@odla-ai/cli 0.27.13 → 0.27.15

package/dist/chunk-UKLSRQ5J.js

@@ -0,0 +1,129 @@
+#!/usr/bin/env node
+
+// src/version.ts
+import { readFileSync } from "fs";
+function cliVersion() {
+  const pkg = JSON.parse(readFileSync(new URL("../package.json", import.meta.url), "utf8"));
+  return pkg.version ?? "unknown";
+}
+
+// src/exit-code.ts
+function exitCodeFor(err) {
+  const code = err?.code;
+  if (code === "handshake_pending" || code === "watch_timeout" || code === "operation_pending") return 75;
+  if (code === "checkpoint_required") return 3;
+  if (code === "remote_unavailable") return 6;
+  if (code === "auth_failed") return 5;
+  if (code === "invalid_cursor" || code === "invalid_plan" || code === "invalid_operation_id") return 2;
+  return 1;
+}
+
+// src/redact.ts
+var REPLACEMENTS = [
+  [/odla_(sk|dev)_[A-Za-z0-9._-]+/g, "odla_$1_[redacted]"],
+  [/\bsk_(live|test)_[A-Za-z0-9]+/g, "sk_$1_[redacted]"],
+  [/\bsk-[A-Za-z0-9._-]+/g, "sk-[redacted]"],
+  [/\bwhsec_[A-Za-z0-9+/=]+/g, "whsec_[redacted]"],
+  [/\bo11y_[A-Za-z0-9]+/g, "o11y_[redacted]"],
+  [/\b(ghp|gho|github_pat)_[A-Za-z0-9_]+/g, "$1_[redacted]"],
+  [/\bAKIA[A-Z0-9]{12,}/g, "AKIA[redacted]"]
+];
+function redactSecrets(value) {
+  let result = value;
+  for (const [pattern, replacement] of REPLACEMENTS) result = result.replace(pattern, replacement);
+  return result;
+}
+function redactingOutput(output) {
+  const redactArgs = (args) => args.map((value) => redactOutputValue(value, /* @__PURE__ */ new WeakMap()));
+  return {
+    log: (...args) => output.log(...redactArgs(args)),
+    error: (...args) => output.error(...redactArgs(args))
+  };
+}
+function redactOutputValue(value, seen) {
+  if (typeof value === "string") return redactSecrets(value);
+  if (value instanceof Error) {
+    const redacted = new Error(redactSecrets(value.message));
+    redacted.name = value.name;
+    if (value.stack) redacted.stack = redactSecrets(value.stack);
+    return redacted;
+  }
+  if (!value || typeof value !== "object") return value;
+  const prior = seen.get(value);
+  if (prior) return prior;
+  if (Array.isArray(value)) {
+    const next2 = [];
+    seen.set(value, next2);
+    for (const item of value) next2.push(redactOutputValue(item, seen));
+    return next2;
+  }
+  const prototype = Object.getPrototypeOf(value);
+  if (prototype !== Object.prototype && prototype !== null) return value;
+  const next = {};
+  seen.set(value, next);
+  for (const [key, item] of Object.entries(value)) next[key] = redactOutputValue(item, seen);
+  return next;
+}
+function looksSecret(value) {
+  return redactSecrets(value) !== value || value.includes("-----BEGIN");
+}
+
+// src/runbook-requires.ts
+var SPEC = /^(@?[\w./-]+?)@(\d+\.\d+\.\d+(?:[\w.-]*)?)$/;
+function parseRequires(value) {
+  if (!value) return [];
+  const out = [];
+  for (const token of value.split(/[\s,]+/).filter(Boolean)) {
+    const match = SPEC.exec(token);
+    if (match?.[1] && match[2]) out.push({ name: match[1], min: match[2] });
+  }
+  return out;
+}
+function compareVersions(a, b) {
+  const parts = (v) => {
+    const [core = "", pre = ""] = v.split("-", 2);
