@odla-ai/cli 0.27.9 → 0.27.10

package/dist/index.cjs

@@ -2616,7 +2616,7 @@ function parseCalendarStatus(raw, env) {
     throw new Error("calendar status returned unsupported access");
   }
   const errorValue = record(value2.error) ?? record(connection.error);
-  const errorCode = textField(value2.lastErrorCode, 128);
+  const errorCode2 = textField(value2.lastErrorCode, 128);
   const bookingPageValue = Object.hasOwn(value2, "bookingPageUrl") ? value2.bookingPageUrl : Object.hasOwn(config, "bookingPageUrl") ? config.bookingPageUrl : googleConfig.bookingPageUrl;
   const connected = typeof (value2.connected ?? connection.connected) === "boolean" ? Boolean(value2.connected ?? connection.connected) : ["healthy", "degraded"].includes(stateValue);
   const bookingCalendarId = textField(value2.bookingCalendarId ?? config.bookingCalendarId, 1024);
@@ -2635,10 +2635,10 @@ function parseCalendarStatus(raw, env) {
     ...optionalNullableUrl("bookingPageUrl", bookingPageValue),
     grantedScopes: stringList(value2.grantedScopes ?? connection.grantedScopes ?? connection.scopes),
     ...optionalText("attemptId", value2.attemptId ?? connection.attemptId, 180),
-    ...errorValue || errorCode ? { error: {
+    ...errorValue || errorCode2 ? { error: {
       ...textField(errorValue?.code, 128) ? { code: textField(errorValue?.code, 128) } : {},
       ...textField(errorValue?.message, 500) ? { message: textField(errorValue?.message, 500) } : {},
-      ...!errorValue && errorCode ? { code: errorCode } : {}
+      ...!errorValue && errorCode2 ? { code: errorCode2 } : {}
     } } : {}
   };
 }
@@ -3184,12 +3184,26 @@ async function assertTenantAdminAccess(doFetch, cfg, env, token) {
   });
   if (res.ok || res.status === 404) return;
   if (res.status === 403) {
+    const detail = await safeText4(res);
+    if (errorCode(detail) === "human_session_required") {
+      throw new Error(
+        `${env}: odla-db rejected the provision credential before checking ownership for "${cfg.app.id}" (tenant ${tenantId}): human_session_required. Retrying or changing app owners will not help; the deployed odla-db must accept owner-approved app.manage credentials on provisioning routes`
+      );
+    }
     throw new Error(
       `${env}: this credential lacks live app.manage authority for "${cfg.app.id}" (tenant ${tenantId}) \u2014 nothing was minted or written; re-run provision with a fresh owner-approved provision handshake. If the human account is not an owner, an existing owner must add it in signed-in Studio; an agent token cannot repair ownership`
     );
   }
   throw new Error(`${env}: tenant access preflight (${tenantId}) failed: ${res.status} ${await safeText4(res)}`);
 }
+function errorCode(text2) {
+  try {
+    const body = JSON.parse(text2);
+    return typeof body.error?.code === "string" ? body.error.code : null;
+  } catch {
+    return null;
+  }
+}
 async function postJson(doFetch, url, bearer, body) {
   const res = await doFetch(url, {
     method: "POST",