@odla-ai/cli 0.25.2 → 0.25.6

package/dist/bin.cjs

@@ -1875,6 +1875,37 @@ function redactSecrets(value) {
   for (const [pattern, replacement] of REPLACEMENTS) result = result.replace(pattern, replacement);
   return result;
 }
+function redactingOutput(output) {
+  const redactArgs = (args) => args.map((value) => redactOutputValue(value, /* @__PURE__ */ new WeakMap()));
+  return {
+    log: (...args) => output.log(...redactArgs(args)),
+    error: (...args) => output.error(...redactArgs(args))
+  };
+}
+function redactOutputValue(value, seen) {
+  if (typeof value === "string") return redactSecrets(value);
+  if (value instanceof Error) {
+    const redacted = new Error(redactSecrets(value.message));
+    redacted.name = value.name;
+    if (value.stack) redacted.stack = redactSecrets(value.stack);
+    return redacted;
+  }
+  if (!value || typeof value !== "object") return value;
+  const prior = seen.get(value);
+  if (prior) return prior;
+  if (Array.isArray(value)) {
+    const next2 = [];
+    seen.set(value, next2);
+    for (const item of value) next2.push(redactOutputValue(item, seen));
+    return next2;
+  }
+  const prototype = Object.getPrototypeOf(value);
+  if (prototype !== Object.prototype && prototype !== null) return value;
+  const next = {};
+  seen.set(value, next);
+  for (const [key, item] of Object.entries(value)) next[key] = redactOutputValue(item, seen);
+  return next;
+}
 function looksSecret(value) {
   return redactSecrets(value) !== value || value.includes("-----BEGIN");
 }
@@ -2279,6 +2310,7 @@ var CAPABILITIES = {
     "compose declared app-capability schema/rules, create guarded seeds when absent, and configure platform AI, auth, and deployment links",
     "apply Google Calendar booking config, then drive state-bound consent, status, discovery, and disconnect flows (bookings run live through the platform proxy)",
     "validate integration contracts offline and smoke-test a provisioned db environment plus anonymous capability routes",
+    "read one versioned o11y status envelope spanning application RED, current live-sync freshness/load, the protected commit-to-visible canary, collector ingest/scheduler trust, provider-owned runtime metrics, and a bounded machine verdict",
     "run app-attributed hosted security discovery and independent validation without provider keys",
     "connect/revoke source-read-only GitHub sources and drive commit-pinned hosted security jobs without PATs or provider keys",
     "let admins manage system AI policy and credentials, inspect attributed usage, and read immutable admin changes through separate short-lived capability-only approvals"
@@ -2299,7 +2331,7 @@ var CAPABILITIES = {
     "approve GitHub App repository access separately from redacted-snippet disclosure"
   ],
   studio: [
-    "view telemetry and environment state",
+    "view application telemetry, reconciled live-sync load/freshness, commit-to-visible canary health, provider-owned Worker runtime metrics, and environment state",
     "let signed-in users inventory/revoke their own agent grants and admins audit/global-revoke them",
     "review calendar connection, granted read scope, selected calendars, and sync health without exposing provider tokens",
     "perform manual credential recovery \u2014 for the primary owner or any co-owner \u2014 when the CLI's local shown-once copy is unavailable",
@@ -3291,9 +3323,17 @@ async function smoke(options) {
     throw new Error(`local credentials are for app "${credentials.appId}", but config app is "${cfg.app.id}"`);
   }
   const entry = credentials.envs[env];
-  if (!entry?.tenantId || !entry.dbKey) {
+  if (!entry?.tenantId) {
+    throw new Error(`local credentials have no tenant for env "${env}". Run "odla-ai provision --write-dev-vars".`);
+  }
+  const hasDb = cfg.services.includes("db");
+  const hasO11y = cfg.services.includes("o11y");
+  if (hasDb && !entry.dbKey) {
     throw new Error(`local credentials have no db key for env "${env}". Run "odla-ai provision --write-dev-vars".`);
   }
+  if (hasO11y && !entry.o11yToken) {
+    throw new Error(`local credentials have no o11y token for env "${env}". Run "odla-ai provision --write-dev-vars".`);
+  }
