@odla-ai/cli 0.25.21 → 0.25.22

package/dist/{chunk-L2NG4UR4.js → chunk-2AFAXLKE.js}

@@ -165,7 +165,9 @@ function approvalLines(prompt) {
   lines.push("");
   lines.push(`   ${prompt.approvalUrl}`);
   lines.push("");
-  lines.push("   A signed-in odla admin opens that URL, checks the code matches, and approves.");
+  lines.push(
+    `   ${prompt.approver ?? "The matching signed-in odla account"} opens that URL, checks the code matches, and approves.`
+  );
   lines.push("   Opening the link without approving does nothing; this command waits until they do.");
   if (prompt.browserAttempted) {
     lines.push("   A browser launch was attempted, but it is best-effort and may have shown no tab.");
@@ -437,6 +439,7 @@ function audienceBoundEnvToken(token, platform) {
 }
 var SCOPE_PURPOSE = {
   "platform:status:read": "read the platform fleet health and deployment snapshot",
+  "app:config:read": "compare checked-in intent with an exact-id app Registry configuration",
   "platform:runbook:write": "add or edit odla's operational runbooks",
   "platform:ai:policy:write": "change System AI model routing",
   "platform:ai:policy:read": "read System AI model routing",
@@ -473,6 +476,7 @@ async function scopedToken(platform, scope, options, doFetch, out) {
         approvalUrl,
         minutesLeft: Math.floor(expiresIn / 60),
         purpose: SCOPE_PURPOSE[scope] ?? `use ${scope}`,
+        approver: scope.startsWith("app:") ? "A signed-in app owner" : "A signed-in odla platform admin",
         browserAttempted: browser.open,
         browserSkipped: browser.reason
       });
@@ -668,10 +672,10 @@ async function responseBody2(res) {
     return { message: text.slice(0, 300) };
   }
 }
-function apiError2(action, status, body) {
+function apiError2(action2, status, body) {
   const error = isRecord2(body) && isRecord2(body.error) ? body.error : void 0;
   const message2 = error && typeof error.message === "string" ? error.message : isRecord2(body) && typeof body.message === "string" ? body.message : "request failed";
-  return `${action} failed (${status}): ${message2}`;
+  return `${action2} failed (${status}): ${message2}`;
 }
 function isRecord2(value2) {
   return Boolean(value2) && typeof value2 === "object" && !Array.isArray(value2);
@@ -849,10 +853,10 @@ async function responseBody3(res) {
     return { message: text.slice(0, 300) };
   }
 }
-function apiError3(action, status, body) {
+function apiError3(action2, status, body) {
   const error = isRecord3(body) && isRecord3(body.error) ? body.error : void 0;
   const message2 = error && typeof error.message === "string" ? error.message : isRecord3(body) && typeof body.message === "string" ? body.message : "request failed";
-  return `${action} failed (${status}): ${message2}`;
+  return `${action2} failed (${status}): ${message2}`;
 }
 function isRecord3(value2) {
   return Boolean(value2) && typeof value2 === "object" && !Array.isArray(value2);
@@ -1603,8 +1607,8 @@ function pollTimeout(value2 = 10 * 6e4) {
   if (!Number.isSafeInteger(value2) || value2 < 1e3 || value2 > 60 * 6e4) throw new Error("calendar poll timeout must be 1000-3600000ms");
   return value2;
 }
-function productionConsent(env, yes, action) {
-  if ((env === "prod" || env === "production") && !yes) throw new Error(`refusing to ${action} for "${env}" without --yes`);
+function productionConsent(env, yes, action2) {
+  if ((env === "prod" || env === "production") && !yes) throw new Error(`refusing to ${action2} for "${env}" without --yes`);
 }
 function printStatus(status, json, out) {
   if (json) {
@@ -1634,6 +1638,7 @@ var CAPABILITIES = {
     "save and explicitly select non-secret named operator contexts with isolated credential caches; resolve and explain platform, app, environment, and credential provenance without authenticating; then run PM, Discussions, o11y, runbook, and identity operations outside a project checkout",
     "read one versioned o11y status envelope spanning application RED, exact Worker versions and Cloudflare colos observed in traffic, current live-sync freshness/load, the protected commit-to-visible canary, collector ingest/scheduler trust, provider-owned runtime metrics, account-scoped Durable Object, D1, and R2 evidence under odla-db, and a bounded machine verdict",
     "read one canonical platform fleet snapshot over private service bindings, including release identities, probe latency, Cloudflare load/runtime freshness, explicit unknowns, and stable next actions through a read-only capability",
+    "compare one project's checked-in Registry intent with live owner-visible state and freeze a secret-free plan digest through an exact app:config:read capability",
     "inspect durable agent wakeups as a versioned JSON envelope and explicitly requeue one dead-lettered job with a scoped environment credential",
     "run app-attributed hosted security discovery and independent validation without provider keys",
     "connect/revoke source-read-only GitHub sources and drive commit-pinned hosted security jobs without PATs or provider keys",
@@ -1680,15 +1685,540 @@ function printGroup(out, heading, items) {
   out.log("");
 }
 
+// src/config-reconcile-desired.ts
+import { orderAppServices } from "@odla-ai/apps";
+
+// src/provision-helpers.ts
+import { DEFAULT_SECRET_NAMES } from "@odla-ai/ai";
+import { tenantIdFor } from "@odla-ai/apps";
+function defaultSecretName(provider) {
+  const names = DEFAULT_SECRET_NAMES;
+  return names[provider] ?? `${provider}_api_key`;
+}
+async function assertTenantAdminAccess(doFetch, cfg, env, token) {
+  const tenantId = tenantIdFor(cfg.app.id, env);
+  const res = await doFetch(`${cfg.dbEndpoint}/admin/apps/${encodeURIComponent(tenantId)}/entitlements`, {
+    headers: { authorization: `Bearer ${token}` }
+  });
+  if (res.ok || res.status === 404) return;
+  if (res.status === 403) {
+    throw new Error(
+      `${env}: you are not an owner of "${cfg.app.id}" (tenant ${tenantId}) \u2014 nothing was minted or written; ask an existing owner to run "odla-ai app owners add <your-email>", then re-run provision`
+    );
+  }
+  throw new Error(`${env}: tenant access preflight (${tenantId}) failed: ${res.status} ${await safeText3(res)}`);
+}
+async function postJson(doFetch, url, bearer, body) {
+  const res = await doFetch(url, {
+    method: "POST",
+    headers: { authorization: `Bearer ${bearer}`, "content-type": "application/json" },
+    body: JSON.stringify(body)
+  });
+  if (!res.ok) throw new Error(`${new URL(url).pathname} failed: ${res.status} ${await safeText3(res)}`);
+}
+function normalizeClerkConfig(value2) {
+  if (!value2) return null;
+  if (typeof value2 === "string") {
+    const publishableKey2 = envValue(value2);
+    return publishableKey2 ? { publishableKey: publishableKey2 } : null;
+  }
+  if (typeof value2 !== "object") return null;
+  const cfg = value2;
+  const publishableKey = envValue(cfg.publishableKey);
+  return publishableKey ? { publishableKey, ...cfg.audience ? { audience: cfg.audience } : {}, ...cfg.mode ? { mode: cfg.mode } : {} } : null;
+}
+async function safeText3(res) {
+  try {
+    return redactSecrets((await res.text()).slice(0, 500));
+  } catch {
+    return "";
+  }
+}
+
+// src/config-reconcile-desired.ts
+function desiredRegistryState(cfg) {
+  const environments = {};
+  const services = orderAppServices(cfg.services);
+  for (const env of cfg.envs) {
+    const desiredServices = {};
+    for (const service of services) {
+      desiredServices[service] = {
+        enabled: true,
+        ...managedServiceConfig(cfg, env, service)
+      };
+    }
+    const authoredAuth = cfg.auth?.clerk && Object.hasOwn(cfg.auth.clerk, env) ? cfg.auth.clerk[env] : void 0;
+    const auth = normalizeClerkConfig(authoredAuth);
+    if (authoredAuth && !auth) {
+      throw new Error(`auth.clerk.${env} could not resolve its publishable key`);
+    }
+    const linkManaged = !!cfg.links && Object.hasOwn(cfg.links, env);
+    environments[env] = {
+      services: desiredServices,
+      ...auth ? { auth } : {},
+      ...linkManaged ? { link: cfg.links?.[env] ?? null } : {}
+    };
+  }
+  return {
+    appId: cfg.app.id,
+    name: cfg.app.name,
+    environments
+  };
+}
+function managedServiceConfig(cfg, env, service) {
+  if (service === "ai" && cfg.ai?.provider) {
+    return {
+      config: {
+        provider: cfg.ai.provider,
+        ...cfg.ai.model ? { model: cfg.ai.model } : {}
+      }
+    };
+  }
+  if (service === "calendar") return { config: calendarServiceConfig(cfg, env) };
+  return {};
+}
+
+// src/config-reconcile.ts
+import { appServiceIds as appServiceIds2, orderAppServices as orderAppServices2 } from "@odla-ai/apps";
+
+// src/config-reconcile-digest.ts
+import { createHash } from "crypto";
+function canonicalJson(value2) {
+  return JSON.stringify(canonicalValue(value2));
+}
+function configDigest(value2) {
+  return `sha256:${createHash("sha256").update(canonicalJson(value2)).digest("hex")}`;
+}
+function canonicalValue(value2) {
+  if (Array.isArray(value2)) return value2.map(canonicalValue);
+  if (value2 && typeof value2 === "object") {
+    return Object.fromEntries(
+      Object.entries(value2).filter(([, entry]) => entry !== void 0).sort(([left], [right]) => left.localeCompare(right)).map(([key, entry]) => [key, canonicalValue(entry)])
+    );
+  }
+  return value2;
+}
+
+// src/config-reconcile-values.ts
+function difference(path, desired, observed, status, reason, desiredSource, observedSource, env, service) {
+  return { path, env, service, status, desired, observed, desiredSource, observedSource, reason };
+}
+function action(kind, path, before, after, risk, applySupport, reason) {
+  return { kind, path, before, after, risk, requiresApproval: false, applySupport, reason };
+}
+function scopedAction(kind, path, env, service, before, after, reason, destructive = false) {
+  const production = env === "prod" || env === "production";
+  return {
+    ...action(
+      kind,
+      path,
+      before,
+      after,
+      destructive ? "high" : production ? "medium" : "low",
+      destructive ? "studio" : "provision",
+      reason
+    ),
+    env,
+    ...service ? { service } : {},
+    requiresApproval: production || destructive
+  };
+}
+function observedProjection(app) {
+  return {
+    appId: app.appId,
+    name: app.name,
+    archivedAt: app.archivedAt,
+    environments: Object.fromEntries(
+      Object.entries(app.environments).sort(([left], [right]) => left.localeCompare(right)).map(([env, services]) => [
+        env,
+        Object.fromEntries(Object.entries(services).sort(([left], [right]) => left.localeCompare(right)))
+      ])
+    ),
+    auth: app.auth,
+    links: app.links
+  };
+}
+function projectConfig(value2, keys) {
+  return Object.fromEntries(keys.filter((key) => value2[key] !== void 0).map((key) => [key, value2[key]]));
+}
+function same(left, right) {
+  return canonicalJson(left) === canonicalJson(right);
+}
+function actionId(actionValue) {
+  return `action-${configDigest(actionValue).slice("sha256:".length, "sha256:".length + 16)}`;
+}
+function quoteArg(value2) {
+  return `'${value2.replace(/'/g, `'\\''`)}'`;
+}
+
+// src/config-reconcile.ts
+var COVERAGE = {
+  included: [
+    "app display name",
+    "environment service enablement",
+    "AI provider/model and calendar booking service configuration",
+    "auth configuration when explicitly declared",
+    "deployment link when explicitly declared"
+  ],
+  excluded: [
+    { path: "db.schema", reason: "owned by the database data plane" },
+    { path: "db.rules", reason: "owned by the database data plane" },
+    { path: "integrations.seeds", reason: "guarded data-plane writes are not Registry state" },
+    { path: "credentials", reason: "shown-once credentials are intentionally local" },
+    { path: "secrets", reason: "vault and Worker secrets are write-only" },
+    { path: "calendar.connection", reason: "OAuth connection state is provider-owned" },
+    { path: "service.config.opaque", reason: "controller-assigned fields remain service-owned" }
+  ]
+};
+function reconcileConfig(input) {
+  const desiredSource = { kind: "project_config", location: input.configPath };
+  const observedSource = {
+    kind: "registry",
+    location: `${input.platformUrl}/registry/apps/${encodeURIComponent(input.desired.appId)}`
+  };
+  const differences = [];
+  const actions = [];
+  const add = (difference2, action2) => {
+    differences.push(difference2);
+    if (action2) actions.push({ ...action2, id: actionId(action2) });
+  };
+  compareApp(input.desired, input.observed, desiredSource, observedSource, add);
+  compareEnvironments(input.desired, input.observed, desiredSource, observedSource, add);
+  const desiredRevision = configDigest(input.desired);
+  const observedRevision = input.observed ? configDigest(observedProjection(input.observed)) : null;
+  const different = differences.filter((entry) => entry.status === "different").length;
+  const unmanaged = differences.length - different;
+  return {
+    generatedAt: input.generatedAt,
+    scope: {
+      appId: input.desired.appId,
+      platformUrl: input.platformUrl,
+      environments: Object.keys(input.desired.environments).sort()
+    },
+    sources: { desired: desiredSource, observed: observedSource },
+    desiredRevision,
+    observedRevision,
+    status: different ? "different" : unmanaged ? "unmanaged" : "in_sync",
+    summary: {
+      differences: different,
+      unmanaged,
+      actions: actions.length,
+      productionActions: actions.filter((action2) => action2.env === "prod" || action2.env === "production").length,
+      highRiskActions: actions.filter((action2) => action2.risk === "high").length
+    },
+    coverage: COVERAGE,
+    differences,
+    actions
+  };
+}
+function compareApp(desired, observed, desiredSource, observedSource, add) {
+  if (!observed) {
+    const path = "app";
+    add(
+      difference(path, desired, null, "different", "the app is absent from Registry", desiredSource, observedSource),
+      action(
+        "create_app",
+        path,
+        null,
+        { appId: desired.appId, name: desired.name },
+        "low",
+        "provision",
+        "create the repository-declared app"
+      )
+    );
+    return;
+  }
+  if (observed.name !== desired.name) {
+    const path = "app.name";
+    add(
+      difference(path, desired.name, observed.name, "different", "the checked-in display name differs", desiredSource, observedSource),
+      {
+        ...action("rename_app", path, observed.name, desired.name, "low", "command", "make Registry match the checked-in display name"),
+        command: `odla-ai app rename ${quoteArg(desired.name)} --config ${quoteArg(desiredSource.location)}`
+      }
+    );
+  }
+}
+function compareEnvironments(desired, observed, desiredSource, observedSource, add) {
+  const envs = /* @__PURE__ */ new Set([
+    ...Object.keys(desired.environments),
+    ...Object.keys(observed?.environments ?? {}).filter((env) => Object.values(observed?.environments[env] ?? {}).some((service) => service.enabled))
+  ]);
+  for (const env of [...envs].sort()) {
+    compareServices(env, desired, observed, desiredSource, observedSource, add);
+    compareOptionalEnvironmentState(env, desired, observed, desiredSource, observedSource, add);
+  }
+}
+function compareServices(env, desired, observed, desiredSource, observedSource, add) {
+  const wanted = desired.environments[env]?.services ?? {};
+  const live = observed?.environments[env] ?? {};
+  const knownOrder = orderAppServices2(appServiceIds2());
+  const services = [.../* @__PURE__ */ new Set([...knownOrder, ...Object.keys(wanted), ...Object.keys(live)])];
+  for (const service of services) {
+    const next = wanted[service];
+    const current = live[service];
+    const path = `environments.${env}.services.${service}`;
+    if (next?.enabled && !current?.enabled) {
+      add(
+        difference(path, next, current ?? null, "different", "the repository enables a service Registry does not", desiredSource, observedSource, env, service),
+        scopedAction("enable_service", path, env, service, current ?? null, next, "enable the repository-declared service")
+      );
+      continue;
+    }
+    if (next?.enabled && current?.enabled && next.config) {
+      const projected = projectConfig(current.config, Object.keys(next.config));
+      if (!same(next.config, projected)) {
+        add(
+          difference(`${path}.config`, next.config, projected, "different", "repository-managed service settings differ", desiredSource, observedSource, env, service),
+          scopedAction(
+            "configure_service",
+            `${path}.config`,
+            env,
+            service,
+            projected,
+            next.config,
+            "apply the repository-managed service settings"
+          )
+        );
+      }
+    }
+  }
+  for (const service of [...services].reverse()) {
+    const next = wanted[service];
+    const current = live[service];
+    if (next?.enabled || !current?.enabled) continue;
+    const path = `environments.${env}.services.${service}`;
+    add(
+      difference(path, null, { enabled: true }, "different", "Registry enables a service absent from repository intent", desiredSource, observedSource, env, service),
+      scopedAction(
+        "disable_service",
+        path,
+        env,
+        service,
+        { enabled: true },
+        { enabled: false },
+        "disablement is destructive to availability and requires an explicit Studio review",
+        true
+      )
+    );
+  }
+}
+function compareOptionalEnvironmentState(env, desired, observed, desiredSource, observedSource, add) {
+  const wanted = desired.environments[env];
+  const liveAuth = observed?.auth[env] ?? null;
+  if (wanted?.auth) {
+    const projected = liveAuth ? projectConfig(liveAuth, Object.keys(wanted.auth)) : null;
+    if (!same(wanted.auth, projected)) {
+      const path = `environments.${env}.auth`;
+      add(
+        difference(path, wanted.auth, projected, "different", "explicit repository auth settings differ", desiredSource, observedSource, env),
+        scopedAction("set_auth", path, env, void 0, projected, wanted.auth, "apply explicit repository auth settings")
+      );
+    }
+  } else if (liveAuth) {
+    add(difference(
+      `environments.${env}.auth`,
+      null,
+      projectConfig(liveAuth, ["publishableKey", "audience", "mode"]),
+      "unmanaged",
+      "live auth exists but this project config does not manage it",
+      desiredSource,
+      observedSource,
+      env
+    ));
+  }
+  const managesLink = wanted && Object.hasOwn(wanted, "link");
+  const liveLink = observed?.links[env] ?? null;
+  if (managesLink && wanted.link !== liveLink) {
+    const path = `environments.${env}.link`;
+    add(
+      difference(path, wanted.link ?? null, liveLink, "different", "explicit repository deployment link differs", desiredSource, observedSource, env),
+      scopedAction("set_link", path, env, void 0, liveLink, wanted.link ?? null, "apply the repository deployment link")
+    );
+  } else if (!managesLink && liveLink) {
+    add(difference(
+      `environments.${env}.link`,
+      null,
+      liveLink,
+      "unmanaged",
+      "a live deployment link exists but this project config does not manage it",
+      desiredSource,
+      observedSource,
+      env
+    ));
+  }
+}
+
+// src/config-reconcile-command.ts
+import { createAppsClient } from "@odla-ai/apps";
+import { join as join3 } from "path";
+async function configDiff(options) {
+  const reconciliation = await inspectConfig(options);
+  const { actions: _actions, ...read3 } = reconciliation;
+  const document = {
+    schemaVersion: "odla.config-diff/v1",
+    ...read3,
+    nextActions: diffNextActions(reconciliation, options.configPath)
+  };
+  printDiff(document, options);
+  return document;
+}
+async function configPlan(options) {
+  const reconciliation = await inspectConfig(options);
+  const planDigest = configDigest({
+    schemaVersion: "odla.config-plan/v1",
+    desiredRevision: reconciliation.desiredRevision,
+    observedRevision: reconciliation.observedRevision,
+    actions: reconciliation.actions
+  });
+  const document = {
+    schemaVersion: "odla.config-plan/v1",
+    ...reconciliation,
+    planDigest,
+    apply: {
+      supported: false,
+      reason: "conditional, resumable config apply is not available yet; use the exact reviewed commands below"
+    },
+    nextActions: planNextActions(reconciliation, options.configPath)
+  };
+  printPlan(document, options);
+  return document;
+}
+async function inspectConfig(options) {
+  const out = options.stdout ?? console;
+  const cfg = await loadProjectConfig(options.configPath);
+  const doFetch = options.fetch ?? fetch;
+  const token = await resolveAdminPlatformToken({
+    platform: cfg.platformUrl,
+    scope: "app:config:read",
+    token: options.token,
+    tokenFile: join3(cfg.rootDir, ".odla", "admin-token.local.json"),
+    rootDir: cfg.rootDir,
+    email: options.email,
+    open: options.open,
+    fetch: doFetch,
+    stdout: out,
+    openApprovalUrl: options.openApprovalUrl,
+    label: `odla CLI (${cfg.app.id} config read)`
+  });
+  const client = createAppsClient({ endpoint: cfg.platformUrl, token, fetcher: { fetch: doFetch } });
+  const observed = await client.resolveApp(cfg.app.id);
+  return reconcileConfig({
+    desired: desiredRegistryState(cfg),
+    observed,
+    configPath: cfg.configPath,
+    platformUrl: cfg.platformUrl,
+    generatedAt: (options.now?.() ?? /* @__PURE__ */ new Date()).toISOString()
+  });
+}
+function printDiff(document, options) {
+  const out = options.stdout ?? console;
+  if (options.json) {
+    out.log(JSON.stringify(document, null, 2));
+    return;
+  }
+  printHeader(out, "diff", document);
+  printDifferences(out, document);
+  printNext(out, document.nextActions);
+}
+function printPlan(document, options) {
+  const out = options.stdout ?? console;
+  if (options.json) {
+    out.log(JSON.stringify(document, null, 2));
+    return;
+  }
+  printHeader(out, "plan", document);
+  for (const entry of document.actions) {
+    const scope = [entry.env, entry.service].filter(Boolean).join("/");
+    out.log(
+      `  ${entry.id}  ${entry.kind}${scope ? ` (${scope})` : ""}  ${entry.risk}${entry.requiresApproval ? ", approval required" : ""}`
+    );
+    out.log(`    ${entry.reason}`);
+  }
+  if (!document.actions.length) out.log("  no managed changes");
+  out.log(`plan digest: ${document.planDigest}`);
+  out.log(`apply: unsupported \u2014 ${document.apply.reason}`);
+  printNext(out, document.nextActions);
+}
+function printHeader(out, kind, document) {
+  out.log(`config ${kind}: ${document.scope.appId} \u2014 ${document.status}`);
+  out.log(`platform: ${document.scope.platformUrl}`);
+  out.log(`desired:  ${document.desiredRevision}`);
+  out.log(`observed: ${document.observedRevision ?? "absent"}`);
+  out.log(
+    `summary: ${document.summary.differences} different, ${document.summary.unmanaged} unmanaged, ${document.summary.actions} planned actions`
+  );
+}
+function printDifferences(out, document) {
+  for (const entry of document.differences) {
+    out.log(`  ${entry.status}	${entry.path}	${entry.reason}`);
+  }
+  if (!document.differences.length) out.log("  managed Registry configuration is in sync");
+}
+function printNext(out, next) {
+  if (!next.length) return;
+  out.log("next:");
+  for (const item of next) out.log(`  ${item.command}
+    ${item.description}`);
+}
+function diffNextActions(reconciliation, configPath) {
+  if (reconciliation.status === "in_sync") {
+    return [{
+      code: "verify_runtime",
+      command: `odla-ai smoke --config ${quoteArg2(configPath)}`,
+      description: "Registry intent matches; verify the service-owned data planes separately."
+    }];
+  }
+  return [{
+    code: "freeze_plan",
+    command: `odla-ai config plan --config ${quoteArg2(configPath)} --json`,
+    description: "Freeze the current desired and observed revisions into a reviewable action plan."
+  }];
+}
+function planNextActions(reconciliation, configPath) {
+  const next = [];
+  if (reconciliation.actions.some((action2) => action2.applySupport === "provision")) {
+    next.push({
+      code: "review_provision",
+      command: `odla-ai provision --config ${quoteArg2(configPath)} --dry-run`,
+      description: "Review the existing provisioner's service/auth/link work before applying it."
+    });
+  }
+  for (const action2 of reconciliation.actions.filter((entry) => entry.command)) {
+    if (!next.some((entry) => entry.command === action2.command)) {
+      next.push({ code: action2.kind, command: action2.command, description: action2.reason });
+    }
+  }
+  if (reconciliation.actions.some((action2) => action2.applySupport === "studio")) {
+    const { appId, platformUrl } = reconciliation.scope;
+    next.push({
+      code: "review_destructive",
+      command: `${platformUrl}/studio/apps/${encodeURIComponent(appId)}/settings`,
+      description: "Review service disablement in the owning Studio scope; this plan will not apply it."
+    });
+  }
+  if (!reconciliation.actions.length && reconciliation.summary.unmanaged) {
+    next.push({
+      code: "declare_or_accept_runtime_state",
+      command: `${reconciliation.scope.platformUrl}/studio/apps/${encodeURIComponent(reconciliation.scope.appId)}/settings`,
+      description: "Declare the live value in project config or keep it as an explicit runtime-managed setting."
+    });
+  }
+  return next;
+}
+function quoteArg2(value2) {
+  return `'${value2.replace(/'/g, `'\\''`)}'`;
+}
+
 // src/doctor-checks.ts
 import { execFileSync } from "child_process";
 import { existsSync as existsSync5, readFileSync as readFileSync4 } from "fs";
-import { join as join4, resolve as resolve3 } from "path";
+import { join as join5, resolve as resolve3 } from "path";
 
