@odla-ai/cli 0.16.6 → 0.17.0

package/dist/bin.js

@@ -2,7 +2,7 @@
 import {
   exitCodeFor,
   runCli
-} from "./chunk-X3HUN6S3.js";
+} from "./chunk-2UKO2NED.js";
 
 // src/bin.ts
 runCli().catch((err) => {

package/dist/{chunk-X3HUN6S3.js → chunk-2UKO2NED.js}

@@ -1096,7 +1096,7 @@ var CAPABILITIES = {
   human: [
     "provide the existing odla account email, then sign in and explicitly review/approve the exact device code",
     "review mirrored calendar/attendee disclosure and complete the server-issued Google consent flow",
-    "consent to production changes with --yes",
+    "consent to changes against an app's live database with --yes",
     "request destructive credential rotation explicitly",
     "review application semantics, security findings, releases, and merges",
     "approve redacted-source disclosure before hosted security reasoning",
@@ -4786,6 +4786,10 @@ Usage:
   odla-ai app archive [--config odla.config.mjs] [--email <odla-account>] [--json] --yes
   odla-ai app restore [--config odla.config.mjs] [--email <odla-account>] [--json]
   odla-ai app export [--env dev] [--fresh] [--out <file>] [--email <odla-account>] [--json]
+  odla-ai app import <file|-> [--env dev] [--ns <namespace>] [--id-field <f>|--key <attr>|--generate-ids] [--dry-run] [--json] --yes
+  odla-ai app refresh-sandbox [--include-identity] [--include-files] [--dry-run] [--json] --yes
+  odla-ai app go-live         [--include-identity] [--include-files] [--dry-run] [--json] --yes
+  odla-ai app promote         [--dry-run] [--json] --yes
   odla-ai app owners list [--config odla.config.mjs] [--email <odla-account>] [--json]
   odla-ai app owners add <email> [--email <odla-account>] [--json]
   odla-ai app owners remove <email> [--email <odla-account>] [--json]
@@ -4822,17 +4826,29 @@ Commands:
   init         Create a generic odla.config.mjs plus starter schema/rules files.
   doctor       Validate and summarize the project config without network calls.
   calendar     Inspect, connect, or disconnect the live Google booking connection.
-  app          Archive (suspend, data retained), restore, export, or manage the
-               co-owners of the app. Archiving takes every environment's data
-               plane down until restored; permanent deletion has NO CLI \u2014 it
-               requires a signed-in owner in Studio, and no machine or agent
-               credential can purge. "app export" downloads a portable
-               gzipped-JSONL snapshot of one environment's database (--fresh
-               takes a new snapshot first) \u2014 your data is always yours to take.
+  app          Archive (suspend, data retained), restore, export, import, or
+               manage the co-owners of the app. Archiving takes every
+               environment's data plane down until restored; permanent deletion
+               has NO CLI \u2014 it requires a signed-in owner in Studio, and no
+               machine or agent credential can purge. "app export" downloads a
+               portable gzipped-JSONL snapshot of one database (--fresh takes a
+               new snapshot first) \u2014 your data is always yours to take.
+               "app import" upserts rows back in from JSON, JSONL, or a
+               {namespace: rows} map (the shape a query returns); it writes only
+               with --yes, so the bare command is a dry run, and it refuses to
+               guess an id mode that would duplicate rows on a re-run.
+               "app refresh-sandbox" replaces the sandbox with a copy of live
+               (the routine dev loop); "app go-live" copies the sandbox into an
+               EMPTY live database, once, at launch; "app promote" pushes only
+               schema, rules and gates up afterwards, leaving live's rows alone.
+               Each prints its plan and writes nothing without --yes, so the
+               bare command is the dry run. Clerk config, triggers, allowlists,
+               secrets and API keys never travel; identity rows stay behind
+               unless --include-identity.
                "app owners add <email>" grants a signed-up odla member the SAME
                full access as you; they then run their own "provision" to mint
-               their own credentials for the shared db (prod included) \u2014 no
-               secret is ever copied between people.
