@odla-ai/cli 0.4.0 → 0.6.0

package/dist/chunk-OERLHVLH.js

@@ -0,0 +1,2107 @@
+#!/usr/bin/env node
+
+// src/admin-ai.ts
+import process4 from "process";
+import { existsSync as existsSync2 } from "fs";
+import { requestToken as requestToken2 } from "@odla-ai/db";
+
+// src/open.ts
+import { spawn } from "child_process";
+import process2 from "process";
+async function openUrl(url, options = {}) {
+  const command = openerFor(options.platform ?? process2.platform);
+  const doSpawn = options.spawnImpl ?? spawn;
+  await new Promise((resolve7, reject) => {
+    const child = doSpawn(command.cmd, [...command.args, url], {
+      stdio: "ignore",
+      detached: true
+    });
+    child.once("error", reject);
+    child.once("spawn", () => {
+      child.unref();
+      resolve7();
+    });
+  });
+}
+function openerFor(platform) {
+  if (platform === "darwin") return { cmd: "open", args: [] };
+  if (platform === "win32") return { cmd: "cmd", args: ["/c", "start", ""] };
+  return { cmd: "xdg-open", args: [] };
+}
+
+// src/token.ts
+import { requestToken } from "@odla-ai/db";
+import process3 from "process";
+
+// src/local.ts
+import { chmodSync, existsSync, mkdirSync, readFileSync, renameSync, writeFileSync } from "fs";
+import { dirname, isAbsolute, relative, resolve } from "path";
+var GITIGNORE_LINES = [".odla/*.local.json", ".odla/dev-token.json", ".dev.vars"];
+function readJsonFile(path) {
+  try {
+    return JSON.parse(readFileSync(path, "utf8"));
+  } catch {
+    return null;
+  }
+}
+function writePrivateJson(path, value) {
+  writePrivateText(path, `${JSON.stringify(value, null, 2)}
+`);
+}
+function readCredentials(path) {
+  if (!existsSync(path)) return null;
+  let value;
+  try {
+    value = JSON.parse(readFileSync(path, "utf8"));
+  } catch {
+    throw new Error(`credentials file ${path} is not valid JSON; fix or remove it before provisioning`);
+  }
+  if (!value || typeof value !== "object" || typeof value.appId !== "string" || !value.envs || typeof value.envs !== "object") {
+    throw new Error(`credentials file ${path} has an invalid shape; fix or remove it before provisioning`);
+  }
+  return value;
+}
+function mergeCredential(current, update) {
+  const next = current ?? {
+    appId: update.appId,
+    platformUrl: update.platformUrl,
+    dbEndpoint: update.dbEndpoint,
+    updatedAt: (/* @__PURE__ */ new Date(0)).toISOString(),
+    envs: {}
+  };
+  next.appId = update.appId;
+  next.platformUrl = update.platformUrl;
+  next.dbEndpoint = update.dbEndpoint;
+  next.updatedAt = (/* @__PURE__ */ new Date()).toISOString();
+  next.envs[update.env] = {
+    ...next.envs[update.env] ?? {},
+    tenantId: update.tenantId,
+    ...update.dbKey ? { dbKey: update.dbKey } : {},
+    ...update.o11yToken ? { o11yToken: update.o11yToken } : {}
+  };
+  return next;
+}
+function ensureGitignore(rootDir, localPaths = []) {
+  const path = resolve(rootDir, ".gitignore");
+  const existing = existsSync(path) ? readFileSync(path, "utf8") : "";
+  const configured = localPaths.map((localPath) => gitignoreEntry(rootDir, localPath)).filter((line) => !!line);
+  const wanted = [.../* @__PURE__ */ new Set([...GITIGNORE_LINES, ...configured])];
+  const missing = wanted.filter((line) => !existing.split(/\r?\n/).includes(line));
+  if (missing.length === 0) return;
+  const prefix = existing && !existing.endsWith("\n") ? "\n" : "";
+  writeFileSync(path, `${existing}${prefix}${missing.join("\n")}
+`);
+}
+function o11yDevVars(cfg) {
+  if (!cfg.services.includes("o11y")) return void 0;
+  return {
+    endpoint: cfg.o11y?.endpoint ?? "https://o11y.odla.ai",
+    service: cfg.o11y?.service ?? cfg.app.id,
+    ...cfg.o11y?.version ? { version: cfg.o11y.version } : {}
+  };
+}
+function resolveWriteDevVarsTarget(cfg, requested) {
+  if (!requested) return null;
+  if (requested === true) return cfg.local.devVarsFile;
+  return resolve(dirname(cfg.configPath), requested);
+}
+function writeDevVars(path, credentials, env, o11y) {
+  const entry = credentials.envs[env];
+  if (!entry) throw new Error(`no credentials for env "${env}" in ${path}`);
+  const lines = [`ODLA_PLATFORM="${credentials.platformUrl}"`];
+  if (entry.dbKey) lines.push(`ODLA_ENDPOINT="${credentials.dbEndpoint}"`);
+  lines.push(`ODLA_APP_ID="${credentials.appId}"`, `ODLA_ENV="${env}"`, `ODLA_TENANT="${entry.tenantId}"`);
+  if (entry.dbKey) lines.push(`ODLA_API_KEY="${entry.dbKey}"`);
+  if (o11y) {
+    lines.push(`ODLA_O11Y_ENDPOINT="${o11y.endpoint}"`, `ODLA_O11Y_SERVICE="${o11y.service}"`);
+    if (o11y.version) lines.push(`ODLA_O11Y_VERSION="${o11y.version}"`);
+    if (entry.o11yToken) lines.push(`ODLA_O11Y_TOKEN="${entry.o11yToken}"`);
+  }
+  const existing = existsSync(path) ? readFileSync(path, "utf8") : "";
+  const retained = existing.split(/\r?\n/).filter((line) => !isManagedDevVar(line));
+  while (retained.at(-1) === "") retained.pop();
+  const prefix = retained.length ? `${retained.join("\n")}
+
+` : "";
+  writePrivateText(path, `${prefix}${lines.join("\n")}
+`);
+}
+var MANAGED_DEV_VARS = /* @__PURE__ */ new Set([
+  "ODLA_PLATFORM",
+  "ODLA_ENDPOINT",
+  "ODLA_APP_ID",
+  "ODLA_ENV",
+  "ODLA_TENANT",
+  "ODLA_API_KEY",
+  "ODLA_O11Y_ENDPOINT",
+  "ODLA_O11Y_SERVICE",
+  "ODLA_O11Y_VERSION",
+  "ODLA_O11Y_TOKEN"
+]);
+function isManagedDevVar(line) {
+  const match = line.match(/^\s*(?:export\s+)?([A-Z][A-Z0-9_]*)\s*=/);
+  return !!match?.[1] && MANAGED_DEV_VARS.has(match[1]);
+}
+function writePrivateText(path, text) {
+  mkdirSync(dirname(path), { recursive: true });
+  const temporary = `${path}.tmp-${process.pid}-${Date.now()}`;
+  writeFileSync(temporary, text, { mode: 384 });
+  chmodSync(temporary, 384);
+  renameSync(temporary, path);
+}
+function gitignoreEntry(rootDir, path) {
+  const rel = relative(resolve(rootDir), resolve(path));
+  if (!rel || rel === ".." || rel.startsWith(`..${process.platform === "win32" ? "\\" : "/"}`) || isAbsolute(rel)) return null;
+  return rel.replaceAll("\\", "/");
+}
+function displayPath(path, rootDir = process.cwd()) {
+  const rel = relative(rootDir, path);
+  return rel && !rel.startsWith("..") ? rel : path;
+}
+
+// src/token.ts
+async function getDeveloperToken(cfg, options, doFetch, out) {
+  if (options.token) return options.token;
+  if (process3.env.ODLA_DEV_TOKEN) return process3.env.ODLA_DEV_TOKEN;
+  const cached = readJsonFile(cfg.local.tokenFile);
+  if (cached?.token && (cached.expiresAt ?? 0) > Date.now() + 6e4) {
+    out.log(`auth: using cached developer token (${displayPath(cfg.local.tokenFile, cfg.rootDir)})`);
+    return cached.token;
+  }
+  const browser = approvalBrowser(options);
+  const { token, expiresAt } = await requestToken({
+    endpoint: cfg.platformUrl,
+    label: `${cfg.app.id} provisioner`,
+    fetch: doFetch,
+    onCode: async ({ userCode, expiresIn }) => {
+      const approvalUrl = handshakeUrl(cfg.platformUrl, userCode);
+      out.log("");
+      out.log(`Approve code ${userCode} at ${approvalUrl} within ${Math.floor(expiresIn / 60)}m.`);
+      if (browser.open) {
+        try {
+          await (options.openApprovalUrl ?? openUrl)(approvalUrl);
+          out.log(`auth: opened browser for approval${browser.mode === "auto" ? " (auto)" : ""}`);
+        } catch (err) {
+          out.log(`auth: could not open browser (${err instanceof Error ? err.message : String(err)})`);
+        }
+      } else if (browser.reason) {
+        out.log(`auth: browser launch skipped (${browser.reason})`);
+      }
+      out.log("");
+    }
+  });
+  writePrivateJson(cfg.local.tokenFile, { token, expiresAt });
+  out.log(`auth: developer token cached (${displayPath(cfg.local.tokenFile, cfg.rootDir)})`);
+  return token;
+}
+function approvalBrowser(options) {
+  if (options.open === true) return { open: true, mode: "forced" };
+  if (options.open === false) return { open: false, reason: "disabled by --no-open" };
+  if (process3.env.CI) return { open: false, reason: "CI environment" };
+  const interactive = options.interactive ?? Boolean(process3.stdin.isTTY && process3.stdout.isTTY);
+  if (!interactive) return { open: false, reason: "non-interactive shell; pass --open to force" };
+  return { open: true, mode: "auto" };
+}
+function handshakeUrl(platformUrl, userCode) {
+  const url = new URL("/studio", platformUrl);
+  url.searchParams.set("code", userCode);
+  return url.toString();
+}
+
+// src/admin-ai.ts
+var SYSTEM_AI_PURPOSES = ["o11y.triage", "security.discovery", "security.validation"];
+async function getScopedPlatformToken(options) {
+  const fromEnv = process4.env.ODLA_ADMIN_TOKEN;
+  if (fromEnv) return fromEnv;
+  return scopedToken(
+    options.platform.replace(/\/$/, ""),
+    options.scope,
+    { action: "show", ...options },
+    options.fetch ?? fetch,
+    options.stdout ?? console
+  );
+}
+async function adminAi(options) {
+  const platform = (options.platform ?? process4.env.ODLA_PLATFORM ?? "https://odla.ai").replace(/\/$/, "");
+  const doFetch = options.fetch ?? fetch;
+  const out = options.stdout ?? console;
+  const scope = options.action === "set" || options.action === "credential-set" ? "platform:ai:write" : "platform:ai:read";
+  const token = options.token ?? process4.env.ODLA_ADMIN_TOKEN ?? await scopedToken(platform, scope, options, doFetch, out);
+  const headers = { authorization: `Bearer ${token}`, "content-type": "application/json" };
+  if (options.action === "credentials") {
+    const res2 = await doFetch(`${platform}/registry/platform/ai-credentials`, { headers });
+    const body2 = await responseBody(res2);
+    if (!res2.ok) throw new Error(apiError("read platform AI credential status", res2.status, body2));
+    const credentials = isRecord(body2) && isRecord(body2.credentials) ? body2.credentials : body2;
+    if (options.json) out.log(JSON.stringify({ credentials }, null, 2));
+    else for (const [provider, status] of Object.entries(isRecord(credentials) ? credentials : {})) {
+      out.log(`${provider}	${isRecord(status) && status.set === true ? "set" : "not set"}`);
+    }
+    return;
+  }
+  if (options.action === "credential-set") {
+    const provider = requireProvider(options.credentialProvider);
+    const value = await credentialValue(options);
+    const res2 = await doFetch(`${platform}/registry/platform/ai-credentials/${encodeURIComponent(provider)}`, {
+      method: "PUT",
+      headers,
+      body: JSON.stringify({ value })
+    });
+    const body2 = await responseBody(res2);
+    if (!res2.ok) throw new Error(apiError(`store ${provider} platform credential`, res2.status, body2));
+    out.log(`stored ${provider} platform credential (write-only; value was not returned)`);
+    return;
+  }
+  if (options.action === "show") {
+    const res2 = await doFetch(`${platform}/registry/platform/ai-policies`, { headers });
+    const body2 = await responseBody(res2);
+    if (!res2.ok) throw new Error(apiError("read platform AI policies", res2.status, body2));
+    const policies = policyArray(body2);
+    if (options.json) {
+      out.log(JSON.stringify({ policies }, null, 2));
+      return;
+    }
+    out.log("purpose	enabled	provider	model	max calls	max input bytes	max output tokens");
+    for (const policy2 of policies) {
+      out.log([
+        policy2.purpose,
+        String(policy2.enabled),
+        policy2.provider,
+        policy2.model,
+        String(policy2.maxCallsPerRun ?? ""),
+        String(policy2.maxInputBytes ?? ""),
+        String(policy2.maxOutputTokens ?? "")
+      ].join("	"));
+    }
+    return;
+  }
+  const purpose = requirePurpose(options.purpose);
+  if (!options.provider?.trim()) throw new Error("--provider is required");
+  if (!options.model?.trim()) throw new Error("--model is required");
+  const body = {
+    provider: options.provider.trim(),
+    model: options.model.trim(),
+    ...options.enabled === void 0 ? {} : { enabled: options.enabled },
+    ...options.maxInputBytes === void 0 ? {} : { maxInputBytes: options.maxInputBytes },
+    ...options.maxOutputTokens === void 0 ? {} : { maxOutputTokens: options.maxOutputTokens },
