@odla-ai/cli 0.26.1 → 0.26.2

package/dist/bin.js

@@ -3,7 +3,7 @@ import {
   exitCodeFor,
   redactSecrets,
   runCli
-} from "./chunk-ZAZBUURZ.js";
+} from "./chunk-MBZXWPZP.js";
 
 // src/bin.ts
 runCli().catch((err) => {

package/dist/{chunk-ZAZBUURZ.js → chunk-MBZXWPZP.js}

@@ -439,7 +439,6 @@ function audienceBoundEnvToken(token, platform) {
 }
 var SCOPE_PURPOSE = {
   "platform:status:read": "read the platform fleet health and deployment snapshot",
-  "platform:chat:credential:write": "rotate the built-in Discussion responder credential",
   "app:config:read": "compare checked-in intent with an exact-id app Registry configuration",
   "app:config:write": "apply or inspect one revision-bound configuration operation for an app you own",
   "platform:runbook:write": "add or edit odla's operational runbooks",
@@ -1837,9 +1836,9 @@ function canonicalValue(value2) {
   }
   if (Array.isArray(value2)) return value2.map(canonicalValue);
   if (value2 && typeof value2 === "object") {
-    const record11 = value2;
+    const record10 = value2;
     return Object.fromEntries(
-      Object.keys(record11).filter((key) => record11[key] !== void 0).sort().map((key) => [key, canonicalValue(record11[key])])
+      Object.keys(record10).filter((key) => record10[key] !== void 0).sort().map((key) => [key, canonicalValue(record10[key])])
     );
   }
   throw new TypeError("canonical JSON rejects unsupported values");
@@ -4397,8 +4396,8 @@ async function materializeGitTree(source, commitSha, options = {}) {
   const maxFiles = options.maxFiles ?? 2e4;
   const maxBytes = options.maxBytes ?? 512 * 1024 * 1024;
   const inventory = (await gitOutput(sourceDir, ["ls-tree", "-rz", commitSha], 16 * 1024 * 1024)).toString("utf8").split("\0").filter(Boolean);
-  const entries = inventory.flatMap((record11) => {
-    const match = /^(100644|100755) blob ([0-9a-f]{40,64})\t([\s\S]+)$/.exec(record11);
+  const entries = inventory.flatMap((record10) => {
+    const match = /^(100644|100755) blob ([0-9a-f]{40,64})\t([\s\S]+)$/.exec(record10);
     return match && allowedWorkspacePath(match[3]) ? [{ mode: match[1], hash: match[2], path: match[3] }] : [];
   });
   if (entries.length > maxFiles) throw new Error(`workspace exceeds ${maxFiles} files`);
@@ -4646,8 +4645,8 @@ function normalize(value2) {
   if (Array.isArray(value2)) return value2.map(normalize);
   if (value2 instanceof Uint8Array) return { $bytes: [...value2] };
   if (typeof value2 === "object") {
-    const record11 = value2;
-    return Object.fromEntries(Object.keys(record11).filter((key) => record11[key] !== void 0).sort().map((key) => [key, normalize(record11[key])]));
+    const record10 = value2;
+    return Object.fromEntries(Object.keys(record10).filter((key) => record10[key] !== void 0).sort().map((key) => [key, normalize(record10[key])]));
   }
   throw new CamelError("state_conflict", "Canonical JSON rejects unsupported values.");
 }
@@ -7537,8 +7536,7 @@ var COMMAND_SURFACE = {
   o11y: { status: {} },
   operations: { get: {}, wait: {} },
   platform: {
-    status: {},
-    "chat-credentials": { rotate: {} }
+    status: {}
   },
   pm: {
     ...PM_ENTITIES,
@@ -9329,7 +9327,6 @@ Usage:
   odla-ai context remove <name> --yes [--json]
   odla-ai o11y status [--app <id>] [--context <name>] [--platform https://odla.ai] [--env prod] [--minutes 60] [--json]
   odla-ai platform status [--context <name>] [--platform https://odla.ai] [--email <odla-account>] [--json]
-  odla-ai platform chat-credentials rotate [--context <name>] [--email <odla-account>] [--wrangler-config <path>] [--expected-version <id>] [--json] --yes
   odla-ai whoami [--context <name>] [--platform https://odla.ai] [--json]
   odla-ai runbook ask "<question>" [--app <id>] [--all] [--json]
   odla-ai runbook search "<question>" [--app <id>] [--all] [--limit <n>] [--json]
@@ -10162,8 +10159,8 @@ async function pmAdd(ctx, entity, parsed) {
