@odla-ai/cli 0.4.0 → 0.6.0

package/dist/chunk-UWT7C6VT.js

@@ -1,1187 +0,0 @@
-#!/usr/bin/env node
-
-// src/redact.ts
-var REPLACEMENTS = [
-  [/odla_(sk|dev)_[A-Za-z0-9._-]+/g, "odla_$1_[redacted]"],
-  [/\bsk_(live|test)_[A-Za-z0-9]+/g, "sk_$1_[redacted]"],
-  [/\bsk-[A-Za-z0-9._-]+/g, "sk-[redacted]"],
-  [/\bwhsec_[A-Za-z0-9+/=]+/g, "whsec_[redacted]"],
-  [/\bo11y_[A-Za-z0-9]+/g, "o11y_[redacted]"],
-  [/\b(ghp|gho|github_pat)_[A-Za-z0-9_]+/g, "$1_[redacted]"],
-  [/\bAKIA[A-Z0-9]{12,}/g, "AKIA[redacted]"]
-];
-function redactSecrets(value) {
-  let result = value;
-  for (const [pattern, replacement] of REPLACEMENTS) result = result.replace(pattern, replacement);
-  return result;
-}
-function looksSecret(value) {
-  return redactSecrets(value) !== value || value.includes("-----BEGIN");
-}
-
-// src/config.ts
-import { existsSync, readFileSync } from "fs";
-import { dirname, isAbsolute, resolve } from "path";
-import { pathToFileURL } from "url";
-var DEFAULT_PLATFORM = "https://odla.ai";
-var DEFAULT_ENVS = ["prod", "dev"];
-var DEFAULT_SERVICES = ["db", "ai"];
-async function loadProjectConfig(configPath = "odla.config.mjs") {
-  const resolved = resolve(configPath);
-  if (!existsSync(resolved)) {
-    throw new Error(`config not found: ${configPath}. Run "odla-ai init" first or pass --config.`);
-  }
-  const raw = await loadConfigModule(resolved);
-  const rootDir = dirname(resolved);
-  validateRawConfig(raw, resolved);
-  const platformUrl = trimSlash(process.env.ODLA_PLATFORM_URL || raw.platformUrl || DEFAULT_PLATFORM);
-  const dbEndpoint = trimSlash(process.env.ODLA_DB_ENDPOINT || raw.dbEndpoint || platformUrl);
-  const envs = unique(raw.envs?.length ? raw.envs : DEFAULT_ENVS);
-  const services = unique(raw.services?.length ? raw.services : DEFAULT_SERVICES);
-  const local = {
-    tokenFile: resolve(rootDir, raw.local?.tokenFile ?? ".odla/dev-token.json"),
-    credentialsFile: resolve(rootDir, raw.local?.credentialsFile ?? ".odla/credentials.local.json"),
-    devVarsFile: resolve(rootDir, raw.local?.devVarsFile ?? ".dev.vars"),
-    gitignore: raw.local?.gitignore ?? true
-  };
-  return {
-    ...raw,
-    configPath: resolved,
-    rootDir,
-    platformUrl,
-    dbEndpoint,
-    envs,
-    services,
-    local
-  };
-}
-async function resolveDataExport(cfg, value, names) {
-  if (value === void 0 || value === null || value === false) return void 0;
-  if (typeof value !== "string") return value;
-  const target = isAbsolute(value) ? value : resolve(cfg.rootDir, value);
-  if (target.endsWith(".json")) {
-    return JSON.parse(readFileSync(target, "utf8"));
-  }
-  const mod = await import(pathToFileURL(target).href);
-  for (const name of names) {
-    if (mod[name] !== void 0) return mod[name];
-  }
-  if (mod.default !== void 0) return mod.default;
-  throw new Error(`${value} did not export ${names.join(", ")} or default`);
-}
-function buildPlan(cfg) {
-  return {
-    appId: cfg.app.id,
-    appName: cfg.app.name,
-    platformUrl: cfg.platformUrl,
-    dbEndpoint: cfg.dbEndpoint,
-    envs: cfg.envs,
-    services: cfg.services,
-    hasSchema: !!cfg.db?.schema,
-    hasRules: !!cfg.db?.rules || !!cfg.db?.schema && cfg.db.defaultRules !== false,
-    aiProvider: cfg.ai?.provider
-  };
-}
-function rulesFromSchema(schema) {
-  const entities = serializedEntities(schema);
-  return Object.fromEntries(
-    entities.map((name) => [name, { view: "false", create: "false", update: "false", delete: "false" }])
-  );
-}
-function serializedEntities(schema) {
-  if (!schema || typeof schema !== "object") return [];
-  const entities = schema.entities;
-  if (!entities || typeof entities !== "object" || Array.isArray(entities)) return [];
-  return Object.keys(entities);
-}
-function envValue(value) {
-  if (!value) return void 0;
-  if (value.startsWith("$")) return process.env[value.slice(1)];
-  return value;
-}
-function validateRawConfig(raw, path) {
-  if (!raw || typeof raw !== "object") throw new Error(`${path} must export an object`);
-  const cfg = raw;
-  if (!cfg.app || typeof cfg.app !== "object") throw new Error(`${path}: missing app object`);
-  if (!validId(cfg.app.id)) throw new Error(`${path}: app.id must be lowercase letters, numbers, and hyphens`);
-  if (!cfg.app.name || typeof cfg.app.name !== "string") throw new Error(`${path}: app.name is required`);
-  if (cfg.envs?.some((env) => !validId(env))) throw new Error(`${path}: env names must be lowercase letters, numbers, and hyphens`);
-}
-function validId(value) {
-  return typeof value === "string" && /^[a-z0-9][a-z0-9-]*$/.test(value);
-}
-async function loadConfigModule(path) {
-  if (path.endsWith(".json")) return JSON.parse(readFileSync(path, "utf8"));
-  const mod = await import(`${pathToFileURL(path).href}?t=${Date.now()}`);
-  const value = mod.default ?? mod.config;
-  if (typeof value === "function") return await value();
-  return value;
-}
-function trimSlash(value) {
-  return value.replace(/\/+$/, "");
-}
-function unique(values) {
-  return [...new Set(values.filter(Boolean))];
-}
-
-// src/doctor-checks.ts
-import { execFileSync } from "child_process";
-import { existsSync as existsSync3, readFileSync as readFileSync3 } from "fs";
-import { join as join2, resolve as resolve2 } from "path";
-
-// src/wrangler.ts
-import { spawn } from "child_process";
-import { existsSync as existsSync2, readFileSync as readFileSync2 } from "fs";
-import { join } from "path";
-var defaultRunner = (cmd, args, opts) => new Promise((resolvePromise, reject) => {
-  const child = spawn(cmd, args, { cwd: opts?.cwd, stdio: ["pipe", "pipe", "pipe"] });
-  let stdout = "";
-  let stderr = "";
-  child.stdout.on("data", (chunk) => stdout += chunk.toString());
-  child.stderr.on("data", (chunk) => stderr += chunk.toString());
-  child.on("error", reject);
-  child.on("close", (code) => resolvePromise({ code: code ?? 1, stdout, stderr }));
-  child.stdin.end(opts?.input ?? "");
-});
-var WRANGLER_CONFIG_FILES = ["wrangler.jsonc", "wrangler.json", "wrangler.toml"];
-function findWranglerConfig(rootDir) {
-  for (const name of WRANGLER_CONFIG_FILES) {
-    const path = join(rootDir, name);
