@odla-ai/cli 0.27.11 → 0.27.13

package/dist/index.d.cts

@@ -569,6 +569,9 @@ interface ProvisionOptions {
     writeCredentials?: boolean;
     writeDevVars?: string | boolean;
     token?: string;
+    /** Ignore ambient/cached developer credentials and start one fresh
+     * owner-reviewed handshake for the exact app.manage provisioning grant. */
+    requestGrant?: boolean;
     /** Existing odla account email used only when a fresh device handshake is required. */
     email?: string;
     /** Browser opening is attempted by default in every real CLI environment.
@@ -910,6 +913,8 @@ declare function initProject(options: InitOptions): void;
  * @param options.rotateO11yToken Rotate only the o11y token.
  * @param options.email Existing odla account email for a fresh handshake;
  * this is an identity hint, never a password or session credential.
+ * @param options.requestGrant Ignore ambient/cached credentials and request a
+ * fresh owner-reviewed app.manage grant for this exact app.
  * @param options.pushSecrets Preflight Wrangler, then push each env's configured
  *   Worker secrets immediately after credential provisioning.
  * @param options.writeDevVars `true`/a path writes `.dev.vars`; `writeCredentials: false` skips the creds file.

package/dist/index.d.ts

@@ -569,6 +569,9 @@ interface ProvisionOptions {
     writeCredentials?: boolean;
     writeDevVars?: string | boolean;
     token?: string;
+    /** Ignore ambient/cached developer credentials and start one fresh
+     * owner-reviewed handshake for the exact app.manage provisioning grant. */
+    requestGrant?: boolean;
     /** Existing odla account email used only when a fresh device handshake is required. */
     email?: string;
     /** Browser opening is attempted by default in every real CLI environment.
@@ -910,6 +913,8 @@ declare function initProject(options: InitOptions): void;
  * @param options.rotateO11yToken Rotate only the o11y token.
  * @param options.email Existing odla account email for a fresh handshake;
  * this is an identity hint, never a password or session credential.
+ * @param options.requestGrant Ignore ambient/cached credentials and request a
+ * fresh owner-reviewed app.manage grant for this exact app.
  * @param options.pushSecrets Preflight Wrangler, then push each env's configured
  *   Worker secrets immediately after credential provisioning.
  * @param options.writeDevVars `true`/a path writes `.dev.vars`; `writeCredentials: false` skips the creds file.

package/dist/index.js

@@ -57,7 +57,7 @@ import {
   startHostedSecurityJob,
   surfacePaths,
   validateInvocation
-} from "./chunk-Y7WFLSTN.js";
+} from "./chunk-3YSCRXPF.js";
 export {
   AGENT_HARNESSES,
   CAPABILITIES,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@odla-ai/cli",
-  "version": "0.27.11",
+  "version": "0.27.13",
   "description": "Agent-operable CLI for odla provisioning, calendar consent and connection lifecycle, System AI administration, Worker secrets, security jobs, and smoke checks.",
   "license": "MIT",
   "homepage": "https://odla.ai/docs/packages/cli",

package/skills/odla/references/build.md

@@ -74,6 +74,14 @@ request. A 404 from **Approve** is a platform regression; capture the code and
 retry only after Registry is healthy. Ownership, rename/category, and lifecycle
 mutations remain direct-human operations.
 
+If provision reports that the selected agent credential has no live
+`app.manage` grant, retries cannot add authority. Run
+`npx @odla-ai/cli provision --request-grant --email <existing-odla-account>
+--write-dev-vars --push-secrets`. This deliberately ignores `ODLA_DEV_TOKEN`
+and the local token cache, prints/opens a fresh exact-project review URL, and
+continues with the approved replacement credential. Remove an explicit
+`--token`; a supplied credential cannot approve authority for itself.
+
 Calendar adds a second ⏸ checkpoint after the odla device approval: provision
 prints/opens a state-bound Google URL issued by the platform and waits while
 the human grants the booking scopes in a browser. The CLI never receives the