@odla-ai/cli 0.6.0 → 0.7.1

package/dist/index.d.cts

@@ -10,8 +10,9 @@ import { SecurityReport, PlatformSecurityRun } from '@odla-ai/security';
  * Recognized commands: `version`/`-v`/`--version` and `help`/`-h`/`--help` print
  * and return; `init` scaffolds a project (requires `--app-id` and `--name`);
  * `doctor` validates config offline; `capabilities` prints the responsibility
- * boundary; `admin ai` reads/updates purpose-specific platform AI policies and
- * write-only credentials through a short-lived exact-scope device grant;
+ * boundary; `admin ai` reads/updates purpose-specific platform AI policies,
+ * transfers write-only credentials, and reads metadata-only attributed usage
+ * through separate short-lived exact-scope device grants;
  * `security run` performs an explicitly acknowledged, app-attributed hosted
  * reasoning pass; `provision` runs the full provision (including optional secret
  * rotation, local vars, and deployed secret push); `smoke` checks a live env;
@@ -26,15 +27,32 @@ import { SecurityReport, PlatformSecurityRun } from '@odla-ai/security';
  */
 declare function runCli(argv?: string[]): Promise<void>;
 
+/** One exact platform scope obtainable through the admin device flow. */
+type ScopedPlatformScope = "platform:ai:policy:read" | "platform:ai:policy:write" | "platform:ai:credential:read" | "platform:ai:credential:write" | "platform:ai:usage:read" | "platform:ai:audit:read" | "platform:security:self";
+/** Inputs for obtaining one short-lived, exact-scope platform device grant. */
+interface ScopedPlatformTokenOptions {
+    platform: string;
+    scope: ScopedPlatformScope;
+    open?: boolean;
+    fetch?: typeof fetch;
+    stdout?: Pick<typeof console, "log">;
+    openApprovalUrl?: (url: string) => Promise<void>;
+    tokenFile?: string;
+}
+/** Obtain/cache one exact platform scope without granting ambient admin. */
+declare function getScopedPlatformToken(options: ScopedPlatformTokenOptions): Promise<string>;
+
 /** Hosted platform purposes whose provider, model, and budgets an admin may route. */
 declare const SYSTEM_AI_PURPOSES: readonly ["o11y.triage", "security.discovery", "security.validation"];
 /** One catalog-validated, platform-funded System AI purpose. */
 type SystemAiPurpose = (typeof SYSTEM_AI_PURPOSES)[number];
-/** Inputs for one System AI read, policy update, credential-status read, or
- * write-only credential transfer. Provider values may come only from a named
- * environment variable or stdin. */
+
+/** Inputs for one System AI policy/catalog read, policy update,
+ * credential-status read, write-only credential transfer, or metadata-only
+ * usage or admin-audit read. Provider values may come only from a named environment variable
+ * or stdin. */
 interface AdminAiOptions {
-    action: "show" | "set" | "credentials" | "credential-set";
+    action: "show" | "models" | "set" | "credentials" | "credential-set" | "usage" | "audit";
     purpose?: string;
     provider?: string;
     model?: string;
@@ -53,22 +71,20 @@ interface AdminAiOptions {
     fromEnv?: string;
     stdin?: boolean;
     readStdin?: () => Promise<string>;
+    discoveryProvider?: string;
+    discoveryModel?: string;
+    validationProvider?: string;
+    validationModel?: string;
+    /** Optional metadata-only usage filters. */
+    appId?: string;
+    env?: string;
+    runId?: string;
+    limit?: number;
