@odla-ai/cli 0.31.1 → 0.33.0

package/dist/index.d.cts

@@ -56,10 +56,6 @@ interface PreparedCodeLocalSource {
 /** Freeze the local Git tree and exact commit base before any approval request. */
 declare function prepareCodeLocalSource(cwd: string, repository: string, readHead?: (cwd: string) => Promise<string>): Promise<PreparedCodeLocalSource>;
 
-/** Release-owned Pi adapter bundled into the CLI. `prepareCodeImages` hashes
- * the exact bundle and builds a content-addressed local image; no registry
- * credential enters the terminal connection. */
-declare const CODE_PI_IMAGE = "odla-ai/pi-agent:embedded";
 /** Immutable CaMeL-registered build recipe available to an agent container. */
 interface CodeBuildRule {
     id: string;
@@ -76,14 +72,6 @@ interface CodeBuildRule {
  * this once their owner-visible registration contract exists. */
 declare const CODE_BUILD_RECIPES: readonly CodeBuildRule[];
 
-type CodeImageCommandRunner = (command: string, args: readonly string[], stdio: "inherit" | "ignore") => Promise<void>;
-type EmbeddedPiImageBuilder = (engine: CodeContainerEngine, image: string, run: CodeImageCommandRunner) => Promise<void>;
-type EmbeddedPiImageNamer = () => Promise<string>;
-/** Build the CLI-embedded Pi adapter and pull each immutable recipe image
- * before an owner is asked to approve the terminal. Runtime attempts never
- * pull, and fail closed if a prepared image disappears. */
-declare function prepareCodeImages(engine: CodeContainerEngine, images: readonly string[], run?: CodeImageCommandRunner, buildEmbedded?: EmbeddedPiImageBuilder, nameEmbedded?: EmbeddedPiImageNamer): Promise<readonly string[]>;
-
 /** Supported local isolation engines for an odla Code host runtime. */
 type CodeContainerEngine = "container" | "podman" | "docker";
 /** Bounded host facts reported on each outbound Code control-plane heartbeat. */
@@ -97,8 +85,6 @@ interface CodeHostCapabilities {
     source: CodeLocalSourceDescriptor;
     images: {
         ready: true;
-        pi: string;
-        piSource: "cli_embedded";
         recipes: Array<{
             id: string;
             image: string;
@@ -134,7 +120,6 @@ interface CodeConnectOptions {
     runRuntime?: (input: CodeRuntimeInput) => Promise<void>;
     readGitOrigin?: (cwd: string) => Promise<string>;
     readGitHead?: (cwd: string) => Promise<string>;
-    prepareImages?: (engine: CodeContainerEngine, images: readonly string[]) => Promise<readonly string[]>;
     prepareLocalSource?: typeof prepareCodeLocalSource;
 }
 /** Authority and runtime boundaries used after a Code host enrollment succeeds. */
@@ -153,7 +138,6 @@ interface CodeRuntimeInput {
         trustedBaseDir: string;
         sourceDir: string;
     };
-    piImage?: string;
 }
 /** Enroll this machine from an odla project and keep the embedded Pi runtime
  * online. Both the approval grant and host credential hashes are stored in
@@ -435,6 +419,35 @@ interface IntegrationProbe {
     /** Expected unauthenticated HTTP status, normally 401. */
     expectedStatus: number;
 }
+/**
+ * One tenant-vault secret a capability or app needs in order to work.
+ *
+ * This is the declaration half of the declaration/storage split: the contract
+ * is committed, the value never is. Declaring a secret does not store, read, or
+ * transmit it — `odla-ai secrets set` remains the only write path and values
+ * stay write-only afterwards. Declarations exist so `doctor` can tell "not set
+ * yet" apart from "not needed", so an agent can discover what to ask a human
+ * for instead of learning it from prose, and so `check:secrets` can prove the
+ * declared name is the name the runtime actually reads.
+ */
+interface IntegrationSecret {
+    /** Vault name, byte-identical to what `odla-ai secrets set <name>` writes and
+     * what the runtime passes to `getSecret`. Reserved slots keep their `$`. */
+    name: string;
+    /** What the secret is for, and what breaks without it. */
+    description: string;
+    /** Expected value prefix, e.g. `whsec_`. Advisory: never matched against a
+     * stored value (the CLI cannot read one back), only against a value on its
+     * way in. */
+    pattern?: string;
+    /** Platform-managed `$`-prefixed slot. Reserved secrets are never readable by
+     * an app key and are written by a dedicated command, not `secrets set`. */
+    reserved?: boolean;
+    /** Whether the capability is broken without it. Defaults to `true`; set
+     * `false` for secrets only some configurations need, so `doctor` reports them
+     * as available rather than missing. */
+    required?: boolean;
+}
 /** Structural, data-only capability descriptor consumed from
  * `odla.config.mjs`. Capability packages do not depend on the CLI; their
  * descriptors only need to conform to this shape. */
@@ -456,6 +469,8 @@ interface OdlaIntegration {
     seeds?: IntegrationSeed[];
     /** Read-only unauthenticated checks run against `links.<env>`. */
     probes?: IntegrationProbe[];
+    /** Tenant-vault secrets this capability reads. Names only — never values. */
+    secrets?: IntegrationSecret[];
 }
 interface ClerkAuthConfig {
     publishableKey?: string;
@@ -502,6 +517,9 @@ interface OdlaProjectConfig {
     /** App capabilities composed into schema/rules/seeds. Integrations are npm
      * modules, not hosted platform services, so they do not belong in services. */
     integrations?: OdlaIntegration[];
+    /** Vault secrets this app needs beyond the ones its capabilities declare.
+     * Names and descriptions only; values are never authored here. */
+    secrets?: IntegrationSecret[];
     db?: {
         /** Inline SerializedSchema, JSON file, or JS module path exporting default/schema. */
         schema?: unknown;
@@ -640,13 +658,22 @@ interface SmokeOptions {
     stdout?: Pick<typeof console, "log" | "error">;
 }
 
