@odla-ai/cli 0.30.0 → 0.30.1

package/dist/index.d.cts

@@ -594,9 +594,8 @@ interface ProvisionOptions {
      * true records an explicit request; false is the only production suppression. */
     open?: boolean;
     /** Cap the handshake-approval wait, in seconds. When it elapses the command
-     * exits with the pending handshake persisted; rerunning resumes it. Defaults
-     * to the handshake's own expiry on an interactive terminal and 90 seconds
-     * everywhere else (agent tool shells kill long-running commands). */
+     * exits pending; rerunning requests a new code. Defaults to the handshake's
+     * own expiry on an interactive terminal and 90 seconds everywhere else. */
     wait?: number;
     /** Test/embedding override for opening the approval URL. Defaults to the OS browser opener. */
     openApprovalUrl?: (url: string) => Promise<void>;
@@ -629,6 +628,8 @@ interface ProvisionPlan {
 interface SmokeOptions {
     configPath: string;
     env?: string;
+    /** Verify the deployed Worker without reading local db/o11y credentials. */
+    runtime?: boolean;
     /** Developer-token override used only for owner-visible calendar health. */
     token?: string;
     /** Existing odla account email used only when a fresh device handshake is required. */
@@ -1255,10 +1256,10 @@ declare function installSkill(options?: SkillInstallOptions): SkillInstallResult
  * Verify a live, already-provisioned environment end-to-end. Resolves the target
  * env (`options.env`, else `dev`, else the first declared env). Explicit `prod`
  * remains addressable after one-shot `provision --live` even when ordinary
- * provision defaults stay dev-only. Reads the local credentials file and checks
- * that it belongs to this app and holds the credentials required by the enabled
- * services — otherwise it throws pointing the user at
- * `odla-ai provision --write-dev-vars`.
+ * provision defaults stay dev-only. Local mode reads the private service
+ * credentials and performs direct db checks. `runtime` mode never reads those
+ * values: it verifies Registry state, the deployed Worker link, anonymous
+ * integration probes, and owner-visible calendar health instead.
  *
  * It then makes service-aware network calls: fetches the registry public-config
  * (and, when `ai.provider` is configured, asserts the live provider matches);

package/dist/index.d.ts

@@ -594,9 +594,8 @@ interface ProvisionOptions {
      * true records an explicit request; false is the only production suppression. */
     open?: boolean;
     /** Cap the handshake-approval wait, in seconds. When it elapses the command
-     * exits with the pending handshake persisted; rerunning resumes it. Defaults
-     * to the handshake's own expiry on an interactive terminal and 90 seconds
-     * everywhere else (agent tool shells kill long-running commands). */
+     * exits pending; rerunning requests a new code. Defaults to the handshake's
+     * own expiry on an interactive terminal and 90 seconds everywhere else. */
     wait?: number;
     /** Test/embedding override for opening the approval URL. Defaults to the OS browser opener. */
     openApprovalUrl?: (url: string) => Promise<void>;
@@ -629,6 +628,8 @@ interface ProvisionPlan {
 interface SmokeOptions {
     configPath: string;
     env?: string;
+    /** Verify the deployed Worker without reading local db/o11y credentials. */
+    runtime?: boolean;
     /** Developer-token override used only for owner-visible calendar health. */
     token?: string;
     /** Existing odla account email used only when a fresh device handshake is required. */
@@ -1255,10 +1256,10 @@ declare function installSkill(options?: SkillInstallOptions): SkillInstallResult
  * Verify a live, already-provisioned environment end-to-end. Resolves the target
  * env (`options.env`, else `dev`, else the first declared env). Explicit `prod`
  * remains addressable after one-shot `provision --live` even when ordinary
- * provision defaults stay dev-only. Reads the local credentials file and checks
- * that it belongs to this app and holds the credentials required by the enabled
- * services — otherwise it throws pointing the user at
- * `odla-ai provision --write-dev-vars`.
+ * provision defaults stay dev-only. Local mode reads the private service
+ * credentials and performs direct db checks. `runtime` mode never reads those
+ * values: it verifies Registry state, the deployed Worker link, anonymous
+ * integration probes, and owner-visible calendar health instead.
  *
  * It then makes service-aware network calls: fetches the registry public-config
  * (and, when `ai.provider` is configured, asserts the live provider matches);

package/dist/index.js

@@ -56,7 +56,7 @@ import {
   startHostedSecurityJob,
   surfacePaths,
   validateInvocation
-} from "./chunk-PPSXHZJI.js";
+} from "./chunk-7V7WVTDT.js";
 import {
   exitCodeFor,
   redactSecrets

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@odla-ai/cli",
-  "version": "0.30.0",
+  "version": "0.30.1",
   "description": "Agent-operable CLI for odla provisioning, calendar consent and connection lifecycle, System AI administration, Worker secrets, security jobs, and smoke checks.",
   "license": "MIT",
   "homepage": "https://odla.ai/docs/packages/cli",

package/skills/odla/SKILL.md

@@ -113,9 +113,8 @@ guessing which platform/credential steps need manual work. Then:
    control, open that exact URL now.** If you do not, give it to the human
    verbatim; never wait silently or start a substitute handshake. Outside an
    interactive terminal the wait is capped (90s default,
-   `--wait <seconds>`); exit code 75 means still pending: the handshake is
-   persisted, so once the human approves, re-run the same command and it
-   resumes the same code and collects the token. It creates the app,
+   `--wait <seconds>`); exit code 75 means still pending. The device code is
+   not cached: rerunning always opens a fresh code for human review. It creates the app,
    consuming a one-time exact-id reservation when the approved app is new,
    enables services, issues or reuses configured credentials (db key + o11y
    ingest token when enabled), composes declared integration schema/rules and
@@ -280,7 +279,10 @@ If approval is not available, comment on the runbook instead so an admin can fix
 it later.
 
 `npx @odla-ai/cli doctor` is an offline config check anytime;
-`npx @odla-ai/cli smoke --env dev` verifies a live deployment.
+`npx @odla-ai/cli smoke --env dev` verifies a live deployment from local
+service credentials. After `provision --push-secrets`, use
+`npx @odla-ai/cli smoke --env dev --runtime`; it verifies the Worker and
+anonymous integration routes without retrieving its db/o11y secrets.
 Use `calendar status --json` for safe connection state (`bookable`, booking
 and availability calendars) and `calendar calendars --json` to discover ids
 after consent; update checked-in config and re-provision. Disconnect always