@odla-ai/cli 0.14.0 → 0.14.1

package/dist/index.d.cts

@@ -748,8 +748,9 @@ interface HostedSecurityRequestOptions {
 interface ConnectGitHubSecuritySourceOptions extends HostedSecurityRequestOptions {
     appId: string;
     env: string;
-    /** Exact owner/name repository requested before GitHub approval. */
-    repository: string;
+    /** Optional owner/name cross-check. The server always scans the app's one
+     * Studio-connected repository; a mismatch fails the connect. */
+    repository?: string;
     /** false prints but does not launch the install URL. Defaults to true. */
     open?: boolean;
     openInstallUrl?: (url: string) => Promise<void>;

package/dist/index.d.ts

@@ -748,8 +748,9 @@ interface HostedSecurityRequestOptions {
 interface ConnectGitHubSecuritySourceOptions extends HostedSecurityRequestOptions {
     appId: string;
     env: string;
-    /** Exact owner/name repository requested before GitHub approval. */
-    repository: string;
+    /** Optional owner/name cross-check. The server always scans the app's one
+     * Studio-connected repository; a mismatch fails the connect. */
+    repository?: string;
     /** false prints but does not launch the install URL. Defaults to true. */
     open?: boolean;
     openInstallUrl?: (url: string) => Promise<void>;

package/dist/index.js

@@ -42,7 +42,7 @@ import {
   secretsSetClerkKey,
   smoke,
   startHostedSecurityJob
-} from "./chunk-3AC74CD2.js";
+} from "./chunk-AN6KZMR5.js";
 export {
   AGENT_HARNESSES,
   CAPABILITIES,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@odla-ai/cli",
-  "version": "0.14.0",
+  "version": "0.14.1",
   "description": "Agent-operable CLI for odla provisioning, calendar consent and sync lifecycle, System AI administration, Worker secrets, security jobs, and smoke checks.",
   "license": "MIT",
   "homepage": "https://odla.ai/docs/packages/cli",

package/skills/odla/references/co-owners.md

@@ -47,6 +47,13 @@ own key. Treat first-prod provision/deploy as the usual human checkpoint
 (`provision --dry-run` review, then `provision --yes --push-secrets`), and never
 rotate another owner's credentials on their behalf.
 
+## If provision says "you are not an owner"
+
+provision checks tenant admin access up front and aborts **before** anything is
+minted or written — no credential lands on disk, in the vault, or in a Worker.
+It means the registry doesn't list you as an owner yet: ask an existing owner
+to run `npx @odla-ai/cli app owners add <your-email>`, then re-run provision.
+
 ## If a co-owner loses their local key
 
 Keys are shown once and stored hashed — there is no reveal. Re-mint instead: