@odla-ai/cli 0.29.0 → 0.30.0

package/dist/{cli-DNOAYDBR.js → cli-CKBUVTJM.js}

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import {
   runCli
-} from "./chunk-YTVLTADT.js";
+} from "./chunk-PPSXHZJI.js";
 import {
   exitCodeFor
 } from "./chunk-UKLSRQ5J.js";
@@ -9,4 +9,4 @@ export {
   exitCodeFor,
   runCli
 };
-//# sourceMappingURL=cli-DNOAYDBR.js.map
+//# sourceMappingURL=cli-CKBUVTJM.js.map

package/dist/index.cjs

@@ -3961,6 +3961,41 @@ async function wranglerLoggedIn(run, cwd) {
     return false;
   }
 }
+async function wranglerRuntimeTarget(run, opts) {
+  const configPath = findWranglerConfig(opts.cwd);
+  if (!configPath) throw new Error(`no wrangler config found in ${opts.cwd}`);
+  const config = readWranglerConfig(configPath);
+  if (!config) throw new Error("runtime credential delivery requires wrangler.json or wrangler.jsonc");
+  const baseName = typeof config.name === "string" ? config.name : "";
+  const envs = config.env && typeof config.env === "object" && !Array.isArray(config.env) ? config.env : {};
+  const envConfig = opts.env && envs[opts.env] && typeof envs[opts.env] === "object" ? envs[opts.env] : {};
+  const explicitName = typeof envConfig.name === "string" ? envConfig.name : "";
+  const serviceEnvironments = config.legacy_env === false;
+  if (serviceEnvironments && explicitName) {
+    throw new Error("env.<name>.name is not allowed when wrangler legacy_env is false");
+  }
+  const scriptName = serviceEnvironments ? baseName : explicitName || (opts.env ? `${baseName}-${opts.env}` : baseName);
+  if (!/^[a-z0-9][a-z0-9_-]{0,62}$/.test(scriptName)) {
+    throw new Error("wrangler config must resolve an exact Worker name before credentials are issued");
+  }
+  const configuredAccount = typeof envConfig.account_id === "string" ? envConfig.account_id : typeof config.account_id === "string" ? config.account_id : "";
+  const whoami = await run("npx", ["wrangler", "whoami"], { cwd: opts.cwd });
+  if (whoami.code !== 0 || /not authenticated/i.test(`${whoami.stdout}${whoami.stderr}`)) {
+    throw new Error(`wrangler is not logged in \u2014 run "wrangler login" (a browser step for the human)`);
+  }
+  const discovered = [...new Set(`${whoami.stdout}
+${whoami.stderr}`.match(/\b[a-f0-9]{32}\b/gi)?.map((id) => id.toLowerCase()) ?? [])];
+  const accountId = configuredAccount.toLowerCase() || (discovered.length === 1 ? discovered[0] : "");
+  if (!/^[a-f0-9]{32}$/.test(accountId) || configuredAccount && discovered.length > 0 && !discovered.includes(accountId)) {
+    throw new Error("Wrangler account is ambiguous or does not match account_id in the config");
+  }
+  return {
+    provider: "cloudflare",
+    accountId,
+    scriptName,
+    ...opts.env ? { environment: opts.env } : {}
+  };
+}
 function wranglerPutSecret(run, opts) {
   const args = [
     "wrangler",
@@ -3972,6 +4007,16 @@ function wranglerPutSecret(run, opts) {
   ];
   return run("npx", args, { input: opts.value, cwd: opts.cwd });
 }
+function wranglerBulkSecrets(run, opts) {
+  const args = [
+    "wrangler",
+    "secret",
+    "bulk",
+    ...opts.env ? ["--env", opts.env] : [],
+    ...opts.configPath ? ["--config", opts.configPath] : []
+  ];
+  return run("npx", args, { input: JSON.stringify(opts.secrets), cwd: opts.cwd });
+}
 
 // src/doctor-checks.ts
 function lintRules(rules, entities, publicRead) {
@@ -4460,9 +4505,6 @@ var PROD_ENV_NAMES = /* @__PURE__ */ new Set(["prod", "production"]);
 async function secretsPush(options) {
   await secretsPushImpl(options, true);
 }
-async function secretsPushAfterPreflight(options) {
-  await secretsPushImpl(options, false);
-}
 async function secretsPushImpl(options, preflight) {
   const out = options.stdout ?? console;
   const cfg = await loadProjectConfig(options.configPath);
@@ -8827,6 +8869,55 @@ function requireName(parsed) {
   return name;
 }
 
+// src/credential-command.ts
+async function responseError(response2) {
