@odla-ai/cli 0.14.0 → 0.14.1

package/dist/bin.cjs

@@ -4618,7 +4618,7 @@ function hostedSecurityCredential(value) {
 // src/security-hosted-github.ts
 async function connectGitHubSecuritySource(options) {
   const out = options.stdout ?? console;
-  const repository = githubRepositoryName(options.repository);
+  const repository = options.repository === void 0 ? void 0 : githubRepositoryName(options.repository);
   const attempt = await requestHostedSecurityJson(
     options,
     "/registry/github/connect",
@@ -4627,7 +4627,7 @@ async function connectGitHubSecuritySource(options) {
       body: JSON.stringify({
         appId: hostedIdentifier(options.appId, "appId"),
         env: hostedIdentifier(options.env, "env"),
-        repository
+        ...repository === void 0 ? {} : { repository }
       })
     },
     "start GitHub connection"
@@ -5440,7 +5440,7 @@ function relativeDisplay(path, rootDir) {
 }
 
 // src/provision.ts
-var import_apps2 = require("@odla-ai/apps");
+var import_apps3 = require("@odla-ai/apps");
 var import_ai2 = require("@odla-ai/ai");
 var import_node_process7 = __toESM(require("process"), 1);
 
@@ -5593,6 +5593,7 @@ async function safeText3(res) {
 
 // src/provision-helpers.ts
 var import_ai = require("@odla-ai/ai");
+var import_apps2 = require("@odla-ai/apps");
 function serviceRank(service) {
   if (service === "db") return 0;
   if (service === "calendar") return 2;
@@ -5602,6 +5603,54 @@ function defaultSecretName(provider) {
   const names = import_ai.DEFAULT_SECRET_NAMES;
   return names[provider] ?? `${provider}_api_key`;
 }
+async function assertTenantAdminAccess(doFetch, cfg, env, token) {
+  const tenantId = (0, import_apps2.tenantIdFor)(cfg.app.id, env);
+  const res = await doFetch(`${cfg.dbEndpoint}/admin/apps/${encodeURIComponent(tenantId)}/entitlements`, {
+    headers: { authorization: `Bearer ${token}` }
+  });
+  if (res.ok || res.status === 404) return;
+  if (res.status === 403) {
+    throw new Error(
+      `${env}: you are not an owner of "${cfg.app.id}" (tenant ${tenantId}) \u2014 nothing was minted or written; ask an existing owner to run "odla-ai app owners add <your-email>", then re-run provision`
+    );
+  }
+  throw new Error(`${env}: tenant access preflight (${tenantId}) failed: ${res.status} ${await safeText4(res)}`);
+}
+async function readRegistryApp(cfg, token, doFetch) {
+  const res = await doFetch(`${cfg.platformUrl}/registry/apps/${encodeURIComponent(cfg.app.id)}`, {
+    headers: { authorization: `Bearer ${token}` }
+  });
+  if (res.status === 404) return null;
+  if (!res.ok) return null;
+  const json2 = await res.json();
+  return json2.app ?? null;
+}
+async function postJson2(doFetch, url, bearer, body) {
+  const res = await doFetch(url, {
+    method: "POST",
+    headers: { authorization: `Bearer ${bearer}`, "content-type": "application/json" },
+    body: JSON.stringify(body)
+  });
+  if (!res.ok) throw new Error(`${new URL(url).pathname} failed: ${res.status} ${await safeText4(res)}`);
+}
+function normalizeClerkConfig(value) {
+  if (!value) return null;
+  if (typeof value === "string") {
+    const publishableKey2 = envValue(value);
+    return publishableKey2 ? { publishableKey: publishableKey2 } : null;
+  }
+  if (typeof value !== "object") return null;
+  const cfg = value;
+  const publishableKey = envValue(cfg.publishableKey);
+  return publishableKey ? { publishableKey, ...cfg.audience ? { audience: cfg.audience } : {}, ...cfg.mode ? { mode: cfg.mode } : {} } : null;
+}
+async function safeText4(res) {
+  try {
+    return redactSecrets((await res.text()).slice(0, 500));
+  } catch {
+    return "";
+  }
+}
 
