@odla-ai/cli 0.16.7 → 0.17.1

package/dist/index.cjs

@@ -1293,14 +1293,36 @@ function unique2(values) {
   return [...new Set(values.filter(Boolean))];
 }
 
+// src/tenant.ts
+var import_apps = require("@odla-ai/apps");
+function resolveEnv(cfg, requested) {
+  const env = requested ?? (cfg.envs.includes("dev") ? "dev" : cfg.envs[0]);
+  if (!env || !cfg.envs.includes(env)) {
+    throw new Error(`env "${env ?? ""}" is not declared in ${cfg.configPath}`);
+  }
+  return env;
+}
+function resolveTenant(cfg, requested) {
+  const env = resolveEnv(cfg, requested);
+  return { env, tenant: (0, import_apps.tenantIdFor)(cfg.app.id, env) };
+}
+function bothTenants(cfg) {
+  for (const env of ["dev", "prod"]) {
+    if (!cfg.envs.includes(env)) {
+      throw new Error(
+        `env "${env}" is not declared in ${cfg.configPath} \u2014 add it to \`envs\` and run \`odla-ai provision --yes\` before transferring data between environments`
+      );
+    }
+  }
+  return { sandbox: (0, import_apps.tenantIdFor)(cfg.app.id, "dev"), live: (0, import_apps.tenantIdFor)(cfg.app.id, "prod") };
+}
+
 // src/app-export.ts
 async function appExport(options) {
   const cfg = await loadProjectConfig(options.configPath);
   const out = options.stdout ?? console;
   const doFetch = options.fetch ?? fetch;
-  const env = options.env ?? (cfg.envs.includes("dev") ? "dev" : cfg.envs[0]);
-  if (!env || !cfg.envs.includes(env)) throw new Error(`env "${env ?? ""}" is not declared in ${options.configPath}`);
-  const tenant = env === "prod" ? cfg.app.id : `${cfg.app.id}--${env}`;
+  const { tenant } = resolveTenant(cfg, options.env);
   const token = await getDeveloperToken(
     cfg,
     { configPath: cfg.configPath, token: options.token, email: options.email, open: false },
@@ -1335,6 +1357,84 @@ async function appExport(options) {
   return { file, backup: newest };
 }
 
+// src/app-import.ts
+var import_node_fs6 = require("fs");
+var import_import = require("@odla-ai/db/import");
+function chooseIdMode(options, rows) {
+  const chosen = [options.idField && "field", options.key && "key", options.generateIds && "generate"].filter(Boolean);
+  if (chosen.length > 1) throw new Error("choose one of --id-field, --key, or --generate-ids");
+  if (options.key) return { idMode: "key" };
+  if (options.generateIds) return { idMode: "generate" };
+  if (options.idField) return { idMode: "field", idField: options.idField };
+  if (rows.length > 0 && rows.every((row) => typeof row?.id === "string" && row.id)) return { idMode: "field" };
+  throw new Error(
+    "rows have no usable `id` \u2014 pass --id-field <field> to name the id column, --key <unique-attr> to match on a unique attribute, or --generate-ids to mint new ids (which is NOT idempotent: re-running duplicates rows)"
+  );
+}
+async function appImport(options) {
+  const cfg = await loadProjectConfig(options.configPath);
+  const out = options.stdout ?? console;
+  const doFetch = options.fetch ?? fetch;
+  const { tenant } = resolveTenant(cfg, options.env);
+  const text = options.file === "-" ? (options.readStdin ?? (() => (0, import_node_fs6.readFileSync)(0, "utf8")))() : (0, import_node_fs6.readFileSync)(options.file, "utf8");
+  const { format, sources } = (0, import_import.parseImport)(text, options.ns);
+  if (format === "namespace-map" && options.ns) {
+    throw new Error("--ns cannot be combined with a {namespace: rows} file \u2014 the file already names each namespace");
+  }
+  if (format !== "namespace-map" && !options.ns) throw new Error("--ns is required unless the file is a {namespace: rows} map");
+  if (sources.length === 0) throw new Error(`${options.file} contains no rows`);
+  const mode = chooseIdMode(options, sources.map((s) => s.row));
+  const build = { ...mode, keyAttr: options.key };
+  const { ops, rejected, ignored } = (0, import_import.buildImportOps)(sources, build);
+  if (rejected.length > 0) {
+    const detail = rejected.slice(0, 10).map((r) => `  row ${r.index}: ${r.reason}`).join("\n");
+    const more = rejected.length > 10 ? `
+  \u2026and ${rejected.length - 10} more` : "";
+    throw new Error(`${rejected.length} row(s) cannot be imported \u2014 fix the input and re-run:
+${detail}${more}`);
+  }
+  const chunks = (0, import_import.planImportChunks)(ops);
+  const result = { tenant, rows: ops.length, chunks: chunks.length, committed: 0, duplicate: 0, txIds: [], ignored };
+  if (ignored.length > 0) out.log(`ignoring server-maintained field(s): ${ignored.join(", ")} \u2014 odla-db stamps these on write`);
+  if (options.dryRun || options.yes !== true) {
+    const why = options.dryRun ? "--dry-run" : "no --yes";
+    out.log(`${tenant}: would upsert ${ops.length} row(s) across ${chunks.length} transaction(s) \u2014 nothing written (${why})`);
+    if (options.json) out.log(JSON.stringify(result, null, 2));
+    return result;
+  }
+  const token = await getDeveloperToken(
+    cfg,
+    { configPath: cfg.configPath, token: options.token, email: options.email, open: false },
+    doFetch,
+    out
+  );
+  const runId = crypto.randomUUID();
+  const url = `${cfg.dbEndpoint}/admin/apps/${encodeURIComponent(tenant)}/transact`;
+  for (const chunk of chunks) {
+    const res = await doFetch(url, {
+      method: "POST",
+      headers: { authorization: `Bearer ${token}`, "content-type": "application/json" },
+      body: JSON.stringify({ mutationId: (0, import_import.importMutationId)(runId, chunk.index), ops: chunk.ops })
+    });
+    const body = await res.json().catch(() => ({}));
+    if (!res.ok) {
+      const code = body.error?.code ? ` (${body.error.code})` : "";
+      throw new Error(
+        `chunk ${chunk.index + 1} of ${chunks.length} failed${code}: ${body.error?.message ?? res.status}. ${result.committed} row(s) already committed; fix the input and re-run to import the rest.`
+      );
+    }
+    result.committed += chunk.ops.length;
+    if (typeof body.txId === "number") result.txIds.push(body.txId);
+    if (body.duplicate) result.duplicate++;
+  }
+  if (options.json) out.log(JSON.stringify(result, null, 2));
+  else {
+    const dup = result.duplicate > 0 ? ` (${result.duplicate} chunk(s) were already applied)` : "";
+    out.log(`${tenant}: upserted ${result.committed} row(s) in ${chunks.length} transaction(s)${dup}`);
+  }
+  return result;
+}
+
 // src/app-owners.ts
 var sink = (options) => options.stdout ?? console;
 async function ownersRequest(method, suffix, options, body) {
@@ -1422,6 +1522,133 @@ async function appOwnersCommand(parsed, dependencies = {}) {
   );
 }
 
