@odla-ai/cli 0.27.15 → 0.27.17

package/README.md

@@ -344,6 +344,7 @@ npx odla-ai whoami
 npx odla-ai setup
 npx odla-ai init --app-id my-app --name "My App"
 npx odla-ai doctor
+npx odla-ai ai models --env dev # exact models this app may select; no admin grant
 npx odla-ai config diff --json
 npx odla-ai config plan --json > .odla/config-plan.json
 npx odla-ai config apply --plan .odla/config-plan.json --json
@@ -753,7 +754,10 @@ otherwise. It never follows an arbitrary shell working directory. Studio display
 exact scope, only an admin can approve it, and it expires after ~15 minutes;
 policy, credential, and usage capabilities are separate and cannot act as the
 approver on ordinary app/db/o11y routes. `admin ai models` reads the server
-catalog. `admin ai set security` updates discovery and independent validation
+catalog. For app code and provisioning, `ai models [--env dev] [--json]` reads
+the app-safe public configuration and lists only the hosted models that exact
+app may select (or the configured provider's local catalog in BYOK mode), with
+the default and generic capabilities. `admin ai set security` updates discovery and independent validation
 together with expected revisions; a concurrent edit returns 409 and reloads
 instead of being overwritten. `admin ai usage` requests its own read-only
 capability and lists metadata-only events and status aggregates; narrow it with

package/dist/bin.cjs

@@ -3035,6 +3035,71 @@ var init_capabilities = __esm({
   }
 });
 
+// src/ai-models.ts
+async function aiModels(options = {}) {
+  const cfg = await loadProjectConfig(options.configPath ?? "odla.config.mjs");
+  const env = options.env ?? cfg.envs[0] ?? "dev";
+  if (!cfg.envs.includes(env)) throw new Error(`ai models env "${env}" is not declared in config envs`);
+  const url = new URL(`/registry/apps/${encodeURIComponent(cfg.app.id)}/public-config`, cfg.platformUrl);
+  url.searchParams.set("env", env);
+  const response2 = await (options.fetch ?? fetch)(url);
+  if (!response2.ok) throw new Error(`read app AI models failed (${response2.status}): ${await safeText4(response2)}`);
+  const body = await response2.json();
+  if (!body.ai) throw new Error(`ai is not configured for ${cfg.app.id}/${env}`);
+  const mode = body.ai.mode === "hosted" ? "hosted" : "byok";
+  const defaultModel = typeof body.ai.model === "string" ? body.ai.model : void 0;
+  let models;
+  if (mode === "hosted") {
+    if (body.ai.enabled !== true) throw new Error(`hosted ai is disabled for ${cfg.app.id}/${env}`);
+    if (!Array.isArray(body.ai.models) || !body.ai.models.every(isModelSpec)) {
+      throw new Error("platform returned an invalid hosted AI model catalog");
+    }
+    models = body.ai.models;
+  } else {
+    const provider = typeof body.ai.provider === "string" ? body.ai.provider : cfg.ai?.provider;
+    if (!provider) throw new Error(`BYOK ai has no provider for ${cfg.app.id}/${env}`);
+    models = Object.values(import_ai.DEFAULT_CATALOG).filter((model) => model.provider === provider);
+  }
+  if (options.provider) models = models.filter((model) => model.provider === options.provider);
+  models.sort((a, b) => a.provider.localeCompare(b.provider) || a.id.localeCompare(b.id));
+  const out = options.stdout ?? console;
+  if (options.json) {
+    out.log(JSON.stringify({ appId: cfg.app.id, env, mode, defaultModel: defaultModel ?? null, models }, null, 2));
+    return;
+  }
+  out.log("provider	model	default	capabilities");
+  for (const model of models) {
+    out.log([model.provider, model.id, model.id === defaultModel ? "yes" : "", capabilityList(model)].join("	"));
+  }
+}
+function capabilityList(model) {
+  return [
+    model.capabilities.imageIn ? "image" : "",
