@odla-ai/cli 0.11.2 → 0.13.0

package/dist/{chunk-DC4MIB4X.js → chunk-I7XDJZB6.js}

@@ -2,7 +2,7 @@
 
 // src/admin-ai-auth.ts
 import { existsSync as existsSync2 } from "fs";
-import process4 from "process";
+import process5 from "process";
 import { requestToken as requestToken2 } from "@odla-ai/db";
 
 // src/local.ts
@@ -156,55 +156,173 @@ function openerFor(platform) {
 }
 
 // src/token.ts
-import { requestToken } from "@odla-ai/db";
+import { collectToken, OdlaError, requestToken } from "@odla-ai/db";
+import process4 from "process";
+
+// src/handshake-state.ts
+import { rmSync } from "fs";
+import { dirname as dirname2, join } from "path";
 import process3 from "process";
+function handshakeFile(cfg) {
+  return join(dirname2(cfg.local.tokenFile), "handshake.local.json");
+}
+var RESUME_MARGIN_MS = 5e3;
+function readPendingHandshake(path, platform, email) {
+  const pending = readJsonFile(path);
+  if (!pending || pending.platform !== platform || pending.email !== email) return null;
+  if (typeof pending.userCode !== "string" || typeof pending.deviceCode !== "string" || typeof pending.approvalUrl !== "string") return null;
+  if (typeof pending.expiresAt !== "number" || pending.expiresAt <= Date.now() + RESUME_MARGIN_MS) return null;
+  return { interval: 3, ...pending };
+}
+function writePendingHandshake(path, pending) {
+  writePrivateJson(path, pending);
+}
+function clearPendingHandshake(path) {
+  rmSync(path, { force: true });
+}
+function minutesLeft(expiresAt) {
+  return Math.max(1, Math.round((expiresAt - Date.now()) / 6e4));
+}
+function approvalHint(pending) {
+  return `approve code ${pending.userCode} at ${pending.approvalUrl} (${minutesLeft(pending.expiresAt)}m left)`;
+}
+function approvalReminder(out, pending, periodMs = 3e4) {
+  const timer = setInterval(() => out.log(`auth: still waiting \u2014 ${approvalHint(pending)}`), periodMs);
+  timer.unref?.();
+  return () => clearInterval(timer);
+}
+function handshakeWaitMs(waitSeconds, interactive = process3.stdout.isTTY === true) {
+  if (waitSeconds !== void 0) return waitSeconds * 1e3;
+  return interactive ? void 0 : 9e4;
+}
+
+// src/token.ts
 async function getDeveloperToken(cfg, options, doFetch, out) {
   if (options.token) return options.token;
   const audience = platformAudience(cfg.platformUrl);
-  if (process3.env.ODLA_DEV_TOKEN) {
-    const declared = process3.env.ODLA_DEV_TOKEN_AUDIENCE;
+  if (process4.env.ODLA_DEV_TOKEN) {
+    const declared = process4.env.ODLA_DEV_TOKEN_AUDIENCE;
     if (declared) {
       if (platformAudience(declared) !== audience) throw new Error("ODLA_DEV_TOKEN_AUDIENCE does not match the configured platform");
     } else if (audience !== "https://odla.ai") {
       throw new Error("ODLA_DEV_TOKEN_AUDIENCE is required for a non-default platform");
     }
-    return process3.env.ODLA_DEV_TOKEN;
+    return process4.env.ODLA_DEV_TOKEN;
   }
   const cached = readJsonFile(cfg.local.tokenFile);
   if (cached?.token && cached.platform === audience && (cached.expiresAt ?? 0) > Date.now() + 6e4) {
     out.log(`auth: using cached developer token (${displayPath(cfg.local.tokenFile, cfg.rootDir)})`);
     return cached.token;
   }
-  const browser = approvalBrowser(options);
-  const email = handshakeEmail(options.email, cached?.platform === audience ? cached.email : void 0);
-  const { token, expiresAt } = await requestToken({
-    endpoint: cfg.platformUrl,
-    email,
-    label: `${cfg.app.id} provisioner`,
-    fetch: doFetch,
-    onCode: async ({ userCode, expiresIn, verificationUriComplete }) => {
-      const approvalUrl = verificationUriComplete ?? handshakeUrl(cfg.platformUrl, userCode);
-      out.log("");
-      out.log(`Review, then approve code ${userCode} at ${approvalUrl} within ${Math.floor(expiresIn / 60)}m.`);
-      if (browser.open) {
-        try {
-          await (options.openApprovalUrl ?? openUrl)(approvalUrl);
-          out.log(`auth: opened browser for approval${browser.mode === "auto" ? " (auto)" : ""}`);
-        } catch (err) {
-          out.log(`auth: could not open browser (${err instanceof Error ? err.message : String(err)})`);
-        }
-      } else if (browser.reason) {
-        out.log(`auth: browser launch skipped (${browser.reason})`);
-      }
-      out.log("");
-    }
-  });
-  writePrivateJson(cfg.local.tokenFile, { platform: audience, email, token, expiresAt });
+  const ctx = {
+    cfg,
+    options,
+    doFetch,
+    out,
+    audience,
+    browser: approvalBrowser(options),
+    email: handshakeEmail(options.email, cached?.platform === audience ? cached.email : void 0),
+    pendingFile: handshakeFile(cfg)
+  };
+  const waitMs = handshakeWaitMs(options.wait);
+  const { token, expiresAt } = await resumePendingHandshake(ctx, waitMs) ?? await freshHandshake(ctx, waitMs);
+  clearPendingHandshake(ctx.pendingFile);
+  writePrivateJson(cfg.local.tokenFile, { platform: audience, email: ctx.email, token, expiresAt });
   out.log(`auth: developer token cached (${displayPath(cfg.local.tokenFile, cfg.rootDir)})`);
   return token;
 }
+async function resumePendingHandshake(ctx, waitMs) {
+  const pending = readPendingHandshake(ctx.pendingFile, ctx.audience, ctx.email);
+  if (!pending) return null;
+  ctx.out.log("");
+  ctx.out.log(`auth: resuming pending handshake \u2014 ${approvalHint(pending)}`);
+  await launchApproval(ctx, pending.approvalUrl);
+  ctx.out.log("");
+  const stopReminder = approvalReminder(ctx.out, pending);
+  try {
+    return await collectToken({
+      endpoint: ctx.cfg.platformUrl,
+      deviceCode: pending.deviceCode,
+      expiresAt: pending.expiresAt,
+      interval: pending.interval,
+      waitMs,
+      fetch: ctx.doFetch
+    });
+  } catch (err) {
+    const code = err instanceof OdlaError ? err.code : void 0;
+    if (code === "handshake_pending") throw stillPending(pending, ctx.email);
+    if (code === "handshake_expired" || code === "handshake_timeout") {
+      clearPendingHandshake(ctx.pendingFile);
+      ctx.out.log("auth: pending handshake lapsed unapproved; starting a fresh one");
+      return null;
+    }
+    if (code === "handshake_denied") clearPendingHandshake(ctx.pendingFile);
+    throw err;
+  } finally {
+    stopReminder();
+  }
+}
+async function freshHandshake(ctx, waitMs) {
+  let started;
+  let stopReminder;
+  try {
+    return await requestToken({
+      endpoint: ctx.cfg.platformUrl,
+      email: ctx.email,
+      label: `${ctx.cfg.app.id} provisioner`,
+      fetch: ctx.doFetch,
+      waitMs,
+      onCode: async ({ userCode, deviceCode, expiresIn, interval, verificationUriComplete }) => {
+        const approvalUrl = verificationUriComplete ?? handshakeUrl(ctx.cfg.platformUrl, userCode);
+        started = {
+          platform: ctx.audience,
+          email: ctx.email,
+          userCode,
+          deviceCode,
+          approvalUrl,
+          interval,
+          expiresAt: Date.now() + expiresIn * 1e3
+        };
+        writePendingHandshake(ctx.pendingFile, started);
+        ctx.out.log("");
+        ctx.out.log(`Review, then ${approvalHint(started)}.`);
+        await launchApproval(ctx, approvalUrl);
+        ctx.out.log("");
+        stopReminder = approvalReminder(ctx.out, started);
+      }
+    });
+  } catch (err) {
+    const code = err instanceof OdlaError ? err.code : void 0;
+    if (code === "handshake_pending" && started) throw stillPending(started, ctx.email);
+    if (code === "handshake_denied" || code === "handshake_expired" || code === "handshake_timeout") {
+      clearPendingHandshake(ctx.pendingFile);
+    }
+    throw err;
+  } finally {
+    stopReminder?.();
+  }
+}
+async function launchApproval(ctx, approvalUrl) {
+  if (ctx.browser.open) {
+    try {
+      await (ctx.options.openApprovalUrl ?? openUrl)(approvalUrl);
+      ctx.out.log(`auth: asked the OS to open a browser${ctx.browser.mode === "auto" ? " (auto)" : ""} \u2014 if no tab appeared, use the URL above`);
+    } catch (err) {
+      ctx.out.log(`auth: could not open browser (${err instanceof Error ? err.message : String(err)})`);
+    }
+  } else if (ctx.browser.reason) {
+    ctx.out.log(`auth: browser launch skipped (${ctx.browser.reason}) \u2014 show the human the URL above`);
+  }
+}
+function stillPending(pending, email) {
+  return new OdlaError(
+    "handshake_pending",
+    `handshake still pending \u2014 ask ${email} to ${approvalHint(pending)}, then re-run this command; it resumes the same handshake and collects the token`,
+    { retryable: true }
+  );
+}
 function handshakeEmail(value, cached) {
-  const email = (value ?? process3.env.ODLA_USER_EMAIL ?? cached ?? "").trim().toLowerCase();
+  const email = (value ?? process4.env.ODLA_USER_EMAIL ?? cached ?? "").trim().toLowerCase();
   if (email.length > 254 || !/^[^\s@]+@[^\s@]+\.[^\s@]+$/.test(email)) {
     throw new Error("a fresh odla handshake requires --email <account> or ODLA_USER_EMAIL");
   }
@@ -213,10 +331,11 @@ function handshakeEmail(value, cached) {
 function approvalBrowser(options, host = {}) {
   if (options.open === true) return { open: true, mode: "forced" };
   if (options.open === false) return { open: false, reason: "disabled by --no-open" };
-  const env = host.env ?? process3.env;
+  const env = host.env ?? process4.env;
+  if (env.VITEST || env.NODE_ENV === "test") return { open: false, reason: "test environment" };
   if (env.CI) return { open: false, reason: "CI environment" };
   if (env.SSH_CONNECTION || env.SSH_TTY) return { open: false, reason: "SSH session; pass --open to force" };
-  const platform = host.platform ?? process3.platform;
+  const platform = host.platform ?? process4.platform;
   if (platform !== "darwin" && platform !== "win32" && !env.DISPLAY && !env.WAYLAND_DISPLAY) {
     return { open: false, reason: "no graphical display; pass --open to force" };
   }
@@ -251,7 +370,7 @@ async function getScopedPlatformToken(options) {
 async function resolveAdminPlatformToken(options) {
   const audience = platformAudience(options.platform);
   if (options.token) return options.token;
-  const fromEnv = process4.env.ODLA_ADMIN_TOKEN;
+  const fromEnv = process5.env.ODLA_ADMIN_TOKEN;
   if (fromEnv) return audienceBoundEnvToken(fromEnv, audience);
   return scopedToken(
     audience,
@@ -263,7 +382,7 @@ async function resolveAdminPlatformToken(options) {
 }
 function audienceBoundEnvToken(token, platform) {
   const audience = platformAudience(platform);
-  const declared = process4.env.ODLA_ADMIN_TOKEN_AUDIENCE;
+  const declared = process5.env.ODLA_ADMIN_TOKEN_AUDIENCE;
   if (declared) {
     if (platformAudience(declared) !== audience) throw new Error("ODLA_ADMIN_TOKEN_AUDIENCE does not match the configured platform");
   } else if (audience !== "https://odla.ai") {
@@ -273,7 +392,7 @@ function audienceBoundEnvToken(token, platform) {
 }
 async function scopedToken(platform, scope, options, doFetch, out) {
   const audience = platformAudience(platform);
-  const tokenFile = options.tokenFile ?? `${process4.cwd()}/.odla/admin-token.local.json`;
+  const tokenFile = options.tokenFile ?? `${process5.cwd()}/.odla/admin-token.local.json`;
   const cache = readJsonFile(tokenFile);
   const cached = cache?.platform === audience ? cache.tokens?.[scope] : void 0;
   if (cached?.token && (cached.expiresAt ?? 0) > Date.now() + 6e4) {
@@ -297,7 +416,7 @@ async function scopedToken(platform, scope, options, doFetch, out) {
   });
   const tokens = cache?.platform === audience ? { ...cache.tokens ?? {} } : {};
   tokens[scope] = { token, expiresAt };
-  if (existsSync2(`${process4.cwd()}/.git`)) ensureGitignore(process4.cwd(), [tokenFile]);
+  if (existsSync2(`${process5.cwd()}/.git`)) ensureGitignore(process5.cwd(), [tokenFile]);
   writePrivateJson(tokenFile, { platform: audience, email, tokens });
   out.log(`auth: cached ${scope} grant (${tokenFile}; mode 0600)`);
   return token;
@@ -313,15 +432,15 @@ function requireSystemAiPurpose(value) {
 }
 
