@odla-ai/cli 0.27.12 → 0.27.13

package/dist/index.cjs

@@ -386,23 +386,30 @@ function handshakeWaitMs(waitSeconds, interactive = import_node_process3.default
 
 // src/token.ts
 async function getDeveloperToken(cfg, options, doFetch, out, grantRequest = {}) {
-  if (options.token) return options.token;
   const audience = platformAudience(cfg.platformUrl);
-  if (import_node_process4.default.env.ODLA_DEV_TOKEN) {
-    const declared = import_node_process4.default.env.ODLA_DEV_TOKEN_AUDIENCE;
-    if (declared) {
-      if (platformAudience(declared) !== audience) throw new Error("ODLA_DEV_TOKEN_AUDIENCE does not match the configured platform");
-    } else if (audience !== "https://odla.ai") {
-      throw new Error("ODLA_DEV_TOKEN_AUDIENCE is required for a non-default platform");
-    }
-    return import_node_process4.default.env.ODLA_DEV_TOKEN;
-  }
   const optionalProjectCapabilities = grantRequest.optionalProjectCapabilities ?? [];
   const grantIntent = { projectIds: [cfg.app.id], optionalProjectCapabilities };
   const cached = readJsonFile(cfg.local.tokenFile);
-  if (cached?.token && cached.platform === audience && (cached.expiresAt ?? 0) > Date.now() + 6e4 && cachedGrantCovers(cached, grantIntent)) {
-    out.error(`auth: using cached developer token (${displayPath(cfg.local.tokenFile, cfg.rootDir)})`);
-    return cached.token;
+  if (!grantRequest.forceReview) {
+    if (options.token) return options.token;
+    if (import_node_process4.default.env.ODLA_DEV_TOKEN) {
+      const declared = import_node_process4.default.env.ODLA_DEV_TOKEN_AUDIENCE;
+      if (declared) {
+        if (platformAudience(declared) !== audience) throw new Error("ODLA_DEV_TOKEN_AUDIENCE does not match the configured platform");
+      } else if (audience !== "https://odla.ai") {
+        throw new Error("ODLA_DEV_TOKEN_AUDIENCE is required for a non-default platform");
+      }
+      return import_node_process4.default.env.ODLA_DEV_TOKEN;
+    }
+    if (cached?.token && cached.platform === audience && (cached.expiresAt ?? 0) > Date.now() + 6e4 && cachedGrantCovers(cached, grantIntent)) {
+      out.error(`auth: using cached developer token (${displayPath(cfg.local.tokenFile, cfg.rootDir)})`);
+      return cached.token;
+    }
+  } else {
+    if (options.token) {
+      throw new Error("--request-grant cannot be combined with --token; remove --token so the approved replacement credential can be collected and cached");
+    }
+    out.error(`auth: requesting fresh owner review for app.manage on exact project "${cfg.app.id}"`);
   }
   const ctx = {
     cfg,
@@ -2899,11 +2906,11 @@ async function assertTenantAdminAccess(doFetch, cfg, env, token) {
     }
     if (code === "provision_approval_required") {
       throw new Error(
-        `${env}: the agent credential does not carry the owner-reviewed app.manage grant required to provision "${cfg.app.id}" (tenant ${tenantId}). The human owner id on the token is accountability, not agent authority. Discard the cached or supplied token and run this command with the current CLI to approve one fresh exact-project provisioning handshake`
+        `${env}: the agent credential does not carry the owner-reviewed app.manage grant required to provision "${cfg.app.id}" (tenant ${tenantId}). The human owner id on the token is accountability, not agent authority. Run "odla-ai provision --request-grant --email <odla-account>" to open one fresh exact-project owner review; do not change app ownership unless the human account itself is not an owner`
       );
     }
     throw new Error(
-      `${env}: this credential lacks live app.manage authority for "${cfg.app.id}" (tenant ${tenantId}) \u2014 nothing was minted or written; re-run provision with a fresh owner-approved provision handshake. If the human account is not an owner, an existing owner must add it in signed-in Studio; an agent token cannot repair ownership`