+    model.capabilities.audioIn ? "audio" : "",
+    model.capabilities.documentIn ? "document" : "",
+    model.capabilities.toolUse ? "tools" : "",
+    model.capabilities.thinking || model.capabilities.effort ? "reasoning" : "",
+    model.capabilities.webSearch || model.superpowers?.webSearch ? "web-search" : ""
+  ].filter(Boolean).join(",");
+}
+function isModelSpec(value2) {
+  if (!value2 || typeof value2 !== "object" || Array.isArray(value2)) return false;
+  const model = value2;
+  return typeof model.id === "string" && typeof model.nativeId === "string" && (model.provider === "anthropic" || model.provider === "openai" || model.provider === "google") && Boolean(model.capabilities) && typeof model.capabilities === "object";
+}
+async function safeText4(response2) {
+  return (await response2.text().catch(() => "request failed")).slice(0, 300);
+}
+var import_ai;
+var init_ai_models = __esm({
+  "src/ai-models.ts"() {
+    "use strict";
+    init_cjs_shims();
+    import_ai = require("@odla-ai/ai");
+    init_config();
+  }
+});
+
 // src/config-operation-error.ts
 var ConfigOperationCommandError;
 var init_config_operation_error = __esm({
@@ -3223,7 +3288,7 @@ var init_config_operation_validate = __esm({
 
 // src/provision-helpers.ts
 function defaultSecretName(provider) {
-  const names = import_ai.DEFAULT_SECRET_NAMES;
+  const names = import_ai2.DEFAULT_SECRET_NAMES;
   return names[provider] ?? `${provider}_api_key`;
 }
 async function assertTenantAdminAccess(doFetch, cfg, env, token) {
@@ -3233,7 +3298,7 @@ async function assertTenantAdminAccess(doFetch, cfg, env, token) {
   });
   if (res.ok || res.status === 404) return;
   if (res.status === 403) {
-    const detail = await safeText4(res);
+    const detail = await safeText5(res);
     const code = errorCode(detail);
     if (code === "human_session_required") {
       throw new Error(
@@ -3249,7 +3314,7 @@ async function assertTenantAdminAccess(doFetch, cfg, env, token) {
       `${env}: this credential lacks live app.manage authority for "${cfg.app.id}" (tenant ${tenantId}) \u2014 nothing was minted or written; run "odla-ai provision --request-grant --email <odla-account>" to open a fresh owner review. If the human account is not an owner, an existing owner must add it in signed-in Studio; an agent token cannot repair ownership`
     );
   }
-  throw new Error(`${env}: tenant access preflight (${tenantId}) failed: ${res.status} ${await safeText4(res)}`);
+  throw new Error(`${env}: tenant access preflight (${tenantId}) failed: ${res.status} ${await safeText5(res)}`);
 }
 function errorCode(text2) {
   try {
@@ -3265,7 +3330,7 @@ async function postJson(doFetch, url, bearer, body) {
     headers: { authorization: `Bearer ${bearer}`, "content-type": "application/json" },
     body: JSON.stringify(body)
   });
-  if (!res.ok) throw new Error(`${new URL(url).pathname} failed: ${res.status} ${await safeText4(res)}`);
+  if (!res.ok) throw new Error(`${new URL(url).pathname} failed: ${res.status} ${await safeText5(res)}`);
 }
 function normalizeClerkConfig(value2) {
   if (!value2) return null;
@@ -3278,19 +3343,19 @@ function normalizeClerkConfig(value2) {
   const publishableKey = envValue(cfg.publishableKey);
   return publishableKey ? { publishableKey, ...cfg.audience ? { audience: cfg.audience } : {}, ...cfg.mode ? { mode: cfg.mode } : {} } : null;
 }
-async function safeText4(res) {
+async function safeText5(res) {
   try {
     return redactSecrets((await res.text()).slice(0, 500));
   } catch {
     return "";
   }
 }
-var import_ai, import_apps4;
+var import_ai2, import_apps4;
 var init_provision_helpers = __esm({
   "src/provision-helpers.ts"() {
     "use strict";
     init_cjs_shims();
