@odla-ai/cli 0.1.0

package/dist/index.cjs

@@ -0,0 +1,863 @@
+#!/usr/bin/env node
+"use strict";
+var __create = Object.create;
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __getProtoOf = Object.getPrototypeOf;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(
+  // If the importer is in node compatibility mode or this is not an ESM
+  // file that has been converted to a CommonJS file using a Babel-
+  // compatible transform (i.e. "__esModule" has not been set), then set
+  // "default" to the CommonJS "module.exports" for node compatibility.
+  isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,
+  mod
+));
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+
+// src/index.ts
+var index_exports = {};
+__export(index_exports, {
+  doctor: () => doctor,
+  initProject: () => initProject,
+  provision: () => provision,
+  runCli: () => runCli,
+  smoke: () => smoke
+});
+module.exports = __toCommonJS(index_exports);
+
+// ../../node_modules/tsup/assets/cjs_shims.js
+var getImportMetaUrl = () => typeof document === "undefined" ? new URL(`file:${__filename}`).href : document.currentScript && document.currentScript.tagName.toUpperCase() === "SCRIPT" ? document.currentScript.src : new URL("main.js", document.baseURI).href;
+var importMetaUrl = /* @__PURE__ */ getImportMetaUrl();
+
+// src/cli.ts
+var import_node_fs4 = require("fs");
+
+// src/config.ts
+var import_node_fs = require("fs");
+var import_node_path = require("path");
+var import_node_url = require("url");
+var DEFAULT_PLATFORM = "https://odla.ai";
+var DEFAULT_ENVS = ["prod", "dev"];
+var DEFAULT_SERVICES = ["db", "ai"];
+async function loadProjectConfig(configPath = "odla.config.mjs") {
+  const resolved = (0, import_node_path.resolve)(configPath);
+  if (!(0, import_node_fs.existsSync)(resolved)) {
+    throw new Error(`config not found: ${configPath}. Run "odla-ai init" first or pass --config.`);
+  }
+  const raw = await loadConfigModule(resolved);
+  const rootDir = (0, import_node_path.dirname)(resolved);
+  validateRawConfig(raw, resolved);
+  const platformUrl = trimSlash(process.env.ODLA_PLATFORM_URL || raw.platformUrl || DEFAULT_PLATFORM);
+  const dbEndpoint = trimSlash(process.env.ODLA_DB_ENDPOINT || raw.dbEndpoint || platformUrl);
+  const envs = unique(raw.envs?.length ? raw.envs : DEFAULT_ENVS);
+  const services = unique(raw.services?.length ? raw.services : DEFAULT_SERVICES);
+  const local = {
+    tokenFile: (0, import_node_path.resolve)(rootDir, raw.local?.tokenFile ?? ".odla/dev-token.json"),
+    credentialsFile: (0, import_node_path.resolve)(rootDir, raw.local?.credentialsFile ?? ".odla/credentials.local.json"),
+    devVarsFile: (0, import_node_path.resolve)(rootDir, raw.local?.devVarsFile ?? ".dev.vars"),
+    gitignore: raw.local?.gitignore ?? true
+  };
+  return {
+    ...raw,
+    configPath: resolved,
+    rootDir,
+    platformUrl,
+    dbEndpoint,
+    envs,
+    services,
+    local
+  };
+}
+async function resolveDataExport(cfg, value, names) {
+  if (value === void 0 || value === null || value === false) return void 0;
+  if (typeof value !== "string") return value;
+  const target = (0, import_node_path.isAbsolute)(value) ? value : (0, import_node_path.resolve)(cfg.rootDir, value);
+  if (target.endsWith(".json")) {
+    return JSON.parse((0, import_node_fs.readFileSync)(target, "utf8"));
+  }
+  const mod = await import((0, import_node_url.pathToFileURL)(target).href);
+  for (const name of names) {
+    if (mod[name] !== void 0) return mod[name];
+  }
+  if (mod.default !== void 0) return mod.default;
+  throw new Error(`${value} did not export ${names.join(", ")} or default`);
+}
+function buildPlan(cfg) {
+  return {
+    appId: cfg.app.id,
+    appName: cfg.app.name,
+    platformUrl: cfg.platformUrl,
+    dbEndpoint: cfg.dbEndpoint,
+    envs: cfg.envs,
+    services: cfg.services,
+    hasSchema: !!cfg.db?.schema,
+    hasRules: !!cfg.db?.rules || !!cfg.db?.schema && cfg.db.defaultRules !== false,
+    aiProvider: cfg.ai?.provider
+  };
+}
+function rulesFromSchema(schema) {
+  const entities = serializedEntities(schema);
+  return Object.fromEntries(
+    entities.map((name) => [name, { view: "false", create: "false", update: "false", delete: "false" }])
+  );
+}
+function serializedEntities(schema) {
