@odla-ai/cli 0.28.2 → 0.29.0

package/README.md

@@ -461,9 +461,23 @@ the previous bearer.
 - `src/odla/rules.mjs`
 - `.gitignore` entries for local credentials
 
-New configs contain only the `dev` environment. Add `prod` explicitly after
-the development flow is healthy; `provision` refuses to mutate `prod` or
-`production` without `--yes` and supports `--dry-run` for review.
+New configs contain only the `dev` environment. After the development flow is
+healthy, initialize the existing app's live instance without editing the config:
+
+```sh
+npx @odla-ai/cli provision --live --dry-run
+npx @odla-ai/cli provision --live --yes --push-secrets
+```
+
+`--live` targets only `prod`, enables every configured service, provisions its
+credentials/schema/integrations, and refuses to create an app when the sandbox
+does not exist yet. Add `prod` to `envs` only when normal provision runs should
+manage both environments. Calendar apps may predeclare
+`calendar.google.availabilityCalendars.prod` while `envs` remains dev-only;
+live still uses its own Google consent. Every production mutation requires
+`--yes`. Afterwards, explicit live operations such as `smoke --env prod`,
+`secrets push --env prod --yes`, and `app go-live` work while unqualified
+commands continue to default to the sandbox.
 
 `provision` performs the standard safe setup flow:
 

package/REQUIREMENTS.md

@@ -28,6 +28,10 @@ Agnacl, but none should mention or special-case Agnacl.
 - Source semantics remain with the coding agent: package installation, Worker
   instrumentation, and application-specific signals/rules. Humans approve
   identity, production mutation, and explicit destructive rotation.
+- An existing dev-first sandbox app must be able to initialize only its live
+  environment with one explicit CLI mode. That mode enables the complete
+  configured service set, requires production consent, refuses to create a new
+  app, and must not make live part of later unqualified provision runs.
 
 ## Human Approval
 

package/dist/bin.cjs

@@ -1410,7 +1410,7 @@ var init_integration_validation = __esm({
 });
 