+    ...options.maxCallsPerRun === void 0 ? {} : { maxCallsPerRun: options.maxCallsPerRun }
+  };
+  const res = await doFetch(`${platform}/registry/platform/ai-policies/${encodeURIComponent(purpose)}`, {
+    method: "PUT",
+    headers,
+    body: JSON.stringify(body)
+  });
+  const response = await responseBody(res);
+  if (!res.ok) throw new Error(apiError(`update ${purpose}`, res.status, response));
+  const policy = isRecord(response) && isRecord(response.policy) ? response.policy : isRecord(response) ? response : {};
+  out.log(options.json ? JSON.stringify({ policy }, null, 2) : `updated ${purpose}: ${String(policy.provider ?? body.provider)}/${String(policy.model ?? body.model)}`);
+}
+async function scopedToken(platform, scope, options, doFetch, out) {
+  const tokenFile = options.tokenFile ?? `${process4.cwd()}/.odla/admin-token.local.json`;
+  const cache = readJsonFile(tokenFile);
+  const cached = cache?.platform === platform ? cache.tokens?.[scope] : void 0;
+  if (cached?.token && (cached.expiresAt ?? 0) > Date.now() + 6e4) {
+    out.log(`auth: using cached ${scope} grant (${tokenFile})`);
+    return cached.token;
+  }
+  const { token, expiresAt } = await requestToken2({
+    endpoint: platform,
+    label: `odla CLI admin AI (${scope})`,
+    scopes: [scope],
+    fetch: doFetch,
+    onCode: async ({ userCode, expiresIn }) => {
+      const approvalUrl = handshakeUrl(platform, userCode);
+      out.log(`Approve scoped request ${userCode} at ${approvalUrl} within ${Math.floor(expiresIn / 60)}m.`);
+      const shouldOpen = options.open === true || options.open !== false && !process4.env.CI && Boolean(process4.stdin.isTTY && process4.stdout.isTTY);
+      if (shouldOpen) await (options.openApprovalUrl ?? openUrl)(approvalUrl).catch(() => void 0);
+    }
+  });
+  const tokens = cache?.platform === platform ? { ...cache.tokens ?? {} } : {};
+  tokens[scope] = { token, expiresAt };
+  if (existsSync2(`${process4.cwd()}/.git`)) ensureGitignore(process4.cwd(), [tokenFile]);
+  writePrivateJson(tokenFile, { platform, tokens });
+  out.log(`auth: cached ${scope} grant (${tokenFile}; mode 0600)`);
+  return token;
+}
+function requirePurpose(value) {
+  if (!SYSTEM_AI_PURPOSES.includes(value)) {
+    throw new Error(`purpose must be one of: ${SYSTEM_AI_PURPOSES.join(", ")}`);
+  }
+  return value;
+}
+function requireProvider(value) {
+  if (value !== "anthropic" && value !== "openai" && value !== "google") {
+    throw new Error("provider must be one of: anthropic, openai, google");
+  }
+  return value;
+}
+async function credentialValue(options) {
+  if (options.fromEnv && options.stdin) throw new Error("choose exactly one of --from-env or --stdin");
+  let value;
+  if (options.fromEnv) value = process4.env[options.fromEnv];
+  else if (options.stdin) value = await (options.readStdin ?? readStdin)();
+  else throw new Error("credential input required: use --from-env <NAME> or --stdin; values are never accepted as arguments");
+  value = value?.replace(/[\r\n]+$/, "");
+  if (!value) throw new Error(options.fromEnv ? `environment variable ${options.fromEnv} is empty or unset` : "stdin credential is empty");
+  if (new TextEncoder().encode(value).byteLength > 64 * 1024) throw new Error("credential exceeds 64 KiB");
+  return value;
+}
+async function readStdin() {
+  let value = "";
+  for await (const chunk of process4.stdin) {
+    value += String(chunk);
+    if (value.length > 64 * 1024) throw new Error("credential exceeds 64 KiB");
+  }
+  return value;
+}
+function policyArray(body) {
+  if (isRecord(body) && Array.isArray(body.policies)) return body.policies.filter(isRecord);
+  if (isRecord(body) && isRecord(body.policies)) return Object.values(body.policies).filter(isRecord);
+  throw new Error("platform returned an invalid AI policy response");
+}
+async function responseBody(res) {
+  const text = await res.text();
+  if (!text) return {};
+  try {
+    return JSON.parse(text);
+  } catch {
+    return { message: text.slice(0, 300) };
+  }
+}
+function apiError(action, status, body) {
+  const error = isRecord(body) && isRecord(body.error) ? body.error : void 0;
+  const message = error && typeof error.message === "string" ? error.message : isRecord(body) && typeof body.message === "string" ? body.message : "request failed";
+  return `${action} failed (${status}): ${message}`;
+}
+function isRecord(value) {
+  return Boolean(value) && typeof value === "object" && !Array.isArray(value);
+}
+
+// src/capabilities.ts
+var CAPABILITIES = {
+  cli: [
+    "register the app and enable configured services per environment",
+    "issue, persist, and explicitly rotate configured service credentials",
+    "write local Worker values and push deployed Worker secrets through Wrangler stdin",
+    "push db schema/rules and configure platform AI, auth, and deployment links",
+    "validate config offline and smoke-test a provisioned db environment",
+    "run app-attributed hosted security discovery and independent validation without provider keys",
+    "let admins manage system AI routes/credentials through short-lived exact-scope approval"
+  ],
+  agent: [
+    "install and import the selected odla SDKs",
+    "wrap the Worker with withObservability and choose useful telemetry",
+    "make application-specific schema, rules, auth, UI, and migration decisions"
+  ],
+  human: [
+    "approve the odla device code and one-off third-party logins",
+    "consent to production changes with --yes",
+    "request destructive credential rotation explicitly",
+    "review application semantics, security findings, releases, and merges",
+    "approve redacted-source disclosure before hosted security reasoning"
+  ],
+  studio: [
+    "view telemetry and environment state",
+    "perform manual credential recovery when the CLI's local shown-once copy is unavailable",
+    "configure system AI purposes and view app/environment/run-attributed usage"
+  ]
+};
+function printCapabilities(json = false, out = console) {
+  if (json) {
+    out.log(JSON.stringify(CAPABILITIES, null, 2));
+    return;
+  }
+  out.log("odla-ai responsibility boundary\n");
+  printGroup(out, "CLI automates", CAPABILITIES.cli);
+  printGroup(out, "Coding agent changes source", CAPABILITIES.agent);
+  printGroup(out, "Human checkpoints", CAPABILITIES.human);
+  printGroup(out, "Studio", CAPABILITIES.studio);
+}
+function printGroup(out, heading, items) {
+  out.log(`${heading}:`);
+  for (const item of items) out.log(`  - ${item}`);
+  out.log("");
+}
+
+// src/redact.ts
+var REPLACEMENTS = [
+  [/odla_(sk|dev)_[A-Za-z0-9._-]+/g, "odla_$1_[redacted]"],
+  [/\bsk_(live|test)_[A-Za-z0-9]+/g, "sk_$1_[redacted]"],
+  [/\bsk-[A-Za-z0-9._-]+/g, "sk-[redacted]"],
+  [/\bwhsec_[A-Za-z0-9+/=]+/g, "whsec_[redacted]"],
+  [/\bo11y_[A-Za-z0-9]+/g, "o11y_[redacted]"],
+  [/\b(ghp|gho|github_pat)_[A-Za-z0-9_]+/g, "$1_[redacted]"],
+  [/\bAKIA[A-Z0-9]{12,}/g, "AKIA[redacted]"]
+];
+function redactSecrets(value) {
+  let result = value;
+  for (const [pattern, replacement] of REPLACEMENTS) result = result.replace(pattern, replacement);
+  return result;
+}
+function looksSecret(value) {
+  return redactSecrets(value) !== value || value.includes("-----BEGIN");
+}
+
+// src/config.ts
+import { existsSync as existsSync3, readFileSync as readFileSync2 } from "fs";
+import { dirname as dirname2, isAbsolute as isAbsolute2, resolve as resolve2 } from "path";
+import { pathToFileURL } from "url";
+var DEFAULT_PLATFORM = "https://odla.ai";
+var DEFAULT_ENVS = ["dev"];
+var DEFAULT_SERVICES = ["db", "ai"];
+async function loadProjectConfig(configPath = "odla.config.mjs") {
+  const resolved = resolve2(configPath);
+  if (!existsSync3(resolved)) {
+    throw new Error(`config not found: ${configPath}. Run "odla-ai init" first or pass --config.`);
+  }
+  const raw = await loadConfigModule(resolved);
+  const rootDir = dirname2(resolved);
+  validateRawConfig(raw, resolved);
+  const platformUrl = trimSlash(process.env.ODLA_PLATFORM_URL || raw.platformUrl || DEFAULT_PLATFORM);
+  const dbEndpoint = trimSlash(process.env.ODLA_DB_ENDPOINT || raw.dbEndpoint || platformUrl);
+  const envs = unique(raw.envs?.length ? raw.envs : DEFAULT_ENVS);
+  const services = unique(raw.services?.length ? raw.services : DEFAULT_SERVICES);
+  const local = {
+    tokenFile: resolve2(rootDir, raw.local?.tokenFile ?? ".odla/dev-token.json"),
+    credentialsFile: resolve2(rootDir, raw.local?.credentialsFile ?? ".odla/credentials.local.json"),
+    devVarsFile: resolve2(rootDir, raw.local?.devVarsFile ?? ".dev.vars"),
+    gitignore: raw.local?.gitignore ?? true
+  };
+  return {
+    ...raw,
+    configPath: resolved,
+    rootDir,
+    platformUrl,
+    dbEndpoint,
+    envs,
+    services,
+    local
+  };
+}
+async function resolveDataExport(cfg, value, names) {
+  if (value === void 0 || value === null || value === false) return void 0;
+  if (typeof value !== "string") return value;
+  const target = isAbsolute2(value) ? value : resolve2(cfg.rootDir, value);
+  if (target.endsWith(".json")) {
+    return JSON.parse(readFileSync2(target, "utf8"));
+  }
+  const mod = await import(pathToFileURL(target).href);
+  for (const name of names) {
+    if (mod[name] !== void 0) return mod[name];
+  }
+  if (mod.default !== void 0) return mod.default;
+  throw new Error(`${value} did not export ${names.join(", ")} or default`);
+}
+function buildPlan(cfg) {
+  return {
+    appId: cfg.app.id,
+    appName: cfg.app.name,
+    platformUrl: cfg.platformUrl,
+    dbEndpoint: cfg.dbEndpoint,
+    envs: cfg.envs,
+    services: cfg.services,
+    hasSchema: !!cfg.db?.schema,
+    hasRules: !!cfg.db?.rules || !!cfg.db?.schema && cfg.db.defaultRules !== false,
+    aiProvider: cfg.ai?.provider
+  };
+}
+function rulesFromSchema(schema) {
+  const entities = serializedEntities(schema);
+  return Object.fromEntries(
+    entities.map((name) => [name, { view: "false", create: "false", update: "false", delete: "false" }])
+  );
+}
+function serializedEntities(schema) {
+  if (!schema || typeof schema !== "object") return [];
+  const entities = schema.entities;
+  if (!entities || typeof entities !== "object" || Array.isArray(entities)) return [];
+  return Object.keys(entities);
+}
+function envValue(value) {
+  if (!value) return void 0;
+  if (value.startsWith("$")) return process.env[value.slice(1)];
+  return value;
+}
+function validateRawConfig(raw, path) {
+  if (!raw || typeof raw !== "object") throw new Error(`${path} must export an object`);
+  const cfg = raw;
+  if (!cfg.app || typeof cfg.app !== "object") throw new Error(`${path}: missing app object`);
+  if (!validId(cfg.app.id)) throw new Error(`${path}: app.id must be lowercase letters, numbers, and hyphens`);
+  if (!cfg.app.name || typeof cfg.app.name !== "string") throw new Error(`${path}: app.name is required`);
+  if (cfg.envs?.some((env) => !validId(env))) throw new Error(`${path}: env names must be lowercase letters, numbers, and hyphens`);
+}
+function validId(value) {
+  return typeof value === "string" && /^[a-z0-9][a-z0-9-]*$/.test(value);
+}
+async function loadConfigModule(path) {
+  if (path.endsWith(".json")) return JSON.parse(readFileSync2(path, "utf8"));
+  const mod = await import(`${pathToFileURL(path).href}?t=${Date.now()}`);
+  const value = mod.default ?? mod.config;
+  if (typeof value === "function") return await value();
+  return value;
+}
+function trimSlash(value) {
+  return value.replace(/\/+$/, "");
+}
+function unique(values) {
+  return [...new Set(values.filter(Boolean))];
+}
+
+// src/doctor-checks.ts
+import { execFileSync } from "child_process";
+import { existsSync as existsSync5, readFileSync as readFileSync4 } from "fs";
+import { join as join2, resolve as resolve3 } from "path";
+
+// src/wrangler.ts
+import { spawn as spawn2 } from "child_process";
+import { existsSync as existsSync4, readFileSync as readFileSync3 } from "fs";
+import { join } from "path";
+var defaultRunner = (cmd, args, opts) => new Promise((resolvePromise, reject) => {
+  const child = spawn2(cmd, args, { cwd: opts?.cwd, stdio: ["pipe", "pipe", "pipe"] });
