@odla-ai/cli 0.27.7 → 0.27.9

package/README.md

@@ -467,6 +467,15 @@ shown-once credential.
    capability request without mutation controls. The owner approves that exact
    request or declines it with an explanation which the CLI returns to the
    calling agent; a different identity or access set requires a new request.
+   `provision` includes `app.manage` for the configured exact app. That permits
+   the non-lifecycle app configuration and sibling-service tenant administration
+   needed by the run; it does not permit ownership, rename/category, archive,
+   restore, or purge. A cached or pending baseline handshake without
+   `app.manage` is not reused for provision: the CLI starts a fresh request for
+   owner review. If
+   the exact project id does not exist yet, approval reserves that id for this
+   credential instead of failing: the credential may create only that app once,
+   and Registry binds its reviewed grant to the new app incarnation.
    Every real CLI handshake prints exactly one canonical `/studio?code=…` URL
    and attempts to open it — including from CI, SSH, display-less, scripted,
    and agent-driven shells. Only `--no-open` suppresses the attempt. Browser
@@ -477,7 +486,8 @@ shown-once credential.
    Outside an interactive terminal the approval wait is capped (90 seconds by
    default; `--wait <seconds>` overrides), and a still-pending handshake exits
    with code 75 — approve at the URL, then re-run to collect the token.
-2. Creates the platform app if needed.
+2. Creates the platform app if needed. For a new id, this consumes the exact-id
+   reservation approved in step 1; it is not ambient project-creation authority.
 3. Enables configured services in every configured environment. Calendar
    config is normalized per env and fixed to Google read-only access.
 4. Mints or reuses each env's configured service credentials: an odla-db app
@@ -554,7 +564,13 @@ or approved-but-uncollected request can be active for that user.
 For an ordinary request, Studio also requires at least one exact project
 selection. The credential receives project metadata, PM, discussion, and
 brand-candidate editing grants only for those projects, never ambient owner
-access, app administration, or brand approval.
+access, app administration, or brand approval. A selected id that does not yet
+exist is a one-time bootstrap reservation: the credential may create that exact
+app, after which the grant is bound to its new lifetime. A 404 from the approve
+action is a routing regression; missing, archived, foreign, changed, or raced
+requests must produce a specific conflict or denial. The reservation authorizes
+only that bootstrap creation; later service, configuration, and administrative
+mutations still require their normal capabilities and human checkpoints.
 
 Developer grants are tracked by id, owner, label, scopes, creation/expiry,
 last use, and revocation state. The plaintext token is delivered once to the

package/REQUIREMENTS.md

@@ -46,6 +46,11 @@ Agnacl, but none should mention or special-case Agnacl.
   controls. Approval accepts the request digest exactly; denial requires a
   bounded, non-secret explanation returned to the polling agent. Any changed
   scope, project, or capability requires a fresh request.
+- An approved exact project id may be absent at review time. Collection must
+  reserve that id for the approved credential, which may create only that app
+  once; creation binds the reviewed grant to the new app incarnation. Existing
+  foreign or archived ids remain unapprovable. Approval precondition failures
+  must return an actionable conflict—never a route-like 404.
 - Only one claimed pending or approved-but-uncollected request may be active per
   user. Unclaimed issued codes must not occupy that slot.
 - Every real CLI handshake must attempt to open that canonical approval URL,

package/dist/bin.cjs

@@ -269,17 +269,24 @@ function handshakeFile(cfg) {
   return (0, import_node_path2.join)((0, import_node_path2.dirname)(cfg.local.tokenFile), "handshake.local.json");
 }
 var RESUME_MARGIN_MS = 5e3;
-function readPendingHandshake(path, platform, email) {
+function readPendingHandshake(path, platform, email, requiredGrant) {
   const pending = readJsonFile(path);
   if (!pending || pending.platform !== platform || pending.email !== email) return null;
   if (typeof pending.userCode !== "string" || typeof pending.deviceCode !== "string") return null;
   if (typeof pending.expiresAt !== "number" || pending.expiresAt <= Date.now() + RESUME_MARGIN_MS) return null;
+  if (requiredGrant && !grantCovers(pending, requiredGrant)) return null;
   return {
     interval: typeof pending.interval === "number" ? pending.interval : 3,
     ...pending,
     approvalUrl: handshakeUrl(platform, pending.userCode)
   };
 }
+function grantCovers(stored, required) {
+  if (required.optionalProjectCapabilities.length === 0) return true;
+  return required.projectIds.every((id) => stored.projectIds?.includes(id)) && required.optionalProjectCapabilities.every(
+    (capability) => stored.optionalProjectCapabilities?.includes(capability)
+  );
+}
 function writePendingHandshake(path, pending) {
   writePrivateJson(path, pending);
 }
@@ -310,7 +317,7 @@ function handshakeWaitMs(waitSeconds, interactive = import_node_process3.default
 }
 