+    return { nums: core.split(".").map((n) => Number.parseInt(n, 10) || 0), pre };
+  };
+  const left = parts(a);
+  const right = parts(b);
+  for (let i = 0; i < Math.max(left.nums.length, right.nums.length); i++) {
+    const diff = (left.nums[i] ?? 0) - (right.nums[i] ?? 0);
+    if (diff) return diff < 0 ? -1 : 1;
+  }
+  if (left.pre === right.pre) return 0;
+  if (!left.pre) return 1;
+  if (!right.pre) return -1;
+  return left.pre < right.pre ? -1 : 1;
+}
+function satisfies(installed, min) {
+  return compareVersions(installed, min) >= 0;
+}
+function unmetRequirements(requires, installedVersions) {
+  const unmet = [];
+  for (const requirement of parseRequires(requires)) {
+    const installed = installedVersions[requirement.name];
+    if (installed === void 0) {
+      unmet.push({ ...requirement, installed: null });
+    } else if (!satisfies(installed, requirement.min)) {
+      unmet.push({ ...requirement, installed });
+    }
+  }
+  return unmet;
+}
+function describeUnmet(slug, unmet) {
+  const detail = unmet.map((u) => `${u.name}@${u.min}${u.installed ? ` (you have ${u.installed})` : " (not installed here)"}`).join(", ");
+  return `note: runbook "${slug}" expects ${detail} \u2014 some steps may name commands your version does not have.`;
+}
+
+export {
+  parseRequires,
+  compareVersions,
+  unmetRequirements,
+  describeUnmet,
+  cliVersion,
+  exitCodeFor,
+  redactSecrets,
+  redactingOutput,
+  looksSecret
+};
+//# sourceMappingURL=chunk-UKLSRQ5J.js.map

package/dist/chunk-UKLSRQ5J.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/version.ts","../src/exit-code.ts","../src/redact.ts","../src/runbook-requires.ts"],"sourcesContent":["import { readFileSync } from \"node:fs\";\n\nexport function cliVersion(): string {\n  const pkg = JSON.parse(readFileSync(new URL(\"../package.json\", import.meta.url), \"utf8\")) as { version?: string };\n  return pkg.version ?? \"unknown\";\n}\n","/** Map a CLI failure to its documented process exit code without importing the\n * command graph. The binary needs this tiny module before it verifies that its\n * external runtime dependencies are coherent. */\nexport function exitCodeFor(err: unknown): number {\n  const code = (err as { code?: unknown } | null)?.code;\n  if (code === \"handshake_pending\" || code === \"watch_timeout\" || code === \"operation_pending\") return 75;\n  if (code === \"checkpoint_required\") return 3;\n  if (code === \"remote_unavailable\") return 6;\n  if (code === \"auth_failed\") return 5;\n  if (code === \"invalid_cursor\" || code === \"invalid_plan\" || code === \"invalid_operation_id\") return 2;\n  return 1;\n}\n","/**\n * Secret redaction shared by every command's output path and by doctor's\n * \"does this value look like a secret\" checks. Clerk publishable keys\n * (pk_test_/pk_live_) are public by design and are deliberately not matched.