+  let stdout = "";
+  let stderr = "";
+  child.stdout.on("data", (chunk) => stdout += chunk.toString());
+  child.stderr.on("data", (chunk) => stderr += chunk.toString());
+  child.on("error", reject);
+  child.on("close", (code) => resolvePromise({ code: code ?? 1, stdout, stderr }));
+  child.stdin.end(opts?.input ?? "");
+});
+var WRANGLER_CONFIG_FILES = ["wrangler.jsonc", "wrangler.json", "wrangler.toml"];
+function findWranglerConfig(rootDir) {
+  for (const name of WRANGLER_CONFIG_FILES) {
+    const path = join(rootDir, name);
+    if (existsSync4(path)) return path;
+  }
+  return null;
+}
+function readWranglerConfig(path) {
+  if (path.endsWith(".toml")) return null;
+  try {
+    return JSON.parse(stripJsonComments(readFileSync3(path, "utf8")));
+  } catch {
+    return null;
+  }
+}
+function stripJsonComments(text) {
+  let result = "";
+  let inString = false;
+  for (let i = 0; i < text.length; i++) {
+    const ch = text[i];
+    if (inString) {
+      result += ch;
+      if (ch === "\\") {
+        result += text[i + 1] ?? "";
+        i++;
+      } else if (ch === '"') {
+        inString = false;
+      }
+      continue;
+    }
+    if (ch === '"') {
+      inString = true;
+      result += ch;
+      continue;
+    }
+    if (ch === "/" && text[i + 1] === "/") {
+      while (i < text.length && text[i] !== "\n") i++;
+      result += "\n";
+      continue;
+    }
+    if (ch === "/" && text[i + 1] === "*") {
+      i += 2;
+      while (i < text.length && !(text[i] === "*" && text[i + 1] === "/")) i++;
+      i++;
+      continue;
+    }
+    result += ch;
+  }
+  return result;
+}
+async function wranglerLoggedIn(run, cwd) {
+  try {
+    const result = await run("npx", ["wrangler", "whoami"], { cwd });
+    return result.code === 0 && !/not authenticated/i.test(`${result.stdout}${result.stderr}`);
+  } catch {
+    return false;
+  }
+}
+function wranglerPutSecret(run, opts) {
+  const args = ["wrangler", "secret", "put", opts.name, ...opts.env ? ["--env", opts.env] : []];
+  return run("npx", args, { input: opts.value, cwd: opts.cwd });
+}
+
+// src/doctor-checks.ts
+function lintRules(rules, entities, publicRead) {
+  const warnings = [];
+  if (!rules) return warnings;
+  for (const [ns, actions] of Object.entries(rules)) {
+    for (const [action, expr] of Object.entries(actions)) {
+      if (typeof expr !== "string" || expr.trim() !== "true") continue;
+      if (action === "view" && publicRead.includes(ns)) continue;
+      warnings.push(
+        action === "view" ? `rules.${ns}.view is "true" \u2014 public read; add "${ns}" to db.publicRead if intended` : `rules.${ns}.${action} is "true" \u2014 any client can ${action} ${ns} rows`
+      );
+    }
+  }
+  for (const entity of entities) {
+    if (!(entity in rules)) warnings.push(`schema entity "${entity}" has no rules entry (all client access denied)`);
+  }
+  return warnings;
+}
+var defaultExec = (cmd, args, cwd) => execFileSync(cmd, args, { cwd, encoding: "utf8", stdio: ["ignore", "pipe", "ignore"] });
+function trackedSecretFiles(rootDir, exec = defaultExec, localPaths = []) {
+  let output;
+  try {
+    const custom = localPaths.map((path) => gitignoreEntry(rootDir, path)).filter((path) => !!path);
+    output = exec("git", ["ls-files", "--", ".dev.vars", ".odla", ...custom], rootDir);
+  } catch {
+    return [];
+  }
+  return output.split(/\r?\n/).filter(Boolean).map((path) => `${path} is tracked by git \u2014 run "git rm --cached ${path}" and commit; it belongs in .gitignore`);
+}
+function wranglerWarnings(rootDir) {
+  const configPath = findWranglerConfig(rootDir);
+  if (!configPath) return [];
+  const config = readWranglerConfig(configPath);
+  if (!config) return [];
+  const warnings = [];
+  const blocks = [{ label: "", block: config }];
+  const envs = config.env;
+  if (envs && typeof envs === "object") {
+    for (const [name, block] of Object.entries(envs)) {
+      if (block && typeof block === "object") blocks.push({ label: `env.${name}.`, block });
+    }
+  }
+  for (const { label, block } of blocks) {
+    const assets = block.assets;
+    if (assets?.directory) {
+      const dir = resolve3(rootDir, assets.directory);
+      if (dir === resolve3(rootDir)) {
+        warnings.push(`${label}assets.directory is the project root \u2014 point it at a dedicated build dir (wrangler dev fails with "spawn EBADF")`);
+      } else if (existsSync5(join2(dir, "node_modules"))) {
+        warnings.push(`${label}assets.directory contains node_modules \u2014 wrangler dev's watcher will exhaust file descriptors`);
+      }
+    }
+    const vars = block.vars;
+    if (vars && typeof vars === "object") {
+      for (const [name, value] of Object.entries(vars)) {
+        if (name === "ODLA_API_KEY" || name === "ODLA_O11Y_TOKEN" || typeof value === "string" && looksSecret(value)) {
+          warnings.push(`wrangler ${label}vars.${name} looks like a secret \u2014 use "odla-ai secrets push" / wrangler secret put, never vars`);
+        }
+      }
+    }
+  }
+  const pkg = readPackageJson(rootDir);
+  if (pkg && typeof pkg.scripts === "object" && pkg.scripts && "deploy" in pkg.scripts) {
+    warnings.push(`package.json has a script named "deploy" \u2014 CI may auto-deploy it; rename to deploy:app`);
+  }
+  return warnings;
+}
+function o11yProjectWarnings(rootDir) {
+  const warnings = [];
+  const pkg = readPackageJson(rootDir);
+  const dependencies = pkg?.dependencies;
+  const devDependencies = pkg?.devDependencies;
+  if (!dependencies?.["@odla-ai/o11y"]) {
+    warnings.push(
+      devDependencies?.["@odla-ai/o11y"] ? "@odla-ai/o11y is a devDependency \u2014 move it to dependencies so the Worker can import it" : 'Worker instrumentation is missing @odla-ai/o11y \u2014 install it and wrap the handler with "withObservability"'
+    );
+  }
+  const configPath = findWranglerConfig(rootDir);
+  const config = configPath ? readWranglerConfig(configPath) : null;
+  if (!configPath || !config) {
+    warnings.push("cannot verify o11y Worker instrumentation \u2014 add a parseable wrangler.jsonc/json config");
+    return warnings;
+  }
+  const main = typeof config.main === "string" ? resolve3(rootDir, config.main) : null;
+  if (!main || !existsSync5(main)) {
+    warnings.push("cannot verify o11y Worker instrumentation \u2014 wrangler main is missing or unreadable");
+  } else {
+    let source = "";
+    try {
+      source = readFileSync4(main, "utf8");
+    } catch {
+    }
+    if (!/\bwithObservability\b/.test(source)) {
+      warnings.push(`wrangler entrypoint ${config.main} does not reference withObservability`);
+    }
+  }
+  const flags = Array.isArray(config.compatibility_flags) ? config.compatibility_flags : [];
+  if (!flags.includes("nodejs_compat")) {
+    warnings.push('wrangler compatibility_flags is missing "nodejs_compat" required by @odla-ai/o11y');
+  }
+  return warnings;
+}
+function readPackageJson(rootDir) {
+  try {
+    return JSON.parse(readFileSync4(join2(rootDir, "package.json"), "utf8"));
+  } catch {
+    return null;
+  }
+}
+
+// src/doctor.ts
+async function doctor(options) {
+  const out = options.stdout ?? console;
+  const cfg = await loadProjectConfig(options.configPath);
+  const plan = buildPlan(cfg);
+  const hasDb = cfg.services.includes("db");
+  const schema = hasDb ? await resolveDataExport(cfg, cfg.db?.schema, ["schema", "SCHEMA"]) : void 0;
+  const configuredRules = hasDb ? await resolveDataExport(cfg, cfg.db?.rules, ["rules", "RULES"]) : void 0;
+  const rules = configuredRules ?? (schema && cfg.db?.defaultRules !== false ? rulesFromSchema(schema) : void 0);
+  const entities = serializedEntities(schema);
+  out.log(`config: ${cfg.configPath}`);
+  out.log(`app:    ${plan.appName} (${plan.appId})`);
+  out.log(`envs:   ${plan.envs.join(", ")}`);
+  out.log(`svc:    ${plan.services.join(", ")}`);
+  out.log(`schema: ${schema ? `${entities.length} entities` : "none"}`);
+  out.log(`rules:  ${rules ? `${Object.keys(rules).length} namespaces` : "none"}`);
+  out.log(`ai:     ${cfg.services.includes("ai") ? cfg.ai?.provider ?? "not configured" : "not enabled"}`);
+  const warnings = [];
+  if (schema && entities.length === 0) warnings.push("schema has no entities");
+  if (rules) {
+    for (const ns of Object.keys(rules)) {
+      if (entities.length > 0 && !entities.includes(ns)) warnings.push(`rules include "${ns}" but schema has no matching entity`);
+    }
+  }
+  if (cfg.services.includes("ai") && !cfg.ai?.provider) warnings.push("ai service is enabled but ai.provider is not set");
+  if (cfg.auth?.clerk) {
+    for (const [env, value] of Object.entries(cfg.auth.clerk)) {
+      if (typeof value === "string" && value.startsWith("$") && !process.env[value.slice(1)]) {
+        warnings.push(`auth.clerk.${env} references unset env var ${value}`);
+      }
+    }
+  }
+  if (cfg.services.includes("ai") && cfg.ai?.keyEnv && !process.env[cfg.ai.keyEnv]) {
+    warnings.push(`${cfg.ai.keyEnv} is not set; provision will skip provider key storage`);
+  }
+  if (cfg.services.includes("o11y")) {
+    const credentials = readCredentials(cfg.local.credentialsFile);
+    for (const env of cfg.envs) {
+      if (!credentials?.envs[env]?.o11yToken) {
+        warnings.push(`o11y is enabled but env "${env}" has no ingest token \u2014 run "odla-ai provision" to mint one`);
+      }
+    }
+    warnings.push(...o11yProjectWarnings(cfg.rootDir));
+  }
+  warnings.push(...lintRules(rules, entities, cfg.db?.publicRead ?? []));
+  warnings.push(...trackedSecretFiles(cfg.rootDir, void 0, [
+    cfg.local.tokenFile,
+    cfg.local.credentialsFile,
+    cfg.local.devVarsFile
+  ]));
+  warnings.push(...wranglerWarnings(cfg.rootDir));
+  if (warnings.length) {
+    out.log("");
+    out.log("warnings:");
+    for (const warning of warnings) out.log(`  - ${warning}`);
+  } else {
+    out.log("ok");
+  }
+}
+
+// src/init.ts
+import { existsSync as existsSync6, mkdirSync as mkdirSync2, writeFileSync as writeFileSync2 } from "fs";
+import { dirname as dirname3, resolve as resolve4 } from "path";
+function initProject(options) {
+  const out = options.stdout ?? console;
+  const rootDir = resolve4(options.rootDir ?? process.cwd());
+  const configPath = resolve4(rootDir, options.configPath ?? "odla.config.mjs");
+  if (existsSync6(configPath) && !options.force) {
+    throw new Error(`${configPath} already exists. Pass --force to overwrite.`);
+  }
+  if (!/^[a-z0-9][a-z0-9-]*$/.test(options.appId)) {
+    throw new Error("--app-id must be lowercase letters, numbers, and hyphens");
+  }
+  const envs = options.envs?.length ? options.envs : ["dev"];
+  const services = options.services?.length ? options.services : ["db", "ai"];
+  const aiProvider = options.aiProvider ?? "anthropic";
+  mkdirSync2(dirname3(configPath), { recursive: true });
+  mkdirSync2(resolve4(rootDir, "src/odla"), { recursive: true });
+  mkdirSync2(resolve4(rootDir, ".odla"), { recursive: true });
+  writeFileSync2(configPath, configTemplate({ appId: options.appId, name: options.name, envs, services, aiProvider }));
+  writeIfMissing(resolve4(rootDir, "src/odla/schema.mjs"), schemaTemplate());
+  writeIfMissing(resolve4(rootDir, "src/odla/rules.mjs"), rulesTemplate());
+  ensureGitignore(rootDir);
+  out.log(`created ${relativeDisplay(configPath, rootDir)}`);
+  out.log("created src/odla/schema.mjs and src/odla/rules.mjs");
+  out.log("updated .gitignore for local odla credentials");
+}
+function writeIfMissing(path, text) {
+  if (existsSync6(path)) return;
+  writeFileSync2(path, text);
+}
+function configTemplate(input) {
+  return `export default {
+  platformUrl: process.env.ODLA_PLATFORM_URL ?? "https://odla.ai",
+  dbEndpoint: process.env.ODLA_ENDPOINT ?? process.env.ODLA_DB_ENDPOINT ?? "https://db.odla.ai",
+  app: {
+    id: "${input.appId}",
+    name: "${input.name.replace(/"/g, '\\"')}",
+  },
+  envs: ${JSON.stringify(input.envs)},
+  services: ${JSON.stringify(input.services)},
+  db: {
+    schema: "./src/odla/schema.mjs",
+    rules: "./src/odla/rules.mjs",
+    // When rules is omitted, the CLI generates deny-all rules from schema.
