@odla-ai/cli 0.28.2 → 0.30.0

package/dist/{cli-2WZIFXA6.js → cli-CKBUVTJM.js}

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import {
   runCli
-} from "./chunk-STJCWZJU.js";
+} from "./chunk-PPSXHZJI.js";
 import {
   exitCodeFor
 } from "./chunk-UKLSRQ5J.js";
@@ -9,4 +9,4 @@ export {
   exitCodeFor,
   runCli
 };
-//# sourceMappingURL=cli-2WZIFXA6.js.map
+//# sourceMappingURL=cli-CKBUVTJM.js.map

package/dist/index.cjs

@@ -1218,7 +1218,7 @@ var DEFAULT_ENVS = ["dev"];
 var DEFAULT_SERVICES = ["db", "ai"];
 var configImportSerial = 0;
 var GOOGLE_CALENDAR_EVENTS_SCOPE = "https://www.googleapis.com/auth/calendar.events";
-async function loadProjectConfig(configPath = "odla.config.mjs") {
+async function loadProjectConfig(configPath = "odla.config.mjs", options = {}) {
   const resolved = (0, import_node_path4.resolve)(configPath);
   if (!(0, import_node_fs4.existsSync)(resolved)) {
     throw new Error(`config not found: ${configPath}. Run "odla-ai init" first or pass --config.`);
@@ -1231,7 +1231,7 @@ async function loadProjectConfig(configPath = "odla.config.mjs") {
   const envs = unique2(raw.envs?.length ? raw.envs : DEFAULT_ENVS);
   const services = unique2(raw.services?.length ? raw.services : DEFAULT_SERVICES);
   validateServices(services, resolved);
-  validateCalendarConfig(raw, envs, services, resolved);
+  validateCalendarConfig(raw, unique2([...envs, ...options.additionalEnvs ?? []]), services, resolved);
   const local = {
     tokenFile: (0, import_node_path4.resolve)(rootDir, raw.local?.tokenFile ?? ".odla/dev-token.json"),
     credentialsFile: (0, import_node_path4.resolve)(rootDir, raw.local?.credentialsFile ?? ".odla/credentials.local.json"),
@@ -1281,12 +1281,12 @@ function buildPlan(cfg) {
 }
 function calendarServiceConfig(cfg, env) {
   if (!cfg.services.includes("calendar")) throw new Error("calendar service is not enabled in config services");
-  if (!cfg.envs.includes(env)) throw new Error(`calendar env "${env}" is not declared in config envs`);
+  if (!cfg.envs.includes(env) && env !== "prod") throw new Error(`calendar env "${env}" is not declared in config envs`);
   const google = cfg.calendar?.google;
   if (!google) throw new Error("calendar.google is required when the calendar service is enabled");
-  const availability = unique2(
-    (google.availabilityCalendars?.[env] ?? google.calendars?.[env]).map((id) => id.trim())
-  );
+  const configured = google.availabilityCalendars?.[env] ?? google.calendars?.[env];
+  if (!configured?.length) throw new Error(`calendar.google.availabilityCalendars.${env} is required`);
+  const availability = unique2(configured.map((id) => id.trim()));
   return {
     provider: "google",
     access: "book",
@@ -1353,13 +1353,18 @@ function validateCalendarConfig(cfg, envs, services, path) {
   }
   const availability = google[availabilityKey];
   if (!isRecord6(availability)) throw new Error(`${path}: calendar.google.${availabilityKey} must map env names to calendar ids`);
-  const unknownEnv = Object.keys(availability).find((env) => !envs.includes(env));
+  const unknownEnv = Object.keys(availability).find((env) => !envs.includes(env) && env !== "prod");
   if (unknownEnv) throw new Error(`${path}: calendar.google.${availabilityKey}.${unknownEnv} is not in config envs`);
   for (const env of envs) {
     const ids = availability[env];
     if (!Array.isArray(ids) || ids.length === 0) {
       throw new Error(`${path}: calendar.google.${availabilityKey}.${env} must be a non-empty array`);
     }
+  }
+  for (const [env, ids] of Object.entries(availability)) {
+    if (!Array.isArray(ids) || ids.length === 0) {
+      throw new Error(`${path}: calendar.google.${availabilityKey}.${env} must be a non-empty array`);
+    }
     if (ids.length > 10) {
       throw new Error(`${path}: calendar.google.${availabilityKey}.${env} must contain at most 10 calendar ids`);
     }
@@ -1369,7 +1374,7 @@ function validateCalendarConfig(cfg, envs, services, path) {
   }
   if (google.bookingCalendar !== void 0) {
     if (!isRecord6(google.bookingCalendar)) throw new Error(`${path}: calendar.google.bookingCalendar must map env names to one calendar id`);
