@odla-ai/cli 0.6.0 → 0.7.1

package/dist/bin.cjs

@@ -31,9 +31,11 @@ var importMetaUrl = /* @__PURE__ */ getImportMetaUrl();
 var import_security2 = require("@odla-ai/security");
 
 // src/admin-ai.ts
-var import_node_process3 = __toESM(require("process"), 1);
-var import_node_fs2 = require("fs");
-var import_db2 = require("@odla-ai/db");
+var import_node_process4 = __toESM(require("process"), 1);
+
+// src/token.ts
+var import_db = require("@odla-ai/db");
+var import_node_process2 = __toESM(require("process"), 1);
 
 // src/open.ts
 var import_node_child_process = require("child_process");
@@ -59,10 +61,6 @@ function openerFor(platform) {
   return { cmd: "xdg-open", args: [] };
 }
 
-// src/token.ts
-var import_db = require("@odla-ai/db");
-var import_node_process2 = __toESM(require("process"), 1);
-
 // src/local.ts
 var import_node_fs = require("fs");
 var import_node_path = require("path");
@@ -192,9 +190,18 @@ function displayPath(path, rootDir = process.cwd()) {
 // src/token.ts
 async function getDeveloperToken(cfg, options, doFetch, out) {
   if (options.token) return options.token;
-  if (import_node_process2.default.env.ODLA_DEV_TOKEN) return import_node_process2.default.env.ODLA_DEV_TOKEN;
+  const audience = platformAudience(cfg.platformUrl);
+  if (import_node_process2.default.env.ODLA_DEV_TOKEN) {
+    const declared = import_node_process2.default.env.ODLA_DEV_TOKEN_AUDIENCE;
+    if (declared) {
+      if (platformAudience(declared) !== audience) throw new Error("ODLA_DEV_TOKEN_AUDIENCE does not match the configured platform");
+    } else if (audience !== "https://odla.ai") {
+      throw new Error("ODLA_DEV_TOKEN_AUDIENCE is required for a non-default platform");
+    }
+    return import_node_process2.default.env.ODLA_DEV_TOKEN;
+  }
   const cached = readJsonFile(cfg.local.tokenFile);
-  if (cached?.token && (cached.expiresAt ?? 0) > Date.now() + 6e4) {
+  if (cached?.token && cached.platform === audience && (cached.expiresAt ?? 0) > Date.now() + 6e4) {
     out.log(`auth: using cached developer token (${displayPath(cfg.local.tokenFile, cfg.rootDir)})`);
     return cached.token;
   }
@@ -220,7 +227,7 @@ async function getDeveloperToken(cfg, options, doFetch, out) {
       out.log("");
     }
   });
-  writePrivateJson(cfg.local.tokenFile, { token, expiresAt });
+  writePrivateJson(cfg.local.tokenFile, { platform: audience, token, expiresAt });
   out.log(`auth: developer token cached (${displayPath(cfg.local.tokenFile, cfg.rootDir)})`);
   return token;
 }
@@ -237,35 +244,271 @@ function handshakeUrl(platformUrl, userCode) {
   url.searchParams.set("code", userCode);
   return url.toString();
 }
+function platformAudience(value) {
+  let url;
+  try {
+    url = new URL(value);
+  } catch {
+    throw new Error("platform must be an absolute URL");
+  }
+  const local = url.hostname === "localhost" || url.hostname === "127.0.0.1" || url.hostname === "[::1]";
+  if (url.protocol !== "https:" && !(local && url.protocol === "http:")) {
+    throw new Error("platform credentials require HTTPS except for loopback development");
+  }
+  if (url.username || url.password || url.search || url.hash) {
+    throw new Error("platform URL must not contain credentials, query, or fragment");
+  }
+  return url.origin;
+}
 
-// src/admin-ai.ts
-var SYSTEM_AI_PURPOSES = ["o11y.triage", "security.discovery", "security.validation"];
+// src/admin-ai-auth.ts
+var import_node_fs2 = require("fs");
+var import_node_process3 = __toESM(require("process"), 1);
+var import_db2 = require("@odla-ai/db");
 async function getScopedPlatformToken(options) {
+  return resolveAdminPlatformToken(options);
+}
+async function resolveAdminPlatformToken(options) {
+  const audience = platformAudience(options.platform);
+  if (options.token) return options.token;
   const fromEnv = import_node_process3.default.env.ODLA_ADMIN_TOKEN;
-  if (fromEnv) return fromEnv;
+  if (fromEnv) return audienceBoundEnvToken(fromEnv, audience);
   return scopedToken(
-    options.platform.replace(/\/$/, ""),
+    audience,
     options.scope,
-    { action: "show", ...options },
+    options,
     options.fetch ?? fetch,
     options.stdout ?? console
   );
 }
+function audienceBoundEnvToken(token, platform) {
+  const audience = platformAudience(platform);
+  const declared = import_node_process3.default.env.ODLA_ADMIN_TOKEN_AUDIENCE;
+  if (declared) {
+    if (platformAudience(declared) !== audience) throw new Error("ODLA_ADMIN_TOKEN_AUDIENCE does not match the configured platform");
+  } else if (audience !== "https://odla.ai") {
+    throw new Error("ODLA_ADMIN_TOKEN_AUDIENCE is required for a non-default platform");
+  }
+  return token;
+}
+async function scopedToken(platform, scope, options, doFetch, out) {
+  const audience = platformAudience(platform);
+  const tokenFile = options.tokenFile ?? `${import_node_process3.default.cwd()}/.odla/admin-token.local.json`;
+  const cache = readJsonFile(tokenFile);
+  const cached = cache?.platform === audience ? cache.tokens?.[scope] : void 0;
+  if (cached?.token && (cached.expiresAt ?? 0) > Date.now() + 6e4) {
+    out.log(`auth: using cached ${scope} grant (${tokenFile})`);
+    return cached.token;
+  }
+  const { token, expiresAt } = await (0, import_db2.requestToken)({
+    endpoint: audience,
+    label: `odla CLI admin AI (${scope})`,
+    scopes: [scope],
+    fetch: doFetch,
+    onCode: async ({ userCode, expiresIn }) => {
+      const approvalUrl = handshakeUrl(audience, userCode);
+      out.log(`Approve scoped request ${userCode} at ${approvalUrl} within ${Math.floor(expiresIn / 60)}m.`);
+      const shouldOpen = options.open === true || options.open !== false && !import_node_process3.default.env.CI && Boolean(import_node_process3.default.stdin.isTTY && import_node_process3.default.stdout.isTTY);
+      if (shouldOpen) await (options.openApprovalUrl ?? openUrl)(approvalUrl).catch(() => void 0);
+    }
+  });
+  const tokens = cache?.platform === audience ? { ...cache.tokens ?? {} } : {};
+  tokens[scope] = { token, expiresAt };
+  if ((0, import_node_fs2.existsSync)(`${import_node_process3.default.cwd()}/.git`)) ensureGitignore(import_node_process3.default.cwd(), [tokenFile]);
+  writePrivateJson(tokenFile, { platform: audience, tokens });
+  out.log(`auth: cached ${scope} grant (${tokenFile}; mode 0600)`);
+  return token;
+}
+
+// src/admin-ai-audit.ts
+function adminAiAuditQuery(filters) {
+  if (filters.limit === void 0) return "";
+  if (!Number.isSafeInteger(filters.limit) || filters.limit < 1 || filters.limit > 200) {
+    throw new Error("audit limit must be an integer from 1 to 200");
+  }
+  return `?limit=${filters.limit}`;
+}
+async function readAdminAiAudit(request) {
+  const response = await request.fetch(`${request.platform}/registry/platform/ai-audit${request.query}`, {
+    headers: request.headers
+  });
+  const body = await responseBody(response);
+  if (!response.ok) throw new Error(apiError(response.status, body));
+  if (request.json) {
+    request.stdout.log(JSON.stringify(body, null, 2));
+    return;
+  }
+  const events = isRecord(body) && Array.isArray(body.events) ? body.events.filter(isRecord) : [];
+  request.stdout.log("when	change	target	before -> after	actor");
+  for (const event of events) {
+    const before = isRecord(event.oldPolicy) ? event.oldPolicy : void 0;
+    const after = isRecord(event.newPolicy) ? event.newPolicy : void 0;
+    const route = before && after ? `${String(before.provider)}/${String(before.model)}@v${String(before.version)} -> ${String(after.provider)}/${String(after.model)}@v${String(after.version)}` : "value not retained";
+    request.stdout.log([
+      timestamp(event.createdAt),
+      String(event.changeKind ?? ""),
+      String(event.purpose ?? event.provider ?? ""),
+      route,
+      `${String(event.actorType ?? "")}:${String(event.actorId ?? "")}`
+    ].join("	"));
+  }
+}
+async function responseBody(response) {
+  const text = await response.text();
+  if (!text) return {};
+  try {
+    return JSON.parse(text);
+  } catch {
+    return { message: text.slice(0, 300) };
+  }
+}
+function apiError(status, body) {
+  const error = isRecord(body) && isRecord(body.error) ? body.error : void 0;
+  const message = error && typeof error.message === "string" ? error.message : isRecord(body) && typeof body.message === "string" ? body.message : "request failed";
+  return `read System AI admin changes failed (${status}): ${message}`;
+}
+function timestamp(value) {
+  if (typeof value !== "number" || !Number.isFinite(value)) return String(value ?? "");
+  const date = new Date(value);
+  return Number.isFinite(date.valueOf()) ? date.toISOString() : "";
+}
+function isRecord(value) {
+  return Boolean(value) && typeof value === "object" && !Array.isArray(value);
+}
+
+// src/admin-ai-policy.ts
+var SYSTEM_AI_PURPOSES = ["o11y.triage", "security.discovery", "security.validation"];
+function requireSystemAiPurpose(value) {
+  if (!SYSTEM_AI_PURPOSES.includes(value)) {
+    throw new Error(`purpose must be one of: ${SYSTEM_AI_PURPOSES.join(", ")}`);
+  }
+  return value;