+  if (!schema || typeof schema !== "object") return [];
+  const entities = schema.entities;
+  if (!entities || typeof entities !== "object" || Array.isArray(entities)) return [];
+  return Object.keys(entities);
+}
+function envValue(value) {
+  if (!value) return void 0;
+  if (value.startsWith("$")) return process.env[value.slice(1)];
+  return value;
+}
+function validateRawConfig(raw, path) {
+  if (!raw || typeof raw !== "object") throw new Error(`${path} must export an object`);
+  const cfg = raw;
+  if (!cfg.app || typeof cfg.app !== "object") throw new Error(`${path}: missing app object`);
+  if (!validId(cfg.app.id)) throw new Error(`${path}: app.id must be lowercase letters, numbers, and hyphens`);
+  if (!cfg.app.name || typeof cfg.app.name !== "string") throw new Error(`${path}: app.name is required`);
+  if (cfg.envs?.some((env) => !validId(env))) throw new Error(`${path}: env names must be lowercase letters, numbers, and hyphens`);
+}
+function validId(value) {
+  return typeof value === "string" && /^[a-z0-9][a-z0-9-]*$/.test(value);
+}
+async function loadConfigModule(path) {
+  if (path.endsWith(".json")) return JSON.parse((0, import_node_fs.readFileSync)(path, "utf8"));
+  const mod = await import(`${(0, import_node_url.pathToFileURL)(path).href}?t=${Date.now()}`);
+  const value = mod.default ?? mod.config;
+  if (typeof value === "function") return await value();
+  return value;
+}
+function trimSlash(value) {
+  return value.replace(/\/+$/, "");
+}
+function unique(values) {
+  return [...new Set(values.filter(Boolean))];
+}
+
+// src/doctor.ts
+async function doctor(options) {
+  const out = options.stdout ?? console;
+  const cfg = await loadProjectConfig(options.configPath);
+  const plan = buildPlan(cfg);
+  const schema = await resolveDataExport(cfg, cfg.db?.schema, ["schema", "SCHEMA"]);
+  const configuredRules = await resolveDataExport(cfg, cfg.db?.rules, ["rules", "RULES"]);
+  const rules = configuredRules ?? (schema && cfg.db?.defaultRules !== false ? rulesFromSchema(schema) : void 0);
+  const entities = serializedEntities(schema);
+  out.log(`config: ${cfg.configPath}`);
+  out.log(`app:    ${plan.appName} (${plan.appId})`);
+  out.log(`envs:   ${plan.envs.join(", ")}`);
+  out.log(`svc:    ${plan.services.join(", ")}`);
+  out.log(`schema: ${schema ? `${entities.length} entities` : "none"}`);
+  out.log(`rules:  ${rules ? `${Object.keys(rules).length} namespaces` : "none"}`);
+  out.log(`ai:     ${cfg.ai?.provider ?? "not configured"}`);
+  const warnings = [];
+  if (schema && entities.length === 0) warnings.push("schema has no entities");
+  if (rules) {
+    for (const ns of Object.keys(rules)) {
+      if (entities.length > 0 && !entities.includes(ns)) warnings.push(`rules include "${ns}" but schema has no matching entity`);
+    }
+  }
+  if (cfg.services.includes("ai") && !cfg.ai?.provider) warnings.push("ai service is enabled but ai.provider is not set");
+  if (cfg.auth?.clerk) {
+    for (const [env, value] of Object.entries(cfg.auth.clerk)) {
+      if (typeof value === "string" && value.startsWith("$") && !process.env[value.slice(1)]) {
+        warnings.push(`auth.clerk.${env} references unset env var ${value}`);
+      }
+    }
+  }
+  if (cfg.ai?.keyEnv && !process.env[cfg.ai.keyEnv]) warnings.push(`${cfg.ai.keyEnv} is not set; provision will skip provider key storage`);
+  if (warnings.length) {
+    out.log("");
+    out.log("warnings:");
+    for (const warning of warnings) out.log(`  - ${warning}`);
+  } else {
+    out.log("ok");
+  }
+}
+
+// src/init.ts
+var import_node_fs3 = require("fs");
+var import_node_path3 = require("path");
+
+// src/local.ts
+var import_node_fs2 = require("fs");
+var import_node_path2 = require("path");
+var GITIGNORE_LINES = [".odla/*.local.json", ".odla/dev-token.json", ".dev.vars"];
+function readJsonFile(path) {
+  try {
+    return JSON.parse((0, import_node_fs2.readFileSync)(path, "utf8"));
+  } catch {
+    return null;
+  }
+}
+function writePrivateJson(path, value) {
+  (0, import_node_fs2.mkdirSync)((0, import_node_path2.dirname)(path), { recursive: true });
+  (0, import_node_fs2.writeFileSync)(path, `${JSON.stringify(value, null, 2)}
+`);
+  (0, import_node_fs2.chmodSync)(path, 384);
+}
+function readCredentials(path) {
+  return readJsonFile(path);
+}
