@odla-ai/cli 0.30.0 → 0.30.1

package/dist/bin.js

@@ -174,7 +174,7 @@ function absoluteEntryPath(entryPath) {
 
 // src/bin.ts
 var argv = process.argv.slice(2);
-requireCurrentCliForProvision(argv).then(() => requireCoherentProvisionRuntime(argv)).then(async () => (await import("./cli-CKBUVTJM.js")).runCli()).catch((err) => {
+requireCurrentCliForProvision(argv).then(() => requireCoherentProvisionRuntime(argv)).then(async () => (await import("./cli-SZUWA6EF.js")).runCli()).catch((err) => {
   console.error(redactSecrets(`odla-ai: ${err instanceof Error ? err.message : String(err)}`));
   process.exitCode = exitCodeFor(err);
 });

package/dist/{chunk-PPSXHZJI.js → chunk-7V7WVTDT.js}

@@ -13,7 +13,7 @@ import {
 import process8 from "process";
 
 // src/token.ts
-import { collectToken, OdlaError, requestToken } from "@odla-ai/db";
+import { OdlaError, requestToken } from "@odla-ai/db";
 import { createHash } from "crypto";
 import process5 from "process";
 
@@ -117,12 +117,40 @@ function handshakeUrl(platformUrl, userCode) {
 
 // src/handshake-state.ts
 import { rmSync } from "fs";
-import { dirname as dirname2, join } from "path";
+import { dirname, join } from "path";
 import process4 from "process";
+function handshakeFile(cfg) {
+  return join(dirname(cfg.local.tokenFile), "handshake.local.json");
+}
+function clearPendingHandshake(path) {
+  rmSync(path, { force: true });
+}
+function minutesLeft(expiresAt) {
+  return Math.max(1, Math.round((expiresAt - Date.now()) / 6e4));
+}
+function approvalHint(pending) {
+  return `approve code ${pending.userCode} at ${pending.approvalUrl} (${minutesLeft(pending.expiresAt)}m left)`;
+}
+function approvalReminder(out, pending, periodMs = 3e4) {
+  const timer = setInterval(() => {
+    for (const line of reminderLines({
+      userCode: pending.userCode,
+      approvalUrl: pending.approvalUrl,
+      minutesLeft: minutesLeft(pending.expiresAt)
+    }))
+      out.log(line);
+  }, periodMs);
+  timer.unref?.();
+  return () => clearInterval(timer);
+}
+function handshakeWaitMs(waitSeconds, interactive = process4.stdout.isTTY === true) {
+  if (waitSeconds !== void 0) return waitSeconds * 1e3;
+  return interactive ? void 0 : 9e4;
+}
 
 // src/local.ts
 import { chmodSync, existsSync, mkdirSync, readFileSync, renameSync, writeFileSync } from "fs";
-import { dirname, isAbsolute, relative, resolve } from "path";
+import { dirname as dirname2, isAbsolute, relative, resolve } from "path";
 var GITIGNORE_LINES = [".odla/*.local.json", ".odla/dev-token.json", ".dev.vars"];
 function readJsonFile(path) {
   try {
@@ -190,7 +218,7 @@ function o11yDevVars(cfg) {
 function resolveWriteDevVarsTarget(cfg, requested) {
   if (!requested) return null;
   if (requested === true) return cfg.local.devVarsFile;
-  return resolve(dirname(cfg.configPath), requested);
+  return resolve(dirname2(cfg.configPath), requested);
 }
 function writeDevVars(path, credentials, env, o11y) {
   const entry = credentials.envs[env];
@@ -230,7 +258,7 @@ function isManagedDevVar(line) {
   return !!match?.[1] && MANAGED_DEV_VARS.has(match[1]);
 }
 function writePrivateText(path, text2) {
-  mkdirSync(dirname(path), { recursive: true });
+  mkdirSync(dirname2(path), { recursive: true });
   const temporary = `${path}.tmp-${process.pid}-${Date.now()}`;
   writeFileSync(temporary, text2, { mode: 384 });
   chmodSync(temporary, 384);
@@ -246,58 +274,6 @@ function displayPath(path, rootDir = process.cwd()) {
   return rel && !rel.startsWith("..") ? rel : path;
 }
 