-    const unknownBookingEnv = Object.keys(google.bookingCalendar).find((env) => !envs.includes(env));
+    const unknownBookingEnv = Object.keys(google.bookingCalendar).find((env) => !envs.includes(env) && env !== "prod");
     if (unknownBookingEnv) throw new Error(`${path}: calendar.google.bookingCalendar.${unknownBookingEnv} is not in config envs`);
     for (const [env, value2] of Object.entries(google.bookingCalendar)) {
       if (!safeText3(value2, 1024)) {
@@ -1379,7 +1384,7 @@ function validateCalendarConfig(cfg, envs, services, path) {
   }
   if (google.bookingPageUrl !== void 0) {
     if (!isRecord6(google.bookingPageUrl)) throw new Error(`${path}: calendar.google.bookingPageUrl must map env names to HTTPS URLs or null`);
-    const unknownBookingEnv = Object.keys(google.bookingPageUrl).find((env) => !envs.includes(env));
+    const unknownBookingEnv = Object.keys(google.bookingPageUrl).find((env) => !envs.includes(env) && env !== "prod");
     if (unknownBookingEnv) throw new Error(`${path}: calendar.google.bookingPageUrl.${unknownBookingEnv} is not in config envs`);
     for (const [env, value2] of Object.entries(google.bookingPageUrl)) {
       if (value2 !== null && !safeHttpsUrl(value2)) {
@@ -1925,7 +1930,7 @@ async function authCommand(parsed, deps = {}) {
 var import_apps2 = require("@odla-ai/apps");
 function resolveEnv(cfg, requested) {
   const env = requested ?? (cfg.envs.includes("dev") ? "dev" : cfg.envs[0]);
-  if (!env || !cfg.envs.includes(env)) {
+  if (!env || !cfg.envs.includes(env) && env !== "prod") {
     throw new Error(`env "${env ?? ""}" is not declared in ${cfg.configPath}`);
   }
   return env;
@@ -1935,12 +1940,10 @@ function resolveTenant(cfg, requested) {
   return { env, tenant: (0, import_apps2.tenantIdFor)(cfg.app.id, env) };
 }
 function bothTenants(cfg) {
-  for (const env of ["dev", "prod"]) {
-    if (!cfg.envs.includes(env)) {
-      throw new Error(
-        `env "${env}" is not declared in ${cfg.configPath} \u2014 add it to \`envs\` and run \`odla-ai provision --yes\` before transferring data between environments`
-      );
-    }
+  if (!cfg.envs.includes("dev")) {
+    throw new Error(
+      `env "dev" is not declared in ${cfg.configPath} \u2014 sandbox/live transfers require an existing sandbox`
+    );
   }
   return { sandbox: (0, import_apps2.tenantIdFor)(cfg.app.id, "dev"), live: (0, import_apps2.tenantIdFor)(cfg.app.id, "prod") };
 }
@@ -2028,7 +2031,7 @@ function errorMessage(body) {
 // src/human-session.ts
 async function requireStudioHuman(configPath, action2, destination = "app", env) {
   const cfg = await loadProjectConfig(configPath);
-  const appEnv = env && cfg.envs.includes(env) ? env : cfg.envs.includes("dev") ? "dev" : cfg.envs[0] ?? "prod";
+  const appEnv = env && (cfg.envs.includes(env) || env === "prod") ? env : cfg.envs.includes("dev") ? "dev" : cfg.envs[0] ?? "prod";
   const path = destination === "app" ? `/studio/apps/${encodeURIComponent(cfg.app.id)}/${encodeURIComponent(appEnv)}/settings/app` : `/studio/apps/${encodeURIComponent(cfg.app.id)}/${encodeURIComponent(appEnv)}/${destination}`;
   throw new Error(
     `human_session_required: ${action2} requires the signed-in owner in Studio. A CLI device token is an agent credential, so another approval or retry cannot work. ${new URL(path, cfg.platformUrl).href}`
@@ -2714,8 +2717,7 @@ async function ensureCalendarConnected(ctx, options) {
 async function lifecycleContext(options, optionalProjectCapabilities = []) {
   const cfg = await loadProjectConfig(options.configPath);
   if (!cfg.services.includes("calendar")) throw new Error("calendar service is not enabled in config services");
-  const env = options.env ?? (cfg.envs.includes("dev") ? "dev" : cfg.envs[0]);
-  if (!env || !cfg.envs.includes(env)) throw new Error(`env "${env ?? ""}" is not declared in ${options.configPath}`);
+  const env = resolveEnv(cfg, options.env);
   calendarServiceConfig(cfg, env);
   const out = options.stdout ?? console;
   const doFetch = options.fetch ?? fetch;
@@ -2916,8 +2918,7 @@ function printGroup(out, heading, items) {
 var import_ai = require("@odla-ai/ai");