   emit2(ctx, res, () => ctx.out.log(`created ${entity} ${res.id}`));
 }
 async function pmGet(ctx, entity, id) {
-  const { record: record11 } = await pmRequest(ctx, "GET", `/${entity}/${encodeURIComponent(id)}`);
-  emit2(ctx, record11, () => printRecord(ctx, entity, record11));
+  const { record: record10 } = await pmRequest(ctx, "GET", `/${entity}/${encodeURIComponent(id)}`);
+  emit2(ctx, record10, () => printRecord(ctx, entity, record10));
 }
 async function pmSet(ctx, entity, id, parsed) {
   const patch2 = collectEntityFields(entity, parsed, true);
@@ -10208,9 +10205,9 @@ async function pmHandoff(ctx, parsed) {
   ]);
   const handoff = {
     appId,
-    unmetGoals: goals.filter((record11) => record11.status !== "met"),
-    activeTasks: tasks.filter((record11) => record11.column !== "done"),
-    openBugs: bugs.filter((record11) => record11.status !== "fixed" && record11.status !== "wontfix")
+    unmetGoals: goals.filter((record10) => record10.status !== "met"),
+    activeTasks: tasks.filter((record10) => record10.column !== "done"),
+    openBugs: bugs.filter((record10) => record10.status !== "fixed" && record10.status !== "wontfix")
   };
   const result = {
     ...handoff,
@@ -10229,10 +10226,10 @@ async function pmHandoff(ctx, parsed) {
     ]) {
       ctx.out.log(`${label}:`);
       if (!records.length) ctx.out.log("- (none)");
-      else for (const record11 of records) printRecord(
+      else for (const record10 of records) printRecord(
         ctx,
         label === "unmet goals" ? "goal" : label === "active tasks" ? "task" : "bug",
-        record11
+        record10
       );
     }
   });
@@ -10423,167 +10420,12 @@ function age(input) {
   return `${Math.round(input / 6e4)}m`;
 }
 
-// src/platform-chat-credential-command.ts
-import process12 from "process";
-async function rotatePlatformChatCredential(parsed, deps) {
-  assertArgs(
-    parsed,
-    [
-      "config",
-      "context",
-      "platform",
-      "token",
-      "email",
-      "open",
-      "json",
-      "yes",
-      "wrangler-config",
-      "expected-version"
-    ],
-    3
-  );
-  if (parsed.options.yes !== true) {
-    throw new Error(
-      "platform chat-credentials rotate changes the production chat secret; pass --yes"
-    );
-  }
-  const context = await resolveOperatorContext(parsed, {
-    allowMissingConfig: true
-  });
-  const platform = context.platform.value;
-  const doFetch = deps.fetch ?? fetch;
-  const out = deps.stdout ?? console;
-  const run = deps.runner ?? defaultRunner;
-  const cwd = process12.cwd();
-  const wranglerConfig = stringOpt(parsed.options["wrangler-config"]) ?? "packages/chat-agent/wrangler.jsonc";
-  if (!await wranglerLoggedIn(run, cwd)) {
-    throw new Error(
-      'Wrangler is not authenticated; run "npx wrangler login" and retry'
-    );
-  }
-  const priorHealth = await doFetch(`${platform}/health/services/chat`);
-  const priorVersion = priorHealth.headers.get("x-odla-worker-version-id");
-  await priorHealth.body?.cancel().catch(() => {
-  });
-  if (!priorVersion) {
-    throw new Error(
-      "chat health did not identify its current Worker version; refusing to rotate"
-    );
-  }
-  const expectedVersion = stringOpt(parsed.options["expected-version"]);
-  if (expectedVersion && priorVersion !== expectedVersion) {
-    throw new Error(
-      `chat health answered from version ${priorVersion}; expected ${expectedVersion}`
-    );
-  }
-  const token = await resolveAdminPlatformToken({
-    platform,
-    scope: "platform:chat:credential:write",
-    token: stringOpt(parsed.options.token),
-    tokenFile: context.credentials.scopedTokenFile,
-    email: stringOpt(parsed.options.email),
-    open: parsed.options.open === false ? false : parsed.options.open === true ? true : void 0,
-    fetch: doFetch,
-    stdout: out,
-    openApprovalUrl: deps.openUrl,