   const doFetch = options.fetch ?? fetch;
   out.log(`smoke: ${cfg.app.id}/${env}`);
   out.log(`  tenant: ${entry.tenantId}`);
@@ -3306,6 +3346,7 @@ async function smoke(options) {
     }
     out.log(`  ai: ${provider}`);
   }
+  if (hasO11y) out.log(`  o11y: credentials present`);
   if (cfg.services.includes("calendar")) {
     const token = await getDeveloperToken(
       cfg,
@@ -3324,26 +3365,30 @@ async function smoke(options) {
     out.log(`  calendar: ${status.status}, bookable (booking \u2192 ${status.bookingCalendarId ?? "primary"})`);
   }
   const database = await resolveDatabaseConfig(cfg);
-  const expectedSchema = database.schema;
-  const expectedEntities = serializedEntities(expectedSchema);
-  const liveSchemaPayload = await getJson(doFetch, `${cfg.dbEndpoint}/app/${encodeURIComponent(entry.tenantId)}/schema`, entry.dbKey);
-  const liveSchema = liveSchemaPayload.schema ?? liveSchemaPayload;
-  const liveEntities = serializedEntities(liveSchema);
-  if (expectedEntities.length) {
-    const missing = expectedEntities.filter((entity) => !liveEntities.includes(entity));
-    if (missing.length) throw new Error(`live schema is missing expected entities: ${missing.join(", ")}`);
-  }
-  out.log(`  schema: ${liveEntities.length} entities`);
-  const aggregateEntity = expectedEntities[0] ?? liveEntities[0];
-  if (aggregateEntity) {
-    const aggregate = await postJson(doFetch, `${cfg.dbEndpoint}/app/${encodeURIComponent(entry.tenantId)}/aggregate`, entry.dbKey, {
-      ns: aggregateEntity,
-      aggregate: { count: true }
-    });
-    const count = aggregate.aggregate?.count;
-    out.log(`  aggregate: ${aggregateEntity}.count=${String(count ?? "ok")}`);
+  if (hasDb) {
+    const expectedSchema = database.schema;
+    const expectedEntities = serializedEntities(expectedSchema);
+    const liveSchemaPayload = await getJson(doFetch, `${cfg.dbEndpoint}/app/${encodeURIComponent(entry.tenantId)}/schema`, entry.dbKey);
+    const liveSchema = liveSchemaPayload.schema ?? liveSchemaPayload;
+    const liveEntities = serializedEntities(liveSchema);
+    if (expectedEntities.length) {
+      const missing = expectedEntities.filter((entity) => !liveEntities.includes(entity));
+      if (missing.length) throw new Error(`live schema is missing expected entities: ${missing.join(", ")}`);
+    }
+    out.log(`  schema: ${liveEntities.length} entities`);
+    const aggregateEntity = expectedEntities[0] ?? liveEntities[0];
+    if (aggregateEntity) {
+      const aggregate = await postJson(doFetch, `${cfg.dbEndpoint}/app/${encodeURIComponent(entry.tenantId)}/aggregate`, entry.dbKey, {
+        ns: aggregateEntity,
+        aggregate: { count: true }
+      });
+      const count = aggregate.aggregate?.count;
+      out.log(`  aggregate: ${aggregateEntity}.count=${String(count ?? "ok")}`);
+    } else {
+      out.log(`  aggregate: skipped (schema has no entities)`);
+    }
   } else {
-    out.log(`  aggregate: skipped (schema has no entities)`);
+    out.log(`  db: skipped (not enabled)`);
   }
   const probes = database.integrations.flatMap(
     (integration) => (integration.probes ?? []).map((probe) => ({ integration: integration.id, probe }))
@@ -3396,7 +3441,7 @@ function publicConfigUrl(platformUrl, appId, env) {
 }
 async function safeText3(res) {
   try {
-    return (await res.text()).slice(0, 500);
+    return redactSecrets((await res.text()).slice(0, 500));
   } catch {
     return "";
   }
@@ -3901,8 +3946,8 @@ async function materializeGitTree(source, commitSha, options = {}) {
   const maxFiles = options.maxFiles ?? 2e4;
   const maxBytes = options.maxBytes ?? 512 * 1024 * 1024;
   const inventory = (await gitOutput(sourceDir, ["ls-tree", "-rz", commitSha], 16 * 1024 * 1024)).toString("utf8").split("\0").filter(Boolean);
-  const entries = inventory.flatMap((record5) => {
-    const match = /^(100644|100755) blob ([0-9a-f]{40,64})\t([\s\S]+)$/.exec(record5);
+  const entries = inventory.flatMap((record6) => {
+    const match = /^(100644|100755) blob ([0-9a-f]{40,64})\t([\s\S]+)$/.exec(record6);
     return match && allowedWorkspacePath(match[3]) ? [{ mode: match[1], hash: match[2], path: match[3] }] : [];
   });