-/** The Google OAuth scope that authorizes booking writes (events read/write). */
-declare const GOOGLE_CALENDAR_EVENTS_SCOPE = "https://www.googleapis.com/auth/calendar.events";
+/**
+ * The calendar half of `odla.config.mjs`: resolving the checked-in Google
+ * booking block into a controller payload, and validating it.
+ *
+ * Split out of config.ts because calendar validation and its four value
+ * guards are used by nothing else in config loading — the guards were private
+ * to this one validator already.
+ */
 /** Resolve the checked-in calendar block into one controller-safe env payload. */
 declare function calendarServiceConfig(cfg: LoadedProjectConfig, env: string): CalendarServiceConfig;
 /** Public Appointment Schedule URL to apply separately from connector config. */
 declare function calendarBookingPageUrl(cfg: LoadedProjectConfig, env: string): string | null | undefined;
 
+/** The Google OAuth scope that authorizes booking writes (events read/write). */
+declare const GOOGLE_CALENDAR_EVENTS_SCOPE = "https://www.googleapis.com/auth/calendar.events";
+
 /** Canonical SHA-256 identifier for normalized configuration or a frozen plan. */
 type ConfigDigest = `sha256:${string}`;
 /** Overall relationship between repository-managed intent and observed state. */
@@ -1277,4 +1304,4 @@ declare function installSkill(options?: SkillInstallOptions): SkillInstallResult
  */
 declare function smoke(options: SmokeOptions): Promise<void>;
 