 // src/token.ts
-async function getDeveloperToken(cfg, options, doFetch, out) {
+async function getDeveloperToken(cfg, options, doFetch, out, grantRequest = {}) {
   if (options.token) return options.token;
   const audience = platformAudience(cfg.platformUrl);
   if (import_node_process4.default.env.ODLA_DEV_TOKEN) {
@@ -322,8 +329,10 @@ async function getDeveloperToken(cfg, options, doFetch, out) {
     }
     return import_node_process4.default.env.ODLA_DEV_TOKEN;
   }
+  const optionalProjectCapabilities = grantRequest.optionalProjectCapabilities ?? [];
+  const grantIntent = { projectIds: [cfg.app.id], optionalProjectCapabilities };
   const cached = readJsonFile(cfg.local.tokenFile);
-  if (cached?.token && cached.platform === audience && (cached.expiresAt ?? 0) > Date.now() + 6e4) {
+  if (cached?.token && cached.platform === audience && (cached.expiresAt ?? 0) > Date.now() + 6e4 && cachedGrantCovers(cached, grantIntent)) {
     out.error(`auth: using cached developer token (${displayPath(cfg.local.tokenFile, cfg.rootDir)})`);
     return cached.token;
   }
@@ -334,17 +343,30 @@ async function getDeveloperToken(cfg, options, doFetch, out) {
     out,
     audience,
     email: handshakeEmail(options.email, cached?.platform === audience ? cached.email : void 0),
-    pendingFile: handshakeFile(cfg)
+    pendingFile: handshakeFile(cfg),
+    grantIntent
   };
   const waitMs = handshakeWaitMs(options.wait);
   const { token, expiresAt } = await resumePendingHandshake(ctx, waitMs) ?? await freshHandshake(ctx, waitMs);
   clearPendingHandshake(ctx.pendingFile);
-  writePrivateJson(cfg.local.tokenFile, { platform: audience, email: ctx.email, token, expiresAt });
+  writePrivateJson(cfg.local.tokenFile, {
+    platform: audience,
+    email: ctx.email,
+    projectIds: grantIntent.projectIds,
+    optionalProjectCapabilities,
+    token,
+    expiresAt
+  });
   out.error(`auth: developer token cached (${displayPath(cfg.local.tokenFile, cfg.rootDir)})`);
   return token;
 }
 async function resumePendingHandshake(ctx, waitMs) {
-  const pending = readPendingHandshake(ctx.pendingFile, ctx.audience, ctx.email);
+  const pending = readPendingHandshake(
+    ctx.pendingFile,
+    ctx.audience,
+    ctx.email,
+    ctx.grantIntent
+  );
   if (!pending) return null;
   ctx.out.error("");
   ctx.out.error(`auth: resuming pending handshake \u2014 ${approvalHint(pending)}`);
@@ -389,6 +411,7 @@ async function freshHandshake(ctx, waitMs) {
       label: `${ctx.cfg.app.id} provisioner`,
       agentHandle: projectAgentHandle(ctx.cfg.app.id),
       projectIds: [ctx.cfg.app.id],
+      optionalProjectCapabilities: ctx.grantIntent.optionalProjectCapabilities,
       fetch: ctx.doFetch,
       waitMs,
       onCode: async ({ userCode, deviceCode, expiresIn, interval }) => {
@@ -400,7 +423,9 @@ async function freshHandshake(ctx, waitMs) {
           deviceCode,
           approvalUrl,
           interval,
-          expiresAt: Date.now() + expiresIn * 1e3
+          expiresAt: Date.now() + expiresIn * 1e3,
+          projectIds: ctx.grantIntent.projectIds,
+          optionalProjectCapabilities: ctx.grantIntent.optionalProjectCapabilities
         };
         writePendingHandshake(ctx.pendingFile, started);
         await presentHandshakeApproval(ctx.out, {
@@ -423,6 +448,12 @@ async function freshHandshake(ctx, waitMs) {
     stopReminder?.();
   }
 }
+function cachedGrantCovers(cached, required) {
+  if (required.optionalProjectCapabilities.length === 0) return true;
+  return required.projectIds.every((id) => cached.projectIds?.includes(id)) && required.optionalProjectCapabilities.every(
+    (capability) => cached.optionalProjectCapabilities?.includes(capability)
+  );
+}
 function projectAgentHandle(appId) {
   const candidate = /^[a-z]/.test(appId) ? appId : `app-${appId}`;
   if (candidate.length <= 32) return candidate;
@@ -3086,7 +3117,7 @@ async function assertTenantAdminAccess(doFetch, cfg, env, token) {
   if (res.ok || res.status === 404) return;
   if (res.status === 403) {
     throw new Error(
-      `${env}: you are not an owner of "${cfg.app.id}" (tenant ${tenantId}) \u2014 nothing was minted or written; ask an existing owner to run "odla-ai app owners add <your-email>", then re-run provision`
+      `${env}: this credential lacks live app.manage authority for "${cfg.app.id}" (tenant ${tenantId}) \u2014 nothing was minted or written; re-run provision with a fresh owner-approved provision handshake. If the human account is not an owner, an existing owner must add it in signed-in Studio; an agent token cannot repair ownership`
     );
   }
   throw new Error(`${env}: tenant access preflight (${tenantId}) failed: ${res.status} ${await safeText4(res)}`);
@@ -10923,7 +10954,9 @@ async function provision(options) {
     out.log("secrets: Wrangler config and login preflight passed");
   }
   const doFetch = options.fetch ?? fetch;
-  const token = await getDeveloperToken(cfg, options, doFetch, out);
+  const token = await getDeveloperToken(cfg, options, doFetch, out, {
+    optionalProjectCapabilities: ["app.manage"]
+  });
   const apps = (0, import_apps12.createAppsClient)({ endpoint: cfg.platformUrl, token, fetcher: { fetch: doFetch } });
   const existing = await apps.resolveApp(cfg.app.id);
   if (existing) {