@odla-ai/cli 0.25.21 → 0.25.22

package/dist/bin.cjs

@@ -43,7 +43,9 @@ function approvalLines(prompt) {
   lines.push("");
   lines.push(`   ${prompt.approvalUrl}`);
   lines.push("");
-  lines.push("   A signed-in odla admin opens that URL, checks the code matches, and approves.");
+  lines.push(
+    `   ${prompt.approver ?? "The matching signed-in odla account"} opens that URL, checks the code matches, and approves.`
+  );
   lines.push("   Opening the link without approving does nothing; this command waits until they do.");
   if (prompt.browserAttempted) {
     lines.push("   A browser launch was attempted, but it is best-effort and may have shown no tab.");
@@ -490,6 +492,7 @@ function audienceBoundEnvToken(token, platform) {
 }
 var SCOPE_PURPOSE = {
   "platform:status:read": "read the platform fleet health and deployment snapshot",
+  "app:config:read": "compare checked-in intent with an exact-id app Registry configuration",
   "platform:runbook:write": "add or edit odla's operational runbooks",
   "platform:ai:policy:write": "change System AI model routing",
   "platform:ai:policy:read": "read System AI model routing",
@@ -526,6 +529,7 @@ async function scopedToken(platform, scope, options, doFetch, out) {
         approvalUrl,
         minutesLeft: Math.floor(expiresIn / 60),
         purpose: SCOPE_PURPOSE[scope] ?? `use ${scope}`,
+        approver: scope.startsWith("app:") ? "A signed-in app owner" : "A signed-in odla platform admin",
         browserAttempted: browser.open,
         browserSkipped: browser.reason
       });
@@ -695,10 +699,10 @@ async function responseBody2(res) {
     return { message: text.slice(0, 300) };
   }
 }
-function apiError2(action, status, body) {
+function apiError2(action2, status, body) {
   const error = isRecord2(body) && isRecord2(body.error) ? body.error : void 0;
   const message2 = error && typeof error.message === "string" ? error.message : isRecord2(body) && typeof body.message === "string" ? body.message : "request failed";
-  return `${action} failed (${status}): ${message2}`;
+  return `${action2} failed (${status}): ${message2}`;
 }
 function isRecord2(value2) {
   return Boolean(value2) && typeof value2 === "object" && !Array.isArray(value2);
@@ -876,10 +880,10 @@ async function responseBody3(res) {
     return { message: text.slice(0, 300) };
   }
 }
-function apiError3(action, status, body) {
+function apiError3(action2, status, body) {
   const error = isRecord3(body) && isRecord3(body.error) ? body.error : void 0;
   const message2 = error && typeof error.message === "string" ? error.message : isRecord3(body) && typeof body.message === "string" ? body.message : "request failed";
-  return `${action} failed (${status}): ${message2}`;
+  return `${action2} failed (${status}): ${message2}`;
 }
 function isRecord3(value2) {
   return Boolean(value2) && typeof value2 === "object" && !Array.isArray(value2);
@@ -1503,21 +1507,21 @@ var SET_OPTIONS = [
 ];
 async function adminCommand(parsed, deps = {}) {
   const area = parsed.positionals[1];
-  const action = parsed.positionals[2];
-  const credentialSet = action === "credential" && parsed.positionals[3] === "set";
-  const credentials = action === "credentials";
-  const models = action === "models";
-  const usage = action === "usage";
-  const audit = action === "audit";
-  if (area !== "ai" || action !== "show" && action !== "set" && !credentialSet && !credentials && !models && !usage && !audit) {
+  const action2 = parsed.positionals[2];
+  const credentialSet = action2 === "credential" && parsed.positionals[3] === "set";
+  const credentials = action2 === "credentials";
+  const models = action2 === "models";
+  const usage = action2 === "usage";
+  const audit = action2 === "audit";
+  if (area !== "ai" || action2 !== "show" && action2 !== "set" && !credentialSet && !credentials && !models && !usage && !audit) {
     throw new Error('unknown admin command. Try "odla-ai admin ai show".');
   }
-  const allowed = credentialSet ? [...CONTEXT_OPTIONS, "from-env", "stdin"] : action === "set" ? SET_OPTIONS : models ? [...JSON_OPTIONS, "provider"] : usage ? [...JSON_OPTIONS, "app-id", "env", "run-id", "limit"] : audit ? [...JSON_OPTIONS, "limit"] : JSON_OPTIONS;
-  assertArgs(parsed, allowed, credentialSet ? 5 : action === "set" ? 4 : 3);
+  const allowed = credentialSet ? [...CONTEXT_OPTIONS, "from-env", "stdin"] : action2 === "set" ? SET_OPTIONS : models ? [...JSON_OPTIONS, "provider"] : usage ? [...JSON_OPTIONS, "app-id", "env", "run-id", "limit"] : audit ? [...JSON_OPTIONS, "limit"] : JSON_OPTIONS;
+  assertArgs(parsed, allowed, credentialSet ? 5 : action2 === "set" ? 4 : 3);
   const context = await resolveOperatorContext(parsed, { allowMissingConfig: true });
   await adminAi({
-    action: credentialSet ? "credential-set" : credentials ? "credentials" : models ? "models" : usage ? "usage" : audit ? "audit" : action,
-    purpose: action === "set" ? parsed.positionals[3] : void 0,
+    action: credentialSet ? "credential-set" : credentials ? "credentials" : models ? "models" : usage ? "usage" : audit ? "audit" : action2,
+    purpose: action2 === "set" ? parsed.positionals[3] : void 0,
     provider: stringOpt(parsed.options.provider),
     model: stringOpt(parsed.options.model),
     enabled: boolOpt(parsed.options.enabled),
@@ -1574,12 +1578,12 @@ function bothTenants(cfg) {
 
 // src/agent-command.ts
 async function agentCommand(parsed, deps = {}) {
-  const action = parsed.positionals[1];
-  if (action !== "jobs" && action !== "retry") {
-    throw new Error(`unknown agent action "${action ?? ""}". Try "odla-ai agent jobs --json".`);
+  const action2 = parsed.positionals[1];
+  if (action2 !== "jobs" && action2 !== "retry") {
+    throw new Error(`unknown agent action "${action2 ?? ""}". Try "odla-ai agent jobs --json".`);
   }
-  assertArgs(parsed, ["config", "env", "state", "limit", "json", "token", "email"], action === "jobs" ? 2 : 3);
-  if (action === "retry" && (parsed.options.state !== void 0 || parsed.options.limit !== void 0)) {
+  assertArgs(parsed, ["config", "env", "state", "limit", "json", "token", "email"], action2 === "jobs" ? 2 : 3);
+  if (action2 === "retry" && (parsed.options.state !== void 0 || parsed.options.limit !== void 0)) {
     throw new Error('--state and --limit are supported only by "agent jobs"');
   }
   const cfg = await loadProjectConfig(stringOpt(parsed.options.config) ?? "odla.config.mjs");
@@ -1599,7 +1603,7 @@ async function agentCommand(parsed, deps = {}) {
   );
   const base = `${cfg.dbEndpoint}/app/${encodeURIComponent(tenant)}/admin/agent-jobs`;
   const headers = { authorization: `Bearer ${credential2}` };
-  if (action === "retry") {
+  if (action2 === "retry") {
     const id = parsed.positionals[2];
     const res2 = await doFetch(`${base}/${encodeURIComponent(id)}/retry`, { method: "POST", headers });
     const body2 = await readJson(res2);
@@ -2035,7 +2039,7 @@ async function copyFiles(cfg, token, route2, doFetch, out) {
 }
 
 // src/app-lifecycle.ts
-async function lifecycleCall(action, options) {
+async function lifecycleCall(action2, options) {
   const cfg = await loadProjectConfig(options.configPath);
   const out = options.stdout ?? console;
   const doFetch = options.fetch ?? fetch;
@@ -2045,13 +2049,13 @@ async function lifecycleCall(action, options) {
     doFetch,
     out
   );
-  const res = await doFetch(`${cfg.platformUrl}/registry/apps/${encodeURIComponent(cfg.app.id)}/${action}`, {
+  const res = await doFetch(`${cfg.platformUrl}/registry/apps/${encodeURIComponent(cfg.app.id)}/${action2}`, {
     method: "POST",
     headers: { authorization: `Bearer ${token}`, "content-type": "application/json" }
   });
   const body = await res.json().catch(() => ({}));
   if (!res.ok || !body.ok) {
-    throw new Error(`${action} failed${body.error?.code ? ` (${body.error.code})` : ""}: ${body.error?.message ?? `registry returned ${res.status}`}`);
+    throw new Error(`${action2} failed${body.error?.code ? ` (${body.error.code})` : ""}: ${body.error?.message ?? `registry returned ${res.status}`}`);
   }
   return body;
 }
@@ -2604,8 +2608,8 @@ function pollTimeout(value2 = 10 * 6e4) {
   if (!Number.isSafeInteger(value2) || value2 < 1e3 || value2 > 60 * 6e4) throw new Error("calendar poll timeout must be 1000-3600000ms");
   return value2;
 }
-function productionConsent(env, yes, action) {
-  if ((env === "prod" || env === "production") && !yes) throw new Error(`refusing to ${action} for "${env}" without --yes`);
+function productionConsent(env, yes, action2) {
+  if ((env === "prod" || env === "production") && !yes) throw new Error(`refusing to ${action2} for "${env}" without --yes`);
 }
 function printStatus(status, json, out) {
   if (json) {
@@ -2635,6 +2639,7 @@ var CAPABILITIES = {
     "save and explicitly select non-secret named operator contexts with isolated credential caches; resolve and explain platform, app, environment, and credential provenance without authenticating; then run PM, Discussions, o11y, runbook, and identity operations outside a project checkout",
     "read one versioned o11y status envelope spanning application RED, exact Worker versions and Cloudflare colos observed in traffic, current live-sync freshness/load, the protected commit-to-visible canary, collector ingest/scheduler trust, provider-owned runtime metrics, account-scoped Durable Object, D1, and R2 evidence under odla-db, and a bounded machine verdict",
     "read one canonical platform fleet snapshot over private service bindings, including release identities, probe latency, Cloudflare load/runtime freshness, explicit unknowns, and stable next actions through a read-only capability",
+    "compare one project's checked-in Registry intent with live owner-visible state and freeze a secret-free plan digest through an exact app:config:read capability",
     "inspect durable agent wakeups as a versioned JSON envelope and explicitly requeue one dead-lettered job with a scoped environment credential",
     "run app-attributed hosted security discovery and independent validation without provider keys",
     "connect/revoke source-read-only GitHub sources and drive commit-pinned hosted security jobs without PATs or provider keys",
@@ -2681,15 +2686,542 @@ function printGroup(out, heading, items) {
   out.log("");
 }
 