-export { AGENT_HARNESSES, type AdminAiOptions, type AgentHarness, type AgentHarnessSelector, type AiModelsOptions, type AvailableGoogleCalendar, CAPABILITIES, CODE_BUILD_RECIPES, CODE_PI_IMAGE, COMMAND_SURFACE, type CalendarConfig, type CalendarConnectionState, type CalendarLifecycleOptions, type CalendarServiceConfig, type CalendarStatus, type CliDependencies, type CodeBuildRule, type CodeConnectOptions, type CodeContainerEngine, type CodeHostCapabilities, type CodeLocalSourceDescriptor, type CodeRuntimeInput, type ConfigApplyOptions, type ConfigCoverage, type ConfigDiffDocument, type ConfigDifference, type ConfigDigest, type ConfigDrift, type ConfigInspectOptions, ConfigOperationCommandError, type ConfigOperationInspectOptions, type ConfigOperationResult, type ConfigPlanAction, type ConfigPlanDocument, type ConfigReconciliation, type ConfigRisk, type ConfigSource, type ConnectGitHubSecuritySourceOptions, type DesiredRegistryState, type DisconnectGitHubSecuritySourceOptions, type FollowHostedSecurityJobOptions, GOOGLE_CALENDAR_EVENTS_SCOPE, type GetHostedSecurityIntentOptions, type GetHostedSecurityJobOptions, type GoogleCalendarConfig, type HarnessInstallResult, type HostedSecurityProfile, type HostedSecurityResult, type HostedSecurityTokenRequest, type IntegrationProbe, type IntegrationSeed, type InvocationProblem, type ListGitHubSecuritySourcesOptions, type ListHostedSecurityJobsOptions, type LoadedProjectConfig, type LocalCredentials, type OdlaIntegration, type OdlaProjectConfig, type ProvisionOptions, type ProvisionPlan, type ReconciliationInput, type RunHostedSecurityOptions, SYSTEM_AI_PURPOSES, type ScopedPlatformTokenOptions, type SecretsPushOptions, type SecretsSetOptions, type SkillInstallOptions, type SkillInstallResult, type SmokeOptions, type StartHostedSecurityJobOptions, type SurfaceNode, type SystemAiPurpose, acceptedAfter, adminAi, aiModels, calendarBookingPageUrl, calendarCalendars, calendarConnect, calendarDisconnect, calendarServiceConfig, calendarStatus, codeConnect, configApply, configDiff, configOperationGet, configOperationWait, configPlan, connectGitHubSecuritySource, describeProblem, desiredRegistryState, disconnectGitHubSecuritySource, doctor, exitCodeFor, followHostedSecurityJob, getHostedSecurityIntent, getHostedSecurityJob, getHostedSecurityPlan, getHostedSecurityReport, getScopedPlatformToken, inferGitHubRepository, initProject, installSkill, invocationPath, isTerminalHostedSecurityStatus, listGitHubSecuritySources, listHostedSecurityJobs, prepareCodeImages, printCapabilities, provision, reconcileConfig, redactSecrets, repositoryFromGitRemote, runCli, runCodeRuntime, runHostedSecurity, secretsPush, secretsSet, secretsSetClerkKey, smoke, startHostedSecurityJob, surfacePaths, validateInvocation };
+export { AGENT_HARNESSES, type AdminAiOptions, type AgentHarness, type AgentHarnessSelector, type AiModelsOptions, type AvailableGoogleCalendar, CAPABILITIES, CODE_BUILD_RECIPES, COMMAND_SURFACE, type CalendarConfig, type CalendarConnectionState, type CalendarLifecycleOptions, type CalendarServiceConfig, type CalendarStatus, type CliDependencies, type CodeBuildRule, type CodeConnectOptions, type CodeContainerEngine, type CodeHostCapabilities, type CodeLocalSourceDescriptor, type CodeRuntimeInput, type ConfigApplyOptions, type ConfigCoverage, type ConfigDiffDocument, type ConfigDifference, type ConfigDigest, type ConfigDrift, type ConfigInspectOptions, ConfigOperationCommandError, type ConfigOperationInspectOptions, type ConfigOperationResult, type ConfigPlanAction, type ConfigPlanDocument, type ConfigReconciliation, type ConfigRisk, type ConfigSource, type ConnectGitHubSecuritySourceOptions, type DesiredRegistryState, type DisconnectGitHubSecuritySourceOptions, type FollowHostedSecurityJobOptions, GOOGLE_CALENDAR_EVENTS_SCOPE, type GetHostedSecurityIntentOptions, type GetHostedSecurityJobOptions, type GoogleCalendarConfig, type HarnessInstallResult, type HostedSecurityProfile, type HostedSecurityResult, type HostedSecurityTokenRequest, type IntegrationProbe, type IntegrationSeed, type InvocationProblem, type ListGitHubSecuritySourcesOptions, type ListHostedSecurityJobsOptions, type LoadedProjectConfig, type LocalCredentials, type OdlaIntegration, type OdlaProjectConfig, type ProvisionOptions, type ProvisionPlan, type ReconciliationInput, type RunHostedSecurityOptions, SYSTEM_AI_PURPOSES, type ScopedPlatformTokenOptions, type SecretsPushOptions, type SecretsSetOptions, type SkillInstallOptions, type SkillInstallResult, type SmokeOptions, type StartHostedSecurityJobOptions, type SurfaceNode, type SystemAiPurpose, acceptedAfter, adminAi, aiModels, calendarBookingPageUrl, calendarCalendars, calendarConnect, calendarDisconnect, calendarServiceConfig, calendarStatus, codeConnect, configApply, configDiff, configOperationGet, configOperationWait, configPlan, connectGitHubSecuritySource, describeProblem, desiredRegistryState, disconnectGitHubSecuritySource, doctor, exitCodeFor, followHostedSecurityJob, getHostedSecurityIntent, getHostedSecurityJob, getHostedSecurityPlan, getHostedSecurityReport, getScopedPlatformToken, inferGitHubRepository, initProject, installSkill, invocationPath, isTerminalHostedSecurityStatus, listGitHubSecuritySources, listHostedSecurityJobs, printCapabilities, provision, reconcileConfig, redactSecrets, repositoryFromGitRemote, runCli, runCodeRuntime, runHostedSecurity, secretsPush, secretsSet, secretsSetClerkKey, smoke, startHostedSecurityJob, surfacePaths, validateInvocation };

