@odla-ai/cli 0.27.4 → 0.27.5

package/README.md

@@ -7,14 +7,14 @@
 
 Project-neutral provisioning CLI for odla apps. It creates and validates an
 `odla.config.mjs`, then uses that config to register an app, enable services,
-push odla-db schema/rules, configure per-app BYOK AI, configure Clerk auth, record
+push odla-db schema/rules, configure hosted app AI (or explicit BYOK), configure Clerk auth, record
 deployment links, compose declared npm capability integrations, connect Google Calendar booking, provision o11y ingest credentials, and transfer local or
 deployed Worker secrets without printing them. It also gives platform admins a
 scoped System AI control surface and gives app owners a provider-key-free
 hosted security command.
 
 Provisioning does not know about any specific app. App identity, environments,
-services, schema, rules, integrations, auth, AI provider, and links all come
+services, schema, rules, integrations, auth, AI mode/model, and links all come
 from config. Operator commands can also receive explicit platform/app/env
 context so remote agents are not forced to manufacture a project checkout.
 
@@ -485,8 +485,8 @@ shown-once credential.
 5. Collision-checks and merges declared integration schema/rule fragments,
    pushes the composed database contract, and creates integration seeds only
    when their natural-key rows are absent.
-6. Configures platform AI and stores provider keys in the tenant vault when the
-   configured key env var is set.
+6. Configures hosted app AI by default. An explicit BYOK config stores its
+   provider key in the tenant vault when the configured key env var is set.
 7. For calendar, reads owner-visible connection status and, when needed, asks
    the platform for a state-bound Google authorization URL and opens only the
    exact Google OAuth endpoint (or a same-platform interstitial). The human completes consent there;
@@ -730,7 +730,8 @@ change events with actor attribution; credential values never enter that trail.
 It never returns prompts, repository source, model output, reports, or provider
 credentials. Credential writes accept only
 `--from-env <NAME>` or `--stdin` and never place the value in argv, output, or
-the cache. System AI and each app's BYOK AI are separate vault/funding paths.
+the cache. System AI and hosted app AI have separate routes and accounting;
+explicit BYOK has its own app-tenant vault path.
 Discovery and validation provider/model settings are authoritative server
 policy: a security command has no field that can override either route. Admin
 bounds can only narrow the hard ceilings of 64 calls per role/run and, for each
@@ -829,10 +830,9 @@ export default {
     defaultRules: "deny",
     publicRead: [], // namespaces where a `view: "true"` rule is intentional
   },
-  ai: {
-    provider: process.env.ODLA_AI_PROVIDER ?? "anthropic",
-    keyEnv: "ANTHROPIC_API_KEY",
-  },
+  ai: { mode: "hosted" },
+  // BYOK compatibility instead:
+  // ai: { mode: "byok", provider: "anthropic", keyEnv: "ANTHROPIC_API_KEY" },
   calendar: {
     google: {
       availabilityCalendars: { dev: ["primary"] },

package/dist/bin.cjs

@@ -1001,6 +1001,32 @@ var import_node_path4 = require("path");
 var import_node_url = require("url");
 var import_apps = require("@odla-ai/apps");
 
+// src/ai-config-validation.ts
+function validateAiConfig(cfg, path) {
+  if (cfg.ai === void 0) return;
+  if (!isRecord4(cfg.ai)) throw new Error(`${path}: ai must be an object`);
+  assertOnly(cfg.ai, ["mode", "provider", "model", "keyEnv", "secretName"], `${path}: ai`);
+  if (cfg.ai.mode !== void 0 && cfg.ai.mode !== "hosted" && cfg.ai.mode !== "byok") {
+    throw new Error(`${path}: ai.mode must be hosted or byok`);
+  }
+  if (cfg.ai.mode === "byok" && !safeText(cfg.ai.provider, 100)) {
+    throw new Error(`${path}: ai.provider is required when ai.mode is byok`);
+  }