+// src/app-transfer.ts
+function endpointsFor(verb, tenants) {
+  const up = { source: tenants.sandbox, target: tenants.live, from: "dev" };
+  const down = { source: tenants.live, target: tenants.sandbox, from: "prod" };
+  if (verb === "refresh-sandbox") return { ...down, mode: "refresh" };
+  return { ...up, mode: "cutover" };
+}
+async function api(cfg, token, path, init, doFetch) {
+  const res = await doFetch(`${cfg.dbEndpoint}${path}`, {
+    ...init,
+    headers: { authorization: `Bearer ${token}`, "content-type": "application/json", ...init?.headers }
+  });
+  return { status: res.status, body: await res.json().catch(() => ({})) };
+}
+function describe(side) {
+  if (!side.exists) return "not provisioned";
+  if (side.maxTx === 0) return "empty \u2014 never written";
+  const ns = side.namespaces.length === 1 ? "1 namespace" : `${side.namespaces.length} namespaces`;
+  const identity = side.identityRows > 0 ? `, ${side.identityRows} identity row(s)` : "";
+  return `${ns} \xB7 ${side.triples} value(s) \xB7 tx ${side.maxTx}${identity}`;
+}
+function printPlan(out, verb, pre, opts) {
+  const arrow = verb === "refresh-sandbox" ? "live \u2192 sandbox" : "sandbox \u2192 live";
+  out.log(`${verb} (${arrow})`);
+  out.log(`  from  ${pre.source.tenant}  ${describe(pre.source)}`);
+  out.log(`  to    ${pre.target.tenant}  ${describe(pre.target)}`);
+  if (verb === "promote") {
+    out.log("  moves schema, rules and gates only \u2014 no rows are copied or removed");
+  } else {
+    out.log(`  ${pre.target.tenant} is REPLACED by ${pre.source.tenant}`);
+    out.log(`  stays put: ${pre.staysPut.join(", ")}`);
+    const identity = opts.includeIdentity ? "INCLUDED (--include-identity)" : `left behind: ${pre.excluded.join(", ")}`;
+    out.log(`  identity: ${identity}`);
+    out.log(`  files: ${opts.includeFiles ? "copied (--include-files)" : "not copied"}`);
+  }
+  for (const blocker of pre.blockers) out.log(`  \u2716 ${blocker.code}: ${blocker.message}`);
+}
+async function appTransfer(options) {
+  const cfg = await loadProjectConfig(options.configPath);
+  const out = options.stdout ?? console;
+  const doFetch = options.fetch ?? fetch;
+  const tenants = bothTenants(cfg);
+  const route2 = endpointsFor(options.verb, tenants);
+  const token = await getDeveloperToken(
+    cfg,
+    { configPath: cfg.configPath, token: options.token, email: options.email, open: false },
+    doFetch,
+    out
+  );
+  const pre = await api(
+    cfg,
+    token,
+    `/admin/apps/${encodeURIComponent(route2.target)}/copy-preflight?from=${route2.from}`,
+    void 0,
+    doFetch
+  );
+  if (pre.status !== 200) {
+    throw new Error(`pre-flight failed${pre.body.error?.code ? ` (${pre.body.error.code})` : ""}: ${pre.body.error?.message ?? pre.status}`);
+  }
+  const plan = pre.body;
+  printPlan(out, options.verb, plan, options);
+  if (options.verb === "go-live" && !plan.targetEmpty) {
+    throw new Error(
+      `${route2.target} already has data \u2014 go-live has already happened. Use \`odla-ai app promote --yes\` to push schema and rules, or \`odla-ai app refresh-sandbox --yes\` to pull live back down.`
+    );
+  }
+  if (plan.blockers.length > 0) throw new Error(`cannot ${options.verb}: ${plan.blockers.map((b) => b.message).join("; ")}`);
+  if (options.dryRun || options.yes !== true) {
+    out.log(`nothing written (${options.dryRun ? "--dry-run" : "no --yes"})`);
+    if (options.json) out.log(JSON.stringify(plan, null, 2));
+    return { ok: true, plan };
+  }
+  if (options.verb === "promote") {
+    const res2 = await api(
+      cfg,
+      token,
+      `/admin/apps/${encodeURIComponent(route2.target)}/promote-definitions`,
+      { method: "POST", body: JSON.stringify({ from: "dev" }) },
+      doFetch
+    );
+    if (res2.status !== 200) throw new Error(`promote failed${res2.body.error?.code ? ` (${res2.body.error.code})` : ""}: ${res2.body.error?.message ?? res2.status}`);
+    if (options.json) out.log(JSON.stringify(res2.body, null, 2));
+    else out.log(`${route2.target}: promoted ${(res2.body.applied ?? []).join(", ")}`);
+    return { ok: true, plan, result: res2.body };
+  }
+  const res = await api(
+    cfg,
+    token,
+    `/admin/apps/${encodeURIComponent(route2.target)}/copy-db`,
+    {
+      method: "POST",
+      body: JSON.stringify({
+        from: route2.from,
+        mode: route2.mode,
+        ...options.includeIdentity ? { includeUsers: true } : {},
+        ...options.includeFiles ? { includeFiles: true } : {}
+      })
+    },
+    doFetch
+  );
+  if (res.status !== 200) throw new Error(`${options.verb} failed${res.body.error?.code ? ` (${res.body.error.code})` : ""}: ${res.body.error?.message ?? res.status}`);
