@odla-ai/cli 0.10.0 → 0.10.2

package/llms.txt

@@ -1,1221 +0,0 @@
-# @odla-ai/cli — LLM context
-
-> Agent-operable CLI for odla provisioning, calendar consent and sync lifecycle, System AI administration, Worker secrets, security jobs, and smoke checks.
-
-> ⚠️ **Early access — pre-1.0.** Agents work from bounded runbooks; humans
-> approve credentials, production changes, releases, and merges. APIs and exact
-> package availability can change. Review the documented guarantees and
-> limitations; this software is MIT-licensed and provided without warranty.
-
-Project-neutral provisioning CLI for odla apps. It creates and validates an
-`odla.config.mjs`, then uses that config to register an app, enable services,
-push odla-db schema/rules, configure per-app BYOK AI, configure Clerk auth, record
-deployment links, connect read-only Google Calendar mirrors, provision o11y ingest credentials, and transfer local or
-deployed Worker secrets without printing them. It also gives platform admins a
-scoped System AI control surface and gives app owners a provider-key-free
-hosted security command.
-
-It does not know about any specific app. App identity, environments, services,
-schema, rules, auth, AI provider, and links all come from config.
-
-## Install
-
-No install needed — the package ships a single `odla-ai` binary, so npx can run
-it directly:
-
-```bash
-npx @odla-ai/cli init --app-id my-app --name "My App"
-```
-
-For a project you keep working in, install it as a dev dependency so the
-shorter `npx odla-ai` form works and the version is pinned by your lockfile:
-
-```bash
-npm view @odla-ai/cli@0.10.0 version
-npm i -D --save-exact @odla-ai/cli@0.10.0
-```
-
-## Prerequisites
-
-- Node.js 20 or newer (`node --version`).
-- odla apps usually deploy as Cloudflare Workers. If you have never used
-  Cloudflare:
-  1. Create a free account at <https://dash.cloudflare.com/sign-up>.
-  2. You do not need to install anything: `npx wrangler login` opens the
-     browser once to link your account, `npx wrangler dev` runs a Worker
-     locally, and `npx wrangler deploy` ships it.
-  3. The `.dev.vars` file this CLI writes with `provision --write-dev-vars` is
-     wrangler's local secrets file — `wrangler dev` picks it up automatically.
-     It is chmod `0600` and gitignored; never commit it or paste its contents
-     into `wrangler.toml`.
-
-## Commands
-
-```bash
-npx odla-ai setup
-npx odla-ai init --app-id my-app --name "My App"
-npx odla-ai doctor
-npx odla-ai calendar status --env dev
-npx odla-ai calendar calendars --env dev
-npx odla-ai calendar connect --env dev
-npx odla-ai calendar resync --env dev
-npx odla-ai calendar disconnect --env dev --yes
-npx odla-ai capabilities --json
-# install SDKs, write the Worker, and create wrangler.jsonc before secret push
-npx odla-ai provision --dry-run
-npx odla-ai provision --write-dev-vars --push-secrets
-npx odla-ai smoke --env dev
-npx odla-ai secrets push --env dev
-npx odla-ai secrets set clerk_webhook_secret --env dev --stdin
-npx odla-ai secrets set-clerk-key --env dev --from-env CLERK_SECRET_KEY
-npx @odla-ai/cli security run . --env dev --ack-redacted-source
-npx @odla-ai/cli security github connect --env dev # infers owner/name from git origin
-npx @odla-ai/cli security plan --env dev
-npx @odla-ai/cli security sources --env dev
-npx @odla-ai/cli security run --source <source-id> --ref main --env dev --plan-digest <digest-from-security-plan> --ack-redacted-source
-npx @odla-ai/cli security status <job-id>
-npx @odla-ai/cli security report <job-id>
-npx odla-ai admin ai show
-npx odla-ai admin ai models
-npx odla-ai admin ai set security --discovery-provider anthropic --discovery-model claude-opus-4-8 --validation-provider openai --validation-model gpt-5.5 --enabled
-npx odla-ai admin ai credentials
-npx odla-ai admin ai credential set anthropic --from-env ANTHROPIC_API_KEY
-npx odla-ai admin ai usage --app-id my-app --env prod --limit 50
-npx odla-ai admin ai audit --limit 25
-npx odla-ai skill install
-npx odla-ai version
-```
-
-`init` writes:
-
-- `odla.config.mjs`
-- `src/odla/schema.mjs`
-- `src/odla/rules.mjs`
-- `.gitignore` entries for local credentials
-
-New configs contain only the `dev` environment. Add `prod` explicitly after
-the development flow is healthy; `provision` refuses to mutate `prod` or
-`production` without `--yes` and supports `--dry-run` for review.
-
-`provision` performs the standard safe setup flow:
-
-When using `--push-secrets`, create the Worker and its Wrangler config first.
-The CLI checks that config and `wrangler whoami` before it issues or rotates a
-shown-once credential.
-
-1. Gets an `odla_dev_...` token by device handshake, or reuses
-   `ODLA_DEV_TOKEN` / `.odla/dev-token.json`.
-   In an interactive terminal it opens the approval page in your browser when
-   the code is displayed. Pass `--open` to force browser launch from a
-   non-interactive shell, or `--no-open` to suppress it. Browser launch is
-   best-effort; the printed URL and code always remain the fallback.
-2. Creates the platform app if needed.
-3. Enables configured services in every configured environment. Calendar
-   intent is normalized per env and fixed to Google read-only access.
-4. Mints or reuses each env's configured service credentials: an odla-db app
-   key for `db` and an ingest token for `o11y`.
-5. Pushes the configured schema and rules.
-6. Configures platform AI and stores provider keys in the tenant vault when the
-   configured key env var is set.
-7. With calendar enabled, starts a separate state-bound Google consent attempt
-   when needed and follows it through initial sync. The human completes OAuth;
-   codes and tokens never enter the CLI, repository, chat, or app.
-8. Writes `.odla/credentials.local.json` with mode `0600`.
-9. With `--write-dev-vars`, writes the local Worker values to `.dev.vars`; with
-   `--push-secrets`, transfers the configured service secrets to the matching
-   deployed Worker environment over Wrangler stdin.
-
-Plain reruns are idempotent. Pass `--rotate-o11y-token` only when deliberately
-invalidating and replacing the o11y token; combine it with `--push-secrets` so
-the replacement reaches the Worker in the same run. `--rotate-keys` remains the
-broader credential rotation. Production mutation or secret transfer requires
-`--yes`. Pass `--no-write-credentials` to skip writing the local credentials
-file; it cannot be combined with an operation that would issue a shown-once
-credential.
-
-Rotation and Wrangler secret replacement are not a distributed transaction.
-The CLI preflights Wrangler first and persists the replacement before pushing;
-if that final push still fails, follow the printed `secrets push --env ...`
-retry. Do not run the rotation flag again.
-
-`smoke` verifies a provisioned environment from local credentials. It fetches
-the platform public config, checks the configured AI provider, fetches the live
-odla-db schema with the tenant key, compares expected schema entities, and runs
-a count aggregate against the first entity. It fails early with a clear message
-when provisioning has not written `.odla/credentials.local.json`.
-
-### Read-only Google Calendar
-
-Calendar is a platform-custodied connector, not a Google credential stored by
-the application. Enable both `db` and `calendar`, configure calendar ids and an
-optional public Appointment Schedule `bookingPageUrl` per environment, then run
-normal provision. The first run has two human checkpoints: the odla device code
-establishes app-owner authority, then Google grants read-only Calendar scopes.
-
-`calendar status --json` returns the safe connection/sync projection.
-`calendar calendars --json` lists ids visible after consent; update checked-in
-config and re-provision. A resulting `needs_sync` state reuses the installed
-provider credential and resyncs without another OAuth attempt; an existing
-authorization or initial sync is awaited rather than duplicated. `calendar
-resync` requests an immediate sync, while
-`calendar disconnect --yes` stops watches and deletes this app/environment
-connection's encrypted platform token and cursors without purging retained
-mirror rows, which therefore become stale. It does not revoke the shared
-user-to-Google-OAuth-project grant, because that could invalidate other odla
-connections for the same user. A future explicitly global revoke command would
-need cross-connection accounting and warning. Production resync requires the
-CLI's explicit `--yes` checkpoint, and disconnect always requires it. None of
-these commands accepts a Google code, client secret, access token, or refresh
-token.