     /** Separate short-lived admin-token cache; never reuses the app developer-token file. */
     tokenFile?: string;
 }
-/** Inputs for obtaining one short-lived, exact-scope platform device grant. */
-interface ScopedPlatformTokenOptions {
-    platform: string;
-    scope: "platform:ai:read" | "platform:ai:write" | "platform:security:self";
-    open?: boolean;
-    fetch?: typeof fetch;
-    stdout?: Pick<typeof console, "log">;
-    openApprovalUrl?: (url: string) => Promise<void>;
-    tokenFile?: string;
-}
-/** Obtain/cache one exact platform scope without granting ambient admin. */
-declare function getScopedPlatformToken(options: ScopedPlatformTokenOptions): Promise<string>;
-/** Read or update platform-funded AI routing. Authentication is a short-lived,
+/** Read or update platform-funded AI routing and inspect attributed usage.
+ * Authentication is a short-lived,
  * explicitly scoped device grant; ordinary app developer tokens never become
  * platform admins. Credential writes accept values only from a named env var
  * or stdin, transfer them once, and never place them in argv, output, or the
@@ -78,7 +94,7 @@ declare function adminAi(options: AdminAiOptions): Promise<void>;
 /** Stable, machine-readable division of work between the CLI, coding agent,
  * human operator, and Studio. Printed by `odla-ai capabilities --json`. */
 declare const CAPABILITIES: {
-    readonly cli: readonly ["register the app and enable configured services per environment", "issue, persist, and explicitly rotate configured service credentials", "write local Worker values and push deployed Worker secrets through Wrangler stdin", "push db schema/rules and configure platform AI, auth, and deployment links", "validate config offline and smoke-test a provisioned db environment", "run app-attributed hosted security discovery and independent validation without provider keys", "let admins manage system AI routes/credentials through short-lived exact-scope approval"];
+    readonly cli: readonly ["register the app and enable configured services per environment", "issue, persist, and explicitly rotate configured service credentials", "write local Worker values and push deployed Worker secrets through Wrangler stdin", "push db schema/rules and configure platform AI, auth, and deployment links", "validate config offline and smoke-test a provisioned db environment", "run app-attributed hosted security discovery and independent validation without provider keys", "let admins manage system AI policy and credentials, inspect attributed usage, and read immutable admin changes through separate short-lived capability-only approvals"];
     readonly agent: readonly ["install and import the selected odla SDKs", "wrap the Worker with withObservability and choose useful telemetry", "make application-specific schema, rules, auth, UI, and migration decisions"];
     readonly human: readonly ["approve the odla device code and one-off third-party logins", "consent to production changes with --yes", "request destructive credential rotation explicitly", "review application semantics, security findings, releases, and merges", "approve redacted-source disclosure before hosted security reasoning"];
     readonly studio: readonly ["view telemetry and environment state", "perform manual credential recovery when the CLI's local shown-once copy is unavailable", "configure system AI purposes and view app/environment/run-attributed usage"];