+}
+
+// src/admin-ai-usage.ts
+function adminAiUsageQuery(filters) {
+  const params = new URLSearchParams();
+  if (filters.appId?.trim()) params.set("appId", filters.appId.trim());
+  if (filters.env?.trim()) params.set("env", filters.env.trim());
+  if (filters.runId?.trim()) params.set("runId", filters.runId.trim());
+  if (filters.limit !== void 0) params.set("limit", String(usageLimit(filters.limit)));
+  const query = params.toString();
+  return query ? `?${query}` : "";
+}
+async function readAdminAiUsage(request) {
+  const res = await request.fetch(`${request.platform}/registry/platform/ai-usage${request.query}`, {
+    headers: request.headers
+  });
+  const body = await responseBody2(res);
+  if (!res.ok) throw new Error(apiError2("read platform AI usage", res.status, body));
+  if (request.json) request.stdout.log(JSON.stringify(body, null, 2));
+  else printUsage(body, request.stdout);
+}
+function usageLimit(value) {
+  if (!Number.isSafeInteger(value) || value < 1 || value > 500) {
+    throw new Error("usage limit must be an integer from 1 to 500");
+  }
+  return value;
+}
+function printUsage(body, out) {
+  const aggregates = isRecord2(body) && isRecord2(body.aggregates) && Array.isArray(body.aggregates.byStatus) ? body.aggregates.byStatus.filter(isRecord2) : [];
+  out.log(`All retained hosted-security status totals (up to ${String(isRecord2(body) ? body.retentionDays ?? 90 : 90)} days; o11y triage excluded)
+status	calls	input tokens	output tokens	cost	unpriced calls`);
+  for (const row of aggregates) {
+    out.log([
+      String(row.status ?? ""),
+      String(row.calls ?? ""),
+      String(row.input_tokens ?? ""),
+      String(row.output_tokens ?? ""),
+      formatMicrousd(row.cost_microusd),
+      String(row.unpriced_calls ?? "")
+    ].join("	"));
+  }
+  const events = isRecord2(body) && Array.isArray(body.events) ? body.events.filter(isRecord2) : [];
+  out.log(`Latest ${String(isRecord2(body) ? body.eventLimit ?? events.length : events.length)} hosted-security events
+when	app/env	run	actor	purpose/role	route / policy	tokens	cost	status`);
+  for (const event of events) {
+    const input = numeric(event.input_tokens);
+    const output = numeric(event.output_tokens);
+    const priced = event.priced === true || event.priced === 1;
+    out.log([
+      timestamp2(event.created_at),
+      `${String(event.app_id ?? "")}/${String(event.env ?? "")}`,
+      String(event.run_id ?? ""),
+      `${String(event.actor_type ?? "")}:${String(event.actor_id ?? "")}`,
+      `${String(event.purpose ?? "")}/${String(event.role ?? "")}`,
+      `${String(event.provider ?? "")}/${String(event.model ?? "")}@v${String(event.policy_version ?? "unknown")}`,
+      String(input + output),
+      priced ? formatMicrousd(event.cost_microusd) : "unpriced",
+      `${String(event.status ?? "")}${event.error_code ? `:${String(event.error_code)}` : ""}`
+    ].join("	"));
+  }
+}
+function numeric(value) {
+  return typeof value === "number" && Number.isFinite(value) ? value : 0;
+}
+function formatMicrousd(value) {
+  return typeof value === "number" && Number.isFinite(value) ? `$${(value / 1e6).toFixed(6)}` : "unpriced";
+}
+function timestamp2(value) {
+  if (typeof value !== "number" || !Number.isFinite(value)) return String(value ?? "");
+  const date = new Date(value);
+  return Number.isFinite(date.valueOf()) ? date.toISOString() : "";
+}
+async function responseBody2(res) {
+  const text = await res.text();
+  if (!text) return {};
+  try {
+    return JSON.parse(text);
+  } catch {
+    return { message: text.slice(0, 300) };
+  }
+}
+function apiError2(action, status, body) {
+  const error = isRecord2(body) && isRecord2(body.error) ? body.error : void 0;
+  const message = error && typeof error.message === "string" ? error.message : isRecord2(body) && typeof body.message === "string" ? body.message : "request failed";
+  return `${action} failed (${status}): ${message}`;
+}
+function isRecord2(value) {
+  return Boolean(value) && typeof value === "object" && !Array.isArray(value);
+}
+
+// src/admin-ai.ts
 async function adminAi(options) {
-  const platform = (options.platform ?? import_node_process3.default.env.ODLA_PLATFORM ?? "https://odla.ai").replace(/\/$/, "");
+  const platform = platformAudience(options.platform ?? import_node_process4.default.env.ODLA_PLATFORM ?? "https://odla.ai");
   const doFetch = options.fetch ?? fetch;
   const out = options.stdout ?? console;
-  const scope = options.action === "set" || options.action === "credential-set" ? "platform:ai:write" : "platform:ai:read";