-    if (existsSync2(path)) return path;
-  }
-  return null;
-}
-function readWranglerConfig(path) {
-  if (path.endsWith(".toml")) return null;
-  try {
-    return JSON.parse(stripJsonComments(readFileSync2(path, "utf8")));
-  } catch {
-    return null;
-  }
-}
-function stripJsonComments(text) {
-  let result = "";
-  let inString = false;
-  for (let i = 0; i < text.length; i++) {
-    const ch = text[i];
-    if (inString) {
-      result += ch;
-      if (ch === "\\") {
-        result += text[i + 1] ?? "";
-        i++;
-      } else if (ch === '"') {
-        inString = false;
-      }
-      continue;
-    }
-    if (ch === '"') {
-      inString = true;
-      result += ch;
-      continue;
-    }
-    if (ch === "/" && text[i + 1] === "/") {
-      while (i < text.length && text[i] !== "\n") i++;
-      result += "\n";
-      continue;
-    }
-    if (ch === "/" && text[i + 1] === "*") {
-      i += 2;
-      while (i < text.length && !(text[i] === "*" && text[i + 1] === "/")) i++;
-      i++;
-      continue;
-    }
-    result += ch;
-  }
-  return result;
-}
-async function wranglerLoggedIn(run, cwd) {
-  try {
-    const result = await run("npx", ["wrangler", "whoami"], { cwd });
-    return result.code === 0 && !/not authenticated/i.test(`${result.stdout}${result.stderr}`);
-  } catch {
-    return false;
-  }
-}
-function wranglerPutSecret(run, opts) {
-  const args = ["wrangler", "secret", "put", opts.name, ...opts.env ? ["--env", opts.env] : []];
-  return run("npx", args, { input: opts.value, cwd: opts.cwd });
-}
-
-// src/doctor-checks.ts
-function lintRules(rules, entities, publicRead) {
-  const warnings = [];
-  if (!rules) return warnings;
-  for (const [ns, actions] of Object.entries(rules)) {
-    for (const [action, expr] of Object.entries(actions)) {
-      if (typeof expr !== "string" || expr.trim() !== "true") continue;
-      if (action === "view" && publicRead.includes(ns)) continue;
-      warnings.push(
-        action === "view" ? `rules.${ns}.view is "true" \u2014 public read; add "${ns}" to db.publicRead if intended` : `rules.${ns}.${action} is "true" \u2014 any client can ${action} ${ns} rows`
-      );
-    }
-  }
-  for (const entity of entities) {
-    if (!(entity in rules)) warnings.push(`schema entity "${entity}" has no rules entry (all client access denied)`);
-  }
-  return warnings;
-}
-var defaultExec = (cmd, args, cwd) => execFileSync(cmd, args, { cwd, encoding: "utf8", stdio: ["ignore", "pipe", "ignore"] });
-function trackedSecretFiles(rootDir, exec = defaultExec) {
-  let output;
-  try {
-    output = exec("git", ["ls-files", "--", ".dev.vars", ".odla"], rootDir);
-  } catch {
-    return [];
-  }
-  return output.split(/\r?\n/).filter(Boolean).map((path) => `${path} is tracked by git \u2014 run "git rm --cached ${path}" and commit; it belongs in .gitignore`);
-}
-function wranglerWarnings(rootDir) {
-  const configPath = findWranglerConfig(rootDir);
-  if (!configPath) return [];
-  const config = readWranglerConfig(configPath);
-  if (!config) return [];
-  const warnings = [];
-  const blocks = [{ label: "", block: config }];
-  const envs = config.env;
-  if (envs && typeof envs === "object") {
-    for (const [name, block] of Object.entries(envs)) {
-      if (block && typeof block === "object") blocks.push({ label: `env.${name}.`, block });
-    }
-  }
-  for (const { label, block } of blocks) {
-    const assets = block.assets;
-    if (assets?.directory) {
-      const dir = resolve2(rootDir, assets.directory);
-      if (dir === resolve2(rootDir)) {
-        warnings.push(`${label}assets.directory is the project root \u2014 point it at a dedicated build dir (wrangler dev fails with "spawn EBADF")`);
-      } else if (existsSync3(join2(dir, "node_modules"))) {
-        warnings.push(`${label}assets.directory contains node_modules \u2014 wrangler dev's watcher will exhaust file descriptors`);
-      }
-    }
-    const vars = block.vars;
-    if (vars && typeof vars === "object") {
-      for (const [name, value] of Object.entries(vars)) {
-        if (name === "ODLA_API_KEY" || name === "ODLA_O11Y_TOKEN" || typeof value === "string" && looksSecret(value)) {
-          warnings.push(`wrangler ${label}vars.${name} looks like a secret \u2014 use "odla-ai secrets push" / wrangler secret put, never vars`);
-        }
-      }
-    }
-  }
-  const pkg = readPackageJson(rootDir);
-  if (pkg && typeof pkg.scripts === "object" && pkg.scripts && "deploy" in pkg.scripts) {
-    warnings.push(`package.json has a script named "deploy" \u2014 CI may auto-deploy it; rename to deploy:app`);
-  }
-  return warnings;
-}
-function readPackageJson(rootDir) {
-  try {
-    return JSON.parse(readFileSync3(join2(rootDir, "package.json"), "utf8"));
-  } catch {
-    return null;
-  }
-}
-
-// src/local.ts
-import { chmodSync, existsSync as existsSync4, mkdirSync, readFileSync as readFileSync4, writeFileSync } from "fs";
-import { dirname as dirname2, relative, resolve as resolve3 } from "path";
-var GITIGNORE_LINES = [".odla/*.local.json", ".odla/dev-token.json", ".dev.vars"];
-function readJsonFile(path) {
-  try {
-    return JSON.parse(readFileSync4(path, "utf8"));
-  } catch {
-    return null;
-  }
-}
-function writePrivateJson(path, value) {
-  mkdirSync(dirname2(path), { recursive: true });
-  writeFileSync(path, `${JSON.stringify(value, null, 2)}
-`);
-  chmodSync(path, 384);
-}
-function readCredentials(path) {
-  return readJsonFile(path);
-}
-function mergeCredential(current, update) {
-  const next = current ?? {
-    appId: update.appId,
-    platformUrl: update.platformUrl,
-    dbEndpoint: update.dbEndpoint,
-    updatedAt: (/* @__PURE__ */ new Date(0)).toISOString(),
-    envs: {}
-  };
-  next.appId = update.appId;
-  next.platformUrl = update.platformUrl;
-  next.dbEndpoint = update.dbEndpoint;
-  next.updatedAt = (/* @__PURE__ */ new Date()).toISOString();
-  next.envs[update.env] = {
-    ...next.envs[update.env] ?? {},
-    tenantId: update.tenantId,
-    ...update.dbKey ? { dbKey: update.dbKey } : {},
-    ...update.o11yToken ? { o11yToken: update.o11yToken } : {}
-  };
-  return next;
-}