package/dist/index.d.ts

@@ -10,8 +10,9 @@ import { SecurityReport, PlatformSecurityRun } from '@odla-ai/security';
  * Recognized commands: `version`/`-v`/`--version` and `help`/`-h`/`--help` print
  * and return; `init` scaffolds a project (requires `--app-id` and `--name`);
  * `doctor` validates config offline; `capabilities` prints the responsibility
- * boundary; `admin ai` reads/updates purpose-specific platform AI policies and
- * write-only credentials through a short-lived exact-scope device grant;
+ * boundary; `admin ai` reads/updates purpose-specific platform AI policies,
+ * transfers write-only credentials, and reads metadata-only attributed usage
+ * through separate short-lived exact-scope device grants;
  * `security run` performs an explicitly acknowledged, app-attributed hosted
  * reasoning pass; `provision` runs the full provision (including optional secret
  * rotation, local vars, and deployed secret push); `smoke` checks a live env;
@@ -26,15 +27,32 @@ import { SecurityReport, PlatformSecurityRun } from '@odla-ai/security';
  */
 declare function runCli(argv?: string[]): Promise<void>;
 
+/** One exact platform scope obtainable through the admin device flow. */
+type ScopedPlatformScope = "platform:ai:policy:read" | "platform:ai:policy:write" | "platform:ai:credential:read" | "platform:ai:credential:write" | "platform:ai:usage:read" | "platform:ai:audit:read" | "platform:security:self";
+/** Inputs for obtaining one short-lived, exact-scope platform device grant. */
+interface ScopedPlatformTokenOptions {
+    platform: string;
+    scope: ScopedPlatformScope;
+    open?: boolean;
+    fetch?: typeof fetch;
+    stdout?: Pick<typeof console, "log">;
+    openApprovalUrl?: (url: string) => Promise<void>;
+    tokenFile?: string;
+}
+/** Obtain/cache one exact platform scope without granting ambient admin. */
+declare function getScopedPlatformToken(options: ScopedPlatformTokenOptions): Promise<string>;
+
 /** Hosted platform purposes whose provider, model, and budgets an admin may route. */
 declare const SYSTEM_AI_PURPOSES: readonly ["o11y.triage", "security.discovery", "security.validation"];
 /** One catalog-validated, platform-funded System AI purpose. */
 type SystemAiPurpose = (typeof SYSTEM_AI_PURPOSES)[number];
-/** Inputs for one System AI read, policy update, credential-status read, or
- * write-only credential transfer. Provider values may come only from a named
- * environment variable or stdin. */
+
+/** Inputs for one System AI policy/catalog read, policy update,
+ * credential-status read, write-only credential transfer, or metadata-only
+ * usage or admin-audit read. Provider values may come only from a named environment variable
+ * or stdin. */
 interface AdminAiOptions {
-    action: "show" | "set" | "credentials" | "credential-set";
+    action: "show" | "models" | "set" | "credentials" | "credential-set" | "usage" | "audit";
     purpose?: string;
     provider?: string;
     model?: string;
@@ -53,22 +71,20 @@ interface AdminAiOptions {
     fromEnv?: string;
     stdin?: boolean;
     readStdin?: () => Promise<string>;
+    discoveryProvider?: string;
+    discoveryModel?: string;
+    validationProvider?: string;
+    validationModel?: string;
+    /** Optional metadata-only usage filters. */
+    appId?: string;
+    env?: string;
+    runId?: string;
+    limit?: number;
     /** Separate short-lived admin-token cache; never reuses the app developer-token file. */
     tokenFile?: string;
 }
-/** Inputs for obtaining one short-lived, exact-scope platform device grant. */
-interface ScopedPlatformTokenOptions {
-    platform: string;
-    scope: "platform:ai:read" | "platform:ai:write" | "platform:security:self";
-    open?: boolean;
-    fetch?: typeof fetch;
-    stdout?: Pick<typeof console, "log">;
-    openApprovalUrl?: (url: string) => Promise<void>;
-    tokenFile?: string;
-}
-/** Obtain/cache one exact platform scope without granting ambient admin. */
-declare function getScopedPlatformToken(options: ScopedPlatformTokenOptions): Promise<string>;
-/** Read or update platform-funded AI routing. Authentication is a short-lived,
+/** Read or update platform-funded AI routing and inspect attributed usage.
+ * Authentication is a short-lived,
  * explicitly scoped device grant; ordinary app developer tokens never become
  * platform admins. Credential writes accept values only from a named env var
  * or stdin, transfer them once, and never place them in argv, output, or the
@@ -78,7 +94,7 @@ declare function adminAi(options: AdminAiOptions): Promise<void>;
 /** Stable, machine-readable division of work between the CLI, coding agent,
  * human operator, and Studio. Printed by `odla-ai capabilities --json`. */
 declare const CAPABILITIES: {
-    readonly cli: readonly ["register the app and enable configured services per environment", "issue, persist, and explicitly rotate configured service credentials", "write local Worker values and push deployed Worker secrets through Wrangler stdin", "push db schema/rules and configure platform AI, auth, and deployment links", "validate config offline and smoke-test a provisioned db environment", "run app-attributed hosted security discovery and independent validation without provider keys", "let admins manage system AI routes/credentials through short-lived exact-scope approval"];
+    readonly cli: readonly ["register the app and enable configured services per environment", "issue, persist, and explicitly rotate configured service credentials", "write local Worker values and push deployed Worker secrets through Wrangler stdin", "push db schema/rules and configure platform AI, auth, and deployment links", "validate config offline and smoke-test a provisioned db environment", "run app-attributed hosted security discovery and independent validation without provider keys", "let admins manage system AI policy and credentials, inspect attributed usage, and read immutable admin changes through separate short-lived capability-only approvals"];
     readonly agent: readonly ["install and import the selected odla SDKs", "wrap the Worker with withObservability and choose useful telemetry", "make application-specific schema, rules, auth, UI, and migration decisions"];
     readonly human: readonly ["approve the odla device code and one-off third-party logins", "consent to production changes with --yes", "request destructive credential rotation explicitly", "review application semantics, security findings, releases, and merges", "approve redacted-source disclosure before hosted security reasoning"];
     readonly studio: readonly ["view telemetry and environment state", "perform manual credential recovery when the CLI's local shown-once copy is unavailable", "configure system AI purposes and view app/environment/run-attributed usage"];