 async function aiModels(options = {}) {
   const cfg = await loadProjectConfig(options.configPath ?? "odla.config.mjs");
-  const env = options.env ?? cfg.envs[0] ?? "dev";
-  if (!cfg.envs.includes(env)) throw new Error(`ai models env "${env}" is not declared in config envs`);
+  const env = resolveEnv(cfg, options.env);
   const url = new URL(`/registry/apps/${encodeURIComponent(cfg.app.id)}/public-config`, cfg.platformUrl);
   url.searchParams.set("env", env);
   const response2 = await (options.fetch ?? fetch)(url);
@@ -3960,6 +3961,41 @@ async function wranglerLoggedIn(run, cwd) {
     return false;
   }
 }
+async function wranglerRuntimeTarget(run, opts) {
+  const configPath = findWranglerConfig(opts.cwd);
+  if (!configPath) throw new Error(`no wrangler config found in ${opts.cwd}`);
+  const config = readWranglerConfig(configPath);
+  if (!config) throw new Error("runtime credential delivery requires wrangler.json or wrangler.jsonc");
+  const baseName = typeof config.name === "string" ? config.name : "";
+  const envs = config.env && typeof config.env === "object" && !Array.isArray(config.env) ? config.env : {};
+  const envConfig = opts.env && envs[opts.env] && typeof envs[opts.env] === "object" ? envs[opts.env] : {};
+  const explicitName = typeof envConfig.name === "string" ? envConfig.name : "";
+  const serviceEnvironments = config.legacy_env === false;
+  if (serviceEnvironments && explicitName) {
+    throw new Error("env.<name>.name is not allowed when wrangler legacy_env is false");
+  }
+  const scriptName = serviceEnvironments ? baseName : explicitName || (opts.env ? `${baseName}-${opts.env}` : baseName);
+  if (!/^[a-z0-9][a-z0-9_-]{0,62}$/.test(scriptName)) {
+    throw new Error("wrangler config must resolve an exact Worker name before credentials are issued");
+  }
+  const configuredAccount = typeof envConfig.account_id === "string" ? envConfig.account_id : typeof config.account_id === "string" ? config.account_id : "";
+  const whoami = await run("npx", ["wrangler", "whoami"], { cwd: opts.cwd });
+  if (whoami.code !== 0 || /not authenticated/i.test(`${whoami.stdout}${whoami.stderr}`)) {
+    throw new Error(`wrangler is not logged in \u2014 run "wrangler login" (a browser step for the human)`);
+  }
+  const discovered = [...new Set(`${whoami.stdout}
+${whoami.stderr}`.match(/\b[a-f0-9]{32}\b/gi)?.map((id) => id.toLowerCase()) ?? [])];
+  const accountId = configuredAccount.toLowerCase() || (discovered.length === 1 ? discovered[0] : "");
+  if (!/^[a-f0-9]{32}$/.test(accountId) || configuredAccount && discovered.length > 0 && !discovered.includes(accountId)) {
+    throw new Error("Wrangler account is ambiguous or does not match account_id in the config");
+  }
+  return {
+    provider: "cloudflare",
+    accountId,
+    scriptName,
+    ...opts.env ? { environment: opts.env } : {}
+  };
+}
 function wranglerPutSecret(run, opts) {
   const args = [
     "wrangler",
@@ -3971,6 +4007,16 @@ function wranglerPutSecret(run, opts) {
   ];
   return run("npx", args, { input: opts.value, cwd: opts.cwd });
 }
+function wranglerBulkSecrets(run, opts) {
+  const args = [
+    "wrangler",
+    "secret",
+    "bulk",
+    ...opts.env ? ["--env", opts.env] : [],
+    ...opts.configPath ? ["--config", opts.configPath] : []
+  ];
+  return run("npx", args, { input: JSON.stringify(opts.secrets), cwd: opts.cwd });
+}
 
 // src/doctor-checks.ts
 function lintRules(rules, entities, publicRead) {
@@ -4459,16 +4505,10 @@ var PROD_ENV_NAMES = /* @__PURE__ */ new Set(["prod", "production"]);
 async function secretsPush(options) {
   await secretsPushImpl(options, true);
 }
-async function secretsPushAfterPreflight(options) {
-  await secretsPushImpl(options, false);
-}
 async function secretsPushImpl(options, preflight) {
   const out = options.stdout ?? console;
   const cfg = await loadProjectConfig(options.configPath);
-  const env = options.env;
-  if (!cfg.envs.includes(env)) {
-    throw new Error(`env "${env}" is not in config envs (${cfg.envs.join(", ")})`);
-  }
+  const env = resolveEnv(cfg, options.env);
   if (PROD_ENV_NAMES.has(env) && !options.yes) {