-function ensureGitignore(rootDir) {
-  const path = resolve3(rootDir, ".gitignore");
-  const existing = existsSync4(path) ? readFileSync4(path, "utf8") : "";
-  const missing = GITIGNORE_LINES.filter((line) => !existing.split(/\r?\n/).includes(line));
-  if (missing.length === 0) return;
-  const prefix = existing && !existing.endsWith("\n") ? "\n" : "";
-  writeFileSync(path, `${existing}${prefix}${missing.join("\n")}
-`);
-}
-function writeDevVars(path, credentials, env, o11y) {
-  const entry = credentials.envs[env];
-  if (!entry?.dbKey) throw new Error(`no db key for env "${env}" in ${path}`);
-  const lines = [
-    `ODLA_PLATFORM="${credentials.platformUrl}"`,
-    `ODLA_ENDPOINT="${credentials.dbEndpoint}"`,
-    `ODLA_APP_ID="${credentials.appId}"`,
-    `ODLA_ENV="${env}"`,
-    `ODLA_TENANT="${entry.tenantId}"`,
-    `ODLA_API_KEY="${entry.dbKey}"`
-  ];
-  if (o11y) {
-    lines.push(`ODLA_O11Y_ENDPOINT="${o11y.endpoint}"`, `ODLA_O11Y_SERVICE="${o11y.service}"`);
-    if (o11y.version) lines.push(`ODLA_O11Y_VERSION="${o11y.version}"`);
-    if (entry.o11yToken) lines.push(`ODLA_O11Y_TOKEN="${entry.o11yToken}"`);
-  }
-  mkdirSync(dirname2(path), { recursive: true });
-  writeFileSync(path, `${lines.join("\n")}
-`);
-  chmodSync(path, 384);
-}
-function displayPath(path, rootDir = process.cwd()) {
-  const rel = relative(rootDir, path);
-  return rel && !rel.startsWith("..") ? rel : path;
-}
-
-// src/doctor.ts
-async function doctor(options) {
-  const out = options.stdout ?? console;
-  const cfg = await loadProjectConfig(options.configPath);
-  const plan = buildPlan(cfg);
-  const schema = await resolveDataExport(cfg, cfg.db?.schema, ["schema", "SCHEMA"]);
-  const configuredRules = await resolveDataExport(cfg, cfg.db?.rules, ["rules", "RULES"]);
-  const rules = configuredRules ?? (schema && cfg.db?.defaultRules !== false ? rulesFromSchema(schema) : void 0);
-  const entities = serializedEntities(schema);
-  out.log(`config: ${cfg.configPath}`);
-  out.log(`app:    ${plan.appName} (${plan.appId})`);
-  out.log(`envs:   ${plan.envs.join(", ")}`);
-  out.log(`svc:    ${plan.services.join(", ")}`);
-  out.log(`schema: ${schema ? `${entities.length} entities` : "none"}`);
-  out.log(`rules:  ${rules ? `${Object.keys(rules).length} namespaces` : "none"}`);
-  out.log(`ai:     ${cfg.ai?.provider ?? "not configured"}`);
-  const warnings = [];
-  if (schema && entities.length === 0) warnings.push("schema has no entities");
-  if (rules) {
-    for (const ns of Object.keys(rules)) {
-      if (entities.length > 0 && !entities.includes(ns)) warnings.push(`rules include "${ns}" but schema has no matching entity`);
-    }
-  }
-  if (cfg.services.includes("ai") && !cfg.ai?.provider) warnings.push("ai service is enabled but ai.provider is not set");
-  if (cfg.auth?.clerk) {
-    for (const [env, value] of Object.entries(cfg.auth.clerk)) {
-      if (typeof value === "string" && value.startsWith("$") && !process.env[value.slice(1)]) {
-        warnings.push(`auth.clerk.${env} references unset env var ${value}`);
-      }
-    }
-  }
-  if (cfg.ai?.keyEnv && !process.env[cfg.ai.keyEnv]) warnings.push(`${cfg.ai.keyEnv} is not set; provision will skip provider key storage`);
-  if (cfg.services.includes("o11y")) {
-    const credentials = readCredentials(cfg.local.credentialsFile);
-    for (const env of cfg.envs) {
-      if (!credentials?.envs[env]?.o11yToken) {
-        warnings.push(`o11y is enabled but env "${env}" has no ingest token \u2014 run "odla-ai provision" to mint one`);
-      }
-    }
-  }
-  warnings.push(...lintRules(rules, entities, cfg.db?.publicRead ?? []));
-  warnings.push(...trackedSecretFiles(cfg.rootDir));
-  warnings.push(...wranglerWarnings(cfg.rootDir));
-  if (warnings.length) {
-    out.log("");
-    out.log("warnings:");
-    for (const warning of warnings) out.log(`  - ${warning}`);
-  } else {
-    out.log("ok");
-  }
-}
-
-// src/init.ts
-import { existsSync as existsSync5, mkdirSync as mkdirSync2, writeFileSync as writeFileSync2 } from "fs";
-import { dirname as dirname3, resolve as resolve4 } from "path";
-function initProject(options) {
-  const out = options.stdout ?? console;
-  const rootDir = resolve4(options.rootDir ?? process.cwd());
-  const configPath = resolve4(rootDir, options.configPath ?? "odla.config.mjs");
-  if (existsSync5(configPath) && !options.force) {
-    throw new Error(`${configPath} already exists. Pass --force to overwrite.`);
-  }
-  if (!/^[a-z0-9][a-z0-9-]*$/.test(options.appId)) {
-    throw new Error("--app-id must be lowercase letters, numbers, and hyphens");
-  }
-  const envs = options.envs?.length ? options.envs : ["prod", "dev"];
-  const services = options.services?.length ? options.services : ["db", "ai"];
-  const aiProvider = options.aiProvider ?? "anthropic";
-  mkdirSync2(dirname3(configPath), { recursive: true });
-  mkdirSync2(resolve4(rootDir, "src/odla"), { recursive: true });
-  mkdirSync2(resolve4(rootDir, ".odla"), { recursive: true });
-  writeFileSync2(configPath, configTemplate({ appId: options.appId, name: options.name, envs, services, aiProvider }));
-  writeIfMissing(resolve4(rootDir, "src/odla/schema.mjs"), schemaTemplate());
-  writeIfMissing(resolve4(rootDir, "src/odla/rules.mjs"), rulesTemplate());
-  ensureGitignore(rootDir);
-  out.log(`created ${relativeDisplay(configPath, rootDir)}`);
-  out.log("created src/odla/schema.mjs and src/odla/rules.mjs");
-  out.log("updated .gitignore for local odla credentials");
-}
-function writeIfMissing(path, text) {
-  if (existsSync5(path)) return;
-  writeFileSync2(path, text);
-}
-function configTemplate(input) {
-  return `export default {
-  platformUrl: process.env.ODLA_PLATFORM_URL ?? "https://odla.ai",
-  dbEndpoint: process.env.ODLA_ENDPOINT ?? process.env.ODLA_DB_ENDPOINT ?? "https://db.odla.ai",
-  app: {
-    id: "${input.appId}",
-    name: "${input.name.replace(/"/g, '\\"')}",
-  },
-  envs: ${JSON.stringify(input.envs)},
-  services: ${JSON.stringify(input.services)},
-  db: {
-    schema: "./src/odla/schema.mjs",
-    rules: "./src/odla/rules.mjs",
-    // When rules is omitted, the CLI generates deny-all rules from schema.