package/dist/index.d.ts

@@ -56,10 +56,6 @@ interface PreparedCodeLocalSource {
 /** Freeze the local Git tree and exact commit base before any approval request. */
 declare function prepareCodeLocalSource(cwd: string, repository: string, readHead?: (cwd: string) => Promise<string>): Promise<PreparedCodeLocalSource>;
 
-/** Release-owned Pi adapter bundled into the CLI. `prepareCodeImages` hashes
- * the exact bundle and builds a content-addressed local image; no registry
- * credential enters the terminal connection. */
-declare const CODE_PI_IMAGE = "odla-ai/pi-agent:embedded";
 /** Immutable CaMeL-registered build recipe available to an agent container. */
 interface CodeBuildRule {
     id: string;
@@ -76,14 +72,6 @@ interface CodeBuildRule {
  * this once their owner-visible registration contract exists. */
 declare const CODE_BUILD_RECIPES: readonly CodeBuildRule[];
 
-type CodeImageCommandRunner = (command: string, args: readonly string[], stdio: "inherit" | "ignore") => Promise<void>;
-type EmbeddedPiImageBuilder = (engine: CodeContainerEngine, image: string, run: CodeImageCommandRunner) => Promise<void>;
-type EmbeddedPiImageNamer = () => Promise<string>;
-/** Build the CLI-embedded Pi adapter and pull each immutable recipe image
- * before an owner is asked to approve the terminal. Runtime attempts never
- * pull, and fail closed if a prepared image disappears. */
-declare function prepareCodeImages(engine: CodeContainerEngine, images: readonly string[], run?: CodeImageCommandRunner, buildEmbedded?: EmbeddedPiImageBuilder, nameEmbedded?: EmbeddedPiImageNamer): Promise<readonly string[]>;
-
 /** Supported local isolation engines for an odla Code host runtime. */
 type CodeContainerEngine = "container" | "podman" | "docker";
 /** Bounded host facts reported on each outbound Code control-plane heartbeat. */
@@ -97,8 +85,6 @@ interface CodeHostCapabilities {
     source: CodeLocalSourceDescriptor;
     images: {
         ready: true;
-        pi: string;
-        piSource: "cli_embedded";
         recipes: Array<{
             id: string;
             image: string;
@@ -134,7 +120,6 @@ interface CodeConnectOptions {
     runRuntime?: (input: CodeRuntimeInput) => Promise<void>;
     readGitOrigin?: (cwd: string) => Promise<string>;
     readGitHead?: (cwd: string) => Promise<string>;
-    prepareImages?: (engine: CodeContainerEngine, images: readonly string[]) => Promise<readonly string[]>;
     prepareLocalSource?: typeof prepareCodeLocalSource;
 }
 /** Authority and runtime boundaries used after a Code host enrollment succeeds. */
@@ -153,7 +138,6 @@ interface CodeRuntimeInput {
         trustedBaseDir: string;
         sourceDir: string;
     };
-    piImage?: string;
 }
 /** Enroll this machine from an odla project and keep the embedded Pi runtime
  * online. Both the approval grant and host credential hashes are stored in
@@ -435,6 +419,35 @@ interface IntegrationProbe {
     /** Expected unauthenticated HTTP status, normally 401. */
     expectedStatus: number;
 }
+/**
+ * One tenant-vault secret a capability or app needs in order to work.
+ *
+ * This is the declaration half of the declaration/storage split: the contract
+ * is committed, the value never is. Declaring a secret does not store, read, or
+ * transmit it — `odla-ai secrets set` remains the only write path and values
+ * stay write-only afterwards. Declarations exist so `doctor` can tell "not set
+ * yet" apart from "not needed", so an agent can discover what to ask a human
+ * for instead of learning it from prose, and so `check:secrets` can prove the
+ * declared name is the name the runtime actually reads.
+ */
+interface IntegrationSecret {
+    /** Vault name, byte-identical to what `odla-ai secrets set <name>` writes and
+     * what the runtime passes to `getSecret`. Reserved slots keep their `$`. */
+    name: string;
+    /** What the secret is for, and what breaks without it. */
+    description: string;
+    /** Expected value prefix, e.g. `whsec_`. Advisory: never matched against a
+     * stored value (the CLI cannot read one back), only against a value on its
+     * way in. */
+    pattern?: string;
+    /** Platform-managed `$`-prefixed slot. Reserved secrets are never readable by
+     * an app key and are written by a dedicated command, not `secrets set`. */
+    reserved?: boolean;
+    /** Whether the capability is broken without it. Defaults to `true`; set
+     * `false` for secrets only some configurations need, so `doctor` reports them
+     * as available rather than missing. */
+    required?: boolean;
+}
 /** Structural, data-only capability descriptor consumed from
  * `odla.config.mjs`. Capability packages do not depend on the CLI; their
  * descriptors only need to conform to this shape. */
@@ -456,6 +469,8 @@ interface OdlaIntegration {
     seeds?: IntegrationSeed[];
     /** Read-only unauthenticated checks run against `links.<env>`. */
     probes?: IntegrationProbe[];
+    /** Tenant-vault secrets this capability reads. Names only — never values. */
+    secrets?: IntegrationSecret[];
 }
 interface ClerkAuthConfig {
     publishableKey?: string;
@@ -502,6 +517,9 @@ interface OdlaProjectConfig {
     /** App capabilities composed into schema/rules/seeds. Integrations are npm
      * modules, not hosted platform services, so they do not belong in services. */
     integrations?: OdlaIntegration[];
+    /** Vault secrets this app needs beyond the ones its capabilities declare.
+     * Names and descriptions only; values are never authored here. */
+    secrets?: IntegrationSecret[];
     db?: {
         /** Inline SerializedSchema, JSON file, or JS module path exporting default/schema. */
         schema?: unknown;
@@ -640,13 +658,22 @@ interface SmokeOptions {
     stdout?: Pick<typeof console, "log" | "error">;
 }
 
