@odla-ai/cli 0.27.14 → 0.27.17

package/dist/chunk-UKLSRQ5J.js

@@ -0,0 +1,129 @@
+#!/usr/bin/env node
+
+// src/version.ts
+import { readFileSync } from "fs";
+function cliVersion() {
+  const pkg = JSON.parse(readFileSync(new URL("../package.json", import.meta.url), "utf8"));
+  return pkg.version ?? "unknown";
+}
+
+// src/exit-code.ts
+function exitCodeFor(err) {
+  const code = err?.code;
+  if (code === "handshake_pending" || code === "watch_timeout" || code === "operation_pending") return 75;
+  if (code === "checkpoint_required") return 3;
+  if (code === "remote_unavailable") return 6;
+  if (code === "auth_failed") return 5;
+  if (code === "invalid_cursor" || code === "invalid_plan" || code === "invalid_operation_id") return 2;
+  return 1;
+}
+
+// src/redact.ts
+var REPLACEMENTS = [
+  [/odla_(sk|dev)_[A-Za-z0-9._-]+/g, "odla_$1_[redacted]"],
+  [/\bsk_(live|test)_[A-Za-z0-9]+/g, "sk_$1_[redacted]"],
+  [/\bsk-[A-Za-z0-9._-]+/g, "sk-[redacted]"],
+  [/\bwhsec_[A-Za-z0-9+/=]+/g, "whsec_[redacted]"],
+  [/\bo11y_[A-Za-z0-9]+/g, "o11y_[redacted]"],
+  [/\b(ghp|gho|github_pat)_[A-Za-z0-9_]+/g, "$1_[redacted]"],
+  [/\bAKIA[A-Z0-9]{12,}/g, "AKIA[redacted]"]
+];
+function redactSecrets(value) {
+  let result = value;
+  for (const [pattern, replacement] of REPLACEMENTS) result = result.replace(pattern, replacement);
+  return result;
+}
+function redactingOutput(output) {
+  const redactArgs = (args) => args.map((value) => redactOutputValue(value, /* @__PURE__ */ new WeakMap()));
+  return {
+    log: (...args) => output.log(...redactArgs(args)),
+    error: (...args) => output.error(...redactArgs(args))
+  };
+}
+function redactOutputValue(value, seen) {
+  if (typeof value === "string") return redactSecrets(value);
+  if (value instanceof Error) {
+    const redacted = new Error(redactSecrets(value.message));
+    redacted.name = value.name;
+    if (value.stack) redacted.stack = redactSecrets(value.stack);
+    return redacted;
+  }
+  if (!value || typeof value !== "object") return value;
+  const prior = seen.get(value);
+  if (prior) return prior;
+  if (Array.isArray(value)) {
+    const next2 = [];
+    seen.set(value, next2);
+    for (const item of value) next2.push(redactOutputValue(item, seen));
+    return next2;
+  }
+  const prototype = Object.getPrototypeOf(value);
+  if (prototype !== Object.prototype && prototype !== null) return value;
+  const next = {};
+  seen.set(value, next);
+  for (const [key, item] of Object.entries(value)) next[key] = redactOutputValue(item, seen);
+  return next;
+}
+function looksSecret(value) {
+  return redactSecrets(value) !== value || value.includes("-----BEGIN");
+}
+
+// src/runbook-requires.ts
+var SPEC = /^(@?[\w./-]+?)@(\d+\.\d+\.\d+(?:[\w.-]*)?)$/;
+function parseRequires(value) {
+  if (!value) return [];
+  const out = [];
+  for (const token of value.split(/[\s,]+/).filter(Boolean)) {
+    const match = SPEC.exec(token);
+    if (match?.[1] && match[2]) out.push({ name: match[1], min: match[2] });
+  }
+  return out;
+}
+function compareVersions(a, b) {
+  const parts = (v) => {
+    const [core = "", pre = ""] = v.split("-", 2);
+    return { nums: core.split(".").map((n) => Number.parseInt(n, 10) || 0), pre };
+  };
+  const left = parts(a);
+  const right = parts(b);
+  for (let i = 0; i < Math.max(left.nums.length, right.nums.length); i++) {
+    const diff = (left.nums[i] ?? 0) - (right.nums[i] ?? 0);
+    if (diff) return diff < 0 ? -1 : 1;
+  }
+  if (left.pre === right.pre) return 0;
+  if (!left.pre) return 1;
+  if (!right.pre) return -1;
+  return left.pre < right.pre ? -1 : 1;
+}
+function satisfies(installed, min) {
+  return compareVersions(installed, min) >= 0;
+}
+function unmetRequirements(requires, installedVersions) {
+  const unmet = [];
+  for (const requirement of parseRequires(requires)) {