     throw new Error(`refusing to push a secret to "${env}" without --yes`);
   }
@@ -4578,14 +4618,12 @@ async function resolveVaultWrite(options) {
   const out = options.stdout ?? console;
   const doFetch = options.fetch ?? fetch;
   const cfg = await loadProjectConfig(options.configPath);
-  if (!cfg.envs.includes(options.env)) {
-    throw new Error(`env "${options.env}" is not in config envs (${cfg.envs.join(", ")})`);
-  }
-  if (PROD_ENV_NAMES2.has(options.env) && !options.yes) {
-    throw new Error(`refusing to store a secret for "${options.env}" without --yes`);
+  const env = resolveEnv(cfg, options.env);
+  if (PROD_ENV_NAMES2.has(env) && !options.yes) {
+    throw new Error(`refusing to store a secret for "${env}" without --yes`);
   }
   const value2 = await secretInputValue(options, "secret");
-  return { cfg, tenantId: (0, import_apps10.tenantIdFor)(cfg.app.id, options.env), value: value2, doFetch, out };
+  return { cfg, tenantId: (0, import_apps10.tenantIdFor)(cfg.app.id, env), value: value2, doFetch, out };
 }
 
 // src/skill.ts
@@ -4872,8 +4910,7 @@ function listFiles(dir) {
 async function smoke(options) {
   const out = options.stdout ?? console;
   const cfg = await loadProjectConfig(options.configPath);
-  const env = options.env ?? (cfg.envs.includes("dev") ? "dev" : cfg.envs[0] ?? "prod");
-  if (!cfg.envs.includes(env)) throw new Error(`env "${env}" is not declared in ${displayPath(cfg.configPath, cfg.rootDir)}`);
+  const env = resolveEnv(cfg, options.env);
   const credentials = readCredentials(cfg.local.credentialsFile);
   if (!credentials) {
     throw new Error(`local credentials missing: ${displayPath(cfg.local.credentialsFile, cfg.rootDir)}. Run "odla-ai provision --write-dev-vars".`);
@@ -8832,6 +8869,55 @@ function requireName(parsed) {
   return name;
 }
 
+// src/credential-command.ts
+async function responseError(response2) {
+  return redactSecrets((await response2.text()).slice(0, 1e3));
+}
+async function credentialCommand(parsed, deps = {}) {
+  const action2 = parsed.positionals[1] ?? "list";
+  if (action2 !== "list" && action2 !== "revoke") {
+    throw new Error(`unknown credentials action "${action2}". Try "odla-ai credentials list".`);
+  }
+  assertArgs(parsed, ["config", "env", "all", "json", "token", "email", "open"], action2 === "revoke" ? 3 : 2);
+  const cfg = await loadProjectConfig(stringOpt(parsed.options.config) ?? "odla.config.mjs");
+  const doFetch = deps.fetch ?? fetch;
+  const out = deps.stdout ?? console;
+  const token = await getDeveloperToken(cfg, {
+    configPath: cfg.configPath,
+    token: stringOpt(parsed.options.token),
+    email: stringOpt(parsed.options.email),
+    open: parsed.options.open === false ? false : parsed.options.open === true ? true : void 0,
+    openApprovalUrl: deps.openUrl
+  }, doFetch, out, { optionalProjectCapabilities: ["app.manage"] });
+  const base = `${cfg.platformUrl}/registry/apps/${encodeURIComponent(cfg.app.id)}/runtime-credentials`;
+  if (action2 === "revoke") {
+    const id = parsed.positionals[2];
+    if (!id) throw new Error("credentials revoke requires the exact receipt id from credentials list");
+    const response3 = await doFetch(`${base}/${encodeURIComponent(id)}`, {
+      method: "DELETE",
+      headers: { authorization: `Bearer ${token}` }
+    });
+    if (!response3.ok) throw new Error(`runtime credential revoke failed (${response3.status}): ${await responseError(response3)}`);
+    const body2 = await response3.json();
+    return out.log(parsed.options.json === true ? JSON.stringify(body2, null, 2) : `revoked ${body2.receipt.id} (${body2.receipt.env} ${body2.receipt.target.scriptName})`);
+  }
+  const query = new URLSearchParams();
+  const requestedEnv = stringOpt(parsed.options.env);
+  if (requestedEnv) query.set("env", requestedEnv);
+  const response2 = await doFetch(`${base}${query.size ? `?${query}` : ""}`, {
+    headers: { authorization: `Bearer ${token}` }
+  });
+  if (!response2.ok) throw new Error(`runtime credential inventory failed (${response2.status}): ${await responseError(response2)}`);
+  const body = await response2.json();
