@odla-ai/cli 0.25.18 → 0.25.20

package/dist/index.cjs

@@ -1019,71 +1019,16 @@ function addOption(options, name, value) {
   else options[name] = [String(current), String(value)];
 }
 
-// src/admin-command.ts
-async function adminCommand(parsed) {
-  const area = parsed.positionals[1];
-  const action = parsed.positionals[2];
-  const credentialSet = action === "credential" && parsed.positionals[3] === "set";
-  const credentials = action === "credentials";
-  const models = action === "models";
-  const usage = action === "usage";
-  const audit = action === "audit";
-  if (area !== "ai" || action !== "show" && action !== "set" && !credentialSet && !credentials && !models && !usage && !audit) {
-    throw new Error('unknown admin command. Try "odla-ai admin ai show".');
-  }
-  assertArgs(parsed, [
-    "platform",
-    "json",
-    "open",
-    "email",
-    "provider",
-    "model",
-    "enabled",
-    "max-input-bytes",
-    "max-output-tokens",
-    "max-calls-per-run",
-    "from-env",
-    "stdin",
-    "discovery-provider",
-    "discovery-model",
-    "validation-provider",
-    "validation-model",
-    "app-id",
-    "env",
-    "run-id",
-    "limit"
-  ], credentialSet ? 5 : action === "set" ? 4 : 3);
-  await adminAi({
-    action: credentialSet ? "credential-set" : credentials ? "credentials" : models ? "models" : usage ? "usage" : audit ? "audit" : action,
-    purpose: action === "set" ? parsed.positionals[3] : void 0,
-    provider: stringOpt(parsed.options.provider),
-    model: stringOpt(parsed.options.model),
-    enabled: boolOpt(parsed.options.enabled),
-    maxInputBytes: numberOpt(parsed.options["max-input-bytes"], "--max-input-bytes"),
-    maxOutputTokens: numberOpt(parsed.options["max-output-tokens"], "--max-output-tokens"),
-    maxCallsPerRun: numberOpt(parsed.options["max-calls-per-run"], "--max-calls-per-run"),
-    platform: stringOpt(parsed.options.platform),
-    email: stringOpt(parsed.options.email),
-    json: parsed.options.json === true,
-    open: parsed.options.open === false ? false : parsed.options.open === true ? true : void 0,
-    credentialProvider: credentialSet ? parsed.positionals[4] : void 0,
-    fromEnv: stringOpt(parsed.options["from-env"]),
-    stdin: parsed.options.stdin === true,
-    discoveryProvider: stringOpt(parsed.options["discovery-provider"]),
-    discoveryModel: stringOpt(parsed.options["discovery-model"]),
-    validationProvider: stringOpt(parsed.options["validation-provider"]),
-    validationModel: stringOpt(parsed.options["validation-model"]),
-    appId: stringOpt(parsed.options["app-id"]),
-    env: stringOpt(parsed.options.env),
-    runId: stringOpt(parsed.options["run-id"]),
-    limit: numberOpt(parsed.options.limit, "--limit")
-  });
-}
+// src/operator-context.ts
+var import_node_fs6 = require("fs");
+var import_node_path6 = require("path");
+var import_node_process8 = __toESM(require("process"), 1);
 
 // src/config.ts
 var import_node_fs4 = require("fs");
 var import_node_path4 = require("path");
 var import_node_url = require("url");
+var import_apps = require("@odla-ai/apps");
 
 // src/integration-validation.ts
 function validateIntegrations(cfg, path, defaultServices) {
@@ -1171,6 +1116,7 @@ async function loadProjectConfig(configPath = "odla.config.mjs") {
   const dbEndpoint = trimSlash(process.env.ODLA_DB_ENDPOINT || raw.dbEndpoint || platformUrl);
   const envs = unique2(raw.envs?.length ? raw.envs : DEFAULT_ENVS);
   const services = unique2(raw.services?.length ? raw.services : DEFAULT_SERVICES);
+  validateServices(services, resolved);
   validateCalendarConfig(raw, envs, services, resolved);
   const local = {
     tokenFile: (0, import_node_path4.resolve)(rootDir, raw.local?.tokenFile ?? ".odla/dev-token.json"),
@@ -1326,7 +1272,19 @@ function validateCalendarConfig(cfg, envs, services, path) {
       }
     }
   }
-  if (enabled && !services.includes("db")) throw new Error(`${path}: calendar service requires the db service`);
+}
+function validateServices(services, path) {
+  for (const service of services) {
+    const definition = (0, import_apps.appServiceDefinition)(service);
+    if (!definition) {
+      throw new Error(`${path}: unknown service "${service}" (known: ${(0, import_apps.appServiceIds)().join(", ")})`);
+    }
+    for (const dependency of definition.requires) {
+      if (!services.includes(dependency)) {
+        throw new Error(`${path}: ${service} service requires the ${dependency} service`);
+      }
+    }
+  }
 }
 function assertOnly(value, allowed, label) {
   const extra = Object.keys(value).find((key) => !allowed.includes(key));
@@ -1364,8 +1322,293 @@ function unique2(values) {
   return [...new Set(values.filter(Boolean))];
 }
 
