Live changes (push --live)

Themes, workflows and pages have a draft: push writes there, and visitors see it only when you publish. The things below have no draft: visitors see them the moment they are written.

So a plain push skips them, each with SKIPPED changes the live site at once — `webmati push --live` shows the server's plan and asks first.

See the plan, then send it

webmati push --live --dry-run    # only show the server's plan; nothing is written
webmati push --live              # show the plan, then ask "Send these N live change(s) now? [y/N]"

The server computes the plan (a real dry run on the current data), with a diff of every file:

Live changes — visitors see these the moment they are written:
  WOULD_APPLY PUT    redirects    /old
  REJECTED    PUT    table        bookings  ⚠️ loses data — loses existing data — needs --allow-destructive

--yes skips the question (for a script that already read the plan). With --json the CLI cannot ask, so it takes --live --dry-run or --live --yes only.

Changes that lose data: --allow-destructive

Deleting a table, dropping a column or changing a column's type loses the data in it. The plan marks them ⚠️ loses data, and if there is even one, the whole set of live changes stops before anything is written (exit code 3; the other items report NOT_APPLIED). Only when you are sure:

webmati push --live --allow-destructive

For coding agents

An agent should add --allow-destructive only when you asked for exactly that change, after reading the plan. The project's AGENTS.md tells it so.

Secrets

Secrets have no file to push. Set or replace a value with the tool:

webmati tool call set_backend_secret --json '{"code":"STRIPE_KEY","value":"sk_live_…"}'

The value is sealed and can never be read back, not even in the admin.