-    defaultRules: "deny",
-  },
-  ai: {
-    provider: process.env.ODLA_AI_PROVIDER ?? "${input.aiProvider}",
-    // Optional: set this env var while running provision to store the provider
-    // key in the platform vault for each tenant.
-    keyEnv: "${defaultKeyEnv(input.aiProvider)}",
-  },
-  auth: {
-    clerk: {
-      // dev: "$CLERK_PUBLISHABLE_KEY",
-      // prod: "$CLERK_PUBLISHABLE_KEY",
-    },
-  },
-  // Add "o11y" to services to enable observability; provision then mints the
-  // ingest token and scaffolds the ODLA_O11Y_* vars into .dev.vars.
-  // o11y: {
-  //   service: "${input.appId}",   // defaults to the app id
-  //   // endpoint: "https://o11y.odla.ai",
-  // },
-  links: {
-    // dev: "https://dev.example.com",
-    // prod: "https://example.com",
-  },
-  local: {
-    tokenFile: ".odla/dev-token.json",
-    credentialsFile: ".odla/credentials.local.json",
-    devVarsFile: ".dev.vars",
-  },
-};
-`;
-}
-function schemaTemplate() {
-  return `// Replace this starter schema with your app's odla-db schema.
-// Knowledge-graph projects can export @odla-ai/kg's toSerializedSchema(ontology).
-export const schema = {
-  entities: {
-    notes: {
-      attrs: {
-        id: { type: "string", unique: true, indexed: true, optional: false },
-        text: { type: "string", unique: false, indexed: false, optional: false },
-        createdAt: { type: "number", unique: false, indexed: true, optional: false },
-      },
-    },
-  },
-  links: {},
-};
-`;
-}
-function rulesTemplate() {
-  return `// odla-db is default-deny. The starter keeps runtime data backend-only.
-export const rules = {
-  notes: {
-    view: "false",
-    create: "false",
-    update: "false",
-    delete: "false",
-  },
-};
-`;
-}
-function defaultKeyEnv(provider) {
-  if (provider === "openai") return "OPENAI_API_KEY";
-  if (provider === "google") return "GOOGLE_API_KEY";
-  return "ANTHROPIC_API_KEY";
-}
-function relativeDisplay(path, rootDir) {
-  return path.startsWith(rootDir) ? path.slice(rootDir.length + 1) : path;
-}
-
-// src/provision.ts
-import { createAppsClient, tenantIdFor } from "@odla-ai/apps";
-import { DEFAULT_SECRET_NAMES, putSecret } from "@odla-ai/ai";
-import { dirname as dirname4, resolve as resolve5 } from "path";
-import process4 from "process";
-
-// src/token.ts
-import { requestToken } from "@odla-ai/db";
-import process3 from "process";
-
-// src/open.ts
-import { spawn as spawn2 } from "child_process";
-import process2 from "process";
-async function openUrl(url, options = {}) {
-  const command = openerFor(options.platform ?? process2.platform);
-  const doSpawn = options.spawnImpl ?? spawn2;
-  await new Promise((resolve7, reject) => {
-    const child = doSpawn(command.cmd, [...command.args, url], {
-      stdio: "ignore",
-      detached: true
-    });
-    child.once("error", reject);
-    child.once("spawn", () => {
-      child.unref();
-      resolve7();
-    });
-  });
-}
-function openerFor(platform) {
-  if (platform === "darwin") return { cmd: "open", args: [] };
-  if (platform === "win32") return { cmd: "cmd", args: ["/c", "start", ""] };
-  return { cmd: "xdg-open", args: [] };
-}
-
-// src/token.ts
-async function getDeveloperToken(cfg, options, doFetch, out) {
-  if (options.token) return options.token;
-  if (process3.env.ODLA_DEV_TOKEN) return process3.env.ODLA_DEV_TOKEN;
-  const cached = readJsonFile(cfg.local.tokenFile);
-  if (cached?.token && (cached.expiresAt ?? 0) > Date.now() + 6e4) {
-    out.log(`auth: using cached developer token (${displayPath(cfg.local.tokenFile, cfg.rootDir)})`);
-    return cached.token;
-  }
-  const browser = approvalBrowser(options);
-  const { token, expiresAt } = await requestToken({
-    endpoint: cfg.platformUrl,
-    label: `${cfg.app.id} provisioner`,
-    fetch: doFetch,
-    onCode: async ({ userCode, expiresIn }) => {
-      const approvalUrl = handshakeUrl(cfg.platformUrl, userCode);
-      out.log("");
-      out.log(`Approve code ${userCode} at ${approvalUrl} within ${Math.floor(expiresIn / 60)}m.`);
-      if (browser.open) {
-        try {
-          await (options.openApprovalUrl ?? openUrl)(approvalUrl);
-          out.log(`auth: opened browser for approval${browser.mode === "auto" ? " (auto)" : ""}`);
-        } catch (err) {
-          out.log(`auth: could not open browser (${err instanceof Error ? err.message : String(err)})`);
-        }
-      } else if (browser.reason) {
-        out.log(`auth: browser launch skipped (${browser.reason})`);
-      }
-      out.log("");
-    }
-  });
-  writePrivateJson(cfg.local.tokenFile, { token, expiresAt });
-  out.log(`auth: developer token cached (${displayPath(cfg.local.tokenFile, cfg.rootDir)})`);
-  return token;
-}
-function approvalBrowser(options) {
-  if (options.open === true) return { open: true, mode: "forced" };
-  if (options.open === false) return { open: false, reason: "disabled by --no-open" };
-  if (process3.env.CI) return { open: false, reason: "CI environment" };
-  const interactive = options.interactive ?? Boolean(process3.stdin.isTTY && process3.stdout.isTTY);
-  if (!interactive) return { open: false, reason: "non-interactive shell; pass --open to force" };
-  return { open: true, mode: "auto" };
-}
-function handshakeUrl(platformUrl, userCode) {
-  const url = new URL("/handshakes", platformUrl);
-  url.searchParams.set("code", userCode);
-  return url.toString();
-}
-
-// src/provision.ts
-async function provision(options) {
-  const out = options.stdout ?? console;
-  const cfg = await loadProjectConfig(options.configPath);
-  const plan = buildPlan(cfg);
-  out.log(`odla-ai: ${plan.appName} (${plan.appId})`);
-  out.log(`  platform: ${plan.platformUrl}`);
-  out.log(`  db:       ${plan.dbEndpoint}`);
-  out.log(`  envs:     ${plan.envs.join(", ")}`);
-  out.log(`  services: ${plan.services.join(", ")}`);
-  const schema = await resolveDataExport(cfg, cfg.db?.schema, ["schema", "SCHEMA"]);