+// src/operator-profiles.ts
+var import_node_fs5 = require("fs");
+var import_node_os = require("os");
+var import_node_path5 = require("path");
+var import_node_process7 = __toESM(require("process"), 1);
+function operatorProfileFile() {
+  return (0, import_node_path5.resolve)(
+    clean(import_node_process7.default.env.ODLA_CONTEXT_FILE) ?? (0, import_node_path5.join)((0, import_node_os.homedir)(), ".odla", "contexts.json")
+  );
+}
+function resolveOperatorProfile(parsed) {
+  const fromFlag = clean(stringOpt(parsed.options.context));
+  const fromEnvironment = clean(import_node_process7.default.env.ODLA_CONTEXT);
+  const name = fromFlag ?? fromEnvironment ?? null;
+  const file = operatorProfileFile();
+  if (!name) {
+    return { name: null, source: "unresolved", file, value: null };
+  }
+  assertOperatorName(name, "context");
+  const profiles = readOperatorProfiles(file);
+  const value = Object.hasOwn(profiles, name) ? profiles[name] : void 0;
+  if (!value) {
+    throw new Error(
+      `operator context "${name}" not found in ${file}; run "odla-ai context list" or save it first`
+    );
+  }
+  return {
+    name,
+    source: fromFlag ? "flag" : "environment",
+    file,
+    value
+  };
+}
+function listOperatorProfiles(file = operatorProfileFile()) {
+  return Object.entries(readOperatorProfiles(file)).sort(([a], [b]) => a.localeCompare(b)).map(([name, profile]) => ({ name, ...profile }));
+}
+function saveOperatorProfile(name, profile, file = operatorProfileFile()) {
+  assertOperatorName(name, "context");
+  const normalized = validateProfile(profile, `operator context "${name}"`);
+  const profiles = readOperatorProfiles(file);
+  profiles[name] = normalized;
+  writePrivateJson(file, { schemaVersion: 1, profiles });
+}
+function removeOperatorProfile(name, file = operatorProfileFile()) {
+  assertOperatorName(name, "context");
+  const profiles = readOperatorProfiles(file);
+  if (!Object.hasOwn(profiles, name)) return false;
+  delete profiles[name];
+  writePrivateJson(file, { schemaVersion: 1, profiles });
+  return true;
+}
+function operatorCredentialFiles(selection) {
+  const base = selection.name ? (0, import_node_path5.join)((0, import_node_path5.dirname)(selection.file), "profiles", selection.name) : (0, import_node_path5.join)((0, import_node_os.homedir)(), ".odla");
+  return {
+    developer: (0, import_node_path5.join)(base, "dev-token.json"),
+    scoped: (0, import_node_path5.join)(base, "admin-token.local.json")
+  };
+}
+function assertOperatorName(value, label) {
+  if (!/^[a-z0-9][a-z0-9-]*$/.test(value)) {
+    throw new Error(
+      `${label} must contain lowercase letters, numbers, and hyphens`
+    );
+  }
+}
+function readOperatorProfiles(file) {
+  if (!(0, import_node_fs5.existsSync)(file)) return emptyProfiles();
+  let raw;
+  try {
+    raw = JSON.parse((0, import_node_fs5.readFileSync)(file, "utf8"));
+  } catch {
+    throw new Error(`operator context file ${file} is not valid JSON`);
+  }
+  if (!raw || typeof raw !== "object" || raw.schemaVersion !== 1 || !raw.profiles || typeof raw.profiles !== "object" || Array.isArray(raw.profiles)) {
+    throw new Error(`operator context file ${file} has an invalid shape`);
+  }
+  const unknown = Object.keys(raw).filter(
+    (key) => !["schemaVersion", "profiles"].includes(key)
+  );
+  if (unknown.length > 0) {
+    throw new Error(
+      `operator context file ${file} contains unsupported field(s): ${unknown.sort().join(", ")}`
+    );
+  }
+  const profiles = emptyProfiles();
+  for (const [name, value] of Object.entries(
+    raw.profiles
+  )) {
+    assertOperatorName(name, "context");
+    profiles[name] = validateProfile(value, `operator context "${name}"`);
+  }
+  return profiles;
+}
+function emptyProfiles() {
+  return /* @__PURE__ */ Object.create(null);
+}
+function validateProfile(value, label) {
+  if (!value || typeof value !== "object" || Array.isArray(value)) {
+    throw new Error(`${label} has an invalid shape`);
+  }
+  const unknown = Object.keys(value).filter(
+    (key) => !["platform", "app", "environment"].includes(key)
+  );
+  if (unknown.length > 0) {
+    throw new Error(
+      `${label} contains unsupported field(s): ${unknown.sort().join(", ")}; contexts store scope metadata only, never credentials`
+    );
+  }
+  const candidate = value;
+  if (typeof candidate.platform !== "string") {
+    throw new Error(`${label} needs an absolute platform URL`);
+  }
+  const platform = platformAudience(candidate.platform);
+  const app = clean(candidate.app);
+  const environment2 = clean(candidate.environment);
+  if (app) assertOperatorName(app, "app");
+  if (environment2) assertOperatorName(environment2, "environment");
+  return {
+    platform,
+    ...app ? { app } : {},
+    ...environment2 ? { environment: environment2 } : {}
+  };
+}
+function clean(value) {
+  const normalized = value?.trim();
+  return normalized || void 0;
+}
+
+// src/operator-context.ts
+var DEFAULT_PLATFORM2 = "https://odla.ai";
+async function resolveOperatorContext(parsed, options = {}) {
+  const profile = resolveOperatorProfile(parsed);
+  const configArgument = stringOpt(parsed.options.config) ?? "odla.config.mjs";
+  const configPath = (0, import_node_path6.resolve)(configArgument);
+  const explicitConfig = parsed.options.config !== void 0;
+  const hasConfig = (0, import_node_fs6.existsSync)(configPath);
+  if (!hasConfig && (!options.allowMissingConfig || explicitConfig)) {
+    await loadProjectConfig(configArgument);
+  }
+  const loaded = hasConfig ? await loadProjectConfig(configArgument) : void 0;
+  const platformFlag = clean2(stringOpt(parsed.options.platform));
+  const platformEnvironment = clean2(import_node_process8.default.env.ODLA_PLATFORM_URL);
+  const platformValue = platformAudience(
+    platformFlag ?? platformEnvironment ?? profile.value?.platform ?? loaded?.platformUrl ?? DEFAULT_PLATFORM2
+  );
+  const platformSource = platformFlag ? "flag" : platformEnvironment ? "environment" : profile.value ? "profile" : loaded ? "config" : "default";
+  const appFlag = clean2(stringOpt(parsed.options.app));
+  const appEnvironment = clean2(import_node_process8.default.env.ODLA_APP_ID);
+  const appValue = appFlag ?? appEnvironment ?? profile.value?.app ?? loaded?.app.id ?? null;
+  const appSource = appFlag ? "flag" : appEnvironment ? "environment" : profile.value?.app ? "profile" : loaded ? "config" : "unresolved";
+  if (appValue) assertOperatorName(appValue, "app");
+  if (options.requireApp && !appValue) {
+    throw new Error(
+      "app context is unresolved; pass --app <id>, set ODLA_APP_ID, select --context <name>, or run inside a project with odla.config.mjs"
+    );
+  }
+  const envFlag = clean2(stringOpt(parsed.options.env));
+  const envEnvironment = clean2(import_node_process8.default.env.ODLA_ENV);
+  const environmentValue = envFlag ?? envEnvironment ?? profile.value?.environment ?? options.defaultEnvironment ?? null;
+  const environmentSource = envFlag ? "flag" : envEnvironment ? "environment" : profile.value?.environment ? "profile" : options.defaultEnvironment ? "default" : "unresolved";
+  if (environmentValue) {
+    assertOperatorName(environmentValue, "environment");
+  }
+  const rootDir = loaded?.rootDir ?? import_node_process8.default.cwd();
+  const profileCredentials = operatorCredentialFiles(profile);
+  const tokenFile = clean2(import_node_process8.default.env.ODLA_DEV_TOKEN_FILE) ? (0, import_node_path6.resolve)(import_node_process8.default.env.ODLA_DEV_TOKEN_FILE) : profile.name ? profileCredentials.developer : loaded?.local.tokenFile ?? profileCredentials.developer;
+  const scopedTokenFile = clean2(import_node_process8.default.env.ODLA_ADMIN_TOKEN_FILE) ? (0, import_node_path6.resolve)(import_node_process8.default.env.ODLA_ADMIN_TOKEN_FILE) : profile.name ? profileCredentials.scoped : loaded ? (0, import_node_path6.join)(loaded.rootDir, ".odla", "admin-token.local.json") : profileCredentials.scoped;
+  const cfg = loaded ? {
+    ...loaded,
+    platformUrl: platformValue,
+    app: appValue ? {
+      id: appValue,
+      name: appValue === loaded.app.id ? loaded.app.name : appValue
+    } : loaded.app,
+    local: { ...loaded.local, tokenFile }
+  } : {
+    configPath,
+    rootDir,
+    platformUrl: platformValue,
+    dbEndpoint: platformValue,
+    app: {
+      id: appValue ?? "operator",
+      name: appValue ?? "Operator"
+    },
+    envs: environmentValue ? [environmentValue] : [],
+    services: [],
+    local: {
+      tokenFile,
+      credentialsFile: (0, import_node_path6.join)(rootDir, ".odla", "credentials.local.json"),
+      devVarsFile: (0, import_node_path6.join)(rootDir, ".dev.vars"),
+      gitignore: true
+    }
+  };
+  return {
+    cfg,
+    profile: {
+      name: profile.name,
+      source: profile.source,
+      file: profile.file
+    },
+    config: {
+      path: configPath,
+      status: loaded ? "loaded" : "absent",
+      explicit: explicitConfig
+    },
+    platform: { value: platformValue, source: platformSource },
+    app: { value: appValue, source: appSource },
+    environment: {
+      value: environmentValue,
+      source: environmentSource
+    },
+    credentials: {
+      developerTokenFile: tokenFile,
+      scopedTokenFile
+    }
+  };
+}
+function clean2(value) {
+  const normalized = value?.trim();
+  return normalized || void 0;
+}
+
+// src/admin-command.ts
+var CONTEXT_OPTIONS = ["platform", "config", "context", "token", "open", "email"];
+var JSON_OPTIONS = [...CONTEXT_OPTIONS, "json"];
+var SET_OPTIONS = [
+  ...JSON_OPTIONS,
+  "provider",
+  "model",
+  "enabled",
+  "max-input-bytes",
+  "max-output-tokens",
+  "max-calls-per-run",
+  "discovery-provider",
+  "discovery-model",
+  "validation-provider",
+  "validation-model"
+];
+async function adminCommand(parsed, deps = {}) {
+  const area = parsed.positionals[1];
+  const action = parsed.positionals[2];
+  const credentialSet = action === "credential" && parsed.positionals[3] === "set";
+  const credentials = action === "credentials";
+  const models = action === "models";
+  const usage = action === "usage";
+  const audit = action === "audit";
+  if (area !== "ai" || action !== "show" && action !== "set" && !credentialSet && !credentials && !models && !usage && !audit) {
+    throw new Error('unknown admin command. Try "odla-ai admin ai show".');
+  }
+  const allowed = credentialSet ? [...CONTEXT_OPTIONS, "from-env", "stdin"] : action === "set" ? SET_OPTIONS : models ? [...JSON_OPTIONS, "provider"] : usage ? [...JSON_OPTIONS, "app-id", "env", "run-id", "limit"] : audit ? [...JSON_OPTIONS, "limit"] : JSON_OPTIONS;
+  assertArgs(parsed, allowed, credentialSet ? 5 : action === "set" ? 4 : 3);
+  const context = await resolveOperatorContext(parsed, { allowMissingConfig: true });
+  await adminAi({
+    action: credentialSet ? "credential-set" : credentials ? "credentials" : models ? "models" : usage ? "usage" : audit ? "audit" : action,
+    purpose: action === "set" ? parsed.positionals[3] : void 0,
+    provider: stringOpt(parsed.options.provider),
+    model: stringOpt(parsed.options.model),
+    enabled: boolOpt(parsed.options.enabled),
+    maxInputBytes: numberOpt(parsed.options["max-input-bytes"], "--max-input-bytes"),
+    maxOutputTokens: numberOpt(parsed.options["max-output-tokens"], "--max-output-tokens"),
+    maxCallsPerRun: numberOpt(parsed.options["max-calls-per-run"], "--max-calls-per-run"),
+    platform: context.platform.value,
+    token: stringOpt(parsed.options.token),
+    tokenFile: context.credentials.scopedTokenFile,
+    email: stringOpt(parsed.options.email),
+    json: parsed.options.json === true,
+    open: parsed.options.open === false ? false : parsed.options.open === true ? true : void 0,
+    credentialProvider: credentialSet ? parsed.positionals[4] : void 0,
+    fromEnv: stringOpt(parsed.options["from-env"]),
+    stdin: parsed.options.stdin === true,
+    readStdin: deps.readStdin,
+    discoveryProvider: stringOpt(parsed.options["discovery-provider"]),
+    discoveryModel: stringOpt(parsed.options["discovery-model"]),
+    validationProvider: stringOpt(parsed.options["validation-provider"]),
+    validationModel: stringOpt(parsed.options["validation-model"]),
+    appId: stringOpt(parsed.options["app-id"]),
+    env: stringOpt(parsed.options.env),
+    runId: stringOpt(parsed.options["run-id"]),
+    limit: numberOpt(parsed.options.limit, "--limit"),
+    fetch: deps.fetch,
+    stdout: deps.stdout,
+    openApprovalUrl: deps.openUrl
+  });
+}
+
 // src/tenant.ts
-var import_apps = require("@odla-ai/apps");
+var import_apps2 = require("@odla-ai/apps");
 function resolveEnv(cfg, requested) {
   const env = requested ?? (cfg.envs.includes("dev") ? "dev" : cfg.envs[0]);
   if (!env || !cfg.envs.includes(env)) {
@@ -1375,7 +1618,7 @@ function resolveEnv(cfg, requested) {
 }
 function resolveTenant(cfg, requested) {
   const env = resolveEnv(cfg, requested);
-  return { env, tenant: (0, import_apps.tenantIdFor)(cfg.app.id, env) };
+  return { env, tenant: (0, import_apps2.tenantIdFor)(cfg.app.id, env) };
 }
 function bothTenants(cfg) {
   for (const env of ["dev", "prod"]) {
@@ -1385,7 +1628,7 @@ function bothTenants(cfg) {
       );
     }
   }
-  return { sandbox: (0, import_apps.tenantIdFor)(cfg.app.id, "dev"), live: (0, import_apps.tenantIdFor)(cfg.app.id, "prod") };
+  return { sandbox: (0, import_apps2.tenantIdFor)(cfg.app.id, "dev"), live: (0, import_apps2.tenantIdFor)(cfg.app.id, "prod") };
 }
 