-    import_ai = require("@odla-ai/ai");
+    import_ai2 = require("@odla-ai/ai");
     import_apps4 = require("@odla-ai/apps");
     init_config();
     init_redact();
@@ -4745,7 +4810,7 @@ async function secretsSet(options) {
     optionalProjectCapabilities: ["app.manage"]
   });
   try {
-    await (0, import_ai2.putSecret)({ endpoint: cfg.dbEndpoint, token, fetch: doFetch }, tenantId, name, value2);
+    await (0, import_ai3.putSecret)({ endpoint: cfg.dbEndpoint, token, fetch: doFetch }, tenantId, name, value2);
   } catch (err) {
     throw new Error(scrubValue(err instanceof Error ? err.message : String(err), value2));
   }
@@ -4790,12 +4855,12 @@ async function resolveVaultWrite(options) {
   const value2 = await secretInputValue(options, "secret");
   return { cfg, tenantId: (0, import_apps10.tenantIdFor)(cfg.app.id, options.env), value: value2, doFetch, out };
 }
-var import_ai2, import_apps10, PROD_ENV_NAMES2;
+var import_ai3, import_apps10, PROD_ENV_NAMES2;
 var init_secrets_set = __esm({
   "src/secrets-set.ts"() {
     "use strict";
     init_cjs_shims();
-    import_ai2 = require("@odla-ai/ai");
+    import_ai3 = require("@odla-ai/ai");
     import_apps10 = require("@odla-ai/apps");
     init_config();
     init_redact();
@@ -5207,7 +5272,7 @@ async function getJson(doFetch, url, bearer) {
   const res = await doFetch(url, {
     headers: bearer ? { authorization: `Bearer ${bearer}` } : void 0
   });
-  if (!res.ok) throw new Error(`${new URL(url).pathname} returned ${res.status}: ${await safeText5(res)}`);
+  if (!res.ok) throw new Error(`${new URL(url).pathname} returned ${res.status}: ${await safeText6(res)}`);
   return res.json();
 }
 async function postJson2(doFetch, url, bearer, body) {
@@ -5216,7 +5281,7 @@ async function postJson2(doFetch, url, bearer, body) {
     headers: { authorization: `Bearer ${bearer}`, "content-type": "application/json" },
     body: JSON.stringify(body)
   });
-  if (!res.ok) throw new Error(`${new URL(url).pathname} returned ${res.status}: ${await safeText5(res)}`);
+  if (!res.ok) throw new Error(`${new URL(url).pathname} returned ${res.status}: ${await safeText6(res)}`);
   return res.json();
 }
 function publicConfigUrl(platformUrl, appId, env) {
@@ -5224,7 +5289,7 @@ function publicConfigUrl(platformUrl, appId, env) {
   url.searchParams.set("env", env);
   return url.toString();
 }
-async function safeText5(res) {
+async function safeText6(res) {
   try {
     return redactSecrets((await res.text()).slice(0, 500));
   } catch {
@@ -5291,6 +5356,20 @@ async function secretsCommand(parsed, deps) {
   });
 }
 async function projectCommand(command, parsed, deps) {
+  if (command === "ai") {
+    const sub = parsed.positionals[1];
+    if (sub !== "models") throw new Error(`unknown ai subcommand "${sub ?? ""}". Try "odla-ai ai models --env dev".`);
+    assertArgs(parsed, ["config", "env", "provider", "json"], 2);
+    await aiModels({
+      configPath: stringOpt(parsed.options.config) ?? "odla.config.mjs",
+      env: stringOpt(parsed.options.env),
+      provider: stringOpt(parsed.options.provider),
+      json: parsed.options.json === true,
+      fetch: deps.fetch,
+      stdout: deps.stdout
+    });
+    return true;
+  }
   if (command === "config") {
     const sub = parsed.positionals[1];
     if (sub !== "diff" && sub !== "plan" && sub !== "apply") {
@@ -5413,6 +5492,7 @@ var init_cli_project = __esm({
     init_cjs_shims();
     init_argv();
     init_capabilities();
+    init_ai_models();
     init_config_operation_command();
     init_config_reconcile_command();
     init_doctor();
@@ -9208,6 +9288,7 @@ Usage:
   odla-ai setup [--dir <project>] [--agent <name>] [--global] [--force]