+// src/config-reconcile-command.ts
+var import_apps6 = require("@odla-ai/apps");
+var import_node_path7 = require("path");
+
+// src/config-reconcile-digest.ts
+var import_node_crypto = require("crypto");
+function canonicalJson(value2) {
+  return JSON.stringify(canonicalValue(value2));
+}
+function configDigest(value2) {
+  return `sha256:${(0, import_node_crypto.createHash)("sha256").update(canonicalJson(value2)).digest("hex")}`;
+}
+function canonicalValue(value2) {
+  if (Array.isArray(value2)) return value2.map(canonicalValue);
+  if (value2 && typeof value2 === "object") {
+    return Object.fromEntries(
+      Object.entries(value2).filter(([, entry]) => entry !== void 0).sort(([left], [right]) => left.localeCompare(right)).map(([key, entry]) => [key, canonicalValue(entry)])
+    );
+  }
+  return value2;
+}
+
+// src/config-reconcile-desired.ts
+var import_apps4 = require("@odla-ai/apps");
+
+// src/provision-helpers.ts
+var import_ai = require("@odla-ai/ai");
+var import_apps3 = require("@odla-ai/apps");
+function defaultSecretName(provider) {
+  const names = import_ai.DEFAULT_SECRET_NAMES;
+  return names[provider] ?? `${provider}_api_key`;
+}
+async function assertTenantAdminAccess(doFetch, cfg, env, token) {
+  const tenantId = (0, import_apps3.tenantIdFor)(cfg.app.id, env);
+  const res = await doFetch(`${cfg.dbEndpoint}/admin/apps/${encodeURIComponent(tenantId)}/entitlements`, {
+    headers: { authorization: `Bearer ${token}` }
+  });
+  if (res.ok || res.status === 404) return;
+  if (res.status === 403) {
+    throw new Error(
+      `${env}: you are not an owner of "${cfg.app.id}" (tenant ${tenantId}) \u2014 nothing was minted or written; ask an existing owner to run "odla-ai app owners add <your-email>", then re-run provision`
+    );
+  }
+  throw new Error(`${env}: tenant access preflight (${tenantId}) failed: ${res.status} ${await safeText3(res)}`);
+}
+async function postJson(doFetch, url, bearer, body) {
+  const res = await doFetch(url, {
+    method: "POST",
+    headers: { authorization: `Bearer ${bearer}`, "content-type": "application/json" },
+    body: JSON.stringify(body)
+  });
+  if (!res.ok) throw new Error(`${new URL(url).pathname} failed: ${res.status} ${await safeText3(res)}`);
+}
+function normalizeClerkConfig(value2) {
+  if (!value2) return null;
+  if (typeof value2 === "string") {
+    const publishableKey2 = envValue(value2);
+    return publishableKey2 ? { publishableKey: publishableKey2 } : null;
+  }
+  if (typeof value2 !== "object") return null;
+  const cfg = value2;
+  const publishableKey = envValue(cfg.publishableKey);
+  return publishableKey ? { publishableKey, ...cfg.audience ? { audience: cfg.audience } : {}, ...cfg.mode ? { mode: cfg.mode } : {} } : null;
+}
+async function safeText3(res) {
+  try {
+    return redactSecrets((await res.text()).slice(0, 500));
+  } catch {
+    return "";
+  }
+}
+
+// src/config-reconcile-desired.ts
+function desiredRegistryState(cfg) {
+  const environments = {};
+  const services = (0, import_apps4.orderAppServices)(cfg.services);
+  for (const env of cfg.envs) {
+    const desiredServices = {};
+    for (const service of services) {
+      desiredServices[service] = {
+        enabled: true,
+        ...managedServiceConfig(cfg, env, service)
+      };
+    }
+    const authoredAuth = cfg.auth?.clerk && Object.hasOwn(cfg.auth.clerk, env) ? cfg.auth.clerk[env] : void 0;
+    const auth = normalizeClerkConfig(authoredAuth);
+    if (authoredAuth && !auth) {
+      throw new Error(`auth.clerk.${env} could not resolve its publishable key`);
+    }
+    const linkManaged = !!cfg.links && Object.hasOwn(cfg.links, env);
+    environments[env] = {
+      services: desiredServices,
+      ...auth ? { auth } : {},
+      ...linkManaged ? { link: cfg.links?.[env] ?? null } : {}
+    };
+  }
+  return {
+    appId: cfg.app.id,
+    name: cfg.app.name,
+    environments
+  };
+}
+function managedServiceConfig(cfg, env, service) {
+  if (service === "ai" && cfg.ai?.provider) {
+    return {
+      config: {
+        provider: cfg.ai.provider,
+        ...cfg.ai.model ? { model: cfg.ai.model } : {}
+      }
+    };
+  }
+  if (service === "calendar") return { config: calendarServiceConfig(cfg, env) };
+  return {};
+}
+
+// src/config-reconcile.ts
+var import_apps5 = require("@odla-ai/apps");
+
+// src/config-reconcile-values.ts
+function difference(path, desired, observed, status, reason, desiredSource, observedSource, env, service) {
+  return { path, env, service, status, desired, observed, desiredSource, observedSource, reason };
+}
+function action(kind, path, before, after, risk, applySupport, reason) {
+  return { kind, path, before, after, risk, requiresApproval: false, applySupport, reason };
+}
+function scopedAction(kind, path, env, service, before, after, reason, destructive = false) {
+  const production = env === "prod" || env === "production";
+  return {
+    ...action(
+      kind,
+      path,
+      before,
+      after,
+      destructive ? "high" : production ? "medium" : "low",
+      destructive ? "studio" : "provision",
+      reason
+    ),
+    env,
+    ...service ? { service } : {},
+    requiresApproval: production || destructive
+  };
+}
+function observedProjection(app) {
+  return {
+    appId: app.appId,
+    name: app.name,
+    archivedAt: app.archivedAt,
+    environments: Object.fromEntries(
+      Object.entries(app.environments).sort(([left], [right]) => left.localeCompare(right)).map(([env, services]) => [
+        env,
+        Object.fromEntries(Object.entries(services).sort(([left], [right]) => left.localeCompare(right)))
+      ])
+    ),
+    auth: app.auth,
+    links: app.links
+  };
+}
+function projectConfig(value2, keys) {
+  return Object.fromEntries(keys.filter((key) => value2[key] !== void 0).map((key) => [key, value2[key]]));
+}
+function same(left, right) {
+  return canonicalJson(left) === canonicalJson(right);
+}
+function actionId(actionValue) {
+  return `action-${configDigest(actionValue).slice("sha256:".length, "sha256:".length + 16)}`;
+}
+function quoteArg(value2) {
+  return `'${value2.replace(/'/g, `'\\''`)}'`;
+}
+
+// src/config-reconcile.ts
+var COVERAGE = {
+  included: [
+    "app display name",
+    "environment service enablement",
+    "AI provider/model and calendar booking service configuration",
+    "auth configuration when explicitly declared",
+    "deployment link when explicitly declared"
+  ],
+  excluded: [
+    { path: "db.schema", reason: "owned by the database data plane" },
+    { path: "db.rules", reason: "owned by the database data plane" },
+    { path: "integrations.seeds", reason: "guarded data-plane writes are not Registry state" },
+    { path: "credentials", reason: "shown-once credentials are intentionally local" },
+    { path: "secrets", reason: "vault and Worker secrets are write-only" },
+    { path: "calendar.connection", reason: "OAuth connection state is provider-owned" },
+    { path: "service.config.opaque", reason: "controller-assigned fields remain service-owned" }
+  ]
+};
+function reconcileConfig(input) {
+  const desiredSource = { kind: "project_config", location: input.configPath };
+  const observedSource = {
+    kind: "registry",
+    location: `${input.platformUrl}/registry/apps/${encodeURIComponent(input.desired.appId)}`
+  };
+  const differences = [];
+  const actions = [];
+  const add = (difference2, action2) => {
+    differences.push(difference2);
+    if (action2) actions.push({ ...action2, id: actionId(action2) });
+  };
+  compareApp(input.desired, input.observed, desiredSource, observedSource, add);
+  compareEnvironments(input.desired, input.observed, desiredSource, observedSource, add);
+  const desiredRevision = configDigest(input.desired);
+  const observedRevision = input.observed ? configDigest(observedProjection(input.observed)) : null;
+  const different = differences.filter((entry) => entry.status === "different").length;
+  const unmanaged = differences.length - different;
+  return {
+    generatedAt: input.generatedAt,
+    scope: {
+      appId: input.desired.appId,
+      platformUrl: input.platformUrl,
+      environments: Object.keys(input.desired.environments).sort()
+    },
+    sources: { desired: desiredSource, observed: observedSource },
+    desiredRevision,
+    observedRevision,
+    status: different ? "different" : unmanaged ? "unmanaged" : "in_sync",
+    summary: {
+      differences: different,
+      unmanaged,
+      actions: actions.length,
+      productionActions: actions.filter((action2) => action2.env === "prod" || action2.env === "production").length,
+      highRiskActions: actions.filter((action2) => action2.risk === "high").length
+    },
+    coverage: COVERAGE,
+    differences,
+    actions
+  };
+}
+function compareApp(desired, observed, desiredSource, observedSource, add) {
+  if (!observed) {
+    const path = "app";
+    add(
+      difference(path, desired, null, "different", "the app is absent from Registry", desiredSource, observedSource),
+      action(
+        "create_app",
+        path,
+        null,
+        { appId: desired.appId, name: desired.name },
+        "low",
+        "provision",
+        "create the repository-declared app"
+      )
+    );
+    return;
+  }
+  if (observed.name !== desired.name) {
+    const path = "app.name";
+    add(
+      difference(path, desired.name, observed.name, "different", "the checked-in display name differs", desiredSource, observedSource),
+      {
+        ...action("rename_app", path, observed.name, desired.name, "low", "command", "make Registry match the checked-in display name"),
+        command: `odla-ai app rename ${quoteArg(desired.name)} --config ${quoteArg(desiredSource.location)}`
+      }
+    );
+  }
+}
+function compareEnvironments(desired, observed, desiredSource, observedSource, add) {
+  const envs = /* @__PURE__ */ new Set([
+    ...Object.keys(desired.environments),
+    ...Object.keys(observed?.environments ?? {}).filter((env) => Object.values(observed?.environments[env] ?? {}).some((service) => service.enabled))
+  ]);
+  for (const env of [...envs].sort()) {
+    compareServices(env, desired, observed, desiredSource, observedSource, add);
+    compareOptionalEnvironmentState(env, desired, observed, desiredSource, observedSource, add);
+  }
+}
+function compareServices(env, desired, observed, desiredSource, observedSource, add) {
+  const wanted = desired.environments[env]?.services ?? {};
+  const live = observed?.environments[env] ?? {};
+  const knownOrder = (0, import_apps5.orderAppServices)((0, import_apps5.appServiceIds)());
+  const services = [.../* @__PURE__ */ new Set([...knownOrder, ...Object.keys(wanted), ...Object.keys(live)])];
+  for (const service of services) {
+    const next = wanted[service];
+    const current = live[service];
+    const path = `environments.${env}.services.${service}`;
+    if (next?.enabled && !current?.enabled) {
+      add(
+        difference(path, next, current ?? null, "different", "the repository enables a service Registry does not", desiredSource, observedSource, env, service),
+        scopedAction("enable_service", path, env, service, current ?? null, next, "enable the repository-declared service")
+      );
+      continue;
+    }
+    if (next?.enabled && current?.enabled && next.config) {
+      const projected = projectConfig(current.config, Object.keys(next.config));
+      if (!same(next.config, projected)) {
+        add(
+          difference(`${path}.config`, next.config, projected, "different", "repository-managed service settings differ", desiredSource, observedSource, env, service),
+          scopedAction(
+            "configure_service",
+            `${path}.config`,
+            env,
+            service,
+            projected,
+            next.config,
+            "apply the repository-managed service settings"
+          )
+        );
+      }
+    }
+  }
+  for (const service of [...services].reverse()) {
+    const next = wanted[service];
+    const current = live[service];
+    if (next?.enabled || !current?.enabled) continue;
+    const path = `environments.${env}.services.${service}`;
+    add(
+      difference(path, null, { enabled: true }, "different", "Registry enables a service absent from repository intent", desiredSource, observedSource, env, service),
+      scopedAction(
+        "disable_service",
+        path,
+        env,
+        service,
+        { enabled: true },
+        { enabled: false },
+        "disablement is destructive to availability and requires an explicit Studio review",
+        true
+      )
+    );
+  }
+}
+function compareOptionalEnvironmentState(env, desired, observed, desiredSource, observedSource, add) {
+  const wanted = desired.environments[env];
+  const liveAuth = observed?.auth[env] ?? null;
+  if (wanted?.auth) {
+    const projected = liveAuth ? projectConfig(liveAuth, Object.keys(wanted.auth)) : null;
+    if (!same(wanted.auth, projected)) {
+      const path = `environments.${env}.auth`;
+      add(
+        difference(path, wanted.auth, projected, "different", "explicit repository auth settings differ", desiredSource, observedSource, env),
+        scopedAction("set_auth", path, env, void 0, projected, wanted.auth, "apply explicit repository auth settings")
+      );
+    }
+  } else if (liveAuth) {
+    add(difference(
+      `environments.${env}.auth`,
+      null,
+      projectConfig(liveAuth, ["publishableKey", "audience", "mode"]),
+      "unmanaged",
+      "live auth exists but this project config does not manage it",
+      desiredSource,
+      observedSource,
+      env
+    ));
+  }
+  const managesLink = wanted && Object.hasOwn(wanted, "link");
+  const liveLink = observed?.links[env] ?? null;
+  if (managesLink && wanted.link !== liveLink) {
+    const path = `environments.${env}.link`;
+    add(
+      difference(path, wanted.link ?? null, liveLink, "different", "explicit repository deployment link differs", desiredSource, observedSource, env),
+      scopedAction("set_link", path, env, void 0, liveLink, wanted.link ?? null, "apply the repository deployment link")
+    );
+  } else if (!managesLink && liveLink) {
+    add(difference(
+      `environments.${env}.link`,
+      null,
+      liveLink,
+      "unmanaged",
+      "a live deployment link exists but this project config does not manage it",
+      desiredSource,
+      observedSource,
+      env
+    ));
+  }
+}
+
+// src/config-reconcile-command.ts
+async function configDiff(options) {
+  const reconciliation = await inspectConfig(options);
+  const { actions: _actions, ...read3 } = reconciliation;
+  const document2 = {
+    schemaVersion: "odla.config-diff/v1",
+    ...read3,
+    nextActions: diffNextActions(reconciliation, options.configPath)
+  };
+  printDiff(document2, options);
+  return document2;
+}
+async function configPlan(options) {
+  const reconciliation = await inspectConfig(options);
+  const planDigest = configDigest({
+    schemaVersion: "odla.config-plan/v1",
+    desiredRevision: reconciliation.desiredRevision,
+    observedRevision: reconciliation.observedRevision,
+    actions: reconciliation.actions
+  });
+  const document2 = {
+    schemaVersion: "odla.config-plan/v1",
+    ...reconciliation,
+    planDigest,
+    apply: {
+      supported: false,
+      reason: "conditional, resumable config apply is not available yet; use the exact reviewed commands below"
+    },
+    nextActions: planNextActions(reconciliation, options.configPath)
+  };
+  printPlan2(document2, options);
+  return document2;
+}
+async function inspectConfig(options) {
+  const out = options.stdout ?? console;
+  const cfg = await loadProjectConfig(options.configPath);
+  const doFetch = options.fetch ?? fetch;
+  const token = await resolveAdminPlatformToken({
+    platform: cfg.platformUrl,
+    scope: "app:config:read",
+    token: options.token,
+    tokenFile: (0, import_node_path7.join)(cfg.rootDir, ".odla", "admin-token.local.json"),
+    rootDir: cfg.rootDir,
+    email: options.email,
+    open: options.open,
+    fetch: doFetch,
+    stdout: out,
+    openApprovalUrl: options.openApprovalUrl,
+    label: `odla CLI (${cfg.app.id} config read)`
+  });
+  const client = (0, import_apps6.createAppsClient)({ endpoint: cfg.platformUrl, token, fetcher: { fetch: doFetch } });
+  const observed = await client.resolveApp(cfg.app.id);
+  return reconcileConfig({
+    desired: desiredRegistryState(cfg),
+    observed,
+    configPath: cfg.configPath,
+    platformUrl: cfg.platformUrl,
+    generatedAt: (options.now?.() ?? /* @__PURE__ */ new Date()).toISOString()
+  });
+}
+function printDiff(document2, options) {
+  const out = options.stdout ?? console;
+  if (options.json) {
+    out.log(JSON.stringify(document2, null, 2));
+    return;
+  }
+  printHeader(out, "diff", document2);
+  printDifferences(out, document2);
+  printNext(out, document2.nextActions);
+}
+function printPlan2(document2, options) {
+  const out = options.stdout ?? console;
+  if (options.json) {
+    out.log(JSON.stringify(document2, null, 2));
+    return;
+  }
+  printHeader(out, "plan", document2);
+  for (const entry of document2.actions) {
+    const scope = [entry.env, entry.service].filter(Boolean).join("/");
+    out.log(
+      `  ${entry.id}  ${entry.kind}${scope ? ` (${scope})` : ""}  ${entry.risk}${entry.requiresApproval ? ", approval required" : ""}`
+    );
+    out.log(`    ${entry.reason}`);
+  }
+  if (!document2.actions.length) out.log("  no managed changes");
+  out.log(`plan digest: ${document2.planDigest}`);
+  out.log(`apply: unsupported \u2014 ${document2.apply.reason}`);
+  printNext(out, document2.nextActions);
+}
+function printHeader(out, kind, document2) {
+  out.log(`config ${kind}: ${document2.scope.appId} \u2014 ${document2.status}`);
+  out.log(`platform: ${document2.scope.platformUrl}`);
+  out.log(`desired:  ${document2.desiredRevision}`);
+  out.log(`observed: ${document2.observedRevision ?? "absent"}`);
+  out.log(
+    `summary: ${document2.summary.differences} different, ${document2.summary.unmanaged} unmanaged, ${document2.summary.actions} planned actions`
+  );
+}
+function printDifferences(out, document2) {
+  for (const entry of document2.differences) {
+    out.log(`  ${entry.status}	${entry.path}	${entry.reason}`);
+  }
+  if (!document2.differences.length) out.log("  managed Registry configuration is in sync");
+}
+function printNext(out, next) {
+  if (!next.length) return;
+  out.log("next:");
+  for (const item of next) out.log(`  ${item.command}
+    ${item.description}`);
+}
+function diffNextActions(reconciliation, configPath) {
+  if (reconciliation.status === "in_sync") {
+    return [{
+      code: "verify_runtime",
+      command: `odla-ai smoke --config ${quoteArg2(configPath)}`,
+      description: "Registry intent matches; verify the service-owned data planes separately."
+    }];
+  }
+  return [{
+    code: "freeze_plan",
+    command: `odla-ai config plan --config ${quoteArg2(configPath)} --json`,
+    description: "Freeze the current desired and observed revisions into a reviewable action plan."
+  }];
+}
+function planNextActions(reconciliation, configPath) {
+  const next = [];
+  if (reconciliation.actions.some((action2) => action2.applySupport === "provision")) {
+    next.push({
+      code: "review_provision",
+      command: `odla-ai provision --config ${quoteArg2(configPath)} --dry-run`,
+      description: "Review the existing provisioner's service/auth/link work before applying it."
+    });
+  }
+  for (const action2 of reconciliation.actions.filter((entry) => entry.command)) {
+    if (!next.some((entry) => entry.command === action2.command)) {
+      next.push({ code: action2.kind, command: action2.command, description: action2.reason });
+    }
+  }
+  if (reconciliation.actions.some((action2) => action2.applySupport === "studio")) {
+    const { appId, platformUrl } = reconciliation.scope;
+    next.push({
+      code: "review_destructive",
+      command: `${platformUrl}/studio/apps/${encodeURIComponent(appId)}/settings`,
+      description: "Review service disablement in the owning Studio scope; this plan will not apply it."
+    });
+  }
+  if (!reconciliation.actions.length && reconciliation.summary.unmanaged) {
+    next.push({
+      code: "declare_or_accept_runtime_state",
+      command: `${reconciliation.scope.platformUrl}/studio/apps/${encodeURIComponent(reconciliation.scope.appId)}/settings`,
+      description: "Declare the live value in project config or keep it as an explicit runtime-managed setting."
+    });
+  }
+  return next;
+}
+function quoteArg2(value2) {
+  return `'${value2.replace(/'/g, `'\\''`)}'`;
+}
+
 // src/doctor-checks.ts
 var import_node_child_process3 = require("child_process");
 var import_node_fs10 = require("fs");
-var import_node_path8 = require("path");
+var import_node_path9 = require("path");
 
 // src/wrangler.ts
 var import_node_child_process2 = require("child_process");
 var import_node_fs9 = require("fs");
-var import_node_path7 = require("path");
+var import_node_path8 = require("path");
 var defaultRunner = (cmd, args, opts) => new Promise((resolvePromise, reject) => {
   const child = (0, import_node_child_process2.spawn)(cmd, args, { cwd: opts?.cwd, stdio: ["pipe", "pipe", "pipe"] });
   let stdout = "";
@@ -2703,7 +3235,7 @@ var defaultRunner = (cmd, args, opts) => new Promise((resolvePromise, reject) =>
 var WRANGLER_CONFIG_FILES = ["wrangler.jsonc", "wrangler.json", "wrangler.toml"];
 function findWranglerConfig(rootDir) {
   for (const name of WRANGLER_CONFIG_FILES) {
-    const path = (0, import_node_path7.join)(rootDir, name);
+    const path = (0, import_node_path8.join)(rootDir, name);
     if ((0, import_node_fs9.existsSync)(path)) return path;
   }
   return null;
@@ -2769,11 +3301,11 @@ function lintRules(rules, entities, publicRead) {
   const warnings = [];
   if (!rules) return warnings;
   for (const [ns, actions] of Object.entries(rules)) {
-    for (const [action, expr] of Object.entries(actions)) {
+    for (const [action2, expr] of Object.entries(actions)) {
       if (typeof expr !== "string" || expr.trim() !== "true") continue;
-      if (action === "view" && publicRead.includes(ns)) continue;
+      if (action2 === "view" && publicRead.includes(ns)) continue;
       warnings.push(
-        action === "view" ? `rules.${ns}.view is "true" \u2014 public read; add "${ns}" to db.publicRead if intended` : `rules.${ns}.${action} is "true" \u2014 any client can ${action} ${ns} rows`
+        action2 === "view" ? `rules.${ns}.view is "true" \u2014 public read; add "${ns}" to db.publicRead if intended` : `rules.${ns}.${action2} is "true" \u2014 any client can ${action2} ${ns} rows`
       );
     }
   }
@@ -2809,10 +3341,10 @@ function wranglerWarnings(rootDir) {
   for (const { label, block } of blocks) {
     const assets = block.assets;
     if (assets?.directory) {
-      const dir = (0, import_node_path8.resolve)(rootDir, assets.directory);
-      if (dir === (0, import_node_path8.resolve)(rootDir)) {
+      const dir = (0, import_node_path9.resolve)(rootDir, assets.directory);
+      if (dir === (0, import_node_path9.resolve)(rootDir)) {
         warnings.push(`${label}assets.directory is the project root \u2014 point it at a dedicated build dir (wrangler dev fails with "spawn EBADF")`);
-      } else if ((0, import_node_fs10.existsSync)((0, import_node_path8.join)(dir, "node_modules"))) {
+      } else if ((0, import_node_fs10.existsSync)((0, import_node_path9.join)(dir, "node_modules"))) {
         warnings.push(`${label}assets.directory contains node_modules \u2014 wrangler dev's watcher will exhaust file descriptors`);
       }
     }
@@ -2847,7 +3379,7 @@ function o11yProjectWarnings(rootDir) {
     warnings.push("cannot verify o11y Worker instrumentation \u2014 add a parseable wrangler.jsonc/json config");
     return warnings;
   }
-  const main = typeof config.main === "string" ? (0, import_node_path8.resolve)(rootDir, config.main) : null;
+  const main = typeof config.main === "string" ? (0, import_node_path9.resolve)(rootDir, config.main) : null;
   if (!main || !(0, import_node_fs10.existsSync)(main)) {
     warnings.push("cannot verify o11y Worker instrumentation \u2014 wrangler main is missing or unreadable");
   } else {
@@ -2877,7 +3409,7 @@ function calendarProjectWarnings(rootDir) {
 }
 function readPackageJson(rootDir) {
   try {
-    return JSON.parse((0, import_node_fs10.readFileSync)((0, import_node_path8.join)(rootDir, "package.json"), "utf8"));
+    return JSON.parse((0, import_node_fs10.readFileSync)((0, import_node_path9.join)(rootDir, "package.json"), "utf8"));
   } catch {
     return null;
   }
@@ -2933,8 +3465,8 @@ function integrationWarnings(integrations, schema, rules) {
         warnings.push(`integration "${integration.id}" has no rules for "${ns}"`);
         continue;
       }
-      for (const action of ["view", "create", "update", "delete"]) {
-        if (rule[action] === void 0) warnings.push(`integration "${integration.id}" rule "${ns}.${action}" is missing`);
+      for (const action2 of ["view", "create", "update", "delete"]) {
+        if (rule[action2] === void 0) warnings.push(`integration "${integration.id}" rule "${ns}.${action2}" is missing`);
       }
     }
     for (const seed of integration.seeds ?? []) {
@@ -3105,12 +3637,12 @@ function harnessOption(value2, flag) {
 