+               their own credentials for the shared db (the live one included)
+               \u2014 no secret is ever copied between people.
   capabilities Show what the CLI automates vs agent edits and human checkpoints.
   code         Enroll this Mac/Linux host for the current Studio-connected repository and run Pi.
   admin        Manage platform-funded AI routing/credentials/usage with narrow device grants.
@@ -4847,8 +4863,11 @@ Commands:
   version      Print the CLI version.
 
 Safety:
-  New projects target dev only. Add prod explicitly to odla.config.mjs and pass
-  --yes to provision it; use --dry-run first to inspect the resolved plan.
+  Every app has two databases on odla.ai: a sandbox (env "dev", tenant
+  <appId>--dev) and a live one (env "prod", tenant <appId>). Both are served by
+  production odla.ai \u2014 there is no separate odla to point at. New projects get
+  the sandbox only. Add "prod" explicitly to odla.config.mjs and pass --yes to
+  provision the live database; use --dry-run first to inspect the resolved plan.
   Provision caches the approved developer token and service credentials under
   .odla/ with mode 0600, and init adds those paths to .gitignore. Secret push
   preflights Wrangler before any shown-once issuance or destructive rotation.
@@ -4952,9 +4971,9 @@ async function codeConnect(options) {
   }
   const appId = requestedAppId ?? cfg?.app.id;
   const platform = (options.platform ?? cfg?.platformUrl ?? process.env.ODLA_PLATFORM_URL ?? "https://odla.ai").replace(/\/+$/, "");
-  const appEnv = options.env ?? (cfg ? cfg.envs.includes("dev") ? "dev" : cfg.envs[0] : "dev");
+  const appEnv = options.env ?? (cfg ? cfg.envs.includes("dev") ? "dev" : cfg.envs[0] : void 0);
   if (appEnv !== "dev" && appEnv !== "prod" || cfg && !cfg.envs.includes(appEnv)) {
-    throw new Error(cfg ? `Code env "${appEnv ?? ""}" must be dev or prod and declared in ${options.configPath}` : `Code env "${appEnv ?? ""}" must be dev or prod`);
+    throw new Error(cfg ? `Code env "${appEnv ?? ""}" must be dev or prod and declared in ${options.configPath}` : `Code env "${appEnv ?? ""}" must be dev or prod; pass --env explicitly when there is no ${options.configPath}`);
   }
   if (process.platform !== "darwin" && process.platform !== "linux") {
     throw new Error("odla Code hosts require macOS or Linux");
@@ -5932,7 +5951,7 @@ async function provision(options) {
   const productionEnvs = plan.envs.filter((env) => env === "prod" || env === "production");
   if (!options.dryRun && productionEnvs.length > 0 && !options.yes) {
     throw new Error(
-      `refusing to provision production env ${productionEnvs.join(", ")} without --yes; run --dry-run first`
+      `refusing to provision the live database (env ${productionEnvs.join(", ")}) without --yes; run --dry-run first`
     );
   }
   const database = await resolveDatabaseConfig(cfg);
@@ -6957,13 +6976,37 @@ async function adminCommand(parsed) {
 import { createWriteStream } from "fs";
 import { Readable } from "stream";
 import { pipeline } from "stream/promises";
+
+// src/tenant.ts
+import { tenantIdFor as tenantIdFor5 } from "@odla-ai/apps";
+function resolveEnv(cfg, requested) {
+  const env = requested ?? (cfg.envs.includes("dev") ? "dev" : cfg.envs[0]);
+  if (!env || !cfg.envs.includes(env)) {
+    throw new Error(`env "${env ?? ""}" is not declared in ${cfg.configPath}`);
+  }
+  return env;
+}
+function resolveTenant(cfg, requested) {
+  const env = resolveEnv(cfg, requested);
+  return { env, tenant: tenantIdFor5(cfg.app.id, env) };
+}
+function bothTenants(cfg) {
+  for (const env of ["dev", "prod"]) {