 // src/admin-ai.ts
-import process6 from "process";
+import process7 from "process";
 
 // src/secret-input.ts
-import process5 from "process";
+import process6 from "process";
 var MAX_BYTES = 64 * 1024;
 async function secretInputValue(options, kind = "credential") {
   if (options.fromEnv && options.stdin) throw new Error("choose exactly one of --from-env or --stdin");
   let value;
-  if (options.fromEnv) value = process5.env[options.fromEnv];
+  if (options.fromEnv) value = process6.env[options.fromEnv];
   else if (options.stdin) value = await (options.readStdin ?? (() => readSecretStream(kind)))();
   else throw new Error(`${kind} input required: use --from-env <NAME> or --stdin; values are never accepted as arguments`);
   value = value?.replace(/[\r\n]+$/, "");
@@ -329,7 +448,7 @@ async function secretInputValue(options, kind = "credential") {
   if (new TextEncoder().encode(value).byteLength > MAX_BYTES) throw new Error(`${kind} exceeds 64 KiB`);
   return value;
 }
-async function readSecretStream(kind, stream = process5.stdin) {
+async function readSecretStream(kind, stream = process6.stdin) {
   let value = "";
   for await (const chunk of stream) {
     value += String(chunk);
@@ -484,7 +603,7 @@ function isRecord2(value) {
 
 // src/admin-ai.ts
 async function adminAi(options) {
-  const platform = platformAudience(options.platform ?? process6.env.ODLA_PLATFORM ?? "https://odla.ai");
+  const platform = platformAudience(options.platform ?? process7.env.ODLA_PLATFORM ?? "https://odla.ai");
   const doFetch = options.fetch ?? fetch;
   const out = options.stdout ?? console;
   const usageQuery = options.action === "usage" ? adminAiUsageQuery(options) : void 0;
@@ -663,82 +782,97 @@ function isRecord3(value) {
   return Boolean(value) && typeof value === "object" && !Array.isArray(value);
 }
 
-// src/capabilities.ts
-var CAPABILITIES = {
-  cli: [
-    "start an email-bound device request without accepting a password or user session token",
-    "register the app and enable configured services per environment",
-    "issue, persist, and explicitly rotate configured service credentials",
-    "write local Worker values and push deployed Worker secrets through Wrangler stdin",
-    "store tenant-vault secrets (including the Clerk webhook secret and reserved Clerk secret key) write-only from stdin or an env var",
-    "push db schema/rules and configure platform AI, auth, and deployment links",
-    "apply read-only Google calendar mirror and public booking-page config, then drive state-bound consent, status, discovery, resync, and disconnect flows",
-    "validate config offline and smoke-test a provisioned db environment",
-    "run app-attributed hosted security discovery and independent validation without provider keys",
-    "connect/revoke source-read-only GitHub sources and drive commit-pinned hosted security jobs without PATs or provider keys",
-    "let admins manage system AI policy and credentials, inspect attributed usage, and read immutable admin changes through separate short-lived capability-only approvals"
-  ],
-  agent: [
-    "install and import the selected odla SDKs",
-    "wrap the Worker with withObservability and choose useful telemetry",
-    "make application-specific schema, rules, auth, UI, and migration decisions",
-    "wire @odla-ai/calendar into trusted Worker code and keep the app admin key out of browsers"
-  ],
-  human: [
-    "provide the existing odla account email, then sign in and explicitly review/approve the exact device code",
-    "review mirrored calendar/attendee disclosure and complete the server-issued Google consent flow",
-    "consent to production changes with --yes",
-    "request destructive credential rotation explicitly",
-    "review application semantics, security findings, releases, and merges",
-    "approve redacted-source disclosure before hosted security reasoning",
-    "approve GitHub App repository access separately from redacted-snippet disclosure"
-  ],
-  studio: [
-    "view telemetry and environment state",
-    "let signed-in users inventory/revoke their own agent grants and admins audit/global-revoke them",
-    "review calendar connection, granted read scope, selected calendars, and sync health without exposing provider tokens",
-    "perform manual credential recovery when the CLI's local shown-once copy is unavailable",
-    "configure system AI purposes and view app/environment/run-attributed usage",
-    "connect/revoke GitHub security sources and inspect ref-to-SHA jobs, routes, retention, coverage, and normalized reports"
-  ]
-};
-function printCapabilities(json = false, out = console) {
-  if (json) {
-    out.log(JSON.stringify(CAPABILITIES, null, 2));
-    return;
+// src/config.ts
+import { existsSync as existsSync3, readFileSync as readFileSync2 } from "fs";
+import { dirname as dirname3, isAbsolute as isAbsolute2, resolve as resolve2 } from "path";
+import { pathToFileURL } from "url";
+
+// src/integration-validation.ts
+function validateIntegrations(cfg, path, defaultServices) {
+  if (cfg.integrations === void 0) return;
+  if (!Array.isArray(cfg.integrations)) throw new Error(`${path}: integrations must be an array`);
+  const ids = /* @__PURE__ */ new Set();
+  for (const [index, integration] of cfg.integrations.entries()) {
+    const at = `${path}: integrations[${index}]`;
+    if (!isRecord4(integration)) throw new Error(`${at} must be an object`);
+    if (!validId(integration.id)) throw new Error(`${at}.id must be lowercase letters, numbers, and hyphens`);
+    if (ids.has(integration.id)) throw new Error(`${path}: duplicate integration id "${integration.id}"`);
+    ids.add(integration.id);
+    if (!safeText(integration.title, 200)) throw new Error(`${at}.title is required`);
+    if (!safeText(integration.npm, 200)) throw new Error(`${at}.npm is required`);
+    if (integration.schema !== void 0 && (!isRecord4(integration.schema) || !isRecord4(integration.schema.entities))) {
+      throw new Error(`${at}.schema must contain an entities object`);
+    }
+    if (integration.rules !== void 0 && !isRecord4(integration.rules)) throw new Error(`${at}.rules must be an object`);
+    validateSeeds(integration, at);
+    validateProbes(integration, at);
+  }
+  const needsDb = cfg.integrations.some((integration) => integration.schema || integration.rules || integration.seeds?.length);
+  const services = unique(cfg.services?.length ? cfg.services : defaultServices);
+  if (needsDb && !services.includes("db")) throw new Error(`${path}: schema/rules/seed integrations require the db service`);
+}
+function validateSeeds(integration, at) {
+  if (integration.seeds === void 0) return;
+  if (!Array.isArray(integration.seeds)) throw new Error(`${at}.seeds must be an array`);
+  const ids = /* @__PURE__ */ new Set();
+  for (const [index, seed] of integration.seeds.entries()) {
+    const sat = `${at}.seeds[${index}]`;
+    if (!isRecord4(seed) || !safeText(seed.id, 200) || !safeText(seed.ns, 200)) throw new Error(`${sat} requires id and ns`);
+    if (ids.has(seed.id)) throw new Error(`${at} has duplicate seed id "${seed.id}"`);
+    ids.add(seed.id);
+    if (!isRecord4(seed.key) || !safeText(seed.key.attr, 200) || !safeText(seed.key.value, 2048)) {
+      throw new Error(`${sat}.key requires string attr and value`);
+    }
+    if (!isRecord4(seed.attrs)) throw new Error(`${sat}.attrs must be an object`);
+    if (Object.hasOwn(seed.attrs, seed.key.attr) && seed.attrs[seed.key.attr] !== seed.key.value) {
+      throw new Error(`${sat}.attrs.${seed.key.attr} conflicts with its natural key`);
+    }
   }
-  out.log("odla-ai responsibility boundary\n");
-  printGroup(out, "CLI automates", CAPABILITIES.cli);
-  printGroup(out, "Coding agent changes source", CAPABILITIES.agent);
-  printGroup(out, "Human checkpoints", CAPABILITIES.human);
-  printGroup(out, "Studio", CAPABILITIES.studio);
 }
-function printGroup(out, heading, items) {
-  out.log(`${heading}:`);
-  for (const item of items) out.log(`  - ${item}`);
-  out.log("");
+function validateProbes(integration, at) {
+  if (integration.probes === void 0) return;
+  if (!Array.isArray(integration.probes)) throw new Error(`${at}.probes must be an array`);
+  for (const [index, probe] of integration.probes.entries()) {
+    const pat = `${at}.probes[${index}]`;
+    if (!isRecord4(probe) || !safeProbePath(probe.path)) throw new Error(`${pat}.path must be an absolute path without query or fragment`);
+    if (!Number.isInteger(probe.expectedStatus) || probe.expectedStatus < 100 || probe.expectedStatus > 599) {
+      throw new Error(`${pat}.expectedStatus must be an HTTP status`);
+    }
+  }
+}
+function isRecord4(value) {
+  return value !== null && typeof value === "object" && !Array.isArray(value);
+}
+function safeText(value, max) {
+  return typeof value === "string" && value.trim().length > 0 && value.length <= max && !/[\u0000-\u001f\u007f]/.test(value);
+}
+function safeProbePath(value) {
+  return typeof value === "string" && /^\/[A-Za-z0-9._~!$&'()*+,;=:@%/-]*$/.test(value);
+}
+function validId(value) {
+  return typeof value === "string" && /^[a-z0-9][a-z0-9-]*$/.test(value);
+}
+function unique(values) {
+  return [...new Set(values.filter(Boolean))];
 }
 