-  const token = options.token ?? import_node_process3.default.env.ODLA_ADMIN_TOKEN ?? await scopedToken(platform, scope, options, doFetch, out);
+  const usageQuery = options.action === "usage" ? adminAiUsageQuery(options) : void 0;
+  const auditQuery = options.action === "audit" ? adminAiAuditQuery(options) : void 0;
+  const scope = options.action === "set" ? "platform:ai:policy:write" : options.action === "credential-set" ? "platform:ai:credential:write" : options.action === "credentials" ? "platform:ai:credential:read" : options.action === "usage" ? "platform:ai:usage:read" : options.action === "audit" ? "platform:ai:audit:read" : "platform:ai:policy:read";
+  const token = await resolveAdminPlatformToken({
+    platform,
+    scope,
+    token: options.token,
+    open: options.open,
+    fetch: doFetch,
+    stdout: out,
+    openApprovalUrl: options.openApprovalUrl,
+    tokenFile: options.tokenFile
+  });
   const headers = { authorization: `Bearer ${token}`, "content-type": "application/json" };
+  if (options.action === "usage") {
+    await readAdminAiUsage({ platform, query: usageQuery ?? "", headers, json: options.json, fetch: doFetch, stdout: out });
+    return;
+  }
+  if (options.action === "audit") {
+    await readAdminAiAudit({ platform, query: auditQuery ?? "", headers, json: options.json, fetch: doFetch, stdout: out });
+    return;
+  }
   if (options.action === "credentials") {
     const res2 = await doFetch(`${platform}/registry/platform/ai-credentials`, { headers });
-    const body2 = await responseBody(res2);
-    if (!res2.ok) throw new Error(apiError("read platform AI credential status", res2.status, body2));
-    const credentials = isRecord(body2) && isRecord(body2.credentials) ? body2.credentials : body2;
+    const body2 = await responseBody3(res2);
+    if (!res2.ok) throw new Error(apiError3("read platform AI credential status", res2.status, body2));
+    const credentials = isRecord3(body2) && isRecord3(body2.credentials) ? body2.credentials : body2;
     if (options.json) out.log(JSON.stringify({ credentials }, null, 2));
-    else for (const [provider, status] of Object.entries(isRecord(credentials) ? credentials : {})) {
-      out.log(`${provider}	${isRecord(status) && status.set === true ? "set" : "not set"}`);
+    else for (const [provider, status] of Object.entries(isRecord3(credentials) ? credentials : {})) {
+      const label = isRecord3(status) && status.set === true ? status.readable === true ? "vault readable" : "stored; vault unreadable" : "not set";
+      out.log(`${provider}	${label}`);
     }
     return;
   }
@@ -277,18 +520,25 @@ async function adminAi(options) {
       headers,
       body: JSON.stringify({ value })
     });
-    const body2 = await responseBody(res2);
-    if (!res2.ok) throw new Error(apiError(`store ${provider} platform credential`, res2.status, body2));
+    const body2 = await responseBody3(res2);
+    if (!res2.ok) throw new Error(apiError3(`store ${provider} platform credential`, res2.status, body2));
     out.log(`stored ${provider} platform credential (write-only; value was not returned)`);
     return;
   }
-  if (options.action === "show") {
+  if (options.action === "show" || options.action === "models") {
     const res2 = await doFetch(`${platform}/registry/platform/ai-policies`, { headers });
-    const body2 = await responseBody(res2);
-    if (!res2.ok) throw new Error(apiError("read platform AI policies", res2.status, body2));
+    const body2 = await responseBody3(res2);
+    if (!res2.ok) throw new Error(apiError3("read platform AI policies", res2.status, body2));
+    if (options.action === "models") {
+      const models = catalogModels(body2).filter((model) => !options.provider || model.provider === options.provider);
+      if (!models.length) throw new Error(options.provider ? `no System AI models found for provider ${options.provider}` : "platform returned no System AI models");
+      if (options.json) out.log(JSON.stringify({ models }, null, 2));
+      else for (const model of models) out.log(`${model.provider}	${model.id}`);
+      return;
+    }
     const policies = policyArray(body2);
     if (options.json) {
-      out.log(JSON.stringify({ policies }, null, 2));
+      out.log(JSON.stringify({ policies, models: catalogModels(body2) }, null, 2));
       return;
     }
     out.log("purpose	enabled	provider	model	max calls	max input bytes	max output tokens");
@@ -305,59 +555,68 @@ async function adminAi(options) {
     }
