@odla-ai/cli 0.11.2 → 0.12.0

package/dist/index.cjs

@@ -33,19 +33,19 @@ var index_exports = {};
 __export(index_exports, {
   AGENT_HARNESSES: () => AGENT_HARNESSES,
   CAPABILITIES: () => CAPABILITIES,
-  GOOGLE_CALENDAR_READ_SCOPE: () => GOOGLE_CALENDAR_READ_SCOPE,
+  GOOGLE_CALENDAR_EVENTS_SCOPE: () => GOOGLE_CALENDAR_EVENTS_SCOPE,
   SYSTEM_AI_PURPOSES: () => SYSTEM_AI_PURPOSES,
   adminAi: () => adminAi,
   calendarBookingPageUrl: () => calendarBookingPageUrl,
   calendarCalendars: () => calendarCalendars,
   calendarConnect: () => calendarConnect,
   calendarDisconnect: () => calendarDisconnect,
-  calendarResync: () => calendarResync,
   calendarServiceConfig: () => calendarServiceConfig,
   calendarStatus: () => calendarStatus,
   connectGitHubSecuritySource: () => connectGitHubSecuritySource,
   disconnectGitHubSecuritySource: () => disconnectGitHubSecuritySource,
   doctor: () => doctor,
+  exitCodeFor: () => exitCodeFor,
   followHostedSecurityJob: () => followHostedSecurityJob,
   getHostedSecurityIntent: () => getHostedSecurityIntent,
   getHostedSecurityJob: () => getHostedSecurityJob,
@@ -77,35 +77,16 @@ var getImportMetaUrl = () => typeof document === "undefined" ? new URL(`file:${_
 var importMetaUrl = /* @__PURE__ */ getImportMetaUrl();
 
 // src/admin-ai.ts
-var import_node_process5 = __toESM(require("process"), 1);
+var import_node_process6 = __toESM(require("process"), 1);
 
 // src/token.ts
 var import_db = require("@odla-ai/db");
-var import_node_process2 = __toESM(require("process"), 1);
+var import_node_process3 = __toESM(require("process"), 1);
 
-// src/open.ts
-var import_node_child_process = require("child_process");
+// src/handshake-state.ts
+var import_node_fs2 = require("fs");
+var import_node_path2 = require("path");
 var import_node_process = __toESM(require("process"), 1);
-async function openUrl(url, options = {}) {
-  const command = openerFor(options.platform ?? import_node_process.default.platform);
-  const doSpawn = options.spawnImpl ?? import_node_child_process.spawn;
-  await new Promise((resolve7, reject) => {
-    const child = doSpawn(command.cmd, [...command.args, url], {
-      stdio: "ignore",
-      detached: true
-    });
-    child.once("error", reject);
-    child.once("spawn", () => {
-      child.unref();
-      resolve7();
-    });
-  });
-}
-function openerFor(platform) {
-  if (platform === "darwin") return { cmd: "open", args: [] };
-  if (platform === "win32") return { cmd: "cmd", args: ["/c", "start", ""] };
-  return { cmd: "xdg-open", args: [] };
-}
 
 // src/local.ts
 var import_node_fs = require("fs");
@@ -233,54 +214,191 @@ function displayPath(path, rootDir = process.cwd()) {
   return rel && !rel.startsWith("..") ? rel : path;
 }
 
+// src/handshake-state.ts
+function handshakeFile(cfg) {
+  return (0, import_node_path2.join)((0, import_node_path2.dirname)(cfg.local.tokenFile), "handshake.local.json");
+}
+var RESUME_MARGIN_MS = 5e3;
+function readPendingHandshake(path, platform, email) {
+  const pending = readJsonFile(path);
+  if (!pending || pending.platform !== platform || pending.email !== email) return null;
+  if (typeof pending.userCode !== "string" || typeof pending.deviceCode !== "string" || typeof pending.approvalUrl !== "string") return null;
+  if (typeof pending.expiresAt !== "number" || pending.expiresAt <= Date.now() + RESUME_MARGIN_MS) return null;
+  return { interval: 3, ...pending };
+}
+function writePendingHandshake(path, pending) {
+  writePrivateJson(path, pending);
+}
+function clearPendingHandshake(path) {
+  (0, import_node_fs2.rmSync)(path, { force: true });
+}
+function minutesLeft(expiresAt) {
+  return Math.max(1, Math.round((expiresAt - Date.now()) / 6e4));
+}
+function approvalHint(pending) {
+  return `approve code ${pending.userCode} at ${pending.approvalUrl} (${minutesLeft(pending.expiresAt)}m left)`;
+}
+function approvalReminder(out, pending, periodMs = 3e4) {
+  const timer = setInterval(() => out.log(`auth: still waiting \u2014 ${approvalHint(pending)}`), periodMs);
+  timer.unref?.();
+  return () => clearInterval(timer);
+}
+function handshakeWaitMs(waitSeconds, interactive = import_node_process.default.stdout.isTTY === true) {
+  if (waitSeconds !== void 0) return waitSeconds * 1e3;
+  return interactive ? void 0 : 9e4;
+}
+
+// src/open.ts
+var import_node_child_process = require("child_process");
+var import_node_process2 = __toESM(require("process"), 1);
+async function openUrl(url, options = {}) {
+  const command = openerFor(options.platform ?? import_node_process2.default.platform);
+  const doSpawn = options.spawnImpl ?? import_node_child_process.spawn;
+  await new Promise((resolve7, reject) => {
+    const child = doSpawn(command.cmd, [...command.args, url], {
+      stdio: "ignore",
+      detached: true
+    });
+    child.once("error", reject);
+    child.once("spawn", () => {
+      child.unref();
+      resolve7();
+    });
+  });
+}
+function openerFor(platform) {
+  if (platform === "darwin") return { cmd: "open", args: [] };
+  if (platform === "win32") return { cmd: "cmd", args: ["/c", "start", ""] };
+  return { cmd: "xdg-open", args: [] };
+}
+
 // src/token.ts
 async function getDeveloperToken(cfg, options, doFetch, out) {
   if (options.token) return options.token;
   const audience = platformAudience(cfg.platformUrl);
-  if (import_node_process2.default.env.ODLA_DEV_TOKEN) {
-    const declared = import_node_process2.default.env.ODLA_DEV_TOKEN_AUDIENCE;
+  if (import_node_process3.default.env.ODLA_DEV_TOKEN) {
+    const declared = import_node_process3.default.env.ODLA_DEV_TOKEN_AUDIENCE;
     if (declared) {
       if (platformAudience(declared) !== audience) throw new Error("ODLA_DEV_TOKEN_AUDIENCE does not match the configured platform");
     } else if (audience !== "https://odla.ai") {
       throw new Error("ODLA_DEV_TOKEN_AUDIENCE is required for a non-default platform");
     }
-    return import_node_process2.default.env.ODLA_DEV_TOKEN;
+    return import_node_process3.default.env.ODLA_DEV_TOKEN;
   }
   const cached = readJsonFile(cfg.local.tokenFile);
   if (cached?.token && cached.platform === audience && (cached.expiresAt ?? 0) > Date.now() + 6e4) {
     out.log(`auth: using cached developer token (${displayPath(cfg.local.tokenFile, cfg.rootDir)})`);
     return cached.token;
   }
-  const browser = approvalBrowser(options);
-  const email = handshakeEmail(options.email, cached?.platform === audience ? cached.email : void 0);
-  const { token, expiresAt } = await (0, import_db.requestToken)({
-    endpoint: cfg.platformUrl,
-    email,
-    label: `${cfg.app.id} provisioner`,
-    fetch: doFetch,
-    onCode: async ({ userCode, expiresIn, verificationUriComplete }) => {
-      const approvalUrl = verificationUriComplete ?? handshakeUrl(cfg.platformUrl, userCode);
-      out.log("");
-      out.log(`Review, then approve code ${userCode} at ${approvalUrl} within ${Math.floor(expiresIn / 60)}m.`);
-      if (browser.open) {
-        try {
-          await (options.openApprovalUrl ?? openUrl)(approvalUrl);
-          out.log(`auth: opened browser for approval${browser.mode === "auto" ? " (auto)" : ""}`);
-        } catch (err) {
-          out.log(`auth: could not open browser (${err instanceof Error ? err.message : String(err)})`);
-        }
-      } else if (browser.reason) {
-        out.log(`auth: browser launch skipped (${browser.reason})`);
-      }
-      out.log("");
-    }
-  });
-  writePrivateJson(cfg.local.tokenFile, { platform: audience, email, token, expiresAt });
+  const ctx = {
+    cfg,
+    options,
+    doFetch,
+    out,
+    audience,
+    browser: approvalBrowser(options),
+    email: handshakeEmail(options.email, cached?.platform === audience ? cached.email : void 0),
+    pendingFile: handshakeFile(cfg)
+  };
+  const waitMs = handshakeWaitMs(options.wait);
+  const { token, expiresAt } = await resumePendingHandshake(ctx, waitMs) ?? await freshHandshake(ctx, waitMs);
+  clearPendingHandshake(ctx.pendingFile);
+  writePrivateJson(cfg.local.tokenFile, { platform: audience, email: ctx.email, token, expiresAt });
   out.log(`auth: developer token cached (${displayPath(cfg.local.tokenFile, cfg.rootDir)})`);
   return token;
 }
+async function resumePendingHandshake(ctx, waitMs) {
+  const pending = readPendingHandshake(ctx.pendingFile, ctx.audience, ctx.email);
+  if (!pending) return null;
+  ctx.out.log("");
+  ctx.out.log(`auth: resuming pending handshake \u2014 ${approvalHint(pending)}`);
+  await launchApproval(ctx, pending.approvalUrl);
+  ctx.out.log("");
+  const stopReminder = approvalReminder(ctx.out, pending);
+  try {
+    return await (0, import_db.collectToken)({
+      endpoint: ctx.cfg.platformUrl,
+      deviceCode: pending.deviceCode,
+      expiresAt: pending.expiresAt,
+      interval: pending.interval,
+      waitMs,
+      fetch: ctx.doFetch
+    });
+  } catch (err) {
+    const code = err instanceof import_db.OdlaError ? err.code : void 0;
+    if (code === "handshake_pending") throw stillPending(pending, ctx.email);
+    if (code === "handshake_expired" || code === "handshake_timeout") {
+      clearPendingHandshake(ctx.pendingFile);
+      ctx.out.log("auth: pending handshake lapsed unapproved; starting a fresh one");
+      return null;
+    }
+    if (code === "handshake_denied") clearPendingHandshake(ctx.pendingFile);
+    throw err;
+  } finally {
+    stopReminder();
+  }
+}
+async function freshHandshake(ctx, waitMs) {
+  let started;
+  let stopReminder;
+  try {
+    return await (0, import_db.requestToken)({
+      endpoint: ctx.cfg.platformUrl,
+      email: ctx.email,
+      label: `${ctx.cfg.app.id} provisioner`,
+      fetch: ctx.doFetch,
+      waitMs,
+      onCode: async ({ userCode, deviceCode, expiresIn, interval, verificationUriComplete }) => {
+        const approvalUrl = verificationUriComplete ?? handshakeUrl(ctx.cfg.platformUrl, userCode);
+        started = {
+          platform: ctx.audience,
+          email: ctx.email,
+          userCode,
+          deviceCode,
+          approvalUrl,
+          interval,
+          expiresAt: Date.now() + expiresIn * 1e3
+        };
+        writePendingHandshake(ctx.pendingFile, started);
+        ctx.out.log("");
+        ctx.out.log(`Review, then ${approvalHint(started)}.`);
+        await launchApproval(ctx, approvalUrl);
+        ctx.out.log("");
+        stopReminder = approvalReminder(ctx.out, started);
+      }
+    });
+  } catch (err) {
+    const code = err instanceof import_db.OdlaError ? err.code : void 0;
+    if (code === "handshake_pending" && started) throw stillPending(started, ctx.email);
+    if (code === "handshake_denied" || code === "handshake_expired" || code === "handshake_timeout") {
+      clearPendingHandshake(ctx.pendingFile);
+    }
+    throw err;
+  } finally {
+    stopReminder?.();
+  }
+}
+async function launchApproval(ctx, approvalUrl) {
+  if (ctx.browser.open) {
+    try {
+      await (ctx.options.openApprovalUrl ?? openUrl)(approvalUrl);
+      ctx.out.log(`auth: asked the OS to open a browser${ctx.browser.mode === "auto" ? " (auto)" : ""} \u2014 if no tab appeared, use the URL above`);
+    } catch (err) {
+      ctx.out.log(`auth: could not open browser (${err instanceof Error ? err.message : String(err)})`);
+    }
+  } else if (ctx.browser.reason) {
+    ctx.out.log(`auth: browser launch skipped (${ctx.browser.reason}) \u2014 show the human the URL above`);
+  }
+}
+function stillPending(pending, email) {
+  return new import_db.OdlaError(
+    "handshake_pending",
+    `handshake still pending \u2014 ask ${email} to ${approvalHint(pending)}, then re-run this command; it resumes the same handshake and collects the token`,
+    { retryable: true }
+  );
+}
 function handshakeEmail(value, cached) {
-  const email = (value ?? import_node_process2.default.env.ODLA_USER_EMAIL ?? cached ?? "").trim().toLowerCase();
+  const email = (value ?? import_node_process3.default.env.ODLA_USER_EMAIL ?? cached ?? "").trim().toLowerCase();
   if (email.length > 254 || !/^[^\s@]+@[^\s@]+\.[^\s@]+$/.test(email)) {
     throw new Error("a fresh odla handshake requires --email <account> or ODLA_USER_EMAIL");
   }
@@ -289,10 +407,11 @@ function handshakeEmail(value, cached) {
 function approvalBrowser(options, host = {}) {
   if (options.open === true) return { open: true, mode: "forced" };
   if (options.open === false) return { open: false, reason: "disabled by --no-open" };
-  const env = host.env ?? import_node_process2.default.env;
+  const env = host.env ?? import_node_process3.default.env;
+  if (env.VITEST || env.NODE_ENV === "test") return { open: false, reason: "test environment" };
   if (env.CI) return { open: false, reason: "CI environment" };
   if (env.SSH_CONNECTION || env.SSH_TTY) return { open: false, reason: "SSH session; pass --open to force" };
-  const platform = host.platform ?? import_node_process2.default.platform;
+  const platform = host.platform ?? import_node_process3.default.platform;
   if (platform !== "darwin" && platform !== "win32" && !env.DISPLAY && !env.WAYLAND_DISPLAY) {
     return { open: false, reason: "no graphical display; pass --open to force" };
   }
@@ -321,12 +440,12 @@ function platformAudience(value) {
 }
 