 // src/init.ts
 var import_node_fs11 = require("fs");
-var import_node_path9 = require("path");
-var import_apps3 = require("@odla-ai/apps");
+var import_node_path10 = require("path");
+var import_apps7 = require("@odla-ai/apps");
 function initProject(options) {
   const out = options.stdout ?? console;
-  const rootDir = (0, import_node_path9.resolve)(options.rootDir ?? process.cwd());
-  const configPath = (0, import_node_path9.resolve)(rootDir, options.configPath ?? "odla.config.mjs");
+  const rootDir = (0, import_node_path10.resolve)(options.rootDir ?? process.cwd());
+  const configPath = (0, import_node_path10.resolve)(rootDir, options.configPath ?? "odla.config.mjs");
   if ((0, import_node_fs11.existsSync)(configPath) && !options.force) {
     throw new Error(`${configPath} already exists. Pass --force to overwrite.`);
   }
@@ -3120,19 +3652,19 @@ function initProject(options) {
   const envs = options.envs?.length ? options.envs : ["dev"];
   const services = options.services?.length ? options.services : ["db", "ai"];
   for (const service of services) {
-    const definition = (0, import_apps3.appServiceDefinition)(service);
-    if (!definition) throw new Error(`--services contains unknown service "${service}" (known: ${(0, import_apps3.appServiceIds)().join(", ")})`);
+    const definition = (0, import_apps7.appServiceDefinition)(service);
+    if (!definition) throw new Error(`--services contains unknown service "${service}" (known: ${(0, import_apps7.appServiceIds)().join(", ")})`);
     for (const dependency of definition.requires) {
       if (!services.includes(dependency)) throw new Error(`--services ${service} requires ${dependency}`);
     }
   }
   const aiProvider = options.aiProvider ?? "anthropic";
-  (0, import_node_fs11.mkdirSync)((0, import_node_path9.dirname)(configPath), { recursive: true });
-  (0, import_node_fs11.mkdirSync)((0, import_node_path9.resolve)(rootDir, "src/odla"), { recursive: true });
-  (0, import_node_fs11.mkdirSync)((0, import_node_path9.resolve)(rootDir, ".odla"), { recursive: true });
+  (0, import_node_fs11.mkdirSync)((0, import_node_path10.dirname)(configPath), { recursive: true });
+  (0, import_node_fs11.mkdirSync)((0, import_node_path10.resolve)(rootDir, "src/odla"), { recursive: true });
+  (0, import_node_fs11.mkdirSync)((0, import_node_path10.resolve)(rootDir, ".odla"), { recursive: true });
   (0, import_node_fs11.writeFileSync)(configPath, configTemplate({ appId: options.appId, name: options.name, envs, services, aiProvider }));
-  writeIfMissing((0, import_node_path9.resolve)(rootDir, "src/odla/schema.mjs"), schemaTemplate());
-  writeIfMissing((0, import_node_path9.resolve)(rootDir, "src/odla/rules.mjs"), rulesTemplate());
+  writeIfMissing((0, import_node_path10.resolve)(rootDir, "src/odla/schema.mjs"), schemaTemplate());
+  writeIfMissing((0, import_node_path10.resolve)(rootDir, "src/odla/rules.mjs"), rulesTemplate());
   ensureGitignore(rootDir);
   out.log(`created ${relativeDisplay(configPath, rootDir)}`);
   out.log("created src/odla/schema.mjs and src/odla/rules.mjs");
@@ -3314,8 +3846,8 @@ function assertWranglerConfig(cfg) {
 }
 
 // src/secrets-set.ts
-var import_ai = require("@odla-ai/ai");
-var import_apps4 = require("@odla-ai/apps");
+var import_ai2 = require("@odla-ai/ai");
+var import_apps8 = require("@odla-ai/apps");
 var PROD_ENV_NAMES2 = /* @__PURE__ */ new Set(["prod", "production"]);
 async function secretsSet(options) {
   const name = (options.name ?? "").trim();
@@ -3326,7 +3858,7 @@ async function secretsSet(options) {
   const { cfg, tenantId, value: value2, doFetch, out } = await resolveVaultWrite(options);
   const token = await getDeveloperToken(cfg, options, doFetch, out);
   try {
-    await (0, import_ai.putSecret)({ endpoint: cfg.dbEndpoint, token, fetch: doFetch }, tenantId, name, value2);
+    await (0, import_ai2.putSecret)({ endpoint: cfg.dbEndpoint, token, fetch: doFetch }, tenantId, name, value2);
   } catch (err) {
     throw new Error(scrubValue(err instanceof Error ? err.message : String(err), value2));
   }
@@ -3367,13 +3899,13 @@ async function resolveVaultWrite(options) {
     throw new Error(`refusing to store a secret for "${options.env}" without --yes`);
   }
   const value2 = await secretInputValue(options, "secret");
-  return { cfg, tenantId: (0, import_apps4.tenantIdFor)(cfg.app.id, options.env), value: value2, doFetch, out };
+  return { cfg, tenantId: (0, import_apps8.tenantIdFor)(cfg.app.id, options.env), value: value2, doFetch, out };
 }
 
 // src/skill.ts
 var import_node_fs12 = require("fs");
 var import_node_os2 = require("os");
-var import_node_path10 = require("path");
+var import_node_path11 = require("path");
 var import_node_url2 = require("url");
 
 // src/skill-adapters.ts
@@ -3452,8 +3984,8 @@ function installSkill(options = {}) {
   const files = listFiles(sourceDir);
   if (files.length === 0) throw new Error(`no bundled skills found at ${sourceDir}`);
   const harnesses = normalizeHarnesses(options.harnesses, options.global === true);
-  const root = (0, import_node_path10.resolve)(options.dir ?? process.cwd());
-  const home = (0, import_node_path10.resolve)(options.homeDir ?? (0, import_node_os2.homedir)());
+  const root = (0, import_node_path11.resolve)(options.dir ?? process.cwd());
+  const home = (0, import_node_path11.resolve)(options.homeDir ?? (0, import_node_os2.homedir)());
   const plans = /* @__PURE__ */ new Map();
   const targets = /* @__PURE__ */ new Map();
   const rememberTarget = (harness, target) => {
@@ -3467,48 +3999,48 @@ function installSkill(options = {}) {
     plans.set(target, { target, content: content2, boundary, managedMerge });
   };
   const planSkillTree = (targetDir2, boundary = root) => {
-    for (const rel of files) plan((0, import_node_path10.join)(targetDir2, rel), (0, import_node_fs12.readFileSync)((0, import_node_path10.join)(sourceDir, rel), "utf8"), false, boundary);
+    for (const rel of files) plan((0, import_node_path11.join)(targetDir2, rel), (0, import_node_fs12.readFileSync)((0, import_node_path11.join)(sourceDir, rel), "utf8"), false, boundary);
   };
   let targetDir;
   if (options.global) {
-    const claudeRoot = (0, import_node_path10.join)(home, ".claude", "skills");
-    const codexRoot = (0, import_node_path10.resolve)(options.codexHomeDir ?? process.env.CODEX_HOME ?? (0, import_node_path10.join)(home, ".codex"), "skills");
+    const claudeRoot = (0, import_node_path11.join)(home, ".claude", "skills");
+    const codexRoot = (0, import_node_path11.resolve)(options.codexHomeDir ?? process.env.CODEX_HOME ?? (0, import_node_path11.join)(home, ".codex"), "skills");
     targetDir = harnesses[0] === "codex" ? codexRoot : claudeRoot;
     for (const harness of harnesses) {
       const skillRoot = harness === "claude" ? claudeRoot : codexRoot;
-      planSkillTree(skillRoot, harness === "claude" ? home : (0, import_node_path10.dirname)((0, import_node_path10.dirname)(codexRoot)));
+      planSkillTree(skillRoot, harness === "claude" ? home : (0, import_node_path11.dirname)((0, import_node_path11.dirname)(codexRoot)));
       rememberTarget(harness, skillRoot);
     }
   } else {
-    const sharedRoot = (0, import_node_path10.join)(root, ".agents", "skills");
+    const sharedRoot = (0, import_node_path11.join)(root, ".agents", "skills");
     planSkillTree(sharedRoot);
-    const claudeRoot = (0, import_node_path10.join)(root, ".claude", "skills");
+    const claudeRoot = (0, import_node_path11.join)(root, ".claude", "skills");
     targetDir = harnesses.includes("claude") ? claudeRoot : sharedRoot;
     for (const harness of harnesses) rememberTarget(harness, sharedRoot);
     if (harnesses.includes("claude")) {
       for (const skill of skillNames(files)) {
-        const canonical = (0, import_node_fs12.readFileSync)((0, import_node_path10.join)(sourceDir, skill, "SKILL.md"), "utf8");
-        plan((0, import_node_path10.join)(claudeRoot, skill, "SKILL.md"), claudeAdapter(skill, canonical));
+        const canonical = (0, import_node_fs12.readFileSync)((0, import_node_path11.join)(sourceDir, skill, "SKILL.md"), "utf8");
+        plan((0, import_node_path11.join)(claudeRoot, skill, "SKILL.md"), claudeAdapter(skill, canonical));
       }
       rememberTarget("claude", claudeRoot);
     }
     if (harnesses.includes("cursor")) {
-      const cursorRule = (0, import_node_path10.join)(root, ".cursor", "rules", "odla.mdc");
+      const cursorRule = (0, import_node_path11.join)(root, ".cursor", "rules", "odla.mdc");
       plan(cursorRule, CURSOR_RULE);
       rememberTarget("cursor", cursorRule);
     }
     if (harnesses.includes("agents")) {
-      const agentsFile = (0, import_node_path10.join)(root, "AGENTS.md");
+      const agentsFile = (0, import_node_path11.join)(root, "AGENTS.md");
       plan(agentsFile, managedFileContent(agentsFile, PROJECT_INSTRUCTIONS, options.force === true, root), true);
       rememberTarget("agents", agentsFile);
     }
     if (harnesses.includes("copilot")) {
-      const copilotFile = (0, import_node_path10.join)(root, ".github", "copilot-instructions.md");
+      const copilotFile = (0, import_node_path11.join)(root, ".github", "copilot-instructions.md");
       plan(copilotFile, managedFileContent(copilotFile, PROJECT_INSTRUCTIONS, options.force === true, root), true);
       rememberTarget("copilot", copilotFile);
     }
     if (harnesses.includes("gemini")) {
-      const geminiFile = (0, import_node_path10.join)(root, "GEMINI.md");
+      const geminiFile = (0, import_node_path11.join)(root, "GEMINI.md");
       plan(geminiFile, managedFileContent(geminiFile, PROJECT_INSTRUCTIONS, options.force === true, root), true);
       rememberTarget("gemini", geminiFile);
     }
@@ -3544,7 +4076,7 @@ ${conflicts.map((f) => `  - ${f}`).join("\n")}`
   }
   for (const file of plans.values()) {
     if (!(0, import_node_fs12.existsSync)(file.target) || (0, import_node_fs12.readFileSync)(file.target, "utf8") !== file.content) {
-      (0, import_node_fs12.mkdirSync)((0, import_node_path10.dirname)(file.target), { recursive: true });
+      (0, import_node_fs12.mkdirSync)((0, import_node_path11.dirname)(file.target), { recursive: true });
       (0, import_node_fs12.writeFileSync)(file.target, file.content);
     }
   }
@@ -3564,7 +4096,7 @@ ${conflicts.map((f) => `  - ${f}`).join("\n")}`
   };
 }
 function pathsUnder(root, paths) {
-  return [...paths].map((path) => (0, import_node_path10.relative)(root, path)).filter((path) => path !== ".." && !path.startsWith(`..${import_node_path10.sep}`) && !(0, import_node_path10.isAbsolute)(path)).sort();
+  return [...paths].map((path) => (0, import_node_path11.relative)(root, path)).filter((path) => path !== ".." && !path.startsWith(`..${import_node_path11.sep}`) && !(0, import_node_path11.isAbsolute)(path)).sort();
 }
 function normalizeHarnesses(values, global) {
   const requested = values?.length ? values : ["claude"];
@@ -3609,13 +4141,13 @@ function managedFileContent(path, block, force, boundary) {
   return `${current.slice(0, startAt)}${block}${current.slice(afterEnd)}`;
 }
 function symlinkedComponent(boundary, target) {
-  const rel = (0, import_node_path10.relative)(boundary, target);
-  if (rel === ".." || rel.startsWith(`..${import_node_path10.sep}`) || (0, import_node_path10.isAbsolute)(rel)) {
+  const rel = (0, import_node_path11.relative)(boundary, target);
+  if (rel === ".." || rel.startsWith(`..${import_node_path11.sep}`) || (0, import_node_path11.isAbsolute)(rel)) {
     throw new Error(`agent setup target escapes its install root: ${target}`);
   }
   let current = boundary;
-  for (const part of rel.split(import_node_path10.sep).filter(Boolean)) {
-    current = (0, import_node_path10.join)(current, part);
+  for (const part of rel.split(import_node_path11.sep).filter(Boolean)) {
+    current = (0, import_node_path11.join)(current, part);
     try {
       if ((0, import_node_fs12.lstatSync)(current).isSymbolicLink()) return current;
     } catch (error) {
@@ -3632,9 +4164,9 @@ function listFiles(dir) {
   const results = [];
   const walk = (current) => {
     for (const entry of (0, import_node_fs12.readdirSync)(current, { withFileTypes: true })) {
-      const path = (0, import_node_path10.join)(current, entry.name);
+      const path = (0, import_node_path11.join)(current, entry.name);
       if (entry.isDirectory()) walk(path);
-      else results.push((0, import_node_path10.relative)(dir, path));
+      else results.push((0, import_node_path11.relative)(dir, path));
     }
   };
   walk(dir);
@@ -3710,7 +4242,7 @@ async function smoke(options) {
     out.log(`  schema: ${liveEntities.length} entities`);
     const aggregateEntity = expectedEntities[0] ?? liveEntities[0];
     if (aggregateEntity) {
-      const aggregate = await postJson(doFetch, `${cfg.dbEndpoint}/app/${encodeURIComponent(entry.tenantId)}/aggregate`, entry.dbKey, {
+      const aggregate = await postJson2(doFetch, `${cfg.dbEndpoint}/app/${encodeURIComponent(entry.tenantId)}/aggregate`, entry.dbKey, {
         ns: aggregateEntity,
         aggregate: { count: true }
       });
@@ -3754,16 +4286,16 @@ async function getJson(doFetch, url, bearer) {
   const res = await doFetch(url, {
     headers: bearer ? { authorization: `Bearer ${bearer}` } : void 0
   });
-  if (!res.ok) throw new Error(`${new URL(url).pathname} returned ${res.status}: ${await safeText3(res)}`);
+  if (!res.ok) throw new Error(`${new URL(url).pathname} returned ${res.status}: ${await safeText4(res)}`);
   return res.json();
 }
-async function postJson(doFetch, url, bearer, body) {
+async function postJson2(doFetch, url, bearer, body) {
   const res = await doFetch(url, {
     method: "POST",
     headers: { authorization: `Bearer ${bearer}`, "content-type": "application/json" },
     body: JSON.stringify(body)
   });
-  if (!res.ok) throw new Error(`${new URL(url).pathname} returned ${res.status}: ${await safeText3(res)}`);
+  if (!res.ok) throw new Error(`${new URL(url).pathname} returned ${res.status}: ${await safeText4(res)}`);
   return res.json();
 }
 function publicConfigUrl(platformUrl, appId, env) {
@@ -3771,7 +4303,7 @@ function publicConfigUrl(platformUrl, appId, env) {
   url.searchParams.set("env", env);
   return url.toString();
 }
-async function safeText3(res) {
+async function safeText4(res) {
   try {
     return redactSecrets((await res.text()).slice(0, 500));
   } catch {
@@ -3827,6 +4359,26 @@ async function secretsCommand(parsed, deps) {
   });
 }
 async function projectCommand(command, parsed, deps) {
+  if (command === "config") {
+    const sub = parsed.positionals[1];
+    if (sub !== "diff" && sub !== "plan") {
+      throw new Error(`unknown config subcommand "${sub ?? ""}". Try "odla-ai config diff --json".`);
+    }
+    assertArgs(parsed, ["config", "token", "email", "open", "json"], 2);
+    const options = {
+      configPath: stringOpt(parsed.options.config) ?? "odla.config.mjs",
+      token: stringOpt(parsed.options.token),
+      email: stringOpt(parsed.options.email),
+      open: parsed.options.open === false ? false : parsed.options.open === true ? true : void 0,
+      json: parsed.options.json === true,
+      fetch: deps.fetch,
+      openApprovalUrl: deps.openUrl,
+      stdout: deps.stdout
+    };
+    if (sub === "diff") await configDiff(options);
+    else await configPlan(options);
+    return true;
+  }
   if (command === "init") {
     assertArgs(parsed, ["app-id", "name", "config", "env", "services", "ai-provider", "force"], 1);
     initProject({
@@ -3887,7 +4439,7 @@ async function projectCommand(command, parsed, deps) {
 // src/code-connect.ts
 var import_node_fs14 = require("fs");
 var import_node_os4 = require("os");
-var import_node_path12 = require("path");
+var import_node_path13 = require("path");
 