     return;
   }
-  const purpose = requirePurpose(options.purpose);
-  if (!options.provider?.trim()) throw new Error("--provider is required");
-  if (!options.model?.trim()) throw new Error("--model is required");
+  if (options.purpose === "security") {
+    const currentResponse = await doFetch(`${platform}/registry/platform/ai-policies`, { headers });
+    const currentBody = await responseBody3(currentResponse);
+    if (!currentResponse.ok) throw new Error(apiError3("read current security AI policies", currentResponse.status, currentBody));
+    const policies = policyArray(currentBody);
+    const discovery = policies.find((policy2) => policy2.purpose === "security.discovery");
+    const validation = policies.find((policy2) => policy2.purpose === "security.validation");
+    if (!discovery || !validation || !Number.isSafeInteger(discovery.version) || !Number.isSafeInteger(validation.version)) {
+      throw new Error("platform returned invalid security AI policy revisions");
+    }
+    const shared = {
+      ...options.enabled === void 0 ? {} : { enabled: options.enabled },
+      ...options.maxInputBytes === void 0 ? {} : { maxInputBytes: options.maxInputBytes },
+      ...options.maxOutputTokens === void 0 ? {} : { maxOutputTokens: options.maxOutputTokens },
+      ...options.maxCallsPerRun === void 0 ? {} : { maxCallsPerRun: options.maxCallsPerRun }
+    };
+    const discoveryUpdate = {
+      ...shared,
+      ...options.discoveryProvider?.trim() ? { provider: options.discoveryProvider.trim() } : {},
+      ...options.discoveryModel?.trim() ? { model: options.discoveryModel.trim() } : {}
+    };
+    const validationUpdate = {
+      ...shared,
+      ...options.validationProvider?.trim() ? { provider: options.validationProvider.trim() } : {},
+      ...options.validationModel?.trim() ? { model: options.validationModel.trim() } : {}
+    };
+    if (!Object.keys(discoveryUpdate).length && !Object.keys(validationUpdate).length) {
+      throw new Error("security set requires a route, enabled state, or budget change");
+    }
+    const res2 = await doFetch(`${platform}/registry/platform/ai-policies/security`, {
+      method: "PUT",
+      headers,
+      body: JSON.stringify({
+        expectedVersions: { discovery: discovery.version, validation: validation.version },
+        discovery: discoveryUpdate,
+        validation: validationUpdate
+      })
+    });
+    const response2 = await responseBody3(res2);
+    if (!res2.ok) throw new Error(apiError3("update security review routes", res2.status, response2));
+    out.log(options.json ? JSON.stringify(response2, null, 2) : "updated security review discovery and independent validation routes atomically");
+    return;
+  }
+  const purpose = requireSystemAiPurpose(options.purpose);
   const body = {
-    provider: options.provider.trim(),
-    model: options.model.trim(),
+    ...options.provider?.trim() ? { provider: options.provider.trim() } : {},
+    ...options.model?.trim() ? { model: options.model.trim() } : {},
     ...options.enabled === void 0 ? {} : { enabled: options.enabled },
     ...options.maxInputBytes === void 0 ? {} : { maxInputBytes: options.maxInputBytes },
     ...options.maxOutputTokens === void 0 ? {} : { maxOutputTokens: options.maxOutputTokens },
     ...options.maxCallsPerRun === void 0 ? {} : { maxCallsPerRun: options.maxCallsPerRun }
   };
+  if (!Object.keys(body).length) throw new Error("set requires a provider, model, enabled state, or budget change");
   const res = await doFetch(`${platform}/registry/platform/ai-policies/${encodeURIComponent(purpose)}`, {
     method: "PUT",
     headers,
     body: JSON.stringify(body)
   });
-  const response = await responseBody(res);
-  if (!res.ok) throw new Error(apiError(`update ${purpose}`, res.status, response));
-  const policy = isRecord(response) && isRecord(response.policy) ? response.policy : isRecord(response) ? response : {};
-  out.log(options.json ? JSON.stringify({ policy }, null, 2) : `updated ${purpose}: ${String(policy.provider ?? body.provider)}/${String(policy.model ?? body.model)}`);
-}
-async function scopedToken(platform, scope, options, doFetch, out) {
-  const tokenFile = options.tokenFile ?? `${import_node_process3.default.cwd()}/.odla/admin-token.local.json`;
-  const cache = readJsonFile(tokenFile);
-  const cached = cache?.platform === platform ? cache.tokens?.[scope] : void 0;
-  if (cached?.token && (cached.expiresAt ?? 0) > Date.now() + 6e4) {
-    out.log(`auth: using cached ${scope} grant (${tokenFile})`);