+  if (cfg.ai.mode === "hosted" && (cfg.ai.provider || cfg.ai.keyEnv || cfg.ai.secretName)) {
+    throw new Error(`${path}: hosted ai cannot configure a provider, keyEnv, or secretName`);
+  }
+}
+function assertOnly(value2, allowed, label) {
+  const extra = Object.keys(value2).find((key) => !allowed.includes(key));
+  if (extra) throw new Error(`${label}.${extra} is not supported`);
+}
+function isRecord4(value2) {
+  return value2 !== null && typeof value2 === "object" && !Array.isArray(value2);
+}
+function safeText(value2, max) {
+  return typeof value2 === "string" && value2.trim().length > 0 && value2.length <= max && !/[\u0000-\u001f\u007f]/.test(value2);
+}
+
 // src/integration-validation.ts
 function validateIntegrations(cfg, path, defaultServices) {
   if (cfg.integrations === void 0) return;
@@ -1008,16 +1034,16 @@ function validateIntegrations(cfg, path, defaultServices) {
   const ids = /* @__PURE__ */ new Set();
   for (const [index, integration] of cfg.integrations.entries()) {
     const at = `${path}: integrations[${index}]`;
-    if (!isRecord4(integration)) throw new Error(`${at} must be an object`);
+    if (!isRecord5(integration)) throw new Error(`${at} must be an object`);
     if (!validId(integration.id)) throw new Error(`${at}.id must be lowercase letters, numbers, and hyphens`);
     if (ids.has(integration.id)) throw new Error(`${path}: duplicate integration id "${integration.id}"`);
     ids.add(integration.id);
-    if (!safeText(integration.title, 200)) throw new Error(`${at}.title is required`);
-    if (!safeText(integration.npm, 200)) throw new Error(`${at}.npm is required`);
-    if (integration.schema !== void 0 && (!isRecord4(integration.schema) || !isRecord4(integration.schema.entities))) {
+    if (!safeText2(integration.title, 200)) throw new Error(`${at}.title is required`);
+    if (!safeText2(integration.npm, 200)) throw new Error(`${at}.npm is required`);
+    if (integration.schema !== void 0 && (!isRecord5(integration.schema) || !isRecord5(integration.schema.entities))) {
       throw new Error(`${at}.schema must contain an entities object`);
     }
-    if (integration.rules !== void 0 && !isRecord4(integration.rules)) throw new Error(`${at}.rules must be an object`);
+    if (integration.rules !== void 0 && !isRecord5(integration.rules)) throw new Error(`${at}.rules must be an object`);
     validateSeeds(integration, at);
     validateProbes(integration, at);
   }
@@ -1031,13 +1057,13 @@ function validateSeeds(integration, at) {
   const ids = /* @__PURE__ */ new Set();
   for (const [index, seed] of integration.seeds.entries()) {
     const sat = `${at}.seeds[${index}]`;
-    if (!isRecord4(seed) || !safeText(seed.id, 200) || !safeText(seed.ns, 200)) throw new Error(`${sat} requires id and ns`);
+    if (!isRecord5(seed) || !safeText2(seed.id, 200) || !safeText2(seed.ns, 200)) throw new Error(`${sat} requires id and ns`);
     if (ids.has(seed.id)) throw new Error(`${at} has duplicate seed id "${seed.id}"`);
     ids.add(seed.id);
-    if (!isRecord4(seed.key) || !safeText(seed.key.attr, 200) || !safeText(seed.key.value, 2048)) {
+    if (!isRecord5(seed.key) || !safeText2(seed.key.attr, 200) || !safeText2(seed.key.value, 2048)) {
       throw new Error(`${sat}.key requires string attr and value`);
     }
-    if (!isRecord4(seed.attrs)) throw new Error(`${sat}.attrs must be an object`);
+    if (!isRecord5(seed.attrs)) throw new Error(`${sat}.attrs must be an object`);
     if (Object.hasOwn(seed.attrs, seed.key.attr) && seed.attrs[seed.key.attr] !== seed.key.value) {
       throw new Error(`${sat}.attrs.${seed.key.attr} conflicts with its natural key`);
     }
@@ -1048,16 +1074,16 @@ function validateProbes(integration, at) {
   if (!Array.isArray(integration.probes)) throw new Error(`${at}.probes must be an array`);
   for (const [index, probe] of integration.probes.entries()) {
     const pat = `${at}.probes[${index}]`;