+  return redactSecrets((await response2.text()).slice(0, 1e3));
+}
+async function credentialCommand(parsed, deps = {}) {
+  const action2 = parsed.positionals[1] ?? "list";
+  if (action2 !== "list" && action2 !== "revoke") {
+    throw new Error(`unknown credentials action "${action2}". Try "odla-ai credentials list".`);
+  }
+  assertArgs(parsed, ["config", "env", "all", "json", "token", "email", "open"], action2 === "revoke" ? 3 : 2);
+  const cfg = await loadProjectConfig(stringOpt(parsed.options.config) ?? "odla.config.mjs");
+  const doFetch = deps.fetch ?? fetch;
+  const out = deps.stdout ?? console;
+  const token = await getDeveloperToken(cfg, {
+    configPath: cfg.configPath,
+    token: stringOpt(parsed.options.token),
+    email: stringOpt(parsed.options.email),
+    open: parsed.options.open === false ? false : parsed.options.open === true ? true : void 0,
+    openApprovalUrl: deps.openUrl
+  }, doFetch, out, { optionalProjectCapabilities: ["app.manage"] });
+  const base = `${cfg.platformUrl}/registry/apps/${encodeURIComponent(cfg.app.id)}/runtime-credentials`;
+  if (action2 === "revoke") {
+    const id = parsed.positionals[2];
+    if (!id) throw new Error("credentials revoke requires the exact receipt id from credentials list");
+    const response3 = await doFetch(`${base}/${encodeURIComponent(id)}`, {
+      method: "DELETE",
+      headers: { authorization: `Bearer ${token}` }
+    });
+    if (!response3.ok) throw new Error(`runtime credential revoke failed (${response3.status}): ${await responseError(response3)}`);
+    const body2 = await response3.json();
+    return out.log(parsed.options.json === true ? JSON.stringify(body2, null, 2) : `revoked ${body2.receipt.id} (${body2.receipt.env} ${body2.receipt.target.scriptName})`);
+  }
+  const query = new URLSearchParams();
+  const requestedEnv = stringOpt(parsed.options.env);
+  if (requestedEnv) query.set("env", requestedEnv);
+  const response2 = await doFetch(`${base}${query.size ? `?${query}` : ""}`, {
+    headers: { authorization: `Bearer ${token}` }
+  });
+  if (!response2.ok) throw new Error(`runtime credential inventory failed (${response2.status}): ${await responseError(response2)}`);
+  const body = await response2.json();
+  const credentials = parsed.options.all === true ? body.credentials : body.credentials.filter((item) => item.state === "committed");
+  if (parsed.options.json === true) return out.log(JSON.stringify({ credentials }, null, 2));
+  if (!credentials.length) return out.log("no active runtime credential receipts");
+  out.log("RECEIPT	ENV	TARGET	CREATED");
+  for (const item of credentials) {
+    out.log(`${item.id}	${item.env}	${item.target.accountId ?? "local"}/${item.target.scriptName}	${new Date(item.createdAt).toISOString()}`);
+  }
+}
+
 // src/help-usage.ts
 var USAGE_SECTION = `
 Start here:
@@ -8945,6 +9036,8 @@ Usage:
   odla-ai security run [target] --ack-redacted-source [--env dev] [--profile odla] [--fail-on high]
   odla-ai security run [target] --self --ack-redacted-source
   odla-ai provision [--live] [--config odla.config.mjs] [--email <odla-account>] [--request-grant] [--wait <seconds>] [--dry-run] [--push-secrets] [--rotate-o11y-token] [--write-dev-vars[=path]] [--yes]
+  odla-ai credentials list [--config odla.config.mjs] [--env dev] [--all] [--json]
+  odla-ai credentials revoke <receipt-id> [--config odla.config.mjs] [--json]
   odla-ai smoke [--config odla.config.mjs] [--env dev] [--email <odla-account>] [--no-open]
   odla-ai skill install [--dir <project>] [--agent <name>] [--global] [--force]
   odla-ai secrets push --env <env> [--config odla.config.mjs] [--dry-run] [--yes]
@@ -9067,9 +9160,13 @@ Safety:
   pinned versions of every external @odla-ai runtime module before importing
   the command graph. A stale workspace module blocks with its resolved path and
   tells the agent to update/rebase, npm ci, and rebuild.
