@odla-ai/cli 0.11.2 → 0.13.0

package/dist/bin.cjs

@@ -28,35 +28,16 @@ var getImportMetaUrl = () => typeof document === "undefined" ? new URL(`file:${_
 var importMetaUrl = /* @__PURE__ */ getImportMetaUrl();
 
 // src/admin-ai.ts
-var import_node_process5 = __toESM(require("process"), 1);
+var import_node_process6 = __toESM(require("process"), 1);
 
 // src/token.ts
 var import_db = require("@odla-ai/db");
-var import_node_process2 = __toESM(require("process"), 1);
+var import_node_process3 = __toESM(require("process"), 1);
 
-// src/open.ts
-var import_node_child_process = require("child_process");
+// src/handshake-state.ts
+var import_node_fs2 = require("fs");
+var import_node_path2 = require("path");
 var import_node_process = __toESM(require("process"), 1);
-async function openUrl(url, options = {}) {
-  const command = openerFor(options.platform ?? import_node_process.default.platform);
-  const doSpawn = options.spawnImpl ?? import_node_child_process.spawn;
-  await new Promise((resolve7, reject) => {
-    const child = doSpawn(command.cmd, [...command.args, url], {
-      stdio: "ignore",
-      detached: true
-    });
-    child.once("error", reject);
-    child.once("spawn", () => {
-      child.unref();
-      resolve7();
-    });
-  });
-}
-function openerFor(platform) {
-  if (platform === "darwin") return { cmd: "open", args: [] };
-  if (platform === "win32") return { cmd: "cmd", args: ["/c", "start", ""] };
-  return { cmd: "xdg-open", args: [] };
-}
 
 // src/local.ts
 var import_node_fs = require("fs");
@@ -184,54 +165,191 @@ function displayPath(path, rootDir = process.cwd()) {
   return rel && !rel.startsWith("..") ? rel : path;
 }
 
+// src/handshake-state.ts
+function handshakeFile(cfg) {
+  return (0, import_node_path2.join)((0, import_node_path2.dirname)(cfg.local.tokenFile), "handshake.local.json");
+}
+var RESUME_MARGIN_MS = 5e3;
+function readPendingHandshake(path, platform, email) {
+  const pending = readJsonFile(path);
+  if (!pending || pending.platform !== platform || pending.email !== email) return null;
+  if (typeof pending.userCode !== "string" || typeof pending.deviceCode !== "string" || typeof pending.approvalUrl !== "string") return null;
+  if (typeof pending.expiresAt !== "number" || pending.expiresAt <= Date.now() + RESUME_MARGIN_MS) return null;
+  return { interval: 3, ...pending };
+}
+function writePendingHandshake(path, pending) {
+  writePrivateJson(path, pending);
+}
+function clearPendingHandshake(path) {
+  (0, import_node_fs2.rmSync)(path, { force: true });
+}
+function minutesLeft(expiresAt) {
+  return Math.max(1, Math.round((expiresAt - Date.now()) / 6e4));
+}
+function approvalHint(pending) {
+  return `approve code ${pending.userCode} at ${pending.approvalUrl} (${minutesLeft(pending.expiresAt)}m left)`;
+}
+function approvalReminder(out, pending, periodMs = 3e4) {
+  const timer = setInterval(() => out.log(`auth: still waiting \u2014 ${approvalHint(pending)}`), periodMs);
+  timer.unref?.();
+  return () => clearInterval(timer);
+}
+function handshakeWaitMs(waitSeconds, interactive = import_node_process.default.stdout.isTTY === true) {
+  if (waitSeconds !== void 0) return waitSeconds * 1e3;
+  return interactive ? void 0 : 9e4;
+}
+
+// src/open.ts
+var import_node_child_process = require("child_process");
+var import_node_process2 = __toESM(require("process"), 1);
+async function openUrl(url, options = {}) {
+  const command = openerFor(options.platform ?? import_node_process2.default.platform);
+  const doSpawn = options.spawnImpl ?? import_node_child_process.spawn;
+  await new Promise((resolve7, reject) => {
+    const child = doSpawn(command.cmd, [...command.args, url], {
+      stdio: "ignore",
+      detached: true
+    });
+    child.once("error", reject);
+    child.once("spawn", () => {
+      child.unref();
+      resolve7();
+    });
+  });
+}
+function openerFor(platform) {
+  if (platform === "darwin") return { cmd: "open", args: [] };
+  if (platform === "win32") return { cmd: "cmd", args: ["/c", "start", ""] };
+  return { cmd: "xdg-open", args: [] };
+}
+
 // src/token.ts
 async function getDeveloperToken(cfg, options, doFetch, out) {
   if (options.token) return options.token;
   const audience = platformAudience(cfg.platformUrl);
-  if (import_node_process2.default.env.ODLA_DEV_TOKEN) {
-    const declared = import_node_process2.default.env.ODLA_DEV_TOKEN_AUDIENCE;
+  if (import_node_process3.default.env.ODLA_DEV_TOKEN) {
+    const declared = import_node_process3.default.env.ODLA_DEV_TOKEN_AUDIENCE;
     if (declared) {
       if (platformAudience(declared) !== audience) throw new Error("ODLA_DEV_TOKEN_AUDIENCE does not match the configured platform");
     } else if (audience !== "https://odla.ai") {
       throw new Error("ODLA_DEV_TOKEN_AUDIENCE is required for a non-default platform");
     }
-    return import_node_process2.default.env.ODLA_DEV_TOKEN;
+    return import_node_process3.default.env.ODLA_DEV_TOKEN;
   }
   const cached = readJsonFile(cfg.local.tokenFile);
   if (cached?.token && cached.platform === audience && (cached.expiresAt ?? 0) > Date.now() + 6e4) {
     out.log(`auth: using cached developer token (${displayPath(cfg.local.tokenFile, cfg.rootDir)})`);
     return cached.token;
   }
-  const browser = approvalBrowser(options);
-  const email = handshakeEmail(options.email, cached?.platform === audience ? cached.email : void 0);
-  const { token, expiresAt } = await (0, import_db.requestToken)({
-    endpoint: cfg.platformUrl,
-    email,
-    label: `${cfg.app.id} provisioner`,
-    fetch: doFetch,
-    onCode: async ({ userCode, expiresIn, verificationUriComplete }) => {
-      const approvalUrl = verificationUriComplete ?? handshakeUrl(cfg.platformUrl, userCode);
-      out.log("");
-      out.log(`Review, then approve code ${userCode} at ${approvalUrl} within ${Math.floor(expiresIn / 60)}m.`);
-      if (browser.open) {
-        try {
-          await (options.openApprovalUrl ?? openUrl)(approvalUrl);
-          out.log(`auth: opened browser for approval${browser.mode === "auto" ? " (auto)" : ""}`);
-        } catch (err) {
-          out.log(`auth: could not open browser (${err instanceof Error ? err.message : String(err)})`);
-        }
-      } else if (browser.reason) {
-        out.log(`auth: browser launch skipped (${browser.reason})`);
-      }
-      out.log("");
-    }
-  });
-  writePrivateJson(cfg.local.tokenFile, { platform: audience, email, token, expiresAt });
+  const ctx = {
+    cfg,
+    options,
+    doFetch,
+    out,
+    audience,
+    browser: approvalBrowser(options),
+    email: handshakeEmail(options.email, cached?.platform === audience ? cached.email : void 0),
+    pendingFile: handshakeFile(cfg)
+  };
+  const waitMs = handshakeWaitMs(options.wait);
+  const { token, expiresAt } = await resumePendingHandshake(ctx, waitMs) ?? await freshHandshake(ctx, waitMs);
+  clearPendingHandshake(ctx.pendingFile);
+  writePrivateJson(cfg.local.tokenFile, { platform: audience, email: ctx.email, token, expiresAt });
   out.log(`auth: developer token cached (${displayPath(cfg.local.tokenFile, cfg.rootDir)})`);
   return token;
 }
+async function resumePendingHandshake(ctx, waitMs) {
+  const pending = readPendingHandshake(ctx.pendingFile, ctx.audience, ctx.email);
+  if (!pending) return null;
+  ctx.out.log("");
+  ctx.out.log(`auth: resuming pending handshake \u2014 ${approvalHint(pending)}`);
+  await launchApproval(ctx, pending.approvalUrl);
+  ctx.out.log("");
+  const stopReminder = approvalReminder(ctx.out, pending);
+  try {
+    return await (0, import_db.collectToken)({
+      endpoint: ctx.cfg.platformUrl,
+      deviceCode: pending.deviceCode,
+      expiresAt: pending.expiresAt,
+      interval: pending.interval,
+      waitMs,
+      fetch: ctx.doFetch
+    });
+  } catch (err) {
+    const code = err instanceof import_db.OdlaError ? err.code : void 0;
+    if (code === "handshake_pending") throw stillPending(pending, ctx.email);
+    if (code === "handshake_expired" || code === "handshake_timeout") {
+      clearPendingHandshake(ctx.pendingFile);
+      ctx.out.log("auth: pending handshake lapsed unapproved; starting a fresh one");
+      return null;
+    }
+    if (code === "handshake_denied") clearPendingHandshake(ctx.pendingFile);
+    throw err;
+  } finally {
+    stopReminder();
+  }
+}
+async function freshHandshake(ctx, waitMs) {
+  let started;
+  let stopReminder;
+  try {
+    return await (0, import_db.requestToken)({
+      endpoint: ctx.cfg.platformUrl,
+      email: ctx.email,
+      label: `${ctx.cfg.app.id} provisioner`,
+      fetch: ctx.doFetch,
+      waitMs,
+      onCode: async ({ userCode, deviceCode, expiresIn, interval, verificationUriComplete }) => {
+        const approvalUrl = verificationUriComplete ?? handshakeUrl(ctx.cfg.platformUrl, userCode);
+        started = {
+          platform: ctx.audience,
+          email: ctx.email,
+          userCode,
+          deviceCode,
+          approvalUrl,
+          interval,
+          expiresAt: Date.now() + expiresIn * 1e3
+        };
+        writePendingHandshake(ctx.pendingFile, started);
+        ctx.out.log("");
+        ctx.out.log(`Review, then ${approvalHint(started)}.`);
+        await launchApproval(ctx, approvalUrl);
+        ctx.out.log("");
+        stopReminder = approvalReminder(ctx.out, started);
+      }
+    });
+  } catch (err) {
+    const code = err instanceof import_db.OdlaError ? err.code : void 0;
+    if (code === "handshake_pending" && started) throw stillPending(started, ctx.email);
+    if (code === "handshake_denied" || code === "handshake_expired" || code === "handshake_timeout") {
+      clearPendingHandshake(ctx.pendingFile);
+    }
+    throw err;
+  } finally {
+    stopReminder?.();
+  }
+}
+async function launchApproval(ctx, approvalUrl) {
+  if (ctx.browser.open) {
+    try {
+      await (ctx.options.openApprovalUrl ?? openUrl)(approvalUrl);
+      ctx.out.log(`auth: asked the OS to open a browser${ctx.browser.mode === "auto" ? " (auto)" : ""} \u2014 if no tab appeared, use the URL above`);
+    } catch (err) {
+      ctx.out.log(`auth: could not open browser (${err instanceof Error ? err.message : String(err)})`);
+    }
+  } else if (ctx.browser.reason) {
+    ctx.out.log(`auth: browser launch skipped (${ctx.browser.reason}) \u2014 show the human the URL above`);
+  }
+}
+function stillPending(pending, email) {
+  return new import_db.OdlaError(
+    "handshake_pending",
+    `handshake still pending \u2014 ask ${email} to ${approvalHint(pending)}, then re-run this command; it resumes the same handshake and collects the token`,
+    { retryable: true }
+  );
+}
 function handshakeEmail(value, cached) {
-  const email = (value ?? import_node_process2.default.env.ODLA_USER_EMAIL ?? cached ?? "").trim().toLowerCase();
+  const email = (value ?? import_node_process3.default.env.ODLA_USER_EMAIL ?? cached ?? "").trim().toLowerCase();
   if (email.length > 254 || !/^[^\s@]+@[^\s@]+\.[^\s@]+$/.test(email)) {
     throw new Error("a fresh odla handshake requires --email <account> or ODLA_USER_EMAIL");
   }
@@ -240,10 +358,11 @@ function handshakeEmail(value, cached) {
 function approvalBrowser(options, host = {}) {
   if (options.open === true) return { open: true, mode: "forced" };
   if (options.open === false) return { open: false, reason: "disabled by --no-open" };
-  const env = host.env ?? import_node_process2.default.env;
+  const env = host.env ?? import_node_process3.default.env;
+  if (env.VITEST || env.NODE_ENV === "test") return { open: false, reason: "test environment" };
   if (env.CI) return { open: false, reason: "CI environment" };
   if (env.SSH_CONNECTION || env.SSH_TTY) return { open: false, reason: "SSH session; pass --open to force" };
-  const platform = host.platform ?? import_node_process2.default.platform;
+  const platform = host.platform ?? import_node_process3.default.platform;
   if (platform !== "darwin" && platform !== "win32" && !env.DISPLAY && !env.WAYLAND_DISPLAY) {
     return { open: false, reason: "no graphical display; pass --open to force" };
   }
@@ -272,12 +391,12 @@ function platformAudience(value) {
 }
 
 // src/secret-input.ts
-var import_node_process3 = __toESM(require("process"), 1);
+var import_node_process4 = __toESM(require("process"), 1);
 var MAX_BYTES = 64 * 1024;
 async function secretInputValue(options, kind = "credential") {
   if (options.fromEnv && options.stdin) throw new Error("choose exactly one of --from-env or --stdin");
   let value;
-  if (options.fromEnv) value = import_node_process3.default.env[options.fromEnv];
+  if (options.fromEnv) value = import_node_process4.default.env[options.fromEnv];
   else if (options.stdin) value = await (options.readStdin ?? (() => readSecretStream(kind)))();
   else throw new Error(`${kind} input required: use --from-env <NAME> or --stdin; values are never accepted as arguments`);
   value = value?.replace(/[\r\n]+$/, "");
@@ -285,7 +404,7 @@ async function secretInputValue(options, kind = "credential") {
   if (new TextEncoder().encode(value).byteLength > MAX_BYTES) throw new Error(`${kind} exceeds 64 KiB`);
   return value;
 }
-async function readSecretStream(kind, stream = import_node_process3.default.stdin) {
+async function readSecretStream(kind, stream = import_node_process4.default.stdin) {
   let value = "";
   for await (const chunk of stream) {
     value += String(chunk);
@@ -295,8 +414,8 @@ async function readSecretStream(kind, stream = import_node_process3.default.stdi
 }
 
