@odla-ai/cli 0.14.0 → 0.15.0

package/dist/index.d.cts

@@ -3,7 +3,7 @@ import { HostedSecurityJob, GitHubConnectionStatus, GitHubSecuritySource, Hosted
 export { GitHubConnectionAttempt, GitHubConnectionStatus, GitHubSecuritySource, HostedSecurityCounts, HostedSecurityCoverage, HostedSecurityIntent, HostedSecurityIntentResponse, HostedSecurityJob, HostedSecurityJobStatus, HostedSecurityPlan, HostedSecurityPlanRoute, HostedSecurityReport, HostedSecurityReportFinding, HostedSecurityRoute } from '@odla-ai/security/hosted';
 
 /** One exact platform scope obtainable through the admin device flow. */
-type ScopedPlatformScope = "platform:ai:policy:read" | "platform:ai:policy:write" | "platform:ai:credential:read" | "platform:ai:credential:write" | "platform:ai:usage:read" | "platform:ai:audit:read" | "platform:code:host:connect" | "platform:security:self";
+type ScopedPlatformScope = "platform:ai:policy:read" | "platform:ai:policy:write" | "platform:ai:credential:read" | "platform:ai:credential:write" | "platform:ai:usage:read" | "platform:ai:audit:read" | "app:code:host:connect" | "platform:code:host:connect" | "platform:security:self";
 /** Inputs for obtaining one short-lived, exact-scope platform device grant. */
 interface ScopedPlatformTokenOptions {
     platform: string;
@@ -23,10 +23,31 @@ interface ScopedPlatformTokenOptions {
 /** Obtain/cache one exact platform scope without granting ambient admin. */
 declare function getScopedPlatformToken(options: ScopedPlatformTokenOptions): Promise<string>;
 
