@odla-ai/cli 0.27.4 → 0.27.5

package/dist/index.cjs

@@ -1069,6 +1069,32 @@ var import_node_path4 = require("path");
 var import_node_url = require("url");
 var import_apps = require("@odla-ai/apps");
 
+// src/ai-config-validation.ts
+function validateAiConfig(cfg, path) {
+  if (cfg.ai === void 0) return;
+  if (!isRecord4(cfg.ai)) throw new Error(`${path}: ai must be an object`);
+  assertOnly(cfg.ai, ["mode", "provider", "model", "keyEnv", "secretName"], `${path}: ai`);
+  if (cfg.ai.mode !== void 0 && cfg.ai.mode !== "hosted" && cfg.ai.mode !== "byok") {
+    throw new Error(`${path}: ai.mode must be hosted or byok`);
+  }
+  if (cfg.ai.mode === "byok" && !safeText(cfg.ai.provider, 100)) {
+    throw new Error(`${path}: ai.provider is required when ai.mode is byok`);
+  }
+  if (cfg.ai.mode === "hosted" && (cfg.ai.provider || cfg.ai.keyEnv || cfg.ai.secretName)) {
+    throw new Error(`${path}: hosted ai cannot configure a provider, keyEnv, or secretName`);
+  }
+}
+function assertOnly(value2, allowed, label) {
+  const extra = Object.keys(value2).find((key) => !allowed.includes(key));
+  if (extra) throw new Error(`${label}.${extra} is not supported`);
+}
+function isRecord4(value2) {
+  return value2 !== null && typeof value2 === "object" && !Array.isArray(value2);
+}
+function safeText(value2, max) {
+  return typeof value2 === "string" && value2.trim().length > 0 && value2.length <= max && !/[\u0000-\u001f\u007f]/.test(value2);
+}
+
 // src/integration-validation.ts
 function validateIntegrations(cfg, path, defaultServices) {
   if (cfg.integrations === void 0) return;
@@ -1076,16 +1102,16 @@ function validateIntegrations(cfg, path, defaultServices) {
   const ids = /* @__PURE__ */ new Set();
   for (const [index, integration] of cfg.integrations.entries()) {
     const at = `${path}: integrations[${index}]`;
-    if (!isRecord4(integration)) throw new Error(`${at} must be an object`);
+    if (!isRecord5(integration)) throw new Error(`${at} must be an object`);
     if (!validId(integration.id)) throw new Error(`${at}.id must be lowercase letters, numbers, and hyphens`);
     if (ids.has(integration.id)) throw new Error(`${path}: duplicate integration id "${integration.id}"`);
     ids.add(integration.id);
-    if (!safeText(integration.title, 200)) throw new Error(`${at}.title is required`);
-    if (!safeText(integration.npm, 200)) throw new Error(`${at}.npm is required`);
-    if (integration.schema !== void 0 && (!isRecord4(integration.schema) || !isRecord4(integration.schema.entities))) {
+    if (!safeText2(integration.title, 200)) throw new Error(`${at}.title is required`);
+    if (!safeText2(integration.npm, 200)) throw new Error(`${at}.npm is required`);
+    if (integration.schema !== void 0 && (!isRecord5(integration.schema) || !isRecord5(integration.schema.entities))) {
       throw new Error(`${at}.schema must contain an entities object`);
     }
-    if (integration.rules !== void 0 && !isRecord4(integration.rules)) throw new Error(`${at}.rules must be an object`);
+    if (integration.rules !== void 0 && !isRecord5(integration.rules)) throw new Error(`${at}.rules must be an object`);
     validateSeeds(integration, at);
     validateProbes(integration, at);
   }
@@ -1099,13 +1125,13 @@ function validateSeeds(integration, at) {