 // ../harness/dist/chunk-QTUEF2HZ.js
 var HARNESS_PROTOCOL_VERSION = 1;
@@ -4505,7 +5057,7 @@ var CamelError = class extends Error {
 };
 
 // ../camel/dist/chunk-L5DYU2E2.js
-function canonicalJson(value2) {
+function canonicalJson2(value2) {
   return JSON.stringify(normalize(value2));
 }
 async function sha256Hex(value2) {
@@ -4517,7 +5069,7 @@ function utf8Length(value2) {
   if (typeof value2 === "string") return new TextEncoder().encode(value2).byteLength;
   if (value2 instanceof Uint8Array) return value2.byteLength;
   try {
-    return new TextEncoder().encode(canonicalJson(value2)).byteLength;
+    return new TextEncoder().encode(canonicalJson2(value2)).byteLength;
   } catch {
     throw new CamelError("conversion_rejected", "Unsafe input could not be canonically measured.");
   }
@@ -4643,7 +5195,7 @@ async function digestCodeVerificationReceipt(fields) {
     changedTestsRequireReview: fields.changedTestsRequireReview,
     outcome: fields.outcome
   };
-  return `sha256:${await sha256Hex(canonicalJson(canonical))}`;
+  return `sha256:${await sha256Hex(canonicalJson2(canonical))}`;
 }
 function validate(fields) {
   if (fields.schemaVersion !== 1 || typeof fields.verificationId !== "string" || !ID.test(fields.verificationId) || typeof fields.trustedBaseCommitSha !== "string" || !SHA.test(fields.trustedBaseCommitSha) || !DIGEST.test(fields.trustedBaseDigest) || !DIGEST.test(fields.patchDigest) || !DIGEST.test(fields.candidateDigest) || !DIGEST.test(fields.sourceDigest) || !DIGEST.test(fields.policyDigest) || !DIGEST.test(fields.changedTestSetDigest) || !Number.isSafeInteger(fields.changedTestCount) || fields.changedTestCount < 0 || fields.changedTestCount > 1e4 || fields.changedTestsRequireReview !== fields.changedTestCount > 0 || fields.recipes.length < 1 || fields.recipes.length > 64) {
@@ -4681,9 +5233,9 @@ async function createCodePortableCheckpoint(input) {
   const state2 = normalizeState(input.state);
   validateBaseAndPatch(input.baseCommitSha, input.patch);
   const patchDigest = `sha256:${await sha256Hex(input.patch)}`;
-  const stateDigest = `sha256:${await sha256Hex(canonicalJson(state2))}`;
+  const stateDigest = `sha256:${await sha256Hex(canonicalJson2(state2))}`;
   const fields = { schemaVersion: 1, baseCommitSha: input.baseCommitSha, patchDigest, state: state2, stateDigest };
-  const checkpointDigest = `sha256:${await sha256Hex(canonicalJson(fields))}`;
+  const checkpointDigest = `sha256:${await sha256Hex(canonicalJson2(fields))}`;
   return freeze({ ...fields, patch: input.patch, checkpointDigest });
 }
 async function verifyCodePortableCheckpoint(value2) {
@@ -4801,7 +5353,7 @@ async function digestCodeRepositorySnapshot(snapshot, limits = DEFAULT_LIMITS) {
     commitSha: snapshot.commitSha,
     files: [...snapshot.files].map((file) => ({ path: file.path, content: file.content })).sort((left, right) => left.path.localeCompare(right.path))
   };
-  return `sha256:${await sha256Hex(canonicalJson(normalized))}`;
+  return `sha256:${await sha256Hex(canonicalJson2(normalized))}`;
 }
 function validateSnapshot(snapshot, limits) {
   if (!REPOSITORY.test(snapshot.repository) || !SHA4.test(snapshot.commitSha)) {
@@ -4843,10 +5395,10 @@ var import_path9 = require("path");
 
 // ../camel/dist/chunk-LAXU2AVK.js
 function conversionPolicyDigest(policy) {
-  return sha256Hex(canonicalJson(policy));
+  return sha256Hex(canonicalJson2(policy));
 }
 function registeredIdRegistryDigest(values) {
-  return sha256Hex(canonicalJson(values));
+  return sha256Hex(canonicalJson2(values));
 }
 async function createConversionRegistry(config) {
   const policies = /* @__PURE__ */ new Map();
@@ -5047,10 +5599,10 @@ function createEffectPolicy(config = {}) {
   return Object.freeze({ evaluate: (input) => evaluate(input, registries, approvalEffects) });
 }
 function destinationRegistryDigest(values) {
-  return sha256Hex(canonicalJson([...values].sort()));
+  return sha256Hex(canonicalJson2([...values].sort()));
 }
 async function evaluate(input, registries, approvals) {
-  const actionDigest = await sha256Hex(canonicalJson(input));
+  const actionDigest = await sha256Hex(canonicalJson2(input));
   const decisionId = `decision_${actionDigest.slice(0, 24)}`;
   const deny = (reasonCode) => ({ outcome: "deny", decisionId, reasonCode });
   if (!input.planId || !input.tool.name || !input.tool.policyId || !Number.isSafeInteger(input.tool.version)) return deny("invalid_descriptor");
@@ -6771,268 +7323,19 @@ var CodePiRuntimeEngine = class {
   }
 };
 
-// src/help.ts
+// src/version.ts
 var import_node_fs13 = require("fs");
 function cliVersion() {
   const pkg = JSON.parse((0, import_node_fs13.readFileSync)(new URL("../package.json", importMetaUrl), "utf8"));
   return pkg.version ?? "unknown";
 }
-function printHelp(output = console) {
-  output.log(`odla-ai
 
-Start here:
-  odla-ai runbook ask "<question>"   The current procedure, from odla's own
-                                     runbooks. Ask BEFORE searching the web or
-                                     working from memory: runbooks are edited
-                                     live, so your training data is out of date
-                                     and this is not.
-  odla-ai runbook impact             After a change: which runbooks describe the
-                                     code you just touched, so you can fix any
-                                     step it made wrong.
-
-Usage:
-  odla-ai setup [--dir <project>] [--agent <name>] [--global] [--force]
-  odla-ai init --app-id <id> --name <name> [--services db,ai,o11y,calendar] [--env dev --env prod]
-  odla-ai doctor [--config odla.config.mjs]
-  odla-ai calendar status [--env dev] [--email <odla-account>] [--json]
-  odla-ai calendar calendars [--env dev] [--email <odla-account>] [--json]
-  odla-ai calendar connect [--env dev] [--email <odla-account>] [--no-open] [--yes]
-  odla-ai calendar disconnect [--env dev] [--email <odla-account>] --yes
-  odla-ai app archive [--config odla.config.mjs] [--email <odla-account>] [--json] --yes
-  odla-ai app restore [--config odla.config.mjs] [--email <odla-account>] [--json]
-  odla-ai app export [--env dev] [--fresh] [--out <file>] [--email <odla-account>] [--json]
-  odla-ai app import <file|-> [--env dev] [--ns <namespace>] [--id-field <f>|--key <attr>|--generate-ids] [--dry-run] [--json] --yes
-  odla-ai app refresh-sandbox [--include-identity] [--include-files] [--dry-run] [--json] --yes
-  odla-ai app go-live         [--include-identity] [--include-files] [--dry-run] [--json] --yes
-  odla-ai app promote         [--dry-run] [--json] --yes
-  odla-ai app rename <name> [--config odla.config.mjs] [--email <odla-account>] [--json]
-  odla-ai app owners list [--config odla.config.mjs] [--email <odla-account>] [--json]
-  odla-ai app owners add <email> [--email <odla-account>] [--json]
-  odla-ai app owners remove <email> [--email <odla-account>] [--json]
-  odla-ai pm goal list [--app <id>] [--status <s>] [--q <text>] [--limit <n>] [--offset <n>] [--json]
-  odla-ai pm task list [--app <id>] [--column <c>] [--goal <id>] [--assignee <id>] [--q <text>] [--limit <n>] [--offset <n>] [--json]
-  odla-ai pm decision list [--app <id>] [--status <s>] [--q <text>] [--limit <n>] [--offset <n>] [--json]
-  odla-ai pm bug list [--app <id>] [--status <s>] [--severity <s>] [--goal <id>] [--assignee <id>] [--decision <id>] [--q <text>] [--limit <n>] [--offset <n>] [--json]
-  odla-ai pm goal add --app <id> --title <t> [--status <s>] [--proof <text>] [--target <pct>] [--mutation-id <id>] [--json]
-  odla-ai pm task add --app <id> --title <t> [--column <c>] [--goal <id>] [--assignee <id>] [--description <text>|--body <text>] [--due <epoch-ms>] [--mutation-id <id>] [--json]
-  odla-ai pm decision add --app <id> --title <t> --body <text> [--status <s>] [--mutation-id <id>] [--json]
-  odla-ai pm bug add --app <id> --title <t> (--description <text>|--body <text>) [--status <s>] [--severity <s>] [--goal <id>] [--assignee <id>] [--decision <id>] [--mutation-id <id>] [--json]
-  odla-ai pm <goal|task|decision|bug> get <id> [--json]
-  odla-ai pm goal set <id> [--title <t>|--status <s>|--proof <text>|--no-proof|--target <pct>|--no-target] [--mutation-id <id>] [--json]
-  odla-ai pm task set <id> [--title <t>|--column <c>|--rank <n>|--goal <id>|--no-goal|--assignee <id>|--no-assignee|--description <text>|--body <text>|--due <epoch-ms>|--no-due] [--mutation-id <id>] [--json]
-  odla-ai pm decision set <id> [--title <t>|--status <s>|--body <text>] [--mutation-id <id>] [--json]
-  odla-ai pm bug set <id> [--title <t>|--status <s>|--severity <s>|--goal <id>|--no-goal|--assignee <id>|--no-assignee|--decision <id>|--no-decision|--description <text>|--body <text>] [--mutation-id <id>] [--json]
-  odla-ai pm <goal|task|decision> done <id> [--mutation-id <id>]
-  odla-ai pm bug done <id> [--decision <accepted-decision-id>] [--mutation-id <id>]
-  odla-ai pm <goal|task|decision|bug> comment <id> --body "..." [--mutation-id <id>]
-  odla-ai pm <goal|task|decision|bug> comments <id> [--json]
-  odla-ai pm <goal|task|decision|bug> rm <id>
-  odla-ai pm handoff --app <id> [--json]
-  odla-ai discuss groups [--json]
-  odla-ai discuss list [--app <id>] [--q <text>] [--state open|resolved|all] [--json]
-  odla-ai discuss read <topic> [--limit <n> --offset <n>] [--json]
-  odla-ai discuss post --app <id> --subject "..." --body "..." [--markup "... @[Label](kind/id)"] [--mutation-id <id>]
-  odla-ai discuss reply <topic> --body "..." [--markup "..."] [--mutation-id <id>]
-  odla-ai discuss resolve <topic> [--reopen] [--mutation-id <id>]
-  odla-ai discuss who --q <text> [--app <id>] [--kinds user,pm:task] [--json]
-  odla-ai discuss watch [<topic>] [--cursor <cursor>] [--by <authorId>] [--self <authorId>] [--interval <s>] [--timeout <s>] [--json|--jsonl]
-  odla-ai agent jobs [--env dev] [--state pending|running|succeeded|dead_letter] [--limit 50] [--email <email>] [--json]
-  odla-ai agent retry <job-id> [--env dev] [--email <email>] [--json]
-  odla-ai context show [--context <name>] [--platform https://odla.ai] [--app <id>] [--env prod] [--json]
-  odla-ai context list [--json]
-  odla-ai context save <name> [--platform <url>] [--app <id>] [--env <name>] [--json]
-  odla-ai context remove <name> --yes [--json]
-  odla-ai o11y status [--app <id>] [--context <name>] [--platform https://odla.ai] [--env prod] [--minutes 60] [--json]
-  odla-ai platform status [--context <name>] [--platform https://odla.ai] [--email <odla-account>] [--json]
-  odla-ai whoami [--context <name>] [--platform https://odla.ai] [--json]
-  odla-ai runbook ask "<question>" [--app <id>] [--all] [--json]
-  odla-ai runbook search "<question>" [--app <id>] [--all] [--limit <n>] [--json]
-  odla-ai runbook impact [--base origin/main] [--app <id>] [--all] [--limit <n>] [--json]
-  odla-ai runbook lint [--app <id>] [--all] [--json]
-  odla-ai runbook list [--app <id>] [--all] [--q <text>] [--json]
-  odla-ai runbook comment <slug> --body "..." [--app <id>]
-  odla-ai runbook get <slug> [--app <id>]
-  odla-ai runbook new <slug> --title <t> --file <path|-> [--summary <s>] [--requires <specs>] [--app <id>]
-  odla-ai runbook edit <slug> [--file <path|->|--body "..."] [--note <why>] [--requires <specs>] [--app <id>]
-  odla-ai runbook import <dir> [--visibility operator|admin] [--dry-run] [--app <id>]
-  odla-ai runbook publish <slug> [--app <id>]
-  odla-ai runbook visibility <slug> <operator|admin> [--app <id>]
-  odla-ai runbook archive <slug> [--app <id>]
-  odla-ai runbook history <slug> [--app <id>] [--json]
-  odla-ai runbook revert <slug> --version <n> [--app <id>]
-  odla-ai runbook rm <slug> [--app <id>]
-  odla-ai capabilities [--json]
-  odla-ai code connect [--env dev|prod] [--email <odla-account>] [--engine auto|container|podman|docker] [--slots <1-64>] [--once]
-  odla-ai admin ai show [--context <name>] [--platform https://odla.ai] [--email <odla-account>] [--json]
-  odla-ai admin ai models [--context <name>] [--provider <id>] [--json]
-  odla-ai admin ai set <purpose> [--context <name>] [--provider <id>] [--model <id>] [--enabled|--no-enabled]
-    [--max-input-bytes <n>] [--max-output-tokens <n>] [--max-calls-per-run <n>] [--json]
-  odla-ai admin ai set security [--context <name>] --discovery-provider <id> --discovery-model <id>
-    --validation-provider <id> --validation-model <id> [--enabled|--no-enabled] [--json]
-  odla-ai admin ai credentials [--context <name>] [--json]
-  odla-ai admin ai credential set <provider> [--context <name>] (--from-env <NAME>|--stdin)
-  odla-ai admin ai usage [--context <name>] [--app-id <id>] [--env <env>] [--run-id <id>] [--limit <1-500>] [--json]
-  odla-ai admin ai audit [--context <name>] [--limit <1-200>] [--json]
-  odla-ai security github connect [--repo owner/name] [--env dev] [--email <odla-account>] [--no-open]
-  odla-ai security github disconnect --source <id> [--env dev] [--yes]
-  odla-ai security plan [--env dev] [--json]
-  odla-ai security sources [--env dev] [--json]
-  odla-ai security run --source <id> --plan-digest <sha256:...> --ack-redacted-source [--ref <branch|tag|sha>] [--env dev] [--no-follow]
-  odla-ai security status <job-id> [--follow] [--json]
-  odla-ai security report <job-id> [--json]
-  odla-ai security run [target] --ack-redacted-source [--env dev] [--profile odla] [--fail-on high]
-  odla-ai security run [target] --self --ack-redacted-source
-  odla-ai provision [--config odla.config.mjs] [--email <odla-account>] [--wait <seconds>] [--dry-run] [--push-secrets] [--rotate-o11y-token] [--write-dev-vars[=path]] [--yes]
-  odla-ai smoke [--config odla.config.mjs] [--env dev] [--email <odla-account>] [--no-open]
-  odla-ai skill install [--dir <project>] [--agent <name>] [--global] [--force]
-  odla-ai secrets push --env <env> [--config odla.config.mjs] [--dry-run] [--yes]
-  odla-ai secrets set <name> --env <env> (--from-env <NAME>|--stdin) [--email <odla-account>] [--config odla.config.mjs] [--yes]
-  odla-ai secrets set-clerk-key --env <env> (--from-env <NAME>|--stdin) [--email <odla-account>] [--config odla.config.mjs] [--yes]
-  odla-ai version
-
-Commands:
-  agent        Inspect durable agent wakeups and explicitly requeue a
-               dead-lettered job; JSON output is stable for remote operators.
-  runbook      odla's operational procedures, stored in the database and read at
-               the moment they are followed. "ask" gives a written, cited answer;
-               "search" the passages behind it; "get" the whole document.
-               "impact" diffs your working tree against a base ref and names the
-               runbooks that describe what you changed \u2014 run it after touching a
-               package's exported API or JSDoc, or a Studio surface. "lint"
-               checks the corpus the other way: every odla-ai command the
-               runbooks name is held against this CLI's real command surface,
-               and against the minimum versions each runbook declares. A wrong step
-               is fixed with "edit", which takes effect immediately: a runbook is
-               a row, not a release. Runbooks describe PROCEDURE; what an export
-               does and what it guarantees is JSDoc, rendered per package at
-               https://odla.ai/docs and shipped in the installed .d.ts. Answering
-               a question usually needs both.
-  whoami       Report who this terminal is authenticated as, and whether it holds
-               platform admin. A handshake-minted device token is never admin,
-               however the human who approved it is configured.
-  context      Explain selected config, platform, app, environment, and
-               developer-token provenance without printing credentials or
-               starting a device handshake. Operator work can run outside a
-               project checkout with explicit flags or ODLA_* environment
-               variables.
-  setup        Install offline odla runbooks for common coding-agent harnesses.
-  init         Create a generic odla.config.mjs plus starter schema/rules files.
-  doctor       Validate and summarize the project config without network calls.
-  calendar     Inspect, connect, or disconnect the live Google booking connection.
-  app          Archive (suspend, data retained), restore, export, import, or
-               manage the co-owners of the app. Archiving takes every
-               environment's data plane down until restored; permanent deletion
-               has NO CLI \u2014 it requires a signed-in owner in Studio, and no
-               machine or agent credential can purge. "app export" downloads a
-               portable gzipped-JSONL snapshot of one database (--fresh takes a
-               new snapshot first) \u2014 your data is always yours to take.
-               "app import" upserts rows back in from JSON, JSONL, or a
-               {namespace: rows} map (the shape a query returns); it writes only
-               with --yes, so the bare command is a dry run, and it refuses to
-               guess an id mode that would duplicate rows on a re-run.
-               "app refresh-sandbox" replaces the sandbox with a copy of live
-               (the routine dev loop); "app go-live" copies the sandbox into an
-               EMPTY live database, once, at launch; "app promote" pushes only
-               schema, rules and gates up afterwards, leaving live's rows alone.
-               Each prints its plan and writes nothing without --yes, so the
-               bare command is the dry run. Clerk config, triggers, allowlists,
-               secrets and API keys never travel; identity rows stay behind
-               unless --include-identity.
-               "app rename <name>" changes only the display name humans read;
-               the app id is permanent (tenants, URLs and keys embed it), so a
-               rename never re-provisions anything or invalidates a credential.
-               "app owners add <email>" grants a signed-up odla member the SAME
-               full access as you; they then run their own "provision" to mint
-               their own credentials for the shared db (the live one included)
-               \u2014 no secret is ever copied between people.
-  capabilities Show what the CLI automates vs agent edits and human checkpoints.
-  code         Enroll this Mac/Linux host for the current Studio-connected repository and run Pi.
-  admin        Manage platform-funded AI routing/credentials/usage with narrow device grants.
-  security     Connect GitHub sources and run commit-pinned hosted reviews, or scan a local snapshot.
-  pm           Project management (via @odla-ai/pm) shared across the apps you
-               co-own: conformance goals, kanban tasks, decisions, and bugs. With
-               no --app, "list" spans every co-owned project (the cross-project
-               view); with --app it scopes to one. Same device-grant auth as
-               "app". Entities: goal (alias conformance), task (alias kanban),
-               decision, bug. Status changes and comments post to each item's
-               @odla-ai/chat discussion thread.
-  discuss      Group discussions (via @odla-ai/chat) for the apps you co-own:
-               one group per project, topics with replies, @-mentions of people,
-               agents, PM items, and projects. Built for unattended use \u2014 post a
-               question, then "watch" it until someone answers. "watch" exits 75
-               (not 1) when it times out with nothing new, so a script can tell
-               "no answer yet" from a failure and just rerun. Use "who" to look
-               up the exact @[Label](kind/id) markup for a mention.
-  o11y         Read one stable status envelope for application RED, current
-               live-sync load/freshness, the protected commit-to-visible
-               canary, collector ingest/scheduler trust, Cloudflare-owned
-               runtime metrics, and a machine verdict.
-               --json keeps auth progress on stderr for unattended agents.
-  platform     Read canonical fleet health, releases, provider load/freshness,
-               explicit unknowns, and next actions through a read-only grant.
-  provision    Register services, compose integrations, persist credentials, optionally push secrets.
-  smoke        Verify credentials, public-config, composed schema, db aggregate, and integration probes.
-  skill        Same installer; --agent accepts all, claude, codex, cursor,
-               copilot, gemini, or agents (repeatable or comma-separated).
-  secrets      Push configured db/o11y secrets into the Worker via wrangler
-               stdin; set stores a tenant-vault secret and set-clerk-key the
-               reserved Clerk secret key, write-only from stdin or an env var.
-  version      Print the CLI version.
-
-Safety:
-  Every app has two databases on odla.ai: a sandbox (env "dev", tenant
-  <appId>--dev) and a live one (env "prod", tenant <appId>). Both are served by
-  production odla.ai \u2014 there is no separate odla to point at. New projects get
-  the sandbox only. Add "prod" explicitly to odla.config.mjs and pass --yes to
-  provision the live database; use --dry-run first to inspect the resolved plan.
-  Provision caches the approved developer token and service credentials under
-  .odla/ with mode 0600, and init adds those paths to .gitignore. Secret push
-  preflights Wrangler before any shown-once issuance or destructive rotation.
-  Projectless PM, Discussions, o11y, runbook, and identity commands use
-  --platform/--app/--env, ODLA_PLATFORM_URL/ODLA_APP_ID/ODLA_ENV, and
-  ODLA_DEV_TOKEN. Save non-secret scope metadata with "context save", then
-  select it explicitly with --context or ODLA_CONTEXT. Each named context gets
-  isolated developer and scoped-token caches. Override their locations with
-  ODLA_DEV_TOKEN_FILE and ODLA_ADMIN_TOKEN_FILE; ODLA_CONTEXT_FILE relocates
-  the metadata file. Flags and specific ODLA_* scope variables beat a selected
-  context, which beats project config. There is no ambient current context.
-  "context show" reports only provenance and cache state and never authenticates.
-  Provision opens the approval page in your browser automatically whenever the
-  machine can show one, including agent-driven runs; only CI, SSH, and
-  display-less hosts skip it. Use --open to force or --no-open to suppress.
-  Browser launch is best-effort: the printed approval URL is authoritative and
-  agents must relay it to the human verbatim. A started handshake is persisted
-  under .odla/, so a command killed mid-wait loses nothing \u2014 rerunning resumes
-  the same code. Outside an interactive terminal the wait is capped (90s by
-  default, --wait <seconds> to change); a still-pending handshake then exits
-  with code 75: relay the URL, wait for approval, and re-run to collect.
-  A fresh device handshake requires --email <odla-account> or ODLA_USER_EMAIL.
-  The email is a non-secret identity hint: never provide a password or session
-  token. The matching account must already exist, be signed in, explicitly
-  review the exact code, and finish any current request before claiming another.
-  Run Code from a GitHub checkout already connected to an app in Studio; an
-  odla.config.mjs may select the app explicitly but is not required. Code host
-  approval and credential hashes live in odla-ai/db. The host
-  credential is never written under .odla/; it exists only in the foreground
-  "code connect" process and is rotated by the next approved connection.
-  Calendar setup has a second human checkpoint: odla issues a state-bound Google consent URL;
-  OAuth codes and refresh tokens never enter the CLI, repo, chat, or app.
-  GitHub security uses source-read-only access plus optional metadata-only Checks write: the CLI never asks
-  for a PAT or provider key. GitHub read access is separate from the explicit
-  --ack-redacted-source consent and the exact --plan-digest printed by security
-  plan are required before bounded snippets reach System AI.
-  Run security plan first to inspect the admin-selected providers, models,
-  per-route bounds, credential readiness, retention, no-execution boundary,
-  and digest that binds consent to that exact plan.
-`);
-}
-
-// src/security-hosted-github.ts
-var import_node_child_process4 = require("child_process");
-var import_node_util2 = require("util");
+// src/security-hosted-github.ts
+var import_node_child_process4 = require("child_process");
+var import_node_util2 = require("util");
 