 // src/wrangler.ts
 import { spawn as spawn2 } from "child_process";
 import { existsSync as existsSync4, readFileSync as readFileSync3 } from "fs";
-import { join as join3 } from "path";
+import { join as join4 } from "path";
 var defaultRunner = (cmd, args, opts) => new Promise((resolvePromise, reject) => {
   const child = spawn2(cmd, args, { cwd: opts?.cwd, stdio: ["pipe", "pipe", "pipe"] });
   let stdout = "";
@@ -1702,7 +2232,7 @@ var defaultRunner = (cmd, args, opts) => new Promise((resolvePromise, reject) =>
 var WRANGLER_CONFIG_FILES = ["wrangler.jsonc", "wrangler.json", "wrangler.toml"];
 function findWranglerConfig(rootDir) {
   for (const name of WRANGLER_CONFIG_FILES) {
-    const path = join3(rootDir, name);
+    const path = join4(rootDir, name);
     if (existsSync4(path)) return path;
   }
   return null;
@@ -1768,11 +2298,11 @@ function lintRules(rules, entities, publicRead) {
   const warnings = [];
   if (!rules) return warnings;
   for (const [ns, actions] of Object.entries(rules)) {
-    for (const [action, expr] of Object.entries(actions)) {
+    for (const [action2, expr] of Object.entries(actions)) {
       if (typeof expr !== "string" || expr.trim() !== "true") continue;
-      if (action === "view" && publicRead.includes(ns)) continue;
+      if (action2 === "view" && publicRead.includes(ns)) continue;
       warnings.push(
-        action === "view" ? `rules.${ns}.view is "true" \u2014 public read; add "${ns}" to db.publicRead if intended` : `rules.${ns}.${action} is "true" \u2014 any client can ${action} ${ns} rows`
+        action2 === "view" ? `rules.${ns}.view is "true" \u2014 public read; add "${ns}" to db.publicRead if intended` : `rules.${ns}.${action2} is "true" \u2014 any client can ${action2} ${ns} rows`
       );
     }
   }
@@ -1811,7 +2341,7 @@ function wranglerWarnings(rootDir) {
       const dir = resolve3(rootDir, assets.directory);
       if (dir === resolve3(rootDir)) {
         warnings.push(`${label}assets.directory is the project root \u2014 point it at a dedicated build dir (wrangler dev fails with "spawn EBADF")`);
-      } else if (existsSync5(join4(dir, "node_modules"))) {
+      } else if (existsSync5(join5(dir, "node_modules"))) {
         warnings.push(`${label}assets.directory contains node_modules \u2014 wrangler dev's watcher will exhaust file descriptors`);
       }
     }
@@ -1876,7 +2406,7 @@ function calendarProjectWarnings(rootDir) {
 }
 function readPackageJson(rootDir) {
   try {
-    return JSON.parse(readFileSync4(join4(rootDir, "package.json"), "utf8"));
+    return JSON.parse(readFileSync4(join5(rootDir, "package.json"), "utf8"));
   } catch {
     return null;
   }
@@ -1932,8 +2462,8 @@ function integrationWarnings(integrations, schema, rules) {
         warnings.push(`integration "${integration.id}" has no rules for "${ns}"`);
         continue;
       }
-      for (const action of ["view", "create", "update", "delete"]) {
-        if (rule[action] === void 0) warnings.push(`integration "${integration.id}" rule "${ns}.${action}" is missing`);
+      for (const action2 of ["view", "create", "update", "delete"]) {
+        if (rule[action2] === void 0) warnings.push(`integration "${integration.id}" rule "${ns}.${action2}" is missing`);
       }
     }
     for (const seed of integration.seeds ?? []) {
@@ -2086,7 +2616,7 @@ async function doctor(options) {
 // src/init.ts
 import { existsSync as existsSync6, mkdirSync as mkdirSync2, writeFileSync as writeFileSync2 } from "fs";
 import { dirname as dirname4, resolve as resolve4 } from "path";
-import { appServiceDefinition as appServiceDefinition2, appServiceIds as appServiceIds2 } from "@odla-ai/apps";
+import { appServiceDefinition as appServiceDefinition2, appServiceIds as appServiceIds3 } from "@odla-ai/apps";
 function initProject(options) {
   const out = options.stdout ?? console;
   const rootDir = resolve4(options.rootDir ?? process.cwd());
@@ -2101,7 +2631,7 @@ function initProject(options) {
   const services = options.services?.length ? options.services : ["db", "ai"];
   for (const service of services) {
     const definition = appServiceDefinition2(service);
-    if (!definition) throw new Error(`--services contains unknown service "${service}" (known: ${appServiceIds2().join(", ")})`);
+    if (!definition) throw new Error(`--services contains unknown service "${service}" (known: ${appServiceIds3().join(", ")})`);
     for (const dependency of definition.requires) {
       if (!services.includes(dependency)) throw new Error(`--services ${service} requires ${dependency}`);
     }
@@ -2295,7 +2825,7 @@ function assertWranglerConfig(cfg) {
 
 // src/secrets-set.ts
 import { putSecret } from "@odla-ai/ai";
-import { tenantIdFor } from "@odla-ai/apps";
+import { tenantIdFor as tenantIdFor2 } from "@odla-ai/apps";
 var PROD_ENV_NAMES2 = /* @__PURE__ */ new Set(["prod", "production"]);
 async function secretsSet(options) {
   const name = (options.name ?? "").trim();
@@ -2347,13 +2877,13 @@ async function resolveVaultWrite(options) {
     throw new Error(`refusing to store a secret for "${options.env}" without --yes`);
   }
   const value2 = await secretInputValue(options, "secret");
-  return { cfg, tenantId: tenantIdFor(cfg.app.id, options.env), value: value2, doFetch, out };
+  return { cfg, tenantId: tenantIdFor2(cfg.app.id, options.env), value: value2, doFetch, out };
 }
 
 // src/skill.ts
 import { existsSync as existsSync7, lstatSync, mkdirSync as mkdirSync3, readFileSync as readFileSync5, readdirSync, writeFileSync as writeFileSync3 } from "fs";
 import { homedir } from "os";
-import { dirname as dirname5, isAbsolute as isAbsolute3, join as join5, relative as relative2, resolve as resolve5, sep } from "path";
+import { dirname as dirname5, isAbsolute as isAbsolute3, join as join6, relative as relative2, resolve as resolve5, sep } from "path";
 import { fileURLToPath } from "url";
 