   if (entries.length > maxFiles) throw new Error(`workspace exceeds ${maxFiles} files`);
@@ -4150,8 +4195,8 @@ function normalize(value) {
   if (Array.isArray(value)) return value.map(normalize);
   if (value instanceof Uint8Array) return { $bytes: [...value] };
   if (typeof value === "object") {
-    const record5 = value;
-    return Object.fromEntries(Object.keys(record5).filter((key) => record5[key] !== void 0).sort().map((key) => [key, normalize(record5[key])]));
+    const record6 = value;
+    return Object.fromEntries(Object.keys(record6).filter((key) => record6[key] !== void 0).sort().map((key) => [key, normalize(record6[key])]));
   }
   throw new CamelError("state_conflict", "Canonical JSON rejects unsupported values.");
 }
@@ -6396,8 +6441,8 @@ function cliVersion() {
   const pkg = JSON.parse((0, import_node_fs11.readFileSync)(new URL("../package.json", importMetaUrl), "utf8"));
   return pkg.version ?? "unknown";
 }
-function printHelp() {
-  console.log(`odla-ai
+function printHelp(output = console) {
+  output.log(`odla-ai
 
 Start here:
   odla-ai runbook ask "<question>"   The current procedure, from odla's own
@@ -6429,22 +6474,23 @@ Usage:
   odla-ai app owners add <email> [--email <odla-account>] [--json]
   odla-ai app owners remove <email> [--email <odla-account>] [--json]
   odla-ai pm <goal|task|decision|bug> list [--app <id>] [--status <s>] [--severity <s>] [--column <c>] [--q <text>] [--json]
-  odla-ai pm <goal|task|decision|bug> add --app <id> --title <t> [--severity high|--column doing|--goal <id>|--description <text>|--body <text>|--proof <text>]
+  odla-ai pm <goal|task|decision|bug> add --app <id> --title <t> [--severity high|--column doing|--goal <id>|--description <text>|--body <text>|--proof <text>] [--mutation-id <id>]
   odla-ai pm <goal|task|decision|bug> get <id> [--json]
-  odla-ai pm <goal|task|decision|bug> set <id> [--status <s>|--column <c>|--assignee <id>|--no-assignee|--goal <id>|--decision <id>]
-  odla-ai pm <goal|task|decision|bug> done <id> [--decision <accepted-decision-id>]
-  odla-ai pm <goal|task|decision|bug> comment <id> --body "..."
+  odla-ai pm <goal|task|decision|bug> set <id> [--status <s>|--column <c>|--assignee <id>|--no-assignee|--goal <id>|--decision <id>] [--mutation-id <id>]
+  odla-ai pm <goal|task|decision|bug> done <id> [--decision <accepted-decision-id>] [--mutation-id <id>]
+  odla-ai pm <goal|task|decision|bug> comment <id> --body "..." [--mutation-id <id>]
   odla-ai pm <goal|task|decision|bug> comments <id> [--json]
   odla-ai pm <goal|task|decision|bug> rm <id>
   odla-ai pm handoff --app <id> [--json]
   odla-ai discuss groups [--json]
   odla-ai discuss list [--app <id>] [--q <text>] [--state open|resolved|all] [--json]
   odla-ai discuss read <topic> [--json]
-  odla-ai discuss post --app <id> --subject "..." --body "..." [--markup "... @[Label](kind/id)"]
-  odla-ai discuss reply <topic> --body "..." [--markup "..."]
-  odla-ai discuss resolve <topic> [--reopen]
+  odla-ai discuss post --app <id> --subject "..." --body "..." [--markup "... @[Label](kind/id)"] [--mutation-id <id>]
+  odla-ai discuss reply <topic> --body "..." [--markup "..."] [--mutation-id <id>]
+  odla-ai discuss resolve <topic> [--reopen] [--mutation-id <id>]
   odla-ai discuss who --q <text> [--app <id>] [--kinds user,pm:task] [--json]
   odla-ai discuss watch [<topic>] [--by <authorId>] [--self <authorId>] [--interval <s>] [--timeout <s>] [--json]
+  odla-ai o11y status [--app <id>] [--env prod] [--minutes 60] [--json]
   odla-ai whoami [--json]
   odla-ai runbook ask "<question>" [--app <id>] [--all] [--json]
   odla-ai runbook search "<question>" [--app <id>] [--all] [--limit <n>] [--json]
@@ -6556,6 +6602,11 @@ Commands:
                (not 1) when it times out with nothing new, so a script can tell
                "no answer yet" from a failure and just rerun. Use "who" to look
                up the exact @[Label](kind/id) markup for a mention.
+  o11y         Read one stable status envelope for application RED, current
+               live-sync load/freshness, the protected commit-to-visible
+               canary, collector ingest/scheduler trust, Cloudflare-owned
+               runtime metrics, and a machine verdict.