+  out.log(`${route2.target}: replaced from ${route2.source} (tx ${res.body.destination?.maxTx}, epoch ${res.body.destination?.epoch}) \u2014 connected clients resync automatically`);
+  if (options.includeFiles) await copyFiles(cfg, token, route2, doFetch, out);
+  if (options.json) out.log(JSON.stringify(res.body, null, 2));
+  return { ok: true, plan, result: res.body };
+}
+async function copyFiles(cfg, token, route2, doFetch, out) {
+  for (let attempt = 1; attempt <= 20; attempt++) {
+    const res = await api(
+      cfg,
+      token,
+      `/admin/apps/${encodeURIComponent(route2.target)}/copy-files`,
+      { method: "POST", body: JSON.stringify({ from: route2.from }) },
+      doFetch
+    );
+    if (res.status === 200) {
+      out.log(`${route2.target}: files copied`);
+      return;
+    }
+    if (!res.body.error?.retry) {
+      throw new Error(`file copy failed${res.body.error?.code ? ` (${res.body.error.code})` : ""}: ${res.body.error?.message ?? res.status}`);
+    }
+    out.log(`  files: bounded at attempt ${attempt}, resuming\u2026`);
+  }
+  throw new Error("file copy did not finish within 20 rounds \u2014 re-run to continue where it left off");
+}
+
 // src/app-lifecycle.ts
 async function lifecycleCall(action, options) {
   const cfg = await loadProjectConfig(options.configPath);
@@ -1483,9 +1710,48 @@ async function appCommand(parsed, dependencies = {}) {
     });
     return;
   }
+  if (sub === "refresh-sandbox" || sub === "go-live" || sub === "promote") {
+    assertArgs(parsed, ["config", "include-identity", "include-files", "dry-run", "yes", "token", "email", "json"], 2);
+    await appTransfer({
+      configPath: stringOpt(parsed.options.config) ?? "odla.config.mjs",
+      verb: sub,
+      includeIdentity: parsed.options["include-identity"] === true,
+      includeFiles: parsed.options["include-files"] === true,
+      dryRun: parsed.options["dry-run"] === true,
+      yes: parsed.options.yes === true,
+      token: stringOpt(parsed.options.token),
+      email: stringOpt(parsed.options.email),
+      json: parsed.options.json === true,
+      fetch: dependencies.fetch,
+      stdout: dependencies.stdout
+    });
+    return;
+  }
+  if (sub === "import") {
+    assertArgs(parsed, ["config", "env", "ns", "id-field", "key", "generate-ids", "dry-run", "yes", "token", "email", "json"], 3);
+    const file = parsed.positionals[2];
+    if (!file) throw new Error('app import needs a file: "odla-ai app import rows.json --ns todos --yes" (or "-" for stdin)');
+    await appImport({
+      configPath: stringOpt(parsed.options.config) ?? "odla.config.mjs",
+      file,
+      env: stringOpt(parsed.options.env),
+      ns: stringOpt(parsed.options.ns),
+      idField: stringOpt(parsed.options["id-field"]),
+      key: stringOpt(parsed.options.key),
+      generateIds: parsed.options["generate-ids"] === true,
+      dryRun: parsed.options["dry-run"] === true,
+      yes: parsed.options.yes === true,
+      token: stringOpt(parsed.options.token),
+      email: stringOpt(parsed.options.email),
+      json: parsed.options.json === true,
+      fetch: dependencies.fetch,
+      stdout: dependencies.stdout
+    });
+    return;
+  }
   if (sub !== "archive" && sub !== "restore") {
     throw new Error(
-      `unknown app subcommand "${sub ?? ""}". Try "odla-ai app archive --yes", "odla-ai app restore", "odla-ai app export", or "odla-ai app owners <list|add|remove>". (Permanent deletion has no CLI: it requires a signed-in owner in Studio.)`
+      `unknown app subcommand "${sub ?? ""}". Try "odla-ai app archive --yes", "odla-ai app restore", "odla-ai app export", "odla-ai app import <file>", "odla-ai app refresh-sandbox", "odla-ai app go-live", "odla-ai app promote", or "odla-ai app owners <list|add|remove>". (Permanent deletion has no CLI: it requires a signed-in owner in Studio.)`
     );
   }
   assertArgs(parsed, ["config", "token", "email", "yes", "json"], 2);
@@ -1527,7 +1793,7 @@ var CAPABILITIES = {
   human: [
     "provide the existing odla account email, then sign in and explicitly review/approve the exact device code",
     "review mirrored calendar/attendee disclosure and complete the server-issued Google consent flow",
-    "consent to production changes with --yes",
+    "consent to changes against an app's live database with --yes",
     "request destructive credential rotation explicitly",
     "review application semantics, security findings, releases, and merges",
     "approve redacted-source disclosure before hosted security reasoning",
@@ -1992,7 +2258,7 @@ function printStatus(status, json, out) {
 }
 