 // src/skill-adapters.ts
@@ -2447,12 +2977,12 @@ function installSkill(options = {}) {
     plans.set(target, { target, content: content2, boundary, managedMerge });
   };
   const planSkillTree = (targetDir2, boundary = root) => {
-    for (const rel of files) plan(join5(targetDir2, rel), readFileSync5(join5(sourceDir, rel), "utf8"), false, boundary);
+    for (const rel of files) plan(join6(targetDir2, rel), readFileSync5(join6(sourceDir, rel), "utf8"), false, boundary);
   };
   let targetDir;
   if (options.global) {
-    const claudeRoot = join5(home, ".claude", "skills");
-    const codexRoot = resolve5(options.codexHomeDir ?? process.env.CODEX_HOME ?? join5(home, ".codex"), "skills");
+    const claudeRoot = join6(home, ".claude", "skills");
+    const codexRoot = resolve5(options.codexHomeDir ?? process.env.CODEX_HOME ?? join6(home, ".codex"), "skills");
     targetDir = harnesses[0] === "codex" ? codexRoot : claudeRoot;
     for (const harness of harnesses) {
       const skillRoot = harness === "claude" ? claudeRoot : codexRoot;
@@ -2460,35 +2990,35 @@ function installSkill(options = {}) {
       rememberTarget(harness, skillRoot);
     }
   } else {
-    const sharedRoot = join5(root, ".agents", "skills");
+    const sharedRoot = join6(root, ".agents", "skills");
     planSkillTree(sharedRoot);
-    const claudeRoot = join5(root, ".claude", "skills");
+    const claudeRoot = join6(root, ".claude", "skills");
     targetDir = harnesses.includes("claude") ? claudeRoot : sharedRoot;
     for (const harness of harnesses) rememberTarget(harness, sharedRoot);
     if (harnesses.includes("claude")) {
       for (const skill of skillNames(files)) {
-        const canonical = readFileSync5(join5(sourceDir, skill, "SKILL.md"), "utf8");
-        plan(join5(claudeRoot, skill, "SKILL.md"), claudeAdapter(skill, canonical));
+        const canonical = readFileSync5(join6(sourceDir, skill, "SKILL.md"), "utf8");
+        plan(join6(claudeRoot, skill, "SKILL.md"), claudeAdapter(skill, canonical));
       }
       rememberTarget("claude", claudeRoot);
     }
     if (harnesses.includes("cursor")) {
-      const cursorRule = join5(root, ".cursor", "rules", "odla.mdc");
+      const cursorRule = join6(root, ".cursor", "rules", "odla.mdc");
       plan(cursorRule, CURSOR_RULE);
       rememberTarget("cursor", cursorRule);
     }
     if (harnesses.includes("agents")) {
-      const agentsFile = join5(root, "AGENTS.md");
+      const agentsFile = join6(root, "AGENTS.md");
       plan(agentsFile, managedFileContent(agentsFile, PROJECT_INSTRUCTIONS, options.force === true, root), true);
       rememberTarget("agents", agentsFile);
     }
     if (harnesses.includes("copilot")) {
-      const copilotFile = join5(root, ".github", "copilot-instructions.md");
+      const copilotFile = join6(root, ".github", "copilot-instructions.md");
       plan(copilotFile, managedFileContent(copilotFile, PROJECT_INSTRUCTIONS, options.force === true, root), true);
       rememberTarget("copilot", copilotFile);
     }
     if (harnesses.includes("gemini")) {
-      const geminiFile = join5(root, "GEMINI.md");
+      const geminiFile = join6(root, "GEMINI.md");
       plan(geminiFile, managedFileContent(geminiFile, PROJECT_INSTRUCTIONS, options.force === true, root), true);
       rememberTarget("gemini", geminiFile);
     }
@@ -2595,7 +3125,7 @@ function symlinkedComponent(boundary, target) {
   }
   let current = boundary;
   for (const part of rel.split(sep).filter(Boolean)) {
-    current = join5(current, part);
+    current = join6(current, part);
     try {
       if (lstatSync(current).isSymbolicLink()) return current;
     } catch (error) {
@@ -2612,7 +3142,7 @@ function listFiles(dir) {
   const results = [];
   const walk = (current) => {
     for (const entry of readdirSync(current, { withFileTypes: true })) {
-      const path = join5(current, entry.name);
+      const path = join6(current, entry.name);
       if (entry.isDirectory()) walk(path);
       else results.push(relative2(dir, path));
     }
@@ -2690,7 +3220,7 @@ async function smoke(options) {
     out.log(`  schema: ${liveEntities.length} entities`);
     const aggregateEntity = expectedEntities[0] ?? liveEntities[0];
     if (aggregateEntity) {
-      const aggregate = await postJson(doFetch, `${cfg.dbEndpoint}/app/${encodeURIComponent(entry.tenantId)}/aggregate`, entry.dbKey, {
+      const aggregate = await postJson2(doFetch, `${cfg.dbEndpoint}/app/${encodeURIComponent(entry.tenantId)}/aggregate`, entry.dbKey, {
         ns: aggregateEntity,
         aggregate: { count: true }
       });
@@ -2734,16 +3264,16 @@ async function getJson(doFetch, url, bearer) {
   const res = await doFetch(url, {
     headers: bearer ? { authorization: `Bearer ${bearer}` } : void 0
   });
-  if (!res.ok) throw new Error(`${new URL(url).pathname} returned ${res.status}: ${await safeText3(res)}`);
+  if (!res.ok) throw new Error(`${new URL(url).pathname} returned ${res.status}: ${await safeText4(res)}`);
   return res.json();
 }
-async function postJson(doFetch, url, bearer, body) {
+async function postJson2(doFetch, url, bearer, body) {
   const res = await doFetch(url, {
     method: "POST",
     headers: { authorization: `Bearer ${bearer}`, "content-type": "application/json" },
     body: JSON.stringify(body)
   });
-  if (!res.ok) throw new Error(`${new URL(url).pathname} returned ${res.status}: ${await safeText3(res)}`);
+  if (!res.ok) throw new Error(`${new URL(url).pathname} returned ${res.status}: ${await safeText4(res)}`);
   return res.json();
 }
 function publicConfigUrl(platformUrl, appId, env) {
@@ -2751,7 +3281,7 @@ function publicConfigUrl(platformUrl, appId, env) {
   url.searchParams.set("env", env);
   return url.toString();
 }
-async function safeText3(res) {
+async function safeText4(res) {
   try {
     return redactSecrets((await res.text()).slice(0, 500));
   } catch {
@@ -2764,7 +3294,7 @@ import { execFile } from "child_process";
 import { promisify } from "util";
 
 // src/security-hosted-request.ts
-async function requestHostedSecurityJson(options, path, init, action) {
+async function requestHostedSecurityJson(options, path, init, action2) {
   const platform = platformAudience(options.platform);
   const token = hostedSecurityCredential(options.token);
   const requestInit = {
@@ -2784,7 +3314,7 @@ async function requestHostedSecurityJson(options, path, init, action) {
   if (!response2.ok) {
     const code = optionalHostedText(body.error?.code, "error code", 128);
     const message2 = optionalHostedText(body.error?.message, "error message", 300);
-    throw new Error(`${action} failed (${response2.status})${code ? ` ${code}` : ""}${message2 ? `: ${message2}` : ""}`);
+    throw new Error(`${action2} failed (${response2.status})${code ? ` ${code}` : ""}${message2 ? `: ${message2}` : ""}`);
   }
   return body;
 }
@@ -3000,10 +3530,10 @@ var CODE_BUILD_RECIPES = Object.freeze([{
 
 // src/code-images.ts
 import { spawn as spawn3 } from "child_process";
-import { createHash } from "crypto";
+import { createHash as createHash2 } from "crypto";
 import { copyFile, mkdtemp, readFile, rm, writeFile } from "fs/promises";
 import { tmpdir } from "os";
-import { join as join6 } from "path";
+import { join as join7 } from "path";
 import { fileURLToPath as fileURLToPath2 } from "url";
 var runCodeImageCommand = (command, args, stdio) => new Promise((accept, reject) => {
   const child = spawn3(command, [...args], { shell: false, stdio });
@@ -3059,13 +3589,13 @@ async function embeddedPiImageName() {
   const bundle = await readFile(embeddedPiAssetPath()).catch(() => {
     throw new Error("CLI-embedded Pi runtime is missing; reinstall this exact @odla-ai/cli version");
   });
-  return `odla-ai/pi-agent:embedded-sha256-${createHash("sha256").update(bundle).digest("hex")}`;
+  return `odla-ai/pi-agent:embedded-sha256-${createHash2("sha256").update(bundle).digest("hex")}`;
 }
 async function buildEmbeddedPiImage(engine, image, run) {
-  const context = await mkdtemp(join6(tmpdir(), "odla-code-pi-"));
+  const context = await mkdtemp(join7(tmpdir(), "odla-code-pi-"));
   try {
-    await copyFile(embeddedPiAssetPath(), join6(context, "pi-agent.js"));
-    await writeFile(join6(context, "Dockerfile"), [
+    await copyFile(embeddedPiAssetPath(), join7(context, "pi-agent.js"));
+    await writeFile(join7(context, "Dockerfile"), [
       `FROM ${CODE_NODE_IMAGE}`,
       "COPY pi-agent.js /opt/odla/pi-agent.js",
       "WORKDIR /workspace",
@@ -3168,7 +3698,7 @@ function encodeAgentInput(message2) {
 import { execFile as execFile2, spawn as spawn4 } from "child_process";
 import { constants } from "fs";
 import { access } from "fs/promises";
-import { delimiter, join as join7 } from "path";
+import { delimiter, join as join8 } from "path";
 import { getgid, getuid } from "process";
 import { mkdir, mkdtemp as mkdtemp2, realpath, rm as rm2, writeFile as writeFile2 } from "fs/promises";
 import { tmpdir as tmpdir2 } from "os";
@@ -3186,7 +3716,7 @@ function assertPinnedImage(image) {
 async function commandAvailable(engine) {
   for (const directory of (process.env.PATH ?? "").split(delimiter).filter(Boolean)) {
     try {
-      await access(join7(directory, engine), constants.X_OK);
+      await access(join8(directory, engine), constants.X_OK);
       return true;
     } catch {
     }
@@ -3682,7 +4212,7 @@ async function stageWorkspacePair(baselineSource, workspaceSource, options = {})
 }
 
 // ../harness/dist/chunk-GMVZ4LZH.js
-import { createHash as createHash2 } from "crypto";
+import { createHash as createHash3 } from "crypto";
 import { readFile as readFile2, readdir as readdir2 } from "fs/promises";
 import { relative as relative4, resolve as resolve7 } from "path";
 
@@ -3699,7 +4229,7 @@ var CamelError = class extends Error {
 };
 
 // ../camel/dist/chunk-L5DYU2E2.js
-function canonicalJson(value2) {
+function canonicalJson2(value2) {
   return JSON.stringify(normalize(value2));
 }
 async function sha256Hex(value2) {
@@ -3711,7 +4241,7 @@ function utf8Length(value2) {
   if (typeof value2 === "string") return new TextEncoder().encode(value2).byteLength;
   if (value2 instanceof Uint8Array) return value2.byteLength;
   try {
-    return new TextEncoder().encode(canonicalJson(value2)).byteLength;
+    return new TextEncoder().encode(canonicalJson2(value2)).byteLength;
   } catch {
     throw new CamelError("conversion_rejected", "Unsafe input could not be canonically measured.");
   }
@@ -3837,7 +4367,7 @@ async function digestCodeVerificationReceipt(fields) {
     changedTestsRequireReview: fields.changedTestsRequireReview,
     outcome: fields.outcome
   };
-  return `sha256:${await sha256Hex(canonicalJson(canonical))}`;
+  return `sha256:${await sha256Hex(canonicalJson2(canonical))}`;
 }
 function validate(fields) {
   if (fields.schemaVersion !== 1 || typeof fields.verificationId !== "string" || !ID.test(fields.verificationId) || typeof fields.trustedBaseCommitSha !== "string" || !SHA.test(fields.trustedBaseCommitSha) || !DIGEST.test(fields.trustedBaseDigest) || !DIGEST.test(fields.patchDigest) || !DIGEST.test(fields.candidateDigest) || !DIGEST.test(fields.sourceDigest) || !DIGEST.test(fields.policyDigest) || !DIGEST.test(fields.changedTestSetDigest) || !Number.isSafeInteger(fields.changedTestCount) || fields.changedTestCount < 0 || fields.changedTestCount > 1e4 || fields.changedTestsRequireReview !== fields.changedTestCount > 0 || fields.recipes.length < 1 || fields.recipes.length > 64) {
@@ -3875,9 +4405,9 @@ async function createCodePortableCheckpoint(input) {
   const state2 = normalizeState(input.state);
   validateBaseAndPatch(input.baseCommitSha, input.patch);
   const patchDigest = `sha256:${await sha256Hex(input.patch)}`;
-  const stateDigest = `sha256:${await sha256Hex(canonicalJson(state2))}`;
+  const stateDigest = `sha256:${await sha256Hex(canonicalJson2(state2))}`;
   const fields = { schemaVersion: 1, baseCommitSha: input.baseCommitSha, patchDigest, state: state2, stateDigest };
-  const checkpointDigest = `sha256:${await sha256Hex(canonicalJson(fields))}`;
+  const checkpointDigest = `sha256:${await sha256Hex(canonicalJson2(fields))}`;
   return freeze({ ...fields, patch: input.patch, checkpointDigest });
 }
 async function verifyCodePortableCheckpoint(value2) {
@@ -3995,7 +4525,7 @@ async function digestCodeRepositorySnapshot(snapshot, limits = DEFAULT_LIMITS) {
     commitSha: snapshot.commitSha,
     files: [...snapshot.files].map((file) => ({ path: file.path, content: file.content })).sort((left, right) => left.path.localeCompare(right.path))
   };
-  return `sha256:${await sha256Hex(canonicalJson(normalized))}`;
+  return `sha256:${await sha256Hex(canonicalJson2(normalized))}`;
 }
 function validateSnapshot(snapshot, limits) {
   if (!REPOSITORY.test(snapshot.repository) || !SHA4.test(snapshot.commitSha)) {
@@ -4028,7 +4558,7 @@ import { randomUUID } from "crypto";
 import { createHash as createHash22, randomUUID as randomUUID2 } from "crypto";
 import { createReadStream } from "fs";
 import { lstat as lstat22 } from "fs/promises";
-import { join as join8 } from "path";
+import { join as join9 } from "path";
 import { mkdir as mkdir3, mkdtemp as mkdtemp3, rm as rm3, writeFile as writeFile3 } from "fs/promises";
 import { tmpdir as tmpdir3 } from "os";
 import { dirname as dirname6, join as join23, resolve as resolve32, sep as sep23 } from "path";
@@ -4037,10 +4567,10 @@ import { relative as relative22, resolve as resolve42 } from "path";
 
 // ../camel/dist/chunk-LAXU2AVK.js
 function conversionPolicyDigest(policy) {
-  return sha256Hex(canonicalJson(policy));
+  return sha256Hex(canonicalJson2(policy));
 }
 function registeredIdRegistryDigest(values) {
-  return sha256Hex(canonicalJson(values));
+  return sha256Hex(canonicalJson2(values));
 }
 async function createConversionRegistry(config) {
   const policies = /* @__PURE__ */ new Map();
@@ -4241,10 +4771,10 @@ function createEffectPolicy(config = {}) {
   return Object.freeze({ evaluate: (input) => evaluate(input, registries, approvalEffects) });
 }
 function destinationRegistryDigest(values) {
-  return sha256Hex(canonicalJson([...values].sort()));
+  return sha256Hex(canonicalJson2([...values].sort()));
 }
 async function evaluate(input, registries, approvals) {
-  const actionDigest = await sha256Hex(canonicalJson(input));
+  const actionDigest = await sha256Hex(canonicalJson2(input));
   const decisionId = `decision_${actionDigest.slice(0, 24)}`;
   const deny = (reasonCode) => ({ outcome: "deny", decisionId, reasonCode });
   if (!input.planId || !input.tool.name || !input.tool.policyId || !Number.isSafeInteger(input.tool.version)) return deny("invalid_descriptor");
@@ -4312,7 +4842,7 @@ function looksLikeDestination(value2) {
 }
 
 // ../harness/dist/chunk-GMVZ4LZH.js
-import { createHash as createHash3 } from "crypto";
+import { createHash as createHash32 } from "crypto";
 async function digestStagedWorkspace(root, limits) {
   const files = [];
   const walk = async (directory) => {
@@ -4328,7 +4858,7 @@ async function digestStagedWorkspace(root, limits) {
     }
   };
   await walk(resolve7(root));
-  const hash = createHash2("sha256");
+  const hash = createHash3("sha256");
   let bytes = 0;
   for (const file of files.sort((left, right) => left.path.localeCompare(right.path))) {
     const content2 = await readFile2(file.target);
@@ -4947,7 +5477,7 @@ async function inspectArtifacts(workspaceDir, recipe2) {
   const receipts = [];
   for (const artifact of recipe2.expectedArtifacts ?? []) {
     try {
-      const path = join8(workspaceDir, artifact.path);
+      const path = join9(workspaceDir, artifact.path);
       const info = await lstat22(path);
       if (!info.isFile() || info.isSymbolicLink()) {
         receipts.push({ artifactId: artifact.id, status: "invalid", bytes: null, digest: null });
@@ -5654,7 +6184,7 @@ async function appendCodeRuntimeEvent(control, command, event, refs) {
   const bounded = event.type === "message" ? { ...event, body: event.body.trim().slice(0, 2e4) || `${event.actor} event` } : event;
   await control.appendSessionEvent(command.sessionId, eventId, bounded);
 }
-var digestRuntimeValue = (value2) => `sha256:${createHash3("sha256").update(value2).digest("hex")}`;
+var digestRuntimeValue = (value2) => `sha256:${createHash32("sha256").update(value2).digest("hex")}`;
 var runtimeErrorMessage = (value2) => value2 instanceof Error ? value2.message : String(value2);
 var runtimeRecord = (value2) => value2 && typeof value2 === "object" && !Array.isArray(value2) ? value2 : null;
 var safeRuntimeJson = (value2) => {
@@ -5965,317 +6495,68 @@ var CodePiRuntimeEngine = class {
   }
 };
 