package/dist/index.js

@@ -15,7 +15,7 @@ import {
   runHostedSecurity,
   secretsPush,
   smoke
-} from "./chunk-OERLHVLH.js";
+} from "./chunk-643B2AKG.js";
 export {
   AGENT_HARNESSES,
   CAPABILITIES,

package/llms.txt

@@ -31,8 +31,8 @@ For a project you keep working in, install it as a dev dependency so the
 shorter `npx odla-ai` form works and the version is pinned by your lockfile:
 
 ```bash
-npm view @odla-ai/cli@0.6.0 version
-npm i -D --save-exact @odla-ai/cli@0.6.0
+npm view @odla-ai/cli@0.7.1 version
+npm i -D --save-exact @odla-ai/cli@0.7.1
 ```
 
 ## Prerequisites
@@ -63,9 +63,12 @@ npx odla-ai smoke --env dev
 npx odla-ai secrets push --env dev
 npx odla-ai security run . --env dev --ack-redacted-source
 npx odla-ai admin ai show
-npx odla-ai admin ai set security.discovery --provider anthropic --model claude-opus-4-8 --enabled
+npx odla-ai admin ai models
+npx odla-ai admin ai set security --discovery-provider anthropic --discovery-model claude-opus-4-8 --validation-provider openai --validation-model gpt-5.5 --enabled
 npx odla-ai admin ai credentials
 npx odla-ai admin ai credential set anthropic --from-env ANTHROPIC_API_KEY
+npx odla-ai admin ai usage --app-id my-app --env prod --limit 50
+npx odla-ai admin ai audit --limit 25
 npx odla-ai skill install
 npx odla-ai version
 ```
@@ -126,29 +129,59 @@ when provisioning has not written `.odla/credentials.local.json`.
 
 The bundled build/migration skills add a passive pre-ship gate with
 `@odla-ai/security`: after the exact-version availability check, run
-`npm i -D --save-exact @odla-ai/security@0.2.0`, then
+`npm i -D --save-exact @odla-ai/security@0.2.1`, then
 `npx odla-security scan . --profile odla --out .odla/security/pre-ship --fail-on high --fail-on-candidates critical`.
 The passive scan remains a separate binary: it makes no model calls and does
 not execute target code. After explicit redacted-source approval,
 `odla-ai security run . --env dev --ack-redacted-source` adds hosted discovery
 and independent validation. The CLI obtains/reuses app-owner auth and the
 platform supplies bounded role grants; it never requests provider keys.
-Early-access run ceilings are rolling; a `429` includes the platform's safe
-retry hint, which the CLI surfaces without echoing arbitrary response text.
+The CLI schedules within those grants: recon consumes one discovery call,
+first-pass hunts are capped before retries, and validation handles the
+highest-risk candidates first. Used/skipped role calls appear in the summary
+and report. Budget-limited coverage is explicitly incomplete and still fails
+the default gate unless `--allow-incomplete` is supplied after review.
+All hosted-security network calls target the configured odla platform origin.
+The CLI transmits typed redacted security operations only and never contacts a
+model-provider host; odla.ai owns the prompts/schemas, route, credential,
+provider call, attribution, and receipt. Cached/environment tokens are bound to
+their canonical platform audience and are rejected before disclosure on a
+different origin. For a non-default platform, set the matching
+`ODLA_DEV_TOKEN_AUDIENCE` with `ODLA_DEV_TOKEN`.
+Early-access run ceilings are rolling. A platform-ceiling `429` always carries
+a conservative `Retry-After`. A provider-side `429` uses the sanitized
+`provider_rate_limited` code after the provider SDK's bounded retries and
+carries a bounded `Retry-After` only when the upstream supplied one. The CLI
+does not echo arbitrary response text or silently change the admin-selected
+model.
 Before installing the exact release, require
-`npm view @odla-ai/security@0.2.0 version` to succeed before installation. An
