@odla-ai/cli 0.25.20 → 0.25.22

package/dist/bin.cjs

@@ -43,7 +43,9 @@ function approvalLines(prompt) {
   lines.push("");
   lines.push(`   ${prompt.approvalUrl}`);
   lines.push("");
-  lines.push("   A signed-in odla admin opens that URL, checks the code matches, and approves.");
+  lines.push(
+    `   ${prompt.approver ?? "The matching signed-in odla account"} opens that URL, checks the code matches, and approves.`
+  );
   lines.push("   Opening the link without approving does nothing; this command waits until they do.");
   if (prompt.browserAttempted) {
     lines.push("   A browser launch was attempted, but it is best-effort and may have shown no tab.");
@@ -82,22 +84,22 @@ function readJsonFile(path) {
     return null;
   }
 }
-function writePrivateJson(path, value) {
-  writePrivateText(path, `${JSON.stringify(value, null, 2)}
+function writePrivateJson(path, value2) {
+  writePrivateText(path, `${JSON.stringify(value2, null, 2)}
 `);
 }
 function readCredentials(path) {
   if (!(0, import_node_fs.existsSync)(path)) return null;
-  let value;
+  let value2;
   try {
-    value = JSON.parse((0, import_node_fs.readFileSync)(path, "utf8"));
+    value2 = JSON.parse((0, import_node_fs.readFileSync)(path, "utf8"));
   } catch {
     throw new Error(`credentials file ${path} is not valid JSON; fix or remove it before provisioning`);
   }
-  if (!value || typeof value !== "object" || typeof value.appId !== "string" || !value.envs || typeof value.envs !== "object") {
+  if (!value2 || typeof value2 !== "object" || typeof value2.appId !== "string" || !value2.envs || typeof value2.envs !== "object") {
     throw new Error(`credentials file ${path} has an invalid shape; fix or remove it before provisioning`);
   }
-  return value;
+  return value2;
 }
 function mergeCredential(current, update) {
   const next = current ?? {
@@ -392,8 +394,8 @@ function stillPending(pending, email) {
     { retryable: true }
   );
 }
-function handshakeEmail(value, cached) {
-  const email = (value ?? import_node_process3.default.env.ODLA_USER_EMAIL ?? cached ?? "").trim().toLowerCase();
+function handshakeEmail(value2, cached) {
+  const email = (value2 ?? import_node_process3.default.env.ODLA_USER_EMAIL ?? cached ?? "").trim().toLowerCase();
   if (email.length > 254 || !/^[^\s@]+@[^\s@]+\.[^\s@]+$/.test(email)) {
     throw new Error("a fresh odla handshake requires --email <account> or ODLA_USER_EMAIL");
   }
@@ -417,10 +419,10 @@ function handshakeUrl(platformUrl, userCode) {
   url.searchParams.set("code", userCode);
   return url.toString();
 }
-function platformAudience(value) {
+function platformAudience(value2) {
   let url;
   try {
-    url = new URL(value);
+    url = new URL(value2);
   } catch {
     throw new Error("platform must be an absolute URL");
   }
@@ -439,22 +441,22 @@ var import_node_process4 = __toESM(require("process"), 1);
 var MAX_BYTES = 64 * 1024;
 async function secretInputValue(options, kind = "credential") {
   if (options.fromEnv && options.stdin) throw new Error("choose exactly one of --from-env or --stdin");
-  let value;
-  if (options.fromEnv) value = import_node_process4.default.env[options.fromEnv];
-  else if (options.stdin) value = await (options.readStdin ?? (() => readSecretStream(kind)))();
+  let value2;
+  if (options.fromEnv) value2 = import_node_process4.default.env[options.fromEnv];
+  else if (options.stdin) value2 = await (options.readStdin ?? (() => readSecretStream(kind)))();
   else throw new Error(`${kind} input required: use --from-env <NAME> or --stdin; values are never accepted as arguments`);
-  value = value?.replace(/[\r\n]+$/, "");
-  if (!value) throw new Error(options.fromEnv ? `environment variable ${options.fromEnv} is empty or unset` : `stdin ${kind} is empty`);
-  if (new TextEncoder().encode(value).byteLength > MAX_BYTES) throw new Error(`${kind} exceeds 64 KiB`);
-  return value;
+  value2 = value2?.replace(/[\r\n]+$/, "");
+  if (!value2) throw new Error(options.fromEnv ? `environment variable ${options.fromEnv} is empty or unset` : `stdin ${kind} is empty`);
+  if (new TextEncoder().encode(value2).byteLength > MAX_BYTES) throw new Error(`${kind} exceeds 64 KiB`);
+  return value2;
 }
 async function readSecretStream(kind, stream = import_node_process4.default.stdin) {
-  let value = "";
+  let value2 = "";
   for await (const chunk of stream) {
-    value += String(chunk);
-    if (value.length > MAX_BYTES) throw new Error(`${kind} exceeds 64 KiB`);
+    value2 += String(chunk);
+    if (value2.length > MAX_BYTES) throw new Error(`${kind} exceeds 64 KiB`);
   }
-  return value;
+  return value2;
 }
 
 // src/admin-ai-auth.ts
@@ -489,6 +491,8 @@ function audienceBoundEnvToken(token, platform) {
   return token;
 }
 var SCOPE_PURPOSE = {
+  "platform:status:read": "read the platform fleet health and deployment snapshot",
+  "app:config:read": "compare checked-in intent with an exact-id app Registry configuration",
   "platform:runbook:write": "add or edit odla's operational runbooks",
   "platform:ai:policy:write": "change System AI model routing",
   "platform:ai:policy:read": "read System AI model routing",
@@ -525,6 +529,7 @@ async function scopedToken(platform, scope, options, doFetch, out) {
         approvalUrl,
         minutesLeft: Math.floor(expiresIn / 60),
         purpose: SCOPE_PURPOSE[scope] ?? `use ${scope}`,
+        approver: scope.startsWith("app:") ? "A signed-in app owner" : "A signed-in odla platform admin",
         browserAttempted: browser.open,
         browserSkipped: browser.reason
       });
@@ -592,13 +597,13 @@ function apiError(status, body) {
   const message2 = error && typeof error.message === "string" ? error.message : isRecord(body) && typeof body.message === "string" ? body.message : "request failed";
   return `read System AI admin changes failed (${status}): ${message2}`;
 }
-function timestamp(value) {
-  if (typeof value !== "number" || !Number.isFinite(value)) return String(value ?? "");
-  const date = new Date(value);
+function timestamp(value2) {
+  if (typeof value2 !== "number" || !Number.isFinite(value2)) return String(value2 ?? "");
+  const date = new Date(value2);
   return Number.isFinite(date.valueOf()) ? date.toISOString() : "";
 }
-function isRecord(value) {
-  return Boolean(value) && typeof value === "object" && !Array.isArray(value);
+function isRecord(value2) {
+  return Boolean(value2) && typeof value2 === "object" && !Array.isArray(value2);
 }
 
 // src/admin-ai-policy.ts
@@ -608,11 +613,11 @@ var SYSTEM_AI_PURPOSES = [
   "security.validation",
   "runbook.answer"
 ];
-function requireSystemAiPurpose(value) {
-  if (!SYSTEM_AI_PURPOSES.includes(value)) {
+function requireSystemAiPurpose(value2) {
+  if (!SYSTEM_AI_PURPOSES.includes(value2)) {
     throw new Error(`purpose must be one of: ${SYSTEM_AI_PURPOSES.join(", ")}`);
   }
-  return value;
+  return value2;
 }
 
 // src/admin-ai-usage.ts
@@ -634,11 +639,11 @@ async function readAdminAiUsage(request2) {
   if (request2.json) request2.stdout.log(JSON.stringify(body, null, 2));
   else printUsage(body, request2.stdout);
 }
-function usageLimit(value) {
-  if (!Number.isSafeInteger(value) || value < 1 || value > 500) {
+function usageLimit(value2) {
+  if (!Number.isSafeInteger(value2) || value2 < 1 || value2 > 500) {
     throw new Error("usage limit must be an integer from 1 to 500");
   }
-  return value;
+  return value2;
 }
 function printUsage(body, out) {
   const aggregates = isRecord2(body) && isRecord2(body.aggregates) && Array.isArray(body.aggregates.byStatus) ? body.aggregates.byStatus.filter(isRecord2) : [];
@@ -674,15 +679,15 @@ when	app/env	run	actor	purpose/role	route / policy	tokens	cost	status`);
     ].join("	"));
   }
 }
-function numeric(value) {
-  return typeof value === "number" && Number.isFinite(value) ? value : 0;
+function numeric(value2) {
+  return typeof value2 === "number" && Number.isFinite(value2) ? value2 : 0;
 }
-function formatMicrousd(value) {
-  return typeof value === "number" && Number.isFinite(value) ? `$${(value / 1e6).toFixed(6)}` : "unpriced";
+function formatMicrousd(value2) {
+  return typeof value2 === "number" && Number.isFinite(value2) ? `$${(value2 / 1e6).toFixed(6)}` : "unpriced";
 }
-function timestamp2(value) {
-  if (typeof value !== "number" || !Number.isFinite(value)) return String(value ?? "");
-  const date = new Date(value);
+function timestamp2(value2) {
+  if (typeof value2 !== "number" || !Number.isFinite(value2)) return String(value2 ?? "");
+  const date = new Date(value2);
   return Number.isFinite(date.valueOf()) ? date.toISOString() : "";
 }
 async function responseBody2(res) {
@@ -694,13 +699,13 @@ async function responseBody2(res) {
     return { message: text.slice(0, 300) };
   }
 }
-function apiError2(action, status, body) {
+function apiError2(action2, status, body) {
   const error = isRecord2(body) && isRecord2(body.error) ? body.error : void 0;
   const message2 = error && typeof error.message === "string" ? error.message : isRecord2(body) && typeof body.message === "string" ? body.message : "request failed";
-  return `${action} failed (${status}): ${message2}`;
+  return `${action2} failed (${status}): ${message2}`;
 }
-function isRecord2(value) {
-  return Boolean(value) && typeof value === "object" && !Array.isArray(value);
+function isRecord2(value2) {
+  return Boolean(value2) && typeof value2 === "object" && !Array.isArray(value2);
 }
 
 // src/admin-ai.ts
@@ -745,11 +750,11 @@ async function adminAi(options) {
   }
   if (options.action === "credential-set") {
     const provider = requireProvider(options.credentialProvider);
-    const value = await secretInputValue(options);
+    const value2 = await secretInputValue(options);
     const res2 = await doFetch(`${platform}/registry/platform/ai-credentials/${encodeURIComponent(provider)}`, {
       method: "PUT",
       headers,
-      body: JSON.stringify({ value })
+      body: JSON.stringify({ value: value2 })
     });
     const body2 = await responseBody3(res2);
     if (!res2.ok) throw new Error(apiError3(`store ${provider} platform credential`, res2.status, body2));
@@ -849,11 +854,11 @@ async function adminAi(options) {
   const policy = isRecord3(response2) && isRecord3(response2.policy) ? response2.policy : isRecord3(response2) ? response2 : {};
   out.log(options.json ? JSON.stringify({ policy }, null, 2) : `updated ${purpose}: ${String(policy.provider ?? "unchanged")}/${String(policy.model ?? "unchanged")}`);
 }
-function requireProvider(value) {
-  if (value !== "anthropic" && value !== "openai" && value !== "google") {
+function requireProvider(value2) {
+  if (value2 !== "anthropic" && value2 !== "openai" && value2 !== "google") {
     throw new Error("provider must be one of: anthropic, openai, google");
   }
-  return value;
+  return value2;
 }
 function policyArray(body) {
   if (isRecord3(body) && Array.isArray(body.policies)) return body.policies.filter(isRecord3);
@@ -864,7 +869,7 @@ function catalogModels(body) {
   if (!isRecord3(body) || !isRecord3(body.catalog) || !Array.isArray(body.catalog.models)) {
     throw new Error("platform returned an invalid System AI model catalog");
   }
-  return body.catalog.models.filter((value) => isRecord3(value) && typeof value.id === "string" && typeof value.provider === "string");
+  return body.catalog.models.filter((value2) => isRecord3(value2) && typeof value2.id === "string" && typeof value2.provider === "string");
 }
 async function responseBody3(res) {
   const text = await res.text();
@@ -875,13 +880,13 @@ async function responseBody3(res) {
     return { message: text.slice(0, 300) };
   }
 }
-function apiError3(action, status, body) {
+function apiError3(action2, status, body) {
   const error = isRecord3(body) && isRecord3(body.error) ? body.error : void 0;
   const message2 = error && typeof error.message === "string" ? error.message : isRecord3(body) && typeof body.message === "string" ? body.message : "request failed";
-  return `${action} failed (${status}): ${message2}`;
+  return `${action2} failed (${status}): ${message2}`;
 }
-function isRecord3(value) {
-  return Boolean(value) && typeof value === "object" && !Array.isArray(value);
+function isRecord3(value2) {
+  return Boolean(value2) && typeof value2 === "object" && !Array.isArray(value2);
 }
 
 // src/argv.ts
@@ -905,10 +910,10 @@ function parseArgv(argv) {
       addOption(options, rawName, arg.slice(eq + 1));
       continue;
     }
-    const value = argv[i + 1];
-    if (value !== void 0 && !value.startsWith("--")) {
+    const value2 = argv[i + 1];
+    if (value2 !== void 0 && !value2.startsWith("--")) {
       i++;
-      addOption(options, rawName, value);
+      addOption(options, rawName, value2);
     } else {
       addOption(options, rawName, true);
     }
@@ -924,39 +929,39 @@ function assertArgs(parsed, allowedOptions2, maxPositionals) {
     throw new Error(`unexpected argument "${parsed.positionals[maxPositionals]}"; run "odla-ai help"`);
   }
 }
-function requiredString(value, name) {
-  const result = stringOpt(value);
+function requiredString(value2, name) {
+  const result = stringOpt(value2);
   if (!result) throw new Error(`${name} is required`);
   return result;
 }
-function stringOpt(value) {
-  if (typeof value === "string") return value;
-  if (Array.isArray(value)) return value[value.length - 1];
+function stringOpt(value2) {
+  if (typeof value2 === "string") return value2;
+  if (Array.isArray(value2)) return value2[value2.length - 1];
   return void 0;
 }
-function listOpt(value) {
-  if (value === void 0 || typeof value === "boolean") return void 0;
-  const values = Array.isArray(value) ? value : [value];
+function listOpt(value2) {
+  if (value2 === void 0 || typeof value2 === "boolean") return void 0;
+  const values = Array.isArray(value2) ? value2 : [value2];
   return values.flatMap((item) => item.split(",")).map((item) => item.trim()).filter(Boolean);
 }
-function boolOpt(value) {
-  if (typeof value === "boolean") return value;
-  if (typeof value === "string" && (value === "true" || value === "false")) return value === "true";
-  if (value === void 0) return void 0;
+function boolOpt(value2) {
+  if (typeof value2 === "boolean") return value2;
+  if (typeof value2 === "string" && (value2 === "true" || value2 === "false")) return value2 === "true";
+  if (value2 === void 0) return void 0;
   throw new Error("boolean option must be true or false");
 }
-function numberOpt(value, flag) {
-  if (value === void 0) return void 0;
-  const raw = stringOpt(value);
+function numberOpt(value2, flag) {
+  if (value2 === void 0) return void 0;
+  const raw = stringOpt(value2);
   const parsed = raw === void 0 ? Number.NaN : Number(raw);
   if (!Number.isSafeInteger(parsed) || parsed < 1) throw new Error(`${flag} requires a positive integer`);
   return parsed;
 }
-function addOption(options, name, value) {
+function addOption(options, name, value2) {
   const current = options[name];
-  if (current === void 0) options[name] = value;
-  else if (Array.isArray(current)) current.push(String(value));
-  else options[name] = [String(current), String(value)];
+  if (current === void 0) options[name] = value2;
+  else if (Array.isArray(current)) current.push(String(value2));
+  else options[name] = [String(current), String(value2)];
 }
 
 // src/operator-context.ts
@@ -1023,17 +1028,17 @@ function validateProbes(integration, at) {
     }
   }
 }
-function isRecord4(value) {
-  return value !== null && typeof value === "object" && !Array.isArray(value);
+function isRecord4(value2) {
+  return value2 !== null && typeof value2 === "object" && !Array.isArray(value2);
 }
-function safeText(value, max) {
-  return typeof value === "string" && value.trim().length > 0 && value.length <= max && !/[\u0000-\u001f\u007f]/.test(value);
+function safeText(value2, max) {
+  return typeof value2 === "string" && value2.trim().length > 0 && value2.length <= max && !/[\u0000-\u001f\u007f]/.test(value2);
 }
-function safeProbePath(value) {
-  return typeof value === "string" && /^\/[A-Za-z0-9._~!$&'()*+,;=:@%/-]*$/.test(value);
+function safeProbePath(value2) {
+  return typeof value2 === "string" && /^\/[A-Za-z0-9._~!$&'()*+,;=:@%/-]*$/.test(value2);
 }
-function validId(value) {
-  return typeof value === "string" && /^[a-z0-9][a-z0-9-]*$/.test(value);
+function validId(value2) {
+  return typeof value2 === "string" && /^[a-z0-9][a-z0-9-]*$/.test(value2);
 }
 function unique(values) {
   return [...new Set(values.filter(Boolean))];
@@ -1075,10 +1080,10 @@ async function loadProjectConfig(configPath = "odla.config.mjs") {
     local
   };
 }
-async function resolveDataExport(cfg, value, names) {
-  if (value === void 0 || value === null || value === false) return void 0;
-  if (typeof value !== "string") return value;
-  const target = (0, import_node_path4.isAbsolute)(value) ? value : (0, import_node_path4.resolve)(cfg.rootDir, value);
+async function resolveDataExport(cfg, value2, names) {
+  if (value2 === void 0 || value2 === null || value2 === false) return void 0;
+  if (typeof value2 !== "string") return value2;
+  const target = (0, import_node_path4.isAbsolute)(value2) ? value2 : (0, import_node_path4.resolve)(cfg.rootDir, value2);
   if (target.endsWith(".json")) {
     return JSON.parse((0, import_node_fs4.readFileSync)(target, "utf8"));
   }
@@ -1087,7 +1092,7 @@ async function resolveDataExport(cfg, value, names) {
     if (mod[name] !== void 0) return mod[name];
   }
   if (mod.default !== void 0) return mod.default;
-  throw new Error(`${value} did not export ${names.join(", ")} or default`);
+  throw new Error(`${value2} did not export ${names.join(", ")} or default`);
 }
 function buildPlan(cfg) {
   const integrationSchema = cfg.integrations?.some((integration) => integration.schema) ?? false;
@@ -1121,9 +1126,9 @@ function calendarServiceConfig(cfg, env) {
   };
 }
 function calendarBookingPageUrl(cfg, env) {
-  const value = cfg.calendar?.google.bookingPageUrl?.[env];
-  if (value === void 0 || value === null) return value;
-  return new URL(value).toString();
+  const value2 = cfg.calendar?.google.bookingPageUrl?.[env];
+  if (value2 === void 0 || value2 === null) return value2;
+  return new URL(value2).toString();
 }
 function rulesFromSchema(schema) {
   const entities = serializedEntities(schema);
@@ -1137,10 +1142,10 @@ function serializedEntities(schema) {
   if (!entities || typeof entities !== "object" || Array.isArray(entities)) return [];
   return Object.keys(entities);
 }
-function envValue(value) {
-  if (!value) return void 0;
-  if (value.startsWith("$")) return process.env[value.slice(1)];
-  return value;
+function envValue(value2) {
+  if (!value2) return void 0;
+  if (value2.startsWith("$")) return process.env[value2.slice(1)];
+  return value2;
 }
 function validateRawConfig(raw, path) {
   if (!raw || typeof raw !== "object") throw new Error(`${path} must export an object`);
@@ -1196,8 +1201,8 @@ function validateCalendarConfig(cfg, envs, services, path) {
     if (!isRecord5(google.bookingCalendar)) throw new Error(`${path}: calendar.google.bookingCalendar must map env names to one calendar id`);
     const unknownBookingEnv = Object.keys(google.bookingCalendar).find((env) => !envs.includes(env));
     if (unknownBookingEnv) throw new Error(`${path}: calendar.google.bookingCalendar.${unknownBookingEnv} is not in config envs`);
-    for (const [env, value] of Object.entries(google.bookingCalendar)) {
-      if (!safeText2(value, 1024)) {
+    for (const [env, value2] of Object.entries(google.bookingCalendar)) {
+      if (!safeText2(value2, 1024)) {
         throw new Error(`${path}: calendar.google.bookingCalendar.${env} must be a calendar id`);
       }
     }
@@ -1206,8 +1211,8 @@ function validateCalendarConfig(cfg, envs, services, path) {
     if (!isRecord5(google.bookingPageUrl)) throw new Error(`${path}: calendar.google.bookingPageUrl must map env names to HTTPS URLs or null`);
     const unknownBookingEnv = Object.keys(google.bookingPageUrl).find((env) => !envs.includes(env));
     if (unknownBookingEnv) throw new Error(`${path}: calendar.google.bookingPageUrl.${unknownBookingEnv} is not in config envs`);
-    for (const [env, value] of Object.entries(google.bookingPageUrl)) {
-      if (value !== null && !safeHttpsUrl(value)) {
+    for (const [env, value2] of Object.entries(google.bookingPageUrl)) {
+      if (value2 !== null && !safeHttpsUrl(value2)) {
         throw new Error(`${path}: calendar.google.bookingPageUrl.${env} must be an HTTPS URL without credentials or fragment`);
       }
     }
@@ -1226,37 +1231,37 @@ function validateServices(services, path) {
     }
   }
 }
-function assertOnly(value, allowed, label) {
-  const extra = Object.keys(value).find((key) => !allowed.includes(key));
+function assertOnly(value2, allowed, label) {
+  const extra = Object.keys(value2).find((key) => !allowed.includes(key));
   if (extra) throw new Error(`${label}.${extra} is not supported`);
 }
-function isRecord5(value) {
-  return value !== null && typeof value === "object" && !Array.isArray(value);
+function isRecord5(value2) {
+  return value2 !== null && typeof value2 === "object" && !Array.isArray(value2);
 }
-function safeText2(value, max) {
-  return typeof value === "string" && value.trim().length > 0 && value.length <= max && !/[\u0000-\u001f\u007f]/.test(value);
+function safeText2(value2, max) {
+  return typeof value2 === "string" && value2.trim().length > 0 && value2.length <= max && !/[\u0000-\u001f\u007f]/.test(value2);
 }
-function safeHttpsUrl(value) {
-  if (typeof value !== "string" || value.length > 2048) return false;
+function safeHttpsUrl(value2) {
+  if (typeof value2 !== "string" || value2.length > 2048) return false;
   try {
-    const url = new URL(value);
+    const url = new URL(value2);
     return url.protocol === "https:" && !url.username && !url.password && !url.hash;
   } catch {
     return false;
   }
 }
-function validId2(value) {
-  return typeof value === "string" && /^[a-z0-9][a-z0-9-]*$/.test(value);
+function validId2(value2) {
+  return typeof value2 === "string" && /^[a-z0-9][a-z0-9-]*$/.test(value2);
 }
 async function loadConfigModule(path) {
   if (path.endsWith(".json")) return JSON.parse((0, import_node_fs4.readFileSync)(path, "utf8"));
   const mod = await import(`${(0, import_node_url.pathToFileURL)(path).href}?t=${Date.now()}`);
-  const value = mod.default ?? mod.config;
-  if (typeof value === "function") return await value();
-  return value;
+  const value2 = mod.default ?? mod.config;
+  if (typeof value2 === "function") return await value2();
+  return value2;
 }
-function trimSlash(value) {
-  return value.replace(/\/+$/, "");
+function trimSlash(value2) {
+  return value2.replace(/\/+$/, "");
 }
 function unique2(values) {
   return [...new Set(values.filter(Boolean))];
@@ -1282,8 +1287,8 @@ function resolveOperatorProfile(parsed) {
   }
   assertOperatorName(name, "context");
   const profiles = readOperatorProfiles(file);
-  const value = Object.hasOwn(profiles, name) ? profiles[name] : void 0;
-  if (!value) {
+  const value2 = Object.hasOwn(profiles, name) ? profiles[name] : void 0;
+  if (!value2) {
     throw new Error(
       `operator context "${name}" not found in ${file}; run "odla-ai context list" or save it first`
     );
@@ -1292,7 +1297,7 @@ function resolveOperatorProfile(parsed) {
     name,
     source: fromFlag ? "flag" : "environment",
     file,
-    value
+    value: value2
   };
 }
 function listOperatorProfiles(file = operatorProfileFile()) {
@@ -1320,8 +1325,8 @@ function operatorCredentialFiles(selection) {
     scoped: (0, import_node_path5.join)(base, "admin-token.local.json")
   };
 }
-function assertOperatorName(value, label) {
-  if (!/^[a-z0-9][a-z0-9-]*$/.test(value)) {
+function assertOperatorName(value2, label) {
+  if (!/^[a-z0-9][a-z0-9-]*$/.test(value2)) {
     throw new Error(
       `${label} must contain lowercase letters, numbers, and hyphens`
     );
@@ -1347,22 +1352,22 @@ function readOperatorProfiles(file) {
     );
   }
   const profiles = emptyProfiles();
-  for (const [name, value] of Object.entries(
+  for (const [name, value2] of Object.entries(
     raw.profiles
   )) {
     assertOperatorName(name, "context");
-    profiles[name] = validateProfile(value, `operator context "${name}"`);
+    profiles[name] = validateProfile(value2, `operator context "${name}"`);
   }
   return profiles;
 }
 function emptyProfiles() {
   return /* @__PURE__ */ Object.create(null);
 }
-function validateProfile(value, label) {
-  if (!value || typeof value !== "object" || Array.isArray(value)) {
+function validateProfile(value2, label) {
+  if (!value2 || typeof value2 !== "object" || Array.isArray(value2)) {
     throw new Error(`${label} has an invalid shape`);
   }
-  const unknown = Object.keys(value).filter(
+  const unknown = Object.keys(value2).filter(
     (key) => !["platform", "app", "environment"].includes(key)
   );
   if (unknown.length > 0) {
@@ -1370,7 +1375,7 @@ function validateProfile(value, label) {
       `${label} contains unsupported field(s): ${unknown.sort().join(", ")}; contexts store scope metadata only, never credentials`
     );
   }
-  const candidate = value;
+  const candidate = value2;
   if (typeof candidate.platform !== "string") {
     throw new Error(`${label} needs an absolute platform URL`);
   }
@@ -1385,8 +1390,8 @@ function validateProfile(value, label) {
     ...environment2 ? { environment: environment2 } : {}
   };
 }
-function clean(value) {
-  const normalized = value?.trim();
+function clean(value2) {
+  const normalized = value2?.trim();
   return normalized || void 0;
 }
 
@@ -1479,8 +1484,8 @@ async function resolveOperatorContext(parsed, options = {}) {
     }
   };
 }
-function clean2(value) {
-  const normalized = value?.trim();
+function clean2(value2) {
+  const normalized = value2?.trim();
   return normalized || void 0;
 }
 
@@ -1502,21 +1507,21 @@ var SET_OPTIONS = [
 ];
 async function adminCommand(parsed, deps = {}) {
   const area = parsed.positionals[1];
-  const action = parsed.positionals[2];
-  const credentialSet = action === "credential" && parsed.positionals[3] === "set";
-  const credentials = action === "credentials";
-  const models = action === "models";
-  const usage = action === "usage";
-  const audit = action === "audit";
-  if (area !== "ai" || action !== "show" && action !== "set" && !credentialSet && !credentials && !models && !usage && !audit) {
+  const action2 = parsed.positionals[2];
+  const credentialSet = action2 === "credential" && parsed.positionals[3] === "set";
+  const credentials = action2 === "credentials";
+  const models = action2 === "models";
+  const usage = action2 === "usage";
+  const audit = action2 === "audit";
+  if (area !== "ai" || action2 !== "show" && action2 !== "set" && !credentialSet && !credentials && !models && !usage && !audit) {
     throw new Error('unknown admin command. Try "odla-ai admin ai show".');
   }
-  const allowed = credentialSet ? [...CONTEXT_OPTIONS, "from-env", "stdin"] : action === "set" ? SET_OPTIONS : models ? [...JSON_OPTIONS, "provider"] : usage ? [...JSON_OPTIONS, "app-id", "env", "run-id", "limit"] : audit ? [...JSON_OPTIONS, "limit"] : JSON_OPTIONS;
-  assertArgs(parsed, allowed, credentialSet ? 5 : action === "set" ? 4 : 3);
+  const allowed = credentialSet ? [...CONTEXT_OPTIONS, "from-env", "stdin"] : action2 === "set" ? SET_OPTIONS : models ? [...JSON_OPTIONS, "provider"] : usage ? [...JSON_OPTIONS, "app-id", "env", "run-id", "limit"] : audit ? [...JSON_OPTIONS, "limit"] : JSON_OPTIONS;
+  assertArgs(parsed, allowed, credentialSet ? 5 : action2 === "set" ? 4 : 3);
   const context = await resolveOperatorContext(parsed, { allowMissingConfig: true });
   await adminAi({
-    action: credentialSet ? "credential-set" : credentials ? "credentials" : models ? "models" : usage ? "usage" : audit ? "audit" : action,
-    purpose: action === "set" ? parsed.positionals[3] : void 0,
+    action: credentialSet ? "credential-set" : credentials ? "credentials" : models ? "models" : usage ? "usage" : audit ? "audit" : action2,
+    purpose: action2 === "set" ? parsed.positionals[3] : void 0,
     provider: stringOpt(parsed.options.provider),
     model: stringOpt(parsed.options.model),
     enabled: boolOpt(parsed.options.enabled),
@@ -1573,12 +1578,12 @@ function bothTenants(cfg) {
 
 // src/agent-command.ts
 async function agentCommand(parsed, deps = {}) {
-  const action = parsed.positionals[1];
-  if (action !== "jobs" && action !== "retry") {
-    throw new Error(`unknown agent action "${action ?? ""}". Try "odla-ai agent jobs --json".`);
+  const action2 = parsed.positionals[1];
+  if (action2 !== "jobs" && action2 !== "retry") {
+    throw new Error(`unknown agent action "${action2 ?? ""}". Try "odla-ai agent jobs --json".`);
   }
-  assertArgs(parsed, ["config", "env", "state", "limit", "json", "token", "email"], action === "jobs" ? 2 : 3);
-  if (action === "retry" && (parsed.options.state !== void 0 || parsed.options.limit !== void 0)) {
+  assertArgs(parsed, ["config", "env", "state", "limit", "json", "token", "email"], action2 === "jobs" ? 2 : 3);
+  if (action2 === "retry" && (parsed.options.state !== void 0 || parsed.options.limit !== void 0)) {
     throw new Error('--state and --limit are supported only by "agent jobs"');
   }
   const cfg = await loadProjectConfig(stringOpt(parsed.options.config) ?? "odla.config.mjs");
@@ -1598,7 +1603,7 @@ async function agentCommand(parsed, deps = {}) {
   );
   const base = `${cfg.dbEndpoint}/app/${encodeURIComponent(tenant)}/admin/agent-jobs`;
   const headers = { authorization: `Bearer ${credential2}` };
-  if (action === "retry") {
+  if (action2 === "retry") {
     const id = parsed.positionals[2];
     const res2 = await doFetch(`${base}/${encodeURIComponent(id)}/retry`, { method: "POST", headers });
     const body2 = await readJson(res2);
@@ -2034,7 +2039,7 @@ async function copyFiles(cfg, token, route2, doFetch, out) {
 }
 