+function mergeCredential(current, update) {
+  const next = current ?? {
+    appId: update.appId,
+    platformUrl: update.platformUrl,
+    dbEndpoint: update.dbEndpoint,
+    updatedAt: (/* @__PURE__ */ new Date(0)).toISOString(),
+    envs: {}
+  };
+  next.appId = update.appId;
+  next.platformUrl = update.platformUrl;
+  next.dbEndpoint = update.dbEndpoint;
+  next.updatedAt = (/* @__PURE__ */ new Date()).toISOString();
+  next.envs[update.env] = {
+    ...next.envs[update.env] ?? {},
+    tenantId: update.tenantId,
+    ...update.dbKey ? { dbKey: update.dbKey } : {}
+  };
+  return next;
+}
+function ensureGitignore(rootDir) {
+  const path = (0, import_node_path2.resolve)(rootDir, ".gitignore");
+  const existing = (0, import_node_fs2.existsSync)(path) ? (0, import_node_fs2.readFileSync)(path, "utf8") : "";
+  const missing = GITIGNORE_LINES.filter((line) => !existing.split(/\r?\n/).includes(line));
+  if (missing.length === 0) return;
+  const prefix = existing && !existing.endsWith("\n") ? "\n" : "";
+  (0, import_node_fs2.writeFileSync)(path, `${existing}${prefix}${missing.join("\n")}
+`);
+}
+function writeDevVars(path, credentials, env) {
+  const entry = credentials.envs[env];
+  if (!entry?.dbKey) throw new Error(`no db key for env "${env}" in ${path}`);
+  const lines = [
+    `ODLA_PLATFORM="${credentials.platformUrl}"`,
+    `ODLA_ENDPOINT="${credentials.dbEndpoint}"`,
+    `ODLA_APP_ID="${credentials.appId}"`,
+    `ODLA_ENV="${env}"`,
+    `ODLA_TENANT="${entry.tenantId}"`,
+    `ODLA_API_KEY="${entry.dbKey}"`
+  ];
+  (0, import_node_fs2.mkdirSync)((0, import_node_path2.dirname)(path), { recursive: true });
+  (0, import_node_fs2.writeFileSync)(path, `${lines.join("\n")}
+`);
+  (0, import_node_fs2.chmodSync)(path, 384);
+}
+function displayPath(path, rootDir = process.cwd()) {
+  const rel = (0, import_node_path2.relative)(rootDir, path);
+  return rel && !rel.startsWith("..") ? rel : path;
+}
+
+// src/init.ts
+function initProject(options) {
+  const out = options.stdout ?? console;
+  const rootDir = (0, import_node_path3.resolve)(options.rootDir ?? process.cwd());
+  const configPath = (0, import_node_path3.resolve)(rootDir, options.configPath ?? "odla.config.mjs");
+  if ((0, import_node_fs3.existsSync)(configPath) && !options.force) {
+    throw new Error(`${configPath} already exists. Pass --force to overwrite.`);
+  }
+  if (!/^[a-z0-9][a-z0-9-]*$/.test(options.appId)) {
+    throw new Error("--app-id must be lowercase letters, numbers, and hyphens");
+  }
+  const envs = options.envs?.length ? options.envs : ["prod", "dev"];
+  const services = options.services?.length ? options.services : ["db", "ai"];
+  const aiProvider = options.aiProvider ?? "anthropic";
+  (0, import_node_fs3.mkdirSync)((0, import_node_path3.dirname)(configPath), { recursive: true });
+  (0, import_node_fs3.mkdirSync)((0, import_node_path3.resolve)(rootDir, "src/odla"), { recursive: true });
+  (0, import_node_fs3.mkdirSync)((0, import_node_path3.resolve)(rootDir, ".odla"), { recursive: true });
+  (0, import_node_fs3.writeFileSync)(configPath, configTemplate({ appId: options.appId, name: options.name, envs, services, aiProvider }));
+  writeIfMissing((0, import_node_path3.resolve)(rootDir, "src/odla/schema.mjs"), schemaTemplate());
+  writeIfMissing((0, import_node_path3.resolve)(rootDir, "src/odla/rules.mjs"), rulesTemplate());
+  ensureGitignore(rootDir);
+  out.log(`created ${relativeDisplay(configPath, rootDir)}`);
+  out.log("created src/odla/schema.mjs and src/odla/rules.mjs");
+  out.log("updated .gitignore for local odla credentials");
+}
+function writeIfMissing(path, text) {
+  if ((0, import_node_fs3.existsSync)(path)) return;
+  (0, import_node_fs3.writeFileSync)(path, text);
+}
+function configTemplate(input) {
+  return `export default {
+  platformUrl: process.env.ODLA_PLATFORM_URL ?? "https://odla.ai",
+  dbEndpoint: process.env.ODLA_ENDPOINT ?? process.env.ODLA_DB_ENDPOINT ?? "https://db.odla.ai",
+  app: {
+    id: "${input.appId}",
+    name: "${input.name.replace(/"/g, '\\"')}",
+  },
+  envs: ${JSON.stringify(input.envs)},
+  services: ${JSON.stringify(input.services)},
+  db: {
+    schema: "./src/odla/schema.mjs",
+    rules: "./src/odla/rules.mjs",
+    // When rules is omitted, the CLI generates deny-all rules from schema.