-  Provision caches the approved developer token and service credentials under
-  .odla/ with mode 0600, and init adds those paths to .gitignore. Secret push
-  preflights Wrangler before any shown-once issuance or destructive rotation.
+  Provision caches the approved developer token under .odla/ with mode 0600.
+  Local-only development provisioning may also cache that developer's service
+  credentials there. \`provision --push-secrets\` instead stages a fresh,
+  independently revocable credential set through the approved handshake,
+  transfers the complete set to the exact Worker with \`wrangler secret bulk\`
+  over stdin, and never writes its plaintext under .odla. Secret push preflights
+  Wrangler before shown-once issuance; it never rotates sibling credentials.
   Projectless PM, Discussions, o11y, runbook, and identity commands use
   --platform/--app/--env, ODLA_PLATFORM_URL/ODLA_APP_ID/ODLA_ENV, and
   ODLA_DEV_TOKEN. Save non-secret scope metadata with "context save", then
@@ -10993,7 +11090,7 @@ async function issueO11yToken(opts) {
   );
   if (res.status === 409 && !opts.rotateO11y) {
     throw new Error(
-      `o11y token already exists for env "${opts.env}", but its shown-once value is not in the local credentials file; run "odla-ai provision --rotate-o11y-token --push-secrets" to replace it explicitly`
+      `o11y token already exists for env "${opts.env}", but its shown-once value is not in the local credentials file; run "odla-ai provision --push-secrets" to install a separate runtime credential without rotating siblings`
     );
   }
   if (!res.ok) throw new Error(`o11y token ${opts.rotateO11y ? "rotation" : "issue"} (${opts.env}) failed: ${res.status} ${await safeText7(res)}`);
@@ -11009,6 +11106,88 @@ async function safeText7(res) {
   }
 }
 
+// src/runtime-credentials.ts
+var import_node_crypto5 = require("crypto");
+function runtimeUrl(cfg, suffix = "") {
+  return `${cfg.platformUrl}/registry/apps/${encodeURIComponent(cfg.app.id)}/runtime-credentials${suffix}`;
+}
+async function safeError(response2) {
+  const text2 = await response2.text();
+  return redactSecrets(text2.slice(0, 1e3));
+}
+async function finish(doFetch, cfg, token, sessionId, method) {
+  return doFetch(runtimeUrl(cfg, `/${encodeURIComponent(sessionId)}`), {
+    method,
+    headers: { authorization: `Bearer ${token}` }
+  });
+}
+async function deliverRuntimeCredentials(cfg, options) {
+  const doFetch = options.fetch ?? fetch;
+  const run = options.runner ?? defaultRunner;
+  const wranglerEnv = options.env === "prod" || options.env === "production" ? void 0 : options.env;
+  const target = await wranglerRuntimeTarget(run, {
+    cwd: cfg.rootDir,
+    env: wranglerEnv
+  });
+  const issue = await doFetch(runtimeUrl(cfg), {
+    method: "POST",
+    headers: {
+      authorization: `Bearer ${options.developerToken}`,
+      "content-type": "application/json"
+    },
+    body: JSON.stringify({
+      env: options.env,
+      idempotencyKey: `wrangler:${(0, import_node_crypto5.randomUUID)()}`,
+      target
+    })
+  });
+  const body = await issue.json().catch(() => null);
+  if (!issue.ok || typeof body?.sessionId !== "string" || !body.secrets || typeof body.secrets !== "object") {
+    const detail = body?.error?.code ?? body?.error?.message ?? issue.status;
+    throw new Error(`runtime credential staging failed: ${String(detail)}`);
+  }
+  const secrets = body.secrets;
+  const values = {};
+  for (const name of ["ODLA_API_KEY", "ODLA_O11Y_TOKEN"]) {
+    const value2 = secrets[name];
+    if (typeof value2 === "string" && value2) values[name] = value2;
+  }
+  if (Object.keys(values).length === 0) {
+    await finish(doFetch, cfg, options.developerToken, body.sessionId, "DELETE");