+    if (!cfg.envs.includes(env)) {
+      throw new Error(
+        `env "${env}" is not declared in ${cfg.configPath} \u2014 add it to \`envs\` and run \`odla-ai provision --yes\` before transferring data between environments`
+      );
+    }
+  }
+  return { sandbox: tenantIdFor5(cfg.app.id, "dev"), live: tenantIdFor5(cfg.app.id, "prod") };
+}
+
+// src/app-export.ts
 async function appExport(options) {
   const cfg = await loadProjectConfig(options.configPath);
   const out = options.stdout ?? console;
   const doFetch = options.fetch ?? fetch;
-  const env = options.env ?? (cfg.envs.includes("dev") ? "dev" : cfg.envs[0]);
-  if (!env || !cfg.envs.includes(env)) throw new Error(`env "${env ?? ""}" is not declared in ${options.configPath}`);
-  const tenant = env === "prod" ? cfg.app.id : `${cfg.app.id}--${env}`;
+  const { tenant } = resolveTenant(cfg, options.env);
   const token = await getDeveloperToken(
     cfg,
     { configPath: cfg.configPath, token: options.token, email: options.email, open: false },
@@ -6998,6 +7041,89 @@ async function appExport(options) {
   return { file, backup: newest };
 }
 
+// src/app-import.ts
+import { readFileSync as readFileSync7 } from "fs";
+import {
+  buildImportOps,
+  importMutationId,
+  parseImport,
+  planImportChunks
+} from "@odla-ai/db/import";
+function chooseIdMode(options, rows) {
+  const chosen = [options.idField && "field", options.key && "key", options.generateIds && "generate"].filter(Boolean);
+  if (chosen.length > 1) throw new Error("choose one of --id-field, --key, or --generate-ids");
+  if (options.key) return { idMode: "key" };
+  if (options.generateIds) return { idMode: "generate" };
+  if (options.idField) return { idMode: "field", idField: options.idField };
+  if (rows.length > 0 && rows.every((row) => typeof row?.id === "string" && row.id)) return { idMode: "field" };
+  throw new Error(
+    "rows have no usable `id` \u2014 pass --id-field <field> to name the id column, --key <unique-attr> to match on a unique attribute, or --generate-ids to mint new ids (which is NOT idempotent: re-running duplicates rows)"
+  );
+}
+async function appImport(options) {
+  const cfg = await loadProjectConfig(options.configPath);
+  const out = options.stdout ?? console;
+  const doFetch = options.fetch ?? fetch;
+  const { tenant } = resolveTenant(cfg, options.env);
+  const text = options.file === "-" ? (options.readStdin ?? (() => readFileSync7(0, "utf8")))() : readFileSync7(options.file, "utf8");
+  const { format, sources } = parseImport(text, options.ns);
+  if (format === "namespace-map" && options.ns) {
+    throw new Error("--ns cannot be combined with a {namespace: rows} file \u2014 the file already names each namespace");
+  }
+  if (format !== "namespace-map" && !options.ns) throw new Error("--ns is required unless the file is a {namespace: rows} map");
+  if (sources.length === 0) throw new Error(`${options.file} contains no rows`);
+  const mode = chooseIdMode(options, sources.map((s) => s.row));
+  const build = { ...mode, keyAttr: options.key };
+  const { ops, rejected, ignored } = buildImportOps(sources, build);
+  if (rejected.length > 0) {
+    const detail = rejected.slice(0, 10).map((r) => `  row ${r.index}: ${r.reason}`).join("\n");
+    const more = rejected.length > 10 ? `
+  \u2026and ${rejected.length - 10} more` : "";
+    throw new Error(`${rejected.length} row(s) cannot be imported \u2014 fix the input and re-run:
+${detail}${more}`);
+  }
+  const chunks = planImportChunks(ops);
+  const result = { tenant, rows: ops.length, chunks: chunks.length, committed: 0, duplicate: 0, txIds: [], ignored };
