@odla-ai/cli 0.2.0 → 0.3.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Cory Ondrejka
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -1,5 +1,10 @@
 # @odla-ai/cli
 
+> ⚠️ **Experimental — an agentic-coding experiment.** This package is built and
+> operated by autonomous coding agents as an experiment in agentic loops. APIs
+> change without notice and nothing here is production-hardened. **Use at your
+> own risk.**
+
 Project-neutral provisioning CLI for odla apps. It creates and validates an
 `odla.config.mjs`, then uses that config to register an app, enable services,
 push odla-db schema/rules, configure platform AI, configure Clerk auth, record
@@ -96,7 +101,10 @@ wrangler) and requires `--yes`; every other env maps to wrangler's
 (currently `odla-migrate`, the phased GitHub Pages → odla migration
 procedure) into the project's `.claude/skills/`, or into `~/.claude/skills/`
 with `--global`. Re-runs are idempotent; a locally modified skill file is
-never overwritten without `--force`.
+never overwritten without `--force`. The skill's reference runbook is served
+at <https://odla.ai/llms-migrate.txt>; the human companion — "Moving your site
+to odla" (accounts, the approval code, costs) — lives in the odla docs after
+sign-in.
 
 `doctor` also lints for common footguns: permission rules that are literally
 `"true"` (public writes always warn; a public `view` warns unless the

package/dist/bin.cjs

@@ -146,6 +146,7 @@ var REPLACEMENTS = [
   [/\bsk_(live|test)_[A-Za-z0-9]+/g, "sk_$1_[redacted]"],
   [/\bsk-[A-Za-z0-9._-]+/g, "sk-[redacted]"],
   [/\bwhsec_[A-Za-z0-9+/=]+/g, "whsec_[redacted]"],
+  [/\bo11y_[A-Za-z0-9]+/g, "o11y_[redacted]"],
   [/\b(ghp|gho|github_pat)_[A-Za-z0-9_]+/g, "$1_[redacted]"],
   [/\bAKIA[A-Z0-9]{12,}/g, "AKIA[redacted]"]
 ];
@@ -290,7 +291,7 @@ function wranglerWarnings(rootDir) {
     const vars = block.vars;
     if (vars && typeof vars === "object") {
       for (const [name, value] of Object.entries(vars)) {
-        if (name === "ODLA_API_KEY" || typeof value === "string" && looksSecret(value)) {
+        if (name === "ODLA_API_KEY" || name === "ODLA_O11Y_TOKEN" || typeof value === "string" && looksSecret(value)) {
           warnings.push(`wrangler ${label}vars.${name} looks like a secret \u2014 use "odla-ai secrets push" / wrangler secret put, never vars`);
         }
       }
@@ -310,54 +311,6 @@ function readPackageJson(rootDir) {
   }
 }
 