-  const configuredRules = await resolveDataExport(cfg, cfg.db?.rules, ["rules", "RULES"]);
-  const rules = configuredRules ?? (schema && cfg.db?.defaultRules !== false ? rulesFromSchema(schema) : void 0);
-  if (options.dryRun) {
-    out.log("dry run: no network calls or file writes");
-    out.log(`  schema: ${schema ? "yes" : "no"}`);
-    out.log(`  rules:  ${rules ? Object.keys(rules).length : 0} namespaces`);
-    out.log(`  ai:     ${cfg.ai?.provider ?? "not configured"}`);
-    return;
-  }
-  const doFetch = options.fetch ?? fetch;
-  const token = await getDeveloperToken(cfg, options, doFetch, out);
-  const auth = { authorization: `Bearer ${token}`, "content-type": "application/json" };
-  const apps = createAppsClient({ endpoint: cfg.platformUrl, token, fetcher: { fetch: doFetch } });
-  const existing = await readRegistryApp(cfg, token, doFetch);
-  if (existing) {
-    out.log(`app: ${cfg.app.id} already exists`);
-  } else {
-    await apps.createApp({ name: cfg.app.name, appId: cfg.app.id });
-    out.log(`app: created ${cfg.app.id}`);
-  }
-  for (const env of cfg.envs) {
-    for (const service of cfg.services) {
-      if (service === "ai") {
-        if (cfg.ai?.provider) {
-          await apps.setAi(cfg.app.id, env, { provider: cfg.ai.provider, ...cfg.ai.model ? { model: cfg.ai.model } : {} });
-          out.log(`${env}: ai configured (${cfg.ai.provider}${cfg.ai.model ? `/${cfg.ai.model}` : ""})`);
-        } else {
-          await apps.setService(cfg.app.id, "ai", true, { env });
-          out.log(`${env}: ai enabled`);
-        }
-      } else {
-        await apps.setService(cfg.app.id, service, true, { env });
-        out.log(`${env}: ${service} enabled`);
-      }
-    }
-    const authConfig = normalizeClerkConfig(cfg.auth?.clerk?.[env]);
-    if (authConfig?.publishableKey) {
-      await apps.setAuth(cfg.app.id, env, authConfig);
-      out.log(`${env}: auth configured (clerk ${authConfig.mode ?? "client"})`);
-    }
-    const link = cfg.links?.[env];
-    if (link !== void 0) {
-      await apps.setLink(cfg.app.id, env, link ?? null);
-      out.log(`${env}: link ${link ? "set" : "cleared"}`);
-    }
-  }
-  let credentials = readCredentials(cfg.local.credentialsFile);
-  for (const env of cfg.envs) {
-    const tenantId = tenantIdFor(cfg.app.id, env);
-    let dbKey = !options.rotateKeys ? credentials?.envs[env]?.dbKey : void 0;
-    if (dbKey) {
-      out.log(`${env}: reusing local db key for ${tenantId}`);
-    } else {
-      dbKey = await mintDbKey({ cfg, tenantId, env, token, auth, fetch: doFetch });
-      out.log(`${env}: minted db key for ${tenantId}`);
-    }
-    let o11yToken = cfg.services.includes("o11y") && !options.rotateKeys ? credentials?.envs[env]?.o11yToken : void 0;
-    if (cfg.services.includes("o11y")) {
-      if (o11yToken) {
-        out.log(`${env}: reusing local o11y ingest token`);
-      } else {
-        o11yToken = await mintO11yToken(cfg, env, token, doFetch);
-        out.log(`${env}: minted o11y ingest token`);
-      }
-    }
-    if (schema) {
-      await postJson(doFetch, `${cfg.dbEndpoint}/app/${encodeURIComponent(tenantId)}/schema`, dbKey, { schema });
-      out.log(`${env}: schema pushed`);
-    }
-    if (rules) {
-      await postJson(doFetch, `${cfg.dbEndpoint}/app/${encodeURIComponent(tenantId)}/admin/rules`, token, rules);
-      out.log(`${env}: rules pushed (${Object.keys(rules).length} namespaces)`);
-    }
-    if (cfg.ai?.provider && cfg.ai.keyEnv) {
-      const key = process4.env[cfg.ai.keyEnv];
-      if (key) {
-        const secretName = cfg.ai.secretName ?? defaultSecretName(cfg.ai.provider);
-        await putSecret({ endpoint: cfg.dbEndpoint, token, fetch: doFetch }, tenantId, secretName, key);
-        out.log(`${env}: ${cfg.ai.provider} key stored in vault (${secretName})`);
-      } else {
-        out.log(`${env}: ${cfg.ai.keyEnv} not set; skipped provider key storage`);
-      }
-    }
-    credentials = mergeCredential(credentials, {
-      appId: cfg.app.id,
-      platformUrl: cfg.platformUrl,
-      dbEndpoint: cfg.dbEndpoint,
-      env,
-      tenantId,
-      dbKey,
-      ...o11yToken ? { o11yToken } : {}
-    });
-  }
-  if (cfg.local.gitignore) ensureGitignore(cfg.rootDir);
-  if (options.writeCredentials !== false && credentials) {
-    writePrivateJson(cfg.local.credentialsFile, credentials);
-    out.log(`credentials: wrote ${displayPath(cfg.local.credentialsFile, cfg.rootDir)} (0600, gitignored)`);
-  }
-  const devVarsTarget = resolveWriteDevVarsTarget(cfg, options.writeDevVars);
-  if (devVarsTarget && credentials) {
-    const env = cfg.envs.includes("dev") ? "dev" : cfg.envs[0] ?? "prod";
-    writeDevVars(devVarsTarget, credentials, env, o11yDevVars(cfg));
-    out.log(`dev vars: wrote ${displayPath(devVarsTarget, cfg.rootDir)} for ${env}`);
-  }
-}
-function o11yDevVars(cfg) {
-  if (!cfg.services.includes("o11y")) return void 0;
-  return {
-    endpoint: cfg.o11y?.endpoint ?? "https://o11y.odla.ai",
-    service: cfg.o11y?.service ?? cfg.app.id,
-    ...cfg.o11y?.version ? { version: cfg.o11y.version } : {}
-  };
-}
-async function readRegistryApp(cfg, token, doFetch) {
-  const res = await doFetch(`${cfg.platformUrl}/registry/apps/${encodeURIComponent(cfg.app.id)}`, {
-    headers: { authorization: `Bearer ${token}` }
-  });
-  if (res.status === 404) return null;
-  if (!res.ok) return null;
-  const json = await res.json();
-  return json.app ?? null;
-}
-async function mintDbKey(opts) {
-  let res = await opts.fetch(`${opts.cfg.dbEndpoint}/admin/apps/${encodeURIComponent(opts.tenantId)}/keys`, {
-    method: "POST",
-    headers: opts.auth,
-    body: "{}"
-  });
-  if (res.status === 404) {
-    const created = await opts.fetch(`${opts.cfg.dbEndpoint}/admin/apps`, {
-      method: "POST",
-      headers: opts.auth,
-      body: JSON.stringify({
-        name: opts.env === "prod" ? opts.cfg.app.name : `${opts.cfg.app.name} (${opts.env})`,
