chat; fine inline in odla.config.mjs |
-| Clerk webhook secret (`whsec_…`) | tenant vault (`clerk_webhook_secret`) | only for auth mode "full"; entered in Studio, never wrangler, never chat |
-| Clerk secret key (`sk_test_`/`sk_live_`) | not used in this journey | never ask for it |
+| Clerk webhook secret (`whsec_…`) | tenant vault (`clerk_webhook_secret`) | only for auth mode "full"; piped with `secrets set clerk_webhook_secret --env <env> --stdin`, or entered in Studio; never wrangler, never chat |
+| Clerk secret key (`sk_test_`/`sk_live_`) | not needed for this journey | if a later feature needs user resolution/invites, pipe it with `secrets set-clerk-key --env <env>` (reserved `$clerk_secret`, write-only); never chat |
 | LLM provider key | tenant vault | env var in the HUMAN's shell for one provision run; never wrangler vars, never git, never chat |
 | `odla_sk_…` (tenant db key) | wrangler secret `ODLA_API_KEY` + `.odla/credentials.local.json` (0600) + `.dev.vars` | present when db is enabled; move it only with the pipeline below |
 | `odla_dev_…` (developer token) | `.odla/dev-token.json` (0600) | ~24h lifetime, provision-time only; never deployed |
@@ -42,6 +42,20 @@ Manual fallback (identical mechanics, if the CLI is unavailable):
 (For prod, use `c.envs.prod.dbKey` and drop `--env` — the top-level
 wrangler env is prod.)
 
+## Moving a tenant-vault secret (never through the transcript)
+
+`secrets set` fills the same write-only vault slot as Studio's Secrets panel,
+reading the value only from stdin or a named env var — never argv — so a
+producer command pipes straight into the vault:
+
+    <command that prints the value> | npx @odla-ai/cli secrets set clerk_webhook_secret --env dev --stdin
+    npx @odla-ai/cli secrets set-clerk-key --env dev --from-env CLERK_SECRET_KEY
+
+The value cannot be read back by the CLI, Studio, or the developer token —
+only by that tenant's app API key (reserved `$` secrets not even then). Studio
+remains the fallback when no producer command exists (a human copies from the
+Clerk dashboard between two browser tabs). Prod-named envs require `--yes`.
+
 ## Standing rules
 
 - Never `cat`, `head`, `grep -v`, or otherwise display `.dev.vars`,