+    defaultRules: "deny",
+  },
+  ai: {
+    provider: process.env.ODLA_AI_PROVIDER ?? "${input.aiProvider}",
+    // Optional: set this env var while running provision to store the provider
+    // key in the platform vault for each tenant.
+    keyEnv: "${defaultKeyEnv(input.aiProvider)}",
+  },
+  auth: {
+    clerk: {
+      // dev: "$CLERK_PUBLISHABLE_KEY",
+      // prod: "$CLERK_PUBLISHABLE_KEY",
+    },
+  },
+  links: {
+    // dev: "https://dev.example.com",
+    // prod: "https://example.com",
+  },
+  local: {
+    tokenFile: ".odla/dev-token.json",
+    credentialsFile: ".odla/credentials.local.json",
+    devVarsFile: ".dev.vars",
+  },
+};
+`;
+}
+function schemaTemplate() {
+  return `// Replace this starter schema with your app's odla-db schema.
+// Knowledge-graph projects can export @odla-ai/kg's toSerializedSchema(ontology).
+export const schema = {
+  entities: {
+    notes: {
+      attrs: {
+        id: { type: "string", unique: true, indexed: true, optional: false },
+        text: { type: "string", unique: false, indexed: false, optional: false },
+        createdAt: { type: "number", unique: false, indexed: true, optional: false },
+      },
+    },
+  },
+  links: {},
+};
+`;
+}
+function rulesTemplate() {
+  return `// odla-db is default-deny. The starter keeps runtime data backend-only.
+export const rules = {
+  notes: {
+    view: "false",
+    create: "false",
+    update: "false",
+    delete: "false",
+  },
+};
+`;
+}
+function defaultKeyEnv(provider) {
+  if (provider === "openai") return "OPENAI_API_KEY";
+  if (provider === "google") return "GOOGLE_API_KEY";
+  return "ANTHROPIC_API_KEY";
+}
+function relativeDisplay(path, rootDir) {
+  return path.startsWith(rootDir) ? path.slice(rootDir.length + 1) : path;
+}
+
+// src/provision.ts
+var import_apps = require("@odla-ai/apps");
+var import_ai = require("@odla-ai/ai");
+var import_node_path4 = require("path");
+var import_node_process3 = __toESM(require("process"), 1);
+
+// src/token.ts
+var import_db = require("@odla-ai/db");
+var import_node_process2 = __toESM(require("process"), 1);
+
+// src/open.ts
+var import_node_child_process = require("child_process");
+var import_node_process = __toESM(require("process"), 1);
+async function openUrl(url, options = {}) {
+  const command = openerFor(options.platform ?? import_node_process.default.platform);
+  const doSpawn = options.spawnImpl ?? import_node_child_process.spawn;
+  await new Promise((resolve5, reject) => {
+    const child = doSpawn(command.cmd, [...command.args, url], {
+      stdio: "ignore",
+      detached: true
+    });
+    child.once("error", reject);
+    child.once("spawn", () => {
+      child.unref();
+      resolve5();
+    });
+  });
+}
+function openerFor(platform) {
+  if (platform === "darwin") return { cmd: "open", args: [] };
+  if (platform === "win32") return { cmd: "cmd", args: ["/c", "start", ""] };
+  return { cmd: "xdg-open", args: [] };
+}
+
+// src/token.ts
+async function getDeveloperToken(cfg, options, doFetch, out) {
+  if (options.token) return options.token;
+  if (import_node_process2.default.env.ODLA_DEV_TOKEN) return import_node_process2.default.env.ODLA_DEV_TOKEN;
+  const cached = readJsonFile(cfg.local.tokenFile);
+  if (cached?.token && (cached.expiresAt ?? 0) > Date.now() + 6e4) {
+    out.log(`auth: using cached developer token (${displayPath(cfg.local.tokenFile, cfg.rootDir)})`);
+    return cached.token;
+  }
+  const browser = approvalBrowser(options);
+  const { token, expiresAt } = await (0, import_db.requestToken)({
+    endpoint: cfg.platformUrl,
+    label: `${cfg.app.id} provisioner`,
+    fetch: doFetch,
+    onCode: async ({ userCode, expiresIn }) => {
+      const approvalUrl = handshakeUrl(cfg.platformUrl, userCode);
+      out.log("");
+      out.log(`Approve code ${userCode} at ${approvalUrl} within ${Math.floor(expiresIn / 60)}m.`);
+      if (browser.open) {
+        try {
+          await (options.openApprovalUrl ?? openUrl)(approvalUrl);
+          out.log(`auth: opened browser for approval${browser.mode === "auto" ? " (auto)" : ""}`);
+        } catch (err) {
+          out.log(`auth: could not open browser (${err instanceof Error ? err.message : String(err)})`);
+        }
+      } else if (browser.reason) {
+        out.log(`auth: browser launch skipped (${browser.reason})`);
+      }
+      out.log("");
+    }
+  });