 // src/admin-ai-auth.ts
-var import_node_fs2 = require("fs");
-var import_node_process4 = __toESM(require("process"), 1);
+var import_node_fs3 = require("fs");
+var import_node_process5 = __toESM(require("process"), 1);
 var import_db2 = require("@odla-ai/db");
 async function getScopedPlatformToken(options) {
   return resolveAdminPlatformToken(options);
@@ -304,7 +423,7 @@ async function getScopedPlatformToken(options) {
 async function resolveAdminPlatformToken(options) {
   const audience = platformAudience(options.platform);
   if (options.token) return options.token;
-  const fromEnv = import_node_process4.default.env.ODLA_ADMIN_TOKEN;
+  const fromEnv = import_node_process5.default.env.ODLA_ADMIN_TOKEN;
   if (fromEnv) return audienceBoundEnvToken(fromEnv, audience);
   return scopedToken(
     audience,
@@ -316,7 +435,7 @@ async function resolveAdminPlatformToken(options) {
 }
 function audienceBoundEnvToken(token, platform) {
   const audience = platformAudience(platform);
-  const declared = import_node_process4.default.env.ODLA_ADMIN_TOKEN_AUDIENCE;
+  const declared = import_node_process5.default.env.ODLA_ADMIN_TOKEN_AUDIENCE;
   if (declared) {
     if (platformAudience(declared) !== audience) throw new Error("ODLA_ADMIN_TOKEN_AUDIENCE does not match the configured platform");
   } else if (audience !== "https://odla.ai") {
@@ -326,7 +445,7 @@ function audienceBoundEnvToken(token, platform) {
 }
 async function scopedToken(platform, scope, options, doFetch, out) {
   const audience = platformAudience(platform);
-  const tokenFile = options.tokenFile ?? `${import_node_process4.default.cwd()}/.odla/admin-token.local.json`;
+  const tokenFile = options.tokenFile ?? `${import_node_process5.default.cwd()}/.odla/admin-token.local.json`;
   const cache = readJsonFile(tokenFile);
   const cached = cache?.platform === audience ? cache.tokens?.[scope] : void 0;
   if (cached?.token && (cached.expiresAt ?? 0) > Date.now() + 6e4) {
@@ -350,7 +469,7 @@ async function scopedToken(platform, scope, options, doFetch, out) {
   });
   const tokens = cache?.platform === audience ? { ...cache.tokens ?? {} } : {};
   tokens[scope] = { token, expiresAt };
-  if ((0, import_node_fs2.existsSync)(`${import_node_process4.default.cwd()}/.git`)) ensureGitignore(import_node_process4.default.cwd(), [tokenFile]);
+  if ((0, import_node_fs3.existsSync)(`${import_node_process5.default.cwd()}/.git`)) ensureGitignore(import_node_process5.default.cwd(), [tokenFile]);
   writePrivateJson(tokenFile, { platform: audience, email, tokens });
   out.log(`auth: cached ${scope} grant (${tokenFile}; mode 0600)`);
   return token;
@@ -511,7 +630,7 @@ function isRecord2(value) {
 
 // src/admin-ai.ts
 async function adminAi(options) {
-  const platform = platformAudience(options.platform ?? import_node_process5.default.env.ODLA_PLATFORM ?? "https://odla.ai");
+  const platform = platformAudience(options.platform ?? import_node_process6.default.env.ODLA_PLATFORM ?? "https://odla.ai");
   const doFetch = options.fetch ?? fetch;
   const out = options.stdout ?? console;
   const usageQuery = options.action === "usage" ? adminAiUsageQuery(options) : void 0;
@@ -826,87 +945,107 @@ async function adminCommand(parsed) {
   });
 }
 
-// src/capabilities.ts
-var CAPABILITIES = {
-  cli: [
-    "start an email-bound device request without accepting a password or user session token",
-    "register the app and enable configured services per environment",
-    "issue, persist, and explicitly rotate configured service credentials",
-    "write local Worker values and push deployed Worker secrets through Wrangler stdin",
-    "store tenant-vault secrets (including the Clerk webhook secret and reserved Clerk secret key) write-only from stdin or an env var",
-    "push db schema/rules and configure platform AI, auth, and deployment links",
-    "apply read-only Google calendar mirror and public booking-page config, then drive state-bound consent, status, discovery, resync, and disconnect flows",
-    "validate config offline and smoke-test a provisioned db environment",
-    "run app-attributed hosted security discovery and independent validation without provider keys",
-    "connect/revoke source-read-only GitHub sources and drive commit-pinned hosted security jobs without PATs or provider keys",
-    "let admins manage system AI policy and credentials, inspect attributed usage, and read immutable admin changes through separate short-lived capability-only approvals"
-  ],
-  agent: [
-    "install and import the selected odla SDKs",
-    "wrap the Worker with withObservability and choose useful telemetry",
-    "make application-specific schema, rules, auth, UI, and migration decisions",
-    "wire @odla-ai/calendar into trusted Worker code and keep the app admin key out of browsers"
-  ],
-  human: [
-    "provide the existing odla account email, then sign in and explicitly review/approve the exact device code",
-    "review mirrored calendar/attendee disclosure and complete the server-issued Google consent flow",
-    "consent to production changes with --yes",
-    "request destructive credential rotation explicitly",
-    "review application semantics, security findings, releases, and merges",
-    "approve redacted-source disclosure before hosted security reasoning",
-    "approve GitHub App repository access separately from redacted-snippet disclosure"
-  ],
-  studio: [
-    "view telemetry and environment state",
-    "let signed-in users inventory/revoke their own agent grants and admins audit/global-revoke them",
-    "review calendar connection, granted read scope, selected calendars, and sync health without exposing provider tokens",
-    "perform manual credential recovery when the CLI's local shown-once copy is unavailable",
-    "configure system AI purposes and view app/environment/run-attributed usage",
-    "connect/revoke GitHub security sources and inspect ref-to-SHA jobs, routes, retention, coverage, and normalized reports"
-  ]
-};
-function printCapabilities(json = false, out = console) {
-  if (json) {
-    out.log(JSON.stringify(CAPABILITIES, null, 2));
-    return;
+// src/app-export.ts
+var import_node_fs5 = require("fs");
+var import_node_stream = require("stream");
+var import_promises = require("stream/promises");
+
+// src/config.ts
+var import_node_fs4 = require("fs");
+var import_node_path3 = require("path");
+var import_node_url = require("url");
+
+// src/integration-validation.ts
+function validateIntegrations(cfg, path, defaultServices) {
+  if (cfg.integrations === void 0) return;
+  if (!Array.isArray(cfg.integrations)) throw new Error(`${path}: integrations must be an array`);
+  const ids = /* @__PURE__ */ new Set();
+  for (const [index, integration] of cfg.integrations.entries()) {
+    const at = `${path}: integrations[${index}]`;
+    if (!isRecord4(integration)) throw new Error(`${at} must be an object`);
+    if (!validId(integration.id)) throw new Error(`${at}.id must be lowercase letters, numbers, and hyphens`);
+    if (ids.has(integration.id)) throw new Error(`${path}: duplicate integration id "${integration.id}"`);
+    ids.add(integration.id);
+    if (!safeText(integration.title, 200)) throw new Error(`${at}.title is required`);
+    if (!safeText(integration.npm, 200)) throw new Error(`${at}.npm is required`);
+    if (integration.schema !== void 0 && (!isRecord4(integration.schema) || !isRecord4(integration.schema.entities))) {
+      throw new Error(`${at}.schema must contain an entities object`);
+    }
+    if (integration.rules !== void 0 && !isRecord4(integration.rules)) throw new Error(`${at}.rules must be an object`);
+    validateSeeds(integration, at);
+    validateProbes(integration, at);
+  }
+  const needsDb = cfg.integrations.some((integration) => integration.schema || integration.rules || integration.seeds?.length);
+  const services = unique(cfg.services?.length ? cfg.services : defaultServices);
+  if (needsDb && !services.includes("db")) throw new Error(`${path}: schema/rules/seed integrations require the db service`);
+}
+function validateSeeds(integration, at) {
+  if (integration.seeds === void 0) return;
+  if (!Array.isArray(integration.seeds)) throw new Error(`${at}.seeds must be an array`);
+  const ids = /* @__PURE__ */ new Set();
+  for (const [index, seed] of integration.seeds.entries()) {
+    const sat = `${at}.seeds[${index}]`;
+    if (!isRecord4(seed) || !safeText(seed.id, 200) || !safeText(seed.ns, 200)) throw new Error(`${sat} requires id and ns`);
+    if (ids.has(seed.id)) throw new Error(`${at} has duplicate seed id "${seed.id}"`);
+    ids.add(seed.id);
+    if (!isRecord4(seed.key) || !safeText(seed.key.attr, 200) || !safeText(seed.key.value, 2048)) {
+      throw new Error(`${sat}.key requires string attr and value`);
+    }
+    if (!isRecord4(seed.attrs)) throw new Error(`${sat}.attrs must be an object`);
+    if (Object.hasOwn(seed.attrs, seed.key.attr) && seed.attrs[seed.key.attr] !== seed.key.value) {
+      throw new Error(`${sat}.attrs.${seed.key.attr} conflicts with its natural key`);
+    }
   }
-  out.log("odla-ai responsibility boundary\n");
-  printGroup(out, "CLI automates", CAPABILITIES.cli);
-  printGroup(out, "Coding agent changes source", CAPABILITIES.agent);
-  printGroup(out, "Human checkpoints", CAPABILITIES.human);
-  printGroup(out, "Studio", CAPABILITIES.studio);
 }
-function printGroup(out, heading, items) {
-  out.log(`${heading}:`);
-  for (const item of items) out.log(`  - ${item}`);
-  out.log("");
+function validateProbes(integration, at) {
+  if (integration.probes === void 0) return;
+  if (!Array.isArray(integration.probes)) throw new Error(`${at}.probes must be an array`);
+  for (const [index, probe] of integration.probes.entries()) {
+    const pat = `${at}.probes[${index}]`;
+    if (!isRecord4(probe) || !safeProbePath(probe.path)) throw new Error(`${pat}.path must be an absolute path without query or fragment`);
+    if (!Number.isInteger(probe.expectedStatus) || probe.expectedStatus < 100 || probe.expectedStatus > 599) {
+      throw new Error(`${pat}.expectedStatus must be an HTTP status`);
+    }
+  }
+}
+function isRecord4(value) {
+  return value !== null && typeof value === "object" && !Array.isArray(value);
+}
+function safeText(value, max) {
+  return typeof value === "string" && value.trim().length > 0 && value.length <= max && !/[\u0000-\u001f\u007f]/.test(value);
+}
+function safeProbePath(value) {
+  return typeof value === "string" && /^\/[A-Za-z0-9._~!$&'()*+,;=:@%/-]*$/.test(value);
+}
+function validId(value) {
+  return typeof value === "string" && /^[a-z0-9][a-z0-9-]*$/.test(value);
+}
+function unique(values) {
+  return [...new Set(values.filter(Boolean))];
 }
 
