@odla-ai/cli 0.27.8 → 0.27.9

package/README.md

@@ -466,7 +466,13 @@ shown-once credential.
    Studio shows the immutable project-derived agent handle, project, and
    capability request without mutation controls. The owner approves that exact
    request or declines it with an explanation which the CLI returns to the
-   calling agent; a different identity or access set requires a new request. If
+   calling agent; a different identity or access set requires a new request.
+   `provision` includes `app.manage` for the configured exact app. That permits
+   the non-lifecycle app configuration and sibling-service tenant administration
+   needed by the run; it does not permit ownership, rename/category, archive,
+   restore, or purge. A cached or pending baseline handshake without
+   `app.manage` is not reused for provision: the CLI starts a fresh request for
+   owner review. If
    the exact project id does not exist yet, approval reserves that id for this
    credential instead of failing: the credential may create only that app once,
    and Registry binds its reviewed grant to the new app incarnation.

package/dist/bin.cjs

@@ -269,17 +269,24 @@ function handshakeFile(cfg) {
   return (0, import_node_path2.join)((0, import_node_path2.dirname)(cfg.local.tokenFile), "handshake.local.json");
 }
 var RESUME_MARGIN_MS = 5e3;
-function readPendingHandshake(path, platform, email) {
+function readPendingHandshake(path, platform, email, requiredGrant) {
   const pending = readJsonFile(path);
   if (!pending || pending.platform !== platform || pending.email !== email) return null;
   if (typeof pending.userCode !== "string" || typeof pending.deviceCode !== "string") return null;
   if (typeof pending.expiresAt !== "number" || pending.expiresAt <= Date.now() + RESUME_MARGIN_MS) return null;
+  if (requiredGrant && !grantCovers(pending, requiredGrant)) return null;
   return {
     interval: typeof pending.interval === "number" ? pending.interval : 3,
     ...pending,
     approvalUrl: handshakeUrl(platform, pending.userCode)
   };
 }
+function grantCovers(stored, required) {
+  if (required.optionalProjectCapabilities.length === 0) return true;
+  return required.projectIds.every((id) => stored.projectIds?.includes(id)) && required.optionalProjectCapabilities.every(
+    (capability) => stored.optionalProjectCapabilities?.includes(capability)
+  );
+}
 function writePendingHandshake(path, pending) {
   writePrivateJson(path, pending);
 }
@@ -310,7 +317,7 @@ function handshakeWaitMs(waitSeconds, interactive = import_node_process3.default
 }
 