 // src/agent-command.ts
@@ -1469,7 +1712,7 @@ function errorMessage(body) {
 }
 
 // src/app-export.ts
-var import_node_fs5 = require("fs");
+var import_node_fs7 = require("fs");
 var import_node_stream = require("stream");
 var import_promises = require("stream/promises");
 async function appExport(options) {
@@ -1502,7 +1745,7 @@ async function appExport(options) {
   const download = await doFetch(`${base}/backups/${newest.id}/download`, { headers: auth });
   if (!download.ok || !download.body) throw new Error(`download failed (${download.status})`);
   const file = options.out ?? `${tenant}-${new Date(newest.created_at).toISOString().slice(0, 10)}-tx${newest.max_tx}.jsonl.gz`;
-  await (0, import_promises.pipeline)(import_node_stream.Readable.fromWeb(download.body), (0, import_node_fs5.createWriteStream)(file));
+  await (0, import_promises.pipeline)(import_node_stream.Readable.fromWeb(download.body), (0, import_node_fs7.createWriteStream)(file));
   if (options.json) out.log(JSON.stringify({ file, backup: newest }, null, 2));
   else {
     out.log(`${tenant}: wrote ${file} (${newest.bytes} bytes, ${newest.kind} snapshot at tx ${newest.max_tx})`);
@@ -1512,7 +1755,7 @@ async function appExport(options) {
 }
 
 // src/app-import.ts
-var import_node_fs6 = require("fs");
+var import_node_fs8 = require("fs");
 var import_import = require("@odla-ai/db/import");
 function chooseIdMode(options, rows) {
   const chosen = [options.idField && "field", options.key && "key", options.generateIds && "generate"].filter(Boolean);
@@ -1531,7 +1774,7 @@ async function appImport(options) {
   const say = options.json ? (line) => out.error(line) : (line) => out.log(line);
   const doFetch = options.fetch ?? fetch;
   const { tenant } = resolveTenant(cfg, options.env);
-  const text = options.file === "-" ? (options.readStdin ?? (() => (0, import_node_fs6.readFileSync)(0, "utf8")))() : (0, import_node_fs6.readFileSync)(options.file, "utf8");
+  const text = options.file === "-" ? (options.readStdin ?? (() => (0, import_node_fs8.readFileSync)(0, "utf8")))() : (0, import_node_fs8.readFileSync)(options.file, "utf8");
   const { format, sources } = (0, import_import.parseImport)(text, options.ns);
   if (format === "namespace-map" && options.ns) {
     throw new Error("--ns cannot be combined with a {namespace: rows} file \u2014 the file already names each namespace");
@@ -2498,13 +2741,13 @@ function printGroup(out, heading, items) {
 
 // src/doctor-checks.ts
 var import_node_child_process3 = require("child_process");
-var import_node_fs8 = require("fs");
-var import_node_path6 = require("path");
+var import_node_fs10 = require("fs");
+var import_node_path8 = require("path");
 
 // src/wrangler.ts
 var import_node_child_process2 = require("child_process");
-var import_node_fs7 = require("fs");
-var import_node_path5 = require("path");
+var import_node_fs9 = require("fs");
+var import_node_path7 = require("path");
 var defaultRunner = (cmd, args, opts) => new Promise((resolvePromise, reject) => {
   const child = (0, import_node_child_process2.spawn)(cmd, args, { cwd: opts?.cwd, stdio: ["pipe", "pipe", "pipe"] });
   let stdout = "";
@@ -2518,15 +2761,15 @@ var defaultRunner = (cmd, args, opts) => new Promise((resolvePromise, reject) =>
 var WRANGLER_CONFIG_FILES = ["wrangler.jsonc", "wrangler.json", "wrangler.toml"];
 function findWranglerConfig(rootDir) {
   for (const name of WRANGLER_CONFIG_FILES) {
-    const path = (0, import_node_path5.join)(rootDir, name);
-    if ((0, import_node_fs7.existsSync)(path)) return path;
+    const path = (0, import_node_path7.join)(rootDir, name);
+    if ((0, import_node_fs9.existsSync)(path)) return path;
   }
   return null;
 }
 function readWranglerConfig(path) {
   if (path.endsWith(".toml")) return null;
   try {
-    return JSON.parse(stripJsonComments((0, import_node_fs7.readFileSync)(path, "utf8")));
+    return JSON.parse(stripJsonComments((0, import_node_fs9.readFileSync)(path, "utf8")));
   } catch {
     return null;
   }
@@ -2624,10 +2867,10 @@ function wranglerWarnings(rootDir) {
   for (const { label, block } of blocks) {
     const assets = block.assets;
     if (assets?.directory) {
-      const dir = (0, import_node_path6.resolve)(rootDir, assets.directory);
-      if (dir === (0, import_node_path6.resolve)(rootDir)) {
+      const dir = (0, import_node_path8.resolve)(rootDir, assets.directory);
+      if (dir === (0, import_node_path8.resolve)(rootDir)) {
         warnings.push(`${label}assets.directory is the project root \u2014 point it at a dedicated build dir (wrangler dev fails with "spawn EBADF")`);
-      } else if ((0, import_node_fs8.existsSync)((0, import_node_path6.join)(dir, "node_modules"))) {
+      } else if ((0, import_node_fs10.existsSync)((0, import_node_path8.join)(dir, "node_modules"))) {
         warnings.push(`${label}assets.directory contains node_modules \u2014 wrangler dev's watcher will exhaust file descriptors`);
       }
     }
@@ -2662,13 +2905,13 @@ function o11yProjectWarnings(rootDir) {
     warnings.push("cannot verify o11y Worker instrumentation \u2014 add a parseable wrangler.jsonc/json config");
     return warnings;
   }
-  const main = typeof config.main === "string" ? (0, import_node_path6.resolve)(rootDir, config.main) : null;
-  if (!main || !(0, import_node_fs8.existsSync)(main)) {
+  const main = typeof config.main === "string" ? (0, import_node_path8.resolve)(rootDir, config.main) : null;
+  if (!main || !(0, import_node_fs10.existsSync)(main)) {
     warnings.push("cannot verify o11y Worker instrumentation \u2014 wrangler main is missing or unreadable");
   } else {
     let source = "";
     try {
-      source = (0, import_node_fs8.readFileSync)(main, "utf8");
+      source = (0, import_node_fs10.readFileSync)(main, "utf8");
     } catch {
     }
     if (!/\bwithObservability\b/.test(source)) {
@@ -2692,7 +2935,7 @@ function calendarProjectWarnings(rootDir) {
 }
 function readPackageJson(rootDir) {
   try {
-    return JSON.parse((0, import_node_fs8.readFileSync)((0, import_node_path6.join)(rootDir, "package.json"), "utf8"));
+    return JSON.parse((0, import_node_fs10.readFileSync)((0, import_node_path8.join)(rootDir, "package.json"), "utf8"));
   } catch {
     return null;
   }
@@ -2919,13 +3162,14 @@ function harnessOption(value, flag) {
 }
 