   odla-ai init --app-id <id> --name <name> [--services db,ai,o11y,calendar] [--env dev --env prod] [--ai-provider <byok-provider>]
   odla-ai doctor [--config odla.config.mjs]
+  odla-ai ai models [--config odla.config.mjs] [--env dev] [--provider <id>] [--json]
   odla-ai config <diff|plan> [--config odla.config.mjs] [--email <odla-account>] [--json]
   odla-ai config apply --plan <plan.json> [--idempotency-key <key>] [--email <odla-account>] [--json]
   odla-ai operations get <operation-id> [--json]
@@ -11468,14 +11549,14 @@ async function mintDbKey(opts, tenantId) {
         appId: tenantId
       })
     });
-    if (!created.ok) throw new Error(`db app create (${tenantId}) failed: ${created.status} ${await safeText6(created)}`);
+    if (!created.ok) throw new Error(`db app create (${tenantId}) failed: ${created.status} ${await safeText7(created)}`);
     res = await opts.fetch(`${opts.cfg.dbEndpoint}/admin/apps/${encodeURIComponent(tenantId)}/keys`, {
       method: "POST",
       headers,
       body: "{}"
     });
   }
-  if (!res.ok) throw new Error(`db key mint (${tenantId}) failed: ${res.status} ${await safeText6(res)}`);
+  if (!res.ok) throw new Error(`db key mint (${tenantId}) failed: ${res.status} ${await safeText7(res)}`);
   const body = await res.json();
   if (!body.key) throw new Error(`db key mint (${tenantId}) returned no key`);
   return body.key;
@@ -11491,12 +11572,12 @@ async function issueO11yToken(opts) {
       `o11y token already exists for env "${opts.env}", but its shown-once value is not in the local credentials file; run "odla-ai provision --rotate-o11y-token --push-secrets" to replace it explicitly`
     );
   }
-  if (!res.ok) throw new Error(`o11y token ${opts.rotateO11y ? "rotation" : "issue"} (${opts.env}) failed: ${res.status} ${await safeText6(res)}`);
+  if (!res.ok) throw new Error(`o11y token ${opts.rotateO11y ? "rotation" : "issue"} (${opts.env}) failed: ${res.status} ${await safeText7(res)}`);
   const body = await res.json();
   if (!body.token) throw new Error(`o11y token ${opts.rotateO11y ? "rotation" : "issue"} (${opts.env}) returned no token`);
   return body.token;
 }
-async function safeText6(res) {
+async function safeText7(res) {
   try {
     return redactSecrets((await res.text()).slice(0, 500));
   } catch {
@@ -11688,7 +11769,7 @@ ${env}: credentials are already saved; retry "odla-ai secrets push --env ${env}$
       const key = import_node_process11.default.env[cfg.ai.keyEnv];
       if (key) {
         const secretName = cfg.ai.secretName ?? defaultSecretName(cfg.ai.provider);
-        await (0, import_ai3.putSecret)({ endpoint: cfg.dbEndpoint, token, fetch: doFetch }, tenantId, secretName, key);
+        await (0, import_ai4.putSecret)({ endpoint: cfg.dbEndpoint, token, fetch: doFetch }, tenantId, secretName, key);
         out.log(`${env}: ${cfg.ai.provider} key stored in vault (${secretName})`);
       } else {
         out.log(`${env}: ${cfg.ai.keyEnv} not set; skipped provider key storage`);
@@ -11724,13 +11805,13 @@ ${env}: credentials are already saved; retry "odla-ai secrets push --env ${env}$
     }
   }
 }
-var import_apps12, import_ai3, import_node_process11;
+var import_apps12, import_ai4, import_node_process11;
 var init_provision = __esm({
   "src/provision.ts"() {
     "use strict";
     init_cjs_shims();
     import_apps12 = require("@odla-ai/apps");
-    import_ai3 = require("@odla-ai/ai");
+    import_ai4 = require("@odla-ai/ai");
     import_node_process11 = __toESM(require("process"), 1);
     init_config();
     init_calendar();
@@ -11819,6 +11900,7 @@ var init_surface = __esm({
     };
     COMMAND_SURFACE = {
       agent: { jobs: {}, retry: {} },
+      ai: { models: {} },
       admin: {
         ai: {
           show: {},