+    defaultRules: "deny",
+  },
+  ai: {
+    provider: process.env.ODLA_AI_PROVIDER ?? "${input.aiProvider}",
+    // Optional: set this env var while running provision to store the provider
+    // key in the platform vault for each tenant.
+    keyEnv: "${defaultKeyEnv(input.aiProvider)}",
+  },
+  auth: {
+    clerk: {
+      // dev: "$CLERK_PUBLISHABLE_KEY",
+      // prod: "$CLERK_PUBLISHABLE_KEY",
+    },
+  },
+  // Add "o11y" to services to enable observability; provision then mints the
+  // ingest token and scaffolds the ODLA_O11Y_* vars into .dev.vars.
+  // o11y: {
+  //   service: "${input.appId}",   // defaults to the app id
+  //   // endpoint: "https://o11y.odla.ai",
+  // },
+  links: {
+    // dev: "https://dev.example.com",
+    // prod: "https://example.com",
+  },
+  local: {
+    tokenFile: ".odla/dev-token.json",
+    credentialsFile: ".odla/credentials.local.json",
+    devVarsFile: ".dev.vars",
+  },
+};
+`;
+}
+function schemaTemplate() {
+  return `// Replace this starter schema with your app's odla-db schema.
+// Knowledge-graph projects can export @odla-ai/kg's toSerializedSchema(ontology).
+export const schema = {
+  entities: {
+    notes: {
+      attrs: {
+        id: { type: "string", unique: true, indexed: true, optional: false },
+        text: { type: "string", unique: false, indexed: false, optional: false },
+        createdAt: { type: "number", unique: false, indexed: true, optional: false },
+      },
+    },
+  },
+  links: {},
+};
+`;
+}
+function rulesTemplate() {
+  return `// odla-db is default-deny. The starter keeps runtime data backend-only.
+export const rules = {
+  notes: {
+    view: "false",
+    create: "false",
+    update: "false",
+    delete: "false",
+  },
+};
+`;
+}
+function defaultKeyEnv(provider) {
+  if (provider === "openai") return "OPENAI_API_KEY";
+  if (provider === "google") return "GOOGLE_API_KEY";
+  return "ANTHROPIC_API_KEY";
+}
+function relativeDisplay(path, rootDir) {
+  return path.startsWith(rootDir) ? path.slice(rootDir.length + 1) : path;
+}
+
+// src/secrets.ts
+var PROD_ENV_NAMES = /* @__PURE__ */ new Set(["prod", "production"]);
+async function secretsPush(options) {
+  await secretsPushImpl(options, true);
+}
+async function secretsPushAfterPreflight(options) {
+  await secretsPushImpl(options, false);
+}
+async function secretsPushImpl(options, preflight) {
+  const out = options.stdout ?? console;
+  const cfg = await loadProjectConfig(options.configPath);
+  const env = options.env;
+  if (!cfg.envs.includes(env)) {
+    throw new Error(`env "${env}" is not in config envs (${cfg.envs.join(", ")})`);
+  }
+  if (PROD_ENV_NAMES.has(env) && !options.yes) {
+    throw new Error(`refusing to push a secret to "${env}" without --yes`);
+  }
+  const credentialsPath = displayPath(cfg.local.credentialsFile, cfg.rootDir);
+  const credentials = readCredentials(cfg.local.credentialsFile);
+  if (!credentials) throw new Error(`no credentials at ${credentialsPath} \u2014 run "odla-ai provision" first`);
+  if (credentials.appId !== cfg.app.id) {
+    throw new Error(`credentials at ${credentialsPath} are for "${credentials.appId}", not "${cfg.app.id}"`);
+  }
+  const entry = credentials.envs[env];
+  if (!entry) throw new Error(`no credentials for env "${env}" in ${credentialsPath} \u2014 run "odla-ai provision" first`);
+  const secrets = [];
+  if (cfg.services.includes("o11y")) {
+    if (!entry.o11yToken) throw new Error(`no o11y token for env "${env}" in ${credentialsPath} \u2014 run "odla-ai provision" first`);
+    secrets.push({ name: "ODLA_O11Y_TOKEN", value: entry.o11yToken });
+  }
+  if (cfg.services.includes("db")) {
+    if (!entry.dbKey) throw new Error(`no db key for env "${env}" in ${credentialsPath} \u2014 run "odla-ai provision" first`);
+    secrets.push({ name: "ODLA_API_KEY", value: entry.dbKey });
+  }
+  if (secrets.length === 0) {
+    out.log(`${env}: no configured Worker secrets to push`);
+    return;
+  }
+  const wranglerEnv = PROD_ENV_NAMES.has(env) ? void 0 : env;
+  const target = wranglerEnv ? `wrangler env "${wranglerEnv}"` : "the top-level (prod) wrangler env";
+  if (options.dryRun) {
+    assertWranglerConfig(cfg);
+    for (const s of secrets) out.log(`dry run: would push ${s.name} (${redactSecrets(s.value)}) to ${target}`);
+    return;
+  }
+  const run = options.runner ?? defaultRunner;
+  if (preflight) await preflightLoadedConfig(cfg, run);
+  for (const s of secrets) {
+    const result = await wranglerPutSecret(run, { name: s.name, value: s.value, env: wranglerEnv, cwd: cfg.rootDir });
+    if (result.code !== 0) {
+      throw new Error(`wrangler secret put ${s.name} failed (exit ${result.code}): ${redactSecrets(`${result.stderr || result.stdout}`.trim())}`);
+    }
+    out.log(`${s.name} pushed to ${target} (value read from ${credentialsPath}, never echoed)`);
+  }
+}
+async function preflightSecretsPush(options) {
+  const cfg = await loadProjectConfig(options.configPath);
+  if (!cfg.services.some((service) => service === "db" || service === "o11y")) return;
+  await preflightLoadedConfig(cfg, options.runner ?? defaultRunner);
+}
+async function preflightLoadedConfig(cfg, run) {
+  assertWranglerConfig(cfg);
+  if (!await wranglerLoggedIn(run, cfg.rootDir)) {
+    throw new Error(`wrangler is not logged in \u2014 run "wrangler login" (a browser step for the human)`);
+  }
+}
+function assertWranglerConfig(cfg) {
+  if (!findWranglerConfig(cfg.rootDir)) {
+    throw new Error(`no wrangler config found in ${cfg.rootDir} (wrangler.jsonc, wrangler.json, or wrangler.toml)`);
+  }
+}
+
+// src/provision.ts
+import { createAppsClient, tenantIdFor as tenantIdFor2 } from "@odla-ai/apps";
+import { DEFAULT_SECRET_NAMES, putSecret } from "@odla-ai/ai";
+import process5 from "process";
+
+// src/provision-credentials.ts
+import { tenantIdFor } from "@odla-ai/apps";
+async function provisionEnvCredentials(opts) {
+  const tenantId = tenantIdFor(opts.cfg.app.id, opts.env);
+  const prior = opts.credentials?.envs[opts.env];
+  let credentials = opts.credentials;
+  let dbKey = opts.cfg.services.includes("db") && !opts.rotateDb ? prior?.dbKey : void 0;
+  let o11yToken = opts.cfg.services.includes("o11y") && !opts.rotateO11y ? prior?.o11yToken : void 0;
+  if (opts.cfg.services.includes("db")) {
+    if (dbKey) {
+      opts.stdout.log(`${opts.env}: reusing local db key for ${tenantId}`);
+    } else {
+      dbKey = await mintDbKey(opts, tenantId);
+      credentials = save(opts, credentials, tenantId, { dbKey });
+      opts.stdout.log(`${opts.env}: minted db key for ${tenantId}`);
+    }
+  }
+  if (opts.cfg.services.includes("o11y")) {
+    if (o11yToken) {
+      opts.stdout.log(`${opts.env}: reusing local o11y ingest token`);
+    } else {
+      o11yToken = await issueO11yToken(opts);
+      credentials = save(opts, credentials, tenantId, { ...dbKey ? { dbKey } : {}, o11yToken });
+      opts.stdout.log(`${opts.env}: ${opts.rotateO11y ? "rotated" : "issued"} o11y ingest token`);
+    }
+  }
+  return save(opts, credentials, tenantId, {
+    ...dbKey ? { dbKey } : {},
+    ...o11yToken ? { o11yToken } : {}
+  });
+}
+function save(opts, current, tenantId, values) {
+  const next = mergeCredential(current, {
+    appId: opts.cfg.app.id,
+    platformUrl: opts.cfg.platformUrl,
+    dbEndpoint: opts.cfg.dbEndpoint,
+    env: opts.env,
+    tenantId,
+    ...values
+  });
+  if (opts.write) writePrivateJson(opts.cfg.local.credentialsFile, next);
+  return next;
+}
+async function mintDbKey(opts, tenantId) {
+  const headers = { authorization: `Bearer ${opts.developerToken}`, "content-type": "application/json" };
+  let res = await opts.fetch(`${opts.cfg.dbEndpoint}/admin/apps/${encodeURIComponent(tenantId)}/keys`, {
+    method: "POST",
+    headers,
+    body: "{}"
+  });
+  if (res.status === 404) {
+    const created = await opts.fetch(`${opts.cfg.dbEndpoint}/admin/apps`, {
+      method: "POST",
+      headers,
+      body: JSON.stringify({
+        name: opts.env === "prod" ? opts.cfg.app.name : `${opts.cfg.app.name} (${opts.env})`,
+        appId: tenantId
+      })
+    });
+    if (!created.ok) throw new Error(`db app create (${tenantId}) failed: ${created.status} ${await safeText(created)}`);
+    res = await opts.fetch(`${opts.cfg.dbEndpoint}/admin/apps/${encodeURIComponent(tenantId)}/keys`, {
+      method: "POST",
+      headers,
+      body: "{}"
+    });
+  }
+  if (!res.ok) throw new Error(`db key mint (${tenantId}) failed: ${res.status} ${await safeText(res)}`);
+  const body = await res.json();
+  if (!body.key) throw new Error(`db key mint (${tenantId}) returned no key`);
+  return body.key;
+}
+async function issueO11yToken(opts) {
+  const suffix = opts.rotateO11y ? "/rotate" : "";
+  const res = await opts.fetch(
+    `${opts.cfg.platformUrl}/o11y/${encodeURIComponent(opts.cfg.app.id)}/token${suffix}?env=${encodeURIComponent(opts.env)}`,
+    { method: "POST", headers: { authorization: `Bearer ${opts.developerToken}` } }
+  );
+  if (res.status === 409 && !opts.rotateO11y) {
+    throw new Error(
+      `o11y token already exists for env "${opts.env}", but its shown-once value is not in the local credentials file; run "odla-ai provision --rotate-o11y-token --push-secrets" to replace it explicitly`
+    );
+  }
+  if (!res.ok) throw new Error(`o11y token ${opts.rotateO11y ? "rotation" : "issue"} (${opts.env}) failed: ${res.status} ${await safeText(res)}`);
+  const body = await res.json();
+  if (!body.token) throw new Error(`o11y token ${opts.rotateO11y ? "rotation" : "issue"} (${opts.env}) returned no token`);
+  return body.token;
+}
+async function safeText(res) {
+  try {
+    return redactSecrets((await res.text()).slice(0, 500));
+  } catch {
+    return "";
+  }
+}
+
+// src/provision.ts
+async function provision(options) {
+  const out = options.stdout ?? console;
+  const cfg = await loadProjectConfig(options.configPath);
+  const plan = buildPlan(cfg);
+  const hasDb = cfg.services.includes("db");
+  const hasO11y = cfg.services.includes("o11y");
+  if (options.rotateO11yToken && !hasO11y) {
+    throw new Error("--rotate-o11y-token requires the o11y service in odla.config.mjs");
+  }
+  if (options.pushSecrets && options.writeCredentials === false) {
+    throw new Error("--push-secrets cannot be combined with --no-write-credentials");
+  }
+  out.log(`odla-ai: ${plan.appName} (${plan.appId})`);
+  out.log(`  platform: ${plan.platformUrl}`);
+  out.log(`  db:       ${plan.dbEndpoint}`);
+  out.log(`  envs:     ${plan.envs.join(", ")}`);
+  out.log(`  services: ${plan.services.join(", ")}`);
+  const productionEnvs = plan.envs.filter((env) => env === "prod" || env === "production");
+  if (!options.dryRun && productionEnvs.length > 0 && !options.yes) {
