@odla-ai/cli 0.25.19 → 0.25.20

package/README.md

@@ -746,6 +746,12 @@ export default {
 `db.schema` and `db.rules` may be inline objects, JSON files, or JS modules
 exporting `default`, `schema` / `SCHEMA`, or `rules` / `RULES`.
 
+`services` accepts only ids from `@odla-ai/apps`'
+`APP_SERVICE_CATALOG`. The CLI validates the same-environment dependencies
+from that catalog before authentication or mutation; currently `calendar`,
+`chat`, and `kg` require `db`. Application npm integrations remain under
+`integrations`, not `services`.
+
 If schema is present and rules are omitted, `defaultRules: "deny"` generates
 deny-all rules for every schema entity. That is the safe default for Workers
 that mediate reads and writes with an app key.

package/dist/bin.cjs

@@ -968,6 +968,7 @@ var import_node_process8 = __toESM(require("process"), 1);
 var import_node_fs4 = require("fs");
 var import_node_path4 = require("path");
 var import_node_url = require("url");
+var import_apps = require("@odla-ai/apps");
 
 // src/integration-validation.ts
 function validateIntegrations(cfg, path, defaultServices) {
@@ -1055,6 +1056,7 @@ async function loadProjectConfig(configPath = "odla.config.mjs") {
   const dbEndpoint = trimSlash(process.env.ODLA_DB_ENDPOINT || raw.dbEndpoint || platformUrl);
   const envs = unique2(raw.envs?.length ? raw.envs : DEFAULT_ENVS);
   const services = unique2(raw.services?.length ? raw.services : DEFAULT_SERVICES);
+  validateServices(services, resolved);
   validateCalendarConfig(raw, envs, services, resolved);
   const local = {
     tokenFile: (0, import_node_path4.resolve)(rootDir, raw.local?.tokenFile ?? ".odla/dev-token.json"),
@@ -1210,7 +1212,19 @@ function validateCalendarConfig(cfg, envs, services, path) {
       }
     }
   }
-  if (enabled && !services.includes("db")) throw new Error(`${path}: calendar service requires the db service`);
+}
+function validateServices(services, path) {
+  for (const service of services) {
+    const definition = (0, import_apps.appServiceDefinition)(service);
+    if (!definition) {
+      throw new Error(`${path}: unknown service "${service}" (known: ${(0, import_apps.appServiceIds)().join(", ")})`);
+    }
+    for (const dependency of definition.requires) {
+      if (!services.includes(dependency)) {
+        throw new Error(`${path}: ${service} service requires the ${dependency} service`);
+      }
+    }
+  }
 }
 function assertOnly(value, allowed, label) {
   const extra = Object.keys(value).find((key) => !allowed.includes(key));
@@ -1534,7 +1548,7 @@ async function adminCommand(parsed, deps = {}) {
 }
 
 // src/tenant.ts
-var import_apps = require("@odla-ai/apps");
+var import_apps2 = require("@odla-ai/apps");
 function resolveEnv(cfg, requested) {
   const env = requested ?? (cfg.envs.includes("dev") ? "dev" : cfg.envs[0]);
   if (!env || !cfg.envs.includes(env)) {
@@ -1544,7 +1558,7 @@ function resolveEnv(cfg, requested) {
 }
 function resolveTenant(cfg, requested) {
   const env = resolveEnv(cfg, requested);
-  return { env, tenant: (0, import_apps.tenantIdFor)(cfg.app.id, env) };
+  return { env, tenant: (0, import_apps2.tenantIdFor)(cfg.app.id, env) };
 }
 function bothTenants(cfg) {
   for (const env of ["dev", "prod"]) {
@@ -1554,7 +1568,7 @@ function bothTenants(cfg) {
       );
     }
   }
-  return { sandbox: (0, import_apps.tenantIdFor)(cfg.app.id, "dev"), live: (0, import_apps.tenantIdFor)(cfg.app.id, "prod") };
+  return { sandbox: (0, import_apps2.tenantIdFor)(cfg.app.id, "dev"), live: (0, import_apps2.tenantIdFor)(cfg.app.id, "prod") };
 }
 
 // src/agent-command.ts
@@ -3090,6 +3104,7 @@ function harnessOption(value, flag) {
 // src/init.ts
 var import_node_fs11 = require("fs");
 var import_node_path9 = require("path");
+var import_apps3 = require("@odla-ai/apps");
 function initProject(options) {
   const out = options.stdout ?? console;
   const rootDir = (0, import_node_path9.resolve)(options.rootDir ?? process.cwd());
@@ -3102,7 +3117,13 @@ function initProject(options) {
   }
   const envs = options.envs?.length ? options.envs : ["dev"];
   const services = options.services?.length ? options.services : ["db", "ai"];
-  if (services.includes("calendar") && !services.includes("db")) throw new Error("--services calendar requires db");
+  for (const service of services) {
+    const definition = (0, import_apps3.appServiceDefinition)(service);
+    if (!definition) throw new Error(`--services contains unknown service "${service}" (known: ${(0, import_apps3.appServiceIds)().join(", ")})`);
+    for (const dependency of definition.requires) {
+      if (!services.includes(dependency)) throw new Error(`--services ${service} requires ${dependency}`);
+    }
+  }
   const aiProvider = options.aiProvider ?? "anthropic";
   (0, import_node_fs11.mkdirSync)((0, import_node_path9.dirname)(configPath), { recursive: true });
   (0, import_node_fs11.mkdirSync)((0, import_node_path9.resolve)(rootDir, "src/odla"), { recursive: true });
@@ -3292,7 +3313,7 @@ function assertWranglerConfig(cfg) {
 