-    return cached.token;
-  }
-  const { token, expiresAt } = await (0, import_db2.requestToken)({
-    endpoint: platform,
-    label: `odla CLI admin AI (${scope})`,
-    scopes: [scope],
-    fetch: doFetch,
-    onCode: async ({ userCode, expiresIn }) => {
-      const approvalUrl = handshakeUrl(platform, userCode);
-      out.log(`Approve scoped request ${userCode} at ${approvalUrl} within ${Math.floor(expiresIn / 60)}m.`);
-      const shouldOpen = options.open === true || options.open !== false && !import_node_process3.default.env.CI && Boolean(import_node_process3.default.stdin.isTTY && import_node_process3.default.stdout.isTTY);
-      if (shouldOpen) await (options.openApprovalUrl ?? openUrl)(approvalUrl).catch(() => void 0);
-    }
-  });
-  const tokens = cache?.platform === platform ? { ...cache.tokens ?? {} } : {};
-  tokens[scope] = { token, expiresAt };
-  if ((0, import_node_fs2.existsSync)(`${import_node_process3.default.cwd()}/.git`)) ensureGitignore(import_node_process3.default.cwd(), [tokenFile]);
-  writePrivateJson(tokenFile, { platform, tokens });
-  out.log(`auth: cached ${scope} grant (${tokenFile}; mode 0600)`);
-  return token;
-}
-function requirePurpose(value) {
-  if (!SYSTEM_AI_PURPOSES.includes(value)) {
-    throw new Error(`purpose must be one of: ${SYSTEM_AI_PURPOSES.join(", ")}`);
-  }
-  return value;
+  const response = await responseBody3(res);
+  if (!res.ok) throw new Error(apiError3(`update ${purpose}`, res.status, response));
+  const policy = isRecord3(response) && isRecord3(response.policy) ? response.policy : isRecord3(response) ? response : {};
+  out.log(options.json ? JSON.stringify({ policy }, null, 2) : `updated ${purpose}: ${String(policy.provider ?? "unchanged")}/${String(policy.model ?? "unchanged")}`);
 }
 function requireProvider(value) {
   if (value !== "anthropic" && value !== "openai" && value !== "google") {
@@ -368,7 +627,7 @@ function requireProvider(value) {
 async function credentialValue(options) {
   if (options.fromEnv && options.stdin) throw new Error("choose exactly one of --from-env or --stdin");
   let value;
-  if (options.fromEnv) value = import_node_process3.default.env[options.fromEnv];
+  if (options.fromEnv) value = import_node_process4.default.env[options.fromEnv];
   else if (options.stdin) value = await (options.readStdin ?? readStdin)();
   else throw new Error("credential input required: use --from-env <NAME> or --stdin; values are never accepted as arguments");
   value = value?.replace(/[\r\n]+$/, "");
@@ -378,18 +637,24 @@ async function credentialValue(options) {
 }
 async function readStdin() {
   let value = "";
-  for await (const chunk of import_node_process3.default.stdin) {
+  for await (const chunk of import_node_process4.default.stdin) {
     value += String(chunk);
     if (value.length > 64 * 1024) throw new Error("credential exceeds 64 KiB");
   }
   return value;
 }
 function policyArray(body) {
-  if (isRecord(body) && Array.isArray(body.policies)) return body.policies.filter(isRecord);
-  if (isRecord(body) && isRecord(body.policies)) return Object.values(body.policies).filter(isRecord);
+  if (isRecord3(body) && Array.isArray(body.policies)) return body.policies.filter(isRecord3);
+  if (isRecord3(body) && isRecord3(body.policies)) return Object.values(body.policies).filter(isRecord3);
   throw new Error("platform returned an invalid AI policy response");
 }
-async function responseBody(res) {
+function catalogModels(body) {
+  if (!isRecord3(body) || !isRecord3(body.catalog) || !Array.isArray(body.catalog.models)) {
+    throw new Error("platform returned an invalid System AI model catalog");
+  }
+  return body.catalog.models.filter((value) => isRecord3(value) && typeof value.id === "string" && typeof value.provider === "string");
+}
+async function responseBody3(res) {
   const text = await res.text();
   if (!text) return {};
   try {
@@ -398,12 +663,12 @@ async function responseBody(res) {
     return { message: text.slice(0, 300) };
   }
 }
-function apiError(action, status, body) {
-  const error = isRecord(body) && isRecord(body.error) ? body.error : void 0;
-  const message = error && typeof error.message === "string" ? error.message : isRecord(body) && typeof body.message === "string" ? body.message : "request failed";
+function apiError3(action, status, body) {
+  const error = isRecord3(body) && isRecord3(body.error) ? body.error : void 0;
+  const message = error && typeof error.message === "string" ? error.message : isRecord3(body) && typeof body.message === "string" ? body.message : "request failed";