+    throw new Error("runtime credential staging returned no configured service credentials");
+  }
+  const pushed = await wranglerBulkSecrets(run, {
+    secrets: values,
+    env: wranglerEnv,
+    cwd: cfg.rootDir
+  });
+  if (pushed.code !== 0) {
+    await finish(doFetch, cfg, options.developerToken, body.sessionId, "DELETE");
+    const detail = redactSecrets(`${pushed.stderr || pushed.stdout}`.trim());
+    throw new Error(`wrangler secret bulk failed (exit ${pushed.code}): ${detail}`);
+  }
+  const committed = await finish(
+    doFetch,
+    cfg,
+    options.developerToken,
+    body.sessionId,
+    "POST"
+  );
+  if (!committed.ok) {
+    await finish(doFetch, cfg, options.developerToken, body.sessionId, "DELETE");
+    throw new Error(`runtime credential receipt commit failed: ${await safeError(committed)}`);
+  }
+  options.stdout?.log(
+    `${options.env}: installed ${Object.keys(values).join(" + ")} on ${target.accountId}/${target.scriptName}${target.environment ? ` (${target.environment})` : ""}; plaintext stayed in memory`
+  );
+  return {
+    sessionId: body.sessionId,
+    target,
+    ...values.ODLA_API_KEY ? { dbKey: values.ODLA_API_KEY } : {},
+    ...values.ODLA_O11Y_TOKEN ? { o11yToken: values.ODLA_O11Y_TOKEN } : {}
+  };
+}
+
 // src/provision-live.ts
 function liveProvisionConfig(cfg) {
   if (!cfg.envs.includes("dev")) {
@@ -11042,8 +11221,10 @@ async function provision(options) {
   if (options.rotateO11yToken && !hasO11y) {
     throw new Error("--rotate-o11y-token requires the o11y service in odla.config.mjs");
   }
-  if (options.pushSecrets && options.writeCredentials === false) {
-    throw new Error("--push-secrets cannot be combined with --no-write-credentials");
+  if (options.pushSecrets && (options.rotateKeys || options.rotateO11yToken)) {
+    throw new Error(
+      "--push-secrets always issues an independent runtime credential set; do not combine it with destructive rotation flags"
+    );
   }
   out.log(`odla-ai: ${plan.appName} (${plan.appId})`);
   out.log(`  platform: ${plan.platformUrl}`);
@@ -11080,7 +11261,7 @@ async function provision(options) {
     out.log(`  secrets: ${options.pushSecrets ? "push configured Worker secrets" : "local only"}`);
     return;
   }
-  let credentials = readCredentials(cfg.local.credentialsFile);
+  let credentials = options.pushSecrets ? null : readCredentials(cfg.local.credentialsFile);
   if (credentials && credentials.appId !== cfg.app.id) {
     throw new Error(
       `credentials at ${displayPath(cfg.local.credentialsFile, cfg.rootDir)} are for "${credentials.appId}", not "${cfg.app.id}"`
@@ -11089,7 +11270,7 @@ async function provision(options) {
   const rotatesO11y = !!(options.rotateKeys || options.rotateO11yToken);
   const missingO11y = cfg.envs.some((env) => !credentials?.envs[env]?.o11yToken);
   const missingDb = cfg.envs.some((env) => !credentials?.envs[env]?.dbKey);
-  const losesShownOnceCredential = hasDb && (!!options.rotateKeys || missingDb) || hasO11y && (rotatesO11y || missingO11y);
+  const losesShownOnceCredential = !options.pushSecrets && (hasDb && (!!options.rotateKeys || missingDb) || hasO11y && (rotatesO11y || missingO11y));
   if (options.writeCredentials === false && losesShownOnceCredential) {
     throw new Error("credential issuance/rotation requires the private credentials file; remove --no-write-credentials");
   }
@@ -11163,38 +11344,42 @@ async function provision(options) {
       await applyCalendarBookingPage(calendarCtx, calendarBookingPageUrl(cfg, env), out);
     }
   }
+  let devVarsCredentials = credentials;
   for (const env of cfg.envs) {
     const tenantId = (0, import_apps12.tenantIdFor)(cfg.app.id, env);
-    credentials = await provisionEnvCredentials({