-// src/help.ts
+// src/version.ts
 import { readFileSync as readFileSync6 } from "fs";
 function cliVersion() {
   const pkg = JSON.parse(readFileSync6(new URL("../package.json", import.meta.url), "utf8"));
   return pkg.version ?? "unknown";
 }
-function printHelp(output = console) {
-  output.log(`odla-ai
 
-Start here:
-  odla-ai runbook ask "<question>"   The current procedure, from odla's own
-                                     runbooks. Ask BEFORE searching the web or
-                                     working from memory: runbooks are edited
-                                     live, so your training data is out of date
-                                     and this is not.
-  odla-ai runbook impact             After a change: which runbooks describe the
-                                     code you just touched, so you can fix any
-                                     step it made wrong.
-
-Usage:
-  odla-ai setup [--dir <project>] [--agent <name>] [--global] [--force]
-  odla-ai init --app-id <id> --name <name> [--services db,ai,o11y,calendar] [--env dev --env prod]
-  odla-ai doctor [--config odla.config.mjs]
-  odla-ai calendar status [--env dev] [--email <odla-account>] [--json]
-  odla-ai calendar calendars [--env dev] [--email <odla-account>] [--json]
-  odla-ai calendar connect [--env dev] [--email <odla-account>] [--no-open] [--yes]
-  odla-ai calendar disconnect [--env dev] [--email <odla-account>] --yes
-  odla-ai app archive [--config odla.config.mjs] [--email <odla-account>] [--json] --yes
-  odla-ai app restore [--config odla.config.mjs] [--email <odla-account>] [--json]
-  odla-ai app export [--env dev] [--fresh] [--out <file>] [--email <odla-account>] [--json]
-  odla-ai app import <file|-> [--env dev] [--ns <namespace>] [--id-field <f>|--key <attr>|--generate-ids] [--dry-run] [--json] --yes
-  odla-ai app refresh-sandbox [--include-identity] [--include-files] [--dry-run] [--json] --yes
-  odla-ai app go-live         [--include-identity] [--include-files] [--dry-run] [--json] --yes
-  odla-ai app promote         [--dry-run] [--json] --yes
-  odla-ai app rename <name> [--config odla.config.mjs] [--email <odla-account>] [--json]
-  odla-ai app owners list [--config odla.config.mjs] [--email <odla-account>] [--json]
-  odla-ai app owners add <email> [--email <odla-account>] [--json]
-  odla-ai app owners remove <email> [--email <odla-account>] [--json]
-  odla-ai pm goal list [--app <id>] [--status <s>] [--q <text>] [--limit <n>] [--offset <n>] [--json]
-  odla-ai pm task list [--app <id>] [--column <c>] [--goal <id>] [--assignee <id>] [--q <text>] [--limit <n>] [--offset <n>] [--json]
-  odla-ai pm decision list [--app <id>] [--status <s>] [--q <text>] [--limit <n>] [--offset <n>] [--json]
-  odla-ai pm bug list [--app <id>] [--status <s>] [--severity <s>] [--goal <id>] [--assignee <id>] [--decision <id>] [--q <text>] [--limit <n>] [--offset <n>] [--json]
-  odla-ai pm goal add --app <id> --title <t> [--status <s>] [--proof <text>] [--target <pct>] [--mutation-id <id>] [--json]
-  odla-ai pm task add --app <id> --title <t> [--column <c>] [--goal <id>] [--assignee <id>] [--description <text>|--body <text>] [--due <epoch-ms>] [--mutation-id <id>] [--json]
-  odla-ai pm decision add --app <id> --title <t> --body <text> [--status <s>] [--mutation-id <id>] [--json]
-  odla-ai pm bug add --app <id> --title <t> (--description <text>|--body <text>) [--status <s>] [--severity <s>] [--goal <id>] [--assignee <id>] [--decision <id>] [--mutation-id <id>] [--json]
-  odla-ai pm <goal|task|decision|bug> get <id> [--json]
-  odla-ai pm goal set <id> [--title <t>|--status <s>|--proof <text>|--no-proof|--target <pct>|--no-target] [--mutation-id <id>] [--json]
-  odla-ai pm task set <id> [--title <t>|--column <c>|--rank <n>|--goal <id>|--no-goal|--assignee <id>|--no-assignee|--description <text>|--body <text>|--due <epoch-ms>|--no-due] [--mutation-id <id>] [--json]
-  odla-ai pm decision set <id> [--title <t>|--status <s>|--body <text>] [--mutation-id <id>] [--json]
-  odla-ai pm bug set <id> [--title <t>|--status <s>|--severity <s>|--goal <id>|--no-goal|--assignee <id>|--no-assignee|--decision <id>|--no-decision|--description <text>|--body <text>] [--mutation-id <id>] [--json]
-  odla-ai pm <goal|task|decision> done <id> [--mutation-id <id>]
-  odla-ai pm bug done <id> [--decision <accepted-decision-id>] [--mutation-id <id>]
-  odla-ai pm <goal|task|decision|bug> comment <id> --body "..." [--mutation-id <id>]
-  odla-ai pm <goal|task|decision|bug> comments <id> [--json]
-  odla-ai pm <goal|task|decision|bug> rm <id>
-  odla-ai pm handoff --app <id> [--json]
-  odla-ai discuss groups [--json]
-  odla-ai discuss list [--app <id>] [--q <text>] [--state open|resolved|all] [--json]
-  odla-ai discuss read <topic> [--limit <n> --offset <n>] [--json]
-  odla-ai discuss post --app <id> --subject "..." --body "..." [--markup "... @[Label](kind/id)"] [--mutation-id <id>]
-  odla-ai discuss reply <topic> --body "..." [--markup "..."] [--mutation-id <id>]
-  odla-ai discuss resolve <topic> [--reopen] [--mutation-id <id>]
-  odla-ai discuss who --q <text> [--app <id>] [--kinds user,pm:task] [--json]
-  odla-ai discuss watch [<topic>] [--cursor <cursor>] [--by <authorId>] [--self <authorId>] [--interval <s>] [--timeout <s>] [--json|--jsonl]
-  odla-ai agent jobs [--env dev] [--state pending|running|succeeded|dead_letter] [--limit 50] [--email <email>] [--json]
-  odla-ai agent retry <job-id> [--env dev] [--email <email>] [--json]
-  odla-ai context show [--context <name>] [--platform https://odla.ai] [--app <id>] [--env prod] [--json]
-  odla-ai context list [--json]
-  odla-ai context save <name> [--platform <url>] [--app <id>] [--env <name>] [--json]
-  odla-ai context remove <name> --yes [--json]
-  odla-ai o11y status [--app <id>] [--context <name>] [--platform https://odla.ai] [--env prod] [--minutes 60] [--json]
-  odla-ai platform status [--context <name>] [--platform https://odla.ai] [--email <odla-account>] [--json]
-  odla-ai whoami [--context <name>] [--platform https://odla.ai] [--json]
-  odla-ai runbook ask "<question>" [--app <id>] [--all] [--json]
-  odla-ai runbook search "<question>" [--app <id>] [--all] [--limit <n>] [--json]
-  odla-ai runbook impact [--base origin/main] [--app <id>] [--all] [--limit <n>] [--json]
-  odla-ai runbook lint [--app <id>] [--all] [--json]
-  odla-ai runbook list [--app <id>] [--all] [--q <text>] [--json]
-  odla-ai runbook comment <slug> --body "..." [--app <id>]
-  odla-ai runbook get <slug> [--app <id>]
-  odla-ai runbook new <slug> --title <t> --file <path|-> [--summary <s>] [--requires <specs>] [--app <id>]
-  odla-ai runbook edit <slug> [--file <path|->|--body "..."] [--note <why>] [--requires <specs>] [--app <id>]
-  odla-ai runbook import <dir> [--visibility operator|admin] [--dry-run] [--app <id>]
-  odla-ai runbook publish <slug> [--app <id>]
-  odla-ai runbook visibility <slug> <operator|admin> [--app <id>]
-  odla-ai runbook archive <slug> [--app <id>]
-  odla-ai runbook history <slug> [--app <id>] [--json]
-  odla-ai runbook revert <slug> --version <n> [--app <id>]
-  odla-ai runbook rm <slug> [--app <id>]
-  odla-ai capabilities [--json]
-  odla-ai code connect [--env dev|prod] [--email <odla-account>] [--engine auto|container|podman|docker] [--slots <1-64>] [--once]
-  odla-ai admin ai show [--context <name>] [--platform https://odla.ai] [--email <odla-account>] [--json]
-  odla-ai admin ai models [--context <name>] [--provider <id>] [--json]
-  odla-ai admin ai set <purpose> [--context <name>] [--provider <id>] [--model <id>] [--enabled|--no-enabled]
-    [--max-input-bytes <n>] [--max-output-tokens <n>] [--max-calls-per-run <n>] [--json]
-  odla-ai admin ai set security [--context <name>] --discovery-provider <id> --discovery-model <id>
-    --validation-provider <id> --validation-model <id> [--enabled|--no-enabled] [--json]
-  odla-ai admin ai credentials [--context <name>] [--json]
-  odla-ai admin ai credential set <provider> [--context <name>] (--from-env <NAME>|--stdin)
-  odla-ai admin ai usage [--context <name>] [--app-id <id>] [--env <env>] [--run-id <id>] [--limit <1-500>] [--json]
-  odla-ai admin ai audit [--context <name>] [--limit <1-200>] [--json]
-  odla-ai security github connect [--repo owner/name] [--env dev] [--email <odla-account>] [--no-open]
-  odla-ai security github disconnect --source <id> [--env dev] [--yes]
-  odla-ai security plan [--env dev] [--json]
-  odla-ai security sources [--env dev] [--json]
-  odla-ai security run --source <id> --plan-digest <sha256:...> --ack-redacted-source [--ref <branch|tag|sha>] [--env dev] [--no-follow]
-  odla-ai security status <job-id> [--follow] [--json]
-  odla-ai security report <job-id> [--json]
-  odla-ai security run [target] --ack-redacted-source [--env dev] [--profile odla] [--fail-on high]
-  odla-ai security run [target] --self --ack-redacted-source
-  odla-ai provision [--config odla.config.mjs] [--email <odla-account>] [--wait <seconds>] [--dry-run] [--push-secrets] [--rotate-o11y-token] [--write-dev-vars[=path]] [--yes]
-  odla-ai smoke [--config odla.config.mjs] [--env dev] [--email <odla-account>] [--no-open]
-  odla-ai skill install [--dir <project>] [--agent <name>] [--global] [--force]
-  odla-ai secrets push --env <env> [--config odla.config.mjs] [--dry-run] [--yes]
-  odla-ai secrets set <name> --env <env> (--from-env <NAME>|--stdin) [--email <odla-account>] [--config odla.config.mjs] [--yes]
-  odla-ai secrets set-clerk-key --env <env> (--from-env <NAME>|--stdin) [--email <odla-account>] [--config odla.config.mjs] [--yes]
-  odla-ai version
-
-Commands:
-  agent        Inspect durable agent wakeups and explicitly requeue a
-               dead-lettered job; JSON output is stable for remote operators.
-  runbook      odla's operational procedures, stored in the database and read at
-               the moment they are followed. "ask" gives a written, cited answer;
-               "search" the passages behind it; "get" the whole document.
-               "impact" diffs your working tree against a base ref and names the
-               runbooks that describe what you changed \u2014 run it after touching a
-               package's exported API or JSDoc, or a Studio surface. "lint"
-               checks the corpus the other way: every odla-ai command the
-               runbooks name is held against this CLI's real command surface,
-               and against the minimum versions each runbook declares. A wrong step
-               is fixed with "edit", which takes effect immediately: a runbook is
-               a row, not a release. Runbooks describe PROCEDURE; what an export
-               does and what it guarantees is JSDoc, rendered per package at
-               https://odla.ai/docs and shipped in the installed .d.ts. Answering
-               a question usually needs both.
-  whoami       Report who this terminal is authenticated as, and whether it holds
-               platform admin. A handshake-minted device token is never admin,
-               however the human who approved it is configured.
-  context      Explain selected config, platform, app, environment, and
-               developer-token provenance without printing credentials or
-               starting a device handshake. Operator work can run outside a
-               project checkout with explicit flags or ODLA_* environment
-               variables.
-  setup        Install offline odla runbooks for common coding-agent harnesses.
-  init         Create a generic odla.config.mjs plus starter schema/rules files.
-  doctor       Validate and summarize the project config without network calls.
-  calendar     Inspect, connect, or disconnect the live Google booking connection.
-  app          Archive (suspend, data retained), restore, export, import, or
-               manage the co-owners of the app. Archiving takes every
-               environment's data plane down until restored; permanent deletion
-               has NO CLI \u2014 it requires a signed-in owner in Studio, and no
-               machine or agent credential can purge. "app export" downloads a
-               portable gzipped-JSONL snapshot of one database (--fresh takes a
-               new snapshot first) \u2014 your data is always yours to take.
-               "app import" upserts rows back in from JSON, JSONL, or a
-               {namespace: rows} map (the shape a query returns); it writes only
-               with --yes, so the bare command is a dry run, and it refuses to
-               guess an id mode that would duplicate rows on a re-run.
-               "app refresh-sandbox" replaces the sandbox with a copy of live
-               (the routine dev loop); "app go-live" copies the sandbox into an
-               EMPTY live database, once, at launch; "app promote" pushes only
-               schema, rules and gates up afterwards, leaving live's rows alone.
-               Each prints its plan and writes nothing without --yes, so the
-               bare command is the dry run. Clerk config, triggers, allowlists,
-               secrets and API keys never travel; identity rows stay behind
-               unless --include-identity.
-               "app rename <name>" changes only the display name humans read;
-               the app id is permanent (tenants, URLs and keys embed it), so a
-               rename never re-provisions anything or invalidates a credential.
-               "app owners add <email>" grants a signed-up odla member the SAME
-               full access as you; they then run their own "provision" to mint
-               their own credentials for the shared db (the live one included)
-               \u2014 no secret is ever copied between people.
-  capabilities Show what the CLI automates vs agent edits and human checkpoints.
-  code         Enroll this Mac/Linux host for the current Studio-connected repository and run Pi.
-  admin        Manage platform-funded AI routing/credentials/usage with narrow device grants.
-  security     Connect GitHub sources and run commit-pinned hosted reviews, or scan a local snapshot.
-  pm           Project management (via @odla-ai/pm) shared across the apps you
-               co-own: conformance goals, kanban tasks, decisions, and bugs. With
-               no --app, "list" spans every co-owned project (the cross-project
-               view); with --app it scopes to one. Same device-grant auth as
-               "app". Entities: goal (alias conformance), task (alias kanban),
-               decision, bug. Status changes and comments post to each item's
-               @odla-ai/chat discussion thread.
-  discuss      Group discussions (via @odla-ai/chat) for the apps you co-own:
-               one group per project, topics with replies, @-mentions of people,
-               agents, PM items, and projects. Built for unattended use \u2014 post a
-               question, then "watch" it until someone answers. "watch" exits 75
-               (not 1) when it times out with nothing new, so a script can tell
-               "no answer yet" from a failure and just rerun. Use "who" to look
-               up the exact @[Label](kind/id) markup for a mention.
-  o11y         Read one stable status envelope for application RED, current
-               live-sync load/freshness, the protected commit-to-visible
-               canary, collector ingest/scheduler trust, Cloudflare-owned
-               runtime metrics, and a machine verdict.
-               --json keeps auth progress on stderr for unattended agents.
-  platform     Read canonical fleet health, releases, provider load/freshness,
-               explicit unknowns, and next actions through a read-only grant.
-  provision    Register services, compose integrations, persist credentials, optionally push secrets.
-  smoke        Verify credentials, public-config, composed schema, db aggregate, and integration probes.
-  skill        Same installer; --agent accepts all, claude, codex, cursor,
-               copilot, gemini, or agents (repeatable or comma-separated).
-  secrets      Push configured db/o11y secrets into the Worker via wrangler
-               stdin; set stores a tenant-vault secret and set-clerk-key the
-               reserved Clerk secret key, write-only from stdin or an env var.
-  version      Print the CLI version.
-
-Safety:
-  Every app has two databases on odla.ai: a sandbox (env "dev", tenant
-  <appId>--dev) and a live one (env "prod", tenant <appId>). Both are served by
-  production odla.ai \u2014 there is no separate odla to point at. New projects get
-  the sandbox only. Add "prod" explicitly to odla.config.mjs and pass --yes to
-  provision the live database; use --dry-run first to inspect the resolved plan.
-  Provision caches the approved developer token and service credentials under
-  .odla/ with mode 0600, and init adds those paths to .gitignore. Secret push
-  preflights Wrangler before any shown-once issuance or destructive rotation.
-  Projectless PM, Discussions, o11y, runbook, and identity commands use
-  --platform/--app/--env, ODLA_PLATFORM_URL/ODLA_APP_ID/ODLA_ENV, and
-  ODLA_DEV_TOKEN. Save non-secret scope metadata with "context save", then
-  select it explicitly with --context or ODLA_CONTEXT. Each named context gets
-  isolated developer and scoped-token caches. Override their locations with
-  ODLA_DEV_TOKEN_FILE and ODLA_ADMIN_TOKEN_FILE; ODLA_CONTEXT_FILE relocates
-  the metadata file. Flags and specific ODLA_* scope variables beat a selected
-  context, which beats project config. There is no ambient current context.
-  "context show" reports only provenance and cache state and never authenticates.
-  Provision opens the approval page in your browser automatically whenever the
-  machine can show one, including agent-driven runs; only CI, SSH, and
-  display-less hosts skip it. Use --open to force or --no-open to suppress.
-  Browser launch is best-effort: the printed approval URL is authoritative and
-  agents must relay it to the human verbatim. A started handshake is persisted
-  under .odla/, so a command killed mid-wait loses nothing \u2014 rerunning resumes
-  the same code. Outside an interactive terminal the wait is capped (90s by
-  default, --wait <seconds> to change); a still-pending handshake then exits
-  with code 75: relay the URL, wait for approval, and re-run to collect.
-  A fresh device handshake requires --email <odla-account> or ODLA_USER_EMAIL.
-  The email is a non-secret identity hint: never provide a password or session
-  token. The matching account must already exist, be signed in, explicitly
-  review the exact code, and finish any current request before claiming another.
-  Run Code from a GitHub checkout already connected to an app in Studio; an
-  odla.config.mjs may select the app explicitly but is not required. Code host
-  approval and credential hashes live in odla-ai/db. The host
-  credential is never written under .odla/; it exists only in the foreground
-  "code connect" process and is rotated by the next approved connection.
-  Calendar setup has a second human checkpoint: odla issues a state-bound Google consent URL;
-  OAuth codes and refresh tokens never enter the CLI, repo, chat, or app.
-  GitHub security uses source-read-only access plus optional metadata-only Checks write: the CLI never asks
-  for a PAT or provider key. GitHub read access is separate from the explicit
-  --ack-redacted-source consent and the exact --plan-digest printed by security
-  plan are required before bounded snippets reach System AI.
-  Run security plan first to inspect the admin-selected providers, models,
-  per-route bounds, credential readiness, retention, no-execution boundary,
-  and digest that binds consent to that exact plan.
-`);
-}
-
-// src/code-local-source.ts
-import { execFile as execFile3 } from "child_process";
-import { createHash as createHash4 } from "crypto";
-var SOURCE_LIMITS2 = { maxFiles: 2e4, maxBytes: 512 * 1024 * 1024 };
-async function prepareCodeLocalSource(cwd, repository, readHead = readGitHead) {
-  const headCommitSha = await readHead(cwd);
-  const staged = await stageWorkspace(cwd, { ...SOURCE_LIMITS2, gitTrackedAndUnignored: true });
-  let trusted;
-  try {
-    trusted = await materializeGitTree(cwd, headCommitSha, SOURCE_LIMITS2);
-    const comparison = await stageWorkspacePair(trusted.sourceDir, staged.baselineDir, SOURCE_LIMITS2);
-    let developerPatch;
-    try {
-      developerPatch = await comparison.patch(4 * 1024 * 1024);
-    } finally {
-      await comparison.cleanup();
-    }
-    const descriptor2 = {
-      kind: "local_checkout",
-      repository,
-      headCommitSha,
-      trustedBaseDigest: await digestStagedWorkspace(trusted.sourceDir, SOURCE_LIMITS2),
-      developerPatchDigest: digestText(developerPatch),
-      snapshotDigest: await digestStagedWorkspace(staged.baselineDir, SOURCE_LIMITS2),
-      modified: developerPatch.length > 0,
-      fileCount: staged.fileCount,
-      byteCount: staged.byteCount,
-      capturedAt: Date.now()
-    };
-    return {
-      descriptor: descriptor2,
-      trustedBaseDir: trusted.sourceDir,
-      sourceDir: staged.baselineDir,
-      cleanup: async () => {
-        await Promise.all([staged.cleanup(), trusted.cleanup()]);
-      }
-    };
-  } catch (error) {
-    await Promise.all([staged.cleanup(), trusted?.cleanup()]);
-    throw error;
-  }
-}
-async function readGitHead(cwd) {
-  const value2 = await new Promise((accept, reject) => {
-    execFile3("git", ["rev-parse", "HEAD"], { cwd, encoding: "utf8", maxBuffer: 16384 }, (error, stdout) => {
-      if (error) reject(new Error("code connect requires a Git checkout with an initial commit"));
-      else accept(stdout.trim());
-    });
-  });
-  if (!/^[0-9a-f]{40}$/.test(value2)) throw new Error("code connect could not resolve the checkout HEAD commit");
-  return value2;
-}
-function digestText(value2) {
-  return `sha256:${createHash4("sha256").update(value2).digest("hex")}`;
-}
+// src/code-local-source.ts
+import { execFile as execFile3 } from "child_process";
+import { createHash as createHash4 } from "crypto";
+var SOURCE_LIMITS2 = { maxFiles: 2e4, maxBytes: 512 * 1024 * 1024 };
+async function prepareCodeLocalSource(cwd, repository, readHead = readGitHead) {
+  const headCommitSha = await readHead(cwd);
+  const staged = await stageWorkspace(cwd, { ...SOURCE_LIMITS2, gitTrackedAndUnignored: true });
+  let trusted;
+  try {
+    trusted = await materializeGitTree(cwd, headCommitSha, SOURCE_LIMITS2);
+    const comparison = await stageWorkspacePair(trusted.sourceDir, staged.baselineDir, SOURCE_LIMITS2);
+    let developerPatch;
+    try {
+      developerPatch = await comparison.patch(4 * 1024 * 1024);
+    } finally {
+      await comparison.cleanup();
+    }
+    const descriptor2 = {
+      kind: "local_checkout",
+      repository,
+      headCommitSha,
+      trustedBaseDigest: await digestStagedWorkspace(trusted.sourceDir, SOURCE_LIMITS2),
+      developerPatchDigest: digestText(developerPatch),
+      snapshotDigest: await digestStagedWorkspace(staged.baselineDir, SOURCE_LIMITS2),
+      modified: developerPatch.length > 0,
+      fileCount: staged.fileCount,
+      byteCount: staged.byteCount,
+      capturedAt: Date.now()
+    };
+    return {
+      descriptor: descriptor2,
+      trustedBaseDir: trusted.sourceDir,
+      sourceDir: staged.baselineDir,
+      cleanup: async () => {
+        await Promise.all([staged.cleanup(), trusted.cleanup()]);
+      }
+    };
+  } catch (error) {
+    await Promise.all([staged.cleanup(), trusted?.cleanup()]);
+    throw error;
+  }
+}
+async function readGitHead(cwd) {
+  const value2 = await new Promise((accept, reject) => {
+    execFile3("git", ["rev-parse", "HEAD"], { cwd, encoding: "utf8", maxBuffer: 16384 }, (error, stdout) => {
+      if (error) reject(new Error("code connect requires a Git checkout with an initial commit"));
+      else accept(stdout.trim());
+    });
+  });
+  if (!/^[0-9a-f]{40}$/.test(value2)) throw new Error("code connect could not resolve the checkout HEAD commit");
+  return value2;
+}
+function digestText(value2) {
+  return `sha256:${createHash4("sha256").update(value2).digest("hex")}`;
+}
 