-        appId: opts.tenantId
-      })
-    });
-    if (!created.ok) throw new Error(`db app create (${opts.tenantId}) failed: ${created.status} ${await safeText(created)}`);
-    res = await opts.fetch(`${opts.cfg.dbEndpoint}/admin/apps/${encodeURIComponent(opts.tenantId)}/keys`, {
-      method: "POST",
-      headers: opts.auth,
-      body: "{}"
-    });
-  }
-  if (!res.ok) throw new Error(`db key mint (${opts.tenantId}) failed: ${res.status} ${await safeText(res)}`);
-  const body = await res.json();
-  if (!body.key) throw new Error(`db key mint (${opts.tenantId}) returned no key`);
-  return body.key;
-}
-async function mintO11yToken(cfg, env, token, doFetch) {
-  const res = await doFetch(
-    `${cfg.platformUrl}/o11y/${encodeURIComponent(cfg.app.id)}/token?env=${encodeURIComponent(env)}`,
-    { method: "POST", headers: { authorization: `Bearer ${token}` } }
-  );
-  if (!res.ok) throw new Error(`o11y token mint (${env}) failed: ${res.status} ${await safeText(res)}`);
-  const body = await res.json();
-  if (!body.token) throw new Error(`o11y token mint (${env}) returned no token`);
-  return body.token;
-}
-async function postJson(doFetch, url, bearer, body) {
-  const res = await doFetch(url, {
-    method: "POST",
-    headers: { authorization: `Bearer ${bearer}`, "content-type": "application/json" },
-    body: JSON.stringify(body)
-  });
-  if (!res.ok) throw new Error(`${new URL(url).pathname} failed: ${res.status} ${await safeText(res)}`);
-}
-function normalizeClerkConfig(value) {
-  if (!value) return null;
-  if (typeof value === "string") {
-    const publishableKey2 = envValue(value);
-    return publishableKey2 ? { publishableKey: publishableKey2 } : null;
-  }
-  if (typeof value !== "object") return null;
-  const cfg = value;
-  const publishableKey = envValue(cfg.publishableKey);
-  return publishableKey ? { publishableKey, ...cfg.audience ? { audience: cfg.audience } : {}, ...cfg.mode ? { mode: cfg.mode } : {} } : null;
-}
-function defaultSecretName(provider) {
-  const names = DEFAULT_SECRET_NAMES;
-  return names[provider] ?? `${provider}_api_key`;
-}
-function resolveWriteDevVarsTarget(cfg, requested) {
-  if (!requested) return null;
-  if (requested === true) return cfg.local.devVarsFile;
-  return resolve5(dirname4(cfg.configPath), requested);
-}
-async function safeText(res) {
-  try {
-    return redactSecrets((await res.text()).slice(0, 500));
-  } catch {
-    return "";
-  }
-}
-
-// src/secrets.ts
-var PROD_ENV_NAMES = /* @__PURE__ */ new Set(["prod", "production"]);
-async function secretsPush(options) {
-  const out = options.stdout ?? console;
-  const cfg = await loadProjectConfig(options.configPath);
-  const env = options.env;
-  if (!cfg.envs.includes(env)) {
-    throw new Error(`env "${env}" is not in config envs (${cfg.envs.join(", ")})`);
-  }
-  if (PROD_ENV_NAMES.has(env) && !options.yes) {
-    throw new Error(`refusing to push a secret to "${env}" without --yes`);
-  }
-  const credentialsPath = displayPath(cfg.local.credentialsFile, cfg.rootDir);
-  const credentials = readCredentials(cfg.local.credentialsFile);
-  if (!credentials) throw new Error(`no credentials at ${credentialsPath} \u2014 run "odla-ai provision" first`);
-  if (credentials.appId !== cfg.app.id) {
-    throw new Error(`credentials at ${credentialsPath} are for "${credentials.appId}", not "${cfg.app.id}"`);
-  }
-  const dbKey = credentials.envs[env]?.dbKey;
-  if (!dbKey) throw new Error(`no db key for env "${env}" in ${credentialsPath} \u2014 run "odla-ai provision" first`);
-  const wranglerConfig = findWranglerConfig(cfg.rootDir);
-  if (!wranglerConfig) {
-    throw new Error(`no wrangler config found in ${cfg.rootDir} (wrangler.jsonc, wrangler.json, or wrangler.toml)`);
-  }
-  const wranglerEnv = PROD_ENV_NAMES.has(env) ? void 0 : env;
-  const target = wranglerEnv ? `wrangler env "${wranglerEnv}"` : "the top-level (prod) wrangler env";
-  const secrets = [{ name: "ODLA_API_KEY", value: dbKey }];
-  const o11yToken = credentials.envs[env]?.o11yToken;
-  if (o11yToken) secrets.push({ name: "ODLA_O11Y_TOKEN", value: o11yToken });
-  if (options.dryRun) {
-    for (const s of secrets) out.log(`dry run: would push ${s.name} (${redactSecrets(s.value)}) to ${target}`);
-    return;
-  }
-  const run = options.runner ?? defaultRunner;
-  if (!await wranglerLoggedIn(run, cfg.rootDir)) {
-    throw new Error(`wrangler is not logged in \u2014 run "wrangler login" (a browser step for the human)`);
-  }
-  for (const s of secrets) {
-    const result = await wranglerPutSecret(run, { name: s.name, value: s.value, env: wranglerEnv, cwd: cfg.rootDir });
-    if (result.code !== 0) {
-      throw new Error(`wrangler secret put ${s.name} failed (exit ${result.code}): ${redactSecrets(`${result.stderr || result.stdout}`.trim())}`);
-    }
-    out.log(`${s.name} pushed to ${target} (value read from ${credentialsPath}, never echoed)`);
-  }
-}
-
-// src/skill.ts
-import { existsSync as existsSync6, mkdirSync as mkdirSync3, readFileSync as readFileSync5, readdirSync, writeFileSync as writeFileSync3 } from "fs";
-import { homedir } from "os";
-import { join as join3, relative as relative2, resolve as resolve6 } from "path";
-import { fileURLToPath } from "url";
-function installSkill(options = {}) {
-  const out = options.stdout ?? console;
-  const sourceDir = options.sourceDir ?? fileURLToPath(new URL("../skills", import.meta.url));
-  const targetDir = options.global ? join3(options.homeDir ?? homedir(), ".claude", "skills") : resolve6(options.dir ?? process.cwd(), ".claude", "skills");
-  const files = listFiles(sourceDir);
-  if (files.length === 0) throw new Error(`no bundled skills found at ${sourceDir}`);
-  const written = [];
-  const unchanged = [];
-  const conflicts = [];
-  for (const rel of files) {
-    const target = join3(targetDir, rel);
-    const source = readFileSync5(join3(sourceDir, rel), "utf8");
-    if (existsSync6(target)) {
