@odla-ai/cli 0.25.22 → 0.25.23

package/dist/{chunk-2AFAXLKE.js → chunk-JJ42NV7X.js}

@@ -440,6 +440,7 @@ function audienceBoundEnvToken(token, platform) {
 var SCOPE_PURPOSE = {
   "platform:status:read": "read the platform fleet health and deployment snapshot",
   "app:config:read": "compare checked-in intent with an exact-id app Registry configuration",
+  "app:config:write": "apply or inspect one revision-bound configuration operation for an app you own",
   "platform:runbook:write": "add or edit odla's operational runbooks",
   "platform:ai:policy:write": "change System AI model routing",
   "platform:ai:policy:read": "read System AI model routing",
@@ -941,6 +942,7 @@ function unique(values) {
 var DEFAULT_PLATFORM = "https://odla.ai";
 var DEFAULT_ENVS = ["dev"];
 var DEFAULT_SERVICES = ["db", "ai"];
+var configImportSerial = 0;
 var GOOGLE_CALENDAR_EVENTS_SCOPE = "https://www.googleapis.com/auth/calendar.events";
 async function loadProjectConfig(configPath = "odla.config.mjs") {
   const resolved = resolve2(configPath);
@@ -1148,7 +1150,8 @@ function validId2(value2) {
 }
 async function loadConfigModule(path) {
   if (path.endsWith(".json")) return JSON.parse(readFileSync2(path, "utf8"));
-  const mod = await import(`${pathToFileURL(path).href}?t=${Date.now()}`);
+  const nonce = `${Date.now()}-${configImportSerial++}`;
+  const mod = await import(`${pathToFileURL(path).href}?reload=${nonce}`);
   const value2 = mod.default ?? mod.config;
   if (typeof value2 === "function") return await value2();
   return value2;
@@ -1638,7 +1641,8 @@ var CAPABILITIES = {
     "save and explicitly select non-secret named operator contexts with isolated credential caches; resolve and explain platform, app, environment, and credential provenance without authenticating; then run PM, Discussions, o11y, runbook, and identity operations outside a project checkout",
     "read one versioned o11y status envelope spanning application RED, exact Worker versions and Cloudflare colos observed in traffic, current live-sync freshness/load, the protected commit-to-visible canary, collector ingest/scheduler trust, provider-owned runtime metrics, account-scoped Durable Object, D1, and R2 evidence under odla-db, and a bounded machine verdict",
     "read one canonical platform fleet snapshot over private service bindings, including release identities, probe latency, Cloudflare load/runtime freshness, explicit unknowns, and stable next actions through a read-only capability",
-    "compare one project's checked-in Registry intent with live owner-visible state and freeze a secret-free plan digest through an exact app:config:read capability",
+    "compare one project's checked-in Registry intent with live owner-visible state, freeze a secret-free Registry-revision-bound plan through app:config:read, and conditionally apply checkpoint-free actions through exact app:config:write operation routes",
+    "inspect or bounded-wait one exact durable config-operation journal entry and verify every terminal receipt digest before returning it to remote automation",
     "inspect durable agent wakeups as a versioned JSON envelope and explicitly requeue one dead-lettered job with a scoped environment credential",
     "run app-attributed hosted security discovery and independent validation without provider keys",
     "connect/revoke source-read-only GitHub sources and drive commit-pinned hosted security jobs without PATs or provider keys",
@@ -1685,6 +1689,16 @@ function printGroup(out, heading, items) {
   out.log("");
 }
 
+// src/config-operation-error.ts
+var ConfigOperationCommandError = class extends Error {
+  constructor(message2, code) {
+    super(message2);
+    this.code = code;
+    this.name = "ConfigOperationCommandError";
+  }
+  code;
+};
+
 // src/config-reconcile-desired.ts
 import { orderAppServices } from "@odla-ai/apps";
 
@@ -1778,8 +1792,25 @@ function managedServiceConfig(cfg, env, service) {
   return {};
 }
 
-// src/config-reconcile.ts
-import { appServiceIds as appServiceIds2, orderAppServices as orderAppServices2 } from "@odla-ai/apps";
+// src/config-operation-command.ts
+import {
+  AppsError,
+  createAppsClient
+} from "@odla-ai/apps";
+import { join as join3 } from "path";
+
+// src/version.ts
+import { readFileSync as readFileSync3 } from "fs";
+function cliVersion() {
+  const pkg = JSON.parse(readFileSync3(new URL("../package.json", import.meta.url), "utf8"));
+  return pkg.version ?? "unknown";
+}
+
+// src/config-operation-validate.ts
+import {
+  appServiceDefinition as appServiceDefinition2
+} from "@odla-ai/apps";
+import { readFileSync as readFileSync4 } from "fs";
 
 // src/config-reconcile-digest.ts
 import { createHash } from "crypto";
@@ -1790,15 +1821,347 @@ function configDigest(value2) {
   return `sha256:${createHash("sha256").update(canonicalJson(value2)).digest("hex")}`;
 }
 function canonicalValue(value2) {
+  if (value2 === null || typeof value2 === "string" || typeof value2 === "boolean") return value2;
+  if (typeof value2 === "number") {
+    if (!Number.isFinite(value2)) throw new TypeError("canonical JSON rejects non-finite numbers");
+    return value2;
+  }
   if (Array.isArray(value2)) return value2.map(canonicalValue);
   if (value2 && typeof value2 === "object") {
+    const record10 = value2;
     return Object.fromEntries(
-      Object.entries(value2).filter(([, entry]) => entry !== void 0).sort(([left], [right]) => left.localeCompare(right)).map(([key, entry]) => [key, canonicalValue(entry)])
+      Object.keys(record10).filter((key) => record10[key] !== void 0).sort().map((key) => [key, canonicalValue(record10[key])])
     );
   }
-  return value2;
+  throw new TypeError("canonical JSON rejects unsupported values");
 }
 
