@odla-ai/cli 0.11.2 → 0.12.0

package/dist/{chunk-DC4MIB4X.js → chunk-Y4HWUEFF.js}

@@ -2,7 +2,7 @@
 
 // src/admin-ai-auth.ts
 import { existsSync as existsSync2 } from "fs";
-import process4 from "process";
+import process5 from "process";
 import { requestToken as requestToken2 } from "@odla-ai/db";
 
 // src/local.ts
@@ -156,55 +156,173 @@ function openerFor(platform) {
 }
 
 // src/token.ts
-import { requestToken } from "@odla-ai/db";
+import { collectToken, OdlaError, requestToken } from "@odla-ai/db";
+import process4 from "process";
+
+// src/handshake-state.ts
+import { rmSync } from "fs";
+import { dirname as dirname2, join } from "path";
 import process3 from "process";
+function handshakeFile(cfg) {
+  return join(dirname2(cfg.local.tokenFile), "handshake.local.json");
+}
+var RESUME_MARGIN_MS = 5e3;
+function readPendingHandshake(path, platform, email) {
+  const pending = readJsonFile(path);
+  if (!pending || pending.platform !== platform || pending.email !== email) return null;
+  if (typeof pending.userCode !== "string" || typeof pending.deviceCode !== "string" || typeof pending.approvalUrl !== "string") return null;
+  if (typeof pending.expiresAt !== "number" || pending.expiresAt <= Date.now() + RESUME_MARGIN_MS) return null;
+  return { interval: 3, ...pending };
+}
+function writePendingHandshake(path, pending) {
+  writePrivateJson(path, pending);
+}
+function clearPendingHandshake(path) {
+  rmSync(path, { force: true });
+}
+function minutesLeft(expiresAt) {
+  return Math.max(1, Math.round((expiresAt - Date.now()) / 6e4));
+}
+function approvalHint(pending) {
+  return `approve code ${pending.userCode} at ${pending.approvalUrl} (${minutesLeft(pending.expiresAt)}m left)`;
+}
+function approvalReminder(out, pending, periodMs = 3e4) {
+  const timer = setInterval(() => out.log(`auth: still waiting \u2014 ${approvalHint(pending)}`), periodMs);
+  timer.unref?.();
+  return () => clearInterval(timer);
+}
+function handshakeWaitMs(waitSeconds, interactive = process3.stdout.isTTY === true) {
+  if (waitSeconds !== void 0) return waitSeconds * 1e3;
+  return interactive ? void 0 : 9e4;
+}
+
+// src/token.ts
 async function getDeveloperToken(cfg, options, doFetch, out) {
   if (options.token) return options.token;
   const audience = platformAudience(cfg.platformUrl);
-  if (process3.env.ODLA_DEV_TOKEN) {
-    const declared = process3.env.ODLA_DEV_TOKEN_AUDIENCE;
+  if (process4.env.ODLA_DEV_TOKEN) {
+    const declared = process4.env.ODLA_DEV_TOKEN_AUDIENCE;
     if (declared) {
       if (platformAudience(declared) !== audience) throw new Error("ODLA_DEV_TOKEN_AUDIENCE does not match the configured platform");
     } else if (audience !== "https://odla.ai") {
       throw new Error("ODLA_DEV_TOKEN_AUDIENCE is required for a non-default platform");
     }
-    return process3.env.ODLA_DEV_TOKEN;
+    return process4.env.ODLA_DEV_TOKEN;
   }
   const cached = readJsonFile(cfg.local.tokenFile);
   if (cached?.token && cached.platform === audience && (cached.expiresAt ?? 0) > Date.now() + 6e4) {
     out.log(`auth: using cached developer token (${displayPath(cfg.local.tokenFile, cfg.rootDir)})`);
     return cached.token;
   }
-  const browser = approvalBrowser(options);
-  const email = handshakeEmail(options.email, cached?.platform === audience ? cached.email : void 0);
-  const { token, expiresAt } = await requestToken({
-    endpoint: cfg.platformUrl,
-    email,
-    label: `${cfg.app.id} provisioner`,
-    fetch: doFetch,
-    onCode: async ({ userCode, expiresIn, verificationUriComplete }) => {
-      const approvalUrl = verificationUriComplete ?? handshakeUrl(cfg.platformUrl, userCode);
-      out.log("");
-      out.log(`Review, then approve code ${userCode} at ${approvalUrl} within ${Math.floor(expiresIn / 60)}m.`);
-      if (browser.open) {
-        try {
-          await (options.openApprovalUrl ?? openUrl)(approvalUrl);
-          out.log(`auth: opened browser for approval${browser.mode === "auto" ? " (auto)" : ""}`);
-        } catch (err) {
-          out.log(`auth: could not open browser (${err instanceof Error ? err.message : String(err)})`);
-        }
-      } else if (browser.reason) {
-        out.log(`auth: browser launch skipped (${browser.reason})`);
-      }
-      out.log("");
-    }
-  });
-  writePrivateJson(cfg.local.tokenFile, { platform: audience, email, token, expiresAt });
+  const ctx = {
+    cfg,
+    options,
+    doFetch,
+    out,
+    audience,
+    browser: approvalBrowser(options),
+    email: handshakeEmail(options.email, cached?.platform === audience ? cached.email : void 0),
+    pendingFile: handshakeFile(cfg)
+  };
+  const waitMs = handshakeWaitMs(options.wait);
+  const { token, expiresAt } = await resumePendingHandshake(ctx, waitMs) ?? await freshHandshake(ctx, waitMs);
+  clearPendingHandshake(ctx.pendingFile);
+  writePrivateJson(cfg.local.tokenFile, { platform: audience, email: ctx.email, token, expiresAt });
   out.log(`auth: developer token cached (${displayPath(cfg.local.tokenFile, cfg.rootDir)})`);
   return token;
 }
+async function resumePendingHandshake(ctx, waitMs) {
+  const pending = readPendingHandshake(ctx.pendingFile, ctx.audience, ctx.email);
+  if (!pending) return null;
+  ctx.out.log("");
+  ctx.out.log(`auth: resuming pending handshake \u2014 ${approvalHint(pending)}`);
+  await launchApproval(ctx, pending.approvalUrl);
+  ctx.out.log("");
+  const stopReminder = approvalReminder(ctx.out, pending);
+  try {
+    return await collectToken({
+      endpoint: ctx.cfg.platformUrl,
+      deviceCode: pending.deviceCode,
+      expiresAt: pending.expiresAt,
+      interval: pending.interval,
+      waitMs,
+      fetch: ctx.doFetch
+    });
+  } catch (err) {
+    const code = err instanceof OdlaError ? err.code : void 0;
+    if (code === "handshake_pending") throw stillPending(pending, ctx.email);
+    if (code === "handshake_expired" || code === "handshake_timeout") {
+      clearPendingHandshake(ctx.pendingFile);
+      ctx.out.log("auth: pending handshake lapsed unapproved; starting a fresh one");
+      return null;
+    }
+    if (code === "handshake_denied") clearPendingHandshake(ctx.pendingFile);
+    throw err;
+  } finally {
+    stopReminder();
+  }
+}
+async function freshHandshake(ctx, waitMs) {
+  let started;
+  let stopReminder;
+  try {
+    return await requestToken({
+      endpoint: ctx.cfg.platformUrl,
+      email: ctx.email,
+      label: `${ctx.cfg.app.id} provisioner`,
+      fetch: ctx.doFetch,
+      waitMs,
+      onCode: async ({ userCode, deviceCode, expiresIn, interval, verificationUriComplete }) => {
+        const approvalUrl = verificationUriComplete ?? handshakeUrl(ctx.cfg.platformUrl, userCode);
+        started = {
+          platform: ctx.audience,
+          email: ctx.email,
+          userCode,
+          deviceCode,
+          approvalUrl,
+          interval,
+          expiresAt: Date.now() + expiresIn * 1e3
+        };
+        writePendingHandshake(ctx.pendingFile, started);
+        ctx.out.log("");
+        ctx.out.log(`Review, then ${approvalHint(started)}.`);
+        await launchApproval(ctx, approvalUrl);
+        ctx.out.log("");
+        stopReminder = approvalReminder(ctx.out, started);
+      }
+    });
+  } catch (err) {
+    const code = err instanceof OdlaError ? err.code : void 0;
+    if (code === "handshake_pending" && started) throw stillPending(started, ctx.email);
+    if (code === "handshake_denied" || code === "handshake_expired" || code === "handshake_timeout") {
+      clearPendingHandshake(ctx.pendingFile);
+    }
+    throw err;
+  } finally {
+    stopReminder?.();
+  }
+}
+async function launchApproval(ctx, approvalUrl) {
+  if (ctx.browser.open) {
+    try {
+      await (ctx.options.openApprovalUrl ?? openUrl)(approvalUrl);
+      ctx.out.log(`auth: asked the OS to open a browser${ctx.browser.mode === "auto" ? " (auto)" : ""} \u2014 if no tab appeared, use the URL above`);
+    } catch (err) {
+      ctx.out.log(`auth: could not open browser (${err instanceof Error ? err.message : String(err)})`);
+    }
+  } else if (ctx.browser.reason) {
+    ctx.out.log(`auth: browser launch skipped (${ctx.browser.reason}) \u2014 show the human the URL above`);
+  }
+}
+function stillPending(pending, email) {
+  return new OdlaError(
+    "handshake_pending",
+    `handshake still pending \u2014 ask ${email} to ${approvalHint(pending)}, then re-run this command; it resumes the same handshake and collects the token`,
+    { retryable: true }
+  );
+}
 function handshakeEmail(value, cached) {
-  const email = (value ?? process3.env.ODLA_USER_EMAIL ?? cached ?? "").trim().toLowerCase();
+  const email = (value ?? process4.env.ODLA_USER_EMAIL ?? cached ?? "").trim().toLowerCase();
   if (email.length > 254 || !/^[^\s@]+@[^\s@]+\.[^\s@]+$/.test(email)) {
     throw new Error("a fresh odla handshake requires --email <account> or ODLA_USER_EMAIL");
   }
@@ -213,10 +331,11 @@ function handshakeEmail(value, cached) {
 function approvalBrowser(options, host = {}) {
   if (options.open === true) return { open: true, mode: "forced" };
   if (options.open === false) return { open: false, reason: "disabled by --no-open" };
-  const env = host.env ?? process3.env;
+  const env = host.env ?? process4.env;
+  if (env.VITEST || env.NODE_ENV === "test") return { open: false, reason: "test environment" };
   if (env.CI) return { open: false, reason: "CI environment" };
   if (env.SSH_CONNECTION || env.SSH_TTY) return { open: false, reason: "SSH session; pass --open to force" };
-  const platform = host.platform ?? process3.platform;
+  const platform = host.platform ?? process4.platform;
   if (platform !== "darwin" && platform !== "win32" && !env.DISPLAY && !env.WAYLAND_DISPLAY) {
     return { open: false, reason: "no graphical display; pass --open to force" };
   }
@@ -251,7 +370,7 @@ async function getScopedPlatformToken(options) {
 async function resolveAdminPlatformToken(options) {
   const audience = platformAudience(options.platform);
   if (options.token) return options.token;
-  const fromEnv = process4.env.ODLA_ADMIN_TOKEN;
+  const fromEnv = process5.env.ODLA_ADMIN_TOKEN;
   if (fromEnv) return audienceBoundEnvToken(fromEnv, audience);
   return scopedToken(
     audience,
@@ -263,7 +382,7 @@ async function resolveAdminPlatformToken(options) {
 }
 function audienceBoundEnvToken(token, platform) {
   const audience = platformAudience(platform);
-  const declared = process4.env.ODLA_ADMIN_TOKEN_AUDIENCE;
+  const declared = process5.env.ODLA_ADMIN_TOKEN_AUDIENCE;
   if (declared) {
     if (platformAudience(declared) !== audience) throw new Error("ODLA_ADMIN_TOKEN_AUDIENCE does not match the configured platform");
   } else if (audience !== "https://odla.ai") {
@@ -273,7 +392,7 @@ function audienceBoundEnvToken(token, platform) {
 }
 async function scopedToken(platform, scope, options, doFetch, out) {
   const audience = platformAudience(platform);
-  const tokenFile = options.tokenFile ?? `${process4.cwd()}/.odla/admin-token.local.json`;
+  const tokenFile = options.tokenFile ?? `${process5.cwd()}/.odla/admin-token.local.json`;
   const cache = readJsonFile(tokenFile);
   const cached = cache?.platform === audience ? cache.tokens?.[scope] : void 0;
   if (cached?.token && (cached.expiresAt ?? 0) > Date.now() + 6e4) {
@@ -297,7 +416,7 @@ async function scopedToken(platform, scope, options, doFetch, out) {
   });
   const tokens = cache?.platform === audience ? { ...cache.tokens ?? {} } : {};
   tokens[scope] = { token, expiresAt };
-  if (existsSync2(`${process4.cwd()}/.git`)) ensureGitignore(process4.cwd(), [tokenFile]);
+  if (existsSync2(`${process5.cwd()}/.git`)) ensureGitignore(process5.cwd(), [tokenFile]);
   writePrivateJson(tokenFile, { platform: audience, email, tokens });
   out.log(`auth: cached ${scope} grant (${tokenFile}; mode 0600)`);
   return token;
@@ -313,15 +432,15 @@ function requireSystemAiPurpose(value) {
 }
 