+/** Immutable local-checkout attestation advertised by a connected terminal. */
+interface CodeLocalSourceDescriptor {
+    kind: "local_checkout";
+    repository: string;
+    headCommitSha: string;
+    trustedBaseDigest: `sha256:${string}`;
+    developerPatchDigest: `sha256:${string}`;
+    snapshotDigest: `sha256:${string}`;
+    modified: boolean;
+    fileCount: number;
+    byteCount: number;
+    capturedAt: number;
+}
+
+interface PreparedCodeLocalSource {
+    descriptor: CodeLocalSourceDescriptor;
+    trustedBaseDir: string;
+    sourceDir: string;
+    cleanup(): Promise<void>;
+}
+/** Freeze the local Git tree and exact commit base before any approval request. */
+declare function prepareCodeLocalSource(cwd: string, repository: string, readHead?: (cwd: string) => Promise<string>): Promise<PreparedCodeLocalSource>;
+
 /** Immutable, release-owned Pi adapter. No registry credential enters it. */
-declare const CODE_PI_IMAGE = "ghcr.io/cory/odla-pi-agent@sha256:713db58428bc05cb486167c5747de8fd826669c9b283ff78e0139ac194c3d058";
-/** Supported local isolation engines for an odla Code host runtime. */
-type CodeContainerEngine = "container" | "podman" | "docker";
+declare const CODE_PI_IMAGE = "ghcr.io/cory/odla-pi-agent@sha256:e7858b4f0291543171b2659b47c5d00f97acc4767cafd9b74ae5228899e0cde4";
 /** Immutable CaMeL-registered build recipe available to an agent container. */
 interface CodeBuildRule {
     id: string;
@@ -39,6 +60,12 @@ interface CodeBuildRule {
     pids?: number;
     tmpfsBytes?: number;
 }
+/** Initial dependency-free dogfood recipe. App-registered catalogs can replace
+ * this once their owner-visible registration contract exists. */
+declare const CODE_BUILD_RECIPES: readonly CodeBuildRule[];
+
+/** Supported local isolation engines for an odla Code host runtime. */
+type CodeContainerEngine = "container" | "podman" | "docker";
 /** Bounded host facts reported on each outbound Code control-plane heartbeat. */
 interface CodeHostCapabilities {
     protocolVersion: 1;
@@ -47,10 +74,16 @@ interface CodeHostCapabilities {
     engines: CodeContainerEngine[];
     cpuCount: number;
     memoryBytes: number;
+    source: CodeLocalSourceDescriptor;
+    images: {
+        ready: true;
+        pi: string;
+        recipes: Array<{
+            id: string;
+            image: string;
+        }>;
+    };
 }
-/** Initial CaMeL-registered clean-build rule. App-specific recipes can replace
- * this only after their own owner-visible registration flow exists. */
-declare const CODE_BUILD_RECIPES: readonly CodeBuildRule[];
 type Output$1 = Pick<typeof console, "log" | "error">;
 /** Inputs for enrolling the current checkout and running its foreground Pi host. */
 interface CodeConnectOptions {
@@ -58,6 +91,10 @@ interface CodeConnectOptions {
     /** Repository root. Defaults to the current directory. */
     cwd?: string;
     env?: string;
+    /** Explicit Studio control-plane origin; overrides config and environment. */
+    platform?: string;
+    /** Explicit app target; useful before or without odla.config.mjs. */
+    appId?: string;
     email?: string;
     open?: boolean;
     name?: string;
@@ -75,6 +112,9 @@ interface CodeConnectOptions {
     selectEngine?: (requested: CodeContainerEngine | "auto") => Promise<CodeContainerEngine>;
     runRuntime?: (input: CodeRuntimeInput) => Promise<void>;
     readGitOrigin?: (cwd: string) => Promise<string>;
+    readGitHead?: (cwd: string) => Promise<string>;
+    prepareImages?: (engine: CodeContainerEngine, images: readonly string[]) => Promise<void>;
+    prepareLocalSource?: typeof prepareCodeLocalSource;
 }
 /** Authority and runtime boundaries used after a Code host enrollment succeeds. */
 interface CodeRuntimeInput {
@@ -87,6 +127,11 @@ interface CodeRuntimeInput {
     signal?: AbortSignal;
     stdout: Output$1;
     fetch?: typeof fetch;
+    localSource?: {
+        descriptor: CodeLocalSourceDescriptor;
+        trustedBaseDir: string;
+        sourceDir: string;
+    };
 }
 /** Enroll this machine from an odla project and keep the embedded Pi runtime
  * online. Both the approval grant and host credential hashes are stored in
@@ -748,8 +793,9 @@ interface HostedSecurityRequestOptions {
 interface ConnectGitHubSecuritySourceOptions extends HostedSecurityRequestOptions {
     appId: string;
     env: string;
-    /** Exact owner/name repository requested before GitHub approval. */
-    repository: string;
+    /** Optional owner/name cross-check. The server always scans the app's one
+     * Studio-connected repository; a mismatch fails the connect. */
+    repository?: string;
     /** false prints but does not launch the install URL. Defaults to true. */
     open?: boolean;
     openInstallUrl?: (url: string) => Promise<void>;
@@ -932,4 +978,4 @@ declare function installSkill(options?: SkillInstallOptions): SkillInstallResult
  */
 declare function smoke(options: SmokeOptions): Promise<void>;
 