+  writePrivateJson(cfg.local.tokenFile, { token, expiresAt });
+  out.log(`auth: developer token cached (${displayPath(cfg.local.tokenFile, cfg.rootDir)})`);
+  return token;
+}
+function approvalBrowser(options) {
+  if (options.open === true) return { open: true, mode: "forced" };
+  if (options.open === false) return { open: false, reason: "disabled by --no-open" };
+  if (import_node_process2.default.env.CI) return { open: false, reason: "CI environment" };
+  const interactive = options.interactive ?? Boolean(import_node_process2.default.stdin.isTTY && import_node_process2.default.stdout.isTTY);
+  if (!interactive) return { open: false, reason: "non-interactive shell; pass --open to force" };
+  return { open: true, mode: "auto" };
+}
+function handshakeUrl(platformUrl, userCode) {
+  const url = new URL("/handshakes", platformUrl);
+  url.searchParams.set("code", userCode);
+  return url.toString();
+}
+
+// src/provision.ts
+async function provision(options) {
+  const out = options.stdout ?? console;
+  const cfg = await loadProjectConfig(options.configPath);
+  const plan = buildPlan(cfg);
+  out.log(`odla-ai: ${plan.appName} (${plan.appId})`);
+  out.log(`  platform: ${plan.platformUrl}`);
+  out.log(`  db:       ${plan.dbEndpoint}`);
+  out.log(`  envs:     ${plan.envs.join(", ")}`);
+  out.log(`  services: ${plan.services.join(", ")}`);
+  const schema = await resolveDataExport(cfg, cfg.db?.schema, ["schema", "SCHEMA"]);
+  const configuredRules = await resolveDataExport(cfg, cfg.db?.rules, ["rules", "RULES"]);
+  const rules = configuredRules ?? (schema && cfg.db?.defaultRules !== false ? rulesFromSchema(schema) : void 0);
+  if (options.dryRun) {
+    out.log("dry run: no network calls or file writes");
+    out.log(`  schema: ${schema ? "yes" : "no"}`);
+    out.log(`  rules:  ${rules ? Object.keys(rules).length : 0} namespaces`);
+    out.log(`  ai:     ${cfg.ai?.provider ?? "not configured"}`);
+    return;
+  }
+  const doFetch = options.fetch ?? fetch;
+  const token = await getDeveloperToken(cfg, options, doFetch, out);
+  const auth = { authorization: `Bearer ${token}`, "content-type": "application/json" };
+  const apps = (0, import_apps.createAppsClient)({ endpoint: cfg.platformUrl, token, fetcher: { fetch: doFetch } });
+  const existing = await readRegistryApp(cfg, token, doFetch);
+  if (existing) {
+    out.log(`app: ${cfg.app.id} already exists`);
+  } else {
+    await apps.createApp({ name: cfg.app.name, appId: cfg.app.id });
+    out.log(`app: created ${cfg.app.id}`);
+  }
+  for (const env of cfg.envs) {
+    for (const service of cfg.services) {
+      if (service === "ai") {
+        if (cfg.ai?.provider) {
+          await apps.setAi(cfg.app.id, env, { provider: cfg.ai.provider, ...cfg.ai.model ? { model: cfg.ai.model } : {} });
+          out.log(`${env}: ai configured (${cfg.ai.provider}${cfg.ai.model ? `/${cfg.ai.model}` : ""})`);
+        } else {
+          await apps.setService(cfg.app.id, "ai", true, { env });
+          out.log(`${env}: ai enabled`);
+        }
+      } else {
+        await apps.setService(cfg.app.id, service, true, { env });
+        out.log(`${env}: ${service} enabled`);
+      }
+    }
+    const authConfig = normalizeClerkConfig(cfg.auth?.clerk?.[env]);
+    if (authConfig?.publishableKey) {
+      await apps.setAuth(cfg.app.id, env, authConfig);
+      out.log(`${env}: auth configured (clerk ${authConfig.mode ?? "client"})`);
+    }
+    const link = cfg.links?.[env];
+    if (link !== void 0) {
+      await apps.setLink(cfg.app.id, env, link ?? null);
+      out.log(`${env}: link ${link ? "set" : "cleared"}`);
+    }
+  }
+  let credentials = readCredentials(cfg.local.credentialsFile);
+  for (const env of cfg.envs) {
+    const tenantId = (0, import_apps.tenantIdFor)(cfg.app.id, env);
+    let dbKey = !options.rotateKeys ? credentials?.envs[env]?.dbKey : void 0;
+    if (dbKey) {
+      out.log(`${env}: reusing local db key for ${tenantId}`);
+    } else {
+      dbKey = await mintDbKey({ cfg, tenantId, env, token, auth, fetch: doFetch });
+      out.log(`${env}: minted db key for ${tenantId}`);
+    }
+    if (schema) {
+      await postJson(doFetch, `${cfg.dbEndpoint}/app/${encodeURIComponent(tenantId)}/schema`, dbKey, { schema });
+      out.log(`${env}: schema pushed`);
+    }
+    if (rules) {
+      await postJson(doFetch, `${cfg.dbEndpoint}/app/${encodeURIComponent(tenantId)}/admin/rules`, token, rules);