-// src/doctor.ts
-async function doctor(options) {
-  const out = options.stdout ?? console;
-  const cfg = await loadProjectConfig(options.configPath);
-  const plan = buildPlan(cfg);
-  const schema = await resolveDataExport(cfg, cfg.db?.schema, ["schema", "SCHEMA"]);
-  const configuredRules = await resolveDataExport(cfg, cfg.db?.rules, ["rules", "RULES"]);
-  const rules = configuredRules ?? (schema && cfg.db?.defaultRules !== false ? rulesFromSchema(schema) : void 0);
-  const entities = serializedEntities(schema);
-  out.log(`config: ${cfg.configPath}`);
-  out.log(`app:    ${plan.appName} (${plan.appId})`);
-  out.log(`envs:   ${plan.envs.join(", ")}`);
-  out.log(`svc:    ${plan.services.join(", ")}`);
-  out.log(`schema: ${schema ? `${entities.length} entities` : "none"}`);
-  out.log(`rules:  ${rules ? `${Object.keys(rules).length} namespaces` : "none"}`);
-  out.log(`ai:     ${cfg.ai?.provider ?? "not configured"}`);
-  const warnings = [];
-  if (schema && entities.length === 0) warnings.push("schema has no entities");
-  if (rules) {
-    for (const ns of Object.keys(rules)) {
-      if (entities.length > 0 && !entities.includes(ns)) warnings.push(`rules include "${ns}" but schema has no matching entity`);
-    }
-  }
-  if (cfg.services.includes("ai") && !cfg.ai?.provider) warnings.push("ai service is enabled but ai.provider is not set");
-  if (cfg.auth?.clerk) {
-    for (const [env, value] of Object.entries(cfg.auth.clerk)) {
-      if (typeof value === "string" && value.startsWith("$") && !process.env[value.slice(1)]) {
-        warnings.push(`auth.clerk.${env} references unset env var ${value}`);
-      }
-    }
-  }
-  if (cfg.ai?.keyEnv && !process.env[cfg.ai.keyEnv]) warnings.push(`${cfg.ai.keyEnv} is not set; provision will skip provider key storage`);
-  warnings.push(...lintRules(rules, entities, cfg.db?.publicRead ?? []));
-  warnings.push(...trackedSecretFiles(cfg.rootDir));
-  warnings.push(...wranglerWarnings(cfg.rootDir));
-  if (warnings.length) {
-    out.log("");
-    out.log("warnings:");
-    for (const warning of warnings) out.log(`  - ${warning}`);
-  } else {
-    out.log("ok");
-  }
-}
-
-// src/init.ts
-var import_node_fs5 = require("fs");
-var import_node_path5 = require("path");
-
 // src/local.ts
 var import_node_fs4 = require("fs");
 var import_node_path4 = require("path");
@@ -393,7 +346,8 @@ function mergeCredential(current, update) {
   next.envs[update.env] = {
     ...next.envs[update.env] ?? {},
     tenantId: update.tenantId,
-    ...update.dbKey ? { dbKey: update.dbKey } : {}
+    ...update.dbKey ? { dbKey: update.dbKey } : {},
+    ...update.o11yToken ? { o11yToken: update.o11yToken } : {}
   };
   return next;
 }
@@ -406,7 +360,7 @@ function ensureGitignore(rootDir) {
   (0, import_node_fs4.writeFileSync)(path, `${existing}${prefix}${missing.join("\n")}
 `);
 }
-function writeDevVars(path, credentials, env) {
+function writeDevVars(path, credentials, env, o11y) {
   const entry = credentials.envs[env];
   if (!entry?.dbKey) throw new Error(`no db key for env "${env}" in ${path}`);
   const lines = [
@@ -417,6 +371,11 @@ function writeDevVars(path, credentials, env) {
     `ODLA_TENANT="${entry.tenantId}"`,
     `ODLA_API_KEY="${entry.dbKey}"`
   ];
+  if (o11y) {
+    lines.push(`ODLA_O11Y_ENDPOINT="${o11y.endpoint}"`, `ODLA_O11Y_SERVICE="${o11y.service}"`);
+    if (o11y.version) lines.push(`ODLA_O11Y_VERSION="${o11y.version}"`);
+    if (entry.o11yToken) lines.push(`ODLA_O11Y_TOKEN="${entry.o11yToken}"`);
+  }
   (0, import_node_fs4.mkdirSync)((0, import_node_path4.dirname)(path), { recursive: true });
   (0, import_node_fs4.writeFileSync)(path, `${lines.join("\n")}
 `);
@@ -427,7 +386,61 @@ function displayPath(path, rootDir = process.cwd()) {
   return rel && !rel.startsWith("..") ? rel : path;
 }
 