 // src/config.ts
-import { existsSync as existsSync3, readFileSync as readFileSync2 } from "fs";
-import { dirname as dirname2, isAbsolute as isAbsolute2, resolve as resolve2 } from "path";
-import { pathToFileURL } from "url";
 var DEFAULT_PLATFORM = "https://odla.ai";
 var DEFAULT_ENVS = ["dev"];
 var DEFAULT_SERVICES = ["db", "ai"];
-var GOOGLE_CALENDAR_READ_SCOPE = "https://www.googleapis.com/auth/calendar.events.readonly";
+var GOOGLE_CALENDAR_EVENTS_SCOPE = "https://www.googleapis.com/auth/calendar.events";
 async function loadProjectConfig(configPath = "odla.config.mjs") {
   const resolved = resolve2(configPath);
   if (!existsSync3(resolved)) {
     throw new Error(`config not found: ${configPath}. Run "odla-ai init" first or pass --config.`);
   }
   const raw = await loadConfigModule(resolved);
-  const rootDir = dirname2(resolved);
+  const rootDir = dirname3(resolved);
   validateRawConfig(raw, resolved);
   const platformUrl = trimSlash(process.env.ODLA_PLATFORM_URL || raw.platformUrl || DEFAULT_PLATFORM);
   const dbEndpoint = trimSlash(process.env.ODLA_DB_ENDPOINT || raw.dbEndpoint || platformUrl);
-  const envs = unique(raw.envs?.length ? raw.envs : DEFAULT_ENVS);
-  const services = unique(raw.services?.length ? raw.services : DEFAULT_SERVICES);
+  const envs = unique2(raw.envs?.length ? raw.envs : DEFAULT_ENVS);
+  const services = unique2(raw.services?.length ? raw.services : DEFAULT_SERVICES);
   validateCalendarConfig(raw, envs, services, resolved);
   const local = {
     tokenFile: resolve2(rootDir, raw.local?.tokenFile ?? ".odla/dev-token.json"),
@@ -772,6 +906,8 @@ async function resolveDataExport(cfg, value, names) {
   throw new Error(`${value} did not export ${names.join(", ")} or default`);
 }
 function buildPlan(cfg) {
+  const integrationSchema = cfg.integrations?.some((integration) => integration.schema) ?? false;
+  const integrationRules = cfg.integrations?.some((integration) => integration.rules) ?? false;
   return {
     appId: cfg.app.id,
     appName: cfg.app.name,
@@ -779,8 +915,9 @@ function buildPlan(cfg) {
     dbEndpoint: cfg.dbEndpoint,
     envs: cfg.envs,
     services: cfg.services,
-    hasSchema: !!cfg.db?.schema,
-    hasRules: !!cfg.db?.rules || !!cfg.db?.schema && cfg.db.defaultRules !== false,
+    integrations: (cfg.integrations ?? []).map((integration) => integration.id),
+    hasSchema: !!cfg.db?.schema || integrationSchema,
+    hasRules: !!cfg.db?.rules || integrationRules || (!!cfg.db?.schema || integrationSchema) && cfg.db?.defaultRules !== false,
     aiProvider: cfg.ai?.provider
   };
 }
@@ -789,16 +926,14 @@ function calendarServiceConfig(cfg, env) {
   if (!cfg.envs.includes(env)) throw new Error(`calendar env "${env}" is not declared in config envs`);
   const google = cfg.calendar?.google;
   if (!google) throw new Error("calendar.google is required when the calendar service is enabled");
+  const availability = unique2(
+    (google.availabilityCalendars?.[env] ?? google.calendars?.[env]).map((id) => id.trim())
+  );
   return {
     provider: "google",
-    access: "read",
-    calendars: unique(google.calendars[env].map((id) => id.trim())),
-    match: {
-      organizerSelf: google.match?.organizerSelf ?? true,
-      requireAttendees: google.match?.requireAttendees ?? true,
-      ...google.match?.summaryPrefix !== void 0 ? { summaryPrefix: google.match.summaryPrefix.trim() } : {}
-    },
-    attendeePolicy: google.attendeePolicy ?? "full"
+    access: "book",
+    bookingCalendarId: google.bookingCalendar?.[env]?.trim() ?? availability[0],
+    availabilityCalendars: availability
   };
 }
 function calendarBookingPageUrl(cfg, env) {
@@ -827,15 +962,16 @@ function validateRawConfig(raw, path) {
   if (!raw || typeof raw !== "object") throw new Error(`${path} must export an object`);
   const cfg = raw;
   if (!cfg.app || typeof cfg.app !== "object") throw new Error(`${path}: missing app object`);
-  if (!validId(cfg.app.id)) throw new Error(`${path}: app.id must be lowercase letters, numbers, and hyphens`);
+  if (!validId2(cfg.app.id)) throw new Error(`${path}: app.id must be lowercase letters, numbers, and hyphens`);
   if (!cfg.app.name || typeof cfg.app.name !== "string") throw new Error(`${path}: app.name is required`);
   if (cfg.envs !== void 0 && (!Array.isArray(cfg.envs) || cfg.envs.some((env) => typeof env !== "string"))) {
     throw new Error(`${path}: envs must be an array of names`);
   }
-  if (cfg.envs?.some((env) => !validId(env))) throw new Error(`${path}: env names must be lowercase letters, numbers, and hyphens`);
+  if (cfg.envs?.some((env) => !validId2(env))) throw new Error(`${path}: env names must be lowercase letters, numbers, and hyphens`);
   if (cfg.services !== void 0 && (!Array.isArray(cfg.services) || cfg.services.some((service) => typeof service !== "string" || !service.trim()))) {
     throw new Error(`${path}: services must be an array of non-empty names`);
   }
+  validateIntegrations(cfg, path, DEFAULT_SERVICES);
 }
 function validateCalendarConfig(cfg, envs, services, path) {
   const enabled = services.includes("calendar");
@@ -843,28 +979,47 @@ function validateCalendarConfig(cfg, envs, services, path) {
     if (enabled) throw new Error(`${path}: calendar.google is required when services includes "calendar"`);
     return;
   }
-  if (!isRecord4(cfg.calendar)) throw new Error(`${path}: calendar must be an object`);
+  if (!isRecord5(cfg.calendar)) throw new Error(`${path}: calendar must be an object`);
   assertOnly(cfg.calendar, ["google"], `${path}: calendar`);
-  if (!isRecord4(cfg.calendar.google)) throw new Error(`${path}: calendar.google must be an object`);
+  if (!isRecord5(cfg.calendar.google)) throw new Error(`${path}: calendar.google must be an object`);
   const google = cfg.calendar.google;
-  assertOnly(google, ["calendars", "bookingPageUrl", "match", "attendeePolicy"], `${path}: calendar.google`);
-  if (!isRecord4(google.calendars)) throw new Error(`${path}: calendar.google.calendars must map env names to calendar ids`);
-  const unknownEnv = Object.keys(google.calendars).find((env) => !envs.includes(env));
-  if (unknownEnv) throw new Error(`${path}: calendar.google.calendars.${unknownEnv} is not in config envs`);
+  assertOnly(
+    google,
+    ["availabilityCalendars", "calendars", "bookingCalendar", "bookingPageUrl"],
+    `${path}: calendar.google`
+  );
+  const availabilityKey = google.availabilityCalendars !== void 0 ? "availabilityCalendars" : google.calendars !== void 0 ? "calendars" : null;
+  if (!availabilityKey || google.availabilityCalendars !== void 0 && google.calendars !== void 0) {
+    throw new Error(`${path}: calendar.google requires exactly one of availabilityCalendars or calendars (legacy)`);
+  }
+  const availability = google[availabilityKey];
+  if (!isRecord5(availability)) throw new Error(`${path}: calendar.google.${availabilityKey} must map env names to calendar ids`);
+  const unknownEnv = Object.keys(availability).find((env) => !envs.includes(env));
+  if (unknownEnv) throw new Error(`${path}: calendar.google.${availabilityKey}.${unknownEnv} is not in config envs`);
   for (const env of envs) {
-    const ids = google.calendars[env];
+    const ids = availability[env];
     if (!Array.isArray(ids) || ids.length === 0) {
-      throw new Error(`${path}: calendar.google.calendars.${env} must be a non-empty array`);
+      throw new Error(`${path}: calendar.google.${availabilityKey}.${env} must be a non-empty array`);
     }
     if (ids.length > 10) {
-      throw new Error(`${path}: calendar.google.calendars.${env} must contain at most 10 calendar ids`);
+      throw new Error(`${path}: calendar.google.${availabilityKey}.${env} must contain at most 10 calendar ids`);
     }
-    if (ids.some((id) => !safeText(id, 1024))) {
-      throw new Error(`${path}: calendar.google.calendars.${env} contains an invalid calendar id`);
+    if (ids.some((id) => !safeText2(id, 1024))) {
+      throw new Error(`${path}: calendar.google.${availabilityKey}.${env} contains an invalid calendar id`);
+    }
+  }
+  if (google.bookingCalendar !== void 0) {
+    if (!isRecord5(google.bookingCalendar)) throw new Error(`${path}: calendar.google.bookingCalendar must map env names to one calendar id`);
+    const unknownBookingEnv = Object.keys(google.bookingCalendar).find((env) => !envs.includes(env));
+    if (unknownBookingEnv) throw new Error(`${path}: calendar.google.bookingCalendar.${unknownBookingEnv} is not in config envs`);
+    for (const [env, value] of Object.entries(google.bookingCalendar)) {
+      if (!safeText2(value, 1024)) {
+        throw new Error(`${path}: calendar.google.bookingCalendar.${env} must be a calendar id`);
+      }
     }
   }
   if (google.bookingPageUrl !== void 0) {
-    if (!isRecord4(google.bookingPageUrl)) throw new Error(`${path}: calendar.google.bookingPageUrl must map env names to HTTPS URLs or null`);
+    if (!isRecord5(google.bookingPageUrl)) throw new Error(`${path}: calendar.google.bookingPageUrl must map env names to HTTPS URLs or null`);
     const unknownBookingEnv = Object.keys(google.bookingPageUrl).find((env) => !envs.includes(env));
     if (unknownBookingEnv) throw new Error(`${path}: calendar.google.bookingPageUrl.${unknownBookingEnv} is not in config envs`);
     for (const [env, value] of Object.entries(google.bookingPageUrl)) {
@@ -873,31 +1028,16 @@ function validateCalendarConfig(cfg, envs, services, path) {
       }
     }
   }
-  if (google.attendeePolicy !== void 0 && google.attendeePolicy !== "full" && google.attendeePolicy !== "hashed") {
-    throw new Error(`${path}: calendar.google.attendeePolicy must be "full" or "hashed"`);
-  }
-  if (google.match !== void 0) {
-    if (!isRecord4(google.match)) throw new Error(`${path}: calendar.google.match must be an object`);
-    assertOnly(google.match, ["summaryPrefix", "organizerSelf", "requireAttendees"], `${path}: calendar.google.match`);
-    if (google.match.summaryPrefix !== void 0 && !safeText(google.match.summaryPrefix, 256)) {
-      throw new Error(`${path}: calendar.google.match.summaryPrefix must be 1-256 printable characters`);
-    }
-    for (const name of ["organizerSelf", "requireAttendees"]) {
-      if (google.match[name] !== void 0 && typeof google.match[name] !== "boolean") {
-        throw new Error(`${path}: calendar.google.match.${name} must be boolean`);
-      }
-    }
-  }
   if (enabled && !services.includes("db")) throw new Error(`${path}: calendar service requires the db service`);
 }
 function assertOnly(value, allowed, label) {
   const extra = Object.keys(value).find((key) => !allowed.includes(key));
   if (extra) throw new Error(`${label}.${extra} is not supported`);
 }
-function isRecord4(value) {
+function isRecord5(value) {
   return value !== null && typeof value === "object" && !Array.isArray(value);
 }
-function safeText(value, max) {
+function safeText2(value, max) {
   return typeof value === "string" && value.trim().length > 0 && value.length <= max && !/[\u0000-\u001f\u007f]/.test(value);
 }
 function safeHttpsUrl(value) {
@@ -909,7 +1049,7 @@ function safeHttpsUrl(value) {
     return false;
   }
 }
-function validId(value) {
+function validId2(value) {
   return typeof value === "string" && /^[a-z0-9][a-z0-9-]*$/.test(value);
 }
 async function loadConfigModule(path) {
@@ -922,10 +1062,66 @@ async function loadConfigModule(path) {
 function trimSlash(value) {
   return value.replace(/\/+$/, "");
 }
-function unique(values) {
+function unique2(values) {
   return [...new Set(values.filter(Boolean))];
 }
 