 // src/init.ts
-var import_node_fs9 = require("fs");
-var import_node_path7 = require("path");
+var import_node_fs11 = require("fs");
+var import_node_path9 = require("path");
+var import_apps3 = require("@odla-ai/apps");
 function initProject(options) {
   const out = options.stdout ?? console;
-  const rootDir = (0, import_node_path7.resolve)(options.rootDir ?? process.cwd());
-  const configPath = (0, import_node_path7.resolve)(rootDir, options.configPath ?? "odla.config.mjs");
-  if ((0, import_node_fs9.existsSync)(configPath) && !options.force) {
+  const rootDir = (0, import_node_path9.resolve)(options.rootDir ?? process.cwd());
+  const configPath = (0, import_node_path9.resolve)(rootDir, options.configPath ?? "odla.config.mjs");
+  if ((0, import_node_fs11.existsSync)(configPath) && !options.force) {
     throw new Error(`${configPath} already exists. Pass --force to overwrite.`);
   }
   if (!/^[a-z0-9][a-z0-9-]*$/.test(options.appId)) {
@@ -2933,22 +3177,28 @@ function initProject(options) {
   }
   const envs = options.envs?.length ? options.envs : ["dev"];
   const services = options.services?.length ? options.services : ["db", "ai"];
-  if (services.includes("calendar") && !services.includes("db")) throw new Error("--services calendar requires db");
+  for (const service of services) {
+    const definition = (0, import_apps3.appServiceDefinition)(service);
+    if (!definition) throw new Error(`--services contains unknown service "${service}" (known: ${(0, import_apps3.appServiceIds)().join(", ")})`);
+    for (const dependency of definition.requires) {
+      if (!services.includes(dependency)) throw new Error(`--services ${service} requires ${dependency}`);
+    }
+  }
   const aiProvider = options.aiProvider ?? "anthropic";
-  (0, import_node_fs9.mkdirSync)((0, import_node_path7.dirname)(configPath), { recursive: true });
-  (0, import_node_fs9.mkdirSync)((0, import_node_path7.resolve)(rootDir, "src/odla"), { recursive: true });
-  (0, import_node_fs9.mkdirSync)((0, import_node_path7.resolve)(rootDir, ".odla"), { recursive: true });
-  (0, import_node_fs9.writeFileSync)(configPath, configTemplate({ appId: options.appId, name: options.name, envs, services, aiProvider }));
-  writeIfMissing((0, import_node_path7.resolve)(rootDir, "src/odla/schema.mjs"), schemaTemplate());
-  writeIfMissing((0, import_node_path7.resolve)(rootDir, "src/odla/rules.mjs"), rulesTemplate());
+  (0, import_node_fs11.mkdirSync)((0, import_node_path9.dirname)(configPath), { recursive: true });
+  (0, import_node_fs11.mkdirSync)((0, import_node_path9.resolve)(rootDir, "src/odla"), { recursive: true });
+  (0, import_node_fs11.mkdirSync)((0, import_node_path9.resolve)(rootDir, ".odla"), { recursive: true });
+  (0, import_node_fs11.writeFileSync)(configPath, configTemplate({ appId: options.appId, name: options.name, envs, services, aiProvider }));
+  writeIfMissing((0, import_node_path9.resolve)(rootDir, "src/odla/schema.mjs"), schemaTemplate());
+  writeIfMissing((0, import_node_path9.resolve)(rootDir, "src/odla/rules.mjs"), rulesTemplate());
   ensureGitignore(rootDir);
   out.log(`created ${relativeDisplay(configPath, rootDir)}`);
   out.log("created src/odla/schema.mjs and src/odla/rules.mjs");
   out.log("updated .gitignore for local odla credentials");
 }
 function writeIfMissing(path, text) {
-  if ((0, import_node_fs9.existsSync)(path)) return;
-  (0, import_node_fs9.writeFileSync)(path, text);
+  if ((0, import_node_fs11.existsSync)(path)) return;
+  (0, import_node_fs11.writeFileSync)(path, text);
 }
 function configTemplate(input) {
   const calendar = input.services.includes("calendar") ? `  calendar: {
@@ -3123,7 +3373,7 @@ function assertWranglerConfig(cfg) {
 
 // src/secrets-set.ts
 var import_ai = require("@odla-ai/ai");
-var import_apps2 = require("@odla-ai/apps");
+var import_apps4 = require("@odla-ai/apps");
 var PROD_ENV_NAMES2 = /* @__PURE__ */ new Set(["prod", "production"]);
 async function secretsSet(options) {
   const name = (options.name ?? "").trim();
@@ -3175,13 +3425,13 @@ async function resolveVaultWrite(options) {
     throw new Error(`refusing to store a secret for "${options.env}" without --yes`);
   }
   const value = await secretInputValue(options, "secret");
-  return { cfg, tenantId: (0, import_apps2.tenantIdFor)(cfg.app.id, options.env), value, doFetch, out };
+  return { cfg, tenantId: (0, import_apps4.tenantIdFor)(cfg.app.id, options.env), value, doFetch, out };
 }
 
 // src/skill.ts
-var import_node_fs10 = require("fs");
-var import_node_os = require("os");
-var import_node_path8 = require("path");
+var import_node_fs12 = require("fs");
+var import_node_os2 = require("os");
+var import_node_path10 = require("path");
 var import_node_url2 = require("url");
 