 // src/secret-input.ts
-var import_node_process3 = __toESM(require("process"), 1);
+var import_node_process4 = __toESM(require("process"), 1);
 var MAX_BYTES = 64 * 1024;
 async function secretInputValue(options, kind = "credential") {
   if (options.fromEnv && options.stdin) throw new Error("choose exactly one of --from-env or --stdin");
   let value;
-  if (options.fromEnv) value = import_node_process3.default.env[options.fromEnv];
+  if (options.fromEnv) value = import_node_process4.default.env[options.fromEnv];
   else if (options.stdin) value = await (options.readStdin ?? (() => readSecretStream(kind)))();
   else throw new Error(`${kind} input required: use --from-env <NAME> or --stdin; values are never accepted as arguments`);
   value = value?.replace(/[\r\n]+$/, "");
@@ -334,7 +453,7 @@ async function secretInputValue(options, kind = "credential") {
   if (new TextEncoder().encode(value).byteLength > MAX_BYTES) throw new Error(`${kind} exceeds 64 KiB`);
   return value;
 }
-async function readSecretStream(kind, stream = import_node_process3.default.stdin) {
+async function readSecretStream(kind, stream = import_node_process4.default.stdin) {
   let value = "";
   for await (const chunk of stream) {
     value += String(chunk);
@@ -344,8 +463,8 @@ async function readSecretStream(kind, stream = import_node_process3.default.stdi
 }
 
 // src/admin-ai-auth.ts
-var import_node_fs2 = require("fs");
-var import_node_process4 = __toESM(require("process"), 1);
+var import_node_fs3 = require("fs");
+var import_node_process5 = __toESM(require("process"), 1);
 var import_db2 = require("@odla-ai/db");
 async function getScopedPlatformToken(options) {
   return resolveAdminPlatformToken(options);
@@ -353,7 +472,7 @@ async function getScopedPlatformToken(options) {
 async function resolveAdminPlatformToken(options) {
   const audience = platformAudience(options.platform);
   if (options.token) return options.token;
-  const fromEnv = import_node_process4.default.env.ODLA_ADMIN_TOKEN;
+  const fromEnv = import_node_process5.default.env.ODLA_ADMIN_TOKEN;
   if (fromEnv) return audienceBoundEnvToken(fromEnv, audience);
   return scopedToken(
     audience,
@@ -365,7 +484,7 @@ async function resolveAdminPlatformToken(options) {
 }
 function audienceBoundEnvToken(token, platform) {
   const audience = platformAudience(platform);
-  const declared = import_node_process4.default.env.ODLA_ADMIN_TOKEN_AUDIENCE;
+  const declared = import_node_process5.default.env.ODLA_ADMIN_TOKEN_AUDIENCE;
   if (declared) {
     if (platformAudience(declared) !== audience) throw new Error("ODLA_ADMIN_TOKEN_AUDIENCE does not match the configured platform");
   } else if (audience !== "https://odla.ai") {
@@ -375,7 +494,7 @@ function audienceBoundEnvToken(token, platform) {
 }
 async function scopedToken(platform, scope, options, doFetch, out) {
   const audience = platformAudience(platform);
-  const tokenFile = options.tokenFile ?? `${import_node_process4.default.cwd()}/.odla/admin-token.local.json`;
+  const tokenFile = options.tokenFile ?? `${import_node_process5.default.cwd()}/.odla/admin-token.local.json`;
   const cache = readJsonFile(tokenFile);
   const cached = cache?.platform === audience ? cache.tokens?.[scope] : void 0;
   if (cached?.token && (cached.expiresAt ?? 0) > Date.now() + 6e4) {
@@ -399,7 +518,7 @@ async function scopedToken(platform, scope, options, doFetch, out) {
   });
   const tokens = cache?.platform === audience ? { ...cache.tokens ?? {} } : {};
   tokens[scope] = { token, expiresAt };
-  if ((0, import_node_fs2.existsSync)(`${import_node_process4.default.cwd()}/.git`)) ensureGitignore(import_node_process4.default.cwd(), [tokenFile]);
+  if ((0, import_node_fs3.existsSync)(`${import_node_process5.default.cwd()}/.git`)) ensureGitignore(import_node_process5.default.cwd(), [tokenFile]);
   writePrivateJson(tokenFile, { platform: audience, email, tokens });
   out.log(`auth: cached ${scope} grant (${tokenFile}; mode 0600)`);
   return token;
@@ -560,7 +679,7 @@ function isRecord2(value) {
 
 // src/admin-ai.ts
 async function adminAi(options) {
-  const platform = platformAudience(options.platform ?? import_node_process5.default.env.ODLA_PLATFORM ?? "https://odla.ai");
+  const platform = platformAudience(options.platform ?? import_node_process6.default.env.ODLA_PLATFORM ?? "https://odla.ai");
   const doFetch = options.fetch ?? fetch;
   const out = options.stdout ?? console;
   const usageQuery = options.action === "usage" ? adminAiUsageQuery(options) : void 0;
@@ -875,77 +994,26 @@ async function adminCommand(parsed) {
   });
 }
 
-// src/capabilities.ts
-var CAPABILITIES = {
-  cli: [
-    "start an email-bound device request without accepting a password or user session token",
-    "register the app and enable configured services per environment",
-    "issue, persist, and explicitly rotate configured service credentials",
-    "write local Worker values and push deployed Worker secrets through Wrangler stdin",
-    "store tenant-vault secrets (including the Clerk webhook secret and reserved Clerk secret key) write-only from stdin or an env var",
-    "push db schema/rules and configure platform AI, auth, and deployment links",
-    "apply read-only Google calendar mirror and public booking-page config, then drive state-bound consent, status, discovery, resync, and disconnect flows",
-    "validate config offline and smoke-test a provisioned db environment",
-    "run app-attributed hosted security discovery and independent validation without provider keys",
-    "connect/revoke source-read-only GitHub sources and drive commit-pinned hosted security jobs without PATs or provider keys",
-    "let admins manage system AI policy and credentials, inspect attributed usage, and read immutable admin changes through separate short-lived capability-only approvals"
-  ],
-  agent: [
-    "install and import the selected odla SDKs",
-    "wrap the Worker with withObservability and choose useful telemetry",
-    "make application-specific schema, rules, auth, UI, and migration decisions",
-    "wire @odla-ai/calendar into trusted Worker code and keep the app admin key out of browsers"
-  ],
-  human: [
-    "provide the existing odla account email, then sign in and explicitly review/approve the exact device code",
-    "review mirrored calendar/attendee disclosure and complete the server-issued Google consent flow",
-    "consent to production changes with --yes",
-    "request destructive credential rotation explicitly",
-    "review application semantics, security findings, releases, and merges",
-    "approve redacted-source disclosure before hosted security reasoning",
-    "approve GitHub App repository access separately from redacted-snippet disclosure"
-  ],
-  studio: [
-    "view telemetry and environment state",
-    "let signed-in users inventory/revoke their own agent grants and admins audit/global-revoke them",
-    "review calendar connection, granted read scope, selected calendars, and sync health without exposing provider tokens",
-    "perform manual credential recovery when the CLI's local shown-once copy is unavailable",
-    "configure system AI purposes and view app/environment/run-attributed usage",
-    "connect/revoke GitHub security sources and inspect ref-to-SHA jobs, routes, retention, coverage, and normalized reports"
-  ]
-};
-function printCapabilities(json = false, out = console) {
-  if (json) {
-    out.log(JSON.stringify(CAPABILITIES, null, 2));
-    return;
-  }
-  out.log("odla-ai responsibility boundary\n");
-  printGroup(out, "CLI automates", CAPABILITIES.cli);
-  printGroup(out, "Coding agent changes source", CAPABILITIES.agent);
-  printGroup(out, "Human checkpoints", CAPABILITIES.human);
-  printGroup(out, "Studio", CAPABILITIES.studio);
-}
-function printGroup(out, heading, items) {
-  out.log(`${heading}:`);
-  for (const item of items) out.log(`  - ${item}`);
-  out.log("");
-}
+// src/app-export.ts
+var import_node_fs5 = require("fs");
+var import_node_stream = require("stream");
+var import_promises = require("stream/promises");
 