-
-The application uses its existing server-side `ODLA_ENDPOINT`, `ODLA_TENANT`,
-and `ODLA_API_KEY`; calendar adds no app Worker secret. Never expose the app key
-to a browser. Provider write actions are outside this read-only slice.
-
-These commands operate the current read/embed reconciliation slice. The CLI has
-no native slot-picker or create/reschedule/cancel command, and exposes no
-rolling-window/age-out, quota-backoff, retention/purge, or provider-derived
-mutation-id control. Public health remains aggregate rather than per calendar.
-
-The bundled build/migration skills add a passive pre-ship gate with
-`@odla-ai/security`: after the exact-version availability check, run
-`npm i -D --save-exact @odla-ai/security@0.2.2`, then
-`npx odla-security scan . --profile odla --out .odla/security/pre-ship --fail-on high --fail-on-candidates critical`.
-The passive scan remains a separate binary: it makes no model calls and does
-not execute target code. After explicit redacted-source approval,
-`odla-ai security run . --env dev --ack-redacted-source` adds hosted discovery
-and independent validation. The CLI obtains/reuses app-owner auth and the
-platform supplies bounded role grants; it never requests provider keys.
-The CLI schedules within those grants: recon consumes one discovery call,
-first-pass hunts are capped before retries, and validation handles the
-highest-risk candidates first. Used/skipped role calls appear in the summary
-and report. Budget-limited coverage is explicitly incomplete and still fails
-the default gate unless `--allow-incomplete` is supplied after review.
-All hosted-security network calls target the configured odla platform origin.
-The CLI transmits typed redacted security operations only and never contacts a
-model-provider host; odla.ai owns the prompts/schemas, route, credential,
-provider call, attribution, and receipt. Cached/environment tokens are bound to
-their canonical platform audience and are rejected before disclosure on a
-different origin. For a non-default platform, set the matching
-`ODLA_DEV_TOKEN_AUDIENCE` with `ODLA_DEV_TOKEN`.
-Early-access run ceilings are rolling. A platform-ceiling `429` always carries
-a conservative `Retry-After`. A provider-side `429` uses the sanitized
-`provider_rate_limited` code after the provider SDK's bounded retries and
-carries a bounded `Retry-After` only when the upstream supplied one. The CLI
-does not echo arbitrary response text or silently change the admin-selected
-model.
-Before installing the exact release, require
-`npm view @odla-ai/security@0.2.2 version` to succeed before installation. An
-exact-version `E404` means the release is unavailable, not that the security
-preflight passed, and does not prove the package name is absent. odla's own
-engineering environment uses an equivalent internal gate; customer projects
-should use the published `odla-security` command above.
-
-For a server-side, commit-pinned review, connect one repository through odla's
-GitHub App. Contents and Metadata access are read-only; optional Checks write
-access publishes only a best-effort summary. The CLI infers `owner/name` from a
-safe GitHub HTTPS or SSH `origin`; pass `--repo owner/name` when it cannot. It
-opens GitHub's installation/authorization page and polls that exact odla
-attempt. Finish each browser stage within its displayed 15-minute window:
-
-```bash
-npx @odla-ai/cli security github connect --env dev
-npx @odla-ai/cli security plan --env dev
-npx @odla-ai/cli security sources --env dev
-npx @odla-ai/cli security run --source <source-id> --ref main --env dev --plan-digest <digest-from-security-plan> --ack-redacted-source
-```
-
-The source job follows by default, renders the normalized report, and applies
-the same confirmed/candidate/incomplete gates; `--no-follow` only enqueues.
-`security status` and `security report` inspect prior jobs, while `security
-github disconnect --source <source-id> --env dev --yes` revokes the saved
-source without requiring a GitHub-side uninstall. A source id belongs to one
-app/environment; reconnect separately for another environment. Disconnect
-cancels nonterminal work, while terminal reports remain until normal expiry.
-The App is not subscribed to Push; an unexpectedly delivered Push event is
-ignored and never starts a job. Source jobs default to `cloudflare-app`;
-local-path jobs default to `odla`.
-
-Clients send only an opaque odla source id, ref, profile, and explicit redacted
-disclosure acknowledgement—never a PAT, installation id, provider key, or
-provider/model selection override. The CLI deliberately displays the read-only
-route identities in the consent preflight. odla.ai verifies access, pins the ref to a commit SHA,
-fetches the bounded snapshot server-side, and uses the admin-selected System AI
-routes. `security plan` shows both provider/model routes, exact policy
-revisions and bounds, prompt/redaction/report contracts, readiness, retention,
-and the no-execution boundary before consent. Each job requires
-`--plan-digest` and binds acknowledgement to that complete digest; any covered
-change requires a refreshed plan and acknowledgement.
-
-After validating that plan digest, the CLI fetches and prints the atomic
-server-authored execution intent for the exact app/environment, opaque source,
-ref (or default branch), profile, redacted disclosure, and plan digest. Its
-`executionDigest` is persisted with the job and sent back as
-`expectedExecutionDigest`; a changed selection fails with `intent_conflict`
-instead of running under generic consent. Repository display text is not digest
-authority.
-An omitted `--ref` is canonicalized to the source's current default-branch name
-during preview. A branch-default change before enqueue invalidates the intent
-instead of changing what the Workflow will acquire.
-
-GitHub read access is not disclosure consent. No raw archive, file body, or
-explicit source excerpt is deliberately persisted in the hosted report or
-Workflow checkpoints. The private report may keep bounded,
-best-effort credential-pattern-redacted model-derived prose and repository-relative paths for up to
-90 days; treat it as sensitive because it may reveal source semantics.
-Provider/GitHub terms are separate.
-
-The archive envelope is 16 MiB compressed, 48 MiB decompressed, 20,000 entries,
-10,000 files, 2 MiB per file, and 16 MiB aggregate file bytes. Links, special
-entries, unsafe redirects, duplicate paths, and escaping paths are rejected.
-The combined acquire/analyze step has zero automatic retries; after a terminal
-failure, correct the ref/access/archive shape or wait for service recovery and
-explicitly start a new job.
-
-Checks are optional, best-effort summaries, use fixed conclusion semantics, and
-are not the configurable CLI gate. Target code is not executed. Without an
-injected isolated executor, hosted inference cannot mechanically confirm a
-finding; critical candidates and incomplete coverage remain the operative
-gates, and a clean result is not proof of security.
-
-`admin ai show|models|set|credentials|credential set|usage|audit` manages platform-funded System
-AI (`o11y.triage`, `security.discovery`, `security.validation`). It uses a
-separate, mode-`0600` `.odla/admin-token.local.json` cache. Studio displays the
-exact scope, only an admin can approve it, and it expires after ~15 minutes;
-policy, credential, and usage capabilities are separate and cannot act as the
-approver on ordinary app/db/o11y routes. `admin ai models` reads the server
-catalog. `admin ai set security` updates discovery and independent validation
-together with expected revisions; a concurrent edit returns 409 and reloads
-instead of being overwritten. `admin ai usage` requests its own read-only
-capability and lists metadata-only events and status aggregates; filter by
-`--app-id`, `--env`, `--run-id`, and `--limit`, or emit `--json`. Prompts,
-repository source, model output, reports, and provider credentials are never in
-that response.
-`admin ai audit` uses its own read capability for immutable, metadata-only
-policy and credential change events with actor attribution; credential values
-never enter that trail. Credential writes accept only
-`--from-env <NAME>` or `--stdin` and never place the value in argv, output, or
-the cache. System AI and each app's BYOK AI are separate vault/funding paths.
-Admin bounds can only narrow hard ceilings of 64 calls per role/run and, for
-each call, 512 KiB input and 32,768 output tokens. A non-default platform environment token
-must declare the matching `ODLA_ADMIN_TOKEN_AUDIENCE`.