-export { AGENT_HARNESSES, type AdminAiOptions, type AgentHarness, type AgentHarnessSelector, type AvailableGoogleCalendar, CAPABILITIES, CODE_BUILD_RECIPES, CODE_PI_IMAGE, type CalendarConfig, type CalendarConnectionState, type CalendarLifecycleOptions, type CalendarServiceConfig, type CalendarStatus, type CliDependencies, type CodeBuildRule, type CodeConnectOptions, type CodeContainerEngine, type CodeHostCapabilities, type CodeRuntimeInput, type ConnectGitHubSecuritySourceOptions, type DisconnectGitHubSecuritySourceOptions, type FollowHostedSecurityJobOptions, GOOGLE_CALENDAR_EVENTS_SCOPE, type GetHostedSecurityIntentOptions, type GetHostedSecurityJobOptions, type GoogleCalendarConfig, type HarnessInstallResult, type HostedSecurityProfile, type HostedSecurityResult, type HostedSecurityTokenRequest, type IntegrationProbe, type IntegrationSeed, type ListGitHubSecuritySourcesOptions, type ListHostedSecurityJobsOptions, type LoadedProjectConfig, type LocalCredentials, type OdlaIntegration, type OdlaProjectConfig, type ProvisionOptions, type ProvisionPlan, type RunHostedSecurityOptions, SYSTEM_AI_PURPOSES, type ScopedPlatformTokenOptions, type SecretsPushOptions, type SecretsSetOptions, type SkillInstallOptions, type SkillInstallResult, type SmokeOptions, type StartHostedSecurityJobOptions, type SystemAiPurpose, adminAi, calendarBookingPageUrl, calendarCalendars, calendarConnect, calendarDisconnect, calendarServiceConfig, calendarStatus, codeConnect, connectGitHubSecuritySource, disconnectGitHubSecuritySource, doctor, exitCodeFor, followHostedSecurityJob, getHostedSecurityIntent, getHostedSecurityJob, getHostedSecurityPlan, getHostedSecurityReport, getScopedPlatformToken, inferGitHubRepository, initProject, installSkill, isTerminalHostedSecurityStatus, listGitHubSecuritySources, listHostedSecurityJobs, printCapabilities, provision, redactSecrets, repositoryFromGitRemote, runCli, runCodeRuntime, runHostedSecurity, secretsPush, secretsSet, secretsSetClerkKey, smoke, startHostedSecurityJob };
+export { AGENT_HARNESSES, type AdminAiOptions, type AgentHarness, type AgentHarnessSelector, type AvailableGoogleCalendar, CAPABILITIES, CODE_BUILD_RECIPES, CODE_PI_IMAGE, type CalendarConfig, type CalendarConnectionState, type CalendarLifecycleOptions, type CalendarServiceConfig, type CalendarStatus, type CliDependencies, type CodeBuildRule, type CodeConnectOptions, type CodeContainerEngine, type CodeHostCapabilities, type CodeLocalSourceDescriptor, type CodeRuntimeInput, type ConnectGitHubSecuritySourceOptions, type DisconnectGitHubSecuritySourceOptions, type FollowHostedSecurityJobOptions, GOOGLE_CALENDAR_EVENTS_SCOPE, type GetHostedSecurityIntentOptions, type GetHostedSecurityJobOptions, type GoogleCalendarConfig, type HarnessInstallResult, type HostedSecurityProfile, type HostedSecurityResult, type HostedSecurityTokenRequest, type IntegrationProbe, type IntegrationSeed, type ListGitHubSecuritySourcesOptions, type ListHostedSecurityJobsOptions, type LoadedProjectConfig, type LocalCredentials, type OdlaIntegration, type OdlaProjectConfig, type ProvisionOptions, type ProvisionPlan, type RunHostedSecurityOptions, SYSTEM_AI_PURPOSES, type ScopedPlatformTokenOptions, type SecretsPushOptions, type SecretsSetOptions, type SkillInstallOptions, type SkillInstallResult, type SmokeOptions, type StartHostedSecurityJobOptions, type SystemAiPurpose, adminAi, calendarBookingPageUrl, calendarCalendars, calendarConnect, calendarDisconnect, calendarServiceConfig, calendarStatus, codeConnect, connectGitHubSecuritySource, disconnectGitHubSecuritySource, doctor, exitCodeFor, followHostedSecurityJob, getHostedSecurityIntent, getHostedSecurityJob, getHostedSecurityPlan, getHostedSecurityReport, getScopedPlatformToken, inferGitHubRepository, initProject, installSkill, isTerminalHostedSecurityStatus, listGitHubSecuritySources, listHostedSecurityJobs, printCapabilities, provision, redactSecrets, repositoryFromGitRemote, runCli, runCodeRuntime, runHostedSecurity, secretsPush, secretsSet, secretsSetClerkKey, smoke, startHostedSecurityJob };

package/dist/index.d.ts

@@ -3,7 +3,7 @@ import { HostedSecurityJob, GitHubConnectionStatus, GitHubSecuritySource, Hosted
 export { GitHubConnectionAttempt, GitHubConnectionStatus, GitHubSecuritySource, HostedSecurityCounts, HostedSecurityCoverage, HostedSecurityIntent, HostedSecurityIntentResponse, HostedSecurityJob, HostedSecurityJobStatus, HostedSecurityPlan, HostedSecurityPlanRoute, HostedSecurityReport, HostedSecurityReportFinding, HostedSecurityRoute } from '@odla-ai/security/hosted';
 