+  const credentials = parsed.options.all === true ? body.credentials : body.credentials.filter((item) => item.state === "committed");
+  if (parsed.options.json === true) return out.log(JSON.stringify({ credentials }, null, 2));
+  if (!credentials.length) return out.log("no active runtime credential receipts");
+  out.log("RECEIPT	ENV	TARGET	CREATED");
+  for (const item of credentials) {
+    out.log(`${item.id}	${item.env}	${item.target.accountId ?? "local"}/${item.target.scriptName}	${new Date(item.createdAt).toISOString()}`);
+  }
+}
+
 // src/help-usage.ts
 var USAGE_SECTION = `
 Start here:
@@ -8949,7 +9035,9 @@ Usage:
   odla-ai security report <job-id> [--json]
   odla-ai security run [target] --ack-redacted-source [--env dev] [--profile odla] [--fail-on high]
   odla-ai security run [target] --self --ack-redacted-source
-  odla-ai provision [--config odla.config.mjs] [--email <odla-account>] [--request-grant] [--wait <seconds>] [--dry-run] [--push-secrets] [--rotate-o11y-token] [--write-dev-vars[=path]] [--yes]
+  odla-ai provision [--live] [--config odla.config.mjs] [--email <odla-account>] [--request-grant] [--wait <seconds>] [--dry-run] [--push-secrets] [--rotate-o11y-token] [--write-dev-vars[=path]] [--yes]
+  odla-ai credentials list [--config odla.config.mjs] [--env dev] [--all] [--json]
+  odla-ai credentials revoke <receipt-id> [--config odla.config.mjs] [--json]
   odla-ai smoke [--config odla.config.mjs] [--env dev] [--email <odla-account>] [--no-open]
   odla-ai skill install [--dir <project>] [--agent <name>] [--global] [--force]
   odla-ai secrets push --env <env> [--config odla.config.mjs] [--dry-run] [--yes]
@@ -9049,6 +9137,9 @@ Commands:
   platform     Read canonical fleet health, releases, provider load/freshness,
                explicit unknowns, and next actions through a read-only grant.
   provision    Register services, compose integrations, persist credentials, optionally push secrets.
+               "provision --live --yes" initializes only the live instance of
+               an existing sandbox app and enables every configured service;
+               no edit to the dev-first envs list is required.
   smoke        Verify credentials, public-config, composed schema, db aggregate, and integration probes.
   skill        Same installer; --agent accepts all, claude, codex, cursor,
                copilot, gemini, or agents (repeatable or comma-separated).
@@ -9061,15 +9152,21 @@ Safety:
   Every app has two databases on odla.ai: a sandbox (env "dev", tenant
   <appId>--dev) and a live one (env "prod", tenant <appId>). Both are served by
   production odla.ai \u2014 there is no separate odla to point at. New projects get
-  the sandbox only. Add "prod" explicitly to odla.config.mjs and pass --yes to
-  provision the live database; use --dry-run first to inspect the resolved plan.
+  the sandbox only. Run "provision --live --dry-run", then "provision --live
+  --yes" to initialize live from that existing sandbox project's config. Add
+  "prod" to envs only when ordinary provision runs should manage both; use
+  --dry-run first to inspect either resolved plan.
   A real provision first verifies both the released CLI version and the exact
   pinned versions of every external @odla-ai runtime module before importing
   the command graph. A stale workspace module blocks with its resolved path and
   tells the agent to update/rebase, npm ci, and rebuild.
-  Provision caches the approved developer token and service credentials under
-  .odla/ with mode 0600, and init adds those paths to .gitignore. Secret push
-  preflights Wrangler before any shown-once issuance or destructive rotation.
+  Provision caches the approved developer token under .odla/ with mode 0600.
+  Local-only development provisioning may also cache that developer's service
+  credentials there. \`provision --push-secrets\` instead stages a fresh,
+  independently revocable credential set through the approved handshake,
+  transfers the complete set to the exact Worker with \`wrangler secret bulk\`
+  over stdin, and never writes its plaintext under .odla. Secret push preflights
+  Wrangler before shown-once issuance; it never rotates sibling credentials.