+// src/capabilities.ts
+var CAPABILITIES = {
+  cli: [
+    "start an email-bound device request without accepting a password or user session token",
+    "register the app and enable configured services per environment",
+    "issue, persist, and explicitly rotate configured service credentials",
+    "write local Worker values and push deployed Worker secrets through Wrangler stdin",
+    "store tenant-vault secrets (including the Clerk webhook secret and reserved Clerk secret key) write-only from stdin or an env var",
+    "compose declared app-capability schema/rules, create guarded seeds when absent, and configure platform AI, auth, and deployment links",
+    "apply Google Calendar booking config, then drive state-bound consent, status, discovery, and disconnect flows (bookings run live through the platform proxy)",
+    "validate integration contracts offline and smoke-test a provisioned db environment plus anonymous capability routes",
+    "run app-attributed hosted security discovery and independent validation without provider keys",
+    "connect/revoke source-read-only GitHub sources and drive commit-pinned hosted security jobs without PATs or provider keys",
+    "let admins manage system AI policy and credentials, inspect attributed usage, and read immutable admin changes through separate short-lived capability-only approvals"
+  ],
+  agent: [
+    "install and import the selected odla SDKs",
+    "wrap the Worker with withObservability and choose useful telemetry",
+    "install capability packages, mount their runtime routes, and make application-specific schema, rules, auth, UI, and migration decisions",
+    "wire @odla-ai/calendar into trusted Worker code and keep the app admin key out of browsers"
+  ],
+  human: [
+    "provide the existing odla account email, then sign in and explicitly review/approve the exact device code",
+    "review mirrored calendar/attendee disclosure and complete the server-issued Google consent flow",
+    "consent to production changes with --yes",
+    "request destructive credential rotation explicitly",
+    "review application semantics, security findings, releases, and merges",
+    "approve redacted-source disclosure before hosted security reasoning",
+    "approve GitHub App repository access separately from redacted-snippet disclosure"
+  ],
+  studio: [
+    "view telemetry and environment state",
+    "let signed-in users inventory/revoke their own agent grants and admins audit/global-revoke them",
+    "review calendar connection, granted read scope, selected calendars, and sync health without exposing provider tokens",
+    "perform manual credential recovery when the CLI's local shown-once copy is unavailable",
+    "configure system AI purposes and view app/environment/run-attributed usage",
+    "connect/revoke GitHub security sources and inspect ref-to-SHA jobs, routes, retention, coverage, and normalized reports"
+  ]
+};
+function printCapabilities(json = false, out = console) {
+  if (json) {
+    out.log(JSON.stringify(CAPABILITIES, null, 2));
+    return;
+  }
+  out.log("odla-ai responsibility boundary\n");
+  printGroup(out, "CLI automates", CAPABILITIES.cli);
+  printGroup(out, "Coding agent changes source", CAPABILITIES.agent);
+  printGroup(out, "Human checkpoints", CAPABILITIES.human);
+  printGroup(out, "Studio", CAPABILITIES.studio);
+}
+function printGroup(out, heading, items) {
+  out.log(`${heading}:`);
+  for (const item of items) out.log(`  - ${item}`);
+  out.log("");
+}
+
 // src/redact.ts
 var REPLACEMENTS = [
   [/odla_(sk|dev)_[A-Za-z0-9._-]+/g, "odla_$1_[redacted]"],
@@ -949,6 +1145,9 @@ function looksSecret(value) {
 var PLATFORM_NOT_READY_CODES = /* @__PURE__ */ new Set([
   "calendar_google_oauth_not_configured",
   "calendar_token_vault_not_configured",
+  // Current spelling (booking-era key verifier) plus the retired mirror-era
+  // ingress code, so the CLI stays resumable against either platform version.
+  "calendar_db_verifier_not_configured",
   "calendar_db_ingress_not_configured"
 ]);
 var CalendarRequestError = class extends Error {
@@ -971,8 +1170,6 @@ function isCalendarPlatformNotReady(error) {
 var CALENDAR_STATES = [
   "not_connected",
   "authorizing",
-  "needs_sync",
-  "initial_sync",
   "healthy",
   "degraded",
   "disconnected",
@@ -1020,9 +1217,6 @@ async function pollCalendarConnection(ctx, attemptId) {
     ctx.env
   );
 }
-async function requestCalendarResync(ctx) {
-  return parseCalendarStatus(await calendarJson(ctx, "/resync", { method: "POST", body: "{}" }), ctx.env);
-}
 async function requestCalendarDisconnect(ctx) {
   return parseCalendarStatus(
     await calendarJson(ctx, "/disconnect", { method: "POST", body: JSON.stringify({ purge: false }) }),
@@ -1033,10 +1227,8 @@ function parseCalendarStatus(raw, env) {
   const outer = wrapped(raw, "calendar");
   const value = record(outer.attempt) ?? record(outer.status) ?? outer;
   const connection = record(value.connection) ?? {};
-  const sync = record(value.sync) ?? record(connection.sync) ?? {};
   const config = record(value.config) ?? record(outer.config) ?? {};
   const googleConfig = record(config.google) ?? config;
-  const watches = record(value.watches) ?? {};
   const stateValue = calendarState(value.status ?? value.state ?? connection.status ?? connection.state);
   if (!stateValue) {
     throw new Error("calendar status returned an invalid connection state");
@@ -1046,31 +1238,29 @@ function parseCalendarStatus(raw, env) {
     throw new Error("calendar status returned an unsupported provider");
   }
   const accessValue = value.access ?? connection.access ?? config.access ?? googleConfig.access;
-  if (accessValue !== void 0 && accessValue !== "read") throw new Error("calendar status returned unsupported access");
-  const policyValue = value.attendeePolicy ?? config.attendeePolicy ?? googleConfig.attendeePolicy;
-  if (policyValue !== void 0 && policyValue !== "full" && policyValue !== "hashed") {
-    throw new Error("calendar status returned an invalid attendee policy");
+  if (accessValue !== void 0 && accessValue !== "book" && accessValue !== "read") {
+    throw new Error("calendar status returned unsupported access");
   }
   const errorValue = record(value.error) ?? record(connection.error);
   const errorCode = textField(value.lastErrorCode, 128);
   const bookingPageValue = Object.hasOwn(value, "bookingPageUrl") ? value.bookingPageUrl : Object.hasOwn(config, "bookingPageUrl") ? config.bookingPageUrl : googleConfig.bookingPageUrl;
+  const connected = typeof (value.connected ?? connection.connected) === "boolean" ? Boolean(value.connected ?? connection.connected) : ["healthy", "degraded"].includes(stateValue);
+  const bookingCalendarId = textField(value.bookingCalendarId ?? config.bookingCalendarId, 1024);
   return {
     env,
     enabled: typeof value.enabled === "boolean" ? value.enabled : true,
-    connected: typeof (value.connected ?? connection.connected) === "boolean" ? Boolean(value.connected ?? connection.connected) : ["needs_sync", "initial_sync", "healthy", "degraded"].includes(stateValue),
+    connected,
+    writable: typeof value.writable === "boolean" ? value.writable : stateValue === "healthy",
     provider: providerValue === "google" ? "google" : null,
     status: stateValue,
-    ...accessValue === "read" ? { access: "read" } : {},
-    calendars: calendarIds(value.configuredCalendars ?? value.calendars ?? config.calendars ?? googleConfig.calendars),
-    ...policyValue === "full" || policyValue === "hashed" ? { attendeePolicy: policyValue } : {},
-    ...typeof value.attendeePolicyLocked === "boolean" ? { attendeePolicyLocked: value.attendeePolicyLocked } : {},
+    ...accessValue !== void 0 ? { access: "book" } : {},
+    ...bookingCalendarId ? { bookingCalendarId } : {},
+    calendars: calendarIds(
+      value.availabilityCalendars ?? config.availabilityCalendars ?? value.configuredCalendars ?? value.calendars ?? config.calendars ?? googleConfig.calendars
+    ),
     ...optionalNullableUrl("bookingPageUrl", bookingPageValue),
     grantedScopes: stringList(value.grantedScopes ?? connection.grantedScopes ?? connection.scopes),
     ...optionalText("attemptId", value.attemptId ?? connection.attemptId, 180),
-    ...optionalNumber("lastSuccessfulSyncAt", value.lastSuccessfulSyncAt ?? sync.lastSuccessfulSyncAt),
-    ...optionalNumber("lastFullSyncAt", value.lastFullSyncAt ?? sync.lastFullSyncAt),
-    ...optionalNumber("watchExpiresAt", value.watchExpiresAt ?? sync.watchExpiresAt ?? watches.nextExpirationAt),
-    ...optionalInteger("bookingCount", value.bookingCount ?? sync.bookingCount),
     ...errorValue || errorCode ? { error: {
       ...textField(errorValue?.code, 128) ? { code: textField(errorValue?.code, 128) } : {},
       ...textField(errorValue?.message, 500) ? { message: textField(errorValue?.message, 500) } : {},
@@ -1085,7 +1275,9 @@ function calendarState(value) {
     disabled: "not_connected",
     disconnected: "disconnected",
     connecting: "authorizing",
-    syncing: "initial_sync",
+    syncing: "healthy",
+    needs_sync: "healthy",
+    initial_sync: "healthy",
     ready: "healthy",
     error: "failed"
   };
@@ -1153,13 +1345,6 @@ function optionalText(key, value, max) {
   const parsed = textField(value, max);
   return parsed ? { [key]: parsed } : {};
 }
-function optionalNumber(key, value) {
-  const parsed = timestamp3(value);
-  return parsed === void 0 ? {} : { [key]: parsed };
-}
-function optionalInteger(key, value) {
-  return Number.isSafeInteger(value) && value >= 0 ? { [key]: value } : {};
-}
 function optionalNullableUrl(key, value) {
   if (value === null) return { [key]: null };
   const parsed = textField(value, 4096);
@@ -1211,7 +1396,7 @@ async function calendarConnect(options) {
   const page = calendarBookingPageUrl(cfg, ctx.env);
   const applied = page === void 0 ? await readCalendarStatus(ctx) : await applyCalendarSettings(ctx, page);
   const connectOptions = connectionOptions(options, out);
-  return await continueConnectedCalendar(ctx, applied, connectOptions, false) ?? connectWithContext(ctx, connectOptions);
+  return await continueConnectedCalendar(ctx, applied, connectOptions) ?? connectWithContext(ctx, connectOptions);
 }
 async function applyCalendarBookingPage(ctx, bookingPageUrl, out) {
   if (bookingPageUrl === void 0) return null;
@@ -1219,25 +1404,18 @@ async function applyCalendarBookingPage(ctx, bookingPageUrl, out) {
   out.log(`${ctx.env}: calendar booking page ${bookingPageUrl ? "set" : "cleared"}`);
   return status;
 }
-async function calendarResync(options) {
-  const { ctx, out } = await lifecycleContext(options);
-  productionConsent(ctx.env, options.yes, "resync calendar");
-  const status = await requestCalendarResync(ctx);
-  out.log(`${ctx.env}: calendar resync requested (${status.status})`);
-  return status;
-}
 async function calendarDisconnect(options) {
   if (!options.yes) throw new Error("calendar disconnect requires --yes");
   const { ctx, out } = await lifecycleContext(options);
   const status = await requestCalendarDisconnect(ctx);
-  out.log(`${ctx.env}: calendar disconnected; retained mirror rows may now be stale`);
+  out.log(`${ctx.env}: calendar disconnected; no calendar data was stored`);
   return status;
 }
 async function ensureCalendarConnected(ctx, options) {
   const out = options.stdout ?? console;
   const current = await readCalendarStatus(ctx);
   const connectOptions = connectionOptions(options, out);
-  return await continueConnectedCalendar(ctx, current, connectOptions, true) ?? connectWithContext(ctx, connectOptions);
+  return await continueConnectedCalendar(ctx, current, connectOptions) ?? connectWithContext(ctx, connectOptions);
 }
 async function lifecycleContext(options) {
   const cfg = await loadProjectConfig(options.configPath);
@@ -1273,25 +1451,20 @@ function connectionOptions(options, out) {
     signal: options.signal
   };
 }
-async function continueConnectedCalendar(ctx, current, options, reuseDegraded) {
-  if (current.status === "healthy" || reuseDegraded && current.status === "degraded") {
-    options.out.log(`${ctx.env}: calendar ${reuseDegraded ? "connected" : "already connected"} (${current.status})`);
+async function continueConnectedCalendar(ctx, current, options) {
+  if (current.status === "healthy") {
+    options.out.log(`${ctx.env}: calendar already connected (healthy)`);
     return current;
   }
-  if (current.status === "degraded") return null;
-  if (current.status === "needs_sync") {
-    if (!current.connected) return null;
-    options.out.log(`${ctx.env}: calendar configuration needs sync`);
-    const synced = await requestCalendarResync(ctx);
-    options.out.log(`${ctx.env}: calendar ${synced.status.replaceAll("_", " ")}`);
-    return synced;
+  if (current.status === "degraded") {
+    options.out.log(`${ctx.env}: calendar grant predates booking scopes \u2014 Google re-consent required`);
+    return null;
   }
   if (current.status === "failed" && current.connected) {
     const reason = current.error?.message ?? current.error?.code;
-    throw new Error(`calendar connection failed${reason ? `: ${reason}` : ""}; inspect status and resync or reconnect explicitly`);
+    throw new Error(`calendar connection failed${reason ? `: ${reason}` : ""}; inspect status and reconnect explicitly`);
   }
-  const waitingForExisting = current.status === "authorizing" || current.status === "initial_sync" && current.connected;
-  if (!waitingForExisting) return null;
+  if (current.status !== "authorizing") return null;
   const now = options.now ?? Date.now;
   const deadline = now() + pollTimeout(options.pollTimeoutMs);
   const wait = options.wait ?? waitForCalendarPoll;
@@ -1303,17 +1476,16 @@ async function continueConnectedCalendar(ctx, current, options, reuseDegraded) {
       options.out.log(`${ctx.env}: calendar ${status.status.replaceAll("_", " ")}`);
       prior = status.status;
     }
-    if (status.status === "healthy" || reuseDegraded && status.status === "degraded") return status;
+    if (status.status === "healthy") return status;
     if (status.status === "degraded") return null;
-    if (status.status === "needs_sync") return requestCalendarResync(ctx);
     if (status.status === "failed" && status.connected) {
       const reason = status.error?.message ?? status.error?.code;
-      throw new Error(`calendar connection failed${reason ? `: ${reason}` : ""}; inspect status and resync or reconnect explicitly`);
+      throw new Error(`calendar connection failed${reason ? `: ${reason}` : ""}; inspect status and reconnect explicitly`);
     }
-    if (status.status !== "authorizing" && (status.status !== "initial_sync" || !status.connected)) return null;
+    if (status.status !== "authorizing") return null;
     await wait(Math.min(2e3, Math.max(0, deadline - now())), options.signal);
   }
-  throw new Error('Existing Google Calendar authorization or initial sync timed out; run "odla-ai calendar status" and retry');
+  throw new Error('Existing Google Calendar authorization timed out; run "odla-ai calendar status" and retry');
 }
 async function connectWithContext(ctx, options) {
   const attempt = await startCalendarConnection(ctx);
@@ -1335,14 +1507,17 @@ async function connectWithContext(ctx, options) {
       options.out.log(`${ctx.env}: calendar ${status.status.replaceAll("_", " ")}`);
       prior = status.status;
     }
-    if (status.status === "healthy" || status.status === "degraded") return status;
+    if (status.status === "healthy") return status;
+    if (status.status === "degraded") {
+      throw new Error("calendar connected without booking scopes; re-run connect and grant calendar access");
+    }
     if (status.status === "failed" || status.status === "disconnected" || status.status === "not_connected") {
       const reason = status.error?.message ?? status.error?.code;
       throw new Error(`calendar connection ${status.status}${reason ? `: ${reason}` : ""}`);
     }
     await wait(Math.min(2e3, Math.max(0, deadline - now())), options.signal);
   }
-  throw new Error('Google Calendar consent or initial sync timed out; run "odla-ai calendar status" and retry connect');
+  throw new Error('Google Calendar consent timed out; run "odla-ai calendar status" and retry connect');
 }
 function trustedCalendarConsentUrl(platform, value) {
   const origin = platformAudience(platform);
@@ -1372,26 +1547,22 @@ function printStatus(status, json, out) {
     return;
   }
   out.log(`calendar: ${status.provider ?? "none"}/${status.status} (${status.env})`);
-  out.log(`  access: ${status.access ?? "not granted"}`);
-  out.log(`  calendars: ${status.calendars.length ? status.calendars.join(", ") : "none"}`);
-  if (status.attendeePolicy) {
-    out.log(`  attendee policy: ${status.attendeePolicy}${status.attendeePolicyLocked ? " (locked)" : ""}`);
-  }
+  out.log(`  bookable: ${status.writable ? "yes" : status.connected ? "no \u2014 reconnect to grant booking scopes" : "no \u2014 not connected"}`);
+  if (status.bookingCalendarId) out.log(`  booking calendar: ${status.bookingCalendarId}`);
+  out.log(`  availability calendars: ${status.calendars.length ? status.calendars.join(", ") : "none"}`);
   if (status.bookingPageUrl !== void 0) out.log(`  booking page: ${status.bookingPageUrl ?? "not configured"}`);
-  out.log(`  last sync: ${status.lastSuccessfulSyncAt === void 0 ? "never" : new Date(status.lastSuccessfulSyncAt).toISOString()}`);
-  if (status.bookingCount !== void 0) out.log(`  bookings: ${status.bookingCount}`);
   if (status.error?.code || status.error?.message) out.log(`  error: ${status.error.code ?? "error"}${status.error.message ? ` \u2014 ${status.error.message}` : ""}`);
 }
 