-// src/handshake-state.ts
-function handshakeFile(cfg) {
-  return join(dirname2(cfg.local.tokenFile), "handshake.local.json");
-}
-var RESUME_MARGIN_MS = 5e3;
-function readPendingHandshake(path, platform, email, requiredGrant) {
-  const pending = readJsonFile(path);
-  if (!pending || pending.platform !== platform || pending.email !== email) return null;
-  if (typeof pending.userCode !== "string" || typeof pending.deviceCode !== "string") return null;
-  if (typeof pending.expiresAt !== "number" || pending.expiresAt <= Date.now() + RESUME_MARGIN_MS) return null;
-  if (requiredGrant && !grantCovers(pending, requiredGrant)) return null;
-  return {
-    interval: typeof pending.interval === "number" ? pending.interval : 3,
-    ...pending,
-    approvalUrl: handshakeUrl(platform, pending.userCode)
-  };
-}
-function grantCovers(stored, required) {
-  if (required.optionalProjectCapabilities.length === 0) return true;
-  return required.projectIds.every((id) => stored.projectIds?.includes(id)) && required.optionalProjectCapabilities.every(
-    (capability) => stored.optionalProjectCapabilities?.includes(capability)
-  );
-}
-function writePendingHandshake(path, pending) {
-  writePrivateJson(path, pending);
-}
-function clearPendingHandshake(path) {
-  rmSync(path, { force: true });
-}
-function minutesLeft(expiresAt) {
-  return Math.max(1, Math.round((expiresAt - Date.now()) / 6e4));
-}
-function approvalHint(pending) {
-  return `approve code ${pending.userCode} at ${pending.approvalUrl} (${minutesLeft(pending.expiresAt)}m left)`;
-}
-function approvalReminder(out, pending, periodMs = 3e4) {
-  const timer = setInterval(() => {
-    for (const line of reminderLines({
-      userCode: pending.userCode,
-      approvalUrl: pending.approvalUrl,
-      minutesLeft: minutesLeft(pending.expiresAt)
-    }))
-      out.log(line);
-  }, periodMs);
-  timer.unref?.();
-  return () => clearInterval(timer);
-}
-function handshakeWaitMs(waitSeconds, interactive = process4.stdout.isTTY === true) {
-  if (waitSeconds !== void 0) return waitSeconds * 1e3;
-  return interactive ? void 0 : 9e4;
-}
-
 // src/token.ts
 async function getDeveloperToken(cfg, options, doFetch, out, grantRequest = {}) {
   const audience = platformAudience(cfg.platformUrl);
@@ -336,8 +312,8 @@ async function getDeveloperToken(cfg, options, doFetch, out, grantRequest = {})
     grantIntent
   };
   const waitMs = handshakeWaitMs(options.wait);
-  if (grantRequest.freshLogin) clearPendingHandshake(ctx.pendingFile);
-  const { token, expiresAt } = await resumePendingHandshake(ctx, waitMs) ?? await freshHandshake(ctx, waitMs);
+  clearPendingHandshake(ctx.pendingFile);
+  const { token, expiresAt } = await freshHandshake(ctx, waitMs);
   clearPendingHandshake(ctx.pendingFile);
   writePrivateJson(cfg.local.tokenFile, {
     platform: audience,
@@ -350,47 +326,6 @@ async function getDeveloperToken(cfg, options, doFetch, out, grantRequest = {})
   out.error(`auth: developer token cached (${displayPath(cfg.local.tokenFile, cfg.rootDir)})`);
   return token;
 }
-async function resumePendingHandshake(ctx, waitMs) {
-  const pending = readPendingHandshake(
-    ctx.pendingFile,
-    ctx.audience,
-    ctx.email,
-    ctx.grantIntent
-  );
-  if (!pending) return null;
-  ctx.out.error("");
-  ctx.out.error(`auth: resuming pending handshake \u2014 ${approvalHint(pending)}`);
-  await presentHandshakeApproval(ctx.out, {
-    userCode: pending.userCode,
-    approvalUrl: pending.approvalUrl,