+// src/config-operation-validate.ts
+var DIGEST = /^sha256:[0-9a-f]{64}$/;
+var REVISION = /^registry:[1-9][0-9]*$/;
+var OPERATION_ID = /^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i;
+var ACTION_ID = /^action-[0-9a-f]{16}$/;
+var ENV = /^[a-z0-9]{2,12}$/;
+var SERVICE = /^[a-z][a-z0-9-]{0,39}$/;
+function readPlan(path) {
+  let value2;
+  try {
+    const raw = readFileSync4(path, "utf8");
+    if (Buffer.byteLength(raw) > 128 * 1024) throw new Error("plan exceeds 128 KiB");
+    value2 = JSON.parse(raw);
+  } catch (error) {
+    throw new ConfigOperationCommandError(
+      `cannot read --plan ${path}: ${error instanceof Error ? error.message : String(error)}`,
+      "invalid_plan"
+    );
+  }
+  if (!record2(value2) || value2.schemaVersion !== "odla.config-plan/v2") invalidPlan("unsupported plan schema");
+  if (!record2(value2.scope) || typeof value2.scope.appId !== "string" || typeof value2.scope.platformUrl !== "string") {
+    invalidPlan("plan scope is invalid");
+  }
+  if (!DIGEST.test(String(value2.desiredRevision)) || !DIGEST.test(String(value2.observedRevision))) {
+    invalidPlan("plan content revisions are invalid");
+  }
+  if (!REVISION.test(String(value2.registryRevision)) || !DIGEST.test(String(value2.planDigest))) {
+    invalidPlan("plan Registry revision or digest is invalid");
+  }
+  if (!Array.isArray(value2.actions) || !value2.actions.length || value2.actions.length > 32) {
+    invalidPlan("plan actions must contain 1-32 entries");
+  }
+  assertActions(value2.actions);
+  const plan = value2;
+  const digest = configDigest({
+    schemaVersion: plan.schemaVersion,
+    desiredRevision: plan.desiredRevision,
+    observedRevision: plan.observedRevision,
+    registryRevision: plan.registryRevision,
+    actions: plan.actions
+  });
+  if (digest !== plan.planDigest) invalidPlan("plan digest does not bind these revisions and actions");
+  return plan;
+}
+function assertPlanContext(plan, appId, platformUrl) {
+  if (plan.scope.appId !== appId || plan.scope.platformUrl.replace(/\/$/, "") !== platformUrl.replace(/\/$/, "")) {
+    throw new ConfigOperationCommandError("plan scope does not match the selected project config", "checkpoint_required");
+  }
+}
+function verifyReceipt(receipt, appId, operationId) {
+  if (receipt.appId !== appId || operationId && receipt.operationId !== operationId) {
+    throw new ConfigOperationCommandError("Registry returned a receipt outside the requested scope", "invalid_receipt");
+  }
+  if (receipt.receiptDigest) {
+    const { receiptDigest, ...fields } = receipt;
+    if (configDigest(fields) !== receiptDigest) {
+      throw new ConfigOperationCommandError("config operation receipt digest is invalid", "invalid_receipt");
+    }
+  } else if (receipt.state === "succeeded" || receipt.state === "conflict" || receipt.state === "failed" && !receipt.error?.retryable) {
+    throw new ConfigOperationCommandError("terminal config operation receipt is not digest-authenticated", "invalid_receipt");
+  }
+}
+function assertOperationId(value2) {
+  if (!OPERATION_ID.test(value2)) {
+    throw new ConfigOperationCommandError("operation id must be a UUID", "invalid_operation_id");
+  }
+}
+function assertActions(actions) {
+  const ids = /* @__PURE__ */ new Set();
+  for (const action2 of actions) {
+    if (!record2(action2)) invalidPlan("every plan action must be an object");
+    const id = String(action2.id ?? "");
+    if (!ACTION_ID.test(id) || ids.has(id)) invalidPlan("plan action ids must be unique frozen ids");
+    ids.add(id);
+    if (typeof action2.path !== "string" || typeof action2.reason !== "string" || !action2.reason || action2.reason.length > 500 || typeof action2.requiresApproval !== "boolean" || !["low", "medium", "high"].includes(String(action2.risk)) || !["provision", "command", "studio"].includes(String(action2.applySupport))) {
+      invalidPlan("plan action metadata is invalid");
+    }
+    if (["rename_app", "enable_service", "configure_service", "set_link"].includes(String(action2.kind))) {
+      assertConditionalAction(action2);
+    }
+  }
+}
+function assertConditionalAction(action2) {
+  if (action2.kind === "rename_app") {
+    if (action2.path !== "app.name" || action2.applySupport !== "command" || typeof action2.before !== "string" || typeof action2.after !== "string" || action2.after !== action2.after.trim() || !action2.after || action2.after.length > 80) invalidPlan("rename action is invalid");
+    return;
+  }
+  if (!action2.env || !ENV.test(action2.env)) invalidPlan("conditional action env is invalid");
+  if (action2.kind === "set_link") {
+    if (action2.path !== `environments.${action2.env}.link` || action2.applySupport !== "provision" || !linkState(action2.before) || !linkState(action2.after)) invalidPlan("link action is invalid");
+    return;
+  }
+  if (!action2.service || !SERVICE.test(action2.service) || !appServiceDefinition2(action2.service)) {
+    invalidPlan("service action names an unknown service");
+  }
+  const base = `environments.${action2.env}.services.${action2.service}`;
+  if (action2.path !== (action2.kind === "configure_service" ? `${base}.config` : base)) {
+    invalidPlan("service action path is invalid");
+  }
+  if (action2.applySupport !== "provision" || !record2(action2.after)) {
+    invalidPlan("service action payload is invalid");
+  }
+  if (action2.kind === "enable_service") {
+    if (action2.after.enabled !== true || action2.before !== null && !record2(action2.before)) {
+      invalidPlan("service enable action is invalid");
+    }
+  } else if (!record2(action2.before)) {
+    invalidPlan("service configure action is invalid");
+  }
+}
+function linkState(value2) {
+  if (value2 === null) return true;
+  if (typeof value2 !== "string") return false;
+  try {
+    const url = new URL(value2.trim());
+    return url.protocol === "http:" || url.protocol === "https:";
+  } catch {
+    return false;
+  }
+}
+function invalidPlan(message2) {
+  throw new ConfigOperationCommandError(message2, "invalid_plan");
+}
+function record2(value2) {
+  return !!value2 && typeof value2 === "object" && !Array.isArray(value2);
+}
+
+// src/config-reconcile-support.ts
+var CONDITIONAL_KINDS = /* @__PURE__ */ new Set([
+  "rename_app",
+  "enable_service",
+  "configure_service",
+  "set_link"
+]);
+function configApplySupport(reconciliation) {
+  if (!reconciliation.observedRevision || !reconciliation.registryRevision) {
+    return {
+      supported: false,
+      checkpointRequired: false,
+      reason: "the app must already exist in a revision-aware Registry"
+    };
+  }
+  if (!reconciliation.actions.length) {
+    return {
+      supported: false,
+      checkpointRequired: false,
+      reason: "there are no managed changes to apply"
+    };
+  }
+  const blocked = reconciliation.actions.filter(
+    (action2) => !CONDITIONAL_KINDS.has(action2.kind) || action2.risk !== "low" || action2.requiresApproval || action2.applySupport === "studio" || action2.env === "prod" || action2.env === "production"
+  );
+  if (blocked.length) {
+    return {
+      supported: false,
+      checkpointRequired: blocked.some(
+        (action2) => action2.risk === "high" || action2.requiresApproval || action2.applySupport === "studio" || action2.env === "prod" || action2.env === "production"
+      ),
+      reason: `${blocked.length} action${blocked.length === 1 ? "" : "s"} remain outside conditional apply`
+    };
+  }
+  return {
+    supported: true,
+    checkpointRequired: false,
+    reason: "all actions are low-risk, checkpoint-free Registry changes"
+  };
+}
+
+// src/config-operation-command.ts
+var IDEMPOTENCY_KEY = /^[A-Za-z0-9][A-Za-z0-9._:-]{0,119}$/;
+var DEFAULT_WAIT_SECONDS = 60;
+var DEFAULT_INTERVAL_SECONDS = 2;
+async function configApply(options) {
+  const plan = readPlan(options.planPath);
+  const cfg = await loadProjectConfig(options.configPath);
+  assertPlanContext(plan, cfg.app.id, cfg.platformUrl);
+  const support = configApplySupport(plan);
+  if (!support.supported) {
+    throw new ConfigOperationCommandError(
+      support.reason,
+      support.checkpointRequired ? "checkpoint_required" : "invalid_plan"
+    );
+  }
+  if (configDigest(desiredRegistryState(cfg)) !== plan.desiredRevision) {
+    throw new ConfigOperationCommandError(
+      "project config changed after this plan was frozen; generate and review a fresh plan",
+      "checkpoint_required"
+    );
+  }
+  const idempotencyKey = options.idempotencyKey ?? `cli:${plan.planDigest.slice(7)}`;
+  if (!IDEMPOTENCY_KEY.test(idempotencyKey)) {
+    throw new ConfigOperationCommandError("--idempotency-key is not a safe 1-120 character key", "invalid_plan");
+  }
+  const client = await operationClient(cfg, options, "apply");
+  const request2 = {
+    schemaVersion: "odla.config-operation-request/v1",
+    expectedRevision: plan.registryRevision,
+    desiredRevision: plan.desiredRevision,
+    observedRevision: plan.observedRevision,
+    planDigest: plan.planDigest,
+    idempotencyKey,
+    source: { kind: "cli", version: cliVersion() },
+    actions: plan.actions
+  };
+  let receipt;
+  try {
+    receipt = await client.applyConfigOperation(cfg.app.id, request2);
+  } catch (error) {
+    const retained = retainedReceipt(error);
+    if (retained) {
+      verifyReceipt(retained, cfg.app.id);
+      printReceipt(retained, options);
+      throw failureForReceipt(retained);
+    }
+    throw normalizeRequestError(error);
+  }
+  verifyReceipt(receipt, cfg.app.id);
+  printReceipt(receipt, options);
+  assertApplyCompleted(receipt);
+  return receipt;
+}
+async function configOperationGet(options) {
+  assertOperationId(options.operationId);
+  const cfg = await loadProjectConfig(options.configPath);
+  const client = await operationClient(cfg, options, "read");
+  const receipt = await client.getConfigOperation(cfg.app.id, options.operationId).catch((error) => {
+    throw normalizeRequestError(error);
+  });
+  if (!receipt) {
+    throw new ConfigOperationCommandError("config operation not found for this app", "operation_not_found");
+  }
+  verifyReceipt(receipt, cfg.app.id, options.operationId);
+  printReceipt(receipt, options);
+  return receipt;
+}
+async function configOperationWait(options) {
+  assertOperationId(options.operationId);
+  const cfg = await loadProjectConfig(options.configPath);
+  const client = await operationClient(cfg, options, "wait");
+  const wait2 = options.pollWait ?? ((ms) => new Promise((resolve12) => setTimeout(resolve12, ms)));
+  const now = () => (options.now?.() ?? /* @__PURE__ */ new Date()).getTime();
+  const deadline = now() + (options.timeoutSeconds ?? DEFAULT_WAIT_SECONDS) * 1e3;
+  const interval = (options.intervalSeconds ?? DEFAULT_INTERVAL_SECONDS) * 1e3;
+  let receipt = null;
+  for (; ; ) {
+    receipt = await client.getConfigOperation(cfg.app.id, options.operationId).catch((error) => {
+      throw normalizeRequestError(error);
+    });
+    if (!receipt) {
+      throw new ConfigOperationCommandError("config operation not found for this app", "operation_not_found");
+    }
+    verifyReceipt(receipt, cfg.app.id, options.operationId);
+    if (receipt.state !== "running") break;
+    if (now() >= deadline) {
+      printReceipt(receipt, options);
+      throw new ConfigOperationCommandError("config operation is still running", "operation_pending");
+    }
+    await wait2(Math.min(interval, Math.max(0, deadline - now())));
+  }
+  printReceipt(receipt, options);
+  if (receipt.state !== "succeeded") throw failureForReceipt(receipt);
+  return receipt;
+}
+async function operationClient(cfg, options, purpose) {
+  const doFetch = options.fetch ?? fetch;
+  const out = options.stdout ?? console;
+  const token = await resolveAdminPlatformToken({
+    platform: cfg.platformUrl,
+    scope: "app:config:write",
+    token: options.token,
+    tokenFile: join3(cfg.rootDir, ".odla", "admin-token.local.json"),
+    rootDir: cfg.rootDir,
+    email: options.email,
+    open: options.open,
+    fetch: doFetch,
+    stdout: out,
+    openApprovalUrl: options.openApprovalUrl,
+    label: `odla CLI (${cfg.app.id} config operation ${purpose})`
+  });
+  return createAppsClient({ endpoint: cfg.platformUrl, token, fetcher: { fetch: doFetch } });
+}
+function printReceipt(receipt, options) {
+  const out = options.stdout ?? console;
+  if (options.json) out.log(JSON.stringify(receipt, null, 2));
+  else {
+    out.log(`config operation ${receipt.operationId}: ${receipt.state}`);
+    out.log(`revision: ${receipt.expectedRevision} \u2192 ${receipt.currentRevision}`);
+    for (const step of receipt.progress) out.log(`  ${step.state}	${step.actionId}	attempts=${step.attempts}`);
+    out.log(`receipt: ${receipt.receiptDigest ?? "pending"}`);
+    out.log(`studio: ${receipt.studioUrl}`);
+  }
+}
+function assertApplyCompleted(receipt) {
+  if (receipt.state === "succeeded") return;
+  throw receipt.state === "running" ? new ConfigOperationCommandError("config operation is still running", "operation_pending") : failureForReceipt(receipt);
+}
+function failureForReceipt(receipt) {
+  if (receipt.state === "conflict") return new ConfigOperationCommandError(
+    receipt.error?.message ?? "config operation conflicted with current Registry state",
+    "checkpoint_required"
+  );
+  if (receipt.error?.retryable) return new ConfigOperationCommandError(receipt.error.message, "remote_unavailable");
+  return new ConfigOperationCommandError(receipt.error?.message ?? `config operation ${receipt.state}`, "config_operation_failed");
+}
+function retainedReceipt(error) {
+  if (!(error instanceof AppsError) || !record3(error.details)) return null;
+  return record3(error.details.operation) ? error.details.operation : null;
+}
+function normalizeRequestError(error) {
+  if (!(error instanceof AppsError)) return error instanceof Error ? error : new Error(String(error));
+  if (error.status === 401 || error.status === 403) {
+    return new ConfigOperationCommandError(error.message, "auth_failed");
+  }
+  if (error.status === 409) return new ConfigOperationCommandError(error.message, "checkpoint_required");
+  if (error.status === 429 || error.status >= 500) {
+    return new ConfigOperationCommandError(error.message, "remote_unavailable");
+  }
+  return new ConfigOperationCommandError(error.message, error.code || "config_operation_failed");
+}
+function record3(value2) {
+  return !!value2 && typeof value2 === "object" && !Array.isArray(value2);
+}
+
+// src/config-reconcile.ts
+import { appServiceIds as appServiceIds2, orderAppServices as orderAppServices2 } from "@odla-ai/apps";
+
 // src/config-reconcile-values.ts
 function difference(path, desired, observed, status, reason, desiredSource, observedSource, env, service) {
   return { path, env, service, status, desired, observed, desiredSource, observedSource, reason };
@@ -1898,6 +2261,7 @@ function reconcileConfig(input) {
     sources: { desired: desiredSource, observed: observedSource },
     desiredRevision,
     observedRevision,
+    registryRevision: input.observed?.configRevision ?? null,
     status: different ? "different" : unmanaged ? "unmanaged" : "in_sync",
     summary: {
       differences: different,
@@ -2050,8 +2414,8 @@ function compareOptionalEnvironmentState(env, desired, observed, desiredSource,
 }
 