 /** One exact platform scope obtainable through the admin device flow. */
-type ScopedPlatformScope = "platform:ai:policy:read" | "platform:ai:policy:write" | "platform:ai:credential:read" | "platform:ai:credential:write" | "platform:ai:usage:read" | "platform:ai:audit:read" | "platform:code:host:connect" | "platform:security:self";
+type ScopedPlatformScope = "platform:ai:policy:read" | "platform:ai:policy:write" | "platform:ai:credential:read" | "platform:ai:credential:write" | "platform:ai:usage:read" | "platform:ai:audit:read" | "app:code:host:connect" | "platform:code:host:connect" | "platform:security:self";
 /** Inputs for obtaining one short-lived, exact-scope platform device grant. */
 interface ScopedPlatformTokenOptions {
     platform: string;
@@ -23,10 +23,31 @@ interface ScopedPlatformTokenOptions {
 /** Obtain/cache one exact platform scope without granting ambient admin. */
 declare function getScopedPlatformToken(options: ScopedPlatformTokenOptions): Promise<string>;
 
+/** Immutable local-checkout attestation advertised by a connected terminal. */
+interface CodeLocalSourceDescriptor {
+    kind: "local_checkout";
+    repository: string;
+    headCommitSha: string;
+    trustedBaseDigest: `sha256:${string}`;
+    developerPatchDigest: `sha256:${string}`;
+    snapshotDigest: `sha256:${string}`;
+    modified: boolean;
+    fileCount: number;
+    byteCount: number;
+    capturedAt: number;
+}
+
+interface PreparedCodeLocalSource {
+    descriptor: CodeLocalSourceDescriptor;
+    trustedBaseDir: string;
+    sourceDir: string;
+    cleanup(): Promise<void>;
+}
+/** Freeze the local Git tree and exact commit base before any approval request. */
+declare function prepareCodeLocalSource(cwd: string, repository: string, readHead?: (cwd: string) => Promise<string>): Promise<PreparedCodeLocalSource>;
+
 /** Immutable, release-owned Pi adapter. No registry credential enters it. */
-declare const CODE_PI_IMAGE = "ghcr.io/cory/odla-pi-agent@sha256:713db58428bc05cb486167c5747de8fd826669c9b283ff78e0139ac194c3d058";
-/** Supported local isolation engines for an odla Code host runtime. */
-type CodeContainerEngine = "container" | "podman" | "docker";
+declare const CODE_PI_IMAGE = "ghcr.io/cory/odla-pi-agent@sha256:e7858b4f0291543171b2659b47c5d00f97acc4767cafd9b74ae5228899e0cde4";
 /** Immutable CaMeL-registered build recipe available to an agent container. */
 interface CodeBuildRule {
     id: string;
@@ -39,6 +60,12 @@ interface CodeBuildRule {
     pids?: number;
     tmpfsBytes?: number;
 }
+/** Initial dependency-free dogfood recipe. App-registered catalogs can replace
+ * this once their owner-visible registration contract exists. */
+declare const CODE_BUILD_RECIPES: readonly CodeBuildRule[];
+
+/** Supported local isolation engines for an odla Code host runtime. */
+type CodeContainerEngine = "container" | "podman" | "docker";
 /** Bounded host facts reported on each outbound Code control-plane heartbeat. */
 interface CodeHostCapabilities {
     protocolVersion: 1;
@@ -47,10 +74,16 @@ interface CodeHostCapabilities {
     engines: CodeContainerEngine[];
     cpuCount: number;
     memoryBytes: number;
+    source: CodeLocalSourceDescriptor;
+    images: {
+        ready: true;
+        pi: string;
+        recipes: Array<{
+            id: string;
+            image: string;
+        }>;
+    };
 }
-/** Initial CaMeL-registered clean-build rule. App-specific recipes can replace
- * this only after their own owner-visible registration flow exists. */
-declare const CODE_BUILD_RECIPES: readonly CodeBuildRule[];
 type Output$1 = Pick<typeof console, "log" | "error">;
 /** Inputs for enrolling the current checkout and running its foreground Pi host. */
 interface CodeConnectOptions {
@@ -58,6 +91,10 @@ interface CodeConnectOptions {
     /** Repository root. Defaults to the current directory. */
     cwd?: string;
     env?: string;
+    /** Explicit Studio control-plane origin; overrides config and environment. */
+    platform?: string;
+    /** Explicit app target; useful before or without odla.config.mjs. */
+    appId?: string;
     email?: string;
     open?: boolean;
     name?: string;
@@ -75,6 +112,9 @@ interface CodeConnectOptions {
     selectEngine?: (requested: CodeContainerEngine | "auto") => Promise<CodeContainerEngine>;
     runRuntime?: (input: CodeRuntimeInput) => Promise<void>;
     readGitOrigin?: (cwd: string) => Promise<string>;
+    readGitHead?: (cwd: string) => Promise<string>;
+    prepareImages?: (engine: CodeContainerEngine, images: readonly string[]) => Promise<void>;
+    prepareLocalSource?: typeof prepareCodeLocalSource;
 }
 /** Authority and runtime boundaries used after a Code host enrollment succeeds. */
 interface CodeRuntimeInput {
@@ -87,6 +127,11 @@ interface CodeRuntimeInput {
     signal?: AbortSignal;
     stdout: Output$1;
     fetch?: typeof fetch;
+    localSource?: {
+        descriptor: CodeLocalSourceDescriptor;
+        trustedBaseDir: string;
+        sourceDir: string;
+    };
 }
 /** Enroll this machine from an odla project and keep the embedded Pi runtime
  * online. Both the approval grant and host credential hashes are stored in
@@ -748,8 +793,9 @@ interface HostedSecurityRequestOptions {
 interface ConnectGitHubSecuritySourceOptions extends HostedSecurityRequestOptions {
     appId: string;
     env: string;
-    /** Exact owner/name repository requested before GitHub approval. */
-    repository: string;
+    /** Optional owner/name cross-check. The server always scans the app's one
+     * Studio-connected repository; a mismatch fails the connect. */
+    repository?: string;
     /** false prints but does not launch the install URL. Defaults to true. */
     open?: boolean;
     openInstallUrl?: (url: string) => Promise<void>;
@@ -932,4 +978,4 @@ declare function installSkill(options?: SkillInstallOptions): SkillInstallResult
  */
 declare function smoke(options: SmokeOptions): Promise<void>;
 