+  if (ignored.length > 0) out.log(`ignoring server-maintained field(s): ${ignored.join(", ")} \u2014 odla-db stamps these on write`);
+  if (options.dryRun || options.yes !== true) {
+    const why = options.dryRun ? "--dry-run" : "no --yes";
+    out.log(`${tenant}: would upsert ${ops.length} row(s) across ${chunks.length} transaction(s) \u2014 nothing written (${why})`);
+    if (options.json) out.log(JSON.stringify(result, null, 2));
+    return result;
+  }
+  const token = await getDeveloperToken(
+    cfg,
+    { configPath: cfg.configPath, token: options.token, email: options.email, open: false },
+    doFetch,
+    out
+  );
+  const runId = crypto.randomUUID();
+  const url = `${cfg.dbEndpoint}/admin/apps/${encodeURIComponent(tenant)}/transact`;
+  for (const chunk of chunks) {
+    const res = await doFetch(url, {
+      method: "POST",
+      headers: { authorization: `Bearer ${token}`, "content-type": "application/json" },
+      body: JSON.stringify({ mutationId: importMutationId(runId, chunk.index), ops: chunk.ops })
+    });
+    const body = await res.json().catch(() => ({}));
+    if (!res.ok) {
+      const code = body.error?.code ? ` (${body.error.code})` : "";
+      throw new Error(
+        `chunk ${chunk.index + 1} of ${chunks.length} failed${code}: ${body.error?.message ?? res.status}. ${result.committed} row(s) already committed; fix the input and re-run to import the rest.`
+      );
+    }
+    result.committed += chunk.ops.length;
+    if (typeof body.txId === "number") result.txIds.push(body.txId);
+    if (body.duplicate) result.duplicate++;
+  }
+  if (options.json) out.log(JSON.stringify(result, null, 2));
+  else {
+    const dup = result.duplicate > 0 ? ` (${result.duplicate} chunk(s) were already applied)` : "";
+    out.log(`${tenant}: upserted ${result.committed} row(s) in ${chunks.length} transaction(s)${dup}`);
+  }
+  return result;
+}
+
 // src/app-owners.ts
 var sink = (options) => options.stdout ?? console;
 async function ownersRequest(method, suffix, options, body) {
@@ -7085,6 +7211,133 @@ async function appOwnersCommand(parsed, dependencies = {}) {
   );
 }
 
+// src/app-transfer.ts
+function endpointsFor(verb, tenants) {
+  const up = { source: tenants.sandbox, target: tenants.live, from: "dev" };
+  const down = { source: tenants.live, target: tenants.sandbox, from: "prod" };
+  if (verb === "refresh-sandbox") return { ...down, mode: "refresh" };
+  return { ...up, mode: "cutover" };
+}
+async function api(cfg, token, path, init, doFetch) {
+  const res = await doFetch(`${cfg.dbEndpoint}${path}`, {
+    ...init,
+    headers: { authorization: `Bearer ${token}`, "content-type": "application/json", ...init?.headers }
+  });
+  return { status: res.status, body: await res.json().catch(() => ({})) };
+}
+function describe(side) {
+  if (!side.exists) return "not provisioned";
+  if (side.maxTx === 0) return "empty \u2014 never written";
+  const ns = side.namespaces.length === 1 ? "1 namespace" : `${side.namespaces.length} namespaces`;
+  const identity = side.identityRows > 0 ? `, ${side.identityRows} identity row(s)` : "";
+  return `${ns} \xB7 ${side.triples} value(s) \xB7 tx ${side.maxTx}${identity}`;
+}
+function printPlan(out, verb, pre, opts) {
+  const arrow = verb === "refresh-sandbox" ? "live \u2192 sandbox" : "sandbox \u2192 live";
+  out.log(`${verb} (${arrow})`);
+  out.log(`  from  ${pre.source.tenant}  ${describe(pre.source)}`);
+  out.log(`  to    ${pre.target.tenant}  ${describe(pre.target)}`);
+  if (verb === "promote") {
+    out.log("  moves schema, rules and gates only \u2014 no rows are copied or removed");
+  } else {