 // src/secrets.ts
 var PROD_ENV_NAMES = /* @__PURE__ */ new Set(["prod", "production"]);
@@ -5746,7 +5795,7 @@ async function provision(options) {
   }
   const doFetch = options.fetch ?? fetch;
   const token = await getDeveloperToken(cfg, options, doFetch, out);
-  const apps = (0, import_apps2.createAppsClient)({ endpoint: cfg.platformUrl, token, fetcher: { fetch: doFetch } });
+  const apps = (0, import_apps3.createAppsClient)({ endpoint: cfg.platformUrl, token, fetcher: { fetch: doFetch } });
   const existing = await readRegistryApp(cfg, token, doFetch);
   if (existing) {
     out.log(`app: ${cfg.app.id} already exists`);
@@ -5754,6 +5803,9 @@ async function provision(options) {
     await apps.createApp({ name: cfg.app.name, appId: cfg.app.id });
     out.log(`app: created ${cfg.app.id}`);
   }
+  for (const env of cfg.envs) {
+    await assertTenantAdminAccess(doFetch, cfg, env, token);
+  }
   const serviceOrder = [...cfg.services].sort((a, b) => serviceRank(a) - serviceRank(b));
   for (const env of cfg.envs) {
     for (const service of serviceOrder) {
@@ -5787,7 +5839,7 @@ async function provision(options) {
     }
   }
   for (const env of cfg.envs) {
-    const tenantId = (0, import_apps2.tenantIdFor)(cfg.app.id, env);
+    const tenantId = (0, import_apps3.tenantIdFor)(cfg.app.id, env);
     credentials = await provisionEnvCredentials({
       cfg,
       env,
@@ -5870,45 +5922,10 @@ ${env}: credentials are already saved; retry "odla-ai secrets push --env ${env}$
     }
   }
 }
-async function readRegistryApp(cfg, token, doFetch) {
-  const res = await doFetch(`${cfg.platformUrl}/registry/apps/${encodeURIComponent(cfg.app.id)}`, {
-    headers: { authorization: `Bearer ${token}` }
-  });
-  if (res.status === 404) return null;
-  if (!res.ok) return null;
-  const json2 = await res.json();
-  return json2.app ?? null;
-}
-async function postJson2(doFetch, url, bearer, body) {
-  const res = await doFetch(url, {
-    method: "POST",
-    headers: { authorization: `Bearer ${bearer}`, "content-type": "application/json" },
-    body: JSON.stringify(body)
-  });
-  if (!res.ok) throw new Error(`${new URL(url).pathname} failed: ${res.status} ${await safeText4(res)}`);
-}
-function normalizeClerkConfig(value) {
-  if (!value) return null;
-  if (typeof value === "string") {
-    const publishableKey2 = envValue(value);
-    return publishableKey2 ? { publishableKey: publishableKey2 } : null;
-  }
-  if (typeof value !== "object") return null;
-  const cfg = value;
-  const publishableKey = envValue(cfg.publishableKey);
-  return publishableKey ? { publishableKey, ...cfg.audience ? { audience: cfg.audience } : {}, ...cfg.mode ? { mode: cfg.mode } : {} } : null;
-}
-async function safeText4(res) {
-  try {
-    return redactSecrets((await res.text()).slice(0, 500));
-  } catch {
-    return "";
-  }
-}
 
 // src/secrets-set.ts
 var import_ai3 = require("@odla-ai/ai");
-var import_apps3 = require("@odla-ai/apps");
+var import_apps4 = require("@odla-ai/apps");
 var PROD_ENV_NAMES2 = /* @__PURE__ */ new Set(["prod", "production"]);
 async function secretsSet(options) {
   const name = (options.name ?? "").trim();
@@ -5960,7 +5977,7 @@ async function resolveVaultWrite(options) {
     throw new Error(`refusing to store a secret for "${options.env}" without --yes`);
   }
   const value = await secretInputValue(options, "secret");
-  return { cfg, tenantId: (0, import_apps3.tenantIdFor)(cfg.app.id, options.env), value, doFetch, out };
+  return { cfg, tenantId: (0, import_apps4.tenantIdFor)(cfg.app.id, options.env), value, doFetch, out };
 }
 
 // src/security-command-context.ts
@@ -6601,16 +6618,16 @@ async function githubSecurityCommand(parsed, dependencies) {
   }
   assertArgs(parsed, ["config", "env", "platform", "repo", "email", "open"], 3);
   const context = await hostedSecurityContext(parsed, dependencies);
-  const repository = stringOpt(parsed.options.repo) ?? await inferGitHubRepository(process.cwd(), dependencies.readGitOrigin);
+  const repository = stringOpt(parsed.options.repo) ?? await inferGitHubRepository(process.cwd(), dependencies.readGitOrigin).catch(() => void 0);
   const connection = await connectGitHubSecuritySource({
     ...context,
-    repository,
+    ...repository === void 0 ? {} : { repository },
     open: parsed.options.open !== false,
     openInstallUrl: dependencies.openUrl ?? openUrl,
     wait: dependencies.pollWait,
     stdout: context.stdout
   });
-  context.stdout.log(`github: connected ${connection.repository ?? repository} (${connection.sourceId ?? "source pending"})`);
+  context.stdout.log(`github: connected ${connection.repository ?? repository ?? "app repository"} (${connection.sourceId ?? "source pending"})`);
   context.stdout.log("github: odla.ai stores the installation; no PAT or GitHub token is written locally");
 }
 async function listSecuritySources(parsed, dependencies) {