 // src/secrets-set.ts
 var import_ai = require("@odla-ai/ai");
-var import_apps2 = require("@odla-ai/apps");
+var import_apps4 = require("@odla-ai/apps");
 var PROD_ENV_NAMES2 = /* @__PURE__ */ new Set(["prod", "production"]);
 async function secretsSet(options) {
   const name = (options.name ?? "").trim();
@@ -3344,7 +3365,7 @@ async function resolveVaultWrite(options) {
     throw new Error(`refusing to store a secret for "${options.env}" without --yes`);
   }
   const value = await secretInputValue(options, "secret");
-  return { cfg, tenantId: (0, import_apps2.tenantIdFor)(cfg.app.id, options.env), value, doFetch, out };
+  return { cfg, tenantId: (0, import_apps4.tenantIdFor)(cfg.app.id, options.env), value, doFetch, out };
 }
 
 // src/skill.ts
@@ -8972,7 +8993,7 @@ async function read2(url, headers, doFetch) {
 }
 
 // src/provision.ts
-var import_apps5 = require("@odla-ai/apps");
+var import_apps7 = require("@odla-ai/apps");
 var import_ai3 = require("@odla-ai/ai");
 var import_node_process10 = __toESM(require("process"), 1);
 
@@ -9029,9 +9050,9 @@ async function responseText(res) {
 }
 
 // src/provision-credentials.ts
-var import_apps3 = require("@odla-ai/apps");
+var import_apps5 = require("@odla-ai/apps");
 async function provisionEnvCredentials(opts) {
-  const tenantId = (0, import_apps3.tenantIdFor)(opts.cfg.app.id, opts.env);
+  const tenantId = (0, import_apps5.tenantIdFor)(opts.cfg.app.id, opts.env);
   const prior = opts.credentials?.envs[opts.env];
   let credentials = opts.credentials;
   let dbKey = opts.cfg.services.includes("db") && !opts.rotateDb ? prior?.dbKey : void 0;
@@ -9125,18 +9146,13 @@ async function safeText4(res) {
 
 // src/provision-helpers.ts
 var import_ai2 = require("@odla-ai/ai");
-var import_apps4 = require("@odla-ai/apps");
-function serviceRank(service) {
-  if (service === "db") return 0;
-  if (service === "calendar") return 2;
-  return 1;
-}
+var import_apps6 = require("@odla-ai/apps");
 function defaultSecretName(provider) {
   const names = import_ai2.DEFAULT_SECRET_NAMES;
   return names[provider] ?? `${provider}_api_key`;
 }
 async function assertTenantAdminAccess(doFetch, cfg, env, token) {
-  const tenantId = (0, import_apps4.tenantIdFor)(cfg.app.id, env);
+  const tenantId = (0, import_apps6.tenantIdFor)(cfg.app.id, env);
   const res = await doFetch(`${cfg.dbEndpoint}/admin/apps/${encodeURIComponent(tenantId)}/entitlements`, {
     headers: { authorization: `Bearer ${token}` }
   });
@@ -9245,7 +9261,7 @@ async function provision(options) {
   }
   const doFetch = options.fetch ?? fetch;
   const token = await getDeveloperToken(cfg, options, doFetch, out);
-  const apps = (0, import_apps5.createAppsClient)({ endpoint: cfg.platformUrl, token, fetcher: { fetch: doFetch } });
+  const apps = (0, import_apps7.createAppsClient)({ endpoint: cfg.platformUrl, token, fetcher: { fetch: doFetch } });
   const existing = await apps.resolveApp(cfg.app.id);
   if (existing) {
     out.log(`app: ${cfg.app.id} already exists`);
@@ -9256,7 +9272,7 @@ async function provision(options) {
   for (const env of cfg.envs) {
     await assertTenantAdminAccess(doFetch, cfg, env, token);
   }
-  const serviceOrder = [...cfg.services].sort((a, b) => serviceRank(a) - serviceRank(b));
+  const serviceOrder = (0, import_apps7.orderAppServices)(cfg.services);
   for (const env of cfg.envs) {
     for (const service of serviceOrder) {
       if (service === "ai") {
@@ -9289,7 +9305,7 @@ async function provision(options) {
     }
   }
   for (const env of cfg.envs) {
-    const tenantId = (0, import_apps5.tenantIdFor)(cfg.app.id, env);
+    const tenantId = (0, import_apps7.tenantIdFor)(cfg.app.id, env);
     credentials = await provisionEnvCredentials({
       cfg,
       env,