+// src/doctor.ts
+async function doctor(options) {
+  const out = options.stdout ?? console;
+  const cfg = await loadProjectConfig(options.configPath);
+  const plan = buildPlan(cfg);
+  const schema = await resolveDataExport(cfg, cfg.db?.schema, ["schema", "SCHEMA"]);
+  const configuredRules = await resolveDataExport(cfg, cfg.db?.rules, ["rules", "RULES"]);
+  const rules = configuredRules ?? (schema && cfg.db?.defaultRules !== false ? rulesFromSchema(schema) : void 0);
+  const entities = serializedEntities(schema);
+  out.log(`config: ${cfg.configPath}`);
+  out.log(`app:    ${plan.appName} (${plan.appId})`);
+  out.log(`envs:   ${plan.envs.join(", ")}`);
+  out.log(`svc:    ${plan.services.join(", ")}`);
+  out.log(`schema: ${schema ? `${entities.length} entities` : "none"}`);
+  out.log(`rules:  ${rules ? `${Object.keys(rules).length} namespaces` : "none"}`);
+  out.log(`ai:     ${cfg.ai?.provider ?? "not configured"}`);
+  const warnings = [];
+  if (schema && entities.length === 0) warnings.push("schema has no entities");
+  if (rules) {
+    for (const ns of Object.keys(rules)) {
+      if (entities.length > 0 && !entities.includes(ns)) warnings.push(`rules include "${ns}" but schema has no matching entity`);
+    }
+  }
+  if (cfg.services.includes("ai") && !cfg.ai?.provider) warnings.push("ai service is enabled but ai.provider is not set");
+  if (cfg.auth?.clerk) {
+    for (const [env, value] of Object.entries(cfg.auth.clerk)) {
+      if (typeof value === "string" && value.startsWith("$") && !process.env[value.slice(1)]) {
+        warnings.push(`auth.clerk.${env} references unset env var ${value}`);
+      }
+    }
+  }
+  if (cfg.ai?.keyEnv && !process.env[cfg.ai.keyEnv]) warnings.push(`${cfg.ai.keyEnv} is not set; provision will skip provider key storage`);
+  if (cfg.services.includes("o11y")) {
+    const credentials = readCredentials(cfg.local.credentialsFile);
+    for (const env of cfg.envs) {
+      if (!credentials?.envs[env]?.o11yToken) {
+        warnings.push(`o11y is enabled but env "${env}" has no ingest token \u2014 run "odla-ai provision" to mint one`);
+      }
+    }
+  }
+  warnings.push(...lintRules(rules, entities, cfg.db?.publicRead ?? []));
+  warnings.push(...trackedSecretFiles(cfg.rootDir));
+  warnings.push(...wranglerWarnings(cfg.rootDir));
+  if (warnings.length) {
+    out.log("");
+    out.log("warnings:");
+    for (const warning of warnings) out.log(`  - ${warning}`);
+  } else {
+    out.log("ok");
+  }
+}
+
 // src/init.ts
+var import_node_fs5 = require("fs");
+var import_node_path5 = require("path");
 function initProject(options) {
   const out = options.stdout ?? console;
   const rootDir = (0, import_node_path5.resolve)(options.rootDir ?? process.cwd());
@@ -484,6 +497,12 @@ function configTemplate(input) {
       // prod: "$CLERK_PUBLISHABLE_KEY",
     },
   },
+  // Add "o11y" to services to enable observability; provision then mints the
+  // ingest token and scaffolds the ODLA_O11Y_* vars into .dev.vars.
+  // o11y: {
+  //   service: "${input.appId}",   // defaults to the app id
+  //   // endpoint: "https://o11y.odla.ai",
+  // },
   links: {
     // dev: "https://dev.example.com",
     // prod: "https://example.com",
@@ -684,6 +703,15 @@ async function provision(options) {
       dbKey = await mintDbKey({ cfg, tenantId, env, token, auth, fetch: doFetch });
       out.log(`${env}: minted db key for ${tenantId}`);
     }
+    let o11yToken = cfg.services.includes("o11y") && !options.rotateKeys ? credentials?.envs[env]?.o11yToken : void 0;
+    if (cfg.services.includes("o11y")) {
+      if (o11yToken) {
+        out.log(`${env}: reusing local o11y ingest token`);
+      } else {
+        o11yToken = await mintO11yToken(cfg, env, token, doFetch);
+        out.log(`${env}: minted o11y ingest token`);
+      }
+    }
     if (schema) {
