@odla-ai/cli 0.10.1 → 0.10.2

package/README.md

@@ -29,8 +29,8 @@ For a project you keep working in, install it as a dev dependency so the
 shorter `npx odla-ai` form works and the version is pinned by your lockfile:
 
 ```bash
-npm view @odla-ai/cli@0.10.1 version
-npm i -D --save-exact @odla-ai/cli@0.10.1
+npm view @odla-ai/cli@0.10.2 version
+npm i -D --save-exact @odla-ai/cli@0.10.2
 ```
 
 ## Prerequisites
@@ -215,7 +215,7 @@ mutation-id control. Public health remains aggregate rather than per calendar.
 
 The bundled build/migration skills add a passive pre-ship gate with
 `@odla-ai/security`: after the exact-version availability check, run
-`npm i -D --save-exact @odla-ai/security@0.2.2`, then
+`npm i -D --save-exact @odla-ai/security@0.3.1`, then
 `npx odla-security scan . --profile odla --out .odla/security/pre-ship --fail-on high --fail-on-candidates critical`.
 The passive scan remains a separate binary: it makes no model calls and does
 not execute target code. After explicit redacted-source approval,
@@ -240,7 +240,7 @@ carries a bounded `Retry-After` only when the upstream supplied one. The CLI
 does not echo arbitrary response text or silently change the admin-selected
 model.
 Before installing the exact release, require
-`npm view @odla-ai/security@0.2.2 version` to succeed before installation. An
+`npm view @odla-ai/security@0.3.1 version` to succeed before installation. An
 exact-version `E404` means the release is unavailable, not that the security
 preflight passed, and does not prove the package name is absent. odla's own
 engineering environment uses an equivalent internal gate; customer projects

package/REQUIREMENTS.md

@@ -97,4 +97,6 @@ Agnacl, but none should mention or special-case Agnacl.
 - Every command must produce machine-readable enough output for an LLM to decide
   the next action from stdout alone.
 - Failures should name the exact config key or external capability missing.
-- The package must ship `llms.txt` so agents can use it without reading source.
+- The package must ship its offline skills and README so agents have the
+  operational contract without reading private source; exported TypeScript
+  declarations/JSDoc remain the version-matched programmatic reference.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@odla-ai/cli",
-  "version": "0.10.1",
+  "version": "0.10.2",
   "description": "Agent-operable CLI for odla provisioning, calendar consent and sync lifecycle, System AI administration, Worker secrets, security jobs, and smoke checks.",
   "license": "MIT",
   "homepage": "https://odla.ai/docs/packages/cli",
@@ -27,8 +27,7 @@
     "dist",
     "skills",
     "README.md",
-    "REQUIREMENTS.md",
-    "llms.txt"
+    "REQUIREMENTS.md"
   ],
   "sideEffects": false,
   "engines": {
@@ -55,14 +54,13 @@
     "typecheck": "tsc --noEmit",
     "test": "vitest run",
     "coverage": "vitest run --coverage",
-    "gen:llms": "node ../../scripts/gen-llms.mjs",
-    "prepublishOnly": "npm run build && npm run gen:llms"
+    "prepublishOnly": "npm run build"
   },
   "dependencies": {
-    "@odla-ai/ai": "^0.3.3",
-    "@odla-ai/apps": "^0.8.0",
-    "@odla-ai/db": "^0.6.3",
-    "@odla-ai/security": "^0.2.2"
+    "@odla-ai/ai": "^0.4.0",
+    "@odla-ai/apps": "^0.8.1",
+    "@odla-ai/db": "^0.6.4",
+    "@odla-ai/security": "^0.3.1"
   },
   "devDependencies": {
     "@types/node": "^22.10.0",

package/skills/odla/SKILL.md

@@ -124,5 +124,7 @@ code, paste a publishable key, run a command) — and wait for a nod.
 - `references/build.md` — the greenfield build, step by step, with the exact
   commands and what to verify at each one.
 - `references/sdks.md` — SDK cheat-sheet (what each does + minimal real usage).
-  Every installed SDK also ships `node_modules/@odla-ai/<pkg>/llms.txt` — read
-  it for the full, current API.
+  For the full, version-matched API, read the installed package's README and
+  exported TypeScript declarations/JSDoc (resolve entry points through its
+  `package.json` `exports`). Rendered references are also public at
+  `https://odla.ai/docs/packages/<pkg>`.

package/skills/odla/references/build.md

@@ -30,9 +30,10 @@ deployed-secret transfer. With o11y, install `@odla-ai/o11y`, add
 `"nodejs_compat"` to `compatibility_flags`, and wrap the entrypoint with
 `withObservability`.
 