 // src/config.ts
-var import_node_fs3 = require("fs");
-var import_node_path2 = require("path");
+var import_node_fs4 = require("fs");
+var import_node_path3 = require("path");
 var import_node_url = require("url");
 var DEFAULT_PLATFORM = "https://odla.ai";
 var DEFAULT_ENVS = ["dev"];
 var DEFAULT_SERVICES = ["db", "ai"];
-var GOOGLE_CALENDAR_READ_SCOPE = "https://www.googleapis.com/auth/calendar.events.readonly";
+var GOOGLE_CALENDAR_EVENTS_SCOPE = "https://www.googleapis.com/auth/calendar.events";
 async function loadProjectConfig(configPath = "odla.config.mjs") {
-  const resolved = (0, import_node_path2.resolve)(configPath);
-  if (!(0, import_node_fs3.existsSync)(resolved)) {
+  const resolved = (0, import_node_path3.resolve)(configPath);
+  if (!(0, import_node_fs4.existsSync)(resolved)) {
     throw new Error(`config not found: ${configPath}. Run "odla-ai init" first or pass --config.`);
   }
   const raw = await loadConfigModule(resolved);
-  const rootDir = (0, import_node_path2.dirname)(resolved);
+  const rootDir = (0, import_node_path3.dirname)(resolved);
   validateRawConfig(raw, resolved);
   const platformUrl = trimSlash(process.env.ODLA_PLATFORM_URL || raw.platformUrl || DEFAULT_PLATFORM);
   const dbEndpoint = trimSlash(process.env.ODLA_DB_ENDPOINT || raw.dbEndpoint || platformUrl);
@@ -953,9 +1021,9 @@ async function loadProjectConfig(configPath = "odla.config.mjs") {
   const services = unique(raw.services?.length ? raw.services : DEFAULT_SERVICES);
   validateCalendarConfig(raw, envs, services, resolved);
   const local = {
-    tokenFile: (0, import_node_path2.resolve)(rootDir, raw.local?.tokenFile ?? ".odla/dev-token.json"),
-    credentialsFile: (0, import_node_path2.resolve)(rootDir, raw.local?.credentialsFile ?? ".odla/credentials.local.json"),
-    devVarsFile: (0, import_node_path2.resolve)(rootDir, raw.local?.devVarsFile ?? ".dev.vars"),
+    tokenFile: (0, import_node_path3.resolve)(rootDir, raw.local?.tokenFile ?? ".odla/dev-token.json"),
+    credentialsFile: (0, import_node_path3.resolve)(rootDir, raw.local?.credentialsFile ?? ".odla/credentials.local.json"),
+    devVarsFile: (0, import_node_path3.resolve)(rootDir, raw.local?.devVarsFile ?? ".dev.vars"),
     gitignore: raw.local?.gitignore ?? true
   };
   return {
@@ -972,9 +1040,9 @@ async function loadProjectConfig(configPath = "odla.config.mjs") {
 async function resolveDataExport(cfg, value, names) {
   if (value === void 0 || value === null || value === false) return void 0;
   if (typeof value !== "string") return value;
-  const target = (0, import_node_path2.isAbsolute)(value) ? value : (0, import_node_path2.resolve)(cfg.rootDir, value);
+  const target = (0, import_node_path3.isAbsolute)(value) ? value : (0, import_node_path3.resolve)(cfg.rootDir, value);
   if (target.endsWith(".json")) {
-    return JSON.parse((0, import_node_fs3.readFileSync)(target, "utf8"));
+    return JSON.parse((0, import_node_fs4.readFileSync)(target, "utf8"));
   }
   const mod = await import((0, import_node_url.pathToFileURL)(target).href);
   for (const name of names) {
@@ -1001,16 +1069,14 @@ function calendarServiceConfig(cfg, env) {
   if (!cfg.envs.includes(env)) throw new Error(`calendar env "${env}" is not declared in config envs`);
   const google = cfg.calendar?.google;
   if (!google) throw new Error("calendar.google is required when the calendar service is enabled");
+  const availability = unique(
+    (google.availabilityCalendars?.[env] ?? google.calendars?.[env]).map((id) => id.trim())
+  );
   return {
     provider: "google",
-    access: "read",
-    calendars: unique(google.calendars[env].map((id) => id.trim())),
-    match: {
-      organizerSelf: google.match?.organizerSelf ?? true,
-      requireAttendees: google.match?.requireAttendees ?? true,
-      ...google.match?.summaryPrefix !== void 0 ? { summaryPrefix: google.match.summaryPrefix.trim() } : {}
-    },
-    attendeePolicy: google.attendeePolicy ?? "full"
+    access: "book",
+    bookingCalendarId: google.bookingCalendar?.[env]?.trim() ?? availability[0],
+    availabilityCalendars: availability
   };
 }
 function calendarBookingPageUrl(cfg, env) {
@@ -1059,20 +1125,39 @@ function validateCalendarConfig(cfg, envs, services, path) {
   assertOnly(cfg.calendar, ["google"], `${path}: calendar`);
   if (!isRecord4(cfg.calendar.google)) throw new Error(`${path}: calendar.google must be an object`);
   const google = cfg.calendar.google;
-  assertOnly(google, ["calendars", "bookingPageUrl", "match", "attendeePolicy"], `${path}: calendar.google`);
-  if (!isRecord4(google.calendars)) throw new Error(`${path}: calendar.google.calendars must map env names to calendar ids`);
-  const unknownEnv = Object.keys(google.calendars).find((env) => !envs.includes(env));
-  if (unknownEnv) throw new Error(`${path}: calendar.google.calendars.${unknownEnv} is not in config envs`);
+  assertOnly(
+    google,
+    ["availabilityCalendars", "calendars", "bookingCalendar", "bookingPageUrl"],
+    `${path}: calendar.google`
+  );
+  const availabilityKey = google.availabilityCalendars !== void 0 ? "availabilityCalendars" : google.calendars !== void 0 ? "calendars" : null;
+  if (!availabilityKey || google.availabilityCalendars !== void 0 && google.calendars !== void 0) {
+    throw new Error(`${path}: calendar.google requires exactly one of availabilityCalendars or calendars (legacy)`);
+  }
+  const availability = google[availabilityKey];
+  if (!isRecord4(availability)) throw new Error(`${path}: calendar.google.${availabilityKey} must map env names to calendar ids`);
+  const unknownEnv = Object.keys(availability).find((env) => !envs.includes(env));
+  if (unknownEnv) throw new Error(`${path}: calendar.google.${availabilityKey}.${unknownEnv} is not in config envs`);
   for (const env of envs) {
-    const ids = google.calendars[env];
+    const ids = availability[env];
     if (!Array.isArray(ids) || ids.length === 0) {
-      throw new Error(`${path}: calendar.google.calendars.${env} must be a non-empty array`);
+      throw new Error(`${path}: calendar.google.${availabilityKey}.${env} must be a non-empty array`);
     }
     if (ids.length > 10) {
-      throw new Error(`${path}: calendar.google.calendars.${env} must contain at most 10 calendar ids`);
+      throw new Error(`${path}: calendar.google.${availabilityKey}.${env} must contain at most 10 calendar ids`);
     }
     if (ids.some((id) => !safeText(id, 1024))) {
-      throw new Error(`${path}: calendar.google.calendars.${env} contains an invalid calendar id`);
+      throw new Error(`${path}: calendar.google.${availabilityKey}.${env} contains an invalid calendar id`);
+    }
+  }
+  if (google.bookingCalendar !== void 0) {
+    if (!isRecord4(google.bookingCalendar)) throw new Error(`${path}: calendar.google.bookingCalendar must map env names to one calendar id`);
+    const unknownBookingEnv = Object.keys(google.bookingCalendar).find((env) => !envs.includes(env));
+    if (unknownBookingEnv) throw new Error(`${path}: calendar.google.bookingCalendar.${unknownBookingEnv} is not in config envs`);
+    for (const [env, value] of Object.entries(google.bookingCalendar)) {
+      if (!safeText(value, 1024)) {
+        throw new Error(`${path}: calendar.google.bookingCalendar.${env} must be a calendar id`);
+      }
     }
   }
   if (google.bookingPageUrl !== void 0) {
@@ -1085,21 +1170,6 @@ function validateCalendarConfig(cfg, envs, services, path) {
       }
     }
   }
-  if (google.attendeePolicy !== void 0 && google.attendeePolicy !== "full" && google.attendeePolicy !== "hashed") {
-    throw new Error(`${path}: calendar.google.attendeePolicy must be "full" or "hashed"`);
-  }
-  if (google.match !== void 0) {
-    if (!isRecord4(google.match)) throw new Error(`${path}: calendar.google.match must be an object`);
-    assertOnly(google.match, ["summaryPrefix", "organizerSelf", "requireAttendees"], `${path}: calendar.google.match`);
-    if (google.match.summaryPrefix !== void 0 && !safeText(google.match.summaryPrefix, 256)) {
-      throw new Error(`${path}: calendar.google.match.summaryPrefix must be 1-256 printable characters`);
-    }
-    for (const name of ["organizerSelf", "requireAttendees"]) {
-      if (google.match[name] !== void 0 && typeof google.match[name] !== "boolean") {
-        throw new Error(`${path}: calendar.google.match.${name} must be boolean`);
-      }
-    }
-  }
   if (enabled && !services.includes("db")) throw new Error(`${path}: calendar service requires the db service`);
 }
 function assertOnly(value, allowed, label) {
@@ -1125,7 +1195,7 @@ function validId(value) {
   return typeof value === "string" && /^[a-z0-9][a-z0-9-]*$/.test(value);
 }
 async function loadConfigModule(path) {
-  if (path.endsWith(".json")) return JSON.parse((0, import_node_fs3.readFileSync)(path, "utf8"));
+  if (path.endsWith(".json")) return JSON.parse((0, import_node_fs4.readFileSync)(path, "utf8"));
   const mod = await import(`${(0, import_node_url.pathToFileURL)(path).href}?t=${Date.now()}`);
   const value = mod.default ?? mod.config;
   if (typeof value === "function") return await value();
@@ -1138,10 +1208,187 @@ function unique(values) {
   return [...new Set(values.filter(Boolean))];
 }
 