\n */\nconst REPLACEMENTS: Array<[RegExp, string]> = [\n  [/odla_(sk|dev)_[A-Za-z0-9._-]+/g, \"odla_$1_[redacted]\"],\n  [/\\bsk_(live|test)_[A-Za-z0-9]+/g, \"sk_$1_[redacted]\"],\n  [/\\bsk-[A-Za-z0-9._-]+/g, \"sk-[redacted]\"],\n  [/\\bwhsec_[A-Za-z0-9+/=]+/g, \"whsec_[redacted]\"],\n  [/\\bo11y_[A-Za-z0-9]+/g, \"o11y_[redacted]\"],\n  [/\\b(ghp|gho|github_pat)_[A-Za-z0-9_]+/g, \"$1_[redacted]\"],\n  [/\\bAKIA[A-Z0-9]{12,}/g, \"AKIA[redacted]\"],\n];\n\n/**\n * Return `value` with every secret-shaped substring replaced by a `[redacted]`\n * placeholder that keeps the identifying prefix (e.g. `sk_live_[redacted]`).\n * Matches odla db keys (`odla_sk_`/`odla_dev_`), Clerk secret keys\n * (`sk_live_`/`sk_test_`), OpenAI keys (`sk-`), webhook signing secrets\n * (`whsec_`), o11y tokens (`o11y_`), GitHub tokens (`ghp_`/`gho_`/`github_pat_`),\n * and AWS access-key ids (`AKIA…`). Clerk publishable keys (`pk_test_`/\n * `pk_live_`) are public by design and intentionally left untouched. Used to\n * sanitize anything the CLI echoes (notably network error bodies) before it\n * reaches stdout/stderr. Non-matching input is returned unchanged.\n */\nexport function redactSecrets(value: string): string {\n  let result = value;\n  for (const [pattern, replacement] of REPLACEMENTS) result = result.replace(pattern, replacement);\n  return result;\n}\n\n/**\n * Wrap the CLI's line-oriented output boundary so command implementations\n * cannot accidentally bypass redaction when they print a backend message.\n * Objects and arrays retain their shape for console/test sinks while every\n * nested string is sanitized.\n */\nexport function redactingOutput(\n  output: Pick<typeof console, \"log\" | \"error\">,\n): Pick<typeof console, \"log\" | \"error\"> {\n  const redactArgs = (args: unknown[]) => args.map((value) => redactOutputValue(value, new WeakMap<object, unknown>()));\n  return {\n    log: (...args: unknown[]) => output.log(...redactArgs(args)),\n    error: (...args: unknown[]) => output.error(...redactArgs(args)),\n  };\n}\n\nfunction redactOutputValue(value: unknown, seen: WeakMap<object, unknown>): unknown {\n  if (typeof value === \"string\") return redactSecrets(value);\n  if (value instanceof Error) {\n    const redacted = new Error(redactSecrets(value.message));\n    redacted.name = value.name;\n    if (value.stack) redacted.stack = redactSecrets(value.stack);\n    return redacted;\n  }\n  if (!value || typeof value !== \"object\") return value;\n  const prior = seen.get(value);\n  if (prior) return prior;\n  if (Array.isArray(value)) {\n    const next: unknown[] = [];\n    seen.set(value, next);\n    for (const item of value) next.push(redactOutputValue(item, seen));\n    return next;\n  }\n  const prototype = Object.getPrototypeOf(value);\n  if (prototype !== Object.prototype && prototype !== null) return value;\n  const next: Record<string, unknown> = {};\n  seen.set(value, next);\n  for (const [key, item] of Object.entries(value)) next[key] = redactOutputValue(item, seen);\n  return next;\n}\n\n/** True when a value matches any known secret shape (used for detection, never display). */\nexport function looksSecret(value: string): boolean {\n  return redactSecrets(value) !== value || value.includes(\"-----BEGIN\");\n}\n","// A runbook can be corrected the moment a step is wrong, which means its text\n// routinely runs ahead of the packages a reader has installed: the step is right,\n// and the command it names simply does not exist in their copy yet. `requires`\n// is how a runbook says which version it assumes, so the reader learns that from\n// the runbook instead of from a confusing \"unknown action\" error.