-    if (!isRecord4(probe) || !safeProbePath(probe.path)) throw new Error(`${pat}.path must be an absolute path without query or fragment`);
+    if (!isRecord5(probe) || !safeProbePath(probe.path)) throw new Error(`${pat}.path must be an absolute path without query or fragment`);
     if (!Number.isInteger(probe.expectedStatus) || probe.expectedStatus < 100 || probe.expectedStatus > 599) {
       throw new Error(`${pat}.expectedStatus must be an HTTP status`);
     }
   }
 }
-function isRecord4(value2) {
+function isRecord5(value2) {
   return value2 !== null && typeof value2 === "object" && !Array.isArray(value2);
 }
-function safeText(value2, max) {
+function safeText2(value2, max) {
   return typeof value2 === "string" && value2.trim().length > 0 && value2.length <= max && !/[\u0000-\u001f\u007f]/.test(value2);
 }
 function safeProbePath(value2) {
@@ -1187,6 +1213,7 @@ function validateRawConfig(raw, path) {
   if (cfg.services !== void 0 && (!Array.isArray(cfg.services) || cfg.services.some((service) => typeof service !== "string" || !service.trim()))) {
     throw new Error(`${path}: services must be an array of non-empty names`);
   }
+  validateAiConfig(cfg, path);
   validateIntegrations(cfg, path, DEFAULT_SERVICES);
 }
 function validateCalendarConfig(cfg, envs, services, path) {
@@ -1195,11 +1222,11 @@ function validateCalendarConfig(cfg, envs, services, path) {
     if (enabled) throw new Error(`${path}: calendar.google is required when services includes "calendar"`);
     return;
   }
-  if (!isRecord5(cfg.calendar)) throw new Error(`${path}: calendar must be an object`);
-  assertOnly(cfg.calendar, ["google"], `${path}: calendar`);
-  if (!isRecord5(cfg.calendar.google)) throw new Error(`${path}: calendar.google must be an object`);
+  if (!isRecord6(cfg.calendar)) throw new Error(`${path}: calendar must be an object`);
+  assertOnly2(cfg.calendar, ["google"], `${path}: calendar`);
+  if (!isRecord6(cfg.calendar.google)) throw new Error(`${path}: calendar.google must be an object`);
   const google = cfg.calendar.google;
-  assertOnly(
+  assertOnly2(
     google,
     ["availabilityCalendars", "calendars", "bookingCalendar", "bookingPageUrl"],
     `${path}: calendar.google`
@@ -1209,7 +1236,7 @@ function validateCalendarConfig(cfg, envs, services, path) {
     throw new Error(`${path}: calendar.google requires exactly one of availabilityCalendars or calendars (legacy)`);
   }
   const availability = google[availabilityKey];
-  if (!isRecord5(availability)) throw new Error(`${path}: calendar.google.${availabilityKey} must map env names to calendar ids`);
+  if (!isRecord6(availability)) throw new Error(`${path}: calendar.google.${availabilityKey} must map env names to calendar ids`);
   const unknownEnv = Object.keys(availability).find((env) => !envs.includes(env));
   if (unknownEnv) throw new Error(`${path}: calendar.google.${availabilityKey}.${unknownEnv} is not in config envs`);
   for (const env of envs) {
@@ -1220,22 +1247,22 @@ function validateCalendarConfig(cfg, envs, services, path) {
     if (ids.length > 10) {
       throw new Error(`${path}: calendar.google.${availabilityKey}.${env} must contain at most 10 calendar ids`);
     }
-    if (ids.some((id) => !safeText2(id, 1024))) {
+    if (ids.some((id) => !safeText3(id, 1024))) {
       throw new Error(`${path}: calendar.google.${availabilityKey}.${env} contains an invalid calendar id`);
     }
   }
   if (google.bookingCalendar !== void 0) {
-    if (!isRecord5(google.bookingCalendar)) throw new Error(`${path}: calendar.google.bookingCalendar must map env names to one calendar id`);
+    if (!isRecord6(google.bookingCalendar)) throw new Error(`${path}: calendar.google.bookingCalendar must map env names to one calendar id`);
     const unknownBookingEnv = Object.keys(google.bookingCalendar).find((env) => !envs.includes(env));
