@odla-ai/cli 0.28.2 → 0.29.0

package/dist/{cli-2WZIFXA6.js → cli-DNOAYDBR.js}

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import {
   runCli
-} from "./chunk-STJCWZJU.js";
+} from "./chunk-YTVLTADT.js";
 import {
   exitCodeFor
 } from "./chunk-UKLSRQ5J.js";
@@ -9,4 +9,4 @@ export {
   exitCodeFor,
   runCli
 };
-//# sourceMappingURL=cli-2WZIFXA6.js.map
+//# sourceMappingURL=cli-DNOAYDBR.js.map

package/dist/index.cjs

@@ -1218,7 +1218,7 @@ var DEFAULT_ENVS = ["dev"];
 var DEFAULT_SERVICES = ["db", "ai"];
 var configImportSerial = 0;
 var GOOGLE_CALENDAR_EVENTS_SCOPE = "https://www.googleapis.com/auth/calendar.events";
-async function loadProjectConfig(configPath = "odla.config.mjs") {
+async function loadProjectConfig(configPath = "odla.config.mjs", options = {}) {
   const resolved = (0, import_node_path4.resolve)(configPath);
   if (!(0, import_node_fs4.existsSync)(resolved)) {
     throw new Error(`config not found: ${configPath}. Run "odla-ai init" first or pass --config.`);
@@ -1231,7 +1231,7 @@ async function loadProjectConfig(configPath = "odla.config.mjs") {
   const envs = unique2(raw.envs?.length ? raw.envs : DEFAULT_ENVS);
   const services = unique2(raw.services?.length ? raw.services : DEFAULT_SERVICES);
   validateServices(services, resolved);
-  validateCalendarConfig(raw, envs, services, resolved);
+  validateCalendarConfig(raw, unique2([...envs, ...options.additionalEnvs ?? []]), services, resolved);
   const local = {
     tokenFile: (0, import_node_path4.resolve)(rootDir, raw.local?.tokenFile ?? ".odla/dev-token.json"),
     credentialsFile: (0, import_node_path4.resolve)(rootDir, raw.local?.credentialsFile ?? ".odla/credentials.local.json"),
@@ -1281,12 +1281,12 @@ function buildPlan(cfg) {
 }
 function calendarServiceConfig(cfg, env) {
   if (!cfg.services.includes("calendar")) throw new Error("calendar service is not enabled in config services");
-  if (!cfg.envs.includes(env)) throw new Error(`calendar env "${env}" is not declared in config envs`);
+  if (!cfg.envs.includes(env) && env !== "prod") throw new Error(`calendar env "${env}" is not declared in config envs`);
   const google = cfg.calendar?.google;
   if (!google) throw new Error("calendar.google is required when the calendar service is enabled");
-  const availability = unique2(
-    (google.availabilityCalendars?.[env] ?? google.calendars?.[env]).map((id) => id.trim())
-  );
+  const configured = google.availabilityCalendars?.[env] ?? google.calendars?.[env];
+  if (!configured?.length) throw new Error(`calendar.google.availabilityCalendars.${env} is required`);
+  const availability = unique2(configured.map((id) => id.trim()));
   return {
     provider: "google",
     access: "book",
@@ -1353,13 +1353,18 @@ function validateCalendarConfig(cfg, envs, services, path) {
   }
   const availability = google[availabilityKey];
   if (!isRecord6(availability)) throw new Error(`${path}: calendar.google.${availabilityKey} must map env names to calendar ids`);
-  const unknownEnv = Object.keys(availability).find((env) => !envs.includes(env));
+  const unknownEnv = Object.keys(availability).find((env) => !envs.includes(env) && env !== "prod");
   if (unknownEnv) throw new Error(`${path}: calendar.google.${availabilityKey}.${unknownEnv} is not in config envs`);
   for (const env of envs) {
     const ids = availability[env];
     if (!Array.isArray(ids) || ids.length === 0) {
       throw new Error(`${path}: calendar.google.${availabilityKey}.${env} must be a non-empty array`);
     }
+  }
+  for (const [env, ids] of Object.entries(availability)) {
+    if (!Array.isArray(ids) || ids.length === 0) {
+      throw new Error(`${path}: calendar.google.${availabilityKey}.${env} must be a non-empty array`);
+    }
     if (ids.length > 10) {
       throw new Error(`${path}: calendar.google.${availabilityKey}.${env} must contain at most 10 calendar ids`);
     }
@@ -1369,7 +1374,7 @@ function validateCalendarConfig(cfg, envs, services, path) {
   }
   if (google.bookingCalendar !== void 0) {