 // src/admin-ai.ts
-import process6 from "process";
+import process7 from "process";
 
 // src/secret-input.ts
-import process5 from "process";
+import process6 from "process";
 var MAX_BYTES = 64 * 1024;
 async function secretInputValue(options, kind = "credential") {
   if (options.fromEnv && options.stdin) throw new Error("choose exactly one of --from-env or --stdin");
   let value;
-  if (options.fromEnv) value = process5.env[options.fromEnv];
+  if (options.fromEnv) value = process6.env[options.fromEnv];
   else if (options.stdin) value = await (options.readStdin ?? (() => readSecretStream(kind)))();
   else throw new Error(`${kind} input required: use --from-env <NAME> or --stdin; values are never accepted as arguments`);
   value = value?.replace(/[\r\n]+$/, "");
@@ -329,7 +448,7 @@ async function secretInputValue(options, kind = "credential") {
   if (new TextEncoder().encode(value).byteLength > MAX_BYTES) throw new Error(`${kind} exceeds 64 KiB`);
   return value;
 }
-async function readSecretStream(kind, stream = process5.stdin) {
+async function readSecretStream(kind, stream = process6.stdin) {
   let value = "";
   for await (const chunk of stream) {
     value += String(chunk);
@@ -484,7 +603,7 @@ function isRecord2(value) {
 
 // src/admin-ai.ts
 async function adminAi(options) {
-  const platform = platformAudience(options.platform ?? process6.env.ODLA_PLATFORM ?? "https://odla.ai");
+  const platform = platformAudience(options.platform ?? process7.env.ODLA_PLATFORM ?? "https://odla.ai");
   const doFetch = options.fetch ?? fetch;
   const out = options.stdout ?? console;
   const usageQuery = options.action === "usage" ? adminAiUsageQuery(options) : void 0;
@@ -663,77 +782,21 @@ function isRecord3(value) {
   return Boolean(value) && typeof value === "object" && !Array.isArray(value);
 }
 