 // src/code-connect.ts
-var import_node_fs7 = require("fs");
+var import_node_fs8 = require("fs");
 var import_node_os2 = require("os");
 var import_node_path5 = require("path");
 
@@ -4879,9 +5145,9 @@ var CodePiRuntimeEngine = class {
 };
 
 // src/help.ts
-var import_node_fs6 = require("fs");
+var import_node_fs7 = require("fs");
 function cliVersion() {
-  const pkg = JSON.parse((0, import_node_fs6.readFileSync)(new URL("../package.json", importMetaUrl), "utf8"));
+  const pkg = JSON.parse((0, import_node_fs7.readFileSync)(new URL("../package.json", importMetaUrl), "utf8"));
   return pkg.version ?? "unknown";
 }
 function printHelp() {
@@ -4898,6 +5164,10 @@ Usage:
   odla-ai app archive [--config odla.config.mjs] [--email <odla-account>] [--json] --yes
   odla-ai app restore [--config odla.config.mjs] [--email <odla-account>] [--json]
   odla-ai app export [--env dev] [--fresh] [--out <file>] [--email <odla-account>] [--json]
+  odla-ai app import <file|-> [--env dev] [--ns <namespace>] [--id-field <f>|--key <attr>|--generate-ids] [--dry-run] [--json] --yes
+  odla-ai app refresh-sandbox [--include-identity] [--include-files] [--dry-run] [--json] --yes
+  odla-ai app go-live         [--include-identity] [--include-files] [--dry-run] [--json] --yes
+  odla-ai app promote         [--dry-run] [--json] --yes
   odla-ai app owners list [--config odla.config.mjs] [--email <odla-account>] [--json]
   odla-ai app owners add <email> [--email <odla-account>] [--json]
   odla-ai app owners remove <email> [--email <odla-account>] [--json]
@@ -4934,17 +5204,29 @@ Commands:
   init         Create a generic odla.config.mjs plus starter schema/rules files.
   doctor       Validate and summarize the project config without network calls.
   calendar     Inspect, connect, or disconnect the live Google booking connection.
-  app          Archive (suspend, data retained), restore, export, or manage the
-               co-owners of the app. Archiving takes every environment's data
-               plane down until restored; permanent deletion has NO CLI \u2014 it
-               requires a signed-in owner in Studio, and no machine or agent
-               credential can purge. "app export" downloads a portable
-               gzipped-JSONL snapshot of one environment's database (--fresh
-               takes a new snapshot first) \u2014 your data is always yours to take.
+  app          Archive (suspend, data retained), restore, export, import, or
+               manage the co-owners of the app. Archiving takes every
+               environment's data plane down until restored; permanent deletion
+               has NO CLI \u2014 it requires a signed-in owner in Studio, and no
+               machine or agent credential can purge. "app export" downloads a
+               portable gzipped-JSONL snapshot of one database (--fresh takes a
+               new snapshot first) \u2014 your data is always yours to take.
+               "app import" upserts rows back in from JSON, JSONL, or a
+               {namespace: rows} map (the shape a query returns); it writes only
+               with --yes, so the bare command is a dry run, and it refuses to
+               guess an id mode that would duplicate rows on a re-run.
+               "app refresh-sandbox" replaces the sandbox with a copy of live
+               (the routine dev loop); "app go-live" copies the sandbox into an
+               EMPTY live database, once, at launch; "app promote" pushes only
+               schema, rules and gates up afterwards, leaving live's rows alone.
+               Each prints its plan and writes nothing without --yes, so the
+               bare command is the dry run. Clerk config, triggers, allowlists,
+               secrets and API keys never travel; identity rows stay behind
+               unless --include-identity.
                "app owners add <email>" grants a signed-up odla member the SAME
                full access as you; they then run their own "provision" to mint
-               their own credentials for the shared db (prod included) \u2014 no
-               secret is ever copied between people.
+               their own credentials for the shared db (the live one included)
+               \u2014 no secret is ever copied between people.
   capabilities Show what the CLI automates vs agent edits and human checkpoints.
   code         Enroll this Mac/Linux host for the current Studio-connected repository and run Pi.
   admin        Manage platform-funded AI routing/credentials/usage with narrow device grants.
@@ -4959,8 +5241,11 @@ Commands:
   version      Print the CLI version.
 