     if (unknownBookingEnv) throw new Error(`${path}: calendar.google.bookingCalendar.${unknownBookingEnv} is not in config envs`);
     for (const [env, value2] of Object.entries(google.bookingCalendar)) {
-      if (!safeText2(value2, 1024)) {
+      if (!safeText3(value2, 1024)) {
         throw new Error(`${path}: calendar.google.bookingCalendar.${env} must be a calendar id`);
       }
     }
   }
   if (google.bookingPageUrl !== void 0) {
-    if (!isRecord5(google.bookingPageUrl)) throw new Error(`${path}: calendar.google.bookingPageUrl must map env names to HTTPS URLs or null`);
+    if (!isRecord6(google.bookingPageUrl)) throw new Error(`${path}: calendar.google.bookingPageUrl must map env names to HTTPS URLs or null`);
     const unknownBookingEnv = Object.keys(google.bookingPageUrl).find((env) => !envs.includes(env));
     if (unknownBookingEnv) throw new Error(`${path}: calendar.google.bookingPageUrl.${unknownBookingEnv} is not in config envs`);
     for (const [env, value2] of Object.entries(google.bookingPageUrl)) {
@@ -1258,14 +1285,14 @@ function validateServices(services, path) {
     }
   }
 }
-function assertOnly(value2, allowed, label) {
+function assertOnly2(value2, allowed, label) {
   const extra = Object.keys(value2).find((key) => !allowed.includes(key));
   if (extra) throw new Error(`${label}.${extra} is not supported`);
 }
-function isRecord5(value2) {
+function isRecord6(value2) {
   return value2 !== null && typeof value2 === "object" && !Array.isArray(value2);
 }
-function safeText2(value2, max) {
+function safeText3(value2, max) {
   return typeof value2 === "string" && value2.trim().length > 0 && value2.length <= max && !/[\u0000-\u001f\u007f]/.test(value2);
 }
 function safeHttpsUrl(value2) {
@@ -3062,7 +3089,7 @@ async function assertTenantAdminAccess(doFetch, cfg, env, token) {
       `${env}: you are not an owner of "${cfg.app.id}" (tenant ${tenantId}) \u2014 nothing was minted or written; ask an existing owner to run "odla-ai app owners add <your-email>", then re-run provision`
     );
   }
-  throw new Error(`${env}: tenant access preflight (${tenantId}) failed: ${res.status} ${await safeText3(res)}`);
+  throw new Error(`${env}: tenant access preflight (${tenantId}) failed: ${res.status} ${await safeText4(res)}`);
 }
 async function postJson(doFetch, url, bearer, body) {
   const res = await doFetch(url, {
@@ -3070,7 +3097,7 @@ async function postJson(doFetch, url, bearer, body) {
     headers: { authorization: `Bearer ${bearer}`, "content-type": "application/json" },
     body: JSON.stringify(body)
   });
-  if (!res.ok) throw new Error(`${new URL(url).pathname} failed: ${res.status} ${await safeText3(res)}`);
+  if (!res.ok) throw new Error(`${new URL(url).pathname} failed: ${res.status} ${await safeText4(res)}`);
 }
 function normalizeClerkConfig(value2) {
   if (!value2) return null;
@@ -3083,7 +3110,7 @@ function normalizeClerkConfig(value2) {
   const publishableKey = envValue(cfg.publishableKey);
   return publishableKey ? { publishableKey, ...cfg.audience ? { audience: cfg.audience } : {}, ...cfg.mode ? { mode: cfg.mode } : {} } : null;
 }
-async function safeText3(res) {
+async function safeText4(res) {
   try {
     return redactSecrets((await res.text()).slice(0, 500));
   } catch {
@@ -4065,18 +4092,18 @@ function assertSeedContracts(integrations, schema) {
   }
 }
 function isUniqueAttr(schema, ns, attr) {
-  if (!isRecord6(schema) || !isRecord6(schema.entities)) return false;
+  if (!isRecord7(schema) || !isRecord7(schema.entities)) return false;
   const entity = schema.entities[ns];
-  if (!isRecord6(entity) || !isRecord6(entity.attrs)) return false;
+  if (!isRecord7(entity) || !isRecord7(entity.attrs)) return false;
   const definition = entity.attrs[attr];
-  return isRecord6(definition) && definition.unique === true;
+  return isRecord7(definition) && definition.unique === true;
 }
 function normalizeSchema(value2) {