+    const installed = installedVersions[requirement.name];
+    if (installed === void 0) {
+      unmet.push({ ...requirement, installed: null });
+    } else if (!satisfies(installed, requirement.min)) {
+      unmet.push({ ...requirement, installed });
+    }
+  }
+  return unmet;
+}
+function describeUnmet(slug, unmet) {
+  const detail = unmet.map((u) => `${u.name}@${u.min}${u.installed ? ` (you have ${u.installed})` : " (not installed here)"}`).join(", ");
+  return `note: runbook "${slug}" expects ${detail} \u2014 some steps may name commands your version does not have.`;
+}
+
+export {
+  parseRequires,
+  compareVersions,
+  unmetRequirements,
+  describeUnmet,
+  cliVersion,
+  exitCodeFor,
+  redactSecrets,
+  redactingOutput,
+  looksSecret
+};
+//# sourceMappingURL=chunk-UKLSRQ5J.js.map

package/dist/chunk-UKLSRQ5J.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/version.ts","../src/exit-code.ts","../src/redact.ts","../src/runbook-requires.ts"],"sourcesContent":["import { readFileSync } from \"node:fs\";\n\nexport function cliVersion(): string {\n  const pkg = JSON.parse(readFileSync(new URL(\"../package.json\", import.meta.url), \"utf8\")) as { version?: string };\n  return pkg.version ?? \"unknown\";\n}\n","/** Map a CLI failure to its documented process exit code without importing the\n * command graph. The binary needs this tiny module before it verifies that its\n * external runtime dependencies are coherent. */\nexport function exitCodeFor(err: unknown): number {\n  const code = (err as { code?: unknown } | null)?.code;\n  if (code === \"handshake_pending\" || code === \"watch_timeout\" || code === \"operation_pending\") return 75;\n  if (code === \"checkpoint_required\") return 3;\n  if (code === \"remote_unavailable\") return 6;\n  if (code === \"auth_failed\") return 5;\n  if (code === \"invalid_cursor\" || code === \"invalid_plan\" || code === \"invalid_operation_id\") return 2;\n  return 1;\n}\n","/**\n * Secret redaction shared by every command's output path and by doctor's\n * \"does this value look like a secret\" checks. Clerk publishable keys\n * (pk_test_/pk_live_) are public by design and are deliberately not matched.\n */\nconst REPLACEMENTS: Array<[RegExp, string]> = [\n  [/odla_(sk|dev)_[A-Za-z0-9._-]+/g, \"odla_$1_[redacted]\"],\n  [/\\bsk_(live|test)_[A-Za-z0-9]+/g, \"sk_$1_[redacted]\"],\n  [/\\bsk-[A-Za-z0-9._-]+/g, \"sk-[redacted]\"],\n  [/\\bwhsec_[A-Za-z0-9+/=]+/g, \"whsec_[redacted]\"],\n  [/\\bo11y_[A-Za-z0-9]+/g, \"o11y_[redacted]\"],\n  [/\\b(ghp|gho|github_pat)_[A-Za-z0-9_]+/g, \"$1_[redacted]\"],\n  [/\\bAKIA[A-Z0-9]{12,}/g, \"AKIA[redacted]\"],\n];\n\n/**\n * Return `value` with every secret-shaped substring replaced by a `[redacted]`\n * placeholder that keeps the identifying prefix (e.g. `sk_live_[redacted]`).\n * Matches odla db keys (`odla_sk_`/`odla_dev_`), Clerk secret keys\n * (`sk_live_`/`sk_test_`), OpenAI keys (`sk-`), webhook signing secrets\n * (`whsec_`), o11y tokens (`o11y_`), GitHub tokens (`ghp_`/`gho_`/`github_pat_`),\n * and AWS access-key ids (`AKIA…`). Clerk publishable keys (`pk_test_`/\n * `pk_live_`) are public by design and intentionally left untouched. Used to\n * sanitize anything the CLI echoes (notably network error bodies) before it\n * reaches stdout/stderr. Non-matching input is returned unchanged.\n */\nexport function redactSecrets(value: string): string {\n  let result = value;\n  for (const [pattern, replacement] of REPLACEMENTS) result = result.replace(pattern, replacement);\n  return result;\n}\n\n/**\n * Wrap the CLI's line-oriented output boundary so command implementations\n * cannot accidentally bypass redaction when they print a backend message.\n * Objects and arrays retain their shape for console/test sinks while every\n * nested string is sanitized.