-      cfg,
-      env,
-      developerToken: token,
-      credentials,
-      rotateDb: !!options.rotateKeys,
-      rotateO11y: rotatesO11y,
-      write: options.writeCredentials !== false,
-      fetch: doFetch,
-      stdout: out
-    });
-    const dbKey = credentials.envs[env]?.dbKey;
+    let dbKey;
     if (options.pushSecrets) {
-      try {
-        await secretsPushAfterPreflight({
-          configPath: cfg.configPath,
-          env,
-          yes: options.yes,
-          runner: options.secretRunner,
-          stdout: out
-        });
-      } catch (error) {
-        const message2 = error instanceof Error ? error.message : String(error);
-        const consent = env === "prod" || env === "production" ? " --yes" : "";
-        throw new Error(
-          `${message2}
-${env}: credentials are already saved; retry "odla-ai secrets push --env ${env}${consent}" without issuing or rotating again`,
-          { cause: error }
-        );
-      }
+      const delivered = await deliverRuntimeCredentials(cfg, {
+        env,
+        developerToken: token,
+        fetch: doFetch,
+        runner: options.secretRunner,
+        stdout: out
+      });
+      dbKey = delivered.dbKey;
+      devVarsCredentials = mergeCredential(devVarsCredentials, {
+        appId: cfg.app.id,
+        platformUrl: cfg.platformUrl,
+        dbEndpoint: cfg.dbEndpoint,
+        env,
+        tenantId,
+        ...delivered.dbKey ? { dbKey: delivered.dbKey } : {},
+        ...delivered.o11yToken ? { o11yToken: delivered.o11yToken } : {}
+      });
+    } else {
+      credentials = await provisionEnvCredentials({
+        cfg,
+        env,
+        developerToken: token,
+        credentials,
+        rotateDb: !!options.rotateKeys,
+        rotateO11y: rotatesO11y,
+        write: options.writeCredentials !== false,
+        fetch: doFetch,
+        stdout: out
+      });
+      devVarsCredentials = credentials;
+      dbKey = credentials.envs[env]?.dbKey;
     }
     if (schema && dbKey) {
       await postJson(doFetch, `${cfg.dbEndpoint}/app/${encodeURIComponent(tenantId)}/schema`, dbKey, { schema });
@@ -11218,13 +11403,13 @@ ${env}: credentials are already saved; retry "odla-ai secrets push --env ${env}$
       }
     }
   }
-  if (options.writeCredentials !== false && credentials) {
+  if (!options.pushSecrets && options.writeCredentials !== false && credentials) {
     const ignored = cfg.local.gitignore && gitignoreEntry(cfg.rootDir, cfg.local.credentialsFile);
     out.log(`credentials: wrote ${displayPath(cfg.local.credentialsFile, cfg.rootDir)} (0600${ignored ? ", gitignored" : ""})`);
   }
-  if (devVarsTarget && credentials) {
+  if (devVarsTarget && devVarsCredentials) {
     const env = cfg.envs.includes("dev") ? "dev" : cfg.envs[0] ?? "prod";
-    writeDevVars(devVarsTarget, credentials, env, o11yDevVars(cfg));
+    writeDevVars(devVarsTarget, devVarsCredentials, env, o11yDevVars(cfg));
     out.log(`dev vars: wrote ${displayPath(devVarsTarget, cfg.rootDir)} for ${env}`);
   }
   if (cfg.services.includes("calendar")) {
@@ -11315,6 +11500,7 @@ var COMMAND_SURFACE = {
   code: { connect: {} },
   config: { diff: {}, plan: {}, apply: {} },
   context: { show: {}, list: {}, save: {}, remove: {} },
+  credentials: { list: {}, revoke: {} },
   // `watch`, `read`, `reply`, and `resolve` take a topic id from there on.
   discuss: {
     groups: {},
@@ -13052,6 +13238,10 @@ async function runCli(argv = process.argv.slice(2), dependencies = {}) {
     await contextCommand(parsed, runtime);
     return;
   }
+  if (command === "credentials") {
+    await credentialCommand(parsed, runtime);
+    return;
+  }
   if (command === "runbook") {
     await runbookCommand(parsed, runtime);
     return;