+`npm view @odla-ai/security@0.2.1 version` to succeed before installation. An
 exact-version `E404` means the release is unavailable, not that the security
 preflight passed, and does not prove the package name is absent. odla's own
 engineering environment uses an equivalent internal gate; customer projects
 should use the published `odla-security` command above.
 
-`admin ai show|set|credentials|credential set` manages platform-funded System
+`admin ai show|models|set|credentials|credential set|usage|audit` manages platform-funded System
 AI (`o11y.triage`, `security.discovery`, `security.validation`). It uses a
 separate, mode-`0600` `.odla/admin-token.local.json` cache. Studio displays the
 exact scope, only an admin can approve it, and it expires after ~15 minutes;
-the token never becomes ambient admin. Credential writes accept only
+policy, credential, and usage capabilities are separate and cannot act as the
+approver on ordinary app/db/o11y routes. `admin ai models` reads the server
+catalog. `admin ai set security` updates discovery and independent validation
+together with expected revisions; a concurrent edit returns 409 and reloads
+instead of being overwritten. `admin ai usage` requests its own read-only
+capability and lists metadata-only events and status aggregates; filter by
+`--app-id`, `--env`, `--run-id`, and `--limit`, or emit `--json`. Prompts,
+repository source, model output, reports, and provider credentials are never in
+that response.
+`admin ai audit` uses its own read capability for immutable, metadata-only
+policy and credential change events with actor attribution; credential values
+never enter that trail. Credential writes accept only
 `--from-env <NAME>` or `--stdin` and never place the value in argv, output, or
 the cache. System AI and each app's BYOK AI are separate vault/funding paths.
+Admin bounds can only narrow hard ceilings of 64 calls per role/run and, for
+each call, 512 KiB input and 32,768 output tokens. A non-default platform environment token
+must declare the matching `ODLA_ADMIN_TOKEN_AUDIENCE`.
 
 `secrets push --env <env>` is the narrower recovery/retry command. It moves the
 configured env's odla-db key and/or o11y ingest token from
@@ -251,7 +284,7 @@ If schema is present and rules are omitted, `defaultRules: "deny"` generates
 deny-all rules for every schema entity. That is the safe default for Workers
 that mediate reads and writes with an app key.
 
-## API reference (generated from dist/index.d.ts, v0.6.0)
+## API reference (generated from dist/index.d.ts, v0.7.1)
 
 ```ts
 import { SecurityReport, PlatformSecurityRun } from '@odla-ai/security';
@@ -266,8 +299,9 @@ import { SecurityReport, PlatformSecurityRun } from '@odla-ai/security';
  * Recognized commands: `version`/`-v`/`--version` and `help`/`-h`/`--help` print
  * and return; `init` scaffolds a project (requires `--app-id` and `--name`);
  * `doctor` validates config offline; `capabilities` prints the responsibility
- * boundary; `admin ai` reads/updates purpose-specific platform AI policies and
- * write-only credentials through a short-lived exact-scope device grant;
+ * boundary; `admin ai` reads/updates purpose-specific platform AI policies,
+ * transfers write-only credentials, and reads metadata-only attributed usage
+ * through separate short-lived exact-scope device grants;
  * `security run` performs an explicitly acknowledged, app-attributed hosted
  * reasoning pass; `provision` runs the full provision (including optional secret
  * rotation, local vars, and deployed secret push); `smoke` checks a live env;
@@ -282,15 +316,32 @@ import { SecurityReport, PlatformSecurityRun } from '@odla-ai/security';
  */
 declare function runCli(argv?: string[]): Promise<void>;
 