 // src/config.ts
-async function loadProjectConfig(configPath = "odla.config.mjs") {
+async function loadProjectConfig(configPath = "odla.config.mjs", options = {}) {
   const resolved = (0, import_node_path5.resolve)(configPath);
   if (!(0, import_node_fs7.existsSync)(resolved)) {
     throw new Error(`config not found: ${configPath}. Run "odla-ai init" first or pass --config.`);
@@ -1423,7 +1423,7 @@ async function loadProjectConfig(configPath = "odla.config.mjs") {
   const envs = unique2(raw.envs?.length ? raw.envs : DEFAULT_ENVS);
   const services = unique2(raw.services?.length ? raw.services : DEFAULT_SERVICES);
   validateServices(services, resolved);
-  validateCalendarConfig(raw, envs, services, resolved);
+  validateCalendarConfig(raw, unique2([...envs, ...options.additionalEnvs ?? []]), services, resolved);
   const local = {
     tokenFile: (0, import_node_path5.resolve)(rootDir, raw.local?.tokenFile ?? ".odla/dev-token.json"),
     credentialsFile: (0, import_node_path5.resolve)(rootDir, raw.local?.credentialsFile ?? ".odla/credentials.local.json"),
@@ -1473,12 +1473,12 @@ function buildPlan(cfg) {
 }
 function calendarServiceConfig(cfg, env) {
   if (!cfg.services.includes("calendar")) throw new Error("calendar service is not enabled in config services");
-  if (!cfg.envs.includes(env)) throw new Error(`calendar env "${env}" is not declared in config envs`);
+  if (!cfg.envs.includes(env) && env !== "prod") throw new Error(`calendar env "${env}" is not declared in config envs`);
   const google = cfg.calendar?.google;
   if (!google) throw new Error("calendar.google is required when the calendar service is enabled");
-  const availability = unique2(
-    (google.availabilityCalendars?.[env] ?? google.calendars?.[env]).map((id) => id.trim())
-  );
+  const configured = google.availabilityCalendars?.[env] ?? google.calendars?.[env];
+  if (!configured?.length) throw new Error(`calendar.google.availabilityCalendars.${env} is required`);
+  const availability = unique2(configured.map((id) => id.trim()));
   return {
     provider: "google",
     access: "book",
@@ -1545,13 +1545,18 @@ function validateCalendarConfig(cfg, envs, services, path) {
   }
   const availability = google[availabilityKey];
   if (!isRecord6(availability)) throw new Error(`${path}: calendar.google.${availabilityKey} must map env names to calendar ids`);
-  const unknownEnv = Object.keys(availability).find((env) => !envs.includes(env));
+  const unknownEnv = Object.keys(availability).find((env) => !envs.includes(env) && env !== "prod");
   if (unknownEnv) throw new Error(`${path}: calendar.google.${availabilityKey}.${unknownEnv} is not in config envs`);
   for (const env of envs) {
     const ids = availability[env];
     if (!Array.isArray(ids) || ids.length === 0) {
       throw new Error(`${path}: calendar.google.${availabilityKey}.${env} must be a non-empty array`);
     }
+  }
+  for (const [env, ids] of Object.entries(availability)) {
+    if (!Array.isArray(ids) || ids.length === 0) {
+      throw new Error(`${path}: calendar.google.${availabilityKey}.${env} must be a non-empty array`);
+    }
     if (ids.length > 10) {
       throw new Error(`${path}: calendar.google.${availabilityKey}.${env} must contain at most 10 calendar ids`);
     }
@@ -1561,7 +1566,7 @@ function validateCalendarConfig(cfg, envs, services, path) {
   }
   if (google.bookingCalendar !== void 0) {
     if (!isRecord6(google.bookingCalendar)) throw new Error(`${path}: calendar.google.bookingCalendar must map env names to one calendar id`);
-    const unknownBookingEnv = Object.keys(google.bookingCalendar).find((env) => !envs.includes(env));
+    const unknownBookingEnv = Object.keys(google.bookingCalendar).find((env) => !envs.includes(env) && env !== "prod");
     if (unknownBookingEnv) throw new Error(`${path}: calendar.google.bookingCalendar.${unknownBookingEnv} is not in config envs`);