   const ids = /* @__PURE__ */ new Set();
   for (const [index, seed] of integration.seeds.entries()) {
     const sat = `${at}.seeds[${index}]`;
-    if (!isRecord4(seed) || !safeText(seed.id, 200) || !safeText(seed.ns, 200)) throw new Error(`${sat} requires id and ns`);
+    if (!isRecord5(seed) || !safeText2(seed.id, 200) || !safeText2(seed.ns, 200)) throw new Error(`${sat} requires id and ns`);
     if (ids.has(seed.id)) throw new Error(`${at} has duplicate seed id "${seed.id}"`);
     ids.add(seed.id);
-    if (!isRecord4(seed.key) || !safeText(seed.key.attr, 200) || !safeText(seed.key.value, 2048)) {
+    if (!isRecord5(seed.key) || !safeText2(seed.key.attr, 200) || !safeText2(seed.key.value, 2048)) {
       throw new Error(`${sat}.key requires string attr and value`);
     }
-    if (!isRecord4(seed.attrs)) throw new Error(`${sat}.attrs must be an object`);
+    if (!isRecord5(seed.attrs)) throw new Error(`${sat}.attrs must be an object`);
     if (Object.hasOwn(seed.attrs, seed.key.attr) && seed.attrs[seed.key.attr] !== seed.key.value) {
       throw new Error(`${sat}.attrs.${seed.key.attr} conflicts with its natural key`);
     }
@@ -1116,16 +1142,16 @@ function validateProbes(integration, at) {
   if (!Array.isArray(integration.probes)) throw new Error(`${at}.probes must be an array`);
   for (const [index, probe] of integration.probes.entries()) {
     const pat = `${at}.probes[${index}]`;
-    if (!isRecord4(probe) || !safeProbePath(probe.path)) throw new Error(`${pat}.path must be an absolute path without query or fragment`);
+    if (!isRecord5(probe) || !safeProbePath(probe.path)) throw new Error(`${pat}.path must be an absolute path without query or fragment`);
     if (!Number.isInteger(probe.expectedStatus) || probe.expectedStatus < 100 || probe.expectedStatus > 599) {
       throw new Error(`${pat}.expectedStatus must be an HTTP status`);
     }
   }
 }
-function isRecord4(value2) {
+function isRecord5(value2) {
   return value2 !== null && typeof value2 === "object" && !Array.isArray(value2);
 }
-function safeText(value2, max) {
+function safeText2(value2, max) {
   return typeof value2 === "string" && value2.trim().length > 0 && value2.length <= max && !/[\u0000-\u001f\u007f]/.test(value2);
 }
 function safeProbePath(value2) {
@@ -1255,6 +1281,7 @@ function validateRawConfig(raw, path) {
   if (cfg.services !== void 0 && (!Array.isArray(cfg.services) || cfg.services.some((service) => typeof service !== "string" || !service.trim()))) {
     throw new Error(`${path}: services must be an array of non-empty names`);
   }
+  validateAiConfig(cfg, path);
   validateIntegrations(cfg, path, DEFAULT_SERVICES);
 }
 function validateCalendarConfig(cfg, envs, services, path) {
@@ -1263,11 +1290,11 @@ function validateCalendarConfig(cfg, envs, services, path) {
     if (enabled) throw new Error(`${path}: calendar.google is required when services includes "calendar"`);
     return;
   }
-  if (!isRecord5(cfg.calendar)) throw new Error(`${path}: calendar must be an object`);
-  assertOnly(cfg.calendar, ["google"], `${path}: calendar`);
-  if (!isRecord5(cfg.calendar.google)) throw new Error(`${path}: calendar.google must be an object`);
+  if (!isRecord6(cfg.calendar)) throw new Error(`${path}: calendar must be an object`);