 // src/config.ts
-var import_node_fs3 = require("fs");
-var import_node_path2 = require("path");
-var import_node_url = require("url");
 var DEFAULT_PLATFORM = "https://odla.ai";
 var DEFAULT_ENVS = ["dev"];
 var DEFAULT_SERVICES = ["db", "ai"];
-var GOOGLE_CALENDAR_READ_SCOPE = "https://www.googleapis.com/auth/calendar.events.readonly";
+var GOOGLE_CALENDAR_EVENTS_SCOPE = "https://www.googleapis.com/auth/calendar.events";
 async function loadProjectConfig(configPath = "odla.config.mjs") {
-  const resolved = (0, import_node_path2.resolve)(configPath);
-  if (!(0, import_node_fs3.existsSync)(resolved)) {
+  const resolved = (0, import_node_path3.resolve)(configPath);
+  if (!(0, import_node_fs4.existsSync)(resolved)) {
     throw new Error(`config not found: ${configPath}. Run "odla-ai init" first or pass --config.`);
   }
   const raw = await loadConfigModule(resolved);
-  const rootDir = (0, import_node_path2.dirname)(resolved);
+  const rootDir = (0, import_node_path3.dirname)(resolved);
   validateRawConfig(raw, resolved);
   const platformUrl = trimSlash(process.env.ODLA_PLATFORM_URL || raw.platformUrl || DEFAULT_PLATFORM);
   const dbEndpoint = trimSlash(process.env.ODLA_DB_ENDPOINT || raw.dbEndpoint || platformUrl);
-  const envs = unique(raw.envs?.length ? raw.envs : DEFAULT_ENVS);
-  const services = unique(raw.services?.length ? raw.services : DEFAULT_SERVICES);
+  const envs = unique2(raw.envs?.length ? raw.envs : DEFAULT_ENVS);
+  const services = unique2(raw.services?.length ? raw.services : DEFAULT_SERVICES);
   validateCalendarConfig(raw, envs, services, resolved);
   const local = {
-    tokenFile: (0, import_node_path2.resolve)(rootDir, raw.local?.tokenFile ?? ".odla/dev-token.json"),
-    credentialsFile: (0, import_node_path2.resolve)(rootDir, raw.local?.credentialsFile ?? ".odla/credentials.local.json"),
-    devVarsFile: (0, import_node_path2.resolve)(rootDir, raw.local?.devVarsFile ?? ".dev.vars"),
+    tokenFile: (0, import_node_path3.resolve)(rootDir, raw.local?.tokenFile ?? ".odla/dev-token.json"),
+    credentialsFile: (0, import_node_path3.resolve)(rootDir, raw.local?.credentialsFile ?? ".odla/credentials.local.json"),
+    devVarsFile: (0, import_node_path3.resolve)(rootDir, raw.local?.devVarsFile ?? ".dev.vars"),
     gitignore: raw.local?.gitignore ?? true
   };
   return {
@@ -923,9 +1062,9 @@ async function loadProjectConfig(configPath = "odla.config.mjs") {
 async function resolveDataExport(cfg, value, names) {
   if (value === void 0 || value === null || value === false) return void 0;
   if (typeof value !== "string") return value;
-  const target = (0, import_node_path2.isAbsolute)(value) ? value : (0, import_node_path2.resolve)(cfg.rootDir, value);
+  const target = (0, import_node_path3.isAbsolute)(value) ? value : (0, import_node_path3.resolve)(cfg.rootDir, value);
   if (target.endsWith(".json")) {
-    return JSON.parse((0, import_node_fs3.readFileSync)(target, "utf8"));
+    return JSON.parse((0, import_node_fs4.readFileSync)(target, "utf8"));
   }
   const mod = await import((0, import_node_url.pathToFileURL)(target).href);
   for (const name of names) {
@@ -935,6 +1074,8 @@ async function resolveDataExport(cfg, value, names) {
   throw new Error(`${value} did not export ${names.join(", ")} or default`);
 }
 function buildPlan(cfg) {
+  const integrationSchema = cfg.integrations?.some((integration) => integration.schema) ?? false;
+  const integrationRules = cfg.integrations?.some((integration) => integration.rules) ?? false;
   return {
     appId: cfg.app.id,
     appName: cfg.app.name,
@@ -942,8 +1083,9 @@ function buildPlan(cfg) {
     dbEndpoint: cfg.dbEndpoint,
     envs: cfg.envs,
     services: cfg.services,
-    hasSchema: !!cfg.db?.schema,
-    hasRules: !!cfg.db?.rules || !!cfg.db?.schema && cfg.db.defaultRules !== false,
+    integrations: (cfg.integrations ?? []).map((integration) => integration.id),
+    hasSchema: !!cfg.db?.schema || integrationSchema,
+    hasRules: !!cfg.db?.rules || integrationRules || (!!cfg.db?.schema || integrationSchema) && cfg.db?.defaultRules !== false,
     aiProvider: cfg.ai?.provider
   };
 }
@@ -952,16 +1094,14 @@ function calendarServiceConfig(cfg, env) {
   if (!cfg.envs.includes(env)) throw new Error(`calendar env "${env}" is not declared in config envs`);
   const google = cfg.calendar?.google;
   if (!google) throw new Error("calendar.google is required when the calendar service is enabled");
+  const availability = unique2(
+    (google.availabilityCalendars?.[env] ?? google.calendars?.[env]).map((id) => id.trim())
+  );
   return {
     provider: "google",
-    access: "read",
-    calendars: unique(google.calendars[env].map((id) => id.trim())),
-    match: {
-      organizerSelf: google.match?.organizerSelf ?? true,
-      requireAttendees: google.match?.requireAttendees ?? true,
-      ...google.match?.summaryPrefix !== void 0 ? { summaryPrefix: google.match.summaryPrefix.trim() } : {}
-    },
-    attendeePolicy: google.attendeePolicy ?? "full"
+    access: "book",
+    bookingCalendarId: google.bookingCalendar?.[env]?.trim() ?? availability[0],
+    availabilityCalendars: availability
   };
 }
 function calendarBookingPageUrl(cfg, env) {
@@ -990,15 +1130,16 @@ function validateRawConfig(raw, path) {
   if (!raw || typeof raw !== "object") throw new Error(`${path} must export an object`);
   const cfg = raw;
   if (!cfg.app || typeof cfg.app !== "object") throw new Error(`${path}: missing app object`);
-  if (!validId(cfg.app.id)) throw new Error(`${path}: app.id must be lowercase letters, numbers, and hyphens`);
+  if (!validId2(cfg.app.id)) throw new Error(`${path}: app.id must be lowercase letters, numbers, and hyphens`);
   if (!cfg.app.name || typeof cfg.app.name !== "string") throw new Error(`${path}: app.name is required`);
   if (cfg.envs !== void 0 && (!Array.isArray(cfg.envs) || cfg.envs.some((env) => typeof env !== "string"))) {
     throw new Error(`${path}: envs must be an array of names`);
   }
-  if (cfg.envs?.some((env) => !validId(env))) throw new Error(`${path}: env names must be lowercase letters, numbers, and hyphens`);
+  if (cfg.envs?.some((env) => !validId2(env))) throw new Error(`${path}: env names must be lowercase letters, numbers, and hyphens`);
   if (cfg.services !== void 0 && (!Array.isArray(cfg.services) || cfg.services.some((service) => typeof service !== "string" || !service.trim()))) {
     throw new Error(`${path}: services must be an array of non-empty names`);
   }
+  validateIntegrations(cfg, path, DEFAULT_SERVICES);
 }
 function validateCalendarConfig(cfg, envs, services, path) {
   const enabled = services.includes("calendar");
@@ -1006,28 +1147,47 @@ function validateCalendarConfig(cfg, envs, services, path) {
     if (enabled) throw new Error(`${path}: calendar.google is required when services includes "calendar"`);
     return;
   }
-  if (!isRecord4(cfg.calendar)) throw new Error(`${path}: calendar must be an object`);
+  if (!isRecord5(cfg.calendar)) throw new Error(`${path}: calendar must be an object`);
   assertOnly(cfg.calendar, ["google"], `${path}: calendar`);
-  if (!isRecord4(cfg.calendar.google)) throw new Error(`${path}: calendar.google must be an object`);
+  if (!isRecord5(cfg.calendar.google)) throw new Error(`${path}: calendar.google must be an object`);
   const google = cfg.calendar.google;
-  assertOnly(google, ["calendars", "bookingPageUrl", "match", "attendeePolicy"], `${path}: calendar.google`);
-  if (!isRecord4(google.calendars)) throw new Error(`${path}: calendar.google.calendars must map env names to calendar ids`);
-  const unknownEnv = Object.keys(google.calendars).find((env) => !envs.includes(env));
-  if (unknownEnv) throw new Error(`${path}: calendar.google.calendars.${unknownEnv} is not in config envs`);
+  assertOnly(
+    google,
+    ["availabilityCalendars", "calendars", "bookingCalendar", "bookingPageUrl"],
+    `${path}: calendar.google`
+  );
+  const availabilityKey = google.availabilityCalendars !== void 0 ? "availabilityCalendars" : google.calendars !== void 0 ? "calendars" : null;
+  if (!availabilityKey || google.availabilityCalendars !== void 0 && google.calendars !== void 0) {
+    throw new Error(`${path}: calendar.google requires exactly one of availabilityCalendars or calendars (legacy)`);
+  }
+  const availability = google[availabilityKey];
+  if (!isRecord5(availability)) throw new Error(`${path}: calendar.google.${availabilityKey} must map env names to calendar ids`);
+  const unknownEnv = Object.keys(availability).find((env) => !envs.includes(env));
+  if (unknownEnv) throw new Error(`${path}: calendar.google.${availabilityKey}.${unknownEnv} is not in config envs`);
   for (const env of envs) {
-    const ids = google.calendars[env];
+    const ids = availability[env];
     if (!Array.isArray(ids) || ids.length === 0) {
-      throw new Error(`${path}: calendar.google.calendars.${env} must be a non-empty array`);
+      throw new Error(`${path}: calendar.google.${availabilityKey}.${env} must be a non-empty array`);
     }
     if (ids.length > 10) {
-      throw new Error(`${path}: calendar.google.calendars.${env} must contain at most 10 calendar ids`);
+      throw new Error(`${path}: calendar.google.${availabilityKey}.${env} must contain at most 10 calendar ids`);
     }
-    if (ids.some((id) => !safeText(id, 1024))) {
-      throw new Error(`${path}: calendar.google.calendars.${env} contains an invalid calendar id`);
+    if (ids.some((id) => !safeText2(id, 1024))) {
+      throw new Error(`${path}: calendar.google.${availabilityKey}.${env} contains an invalid calendar id`);
+    }
+  }
+  if (google.bookingCalendar !== void 0) {
+    if (!isRecord5(google.bookingCalendar)) throw new Error(`${path}: calendar.google.bookingCalendar must map env names to one calendar id`);
+    const unknownBookingEnv = Object.keys(google.bookingCalendar).find((env) => !envs.includes(env));
+    if (unknownBookingEnv) throw new Error(`${path}: calendar.google.bookingCalendar.${unknownBookingEnv} is not in config envs`);
+    for (const [env, value] of Object.entries(google.bookingCalendar)) {
+      if (!safeText2(value, 1024)) {
+        throw new Error(`${path}: calendar.google.bookingCalendar.${env} must be a calendar id`);
+      }
     }
   }
   if (google.bookingPageUrl !== void 0) {
-    if (!isRecord4(google.bookingPageUrl)) throw new Error(`${path}: calendar.google.bookingPageUrl must map env names to HTTPS URLs or null`);
+    if (!isRecord5(google.bookingPageUrl)) throw new Error(`${path}: calendar.google.bookingPageUrl must map env names to HTTPS URLs or null`);
     const unknownBookingEnv = Object.keys(google.bookingPageUrl).find((env) => !envs.includes(env));
     if (unknownBookingEnv) throw new Error(`${path}: calendar.google.bookingPageUrl.${unknownBookingEnv} is not in config envs`);
     for (const [env, value] of Object.entries(google.bookingPageUrl)) {
@@ -1036,31 +1196,16 @@ function validateCalendarConfig(cfg, envs, services, path) {
       }
     }
   }
-  if (google.attendeePolicy !== void 0 && google.attendeePolicy !== "full" && google.attendeePolicy !== "hashed") {
-    throw new Error(`${path}: calendar.google.attendeePolicy must be "full" or "hashed"`);
-  }
-  if (google.match !== void 0) {
-    if (!isRecord4(google.match)) throw new Error(`${path}: calendar.google.match must be an object`);
-    assertOnly(google.match, ["summaryPrefix", "organizerSelf", "requireAttendees"], `${path}: calendar.google.match`);
-    if (google.match.summaryPrefix !== void 0 && !safeText(google.match.summaryPrefix, 256)) {
-      throw new Error(`${path}: calendar.google.match.summaryPrefix must be 1-256 printable characters`);
-    }
-    for (const name of ["organizerSelf", "requireAttendees"]) {
-      if (google.match[name] !== void 0 && typeof google.match[name] !== "boolean") {
-        throw new Error(`${path}: calendar.google.match.${name} must be boolean`);
-      }
-    }
-  }
   if (enabled && !services.includes("db")) throw new Error(`${path}: calendar service requires the db service`);
 }
 function assertOnly(value, allowed, label) {
   const extra = Object.keys(value).find((key) => !allowed.includes(key));
   if (extra) throw new Error(`${label}.${extra} is not supported`);
 }
-function isRecord4(value) {
+function isRecord5(value) {
   return value !== null && typeof value === "object" && !Array.isArray(value);
 }
-function safeText(value, max) {
+function safeText2(value, max) {
   return typeof value === "string" && value.trim().length > 0 && value.length <= max && !/[\u0000-\u001f\u007f]/.test(value);
 }
 function safeHttpsUrl(value) {
@@ -1072,11 +1217,11 @@ function safeHttpsUrl(value) {
     return false;
   }
 }
-function validId(value) {
+function validId2(value) {
   return typeof value === "string" && /^[a-z0-9][a-z0-9-]*$/.test(value);
 }
 async function loadConfigModule(path) {
-  if (path.endsWith(".json")) return JSON.parse((0, import_node_fs3.readFileSync)(path, "utf8"));
+  if (path.endsWith(".json")) return JSON.parse((0, import_node_fs4.readFileSync)(path, "utf8"));
   const mod = await import(`${(0, import_node_url.pathToFileURL)(path).href}?t=${Date.now()}`);
   const value = mod.default ?? mod.config;
   if (typeof value === "function") return await value();
@@ -1085,14 +1230,191 @@ async function loadConfigModule(path) {
 function trimSlash(value) {
   return value.replace(/\/+$/, "");
 }
-function unique(values) {
+function unique2(values) {
   return [...new Set(values.filter(Boolean))];
 }
 