     for (const [env, value2] of Object.entries(google.bookingCalendar)) {
       if (!safeText3(value2, 1024)) {
@@ -1571,7 +1576,7 @@ function validateCalendarConfig(cfg, envs, services, path) {
   }
   if (google.bookingPageUrl !== void 0) {
     if (!isRecord6(google.bookingPageUrl)) throw new Error(`${path}: calendar.google.bookingPageUrl must map env names to HTTPS URLs or null`);
-    const unknownBookingEnv = Object.keys(google.bookingPageUrl).find((env) => !envs.includes(env));
+    const unknownBookingEnv = Object.keys(google.bookingPageUrl).find((env) => !envs.includes(env) && env !== "prod");
     if (unknownBookingEnv) throw new Error(`${path}: calendar.google.bookingPageUrl.${unknownBookingEnv} is not in config envs`);
     for (const [env, value2] of Object.entries(google.bookingPageUrl)) {
       if (value2 !== null && !safeHttpsUrl(value2)) {
@@ -2187,7 +2192,7 @@ var init_auth_command = __esm({
 // src/tenant.ts
 function resolveEnv(cfg, requested) {
   const env = requested ?? (cfg.envs.includes("dev") ? "dev" : cfg.envs[0]);
-  if (!env || !cfg.envs.includes(env)) {
+  if (!env || !cfg.envs.includes(env) && env !== "prod") {
     throw new Error(`env "${env ?? ""}" is not declared in ${cfg.configPath}`);
   }
   return env;
@@ -2197,12 +2202,10 @@ function resolveTenant(cfg, requested) {
   return { env, tenant: (0, import_apps2.tenantIdFor)(cfg.app.id, env) };
 }
 function bothTenants(cfg) {
-  for (const env of ["dev", "prod"]) {
-    if (!cfg.envs.includes(env)) {
-      throw new Error(
-        `env "${env}" is not declared in ${cfg.configPath} \u2014 add it to \`envs\` and run \`odla-ai provision --yes\` before transferring data between environments`
-      );
-    }
+  if (!cfg.envs.includes("dev")) {
+    throw new Error(
+      `env "dev" is not declared in ${cfg.configPath} \u2014 sandbox/live transfers require an existing sandbox`
+    );
   }
   return { sandbox: (0, import_apps2.tenantIdFor)(cfg.app.id, "dev"), live: (0, import_apps2.tenantIdFor)(cfg.app.id, "prod") };
 }
@@ -2308,7 +2311,7 @@ var init_agent_command = __esm({
 // src/human-session.ts
 async function requireStudioHuman(configPath, action2, destination = "app", env) {
   const cfg = await loadProjectConfig(configPath);
-  const appEnv = env && cfg.envs.includes(env) ? env : cfg.envs.includes("dev") ? "dev" : cfg.envs[0] ?? "prod";
+  const appEnv = env && (cfg.envs.includes(env) || env === "prod") ? env : cfg.envs.includes("dev") ? "dev" : cfg.envs[0] ?? "prod";
   const path = destination === "app" ? `/studio/apps/${encodeURIComponent(cfg.app.id)}/${encodeURIComponent(appEnv)}/settings/app` : `/studio/apps/${encodeURIComponent(cfg.app.id)}/${encodeURIComponent(appEnv)}/${destination}`;
   throw new Error(
     `human_session_required: ${action2} requires the signed-in owner in Studio. A CLI device token is an agent credential, so another approval or retry cannot work. ${new URL(path, cfg.platformUrl).href}`
@@ -3043,8 +3046,7 @@ async function ensureCalendarConnected(ctx, options) {
 async function lifecycleContext(options, optionalProjectCapabilities = []) {
   const cfg = await loadProjectConfig(options.configPath);
   if (!cfg.services.includes("calendar")) throw new Error("calendar service is not enabled in config services");
-  const env = options.env ?? (cfg.envs.includes("dev") ? "dev" : cfg.envs[0]);
-  if (!env || !cfg.envs.includes(env)) throw new Error(`env "${env ?? ""}" is not declared in ${options.configPath}`);
+  const env = resolveEnv(cfg, options.env);
   calendarServiceConfig(cfg, env);
   const out = options.stdout ?? console;
   const doFetch = options.fetch ?? fetch;
@@ -3188,6 +3190,7 @@ var init_calendar = __esm({
     init_handshake_approval();
     init_token();
     init_human_session();
+    init_tenant();
   }
 });
 