 // src/skill-adapters.ts
@@ -3260,8 +3510,8 @@ function installSkill(options = {}) {
   const files = listFiles(sourceDir);
   if (files.length === 0) throw new Error(`no bundled skills found at ${sourceDir}`);
   const harnesses = normalizeHarnesses(options.harnesses, options.global === true);
-  const root = (0, import_node_path8.resolve)(options.dir ?? process.cwd());
-  const home = (0, import_node_path8.resolve)(options.homeDir ?? (0, import_node_os.homedir)());
+  const root = (0, import_node_path10.resolve)(options.dir ?? process.cwd());
+  const home = (0, import_node_path10.resolve)(options.homeDir ?? (0, import_node_os2.homedir)());
   const plans = /* @__PURE__ */ new Map();
   const targets = /* @__PURE__ */ new Map();
   const rememberTarget = (harness, target) => {
@@ -3275,48 +3525,48 @@ function installSkill(options = {}) {
     plans.set(target, { target, content: content2, boundary, managedMerge });
   };
   const planSkillTree = (targetDir2, boundary = root) => {
-    for (const rel of files) plan((0, import_node_path8.join)(targetDir2, rel), (0, import_node_fs10.readFileSync)((0, import_node_path8.join)(sourceDir, rel), "utf8"), false, boundary);
+    for (const rel of files) plan((0, import_node_path10.join)(targetDir2, rel), (0, import_node_fs12.readFileSync)((0, import_node_path10.join)(sourceDir, rel), "utf8"), false, boundary);
   };
   let targetDir;
   if (options.global) {
-    const claudeRoot = (0, import_node_path8.join)(home, ".claude", "skills");
-    const codexRoot = (0, import_node_path8.resolve)(options.codexHomeDir ?? process.env.CODEX_HOME ?? (0, import_node_path8.join)(home, ".codex"), "skills");
+    const claudeRoot = (0, import_node_path10.join)(home, ".claude", "skills");
+    const codexRoot = (0, import_node_path10.resolve)(options.codexHomeDir ?? process.env.CODEX_HOME ?? (0, import_node_path10.join)(home, ".codex"), "skills");
     targetDir = harnesses[0] === "codex" ? codexRoot : claudeRoot;
     for (const harness of harnesses) {
       const skillRoot = harness === "claude" ? claudeRoot : codexRoot;
-      planSkillTree(skillRoot, harness === "claude" ? home : (0, import_node_path8.dirname)((0, import_node_path8.dirname)(codexRoot)));
+      planSkillTree(skillRoot, harness === "claude" ? home : (0, import_node_path10.dirname)((0, import_node_path10.dirname)(codexRoot)));
       rememberTarget(harness, skillRoot);
     }
   } else {
-    const sharedRoot = (0, import_node_path8.join)(root, ".agents", "skills");
+    const sharedRoot = (0, import_node_path10.join)(root, ".agents", "skills");
     planSkillTree(sharedRoot);
-    const claudeRoot = (0, import_node_path8.join)(root, ".claude", "skills");
+    const claudeRoot = (0, import_node_path10.join)(root, ".claude", "skills");
     targetDir = harnesses.includes("claude") ? claudeRoot : sharedRoot;
     for (const harness of harnesses) rememberTarget(harness, sharedRoot);
     if (harnesses.includes("claude")) {
       for (const skill of skillNames(files)) {
-        const canonical = (0, import_node_fs10.readFileSync)((0, import_node_path8.join)(sourceDir, skill, "SKILL.md"), "utf8");
-        plan((0, import_node_path8.join)(claudeRoot, skill, "SKILL.md"), claudeAdapter(skill, canonical));
+        const canonical = (0, import_node_fs12.readFileSync)((0, import_node_path10.join)(sourceDir, skill, "SKILL.md"), "utf8");
+        plan((0, import_node_path10.join)(claudeRoot, skill, "SKILL.md"), claudeAdapter(skill, canonical));
       }
       rememberTarget("claude", claudeRoot);
     }
     if (harnesses.includes("cursor")) {
-      const cursorRule = (0, import_node_path8.join)(root, ".cursor", "rules", "odla.mdc");
+      const cursorRule = (0, import_node_path10.join)(root, ".cursor", "rules", "odla.mdc");
       plan(cursorRule, CURSOR_RULE);
       rememberTarget("cursor", cursorRule);
     }
     if (harnesses.includes("agents")) {
-      const agentsFile = (0, import_node_path8.join)(root, "AGENTS.md");
+      const agentsFile = (0, import_node_path10.join)(root, "AGENTS.md");
       plan(agentsFile, managedFileContent(agentsFile, PROJECT_INSTRUCTIONS, options.force === true, root), true);
       rememberTarget("agents", agentsFile);
     }
     if (harnesses.includes("copilot")) {
-      const copilotFile = (0, import_node_path8.join)(root, ".github", "copilot-instructions.md");
+      const copilotFile = (0, import_node_path10.join)(root, ".github", "copilot-instructions.md");
       plan(copilotFile, managedFileContent(copilotFile, PROJECT_INSTRUCTIONS, options.force === true, root), true);
       rememberTarget("copilot", copilotFile);
     }
     if (harnesses.includes("gemini")) {
-      const geminiFile = (0, import_node_path8.join)(root, "GEMINI.md");
+      const geminiFile = (0, import_node_path10.join)(root, "GEMINI.md");
       plan(geminiFile, managedFileContent(geminiFile, PROJECT_INSTRUCTIONS, options.force === true, root), true);
       rememberTarget("gemini", geminiFile);
     }
@@ -3330,11 +3580,11 @@ function installSkill(options = {}) {
       conflicts.push(`${file.target} (redirected by symbolic link ${symlink})`);
       continue;
     }
-    if (!(0, import_node_fs10.existsSync)(file.target)) {
+    if (!(0, import_node_fs12.existsSync)(file.target)) {
       writtenPaths.add(file.target);
       continue;
     }
-    const current = (0, import_node_fs10.readFileSync)(file.target, "utf8");
+    const current = (0, import_node_fs12.readFileSync)(file.target, "utf8");
     if (current === file.content) {
       unchangedPaths.add(file.target);
     } else if (file.managedMerge || options.force) {
@@ -3351,9 +3601,9 @@ ${conflicts.map((f) => `  - ${f}`).join("\n")}`
     );
   }
   for (const file of plans.values()) {
-    if (!(0, import_node_fs10.existsSync)(file.target) || (0, import_node_fs10.readFileSync)(file.target, "utf8") !== file.content) {
-      (0, import_node_fs10.mkdirSync)((0, import_node_path8.dirname)(file.target), { recursive: true });
-      (0, import_node_fs10.writeFileSync)(file.target, file.content);
+    if (!(0, import_node_fs12.existsSync)(file.target) || (0, import_node_fs12.readFileSync)(file.target, "utf8") !== file.content) {
+      (0, import_node_fs12.mkdirSync)((0, import_node_path10.dirname)(file.target), { recursive: true });
+      (0, import_node_fs12.writeFileSync)(file.target, file.content);
     }
   }
   const skills = skillNames(files);
@@ -3372,7 +3622,7 @@ ${conflicts.map((f) => `  - ${f}`).join("\n")}`
   };
 }
 function pathsUnder(root, paths) {
-  return [...paths].map((path) => (0, import_node_path8.relative)(root, path)).filter((path) => path !== ".." && !path.startsWith(`..${import_node_path8.sep}`) && !(0, import_node_path8.isAbsolute)(path)).sort();
+  return [...paths].map((path) => (0, import_node_path10.relative)(root, path)).filter((path) => path !== ".." && !path.startsWith(`..${import_node_path10.sep}`) && !(0, import_node_path10.isAbsolute)(path)).sort();
 }
 function normalizeHarnesses(values, global) {
   const requested = values?.length ? values : ["claude"];
@@ -3394,9 +3644,9 @@ function normalizeHarnesses(values, global) {
 function managedFileContent(path, block, force, boundary) {
   const symlink = symlinkedComponent(boundary, path);
   if (symlink) throw new Error(`refusing to manage ${path}: symbolic link component ${symlink}`);
-  if (!(0, import_node_fs10.existsSync)(path)) return `${block}
+  if (!(0, import_node_fs12.existsSync)(path)) return `${block}
 `;
-  const current = (0, import_node_fs10.readFileSync)(path, "utf8");
+  const current = (0, import_node_fs12.readFileSync)(path, "utf8");
   const start = "<!-- odla-ai agent setup:start -->";
   const end = "<!-- odla-ai agent setup:end -->";
   const startAt = current.indexOf(start);
@@ -3417,15 +3667,15 @@ function managedFileContent(path, block, force, boundary) {
   return `${current.slice(0, startAt)}${block}${current.slice(afterEnd)}`;
 }
 function symlinkedComponent(boundary, target) {
-  const rel = (0, import_node_path8.relative)(boundary, target);
-  if (rel === ".." || rel.startsWith(`..${import_node_path8.sep}`) || (0, import_node_path8.isAbsolute)(rel)) {
+  const rel = (0, import_node_path10.relative)(boundary, target);
+  if (rel === ".." || rel.startsWith(`..${import_node_path10.sep}`) || (0, import_node_path10.isAbsolute)(rel)) {
     throw new Error(`agent setup target escapes its install root: ${target}`);
   }
   let current = boundary;
-  for (const part of rel.split(import_node_path8.sep).filter(Boolean)) {
-    current = (0, import_node_path8.join)(current, part);
+  for (const part of rel.split(import_node_path10.sep).filter(Boolean)) {
+    current = (0, import_node_path10.join)(current, part);
     try {
-      if ((0, import_node_fs10.lstatSync)(current).isSymbolicLink()) return current;
+      if ((0, import_node_fs12.lstatSync)(current).isSymbolicLink()) return current;
     } catch (error) {
       if (error.code !== "ENOENT") throw error;
     }
@@ -3436,13 +3686,13 @@ function skillNames(files) {
   return [...new Set(files.filter((file) => /(^|[\\/])SKILL\.md$/.test(file)).map((file) => file.split(/[\\/]/)[0]))].sort();
 }
 function listFiles(dir) {
-  if (!(0, import_node_fs10.existsSync)(dir)) return [];
+  if (!(0, import_node_fs12.existsSync)(dir)) return [];
   const results = [];
   const walk = (current) => {
-    for (const entry of (0, import_node_fs10.readdirSync)(current, { withFileTypes: true })) {
-      const path = (0, import_node_path8.join)(current, entry.name);
+    for (const entry of (0, import_node_fs12.readdirSync)(current, { withFileTypes: true })) {
+      const path = (0, import_node_path10.join)(current, entry.name);
       if (entry.isDirectory()) walk(path);
-      else results.push((0, import_node_path8.relative)(dir, path));
+      else results.push((0, import_node_path10.relative)(dir, path));
     }
   };
   walk(dir);
@@ -3589,13 +3839,16 @@ async function safeText3(res) {
 