+    out.log(`  ${pre.target.tenant} is REPLACED by ${pre.source.tenant}`);
+    out.log(`  stays put: ${pre.staysPut.join(", ")}`);
+    const identity = opts.includeIdentity ? "INCLUDED (--include-identity)" : `left behind: ${pre.excluded.join(", ")}`;
+    out.log(`  identity: ${identity}`);
+    out.log(`  files: ${opts.includeFiles ? "copied (--include-files)" : "not copied"}`);
+  }
+  for (const blocker of pre.blockers) out.log(`  \u2716 ${blocker.code}: ${blocker.message}`);
+}
+async function appTransfer(options) {
+  const cfg = await loadProjectConfig(options.configPath);
+  const out = options.stdout ?? console;
+  const doFetch = options.fetch ?? fetch;
+  const tenants = bothTenants(cfg);
+  const route2 = endpointsFor(options.verb, tenants);
+  const token = await getDeveloperToken(
+    cfg,
+    { configPath: cfg.configPath, token: options.token, email: options.email, open: false },
+    doFetch,
+    out
+  );
+  const pre = await api(
+    cfg,
+    token,
+    `/admin/apps/${encodeURIComponent(route2.target)}/copy-preflight?from=${route2.from}`,
+    void 0,
+    doFetch
+  );
+  if (pre.status !== 200) {
+    throw new Error(`pre-flight failed${pre.body.error?.code ? ` (${pre.body.error.code})` : ""}: ${pre.body.error?.message ?? pre.status}`);
+  }
+  const plan = pre.body;
+  printPlan(out, options.verb, plan, options);
+  if (options.verb === "go-live" && !plan.targetEmpty) {
+    throw new Error(
+      `${route2.target} already has data \u2014 go-live has already happened. Use \`odla-ai app promote --yes\` to push schema and rules, or \`odla-ai app refresh-sandbox --yes\` to pull live back down.`
+    );
+  }
+  if (plan.blockers.length > 0) throw new Error(`cannot ${options.verb}: ${plan.blockers.map((b) => b.message).join("; ")}`);
+  if (options.dryRun || options.yes !== true) {
+    out.log(`nothing written (${options.dryRun ? "--dry-run" : "no --yes"})`);
+    if (options.json) out.log(JSON.stringify(plan, null, 2));
+    return { ok: true, plan };
+  }
+  if (options.verb === "promote") {
+    const res2 = await api(
+      cfg,
+      token,
+      `/admin/apps/${encodeURIComponent(route2.target)}/promote-definitions`,
+      { method: "POST", body: JSON.stringify({ from: "dev" }) },
+      doFetch
+    );
+    if (res2.status !== 200) throw new Error(`promote failed${res2.body.error?.code ? ` (${res2.body.error.code})` : ""}: ${res2.body.error?.message ?? res2.status}`);
+    if (options.json) out.log(JSON.stringify(res2.body, null, 2));
+    else out.log(`${route2.target}: promoted ${(res2.body.applied ?? []).join(", ")}`);
+    return { ok: true, plan, result: res2.body };
+  }
+  const res = await api(
+    cfg,
+    token,
+    `/admin/apps/${encodeURIComponent(route2.target)}/copy-db`,
+    {
+      method: "POST",
+      body: JSON.stringify({
+        from: route2.from,
+        mode: route2.mode,
+        ...options.includeIdentity ? { includeUsers: true } : {},
+        ...options.includeFiles ? { includeFiles: true } : {}
+      })
+    },
+    doFetch
+  );
+  if (res.status !== 200) throw new Error(`${options.verb} failed${res.body.error?.code ? ` (${res.body.error.code})` : ""}: ${res.body.error?.message ?? res.status}`);
+  out.log(`${route2.target}: replaced from ${route2.source} (tx ${res.body.destination?.maxTx}, epoch ${res.body.destination?.epoch}) \u2014 connected clients resync automatically`);
+  if (options.includeFiles) await copyFiles(cfg, token, route2, doFetch, out);
+  if (options.json) out.log(JSON.stringify(res.body, null, 2));
+  return { ok: true, plan, result: res.body };
+}
+async function copyFiles(cfg, token, route2, doFetch, out) {