   return `${action} failed (${status}): ${message}`;
 }
-function isRecord(value) {
+function isRecord3(value) {
   return Boolean(value) && typeof value === "object" && !Array.isArray(value);
 }
 
@@ -491,7 +756,7 @@ var CAPABILITIES = {
     "push db schema/rules and configure platform AI, auth, and deployment links",
     "validate config offline and smoke-test a provisioned db environment",
     "run app-attributed hosted security discovery and independent validation without provider keys",
-    "let admins manage system AI routes/credentials through short-lived exact-scope approval"
+    "let admins manage system AI policy and credentials, inspect attributed usage, and read immutable admin changes through separate short-lived capability-only approvals"
   ],
   agent: [
     "install and import the selected odla SDKs",
@@ -1023,7 +1288,7 @@ function relativeDisplay(path, rootDir) {
 // src/provision.ts
 var import_apps2 = require("@odla-ai/apps");
 var import_ai = require("@odla-ai/ai");
-var import_node_process4 = __toESM(require("process"), 1);
+var import_node_process5 = __toESM(require("process"), 1);
 
 // src/provision-credentials.ts
 var import_apps = require("@odla-ai/apps");
@@ -1327,7 +1592,7 @@ ${env}: credentials are already saved; retry "odla-ai secrets push --env ${env}$
       out.log(`${env}: rules pushed (${Object.keys(rules).length} namespaces)`);
     }
     if (cfg.services.includes("ai") && cfg.ai?.provider && cfg.ai.keyEnv) {
-      const key = import_node_process4.default.env[cfg.ai.keyEnv];
+      const key = import_node_process5.default.env[cfg.ai.keyEnv];
       if (key) {
         const secretName = cfg.ai.secretName ?? defaultSecretName(cfg.ai.provider);
         await (0, import_ai.putSecret)({ endpoint: cfg.dbEndpoint, token, fetch: doFetch }, tenantId, secretName, key);
@@ -1482,10 +1747,14 @@ function printSummary(out, appId, env, run, report, output) {
   out.log(`security: ${appId}/${env} run=${run.runId} profile=${run.profileVersion}`);
   out.log(`  discovery: ${run.discovery.identity.provider}/${run.discovery.identity.model}`);
   out.log(`  validation: ${run.validation.identity.provider}/${run.validation.identity.model}`);
-  out.log(`  coverage: ${report.coverageStatus} ${complete}/${report.coverage.length} blocked=${report.metrics.blockedCells} shallow=${report.metrics.shallowCells} unscheduled=${report.metrics.unscheduledCells}`);
+  out.log(`  coverage: ${report.coverageStatus} ${complete}/${report.coverage.length} blocked=${report.metrics.blockedCells} shallow=${report.metrics.shallowCells} unscheduled=${report.metrics.unscheduledCells} budget_exhausted=${report.metrics.budgetExhaustedCells}`);
+  if (report.callBudget) out.log(`  calls: discovery=${formatBudget(report.callBudget.discovery)} validation=${formatBudget(report.callBudget.validation)}`);
   out.log(`  findings: confirmed=${report.metrics.confirmed} needs_reproduction=${report.metrics.needsReproduction} candidates=${report.metrics.candidates}`);
   out.log(`  report: ${(0, import_node_path6.resolve)(output, "REPORT.md")}`);
 }
+function formatBudget(usage) {
+  return usage ? `${usage.usedCalls}/${usage.maxCalls} skipped=${usage.skippedCalls}` : "caller-managed";
+}
 
 // src/help.ts
 var import_node_fs7 = require("fs");
@@ -1502,9 +1771,14 @@ Usage:
   odla-ai doctor [--config odla.config.mjs]
   odla-ai capabilities [--json]
   odla-ai admin ai show [--platform https://odla.ai] [--json]
-  odla-ai admin ai set <purpose> --provider <id> --model <id> [--enabled|--no-enabled]
+  odla-ai admin ai models [--provider <id>] [--json]
+  odla-ai admin ai set <purpose> [--provider <id>] [--model <id>] [--enabled|--no-enabled]
+  odla-ai admin ai set security --discovery-provider <id> --discovery-model <id>
+    --validation-provider <id> --validation-model <id> [--enabled|--no-enabled]
   odla-ai admin ai credentials [--json]
   odla-ai admin ai credential set <provider> (--from-env <NAME>|--stdin)
+  odla-ai admin ai usage [--app-id <id>] [--env <env>] [--run-id <id>] [--limit <1-500>] [--json]
+  odla-ai admin ai audit [--limit <1-200>] [--json]
   odla-ai security run [target] --ack-redacted-source [--env dev] [--profile odla] [--fail-on high]
   odla-ai security run [target] --self --ack-redacted-source
   odla-ai provision [--config odla.config.mjs] [--dry-run] [--push-secrets] [--rotate-o11y-token] [--write-dev-vars[=path]] [--yes]
@@ -1518,7 +1792,7 @@ Commands:
   init         Create a generic odla.config.mjs plus starter schema/rules files.