-    label: "odla CLI (rotate built-in Discussion responder)"
-  });
-  const mintedResponse = await doFetch(
-    `${platform}/registry/platform/chat-credentials/rotate`,
-    {
-      method: "POST",
-      headers: { authorization: `Bearer ${token}` }
-    }
-  );
-  const minted = await mintedResponse.json().catch(() => null);
-  if (!mintedResponse.ok) {
-    throw new Error(
-      `mint Discussion credential failed (HTTP ${mintedResponse.status}): ${apiMessage(minted)}`
-    );
-  }
-  if (!isPlatformChatCredential(minted)) {
-    throw new Error(
-      "platform returned an invalid odla.platform-chat-credential/v1 envelope"
-    );
-  }
-  const put = await wranglerPutSecret(run, {
-    name: "ODLA_BOT_TOKENS",
-    value: JSON.stringify({
-      [minted.appId]: { [minted.principalId]: minted.key }
-    }),
-    configPath: wranglerConfig,
-    cwd
-  });
-  if (put.code !== 0) {
-    throw new Error(
-      "Wrangler could not replace ODLA_BOT_TOKENS; the new scoped key was not activated"
-    );
-  }
-  const version = await waitForRotatedChatHealth({
-    fetch: doFetch,
-    platform,
-    priorVersion,
-    wait: deps.pollWait
-  });
-  const result = {
-    schemaVersion: "odla.platform-chat-credential-rotation/v1",
-    appId: minted.appId,
-    appIncarnation: minted.appIncarnation,
-    principalId: minted.principalId,
-    health: { ok: true, service: "odla-chat-agent", version }
-  };
-  if (parsed.options.json === true) {
-    out.log(JSON.stringify(result, null, 2));
-  } else {
-    out.log(
-      `rotated	${result.appId}	${result.principalId}	${result.health.version}`
-    );
-  }
-}
-async function waitForRotatedChatHealth(opts) {
-  const wait2 = opts.wait ?? ((milliseconds) => new Promise((resolve12) => setTimeout(resolve12, milliseconds)));
-  let lastStatus = 0;
-  let lastVersion = null;
-  let lastError = "private_service_unready";
-  for (let attempt = 0; attempt < 60; attempt++) {
-    const response2 = await opts.fetch(
-      `${opts.platform}/health/services/chat`
-    );
-    const body = await response2.json().catch(() => null);
-    const version = response2.headers.get("x-odla-worker-version-id");
-    if (response2.ok && record7(body) && body.ok === true && body.service === "odla-chat-agent" && version && version !== opts.priorVersion) {
-      return version;
-    }
-    lastStatus = response2.status;
-    lastVersion = version;
-    lastError = record7(body) && typeof body.error === "string" ? body.error : "private_service_unready";
-    if (attempt < 59) await wait2(5e3);
-  }
-  throw new Error(
-    `chat health did not converge on the rotated Worker deployment (HTTP ${lastStatus}, version ${lastVersion ?? "unknown"}, ${lastError})`
-  );
-}
-function isPlatformChatCredential(value2) {
-  return record7(value2) && value2.schemaVersion === "odla.platform-chat-credential/v1" && value2.appId === "odla-pm" && typeof value2.appIncarnation === "string" && value2.appIncarnation.length > 0 && value2.principalId === "agent_odla" && typeof value2.key === "string" && value2.key.startsWith("odla_sk_");
-}
-function apiMessage(value2) {
-  if (!record7(value2)) return "request failed";
-  const error = record7(value2.error) ? value2.error : value2;
-  return typeof error.message === "string" ? error.message : typeof error.code === "string" ? error.code : "request failed";
-}
-function record7(value2) {
-  return !!value2 && typeof value2 === "object" && !Array.isArray(value2);
-}
-
 // src/platform-command.ts
 async function platformCommand(parsed, deps = {}) {
   const action2 = parsed.positionals[1];
   if (action2 === "status") {
     return platformStatus(parsed, deps);
   }
-  if (action2 === "chat-credentials" && parsed.positionals[2] === "rotate") {
-    return rotatePlatformChatCredential(parsed, deps);
-  }
   throw new Error(
     `unknown platform action "${[
       action2,
