@odla-ai/cli 0.27.8 → 0.27.10

package/dist/bin.js

@@ -3,7 +3,7 @@ import {
   exitCodeFor,
   redactSecrets,
   runCli
-} from "./chunk-MZSU4YQL.js";
+} from "./chunk-OGZELVS5.js";
 
 // src/bin.ts
 runCli().catch((err) => {

package/dist/{chunk-MZSU4YQL.js → chunk-OGZELVS5.js}

@@ -243,17 +243,24 @@ function handshakeFile(cfg) {
   return join(dirname2(cfg.local.tokenFile), "handshake.local.json");
 }
 var RESUME_MARGIN_MS = 5e3;
-function readPendingHandshake(path, platform, email) {
+function readPendingHandshake(path, platform, email, requiredGrant) {
   const pending = readJsonFile(path);
   if (!pending || pending.platform !== platform || pending.email !== email) return null;
   if (typeof pending.userCode !== "string" || typeof pending.deviceCode !== "string") return null;
   if (typeof pending.expiresAt !== "number" || pending.expiresAt <= Date.now() + RESUME_MARGIN_MS) return null;
+  if (requiredGrant && !grantCovers(pending, requiredGrant)) return null;
   return {
     interval: typeof pending.interval === "number" ? pending.interval : 3,
     ...pending,
     approvalUrl: handshakeUrl(platform, pending.userCode)
   };
 }
+function grantCovers(stored, required) {
+  if (required.optionalProjectCapabilities.length === 0) return true;
+  return required.projectIds.every((id) => stored.projectIds?.includes(id)) && required.optionalProjectCapabilities.every(
+    (capability) => stored.optionalProjectCapabilities?.includes(capability)
+  );
+}
 function writePendingHandshake(path, pending) {
   writePrivateJson(path, pending);
 }
@@ -284,7 +291,7 @@ function handshakeWaitMs(waitSeconds, interactive = process4.stdout.isTTY === tr
 }
 