 // src/app-lifecycle.ts
-async function lifecycleCall(action, options) {
+async function lifecycleCall(action2, options) {
   const cfg = await loadProjectConfig(options.configPath);
   const out = options.stdout ?? console;
   const doFetch = options.fetch ?? fetch;
@@ -2044,13 +2049,13 @@ async function lifecycleCall(action, options) {
     doFetch,
     out
   );
-  const res = await doFetch(`${cfg.platformUrl}/registry/apps/${encodeURIComponent(cfg.app.id)}/${action}`, {
+  const res = await doFetch(`${cfg.platformUrl}/registry/apps/${encodeURIComponent(cfg.app.id)}/${action2}`, {
     method: "POST",
     headers: { authorization: `Bearer ${token}`, "content-type": "application/json" }
   });
   const body = await res.json().catch(() => ({}));
   if (!res.ok || !body.ok) {
-    throw new Error(`${action} failed${body.error?.code ? ` (${body.error.code})` : ""}: ${body.error?.message ?? `registry returned ${res.status}`}`);
+    throw new Error(`${action2} failed${body.error?.code ? ` (${body.error.code})` : ""}: ${body.error?.message ?? `registry returned ${res.status}`}`);
   }
   return body;
 }
@@ -2191,44 +2196,44 @@ var REPLACEMENTS = [
   [/\b(ghp|gho|github_pat)_[A-Za-z0-9_]+/g, "$1_[redacted]"],
   [/\bAKIA[A-Z0-9]{12,}/g, "AKIA[redacted]"]
 ];
-function redactSecrets(value) {
-  let result = value;
+function redactSecrets(value2) {
+  let result = value2;
   for (const [pattern, replacement] of REPLACEMENTS) result = result.replace(pattern, replacement);
   return result;
 }
 function redactingOutput(output) {
-  const redactArgs = (args) => args.map((value) => redactOutputValue(value, /* @__PURE__ */ new WeakMap()));
+  const redactArgs = (args) => args.map((value2) => redactOutputValue(value2, /* @__PURE__ */ new WeakMap()));
   return {
     log: (...args) => output.log(...redactArgs(args)),
     error: (...args) => output.error(...redactArgs(args))
   };
 }
-function redactOutputValue(value, seen) {
-  if (typeof value === "string") return redactSecrets(value);
-  if (value instanceof Error) {
-    const redacted = new Error(redactSecrets(value.message));
-    redacted.name = value.name;
-    if (value.stack) redacted.stack = redactSecrets(value.stack);
+function redactOutputValue(value2, seen) {
+  if (typeof value2 === "string") return redactSecrets(value2);
+  if (value2 instanceof Error) {
+    const redacted = new Error(redactSecrets(value2.message));
+    redacted.name = value2.name;
+    if (value2.stack) redacted.stack = redactSecrets(value2.stack);
     return redacted;
   }
-  if (!value || typeof value !== "object") return value;
-  const prior = seen.get(value);
+  if (!value2 || typeof value2 !== "object") return value2;
+  const prior = seen.get(value2);
   if (prior) return prior;
-  if (Array.isArray(value)) {
+  if (Array.isArray(value2)) {
     const next2 = [];
-    seen.set(value, next2);
-    for (const item of value) next2.push(redactOutputValue(item, seen));
+    seen.set(value2, next2);
+    for (const item of value2) next2.push(redactOutputValue(item, seen));
     return next2;
   }
-  const prototype = Object.getPrototypeOf(value);
-  if (prototype !== Object.prototype && prototype !== null) return value;
+  const prototype = Object.getPrototypeOf(value2);
+  if (prototype !== Object.prototype && prototype !== null) return value2;
   const next = {};
-  seen.set(value, next);
-  for (const [key, item] of Object.entries(value)) next[key] = redactOutputValue(item, seen);
+  seen.set(value2, next);
+  for (const [key, item] of Object.entries(value2)) next[key] = redactOutputValue(item, seen);
   return next;
 }
-function looksSecret(value) {
-  return redactSecrets(value) !== value || value.includes("-----BEGIN");
+function looksSecret(value2) {
+  return redactSecrets(value2) !== value2 || value2.includes("-----BEGIN");
 }
 
 // src/calendar-http.ts
@@ -2245,9 +2250,9 @@ async function readCalendarStatus(ctx) {
 }
 async function discoverGoogleCalendars(ctx) {
   const raw = await calendarJson(ctx, "/calendars", {});
-  const value = record(raw);
-  if (!value || !Array.isArray(value.calendars)) throw new Error("calendar discovery returned an invalid response");
-  return value.calendars.map((item, index) => {
+  const value2 = record(raw);
+  if (!value2 || !Array.isArray(value2.calendars)) throw new Error("calendar discovery returned an invalid response");
+  return value2.calendars.map((item, index) => {
     const calendar = record(item);
     const id = textField(calendar?.id, 1024);
     if (!calendar || !id) throw new Error(`calendar discovery returned an invalid calendar at index ${index}`);
@@ -2269,10 +2274,10 @@ async function applyCalendarSettings(ctx, bookingPageUrl) {
 }
 async function startCalendarConnection(ctx) {
   const raw = await calendarJson(ctx, "/google/connect", { method: "POST", body: "{}" });
-  const value = wrapped(raw, "attempt");
-  const attemptId = textField(value.attemptId, 180);
-  const consentUrl = textField(value.consentUrl, 4096);
-  const expiresAt = timestamp3(value.expiresAt);
+  const value2 = wrapped(raw, "attempt");
+  const attemptId = textField(value2.attemptId, 180);
+  const consentUrl = textField(value2.consentUrl, 4096);
+  const expiresAt = timestamp3(value2.expiresAt);
   if (!attemptId || !consentUrl || expiresAt === void 0) throw new Error("calendar connect returned an invalid attempt");
   return { attemptId, consentUrl, expiresAt };
 }
@@ -2290,42 +2295,42 @@ async function requestCalendarDisconnect(ctx) {
 }
 function parseCalendarStatus(raw, env) {
   const outer = wrapped(raw, "calendar");
-  const value = record(outer.attempt) ?? record(outer.status) ?? outer;
-  const connection = record(value.connection) ?? {};
-  const config = record(value.config) ?? record(outer.config) ?? {};
+  const value2 = record(outer.attempt) ?? record(outer.status) ?? outer;
+  const connection = record(value2.connection) ?? {};
+  const config = record(value2.config) ?? record(outer.config) ?? {};
   const googleConfig = record(config.google) ?? config;
-  const stateValue = calendarState(value.status ?? value.state ?? connection.status ?? connection.state);
+  const stateValue = calendarState(value2.status ?? value2.state ?? connection.status ?? connection.state);
   if (!stateValue) {
     throw new Error("calendar status returned an invalid connection state");
   }
-  const providerValue = value.provider ?? connection.provider ?? config.provider ?? (config.google ? "google" : void 0);
+  const providerValue = value2.provider ?? connection.provider ?? config.provider ?? (config.google ? "google" : void 0);
   if (providerValue !== void 0 && providerValue !== null && providerValue !== "google") {
     throw new Error("calendar status returned an unsupported provider");
   }
-  const accessValue = value.access ?? connection.access ?? config.access ?? googleConfig.access;
+  const accessValue = value2.access ?? connection.access ?? config.access ?? googleConfig.access;
   if (accessValue !== void 0 && accessValue !== "book" && accessValue !== "read") {
     throw new Error("calendar status returned unsupported access");
   }
-  const errorValue = record(value.error) ?? record(connection.error);
-  const errorCode = textField(value.lastErrorCode, 128);
-  const bookingPageValue = Object.hasOwn(value, "bookingPageUrl") ? value.bookingPageUrl : Object.hasOwn(config, "bookingPageUrl") ? config.bookingPageUrl : googleConfig.bookingPageUrl;
-  const connected = typeof (value.connected ?? connection.connected) === "boolean" ? Boolean(value.connected ?? connection.connected) : ["healthy", "degraded"].includes(stateValue);
-  const bookingCalendarId = textField(value.bookingCalendarId ?? config.bookingCalendarId, 1024);
+  const errorValue = record(value2.error) ?? record(connection.error);
+  const errorCode = textField(value2.lastErrorCode, 128);
+  const bookingPageValue = Object.hasOwn(value2, "bookingPageUrl") ? value2.bookingPageUrl : Object.hasOwn(config, "bookingPageUrl") ? config.bookingPageUrl : googleConfig.bookingPageUrl;
+  const connected = typeof (value2.connected ?? connection.connected) === "boolean" ? Boolean(value2.connected ?? connection.connected) : ["healthy", "degraded"].includes(stateValue);
+  const bookingCalendarId = textField(value2.bookingCalendarId ?? config.bookingCalendarId, 1024);
   return {
     env,
-    enabled: typeof value.enabled === "boolean" ? value.enabled : true,
+    enabled: typeof value2.enabled === "boolean" ? value2.enabled : true,
     connected,
-    writable: typeof value.writable === "boolean" ? value.writable : stateValue === "healthy",
+    writable: typeof value2.writable === "boolean" ? value2.writable : stateValue === "healthy",
     provider: providerValue === "google" ? "google" : null,
     status: stateValue,
     ...accessValue !== void 0 ? { access: "book" } : {},
     ...bookingCalendarId ? { bookingCalendarId } : {},
     calendars: calendarIds(
-      value.availabilityCalendars ?? config.availabilityCalendars ?? value.configuredCalendars ?? value.calendars ?? config.calendars ?? googleConfig.calendars
+      value2.availabilityCalendars ?? config.availabilityCalendars ?? value2.configuredCalendars ?? value2.calendars ?? config.calendars ?? googleConfig.calendars
     ),
     ...optionalNullableUrl("bookingPageUrl", bookingPageValue),
-    grantedScopes: stringList(value.grantedScopes ?? connection.grantedScopes ?? connection.scopes),
-    ...optionalText("attemptId", value.attemptId ?? connection.attemptId, 180),
+    grantedScopes: stringList(value2.grantedScopes ?? connection.grantedScopes ?? connection.scopes),
+    ...optionalText("attemptId", value2.attemptId ?? connection.attemptId, 180),
     ...errorValue || errorCode ? { error: {
       ...textField(errorValue?.code, 128) ? { code: textField(errorValue?.code, 128) } : {},
       ...textField(errorValue?.message, 500) ? { message: textField(errorValue?.message, 500) } : {},
@@ -2333,9 +2338,9 @@ function parseCalendarStatus(raw, env) {
     } } : {}
   };
 }
-function calendarState(value) {
-  if (typeof value !== "string") return null;
-  if (CALENDAR_STATES.includes(value)) return value;
+function calendarState(value2) {
+  if (typeof value2 !== "string") return null;
+  if (CALENDAR_STATES.includes(value2)) return value2;
   const legacy = {
     disabled: "not_connected",
     disconnected: "disconnected",
@@ -2346,7 +2351,7 @@ function calendarState(value) {
     ready: "healthy",
     error: "failed"
   };
-  return legacy[value] ?? null;
+  return legacy[value2] ?? null;
 }
 async function calendarJson(ctx, suffix, init) {
   const platform = platformAudience(ctx.platform);
@@ -2380,50 +2385,50 @@ function wrapped(raw, key) {
   if (!outer) throw new Error("calendar returned an invalid response");
   return record(outer[key]) ?? outer;
 }
-function record(value) {
-  return value !== null && typeof value === "object" && !Array.isArray(value) ? value : null;
+function record(value2) {
+  return value2 !== null && typeof value2 === "object" && !Array.isArray(value2) ? value2 : null;
 }
-function textField(value, max) {
-  return typeof value === "string" && value.length > 0 && value.length <= max && !/[\u0000-\u001f\u007f]/.test(value) ? value : void 0;
+function textField(value2, max) {
+  return typeof value2 === "string" && value2.length > 0 && value2.length <= max && !/[\u0000-\u001f\u007f]/.test(value2) ? value2 : void 0;
 }
-function stringList(value) {
-  return Array.isArray(value) ? [...new Set(value.filter((item) => !!textField(item, 4096)))] : [];
+function stringList(value2) {
+  return Array.isArray(value2) ? [...new Set(value2.filter((item) => !!textField(item, 4096)))] : [];
 }
-function calendarIds(value) {
-  if (!Array.isArray(value)) return [];
-  return [...new Set(value.flatMap((item) => {
+function calendarIds(value2) {
+  if (!Array.isArray(value2)) return [];
+  return [...new Set(value2.flatMap((item) => {
     if (typeof item === "string") return textField(item, 4096) ? [item] : [];
     const calendar = record(item);
     const id = textField(calendar?.id, 4096);
     return id && calendar?.selected !== false ? [id] : [];
   }))];
 }
-function timestamp3(value) {
-  if (typeof value === "number" && Number.isFinite(value) && value >= 0) return value;
-  if (typeof value === "string") {
-    const parsed = Date.parse(value);
+function timestamp3(value2) {
+  if (typeof value2 === "number" && Number.isFinite(value2) && value2 >= 0) return value2;
+  if (typeof value2 === "string") {
+    const parsed = Date.parse(value2);
     if (Number.isFinite(parsed)) return parsed;
   }
   return void 0;
 }
-function optionalText(key, value, max) {
-  const parsed = textField(value, max);
+function optionalText(key, value2, max) {
+  const parsed = textField(value2, max);
   return parsed ? { [key]: parsed } : {};
 }
-function optionalNullableUrl(key, value) {
-  if (value === null) return { [key]: null };
-  const parsed = textField(value, 4096);
+function optionalNullableUrl(key, value2) {
+  if (value2 === null) return { [key]: null };
+  const parsed = textField(value2, 4096);
   return parsed ? { [key]: parsed } : {};
 }
-function identifier(value, name) {
-  if (typeof value !== "string" || !/^[A-Za-z0-9][A-Za-z0-9._:-]{0,179}$/.test(value)) throw new Error(`${name} is invalid`);
-  return value;
+function identifier(value2, name) {
+  if (typeof value2 !== "string" || !/^[A-Za-z0-9][A-Za-z0-9._:-]{0,179}$/.test(value2)) throw new Error(`${name} is invalid`);
+  return value2;
 }
-function credential(value) {
-  if (typeof value !== "string" || value.length < 8 || value.length > 8192 || /\s|[\u0000-\u001f\u007f]/.test(value)) {
+function credential(value2) {
+  if (typeof value2 !== "string" || value2.length < 8 || value2.length > 8192 || /\s|[\u0000-\u001f\u007f]/.test(value2)) {
     throw new Error("calendar requires an odla developer token");
   }
-  return value;
+  return value2;
 }
 
 // src/calendar-poll.ts
@@ -2584,11 +2589,11 @@ async function connectWithContext(ctx, options) {
   }
   throw new Error('Google Calendar consent timed out; run "odla-ai calendar status" and retry connect');
 }
-function trustedCalendarConsentUrl(platform, value) {
+function trustedCalendarConsentUrl(platform, value2) {
   const origin = platformAudience(platform);
   let url;
   try {
-    url = value.startsWith("/") ? new URL(value, origin) : new URL(value);
+    url = value2.startsWith("/") ? new URL(value2, origin) : new URL(value2);
   } catch {
     throw new Error("odla.ai returned an invalid calendar consent URL");
   }
@@ -2599,12 +2604,12 @@ function trustedCalendarConsentUrl(platform, value) {
   }
   return url.toString();
 }
-function pollTimeout(value = 10 * 6e4) {
-  if (!Number.isSafeInteger(value) || value < 1e3 || value > 60 * 6e4) throw new Error("calendar poll timeout must be 1000-3600000ms");
-  return value;
+function pollTimeout(value2 = 10 * 6e4) {
+  if (!Number.isSafeInteger(value2) || value2 < 1e3 || value2 > 60 * 6e4) throw new Error("calendar poll timeout must be 1000-3600000ms");
+  return value2;
 }
-function productionConsent(env, yes, action) {
-  if ((env === "prod" || env === "production") && !yes) throw new Error(`refusing to ${action} for "${env}" without --yes`);
+function productionConsent(env, yes, action2) {
+  if ((env === "prod" || env === "production") && !yes) throw new Error(`refusing to ${action2} for "${env}" without --yes`);
 }
 function printStatus(status, json, out) {
   if (json) {
@@ -2633,6 +2638,8 @@ var CAPABILITIES = {
     "validate integration contracts offline and smoke-test a provisioned db environment plus anonymous capability routes",
     "save and explicitly select non-secret named operator contexts with isolated credential caches; resolve and explain platform, app, environment, and credential provenance without authenticating; then run PM, Discussions, o11y, runbook, and identity operations outside a project checkout",
     "read one versioned o11y status envelope spanning application RED, exact Worker versions and Cloudflare colos observed in traffic, current live-sync freshness/load, the protected commit-to-visible canary, collector ingest/scheduler trust, provider-owned runtime metrics, account-scoped Durable Object, D1, and R2 evidence under odla-db, and a bounded machine verdict",
+    "read one canonical platform fleet snapshot over private service bindings, including release identities, probe latency, Cloudflare load/runtime freshness, explicit unknowns, and stable next actions through a read-only capability",
+    "compare one project's checked-in Registry intent with live owner-visible state and freeze a secret-free plan digest through an exact app:config:read capability",
     "inspect durable agent wakeups as a versioned JSON envelope and explicitly requeue one dead-lettered job with a scoped environment credential",
     "run app-attributed hosted security discovery and independent validation without provider keys",
     "connect/revoke source-read-only GitHub sources and drive commit-pinned hosted security jobs without PATs or provider keys",
@@ -2679,15 +2686,542 @@ function printGroup(out, heading, items) {
   out.log("");
 }
 
+// src/config-reconcile-command.ts
+var import_apps6 = require("@odla-ai/apps");
+var import_node_path7 = require("path");
+
+// src/config-reconcile-digest.ts
+var import_node_crypto = require("crypto");
+function canonicalJson(value2) {
+  return JSON.stringify(canonicalValue(value2));
+}
+function configDigest(value2) {
+  return `sha256:${(0, import_node_crypto.createHash)("sha256").update(canonicalJson(value2)).digest("hex")}`;
+}
+function canonicalValue(value2) {
+  if (Array.isArray(value2)) return value2.map(canonicalValue);
+  if (value2 && typeof value2 === "object") {
+    return Object.fromEntries(
+      Object.entries(value2).filter(([, entry]) => entry !== void 0).sort(([left], [right]) => left.localeCompare(right)).map(([key, entry]) => [key, canonicalValue(entry)])
+    );
+  }
+  return value2;
+}
+
+// src/config-reconcile-desired.ts
+var import_apps4 = require("@odla-ai/apps");
+
+// src/provision-helpers.ts
+var import_ai = require("@odla-ai/ai");
+var import_apps3 = require("@odla-ai/apps");
+function defaultSecretName(provider) {
+  const names = import_ai.DEFAULT_SECRET_NAMES;
+  return names[provider] ?? `${provider}_api_key`;
+}
+async function assertTenantAdminAccess(doFetch, cfg, env, token) {
+  const tenantId = (0, import_apps3.tenantIdFor)(cfg.app.id, env);
+  const res = await doFetch(`${cfg.dbEndpoint}/admin/apps/${encodeURIComponent(tenantId)}/entitlements`, {
+    headers: { authorization: `Bearer ${token}` }
+  });
+  if (res.ok || res.status === 404) return;
+  if (res.status === 403) {
+    throw new Error(
+      `${env}: you are not an owner of "${cfg.app.id}" (tenant ${tenantId}) \u2014 nothing was minted or written; ask an existing owner to run "odla-ai app owners add <your-email>", then re-run provision`
+    );
+  }
+  throw new Error(`${env}: tenant access preflight (${tenantId}) failed: ${res.status} ${await safeText3(res)}`);
+}
+async function postJson(doFetch, url, bearer, body) {
+  const res = await doFetch(url, {
+    method: "POST",
+    headers: { authorization: `Bearer ${bearer}`, "content-type": "application/json" },
+    body: JSON.stringify(body)
+  });
+  if (!res.ok) throw new Error(`${new URL(url).pathname} failed: ${res.status} ${await safeText3(res)}`);
+}
+function normalizeClerkConfig(value2) {
+  if (!value2) return null;
+  if (typeof value2 === "string") {
+    const publishableKey2 = envValue(value2);
+    return publishableKey2 ? { publishableKey: publishableKey2 } : null;
+  }
+  if (typeof value2 !== "object") return null;
+  const cfg = value2;
+  const publishableKey = envValue(cfg.publishableKey);
+  return publishableKey ? { publishableKey, ...cfg.audience ? { audience: cfg.audience } : {}, ...cfg.mode ? { mode: cfg.mode } : {} } : null;
+}
+async function safeText3(res) {
+  try {
+    return redactSecrets((await res.text()).slice(0, 500));
+  } catch {
+    return "";
+  }
+}
+
+// src/config-reconcile-desired.ts
+function desiredRegistryState(cfg) {
+  const environments = {};
+  const services = (0, import_apps4.orderAppServices)(cfg.services);
+  for (const env of cfg.envs) {
+    const desiredServices = {};
+    for (const service of services) {
+      desiredServices[service] = {
+        enabled: true,
+        ...managedServiceConfig(cfg, env, service)
+      };
+    }
+    const authoredAuth = cfg.auth?.clerk && Object.hasOwn(cfg.auth.clerk, env) ? cfg.auth.clerk[env] : void 0;
+    const auth = normalizeClerkConfig(authoredAuth);
+    if (authoredAuth && !auth) {
+      throw new Error(`auth.clerk.${env} could not resolve its publishable key`);
+    }
+    const linkManaged = !!cfg.links && Object.hasOwn(cfg.links, env);
+    environments[env] = {
+      services: desiredServices,
+      ...auth ? { auth } : {},
+      ...linkManaged ? { link: cfg.links?.[env] ?? null } : {}
+    };
+  }
+  return {
+    appId: cfg.app.id,
+    name: cfg.app.name,
+    environments
+  };
+}
+function managedServiceConfig(cfg, env, service) {
+  if (service === "ai" && cfg.ai?.provider) {
+    return {
+      config: {
+        provider: cfg.ai.provider,
+        ...cfg.ai.model ? { model: cfg.ai.model } : {}
+      }
+    };
+  }
+  if (service === "calendar") return { config: calendarServiceConfig(cfg, env) };
+  return {};
+}
+
+// src/config-reconcile.ts
+var import_apps5 = require("@odla-ai/apps");
+
+// src/config-reconcile-values.ts
+function difference(path, desired, observed, status, reason, desiredSource, observedSource, env, service) {
+  return { path, env, service, status, desired, observed, desiredSource, observedSource, reason };
+}
+function action(kind, path, before, after, risk, applySupport, reason) {
+  return { kind, path, before, after, risk, requiresApproval: false, applySupport, reason };
+}
+function scopedAction(kind, path, env, service, before, after, reason, destructive = false) {
+  const production = env === "prod" || env === "production";
+  return {
+    ...action(
+      kind,
+      path,
+      before,
+      after,
+      destructive ? "high" : production ? "medium" : "low",
+      destructive ? "studio" : "provision",
+      reason
+    ),
+    env,
+    ...service ? { service } : {},
+    requiresApproval: production || destructive
+  };
+}
+function observedProjection(app) {
+  return {
+    appId: app.appId,
+    name: app.name,
+    archivedAt: app.archivedAt,
+    environments: Object.fromEntries(
+      Object.entries(app.environments).sort(([left], [right]) => left.localeCompare(right)).map(([env, services]) => [
+        env,
+        Object.fromEntries(Object.entries(services).sort(([left], [right]) => left.localeCompare(right)))
+      ])
+    ),
+    auth: app.auth,
+    links: app.links
+  };
+}
+function projectConfig(value2, keys) {
+  return Object.fromEntries(keys.filter((key) => value2[key] !== void 0).map((key) => [key, value2[key]]));
+}
+function same(left, right) {
+  return canonicalJson(left) === canonicalJson(right);
+}
+function actionId(actionValue) {
+  return `action-${configDigest(actionValue).slice("sha256:".length, "sha256:".length + 16)}`;
+}
+function quoteArg(value2) {
+  return `'${value2.replace(/'/g, `'\\''`)}'`;
+}
+
+// src/config-reconcile.ts
+var COVERAGE = {
+  included: [
+    "app display name",
+    "environment service enablement",
+    "AI provider/model and calendar booking service configuration",
+    "auth configuration when explicitly declared",
+    "deployment link when explicitly declared"
+  ],
+  excluded: [
+    { path: "db.schema", reason: "owned by the database data plane" },
+    { path: "db.rules", reason: "owned by the database data plane" },
+    { path: "integrations.seeds", reason: "guarded data-plane writes are not Registry state" },
+    { path: "credentials", reason: "shown-once credentials are intentionally local" },
+    { path: "secrets", reason: "vault and Worker secrets are write-only" },
+    { path: "calendar.connection", reason: "OAuth connection state is provider-owned" },
+    { path: "service.config.opaque", reason: "controller-assigned fields remain service-owned" }
+  ]
+};
+function reconcileConfig(input) {
+  const desiredSource = { kind: "project_config", location: input.configPath };
+  const observedSource = {
+    kind: "registry",
+    location: `${input.platformUrl}/registry/apps/${encodeURIComponent(input.desired.appId)}`
+  };
+  const differences = [];
+  const actions = [];
+  const add = (difference2, action2) => {
+    differences.push(difference2);
+    if (action2) actions.push({ ...action2, id: actionId(action2) });
+  };
+  compareApp(input.desired, input.observed, desiredSource, observedSource, add);
+  compareEnvironments(input.desired, input.observed, desiredSource, observedSource, add);
+  const desiredRevision = configDigest(input.desired);
+  const observedRevision = input.observed ? configDigest(observedProjection(input.observed)) : null;
+  const different = differences.filter((entry) => entry.status === "different").length;
+  const unmanaged = differences.length - different;
+  return {
+    generatedAt: input.generatedAt,
+    scope: {
+      appId: input.desired.appId,
+      platformUrl: input.platformUrl,
+      environments: Object.keys(input.desired.environments).sort()
+    },
+    sources: { desired: desiredSource, observed: observedSource },
+    desiredRevision,
+    observedRevision,
+    status: different ? "different" : unmanaged ? "unmanaged" : "in_sync",
+    summary: {
+      differences: different,
+      unmanaged,
+      actions: actions.length,
+      productionActions: actions.filter((action2) => action2.env === "prod" || action2.env === "production").length,
+      highRiskActions: actions.filter((action2) => action2.risk === "high").length
+    },
+    coverage: COVERAGE,
+    differences,
+    actions
+  };
+}
+function compareApp(desired, observed, desiredSource, observedSource, add) {
+  if (!observed) {
+    const path = "app";
+    add(
+      difference(path, desired, null, "different", "the app is absent from Registry", desiredSource, observedSource),
+      action(
+        "create_app",
+        path,
+        null,
+        { appId: desired.appId, name: desired.name },
+        "low",
+        "provision",
+        "create the repository-declared app"
+      )
+    );
+    return;
+  }
+  if (observed.name !== desired.name) {
+    const path = "app.name";
+    add(
+      difference(path, desired.name, observed.name, "different", "the checked-in display name differs", desiredSource, observedSource),
+      {
+        ...action("rename_app", path, observed.name, desired.name, "low", "command", "make Registry match the checked-in display name"),
+        command: `odla-ai app rename ${quoteArg(desired.name)} --config ${quoteArg(desiredSource.location)}`
+      }
+    );
+  }
+}
+function compareEnvironments(desired, observed, desiredSource, observedSource, add) {
+  const envs = /* @__PURE__ */ new Set([
+    ...Object.keys(desired.environments),
+    ...Object.keys(observed?.environments ?? {}).filter((env) => Object.values(observed?.environments[env] ?? {}).some((service) => service.enabled))
+  ]);
+  for (const env of [...envs].sort()) {
+    compareServices(env, desired, observed, desiredSource, observedSource, add);
+    compareOptionalEnvironmentState(env, desired, observed, desiredSource, observedSource, add);
+  }
+}
+function compareServices(env, desired, observed, desiredSource, observedSource, add) {
+  const wanted = desired.environments[env]?.services ?? {};
+  const live = observed?.environments[env] ?? {};
+  const knownOrder = (0, import_apps5.orderAppServices)((0, import_apps5.appServiceIds)());
+  const services = [.../* @__PURE__ */ new Set([...knownOrder, ...Object.keys(wanted), ...Object.keys(live)])];
+  for (const service of services) {
+    const next = wanted[service];
+    const current = live[service];
+    const path = `environments.${env}.services.${service}`;
+    if (next?.enabled && !current?.enabled) {
+      add(
+        difference(path, next, current ?? null, "different", "the repository enables a service Registry does not", desiredSource, observedSource, env, service),
+        scopedAction("enable_service", path, env, service, current ?? null, next, "enable the repository-declared service")
+      );
+      continue;
+    }
+    if (next?.enabled && current?.enabled && next.config) {
+      const projected = projectConfig(current.config, Object.keys(next.config));
+      if (!same(next.config, projected)) {
+        add(
+          difference(`${path}.config`, next.config, projected, "different", "repository-managed service settings differ", desiredSource, observedSource, env, service),
+          scopedAction(
+            "configure_service",
+            `${path}.config`,
+            env,
+            service,
+            projected,
+            next.config,
+            "apply the repository-managed service settings"
+          )
+        );
+      }
+    }
+  }
+  for (const service of [...services].reverse()) {
+    const next = wanted[service];
+    const current = live[service];
+    if (next?.enabled || !current?.enabled) continue;
+    const path = `environments.${env}.services.${service}`;
+    add(
+      difference(path, null, { enabled: true }, "different", "Registry enables a service absent from repository intent", desiredSource, observedSource, env, service),
+      scopedAction(
+        "disable_service",
+        path,
+        env,
+        service,
+        { enabled: true },
+        { enabled: false },
+        "disablement is destructive to availability and requires an explicit Studio review",
+        true
+      )
+    );
+  }
+}
+function compareOptionalEnvironmentState(env, desired, observed, desiredSource, observedSource, add) {
+  const wanted = desired.environments[env];
+  const liveAuth = observed?.auth[env] ?? null;
+  if (wanted?.auth) {
+    const projected = liveAuth ? projectConfig(liveAuth, Object.keys(wanted.auth)) : null;
+    if (!same(wanted.auth, projected)) {
+      const path = `environments.${env}.auth`;
+      add(
+        difference(path, wanted.auth, projected, "different", "explicit repository auth settings differ", desiredSource, observedSource, env),
+        scopedAction("set_auth", path, env, void 0, projected, wanted.auth, "apply explicit repository auth settings")
+      );
+    }
+  } else if (liveAuth) {
+    add(difference(
+      `environments.${env}.auth`,
+      null,
+      projectConfig(liveAuth, ["publishableKey", "audience", "mode"]),
+      "unmanaged",
+      "live auth exists but this project config does not manage it",
+      desiredSource,
+      observedSource,
+      env
+    ));
+  }
+  const managesLink = wanted && Object.hasOwn(wanted, "link");
+  const liveLink = observed?.links[env] ?? null;
+  if (managesLink && wanted.link !== liveLink) {
+    const path = `environments.${env}.link`;
+    add(
+      difference(path, wanted.link ?? null, liveLink, "different", "explicit repository deployment link differs", desiredSource, observedSource, env),
+      scopedAction("set_link", path, env, void 0, liveLink, wanted.link ?? null, "apply the repository deployment link")
+    );
+  } else if (!managesLink && liveLink) {
+    add(difference(
+      `environments.${env}.link`,
+      null,
+      liveLink,
+      "unmanaged",
+      "a live deployment link exists but this project config does not manage it",
+      desiredSource,
+      observedSource,
+      env
+    ));
+  }
+}
+
+// src/config-reconcile-command.ts
+async function configDiff(options) {
+  const reconciliation = await inspectConfig(options);
+  const { actions: _actions, ...read3 } = reconciliation;
+  const document2 = {
+    schemaVersion: "odla.config-diff/v1",
+    ...read3,
+    nextActions: diffNextActions(reconciliation, options.configPath)
+  };
+  printDiff(document2, options);
+  return document2;
+}
+async function configPlan(options) {
+  const reconciliation = await inspectConfig(options);
+  const planDigest = configDigest({
+    schemaVersion: "odla.config-plan/v1",
+    desiredRevision: reconciliation.desiredRevision,
+    observedRevision: reconciliation.observedRevision,
+    actions: reconciliation.actions
+  });
+  const document2 = {
+    schemaVersion: "odla.config-plan/v1",
+    ...reconciliation,
+    planDigest,
+    apply: {
+      supported: false,
+      reason: "conditional, resumable config apply is not available yet; use the exact reviewed commands below"
+    },
+    nextActions: planNextActions(reconciliation, options.configPath)
+  };
+  printPlan2(document2, options);
+  return document2;
+}
+async function inspectConfig(options) {
+  const out = options.stdout ?? console;
+  const cfg = await loadProjectConfig(options.configPath);
+  const doFetch = options.fetch ?? fetch;
+  const token = await resolveAdminPlatformToken({
+    platform: cfg.platformUrl,
+    scope: "app:config:read",
+    token: options.token,
+    tokenFile: (0, import_node_path7.join)(cfg.rootDir, ".odla", "admin-token.local.json"),
+    rootDir: cfg.rootDir,
+    email: options.email,
+    open: options.open,
+    fetch: doFetch,
+    stdout: out,
+    openApprovalUrl: options.openApprovalUrl,
+    label: `odla CLI (${cfg.app.id} config read)`
+  });
+  const client = (0, import_apps6.createAppsClient)({ endpoint: cfg.platformUrl, token, fetcher: { fetch: doFetch } });
+  const observed = await client.resolveApp(cfg.app.id);
+  return reconcileConfig({
+    desired: desiredRegistryState(cfg),
+    observed,
+    configPath: cfg.configPath,
+    platformUrl: cfg.platformUrl,
+    generatedAt: (options.now?.() ?? /* @__PURE__ */ new Date()).toISOString()
+  });
+}
+function printDiff(document2, options) {
+  const out = options.stdout ?? console;
+  if (options.json) {
+    out.log(JSON.stringify(document2, null, 2));
+    return;
+  }
+  printHeader(out, "diff", document2);
+  printDifferences(out, document2);
+  printNext(out, document2.nextActions);
+}
+function printPlan2(document2, options) {
+  const out = options.stdout ?? console;
+  if (options.json) {
+    out.log(JSON.stringify(document2, null, 2));
+    return;
+  }
+  printHeader(out, "plan", document2);
+  for (const entry of document2.actions) {
+    const scope = [entry.env, entry.service].filter(Boolean).join("/");
+    out.log(
+      `  ${entry.id}  ${entry.kind}${scope ? ` (${scope})` : ""}  ${entry.risk}${entry.requiresApproval ? ", approval required" : ""}`
+    );
+    out.log(`    ${entry.reason}`);
+  }
+  if (!document2.actions.length) out.log("  no managed changes");
+  out.log(`plan digest: ${document2.planDigest}`);
+  out.log(`apply: unsupported \u2014 ${document2.apply.reason}`);
+  printNext(out, document2.nextActions);
+}
+function printHeader(out, kind, document2) {
+  out.log(`config ${kind}: ${document2.scope.appId} \u2014 ${document2.status}`);
+  out.log(`platform: ${document2.scope.platformUrl}`);
+  out.log(`desired:  ${document2.desiredRevision}`);
+  out.log(`observed: ${document2.observedRevision ?? "absent"}`);
+  out.log(
+    `summary: ${document2.summary.differences} different, ${document2.summary.unmanaged} unmanaged, ${document2.summary.actions} planned actions`
+  );
+}
+function printDifferences(out, document2) {
+  for (const entry of document2.differences) {
+    out.log(`  ${entry.status}	${entry.path}	${entry.reason}`);
+  }
+  if (!document2.differences.length) out.log("  managed Registry configuration is in sync");
+}
+function printNext(out, next) {
+  if (!next.length) return;
+  out.log("next:");
+  for (const item of next) out.log(`  ${item.command}
+    ${item.description}`);
+}
+function diffNextActions(reconciliation, configPath) {
+  if (reconciliation.status === "in_sync") {
+    return [{
+      code: "verify_runtime",
+      command: `odla-ai smoke --config ${quoteArg2(configPath)}`,
+      description: "Registry intent matches; verify the service-owned data planes separately."
+    }];
+  }
+  return [{
+    code: "freeze_plan",
+    command: `odla-ai config plan --config ${quoteArg2(configPath)} --json`,
+    description: "Freeze the current desired and observed revisions into a reviewable action plan."
+  }];
+}
+function planNextActions(reconciliation, configPath) {
+  const next = [];
+  if (reconciliation.actions.some((action2) => action2.applySupport === "provision")) {
+    next.push({
+      code: "review_provision",
+      command: `odla-ai provision --config ${quoteArg2(configPath)} --dry-run`,
+      description: "Review the existing provisioner's service/auth/link work before applying it."
+    });
+  }
+  for (const action2 of reconciliation.actions.filter((entry) => entry.command)) {
+    if (!next.some((entry) => entry.command === action2.command)) {
+      next.push({ code: action2.kind, command: action2.command, description: action2.reason });
+    }
+  }
+  if (reconciliation.actions.some((action2) => action2.applySupport === "studio")) {
+    const { appId, platformUrl } = reconciliation.scope;
+    next.push({
+      code: "review_destructive",
+      command: `${platformUrl}/studio/apps/${encodeURIComponent(appId)}/settings`,
+      description: "Review service disablement in the owning Studio scope; this plan will not apply it."
+    });
+  }
+  if (!reconciliation.actions.length && reconciliation.summary.unmanaged) {
+    next.push({
+      code: "declare_or_accept_runtime_state",
+      command: `${reconciliation.scope.platformUrl}/studio/apps/${encodeURIComponent(reconciliation.scope.appId)}/settings`,
+      description: "Declare the live value in project config or keep it as an explicit runtime-managed setting."
+    });
+  }
+  return next;
+}
+function quoteArg2(value2) {
+  return `'${value2.replace(/'/g, `'\\''`)}'`;
+}
+
 // src/doctor-checks.ts
 var import_node_child_process3 = require("child_process");
 var import_node_fs10 = require("fs");
-var import_node_path8 = require("path");
+var import_node_path9 = require("path");
 