 // src/cli-project.ts
 var SKILL_OPTS = ["dir", "global", "force", "agent", "harness"];
-function install(parsed, positionals) {
+function install(parsed, positionals, deps) {
   assertArgs(parsed, SKILL_OPTS, positionals);
   installSkill({
     dir: stringOpt(parsed.options.dir),
     global: parsed.options.global === true,
     harnesses: harnessList(parsed),
-    force: parsed.options.force === true
+    force: parsed.options.force === true,
+    homeDir: deps.homeDir,
+    codexHomeDir: deps.codexHomeDir,
+    stdout: deps.stdout
   });
 }
 async function secretsCommand(parsed, deps) {
@@ -3611,6 +3864,7 @@ async function secretsCommand(parsed, deps) {
       token: stringOpt(parsed.options.token),
       email: stringOpt(parsed.options.email),
       yes: parsed.options.yes === true,
+      readStdin: deps.readStdin,
       fetch: deps.fetch,
       stdout: deps.stdout
     };
@@ -3669,8 +3923,8 @@ async function projectCommand(command, parsed, deps) {
     return true;
   }
   if (command === "setup") {
-    install(parsed, 1);
-    console.log(
+    install(parsed, 1, deps);
+    (deps.stdout ?? console).log(
       "\nOffline runbooks installed. Open this repo in your coding agent and ask it to set up odla.\nIts native adapter finds the local `odla` skill, chooses build or migration, and drives the CLI."
     );
     return true;
@@ -3678,7 +3932,7 @@ async function projectCommand(command, parsed, deps) {
   if (command === "skill") {
     const sub = parsed.positionals[1];
     if (sub !== "install") throw new Error(`unknown skill subcommand "${sub ?? ""}". Try "odla-ai skill install".`);
-    install(parsed, 2);
+    install(parsed, 2, deps);
     return true;
   }
   if (command === "secrets") {
@@ -3689,9 +3943,9 @@ async function projectCommand(command, parsed, deps) {
 }
 
 // src/code-connect.ts
-var import_node_fs12 = require("fs");
-var import_node_os3 = require("os");
-var import_node_path10 = require("path");
+var import_node_fs14 = require("fs");
+var import_node_os4 = require("os");
+var import_node_path12 = require("path");
 
 // ../harness/dist/chunk-QTUEF2HZ.js
 var HARNESS_PROTOCOL_VERSION = 1;
@@ -6576,9 +6830,9 @@ var CodePiRuntimeEngine = class {
 };
 
 // src/help.ts
-var import_node_fs11 = require("fs");
+var import_node_fs13 = require("fs");
 function cliVersion() {
-  const pkg = JSON.parse((0, import_node_fs11.readFileSync)(new URL("../package.json", importMetaUrl), "utf8"));
+  const pkg = JSON.parse((0, import_node_fs13.readFileSync)(new URL("../package.json", importMetaUrl), "utf8"));
   return pkg.version ?? "unknown";
 }
 function printHelp(output = console) {
@@ -6666,15 +6920,16 @@ Usage:
   odla-ai runbook rm <slug> [--app <id>]
   odla-ai capabilities [--json]
   odla-ai code connect [--env dev|prod] [--email <odla-account>] [--engine auto|container|podman|docker] [--slots <1-64>] [--once]
-  odla-ai admin ai show [--platform https://odla.ai] [--email <odla-account>] [--json]
-  odla-ai admin ai models [--provider <id>] [--json]
-  odla-ai admin ai set <purpose> [--provider <id>] [--model <id>] [--enabled|--no-enabled]
-  odla-ai admin ai set security --discovery-provider <id> --discovery-model <id>
-    --validation-provider <id> --validation-model <id> [--enabled|--no-enabled]
-  odla-ai admin ai credentials [--json]
-  odla-ai admin ai credential set <provider> (--from-env <NAME>|--stdin)
-  odla-ai admin ai usage [--app-id <id>] [--env <env>] [--run-id <id>] [--limit <1-500>] [--json]
-  odla-ai admin ai audit [--limit <1-200>] [--json]
+  odla-ai admin ai show [--context <name>] [--platform https://odla.ai] [--email <odla-account>] [--json]
+  odla-ai admin ai models [--context <name>] [--provider <id>] [--json]
+  odla-ai admin ai set <purpose> [--context <name>] [--provider <id>] [--model <id>] [--enabled|--no-enabled]
+    [--max-input-bytes <n>] [--max-output-tokens <n>] [--max-calls-per-run <n>] [--json]
+  odla-ai admin ai set security [--context <name>] --discovery-provider <id> --discovery-model <id>
+    --validation-provider <id> --validation-model <id> [--enabled|--no-enabled] [--json]
+  odla-ai admin ai credentials [--context <name>] [--json]
+  odla-ai admin ai credential set <provider> [--context <name>] (--from-env <NAME>|--stdin)
+  odla-ai admin ai usage [--context <name>] [--app-id <id>] [--env <env>] [--run-id <id>] [--limit <1-500>] [--json]
+  odla-ai admin ai audit [--context <name>] [--limit <1-200>] [--json]
   odla-ai security github connect [--repo owner/name] [--env dev] [--email <odla-account>] [--no-open]
   odla-ai security github disconnect --source <id> [--env dev] [--yes]
   odla-ai security plan [--env dev] [--json]
@@ -7101,8 +7356,8 @@ function digestText(value) {
 var import_node_child_process6 = require("child_process");
 var import_node_crypto2 = require("crypto");
 var import_promises10 = require("fs/promises");
-var import_node_os2 = require("os");
-var import_node_path9 = require("path");
+var import_node_os3 = require("os");
+var import_node_path11 = require("path");
 var import_node_url3 = require("url");
 
 // src/code-runtime-config.ts
@@ -7188,10 +7443,10 @@ async function embeddedPiImageName() {
   return `odla-ai/pi-agent:embedded-sha256-${(0, import_node_crypto2.createHash)("sha256").update(bundle).digest("hex")}`;
 }
 async function buildEmbeddedPiImage(engine, image, run) {
-  const context = await (0, import_promises10.mkdtemp)((0, import_node_path9.join)((0, import_node_os2.tmpdir)(), "odla-code-pi-"));
+  const context = await (0, import_promises10.mkdtemp)((0, import_node_path11.join)((0, import_node_os3.tmpdir)(), "odla-code-pi-"));
   try {
-    await (0, import_promises10.copyFile)(embeddedPiAssetPath(), (0, import_node_path9.join)(context, "pi-agent.js"));
-    await (0, import_promises10.writeFile)((0, import_node_path9.join)(context, "Dockerfile"), [
+    await (0, import_promises10.copyFile)(embeddedPiAssetPath(), (0, import_node_path11.join)(context, "pi-agent.js"));
+    await (0, import_promises10.writeFile)((0, import_node_path11.join)(context, "Dockerfile"), [
       `FROM ${CODE_NODE_IMAGE}`,
       "COPY pi-agent.js /opt/odla/pi-agent.js",
       "WORKDIR /workspace",
@@ -7207,8 +7462,8 @@ async function buildEmbeddedPiImage(engine, image, run) {
 // src/code-connect.ts
 async function codeConnect(options) {
   const cwd = options.cwd ?? process.cwd();
-  const configPath = (0, import_node_path10.resolve)(cwd, options.configPath);
-  const cfg = (0, import_node_fs12.existsSync)(configPath) ? await loadProjectConfig(configPath) : null;
+  const configPath = (0, import_node_path12.resolve)(cwd, options.configPath);
+  const cfg = (0, import_node_fs14.existsSync)(configPath) ? await loadProjectConfig(configPath) : null;
   const requestedAppId = options.appId?.trim();
   if (requestedAppId && !/^[a-z0-9][a-z0-9-]{1,62}$/.test(requestedAppId)) {
     throw new Error("--app-id must be a valid odla app id");
@@ -7242,7 +7497,7 @@ async function codeConnect(options) {
   );
   if (!piImage || !/^odla-ai\/pi-agent:embedded-sha256-[0-9a-f]{64}$/.test(piImage)) throw new Error("Code image preflight did not produce the content-addressed embedded Pi runtime");
   const hostPlatform = process.platform === "darwin" ? "macos" : "linux";
-  const hostName = (options.name ?? (0, import_node_os3.hostname)()).trim();
+  const hostName = (options.name ?? (0, import_node_os4.hostname)()).trim();
   if (!hostName || hostName.length > 120) throw new Error("--name must contain 1 to 120 characters");
   const repository = await inferGitHubRepository(cwd, options.readGitOrigin);
   const localSource = await (options.prepareLocalSource ?? prepareCodeLocalSource)(
@@ -7279,8 +7534,8 @@ async function codeConnect(options) {
       platform: hostPlatform,
       arch: process.arch,
       engines: [engine],
-      cpuCount: (0, import_node_os3.cpus)().length,
-      memoryBytes: (0, import_node_os3.totalmem)(),
+      cpuCount: (0, import_node_os4.cpus)().length,
+      memoryBytes: (0, import_node_os4.totalmem)(),
       source: descriptor2,
       images: {
         ready: true,
@@ -7426,246 +7681,19 @@ async function codeCommand(parsed, dependencies) {
 }
 