-
-`secrets push --env <env>` is the narrower recovery/retry command. It moves the
-configured env's odla-db key and/or o11y ingest token from
-`.odla/credentials.local.json` into the deployed Worker by piping each value
-over stdin to `wrangler secret put`; values never appear on argv, in output, or
-in an agent's transcript. It preflights `wrangler whoami` and the presence of a
-wrangler config file. The env `prod`/`production` targets the top-level
-wrangler environment (no `--env` flag is passed to Wrangler) and requires
-`--yes`; every other env maps to `wrangler --env <name>`. `--dry-run` prints a
-redacted plan without spawning anything. For the normal path, use
-`provision --write-dev-vars --push-secrets` so service enablement, credential
-issuance, local config, and deployed secret transfer stay one composition.
-
-`secrets set <name> --env <env>` stores one named secret in that env's tenant
-vault — the same write-only slot Studio's Secrets panel fills (for example
-`clerk_webhook_secret` for synced auth). The value may come only from
-`--from-env <NAME>` or `--stdin`, so a producer command pipes straight into the
-vault without the secret ever appearing on argv, in output, or in an agent's
-transcript; it is encrypted at rest and readable back only by that tenant's
-app API key, never by the CLI, Studio, or the developer token. `$`-prefixed
-names are platform-reserved. `secrets set-clerk-key --env <env>` stores the
-app's Clerk secret key in the reserved `$clerk_secret` slot so the platform can
-resolve the app's users (invites, member lookups); reserved secrets are never
-readable by app keys. It refuses an `sk_test_` key for a prod-named env and
-requires `--yes` to put an `sk_live_` key into a non-prod env, since live users
-would sync into a non-prod tenant. Both commands authenticate with the
-developer token (`$ODLA_DEV_TOKEN`, the cached token, or a fresh device
-approval), and prod-named envs require `--yes`, matching `secrets push`.
-
-## Who does what
-
-If a change is deterministic from `odla.config.mjs`, the CLI owns it: app and
-service enablement, credential issuance and local persistence, `.dev.vars`,
-schema/rules/auth/AI configuration, and Wrangler secret transfer. The coding
-agent owns application semantics: installing `@odla-ai/o11y`, wrapping the
-Worker with `withObservability`, and choosing useful spans, metrics, errors, and
-LLM-usage records. The human owns the device approval, production consent, and
-explicit destructive rotation. Studio is where people view telemetry and
-perform manual recovery, configure System AI, and inspect app/run-attributed
-platform usage; its o11y token control is not the normal setup path.
-Run `npx odla-ai capabilities` for the human-readable contract or add `--json`
-when an agent or tool needs to branch on it without scraping prose.
-
-`setup` (and `skill install`) installs one complete offline runbook bundle at
-`.agents/skills/`, then adds thin native adapters for Claude Code
-(`.claude/skills/`), Codex, Cursor (`.cursor/rules/`), GitHub Copilot
-(`.github/copilot-instructions.md`), Gemini CLI (`GEMINI.md`), and portable
-`AGENTS.md` agents. The default is `--agent all`; select one or more with
-`--agent claude,codex` or repeated `--agent` flags. A global install supports
-the native Claude and Codex roots only.
-
-Existing `AGENTS.md`, `GEMINI.md`, and Copilot instructions are preserved. The
-installer appends a bounded odla-managed section, is idempotent, refuses
-symlink-redirection and locally changed managed content, and lets `--force`
-replace only odla-owned content. The local bundle includes build, migration,
-and observability-debug procedures plus every reference they need; agents do
-not need online docs or access to odla's private service source after setup.
-
-After running setup, the whole prompt can be: “Set up odla in this repo using
-the installed local odla runbook. Decide whether this is a new app or an
-existing site to migrate, then drive it end to end. Ask me only for the device
-approval and other human-only checkpoints.”
-
-For programmatic callers, `installSkill()` keeps `targetDir`, `written`, and
-`unchanged` as one unambiguous primary-root view: the latter two contain paths
-relative to `targetDir` only. Use the additive absolute `writtenPaths` and
-`unchangedPaths` fields to inspect every shared-bundle and adapter artifact.
-
-`doctor` also lints for common footguns: permission rules that are literally
-`"true"` (public writes always warn; a public `view` warns unless the
-namespace is listed in `db.publicRead`), schema entities missing from the
-rules map, credential files (`.dev.vars`, `.odla/*`) tracked by git, a
-wrangler assets directory pointed at the project root or at a directory
-containing `node_modules` (the `wrangler dev` "spawn EBADF" footgun),
-secret-shaped values in wrangler `vars`, and a package.json script literally
-named `deploy` (CI may auto-deploy it).
-
-## Config
-
-```js
-export default {
-  platformUrl: process.env.ODLA_PLATFORM_URL ?? "https://odla.ai",
-  dbEndpoint: process.env.ODLA_ENDPOINT ?? process.env.ODLA_DB_ENDPOINT ?? "https://db.odla.ai",
-  app: { id: "my-app", name: "My App" },
-  envs: ["dev"], // add "prod" deliberately; provisioning it requires --yes
-  services: ["db", "ai", "o11y", "calendar"],
-  db: {
-    schema: "./src/odla/schema.mjs",
-    rules: "./src/odla/rules.mjs",
-    defaultRules: "deny",
-    publicRead: [], // namespaces where a `view: "true"` rule is intentional
-  },
-  ai: {
-    provider: process.env.ODLA_AI_PROVIDER ?? "anthropic",
-    keyEnv: "ANTHROPIC_API_KEY",
-  },
-  calendar: {
-    google: {
-      calendars: { dev: ["primary"] },
-      bookingPageUrl: {
-        dev: "https://calendar.google.com/calendar/appointments/schedules/…",
-      },
-      match: {
-        summaryPrefix: "Intro", // optional
-        organizerSelf: true,
-        requireAttendees: true,
-      },
-      attendeePolicy: "full", // or "hashed"
-    },
-  },
-  auth: {
-    // Publishable key (public). Created + pulled by the Clerk CLI (`npx clerk`);
-    // See the installed odla-migrate phase 3. Inline `pk_…` or "$ENV_VAR".
-    clerk: {
-      dev: "$CLERK_PUBLISHABLE_KEY",
-      prod: "$CLERK_PUBLISHABLE_KEY",
-    },
-  },
-  links: {
-    dev: "https://dev.example.com",
-    prod: "https://example.com",
-  },
-};
-```
-
-`db.schema` and `db.rules` may be inline objects, JSON files, or JS modules
-exporting `default`, `schema` / `SCHEMA`, or `rules` / `RULES`.
-
-If schema is present and rules are omitted, `defaultRules: "deny"` generates
-deny-all rules for every schema entity. That is the safe default for Workers
-that mediate reads and writes with an app key.
-
-## API reference (generated from dist/index.d.ts, v0.10.0)
-
-```ts
-import { SecurityReport, PlatformSecurityRun } from '@odla-ai/security';
-import { HostedSecurityJob, GitHubConnectionStatus, GitHubSecuritySource, HostedSecurityIntentResponse, HostedSecurityPlan, HostedSecurityReport, HostedSecurityJobStatus } from '@odla-ai/security/hosted';
-export { GitHubConnectionAttempt, GitHubConnectionStatus, GitHubSecuritySource, HostedSecurityCounts, HostedSecurityCoverage, HostedSecurityIntent, HostedSecurityIntentResponse, HostedSecurityJob, HostedSecurityJobStatus, HostedSecurityPlan, HostedSecurityPlanRoute, HostedSecurityReport, HostedSecurityReportFinding, HostedSecurityRoute } from '@odla-ai/security/hosted';
-
-/** Injectable side-effect boundaries used to run and test the command dispatcher. */
-interface CliDependencies {
-    fetch?: typeof fetch;
-    openUrl?: (url: string) => Promise<void>;
-    pollWait?: (milliseconds: number, signal?: AbortSignal) => Promise<void>;
-    readGitOrigin?: (cwd: string) => Promise<string>;
-    confirm?: (message: string) => Promise<boolean>;
-    stdout?: Pick<typeof console, "log" | "error">;
-}
-/**
- * Parse CLI arguments and dispatch the matching odla command.