-export { AGENT_HARNESSES, type AdminAiOptions, type AgentHarness, type AgentHarnessSelector, type AvailableGoogleCalendar, CAPABILITIES, CODE_BUILD_RECIPES, CODE_PI_IMAGE, type CalendarConfig, type CalendarConnectionState, type CalendarLifecycleOptions, type CalendarServiceConfig, type CalendarStatus, type CliDependencies, type CodeBuildRule, type CodeConnectOptions, type CodeContainerEngine, type CodeHostCapabilities, type CodeRuntimeInput, type ConnectGitHubSecuritySourceOptions, type DisconnectGitHubSecuritySourceOptions, type FollowHostedSecurityJobOptions, GOOGLE_CALENDAR_EVENTS_SCOPE, type GetHostedSecurityIntentOptions, type GetHostedSecurityJobOptions, type GoogleCalendarConfig, type HarnessInstallResult, type HostedSecurityProfile, type HostedSecurityResult, type HostedSecurityTokenRequest, type IntegrationProbe, type IntegrationSeed, type ListGitHubSecuritySourcesOptions, type ListHostedSecurityJobsOptions, type LoadedProjectConfig, type LocalCredentials, type OdlaIntegration, type OdlaProjectConfig, type ProvisionOptions, type ProvisionPlan, type RunHostedSecurityOptions, SYSTEM_AI_PURPOSES, type ScopedPlatformTokenOptions, type SecretsPushOptions, type SecretsSetOptions, type SkillInstallOptions, type SkillInstallResult, type SmokeOptions, type StartHostedSecurityJobOptions, type SystemAiPurpose, adminAi, calendarBookingPageUrl, calendarCalendars, calendarConnect, calendarDisconnect, calendarServiceConfig, calendarStatus, codeConnect, connectGitHubSecuritySource, disconnectGitHubSecuritySource, doctor, exitCodeFor, followHostedSecurityJob, getHostedSecurityIntent, getHostedSecurityJob, getHostedSecurityPlan, getHostedSecurityReport, getScopedPlatformToken, inferGitHubRepository, initProject, installSkill, isTerminalHostedSecurityStatus, listGitHubSecuritySources, listHostedSecurityJobs, printCapabilities, provision, redactSecrets, repositoryFromGitRemote, runCli, runCodeRuntime, runHostedSecurity, secretsPush, secretsSet, secretsSetClerkKey, smoke, startHostedSecurityJob };
+export { AGENT_HARNESSES, type AdminAiOptions, type AgentHarness, type AgentHarnessSelector, type AvailableGoogleCalendar, CAPABILITIES, CODE_BUILD_RECIPES, CODE_PI_IMAGE, type CalendarConfig, type CalendarConnectionState, type CalendarLifecycleOptions, type CalendarServiceConfig, type CalendarStatus, type CliDependencies, type CodeBuildRule, type CodeConnectOptions, type CodeContainerEngine, type CodeHostCapabilities, type CodeLocalSourceDescriptor, type CodeRuntimeInput, type ConnectGitHubSecuritySourceOptions, type DisconnectGitHubSecuritySourceOptions, type FollowHostedSecurityJobOptions, GOOGLE_CALENDAR_EVENTS_SCOPE, type GetHostedSecurityIntentOptions, type GetHostedSecurityJobOptions, type GoogleCalendarConfig, type HarnessInstallResult, type HostedSecurityProfile, type HostedSecurityResult, type HostedSecurityTokenRequest, type IntegrationProbe, type IntegrationSeed, type ListGitHubSecuritySourcesOptions, type ListHostedSecurityJobsOptions, type LoadedProjectConfig, type LocalCredentials, type OdlaIntegration, type OdlaProjectConfig, type ProvisionOptions, type ProvisionPlan, type RunHostedSecurityOptions, SYSTEM_AI_PURPOSES, type ScopedPlatformTokenOptions, type SecretsPushOptions, type SecretsSetOptions, type SkillInstallOptions, type SkillInstallResult, type SmokeOptions, type StartHostedSecurityJobOptions, type SystemAiPurpose, adminAi, calendarBookingPageUrl, calendarCalendars, calendarConnect, calendarDisconnect, calendarServiceConfig, calendarStatus, codeConnect, connectGitHubSecuritySource, disconnectGitHubSecuritySource, doctor, exitCodeFor, followHostedSecurityJob, getHostedSecurityIntent, getHostedSecurityJob, getHostedSecurityPlan, getHostedSecurityReport, getScopedPlatformToken, inferGitHubRepository, initProject, installSkill, isTerminalHostedSecurityStatus, listGitHubSecuritySources, listHostedSecurityJobs, printCapabilities, provision, redactSecrets, repositoryFromGitRemote, runCli, runCodeRuntime, runHostedSecurity, secretsPush, secretsSet, secretsSetClerkKey, smoke, startHostedSecurityJob };