-// src/capabilities.ts
-var CAPABILITIES = {
-  cli: [
-    "start an email-bound device request without accepting a password or user session token",
-    "register the app and enable configured services per environment",
-    "issue, persist, and explicitly rotate configured service credentials",
-    "write local Worker values and push deployed Worker secrets through Wrangler stdin",
-    "store tenant-vault secrets (including the Clerk webhook secret and reserved Clerk secret key) write-only from stdin or an env var",
-    "push db schema/rules and configure platform AI, auth, and deployment links",
-    "apply read-only Google calendar mirror and public booking-page config, then drive state-bound consent, status, discovery, resync, and disconnect flows",
-    "validate config offline and smoke-test a provisioned db environment",
-    "run app-attributed hosted security discovery and independent validation without provider keys",
-    "connect/revoke source-read-only GitHub sources and drive commit-pinned hosted security jobs without PATs or provider keys",
-    "let admins manage system AI policy and credentials, inspect attributed usage, and read immutable admin changes through separate short-lived capability-only approvals"
-  ],
-  agent: [
-    "install and import the selected odla SDKs",
-    "wrap the Worker with withObservability and choose useful telemetry",
-    "make application-specific schema, rules, auth, UI, and migration decisions",
-    "wire @odla-ai/calendar into trusted Worker code and keep the app admin key out of browsers"
-  ],
-  human: [
-    "provide the existing odla account email, then sign in and explicitly review/approve the exact device code",
-    "review mirrored calendar/attendee disclosure and complete the server-issued Google consent flow",
-    "consent to production changes with --yes",
-    "request destructive credential rotation explicitly",
-    "review application semantics, security findings, releases, and merges",
-    "approve redacted-source disclosure before hosted security reasoning",
-    "approve GitHub App repository access separately from redacted-snippet disclosure"
-  ],
-  studio: [
-    "view telemetry and environment state",
-    "let signed-in users inventory/revoke their own agent grants and admins audit/global-revoke them",
-    "review calendar connection, granted read scope, selected calendars, and sync health without exposing provider tokens",
-    "perform manual credential recovery when the CLI's local shown-once copy is unavailable",
-    "configure system AI purposes and view app/environment/run-attributed usage",
-    "connect/revoke GitHub security sources and inspect ref-to-SHA jobs, routes, retention, coverage, and normalized reports"
-  ]
-};
-function printCapabilities(json = false, out = console) {
-  if (json) {
-    out.log(JSON.stringify(CAPABILITIES, null, 2));
-    return;
-  }
-  out.log("odla-ai responsibility boundary\n");
-  printGroup(out, "CLI automates", CAPABILITIES.cli);
-  printGroup(out, "Coding agent changes source", CAPABILITIES.agent);
-  printGroup(out, "Human checkpoints", CAPABILITIES.human);
-  printGroup(out, "Studio", CAPABILITIES.studio);
-}
-function printGroup(out, heading, items) {
-  out.log(`${heading}:`);
-  for (const item of items) out.log(`  - ${item}`);
-  out.log("");
-}
-
 // src/config.ts
 import { existsSync as existsSync3, readFileSync as readFileSync2 } from "fs";
-import { dirname as dirname2, isAbsolute as isAbsolute2, resolve as resolve2 } from "path";
+import { dirname as dirname3, isAbsolute as isAbsolute2, resolve as resolve2 } from "path";
 import { pathToFileURL } from "url";
 var DEFAULT_PLATFORM = "https://odla.ai";
 var DEFAULT_ENVS = ["dev"];
 var DEFAULT_SERVICES = ["db", "ai"];
-var GOOGLE_CALENDAR_READ_SCOPE = "https://www.googleapis.com/auth/calendar.events.readonly";
+var GOOGLE_CALENDAR_EVENTS_SCOPE = "https://www.googleapis.com/auth/calendar.events";
 async function loadProjectConfig(configPath = "odla.config.mjs") {
   const resolved = resolve2(configPath);
   if (!existsSync3(resolved)) {
     throw new Error(`config not found: ${configPath}. Run "odla-ai init" first or pass --config.`);
   }
   const raw = await loadConfigModule(resolved);
-  const rootDir = dirname2(resolved);
+  const rootDir = dirname3(resolved);
   validateRawConfig(raw, resolved);
   const platformUrl = trimSlash(process.env.ODLA_PLATFORM_URL || raw.platformUrl || DEFAULT_PLATFORM);
   const dbEndpoint = trimSlash(process.env.ODLA_DB_ENDPOINT || raw.dbEndpoint || platformUrl);
@@ -789,16 +852,14 @@ function calendarServiceConfig(cfg, env) {
   if (!cfg.envs.includes(env)) throw new Error(`calendar env "${env}" is not declared in config envs`);
   const google = cfg.calendar?.google;
   if (!google) throw new Error("calendar.google is required when the calendar service is enabled");
+  const availability = unique(
+    (google.availabilityCalendars?.[env] ?? google.calendars?.[env]).map((id) => id.trim())
+  );
   return {
     provider: "google",
-    access: "read",
-    calendars: unique(google.calendars[env].map((id) => id.trim())),
-    match: {
-      organizerSelf: google.match?.organizerSelf ?? true,
-      requireAttendees: google.match?.requireAttendees ?? true,
-      ...google.match?.summaryPrefix !== void 0 ? { summaryPrefix: google.match.summaryPrefix.trim() } : {}
-    },
-    attendeePolicy: google.attendeePolicy ?? "full"
+    access: "book",
+    bookingCalendarId: google.bookingCalendar?.[env]?.trim() ?? availability[0],
+    availabilityCalendars: availability
   };
 }
 function calendarBookingPageUrl(cfg, env) {
@@ -847,20 +908,39 @@ function validateCalendarConfig(cfg, envs, services, path) {
   assertOnly(cfg.calendar, ["google"], `${path}: calendar`);
   if (!isRecord4(cfg.calendar.google)) throw new Error(`${path}: calendar.google must be an object`);
   const google = cfg.calendar.google;
-  assertOnly(google, ["calendars", "bookingPageUrl", "match", "attendeePolicy"], `${path}: calendar.google`);
-  if (!isRecord4(google.calendars)) throw new Error(`${path}: calendar.google.calendars must map env names to calendar ids`);
-  const unknownEnv = Object.keys(google.calendars).find((env) => !envs.includes(env));
-  if (unknownEnv) throw new Error(`${path}: calendar.google.calendars.${unknownEnv} is not in config envs`);
+  assertOnly(
+    google,
+    ["availabilityCalendars", "calendars", "bookingCalendar", "bookingPageUrl"],
+    `${path}: calendar.google`
+  );
+  const availabilityKey = google.availabilityCalendars !== void 0 ? "availabilityCalendars" : google.calendars !== void 0 ? "calendars" : null;
+  if (!availabilityKey || google.availabilityCalendars !== void 0 && google.calendars !== void 0) {
+    throw new Error(`${path}: calendar.google requires exactly one of availabilityCalendars or calendars (legacy)`);
+  }
+  const availability = google[availabilityKey];
+  if (!isRecord4(availability)) throw new Error(`${path}: calendar.google.${availabilityKey} must map env names to calendar ids`);
+  const unknownEnv = Object.keys(availability).find((env) => !envs.includes(env));
+  if (unknownEnv) throw new Error(`${path}: calendar.google.${availabilityKey}.${unknownEnv} is not in config envs`);
   for (const env of envs) {
-    const ids = google.calendars[env];
+    const ids = availability[env];
     if (!Array.isArray(ids) || ids.length === 0) {
-      throw new Error(`${path}: calendar.google.calendars.${env} must be a non-empty array`);
+      throw new Error(`${path}: calendar.google.${availabilityKey}.${env} must be a non-empty array`);
     }
     if (ids.length > 10) {
-      throw new Error(`${path}: calendar.google.calendars.${env} must contain at most 10 calendar ids`);
+      throw new Error(`${path}: calendar.google.${availabilityKey}.${env} must contain at most 10 calendar ids`);
     }
     if (ids.some((id) => !safeText(id, 1024))) {
-      throw new Error(`${path}: calendar.google.calendars.${env} contains an invalid calendar id`);
+      throw new Error(`${path}: calendar.google.${availabilityKey}.${env} contains an invalid calendar id`);
+    }
+  }
+  if (google.bookingCalendar !== void 0) {
+    if (!isRecord4(google.bookingCalendar)) throw new Error(`${path}: calendar.google.bookingCalendar must map env names to one calendar id`);
+    const unknownBookingEnv = Object.keys(google.bookingCalendar).find((env) => !envs.includes(env));
+    if (unknownBookingEnv) throw new Error(`${path}: calendar.google.bookingCalendar.${unknownBookingEnv} is not in config envs`);
+    for (const [env, value] of Object.entries(google.bookingCalendar)) {
+      if (!safeText(value, 1024)) {
+        throw new Error(`${path}: calendar.google.bookingCalendar.${env} must be a calendar id`);
+      }
     }
   }
   if (google.bookingPageUrl !== void 0) {
@@ -873,21 +953,6 @@ function validateCalendarConfig(cfg, envs, services, path) {
       }
     }
   }
-  if (google.attendeePolicy !== void 0 && google.attendeePolicy !== "full" && google.attendeePolicy !== "hashed") {
-    throw new Error(`${path}: calendar.google.attendeePolicy must be "full" or "hashed"`);
-  }
-  if (google.match !== void 0) {
-    if (!isRecord4(google.match)) throw new Error(`${path}: calendar.google.match must be an object`);
-    assertOnly(google.match, ["summaryPrefix", "organizerSelf", "requireAttendees"], `${path}: calendar.google.match`);
-    if (google.match.summaryPrefix !== void 0 && !safeText(google.match.summaryPrefix, 256)) {
-      throw new Error(`${path}: calendar.google.match.summaryPrefix must be 1-256 printable characters`);
-    }
-    for (const name of ["organizerSelf", "requireAttendees"]) {
-      if (google.match[name] !== void 0 && typeof google.match[name] !== "boolean") {
-        throw new Error(`${path}: calendar.google.match.${name} must be boolean`);
-      }
-    }
-  }
   if (enabled && !services.includes("db")) throw new Error(`${path}: calendar service requires the db service`);
 }
 function assertOnly(value, allowed, label) {
@@ -926,6 +991,62 @@ function unique(values) {
   return [...new Set(values.filter(Boolean))];
 }
 