- *
- * The dispatcher covers project setup, platform AI administration, hosted and
- * local security, provisioning, smoke checks, skill installation, and secret
- * pushes. It rejects unknown commands, unsupported options, extra positionals,
- * missing values, and errors returned by the selected command.
- *
- * @param argv Argument vector without the node/script prefix.
- * @param dependencies Optional side-effect overrides for embedding and tests.
- */
-declare function runCli(argv?: string[], dependencies?: CliDependencies): Promise<void>;
-
-/** One exact platform scope obtainable through the admin device flow. */
-type ScopedPlatformScope = "platform:ai:policy:read" | "platform:ai:policy:write" | "platform:ai:credential:read" | "platform:ai:credential:write" | "platform:ai:usage:read" | "platform:ai:audit:read" | "platform:security:self";
-/** Inputs for obtaining one short-lived, exact-scope platform device grant. */
-interface ScopedPlatformTokenOptions {
-    platform: string;
-    scope: ScopedPlatformScope;
-    open?: boolean;
-    fetch?: typeof fetch;
-    stdout?: Pick<typeof console, "log">;
-    openApprovalUrl?: (url: string) => Promise<void>;
-    tokenFile?: string;
-}
-/** Obtain/cache one exact platform scope without granting ambient admin. */
-declare function getScopedPlatformToken(options: ScopedPlatformTokenOptions): Promise<string>;
-
-/** Hosted platform purposes whose provider, model, and budgets an admin may route. */
-declare const SYSTEM_AI_PURPOSES: readonly ["o11y.triage", "security.discovery", "security.validation"];
-/** One catalog-validated, platform-funded System AI purpose. */
-type SystemAiPurpose = (typeof SYSTEM_AI_PURPOSES)[number];
-
-/** Inputs for one System AI policy/catalog read, policy update,
- * credential-status read, write-only credential transfer, or metadata-only
- * usage or admin-audit read. Provider values may come only from a named environment variable
- * or stdin. */
-interface AdminAiOptions {
-    action: "show" | "models" | "set" | "credentials" | "credential-set" | "usage" | "audit";
-    purpose?: string;
-    provider?: string;
-    model?: string;
-    enabled?: boolean;
-    maxInputBytes?: number;
-    maxOutputTokens?: number;
-    maxCallsPerRun?: number;
-    platform?: string;
-    token?: string;
-    json?: boolean;
-    open?: boolean;
-    fetch?: typeof fetch;
-    stdout?: Pick<typeof console, "log">;
-    openApprovalUrl?: (url: string) => Promise<void>;
-    credentialProvider?: string;
-    fromEnv?: string;
-    stdin?: boolean;
-    readStdin?: () => Promise<string>;
-    discoveryProvider?: string;
-    discoveryModel?: string;
-    validationProvider?: string;
-    validationModel?: string;
-    /** Optional metadata-only usage filters. */
-    appId?: string;
-    env?: string;
-    runId?: string;
-    limit?: number;
-    /** Separate short-lived admin-token cache; never reuses the app developer-token file. */
-    tokenFile?: string;
-}
-/** Read or update platform-funded AI routing and inspect attributed usage.
- * Authentication is a short-lived,
- * explicitly scoped device grant; ordinary app developer tokens never become
- * platform admins. Credential writes accept values only from a named env var
- * or stdin, transfer them once, and never place them in argv, output, or the
- * scoped-token cache. */
-declare function adminAi(options: AdminAiOptions): Promise<void>;
-
-/** Stable, machine-readable division of work between the CLI, coding agent,
- * human operator, and Studio. Printed by `odla-ai capabilities --json`. */
-declare const CAPABILITIES: {
-    readonly cli: readonly ["register the app and enable configured services per environment", "issue, persist, and explicitly rotate configured service credentials", "write local Worker values and push deployed Worker secrets through Wrangler stdin", "store tenant-vault secrets (including the Clerk webhook secret and reserved Clerk secret key) write-only from stdin or an env var", "push db schema/rules and configure platform AI, auth, and deployment links", "apply read-only Google calendar mirror and public booking-page config, then drive state-bound consent, status, discovery, resync, and disconnect flows", "validate config offline and smoke-test a provisioned db environment", "run app-attributed hosted security discovery and independent validation without provider keys", "connect/revoke source-read-only GitHub sources and drive commit-pinned hosted security jobs without PATs or provider keys", "let admins manage system AI policy and credentials, inspect attributed usage, and read immutable admin changes through separate short-lived capability-only approvals"];
-    readonly agent: readonly ["install and import the selected odla SDKs", "wrap the Worker with withObservability and choose useful telemetry", "make application-specific schema, rules, auth, UI, and migration decisions", "wire @odla-ai/calendar into trusted Worker code and keep the app admin key out of browsers"];
-    readonly human: readonly ["approve the odla device code and one-off third-party logins", "review mirrored calendar/attendee disclosure and complete the server-issued Google consent flow", "consent to production changes with --yes", "request destructive credential rotation explicitly", "review application semantics, security findings, releases, and merges", "approve redacted-source disclosure before hosted security reasoning", "approve GitHub App repository access separately from redacted-snippet disclosure"];
-    readonly studio: readonly ["view telemetry and environment state", "review calendar connection, granted read scope, selected calendars, and sync health without exposing provider tokens", "perform manual credential recovery when the CLI's local shown-once copy is unavailable", "configure system AI purposes and view app/environment/run-attributed usage", "connect/revoke GitHub security sources and inspect ref-to-SHA jobs, routes, retention, coverage, and normalized reports"];
-};
-type Output = Pick<typeof console, "log">;
-/** Print the stable responsibility boundary for humans or agent tooling. */
-declare function printCapabilities(json?: boolean, out?: Output): void;
-
-declare const CALENDAR_STATES: readonly ["not_connected", "authorizing", "needs_sync", "initial_sync", "healthy", "degraded", "disconnected", "failed"];
-type CalendarConnectionState = (typeof CALENDAR_STATES)[number];
-/** Owner-visible, secret-free calendar connection and sync health. */
-interface CalendarStatus {
-    env: string;
-    enabled: boolean;
-    /** True when the platform has provider credentials for this connection. */
-    connected: boolean;
-    provider: "google" | null;
-    status: CalendarConnectionState;
-    access?: "read";
-    calendars: string[];
-    attendeePolicy?: "full" | "hashed";
-    /** True once a booking projection may have established the DB privacy policy. */
-    attendeePolicyLocked?: boolean;
-    bookingPageUrl?: string | null;
-    grantedScopes: string[];
-    attemptId?: string;
-    lastSuccessfulSyncAt?: number;
-    lastFullSyncAt?: number;
-    watchExpiresAt?: number;
-    bookingCount?: number;
-    error?: {
-        code?: string;
-        message?: string;
-    };
-}
-/** One Google calendar the connected identity may select for mirroring. */
-interface AvailableGoogleCalendar {
-    id: string;
-    summary?: string;
-    primary?: boolean;
-    selected?: boolean;
-    accessRole?: "freeBusyReader" | "reader" | "writer" | "owner";
-}
-
-interface CalendarLifecycleOptions {
-    configPath: string;
-    env?: string;
-    token?: string;
-    open?: boolean;
-    interactive?: boolean;
-    yes?: boolean;
-    json?: boolean;
-    fetch?: typeof fetch;
-    stdout?: Pick<typeof console, "log" | "error">;
-    openConsentUrl?: (url: string) => Promise<void>;
-    wait?: (milliseconds: number, signal?: AbortSignal) => Promise<void>;
-    pollTimeoutMs?: number;
-    now?: () => number;
-    signal?: AbortSignal;
-}
-/** Read the owner-visible Google connection and mirror health for one env. */
-declare function calendarStatus(options: CalendarLifecycleOptions): Promise<CalendarStatus>;
-/** List calendars visible to the connected Google identity for config authoring. */
-declare function calendarCalendars(options: CalendarLifecycleOptions): Promise<AvailableGoogleCalendar[]>;
-/** Apply the public booking page setting, then complete Google consent + initial sync. */