+// src/app-export.ts
+async function appExport(options) {
+  const cfg = await loadProjectConfig(options.configPath);
+  const out = options.stdout ?? console;
+  const doFetch = options.fetch ?? fetch;
+  const env = options.env ?? (cfg.envs.includes("dev") ? "dev" : cfg.envs[0]);
+  if (!env || !cfg.envs.includes(env)) throw new Error(`env "${env ?? ""}" is not declared in ${options.configPath}`);
+  const tenant = env === "prod" ? cfg.app.id : `${cfg.app.id}--${env}`;
+  const token = await getDeveloperToken(
+    cfg,
+    { configPath: cfg.configPath, token: options.token, email: options.email, open: false },
+    doFetch,
+    out
+  );
+  const auth = { authorization: `Bearer ${token}` };
+  const base = `${cfg.dbEndpoint}/admin/apps/${encodeURIComponent(tenant)}`;
+  if (options.fresh) {
+    const res = await doFetch(`${base}/export`, { method: "POST", headers: auth });
+    const body = await res.json().catch(() => ({}));
+    if (!res.ok) throw new Error(`export failed${body.error?.code ? ` (${body.error.code})` : ""}: ${body.error?.message ?? res.status}`);
+  }
+  const list = await doFetch(`${base}/backups`, { headers: auth });
+  if (!list.ok) throw new Error(`couldn't list backups (${list.status})`);
+  const { backups } = await list.json();
+  const newest = backups[0];
+  if (!newest) {
+    throw new Error(
+      `${tenant} has no backups yet \u2014 run \`odla-ai app export --fresh\` to take one now (nightly snapshots appear after the first day with writes)`
+    );
+  }
+  const download = await doFetch(`${base}/backups/${newest.id}/download`, { headers: auth });
+  if (!download.ok || !download.body) throw new Error(`download failed (${download.status})`);
+  const file = options.out ?? `${tenant}-${new Date(newest.created_at).toISOString().slice(0, 10)}-tx${newest.max_tx}.jsonl.gz`;
+  await (0, import_promises.pipeline)(import_node_stream.Readable.fromWeb(download.body), (0, import_node_fs5.createWriteStream)(file));
+  if (options.json) out.log(JSON.stringify({ file, backup: newest }, null, 2));
+  else {
+    out.log(`${tenant}: wrote ${file} (${newest.bytes} bytes, ${newest.kind} snapshot at tx ${newest.max_tx})`);
+    out.log(`sha256 ${download.headers.get("x-odla-sha256") ?? newest.sha256}`);
+  }
+  return { file, backup: newest };
+}
+
+// src/app-lifecycle.ts
+async function lifecycleCall(action, options) {
+  const cfg = await loadProjectConfig(options.configPath);
+  const out = options.stdout ?? console;
+  const doFetch = options.fetch ?? fetch;
+  const token = await getDeveloperToken(
+    cfg,
+    { configPath: cfg.configPath, token: options.token, email: options.email, open: false },
+    doFetch,
+    out
+  );
+  const res = await doFetch(`${cfg.platformUrl}/registry/apps/${encodeURIComponent(cfg.app.id)}/${action}`, {
+    method: "POST",
+    headers: { authorization: `Bearer ${token}`, "content-type": "application/json" }
+  });
+  const body = await res.json().catch(() => ({}));
+  if (!res.ok || !body.ok) {
+    throw new Error(`${action} failed${body.error?.code ? ` (${body.error.code})` : ""}: ${body.error?.message ?? `registry returned ${res.status}`}`);
+  }
+  return body;
+}
+async function appArchive(options) {
+  if (options.yes !== true) {
+    throw new Error(
+      "app archive suspends EVERY environment: API keys stop working and all services refuse requests until restored. All data is retained. Pass --yes to proceed."
+    );
+  }
+  const out = options.stdout ?? console;
+  const body = await lifecycleCall("archive", options);
+  if (options.json) out.log(JSON.stringify(body, null, 2));
+  else if (body.operation?.state === "noop") out.log(`${body.app?.appId}: already archived`);
+  else out.log(`${body.app?.appId}: archived \u2014 data retained; run \`odla-ai app restore\` (or use Studio) to bring it back`);
+}
+async function appRestore(options) {
+  const out = options.stdout ?? console;
+  const body = await lifecycleCall("restore", options);
+  if (options.json) out.log(JSON.stringify(body, null, 2));
+  else if (body.operation?.state === "noop") out.log(`${body.app?.appId}: already active`);
+  else out.log(`${body.app?.appId}: restored \u2014 every service's data plane is live again`);
+}
+async function appCommand(parsed, dependencies = {}) {
+  const sub = parsed.positionals[1];
+  if (sub === "export") {
+    assertArgs(parsed, ["config", "env", "token", "email", "fresh", "out", "json"], 2);
+    await appExport({
+      configPath: stringOpt(parsed.options.config) ?? "odla.config.mjs",
+      env: stringOpt(parsed.options.env),
+      token: stringOpt(parsed.options.token),
+      email: stringOpt(parsed.options.email),
+      fresh: parsed.options.fresh === true,
+      out: stringOpt(parsed.options.out),
+      json: parsed.options.json === true,
+      fetch: dependencies.fetch,
+      stdout: dependencies.stdout
+    });
+    return;
+  }
+  if (sub !== "archive" && sub !== "restore") {
+    throw new Error(
+      `unknown app subcommand "${sub ?? ""}". Try "odla-ai app archive --yes", "odla-ai app restore", or "odla-ai app export". (Permanent deletion has no CLI: it requires a signed-in owner in Studio.)`
+    );
+  }
+  assertArgs(parsed, ["config", "token", "email", "yes", "json"], 2);
+  const options = {
+    configPath: stringOpt(parsed.options.config) ?? "odla.config.mjs",
+    token: stringOpt(parsed.options.token),
+    email: stringOpt(parsed.options.email),
+    yes: parsed.options.yes === true,
+    json: parsed.options.json === true,
+    fetch: dependencies.fetch,
+    stdout: dependencies.stdout
+  };
+  if (sub === "archive") await appArchive(options);
+  else await appRestore(options);
+}
+
+// src/capabilities.ts
+var CAPABILITIES = {
+  cli: [
+    "start an email-bound device request without accepting a password or user session token",
+    "register the app and enable configured services per environment",
+    "issue, persist, and explicitly rotate configured service credentials",
+    "write local Worker values and push deployed Worker secrets through Wrangler stdin",
+    "store tenant-vault secrets (including the Clerk webhook secret and reserved Clerk secret key) write-only from stdin or an env var",
+    "compose declared app-capability schema/rules, create guarded seeds when absent, and configure platform AI, auth, and deployment links",
+    "apply Google Calendar booking config, then drive state-bound consent, status, discovery, and disconnect flows (bookings run live through the platform proxy)",
+    "validate integration contracts offline and smoke-test a provisioned db environment plus anonymous capability routes",
+    "run app-attributed hosted security discovery and independent validation without provider keys",
+    "connect/revoke source-read-only GitHub sources and drive commit-pinned hosted security jobs without PATs or provider keys",
+    "let admins manage system AI policy and credentials, inspect attributed usage, and read immutable admin changes through separate short-lived capability-only approvals"
+  ],
+  agent: [
+    "install and import the selected odla SDKs",
+    "wrap the Worker with withObservability and choose useful telemetry",
+    "install capability packages, mount their runtime routes, and make application-specific schema, rules, auth, UI, and migration decisions",
+    "wire @odla-ai/calendar into trusted Worker code and keep the app admin key out of browsers"
+  ],
+  human: [
+    "provide the existing odla account email, then sign in and explicitly review/approve the exact device code",
+    "review mirrored calendar/attendee disclosure and complete the server-issued Google consent flow",
+    "consent to production changes with --yes",
+    "request destructive credential rotation explicitly",
+    "review application semantics, security findings, releases, and merges",
+    "approve redacted-source disclosure before hosted security reasoning",
+    "approve GitHub App repository access separately from redacted-snippet disclosure"
+  ],
+  studio: [
+    "view telemetry and environment state",
+    "let signed-in users inventory/revoke their own agent grants and admins audit/global-revoke them",
+    "review calendar connection, granted read scope, selected calendars, and sync health without exposing provider tokens",
+    "perform manual credential recovery when the CLI's local shown-once copy is unavailable",
+    "configure system AI purposes and view app/environment/run-attributed usage",
+    "connect/revoke GitHub security sources and inspect ref-to-SHA jobs, routes, retention, coverage, and normalized reports"
+  ]
+};
+function printCapabilities(json = false, out = console) {
+  if (json) {
+    out.log(JSON.stringify(CAPABILITIES, null, 2));
+    return;
+  }
+  out.log("odla-ai responsibility boundary\n");
+  printGroup(out, "CLI automates", CAPABILITIES.cli);
+  printGroup(out, "Coding agent changes source", CAPABILITIES.agent);
+  printGroup(out, "Human checkpoints", CAPABILITIES.human);
+  printGroup(out, "Studio", CAPABILITIES.studio);
+}
+function printGroup(out, heading, items) {
+  out.log(`${heading}:`);
+  for (const item of items) out.log(`  - ${item}`);
+  out.log("");
+}
+
 // src/calendar-errors.ts
 var PLATFORM_NOT_READY_CODES = /* @__PURE__ */ new Set([
   "calendar_google_oauth_not_configured",
   "calendar_token_vault_not_configured",
+  // Current spelling (booking-era key verifier) plus the retired mirror-era
+  // ingress code, so the CLI stays resumable against either platform version.
+  "calendar_db_verifier_not_configured",
   "calendar_db_ingress_not_configured"
 ]);
 var CalendarRequestError = class extends Error {
@@ -1134,8 +1456,6 @@ function looksSecret(value) {
 var CALENDAR_STATES = [
   "not_connected",
   "authorizing",
-  "needs_sync",
-  "initial_sync",
   "healthy",
   "degraded",
   "disconnected",
@@ -1183,9 +1503,6 @@ async function pollCalendarConnection(ctx, attemptId) {
     ctx.env
   );
 }
-async function requestCalendarResync(ctx) {
-  return parseCalendarStatus(await calendarJson(ctx, "/resync", { method: "POST", body: "{}" }), ctx.env);
-}
 async function requestCalendarDisconnect(ctx) {
   return parseCalendarStatus(
     await calendarJson(ctx, "/disconnect", { method: "POST", body: JSON.stringify({ purge: false }) }),
@@ -1196,10 +1513,8 @@ function parseCalendarStatus(raw, env) {
   const outer = wrapped(raw, "calendar");
   const value = record(outer.attempt) ?? record(outer.status) ?? outer;
   const connection = record(value.connection) ?? {};
-  const sync = record(value.sync) ?? record(connection.sync) ?? {};
   const config = record(value.config) ?? record(outer.config) ?? {};
   const googleConfig = record(config.google) ?? config;
-  const watches = record(value.watches) ?? {};
   const stateValue = calendarState(value.status ?? value.state ?? connection.status ?? connection.state);
   if (!stateValue) {
     throw new Error("calendar status returned an invalid connection state");
@@ -1209,31 +1524,29 @@ function parseCalendarStatus(raw, env) {
     throw new Error("calendar status returned an unsupported provider");
   }
   const accessValue = value.access ?? connection.access ?? config.access ?? googleConfig.access;
-  if (accessValue !== void 0 && accessValue !== "read") throw new Error("calendar status returned unsupported access");
-  const policyValue = value.attendeePolicy ?? config.attendeePolicy ?? googleConfig.attendeePolicy;
-  if (policyValue !== void 0 && policyValue !== "full" && policyValue !== "hashed") {
-    throw new Error("calendar status returned an invalid attendee policy");
+  if (accessValue !== void 0 && accessValue !== "book" && accessValue !== "read") {
+    throw new Error("calendar status returned unsupported access");
   }
   const errorValue = record(value.error) ?? record(connection.error);
   const errorCode = textField(value.lastErrorCode, 128);
   const bookingPageValue = Object.hasOwn(value, "bookingPageUrl") ? value.bookingPageUrl : Object.hasOwn(config, "bookingPageUrl") ? config.bookingPageUrl : googleConfig.bookingPageUrl;
+  const connected = typeof (value.connected ?? connection.connected) === "boolean" ? Boolean(value.connected ?? connection.connected) : ["healthy", "degraded"].includes(stateValue);
+  const bookingCalendarId = textField(value.bookingCalendarId ?? config.bookingCalendarId, 1024);
   return {
     env,
     enabled: typeof value.enabled === "boolean" ? value.enabled : true,
-    connected: typeof (value.connected ?? connection.connected) === "boolean" ? Boolean(value.connected ?? connection.connected) : ["needs_sync", "initial_sync", "healthy", "degraded"].includes(stateValue),
+    connected,
+    writable: typeof value.writable === "boolean" ? value.writable : stateValue === "healthy",
     provider: providerValue === "google" ? "google" : null,
     status: stateValue,
-    ...accessValue === "read" ? { access: "read" } : {},
-    calendars: calendarIds(value.configuredCalendars ?? value.calendars ?? config.calendars ?? googleConfig.calendars),
-    ...policyValue === "full" || policyValue === "hashed" ? { attendeePolicy: policyValue } : {},
-    ...typeof value.attendeePolicyLocked === "boolean" ? { attendeePolicyLocked: value.attendeePolicyLocked } : {},
+    ...accessValue !== void 0 ? { access: "book" } : {},
+    ...bookingCalendarId ? { bookingCalendarId } : {},
+    calendars: calendarIds(
+      value.availabilityCalendars ?? config.availabilityCalendars ?? value.configuredCalendars ?? value.calendars ?? config.calendars ?? googleConfig.calendars
+    ),
     ...optionalNullableUrl("bookingPageUrl", bookingPageValue),
     grantedScopes: stringList(value.grantedScopes ?? connection.grantedScopes ?? connection.scopes),
     ...optionalText("attemptId", value.attemptId ?? connection.attemptId, 180),
-    ...optionalNumber("lastSuccessfulSyncAt", value.lastSuccessfulSyncAt ?? sync.lastSuccessfulSyncAt),
-    ...optionalNumber("lastFullSyncAt", value.lastFullSyncAt ?? sync.lastFullSyncAt),
-    ...optionalNumber("watchExpiresAt", value.watchExpiresAt ?? sync.watchExpiresAt ?? watches.nextExpirationAt),
-    ...optionalInteger("bookingCount", value.bookingCount ?? sync.bookingCount),
     ...errorValue || errorCode ? { error: {
       ...textField(errorValue?.code, 128) ? { code: textField(errorValue?.code, 128) } : {},
       ...textField(errorValue?.message, 500) ? { message: textField(errorValue?.message, 500) } : {},
@@ -1248,7 +1561,9 @@ function calendarState(value) {
     disabled: "not_connected",
     disconnected: "disconnected",
     connecting: "authorizing",
-    syncing: "initial_sync",
+    syncing: "healthy",
+    needs_sync: "healthy",
+    initial_sync: "healthy",
     ready: "healthy",
     error: "failed"
   };
@@ -1316,13 +1631,6 @@ function optionalText(key, value, max) {
   const parsed = textField(value, max);
   return parsed ? { [key]: parsed } : {};
 }
-function optionalNumber(key, value) {
-  const parsed = timestamp3(value);
-  return parsed === void 0 ? {} : { [key]: parsed };
-}
-function optionalInteger(key, value) {
-  return Number.isSafeInteger(value) && value >= 0 ? { [key]: value } : {};
-}
 function optionalNullableUrl(key, value) {
   if (value === null) return { [key]: null };
   const parsed = textField(value, 4096);
@@ -1374,7 +1682,7 @@ async function calendarConnect(options) {
   const page = calendarBookingPageUrl(cfg, ctx.env);
   const applied = page === void 0 ? await readCalendarStatus(ctx) : await applyCalendarSettings(ctx, page);
   const connectOptions = connectionOptions(options, out);
-  return await continueConnectedCalendar(ctx, applied, connectOptions, false) ?? connectWithContext(ctx, connectOptions);
+  return await continueConnectedCalendar(ctx, applied, connectOptions) ?? connectWithContext(ctx, connectOptions);
 }
 async function applyCalendarBookingPage(ctx, bookingPageUrl, out) {
   if (bookingPageUrl === void 0) return null;
@@ -1382,25 +1690,18 @@ async function applyCalendarBookingPage(ctx, bookingPageUrl, out) {
   out.log(`${ctx.env}: calendar booking page ${bookingPageUrl ? "set" : "cleared"}`);
   return status;
 }
-async function calendarResync(options) {
-  const { ctx, out } = await lifecycleContext(options);
-  productionConsent(ctx.env, options.yes, "resync calendar");
-  const status = await requestCalendarResync(ctx);
-  out.log(`${ctx.env}: calendar resync requested (${status.status})`);
-  return status;
-}
 async function calendarDisconnect(options) {
   if (!options.yes) throw new Error("calendar disconnect requires --yes");
   const { ctx, out } = await lifecycleContext(options);
   const status = await requestCalendarDisconnect(ctx);
-  out.log(`${ctx.env}: calendar disconnected; retained mirror rows may now be stale`);
+  out.log(`${ctx.env}: calendar disconnected; no calendar data was stored`);
   return status;
 }
 async function ensureCalendarConnected(ctx, options) {
   const out = options.stdout ?? console;
   const current = await readCalendarStatus(ctx);
   const connectOptions = connectionOptions(options, out);
-  return await continueConnectedCalendar(ctx, current, connectOptions, true) ?? connectWithContext(ctx, connectOptions);
+  return await continueConnectedCalendar(ctx, current, connectOptions) ?? connectWithContext(ctx, connectOptions);
 }
 async function lifecycleContext(options) {
   const cfg = await loadProjectConfig(options.configPath);
@@ -1436,25 +1737,20 @@ function connectionOptions(options, out) {
     signal: options.signal
   };
 }
-async function continueConnectedCalendar(ctx, current, options, reuseDegraded) {
-  if (current.status === "healthy" || reuseDegraded && current.status === "degraded") {
-    options.out.log(`${ctx.env}: calendar ${reuseDegraded ? "connected" : "already connected"} (${current.status})`);
+async function continueConnectedCalendar(ctx, current, options) {
+  if (current.status === "healthy") {
+    options.out.log(`${ctx.env}: calendar already connected (healthy)`);
     return current;
   }
-  if (current.status === "degraded") return null;
-  if (current.status === "needs_sync") {
-    if (!current.connected) return null;
-    options.out.log(`${ctx.env}: calendar configuration needs sync`);
-    const synced = await requestCalendarResync(ctx);
-    options.out.log(`${ctx.env}: calendar ${synced.status.replaceAll("_", " ")}`);
-    return synced;
+  if (current.status === "degraded") {
+    options.out.log(`${ctx.env}: calendar grant predates booking scopes \u2014 Google re-consent required`);
+    return null;
   }
   if (current.status === "failed" && current.connected) {
     const reason = current.error?.message ?? current.error?.code;
-    throw new Error(`calendar connection failed${reason ? `: ${reason}` : ""}; inspect status and resync or reconnect explicitly`);
+    throw new Error(`calendar connection failed${reason ? `: ${reason}` : ""}; inspect status and reconnect explicitly`);
   }
-  const waitingForExisting = current.status === "authorizing" || current.status === "initial_sync" && current.connected;
-  if (!waitingForExisting) return null;
+  if (current.status !== "authorizing") return null;
   const now = options.now ?? Date.now;
   const deadline = now() + pollTimeout(options.pollTimeoutMs);
   const wait = options.wait ?? waitForCalendarPoll;
@@ -1466,17 +1762,16 @@ async function continueConnectedCalendar(ctx, current, options, reuseDegraded) {
       options.out.log(`${ctx.env}: calendar ${status.status.replaceAll("_", " ")}`);
       prior = status.status;
     }
-    if (status.status === "healthy" || reuseDegraded && status.status === "degraded") return status;
+    if (status.status === "healthy") return status;
     if (status.status === "degraded") return null;
-    if (status.status === "needs_sync") return requestCalendarResync(ctx);
     if (status.status === "failed" && status.connected) {
       const reason = status.error?.message ?? status.error?.code;
-      throw new Error(`calendar connection failed${reason ? `: ${reason}` : ""}; inspect status and resync or reconnect explicitly`);
+      throw new Error(`calendar connection failed${reason ? `: ${reason}` : ""}; inspect status and reconnect explicitly`);
     }
-    if (status.status !== "authorizing" && (status.status !== "initial_sync" || !status.connected)) return null;
+    if (status.status !== "authorizing") return null;
     await wait(Math.min(2e3, Math.max(0, deadline - now())), options.signal);
   }
-  throw new Error('Existing Google Calendar authorization or initial sync timed out; run "odla-ai calendar status" and retry');
+  throw new Error('Existing Google Calendar authorization timed out; run "odla-ai calendar status" and retry');
 }
 async function connectWithContext(ctx, options) {
   const attempt = await startCalendarConnection(ctx);
@@ -1498,14 +1793,17 @@ async function connectWithContext(ctx, options) {
       options.out.log(`${ctx.env}: calendar ${status.status.replaceAll("_", " ")}`);
       prior = status.status;
     }
-    if (status.status === "healthy" || status.status === "degraded") return status;
+    if (status.status === "healthy") return status;
+    if (status.status === "degraded") {
+      throw new Error("calendar connected without booking scopes; re-run connect and grant calendar access");
+    }
     if (status.status === "failed" || status.status === "disconnected" || status.status === "not_connected") {
       const reason = status.error?.message ?? status.error?.code;
       throw new Error(`calendar connection ${status.status}${reason ? `: ${reason}` : ""}`);
     }
     await wait(Math.min(2e3, Math.max(0, deadline - now())), options.signal);
   }
-  throw new Error('Google Calendar consent or initial sync timed out; run "odla-ai calendar status" and retry connect');
+  throw new Error('Google Calendar consent timed out; run "odla-ai calendar status" and retry connect');
 }
 function trustedCalendarConsentUrl(platform, value) {
   const origin = platformAudience(platform);
@@ -1535,26 +1833,22 @@ function printStatus(status, json, out) {
     return;
   }
   out.log(`calendar: ${status.provider ?? "none"}/${status.status} (${status.env})`);
-  out.log(`  access: ${status.access ?? "not granted"}`);
-  out.log(`  calendars: ${status.calendars.length ? status.calendars.join(", ") : "none"}`);
-  if (status.attendeePolicy) {
-    out.log(`  attendee policy: ${status.attendeePolicy}${status.attendeePolicyLocked ? " (locked)" : ""}`);
-  }
+  out.log(`  bookable: ${status.writable ? "yes" : status.connected ? "no \u2014 reconnect to grant booking scopes" : "no \u2014 not connected"}`);
+  if (status.bookingCalendarId) out.log(`  booking calendar: ${status.bookingCalendarId}`);
+  out.log(`  availability calendars: ${status.calendars.length ? status.calendars.join(", ") : "none"}`);
   if (status.bookingPageUrl !== void 0) out.log(`  booking page: ${status.bookingPageUrl ?? "not configured"}`);
-  out.log(`  last sync: ${status.lastSuccessfulSyncAt === void 0 ? "never" : new Date(status.lastSuccessfulSyncAt).toISOString()}`);
-  if (status.bookingCount !== void 0) out.log(`  bookings: ${status.bookingCount}`);
   if (status.error?.code || status.error?.message) out.log(`  error: ${status.error.code ?? "error"}${status.error.message ? ` \u2014 ${status.error.message}` : ""}`);
 }
 