+// src/app-export.ts
+async function appExport(options) {
+  const cfg = await loadProjectConfig(options.configPath);
+  const out = options.stdout ?? console;
+  const doFetch = options.fetch ?? fetch;
+  const env = options.env ?? (cfg.envs.includes("dev") ? "dev" : cfg.envs[0]);
+  if (!env || !cfg.envs.includes(env)) throw new Error(`env "${env ?? ""}" is not declared in ${options.configPath}`);
+  const tenant = env === "prod" ? cfg.app.id : `${cfg.app.id}--${env}`;
+  const token = await getDeveloperToken(
+    cfg,
+    { configPath: cfg.configPath, token: options.token, email: options.email, open: false },
+    doFetch,
+    out
+  );
+  const auth = { authorization: `Bearer ${token}` };
+  const base = `${cfg.dbEndpoint}/admin/apps/${encodeURIComponent(tenant)}`;
+  if (options.fresh) {
+    const res = await doFetch(`${base}/export`, { method: "POST", headers: auth });
+    const body = await res.json().catch(() => ({}));
+    if (!res.ok) throw new Error(`export failed${body.error?.code ? ` (${body.error.code})` : ""}: ${body.error?.message ?? res.status}`);
+  }
+  const list = await doFetch(`${base}/backups`, { headers: auth });
+  if (!list.ok) throw new Error(`couldn't list backups (${list.status})`);
+  const { backups } = await list.json();
+  const newest = backups[0];
+  if (!newest) {
+    throw new Error(
+      `${tenant} has no backups yet \u2014 run \`odla-ai app export --fresh\` to take one now (nightly snapshots appear after the first day with writes)`
+    );
+  }
+  const download = await doFetch(`${base}/backups/${newest.id}/download`, { headers: auth });
+  if (!download.ok || !download.body) throw new Error(`download failed (${download.status})`);
+  const file = options.out ?? `${tenant}-${new Date(newest.created_at).toISOString().slice(0, 10)}-tx${newest.max_tx}.jsonl.gz`;
+  await (0, import_promises.pipeline)(import_node_stream.Readable.fromWeb(download.body), (0, import_node_fs5.createWriteStream)(file));
+  if (options.json) out.log(JSON.stringify({ file, backup: newest }, null, 2));
+  else {
+    out.log(`${tenant}: wrote ${file} (${newest.bytes} bytes, ${newest.kind} snapshot at tx ${newest.max_tx})`);
+    out.log(`sha256 ${download.headers.get("x-odla-sha256") ?? newest.sha256}`);
+  }
+  return { file, backup: newest };
+}
+
+// src/app-lifecycle.ts
+async function lifecycleCall(action, options) {
+  const cfg = await loadProjectConfig(options.configPath);
+  const out = options.stdout ?? console;
+  const doFetch = options.fetch ?? fetch;
+  const token = await getDeveloperToken(
+    cfg,
+    { configPath: cfg.configPath, token: options.token, email: options.email, open: false },
+    doFetch,
+    out
+  );
+  const res = await doFetch(`${cfg.platformUrl}/registry/apps/${encodeURIComponent(cfg.app.id)}/${action}`, {
+    method: "POST",
+    headers: { authorization: `Bearer ${token}`, "content-type": "application/json" }
+  });
+  const body = await res.json().catch(() => ({}));
+  if (!res.ok || !body.ok) {
+    throw new Error(`${action} failed${body.error?.code ? ` (${body.error.code})` : ""}: ${body.error?.message ?? `registry returned ${res.status}`}`);
+  }
+  return body;
+}
+async function appArchive(options) {
+  if (options.yes !== true) {
+    throw new Error(
+      "app archive suspends EVERY environment: API keys stop working and all services refuse requests until restored. All data is retained. Pass --yes to proceed."
+    );
+  }
+  const out = options.stdout ?? console;
+  const body = await lifecycleCall("archive", options);
+  if (options.json) out.log(JSON.stringify(body, null, 2));
+  else if (body.operation?.state === "noop") out.log(`${body.app?.appId}: already archived`);
+  else out.log(`${body.app?.appId}: archived \u2014 data retained; run \`odla-ai app restore\` (or use Studio) to bring it back`);
+}
+async function appRestore(options) {
+  const out = options.stdout ?? console;
+  const body = await lifecycleCall("restore", options);
+  if (options.json) out.log(JSON.stringify(body, null, 2));
+  else if (body.operation?.state === "noop") out.log(`${body.app?.appId}: already active`);
+  else out.log(`${body.app?.appId}: restored \u2014 every service's data plane is live again`);
+}
+async function appCommand(parsed, dependencies = {}) {
+  const sub = parsed.positionals[1];
+  if (sub === "export") {
+    assertArgs(parsed, ["config", "env", "token", "email", "fresh", "out", "json"], 2);
+    await appExport({
+      configPath: stringOpt(parsed.options.config) ?? "odla.config.mjs",
+      env: stringOpt(parsed.options.env),
+      token: stringOpt(parsed.options.token),
+      email: stringOpt(parsed.options.email),
+      fresh: parsed.options.fresh === true,
+      out: stringOpt(parsed.options.out),
+      json: parsed.options.json === true,
+      fetch: dependencies.fetch,
+      stdout: dependencies.stdout
+    });
+    return;
+  }
+  if (sub !== "archive" && sub !== "restore") {
+    throw new Error(
+      `unknown app subcommand "${sub ?? ""}". Try "odla-ai app archive --yes", "odla-ai app restore", or "odla-ai app export". (Permanent deletion has no CLI: it requires a signed-in owner in Studio.)`
+    );
+  }
+  assertArgs(parsed, ["config", "token", "email", "yes", "json"], 2);
+  const options = {
+    configPath: stringOpt(parsed.options.config) ?? "odla.config.mjs",
+    token: stringOpt(parsed.options.token),
+    email: stringOpt(parsed.options.email),
+    yes: parsed.options.yes === true,
+    json: parsed.options.json === true,
+    fetch: dependencies.fetch,
+    stdout: dependencies.stdout
+  };
+  if (sub === "archive") await appArchive(options);
+  else await appRestore(options);
+}
+
+// src/capabilities.ts
+var CAPABILITIES = {
+  cli: [
+    "start an email-bound device request without accepting a password or user session token",
+    "register the app and enable configured services per environment",
+    "issue, persist, and explicitly rotate configured service credentials",
+    "write local Worker values and push deployed Worker secrets through Wrangler stdin",
+    "store tenant-vault secrets (including the Clerk webhook secret and reserved Clerk secret key) write-only from stdin or an env var",
+    "push db schema/rules and configure platform AI, auth, and deployment links",
+    "apply Google Calendar booking config, then drive state-bound consent, status, discovery, and disconnect flows (bookings run live through the platform proxy)",
+    "validate config offline and smoke-test a provisioned db environment",
+    "run app-attributed hosted security discovery and independent validation without provider keys",
+    "connect/revoke source-read-only GitHub sources and drive commit-pinned hosted security jobs without PATs or provider keys",
+    "let admins manage system AI policy and credentials, inspect attributed usage, and read immutable admin changes through separate short-lived capability-only approvals"
+  ],
+  agent: [
+    "install and import the selected odla SDKs",
+    "wrap the Worker with withObservability and choose useful telemetry",
+    "make application-specific schema, rules, auth, UI, and migration decisions",
+    "wire @odla-ai/calendar into trusted Worker code and keep the app admin key out of browsers"
+  ],
+  human: [
+    "provide the existing odla account email, then sign in and explicitly review/approve the exact device code",
+    "review mirrored calendar/attendee disclosure and complete the server-issued Google consent flow",
+    "consent to production changes with --yes",
+    "request destructive credential rotation explicitly",
+    "review application semantics, security findings, releases, and merges",
+    "approve redacted-source disclosure before hosted security reasoning",
+    "approve GitHub App repository access separately from redacted-snippet disclosure"
+  ],
+  studio: [
+    "view telemetry and environment state",
+    "let signed-in users inventory/revoke their own agent grants and admins audit/global-revoke them",
+    "review calendar connection, granted read scope, selected calendars, and sync health without exposing provider tokens",
+    "perform manual credential recovery when the CLI's local shown-once copy is unavailable",
+    "configure system AI purposes and view app/environment/run-attributed usage",
+    "connect/revoke GitHub security sources and inspect ref-to-SHA jobs, routes, retention, coverage, and normalized reports"
+  ]
+};
+function printCapabilities(json = false, out = console) {
+  if (json) {
+    out.log(JSON.stringify(CAPABILITIES, null, 2));
+    return;
+  }
+  out.log("odla-ai responsibility boundary\n");
+  printGroup(out, "CLI automates", CAPABILITIES.cli);
+  printGroup(out, "Coding agent changes source", CAPABILITIES.agent);
+  printGroup(out, "Human checkpoints", CAPABILITIES.human);
+  printGroup(out, "Studio", CAPABILITIES.studio);
+}
+function printGroup(out, heading, items) {
+  out.log(`${heading}:`);
+  for (const item of items) out.log(`  - ${item}`);
+  out.log("");
+}
+
 // src/calendar-errors.ts
 var PLATFORM_NOT_READY_CODES = /* @__PURE__ */ new Set([
   "calendar_google_oauth_not_configured",
   "calendar_token_vault_not_configured",
+  // Current spelling (booking-era key verifier) plus the retired mirror-era
+  // ingress code, so the CLI stays resumable against either platform version.
+  "calendar_db_verifier_not_configured",
   "calendar_db_ingress_not_configured"
 ]);
 var CalendarRequestError = class extends Error {
@@ -1183,8 +1430,6 @@ function looksSecret(value) {
 var CALENDAR_STATES = [
   "not_connected",
   "authorizing",
-  "needs_sync",
-  "initial_sync",
   "healthy",
   "degraded",
   "disconnected",
@@ -1232,9 +1477,6 @@ async function pollCalendarConnection(ctx, attemptId) {
     ctx.env
   );
 }
-async function requestCalendarResync(ctx) {
-  return parseCalendarStatus(await calendarJson(ctx, "/resync", { method: "POST", body: "{}" }), ctx.env);
-}
 async function requestCalendarDisconnect(ctx) {
   return parseCalendarStatus(
     await calendarJson(ctx, "/disconnect", { method: "POST", body: JSON.stringify({ purge: false }) }),
@@ -1245,10 +1487,8 @@ function parseCalendarStatus(raw, env) {
   const outer = wrapped(raw, "calendar");
   const value = record(outer.attempt) ?? record(outer.status) ?? outer;
   const connection = record(value.connection) ?? {};
-  const sync = record(value.sync) ?? record(connection.sync) ?? {};
   const config = record(value.config) ?? record(outer.config) ?? {};
   const googleConfig = record(config.google) ?? config;
-  const watches = record(value.watches) ?? {};
   const stateValue = calendarState(value.status ?? value.state ?? connection.status ?? connection.state);
   if (!stateValue) {
     throw new Error("calendar status returned an invalid connection state");
@@ -1258,31 +1498,29 @@ function parseCalendarStatus(raw, env) {
     throw new Error("calendar status returned an unsupported provider");
   }
   const accessValue = value.access ?? connection.access ?? config.access ?? googleConfig.access;
-  if (accessValue !== void 0 && accessValue !== "read") throw new Error("calendar status returned unsupported access");
-  const policyValue = value.attendeePolicy ?? config.attendeePolicy ?? googleConfig.attendeePolicy;
-  if (policyValue !== void 0 && policyValue !== "full" && policyValue !== "hashed") {
-    throw new Error("calendar status returned an invalid attendee policy");
+  if (accessValue !== void 0 && accessValue !== "book" && accessValue !== "read") {
+    throw new Error("calendar status returned unsupported access");
   }
   const errorValue = record(value.error) ?? record(connection.error);
   const errorCode = textField(value.lastErrorCode, 128);
   const bookingPageValue = Object.hasOwn(value, "bookingPageUrl") ? value.bookingPageUrl : Object.hasOwn(config, "bookingPageUrl") ? config.bookingPageUrl : googleConfig.bookingPageUrl;
+  const connected = typeof (value.connected ?? connection.connected) === "boolean" ? Boolean(value.connected ?? connection.connected) : ["healthy", "degraded"].includes(stateValue);
+  const bookingCalendarId = textField(value.bookingCalendarId ?? config.bookingCalendarId, 1024);
   return {
     env,
     enabled: typeof value.enabled === "boolean" ? value.enabled : true,
-    connected: typeof (value.connected ?? connection.connected) === "boolean" ? Boolean(value.connected ?? connection.connected) : ["needs_sync", "initial_sync", "healthy", "degraded"].includes(stateValue),
+    connected,
+    writable: typeof value.writable === "boolean" ? value.writable : stateValue === "healthy",
     provider: providerValue === "google" ? "google" : null,
     status: stateValue,
-    ...accessValue === "read" ? { access: "read" } : {},
-    calendars: calendarIds(value.configuredCalendars ?? value.calendars ?? config.calendars ?? googleConfig.calendars),
-    ...policyValue === "full" || policyValue === "hashed" ? { attendeePolicy: policyValue } : {},
-    ...typeof value.attendeePolicyLocked === "boolean" ? { attendeePolicyLocked: value.attendeePolicyLocked } : {},
+    ...accessValue !== void 0 ? { access: "book" } : {},
+    ...bookingCalendarId ? { bookingCalendarId } : {},
+    calendars: calendarIds(
+      value.availabilityCalendars ?? config.availabilityCalendars ?? value.configuredCalendars ?? value.calendars ?? config.calendars ?? googleConfig.calendars
+    ),
     ...optionalNullableUrl("bookingPageUrl", bookingPageValue),
     grantedScopes: stringList(value.grantedScopes ?? connection.grantedScopes ?? connection.scopes),
     ...optionalText("attemptId", value.attemptId ?? connection.attemptId, 180),
-    ...optionalNumber("lastSuccessfulSyncAt", value.lastSuccessfulSyncAt ?? sync.lastSuccessfulSyncAt),
-    ...optionalNumber("lastFullSyncAt", value.lastFullSyncAt ?? sync.lastFullSyncAt),
-    ...optionalNumber("watchExpiresAt", value.watchExpiresAt ?? sync.watchExpiresAt ?? watches.nextExpirationAt),
-    ...optionalInteger("bookingCount", value.bookingCount ?? sync.bookingCount),
     ...errorValue || errorCode ? { error: {
       ...textField(errorValue?.code, 128) ? { code: textField(errorValue?.code, 128) } : {},
       ...textField(errorValue?.message, 500) ? { message: textField(errorValue?.message, 500) } : {},
@@ -1297,7 +1535,9 @@ function calendarState(value) {
     disabled: "not_connected",
     disconnected: "disconnected",
     connecting: "authorizing",
-    syncing: "initial_sync",
+    syncing: "healthy",
+    needs_sync: "healthy",
+    initial_sync: "healthy",
     ready: "healthy",
     error: "failed"
   };
@@ -1365,13 +1605,6 @@ function optionalText(key, value, max) {
   const parsed = textField(value, max);
   return parsed ? { [key]: parsed } : {};
 }
-function optionalNumber(key, value) {
-  const parsed = timestamp3(value);
-  return parsed === void 0 ? {} : { [key]: parsed };
-}
-function optionalInteger(key, value) {
-  return Number.isSafeInteger(value) && value >= 0 ? { [key]: value } : {};
-}
 function optionalNullableUrl(key, value) {
   if (value === null) return { [key]: null };
   const parsed = textField(value, 4096);
@@ -1423,7 +1656,7 @@ async function calendarConnect(options) {
   const page = calendarBookingPageUrl(cfg, ctx.env);
   const applied = page === void 0 ? await readCalendarStatus(ctx) : await applyCalendarSettings(ctx, page);
   const connectOptions = connectionOptions(options, out);
-  return await continueConnectedCalendar(ctx, applied, connectOptions, false) ?? connectWithContext(ctx, connectOptions);
+  return await continueConnectedCalendar(ctx, applied, connectOptions) ?? connectWithContext(ctx, connectOptions);
 }
 async function applyCalendarBookingPage(ctx, bookingPageUrl, out) {
   if (bookingPageUrl === void 0) return null;
@@ -1431,25 +1664,18 @@ async function applyCalendarBookingPage(ctx, bookingPageUrl, out) {
   out.log(`${ctx.env}: calendar booking page ${bookingPageUrl ? "set" : "cleared"}`);
   return status;
 }
-async function calendarResync(options) {
-  const { ctx, out } = await lifecycleContext(options);
-  productionConsent(ctx.env, options.yes, "resync calendar");
-  const status = await requestCalendarResync(ctx);
-  out.log(`${ctx.env}: calendar resync requested (${status.status})`);
-  return status;
-}
 async function calendarDisconnect(options) {
   if (!options.yes) throw new Error("calendar disconnect requires --yes");
   const { ctx, out } = await lifecycleContext(options);
   const status = await requestCalendarDisconnect(ctx);
-  out.log(`${ctx.env}: calendar disconnected; retained mirror rows may now be stale`);
+  out.log(`${ctx.env}: calendar disconnected; no calendar data was stored`);
   return status;
 }
 async function ensureCalendarConnected(ctx, options) {
   const out = options.stdout ?? console;
   const current = await readCalendarStatus(ctx);
   const connectOptions = connectionOptions(options, out);
-  return await continueConnectedCalendar(ctx, current, connectOptions, true) ?? connectWithContext(ctx, connectOptions);
+  return await continueConnectedCalendar(ctx, current, connectOptions) ?? connectWithContext(ctx, connectOptions);
 }
 async function lifecycleContext(options) {
   const cfg = await loadProjectConfig(options.configPath);
@@ -1485,25 +1711,20 @@ function connectionOptions(options, out) {
     signal: options.signal
   };
 }
-async function continueConnectedCalendar(ctx, current, options, reuseDegraded) {
-  if (current.status === "healthy" || reuseDegraded && current.status === "degraded") {
-    options.out.log(`${ctx.env}: calendar ${reuseDegraded ? "connected" : "already connected"} (${current.status})`);
+async function continueConnectedCalendar(ctx, current, options) {
+  if (current.status === "healthy") {
+    options.out.log(`${ctx.env}: calendar already connected (healthy)`);
     return current;
   }
-  if (current.status === "degraded") return null;
-  if (current.status === "needs_sync") {
-    if (!current.connected) return null;
-    options.out.log(`${ctx.env}: calendar configuration needs sync`);
-    const synced = await requestCalendarResync(ctx);
-    options.out.log(`${ctx.env}: calendar ${synced.status.replaceAll("_", " ")}`);
-    return synced;
+  if (current.status === "degraded") {
+    options.out.log(`${ctx.env}: calendar grant predates booking scopes \u2014 Google re-consent required`);
+    return null;
   }
   if (current.status === "failed" && current.connected) {
     const reason = current.error?.message ?? current.error?.code;
-    throw new Error(`calendar connection failed${reason ? `: ${reason}` : ""}; inspect status and resync or reconnect explicitly`);
+    throw new Error(`calendar connection failed${reason ? `: ${reason}` : ""}; inspect status and reconnect explicitly`);
   }
-  const waitingForExisting = current.status === "authorizing" || current.status === "initial_sync" && current.connected;
-  if (!waitingForExisting) return null;
+  if (current.status !== "authorizing") return null;
   const now = options.now ?? Date.now;
   const deadline = now() + pollTimeout(options.pollTimeoutMs);
   const wait = options.wait ?? waitForCalendarPoll;
@@ -1515,17 +1736,16 @@ async function continueConnectedCalendar(ctx, current, options, reuseDegraded) {
       options.out.log(`${ctx.env}: calendar ${status.status.replaceAll("_", " ")}`);
       prior = status.status;
     }
-    if (status.status === "healthy" || reuseDegraded && status.status === "degraded") return status;
+    if (status.status === "healthy") return status;
     if (status.status === "degraded") return null;
-    if (status.status === "needs_sync") return requestCalendarResync(ctx);
     if (status.status === "failed" && status.connected) {
       const reason = status.error?.message ?? status.error?.code;
-      throw new Error(`calendar connection failed${reason ? `: ${reason}` : ""}; inspect status and resync or reconnect explicitly`);
+      throw new Error(`calendar connection failed${reason ? `: ${reason}` : ""}; inspect status and reconnect explicitly`);
     }
-    if (status.status !== "authorizing" && (status.status !== "initial_sync" || !status.connected)) return null;
+    if (status.status !== "authorizing") return null;
     await wait(Math.min(2e3, Math.max(0, deadline - now())), options.signal);
   }
-  throw new Error('Existing Google Calendar authorization or initial sync timed out; run "odla-ai calendar status" and retry');
+  throw new Error('Existing Google Calendar authorization timed out; run "odla-ai calendar status" and retry');
 }
 async function connectWithContext(ctx, options) {
   const attempt = await startCalendarConnection(ctx);
@@ -1547,14 +1767,17 @@ async function connectWithContext(ctx, options) {
       options.out.log(`${ctx.env}: calendar ${status.status.replaceAll("_", " ")}`);
       prior = status.status;
     }
-    if (status.status === "healthy" || status.status === "degraded") return status;
+    if (status.status === "healthy") return status;
+    if (status.status === "degraded") {
+      throw new Error("calendar connected without booking scopes; re-run connect and grant calendar access");
+    }
     if (status.status === "failed" || status.status === "disconnected" || status.status === "not_connected") {
       const reason = status.error?.message ?? status.error?.code;
       throw new Error(`calendar connection ${status.status}${reason ? `: ${reason}` : ""}`);
     }
     await wait(Math.min(2e3, Math.max(0, deadline - now())), options.signal);
   }
-  throw new Error('Google Calendar consent or initial sync timed out; run "odla-ai calendar status" and retry connect');
+  throw new Error('Google Calendar consent timed out; run "odla-ai calendar status" and retry connect');
 }
 function trustedCalendarConsentUrl(platform, value) {
   const origin = platformAudience(platform);
@@ -1584,26 +1807,22 @@ function printStatus(status, json, out) {
     return;
   }
   out.log(`calendar: ${status.provider ?? "none"}/${status.status} (${status.env})`);
-  out.log(`  access: ${status.access ?? "not granted"}`);
-  out.log(`  calendars: ${status.calendars.length ? status.calendars.join(", ") : "none"}`);
-  if (status.attendeePolicy) {
-    out.log(`  attendee policy: ${status.attendeePolicy}${status.attendeePolicyLocked ? " (locked)" : ""}`);
-  }
+  out.log(`  bookable: ${status.writable ? "yes" : status.connected ? "no \u2014 reconnect to grant booking scopes" : "no \u2014 not connected"}`);
+  if (status.bookingCalendarId) out.log(`  booking calendar: ${status.bookingCalendarId}`);
+  out.log(`  availability calendars: ${status.calendars.length ? status.calendars.join(", ") : "none"}`);
   if (status.bookingPageUrl !== void 0) out.log(`  booking page: ${status.bookingPageUrl ?? "not configured"}`);
-  out.log(`  last sync: ${status.lastSuccessfulSyncAt === void 0 ? "never" : new Date(status.lastSuccessfulSyncAt).toISOString()}`);
-  if (status.bookingCount !== void 0) out.log(`  bookings: ${status.bookingCount}`);
   if (status.error?.code || status.error?.message) out.log(`  error: ${status.error.code ?? "error"}${status.error.message ? ` \u2014 ${status.error.message}` : ""}`);
 }
 