     if (!isRecord6(google.bookingCalendar)) throw new Error(`${path}: calendar.google.bookingCalendar must map env names to one calendar id`);
-    const unknownBookingEnv = Object.keys(google.bookingCalendar).find((env) => !envs.includes(env));
+    const unknownBookingEnv = Object.keys(google.bookingCalendar).find((env) => !envs.includes(env) && env !== "prod");
     if (unknownBookingEnv) throw new Error(`${path}: calendar.google.bookingCalendar.${unknownBookingEnv} is not in config envs`);
     for (const [env, value2] of Object.entries(google.bookingCalendar)) {
       if (!safeText3(value2, 1024)) {
@@ -1379,7 +1384,7 @@ function validateCalendarConfig(cfg, envs, services, path) {
   }
   if (google.bookingPageUrl !== void 0) {
     if (!isRecord6(google.bookingPageUrl)) throw new Error(`${path}: calendar.google.bookingPageUrl must map env names to HTTPS URLs or null`);
-    const unknownBookingEnv = Object.keys(google.bookingPageUrl).find((env) => !envs.includes(env));
+    const unknownBookingEnv = Object.keys(google.bookingPageUrl).find((env) => !envs.includes(env) && env !== "prod");
     if (unknownBookingEnv) throw new Error(`${path}: calendar.google.bookingPageUrl.${unknownBookingEnv} is not in config envs`);
     for (const [env, value2] of Object.entries(google.bookingPageUrl)) {
       if (value2 !== null && !safeHttpsUrl(value2)) {
@@ -1925,7 +1930,7 @@ async function authCommand(parsed, deps = {}) {
 var import_apps2 = require("@odla-ai/apps");
 function resolveEnv(cfg, requested) {
   const env = requested ?? (cfg.envs.includes("dev") ? "dev" : cfg.envs[0]);
-  if (!env || !cfg.envs.includes(env)) {
+  if (!env || !cfg.envs.includes(env) && env !== "prod") {
     throw new Error(`env "${env ?? ""}" is not declared in ${cfg.configPath}`);
   }
   return env;
@@ -1935,12 +1940,10 @@ function resolveTenant(cfg, requested) {
   return { env, tenant: (0, import_apps2.tenantIdFor)(cfg.app.id, env) };
 }
 function bothTenants(cfg) {
-  for (const env of ["dev", "prod"]) {
-    if (!cfg.envs.includes(env)) {
-      throw new Error(
-        `env "${env}" is not declared in ${cfg.configPath} \u2014 add it to \`envs\` and run \`odla-ai provision --yes\` before transferring data between environments`
-      );
-    }
+  if (!cfg.envs.includes("dev")) {
+    throw new Error(
+      `env "dev" is not declared in ${cfg.configPath} \u2014 sandbox/live transfers require an existing sandbox`
+    );
   }
   return { sandbox: (0, import_apps2.tenantIdFor)(cfg.app.id, "dev"), live: (0, import_apps2.tenantIdFor)(cfg.app.id, "prod") };
 }
@@ -2028,7 +2031,7 @@ function errorMessage(body) {
 // src/human-session.ts
 async function requireStudioHuman(configPath, action2, destination = "app", env) {
   const cfg = await loadProjectConfig(configPath);
-  const appEnv = env && cfg.envs.includes(env) ? env : cfg.envs.includes("dev") ? "dev" : cfg.envs[0] ?? "prod";
+  const appEnv = env && (cfg.envs.includes(env) || env === "prod") ? env : cfg.envs.includes("dev") ? "dev" : cfg.envs[0] ?? "prod";
   const path = destination === "app" ? `/studio/apps/${encodeURIComponent(cfg.app.id)}/${encodeURIComponent(appEnv)}/settings/app` : `/studio/apps/${encodeURIComponent(cfg.app.id)}/${encodeURIComponent(appEnv)}/${destination}`;
   throw new Error(
     `human_session_required: ${action2} requires the signed-in owner in Studio. A CLI device token is an agent credential, so another approval or retry cannot work. ${new URL(path, cfg.platformUrl).href}`
@@ -2714,8 +2717,7 @@ async function ensureCalendarConnected(ctx, options) {
 async function lifecycleContext(options, optionalProjectCapabilities = []) {
   const cfg = await loadProjectConfig(options.configPath);
   if (!cfg.services.includes("calendar")) throw new Error("calendar service is not enabled in config services");
-  const env = options.env ?? (cfg.envs.includes("dev") ? "dev" : cfg.envs[0]);
-  if (!env || !cfg.envs.includes(env)) throw new Error(`env "${env ?? ""}" is not declared in ${options.configPath}`);
+  const env = resolveEnv(cfg, options.env);
   calendarServiceConfig(cfg, env);
   const out = options.stdout ?? console;