\n */\nexport function redactingOutput(\n  output: Pick<typeof console, \"log\" | \"error\">,\n): Pick<typeof console, \"log\" | \"error\"> {\n  const redactArgs = (args: unknown[]) => args.map((value) => redactOutputValue(value, new WeakMap<object, unknown>()));\n  return {\n    log: (...args: unknown[]) => output.log(...redactArgs(args)),\n    error: (...args: unknown[]) => output.error(...redactArgs(args)),\n  };\n}\n\nfunction redactOutputValue(value: unknown, seen: WeakMap<object, unknown>): unknown {\n  if (typeof value === \"string\") return redactSecrets(value);\n  if (value instanceof Error) {\n    const redacted = new Error(redactSecrets(value.message));\n    redacted.name = value.name;\n    if (value.stack) redacted.stack = redactSecrets(value.stack);\n    return redacted;\n  }\n  if (!value || typeof value !== \"object\") return value;\n  const prior = seen.get(value);\n  if (prior) return prior;\n  if (Array.isArray(value)) {\n    const next: unknown[] = [];\n    seen.set(value, next);\n    for (const item of value) next.push(redactOutputValue(item, seen));\n    return next;\n  }\n  const prototype = Object.getPrototypeOf(value);\n  if (prototype !== Object.prototype && prototype !== null) return value;\n  const next: Record<string, unknown> = {};\n  seen.set(value, next);\n  for (const [key, item] of Object.entries(value)) next[key] = redactOutputValue(item, seen);\n  return next;\n}\n\n/** True when a value matches any known secret shape (used for detection, never display). */\nexport function looksSecret(value: string): boolean {\n  return redactSecrets(value) !== value || value.includes(\"-----BEGIN\");\n}\n","// A runbook can be corrected the moment a step is wrong, which means its text\n// routinely runs ahead of the packages a reader has installed: the step is right,\n// and the command it names simply does not exist in their copy yet. `requires`\n// is how a runbook says which version it assumes, so the reader learns that from\n// the runbook instead of from a confusing \"unknown action\" error.\n//\n// Specs are `name@version`, space- or comma-separated, and read as MINIMUMS.\n// Deliberately not semver ranges: the only question worth answering here is\n// \"is what I have new enough\", and a range grammar invites `<` bounds that a\n// runbook has no way to be right about.\n\n/** One package version a runbook assumes. */\nexport interface Requirement {\n  name: string;\n  /** The lowest version whose steps are known to work. */\n  min: string;\n}\n\n/** A requirement the caller does not meet. */\nexport interface UnmetRequirement extends Requirement {\n  /** What is installed, or null when nothing local claims to be this package. */\n  installed: string | null;\n}\n\nconst SPEC = /^(@?[\\w./-]+?)@(\\d+\\.\\d+\\.\\d+(?:[\\w.-]*)?)$/;\n\n/** Parse a `requires` string. Unparseable entries are dropped rather than\n * throwing: a malformed spec must not make a runbook unreadable. */\nexport function parseRequires(value: string | undefined | null): Requirement[] {\n  if (!value) return [];\n  const out: Requirement[] = [];\n  for (const token of value.split(/[\\s,]+/).filter(Boolean)) {\n    const match = SPEC.exec(token);\n    if (match?.[1] && match[2]) out.push({ name: match[1], min: match[2] });\n  }\n  return out;\n}\n\n/** Compare two dotted versions numerically. Pre-release suffixes sort BELOW the\n * release they precede, so `0.18.0-rc.1` does not satisfy `0.18.0`. */\nexport function compareVersions(a: string, b: string): number {\n  const parts = (v: string) => {\n    const [core = \"\", pre = \"\"] = v.split(\"-\", 2);\n    return { nums: core.split(\".\").map((n) => Number.parseInt(n, 10) || 0), pre };\n  };\n  const left = parts(a);\n  const right = parts(b);\n  for (let i = 0; i < Math.max(left.nums.length, right.nums.length); i++) {\n    const diff = (left.nums[i] ?? 0) - (right.nums[i] ?? 