   doctor       Validate and summarize the project config without network calls.
   capabilities Show what the CLI automates vs agent edits and human checkpoints.
-  admin        Manage platform-funded AI routing with a narrow admin-approved device grant.
+  admin        Manage platform-funded AI routing/credentials/usage with narrow device grants.
   security     Run hosted discovery + independent validation with app/run attribution.
   provision    Register services, configure them, persist credentials, optionally push secrets.
   smoke        Verify local credentials, public-config, live schema, and db aggregate.
@@ -1914,12 +2188,14 @@ async function runCli(argv = process.argv.slice(2)) {
     const action = parsed.positionals[2];
     const credentialSet = action === "credential" && parsed.positionals[3] === "set";
     const credentials = action === "credentials";
-    if (area !== "ai" || action !== "show" && action !== "set" && !credentialSet && !credentials) {
+    const models = action === "models";
+    const usage = action === "usage";
+    const audit = action === "audit";
+    if (area !== "ai" || action !== "show" && action !== "set" && !credentialSet && !credentials && !models && !usage && !audit) {
       throw new Error('unknown admin command. Try "odla-ai admin ai show".');
     }
     assertArgs(parsed, [
       "platform",
-      "token",
       "json",
       "open",
       "provider",
@@ -1929,10 +2205,18 @@ async function runCli(argv = process.argv.slice(2)) {
       "max-output-tokens",
       "max-calls-per-run",
       "from-env",
-      "stdin"
+      "stdin",
+      "discovery-provider",
+      "discovery-model",
+      "validation-provider",
+      "validation-model",
+      "app-id",
+      "env",
+      "run-id",
+      "limit"
     ], credentialSet ? 5 : action === "set" ? 4 : 3);
     await adminAi({
-      action: credentialSet ? "credential-set" : credentials ? "credentials" : action,
+      action: credentialSet ? "credential-set" : credentials ? "credentials" : models ? "models" : usage ? "usage" : audit ? "audit" : action,
       purpose: action === "set" ? parsed.positionals[3] : void 0,
       provider: stringOpt(parsed.options.provider),
       model: stringOpt(parsed.options.model),
@@ -1941,12 +2225,19 @@ async function runCli(argv = process.argv.slice(2)) {
       maxOutputTokens: numberOpt(parsed.options["max-output-tokens"], "--max-output-tokens"),
       maxCallsPerRun: numberOpt(parsed.options["max-calls-per-run"], "--max-calls-per-run"),
       platform: stringOpt(parsed.options.platform),
-      token: stringOpt(parsed.options.token),
       json: parsed.options.json === true,
       open: parsed.options.open === false ? false : parsed.options.open === true ? true : void 0,
       credentialProvider: credentialSet ? parsed.positionals[4] : void 0,
       fromEnv: stringOpt(parsed.options["from-env"]),
-      stdin: parsed.options.stdin === true
+      stdin: parsed.options.stdin === true,
+      discoveryProvider: stringOpt(parsed.options["discovery-provider"]),
+      discoveryModel: stringOpt(parsed.options["discovery-model"]),
+      validationProvider: stringOpt(parsed.options["validation-provider"]),
+      validationModel: stringOpt(parsed.options["validation-model"]),
+      appId: stringOpt(parsed.options["app-id"]),
+      env: stringOpt(parsed.options.env),
+      runId: stringOpt(parsed.options["run-id"]),
+      limit: numberOpt(parsed.options.limit, "--limit")
     });
     return;
   }
@@ -1988,6 +2279,9 @@ async function runCli(argv = process.argv.slice(2)) {
           return getScopedPlatformToken({ platform: request.platform, scope: request.scope, open });
         }
         const cfg = await loadProjectConfig(configPath);
+        if (platformAudience(cfg.platformUrl) !== platformAudience(request.platform)) {
+          throw new Error("--platform cannot reuse a project developer token from another platform; update odla.config.mjs and authenticate there");
+        }
         return getDeveloperToken(cfg, { configPath, open }, fetch, console);
       }
     });