+      out.log(`${env}: rules pushed (${Object.keys(rules).length} namespaces)`);
+    }
+    if (cfg.ai?.provider && cfg.ai.keyEnv) {
+      const key = import_node_process3.default.env[cfg.ai.keyEnv];
+      if (key) {
+        const secretName = cfg.ai.secretName ?? defaultSecretName(cfg.ai.provider);
+        await (0, import_ai.putSecret)({ endpoint: cfg.dbEndpoint, token, fetch: doFetch }, tenantId, secretName, key);
+        out.log(`${env}: ${cfg.ai.provider} key stored in vault (${secretName})`);
+      } else {
+        out.log(`${env}: ${cfg.ai.keyEnv} not set; skipped provider key storage`);
+      }
+    }
+    credentials = mergeCredential(credentials, {
+      appId: cfg.app.id,
+      platformUrl: cfg.platformUrl,
+      dbEndpoint: cfg.dbEndpoint,
+      env,
+      tenantId,
+      dbKey
+    });
+  }
+  if (cfg.local.gitignore) ensureGitignore(cfg.rootDir);
+  if (options.writeCredentials !== false && credentials) {
+    writePrivateJson(cfg.local.credentialsFile, credentials);
+    out.log(`credentials: wrote ${displayPath(cfg.local.credentialsFile, cfg.rootDir)} (0600, gitignored)`);
+  }
+  const devVarsTarget = resolveWriteDevVarsTarget(cfg, options.writeDevVars);
+  if (devVarsTarget && credentials) {
+    const env = cfg.envs.includes("dev") ? "dev" : cfg.envs[0] ?? "prod";
+    writeDevVars(devVarsTarget, credentials, env);
+    out.log(`dev vars: wrote ${displayPath(devVarsTarget, cfg.rootDir)} for ${env}`);
+  }
+}
+async function readRegistryApp(cfg, token, doFetch) {
+  const res = await doFetch(`${cfg.platformUrl}/registry/apps/${encodeURIComponent(cfg.app.id)}`, {
+    headers: { authorization: `Bearer ${token}` }
+  });
+  if (res.status === 404) return null;
+  if (!res.ok) return null;
+  const json = await res.json();
+  return json.app ?? null;
+}
+async function mintDbKey(opts) {
+  let res = await opts.fetch(`${opts.cfg.dbEndpoint}/admin/apps/${encodeURIComponent(opts.tenantId)}/keys`, {
+    method: "POST",
+    headers: opts.auth,
+    body: "{}"
+  });
+  if (res.status === 404) {
+    const created = await opts.fetch(`${opts.cfg.dbEndpoint}/admin/apps`, {
+      method: "POST",
+      headers: opts.auth,
+      body: JSON.stringify({
+        name: opts.env === "prod" ? opts.cfg.app.name : `${opts.cfg.app.name} (${opts.env})`,
+        appId: opts.tenantId
+      })
+    });
+    if (!created.ok) throw new Error(`db app create (${opts.tenantId}) failed: ${created.status} ${await safeText(created)}`);
+    res = await opts.fetch(`${opts.cfg.dbEndpoint}/admin/apps/${encodeURIComponent(opts.tenantId)}/keys`, {
+      method: "POST",
+      headers: opts.auth,
+      body: "{}"
+    });
+  }
+  if (!res.ok) throw new Error(`db key mint (${opts.tenantId}) failed: ${res.status} ${await safeText(res)}`);
+  const body = await res.json();
+  if (!body.key) throw new Error(`db key mint (${opts.tenantId}) returned no key`);
+  return body.key;
+}
+async function postJson(doFetch, url, bearer, body) {
+  const res = await doFetch(url, {
+    method: "POST",
+    headers: { authorization: `Bearer ${bearer}`, "content-type": "application/json" },
+    body: JSON.stringify(body)
+  });
+  if (!res.ok) throw new Error(`${new URL(url).pathname} failed: ${res.status} ${await safeText(res)}`);
+}
+function normalizeClerkConfig(value) {
+  if (!value) return null;
+  if (typeof value === "string") {
+    const publishableKey2 = envValue(value);
+    return publishableKey2 ? { publishableKey: publishableKey2 } : null;
+  }
+  if (typeof value !== "object") return null;
+  const cfg = value;
+  const publishableKey = envValue(cfg.publishableKey);
+  return publishableKey ? { publishableKey, ...cfg.audience ? { audience: cfg.audience } : {}, ...cfg.mode ? { mode: cfg.mode } : {} } : null;
+}
+function defaultSecretName(provider) {
+  const names = import_ai.DEFAULT_SECRET_NAMES;
+  return names[provider] ?? `${provider}_api_key`;
+}
+function resolveWriteDevVarsTarget(cfg, requested) {
+  if (!requested) return null;
+  if (requested === true) return cfg.local.devVarsFile;
+  return (0, import_node_path4.resolve)((0, import_node_path4.dirname)(cfg.configPath), requested);
+}
+async function safeText(res) {
+  try {
+    return redact((await res.text()).slice(0, 500));
+  } catch {
+    return "";
+  }
+}
+function redact(value) {
+  return value.replace(/odla_(sk|dev)_[A-Za-z0-9._-]+/g, "odla_$1_[redacted]").replace(/sk-[A-Za-z0-9._-]+/g, "sk-[redacted]");