-    minutesLeft: Math.max(1, Math.floor((pending.expiresAt - Date.now()) / 6e4)),
-    purpose: `sign this terminal in as ${ctx.email}`
-  }, ctx.options);
-  ctx.out.error("");
-  const stopReminder = approvalReminder(ctx.out, pending);
-  try {
-    return await collectToken({
-      endpoint: ctx.cfg.platformUrl,
-      deviceCode: pending.deviceCode,
-      expiresAt: pending.expiresAt,
-      interval: pending.interval,
-      waitMs,
-      fetch: ctx.doFetch
-    });
-  } catch (err) {
-    const code = err instanceof OdlaError ? err.code : void 0;
-    if (code === "handshake_pending") throw stillPending(pending, ctx.email);
-    if (code === "handshake_expired" || code === "handshake_timeout") {
-      clearPendingHandshake(ctx.pendingFile);
-      ctx.out.error("auth: pending handshake lapsed unapproved; starting a fresh one");
-      return null;
-    }
-    if (code === "handshake_denied") clearPendingHandshake(ctx.pendingFile);
-    throw err;
-  } finally {
-    stopReminder();
-  }
-}
 async function freshHandshake(ctx, waitMs) {
   let started;
   let stopReminder;
@@ -418,7 +353,6 @@ async function freshHandshake(ctx, waitMs) {
           projectIds: ctx.grantIntent.projectIds,
           optionalProjectCapabilities: ctx.grantIntent.optionalProjectCapabilities
         };
-        writePendingHandshake(ctx.pendingFile, started);
         await presentHandshakeApproval(ctx.out, {
           userCode,
           approvalUrl,
@@ -454,7 +388,7 @@ function projectAgentHandle(appId) {
 function stillPending(pending, email) {
   return new OdlaError(
     "handshake_pending",
-    `handshake still pending \u2014 ask ${email} to ${approvalHint(pending)}, then re-run this command; it resumes the same handshake and collects the token`,
+    `handshake still pending \u2014 ask ${email} to ${approvalHint(pending)}; if this command exits, re-run it to request a new code`,
     { retryable: true }
   );
 }
@@ -4781,28 +4715,31 @@ async function smoke(options) {
   const out = options.stdout ?? console;
   const cfg = await loadProjectConfig(options.configPath);
   const env = resolveEnv(cfg, options.env);
-  const credentials = readCredentials(cfg.local.credentialsFile);
-  if (!credentials) {
+  const runtime = options.runtime === true;
+  const credentials = runtime ? null : readCredentials(cfg.local.credentialsFile);
+  if (!runtime && !credentials) {
     throw new Error(`local credentials missing: ${displayPath(cfg.local.credentialsFile, cfg.rootDir)}. Run "odla-ai provision --write-dev-vars".`);
   }
-  if (credentials.appId !== cfg.app.id) {
+  if (credentials && credentials.appId !== cfg.app.id) {
     throw new Error(`local credentials are for app "${credentials.appId}", but config app is "${cfg.app.id}"`);
   }
-  const entry = credentials.envs[env];
-  if (!entry?.tenantId) {
+  const entry = credentials?.envs[env];
+  if (!runtime && !entry?.tenantId) {
     throw new Error(`local credentials have no tenant for env "${env}". Run "odla-ai provision --write-dev-vars".`);
   }
   const hasDb = cfg.services.includes("db");
   const hasO11y = cfg.services.includes("o11y");
-  if (hasDb && !entry.dbKey) {
+  if (!runtime && hasDb && !entry?.dbKey) {
     throw new Error(`local credentials have no db key for env "${env}". Run "odla-ai provision --write-dev-vars".`);
   }
-  if (hasO11y && !entry.o11yToken) {
+  if (!runtime && hasO11y && !entry?.o11yToken) {