 // src/wrangler.ts
 var import_node_child_process2 = require("child_process");
 var import_node_fs9 = require("fs");
-var import_node_path7 = require("path");
+var import_node_path8 = require("path");
 var defaultRunner = (cmd, args, opts) => new Promise((resolvePromise, reject) => {
   const child = (0, import_node_child_process2.spawn)(cmd, args, { cwd: opts?.cwd, stdio: ["pipe", "pipe", "pipe"] });
   let stdout = "";
@@ -2701,7 +3235,7 @@ var defaultRunner = (cmd, args, opts) => new Promise((resolvePromise, reject) =>
 var WRANGLER_CONFIG_FILES = ["wrangler.jsonc", "wrangler.json", "wrangler.toml"];
 function findWranglerConfig(rootDir) {
   for (const name of WRANGLER_CONFIG_FILES) {
-    const path = (0, import_node_path7.join)(rootDir, name);
+    const path = (0, import_node_path8.join)(rootDir, name);
     if ((0, import_node_fs9.existsSync)(path)) return path;
   }
   return null;
@@ -2767,11 +3301,11 @@ function lintRules(rules, entities, publicRead) {
   const warnings = [];
   if (!rules) return warnings;
   for (const [ns, actions] of Object.entries(rules)) {
-    for (const [action, expr] of Object.entries(actions)) {
+    for (const [action2, expr] of Object.entries(actions)) {
       if (typeof expr !== "string" || expr.trim() !== "true") continue;
-      if (action === "view" && publicRead.includes(ns)) continue;
+      if (action2 === "view" && publicRead.includes(ns)) continue;
       warnings.push(
-        action === "view" ? `rules.${ns}.view is "true" \u2014 public read; add "${ns}" to db.publicRead if intended` : `rules.${ns}.${action} is "true" \u2014 any client can ${action} ${ns} rows`
+        action2 === "view" ? `rules.${ns}.view is "true" \u2014 public read; add "${ns}" to db.publicRead if intended` : `rules.${ns}.${action2} is "true" \u2014 any client can ${action2} ${ns} rows`
       );
     }
   }
@@ -2807,17 +3341,17 @@ function wranglerWarnings(rootDir) {
   for (const { label, block } of blocks) {
     const assets = block.assets;
     if (assets?.directory) {
-      const dir = (0, import_node_path8.resolve)(rootDir, assets.directory);
-      if (dir === (0, import_node_path8.resolve)(rootDir)) {
+      const dir = (0, import_node_path9.resolve)(rootDir, assets.directory);
+      if (dir === (0, import_node_path9.resolve)(rootDir)) {
         warnings.push(`${label}assets.directory is the project root \u2014 point it at a dedicated build dir (wrangler dev fails with "spawn EBADF")`);
-      } else if ((0, import_node_fs10.existsSync)((0, import_node_path8.join)(dir, "node_modules"))) {
+      } else if ((0, import_node_fs10.existsSync)((0, import_node_path9.join)(dir, "node_modules"))) {
         warnings.push(`${label}assets.directory contains node_modules \u2014 wrangler dev's watcher will exhaust file descriptors`);
       }
     }
     const vars = block.vars;
     if (vars && typeof vars === "object") {
-      for (const [name, value] of Object.entries(vars)) {
-        if (name === "ODLA_API_KEY" || name === "ODLA_O11Y_TOKEN" || typeof value === "string" && looksSecret(value)) {
+      for (const [name, value2] of Object.entries(vars)) {
+        if (name === "ODLA_API_KEY" || name === "ODLA_O11Y_TOKEN" || typeof value2 === "string" && looksSecret(value2)) {
           warnings.push(`wrangler ${label}vars.${name} looks like a secret \u2014 use "odla-ai secrets push" / wrangler secret put, never vars`);
         }
       }
@@ -2845,7 +3379,7 @@ function o11yProjectWarnings(rootDir) {
     warnings.push("cannot verify o11y Worker instrumentation \u2014 add a parseable wrangler.jsonc/json config");
     return warnings;
   }
-  const main = typeof config.main === "string" ? (0, import_node_path8.resolve)(rootDir, config.main) : null;
+  const main = typeof config.main === "string" ? (0, import_node_path9.resolve)(rootDir, config.main) : null;
   if (!main || !(0, import_node_fs10.existsSync)(main)) {
     warnings.push("cannot verify o11y Worker instrumentation \u2014 wrangler main is missing or unreadable");
   } else {
@@ -2875,7 +3409,7 @@ function calendarProjectWarnings(rootDir) {
 }
 function readPackageJson(rootDir) {
   try {
-    return JSON.parse((0, import_node_fs10.readFileSync)((0, import_node_path8.join)(rootDir, "package.json"), "utf8"));
+    return JSON.parse((0, import_node_fs10.readFileSync)((0, import_node_path9.join)(rootDir, "package.json"), "utf8"));
   } catch {
     return null;
   }
@@ -2931,8 +3465,8 @@ function integrationWarnings(integrations, schema, rules) {
         warnings.push(`integration "${integration.id}" has no rules for "${ns}"`);
         continue;
       }
-      for (const action of ["view", "create", "update", "delete"]) {
-        if (rule[action] === void 0) warnings.push(`integration "${integration.id}" rule "${ns}.${action}" is missing`);
+      for (const action2 of ["view", "create", "update", "delete"]) {
+        if (rule[action2] === void 0) warnings.push(`integration "${integration.id}" rule "${ns}.${action2}" is missing`);
       }
     }
     for (const seed of integration.seeds ?? []) {
@@ -2985,27 +3519,27 @@ function isUniqueAttr(schema, ns, attr) {
   const definition = entity.attrs[attr];
   return isRecord6(definition) && definition.unique === true;
 }
-function normalizeSchema(value) {
-  if (value === void 0 || value === null) return { entities: {}, links: {} };
-  if (!isRecord6(value) || !isRecord6(value.entities)) {
+function normalizeSchema(value2) {
+  if (value2 === void 0 || value2 === null) return { entities: {}, links: {} };
+  if (!isRecord6(value2) || !isRecord6(value2.entities)) {
     throw new Error("db schema must be a serialized schema object with an entities map");
   }
-  if (value.links !== void 0 && !isRecord6(value.links)) throw new Error("db schema links must be an object");
+  if (value2.links !== void 0 && !isRecord6(value2.links)) throw new Error("db schema links must be an object");
   return {
-    entities: { ...value.entities },
-    links: { ...value.links ?? {} }
+    entities: { ...value2.entities },
+    links: { ...value2.links ?? {} }
   };
 }
 function mergeMap(target, fragment, label) {
-  for (const [name, value] of Object.entries(fragment)) {
-    if (Object.hasOwn(target, name) && !(0, import_node_util.isDeepStrictEqual)(target[name], value)) {
+  for (const [name, value2] of Object.entries(fragment)) {
+    if (Object.hasOwn(target, name) && !(0, import_node_util.isDeepStrictEqual)(target[name], value2)) {
       throw new Error(`${label} "${name}" conflicts with an existing definition`);
     }
-    target[name] = value;
+    target[name] = value2;
   }
 }
-function isRecord6(value) {
-  return value !== null && typeof value === "object" && !Array.isArray(value);
+function isRecord6(value2) {
+  return value2 !== null && typeof value2 === "object" && !Array.isArray(value2);
 }
 
 // src/doctor.ts
@@ -3046,9 +3580,9 @@ async function doctor(options) {
   warnings.push(...integrationWarnings(database.integrations, schema, rules));
   if (cfg.services.includes("ai") && !cfg.ai?.provider) warnings.push("ai service is enabled but ai.provider is not set");
   if (cfg.auth?.clerk) {
-    for (const [env, value] of Object.entries(cfg.auth.clerk)) {
-      if (typeof value === "string" && value.startsWith("$") && !process.env[value.slice(1)]) {
-        warnings.push(`auth.clerk.${env} references unset env var ${value}`);
+    for (const [env, value2] of Object.entries(cfg.auth.clerk)) {
+      if (typeof value2 === "string" && value2.startsWith("$") && !process.env[value2.slice(1)]) {
+        warnings.push(`auth.clerk.${env} references unset env var ${value2}`);
       }
     }
   }
@@ -3090,10 +3624,10 @@ function harnessList(parsed) {
   ];
   return selected.length ? selected : ["all"];
 }
-function harnessOption(value, flag) {
-  if (value === void 0) return [];
-  if (typeof value === "boolean") throw new Error(`${flag} requires a harness name`);
-  const raw = Array.isArray(value) ? value : [value];
+function harnessOption(value2, flag) {
+  if (value2 === void 0) return [];
+  if (typeof value2 === "boolean") throw new Error(`${flag} requires a harness name`);
+  const raw = Array.isArray(value2) ? value2 : [value2];
   const parts = raw.flatMap((item) => item.split(","));
   if (parts.some((item) => !item.trim())) {
     throw new Error(`${flag} requires a harness name`);
@@ -3103,12 +3637,12 @@ function harnessOption(value, flag) {
 
 // src/init.ts
 var import_node_fs11 = require("fs");
-var import_node_path9 = require("path");
-var import_apps3 = require("@odla-ai/apps");
+var import_node_path10 = require("path");
+var import_apps7 = require("@odla-ai/apps");
 function initProject(options) {
   const out = options.stdout ?? console;
-  const rootDir = (0, import_node_path9.resolve)(options.rootDir ?? process.cwd());
-  const configPath = (0, import_node_path9.resolve)(rootDir, options.configPath ?? "odla.config.mjs");
+  const rootDir = (0, import_node_path10.resolve)(options.rootDir ?? process.cwd());
+  const configPath = (0, import_node_path10.resolve)(rootDir, options.configPath ?? "odla.config.mjs");
   if ((0, import_node_fs11.existsSync)(configPath) && !options.force) {
     throw new Error(`${configPath} already exists. Pass --force to overwrite.`);
   }
@@ -3118,19 +3652,19 @@ function initProject(options) {
   const envs = options.envs?.length ? options.envs : ["dev"];
   const services = options.services?.length ? options.services : ["db", "ai"];
   for (const service of services) {
-    const definition = (0, import_apps3.appServiceDefinition)(service);
-    if (!definition) throw new Error(`--services contains unknown service "${service}" (known: ${(0, import_apps3.appServiceIds)().join(", ")})`);
+    const definition = (0, import_apps7.appServiceDefinition)(service);
+    if (!definition) throw new Error(`--services contains unknown service "${service}" (known: ${(0, import_apps7.appServiceIds)().join(", ")})`);
     for (const dependency of definition.requires) {
       if (!services.includes(dependency)) throw new Error(`--services ${service} requires ${dependency}`);
     }
   }
   const aiProvider = options.aiProvider ?? "anthropic";
-  (0, import_node_fs11.mkdirSync)((0, import_node_path9.dirname)(configPath), { recursive: true });
-  (0, import_node_fs11.mkdirSync)((0, import_node_path9.resolve)(rootDir, "src/odla"), { recursive: true });
-  (0, import_node_fs11.mkdirSync)((0, import_node_path9.resolve)(rootDir, ".odla"), { recursive: true });
+  (0, import_node_fs11.mkdirSync)((0, import_node_path10.dirname)(configPath), { recursive: true });
+  (0, import_node_fs11.mkdirSync)((0, import_node_path10.resolve)(rootDir, "src/odla"), { recursive: true });
+  (0, import_node_fs11.mkdirSync)((0, import_node_path10.resolve)(rootDir, ".odla"), { recursive: true });
   (0, import_node_fs11.writeFileSync)(configPath, configTemplate({ appId: options.appId, name: options.name, envs, services, aiProvider }));
-  writeIfMissing((0, import_node_path9.resolve)(rootDir, "src/odla/schema.mjs"), schemaTemplate());
-  writeIfMissing((0, import_node_path9.resolve)(rootDir, "src/odla/rules.mjs"), rulesTemplate());
+  writeIfMissing((0, import_node_path10.resolve)(rootDir, "src/odla/schema.mjs"), schemaTemplate());
+  writeIfMissing((0, import_node_path10.resolve)(rootDir, "src/odla/rules.mjs"), rulesTemplate());
   ensureGitignore(rootDir);
   out.log(`created ${relativeDisplay(configPath, rootDir)}`);
   out.log("created src/odla/schema.mjs and src/odla/rules.mjs");
@@ -3312,8 +3846,8 @@ function assertWranglerConfig(cfg) {
 }
 
 // src/secrets-set.ts
-var import_ai = require("@odla-ai/ai");
-var import_apps4 = require("@odla-ai/apps");
+var import_ai2 = require("@odla-ai/ai");
+var import_apps8 = require("@odla-ai/apps");
 var PROD_ENV_NAMES2 = /* @__PURE__ */ new Set(["prod", "production"]);
 async function secretsSet(options) {
   const name = (options.name ?? "").trim();
@@ -3321,38 +3855,38 @@ async function secretsSet(options) {
   if (name.startsWith("$")) {
     throw new Error('"$"-prefixed vault names are platform-reserved; for the Clerk secret key use "odla-ai secrets set-clerk-key"');
   }
-  const { cfg, tenantId, value, doFetch, out } = await resolveVaultWrite(options);
+  const { cfg, tenantId, value: value2, doFetch, out } = await resolveVaultWrite(options);
   const token = await getDeveloperToken(cfg, options, doFetch, out);
   try {
-    await (0, import_ai.putSecret)({ endpoint: cfg.dbEndpoint, token, fetch: doFetch }, tenantId, name, value);
+    await (0, import_ai2.putSecret)({ endpoint: cfg.dbEndpoint, token, fetch: doFetch }, tenantId, name, value2);
   } catch (err) {
-    throw new Error(scrubValue(err instanceof Error ? err.message : String(err), value));
+    throw new Error(scrubValue(err instanceof Error ? err.message : String(err), value2));
   }
   out.log(`${name} stored in the ${tenantId} vault (write-only; the value was never echoed and cannot be read back here)`);
 }
 async function secretsSetClerkKey(options) {
-  const { cfg, tenantId, value, doFetch, out } = await resolveVaultWrite(options);
-  if (!value.startsWith("sk_")) throw new Error("the Clerk secret key must start with sk_ (sk_test_\u2026 or sk_live_\u2026)");
-  if (value.startsWith("sk_test_") && PROD_ENV_NAMES2.has(options.env)) {
+  const { cfg, tenantId, value: value2, doFetch, out } = await resolveVaultWrite(options);
+  if (!value2.startsWith("sk_")) throw new Error("the Clerk secret key must start with sk_ (sk_test_\u2026 or sk_live_\u2026)");
+  if (value2.startsWith("sk_test_") && PROD_ENV_NAMES2.has(options.env)) {
     throw new Error(`refusing to store an sk_test_ Clerk key for "${options.env}" \u2014 use the production instance's sk_live_ key`);
   }
-  if (value.startsWith("sk_live_") && !PROD_ENV_NAMES2.has(options.env) && !options.yes) {
+  if (value2.startsWith("sk_live_") && !PROD_ENV_NAMES2.has(options.env) && !options.yes) {
     throw new Error(`refusing to store an sk_live_ Clerk key for "${options.env}" without --yes (live users would sync into a non-prod tenant)`);
   }
   const token = await getDeveloperToken(cfg, options, doFetch, out);
   const res = await doFetch(`${cfg.dbEndpoint}/admin/apps/${encodeURIComponent(tenantId)}/clerk-secret`, {
     method: "POST",
     headers: { authorization: `Bearer ${token}`, "content-type": "application/json" },
-    body: JSON.stringify({ value })
+    body: JSON.stringify({ value: value2 })
   });
   if (!res.ok) {
-    const text = scrubValue((await res.text().catch(() => "")).slice(0, 300), value);
+    const text = scrubValue((await res.text().catch(() => "")).slice(0, 300), value2);
     throw new Error(`store Clerk secret key failed (${res.status}): ${text || "request failed"}`);
   }
   out.log(`Clerk secret key stored for ${tenantId} ($clerk_secret, reserved + write-only; the value was never echoed)`);
 }
-function scrubValue(text, value) {
-  return redactSecrets(text).split(value).join("[value redacted]");
+function scrubValue(text, value2) {
+  return redactSecrets(text).split(value2).join("[value redacted]");
 }
 async function resolveVaultWrite(options) {
   const out = options.stdout ?? console;
@@ -3364,14 +3898,14 @@ async function resolveVaultWrite(options) {
   if (PROD_ENV_NAMES2.has(options.env) && !options.yes) {
     throw new Error(`refusing to store a secret for "${options.env}" without --yes`);
   }
-  const value = await secretInputValue(options, "secret");
-  return { cfg, tenantId: (0, import_apps4.tenantIdFor)(cfg.app.id, options.env), value, doFetch, out };
+  const value2 = await secretInputValue(options, "secret");
+  return { cfg, tenantId: (0, import_apps8.tenantIdFor)(cfg.app.id, options.env), value: value2, doFetch, out };
 }
 
 // src/skill.ts
 var import_node_fs12 = require("fs");
 var import_node_os2 = require("os");
-var import_node_path10 = require("path");
+var import_node_path11 = require("path");
 var import_node_url2 = require("url");
 
 // src/skill-adapters.ts
@@ -3450,8 +3984,8 @@ function installSkill(options = {}) {
   const files = listFiles(sourceDir);
   if (files.length === 0) throw new Error(`no bundled skills found at ${sourceDir}`);
   const harnesses = normalizeHarnesses(options.harnesses, options.global === true);
-  const root = (0, import_node_path10.resolve)(options.dir ?? process.cwd());
-  const home = (0, import_node_path10.resolve)(options.homeDir ?? (0, import_node_os2.homedir)());
+  const root = (0, import_node_path11.resolve)(options.dir ?? process.cwd());
+  const home = (0, import_node_path11.resolve)(options.homeDir ?? (0, import_node_os2.homedir)());
   const plans = /* @__PURE__ */ new Map();
   const targets = /* @__PURE__ */ new Map();
   const rememberTarget = (harness, target) => {
@@ -3465,48 +3999,48 @@ function installSkill(options = {}) {
     plans.set(target, { target, content: content2, boundary, managedMerge });
   };
   const planSkillTree = (targetDir2, boundary = root) => {
-    for (const rel of files) plan((0, import_node_path10.join)(targetDir2, rel), (0, import_node_fs12.readFileSync)((0, import_node_path10.join)(sourceDir, rel), "utf8"), false, boundary);
+    for (const rel of files) plan((0, import_node_path11.join)(targetDir2, rel), (0, import_node_fs12.readFileSync)((0, import_node_path11.join)(sourceDir, rel), "utf8"), false, boundary);
   };
   let targetDir;
   if (options.global) {
-    const claudeRoot = (0, import_node_path10.join)(home, ".claude", "skills");
-    const codexRoot = (0, import_node_path10.resolve)(options.codexHomeDir ?? process.env.CODEX_HOME ?? (0, import_node_path10.join)(home, ".codex"), "skills");
+    const claudeRoot = (0, import_node_path11.join)(home, ".claude", "skills");
+    const codexRoot = (0, import_node_path11.resolve)(options.codexHomeDir ?? process.env.CODEX_HOME ?? (0, import_node_path11.join)(home, ".codex"), "skills");
     targetDir = harnesses[0] === "codex" ? codexRoot : claudeRoot;
     for (const harness of harnesses) {
       const skillRoot = harness === "claude" ? claudeRoot : codexRoot;
-      planSkillTree(skillRoot, harness === "claude" ? home : (0, import_node_path10.dirname)((0, import_node_path10.dirname)(codexRoot)));
+      planSkillTree(skillRoot, harness === "claude" ? home : (0, import_node_path11.dirname)((0, import_node_path11.dirname)(codexRoot)));
       rememberTarget(harness, skillRoot);
     }
   } else {
-    const sharedRoot = (0, import_node_path10.join)(root, ".agents", "skills");
+    const sharedRoot = (0, import_node_path11.join)(root, ".agents", "skills");
     planSkillTree(sharedRoot);
-    const claudeRoot = (0, import_node_path10.join)(root, ".claude", "skills");
+    const claudeRoot = (0, import_node_path11.join)(root, ".claude", "skills");
     targetDir = harnesses.includes("claude") ? claudeRoot : sharedRoot;
     for (const harness of harnesses) rememberTarget(harness, sharedRoot);
     if (harnesses.includes("claude")) {
       for (const skill of skillNames(files)) {
-        const canonical = (0, import_node_fs12.readFileSync)((0, import_node_path10.join)(sourceDir, skill, "SKILL.md"), "utf8");
-        plan((0, import_node_path10.join)(claudeRoot, skill, "SKILL.md"), claudeAdapter(skill, canonical));
+        const canonical = (0, import_node_fs12.readFileSync)((0, import_node_path11.join)(sourceDir, skill, "SKILL.md"), "utf8");
+        plan((0, import_node_path11.join)(claudeRoot, skill, "SKILL.md"), claudeAdapter(skill, canonical));
       }
       rememberTarget("claude", claudeRoot);
     }
     if (harnesses.includes("cursor")) {
-      const cursorRule = (0, import_node_path10.join)(root, ".cursor", "rules", "odla.mdc");
+      const cursorRule = (0, import_node_path11.join)(root, ".cursor", "rules", "odla.mdc");
       plan(cursorRule, CURSOR_RULE);
       rememberTarget("cursor", cursorRule);
     }
     if (harnesses.includes("agents")) {
-      const agentsFile = (0, import_node_path10.join)(root, "AGENTS.md");
+      const agentsFile = (0, import_node_path11.join)(root, "AGENTS.md");
       plan(agentsFile, managedFileContent(agentsFile, PROJECT_INSTRUCTIONS, options.force === true, root), true);
       rememberTarget("agents", agentsFile);
     }
     if (harnesses.includes("copilot")) {
-      const copilotFile = (0, import_node_path10.join)(root, ".github", "copilot-instructions.md");
+      const copilotFile = (0, import_node_path11.join)(root, ".github", "copilot-instructions.md");
       plan(copilotFile, managedFileContent(copilotFile, PROJECT_INSTRUCTIONS, options.force === true, root), true);
       rememberTarget("copilot", copilotFile);
     }
     if (harnesses.includes("gemini")) {
-      const geminiFile = (0, import_node_path10.join)(root, "GEMINI.md");
+      const geminiFile = (0, import_node_path11.join)(root, "GEMINI.md");
       plan(geminiFile, managedFileContent(geminiFile, PROJECT_INSTRUCTIONS, options.force === true, root), true);
       rememberTarget("gemini", geminiFile);
     }
@@ -3542,7 +4076,7 @@ ${conflicts.map((f) => `  - ${f}`).join("\n")}`
   }
   for (const file of plans.values()) {
     if (!(0, import_node_fs12.existsSync)(file.target) || (0, import_node_fs12.readFileSync)(file.target, "utf8") !== file.content) {
-      (0, import_node_fs12.mkdirSync)((0, import_node_path10.dirname)(file.target), { recursive: true });
+      (0, import_node_fs12.mkdirSync)((0, import_node_path11.dirname)(file.target), { recursive: true });
       (0, import_node_fs12.writeFileSync)(file.target, file.content);
     }
   }
@@ -3562,7 +4096,7 @@ ${conflicts.map((f) => `  - ${f}`).join("\n")}`
   };
 }
 function pathsUnder(root, paths) {
-  return [...paths].map((path) => (0, import_node_path10.relative)(root, path)).filter((path) => path !== ".." && !path.startsWith(`..${import_node_path10.sep}`) && !(0, import_node_path10.isAbsolute)(path)).sort();
+  return [...paths].map((path) => (0, import_node_path11.relative)(root, path)).filter((path) => path !== ".." && !path.startsWith(`..${import_node_path11.sep}`) && !(0, import_node_path11.isAbsolute)(path)).sort();
 }
 function normalizeHarnesses(values, global) {
   const requested = values?.length ? values : ["claude"];
@@ -3607,13 +4141,13 @@ function managedFileContent(path, block, force, boundary) {
   return `${current.slice(0, startAt)}${block}${current.slice(afterEnd)}`;
 }
 function symlinkedComponent(boundary, target) {
-  const rel = (0, import_node_path10.relative)(boundary, target);
-  if (rel === ".." || rel.startsWith(`..${import_node_path10.sep}`) || (0, import_node_path10.isAbsolute)(rel)) {
+  const rel = (0, import_node_path11.relative)(boundary, target);
+  if (rel === ".." || rel.startsWith(`..${import_node_path11.sep}`) || (0, import_node_path11.isAbsolute)(rel)) {
     throw new Error(`agent setup target escapes its install root: ${target}`);
   }
   let current = boundary;
-  for (const part of rel.split(import_node_path10.sep).filter(Boolean)) {
-    current = (0, import_node_path10.join)(current, part);
+  for (const part of rel.split(import_node_path11.sep).filter(Boolean)) {
+    current = (0, import_node_path11.join)(current, part);
     try {
       if ((0, import_node_fs12.lstatSync)(current).isSymbolicLink()) return current;
     } catch (error) {
@@ -3630,9 +4164,9 @@ function listFiles(dir) {
   const results = [];
   const walk = (current) => {
     for (const entry of (0, import_node_fs12.readdirSync)(current, { withFileTypes: true })) {
-      const path = (0, import_node_path10.join)(current, entry.name);
+      const path = (0, import_node_path11.join)(current, entry.name);
       if (entry.isDirectory()) walk(path);
-      else results.push((0, import_node_path10.relative)(dir, path));
+      else results.push((0, import_node_path11.relative)(dir, path));
     }
   };
   walk(dir);
@@ -3708,7 +4242,7 @@ async function smoke(options) {
     out.log(`  schema: ${liveEntities.length} entities`);
     const aggregateEntity = expectedEntities[0] ?? liveEntities[0];
     if (aggregateEntity) {
-      const aggregate = await postJson(doFetch, `${cfg.dbEndpoint}/app/${encodeURIComponent(entry.tenantId)}/aggregate`, entry.dbKey, {
+      const aggregate = await postJson2(doFetch, `${cfg.dbEndpoint}/app/${encodeURIComponent(entry.tenantId)}/aggregate`, entry.dbKey, {
         ns: aggregateEntity,
         aggregate: { count: true }
       });
@@ -3752,16 +4286,16 @@ async function getJson(doFetch, url, bearer) {
   const res = await doFetch(url, {
     headers: bearer ? { authorization: `Bearer ${bearer}` } : void 0
   });
-  if (!res.ok) throw new Error(`${new URL(url).pathname} returned ${res.status}: ${await safeText3(res)}`);
+  if (!res.ok) throw new Error(`${new URL(url).pathname} returned ${res.status}: ${await safeText4(res)}`);
   return res.json();
 }
-async function postJson(doFetch, url, bearer, body) {
+async function postJson2(doFetch, url, bearer, body) {
   const res = await doFetch(url, {
     method: "POST",
     headers: { authorization: `Bearer ${bearer}`, "content-type": "application/json" },
     body: JSON.stringify(body)
   });
-  if (!res.ok) throw new Error(`${new URL(url).pathname} returned ${res.status}: ${await safeText3(res)}`);
+  if (!res.ok) throw new Error(`${new URL(url).pathname} returned ${res.status}: ${await safeText4(res)}`);
   return res.json();
 }
 function publicConfigUrl(platformUrl, appId, env) {
@@ -3769,7 +4303,7 @@ function publicConfigUrl(platformUrl, appId, env) {
   url.searchParams.set("env", env);
   return url.toString();
 }
-async function safeText3(res) {
+async function safeText4(res) {
   try {
     return redactSecrets((await res.text()).slice(0, 500));
   } catch {
@@ -3825,6 +4359,26 @@ async function secretsCommand(parsed, deps) {
   });
 }
 async function projectCommand(command, parsed, deps) {
+  if (command === "config") {
+    const sub = parsed.positionals[1];
+    if (sub !== "diff" && sub !== "plan") {
+      throw new Error(`unknown config subcommand "${sub ?? ""}". Try "odla-ai config diff --json".`);
+    }
+    assertArgs(parsed, ["config", "token", "email", "open", "json"], 2);
+    const options = {
+      configPath: stringOpt(parsed.options.config) ?? "odla.config.mjs",
+      token: stringOpt(parsed.options.token),
+      email: stringOpt(parsed.options.email),
+      open: parsed.options.open === false ? false : parsed.options.open === true ? true : void 0,
+      json: parsed.options.json === true,
+      fetch: deps.fetch,
+      openApprovalUrl: deps.openUrl,
+      stdout: deps.stdout
+    };
+    if (sub === "diff") await configDiff(options);
+    else await configPlan(options);
+    return true;
+  }
   if (command === "init") {
     assertArgs(parsed, ["app-id", "name", "config", "env", "services", "ai-provider", "force"], 1);
     initProject({
@@ -3885,7 +4439,7 @@ async function projectCommand(command, parsed, deps) {
 // src/code-connect.ts
 var import_node_fs14 = require("fs");
 var import_node_os4 = require("os");
-var import_node_path12 = require("path");
+var import_node_path13 = require("path");
 