-declare function calendarConnect(options: CalendarLifecycleOptions): Promise<CalendarStatus>;
-/** Ask the hosted connector for an immediate incremental/full recovery sync. */
-declare function calendarResync(options: CalendarLifecycleOptions): Promise<CalendarStatus>;
-/** Stop watches and delete this connection's encrypted platform token/cursors
- * without purging the mirror or revoking the shared Google project grant. */
-declare function calendarDisconnect(options: CalendarLifecycleOptions): Promise<CalendarStatus>;
-
-interface RunResult {
-    code: number;
-    stdout: string;
-    stderr: string;
-}
-/** Subprocess seam: injectable in tests, `defaultRunner` in production. */
-type CommandRunner = (cmd: string, args: string[], opts?: {
-    input?: string;
-    cwd?: string;
-}) => Promise<RunResult>;
-
-type OdlaEnvName = string;
-type AppRules = Record<string, {
-    view?: string;
-    create?: string;
-    update?: string;
-    delete?: string;
-}>;
-interface ClerkAuthConfig {
-    publishableKey?: string;
-    audience?: string;
-    mode?: "client" | "full";
-}
-/** Read-only event selection applied by the hosted Google calendar connector. */
-interface GoogleCalendarMatchConfig {
-    /** Mirror only events whose summary begins with this value. */
-    summaryPrefix?: string;
-    /** Require the connected identity to organize the event. Defaults to true. */
-    organizerSelf?: boolean;
-    /** Require at least one attendee. Defaults to true. */
-    requireAttendees?: boolean;
-}
-/** Google Calendar intent. OAuth credentials never belong in this config. */
-interface GoogleCalendarConfig {
-    /** One through ten provider calendar ids to mirror in each odla environment. */
-    calendars: Record<OdlaEnvName, string[]>;
-    /** Public Google Appointment Schedule URL for static embed/link mode. */
-    bookingPageUrl?: Record<OdlaEnvName, string | null>;
-    match?: GoogleCalendarMatchConfig;
-    /** Store normalized attendee addresses, or only SHA-256 match keys. */
-    attendeePolicy?: "full" | "hashed";
-}
-interface CalendarConfig {
-    google: GoogleCalendarConfig;
-}
-/** Canonical, environment-specific config sent to the calendar controller. */
-interface CalendarServiceConfig extends Record<string, unknown> {
-    provider: "google";
-    access: "read";
-    /** Deduplicated provider ids; the hosted connector accepts at most ten. */
-    calendars: string[];
-    match: {
-        organizerSelf: boolean;
-        requireAttendees: boolean;
-        summaryPrefix?: string;
-    };
-    attendeePolicy: "full" | "hashed";
-}
-/** Authored `odla.config.mjs` contract consumed by doctor and provision. */
-interface OdlaProjectConfig {
-    platformUrl?: string;
-    dbEndpoint?: string;
-    app: {
-        id: string;
-        name: string;
-    };
-    envs?: OdlaEnvName[];
-    services?: string[];
-    db?: {
-        /** Inline SerializedSchema, JSON file, or JS module path exporting default/schema. */
-        schema?: unknown;
-        /** Inline rule map, JSON file, or JS module path exporting default/rules. */
-        rules?: AppRules | string;
-        /** Generate deny-all rules from schema when rules are omitted. Defaults to true when schema exists. */
-        defaultRules?: "deny" | false;
-        /** Namespaces where a literal `view: "true"` rule is intentional (public content). */
-        publicRead?: string[];
-    };
-    ai?: {
-        provider?: string;
-        model?: string;
-        /** Env var containing the provider key to store in the platform vault. */
-        keyEnv?: string;
-        /** Vault secret name. Defaults to @odla-ai/ai's provider default. */
-        secretName?: string;
-    };
-    calendar?: CalendarConfig;
-    o11y?: {
-        /** This service's name in the collector. Defaults to the app id. */
-        service?: string;
-        /** Collector base URL. Defaults to https://o11y.odla.ai. */
-        endpoint?: string;
-        /** Release tag stamped on emitted signals. */
-        version?: string;
-    };
-    auth?: {
-        clerk?: Record<OdlaEnvName, ClerkAuthConfig | string | null | undefined>;
-    };
-    links?: Record<OdlaEnvName, string | null | undefined>;
-    local?: {
-        tokenFile?: string;
-        credentialsFile?: string;
-        devVarsFile?: string;
-        gitignore?: boolean;
-    };
-}
-/** Normalized project config with resolved paths, endpoints, envs, and services. */
-interface LoadedProjectConfig extends OdlaProjectConfig {
-    configPath: string;
-    rootDir: string;
-    platformUrl: string;
-    dbEndpoint: string;
-    envs: OdlaEnvName[];
-    services: string[];
-    local: {
-        tokenFile: string;
-        credentialsFile: string;
-        devVarsFile: string;
-        gitignore: boolean;
-    };
-}
-/** Private mode-0600 local state written by provision and never committed. */
-interface LocalCredentials {
-    appId: string;
-    platformUrl: string;
-    dbEndpoint: string;
-    updatedAt: string;
-    envs: Record<string, {
-        tenantId: string;
-        dbKey?: string;
-        o11yToken?: string;
-    }>;
-}
-/** Controls one dev-first provisioning run; production mutation requires `yes`. */
-interface ProvisionOptions {
-    configPath: string;
-    dryRun?: boolean;
-    rotateKeys?: boolean;
-    /** Rotate only the o11y ingest token; leaves db keys unchanged. */
-    rotateO11yToken?: boolean;
-    /** Push configured Worker secrets to every configured env after provisioning. */
-    pushSecrets?: boolean;
-    writeCredentials?: boolean;
-    writeDevVars?: string | boolean;
-    token?: string;
-    /** true forces browser launch, false disables it, undefined auto-opens only for interactive terminals. */
-    open?: boolean;
-    /** Test/embedding override for terminal interactivity. Defaults to stdin/stdout TTY detection. */
-    interactive?: boolean;
-    /** Test/embedding override for opening the approval URL. Defaults to the OS browser opener. */
-    openApprovalUrl?: (url: string) => Promise<void>;
-    /** Test/embedding override for calendar connection polling. */
-    calendarPollWait?: (milliseconds: number, signal?: AbortSignal) => Promise<void>;
-    /** Maximum calendar consent + initial-sync wait. Defaults to ten minutes. */
-    calendarPollTimeoutMs?: number;
-    /** Explicit consent for a non-dry-run plan containing `prod` or `production`. */
-    yes?: boolean;
-    fetch?: typeof fetch;
-    /** Test/embedding override for Wrangler subprocesses used by `pushSecrets`. */
-    secretRunner?: CommandRunner;
-    stdout?: Pick<typeof console, "log" | "error">;
-}
-/** Human-reviewable, secret-free plan printed by `provision({ dryRun: true })`. */
-interface ProvisionPlan {
-    appId: string;
-    appName: string;
-    platformUrl: string;
-    dbEndpoint: string;
-    envs: string[];
-    services: string[];
-    hasSchema: boolean;
-    hasRules: boolean;
-    aiProvider?: string;
-}
-/** Inputs for a read-only live environment smoke check. */
-interface SmokeOptions {
-    configPath: string;
-    env?: string;
-    /** Developer-token override used only for owner-visible calendar health. */
-    token?: string;
-    open?: boolean;
-    interactive?: boolean;
-    openApprovalUrl?: (url: string) => Promise<void>;
-    fetch?: typeof fetch;
-    stdout?: Pick<typeof console, "log" | "error">;
-}
-
-declare const GOOGLE_CALENDAR_READ_SCOPE = "https://www.googleapis.com/auth/calendar.events.readonly";
-/** Resolve the checked-in calendar block into one controller-safe env payload. */
-declare function calendarServiceConfig(cfg: LoadedProjectConfig, env: string): CalendarServiceConfig;
-/** Public Appointment Schedule URL to apply separately from connector config. */
-declare function calendarBookingPageUrl(cfg: LoadedProjectConfig, env: string): string | null | undefined;
-
-interface DoctorOptions {
-    configPath: string;
-    stdout?: Pick<typeof console, "log" | "error">;
-}
-/**
- * Validate and summarize an odla project config entirely offline — no network
- * calls and no file writes. Loads `configPath`, builds the provision plan, and
- * resolves the schema and rules (synthesizing deny-all rules from the schema
- * when `db.rules` is omitted and `db.defaultRules` isn't `false`), then prints a
- * summary line for the app, envs, services, schema entity count, rules namespace
- * count, and AI provider.