 Safety:
-  New projects target dev only. Add prod explicitly to odla.config.mjs and pass
-  --yes to provision it; use --dry-run first to inspect the resolved plan.
+  Every app has two databases on odla.ai: a sandbox (env "dev", tenant
+  <appId>--dev) and a live one (env "prod", tenant <appId>). Both are served by
+  production odla.ai \u2014 there is no separate odla to point at. New projects get
+  the sandbox only. Add "prod" explicitly to odla.config.mjs and pass --yes to
+  provision the live database; use --dry-run first to inspect the resolved plan.
   Provision caches the approved developer token and service credentials under
   .odla/ with mode 0600, and init adds those paths to .gitignore. Secret push
   preflights Wrangler before any shown-once issuance or destructive rotation.
@@ -5375,7 +5660,7 @@ async function buildEmbeddedPiImage(engine, image, run) {
 async function codeConnect(options) {
   const cwd = options.cwd ?? process.cwd();
   const configPath = (0, import_node_path5.resolve)(cwd, options.configPath);
-  const cfg = (0, import_node_fs7.existsSync)(configPath) ? await loadProjectConfig(configPath) : null;
+  const cfg = (0, import_node_fs8.existsSync)(configPath) ? await loadProjectConfig(configPath) : null;
   const requestedAppId = options.appId?.trim();
   if (requestedAppId && !/^[a-z0-9][a-z0-9-]{1,62}$/.test(requestedAppId)) {
     throw new Error("--app-id must be a valid odla app id");
@@ -5385,9 +5670,9 @@ async function codeConnect(options) {
   }
   const appId = requestedAppId ?? cfg?.app.id;
   const platform = (options.platform ?? cfg?.platformUrl ?? process.env.ODLA_PLATFORM_URL ?? "https://odla.ai").replace(/\/+$/, "");
-  const appEnv = options.env ?? (cfg ? cfg.envs.includes("dev") ? "dev" : cfg.envs[0] : "dev");
+  const appEnv = options.env ?? (cfg ? cfg.envs.includes("dev") ? "dev" : cfg.envs[0] : void 0);
   if (appEnv !== "dev" && appEnv !== "prod" || cfg && !cfg.envs.includes(appEnv)) {
-    throw new Error(cfg ? `Code env "${appEnv ?? ""}" must be dev or prod and declared in ${options.configPath}` : `Code env "${appEnv ?? ""}" must be dev or prod`);
+    throw new Error(cfg ? `Code env "${appEnv ?? ""}" must be dev or prod and declared in ${options.configPath}` : `Code env "${appEnv ?? ""}" must be dev or prod; pass --env explicitly when there is no ${options.configPath}`);
   }
   if (process.platform !== "darwin" && process.platform !== "linux") {
     throw new Error("odla Code hosts require macOS or Linux");
@@ -5594,12 +5879,12 @@ async function codeCommand(parsed, dependencies) {
 
 // src/doctor-checks.ts
 var import_node_child_process6 = require("child_process");
-var import_node_fs9 = require("fs");
+var import_node_fs10 = require("fs");
 var import_node_path7 = require("path");
 