-/** The Google OAuth scope that authorizes booking writes (events read/write). */
-declare const GOOGLE_CALENDAR_EVENTS_SCOPE = "https://www.googleapis.com/auth/calendar.events";
+/**
+ * The calendar half of `odla.config.mjs`: resolving the checked-in Google
+ * booking block into a controller payload, and validating it.
+ *
+ * Split out of config.ts because calendar validation and its four value
+ * guards are used by nothing else in config loading — the guards were private
+ * to this one validator already.
+ */
 /** Resolve the checked-in calendar block into one controller-safe env payload. */
 declare function calendarServiceConfig(cfg: LoadedProjectConfig, env: string): CalendarServiceConfig;
 /** Public Appointment Schedule URL to apply separately from connector config. */
 declare function calendarBookingPageUrl(cfg: LoadedProjectConfig, env: string): string | null | undefined;
 
+/** The Google OAuth scope that authorizes booking writes (events read/write). */
+declare const GOOGLE_CALENDAR_EVENTS_SCOPE = "https://www.googleapis.com/auth/calendar.events";
+
 /** Canonical SHA-256 identifier for normalized configuration or a frozen plan. */
 type ConfigDigest = `sha256:${string}`;
 /** Overall relationship between repository-managed intent and observed state. */
@@ -1277,4 +1304,4 @@ declare function installSkill(options?: SkillInstallOptions): SkillInstallResult
  */
 declare function smoke(options: SmokeOptions): Promise<void>;
 