   if (value2 === void 0 || value2 === null) return { entities: {}, links: {} };
-  if (!isRecord6(value2) || !isRecord6(value2.entities)) {
+  if (!isRecord7(value2) || !isRecord7(value2.entities)) {
     throw new Error("db schema must be a serialized schema object with an entities map");
   }
-  if (value2.links !== void 0 && !isRecord6(value2.links)) throw new Error("db schema links must be an object");
+  if (value2.links !== void 0 && !isRecord7(value2.links)) throw new Error("db schema links must be an object");
   return {
     entities: { ...value2.entities },
     links: { ...value2.links ?? {} }
@@ -4090,7 +4117,7 @@ function mergeMap(target, fragment, label) {
     target[name] = value2;
   }
 }
-function isRecord6(value2) {
+function isRecord7(value2) {
   return value2 !== null && typeof value2 === "object" && !Array.isArray(value2);
 }
 
@@ -4109,7 +4136,7 @@ async function doctor(options) {
   out.log(`integrations: ${plan.integrations.length ? plan.integrations.join(", ") : "none"}`);
   out.log(`schema: ${schema ? `${entities.length} entities` : "none"}`);
   out.log(`rules:  ${rules ? `${Object.keys(rules).length} namespaces` : "none"}`);
-  out.log(`ai:     ${cfg.services.includes("ai") ? cfg.ai?.provider ?? "not configured" : "not enabled"}`);
+  out.log(`ai:     ${cfg.services.includes("ai") ? cfg.ai?.provider ? `byok/${cfg.ai.provider}` : "hosted" : "not enabled"}`);
   if (cfg.services.includes("calendar")) {
     const calendar = cfg.envs.map((env) => {
       const resolved = calendarServiceConfig(cfg, env);
@@ -4130,7 +4157,9 @@ async function doctor(options) {
     }
   }
   warnings.push(...integrationWarnings(database.integrations, schema, rules));
-  if (cfg.services.includes("ai") && !cfg.ai?.provider) warnings.push("ai service is enabled but ai.provider is not set");
+  if (cfg.services.includes("ai") && cfg.ai?.mode === "byok" && !cfg.ai.provider) {
+    warnings.push("ai.mode is byok but ai.provider is not set");
+  }
   if (cfg.auth?.clerk) {
     for (const [env, value2] of Object.entries(cfg.auth.clerk)) {
       if (typeof value2 === "string" && value2.startsWith("$") && !process.env[value2.slice(1)]) {
@@ -4210,7 +4239,7 @@ function initProject(options) {
       if (!services.includes(dependency)) throw new Error(`--services ${service} requires ${dependency}`);
     }
   }
-  const aiProvider = options.aiProvider ?? "anthropic";
+  const aiProvider = options.aiProvider;
   (0, import_node_fs13.mkdirSync)((0, import_node_path12.dirname)(configPath), { recursive: true });
   (0, import_node_fs13.mkdirSync)((0, import_node_path12.resolve)(rootDir, "src/odla"), { recursive: true });
   (0, import_node_fs13.mkdirSync)((0, import_node_path12.resolve)(rootDir, ".odla"), { recursive: true });
@@ -4237,6 +4266,15 @@ function configTemplate(input) {
     },
   },
 ` : "";
+  const ai = input.aiProvider ? `  ai: {
+    mode: "byok",
+    provider: process.env.ODLA_AI_PROVIDER ?? "${input.aiProvider}",
+    // Optional: set this env var while running provision to store the provider
+    // key in the app vault for each tenant.
+    keyEnv: "${defaultKeyEnv(input.aiProvider)}",
+  },` : `  // Hosted AI uses admin-approved models and central cost tracking.
+  // Pass --ai-provider during init only when this app must use BYOK.
+  ai: { mode: "hosted" },`;
   return `export default {
   platformUrl: process.env.ODLA_PLATFORM_URL ?? "https://odla.ai",
   dbEndpoint: process.env.ODLA_ENDPOINT ?? process.env.ODLA_DB_ENDPOINT ?? "https://db.odla.ai",
@@ -4255,12 +4293,7 @@ function configTemplate(input) {
     // When rules is omitted, the CLI generates deny-all rules from schema.
     defaultRules: "deny",
   },
-  ai: {
-    provider: process.env.ODLA_AI_PROVIDER ?? "${input.aiProvider}",
-    // Optional: set this env var while running provision to store the provider
-    // key in the platform vault for each tenant.