+// src/capabilities.ts
+var CAPABILITIES = {
+  cli: [
+    "start an email-bound device request without accepting a password or user session token",
+    "register the app and enable configured services per environment",
+    "issue, persist, and explicitly rotate configured service credentials",
+    "write local Worker values and push deployed Worker secrets through Wrangler stdin",
+    "store tenant-vault secrets (including the Clerk webhook secret and reserved Clerk secret key) write-only from stdin or an env var",
+    "push db schema/rules and configure platform AI, auth, and deployment links",
+    "apply Google Calendar booking config, then drive state-bound consent, status, discovery, and disconnect flows (bookings run live through the platform proxy)",
+    "validate config offline and smoke-test a provisioned db environment",
+    "run app-attributed hosted security discovery and independent validation without provider keys",
+    "connect/revoke source-read-only GitHub sources and drive commit-pinned hosted security jobs without PATs or provider keys",
+    "let admins manage system AI policy and credentials, inspect attributed usage, and read immutable admin changes through separate short-lived capability-only approvals"
+  ],
+  agent: [
+    "install and import the selected odla SDKs",
+    "wrap the Worker with withObservability and choose useful telemetry",
+    "make application-specific schema, rules, auth, UI, and migration decisions",
+    "wire @odla-ai/calendar into trusted Worker code and keep the app admin key out of browsers"
+  ],
+  human: [
+    "provide the existing odla account email, then sign in and explicitly review/approve the exact device code",
+    "review mirrored calendar/attendee disclosure and complete the server-issued Google consent flow",
+    "consent to production changes with --yes",
+    "request destructive credential rotation explicitly",
+    "review application semantics, security findings, releases, and merges",
+    "approve redacted-source disclosure before hosted security reasoning",
+    "approve GitHub App repository access separately from redacted-snippet disclosure"
+  ],
+  studio: [
+    "view telemetry and environment state",
+    "let signed-in users inventory/revoke their own agent grants and admins audit/global-revoke them",
+    "review calendar connection, granted read scope, selected calendars, and sync health without exposing provider tokens",
+    "perform manual credential recovery when the CLI's local shown-once copy is unavailable",
+    "configure system AI purposes and view app/environment/run-attributed usage",
+    "connect/revoke GitHub security sources and inspect ref-to-SHA jobs, routes, retention, coverage, and normalized reports"
+  ]
+};
+function printCapabilities(json = false, out = console) {
+  if (json) {
+    out.log(JSON.stringify(CAPABILITIES, null, 2));
+    return;
+  }
+  out.log("odla-ai responsibility boundary\n");
+  printGroup(out, "CLI automates", CAPABILITIES.cli);
+  printGroup(out, "Coding agent changes source", CAPABILITIES.agent);
+  printGroup(out, "Human checkpoints", CAPABILITIES.human);
+  printGroup(out, "Studio", CAPABILITIES.studio);
+}
+function printGroup(out, heading, items) {
+  out.log(`${heading}:`);
+  for (const item of items) out.log(`  - ${item}`);
+  out.log("");
+}
+
 // src/redact.ts
 var REPLACEMENTS = [
   [/odla_(sk|dev)_[A-Za-z0-9._-]+/g, "odla_$1_[redacted]"],
@@ -949,6 +1070,9 @@ function looksSecret(value) {
 var PLATFORM_NOT_READY_CODES = /* @__PURE__ */ new Set([
   "calendar_google_oauth_not_configured",
   "calendar_token_vault_not_configured",
+  // Current spelling (booking-era key verifier) plus the retired mirror-era
+  // ingress code, so the CLI stays resumable against either platform version.
+  "calendar_db_verifier_not_configured",
   "calendar_db_ingress_not_configured"
 ]);
 var CalendarRequestError = class extends Error {
@@ -971,8 +1095,6 @@ function isCalendarPlatformNotReady(error) {
 var CALENDAR_STATES = [
   "not_connected",
   "authorizing",
-  "needs_sync",
-  "initial_sync",
   "healthy",
   "degraded",
   "disconnected",
@@ -1020,9 +1142,6 @@ async function pollCalendarConnection(ctx, attemptId) {
     ctx.env
   );
 }
-async function requestCalendarResync(ctx) {
-  return parseCalendarStatus(await calendarJson(ctx, "/resync", { method: "POST", body: "{}" }), ctx.env);
-}
 async function requestCalendarDisconnect(ctx) {
   return parseCalendarStatus(
     await calendarJson(ctx, "/disconnect", { method: "POST", body: JSON.stringify({ purge: false }) }),
@@ -1033,10 +1152,8 @@ function parseCalendarStatus(raw, env) {
   const outer = wrapped(raw, "calendar");
   const value = record(outer.attempt) ?? record(outer.status) ?? outer;
   const connection = record(value.connection) ?? {};
-  const sync = record(value.sync) ?? record(connection.sync) ?? {};
   const config = record(value.config) ?? record(outer.config) ?? {};
   const googleConfig = record(config.google) ?? config;
-  const watches = record(value.watches) ?? {};
   const stateValue = calendarState(value.status ?? value.state ?? connection.status ?? connection.state);
   if (!stateValue) {
     throw new Error("calendar status returned an invalid connection state");
@@ -1046,31 +1163,29 @@ function parseCalendarStatus(raw, env) {
     throw new Error("calendar status returned an unsupported provider");
   }
   const accessValue = value.access ?? connection.access ?? config.access ?? googleConfig.access;
-  if (accessValue !== void 0 && accessValue !== "read") throw new Error("calendar status returned unsupported access");
-  const policyValue = value.attendeePolicy ?? config.attendeePolicy ?? googleConfig.attendeePolicy;
-  if (policyValue !== void 0 && policyValue !== "full" && policyValue !== "hashed") {
-    throw new Error("calendar status returned an invalid attendee policy");
+  if (accessValue !== void 0 && accessValue !== "book" && accessValue !== "read") {
+    throw new Error("calendar status returned unsupported access");
   }
   const errorValue = record(value.error) ?? record(connection.error);
   const errorCode = textField(value.lastErrorCode, 128);
   const bookingPageValue = Object.hasOwn(value, "bookingPageUrl") ? value.bookingPageUrl : Object.hasOwn(config, "bookingPageUrl") ? config.bookingPageUrl : googleConfig.bookingPageUrl;
+  const connected = typeof (value.connected ?? connection.connected) === "boolean" ? Boolean(value.connected ?? connection.connected) : ["healthy", "degraded"].includes(stateValue);
+  const bookingCalendarId = textField(value.bookingCalendarId ?? config.bookingCalendarId, 1024);
   return {
     env,
     enabled: typeof value.enabled === "boolean" ? value.enabled : true,
-    connected: typeof (value.connected ?? connection.connected) === "boolean" ? Boolean(value.connected ?? connection.connected) : ["needs_sync", "initial_sync", "healthy", "degraded"].includes(stateValue),
+    connected,
+    writable: typeof value.writable === "boolean" ? value.writable : stateValue === "healthy",
     provider: providerValue === "google" ? "google" : null,
     status: stateValue,
-    ...accessValue === "read" ? { access: "read" } : {},
-    calendars: calendarIds(value.configuredCalendars ?? value.calendars ?? config.calendars ?? googleConfig.calendars),
-    ...policyValue === "full" || policyValue === "hashed" ? { attendeePolicy: policyValue } : {},
-    ...typeof value.attendeePolicyLocked === "boolean" ? { attendeePolicyLocked: value.attendeePolicyLocked } : {},
+    ...accessValue !== void 0 ? { access: "book" } : {},
+    ...bookingCalendarId ? { bookingCalendarId } : {},
+    calendars: calendarIds(
+      value.availabilityCalendars ?? config.availabilityCalendars ?? value.configuredCalendars ?? value.calendars ?? config.calendars ?? googleConfig.calendars
+    ),
     ...optionalNullableUrl("bookingPageUrl", bookingPageValue),
     grantedScopes: stringList(value.grantedScopes ?? connection.grantedScopes ?? connection.scopes),
     ...optionalText("attemptId", value.attemptId ?? connection.attemptId, 180),
-    ...optionalNumber("lastSuccessfulSyncAt", value.lastSuccessfulSyncAt ?? sync.lastSuccessfulSyncAt),
-    ...optionalNumber("lastFullSyncAt", value.lastFullSyncAt ?? sync.lastFullSyncAt),
-    ...optionalNumber("watchExpiresAt", value.watchExpiresAt ?? sync.watchExpiresAt ?? watches.nextExpirationAt),
-    ...optionalInteger("bookingCount", value.bookingCount ?? sync.bookingCount),
     ...errorValue || errorCode ? { error: {
       ...textField(errorValue?.code, 128) ? { code: textField(errorValue?.code, 128) } : {},
       ...textField(errorValue?.message, 500) ? { message: textField(errorValue?.message, 500) } : {},
@@ -1085,7 +1200,9 @@ function calendarState(value) {
     disabled: "not_connected",
     disconnected: "disconnected",
     connecting: "authorizing",
-    syncing: "initial_sync",
+    syncing: "healthy",
+    needs_sync: "healthy",
+    initial_sync: "healthy",
     ready: "healthy",
     error: "failed"
   };
@@ -1153,13 +1270,6 @@ function optionalText(key, value, max) {
   const parsed = textField(value, max);
   return parsed ? { [key]: parsed } : {};
 }
-function optionalNumber(key, value) {
-  const parsed = timestamp3(value);
-  return parsed === void 0 ? {} : { [key]: parsed };
-}
-function optionalInteger(key, value) {
-  return Number.isSafeInteger(value) && value >= 0 ? { [key]: value } : {};
-}
 function optionalNullableUrl(key, value) {
   if (value === null) return { [key]: null };
   const parsed = textField(value, 4096);
@@ -1211,7 +1321,7 @@ async function calendarConnect(options) {
   const page = calendarBookingPageUrl(cfg, ctx.env);
   const applied = page === void 0 ? await readCalendarStatus(ctx) : await applyCalendarSettings(ctx, page);
   const connectOptions = connectionOptions(options, out);
-  return await continueConnectedCalendar(ctx, applied, connectOptions, false) ?? connectWithContext(ctx, connectOptions);
+  return await continueConnectedCalendar(ctx, applied, connectOptions) ?? connectWithContext(ctx, connectOptions);
 }
 async function applyCalendarBookingPage(ctx, bookingPageUrl, out) {
   if (bookingPageUrl === void 0) return null;
@@ -1219,25 +1329,18 @@ async function applyCalendarBookingPage(ctx, bookingPageUrl, out) {
   out.log(`${ctx.env}: calendar booking page ${bookingPageUrl ? "set" : "cleared"}`);
   return status;
 }
-async function calendarResync(options) {
-  const { ctx, out } = await lifecycleContext(options);
-  productionConsent(ctx.env, options.yes, "resync calendar");
-  const status = await requestCalendarResync(ctx);
-  out.log(`${ctx.env}: calendar resync requested (${status.status})`);
-  return status;
-}
 async function calendarDisconnect(options) {
   if (!options.yes) throw new Error("calendar disconnect requires --yes");
   const { ctx, out } = await lifecycleContext(options);
   const status = await requestCalendarDisconnect(ctx);
-  out.log(`${ctx.env}: calendar disconnected; retained mirror rows may now be stale`);
+  out.log(`${ctx.env}: calendar disconnected; no calendar data was stored`);
   return status;
 }
 async function ensureCalendarConnected(ctx, options) {
   const out = options.stdout ?? console;
   const current = await readCalendarStatus(ctx);
   const connectOptions = connectionOptions(options, out);
-  return await continueConnectedCalendar(ctx, current, connectOptions, true) ?? connectWithContext(ctx, connectOptions);
+  return await continueConnectedCalendar(ctx, current, connectOptions) ?? connectWithContext(ctx, connectOptions);
 }
 async function lifecycleContext(options) {
   const cfg = await loadProjectConfig(options.configPath);
@@ -1273,25 +1376,20 @@ function connectionOptions(options, out) {
     signal: options.signal
   };
 }
-async function continueConnectedCalendar(ctx, current, options, reuseDegraded) {
-  if (current.status === "healthy" || reuseDegraded && current.status === "degraded") {
-    options.out.log(`${ctx.env}: calendar ${reuseDegraded ? "connected" : "already connected"} (${current.status})`);
+async function continueConnectedCalendar(ctx, current, options) {
+  if (current.status === "healthy") {
+    options.out.log(`${ctx.env}: calendar already connected (healthy)`);
     return current;
   }
-  if (current.status === "degraded") return null;
-  if (current.status === "needs_sync") {
-    if (!current.connected) return null;
-    options.out.log(`${ctx.env}: calendar configuration needs sync`);
-    const synced = await requestCalendarResync(ctx);
-    options.out.log(`${ctx.env}: calendar ${synced.status.replaceAll("_", " ")}`);
-    return synced;
+  if (current.status === "degraded") {
+    options.out.log(`${ctx.env}: calendar grant predates booking scopes \u2014 Google re-consent required`);
+    return null;
   }
   if (current.status === "failed" && current.connected) {
     const reason = current.error?.message ?? current.error?.code;
-    throw new Error(`calendar connection failed${reason ? `: ${reason}` : ""}; inspect status and resync or reconnect explicitly`);
+    throw new Error(`calendar connection failed${reason ? `: ${reason}` : ""}; inspect status and reconnect explicitly`);
   }
-  const waitingForExisting = current.status === "authorizing" || current.status === "initial_sync" && current.connected;
-  if (!waitingForExisting) return null;
+  if (current.status !== "authorizing") return null;
   const now = options.now ?? Date.now;
   const deadline = now() + pollTimeout(options.pollTimeoutMs);
   const wait = options.wait ?? waitForCalendarPoll;
@@ -1303,17 +1401,16 @@ async function continueConnectedCalendar(ctx, current, options, reuseDegraded) {
       options.out.log(`${ctx.env}: calendar ${status.status.replaceAll("_", " ")}`);
       prior = status.status;
     }
-    if (status.status === "healthy" || reuseDegraded && status.status === "degraded") return status;
+    if (status.status === "healthy") return status;
     if (status.status === "degraded") return null;
-    if (status.status === "needs_sync") return requestCalendarResync(ctx);
     if (status.status === "failed" && status.connected) {
       const reason = status.error?.message ?? status.error?.code;
-      throw new Error(`calendar connection failed${reason ? `: ${reason}` : ""}; inspect status and resync or reconnect explicitly`);
+      throw new Error(`calendar connection failed${reason ? `: ${reason}` : ""}; inspect status and reconnect explicitly`);
     }
-    if (status.status !== "authorizing" && (status.status !== "initial_sync" || !status.connected)) return null;
+    if (status.status !== "authorizing") return null;
     await wait(Math.min(2e3, Math.max(0, deadline - now())), options.signal);
   }
-  throw new Error('Existing Google Calendar authorization or initial sync timed out; run "odla-ai calendar status" and retry');
+  throw new Error('Existing Google Calendar authorization timed out; run "odla-ai calendar status" and retry');
 }
 async function connectWithContext(ctx, options) {
   const attempt = await startCalendarConnection(ctx);
@@ -1335,14 +1432,17 @@ async function connectWithContext(ctx, options) {
       options.out.log(`${ctx.env}: calendar ${status.status.replaceAll("_", " ")}`);
       prior = status.status;
     }
-    if (status.status === "healthy" || status.status === "degraded") return status;
+    if (status.status === "healthy") return status;
+    if (status.status === "degraded") {
+      throw new Error("calendar connected without booking scopes; re-run connect and grant calendar access");
+    }
     if (status.status === "failed" || status.status === "disconnected" || status.status === "not_connected") {
       const reason = status.error?.message ?? status.error?.code;
       throw new Error(`calendar connection ${status.status}${reason ? `: ${reason}` : ""}`);
     }
     await wait(Math.min(2e3, Math.max(0, deadline - now())), options.signal);
   }
-  throw new Error('Google Calendar consent or initial sync timed out; run "odla-ai calendar status" and retry connect');
+  throw new Error('Google Calendar consent timed out; run "odla-ai calendar status" and retry connect');
 }
 function trustedCalendarConsentUrl(platform, value) {
   const origin = platformAudience(platform);
@@ -1372,26 +1472,22 @@ function printStatus(status, json, out) {
     return;
   }
   out.log(`calendar: ${status.provider ?? "none"}/${status.status} (${status.env})`);
-  out.log(`  access: ${status.access ?? "not granted"}`);
-  out.log(`  calendars: ${status.calendars.length ? status.calendars.join(", ") : "none"}`);
-  if (status.attendeePolicy) {
-    out.log(`  attendee policy: ${status.attendeePolicy}${status.attendeePolicyLocked ? " (locked)" : ""}`);
-  }
+  out.log(`  bookable: ${status.writable ? "yes" : status.connected ? "no \u2014 reconnect to grant booking scopes" : "no \u2014 not connected"}`);
+  if (status.bookingCalendarId) out.log(`  booking calendar: ${status.bookingCalendarId}`);
+  out.log(`  availability calendars: ${status.calendars.length ? status.calendars.join(", ") : "none"}`);
   if (status.bookingPageUrl !== void 0) out.log(`  booking page: ${status.bookingPageUrl ?? "not configured"}`);
-  out.log(`  last sync: ${status.lastSuccessfulSyncAt === void 0 ? "never" : new Date(status.lastSuccessfulSyncAt).toISOString()}`);
-  if (status.bookingCount !== void 0) out.log(`  bookings: ${status.bookingCount}`);
   if (status.error?.code || status.error?.message) out.log(`  error: ${status.error.code ?? "error"}${status.error.message ? ` \u2014 ${status.error.message}` : ""}`);
 }
 