0);\n    if (diff) return diff < 0 ? -1 : 1;\n  }\n  if (left.pre === right.pre) return 0;\n  if (!left.pre) return 1;\n  if (!right.pre) return -1;\n  return left.pre < right.pre ? -1 : 1;\n}\n\n/** True when `installed` is at least `min`. */\nexport function satisfies(installed: string, min: string): boolean {\n  return compareVersions(installed, min) >= 0;\n}\n\n/**\n * Which of a runbook's requirements the caller does not meet.\n *\n * `installedVersions` maps a package name to what the caller has. A package the\n * caller knows nothing about is reported with `installed: null` rather than\n * assumed satisfied — silence about an unknown dependency is the failure mode\n * this exists to prevent.\n */\nexport function unmetRequirements(\n  requires: string | undefined | null,\n  installedVersions: Readonly<Record<string, string | undefined>>,\n): UnmetRequirement[] {\n  const unmet: UnmetRequirement[] = [];\n  for (const requirement of parseRequires(requires)) {\n    const installed = installedVersions[requirement.name];\n    if (installed === undefined) {\n      unmet.push({ ...requirement, installed: null });\n    } else if (!satisfies(installed, requirement.min)) {\n      unmet.push({ ...requirement, installed });\n    }\n  }\n  return unmet;\n}\n\n/** The one-line warning shown when a runbook expects more than the caller has. */\nexport function describeUnmet(slug: string, unmet: readonly UnmetRequirement[]): string {\n  const detail = unmet\n    .map((u) => `${u.name}@${u.min}${u.installed ? ` (you have ${u.installed})` : \" (not installed here)\"}`)\n    .join(\", \");\n  return `note: runbook \"${slug}\" expects ${detail} — some steps may name commands your version does not have.`;\n}\n"],"mappings":";;;AAAA,SAAS,oBAAoB;AAEtB,SAAS,aAAqB;AACnC,QAAM,MAAM,KAAK,MAAM,aAAa,IAAI,IAAI,mBAAmB,YAAY,GAAG,GAAG,MAAM,CAAC;AACxF,SAAO,IAAI,WAAW;AACxB;;;ACFO,SAAS,YAAY,KAAsB;AAChD,QAAM,OAAQ,KAAmC;AACjD,MAAI,SAAS,uBAAuB,SAAS,mBAAmB,SAAS,oBAAqB,QAAO;AACrG,MAAI,SAAS,sBAAuB,QAAO;AAC3C,MAAI,SAAS,qBAAsB,QAAO;AAC1C,MAAI,SAAS,cAAe,QAAO;AACnC,MAAI,SAAS,oBAAoB,SAAS,kBAAkB,SAAS,uBAAwB,QAAO;AACpG,SAAO;AACT;;;ACNA,IAAM,eAAwC;AAAA,EAC5C,CAAC,kCAAkC,oBAAoB;AAAA,EACvD,CAAC,kCAAkC,kBAAkB;AAAA,EACrD,CAAC,yBAAyB,eAAe;AAAA,EACzC,CAAC,4BAA4B,kBAAkB;AAAA,EAC/C,CAAC,wBAAwB,iBAAiB;AAAA,EAC1C,CAAC,yCAAyC,eAAe;AAAA,EACzD,CAAC,wBAAwB,gBAAgB;AAC3C;AAaO,SAAS,cAAc,OAAuB;AACnD,MAAI,SAAS;AACb,aAAW,CAAC,SAAS,WAAW,KAAK,aAAc,UAAS,OAAO,QAAQ,SAAS,WAAW;AAC/F,SAAO;AACT;AAQO,SAAS,gBACd,QACuC;AACvC,QAAM,aAAa,CAAC,SAAoB,KAAK,IAAI,CAAC,UAAU,kBAAkB,OAAO,oBAAI,QAAyB,CAAC,CAAC;AACpH,SAAO;AAAA,IACL,KAAK,IAAI,SAAoB,OAAO,IAAI,GAAG,WAAW,IAAI,CAAC;AAAA,IAC3D,OAAO,IAAI,SAAoB,OAAO,MAAM,GAAG,WAAW,IAAI,CAAC;AAAA,EACjE;AACF;AAEA,SAAS,kBAAkB,OAAgB,MAAyC;AAClF,MAAI,OAAO,UAAU,SAAU,QAAO,cAAc,KAAK;AACzD,MAAI,iBAAiB,OAAO;AAC1B,UAAM,WAAW,IAAI,MAAM,cAAc,MAAM,OAAO,CAAC;AACvD,aAAS,OAAO,MAAM;AACtB,QAAI,MAAM,MAAO,UAAS,QAAQ,cAAc,MAAM,KAAK;AAC3D,WAAO;AAAA,EACT;AACA,MAAI,CAAC,SAAS,OAAO,UAAU,SAAU,QAAO;AAChD,QAAM,QAAQ,KAAK,IAAI,KAAK;AAC5B,MAAI,MAAO,QAAO;AAClB,MAAI,MAAM,QAAQ,KAAK,GAAG;AACxB,UAAMA,QAAkB,CAAC;AACzB,SAAK,IAAI,OAAOA,KAAI;AACpB,eAAW,QAAQ,MAAO,CAAAA,MAAK,KAAK,kBAAkB,MAAM,IAAI,CAAC;AACjE,WAAOA;AAAA,EACT;AACA,QAAM,YAAY,OAAO,eAAe,KAAK;AAC7C,MAAI,cAAc,OAAO,aAAa,cAAc,KAAM,QAAO;AACjE,QAAM,OAAgC,CAAC;AACvC,OAAK,IAAI,OAAO,IAAI;AACpB,aAAW,CAAC,KAAK,IAAI,KAAK,OAAO,QAAQ,KAAK,EAAG,MAAK,GAAG,IAAI,kBAAkB,MAAM,IAAI;AACzF,SAAO;AACT;AAGO,SAAS,YAAY,OAAwB;AAClD,SAAO,cAAc,KAAK,MAAM,SAAS,MAAM,SAAS,YAAY;AACtE;;;ACpDA,IAAM,OAAO;AAIN,SAAS,cAAc,OAAiD;AAC7E,MAAI,CAAC,MAAO,QAAO,CAAC;AACpB,QAAM,MAAqB,CAAC;AAC5B,aAAW,SAAS,MAAM,MAAM,QAAQ,EAAE,OAAO,OAAO,GAAG;AACzD,UAAM,QAAQ,KAAK,KAAK,KAAK;AAC7B,QAAI,QAAQ,CAAC,KAAK,MAAM,CAAC,EAAG,KAAI,KAAK,EAAE,MAAM,MAAM,CAAC,GAAG,KAAK,MAAM,CAAC,EAAE,CAAC;AAAA,EACxE;AACA,SAAO;AACT;AAIO,SAAS,gBAAgB,GAAW,GAAmB;AAC5D,QAAM,QAAQ,CAAC,MAAc;AAC3B,