 // src/operator-credentials.ts
-var import_node_process7 = __toESM(require("process"), 1);
+var import_node_process9 = __toESM(require("process"), 1);
 function developerTokenStatus(context, parsed, now = Date.now()) {
   const cached = readJsonFile(context.cfg.local.tokenFile);
   const cacheStatus = !cached?.token ? "missing" : cached.platform !== context.platform.value ? "other-platform" : (cached.expiresAt ?? 0) <= now + 6e4 ? "expired" : "valid";
-  const source = clean(
+  const source = clean3(
     stringOpt(parsed.options.token)
-  ) ? "flag" : clean(import_node_process7.default.env.ODLA_DEV_TOKEN) ? "environment" : cacheStatus === "valid" ? "cache" : "missing";
+  ) ? "flag" : clean3(import_node_process9.default.env.ODLA_DEV_TOKEN) ? "environment" : cacheStatus === "valid" ? "cache" : "missing";
   return {
     source,
     cacheFile: context.cfg.local.tokenFile,
     cacheStatus
   };
 }
-function clean(value) {
-  const normalized = value?.trim();
-  return normalized || void 0;
-}
-
-// src/operator-context.ts
-var import_node_fs14 = require("fs");
-var import_node_path12 = require("path");
-var import_node_process9 = __toESM(require("process"), 1);
-
-// src/operator-profiles.ts
-var import_node_fs13 = require("fs");
-var import_node_os4 = require("os");
-var import_node_path11 = require("path");
-var import_node_process8 = __toESM(require("process"), 1);
-function operatorProfileFile() {
-  return (0, import_node_path11.resolve)(
-    clean2(import_node_process8.default.env.ODLA_CONTEXT_FILE) ?? (0, import_node_path11.join)((0, import_node_os4.homedir)(), ".odla", "contexts.json")
-  );
-}
-function resolveOperatorProfile(parsed) {
-  const fromFlag = clean2(stringOpt(parsed.options.context));
-  const fromEnvironment = clean2(import_node_process8.default.env.ODLA_CONTEXT);
-  const name = fromFlag ?? fromEnvironment ?? null;
-  const file = operatorProfileFile();
-  if (!name) {
-    return { name: null, source: "unresolved", file, value: null };
-  }
-  assertOperatorName(name, "context");
-  const profiles = readOperatorProfiles(file);
-  const value = Object.hasOwn(profiles, name) ? profiles[name] : void 0;
-  if (!value) {
-    throw new Error(
-      `operator context "${name}" not found in ${file}; run "odla-ai context list" or save it first`
-    );
-  }
-  return {
-    name,
-    source: fromFlag ? "flag" : "environment",
-    file,
-    value
-  };
-}
-function listOperatorProfiles(file = operatorProfileFile()) {
-  return Object.entries(readOperatorProfiles(file)).sort(([a], [b]) => a.localeCompare(b)).map(([name, profile]) => ({ name, ...profile }));
-}
-function saveOperatorProfile(name, profile, file = operatorProfileFile()) {
-  assertOperatorName(name, "context");
-  const normalized = validateProfile(profile, `operator context "${name}"`);
-  const profiles = readOperatorProfiles(file);
-  profiles[name] = normalized;
-  writePrivateJson(file, { schemaVersion: 1, profiles });
-}
-function removeOperatorProfile(name, file = operatorProfileFile()) {
-  assertOperatorName(name, "context");
-  const profiles = readOperatorProfiles(file);
-  if (!Object.hasOwn(profiles, name)) return false;
-  delete profiles[name];
-  writePrivateJson(file, { schemaVersion: 1, profiles });
-  return true;
-}
-function operatorCredentialFiles(selection) {
-  const base = selection.name ? (0, import_node_path11.join)((0, import_node_path11.dirname)(selection.file), "profiles", selection.name) : (0, import_node_path11.join)((0, import_node_os4.homedir)(), ".odla");
-  return {
-    developer: (0, import_node_path11.join)(base, "dev-token.json"),
-    scoped: (0, import_node_path11.join)(base, "admin-token.local.json")
-  };
-}
-function assertOperatorName(value, label) {
-  if (!/^[a-z0-9][a-z0-9-]*$/.test(value)) {
-    throw new Error(
-      `${label} must contain lowercase letters, numbers, and hyphens`
-    );
-  }
-}
-function readOperatorProfiles(file) {
-  if (!(0, import_node_fs13.existsSync)(file)) return emptyProfiles();
-  let raw;
-  try {
-    raw = JSON.parse((0, import_node_fs13.readFileSync)(file, "utf8"));
-  } catch {
-    throw new Error(`operator context file ${file} is not valid JSON`);
-  }
-  if (!raw || typeof raw !== "object" || raw.schemaVersion !== 1 || !raw.profiles || typeof raw.profiles !== "object" || Array.isArray(raw.profiles)) {
-    throw new Error(`operator context file ${file} has an invalid shape`);
-  }
-  const unknown = Object.keys(raw).filter(
-    (key) => !["schemaVersion", "profiles"].includes(key)
-  );
-  if (unknown.length > 0) {
-    throw new Error(
-      `operator context file ${file} contains unsupported field(s): ${unknown.sort().join(", ")}`
-    );
-  }
-  const profiles = emptyProfiles();
-  for (const [name, value] of Object.entries(
-    raw.profiles
-  )) {
-    assertOperatorName(name, "context");
-    profiles[name] = validateProfile(value, `operator context "${name}"`);
-  }
-  return profiles;
-}
-function emptyProfiles() {
-  return /* @__PURE__ */ Object.create(null);
-}
-function validateProfile(value, label) {
-  if (!value || typeof value !== "object" || Array.isArray(value)) {
-    throw new Error(`${label} has an invalid shape`);
-  }
-  const unknown = Object.keys(value).filter(
-    (key) => !["platform", "app", "environment"].includes(key)
-  );
-  if (unknown.length > 0) {
-    throw new Error(
-      `${label} contains unsupported field(s): ${unknown.sort().join(", ")}; contexts store scope metadata only, never credentials`
-    );
-  }
-  const candidate = value;
-  if (typeof candidate.platform !== "string") {
-    throw new Error(`${label} needs an absolute platform URL`);
-  }
-  const platform = platformAudience(candidate.platform);
-  const app = clean2(candidate.app);
-  const environment2 = clean2(candidate.environment);
-  if (app) assertOperatorName(app, "app");
-  if (environment2) assertOperatorName(environment2, "environment");
-  return {
-    platform,
-    ...app ? { app } : {},
-    ...environment2 ? { environment: environment2 } : {}
-  };
-}
-function clean2(value) {
-  const normalized = value?.trim();
-  return normalized || void 0;
-}
-
-// src/operator-context.ts
-var DEFAULT_PLATFORM2 = "https://odla.ai";
-async function resolveOperatorContext(parsed, options = {}) {
-  const profile = resolveOperatorProfile(parsed);
-  const configArgument = stringOpt(parsed.options.config) ?? "odla.config.mjs";
-  const configPath = (0, import_node_path12.resolve)(configArgument);
-  const explicitConfig = parsed.options.config !== void 0;
-  const hasConfig = (0, import_node_fs14.existsSync)(configPath);
-  if (!hasConfig && (!options.allowMissingConfig || explicitConfig)) {
-    await loadProjectConfig(configArgument);
-  }
-  const loaded = hasConfig ? await loadProjectConfig(configArgument) : void 0;
-  const platformFlag = clean3(stringOpt(parsed.options.platform));
-  const platformEnvironment = clean3(import_node_process9.default.env.ODLA_PLATFORM_URL);
-  const platformValue = platformAudience(
-    platformFlag ?? platformEnvironment ?? profile.value?.platform ?? loaded?.platformUrl ?? DEFAULT_PLATFORM2
-  );
-  const platformSource = platformFlag ? "flag" : platformEnvironment ? "environment" : profile.value ? "profile" : loaded ? "config" : "default";
-  const appFlag = clean3(stringOpt(parsed.options.app));
-  const appEnvironment = clean3(import_node_process9.default.env.ODLA_APP_ID);
-  const appValue = appFlag ?? appEnvironment ?? profile.value?.app ?? loaded?.app.id ?? null;
-  const appSource = appFlag ? "flag" : appEnvironment ? "environment" : profile.value?.app ? "profile" : loaded ? "config" : "unresolved";
-  if (appValue) assertOperatorName(appValue, "app");
-  if (options.requireApp && !appValue) {
-    throw new Error(
-      "app context is unresolved; pass --app <id>, set ODLA_APP_ID, select --context <name>, or run inside a project with odla.config.mjs"
-    );
-  }
-  const envFlag = clean3(stringOpt(parsed.options.env));
-  const envEnvironment = clean3(import_node_process9.default.env.ODLA_ENV);
-  const environmentValue = envFlag ?? envEnvironment ?? profile.value?.environment ?? options.defaultEnvironment ?? null;
-  const environmentSource = envFlag ? "flag" : envEnvironment ? "environment" : profile.value?.environment ? "profile" : options.defaultEnvironment ? "default" : "unresolved";
-  if (environmentValue) {
-    assertOperatorName(environmentValue, "environment");
-  }
-  const rootDir = loaded?.rootDir ?? import_node_process9.default.cwd();
-  const profileCredentials = operatorCredentialFiles(profile);
-  const tokenFile = clean3(import_node_process9.default.env.ODLA_DEV_TOKEN_FILE) ? (0, import_node_path12.resolve)(import_node_process9.default.env.ODLA_DEV_TOKEN_FILE) : profile.name ? profileCredentials.developer : loaded?.local.tokenFile ?? profileCredentials.developer;
-  const scopedTokenFile = clean3(import_node_process9.default.env.ODLA_ADMIN_TOKEN_FILE) ? (0, import_node_path12.resolve)(import_node_process9.default.env.ODLA_ADMIN_TOKEN_FILE) : profile.name ? profileCredentials.scoped : loaded ? (0, import_node_path12.join)(loaded.rootDir, ".odla", "admin-token.local.json") : profileCredentials.scoped;
-  const cfg = loaded ? {
-    ...loaded,
-    platformUrl: platformValue,
-    app: appValue ? {
-      id: appValue,
-      name: appValue === loaded.app.id ? loaded.app.name : appValue
-    } : loaded.app,
-    local: { ...loaded.local, tokenFile }
-  } : {
-    configPath,
-    rootDir,
-    platformUrl: platformValue,
-    dbEndpoint: platformValue,
-    app: {
-      id: appValue ?? "operator",
-      name: appValue ?? "Operator"
-    },
-    envs: environmentValue ? [environmentValue] : [],
-    services: [],
-    local: {
-      tokenFile,
-      credentialsFile: (0, import_node_path12.join)(rootDir, ".odla", "credentials.local.json"),
-      devVarsFile: (0, import_node_path12.join)(rootDir, ".dev.vars"),
-      gitignore: true
-    }
-  };
-  return {
-    cfg,
-    profile: {
-      name: profile.name,
-      source: profile.source,
-      file: profile.file
-    },
-    config: {
-      path: configPath,
-      status: loaded ? "loaded" : "absent",
-      explicit: explicitConfig
-    },
-    platform: { value: platformValue, source: platformSource },
-    app: { value: appValue, source: appSource },
-    environment: {
-      value: environmentValue,
-      source: environmentSource
-    },
-    credentials: {
-      developerTokenFile: tokenFile,
-      scopedTokenFile
-    }
-  };
-}
 function clean3(value) {
   const normalized = value?.trim();
   return normalized || void 0;
@@ -9025,7 +9053,7 @@ async function read2(url, headers, doFetch) {
 }
 