+               --json keeps auth progress on stderr for unattended agents.
   provision    Register services, compose integrations, persist credentials, optionally push secrets.
   smoke        Verify credentials, public-config, composed schema, db aggregate, and integration probes.
   skill        Same installer; --agent accepts all, claude, codex, cursor,
@@ -7203,6 +7254,7 @@ async function codeCommand(parsed, dependencies) {
 }
 
 // src/discuss-actions.ts
+var writeMutationId = (parsed) => stringOpt(parsed.options["mutation-id"]) ?? crypto.randomUUID();
 async function request(ctx, method, path, body) {
   const res = await ctx.doFetch(`${ctx.platformUrl}/registry/discuss${path}`, {
     method,
@@ -7299,7 +7351,8 @@ async function discussPost(ctx, parsed) {
   const created = await request(ctx, "POST", "/topics", {
     appId,
     subject,
-    ...content(parsed)
+    ...content(parsed),
+    mutationId: writeMutationId(parsed)
   });
   emit(ctx, created, () => ctx.out.log(`opened topic ${created.id}`));
 }
@@ -7308,16 +7361,16 @@ async function discussReply(ctx, id, parsed) {
     ctx,
     "POST",
     `/topics/${encodeURIComponent(id)}/replies`,
-    content(parsed)
+    { ...content(parsed), mutationId: writeMutationId(parsed) }
   );
   emit(ctx, created, () => ctx.out.log(`replied ${created.id}`));
 }
-async function discussResolve(ctx, id, resolved) {
+async function discussResolve(ctx, id, resolved, parsed) {
   const result = await request(
     ctx,
     "PATCH",
     `/topics/${encodeURIComponent(id)}`,
-    { resolved }
+    { resolved, mutationId: writeMutationId(parsed) }
   );
   emit(ctx, result, () => ctx.out.log(`${resolved ? "resolved" : "reopened"} ${result.id}`));
 }
@@ -7430,7 +7483,8 @@ var ALLOWED = [
   "by",
   "self",
   "interval",
-  "timeout"
+  "timeout",
+  "mutation-id"
 ];
 function requireId(id, action) {
   if (!id) throw new Error(`"discuss ${action}" needs a topic id`);
@@ -7472,7 +7526,7 @@ async function discussCommand(parsed, deps = {}) {
     case "reply":
       return discussReply(ctx, requireId(id, "reply"), parsed);
     case "resolve":
-      return discussResolve(ctx, requireId(id, "resolve"), parsed.options.reopen !== true);
+      return discussResolve(ctx, requireId(id, "resolve"), parsed.options.reopen !== true, parsed);
     case "who":
       return discussWho(ctx, parsed);
     case "watch": {
@@ -7486,6 +7540,7 @@ async function discussCommand(parsed, deps = {}) {
 }
 
 // src/pm-actions.ts
+var writeMutationId2 = (parsed) => stringOpt(parsed.options["mutation-id"]) ?? crypto.randomUUID();
 var FIELD_MAP = {
   title: { key: "title" },
   status: { key: "status" },
@@ -7587,25 +7642,35 @@ async function pmAdd(ctx, entity, parsed) {
   if (!input.title) throw new Error("pm add needs --title <title>");
   if (entity === "bug" && !input.description)
     throw new Error("pm bug add needs --description <context> (or --body <context>)");
-  const res = await pmRequest(ctx, "POST", `/${entity}`, { appId, input });
+  const res = await pmRequest(ctx, "POST", `/${entity}`, {
+    appId,
+    input,
+    mutationId: writeMutationId2(parsed)
+  });
   emit2(ctx, res, () => ctx.out.log(`created ${entity} ${res.id}`));
 }
 async function pmGet(ctx, entity, id) {
-  const { record: record5 } = await pmRequest(ctx, "GET", `/${entity}/${encodeURIComponent(id)}`);
-  emit2(ctx, record5, () => printRecord(ctx, entity, record5));
+  const { record: record6 } = await pmRequest(ctx, "GET", `/${entity}/${encodeURIComponent(id)}`);
+  emit2(ctx, record6, () => printRecord(ctx, entity, record6));
 }
 async function pmSet(ctx, entity, id, parsed) {
   const patch2 = collectEntityFields(entity, parsed, true);
   if (Object.keys(patch2).length === 0)
     throw new Error("pm set needs at least one field flag (e.g. --status doing, --assignee me, --no-assignee)");
-  const res = await pmRequest(ctx, "PATCH", `/${entity}/${encodeURIComponent(id)}`, { patch: patch2 });
+  const res = await pmRequest(ctx, "PATCH", `/${entity}/${encodeURIComponent(id)}`, {
+    patch: patch2,
+    mutationId: writeMutationId2(parsed)
+  });
   emit2(ctx, res, () => ctx.out.log(res.record ? `${res.record.id}	[${statusCol(entity, res.record)}]	${res.record.appId}	${res.record.title ?? ""}` : `updated ${entity} ${id}`));