UAAM,CAAC,OAAO,IAAI,MAAM,EAAE,IAAI,EAAE,MAAM,KAAK,CAAC;AAC5C,WAAO,EAAE,MAAM,KAAK,MAAM,GAAG,EAAE,IAAI,CAAC,MAAM,OAAO,SAAS,GAAG,EAAE,KAAK,CAAC,GAAG,IAAI;AAAA,EAC9E;AACA,QAAM,OAAO,MAAM,CAAC;AACpB,QAAM,QAAQ,MAAM,CAAC;AACrB,WAAS,IAAI,GAAG,IAAI,KAAK,IAAI,KAAK,KAAK,QAAQ,MAAM,KAAK,MAAM,GAAG,KAAK;AACtE,UAAM,QAAQ,KAAK,KAAK,CAAC,KAAK,MAAM,MAAM,KAAK,CAAC,KAAK;AACrD,QAAI,KAAM,QAAO,OAAO,IAAI,KAAK;AAAA,EACnC;AACA,MAAI,KAAK,QAAQ,MAAM,IAAK,QAAO;AACnC,MAAI,CAAC,KAAK,IAAK,QAAO;AACtB,MAAI,CAAC,MAAM,IAAK,QAAO;AACvB,SAAO,KAAK,MAAM,MAAM,MAAM,KAAK;AACrC;AAGO,SAAS,UAAU,WAAmB,KAAsB;AACjE,SAAO,gBAAgB,WAAW,GAAG,KAAK;AAC5C;AAUO,SAAS,kBACd,UACA,mBACoB;AACpB,QAAM,QAA4B,CAAC;AACnC,aAAW,eAAe,cAAc,QAAQ,GAAG;AACjD,UAAM,YAAY,kBAAkB,YAAY,IAAI;AACpD,QAAI,cAAc,QAAW;AAC3B,YAAM,KAAK,EAAE,GAAG,aAAa,WAAW,KAAK,CAAC;AAAA,IAChD,WAAW,CAAC,UAAU,WAAW,YAAY,GAAG,GAAG;AACjD,YAAM,KAAK,EAAE,GAAG,aAAa,UAAU,CAAC;AAAA,IAC1C;AAAA,EACF;AACA,SAAO;AACT;AAGO,SAAS,cAAc,MAAc,OAA4C;AACtF,QAAM,SAAS,MACZ,IAAI,CAAC,MAAM,GAAG,EAAE,IAAI,IAAI,EAAE,GAAG,GAAG,EAAE,YAAY,cAAc,EAAE,SAAS,MAAM,uBAAuB,EAAE,EACtG,KAAK,IAAI;AACZ,SAAO,kBAAkB,IAAI,aAAa,MAAM;AAClD;","names":["next"]}

package/dist/cli-DCSVQAZ6.js

@@ -0,0 +1,12 @@
+#!/usr/bin/env node
+import {
+  runCli
+} from "./chunk-3WVVHH3Y.js";
+import {
+  exitCodeFor
+} from "./chunk-UKLSRQ5J.js";
+export {
+  exitCodeFor,
+  runCli
+};
+//# sourceMappingURL=cli-DCSVQAZ6.js.map

package/dist/cli-DCSVQAZ6.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":[],"sourcesContent":[],"mappings":"","names":[]}

package/dist/index.cjs

@@ -41,6 +41,7 @@ __export(index_exports, {
   SYSTEM_AI_PURPOSES: () => SYSTEM_AI_PURPOSES,
   acceptedAfter: () => acceptedAfter,
   adminAi: () => adminAi,
+  aiModels: () => aiModels,
   calendarBookingPageUrl: () => calendarBookingPageUrl,
   calendarCalendars: () => calendarCalendars,
   calendarConnect: () => calendarConnect,
@@ -2704,6 +2705,63 @@ function printGroup(out, heading, items) {
   out.log("");
 }
 
+// src/ai-models.ts
+var import_ai = require("@odla-ai/ai");
+async function aiModels(options = {}) {
+  const cfg = await loadProjectConfig(options.configPath ?? "odla.config.mjs");
+  const env = options.env ?? cfg.envs[0] ?? "dev";
+  if (!cfg.envs.includes(env)) throw new Error(`ai models env "${env}" is not declared in config envs`);
+  const url = new URL(`/registry/apps/${encodeURIComponent(cfg.app.id)}/public-config`, cfg.platformUrl);
+  url.searchParams.set("env", env);
+  const response2 = await (options.fetch ?? fetch)(url);
+  if (!response2.ok) throw new Error(`read app AI models failed (${response2.status}): ${await safeText4(response2)}`);
+  const body = await response2.json();
+  if (!body.ai) throw new Error(`ai is not configured for ${cfg.app.id}/${env}`);
+  const mode = body.ai.mode === "hosted" ? "hosted" : "byok";
+  const defaultModel = typeof body.ai.model === "string" ? body.ai.model : void 0;
+  let models;
+  if (mode === "hosted") {
+    if (body.ai.enabled !== true) throw new Error(`hosted ai is disabled for ${cfg.app.id}/${env}`);
+    if (!Array.isArray(body.ai.models) || !body.ai.models.every(isModelSpec)) {
+      throw new Error("platform returned an invalid hosted AI model catalog");
+    }
+    models = body.ai.models;
+  } else {
+    const provider = typeof body.ai.provider === "string" ? body.ai.provider : cfg.ai?.provider;
+    if (!provider) throw new Error(`BYOK ai has no provider for ${cfg.app.id}/${env}`);
+    models = Object.values(import_ai.DEFAULT_CATALOG).filter((model) => model.provider === provider);
+  }
+  if (options.provider) models = models.filter((model) => model.provider === options.provider);
+  models.sort((a, b) => a.provider.localeCompare(b.provider) || a.id.localeCompare(b.id));
+  const out = options.stdout ?? console;
+  if (options.json) {