   Projectless PM, Discussions, o11y, runbook, and identity commands use
   --platform/--app/--env, ODLA_PLATFORM_URL/ODLA_APP_ID/ODLA_ENV, and
   ODLA_DEV_TOKEN. Save non-secret scope metadata with "context save", then
@@ -10993,7 +11090,7 @@ async function issueO11yToken(opts) {
   );
   if (res.status === 409 && !opts.rotateO11y) {
     throw new Error(
-      `o11y token already exists for env "${opts.env}", but its shown-once value is not in the local credentials file; run "odla-ai provision --rotate-o11y-token --push-secrets" to replace it explicitly`
+      `o11y token already exists for env "${opts.env}", but its shown-once value is not in the local credentials file; run "odla-ai provision --push-secrets" to install a separate runtime credential without rotating siblings`
     );
   }
   if (!res.ok) throw new Error(`o11y token ${opts.rotateO11y ? "rotation" : "issue"} (${opts.env}) failed: ${res.status} ${await safeText7(res)}`);
@@ -11009,23 +11106,131 @@ async function safeText7(res) {
   }
 }
 
+// src/runtime-credentials.ts
+var import_node_crypto5 = require("crypto");
+function runtimeUrl(cfg, suffix = "") {
+  return `${cfg.platformUrl}/registry/apps/${encodeURIComponent(cfg.app.id)}/runtime-credentials${suffix}`;
+}
+async function safeError(response2) {
+  const text2 = await response2.text();
+  return redactSecrets(text2.slice(0, 1e3));
+}
+async function finish(doFetch, cfg, token, sessionId, method) {
+  return doFetch(runtimeUrl(cfg, `/${encodeURIComponent(sessionId)}`), {
+    method,
+    headers: { authorization: `Bearer ${token}` }
+  });
+}
+async function deliverRuntimeCredentials(cfg, options) {
+  const doFetch = options.fetch ?? fetch;
+  const run = options.runner ?? defaultRunner;
+  const wranglerEnv = options.env === "prod" || options.env === "production" ? void 0 : options.env;
+  const target = await wranglerRuntimeTarget(run, {
+    cwd: cfg.rootDir,
+    env: wranglerEnv
+  });
+  const issue = await doFetch(runtimeUrl(cfg), {
+    method: "POST",
+    headers: {
+      authorization: `Bearer ${options.developerToken}`,
+      "content-type": "application/json"
+    },
+    body: JSON.stringify({
+      env: options.env,
+      idempotencyKey: `wrangler:${(0, import_node_crypto5.randomUUID)()}`,
+      target
+    })
+  });
+  const body = await issue.json().catch(() => null);
+  if (!issue.ok || typeof body?.sessionId !== "string" || !body.secrets || typeof body.secrets !== "object") {
+    const detail = body?.error?.code ?? body?.error?.message ?? issue.status;
+    throw new Error(`runtime credential staging failed: ${String(detail)}`);
+  }
+  const secrets = body.secrets;
+  const values = {};
+  for (const name of ["ODLA_API_KEY", "ODLA_O11Y_TOKEN"]) {
+    const value2 = secrets[name];
+    if (typeof value2 === "string" && value2) values[name] = value2;
+  }
+  if (Object.keys(values).length === 0) {
+    await finish(doFetch, cfg, options.developerToken, body.sessionId, "DELETE");
+    throw new Error("runtime credential staging returned no configured service credentials");
+  }
+  const pushed = await wranglerBulkSecrets(run, {
+    secrets: values,
+    env: wranglerEnv,
+    cwd: cfg.rootDir
+  });
+  if (pushed.code !== 0) {
+    await finish(doFetch, cfg, options.developerToken, body.sessionId, "DELETE");
+    const detail = redactSecrets(`${pushed.stderr || pushed.stdout}`.trim());
+    throw new Error(`wrangler secret bulk failed (exit ${pushed.code}): ${detail}`);
+  }
+  const committed = await finish(
+    doFetch,
+    cfg,
+    options.developerToken,
+    body.sessionId,
+    "POST"
+  );
+  if (!committed.ok) {
+    await finish(doFetch, cfg, options.developerToken, body.sessionId, "DELETE");
+    throw new Error(`runtime credential receipt commit failed: ${await safeError(committed)}`);
+  }
+  options.stdout?.log(
+    `${options.env}: installed ${Object.keys(values).join(" + ")} on ${target.accountId}/${target.scriptName}${target.environment ? ` (${target.environment})` : ""}; plaintext stayed in memory`
+  );
+  return {
+    sessionId: body.sessionId,
+    target,
+    ...values.ODLA_API_KEY ? { dbKey: values.ODLA_API_KEY } : {},
+    ...values.ODLA_O11Y_TOKEN ? { o11yToken: values.ODLA_O11Y_TOKEN } : {}
+  };
+}
+
+// src/provision-live.ts
+function liveProvisionConfig(cfg) {
+  if (!cfg.envs.includes("dev")) {
+    throw new Error(