 }
 async function pmDone(ctx, entity, id, parsed) {
   const decisionId = stringOpt(parsed.options.decision);
   if (decisionId && entity !== "bug") throw new Error("--decision is only valid when completing a bug");
   const patch2 = { ...DONE[entity], ...decisionId ? { decisionId } : {} };
-  const res = await pmRequest(ctx, "PATCH", `/${entity}/${encodeURIComponent(id)}`, { patch: patch2 });
+  const res = await pmRequest(ctx, "PATCH", `/${entity}/${encodeURIComponent(id)}`, {
+    patch: patch2,
+    mutationId: writeMutationId2(parsed)
+  });
   emit2(ctx, res, () => ctx.out.log(`${entity} ${id} \u2192 done`));
 }
 async function allRecords(ctx, entity, appId) {
@@ -7631,9 +7696,9 @@ async function pmHandoff(ctx, parsed) {
   ]);
   const handoff = {
     appId,
-    unmetGoals: goals.filter((record5) => record5.status !== "met"),
-    activeTasks: tasks.filter((record5) => record5.column !== "done"),
-    openBugs: bugs.filter((record5) => record5.status !== "fixed" && record5.status !== "wontfix")
+    unmetGoals: goals.filter((record6) => record6.status !== "met"),
+    activeTasks: tasks.filter((record6) => record6.column !== "done"),
+    openBugs: bugs.filter((record6) => record6.status !== "fixed" && record6.status !== "wontfix")
   };
   const result = {
     ...handoff,
@@ -7652,10 +7717,10 @@ async function pmHandoff(ctx, parsed) {
     ]) {
       ctx.out.log(`${label}:`);
       if (!records.length) ctx.out.log("- (none)");
-      else for (const record5 of records) printRecord(
+      else for (const record6 of records) printRecord(
         ctx,
         label === "unmet goals" ? "goal" : label === "active tasks" ? "task" : "bug",
-        record5
+        record6
       );
     }
   });
@@ -7663,7 +7728,10 @@ async function pmHandoff(ctx, parsed) {
 async function pmComment(ctx, entity, id, parsed) {
   const body = stringOpt(parsed.options.body);
   if (!body) throw new Error('pm comment needs --body "..."');
-  await pmRequest(ctx, "POST", `/${entity}/${encodeURIComponent(id)}/comments`, { body });
+  await pmRequest(ctx, "POST", `/${entity}/${encodeURIComponent(id)}/comments`, {
+    body,
+    mutationId: writeMutationId2(parsed)
+  });
   ctx.out.log(`commented on ${entity} ${id}`);
 }
 async function pmComments(ctx, entity, id) {
@@ -7713,7 +7781,8 @@ var ALLOWED2 = [
   "decision",
   "limit",
   "offset",
-  "q"
+  "q",
+  "mutation-id"
 ];
 function requireId2(id, action) {
   if (!id) throw new Error(`"pm ... ${action}" needs an item id`);
@@ -7770,6 +7839,234 @@ async function pmCommand(parsed, deps = {}) {
   }
 }
 
+// src/o11y-verdict.ts
+function statusVerdict(reads) {
+  const reasons = [];
+  sourceHttp(reasons, "application", reads.application);
+  sourceHttp(reasons, "liveSync", reads.liveSync);
+  sourceHttp(reasons, "canary", reads.canary);
+  sourceHttp(reasons, "collector", reads.collector);
+  sourceHttp(reasons, "provider", reads.provider);
+  const liveStatus = String(reads.liveSync.body.status ?? "");
+  if (liveStatus === "partial") {
+    reasons.push({
+      source: "liveSync",
+      code: "partial_reconciliation",
+      severity: "degraded"
+    });
+  } else if (liveStatus === "stale" || liveStatus === "unavailable") {
+    reasons.push({
+      source: "liveSync",
+      code: `reconciliation_${liveStatus}`,
+      severity: "degraded"
+    });
+  }
+  const canaryStatus = String(reads.canary.body.status ?? "");
+  if (canaryStatus === "failing") {
+    reasons.push({
+      source: "canary",
+      code: String(reads.canary.body.errorCode ?? "journey_failed"),
+      severity: "unhealthy"
+    });
+  } else if (canaryStatus === "stale") {
+    reasons.push({
+      source: "canary",
+      code: "journey_stale",
+      severity: "unhealthy"
+    });
+  } else if (canaryStatus === "pending" || canaryStatus === "not_configured") {
+    reasons.push({
+      source: "canary",
+      code: `journey_${canaryStatus}`,
+      severity: "degraded"
+    });
+  }
+  const collectorStatus = String(reads.collector.body.status ?? "");
+  if (collectorStatus === "unhealthy") {
+    reasons.push({
+      source: "collector",
+      code: collectorReason(reads.collector, "collector_unhealthy"),
+      severity: "unhealthy"
+    });