+/** One exact platform scope obtainable through the admin device flow. */
+type ScopedPlatformScope = "platform:ai:policy:read" | "platform:ai:policy:write" | "platform:ai:credential:read" | "platform:ai:credential:write" | "platform:ai:usage:read" | "platform:ai:audit:read" | "platform:security:self";
+/** Inputs for obtaining one short-lived, exact-scope platform device grant. */
+interface ScopedPlatformTokenOptions {
+    platform: string;
+    scope: ScopedPlatformScope;
+    open?: boolean;
+    fetch?: typeof fetch;
+    stdout?: Pick<typeof console, "log">;
+    openApprovalUrl?: (url: string) => Promise<void>;
+    tokenFile?: string;
+}
+/** Obtain/cache one exact platform scope without granting ambient admin. */
+declare function getScopedPlatformToken(options: ScopedPlatformTokenOptions): Promise<string>;
+
 /** Hosted platform purposes whose provider, model, and budgets an admin may route. */
 declare const SYSTEM_AI_PURPOSES: readonly ["o11y.triage", "security.discovery", "security.validation"];
 /** One catalog-validated, platform-funded System AI purpose. */
 type SystemAiPurpose = (typeof SYSTEM_AI_PURPOSES)[number];
-/** Inputs for one System AI read, policy update, credential-status read, or
- * write-only credential transfer. Provider values may come only from a named
- * environment variable or stdin. */
+
+/** Inputs for one System AI policy/catalog read, policy update,
+ * credential-status read, write-only credential transfer, or metadata-only
+ * usage or admin-audit read. Provider values may come only from a named environment variable
+ * or stdin. */
 interface AdminAiOptions {
-    action: "show" | "set" | "credentials" | "credential-set";
+    action: "show" | "models" | "set" | "credentials" | "credential-set" | "usage" | "audit";
     purpose?: string;
     provider?: string;
     model?: string;
@@ -309,22 +360,20 @@ interface AdminAiOptions {
     fromEnv?: string;
     stdin?: boolean;
     readStdin?: () => Promise<string>;
+    discoveryProvider?: string;
+    discoveryModel?: string;
+    validationProvider?: string;
+    validationModel?: string;
+    /** Optional metadata-only usage filters. */
+    appId?: string;
+    env?: string;
+    runId?: string;
+    limit?: number;
     /** Separate short-lived admin-token cache; never reuses the app developer-token file. */
     tokenFile?: string;
 }
-/** Inputs for obtaining one short-lived, exact-scope platform device grant. */
-interface ScopedPlatformTokenOptions {
-    platform: string;
-    scope: "platform:ai:read" | "platform:ai:write" | "platform:security:self";
-    open?: boolean;
-    fetch?: typeof fetch;
-    stdout?: Pick<typeof console, "log">;
-    openApprovalUrl?: (url: string) => Promise<void>;
-    tokenFile?: string;
-}
-/** Obtain/cache one exact platform scope without granting ambient admin. */
-declare function getScopedPlatformToken(options: ScopedPlatformTokenOptions): Promise<string>;
-/** Read or update platform-funded AI routing. Authentication is a short-lived,
+/** Read or update platform-funded AI routing and inspect attributed usage.
+ * Authentication is a short-lived,
  * explicitly scoped device grant; ordinary app developer tokens never become
  * platform admins. Credential writes accept values only from a named env var
  * or stdin, transfer them once, and never place them in argv, output, or the
@@ -334,7 +383,7 @@ declare function adminAi(options: AdminAiOptions): Promise<void>;
 /** Stable, machine-readable division of work between the CLI, coding agent,
  * human operator, and Studio. Printed by `odla-ai capabilities --json`. */
 declare const CAPABILITIES: {
-    readonly cli: readonly ["register the app and enable configured services per environment", "issue, persist, and explicitly rotate configured service credentials", "write local Worker values and push deployed Worker secrets through Wrangler stdin", "push db schema/rules and configure platform AI, auth, and deployment links", "validate config offline and smoke-test a provisioned db environment", "run app-attributed hosted security discovery and independent validation without provider keys", "let admins manage system AI routes/credentials through short-lived exact-scope approval"];
+    readonly cli: readonly ["register the app and enable configured services per environment", "issue, persist, and explicitly rotate configured service credentials", "write local Worker values and push deployed Worker secrets through Wrangler stdin", "push db schema/rules and configure platform AI, auth, and deployment links", "validate config offline and smoke-test a provisioned db environment", "run app-attributed hosted security discovery and independent validation without provider keys", "let admins manage system AI policy and credentials, inspect attributed usage, and read immutable admin changes through separate short-lived capability-only approvals"];
     readonly agent: readonly ["install and import the selected odla SDKs", "wrap the Worker with withObservability and choose useful telemetry", "make application-specific schema, rules, auth, UI, and migration decisions"];
     readonly human: readonly ["approve the odla device code and one-off third-party logins", "consent to production changes with --yes", "request destructive credential rotation explicitly", "review application semantics, security findings, releases, and merges", "approve redacted-source disclosure before hosted security reasoning"];
     readonly studio: readonly ["view telemetry and environment state", "perform manual credential recovery when the CLI's local shown-once copy is unavailable", "configure system AI purposes and view app/environment/run-attributed usage"];