-      const current = readFileSync5(target, "utf8");
-      if (current === source) {
-        unchanged.push(rel);
-        continue;
-      }
-      if (!options.force) {
-        conflicts.push(rel);
-        continue;
-      }
-    }
-    written.push(rel);
-  }
-  if (conflicts.length > 0) {
-    throw new Error(
-      `skill files modified locally (re-run with --force to overwrite):
-${conflicts.map((f) => `  - ${join3(targetDir, f)}`).join("\n")}`
-    );
-  }
-  for (const rel of written) {
-    const target = join3(targetDir, rel);
-    mkdirSync3(join3(target, ".."), { recursive: true });
-    writeFileSync3(target, readFileSync5(join3(sourceDir, rel), "utf8"));
-  }
-  const skills = [...new Set(files.map((f) => f.split(/[\\/]/)[0]))].sort();
-  out.log(`skills: ${skills.join(", ")}`);
-  out.log(`installed ${written.length} file(s) to ${targetDir}${unchanged.length ? ` (${unchanged.length} unchanged)` : ""}`);
-  return { targetDir, written, unchanged };
-}
-function listFiles(dir) {
-  if (!existsSync6(dir)) return [];
-  const results = [];
-  const walk = (current) => {
-    for (const entry of readdirSync(current, { withFileTypes: true })) {
-      const path = join3(current, entry.name);
-      if (entry.isDirectory()) walk(path);
-      else results.push(relative2(dir, path));
-    }
-  };
-  walk(dir);
-  return results.sort();
-}
-
-// src/smoke.ts
-async function smoke(options) {
-  const out = options.stdout ?? console;
-  const cfg = await loadProjectConfig(options.configPath);
-  const env = options.env ?? (cfg.envs.includes("dev") ? "dev" : cfg.envs[0] ?? "prod");
-  if (!cfg.envs.includes(env)) throw new Error(`env "${env}" is not declared in ${displayPath(cfg.configPath, cfg.rootDir)}`);
-  const credentials = readCredentials(cfg.local.credentialsFile);
-  if (!credentials) {
-    throw new Error(`local credentials missing: ${displayPath(cfg.local.credentialsFile, cfg.rootDir)}. Run "odla-ai provision --write-dev-vars".`);
-  }
-  if (credentials.appId !== cfg.app.id) {
-    throw new Error(`local credentials are for app "${credentials.appId}", but config app is "${cfg.app.id}"`);
-  }
-  const entry = credentials.envs[env];
-  if (!entry?.tenantId || !entry.dbKey) {
-    throw new Error(`local credentials have no db key for env "${env}". Run "odla-ai provision --write-dev-vars".`);
-  }
-  const doFetch = options.fetch ?? fetch;
-  out.log(`smoke: ${cfg.app.id}/${env}`);
-  out.log(`  tenant: ${entry.tenantId}`);
-  const publicConfig = await getJson(doFetch, publicConfigUrl(cfg.platformUrl, cfg.app.id, env), void 0);
-  out.log(`  public-config: ok`);
-  if (cfg.ai?.provider) {
-    const provider = publicConfig.ai?.provider ?? null;
-    if (provider !== cfg.ai.provider) {
-      throw new Error(`ai provider mismatch: expected "${cfg.ai.provider}", public-config has "${provider ?? "none"}"`);
-    }
-    out.log(`  ai: ${provider}`);
-  }
-  const expectedSchema = await resolveDataExport(cfg, cfg.db?.schema, ["schema", "SCHEMA"]);
-  const expectedEntities = serializedEntities(expectedSchema);
-  const liveSchemaPayload = await getJson(doFetch, `${cfg.dbEndpoint}/app/${encodeURIComponent(entry.tenantId)}/schema`, entry.dbKey);
-  const liveSchema = liveSchemaPayload.schema ?? liveSchemaPayload;
-  const liveEntities = serializedEntities(liveSchema);
-  if (expectedEntities.length) {
-    const missing = expectedEntities.filter((entity) => !liveEntities.includes(entity));
-    if (missing.length) throw new Error(`live schema is missing expected entities: ${missing.join(", ")}`);
-  }
-  out.log(`  schema: ${liveEntities.length} entities`);
-  const aggregateEntity = expectedEntities[0] ?? liveEntities[0];
-  if (aggregateEntity) {
-    const aggregate = await postJson2(doFetch, `${cfg.dbEndpoint}/app/${encodeURIComponent(entry.tenantId)}/aggregate`, entry.dbKey, {
-      ns: aggregateEntity,
-      aggregate: { count: true }
-    });
-    const count = aggregate.aggregate?.count;
-    out.log(`  aggregate: ${aggregateEntity}.count=${String(count ?? "ok")}`);
-  } else {
-    out.log(`  aggregate: skipped (schema has no entities)`);
-  }
-  out.log("ok");
-}
-async function getJson(doFetch, url, bearer) {
-  const res = await doFetch(url, {
-    headers: bearer ? { authorization: `Bearer ${bearer}` } : void 0
-  });
-  if (!res.ok) throw new Error(`${new URL(url).pathname} returned ${res.status}: ${await safeText2(res)}`);
-  return res.json();
-}
-async function postJson2(doFetch, url, bearer, body) {
-  const res = await doFetch(url, {
-    method: "POST",
-    headers: { authorization: `Bearer ${bearer}`, "content-type": "application/json" },
-    body: JSON.stringify(body)
-  });
-  if (!res.ok) throw new Error(`${new URL(url).pathname} returned ${res.status}: ${await safeText2(res)}`);
-  return res.json();
-}
-function publicConfigUrl(platformUrl, appId, env) {
-  const url = new URL(`/registry/apps/${encodeURIComponent(appId)}/public-config`, platformUrl);
-  url.searchParams.set("env", env);
-  return url.toString();
-}
-async function safeText2(res) {
-  try {
-    return (await res.text()).slice(0, 500);
-  } catch {
-    return "";
-  }
-}
-
-// src/cli.ts
-import { readFileSync as readFileSync6 } from "fs";
-async function runCli(argv = process.argv.slice(2)) {
-  const parsed = parseArgv(argv);
-  const command = parsed.positionals[0] ?? "help";
-  if (command === "version" || command === "-v" || parsed.options.version === true) {
-    console.log(cliVersion());
-    return;
-  }
-  if (command === "help" || command === "--help" || command === "-h") {
-    printHelp();
-    return;
-  }
-  if (command === "init") {
-    initProject({
-      appId: requiredString(parsed.options["app-id"], "--app-id"),
-      name: requiredString(parsed.options.name, "--name"),
-      configPath: stringOpt(parsed.options.config),
-      envs: listOpt(parsed.options.env),
-      services: listOpt(parsed.options.services),