     throw new Error(`local credentials have no o11y token for env "${env}". Run "odla-ai provision --write-dev-vars".`);
   }
   const doFetch = options.fetch ?? fetch;
+  const tenantId = entry?.tenantId ?? resolveTenant(cfg, env).tenant;
   out.log(`smoke: ${cfg.app.id}/${env}`);
-  out.log(`  tenant: ${entry.tenantId}`);
+  out.log(`  mode: ${runtime ? "runtime (Worker-held credentials)" : "local credentials"}`);
+  out.log(`  tenant: ${tenantId}`);
   const publicConfig = await getJson(doFetch, publicConfigUrl(cfg.platformUrl, cfg.app.id, env), void 0);
   out.log(`  public-config: ok`);
   if (cfg.services.includes("ai") && cfg.ai?.provider) {
@@ -4816,7 +4753,7 @@ async function smoke(options) {
     if (mode !== "hosted") throw new Error(`ai mode mismatch: expected "hosted", public-config has "${String(mode ?? "none")}"`);
     out.log("  ai: hosted");
   }
-  if (hasO11y) out.log(`  o11y: credentials present`);
+  if (hasO11y) out.log(runtime ? `  o11y: Worker-held credential` : `  o11y: credentials present`);
   if (cfg.services.includes("calendar")) {
     const token = await getDeveloperToken(
       cfg,
@@ -4835,10 +4772,10 @@ async function smoke(options) {
     out.log(`  calendar: ${status.status}, bookable (booking \u2192 ${status.bookingCalendarId ?? "primary"})`);
   }
   const database = await resolveDatabaseConfig(cfg);
-  if (hasDb) {
+  if (hasDb && !runtime) {
     const expectedSchema = database.schema;
     const expectedEntities = serializedEntities(expectedSchema);
-    const liveSchemaPayload = await getJson(doFetch, `${cfg.dbEndpoint}/app/${encodeURIComponent(entry.tenantId)}/schema`, entry.dbKey);
+    const liveSchemaPayload = await getJson(doFetch, `${cfg.dbEndpoint}/app/${encodeURIComponent(tenantId)}/schema`, entry.dbKey);
     const liveSchema = liveSchemaPayload.schema ?? liveSchemaPayload;
     const liveEntities = serializedEntities(liveSchema);
     if (expectedEntities.length) {
@@ -4848,7 +4785,7 @@ async function smoke(options) {
     out.log(`  schema: ${liveEntities.length} entities`);
     const aggregateEntity = expectedEntities[0] ?? liveEntities[0];
     if (aggregateEntity) {
-      const aggregate = await postJson2(doFetch, `${cfg.dbEndpoint}/app/${encodeURIComponent(entry.tenantId)}/aggregate`, entry.dbKey, {
+      const aggregate = await postJson2(doFetch, `${cfg.dbEndpoint}/app/${encodeURIComponent(tenantId)}/aggregate`, entry.dbKey, {
         ns: aggregateEntity,
         aggregate: { count: true }
       });
@@ -4857,9 +4794,20 @@ async function smoke(options) {
     } else {
       out.log(`  aggregate: skipped (schema has no entities)`);
     }
+  } else if (hasDb) {
+    out.log(`  db: Worker-held credential (direct schema/aggregate skipped)`);
   } else {
     out.log(`  db: skipped (not enabled)`);
   }
+  if (runtime) {
+    const link = cfg.links?.[env];
+    if (!link) throw new Error(`runtime smoke requires links.${env} in odla.config.mjs`);
+    const res = await doFetch(link, { redirect: "manual" });
+    if (res.status < 200 || res.status >= 500) {
+      throw new Error(`runtime target ${new URL(link).origin} returned ${res.status}`);
+    }
+    out.log(`  runtime target: ${res.status}`);
+  }
   const probes = database.integrations.flatMap(
     (integration) => (integration.probes ?? []).map((probe) => ({ integration: integration.id, probe }))
   );
@@ -5062,10 +5010,11 @@ async function projectCommand(command, parsed, deps) {
     return true;
   }
   if (command === "smoke") {
