@odla-ai/cli 0.28.2 → 0.29.0

package/dist/index.d.cts

@@ -572,6 +572,10 @@ interface LocalCredentials {
 /** Controls one dev-first provisioning run; production mutation requires `yes`. */
 interface ProvisionOptions {
     configPath: string;
+    /** Initialize only the live (`prod`) environment of an existing sandbox
+     * app, even when the dev-first project config has not added `prod` to
+     * `envs` yet. The normal production `yes` gate still applies. */
+    live?: boolean;
     dryRun?: boolean;
     rotateKeys?: boolean;
     /** Rotate only the o11y ingest token; leaves db keys unchanged. */
@@ -1248,9 +1252,10 @@ declare function installSkill(options?: SkillInstallOptions): SkillInstallResult
 
 /**
  * Verify a live, already-provisioned environment end-to-end. Resolves the target
- * env (`options.env`, else `dev`, else the first declared env) and requires it to
- * be declared in the config. Reads the local credentials file and checks that it
- * belongs to this app and holds the credentials required by the enabled
+ * env (`options.env`, else `dev`, else the first declared env). Explicit `prod`
+ * remains addressable after one-shot `provision --live` even when ordinary
+ * provision defaults stay dev-only. Reads the local credentials file and checks
+ * that it belongs to this app and holds the credentials required by the enabled
  * services — otherwise it throws pointing the user at
  * `odla-ai provision --write-dev-vars`.
  *

package/dist/index.d.ts

@@ -572,6 +572,10 @@ interface LocalCredentials {
 /** Controls one dev-first provisioning run; production mutation requires `yes`. */
 interface ProvisionOptions {
     configPath: string;
+    /** Initialize only the live (`prod`) environment of an existing sandbox
+     * app, even when the dev-first project config has not added `prod` to
+     * `envs` yet. The normal production `yes` gate still applies. */
+    live?: boolean;
     dryRun?: boolean;
     rotateKeys?: boolean;
     /** Rotate only the o11y ingest token; leaves db keys unchanged. */
@@ -1248,9 +1252,10 @@ declare function installSkill(options?: SkillInstallOptions): SkillInstallResult
 
 /**
  * Verify a live, already-provisioned environment end-to-end. Resolves the target
- * env (`options.env`, else `dev`, else the first declared env) and requires it to
- * be declared in the config. Reads the local credentials file and checks that it
- * belongs to this app and holds the credentials required by the enabled
+ * env (`options.env`, else `dev`, else the first declared env). Explicit `prod`
+ * remains addressable after one-shot `provision --live` even when ordinary
+ * provision defaults stay dev-only. Reads the local credentials file and checks
+ * that it belongs to this app and holds the credentials required by the enabled
  * services — otherwise it throws pointing the user at
  * `odla-ai provision --write-dev-vars`.
  *

package/dist/index.js

@@ -56,7 +56,7 @@ import {
   startHostedSecurityJob,
   surfacePaths,
   validateInvocation
-} from "./chunk-STJCWZJU.js";
+} from "./chunk-YTVLTADT.js";
 import {
   exitCodeFor,
   redactSecrets

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@odla-ai/cli",
-  "version": "0.28.2",
+  "version": "0.29.0",
   "description": "Agent-operable CLI for odla provisioning, calendar consent and connection lifecycle, System AI administration, Worker secrets, security jobs, and smoke checks.",
   "license": "MIT",
   "homepage": "https://odla.ai/docs/packages/cli",

package/skills/odla/SKILL.md

@@ -54,9 +54,10 @@ State which path you're taking and what you'll build in one line; get a nod.
    a sandbox (env `dev`, tenant `<appId>--dev`) and a live one (env `prod`,
    tenant `<appId>`). "prod" names the app's live DATABASE, never a different
    odla — there is only one odla.ai. Keep `envs: ["dev"]` and verify the tenant
-   before any write or deploy. Add `prod` only at the explicit go-live
-   checkpoint. That first live `provision --dry-run` review,
-   `provision --yes --push-secrets`, and deploy are human checkpoints.
+   before any write or deploy. At the explicit go-live checkpoint, use
+   `provision --live`; add `prod` to `envs` only if normal later provision runs
+   should manage both. That first live `provision --live --dry-run` review,
+   `provision --live --yes --push-secrets`, and deploy are human checkpoints.
 3. **Rules are default-deny.** A namespace with no rule is invisible; a write
    with no rule is rejected. Never widen a rule just to clear a 403 — edit
    `src/odla/rules.mjs` deliberately, and flag rule changes to the human.
@@ -141,9 +142,10 @@ guessing which platform/credential steps need manual work. Then:
    --ack-redacted-source`.
    The source job follows, reports, and gates by default. Never request a PAT or
    treat GitHub read approval as redacted-snippet disclosure consent.
-6. **ship** ⏸ — after adding `prod`, run `npx @odla-ai/cli provision --dry-run`,
-   show the human, then `npx @odla-ai/cli provision --yes --push-secrets` and
-   `npx wrangler deploy`.
+6. **ship** ⏸ — run `npx @odla-ai/cli provision --live --dry-run`, show the
+   human, then `npx @odla-ai/cli provision --live --yes --push-secrets` and
+   `npx wrangler deploy`. Add `prod` to `envs` only when future ordinary
+   provision runs should target both environments.
 
 ## Track the work in PM, as you go
 

package/skills/odla/references/build.md

@@ -167,12 +167,18 @@ supplied one. Surface either without looping or manufacturing a provider key.
 
 ## 6. Ship  ⏸ human checkpoint
 
-Add `"prod"` to `envs`, provision again (prod tenant = the bare `appId`), then:
+Initialize live after the sandbox is healthy (prod tenant = the bare `appId`), then:
 
 ```
-npx @odla-ai/cli provision --yes --push-secrets  # prod mutation + configured Worker secrets
+npx @odla-ai/cli provision --live --yes --push-secrets  # prod mutation + configured Worker secrets
 npx wrangler deploy
 ```
 
+`--live` targets only prod and does not require adding it to the dev-first
+`envs` list. Add `"prod"` to `envs` only if ordinary future provision runs
+should manage sandbox and live together. If calendar is enabled, predeclare
+`calendar.google.availabilityCalendars.prod`; the live Google connection still
+has its own consent checkpoint.
+
 Verify with `npx @odla-ai/cli smoke --env prod`. Point env vars at the service
 custom domains, never `*.workers.dev` (Workers can't fetch same-account workers.dev).

package/skills/odla/references/co-owners.md

@@ -39,8 +39,9 @@ Every environment's tenant is the same across all owners (prod's tenant is the
 bare app id; `dev` is `<appId>--dev`). So multiple co-owners deploying to
 **production** all read and write the **same** prod database — each with their
 own key. Treat first-prod provision/deploy as the usual human checkpoint
-(`provision --dry-run` review, then `provision --yes --push-secrets`), and never
-rotate another owner's credentials on their behalf.
+(`provision --live --dry-run` review, then
+`provision --live --yes --push-secrets`), and never rotate another owner's
+credentials on their behalf.
 
 ## If provision says the credential lacks `app.manage`