-Each installed package's `node_modules/@odla-ai/<pkg>/llms.txt` is the full API
-contract. The npm artifacts contain everything required for this flow; private
-service source or online documentation is not setup context.
+Each installed package's README and exported TypeScript declarations/JSDoc are
+the version-matched API contract; resolve public entry points through its
+`package.json` `exports`. The npm artifacts contain everything required for
+this flow; private service source or online documentation is not setup context.
 
 ## 3. Provision  ⏸ device-code approval
 
@@ -87,12 +88,12 @@ code. Browser code uses db subscriptions under explicit rules or pure
 Install the passive harness and scan before any production secret or deploy:
 
 Before installing the exact release, first verify
-`npm view @odla-ai/security@0.2.2 version`. An exact-version `E404` means the
+`npm view @odla-ai/security@0.3.1 version`. An exact-version `E404` means the
 release is unavailable and blocks this preflight; it is not a clean scan and
 does not prove the package name is absent.
 
 ```
-npm i -D --save-exact @odla-ai/security@0.2.2
+npm i -D --save-exact @odla-ai/security@0.3.1
 npx odla-security scan . --profile odla --out .odla/security/pre-ship --fail-on high --fail-on-candidates critical
 ```
 

package/skills/odla/references/sdks.md

@@ -1,8 +1,9 @@
 # odla SDK cheat-sheet
 
-Install only what the app needs. Every package ships an `llms.txt` in
-`node_modules/@odla-ai/<pkg>/` with the full, current API — read it. Minimal
-real usage below.
+Install only what the app needs. Prefer the installed package's README and
+exported TypeScript declarations/JSDoc over training memory; resolve public
+entry points through its `package.json` `exports`. Rendered references are also
+available at `https://odla.ai/docs/packages/<pkg>`. Minimal real usage follows.
 
 ## @odla-ai/db — realtime graph database
 
@@ -99,12 +100,12 @@ Run the passive CLI in local/CI development; do not import it into the running
 Worker:
 
 Before installing the exact release, require
-`npm view @odla-ai/security@0.2.2 version` to succeed before installing it. An
+`npm view @odla-ai/security@0.3.1 version` to succeed before installing it. An
 exact-version `E404` means the release is unavailable, not that the preflight
 passed, and does not prove the package name is absent.
 
 ```
-npm i -D --save-exact @odla-ai/security@0.2.2
+npm i -D --save-exact @odla-ai/security@0.3.1
 npx odla-security scan . --profile odla --out .odla/security/pre-ship --fail-on high --fail-on-candidates critical
 ```
 

package/skills/odla-migrate/SKILL.md

@@ -121,5 +121,6 @@ On any failure, read references/troubleshooting.md before improvising.
 This installed skill and its `references/` directory are the complete migration
 runbook; do not fetch a website or private source repository to reconstruct it.
 Read only the current phase file as directed above. After `npm install`, prefer
-`node_modules/@odla-ai/*/llms.txt` over training memory for package APIs — the
-installed artifact is the version this project actually uses.
+each installed package's README and exported TypeScript declarations/JSDoc over
+training memory; resolve entry points through its `package.json` `exports`.
+Those artifacts describe the version this project actually uses.

package/skills/odla-migrate/references/phase-2-db.md

@@ -11,8 +11,8 @@ opens the review page in interactive terminals; loading it alone is inert.
 