 // ../harness/dist/chunk-QTUEF2HZ.js
 var HARNESS_PROTOCOL_VERSION = 1;
@@ -3895,24 +4449,24 @@ var CONTROL = /[\u0000-\u0008\u000b\u000c\u000e-\u001f\u007f]/;
 var HarnessProtocolError = class extends Error {
   name = "HarnessProtocolError";
 };
-function record2(value) {
-  return value !== null && typeof value === "object" && !Array.isArray(value) ? value : null;
+function record2(value2) {
+  return value2 !== null && typeof value2 === "object" && !Array.isArray(value2) ? value2 : null;
 }
-function boundedText(value, label, max) {
-  if (typeof value !== "string" || !value || value.length > max || CONTROL.test(value)) {
+function boundedText(value2, label, max) {
+  if (typeof value2 !== "string" || !value2 || value2.length > max || CONTROL.test(value2)) {
     throw new HarnessProtocolError(`${label} must be a non-empty string of at most ${max} characters`);
   }
-  return value;
+  return value2;
 }
 function parseAgentOutput(line) {
   if (Buffer.byteLength(line, "utf8") > 1e6) throw new HarnessProtocolError("agent message exceeds 1 MB");
-  let value;
+  let value2;
   try {
-    value = JSON.parse(line);
+    value2 = JSON.parse(line);
   } catch {
     throw new HarnessProtocolError("agent emitted invalid JSON");
   }
-  const message2 = record2(value);
+  const message2 = record2(value2);
   if (!message2 || message2.protocolVersion !== HARNESS_PROTOCOL_VERSION) {
     throw new HarnessProtocolError(`agent protocolVersion must be ${HARNESS_PROTOCOL_VERSION}`);
   }
@@ -4221,7 +4775,7 @@ async function gitOutput(cwd, args, maxBytes) {
     else stdout.push(chunk);
   });
   child.stderr.on("data", (chunk) => {
-    if (stderr.reduce((sum, value) => sum + value.byteLength, 0) < 16384) stderr.push(chunk);
+    if (stderr.reduce((sum, value2) => sum + value2.byteLength, 0) < 16384) stderr.push(chunk);
   });
   const code = await new Promise((accept, reject) => {
     child.once("error", reject);
@@ -4242,7 +4796,7 @@ async function gitBlobs(cwd, entries, maxBytes) {
     else stdout.push(chunk);
   });
   child.stderr.on("data", (chunk) => {
-    if (stderr.reduce((sum, value) => sum + value.byteLength, 0) < 16384) stderr.push(chunk);
+    if (stderr.reduce((sum, value2) => sum + value2.byteLength, 0) < 16384) stderr.push(chunk);
   });
   child.stdin.end(`${entries.map((entry) => entry.hash).join("\n")}
 `);
@@ -4280,8 +4834,8 @@ async function materializeGitTree(source, commitSha, options = {}) {
   const maxFiles = options.maxFiles ?? 2e4;
   const maxBytes = options.maxBytes ?? 512 * 1024 * 1024;
   const inventory = (await gitOutput(sourceDir, ["ls-tree", "-rz", commitSha], 16 * 1024 * 1024)).toString("utf8").split("\0").filter(Boolean);
-  const entries = inventory.flatMap((record7) => {
-    const match = /^(100644|100755) blob ([0-9a-f]{40,64})\t([\s\S]+)$/.exec(record7);
+  const entries = inventory.flatMap((record8) => {
+    const match = /^(100644|100755) blob ([0-9a-f]{40,64})\t([\s\S]+)$/.exec(record8);
     return match && allowedWorkspacePath(match[3]) ? [{ mode: match[1], hash: match[2], path: match[3] }] : [];
   });
   if (entries.length > maxFiles) throw new Error(`workspace exceeds ${maxFiles} files`);
@@ -4356,7 +4910,7 @@ async function gitSourceFiles(sourceDir, maxFiles, maxBytes) {
     else stdout.push(chunk);
   });
   child.stderr.on("data", (chunk) => {
-    if (stderr.reduce((sum, value) => sum + value.byteLength, 0) < 16384) stderr.push(chunk);
+    if (stderr.reduce((sum, value2) => sum + value2.byteLength, 0) < 16384) stderr.push(chunk);
   });
   const code = await new Promise((accept, reject) => {
     child.once("error", reject);
@@ -4416,7 +4970,7 @@ async function captureGitDiff(root, maxBytes) {
     else stdout.push(chunk);
   });
   child.stderr.on("data", (chunk) => {
-    if (stderr.reduce((sum, value) => sum + value.byteLength, 0) < 16384) stderr.push(chunk);
+    if (stderr.reduce((sum, value2) => sum + value2.byteLength, 0) < 16384) stderr.push(chunk);
   });
   const code = await new Promise((accept, reject) => {
     child.once("error", reject);
@@ -4503,34 +5057,34 @@ var CamelError = class extends Error {
 };
 
 // ../camel/dist/chunk-L5DYU2E2.js
-function canonicalJson(value) {
-  return JSON.stringify(normalize(value));
+function canonicalJson2(value2) {
+  return JSON.stringify(normalize(value2));
 }
-async function sha256Hex(value) {
-  const bytes = typeof value === "string" ? new TextEncoder().encode(value) : value;
+async function sha256Hex(value2) {
+  const bytes = typeof value2 === "string" ? new TextEncoder().encode(value2) : value2;
   const digest = await crypto.subtle.digest("SHA-256", Uint8Array.from(bytes).buffer);
   return [...new Uint8Array(digest)].map((byte) => byte.toString(16).padStart(2, "0")).join("");
 }
-function utf8Length(value) {
-  if (typeof value === "string") return new TextEncoder().encode(value).byteLength;
-  if (value instanceof Uint8Array) return value.byteLength;
+function utf8Length(value2) {
+  if (typeof value2 === "string") return new TextEncoder().encode(value2).byteLength;
+  if (value2 instanceof Uint8Array) return value2.byteLength;
   try {
-    return new TextEncoder().encode(canonicalJson(value)).byteLength;
+    return new TextEncoder().encode(canonicalJson2(value2)).byteLength;
   } catch {
     throw new CamelError("conversion_rejected", "Unsafe input could not be canonically measured.");
   }
 }
-function normalize(value) {
-  if (value === null || typeof value === "string" || typeof value === "boolean") return value;
-  if (typeof value === "number") {
-    if (!Number.isFinite(value)) throw new CamelError("state_conflict", "Canonical JSON rejects non-finite numbers.");
-    return value;
+function normalize(value2) {
+  if (value2 === null || typeof value2 === "string" || typeof value2 === "boolean") return value2;
+  if (typeof value2 === "number") {
+    if (!Number.isFinite(value2)) throw new CamelError("state_conflict", "Canonical JSON rejects non-finite numbers.");
+    return value2;
   }
-  if (Array.isArray(value)) return value.map(normalize);
-  if (value instanceof Uint8Array) return { $bytes: [...value] };
-  if (typeof value === "object") {
-    const record7 = value;
-    return Object.fromEntries(Object.keys(record7).filter((key) => record7[key] !== void 0).sort().map((key) => [key, normalize(record7[key])]));
+  if (Array.isArray(value2)) return value2.map(normalize);
+  if (value2 instanceof Uint8Array) return { $bytes: [...value2] };
+  if (typeof value2 === "object") {
+    const record8 = value2;
+    return Object.fromEntries(Object.keys(record8).filter((key) => record8[key] !== void 0).sort().map((key) => [key, normalize(record8[key])]));
   }
   throw new CamelError("state_conflict", "Canonical JSON rejects unsupported values.");
 }
@@ -4539,10 +5093,10 @@ function canRead(readers, readerId) {
 }
 function dependenciesOf(values, influence = "data") {
   const result = [];
-  for (const value of values) {
-    result.push(...value.label.dependencies);
-    for (const ref of value.label.provenance) {
-      result.push({ ref, influence, promptSafetyAtUse: value.label.promptSafety });
+  for (const value2 of values) {
+    result.push(...value2.label.dependencies);
+    for (const ref of value2.label.provenance) {
+      result.push({ ref, influence, promptSafetyAtUse: value2.label.promptSafety });
     }
   }
   const unique3 = /* @__PURE__ */ new Map();
@@ -4553,32 +5107,32 @@ function dependenciesOf(values, influence = "data") {
 // ../camel/dist/chunk-S7EVNA2U.js
 var camelValueBrand = /* @__PURE__ */ Symbol("@odla-ai/camel/value");
 var authenticCamelValues = /* @__PURE__ */ new WeakSet();
-function isCamelValue(value) {
-  return typeof value === "object" && value !== null && authenticCamelValues.has(value);
+function isCamelValue(value2) {
+  return typeof value2 === "object" && value2 !== null && authenticCamelValues.has(value2);
 }
-function isSafe(value) {
-  return isCamelValue(value) && value.label.promptSafety === "safe";
+function isSafe(value2) {
+  return isCamelValue(value2) && value2.label.promptSafety === "safe";
 }
-function isUnsafe(value) {
-  return isCamelValue(value) && value.label.promptSafety === "unsafe";
+function isUnsafe(value2) {
+  return isCamelValue(value2) && value2.label.promptSafety === "unsafe";
 }
-function createSafeInternal(value, safeBasis, metadata2) {
-  return createValue(value, {
+function createSafeInternal(value2, safeBasis, metadata2) {
+  return createValue(value2, {
     schemaVersion: 1,
     promptSafety: "safe",
     safeBasis,
     ...copyMetadata(metadata2)
   });
 }
-function createUnsafeInternal(value, metadata2) {
-  return createValue(value, {
+function createUnsafeInternal(value2, metadata2) {
+  return createValue(value2, {
     schemaVersion: 1,
     promptSafety: "unsafe",
     ...copyMetadata(metadata2)
   });
 }
-function createValue(value, label) {
-  const result = { value, label: Object.freeze(label) };
+function createValue(value2, label) {
+  const result = { value: value2, label: Object.freeze(label) };
   Object.defineProperty(result, camelValueBrand, { value: label.promptSafety, enumerable: false });
   authenticCamelValues.add(result);
   return Object.freeze(result);
@@ -4641,7 +5195,7 @@ async function digestCodeVerificationReceipt(fields) {
     changedTestsRequireReview: fields.changedTestsRequireReview,
     outcome: fields.outcome
   };
-  return `sha256:${await sha256Hex(canonicalJson(canonical))}`;
+  return `sha256:${await sha256Hex(canonicalJson2(canonical))}`;
 }
 function validate(fields) {
   if (fields.schemaVersion !== 1 || typeof fields.verificationId !== "string" || !ID.test(fields.verificationId) || typeof fields.trustedBaseCommitSha !== "string" || !SHA.test(fields.trustedBaseCommitSha) || !DIGEST.test(fields.trustedBaseDigest) || !DIGEST.test(fields.patchDigest) || !DIGEST.test(fields.candidateDigest) || !DIGEST.test(fields.sourceDigest) || !DIGEST.test(fields.policyDigest) || !DIGEST.test(fields.changedTestSetDigest) || !Number.isSafeInteger(fields.changedTestCount) || fields.changedTestCount < 0 || fields.changedTestCount > 1e4 || fields.changedTestsRequireReview !== fields.changedTestCount > 0 || fields.recipes.length < 1 || fields.recipes.length > 64) {
@@ -4679,13 +5233,13 @@ async function createCodePortableCheckpoint(input) {
   const state2 = normalizeState(input.state);
   validateBaseAndPatch(input.baseCommitSha, input.patch);
   const patchDigest = `sha256:${await sha256Hex(input.patch)}`;
-  const stateDigest = `sha256:${await sha256Hex(canonicalJson(state2))}`;
+  const stateDigest = `sha256:${await sha256Hex(canonicalJson2(state2))}`;
   const fields = { schemaVersion: 1, baseCommitSha: input.baseCommitSha, patchDigest, state: state2, stateDigest };
-  const checkpointDigest = `sha256:${await sha256Hex(canonicalJson(fields))}`;
+  const checkpointDigest = `sha256:${await sha256Hex(canonicalJson2(fields))}`;
   return freeze({ ...fields, patch: input.patch, checkpointDigest });
 }
-async function verifyCodePortableCheckpoint(value) {
-  const input = object(value, "checkpoint");
+async function verifyCodePortableCheckpoint(value2) {
+  const input = object(value2, "checkpoint");
   exact2(input, ["schemaVersion", "baseCommitSha", "patch", "patchDigest", "state", "stateDigest", "checkpointDigest"]);
   if (input.schemaVersion !== 1 || typeof input.baseCommitSha !== "string" || typeof input.patch !== "string" || typeof input.patchDigest !== "string" || typeof input.stateDigest !== "string" || typeof input.checkpointDigest !== "string") {
     throw invalid2("Portable checkpoint fields are malformed.");
@@ -4700,8 +5254,8 @@ async function verifyCodePortableCheckpoint(value) {
   }
   return created;
 }
-function normalizeState(value) {
-  const state2 = object(value, "state");
+function normalizeState(value2) {
+  const state2 = object(value2, "state");
   exact2(state2, [
     "planCursor",
     "conversationRefs",
@@ -4759,30 +5313,30 @@ function validateBaseAndPatch(baseCommitSha, patch2) {
     throw invalid2("Portable checkpoint base or patch is malformed or outside its bounds.");
   }
 }
-function strings(value, name, pattern, maximum, sort) {
-  if (!Array.isArray(value) || value.length > maximum || value.some((item) => typeof item !== "string" || !pattern.test(item)) || new Set(value).size !== value.length) {
+function strings(value2, name, pattern, maximum, sort) {
+  if (!Array.isArray(value2) || value2.length > maximum || value2.some((item) => typeof item !== "string" || !pattern.test(item)) || new Set(value2).size !== value2.length) {
     throw invalid2(`Portable checkpoint ${name} is malformed or outside its bounds.`);
   }
-  const result = [...value];
+  const result = [...value2];
   return sort ? result.sort() : result;
 }
-function object(value, name) {
-  if (!value || typeof value !== "object" || Array.isArray(value)) throw invalid2(`Portable ${name} must be an object.`);
-  return value;
+function object(value2, name) {
+  if (!value2 || typeof value2 !== "object" || Array.isArray(value2)) throw invalid2(`Portable ${name} must be an object.`);
+  return value2;
 }
-function exact2(value, keys) {
-  if (Object.keys(value).some((key) => !keys.includes(key)) || keys.some((key) => !(key in value))) {
+function exact2(value2, keys) {
+  if (Object.keys(value2).some((key) => !keys.includes(key)) || keys.some((key) => !(key in value2))) {
     throw invalid2("Portable checkpoint contains missing or unsupported fields.");
   }
 }
-function freeze(value) {
+function freeze(value2) {
   return Object.freeze({
-    ...value,
+    ...value2,
     state: Object.freeze({
-      ...value.state,
-      conversationRefs: Object.freeze([...value.state.conversationRefs]),
-      completedEffects: Object.freeze(value.state.completedEffects.map((item) => Object.freeze({ ...item }))),
-      unresolvedApprovals: Object.freeze([...value.state.unresolvedApprovals])
+      ...value2.state,
+      conversationRefs: Object.freeze([...value2.state.conversationRefs]),
+      completedEffects: Object.freeze(value2.state.completedEffects.map((item) => Object.freeze({ ...item }))),
+      unresolvedApprovals: Object.freeze([...value2.state.unresolvedApprovals])
     })
   });
 }
@@ -4799,7 +5353,7 @@ async function digestCodeRepositorySnapshot(snapshot, limits = DEFAULT_LIMITS) {
     commitSha: snapshot.commitSha,
     files: [...snapshot.files].map((file) => ({ path: file.path, content: file.content })).sort((left, right) => left.path.localeCompare(right.path))
   };
-  return `sha256:${await sha256Hex(canonicalJson(normalized))}`;
+  return `sha256:${await sha256Hex(canonicalJson2(normalized))}`;
 }
 function validateSnapshot(snapshot, limits) {
   if (!REPOSITORY.test(snapshot.repository) || !SHA4.test(snapshot.commitSha)) {
@@ -4841,10 +5395,10 @@ var import_path9 = require("path");
 
 // ../camel/dist/chunk-LAXU2AVK.js
 function conversionPolicyDigest(policy) {
-  return sha256Hex(canonicalJson(policy));
+  return sha256Hex(canonicalJson2(policy));
 }
 function registeredIdRegistryDigest(values) {
-  return sha256Hex(canonicalJson(values));
+  return sha256Hex(canonicalJson2(values));
 }
 async function createConversionRegistry(config) {
   const policies = /* @__PURE__ */ new Map();
@@ -4873,61 +5427,61 @@ async function createConversionRegistry(config) {
     if (utf8Length(source.value) > policy.maximumSourceBytes) throw new CamelError("limit_exceeded", "Unsafe conversion input exceeds its byte bound.");
     return policy;
   };
-  const emit3 = (source, policy, value) => convert(source, policy, value, outputCounts);
+  const emit3 = (source, policy, value2) => convert(source, policy, value2, outputCounts);
   const operations = Object.freeze({
-    boolean: async (value, id) => {
-      const policy = checked(value, id, "boolean");
-      return emit3(value, policy, requireBoolean(value.value));
+    boolean: async (value2, id) => {
+      const policy = checked(value2, id, "boolean");
+      return emit3(value2, policy, requireBoolean(value2.value));
     },
-    integer: async (value, id) => {
-      const policy = checked(value, id, "integer");
-      return emit3(value, policy, boundedInteger(value.value, policy.output));
+    integer: async (value2, id) => {
+      const policy = checked(value2, id, "integer");
+      return emit3(value2, policy, boundedInteger(value2.value, policy.output));
     },
-    finiteNumber: async (value, id) => {
-      const policy = checked(value, id, "finite_number");
-      return emit3(value, policy, boundedNumber(value.value, policy.output));
+    finiteNumber: async (value2, id) => {
+      const policy = checked(value2, id, "finite_number");
+      return emit3(value2, policy, boundedNumber(value2.value, policy.output));
     },
-    enum: async (value, id) => {
-      const policy = checked(value, id, "enum");
-      return emit3(value, policy, enumMember(value.value, policy.output));
+    enum: async (value2, id) => {
+      const policy = checked(value2, id, "enum");
+      return emit3(value2, policy, enumMember(value2.value, policy.output));
     },
-    date: async (value, id) => {
-      const policy = checked(value, id, "date");
-      return emit3(value, policy, canonicalDate(value.value, policy.output));
+    date: async (value2, id) => {
+      const policy = checked(value2, id, "date");
+      return emit3(value2, policy, canonicalDate(value2.value, policy.output));
     },
-    registeredId: async (value, id) => {
-      const policy = checked(value, id, "registered_id");
+    registeredId: async (value2, id) => {
+      const policy = checked(value2, id, "registered_id");
       const registry = config.registeredIds?.[policy.output.registryId];
-      const output = typeof value.value === "string" ? registry?.values[value.value] : void 0;
+      const output = typeof value2.value === "string" ? registry?.values[value2.value] : void 0;
       if (!output) throw new CamelError("conversion_rejected", "Registered-ID conversion rejected the candidate.");
-      return emit3(value, policy, output);
+      return emit3(value2, policy, output);
     },
-    digest: async (value, id) => {
-      const policy = checked(value, id, "digest");
-      if (!(value.value instanceof Uint8Array)) throw new CamelError("conversion_rejected", "Digest conversion requires bytes.");
-      return emit3(value, policy, await sha256Hex(value.value));
+    digest: async (value2, id) => {
+      const policy = checked(value2, id, "digest");
+      if (!(value2.value instanceof Uint8Array)) throw new CamelError("conversion_rejected", "Digest conversion requires bytes.");
+      return emit3(value2, policy, await sha256Hex(value2.value));
     },
-    measure: async (value, metric, id) => {
-      const policy = checked(value, id, "integer");
-      const measured = measure(value.value, metric);
-      return emit3(value, policy, boundedInteger(measured, policy.output));
+    measure: async (value2, metric, id) => {
+      const policy = checked(value2, id, "integer");
+      const measured = measure(value2.value, metric);
+      return emit3(value2, policy, boundedInteger(measured, policy.output));
     },
-    test: async (value, predicateId, id) => {
-      const policy = checked(value, id, "boolean");
+    test: async (value2, predicateId, id) => {
+      const policy = checked(value2, id, "boolean");
       const predicate = config.predicates?.[predicateId];
       if (!predicate) throw new CamelError("conversion_rejected", "Predicate is not registered.");
-      return emit3(value, policy, evaluatePredicate(value.value, predicate, config.registeredIds));
+      return emit3(value2, policy, evaluatePredicate(value2.value, predicate, config.registeredIds));
     }
   });
   return Object.freeze({ operations, policy: (id) => policies.get(id) ?? missingPolicy() });
 }
-async function convert(source, policy, value, counts) {
+async function convert(source, policy, value2, counts) {
   const sourceKey = sourceIdentity(source);
   const countKey = `${policy.conversionId}\0${sourceKey}`;
   const count = counts.get(countKey) ?? 0;
   if (count >= policy.maximumOutputsPerArtifact) throw new CamelError("limit_exceeded", "Conversion output count exceeds its per-source bound.");
   counts.set(countKey, count + 1);
-  return createSafeInternal(value, "atomic_conversion", {
+  return createSafeInternal(value2, "atomic_conversion", {
     readers: source.label.readers,
     provenance: [...source.label.provenance, { kind: "converter", id: policy.conversionId, digest: policy.digest }],
     dependencies: dependenciesOf([source])
@@ -4939,49 +5493,49 @@ function validatePolicyShape(policy) {
   const output = policy.output;
   if ((output.kind === "integer" || output.kind === "finite_number") && (!Number.isFinite(output.minimum) || !Number.isFinite(output.maximum) || output.minimum > output.maximum)) throw new CamelError("state_conflict", "Numeric conversion bounds are invalid.");
   if (output.kind === "finite_number" && (!Number.isSafeInteger(output.maximumDecimalPlaces) || output.maximumDecimalPlaces < 0 || output.maximumDecimalPlaces > 15)) throw new CamelError("state_conflict", "Decimal-place bound is invalid.");
-  if (output.kind === "enum" && (output.values.length === 0 || output.values.some((value) => typeof value !== "string" || !value) || new Set(output.values).size !== output.values.length)) throw new CamelError("state_conflict", "Enum conversion members must be unique and non-empty.");
+  if (output.kind === "enum" && (output.values.length === 0 || output.values.some((value2) => typeof value2 !== "string" || !value2) || new Set(output.values).size !== output.values.length)) throw new CamelError("state_conflict", "Enum conversion members must be unique and non-empty.");
   if (output.kind === "registered_id" && (!output.registryId || !output.registryDigest)) throw new CamelError("state_conflict", "Registered-ID conversion identity is invalid.");
   if (output.kind === "date" && output.format !== "date" && output.format !== "rfc3339") throw new CamelError("state_conflict", "Date conversion format is invalid.");
   if (output.kind === "digest" && output.algorithm !== "sha256") throw new CamelError("state_conflict", "Digest conversion algorithm is invalid.");
 }
-function requireBoolean(value) {
-  if (typeof value !== "boolean") throw new CamelError("conversion_rejected", "Boolean conversion requires a structured boolean.");
-  return value;
+function requireBoolean(value2) {
+  if (typeof value2 !== "boolean") throw new CamelError("conversion_rejected", "Boolean conversion requires a structured boolean.");
+  return value2;
 }
-function boundedInteger(value, spec) {
-  if (spec.kind !== "integer" || typeof value !== "number" || !Number.isSafeInteger(value) || value < spec.minimum || value > spec.maximum) throw new CamelError("conversion_rejected", "Integer conversion rejected the structured value.");
-  return value;
+function boundedInteger(value2, spec) {
+  if (spec.kind !== "integer" || typeof value2 !== "number" || !Number.isSafeInteger(value2) || value2 < spec.minimum || value2 > spec.maximum) throw new CamelError("conversion_rejected", "Integer conversion rejected the structured value.");
+  return value2;
 }
-function boundedNumber(value, spec) {
-  if (spec.kind !== "finite_number" || typeof value !== "number" || !Number.isFinite(value) || value < spec.minimum || value > spec.maximum) throw new CamelError("conversion_rejected", "Finite-number conversion rejected the structured value.");
-  const text = String(value);
+function boundedNumber(value2, spec) {
+  if (spec.kind !== "finite_number" || typeof value2 !== "number" || !Number.isFinite(value2) || value2 < spec.minimum || value2 > spec.maximum) throw new CamelError("conversion_rejected", "Finite-number conversion rejected the structured value.");
+  const text = String(value2);
   if (/e/i.test(text) || (text.split(".")[1]?.length ?? 0) > spec.maximumDecimalPlaces) throw new CamelError("conversion_rejected", "Finite-number conversion rejected a non-canonical decimal.");
-  return value;
+  return value2;
 }
-function enumMember(value, spec) {
-  if (spec.kind !== "enum" || typeof value !== "string") throw new CamelError("conversion_rejected", "Enum conversion requires a structured string member.");
-  const member = spec.caseSensitive ? spec.values.find((item) => item === value) : spec.values.find((item) => item.toLocaleLowerCase("en-US") === value.toLocaleLowerCase("en-US"));
+function enumMember(value2, spec) {
+  if (spec.kind !== "enum" || typeof value2 !== "string") throw new CamelError("conversion_rejected", "Enum conversion requires a structured string member.");
+  const member = spec.caseSensitive ? spec.values.find((item) => item === value2) : spec.values.find((item) => item.toLocaleLowerCase("en-US") === value2.toLocaleLowerCase("en-US"));
   if (member === void 0) throw new CamelError("conversion_rejected", "Enum conversion rejected a non-member.");
   return member;
 }
-function canonicalDate(value, spec) {
-  if (spec.kind !== "date" || typeof value !== "string") throw new CamelError("conversion_rejected", "Date conversion requires a canonical structured string.");
+function canonicalDate(value2, spec) {
+  if (spec.kind !== "date" || typeof value2 !== "string") throw new CamelError("conversion_rejected", "Date conversion requires a canonical structured string.");
   const pattern = spec.format === "date" ? /^\d{4}-\d{2}-\d{2}$/ : /^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}(?:\.\d{1,3})?(?:Z|[+-]\d{2}:\d{2})$/;
-  const instant = Date.parse(spec.format === "date" ? `${value}T00:00:00Z` : value);
-  if (!pattern.test(value) || !Number.isFinite(instant) || spec.format === "date" && new Date(instant).toISOString().slice(0, 10) !== value) throw new CamelError("conversion_rejected", "Date conversion rejected a non-canonical value.");
-  if (spec.earliest && value < spec.earliest || spec.latest && value > spec.latest) throw new CamelError("conversion_rejected", "Date conversion rejected an out-of-range value.");
-  return value;
-}
-function measure(value, metric) {
-  if (metric === "byte_length" && (typeof value === "string" || value instanceof Uint8Array)) return utf8Length(value);
-  if (metric === "codepoint_length" && typeof value === "string") return [...value].length;
-  if (metric === "item_count" && Array.isArray(value)) return value.length;
+  const instant = Date.parse(spec.format === "date" ? `${value2}T00:00:00Z` : value2);
+  if (!pattern.test(value2) || !Number.isFinite(instant) || spec.format === "date" && new Date(instant).toISOString().slice(0, 10) !== value2) throw new CamelError("conversion_rejected", "Date conversion rejected a non-canonical value.");
+  if (spec.earliest && value2 < spec.earliest || spec.latest && value2 > spec.latest) throw new CamelError("conversion_rejected", "Date conversion rejected an out-of-range value.");
+  return value2;
+}
+function measure(value2, metric) {
+  if (metric === "byte_length" && (typeof value2 === "string" || value2 instanceof Uint8Array)) return utf8Length(value2);
+  if (metric === "codepoint_length" && typeof value2 === "string") return [...value2].length;
+  if (metric === "item_count" && Array.isArray(value2)) return value2.length;
   throw new CamelError("conversion_rejected", "Measurement input does not match the registered metric.");
 }
-function evaluatePredicate(value, predicate, registries) {
-  if (predicate.kind === "has_fields") return typeof value === "object" && value !== null && !Array.isArray(value) && predicate.fields.every((field) => Object.hasOwn(value, field));
-  if (predicate.kind === "registered_id") return typeof value === "string" && registries?.[predicate.registryId]?.values[value] !== void 0;
-  const actual = value === null ? "null" : Array.isArray(value) ? "array" : typeof value;
+function evaluatePredicate(value2, predicate, registries) {
+  if (predicate.kind === "has_fields") return typeof value2 === "object" && value2 !== null && !Array.isArray(value2) && predicate.fields.every((field) => Object.hasOwn(value2, field));
+  if (predicate.kind === "registered_id") return typeof value2 === "string" && registries?.[predicate.registryId]?.values[value2] !== void 0;
+  const actual = value2 === null ? "null" : Array.isArray(value2) ? "array" : typeof value2;
   return actual === predicate.valueType;
 }
 function sourceIdentity(source) {
@@ -5004,17 +5558,17 @@ function createCamelIngress(constants2 = []) {
     byId.set(item.id, item);
   }
   const ingress = {
-    userInstruction: (value, input) => createSafeInternal(value, "user_instruction", metadata("user_instruction", input.id, input.readers)),
-    systemPolicy: (value, input) => createSafeInternal(value, "system_policy", metadata("system_policy", input.id, input.readers)),
+    userInstruction: (value2, input) => createSafeInternal(value2, "user_instruction", metadata("user_instruction", input.id, input.readers)),
+    systemPolicy: (value2, input) => createSafeInternal(value2, "system_policy", metadata("system_policy", input.id, input.readers)),
     control: (id) => {
       const item = byId.get(id);
       if (!item) throw new CamelError("permission_denied", "Unknown control constant.");
       return createSafeInternal(item.value, "harness_constant", metadata("harness", id, item.readers));
     },
-    external: (value, label) => createUnsafeInternal(value, label),
-    quarantinedOutput: (value, input) => {
+    external: (value2, label) => createUnsafeInternal(value2, label),
+    quarantinedOutput: (value2, input) => {
       if (!input.runId) throw new CamelError("state_conflict", "Quarantined run IDs must be non-empty.");
-      return createUnsafeInternal(value, {
+      return createUnsafeInternal(value2, {
         readers: input.readers,
         dependencies: input.dependencies,
         provenance: [{ kind: "quarantined_llm", id: input.runId, digest: input.digest }]
@@ -5023,15 +5577,15 @@ function createCamelIngress(constants2 = []) {
   };
   return Object.freeze(ingress);
 }
-function assertNoUnsafeConstant(value, seen = /* @__PURE__ */ new WeakSet()) {
-  if (typeof value !== "object" || value === null || seen.has(value)) return;
-  seen.add(value);
-  if (isCamelValue(value)) {
-    if (isUnsafe(value)) throw new CamelError("unsafe_privileged_flow", "Control constants cannot contain Prompt-Unsafe values.");
-    assertNoUnsafeConstant(value.value, seen);
+function assertNoUnsafeConstant(value2, seen = /* @__PURE__ */ new WeakSet()) {
+  if (typeof value2 !== "object" || value2 === null || seen.has(value2)) return;
+  seen.add(value2);
+  if (isCamelValue(value2)) {
+    if (isUnsafe(value2)) throw new CamelError("unsafe_privileged_flow", "Control constants cannot contain Prompt-Unsafe values.");
+    assertNoUnsafeConstant(value2.value, seen);
     return;
   }
-  for (const child of Object.values(value)) assertNoUnsafeConstant(child, seen);
+  for (const child of Object.values(value2)) assertNoUnsafeConstant(child, seen);
 }
 function metadata(kind, id, readers) {
   if (!id) throw new CamelError("state_conflict", "Provenance IDs must be non-empty.");
@@ -5045,10 +5599,10 @@ function createEffectPolicy(config = {}) {
   return Object.freeze({ evaluate: (input) => evaluate(input, registries, approvalEffects) });
 }
 function destinationRegistryDigest(values) {
-  return sha256Hex(canonicalJson([...values].sort()));
+  return sha256Hex(canonicalJson2([...values].sort()));
 }
 async function evaluate(input, registries, approvals) {
-  const actionDigest = await sha256Hex(canonicalJson(input));
+  const actionDigest = await sha256Hex(canonicalJson2(input));
   const decisionId = `decision_${actionDigest.slice(0, 24)}`;
   const deny = (reasonCode) => ({ outcome: "deny", decisionId, reasonCode });
   if (!input.planId || !input.tool.name || !input.tool.policyId || !Number.isSafeInteger(input.tool.version)) return deny("invalid_descriptor");
@@ -5062,7 +5616,7 @@ async function evaluate(input, registries, approvals) {
     if (invalid3) return deny(invalid3);
     if (arg.role === "selector" && !isSafe(arg.value)) confined.add(arg.value);
   }
-  if (input.controlDependencies.some((value) => !isSafe(value) && !confined.has(value))) return deny("unsafe_control_dependency");
+  if (input.controlDependencies.some((value2) => !isSafe(value2) && !confined.has(value2))) return deny("unsafe_control_dependency");
   if (confined.size > 0) {
     const fixed = input.tool.unsafeSelectorPolicy?.fixedProviderIds ?? [];
     const destinations = Object.values(input.args).filter((arg) => arg.role === "destination");
@@ -5089,29 +5643,29 @@ async function validateArgument(path, arg, tool, registries) {
     if (!isSafe(arg.value)) return "unsafe_destination_argument";
     if (!isControlOwned(arg.value)) return "destination_not_control_owned";
     const registry = registries[arg.registryId];
-    const validValues = registry && registry.values.length > 0 && registry.values.every((value) => typeof value === "string" && value.length > 0) && new Set(registry.values).size === registry.values.length;
+    const validValues = registry && registry.values.length > 0 && registry.values.every((value2) => typeof value2 === "string" && value2.length > 0) && new Set(registry.values).size === registry.values.length;
     if (!registry || !validValues || registry.digest !== arg.registryDigest || await destinationRegistryDigest(registry.values) !== registry.digest || !registry.values.includes(arg.value.value)) return "destination_not_registered";
   }
   if (arg.role === "selector" && !isSafe(arg.value)) return validateUnsafeSelector(path, arg.value, tool);
   return void 0;
 }
-function isControlOwned(value) {
-  return value.label.safeBasis === "system_policy" || value.label.safeBasis === "harness_constant";
+function isControlOwned(value2) {
+  return value2.label.safeBasis === "system_policy" || value2.label.safeBasis === "harness_constant";
 }
 function copyRegistries(registries) {
   return Object.freeze(Object.fromEntries(Object.entries(registries).map(([id, registry]) => [id, Object.freeze({ digest: registry.digest, values: Object.freeze([...registry.values]) })])));
 }
-function validateUnsafeSelector(path, value, tool) {
+function validateUnsafeSelector(path, value2, tool) {
   const policy = tool.unsafeSelectorPolicy;
   if (!policy || policy.effect !== tool.effect || !policy.selectorPaths.includes(path)) return "unsafe_selector_not_confined";
   if (!policy.fixedDestination || !policy.unsafeOutput || policy.fixedProviderIds.length === 0) return "unsafe_selector_not_confined";
   if (![policy.maximumCalls, policy.maximumResultsPerCall, policy.maximumOutputBytes, policy.maximumSelectorBytes].every((bound) => Number.isSafeInteger(bound) && bound > 0)) return "unsafe_selector_not_confined";
-  if (utf8Length(value.value) > policy.maximumSelectorBytes) return "unsafe_selector_too_large";
-  if (typeof value.value === "string" && looksLikeDestination(value.value)) return "unsafe_selector_is_destination";
+  if (utf8Length(value2.value) > policy.maximumSelectorBytes) return "unsafe_selector_too_large";
+  if (typeof value2.value === "string" && looksLikeDestination(value2.value)) return "unsafe_selector_is_destination";
   return void 0;
 }
-function looksLikeDestination(value) {
-  const text = value.trim();
+function looksLikeDestination(value2) {
+  const text = value2.trim();
   return /^(?:[a-z][a-z0-9+.-]*:\/\/|\/|\\\\)/i.test(text) || /^[\w.-]+\.[a-z]{2,}(?:[/:]|$)/i.test(text);
 }
 