+  for (let attempt = 1; attempt <= 20; attempt++) {
+    const res = await api(
+      cfg,
+      token,
+      `/admin/apps/${encodeURIComponent(route2.target)}/copy-files`,
+      { method: "POST", body: JSON.stringify({ from: route2.from }) },
+      doFetch
+    );
+    if (res.status === 200) {
+      out.log(`${route2.target}: files copied`);
+      return;
+    }
+    if (!res.body.error?.retry) {
+      throw new Error(`file copy failed${res.body.error?.code ? ` (${res.body.error.code})` : ""}: ${res.body.error?.message ?? res.status}`);
+    }
+    out.log(`  files: bounded at attempt ${attempt}, resuming\u2026`);
+  }
+  throw new Error("file copy did not finish within 20 rounds \u2014 re-run to continue where it left off");
+}
+
 // src/app-lifecycle.ts
 async function lifecycleCall(action, options) {
   const cfg = await loadProjectConfig(options.configPath);
@@ -7146,9 +7399,48 @@ async function appCommand(parsed, dependencies = {}) {
     });
     return;
   }
+  if (sub === "refresh-sandbox" || sub === "go-live" || sub === "promote") {
+    assertArgs(parsed, ["config", "include-identity", "include-files", "dry-run", "yes", "token", "email", "json"], 2);
+    await appTransfer({
+      configPath: stringOpt(parsed.options.config) ?? "odla.config.mjs",
+      verb: sub,
+      includeIdentity: parsed.options["include-identity"] === true,
+      includeFiles: parsed.options["include-files"] === true,
+      dryRun: parsed.options["dry-run"] === true,
+      yes: parsed.options.yes === true,
+      token: stringOpt(parsed.options.token),
+      email: stringOpt(parsed.options.email),
+      json: parsed.options.json === true,
+      fetch: dependencies.fetch,
+      stdout: dependencies.stdout
+    });
+    return;
+  }
+  if (sub === "import") {
+    assertArgs(parsed, ["config", "env", "ns", "id-field", "key", "generate-ids", "dry-run", "yes", "token", "email", "json"], 3);
+    const file = parsed.positionals[2];
+    if (!file) throw new Error('app import needs a file: "odla-ai app import rows.json --ns todos --yes" (or "-" for stdin)');
+    await appImport({
+      configPath: stringOpt(parsed.options.config) ?? "odla.config.mjs",
+      file,
+      env: stringOpt(parsed.options.env),
+      ns: stringOpt(parsed.options.ns),
+      idField: stringOpt(parsed.options["id-field"]),
+      key: stringOpt(parsed.options.key),
+      generateIds: parsed.options["generate-ids"] === true,
+      dryRun: parsed.options["dry-run"] === true,
+      yes: parsed.options.yes === true,
+      token: stringOpt(parsed.options.token),
+      email: stringOpt(parsed.options.email),
+      json: parsed.options.json === true,
+      fetch: dependencies.fetch,
+      stdout: dependencies.stdout
+    });
+    return;
+  }
   if (sub !== "archive" && sub !== "restore") {
     throw new Error(
-      `unknown app subcommand "${sub ?? ""}". Try "odla-ai app archive --yes", "odla-ai app restore", "odla-ai app export", or "odla-ai app owners <list|add|remove>". (Permanent deletion has no CLI: it requires a signed-in owner in Studio.)`
+      `unknown app subcommand "${sub ?? ""}". Try "odla-ai app archive --yes", "odla-ai app restore", "odla-ai app export", "odla-ai app import <file>", "odla-ai app refresh-sandbox", "odla-ai app go-live", "odla-ai app promote", or "odla-ai app owners <list|add|remove>". (Permanent deletion has no CLI: it requires a signed-in owner in Studio.)`
     );
   }
   assertArgs(parsed, ["config", "token", "email", "yes", "json"], 2);
@@ -7910,4 +8202,4 @@ export {
   exitCodeFor,
   runCli
 };
-//# sourceMappingURL=chunk-X3HUN6S3.js.map
+//# sourceMappingURL=chunk-2UKO2NED.js.map