@@ -10621,7 +10463,7 @@ async function platformStatus(parsed, deps) {
   const body = await response2.json().catch(() => null);
   if (!response2.ok) {
     throw new Error(
-      `read platform status failed (HTTP ${response2.status}): ${apiMessage2(body)}`
+      `read platform status failed (HTTP ${response2.status}): ${apiMessage(body)}`
     );
   }
   if (!isPlatformStatus(body)) {
@@ -10634,17 +10476,17 @@ async function platformStatus(parsed, deps) {
   }
 }
 function isPlatformStatus(value2) {
-  if (!record8(value2) || value2.schemaVersion !== "odla.platform-status/v1") return false;
-  if (!record8(value2.verdict) || !Array.isArray(value2.verdict.reasons)) return false;
-  if (!record8(value2.catalog) || !record8(value2.summary)) return false;
+  if (!record7(value2) || value2.schemaVersion !== "odla.platform-status/v1") return false;
+  if (!record7(value2.verdict) || !Array.isArray(value2.verdict.reasons)) return false;
+  if (!record7(value2.catalog) || !record7(value2.summary)) return false;
   return Array.isArray(value2.services) && Array.isArray(value2.nextActions);
 }
-function apiMessage2(value2) {
-  if (!record8(value2)) return "request failed";
-  const error = record8(value2.error) ? value2.error : value2;
+function apiMessage(value2) {
+  if (!record7(value2)) return "request failed";
+  const error = record7(value2.error) ? value2.error : value2;
   return typeof error.message === "string" ? error.message : typeof error.code === "string" ? error.code : "request failed";
 }
-function record8(value2) {
+function record7(value2) {
   return !!value2 && typeof value2 === "object" && !Array.isArray(value2);
 }
 
@@ -10685,7 +10527,7 @@ function statusVerdict(reads) {
       severity: "degraded"
     });
   }
-  const performance = record9(reads.liveSync.body.performance) ? reads.liveSync.body.performance : null;
+  const performance = record8(reads.liveSync.body.performance) ? reads.liveSync.body.performance : null;
   if (performance?.status === "unavailable") {
     reasons.push({
       source: "liveSync",
@@ -10766,7 +10608,7 @@ function statusVerdict(reads) {
     reasons
   };
 }
-function record9(value2) {
+function record8(value2) {
   return Boolean(value2) && typeof value2 === "object" && !Array.isArray(value2);
 }
 function numeric2(value2) {
@@ -10794,7 +10636,7 @@ function printO11yStatus(status, out) {
   out.log(
     `o11y status ${status.scope.appId}/${status.scope.env} (${status.scope.minutes}m)`
   );
-  const routes = Array.isArray(status.application.body.routes) ? status.application.body.routes.filter(record10) : [];
+  const routes = Array.isArray(status.application.body.routes) ? status.application.body.routes.filter(record9) : [];
   const requests = routes.reduce(
     (total, row) => total + numeric3(row.requests),
     0
@@ -10806,39 +10648,39 @@ function printO11yStatus(status, out) {
   out.log(
     `application	${status.application.httpStatus}	${requests} requests	${errors} errors`
   );
-  const versions = Array.isArray(status.applicationVersions.body.rows) ? status.applicationVersions.body.rows.filter(record10) : [];
+  const versions = Array.isArray(status.applicationVersions.body.rows) ? status.applicationVersions.body.rows.filter(record9) : [];
   out.log(
     `application-versions	${status.applicationVersions.httpStatus}	${versions.length ? versions.slice(0, 5).map(
       (row) => `${String(row.value || "(unattributed)")}:${numeric3(row.requests)}`
     ).join(", ") : "none observed"}`
   );
   out.log(liveSyncLine(status.liveSync));
-  const canaryDurations = record10(status.canary.body.durationsMs) ? status.canary.body.durationsMs : {};
+  const canaryDurations = record9(status.canary.body.durationsMs) ? status.canary.body.durationsMs : {};
   out.log(
     `canary	${status.canary.httpStatus}	${String(status.canary.body.status ?? status.canary.body.error ?? "unavailable")}	${optionalNumeric(canaryDurations.publishToVisibleMs)} publish-to-visible`