-    keyEnv: "${defaultKeyEnv(input.aiProvider)}",
-  },
+${ai}
 ${calendar}
   auth: {
     clerk: {
@@ -4756,12 +4789,16 @@ async function smoke(options) {
   out.log(`  tenant: ${entry.tenantId}`);
   const publicConfig = await getJson(doFetch, publicConfigUrl(cfg.platformUrl, cfg.app.id, env), void 0);
   out.log(`  public-config: ok`);
-  if (cfg.ai?.provider) {
+  if (cfg.services.includes("ai") && cfg.ai?.provider) {
     const provider = publicConfig.ai?.provider ?? null;
     if (provider !== cfg.ai.provider) {
       throw new Error(`ai provider mismatch: expected "${cfg.ai.provider}", public-config has "${provider ?? "none"}"`);
     }
-    out.log(`  ai: ${provider}`);
+    out.log(`  ai: byok/${provider}`);
+  } else if (cfg.services.includes("ai")) {
+    const mode = publicConfig.ai?.mode;
+    if (mode !== "hosted") throw new Error(`ai mode mismatch: expected "hosted", public-config has "${String(mode ?? "none")}"`);
+    out.log("  ai: hosted");
   }
   if (hasO11y) out.log(`  o11y: credentials present`);
   if (cfg.services.includes("calendar")) {
@@ -4839,7 +4876,7 @@ async function getJson(doFetch, url, bearer) {
   const res = await doFetch(url, {
     headers: bearer ? { authorization: `Bearer ${bearer}` } : void 0
   });
-  if (!res.ok) throw new Error(`${new URL(url).pathname} returned ${res.status}: ${await safeText4(res)}`);
+  if (!res.ok) throw new Error(`${new URL(url).pathname} returned ${res.status}: ${await safeText5(res)}`);
   return res.json();
 }
 async function postJson2(doFetch, url, bearer, body) {
@@ -4848,7 +4885,7 @@ async function postJson2(doFetch, url, bearer, body) {
     headers: { authorization: `Bearer ${bearer}`, "content-type": "application/json" },
     body: JSON.stringify(body)
   });
-  if (!res.ok) throw new Error(`${new URL(url).pathname} returned ${res.status}: ${await safeText4(res)}`);
+  if (!res.ok) throw new Error(`${new URL(url).pathname} returned ${res.status}: ${await safeText5(res)}`);
   return res.json();
 }
 function publicConfigUrl(platformUrl, appId, env) {
@@ -4856,7 +4893,7 @@ function publicConfigUrl(platformUrl, appId, env) {
   url.searchParams.set("env", env);
   return url.toString();
 }
-async function safeText4(res) {
+async function safeText5(res) {
   try {
     return redactSecrets((await res.text()).slice(0, 500));
   } catch {
@@ -8686,7 +8723,7 @@ Start here:
 
 Usage:
   odla-ai setup [--dir <project>] [--agent <name>] [--global] [--force]
-  odla-ai init --app-id <id> --name <name> [--services db,ai,o11y,calendar] [--env dev --env prod]
+  odla-ai init --app-id <id> --name <name> [--services db,ai,o11y,calendar] [--env dev --env prod] [--ai-provider <byok-provider>]
   odla-ai doctor [--config odla.config.mjs]
   odla-ai config <diff|plan> [--config odla.config.mjs] [--email <odla-account>] [--json]
   odla-ai config apply --plan <plan.json> [--idempotency-key <key>] [--email <odla-account>] [--json]
@@ -10679,7 +10716,7 @@ async function provisionIntegrationSeeds(doFetch, endpoint, tenantId, dbKey, int
       const payload = await postJson3(doFetch, `${base}/query`, dbKey, {
         query: { [seed.ns]: { $: { where: { [seed.key.attr]: seed.key.value }, limit: 1 } } }
       });
-      const rows = isRecord7(payload) && isRecord7(payload.result) ? payload.result[seed.ns] : void 0;
+      const rows = isRecord8(payload) && isRecord8(payload.result) ? payload.result[seed.ns] : void 0;
       if (!Array.isArray(rows)) {
         throw new Error(`${env}: integration ${integration.id} seed ${seed.id} query returned an invalid response`);
       }
@@ -10711,7 +10748,7 @@ async function postJson3(doFetch, url, bearer, body) {
   if (!res.ok) throw new Error(`${new URL(url).pathname} failed: ${res.status} ${await responseText(res)}`);