 // src/doctor-checks.ts
 var import_node_child_process3 = require("child_process");
-var import_node_fs5 = require("fs");
-var import_node_path4 = require("path");
+var import_node_fs7 = require("fs");
+var import_node_path5 = require("path");
 
 // src/wrangler.ts
 var import_node_child_process2 = require("child_process");
-var import_node_fs4 = require("fs");
-var import_node_path3 = require("path");
+var import_node_fs6 = require("fs");
+var import_node_path4 = require("path");
 var defaultRunner = (cmd, args, opts) => new Promise((resolvePromise, reject) => {
   const child = (0, import_node_child_process2.spawn)(cmd, args, { cwd: opts?.cwd, stdio: ["pipe", "pipe", "pipe"] });
   let stdout = "";
@@ -1617,15 +1836,15 @@ var defaultRunner = (cmd, args, opts) => new Promise((resolvePromise, reject) =>
 var WRANGLER_CONFIG_FILES = ["wrangler.jsonc", "wrangler.json", "wrangler.toml"];
 function findWranglerConfig(rootDir) {
   for (const name of WRANGLER_CONFIG_FILES) {
-    const path = (0, import_node_path3.join)(rootDir, name);
-    if ((0, import_node_fs4.existsSync)(path)) return path;
+    const path = (0, import_node_path4.join)(rootDir, name);
+    if ((0, import_node_fs6.existsSync)(path)) return path;
   }
   return null;
 }
 function readWranglerConfig(path) {
   if (path.endsWith(".toml")) return null;
   try {
-    return JSON.parse(stripJsonComments((0, import_node_fs4.readFileSync)(path, "utf8")));
+    return JSON.parse(stripJsonComments((0, import_node_fs6.readFileSync)(path, "utf8")));
   } catch {
     return null;
   }
@@ -1723,10 +1942,10 @@ function wranglerWarnings(rootDir) {
   for (const { label, block } of blocks) {
     const assets = block.assets;
     if (assets?.directory) {
-      const dir = (0, import_node_path4.resolve)(rootDir, assets.directory);
-      if (dir === (0, import_node_path4.resolve)(rootDir)) {
+      const dir = (0, import_node_path5.resolve)(rootDir, assets.directory);
+      if (dir === (0, import_node_path5.resolve)(rootDir)) {
         warnings.push(`${label}assets.directory is the project root \u2014 point it at a dedicated build dir (wrangler dev fails with "spawn EBADF")`);
-      } else if ((0, import_node_fs5.existsSync)((0, import_node_path4.join)(dir, "node_modules"))) {
+      } else if ((0, import_node_fs7.existsSync)((0, import_node_path5.join)(dir, "node_modules"))) {
         warnings.push(`${label}assets.directory contains node_modules \u2014 wrangler dev's watcher will exhaust file descriptors`);
       }
     }
@@ -1761,13 +1980,13 @@ function o11yProjectWarnings(rootDir) {
     warnings.push("cannot verify o11y Worker instrumentation \u2014 add a parseable wrangler.jsonc/json config");
     return warnings;
   }
-  const main = typeof config.main === "string" ? (0, import_node_path4.resolve)(rootDir, config.main) : null;
-  if (!main || !(0, import_node_fs5.existsSync)(main)) {
+  const main = typeof config.main === "string" ? (0, import_node_path5.resolve)(rootDir, config.main) : null;
+  if (!main || !(0, import_node_fs7.existsSync)(main)) {
     warnings.push("cannot verify o11y Worker instrumentation \u2014 wrangler main is missing or unreadable");
   } else {
     let source = "";
     try {
-      source = (0, import_node_fs5.readFileSync)(main, "utf8");
+      source = (0, import_node_fs7.readFileSync)(main, "utf8");
     } catch {
     }
     if (!/\bwithObservability\b/.test(source)) {
@@ -1791,7 +2010,7 @@ function calendarProjectWarnings(rootDir) {
 }
 function readPackageJson(rootDir) {
   try {
-    return JSON.parse((0, import_node_fs5.readFileSync)((0, import_node_path4.join)(rootDir, "package.json"), "utf8"));
+    return JSON.parse((0, import_node_fs7.readFileSync)((0, import_node_path5.join)(rootDir, "package.json"), "utf8"));
   } catch {
     return null;
   }
@@ -1815,8 +2034,11 @@ async function doctor(options) {
   out.log(`rules:  ${rules ? `${Object.keys(rules).length} namespaces` : "none"}`);
   out.log(`ai:     ${cfg.services.includes("ai") ? cfg.ai?.provider ?? "not configured" : "not enabled"}`);
   if (cfg.services.includes("calendar")) {
-    const calendar = cfg.envs.map((env) => `${env}:${calendarServiceConfig(cfg, env).calendars.length}`).join(", ");
-    out.log(`calendar: google/read-only (${calendar}; attendee ${cfg.calendar?.google.attendeePolicy ?? "full"})`);
+    const calendar = cfg.envs.map((env) => {
+      const resolved = calendarServiceConfig(cfg, env);
+      return `${env}:${resolved.bookingCalendarId}+${resolved.availabilityCalendars.length}`;
+    }).join(", ");
+    out.log(`calendar: google/booking (${calendar})`);
     const pages = cfg.envs.map((env) => `${env}:${calendarBookingPageUrl(cfg, env) ?? "none"}`).join(", ");
     out.log(`booking pages: ${pages}`);
   } else {
@@ -1868,9 +2090,9 @@ async function doctor(options) {
 }
 