 // src/code-connect.ts
 async function codeConnect(options) {
@@ -6448,16 +6729,16 @@ function parseConnection(value2, appId, appEnv) {
   }
   return root;
 }
-function apiFailure(action, status, value2) {
+function apiFailure(action2, status, value2) {
   const message2 = record4(record4(value2)?.error)?.message;
-  return `${action} failed (${status})${typeof message2 === "string" ? `: ${message2}` : ""}`;
+  return `${action2} failed (${status})${typeof message2 === "string" ? `: ${message2}` : ""}`;
 }
 function record4(value2) {
   return value2 && typeof value2 === "object" && !Array.isArray(value2) ? value2 : null;
 }
 
 // src/provision.ts
-import { createAppsClient, orderAppServices, tenantIdFor as tenantIdFor4 } from "@odla-ai/apps";
+import { createAppsClient as createAppsClient2, orderAppServices as orderAppServices3, tenantIdFor as tenantIdFor4 } from "@odla-ai/apps";
 import { putSecret as putSecret2 } from "@odla-ai/ai";
 import process8 from "process";
 
@@ -6467,7 +6748,7 @@ async function provisionIntegrationSeeds(doFetch, endpoint, tenantId, dbKey, int
   const base = `${endpoint}/app/${encodeURIComponent(tenantId)}`;
   for (const integration of integrations) {
     for (const seed of integration.seeds ?? []) {
-      const payload = await postJson2(doFetch, `${base}/query`, dbKey, {
+      const payload = await postJson3(doFetch, `${base}/query`, dbKey, {
         query: { [seed.ns]: { $: { where: { [seed.key.attr]: seed.key.value }, limit: 1 } } }
       });
       const rows = isRecord7(payload) && isRecord7(payload.result) ? payload.result[seed.ns] : void 0;
@@ -6478,7 +6759,7 @@ async function provisionIntegrationSeeds(doFetch, endpoint, tenantId, dbKey, int
         out.log(`${env}: integration ${integration.id} seed ${seed.id} already exists`);
         continue;
       }
-      await postJson2(doFetch, `${base}/transact`, dbKey, {
+      await postJson3(doFetch, `${base}/transact`, dbKey, {
         mutationId: `integration:${integration.id}:seed:${seed.id}`,
         ops: [{
           t: "update",
@@ -6493,7 +6774,7 @@ async function provisionIntegrationSeeds(doFetch, endpoint, tenantId, dbKey, int
     }
   }
 }
-async function postJson2(doFetch, url, bearer, body) {
+async function postJson3(doFetch, url, bearer, body) {
   const res = await doFetch(url, {
     method: "POST",
     headers: { authorization: `Bearer ${bearer}`, "content-type": "application/json" },
@@ -6514,9 +6795,9 @@ async function responseText(res) {
 }
 
 // src/provision-credentials.ts
-import { tenantIdFor as tenantIdFor2 } from "@odla-ai/apps";
+import { tenantIdFor as tenantIdFor3 } from "@odla-ai/apps";
 async function provisionEnvCredentials(opts) {
-  const tenantId = tenantIdFor2(opts.cfg.app.id, opts.env);
+  const tenantId = tenantIdFor3(opts.cfg.app.id, opts.env);
   const prior = opts.credentials?.envs[opts.env];
   let credentials = opts.credentials;
   let dbKey = opts.cfg.services.includes("db") && !opts.rotateDb ? prior?.dbKey : void 0;
@@ -6572,14 +6853,14 @@ async function mintDbKey(opts, tenantId) {
         appId: tenantId
       })
     });
-    if (!created.ok) throw new Error(`db app create (${tenantId}) failed: ${created.status} ${await safeText4(created)}`);
+    if (!created.ok) throw new Error(`db app create (${tenantId}) failed: ${created.status} ${await safeText5(created)}`);
     res = await opts.fetch(`${opts.cfg.dbEndpoint}/admin/apps/${encodeURIComponent(tenantId)}/keys`, {
       method: "POST",
       headers,
       body: "{}"
     });
   }
-  if (!res.ok) throw new Error(`db key mint (${tenantId}) failed: ${res.status} ${await safeText4(res)}`);
+  if (!res.ok) throw new Error(`db key mint (${tenantId}) failed: ${res.status} ${await safeText5(res)}`);
   const body = await res.json();
   if (!body.key) throw new Error(`db key mint (${tenantId}) returned no key`);
   return body.key;
@@ -6595,58 +6876,11 @@ async function issueO11yToken(opts) {
       `o11y token already exists for env "${opts.env}", but its shown-once value is not in the local credentials file; run "odla-ai provision --rotate-o11y-token --push-secrets" to replace it explicitly`
     );
   }
-  if (!res.ok) throw new Error(`o11y token ${opts.rotateO11y ? "rotation" : "issue"} (${opts.env}) failed: ${res.status} ${await safeText4(res)}`);
+  if (!res.ok) throw new Error(`o11y token ${opts.rotateO11y ? "rotation" : "issue"} (${opts.env}) failed: ${res.status} ${await safeText5(res)}`);
   const body = await res.json();
   if (!body.token) throw new Error(`o11y token ${opts.rotateO11y ? "rotation" : "issue"} (${opts.env}) returned no token`);
   return body.token;
 }
-async function safeText4(res) {
-  try {
-    return redactSecrets((await res.text()).slice(0, 500));
-  } catch {
-    return "";
-  }
-}
-
-// src/provision-helpers.ts
-import { DEFAULT_SECRET_NAMES } from "@odla-ai/ai";
-import { tenantIdFor as tenantIdFor3 } from "@odla-ai/apps";
-function defaultSecretName(provider) {
-  const names = DEFAULT_SECRET_NAMES;
-  return names[provider] ?? `${provider}_api_key`;
-}
-async function assertTenantAdminAccess(doFetch, cfg, env, token) {
-  const tenantId = tenantIdFor3(cfg.app.id, env);
-  const res = await doFetch(`${cfg.dbEndpoint}/admin/apps/${encodeURIComponent(tenantId)}/entitlements`, {
-    headers: { authorization: `Bearer ${token}` }
-  });
-  if (res.ok || res.status === 404) return;
-  if (res.status === 403) {
-    throw new Error(
-      `${env}: you are not an owner of "${cfg.app.id}" (tenant ${tenantId}) \u2014 nothing was minted or written; ask an existing owner to run "odla-ai app owners add <your-email>", then re-run provision`
-    );
-  }
-  throw new Error(`${env}: tenant access preflight (${tenantId}) failed: ${res.status} ${await safeText5(res)}`);
-}
-async function postJson3(doFetch, url, bearer, body) {
-  const res = await doFetch(url, {
-    method: "POST",
-    headers: { authorization: `Bearer ${bearer}`, "content-type": "application/json" },
-    body: JSON.stringify(body)
-  });
-  if (!res.ok) throw new Error(`${new URL(url).pathname} failed: ${res.status} ${await safeText5(res)}`);
-}
-function normalizeClerkConfig(value2) {
-  if (!value2) return null;
-  if (typeof value2 === "string") {
-    const publishableKey2 = envValue(value2);
-    return publishableKey2 ? { publishableKey: publishableKey2 } : null;
-  }
-  if (typeof value2 !== "object") return null;
-  const cfg = value2;
-  const publishableKey = envValue(cfg.publishableKey);
-  return publishableKey ? { publishableKey, ...cfg.audience ? { audience: cfg.audience } : {}, ...cfg.mode ? { mode: cfg.mode } : {} } : null;
-}
 async function safeText5(res) {
   try {
     return redactSecrets((await res.text()).slice(0, 500));
@@ -6725,7 +6959,7 @@ async function provision(options) {
   }
   const doFetch = options.fetch ?? fetch;
   const token = await getDeveloperToken(cfg, options, doFetch, out);
-  const apps = createAppsClient({ endpoint: cfg.platformUrl, token, fetcher: { fetch: doFetch } });
+  const apps = createAppsClient2({ endpoint: cfg.platformUrl, token, fetcher: { fetch: doFetch } });
   const existing = await apps.resolveApp(cfg.app.id);
   if (existing) {
     out.log(`app: ${cfg.app.id} already exists`);
@@ -6736,7 +6970,7 @@ async function provision(options) {
   for (const env of cfg.envs) {
     await assertTenantAdminAccess(doFetch, cfg, env, token);
   }
-  const serviceOrder = orderAppServices(cfg.services);
+  const serviceOrder = orderAppServices3(cfg.services);
   for (const env of cfg.envs) {
     for (const service of serviceOrder) {
       if (service === "ai") {
@@ -6802,11 +7036,11 @@ ${env}: credentials are already saved; retry "odla-ai secrets push --env ${env}$
       }
     }
     if (schema && dbKey) {
-      await postJson3(doFetch, `${cfg.dbEndpoint}/app/${encodeURIComponent(tenantId)}/schema`, dbKey, { schema });
+      await postJson(doFetch, `${cfg.dbEndpoint}/app/${encodeURIComponent(tenantId)}/schema`, dbKey, { schema });
       out.log(`${env}: schema pushed`);
     }
     if (rules) {
-      await postJson3(doFetch, `${cfg.dbEndpoint}/app/${encodeURIComponent(tenantId)}/admin/rules`, token, rules);
+      await postJson(doFetch, `${cfg.dbEndpoint}/app/${encodeURIComponent(tenantId)}/admin/rules`, token, rules);
       out.log(`${env}: rules pushed (${Object.keys(rules).length} namespaces)`);
     }
     if (dbKey) {
@@ -6899,6 +7133,7 @@ var COMMAND_SURFACE = {
   calendar: { status: {}, calendars: {}, connect: {}, disconnect: {} },
   capabilities: {},
   code: { connect: {} },
+  config: { diff: {}, plan: {} },
   context: { show: {}, list: {}, save: {}, remove: {} },
   // `watch`, `read`, `reply`, and `resolve` take a topic id from there on.
   discuss: {
@@ -7353,17 +7588,17 @@ function addOption(options, name, value2) {
 