 // src/doctor-checks.ts
 import { execFileSync } from "child_process";
 import { existsSync as existsSync5, readFileSync as readFileSync4 } from "fs";
-import { join as join2, resolve as resolve3 } from "path";
+import { join as join3, resolve as resolve3 } from "path";
 
 // src/wrangler.ts
 import { spawn as spawn2 } from "child_process";
 import { existsSync as existsSync4, readFileSync as readFileSync3 } from "fs";
-import { join } from "path";
+import { join as join2 } from "path";
 var defaultRunner = (cmd, args, opts) => new Promise((resolvePromise, reject) => {
   const child = spawn2(cmd, args, { cwd: opts?.cwd, stdio: ["pipe", "pipe", "pipe"] });
   let stdout = "";
@@ -1405,7 +1501,7 @@ var defaultRunner = (cmd, args, opts) => new Promise((resolvePromise, reject) =>
 var WRANGLER_CONFIG_FILES = ["wrangler.jsonc", "wrangler.json", "wrangler.toml"];
 function findWranglerConfig(rootDir) {
   for (const name of WRANGLER_CONFIG_FILES) {
-    const path = join(rootDir, name);
+    const path = join2(rootDir, name);
     if (existsSync4(path)) return path;
   }
   return null;
@@ -1514,7 +1610,7 @@ function wranglerWarnings(rootDir) {
       const dir = resolve3(rootDir, assets.directory);
       if (dir === resolve3(rootDir)) {
         warnings.push(`${label}assets.directory is the project root \u2014 point it at a dedicated build dir (wrangler dev fails with "spawn EBADF")`);
-      } else if (existsSync5(join2(dir, "node_modules"))) {
+      } else if (existsSync5(join3(dir, "node_modules"))) {
         warnings.push(`${label}assets.directory contains node_modules \u2014 wrangler dev's watcher will exhaust file descriptors`);
       }
     }
@@ -1579,7 +1675,7 @@ function calendarProjectWarnings(rootDir) {
 }
 function readPackageJson(rootDir) {
   try {
-    return JSON.parse(readFileSync4(join2(rootDir, "package.json"), "utf8"));
+    return JSON.parse(readFileSync4(join3(rootDir, "package.json"), "utf8"));
   } catch {
     return null;
   }
@@ -1603,8 +1699,11 @@ async function doctor(options) {
   out.log(`rules:  ${rules ? `${Object.keys(rules).length} namespaces` : "none"}`);
   out.log(`ai:     ${cfg.services.includes("ai") ? cfg.ai?.provider ?? "not configured" : "not enabled"}`);
   if (cfg.services.includes("calendar")) {
-    const calendar = cfg.envs.map((env) => `${env}:${calendarServiceConfig(cfg, env).calendars.length}`).join(", ");
-    out.log(`calendar: google/read-only (${calendar}; attendee ${cfg.calendar?.google.attendeePolicy ?? "full"})`);
+    const calendar = cfg.envs.map((env) => {
+      const resolved = calendarServiceConfig(cfg, env);
+      return `${env}:${resolved.bookingCalendarId}+${resolved.availabilityCalendars.length}`;
+    }).join(", ");
+    out.log(`calendar: google/booking (${calendar})`);
     const pages = cfg.envs.map((env) => `${env}:${calendarBookingPageUrl(cfg, env) ?? "none"}`).join(", ");
     out.log(`booking pages: ${pages}`);
   } else {
@@ -1657,7 +1756,7 @@ async function doctor(options) {
 