 // src/doctor-checks.ts
 var import_node_child_process3 = require("child_process");
-var import_node_fs5 = require("fs");
-var import_node_path4 = require("path");
+var import_node_fs7 = require("fs");
+var import_node_path5 = require("path");
 
 // src/wrangler.ts
 var import_node_child_process2 = require("child_process");
-var import_node_fs4 = require("fs");
-var import_node_path3 = require("path");
+var import_node_fs6 = require("fs");
+var import_node_path4 = require("path");
 var defaultRunner = (cmd, args, opts) => new Promise((resolvePromise, reject) => {
   const child = (0, import_node_child_process2.spawn)(cmd, args, { cwd: opts?.cwd, stdio: ["pipe", "pipe", "pipe"] });
   let stdout = "";
@@ -1568,15 +1862,15 @@ var defaultRunner = (cmd, args, opts) => new Promise((resolvePromise, reject) =>
 var WRANGLER_CONFIG_FILES = ["wrangler.jsonc", "wrangler.json", "wrangler.toml"];
 function findWranglerConfig(rootDir) {
   for (const name of WRANGLER_CONFIG_FILES) {
-    const path = (0, import_node_path3.join)(rootDir, name);
-    if ((0, import_node_fs4.existsSync)(path)) return path;
+    const path = (0, import_node_path4.join)(rootDir, name);
+    if ((0, import_node_fs6.existsSync)(path)) return path;
   }
   return null;
 }
 function readWranglerConfig(path) {
   if (path.endsWith(".toml")) return null;
   try {
-    return JSON.parse(stripJsonComments((0, import_node_fs4.readFileSync)(path, "utf8")));
+    return JSON.parse(stripJsonComments((0, import_node_fs6.readFileSync)(path, "utf8")));
   } catch {
     return null;
   }
@@ -1674,10 +1968,10 @@ function wranglerWarnings(rootDir) {
   for (const { label, block } of blocks) {
     const assets = block.assets;
     if (assets?.directory) {
-      const dir = (0, import_node_path4.resolve)(rootDir, assets.directory);
-      if (dir === (0, import_node_path4.resolve)(rootDir)) {
+      const dir = (0, import_node_path5.resolve)(rootDir, assets.directory);
+      if (dir === (0, import_node_path5.resolve)(rootDir)) {
         warnings.push(`${label}assets.directory is the project root \u2014 point it at a dedicated build dir (wrangler dev fails with "spawn EBADF")`);
-      } else if ((0, import_node_fs5.existsSync)((0, import_node_path4.join)(dir, "node_modules"))) {
+      } else if ((0, import_node_fs7.existsSync)((0, import_node_path5.join)(dir, "node_modules"))) {
         warnings.push(`${label}assets.directory contains node_modules \u2014 wrangler dev's watcher will exhaust file descriptors`);
       }
     }
@@ -1712,13 +2006,13 @@ function o11yProjectWarnings(rootDir) {
     warnings.push("cannot verify o11y Worker instrumentation \u2014 add a parseable wrangler.jsonc/json config");
     return warnings;
   }
-  const main = typeof config.main === "string" ? (0, import_node_path4.resolve)(rootDir, config.main) : null;
-  if (!main || !(0, import_node_fs5.existsSync)(main)) {
+  const main = typeof config.main === "string" ? (0, import_node_path5.resolve)(rootDir, config.main) : null;
+  if (!main || !(0, import_node_fs7.existsSync)(main)) {
     warnings.push("cannot verify o11y Worker instrumentation \u2014 wrangler main is missing or unreadable");
   } else {
     let source = "";
     try {
-      source = (0, import_node_fs5.readFileSync)(main, "utf8");
+      source = (0, import_node_fs7.readFileSync)(main, "utf8");
     } catch {
     }
     if (!/\bwithObservability\b/.test(source)) {
@@ -1742,32 +2036,136 @@ function calendarProjectWarnings(rootDir) {
 }
 function readPackageJson(rootDir) {
   try {
-    return JSON.parse((0, import_node_fs5.readFileSync)((0, import_node_path4.join)(rootDir, "package.json"), "utf8"));
+    return JSON.parse((0, import_node_fs7.readFileSync)((0, import_node_path5.join)(rootDir, "package.json"), "utf8"));
   } catch {
     return null;
   }
 }
 
+// src/integrations.ts
+var import_node_util = require("util");
+async function resolveDatabaseConfig(cfg, options = {}) {
+  const integrations = cfg.integrations ?? [];
+  if (!cfg.services.includes("db")) return { schema: void 0, rules: void 0, integrations };
+  const authoredSchema = await resolveDataExport(cfg, cfg.db?.schema, ["schema", "SCHEMA"]);
+  const schema = mergeSchemas(authoredSchema, integrations);
+  if (options.validateSeeds !== false) assertSeedContracts(integrations, schema);
+  const configuredRules = await resolveDataExport(cfg, cfg.db?.rules, ["rules", "RULES"]);
+  const explicitRules = mergeRules(configuredRules, integrations);
+  const rules = configuredRules === void 0 && schema && cfg.db?.defaultRules !== false ? { ...rulesFromSchema(schema), ...explicitRules ?? {} } : explicitRules;
+  return { schema, rules, integrations };
+}
+function integrationWarnings(integrations, schema, rules) {
+  const warnings = [];
+  const entities = new Set(serializedEntities(schema));
+  for (const integration of integrations) {
+    const namespaces = Object.keys(integration.schema?.entities ?? {});
+    for (const ns of namespaces) {
+      if (!entities.has(ns)) warnings.push(`integration "${integration.id}" schema namespace "${ns}" is missing`);
+      const rule = rules?.[ns];
+      if (!rule) {
+        warnings.push(`integration "${integration.id}" has no rules for "${ns}"`);
+        continue;
+      }
+      for (const action of ["view", "create", "update", "delete"]) {
+        if (rule[action] === void 0) warnings.push(`integration "${integration.id}" rule "${ns}.${action}" is missing`);
+      }
+    }
+    for (const seed of integration.seeds ?? []) {
+      if (!entities.has(seed.ns)) {
+        warnings.push(`integration "${integration.id}" seed "${seed.id}" targets unknown namespace "${seed.ns}"`);
+      } else if (!isUniqueAttr(schema, seed.ns, seed.key.attr)) {
+        warnings.push(`integration "${integration.id}" seed "${seed.id}" key "${seed.ns}.${seed.key.attr}" is not declared unique`);
+      }
+    }
+  }
+  return warnings;
+}
+function mergeSchemas(base, integrations) {
+  const fragments = integrations.filter((integration) => integration.schema);
+  if (fragments.length === 0) return base;
+  const merged = normalizeSchema(base);
+  for (const integration of fragments) {
+    const fragment = normalizeSchema(integration.schema);
+    mergeMap(merged.entities, fragment.entities, `integration "${integration.id}" schema namespace`);
+    mergeMap(merged.links, fragment.links, `integration "${integration.id}" schema link`);
+  }
+  return merged;
+}
+function mergeRules(base, integrations) {
+  const fragments = integrations.filter((integration) => integration.rules);
+  if (fragments.length === 0) return base;
+  const merged = { ...base ?? {} };
+  for (const integration of fragments) {
+    mergeMap(merged, integration.rules ?? {}, `integration "${integration.id}" rule namespace`);
+  }
+  return merged;
+}
+function assertSeedContracts(integrations, schema) {
+  const entities = new Set(serializedEntities(schema));
+  for (const integration of integrations) {
+    for (const seed of integration.seeds ?? []) {
+      if (!entities.has(seed.ns)) {
+        throw new Error(`integration "${integration.id}" seed "${seed.id}" targets unknown namespace "${seed.ns}"`);
+      }
+      if (!isUniqueAttr(schema, seed.ns, seed.key.attr)) {
+        throw new Error(`integration "${integration.id}" seed "${seed.id}" key "${seed.ns}.${seed.key.attr}" must be declared unique`);
+      }
+    }
+  }
+}
+function isUniqueAttr(schema, ns, attr) {
+  if (!isRecord6(schema) || !isRecord6(schema.entities)) return false;
+  const entity = schema.entities[ns];
+  if (!isRecord6(entity) || !isRecord6(entity.attrs)) return false;
+  const definition = entity.attrs[attr];
+  return isRecord6(definition) && definition.unique === true;
+}
+function normalizeSchema(value) {
+  if (value === void 0 || value === null) return { entities: {}, links: {} };
+  if (!isRecord6(value) || !isRecord6(value.entities)) {
+    throw new Error("db schema must be a serialized schema object with an entities map");
+  }
+  if (value.links !== void 0 && !isRecord6(value.links)) throw new Error("db schema links must be an object");
+  return {
+    entities: { ...value.entities },
+    links: { ...value.links ?? {} }
+  };
+}
+function mergeMap(target, fragment, label) {
+  for (const [name, value] of Object.entries(fragment)) {
+    if (Object.hasOwn(target, name) && !(0, import_node_util.isDeepStrictEqual)(target[name], value)) {
+      throw new Error(`${label} "${name}" conflicts with an existing definition`);
+    }
+    target[name] = value;
+  }
+}
+function isRecord6(value) {
+  return value !== null && typeof value === "object" && !Array.isArray(value);
+}
+
 // src/doctor.ts
 async function doctor(options) {
   const out = options.stdout ?? console;
   const cfg = await loadProjectConfig(options.configPath);
   const plan = buildPlan(cfg);
-  const hasDb = cfg.services.includes("db");
-  const schema = hasDb ? await resolveDataExport(cfg, cfg.db?.schema, ["schema", "SCHEMA"]) : void 0;
-  const configuredRules = hasDb ? await resolveDataExport(cfg, cfg.db?.rules, ["rules", "RULES"]) : void 0;
-  const rules = configuredRules ?? (schema && cfg.db?.defaultRules !== false ? rulesFromSchema(schema) : void 0);
+  const database = await resolveDatabaseConfig(cfg, { validateSeeds: false });
+  const { schema, rules } = database;
   const entities = serializedEntities(schema);
   out.log(`config: ${cfg.configPath}`);
   out.log(`app:    ${plan.appName} (${plan.appId})`);
   out.log(`envs:   ${plan.envs.join(", ")}`);
   out.log(`svc:    ${plan.services.join(", ")}`);
+  out.log(`integrations: ${plan.integrations.length ? plan.integrations.join(", ") : "none"}`);
   out.log(`schema: ${schema ? `${entities.length} entities` : "none"}`);
   out.log(`rules:  ${rules ? `${Object.keys(rules).length} namespaces` : "none"}`);
   out.log(`ai:     ${cfg.services.includes("ai") ? cfg.ai?.provider ?? "not configured" : "not enabled"}`);
   if (cfg.services.includes("calendar")) {
-    const calendar = cfg.envs.map((env) => `${env}:${calendarServiceConfig(cfg, env).calendars.length}`).join(", ");
-    out.log(`calendar: google/read-only (${calendar}; attendee ${cfg.calendar?.google.attendeePolicy ?? "full"})`);
+    const calendar = cfg.envs.map((env) => {
+      const resolved = calendarServiceConfig(cfg, env);
+      return `${env}:${resolved.bookingCalendarId}+${resolved.availabilityCalendars.length}`;
+    }).join(", ");
+    out.log(`calendar: google/booking (${calendar})`);
     const pages = cfg.envs.map((env) => `${env}:${calendarBookingPageUrl(cfg, env) ?? "none"}`).join(", ");
     out.log(`booking pages: ${pages}`);
   } else {
@@ -1780,6 +2178,7 @@ async function doctor(options) {
       if (entities.length > 0 && !entities.includes(ns)) warnings.push(`rules include "${ns}" but schema has no matching entity`);
     }
   }
+  warnings.push(...integrationWarnings(database.integrations, schema, rules));
   if (cfg.services.includes("ai") && !cfg.ai?.provider) warnings.push("ai service is enabled but ai.provider is not set");
   if (cfg.auth?.clerk) {
     for (const [env, value] of Object.entries(cfg.auth.clerk)) {
@@ -1819,9 +2218,9 @@ async function doctor(options) {
 }
 