 // src/operator-context.ts
 import { existsSync as existsSync10 } from "fs";
-import { join as join10, resolve as resolve11 } from "path";
+import { join as join11, resolve as resolve11 } from "path";
 import process10 from "process";
 
 // src/operator-profiles.ts
 import { existsSync as existsSync9, readFileSync as readFileSync7 } from "fs";
 import { homedir as homedir2 } from "os";
-import { dirname as dirname7, join as join9, resolve as resolve10 } from "path";
+import { dirname as dirname7, join as join10, resolve as resolve10 } from "path";
 import process9 from "process";
 function operatorProfileFile() {
   return resolve10(
-    clean(process9.env.ODLA_CONTEXT_FILE) ?? join9(homedir2(), ".odla", "contexts.json")
+    clean(process9.env.ODLA_CONTEXT_FILE) ?? join10(homedir2(), ".odla", "contexts.json")
   );
 }
 function resolveOperatorProfile(parsed) {
@@ -7408,10 +7643,10 @@ function removeOperatorProfile(name, file = operatorProfileFile()) {
   return true;
 }
 function operatorCredentialFiles(selection) {
-  const base = selection.name ? join9(dirname7(selection.file), "profiles", selection.name) : join9(homedir2(), ".odla");
+  const base = selection.name ? join10(dirname7(selection.file), "profiles", selection.name) : join10(homedir2(), ".odla");
   return {
-    developer: join9(base, "dev-token.json"),
-    scoped: join9(base, "admin-token.local.json")
+    developer: join10(base, "dev-token.json"),
+    scoped: join10(base, "admin-token.local.json")
   };
 }
 function assertOperatorName(value2, label) {
@@ -7522,7 +7757,7 @@ async function resolveOperatorContext(parsed, options = {}) {
   const rootDir = loaded?.rootDir ?? process10.cwd();
   const profileCredentials = operatorCredentialFiles(profile);
   const tokenFile = clean2(process10.env.ODLA_DEV_TOKEN_FILE) ? resolve11(process10.env.ODLA_DEV_TOKEN_FILE) : profile.name ? profileCredentials.developer : loaded?.local.tokenFile ?? profileCredentials.developer;
-  const scopedTokenFile = clean2(process10.env.ODLA_ADMIN_TOKEN_FILE) ? resolve11(process10.env.ODLA_ADMIN_TOKEN_FILE) : profile.name ? profileCredentials.scoped : loaded ? join10(loaded.rootDir, ".odla", "admin-token.local.json") : profileCredentials.scoped;
+  const scopedTokenFile = clean2(process10.env.ODLA_ADMIN_TOKEN_FILE) ? resolve11(process10.env.ODLA_ADMIN_TOKEN_FILE) : profile.name ? profileCredentials.scoped : loaded ? join11(loaded.rootDir, ".odla", "admin-token.local.json") : profileCredentials.scoped;
   const cfg = loaded ? {
     ...loaded,
     platformUrl: platformValue,
@@ -7544,8 +7779,8 @@ async function resolveOperatorContext(parsed, options = {}) {
     services: [],
     local: {
       tokenFile,
-      credentialsFile: join10(rootDir, ".odla", "credentials.local.json"),
-      devVarsFile: join10(rootDir, ".dev.vars"),
+      credentialsFile: join11(rootDir, ".odla", "credentials.local.json"),
+      devVarsFile: join11(rootDir, ".dev.vars"),
       gitignore: true
     }
   };
@@ -7596,21 +7831,21 @@ var SET_OPTIONS = [
 ];
 async function adminCommand(parsed, deps = {}) {
   const area = parsed.positionals[1];
-  const action = parsed.positionals[2];
-  const credentialSet = action === "credential" && parsed.positionals[3] === "set";
-  const credentials = action === "credentials";
-  const models = action === "models";
-  const usage = action === "usage";
-  const audit = action === "audit";
-  if (area !== "ai" || action !== "show" && action !== "set" && !credentialSet && !credentials && !models && !usage && !audit) {
+  const action2 = parsed.positionals[2];
+  const credentialSet = action2 === "credential" && parsed.positionals[3] === "set";
+  const credentials = action2 === "credentials";
+  const models = action2 === "models";
+  const usage = action2 === "usage";
+  const audit = action2 === "audit";
+  if (area !== "ai" || action2 !== "show" && action2 !== "set" && !credentialSet && !credentials && !models && !usage && !audit) {
     throw new Error('unknown admin command. Try "odla-ai admin ai show".');
   }
-  const allowed = credentialSet ? [...CONTEXT_OPTIONS, "from-env", "stdin"] : action === "set" ? SET_OPTIONS : models ? [...JSON_OPTIONS, "provider"] : usage ? [...JSON_OPTIONS, "app-id", "env", "run-id", "limit"] : audit ? [...JSON_OPTIONS, "limit"] : JSON_OPTIONS;
-  assertArgs(parsed, allowed, credentialSet ? 5 : action === "set" ? 4 : 3);
+  const allowed = credentialSet ? [...CONTEXT_OPTIONS, "from-env", "stdin"] : action2 === "set" ? SET_OPTIONS : models ? [...JSON_OPTIONS, "provider"] : usage ? [...JSON_OPTIONS, "app-id", "env", "run-id", "limit"] : audit ? [...JSON_OPTIONS, "limit"] : JSON_OPTIONS;
+  assertArgs(parsed, allowed, credentialSet ? 5 : action2 === "set" ? 4 : 3);
   const context = await resolveOperatorContext(parsed, { allowMissingConfig: true });
   await adminAi({
-    action: credentialSet ? "credential-set" : credentials ? "credentials" : models ? "models" : usage ? "usage" : audit ? "audit" : action,
-    purpose: action === "set" ? parsed.positionals[3] : void 0,
+    action: credentialSet ? "credential-set" : credentials ? "credentials" : models ? "models" : usage ? "usage" : audit ? "audit" : action2,
+    purpose: action2 === "set" ? parsed.positionals[3] : void 0,
     provider: stringOpt(parsed.options.provider),
     model: stringOpt(parsed.options.model),
     enabled: boolOpt(parsed.options.enabled),
@@ -7667,12 +7902,12 @@ function bothTenants(cfg) {
 
 // src/agent-command.ts
 async function agentCommand(parsed, deps = {}) {
-  const action = parsed.positionals[1];
-  if (action !== "jobs" && action !== "retry") {
-    throw new Error(`unknown agent action "${action ?? ""}". Try "odla-ai agent jobs --json".`);
+  const action2 = parsed.positionals[1];
+  if (action2 !== "jobs" && action2 !== "retry") {
+    throw new Error(`unknown agent action "${action2 ?? ""}". Try "odla-ai agent jobs --json".`);
   }
-  assertArgs(parsed, ["config", "env", "state", "limit", "json", "token", "email"], action === "jobs" ? 2 : 3);
-  if (action === "retry" && (parsed.options.state !== void 0 || parsed.options.limit !== void 0)) {
+  assertArgs(parsed, ["config", "env", "state", "limit", "json", "token", "email"], action2 === "jobs" ? 2 : 3);
+  if (action2 === "retry" && (parsed.options.state !== void 0 || parsed.options.limit !== void 0)) {
     throw new Error('--state and --limit are supported only by "agent jobs"');
   }
   const cfg = await loadProjectConfig(stringOpt(parsed.options.config) ?? "odla.config.mjs");
@@ -7692,7 +7927,7 @@ async function agentCommand(parsed, deps = {}) {
   );
   const base = `${cfg.dbEndpoint}/app/${encodeURIComponent(tenant)}/admin/agent-jobs`;
   const headers = { authorization: `Bearer ${credential2}` };
-  if (action === "retry") {
+  if (action2 === "retry") {
     const id = parsed.positionals[2];
     const res2 = await doFetch(`${base}/${encodeURIComponent(id)}/retry`, { method: "POST", headers });
     const body2 = await readJson(res2);
@@ -8025,7 +8260,7 @@ function describe(side) {
   const identity = side.identityRows > 0 ? `, ${side.identityRows} identity row(s)` : "";
   return `${ns} \xB7 ${side.triples} value(s) \xB7 tx ${side.maxTx}${identity}`;
 }
-function printPlan(out, verb, pre, opts) {
+function printPlan2(out, verb, pre, opts) {
   const arrow = verb === "refresh-sandbox" ? "live \u2192 sandbox" : "sandbox \u2192 live";
   out.log(`${verb} (${arrow})`);
   out.log(`  from  ${pre.source.tenant}  ${describe(pre.source)}`);
@@ -8065,7 +8300,7 @@ async function appTransfer(options) {
     throw new Error(`pre-flight failed${pre.body.error?.code ? ` (${pre.body.error.code})` : ""}: ${pre.body.error?.message ?? pre.status}`);
   }
   const plan = pre.body;
-  printPlan({ log: say }, options.verb, plan, options);
+  printPlan2({ log: say }, options.verb, plan, options);
   if (options.verb === "go-live" && !plan.targetEmpty) {
     throw new Error(
       `${route2.target} already has data \u2014 go-live has already happened. Use \`odla-ai app promote --yes\` to push schema and rules, or \`odla-ai app refresh-sandbox --yes\` to pull live back down.`
@@ -8133,7 +8368,7 @@ async function copyFiles(cfg, token, route2, doFetch, out) {
 }
 
 // src/app-lifecycle.ts
-async function lifecycleCall(action, options) {
+async function lifecycleCall(action2, options) {
   const cfg = await loadProjectConfig(options.configPath);
   const out = options.stdout ?? console;
   const doFetch = options.fetch ?? fetch;
@@ -8143,13 +8378,13 @@ async function lifecycleCall(action, options) {
     doFetch,
     out
   );
-  const res = await doFetch(`${cfg.platformUrl}/registry/apps/${encodeURIComponent(cfg.app.id)}/${action}`, {
+  const res = await doFetch(`${cfg.platformUrl}/registry/apps/${encodeURIComponent(cfg.app.id)}/${action2}`, {
     method: "POST",
     headers: { authorization: `Bearer ${token}`, "content-type": "application/json" }
   });
   const body = await res.json().catch(() => ({}));
   if (!res.ok || !body.ok) {
-    throw new Error(`${action} failed${body.error?.code ? ` (${body.error.code})` : ""}: ${body.error?.message ?? `registry returned ${res.status}`}`);
+    throw new Error(`${action2} failed${body.error?.code ? ` (${body.error.code})` : ""}: ${body.error?.message ?? `registry returned ${res.status}`}`);
   }
   return body;
 }
@@ -8322,6 +8557,26 @@ async function secretsCommand(parsed, deps) {
   });
 }
 async function projectCommand(command, parsed, deps) {
+  if (command === "config") {
+    const sub = parsed.positionals[1];
+    if (sub !== "diff" && sub !== "plan") {
+      throw new Error(`unknown config subcommand "${sub ?? ""}". Try "odla-ai config diff --json".`);
+    }
+    assertArgs(parsed, ["config", "token", "email", "open", "json"], 2);
+    const options = {
+      configPath: stringOpt(parsed.options.config) ?? "odla.config.mjs",
+      token: stringOpt(parsed.options.token),
+      email: stringOpt(parsed.options.email),
+      open: parsed.options.open === false ? false : parsed.options.open === true ? true : void 0,
+      json: parsed.options.json === true,
+      fetch: deps.fetch,
+      openApprovalUrl: deps.openUrl,
+      stdout: deps.stdout
+    };
+    if (sub === "diff") await configDiff(options);
+    else await configPlan(options);
+    return true;
+  }
   if (command === "init") {
     assertArgs(parsed, ["app-id", "name", "config", "env", "services", "ai-provider", "force"], 1);
     initProject({
@@ -8456,9 +8711,9 @@ async function contextCommand(parsed, deps = {}) {
     ],
     3
   );
-  const action = parsed.positionals[1];
+  const action2 = parsed.positionals[1];
   const out = deps.stdout ?? console;
-  if (action === "list") {
+  if (action2 === "list") {
     const profiles = listOperatorProfiles();
     if (parsed.options.json === true) {
       out.log(JSON.stringify({ schemaVersion: 1, profiles }, null, 2));
@@ -8476,7 +8731,7 @@ async function contextCommand(parsed, deps = {}) {
     }
     return;
   }
-  if (action === "save") {
+  if (action2 === "save") {
     if (parsed.options.token !== void 0) {
       throw new Error(
         "context save does not accept --token; contexts store scope metadata only"
@@ -8499,7 +8754,7 @@ async function contextCommand(parsed, deps = {}) {
     }
     return;
   }
-  if (action === "remove") {
+  if (action2 === "remove") {
     const name = requireName(parsed);
     if (parsed.options.yes !== true) {
       throw new Error(`context remove "${name}" requires --yes`);
@@ -8519,9 +8774,9 @@ async function contextCommand(parsed, deps = {}) {
     }
     return;
   }
-  if (action !== "show") {
+  if (action2 !== "show") {
     throw new Error(
-      `unknown context action "${action ?? ""}". Try show|list|save|remove.`
+      `unknown context action "${action2 ?? ""}". Try show|list|save|remove.`
     );
   }
   const context = await resolveOperatorContext(parsed, {
@@ -8572,6 +8827,261 @@ function requireName(parsed) {
   return name;
 }
 