   );
-  const collectorIngest = record10(status.collector.body.ingest) ? status.collector.body.ingest : {};
-  const collectorStorage = record10(collectorIngest.storage) ? collectorIngest.storage : {};
+  const collectorIngest = record9(status.collector.body.ingest) ? status.collector.body.ingest : {};
+  const collectorStorage = record9(collectorIngest.storage) ? collectorIngest.storage : {};
   out.log(
     `collector	${status.collector.httpStatus}	${String(status.collector.body.status ?? status.collector.body.error ?? "unavailable")}	${numeric3(collectorStorage.affectedPoints)} affected points`
   );
-  const providerMetrics = record10(status.provider.body.metrics) ? status.provider.body.metrics : {};
-  const providerCapacity = record10(status.provider.body.capacity) ? status.provider.body.capacity : {};
-  const workerMemory = record10(providerCapacity.memory) ? providerCapacity.memory : {};
+  const providerMetrics = record9(status.provider.body.metrics) ? status.provider.body.metrics : {};
+  const providerCapacity = record9(status.provider.body.capacity) ? status.provider.body.capacity : {};
+  const workerMemory = record9(providerCapacity.memory) ? providerCapacity.memory : {};
   out.log(
     `cloudflare	${status.provider.httpStatus}	${String(status.provider.body.status ?? status.provider.body.error ?? "unavailable")}	${numeric3(providerMetrics.requests)} invocations	${numeric3(providerMetrics.errors)} runtime errors	${optionalBytes(workerMemory.headroomBytes)} isolate memory headroom`
   );
   for (const line of providerCapacityLines(status.providerCapacity)) {
     out.log(line);
   }
-  const coverage = record10(status.providerReconciliation.body.comparison) ? status.providerReconciliation.body.comparison : {};
-  const coverageCounts = record10(status.providerReconciliation.body.counts) ? status.providerReconciliation.body.counts : {};
-  const coverageBudget = record10(status.providerReconciliation.body.budget) ? status.providerReconciliation.body.budget : {};
+  const coverage = record9(status.providerReconciliation.body.comparison) ? status.providerReconciliation.body.comparison : {};
+  const coverageCounts = record9(status.providerReconciliation.body.counts) ? status.providerReconciliation.body.counts : {};
+  const coverageBudget = record9(status.providerReconciliation.body.budget) ? status.providerReconciliation.body.budget : {};
   out.log(
     `request-coverage	${status.providerReconciliation.httpStatus}	${String(status.providerReconciliation.body.status ?? status.providerReconciliation.body.error ?? "unavailable")}	${optionalPercent(coverage.applicationCoverage)} application/provider	${numeric3(coverageCounts.applicationRequests)}/${numeric3(coverageCounts.providerRequests)} requests	\xB1${optionalPercent(coverageBudget.maxRelativeError)} budget`
   );
   const providerPoints = Array.isArray(status.providerHistory.body.points) ? status.providerHistory.body.points.length : 0;
-  const providerFreshness = record10(status.providerHistory.body.freshness) ? status.providerHistory.body.freshness : {};
+  const providerFreshness = record9(status.providerHistory.body.freshness) ? status.providerHistory.body.freshness : {};
   out.log(
     `cloudflare-history	${status.providerHistory.httpStatus}	${String(status.providerHistory.body.status ?? status.providerHistory.body.error ?? "unavailable")}	${providerPoints} snapshots	${optionalAge(providerFreshness.ageMs)} old`
   );
@@ -10847,17 +10689,17 @@ function printO11yStatus(status, out) {
   );
 }
 function providerCapacityLines(read3) {
-  const resources = record10(read3.body.resources) ? read3.body.resources : {};
-  const durableObjects = record10(resources.durableObjects) ? resources.durableObjects : {};
-  const periodic = record10(durableObjects.periodic) ? durableObjects.periodic : {};