- *
- * It then collects warnings for the mistakes provision can't fix silently: a
- * schema with no entities, a rules namespace with no matching entity, the `ai`
- * service enabled without an `ai.provider`, `auth.clerk` entries that reference
- * an unset env var (`$FOO`), an `ai.keyEnv` that isn't set (provider key upload
- * will be skipped), and — when `o11y` is enabled — any env whose local
- * credentials lack an ingest token. It also folds in the shared rule linter,
- * git-tracked secret-shaped files, and wrangler config warnings. Prints `ok`
- * when clean, otherwise the warning list. Purely advisory: never throws on
- * warnings and never mutates anything.
- *
- * @param options.configPath Path to the `odla.config.mjs` to inspect.
- * @param options.stdout Optional console-like sink (defaults to `console`).
- */
-declare function doctor(options: DoctorOptions): Promise<void>;
-
-interface InitOptions {
-    rootDir?: string;
-    configPath?: string;
-    appId: string;
-    name: string;
-    envs?: string[];
-    services?: string[];
-    aiProvider?: string;
-    force?: boolean;
-    stdout?: Pick<typeof console, "log" | "error">;
-}
-/**
- * Scaffold a new odla project into `rootDir` (default: cwd). Writes an
- * `odla.config.mjs` (default name, overridable via `configPath`) plus starter
- * `src/odla/schema.mjs` (a single `notes` entity) and `src/odla/rules.mjs`
- * (deny-all), and creates the `src/odla` and `.odla` directories. Also runs
- * `ensureGitignore` so the local token/credentials paths are ignored.
- *
- * Fully local and synchronous — no network calls. The config file is only
- * written when it doesn't already exist unless `force` is set (otherwise it
- * throws); the schema/rules files are written only when missing (never
- * overwritten, even with `force`). `appId` must match `^[a-z0-9][a-z0-9-]*$` or
- * it throws. Defaults: `envs` → `["dev"]`, `services` → `["db","ai"]`,
- * `aiProvider` → `"anthropic"` (which also picks the `keyEnv`, e.g.
- * `ANTHROPIC_API_KEY`/`OPENAI_API_KEY`/`GOOGLE_API_KEY`).
- *
- * @param options.appId Slug for the app (lowercase alphanumerics and hyphens).
- * @param options.name Human-readable app name embedded in the config.
- * @param options.rootDir Project root (defaults to `process.cwd()`).
- * @param options.configPath Config filename relative to root (default `odla.config.mjs`).
- * @param options.envs Environment names (default `["dev"]`; production is an explicit opt-in).
- * @param options.services Enabled services (default `["db","ai"]`).
- * @param options.aiProvider AI provider slug (default `"anthropic"`).
- * @param options.force Overwrite an existing config file instead of throwing.
- * @param options.stdout Optional console-like sink (defaults to `console`).
- */
-declare function initProject(options: InitOptions): void;
-
-/**
- * Provision an app end-to-end from its config — the primary deploy path, and
- * (apart from key rotation) idempotent, so re-running is safe. Obtains a
- * developer token, creates the registry app when absent, enables each service
- * per env (AI also gets `setAi` with the configured provider/model), configures
- * Clerk auth and links, then per env mints or reuses credentials only for the
- * configured services, pushes the schema with the db key and the
- * rules with the developer token, and stores the provider key in the tenant
- * vault when `ai.keyEnv` is set and present. Finally writes the credentials file
- * (mode 0600, gitignored) and, when requested, `.dev.vars`.
- *
- * The developer token comes from (in order) `options.token`, `$ODLA_DEV_TOKEN`,
- * the cached `.odla` token, or a fresh device handshake — which prints a user
- * code + approval URL and, in interactive terminals, auto-opens the browser
- * (`open: true`/`false` forces/suppresses it). Network error bodies pass through
- * `redactSecrets` before display.
- *
- * @param options.dryRun Print the resolved plan and return before any network call/write.
- * @param options.rotateKeys Rotate db keys and o11y tokens.
- * @param options.rotateO11yToken Rotate only the o11y token.
- * @param options.pushSecrets Preflight Wrangler, then push each env's configured
- *   Worker secrets immediately after credential provisioning.
- * @param options.writeDevVars `true`/a path writes `.dev.vars`; `writeCredentials: false` skips the creds file.
- * @param options.yes Required for a non-dry-run plan containing `prod` or
- *   `production`; callers must show and review `dryRun` output first.
- * @throws When a production plan is executed without `yes`, configuration is
- *   invalid, authorization fails, or a provisioning operation fails.
- */
-declare function provision(options: ProvisionOptions): Promise<void>;
-
-/**
- * Return `value` with every secret-shaped substring replaced by a `[redacted]`
- * placeholder that keeps the identifying prefix (e.g. `sk_live_[redacted]`).
- * Matches odla db keys (`odla_sk_`/`odla_dev_`), Clerk secret keys
- * (`sk_live_`/`sk_test_`), OpenAI keys (`sk-`), webhook signing secrets
- * (`whsec_`), o11y tokens (`o11y_`), GitHub tokens (`ghp_`/`gho_`/`github_pat_`),
- * and AWS access-key ids (`AKIA…`). Clerk publishable keys (`pk_test_`/
- * `pk_live_`) are public by design and intentionally left untouched. Used to
- * sanitize anything the CLI echoes (notably network error bodies) before it
- * reaches stdout/stderr. Non-matching input is returned unchanged.
- */
-declare function redactSecrets(value: string): string;
-
-/** Moves locally stored configured service credentials to one Wrangler environment over stdin. */
-interface SecretsPushOptions {
-    configPath: string;
-    env: string;
-    dryRun?: boolean;
-    /** Required to push to a prod-named env; the visible consent token in agent transcripts. */
-    yes?: boolean;
-    runner?: CommandRunner;
-    stdout?: Pick<typeof console, "log" | "error">;
-}
-/**
- * Moves the env's configured db and/or o11y credentials from the private local
- * credentials file into the Worker, piping values over stdin so they never
- * appear on argv, in output, or in the conversation transcript.
- */
-declare function secretsPush(options: SecretsPushOptions): Promise<void>;
-
-/**
- * Inputs for one write-only tenant-vault transfer (`secrets set` /
- * `secrets set-clerk-key`). Values may come only from a named environment
- * variable or stdin, so a producer command can be piped straight into the
- * vault without the secret ever being displayed or stored on disk.
- */
-interface SecretsSetOptions {
-    configPath: string;
-    env: string;
-    /** Vault secret name (`secrets set` only; `$`-prefixed names are reserved). */
-    name?: string;
-    fromEnv?: string;
-    stdin?: boolean;
-    /** Explicit consent for a prod-named env (and for sk_live_ into a non-prod env). */
-    yes?: boolean;
-    /** Developer token override; defaults to $ODLA_DEV_TOKEN, the cached token, or a device handshake. */
-    token?: string;
-    open?: boolean;
-    interactive?: boolean;
-    openApprovalUrl?: (url: string) => Promise<void>;
-    fetch?: typeof fetch;
-    readStdin?: () => Promise<string>;
-    stdout?: Pick<typeof console, "log" | "error">;
-}
-/**
- * Store one named secret in the env's tenant vault (the same write-only slot
- * Studio's Secrets panel fills), e.g. `clerk_webhook_secret` for synced auth.