+    throw new Error(
+      `refusing to provision production env ${productionEnvs.join(", ")} without --yes; run --dry-run first`
+    );
+  }
+  const schema = hasDb ? await resolveDataExport(cfg, cfg.db?.schema, ["schema", "SCHEMA"]) : void 0;
+  const configuredRules = hasDb ? await resolveDataExport(cfg, cfg.db?.rules, ["rules", "RULES"]) : void 0;
+  const rules = configuredRules ?? (schema && cfg.db?.defaultRules !== false ? rulesFromSchema(schema) : void 0);
+  if (options.dryRun) {
+    out.log("dry run: no network calls or file writes");
+    out.log(`  schema: ${schema ? "yes" : "no"}`);
+    out.log(`  rules:  ${rules ? Object.keys(rules).length : 0} namespaces`);
+    out.log(`  ai:     ${cfg.services.includes("ai") ? cfg.ai?.provider ?? "not configured" : "not enabled"}`);
+    out.log(`  secrets: ${options.pushSecrets ? "push configured Worker secrets" : "local only"}`);
+    return;
+  }
+  let credentials = readCredentials(cfg.local.credentialsFile);
+  if (credentials && credentials.appId !== cfg.app.id) {
+    throw new Error(
+      `credentials at ${displayPath(cfg.local.credentialsFile, cfg.rootDir)} are for "${credentials.appId}", not "${cfg.app.id}"`
+    );
+  }
+  const rotatesO11y = !!(options.rotateKeys || options.rotateO11yToken);
+  const missingO11y = cfg.envs.some((env) => !credentials?.envs[env]?.o11yToken);
+  const missingDb = cfg.envs.some((env) => !credentials?.envs[env]?.dbKey);
+  const losesShownOnceCredential = hasDb && (!!options.rotateKeys || missingDb) || hasO11y && (rotatesO11y || missingO11y);
+  if (options.writeCredentials === false && losesShownOnceCredential) {
+    throw new Error("credential issuance/rotation requires the private credentials file; remove --no-write-credentials");
+  }
+  const devVarsTarget = resolveWriteDevVarsTarget(cfg, options.writeDevVars);
+  if (cfg.local.gitignore) {
+    ensureGitignore(cfg.rootDir, [cfg.local.tokenFile, cfg.local.credentialsFile, ...devVarsTarget ? [devVarsTarget] : []]);
+  }
+  if (options.pushSecrets) {
+    await preflightSecretsPush({ configPath: cfg.configPath, runner: options.secretRunner });
+    out.log("secrets: Wrangler config and login preflight passed");
+  }
+  const doFetch = options.fetch ?? fetch;
+  const token = await getDeveloperToken(cfg, options, doFetch, out);
+  const apps = createAppsClient({ endpoint: cfg.platformUrl, token, fetcher: { fetch: doFetch } });
+  const existing = await readRegistryApp(cfg, token, doFetch);
+  if (existing) {
+    out.log(`app: ${cfg.app.id} already exists`);
+  } else {
+    await apps.createApp({ name: cfg.app.name, appId: cfg.app.id });
+    out.log(`app: created ${cfg.app.id}`);
+  }
+  for (const env of cfg.envs) {
+    for (const service of cfg.services) {
+      if (service === "ai") {
+        if (cfg.ai?.provider) {
+          await apps.setAi(cfg.app.id, env, { provider: cfg.ai.provider, ...cfg.ai.model ? { model: cfg.ai.model } : {} });
+          out.log(`${env}: ai configured (${cfg.ai.provider}${cfg.ai.model ? `/${cfg.ai.model}` : ""})`);
+        } else {
+          await apps.setService(cfg.app.id, "ai", true, { env });
+          out.log(`${env}: ai enabled`);
+        }
+      } else {
+        await apps.setService(cfg.app.id, service, true, { env });
+        out.log(`${env}: ${service} enabled`);
+      }
+    }
+    const authConfig = normalizeClerkConfig(cfg.auth?.clerk?.[env]);
+    if (authConfig?.publishableKey) {
+      await apps.setAuth(cfg.app.id, env, authConfig);
+      out.log(`${env}: auth configured (clerk ${authConfig.mode ?? "client"})`);
+    }
+    const link = cfg.links?.[env];
+    if (link !== void 0) {
+      await apps.setLink(cfg.app.id, env, link ?? null);
+      out.log(`${env}: link ${link ? "set" : "cleared"}`);
+    }
+  }
+  for (const env of cfg.envs) {
+    const tenantId = tenantIdFor2(cfg.app.id, env);
+    credentials = await provisionEnvCredentials({
+      cfg,
+      env,
+      developerToken: token,
+      credentials,
+      rotateDb: !!options.rotateKeys,
+      rotateO11y: rotatesO11y,
+      write: options.writeCredentials !== false,
+      fetch: doFetch,
+      stdout: out
+    });
+    const dbKey = credentials.envs[env]?.dbKey;
+    if (options.pushSecrets) {
+      try {
+        await secretsPushAfterPreflight({
+          configPath: cfg.configPath,
+          env,
+          yes: options.yes,
+          runner: options.secretRunner,
+          stdout: out
+        });
+      } catch (error) {
+        const message = error instanceof Error ? error.message : String(error);
+        const consent = env === "prod" || env === "production" ? " --yes" : "";
+        throw new Error(
+          `${message}
+${env}: credentials are already saved; retry "odla-ai secrets push --env ${env}${consent}" without issuing or rotating again`,
+          { cause: error }
+        );
+      }
+    }
+    if (schema && dbKey) {
+      await postJson(doFetch, `${cfg.dbEndpoint}/app/${encodeURIComponent(tenantId)}/schema`, dbKey, { schema });
+      out.log(`${env}: schema pushed`);
+    }
+    if (rules) {
+      await postJson(doFetch, `${cfg.dbEndpoint}/app/${encodeURIComponent(tenantId)}/admin/rules`, token, rules);
+      out.log(`${env}: rules pushed (${Object.keys(rules).length} namespaces)`);
+    }
+    if (cfg.services.includes("ai") && cfg.ai?.provider && cfg.ai.keyEnv) {
+      const key = process5.env[cfg.ai.keyEnv];
+      if (key) {
+        const secretName = cfg.ai.secretName ?? defaultSecretName(cfg.ai.provider);
+        await putSecret({ endpoint: cfg.dbEndpoint, token, fetch: doFetch }, tenantId, secretName, key);
+        out.log(`${env}: ${cfg.ai.provider} key stored in vault (${secretName})`);
+      } else {
+        out.log(`${env}: ${cfg.ai.keyEnv} not set; skipped provider key storage`);
+      }
+    }
+  }
+  if (options.writeCredentials !== false && credentials) {
+    const ignored = cfg.local.gitignore && gitignoreEntry(cfg.rootDir, cfg.local.credentialsFile);
+    out.log(`credentials: wrote ${displayPath(cfg.local.credentialsFile, cfg.rootDir)} (0600${ignored ? ", gitignored" : ""})`);
+  }
+  if (devVarsTarget && credentials) {
+    const env = cfg.envs.includes("dev") ? "dev" : cfg.envs[0] ?? "prod";
+    writeDevVars(devVarsTarget, credentials, env, o11yDevVars(cfg));
+    out.log(`dev vars: wrote ${displayPath(devVarsTarget, cfg.rootDir)} for ${env}`);
+  }
+}
+async function readRegistryApp(cfg, token, doFetch) {
+  const res = await doFetch(`${cfg.platformUrl}/registry/apps/${encodeURIComponent(cfg.app.id)}`, {
+    headers: { authorization: `Bearer ${token}` }
+  });
+  if (res.status === 404) return null;
+  if (!res.ok) return null;
+  const json = await res.json();
+  return json.app ?? null;
+}
+async function postJson(doFetch, url, bearer, body) {
+  const res = await doFetch(url, {
+    method: "POST",
+    headers: { authorization: `Bearer ${bearer}`, "content-type": "application/json" },
+    body: JSON.stringify(body)
+  });
+  if (!res.ok) throw new Error(`${new URL(url).pathname} failed: ${res.status} ${await safeText2(res)}`);
+}
+function normalizeClerkConfig(value) {
+  if (!value) return null;
+  if (typeof value === "string") {
+    const publishableKey2 = envValue(value);
+    return publishableKey2 ? { publishableKey: publishableKey2 } : null;
+  }
+  if (typeof value !== "object") return null;
+  const cfg = value;
+  const publishableKey = envValue(cfg.publishableKey);
+  return publishableKey ? { publishableKey, ...cfg.audience ? { audience: cfg.audience } : {}, ...cfg.mode ? { mode: cfg.mode } : {} } : null;
+}
+function defaultSecretName(provider) {
+  const names = DEFAULT_SECRET_NAMES;
+  return names[provider] ?? `${provider}_api_key`;
+}
+async function safeText2(res) {
+  try {
+    return redactSecrets((await res.text()).slice(0, 500));
+  } catch {
+    return "";
+  }
+}
+
+// src/security.ts
+import { isAbsolute as isAbsolute3, relative as relative2, resolve as resolve5, sep } from "path";
+import {
+  cloudflareAppProfile,
+  createPlatformSecurityReasoners,
+  createSecurityHarness,
+  genericProfile,
+  odlaProfile,
+  securityFingerprint
+} from "@odla-ai/security";
+import { FileRunStore, snapshotDirectory, writeSecurityArtifacts } from "@odla-ai/security/node";
+async function runHostedSecurity(options) {
+  if (options.sourceDisclosureAck !== "redacted") {
+    throw new Error("Hosted security requires sourceDisclosureAck=redacted before repository source may leave this process");
+  }
+  const selfAudit = options.selfAudit === true;
+  const cfg = selfAudit ? void 0 : await loadProjectConfig(options.configPath ?? "odla.config.mjs");
+  const appId = selfAudit ? "odla-ai" : cfg.app.id;
+  const env = selfAudit ? "prod" : selectEnv(options.env, cfg.envs, cfg.configPath, cfg.rootDir);
+  const platform = options.platform ?? cfg?.platformUrl ?? "https://odla.ai";
+  const target = resolve5(options.target ?? cfg?.rootDir ?? ".");
+  const output = resolve5(options.out ?? resolve5(target, ".odla/security/hosted"));
+  const outputRelative = relative2(target, output).split(sep).join("/");
+  if (!outputRelative) throw new Error("Hosted security output cannot be the repository root");
+  const profile = profileFor(options.profile ?? "odla", options.maxHuntTasks ?? 12);
+  const tokenRequest = {
+    platform,
+    appId,
+    env,
+    selfAudit,
+    scope: selfAudit ? "platform:security:self" : null
+  };
+  const token = await injectedToken(options, tokenRequest);
+  const snapshot = await snapshotDirectory(target, {
+    exclude: !outputRelative.startsWith("../") && !isAbsolute3(outputRelative) ? [outputRelative] : []
+  });
+  const hosted = await createPlatformSecurityReasoners({
+    platform,
+    token,
+    appId,
+    env,
+    repository: snapshot.repository,
+    revision: snapshot.revision,
+    snapshotDigest: snapshot.digest,
+    sourceDisclosure: "redacted",
+    clientRunId: options.runId ?? crypto.randomUUID(),
+    ...selfAudit ? { selfAudit: { enabled: true, subject: "service:odla-security-self-audit" } } : {},
+    fetch: options.fetch,
+    signal: options.signal
+  });
+  const harness = createSecurityHarness({
+    profile,
+    store: new FileRunStore(resolve5(output, "state")),
+    discoveryReasoner: hosted.discoveryReasoner,
+    validationReasoner: hosted.validationReasoner,
+    policy: {
+      modelSourceDisclosure: "redacted",
+      active: false,
+      allowNetwork: false
+    }
+  });
+  const report = await harness.run(snapshot, { runId: hosted.run.runId, signal: options.signal });
+  await writeSecurityArtifacts(output, report);
+  const reportDigest = await securityFingerprint(report);
+  await hosted.complete({
+    reportDigest,
+    coverageStatus: report.coverageStatus,