+    out.log(JSON.stringify({ appId: cfg.app.id, env, mode, defaultModel: defaultModel ?? null, models }, null, 2));
+    return;
+  }
+  out.log("provider	model	default	capabilities");
+  for (const model of models) {
+    out.log([model.provider, model.id, model.id === defaultModel ? "yes" : "", capabilityList(model)].join("	"));
+  }
+}
+function capabilityList(model) {
+  return [
+    model.capabilities.imageIn ? "image" : "",
+    model.capabilities.audioIn ? "audio" : "",
+    model.capabilities.documentIn ? "document" : "",
+    model.capabilities.toolUse ? "tools" : "",
+    model.capabilities.thinking || model.capabilities.effort ? "reasoning" : "",
+    model.capabilities.webSearch || model.superpowers?.webSearch ? "web-search" : ""
+  ].filter(Boolean).join(",");
+}
+function isModelSpec(value2) {
+  if (!value2 || typeof value2 !== "object" || Array.isArray(value2)) return false;
+  const model = value2;
+  return typeof model.id === "string" && typeof model.nativeId === "string" && (model.provider === "anthropic" || model.provider === "openai" || model.provider === "google") && Boolean(model.capabilities) && typeof model.capabilities === "object";
+}
+async function safeText4(response2) {
+  return (await response2.text().catch(() => "request failed")).slice(0, 300);
+}
+
 // src/config-operation-command.ts
 var import_apps6 = require("@odla-ai/apps");
 var import_node_path8 = require("path");
@@ -2884,10 +2942,10 @@ function record2(value2) {
 var import_apps5 = require("@odla-ai/apps");
 
 // src/provision-helpers.ts
-var import_ai = require("@odla-ai/ai");
+var import_ai2 = require("@odla-ai/ai");
 var import_apps4 = require("@odla-ai/apps");
 function defaultSecretName(provider) {
-  const names = import_ai.DEFAULT_SECRET_NAMES;
+  const names = import_ai2.DEFAULT_SECRET_NAMES;
   return names[provider] ?? `${provider}_api_key`;
 }
 async function assertTenantAdminAccess(doFetch, cfg, env, token) {
@@ -2897,7 +2955,7 @@ async function assertTenantAdminAccess(doFetch, cfg, env, token) {
   });
   if (res.ok || res.status === 404) return;
   if (res.status === 403) {
-    const detail = await safeText4(res);
+    const detail = await safeText5(res);
     const code = errorCode(detail);
     if (code === "human_session_required") {
       throw new Error(
@@ -2913,7 +2971,7 @@ async function assertTenantAdminAccess(doFetch, cfg, env, token) {
       `${env}: this credential lacks live app.manage authority for "${cfg.app.id}" (tenant ${tenantId}) \u2014 nothing was minted or written; run "odla-ai provision --request-grant --email <odla-account>" to open a fresh owner review. If the human account is not an owner, an existing owner must add it in signed-in Studio; an agent token cannot repair ownership`
     );
   }
-  throw new Error(`${env}: tenant access preflight (${tenantId}) failed: ${res.status} ${await safeText4(res)}`);
+  throw new Error(`${env}: tenant access preflight (${tenantId}) failed: ${res.status} ${await safeText5(res)}`);
 }
 function errorCode(text2) {
   try {
@@ -2929,7 +2987,7 @@ async function postJson(doFetch, url, bearer, body) {
     headers: { authorization: `Bearer ${bearer}`, "content-type": "application/json" },
     body: JSON.stringify(body)
   });
-  if (!res.ok) throw new Error(`${new URL(url).pathname} failed: ${res.status} ${await safeText4(res)}`);
+  if (!res.ok) throw new Error(`${new URL(url).pathname} failed: ${res.status} ${await safeText5(res)}`);
 }
 function normalizeClerkConfig(value2) {
   if (!value2) return null;
@@ -2942,7 +3000,7 @@ function normalizeClerkConfig(value2) {
   const publishableKey = envValue(cfg.publishableKey);
   return publishableKey ? { publishableKey, ...cfg.audience ? { audience: cfg.audience } : {}, ...cfg.mode ? { mode: cfg.mode } : {} } : null;
 }
-async function safeText4(res) {
+async function safeText5(res) {
   try {