+  assertOnly2(cfg.calendar, ["google"], `${path}: calendar`);
+  if (!isRecord6(cfg.calendar.google)) throw new Error(`${path}: calendar.google must be an object`);
   const google = cfg.calendar.google;
-  assertOnly(
+  assertOnly2(
     google,
     ["availabilityCalendars", "calendars", "bookingCalendar", "bookingPageUrl"],
     `${path}: calendar.google`
@@ -1277,7 +1304,7 @@ function validateCalendarConfig(cfg, envs, services, path) {
     throw new Error(`${path}: calendar.google requires exactly one of availabilityCalendars or calendars (legacy)`);
   }
   const availability = google[availabilityKey];
-  if (!isRecord5(availability)) throw new Error(`${path}: calendar.google.${availabilityKey} must map env names to calendar ids`);
+  if (!isRecord6(availability)) throw new Error(`${path}: calendar.google.${availabilityKey} must map env names to calendar ids`);
   const unknownEnv = Object.keys(availability).find((env) => !envs.includes(env));
   if (unknownEnv) throw new Error(`${path}: calendar.google.${availabilityKey}.${unknownEnv} is not in config envs`);
   for (const env of envs) {
@@ -1288,22 +1315,22 @@ function validateCalendarConfig(cfg, envs, services, path) {
     if (ids.length > 10) {
       throw new Error(`${path}: calendar.google.${availabilityKey}.${env} must contain at most 10 calendar ids`);
     }
-    if (ids.some((id) => !safeText2(id, 1024))) {
+    if (ids.some((id) => !safeText3(id, 1024))) {
       throw new Error(`${path}: calendar.google.${availabilityKey}.${env} contains an invalid calendar id`);
     }
   }
   if (google.bookingCalendar !== void 0) {
-    if (!isRecord5(google.bookingCalendar)) throw new Error(`${path}: calendar.google.bookingCalendar must map env names to one calendar id`);
+    if (!isRecord6(google.bookingCalendar)) throw new Error(`${path}: calendar.google.bookingCalendar must map env names to one calendar id`);
     const unknownBookingEnv = Object.keys(google.bookingCalendar).find((env) => !envs.includes(env));
     if (unknownBookingEnv) throw new Error(`${path}: calendar.google.bookingCalendar.${unknownBookingEnv} is not in config envs`);
     for (const [env, value2] of Object.entries(google.bookingCalendar)) {
-      if (!safeText2(value2, 1024)) {
+      if (!safeText3(value2, 1024)) {
         throw new Error(`${path}: calendar.google.bookingCalendar.${env} must be a calendar id`);
       }
     }
   }
   if (google.bookingPageUrl !== void 0) {
-    if (!isRecord5(google.bookingPageUrl)) throw new Error(`${path}: calendar.google.bookingPageUrl must map env names to HTTPS URLs or null`);
+    if (!isRecord6(google.bookingPageUrl)) throw new Error(`${path}: calendar.google.bookingPageUrl must map env names to HTTPS URLs or null`);
     const unknownBookingEnv = Object.keys(google.bookingPageUrl).find((env) => !envs.includes(env));
     if (unknownBookingEnv) throw new Error(`${path}: calendar.google.bookingPageUrl.${unknownBookingEnv} is not in config envs`);
     for (const [env, value2] of Object.entries(google.bookingPageUrl)) {
@@ -1326,14 +1353,14 @@ function validateServices(services, path) {
     }
   }
 }
-function assertOnly(value2, allowed, label) {
+function assertOnly2(value2, allowed, label) {
   const extra = Object.keys(value2).find((key) => !allowed.includes(key));