+    confirmed: report.metrics.confirmed,
+    candidates: report.metrics.candidates
+  }, { signal: options.signal });
+  printSummary(options.stdout ?? console, appId, env, hosted.run, report, output);
+  return Object.freeze({ report, run: hosted.run, output });
+}
+function selectEnv(requested, declared, configPath, rootDir) {
+  const env = requested ?? (declared.includes("dev") ? "dev" : declared[0]);
+  if (!env || !declared.includes(env)) {
+    const shown = relative2(rootDir, configPath) || configPath;
+    throw new Error(`env "${env ?? ""}" is not declared in ${shown}`);
+  }
+  return env;
+}
+async function injectedToken(options, request) {
+  const value = options.token ?? await options.getToken?.(Object.freeze({ ...request }));
+  if (typeof value !== "string" || value.length < 8 || value.length > 8192 || /\s|[\u0000-\u001f\u007f]/.test(value)) {
+    throw new Error(
+      request.selfAudit ? "Self-audit requires an injected, scoped platform security token" : "Hosted security requires an injected app developer token or getToken callback"
+    );
+  }
+  return value;
+}
+function profileFor(name, maxHuntTasks) {
+  const profile = name === "odla" ? odlaProfile() : name === "cloudflare-app" ? cloudflareAppProfile() : name === "generic" ? genericProfile() : void 0;
+  if (!profile) throw new Error(`unknown security profile "${String(name)}"`);
+  if (maxHuntTasks === void 0) return profile;
+  if (!Number.isSafeInteger(maxHuntTasks) || maxHuntTasks < 1) throw new Error("maxHuntTasks must be a positive integer");
+  return { ...profile, maxHuntTasks };
+}
+function printSummary(out, appId, env, run, report, output) {
+  const complete = report.coverage.filter((cell) => cell.state === "complete").length;
+  out.log(`security: ${appId}/${env} run=${run.runId} profile=${run.profileVersion}`);
+  out.log(`  discovery: ${run.discovery.identity.provider}/${run.discovery.identity.model}`);
+  out.log(`  validation: ${run.validation.identity.provider}/${run.validation.identity.model}`);
+  out.log(`  coverage: ${report.coverageStatus} ${complete}/${report.coverage.length} blocked=${report.metrics.blockedCells} shallow=${report.metrics.shallowCells} unscheduled=${report.metrics.unscheduledCells}`);
+  out.log(`  findings: confirmed=${report.metrics.confirmed} needs_reproduction=${report.metrics.needsReproduction} candidates=${report.metrics.candidates}`);
+  out.log(`  report: ${resolve5(output, "REPORT.md")}`);
+}
+
+// src/skill.ts
+import { existsSync as existsSync7, lstatSync, mkdirSync as mkdirSync3, readFileSync as readFileSync5, readdirSync, writeFileSync as writeFileSync3 } from "fs";
+import { homedir } from "os";
+import { dirname as dirname4, isAbsolute as isAbsolute4, join as join3, relative as relative3, resolve as resolve6, sep as sep2 } from "path";
+import { fileURLToPath } from "url";
+
+// src/skill-adapters.ts
+var PROJECT_INSTRUCTIONS = `<!-- odla-ai agent setup:start -->
+## odla agent workflow
+
+For work that creates an odla app or adds odla services, read and follow
+\`.agents/skills/odla/SKILL.md\`. It dispatches an existing static site to
+\`.agents/skills/odla-migrate/SKILL.md\`. For production telemetry triage, use
+\`.agents/skills/odla-o11y-debug/SKILL.md\`.
+
+The complete runbooks and their references are installed in this repository.
+Do not fetch online odla documentation as setup context. Network access is only
+needed when a runbook deliberately calls the odla service, npm, Cloudflare, or
+another configured provider.
+<!-- odla-ai agent setup:end -->`;
+var CURSOR_RULE = `---
+description: Build, migrate, provision, secure, or debug an odla app using the locally installed odla runbooks
+globs:
+alwaysApply: false
+---
+
+${PROJECT_INSTRUCTIONS}
+`;
+function claudeAdapter(skill, canonical) {
+  const match = canonical.match(/^---\r?\n([\s\S]*?)\r?\n---/);
+  if (!match) throw new Error(`bundled skill ${skill} has no YAML frontmatter`);
+  const lines = match[1].split(/\r?\n/);
+  const frontmatter = [];
+  let keepIndented = false;
+  for (const line of lines) {
+    if (line.startsWith("name:") || line.startsWith("description:")) {
+      frontmatter.push(line);
+      keepIndented = line.startsWith("description:");
+    } else if (keepIndented && /^\s+/.test(line)) {
+      frontmatter.push(line);
+    } else {
+      keepIndented = false;
+    }
+  }
+  return `---
+${frontmatter.join("\n")}
+---
+
+# ${skill} (odla adapter)
+
+Read \`../../../.agents/skills/${skill}/SKILL.md\` completely and follow it. That
+canonical local skill owns every reference path and contains the full offline
+runbook. Do not substitute a remote documentation page for the installed copy.
+`;
+}
+
+// src/skill.ts
+var AGENT_HARNESSES = ["claude", "codex", "cursor", "copilot", "gemini", "agents"];
+function installSkill(options = {}) {
+  const out = options.stdout ?? console;
+  const sourceDir = options.sourceDir ?? fileURLToPath(new URL("../skills", import.meta.url));
+  const files = listFiles(sourceDir);
+  if (files.length === 0) throw new Error(`no bundled skills found at ${sourceDir}`);
+  const harnesses = normalizeHarnesses(options.harnesses, options.global === true);
+  const root = resolve6(options.dir ?? process.cwd());
+  const home = resolve6(options.homeDir ?? homedir());
+  const plans = /* @__PURE__ */ new Map();
+  const targets = /* @__PURE__ */ new Map();
+  const rememberTarget = (harness, target) => {
+    const current = targets.get(harness) ?? /* @__PURE__ */ new Set();
+    current.add(target);
+    targets.set(harness, current);
+  };
+  const plan = (target, content, managedMerge = false, boundary = root) => {
+    const existing = plans.get(target);
+    if (existing && existing.content !== content) throw new Error(`internal agent setup conflict for ${target}`);
+    plans.set(target, { target, content, boundary, managedMerge });
+  };
+  const planSkillTree = (targetDir2, boundary = root) => {
+    for (const rel of files) plan(join3(targetDir2, rel), readFileSync5(join3(sourceDir, rel), "utf8"), false, boundary);
+  };
+  let targetDir;
+  if (options.global) {
+    const claudeRoot = join3(home, ".claude", "skills");
+    const codexRoot = resolve6(options.codexHomeDir ?? process.env.CODEX_HOME ?? join3(home, ".codex"), "skills");
+    targetDir = harnesses[0] === "codex" ? codexRoot : claudeRoot;
+    for (const harness of harnesses) {
+      const skillRoot = harness === "claude" ? claudeRoot : codexRoot;
+      planSkillTree(skillRoot, harness === "claude" ? home : dirname4(dirname4(codexRoot)));
+      rememberTarget(harness, skillRoot);
+    }
+  } else {
+    const sharedRoot = join3(root, ".agents", "skills");
+    planSkillTree(sharedRoot);
+    const claudeRoot = join3(root, ".claude", "skills");
+    targetDir = harnesses.includes("claude") ? claudeRoot : sharedRoot;
+    for (const harness of harnesses) rememberTarget(harness, sharedRoot);
+    if (harnesses.includes("claude")) {
+      for (const skill of skillNames(files)) {
+        const canonical = readFileSync5(join3(sourceDir, skill, "SKILL.md"), "utf8");
+        plan(join3(claudeRoot, skill, "SKILL.md"), claudeAdapter(skill, canonical));
+      }
+      rememberTarget("claude", claudeRoot);
+    }
+    if (harnesses.includes("cursor")) {
+      const cursorRule = join3(root, ".cursor", "rules", "odla.mdc");
+      plan(cursorRule, CURSOR_RULE);
+      rememberTarget("cursor", cursorRule);
+    }
+    if (harnesses.includes("agents")) {
+      const agentsFile = join3(root, "AGENTS.md");
+      plan(agentsFile, managedFileContent(agentsFile, PROJECT_INSTRUCTIONS, options.force === true, root), true);
+      rememberTarget("agents", agentsFile);
+    }
+    if (harnesses.includes("copilot")) {
+      const copilotFile = join3(root, ".github", "copilot-instructions.md");
+      plan(copilotFile, managedFileContent(copilotFile, PROJECT_INSTRUCTIONS, options.force === true, root), true);
+      rememberTarget("copilot", copilotFile);
+    }
+    if (harnesses.includes("gemini")) {
+      const geminiFile = join3(root, "GEMINI.md");
+      plan(geminiFile, managedFileContent(geminiFile, PROJECT_INSTRUCTIONS, options.force === true, root), true);
+      rememberTarget("gemini", geminiFile);
+    }
+  }
+  const writtenPaths = /* @__PURE__ */ new Set();
+  const unchangedPaths = /* @__PURE__ */ new Set();
+  const conflicts = [];
+  for (const file of plans.values()) {
+    const symlink = symlinkedComponent(file.boundary, file.target);
+    if (symlink) {
+      conflicts.push(`${file.target} (redirected by symbolic link ${symlink})`);
+      continue;
+    }
+    if (!existsSync7(file.target)) {
+      writtenPaths.add(file.target);
+      continue;
+    }
+    const current = readFileSync5(file.target, "utf8");
+    if (current === file.content) {
+      unchangedPaths.add(file.target);
+    } else if (file.managedMerge || options.force) {
+      writtenPaths.add(file.target);
+      unchangedPaths.delete(file.target);
+    } else {
+      conflicts.push(file.target);
+    }
+  }
+  if (conflicts.length > 0) {
+    throw new Error(
+      `agent setup files modified locally (re-run with --force to replace only odla-managed content):
+${conflicts.map((f) => `  - ${f}`).join("\n")}`
+    );
+  }
+  for (const file of plans.values()) {
+    if (!existsSync7(file.target) || readFileSync5(file.target, "utf8") !== file.content) {
+      mkdirSync3(dirname4(file.target), { recursive: true });
+      writeFileSync3(file.target, file.content);
+    }
+  }
+  const skills = skillNames(files);
+  const installations = harnesses.map((harness) => ({ harness, targets: [...targets.get(harness) ?? []] }));
+  out.log(`agent harnesses: ${harnesses.join(", ")}`);
+  out.log(`offline skills: ${skills.join(", ")}`);
+  for (const installation of installations) out.log(`${installation.harness}: ${installation.targets.join(", ")}`);
+  out.log(`installed ${writtenPaths.size} managed file(s)${unchangedPaths.size ? ` (${unchangedPaths.size} unchanged)` : ""}`);
+  return {
+    targetDir,
+    written: pathsUnder(targetDir, writtenPaths),
+    unchanged: pathsUnder(targetDir, unchangedPaths),
+    writtenPaths: [...writtenPaths].sort(),
+    unchangedPaths: [...unchangedPaths].sort(),
+    harnesses: installations
+  };
+}
+function pathsUnder(root, paths) {
+  return [...paths].map((path) => relative3(root, path)).filter((path) => path !== ".." && !path.startsWith(`..${sep2}`) && !isAbsolute4(path)).sort();
+}
+function normalizeHarnesses(values, global) {
+  const requested = values?.length ? values : ["claude"];
+  const allowed = /* @__PURE__ */ new Set([...AGENT_HARNESSES, "all"]);
+  for (const harness of requested) {
+    if (!allowed.has(harness)) {