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@odla-ai/cli",
-  "version": "0.6.0",
+  "version": "0.7.1",
   "description": "Agent-operable CLI for odla provisioning, scoped System AI administration, hosted security runs, Worker secrets, and smoke checks.",
   "license": "MIT",
   "homepage": "https://odla.ai/docs/packages/cli",
@@ -59,10 +59,10 @@
     "prepublishOnly": "npm run build && npm run gen:llms"
   },
   "dependencies": {
-    "@odla-ai/ai": "^0.3.1",
+    "@odla-ai/ai": "^0.3.3",
     "@odla-ai/apps": "^0.7.1",
-    "@odla-ai/db": "^0.6.1",
-    "@odla-ai/security": "^0.2.0"
+    "@odla-ai/db": "^0.6.2",
+    "@odla-ai/security": "^0.2.1"
   },
   "devDependencies": {
     "@types/node": "^22.10.0",

package/skills/odla/references/build.md

@@ -66,12 +66,12 @@ re-provision to push it, and retry.
 Install the passive harness and scan before any production secret or deploy:
 
 Before installing the exact release, first verify
-`npm view @odla-ai/security@0.2.0 version`. An exact-version `E404` means the
+`npm view @odla-ai/security@0.2.1 version`. An exact-version `E404` means the
 release is unavailable and blocks this preflight; it is not a clean scan and
 does not prove the package name is absent.
 
 ```
-npm i -D --save-exact @odla-ai/security@0.2.0
+npm i -D --save-exact @odla-ai/security@0.2.1
 npx odla-security scan . --profile odla --out .odla/security/pre-ship --fail-on high --fail-on-candidates critical
 ```
 
@@ -90,8 +90,10 @@ npx @odla-ai/cli security run . --env dev --ack-redacted-source
 Do not ask for Anthropic/OpenAI/Google keys. The CLI obtains app-owner auth;
 the platform fixes separate discovery/validation grants to the admin-configured
 routes, attributes usage to this app/env/run, and retains no source or prompts
-in its accounting ledger. If a rolling early-access ceiling returns `429`,
-surface the CLI's safe retry hint and do not loop or manufacture a provider key.
+in its accounting ledger. A rolling platform-ceiling `429` always carries a
+conservative retry hint. A provider-side `429` uses the sanitized
+`provider_rate_limited` code and carries a bounded hint only when the upstream
+supplied one. Surface either without looping or manufacturing a provider key.
 