+}
+
+// src/smoke.ts
+async function smoke(options) {
+  const out = options.stdout ?? console;
+  const cfg = await loadProjectConfig(options.configPath);
+  const env = options.env ?? (cfg.envs.includes("dev") ? "dev" : cfg.envs[0] ?? "prod");
+  if (!cfg.envs.includes(env)) throw new Error(`env "${env}" is not declared in ${displayPath(cfg.configPath, cfg.rootDir)}`);
+  const credentials = readCredentials(cfg.local.credentialsFile);
+  if (!credentials) {
+    throw new Error(`local credentials missing: ${displayPath(cfg.local.credentialsFile, cfg.rootDir)}. Run "odla-ai provision --write-dev-vars".`);
+  }
+  if (credentials.appId !== cfg.app.id) {
+    throw new Error(`local credentials are for app "${credentials.appId}", but config app is "${cfg.app.id}"`);
+  }
+  const entry = credentials.envs[env];
+  if (!entry?.tenantId || !entry.dbKey) {
+    throw new Error(`local credentials have no db key for env "${env}". Run "odla-ai provision --write-dev-vars".`);
+  }
+  const doFetch = options.fetch ?? fetch;
+  out.log(`smoke: ${cfg.app.id}/${env}`);
+  out.log(`  tenant: ${entry.tenantId}`);
+  const publicConfig = await getJson(doFetch, publicConfigUrl(cfg.platformUrl, cfg.app.id, env), void 0);
+  out.log(`  public-config: ok`);
+  if (cfg.ai?.provider) {
+    const provider = publicConfig.ai?.provider ?? null;
+    if (provider !== cfg.ai.provider) {
+      throw new Error(`ai provider mismatch: expected "${cfg.ai.provider}", public-config has "${provider ?? "none"}"`);
+    }
+    out.log(`  ai: ${provider}`);
+  }
+  const expectedSchema = await resolveDataExport(cfg, cfg.db?.schema, ["schema", "SCHEMA"]);
+  const expectedEntities = serializedEntities(expectedSchema);
+  const liveSchemaPayload = await getJson(doFetch, `${cfg.dbEndpoint}/app/${encodeURIComponent(entry.tenantId)}/schema`, entry.dbKey);
+  const liveSchema = liveSchemaPayload.schema ?? liveSchemaPayload;
+  const liveEntities = serializedEntities(liveSchema);
+  if (expectedEntities.length) {
+    const missing = expectedEntities.filter((entity) => !liveEntities.includes(entity));
+    if (missing.length) throw new Error(`live schema is missing expected entities: ${missing.join(", ")}`);
+  }
+  out.log(`  schema: ${liveEntities.length} entities`);
+  const aggregateEntity = expectedEntities[0] ?? liveEntities[0];
+  if (aggregateEntity) {
+    const aggregate = await postJson2(doFetch, `${cfg.dbEndpoint}/app/${encodeURIComponent(entry.tenantId)}/aggregate`, entry.dbKey, {
+      ns: aggregateEntity,
+      aggregate: { count: true }
+    });
+    const count = aggregate.aggregate?.count;
+    out.log(`  aggregate: ${aggregateEntity}.count=${String(count ?? "ok")}`);
+  } else {
+    out.log(`  aggregate: skipped (schema has no entities)`);
+  }
+  out.log("ok");
+}
+async function getJson(doFetch, url, bearer) {
+  const res = await doFetch(url, {
+    headers: bearer ? { authorization: `Bearer ${bearer}` } : void 0
+  });
+  if (!res.ok) throw new Error(`${new URL(url).pathname} returned ${res.status}: ${await safeText2(res)}`);
+  return res.json();
+}
+async function postJson2(doFetch, url, bearer, body) {
+  const res = await doFetch(url, {
+    method: "POST",
+    headers: { authorization: `Bearer ${bearer}`, "content-type": "application/json" },
+    body: JSON.stringify(body)
+  });
+  if (!res.ok) throw new Error(`${new URL(url).pathname} returned ${res.status}: ${await safeText2(res)}`);
+  return res.json();
+}
+function publicConfigUrl(platformUrl, appId, env) {
+  const url = new URL(`/registry/apps/${encodeURIComponent(appId)}/public-config`, platformUrl);
+  url.searchParams.set("env", env);
+  return url.toString();
+}
+async function safeText2(res) {
+  try {
+    return (await res.text()).slice(0, 500);
+  } catch {
+    return "";
+  }
+}
+
+// src/cli.ts
+async function runCli(argv = process.argv.slice(2)) {
+  const parsed = parseArgv(argv);
+  const command = parsed.positionals[0] ?? "help";
+  if (command === "version" || command === "-v" || parsed.options.version === true) {
+    console.log(cliVersion());
+    return;
+  }
+  if (command === "help" || command === "--help" || command === "-h") {
+    printHelp();
+    return;
+  }
+  if (command === "init") {
+    initProject({
+      appId: requiredString(parsed.options["app-id"], "--app-id"),
+      name: requiredString(parsed.options.name, "--name"),