+      `--live initializes an existing sandbox, but env "dev" is not declared in ${cfg.configPath}; use normal "odla-ai provision --yes" for a prod-only project`
+    );
+  }
+  if (cfg.services.includes("calendar")) {
+    const google = cfg.calendar?.google;
+    const availability = google?.availabilityCalendars ?? google?.calendars;
+    if (!availability?.prod?.length) {
+      throw new Error(
+        `--live requires calendar.google.availabilityCalendars.prod in ${cfg.configPath}; live uses a separate Google Calendar connection, so sandbox calendar ids are not copied`
+      );
+    }
+  }
+  return { ...cfg, envs: ["prod"] };
+}
+
 // src/provision.ts
 async function provision(options) {
   const out = options.stdout ?? console;
-  const cfg = await loadProjectConfig(options.configPath);
+  const loaded = await loadProjectConfig(
+    options.configPath,
+    options.live ? { additionalEnvs: ["prod"] } : void 0
+  );
+  const cfg = options.live ? liveProvisionConfig(loaded) : loaded;
   const plan = buildPlan(cfg);
   const hasDb = cfg.services.includes("db");
   const hasO11y = cfg.services.includes("o11y");
   if (options.rotateO11yToken && !hasO11y) {
     throw new Error("--rotate-o11y-token requires the o11y service in odla.config.mjs");
   }
-  if (options.pushSecrets && options.writeCredentials === false) {
-    throw new Error("--push-secrets cannot be combined with --no-write-credentials");
+  if (options.pushSecrets && (options.rotateKeys || options.rotateO11yToken)) {
+    throw new Error(
+      "--push-secrets always issues an independent runtime credential set; do not combine it with destructive rotation flags"
+    );
   }
   out.log(`odla-ai: ${plan.appName} (${plan.appId})`);
   out.log(`  platform: ${plan.platformUrl}`);
   out.log(`  db:       ${plan.dbEndpoint}`);
   out.log(`  envs:     ${plan.envs.join(", ")}`);
+  if (options.live) out.log("  target:   live setup (existing sandbox app)");
   out.log(`  services: ${plan.services.join(", ")}`);
   out.log(`  integrations: ${plan.integrations.length ? plan.integrations.join(", ") : "none"}`);
   const productionEnvs = plan.envs.filter((env) => env === "prod" || env === "production");
@@ -11056,7 +11261,7 @@ async function provision(options) {
     out.log(`  secrets: ${options.pushSecrets ? "push configured Worker secrets" : "local only"}`);
     return;
   }
-  let credentials = readCredentials(cfg.local.credentialsFile);
+  let credentials = options.pushSecrets ? null : readCredentials(cfg.local.credentialsFile);
   if (credentials && credentials.appId !== cfg.app.id) {
     throw new Error(
       `credentials at ${displayPath(cfg.local.credentialsFile, cfg.rootDir)} are for "${credentials.appId}", not "${cfg.app.id}"`
@@ -11065,7 +11270,7 @@ async function provision(options) {
   const rotatesO11y = !!(options.rotateKeys || options.rotateO11yToken);
   const missingO11y = cfg.envs.some((env) => !credentials?.envs[env]?.o11yToken);
   const missingDb = cfg.envs.some((env) => !credentials?.envs[env]?.dbKey);
-  const losesShownOnceCredential = hasDb && (!!options.rotateKeys || missingDb) || hasO11y && (rotatesO11y || missingO11y);
+  const losesShownOnceCredential = !options.pushSecrets && (hasDb && (!!options.rotateKeys || missingDb) || hasO11y && (rotatesO11y || missingO11y));
   if (options.writeCredentials === false && losesShownOnceCredential) {
     throw new Error("credential issuance/rotation requires the private credentials file; remove --no-write-credentials");
   }
@@ -11086,6 +11291,10 @@ async function provision(options) {
   const existing = await apps.resolveApp(cfg.app.id);
   if (existing) {
     out.log(`app: ${cfg.app.id} already exists`);
+  } else if (options.live) {
+    throw new Error(
+      `cannot set up live for "${cfg.app.id}": the sandbox app does not exist yet; run "odla-ai provision" first`
+    );
   } else {
     try {
       await apps.createApp({ name: cfg.app.name, appId: cfg.app.id });
@@ -11135,38 +11344,42 @@ async function provision(options) {
       await applyCalendarBookingPage(calendarCtx, calendarBookingPageUrl(cfg, env), out);
     }
   }
+  let devVarsCredentials = credentials;
   for (const env of cfg.envs) {
     const tenantId = (0, import_apps12.tenantIdFor)(cfg.app.id, env);
-    credentials = await provisionEnvCredentials({
-      cfg,
-      env,
-      developerToken: token,
-      credentials,