@@ -5197,9 +5751,9 @@ var CodeRuntimeReconciler = class {
     }
   }
 };
-function retryableControlFailure(value) {
-  if (!value || typeof value !== "object") return false;
-  const failure = value;
+function retryableControlFailure(value2) {
+  if (!value2 || typeof value2 !== "object") return false;
+  const failure = value2;
   if (failure.code === "invalid_response" || typeof failure.status !== "number") return false;
   return failure.status === 408 || failure.status === 425 || failure.status === 429 || failure.status >= 500;
 }
@@ -5251,16 +5805,16 @@ function createCodeRuntimeControlClient(options) {
       if (options.signal?.aborted) throw cause;
       throw new CodeRuntimeControlError("Code runtime control plane is unavailable", 503, "transport_unavailable");
     }
-    const value = await response2.json().catch(() => null);
+    const value2 = await response2.json().catch(() => null);
     if (!response2.ok) {
-      const problem = record3(record3(value)?.error);
+      const problem = record3(record3(value2)?.error);
       throw new CodeRuntimeControlError(
         typeof problem?.message === "string" ? problem.message : `Code runtime request failed (${response2.status})`,
         response2.status,
         typeof problem?.code === "string" ? problem.code : void 0
       );
     }
-    return value;
+    return value2;
   };
   return {
     heartbeat: async (version, capabilities) => {
@@ -5275,15 +5829,15 @@ function createCodeRuntimeControlClient(options) {
       await call2(`/registry/code/runtime/sessions/${validSessionId(sessionId)}/source`, {})
     ),
     infer: async (sessionId, inference) => {
-      const value = record3(await call2(
+      const value2 = record3(await call2(
         `/registry/code/runtime/sessions/${validSessionId(sessionId)}/inference`,
         inference,
         modelRequestTimeoutMs
       ));
-      if (!value || value.requestId !== inference.requestId || !record3(value.response) || !record3(value.receipt)) {
+      if (!value2 || value2.requestId !== inference.requestId || !record3(value2.response) || !record3(value2.receipt)) {
         throw new CodeRuntimeControlError("invalid Code inference response", 502, "invalid_response");
       }
-      return value;
+      return value2;
     },
     review: async (sessionId, review) => parseReview(
       await call2(`/registry/code/runtime/sessions/${validSessionId(sessionId)}/review`, review, modelRequestTimeoutMs)
@@ -5308,8 +5862,8 @@ function createCodeRuntimeControlClient(options) {
     }
   };
 }
-function validatedEndpoint(value) {
-  const endpoint = value.replace(/\/+$/, "");
+function validatedEndpoint(value2) {
+  const endpoint = value2.replace(/\/+$/, "");
   let url;
   try {
     url = new URL(endpoint);
@@ -5322,9 +5876,9 @@ function validatedEndpoint(value) {
   }
   return endpoint;
 }
-function validSessionId(value) {
-  if (!/^csess_[0-9a-f]{32}$/.test(value)) throw new TypeError("invalid Code session id");
-  return value;
+function validSessionId(value2) {
+  if (!/^csess_[0-9a-f]{32}$/.test(value2)) throw new TypeError("invalid Code session id");
+  return value2;
 }
 function validateHeartbeat(version, capabilities) {
   if (!version.trim() || version.length > 80) throw new TypeError("runtimeVersion is required and at most 80 characters");
@@ -5337,8 +5891,8 @@ function validateHeartbeat(version, capabilities) {
     throw new TypeError("runtime resources must be positive integers");
   }
 }
-function parseSnapshot(value) {
-  const root = record3(value);
+function parseSnapshot(value2) {
+  const root = record3(value2);
   const host = record3(root?.host);
   if (!host || typeof host.hostId !== "string" || typeof host.runtimeVersion !== "string" || !Number.isSafeInteger(host.lastSeenAt) || host.revokedAt !== null || !Array.isArray(root?.bindings) || root.bindings.length > 1024 || !Array.isArray(root?.commands) || root.commands.length > 64) throw invalid("heartbeat");
   const bindingIds = /* @__PURE__ */ new Set();
@@ -5363,11 +5917,11 @@ function parseSnapshot(value) {
   });
   return { host, bindings, commands };
 }
-async function parseSource(value) {
-  const snapshot = record3(record3(value)?.snapshot);
+async function parseSource(value2) {
+  const snapshot = record3(record3(value2)?.snapshot);
   if (!snapshot || typeof snapshot.repository !== "string" || typeof snapshot.commitSha !== "string" || typeof snapshot.treeDigest !== "string" || !Array.isArray(snapshot.files)) throw invalid("source");
-  const files = snapshot.files.map((value2) => {
-    const file = record3(value2);
+  const files = snapshot.files.map((value22) => {
+    const file = record3(value22);
     if (!file || typeof file.path !== "string" || typeof file.content !== "string") throw invalid("source file");
     return { path: file.path, content: file.content };
   });
@@ -5394,19 +5948,19 @@ async function parseSource(value) {
   if (digest !== snapshot.treeDigest) throw invalid("source digest");
   return { ...source, treeDigest: digest, ...references.length ? { references } : {} };
 }
-function parseReview(value) {
-  const review = record3(record3(value)?.review);
+function parseReview(value2) {
+  const review = record3(record3(value2)?.review);
   if (!review || !["approved", "rejected"].includes(String(review.verdict)) || typeof review.reviewDigest !== "string" || !/^sha256:[0-9a-f]{64}$/.test(review.reviewDigest) || typeof review.provider !== "string" || !review.provider || typeof review.model !== "string" || !review.model || !Number.isSafeInteger(review.policyVersion) || Number(review.policyVersion) < 1) throw invalid("review");
   return review;
 }
-function parseCandidate(value) {
-  const candidate = record3(record3(value)?.candidate);
+function parseCandidate(value2) {
+  const candidate = record3(record3(value2)?.candidate);
   if (!candidate || typeof candidate.candidateId !== "string" || !/^ccand_[0-9a-f]{32}$/.test(candidate.candidateId) || !["submitted", "approved", "published", "failed"].includes(String(candidate.status))) {
     throw invalid("candidate");
   }
   return { candidateId: candidate.candidateId, status: candidate.status };
 }
-var record3 = (value) => value && typeof value === "object" && !Array.isArray(value) ? value : null;
+var record3 = (value2) => value2 && typeof value2 === "object" && !Array.isArray(value2) ? value2 : null;
 var invalid = (part) => new CodeRuntimeControlError(`invalid Code runtime ${part} response`, 502, "invalid_response");
 var RESERVED = /* @__PURE__ */ new Set([".git", ".odla", ".wrangler", "node_modules", "dist", "coverage"]);
 var SECRET = /^(?:\.env(?:\..+)?|\.dev\.vars|credentials(?:\..+)?\.json|dev-token(?:\..+)?\.json)$/i;
@@ -5440,8 +5994,8 @@ function validateCodePatch(patch2, maxBytes) {
   if (!paths.length || new Set(paths).size !== paths.length) throw new TypeError("patch has no diffs or repeats a path");
   return paths;
 }
-function validHeaderPath(value, path, prefix) {
-  return value === "/dev/null" || value === `${prefix}/${path}`;
+function validHeaderPath(value2, path, prefix) {
+  return value2 === "/dev/null" || value2 === `${prefix}/${path}`;
 }
 function validateRelativePath(path) {
   const parts = path.split("/");
@@ -5587,8 +6141,8 @@ function assertCodeBuildRecipe(recipe2) {
     throw new TypeError("build recipe is malformed or exceeds its control bounds");
   }
 }
-function parseMemory(value) {
-  const match = /^([1-9][0-9]{0,4})([kmg])$/.exec(value.toLowerCase());
+function parseMemory(value2) {
+  const match = /^([1-9][0-9]{0,4})([kmg])$/.exec(value2.toLowerCase());
   if (!match?.[1] || !match[2]) return 0;
   const scale = match[2] === "k" ? 1024 : match[2] === "m" ? 1024 ** 2 : 1024 ** 3;
   return Number(match[1]) * scale;
@@ -5823,14 +6377,14 @@ function normalizedRecipe(recipe2) {
     expectedArtifacts: [...recipe2.expectedArtifacts ?? []].sort((left, right) => left.id.localeCompare(right.id)).map((artifact) => ({ id: artifact.id, path: artifact.path, maximumBytes: artifact.maximumBytes }))
   };
 }
-function digestJson(value) {
-  return digestBytes(JSON.stringify(value));
+function digestJson(value2) {
+  return digestBytes(JSON.stringify(value2));
 }
-function digestBytes(value) {
-  return `sha256:${(0, import_crypto3.createHash)("sha256").update(value).digest("hex")}`;
+function digestBytes(value2) {
+  return `sha256:${(0, import_crypto3.createHash)("sha256").update(value2).digest("hex")}`;
 }
-function integer(value, minimum, maximum) {
-  return Number.isSafeInteger(value) && value >= minimum && value <= maximum;
+function integer(value2, minimum, maximum) {
+  return Number.isSafeInteger(value2) && value2 >= minimum && value2 <= maximum;
 }
 async function prepareRuntimeCheckpoint(input) {
   const patch2 = await input.workspace.patch(256 * 1024);
@@ -5883,7 +6437,7 @@ async function prepareRuntimeCheckpoint(input) {
   });
   return { checkpoint, verification, review, note };
 }
-var message = (value) => (value instanceof Error ? value.message : String(value)).slice(0, 500);
+var message = (value2) => (value2 instanceof Error ? value2.message : String(value2)).slice(0, 500);
 var CodeRuntimeCheckpointManager = class {
   constructor(options) {
     this.options = options;
@@ -6077,7 +6631,7 @@ async function conversionPolicy(id, output) {
   return { ...definition, digest: await conversionPolicyDigest(definition) };
 }
 async function registeredPolicy(id, registryId, values) {
-  const mapping = Object.fromEntries(values.map((value) => [value, value]));
+  const mapping = Object.fromEntries(values.map((value2) => [value2, value2]));
   return conversionPolicy(id, {
     kind: "registered_id",
     registryId,
@@ -6086,7 +6640,7 @@ async function registeredPolicy(id, registryId, values) {
 }
 async function conversionRegistry(policies, values) {
   const registeredIds = Object.fromEntries(await Promise.all(Object.entries(values).map(async ([id, entries]) => {
-    const mapping = Object.fromEntries(entries.map((value) => [value, value]));
+    const mapping = Object.fromEntries(entries.map((value2) => [value2, value2]));
     return [id, { values: mapping, digest: await registeredIdRegistryDigest(mapping) }];
   })));
   return createConversionRegistry({ policies, registeredIds });
@@ -6110,8 +6664,8 @@ async function environment(input, options, tool) {
   };
   return { ingress, policy, fixedArgs, reader: ingress.control("reader"), runId: `${input.request.requestId}:${tool}` };
 }
-function unsafe(base, value, field) {
-  return base.ingress.quarantinedOutput(value, {
+function unsafe(base, value2, field) {
+  return base.ingress.quarantinedOutput(value2, {
     readers: base.reader.label.readers,
     runId: `${base.runId}:${field}`
   });
@@ -6191,14 +6745,14 @@ async function read(context, request2, options, policy) {
 }
 async function patch(context, request2, options, policy) {
   exactKeys(request2.input, ["patch"]);
-  const value = stringField(request2.input, "patch");
-  const paths = validateCodePatch(value, options.maxPatchBytes ?? 256 * 1024);
+  const value2 = stringField(request2.input, "patch");
+  const paths = validateCodePatch(value2, options.maxPatchBytes ?? 256 * 1024);
   if (paths.some((path) => options.readOnlyPrefixes?.some((prefix) => path === prefix || path.startsWith(`${prefix}/`)))) {
     throw new TypeError("patch targets a read-only reference source");
   }
-  const allowed = await policy.patch(policyContext(context, request2, options, { patch: value }));
+  const allowed = await policy.patch(policyContext(context, request2, options, { patch: value2 }));
   if (!allowed) return response(request2, false, "tool denied by CaMeL policy");
-  await applyCodePatch(context.workspaceDir, value, paths);
+  await applyCodePatch(context.workspaceDir, value2, paths);
   return response(request2, true, `Applied patch to ${paths.length} file(s).`, { paths });
 }
 async function recipe(context, request2, options, recipes, policy) {
@@ -6289,14 +6843,14 @@ function exactKeys(input, allowed) {
   if (Object.keys(input).some((key) => !allowed.includes(key))) throw new TypeError("tool input contains an unsupported field");
 }
 function stringField(input, name) {
-  const value = input[name];
-  if (typeof value !== "string" || !value) throw new TypeError(`${name} must be a non-empty string`);
-  return value;
+  const value2 = input[name];
+  if (typeof value2 !== "string" || !value2) throw new TypeError(`${name} must be a non-empty string`);
+  return value2;
 }
-function optionalInteger(value) {
-  if (value === void 0) return void 0;
-  if (!Number.isSafeInteger(value) || value < 1) throw new TypeError("line bounds must be positive integers");
-  return value;
+function optionalInteger(value2) {
+  if (value2 === void 0) return void 0;
+  if (!Number.isSafeInteger(value2) || value2 < 1) throw new TypeError("line bounds must be positive integers");
+  return value2;
 }
 function response(request2, ok, content2, details) {
   return { requestId: request2.requestId, ok, content: content2, ...details ? { details } : {} };
@@ -6342,9 +6896,9 @@ function codeLocalSource(payload) {
   return source;
 }
 function codeCheckpointPayload(payload) {
-  const value = payload.checkpoint;
-  if (!value || typeof value !== "object" || Array.isArray(value)) throw new TypeError("resume checkpoint is missing");
-  return value;
+  const value2 = payload.checkpoint;
+  if (!value2 || typeof value2 !== "object" || Array.isArray(value2)) throw new TypeError("resume checkpoint is missing");
+  return value2;
 }
 function fakeCodeLease(command, metadata2) {
   return {
@@ -6368,7 +6922,7 @@ function fakeCodeLease(command, metadata2) {
     }
   };
 }
-var record22 = (value) => value && typeof value === "object" && !Array.isArray(value) ? value : null;
+var record22 = (value2) => value2 && typeof value2 === "object" && !Array.isArray(value2) ? value2 : null;
 var SOURCE_LIMITS = { maxFiles: 2e4, maxBytes: 512 * 1024 * 1024 };
 async function prepareRuntimeLocalSource(input) {
   const { command, descriptor: descriptor2, available, repository, baseCommitSha, resume } = input;
@@ -6458,24 +7012,24 @@ async function appendCodeRuntimeEvent(control, command, event, refs) {
   const bounded = event.type === "message" ? { ...event, body: event.body.trim().slice(0, 2e4) || `${event.actor} event` } : event;
   await control.appendSessionEvent(command.sessionId, eventId, bounded);
 }
-var digestRuntimeValue = (value) => `sha256:${(0, import_crypto4.createHash)("sha256").update(value).digest("hex")}`;
-var runtimeErrorMessage = (value) => value instanceof Error ? value.message : String(value);
-var runtimeRecord = (value) => value && typeof value === "object" && !Array.isArray(value) ? value : null;
-var safeRuntimeJson = (value) => {
+var digestRuntimeValue = (value2) => `sha256:${(0, import_crypto4.createHash)("sha256").update(value2).digest("hex")}`;
+var runtimeErrorMessage = (value2) => value2 instanceof Error ? value2.message : String(value2);
+var runtimeRecord = (value2) => value2 && typeof value2 === "object" && !Array.isArray(value2) ? value2 : null;
+var safeRuntimeJson = (value2) => {
   try {
-    return JSON.stringify(value).slice(0, 1e4);
+    return JSON.stringify(value2).slice(0, 1e4);
   } catch {
     return "[event]";
   }
 };
-function runtimeResultText(value) {
-  const record32 = runtimeRecord(value);
+function runtimeResultText(value2) {
+  const record32 = runtimeRecord(value2);
   if (record32 && typeof record32.text === "string") return record32.text.slice(0, 2e4);
   if (record32 && typeof record32.error === "string") return `Pi failed: ${record32.error.slice(0, 19989)}`;
   return null;
 }
-function runtimeResultError(value) {
-  const record32 = runtimeRecord(value);
+function runtimeResultError(value2) {
+  const record32 = runtimeRecord(value2);
   return record32 && typeof record32.error === "string" && record32.error.trim() ? record32.error.trim().slice(0, 2e3) : null;
 }
 var CodePiRuntimeEngine = class {
@@ -6749,14 +7303,14 @@ var CodePiRuntimeEngine = class {
     this.#active.delete(command.sessionId);
     return result;
   }
-  async #failure(command, active, value) {
-    active.failure = value.slice(0, 2e3);
+  async #failure(command, active, value2) {
+    active.failure = value2.slice(0, 2e3);
     if (active.acknowledged) {
       await this.options.control.reportSessionFailure(command.sessionId, active.failure).catch(() => void 0);
     }
   }
-  async #diagnostic(command, active, value) {
-    const detail = value.trim().slice(0, 2e3) || "Pi runtime failed";
+  async #diagnostic(command, active, value2) {
+    const detail = value2.trim().slice(0, 2e3) || "Pi runtime failed";
     this.options.onDiagnostic?.(detail);
     await this.#event(
       command,
@@ -6769,265 +7323,19 @@ var CodePiRuntimeEngine = class {
   }
 };
 
-// src/help.ts
+// src/version.ts
 var import_node_fs13 = require("fs");
 function cliVersion() {
   const pkg = JSON.parse((0, import_node_fs13.readFileSync)(new URL("../package.json", importMetaUrl), "utf8"));
   return pkg.version ?? "unknown";
 }
-function printHelp(output = console) {
-  output.log(`odla-ai
 
-Start here:
-  odla-ai runbook ask "<question>"   The current procedure, from odla's own
-                                     runbooks. Ask BEFORE searching the web or
-                                     working from memory: runbooks are edited
-                                     live, so your training data is out of date
-                                     and this is not.
-  odla-ai runbook impact             After a change: which runbooks describe the
-                                     code you just touched, so you can fix any
-                                     step it made wrong.
-
-Usage:
-  odla-ai setup [--dir <project>] [--agent <name>] [--global] [--force]
-  odla-ai init --app-id <id> --name <name> [--services db,ai,o11y,calendar] [--env dev --env prod]
-  odla-ai doctor [--config odla.config.mjs]
-  odla-ai calendar status [--env dev] [--email <odla-account>] [--json]
-  odla-ai calendar calendars [--env dev] [--email <odla-account>] [--json]
-  odla-ai calendar connect [--env dev] [--email <odla-account>] [--no-open] [--yes]
-  odla-ai calendar disconnect [--env dev] [--email <odla-account>] --yes
-  odla-ai app archive [--config odla.config.mjs] [--email <odla-account>] [--json] --yes
-  odla-ai app restore [--config odla.config.mjs] [--email <odla-account>] [--json]
-  odla-ai app export [--env dev] [--fresh] [--out <file>] [--email <odla-account>] [--json]
-  odla-ai app import <file|-> [--env dev] [--ns <namespace>] [--id-field <f>|--key <attr>|--generate-ids] [--dry-run] [--json] --yes
-  odla-ai app refresh-sandbox [--include-identity] [--include-files] [--dry-run] [--json] --yes
-  odla-ai app go-live         [--include-identity] [--include-files] [--dry-run] [--json] --yes
-  odla-ai app promote         [--dry-run] [--json] --yes
-  odla-ai app rename <name> [--config odla.config.mjs] [--email <odla-account>] [--json]
-  odla-ai app owners list [--config odla.config.mjs] [--email <odla-account>] [--json]
-  odla-ai app owners add <email> [--email <odla-account>] [--json]
-  odla-ai app owners remove <email> [--email <odla-account>] [--json]
-  odla-ai pm goal list [--app <id>] [--status <s>] [--q <text>] [--limit <n>] [--offset <n>] [--json]
-  odla-ai pm task list [--app <id>] [--column <c>] [--goal <id>] [--assignee <id>] [--q <text>] [--limit <n>] [--offset <n>] [--json]
-  odla-ai pm decision list [--app <id>] [--status <s>] [--q <text>] [--limit <n>] [--offset <n>] [--json]
-  odla-ai pm bug list [--app <id>] [--status <s>] [--severity <s>] [--goal <id>] [--assignee <id>] [--decision <id>] [--q <text>] [--limit <n>] [--offset <n>] [--json]
-  odla-ai pm goal add --app <id> --title <t> [--status <s>] [--proof <text>] [--target <pct>] [--mutation-id <id>] [--json]
-  odla-ai pm task add --app <id> --title <t> [--column <c>] [--goal <id>] [--assignee <id>] [--description <text>|--body <text>] [--due <epoch-ms>] [--mutation-id <id>] [--json]
-  odla-ai pm decision add --app <id> --title <t> --body <text> [--status <s>] [--mutation-id <id>] [--json]
-  odla-ai pm bug add --app <id> --title <t> (--description <text>|--body <text>) [--status <s>] [--severity <s>] [--goal <id>] [--assignee <id>] [--decision <id>] [--mutation-id <id>] [--json]
-  odla-ai pm <goal|task|decision|bug> get <id> [--json]
-  odla-ai pm goal set <id> [--title <t>|--status <s>|--proof <text>|--no-proof|--target <pct>|--no-target] [--mutation-id <id>] [--json]
-  odla-ai pm task set <id> [--title <t>|--column <c>|--rank <n>|--goal <id>|--no-goal|--assignee <id>|--no-assignee|--description <text>|--body <text>|--due <epoch-ms>|--no-due] [--mutation-id <id>] [--json]
-  odla-ai pm decision set <id> [--title <t>|--status <s>|--body <text>] [--mutation-id <id>] [--json]
-  odla-ai pm bug set <id> [--title <t>|--status <s>|--severity <s>|--goal <id>|--no-goal|--assignee <id>|--no-assignee|--decision <id>|--no-decision|--description <text>|--body <text>] [--mutation-id <id>] [--json]
-  odla-ai pm <goal|task|decision> done <id> [--mutation-id <id>]
-  odla-ai pm bug done <id> [--decision <accepted-decision-id>] [--mutation-id <id>]
-  odla-ai pm <goal|task|decision|bug> comment <id> --body "..." [--mutation-id <id>]
-  odla-ai pm <goal|task|decision|bug> comments <id> [--json]
-  odla-ai pm <goal|task|decision|bug> rm <id>
-  odla-ai pm handoff --app <id> [--json]
-  odla-ai discuss groups [--json]
-  odla-ai discuss list [--app <id>] [--q <text>] [--state open|resolved|all] [--json]
-  odla-ai discuss read <topic> [--limit <n> --offset <n>] [--json]
-  odla-ai discuss post --app <id> --subject "..." --body "..." [--markup "... @[Label](kind/id)"] [--mutation-id <id>]
-  odla-ai discuss reply <topic> --body "..." [--markup "..."] [--mutation-id <id>]
-  odla-ai discuss resolve <topic> [--reopen] [--mutation-id <id>]
-  odla-ai discuss who --q <text> [--app <id>] [--kinds user,pm:task] [--json]
-  odla-ai discuss watch [<topic>] [--cursor <cursor>] [--by <authorId>] [--self <authorId>] [--interval <s>] [--timeout <s>] [--json|--jsonl]
-  odla-ai agent jobs [--env dev] [--state pending|running|succeeded|dead_letter] [--limit 50] [--email <email>] [--json]
-  odla-ai agent retry <job-id> [--env dev] [--email <email>] [--json]
-  odla-ai context show [--context <name>] [--platform https://odla.ai] [--app <id>] [--env prod] [--json]
-  odla-ai context list [--json]
-  odla-ai context save <name> [--platform <url>] [--app <id>] [--env <name>] [--json]
-  odla-ai context remove <name> --yes [--json]
-  odla-ai o11y status [--app <id>] [--context <name>] [--platform https://odla.ai] [--env prod] [--minutes 60] [--json]
-  odla-ai whoami [--context <name>] [--platform https://odla.ai] [--json]
-  odla-ai runbook ask "<question>" [--app <id>] [--all] [--json]
-  odla-ai runbook search "<question>" [--app <id>] [--all] [--limit <n>] [--json]
-  odla-ai runbook impact [--base origin/main] [--app <id>] [--all] [--limit <n>] [--json]
-  odla-ai runbook lint [--app <id>] [--all] [--json]
-  odla-ai runbook list [--app <id>] [--all] [--q <text>] [--json]
-  odla-ai runbook comment <slug> --body "..." [--app <id>]
-  odla-ai runbook get <slug> [--app <id>]
-  odla-ai runbook new <slug> --title <t> --file <path|-> [--summary <s>] [--requires <specs>] [--app <id>]
-  odla-ai runbook edit <slug> [--file <path|->|--body "..."] [--note <why>] [--requires <specs>] [--app <id>]
-  odla-ai runbook import <dir> [--visibility operator|admin] [--dry-run] [--app <id>]
-  odla-ai runbook publish <slug> [--app <id>]
-  odla-ai runbook visibility <slug> <operator|admin> [--app <id>]
-  odla-ai runbook archive <slug> [--app <id>]
-  odla-ai runbook history <slug> [--app <id>] [--json]
-  odla-ai runbook revert <slug> --version <n> [--app <id>]
-  odla-ai runbook rm <slug> [--app <id>]
-  odla-ai capabilities [--json]
-  odla-ai code connect [--env dev|prod] [--email <odla-account>] [--engine auto|container|podman|docker] [--slots <1-64>] [--once]
-  odla-ai admin ai show [--context <name>] [--platform https://odla.ai] [--email <odla-account>] [--json]
-  odla-ai admin ai models [--context <name>] [--provider <id>] [--json]
-  odla-ai admin ai set <purpose> [--context <name>] [--provider <id>] [--model <id>] [--enabled|--no-enabled]
-    [--max-input-bytes <n>] [--max-output-tokens <n>] [--max-calls-per-run <n>] [--json]
-  odla-ai admin ai set security [--context <name>] --discovery-provider <id> --discovery-model <id>
-    --validation-provider <id> --validation-model <id> [--enabled|--no-enabled] [--json]
-  odla-ai admin ai credentials [--context <name>] [--json]
-  odla-ai admin ai credential set <provider> [--context <name>] (--from-env <NAME>|--stdin)
-  odla-ai admin ai usage [--context <name>] [--app-id <id>] [--env <env>] [--run-id <id>] [--limit <1-500>] [--json]
-  odla-ai admin ai audit [--context <name>] [--limit <1-200>] [--json]
-  odla-ai security github connect [--repo owner/name] [--env dev] [--email <odla-account>] [--no-open]
-  odla-ai security github disconnect --source <id> [--env dev] [--yes]
-  odla-ai security plan [--env dev] [--json]
-  odla-ai security sources [--env dev] [--json]
-  odla-ai security run --source <id> --plan-digest <sha256:...> --ack-redacted-source [--ref <branch|tag|sha>] [--env dev] [--no-follow]
-  odla-ai security status <job-id> [--follow] [--json]
-  odla-ai security report <job-id> [--json]
-  odla-ai security run [target] --ack-redacted-source [--env dev] [--profile odla] [--fail-on high]
-  odla-ai security run [target] --self --ack-redacted-source
-  odla-ai provision [--config odla.config.mjs] [--email <odla-account>] [--wait <seconds>] [--dry-run] [--push-secrets] [--rotate-o11y-token] [--write-dev-vars[=path]] [--yes]
-  odla-ai smoke [--config odla.config.mjs] [--env dev] [--email <odla-account>] [--no-open]
-  odla-ai skill install [--dir <project>] [--agent <name>] [--global] [--force]
-  odla-ai secrets push --env <env> [--config odla.config.mjs] [--dry-run] [--yes]
-  odla-ai secrets set <name> --env <env> (--from-env <NAME>|--stdin) [--email <odla-account>] [--config odla.config.mjs] [--yes]
-  odla-ai secrets set-clerk-key --env <env> (--from-env <NAME>|--stdin) [--email <odla-account>] [--config odla.config.mjs] [--yes]
-  odla-ai version
-
-Commands:
-  agent        Inspect durable agent wakeups and explicitly requeue a
-               dead-lettered job; JSON output is stable for remote operators.
-  runbook      odla's operational procedures, stored in the database and read at
-               the moment they are followed. "ask" gives a written, cited answer;
-               "search" the passages behind it; "get" the whole document.
-               "impact" diffs your working tree against a base ref and names the
-               runbooks that describe what you changed \u2014 run it after touching a
-               package's exported API or JSDoc, or a Studio surface. "lint"
-               checks the corpus the other way: every odla-ai command the
-               runbooks name is held against this CLI's real command surface,
-               and against the minimum versions each runbook declares. A wrong step
-               is fixed with "edit", which takes effect immediately: a runbook is
-               a row, not a release. Runbooks describe PROCEDURE; what an export
-               does and what it guarantees is JSDoc, rendered per package at
-               https://odla.ai/docs and shipped in the installed .d.ts. Answering
-               a question usually needs both.
-  whoami       Report who this terminal is authenticated as, and whether it holds
-               platform admin. A handshake-minted device token is never admin,
-               however the human who approved it is configured.
-  context      Explain selected config, platform, app, environment, and
-               developer-token provenance without printing credentials or
-               starting a device handshake. Operator work can run outside a
-               project checkout with explicit flags or ODLA_* environment
-               variables.
-  setup        Install offline odla runbooks for common coding-agent harnesses.
-  init         Create a generic odla.config.mjs plus starter schema/rules files.
-  doctor       Validate and summarize the project config without network calls.
-  calendar     Inspect, connect, or disconnect the live Google booking connection.
-  app          Archive (suspend, data retained), restore, export, import, or
-               manage the co-owners of the app. Archiving takes every
-               environment's data plane down until restored; permanent deletion
-               has NO CLI \u2014 it requires a signed-in owner in Studio, and no
-               machine or agent credential can purge. "app export" downloads a
-               portable gzipped-JSONL snapshot of one database (--fresh takes a
-               new snapshot first) \u2014 your data is always yours to take.
-               "app import" upserts rows back in from JSON, JSONL, or a
-               {namespace: rows} map (the shape a query returns); it writes only
-               with --yes, so the bare command is a dry run, and it refuses to
-               guess an id mode that would duplicate rows on a re-run.
-               "app refresh-sandbox" replaces the sandbox with a copy of live
-               (the routine dev loop); "app go-live" copies the sandbox into an
-               EMPTY live database, once, at launch; "app promote" pushes only
-               schema, rules and gates up afterwards, leaving live's rows alone.
-               Each prints its plan and writes nothing without --yes, so the
-               bare command is the dry run. Clerk config, triggers, allowlists,
-               secrets and API keys never travel; identity rows stay behind
-               unless --include-identity.
-               "app rename <name>" changes only the display name humans read;
-               the app id is permanent (tenants, URLs and keys embed it), so a
-               rename never re-provisions anything or invalidates a credential.
-               "app owners add <email>" grants a signed-up odla member the SAME
-               full access as you; they then run their own "provision" to mint
-               their own credentials for the shared db (the live one included)
-               \u2014 no secret is ever copied between people.
-  capabilities Show what the CLI automates vs agent edits and human checkpoints.
-  code         Enroll this Mac/Linux host for the current Studio-connected repository and run Pi.
-  admin        Manage platform-funded AI routing/credentials/usage with narrow device grants.
-  security     Connect GitHub sources and run commit-pinned hosted reviews, or scan a local snapshot.
-  pm           Project management (via @odla-ai/pm) shared across the apps you
-               co-own: conformance goals, kanban tasks, decisions, and bugs. With
-               no --app, "list" spans every co-owned project (the cross-project
-               view); with --app it scopes to one. Same device-grant auth as
-               "app". Entities: goal (alias conformance), task (alias kanban),
-               decision, bug. Status changes and comments post to each item's
-               @odla-ai/chat discussion thread.
-  discuss      Group discussions (via @odla-ai/chat) for the apps you co-own:
-               one group per project, topics with replies, @-mentions of people,
-               agents, PM items, and projects. Built for unattended use \u2014 post a
-               question, then "watch" it until someone answers. "watch" exits 75
-               (not 1) when it times out with nothing new, so a script can tell
-               "no answer yet" from a failure and just rerun. Use "who" to look
-               up the exact @[Label](kind/id) markup for a mention.
-  o11y         Read one stable status envelope for application RED, current
-               live-sync load/freshness, the protected commit-to-visible
-               canary, collector ingest/scheduler trust, Cloudflare-owned
-               runtime metrics, and a machine verdict.
-               --json keeps auth progress on stderr for unattended agents.
-  provision    Register services, compose integrations, persist credentials, optionally push secrets.
-  smoke        Verify credentials, public-config, composed schema, db aggregate, and integration probes.
-  skill        Same installer; --agent accepts all, claude, codex, cursor,
-               copilot, gemini, or agents (repeatable or comma-separated).
-  secrets      Push configured db/o11y secrets into the Worker via wrangler
-               stdin; set stores a tenant-vault secret and set-clerk-key the
-               reserved Clerk secret key, write-only from stdin or an env var.
-  version      Print the CLI version.
-
-Safety:
-  Every app has two databases on odla.ai: a sandbox (env "dev", tenant
-  <appId>--dev) and a live one (env "prod", tenant <appId>). Both are served by
-  production odla.ai \u2014 there is no separate odla to point at. New projects get
-  the sandbox only. Add "prod" explicitly to odla.config.mjs and pass --yes to
-  provision the live database; use --dry-run first to inspect the resolved plan.
-  Provision caches the approved developer token and service credentials under
-  .odla/ with mode 0600, and init adds those paths to .gitignore. Secret push
-  preflights Wrangler before any shown-once issuance or destructive rotation.
-  Projectless PM, Discussions, o11y, runbook, and identity commands use
-  --platform/--app/--env, ODLA_PLATFORM_URL/ODLA_APP_ID/ODLA_ENV, and
-  ODLA_DEV_TOKEN. Save non-secret scope metadata with "context save", then
-  select it explicitly with --context or ODLA_CONTEXT. Each named context gets
-  isolated developer and scoped-token caches. Override their locations with
-  ODLA_DEV_TOKEN_FILE and ODLA_ADMIN_TOKEN_FILE; ODLA_CONTEXT_FILE relocates
-  the metadata file. Flags and specific ODLA_* scope variables beat a selected
-  context, which beats project config. There is no ambient current context.
-  "context show" reports only provenance and cache state and never authenticates.
-  Provision opens the approval page in your browser automatically whenever the
-  machine can show one, including agent-driven runs; only CI, SSH, and
-  display-less hosts skip it. Use --open to force or --no-open to suppress.
-  Browser launch is best-effort: the printed approval URL is authoritative and
-  agents must relay it to the human verbatim. A started handshake is persisted
-  under .odla/, so a command killed mid-wait loses nothing \u2014 rerunning resumes
-  the same code. Outside an interactive terminal the wait is capped (90s by
-  default, --wait <seconds> to change); a still-pending handshake then exits
-  with code 75: relay the URL, wait for approval, and re-run to collect.
-  A fresh device handshake requires --email <odla-account> or ODLA_USER_EMAIL.
-  The email is a non-secret identity hint: never provide a password or session
-  token. The matching account must already exist, be signed in, explicitly
-  review the exact code, and finish any current request before claiming another.
-  Run Code from a GitHub checkout already connected to an app in Studio; an
-  odla.config.mjs may select the app explicitly but is not required. Code host
-  approval and credential hashes live in odla-ai/db. The host
-  credential is never written under .odla/; it exists only in the foreground
-  "code connect" process and is rotated by the next approved connection.
-  Calendar setup has a second human checkpoint: odla issues a state-bound Google consent URL;
-  OAuth codes and refresh tokens never enter the CLI, repo, chat, or app.
-  GitHub security uses source-read-only access plus optional metadata-only Checks write: the CLI never asks
-  for a PAT or provider key. GitHub read access is separate from the explicit
-  --ack-redacted-source consent and the exact --plan-digest printed by security
-  plan are required before bounded snippets reach System AI.
-  Run security plan first to inspect the admin-selected providers, models,
-  per-route bounds, credential readiness, retention, no-execution boundary,
-  and digest that binds consent to that exact plan.
-`);
-}
-
-// src/security-hosted-github.ts
-var import_node_child_process4 = require("child_process");
-var import_node_util2 = require("util");
+// src/security-hosted-github.ts
+var import_node_child_process4 = require("child_process");
+var import_node_util2 = require("util");
 