+      configPath: stringOpt(parsed.options.config),
+      envs: listOpt(parsed.options.env),
+      services: listOpt(parsed.options.services),
+      aiProvider: stringOpt(parsed.options["ai-provider"]),
+      force: parsed.options.force === true
+    });
+    return;
+  }
+  if (command === "doctor") {
+    await doctor({ configPath: stringOpt(parsed.options.config) ?? "odla.config.mjs" });
+    return;
+  }
+  if (command === "provision") {
+    const writeDevVars2 = parsed.options["write-dev-vars"];
+    const opts = {
+      configPath: stringOpt(parsed.options.config) ?? "odla.config.mjs",
+      dryRun: parsed.options["dry-run"] === true,
+      rotateKeys: parsed.options["rotate-keys"] === true,
+      writeCredentials: parsed.options["write-credentials"] !== false,
+      writeDevVars: typeof writeDevVars2 === "string" ? writeDevVars2 : writeDevVars2 === true,
+      token: stringOpt(parsed.options.token),
+      open: parsed.options.open === false ? false : parsed.options.open === true ? true : void 0,
+      yes: parsed.options.yes === true
+    };
+    await provision(opts);
+    return;
+  }
+  if (command === "smoke") {
+    await smoke({
+      configPath: stringOpt(parsed.options.config) ?? "odla.config.mjs",
+      env: stringOpt(parsed.options.env)
+    });
+    return;
+  }
+  throw new Error(`unknown command "${command}". Run "odla-ai help".`);
+}
+function parseArgv(argv) {
+  const positionals = [];
+  const options = {};
+  for (let i = 0; i < argv.length; i++) {
+    const arg = argv[i];
+    if (!arg.startsWith("--")) {
+      positionals.push(arg);
+      continue;
+    }
+    const eq = arg.indexOf("=");
+    const rawName = arg.slice(2, eq === -1 ? void 0 : eq);
+    if (!rawName) continue;
+    if (rawName.startsWith("no-")) {
+      options[rawName.slice(3)] = false;
+      continue;
+    }
+    if (eq !== -1) {
+      addOption(options, rawName, arg.slice(eq + 1));
+      continue;
+    }
+    const value = argv[i + 1];
+    if (value !== void 0 && !value.startsWith("--")) {
+      i++;
+      addOption(options, rawName, value);
+    } else {
+      addOption(options, rawName, true);
+    }
+  }
+  return { positionals, options };
+}
+function addOption(options, name, value) {
+  const cur = options[name];
+  if (cur === void 0) {
+    options[name] = value;
+  } else if (Array.isArray(cur)) {
+    cur.push(String(value));
+  } else {
+    options[name] = [String(cur), String(value)];
+  }
+}
+function requiredString(value, name) {
+  const s = stringOpt(value);
+  if (!s) throw new Error(`${name} is required`);
+  return s;
+}
+function stringOpt(value) {
+  if (typeof value === "string") return value;
+  if (Array.isArray(value)) return value[value.length - 1];
+  return void 0;
+}
+function listOpt(value) {
+  if (value === void 0 || value === false || value === true) return void 0;
+  const values = Array.isArray(value) ? value : [value];
+  return values.flatMap((item) => item.split(",")).map((item) => item.trim()).filter(Boolean);
+}
+function cliVersion() {
+  const pkg = JSON.parse((0, import_node_fs4.readFileSync)(new URL("../package.json", importMetaUrl), "utf8"));
+  return pkg.version ?? "unknown";
+}
+function printHelp() {
+  console.log(`odla-ai
+
+Usage:
+  odla-ai init --app-id <id> --name <name> [--services db,ai] [--env dev --env prod]
+  odla-ai doctor [--config odla.config.mjs]
+  odla-ai provision [--config odla.config.mjs] [--dry-run] [--open|--no-open] [--rotate-keys] [--write-dev-vars[=path]]
+  odla-ai smoke [--config odla.config.mjs] [--env dev]
+  odla-ai version
+
+Commands:
+  init        Create a generic odla.config.mjs plus starter schema/rules files.
+  doctor      Validate and summarize the project config without network calls.
+  provision   Register the app, enable services, push schema/rules, configure AI/auth.
+  smoke       Verify local credentials, public-config, live schema, and db aggregate.
+  version     Print the CLI version.
+
+Safety:
+  Provision caches the approved developer token and local db keys under .odla/
+  with mode 0600, and init adds those paths to .gitignore.
+  Provision opens the approval page automatically in interactive terminals;
+  use --open to force browser launch or --no-open to suppress it.
+`);
+}
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  doctor,
+  initProject,
+  provision,
+  runCli,
+  smoke
+});
+//# sourceMappingURL=index.cjs.map