 // src/help.ts
-var import_node_fs6 = require("fs");
+var import_node_fs8 = require("fs");
 function cliVersion() {
-  const pkg = JSON.parse((0, import_node_fs6.readFileSync)(new URL("../package.json", importMetaUrl), "utf8"));
+  const pkg = JSON.parse((0, import_node_fs8.readFileSync)(new URL("../package.json", importMetaUrl), "utf8"));
   return pkg.version ?? "unknown";
 }
 function printHelp() {
@@ -1834,8 +2233,10 @@ Usage:
   odla-ai calendar status [--env dev] [--email <odla-account>] [--json]
   odla-ai calendar calendars [--env dev] [--email <odla-account>] [--json]
   odla-ai calendar connect [--env dev] [--email <odla-account>] [--no-open] [--yes]
-  odla-ai calendar resync [--env dev] [--email <odla-account>] [--yes]
   odla-ai calendar disconnect [--env dev] [--email <odla-account>] --yes
+  odla-ai app archive [--config odla.config.mjs] [--email <odla-account>] [--json] --yes
+  odla-ai app restore [--config odla.config.mjs] [--email <odla-account>] [--json]
+  odla-ai app export [--env dev] [--fresh] [--out <file>] [--email <odla-account>] [--json]
   odla-ai capabilities [--json]
   odla-ai admin ai show [--platform https://odla.ai] [--email <odla-account>] [--json]
   odla-ai admin ai models [--provider <id>] [--json]
@@ -1855,7 +2256,7 @@ Usage:
   odla-ai security report <job-id> [--json]
   odla-ai security run [target] --ack-redacted-source [--env dev] [--profile odla] [--fail-on high]
   odla-ai security run [target] --self --ack-redacted-source
-  odla-ai provision [--config odla.config.mjs] [--email <odla-account>] [--dry-run] [--push-secrets] [--rotate-o11y-token] [--write-dev-vars[=path]] [--yes]
+  odla-ai provision [--config odla.config.mjs] [--email <odla-account>] [--wait <seconds>] [--dry-run] [--push-secrets] [--rotate-o11y-token] [--write-dev-vars[=path]] [--yes]
   odla-ai smoke [--config odla.config.mjs] [--env dev] [--email <odla-account>] [--no-open]
   odla-ai skill install [--dir <project>] [--agent <name>] [--global] [--force]
   odla-ai secrets push --env <env> [--config odla.config.mjs] [--dry-run] [--yes]
@@ -1867,12 +2268,19 @@ Commands:
   setup        Install offline odla runbooks for common coding-agent harnesses.
   init         Create a generic odla.config.mjs plus starter schema/rules files.
   doctor       Validate and summarize the project config without network calls.
-  calendar     Inspect, connect, resync, or disconnect a read-only Google mirror.
+  calendar     Inspect, connect, or disconnect the live Google booking connection.
+  app          Archive (suspend, data retained), restore, or export the app.
+               Archiving takes every environment's data plane down until restored;
+               permanent deletion has NO CLI \u2014 it requires a signed-in owner in
+               Studio, and no machine or agent credential can purge. "app export"
+               downloads a portable gzipped-JSONL snapshot of one environment's
+               database (--fresh takes a new snapshot first) \u2014 your data is
+               always yours to take.
   capabilities Show what the CLI automates vs agent edits and human checkpoints.
   admin        Manage platform-funded AI routing/credentials/usage with narrow device grants.
   security     Connect GitHub sources and run commit-pinned hosted reviews, or scan a local snapshot.
-  provision    Register services, configure them, persist credentials, optionally push secrets.
-  smoke        Verify local credentials, public-config, live schema, and db aggregate.
+  provision    Register services, compose integrations, persist credentials, optionally push secrets.
+  smoke        Verify credentials, public-config, composed schema, db aggregate, and integration probes.
   skill        Same installer; --agent accepts all, claude, codex, cursor,
                copilot, gemini, or agents (repeatable or comma-separated).
   secrets      Push configured db/o11y secrets into the Worker via wrangler
@@ -1889,6 +2297,12 @@ Safety:
   Provision opens the approval page in your browser automatically whenever the
   machine can show one, including agent-driven runs; only CI, SSH, and
   display-less hosts skip it. Use --open to force or --no-open to suppress.
+  Browser launch is best-effort: the printed approval URL is authoritative and
+  agents must relay it to the human verbatim. A started handshake is persisted
+  under .odla/, so a command killed mid-wait loses nothing \u2014 rerunning resumes
+  the same code. Outside an interactive terminal the wait is capped (90s by
+  default, --wait <seconds> to change); a still-pending handshake then exits
+  with code 75: relay the URL, wait for approval, and re-run to collect.
   A fresh device handshake requires --email <odla-account> or ODLA_USER_EMAIL.
   The email is a non-secret identity hint: never provide a password or session
   token. The matching account must already exist, be signed in, explicitly
@@ -1925,13 +2339,13 @@ function harnessOption(value, flag) {
 }
 
 // src/init.ts
-var import_node_fs7 = require("fs");
-var import_node_path5 = require("path");
+var import_node_fs9 = require("fs");
+var import_node_path6 = require("path");
 function initProject(options) {
   const out = options.stdout ?? console;
-  const rootDir = (0, import_node_path5.resolve)(options.rootDir ?? process.cwd());
-  const configPath = (0, import_node_path5.resolve)(rootDir, options.configPath ?? "odla.config.mjs");
-  if ((0, import_node_fs7.existsSync)(configPath) && !options.force) {
+  const rootDir = (0, import_node_path6.resolve)(options.rootDir ?? process.cwd());
+  const configPath = (0, import_node_path6.resolve)(rootDir, options.configPath ?? "odla.config.mjs");
+  if ((0, import_node_fs9.existsSync)(configPath) && !options.force) {
     throw new Error(`${configPath} already exists. Pass --force to overwrite.`);
   }
   if (!/^[a-z0-9][a-z0-9-]*$/.test(options.appId)) {
@@ -1941,29 +2355,29 @@ function initProject(options) {
   const services = options.services?.length ? options.services : ["db", "ai"];
   if (services.includes("calendar") && !services.includes("db")) throw new Error("--services calendar requires db");
   const aiProvider = options.aiProvider ?? "anthropic";
-  (0, import_node_fs7.mkdirSync)((0, import_node_path5.dirname)(configPath), { recursive: true });
-  (0, import_node_fs7.mkdirSync)((0, import_node_path5.resolve)(rootDir, "src/odla"), { recursive: true });
-  (0, import_node_fs7.mkdirSync)((0, import_node_path5.resolve)(rootDir, ".odla"), { recursive: true });
-  (0, import_node_fs7.writeFileSync)(configPath, configTemplate({ appId: options.appId, name: options.name, envs, services, aiProvider }));
-  writeIfMissing((0, import_node_path5.resolve)(rootDir, "src/odla/schema.mjs"), schemaTemplate());
-  writeIfMissing((0, import_node_path5.resolve)(rootDir, "src/odla/rules.mjs"), rulesTemplate());
+  (0, import_node_fs9.mkdirSync)((0, import_node_path6.dirname)(configPath), { recursive: true });
+  (0, import_node_fs9.mkdirSync)((0, import_node_path6.resolve)(rootDir, "src/odla"), { recursive: true });
+  (0, import_node_fs9.mkdirSync)((0, import_node_path6.resolve)(rootDir, ".odla"), { recursive: true });
+  (0, import_node_fs9.writeFileSync)(configPath, configTemplate({ appId: options.appId, name: options.name, envs, services, aiProvider }));
+  writeIfMissing((0, import_node_path6.resolve)(rootDir, "src/odla/schema.mjs"), schemaTemplate());
+  writeIfMissing((0, import_node_path6.resolve)(rootDir, "src/odla/rules.mjs"), rulesTemplate());
   ensureGitignore(rootDir);
   out.log(`created ${relativeDisplay(configPath, rootDir)}`);
   out.log("created src/odla/schema.mjs and src/odla/rules.mjs");
   out.log("updated .gitignore for local odla credentials");
 }
 function writeIfMissing(path, text) {
-  if ((0, import_node_fs7.existsSync)(path)) return;
-  (0, import_node_fs7.writeFileSync)(path, text);
+  if ((0, import_node_fs9.existsSync)(path)) return;
+  (0, import_node_fs9.writeFileSync)(path, text);
 }
 function configTemplate(input) {
   const calendar = input.services.includes("calendar") ? `  calendar: {
     google: {
-      calendars: ${JSON.stringify(Object.fromEntries(input.envs.map((env) => [env, ["primary"]])))},
+      // Calendars consulted for availability; bookings land on bookingCalendar
+      // (defaults to the first availability calendar). Google consent happens
+      // in the browser during provision; bookings write live through odla.ai.
+      availabilityCalendars: ${JSON.stringify(Object.fromEntries(input.envs.map((env) => [env, ["primary"]])))},
       bookingPageUrl: ${JSON.stringify(Object.fromEntries(input.envs.map((env) => [env, null])))},
-      match: { organizerSelf: true, requireAttendees: true },
-      attendeePolicy: "full",
-      // Read-only in this release. Google consent happens in Studio during provision.
     },
   },
 ` : "";
@@ -1976,6 +2390,9 @@ function configTemplate(input) {
   },
   envs: ${JSON.stringify(input.envs)},
   services: ${JSON.stringify(input.services)},
+  // App capabilities are npm modules, not hosted services. Import their
+  // data-only descriptor and add it here (for example createCrmIntegration()).
+  integrations: [],
   db: {
     schema: "./src/odla/schema.mjs",
     rules: "./src/odla/rules.mjs",
@@ -2053,8 +2470,60 @@ function relativeDisplay(path, rootDir) {
 
 // src/provision.ts
 var import_apps2 = require("@odla-ai/apps");
-var import_ai = require("@odla-ai/ai");
-var import_node_process6 = __toESM(require("process"), 1);
+var import_ai2 = require("@odla-ai/ai");
+var import_node_process7 = __toESM(require("process"), 1);
+
+// src/integration-provision.ts
+var import_db3 = require("@odla-ai/db");
+async function provisionIntegrationSeeds(doFetch, endpoint, tenantId, dbKey, integrations, env, out) {
+  const base = `${endpoint}/app/${encodeURIComponent(tenantId)}`;
+  for (const integration of integrations) {
+    for (const seed of integration.seeds ?? []) {
+      const payload = await postJson(doFetch, `${base}/query`, dbKey, {
+        query: { [seed.ns]: { $: { where: { [seed.key.attr]: seed.key.value }, limit: 1 } } }
+      });
+      const rows = isRecord7(payload) && isRecord7(payload.result) ? payload.result[seed.ns] : void 0;
+      if (!Array.isArray(rows)) {
+        throw new Error(`${env}: integration ${integration.id} seed ${seed.id} query returned an invalid response`);
+      }
+      if (rows.length > 0) {
+        out.log(`${env}: integration ${integration.id} seed ${seed.id} already exists`);
+        continue;
+      }
+      await postJson(doFetch, `${base}/transact`, dbKey, {
+        mutationId: `integration:${integration.id}:seed:${seed.id}`,
+        ops: [{
+          t: "update",
+          ns: seed.ns,
+          // A fresh id plus the declared-unique natural key is create-only: a
+          // concurrent creator gets a unique violation instead of being overwritten.
+          id: (0, import_db3.uuidv7)(),
+          attrs: { ...seed.attrs, [seed.key.attr]: seed.key.value }
+        }]
+      });
+      out.log(`${env}: integration ${integration.id} seed ${seed.id} created`);
+    }
+  }
+}
+async function postJson(doFetch, url, bearer, body) {
+  const res = await doFetch(url, {
+    method: "POST",
+    headers: { authorization: `Bearer ${bearer}`, "content-type": "application/json" },
+    body: JSON.stringify(body)
+  });
+  if (!res.ok) throw new Error(`${new URL(url).pathname} failed: ${res.status} ${await responseText(res)}`);
+  return res.json().catch(() => ({}));
+}
+function isRecord7(value) {
+  return value !== null && typeof value === "object" && !Array.isArray(value);
+}
+async function responseText(res) {
+  try {
+    return redactSecrets((await res.text()).slice(0, 500));
+  } catch {
+    return "";
+  }
+}
 
 // src/provision-credentials.ts
 var import_apps = require("@odla-ai/apps");
@@ -2115,14 +2584,14 @@ async function mintDbKey(opts, tenantId) {
         appId: tenantId
       })
     });
-    if (!created.ok) throw new Error(`db app create (${tenantId}) failed: ${created.status} ${await safeText2(created)}`);
+    if (!created.ok) throw new Error(`db app create (${tenantId}) failed: ${created.status} ${await safeText3(created)}`);
     res = await opts.fetch(`${opts.cfg.dbEndpoint}/admin/apps/${encodeURIComponent(tenantId)}/keys`, {
       method: "POST",
       headers,
       body: "{}"
     });
   }
-  if (!res.ok) throw new Error(`db key mint (${tenantId}) failed: ${res.status} ${await safeText2(res)}`);
+  if (!res.ok) throw new Error(`db key mint (${tenantId}) failed: ${res.status} ${await safeText3(res)}`);
   const body = await res.json();
   if (!body.key) throw new Error(`db key mint (${tenantId}) returned no key`);
   return body.key;
@@ -2138,12 +2607,12 @@ async function issueO11yToken(opts) {
       `o11y token already exists for env "${opts.env}", but its shown-once value is not in the local credentials file; run "odla-ai provision --rotate-o11y-token --push-secrets" to replace it explicitly`
     );
   }
-  if (!res.ok) throw new Error(`o11y token ${opts.rotateO11y ? "rotation" : "issue"} (${opts.env}) failed: ${res.status} ${await safeText2(res)}`);
+  if (!res.ok) throw new Error(`o11y token ${opts.rotateO11y ? "rotation" : "issue"} (${opts.env}) failed: ${res.status} ${await safeText3(res)}`);
   const body = await res.json();
   if (!body.token) throw new Error(`o11y token ${opts.rotateO11y ? "rotation" : "issue"} (${opts.env}) returned no token`);
   return body.token;
 }
-async function safeText2(res) {
+async function safeText3(res) {
   try {
     return redactSecrets((await res.text()).slice(0, 500));
   } catch {
@@ -2151,6 +2620,18 @@ async function safeText2(res) {
   }
 }
 