 // src/security-hosted-request.ts
-async function requestHostedSecurityJson(options, path, init, action) {
+async function requestHostedSecurityJson(options, path, init, action2) {
   const platform = platformAudience(options.platform);
   const token = hostedSecurityCredential(options.token);
   const requestInit = {
@@ -7052,7 +7355,7 @@ async function requestHostedSecurityJson(options, path, init, action) {
   if (!response2.ok) {
     const code = optionalHostedText(body.error?.code, "error code", 128);
     const message2 = optionalHostedText(body.error?.message, "error message", 300);
-    throw new Error(`${action} failed (${response2.status})${code ? ` ${code}` : ""}${message2 ? `: ${message2}` : ""}`);
+    throw new Error(`${action2} failed (${response2.status})${code ? ` ${code}` : ""}${message2 ? `: ${message2}` : ""}`);
   }
   return body;
 }
@@ -7243,7 +7546,7 @@ async function defaultReadOrigin(cwd) {
 
 // src/code-local-source.ts
 var import_node_child_process5 = require("child_process");
-var import_node_crypto = require("crypto");
+var import_node_crypto2 = require("crypto");
 var SOURCE_LIMITS2 = { maxFiles: 2e4, maxBytes: 512 * 1024 * 1024 };
 async function prepareCodeLocalSource(cwd, repository, readHead = readGitHead) {
   const headCommitSha = await readHead(cwd);
@@ -7294,15 +7597,15 @@ async function readGitHead(cwd) {
   return value2;
 }
 function digestText(value2) {
-  return `sha256:${(0, import_node_crypto.createHash)("sha256").update(value2).digest("hex")}`;
+  return `sha256:${(0, import_node_crypto2.createHash)("sha256").update(value2).digest("hex")}`;
 }
 
 // src/code-images.ts
 var import_node_child_process6 = require("child_process");
-var import_node_crypto2 = require("crypto");
+var import_node_crypto3 = require("crypto");
 var import_promises10 = require("fs/promises");
 var import_node_os3 = require("os");
-var import_node_path11 = require("path");
+var import_node_path12 = require("path");
 var import_node_url3 = require("url");
 
 // src/code-runtime-config.ts
@@ -7385,13 +7688,13 @@ async function embeddedPiImageName() {
   const bundle = await (0, import_promises10.readFile)(embeddedPiAssetPath()).catch(() => {
     throw new Error("CLI-embedded Pi runtime is missing; reinstall this exact @odla-ai/cli version");
   });
-  return `odla-ai/pi-agent:embedded-sha256-${(0, import_node_crypto2.createHash)("sha256").update(bundle).digest("hex")}`;
+  return `odla-ai/pi-agent:embedded-sha256-${(0, import_node_crypto3.createHash)("sha256").update(bundle).digest("hex")}`;
 }
 async function buildEmbeddedPiImage(engine, image, run) {
-  const context = await (0, import_promises10.mkdtemp)((0, import_node_path11.join)((0, import_node_os3.tmpdir)(), "odla-code-pi-"));
+  const context = await (0, import_promises10.mkdtemp)((0, import_node_path12.join)((0, import_node_os3.tmpdir)(), "odla-code-pi-"));
   try {
-    await (0, import_promises10.copyFile)(embeddedPiAssetPath(), (0, import_node_path11.join)(context, "pi-agent.js"));
-    await (0, import_promises10.writeFile)((0, import_node_path11.join)(context, "Dockerfile"), [
+    await (0, import_promises10.copyFile)(embeddedPiAssetPath(), (0, import_node_path12.join)(context, "pi-agent.js"));
+    await (0, import_promises10.writeFile)((0, import_node_path12.join)(context, "Dockerfile"), [
       `FROM ${CODE_NODE_IMAGE}`,
       "COPY pi-agent.js /opt/odla/pi-agent.js",
       "WORKDIR /workspace",
@@ -7407,7 +7710,7 @@ async function buildEmbeddedPiImage(engine, image, run) {
 // src/code-connect.ts
 async function codeConnect(options) {
   const cwd = options.cwd ?? process.cwd();
-  const configPath = (0, import_node_path12.resolve)(cwd, options.configPath);
+  const configPath = (0, import_node_path13.resolve)(cwd, options.configPath);
   const cfg = (0, import_node_fs14.existsSync)(configPath) ? await loadProjectConfig(configPath) : null;
   const requestedAppId = options.appId?.trim();
   if (requestedAppId && !/^[a-z0-9][a-z0-9-]{1,62}$/.test(requestedAppId)) {
@@ -7575,9 +7878,9 @@ function parseConnection(value2, appId, appEnv) {
   }
   return root;
 }
-function apiFailure(action, status, value2) {
+function apiFailure(action2, status, value2) {
   const message2 = record4(record4(value2)?.error)?.message;
-  return `${action} failed (${status})${typeof message2 === "string" ? `: ${message2}` : ""}`;
+  return `${action2} failed (${status})${typeof message2 === "string" ? `: ${message2}` : ""}`;
 }
 function record4(value2) {
   return value2 && typeof value2 === "object" && !Array.isArray(value2) ? value2 : null;
@@ -7644,136 +7947,391 @@ function clean3(value2) {
   return normalized || void 0;
 }
 