 // src/config-reconcile-command.ts
-import { createAppsClient } from "@odla-ai/apps";
-import { join as join3 } from "path";
+import { createAppsClient as createAppsClient2 } from "@odla-ai/apps";
+import { join as join4 } from "path";
 async function configDiff(options) {
   const reconciliation = await inspectConfig(options);
   const { actions: _actions, ...read3 } = reconciliation;
@@ -2065,20 +2429,19 @@ async function configDiff(options) {
 }
 async function configPlan(options) {
   const reconciliation = await inspectConfig(options);
+  const apply = configApplySupport(reconciliation);
   const planDigest = configDigest({
-    schemaVersion: "odla.config-plan/v1",
+    schemaVersion: "odla.config-plan/v2",
     desiredRevision: reconciliation.desiredRevision,
     observedRevision: reconciliation.observedRevision,
+    registryRevision: reconciliation.registryRevision,
     actions: reconciliation.actions
   });
   const document = {
-    schemaVersion: "odla.config-plan/v1",
+    schemaVersion: "odla.config-plan/v2",
     ...reconciliation,
     planDigest,
-    apply: {
-      supported: false,
-      reason: "conditional, resumable config apply is not available yet; use the exact reviewed commands below"
-    },
+    apply,
     nextActions: planNextActions(reconciliation, options.configPath)
   };
   printPlan(document, options);
@@ -2092,7 +2455,7 @@ async function inspectConfig(options) {
     platform: cfg.platformUrl,
     scope: "app:config:read",
     token: options.token,
-    tokenFile: join3(cfg.rootDir, ".odla", "admin-token.local.json"),
+    tokenFile: join4(cfg.rootDir, ".odla", "admin-token.local.json"),
     rootDir: cfg.rootDir,
     email: options.email,
     open: options.open,
@@ -2101,7 +2464,7 @@ async function inspectConfig(options) {
     openApprovalUrl: options.openApprovalUrl,
     label: `odla CLI (${cfg.app.id} config read)`
   });
-  const client = createAppsClient({ endpoint: cfg.platformUrl, token, fetcher: { fetch: doFetch } });
+  const client = createAppsClient2({ endpoint: cfg.platformUrl, token, fetcher: { fetch: doFetch } });
   const observed = await client.resolveApp(cfg.app.id);
   return reconcileConfig({
     desired: desiredRegistryState(cfg),
@@ -2137,7 +2500,7 @@ function printPlan(document, options) {
   }
   if (!document.actions.length) out.log("  no managed changes");
   out.log(`plan digest: ${document.planDigest}`);
-  out.log(`apply: unsupported \u2014 ${document.apply.reason}`);
+  out.log(`apply: ${document.apply.supported ? "supported" : "blocked"} \u2014 ${document.apply.reason}`);
   printNext(out, document.nextActions);
 }
 function printHeader(out, kind, document) {
@@ -2145,6 +2508,7 @@ function printHeader(out, kind, document) {
   out.log(`platform: ${document.scope.platformUrl}`);
   out.log(`desired:  ${document.desiredRevision}`);
   out.log(`observed: ${document.observedRevision ?? "absent"}`);
+  out.log(`registry: ${document.registryRevision ?? "absent"}`);
   out.log(
     `summary: ${document.summary.differences} different, ${document.summary.unmanaged} unmanaged, ${document.summary.actions} planned actions`
   );
@@ -2177,6 +2541,13 @@ function diffNextActions(reconciliation, configPath) {
 }
 function planNextActions(reconciliation, configPath) {
   const next = [];
+  if (configApplySupport(reconciliation).supported) {
+    next.push({
+      code: "apply_frozen_plan",
+      command: "odla-ai config apply --plan <saved-plan.json> --json",
+      description: "Save this JSON document, then conditionally apply these exact revision-bound actions."
+    });
+  }
   if (reconciliation.actions.some((action2) => action2.applySupport === "provision")) {
     next.push({
       code: "review_provision",
@@ -2212,13 +2583,13 @@ function quoteArg2(value2) {
 
 // src/doctor-checks.ts
 import { execFileSync } from "child_process";
-import { existsSync as existsSync5, readFileSync as readFileSync4 } from "fs";
-import { join as join5, resolve as resolve3 } from "path";
+import { existsSync as existsSync5, readFileSync as readFileSync6 } from "fs";
+import { join as join6, resolve as resolve3 } from "path";
 
 // src/wrangler.ts
 import { spawn as spawn2 } from "child_process";
-import { existsSync as existsSync4, readFileSync as readFileSync3 } from "fs";
-import { join as join4 } from "path";
+import { existsSync as existsSync4, readFileSync as readFileSync5 } from "fs";
+import { join as join5 } from "path";
 var defaultRunner = (cmd, args, opts) => new Promise((resolvePromise, reject) => {
   const child = spawn2(cmd, args, { cwd: opts?.cwd, stdio: ["pipe", "pipe", "pipe"] });
   let stdout = "";
@@ -2232,7 +2603,7 @@ var defaultRunner = (cmd, args, opts) => new Promise((resolvePromise, reject) =>
 var WRANGLER_CONFIG_FILES = ["wrangler.jsonc", "wrangler.json", "wrangler.toml"];
 function findWranglerConfig(rootDir) {
   for (const name of WRANGLER_CONFIG_FILES) {
-    const path = join4(rootDir, name);
+    const path = join5(rootDir, name);
     if (existsSync4(path)) return path;
   }
   return null;
@@ -2240,7 +2611,7 @@ function findWranglerConfig(rootDir) {
 function readWranglerConfig(path) {
   if (path.endsWith(".toml")) return null;
   try {
-    return JSON.parse(stripJsonComments(readFileSync3(path, "utf8")));
+    return JSON.parse(stripJsonComments(readFileSync5(path, "utf8")));
   } catch {
     return null;
   }
@@ -2341,7 +2712,7 @@ function wranglerWarnings(rootDir) {
       const dir = resolve3(rootDir, assets.directory);
       if (dir === resolve3(rootDir)) {
         warnings.push(`${label}assets.directory is the project root \u2014 point it at a dedicated build dir (wrangler dev fails with "spawn EBADF")`);
-      } else if (existsSync5(join5(dir, "node_modules"))) {
+      } else if (existsSync5(join6(dir, "node_modules"))) {
         warnings.push(`${label}assets.directory contains node_modules \u2014 wrangler dev's watcher will exhaust file descriptors`);
       }
     }
@@ -2382,7 +2753,7 @@ function o11yProjectWarnings(rootDir) {
   } else {
     let source = "";
     try {
-      source = readFileSync4(main, "utf8");
+      source = readFileSync6(main, "utf8");
     } catch {
     }
     if (!/\bwithObservability\b/.test(source)) {
@@ -2406,7 +2777,7 @@ function calendarProjectWarnings(rootDir) {
 }
 function readPackageJson(rootDir) {
   try {
-    return JSON.parse(readFileSync4(join5(rootDir, "package.json"), "utf8"));
+    return JSON.parse(readFileSync6(join6(rootDir, "package.json"), "utf8"));
   } catch {
     return null;
   }
@@ -2616,7 +2987,7 @@ async function doctor(options) {
 // src/init.ts
 import { existsSync as existsSync6, mkdirSync as mkdirSync2, writeFileSync as writeFileSync2 } from "fs";
 import { dirname as dirname4, resolve as resolve4 } from "path";
-import { appServiceDefinition as appServiceDefinition2, appServiceIds as appServiceIds3 } from "@odla-ai/apps";
+import { appServiceDefinition as appServiceDefinition3, appServiceIds as appServiceIds3 } from "@odla-ai/apps";
 function initProject(options) {
   const out = options.stdout ?? console;
   const rootDir = resolve4(options.rootDir ?? process.cwd());
@@ -2630,7 +3001,7 @@ function initProject(options) {
   const envs = options.envs?.length ? options.envs : ["dev"];
   const services = options.services?.length ? options.services : ["db", "ai"];
   for (const service of services) {
-    const definition = appServiceDefinition2(service);
+    const definition = appServiceDefinition3(service);
     if (!definition) throw new Error(`--services contains unknown service "${service}" (known: ${appServiceIds3().join(", ")})`);
     for (const dependency of definition.requires) {
       if (!services.includes(dependency)) throw new Error(`--services ${service} requires ${dependency}`);
@@ -2881,9 +3252,9 @@ async function resolveVaultWrite(options) {
 }
 
 // src/skill.ts
-import { existsSync as existsSync7, lstatSync, mkdirSync as mkdirSync3, readFileSync as readFileSync5, readdirSync, writeFileSync as writeFileSync3 } from "fs";
+import { existsSync as existsSync7, lstatSync, mkdirSync as mkdirSync3, readFileSync as readFileSync7, readdirSync, writeFileSync as writeFileSync3 } from "fs";
 import { homedir } from "os";
-import { dirname as dirname5, isAbsolute as isAbsolute3, join as join6, relative as relative2, resolve as resolve5, sep } from "path";
+import { dirname as dirname5, isAbsolute as isAbsolute3, join as join7, relative as relative2, resolve as resolve5, sep } from "path";
 import { fileURLToPath } from "url";
 