   if (extra) throw new Error(`${label}.${extra} is not supported`);
 }
-function isRecord5(value2) {
+function isRecord6(value2) {
   return value2 !== null && typeof value2 === "object" && !Array.isArray(value2);
 }
-function safeText2(value2, max) {
+function safeText3(value2, max) {
   return typeof value2 === "string" && value2.trim().length > 0 && value2.length <= max && !/[\u0000-\u001f\u007f]/.test(value2);
 }
 function safeHttpsUrl(value2) {
@@ -3130,7 +3157,7 @@ async function assertTenantAdminAccess(doFetch, cfg, env, token) {
       `${env}: you are not an owner of "${cfg.app.id}" (tenant ${tenantId}) \u2014 nothing was minted or written; ask an existing owner to run "odla-ai app owners add <your-email>", then re-run provision`
     );
   }
-  throw new Error(`${env}: tenant access preflight (${tenantId}) failed: ${res.status} ${await safeText3(res)}`);
+  throw new Error(`${env}: tenant access preflight (${tenantId}) failed: ${res.status} ${await safeText4(res)}`);
 }
 async function postJson(doFetch, url, bearer, body) {
   const res = await doFetch(url, {
@@ -3138,7 +3165,7 @@ async function postJson(doFetch, url, bearer, body) {
     headers: { authorization: `Bearer ${bearer}`, "content-type": "application/json" },
     body: JSON.stringify(body)
   });
-  if (!res.ok) throw new Error(`${new URL(url).pathname} failed: ${res.status} ${await safeText3(res)}`);
+  if (!res.ok) throw new Error(`${new URL(url).pathname} failed: ${res.status} ${await safeText4(res)}`);
 }
 function normalizeClerkConfig(value2) {
   if (!value2) return null;
@@ -3151,7 +3178,7 @@ function normalizeClerkConfig(value2) {
   const publishableKey = envValue(cfg.publishableKey);
   return publishableKey ? { publishableKey, ...cfg.audience ? { audience: cfg.audience } : {}, ...cfg.mode ? { mode: cfg.mode } : {} } : null;
 }
-async function safeText3(res) {
+async function safeText4(res) {
   try {
     return redactSecrets((await res.text()).slice(0, 500));
   } catch {
@@ -4133,18 +4160,18 @@ function assertSeedContracts(integrations, schema) {
   }
 }
 function isUniqueAttr(schema, ns, attr) {
-  if (!isRecord6(schema) || !isRecord6(schema.entities)) return false;
+  if (!isRecord7(schema) || !isRecord7(schema.entities)) return false;
   const entity = schema.entities[ns];
-  if (!isRecord6(entity) || !isRecord6(entity.attrs)) return false;
+  if (!isRecord7(entity) || !isRecord7(entity.attrs)) return false;
   const definition = entity.attrs[attr];
-  return isRecord6(definition) && definition.unique === true;
+  return isRecord7(definition) && definition.unique === true;
 }
 function normalizeSchema(value2) {
   if (value2 === void 0 || value2 === null) return { entities: {}, links: {} };
-  if (!isRecord6(value2) || !isRecord6(value2.entities)) {
+  if (!isRecord7(value2) || !isRecord7(value2.entities)) {
     throw new Error("db schema must be a serialized schema object with an entities map");
   }
-  if (value2.links !== void 0 && !isRecord6(value2.links)) throw new Error("db schema links must be an object");
+  if (value2.links !== void 0 && !isRecord7(value2.links)) throw new Error("db schema links must be an object");
   return {
     entities: { ...value2.entities },
     links: { ...value2.links ?? {} }