-// src/context-command.ts
-async function contextCommand(parsed, deps = {}) {
-  assertArgs(
-    parsed,
-    [
-      "config",
-      "context",
-      "platform",
-      "app",
-      "env",
-      "token",
-      "json",
-      "yes"
-    ],
-    3
-  );
-  const action = parsed.positionals[1];
-  const out = deps.stdout ?? console;
-  if (action === "list") {
-    const profiles = listOperatorProfiles();
-    if (parsed.options.json === true) {
-      out.log(JSON.stringify({ schemaVersion: 1, profiles }, null, 2));
-      return;
-    }
-    if (profiles.length === 0) {
-      out.log("No named operator contexts.");
-      return;
-    }
-    out.log("name	platform	app	environment");
-    for (const profile of profiles) {
-      out.log(
-        `${profile.name}	${profile.platform}	${profile.app ?? ""}	${profile.environment ?? ""}`
-      );
-    }
-    return;
-  }
-  if (action === "save") {
-    if (parsed.options.token !== void 0) {
-      throw new Error(
-        "context save does not accept --token; contexts store scope metadata only"
-      );
-    }
-    const name = requireName(parsed);
-    const context2 = await resolveOperatorContext(parsed, {
-      allowMissingConfig: true
-    });
-    const profile = {
-      platform: context2.platform.value,
-      ...context2.app.value ? { app: context2.app.value } : {},
-      ...context2.environment.value ? { environment: context2.environment.value } : {}
-    };
-    saveOperatorProfile(name, profile, context2.profile.file);
-    if (parsed.options.json === true) {
-      out.log(JSON.stringify({ schemaVersion: 1, name, ...profile }, null, 2));
-    } else {
-      out.log(`saved operator context "${name}" (${profile.platform})`);
-    }
-    return;
-  }
-  if (action === "remove") {
-    const name = requireName(parsed);
-    if (parsed.options.yes !== true) {
-      throw new Error(`context remove "${name}" requires --yes`);
-    }
-    const removed = removeOperatorProfile(name);
-    const result2 = {
-      schemaVersion: 1,
-      name,
-      removed,
-      credentialCachesRemoved: false,
-      grantsRevoked: false
-    };
-    if (parsed.options.json === true) out.log(JSON.stringify(result2, null, 2));
-    else {
-      const status = removed ? `removed operator context "${name}"` : `operator context "${name}" was already absent`;
-      out.log(`${status}; credential caches were not deleted or revoked`);
-    }
-    return;
-  }
-  if (action !== "show") {
-    throw new Error(
-      `unknown context action "${action ?? ""}". Try show|list|save|remove.`
-    );
-  }
-  const context = await resolveOperatorContext(parsed, {
-    allowMissingConfig: true,
-    defaultEnvironment: "prod"
-  });
-  const token = developerTokenStatus(context, parsed);
-  const result = {
-    schemaVersion: 1,
-    profile: context.profile,
-    config: context.config,
-    platform: context.platform,
-    app: context.app,
-    environment: context.environment,
-    authentication: {
-      developerToken: token,
-      scopedTokenCacheFile: context.credentials.scopedTokenFile,
-      handshakeStarted: false
-    }
-  };
-  if (parsed.options.json === true) {
-    out.log(JSON.stringify(result, null, 2));
-    return;
-  }
-  out.log(`config:    ${context.config.status} (${context.config.path})`);
-  out.log(
-    `context:   ${context.profile.name ?? "(none)"} (${context.profile.source}; ${context.profile.file})`
-  );
-  out.log(
-    `platform:  ${context.platform.value} (${context.platform.source})`
-  );
-  out.log(
-    `app:       ${context.app.value ?? "(unresolved)"} (${context.app.source})`
-  );
-  out.log(
-    `env:       ${context.environment.value ?? "(unresolved)"} (${context.environment.source})`
-  );
-  out.log(
-    `auth:      ${token.source} (cache ${token.cacheStatus}: ${token.cacheFile})`
-  );
-  out.log("handshake: not started");
-}
-function requireName(parsed) {
-  const name = parsed.positionals[2]?.trim();
-  if (!name) {
-    throw new Error(`context ${parsed.positionals[1]} needs a profile name`);
-  }
-  return name;
+// src/context-command.ts
+async function contextCommand(parsed, deps = {}) {
+  assertArgs(
+    parsed,
+    [
+      "config",
+      "context",
+      "platform",
+      "app",
+      "env",
+      "token",
+      "json",
+      "yes"
+    ],
+    3
+  );
+  const action2 = parsed.positionals[1];
+  const out = deps.stdout ?? console;
+  if (action2 === "list") {
+    const profiles = listOperatorProfiles();
+    if (parsed.options.json === true) {
+      out.log(JSON.stringify({ schemaVersion: 1, profiles }, null, 2));
+      return;
+    }
+    if (profiles.length === 0) {
+      out.log("No named operator contexts.");
+      return;
+    }
+    out.log("name	platform	app	environment");
+    for (const profile of profiles) {
+      out.log(
+        `${profile.name}	${profile.platform}	${profile.app ?? ""}	${profile.environment ?? ""}`
+      );
+    }
+    return;
+  }
+  if (action2 === "save") {
+    if (parsed.options.token !== void 0) {
+      throw new Error(
+        "context save does not accept --token; contexts store scope metadata only"
+      );
+    }
+    const name = requireName(parsed);
+    const context2 = await resolveOperatorContext(parsed, {
+      allowMissingConfig: true
+    });
+    const profile = {
+      platform: context2.platform.value,
+      ...context2.app.value ? { app: context2.app.value } : {},
+      ...context2.environment.value ? { environment: context2.environment.value } : {}
+    };
+    saveOperatorProfile(name, profile, context2.profile.file);
+    if (parsed.options.json === true) {
+      out.log(JSON.stringify({ schemaVersion: 1, name, ...profile }, null, 2));
+    } else {
+      out.log(`saved operator context "${name}" (${profile.platform})`);
+    }
+    return;
+  }
+  if (action2 === "remove") {
+    const name = requireName(parsed);
+    if (parsed.options.yes !== true) {
+      throw new Error(`context remove "${name}" requires --yes`);
+    }
+    const removed = removeOperatorProfile(name);
+    const result2 = {
+      schemaVersion: 1,
+      name,
+      removed,
+      credentialCachesRemoved: false,
+      grantsRevoked: false
+    };
+    if (parsed.options.json === true) out.log(JSON.stringify(result2, null, 2));
+    else {
+      const status = removed ? `removed operator context "${name}"` : `operator context "${name}" was already absent`;
+      out.log(`${status}; credential caches were not deleted or revoked`);
+    }
+    return;
+  }
+  if (action2 !== "show") {
+    throw new Error(
+      `unknown context action "${action2 ?? ""}". Try show|list|save|remove.`
+    );
+  }
+  const context = await resolveOperatorContext(parsed, {
+    allowMissingConfig: true,
+    defaultEnvironment: "prod"
+  });
+  const token = developerTokenStatus(context, parsed);
+  const result = {
+    schemaVersion: 1,
+    profile: context.profile,
+    config: context.config,
+    platform: context.platform,
+    app: context.app,
+    environment: context.environment,
+    authentication: {
+      developerToken: token,
+      scopedTokenCacheFile: context.credentials.scopedTokenFile,
+      handshakeStarted: false
+    }
+  };
+  if (parsed.options.json === true) {
+    out.log(JSON.stringify(result, null, 2));
+    return;
+  }
+  out.log(`config:    ${context.config.status} (${context.config.path})`);
+  out.log(
+    `context:   ${context.profile.name ?? "(none)"} (${context.profile.source}; ${context.profile.file})`
+  );
+  out.log(
+    `platform:  ${context.platform.value} (${context.platform.source})`
+  );
+  out.log(
+    `app:       ${context.app.value ?? "(unresolved)"} (${context.app.source})`
+  );
+  out.log(
+    `env:       ${context.environment.value ?? "(unresolved)"} (${context.environment.source})`
+  );
+  out.log(
+    `auth:      ${token.source} (cache ${token.cacheStatus}: ${token.cacheFile})`
+  );
+  out.log("handshake: not started");
+}
+function requireName(parsed) {
+  const name = parsed.positionals[2]?.trim();
+  if (!name) {
+    throw new Error(`context ${parsed.positionals[1]} needs a profile name`);
+  }
+  return name;
+}
+
+// src/help.ts
+function printHelp(output = console) {
+  output.log(`odla-ai
+
+Start here:
+  odla-ai runbook ask "<question>"   The current procedure, from odla's own
+                                     runbooks. Ask BEFORE searching the web or
+                                     working from memory: runbooks are edited
+                                     live, so your training data is out of date
+                                     and this is not.
+  odla-ai runbook impact             After a change: which runbooks describe the
+                                     code you just touched, so you can fix any
+                                     step it made wrong.
+
+Usage:
+  odla-ai setup [--dir <project>] [--agent <name>] [--global] [--force]
+  odla-ai init --app-id <id> --name <name> [--services db,ai,o11y,calendar] [--env dev --env prod]
+  odla-ai doctor [--config odla.config.mjs]
+  odla-ai config diff [--config odla.config.mjs] [--email <odla-account>] [--json]
+  odla-ai config plan [--config odla.config.mjs] [--email <odla-account>] [--json]
+  odla-ai calendar status [--env dev] [--email <odla-account>] [--json]
+  odla-ai calendar calendars [--env dev] [--email <odla-account>] [--json]
+  odla-ai calendar connect [--env dev] [--email <odla-account>] [--no-open] [--yes]
+  odla-ai calendar disconnect [--env dev] [--email <odla-account>] --yes
+  odla-ai app archive [--config odla.config.mjs] [--email <odla-account>] [--json] --yes
+  odla-ai app restore [--config odla.config.mjs] [--email <odla-account>] [--json]
+  odla-ai app export [--env dev] [--fresh] [--out <file>] [--email <odla-account>] [--json]
+  odla-ai app import <file|-> [--env dev] [--ns <namespace>] [--id-field <f>|--key <attr>|--generate-ids] [--dry-run] [--json] --yes
+  odla-ai app refresh-sandbox [--include-identity] [--include-files] [--dry-run] [--json] --yes
+  odla-ai app go-live         [--include-identity] [--include-files] [--dry-run] [--json] --yes
+  odla-ai app promote         [--dry-run] [--json] --yes
+  odla-ai app rename <name> [--config odla.config.mjs] [--email <odla-account>] [--json]
+  odla-ai app owners list [--config odla.config.mjs] [--email <odla-account>] [--json]
+  odla-ai app owners add <email> [--email <odla-account>] [--json]
+  odla-ai app owners remove <email> [--email <odla-account>] [--json]
+  odla-ai pm goal list [--app <id>] [--status <s>] [--q <text>] [--limit <n>] [--offset <n>] [--json]
+  odla-ai pm task list [--app <id>] [--column <c>] [--goal <id>] [--assignee <id>] [--q <text>] [--limit <n>] [--offset <n>] [--json]
+  odla-ai pm decision list [--app <id>] [--status <s>] [--q <text>] [--limit <n>] [--offset <n>] [--json]
+  odla-ai pm bug list [--app <id>] [--status <s>] [--severity <s>] [--goal <id>] [--assignee <id>] [--decision <id>] [--q <text>] [--limit <n>] [--offset <n>] [--json]
+  odla-ai pm goal add --app <id> --title <t> [--status <s>] [--proof <text>] [--target <pct>] [--mutation-id <id>] [--json]
+  odla-ai pm task add --app <id> --title <t> [--column <c>] [--goal <id>] [--assignee <id>] [--description <text>|--body <text>] [--due <epoch-ms>] [--mutation-id <id>] [--json]
+  odla-ai pm decision add --app <id> --title <t> --body <text> [--status <s>] [--mutation-id <id>] [--json]
+  odla-ai pm bug add --app <id> --title <t> (--description <text>|--body <text>) [--status <s>] [--severity <s>] [--goal <id>] [--assignee <id>] [--decision <id>] [--mutation-id <id>] [--json]
+  odla-ai pm <goal|task|decision|bug> get <id> [--json]
+  odla-ai pm goal set <id> [--title <t>|--status <s>|--proof <text>|--no-proof|--target <pct>|--no-target] [--mutation-id <id>] [--json]
+  odla-ai pm task set <id> [--title <t>|--column <c>|--rank <n>|--goal <id>|--no-goal|--assignee <id>|--no-assignee|--description <text>|--body <text>|--due <epoch-ms>|--no-due] [--mutation-id <id>] [--json]
+  odla-ai pm decision set <id> [--title <t>|--status <s>|--body <text>] [--mutation-id <id>] [--json]
+  odla-ai pm bug set <id> [--title <t>|--status <s>|--severity <s>|--goal <id>|--no-goal|--assignee <id>|--no-assignee|--decision <id>|--no-decision|--description <text>|--body <text>] [--mutation-id <id>] [--json]
+  odla-ai pm <goal|task|decision> done <id> [--mutation-id <id>]
+  odla-ai pm bug done <id> [--decision <accepted-decision-id>] [--mutation-id <id>]
+  odla-ai pm <goal|task|decision|bug> comment <id> --body "..." [--mutation-id <id>]
+  odla-ai pm <goal|task|decision|bug> comments <id> [--json]
+  odla-ai pm <goal|task|decision|bug> rm <id>
+  odla-ai pm handoff --app <id> [--json]
+  odla-ai discuss groups [--json]
+  odla-ai discuss list [--app <id>] [--q <text>] [--state open|resolved|all] [--json]
+  odla-ai discuss read <topic> [--limit <n> --offset <n>] [--json]
+  odla-ai discuss post --app <id> --subject "..." --body "..." [--markup "... @[Label](kind/id)"] [--mutation-id <id>]
+  odla-ai discuss reply <topic> --body "..." [--markup "..."] [--mutation-id <id>]
+  odla-ai discuss resolve <topic> [--reopen] [--mutation-id <id>]
+  odla-ai discuss who --q <text> [--app <id>] [--kinds user,pm:task] [--json]
+  odla-ai discuss watch [<topic>] [--cursor <cursor>] [--by <authorId>] [--self <authorId>] [--interval <s>] [--timeout <s>] [--json|--jsonl]
+  odla-ai agent jobs [--env dev] [--state pending|running|succeeded|dead_letter] [--limit 50] [--email <email>] [--json]
+  odla-ai agent retry <job-id> [--env dev] [--email <email>] [--json]
+  odla-ai context show [--context <name>] [--platform https://odla.ai] [--app <id>] [--env prod] [--json]
+  odla-ai context list [--json]
+  odla-ai context save <name> [--platform <url>] [--app <id>] [--env <name>] [--json]
+  odla-ai context remove <name> --yes [--json]
+  odla-ai o11y status [--app <id>] [--context <name>] [--platform https://odla.ai] [--env prod] [--minutes 60] [--json]
+  odla-ai platform status [--context <name>] [--platform https://odla.ai] [--email <odla-account>] [--json]
+  odla-ai whoami [--context <name>] [--platform https://odla.ai] [--json]
+  odla-ai runbook ask "<question>" [--app <id>] [--all] [--json]
+  odla-ai runbook search "<question>" [--app <id>] [--all] [--limit <n>] [--json]
+  odla-ai runbook impact [--base origin/main] [--app <id>] [--all] [--limit <n>] [--json]
+  odla-ai runbook lint [--app <id>] [--all] [--json]
+  odla-ai runbook list [--app <id>] [--all] [--q <text>] [--json]
+  odla-ai runbook comment <slug> --body "..." [--app <id>]
+  odla-ai runbook get <slug> [--app <id>]
+  odla-ai runbook new <slug> --title <t> --file <path|-> [--summary <s>] [--requires <specs>] [--app <id>]
+  odla-ai runbook edit <slug> [--file <path|->|--body "..."] [--note <why>] [--requires <specs>] [--app <id>]
+  odla-ai runbook import <dir> [--visibility operator|admin] [--dry-run] [--app <id>]
+  odla-ai runbook publish <slug> [--app <id>]
+  odla-ai runbook visibility <slug> <operator|admin> [--app <id>]
+  odla-ai runbook archive <slug> [--app <id>]
+  odla-ai runbook history <slug> [--app <id>] [--json]
+  odla-ai runbook revert <slug> --version <n> [--app <id>]
+  odla-ai runbook rm <slug> [--app <id>]
+  odla-ai capabilities [--json]
+  odla-ai code connect [--env dev|prod] [--email <odla-account>] [--engine auto|container|podman|docker] [--slots <1-64>] [--once]
+  odla-ai admin ai show [--context <name>] [--platform https://odla.ai] [--email <odla-account>] [--json]
+  odla-ai admin ai models [--context <name>] [--provider <id>] [--json]
+  odla-ai admin ai set <purpose> [--context <name>] [--provider <id>] [--model <id>] [--enabled|--no-enabled]
+    [--max-input-bytes <n>] [--max-output-tokens <n>] [--max-calls-per-run <n>] [--json]
+  odla-ai admin ai set security [--context <name>] --discovery-provider <id> --discovery-model <id>
+    --validation-provider <id> --validation-model <id> [--enabled|--no-enabled] [--json]
+  odla-ai admin ai credentials [--context <name>] [--json]
+  odla-ai admin ai credential set <provider> [--context <name>] (--from-env <NAME>|--stdin)
+  odla-ai admin ai usage [--context <name>] [--app-id <id>] [--env <env>] [--run-id <id>] [--limit <1-500>] [--json]
+  odla-ai admin ai audit [--context <name>] [--limit <1-200>] [--json]
+  odla-ai security github connect [--repo owner/name] [--env dev] [--email <odla-account>] [--no-open]
+  odla-ai security github disconnect --source <id> [--env dev] [--yes]
+  odla-ai security plan [--env dev] [--json]
+  odla-ai security sources [--env dev] [--json]
+  odla-ai security run --source <id> --plan-digest <sha256:...> --ack-redacted-source [--ref <branch|tag|sha>] [--env dev] [--no-follow]
+  odla-ai security status <job-id> [--follow] [--json]
+  odla-ai security report <job-id> [--json]
+  odla-ai security run [target] --ack-redacted-source [--env dev] [--profile odla] [--fail-on high]
+  odla-ai security run [target] --self --ack-redacted-source
+  odla-ai provision [--config odla.config.mjs] [--email <odla-account>] [--wait <seconds>] [--dry-run] [--push-secrets] [--rotate-o11y-token] [--write-dev-vars[=path]] [--yes]
+  odla-ai smoke [--config odla.config.mjs] [--env dev] [--email <odla-account>] [--no-open]
+  odla-ai skill install [--dir <project>] [--agent <name>] [--global] [--force]
+  odla-ai secrets push --env <env> [--config odla.config.mjs] [--dry-run] [--yes]
+  odla-ai secrets set <name> --env <env> (--from-env <NAME>|--stdin) [--email <odla-account>] [--config odla.config.mjs] [--yes]
+  odla-ai secrets set-clerk-key --env <env> (--from-env <NAME>|--stdin) [--email <odla-account>] [--config odla.config.mjs] [--yes]
+  odla-ai version
+
+Commands:
+  agent        Inspect durable agent wakeups and explicitly requeue a
+               dead-lettered job; JSON output is stable for remote operators.
+  runbook      odla's operational procedures, stored in the database and read at
+               the moment they are followed. "ask" gives a written, cited answer;
+               "search" the passages behind it; "get" the whole document.
+               "impact" diffs your working tree against a base ref and names the
+               runbooks that describe what you changed \u2014 run it after touching a
+               package's exported API or JSDoc, or a Studio surface. "lint"
+               checks the corpus the other way: every odla-ai command the
+               runbooks name is held against this CLI's real command surface,
+               and against the minimum versions each runbook declares. A wrong step
+               is fixed with "edit", which takes effect immediately: a runbook is
+               a row, not a release. Runbooks describe PROCEDURE; what an export
+               does and what it guarantees is JSDoc, rendered per package at
+               https://odla.ai/docs and shipped in the installed .d.ts. Answering
+               a question usually needs both.
+  whoami       Report who this terminal is authenticated as, and whether it holds
+               platform admin. A handshake-minted device token is never admin,
+               however the human who approved it is configured.
+  context      Explain selected config, platform, app, environment, and
+               developer-token provenance without printing credentials or
+               starting a device handshake. Operator work can run outside a
+               project checkout with explicit flags or ODLA_* environment
+               variables.
+  setup        Install offline odla runbooks for common coding-agent harnesses.
+  init         Create a generic odla.config.mjs plus starter schema/rules files.
+  doctor       Validate and summarize the project config without network calls.
+  config       Read-only diff and revision-bound plan for checked-in Registry
+               intent; runtime-owned fields and excluded coverage stay explicit.
+  calendar     Inspect, connect, or disconnect the live Google booking connection.
+  app          Archive (suspend, data retained), restore, export, import, or
+               manage the co-owners of the app. Archiving takes every
+               environment's data plane down until restored; permanent deletion
+               has NO CLI \u2014 it requires a signed-in owner in Studio, and no
+               machine or agent credential can purge. "app export" downloads a
+               portable gzipped-JSONL snapshot of one database (--fresh takes a
+               new snapshot first) \u2014 your data is always yours to take.
+               "app import" upserts rows back in from JSON, JSONL, or a
+               {namespace: rows} map (the shape a query returns); it writes only
+               with --yes, so the bare command is a dry run, and it refuses to
+               guess an id mode that would duplicate rows on a re-run.
+               "app refresh-sandbox" replaces the sandbox with a copy of live
+               (the routine dev loop); "app go-live" copies the sandbox into an
+               EMPTY live database, once, at launch; "app promote" pushes only
+               schema, rules and gates up afterwards, leaving live's rows alone.
+               Each prints its plan and writes nothing without --yes, so the
+               bare command is the dry run. Clerk config, triggers, allowlists,
+               secrets and API keys never travel; identity rows stay behind
+               unless --include-identity.
+               "app rename <name>" changes only the display name humans read;
+               the app id is permanent (tenants, URLs and keys embed it), so a
+               rename never re-provisions anything or invalidates a credential.
+               "app owners add <email>" grants a signed-up odla member the SAME
+               full access as you; they then run their own "provision" to mint
+               their own credentials for the shared db (the live one included)
+               \u2014 no secret is ever copied between people.
+  capabilities Show what the CLI automates vs agent edits and human checkpoints.
+  code         Enroll this Mac/Linux host for the current Studio-connected repository and run Pi.
+  admin        Manage platform-funded AI routing/credentials/usage with narrow device grants.
+  security     Connect GitHub sources and run commit-pinned hosted reviews, or scan a local snapshot.
+  pm           Project management (via @odla-ai/pm) shared across the apps you
+               co-own: conformance goals, kanban tasks, decisions, and bugs. With
+               no --app, "list" spans every co-owned project (the cross-project
+               view); with --app it scopes to one. Same device-grant auth as
+               "app". Entities: goal (alias conformance), task (alias kanban),
+               decision, bug. Status changes and comments post to each item's
+               @odla-ai/chat discussion thread.
+  discuss      Group discussions (via @odla-ai/chat) for the apps you co-own:
+               one group per project, topics with replies, @-mentions of people,
+               agents, PM items, and projects. Built for unattended use \u2014 post a
+               question, then "watch" it until someone answers. "watch" exits 75
+               (not 1) when it times out with nothing new, so a script can tell
+               "no answer yet" from a failure and just rerun. Use "who" to look
+               up the exact @[Label](kind/id) markup for a mention.
+  o11y         Read one stable status envelope for application RED, current
+               live-sync load/freshness, the protected commit-to-visible
+               canary, collector ingest/scheduler trust, Cloudflare-owned
+               runtime metrics, and a machine verdict.
+               --json keeps auth progress on stderr for unattended agents.
+  platform     Read canonical fleet health, releases, provider load/freshness,
+               explicit unknowns, and next actions through a read-only grant.
+  provision    Register services, compose integrations, persist credentials, optionally push secrets.
+  smoke        Verify credentials, public-config, composed schema, db aggregate, and integration probes.
+  skill        Same installer; --agent accepts all, claude, codex, cursor,
+               copilot, gemini, or agents (repeatable or comma-separated).
+  secrets      Push configured db/o11y secrets into the Worker via wrangler
+               stdin; set stores a tenant-vault secret and set-clerk-key the
+               reserved Clerk secret key, write-only from stdin or an env var.
+  version      Print the CLI version.
+
+Safety:
+  Every app has two databases on odla.ai: a sandbox (env "dev", tenant
+  <appId>--dev) and a live one (env "prod", tenant <appId>). Both are served by
+  production odla.ai \u2014 there is no separate odla to point at. New projects get
+  the sandbox only. Add "prod" explicitly to odla.config.mjs and pass --yes to
+  provision the live database; use --dry-run first to inspect the resolved plan.
+  Provision caches the approved developer token and service credentials under
+  .odla/ with mode 0600, and init adds those paths to .gitignore. Secret push
+  preflights Wrangler before any shown-once issuance or destructive rotation.
+  Projectless PM, Discussions, o11y, runbook, and identity commands use
+  --platform/--app/--env, ODLA_PLATFORM_URL/ODLA_APP_ID/ODLA_ENV, and
+  ODLA_DEV_TOKEN. Save non-secret scope metadata with "context save", then
+  select it explicitly with --context or ODLA_CONTEXT. Each named context gets
+  isolated developer and scoped-token caches. Override their locations with
+  ODLA_DEV_TOKEN_FILE and ODLA_ADMIN_TOKEN_FILE; ODLA_CONTEXT_FILE relocates
+  the metadata file. Flags and specific ODLA_* scope variables beat a selected
+  context, which beats project config. There is no ambient current context.
+  "context show" reports only provenance and cache state and never authenticates.
+  Provision opens the approval page in your browser automatically whenever the
+  machine can show one, including agent-driven runs; only CI, SSH, and
+  display-less hosts skip it. Use --open to force or --no-open to suppress.
+  Browser launch is best-effort: the printed approval URL is authoritative and
+  agents must relay it to the human verbatim. A started handshake is persisted
+  under .odla/, so a command killed mid-wait loses nothing \u2014 rerunning resumes
+  the same code. Outside an interactive terminal the wait is capped (90s by
+  default, --wait <seconds> to change); a still-pending handshake then exits
+  with code 75: relay the URL, wait for approval, and re-run to collect.
+  A fresh device handshake requires --email <odla-account> or ODLA_USER_EMAIL.
+  The email is a non-secret identity hint: never provide a password or session
+  token. The matching account must already exist, be signed in, explicitly
+  review the exact code, and finish any current request before claiming another.
+  Run Code from a GitHub checkout already connected to an app in Studio; an
+  odla.config.mjs may select the app explicitly but is not required. Code host
+  approval and credential hashes live in odla-ai/db. The host
+  credential is never written under .odla/; it exists only in the foreground
+  "code connect" process and is rotated by the next approved connection.
+  Calendar setup has a second human checkpoint: odla issues a state-bound Google consent URL;
+  OAuth codes and refresh tokens never enter the CLI, repo, chat, or app.
+  GitHub security uses source-read-only access plus optional metadata-only Checks write: the CLI never asks
+  for a PAT or provider key. GitHub read access is separate from the explicit
+  --ack-redacted-source consent and the exact --plan-digest printed by security
+  plan are required before bounded snippets reach System AI.
+  Run security plan first to inspect the admin-selected providers, models,
+  per-route bounds, credential readiness, retention, no-execution boundary,
+  and digest that binds consent to that exact plan.
+`);
 }
 
