@odla-ai/cli 0.29.0 → 0.30.1

package/README.md

@@ -482,8 +482,8 @@ commands continue to default to the sandbox.
 `provision` performs the standard safe setup flow:
 
 When using `--push-secrets`, create the Worker and its Wrangler config first.
-The CLI checks that config and `wrangler whoami` before it issues or rotates a
-shown-once credential.
+The CLI checks that config and `wrangler whoami` before it issues a shown-once
+credential set.
 
 1. Gets an `odla_dev_...` token by email-bound device handshake, or reuses
    `ODLA_DEV_TOKEN` / `.odla/dev-token.json`. A fresh handshake requires
@@ -511,18 +511,19 @@ shown-once credential.
    and attempts to open it — including from CI, SSH, display-less, scripted,
    and agent-driven shells. Only `--no-open` suppresses the attempt. Browser
    launch is best-effort: an agent with browser control must open that exact URL
-   immediately; otherwise it gives the URL to the human verbatim. The started
-   handshake is persisted privately under `.odla/`, so a
-   run killed before approval loses nothing: rerunning resumes the same code.
-   Outside an interactive terminal the approval wait is capped (90 seconds by
-   default; `--wait <seconds>` overrides), and a still-pending handshake exits
-   with code 75 — approve at the URL, then re-run to collect the token.
+   immediately; otherwise it gives the URL to the human verbatim. The device
+   code stays only in the running process. Outside an interactive terminal the
+   approval wait is capped (90 seconds by default; `--wait <seconds>`
+   overrides), and a still-pending handshake exits with code 75. Rerunning
+   always requests and opens a new code; it never resumes an older request from
+   `.odla/`.
 2. Creates the platform app if needed. For a new id, this consumes the exact-id
    reservation approved in step 1; it is not ambient project-creation authority.
 3. Enables configured services in every configured environment. Calendar
    config is normalized per env and fixed to Google read-only access.
-4. Mints or reuses each env's configured service credentials: an odla-db app
-   key for `db` and an ingest token for `o11y`.
+4. For local development, mints or reuses that developer's configured service
+   credentials. Multiple developers may hold independent DB/o11y credentials
+   for the same shared sandbox tenant.
 5. Collision-checks and merges declared integration schema/rule fragments,
    pushes the composed database contract, and creates integration seeds only
    when their natural-key rows are absent.
@@ -533,23 +534,53 @@ shown-once credential.
    exact Google OAuth endpoint (or a same-platform interstitial). The human completes consent there;
    provision follows the exact attempt through initial sync. OAuth codes and
    refresh tokens never enter the CLI, repo, chat, or app.
-8. Writes `.odla/credentials.local.json` with mode `0600`.
+8. Local-only provisioning writes `.odla/credentials.local.json` with mode
+   `0600`. A deployment run with `--push-secrets` does not write runtime
+   credential plaintext there.
 9. With `--write-dev-vars`, writes the local Worker values to `.dev.vars`; with
-   `--push-secrets`, transfers the configured service secrets to the matching
-   deployed Worker environment over Wrangler stdin.
-
-Plain reruns are idempotent. Pass `--rotate-o11y-token` only when deliberately
-invalidating and replacing the o11y token; combine it with `--push-secrets` so
-the replacement reaches the Worker in the same run. `--rotate-keys` remains the
-broader credential rotation. Production mutation or secret transfer requires
-`--yes`. Pass `--no-write-credentials` to skip writing the local credentials
-file; it cannot be combined with an operation that would issue a shown-once
-credential.
-
-Rotation and Wrangler secret replacement are not a distributed transaction.
-The CLI preflights Wrangler first and persists the replacement before pushing;
-if that final push still fails, follow the printed `secrets push --env ...`
-retry. Do not run the rotation flag again.
+   `--push-secrets`, binds a fresh additive credential set to the exact
+   Cloudflare account/script/environment, transfers both values in one
+   `wrangler secret bulk` stdin payload, and commits a receipt. A failed push
+   aborts the session and revokes partial issuance.
+
+Plain reruns are idempotent at the tenant/configuration layer. Each deployment
+receives new, independently revocable runtime credentials; it never rotates a
+sibling developer or Worker. `--rotate-o11y-token` remains a destructive legacy
+recovery operation for locally cached credentials, and `--rotate-keys` remains
+the broader local rotation. Neither rotation flag may be combined with
+`--push-secrets`. Production mutation or secret transfer requires
+`--yes`. `--no-write-credentials` is valid with `--push-secrets` because the
+deployment path is memory-only by design.
+
+Registry staging and Wrangler installation use a short-lived receipt protocol.
+The CLI preflights the exact target, issues additive credentials, sends one
+bulk payload, and commits only after Wrangler succeeds. Failure revokes staged
+credentials; retrying creates a new bounded session and never invalidates a
+working sibling runtime.
+
+Inventory and retire one successful deployment without disturbing any sibling:
+
+```sh
+npx @odla-ai/cli credentials list --env dev
+npx @odla-ai/cli credentials revoke <receipt-id>
+```
+
+The inventory contains only receipt, target, state, and timestamp metadata.
+Revocation uses the receipt's exact DB and o11y credential ids; no value is
+retrieved or rotated.
+
+Verify a deployment that intentionally keeps db/o11y credentials only on the
+Worker:
+
+```sh
+npx @odla-ai/cli smoke --env dev --runtime
+```
+
+Runtime smoke never reads `.odla/credentials.local.json`. It checks Registry
+public config, the configured Worker link, anonymous integration probes, and
+owner-visible calendar health. Direct schema and aggregate reads remain part
+of ordinary local-credential smoke because a runtime credential is deliberately
+not retrievable from the Worker.
 
 ### Application capability integrations
 
@@ -797,9 +828,10 @@ in an agent's transcript. It preflights `wrangler whoami` and the presence of a
 wrangler config file. The env `prod`/`production` targets the top-level
 wrangler environment (no `--env` flag is passed to Wrangler) and requires
 `--yes`; every other env maps to `wrangler --env <name>`. `--dry-run` prints a
-redacted plan without spawning anything. For the normal path, use
-`provision --write-dev-vars --push-secrets` so service enablement, credential
-issuance, local config, and deployed secret transfer stay one composition.
+redacted plan without spawning anything. It is only for an already-saved local
+credential. For a new Worker or a lost local plaintext, use
+`provision --push-secrets`: the handshake authorizes new target-bound
+credentials and no local production cache is required.
 
 `secrets set <name> --env <env>` stores one named secret in that env's tenant
 vault — the same write-only slot Studio's Secrets panel fills (for example