   const doFetch = options.fetch ?? fetch;
@@ -2916,8 +2918,7 @@ function printGroup(out, heading, items) {
 var import_ai = require("@odla-ai/ai");
 async function aiModels(options = {}) {
   const cfg = await loadProjectConfig(options.configPath ?? "odla.config.mjs");
-  const env = options.env ?? cfg.envs[0] ?? "dev";
-  if (!cfg.envs.includes(env)) throw new Error(`ai models env "${env}" is not declared in config envs`);
+  const env = resolveEnv(cfg, options.env);
   const url = new URL(`/registry/apps/${encodeURIComponent(cfg.app.id)}/public-config`, cfg.platformUrl);
   url.searchParams.set("env", env);
   const response2 = await (options.fetch ?? fetch)(url);
@@ -4465,10 +4466,7 @@ async function secretsPushAfterPreflight(options) {
 async function secretsPushImpl(options, preflight) {
   const out = options.stdout ?? console;
   const cfg = await loadProjectConfig(options.configPath);
-  const env = options.env;
-  if (!cfg.envs.includes(env)) {
-    throw new Error(`env "${env}" is not in config envs (${cfg.envs.join(", ")})`);
-  }
+  const env = resolveEnv(cfg, options.env);
   if (PROD_ENV_NAMES.has(env) && !options.yes) {
     throw new Error(`refusing to push a secret to "${env}" without --yes`);
   }
@@ -4578,14 +4576,12 @@ async function resolveVaultWrite(options) {
   const out = options.stdout ?? console;
   const doFetch = options.fetch ?? fetch;
   const cfg = await loadProjectConfig(options.configPath);
-  if (!cfg.envs.includes(options.env)) {
-    throw new Error(`env "${options.env}" is not in config envs (${cfg.envs.join(", ")})`);
-  }
-  if (PROD_ENV_NAMES2.has(options.env) && !options.yes) {
-    throw new Error(`refusing to store a secret for "${options.env}" without --yes`);
+  const env = resolveEnv(cfg, options.env);
+  if (PROD_ENV_NAMES2.has(env) && !options.yes) {
+    throw new Error(`refusing to store a secret for "${env}" without --yes`);
   }
   const value2 = await secretInputValue(options, "secret");
-  return { cfg, tenantId: (0, import_apps10.tenantIdFor)(cfg.app.id, options.env), value: value2, doFetch, out };
+  return { cfg, tenantId: (0, import_apps10.tenantIdFor)(cfg.app.id, env), value: value2, doFetch, out };
 }
 
 // src/skill.ts
@@ -4872,8 +4868,7 @@ function listFiles(dir) {
 async function smoke(options) {
   const out = options.stdout ?? console;
   const cfg = await loadProjectConfig(options.configPath);
-  const env = options.env ?? (cfg.envs.includes("dev") ? "dev" : cfg.envs[0] ?? "prod");
-  if (!cfg.envs.includes(env)) throw new Error(`env "${env}" is not declared in ${displayPath(cfg.configPath, cfg.rootDir)}`);
+  const env = resolveEnv(cfg, options.env);
   const credentials = readCredentials(cfg.local.credentialsFile);
   if (!credentials) {
     throw new Error(`local credentials missing: ${displayPath(cfg.local.credentialsFile, cfg.rootDir)}. Run "odla-ai provision --write-dev-vars".`);
@@ -8949,7 +8944,7 @@ Usage:
   odla-ai security report <job-id> [--json]
   odla-ai security run [target] --ack-redacted-source [--env dev] [--profile odla] [--fail-on high]
   odla-ai security run [target] --self --ack-redacted-source
-  odla-ai provision [--config odla.config.mjs] [--email <odla-account>] [--request-grant] [--wait <seconds>] [--dry-run] [--push-secrets] [--rotate-o11y-token] [--write-dev-vars[=path]] [--yes]
+  odla-ai provision [--live] [--config odla.config.mjs] [--email <odla-account>] [--request-grant] [--wait <seconds>] [--dry-run] [--push-secrets] [--rotate-o11y-token] [--write-dev-vars[=path]] [--yes]
   odla-ai smoke [--config odla.config.mjs] [--env dev] [--email <odla-account>] [--no-open]
   odla-ai skill install [--dir <project>] [--agent <name>] [--global] [--force]
   odla-ai secrets push --env <env> [--config odla.config.mjs] [--dry-run] [--yes]
@@ -9049,6 +9044,9 @@ Commands:
   platform     Read canonical fleet health, releases, provider load/freshness,
                explicit unknowns, and next actions through a read-only grant.
   provision    Register services, compose integrations, persist credentials, optionally push secrets.