@@ -4158,7 +4185,7 @@ function mergeMap(target, fragment, label) {
     target[name] = value2;
   }
 }
-function isRecord6(value2) {
+function isRecord7(value2) {
   return value2 !== null && typeof value2 === "object" && !Array.isArray(value2);
 }
 
@@ -4177,7 +4204,7 @@ async function doctor(options) {
   out.log(`integrations: ${plan.integrations.length ? plan.integrations.join(", ") : "none"}`);
   out.log(`schema: ${schema ? `${entities.length} entities` : "none"}`);
   out.log(`rules:  ${rules ? `${Object.keys(rules).length} namespaces` : "none"}`);
-  out.log(`ai:     ${cfg.services.includes("ai") ? cfg.ai?.provider ?? "not configured" : "not enabled"}`);
+  out.log(`ai:     ${cfg.services.includes("ai") ? cfg.ai?.provider ? `byok/${cfg.ai.provider}` : "hosted" : "not enabled"}`);
   if (cfg.services.includes("calendar")) {
     const calendar = cfg.envs.map((env) => {
       const resolved = calendarServiceConfig(cfg, env);
@@ -4198,7 +4225,9 @@ async function doctor(options) {
     }
   }
   warnings.push(...integrationWarnings(database.integrations, schema, rules));
-  if (cfg.services.includes("ai") && !cfg.ai?.provider) warnings.push("ai service is enabled but ai.provider is not set");
+  if (cfg.services.includes("ai") && cfg.ai?.mode === "byok" && !cfg.ai.provider) {
+    warnings.push("ai.mode is byok but ai.provider is not set");
+  }
   if (cfg.auth?.clerk) {
     for (const [env, value2] of Object.entries(cfg.auth.clerk)) {
       if (typeof value2 === "string" && value2.startsWith("$") && !process.env[value2.slice(1)]) {
@@ -4278,7 +4307,7 @@ function initProject(options) {
       if (!services.includes(dependency)) throw new Error(`--services ${service} requires ${dependency}`);
     }
   }
-  const aiProvider = options.aiProvider ?? "anthropic";
+  const aiProvider = options.aiProvider;
   (0, import_node_fs13.mkdirSync)((0, import_node_path12.dirname)(configPath), { recursive: true });
   (0, import_node_fs13.mkdirSync)((0, import_node_path12.resolve)(rootDir, "src/odla"), { recursive: true });
   (0, import_node_fs13.mkdirSync)((0, import_node_path12.resolve)(rootDir, ".odla"), { recursive: true });
@@ -4305,6 +4334,15 @@ function configTemplate(input) {
     },
   },
 ` : "";
+  const ai = input.aiProvider ? `  ai: {
+    mode: "byok",
+    provider: process.env.ODLA_AI_PROVIDER ?? "${input.aiProvider}",
+    // Optional: set this env var while running provision to store the provider
+    // key in the app vault for each tenant.
+    keyEnv: "${defaultKeyEnv(input.aiProvider)}",
+  },` : `  // Hosted AI uses admin-approved models and central cost tracking.
+  // Pass --ai-provider during init only when this app must use BYOK.
+  ai: { mode: "hosted" },`;
   return `export default {
   platformUrl: process.env.ODLA_PLATFORM_URL ?? "https://odla.ai",
   dbEndpoint: process.env.ODLA_ENDPOINT ?? process.env.ODLA_DB_ENDPOINT ?? "https://db.odla.ai",
@@ -4323,12 +4361,7 @@ function configTemplate(input) {
     // When rules is omitted, the CLI generates deny-all rules from schema.
     defaultRules: "deny",
   },
-  ai: {
-    provider: process.env.ODLA_AI_PROVIDER ?? "${input.aiProvider}",
-    // Optional: set this env var while running provision to store the provider
-    // key in the platform vault for each tenant.