+// src/help.ts
+function printHelp(output = console) {
+  output.log(`odla-ai
+
+Start here:
+  odla-ai runbook ask "<question>"   The current procedure, from odla's own
+                                     runbooks. Ask BEFORE searching the web or
+                                     working from memory: runbooks are edited
+                                     live, so your training data is out of date
+                                     and this is not.
+  odla-ai runbook impact             After a change: which runbooks describe the
+                                     code you just touched, so you can fix any
+                                     step it made wrong.
+
+Usage:
+  odla-ai setup [--dir <project>] [--agent <name>] [--global] [--force]
+  odla-ai init --app-id <id> --name <name> [--services db,ai,o11y,calendar] [--env dev --env prod]
+  odla-ai doctor [--config odla.config.mjs]
+  odla-ai config diff [--config odla.config.mjs] [--email <odla-account>] [--json]
+  odla-ai config plan [--config odla.config.mjs] [--email <odla-account>] [--json]
+  odla-ai calendar status [--env dev] [--email <odla-account>] [--json]
+  odla-ai calendar calendars [--env dev] [--email <odla-account>] [--json]
+  odla-ai calendar connect [--env dev] [--email <odla-account>] [--no-open] [--yes]
+  odla-ai calendar disconnect [--env dev] [--email <odla-account>] --yes
+  odla-ai app archive [--config odla.config.mjs] [--email <odla-account>] [--json] --yes
+  odla-ai app restore [--config odla.config.mjs] [--email <odla-account>] [--json]
+  odla-ai app export [--env dev] [--fresh] [--out <file>] [--email <odla-account>] [--json]
+  odla-ai app import <file|-> [--env dev] [--ns <namespace>] [--id-field <f>|--key <attr>|--generate-ids] [--dry-run] [--json] --yes
+  odla-ai app refresh-sandbox [--include-identity] [--include-files] [--dry-run] [--json] --yes
+  odla-ai app go-live         [--include-identity] [--include-files] [--dry-run] [--json] --yes
+  odla-ai app promote         [--dry-run] [--json] --yes
+  odla-ai app rename <name> [--config odla.config.mjs] [--email <odla-account>] [--json]
+  odla-ai app owners list [--config odla.config.mjs] [--email <odla-account>] [--json]
+  odla-ai app owners add <email> [--email <odla-account>] [--json]
+  odla-ai app owners remove <email> [--email <odla-account>] [--json]
+  odla-ai pm goal list [--app <id>] [--status <s>] [--q <text>] [--limit <n>] [--offset <n>] [--json]
+  odla-ai pm task list [--app <id>] [--column <c>] [--goal <id>] [--assignee <id>] [--q <text>] [--limit <n>] [--offset <n>] [--json]
+  odla-ai pm decision list [--app <id>] [--status <s>] [--q <text>] [--limit <n>] [--offset <n>] [--json]
+  odla-ai pm bug list [--app <id>] [--status <s>] [--severity <s>] [--goal <id>] [--assignee <id>] [--decision <id>] [--q <text>] [--limit <n>] [--offset <n>] [--json]
+  odla-ai pm goal add --app <id> --title <t> [--status <s>] [--proof <text>] [--target <pct>] [--mutation-id <id>] [--json]
+  odla-ai pm task add --app <id> --title <t> [--column <c>] [--goal <id>] [--assignee <id>] [--description <text>|--body <text>] [--due <epoch-ms>] [--mutation-id <id>] [--json]
+  odla-ai pm decision add --app <id> --title <t> --body <text> [--status <s>] [--mutation-id <id>] [--json]
+  odla-ai pm bug add --app <id> --title <t> (--description <text>|--body <text>) [--status <s>] [--severity <s>] [--goal <id>] [--assignee <id>] [--decision <id>] [--mutation-id <id>] [--json]
+  odla-ai pm <goal|task|decision|bug> get <id> [--json]
+  odla-ai pm goal set <id> [--title <t>|--status <s>|--proof <text>|--no-proof|--target <pct>|--no-target] [--mutation-id <id>] [--json]
+  odla-ai pm task set <id> [--title <t>|--column <c>|--rank <n>|--goal <id>|--no-goal|--assignee <id>|--no-assignee|--description <text>|--body <text>|--due <epoch-ms>|--no-due] [--mutation-id <id>] [--json]
+  odla-ai pm decision set <id> [--title <t>|--status <s>|--body <text>] [--mutation-id <id>] [--json]
+  odla-ai pm bug set <id> [--title <t>|--status <s>|--severity <s>|--goal <id>|--no-goal|--assignee <id>|--no-assignee|--decision <id>|--no-decision|--description <text>|--body <text>] [--mutation-id <id>] [--json]
+  odla-ai pm <goal|task|decision> done <id> [--mutation-id <id>]
+  odla-ai pm bug done <id> [--decision <accepted-decision-id>] [--mutation-id <id>]
+  odla-ai pm <goal|task|decision|bug> comment <id> --body "..." [--mutation-id <id>]
+  odla-ai pm <goal|task|decision|bug> comments <id> [--json]
+  odla-ai pm <goal|task|decision|bug> rm <id>
+  odla-ai pm handoff --app <id> [--json]
+  odla-ai discuss groups [--json]
+  odla-ai discuss list [--app <id>] [--q <text>] [--state open|resolved|all] [--json]
+  odla-ai discuss read <topic> [--limit <n> --offset <n>] [--json]
+  odla-ai discuss post --app <id> --subject "..." --body "..." [--markup "... @[Label](kind/id)"] [--mutation-id <id>]
+  odla-ai discuss reply <topic> --body "..." [--markup "..."] [--mutation-id <id>]
+  odla-ai discuss resolve <topic> [--reopen] [--mutation-id <id>]
+  odla-ai discuss who --q <text> [--app <id>] [--kinds user,pm:task] [--json]
+  odla-ai discuss watch [<topic>] [--cursor <cursor>] [--by <authorId>] [--self <authorId>] [--interval <s>] [--timeout <s>] [--json|--jsonl]
+  odla-ai agent jobs [--env dev] [--state pending|running|succeeded|dead_letter] [--limit 50] [--email <email>] [--json]
+  odla-ai agent retry <job-id> [--env dev] [--email <email>] [--json]
+  odla-ai context show [--context <name>] [--platform https://odla.ai] [--app <id>] [--env prod] [--json]
+  odla-ai context list [--json]
+  odla-ai context save <name> [--platform <url>] [--app <id>] [--env <name>] [--json]
+  odla-ai context remove <name> --yes [--json]
+  odla-ai o11y status [--app <id>] [--context <name>] [--platform https://odla.ai] [--env prod] [--minutes 60] [--json]
+  odla-ai platform status [--context <name>] [--platform https://odla.ai] [--email <odla-account>] [--json]
+  odla-ai whoami [--context <name>] [--platform https://odla.ai] [--json]
+  odla-ai runbook ask "<question>" [--app <id>] [--all] [--json]
+  odla-ai runbook search "<question>" [--app <id>] [--all] [--limit <n>] [--json]
+  odla-ai runbook impact [--base origin/main] [--app <id>] [--all] [--limit <n>] [--json]
+  odla-ai runbook lint [--app <id>] [--all] [--json]
+  odla-ai runbook list [--app <id>] [--all] [--q <text>] [--json]
+  odla-ai runbook comment <slug> --body "..." [--app <id>]
+  odla-ai runbook get <slug> [--app <id>]
+  odla-ai runbook new <slug> --title <t> --file <path|-> [--summary <s>] [--requires <specs>] [--app <id>]
+  odla-ai runbook edit <slug> [--file <path|->|--body "..."] [--note <why>] [--requires <specs>] [--app <id>]
+  odla-ai runbook import <dir> [--visibility operator|admin] [--dry-run] [--app <id>]
+  odla-ai runbook publish <slug> [--app <id>]
+  odla-ai runbook visibility <slug> <operator|admin> [--app <id>]
+  odla-ai runbook archive <slug> [--app <id>]
+  odla-ai runbook history <slug> [--app <id>] [--json]
+  odla-ai runbook revert <slug> --version <n> [--app <id>]
+  odla-ai runbook rm <slug> [--app <id>]
+  odla-ai capabilities [--json]
+  odla-ai code connect [--env dev|prod] [--email <odla-account>] [--engine auto|container|podman|docker] [--slots <1-64>] [--once]
+  odla-ai admin ai show [--context <name>] [--platform https://odla.ai] [--email <odla-account>] [--json]
+  odla-ai admin ai models [--context <name>] [--provider <id>] [--json]
+  odla-ai admin ai set <purpose> [--context <name>] [--provider <id>] [--model <id>] [--enabled|--no-enabled]
+    [--max-input-bytes <n>] [--max-output-tokens <n>] [--max-calls-per-run <n>] [--json]
+  odla-ai admin ai set security [--context <name>] --discovery-provider <id> --discovery-model <id>
+    --validation-provider <id> --validation-model <id> [--enabled|--no-enabled] [--json]
+  odla-ai admin ai credentials [--context <name>] [--json]
+  odla-ai admin ai credential set <provider> [--context <name>] (--from-env <NAME>|--stdin)
+  odla-ai admin ai usage [--context <name>] [--app-id <id>] [--env <env>] [--run-id <id>] [--limit <1-500>] [--json]
+  odla-ai admin ai audit [--context <name>] [--limit <1-200>] [--json]
+  odla-ai security github connect [--repo owner/name] [--env dev] [--email <odla-account>] [--no-open]
+  odla-ai security github disconnect --source <id> [--env dev] [--yes]
+  odla-ai security plan [--env dev] [--json]
+  odla-ai security sources [--env dev] [--json]
+  odla-ai security run --source <id> --plan-digest <sha256:...> --ack-redacted-source [--ref <branch|tag|sha>] [--env dev] [--no-follow]
+  odla-ai security status <job-id> [--follow] [--json]
+  odla-ai security report <job-id> [--json]
+  odla-ai security run [target] --ack-redacted-source [--env dev] [--profile odla] [--fail-on high]
+  odla-ai security run [target] --self --ack-redacted-source
+  odla-ai provision [--config odla.config.mjs] [--email <odla-account>] [--wait <seconds>] [--dry-run] [--push-secrets] [--rotate-o11y-token] [--write-dev-vars[=path]] [--yes]
+  odla-ai smoke [--config odla.config.mjs] [--env dev] [--email <odla-account>] [--no-open]
+  odla-ai skill install [--dir <project>] [--agent <name>] [--global] [--force]
+  odla-ai secrets push --env <env> [--config odla.config.mjs] [--dry-run] [--yes]
+  odla-ai secrets set <name> --env <env> (--from-env <NAME>|--stdin) [--email <odla-account>] [--config odla.config.mjs] [--yes]
+  odla-ai secrets set-clerk-key --env <env> (--from-env <NAME>|--stdin) [--email <odla-account>] [--config odla.config.mjs] [--yes]
+  odla-ai version
+
+Commands:
+  agent        Inspect durable agent wakeups and explicitly requeue a
+               dead-lettered job; JSON output is stable for remote operators.
+  runbook      odla's operational procedures, stored in the database and read at
+               the moment they are followed. "ask" gives a written, cited answer;
+               "search" the passages behind it; "get" the whole document.
+               "impact" diffs your working tree against a base ref and names the
+               runbooks that describe what you changed \u2014 run it after touching a
+               package's exported API or JSDoc, or a Studio surface. "lint"
+               checks the corpus the other way: every odla-ai command the
+               runbooks name is held against this CLI's real command surface,
+               and against the minimum versions each runbook declares. A wrong step
+               is fixed with "edit", which takes effect immediately: a runbook is
+               a row, not a release. Runbooks describe PROCEDURE; what an export
+               does and what it guarantees is JSDoc, rendered per package at
+               https://odla.ai/docs and shipped in the installed .d.ts. Answering
+               a question usually needs both.
+  whoami       Report who this terminal is authenticated as, and whether it holds
+               platform admin. A handshake-minted device token is never admin,
+               however the human who approved it is configured.
+  context      Explain selected config, platform, app, environment, and
+               developer-token provenance without printing credentials or
+               starting a device handshake. Operator work can run outside a
+               project checkout with explicit flags or ODLA_* environment
+               variables.
+  setup        Install offline odla runbooks for common coding-agent harnesses.
+  init         Create a generic odla.config.mjs plus starter schema/rules files.
+  doctor       Validate and summarize the project config without network calls.
+  config       Read-only diff and revision-bound plan for checked-in Registry
+               intent; runtime-owned fields and excluded coverage stay explicit.
+  calendar     Inspect, connect, or disconnect the live Google booking connection.
+  app          Archive (suspend, data retained), restore, export, import, or
+               manage the co-owners of the app. Archiving takes every
+               environment's data plane down until restored; permanent deletion
+               has NO CLI \u2014 it requires a signed-in owner in Studio, and no
+               machine or agent credential can purge. "app export" downloads a
+               portable gzipped-JSONL snapshot of one database (--fresh takes a
+               new snapshot first) \u2014 your data is always yours to take.
+               "app import" upserts rows back in from JSON, JSONL, or a
+               {namespace: rows} map (the shape a query returns); it writes only
+               with --yes, so the bare command is a dry run, and it refuses to
+               guess an id mode that would duplicate rows on a re-run.
+               "app refresh-sandbox" replaces the sandbox with a copy of live
+               (the routine dev loop); "app go-live" copies the sandbox into an
+               EMPTY live database, once, at launch; "app promote" pushes only
+               schema, rules and gates up afterwards, leaving live's rows alone.
+               Each prints its plan and writes nothing without --yes, so the
+               bare command is the dry run. Clerk config, triggers, allowlists,
+               secrets and API keys never travel; identity rows stay behind
+               unless --include-identity.
+               "app rename <name>" changes only the display name humans read;
+               the app id is permanent (tenants, URLs and keys embed it), so a
+               rename never re-provisions anything or invalidates a credential.
+               "app owners add <email>" grants a signed-up odla member the SAME
+               full access as you; they then run their own "provision" to mint
+               their own credentials for the shared db (the live one included)
+               \u2014 no secret is ever copied between people.
+  capabilities Show what the CLI automates vs agent edits and human checkpoints.
+  code         Enroll this Mac/Linux host for the current Studio-connected repository and run Pi.
+  admin        Manage platform-funded AI routing/credentials/usage with narrow device grants.
+  security     Connect GitHub sources and run commit-pinned hosted reviews, or scan a local snapshot.
+  pm           Project management (via @odla-ai/pm) shared across the apps you
+               co-own: conformance goals, kanban tasks, decisions, and bugs. With
+               no --app, "list" spans every co-owned project (the cross-project
+               view); with --app it scopes to one. Same device-grant auth as
+               "app". Entities: goal (alias conformance), task (alias kanban),
+               decision, bug. Status changes and comments post to each item's
+               @odla-ai/chat discussion thread.
+  discuss      Group discussions (via @odla-ai/chat) for the apps you co-own:
+               one group per project, topics with replies, @-mentions of people,
+               agents, PM items, and projects. Built for unattended use \u2014 post a
+               question, then "watch" it until someone answers. "watch" exits 75
+               (not 1) when it times out with nothing new, so a script can tell
+               "no answer yet" from a failure and just rerun. Use "who" to look
+               up the exact @[Label](kind/id) markup for a mention.
+  o11y         Read one stable status envelope for application RED, current
+               live-sync load/freshness, the protected commit-to-visible
+               canary, collector ingest/scheduler trust, Cloudflare-owned
+               runtime metrics, and a machine verdict.
+               --json keeps auth progress on stderr for unattended agents.
+  platform     Read canonical fleet health, releases, provider load/freshness,
+               explicit unknowns, and next actions through a read-only grant.
+  provision    Register services, compose integrations, persist credentials, optionally push secrets.
+  smoke        Verify credentials, public-config, composed schema, db aggregate, and integration probes.
+  skill        Same installer; --agent accepts all, claude, codex, cursor,
+               copilot, gemini, or agents (repeatable or comma-separated).
+  secrets      Push configured db/o11y secrets into the Worker via wrangler
+               stdin; set stores a tenant-vault secret and set-clerk-key the
+               reserved Clerk secret key, write-only from stdin or an env var.
+  version      Print the CLI version.
+
+Safety:
+  Every app has two databases on odla.ai: a sandbox (env "dev", tenant
+  <appId>--dev) and a live one (env "prod", tenant <appId>). Both are served by
+  production odla.ai \u2014 there is no separate odla to point at. New projects get
+  the sandbox only. Add "prod" explicitly to odla.config.mjs and pass --yes to
+  provision the live database; use --dry-run first to inspect the resolved plan.
+  Provision caches the approved developer token and service credentials under
+  .odla/ with mode 0600, and init adds those paths to .gitignore. Secret push
+  preflights Wrangler before any shown-once issuance or destructive rotation.
+  Projectless PM, Discussions, o11y, runbook, and identity commands use
+  --platform/--app/--env, ODLA_PLATFORM_URL/ODLA_APP_ID/ODLA_ENV, and
+  ODLA_DEV_TOKEN. Save non-secret scope metadata with "context save", then
+  select it explicitly with --context or ODLA_CONTEXT. Each named context gets
+  isolated developer and scoped-token caches. Override their locations with
+  ODLA_DEV_TOKEN_FILE and ODLA_ADMIN_TOKEN_FILE; ODLA_CONTEXT_FILE relocates
+  the metadata file. Flags and specific ODLA_* scope variables beat a selected
+  context, which beats project config. There is no ambient current context.
+  "context show" reports only provenance and cache state and never authenticates.
+  Provision opens the approval page in your browser automatically whenever the
+  machine can show one, including agent-driven runs; only CI, SSH, and
+  display-less hosts skip it. Use --open to force or --no-open to suppress.
+  Browser launch is best-effort: the printed approval URL is authoritative and
+  agents must relay it to the human verbatim. A started handshake is persisted
+  under .odla/, so a command killed mid-wait loses nothing \u2014 rerunning resumes
+  the same code. Outside an interactive terminal the wait is capped (90s by
+  default, --wait <seconds> to change); a still-pending handshake then exits
+  with code 75: relay the URL, wait for approval, and re-run to collect.
+  A fresh device handshake requires --email <odla-account> or ODLA_USER_EMAIL.
+  The email is a non-secret identity hint: never provide a password or session
+  token. The matching account must already exist, be signed in, explicitly
+  review the exact code, and finish any current request before claiming another.
+  Run Code from a GitHub checkout already connected to an app in Studio; an
+  odla.config.mjs may select the app explicitly but is not required. Code host
+  approval and credential hashes live in odla-ai/db. The host
+  credential is never written under .odla/; it exists only in the foreground
+  "code connect" process and is rotated by the next approved connection.
+  Calendar setup has a second human checkpoint: odla issues a state-bound Google consent URL;
+  OAuth codes and refresh tokens never enter the CLI, repo, chat, or app.
+  GitHub security uses source-read-only access plus optional metadata-only Checks write: the CLI never asks
+  for a PAT or provider key. GitHub read access is separate from the explicit
+  --ack-redacted-source consent and the exact --plan-digest printed by security
+  plan are required before bounded snippets reach System AI.
+  Run security plan first to inspect the admin-selected providers, models,
+  per-route bounds, credential readiness, retention, no-execution boundary,
+  and digest that binds consent to that exact plan.
+`);
+}
+
 // src/discuss-actions.ts
 var writeMutationId = (parsed) => stringOpt(parsed.options["mutation-id"]) ?? crypto.randomUUID();
 async function request(ctx, method, path, body) {
@@ -8993,8 +9503,8 @@ var ALLOWED = [
   "platform",
   "context"
 ];
-function requireId(id, action) {
-  if (!id) throw new Error(`"discuss ${action}" needs a topic id`);
+function requireId(id, action2) {
+  if (!id) throw new Error(`"discuss ${action2}" needs a topic id`);
   return id;
 }
 async function buildContext(parsed, deps) {
@@ -9028,11 +9538,11 @@ async function buildContext(parsed, deps) {
 }
 async function discussCommand(parsed, deps = {}) {
   assertArgs(parsed, ALLOWED, 3);
-  const action = parsed.positionals[1];
+  const action2 = parsed.positionals[1];
   const id = parsed.positionals[2];
-  if (!action) throw new Error('"discuss" needs an action. Run "odla-ai help".');
+  if (!action2) throw new Error('"discuss" needs an action. Run "odla-ai help".');
   const ctx = await buildContext(parsed, deps);
-  switch (action) {
+  switch (action2) {
     case "groups":
       return discussGroups(ctx);
     case "list":
@@ -9054,7 +9564,7 @@ async function discussCommand(parsed, deps = {}) {
       return;
     }
     default:
-      throw new Error(`unknown discuss action "${action}". Run "odla-ai help".`);
+      throw new Error(`unknown discuss action "${action2}". Run "odla-ai help".`);
   }
 }
 