 // src/doctor-checks.ts
 import { execFileSync } from "child_process";
 import { existsSync as existsSync5, readFileSync as readFileSync4 } from "fs";
-import { join as join2, resolve as resolve3 } from "path";
+import { join as join3, resolve as resolve3 } from "path";
 
 // src/wrangler.ts
 import { spawn as spawn2 } from "child_process";
 import { existsSync as existsSync4, readFileSync as readFileSync3 } from "fs";
-import { join } from "path";
+import { join as join2 } from "path";
 var defaultRunner = (cmd, args, opts) => new Promise((resolvePromise, reject) => {
   const child = spawn2(cmd, args, { cwd: opts?.cwd, stdio: ["pipe", "pipe", "pipe"] });
   let stdout = "";
@@ -1405,7 +1576,7 @@ var defaultRunner = (cmd, args, opts) => new Promise((resolvePromise, reject) =>
 var WRANGLER_CONFIG_FILES = ["wrangler.jsonc", "wrangler.json", "wrangler.toml"];
 function findWranglerConfig(rootDir) {
   for (const name of WRANGLER_CONFIG_FILES) {
-    const path = join(rootDir, name);
+    const path = join2(rootDir, name);
     if (existsSync4(path)) return path;
   }
   return null;
@@ -1514,7 +1685,7 @@ function wranglerWarnings(rootDir) {
       const dir = resolve3(rootDir, assets.directory);
       if (dir === resolve3(rootDir)) {
         warnings.push(`${label}assets.directory is the project root \u2014 point it at a dedicated build dir (wrangler dev fails with "spawn EBADF")`);
-      } else if (existsSync5(join2(dir, "node_modules"))) {
+      } else if (existsSync5(join3(dir, "node_modules"))) {
         warnings.push(`${label}assets.directory contains node_modules \u2014 wrangler dev's watcher will exhaust file descriptors`);
       }
     }
@@ -1579,32 +1750,136 @@ function calendarProjectWarnings(rootDir) {
 }
 function readPackageJson(rootDir) {
   try {
-    return JSON.parse(readFileSync4(join2(rootDir, "package.json"), "utf8"));
+    return JSON.parse(readFileSync4(join3(rootDir, "package.json"), "utf8"));
   } catch {
     return null;
   }
 }
 
+// src/integrations.ts
+import { isDeepStrictEqual } from "util";
+async function resolveDatabaseConfig(cfg, options = {}) {
+  const integrations = cfg.integrations ?? [];
+  if (!cfg.services.includes("db")) return { schema: void 0, rules: void 0, integrations };
+  const authoredSchema = await resolveDataExport(cfg, cfg.db?.schema, ["schema", "SCHEMA"]);
+  const schema = mergeSchemas(authoredSchema, integrations);
+  if (options.validateSeeds !== false) assertSeedContracts(integrations, schema);
+  const configuredRules = await resolveDataExport(cfg, cfg.db?.rules, ["rules", "RULES"]);
+  const explicitRules = mergeRules(configuredRules, integrations);
+  const rules = configuredRules === void 0 && schema && cfg.db?.defaultRules !== false ? { ...rulesFromSchema(schema), ...explicitRules ?? {} } : explicitRules;
+  return { schema, rules, integrations };
+}
+function integrationWarnings(integrations, schema, rules) {
+  const warnings = [];
+  const entities = new Set(serializedEntities(schema));
+  for (const integration of integrations) {
+    const namespaces = Object.keys(integration.schema?.entities ?? {});
+    for (const ns of namespaces) {
+      if (!entities.has(ns)) warnings.push(`integration "${integration.id}" schema namespace "${ns}" is missing`);
+      const rule = rules?.[ns];
+      if (!rule) {
+        warnings.push(`integration "${integration.id}" has no rules for "${ns}"`);
+        continue;
+      }
+      for (const action of ["view", "create", "update", "delete"]) {
+        if (rule[action] === void 0) warnings.push(`integration "${integration.id}" rule "${ns}.${action}" is missing`);
+      }
+    }
+    for (const seed of integration.seeds ?? []) {
+      if (!entities.has(seed.ns)) {
+        warnings.push(`integration "${integration.id}" seed "${seed.id}" targets unknown namespace "${seed.ns}"`);
+      } else if (!isUniqueAttr(schema, seed.ns, seed.key.attr)) {
+        warnings.push(`integration "${integration.id}" seed "${seed.id}" key "${seed.ns}.${seed.key.attr}" is not declared unique`);
+      }
+    }
+  }
+  return warnings;
+}
+function mergeSchemas(base, integrations) {
+  const fragments = integrations.filter((integration) => integration.schema);
+  if (fragments.length === 0) return base;
+  const merged = normalizeSchema(base);
+  for (const integration of fragments) {
+    const fragment = normalizeSchema(integration.schema);
+    mergeMap(merged.entities, fragment.entities, `integration "${integration.id}" schema namespace`);
+    mergeMap(merged.links, fragment.links, `integration "${integration.id}" schema link`);
+  }
+  return merged;
+}
+function mergeRules(base, integrations) {
+  const fragments = integrations.filter((integration) => integration.rules);
+  if (fragments.length === 0) return base;
+  const merged = { ...base ?? {} };
+  for (const integration of fragments) {
+    mergeMap(merged, integration.rules ?? {}, `integration "${integration.id}" rule namespace`);
+  }
+  return merged;
+}
+function assertSeedContracts(integrations, schema) {
+  const entities = new Set(serializedEntities(schema));
+  for (const integration of integrations) {
+    for (const seed of integration.seeds ?? []) {
+      if (!entities.has(seed.ns)) {
+        throw new Error(`integration "${integration.id}" seed "${seed.id}" targets unknown namespace "${seed.ns}"`);
+      }
+      if (!isUniqueAttr(schema, seed.ns, seed.key.attr)) {
+        throw new Error(`integration "${integration.id}" seed "${seed.id}" key "${seed.ns}.${seed.key.attr}" must be declared unique`);
+      }
+    }
+  }
+}
+function isUniqueAttr(schema, ns, attr) {
+  if (!isRecord6(schema) || !isRecord6(schema.entities)) return false;
+  const entity = schema.entities[ns];
+  if (!isRecord6(entity) || !isRecord6(entity.attrs)) return false;
+  const definition = entity.attrs[attr];
+  return isRecord6(definition) && definition.unique === true;
+}
+function normalizeSchema(value) {
+  if (value === void 0 || value === null) return { entities: {}, links: {} };
+  if (!isRecord6(value) || !isRecord6(value.entities)) {
+    throw new Error("db schema must be a serialized schema object with an entities map");
+  }
+  if (value.links !== void 0 && !isRecord6(value.links)) throw new Error("db schema links must be an object");
+  return {
+    entities: { ...value.entities },
+    links: { ...value.links ?? {} }
+  };
+}
+function mergeMap(target, fragment, label) {
+  for (const [name, value] of Object.entries(fragment)) {
+    if (Object.hasOwn(target, name) && !isDeepStrictEqual(target[name], value)) {
+      throw new Error(`${label} "${name}" conflicts with an existing definition`);
+    }
+    target[name] = value;
+  }
+}
+function isRecord6(value) {
+  return value !== null && typeof value === "object" && !Array.isArray(value);
+}
+
 // src/doctor.ts
 async function doctor(options) {
   const out = options.stdout ?? console;
   const cfg = await loadProjectConfig(options.configPath);
   const plan = buildPlan(cfg);
-  const hasDb = cfg.services.includes("db");
-  const schema = hasDb ? await resolveDataExport(cfg, cfg.db?.schema, ["schema", "SCHEMA"]) : void 0;
-  const configuredRules = hasDb ? await resolveDataExport(cfg, cfg.db?.rules, ["rules", "RULES"]) : void 0;
-  const rules = configuredRules ?? (schema && cfg.db?.defaultRules !== false ? rulesFromSchema(schema) : void 0);
+  const database = await resolveDatabaseConfig(cfg, { validateSeeds: false });
+  const { schema, rules } = database;
   const entities = serializedEntities(schema);
   out.log(`config: ${cfg.configPath}`);
   out.log(`app:    ${plan.appName} (${plan.appId})`);
   out.log(`envs:   ${plan.envs.join(", ")}`);
   out.log(`svc:    ${plan.services.join(", ")}`);
+  out.log(`integrations: ${plan.integrations.length ? plan.integrations.join(", ") : "none"}`);
   out.log(`schema: ${schema ? `${entities.length} entities` : "none"}`);
   out.log(`rules:  ${rules ? `${Object.keys(rules).length} namespaces` : "none"}`);
   out.log(`ai:     ${cfg.services.includes("ai") ? cfg.ai?.provider ?? "not configured" : "not enabled"}`);
   if (cfg.services.includes("calendar")) {
-    const calendar = cfg.envs.map((env) => `${env}:${calendarServiceConfig(cfg, env).calendars.length}`).join(", ");
-    out.log(`calendar: google/read-only (${calendar}; attendee ${cfg.calendar?.google.attendeePolicy ?? "full"})`);
+    const calendar = cfg.envs.map((env) => {
+      const resolved = calendarServiceConfig(cfg, env);
+      return `${env}:${resolved.bookingCalendarId}+${resolved.availabilityCalendars.length}`;
+    }).join(", ");
+    out.log(`calendar: google/booking (${calendar})`);
     const pages = cfg.envs.map((env) => `${env}:${calendarBookingPageUrl(cfg, env) ?? "none"}`).join(", ");
     out.log(`booking pages: ${pages}`);
   } else {
@@ -1617,6 +1892,7 @@ async function doctor(options) {
       if (entities.length > 0 && !entities.includes(ns)) warnings.push(`rules include "${ns}" but schema has no matching entity`);
     }
   }
+  warnings.push(...integrationWarnings(database.integrations, schema, rules));
   if (cfg.services.includes("ai") && !cfg.ai?.provider) warnings.push("ai service is enabled but ai.provider is not set");
   if (cfg.auth?.clerk) {
     for (const [env, value] of Object.entries(cfg.auth.clerk)) {
@@ -1657,7 +1933,7 @@ async function doctor(options) {
 
 // src/init.ts
 import { existsSync as existsSync6, mkdirSync as mkdirSync2, writeFileSync as writeFileSync2 } from "fs";
-import { dirname as dirname3, resolve as resolve4 } from "path";
+import { dirname as dirname4, resolve as resolve4 } from "path";
 function initProject(options) {
   const out = options.stdout ?? console;
   const rootDir = resolve4(options.rootDir ?? process.cwd());
@@ -1672,7 +1948,7 @@ function initProject(options) {
   const services = options.services?.length ? options.services : ["db", "ai"];
   if (services.includes("calendar") && !services.includes("db")) throw new Error("--services calendar requires db");
   const aiProvider = options.aiProvider ?? "anthropic";
-  mkdirSync2(dirname3(configPath), { recursive: true });
+  mkdirSync2(dirname4(configPath), { recursive: true });
   mkdirSync2(resolve4(rootDir, "src/odla"), { recursive: true });
   mkdirSync2(resolve4(rootDir, ".odla"), { recursive: true });
   writeFileSync2(configPath, configTemplate({ appId: options.appId, name: options.name, envs, services, aiProvider }));
@@ -1690,11 +1966,11 @@ function writeIfMissing(path, text) {
 function configTemplate(input) {
   const calendar = input.services.includes("calendar") ? `  calendar: {
     google: {
-      calendars: ${JSON.stringify(Object.fromEntries(input.envs.map((env) => [env, ["primary"]])))},
+      // Calendars consulted for availability; bookings land on bookingCalendar
+      // (defaults to the first availability calendar). Google consent happens
+      // in the browser during provision; bookings write live through odla.ai.
+      availabilityCalendars: ${JSON.stringify(Object.fromEntries(input.envs.map((env) => [env, ["primary"]])))},
       bookingPageUrl: ${JSON.stringify(Object.fromEntries(input.envs.map((env) => [env, null])))},
-      match: { organizerSelf: true, requireAttendees: true },
-      attendeePolicy: "full",
-      // Read-only in this release. Google consent happens in Studio during provision.
     },
   },
 ` : "";
@@ -1707,6 +1983,9 @@ function configTemplate(input) {
   },
   envs: ${JSON.stringify(input.envs)},
   services: ${JSON.stringify(input.services)},
+  // App capabilities are npm modules, not hosted services. Import their
+  // data-only descriptor and add it here (for example createCrmIntegration()).
+  integrations: [],
   db: {
     schema: "./src/odla/schema.mjs",
     rules: "./src/odla/rules.mjs",
@@ -1857,8 +2136,60 @@ function assertWranglerConfig(cfg) {
 