       await postJson(doFetch, `${cfg.dbEndpoint}/app/${encodeURIComponent(tenantId)}/schema`, dbKey, { schema });
       out.log(`${env}: schema pushed`);
@@ -708,7 +736,8 @@ async function provision(options) {
       dbEndpoint: cfg.dbEndpoint,
       env,
       tenantId,
-      dbKey
+      dbKey,
+      ...o11yToken ? { o11yToken } : {}
     });
   }
   if (cfg.local.gitignore) ensureGitignore(cfg.rootDir);
@@ -719,10 +748,18 @@ async function provision(options) {
   const devVarsTarget = resolveWriteDevVarsTarget(cfg, options.writeDevVars);
   if (devVarsTarget && credentials) {
     const env = cfg.envs.includes("dev") ? "dev" : cfg.envs[0] ?? "prod";
-    writeDevVars(devVarsTarget, credentials, env);
+    writeDevVars(devVarsTarget, credentials, env, o11yDevVars(cfg));
     out.log(`dev vars: wrote ${displayPath(devVarsTarget, cfg.rootDir)} for ${env}`);
   }
 }
+function o11yDevVars(cfg) {
+  if (!cfg.services.includes("o11y")) return void 0;
+  return {
+    endpoint: cfg.o11y?.endpoint ?? "https://o11y.odla.ai",
+    service: cfg.o11y?.service ?? cfg.app.id,
+    ...cfg.o11y?.version ? { version: cfg.o11y.version } : {}
+  };
+}
 async function readRegistryApp(cfg, token, doFetch) {
   const res = await doFetch(`${cfg.platformUrl}/registry/apps/${encodeURIComponent(cfg.app.id)}`, {
     headers: { authorization: `Bearer ${token}` }
@@ -759,6 +796,16 @@ async function mintDbKey(opts) {
   if (!body.key) throw new Error(`db key mint (${opts.tenantId}) returned no key`);
   return body.key;
 }
+async function mintO11yToken(cfg, env, token, doFetch) {
+  const res = await doFetch(
+    `${cfg.platformUrl}/o11y/${encodeURIComponent(cfg.app.id)}/token?env=${encodeURIComponent(env)}`,
+    { method: "POST", headers: { authorization: `Bearer ${token}` } }
+  );
+  if (!res.ok) throw new Error(`o11y token mint (${env}) failed: ${res.status} ${await safeText(res)}`);
+  const body = await res.json();
+  if (!body.token) throw new Error(`o11y token mint (${env}) returned no token`);
+  return body.token;
+}
 async function postJson(doFetch, url, bearer, body) {
   const res = await doFetch(url, {
     method: "POST",
@@ -821,19 +868,24 @@ async function secretsPush(options) {
   }
   const wranglerEnv = PROD_ENV_NAMES.has(env) ? void 0 : env;
   const target = wranglerEnv ? `wrangler env "${wranglerEnv}"` : "the top-level (prod) wrangler env";
+  const secrets = [{ name: "ODLA_API_KEY", value: dbKey }];
+  const o11yToken = credentials.envs[env]?.o11yToken;
+  if (o11yToken) secrets.push({ name: "ODLA_O11Y_TOKEN", value: o11yToken });
   if (options.dryRun) {
-    out.log(`dry run: would push ODLA_API_KEY (${redactSecrets(dbKey)}) to ${target}`);
+    for (const s of secrets) out.log(`dry run: would push ${s.name} (${redactSecrets(s.value)}) to ${target}`);
     return;
   }
   const run = options.runner ?? defaultRunner;
   if (!await wranglerLoggedIn(run, cfg.rootDir)) {
     throw new Error(`wrangler is not logged in \u2014 run "wrangler login" (a browser step for the human)`);
   }
-  const result = await wranglerPutSecret(run, { name: "ODLA_API_KEY", value: dbKey, env: wranglerEnv, cwd: cfg.rootDir });
-  if (result.code !== 0) {
-    throw new Error(`wrangler secret put failed (exit ${result.code}): ${redactSecrets(`${result.stderr || result.stdout}`.trim())}`);
+  for (const s of secrets) {
+    const result = await wranglerPutSecret(run, { name: s.name, value: s.value, env: wranglerEnv, cwd: cfg.rootDir });
+    if (result.code !== 0) {
+      throw new Error(`wrangler secret put ${s.name} failed (exit ${result.code}): ${redactSecrets(`${result.stderr || result.stdout}`.trim())}`);
+    }
+    out.log(`${s.name} pushed to ${target} (value read from ${credentialsPath}, never echoed)`);
   }
-  out.log(`ODLA_API_KEY pushed to ${target} (value read from ${credentialsPath}, never echoed)`);
 }
 
 // src/skill.ts