-      aiProvider: stringOpt(parsed.options["ai-provider"]),
-      force: parsed.options.force === true
-    });
-    return;
-  }
-  if (command === "doctor") {
-    await doctor({ configPath: stringOpt(parsed.options.config) ?? "odla.config.mjs" });
-    return;
-  }
-  if (command === "provision") {
-    const writeDevVars2 = parsed.options["write-dev-vars"];
-    const opts = {
-      configPath: stringOpt(parsed.options.config) ?? "odla.config.mjs",
-      dryRun: parsed.options["dry-run"] === true,
-      rotateKeys: parsed.options["rotate-keys"] === true,
-      writeCredentials: parsed.options["write-credentials"] !== false,
-      writeDevVars: typeof writeDevVars2 === "string" ? writeDevVars2 : writeDevVars2 === true,
-      token: stringOpt(parsed.options.token),
-      open: parsed.options.open === false ? false : parsed.options.open === true ? true : void 0,
-      yes: parsed.options.yes === true
-    };
-    await provision(opts);
-    return;
-  }
-  if (command === "smoke") {
-    await smoke({
-      configPath: stringOpt(parsed.options.config) ?? "odla.config.mjs",
-      env: stringOpt(parsed.options.env)
-    });
-    return;
-  }
-  if (command === "setup") {
-    installSkill({
-      dir: stringOpt(parsed.options.dir),
-      global: parsed.options.global === true,
-      force: parsed.options.force === true
-    });
-    console.log(
-      "\nSkills installed. Point your coding agent at this repo \u2014 the `odla` skill orients it\n(build a new app, or migrate an existing site) and drives `odla-ai init` / `provision`."
-    );
-    return;
-  }
-  if (command === "skill") {
-    const sub = parsed.positionals[1];
-    if (sub !== "install") throw new Error(`unknown skill subcommand "${sub ?? ""}". Try "odla-ai skill install".`);
-    installSkill({
-      dir: stringOpt(parsed.options.dir),
-      global: parsed.options.global === true,
-      force: parsed.options.force === true
-    });
-    return;
-  }
-  if (command === "secrets") {
-    const sub = parsed.positionals[1];
-    if (sub !== "push") throw new Error(`unknown secrets subcommand "${sub ?? ""}". Try "odla-ai secrets push --env dev".`);
-    await secretsPush({
-      configPath: stringOpt(parsed.options.config) ?? "odla.config.mjs",
-      env: requiredString(parsed.options.env, "--env"),
-      dryRun: parsed.options["dry-run"] === true,
-      yes: parsed.options.yes === true
-    });
-    return;
-  }
-  throw new Error(`unknown command "${command}". Run "odla-ai help".`);
-}
-function parseArgv(argv) {
-  const positionals = [];
-  const options = {};
-  for (let i = 0; i < argv.length; i++) {
-    const arg = argv[i];
-    if (!arg.startsWith("--")) {
-      positionals.push(arg);
-      continue;
-    }
-    const eq = arg.indexOf("=");
-    const rawName = arg.slice(2, eq === -1 ? void 0 : eq);
-    if (!rawName) continue;
-    if (rawName.startsWith("no-")) {
-      options[rawName.slice(3)] = false;
-      continue;
-    }
-    if (eq !== -1) {
-      addOption(options, rawName, arg.slice(eq + 1));
-      continue;
-    }
-    const value = argv[i + 1];
-    if (value !== void 0 && !value.startsWith("--")) {
-      i++;
-      addOption(options, rawName, value);
-    } else {
-      addOption(options, rawName, true);
-    }
-  }
-  return { positionals, options };
-}
-function addOption(options, name, value) {
-  const cur = options[name];
-  if (cur === void 0) {
-    options[name] = value;
-  } else if (Array.isArray(cur)) {
-    cur.push(String(value));
-  } else {
-    options[name] = [String(cur), String(value)];
-  }
-}
-function requiredString(value, name) {
-  const s = stringOpt(value);
-  if (!s) throw new Error(`${name} is required`);
-  return s;
-}
-function stringOpt(value) {
-  if (typeof value === "string") return value;
-  if (Array.isArray(value)) return value[value.length - 1];
-  return void 0;
-}
-function listOpt(value) {
-  if (value === void 0 || value === false || value === true) return void 0;
-  const values = Array.isArray(value) ? value : [value];
-  return values.flatMap((item) => item.split(",")).map((item) => item.trim()).filter(Boolean);
-}
-function cliVersion() {
-  const pkg = JSON.parse(readFileSync6(new URL("../package.json", import.meta.url), "utf8"));
-  return pkg.version ?? "unknown";
-}
-function printHelp() {
-  console.log(`odla-ai
-
-Usage:
-  odla-ai setup [--dir <project>] [--global] [--force]
-  odla-ai init --app-id <id> --name <name> [--services db,ai] [--env dev --env prod]
-  odla-ai doctor [--config odla.config.mjs]
-  odla-ai provision [--config odla.config.mjs] [--dry-run] [--open|--no-open] [--rotate-keys] [--write-dev-vars[=path]]
-  odla-ai smoke [--config odla.config.mjs] [--env dev]
-  odla-ai skill install [--dir <project>] [--global] [--force]
-  odla-ai secrets push --env <env> [--config odla.config.mjs] [--dry-run] [--yes]
-  odla-ai version
-
-Commands:
-  setup       Install the odla skills so a coding agent can drive the rest.
-  init        Create a generic odla.config.mjs plus starter schema/rules files.
-  doctor      Validate and summarize the project config without network calls.
-  provision   Register the app, enable services, push schema/rules, configure AI/auth.
-  smoke       Verify local credentials, public-config, live schema, and db aggregate.
-  skill       Install the bundled Claude Code skills into .claude/skills/.
-  secrets     Push the env's db key into the Worker via wrangler, stdin-piped.
-  version     Print the CLI version.
-
-Safety:
-  Provision caches the approved developer token and local db keys under .odla/
-  with mode 0600, and init adds those paths to .gitignore.
-  Provision opens the approval page automatically in interactive terminals;
-  use --open to force browser launch or --no-open to suppress it.
-`);
-}
-
-export {
-  redactSecrets,
-  doctor,
-  initProject,
-  provision,
-  secretsPush,
-  installSkill,
-  smoke,
-  runCli
-};
-//# sourceMappingURL=chunk-UWT7C6VT.js.map