 // src/wrangler.ts
 var import_node_child_process5 = require("child_process");
-var import_node_fs8 = require("fs");
+var import_node_fs9 = require("fs");
 var import_node_path6 = require("path");
 var defaultRunner = (cmd, args, opts) => new Promise((resolvePromise, reject) => {
   const child = (0, import_node_child_process5.spawn)(cmd, args, { cwd: opts?.cwd, stdio: ["pipe", "pipe", "pipe"] });
@@ -5615,14 +5900,14 @@ var WRANGLER_CONFIG_FILES = ["wrangler.jsonc", "wrangler.json", "wrangler.toml"]
 function findWranglerConfig(rootDir) {
   for (const name of WRANGLER_CONFIG_FILES) {
     const path = (0, import_node_path6.join)(rootDir, name);
-    if ((0, import_node_fs8.existsSync)(path)) return path;
+    if ((0, import_node_fs9.existsSync)(path)) return path;
   }
   return null;
 }
 function readWranglerConfig(path) {
   if (path.endsWith(".toml")) return null;
   try {
-    return JSON.parse(stripJsonComments((0, import_node_fs8.readFileSync)(path, "utf8")));
+    return JSON.parse(stripJsonComments((0, import_node_fs9.readFileSync)(path, "utf8")));
   } catch {
     return null;
   }
@@ -5723,7 +6008,7 @@ function wranglerWarnings(rootDir) {
       const dir = (0, import_node_path7.resolve)(rootDir, assets.directory);
       if (dir === (0, import_node_path7.resolve)(rootDir)) {
         warnings.push(`${label}assets.directory is the project root \u2014 point it at a dedicated build dir (wrangler dev fails with "spawn EBADF")`);
-      } else if ((0, import_node_fs9.existsSync)((0, import_node_path7.join)(dir, "node_modules"))) {
+      } else if ((0, import_node_fs10.existsSync)((0, import_node_path7.join)(dir, "node_modules"))) {
         warnings.push(`${label}assets.directory contains node_modules \u2014 wrangler dev's watcher will exhaust file descriptors`);
       }
     }
@@ -5759,12 +6044,12 @@ function o11yProjectWarnings(rootDir) {
     return warnings;
   }
   const main = typeof config.main === "string" ? (0, import_node_path7.resolve)(rootDir, config.main) : null;
-  if (!main || !(0, import_node_fs9.existsSync)(main)) {
+  if (!main || !(0, import_node_fs10.existsSync)(main)) {
     warnings.push("cannot verify o11y Worker instrumentation \u2014 wrangler main is missing or unreadable");
   } else {
     let source = "";
     try {
-      source = (0, import_node_fs9.readFileSync)(main, "utf8");
+      source = (0, import_node_fs10.readFileSync)(main, "utf8");
     } catch {
     }
     if (!/\bwithObservability\b/.test(source)) {
@@ -5788,7 +6073,7 @@ function calendarProjectWarnings(rootDir) {
 }
 function readPackageJson(rootDir) {
   try {
-    return JSON.parse((0, import_node_fs9.readFileSync)((0, import_node_path7.join)(rootDir, "package.json"), "utf8"));
+    return JSON.parse((0, import_node_fs10.readFileSync)((0, import_node_path7.join)(rootDir, "package.json"), "utf8"));
   } catch {
     return null;
   }
@@ -5989,13 +6274,13 @@ function harnessOption(value, flag) {
 }
 
 // src/init.ts
-var import_node_fs10 = require("fs");
+var import_node_fs11 = require("fs");
 var import_node_path8 = require("path");
 function initProject(options) {
   const out = options.stdout ?? console;
   const rootDir = (0, import_node_path8.resolve)(options.rootDir ?? process.cwd());
   const configPath = (0, import_node_path8.resolve)(rootDir, options.configPath ?? "odla.config.mjs");
-  if ((0, import_node_fs10.existsSync)(configPath) && !options.force) {
+  if ((0, import_node_fs11.existsSync)(configPath) && !options.force) {
     throw new Error(`${configPath} already exists. Pass --force to overwrite.`);
   }
   if (!/^[a-z0-9][a-z0-9-]*$/.test(options.appId)) {
@@ -6005,10 +6290,10 @@ function initProject(options) {
   const services = options.services?.length ? options.services : ["db", "ai"];
   if (services.includes("calendar") && !services.includes("db")) throw new Error("--services calendar requires db");
   const aiProvider = options.aiProvider ?? "anthropic";
-  (0, import_node_fs10.mkdirSync)((0, import_node_path8.dirname)(configPath), { recursive: true });
-  (0, import_node_fs10.mkdirSync)((0, import_node_path8.resolve)(rootDir, "src/odla"), { recursive: true });
-  (0, import_node_fs10.mkdirSync)((0, import_node_path8.resolve)(rootDir, ".odla"), { recursive: true });
-  (0, import_node_fs10.writeFileSync)(configPath, configTemplate({ appId: options.appId, name: options.name, envs, services, aiProvider }));
+  (0, import_node_fs11.mkdirSync)((0, import_node_path8.dirname)(configPath), { recursive: true });
+  (0, import_node_fs11.mkdirSync)((0, import_node_path8.resolve)(rootDir, "src/odla"), { recursive: true });
+  (0, import_node_fs11.mkdirSync)((0, import_node_path8.resolve)(rootDir, ".odla"), { recursive: true });
+  (0, import_node_fs11.writeFileSync)(configPath, configTemplate({ appId: options.appId, name: options.name, envs, services, aiProvider }));
   writeIfMissing((0, import_node_path8.resolve)(rootDir, "src/odla/schema.mjs"), schemaTemplate());
   writeIfMissing((0, import_node_path8.resolve)(rootDir, "src/odla/rules.mjs"), rulesTemplate());
   ensureGitignore(rootDir);
@@ -6017,8 +6302,8 @@ function initProject(options) {
   out.log("updated .gitignore for local odla credentials");
 }
 function writeIfMissing(path, text) {
-  if ((0, import_node_fs10.existsSync)(path)) return;
-  (0, import_node_fs10.writeFileSync)(path, text);
+  if ((0, import_node_fs11.existsSync)(path)) return;
+  (0, import_node_fs11.writeFileSync)(path, text);
 }
 function configTemplate(input) {
   const calendar = input.services.includes("calendar") ? `  calendar: {
@@ -6119,7 +6404,7 @@ function relativeDisplay(path, rootDir) {
 }
 