@@ -3264,8 +3267,7 @@ var init_capabilities = __esm({
 // src/ai-models.ts
 async function aiModels(options = {}) {
   const cfg = await loadProjectConfig(options.configPath ?? "odla.config.mjs");
-  const env = options.env ?? cfg.envs[0] ?? "dev";
-  if (!cfg.envs.includes(env)) throw new Error(`ai models env "${env}" is not declared in config envs`);
+  const env = resolveEnv(cfg, options.env);
   const url = new URL(`/registry/apps/${encodeURIComponent(cfg.app.id)}/public-config`, cfg.platformUrl);
   url.searchParams.set("env", env);
   const response2 = await (options.fetch ?? fetch)(url);
@@ -3323,6 +3325,7 @@ var init_ai_models = __esm({
     init_cjs_shims();
     import_ai = require("@odla-ai/ai");
     init_config();
+    init_tenant();
   }
 });
 
@@ -4950,10 +4953,7 @@ async function secretsPushAfterPreflight(options) {
 async function secretsPushImpl(options, preflight) {
   const out = options.stdout ?? console;
   const cfg = await loadProjectConfig(options.configPath);
-  const env = options.env;
-  if (!cfg.envs.includes(env)) {
-    throw new Error(`env "${env}" is not in config envs (${cfg.envs.join(", ")})`);
-  }
+  const env = resolveEnv(cfg, options.env);
   if (PROD_ENV_NAMES.has(env) && !options.yes) {
     throw new Error(`refusing to push a secret to "${env}" without --yes`);
   }
@@ -5019,6 +5019,7 @@ var init_secrets = __esm({
     init_config();
     init_local();
     init_redact();
+    init_tenant();
     init_wrangler();
     PROD_ENV_NAMES = /* @__PURE__ */ new Set(["prod", "production"]);
   }
@@ -5072,14 +5073,12 @@ async function resolveVaultWrite(options) {
   const out = options.stdout ?? console;
   const doFetch = options.fetch ?? fetch;
   const cfg = await loadProjectConfig(options.configPath);
-  if (!cfg.envs.includes(options.env)) {
-    throw new Error(`env "${options.env}" is not in config envs (${cfg.envs.join(", ")})`);
-  }
-  if (PROD_ENV_NAMES2.has(options.env) && !options.yes) {
-    throw new Error(`refusing to store a secret for "${options.env}" without --yes`);
+  const env = resolveEnv(cfg, options.env);
+  if (PROD_ENV_NAMES2.has(env) && !options.yes) {
+    throw new Error(`refusing to store a secret for "${env}" without --yes`);
   }
   const value2 = await secretInputValue(options, "secret");
-  return { cfg, tenantId: (0, import_apps10.tenantIdFor)(cfg.app.id, options.env), value: value2, doFetch, out };
+  return { cfg, tenantId: (0, import_apps10.tenantIdFor)(cfg.app.id, env), value: value2, doFetch, out };
 }
 var import_ai3, import_apps10, PROD_ENV_NAMES2;
 var init_secrets_set = __esm({
@@ -5092,6 +5091,7 @@ var init_secrets_set = __esm({
     init_redact();
     init_secret_input();
     init_token();
+    init_tenant();
     PROD_ENV_NAMES2 = /* @__PURE__ */ new Set(["prod", "production"]);
   }
 });
@@ -5393,8 +5393,7 @@ var init_skill = __esm({
 async function smoke(options) {
   const out = options.stdout ?? console;
   const cfg = await loadProjectConfig(options.configPath);
-  const env = options.env ?? (cfg.envs.includes("dev") ? "dev" : cfg.envs[0] ?? "prod");
-  if (!cfg.envs.includes(env)) throw new Error(`env "${env}" is not declared in ${displayPath(cfg.configPath, cfg.rootDir)}`);
+  const env = resolveEnv(cfg, options.env);
   const credentials = readCredentials(cfg.local.credentialsFile);
   if (!credentials) {
     throw new Error(`local credentials missing: ${displayPath(cfg.local.credentialsFile, cfg.rootDir)}. Run "odla-ai provision --write-dev-vars".`);
@@ -5540,6 +5539,7 @@ var init_smoke = __esm({
     init_integrations();
     init_redact();
     init_token();
+    init_tenant();
   }
 });
 
@@ -9623,7 +9623,7 @@ Usage:
   odla-ai security report <job-id> [--json]
   odla-ai security run [target] --ack-redacted-source [--env dev] [--profile odla] [--fail-on high]
   odla-ai security run [target] --self --ack-redacted-source
-  odla-ai provision [--config odla.config.mjs] [--email <odla-account>] [--request-grant] [--wait <seconds>] [--dry-run] [--push-secrets] [--rotate-o11y-token] [--write-dev-vars[=path]] [--yes]
+  odla-ai provision [--live] [--config odla.config.mjs] [--email <odla-account>] [--request-grant] [--wait <seconds>] [--dry-run] [--push-secrets] [--rotate-o11y-token] [--write-dev-vars[=path]] [--yes]
   odla-ai smoke [--config odla.config.mjs] [--env dev] [--email <odla-account>] [--no-open]
   odla-ai skill install [--dir <project>] [--agent <name>] [--global] [--force]
   odla-ai secrets push --env <env> [--config odla.config.mjs] [--dry-run] [--yes]
@@ -9725,6 +9725,9 @@ Commands:
   platform     Read canonical fleet health, releases, provider load/freshness,
                explicit unknowns, and next actions through a read-only grant.
   provision    Register services, compose integrations, persist credentials, optionally push secrets.
+               "provision --live --yes" initializes only the live instance of
+               an existing sandbox app and enables every configured service;
+               no edit to the dev-first envs list is required.
   smoke        Verify credentials, public-config, composed schema, db aggregate, and integration probes.
   skill        Same installer; --agent accepts all, claude, codex, cursor,
                copilot, gemini, or agents (repeatable or comma-separated).
@@ -9737,8 +9740,10 @@ Safety:
   Every app has two databases on odla.ai: a sandbox (env "dev", tenant
   <appId>--dev) and a live one (env "prod", tenant <appId>). Both are served by
   production odla.ai \u2014 there is no separate odla to point at. New projects get
-  the sandbox only. Add "prod" explicitly to odla.config.mjs and pass --yes to
-  provision the live database; use --dry-run first to inspect the resolved plan.
+  the sandbox only. Run "provision --live --dry-run", then "provision --live
+  --yes" to initialize live from that existing sandbox project's config. Add
+  "prod" to envs only when ordinary provision runs should manage both; use
+  --dry-run first to inspect either resolved plan.
   A real provision first verifies both the released CLI version and the exact
   pinned versions of every external @odla-ai runtime module before importing
   the command graph. A stale workspace module blocks with its resolved path and
@@ -11850,10 +11855,39 @@ var init_provision_credentials = __esm({
   }
 });
 