+// src/provision-helpers.ts
+var import_ai = require("@odla-ai/ai");
+function serviceRank(service) {
+  if (service === "db") return 0;
+  if (service === "calendar") return 2;
+  return 1;
+}
+function defaultSecretName(provider) {
+  const names = import_ai.DEFAULT_SECRET_NAMES;
+  return names[provider] ?? `${provider}_api_key`;
+}
+
 // src/secrets.ts
 var PROD_ENV_NAMES = /* @__PURE__ */ new Set(["prod", "production"]);
 async function secretsPush(options) {
@@ -2242,24 +2723,28 @@ async function provision(options) {
   out.log(`  db:       ${plan.dbEndpoint}`);
   out.log(`  envs:     ${plan.envs.join(", ")}`);
   out.log(`  services: ${plan.services.join(", ")}`);
+  out.log(`  integrations: ${plan.integrations.length ? plan.integrations.join(", ") : "none"}`);
   const productionEnvs = plan.envs.filter((env) => env === "prod" || env === "production");
   if (!options.dryRun && productionEnvs.length > 0 && !options.yes) {
     throw new Error(
       `refusing to provision production env ${productionEnvs.join(", ")} without --yes; run --dry-run first`
     );
   }
-  const schema = hasDb ? await resolveDataExport(cfg, cfg.db?.schema, ["schema", "SCHEMA"]) : void 0;
-  const configuredRules = hasDb ? await resolveDataExport(cfg, cfg.db?.rules, ["rules", "RULES"]) : void 0;
-  const rules = configuredRules ?? (schema && cfg.db?.defaultRules !== false ? rulesFromSchema(schema) : void 0);
+  const database = await resolveDatabaseConfig(cfg);
+  const { schema, rules } = database;
   if (options.dryRun) {
     out.log("dry run: no network calls or file writes");
     out.log(`  schema: ${schema ? "yes" : "no"}`);
     out.log(`  rules:  ${rules ? Object.keys(rules).length : 0} namespaces`);
+    for (const integration of database.integrations) {
+      const namespaces = Object.keys(integration.schema?.entities ?? {}).length;
+      out.log(`  integration.${integration.id}: ${namespaces} namespaces, ${integration.seeds?.length ?? 0} seeds, ${integration.probes?.length ?? 0} smoke probes`);
+    }
     out.log(`  ai:     ${cfg.services.includes("ai") ? cfg.ai?.provider ?? "not configured" : "not enabled"}`);
     if (cfg.services.includes("calendar")) {
       for (const env of cfg.envs) {
         const calendar = calendarServiceConfig(cfg, env);
-        out.log(`  calendar.${env}: google/read, ${calendar.calendars.join(", ")} (${calendar.attendeePolicy}; ${GOOGLE_CALENDAR_READ_SCOPE})`);
+        out.log(`  calendar.${env}: google/book \u2192 ${calendar.bookingCalendarId}; availability ${calendar.availabilityCalendars.join(", ")} (${GOOGLE_CALENDAR_EVENTS_SCOPE})`);
         const bookingPage = calendarBookingPageUrl(cfg, env);
         out.log(`  calendar.${env}.bookingPageUrl: ${bookingPage === void 0 ? "unchanged" : bookingPage ?? "clear"}`);
       }
@@ -2282,7 +2767,7 @@ async function provision(options) {
   }
   const devVarsTarget = resolveWriteDevVarsTarget(cfg, options.writeDevVars);
   if (cfg.local.gitignore) {
-    ensureGitignore(cfg.rootDir, [cfg.local.tokenFile, cfg.local.credentialsFile, ...devVarsTarget ? [devVarsTarget] : []]);
+    ensureGitignore(cfg.rootDir, [cfg.local.tokenFile, handshakeFile(cfg), cfg.local.credentialsFile, ...devVarsTarget ? [devVarsTarget] : []]);
   }
   if (options.pushSecrets) {
     await preflightSecretsPush({ configPath: cfg.configPath, runner: options.secretRunner });
@@ -2364,18 +2849,21 @@ ${env}: credentials are already saved; retry "odla-ai secrets push --env ${env}$
       }
     }
     if (schema && dbKey) {
-      await postJson(doFetch, `${cfg.dbEndpoint}/app/${encodeURIComponent(tenantId)}/schema`, dbKey, { schema });
+      await postJson2(doFetch, `${cfg.dbEndpoint}/app/${encodeURIComponent(tenantId)}/schema`, dbKey, { schema });
       out.log(`${env}: schema pushed`);
     }
     if (rules) {
-      await postJson(doFetch, `${cfg.dbEndpoint}/app/${encodeURIComponent(tenantId)}/admin/rules`, token, rules);
+      await postJson2(doFetch, `${cfg.dbEndpoint}/app/${encodeURIComponent(tenantId)}/admin/rules`, token, rules);
       out.log(`${env}: rules pushed (${Object.keys(rules).length} namespaces)`);
     }
+    if (dbKey) {
+      await provisionIntegrationSeeds(doFetch, cfg.dbEndpoint, tenantId, dbKey, database.integrations, env, out);
+    }
     if (cfg.services.includes("ai") && cfg.ai?.provider && cfg.ai.keyEnv) {
-      const key = import_node_process6.default.env[cfg.ai.keyEnv];
+      const key = import_node_process7.default.env[cfg.ai.keyEnv];
       if (key) {
         const secretName = cfg.ai.secretName ?? defaultSecretName(cfg.ai.provider);
-        await (0, import_ai.putSecret)({ endpoint: cfg.dbEndpoint, token, fetch: doFetch }, tenantId, secretName, key);
+        await (0, import_ai2.putSecret)({ endpoint: cfg.dbEndpoint, token, fetch: doFetch }, tenantId, secretName, key);
         out.log(`${env}: ${cfg.ai.provider} key stored in vault (${secretName})`);
       } else {
         out.log(`${env}: ${cfg.ai.keyEnv} not set; skipped provider key storage`);
@@ -2411,11 +2899,6 @@ ${env}: credentials are already saved; retry "odla-ai secrets push --env ${env}$
     }
   }
 }
-function serviceRank(service) {
-  if (service === "db") return 0;
-  if (service === "calendar") return 2;
-  return 1;
-}
 async function readRegistryApp(cfg, token, doFetch) {
   const res = await doFetch(`${cfg.platformUrl}/registry/apps/${encodeURIComponent(cfg.app.id)}`, {
     headers: { authorization: `Bearer ${token}` }
@@ -2425,13 +2908,13 @@ async function readRegistryApp(cfg, token, doFetch) {
   const json = await res.json();
   return json.app ?? null;
 }
-async function postJson(doFetch, url, bearer, body) {
+async function postJson2(doFetch, url, bearer, body) {
   const res = await doFetch(url, {
     method: "POST",
     headers: { authorization: `Bearer ${bearer}`, "content-type": "application/json" },
     body: JSON.stringify(body)
   });
-  if (!res.ok) throw new Error(`${new URL(url).pathname} failed: ${res.status} ${await safeText3(res)}`);
+  if (!res.ok) throw new Error(`${new URL(url).pathname} failed: ${res.status} ${await safeText4(res)}`);
 }
 function normalizeClerkConfig(value) {
   if (!value) return null;
@@ -2444,11 +2927,7 @@ function normalizeClerkConfig(value) {
   const publishableKey = envValue(cfg.publishableKey);
   return publishableKey ? { publishableKey, ...cfg.audience ? { audience: cfg.audience } : {}, ...cfg.mode ? { mode: cfg.mode } : {} } : null;
 }
-function defaultSecretName(provider) {
-  const names = import_ai.DEFAULT_SECRET_NAMES;
-  return names[provider] ?? `${provider}_api_key`;
-}
-async function safeText3(res) {
+async function safeText4(res) {
   try {
     return redactSecrets((await res.text()).slice(0, 500));
   } catch {
@@ -2457,7 +2936,7 @@ async function safeText3(res) {
 }
 
 // src/secrets-set.ts
-var import_ai2 = require("@odla-ai/ai");
+var import_ai3 = require("@odla-ai/ai");
 var import_apps3 = require("@odla-ai/apps");
 var PROD_ENV_NAMES2 = /* @__PURE__ */ new Set(["prod", "production"]);
 async function secretsSet(options) {
@@ -2469,7 +2948,7 @@ async function secretsSet(options) {
   const { cfg, tenantId, value, doFetch, out } = await resolveVaultWrite(options);
   const token = await getDeveloperToken(cfg, options, doFetch, out);
   try {
-    await (0, import_ai2.putSecret)({ endpoint: cfg.dbEndpoint, token, fetch: doFetch }, tenantId, name, value);
+    await (0, import_ai3.putSecret)({ endpoint: cfg.dbEndpoint, token, fetch: doFetch }, tenantId, name, value);
   } catch (err) {
     throw new Error(scrubValue(err instanceof Error ? err.message : String(err), value));
   }
@@ -2514,7 +2993,7 @@ async function resolveVaultWrite(options) {
 }
 
 // src/security-command-context.ts
-var import_promises = require("readline/promises");
+var import_promises2 = require("readline/promises");
 async function hostedSecurityContext(parsed, dependencies) {
   const configPath = stringOpt(parsed.options.config) ?? "odla.config.mjs";
   const cfg = await loadProjectConfig(configPath);
@@ -2540,7 +3019,7 @@ async function hostedSecurityContext(parsed, dependencies) {
 async function interactiveConfirmation(message, dependencies) {
   if (dependencies.confirm) return dependencies.confirm(message);
   if (!process.stdin.isTTY || !process.stdout.isTTY) return false;
-  const prompt = (0, import_promises.createInterface)({ input: process.stdin, output: process.stdout });
+  const prompt = (0, import_promises2.createInterface)({ input: process.stdin, output: process.stdout });
   try {
     const answer = await prompt.question(`${message} [y/N] `);
     return /^y(?:es)?$/i.test(answer.trim());
@@ -2670,7 +3149,7 @@ function hostedSeverity(value, flag) {
 var import_security2 = require("@odla-ai/security");
 
 // src/security.ts
-var import_node_path6 = require("path");
+var import_node_path7 = require("path");
 var import_security = require("@odla-ai/security");
 var import_node = require("@odla-ai/security/node");
 async function runHostedSecurity(options) {
@@ -2682,9 +3161,9 @@ async function runHostedSecurity(options) {
   const appId = selfAudit ? "odla-ai" : cfg.app.id;
   const env = selfAudit ? "prod" : selectEnv(options.env, cfg.envs, cfg.configPath, cfg.rootDir);
   const platform = options.platform ?? cfg?.platformUrl ?? "https://odla.ai";
-  const target = (0, import_node_path6.resolve)(options.target ?? cfg?.rootDir ?? ".");
-  const output = (0, import_node_path6.resolve)(options.out ?? (0, import_node_path6.resolve)(target, ".odla/security/hosted"));
-  const outputRelative = (0, import_node_path6.relative)(target, output).split(import_node_path6.sep).join("/");
+  const target = (0, import_node_path7.resolve)(options.target ?? cfg?.rootDir ?? ".");
+  const output = (0, import_node_path7.resolve)(options.out ?? (0, import_node_path7.resolve)(target, ".odla/security/hosted"));
+  const outputRelative = (0, import_node_path7.relative)(target, output).split(import_node_path7.sep).join("/");
   if (!outputRelative) throw new Error("Hosted security output cannot be the repository root");
   const profile = profileFor(options.profile ?? "odla", options.maxHuntTasks ?? 12);
   const tokenRequest = {
@@ -2696,7 +3175,7 @@ async function runHostedSecurity(options) {
   };
   const token = await injectedToken(options, tokenRequest);
   const snapshot = await (0, import_node.snapshotDirectory)(target, {
-    exclude: !outputRelative.startsWith("../") && !(0, import_node_path6.isAbsolute)(outputRelative) ? [outputRelative] : []
+    exclude: !outputRelative.startsWith("../") && !(0, import_node_path7.isAbsolute)(outputRelative) ? [outputRelative] : []
   });
   const hosted = await (0, import_security.createPlatformSecurityReasoners)({
     platform,
@@ -2714,7 +3193,7 @@ async function runHostedSecurity(options) {
   });
   const harness = (0, import_security.createSecurityHarness)({
     profile,
-    store: new import_node.FileRunStore((0, import_node_path6.resolve)(output, "state")),
+    store: new import_node.FileRunStore((0, import_node_path7.resolve)(output, "state")),
     discoveryReasoner: hosted.discoveryReasoner,
     validationReasoner: hosted.validationReasoner,
     policy: {
@@ -2738,7 +3217,7 @@ async function runHostedSecurity(options) {
 function selectEnv(requested, declared, configPath, rootDir) {
   const env = requested ?? (declared.includes("dev") ? "dev" : declared[0]);
   if (!env || !declared.includes(env)) {
-    const shown = (0, import_node_path6.relative)(rootDir, configPath) || configPath;
+    const shown = (0, import_node_path7.relative)(rootDir, configPath) || configPath;
     throw new Error(`env "${env ?? ""}" is not declared in ${shown}`);
   }
   return env;
@@ -2767,7 +3246,7 @@ function printSummary(out, appId, env, run, report, output) {
   out.log(`  coverage: ${report.coverageStatus} ${complete}/${report.coverage.length} blocked=${report.metrics.blockedCells} shallow=${report.metrics.shallowCells} unscheduled=${report.metrics.unscheduledCells} budget_exhausted=${report.metrics.budgetExhaustedCells}`);
   if (report.callBudget) out.log(`  calls: discovery=${formatBudget(report.callBudget.discovery)} validation=${formatBudget(report.callBudget.validation)}`);
   out.log(`  findings: confirmed=${report.metrics.confirmed} needs_reproduction=${report.metrics.needsReproduction} candidates=${report.metrics.candidates}`);
-  out.log(`  report: ${(0, import_node_path6.resolve)(output, "REPORT.md")}`);
+  out.log(`  report: ${(0, import_node_path7.resolve)(output, "REPORT.md")}`);
 }
 function formatBudget(usage) {
   return usage ? `${usage.usedCalls}/${usage.maxCalls} skipped=${usage.skippedCalls}` : "caller-managed";
@@ -2775,7 +3254,7 @@ function formatBudget(usage) {
 
 // src/security-hosted-github.ts
 var import_node_child_process4 = require("child_process");
-var import_node_util = require("util");
+var import_node_util2 = require("util");
 
 // src/security-hosted-request.ts
 async function requestHostedSecurityJson(options, path, init, action) {
@@ -2979,7 +3458,7 @@ async function inferGitHubRepository(cwd = process.cwd(), readOrigin = defaultRe
   return repositoryFromGitRemote(remote);
 }
 async function defaultReadOrigin(cwd) {
-  const result = await (0, import_node_util.promisify)(import_node_child_process4.execFile)(
+  const result = await (0, import_node_util2.promisify)(import_node_child_process4.execFile)(
     "git",
     ["remote", "get-url", "origin"],
     { cwd, encoding: "utf8" }
@@ -3419,9 +3898,9 @@ async function securityStatus(parsed, dependencies) {
 }
 
 // src/skill.ts
-var import_node_fs8 = require("fs");
+var import_node_fs10 = require("fs");
 var import_node_os = require("os");
-var import_node_path7 = require("path");
+var import_node_path8 = require("path");
 var import_node_url2 = require("url");
 