 // src/provision.ts
-var import_apps3 = require("@odla-ai/apps");
+var import_apps4 = require("@odla-ai/apps");
 var import_ai2 = require("@odla-ai/ai");
 var import_node_process7 = __toESM(require("process"), 1);
 
@@ -6176,9 +6461,9 @@ async function responseText(res) {
 }
 
 // src/provision-credentials.ts
-var import_apps = require("@odla-ai/apps");
+var import_apps2 = require("@odla-ai/apps");
 async function provisionEnvCredentials(opts) {
-  const tenantId = (0, import_apps.tenantIdFor)(opts.cfg.app.id, opts.env);
+  const tenantId = (0, import_apps2.tenantIdFor)(opts.cfg.app.id, opts.env);
   const prior = opts.credentials?.envs[opts.env];
   let credentials = opts.credentials;
   let dbKey = opts.cfg.services.includes("db") && !opts.rotateDb ? prior?.dbKey : void 0;
@@ -6272,7 +6557,7 @@ async function safeText3(res) {
 
 // src/provision-helpers.ts
 var import_ai = require("@odla-ai/ai");
-var import_apps2 = require("@odla-ai/apps");
+var import_apps3 = require("@odla-ai/apps");
 function serviceRank(service) {
   if (service === "db") return 0;
   if (service === "calendar") return 2;
@@ -6283,7 +6568,7 @@ function defaultSecretName(provider) {
   return names[provider] ?? `${provider}_api_key`;
 }
 async function assertTenantAdminAccess(doFetch, cfg, env, token) {
-  const tenantId = (0, import_apps2.tenantIdFor)(cfg.app.id, env);
+  const tenantId = (0, import_apps3.tenantIdFor)(cfg.app.id, env);
   const res = await doFetch(`${cfg.dbEndpoint}/admin/apps/${encodeURIComponent(tenantId)}/entitlements`, {
     headers: { authorization: `Bearer ${token}` }
   });
@@ -6426,7 +6711,7 @@ async function provision(options) {
   const productionEnvs = plan.envs.filter((env) => env === "prod" || env === "production");
   if (!options.dryRun && productionEnvs.length > 0 && !options.yes) {
     throw new Error(
-      `refusing to provision production env ${productionEnvs.join(", ")} without --yes; run --dry-run first`
+      `refusing to provision the live database (env ${productionEnvs.join(", ")}) without --yes; run --dry-run first`
     );
   }
   const database = await resolveDatabaseConfig(cfg);
@@ -6474,7 +6759,7 @@ async function provision(options) {
   }
   const doFetch = options.fetch ?? fetch;
   const token = await getDeveloperToken(cfg, options, doFetch, out);
-  const apps = (0, import_apps3.createAppsClient)({ endpoint: cfg.platformUrl, token, fetcher: { fetch: doFetch } });
+  const apps = (0, import_apps4.createAppsClient)({ endpoint: cfg.platformUrl, token, fetcher: { fetch: doFetch } });
   const existing = await readRegistryApp(cfg, token, doFetch);
   if (existing) {
     out.log(`app: ${cfg.app.id} already exists`);
@@ -6518,7 +6803,7 @@ async function provision(options) {
     }
   }
   for (const env of cfg.envs) {
-    const tenantId = (0, import_apps3.tenantIdFor)(cfg.app.id, env);
+    const tenantId = (0, import_apps4.tenantIdFor)(cfg.app.id, env);
     credentials = await provisionEnvCredentials({
       cfg,
       env,
@@ -6604,7 +6889,7 @@ ${env}: credentials are already saved; retry "odla-ai secrets push --env ${env}$
 
 // src/secrets-set.ts
 var import_ai3 = require("@odla-ai/ai");
-var import_apps4 = require("@odla-ai/apps");
+var import_apps5 = require("@odla-ai/apps");
 var PROD_ENV_NAMES2 = /* @__PURE__ */ new Set(["prod", "production"]);
 async function secretsSet(options) {
   const name = (options.name ?? "").trim();
@@ -6656,7 +6941,7 @@ async function resolveVaultWrite(options) {
     throw new Error(`refusing to store a secret for "${options.env}" without --yes`);
   }
   const value = await secretInputValue(options, "secret");
-  return { cfg, tenantId: (0, import_apps4.tenantIdFor)(cfg.app.id, options.env), value, doFetch, out };
+  return { cfg, tenantId: (0, import_apps5.tenantIdFor)(cfg.app.id, options.env), value, doFetch, out };
 }
 
 // src/security-command-context.ts
@@ -7359,7 +7644,7 @@ async function securityStatus(parsed, dependencies) {
 }
 