 // src/init.ts
 import { existsSync as existsSync6, mkdirSync as mkdirSync2, writeFileSync as writeFileSync2 } from "fs";
-import { dirname as dirname3, resolve as resolve4 } from "path";
+import { dirname as dirname4, resolve as resolve4 } from "path";
 function initProject(options) {
   const out = options.stdout ?? console;
   const rootDir = resolve4(options.rootDir ?? process.cwd());
@@ -1672,7 +1771,7 @@ function initProject(options) {
   const services = options.services?.length ? options.services : ["db", "ai"];
   if (services.includes("calendar") && !services.includes("db")) throw new Error("--services calendar requires db");
   const aiProvider = options.aiProvider ?? "anthropic";
-  mkdirSync2(dirname3(configPath), { recursive: true });
+  mkdirSync2(dirname4(configPath), { recursive: true });
   mkdirSync2(resolve4(rootDir, "src/odla"), { recursive: true });
   mkdirSync2(resolve4(rootDir, ".odla"), { recursive: true });
   writeFileSync2(configPath, configTemplate({ appId: options.appId, name: options.name, envs, services, aiProvider }));
@@ -1690,11 +1789,11 @@ function writeIfMissing(path, text) {
 function configTemplate(input) {
   const calendar = input.services.includes("calendar") ? `  calendar: {
     google: {
-      calendars: ${JSON.stringify(Object.fromEntries(input.envs.map((env) => [env, ["primary"]])))},
+      // Calendars consulted for availability; bookings land on bookingCalendar
+      // (defaults to the first availability calendar). Google consent happens
+      // in the browser during provision; bookings write live through odla.ai.
+      availabilityCalendars: ${JSON.stringify(Object.fromEntries(input.envs.map((env) => [env, ["primary"]])))},
       bookingPageUrl: ${JSON.stringify(Object.fromEntries(input.envs.map((env) => [env, null])))},
-      match: { organizerSelf: true, requireAttendees: true },
-      attendeePolicy: "full",
-      // Read-only in this release. Google consent happens in Studio during provision.
     },
   },
 ` : "";
@@ -1858,7 +1957,7 @@ function assertWranglerConfig(cfg) {
 // src/provision.ts
 import { createAppsClient, tenantIdFor as tenantIdFor2 } from "@odla-ai/apps";
 import { DEFAULT_SECRET_NAMES, putSecret } from "@odla-ai/ai";
-import process7 from "process";
+import process8 from "process";
 
 // src/provision-credentials.ts
 import { tenantIdFor } from "@odla-ai/apps";
@@ -1990,7 +2089,7 @@ async function provision(options) {
     if (cfg.services.includes("calendar")) {
       for (const env of cfg.envs) {
         const calendar = calendarServiceConfig(cfg, env);
-        out.log(`  calendar.${env}: google/read, ${calendar.calendars.join(", ")} (${calendar.attendeePolicy}; ${GOOGLE_CALENDAR_READ_SCOPE})`);
+        out.log(`  calendar.${env}: google/book \u2192 ${calendar.bookingCalendarId}; availability ${calendar.availabilityCalendars.join(", ")} (${GOOGLE_CALENDAR_EVENTS_SCOPE})`);
         const bookingPage = calendarBookingPageUrl(cfg, env);
         out.log(`  calendar.${env}.bookingPageUrl: ${bookingPage === void 0 ? "unchanged" : bookingPage ?? "clear"}`);
       }
@@ -2013,7 +2112,7 @@ async function provision(options) {
   }
   const devVarsTarget = resolveWriteDevVarsTarget(cfg, options.writeDevVars);
   if (cfg.local.gitignore) {
-    ensureGitignore(cfg.rootDir, [cfg.local.tokenFile, cfg.local.credentialsFile, ...devVarsTarget ? [devVarsTarget] : []]);
+    ensureGitignore(cfg.rootDir, [cfg.local.tokenFile, handshakeFile(cfg), cfg.local.credentialsFile, ...devVarsTarget ? [devVarsTarget] : []]);
   }
   if (options.pushSecrets) {
     await preflightSecretsPush({ configPath: cfg.configPath, runner: options.secretRunner });
@@ -2103,7 +2202,7 @@ ${env}: credentials are already saved; retry "odla-ai secrets push --env ${env}$
       out.log(`${env}: rules pushed (${Object.keys(rules).length} namespaces)`);
     }
     if (cfg.services.includes("ai") && cfg.ai?.provider && cfg.ai.keyEnv) {
-      const key = process7.env[cfg.ai.keyEnv];
+      const key = process8.env[cfg.ai.keyEnv];
       if (key) {
         const secretName = cfg.ai.secretName ?? defaultSecretName(cfg.ai.provider);
         await putSecret({ endpoint: cfg.dbEndpoint, token, fetch: doFetch }, tenantId, secretName, key);
@@ -2735,7 +2834,7 @@ function securityExecutionDigest(value) {
 // src/skill.ts
 import { existsSync as existsSync7, lstatSync, mkdirSync as mkdirSync3, readFileSync as readFileSync5, readdirSync, writeFileSync as writeFileSync3 } from "fs";
 import { homedir } from "os";
-import { dirname as dirname4, isAbsolute as isAbsolute4, join as join3, relative as relative3, resolve as resolve6, sep as sep2 } from "path";
+import { dirname as dirname5, isAbsolute as isAbsolute4, join as join4, relative as relative3, resolve as resolve6, sep as sep2 } from "path";
 import { fileURLToPath } from "url";
 