-    assertArgs(parsed, ["config", "env", "token", "email", "open"], 1);
+    assertArgs(parsed, ["config", "env", "runtime", "token", "email", "open"], 1);
     await smoke({
       configPath: stringOpt(parsed.options.config) ?? "odla.config.mjs",
       env: stringOpt(parsed.options.env),
+      runtime: parsed.options.runtime === true,
       token: stringOpt(parsed.options.token),
       email: stringOpt(parsed.options.email),
       open: parsed.options.open === false ? false : parsed.options.open === true ? true : void 0,
@@ -8908,7 +8857,7 @@ Usage:
   odla-ai provision [--live] [--config odla.config.mjs] [--email <odla-account>] [--request-grant] [--wait <seconds>] [--dry-run] [--push-secrets] [--rotate-o11y-token] [--write-dev-vars[=path]] [--yes]
   odla-ai credentials list [--config odla.config.mjs] [--env dev] [--all] [--json]
   odla-ai credentials revoke <receipt-id> [--config odla.config.mjs] [--json]
-  odla-ai smoke [--config odla.config.mjs] [--env dev] [--email <odla-account>] [--no-open]
+  odla-ai smoke [--config odla.config.mjs] [--env dev] [--runtime] [--email <odla-account>] [--no-open]
   odla-ai skill install [--dir <project>] [--agent <name>] [--global] [--force]
   odla-ai secrets push --env <env> [--config odla.config.mjs] [--dry-run] [--yes]
   odla-ai secrets set <name> --env <env> (--from-env <NAME>|--stdin) [--email <odla-account>] [--config odla.config.mjs] [--yes]
@@ -9010,7 +8959,7 @@ Commands:
                "provision --live --yes" initializes only the live instance of
                an existing sandbox app and enables every configured service;
                no edit to the dev-first envs list is required.
-  smoke        Verify credentials, public-config, composed schema, db aggregate, and integration probes.
+  smoke        Verify local service access, or use --runtime for a Worker-held credential deployment.
   skill        Same installer; --agent accepts all, claude, codex, cursor,
                copilot, gemini, or agents (repeatable or comma-separated).
   secrets      Push configured db/o11y secrets into the Worker via wrangler
@@ -9050,12 +8999,11 @@ Safety:
   attempts to open it \u2014 including in CI, SSH, display-less, and agent-driven
   shells. Only --no-open suppresses the attempt. Browser launch is best-effort:
   agents with browser control must open that exact URL immediately; otherwise
-  they must give it to the human verbatim. A started handshake is persisted
-  under .odla/, so a command killed mid-wait loses nothing \u2014 rerunning resumes
-  the same code. Outside an interactive terminal the wait is capped (90s by
+  they must give it to the human verbatim. A device code remains only in the
+  running process. Outside an interactive terminal the wait is capped (90s by
   default, --wait <seconds> to change); a still-pending handshake then exits
-  with code 75: open the same URL (or relay it if browser control is unavailable),
-  wait for approval, and re-run to collect.
+  with code 75. Rerunning always requests and opens a new code; older clients'
+  persisted pending state is discarded.
   A fresh device handshake requires --email <odla-account> or ODLA_USER_EMAIL.
   The email is a non-secret identity hint: never provide a password or session
   token. It is the email shown by the signed-in odla account \u2014 never infer it
@@ -13246,4 +13194,4 @@ export {
   isTerminalHostedSecurityStatus,
   runCli
 };
-//# sourceMappingURL=chunk-PPSXHZJI.js.map
+//# sourceMappingURL=chunk-7V7WVTDT.js.map