-    keyEnv: "${defaultKeyEnv(input.aiProvider)}",
-  },
+${ai}
 ${calendar}
   auth: {
     clerk: {
@@ -4824,12 +4857,16 @@ async function smoke(options) {
   out.log(`  tenant: ${entry.tenantId}`);
   const publicConfig = await getJson(doFetch, publicConfigUrl(cfg.platformUrl, cfg.app.id, env), void 0);
   out.log(`  public-config: ok`);
-  if (cfg.ai?.provider) {
+  if (cfg.services.includes("ai") && cfg.ai?.provider) {
     const provider = publicConfig.ai?.provider ?? null;
     if (provider !== cfg.ai.provider) {
       throw new Error(`ai provider mismatch: expected "${cfg.ai.provider}", public-config has "${provider ?? "none"}"`);
     }
-    out.log(`  ai: ${provider}`);
+    out.log(`  ai: byok/${provider}`);
+  } else if (cfg.services.includes("ai")) {
+    const mode = publicConfig.ai?.mode;
+    if (mode !== "hosted") throw new Error(`ai mode mismatch: expected "hosted", public-config has "${String(mode ?? "none")}"`);
+    out.log("  ai: hosted");
   }
   if (hasO11y) out.log(`  o11y: credentials present`);
   if (cfg.services.includes("calendar")) {
@@ -4907,7 +4944,7 @@ async function getJson(doFetch, url, bearer) {
   const res = await doFetch(url, {
     headers: bearer ? { authorization: `Bearer ${bearer}` } : void 0
   });
-  if (!res.ok) throw new Error(`${new URL(url).pathname} returned ${res.status}: ${await safeText4(res)}`);
+  if (!res.ok) throw new Error(`${new URL(url).pathname} returned ${res.status}: ${await safeText5(res)}`);
   return res.json();
 }
 async function postJson2(doFetch, url, bearer, body) {
@@ -4916,7 +4953,7 @@ async function postJson2(doFetch, url, bearer, body) {
     headers: { authorization: `Bearer ${bearer}`, "content-type": "application/json" },
     body: JSON.stringify(body)
   });
-  if (!res.ok) throw new Error(`${new URL(url).pathname} returned ${res.status}: ${await safeText4(res)}`);
+  if (!res.ok) throw new Error(`${new URL(url).pathname} returned ${res.status}: ${await safeText5(res)}`);
   return res.json();
 }
 function publicConfigUrl(platformUrl, appId, env) {
@@ -4924,7 +4961,7 @@ function publicConfigUrl(platformUrl, appId, env) {
   url.searchParams.set("env", env);
   return url.toString();
 }
-async function safeText4(res) {
+async function safeText5(res) {
   try {
     return redactSecrets((await res.text()).slice(0, 500));
   } catch {
@@ -8754,7 +8791,7 @@ Start here:
 
 Usage:
   odla-ai setup [--dir <project>] [--agent <name>] [--global] [--force]
-  odla-ai init --app-id <id> --name <name> [--services db,ai,o11y,calendar] [--env dev --env prod]
+  odla-ai init --app-id <id> --name <name> [--services db,ai,o11y,calendar] [--env dev --env prod] [--ai-provider <byok-provider>]
   odla-ai doctor [--config odla.config.mjs]
   odla-ai config <diff|plan> [--config odla.config.mjs] [--email <odla-account>] [--json]
   odla-ai config apply --plan <plan.json> [--idempotency-key <key>] [--email <odla-account>] [--json]
@@ -10747,7 +10784,7 @@ async function provisionIntegrationSeeds(doFetch, endpoint, tenantId, dbKey, int
       const payload = await postJson3(doFetch, `${base}/query`, dbKey, {
         query: { [seed.ns]: { $: { where: { [seed.key.attr]: seed.key.value }, limit: 1 } } }
       });
-      const rows = isRecord7(payload) && isRecord7(payload.result) ? payload.result[seed.ns] : void 0;
+      const rows = isRecord8(payload) && isRecord8(payload.result) ? payload.result[seed.ns] : void 0;
       if (!Array.isArray(rows)) {
         throw new Error(`${env}: integration ${integration.id} seed ${seed.id} query returned an invalid response`);
       }
@@ -10779,7 +10816,7 @@ async function postJson3(doFetch, url, bearer, body) {
   if (!res.ok) throw new Error(`${new URL(url).pathname} failed: ${res.status} ${await responseText(res)}`);