+      `${env}: this credential lacks live app.manage authority for "${cfg.app.id}" (tenant ${tenantId}) \u2014 nothing was minted or written; run "odla-ai provision --request-grant --email <odla-account>" to open a fresh owner review. If the human account is not an owner, an existing owner must add it in signed-in Studio; an agent token cannot repair ownership`
     );
   }
   throw new Error(`${env}: tenant access preflight (${tenantId}) failed: ${res.status} ${await safeText4(res)}`);
@@ -8652,7 +8659,7 @@ Usage:
   odla-ai security report <job-id> [--json]
   odla-ai security run [target] --ack-redacted-source [--env dev] [--profile odla] [--fail-on high]
   odla-ai security run [target] --self --ack-redacted-source
-  odla-ai provision [--config odla.config.mjs] [--email <odla-account>] [--wait <seconds>] [--dry-run] [--push-secrets] [--rotate-o11y-token] [--write-dev-vars[=path]] [--yes]
+  odla-ai provision [--config odla.config.mjs] [--email <odla-account>] [--request-grant] [--wait <seconds>] [--dry-run] [--push-secrets] [--rotate-o11y-token] [--write-dev-vars[=path]] [--yes]
   odla-ai smoke [--config odla.config.mjs] [--env dev] [--email <odla-account>] [--no-open]
   odla-ai skill install [--dir <project>] [--agent <name>] [--global] [--force]
   odla-ai secrets push --env <env> [--config odla.config.mjs] [--dry-run] [--yes]
@@ -8787,6 +8794,10 @@ Safety:
   The email is a non-secret identity hint: never provide a password or session
   token. The matching account must already exist, be signed in, explicitly
   review the exact code, and finish any current request before claiming another.
+  If provision reports that the current agent principal has no live app.manage
+  grant, run it once with --request-grant. That flag ignores ODLA_DEV_TOKEN and
+  the local cache, prints and opens a fresh exact-project owner-review URL, then
+  continues provisioning with the approved replacement credential.
   Run Code from a GitHub checkout already connected to an app in Studio; an
   odla.config.mjs may select the app explicitly but is not required. Code host
   approval and credential hashes live in odla-ai/db. The host
@@ -10752,14 +10763,25 @@ async function provision(options) {
   }
   const doFetch = options.fetch ?? fetch;
   const token = await getDeveloperToken(cfg, options, doFetch, out, {
-    optionalProjectCapabilities: ["app.manage"]
+    optionalProjectCapabilities: ["app.manage"],
+    forceReview: options.requestGrant
   });
   const apps = (0, import_apps12.createAppsClient)({ endpoint: cfg.platformUrl, token, fetcher: { fetch: doFetch } });
   const existing = await apps.resolveApp(cfg.app.id);
   if (existing) {
     out.log(`app: ${cfg.app.id} already exists`);
   } else {
-    await apps.createApp({ name: cfg.app.name, appId: cfg.app.id });
+    try {
+      await apps.createApp({ name: cfg.app.name, appId: cfg.app.id });
+    } catch (error) {
+      if (error instanceof import_apps12.AppsError && error.status === 403) {
+        throw new Error(
+          `app "${cfg.app.id}" does not exist, and this authenticated agent credential has no owner-reviewed app.manage bootstrap grant for that exact id. Run "odla-ai provision --request-grant --email <odla-account>" to open the review URL and continue; developer ownership alone is not agent authority`,
+          { cause: error }
+        );
+      }
+      throw error;
+    }
     out.log(`app: created ${cfg.app.id}`);
   }
   for (const env of cfg.envs) {
@@ -12878,6 +12900,7 @@ async function provisionCommand(parsed, dependencies) {
     "write-credentials",
     "write-dev-vars",
     "token",
+    "request-grant",
     "email",
     "open",
     "wait",
@@ -12893,6 +12916,7 @@ async function provisionCommand(parsed, dependencies) {
     writeCredentials: parsed.options["write-credentials"] !== false,
     writeDevVars: typeof writeDevVars2 === "string" ? writeDevVars2 : writeDevVars2 === true,
     token: stringOpt(parsed.options.token),
+    requestGrant: parsed.options["request-grant"] === true,
     email: stringOpt(parsed.options.email),
     open: parsed.options.open === false ? false : parsed.options.open === true ? true : void 0,
     wait: numberOpt(parsed.options.wait, "--wait"),