 // src/skill-adapters.ts
@@ -2811,48 +2910,48 @@ function installSkill(options = {}) {
     plans.set(target, { target, content, boundary, managedMerge });
   };
   const planSkillTree = (targetDir2, boundary = root) => {
-    for (const rel of files) plan(join3(targetDir2, rel), readFileSync5(join3(sourceDir, rel), "utf8"), false, boundary);
+    for (const rel of files) plan(join4(targetDir2, rel), readFileSync5(join4(sourceDir, rel), "utf8"), false, boundary);
   };
   let targetDir;
   if (options.global) {
-    const claudeRoot = join3(home, ".claude", "skills");
-    const codexRoot = resolve6(options.codexHomeDir ?? process.env.CODEX_HOME ?? join3(home, ".codex"), "skills");
+    const claudeRoot = join4(home, ".claude", "skills");
+    const codexRoot = resolve6(options.codexHomeDir ?? process.env.CODEX_HOME ?? join4(home, ".codex"), "skills");
     targetDir = harnesses[0] === "codex" ? codexRoot : claudeRoot;
     for (const harness of harnesses) {
       const skillRoot = harness === "claude" ? claudeRoot : codexRoot;
-      planSkillTree(skillRoot, harness === "claude" ? home : dirname4(dirname4(codexRoot)));
+      planSkillTree(skillRoot, harness === "claude" ? home : dirname5(dirname5(codexRoot)));
       rememberTarget(harness, skillRoot);
     }
   } else {
-    const sharedRoot = join3(root, ".agents", "skills");
+    const sharedRoot = join4(root, ".agents", "skills");
     planSkillTree(sharedRoot);
-    const claudeRoot = join3(root, ".claude", "skills");
+    const claudeRoot = join4(root, ".claude", "skills");
     targetDir = harnesses.includes("claude") ? claudeRoot : sharedRoot;
     for (const harness of harnesses) rememberTarget(harness, sharedRoot);
     if (harnesses.includes("claude")) {
       for (const skill of skillNames(files)) {
-        const canonical = readFileSync5(join3(sourceDir, skill, "SKILL.md"), "utf8");
-        plan(join3(claudeRoot, skill, "SKILL.md"), claudeAdapter(skill, canonical));
+        const canonical = readFileSync5(join4(sourceDir, skill, "SKILL.md"), "utf8");
+        plan(join4(claudeRoot, skill, "SKILL.md"), claudeAdapter(skill, canonical));
       }
       rememberTarget("claude", claudeRoot);
     }
     if (harnesses.includes("cursor")) {
-      const cursorRule = join3(root, ".cursor", "rules", "odla.mdc");
+      const cursorRule = join4(root, ".cursor", "rules", "odla.mdc");
       plan(cursorRule, CURSOR_RULE);
       rememberTarget("cursor", cursorRule);
     }
     if (harnesses.includes("agents")) {
-      const agentsFile = join3(root, "AGENTS.md");
+      const agentsFile = join4(root, "AGENTS.md");
       plan(agentsFile, managedFileContent(agentsFile, PROJECT_INSTRUCTIONS, options.force === true, root), true);
       rememberTarget("agents", agentsFile);
     }
     if (harnesses.includes("copilot")) {
-      const copilotFile = join3(root, ".github", "copilot-instructions.md");
+      const copilotFile = join4(root, ".github", "copilot-instructions.md");
       plan(copilotFile, managedFileContent(copilotFile, PROJECT_INSTRUCTIONS, options.force === true, root), true);
       rememberTarget("copilot", copilotFile);
     }
     if (harnesses.includes("gemini")) {
-      const geminiFile = join3(root, "GEMINI.md");
+      const geminiFile = join4(root, "GEMINI.md");
       plan(geminiFile, managedFileContent(geminiFile, PROJECT_INSTRUCTIONS, options.force === true, root), true);
       rememberTarget("gemini", geminiFile);
     }
@@ -2888,7 +2987,7 @@ ${conflicts.map((f) => `  - ${f}`).join("\n")}`
   }
   for (const file of plans.values()) {
     if (!existsSync7(file.target) || readFileSync5(file.target, "utf8") !== file.content) {
-      mkdirSync3(dirname4(file.target), { recursive: true });
+      mkdirSync3(dirname5(file.target), { recursive: true });
       writeFileSync3(file.target, file.content);
     }
   }
@@ -2959,7 +3058,7 @@ function symlinkedComponent(boundary, target) {
   }
   let current = boundary;
   for (const part of rel.split(sep2).filter(Boolean)) {
-    current = join3(current, part);
+    current = join4(current, part);
     try {
       if (lstatSync(current).isSymbolicLink()) return current;
     } catch (error) {
@@ -2976,7 +3075,7 @@ function listFiles(dir) {
   const results = [];
   const walk = (current) => {
     for (const entry of readdirSync(current, { withFileTypes: true })) {
-      const path = join3(current, entry.name);
+      const path = join4(current, entry.name);
       if (entry.isDirectory()) walk(path);
       else results.push(relative3(dir, path));
     }
@@ -3029,7 +3128,7 @@ async function smoke(options) {
     );
     const status = await readCalendarStatus({ platform: cfg.platformUrl, appId: cfg.app.id, env, token, fetch: doFetch });
     assertCalendarHealthy(status, calendarServiceConfig(cfg, env));
-    out.log(`  calendar: ${status.status}, last sync ${new Date(status.lastSuccessfulSyncAt).toISOString()}`);
+    out.log(`  calendar: ${status.status}, bookable (booking \u2192 ${status.bookingCalendarId ?? "primary"})`);
   }
   const expectedSchema = await resolveDataExport(cfg, cfg.db?.schema, ["schema", "SCHEMA"]);
   const expectedEntities = serializedEntities(expectedSchema);
@@ -3052,14 +3151,6 @@ async function smoke(options) {
   } else {
     out.log(`  aggregate: skipped (schema has no entities)`);
   }
-  if (cfg.services.includes("calendar")) {
-    const bookings = await postJson2(doFetch, `${cfg.dbEndpoint}/app/${encodeURIComponent(entry.tenantId)}/aggregate`, entry.dbKey, {
-      ns: "$bookings",
-      aggregate: { count: true }
-    });
-    const count = bookings.aggregate?.count;
-    out.log(`  bookings: ${String(count ?? "ok")}`);
-  }
   out.log("ok");
 }
 function assertCalendarHealthy(status, expected) {
@@ -3067,14 +3158,11 @@ function assertCalendarHealthy(status, expected) {
   if (status.status !== "healthy") {
     throw new Error(`calendar connection is ${status.status}${status.error?.message ? `: ${status.error.message}` : ""}`);
   }
-  if (status.access !== "read") throw new Error("calendar connection is not read-only");
-  const hasReadScope = status.grantedScopes.some((scope) => scope === GOOGLE_CALENDAR_READ_SCOPE || scope === "calendar.events.readonly");
-  if (!hasReadScope) throw new Error("calendar connection is missing calendar.events.readonly consent");
-  const missing = expected.calendars.filter((id) => !status.calendars.includes(id));
+  if (!status.writable) throw new Error('calendar grant does not cover booking writes; run "odla-ai calendar connect" to re-consent');
+  const hasEventsScope = status.grantedScopes.some((scope) => scope === GOOGLE_CALENDAR_EVENTS_SCOPE);
+  if (!hasEventsScope) throw new Error("calendar connection is missing calendar.events consent");
+  const missing = expected.availabilityCalendars.filter((id) => !status.calendars.includes(id));
   if (missing.length) throw new Error(`calendar connection is missing configured calendars: ${missing.join(", ")}`);
-  if (status.lastSuccessfulSyncAt === void 0) throw new Error("calendar has never completed a sync");
-  if (Date.now() - status.lastSuccessfulSyncAt > 30 * 6e4) throw new Error("calendar sync is more than 30 minutes stale");
-  if (status.watchExpiresAt !== void 0 && status.watchExpiresAt <= Date.now()) throw new Error("calendar watch channel is expired");
 }
 async function getJson(doFetch, url, bearer) {
   const res = await doFetch(url, {
@@ -3241,6 +3329,127 @@ async function adminCommand(parsed) {
   });
 }
 