 // src/help.ts
-var import_node_fs6 = require("fs");
+var import_node_fs8 = require("fs");
 function cliVersion() {
-  const pkg = JSON.parse((0, import_node_fs6.readFileSync)(new URL("../package.json", importMetaUrl), "utf8"));
+  const pkg = JSON.parse((0, import_node_fs8.readFileSync)(new URL("../package.json", importMetaUrl), "utf8"));
   return pkg.version ?? "unknown";
 }
 function printHelp() {
@@ -1883,8 +2105,10 @@ Usage:
   odla-ai calendar status [--env dev] [--email <odla-account>] [--json]
   odla-ai calendar calendars [--env dev] [--email <odla-account>] [--json]
   odla-ai calendar connect [--env dev] [--email <odla-account>] [--no-open] [--yes]
-  odla-ai calendar resync [--env dev] [--email <odla-account>] [--yes]
   odla-ai calendar disconnect [--env dev] [--email <odla-account>] --yes
+  odla-ai app archive [--config odla.config.mjs] [--email <odla-account>] [--json] --yes
+  odla-ai app restore [--config odla.config.mjs] [--email <odla-account>] [--json]
+  odla-ai app export [--env dev] [--fresh] [--out <file>] [--email <odla-account>] [--json]
   odla-ai capabilities [--json]
   odla-ai admin ai show [--platform https://odla.ai] [--email <odla-account>] [--json]
   odla-ai admin ai models [--provider <id>] [--json]
@@ -1904,7 +2128,7 @@ Usage:
   odla-ai security report <job-id> [--json]
   odla-ai security run [target] --ack-redacted-source [--env dev] [--profile odla] [--fail-on high]
   odla-ai security run [target] --self --ack-redacted-source
-  odla-ai provision [--config odla.config.mjs] [--email <odla-account>] [--dry-run] [--push-secrets] [--rotate-o11y-token] [--write-dev-vars[=path]] [--yes]
+  odla-ai provision [--config odla.config.mjs] [--email <odla-account>] [--wait <seconds>] [--dry-run] [--push-secrets] [--rotate-o11y-token] [--write-dev-vars[=path]] [--yes]
   odla-ai smoke [--config odla.config.mjs] [--env dev] [--email <odla-account>] [--no-open]
   odla-ai skill install [--dir <project>] [--agent <name>] [--global] [--force]
   odla-ai secrets push --env <env> [--config odla.config.mjs] [--dry-run] [--yes]
@@ -1916,7 +2140,14 @@ Commands:
   setup        Install offline odla runbooks for common coding-agent harnesses.
   init         Create a generic odla.config.mjs plus starter schema/rules files.
   doctor       Validate and summarize the project config without network calls.
-  calendar     Inspect, connect, resync, or disconnect a read-only Google mirror.
+  calendar     Inspect, connect, or disconnect the live Google booking connection.
+  app          Archive (suspend, data retained), restore, or export the app.
+               Archiving takes every environment's data plane down until restored;
+               permanent deletion has NO CLI \u2014 it requires a signed-in owner in
+               Studio, and no machine or agent credential can purge. "app export"
+               downloads a portable gzipped-JSONL snapshot of one environment's
+               database (--fresh takes a new snapshot first) \u2014 your data is
+               always yours to take.
   capabilities Show what the CLI automates vs agent edits and human checkpoints.
   admin        Manage platform-funded AI routing/credentials/usage with narrow device grants.
   security     Connect GitHub sources and run commit-pinned hosted reviews, or scan a local snapshot.
@@ -1938,6 +2169,12 @@ Safety:
   Provision opens the approval page in your browser automatically whenever the
   machine can show one, including agent-driven runs; only CI, SSH, and
   display-less hosts skip it. Use --open to force or --no-open to suppress.
+  Browser launch is best-effort: the printed approval URL is authoritative and
+  agents must relay it to the human verbatim. A started handshake is persisted
+  under .odla/, so a command killed mid-wait loses nothing \u2014 rerunning resumes
+  the same code. Outside an interactive terminal the wait is capped (90s by
+  default, --wait <seconds> to change); a still-pending handshake then exits
+  with code 75: relay the URL, wait for approval, and re-run to collect.
   A fresh device handshake requires --email <odla-account> or ODLA_USER_EMAIL.
   The email is a non-secret identity hint: never provide a password or session
   token. The matching account must already exist, be signed in, explicitly
@@ -1974,13 +2211,13 @@ function harnessOption(value, flag) {
 }
 
 // src/init.ts
-var import_node_fs7 = require("fs");
-var import_node_path5 = require("path");
+var import_node_fs9 = require("fs");
+var import_node_path6 = require("path");
 function initProject(options) {
   const out = options.stdout ?? console;
-  const rootDir = (0, import_node_path5.resolve)(options.rootDir ?? process.cwd());
-  const configPath = (0, import_node_path5.resolve)(rootDir, options.configPath ?? "odla.config.mjs");
-  if ((0, import_node_fs7.existsSync)(configPath) && !options.force) {
+  const rootDir = (0, import_node_path6.resolve)(options.rootDir ?? process.cwd());
+  const configPath = (0, import_node_path6.resolve)(rootDir, options.configPath ?? "odla.config.mjs");
+  if ((0, import_node_fs9.existsSync)(configPath) && !options.force) {
     throw new Error(`${configPath} already exists. Pass --force to overwrite.`);
   }
   if (!/^[a-z0-9][a-z0-9-]*$/.test(options.appId)) {
@@ -1990,29 +2227,29 @@ function initProject(options) {
   const services = options.services?.length ? options.services : ["db", "ai"];
   if (services.includes("calendar") && !services.includes("db")) throw new Error("--services calendar requires db");
   const aiProvider = options.aiProvider ?? "anthropic";
-  (0, import_node_fs7.mkdirSync)((0, import_node_path5.dirname)(configPath), { recursive: true });
-  (0, import_node_fs7.mkdirSync)((0, import_node_path5.resolve)(rootDir, "src/odla"), { recursive: true });
-  (0, import_node_fs7.mkdirSync)((0, import_node_path5.resolve)(rootDir, ".odla"), { recursive: true });
-  (0, import_node_fs7.writeFileSync)(configPath, configTemplate({ appId: options.appId, name: options.name, envs, services, aiProvider }));
-  writeIfMissing((0, import_node_path5.resolve)(rootDir, "src/odla/schema.mjs"), schemaTemplate());
-  writeIfMissing((0, import_node_path5.resolve)(rootDir, "src/odla/rules.mjs"), rulesTemplate());
+  (0, import_node_fs9.mkdirSync)((0, import_node_path6.dirname)(configPath), { recursive: true });
+  (0, import_node_fs9.mkdirSync)((0, import_node_path6.resolve)(rootDir, "src/odla"), { recursive: true });
+  (0, import_node_fs9.mkdirSync)((0, import_node_path6.resolve)(rootDir, ".odla"), { recursive: true });
+  (0, import_node_fs9.writeFileSync)(configPath, configTemplate({ appId: options.appId, name: options.name, envs, services, aiProvider }));
+  writeIfMissing((0, import_node_path6.resolve)(rootDir, "src/odla/schema.mjs"), schemaTemplate());
+  writeIfMissing((0, import_node_path6.resolve)(rootDir, "src/odla/rules.mjs"), rulesTemplate());
   ensureGitignore(rootDir);
   out.log(`created ${relativeDisplay(configPath, rootDir)}`);
   out.log("created src/odla/schema.mjs and src/odla/rules.mjs");
   out.log("updated .gitignore for local odla credentials");
 }
 function writeIfMissing(path, text) {
-  if ((0, import_node_fs7.existsSync)(path)) return;
-  (0, import_node_fs7.writeFileSync)(path, text);
+  if ((0, import_node_fs9.existsSync)(path)) return;
+  (0, import_node_fs9.writeFileSync)(path, text);
 }
 function configTemplate(input) {
   const calendar = input.services.includes("calendar") ? `  calendar: {
     google: {
-      calendars: ${JSON.stringify(Object.fromEntries(input.envs.map((env) => [env, ["primary"]])))},
+      // Calendars consulted for availability; bookings land on bookingCalendar
+      // (defaults to the first availability calendar). Google consent happens
+      // in the browser during provision; bookings write live through odla.ai.
+      availabilityCalendars: ${JSON.stringify(Object.fromEntries(input.envs.map((env) => [env, ["primary"]])))},
       bookingPageUrl: ${JSON.stringify(Object.fromEntries(input.envs.map((env) => [env, null])))},
-      match: { organizerSelf: true, requireAttendees: true },
-      attendeePolicy: "full",
-      // Read-only in this release. Google consent happens in Studio during provision.
     },
   },
 ` : "";
@@ -2103,7 +2340,7 @@ function relativeDisplay(path, rootDir) {
 // src/provision.ts
 var import_apps2 = require("@odla-ai/apps");
 var import_ai = require("@odla-ai/ai");
-var import_node_process6 = __toESM(require("process"), 1);
+var import_node_process7 = __toESM(require("process"), 1);
 