package/dist/index.js

@@ -42,7 +42,7 @@ import {
   secretsSetClerkKey,
   smoke,
   startHostedSecurityJob
-} from "./chunk-3AC74CD2.js";
+} from "./chunk-E3CCYDIT.js";
 export {
   AGENT_HARNESSES,
   CAPABILITIES,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@odla-ai/cli",
-  "version": "0.14.0",
+  "version": "0.15.0",
   "description": "Agent-operable CLI for odla provisioning, calendar consent and sync lifecycle, System AI administration, Worker secrets, security jobs, and smoke checks.",
   "license": "MIT",
   "homepage": "https://odla.ai/docs/packages/cli",

package/skills/odla/references/co-owners.md

@@ -47,6 +47,13 @@ own key. Treat first-prod provision/deploy as the usual human checkpoint
 (`provision --dry-run` review, then `provision --yes --push-secrets`), and never
 rotate another owner's credentials on their behalf.
 
+## If provision says "you are not an owner"
+
+provision checks tenant admin access up front and aborts **before** anything is
+minted or written — no credential lands on disk, in the vault, or in a Worker.
+It means the registry doesn't list you as an owner yet: ask an existing owner
+to run `npx @odla-ai/cli app owners add <your-email>`, then re-run provision.
+
 ## If a co-owner loses their local key
 
 Keys are shown once and stored hashed — there is no reveal. Re-mint instead:

package/skills/odla-migrate/references/phase-2-db.md

@@ -11,8 +11,8 @@ opens the review page in interactive terminals; loading it alone is inert.
 
 ## Steps
 
-1. Require `npm view @odla-ai/cli@0.13.0 version` to succeed, then run
-   `npm i -D --save-exact @odla-ai/cli@0.13.0` and `npm i @odla-ai/db`.
+1. Require `npm view @odla-ai/cli@0.15.0 version` to succeed, then run
+   `npm i -D --save-exact @odla-ai/cli@0.15.0` and `npm i @odla-ai/db`.
 2. `npx @odla-ai/cli init --app-id <id> --name "<Name>" --env dev --services db`
    Review `odla.config.mjs`. Keep `envs: ["dev"]` — prod is Phase 5. Set
    `links.dev` to the URL the Phase 1 `wrangler deploy` **actually printed** —