     return redactSecrets((await res.text()).slice(0, 500));
   } catch {
@@ -4263,7 +4321,7 @@ function assertWranglerConfig(cfg) {
 }
 
 // src/secrets-set.ts
-var import_ai2 = require("@odla-ai/ai");
+var import_ai3 = require("@odla-ai/ai");
 var import_apps10 = require("@odla-ai/apps");
 var PROD_ENV_NAMES2 = /* @__PURE__ */ new Set(["prod", "production"]);
 async function secretsSet(options) {
@@ -4277,7 +4335,7 @@ async function secretsSet(options) {
     optionalProjectCapabilities: ["app.manage"]
   });
   try {
-    await (0, import_ai2.putSecret)({ endpoint: cfg.dbEndpoint, token, fetch: doFetch }, tenantId, name, value2);
+    await (0, import_ai3.putSecret)({ endpoint: cfg.dbEndpoint, token, fetch: doFetch }, tenantId, name, value2);
   } catch (err) {
     throw new Error(scrubValue(err instanceof Error ? err.message : String(err), value2));
   }
@@ -4712,7 +4770,7 @@ async function getJson(doFetch, url, bearer) {
   const res = await doFetch(url, {
     headers: bearer ? { authorization: `Bearer ${bearer}` } : void 0
   });
-  if (!res.ok) throw new Error(`${new URL(url).pathname} returned ${res.status}: ${await safeText5(res)}`);
+  if (!res.ok) throw new Error(`${new URL(url).pathname} returned ${res.status}: ${await safeText6(res)}`);
   return res.json();
 }
 async function postJson2(doFetch, url, bearer, body) {
@@ -4721,7 +4779,7 @@ async function postJson2(doFetch, url, bearer, body) {
     headers: { authorization: `Bearer ${bearer}`, "content-type": "application/json" },
     body: JSON.stringify(body)
   });
-  if (!res.ok) throw new Error(`${new URL(url).pathname} returned ${res.status}: ${await safeText5(res)}`);
+  if (!res.ok) throw new Error(`${new URL(url).pathname} returned ${res.status}: ${await safeText6(res)}`);
   return res.json();
 }
 function publicConfigUrl(platformUrl, appId, env) {
@@ -4729,7 +4787,7 @@ function publicConfigUrl(platformUrl, appId, env) {
   url.searchParams.set("env", env);
   return url.toString();
 }
-async function safeText5(res) {
+async function safeText6(res) {
   try {
     return redactSecrets((await res.text()).slice(0, 500));
   } catch {
@@ -4785,6 +4843,20 @@ async function secretsCommand(parsed, deps) {
   });
 }
 async function projectCommand(command, parsed, deps) {
+  if (command === "ai") {
+    const sub = parsed.positionals[1];
+    if (sub !== "models") throw new Error(`unknown ai subcommand "${sub ?? ""}". Try "odla-ai ai models --env dev".`);
+    assertArgs(parsed, ["config", "env", "provider", "json"], 2);
+    await aiModels({
+      configPath: stringOpt(parsed.options.config) ?? "odla.config.mjs",
+      env: stringOpt(parsed.options.env),
+      provider: stringOpt(parsed.options.provider),
+      json: parsed.options.json === true,
+      fetch: deps.fetch,
+      stdout: deps.stdout
+    });
+    return true;
+  }
   if (command === "config") {
     const sub = parsed.positionals[1];
     if (sub !== "diff" && sub !== "plan" && sub !== "apply") {
@@ -8561,6 +8633,7 @@ Usage:
   odla-ai setup [--dir <project>] [--agent <name>] [--global] [--force]
   odla-ai init --app-id <id> --name <name> [--services db,ai,o11y,calendar] [--env dev --env prod] [--ai-provider <byok-provider>]
   odla-ai doctor [--config odla.config.mjs]
+  odla-ai ai models [--config odla.config.mjs] [--env dev] [--provider <id>] [--json]
   odla-ai config <diff|plan> [--config odla.config.mjs] [--email <odla-account>] [--json]
   odla-ai config apply --plan <plan.json> [--idempotency-key <key>] [--email <odla-account>] [--json]
   odla-ai operations get <operation-id> [--json]
@@ -8768,6 +8841,10 @@ Safety:
   production odla.ai \u2014 there is no separate odla to point at. New projects get
   the sandbox only. Add "prod" explicitly to odla.config.mjs and pass --yes to
   provision the live database; use --dry-run first to inspect the resolved plan.
+  A real provision first verifies both the released CLI version and the exact
+  pinned versions of every external @odla-ai runtime module before importing
+  the command graph. A stale workspace module blocks with its resolved path and
+  tells the agent to update/rebase, npm ci, and rebuild.
   Provision caches the approved developer token and service credentials under
   .odla/ with mode 0600, and init adds those paths to .gitignore. Secret push
   preflights Wrangler before any shown-once issuance or destructive rotation.
@@ -10546,7 +10623,7 @@ async function read2(url, headers, doFetch) {
 
 // src/provision.ts
 var import_apps12 = require("@odla-ai/apps");
-var import_ai3 = require("@odla-ai/ai");
+var import_ai4 = require("@odla-ai/ai");
 var import_node_process11 = __toESM(require("process"), 1);
 
 // src/integration-provision.ts
@@ -10660,14 +10737,14 @@ async function mintDbKey(opts, tenantId) {
         appId: tenantId
       })
     });
-    if (!created.ok) throw new Error(`db app create (${tenantId}) failed: ${created.status} ${await safeText6(created)}`);
+    if (!created.ok) throw new Error(`db app create (${tenantId}) failed: ${created.status} ${await safeText7(created)}`);
     res = await opts.fetch(`${opts.cfg.dbEndpoint}/admin/apps/${encodeURIComponent(tenantId)}/keys`, {
       method: "POST",
       headers,
       body: "{}"
     });
   }
-  if (!res.ok) throw new Error(`db key mint (${tenantId}) failed: ${res.status} ${await safeText6(res)}`);
+  if (!res.ok) throw new Error(`db key mint (${tenantId}) failed: ${res.status} ${await safeText7(res)}`);
   const body = await res.json();
   if (!body.key) throw new Error(`db key mint (${tenantId}) returned no key`);
   return body.key;
@@ -10683,12 +10760,12 @@ async function issueO11yToken(opts) {
       `o11y token already exists for env "${opts.env}", but its shown-once value is not in the local credentials file; run "odla-ai provision --rotate-o11y-token --push-secrets" to replace it explicitly`
     );
   }
-  if (!res.ok) throw new Error(`o11y token ${opts.rotateO11y ? "rotation" : "issue"} (${opts.env}) failed: ${res.status} ${await safeText6(res)}`);
+  if (!res.ok) throw new Error(`o11y token ${opts.rotateO11y ? "rotation" : "issue"} (${opts.env}) failed: ${res.status} ${await safeText7(res)}`);
   const body = await res.json();
   if (!body.token) throw new Error(`o11y token ${opts.rotateO11y ? "rotation" : "issue"} (${opts.env}) returned no token`);
   return body.token;
 }
-async function safeText6(res) {
+async function safeText7(res) {
   try {
     return redactSecrets((await res.text()).slice(0, 500));
   } catch {
@@ -10870,7 +10947,7 @@ ${env}: credentials are already saved; retry "odla-ai secrets push --env ${env}$
       const key = import_node_process11.default.env[cfg.ai.keyEnv];
       if (key) {
         const secretName = cfg.ai.secretName ?? defaultSecretName(cfg.ai.provider);
-        await (0, import_ai3.putSecret)({ endpoint: cfg.dbEndpoint, token, fetch: doFetch }, tenantId, secretName, key);
+        await (0, import_ai4.putSecret)({ endpoint: cfg.dbEndpoint, token, fetch: doFetch }, tenantId, secretName, key);
         out.log(`${env}: ${cfg.ai.provider} key stored in vault (${secretName})`);
       } else {
         out.log(`${env}: ${cfg.ai.keyEnv} not set; skipped provider key storage`);
@@ -10943,6 +11020,7 @@ var PM_ENTITIES = {
 };
 var COMMAND_SURFACE = {
   agent: { jobs: {}, retry: {} },
+  ai: { models: {} },
   admin: {
     ai: {
       show: {},
@@ -12802,7 +12880,7 @@ async function securityStatus(parsed, dependencies) {
   }
 }
 
-// src/cli.ts
+// src/exit-code.ts
 function exitCodeFor(err) {
   const code = err?.code;
   if (code === "handshake_pending" || code === "watch_timeout" || code === "operation_pending") return 75;
@@ -12812,6 +12890,8 @@ function exitCodeFor(err) {
   if (code === "invalid_cursor" || code === "invalid_plan" || code === "invalid_operation_id") return 2;
   return 1;
 }
+
+// src/cli.ts
 async function runCli(argv = process.argv.slice(2), dependencies = {}) {
   const runtime = {
     ...dependencies,
@@ -12967,6 +13047,7 @@ async function calendarCommand(parsed, dependencies) {
   SYSTEM_AI_PURPOSES,
   acceptedAfter,
   adminAi,
+  aiModels,
   calendarBookingPageUrl,
   calendarCalendars,
   calendarConnect,