\n//\n// Specs are `name@version`, space- or comma-separated, and read as MINIMUMS.\n// Deliberately not semver ranges: the only question worth answering here is\n// \"is what I have new enough\", and a range grammar invites `<` bounds that a\n// runbook has no way to be right about.\n\n/** One package version a runbook assumes. */\nexport interface Requirement {\n  name: string;\n  /** The lowest version whose steps are known to work. */\n  min: string;\n}\n\n/** A requirement the caller does not meet. */\nexport interface UnmetRequirement extends Requirement {\n  /** What is installed, or null when nothing local claims to be this package. */\n  installed: string | null;\n}\n\nconst SPEC = /^(@?[\\w./-]+?)@(\\d+\\.\\d+\\.\\d+(?:[\\w.-]*)?)$/;\n\n/** Parse a `requires` string. Unparseable entries are dropped rather than\n * throwing: a malformed spec must not make a runbook unreadable. */\nexport function parseRequires(value: string | undefined | null): Requirement[] {\n  if (!value) return [];\n  const out: Requirement[] = [];\n  for (const token of value.split(/[\\s,]+/).filter(Boolean)) {\n    const match = SPEC.exec(token);\n    if (match?.[1] && match[2]) out.push({ name: match[1], min: match[2] });\n  }\n  return out;\n}\n\n/** Compare two dotted versions numerically. Pre-release suffixes sort BELOW the\n * release they precede, so `0.18.0-rc.1` does not satisfy `0.18.0`. */\nexport function compareVersions(a: string, b: string): number {\n  const parts = (v: string) => {\n    const [core = \"\", pre = \"\"] = v.split(\"-\", 2);\n    return { nums: core.split(\".\").map((n) => Number.parseInt(n, 10) || 0), pre };\n  };\n  const left = parts(a);\n  const right = parts(b);\n  for (let i = 0; i < Math.max(left.nums.length, right.nums.length); i++) {\n    const diff = (left.nums[i] ?? 0) - (right.nums[i] ?? 0);\n    if (diff) return diff < 0 ? -1 : 1;\n  }\n  if (left.pre === right.pre) return 0;\n  if (!left.pre) return 1;\n  if (!right.pre) return -1;\n  return left.pre < right.pre ? -1 : 1;\n}\n\n/** True when `installed` is at least `min`. */\nexport function satisfies(installed: string, min: string): boolean {\n  return compareVersions(installed, min) >= 0;\n}\n\n/**\n * Which of a runbook's requirements the caller does not meet.\n *\n * `installedVersions` maps a package name to what the caller has. A package the\n * caller knows nothing about is reported with `installed: null` rather than\n * assumed satisfied — silence about an unknown dependency is the failure mode\n * this exists to prevent.