- * The value is encrypted at rest and can be read back only by that tenant's
- * app API key — never by this CLI, Studio, or the developer token.
- */
-declare function secretsSet(options: SecretsSetOptions): Promise<void>;
-/**
- * Store the app's Clerk secret key under the reserved `$clerk_secret` slot so
- * odla-db can resolve the app's users (invites, member lookups). Reserved
- * secrets are never readable by app keys; the dedicated endpoint is the only
- * way to set one. Guards against instance/env mismatches: an sk_test_ key
- * never belongs in a prod-named env, and an sk_live_ key entering a non-prod
- * env requires `--yes` (live users would sync into a non-prod tenant).
- */
-declare function secretsSetClerkKey(options: SecretsSetOptions): Promise<void>;
-
-/** Built-in security coverage profile selected for a hosted reasoning run. */
-type HostedSecurityProfile = "odla" | "cloudflare-app" | "generic";
-/** Exact attribution and authorization need supplied to a lazy token callback. */
-interface HostedSecurityTokenRequest {
-    platform: string;
-    appId: string;
-    env: string;
-    selfAudit: boolean;
-    /** Self-audit asks the caller for an explicitly scoped platform credential. */
-    /** Ordinary app runs use owner authority and therefore request no platform scope. */
-    scope: "platform:security:self" | null;
-}
-/** Local snapshot/orchestration controls for an app-attributed hosted security
- * run. The platform supplies model routes and provider credentials. */
-interface RunHostedSecurityOptions {
-    /** Project config; loaded for customer-app runs and ignored for self-audit. */
-    configPath?: string;
-    /** Scan odla itself under the protected odla-ai/prod identity. */
-    selfAudit?: boolean;
-    /** Repository directory to snapshot. Defaults to the config root or cwd for self-audit. */
-    target?: string;
-    /** Private artifact directory. Defaults to `<target>/.odla/security/hosted`. */
-    out?: string;
-    /** Customer environment. Must be declared in config. Self-audit always uses prod. */
-    env?: string;
-    profile?: HostedSecurityProfile;
-    maxHuntTasks?: number;
-    /** Exact acknowledgement required before any source capture or network call. */
-    sourceDisclosureAck?: "redacted";
-    /** Optional client correlation id; the platform returns the authoritative run id. */
-    runId?: string;
-    /** Platform override. Customer runs otherwise use config.platformUrl. */
-    platform?: string;
-    /** Injected app credential; for self-audit this must be explicitly scoped by the caller. */
-    token?: string;
-    /** Lazy token acquisition. Receives the exact app/env and required scope. */
-    getToken?: (request: HostedSecurityTokenRequest) => string | Promise<string>;
-    fetch?: typeof fetch;
-    signal?: AbortSignal;
-    stdout?: Pick<typeof console, "log" | "error">;
-}
-/** Completed local report, public platform run metadata, and private artifact path. */
-interface HostedSecurityResult {
-    report: SecurityReport;
-    run: Readonly<PlatformSecurityRun>;
-    output: string;
-}
-/**
- * Run the hosted, redacted-source security harness for an odla app or odla's
- * protected self-audit identity. Provider/model selection and provider secrets
- * remain platform-owned; this function accepts only an app/scoped bearer and
- * the opaque role grants remain inside @odla-ai/security's reasoner closures.
- */
-declare function runHostedSecurity(options: RunHostedSecurityOptions): Promise<HostedSecurityResult>;
-
-/**
- * The hosted-security client surface. The WIRE types live in @odla-ai/security/hosted — one
- * definition shared with the dashboard and the server that produces them. Re-exported here so
- * this module stays the single import path for the rest of the CLI.
- *
- * What remains below is what is genuinely the CLI's own: transport controls (platform origin,
- * token, fetch, AbortSignal) that no other client shares.
- */
-
-/** Common authenticated transport controls for hosted-security requests. */
-interface HostedSecurityRequestOptions {
-    platform: string;
-    token: string;
-    fetch?: typeof fetch;
-    signal?: AbortSignal;
-}
-/** Options for browser-mediated connection of one exact GitHub repository. */
-interface ConnectGitHubSecuritySourceOptions extends HostedSecurityRequestOptions {
-    appId: string;
-    env: string;
-    /** Exact owner/name repository requested before GitHub approval. */
-    repository: string;
-    /** false prints but does not launch the install URL. Defaults to true. */
-    open?: boolean;
-    openInstallUrl?: (url: string) => Promise<void>;
-    /** Poll interval. The server attempt expiry remains authoritative. */
-    pollIntervalMs?: number;
-    pollTimeoutMs?: number;
-    wait?: (milliseconds: number, signal?: AbortSignal) => Promise<void>;
-    now?: () => number;
-    stdout?: Pick<typeof console, "log">;
-}
-/** Options for listing GitHub sources or reading the plan for one app environment. */
-interface ListGitHubSecuritySourcesOptions extends HostedSecurityRequestOptions {
-    appId: string;
-    env: string;
-}
-/** Inputs for fetching the server-authored execution preview before enqueue. */
-interface GetHostedSecurityIntentOptions extends HostedSecurityRequestOptions {
-    appId: string;
-    env: string;
-    sourceId: string;
-    ref?: string;
-    profile?: "odla" | "cloudflare-app" | "generic";
-}
-/** Options for revoking odla access to one saved GitHub source. */
-interface DisconnectGitHubSecuritySourceOptions extends HostedSecurityRequestOptions {
-    appId: string;
-    sourceId: string;
-}
-/** Options for enqueueing a commit-pinned hosted security review. */
-interface StartHostedSecurityJobOptions extends HostedSecurityRequestOptions {
-    appId: string;
-    env: string;
-    sourceId: string;
-    ref?: string;
-    profile?: "odla" | "cloudflare-app" | "generic";
-    clientRequestId?: string;
-    /** Versions shown in the disclosure preflight. The server rejects stale consent. */
-    expectedPolicyVersions: {
-        discovery: number;
-        validation: number;
-    };
-    /** Digest copied from the plan the app owner explicitly reviewed. */
-    expectedPlanDigest: `sha256:${string}`;
-    /** Digest copied from the exact server-authored source/ref/profile preview. */
-    expectedExecutionDigest: `sha256:${string}`;
-    /** Explicit disclosure acknowledgement; GitHub read access alone is not consent. */
-    sourceDisclosureAck?: "redacted";
-}
-/** Options for reading one hosted security job or its report. */
-interface GetHostedSecurityJobOptions extends HostedSecurityRequestOptions {
-    appId: string;
-    jobId: string;
-}
-/** Options for listing hosted security jobs in one app environment. */
-interface ListHostedSecurityJobsOptions extends HostedSecurityRequestOptions {
-    appId: string;
-    env: string;
-}
-/** Polling controls for following one hosted job to a terminal state. */
-interface FollowHostedSecurityJobOptions extends GetHostedSecurityJobOptions {
-    pollIntervalMs?: number;
-    pollTimeoutMs?: number;
-    wait?: (milliseconds: number, signal?: AbortSignal) => Promise<void>;
-    now?: () => number;
-    onUpdate?: (job: Readonly<HostedSecurityJob>) => void;
-}
-
-/** Begin GitHub App installation, launch its server-issued GitHub URL, and
- * poll the exact attempt until the callback has connected a source. */
-declare function connectGitHubSecuritySource(options: ConnectGitHubSecuritySourceOptions): Promise<GitHubConnectionStatus>;
-/** List repository sources the current app owner connected for one environment. */
-declare function listGitHubSecuritySources(options: ListGitHubSecuritySourcesOptions): Promise<GitHubSecuritySource[]>;
-/** Revoke odla's use of one saved source without requiring a GitHub-side App
- * uninstall. The server marks the source deleted and rejects new jobs. */
-declare function disconnectGitHubSecuritySource(options: DisconnectGitHubSecuritySourceOptions): Promise<void>;
-/** Parse an HTTPS, ssh://, or git@github.com origin without retaining embedded