 ## 6. Ship  ⏸ human checkpoint
 

package/skills/odla/references/sdks.md

@@ -70,12 +70,12 @@ Run the passive CLI in local/CI development; do not import it into the running
 Worker:
 
 Before installing the exact release, require
-`npm view @odla-ai/security@0.2.0 version` to succeed before installing it. An
+`npm view @odla-ai/security@0.2.1 version` to succeed before installing it. An
 exact-version `E404` means the release is unavailable, not that the preflight
 passed, and does not prove the package name is absent.
 
 ```
-npm i -D --save-exact @odla-ai/security@0.2.0
+npm i -D --save-exact @odla-ai/security@0.2.1
 npx odla-security scan . --profile odla --out .odla/security/pre-ship --fail-on high --fail-on-candidates critical
 ```
 

package/skills/odla-migrate/references/phase-2-db.md

@@ -10,8 +10,8 @@ in the browser in interactive terminals).
 
 ## Steps
 
-1. Require `npm view @odla-ai/cli@0.6.0 version` to succeed, then run
-   `npm i -D --save-exact @odla-ai/cli@0.6.0` and `npm i @odla-ai/db`.
+1. Require `npm view @odla-ai/cli@0.7.1 version` to succeed, then run
+   `npm i -D --save-exact @odla-ai/cli@0.7.1` and `npm i @odla-ai/db`.
 2. `npx @odla-ai/cli init --app-id <id> --name "<Name>" --env dev --services db`
    Review `odla.config.mjs`. Keep `envs: ["dev"]` — prod is Phase 5. Set
    `links.dev` to the URL the Phase 1 `wrangler deploy` **actually printed** —

package/skills/odla-migrate/references/phase-5-cutover.md

@@ -24,10 +24,10 @@ instance, never a second Clerk app per env; final go/no-go at each step.
    `secrets push --env prod --yes` only to retry the transfer (see
    references/secrets-map.md).
 3. Build, then run the passive pre-cutover security gate:
-   first require `npm view @odla-ai/security@0.2.0 version` to succeed. An
+   first require `npm view @odla-ai/security@0.2.1 version` to succeed. An
    exact-version `E404` means the release is unavailable and blocks cutover;
    it is not a clean scan and does not prove the package name is absent. Run
-   `npm i -D --save-exact @odla-ai/security@0.2.0` followed by
+   `npm i -D --save-exact @odla-ai/security@0.2.1` followed by
    `npx odla-security scan . --profile odla --out .odla/security/pre-cutover --fail-on high --fail-on-candidates critical`.
    Review `REPORT.md`; a candidate is a lead, not confirmation, and a baseline
    requires a concrete reason, owner, and expiry.

package/skills/odla-migrate/references/secrets-map.md

@@ -10,7 +10,7 @@
 | LLM provider key | tenant vault | env var in the HUMAN's shell for one provision run; never wrangler vars, never git, never chat |
 | `odla_sk_…` (tenant db key) | wrangler secret `ODLA_API_KEY` + `.odla/credentials.local.json` (0600) + `.dev.vars` | present when db is enabled; move it only with the pipeline below |
 | `odla_dev_…` (developer token) | `.odla/dev-token.json` (0600) | ~24h lifetime, provision-time only; never deployed |
-| scoped `odla_dev_…` (admin-approved platform action) | `.odla/admin-token.local.json` (0600) | exact visible scope, ~15m lifetime, never ambient admin or deployed |
+| scoped `odla_dev_…` (admin-approved platform capability) | `.odla/admin-token.local.json` (0600) | separate policy/credential/usage/self-audit scope, ~15m lifetime, denied on owner routes, never deployed |
 | `o11y_…` (o11y ingest token) | wrangler secret `ODLA_O11Y_TOKEN` + `.odla/credentials.local.json` (0600) + `.dev.vars` | only if the app enables o11y; provision issues/reuses it and moves it alongside the db key; never a var, never chat |
 | `ODLA_ENDPOINT` / `ODLA_TENANT` / `ODLA_PLATFORM` / `ODLA_APP_ID` / `ODLA_ENV` | wrangler `vars` | not secrets; keep them set in every env block |
 | `ODLA_O11Y_ENDPOINT` / `ODLA_O11Y_SERVICE` | `.dev.vars` from provision or optional wrangler `vars` overrides | not secrets; public ingest defaults to `https://o11y.odla.ai` and `ODLA_APP_ID` when the token is present |