 // src/security-hosted-request.ts
-async function requestHostedSecurityJson(options, path, init, action) {
+async function requestHostedSecurityJson(options, path, init, action2) {
   const platform = platformAudience(options.platform);
   const token = hostedSecurityCredential(options.token);
   const requestInit = {
@@ -7047,35 +7355,35 @@ async function requestHostedSecurityJson(options, path, init, action) {
   if (!response2.ok) {
     const code = optionalHostedText(body.error?.code, "error code", 128);
     const message2 = optionalHostedText(body.error?.message, "error message", 300);
-    throw new Error(`${action} failed (${response2.status})${code ? ` ${code}` : ""}${message2 ? `: ${message2}` : ""}`);
+    throw new Error(`${action2} failed (${response2.status})${code ? ` ${code}` : ""}${message2 ? `: ${message2}` : ""}`);
   }
   return body;
 }
-function hostedIdentifier(value, name) {
-  const result = optionalHostedText(value, name, 180);
+function hostedIdentifier(value2, name) {
+  const result = optionalHostedText(value2, name, 180);
   if (!result || !/^[A-Za-z0-9][A-Za-z0-9._:-]*$/.test(result)) {
     throw new Error(`${name} is invalid`);
   }
   return result;
 }
-function positivePolicyVersion(value, name) {
-  if (!Number.isSafeInteger(value) || value < 1) {
+function positivePolicyVersion(value2, name) {
+  if (!Number.isSafeInteger(value2) || value2 < 1) {
     throw new Error(`${name} is invalid`);
   }
-  return value;
+  return value2;
 }
-function optionalHostedText(value, name, maxLength) {
-  if (value === void 0 || value === null || value === "") return void 0;
-  if (typeof value !== "string" || value.length > maxLength || /[\u0000-\u001f\u007f]/.test(value)) {
+function optionalHostedText(value2, name, maxLength) {
+  if (value2 === void 0 || value2 === null || value2 === "") return void 0;
+  if (typeof value2 !== "string" || value2.length > maxLength || /[\u0000-\u001f\u007f]/.test(value2)) {
     throw new Error(`${name} is invalid`);
   }
-  return value;
+  return value2;
 }
-function githubRepositoryName(value) {
-  if (typeof value !== "string" || value.length > 201) {
+function githubRepositoryName(value2) {
+  if (typeof value2 !== "string" || value2.length > 201) {
     throw new Error("repository must be owner/name");
   }
-  const parts = value.split("/");
+  const parts = value2.split("/");
   const owner = parts[0] ?? "";
   const name = (parts[1] ?? "").replace(/\.git$/i, "");
   if (parts.length !== 2 || !/^[A-Za-z0-9](?:[A-Za-z0-9-]{0,98}[A-Za-z0-9])?$/.test(owner) || !/^[A-Za-z0-9_.-]{1,100}$/.test(name) || name === "." || name === "..") {
@@ -7083,10 +7391,10 @@ function githubRepositoryName(value) {
   }
   return `${owner}/${name}`;
 }
-function trustedGitHubInstallUrl(value) {
+function trustedGitHubInstallUrl(value2) {
   let url;
   try {
-    url = new URL(value);
+    url = new URL(value2);
   } catch {
     throw new Error("odla.ai returned an invalid GitHub installation URL");
   }
@@ -7095,17 +7403,17 @@ function trustedGitHubInstallUrl(value) {
   }
   return url.toString();
 }
-function hostedPollInterval(value = 2e3) {
-  if (!Number.isSafeInteger(value) || value < 100 || value > 3e4) {
+function hostedPollInterval(value2 = 2e3) {
+  if (!Number.isSafeInteger(value2) || value2 < 100 || value2 > 3e4) {
     throw new Error("poll interval must be 100-30000ms");
   }
-  return value;
+  return value2;
 }
-function hostedPollTimeout(value = 10 * 6e4) {
-  if (!Number.isSafeInteger(value) || value < 1e3 || value > 60 * 6e4) {
+function hostedPollTimeout(value2 = 10 * 6e4) {
+  if (!Number.isSafeInteger(value2) || value2 < 1e3 || value2 > 60 * 6e4) {
     throw new Error("poll timeout must be 1000-3600000ms");
   }
-  return value;
+  return value2;
 }
 async function waitForHostedPoll(milliseconds, signal) {
   if (signal?.aborted) throw signal.reason ?? new DOMException("aborted", "AbortError");
@@ -7117,16 +7425,16 @@ async function waitForHostedPoll(milliseconds, signal) {
     }, { once: true });
   });
 }
-function isValidHostedSecurityPlan(value, env) {
-  if (!value || value.env !== env || !/^sha256:[a-f0-9]{64}$/.test(value.planDigest) || value.consentContract !== "odla.hosted-security-consent.v1" || value.reportProjection !== "odla.hosted-security-report.v1" || value.redactionContract !== "odla.best-effort-credential-pattern-redaction.v1" || typeof value.promptBundle !== "string" || value.promptBundle.length < 1 || value.promptBundle.length > 100 || typeof value.ready !== "boolean" || typeof value.independent !== "boolean" || value.sourceDisclosure !== "redacted" || value.targetExecution !== false || !Number.isSafeInteger(value.reportRetentionDays) || value.reportRetentionDays < 1) return false;
+function isValidHostedSecurityPlan(value2, env) {
+  if (!value2 || value2.env !== env || !/^sha256:[a-f0-9]{64}$/.test(value2.planDigest) || value2.consentContract !== "odla.hosted-security-consent.v1" || value2.reportProjection !== "odla.hosted-security-report.v1" || value2.redactionContract !== "odla.best-effort-credential-pattern-redaction.v1" || typeof value2.promptBundle !== "string" || value2.promptBundle.length < 1 || value2.promptBundle.length > 100 || typeof value2.ready !== "boolean" || typeof value2.independent !== "boolean" || value2.sourceDisclosure !== "redacted" || value2.targetExecution !== false || !Number.isSafeInteger(value2.reportRetentionDays) || value2.reportRetentionDays < 1) return false;
   const validRoute = (route2, purpose) => !!route2 && route2.purpose === purpose && typeof route2.enabled === "boolean" && typeof route2.credentialReady === "boolean" && typeof route2.provider === "string" && route2.provider.length > 0 && route2.provider.length <= 100 && typeof route2.model === "string" && route2.model.length > 0 && route2.model.length <= 200 && Number.isSafeInteger(route2.policyVersion) && route2.policyVersion >= 1 && Number.isSafeInteger(route2.maxCallsPerRun) && route2.maxCallsPerRun >= 1 && Number.isSafeInteger(route2.maxInputBytes) && route2.maxInputBytes >= 1 && Number.isSafeInteger(route2.maxOutputTokens) && route2.maxOutputTokens >= 1;
-  return validRoute(value.routes?.discovery, "security.discovery") && validRoute(value.routes?.validation, "security.validation");
+  return validRoute(value2.routes?.discovery, "security.discovery") && validRoute(value2.routes?.validation, "security.validation");
 }
-function hostedSecurityCredential(value) {
-  if (typeof value !== "string" || value.length < 8 || value.length > 8192 || /\s|[\u0000-\u001f\u007f]/.test(value)) {
+function hostedSecurityCredential(value2) {
+  if (typeof value2 !== "string" || value2.length < 8 || value2.length > 8192 || /\s|[\u0000-\u001f\u007f]/.test(value2)) {
     throw new Error("Hosted security requires an injected odla developer token");
   }
-  return value;
+  return value2;
 }
 
 // src/security-hosted-github.ts
@@ -7238,7 +7546,7 @@ async function defaultReadOrigin(cwd) {
 
 // src/code-local-source.ts
 var import_node_child_process5 = require("child_process");
-var import_node_crypto = require("crypto");
+var import_node_crypto2 = require("crypto");
 var SOURCE_LIMITS2 = { maxFiles: 2e4, maxBytes: 512 * 1024 * 1024 };
 async function prepareCodeLocalSource(cwd, repository, readHead = readGitHead) {
   const headCommitSha = await readHead(cwd);
@@ -7279,25 +7587,25 @@ async function prepareCodeLocalSource(cwd, repository, readHead = readGitHead) {
   }
 }
 async function readGitHead(cwd) {
-  const value = await new Promise((accept, reject) => {
+  const value2 = await new Promise((accept, reject) => {
     (0, import_node_child_process5.execFile)("git", ["rev-parse", "HEAD"], { cwd, encoding: "utf8", maxBuffer: 16384 }, (error, stdout) => {
       if (error) reject(new Error("code connect requires a Git checkout with an initial commit"));
       else accept(stdout.trim());
     });
   });
-  if (!/^[0-9a-f]{40}$/.test(value)) throw new Error("code connect could not resolve the checkout HEAD commit");
-  return value;
+  if (!/^[0-9a-f]{40}$/.test(value2)) throw new Error("code connect could not resolve the checkout HEAD commit");
+  return value2;
 }
-function digestText(value) {
-  return `sha256:${(0, import_node_crypto.createHash)("sha256").update(value).digest("hex")}`;
+function digestText(value2) {
+  return `sha256:${(0, import_node_crypto2.createHash)("sha256").update(value2).digest("hex")}`;
 }
 
 // src/code-images.ts
 var import_node_child_process6 = require("child_process");
-var import_node_crypto2 = require("crypto");
+var import_node_crypto3 = require("crypto");
 var import_promises10 = require("fs/promises");
 var import_node_os3 = require("os");
-var import_node_path11 = require("path");
+var import_node_path12 = require("path");
 var import_node_url3 = require("url");
 
 // src/code-runtime-config.ts
@@ -7380,13 +7688,13 @@ async function embeddedPiImageName() {
   const bundle = await (0, import_promises10.readFile)(embeddedPiAssetPath()).catch(() => {
     throw new Error("CLI-embedded Pi runtime is missing; reinstall this exact @odla-ai/cli version");
   });
-  return `odla-ai/pi-agent:embedded-sha256-${(0, import_node_crypto2.createHash)("sha256").update(bundle).digest("hex")}`;
+  return `odla-ai/pi-agent:embedded-sha256-${(0, import_node_crypto3.createHash)("sha256").update(bundle).digest("hex")}`;
 }
 async function buildEmbeddedPiImage(engine, image, run) {
-  const context = await (0, import_promises10.mkdtemp)((0, import_node_path11.join)((0, import_node_os3.tmpdir)(), "odla-code-pi-"));
+  const context = await (0, import_promises10.mkdtemp)((0, import_node_path12.join)((0, import_node_os3.tmpdir)(), "odla-code-pi-"));
   try {
-    await (0, import_promises10.copyFile)(embeddedPiAssetPath(), (0, import_node_path11.join)(context, "pi-agent.js"));
-    await (0, import_promises10.writeFile)((0, import_node_path11.join)(context, "Dockerfile"), [
+    await (0, import_promises10.copyFile)(embeddedPiAssetPath(), (0, import_node_path12.join)(context, "pi-agent.js"));
+    await (0, import_promises10.writeFile)((0, import_node_path12.join)(context, "Dockerfile"), [
       `FROM ${CODE_NODE_IMAGE}`,
       "COPY pi-agent.js /opt/odla/pi-agent.js",
       "WORKDIR /workspace",
@@ -7402,7 +7710,7 @@ async function buildEmbeddedPiImage(engine, image, run) {
 // src/code-connect.ts
 async function codeConnect(options) {
   const cwd = options.cwd ?? process.cwd();
-  const configPath = (0, import_node_path12.resolve)(cwd, options.configPath);
+  const configPath = (0, import_node_path13.resolve)(cwd, options.configPath);
   const cfg = (0, import_node_fs14.existsSync)(configPath) ? await loadProjectConfig(configPath) : null;
   const requestedAppId = options.appId?.trim();
   if (requestedAppId && !/^[a-z0-9][a-z0-9-]{1,62}$/.test(requestedAppId)) {
@@ -7560,8 +7868,8 @@ async function runCodeRuntime(input) {
     for (const [name, handler] of handlers) process.removeListener(name, handler);
   }
 }
-function parseConnection(value, appId, appEnv) {
-  const root = record4(value);
+function parseConnection(value2, appId, appEnv) {
+  const root = record4(value2);
   const host = record4(root?.host);
   const offer = record4(root?.offer);
   const binding = record4(root?.binding);
@@ -7570,12 +7878,12 @@ function parseConnection(value, appId, appEnv) {
   }
   return root;
 }
-function apiFailure(action, status, value) {
-  const message2 = record4(record4(value)?.error)?.message;
-  return `${action} failed (${status})${typeof message2 === "string" ? `: ${message2}` : ""}`;
+function apiFailure(action2, status, value2) {
+  const message2 = record4(record4(value2)?.error)?.message;
+  return `${action2} failed (${status})${typeof message2 === "string" ? `: ${message2}` : ""}`;
 }
-function record4(value) {
-  return value && typeof value === "object" && !Array.isArray(value) ? value : null;
+function record4(value2) {
+  return value2 && typeof value2 === "object" && !Array.isArray(value2) ? value2 : null;
 }
 
 // src/code-command.ts
@@ -7634,8 +7942,8 @@ function developerTokenStatus(context, parsed, now = Date.now()) {
     cacheStatus
   };
 }
-function clean3(value) {
-  const normalized = value?.trim();
+function clean3(value2) {
+  const normalized = value2?.trim();
   return normalized || void 0;
 }
 
@@ -7655,9 +7963,9 @@ async function contextCommand(parsed, deps = {}) {
     ],
     3
   );
-  const action = parsed.positionals[1];
+  const action2 = parsed.positionals[1];
   const out = deps.stdout ?? console;
-  if (action === "list") {
+  if (action2 === "list") {
     const profiles = listOperatorProfiles();
     if (parsed.options.json === true) {
       out.log(JSON.stringify({ schemaVersion: 1, profiles }, null, 2));
@@ -7675,7 +7983,7 @@ async function contextCommand(parsed, deps = {}) {
     }
     return;
   }
-  if (action === "save") {
+  if (action2 === "save") {
     if (parsed.options.token !== void 0) {
       throw new Error(
         "context save does not accept --token; contexts store scope metadata only"
@@ -7698,7 +8006,7 @@ async function contextCommand(parsed, deps = {}) {
     }
     return;
   }
-  if (action === "remove") {
+  if (action2 === "remove") {
     const name = requireName(parsed);
     if (parsed.options.yes !== true) {
       throw new Error(`context remove "${name}" requires --yes`);
@@ -7718,9 +8026,9 @@ async function contextCommand(parsed, deps = {}) {
     }
     return;
   }
-  if (action !== "show") {
+  if (action2 !== "show") {
     throw new Error(
-      `unknown context action "${action ?? ""}". Try show|list|save|remove.`
+      `unknown context action "${action2 ?? ""}". Try show|list|save|remove.`
     );
   }
   const context = await resolveOperatorContext(parsed, {
@@ -7771,6 +8079,261 @@ function requireName(parsed) {
   return name;
 }
 
+// src/help.ts
+function printHelp(output = console) {
+  output.log(`odla-ai
+
+Start here:
+  odla-ai runbook ask "<question>"   The current procedure, from odla's own
+                                     runbooks. Ask BEFORE searching the web or
+                                     working from memory: runbooks are edited
+                                     live, so your training data is out of date
+                                     and this is not.
+  odla-ai runbook impact             After a change: which runbooks describe the
+                                     code you just touched, so you can fix any
+                                     step it made wrong.
+
+Usage:
+  odla-ai setup [--dir <project>] [--agent <name>] [--global] [--force]
+  odla-ai init --app-id <id> --name <name> [--services db,ai,o11y,calendar] [--env dev --env prod]
+  odla-ai doctor [--config odla.config.mjs]
+  odla-ai config diff [--config odla.config.mjs] [--email <odla-account>] [--json]
+  odla-ai config plan [--config odla.config.mjs] [--email <odla-account>] [--json]
+  odla-ai calendar status [--env dev] [--email <odla-account>] [--json]
+  odla-ai calendar calendars [--env dev] [--email <odla-account>] [--json]
+  odla-ai calendar connect [--env dev] [--email <odla-account>] [--no-open] [--yes]
+  odla-ai calendar disconnect [--env dev] [--email <odla-account>] --yes
+  odla-ai app archive [--config odla.config.mjs] [--email <odla-account>] [--json] --yes
+  odla-ai app restore [--config odla.config.mjs] [--email <odla-account>] [--json]
+  odla-ai app export [--env dev] [--fresh] [--out <file>] [--email <odla-account>] [--json]
+  odla-ai app import <file|-> [--env dev] [--ns <namespace>] [--id-field <f>|--key <attr>|--generate-ids] [--dry-run] [--json] --yes
+  odla-ai app refresh-sandbox [--include-identity] [--include-files] [--dry-run] [--json] --yes
+  odla-ai app go-live         [--include-identity] [--include-files] [--dry-run] [--json] --yes
+  odla-ai app promote         [--dry-run] [--json] --yes
+  odla-ai app rename <name> [--config odla.config.mjs] [--email <odla-account>] [--json]
+  odla-ai app owners list [--config odla.config.mjs] [--email <odla-account>] [--json]
+  odla-ai app owners add <email> [--email <odla-account>] [--json]
+  odla-ai app owners remove <email> [--email <odla-account>] [--json]
+  odla-ai pm goal list [--app <id>] [--status <s>] [--q <text>] [--limit <n>] [--offset <n>] [--json]
+  odla-ai pm task list [--app <id>] [--column <c>] [--goal <id>] [--assignee <id>] [--q <text>] [--limit <n>] [--offset <n>] [--json]
+  odla-ai pm decision list [--app <id>] [--status <s>] [--q <text>] [--limit <n>] [--offset <n>] [--json]
+  odla-ai pm bug list [--app <id>] [--status <s>] [--severity <s>] [--goal <id>] [--assignee <id>] [--decision <id>] [--q <text>] [--limit <n>] [--offset <n>] [--json]
+  odla-ai pm goal add --app <id> --title <t> [--status <s>] [--proof <text>] [--target <pct>] [--mutation-id <id>] [--json]
+  odla-ai pm task add --app <id> --title <t> [--column <c>] [--goal <id>] [--assignee <id>] [--description <text>|--body <text>] [--due <epoch-ms>] [--mutation-id <id>] [--json]
+  odla-ai pm decision add --app <id> --title <t> --body <text> [--status <s>] [--mutation-id <id>] [--json]
+  odla-ai pm bug add --app <id> --title <t> (--description <text>|--body <text>) [--status <s>] [--severity <s>] [--goal <id>] [--assignee <id>] [--decision <id>] [--mutation-id <id>] [--json]
+  odla-ai pm <goal|task|decision|bug> get <id> [--json]
+  odla-ai pm goal set <id> [--title <t>|--status <s>|--proof <text>|--no-proof|--target <pct>|--no-target] [--mutation-id <id>] [--json]
+  odla-ai pm task set <id> [--title <t>|--column <c>|--rank <n>|--goal <id>|--no-goal|--assignee <id>|--no-assignee|--description <text>|--body <text>|--due <epoch-ms>|--no-due] [--mutation-id <id>] [--json]
+  odla-ai pm decision set <id> [--title <t>|--status <s>|--body <text>] [--mutation-id <id>] [--json]
+  odla-ai pm bug set <id> [--title <t>|--status <s>|--severity <s>|--goal <id>|--no-goal|--assignee <id>|--no-assignee|--decision <id>|--no-decision|--description <text>|--body <text>] [--mutation-id <id>] [--json]
+  odla-ai pm <goal|task|decision> done <id> [--mutation-id <id>]
+  odla-ai pm bug done <id> [--decision <accepted-decision-id>] [--mutation-id <id>]
+  odla-ai pm <goal|task|decision|bug> comment <id> --body "..." [--mutation-id <id>]
+  odla-ai pm <goal|task|decision|bug> comments <id> [--json]
+  odla-ai pm <goal|task|decision|bug> rm <id>
+  odla-ai pm handoff --app <id> [--json]
+  odla-ai discuss groups [--json]
+  odla-ai discuss list [--app <id>] [--q <text>] [--state open|resolved|all] [--json]
+  odla-ai discuss read <topic> [--limit <n> --offset <n>] [--json]
+  odla-ai discuss post --app <id> --subject "..." --body "..." [--markup "... @[Label](kind/id)"] [--mutation-id <id>]
+  odla-ai discuss reply <topic> --body "..." [--markup "..."] [--mutation-id <id>]
+  odla-ai discuss resolve <topic> [--reopen] [--mutation-id <id>]
+  odla-ai discuss who --q <text> [--app <id>] [--kinds user,pm:task] [--json]
+  odla-ai discuss watch [<topic>] [--cursor <cursor>] [--by <authorId>] [--self <authorId>] [--interval <s>] [--timeout <s>] [--json|--jsonl]
+  odla-ai agent jobs [--env dev] [--state pending|running|succeeded|dead_letter] [--limit 50] [--email <email>] [--json]
+  odla-ai agent retry <job-id> [--env dev] [--email <email>] [--json]
+  odla-ai context show [--context <name>] [--platform https://odla.ai] [--app <id>] [--env prod] [--json]
+  odla-ai context list [--json]
+  odla-ai context save <name> [--platform <url>] [--app <id>] [--env <name>] [--json]
+  odla-ai context remove <name> --yes [--json]
+  odla-ai o11y status [--app <id>] [--context <name>] [--platform https://odla.ai] [--env prod] [--minutes 60] [--json]
+  odla-ai platform status [--context <name>] [--platform https://odla.ai] [--email <odla-account>] [--json]
+  odla-ai whoami [--context <name>] [--platform https://odla.ai] [--json]
+  odla-ai runbook ask "<question>" [--app <id>] [--all] [--json]
+  odla-ai runbook search "<question>" [--app <id>] [--all] [--limit <n>] [--json]
+  odla-ai runbook impact [--base origin/main] [--app <id>] [--all] [--limit <n>] [--json]
+  odla-ai runbook lint [--app <id>] [--all] [--json]
+  odla-ai runbook list [--app <id>] [--all] [--q <text>] [--json]
+  odla-ai runbook comment <slug> --body "..." [--app <id>]
+  odla-ai runbook get <slug> [--app <id>]
+  odla-ai runbook new <slug> --title <t> --file <path|-> [--summary <s>] [--requires <specs>] [--app <id>]
+  odla-ai runbook edit <slug> [--file <path|->|--body "..."] [--note <why>] [--requires <specs>] [--app <id>]
+  odla-ai runbook import <dir> [--visibility operator|admin] [--dry-run] [--app <id>]
+  odla-ai runbook publish <slug> [--app <id>]
+  odla-ai runbook visibility <slug> <operator|admin> [--app <id>]
+  odla-ai runbook archive <slug> [--app <id>]
+  odla-ai runbook history <slug> [--app <id>] [--json]
+  odla-ai runbook revert <slug> --version <n> [--app <id>]
+  odla-ai runbook rm <slug> [--app <id>]
+  odla-ai capabilities [--json]
+  odla-ai code connect [--env dev|prod] [--email <odla-account>] [--engine auto|container|podman|docker] [--slots <1-64>] [--once]
+  odla-ai admin ai show [--context <name>] [--platform https://odla.ai] [--email <odla-account>] [--json]
+  odla-ai admin ai models [--context <name>] [--provider <id>] [--json]
+  odla-ai admin ai set <purpose> [--context <name>] [--provider <id>] [--model <id>] [--enabled|--no-enabled]
+    [--max-input-bytes <n>] [--max-output-tokens <n>] [--max-calls-per-run <n>] [--json]
+  odla-ai admin ai set security [--context <name>] --discovery-provider <id> --discovery-model <id>
+    --validation-provider <id> --validation-model <id> [--enabled|--no-enabled] [--json]
+  odla-ai admin ai credentials [--context <name>] [--json]
+  odla-ai admin ai credential set <provider> [--context <name>] (--from-env <NAME>|--stdin)
+  odla-ai admin ai usage [--context <name>] [--app-id <id>] [--env <env>] [--run-id <id>] [--limit <1-500>] [--json]
+  odla-ai admin ai audit [--context <name>] [--limit <1-200>] [--json]
+  odla-ai security github connect [--repo owner/name] [--env dev] [--email <odla-account>] [--no-open]
+  odla-ai security github disconnect --source <id> [--env dev] [--yes]
+  odla-ai security plan [--env dev] [--json]
+  odla-ai security sources [--env dev] [--json]
+  odla-ai security run --source <id> --plan-digest <sha256:...> --ack-redacted-source [--ref <branch|tag|sha>] [--env dev] [--no-follow]
+  odla-ai security status <job-id> [--follow] [--json]
+  odla-ai security report <job-id> [--json]
+  odla-ai security run [target] --ack-redacted-source [--env dev] [--profile odla] [--fail-on high]
+  odla-ai security run [target] --self --ack-redacted-source
+  odla-ai provision [--config odla.config.mjs] [--email <odla-account>] [--wait <seconds>] [--dry-run] [--push-secrets] [--rotate-o11y-token] [--write-dev-vars[=path]] [--yes]
+  odla-ai smoke [--config odla.config.mjs] [--env dev] [--email <odla-account>] [--no-open]
+  odla-ai skill install [--dir <project>] [--agent <name>] [--global] [--force]
+  odla-ai secrets push --env <env> [--config odla.config.mjs] [--dry-run] [--yes]
+  odla-ai secrets set <name> --env <env> (--from-env <NAME>|--stdin) [--email <odla-account>] [--config odla.config.mjs] [--yes]
+  odla-ai secrets set-clerk-key --env <env> (--from-env <NAME>|--stdin) [--email <odla-account>] [--config odla.config.mjs] [--yes]
+  odla-ai version
+
+Commands:
+  agent        Inspect durable agent wakeups and explicitly requeue a
+               dead-lettered job; JSON output is stable for remote operators.
+  runbook      odla's operational procedures, stored in the database and read at
+               the moment they are followed. "ask" gives a written, cited answer;
+               "search" the passages behind it; "get" the whole document.
+               "impact" diffs your working tree against a base ref and names the
+               runbooks that describe what you changed \u2014 run it after touching a
+               package's exported API or JSDoc, or a Studio surface. "lint"
+               checks the corpus the other way: every odla-ai command the
+               runbooks name is held against this CLI's real command surface,
+               and against the minimum versions each runbook declares. A wrong step
+               is fixed with "edit", which takes effect immediately: a runbook is
+               a row, not a release. Runbooks describe PROCEDURE; what an export
+               does and what it guarantees is JSDoc, rendered per package at
+               https://odla.ai/docs and shipped in the installed .d.ts. Answering
+               a question usually needs both.
+  whoami       Report who this terminal is authenticated as, and whether it holds
+               platform admin. A handshake-minted device token is never admin,
+               however the human who approved it is configured.
+  context      Explain selected config, platform, app, environment, and
+               developer-token provenance without printing credentials or
+               starting a device handshake. Operator work can run outside a
+               project checkout with explicit flags or ODLA_* environment
+               variables.
+  setup        Install offline odla runbooks for common coding-agent harnesses.
+  init         Create a generic odla.config.mjs plus starter schema/rules files.
+  doctor       Validate and summarize the project config without network calls.
+  config       Read-only diff and revision-bound plan for checked-in Registry
+               intent; runtime-owned fields and excluded coverage stay explicit.
+  calendar     Inspect, connect, or disconnect the live Google booking connection.
+  app          Archive (suspend, data retained), restore, export, import, or
+               manage the co-owners of the app. Archiving takes every
+               environment's data plane down until restored; permanent deletion
+               has NO CLI \u2014 it requires a signed-in owner in Studio, and no
+               machine or agent credential can purge. "app export" downloads a
+               portable gzipped-JSONL snapshot of one database (--fresh takes a
+               new snapshot first) \u2014 your data is always yours to take.
+               "app import" upserts rows back in from JSON, JSONL, or a
+               {namespace: rows} map (the shape a query returns); it writes only
+               with --yes, so the bare command is a dry run, and it refuses to
+               guess an id mode that would duplicate rows on a re-run.
+               "app refresh-sandbox" replaces the sandbox with a copy of live
+               (the routine dev loop); "app go-live" copies the sandbox into an
+               EMPTY live database, once, at launch; "app promote" pushes only
+               schema, rules and gates up afterwards, leaving live's rows alone.
+               Each prints its plan and writes nothing without --yes, so the
+               bare command is the dry run. Clerk config, triggers, allowlists,
+               secrets and API keys never travel; identity rows stay behind
+               unless --include-identity.
+               "app rename <name>" changes only the display name humans read;
+               the app id is permanent (tenants, URLs and keys embed it), so a
+               rename never re-provisions anything or invalidates a credential.
+               "app owners add <email>" grants a signed-up odla member the SAME
+               full access as you; they then run their own "provision" to mint
+               their own credentials for the shared db (the live one included)
+               \u2014 no secret is ever copied between people.
+  capabilities Show what the CLI automates vs agent edits and human checkpoints.
+  code         Enroll this Mac/Linux host for the current Studio-connected repository and run Pi.
+  admin        Manage platform-funded AI routing/credentials/usage with narrow device grants.
+  security     Connect GitHub sources and run commit-pinned hosted reviews, or scan a local snapshot.
+  pm           Project management (via @odla-ai/pm) shared across the apps you
+               co-own: conformance goals, kanban tasks, decisions, and bugs. With
+               no --app, "list" spans every co-owned project (the cross-project
+               view); with --app it scopes to one. Same device-grant auth as
+               "app". Entities: goal (alias conformance), task (alias kanban),
+               decision, bug. Status changes and comments post to each item's
+               @odla-ai/chat discussion thread.
+  discuss      Group discussions (via @odla-ai/chat) for the apps you co-own:
+               one group per project, topics with replies, @-mentions of people,
+               agents, PM items, and projects. Built for unattended use \u2014 post a
+               question, then "watch" it until someone answers. "watch" exits 75
+               (not 1) when it times out with nothing new, so a script can tell
+               "no answer yet" from a failure and just rerun. Use "who" to look
+               up the exact @[Label](kind/id) markup for a mention.
+  o11y         Read one stable status envelope for application RED, current
+               live-sync load/freshness, the protected commit-to-visible
+               canary, collector ingest/scheduler trust, Cloudflare-owned
+               runtime metrics, and a machine verdict.
+               --json keeps auth progress on stderr for unattended agents.
+  platform     Read canonical fleet health, releases, provider load/freshness,
+               explicit unknowns, and next actions through a read-only grant.
+  provision    Register services, compose integrations, persist credentials, optionally push secrets.
+  smoke        Verify credentials, public-config, composed schema, db aggregate, and integration probes.
+  skill        Same installer; --agent accepts all, claude, codex, cursor,
+               copilot, gemini, or agents (repeatable or comma-separated).
+  secrets      Push configured db/o11y secrets into the Worker via wrangler
+               stdin; set stores a tenant-vault secret and set-clerk-key the
+               reserved Clerk secret key, write-only from stdin or an env var.
+  version      Print the CLI version.
+
+Safety:
+  Every app has two databases on odla.ai: a sandbox (env "dev", tenant
+  <appId>--dev) and a live one (env "prod", tenant <appId>). Both are served by
+  production odla.ai \u2014 there is no separate odla to point at. New projects get
+  the sandbox only. Add "prod" explicitly to odla.config.mjs and pass --yes to
+  provision the live database; use --dry-run first to inspect the resolved plan.
+  Provision caches the approved developer token and service credentials under
+  .odla/ with mode 0600, and init adds those paths to .gitignore. Secret push
+  preflights Wrangler before any shown-once issuance or destructive rotation.
+  Projectless PM, Discussions, o11y, runbook, and identity commands use
+  --platform/--app/--env, ODLA_PLATFORM_URL/ODLA_APP_ID/ODLA_ENV, and
+  ODLA_DEV_TOKEN. Save non-secret scope metadata with "context save", then
+  select it explicitly with --context or ODLA_CONTEXT. Each named context gets
+  isolated developer and scoped-token caches. Override their locations with
+  ODLA_DEV_TOKEN_FILE and ODLA_ADMIN_TOKEN_FILE; ODLA_CONTEXT_FILE relocates
+  the metadata file. Flags and specific ODLA_* scope variables beat a selected
+  context, which beats project config. There is no ambient current context.
+  "context show" reports only provenance and cache state and never authenticates.
+  Provision opens the approval page in your browser automatically whenever the
+  machine can show one, including agent-driven runs; only CI, SSH, and
+  display-less hosts skip it. Use --open to force or --no-open to suppress.
+  Browser launch is best-effort: the printed approval URL is authoritative and
+  agents must relay it to the human verbatim. A started handshake is persisted
+  under .odla/, so a command killed mid-wait loses nothing \u2014 rerunning resumes
+  the same code. Outside an interactive terminal the wait is capped (90s by
+  default, --wait <seconds> to change); a still-pending handshake then exits
+  with code 75: relay the URL, wait for approval, and re-run to collect.
+  A fresh device handshake requires --email <odla-account> or ODLA_USER_EMAIL.
+  The email is a non-secret identity hint: never provide a password or session
+  token. The matching account must already exist, be signed in, explicitly
+  review the exact code, and finish any current request before claiming another.
+  Run Code from a GitHub checkout already connected to an app in Studio; an
+  odla.config.mjs may select the app explicitly but is not required. Code host
+  approval and credential hashes live in odla-ai/db. The host
+  credential is never written under .odla/; it exists only in the foreground
+  "code connect" process and is rotated by the next approved connection.
+  Calendar setup has a second human checkpoint: odla issues a state-bound Google consent URL;
+  OAuth codes and refresh tokens never enter the CLI, repo, chat, or app.
+  GitHub security uses source-read-only access plus optional metadata-only Checks write: the CLI never asks
+  for a PAT or provider key. GitHub read access is separate from the explicit
+  --ack-redacted-source consent and the exact --plan-digest printed by security
+  plan are required before bounded snippets reach System AI.
+  Run security plan first to inspect the admin-selected providers, models,
+  per-route bounds, credential readiness, retention, no-execution boundary,
+  and digest that binds consent to that exact plan.
+`);
+}
+
 // src/discuss-actions.ts
 var writeMutationId = (parsed) => stringOpt(parsed.options["mutation-id"]) ?? crypto.randomUUID();
 async function request(ctx, method, path, body) {
@@ -7784,8 +8347,8 @@ async function request(ctx, method, path, body) {
     throw new Error(`discuss ${method} ${path} failed: ${data.error ?? `registry returned ${res.status}`}`);
   return data;
 }
-function emit(ctx, value, human) {
-  if (ctx.json) ctx.out.log(JSON.stringify(value, null, 2));
+function emit(ctx, value2, human) {
+  if (ctx.json) ctx.out.log(JSON.stringify(value2, null, 2));
   else human();
 }
 var state = (topic) => topic.resolved ? "resolved" : "open";
@@ -7830,8 +8393,8 @@ async function discussList(ctx, parsed) {
     ["limit", "limit"],
     ["offset", "offset"]
   ]) {
-    const value = stringOpt(parsed.options[flag]);
-    if (value) query.set(param, value);
+    const value2 = stringOpt(parsed.options[flag]);
+    if (value2) query.set(param, value2);
   }
   const qs = query.toString();
   const page = await request(ctx, "GET", `/topics${qs ? `?${qs}` : ""}`);
@@ -8028,11 +8591,11 @@ var MAX_CONSECUTIVE_FAILURES = 5;
 var MAX_BACKOFF_MS = 3e4;
 function numberOpt2(parsed, flag, fallback) {
   const raw = stringOpt(parsed.options[flag]);
-  const value = raw == null ? NaN : Number(raw);
-  return Number.isFinite(value) && value > 0 ? value : fallback;
+  const value2 = raw == null ? NaN : Number(raw);
+  return Number.isFinite(value2) && value2 > 0 ? value2 : fallback;
 }
-function jsonl(ctx, parsed, value) {
-  if (parsed.options.jsonl === true) ctx.out.log(JSON.stringify({ v: 1, ...value }));
+function jsonl(ctx, parsed, value2) {
+  if (parsed.options.jsonl === true) ctx.out.log(JSON.stringify({ v: 1, ...value2 }));
 }
 async function discussWatch(ctx, topicId, parsed) {
   if (ctx.json && parsed.options.jsonl === true) throw new Error("--json and --jsonl cannot be combined");
@@ -8192,8 +8755,8 @@ var ALLOWED = [
   "platform",
   "context"
 ];
-function requireId(id, action) {
-  if (!id) throw new Error(`"discuss ${action}" needs a topic id`);
+function requireId(id, action2) {
+  if (!id) throw new Error(`"discuss ${action2}" needs a topic id`);
   return id;
 }
 async function buildContext(parsed, deps) {
@@ -8227,11 +8790,11 @@ async function buildContext(parsed, deps) {
 }
 async function discussCommand(parsed, deps = {}) {
   assertArgs(parsed, ALLOWED, 3);
-  const action = parsed.positionals[1];
+  const action2 = parsed.positionals[1];
   const id = parsed.positionals[2];
-  if (!action) throw new Error('"discuss" needs an action. Run "odla-ai help".');
+  if (!action2) throw new Error('"discuss" needs an action. Run "odla-ai help".');
   const ctx = await buildContext(parsed, deps);
-  switch (action) {
+  switch (action2) {
     case "groups":
       return discussGroups(ctx);
     case "list":
@@ -8253,7 +8816,7 @@ async function discussCommand(parsed, deps = {}) {
       return;
     }
     default:
-      throw new Error(`unknown discuss action "${action}". Run "odla-ai help".`);
+      throw new Error(`unknown discuss action "${action2}". Run "odla-ai help".`);
   }
 }
 