 // src/skill-adapters.ts
@@ -2977,12 +3348,12 @@ function installSkill(options = {}) {
     plans.set(target, { target, content: content2, boundary, managedMerge });
   };
   const planSkillTree = (targetDir2, boundary = root) => {
-    for (const rel of files) plan(join6(targetDir2, rel), readFileSync5(join6(sourceDir, rel), "utf8"), false, boundary);
+    for (const rel of files) plan(join7(targetDir2, rel), readFileSync7(join7(sourceDir, rel), "utf8"), false, boundary);
   };
   let targetDir;
   if (options.global) {
-    const claudeRoot = join6(home, ".claude", "skills");
-    const codexRoot = resolve5(options.codexHomeDir ?? process.env.CODEX_HOME ?? join6(home, ".codex"), "skills");
+    const claudeRoot = join7(home, ".claude", "skills");
+    const codexRoot = resolve5(options.codexHomeDir ?? process.env.CODEX_HOME ?? join7(home, ".codex"), "skills");
     targetDir = harnesses[0] === "codex" ? codexRoot : claudeRoot;
     for (const harness of harnesses) {
       const skillRoot = harness === "claude" ? claudeRoot : codexRoot;
@@ -2990,35 +3361,35 @@ function installSkill(options = {}) {
       rememberTarget(harness, skillRoot);
     }
   } else {
-    const sharedRoot = join6(root, ".agents", "skills");
+    const sharedRoot = join7(root, ".agents", "skills");
     planSkillTree(sharedRoot);
-    const claudeRoot = join6(root, ".claude", "skills");
+    const claudeRoot = join7(root, ".claude", "skills");
     targetDir = harnesses.includes("claude") ? claudeRoot : sharedRoot;
     for (const harness of harnesses) rememberTarget(harness, sharedRoot);
     if (harnesses.includes("claude")) {
       for (const skill of skillNames(files)) {
-        const canonical = readFileSync5(join6(sourceDir, skill, "SKILL.md"), "utf8");
-        plan(join6(claudeRoot, skill, "SKILL.md"), claudeAdapter(skill, canonical));
+        const canonical = readFileSync7(join7(sourceDir, skill, "SKILL.md"), "utf8");
+        plan(join7(claudeRoot, skill, "SKILL.md"), claudeAdapter(skill, canonical));
       }
       rememberTarget("claude", claudeRoot);
     }
     if (harnesses.includes("cursor")) {
-      const cursorRule = join6(root, ".cursor", "rules", "odla.mdc");
+      const cursorRule = join7(root, ".cursor", "rules", "odla.mdc");
       plan(cursorRule, CURSOR_RULE);
       rememberTarget("cursor", cursorRule);
     }
     if (harnesses.includes("agents")) {
-      const agentsFile = join6(root, "AGENTS.md");
+      const agentsFile = join7(root, "AGENTS.md");
       plan(agentsFile, managedFileContent(agentsFile, PROJECT_INSTRUCTIONS, options.force === true, root), true);
       rememberTarget("agents", agentsFile);
     }
     if (harnesses.includes("copilot")) {
-      const copilotFile = join6(root, ".github", "copilot-instructions.md");
+      const copilotFile = join7(root, ".github", "copilot-instructions.md");
       plan(copilotFile, managedFileContent(copilotFile, PROJECT_INSTRUCTIONS, options.force === true, root), true);
       rememberTarget("copilot", copilotFile);
     }
     if (harnesses.includes("gemini")) {
-      const geminiFile = join6(root, "GEMINI.md");
+      const geminiFile = join7(root, "GEMINI.md");
       plan(geminiFile, managedFileContent(geminiFile, PROJECT_INSTRUCTIONS, options.force === true, root), true);
       rememberTarget("gemini", geminiFile);
     }
@@ -3036,7 +3407,7 @@ function installSkill(options = {}) {
       writtenPaths.add(file.target);
       continue;
     }
-    const current = readFileSync5(file.target, "utf8");
+    const current = readFileSync7(file.target, "utf8");
     if (current === file.content) {
       unchangedPaths.add(file.target);
     } else if (file.managedMerge || options.force) {
@@ -3053,7 +3424,7 @@ ${conflicts.map((f) => `  - ${f}`).join("\n")}`
     );
   }
   for (const file of plans.values()) {
-    if (!existsSync7(file.target) || readFileSync5(file.target, "utf8") !== file.content) {
+    if (!existsSync7(file.target) || readFileSync7(file.target, "utf8") !== file.content) {
       mkdirSync3(dirname5(file.target), { recursive: true });
       writeFileSync3(file.target, file.content);
     }
@@ -3098,7 +3469,7 @@ function managedFileContent(path, block, force, boundary) {
   if (symlink) throw new Error(`refusing to manage ${path}: symbolic link component ${symlink}`);
   if (!existsSync7(path)) return `${block}
 `;
-  const current = readFileSync5(path, "utf8");
+  const current = readFileSync7(path, "utf8");
   const start = "<!-- odla-ai agent setup:start -->";
   const end = "<!-- odla-ai agent setup:end -->";
   const startAt = current.indexOf(start);
@@ -3125,7 +3496,7 @@ function symlinkedComponent(boundary, target) {
   }
   let current = boundary;
   for (const part of rel.split(sep).filter(Boolean)) {
-    current = join6(current, part);
+    current = join7(current, part);
     try {
       if (lstatSync(current).isSymbolicLink()) return current;
     } catch (error) {
@@ -3142,7 +3513,7 @@ function listFiles(dir) {
   const results = [];
   const walk = (current) => {
     for (const entry of readdirSync(current, { withFileTypes: true })) {
-      const path = join6(current, entry.name);
+      const path = join7(current, entry.name);
       if (entry.isDirectory()) walk(path);
       else results.push(relative2(dir, path));
     }
@@ -3533,7 +3904,7 @@ import { spawn as spawn3 } from "child_process";
 import { createHash as createHash2 } from "crypto";
 import { copyFile, mkdtemp, readFile, rm, writeFile } from "fs/promises";
 import { tmpdir } from "os";
-import { join as join7 } from "path";
+import { join as join8 } from "path";
 import { fileURLToPath as fileURLToPath2 } from "url";
 var runCodeImageCommand = (command, args, stdio) => new Promise((accept, reject) => {
   const child = spawn3(command, [...args], { shell: false, stdio });
@@ -3592,10 +3963,10 @@ async function embeddedPiImageName() {
   return `odla-ai/pi-agent:embedded-sha256-${createHash2("sha256").update(bundle).digest("hex")}`;
 }
 async function buildEmbeddedPiImage(engine, image, run) {
-  const context = await mkdtemp(join7(tmpdir(), "odla-code-pi-"));
+  const context = await mkdtemp(join8(tmpdir(), "odla-code-pi-"));
   try {
-    await copyFile(embeddedPiAssetPath(), join7(context, "pi-agent.js"));
-    await writeFile(join7(context, "Dockerfile"), [
+    await copyFile(embeddedPiAssetPath(), join8(context, "pi-agent.js"));
+    await writeFile(join8(context, "Dockerfile"), [
       `FROM ${CODE_NODE_IMAGE}`,
       "COPY pi-agent.js /opt/odla/pi-agent.js",
       "WORKDIR /workspace",
@@ -3621,7 +3992,7 @@ var CONTROL = /[\u0000-\u0008\u000b\u000c\u000e-\u001f\u007f]/;
 var HarnessProtocolError = class extends Error {
   name = "HarnessProtocolError";
 };
-function record2(value2) {
+function record4(value2) {
   return value2 !== null && typeof value2 === "object" && !Array.isArray(value2) ? value2 : null;
 }
 function boundedText(value2, label, max) {
@@ -3638,7 +4009,7 @@ function parseAgentOutput(line) {
   } catch {
     throw new HarnessProtocolError("agent emitted invalid JSON");
   }
-  const message2 = record2(value2);
+  const message2 = record4(value2);
   if (!message2 || message2.protocolVersion !== HARNESS_PROTOCOL_VERSION) {
     throw new HarnessProtocolError(`agent protocolVersion must be ${HARNESS_PROTOCOL_VERSION}`);
   }
@@ -3651,7 +4022,7 @@ function parseAgentOutput(line) {
     };
   }
   if (message2.type === "inference.request") {
-    const call2 = record2(message2.call);
+    const call2 = record4(message2.call);
     if (!call2 || !Array.isArray(call2.messages) || !Number.isSafeInteger(call2.maxTokens)) {
       throw new HarnessProtocolError("inference.request.call requires messages and maxTokens");
     }
@@ -3663,7 +4034,7 @@ function parseAgentOutput(line) {
     };
   }
   if (message2.type === "tool.request") {
-    const input = record2(message2.input);
+    const input = record4(message2.input);
     const tool = String(message2.tool);
     if (!input || !["sandbox.read", "sandbox.apply_patch", "sandbox.run_recipe"].includes(tool)) {
       throw new HarnessProtocolError("tool.request requires a registered tool and object input");
@@ -3698,7 +4069,7 @@ function encodeAgentInput(message2) {
 import { execFile as execFile2, spawn as spawn4 } from "child_process";
 import { constants } from "fs";
 import { access } from "fs/promises";
-import { delimiter, join as join8 } from "path";
+import { delimiter, join as join9 } from "path";
 import { getgid, getuid } from "process";
 import { mkdir, mkdtemp as mkdtemp2, realpath, rm as rm2, writeFile as writeFile2 } from "fs/promises";
 import { tmpdir as tmpdir2 } from "os";
@@ -3716,7 +4087,7 @@ function assertPinnedImage(image) {
 async function commandAvailable(engine) {
   for (const directory of (process.env.PATH ?? "").split(delimiter).filter(Boolean)) {
     try {
-      await access(join8(directory, engine), constants.X_OK);
+      await access(join9(directory, engine), constants.X_OK);
       return true;
     } catch {
     }
@@ -4006,8 +4377,8 @@ async function materializeGitTree(source, commitSha, options = {}) {
   const maxFiles = options.maxFiles ?? 2e4;
   const maxBytes = options.maxBytes ?? 512 * 1024 * 1024;
   const inventory = (await gitOutput(sourceDir, ["ls-tree", "-rz", commitSha], 16 * 1024 * 1024)).toString("utf8").split("\0").filter(Boolean);
-  const entries = inventory.flatMap((record8) => {
-    const match = /^(100644|100755) blob ([0-9a-f]{40,64})\t([\s\S]+)$/.exec(record8);
+  const entries = inventory.flatMap((record10) => {
+    const match = /^(100644|100755) blob ([0-9a-f]{40,64})\t([\s\S]+)$/.exec(record10);
     return match && allowedWorkspacePath(match[3]) ? [{ mode: match[1], hash: match[2], path: match[3] }] : [];
   });
   if (entries.length > maxFiles) throw new Error(`workspace exceeds ${maxFiles} files`);
@@ -4255,8 +4626,8 @@ function normalize(value2) {
   if (Array.isArray(value2)) return value2.map(normalize);
   if (value2 instanceof Uint8Array) return { $bytes: [...value2] };
   if (typeof value2 === "object") {
-    const record8 = value2;
-    return Object.fromEntries(Object.keys(record8).filter((key) => record8[key] !== void 0).sort().map((key) => [key, normalize(record8[key])]));
+    const record10 = value2;
+    return Object.fromEntries(Object.keys(record10).filter((key) => record10[key] !== void 0).sort().map((key) => [key, normalize(record10[key])]));
   }
   throw new CamelError("state_conflict", "Canonical JSON rejects unsupported values.");
 }
@@ -4335,7 +4706,7 @@ function normalizeReaders(readers) {
 }
 