\n */\nexport function unmetRequirements(\n  requires: string | undefined | null,\n  installedVersions: Readonly<Record<string, string | undefined>>,\n): UnmetRequirement[] {\n  const unmet: UnmetRequirement[] = [];\n  for (const requirement of parseRequires(requires)) {\n    const installed = installedVersions[requirement.name];\n    if (installed === undefined) {\n      unmet.push({ ...requirement, installed: null });\n    } else if (!satisfies(installed, requirement.min)) {\n      unmet.push({ ...requirement, installed });\n    }\n  }\n  return unmet;\n}\n\n/** The one-line warning shown when a runbook expects more than the caller has. */\nexport function describeUnmet(slug: string, unmet: readonly UnmetRequirement[]): string {\n  const detail = unmet\n    .map((u) => `${u.name}@${u.min}${u.installed ? ` (you have ${u.installed})` : \" (not installed here)\"}`)\n    .join(\", \");\n  return `note: runbook \"${slug}\" expects ${detail} — some steps may name commands your version does not have.`;\n}\n"],"mappings":";;;AAAA,SAAS,oBAAoB;AAEtB,SAAS,aAAqB;AACnC,QAAM,MAAM,KAAK,MAAM,aAAa,IAAI,IAAI,mBAAmB,YAAY,GAAG,GAAG,MAAM,CAAC;AACxF,SAAO,IAAI,WAAW;AACxB;;;ACFO,SAAS,YAAY,KAAsB;AAChD,QAAM,OAAQ,KAAmC;AACjD,MAAI,SAAS,uBAAuB,SAAS,mBAAmB,SAAS,oBAAqB,QAAO;AACrG,MAAI,SAAS,sBAAuB,QAAO;AAC3C,MAAI,SAAS,qBAAsB,QAAO;AAC1C,MAAI,SAAS,cAAe,QAAO;AACnC,MAAI,SAAS,oBAAoB,SAAS,kBAAkB,SAAS,uBAAwB,QAAO;AACpG,SAAO;AACT;;;ACNA,IAAM,eAAwC;AAAA,EAC5C,CAAC,kCAAkC,oBAAoB;AAAA,EACvD,CAAC,kCAAkC,kBAAkB;AAAA,EACrD,CAAC,yBAAyB,eAAe;AAAA,EACzC,CAAC,4BAA4B,kBAAkB;AAAA,EAC/C,CAAC,wBAAwB,iBAAiB;AAAA,EAC1C,CAAC,yCAAyC,eAAe;AAAA,EACzD,CAAC,wBAAwB,gBAAgB;AAC3C;AAaO,SAAS,cAAc,OAAuB;AACnD,MAAI,SAAS;AACb,aAAW,CAAC,SAAS,WAAW,KAAK,aAAc,UAAS,OAAO,QAAQ,SAAS,WAAW;AAC/F,SAAO;AACT;AAQO,SAAS,gBACd,QACuC;AACvC,QAAM,aAAa,CAAC,SAAoB,KAAK,IAAI,CAAC,UAAU,kBAAkB,OAAO,oBAAI,QAAyB,CAAC,CAAC;AACpH,SAAO;AAAA,IACL,KAAK,IAAI,SAAoB,OAAO,IAAI,GAAG,WAAW,IAAI,CAAC;AAAA,IAC3D,OAAO,IAAI,SAAoB,OAAO,MAAM,GAAG,WAAW,IAAI,CAAC;AAAA,EACjE;AACF;AAEA,SAAS,kBAAkB,OAAgB,MAAyC;AAClF,MAAI,OAAO,UAAU,SAAU,QAAO,cAAc,KAAK;AACzD,MAAI,iBAAiB,OAAO;AAC1B,UAAM,WAAW,IAAI,MAAM,cAAc,MAAM,OAAO,CAAC;AACvD,aAAS,OAAO,MAAM;AACtB,QAAI,MAAM,MAAO,UAAS,QAAQ,cAAc,MAAM,KAAK;AAC3D,WAAO;AAAA,EACT;AACA,MAAI,CAAC,SAAS,OAAO,UAAU,SAAU,QAAO;AAChD,QAAM,QAAQ,KAAK,IAAI,KAAK;AAC5B,MAAI,MAAO,QAAO;AAClB,MAAI,MAAM,QAAQ,KAAK,GAAG;AACxB,UAAMA,QAAkB,CAAC;AACzB,SAAK,IAAI,OAAOA,KAAI;AACpB,eAAW,QAAQ,MAAO,CAAAA,MAAK,KAAK,kBAAkB,MAAM,IAAI,CAAC;AACjE,WAAOA;AAAA,EACT;AACA,QAAM,YAAY,OAAO,eAAe,KAAK;AAC7C,MAAI,cAAc,OAAO,aAAa,cAAc,KAAM,QAAO;AACjE,QAAM,OAAgC,CAAC;AACvC,OAAK,IAAI,OAAO,IAAI;AACpB,aAAW,CAAC,KAAK,IAAI,KAAK,OAAO,QAAQ,KAAK,EAAG,MAAK,GAAG,IAAI,kBAAkB,MAAM,IAAI;AACzF,SAAO;AACT;AAGO,SAAS,YAAY,OAAwB;AAClD,SAAO,cAAc,KAAK,MAAM,SAAS,MAAM,SAAS,YAAY;AACtE;;;ACpDA,IAAM,OAAO;AAIN,SAAS,cAAc,OAAiD;AAC7E,MAAI,CAAC,MAAO,QAAO,CAAC;AACpB,QAAM,MAAqB,CAAC;AAC5B,aAAW,SAAS,MAAM,MAAM,QAAQ,EAAE,OAAO,OAAO,GAAG;AACzD,UAAM,QAAQ,KAAK,KAAK,KAAK;AAC7B,QAAI,QAAQ,CAAC,KAAK,MAAM,CAAC,EAAG,KAAI,KAAK,EAAE,MAAM,MAAM,CAAC,GAAG,KAAK,MAAM,CAAC,EAAE,CAAC;AAAA,EACxE;AACA,SAAO;AACT;AAIO,SAAS,gBAAgB,GAAW,GAAmB;AAC5D,QAAM,QAAQ,CAAC,MAAc;AAC3B,UAAM,CAAC,OAAO,IAAI,MAAM,EAAE,IAAI,EAAE,MAAM,KAAK,CAAC;AAC5C,WAAO,EAAE,MAAM,KAAK,MAAM,GAAG,EAAE,IAAI,CAAC,MAAM,OAAO,SAAS,GAAG,EAAE,KAAK,CAAC,GAAG,IAAI;AAAA,EAC9E;AACA,QAAM,OAAO,MAAM,CAAC;AACpB,QAAM,QAAQ,MAAM,CAAC;AACrB,WAAS,IAAI,GAAG,IAAI,KAAK,IAAI,KAAK,KAAK,QAAQ,MAAM,KAAK,MAAM,GAAG,KAAK;AACtE,UAAM,QAAQ,KAAK,KAAK,CAAC,KAAK,MAAM,MAAM,KAAK,CAAC,KAAK;AACrD,QAAI,KAAM,QAAO,OAAO,IAAI,KAAK;AAAA,EACnC;AACA,MAAI,KAAK,QAAQ,MAAM,IAAK,QAAO;AACnC,MAAI,CAAC,KAAK,IAAK,QAAO;AACtB,MAAI,