 // src/discuss-actions.ts
@@ -8197,8 +8755,8 @@ var ALLOWED = [
   "platform",
   "context"
 ];
-function requireId(id, action) {
-  if (!id) throw new Error(`"discuss ${action}" needs a topic id`);
+function requireId(id, action2) {
+  if (!id) throw new Error(`"discuss ${action2}" needs a topic id`);
   return id;
 }
 async function buildContext(parsed, deps) {
@@ -8232,11 +8790,11 @@ async function buildContext(parsed, deps) {
 }
 async function discussCommand(parsed, deps = {}) {
   assertArgs(parsed, ALLOWED, 3);
-  const action = parsed.positionals[1];
+  const action2 = parsed.positionals[1];
   const id = parsed.positionals[2];
-  if (!action) throw new Error('"discuss" needs an action. Run "odla-ai help".');
+  if (!action2) throw new Error('"discuss" needs an action. Run "odla-ai help".');
   const ctx = await buildContext(parsed, deps);
-  switch (action) {
+  switch (action2) {
     case "groups":
       return discussGroups(ctx);
     case "list":
@@ -8258,7 +8816,7 @@ async function discussCommand(parsed, deps = {}) {
       return;
     }
     default:
-      throw new Error(`unknown discuss action "${action}". Run "odla-ai help".`);
+      throw new Error(`unknown discuss action "${action2}". Run "odla-ai help".`);
   }
 }
 
@@ -8519,18 +9077,18 @@ var ENTITY_OPTIONS = {
     done: ["decision"]
   }
 };
-function canonicalAction(action) {
-  if (action === "create") return "add";
-  if (action === "update" || action === "status" || action === "move") return "set";
-  if (action === "delete") return "rm";
-  return action in ACTION_OPTIONS ? action : null;
-}
-function allowedOptions(entity, action) {
-  const entityOptions = action === "list" || action === "add" || action === "set" || action === "done" ? ENTITY_OPTIONS[entity][action] : [];
-  return [...COMMON_OPTIONS, ...ACTION_OPTIONS[action], ...entityOptions];
-}
-function requireId2(id, action) {
-  if (!id) throw new Error(`"pm ... ${action}" needs an item id`);
+function canonicalAction(action2) {
+  if (action2 === "create") return "add";
+  if (action2 === "update" || action2 === "status" || action2 === "move") return "set";
+  if (action2 === "delete") return "rm";
+  return action2 in ACTION_OPTIONS ? action2 : null;
+}
+function allowedOptions(entity, action2) {
+  const entityOptions = action2 === "list" || action2 === "add" || action2 === "set" || action2 === "done" ? ENTITY_OPTIONS[entity][action2] : [];
+  return [...COMMON_OPTIONS, ...ACTION_OPTIONS[action2], ...entityOptions];
+}
+function requireId2(id, action2) {
+  if (!id) throw new Error(`"pm ... ${action2}" needs an item id`);
   return id;
 }
 async function buildContext2(parsed, deps) {
@@ -8566,28 +9124,28 @@ async function pmCommand(parsed, deps = {}) {
   const entity = ALIASES[word];
   if (!entity) throw new Error(`unknown pm entity "${word}". Try "odla-ai pm bug list" (goal|task|decision|bug).`);
   const requestedAction = parsed.positionals[2] ?? "list";
-  const action = canonicalAction(requestedAction);
-  if (!action) throw new Error(`unknown pm action "${requestedAction}". Try list|add|get|set|done|comment|comments|rm.`);
-  assertArgs(parsed, allowedOptions(entity, action), 4);
+  const action2 = canonicalAction(requestedAction);
+  if (!action2) throw new Error(`unknown pm action "${requestedAction}". Try list|add|get|set|done|comment|comments|rm.`);
+  assertArgs(parsed, allowedOptions(entity, action2), 4);
   const ctx = await buildContext2(parsed, deps);
   const id = parsed.positionals[3];
-  switch (action) {
+  switch (action2) {
     case "list":
       return pmList(ctx, entity, parsed);
     case "add":
       return pmAdd(ctx, entity, parsed);
     case "get":
-      return pmGet(ctx, entity, requireId2(id, action));
+      return pmGet(ctx, entity, requireId2(id, action2));
     case "set":
-      return pmSet(ctx, entity, requireId2(id, action), parsed);
+      return pmSet(ctx, entity, requireId2(id, action2), parsed);
     case "done":
-      return pmDone(ctx, entity, requireId2(id, action), parsed);
+      return pmDone(ctx, entity, requireId2(id, action2), parsed);
     case "comment":
-      return pmComment(ctx, entity, requireId2(id, action), parsed);
+      return pmComment(ctx, entity, requireId2(id, action2), parsed);
     case "comments":
-      return pmComments(ctx, entity, requireId2(id, action));
+      return pmComments(ctx, entity, requireId2(id, action2));
     case "rm":
-      return pmRemove(ctx, entity, requireId2(id, action));
+      return pmRemove(ctx, entity, requireId2(id, action2));
   }
 }
 
@@ -8620,8 +9178,8 @@ function printPlatformStatus(status, out) {
   if (status.verdict.reasons.length) {
     out.log(`reasons	${status.verdict.reasons.join(", ")}`);
   }
-  for (const action of status.nextActions) {
-    out.log(`next	${action.service}	${action.code}	${action.message}`);
+  for (const action2 of status.nextActions) {
+    out.log(`next	${action2.service}	${action2.code}	${action2.message}`);
   }
 }
 function value(input) {
@@ -8641,10 +9199,10 @@ async function platformCommand(parsed, deps = {}) {
     ["config", "context", "platform", "token", "email", "open", "json"],
     2
   );
-  const action = parsed.positionals[1];
-  if (action !== "status") {
+  const action2 = parsed.positionals[1];
+  if (action2 !== "status") {
     throw new Error(
-      `unknown platform action "${action ?? ""}". Try "odla-ai platform status --json".`
+      `unknown platform action "${action2 ?? ""}". Try "odla-ai platform status --json".`
     );
   }
   const context = await resolveOperatorContext(parsed, {
@@ -8973,10 +9531,10 @@ async function o11yCommand(parsed, deps = {}) {
     ],
     2
   );
-  const action = parsed.positionals[1];
-  if (action !== "status") {
+  const action2 = parsed.positionals[1];
+  if (action2 !== "status") {
     throw new Error(
-      `unknown o11y action "${action ?? ""}". Try "odla-ai o11y status --json".`
+      `unknown o11y action "${action2 ?? ""}". Try "odla-ai o11y status --json".`
     );
   }
   const minutes = statusMinutes(
@@ -9105,7 +9663,7 @@ async function read2(url, headers, doFetch) {
 }
 
 // src/provision.ts
-var import_apps7 = require("@odla-ai/apps");
+var import_apps10 = require("@odla-ai/apps");
 var import_ai3 = require("@odla-ai/ai");
 var import_node_process10 = __toESM(require("process"), 1);
 
@@ -9115,7 +9673,7 @@ async function provisionIntegrationSeeds(doFetch, endpoint, tenantId, dbKey, int
   const base = `${endpoint}/app/${encodeURIComponent(tenantId)}`;
   for (const integration of integrations) {
     for (const seed of integration.seeds ?? []) {
-      const payload = await postJson2(doFetch, `${base}/query`, dbKey, {
+      const payload = await postJson3(doFetch, `${base}/query`, dbKey, {
         query: { [seed.ns]: { $: { where: { [seed.key.attr]: seed.key.value }, limit: 1 } } }
       });
       const rows = isRecord7(payload) && isRecord7(payload.result) ? payload.result[seed.ns] : void 0;
@@ -9126,7 +9684,7 @@ async function provisionIntegrationSeeds(doFetch, endpoint, tenantId, dbKey, int
         out.log(`${env}: integration ${integration.id} seed ${seed.id} already exists`);
         continue;
       }
-      await postJson2(doFetch, `${base}/transact`, dbKey, {
+      await postJson3(doFetch, `${base}/transact`, dbKey, {
         mutationId: `integration:${integration.id}:seed:${seed.id}`,
         ops: [{
           t: "update",
@@ -9141,7 +9699,7 @@ async function provisionIntegrationSeeds(doFetch, endpoint, tenantId, dbKey, int
     }
   }
 }
-async function postJson2(doFetch, url, bearer, body) {
+async function postJson3(doFetch, url, bearer, body) {
   const res = await doFetch(url, {
     method: "POST",
     headers: { authorization: `Bearer ${bearer}`, "content-type": "application/json" },
@@ -9162,9 +9720,9 @@ async function responseText(res) {
 }
 