 // ../camel/dist/code.js
-var DIGEST = /^sha256:[0-9a-f]{64}$/;
+var DIGEST2 = /^sha256:[0-9a-f]{64}$/;
 var SHA = /^[0-9a-f]{40}(?:[0-9a-f]{24})?$/;
 var ID = /^[A-Za-z0-9._:-]{1,160}$/;
 async function digestCodeVerificationReceipt(fields) {
@@ -4370,18 +4741,18 @@ async function digestCodeVerificationReceipt(fields) {
   return `sha256:${await sha256Hex(canonicalJson2(canonical))}`;
 }
 function validate(fields) {
-  if (fields.schemaVersion !== 1 || typeof fields.verificationId !== "string" || !ID.test(fields.verificationId) || typeof fields.trustedBaseCommitSha !== "string" || !SHA.test(fields.trustedBaseCommitSha) || !DIGEST.test(fields.trustedBaseDigest) || !DIGEST.test(fields.patchDigest) || !DIGEST.test(fields.candidateDigest) || !DIGEST.test(fields.sourceDigest) || !DIGEST.test(fields.policyDigest) || !DIGEST.test(fields.changedTestSetDigest) || !Number.isSafeInteger(fields.changedTestCount) || fields.changedTestCount < 0 || fields.changedTestCount > 1e4 || fields.changedTestsRequireReview !== fields.changedTestCount > 0 || fields.recipes.length < 1 || fields.recipes.length > 64) {
+  if (fields.schemaVersion !== 1 || typeof fields.verificationId !== "string" || !ID.test(fields.verificationId) || typeof fields.trustedBaseCommitSha !== "string" || !SHA.test(fields.trustedBaseCommitSha) || !DIGEST2.test(fields.trustedBaseDigest) || !DIGEST2.test(fields.patchDigest) || !DIGEST2.test(fields.candidateDigest) || !DIGEST2.test(fields.sourceDigest) || !DIGEST2.test(fields.policyDigest) || !DIGEST2.test(fields.changedTestSetDigest) || !Number.isSafeInteger(fields.changedTestCount) || fields.changedTestCount < 0 || fields.changedTestCount > 1e4 || fields.changedTestsRequireReview !== fields.changedTestCount > 0 || fields.recipes.length < 1 || fields.recipes.length > 64) {
     throw new CamelError("state_conflict", "Code verification receipt is malformed or outside its bounds.");
   }
   const ids = /* @__PURE__ */ new Set();
   for (const recipe2 of fields.recipes) {
-    if (typeof recipe2.recipeId !== "string" || !ID.test(recipe2.recipeId) || ids.has(recipe2.recipeId) || typeof recipe2.recipeDigest !== "string" || !DIGEST.test(recipe2.recipeDigest) || !["passed", "failed", "timed_out", "output_limited"].includes(recipe2.status) || !Number.isSafeInteger(recipe2.exitCode) || recipe2.exitCode < 0 || recipe2.exitCode > 255 || !Number.isSafeInteger(recipe2.durationMs) || recipe2.durationMs < 0 || recipe2.durationMs > 30 * 6e4) {
+    if (typeof recipe2.recipeId !== "string" || !ID.test(recipe2.recipeId) || ids.has(recipe2.recipeId) || typeof recipe2.recipeDigest !== "string" || !DIGEST2.test(recipe2.recipeDigest) || !["passed", "failed", "timed_out", "output_limited"].includes(recipe2.status) || !Number.isSafeInteger(recipe2.exitCode) || recipe2.exitCode < 0 || recipe2.exitCode > 255 || !Number.isSafeInteger(recipe2.durationMs) || recipe2.durationMs < 0 || recipe2.durationMs > 30 * 6e4) {
       throw new CamelError("state_conflict", "Code verification recipe receipt is malformed or outside its bounds.");
     }
     const artifactIds = /* @__PURE__ */ new Set();
     if (recipe2.artifacts.length > 64) throw new CamelError("state_conflict", "Code verification has too many artifacts.");
     for (const artifact of recipe2.artifacts) {
-      if (typeof artifact.artifactId !== "string" || !ID.test(artifact.artifactId) || artifactIds.has(artifact.artifactId) || !["verified", "missing", "invalid", "too_large"].includes(artifact.status) || artifact.bytes !== null && (!Number.isSafeInteger(artifact.bytes) || artifact.bytes < 0) || artifact.digest !== null && !DIGEST.test(artifact.digest) || artifact.status === "verified" !== (artifact.bytes !== null && artifact.digest !== null) || ["missing", "invalid"].includes(artifact.status) && (artifact.bytes !== null || artifact.digest !== null) || artifact.status === "too_large" && (artifact.bytes === null || artifact.digest !== null)) {
+      if (typeof artifact.artifactId !== "string" || !ID.test(artifact.artifactId) || artifactIds.has(artifact.artifactId) || !["verified", "missing", "invalid", "too_large"].includes(artifact.status) || artifact.bytes !== null && (!Number.isSafeInteger(artifact.bytes) || artifact.bytes < 0) || artifact.digest !== null && !DIGEST2.test(artifact.digest) || artifact.status === "verified" !== (artifact.bytes !== null && artifact.digest !== null) || ["missing", "invalid"].includes(artifact.status) && (artifact.bytes !== null || artifact.digest !== null) || artifact.status === "too_large" && (artifact.bytes === null || artifact.digest !== null)) {
         throw new CamelError("state_conflict", "Code verification artifact receipt is malformed.");
       }
       artifactIds.add(artifact.artifactId);
@@ -4397,7 +4768,7 @@ function validate(fields) {
   }
 }
 var SHA2 = /^[0-9a-f]{40}(?:[0-9a-f]{24})?$/;
-var DIGEST2 = /^sha256:[0-9a-f]{64}$/;
+var DIGEST22 = /^sha256:[0-9a-f]{64}$/;
 var ID2 = /^[A-Za-z0-9._:-]{1,180}$/;
 var MAX_PATCH_BYTES = 256 * 1024;
 var MAX_STATE_BYTES = 64 * 1024;
@@ -4442,14 +4813,14 @@ function normalizeState(value2) {
   ]);
   const planCursor = state2.planCursor;
   const conversations = strings(state2.conversationRefs, "conversationRefs", ID2, 256, false);
-  const approvals = strings(state2.unresolvedApprovals, "unresolvedApprovals", DIGEST2, 256, true);
-  if (planCursor !== null && (typeof planCursor !== "string" || !ID2.test(planCursor)) || typeof state2.planningInputDigest !== "string" || !DIGEST2.test(state2.planningInputDigest) || typeof state2.buildPolicyDigest !== "string" || !DIGEST2.test(state2.buildPolicyDigest) || state2.dependencyLayerDigest !== null && (typeof state2.dependencyLayerDigest !== "string" || !DIGEST2.test(state2.dependencyLayerDigest)) || state2.verificationDigest !== null && (typeof state2.verificationDigest !== "string" || !DIGEST2.test(state2.verificationDigest)) || state2.reviewDigest !== null && (typeof state2.reviewDigest !== "string" || !DIGEST2.test(state2.reviewDigest)) || !["candidate_untrusted", "verified", "reviewed"].includes(String(state2.trustStatus)) || !Array.isArray(state2.completedEffects) || state2.completedEffects.length > 256) {
+  const approvals = strings(state2.unresolvedApprovals, "unresolvedApprovals", DIGEST22, 256, true);
+  if (planCursor !== null && (typeof planCursor !== "string" || !ID2.test(planCursor)) || typeof state2.planningInputDigest !== "string" || !DIGEST22.test(state2.planningInputDigest) || typeof state2.buildPolicyDigest !== "string" || !DIGEST22.test(state2.buildPolicyDigest) || state2.dependencyLayerDigest !== null && (typeof state2.dependencyLayerDigest !== "string" || !DIGEST22.test(state2.dependencyLayerDigest)) || state2.verificationDigest !== null && (typeof state2.verificationDigest !== "string" || !DIGEST22.test(state2.verificationDigest)) || state2.reviewDigest !== null && (typeof state2.reviewDigest !== "string" || !DIGEST22.test(state2.reviewDigest)) || !["candidate_untrusted", "verified", "reviewed"].includes(String(state2.trustStatus)) || !Array.isArray(state2.completedEffects) || state2.completedEffects.length > 256) {
     throw invalid2("Portable checkpoint state is malformed or outside its bounds.");
   }
   const effects = state2.completedEffects.map((item) => {
     const effect = object(item, "completed effect");
     exact2(effect, ["effectId", "actionDigest", "receiptDigest"]);
-    if (typeof effect.effectId !== "string" || !ID2.test(effect.effectId) || typeof effect.actionDigest !== "string" || !DIGEST2.test(effect.actionDigest) || typeof effect.receiptDigest !== "string" || !DIGEST2.test(effect.receiptDigest)) {
+    if (typeof effect.effectId !== "string" || !ID2.test(effect.effectId) || typeof effect.actionDigest !== "string" || !DIGEST22.test(effect.actionDigest) || typeof effect.receiptDigest !== "string" || !DIGEST22.test(effect.receiptDigest)) {
       throw invalid2("Portable checkpoint effect receipt is malformed.");
     }
     return {
@@ -4558,7 +4929,7 @@ import { randomUUID } from "crypto";
 import { createHash as createHash22, randomUUID as randomUUID2 } from "crypto";
 import { createReadStream } from "fs";
 import { lstat as lstat22 } from "fs/promises";
-import { join as join9 } from "path";
+import { join as join10 } from "path";
 import { mkdir as mkdir3, mkdtemp as mkdtemp3, rm as rm3, writeFile as writeFile3 } from "fs/promises";
 import { tmpdir as tmpdir3 } from "os";
 import { dirname as dirname6, join as join23, resolve as resolve32, sep as sep23 } from "path";
@@ -4979,7 +5350,7 @@ function createCodeRuntimeControlClient(options) {
     }
     const value2 = await response2.json().catch(() => null);
     if (!response2.ok) {
-      const problem = record3(record3(value2)?.error);
+      const problem = record5(record5(value2)?.error);
       throw new CodeRuntimeControlError(
         typeof problem?.message === "string" ? problem.message : `Code runtime request failed (${response2.status})`,
         response2.status,
@@ -5001,12 +5372,12 @@ function createCodeRuntimeControlClient(options) {
       await call2(`/registry/code/runtime/sessions/${validSessionId(sessionId)}/source`, {})
     ),
     infer: async (sessionId, inference) => {
-      const value2 = record3(await call2(
+      const value2 = record5(await call2(
         `/registry/code/runtime/sessions/${validSessionId(sessionId)}/inference`,
         inference,
         modelRequestTimeoutMs
       ));
-      if (!value2 || value2.requestId !== inference.requestId || !record3(value2.response) || !record3(value2.receipt)) {
+      if (!value2 || value2.requestId !== inference.requestId || !record5(value2.response) || !record5(value2.receipt)) {
         throw new CodeRuntimeControlError("invalid Code inference response", 502, "invalid_response");
       }
       return value2;
@@ -5064,12 +5435,12 @@ function validateHeartbeat(version, capabilities) {
   }
 }
 function parseSnapshot(value2) {
-  const root = record3(value2);
-  const host = record3(root?.host);
+  const root = record5(value2);
+  const host = record5(root?.host);
   if (!host || typeof host.hostId !== "string" || typeof host.runtimeVersion !== "string" || !Number.isSafeInteger(host.lastSeenAt) || host.revokedAt !== null || !Array.isArray(root?.bindings) || root.bindings.length > 1024 || !Array.isArray(root?.commands) || root.commands.length > 64) throw invalid("heartbeat");
   const bindingIds = /* @__PURE__ */ new Set();
   const bindings = root.bindings.map((item) => {
-    const binding = record3(item);
+    const binding = record5(item);
     if (!binding || typeof binding.bindingId !== "string" || typeof binding.appId !== "string" || binding.env !== "dev" && binding.env !== "prod" || typeof binding.offerId !== "string" || binding.hostId !== host.hostId || !Number.isSafeInteger(binding.generation) || Number(binding.generation) < 1 || binding.revokedAt !== null || bindingIds.has(binding.bindingId)) {
       throw invalid("binding");
     }
@@ -5079,10 +5450,10 @@ function parseSnapshot(value2) {
   const commandIds = /* @__PURE__ */ new Set();
   const commandSequences = /* @__PURE__ */ new Set();
   const commands = root.commands.map((item) => {
-    const command = record3(item);
+    const command = record5(item);
     const binding = bindings.find((candidate) => candidate.bindingId === command?.bindingId);
     const sequenceKey = `${String(command?.instanceId)}:${String(command?.sequence)}`;
-    if (!command || typeof command.commandId !== "string" || !/^ccmd_[0-9a-f]{32}$/.test(command.commandId) || typeof command.instanceId !== "string" || typeof command.sessionId !== "string" || !/^csess_[0-9a-f]{32}$/.test(command.sessionId) || typeof command.appId !== "string" || command.env !== "dev" && command.env !== "prod" || command.hostId !== host.hostId || !binding || binding.appId !== command.appId || binding.generation !== command.bindingGeneration || !Number.isSafeInteger(command.sequence) || Number(command.sequence) < 1 || commandIds.has(command.commandId) || commandSequences.has(sequenceKey) || !["start", "prompt", "checkpoint_stop", "resume"].includes(String(command.kind)) || !record3(command.payload) || !Number.isSafeInteger(command.createdAt)) throw invalid("command");
+    if (!command || typeof command.commandId !== "string" || !/^ccmd_[0-9a-f]{32}$/.test(command.commandId) || typeof command.instanceId !== "string" || typeof command.sessionId !== "string" || !/^csess_[0-9a-f]{32}$/.test(command.sessionId) || typeof command.appId !== "string" || command.env !== "dev" && command.env !== "prod" || command.hostId !== host.hostId || !binding || binding.appId !== command.appId || binding.generation !== command.bindingGeneration || !Number.isSafeInteger(command.sequence) || Number(command.sequence) < 1 || commandIds.has(command.commandId) || commandSequences.has(sequenceKey) || !["start", "prompt", "checkpoint_stop", "resume"].includes(String(command.kind)) || !record5(command.payload) || !Number.isSafeInteger(command.createdAt)) throw invalid("command");
     commandIds.add(command.commandId);
     commandSequences.add(sequenceKey);
     return command;
@@ -5090,10 +5461,10 @@ function parseSnapshot(value2) {
   return { host, bindings, commands };
 }
 async function parseSource(value2) {
-  const snapshot = record3(record3(value2)?.snapshot);
+  const snapshot = record5(record5(value2)?.snapshot);
   if (!snapshot || typeof snapshot.repository !== "string" || typeof snapshot.commitSha !== "string" || typeof snapshot.treeDigest !== "string" || !Array.isArray(snapshot.files)) throw invalid("source");
   const files = snapshot.files.map((value22) => {
-    const file = record3(value22);
+    const file = record5(value22);
     if (!file || typeof file.path !== "string" || typeof file.content !== "string") throw invalid("source file");
     return { path: file.path, content: file.content };
   });
@@ -5102,11 +5473,11 @@ async function parseSource(value2) {
   const aliases = /* @__PURE__ */ new Set();
   const references = [];
   for (const item of referencesValue) {
-    const reference = record3(item);
+    const reference = record5(item);
     if (!reference || typeof reference.alias !== "string" || !/^[a-z][a-z0-9-]{0,39}$/.test(reference.alias) || aliases.has(reference.alias) || reference.alias === "primary" || typeof reference.repository !== "string" || typeof reference.commitSha !== "string" || typeof reference.treeDigest !== "string" || !Array.isArray(reference.files)) throw invalid("reference source");
     aliases.add(reference.alias);
     const referenceFiles = reference.files.map((entry) => {
-      const file = record3(entry);
+      const file = record5(entry);
       if (!file || typeof file.path !== "string" || typeof file.content !== "string") throw invalid("reference source file");
       return { path: file.path, content: file.content };
     });
@@ -5121,18 +5492,18 @@ async function parseSource(value2) {
   return { ...source, treeDigest: digest, ...references.length ? { references } : {} };
 }
 function parseReview(value2) {
-  const review = record3(record3(value2)?.review);
+  const review = record5(record5(value2)?.review);
   if (!review || !["approved", "rejected"].includes(String(review.verdict)) || typeof review.reviewDigest !== "string" || !/^sha256:[0-9a-f]{64}$/.test(review.reviewDigest) || typeof review.provider !== "string" || !review.provider || typeof review.model !== "string" || !review.model || !Number.isSafeInteger(review.policyVersion) || Number(review.policyVersion) < 1) throw invalid("review");
   return review;
 }
 function parseCandidate(value2) {
-  const candidate = record3(record3(value2)?.candidate);
+  const candidate = record5(record5(value2)?.candidate);
   if (!candidate || typeof candidate.candidateId !== "string" || !/^ccand_[0-9a-f]{32}$/.test(candidate.candidateId) || !["submitted", "approved", "published", "failed"].includes(String(candidate.status))) {
     throw invalid("candidate");
   }
   return { candidateId: candidate.candidateId, status: candidate.status };
 }
-var record3 = (value2) => value2 && typeof value2 === "object" && !Array.isArray(value2) ? value2 : null;
+var record5 = (value2) => value2 && typeof value2 === "object" && !Array.isArray(value2) ? value2 : null;
 var invalid = (part) => new CodeRuntimeControlError(`invalid Code runtime ${part} response`, 502, "invalid_response");
 var RESERVED = /* @__PURE__ */ new Set([".git", ".odla", ".wrangler", "node_modules", "dist", "coverage"]);
 var SECRET = /^(?:\.env(?:\..+)?|\.dev\.vars|credentials(?:\..+)?\.json|dev-token(?:\..+)?\.json)$/i;
@@ -5477,7 +5848,7 @@ async function inspectArtifacts(workspaceDir, recipe2) {
   const receipts = [];
   for (const artifact of recipe2.expectedArtifacts ?? []) {
     try {
-      const path = join9(workspaceDir, artifact.path);
+      const path = join10(workspaceDir, artifact.path);
       const info = await lstat22(path);
       if (!info.isFile() || info.isSymbolicLink()) {
         receipts.push({ artifactId: artifact.id, status: "invalid", bytes: null, digest: null });
@@ -6495,13 +6866,6 @@ var CodePiRuntimeEngine = class {
   }
 };
 