CAAC,MAAM,IAAK,QAAO;AACvB,SAAO,KAAK,MAAM,MAAM,MAAM,KAAK;AACrC;AAGO,SAAS,UAAU,WAAmB,KAAsB;AACjE,SAAO,gBAAgB,WAAW,GAAG,KAAK;AAC5C;AAUO,SAAS,kBACd,UACA,mBACoB;AACpB,QAAM,QAA4B,CAAC;AACnC,aAAW,eAAe,cAAc,QAAQ,GAAG;AACjD,UAAM,YAAY,kBAAkB,YAAY,IAAI;AACpD,QAAI,cAAc,QAAW;AAC3B,YAAM,KAAK,EAAE,GAAG,aAAa,WAAW,KAAK,CAAC;AAAA,IAChD,WAAW,CAAC,UAAU,WAAW,YAAY,GAAG,GAAG;AACjD,YAAM,KAAK,EAAE,GAAG,aAAa,UAAU,CAAC;AAAA,IAC1C;AAAA,EACF;AACA,SAAO;AACT;AAGO,SAAS,cAAc,MAAc,OAA4C;AACtF,QAAM,SAAS,MACZ,IAAI,CAAC,MAAM,GAAG,EAAE,IAAI,IAAI,EAAE,GAAG,GAAG,EAAE,YAAY,cAAc,EAAE,SAAS,MAAM,uBAAuB,EAAE,EACtG,KAAK,IAAI;AACZ,SAAO,kBAAkB,IAAI,aAAa,MAAM;AAClD;","names":["next"]}

package/dist/cli-2RZFZRRT.js

@@ -0,0 +1,12 @@
+#!/usr/bin/env node
+import {
+  runCli
+} from "./chunk-MR5QXX3B.js";
+import {
+  exitCodeFor
+} from "./chunk-UKLSRQ5J.js";
+export {
+  exitCodeFor,
+  runCli
+};
+//# sourceMappingURL=cli-2RZFZRRT.js.map

package/dist/cli-2RZFZRRT.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":[],"sourcesContent":[],"mappings":"","names":[]}

package/dist/index.cjs

@@ -8768,6 +8768,10 @@ Safety:
   production odla.ai \u2014 there is no separate odla to point at. New projects get
   the sandbox only. Add "prod" explicitly to odla.config.mjs and pass --yes to
   provision the live database; use --dry-run first to inspect the resolved plan.
+  A real provision first verifies both the released CLI version and the exact
+  pinned versions of every external @odla-ai runtime module before importing
+  the command graph. A stale workspace module blocks with its resolved path and
+  tells the agent to update/rebase, npm ci, and rebuild.
   Provision caches the approved developer token and service credentials under
   .odla/ with mode 0600, and init adds those paths to .gitignore. Secret push
   preflights Wrangler before any shown-once issuance or destructive rotation.
@@ -8798,6 +8802,9 @@ Safety:
   grant, run it once with --request-grant. That flag ignores ODLA_DEV_TOKEN and
   the local cache, prints and opens a fresh exact-project owner-review URL, then
   continues provisioning with the approved replacement credential.
+  Before a non-dry-run provision, the executable checks npm's current CLI
+  release. A confirmed stale client stops with a safe npx rerun command; a
+  workspace-linked client also identifies the worktree that must be updated.
   Run Code from a GitHub checkout already connected to an app in Studio; an
   odla.config.mjs may select the app explicitly but is not required. Code host
   approval and credential hashes live in odla-ai/db. The host
@@ -12799,7 +12806,7 @@ async function securityStatus(parsed, dependencies) {
   }
 }
 
-// src/cli.ts
+// src/exit-code.ts
 function exitCodeFor(err) {
   const code = err?.code;
   if (code === "handshake_pending" || code === "watch_timeout" || code === "operation_pending") return 75;
@@ -12809,6 +12816,8 @@ function exitCodeFor(err) {
   if (code === "invalid_cursor" || code === "invalid_plan" || code === "invalid_operation_id") return 2;
   return 1;
 }
+
+// src/cli.ts
 async function runCli(argv = process.argv.slice(2), dependencies = {}) {
   const runtime = {
     ...dependencies,