   return res.json().catch(() => ({}));
 }
-function isRecord7(value2) {
+function isRecord8(value2) {
   return value2 !== null && typeof value2 === "object" && !Array.isArray(value2);
 }
 async function responseText(res) {
@@ -10849,14 +10886,14 @@ async function mintDbKey(opts, tenantId) {
         appId: tenantId
       })
     });
-    if (!created.ok) throw new Error(`db app create (${tenantId}) failed: ${created.status} ${await safeText5(created)}`);
+    if (!created.ok) throw new Error(`db app create (${tenantId}) failed: ${created.status} ${await safeText6(created)}`);
     res = await opts.fetch(`${opts.cfg.dbEndpoint}/admin/apps/${encodeURIComponent(tenantId)}/keys`, {
       method: "POST",
       headers,
       body: "{}"
     });
   }
-  if (!res.ok) throw new Error(`db key mint (${tenantId}) failed: ${res.status} ${await safeText5(res)}`);
+  if (!res.ok) throw new Error(`db key mint (${tenantId}) failed: ${res.status} ${await safeText6(res)}`);
   const body = await res.json();
   if (!body.key) throw new Error(`db key mint (${tenantId}) returned no key`);
   return body.key;
@@ -10872,12 +10909,12 @@ async function issueO11yToken(opts) {
       `o11y token already exists for env "${opts.env}", but its shown-once value is not in the local credentials file; run "odla-ai provision --rotate-o11y-token --push-secrets" to replace it explicitly`
     );
   }
-  if (!res.ok) throw new Error(`o11y token ${opts.rotateO11y ? "rotation" : "issue"} (${opts.env}) failed: ${res.status} ${await safeText5(res)}`);
+  if (!res.ok) throw new Error(`o11y token ${opts.rotateO11y ? "rotation" : "issue"} (${opts.env}) failed: ${res.status} ${await safeText6(res)}`);
   const body = await res.json();
   if (!body.token) throw new Error(`o11y token ${opts.rotateO11y ? "rotation" : "issue"} (${opts.env}) returned no token`);
   return body.token;
 }
-async function safeText5(res) {
+async function safeText6(res) {
   try {
     return redactSecrets((await res.text()).slice(0, 500));
   } catch {
@@ -10920,7 +10957,7 @@ async function provision(options) {
       const namespaces = Object.keys(integration.schema?.entities ?? {}).length;
       out.log(`  integration.${integration.id}: ${namespaces} namespaces, ${integration.seeds?.length ?? 0} seeds, ${integration.probes?.length ?? 0} smoke probes`);
     }
-    out.log(`  ai:     ${cfg.services.includes("ai") ? cfg.ai?.provider ?? "not configured" : "not enabled"}`);
+    out.log(`  ai:     ${cfg.services.includes("ai") ? cfg.ai?.provider ?? "hosted" : "not enabled"}`);
     if (cfg.services.includes("calendar")) {
       for (const env of cfg.envs) {
         const calendar = calendarServiceConfig(cfg, env);
@@ -10971,11 +11008,11 @@ async function provision(options) {
     for (const service of serviceOrder) {
       if (service === "ai") {
         if (cfg.ai?.provider) {
-          await apps.setAi(cfg.app.id, env, { provider: cfg.ai.provider, ...cfg.ai.model ? { model: cfg.ai.model } : {} });
-          out.log(`${env}: ai configured (${cfg.ai.provider}${cfg.ai.model ? `/${cfg.ai.model}` : ""})`);
+          await apps.setAi(cfg.app.id, env, { mode: "byok", provider: cfg.ai.provider, ...cfg.ai.model ? { model: cfg.ai.model } : {} });
+          out.log(`${env}: ai configured (byok ${cfg.ai.provider}${cfg.ai.model ? `/${cfg.ai.model}` : ""})`);
         } else {
-          await apps.setService(cfg.app.id, "ai", true, { env });
-          out.log(`${env}: ai enabled`);
+          await apps.setAi(cfg.app.id, env, { mode: "hosted", ...cfg.ai?.model ? { model: cfg.ai.model } : {} });
+          out.log(`${env}: ai configured (hosted${cfg.ai?.model ? `/${cfg.ai.model}` : ""})`);
         }
       } else {
         const config = service === "calendar" ? calendarServiceConfig(cfg, env) : void 0;