-// src/version.ts
-import { readFileSync as readFileSync6 } from "fs";
-function cliVersion() {
-  const pkg = JSON.parse(readFileSync6(new URL("../package.json", import.meta.url), "utf8"));
-  return pkg.version ?? "unknown";
-}
-
 // src/code-local-source.ts
 import { execFile as execFile3 } from "child_process";
 import { createHash as createHash4 } from "crypto";
@@ -6720,25 +7084,25 @@ async function runCodeRuntime(input) {
   }
 }
 function parseConnection(value2, appId, appEnv) {
-  const root = record4(value2);
-  const host = record4(root?.host);
-  const offer = record4(root?.offer);
-  const binding = record4(root?.binding);
+  const root = record6(value2);
+  const host = record6(root?.host);
+  const offer = record6(root?.offer);
+  const binding = record6(root?.binding);
   if (!root || typeof root.token !== "string" || !/^odla_code_host_[0-9a-f]{64}$/.test(root.token) || typeof root.resumed !== "boolean" || !host || !/^chost_[0-9a-f]{32}$/.test(String(host.hostId)) || typeof host.name !== "string" || !offer || !Number.isSafeInteger(offer.slots) || !binding || typeof binding.appId !== "string" || !binding.appId || appId && binding.appId !== appId || binding.env !== appEnv || !Number.isSafeInteger(binding.generation)) {
     throw new Error("connect Code host returned an invalid response");
   }
   return root;
 }
 function apiFailure(action2, status, value2) {
-  const message2 = record4(record4(value2)?.error)?.message;
+  const message2 = record6(record6(value2)?.error)?.message;
   return `${action2} failed (${status})${typeof message2 === "string" ? `: ${message2}` : ""}`;
 }
-function record4(value2) {
+function record6(value2) {
   return value2 && typeof value2 === "object" && !Array.isArray(value2) ? value2 : null;
 }
 
 // src/provision.ts
-import { createAppsClient as createAppsClient2, orderAppServices as orderAppServices3, tenantIdFor as tenantIdFor4 } from "@odla-ai/apps";
+import { createAppsClient as createAppsClient3, orderAppServices as orderAppServices3, tenantIdFor as tenantIdFor4 } from "@odla-ai/apps";
 import { putSecret as putSecret2 } from "@odla-ai/ai";
 import process8 from "process";
 
@@ -6959,7 +7323,7 @@ async function provision(options) {
   }
   const doFetch = options.fetch ?? fetch;
   const token = await getDeveloperToken(cfg, options, doFetch, out);
-  const apps = createAppsClient2({ endpoint: cfg.platformUrl, token, fetcher: { fetch: doFetch } });
+  const apps = createAppsClient3({ endpoint: cfg.platformUrl, token, fetcher: { fetch: doFetch } });
   const existing = await apps.resolveApp(cfg.app.id);
   if (existing) {
     out.log(`app: ${cfg.app.id} already exists`);
@@ -7133,7 +7497,7 @@ var COMMAND_SURFACE = {
   calendar: { status: {}, calendars: {}, connect: {}, disconnect: {} },
   capabilities: {},
   code: { connect: {} },
-  config: { diff: {}, plan: {} },
+  config: { diff: {}, plan: {}, apply: {} },
   context: { show: {}, list: {}, save: {}, remove: {} },
   // `watch`, `read`, `reply`, and `resolve` take a topic id from there on.
   discuss: {
@@ -7151,6 +7515,7 @@ var COMMAND_SURFACE = {
   help: {},
   init: {},
   o11y: { status: {} },
+  operations: { get: {}, wait: {} },
   platform: { status: {} },
   pm: {
     ...PM_ENTITIES,
@@ -7588,17 +7953,17 @@ function addOption(options, name, value2) {
 
 // src/operator-context.ts
 import { existsSync as existsSync10 } from "fs";
-import { join as join11, resolve as resolve11 } from "path";
+import { join as join12, resolve as resolve11 } from "path";
 import process10 from "process";
 
 // src/operator-profiles.ts
-import { existsSync as existsSync9, readFileSync as readFileSync7 } from "fs";
+import { existsSync as existsSync9, readFileSync as readFileSync8 } from "fs";
 import { homedir as homedir2 } from "os";
-import { dirname as dirname7, join as join10, resolve as resolve10 } from "path";
+import { dirname as dirname7, join as join11, resolve as resolve10 } from "path";
 import process9 from "process";
 function operatorProfileFile() {
   return resolve10(
-    clean(process9.env.ODLA_CONTEXT_FILE) ?? join10(homedir2(), ".odla", "contexts.json")
+    clean(process9.env.ODLA_CONTEXT_FILE) ?? join11(homedir2(), ".odla", "contexts.json")
   );
 }
 function resolveOperatorProfile(parsed) {
@@ -7643,10 +8008,10 @@ function removeOperatorProfile(name, file = operatorProfileFile()) {
   return true;
 }
 function operatorCredentialFiles(selection) {
-  const base = selection.name ? join10(dirname7(selection.file), "profiles", selection.name) : join10(homedir2(), ".odla");
+  const base = selection.name ? join11(dirname7(selection.file), "profiles", selection.name) : join11(homedir2(), ".odla");
   return {
-    developer: join10(base, "dev-token.json"),
-    scoped: join10(base, "admin-token.local.json")
+    developer: join11(base, "dev-token.json"),
+    scoped: join11(base, "admin-token.local.json")
   };
 }
 function assertOperatorName(value2, label) {
@@ -7660,7 +8025,7 @@ function readOperatorProfiles(file) {
   if (!existsSync9(file)) return emptyProfiles();
   let raw;
   try {
-    raw = JSON.parse(readFileSync7(file, "utf8"));
+    raw = JSON.parse(readFileSync8(file, "utf8"));
   } catch {
     throw new Error(`operator context file ${file} is not valid JSON`);
   }
@@ -7757,7 +8122,7 @@ async function resolveOperatorContext(parsed, options = {}) {
   const rootDir = loaded?.rootDir ?? process10.cwd();
   const profileCredentials = operatorCredentialFiles(profile);
   const tokenFile = clean2(process10.env.ODLA_DEV_TOKEN_FILE) ? resolve11(process10.env.ODLA_DEV_TOKEN_FILE) : profile.name ? profileCredentials.developer : loaded?.local.tokenFile ?? profileCredentials.developer;
-  const scopedTokenFile = clean2(process10.env.ODLA_ADMIN_TOKEN_FILE) ? resolve11(process10.env.ODLA_ADMIN_TOKEN_FILE) : profile.name ? profileCredentials.scoped : loaded ? join11(loaded.rootDir, ".odla", "admin-token.local.json") : profileCredentials.scoped;
+  const scopedTokenFile = clean2(process10.env.ODLA_ADMIN_TOKEN_FILE) ? resolve11(process10.env.ODLA_ADMIN_TOKEN_FILE) : profile.name ? profileCredentials.scoped : loaded ? join12(loaded.rootDir, ".odla", "admin-token.local.json") : profileCredentials.scoped;
   const cfg = loaded ? {
     ...loaded,
     platformUrl: platformValue,
@@ -7779,8 +8144,8 @@ async function resolveOperatorContext(parsed, options = {}) {
     services: [],
     local: {
       tokenFile,
-      credentialsFile: join11(rootDir, ".odla", "credentials.local.json"),
-      devVarsFile: join11(rootDir, ".dev.vars"),
+      credentialsFile: join12(rootDir, ".odla", "credentials.local.json"),
+      devVarsFile: join12(rootDir, ".dev.vars"),
       gitignore: true
     }
   };
@@ -8024,7 +8389,7 @@ async function appExport(options) {
 }
 