@@ -9315,18 +9825,18 @@ var ENTITY_OPTIONS = {
     done: ["decision"]
   }
 };
-function canonicalAction(action) {
-  if (action === "create") return "add";
-  if (action === "update" || action === "status" || action === "move") return "set";
-  if (action === "delete") return "rm";
-  return action in ACTION_OPTIONS ? action : null;
-}
-function allowedOptions(entity, action) {
-  const entityOptions = action === "list" || action === "add" || action === "set" || action === "done" ? ENTITY_OPTIONS[entity][action] : [];
-  return [...COMMON_OPTIONS, ...ACTION_OPTIONS[action], ...entityOptions];
-}
-function requireId2(id, action) {
-  if (!id) throw new Error(`"pm ... ${action}" needs an item id`);
+function canonicalAction(action2) {
+  if (action2 === "create") return "add";
+  if (action2 === "update" || action2 === "status" || action2 === "move") return "set";
+  if (action2 === "delete") return "rm";
+  return action2 in ACTION_OPTIONS ? action2 : null;
+}
+function allowedOptions(entity, action2) {
+  const entityOptions = action2 === "list" || action2 === "add" || action2 === "set" || action2 === "done" ? ENTITY_OPTIONS[entity][action2] : [];
+  return [...COMMON_OPTIONS, ...ACTION_OPTIONS[action2], ...entityOptions];
+}
+function requireId2(id, action2) {
+  if (!id) throw new Error(`"pm ... ${action2}" needs an item id`);
   return id;
 }
 async function buildContext2(parsed, deps) {
@@ -9362,28 +9872,28 @@ async function pmCommand(parsed, deps = {}) {
   const entity = ALIASES[word];
   if (!entity) throw new Error(`unknown pm entity "${word}". Try "odla-ai pm bug list" (goal|task|decision|bug).`);
   const requestedAction = parsed.positionals[2] ?? "list";
-  const action = canonicalAction(requestedAction);
-  if (!action) throw new Error(`unknown pm action "${requestedAction}". Try list|add|get|set|done|comment|comments|rm.`);
-  assertArgs(parsed, allowedOptions(entity, action), 4);
+  const action2 = canonicalAction(requestedAction);
+  if (!action2) throw new Error(`unknown pm action "${requestedAction}". Try list|add|get|set|done|comment|comments|rm.`);
+  assertArgs(parsed, allowedOptions(entity, action2), 4);
   const ctx = await buildContext2(parsed, deps);
   const id = parsed.positionals[3];
-  switch (action) {
+  switch (action2) {
     case "list":
       return pmList(ctx, entity, parsed);
     case "add":
       return pmAdd(ctx, entity, parsed);
     case "get":
-      return pmGet(ctx, entity, requireId2(id, action));
+      return pmGet(ctx, entity, requireId2(id, action2));
     case "set":
-      return pmSet(ctx, entity, requireId2(id, action), parsed);
+      return pmSet(ctx, entity, requireId2(id, action2), parsed);
     case "done":
-      return pmDone(ctx, entity, requireId2(id, action), parsed);
+      return pmDone(ctx, entity, requireId2(id, action2), parsed);
     case "comment":
-      return pmComment(ctx, entity, requireId2(id, action), parsed);
+      return pmComment(ctx, entity, requireId2(id, action2), parsed);
     case "comments":
-      return pmComments(ctx, entity, requireId2(id, action));
+      return pmComments(ctx, entity, requireId2(id, action2));
     case "rm":
-      return pmRemove(ctx, entity, requireId2(id, action));
+      return pmRemove(ctx, entity, requireId2(id, action2));
   }
 }
 
@@ -9416,8 +9926,8 @@ function printPlatformStatus(status, out) {
   if (status.verdict.reasons.length) {
     out.log(`reasons	${status.verdict.reasons.join(", ")}`);
   }
-  for (const action of status.nextActions) {
-    out.log(`next	${action.service}	${action.code}	${action.message}`);
+  for (const action2 of status.nextActions) {
+    out.log(`next	${action2.service}	${action2.code}	${action2.message}`);
   }
 }
 function value(input) {
@@ -9437,10 +9947,10 @@ async function platformCommand(parsed, deps = {}) {
     ["config", "context", "platform", "token", "email", "open", "json"],
     2
   );
-  const action = parsed.positionals[1];
-  if (action !== "status") {
+  const action2 = parsed.positionals[1];
+  if (action2 !== "status") {
     throw new Error(
-      `unknown platform action "${action ?? ""}". Try "odla-ai platform status --json".`
+      `unknown platform action "${action2 ?? ""}". Try "odla-ai platform status --json".`
     );
   }
   const context = await resolveOperatorContext(parsed, {
@@ -9769,10 +10279,10 @@ async function o11yCommand(parsed, deps = {}) {
     ],
     2
   );
-  const action = parsed.positionals[1];
-  if (action !== "status") {
+  const action2 = parsed.positionals[1];
+  if (action2 !== "status") {
     throw new Error(
-      `unknown o11y action "${action ?? ""}". Try "odla-ai o11y status --json".`
+      `unknown o11y action "${action2 ?? ""}". Try "odla-ai o11y status --json".`
     );
   }
   const minutes = statusMinutes(
@@ -10092,7 +10602,7 @@ async function runbookRemove(ctx, slug) {
 
 // src/runbook-import.ts
 import { readFileSync as readFileSync10, readdirSync as readdirSync2, statSync } from "fs";
-import { basename as basename2, join as join11 } from "path";
+import { basename as basename2, join as join12 } from "path";
 function parseRunbook(text, slug) {
   let rest = text;
   const meta = {};
@@ -10122,7 +10632,7 @@ function readRunbookDir(dir) {
   if (!files.length) throw new Error(`no .md files in ${dir}`);
   return files.map((file) => {
     const slug = basename2(file, ".md");
-    const parsed = parseRunbook(readFileSync10(join11(dir, file), "utf8"), slug);
+    const parsed = parseRunbook(readFileSync10(join12(dir, file), "utf8"), slug);
     return { file, slug, ...parsed, words: parsed.body.split(/\s+/).filter(Boolean).length };
   });
 }
@@ -10195,7 +10705,7 @@ async function upsert(ctx, r, visibility) {
 // src/runbook-impact.ts
 import { execFileSync as execFileSync2 } from "child_process";
 import { existsSync as existsSync11, readFileSync as readFileSync11 } from "fs";
-import { join as join12 } from "path";
+import { join as join13 } from "path";
 
 // src/runbook-impact-scan.ts
 var DECL = /^[+-]\s*export\s+(?:declare\s+)?(?:default\s+)?(?:abstract\s+)?(?:async\s+)?(?:const|let|var|function|class|interface|type|enum)\s+([A-Za-z_$][\w$]*)/;
@@ -10364,7 +10874,7 @@ ${body.split("\n").map((line) => `+${line}`).join("\n")}
 }
 function manifestLabeller(root) {
   return (workspace) => {
-    const manifest = join12(root, workspace, "package.json");
+    const manifest = join13(root, workspace, "package.json");
     if (!existsSync11(manifest)) return void 0;
     try {
       const name = JSON.parse(readFileSync11(manifest, "utf8")).name;
@@ -10434,7 +10944,7 @@ function report3(ctx, impacts) {
 async function runbookImpact(ctx, options, deps = {}) {
   const cwd = deps.cwd ?? process.cwd();
   const runGit = deps.runGit ?? gitRunner(cwd);
-  const read3 = deps.readRepoFile ?? ((path) => readFileSync11(join12(cwd, path), "utf8"));
+  const read3 = deps.readRepoFile ?? ((path) => readFileSync11(join13(cwd, path), "utf8"));
   const surfaces = changedSurfaces(collectDiff(runGit, options.base, read3), manifestLabeller(cwd));
   if (!surfaces.length) {
     return ctx.out.log(
@@ -10569,7 +11079,7 @@ async function runbookComment(ctx, slug, body) {
 import { spawnSync } from "child_process";
 import { mkdtempSync, readFileSync as readFileSync12, rmSync as rmSync2, writeFileSync as writeFileSync4 } from "fs";
 import { tmpdir as tmpdir4 } from "os";
-import { join as join13 } from "path";
+import { join as join14 } from "path";
 import process13 from "process";
 var EDITOR_ENV = ["ODLA_EDITOR", "VISUAL", "EDITOR"];
 function resolveEditor(env = process13.env) {
@@ -10595,8 +11105,8 @@ function editText(initial, slug, deps = {}) {
     );
   if (!interactive())
     throw new Error(`cannot open an editor without a terminal \u2014 pass --file <path> or --body "\u2026" instead`);
-  const dir = mkdtempSync(join13(tmpdir4(), "odla-runbook-"));
-  const file = join13(dir, `${slug}.md`);
+  const dir = mkdtempSync(join14(tmpdir4(), "odla-runbook-"));
+  const file = join14(dir, `${slug}.md`);
   try {
     writeFileSync4(file, initial, { mode: 384 });
     const code = defaultRunOrInjected(deps)(editor, file);
@@ -10704,12 +11214,12 @@ var ALLOWED2 = [
   "platform",
   "context"
 ];
-function requireSlug(slug, action) {
-  if (!slug) throw new Error(`"runbook ${action}" needs a slug, e.g. "odla-ai runbook ${action} release"`);
+function requireSlug(slug, action2) {
+  if (!slug) throw new Error(`"runbook ${action2}" needs a slug, e.g. "odla-ai runbook ${action2} release"`);
   return slug;
 }
 var WRITES = /* @__PURE__ */ new Set(["new", "edit", "publish", "archive", "visibility", "revert", "rm", "import"]);
-async function buildContext3(parsed, deps, action) {
+async function buildContext3(parsed, deps, action2) {
   const appIdOption = stringOpt(parsed.options.app);
   const context = await resolveOperatorContext(parsed, {
     allowMissingConfig: true
@@ -10719,7 +11229,7 @@ async function buildContext3(parsed, deps, action) {
   const out = deps.stdout ?? console;
   const appId = appIdOption ?? (context.app.source === "environment" || context.app.source === "profile" ? context.app.value : null) ?? PLATFORM_SCOPE;
   const dryRun = parsed.options["dry-run"] === true;
-  if (action === "import" && dryRun) {
+  if (action2 === "import" && dryRun) {
     return {
       platformUrl: cfg.platformUrl,
       token: "",
@@ -10729,12 +11239,12 @@ async function buildContext3(parsed, deps, action) {
       appId
     };
   }
-  const needsCapability = WRITES.has(action) && !dryRun && appId === PLATFORM_SCOPE && !stringOpt(parsed.options.token);
+  const needsCapability = WRITES.has(action2) && !dryRun && appId === PLATFORM_SCOPE && !stringOpt(parsed.options.token);
   const token = needsCapability ? await getScopedPlatformToken({
     platform: cfg.platformUrl,
     scope: "platform:runbook:write",
     email: stringOpt(parsed.options.email),
-    label: `odla CLI (runbook ${action})`,
+    label: `odla CLI (runbook ${action2})`,
     fetch: doFetch,
     stdout: out,
     openApprovalUrl: deps.openUrl,
@@ -10769,11 +11279,11 @@ async function buildContext3(parsed, deps, action) {
   };
 }
 async function runbookCommand(parsed, deps = {}) {
-  const action = parsed.positionals[1] ?? "list";
-  assertArgs(parsed, ALLOWED2, action === "ask" || action === "search" ? 64 : 4);
-  const ctx = await buildContext3(parsed, deps, action);
+  const action2 = parsed.positionals[1] ?? "list";
+  assertArgs(parsed, ALLOWED2, action2 === "ask" || action2 === "search" ? 64 : 4);
+  const ctx = await buildContext3(parsed, deps, action2);
   const slug = parsed.positionals[2];
-  switch (action) {
+  switch (action2) {
     case "list":
       return runbookList(ctx, parsed.options.all === true, stringOpt(parsed.options.q));
     case "ask": {
@@ -10858,7 +11368,7 @@ async function runbookCommand(parsed, deps = {}) {
     case "rm":
       return runbookRemove(ctx, requireSlug(slug, "rm"));
     default:
-      throw new Error(`unknown runbook action "${action}". Try ${acceptedAfter(["runbook"]).join(", ")}.`);
+      throw new Error(`unknown runbook action "${action2}". Try ${acceptedAfter(["runbook"]).join(", ")}.`);
   }
 }
 
@@ -11221,8 +11731,8 @@ async function securityCommand(parsed, dependencies) {
   else await runLocalSecurityCommand(parsed, dependencies);
 }
 async function githubSecurityCommand(parsed, dependencies) {
-  const action = parsed.positionals[2];
-  if (action === "disconnect") {
+  const action2 = parsed.positionals[2];
+  if (action2 === "disconnect") {
     assertArgs(parsed, ["config", "env", "platform", "source", "email", "open", "yes"], 3);
     const context2 = await hostedSecurityContext(parsed, dependencies);
     const sourceId = requiredString(parsed.options.source, "--source");
@@ -11237,7 +11747,7 @@ async function githubSecurityCommand(parsed, dependencies) {
     context2.stdout.log(`github: disconnected ${sourceId} from ${context2.appId}/${context2.env}`);
     return;
   }
-  if (action !== "connect") {
+  if (action2 !== "connect") {
     throw new Error('unknown security github command. Try "odla-ai security github connect".');
   }
   assertArgs(parsed, ["config", "env", "platform", "repo", "email", "open"], 3);
@@ -11454,6 +11964,10 @@ export {
   calendarDisconnect,
   CAPABILITIES,
   printCapabilities,
+  desiredRegistryState,
+  reconcileConfig,
+  configDiff,
+  configPlan,
   doctor,
   initProject,
   secretsPush,
@@ -11491,4 +12005,4 @@ export {
   exitCodeFor,
   runCli
 };
-//# sourceMappingURL=chunk-L2NG4UR4.js.map
+//# sourceMappingURL=chunk-2AFAXLKE.js.map