 // src/provision.ts
 import { createAppsClient, tenantIdFor as tenantIdFor2 } from "@odla-ai/apps";
-import { DEFAULT_SECRET_NAMES, putSecret } from "@odla-ai/ai";
-import process7 from "process";
+import { putSecret } from "@odla-ai/ai";
+import process8 from "process";
+
+// src/integration-provision.ts
+import { uuidv7 } from "@odla-ai/db";
+async function provisionIntegrationSeeds(doFetch, endpoint, tenantId, dbKey, integrations, env, out) {
+  const base = `${endpoint}/app/${encodeURIComponent(tenantId)}`;
+  for (const integration of integrations) {
+    for (const seed of integration.seeds ?? []) {
+      const payload = await postJson(doFetch, `${base}/query`, dbKey, {
+        query: { [seed.ns]: { $: { where: { [seed.key.attr]: seed.key.value }, limit: 1 } } }
+      });
+      const rows = isRecord7(payload) && isRecord7(payload.result) ? payload.result[seed.ns] : void 0;
+      if (!Array.isArray(rows)) {
+        throw new Error(`${env}: integration ${integration.id} seed ${seed.id} query returned an invalid response`);
+      }
+      if (rows.length > 0) {
+        out.log(`${env}: integration ${integration.id} seed ${seed.id} already exists`);
+        continue;
+      }
+      await postJson(doFetch, `${base}/transact`, dbKey, {
+        mutationId: `integration:${integration.id}:seed:${seed.id}`,
+        ops: [{
+          t: "update",
+          ns: seed.ns,
+          // A fresh id plus the declared-unique natural key is create-only: a
+          // concurrent creator gets a unique violation instead of being overwritten.
+          id: uuidv7(),
+          attrs: { ...seed.attrs, [seed.key.attr]: seed.key.value }
+        }]
+      });
+      out.log(`${env}: integration ${integration.id} seed ${seed.id} created`);
+    }
+  }
+}
+async function postJson(doFetch, url, bearer, body) {
+  const res = await doFetch(url, {
+    method: "POST",
+    headers: { authorization: `Bearer ${bearer}`, "content-type": "application/json" },
+    body: JSON.stringify(body)
+  });
+  if (!res.ok) throw new Error(`${new URL(url).pathname} failed: ${res.status} ${await responseText(res)}`);
+  return res.json().catch(() => ({}));
+}
+function isRecord7(value) {
+  return value !== null && typeof value === "object" && !Array.isArray(value);
+}
+async function responseText(res) {
+  try {
+    return redactSecrets((await res.text()).slice(0, 500));
+  } catch {
+    return "";
+  }
+}
 
 // src/provision-credentials.ts
 import { tenantIdFor } from "@odla-ai/apps";
@@ -1919,14 +2250,14 @@ async function mintDbKey(opts, tenantId) {
         appId: tenantId
       })
     });
-    if (!created.ok) throw new Error(`db app create (${tenantId}) failed: ${created.status} ${await safeText2(created)}`);
+    if (!created.ok) throw new Error(`db app create (${tenantId}) failed: ${created.status} ${await safeText3(created)}`);
     res = await opts.fetch(`${opts.cfg.dbEndpoint}/admin/apps/${encodeURIComponent(tenantId)}/keys`, {
       method: "POST",
       headers,
       body: "{}"
     });
   }
-  if (!res.ok) throw new Error(`db key mint (${tenantId}) failed: ${res.status} ${await safeText2(res)}`);
+  if (!res.ok) throw new Error(`db key mint (${tenantId}) failed: ${res.status} ${await safeText3(res)}`);
   const body = await res.json();
   if (!body.key) throw new Error(`db key mint (${tenantId}) returned no key`);
   return body.key;
@@ -1942,12 +2273,12 @@ async function issueO11yToken(opts) {
       `o11y token already exists for env "${opts.env}", but its shown-once value is not in the local credentials file; run "odla-ai provision --rotate-o11y-token --push-secrets" to replace it explicitly`
     );
   }
-  if (!res.ok) throw new Error(`o11y token ${opts.rotateO11y ? "rotation" : "issue"} (${opts.env}) failed: ${res.status} ${await safeText2(res)}`);
+  if (!res.ok) throw new Error(`o11y token ${opts.rotateO11y ? "rotation" : "issue"} (${opts.env}) failed: ${res.status} ${await safeText3(res)}`);
   const body = await res.json();
   if (!body.token) throw new Error(`o11y token ${opts.rotateO11y ? "rotation" : "issue"} (${opts.env}) returned no token`);
   return body.token;
 }
-async function safeText2(res) {
+async function safeText3(res) {
   try {
     return redactSecrets((await res.text()).slice(0, 500));
   } catch {
@@ -1955,6 +2286,18 @@ async function safeText2(res) {
   }
 }
 
+// src/provision-helpers.ts
+import { DEFAULT_SECRET_NAMES } from "@odla-ai/ai";
+function serviceRank(service) {
+  if (service === "db") return 0;
+  if (service === "calendar") return 2;
+  return 1;
+}
+function defaultSecretName(provider) {
+  const names = DEFAULT_SECRET_NAMES;
+  return names[provider] ?? `${provider}_api_key`;
+}
+
 // src/provision.ts
 async function provision(options) {
   const out = options.stdout ?? console;
@@ -1973,24 +2316,28 @@ async function provision(options) {
   out.log(`  db:       ${plan.dbEndpoint}`);
   out.log(`  envs:     ${plan.envs.join(", ")}`);
   out.log(`  services: ${plan.services.join(", ")}`);
+  out.log(`  integrations: ${plan.integrations.length ? plan.integrations.join(", ") : "none"}`);
   const productionEnvs = plan.envs.filter((env) => env === "prod" || env === "production");
   if (!options.dryRun && productionEnvs.length > 0 && !options.yes) {
     throw new Error(
       `refusing to provision production env ${productionEnvs.join(", ")} without --yes; run --dry-run first`
     );
   }
-  const schema = hasDb ? await resolveDataExport(cfg, cfg.db?.schema, ["schema", "SCHEMA"]) : void 0;
-  const configuredRules = hasDb ? await resolveDataExport(cfg, cfg.db?.rules, ["rules", "RULES"]) : void 0;
-  const rules = configuredRules ?? (schema && cfg.db?.defaultRules !== false ? rulesFromSchema(schema) : void 0);
+  const database = await resolveDatabaseConfig(cfg);
+  const { schema, rules } = database;
   if (options.dryRun) {
     out.log("dry run: no network calls or file writes");
     out.log(`  schema: ${schema ? "yes" : "no"}`);
     out.log(`  rules:  ${rules ? Object.keys(rules).length : 0} namespaces`);
+    for (const integration of database.integrations) {
+      const namespaces = Object.keys(integration.schema?.entities ?? {}).length;
+      out.log(`  integration.${integration.id}: ${namespaces} namespaces, ${integration.seeds?.length ?? 0} seeds, ${integration.probes?.length ?? 0} smoke probes`);
+    }
     out.log(`  ai:     ${cfg.services.includes("ai") ? cfg.ai?.provider ?? "not configured" : "not enabled"}`);
     if (cfg.services.includes("calendar")) {
       for (const env of cfg.envs) {
         const calendar = calendarServiceConfig(cfg, env);
-        out.log(`  calendar.${env}: google/read, ${calendar.calendars.join(", ")} (${calendar.attendeePolicy}; ${GOOGLE_CALENDAR_READ_SCOPE})`);
+        out.log(`  calendar.${env}: google/book \u2192 ${calendar.bookingCalendarId}; availability ${calendar.availabilityCalendars.join(", ")} (${GOOGLE_CALENDAR_EVENTS_SCOPE})`);
         const bookingPage = calendarBookingPageUrl(cfg, env);
         out.log(`  calendar.${env}.bookingPageUrl: ${bookingPage === void 0 ? "unchanged" : bookingPage ?? "clear"}`);
       }
@@ -2013,7 +2360,7 @@ async function provision(options) {
   }
   const devVarsTarget = resolveWriteDevVarsTarget(cfg, options.writeDevVars);
   if (cfg.local.gitignore) {
-    ensureGitignore(cfg.rootDir, [cfg.local.tokenFile, cfg.local.credentialsFile, ...devVarsTarget ? [devVarsTarget] : []]);
+    ensureGitignore(cfg.rootDir, [cfg.local.tokenFile, handshakeFile(cfg), cfg.local.credentialsFile, ...devVarsTarget ? [devVarsTarget] : []]);
   }
   if (options.pushSecrets) {
     await preflightSecretsPush({ configPath: cfg.configPath, runner: options.secretRunner });
@@ -2095,15 +2442,18 @@ ${env}: credentials are already saved; retry "odla-ai secrets push --env ${env}$
       }
     }
     if (schema && dbKey) {
-      await postJson(doFetch, `${cfg.dbEndpoint}/app/${encodeURIComponent(tenantId)}/schema`, dbKey, { schema });
+      await postJson2(doFetch, `${cfg.dbEndpoint}/app/${encodeURIComponent(tenantId)}/schema`, dbKey, { schema });
       out.log(`${env}: schema pushed`);
     }
     if (rules) {
-      await postJson(doFetch, `${cfg.dbEndpoint}/app/${encodeURIComponent(tenantId)}/admin/rules`, token, rules);
+      await postJson2(doFetch, `${cfg.dbEndpoint}/app/${encodeURIComponent(tenantId)}/admin/rules`, token, rules);
       out.log(`${env}: rules pushed (${Object.keys(rules).length} namespaces)`);
     }
+    if (dbKey) {
+      await provisionIntegrationSeeds(doFetch, cfg.dbEndpoint, tenantId, dbKey, database.integrations, env, out);
+    }
     if (cfg.services.includes("ai") && cfg.ai?.provider && cfg.ai.keyEnv) {
-      const key = process7.env[cfg.ai.keyEnv];
+      const key = process8.env[cfg.ai.keyEnv];
       if (key) {
         const secretName = cfg.ai.secretName ?? defaultSecretName(cfg.ai.provider);
         await putSecret({ endpoint: cfg.dbEndpoint, token, fetch: doFetch }, tenantId, secretName, key);
@@ -2142,11 +2492,6 @@ ${env}: credentials are already saved; retry "odla-ai secrets push --env ${env}$
     }
   }
 }
-function serviceRank(service) {
-  if (service === "db") return 0;
-  if (service === "calendar") return 2;
-  return 1;
-}
 async function readRegistryApp(cfg, token, doFetch) {
   const res = await doFetch(`${cfg.platformUrl}/registry/apps/${encodeURIComponent(cfg.app.id)}`, {
     headers: { authorization: `Bearer ${token}` }
@@ -2156,13 +2501,13 @@ async function readRegistryApp(cfg, token, doFetch) {
   const json = await res.json();
   return json.app ?? null;
 }
-async function postJson(doFetch, url, bearer, body) {
+async function postJson2(doFetch, url, bearer, body) {
   const res = await doFetch(url, {
     method: "POST",
     headers: { authorization: `Bearer ${bearer}`, "content-type": "application/json" },
     body: JSON.stringify(body)
   });
-  if (!res.ok) throw new Error(`${new URL(url).pathname} failed: ${res.status} ${await safeText3(res)}`);
+  if (!res.ok) throw new Error(`${new URL(url).pathname} failed: ${res.status} ${await safeText4(res)}`);
 }
 function normalizeClerkConfig(value) {
   if (!value) return null;
@@ -2175,11 +2520,7 @@ function normalizeClerkConfig(value) {
   const publishableKey = envValue(cfg.publishableKey);
   return publishableKey ? { publishableKey, ...cfg.audience ? { audience: cfg.audience } : {}, ...cfg.mode ? { mode: cfg.mode } : {} } : null;
 }
-function defaultSecretName(provider) {
-  const names = DEFAULT_SECRET_NAMES;
-  return names[provider] ?? `${provider}_api_key`;
-}
-async function safeText3(res) {
+async function safeText4(res) {
   try {
     return redactSecrets((await res.text()).slice(0, 500));
   } catch {
@@ -2735,7 +3076,7 @@ function securityExecutionDigest(value) {
 // src/skill.ts
 import { existsSync as existsSync7, lstatSync, mkdirSync as mkdirSync3, readFileSync as readFileSync5, readdirSync, writeFileSync as writeFileSync3 } from "fs";
 import { homedir } from "os";
-import { dirname as dirname4, isAbsolute as isAbsolute4, join as join3, relative as relative3, resolve as resolve6, sep as sep2 } from "path";
+import { dirname as dirname5, isAbsolute as isAbsolute4, join as join4, relative as relative3, resolve as resolve6, sep as sep2 } from "path";
 import { fileURLToPath } from "url";
 