   return res.json().catch(() => ({}));
 }
-function isRecord7(value2) {
+function isRecord8(value2) {
   return value2 !== null && typeof value2 === "object" && !Array.isArray(value2);
 }
 async function responseText(res) {
@@ -10781,14 +10818,14 @@ async function mintDbKey(opts, tenantId) {
         appId: tenantId
       })
     });
-    if (!created.ok) throw new Error(`db app create (${tenantId}) failed: ${created.status} ${await safeText5(created)}`);
+    if (!created.ok) throw new Error(`db app create (${tenantId}) failed: ${created.status} ${await safeText6(created)}`);
     res = await opts.fetch(`${opts.cfg.dbEndpoint}/admin/apps/${encodeURIComponent(tenantId)}/keys`, {
       method: "POST",
       headers,
       body: "{}"
     });
   }
-  if (!res.ok) throw new Error(`db key mint (${tenantId}) failed: ${res.status} ${await safeText5(res)}`);
+  if (!res.ok) throw new Error(`db key mint (${tenantId}) failed: ${res.status} ${await safeText6(res)}`);
   const body = await res.json();
   if (!body.key) throw new Error(`db key mint (${tenantId}) returned no key`);
   return body.key;
@@ -10804,12 +10841,12 @@ async function issueO11yToken(opts) {
       `o11y token already exists for env "${opts.env}", but its shown-once value is not in the local credentials file; run "odla-ai provision --rotate-o11y-token --push-secrets" to replace it explicitly`
     );
   }
-  if (!res.ok) throw new Error(`o11y token ${opts.rotateO11y ? "rotation" : "issue"} (${opts.env}) failed: ${res.status} ${await safeText5(res)}`);
+  if (!res.ok) throw new Error(`o11y token ${opts.rotateO11y ? "rotation" : "issue"} (${opts.env}) failed: ${res.status} ${await safeText6(res)}`);
   const body = await res.json();
   if (!body.token) throw new Error(`o11y token ${opts.rotateO11y ? "rotation" : "issue"} (${opts.env}) returned no token`);
   return body.token;
 }
-async function safeText5(res) {
+async function safeText6(res) {
   try {
     return redactSecrets((await res.text()).slice(0, 500));
   } catch {
@@ -10852,7 +10889,7 @@ async function provision(options) {
       const namespaces = Object.keys(integration.schema?.entities ?? {}).length;
       out.log(`  integration.${integration.id}: ${namespaces} namespaces, ${integration.seeds?.length ?? 0} seeds, ${integration.probes?.length ?? 0} smoke probes`);
     }
-    out.log(`  ai:     ${cfg.services.includes("ai") ? cfg.ai?.provider ?? "not configured" : "not enabled"}`);
+    out.log(`  ai:     ${cfg.services.includes("ai") ? cfg.ai?.provider ?? "hosted" : "not enabled"}`);
     if (cfg.services.includes("calendar")) {
       for (const env of cfg.envs) {
         const calendar = calendarServiceConfig(cfg, env);
@@ -10903,11 +10940,11 @@ async function provision(options) {
     for (const service of serviceOrder) {
       if (service === "ai") {
         if (cfg.ai?.provider) {
-          await apps.setAi(cfg.app.id, env, { provider: cfg.ai.provider, ...cfg.ai.model ? { model: cfg.ai.model } : {} });
-          out.log(`${env}: ai configured (${cfg.ai.provider}${cfg.ai.model ? `/${cfg.ai.model}` : ""})`);
+          await apps.setAi(cfg.app.id, env, { mode: "byok", provider: cfg.ai.provider, ...cfg.ai.model ? { model: cfg.ai.model } : {} });
+          out.log(`${env}: ai configured (byok ${cfg.ai.provider}${cfg.ai.model ? `/${cfg.ai.model}` : ""})`);
         } else {
-          await apps.setService(cfg.app.id, "ai", true, { env });
-          out.log(`${env}: ai enabled`);
+          await apps.setAi(cfg.app.id, env, { mode: "hosted", ...cfg.ai?.model ? { model: cfg.ai.model } : {} });
+          out.log(`${env}: ai configured (hosted${cfg.ai?.model ? `/${cfg.ai.model}` : ""})`);
         }
       } else {
         const config = service === "calendar" ? calendarServiceConfig(cfg, env) : void 0;