@odla-ai/cli 0.46.12 → 0.48.1

package/dist/index.d.cts

@@ -68,8 +68,16 @@ interface CodeBuildRule {
     pids?: number;
     tmpfsBytes?: number;
 }
-/** Initial dependency-free dogfood recipe. App-registered catalogs can replace
- * this once their owner-visible registration contract exists. */
+/** Dependency-free dogfood recipes. App-registered catalogs can replace these
+ * once their owner-visible registration contract exists.
+ *
+ * `odla-code-gates` is what stops a correct change reaching a draft pull
+ * request with red CI. Every recipe here runs inside `verifyCodeCandidate`, and
+ * a non-zero exit leaves the checkpoint `candidate_untrusted`, which
+ * `submitCodeCandidate` refuses to publish -- so registering the repository's
+ * own gates as a recipe is the whole enforcement. See PM bug c775485c: PR #684
+ * was a correct fix that failed check:loc by two lines, 284 milliseconds of
+ * work that first ran on GitHub after the authoring session had ended. */
 declare const CODE_BUILD_RECIPES: readonly CodeBuildRule[];
 
 /** Supported local isolation engines for an odla Code host runtime. */

package/dist/index.d.ts

@@ -68,8 +68,16 @@ interface CodeBuildRule {
     pids?: number;
     tmpfsBytes?: number;
 }
-/** Initial dependency-free dogfood recipe. App-registered catalogs can replace
- * this once their owner-visible registration contract exists. */
+/** Dependency-free dogfood recipes. App-registered catalogs can replace these
+ * once their owner-visible registration contract exists.
+ *
+ * `odla-code-gates` is what stops a correct change reaching a draft pull
+ * request with red CI. Every recipe here runs inside `verifyCodeCandidate`, and
+ * a non-zero exit leaves the checkpoint `candidate_untrusted`, which
+ * `submitCodeCandidate` refuses to publish -- so registering the repository's
+ * own gates as a recipe is the whole enforcement. See PM bug c775485c: PR #684
+ * was a correct fix that failed check:loc by two lines, 284 milliseconds of
+ * work that first ran on GitHub after the authoring session had ended. */
 declare const CODE_BUILD_RECIPES: readonly CodeBuildRule[];
 
 /** Supported local isolation engines for an odla Code host runtime. */

package/dist/index.js

@@ -56,7 +56,7 @@ import {
   startHostedSecurityJob,
   surfacePaths,
   validateInvocation
-} from "./chunk-Q4BGAUEH.js";
+} from "./chunk-BD5KIG63.js";
 import {
   exitCodeFor,
   redactSecrets

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@odla-ai/cli",
-  "version": "0.46.12",
+  "version": "0.48.1",
   "description": "Agent-operable CLI for odla provisioning, calendar consent and connection lifecycle, System AI administration, Worker secrets, security jobs, and smoke checks.",
   "license": "MIT",
   "homepage": "https://odla.ai/docs/packages/cli",
@@ -58,9 +58,9 @@
     "prepublishOnly": "npm run build"
   },
   "dependencies": {
-    "@odla-ai/ai": "0.17.0",
-    "@odla-ai/apps": "0.12.3",
-    "@odla-ai/brand": "0.7.1",
+    "@odla-ai/ai": "0.17.1",
+    "@odla-ai/apps": "0.14.0",
+    "@odla-ai/brand": "0.8.0",
     "@odla-ai/db": "0.13.0",
     "@odla-ai/security": "0.3.3"
   },

package/skills/odla/references/sdks.md

@@ -258,6 +258,11 @@ Web-standard APIs only — no Node built-ins, no `cloudflare:workers`.
   projects -> goals, kanban tasks, decisions, bugs, and versioned runbooks, on
   odla-db and shared across co-owned projects. Usually driven through
   `odla-ai pm ...` rather than the library.
+- **@odla-ai/promotion** — pure content-release contract: package-owned
+  adapters emit canonical artifacts, provenance, explicit exclusions, and
+  target preconditions; shared tooling validates their exact SHA-256-bound
+  bytes and computes a read-only target diff. It never reads providers,
+  approves a release, or applies a mutation.
 - **@odla-ai/brand** — conversational brand-book builder: doc/image uploads,
   agent-driven colour exploration with human-gated palette proposals, and a
   compiler from the approved book to `@odla-ai/ui` design tokens.