@odla-ai/cli 0.27.10 → 0.27.11

package/dist/bin.cjs

@@ -2697,7 +2697,7 @@ async function calendarCalendars(options) {
   return calendars;
 }
 async function calendarConnect(options) {
-  const { cfg, ctx, out } = await lifecycleContext(options);
+  const { cfg, ctx, out } = await lifecycleContext(options, ["app.manage"]);
   productionConsent(ctx.env, options.yes, "connect calendar");
   const page2 = calendarBookingPageUrl(cfg, ctx.env);
   const applied = page2 === void 0 ? await readCalendarStatus(ctx) : await applyCalendarSettings(ctx, page2);
@@ -2723,7 +2723,7 @@ async function ensureCalendarConnected(ctx, options) {
   const connectOptions = connectionOptions(options, out);
   return await continueConnectedCalendar(ctx, current, connectOptions) ?? connectWithContext(ctx, connectOptions);
 }
-async function lifecycleContext(options) {
+async function lifecycleContext(options, optionalProjectCapabilities = []) {
   const cfg = await loadProjectConfig(options.configPath);
   if (!cfg.services.includes("calendar")) throw new Error("calendar service is not enabled in config services");
   const env = options.env ?? (cfg.envs.includes("dev") ? "dev" : cfg.envs[0]);
@@ -2741,7 +2741,8 @@ async function lifecycleContext(options) {
       openApprovalUrl: options.openConsentUrl
     },
     doFetch,
-    out
+    out,
+    { optionalProjectCapabilities }
   );
   return { cfg, ctx: { platform: cfg.platformUrl, appId: cfg.app.id, env, token, fetch: doFetch }, out };
 }
@@ -3117,11 +3118,17 @@ async function assertTenantAdminAccess(doFetch, cfg, env, token) {
   if (res.ok || res.status === 404) return;
   if (res.status === 403) {
     const detail = await safeText4(res);
-    if (errorCode(detail) === "human_session_required") {
+    const code = errorCode(detail);
+    if (code === "human_session_required") {
       throw new Error(
         `${env}: odla-db rejected the provision credential before checking ownership for "${cfg.app.id}" (tenant ${tenantId}): human_session_required. Retrying or changing app owners will not help; the deployed odla-db must accept owner-approved app.manage credentials on provisioning routes`
       );
     }
+    if (code === "provision_approval_required") {
+      throw new Error(
+        `${env}: the agent credential does not carry the owner-reviewed app.manage grant required to provision "${cfg.app.id}" (tenant ${tenantId}). The human owner id on the token is accountability, not agent authority. Discard the cached or supplied token and run this command with the current CLI to approve one fresh exact-project provisioning handshake`
+      );
+    }
     throw new Error(
       `${env}: this credential lacks live app.manage authority for "${cfg.app.id}" (tenant ${tenantId}) \u2014 nothing was minted or written; re-run provision with a fresh owner-approved provision handshake. If the human account is not an owner, an existing owner must add it in signed-in Studio; an agent token cannot repair ownership`
     );
@@ -4486,7 +4493,9 @@ async function secretsSet(options) {
     throw new Error('"$"-prefixed vault names are platform-reserved; for the Clerk secret key use "odla-ai secrets set-clerk-key"');
   }
   const { cfg, tenantId, value: value2, doFetch, out } = await resolveVaultWrite(options);
-  const token = await getDeveloperToken(cfg, options, doFetch, out);
+  const token = await getDeveloperToken(cfg, options, doFetch, out, {
+    optionalProjectCapabilities: ["app.manage"]
+  });
   try {
     await (0, import_ai2.putSecret)({ endpoint: cfg.dbEndpoint, token, fetch: doFetch }, tenantId, name, value2);
   } catch (err) {