+               "provision --live --yes" initializes only the live instance of
+               an existing sandbox app and enables every configured service;
+               no edit to the dev-first envs list is required.
   smoke        Verify credentials, public-config, composed schema, db aggregate, and integration probes.
   skill        Same installer; --agent accepts all, claude, codex, cursor,
                copilot, gemini, or agents (repeatable or comma-separated).
@@ -9061,8 +9059,10 @@ Safety:
   Every app has two databases on odla.ai: a sandbox (env "dev", tenant
   <appId>--dev) and a live one (env "prod", tenant <appId>). Both are served by
   production odla.ai \u2014 there is no separate odla to point at. New projects get
-  the sandbox only. Add "prod" explicitly to odla.config.mjs and pass --yes to
-  provision the live database; use --dry-run first to inspect the resolved plan.
+  the sandbox only. Run "provision --live --dry-run", then "provision --live
+  --yes" to initialize live from that existing sandbox project's config. Add
+  "prod" to envs only when ordinary provision runs should manage both; use
+  --dry-run first to inspect either resolved plan.
   A real provision first verifies both the released CLI version and the exact
   pinned versions of every external @odla-ai runtime module before importing
   the command graph. A stale workspace module blocks with its resolved path and
@@ -11009,10 +11009,33 @@ async function safeText7(res) {
   }
 }
 
+// src/provision-live.ts
+function liveProvisionConfig(cfg) {
+  if (!cfg.envs.includes("dev")) {
+    throw new Error(
+      `--live initializes an existing sandbox, but env "dev" is not declared in ${cfg.configPath}; use normal "odla-ai provision --yes" for a prod-only project`
+    );
+  }
+  if (cfg.services.includes("calendar")) {
+    const google = cfg.calendar?.google;
+    const availability = google?.availabilityCalendars ?? google?.calendars;
+    if (!availability?.prod?.length) {
+      throw new Error(
+        `--live requires calendar.google.availabilityCalendars.prod in ${cfg.configPath}; live uses a separate Google Calendar connection, so sandbox calendar ids are not copied`
+      );
+    }
+  }
+  return { ...cfg, envs: ["prod"] };
+}
+
 // src/provision.ts
 async function provision(options) {
   const out = options.stdout ?? console;
-  const cfg = await loadProjectConfig(options.configPath);
+  const loaded = await loadProjectConfig(
+    options.configPath,
+    options.live ? { additionalEnvs: ["prod"] } : void 0
+  );
+  const cfg = options.live ? liveProvisionConfig(loaded) : loaded;
   const plan = buildPlan(cfg);
   const hasDb = cfg.services.includes("db");
   const hasO11y = cfg.services.includes("o11y");
@@ -11026,6 +11049,7 @@ async function provision(options) {
   out.log(`  platform: ${plan.platformUrl}`);
   out.log(`  db:       ${plan.dbEndpoint}`);
   out.log(`  envs:     ${plan.envs.join(", ")}`);
+  if (options.live) out.log("  target:   live setup (existing sandbox app)");
   out.log(`  services: ${plan.services.join(", ")}`);
   out.log(`  integrations: ${plan.integrations.length ? plan.integrations.join(", ") : "none"}`);
   const productionEnvs = plan.envs.filter((env) => env === "prod" || env === "production");
@@ -11086,6 +11110,10 @@ async function provision(options) {
   const existing = await apps.resolveApp(cfg.app.id);
   if (existing) {
     out.log(`app: ${cfg.app.id} already exists`);
+  } else if (options.live) {
+    throw new Error(
+      `cannot set up live for "${cfg.app.id}": the sandbox app does not exist yet; run "odla-ai provision" first`
+    );
   } else {
     try {
       await apps.createApp({ name: cfg.app.name, appId: cfg.app.id });
@@ -13091,6 +13119,7 @@ async function runCli(argv = process.argv.slice(2), dependencies = {}) {
 async function provisionCommand(parsed, dependencies) {
   assertArgs(parsed, [
     "config",
+    "live",
     "dry-run",
     "rotate-keys",
     "rotate-o11y-token",
@@ -13107,6 +13136,7 @@ async function provisionCommand(parsed, dependencies) {
   const writeDevVars2 = parsed.options["write-dev-vars"];
   const options = {
     configPath: stringOpt(parsed.options.config) ?? "odla.config.mjs",
+    live: parsed.options.live === true,
     dryRun: parsed.options["dry-run"] === true,
     rotateKeys: parsed.options["rotate-keys"] === true,
     rotateO11yToken: parsed.options["rotate-o11y-token"] === true,