+      throw new Error(`unknown agent harness "${harness}"; choose all, ${AGENT_HARNESSES.join(", ")}`);
+    }
+  }
+  const expanded = requested.includes("all") ? global ? ["claude", "codex"] : [...AGENT_HARNESSES] : [...new Set(requested)];
+  if (global) {
+    const unsupported = expanded.filter((harness) => harness !== "claude" && harness !== "codex");
+    if (unsupported.length) {
+      throw new Error(`--global supports claude and codex only; ${unsupported.join(", ")} require a project-local adapter`);
+    }
+  }
+  return expanded;
+}
+function managedFileContent(path, block, force, boundary) {
+  const symlink = symlinkedComponent(boundary, path);
+  if (symlink) throw new Error(`refusing to manage ${path}: symbolic link component ${symlink}`);
+  if (!existsSync7(path)) return `${block}
+`;
+  const current = readFileSync5(path, "utf8");
+  const start = "<!-- odla-ai agent setup:start -->";
+  const end = "<!-- odla-ai agent setup:end -->";
+  const startAt = current.indexOf(start);
+  const endAt = current.indexOf(end);
+  if (startAt === -1 !== (endAt === -1) || startAt !== -1 && endAt < startAt) {
+    throw new Error(`malformed odla-managed section in ${path}`);
+  }
+  if (startAt === -1) {
+    const separator = current.length === 0 || current.endsWith("\n\n") ? "" : current.endsWith("\n") ? "\n" : "\n\n";
+    return `${current}${separator}${block}
+`;
+  }
+  const afterEnd = endAt + end.length;
+  const existing = current.slice(startAt, afterEnd);
+  if (existing !== block && !force) {
+    throw new Error(`odla-managed section modified locally in ${path}; re-run with --force to replace that section`);
+  }
+  return `${current.slice(0, startAt)}${block}${current.slice(afterEnd)}`;
+}
+function symlinkedComponent(boundary, target) {
+  const rel = relative3(boundary, target);
+  if (rel === ".." || rel.startsWith(`..${sep2}`) || isAbsolute4(rel)) {
+    throw new Error(`agent setup target escapes its install root: ${target}`);
+  }
+  let current = boundary;
+  for (const part of rel.split(sep2).filter(Boolean)) {
+    current = join3(current, part);
+    try {
+      if (lstatSync(current).isSymbolicLink()) return current;
+    } catch (error) {
+      if (error.code !== "ENOENT") throw error;
+    }
+  }
+  return void 0;
+}
+function skillNames(files) {
+  return [...new Set(files.filter((file) => /(^|[\\/])SKILL\.md$/.test(file)).map((file) => file.split(/[\\/]/)[0]))].sort();
+}
+function listFiles(dir) {
+  if (!existsSync7(dir)) return [];
+  const results = [];
+  const walk = (current) => {
+    for (const entry of readdirSync(current, { withFileTypes: true })) {
+      const path = join3(current, entry.name);
+      if (entry.isDirectory()) walk(path);
+      else results.push(relative3(dir, path));
+    }
+  };
+  walk(dir);
+  return results.sort();
+}
+
+// src/smoke.ts
+async function smoke(options) {
+  const out = options.stdout ?? console;
+  const cfg = await loadProjectConfig(options.configPath);
+  const env = options.env ?? (cfg.envs.includes("dev") ? "dev" : cfg.envs[0] ?? "prod");
+  if (!cfg.envs.includes(env)) throw new Error(`env "${env}" is not declared in ${displayPath(cfg.configPath, cfg.rootDir)}`);
+  const credentials = readCredentials(cfg.local.credentialsFile);
+  if (!credentials) {
+    throw new Error(`local credentials missing: ${displayPath(cfg.local.credentialsFile, cfg.rootDir)}. Run "odla-ai provision --write-dev-vars".`);
+  }
+  if (credentials.appId !== cfg.app.id) {
+    throw new Error(`local credentials are for app "${credentials.appId}", but config app is "${cfg.app.id}"`);
+  }
+  const entry = credentials.envs[env];
+  if (!entry?.tenantId || !entry.dbKey) {
+    throw new Error(`local credentials have no db key for env "${env}". Run "odla-ai provision --write-dev-vars".`);
+  }
+  const doFetch = options.fetch ?? fetch;
+  out.log(`smoke: ${cfg.app.id}/${env}`);
+  out.log(`  tenant: ${entry.tenantId}`);
+  const publicConfig = await getJson(doFetch, publicConfigUrl(cfg.platformUrl, cfg.app.id, env), void 0);
+  out.log(`  public-config: ok`);
+  if (cfg.ai?.provider) {
+    const provider = publicConfig.ai?.provider ?? null;
+    if (provider !== cfg.ai.provider) {
+      throw new Error(`ai provider mismatch: expected "${cfg.ai.provider}", public-config has "${provider ?? "none"}"`);
+    }
+    out.log(`  ai: ${provider}`);
+  }
+  const expectedSchema = await resolveDataExport(cfg, cfg.db?.schema, ["schema", "SCHEMA"]);
+  const expectedEntities = serializedEntities(expectedSchema);
+  const liveSchemaPayload = await getJson(doFetch, `${cfg.dbEndpoint}/app/${encodeURIComponent(entry.tenantId)}/schema`, entry.dbKey);
+  const liveSchema = liveSchemaPayload.schema ?? liveSchemaPayload;
+  const liveEntities = serializedEntities(liveSchema);
+  if (expectedEntities.length) {
+    const missing = expectedEntities.filter((entity) => !liveEntities.includes(entity));
+    if (missing.length) throw new Error(`live schema is missing expected entities: ${missing.join(", ")}`);
+  }
+  out.log(`  schema: ${liveEntities.length} entities`);
+  const aggregateEntity = expectedEntities[0] ?? liveEntities[0];
+  if (aggregateEntity) {
+    const aggregate = await postJson2(doFetch, `${cfg.dbEndpoint}/app/${encodeURIComponent(entry.tenantId)}/aggregate`, entry.dbKey, {
+      ns: aggregateEntity,
+      aggregate: { count: true }
+    });
+    const count = aggregate.aggregate?.count;
+    out.log(`  aggregate: ${aggregateEntity}.count=${String(count ?? "ok")}`);
+  } else {
+    out.log(`  aggregate: skipped (schema has no entities)`);
+  }
+  out.log("ok");
+}
+async function getJson(doFetch, url, bearer) {
+  const res = await doFetch(url, {
+    headers: bearer ? { authorization: `Bearer ${bearer}` } : void 0
+  });
+  if (!res.ok) throw new Error(`${new URL(url).pathname} returned ${res.status}: ${await safeText3(res)}`);
+  return res.json();
+}
+async function postJson2(doFetch, url, bearer, body) {
+  const res = await doFetch(url, {
+    method: "POST",
+    headers: { authorization: `Bearer ${bearer}`, "content-type": "application/json" },
+    body: JSON.stringify(body)
+  });
+  if (!res.ok) throw new Error(`${new URL(url).pathname} returned ${res.status}: ${await safeText3(res)}`);
+  return res.json();
+}
+function publicConfigUrl(platformUrl, appId, env) {
+  const url = new URL(`/registry/apps/${encodeURIComponent(appId)}/public-config`, platformUrl);
+  url.searchParams.set("env", env);
+  return url.toString();
+}
+async function safeText3(res) {
+  try {
+    return (await res.text()).slice(0, 500);
+  } catch {
+    return "";
+  }
+}
+
+// src/cli.ts
+import { findingsAtOrAbove } from "@odla-ai/security";
+
+// src/argv.ts
+function parseArgv(argv) {
+  const positionals = [];
+  const options = {};
+  for (let i = 0; i < argv.length; i++) {
+    const arg = argv[i];
+    if (!arg.startsWith("--")) {
+      positionals.push(arg);
+      continue;
+    }
+    const eq = arg.indexOf("=");
+    const rawName = arg.slice(2, eq === -1 ? void 0 : eq);
+    if (!rawName) continue;
+    if (rawName.startsWith("no-")) {
+      options[rawName.slice(3)] = false;
+      continue;
+    }
+    if (eq !== -1) {
+      addOption(options, rawName, arg.slice(eq + 1));
+      continue;
+    }
+    const value = argv[i + 1];
+    if (value !== void 0 && !value.startsWith("--")) {
+      i++;
+      addOption(options, rawName, value);
+    } else {
+      addOption(options, rawName, true);
+    }
+  }
+  return { positionals, options };
+}
+function assertArgs(parsed, allowedOptions, maxPositionals) {
+  const allowed = new Set(allowedOptions);
+  for (const name of Object.keys(parsed.options)) {
+    if (!allowed.has(name)) throw new Error(`unknown option "--${name}"; run "odla-ai help" for supported options`);
+  }
+  if (parsed.positionals.length > maxPositionals) {
+    throw new Error(`unexpected argument "${parsed.positionals[maxPositionals]}"; run "odla-ai help"`);
+  }
+}
+function requiredString(value, name) {
+  const result = stringOpt(value);
+  if (!result) throw new Error(`${name} is required`);
+  return result;
+}
+function stringOpt(value) {
+  if (typeof value === "string") return value;
+  if (Array.isArray(value)) return value[value.length - 1];
+  return void 0;
+}
+function listOpt(value) {
+  if (value === void 0 || typeof value === "boolean") return void 0;
+  const values = Array.isArray(value) ? value : [value];
+  return values.flatMap((item) => item.split(",")).map((item) => item.trim()).filter(Boolean);
+}
+function boolOpt(value) {
+  if (typeof value === "boolean") return value;
+  if (typeof value === "string" && (value === "true" || value === "false")) return value === "true";
+  if (value === void 0) return void 0;
+  throw new Error("boolean option must be true or false");
+}
+function numberOpt(value, flag) {
+  if (value === void 0) return void 0;
+  const raw = stringOpt(value);
+  const parsed = raw === void 0 ? Number.NaN : Number(raw);
+  if (!Number.isSafeInteger(parsed) || parsed < 1) throw new Error(`${flag} requires a positive integer`);
+  return parsed;
+}
+function addOption(options, name, value) {
+  const current = options[name];
+  if (current === void 0) options[name] = value;
+  else if (Array.isArray(current)) current.push(String(value));
+  else options[name] = [String(current), String(value)];
+}
+
+// src/help.ts
+import { readFileSync as readFileSync6 } from "fs";
+function cliVersion() {
+  const pkg = JSON.parse(readFileSync6(new URL("../package.json", import.meta.url), "utf8"));
+  return pkg.version ?? "unknown";
+}
+function printHelp() {
+  console.log(`odla-ai
+
+Usage:
+  odla-ai setup [--dir <project>] [--agent <name>] [--global] [--force]
+  odla-ai init --app-id <id> --name <name> [--services db,ai,o11y] [--env dev --env prod]
+  odla-ai doctor [--config odla.config.mjs]
+  odla-ai capabilities [--json]
+  odla-ai admin ai show [--platform https://odla.ai] [--json]
+  odla-ai admin ai set <purpose> --provider <id> --model <id> [--enabled|--no-enabled]
+  odla-ai admin ai credentials [--json]
+  odla-ai admin ai credential set <provider> (--from-env <NAME>|--stdin)
+  odla-ai security run [target] --ack-redacted-source [--env dev] [--profile odla] [--fail-on high]
+  odla-ai security run [target] --self --ack-redacted-source
+  odla-ai provision [--config odla.config.mjs] [--dry-run] [--push-secrets] [--rotate-o11y-token] [--write-dev-vars[=path]] [--yes]
+  odla-ai smoke [--config odla.config.mjs] [--env dev]
+  odla-ai skill install [--dir <project>] [--agent <name>] [--global] [--force]
+  odla-ai secrets push --env <env> [--config odla.config.mjs] [--dry-run] [--yes]
+  odla-ai version
+
+Commands:
+  setup        Install offline odla runbooks for common coding-agent harnesses.
