@odla-ai/cli 0.28.2 → 0.30.0

package/dist/index.d.cts

@@ -572,6 +572,10 @@ interface LocalCredentials {
 /** Controls one dev-first provisioning run; production mutation requires `yes`. */
 interface ProvisionOptions {
     configPath: string;
+    /** Initialize only the live (`prod`) environment of an existing sandbox
+     * app, even when the dev-first project config has not added `prod` to
+     * `envs` yet. The normal production `yes` gate still applies. */
+    live?: boolean;
     dryRun?: boolean;
     rotateKeys?: boolean;
     /** Rotate only the o11y ingest token; leaves db keys unchanged. */
@@ -927,8 +931,9 @@ declare function initProject(options: InitOptions): void;
  * this is an identity hint, never a password or session credential.
  * @param options.requestGrant Ignore ambient/cached credentials and request a
  * fresh owner-reviewed app.manage grant for this exact app.
- * @param options.pushSecrets Preflight Wrangler, then push each env's configured
- *   Worker secrets immediately after credential provisioning.
+ * @param options.pushSecrets Preflight Wrangler, then stage one target-bound
+ *   credential set through the handshake-authorized Registry and transfer it
+ *   to the Worker over stdin without writing plaintext under `.odla`.
  * @param options.writeDevVars `true`/a path writes `.dev.vars`; `writeCredentials: false` skips the creds file.
  * @param options.yes Required for a non-dry-run plan containing `prod` or
  *   `production`; callers must show and review `dryRun` output first.
@@ -1248,9 +1253,10 @@ declare function installSkill(options?: SkillInstallOptions): SkillInstallResult
 
 /**
  * Verify a live, already-provisioned environment end-to-end. Resolves the target
- * env (`options.env`, else `dev`, else the first declared env) and requires it to
- * be declared in the config. Reads the local credentials file and checks that it
- * belongs to this app and holds the credentials required by the enabled
+ * env (`options.env`, else `dev`, else the first declared env). Explicit `prod`
+ * remains addressable after one-shot `provision --live` even when ordinary
+ * provision defaults stay dev-only. Reads the local credentials file and checks
+ * that it belongs to this app and holds the credentials required by the enabled
  * services — otherwise it throws pointing the user at
  * `odla-ai provision --write-dev-vars`.
  *

package/dist/index.d.ts

@@ -572,6 +572,10 @@ interface LocalCredentials {
 /** Controls one dev-first provisioning run; production mutation requires `yes`. */
 interface ProvisionOptions {
     configPath: string;
+    /** Initialize only the live (`prod`) environment of an existing sandbox
+     * app, even when the dev-first project config has not added `prod` to
+     * `envs` yet. The normal production `yes` gate still applies. */
+    live?: boolean;
     dryRun?: boolean;
     rotateKeys?: boolean;
     /** Rotate only the o11y ingest token; leaves db keys unchanged. */
@@ -927,8 +931,9 @@ declare function initProject(options: InitOptions): void;
  * this is an identity hint, never a password or session credential.
  * @param options.requestGrant Ignore ambient/cached credentials and request a
  * fresh owner-reviewed app.manage grant for this exact app.
- * @param options.pushSecrets Preflight Wrangler, then push each env's configured
- *   Worker secrets immediately after credential provisioning.
+ * @param options.pushSecrets Preflight Wrangler, then stage one target-bound
+ *   credential set through the handshake-authorized Registry and transfer it
+ *   to the Worker over stdin without writing plaintext under `.odla`.
  * @param options.writeDevVars `true`/a path writes `.dev.vars`; `writeCredentials: false` skips the creds file.
  * @param options.yes Required for a non-dry-run plan containing `prod` or
  *   `production`; callers must show and review `dryRun` output first.
@@ -1248,9 +1253,10 @@ declare function installSkill(options?: SkillInstallOptions): SkillInstallResult
 
 /**
  * Verify a live, already-provisioned environment end-to-end. Resolves the target
- * env (`options.env`, else `dev`, else the first declared env) and requires it to
- * be declared in the config. Reads the local credentials file and checks that it
- * belongs to this app and holds the credentials required by the enabled
+ * env (`options.env`, else `dev`, else the first declared env). Explicit `prod`
+ * remains addressable after one-shot `provision --live` even when ordinary
+ * provision defaults stay dev-only. Reads the local credentials file and checks
+ * that it belongs to this app and holds the credentials required by the enabled
  * services — otherwise it throws pointing the user at
  * `odla-ai provision --write-dev-vars`.
  *

package/dist/index.js

@@ -56,7 +56,7 @@ import {
   startHostedSecurityJob,
   surfacePaths,
   validateInvocation
-} from "./chunk-STJCWZJU.js";
+} from "./chunk-PPSXHZJI.js";
 import {
   exitCodeFor,
   redactSecrets