 // src/skill.ts
-var import_node_fs11 = require("fs");
+var import_node_fs12 = require("fs");
 var import_node_os3 = require("os");
 var import_node_path10 = require("path");
 var import_node_url3 = require("url");
@@ -7437,7 +7722,7 @@ function installSkill(options = {}) {
     plans.set(target, { target, content, boundary, managedMerge });
   };
   const planSkillTree = (targetDir2, boundary = root) => {
-    for (const rel of files) plan((0, import_node_path10.join)(targetDir2, rel), (0, import_node_fs11.readFileSync)((0, import_node_path10.join)(sourceDir, rel), "utf8"), false, boundary);
+    for (const rel of files) plan((0, import_node_path10.join)(targetDir2, rel), (0, import_node_fs12.readFileSync)((0, import_node_path10.join)(sourceDir, rel), "utf8"), false, boundary);
   };
   let targetDir;
   if (options.global) {
@@ -7457,7 +7742,7 @@ function installSkill(options = {}) {
     for (const harness of harnesses) rememberTarget(harness, sharedRoot);
     if (harnesses.includes("claude")) {
       for (const skill of skillNames(files)) {
-        const canonical = (0, import_node_fs11.readFileSync)((0, import_node_path10.join)(sourceDir, skill, "SKILL.md"), "utf8");
+        const canonical = (0, import_node_fs12.readFileSync)((0, import_node_path10.join)(sourceDir, skill, "SKILL.md"), "utf8");
         plan((0, import_node_path10.join)(claudeRoot, skill, "SKILL.md"), claudeAdapter(skill, canonical));
       }
       rememberTarget("claude", claudeRoot);
@@ -7492,11 +7777,11 @@ function installSkill(options = {}) {
       conflicts.push(`${file.target} (redirected by symbolic link ${symlink})`);
       continue;
     }
-    if (!(0, import_node_fs11.existsSync)(file.target)) {
+    if (!(0, import_node_fs12.existsSync)(file.target)) {
       writtenPaths.add(file.target);
       continue;
     }
-    const current = (0, import_node_fs11.readFileSync)(file.target, "utf8");
+    const current = (0, import_node_fs12.readFileSync)(file.target, "utf8");
     if (current === file.content) {
       unchangedPaths.add(file.target);
     } else if (file.managedMerge || options.force) {
@@ -7513,9 +7798,9 @@ ${conflicts.map((f) => `  - ${f}`).join("\n")}`
     );
   }
   for (const file of plans.values()) {
-    if (!(0, import_node_fs11.existsSync)(file.target) || (0, import_node_fs11.readFileSync)(file.target, "utf8") !== file.content) {
-      (0, import_node_fs11.mkdirSync)((0, import_node_path10.dirname)(file.target), { recursive: true });
-      (0, import_node_fs11.writeFileSync)(file.target, file.content);
+    if (!(0, import_node_fs12.existsSync)(file.target) || (0, import_node_fs12.readFileSync)(file.target, "utf8") !== file.content) {
+      (0, import_node_fs12.mkdirSync)((0, import_node_path10.dirname)(file.target), { recursive: true });
+      (0, import_node_fs12.writeFileSync)(file.target, file.content);
     }
   }
   const skills = skillNames(files);
@@ -7556,9 +7841,9 @@ function normalizeHarnesses(values, global) {
 function managedFileContent(path, block, force, boundary) {
   const symlink = symlinkedComponent(boundary, path);
   if (symlink) throw new Error(`refusing to manage ${path}: symbolic link component ${symlink}`);
-  if (!(0, import_node_fs11.existsSync)(path)) return `${block}
+  if (!(0, import_node_fs12.existsSync)(path)) return `${block}
 `;
-  const current = (0, import_node_fs11.readFileSync)(path, "utf8");
+  const current = (0, import_node_fs12.readFileSync)(path, "utf8");
   const start = "<!-- odla-ai agent setup:start -->";
   const end = "<!-- odla-ai agent setup:end -->";
   const startAt = current.indexOf(start);
@@ -7587,7 +7872,7 @@ function symlinkedComponent(boundary, target) {
   for (const part of rel.split(import_node_path10.sep).filter(Boolean)) {
     current = (0, import_node_path10.join)(current, part);
     try {
-      if ((0, import_node_fs11.lstatSync)(current).isSymbolicLink()) return current;
+      if ((0, import_node_fs12.lstatSync)(current).isSymbolicLink()) return current;
     } catch (error) {
       if (error.code !== "ENOENT") throw error;
     }
@@ -7598,10 +7883,10 @@ function skillNames(files) {
   return [...new Set(files.filter((file) => /(^|[\\/])SKILL\.md$/.test(file)).map((file) => file.split(/[\\/]/)[0]))].sort();
 }
 function listFiles(dir) {
-  if (!(0, import_node_fs11.existsSync)(dir)) return [];
+  if (!(0, import_node_fs12.existsSync)(dir)) return [];
   const results = [];
   const walk = (current) => {
-    for (const entry of (0, import_node_fs11.readdirSync)(current, { withFileTypes: true })) {
+    for (const entry of (0, import_node_fs12.readdirSync)(current, { withFileTypes: true })) {
       const path = (0, import_node_path10.join)(current, entry.name);
       if (entry.isDirectory()) walk(path);
       else results.push((0, import_node_path10.relative)(dir, path));