 // src/provision.ts
-var import_apps5 = require("@odla-ai/apps");
+var import_apps7 = require("@odla-ai/apps");
 var import_ai3 = require("@odla-ai/ai");
 var import_node_process10 = __toESM(require("process"), 1);
 
@@ -9082,9 +9110,9 @@ async function responseText(res) {
 }
 
 // src/provision-credentials.ts
-var import_apps3 = require("@odla-ai/apps");
+var import_apps5 = require("@odla-ai/apps");
 async function provisionEnvCredentials(opts) {
-  const tenantId = (0, import_apps3.tenantIdFor)(opts.cfg.app.id, opts.env);
+  const tenantId = (0, import_apps5.tenantIdFor)(opts.cfg.app.id, opts.env);
   const prior = opts.credentials?.envs[opts.env];
   let credentials = opts.credentials;
   let dbKey = opts.cfg.services.includes("db") && !opts.rotateDb ? prior?.dbKey : void 0;
@@ -9178,18 +9206,13 @@ async function safeText4(res) {
 
 // src/provision-helpers.ts
 var import_ai2 = require("@odla-ai/ai");
-var import_apps4 = require("@odla-ai/apps");
-function serviceRank(service) {
-  if (service === "db") return 0;
-  if (service === "calendar") return 2;
-  return 1;
-}
+var import_apps6 = require("@odla-ai/apps");
 function defaultSecretName(provider) {
   const names = import_ai2.DEFAULT_SECRET_NAMES;
   return names[provider] ?? `${provider}_api_key`;
 }
 async function assertTenantAdminAccess(doFetch, cfg, env, token) {
-  const tenantId = (0, import_apps4.tenantIdFor)(cfg.app.id, env);
+  const tenantId = (0, import_apps6.tenantIdFor)(cfg.app.id, env);
   const res = await doFetch(`${cfg.dbEndpoint}/admin/apps/${encodeURIComponent(tenantId)}/entitlements`, {
     headers: { authorization: `Bearer ${token}` }
   });
@@ -9298,7 +9321,7 @@ async function provision(options) {
   }
   const doFetch = options.fetch ?? fetch;
   const token = await getDeveloperToken(cfg, options, doFetch, out);
-  const apps = (0, import_apps5.createAppsClient)({ endpoint: cfg.platformUrl, token, fetcher: { fetch: doFetch } });
+  const apps = (0, import_apps7.createAppsClient)({ endpoint: cfg.platformUrl, token, fetcher: { fetch: doFetch } });
   const existing = await apps.resolveApp(cfg.app.id);
   if (existing) {
     out.log(`app: ${cfg.app.id} already exists`);
@@ -9309,7 +9332,7 @@ async function provision(options) {
   for (const env of cfg.envs) {
     await assertTenantAdminAccess(doFetch, cfg, env, token);
   }
-  const serviceOrder = [...cfg.services].sort((a, b) => serviceRank(a) - serviceRank(b));
+  const serviceOrder = (0, import_apps7.orderAppServices)(cfg.services);
   for (const env of cfg.envs) {
     for (const service of serviceOrder) {
       if (service === "ai") {
@@ -9342,7 +9365,7 @@ async function provision(options) {
     }
   }
   for (const env of cfg.envs) {
-    const tenantId = (0, import_apps5.tenantIdFor)(cfg.app.id, env);
+    const tenantId = (0, import_apps7.tenantIdFor)(cfg.app.id, env);
     credentials = await provisionEnvCredentials({
       cfg,
       env,
@@ -11286,7 +11309,7 @@ async function runCli(argv = process.argv.slice(2), dependencies = {}) {
     return;
   }
   if (command === "admin") {
-    await adminCommand(parsed);
+    await adminCommand(parsed, runtime);
     return;
   }
   if (command === "agent") {