+  } else if (collectorStatus === "degraded") {
+    reasons.push({
+      source: "collector",
+      code: collectorReason(reads.collector, "collector_degraded"),
+      severity: "degraded"
+    });
+  }
+  const providerStatus = String(reads.provider.body.status ?? "");
+  if (providerStatus && providerStatus !== "observed") {
+    reasons.push({
+      source: "provider",
+      code: `provider_${providerStatus}`,
+      severity: "degraded"
+    });
+  }
+  return {
+    status: reasons.some((reason) => reason.severity === "unhealthy") ? "unhealthy" : reasons.length > 0 ? "degraded" : "healthy",
+    reasons
+  };
+}
+function collectorReason(read3, fallback) {
+  const reasons = read3.body.reasons;
+  if (!Array.isArray(reasons)) return fallback;
+  const first = reasons.find(
+    (reason) => Boolean(reason) && typeof reason === "object" && !Array.isArray(reason)
+  );
+  return typeof first?.code === "string" && first.code ? first.code : fallback;
+}
+function sourceHttp(reasons, source, read3) {
+  if (read3.httpStatus >= 200 && read3.httpStatus < 300) return;
+  reasons.push({
+    source,
+    code: `http_${read3.httpStatus}`,
+    severity: read3.httpStatus >= 500 && read3.httpStatus !== 501 ? "unhealthy" : "degraded"
+  });
+}
+
+// src/o11y-command.ts
+async function o11yCommand(parsed, deps = {}) {
+  assertArgs(
+    parsed,
+    ["config", "token", "email", "json", "app", "env", "minutes"],
+    2
+  );
+  const action = parsed.positionals[1];
+  if (action !== "status") {
+    throw new Error(
+      `unknown o11y action "${action ?? ""}". Try "odla-ai o11y status --json".`
+    );
+  }
+  const minutes = statusMinutes(
+    numberOpt(parsed.options.minutes, "--minutes") ?? 60
+  );
+  const cfg = await loadProjectConfig(
+    stringOpt(parsed.options.config) ?? "odla.config.mjs"
+  );
+  const doFetch = deps.fetch ?? fetch;
+  const out = deps.stdout ?? console;
+  const token = await getDeveloperToken(
+    cfg,
+    {
+      configPath: cfg.configPath,
+      token: stringOpt(parsed.options.token),
+      email: stringOpt(parsed.options.email),
+      open: false
+    },
+    doFetch,
+    out
+  );
+  const appId = stringOpt(parsed.options.app)?.trim() || cfg.app.id;
+  const env = stringOpt(parsed.options.env)?.trim() || "prod";
+  const base = `${cfg.platformUrl}/o11y/${encodeURIComponent(appId)}`;
+  const query = new URLSearchParams({ env, minutes: String(minutes) });
+  const headers = { authorization: `Bearer ${token}` };
+  const [application, liveSync, canary, collector, provider] = await Promise.all([
+    read2(`${base}/metrics/red?${query}`, headers, doFetch),
+    read2(
+      `${base}/live-sync/health?${new URLSearchParams({ env })}`,
+      headers,
+      doFetch
+    ),
+    read2(
+      `${base}/live-sync/canary?${new URLSearchParams({ env })}`,
+      headers,
+      doFetch
+    ),
+    read2(`${base}/self-health?${query}`, headers, doFetch),
+    read2(`${base}/provider/cloudflare?${query}`, headers, doFetch)
+  ]);
+  const verdict = statusVerdict({
+    application,
+    liveSync,
+    canary,
+    collector,
+    provider
+  });
+  const status = {
+    schemaVersion: 3,
+    scope: { appId, env, minutes },
+    observedAt: (/* @__PURE__ */ new Date()).toISOString(),
+    verdict,
+    application,
+    liveSync,
+    canary,
+    collector,
+    provider
+  };
+  if (parsed.options.json === true) {
+    out.log(JSON.stringify(status, null, 2));
+    return;
+  }
+  printStatus2(status, out);
+}
+function statusMinutes(value) {
+  if (!Number.isSafeInteger(value) || value < 1 || value > 7 * 24 * 60) {
+    throw new Error("--minutes must be an integer from 1 to 10080");
+  }
+  return value;
+}
+async function read2(url, headers, doFetch) {
+  const response2 = await doFetch(url, { headers });
+  const text = await response2.text();
+  let body = {};
+  if (text) {
+    try {
+      const value = JSON.parse(text);
+      body = value && typeof value === "object" && !Array.isArray(value) ? value : { value };
+    } catch {
+      body = { message: text.slice(0, 300) };
+    }
+  }
+  return { httpStatus: response2.status, body };
+}
+function printStatus2(status, out) {
+  out.log(
+    `o11y status ${status.scope.appId}/${status.scope.env} (${status.scope.minutes}m)`
+  );