 ## Steps
 
-1. Require `npm view @odla-ai/cli@0.10.1 version` to succeed, then run
-   `npm i -D --save-exact @odla-ai/cli@0.10.1` and `npm i @odla-ai/db`.
+1. Require `npm view @odla-ai/cli@0.10.2 version` to succeed, then run
+   `npm i -D --save-exact @odla-ai/cli@0.10.2` and `npm i @odla-ai/db`.
 2. `npx @odla-ai/cli init --app-id <id> --name "<Name>" --env dev --services db`
    Review `odla.config.mjs`. Keep `envs: ["dev"]` — prod is Phase 5. Set
    `links.dev` to the URL the Phase 1 `wrangler deploy` **actually printed** —
@@ -22,7 +22,7 @@ opens the review page in interactive terminals; loading it alone is inert.
    public-config show where the app runs. (`links.prod` is set the same way at
    Phase 5, from the prod deploy's printed URL.)
 3. STOP before touching schema: read "Porting relational code" in
-   `node_modules/@odla-ai/db/llms.txt`. The traps are silent: entity ids
+   `node_modules/@odla-ai/db/README.md`. The traps are silent: entity ids
    are not attrs (mirror an id attr), there is no NULL (omit on write,
    re-project on read), lists need explicit `order`, uniques are
    single-attr (derive composite keys), ON CONFLICT maps to `mutationId`
@@ -49,8 +49,9 @@ opens the review page in interactive terminals; loading it alone is inert.
 10. Add `/api/*` routes before the assets fall-through, using
     `init({ appId: env.ODLA_TENANT, adminToken: env.ODLA_API_KEY,
     endpoint: env.ODLA_ENDPOINT })` from `@odla-ai/db`. Read the installed
-    package's `node_modules/@odla-ai/db/llms.txt` for query, transaction, and
-    error contracts.
+    package's README and exported TypeScript declarations/JSDoc for query,
+    transaction, and error contracts. The rendered reference is at
+    `https://odla.ai/docs/packages/db` when online.
 11. `wrangler dev` + curl each route; then `npm run deploy:app:dev` and
     curl the workers.dev URL.
 

package/skills/odla-migrate/references/phase-2b-calendar.md

@@ -9,8 +9,8 @@ server-issued Google consent page. They never paste an OAuth code or token.
 
 1. Inventory the old behavior. Distinguish a public appointment-page link from
    actual event create/reschedule/cancel APIs. Do not promise more than exists.
-2. Require `npm view @odla-ai/calendar@0.1.0 version` to succeed, then install
-   `npm i --save-exact @odla-ai/calendar@0.1.0` as a runtime dependency. An
+2. Require `npm view @odla-ai/calendar@0.1.1 version` to succeed, then install
+   `npm i --save-exact @odla-ai/calendar@0.1.1` as a runtime dependency. An
    exact-version `E404` blocks this phase; do not substitute a git checkout or
    another version. Add `"calendar"` beside
    `"db"` in services and configure:

package/skills/odla-migrate/references/phase-4-ai.md

@@ -24,9 +24,10 @@ own terminal so you never see the value.
 3. `npm i @odla-ai/ai`. In the worker, use `initFromPlatform` — it reads
    provider/model from public-config (cached ~60s) and resolves the key
    from the vault at call time using only the app's db key. Provider and
-   model are switchable in Studio with no redeploy. Read
-   `node_modules/@odla-ai/ai/llms.txt` and the public platform manual for the
-   complete vault + public-config contract.
+   model are switchable in Studio with no redeploy. Read the installed
+   `node_modules/@odla-ai/ai/README.md` and exported TypeScript
+   declarations/JSDoc for the version-matched API; the rendered reference at
+   `https://odla.ai/docs/packages/ai` covers the public platform composition.
 4. Add one `/api/*` route that round-trips the model; deploy dev.
 
 ## Verification checklist

package/skills/odla-migrate/references/phase-5-cutover.md

@@ -24,10 +24,10 @@ instance, never a second Clerk app per env; final go/no-go at each step.
    `secrets push --env prod --yes` only to retry the transfer (see
    references/secrets-map.md).
 3. Build, then run the passive pre-cutover security gate:
-   first require `npm view @odla-ai/security@0.2.2 version` to succeed. An
+   first require `npm view @odla-ai/security@0.3.1 version` to succeed. An
    exact-version `E404` means the release is unavailable and blocks cutover;
    it is not a clean scan and does not prove the package name is absent. Run
-   `npm i -D --save-exact @odla-ai/security@0.2.2` followed by
+   `npm i -D --save-exact @odla-ai/security@0.3.1` followed by
    `npx odla-security scan . --profile odla --out .odla/security/pre-cutover --fail-on high --fail-on-candidates critical`.
    Review `REPORT.md`; a candidate is a lead, not confirmation, and a baseline
    requires a concrete reason, owner, and expiry.

package/skills/odla-migrate/references/troubleshooting.md

@@ -80,6 +80,6 @@ the printed `secrets push --env ...` retry and do not rotate again.
 ## Something not covered here
 
 Check, in order: `npx @odla-ai/cli doctor` output; this skill's current phase
-and troubleshooting references; then the relevant installed
-`node_modules/@odla-ai/*/llms.txt`. Do not improvise around a safety rule to
-unblock yourself — surface the blocker to the human instead.
+and troubleshooting references; then the relevant installed package README and
+exported TypeScript declarations/JSDoc. Do not improvise around a safety rule
+to unblock yourself — surface the blocker to the human instead.