 // src/provision-credentials.ts
-var import_apps5 = require("@odla-ai/apps");
+var import_apps9 = require("@odla-ai/apps");
 async function provisionEnvCredentials(opts) {
-  const tenantId = (0, import_apps5.tenantIdFor)(opts.cfg.app.id, opts.env);
+  const tenantId = (0, import_apps9.tenantIdFor)(opts.cfg.app.id, opts.env);
   const prior = opts.credentials?.envs[opts.env];
   let credentials = opts.credentials;
   let dbKey = opts.cfg.services.includes("db") && !opts.rotateDb ? prior?.dbKey : void 0;
@@ -9220,14 +9778,14 @@ async function mintDbKey(opts, tenantId) {
         appId: tenantId
       })
     });
-    if (!created.ok) throw new Error(`db app create (${tenantId}) failed: ${created.status} ${await safeText4(created)}`);
+    if (!created.ok) throw new Error(`db app create (${tenantId}) failed: ${created.status} ${await safeText5(created)}`);
     res = await opts.fetch(`${opts.cfg.dbEndpoint}/admin/apps/${encodeURIComponent(tenantId)}/keys`, {
       method: "POST",
       headers,
       body: "{}"
     });
   }
-  if (!res.ok) throw new Error(`db key mint (${tenantId}) failed: ${res.status} ${await safeText4(res)}`);
+  if (!res.ok) throw new Error(`db key mint (${tenantId}) failed: ${res.status} ${await safeText5(res)}`);
   const body = await res.json();
   if (!body.key) throw new Error(`db key mint (${tenantId}) returned no key`);
   return body.key;
@@ -9243,58 +9801,11 @@ async function issueO11yToken(opts) {
       `o11y token already exists for env "${opts.env}", but its shown-once value is not in the local credentials file; run "odla-ai provision --rotate-o11y-token --push-secrets" to replace it explicitly`
     );
   }
-  if (!res.ok) throw new Error(`o11y token ${opts.rotateO11y ? "rotation" : "issue"} (${opts.env}) failed: ${res.status} ${await safeText4(res)}`);
+  if (!res.ok) throw new Error(`o11y token ${opts.rotateO11y ? "rotation" : "issue"} (${opts.env}) failed: ${res.status} ${await safeText5(res)}`);
   const body = await res.json();
   if (!body.token) throw new Error(`o11y token ${opts.rotateO11y ? "rotation" : "issue"} (${opts.env}) returned no token`);
   return body.token;
 }
-async function safeText4(res) {
-  try {
-    return redactSecrets((await res.text()).slice(0, 500));
-  } catch {
-    return "";
-  }
-}
-
-// src/provision-helpers.ts
-var import_ai2 = require("@odla-ai/ai");
-var import_apps6 = require("@odla-ai/apps");
-function defaultSecretName(provider) {
-  const names = import_ai2.DEFAULT_SECRET_NAMES;
-  return names[provider] ?? `${provider}_api_key`;
-}
-async function assertTenantAdminAccess(doFetch, cfg, env, token) {
-  const tenantId = (0, import_apps6.tenantIdFor)(cfg.app.id, env);
-  const res = await doFetch(`${cfg.dbEndpoint}/admin/apps/${encodeURIComponent(tenantId)}/entitlements`, {
-    headers: { authorization: `Bearer ${token}` }
-  });
-  if (res.ok || res.status === 404) return;
-  if (res.status === 403) {
-    throw new Error(
-      `${env}: you are not an owner of "${cfg.app.id}" (tenant ${tenantId}) \u2014 nothing was minted or written; ask an existing owner to run "odla-ai app owners add <your-email>", then re-run provision`
-    );
-  }
-  throw new Error(`${env}: tenant access preflight (${tenantId}) failed: ${res.status} ${await safeText5(res)}`);
-}
-async function postJson3(doFetch, url, bearer, body) {
-  const res = await doFetch(url, {
-    method: "POST",
-    headers: { authorization: `Bearer ${bearer}`, "content-type": "application/json" },
-    body: JSON.stringify(body)
-  });
-  if (!res.ok) throw new Error(`${new URL(url).pathname} failed: ${res.status} ${await safeText5(res)}`);
-}
-function normalizeClerkConfig(value2) {
-  if (!value2) return null;
-  if (typeof value2 === "string") {
-    const publishableKey2 = envValue(value2);
-    return publishableKey2 ? { publishableKey: publishableKey2 } : null;
-  }
-  if (typeof value2 !== "object") return null;
-  const cfg = value2;
-  const publishableKey = envValue(cfg.publishableKey);
-  return publishableKey ? { publishableKey, ...cfg.audience ? { audience: cfg.audience } : {}, ...cfg.mode ? { mode: cfg.mode } : {} } : null;
-}
 async function safeText5(res) {
   try {
     return redactSecrets((await res.text()).slice(0, 500));
@@ -9373,7 +9884,7 @@ async function provision(options) {
   }
   const doFetch = options.fetch ?? fetch;
   const token = await getDeveloperToken(cfg, options, doFetch, out);
-  const apps = (0, import_apps7.createAppsClient)({ endpoint: cfg.platformUrl, token, fetcher: { fetch: doFetch } });
+  const apps = (0, import_apps10.createAppsClient)({ endpoint: cfg.platformUrl, token, fetcher: { fetch: doFetch } });
   const existing = await apps.resolveApp(cfg.app.id);
   if (existing) {
     out.log(`app: ${cfg.app.id} already exists`);
@@ -9384,7 +9895,7 @@ async function provision(options) {
   for (const env of cfg.envs) {
     await assertTenantAdminAccess(doFetch, cfg, env, token);
   }
-  const serviceOrder = (0, import_apps7.orderAppServices)(cfg.services);
+  const serviceOrder = (0, import_apps10.orderAppServices)(cfg.services);
   for (const env of cfg.envs) {
     for (const service of serviceOrder) {
       if (service === "ai") {
@@ -9417,7 +9928,7 @@ async function provision(options) {
     }
   }
   for (const env of cfg.envs) {
-    const tenantId = (0, import_apps7.tenantIdFor)(cfg.app.id, env);
+    const tenantId = (0, import_apps10.tenantIdFor)(cfg.app.id, env);
     credentials = await provisionEnvCredentials({
       cfg,
       env,
@@ -9450,11 +9961,11 @@ ${env}: credentials are already saved; retry "odla-ai secrets push --env ${env}$
       }
     }
     if (schema && dbKey) {
-      await postJson3(doFetch, `${cfg.dbEndpoint}/app/${encodeURIComponent(tenantId)}/schema`, dbKey, { schema });
+      await postJson(doFetch, `${cfg.dbEndpoint}/app/${encodeURIComponent(tenantId)}/schema`, dbKey, { schema });
       out.log(`${env}: schema pushed`);
     }
     if (rules) {
-      await postJson3(doFetch, `${cfg.dbEndpoint}/app/${encodeURIComponent(tenantId)}/admin/rules`, token, rules);
+      await postJson(doFetch, `${cfg.dbEndpoint}/app/${encodeURIComponent(tenantId)}/admin/rules`, token, rules);
       out.log(`${env}: rules pushed (${Object.keys(rules).length} namespaces)`);
     }
     if (dbKey) {
@@ -9551,6 +10062,7 @@ var COMMAND_SURFACE = {
   calendar: { status: {}, calendars: {}, connect: {}, disconnect: {} },
   capabilities: {},
   code: { connect: {} },
+  config: { diff: {}, plan: {} },
   context: { show: {}, list: {}, save: {}, remove: {} },
   // `watch`, `read`, `reply`, and `resolve` take a topic id from there on.
   discuss: {
@@ -9835,7 +10347,7 @@ async function runbookRemove(ctx, slug) {
 
 // src/runbook-import.ts
 var import_node_fs17 = require("fs");
-var import_node_path13 = require("path");
+var import_node_path14 = require("path");
 function parseRunbook(text, slug) {
   let rest = text;
   const meta = {};
@@ -9864,8 +10376,8 @@ function readRunbookDir(dir) {
   const files = (0, import_node_fs17.readdirSync)(dir).filter((f) => f.endsWith(".md")).sort();
   if (!files.length) throw new Error(`no .md files in ${dir}`);
   return files.map((file) => {
-    const slug = (0, import_node_path13.basename)(file, ".md");
-    const parsed = parseRunbook((0, import_node_fs17.readFileSync)((0, import_node_path13.join)(dir, file), "utf8"), slug);
+    const slug = (0, import_node_path14.basename)(file, ".md");
+    const parsed = parseRunbook((0, import_node_fs17.readFileSync)((0, import_node_path14.join)(dir, file), "utf8"), slug);
     return { file, slug, ...parsed, words: parsed.body.split(/\s+/).filter(Boolean).length };
   });
 }
@@ -9938,7 +10450,7 @@ async function upsert(ctx, r, visibility) {
 // src/runbook-impact.ts
 var import_node_child_process7 = require("child_process");
 var import_node_fs18 = require("fs");
-var import_node_path14 = require("path");
+var import_node_path15 = require("path");
 
 // src/runbook-impact-scan.ts
 var DECL = /^[+-]\s*export\s+(?:declare\s+)?(?:default\s+)?(?:abstract\s+)?(?:async\s+)?(?:const|let|var|function|class|interface|type|enum)\s+([A-Za-z_$][\w$]*)/;
@@ -10107,7 +10619,7 @@ ${body.split("\n").map((line) => `+${line}`).join("\n")}
 }
 function manifestLabeller(root) {
   return (workspace) => {
-    const manifest = (0, import_node_path14.join)(root, workspace, "package.json");
+    const manifest = (0, import_node_path15.join)(root, workspace, "package.json");
     if (!(0, import_node_fs18.existsSync)(manifest)) return void 0;
     try {
       const name = JSON.parse((0, import_node_fs18.readFileSync)(manifest, "utf8")).name;
@@ -10177,7 +10689,7 @@ function report3(ctx, impacts) {
 async function runbookImpact(ctx, options, deps = {}) {
   const cwd = deps.cwd ?? process.cwd();
   const runGit = deps.runGit ?? gitRunner(cwd);
-  const read3 = deps.readRepoFile ?? ((path) => (0, import_node_fs18.readFileSync)((0, import_node_path14.join)(cwd, path), "utf8"));
+  const read3 = deps.readRepoFile ?? ((path) => (0, import_node_fs18.readFileSync)((0, import_node_path15.join)(cwd, path), "utf8"));
   const surfaces = changedSurfaces(collectDiff(runGit, options.base, read3), manifestLabeller(cwd));
   if (!surfaces.length) {
     return ctx.out.log(
@@ -10312,7 +10824,7 @@ async function runbookComment(ctx, slug, body) {
 var import_node_child_process8 = require("child_process");
 var import_node_fs19 = require("fs");
 var import_node_os5 = require("os");
-var import_node_path15 = require("path");
+var import_node_path16 = require("path");
 var import_node_process12 = __toESM(require("process"), 1);
 var EDITOR_ENV = ["ODLA_EDITOR", "VISUAL", "EDITOR"];
 function resolveEditor(env = import_node_process12.default.env) {
@@ -10338,8 +10850,8 @@ function editText(initial, slug, deps = {}) {
     );
   if (!interactive())
     throw new Error(`cannot open an editor without a terminal \u2014 pass --file <path> or --body "\u2026" instead`);
-  const dir = (0, import_node_fs19.mkdtempSync)((0, import_node_path15.join)((0, import_node_os5.tmpdir)(), "odla-runbook-"));
-  const file = (0, import_node_path15.join)(dir, `${slug}.md`);
+  const dir = (0, import_node_fs19.mkdtempSync)((0, import_node_path16.join)((0, import_node_os5.tmpdir)(), "odla-runbook-"));
+  const file = (0, import_node_path16.join)(dir, `${slug}.md`);
   try {
     (0, import_node_fs19.writeFileSync)(file, initial, { mode: 384 });
     const code = defaultRunOrInjected(deps)(editor, file);
@@ -10447,12 +10959,12 @@ var ALLOWED2 = [
   "platform",
   "context"
 ];
-function requireSlug(slug, action) {
-  if (!slug) throw new Error(`"runbook ${action}" needs a slug, e.g. "odla-ai runbook ${action} release"`);
+function requireSlug(slug, action2) {
+  if (!slug) throw new Error(`"runbook ${action2}" needs a slug, e.g. "odla-ai runbook ${action2} release"`);
   return slug;
 }
 var WRITES = /* @__PURE__ */ new Set(["new", "edit", "publish", "archive", "visibility", "revert", "rm", "import"]);
-async function buildContext3(parsed, deps, action) {
+async function buildContext3(parsed, deps, action2) {
   const appIdOption = stringOpt(parsed.options.app);
   const context = await resolveOperatorContext(parsed, {
     allowMissingConfig: true
@@ -10462,7 +10974,7 @@ async function buildContext3(parsed, deps, action) {
   const out = deps.stdout ?? console;
   const appId = appIdOption ?? (context.app.source === "environment" || context.app.source === "profile" ? context.app.value : null) ?? PLATFORM_SCOPE;
   const dryRun = parsed.options["dry-run"] === true;
-  if (action === "import" && dryRun) {
+  if (action2 === "import" && dryRun) {
     return {
       platformUrl: cfg.platformUrl,
       token: "",
@@ -10472,12 +10984,12 @@ async function buildContext3(parsed, deps, action) {
       appId
     };
   }
-  const needsCapability = WRITES.has(action) && !dryRun && appId === PLATFORM_SCOPE && !stringOpt(parsed.options.token);
+  const needsCapability = WRITES.has(action2) && !dryRun && appId === PLATFORM_SCOPE && !stringOpt(parsed.options.token);
   const token = needsCapability ? await getScopedPlatformToken({
     platform: cfg.platformUrl,
     scope: "platform:runbook:write",
     email: stringOpt(parsed.options.email),
-    label: `odla CLI (runbook ${action})`,
+    label: `odla CLI (runbook ${action2})`,
     fetch: doFetch,
     stdout: out,
     openApprovalUrl: deps.openUrl,
@@ -10512,11 +11024,11 @@ async function buildContext3(parsed, deps, action) {
   };
 }
 async function runbookCommand(parsed, deps = {}) {
-  const action = parsed.positionals[1] ?? "list";
-  assertArgs(parsed, ALLOWED2, action === "ask" || action === "search" ? 64 : 4);
-  const ctx = await buildContext3(parsed, deps, action);
+  const action2 = parsed.positionals[1] ?? "list";
+  assertArgs(parsed, ALLOWED2, action2 === "ask" || action2 === "search" ? 64 : 4);
+  const ctx = await buildContext3(parsed, deps, action2);
   const slug = parsed.positionals[2];
-  switch (action) {
+  switch (action2) {
     case "list":
       return runbookList(ctx, parsed.options.all === true, stringOpt(parsed.options.q));
     case "ask": {
@@ -10601,7 +11113,7 @@ async function runbookCommand(parsed, deps = {}) {
     case "rm":
       return runbookRemove(ctx, requireSlug(slug, "rm"));
     default:
-      throw new Error(`unknown runbook action "${action}". Try ${acceptedAfter(["runbook"]).join(", ")}.`);
+      throw new Error(`unknown runbook action "${action2}". Try ${acceptedAfter(["runbook"]).join(", ")}.`);
   }
 }
 
@@ -10759,7 +11271,7 @@ function hostedSeverity(value2, flag) {
 var import_security2 = require("@odla-ai/security");
 
 // src/security.ts
-var import_node_path16 = require("path");
+var import_node_path17 = require("path");
 var import_security = require("@odla-ai/security");
 var import_node3 = require("@odla-ai/security/node");
 async function runHostedSecurity(options) {
@@ -10771,9 +11283,9 @@ async function runHostedSecurity(options) {
   const appId = selfAudit ? "odla-ai" : cfg.app.id;
   const env = selfAudit ? "prod" : selectEnv(options.env, cfg.envs, cfg.configPath, cfg.rootDir);
   const platform = options.platform ?? cfg?.platformUrl ?? "https://odla.ai";
-  const target = (0, import_node_path16.resolve)(options.target ?? cfg?.rootDir ?? ".");
-  const output = (0, import_node_path16.resolve)(options.out ?? (0, import_node_path16.resolve)(target, ".odla/security/hosted"));
-  const outputRelative = (0, import_node_path16.relative)(target, output).split(import_node_path16.sep).join("/");
+  const target = (0, import_node_path17.resolve)(options.target ?? cfg?.rootDir ?? ".");
+  const output = (0, import_node_path17.resolve)(options.out ?? (0, import_node_path17.resolve)(target, ".odla/security/hosted"));
+  const outputRelative = (0, import_node_path17.relative)(target, output).split(import_node_path17.sep).join("/");
   if (!outputRelative) throw new Error("Hosted security output cannot be the repository root");
   const profile = profileFor(options.profile ?? "odla", options.maxHuntTasks ?? 12);
   const tokenRequest = {
@@ -10785,7 +11297,7 @@ async function runHostedSecurity(options) {
   };
   const token = await injectedToken(options, tokenRequest);
   const snapshot = await (0, import_node3.snapshotDirectory)(target, {
-    exclude: !outputRelative.startsWith("../") && !(0, import_node_path16.isAbsolute)(outputRelative) ? [outputRelative] : []
+    exclude: !outputRelative.startsWith("../") && !(0, import_node_path17.isAbsolute)(outputRelative) ? [outputRelative] : []
   });
   const hosted = await (0, import_security.createPlatformSecurityReasoners)({
     platform,
@@ -10803,7 +11315,7 @@ async function runHostedSecurity(options) {
   });
   const harness = (0, import_security.createSecurityHarness)({
     profile,
-    store: new import_node3.FileRunStore((0, import_node_path16.resolve)(output, "state")),
+    store: new import_node3.FileRunStore((0, import_node_path17.resolve)(output, "state")),
     discoveryReasoner: hosted.discoveryReasoner,
     validationReasoner: hosted.validationReasoner,
     policy: {
@@ -10827,7 +11339,7 @@ async function runHostedSecurity(options) {
 function selectEnv(requested, declared, configPath, rootDir) {
   const env = requested ?? (declared.includes("dev") ? "dev" : declared[0]);
   if (!env || !declared.includes(env)) {
-    const shown = (0, import_node_path16.relative)(rootDir, configPath) || configPath;
+    const shown = (0, import_node_path17.relative)(rootDir, configPath) || configPath;
     throw new Error(`env "${env ?? ""}" is not declared in ${shown}`);
   }
   return env;
@@ -10856,7 +11368,7 @@ function printSummary(out, appId, env, run, report4, output) {
   out.log(`  coverage: ${report4.coverageStatus} ${complete}/${report4.coverage.length} blocked=${report4.metrics.blockedCells} shallow=${report4.metrics.shallowCells} unscheduled=${report4.metrics.unscheduledCells} budget_exhausted=${report4.metrics.budgetExhaustedCells}`);
   if (report4.callBudget) out.log(`  calls: discovery=${formatBudget(report4.callBudget.discovery)} validation=${formatBudget(report4.callBudget.validation)}`);
   out.log(`  findings: confirmed=${report4.metrics.confirmed} needs_reproduction=${report4.metrics.needsReproduction} candidates=${report4.metrics.candidates}`);
-  out.log(`  report: ${(0, import_node_path16.resolve)(output, "REPORT.md")}`);
+  out.log(`  report: ${(0, import_node_path17.resolve)(output, "REPORT.md")}`);
 }
 function formatBudget(usage) {
   return usage ? `${usage.usedCalls}/${usage.maxCalls} skipped=${usage.skippedCalls}` : "caller-managed";
@@ -11222,8 +11734,8 @@ async function securityCommand(parsed, dependencies) {
   else await runLocalSecurityCommand(parsed, dependencies);
 }
 async function githubSecurityCommand(parsed, dependencies) {
-  const action = parsed.positionals[2];
-  if (action === "disconnect") {
+  const action2 = parsed.positionals[2];
+  if (action2 === "disconnect") {
     assertArgs(parsed, ["config", "env", "platform", "source", "email", "open", "yes"], 3);
     const context2 = await hostedSecurityContext(parsed, dependencies);
     const sourceId = requiredString(parsed.options.source, "--source");
@@ -11238,7 +11750,7 @@ async function githubSecurityCommand(parsed, dependencies) {
     context2.stdout.log(`github: disconnected ${sourceId} from ${context2.appId}/${context2.env}`);
     return;
   }
-  if (action !== "connect") {
+  if (action2 !== "connect") {
     throw new Error('unknown security github command. Try "odla-ai security github connect".');
   }
   assertArgs(parsed, ["config", "env", "platform", "repo", "email", "open"], 3);