+  const routes = Array.isArray(status.application.body.routes) ? status.application.body.routes.filter(record5) : [];
+  const requests = routes.reduce(
+    (total, row) => total + numeric2(row.requests),
+    0
+  );
+  const errors = routes.reduce(
+    (total, row) => total + numeric2(row.errors),
+    0
+  );
+  out.log(
+    `application	${status.application.httpStatus}	${requests} requests	${errors} errors`
+  );
+  out.log(
+    `live-sync	${status.liveSync.httpStatus}	${String(status.liveSync.body.status ?? status.liveSync.body.error ?? "unavailable")}	${numeric2(status.liveSync.body.activeConnections)} active`
+  );
+  const canaryDurations = record5(status.canary.body.durationsMs) ? status.canary.body.durationsMs : {};
+  out.log(
+    `canary	${status.canary.httpStatus}	${String(status.canary.body.status ?? status.canary.body.error ?? "unavailable")}	${optionalNumeric(canaryDurations.publishToVisibleMs)} publish-to-visible`
+  );
+  const collectorIngest = record5(status.collector.body.ingest) ? status.collector.body.ingest : {};
+  const collectorStorage = record5(collectorIngest.storage) ? collectorIngest.storage : {};
+  out.log(
+    `collector	${status.collector.httpStatus}	${String(status.collector.body.status ?? status.collector.body.error ?? "unavailable")}	${numeric2(collectorStorage.affectedPoints)} affected points`
+  );
+  const providerMetrics = record5(status.provider.body.metrics) ? status.provider.body.metrics : {};
+  out.log(
+    `cloudflare	${status.provider.httpStatus}	${String(status.provider.body.status ?? status.provider.body.error ?? "unavailable")}	${numeric2(providerMetrics.requests)} invocations	${numeric2(providerMetrics.errors)} runtime errors`
+  );
+  out.log(
+    `verdict	${status.verdict.status}	${status.verdict.reasons.map((reason) => `${reason.source}:${reason.code}`).join(", ") || "all required signals healthy"}`
+  );
+}
+function record5(value) {
+  return Boolean(value) && typeof value === "object" && !Array.isArray(value);
+}
+function numeric2(value) {
+  return typeof value === "number" && Number.isFinite(value) ? value : 0;
+}
+function optionalNumeric(value) {
+  return typeof value === "number" && Number.isFinite(value) ? `${value} ms` : "\u2014";
+}
+
 // src/provision.ts
 var import_apps5 = require("@odla-ai/apps");
 var import_ai3 = require("@odla-ai/ai");
@@ -7947,15 +8244,6 @@ async function assertTenantAdminAccess(doFetch, cfg, env, token) {
   }
   throw new Error(`${env}: tenant access preflight (${tenantId}) failed: ${res.status} ${await safeText5(res)}`);
 }
-async function readRegistryApp(cfg, token, doFetch) {
-  const res = await doFetch(`${cfg.platformUrl}/registry/apps/${encodeURIComponent(cfg.app.id)}`, {
-    headers: { authorization: `Bearer ${token}` }
-  });
-  if (res.status === 404) return null;
-  if (!res.ok) return null;
-  const json = await res.json();
-  return json.app ?? null;
-}
 async function postJson3(doFetch, url, bearer, body) {
   const res = await doFetch(url, {
     method: "POST",
@@ -8054,7 +8342,7 @@ async function provision(options) {
   const doFetch = options.fetch ?? fetch;
   const token = await getDeveloperToken(cfg, options, doFetch, out);
   const apps = (0, import_apps5.createAppsClient)({ endpoint: cfg.platformUrl, token, fetcher: { fetch: doFetch } });
-  const existing = await readRegistryApp(cfg, token, doFetch);
+  const existing = await apps.resolveApp(cfg.app.id);
   if (existing) {
     out.log(`app: ${cfg.app.id} already exists`);
   } else {
@@ -8245,6 +8533,7 @@ var COMMAND_SURFACE = {
   doctor: {},
   help: {},
   init: {},
+  o11y: { status: {} },
   pm: {
     ...PM_ENTITIES,
     handoff: {}
@@ -8745,7 +9034,7 @@ var SOURCE2 = /\.(ts|tsx|js|jsx|mts|cts)$/;
 function gitRunner(cwd) {
   return (args) => (0, import_node_child_process7.execFileSync)("git", args, { cwd, encoding: "utf8", maxBuffer: 64 * 1024 * 1024, stdio: ["ignore", "pipe", "pipe"] });
 }
-function collectDiff(runGit, base, read2) {
+function collectDiff(runGit, base, read3) {
   let merged = "";
   try {
     merged += runGit(["diff", "--unified=3", `${base}...HEAD`]);
@@ -8758,9 +9047,9 @@ function collectDiff(runGit, base, read2) {
     merged += runGit(["diff", "--unified=3", "HEAD"]);
   } catch {
   }
-  return merged + untrackedDiff(runGit, read2);