 // src/app-import.ts
-import { readFileSync as readFileSync8 } from "fs";
+import { readFileSync as readFileSync9 } from "fs";
 import {
   buildImportOps,
   importMutationId,
@@ -8048,7 +8413,7 @@ async function appImport(options) {
   const say = options.json ? (line) => out.error(line) : (line) => out.log(line);
   const doFetch = options.fetch ?? fetch;
   const { tenant } = resolveTenant(cfg, options.env);
-  const text = options.file === "-" ? (options.readStdin ?? (() => readFileSync8(0, "utf8")))() : readFileSync8(options.file, "utf8");
+  const text = options.file === "-" ? (options.readStdin ?? (() => readFileSync9(0, "utf8")))() : readFileSync9(options.file, "utf8");
   const { format, sources } = parseImport(text, options.ns);
   if (format === "namespace-map" && options.ns) {
     throw new Error("--ns cannot be combined with a {namespace: rows} file \u2014 the file already names each namespace");
@@ -8559,10 +8924,14 @@ async function secretsCommand(parsed, deps) {
 async function projectCommand(command, parsed, deps) {
   if (command === "config") {
     const sub = parsed.positionals[1];
-    if (sub !== "diff" && sub !== "plan") {
+    if (sub !== "diff" && sub !== "plan" && sub !== "apply") {
       throw new Error(`unknown config subcommand "${sub ?? ""}". Try "odla-ai config diff --json".`);
     }
-    assertArgs(parsed, ["config", "token", "email", "open", "json"], 2);
+    assertArgs(
+      parsed,
+      sub === "apply" ? ["config", "plan", "idempotency-key", "token", "email", "open", "json"] : ["config", "token", "email", "open", "json"],
+      2
+    );
     const options = {
       configPath: stringOpt(parsed.options.config) ?? "odla.config.mjs",
       token: stringOpt(parsed.options.token),
@@ -8574,7 +8943,42 @@ async function projectCommand(command, parsed, deps) {
       stdout: deps.stdout
     };
     if (sub === "diff") await configDiff(options);
-    else await configPlan(options);
+    else if (sub === "plan") await configPlan(options);
+    else await configApply({
+      ...options,
+      planPath: requiredString(parsed.options.plan, "--plan"),
+      idempotencyKey: stringOpt(parsed.options["idempotency-key"])
+    });
+    return true;
+  }
+  if (command === "operations") {
+    const sub = parsed.positionals[1];
+    if (sub !== "get" && sub !== "wait") {
+      throw new Error(`unknown operations subcommand "${sub ?? ""}". Try "odla-ai operations get <operation-id> --json".`);
+    }
+    assertArgs(
+      parsed,
+      sub === "wait" ? ["config", "token", "email", "open", "json", "interval", "timeout"] : ["config", "token", "email", "open", "json"],
+      3
+    );
+    const operationId = parsed.positionals[2];
+    if (!operationId) throw new Error(`operation id is required`);
+    const options = {
+      configPath: stringOpt(parsed.options.config) ?? "odla.config.mjs",
+      operationId,
+      token: stringOpt(parsed.options.token),
+      email: stringOpt(parsed.options.email),
+      open: parsed.options.open === false ? false : parsed.options.open === true ? true : void 0,
+      json: parsed.options.json === true,
+      fetch: deps.fetch,
+      openApprovalUrl: deps.openUrl,
+      stdout: deps.stdout,
+      pollWait: deps.pollWait,
+      intervalSeconds: numberOpt(parsed.options.interval, "--interval"),
+      timeoutSeconds: numberOpt(parsed.options.timeout, "--timeout")
+    };
+    if (sub === "get") await configOperationGet(options);
+    else await configOperationWait(options);
     return true;
   }
   if (command === "init") {
@@ -8845,8 +9249,9 @@ Usage:
   odla-ai setup [--dir <project>] [--agent <name>] [--global] [--force]
   odla-ai init --app-id <id> --name <name> [--services db,ai,o11y,calendar] [--env dev --env prod]
   odla-ai doctor [--config odla.config.mjs]
-  odla-ai config diff [--config odla.config.mjs] [--email <odla-account>] [--json]
-  odla-ai config plan [--config odla.config.mjs] [--email <odla-account>] [--json]
+  odla-ai config <diff|plan> [--config odla.config.mjs] [--email <odla-account>] [--json]
+  odla-ai config apply --plan <plan.json> [--idempotency-key <key>] [--email <odla-account>] [--json]
+  odla-ai operations <get|wait> <operation-id> [--interval <seconds>] [--timeout <seconds>] [--json]
   odla-ai calendar status [--env dev] [--email <odla-account>] [--json]
   odla-ai calendar calendars [--env dev] [--email <odla-account>] [--json]
   odla-ai calendar connect [--env dev] [--email <odla-account>] [--no-open] [--yes]
@@ -8971,8 +9376,8 @@ Commands:
   setup        Install offline odla runbooks for common coding-agent harnesses.
   init         Create a generic odla.config.mjs plus starter schema/rules files.
   doctor       Validate and summarize the project config without network calls.
-  config       Read-only diff and revision-bound plan for checked-in Registry
-               intent; runtime-owned fields and excluded coverage stay explicit.
+  config       Diff Registry intent, freeze a CAS-bound plan, and conditionally apply its safe actions.
+  operations   Inspect or wait on one exact, durable config-operation receipt.
   calendar     Inspect, connect, or disconnect the live Google booking connection.
   app          Archive (suspend, data retained), restore, export, import, or
                manage the co-owners of the app. Archiving takes every
@@ -9679,8 +10084,8 @@ async function pmAdd(ctx, entity, parsed) {
   emit2(ctx, res, () => ctx.out.log(`created ${entity} ${res.id}`));
 }
 async function pmGet(ctx, entity, id) {
-  const { record: record8 } = await pmRequest(ctx, "GET", `/${entity}/${encodeURIComponent(id)}`);
-  emit2(ctx, record8, () => printRecord(ctx, entity, record8));
+  const { record: record10 } = await pmRequest(ctx, "GET", `/${entity}/${encodeURIComponent(id)}`);
+  emit2(ctx, record10, () => printRecord(ctx, entity, record10));
 }
 async function pmSet(ctx, entity, id, parsed) {
   const patch2 = collectEntityFields(entity, parsed, true);
@@ -9725,9 +10130,9 @@ async function pmHandoff(ctx, parsed) {
   ]);
   const handoff = {
     appId,
-    unmetGoals: goals.filter((record8) => record8.status !== "met"),
-    activeTasks: tasks.filter((record8) => record8.column !== "done"),
-    openBugs: bugs.filter((record8) => record8.status !== "fixed" && record8.status !== "wontfix")
+    unmetGoals: goals.filter((record10) => record10.status !== "met"),
+    activeTasks: tasks.filter((record10) => record10.column !== "done"),
+    openBugs: bugs.filter((record10) => record10.status !== "fixed" && record10.status !== "wontfix")
   };
   const result = {
     ...handoff,
@@ -9746,10 +10151,10 @@ async function pmHandoff(ctx, parsed) {
     ]) {
       ctx.out.log(`${label}:`);
       if (!records.length) ctx.out.log("- (none)");
-      else for (const record8 of records) printRecord(
+      else for (const record10 of records) printRecord(
         ctx,
         label === "unmet goals" ? "goal" : label === "active tasks" ? "task" : "bug",
-        record8
+        record10
       );
     }
   });
@@ -9990,17 +10395,17 @@ async function platformCommand(parsed, deps = {}) {
   }
 }
 function isPlatformStatus(value2) {
-  if (!record5(value2) || value2.schemaVersion !== "odla.platform-status/v1") return false;
-  if (!record5(value2.verdict) || !Array.isArray(value2.verdict.reasons)) return false;
-  if (!record5(value2.catalog) || !record5(value2.summary)) return false;
+  if (!record7(value2) || value2.schemaVersion !== "odla.platform-status/v1") return false;
+  if (!record7(value2.verdict) || !Array.isArray(value2.verdict.reasons)) return false;
+  if (!record7(value2.catalog) || !record7(value2.summary)) return false;
   return Array.isArray(value2.services) && Array.isArray(value2.nextActions);
 }
 function apiMessage(value2) {
-  if (!record5(value2)) return "request failed";
-  const error = record5(value2.error) ? value2.error : value2;
+  if (!record7(value2)) return "request failed";
+  const error = record7(value2.error) ? value2.error : value2;
   return typeof error.message === "string" ? error.message : typeof error.code === "string" ? error.code : "request failed";
 }
-function record5(value2) {
+function record7(value2) {
   return !!value2 && typeof value2 === "object" && !Array.isArray(value2);
 }
 