+  init         Create a generic odla.config.mjs plus starter schema/rules files.
+  doctor       Validate and summarize the project config without network calls.
+  capabilities Show what the CLI automates vs agent edits and human checkpoints.
+  admin        Manage platform-funded AI routing with a narrow admin-approved device grant.
+  security     Run hosted discovery + independent validation with app/run attribution.
+  provision    Register services, configure them, persist credentials, optionally push secrets.
+  smoke        Verify local credentials, public-config, live schema, and db aggregate.
+  skill        Same installer; --agent accepts all, claude, codex, cursor,
+               copilot, gemini, or agents (repeatable or comma-separated).
+  secrets      Push configured db/o11y secrets into the Worker via wrangler stdin.
+  version      Print the CLI version.
+
+Safety:
+  New projects target dev only. Add prod explicitly to odla.config.mjs and pass
+  --yes to provision it; use --dry-run first to inspect the resolved plan.
+  Provision caches the approved developer token and service credentials under
+  .odla/ with mode 0600, and init adds those paths to .gitignore. Secret push
+  preflights Wrangler before any shown-once issuance or destructive rotation.
+  Provision opens the approval page automatically in interactive terminals;
+  use --open to force browser launch or --no-open to suppress it.
+`);
+}
+
+// src/cli.ts
+async function runCli(argv = process.argv.slice(2)) {
+  const parsed = parseArgv(argv);
+  const command = parsed.positionals[0] ?? "help";
+  if (command === "version" || command === "-v" || parsed.options.version === true) {
+    assertArgs(parsed, ["version"], 1);
+    console.log(cliVersion());
+    return;
+  }
+  if (command === "help" || command === "--help" || command === "-h") {
+    assertArgs(parsed, ["help"], 1);
+    printHelp();
+    return;
+  }
+  if (command === "init") {
+    assertArgs(parsed, ["app-id", "name", "config", "env", "services", "ai-provider", "force"], 1);
+    initProject({
+      appId: requiredString(parsed.options["app-id"], "--app-id"),
+      name: requiredString(parsed.options.name, "--name"),
+      configPath: stringOpt(parsed.options.config),
+      envs: listOpt(parsed.options.env),
+      services: listOpt(parsed.options.services),
+      aiProvider: stringOpt(parsed.options["ai-provider"]),
+      force: parsed.options.force === true
+    });
+    return;
+  }
+  if (command === "doctor") {
+    assertArgs(parsed, ["config"], 1);
+    await doctor({ configPath: stringOpt(parsed.options.config) ?? "odla.config.mjs" });
+    return;
+  }
+  if (command === "capabilities") {
+    assertArgs(parsed, ["json"], 1);
+    printCapabilities(parsed.options.json === true);
+    return;
+  }
+  if (command === "admin") {
+    const area = parsed.positionals[1];
+    const action = parsed.positionals[2];
+    const credentialSet = action === "credential" && parsed.positionals[3] === "set";
+    const credentials = action === "credentials";
+    if (area !== "ai" || action !== "show" && action !== "set" && !credentialSet && !credentials) {
+      throw new Error('unknown admin command. Try "odla-ai admin ai show".');
+    }
+    assertArgs(parsed, [
+      "platform",
+      "token",
+      "json",
+      "open",
+      "provider",
+      "model",
+      "enabled",
+      "max-input-bytes",
+      "max-output-tokens",
+      "max-calls-per-run",
+      "from-env",
+      "stdin"
+    ], credentialSet ? 5 : action === "set" ? 4 : 3);
+    await adminAi({
+      action: credentialSet ? "credential-set" : credentials ? "credentials" : action,
+      purpose: action === "set" ? parsed.positionals[3] : void 0,
+      provider: stringOpt(parsed.options.provider),
+      model: stringOpt(parsed.options.model),
+      enabled: boolOpt(parsed.options.enabled),
+      maxInputBytes: numberOpt(parsed.options["max-input-bytes"], "--max-input-bytes"),
+      maxOutputTokens: numberOpt(parsed.options["max-output-tokens"], "--max-output-tokens"),
+      maxCallsPerRun: numberOpt(parsed.options["max-calls-per-run"], "--max-calls-per-run"),
+      platform: stringOpt(parsed.options.platform),
+      token: stringOpt(parsed.options.token),
+      json: parsed.options.json === true,
+      open: parsed.options.open === false ? false : parsed.options.open === true ? true : void 0,
+      credentialProvider: credentialSet ? parsed.positionals[4] : void 0,
+      fromEnv: stringOpt(parsed.options["from-env"]),
+      stdin: parsed.options.stdin === true
+    });
+    return;
+  }
+  if (command === "security") {
+    const sub = parsed.positionals[1];
+    if (sub !== "run") throw new Error('unknown security command. Try "odla-ai security run".');
+    assertArgs(parsed, [
+      "config",
+      "env",
+      "out",
+      "profile",
+      "max-hunt-tasks",
+      "run-id",
+      "platform",
+      "self",
+      "ack-redacted-source",
+      "open",
+      "fail-on",
+      "fail-on-candidates",
+      "allow-incomplete"
+    ], 3);
+    const configPath = stringOpt(parsed.options.config) ?? "odla.config.mjs";
+    const selfAudit = parsed.options.self === true;
+    const open = parsed.options.open === false ? false : parsed.options.open === true ? true : void 0;
+    const platform = stringOpt(parsed.options.platform);
+    const result = await runHostedSecurity({
+      configPath,
+      selfAudit,
+      target: parsed.positionals[2],
+      out: stringOpt(parsed.options.out),
+      env: stringOpt(parsed.options.env),
+      profile: securityProfile(stringOpt(parsed.options.profile)),
+      maxHuntTasks: numberOpt(parsed.options["max-hunt-tasks"], "--max-hunt-tasks"),
+      runId: stringOpt(parsed.options["run-id"]),
+      platform,
+      sourceDisclosureAck: parsed.options["ack-redacted-source"] === true ? "redacted" : void 0,
+      getToken: async (request) => {
+        if (request.scope === "platform:security:self") {
+          return getScopedPlatformToken({ platform: request.platform, scope: request.scope, open });
+        }
+        const cfg = await loadProjectConfig(configPath);
+        return getDeveloperToken(cfg, { configPath, open }, fetch, console);
+      }
+    });
+    const failOn = severityOpt(stringOpt(parsed.options["fail-on"]) ?? "high", "--fail-on");
+    const candidateValue = parsed.options["fail-on-candidates"];
+    const failOnCandidates = candidateValue === false ? void 0 : severityOpt(stringOpt(candidateValue) ?? "critical", "--fail-on-candidates");
+    const confirmed = findingsAtOrAbove(result.report, failOn);
+    const leads = failOnCandidates ? findingsAtOrAbove(result.report, failOnCandidates, true).filter((finding) => finding.disposition !== "confirmed") : [];
+    const incomplete = result.report.coverageStatus === "incomplete" && parsed.options["allow-incomplete"] !== true;
+    if (confirmed.length || leads.length || incomplete) {
+      throw new Error(`hosted security gate failed: ${confirmed.length} confirmed >= ${failOn}; ${leads.length} leads >= ${failOnCandidates ?? "disabled"}${incomplete ? "; coverage incomplete" : ""}`);
+    }
+    return;
+  }
+  if (command === "provision") {
+    assertArgs(
+      parsed,
+      [
+        "config",
+        "dry-run",
+        "rotate-keys",
+        "rotate-o11y-token",
+        "push-secrets",
+        "write-credentials",
+        "write-dev-vars",
+        "token",
+        "open",
+        "yes"
+      ],
+      1
+    );
+    const writeDevVars2 = parsed.options["write-dev-vars"];
+    const opts = {
+      configPath: stringOpt(parsed.options.config) ?? "odla.config.mjs",
+      dryRun: parsed.options["dry-run"] === true,
+      rotateKeys: parsed.options["rotate-keys"] === true,
+      rotateO11yToken: parsed.options["rotate-o11y-token"] === true,
+      pushSecrets: parsed.options["push-secrets"] === true,
+      writeCredentials: parsed.options["write-credentials"] !== false,
+      writeDevVars: typeof writeDevVars2 === "string" ? writeDevVars2 : writeDevVars2 === true,
+      token: stringOpt(parsed.options.token),
+      open: parsed.options.open === false ? false : parsed.options.open === true ? true : void 0,
+      yes: parsed.options.yes === true
+    };
+    await provision(opts);
+    return;
+  }
+  if (command === "smoke") {
+    assertArgs(parsed, ["config", "env"], 1);
+    await smoke({
+      configPath: stringOpt(parsed.options.config) ?? "odla.config.mjs",
+      env: stringOpt(parsed.options.env)
+    });
+    return;
+  }
+  if (command === "setup") {
+    assertArgs(parsed, ["dir", "global", "force", "agent", "harness"], 1);
+    installSkill({
+      dir: stringOpt(parsed.options.dir),
+      global: parsed.options.global === true,
+      harnesses: harnessList(parsed),
+      force: parsed.options.force === true
+    });
+    console.log(
+      "\nOffline runbooks installed. Open this repo in your coding agent and ask it to set up odla.\nIts native adapter finds the local `odla` skill, chooses build or migration, and drives the CLI."
+    );
+    return;
+  }
+  if (command === "skill") {
+    const sub = parsed.positionals[1];
+    if (sub !== "install") throw new Error(`unknown skill subcommand "${sub ?? ""}". Try "odla-ai skill install".`);
+    assertArgs(parsed, ["dir", "global", "force", "agent", "harness"], 2);
+    installSkill({
+      dir: stringOpt(parsed.options.dir),
+      global: parsed.options.global === true,
+      harnesses: harnessList(parsed),
+      force: parsed.options.force === true
+    });
+    return;
+  }
+  if (command === "secrets") {
+    const sub = parsed.positionals[1];
+    if (sub !== "push") throw new Error(`unknown secrets subcommand "${sub ?? ""}". Try "odla-ai secrets push --env dev".`);
+    assertArgs(parsed, ["config", "env", "dry-run", "yes"], 2);
+    await secretsPush({
+      configPath: stringOpt(parsed.options.config) ?? "odla.config.mjs",
+      env: requiredString(parsed.options.env, "--env"),
+      dryRun: parsed.options["dry-run"] === true,
+      yes: parsed.options.yes === true
+    });
+    return;
+  }
+  throw new Error(`unknown command "${command}". Run "odla-ai help".`);
+}
+function securityProfile(value) {
+  if (value === void 0) return void 0;
+  if (value === "odla" || value === "cloudflare-app" || value === "generic") return value;
+  throw new Error("--profile must be odla, cloudflare-app, or generic");
+}
+function severityOpt(value, flag) {
+  if (["informational", "low", "medium", "high", "critical"].includes(value)) return value;
+  throw new Error(`${flag} must be informational, low, medium, high, or critical`);
+}
+function harnessList(parsed) {
+  const selected = [
+    ...harnessOption(parsed.options.agent, "--agent"),
+    ...harnessOption(parsed.options.harness, "--harness")
+  ];
+  return selected.length ? selected : ["all"];
+}
+function harnessOption(value, flag) {
+  if (value === void 0) return [];
+  if (typeof value === "boolean") throw new Error(`${flag} requires a harness name`);
+  const raw = Array.isArray(value) ? value : [value];
+  const parts = raw.flatMap((item) => item.split(","));
+  if (parts.some((item) => !item.trim())) throw new Error(`${flag} requires a harness name`);
+  return parts.map((item) => item.trim());
+}
+
+export {
+  SYSTEM_AI_PURPOSES,
+  getScopedPlatformToken,
+  adminAi,
+  CAPABILITIES,
+  printCapabilities,
+  redactSecrets,
+  doctor,
+  initProject,
+  secretsPush,
+  provision,
+  runHostedSecurity,
+  AGENT_HARNESSES,
+  installSkill,
+  smoke,
+  runCli
+};
+//# sourceMappingURL=chunk-OERLHVLH.js.map