-      rotateDb: !!options.rotateKeys,
-      rotateO11y: rotatesO11y,
-      write: options.writeCredentials !== false,
-      fetch: doFetch,
-      stdout: out
-    });
-    const dbKey = credentials.envs[env]?.dbKey;
+    let dbKey;
     if (options.pushSecrets) {
-      try {
-        await secretsPushAfterPreflight({
-          configPath: cfg.configPath,
-          env,
-          yes: options.yes,
-          runner: options.secretRunner,
-          stdout: out
-        });
-      } catch (error) {
-        const message2 = error instanceof Error ? error.message : String(error);
-        const consent = env === "prod" || env === "production" ? " --yes" : "";
-        throw new Error(
-          `${message2}
-${env}: credentials are already saved; retry "odla-ai secrets push --env ${env}${consent}" without issuing or rotating again`,
-          { cause: error }
-        );
-      }
+      const delivered = await deliverRuntimeCredentials(cfg, {
+        env,
+        developerToken: token,
+        fetch: doFetch,
+        runner: options.secretRunner,
+        stdout: out
+      });
+      dbKey = delivered.dbKey;
+      devVarsCredentials = mergeCredential(devVarsCredentials, {
+        appId: cfg.app.id,
+        platformUrl: cfg.platformUrl,
+        dbEndpoint: cfg.dbEndpoint,
+        env,
+        tenantId,
+        ...delivered.dbKey ? { dbKey: delivered.dbKey } : {},
+        ...delivered.o11yToken ? { o11yToken: delivered.o11yToken } : {}
+      });
+    } else {
+      credentials = await provisionEnvCredentials({
+        cfg,
+        env,
+        developerToken: token,
+        credentials,
+        rotateDb: !!options.rotateKeys,
+        rotateO11y: rotatesO11y,
+        write: options.writeCredentials !== false,
+        fetch: doFetch,
+        stdout: out
+      });
+      devVarsCredentials = credentials;
+      dbKey = credentials.envs[env]?.dbKey;
     }
     if (schema && dbKey) {
       await postJson(doFetch, `${cfg.dbEndpoint}/app/${encodeURIComponent(tenantId)}/schema`, dbKey, { schema });
@@ -11190,13 +11403,13 @@ ${env}: credentials are already saved; retry "odla-ai secrets push --env ${env}$
       }
     }
   }
-  if (options.writeCredentials !== false && credentials) {
+  if (!options.pushSecrets && options.writeCredentials !== false && credentials) {
     const ignored = cfg.local.gitignore && gitignoreEntry(cfg.rootDir, cfg.local.credentialsFile);
     out.log(`credentials: wrote ${displayPath(cfg.local.credentialsFile, cfg.rootDir)} (0600${ignored ? ", gitignored" : ""})`);
   }
-  if (devVarsTarget && credentials) {
+  if (devVarsTarget && devVarsCredentials) {
     const env = cfg.envs.includes("dev") ? "dev" : cfg.envs[0] ?? "prod";
-    writeDevVars(devVarsTarget, credentials, env, o11yDevVars(cfg));
+    writeDevVars(devVarsTarget, devVarsCredentials, env, o11yDevVars(cfg));
     out.log(`dev vars: wrote ${displayPath(devVarsTarget, cfg.rootDir)} for ${env}`);
   }
   if (cfg.services.includes("calendar")) {
@@ -11287,6 +11500,7 @@ var COMMAND_SURFACE = {
   code: { connect: {} },
   config: { diff: {}, plan: {}, apply: {} },
   context: { show: {}, list: {}, save: {}, remove: {} },
+  credentials: { list: {}, revoke: {} },
   // `watch`, `read`, `reply`, and `resolve` take a topic id from there on.
   discuss: {
     groups: {},
@@ -13024,6 +13238,10 @@ async function runCli(argv = process.argv.slice(2), dependencies = {}) {
     await contextCommand(parsed, runtime);
     return;
   }
+  if (command === "credentials") {
+    await credentialCommand(parsed, runtime);
+    return;
+  }
   if (command === "runbook") {
     await runbookCommand(parsed, runtime);
     return;
@@ -13091,6 +13309,7 @@ async function runCli(argv = process.argv.slice(2), dependencies = {}) {
 async function provisionCommand(parsed, dependencies) {
   assertArgs(parsed, [
     "config",
+    "live",
     "dry-run",
     "rotate-keys",
     "rotate-o11y-token",
@@ -13107,6 +13326,7 @@ async function provisionCommand(parsed, dependencies) {
   const writeDevVars2 = parsed.options["write-dev-vars"];
   const options = {
     configPath: stringOpt(parsed.options.config) ?? "odla.config.mjs",
+    live: parsed.options.live === true,
     dryRun: parsed.options["dry-run"] === true,
     rotateKeys: parsed.options["rotate-keys"] === true,
     rotateO11yToken: parsed.options["rotate-o11y-token"] === true,