 // src/skill-adapters.ts
@@ -3482,8 +3961,8 @@ function installSkill(options = {}) {
   const files = listFiles(sourceDir);
   if (files.length === 0) throw new Error(`no bundled skills found at ${sourceDir}`);
   const harnesses = normalizeHarnesses(options.harnesses, options.global === true);
-  const root = (0, import_node_path7.resolve)(options.dir ?? process.cwd());
-  const home = (0, import_node_path7.resolve)(options.homeDir ?? (0, import_node_os.homedir)());
+  const root = (0, import_node_path8.resolve)(options.dir ?? process.cwd());
+  const home = (0, import_node_path8.resolve)(options.homeDir ?? (0, import_node_os.homedir)());
   const plans = /* @__PURE__ */ new Map();
   const targets = /* @__PURE__ */ new Map();
   const rememberTarget = (harness, target) => {
@@ -3497,48 +3976,48 @@ function installSkill(options = {}) {
     plans.set(target, { target, content, boundary, managedMerge });
   };
   const planSkillTree = (targetDir2, boundary = root) => {
-    for (const rel of files) plan((0, import_node_path7.join)(targetDir2, rel), (0, import_node_fs8.readFileSync)((0, import_node_path7.join)(sourceDir, rel), "utf8"), false, boundary);
+    for (const rel of files) plan((0, import_node_path8.join)(targetDir2, rel), (0, import_node_fs10.readFileSync)((0, import_node_path8.join)(sourceDir, rel), "utf8"), false, boundary);
   };
   let targetDir;
   if (options.global) {
-    const claudeRoot = (0, import_node_path7.join)(home, ".claude", "skills");
-    const codexRoot = (0, import_node_path7.resolve)(options.codexHomeDir ?? process.env.CODEX_HOME ?? (0, import_node_path7.join)(home, ".codex"), "skills");
+    const claudeRoot = (0, import_node_path8.join)(home, ".claude", "skills");
+    const codexRoot = (0, import_node_path8.resolve)(options.codexHomeDir ?? process.env.CODEX_HOME ?? (0, import_node_path8.join)(home, ".codex"), "skills");
     targetDir = harnesses[0] === "codex" ? codexRoot : claudeRoot;
     for (const harness of harnesses) {
       const skillRoot = harness === "claude" ? claudeRoot : codexRoot;
-      planSkillTree(skillRoot, harness === "claude" ? home : (0, import_node_path7.dirname)((0, import_node_path7.dirname)(codexRoot)));
+      planSkillTree(skillRoot, harness === "claude" ? home : (0, import_node_path8.dirname)((0, import_node_path8.dirname)(codexRoot)));
       rememberTarget(harness, skillRoot);
     }
   } else {
-    const sharedRoot = (0, import_node_path7.join)(root, ".agents", "skills");
+    const sharedRoot = (0, import_node_path8.join)(root, ".agents", "skills");
     planSkillTree(sharedRoot);
-    const claudeRoot = (0, import_node_path7.join)(root, ".claude", "skills");
+    const claudeRoot = (0, import_node_path8.join)(root, ".claude", "skills");
     targetDir = harnesses.includes("claude") ? claudeRoot : sharedRoot;
     for (const harness of harnesses) rememberTarget(harness, sharedRoot);
     if (harnesses.includes("claude")) {
       for (const skill of skillNames(files)) {
-        const canonical = (0, import_node_fs8.readFileSync)((0, import_node_path7.join)(sourceDir, skill, "SKILL.md"), "utf8");
-        plan((0, import_node_path7.join)(claudeRoot, skill, "SKILL.md"), claudeAdapter(skill, canonical));
+        const canonical = (0, import_node_fs10.readFileSync)((0, import_node_path8.join)(sourceDir, skill, "SKILL.md"), "utf8");
+        plan((0, import_node_path8.join)(claudeRoot, skill, "SKILL.md"), claudeAdapter(skill, canonical));
       }
       rememberTarget("claude", claudeRoot);
     }
     if (harnesses.includes("cursor")) {
-      const cursorRule = (0, import_node_path7.join)(root, ".cursor", "rules", "odla.mdc");
+      const cursorRule = (0, import_node_path8.join)(root, ".cursor", "rules", "odla.mdc");
       plan(cursorRule, CURSOR_RULE);
       rememberTarget("cursor", cursorRule);
     }
     if (harnesses.includes("agents")) {
-      const agentsFile = (0, import_node_path7.join)(root, "AGENTS.md");
+      const agentsFile = (0, import_node_path8.join)(root, "AGENTS.md");
       plan(agentsFile, managedFileContent(agentsFile, PROJECT_INSTRUCTIONS, options.force === true, root), true);
       rememberTarget("agents", agentsFile);
     }
     if (harnesses.includes("copilot")) {
-      const copilotFile = (0, import_node_path7.join)(root, ".github", "copilot-instructions.md");
+      const copilotFile = (0, import_node_path8.join)(root, ".github", "copilot-instructions.md");
       plan(copilotFile, managedFileContent(copilotFile, PROJECT_INSTRUCTIONS, options.force === true, root), true);
       rememberTarget("copilot", copilotFile);
     }
     if (harnesses.includes("gemini")) {
-      const geminiFile = (0, import_node_path7.join)(root, "GEMINI.md");
+      const geminiFile = (0, import_node_path8.join)(root, "GEMINI.md");
       plan(geminiFile, managedFileContent(geminiFile, PROJECT_INSTRUCTIONS, options.force === true, root), true);
       rememberTarget("gemini", geminiFile);
     }
@@ -3552,11 +4031,11 @@ function installSkill(options = {}) {
       conflicts.push(`${file.target} (redirected by symbolic link ${symlink})`);
       continue;
     }
-    if (!(0, import_node_fs8.existsSync)(file.target)) {
+    if (!(0, import_node_fs10.existsSync)(file.target)) {
       writtenPaths.add(file.target);
       continue;
     }
-    const current = (0, import_node_fs8.readFileSync)(file.target, "utf8");
+    const current = (0, import_node_fs10.readFileSync)(file.target, "utf8");
     if (current === file.content) {
       unchangedPaths.add(file.target);
     } else if (file.managedMerge || options.force) {
@@ -3573,9 +4052,9 @@ ${conflicts.map((f) => `  - ${f}`).join("\n")}`
     );
   }
   for (const file of plans.values()) {
-    if (!(0, import_node_fs8.existsSync)(file.target) || (0, import_node_fs8.readFileSync)(file.target, "utf8") !== file.content) {
-      (0, import_node_fs8.mkdirSync)((0, import_node_path7.dirname)(file.target), { recursive: true });
-      (0, import_node_fs8.writeFileSync)(file.target, file.content);
+    if (!(0, import_node_fs10.existsSync)(file.target) || (0, import_node_fs10.readFileSync)(file.target, "utf8") !== file.content) {
+      (0, import_node_fs10.mkdirSync)((0, import_node_path8.dirname)(file.target), { recursive: true });
+      (0, import_node_fs10.writeFileSync)(file.target, file.content);
     }
   }
   const skills = skillNames(files);
@@ -3594,7 +4073,7 @@ ${conflicts.map((f) => `  - ${f}`).join("\n")}`
   };
 }
 function pathsUnder(root, paths) {
-  return [...paths].map((path) => (0, import_node_path7.relative)(root, path)).filter((path) => path !== ".." && !path.startsWith(`..${import_node_path7.sep}`) && !(0, import_node_path7.isAbsolute)(path)).sort();
+  return [...paths].map((path) => (0, import_node_path8.relative)(root, path)).filter((path) => path !== ".." && !path.startsWith(`..${import_node_path8.sep}`) && !(0, import_node_path8.isAbsolute)(path)).sort();
 }
 function normalizeHarnesses(values, global) {
   const requested = values?.length ? values : ["claude"];
@@ -3616,9 +4095,9 @@ function normalizeHarnesses(values, global) {
 function managedFileContent(path, block, force, boundary) {
   const symlink = symlinkedComponent(boundary, path);
   if (symlink) throw new Error(`refusing to manage ${path}: symbolic link component ${symlink}`);
-  if (!(0, import_node_fs8.existsSync)(path)) return `${block}
+  if (!(0, import_node_fs10.existsSync)(path)) return `${block}
 `;
-  const current = (0, import_node_fs8.readFileSync)(path, "utf8");
+  const current = (0, import_node_fs10.readFileSync)(path, "utf8");
   const start = "<!-- odla-ai agent setup:start -->";
   const end = "<!-- odla-ai agent setup:end -->";
   const startAt = current.indexOf(start);
@@ -3639,15 +4118,15 @@ function managedFileContent(path, block, force, boundary) {
   return `${current.slice(0, startAt)}${block}${current.slice(afterEnd)}`;
 }
 function symlinkedComponent(boundary, target) {
-  const rel = (0, import_node_path7.relative)(boundary, target);
-  if (rel === ".." || rel.startsWith(`..${import_node_path7.sep}`) || (0, import_node_path7.isAbsolute)(rel)) {
+  const rel = (0, import_node_path8.relative)(boundary, target);
+  if (rel === ".." || rel.startsWith(`..${import_node_path8.sep}`) || (0, import_node_path8.isAbsolute)(rel)) {
     throw new Error(`agent setup target escapes its install root: ${target}`);
   }
   let current = boundary;
-  for (const part of rel.split(import_node_path7.sep).filter(Boolean)) {
-    current = (0, import_node_path7.join)(current, part);
+  for (const part of rel.split(import_node_path8.sep).filter(Boolean)) {
+    current = (0, import_node_path8.join)(current, part);
     try {
-      if ((0, import_node_fs8.lstatSync)(current).isSymbolicLink()) return current;
+      if ((0, import_node_fs10.lstatSync)(current).isSymbolicLink()) return current;
     } catch (error) {
       if (error.code !== "ENOENT") throw error;
     }
@@ -3658,13 +4137,13 @@ function skillNames(files) {
   return [...new Set(files.filter((file) => /(^|[\\/])SKILL\.md$/.test(file)).map((file) => file.split(/[\\/]/)[0]))].sort();
 }
 function listFiles(dir) {
-  if (!(0, import_node_fs8.existsSync)(dir)) return [];
+  if (!(0, import_node_fs10.existsSync)(dir)) return [];
   const results = [];
   const walk = (current) => {
-    for (const entry of (0, import_node_fs8.readdirSync)(current, { withFileTypes: true })) {
-      const path = (0, import_node_path7.join)(current, entry.name);
+    for (const entry of (0, import_node_fs10.readdirSync)(current, { withFileTypes: true })) {
+      const path = (0, import_node_path8.join)(current, entry.name);
       if (entry.isDirectory()) walk(path);
-      else results.push((0, import_node_path7.relative)(dir, path));
+      else results.push((0, import_node_path8.relative)(dir, path));
     }
   };
   walk(dir);
@@ -3715,9 +4194,10 @@ async function smoke(options) {
     );
     const status = await readCalendarStatus({ platform: cfg.platformUrl, appId: cfg.app.id, env, token, fetch: doFetch });
     assertCalendarHealthy(status, calendarServiceConfig(cfg, env));
-    out.log(`  calendar: ${status.status}, last sync ${new Date(status.lastSuccessfulSyncAt).toISOString()}`);
+    out.log(`  calendar: ${status.status}, bookable (booking \u2192 ${status.bookingCalendarId ?? "primary"})`);
   }
-  const expectedSchema = await resolveDataExport(cfg, cfg.db?.schema, ["schema", "SCHEMA"]);
+  const database = await resolveDatabaseConfig(cfg);
+  const expectedSchema = database.schema;
   const expectedEntities = serializedEntities(expectedSchema);
   const liveSchemaPayload = await getJson(doFetch, `${cfg.dbEndpoint}/app/${encodeURIComponent(entry.tenantId)}/schema`, entry.dbKey);
   const liveSchema = liveSchemaPayload.schema ?? liveSchemaPayload;
@@ -3729,7 +4209,7 @@ async function smoke(options) {
   out.log(`  schema: ${liveEntities.length} entities`);
   const aggregateEntity = expectedEntities[0] ?? liveEntities[0];
   if (aggregateEntity) {
-    const aggregate = await postJson2(doFetch, `${cfg.dbEndpoint}/app/${encodeURIComponent(entry.tenantId)}/aggregate`, entry.dbKey, {
+    const aggregate = await postJson3(doFetch, `${cfg.dbEndpoint}/app/${encodeURIComponent(entry.tenantId)}/aggregate`, entry.dbKey, {
       ns: aggregateEntity,
       aggregate: { count: true }
     });
@@ -3738,13 +4218,20 @@ async function smoke(options) {
   } else {
     out.log(`  aggregate: skipped (schema has no entities)`);
   }
-  if (cfg.services.includes("calendar")) {
-    const bookings = await postJson2(doFetch, `${cfg.dbEndpoint}/app/${encodeURIComponent(entry.tenantId)}/aggregate`, entry.dbKey, {
-      ns: "$bookings",
-      aggregate: { count: true }
-    });
-    const count = bookings.aggregate?.count;
-    out.log(`  bookings: ${String(count ?? "ok")}`);
+  const probes = database.integrations.flatMap(
+    (integration) => (integration.probes ?? []).map((probe) => ({ integration: integration.id, probe }))
+  );
+  if (probes.length) {
+    const link = cfg.links?.[env];
+    if (!link) throw new Error(`integration smoke probes require links.${env} in odla.config.mjs`);
+    for (const { integration, probe } of probes) {
+      const probeUrl = new URL(probe.path, link).toString();
+      const res = await doFetch(probeUrl, { redirect: "manual" });
+      if (res.status !== probe.expectedStatus) {
+        throw new Error(`integration "${integration}" probe ${probe.path} returned ${res.status}; expected ${probe.expectedStatus}`);
+      }
+      out.log(`  integration.${integration}: ${probe.path} \u2192 ${res.status}`);
+    }
   }
   out.log("ok");
 }
@@ -3753,29 +4240,26 @@ function assertCalendarHealthy(status, expected) {
   if (status.status !== "healthy") {
     throw new Error(`calendar connection is ${status.status}${status.error?.message ? `: ${status.error.message}` : ""}`);
   }
-  if (status.access !== "read") throw new Error("calendar connection is not read-only");
-  const hasReadScope = status.grantedScopes.some((scope) => scope === GOOGLE_CALENDAR_READ_SCOPE || scope === "calendar.events.readonly");
-  if (!hasReadScope) throw new Error("calendar connection is missing calendar.events.readonly consent");
-  const missing = expected.calendars.filter((id) => !status.calendars.includes(id));
+  if (!status.writable) throw new Error('calendar grant does not cover booking writes; run "odla-ai calendar connect" to re-consent');
+  const hasEventsScope = status.grantedScopes.some((scope) => scope === GOOGLE_CALENDAR_EVENTS_SCOPE);
+  if (!hasEventsScope) throw new Error("calendar connection is missing calendar.events consent");
+  const missing = expected.availabilityCalendars.filter((id) => !status.calendars.includes(id));
   if (missing.length) throw new Error(`calendar connection is missing configured calendars: ${missing.join(", ")}`);
-  if (status.lastSuccessfulSyncAt === void 0) throw new Error("calendar has never completed a sync");
-  if (Date.now() - status.lastSuccessfulSyncAt > 30 * 6e4) throw new Error("calendar sync is more than 30 minutes stale");
-  if (status.watchExpiresAt !== void 0 && status.watchExpiresAt <= Date.now()) throw new Error("calendar watch channel is expired");
 }
 async function getJson(doFetch, url, bearer) {
   const res = await doFetch(url, {
     headers: bearer ? { authorization: `Bearer ${bearer}` } : void 0
   });
-  if (!res.ok) throw new Error(`${new URL(url).pathname} returned ${res.status}: ${await safeText4(res)}`);
+  if (!res.ok) throw new Error(`${new URL(url).pathname} returned ${res.status}: ${await safeText5(res)}`);
   return res.json();
 }
-async function postJson2(doFetch, url, bearer, body) {
+async function postJson3(doFetch, url, bearer, body) {
   const res = await doFetch(url, {
     method: "POST",
     headers: { authorization: `Bearer ${bearer}`, "content-type": "application/json" },
     body: JSON.stringify(body)
   });
-  if (!res.ok) throw new Error(`${new URL(url).pathname} returned ${res.status}: ${await safeText4(res)}`);
+  if (!res.ok) throw new Error(`${new URL(url).pathname} returned ${res.status}: ${await safeText5(res)}`);
   return res.json();
 }
 function publicConfigUrl(platformUrl, appId, env) {
@@ -3783,7 +4267,7 @@ function publicConfigUrl(platformUrl, appId, env) {
   url.searchParams.set("env", env);
   return url.toString();
 }
-async function safeText4(res) {
+async function safeText5(res) {
   try {
     return (await res.text()).slice(0, 500);
   } catch {
@@ -3792,6 +4276,9 @@ async function safeText4(res) {
 }
 
 // src/cli.ts
+function exitCodeFor(err) {
+  return err?.code === "handshake_pending" ? 75 : 1;
+}
 async function runCli(argv = process.argv.slice(2), dependencies = {}) {
   const parsed = parseArgv(argv);
   const command = parsed.positionals[0] ?? "help";
@@ -3844,6 +4331,10 @@ async function runCli(argv = process.argv.slice(2), dependencies = {}) {
     await adminCommand(parsed);
     return;
   }
+  if (command === "app") {
+    await appCommand(parsed, dependencies);
+    return;
+  }
   if (command === "security") {
     await securityCommand(parsed, dependencies);
     return;
@@ -3940,6 +4431,7 @@ async function provisionCommand(parsed, dependencies) {
     "token",
     "email",
     "open",
+    "wait",
     "yes"
   ], 1);
   const writeDevVars2 = parsed.options["write-dev-vars"];
@@ -3954,6 +4446,7 @@ async function provisionCommand(parsed, dependencies) {
     token: stringOpt(parsed.options.token),
     email: stringOpt(parsed.options.email),
     open: parsed.options.open === false ? false : parsed.options.open === true ? true : void 0,
+    wait: numberOpt(parsed.options.wait, "--wait"),
     yes: parsed.options.yes === true,
     fetch: dependencies.fetch,
     openApprovalUrl: dependencies.openUrl,
@@ -3963,7 +4456,7 @@ async function provisionCommand(parsed, dependencies) {
 }
 async function calendarCommand(parsed, dependencies) {
   const sub = parsed.positionals[1];
-  if (sub !== "status" && sub !== "calendars" && sub !== "connect" && sub !== "resync" && sub !== "disconnect") {
+  if (sub !== "status" && sub !== "calendars" && sub !== "connect" && sub !== "disconnect") {
     throw new Error(`unknown calendar subcommand "${sub ?? ""}". Try "odla-ai calendar status --env dev".`);
   }
   assertArgs(parsed, ["config", "env", "json", "token", "email", "open", "yes"], 2);
@@ -3984,13 +4477,12 @@ async function calendarCommand(parsed, dependencies) {
   if (sub === "status") await calendarStatus(options);
   else if (sub === "calendars") await calendarCalendars(options);
   else if (sub === "connect") await calendarConnect(options);
-  else if (sub === "resync") await calendarResync(options);
   else await calendarDisconnect(options);
 }
 
 // src/bin.ts
 runCli().catch((err) => {
   console.error(`odla-ai: ${err instanceof Error ? err.message : String(err)}`);
-  process.exitCode = 1;
+  process.exitCode = exitCodeFor(err);
 });
 //# sourceMappingURL=bin.cjs.map