 // src/skill-adapters.ts
@@ -2811,48 +3152,48 @@ function installSkill(options = {}) {
     plans.set(target, { target, content, boundary, managedMerge });
   };
   const planSkillTree = (targetDir2, boundary = root) => {
-    for (const rel of files) plan(join3(targetDir2, rel), readFileSync5(join3(sourceDir, rel), "utf8"), false, boundary);
+    for (const rel of files) plan(join4(targetDir2, rel), readFileSync5(join4(sourceDir, rel), "utf8"), false, boundary);
   };
   let targetDir;
   if (options.global) {
-    const claudeRoot = join3(home, ".claude", "skills");
-    const codexRoot = resolve6(options.codexHomeDir ?? process.env.CODEX_HOME ?? join3(home, ".codex"), "skills");
+    const claudeRoot = join4(home, ".claude", "skills");
+    const codexRoot = resolve6(options.codexHomeDir ?? process.env.CODEX_HOME ?? join4(home, ".codex"), "skills");
     targetDir = harnesses[0] === "codex" ? codexRoot : claudeRoot;
     for (const harness of harnesses) {
       const skillRoot = harness === "claude" ? claudeRoot : codexRoot;
-      planSkillTree(skillRoot, harness === "claude" ? home : dirname4(dirname4(codexRoot)));
+      planSkillTree(skillRoot, harness === "claude" ? home : dirname5(dirname5(codexRoot)));
       rememberTarget(harness, skillRoot);
     }
   } else {
-    const sharedRoot = join3(root, ".agents", "skills");
+    const sharedRoot = join4(root, ".agents", "skills");
     planSkillTree(sharedRoot);
-    const claudeRoot = join3(root, ".claude", "skills");
+    const claudeRoot = join4(root, ".claude", "skills");
     targetDir = harnesses.includes("claude") ? claudeRoot : sharedRoot;
     for (const harness of harnesses) rememberTarget(harness, sharedRoot);
     if (harnesses.includes("claude")) {
       for (const skill of skillNames(files)) {
-        const canonical = readFileSync5(join3(sourceDir, skill, "SKILL.md"), "utf8");
-        plan(join3(claudeRoot, skill, "SKILL.md"), claudeAdapter(skill, canonical));
+        const canonical = readFileSync5(join4(sourceDir, skill, "SKILL.md"), "utf8");
+        plan(join4(claudeRoot, skill, "SKILL.md"), claudeAdapter(skill, canonical));
       }
       rememberTarget("claude", claudeRoot);
     }
     if (harnesses.includes("cursor")) {
-      const cursorRule = join3(root, ".cursor", "rules", "odla.mdc");
+      const cursorRule = join4(root, ".cursor", "rules", "odla.mdc");
       plan(cursorRule, CURSOR_RULE);
       rememberTarget("cursor", cursorRule);
     }
     if (harnesses.includes("agents")) {
-      const agentsFile = join3(root, "AGENTS.md");
+      const agentsFile = join4(root, "AGENTS.md");
       plan(agentsFile, managedFileContent(agentsFile, PROJECT_INSTRUCTIONS, options.force === true, root), true);
       rememberTarget("agents", agentsFile);
     }
     if (harnesses.includes("copilot")) {
-      const copilotFile = join3(root, ".github", "copilot-instructions.md");
+      const copilotFile = join4(root, ".github", "copilot-instructions.md");
       plan(copilotFile, managedFileContent(copilotFile, PROJECT_INSTRUCTIONS, options.force === true, root), true);
       rememberTarget("copilot", copilotFile);
     }
     if (harnesses.includes("gemini")) {
-      const geminiFile = join3(root, "GEMINI.md");
+      const geminiFile = join4(root, "GEMINI.md");
       plan(geminiFile, managedFileContent(geminiFile, PROJECT_INSTRUCTIONS, options.force === true, root), true);
       rememberTarget("gemini", geminiFile);
     }
@@ -2888,7 +3229,7 @@ ${conflicts.map((f) => `  - ${f}`).join("\n")}`
   }
   for (const file of plans.values()) {
     if (!existsSync7(file.target) || readFileSync5(file.target, "utf8") !== file.content) {
-      mkdirSync3(dirname4(file.target), { recursive: true });
+      mkdirSync3(dirname5(file.target), { recursive: true });
       writeFileSync3(file.target, file.content);
     }
   }
@@ -2959,7 +3300,7 @@ function symlinkedComponent(boundary, target) {
   }
   let current = boundary;
   for (const part of rel.split(sep2).filter(Boolean)) {
-    current = join3(current, part);
+    current = join4(current, part);
     try {
       if (lstatSync(current).isSymbolicLink()) return current;
     } catch (error) {
@@ -2976,7 +3317,7 @@ function listFiles(dir) {
   const results = [];
   const walk = (current) => {
     for (const entry of readdirSync(current, { withFileTypes: true })) {
-      const path = join3(current, entry.name);
+      const path = join4(current, entry.name);
       if (entry.isDirectory()) walk(path);
       else results.push(relative3(dir, path));
     }
@@ -3029,9 +3370,10 @@ async function smoke(options) {
     );
     const status = await readCalendarStatus({ platform: cfg.platformUrl, appId: cfg.app.id, env, token, fetch: doFetch });
     assertCalendarHealthy(status, calendarServiceConfig(cfg, env));
-    out.log(`  calendar: ${status.status}, last sync ${new Date(status.lastSuccessfulSyncAt).toISOString()}`);
+    out.log(`  calendar: ${status.status}, bookable (booking \u2192 ${status.bookingCalendarId ?? "primary"})`);
   }
-  const expectedSchema = await resolveDataExport(cfg, cfg.db?.schema, ["schema", "SCHEMA"]);
+  const database = await resolveDatabaseConfig(cfg);
+  const expectedSchema = database.schema;
   const expectedEntities = serializedEntities(expectedSchema);
   const liveSchemaPayload = await getJson(doFetch, `${cfg.dbEndpoint}/app/${encodeURIComponent(entry.tenantId)}/schema`, entry.dbKey);
   const liveSchema = liveSchemaPayload.schema ?? liveSchemaPayload;
@@ -3043,7 +3385,7 @@ async function smoke(options) {
   out.log(`  schema: ${liveEntities.length} entities`);
   const aggregateEntity = expectedEntities[0] ?? liveEntities[0];
   if (aggregateEntity) {
-    const aggregate = await postJson2(doFetch, `${cfg.dbEndpoint}/app/${encodeURIComponent(entry.tenantId)}/aggregate`, entry.dbKey, {
+    const aggregate = await postJson3(doFetch, `${cfg.dbEndpoint}/app/${encodeURIComponent(entry.tenantId)}/aggregate`, entry.dbKey, {
       ns: aggregateEntity,
       aggregate: { count: true }
     });
@@ -3052,13 +3394,20 @@ async function smoke(options) {
   } else {
     out.log(`  aggregate: skipped (schema has no entities)`);
   }
-  if (cfg.services.includes("calendar")) {
-    const bookings = await postJson2(doFetch, `${cfg.dbEndpoint}/app/${encodeURIComponent(entry.tenantId)}/aggregate`, entry.dbKey, {
-      ns: "$bookings",
-      aggregate: { count: true }
-    });
-    const count = bookings.aggregate?.count;
-    out.log(`  bookings: ${String(count ?? "ok")}`);
+  const probes = database.integrations.flatMap(
+    (integration) => (integration.probes ?? []).map((probe) => ({ integration: integration.id, probe }))
+  );
+  if (probes.length) {
+    const link = cfg.links?.[env];
+    if (!link) throw new Error(`integration smoke probes require links.${env} in odla.config.mjs`);
+    for (const { integration, probe } of probes) {
+      const probeUrl = new URL(probe.path, link).toString();
+      const res = await doFetch(probeUrl, { redirect: "manual" });
+      if (res.status !== probe.expectedStatus) {
+        throw new Error(`integration "${integration}" probe ${probe.path} returned ${res.status}; expected ${probe.expectedStatus}`);
+      }
+      out.log(`  integration.${integration}: ${probe.path} \u2192 ${res.status}`);
+    }
   }
   out.log("ok");
 }
@@ -3067,29 +3416,26 @@ function assertCalendarHealthy(status, expected) {
   if (status.status !== "healthy") {
     throw new Error(`calendar connection is ${status.status}${status.error?.message ? `: ${status.error.message}` : ""}`);
   }
-  if (status.access !== "read") throw new Error("calendar connection is not read-only");
-  const hasReadScope = status.grantedScopes.some((scope) => scope === GOOGLE_CALENDAR_READ_SCOPE || scope === "calendar.events.readonly");
-  if (!hasReadScope) throw new Error("calendar connection is missing calendar.events.readonly consent");
-  const missing = expected.calendars.filter((id) => !status.calendars.includes(id));
+  if (!status.writable) throw new Error('calendar grant does not cover booking writes; run "odla-ai calendar connect" to re-consent');
+  const hasEventsScope = status.grantedScopes.some((scope) => scope === GOOGLE_CALENDAR_EVENTS_SCOPE);
+  if (!hasEventsScope) throw new Error("calendar connection is missing calendar.events consent");
+  const missing = expected.availabilityCalendars.filter((id) => !status.calendars.includes(id));
   if (missing.length) throw new Error(`calendar connection is missing configured calendars: ${missing.join(", ")}`);
-  if (status.lastSuccessfulSyncAt === void 0) throw new Error("calendar has never completed a sync");
-  if (Date.now() - status.lastSuccessfulSyncAt > 30 * 6e4) throw new Error("calendar sync is more than 30 minutes stale");
-  if (status.watchExpiresAt !== void 0 && status.watchExpiresAt <= Date.now()) throw new Error("calendar watch channel is expired");
 }
 async function getJson(doFetch, url, bearer) {
   const res = await doFetch(url, {
     headers: bearer ? { authorization: `Bearer ${bearer}` } : void 0
   });
-  if (!res.ok) throw new Error(`${new URL(url).pathname} returned ${res.status}: ${await safeText4(res)}`);
+  if (!res.ok) throw new Error(`${new URL(url).pathname} returned ${res.status}: ${await safeText5(res)}`);
   return res.json();
 }
-async function postJson2(doFetch, url, bearer, body) {
+async function postJson3(doFetch, url, bearer, body) {
   const res = await doFetch(url, {
     method: "POST",
     headers: { authorization: `Bearer ${bearer}`, "content-type": "application/json" },
     body: JSON.stringify(body)
   });
-  if (!res.ok) throw new Error(`${new URL(url).pathname} returned ${res.status}: ${await safeText4(res)}`);
+  if (!res.ok) throw new Error(`${new URL(url).pathname} returned ${res.status}: ${await safeText5(res)}`);
   return res.json();
 }
 function publicConfigUrl(platformUrl, appId, env) {
@@ -3097,7 +3443,7 @@ function publicConfigUrl(platformUrl, appId, env) {
   url.searchParams.set("env", env);
   return url.toString();
 }
-async function safeText4(res) {
+async function safeText5(res) {
   try {
     return (await res.text()).slice(0, 500);
   } catch {
@@ -3241,6 +3587,127 @@ async function adminCommand(parsed) {
   });
 }
 