-  const storage = record10(durableObjects.sqliteStorage) ? durableObjects.sqliteStorage : {};
-  const d1 = record10(resources.d1) ? resources.d1 : {};
-  const d1Activity = record10(d1.activity) ? d1.activity : {};
-  const d1Storage = record10(d1.storage) ? d1.storage : {};
-  const d1Latency = record10(d1Activity.latency) ? d1Activity.latency : {};
-  const r2 = record10(resources.r2) ? resources.r2 : {};
-  const r2Operations = record10(r2.operations) ? r2.operations : {};
-  const r2Storage = record10(r2.storage) ? r2.storage : {};
+  const resources = record9(read3.body.resources) ? read3.body.resources : {};
+  const durableObjects = record9(resources.durableObjects) ? resources.durableObjects : {};
+  const periodic = record9(durableObjects.periodic) ? durableObjects.periodic : {};
+  const storage = record9(durableObjects.sqliteStorage) ? durableObjects.sqliteStorage : {};
+  const d1 = record9(resources.d1) ? resources.d1 : {};
+  const d1Activity = record9(d1.activity) ? d1.activity : {};
+  const d1Storage = record9(d1.storage) ? d1.storage : {};
+  const d1Latency = record9(d1Activity.latency) ? d1Activity.latency : {};
+  const r2 = record9(resources.r2) ? resources.r2 : {};
+  const r2Operations = record9(r2.operations) ? r2.operations : {};
+  const r2Storage = record9(r2.storage) ? r2.storage : {};
   const status = String(
     read3.body.status ?? read3.body.error ?? "unavailable"
   );
@@ -10868,11 +10710,11 @@ function providerCapacityLines(read3) {
   ];
 }
 function liveSyncLine(read3) {
-  const performance = record10(read3.body.performance) ? read3.body.performance : {};
-  const commitToSend = record10(performance.commitToSend) ? performance.commitToSend : {};
+  const performance = record9(read3.body.performance) ? read3.body.performance : {};
+  const commitToSend = record9(performance.commitToSend) ? performance.commitToSend : {};
   return `live-sync	${read3.httpStatus}	${String(read3.body.status ?? read3.body.error ?? "unavailable")}	${numeric3(read3.body.activeConnections)} active	${optionalNumeric(commitToSend.p95)} commit-to-send p95	${numeric3(performance.sendFailures)} send failures`;
 }
-function record10(value2) {
+function record9(value2) {
   return Boolean(value2) && typeof value2 === "object" && !Array.isArray(value2);
 }
 function numeric3(value2) {
@@ -11056,9 +10898,9 @@ async function read2(url, headers, doFetch) {
 
 // src/record.ts
 import { appendFileSync } from "fs";
-import process13 from "process";
+import process12 from "process";
 function recordInvocation(parsed) {
-  const file = process13.env.ODLA_CLI_RECORD;
+  const file = process12.env.ODLA_CLI_RECORD;
   if (!file) return;
   try {
     const entry = {
@@ -11730,9 +11572,9 @@ import { spawnSync } from "child_process";
 import { mkdtempSync, readFileSync as readFileSync13, rmSync as rmSync2, writeFileSync as writeFileSync4 } from "fs";
 import { tmpdir as tmpdir4 } from "os";
 import { join as join15 } from "path";
-import process14 from "process";
+import process13 from "process";
 var EDITOR_ENV = ["ODLA_EDITOR", "VISUAL", "EDITOR"];
-function resolveEditor(env = process14.env) {
+function resolveEditor(env = process13.env) {
   for (const name of EDITOR_ENV) {
     const value2 = env[name];
     if (value2 && value2.trim()) return value2.trim();
@@ -11746,8 +11588,8 @@ function defaultRun(command, path) {
   return result.status ?? 0;
 }
 function editText(initial, slug, deps = {}) {
-  const env = deps.env ?? process14.env;
-  const interactive = deps.interactive ?? (() => Boolean(process14.stdin.isTTY));
+  const env = deps.env ?? process13.env;
+  const interactive = deps.interactive ?? (() => Boolean(process13.stdin.isTTY));
   const editor = resolveEditor(env);
   if (!editor)
     throw new Error(
@@ -12734,4 +12576,4 @@ export {
   exitCodeFor,
   runCli
 };
-//# sourceMappingURL=chunk-ZAZBUURZ.js.map
+//# sourceMappingURL=chunk-MBZXWPZP.js.map