 // src/provision-credentials.ts
 var import_apps = require("@odla-ai/apps");
@@ -2308,7 +2545,7 @@ async function provision(options) {
     if (cfg.services.includes("calendar")) {
       for (const env of cfg.envs) {
         const calendar = calendarServiceConfig(cfg, env);
-        out.log(`  calendar.${env}: google/read, ${calendar.calendars.join(", ")} (${calendar.attendeePolicy}; ${GOOGLE_CALENDAR_READ_SCOPE})`);
+        out.log(`  calendar.${env}: google/book \u2192 ${calendar.bookingCalendarId}; availability ${calendar.availabilityCalendars.join(", ")} (${GOOGLE_CALENDAR_EVENTS_SCOPE})`);
         const bookingPage = calendarBookingPageUrl(cfg, env);
         out.log(`  calendar.${env}.bookingPageUrl: ${bookingPage === void 0 ? "unchanged" : bookingPage ?? "clear"}`);
       }
@@ -2331,7 +2568,7 @@ async function provision(options) {
   }
   const devVarsTarget = resolveWriteDevVarsTarget(cfg, options.writeDevVars);
   if (cfg.local.gitignore) {
-    ensureGitignore(cfg.rootDir, [cfg.local.tokenFile, cfg.local.credentialsFile, ...devVarsTarget ? [devVarsTarget] : []]);
+    ensureGitignore(cfg.rootDir, [cfg.local.tokenFile, handshakeFile(cfg), cfg.local.credentialsFile, ...devVarsTarget ? [devVarsTarget] : []]);
   }
   if (options.pushSecrets) {
     await preflightSecretsPush({ configPath: cfg.configPath, runner: options.secretRunner });
@@ -2421,7 +2658,7 @@ ${env}: credentials are already saved; retry "odla-ai secrets push --env ${env}$
       out.log(`${env}: rules pushed (${Object.keys(rules).length} namespaces)`);
     }
     if (cfg.services.includes("ai") && cfg.ai?.provider && cfg.ai.keyEnv) {
-      const key = import_node_process6.default.env[cfg.ai.keyEnv];
+      const key = import_node_process7.default.env[cfg.ai.keyEnv];
       if (key) {
         const secretName = cfg.ai.secretName ?? defaultSecretName(cfg.ai.provider);
         await (0, import_ai.putSecret)({ endpoint: cfg.dbEndpoint, token, fetch: doFetch }, tenantId, secretName, key);
@@ -2563,7 +2800,7 @@ async function resolveVaultWrite(options) {
 }
 
 // src/security-command-context.ts
-var import_promises = require("readline/promises");
+var import_promises2 = require("readline/promises");
 async function hostedSecurityContext(parsed, dependencies) {
   const configPath = stringOpt(parsed.options.config) ?? "odla.config.mjs";
   const cfg = await loadProjectConfig(configPath);
@@ -2589,7 +2826,7 @@ async function hostedSecurityContext(parsed, dependencies) {
 async function interactiveConfirmation(message, dependencies) {
   if (dependencies.confirm) return dependencies.confirm(message);
   if (!process.stdin.isTTY || !process.stdout.isTTY) return false;
-  const prompt = (0, import_promises.createInterface)({ input: process.stdin, output: process.stdout });
+  const prompt = (0, import_promises2.createInterface)({ input: process.stdin, output: process.stdout });
   try {
     const answer = await prompt.question(`${message} [y/N] `);
     return /^y(?:es)?$/i.test(answer.trim());
@@ -2719,7 +2956,7 @@ function hostedSeverity(value, flag) {
 var import_security2 = require("@odla-ai/security");
 
 // src/security.ts
-var import_node_path6 = require("path");
+var import_node_path7 = require("path");
 var import_security = require("@odla-ai/security");
 var import_node = require("@odla-ai/security/node");
 async function runHostedSecurity(options) {
@@ -2731,9 +2968,9 @@ async function runHostedSecurity(options) {
   const appId = selfAudit ? "odla-ai" : cfg.app.id;
   const env = selfAudit ? "prod" : selectEnv(options.env, cfg.envs, cfg.configPath, cfg.rootDir);
   const platform = options.platform ?? cfg?.platformUrl ?? "https://odla.ai";
-  const target = (0, import_node_path6.resolve)(options.target ?? cfg?.rootDir ?? ".");
-  const output = (0, import_node_path6.resolve)(options.out ?? (0, import_node_path6.resolve)(target, ".odla/security/hosted"));
-  const outputRelative = (0, import_node_path6.relative)(target, output).split(import_node_path6.sep).join("/");
+  const target = (0, import_node_path7.resolve)(options.target ?? cfg?.rootDir ?? ".");
+  const output = (0, import_node_path7.resolve)(options.out ?? (0, import_node_path7.resolve)(target, ".odla/security/hosted"));
+  const outputRelative = (0, import_node_path7.relative)(target, output).split(import_node_path7.sep).join("/");
   if (!outputRelative) throw new Error("Hosted security output cannot be the repository root");
   const profile = profileFor(options.profile ?? "odla", options.maxHuntTasks ?? 12);
   const tokenRequest = {
@@ -2745,7 +2982,7 @@ async function runHostedSecurity(options) {
   };
   const token = await injectedToken(options, tokenRequest);
   const snapshot = await (0, import_node.snapshotDirectory)(target, {
-    exclude: !outputRelative.startsWith("../") && !(0, import_node_path6.isAbsolute)(outputRelative) ? [outputRelative] : []
+    exclude: !outputRelative.startsWith("../") && !(0, import_node_path7.isAbsolute)(outputRelative) ? [outputRelative] : []
   });
   const hosted = await (0, import_security.createPlatformSecurityReasoners)({
     platform,
@@ -2763,7 +3000,7 @@ async function runHostedSecurity(options) {
   });
   const harness = (0, import_security.createSecurityHarness)({
     profile,
-    store: new import_node.FileRunStore((0, import_node_path6.resolve)(output, "state")),
+    store: new import_node.FileRunStore((0, import_node_path7.resolve)(output, "state")),
     discoveryReasoner: hosted.discoveryReasoner,
     validationReasoner: hosted.validationReasoner,
     policy: {
@@ -2787,7 +3024,7 @@ async function runHostedSecurity(options) {
 function selectEnv(requested, declared, configPath, rootDir) {
   const env = requested ?? (declared.includes("dev") ? "dev" : declared[0]);
   if (!env || !declared.includes(env)) {
-    const shown = (0, import_node_path6.relative)(rootDir, configPath) || configPath;
+    const shown = (0, import_node_path7.relative)(rootDir, configPath) || configPath;
     throw new Error(`env "${env ?? ""}" is not declared in ${shown}`);
   }
   return env;
@@ -2816,7 +3053,7 @@ function printSummary(out, appId, env, run, report, output) {
   out.log(`  coverage: ${report.coverageStatus} ${complete}/${report.coverage.length} blocked=${report.metrics.blockedCells} shallow=${report.metrics.shallowCells} unscheduled=${report.metrics.unscheduledCells} budget_exhausted=${report.metrics.budgetExhaustedCells}`);
   if (report.callBudget) out.log(`  calls: discovery=${formatBudget(report.callBudget.discovery)} validation=${formatBudget(report.callBudget.validation)}`);
   out.log(`  findings: confirmed=${report.metrics.confirmed} needs_reproduction=${report.metrics.needsReproduction} candidates=${report.metrics.candidates}`);
-  out.log(`  report: ${(0, import_node_path6.resolve)(output, "REPORT.md")}`);
+  out.log(`  report: ${(0, import_node_path7.resolve)(output, "REPORT.md")}`);
 }
 function formatBudget(usage) {
   return usage ? `${usage.usedCalls}/${usage.maxCalls} skipped=${usage.skippedCalls}` : "caller-managed";
@@ -3479,9 +3716,9 @@ async function securityStatus(parsed, dependencies) {
 }
 
 // src/skill.ts
-var import_node_fs8 = require("fs");
+var import_node_fs10 = require("fs");
 var import_node_os = require("os");
-var import_node_path7 = require("path");
+var import_node_path8 = require("path");
 var import_node_url2 = require("url");
 