- * credentials. Only github.com owner/name remotes are accepted. */
-declare function repositoryFromGitRemote(remoteInput: string): string;
-/** Read the current repository's origin without invoking a shell. */
-declare function inferGitHubRepository(cwd?: string, readOrigin?: (cwd: string) => Promise<string>): Promise<string>;
-
-/** Fetch the atomic processing-plan and source/ref/profile execution preview. */
-declare function getHostedSecurityIntent(options: GetHostedSecurityIntentOptions): Promise<HostedSecurityIntentResponse>;
-
-/** Read the admin-selected routes, budgets, readiness, disclosure boundary,
- * and digest that must be acknowledged when a hosted review is enqueued. */
-declare function getHostedSecurityPlan(options: ListGitHubSecuritySourcesOptions): Promise<HostedSecurityPlan>;
-/** Enqueue a commit-pinned server-side review. The server resolves sourceId to
- * its saved GitHub App installation; clients cannot choose an installation or
- * pass a PAT. */
-declare function startHostedSecurityJob(options: StartHostedSecurityJobOptions): Promise<HostedSecurityJob>;
-/** Read one bounded hosted job status without an archive or explicit source excerpt. */
-declare function getHostedSecurityJob(options: GetHostedSecurityJobOptions): Promise<HostedSecurityJob>;
-/** List bounded, newest-first job metadata for an app environment. */
-declare function listHostedSecurityJobs(options: ListHostedSecurityJobsOptions): Promise<HostedSecurityJob[]>;
-/** Poll one exact job until it reaches a terminal state. */
-declare function followHostedSecurityJob(options: FollowHostedSecurityJobOptions): Promise<HostedSecurityJob>;
-/** Fetch the bounded normalized report projection for a completed hosted job. */
-declare function getHostedSecurityReport(options: GetHostedSecurityJobOptions): Promise<HostedSecurityReport>;
-/** Return whether a hosted job status can no longer transition. */
-declare function isTerminalHostedSecurityStatus(status: HostedSecurityJobStatus): boolean;
-
-/** Agent harnesses with a first-class local adapter. */
-declare const AGENT_HARNESSES: readonly ["claude", "codex", "cursor", "copilot", "gemini", "agents"];
-/** A supported coding-agent harness. `agents` is the portable `AGENTS.md` adapter. */
-type AgentHarness = (typeof AGENT_HARNESSES)[number];
-/** A harness name accepted by setup; `all` expands to every project-local adapter. */
-type AgentHarnessSelector = AgentHarness | "all";
-/** Controls project-local or global installation of the bundled agent runbooks. */
-interface SkillInstallOptions {
-    /** Project directory receiving the shared runbooks and harness adapters. Defaults to cwd. */
-    dir?: string;
-    /** Install user-wide Claude and/or Codex skills instead of project adapters. */
-    global?: boolean;
-    /** Harnesses to install. The programmatic compatibility default is `claude`; the CLI passes `all`. */
-    harnesses?: AgentHarnessSelector[];
-    /** Overwrite locally modified odla-managed files or managed instruction sections. */
-    force?: boolean;
-    /** Test/embedding override for the home directory. */
-    homeDir?: string;
-    /** Test/embedding override for `$CODEX_HOME`. */
-    codexHomeDir?: string;
-    /** Test/embedding override for the bundled skills directory. */
-    sourceDir?: string;
-    stdout?: Pick<typeof console, "log" | "error">;
-}
-/** One harness adapter and the directories or files through which it discovers odla. */
-interface HarnessInstallResult {
-    harness: AgentHarness;
-    targets: string[];
-}
-/** Files written or left unchanged by an idempotent agent-runbook installation. */
-interface SkillInstallResult {
-    /** Primary native skill directory, retained for compatibility with earlier callers. */
-    targetDir: string;
-    /** Files changed directly under `targetDir`, relative to that directory. */
-    written: string[];
-    /** Files already current directly under `targetDir`, relative to that directory. */
-    unchanged: string[];
-    /** Absolute paths of every changed shared-runbook or adapter file. */
-    writtenPaths: string[];
-    /** Absolute paths of every already-current shared-runbook or adapter file. */
-    unchangedPaths: string[];
-    harnesses: HarnessInstallResult[];
-}
-/**
- * Installs one shared offline runbook tree plus thin native adapters for the
- * selected coding-agent harnesses. Project installs use `.agents/skills/` as
- * the canonical bundle; Claude Code, Cursor, Copilot, Gemini, and generic
- * `AGENTS.md` adapters point to it. Global installs support the native Claude
- * and Codex skill roots only.
- *
- * Installation is idempotent and planned before any write: an odla-managed
- * file changed by the user aborts the whole operation unless `force` is set.
- * Existing `AGENTS.md`, `GEMINI.md`, and Copilot instructions are preserved;
- * only the bounded odla-managed section is appended or replaced.
- */
-declare function installSkill(options?: SkillInstallOptions): SkillInstallResult;
-
-/**
- * Verify a live, already-provisioned environment end-to-end. Resolves the target
- * env (`options.env`, else `dev`, else the first declared env) and requires it to
- * be declared in the config. Reads the local credentials file and checks that it
- * belongs to this app and holds a `tenantId` + `dbKey` for the env — otherwise it
- * throws pointing the user at `odla-ai provision --write-dev-vars`.
- *
- * It then makes real network calls: fetches the registry public-config (and, when
- * `ai.provider` is configured, asserts the live provider matches), fetches the
- * live db schema with the db key and asserts every entity from the local schema
- * is present, and runs a `count` aggregate against the first entity to confirm
- * the db answers queries. Progress lines are printed and it ends with `ok`.
- * Read-only — it writes nothing and throws on the first mismatch or failed
- * request.
- *
- * @param options.configPath Path to the `odla.config.mjs`.
- * @param options.env Env to check (default `dev`, else the first declared env).
- * @param options.fetch Injectable `fetch` (for tests/embedding).
- * @param options.stdout Optional console-like sink (defaults to `console`).
- */
-declare function smoke(options: SmokeOptions): Promise<void>;
-
-export { AGENT_HARNESSES, type AdminAiOptions, type AgentHarness, type AgentHarnessSelector, type AvailableGoogleCalendar, CAPABILITIES, type CalendarConfig, type CalendarConnectionState, type CalendarLifecycleOptions, type CalendarServiceConfig, type CalendarStatus, type CliDependencies, type ConnectGitHubSecuritySourceOptions, type DisconnectGitHubSecuritySourceOptions, type FollowHostedSecurityJobOptions, GOOGLE_CALENDAR_READ_SCOPE, type GetHostedSecurityIntentOptions, type GetHostedSecurityJobOptions, type GoogleCalendarConfig, type GoogleCalendarMatchConfig, type HarnessInstallResult, type HostedSecurityProfile, type HostedSecurityResult, type HostedSecurityTokenRequest, type ListGitHubSecuritySourcesOptions, type ListHostedSecurityJobsOptions, type LoadedProjectConfig, type LocalCredentials, type OdlaProjectConfig, type ProvisionOptions, type ProvisionPlan, type RunHostedSecurityOptions, SYSTEM_AI_PURPOSES, type ScopedPlatformTokenOptions, type SecretsPushOptions, type SecretsSetOptions, type SkillInstallOptions, type SkillInstallResult, type SmokeOptions, type StartHostedSecurityJobOptions, type SystemAiPurpose, adminAi, calendarBookingPageUrl, calendarCalendars, calendarConnect, calendarDisconnect, calendarResync, calendarServiceConfig, calendarStatus, connectGitHubSecuritySource, disconnectGitHubSecuritySource, doctor, followHostedSecurityJob, getHostedSecurityIntent, getHostedSecurityJob, getHostedSecurityPlan, getHostedSecurityReport, getScopedPlatformToken, inferGitHubRepository, initProject, installSkill, isTerminalHostedSecurityStatus, listGitHubSecuritySources, listHostedSecurityJobs, printCapabilities, provision, redactSecrets, repositoryFromGitRemote, runCli, runHostedSecurity, secretsPush, secretsSet, secretsSetClerkKey, smoke, startHostedSecurityJob };
-```