+// src/app-export.ts
+import { createWriteStream } from "fs";
+import { Readable } from "stream";
+import { pipeline } from "stream/promises";
+async function appExport(options) {
+  const cfg = await loadProjectConfig(options.configPath);
+  const out = options.stdout ?? console;
+  const doFetch = options.fetch ?? fetch;
+  const env = options.env ?? (cfg.envs.includes("dev") ? "dev" : cfg.envs[0]);
+  if (!env || !cfg.envs.includes(env)) throw new Error(`env "${env ?? ""}" is not declared in ${options.configPath}`);
+  const tenant = env === "prod" ? cfg.app.id : `${cfg.app.id}--${env}`;
+  const token = await getDeveloperToken(
+    cfg,
+    { configPath: cfg.configPath, token: options.token, email: options.email, open: false },
+    doFetch,
+    out
+  );
+  const auth = { authorization: `Bearer ${token}` };
+  const base = `${cfg.dbEndpoint}/admin/apps/${encodeURIComponent(tenant)}`;
+  if (options.fresh) {
+    const res = await doFetch(`${base}/export`, { method: "POST", headers: auth });
+    const body = await res.json().catch(() => ({}));
+    if (!res.ok) throw new Error(`export failed${body.error?.code ? ` (${body.error.code})` : ""}: ${body.error?.message ?? res.status}`);
+  }
+  const list = await doFetch(`${base}/backups`, { headers: auth });
+  if (!list.ok) throw new Error(`couldn't list backups (${list.status})`);
+  const { backups } = await list.json();
+  const newest = backups[0];
+  if (!newest) {
+    throw new Error(
+      `${tenant} has no backups yet \u2014 run \`odla-ai app export --fresh\` to take one now (nightly snapshots appear after the first day with writes)`
+    );
+  }
+  const download = await doFetch(`${base}/backups/${newest.id}/download`, { headers: auth });
+  if (!download.ok || !download.body) throw new Error(`download failed (${download.status})`);
+  const file = options.out ?? `${tenant}-${new Date(newest.created_at).toISOString().slice(0, 10)}-tx${newest.max_tx}.jsonl.gz`;
+  await pipeline(Readable.fromWeb(download.body), createWriteStream(file));
+  if (options.json) out.log(JSON.stringify({ file, backup: newest }, null, 2));
+  else {
+    out.log(`${tenant}: wrote ${file} (${newest.bytes} bytes, ${newest.kind} snapshot at tx ${newest.max_tx})`);
+    out.log(`sha256 ${download.headers.get("x-odla-sha256") ?? newest.sha256}`);
+  }
+  return { file, backup: newest };
+}
+
+// src/app-lifecycle.ts
+async function lifecycleCall(action, options) {
+  const cfg = await loadProjectConfig(options.configPath);
+  const out = options.stdout ?? console;
+  const doFetch = options.fetch ?? fetch;
+  const token = await getDeveloperToken(
+    cfg,
+    { configPath: cfg.configPath, token: options.token, email: options.email, open: false },
+    doFetch,
+    out
+  );
+  const res = await doFetch(`${cfg.platformUrl}/registry/apps/${encodeURIComponent(cfg.app.id)}/${action}`, {
+    method: "POST",
+    headers: { authorization: `Bearer ${token}`, "content-type": "application/json" }
+  });
+  const body = await res.json().catch(() => ({}));
+  if (!res.ok || !body.ok) {
+    throw new Error(`${action} failed${body.error?.code ? ` (${body.error.code})` : ""}: ${body.error?.message ?? `registry returned ${res.status}`}`);
+  }
+  return body;
+}
+async function appArchive(options) {
+  if (options.yes !== true) {
+    throw new Error(
+      "app archive suspends EVERY environment: API keys stop working and all services refuse requests until restored. All data is retained. Pass --yes to proceed."
+    );
+  }
+  const out = options.stdout ?? console;
+  const body = await lifecycleCall("archive", options);
+  if (options.json) out.log(JSON.stringify(body, null, 2));
+  else if (body.operation?.state === "noop") out.log(`${body.app?.appId}: already archived`);
+  else out.log(`${body.app?.appId}: archived \u2014 data retained; run \`odla-ai app restore\` (or use Studio) to bring it back`);
+}
+async function appRestore(options) {
+  const out = options.stdout ?? console;
+  const body = await lifecycleCall("restore", options);
+  if (options.json) out.log(JSON.stringify(body, null, 2));
+  else if (body.operation?.state === "noop") out.log(`${body.app?.appId}: already active`);
+  else out.log(`${body.app?.appId}: restored \u2014 every service's data plane is live again`);
+}
+async function appCommand(parsed, dependencies = {}) {
+  const sub = parsed.positionals[1];
+  if (sub === "export") {
+    assertArgs(parsed, ["config", "env", "token", "email", "fresh", "out", "json"], 2);
+    await appExport({
+      configPath: stringOpt(parsed.options.config) ?? "odla.config.mjs",
+      env: stringOpt(parsed.options.env),
+      token: stringOpt(parsed.options.token),
+      email: stringOpt(parsed.options.email),
+      fresh: parsed.options.fresh === true,
+      out: stringOpt(parsed.options.out),
+      json: parsed.options.json === true,
+      fetch: dependencies.fetch,
+      stdout: dependencies.stdout
+    });
+    return;
+  }
+  if (sub !== "archive" && sub !== "restore") {
+    throw new Error(
+      `unknown app subcommand "${sub ?? ""}". Try "odla-ai app archive --yes", "odla-ai app restore", or "odla-ai app export". (Permanent deletion has no CLI: it requires a signed-in owner in Studio.)`
+    );
+  }
+  assertArgs(parsed, ["config", "token", "email", "yes", "json"], 2);
+  const options = {
+    configPath: stringOpt(parsed.options.config) ?? "odla.config.mjs",
+    token: stringOpt(parsed.options.token),
+    email: stringOpt(parsed.options.email),
+    yes: parsed.options.yes === true,
+    json: parsed.options.json === true,
+    fetch: dependencies.fetch,
+    stdout: dependencies.stdout
+  };
+  if (sub === "archive") await appArchive(options);
+  else await appRestore(options);
+}
+
 // src/help.ts
 import { readFileSync as readFileSync6 } from "fs";
 function cliVersion() {
@@ -3257,8 +3466,10 @@ Usage:
   odla-ai calendar status [--env dev] [--email <odla-account>] [--json]
   odla-ai calendar calendars [--env dev] [--email <odla-account>] [--json]
   odla-ai calendar connect [--env dev] [--email <odla-account>] [--no-open] [--yes]
-  odla-ai calendar resync [--env dev] [--email <odla-account>] [--yes]
   odla-ai calendar disconnect [--env dev] [--email <odla-account>] --yes
+  odla-ai app archive [--config odla.config.mjs] [--email <odla-account>] [--json] --yes
+  odla-ai app restore [--config odla.config.mjs] [--email <odla-account>] [--json]
+  odla-ai app export [--env dev] [--fresh] [--out <file>] [--email <odla-account>] [--json]
   odla-ai capabilities [--json]
   odla-ai admin ai show [--platform https://odla.ai] [--email <odla-account>] [--json]
   odla-ai admin ai models [--provider <id>] [--json]
@@ -3278,7 +3489,7 @@ Usage:
   odla-ai security report <job-id> [--json]
   odla-ai security run [target] --ack-redacted-source [--env dev] [--profile odla] [--fail-on high]
   odla-ai security run [target] --self --ack-redacted-source
-  odla-ai provision [--config odla.config.mjs] [--email <odla-account>] [--dry-run] [--push-secrets] [--rotate-o11y-token] [--write-dev-vars[=path]] [--yes]
+  odla-ai provision [--config odla.config.mjs] [--email <odla-account>] [--wait <seconds>] [--dry-run] [--push-secrets] [--rotate-o11y-token] [--write-dev-vars[=path]] [--yes]
   odla-ai smoke [--config odla.config.mjs] [--env dev] [--email <odla-account>] [--no-open]
   odla-ai skill install [--dir <project>] [--agent <name>] [--global] [--force]
   odla-ai secrets push --env <env> [--config odla.config.mjs] [--dry-run] [--yes]
@@ -3290,7 +3501,14 @@ Commands:
   setup        Install offline odla runbooks for common coding-agent harnesses.
   init         Create a generic odla.config.mjs plus starter schema/rules files.
   doctor       Validate and summarize the project config without network calls.
-  calendar     Inspect, connect, resync, or disconnect a read-only Google mirror.
+  calendar     Inspect, connect, or disconnect the live Google booking connection.
+  app          Archive (suspend, data retained), restore, or export the app.
+               Archiving takes every environment's data plane down until restored;
+               permanent deletion has NO CLI \u2014 it requires a signed-in owner in
+               Studio, and no machine or agent credential can purge. "app export"
+               downloads a portable gzipped-JSONL snapshot of one environment's
+               database (--fresh takes a new snapshot first) \u2014 your data is
+               always yours to take.
   capabilities Show what the CLI automates vs agent edits and human checkpoints.
   admin        Manage platform-funded AI routing/credentials/usage with narrow device grants.
   security     Connect GitHub sources and run commit-pinned hosted reviews, or scan a local snapshot.
@@ -3312,6 +3530,12 @@ Safety:
   Provision opens the approval page in your browser automatically whenever the
   machine can show one, including agent-driven runs; only CI, SSH, and
   display-less hosts skip it. Use --open to force or --no-open to suppress.
+  Browser launch is best-effort: the printed approval URL is authoritative and
+  agents must relay it to the human verbatim. A started handshake is persisted
+  under .odla/, so a command killed mid-wait loses nothing \u2014 rerunning resumes
+  the same code. Outside an interactive terminal the wait is capped (90s by
+  default, --wait <seconds> to change); a still-pending handshake then exits
+  with code 75: relay the URL, wait for approval, and re-run to collect.
   A fresh device handshake requires --email <odla-account> or ODLA_USER_EMAIL.
   The email is a non-secret identity hint: never provide a password or session
   token. The matching account must already exist, be signed in, explicitly
@@ -3781,6 +4005,9 @@ async function securityStatus(parsed, dependencies) {
 }
 
 // src/cli.ts
+function exitCodeFor(err) {
+  return err?.code === "handshake_pending" ? 75 : 1;
+}
 async function runCli(argv = process.argv.slice(2), dependencies = {}) {
   const parsed = parseArgv(argv);
   const command = parsed.positionals[0] ?? "help";
@@ -3833,6 +4060,10 @@ async function runCli(argv = process.argv.slice(2), dependencies = {}) {
     await adminCommand(parsed);
     return;
   }
+  if (command === "app") {
+    await appCommand(parsed, dependencies);
+    return;
+  }
   if (command === "security") {
     await securityCommand(parsed, dependencies);
     return;
@@ -3929,6 +4160,7 @@ async function provisionCommand(parsed, dependencies) {
     "token",
     "email",
     "open",
+    "wait",
     "yes"
   ], 1);
   const writeDevVars2 = parsed.options["write-dev-vars"];
@@ -3943,6 +4175,7 @@ async function provisionCommand(parsed, dependencies) {
     token: stringOpt(parsed.options.token),
     email: stringOpt(parsed.options.email),
     open: parsed.options.open === false ? false : parsed.options.open === true ? true : void 0,
+    wait: numberOpt(parsed.options.wait, "--wait"),
     yes: parsed.options.yes === true,
     fetch: dependencies.fetch,
     openApprovalUrl: dependencies.openUrl,
@@ -3952,7 +4185,7 @@ async function provisionCommand(parsed, dependencies) {
 }
 async function calendarCommand(parsed, dependencies) {
   const sub = parsed.positionals[1];
-  if (sub !== "status" && sub !== "calendars" && sub !== "connect" && sub !== "resync" && sub !== "disconnect") {
+  if (sub !== "status" && sub !== "calendars" && sub !== "connect" && sub !== "disconnect") {
     throw new Error(`unknown calendar subcommand "${sub ?? ""}". Try "odla-ai calendar status --env dev".`);
   }
   assertArgs(parsed, ["config", "env", "json", "token", "email", "open", "yes"], 2);
@@ -3973,7 +4206,6 @@ async function calendarCommand(parsed, dependencies) {
   if (sub === "status") await calendarStatus(options);
   else if (sub === "calendars") await calendarCalendars(options);
   else if (sub === "connect") await calendarConnect(options);
-  else if (sub === "resync") await calendarResync(options);
   else await calendarDisconnect(options);
 }
 
@@ -3981,16 +4213,15 @@ export {
   getScopedPlatformToken,
   SYSTEM_AI_PURPOSES,
   adminAi,
-  CAPABILITIES,
-  printCapabilities,
-  GOOGLE_CALENDAR_READ_SCOPE,
+  GOOGLE_CALENDAR_EVENTS_SCOPE,
   calendarServiceConfig,
   calendarBookingPageUrl,
+  CAPABILITIES,
+  printCapabilities,
   redactSecrets,
   calendarStatus,
   calendarCalendars,
   calendarConnect,
-  calendarResync,
   calendarDisconnect,
   doctor,
   initProject,
@@ -4015,6 +4246,7 @@ export {
   AGENT_HARNESSES,
   installSkill,
   smoke,
+  exitCodeFor,
   runCli
 };
-//# sourceMappingURL=chunk-DC4MIB4X.js.map
+//# sourceMappingURL=chunk-Y4HWUEFF.js.map