 // src/token.ts
-async function getDeveloperToken(cfg, options, doFetch, out) {
+async function getDeveloperToken(cfg, options, doFetch, out, grantRequest = {}) {
   if (options.token) return options.token;
   const audience = platformAudience(cfg.platformUrl);
   if (import_node_process4.default.env.ODLA_DEV_TOKEN) {
@@ -322,8 +329,10 @@ async function getDeveloperToken(cfg, options, doFetch, out) {
     }
     return import_node_process4.default.env.ODLA_DEV_TOKEN;
   }
+  const optionalProjectCapabilities = grantRequest.optionalProjectCapabilities ?? [];
+  const grantIntent = { projectIds: [cfg.app.id], optionalProjectCapabilities };
   const cached = readJsonFile(cfg.local.tokenFile);
-  if (cached?.token && cached.platform === audience && (cached.expiresAt ?? 0) > Date.now() + 6e4) {
+  if (cached?.token && cached.platform === audience && (cached.expiresAt ?? 0) > Date.now() + 6e4 && cachedGrantCovers(cached, grantIntent)) {
     out.error(`auth: using cached developer token (${displayPath(cfg.local.tokenFile, cfg.rootDir)})`);
     return cached.token;
   }
@@ -334,17 +343,30 @@ async function getDeveloperToken(cfg, options, doFetch, out) {
     out,
     audience,
     email: handshakeEmail(options.email, cached?.platform === audience ? cached.email : void 0),
-    pendingFile: handshakeFile(cfg)
+    pendingFile: handshakeFile(cfg),
+    grantIntent
   };
   const waitMs = handshakeWaitMs(options.wait);
   const { token, expiresAt } = await resumePendingHandshake(ctx, waitMs) ?? await freshHandshake(ctx, waitMs);
   clearPendingHandshake(ctx.pendingFile);
-  writePrivateJson(cfg.local.tokenFile, { platform: audience, email: ctx.email, token, expiresAt });
+  writePrivateJson(cfg.local.tokenFile, {
+    platform: audience,
+    email: ctx.email,
+    projectIds: grantIntent.projectIds,
+    optionalProjectCapabilities,
+    token,
+    expiresAt
+  });
   out.error(`auth: developer token cached (${displayPath(cfg.local.tokenFile, cfg.rootDir)})`);
   return token;
 }
 async function resumePendingHandshake(ctx, waitMs) {
-  const pending = readPendingHandshake(ctx.pendingFile, ctx.audience, ctx.email);
+  const pending = readPendingHandshake(
+    ctx.pendingFile,
+    ctx.audience,
+    ctx.email,
+    ctx.grantIntent
+  );
   if (!pending) return null;
   ctx.out.error("");
   ctx.out.error(`auth: resuming pending handshake \u2014 ${approvalHint(pending)}`);
@@ -389,6 +411,7 @@ async function freshHandshake(ctx, waitMs) {
       label: `${ctx.cfg.app.id} provisioner`,
       agentHandle: projectAgentHandle(ctx.cfg.app.id),
       projectIds: [ctx.cfg.app.id],
+      optionalProjectCapabilities: ctx.grantIntent.optionalProjectCapabilities,
       fetch: ctx.doFetch,
       waitMs,
       onCode: async ({ userCode, deviceCode, expiresIn, interval }) => {
@@ -400,7 +423,9 @@ async function freshHandshake(ctx, waitMs) {
           deviceCode,
           approvalUrl,
           interval,
-          expiresAt: Date.now() + expiresIn * 1e3
+          expiresAt: Date.now() + expiresIn * 1e3,
+          projectIds: ctx.grantIntent.projectIds,
+          optionalProjectCapabilities: ctx.grantIntent.optionalProjectCapabilities
         };
         writePendingHandshake(ctx.pendingFile, started);
         await presentHandshakeApproval(ctx.out, {
@@ -423,6 +448,12 @@ async function freshHandshake(ctx, waitMs) {
     stopReminder?.();
   }
 }
+function cachedGrantCovers(cached, required) {
+  if (required.optionalProjectCapabilities.length === 0) return true;
+  return required.projectIds.every((id) => cached.projectIds?.includes(id)) && required.optionalProjectCapabilities.every(
+    (capability) => cached.optionalProjectCapabilities?.includes(capability)
+  );
+}
 function projectAgentHandle(appId) {
   const candidate = /^[a-z]/.test(appId) ? appId : `app-${appId}`;
   if (candidate.length <= 32) return candidate;
@@ -3086,7 +3117,7 @@ async function assertTenantAdminAccess(doFetch, cfg, env, token) {
   if (res.ok || res.status === 404) return;
   if (res.status === 403) {
     throw new Error(
-      `${env}: you are not an owner of "${cfg.app.id}" (tenant ${tenantId}) \u2014 nothing was minted or written; ask an existing owner to run "odla-ai app owners add <your-email>", then re-run provision`
+      `${env}: this credential lacks live app.manage authority for "${cfg.app.id}" (tenant ${tenantId}) \u2014 nothing was minted or written; re-run provision with a fresh owner-approved provision handshake. If the human account is not an owner, an existing owner must add it in signed-in Studio; an agent token cannot repair ownership`
     );
   }
   throw new Error(`${env}: tenant access preflight (${tenantId}) failed: ${res.status} ${await safeText4(res)}`);
@@ -10923,7 +10954,9 @@ async function provision(options) {
     out.log("secrets: Wrangler config and login preflight passed");
   }
   const doFetch = options.fetch ?? fetch;
-  const token = await getDeveloperToken(cfg, options, doFetch, out);
+  const token = await getDeveloperToken(cfg, options, doFetch, out, {
+    optionalProjectCapabilities: ["app.manage"]
+  });
   const apps = (0, import_apps12.createAppsClient)({ endpoint: cfg.platformUrl, token, fetcher: { fetch: doFetch } });
   const existing = await apps.resolveApp(cfg.app.id);
   if (existing) {