+// src/provision-live.ts
+function liveProvisionConfig(cfg) {
+  if (!cfg.envs.includes("dev")) {
+    throw new Error(
+      `--live initializes an existing sandbox, but env "dev" is not declared in ${cfg.configPath}; use normal "odla-ai provision --yes" for a prod-only project`
+    );
+  }
+  if (cfg.services.includes("calendar")) {
+    const google = cfg.calendar?.google;
+    const availability = google?.availabilityCalendars ?? google?.calendars;
+    if (!availability?.prod?.length) {
+      throw new Error(
+        `--live requires calendar.google.availabilityCalendars.prod in ${cfg.configPath}; live uses a separate Google Calendar connection, so sandbox calendar ids are not copied`
+      );
+    }
+  }
+  return { ...cfg, envs: ["prod"] };
+}
+var init_provision_live = __esm({
+  "src/provision-live.ts"() {
+    "use strict";
+    init_cjs_shims();
+  }
+});
+
 // src/provision.ts
 async function provision(options) {
   const out = options.stdout ?? console;
-  const cfg = await loadProjectConfig(options.configPath);
+  const loaded = await loadProjectConfig(
+    options.configPath,
+    options.live ? { additionalEnvs: ["prod"] } : void 0
+  );
+  const cfg = options.live ? liveProvisionConfig(loaded) : loaded;
   const plan = buildPlan(cfg);
   const hasDb = cfg.services.includes("db");
   const hasO11y = cfg.services.includes("o11y");
@@ -11867,6 +11901,7 @@ async function provision(options) {
   out.log(`  platform: ${plan.platformUrl}`);
   out.log(`  db:       ${plan.dbEndpoint}`);
   out.log(`  envs:     ${plan.envs.join(", ")}`);
+  if (options.live) out.log("  target:   live setup (existing sandbox app)");
   out.log(`  services: ${plan.services.join(", ")}`);
   out.log(`  integrations: ${plan.integrations.length ? plan.integrations.join(", ") : "none"}`);
   const productionEnvs = plan.envs.filter((env) => env === "prod" || env === "production");
@@ -11927,6 +11962,10 @@ async function provision(options) {
   const existing = await apps.resolveApp(cfg.app.id);
   if (existing) {
     out.log(`app: ${cfg.app.id} already exists`);
+  } else if (options.live) {
+    throw new Error(
+      `cannot set up live for "${cfg.app.id}": the sandbox app does not exist yet; run "odla-ai provision" first`
+    );
   } else {
     try {
       await apps.createApp({ name: cfg.app.name, appId: cfg.app.id });
@@ -12077,6 +12116,7 @@ var init_provision = __esm({
     init_token();
     init_local();
     init_provision_credentials();
+    init_provision_live();
     init_provision_helpers();
     init_secrets();
   }
@@ -14049,6 +14089,7 @@ async function runCli(argv2 = process.argv.slice(2), dependencies = {}) {
 async function provisionCommand(parsed, dependencies) {
   assertArgs(parsed, [
     "config",
+    "live",
     "dry-run",
     "rotate-keys",
     "rotate-o11y-token",
@@ -14065,6 +14106,7 @@ async function provisionCommand(parsed, dependencies) {
   const writeDevVars2 = parsed.options["write-dev-vars"];
   const options = {
     configPath: stringOpt(parsed.options.config) ?? "odla.config.mjs",
+    live: parsed.options.live === true,
     dryRun: parsed.options["dry-run"] === true,
     rotateKeys: parsed.options["rotate-keys"] === true,
     rotateO11yToken: parsed.options["rotate-o11y-token"] === true,