-export { AGENT_HARNESSES, type AdminAiOptions, type AgentHarness, type AgentHarnessSelector, type AiModelsOptions, type AvailableGoogleCalendar, CAPABILITIES, CODE_BUILD_RECIPES, CODE_PI_IMAGE, COMMAND_SURFACE, type CalendarConfig, type CalendarConnectionState, type CalendarLifecycleOptions, type CalendarServiceConfig, type CalendarStatus, type CliDependencies, type CodeBuildRule, type CodeConnectOptions, type CodeContainerEngine, type CodeHostCapabilities, type CodeLocalSourceDescriptor, type CodeRuntimeInput, type ConfigApplyOptions, type ConfigCoverage, type ConfigDiffDocument, type ConfigDifference, type ConfigDigest, type ConfigDrift, type ConfigInspectOptions, ConfigOperationCommandError, type ConfigOperationInspectOptions, type ConfigOperationResult, type ConfigPlanAction, type ConfigPlanDocument, type ConfigReconciliation, type ConfigRisk, type ConfigSource, type ConnectGitHubSecuritySourceOptions, type DesiredRegistryState, type DisconnectGitHubSecuritySourceOptions, type FollowHostedSecurityJobOptions, GOOGLE_CALENDAR_EVENTS_SCOPE, type GetHostedSecurityIntentOptions, type GetHostedSecurityJobOptions, type GoogleCalendarConfig, type HarnessInstallResult, type HostedSecurityProfile, type HostedSecurityResult, type HostedSecurityTokenRequest, type IntegrationProbe, type IntegrationSeed, type InvocationProblem, type ListGitHubSecuritySourcesOptions, type ListHostedSecurityJobsOptions, type LoadedProjectConfig, type LocalCredentials, type OdlaIntegration, type OdlaProjectConfig, type ProvisionOptions, type ProvisionPlan, type ReconciliationInput, type RunHostedSecurityOptions, SYSTEM_AI_PURPOSES, type ScopedPlatformTokenOptions, type SecretsPushOptions, type SecretsSetOptions, type SkillInstallOptions, type SkillInstallResult, type SmokeOptions, type StartHostedSecurityJobOptions, type SurfaceNode, type SystemAiPurpose, acceptedAfter, adminAi, aiModels, calendarBookingPageUrl, calendarCalendars, calendarConnect, calendarDisconnect, calendarServiceConfig, calendarStatus, codeConnect, configApply, configDiff, configOperationGet, configOperationWait, configPlan, connectGitHubSecuritySource, describeProblem, desiredRegistryState, disconnectGitHubSecuritySource, doctor, exitCodeFor, followHostedSecurityJob, getHostedSecurityIntent, getHostedSecurityJob, getHostedSecurityPlan, getHostedSecurityReport, getScopedPlatformToken, inferGitHubRepository, initProject, installSkill, invocationPath, isTerminalHostedSecurityStatus, listGitHubSecuritySources, listHostedSecurityJobs, prepareCodeImages, printCapabilities, provision, reconcileConfig, redactSecrets, repositoryFromGitRemote, runCli, runCodeRuntime, runHostedSecurity, secretsPush, secretsSet, secretsSetClerkKey, smoke, startHostedSecurityJob, surfacePaths, validateInvocation };
+export { AGENT_HARNESSES, type AdminAiOptions, type AgentHarness, type AgentHarnessSelector, type AiModelsOptions, type AvailableGoogleCalendar, CAPABILITIES, CODE_BUILD_RECIPES, COMMAND_SURFACE, type CalendarConfig, type CalendarConnectionState, type CalendarLifecycleOptions, type CalendarServiceConfig, type CalendarStatus, type CliDependencies, type CodeBuildRule, type CodeConnectOptions, type CodeContainerEngine, type CodeHostCapabilities, type CodeLocalSourceDescriptor, type CodeRuntimeInput, type ConfigApplyOptions, type ConfigCoverage, type ConfigDiffDocument, type ConfigDifference, type ConfigDigest, type ConfigDrift, type ConfigInspectOptions, ConfigOperationCommandError, type ConfigOperationInspectOptions, type ConfigOperationResult, type ConfigPlanAction, type ConfigPlanDocument, type ConfigReconciliation, type ConfigRisk, type ConfigSource, type ConnectGitHubSecuritySourceOptions, type DesiredRegistryState, type DisconnectGitHubSecuritySourceOptions, type FollowHostedSecurityJobOptions, GOOGLE_CALENDAR_EVENTS_SCOPE, type GetHostedSecurityIntentOptions, type GetHostedSecurityJobOptions, type GoogleCalendarConfig, type HarnessInstallResult, type HostedSecurityProfile, type HostedSecurityResult, type HostedSecurityTokenRequest, type IntegrationProbe, type IntegrationSeed, type InvocationProblem, type ListGitHubSecuritySourcesOptions, type ListHostedSecurityJobsOptions, type LoadedProjectConfig, type LocalCredentials, type OdlaIntegration, type OdlaProjectConfig, type ProvisionOptions, type ProvisionPlan, type ReconciliationInput, type RunHostedSecurityOptions, SYSTEM_AI_PURPOSES, type ScopedPlatformTokenOptions, type SecretsPushOptions, type SecretsSetOptions, type SkillInstallOptions, type SkillInstallResult, type SmokeOptions, type StartHostedSecurityJobOptions, type SurfaceNode, type SystemAiPurpose, acceptedAfter, adminAi, aiModels, calendarBookingPageUrl, calendarCalendars, calendarConnect, calendarDisconnect, calendarServiceConfig, calendarStatus, codeConnect, configApply, configDiff, configOperationGet, configOperationWait, configPlan, connectGitHubSecuritySource, describeProblem, desiredRegistryState, disconnectGitHubSecuritySource, doctor, exitCodeFor, followHostedSecurityJob, getHostedSecurityIntent, getHostedSecurityJob, getHostedSecurityPlan, getHostedSecurityReport, getScopedPlatformToken, inferGitHubRepository, initProject, installSkill, invocationPath, isTerminalHostedSecurityStatus, listGitHubSecuritySources, listHostedSecurityJobs, printCapabilities, provision, reconcileConfig, redactSecrets, repositoryFromGitRemote, runCli, runCodeRuntime, runHostedSecurity, secretsPush, secretsSet, secretsSetClerkKey, smoke, startHostedSecurityJob, surfacePaths, validateInvocation };