@@ -8294,13 +8857,13 @@ async function pmRequest(ctx, method, path, body) {
 function collectFields(parsed, allowClear) {
   const out = {};
   for (const [flag, spec] of Object.entries(FIELD_MAP)) {
-    const value = parsed.options[flag];
-    if (value === void 0 || value === true) continue;
-    if (value === false) {
+    const value2 = parsed.options[flag];
+    if (value2 === void 0 || value2 === true) continue;
+    if (value2 === false) {
       if (allowClear) out[spec.key] = null;
       continue;
     }
-    const text = stringOpt(value);
+    const text = stringOpt(value2);
     out[spec.key] = spec.num ? Number(text) : text;
   }
   return out;
@@ -8321,8 +8884,8 @@ function statusCol(entity, r) {
 function printRecord(ctx, entity, r) {
   ctx.out.log(`${r.id}	[${statusCol(entity, r)}]	${r.appId}	${r.title ?? ""}`);
 }
-function emit2(ctx, value, human) {
-  if (ctx.json) ctx.out.log(JSON.stringify(value, null, 2));
+function emit2(ctx, value2, human) {
+  if (ctx.json) ctx.out.log(JSON.stringify(value2, null, 2));
   else human();
 }
 async function pmList(ctx, entity, parsed) {
@@ -8368,8 +8931,8 @@ async function pmAdd(ctx, entity, parsed) {
   emit2(ctx, res, () => ctx.out.log(`created ${entity} ${res.id}`));
 }
 async function pmGet(ctx, entity, id) {
-  const { record: record7 } = await pmRequest(ctx, "GET", `/${entity}/${encodeURIComponent(id)}`);
-  emit2(ctx, record7, () => printRecord(ctx, entity, record7));
+  const { record: record8 } = await pmRequest(ctx, "GET", `/${entity}/${encodeURIComponent(id)}`);
+  emit2(ctx, record8, () => printRecord(ctx, entity, record8));
 }
 async function pmSet(ctx, entity, id, parsed) {
   const patch2 = collectEntityFields(entity, parsed, true);
@@ -8414,9 +8977,9 @@ async function pmHandoff(ctx, parsed) {
   ]);
   const handoff = {
     appId,
-    unmetGoals: goals.filter((record7) => record7.status !== "met"),
-    activeTasks: tasks.filter((record7) => record7.column !== "done"),
-    openBugs: bugs.filter((record7) => record7.status !== "fixed" && record7.status !== "wontfix")
+    unmetGoals: goals.filter((record8) => record8.status !== "met"),
+    activeTasks: tasks.filter((record8) => record8.column !== "done"),
+    openBugs: bugs.filter((record8) => record8.status !== "fixed" && record8.status !== "wontfix")
   };
   const result = {
     ...handoff,
@@ -8435,10 +8998,10 @@ async function pmHandoff(ctx, parsed) {
     ]) {
       ctx.out.log(`${label}:`);
       if (!records.length) ctx.out.log("- (none)");
-      else for (const record7 of records) printRecord(
+      else for (const record8 of records) printRecord(
         ctx,
         label === "unmet goals" ? "goal" : label === "active tasks" ? "task" : "bug",
-        record7
+        record8
       );
     }
   });
@@ -8514,18 +9077,18 @@ var ENTITY_OPTIONS = {
     done: ["decision"]
   }
 };
-function canonicalAction(action) {
-  if (action === "create") return "add";
-  if (action === "update" || action === "status" || action === "move") return "set";
-  if (action === "delete") return "rm";
-  return action in ACTION_OPTIONS ? action : null;
-}
-function allowedOptions(entity, action) {
-  const entityOptions = action === "list" || action === "add" || action === "set" || action === "done" ? ENTITY_OPTIONS[entity][action] : [];
-  return [...COMMON_OPTIONS, ...ACTION_OPTIONS[action], ...entityOptions];
-}
-function requireId2(id, action) {
-  if (!id) throw new Error(`"pm ... ${action}" needs an item id`);
+function canonicalAction(action2) {
+  if (action2 === "create") return "add";
+  if (action2 === "update" || action2 === "status" || action2 === "move") return "set";
+  if (action2 === "delete") return "rm";
+  return action2 in ACTION_OPTIONS ? action2 : null;
+}
+function allowedOptions(entity, action2) {
+  const entityOptions = action2 === "list" || action2 === "add" || action2 === "set" || action2 === "done" ? ENTITY_OPTIONS[entity][action2] : [];
+  return [...COMMON_OPTIONS, ...ACTION_OPTIONS[action2], ...entityOptions];
+}
+function requireId2(id, action2) {
+  if (!id) throw new Error(`"pm ... ${action2}" needs an item id`);
   return id;
 }
 async function buildContext2(parsed, deps) {
@@ -8561,29 +9124,136 @@ async function pmCommand(parsed, deps = {}) {
   const entity = ALIASES[word];
   if (!entity) throw new Error(`unknown pm entity "${word}". Try "odla-ai pm bug list" (goal|task|decision|bug).`);
   const requestedAction = parsed.positionals[2] ?? "list";
-  const action = canonicalAction(requestedAction);
-  if (!action) throw new Error(`unknown pm action "${requestedAction}". Try list|add|get|set|done|comment|comments|rm.`);
-  assertArgs(parsed, allowedOptions(entity, action), 4);
+  const action2 = canonicalAction(requestedAction);
+  if (!action2) throw new Error(`unknown pm action "${requestedAction}". Try list|add|get|set|done|comment|comments|rm.`);
+  assertArgs(parsed, allowedOptions(entity, action2), 4);
   const ctx = await buildContext2(parsed, deps);
   const id = parsed.positionals[3];
-  switch (action) {
+  switch (action2) {
     case "list":
       return pmList(ctx, entity, parsed);
     case "add":
       return pmAdd(ctx, entity, parsed);
     case "get":
-      return pmGet(ctx, entity, requireId2(id, action));
+      return pmGet(ctx, entity, requireId2(id, action2));
     case "set":
-      return pmSet(ctx, entity, requireId2(id, action), parsed);
+      return pmSet(ctx, entity, requireId2(id, action2), parsed);
     case "done":
-      return pmDone(ctx, entity, requireId2(id, action), parsed);
+      return pmDone(ctx, entity, requireId2(id, action2), parsed);
     case "comment":
-      return pmComment(ctx, entity, requireId2(id, action), parsed);
+      return pmComment(ctx, entity, requireId2(id, action2), parsed);
     case "comments":
-      return pmComments(ctx, entity, requireId2(id, action));
+      return pmComments(ctx, entity, requireId2(id, action2));
     case "rm":
-      return pmRemove(ctx, entity, requireId2(id, action));
+      return pmRemove(ctx, entity, requireId2(id, action2));
+  }
+}
+
+// src/platform-output.ts
+function printPlatformStatus(status, out) {
+  out.log(`platform	${status.verdict.status}	${status.observedAt}`);
+  out.log(
+    `fleet	${status.summary.healthy}/${status.summary.services} healthy	${status.summary.required} required	${status.summary.unreachable} unreachable	${status.summary.notConfigured} not configured`
+  );
+  out.log(`catalog	${status.catalog.revision}`);
+  out.log(
+    "service	required	health	probe ms	version	provider	age	requests	errors	cpu p99 us	wall p99 us"
+  );
+  for (const service of status.services) {
+    const metrics = service.provider.metrics;
+    out.log([
+      service.id,
+      service.required ? "yes" : "no",
+      service.health.status,
+      value(service.health.latencyMs),
+      service.release.observedVersionId ?? "unknown",
+      service.provider.status,
+      age(service.provider.ageMs),
+      value(metrics?.requests),
+      value(metrics?.errors),
+      value(metrics?.cpuTimeP99),
+      value(metrics?.wallTimeP99)
+    ].join("	"));
+  }
+  if (status.verdict.reasons.length) {
+    out.log(`reasons	${status.verdict.reasons.join(", ")}`);
+  }
+  for (const action2 of status.nextActions) {
+    out.log(`next	${action2.service}	${action2.code}	${action2.message}`);
+  }
+}
+function value(input) {
+  return input === null || input === void 0 ? "unknown" : String(input);
+}
+function age(input) {
+  if (input === null) return "unknown";
+  if (input < 1e3) return `${input}ms`;
+  if (input < 6e4) return `${Math.round(input / 1e3)}s`;
+  return `${Math.round(input / 6e4)}m`;
+}
+
+// src/platform-command.ts
+async function platformCommand(parsed, deps = {}) {
+  assertArgs(
+    parsed,
+    ["config", "context", "platform", "token", "email", "open", "json"],
+    2
+  );
+  const action2 = parsed.positionals[1];
+  if (action2 !== "status") {
+    throw new Error(
+      `unknown platform action "${action2 ?? ""}". Try "odla-ai platform status --json".`
+    );
+  }
+  const context = await resolveOperatorContext(parsed, {
+    allowMissingConfig: true
+  });
+  const platform = context.platform.value;
+  const doFetch = deps.fetch ?? fetch;
+  const out = deps.stdout ?? console;
+  const token = await resolveAdminPlatformToken({
+    platform,
+    scope: "platform:status:read",
+    token: stringOpt(parsed.options.token),
+    tokenFile: context.credentials.scopedTokenFile,
+    email: stringOpt(parsed.options.email),
+    open: parsed.options.open === false ? false : parsed.options.open === true ? true : void 0,
+    fetch: doFetch,
+    stdout: out,
+    openApprovalUrl: deps.openUrl,
+    label: "odla CLI (platform fleet status)"
+  });
+  const response2 = await doFetch(`${platform}/registry/platform/status`, {
+    headers: { authorization: `Bearer ${token}` }
+  });
+  const body = await response2.json().catch(() => null);
+  if (!response2.ok) {
+    throw new Error(
+      `read platform status failed (HTTP ${response2.status}): ${apiMessage(body)}`
+    );
+  }
+  if (!isPlatformStatus(body)) {
+    throw new Error("platform returned an invalid odla.platform-status/v1 envelope");
   }
+  if (parsed.options.json === true) {
+    out.log(JSON.stringify(body, null, 2));
+  } else {
+    printPlatformStatus(body, out);
+  }
+}
+function isPlatformStatus(value2) {
+  if (!record5(value2) || value2.schemaVersion !== "odla.platform-status/v1") return false;
+  if (!record5(value2.verdict) || !Array.isArray(value2.verdict.reasons)) return false;
+  if (!record5(value2.catalog) || !record5(value2.summary)) return false;
+  return Array.isArray(value2.services) && Array.isArray(value2.nextActions);
+}
+function apiMessage(value2) {
+  if (!record5(value2)) return "request failed";
+  const error = record5(value2.error) ? value2.error : value2;
+  return typeof error.message === "string" ? error.message : typeof error.code === "string" ? error.code : "request failed";
+}
+function record5(value2) {
+  return !!value2 && typeof value2 === "object" && !Array.isArray(value2);
 }
 
 // src/o11y-verdict.ts
@@ -8623,7 +9293,7 @@ function statusVerdict(reads) {
       severity: "degraded"
     });
   }
-  const performance = record5(reads.liveSync.body.performance) ? reads.liveSync.body.performance : null;
+  const performance = record6(reads.liveSync.body.performance) ? reads.liveSync.body.performance : null;
   if (performance?.status === "unavailable") {
     reasons.push({
       source: "liveSync",
@@ -8704,11 +9374,11 @@ function statusVerdict(reads) {
     reasons
   };
 }
-function record5(value) {
-  return Boolean(value) && typeof value === "object" && !Array.isArray(value);
+function record6(value2) {
+  return Boolean(value2) && typeof value2 === "object" && !Array.isArray(value2);
 }
-function numeric2(value) {
-  return typeof value === "number" && Number.isFinite(value) ? value : 0;
+function numeric2(value2) {
+  return typeof value2 === "number" && Number.isFinite(value2) ? value2 : 0;
 }
 function collectorReason(read3, fallback) {
   const reasons = read3.body.reasons;
@@ -8732,7 +9402,7 @@ function printO11yStatus(status, out) {
   out.log(
     `o11y status ${status.scope.appId}/${status.scope.env} (${status.scope.minutes}m)`
   );
-  const routes = Array.isArray(status.application.body.routes) ? status.application.body.routes.filter(record6) : [];
+  const routes = Array.isArray(status.application.body.routes) ? status.application.body.routes.filter(record7) : [];
   const requests = routes.reduce(
     (total, row) => total + numeric3(row.requests),
     0
@@ -8744,39 +9414,39 @@ function printO11yStatus(status, out) {
   out.log(
     `application	${status.application.httpStatus}	${requests} requests	${errors} errors`
   );
-  const versions = Array.isArray(status.applicationVersions.body.rows) ? status.applicationVersions.body.rows.filter(record6) : [];
+  const versions = Array.isArray(status.applicationVersions.body.rows) ? status.applicationVersions.body.rows.filter(record7) : [];
   out.log(
     `application-versions	${status.applicationVersions.httpStatus}	${versions.length ? versions.slice(0, 5).map(
       (row) => `${String(row.value || "(unattributed)")}:${numeric3(row.requests)}`
     ).join(", ") : "none observed"}`
   );
   out.log(liveSyncLine(status.liveSync));
-  const canaryDurations = record6(status.canary.body.durationsMs) ? status.canary.body.durationsMs : {};
+  const canaryDurations = record7(status.canary.body.durationsMs) ? status.canary.body.durationsMs : {};
   out.log(
     `canary	${status.canary.httpStatus}	${String(status.canary.body.status ?? status.canary.body.error ?? "unavailable")}	${optionalNumeric(canaryDurations.publishToVisibleMs)} publish-to-visible`
   );
-  const collectorIngest = record6(status.collector.body.ingest) ? status.collector.body.ingest : {};
-  const collectorStorage = record6(collectorIngest.storage) ? collectorIngest.storage : {};
+  const collectorIngest = record7(status.collector.body.ingest) ? status.collector.body.ingest : {};
+  const collectorStorage = record7(collectorIngest.storage) ? collectorIngest.storage : {};
   out.log(
     `collector	${status.collector.httpStatus}	${String(status.collector.body.status ?? status.collector.body.error ?? "unavailable")}	${numeric3(collectorStorage.affectedPoints)} affected points`
   );
-  const providerMetrics = record6(status.provider.body.metrics) ? status.provider.body.metrics : {};
-  const providerCapacity = record6(status.provider.body.capacity) ? status.provider.body.capacity : {};
-  const workerMemory = record6(providerCapacity.memory) ? providerCapacity.memory : {};
+  const providerMetrics = record7(status.provider.body.metrics) ? status.provider.body.metrics : {};
+  const providerCapacity = record7(status.provider.body.capacity) ? status.provider.body.capacity : {};
+  const workerMemory = record7(providerCapacity.memory) ? providerCapacity.memory : {};
   out.log(
     `cloudflare	${status.provider.httpStatus}	${String(status.provider.body.status ?? status.provider.body.error ?? "unavailable")}	${numeric3(providerMetrics.requests)} invocations	${numeric3(providerMetrics.errors)} runtime errors	${optionalBytes(workerMemory.headroomBytes)} isolate memory headroom`
   );
   for (const line of providerCapacityLines(status.providerCapacity)) {
     out.log(line);
   }
-  const coverage = record6(status.providerReconciliation.body.comparison) ? status.providerReconciliation.body.comparison : {};
-  const coverageCounts = record6(status.providerReconciliation.body.counts) ? status.providerReconciliation.body.counts : {};
-  const coverageBudget = record6(status.providerReconciliation.body.budget) ? status.providerReconciliation.body.budget : {};
+  const coverage = record7(status.providerReconciliation.body.comparison) ? status.providerReconciliation.body.comparison : {};
+  const coverageCounts = record7(status.providerReconciliation.body.counts) ? status.providerReconciliation.body.counts : {};
+  const coverageBudget = record7(status.providerReconciliation.body.budget) ? status.providerReconciliation.body.budget : {};
   out.log(
     `request-coverage	${status.providerReconciliation.httpStatus}	${String(status.providerReconciliation.body.status ?? status.providerReconciliation.body.error ?? "unavailable")}	${optionalPercent(coverage.applicationCoverage)} application/provider	${numeric3(coverageCounts.applicationRequests)}/${numeric3(coverageCounts.providerRequests)} requests	\xB1${optionalPercent(coverageBudget.maxRelativeError)} budget`
   );
   const providerPoints = Array.isArray(status.providerHistory.body.points) ? status.providerHistory.body.points.length : 0;
-  const providerFreshness = record6(status.providerHistory.body.freshness) ? status.providerHistory.body.freshness : {};
+  const providerFreshness = record7(status.providerHistory.body.freshness) ? status.providerHistory.body.freshness : {};
   out.log(
     `cloudflare-history	${status.providerHistory.httpStatus}	${String(status.providerHistory.body.status ?? status.providerHistory.body.error ?? "unavailable")}	${providerPoints} snapshots	${optionalAge(providerFreshness.ageMs)} old`
   );
@@ -8785,17 +9455,17 @@ function printO11yStatus(status, out) {
   );
 }
 function providerCapacityLines(read3) {
-  const resources = record6(read3.body.resources) ? read3.body.resources : {};
-  const durableObjects = record6(resources.durableObjects) ? resources.durableObjects : {};
-  const periodic = record6(durableObjects.periodic) ? durableObjects.periodic : {};
-  const storage = record6(durableObjects.sqliteStorage) ? durableObjects.sqliteStorage : {};
-  const d1 = record6(resources.d1) ? resources.d1 : {};
-  const d1Activity = record6(d1.activity) ? d1.activity : {};
-  const d1Storage = record6(d1.storage) ? d1.storage : {};
-  const d1Latency = record6(d1Activity.latency) ? d1Activity.latency : {};
-  const r2 = record6(resources.r2) ? resources.r2 : {};
-  const r2Operations = record6(r2.operations) ? r2.operations : {};
-  const r2Storage = record6(r2.storage) ? r2.storage : {};
+  const resources = record7(read3.body.resources) ? read3.body.resources : {};
+  const durableObjects = record7(resources.durableObjects) ? resources.durableObjects : {};
+  const periodic = record7(durableObjects.periodic) ? durableObjects.periodic : {};
+  const storage = record7(durableObjects.sqliteStorage) ? durableObjects.sqliteStorage : {};
+  const d1 = record7(resources.d1) ? resources.d1 : {};
+  const d1Activity = record7(d1.activity) ? d1.activity : {};
+  const d1Storage = record7(d1.storage) ? d1.storage : {};
+  const d1Latency = record7(d1Activity.latency) ? d1Activity.latency : {};
+  const r2 = record7(resources.r2) ? resources.r2 : {};
+  const r2Operations = record7(r2.operations) ? r2.operations : {};
+  const r2Storage = record7(r2.storage) ? r2.storage : {};
   const status = String(
     read3.body.status ?? read3.body.error ?? "unavailable"
   );
@@ -8806,42 +9476,42 @@ function providerCapacityLines(read3) {
   ];
 }
 function liveSyncLine(read3) {
-  const performance = record6(read3.body.performance) ? read3.body.performance : {};
-  const commitToSend = record6(performance.commitToSend) ? performance.commitToSend : {};
+  const performance = record7(read3.body.performance) ? read3.body.performance : {};
+  const commitToSend = record7(performance.commitToSend) ? performance.commitToSend : {};
   return `live-sync	${read3.httpStatus}	${String(read3.body.status ?? read3.body.error ?? "unavailable")}	${numeric3(read3.body.activeConnections)} active	${optionalNumeric(commitToSend.p95)} commit-to-send p95	${numeric3(performance.sendFailures)} send failures`;
 }
-function record6(value) {
-  return Boolean(value) && typeof value === "object" && !Array.isArray(value);
+function record7(value2) {
+  return Boolean(value2) && typeof value2 === "object" && !Array.isArray(value2);
 }
-function numeric3(value) {
-  return typeof value === "number" && Number.isFinite(value) ? value : 0;
+function numeric3(value2) {
+  return typeof value2 === "number" && Number.isFinite(value2) ? value2 : 0;
 }
-function optionalNumeric(value) {
-  return typeof value === "number" && Number.isFinite(value) ? `${value} ms` : "\u2014";
+function optionalNumeric(value2) {
+  return typeof value2 === "number" && Number.isFinite(value2) ? `${value2} ms` : "\u2014";
 }
-function optionalAge(value) {
-  if (typeof value !== "number" || !Number.isFinite(value)) return "unknown";
-  return `${Math.max(0, Math.round(value / 1e3))}s`;
+function optionalAge(value2) {
+  if (typeof value2 !== "number" || !Number.isFinite(value2)) return "unknown";
+  return `${Math.max(0, Math.round(value2 / 1e3))}s`;
 }
-function optionalPercent(value) {
-  return typeof value === "number" && Number.isFinite(value) ? `${Math.round(value * 100)}%` : "\u2014";
+function optionalPercent(value2) {
+  return typeof value2 === "number" && Number.isFinite(value2) ? `${Math.round(value2 * 100)}%` : "\u2014";
 }
-function optionalBytes(value) {
-  if (typeof value !== "number" || !Number.isFinite(value)) return "\u2014";
-  if (value >= 1024 * 1024 * 1024) {
-    return `${(value / (1024 * 1024 * 1024)).toFixed(2)} GiB`;
+function optionalBytes(value2) {
+  if (typeof value2 !== "number" || !Number.isFinite(value2)) return "\u2014";
+  if (value2 >= 1024 * 1024 * 1024) {
+    return `${(value2 / (1024 * 1024 * 1024)).toFixed(2)} GiB`;
   }
-  if (value >= 1024 * 1024) {
-    return `${(value / (1024 * 1024)).toFixed(1)} MiB`;
+  if (value2 >= 1024 * 1024) {
+    return `${(value2 / (1024 * 1024)).toFixed(1)} MiB`;
   }
-  if (value >= 1024) return `${(value / 1024).toFixed(1)} KiB`;
-  return `${Math.round(value)} B`;
+  if (value2 >= 1024) return `${(value2 / 1024).toFixed(1)} KiB`;
+  return `${Math.round(value2)} B`;
 }
-function optionalCount(value, unit) {
-  return typeof value === "number" && Number.isFinite(value) ? `${value} ${unit}` : `\u2014 ${unit}`;
+function optionalCount(value2, unit) {
+  return typeof value2 === "number" && Number.isFinite(value2) ? `${value2} ${unit}` : `\u2014 ${unit}`;
 }
-function optionalAgeSeconds(value) {
-  return typeof value === "number" && Number.isFinite(value) ? `${Math.max(0, Math.round(value))}s` : "unknown";
+function optionalAgeSeconds(value2) {
+  return typeof value2 === "number" && Number.isFinite(value2) ? `${Math.max(0, Math.round(value2))}s` : "unknown";
 }
 
 // src/o11y-command.ts
@@ -8861,10 +9531,10 @@ async function o11yCommand(parsed, deps = {}) {
     ],
     2
   );
-  const action = parsed.positionals[1];
-  if (action !== "status") {
+  const action2 = parsed.positionals[1];
+  if (action2 !== "status") {
     throw new Error(
-      `unknown o11y action "${action ?? ""}". Try "odla-ai o11y status --json".`
+      `unknown o11y action "${action2 ?? ""}". Try "odla-ai o11y status --json".`
     );
   }
   const minutes = statusMinutes(
@@ -8971,11 +9641,11 @@ async function o11yCommand(parsed, deps = {}) {
   }
   printO11yStatus(status, out);
 }
-function statusMinutes(value) {
-  if (!Number.isSafeInteger(value) || value < 1 || value > 7 * 24 * 60) {
+function statusMinutes(value2) {
+  if (!Number.isSafeInteger(value2) || value2 < 1 || value2 > 7 * 24 * 60) {
     throw new Error("--minutes must be an integer from 1 to 10080");
   }
-  return value;
+  return value2;
 }
 async function read2(url, headers, doFetch) {
   const response2 = await doFetch(url, { headers });
@@ -8983,8 +9653,8 @@ async function read2(url, headers, doFetch) {
   let body = {};
   if (text) {
     try {
-      const value = JSON.parse(text);
-      body = value && typeof value === "object" && !Array.isArray(value) ? value : { value };
+      const value2 = JSON.parse(text);
+      body = value2 && typeof value2 === "object" && !Array.isArray(value2) ? value2 : { value: value2 };
     } catch {
       body = { message: text.slice(0, 300) };
     }
@@ -8993,7 +9663,7 @@ async function read2(url, headers, doFetch) {
 }
 
 // src/provision.ts
-var import_apps7 = require("@odla-ai/apps");
+var import_apps10 = require("@odla-ai/apps");
 var import_ai3 = require("@odla-ai/ai");
 var import_node_process10 = __toESM(require("process"), 1);
 