+  return merged + untrackedDiff(runGit, read3);
 }
-function untrackedDiff(runGit, read2) {
+function untrackedDiff(runGit, read3) {
   let listed = "";
   try {
     listed = runGit(["ls-files", "--others", "--exclude-standard"]);
@@ -8776,7 +9065,7 @@ function untrackedDiff(runGit, read2) {
     if (!SOURCE2.test(path)) continue;
     let body;
     try {
-      body = read2(path);
+      body = read3(path);
     } catch {
       continue;
     }
@@ -8858,8 +9147,8 @@ function report3(ctx, impacts) {
 async function runbookImpact(ctx, options, deps = {}) {
   const cwd = deps.cwd ?? process.cwd();
   const runGit = deps.runGit ?? gitRunner(cwd);
-  const read2 = deps.readRepoFile ?? ((path) => (0, import_node_fs16.readFileSync)((0, import_node_path12.join)(cwd, path), "utf8"));
-  const surfaces = changedSurfaces(collectDiff(runGit, options.base, read2), manifestLabeller(cwd));
+  const read3 = deps.readRepoFile ?? ((path) => (0, import_node_fs16.readFileSync)((0, import_node_path12.join)(cwd, path), "utf8"));
+  const surfaces = changedSurfaces(collectDiff(runGit, options.base, read3), manifestLabeller(cwd));
   if (!surfaces.length) {
     return ctx.out.log(
       ctx.json ? JSON.stringify({ base: options.base, impacts: [] }, null, 2) : `no changes against ${options.base}`
@@ -9982,33 +10271,37 @@ function exitCodeFor(err) {
   return code === "handshake_pending" || code === "watch_timeout" ? 75 : 1;
 }
 async function runCli(argv = process.argv.slice(2), dependencies = {}) {
+  const runtime = {
+    ...dependencies,
+    stdout: redactingOutput(dependencies.stdout ?? console)
+  };
   const parsed = parseArgv(argv);
   recordInvocation(parsed);
   const command = parsed.positionals[0] ?? "help";
   if (command === "version" || command === "-v" || parsed.options.version === true) {
     assertArgs(parsed, ["version"], 1);
-    console.log(cliVersion());
+    runtime.stdout.log(cliVersion());
     return;
   }
   if (command === "help" || command === "--help" || command === "-h") {
     assertArgs(parsed, ["help"], 1);
-    printHelp();
+    printHelp(runtime.stdout);
     return;
   }
   if (command === "whoami") {
-    await whoamiCommand(parsed, dependencies);
+    await whoamiCommand(parsed, runtime);
     return;
   }
   if (command === "runbook") {
-    await runbookCommand(parsed, dependencies);
+    await runbookCommand(parsed, runtime);
     return;
   }
   if (command === "calendar") {
-    await calendarCommand(parsed, dependencies);
+    await calendarCommand(parsed, runtime);
     return;
   }
   if (command === "code") {
-    await codeCommand(parsed, dependencies);
+    await codeCommand(parsed, runtime);
     return;
   }
   if (command === "admin") {
@@ -10016,26 +10309,30 @@ async function runCli(argv = process.argv.slice(2), dependencies = {}) {
     return;
   }
   if (command === "app") {
-    await appCommand(parsed, dependencies);
+    await appCommand(parsed, runtime);
     return;
   }
   if (command === "security") {
-    await securityCommand(parsed, dependencies);
+    await securityCommand(parsed, runtime);
     return;
   }
   if (command === "pm") {
-    await pmCommand(parsed, dependencies);
+    await pmCommand(parsed, runtime);
     return;
   }
   if (command === "discuss") {
-    await discussCommand(parsed, dependencies);
+    await discussCommand(parsed, runtime);
+    return;
+  }
+  if (command === "o11y") {
+    await o11yCommand(parsed, runtime);
     return;
   }
   if (command === "provision") {
-    await provisionCommand(parsed, dependencies);
+    await provisionCommand(parsed, runtime);
     return;
   }
-  if (await projectCommand(command, parsed, dependencies)) return;
+  if (await projectCommand(command, parsed, runtime)) return;
   throw new Error(`unknown command "${command}". Run "odla-ai help".`);
 }
 async function provisionCommand(parsed, dependencies) {
@@ -10101,7 +10398,7 @@ async function calendarCommand(parsed, dependencies) {
 
 // src/bin.ts
 runCli().catch((err) => {
-  console.error(`odla-ai: ${err instanceof Error ? err.message : String(err)}`);
+  console.error(redactSecrets(`odla-ai: ${err instanceof Error ? err.message : String(err)}`));
   process.exitCode = exitCodeFor(err);
 });
 //# sourceMappingURL=bin.cjs.map