@odla-ai/cli 0.27.4 → 0.27.5

package/dist/index.d.cts

@@ -501,6 +501,8 @@ interface OdlaProjectConfig {
         publicRead?: string[];
     };
     ai?: {
+        /** Hosted is the default when omitted; provider-only legacy configs are BYOK. */
+        mode?: "hosted" | "byok";
         provider?: string;
         model?: string;
         /** Env var containing the provider key to store in the platform vault. */
@@ -829,7 +831,7 @@ interface DoctorOptions {
  * It then collects warnings for the mistakes provision can't fix silently: a
  * schema with no entities, a rules namespace with no matching entity, an
  * integration with incomplete rules or a seed targeting an unknown namespace, the `ai`
- * service enabled without an `ai.provider`, `auth.clerk` entries that reference
+ * BYOK service enabled without an `ai.provider`, `auth.clerk` entries that reference
  * an unset env var (`$FOO`), an `ai.keyEnv` that isn't set (provider key upload
  * will be skipped), and — when `o11y` is enabled — any env whose local
  * credentials lack an ingest token. It also folds in the shared rule linter,
@@ -864,9 +866,9 @@ interface InitOptions {
  * written when it doesn't already exist unless `force` is set (otherwise it
  * throws); the schema/rules files are written only when missing (never
  * overwritten, even with `force`). `appId` must match `^[a-z0-9][a-z0-9-]*$` or
- * it throws. Defaults: `envs` → `["dev"]`, `services` → `["db","ai"]`,
- * `aiProvider` → `"anthropic"` (which also picks the `keyEnv`, e.g.
- * `ANTHROPIC_API_KEY`/`OPENAI_API_KEY`/`GOOGLE_API_KEY`).
+ * it throws. Defaults: `envs` → `["dev"]`, `services` → `["db","ai"]`, and
+ * platform-hosted AI. Passing `aiProvider` explicitly opts into BYOK and also
+ * picks its `keyEnv`.
  *
  * @param options.appId Slug for the app (lowercase alphanumerics and hyphens).
  * @param options.name Human-readable app name embedded in the config.
@@ -874,7 +876,7 @@ interface InitOptions {
  * @param options.configPath Config filename relative to root (default `odla.config.mjs`).
  * @param options.envs Environment names (default `["dev"]`; production is an explicit opt-in).
  * @param options.services Enabled services (default `["db","ai"]`).
- * @param options.aiProvider AI provider slug (default `"anthropic"`).
+ * @param options.aiProvider Optional provider slug; supplying it opts into BYOK.
  * @param options.force Overwrite an existing config file instead of throwing.
  * @param options.stdout Optional console-like sink (defaults to `console`).
  */

package/dist/index.d.ts

@@ -501,6 +501,8 @@ interface OdlaProjectConfig {
         publicRead?: string[];
     };
     ai?: {
+        /** Hosted is the default when omitted; provider-only legacy configs are BYOK. */
+        mode?: "hosted" | "byok";
         provider?: string;
         model?: string;
         /** Env var containing the provider key to store in the platform vault. */
@@ -829,7 +831,7 @@ interface DoctorOptions {
  * It then collects warnings for the mistakes provision can't fix silently: a
  * schema with no entities, a rules namespace with no matching entity, an
  * integration with incomplete rules or a seed targeting an unknown namespace, the `ai`
- * service enabled without an `ai.provider`, `auth.clerk` entries that reference
+ * BYOK service enabled without an `ai.provider`, `auth.clerk` entries that reference
  * an unset env var (`$FOO`), an `ai.keyEnv` that isn't set (provider key upload
  * will be skipped), and — when `o11y` is enabled — any env whose local
  * credentials lack an ingest token. It also folds in the shared rule linter,
@@ -864,9 +866,9 @@ interface InitOptions {
  * written when it doesn't already exist unless `force` is set (otherwise it
  * throws); the schema/rules files are written only when missing (never
  * overwritten, even with `force`). `appId` must match `^[a-z0-9][a-z0-9-]*$` or
- * it throws. Defaults: `envs` → `["dev"]`, `services` → `["db","ai"]`,
- * `aiProvider` → `"anthropic"` (which also picks the `keyEnv`, e.g.
- * `ANTHROPIC_API_KEY`/`OPENAI_API_KEY`/`GOOGLE_API_KEY`).
+ * it throws. Defaults: `envs` → `["dev"]`, `services` → `["db","ai"]`, and
+ * platform-hosted AI. Passing `aiProvider` explicitly opts into BYOK and also
+ * picks its `keyEnv`.
  *
  * @param options.appId Slug for the app (lowercase alphanumerics and hyphens).
  * @param options.name Human-readable app name embedded in the config.
@@ -874,7 +876,7 @@ interface InitOptions {
  * @param options.configPath Config filename relative to root (default `odla.config.mjs`).
  * @param options.envs Environment names (default `["dev"]`; production is an explicit opt-in).
  * @param options.services Enabled services (default `["db","ai"]`).
- * @param options.aiProvider AI provider slug (default `"anthropic"`).
+ * @param options.aiProvider Optional provider slug; supplying it opts into BYOK.
  * @param options.force Overwrite an existing config file instead of throwing.
  * @param options.stdout Optional console-like sink (defaults to `console`).
  */

package/dist/index.js

@@ -57,7 +57,7 @@ import {
   startHostedSecurityJob,
   surfacePaths,
   validateInvocation
-} from "./chunk-GENTB3VO.js";
+} from "./chunk-DQOJ4S6H.js";
 export {
   AGENT_HARNESSES,
   CAPABILITIES,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@odla-ai/cli",
-  "version": "0.27.4",
+  "version": "0.27.5",
   "description": "Agent-operable CLI for odla provisioning, calendar consent and sync lifecycle, System AI administration, Worker secrets, security jobs, and smoke checks.",
   "license": "MIT",
   "homepage": "https://odla.ai/docs/packages/cli",

package/skills/odla/references/sdks.md

@@ -79,12 +79,13 @@ re-run `calendar connect`.
 ## @odla-ai/ai — inference (Claude / GPT / Gemini)
 
 ```ts
-const { ai } = await initFromPlatform({ platform, appId, env, db });
-await ai.chat({ messages }); // provider/model + key resolved from the platform vault
+const { ai } = await initFromPlatform({ platform, appId, env, appKey, db });
+await ai.chat({ messages, maxTokens: 512 }); // approved hosted model; db supports BYOK fallback
 ```
 
-No API key in your code or env — it lives in the tenant vault; `provision`
-stores it when the configured `ai.keyEnv` is set at provision time.
+No provider key in your code or env. Hosted AI uses the app's existing backend
+key and central cost attribution; `--ai-provider` explicitly opts a new config
+into BYOK.
 
 ## @odla-ai/crm — records, pipelines, follow-ups, and contactability