 // src/skill-adapters.ts
@@ -3542,8 +3779,8 @@ function installSkill(options = {}) {
   const files = listFiles(sourceDir);
   if (files.length === 0) throw new Error(`no bundled skills found at ${sourceDir}`);
   const harnesses = normalizeHarnesses(options.harnesses, options.global === true);
-  const root = (0, import_node_path7.resolve)(options.dir ?? process.cwd());
-  const home = (0, import_node_path7.resolve)(options.homeDir ?? (0, import_node_os.homedir)());
+  const root = (0, import_node_path8.resolve)(options.dir ?? process.cwd());
+  const home = (0, import_node_path8.resolve)(options.homeDir ?? (0, import_node_os.homedir)());
   const plans = /* @__PURE__ */ new Map();
   const targets = /* @__PURE__ */ new Map();
   const rememberTarget = (harness, target) => {
@@ -3557,48 +3794,48 @@ function installSkill(options = {}) {
     plans.set(target, { target, content, boundary, managedMerge });
   };
   const planSkillTree = (targetDir2, boundary = root) => {
-    for (const rel of files) plan((0, import_node_path7.join)(targetDir2, rel), (0, import_node_fs8.readFileSync)((0, import_node_path7.join)(sourceDir, rel), "utf8"), false, boundary);
+    for (const rel of files) plan((0, import_node_path8.join)(targetDir2, rel), (0, import_node_fs10.readFileSync)((0, import_node_path8.join)(sourceDir, rel), "utf8"), false, boundary);
   };
   let targetDir;
   if (options.global) {
-    const claudeRoot = (0, import_node_path7.join)(home, ".claude", "skills");
-    const codexRoot = (0, import_node_path7.resolve)(options.codexHomeDir ?? process.env.CODEX_HOME ?? (0, import_node_path7.join)(home, ".codex"), "skills");
+    const claudeRoot = (0, import_node_path8.join)(home, ".claude", "skills");
+    const codexRoot = (0, import_node_path8.resolve)(options.codexHomeDir ?? process.env.CODEX_HOME ?? (0, import_node_path8.join)(home, ".codex"), "skills");
     targetDir = harnesses[0] === "codex" ? codexRoot : claudeRoot;
     for (const harness of harnesses) {
       const skillRoot = harness === "claude" ? claudeRoot : codexRoot;
-      planSkillTree(skillRoot, harness === "claude" ? home : (0, import_node_path7.dirname)((0, import_node_path7.dirname)(codexRoot)));
+      planSkillTree(skillRoot, harness === "claude" ? home : (0, import_node_path8.dirname)((0, import_node_path8.dirname)(codexRoot)));
       rememberTarget(harness, skillRoot);
     }
   } else {
-    const sharedRoot = (0, import_node_path7.join)(root, ".agents", "skills");
+    const sharedRoot = (0, import_node_path8.join)(root, ".agents", "skills");
     planSkillTree(sharedRoot);
-    const claudeRoot = (0, import_node_path7.join)(root, ".claude", "skills");
+    const claudeRoot = (0, import_node_path8.join)(root, ".claude", "skills");
     targetDir = harnesses.includes("claude") ? claudeRoot : sharedRoot;
     for (const harness of harnesses) rememberTarget(harness, sharedRoot);
     if (harnesses.includes("claude")) {
       for (const skill of skillNames(files)) {
-        const canonical = (0, import_node_fs8.readFileSync)((0, import_node_path7.join)(sourceDir, skill, "SKILL.md"), "utf8");
-        plan((0, import_node_path7.join)(claudeRoot, skill, "SKILL.md"), claudeAdapter(skill, canonical));
+        const canonical = (0, import_node_fs10.readFileSync)((0, import_node_path8.join)(sourceDir, skill, "SKILL.md"), "utf8");
+        plan((0, import_node_path8.join)(claudeRoot, skill, "SKILL.md"), claudeAdapter(skill, canonical));
       }
       rememberTarget("claude", claudeRoot);
     }
     if (harnesses.includes("cursor")) {
-      const cursorRule = (0, import_node_path7.join)(root, ".cursor", "rules", "odla.mdc");
+      const cursorRule = (0, import_node_path8.join)(root, ".cursor", "rules", "odla.mdc");
       plan(cursorRule, CURSOR_RULE);
       rememberTarget("cursor", cursorRule);
     }
     if (harnesses.includes("agents")) {
-      const agentsFile = (0, import_node_path7.join)(root, "AGENTS.md");
+      const agentsFile = (0, import_node_path8.join)(root, "AGENTS.md");
       plan(agentsFile, managedFileContent(agentsFile, PROJECT_INSTRUCTIONS, options.force === true, root), true);
       rememberTarget("agents", agentsFile);
     }
     if (harnesses.includes("copilot")) {
-      const copilotFile = (0, import_node_path7.join)(root, ".github", "copilot-instructions.md");
+      const copilotFile = (0, import_node_path8.join)(root, ".github", "copilot-instructions.md");
       plan(copilotFile, managedFileContent(copilotFile, PROJECT_INSTRUCTIONS, options.force === true, root), true);
       rememberTarget("copilot", copilotFile);
     }
     if (harnesses.includes("gemini")) {
-      const geminiFile = (0, import_node_path7.join)(root, "GEMINI.md");
+      const geminiFile = (0, import_node_path8.join)(root, "GEMINI.md");
       plan(geminiFile, managedFileContent(geminiFile, PROJECT_INSTRUCTIONS, options.force === true, root), true);
       rememberTarget("gemini", geminiFile);
     }
@@ -3612,11 +3849,11 @@ function installSkill(options = {}) {
       conflicts.push(`${file.target} (redirected by symbolic link ${symlink})`);
       continue;
     }
-    if (!(0, import_node_fs8.existsSync)(file.target)) {
+    if (!(0, import_node_fs10.existsSync)(file.target)) {
       writtenPaths.add(file.target);
       continue;
     }
-    const current = (0, import_node_fs8.readFileSync)(file.target, "utf8");
+    const current = (0, import_node_fs10.readFileSync)(file.target, "utf8");
     if (current === file.content) {
       unchangedPaths.add(file.target);
     } else if (file.managedMerge || options.force) {
@@ -3633,9 +3870,9 @@ ${conflicts.map((f) => `  - ${f}`).join("\n")}`
     );
   }
   for (const file of plans.values()) {
-    if (!(0, import_node_fs8.existsSync)(file.target) || (0, import_node_fs8.readFileSync)(file.target, "utf8") !== file.content) {
-      (0, import_node_fs8.mkdirSync)((0, import_node_path7.dirname)(file.target), { recursive: true });
-      (0, import_node_fs8.writeFileSync)(file.target, file.content);
+    if (!(0, import_node_fs10.existsSync)(file.target) || (0, import_node_fs10.readFileSync)(file.target, "utf8") !== file.content) {
+      (0, import_node_fs10.mkdirSync)((0, import_node_path8.dirname)(file.target), { recursive: true });
+      (0, import_node_fs10.writeFileSync)(file.target, file.content);
     }
   }
   const skills = skillNames(files);
@@ -3654,7 +3891,7 @@ ${conflicts.map((f) => `  - ${f}`).join("\n")}`
   };
 }
 function pathsUnder(root, paths) {
-  return [...paths].map((path) => (0, import_node_path7.relative)(root, path)).filter((path) => path !== ".." && !path.startsWith(`..${import_node_path7.sep}`) && !(0, import_node_path7.isAbsolute)(path)).sort();
+  return [...paths].map((path) => (0, import_node_path8.relative)(root, path)).filter((path) => path !== ".." && !path.startsWith(`..${import_node_path8.sep}`) && !(0, import_node_path8.isAbsolute)(path)).sort();
 }
 function normalizeHarnesses(values, global) {
   const requested = values?.length ? values : ["claude"];
@@ -3676,9 +3913,9 @@ function normalizeHarnesses(values, global) {
 function managedFileContent(path, block, force, boundary) {
   const symlink = symlinkedComponent(boundary, path);
   if (symlink) throw new Error(`refusing to manage ${path}: symbolic link component ${symlink}`);
-  if (!(0, import_node_fs8.existsSync)(path)) return `${block}
+  if (!(0, import_node_fs10.existsSync)(path)) return `${block}
 `;
-  const current = (0, import_node_fs8.readFileSync)(path, "utf8");
+  const current = (0, import_node_fs10.readFileSync)(path, "utf8");
   const start = "<!-- odla-ai agent setup:start -->";
   const end = "<!-- odla-ai agent setup:end -->";
   const startAt = current.indexOf(start);
@@ -3699,15 +3936,15 @@ function managedFileContent(path, block, force, boundary) {
   return `${current.slice(0, startAt)}${block}${current.slice(afterEnd)}`;
 }
 function symlinkedComponent(boundary, target) {
-  const rel = (0, import_node_path7.relative)(boundary, target);
-  if (rel === ".." || rel.startsWith(`..${import_node_path7.sep}`) || (0, import_node_path7.isAbsolute)(rel)) {
+  const rel = (0, import_node_path8.relative)(boundary, target);
+  if (rel === ".." || rel.startsWith(`..${import_node_path8.sep}`) || (0, import_node_path8.isAbsolute)(rel)) {
     throw new Error(`agent setup target escapes its install root: ${target}`);
   }
   let current = boundary;
-  for (const part of rel.split(import_node_path7.sep).filter(Boolean)) {
-    current = (0, import_node_path7.join)(current, part);
+  for (const part of rel.split(import_node_path8.sep).filter(Boolean)) {
+    current = (0, import_node_path8.join)(current, part);
     try {
-      if ((0, import_node_fs8.lstatSync)(current).isSymbolicLink()) return current;
+      if ((0, import_node_fs10.lstatSync)(current).isSymbolicLink()) return current;
     } catch (error) {
       if (error.code !== "ENOENT") throw error;
     }
@@ -3718,13 +3955,13 @@ function skillNames(files) {
   return [...new Set(files.filter((file) => /(^|[\\/])SKILL\.md$/.test(file)).map((file) => file.split(/[\\/]/)[0]))].sort();
 }
 function listFiles(dir) {
-  if (!(0, import_node_fs8.existsSync)(dir)) return [];
+  if (!(0, import_node_fs10.existsSync)(dir)) return [];
   const results = [];
   const walk = (current) => {
-    for (const entry of (0, import_node_fs8.readdirSync)(current, { withFileTypes: true })) {
-      const path = (0, import_node_path7.join)(current, entry.name);
+    for (const entry of (0, import_node_fs10.readdirSync)(current, { withFileTypes: true })) {
+      const path = (0, import_node_path8.join)(current, entry.name);
       if (entry.isDirectory()) walk(path);
-      else results.push((0, import_node_path7.relative)(dir, path));
+      else results.push((0, import_node_path8.relative)(dir, path));
     }
   };
   walk(dir);
@@ -3775,7 +4012,7 @@ async function smoke(options) {
     );
     const status = await readCalendarStatus({ platform: cfg.platformUrl, appId: cfg.app.id, env, token, fetch: doFetch });
     assertCalendarHealthy(status, calendarServiceConfig(cfg, env));
-    out.log(`  calendar: ${status.status}, last sync ${new Date(status.lastSuccessfulSyncAt).toISOString()}`);
+    out.log(`  calendar: ${status.status}, bookable (booking \u2192 ${status.bookingCalendarId ?? "primary"})`);
   }
   const expectedSchema = await resolveDataExport(cfg, cfg.db?.schema, ["schema", "SCHEMA"]);
   const expectedEntities = serializedEntities(expectedSchema);
@@ -3798,14 +4035,6 @@ async function smoke(options) {
   } else {
     out.log(`  aggregate: skipped (schema has no entities)`);
   }
-  if (cfg.services.includes("calendar")) {
-    const bookings = await postJson2(doFetch, `${cfg.dbEndpoint}/app/${encodeURIComponent(entry.tenantId)}/aggregate`, entry.dbKey, {
-      ns: "$bookings",
-      aggregate: { count: true }
-    });
-    const count = bookings.aggregate?.count;
-    out.log(`  bookings: ${String(count ?? "ok")}`);
-  }
   out.log("ok");
 }
 function assertCalendarHealthy(status, expected) {
@@ -3813,14 +4042,11 @@ function assertCalendarHealthy(status, expected) {
   if (status.status !== "healthy") {
     throw new Error(`calendar connection is ${status.status}${status.error?.message ? `: ${status.error.message}` : ""}`);
   }
-  if (status.access !== "read") throw new Error("calendar connection is not read-only");
-  const hasReadScope = status.grantedScopes.some((scope) => scope === GOOGLE_CALENDAR_READ_SCOPE || scope === "calendar.events.readonly");
-  if (!hasReadScope) throw new Error("calendar connection is missing calendar.events.readonly consent");
-  const missing = expected.calendars.filter((id) => !status.calendars.includes(id));
+  if (!status.writable) throw new Error('calendar grant does not cover booking writes; run "odla-ai calendar connect" to re-consent');
+  const hasEventsScope = status.grantedScopes.some((scope) => scope === GOOGLE_CALENDAR_EVENTS_SCOPE);
+  if (!hasEventsScope) throw new Error("calendar connection is missing calendar.events consent");
+  const missing = expected.availabilityCalendars.filter((id) => !status.calendars.includes(id));
   if (missing.length) throw new Error(`calendar connection is missing configured calendars: ${missing.join(", ")}`);
-  if (status.lastSuccessfulSyncAt === void 0) throw new Error("calendar has never completed a sync");
-  if (Date.now() - status.lastSuccessfulSyncAt > 30 * 6e4) throw new Error("calendar sync is more than 30 minutes stale");
-  if (status.watchExpiresAt !== void 0 && status.watchExpiresAt <= Date.now()) throw new Error("calendar watch channel is expired");
 }
 async function getJson(doFetch, url, bearer) {
   const res = await doFetch(url, {
@@ -3852,6 +4078,9 @@ async function safeText4(res) {
 }
 
 // src/cli.ts
+function exitCodeFor(err) {
+  return err?.code === "handshake_pending" ? 75 : 1;
+}
 async function runCli(argv = process.argv.slice(2), dependencies = {}) {
   const parsed = parseArgv(argv);
   const command = parsed.positionals[0] ?? "help";
@@ -3904,6 +4133,10 @@ async function runCli(argv = process.argv.slice(2), dependencies = {}) {
     await adminCommand(parsed);
     return;
   }
+  if (command === "app") {
+    await appCommand(parsed, dependencies);
+    return;
+  }
   if (command === "security") {
     await securityCommand(parsed, dependencies);
     return;
@@ -4000,6 +4233,7 @@ async function provisionCommand(parsed, dependencies) {
     "token",
     "email",
     "open",
+    "wait",
     "yes"
   ], 1);
   const writeDevVars2 = parsed.options["write-dev-vars"];
@@ -4014,6 +4248,7 @@ async function provisionCommand(parsed, dependencies) {
     token: stringOpt(parsed.options.token),
     email: stringOpt(parsed.options.email),
     open: parsed.options.open === false ? false : parsed.options.open === true ? true : void 0,
+    wait: numberOpt(parsed.options.wait, "--wait"),
     yes: parsed.options.yes === true,
     fetch: dependencies.fetch,
     openApprovalUrl: dependencies.openUrl,
@@ -4023,7 +4258,7 @@ async function provisionCommand(parsed, dependencies) {
 }
 async function calendarCommand(parsed, dependencies) {
   const sub = parsed.positionals[1];
-  if (sub !== "status" && sub !== "calendars" && sub !== "connect" && sub !== "resync" && sub !== "disconnect") {
+  if (sub !== "status" && sub !== "calendars" && sub !== "connect" && sub !== "disconnect") {
     throw new Error(`unknown calendar subcommand "${sub ?? ""}". Try "odla-ai calendar status --env dev".`);
   }
   assertArgs(parsed, ["config", "env", "json", "token", "email", "open", "yes"], 2);
@@ -4044,26 +4279,25 @@ async function calendarCommand(parsed, dependencies) {
   if (sub === "status") await calendarStatus(options);
   else if (sub === "calendars") await calendarCalendars(options);
   else if (sub === "connect") await calendarConnect(options);
-  else if (sub === "resync") await calendarResync(options);
   else await calendarDisconnect(options);
 }
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
   AGENT_HARNESSES,
   CAPABILITIES,
-  GOOGLE_CALENDAR_READ_SCOPE,
+  GOOGLE_CALENDAR_EVENTS_SCOPE,
   SYSTEM_AI_PURPOSES,
   adminAi,
   calendarBookingPageUrl,
   calendarCalendars,
   calendarConnect,
   calendarDisconnect,
-  calendarResync,
   calendarServiceConfig,
   calendarStatus,
   connectGitHubSecuritySource,
   disconnectGitHubSecuritySource,
   doctor,
+  exitCodeFor,
   followHostedSecurityJob,
   getHostedSecurityIntent,
   getHostedSecurityJob,