@@ -9003,7 +9673,7 @@ async function provisionIntegrationSeeds(doFetch, endpoint, tenantId, dbKey, int
   const base = `${endpoint}/app/${encodeURIComponent(tenantId)}`;
   for (const integration of integrations) {
     for (const seed of integration.seeds ?? []) {
-      const payload = await postJson2(doFetch, `${base}/query`, dbKey, {
+      const payload = await postJson3(doFetch, `${base}/query`, dbKey, {
         query: { [seed.ns]: { $: { where: { [seed.key.attr]: seed.key.value }, limit: 1 } } }
       });
       const rows = isRecord7(payload) && isRecord7(payload.result) ? payload.result[seed.ns] : void 0;
@@ -9014,7 +9684,7 @@ async function provisionIntegrationSeeds(doFetch, endpoint, tenantId, dbKey, int
         out.log(`${env}: integration ${integration.id} seed ${seed.id} already exists`);
         continue;
       }
-      await postJson2(doFetch, `${base}/transact`, dbKey, {
+      await postJson3(doFetch, `${base}/transact`, dbKey, {
         mutationId: `integration:${integration.id}:seed:${seed.id}`,
         ops: [{
           t: "update",
@@ -9029,7 +9699,7 @@ async function provisionIntegrationSeeds(doFetch, endpoint, tenantId, dbKey, int
     }
   }
 }
-async function postJson2(doFetch, url, bearer, body) {
+async function postJson3(doFetch, url, bearer, body) {
   const res = await doFetch(url, {
     method: "POST",
     headers: { authorization: `Bearer ${bearer}`, "content-type": "application/json" },
@@ -9038,8 +9708,8 @@ async function postJson2(doFetch, url, bearer, body) {
   if (!res.ok) throw new Error(`${new URL(url).pathname} failed: ${res.status} ${await responseText(res)}`);
   return res.json().catch(() => ({}));
 }
-function isRecord7(value) {
-  return value !== null && typeof value === "object" && !Array.isArray(value);
+function isRecord7(value2) {
+  return value2 !== null && typeof value2 === "object" && !Array.isArray(value2);
 }
 async function responseText(res) {
   try {
@@ -9050,9 +9720,9 @@ async function responseText(res) {
 }
 
 // src/provision-credentials.ts
-var import_apps5 = require("@odla-ai/apps");
+var import_apps9 = require("@odla-ai/apps");
 async function provisionEnvCredentials(opts) {
-  const tenantId = (0, import_apps5.tenantIdFor)(opts.cfg.app.id, opts.env);
+  const tenantId = (0, import_apps9.tenantIdFor)(opts.cfg.app.id, opts.env);
   const prior = opts.credentials?.envs[opts.env];
   let credentials = opts.credentials;
   let dbKey = opts.cfg.services.includes("db") && !opts.rotateDb ? prior?.dbKey : void 0;
@@ -9108,14 +9778,14 @@ async function mintDbKey(opts, tenantId) {
         appId: tenantId
       })
     });
-    if (!created.ok) throw new Error(`db app create (${tenantId}) failed: ${created.status} ${await safeText4(created)}`);
+    if (!created.ok) throw new Error(`db app create (${tenantId}) failed: ${created.status} ${await safeText5(created)}`);
     res = await opts.fetch(`${opts.cfg.dbEndpoint}/admin/apps/${encodeURIComponent(tenantId)}/keys`, {
       method: "POST",
       headers,
       body: "{}"
     });
   }
-  if (!res.ok) throw new Error(`db key mint (${tenantId}) failed: ${res.status} ${await safeText4(res)}`);
+  if (!res.ok) throw new Error(`db key mint (${tenantId}) failed: ${res.status} ${await safeText5(res)}`);
   const body = await res.json();
   if (!body.key) throw new Error(`db key mint (${tenantId}) returned no key`);
   return body.key;
@@ -9131,58 +9801,11 @@ async function issueO11yToken(opts) {
       `o11y token already exists for env "${opts.env}", but its shown-once value is not in the local credentials file; run "odla-ai provision --rotate-o11y-token --push-secrets" to replace it explicitly`
     );
   }
-  if (!res.ok) throw new Error(`o11y token ${opts.rotateO11y ? "rotation" : "issue"} (${opts.env}) failed: ${res.status} ${await safeText4(res)}`);
+  if (!res.ok) throw new Error(`o11y token ${opts.rotateO11y ? "rotation" : "issue"} (${opts.env}) failed: ${res.status} ${await safeText5(res)}`);
   const body = await res.json();
   if (!body.token) throw new Error(`o11y token ${opts.rotateO11y ? "rotation" : "issue"} (${opts.env}) returned no token`);
   return body.token;
 }
-async function safeText4(res) {
-  try {
-    return redactSecrets((await res.text()).slice(0, 500));
-  } catch {
-    return "";
-  }
-}
-
-// src/provision-helpers.ts
-var import_ai2 = require("@odla-ai/ai");
-var import_apps6 = require("@odla-ai/apps");
-function defaultSecretName(provider) {
-  const names = import_ai2.DEFAULT_SECRET_NAMES;
-  return names[provider] ?? `${provider}_api_key`;
-}
-async function assertTenantAdminAccess(doFetch, cfg, env, token) {
-  const tenantId = (0, import_apps6.tenantIdFor)(cfg.app.id, env);
-  const res = await doFetch(`${cfg.dbEndpoint}/admin/apps/${encodeURIComponent(tenantId)}/entitlements`, {
-    headers: { authorization: `Bearer ${token}` }
-  });
-  if (res.ok || res.status === 404) return;
-  if (res.status === 403) {
-    throw new Error(
-      `${env}: you are not an owner of "${cfg.app.id}" (tenant ${tenantId}) \u2014 nothing was minted or written; ask an existing owner to run "odla-ai app owners add <your-email>", then re-run provision`
-    );
-  }
-  throw new Error(`${env}: tenant access preflight (${tenantId}) failed: ${res.status} ${await safeText5(res)}`);
-}
-async function postJson3(doFetch, url, bearer, body) {
-  const res = await doFetch(url, {
-    method: "POST",
-    headers: { authorization: `Bearer ${bearer}`, "content-type": "application/json" },
-    body: JSON.stringify(body)
-  });
-  if (!res.ok) throw new Error(`${new URL(url).pathname} failed: ${res.status} ${await safeText5(res)}`);
-}
-function normalizeClerkConfig(value) {
-  if (!value) return null;
-  if (typeof value === "string") {
-    const publishableKey2 = envValue(value);
-    return publishableKey2 ? { publishableKey: publishableKey2 } : null;
-  }
-  if (typeof value !== "object") return null;
-  const cfg = value;
-  const publishableKey = envValue(cfg.publishableKey);
-  return publishableKey ? { publishableKey, ...cfg.audience ? { audience: cfg.audience } : {}, ...cfg.mode ? { mode: cfg.mode } : {} } : null;
-}
 async function safeText5(res) {
   try {
     return redactSecrets((await res.text()).slice(0, 500));
@@ -9261,7 +9884,7 @@ async function provision(options) {
   }
   const doFetch = options.fetch ?? fetch;
   const token = await getDeveloperToken(cfg, options, doFetch, out);
-  const apps = (0, import_apps7.createAppsClient)({ endpoint: cfg.platformUrl, token, fetcher: { fetch: doFetch } });
+  const apps = (0, import_apps10.createAppsClient)({ endpoint: cfg.platformUrl, token, fetcher: { fetch: doFetch } });
   const existing = await apps.resolveApp(cfg.app.id);
   if (existing) {
     out.log(`app: ${cfg.app.id} already exists`);
@@ -9272,7 +9895,7 @@ async function provision(options) {
   for (const env of cfg.envs) {
     await assertTenantAdminAccess(doFetch, cfg, env, token);
   }
-  const serviceOrder = (0, import_apps7.orderAppServices)(cfg.services);
+  const serviceOrder = (0, import_apps10.orderAppServices)(cfg.services);
   for (const env of cfg.envs) {
     for (const service of serviceOrder) {
       if (service === "ai") {
@@ -9305,7 +9928,7 @@ async function provision(options) {
     }
   }
   for (const env of cfg.envs) {
-    const tenantId = (0, import_apps7.tenantIdFor)(cfg.app.id, env);
+    const tenantId = (0, import_apps10.tenantIdFor)(cfg.app.id, env);
     credentials = await provisionEnvCredentials({
       cfg,
       env,
@@ -9338,11 +9961,11 @@ ${env}: credentials are already saved; retry "odla-ai secrets push --env ${env}$
       }
     }
     if (schema && dbKey) {
-      await postJson3(doFetch, `${cfg.dbEndpoint}/app/${encodeURIComponent(tenantId)}/schema`, dbKey, { schema });
+      await postJson(doFetch, `${cfg.dbEndpoint}/app/${encodeURIComponent(tenantId)}/schema`, dbKey, { schema });
       out.log(`${env}: schema pushed`);
     }
     if (rules) {
-      await postJson3(doFetch, `${cfg.dbEndpoint}/app/${encodeURIComponent(tenantId)}/admin/rules`, token, rules);
+      await postJson(doFetch, `${cfg.dbEndpoint}/app/${encodeURIComponent(tenantId)}/admin/rules`, token, rules);
       out.log(`${env}: rules pushed (${Object.keys(rules).length} namespaces)`);
     }
     if (dbKey) {
@@ -9439,6 +10062,7 @@ var COMMAND_SURFACE = {
   calendar: { status: {}, calendars: {}, connect: {}, disconnect: {} },
   capabilities: {},
   code: { connect: {} },
+  config: { diff: {}, plan: {} },
   context: { show: {}, list: {}, save: {}, remove: {} },
   // `watch`, `read`, `reply`, and `resolve` take a topic id from there on.
   discuss: {
@@ -9456,6 +10080,7 @@ var COMMAND_SURFACE = {
   help: {},
   init: {},
   o11y: { status: {} },
+  platform: { status: {} },
   pm: {
     ...PM_ENTITIES,
     handoff: {}
@@ -9539,7 +10164,7 @@ function recordInvocation(parsed) {
   try {
     const entry = {
       path: invocationPath(parsed.positionals),
-      options: Object.entries(parsed.options).map(([name, value]) => value === false ? `no-${name}` : name).sort()
+      options: Object.entries(parsed.options).map(([name, value2]) => value2 === false ? `no-${name}` : name).sort()
     };
     if (!entry.path.length) return;
     (0, import_node_fs15.appendFileSync)(file, `${JSON.stringify(entry)}
@@ -9553,10 +10178,10 @@ var import_node_fs16 = require("fs");
 
 // src/runbook-requires.ts
 var SPEC = /^(@?[\w./-]+?)@(\d+\.\d+\.\d+(?:[\w.-]*)?)$/;
-function parseRequires(value) {
-  if (!value) return [];
+function parseRequires(value2) {
+  if (!value2) return [];
   const out = [];
-  for (const token of value.split(/[\s,]+/).filter(Boolean)) {
+  for (const token of value2.split(/[\s,]+/).filter(Boolean)) {
     const match = SPEC.exec(token);
     if (match?.[1] && match[2]) out.push({ name: match[1], min: match[2] });
   }
@@ -9722,7 +10347,7 @@ async function runbookRemove(ctx, slug) {
 
 // src/runbook-import.ts
 var import_node_fs17 = require("fs");
-var import_node_path13 = require("path");
+var import_node_path14 = require("path");
 function parseRunbook(text, slug) {
   let rest = text;
   const meta = {};
@@ -9732,9 +10357,9 @@ function parseRunbook(text, slug) {
     for (const line of fm[1].split(/\r?\n/)) {
       const pair = /^(\w+)\s*:\s*(.+)$/.exec(line.trim());
       if (!pair) continue;
-      const value = pair[2].trim().replace(/^["']|["']$/g, "");
-      if (pair[1] === "summary") meta.summary = value;
-      if (pair[1] === "tags") meta.tags = value.replace(/^\[|\]$/g, "").trim();
+      const value2 = pair[2].trim().replace(/^["']|["']$/g, "");
+      if (pair[1] === "summary") meta.summary = value2;
+      if (pair[1] === "tags") meta.tags = value2.replace(/^\[|\]$/g, "").trim();
     }
   }
   const lines = rest.split("\n");
@@ -9751,8 +10376,8 @@ function readRunbookDir(dir) {
   const files = (0, import_node_fs17.readdirSync)(dir).filter((f) => f.endsWith(".md")).sort();
   if (!files.length) throw new Error(`no .md files in ${dir}`);
   return files.map((file) => {
-    const slug = (0, import_node_path13.basename)(file, ".md");
-    const parsed = parseRunbook((0, import_node_fs17.readFileSync)((0, import_node_path13.join)(dir, file), "utf8"), slug);
+    const slug = (0, import_node_path14.basename)(file, ".md");
+    const parsed = parseRunbook((0, import_node_fs17.readFileSync)((0, import_node_path14.join)(dir, file), "utf8"), slug);
     return { file, slug, ...parsed, words: parsed.body.split(/\s+/).filter(Boolean).length };
   });
 }
@@ -9825,7 +10450,7 @@ async function upsert(ctx, r, visibility) {
 // src/runbook-impact.ts
 var import_node_child_process7 = require("child_process");
 var import_node_fs18 = require("fs");
-var import_node_path14 = require("path");
+var import_node_path15 = require("path");
 
 // src/runbook-impact-scan.ts
 var DECL = /^[+-]\s*export\s+(?:declare\s+)?(?:default\s+)?(?:abstract\s+)?(?:async\s+)?(?:const|let|var|function|class|interface|type|enum)\s+([A-Za-z_$][\w$]*)/;
@@ -9851,7 +10476,7 @@ var NOISE = /* @__PURE__ */ new Set([
   "and",
   "for"
 ]);
-var words = (value) => value.replace(/^@[\w-]+\//, "").split(/[^A-Za-z0-9]+/).filter((w) => w.length > 1 && !NOISE.has(w.toLowerCase()));
+var words = (value2) => value2.replace(/^@[\w-]+\//, "").split(/[^A-Za-z0-9]+/).filter((w) => w.length > 1 && !NOISE.has(w.toLowerCase()));
 function namedExports(clause) {
   return clause.split(",").map((part) => part.trim().split(/\s+as\s+/)[0]?.trim() ?? "").filter((name) => /^[A-Za-z_$][\w$]*$/.test(name) && name !== "type");
 }
@@ -9994,7 +10619,7 @@ ${body.split("\n").map((line) => `+${line}`).join("\n")}
 }
 function manifestLabeller(root) {
   return (workspace) => {
-    const manifest = (0, import_node_path14.join)(root, workspace, "package.json");
+    const manifest = (0, import_node_path15.join)(root, workspace, "package.json");
     if (!(0, import_node_fs18.existsSync)(manifest)) return void 0;
     try {
       const name = JSON.parse((0, import_node_fs18.readFileSync)(manifest, "utf8")).name;
@@ -10064,7 +10689,7 @@ function report3(ctx, impacts) {
 async function runbookImpact(ctx, options, deps = {}) {
   const cwd = deps.cwd ?? process.cwd();
   const runGit = deps.runGit ?? gitRunner(cwd);
-  const read3 = deps.readRepoFile ?? ((path) => (0, import_node_fs18.readFileSync)((0, import_node_path14.join)(cwd, path), "utf8"));
+  const read3 = deps.readRepoFile ?? ((path) => (0, import_node_fs18.readFileSync)((0, import_node_path15.join)(cwd, path), "utf8"));
   const surfaces = changedSurfaces(collectDiff(runGit, options.base, read3), manifestLabeller(cwd));
   if (!surfaces.length) {
     return ctx.out.log(
@@ -10199,13 +10824,13 @@ async function runbookComment(ctx, slug, body) {
 var import_node_child_process8 = require("child_process");
 var import_node_fs19 = require("fs");
 var import_node_os5 = require("os");
-var import_node_path15 = require("path");
+var import_node_path16 = require("path");
 var import_node_process12 = __toESM(require("process"), 1);
 var EDITOR_ENV = ["ODLA_EDITOR", "VISUAL", "EDITOR"];
 function resolveEditor(env = import_node_process12.default.env) {
   for (const name of EDITOR_ENV) {
-    const value = env[name];
-    if (value && value.trim()) return value.trim();
+    const value2 = env[name];
+    if (value2 && value2.trim()) return value2.trim();
   }
   return null;
 }
@@ -10225,8 +10850,8 @@ function editText(initial, slug, deps = {}) {
     );
   if (!interactive())
     throw new Error(`cannot open an editor without a terminal \u2014 pass --file <path> or --body "\u2026" instead`);
-  const dir = (0, import_node_fs19.mkdtempSync)((0, import_node_path15.join)((0, import_node_os5.tmpdir)(), "odla-runbook-"));
-  const file = (0, import_node_path15.join)(dir, `${slug}.md`);
+  const dir = (0, import_node_fs19.mkdtempSync)((0, import_node_path16.join)((0, import_node_os5.tmpdir)(), "odla-runbook-"));
+  const file = (0, import_node_path16.join)(dir, `${slug}.md`);
   try {
     (0, import_node_fs19.writeFileSync)(file, initial, { mode: 384 });
     const code = defaultRunOrInjected(deps)(editor, file);
@@ -10334,12 +10959,12 @@ var ALLOWED2 = [
   "platform",
   "context"
 ];
-function requireSlug(slug, action) {
-  if (!slug) throw new Error(`"runbook ${action}" needs a slug, e.g. "odla-ai runbook ${action} release"`);
+function requireSlug(slug, action2) {
+  if (!slug) throw new Error(`"runbook ${action2}" needs a slug, e.g. "odla-ai runbook ${action2} release"`);
   return slug;
 }
 var WRITES = /* @__PURE__ */ new Set(["new", "edit", "publish", "archive", "visibility", "revert", "rm", "import"]);
-async function buildContext3(parsed, deps, action) {
+async function buildContext3(parsed, deps, action2) {
   const appIdOption = stringOpt(parsed.options.app);
   const context = await resolveOperatorContext(parsed, {
     allowMissingConfig: true
@@ -10349,7 +10974,7 @@ async function buildContext3(parsed, deps, action) {
   const out = deps.stdout ?? console;
   const appId = appIdOption ?? (context.app.source === "environment" || context.app.source === "profile" ? context.app.value : null) ?? PLATFORM_SCOPE;
   const dryRun = parsed.options["dry-run"] === true;
-  if (action === "import" && dryRun) {
+  if (action2 === "import" && dryRun) {
     return {
       platformUrl: cfg.platformUrl,
       token: "",
@@ -10359,12 +10984,12 @@ async function buildContext3(parsed, deps, action) {
       appId
     };
   }
-  const needsCapability = WRITES.has(action) && !dryRun && appId === PLATFORM_SCOPE && !stringOpt(parsed.options.token);
+  const needsCapability = WRITES.has(action2) && !dryRun && appId === PLATFORM_SCOPE && !stringOpt(parsed.options.token);
   const token = needsCapability ? await getScopedPlatformToken({
     platform: cfg.platformUrl,
     scope: "platform:runbook:write",
     email: stringOpt(parsed.options.email),
-    label: `odla CLI (runbook ${action})`,
+    label: `odla CLI (runbook ${action2})`,
     fetch: doFetch,
     stdout: out,
     openApprovalUrl: deps.openUrl,
@@ -10399,11 +11024,11 @@ async function buildContext3(parsed, deps, action) {
   };
 }
 async function runbookCommand(parsed, deps = {}) {
-  const action = parsed.positionals[1] ?? "list";
-  assertArgs(parsed, ALLOWED2, action === "ask" || action === "search" ? 64 : 4);
-  const ctx = await buildContext3(parsed, deps, action);
+  const action2 = parsed.positionals[1] ?? "list";
+  assertArgs(parsed, ALLOWED2, action2 === "ask" || action2 === "search" ? 64 : 4);
+  const ctx = await buildContext3(parsed, deps, action2);
   const slug = parsed.positionals[2];
-  switch (action) {
+  switch (action2) {
     case "list":
       return runbookList(ctx, parsed.options.all === true, stringOpt(parsed.options.q));
     case "ask": {
@@ -10470,9 +11095,9 @@ async function runbookCommand(parsed, deps = {}) {
       });
     }
     case "visibility": {
-      const value = parsed.positionals[3] ?? stringOpt(parsed.options.visibility);
-      if (!value) throw new Error('"runbook visibility" needs operator|admin, e.g. "runbook visibility release operator"');
-      return runbookVisibility(ctx, requireSlug(slug, "visibility"), value);
+      const value2 = parsed.positionals[3] ?? stringOpt(parsed.options.visibility);
+      if (!value2) throw new Error('"runbook visibility" needs operator|admin, e.g. "runbook visibility release operator"');
+      return runbookVisibility(ctx, requireSlug(slug, "visibility"), value2);
     }
     case "publish":
       return runbookStatus(ctx, requireSlug(slug, "publish"), "published");
@@ -10488,7 +11113,7 @@ async function runbookCommand(parsed, deps = {}) {
     case "rm":
       return runbookRemove(ctx, requireSlug(slug, "rm"));
     default:
-      throw new Error(`unknown runbook action "${action}". Try ${acceptedAfter(["runbook"]).join(", ")}.`);
+      throw new Error(`unknown runbook action "${action2}". Try ${acceptedAfter(["runbook"]).join(", ")}.`);
   }
 }
 
@@ -10528,13 +11153,13 @@ async function interactiveConfirmation(message2, dependencies) {
   }
 }
 function requiredSecurityPositional(parsed, index, label) {
-  const value = parsed.positionals[index];
-  if (!value) throw new Error(`${label} is required`);
-  return value;
+  const value2 = parsed.positionals[index];
+  if (!value2) throw new Error(`${label} is required`);
+  return value2;
 }
-function securityProfile(value) {
-  if (value === void 0) return void 0;
-  if (value === "odla" || value === "cloudflare-app" || value === "generic") return value;
+function securityProfile(value2) {
+  if (value2 === void 0) return void 0;
+  if (value2 === "odla" || value2 === "cloudflare-app" || value2 === "generic") return value2;
   throw new Error("--profile must be odla, cloudflare-app, or generic");
 }
 
@@ -10635,9 +11260,9 @@ function routeLabel(route2) {
   return `${route2.provider}/${route2.model}${route2.policyVersion ? ` policy v${route2.policyVersion}` : ""}`;
 }
 var HOSTED_SEVERITIES = ["informational", "low", "medium", "high", "critical"];
-function hostedSeverity(value, flag) {
-  if (HOSTED_SEVERITIES.includes(value)) {
-    return value;
+function hostedSeverity(value2, flag) {
+  if (HOSTED_SEVERITIES.includes(value2)) {
+    return value2;
   }
   throw new Error(`${flag} must be informational, low, medium, high, or critical`);
 }
@@ -10646,7 +11271,7 @@ function hostedSeverity(value, flag) {
 var import_security2 = require("@odla-ai/security");
 
 // src/security.ts
-var import_node_path16 = require("path");
+var import_node_path17 = require("path");
 var import_security = require("@odla-ai/security");
 var import_node3 = require("@odla-ai/security/node");
 async function runHostedSecurity(options) {
@@ -10658,9 +11283,9 @@ async function runHostedSecurity(options) {
   const appId = selfAudit ? "odla-ai" : cfg.app.id;
   const env = selfAudit ? "prod" : selectEnv(options.env, cfg.envs, cfg.configPath, cfg.rootDir);
   const platform = options.platform ?? cfg?.platformUrl ?? "https://odla.ai";
-  const target = (0, import_node_path16.resolve)(options.target ?? cfg?.rootDir ?? ".");
-  const output = (0, import_node_path16.resolve)(options.out ?? (0, import_node_path16.resolve)(target, ".odla/security/hosted"));
-  const outputRelative = (0, import_node_path16.relative)(target, output).split(import_node_path16.sep).join("/");
+  const target = (0, import_node_path17.resolve)(options.target ?? cfg?.rootDir ?? ".");
+  const output = (0, import_node_path17.resolve)(options.out ?? (0, import_node_path17.resolve)(target, ".odla/security/hosted"));
+  const outputRelative = (0, import_node_path17.relative)(target, output).split(import_node_path17.sep).join("/");
   if (!outputRelative) throw new Error("Hosted security output cannot be the repository root");
   const profile = profileFor(options.profile ?? "odla", options.maxHuntTasks ?? 12);
   const tokenRequest = {
@@ -10672,7 +11297,7 @@ async function runHostedSecurity(options) {
   };
   const token = await injectedToken(options, tokenRequest);
   const snapshot = await (0, import_node3.snapshotDirectory)(target, {
-    exclude: !outputRelative.startsWith("../") && !(0, import_node_path16.isAbsolute)(outputRelative) ? [outputRelative] : []
+    exclude: !outputRelative.startsWith("../") && !(0, import_node_path17.isAbsolute)(outputRelative) ? [outputRelative] : []
   });
   const hosted = await (0, import_security.createPlatformSecurityReasoners)({
     platform,
@@ -10690,7 +11315,7 @@ async function runHostedSecurity(options) {
   });
   const harness = (0, import_security.createSecurityHarness)({
     profile,
-    store: new import_node3.FileRunStore((0, import_node_path16.resolve)(output, "state")),
+    store: new import_node3.FileRunStore((0, import_node_path17.resolve)(output, "state")),
     discoveryReasoner: hosted.discoveryReasoner,
     validationReasoner: hosted.validationReasoner,
     policy: {
@@ -10714,19 +11339,19 @@ async function runHostedSecurity(options) {
 function selectEnv(requested, declared, configPath, rootDir) {
   const env = requested ?? (declared.includes("dev") ? "dev" : declared[0]);
   if (!env || !declared.includes(env)) {
-    const shown = (0, import_node_path16.relative)(rootDir, configPath) || configPath;
+    const shown = (0, import_node_path17.relative)(rootDir, configPath) || configPath;
     throw new Error(`env "${env ?? ""}" is not declared in ${shown}`);
   }
   return env;
 }
 async function injectedToken(options, request2) {
-  const value = options.token ?? await options.getToken?.(Object.freeze({ ...request2 }));
-  if (typeof value !== "string" || value.length < 8 || value.length > 8192 || /\s|[\u0000-\u001f\u007f]/.test(value)) {
+  const value2 = options.token ?? await options.getToken?.(Object.freeze({ ...request2 }));
+  if (typeof value2 !== "string" || value2.length < 8 || value2.length > 8192 || /\s|[\u0000-\u001f\u007f]/.test(value2)) {
     throw new Error(
       request2.selfAudit ? "Self-audit requires an injected, scoped platform security token" : "Hosted security requires an injected app developer token or getToken callback"
     );
   }
-  return value;
+  return value2;
 }
 function profileFor(name, maxHuntTasks) {
   const profile = name === "odla" ? (0, import_security.odlaProfile)() : name === "cloudflare-app" ? (0, import_security.cloudflareAppProfile)() : name === "generic" ? (0, import_security.genericProfile)() : void 0;
@@ -10743,7 +11368,7 @@ function printSummary(out, appId, env, run, report4, output) {
   out.log(`  coverage: ${report4.coverageStatus} ${complete}/${report4.coverage.length} blocked=${report4.metrics.blockedCells} shallow=${report4.metrics.shallowCells} unscheduled=${report4.metrics.unscheduledCells} budget_exhausted=${report4.metrics.budgetExhaustedCells}`);
   if (report4.callBudget) out.log(`  calls: discovery=${formatBudget(report4.callBudget.discovery)} validation=${formatBudget(report4.callBudget.validation)}`);
   out.log(`  findings: confirmed=${report4.metrics.confirmed} needs_reproduction=${report4.metrics.needsReproduction} candidates=${report4.metrics.candidates}`);
-  out.log(`  report: ${(0, import_node_path16.resolve)(output, "REPORT.md")}`);
+  out.log(`  report: ${(0, import_node_path17.resolve)(output, "REPORT.md")}`);
 }
 function formatBudget(usage) {
   return usage ? `${usage.usedCalls}/${usage.maxCalls} skipped=${usage.skippedCalls}` : "caller-managed";
@@ -10772,8 +11397,8 @@ async function getHostedSecurityIntent(options) {
   }
   return response2;
 }
-function isValidIntent(value, expected) {
-  return !!value && value.executionContract === "odla.hosted-security-execution-consent.v1" && /^sha256:[a-f0-9]{64}$/.test(value.executionDigest) && /^sha256:[a-f0-9]{64}$/.test(value.planDigest) && value.appId === expected.appId && value.env === expected.env && value.sourceId === expected.sourceId && typeof value.repository === "string" && value.repository.length > 2 && value.repository.length <= 201 && typeof value.defaultBranch === "string" && value.defaultBranch.length > 0 && value.defaultBranch.length <= 255 && typeof value.requestedRef === "string" && value.requestedRef.length > 0 && value.requestedRef.length <= 255 && !/[\u0000-\u001f\u007f]/.test(value.requestedRef) && ["odla", "cloudflare-app", "generic"].includes(value.profile) && value.sourceDisclosure === "redacted";
+function isValidIntent(value2, expected) {
+  return !!value2 && value2.executionContract === "odla.hosted-security-execution-consent.v1" && /^sha256:[a-f0-9]{64}$/.test(value2.executionDigest) && /^sha256:[a-f0-9]{64}$/.test(value2.planDigest) && value2.appId === expected.appId && value2.env === expected.env && value2.sourceId === expected.sourceId && typeof value2.repository === "string" && value2.repository.length > 2 && value2.repository.length <= 201 && typeof value2.defaultBranch === "string" && value2.defaultBranch.length > 0 && value2.defaultBranch.length <= 255 && typeof value2.requestedRef === "string" && value2.requestedRef.length > 0 && value2.requestedRef.length <= 255 && !/[\u0000-\u001f\u007f]/.test(value2.requestedRef) && ["odla", "cloudflare-app", "generic"].includes(value2.profile) && value2.sourceDisclosure === "redacted";
 }
 
 // src/security-hosted-jobs.ts
@@ -10888,17 +11513,17 @@ function hostedJobPath(appIdInput, jobIdInput) {
   const jobId = hostedIdentifier(jobIdInput, "jobId");
   return `/registry/apps/${encodeURIComponent(appId)}/security/jobs/${encodeURIComponent(jobId)}`;
 }
-function securityPlanDigest(value) {
-  if (!/^sha256:[a-f0-9]{64}$/.test(value)) {
+function securityPlanDigest(value2) {
+  if (!/^sha256:[a-f0-9]{64}$/.test(value2)) {
     throw new Error("expected plan digest must be a sha256 digest from security plan");
   }
-  return value;
+  return value2;
 }
-function securityExecutionDigest(value) {
-  if (!/^sha256:[a-f0-9]{64}$/.test(value)) {
+function securityExecutionDigest(value2) {
+  if (!/^sha256:[a-f0-9]{64}$/.test(value2)) {
     throw new Error("expected execution digest must be a sha256 digest from security intent");
   }
-  return value;
+  return value2;
 }
 
 // src/security-run-command.ts
@@ -10962,7 +11587,7 @@ async function runSourceSecurityCommand(parsed, dependencies, sourceId) {
     ...context,
     jobId: job.jobId,
     wait: dependencies.pollWait,
-    onUpdate: parsed.options.json === true ? void 0 : (value) => printHostedJob(context.stdout, value, context.platform, context.appId)
+    onUpdate: parsed.options.json === true ? void 0 : (value2) => printHostedJob(context.stdout, value2, context.platform, context.appId)
   }) : job;
   if (!follow) {
     if (parsed.options.json === true) {
@@ -11062,9 +11687,9 @@ function enforceLocalGate(report4, parsed) {
     throw new Error(`hosted security gate failed: ${confirmed.length} confirmed >= ${failOn}; ${leads.length} leads >= ${failOnCandidates ?? "disabled"}${incomplete ? "; coverage incomplete" : ""}`);
   }
 }
-function severityOpt(value, flag) {
-  if (["informational", "low", "medium", "high", "critical"].includes(value)) {
-    return value;
+function severityOpt(value2, flag) {
+  if (["informational", "low", "medium", "high", "critical"].includes(value2)) {
+    return value2;
   }
   throw new Error(`${flag} must be informational, low, medium, high, or critical`);
 }
@@ -11109,8 +11734,8 @@ async function securityCommand(parsed, dependencies) {
   else await runLocalSecurityCommand(parsed, dependencies);
 }
 async function githubSecurityCommand(parsed, dependencies) {
-  const action = parsed.positionals[2];
-  if (action === "disconnect") {
+  const action2 = parsed.positionals[2];
+  if (action2 === "disconnect") {
     assertArgs(parsed, ["config", "env", "platform", "source", "email", "open", "yes"], 3);
     const context2 = await hostedSecurityContext(parsed, dependencies);
     const sourceId = requiredString(parsed.options.source, "--source");
@@ -11125,7 +11750,7 @@ async function githubSecurityCommand(parsed, dependencies) {
     context2.stdout.log(`github: disconnected ${sourceId} from ${context2.appId}/${context2.env}`);
     return;
   }
-  if (action !== "connect") {
+  if (action2 !== "connect") {
     throw new Error('unknown security github command. Try "odla-ai security github connect".');
   }
   assertArgs(parsed, ["config", "env", "platform", "repo", "email", "open"], 3);
@@ -11172,7 +11797,7 @@ async function securityStatus(parsed, dependencies) {
     ...context,
     jobId,
     wait: dependencies.pollWait,
-    onUpdate: parsed.options.json === true ? void 0 : (value) => printHostedJob(context.stdout, value, context.platform, context.appId)
+    onUpdate: parsed.options.json === true ? void 0 : (value2) => printHostedJob(context.stdout, value2, context.platform, context.appId)
   }) : await getHostedSecurityJob({ ...context, jobId });
   if (parsed.options.json === true) context.stdout.log(JSON.stringify(job, null, 2));
   else if (parsed.options.follow !== true) {
@@ -11256,6 +11881,10 @@ async function runCli(argv = process.argv.slice(2), dependencies = {}) {
     await o11yCommand(parsed, runtime);
     return;
   }
+  if (command === "platform") {
+    await platformCommand(parsed, runtime);
+    return;
+  }
   if (command === "provision") {
     await provisionCommand(parsed, runtime);
     return;