package/dist/index.js

@@ -3,7 +3,6 @@ import {
   AGENT_HARNESSES,
   CAPABILITIES,
   CODE_BUILD_RECIPES,
-  CODE_PI_IMAGE,
   COMMAND_SURFACE,
   ConfigOperationCommandError,
   GOOGLE_CALENDAR_EVENTS_SCOPE,
@@ -41,7 +40,6 @@ import {
   isTerminalHostedSecurityStatus,
   listGitHubSecuritySources,
   listHostedSecurityJobs,
-  prepareCodeImages,
   printCapabilities,
   provision,
   reconcileConfig,
@@ -56,7 +54,7 @@ import {
   startHostedSecurityJob,
   surfacePaths,
   validateInvocation
-} from "./chunk-Y3W7YKWI.js";
+} from "./chunk-YSQORU5J.js";
 import {
   exitCodeFor,
   redactSecrets
@@ -65,7 +63,6 @@ export {
   AGENT_HARNESSES,
   CAPABILITIES,
   CODE_BUILD_RECIPES,
-  CODE_PI_IMAGE,
   COMMAND_SURFACE,
   ConfigOperationCommandError,
   GOOGLE_CALENDAR_EVENTS_SCOPE,
@@ -104,7 +101,6 @@ export {
   isTerminalHostedSecurityStatus,
   listGitHubSecuritySources,
   listHostedSecurityJobs,
-  prepareCodeImages,
   printCapabilities,
   provision,
   reconcileConfig,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@odla-ai/cli",
-  "version": "0.31.1",
+  "version": "0.33.0",
   "description": "Agent-operable CLI for odla provisioning, calendar consent and connection lifecycle, System AI administration, Worker secrets, security jobs, and smoke checks.",
   "license": "MIT",
   "homepage": "https://odla.ai/docs/packages/cli",
@@ -50,7 +50,7 @@
     "ai"
   ],
   "scripts": {
-    "build": "tsup && tsup --config tsup.runtime.config.ts",
+    "build": "tsup",
     "clean": "rm -rf dist",
     "typecheck": "tsc --noEmit",
     "test": "vitest run",
@@ -58,10 +58,10 @@
     "prepublishOnly": "npm run build"
   },
   "dependencies": {
-    "@odla-ai/ai": "0.13.0",
+    "@odla-ai/ai": "0.14.0",
     "@odla-ai/apps": "0.10.5",
     "@odla-ai/brand": "0.5.0",
-    "@odla-ai/db": ">=0.10.1 <0.11.0",
+    "@odla-ai/db": "0.10.3",
     "@odla-ai/security": "0.3.3"
   },
   "devDependencies": {