+// src/app-export.ts
+import { createWriteStream } from "fs";
+import { Readable } from "stream";
+import { pipeline } from "stream/promises";
+async function appExport(options) {
+  const cfg = await loadProjectConfig(options.configPath);
+  const out = options.stdout ?? console;
+  const doFetch = options.fetch ?? fetch;
+  const env = options.env ?? (cfg.envs.includes("dev") ? "dev" : cfg.envs[0]);
+  if (!env || !cfg.envs.includes(env)) throw new Error(`env "${env ?? ""}" is not declared in ${options.configPath}`);
+  const tenant = env === "prod" ? cfg.app.id : `${cfg.app.id}--${env}`;
+  const token = await getDeveloperToken(
+    cfg,
+    { configPath: cfg.configPath, token: options.token, email: options.email, open: false },
+    doFetch,
+    out
+  );
+  const auth = { authorization: `Bearer ${token}` };
+  const base = `${cfg.dbEndpoint}/admin/apps/${encodeURIComponent(tenant)}`;
+  if (options.fresh) {
+    const res = await doFetch(`${base}/export`, { method: "POST", headers: auth });
+    const body = await res.json().catch(() => ({}));
+    if (!res.ok) throw new Error(`export failed${body.error?.code ? ` (${body.error.code})` : ""}: ${body.error?.message ?? res.status}`);
+  }
+  const list = await doFetch(`${base}/backups`, { headers: auth });
+  if (!list.ok) throw new Error(`couldn't list backups (${list.status})`);
+  const { backups } = await list.json();
+  const newest = backups[0];
+  if (!newest) {
+    throw new Error(
+      `${tenant} has no backups yet \u2014 run \`odla-ai app export --fresh\` to take one now (nightly snapshots appear after the first day with writes)`
+    );
+  }
+  const download = await doFetch(`${base}/backups/${newest.id}/download`, { headers: auth });
+  if (!download.ok || !download.body) throw new Error(`download failed (${download.status})`);
+  const file = options.out ?? `${tenant}-${new Date(newest.created_at).toISOString().slice(0, 10)}-tx${newest.max_tx}.jsonl.gz`;
+  await pipeline(Readable.fromWeb(download.body), createWriteStream(file));
+  if (options.json) out.log(JSON.stringify({ file, backup: newest }, null, 2));
+  else {
+    out.log(`${tenant}: wrote ${file} (${newest.bytes} bytes, ${newest.kind} snapshot at tx ${newest.max_tx})`);
+    out.log(`sha256 ${download.headers.get("x-odla-sha256") ?? newest.sha256}`);
+  }
+  return { file, backup: newest };
+}
+
+// src/app-lifecycle.ts
+async function lifecycleCall(action, options) {
+  const cfg = await loadProjectConfig(options.configPath);
+  const out = options.stdout ?? console;
+  const doFetch = options.fetch ?? fetch;
+  const token = await getDeveloperToken(
+    cfg,
+    { configPath: cfg.configPath, token: options.token, email: options.email, open: false },
+    doFetch,
+    out
+  );
+  const res = await doFetch(`${cfg.platformUrl}/registry/apps/${encodeURIComponent(cfg.app.id)}/${action}`, {
+    method: "POST",
+    headers: { authorization: `Bearer ${token}`, "content-type": "application/json" }
+  });
+  const body = await res.json().catch(() => ({}));
+  if (!res.ok || !body.ok) {
+    throw new Error(`${action} failed${body.error?.code ? ` (${body.error.code})` : ""}: ${body.error?.message ?? `registry returned ${res.status}`}`);
+  }
+  return body;
+}
+async function appArchive(options) {
+  if (options.yes !== true) {
+    throw new Error(
+      "app archive suspends EVERY environment: API keys stop working and all services refuse requests until restored. All data is retained. Pass --yes to proceed."
+    );
+  }
+  const out = options.stdout ?? console;
+  const body = await lifecycleCall("archive", options);
+  if (options.json) out.log(JSON.stringify(body, null, 2));
+  else if (body.operation?.state === "noop") out.log(`${body.app?.appId}: already archived`);
+  else out.log(`${body.app?.appId}: archived \u2014 data retained; run \`odla-ai app restore\` (or use Studio) to bring it back`);
+}
+async function appRestore(options) {
+  const out = options.stdout ?? console;
+  const body = await lifecycleCall("restore", options);
+  if (options.json) out.log(JSON.stringify(body, null, 2));
+  else if (body.operation?.state === "noop") out.log(`${body.app?.appId}: already active`);
+  else out.log(`${body.app?.appId}: restored \u2014 every service's data plane is live again`);
+}
+async function appCommand(parsed, dependencies = {}) {
+  const sub = parsed.positionals[1];
+  if (sub === "export") {
+    assertArgs(parsed, ["config", "env", "token", "email", "fresh", "out", "json"], 2);
+    await appExport({
+      configPath: stringOpt(parsed.options.config) ?? "odla.config.mjs",
+      env: stringOpt(parsed.options.env),
+      token: stringOpt(parsed.options.token),
+      email: stringOpt(parsed.options.email),
+      fresh: parsed.options.fresh === true,
+      out: stringOpt(parsed.options.out),
+      json: parsed.options.json === true,
+      fetch: dependencies.fetch,
+      stdout: dependencies.stdout
+    });
+    return;
+  }
+  if (sub !== "archive" && sub !== "restore") {
+    throw new Error(
+      `unknown app subcommand "${sub ?? ""}". Try "odla-ai app archive --yes", "odla-ai app restore", or "odla-ai app export". (Permanent deletion has no CLI: it requires a signed-in owner in Studio.)`
+    );
+  }
+  assertArgs(parsed, ["config", "token", "email", "yes", "json"], 2);
+  const options = {
+    configPath: stringOpt(parsed.options.config) ?? "odla.config.mjs",
+    token: stringOpt(parsed.options.token),
+    email: stringOpt(parsed.options.email),
+    yes: parsed.options.yes === true,
+    json: parsed.options.json === true,
+    fetch: dependencies.fetch,
+    stdout: dependencies.stdout
+  };
+  if (sub === "archive") await appArchive(options);
+  else await appRestore(options);
+}
+
 // src/help.ts
 import { readFileSync as readFileSync6 } from "fs";
 function cliVersion() {
@@ -3257,8 +3724,10 @@ Usage:
   odla-ai calendar status [--env dev] [--email <odla-account>] [--json]
   odla-ai calendar calendars [--env dev] [--email <odla-account>] [--json]
   odla-ai calendar connect [--env dev] [--email <odla-account>] [--no-open] [--yes]
-  odla-ai calendar resync [--env dev] [--email <odla-account>] [--yes]
   odla-ai calendar disconnect [--env dev] [--email <odla-account>] --yes
+  odla-ai app archive [--config odla.config.mjs] [--email <odla-account>] [--json] --yes
+  odla-ai app restore [--config odla.config.mjs] [--email <odla-account>] [--json]
+  odla-ai app export [--env dev] [--fresh] [--out <file>] [--email <odla-account>] [--json]
   odla-ai capabilities [--json]
   odla-ai admin ai show [--platform https://odla.ai] [--email <odla-account>] [--json]
   odla-ai admin ai models [--provider <id>] [--json]
@@ -3278,7 +3747,7 @@ Usage:
   odla-ai security report <job-id> [--json]
   odla-ai security run [target] --ack-redacted-source [--env dev] [--profile odla] [--fail-on high]
   odla-ai security run [target] --self --ack-redacted-source
-  odla-ai provision [--config odla.config.mjs] [--email <odla-account>] [--dry-run] [--push-secrets] [--rotate-o11y-token] [--write-dev-vars[=path]] [--yes]
+  odla-ai provision [--config odla.config.mjs] [--email <odla-account>] [--wait <seconds>] [--dry-run] [--push-secrets] [--rotate-o11y-token] [--write-dev-vars[=path]] [--yes]
   odla-ai smoke [--config odla.config.mjs] [--env dev] [--email <odla-account>] [--no-open]
   odla-ai skill install [--dir <project>] [--agent <name>] [--global] [--force]
   odla-ai secrets push --env <env> [--config odla.config.mjs] [--dry-run] [--yes]
@@ -3290,12 +3759,19 @@ Commands:
   setup        Install offline odla runbooks for common coding-agent harnesses.
   init         Create a generic odla.config.mjs plus starter schema/rules files.
   doctor       Validate and summarize the project config without network calls.
-  calendar     Inspect, connect, resync, or disconnect a read-only Google mirror.
+  calendar     Inspect, connect, or disconnect the live Google booking connection.
+  app          Archive (suspend, data retained), restore, or export the app.
+               Archiving takes every environment's data plane down until restored;
+               permanent deletion has NO CLI \u2014 it requires a signed-in owner in
+               Studio, and no machine or agent credential can purge. "app export"
+               downloads a portable gzipped-JSONL snapshot of one environment's
+               database (--fresh takes a new snapshot first) \u2014 your data is
+               always yours to take.
   capabilities Show what the CLI automates vs agent edits and human checkpoints.
   admin        Manage platform-funded AI routing/credentials/usage with narrow device grants.
   security     Connect GitHub sources and run commit-pinned hosted reviews, or scan a local snapshot.
-  provision    Register services, configure them, persist credentials, optionally push secrets.
-  smoke        Verify local credentials, public-config, live schema, and db aggregate.
+  provision    Register services, compose integrations, persist credentials, optionally push secrets.
+  smoke        Verify credentials, public-config, composed schema, db aggregate, and integration probes.
   skill        Same installer; --agent accepts all, claude, codex, cursor,
                copilot, gemini, or agents (repeatable or comma-separated).
   secrets      Push configured db/o11y secrets into the Worker via wrangler
@@ -3312,6 +3788,12 @@ Safety:
   Provision opens the approval page in your browser automatically whenever the
   machine can show one, including agent-driven runs; only CI, SSH, and
   display-less hosts skip it. Use --open to force or --no-open to suppress.
+  Browser launch is best-effort: the printed approval URL is authoritative and
+  agents must relay it to the human verbatim. A started handshake is persisted
+  under .odla/, so a command killed mid-wait loses nothing \u2014 rerunning resumes
+  the same code. Outside an interactive terminal the wait is capped (90s by
+  default, --wait <seconds> to change); a still-pending handshake then exits
+  with code 75: relay the URL, wait for approval, and re-run to collect.
   A fresh device handshake requires --email <odla-account> or ODLA_USER_EMAIL.
   The email is a non-secret identity hint: never provide a password or session
   token. The matching account must already exist, be signed in, explicitly
@@ -3781,6 +4263,9 @@ async function securityStatus(parsed, dependencies) {
 }
 
 // src/cli.ts
+function exitCodeFor(err) {
+  return err?.code === "handshake_pending" ? 75 : 1;
+}
 async function runCli(argv = process.argv.slice(2), dependencies = {}) {
   const parsed = parseArgv(argv);
   const command = parsed.positionals[0] ?? "help";
@@ -3833,6 +4318,10 @@ async function runCli(argv = process.argv.slice(2), dependencies = {}) {
     await adminCommand(parsed);
     return;
   }
+  if (command === "app") {
+    await appCommand(parsed, dependencies);
+    return;
+  }
   if (command === "security") {
     await securityCommand(parsed, dependencies);
     return;
@@ -3929,6 +4418,7 @@ async function provisionCommand(parsed, dependencies) {
     "token",
     "email",
     "open",
+    "wait",
     "yes"
   ], 1);
   const writeDevVars2 = parsed.options["write-dev-vars"];
@@ -3943,6 +4433,7 @@ async function provisionCommand(parsed, dependencies) {
     token: stringOpt(parsed.options.token),
     email: stringOpt(parsed.options.email),
     open: parsed.options.open === false ? false : parsed.options.open === true ? true : void 0,
+    wait: numberOpt(parsed.options.wait, "--wait"),
     yes: parsed.options.yes === true,
     fetch: dependencies.fetch,
     openApprovalUrl: dependencies.openUrl,
@@ -3952,7 +4443,7 @@ async function provisionCommand(parsed, dependencies) {
 }
 async function calendarCommand(parsed, dependencies) {
   const sub = parsed.positionals[1];
-  if (sub !== "status" && sub !== "calendars" && sub !== "connect" && sub !== "resync" && sub !== "disconnect") {
+  if (sub !== "status" && sub !== "calendars" && sub !== "connect" && sub !== "disconnect") {
     throw new Error(`unknown calendar subcommand "${sub ?? ""}". Try "odla-ai calendar status --env dev".`);
   }
   assertArgs(parsed, ["config", "env", "json", "token", "email", "open", "yes"], 2);
@@ -3973,7 +4464,6 @@ async function calendarCommand(parsed, dependencies) {
   if (sub === "status") await calendarStatus(options);
   else if (sub === "calendars") await calendarCalendars(options);
   else if (sub === "connect") await calendarConnect(options);
-  else if (sub === "resync") await calendarResync(options);
   else await calendarDisconnect(options);
 }
 
@@ -3981,16 +4471,15 @@ export {
   getScopedPlatformToken,
   SYSTEM_AI_PURPOSES,
   adminAi,
-  CAPABILITIES,
-  printCapabilities,
-  GOOGLE_CALENDAR_READ_SCOPE,
+  GOOGLE_CALENDAR_EVENTS_SCOPE,
   calendarServiceConfig,
   calendarBookingPageUrl,
+  CAPABILITIES,
+  printCapabilities,
   redactSecrets,
   calendarStatus,
   calendarCalendars,
   calendarConnect,
-  calendarResync,
   calendarDisconnect,
   doctor,
   initProject,
@@ -4015,6 +4504,7 @@ export {
   AGENT_HARNESSES,
   installSkill,
   smoke,
+  exitCodeFor,
   runCli
 };
-//# sourceMappingURL=chunk-DC4MIB4X.js.map
+//# sourceMappingURL=chunk-I7XDJZB6.js.map