 // src/token.ts
-async function getDeveloperToken(cfg, options, doFetch, out) {
+async function getDeveloperToken(cfg, options, doFetch, out, grantRequest = {}) {
   if (options.token) return options.token;
   const audience = platformAudience(cfg.platformUrl);
   if (process5.env.ODLA_DEV_TOKEN) {
@@ -296,8 +303,10 @@ async function getDeveloperToken(cfg, options, doFetch, out) {
     }
     return process5.env.ODLA_DEV_TOKEN;
   }
+  const optionalProjectCapabilities = grantRequest.optionalProjectCapabilities ?? [];
+  const grantIntent = { projectIds: [cfg.app.id], optionalProjectCapabilities };
   const cached = readJsonFile(cfg.local.tokenFile);
-  if (cached?.token && cached.platform === audience && (cached.expiresAt ?? 0) > Date.now() + 6e4) {
+  if (cached?.token && cached.platform === audience && (cached.expiresAt ?? 0) > Date.now() + 6e4 && cachedGrantCovers(cached, grantIntent)) {
     out.error(`auth: using cached developer token (${displayPath(cfg.local.tokenFile, cfg.rootDir)})`);
     return cached.token;
   }
@@ -308,17 +317,30 @@ async function getDeveloperToken(cfg, options, doFetch, out) {
     out,
     audience,
     email: handshakeEmail(options.email, cached?.platform === audience ? cached.email : void 0),
-    pendingFile: handshakeFile(cfg)
+    pendingFile: handshakeFile(cfg),
+    grantIntent
   };
   const waitMs = handshakeWaitMs(options.wait);
   const { token, expiresAt } = await resumePendingHandshake(ctx, waitMs) ?? await freshHandshake(ctx, waitMs);
   clearPendingHandshake(ctx.pendingFile);
-  writePrivateJson(cfg.local.tokenFile, { platform: audience, email: ctx.email, token, expiresAt });
+  writePrivateJson(cfg.local.tokenFile, {
+    platform: audience,
+    email: ctx.email,
+    projectIds: grantIntent.projectIds,
+    optionalProjectCapabilities,
+    token,
+    expiresAt
+  });
   out.error(`auth: developer token cached (${displayPath(cfg.local.tokenFile, cfg.rootDir)})`);
   return token;
 }
 async function resumePendingHandshake(ctx, waitMs) {
-  const pending = readPendingHandshake(ctx.pendingFile, ctx.audience, ctx.email);
+  const pending = readPendingHandshake(
+    ctx.pendingFile,
+    ctx.audience,
+    ctx.email,
+    ctx.grantIntent
+  );
   if (!pending) return null;
   ctx.out.error("");
   ctx.out.error(`auth: resuming pending handshake \u2014 ${approvalHint(pending)}`);
@@ -363,6 +385,7 @@ async function freshHandshake(ctx, waitMs) {
       label: `${ctx.cfg.app.id} provisioner`,
       agentHandle: projectAgentHandle(ctx.cfg.app.id),
       projectIds: [ctx.cfg.app.id],
+      optionalProjectCapabilities: ctx.grantIntent.optionalProjectCapabilities,
       fetch: ctx.doFetch,
       waitMs,
       onCode: async ({ userCode, deviceCode, expiresIn, interval }) => {
@@ -374,7 +397,9 @@ async function freshHandshake(ctx, waitMs) {
           deviceCode,
           approvalUrl,
           interval,
-          expiresAt: Date.now() + expiresIn * 1e3
+          expiresAt: Date.now() + expiresIn * 1e3,
+          projectIds: ctx.grantIntent.projectIds,
+          optionalProjectCapabilities: ctx.grantIntent.optionalProjectCapabilities
         };
         writePendingHandshake(ctx.pendingFile, started);
         await presentHandshakeApproval(ctx.out, {
@@ -397,6 +422,12 @@ async function freshHandshake(ctx, waitMs) {
     stopReminder?.();
   }
 }
+function cachedGrantCovers(cached, required) {
+  if (required.optionalProjectCapabilities.length === 0) return true;
+  return required.projectIds.every((id) => cached.projectIds?.includes(id)) && required.optionalProjectCapabilities.every(
+    (capability) => cached.optionalProjectCapabilities?.includes(capability)
+  );
+}
 function projectAgentHandle(appId) {
   const candidate = /^[a-z]/.test(appId) ? appId : `app-${appId}`;
   if (candidate.length <= 32) return candidate;
@@ -1366,7 +1397,7 @@ function parseCalendarStatus(raw, env) {
     throw new Error("calendar status returned unsupported access");
   }
   const errorValue = record(value2.error) ?? record(connection.error);
-  const errorCode = textField(value2.lastErrorCode, 128);
+  const errorCode2 = textField(value2.lastErrorCode, 128);
   const bookingPageValue = Object.hasOwn(value2, "bookingPageUrl") ? value2.bookingPageUrl : Object.hasOwn(config, "bookingPageUrl") ? config.bookingPageUrl : googleConfig.bookingPageUrl;
   const connected = typeof (value2.connected ?? connection.connected) === "boolean" ? Boolean(value2.connected ?? connection.connected) : ["healthy", "degraded"].includes(stateValue);
   const bookingCalendarId = textField(value2.bookingCalendarId ?? config.bookingCalendarId, 1024);
@@ -1385,10 +1416,10 @@ function parseCalendarStatus(raw, env) {
     ...optionalNullableUrl("bookingPageUrl", bookingPageValue),
     grantedScopes: stringList(value2.grantedScopes ?? connection.grantedScopes ?? connection.scopes),
     ...optionalText("attemptId", value2.attemptId ?? connection.attemptId, 180),
-    ...errorValue || errorCode ? { error: {
+    ...errorValue || errorCode2 ? { error: {
       ...textField(errorValue?.code, 128) ? { code: textField(errorValue?.code, 128) } : {},
       ...textField(errorValue?.message, 500) ? { message: textField(errorValue?.message, 500) } : {},
-      ...!errorValue && errorCode ? { code: errorCode } : {}
+      ...!errorValue && errorCode2 ? { code: errorCode2 } : {}
     } } : {}
   };
 }
@@ -1768,12 +1799,26 @@ async function assertTenantAdminAccess(doFetch, cfg, env, token) {
   });
   if (res.ok || res.status === 404) return;
   if (res.status === 403) {
+    const detail = await safeText4(res);
+    if (errorCode(detail) === "human_session_required") {
+      throw new Error(
+        `${env}: odla-db rejected the provision credential before checking ownership for "${cfg.app.id}" (tenant ${tenantId}): human_session_required. Retrying or changing app owners will not help; the deployed odla-db must accept owner-approved app.manage credentials on provisioning routes`
+      );
+    }
     throw new Error(
-      `${env}: you are not an owner of "${cfg.app.id}" (tenant ${tenantId}) \u2014 nothing was minted or written; ask an existing owner to run "odla-ai app owners add <your-email>", then re-run provision`
+      `${env}: this credential lacks live app.manage authority for "${cfg.app.id}" (tenant ${tenantId}) \u2014 nothing was minted or written; re-run provision with a fresh owner-approved provision handshake. If the human account is not an owner, an existing owner must add it in signed-in Studio; an agent token cannot repair ownership`
     );
   }
   throw new Error(`${env}: tenant access preflight (${tenantId}) failed: ${res.status} ${await safeText4(res)}`);
 }
+function errorCode(text2) {
+  try {
+    const body = JSON.parse(text2);
+    return typeof body.error?.code === "string" ? body.error.code : null;
+  } catch {
+    return null;
+  }
+}
 async function postJson(doFetch, url, bearer, body) {
   const res = await doFetch(url, {
     method: "POST",
@@ -7404,7 +7449,9 @@ async function provision(options) {
     out.log("secrets: Wrangler config and login preflight passed");
   }
   const doFetch = options.fetch ?? fetch;
-  const token = await getDeveloperToken(cfg, options, doFetch, out);
+  const token = await getDeveloperToken(cfg, options, doFetch, out, {
+    optionalProjectCapabilities: ["app.manage"]
+  });
   const apps = createAppsClient3({ endpoint: cfg.platformUrl, token, fetcher: { fetch: doFetch } });
   const existing = await apps.resolveApp(cfg.app.id);
   if (existing) {
@@ -13166,4 +13213,4 @@ export {
   exitCodeFor,
   runCli
 };
-//# sourceMappingURL=chunk-MZSU4YQL.js.map
+//# sourceMappingURL=chunk-OGZELVS5.js.map