@@ -10041,7 +10446,7 @@ function statusVerdict(reads) {
       severity: "degraded"
     });
   }
-  const performance = record6(reads.liveSync.body.performance) ? reads.liveSync.body.performance : null;
+  const performance = record8(reads.liveSync.body.performance) ? reads.liveSync.body.performance : null;
   if (performance?.status === "unavailable") {
     reasons.push({
       source: "liveSync",
@@ -10122,7 +10527,7 @@ function statusVerdict(reads) {
     reasons
   };
 }
-function record6(value2) {
+function record8(value2) {
   return Boolean(value2) && typeof value2 === "object" && !Array.isArray(value2);
 }
 function numeric2(value2) {
@@ -10150,7 +10555,7 @@ function printO11yStatus(status, out) {
   out.log(
     `o11y status ${status.scope.appId}/${status.scope.env} (${status.scope.minutes}m)`
   );
-  const routes = Array.isArray(status.application.body.routes) ? status.application.body.routes.filter(record7) : [];
+  const routes = Array.isArray(status.application.body.routes) ? status.application.body.routes.filter(record9) : [];
   const requests = routes.reduce(
     (total, row) => total + numeric3(row.requests),
     0
@@ -10162,39 +10567,39 @@ function printO11yStatus(status, out) {
   out.log(
     `application	${status.application.httpStatus}	${requests} requests	${errors} errors`
   );
-  const versions = Array.isArray(status.applicationVersions.body.rows) ? status.applicationVersions.body.rows.filter(record7) : [];
+  const versions = Array.isArray(status.applicationVersions.body.rows) ? status.applicationVersions.body.rows.filter(record9) : [];
   out.log(
     `application-versions	${status.applicationVersions.httpStatus}	${versions.length ? versions.slice(0, 5).map(
       (row) => `${String(row.value || "(unattributed)")}:${numeric3(row.requests)}`
     ).join(", ") : "none observed"}`
   );
   out.log(liveSyncLine(status.liveSync));
-  const canaryDurations = record7(status.canary.body.durationsMs) ? status.canary.body.durationsMs : {};
+  const canaryDurations = record9(status.canary.body.durationsMs) ? status.canary.body.durationsMs : {};
   out.log(
     `canary	${status.canary.httpStatus}	${String(status.canary.body.status ?? status.canary.body.error ?? "unavailable")}	${optionalNumeric(canaryDurations.publishToVisibleMs)} publish-to-visible`
   );
-  const collectorIngest = record7(status.collector.body.ingest) ? status.collector.body.ingest : {};
-  const collectorStorage = record7(collectorIngest.storage) ? collectorIngest.storage : {};
+  const collectorIngest = record9(status.collector.body.ingest) ? status.collector.body.ingest : {};
+  const collectorStorage = record9(collectorIngest.storage) ? collectorIngest.storage : {};
   out.log(
     `collector	${status.collector.httpStatus}	${String(status.collector.body.status ?? status.collector.body.error ?? "unavailable")}	${numeric3(collectorStorage.affectedPoints)} affected points`
   );
-  const providerMetrics = record7(status.provider.body.metrics) ? status.provider.body.metrics : {};
-  const providerCapacity = record7(status.provider.body.capacity) ? status.provider.body.capacity : {};
-  const workerMemory = record7(providerCapacity.memory) ? providerCapacity.memory : {};
+  const providerMetrics = record9(status.provider.body.metrics) ? status.provider.body.metrics : {};
+  const providerCapacity = record9(status.provider.body.capacity) ? status.provider.body.capacity : {};
+  const workerMemory = record9(providerCapacity.memory) ? providerCapacity.memory : {};
   out.log(
     `cloudflare	${status.provider.httpStatus}	${String(status.provider.body.status ?? status.provider.body.error ?? "unavailable")}	${numeric3(providerMetrics.requests)} invocations	${numeric3(providerMetrics.errors)} runtime errors	${optionalBytes(workerMemory.headroomBytes)} isolate memory headroom`
   );
   for (const line of providerCapacityLines(status.providerCapacity)) {
     out.log(line);
   }
-  const coverage = record7(status.providerReconciliation.body.comparison) ? status.providerReconciliation.body.comparison : {};
-  const coverageCounts = record7(status.providerReconciliation.body.counts) ? status.providerReconciliation.body.counts : {};
-  const coverageBudget = record7(status.providerReconciliation.body.budget) ? status.providerReconciliation.body.budget : {};
+  const coverage = record9(status.providerReconciliation.body.comparison) ? status.providerReconciliation.body.comparison : {};
+  const coverageCounts = record9(status.providerReconciliation.body.counts) ? status.providerReconciliation.body.counts : {};
+  const coverageBudget = record9(status.providerReconciliation.body.budget) ? status.providerReconciliation.body.budget : {};
   out.log(
     `request-coverage	${status.providerReconciliation.httpStatus}	${String(status.providerReconciliation.body.status ?? status.providerReconciliation.body.error ?? "unavailable")}	${optionalPercent(coverage.applicationCoverage)} application/provider	${numeric3(coverageCounts.applicationRequests)}/${numeric3(coverageCounts.providerRequests)} requests	\xB1${optionalPercent(coverageBudget.maxRelativeError)} budget`
   );
   const providerPoints = Array.isArray(status.providerHistory.body.points) ? status.providerHistory.body.points.length : 0;
-  const providerFreshness = record7(status.providerHistory.body.freshness) ? status.providerHistory.body.freshness : {};
+  const providerFreshness = record9(status.providerHistory.body.freshness) ? status.providerHistory.body.freshness : {};
   out.log(
     `cloudflare-history	${status.providerHistory.httpStatus}	${String(status.providerHistory.body.status ?? status.providerHistory.body.error ?? "unavailable")}	${providerPoints} snapshots	${optionalAge(providerFreshness.ageMs)} old`
   );
@@ -10203,17 +10608,17 @@ function printO11yStatus(status, out) {
   );
 }
 function providerCapacityLines(read3) {
-  const resources = record7(read3.body.resources) ? read3.body.resources : {};
-  const durableObjects = record7(resources.durableObjects) ? resources.durableObjects : {};
-  const periodic = record7(durableObjects.periodic) ? durableObjects.periodic : {};
-  const storage = record7(durableObjects.sqliteStorage) ? durableObjects.sqliteStorage : {};
-  const d1 = record7(resources.d1) ? resources.d1 : {};
-  const d1Activity = record7(d1.activity) ? d1.activity : {};
-  const d1Storage = record7(d1.storage) ? d1.storage : {};
-  const d1Latency = record7(d1Activity.latency) ? d1Activity.latency : {};
-  const r2 = record7(resources.r2) ? resources.r2 : {};
-  const r2Operations = record7(r2.operations) ? r2.operations : {};
-  const r2Storage = record7(r2.storage) ? r2.storage : {};
+  const resources = record9(read3.body.resources) ? read3.body.resources : {};
+  const durableObjects = record9(resources.durableObjects) ? resources.durableObjects : {};
+  const periodic = record9(durableObjects.periodic) ? durableObjects.periodic : {};
+  const storage = record9(durableObjects.sqliteStorage) ? durableObjects.sqliteStorage : {};
+  const d1 = record9(resources.d1) ? resources.d1 : {};
+  const d1Activity = record9(d1.activity) ? d1.activity : {};
+  const d1Storage = record9(d1.storage) ? d1.storage : {};
+  const d1Latency = record9(d1Activity.latency) ? d1Activity.latency : {};
+  const r2 = record9(resources.r2) ? resources.r2 : {};
+  const r2Operations = record9(r2.operations) ? r2.operations : {};
+  const r2Storage = record9(r2.storage) ? r2.storage : {};
   const status = String(
     read3.body.status ?? read3.body.error ?? "unavailable"
   );
@@ -10224,11 +10629,11 @@ function providerCapacityLines(read3) {
   ];
 }
 function liveSyncLine(read3) {
-  const performance = record7(read3.body.performance) ? read3.body.performance : {};
-  const commitToSend = record7(performance.commitToSend) ? performance.commitToSend : {};
+  const performance = record9(read3.body.performance) ? read3.body.performance : {};
+  const commitToSend = record9(performance.commitToSend) ? performance.commitToSend : {};
   return `live-sync	${read3.httpStatus}	${String(read3.body.status ?? read3.body.error ?? "unavailable")}	${numeric3(read3.body.activeConnections)} active	${optionalNumeric(commitToSend.p95)} commit-to-send p95	${numeric3(performance.sendFailures)} send failures`;
 }
-function record7(value2) {
+function record9(value2) {
   return Boolean(value2) && typeof value2 === "object" && !Array.isArray(value2);
 }
 function numeric3(value2) {
@@ -10429,7 +10834,7 @@ function recordInvocation(parsed) {
 }
 
 // src/runbook-actions.ts
-import { readFileSync as readFileSync9 } from "fs";
+import { readFileSync as readFileSync10 } from "fs";
 
 // src/runbook-requires.ts
 var SPEC = /^(@?[\w./-]+?)@(\d+\.\d+\.\d+(?:[\w.-]*)?)$/;
@@ -10514,7 +10919,7 @@ async function bySlug(ctx, slug) {
 function readBody(file, inline) {
   if (inline !== void 0) return inline;
   if (file === void 0) throw new Error("supply the new text with --file <path>, --file - (stdin), or --body");
-  return readFileSync9(file === "-" ? 0 : file, "utf8");
+  return readFileSync10(file === "-" ? 0 : file, "utf8");
 }
 var stamp = (ms) => ms ? new Date(ms).toISOString().slice(0, 16).replace("T", " ") : "";
 async function runbookList(ctx, all, query) {
@@ -10601,8 +11006,8 @@ async function runbookRemove(ctx, slug) {
 }
 
 // src/runbook-import.ts
-import { readFileSync as readFileSync10, readdirSync as readdirSync2, statSync } from "fs";
-import { basename as basename2, join as join12 } from "path";
+import { readFileSync as readFileSync11, readdirSync as readdirSync2, statSync } from "fs";
+import { basename as basename2, join as join13 } from "path";
 function parseRunbook(text, slug) {
   let rest = text;
   const meta = {};
@@ -10632,7 +11037,7 @@ function readRunbookDir(dir) {
   if (!files.length) throw new Error(`no .md files in ${dir}`);
   return files.map((file) => {
     const slug = basename2(file, ".md");
-    const parsed = parseRunbook(readFileSync10(join12(dir, file), "utf8"), slug);
+    const parsed = parseRunbook(readFileSync11(join13(dir, file), "utf8"), slug);
     return { file, slug, ...parsed, words: parsed.body.split(/\s+/).filter(Boolean).length };
   });
 }
@@ -10704,8 +11109,8 @@ async function upsert(ctx, r, visibility) {
 
 // src/runbook-impact.ts
 import { execFileSync as execFileSync2 } from "child_process";
-import { existsSync as existsSync11, readFileSync as readFileSync11 } from "fs";
-import { join as join13 } from "path";
+import { existsSync as existsSync11, readFileSync as readFileSync12 } from "fs";
+import { join as join14 } from "path";
 
 // src/runbook-impact-scan.ts
 var DECL = /^[+-]\s*export\s+(?:declare\s+)?(?:default\s+)?(?:abstract\s+)?(?:async\s+)?(?:const|let|var|function|class|interface|type|enum)\s+([A-Za-z_$][\w$]*)/;
@@ -10874,10 +11279,10 @@ ${body.split("\n").map((line) => `+${line}`).join("\n")}
 }
 function manifestLabeller(root) {
   return (workspace) => {
-    const manifest = join13(root, workspace, "package.json");
+    const manifest = join14(root, workspace, "package.json");
     if (!existsSync11(manifest)) return void 0;
     try {
-      const name = JSON.parse(readFileSync11(manifest, "utf8")).name;
+      const name = JSON.parse(readFileSync12(manifest, "utf8")).name;
       return typeof name === "string" ? name : void 0;
     } catch {
       return void 0;
@@ -10944,7 +11349,7 @@ function report3(ctx, impacts) {
 async function runbookImpact(ctx, options, deps = {}) {
   const cwd = deps.cwd ?? process.cwd();
   const runGit = deps.runGit ?? gitRunner(cwd);
-  const read3 = deps.readRepoFile ?? ((path) => readFileSync11(join13(cwd, path), "utf8"));
+  const read3 = deps.readRepoFile ?? ((path) => readFileSync12(join14(cwd, path), "utf8"));
   const surfaces = changedSurfaces(collectDiff(runGit, options.base, read3), manifestLabeller(cwd));
   if (!surfaces.length) {
     return ctx.out.log(
@@ -11077,9 +11482,9 @@ async function runbookComment(ctx, slug, body) {
 
 // src/runbook-editor.ts
 import { spawnSync } from "child_process";
-import { mkdtempSync, readFileSync as readFileSync12, rmSync as rmSync2, writeFileSync as writeFileSync4 } from "fs";
+import { mkdtempSync, readFileSync as readFileSync13, rmSync as rmSync2, writeFileSync as writeFileSync4 } from "fs";
 import { tmpdir as tmpdir4 } from "os";
-import { join as join14 } from "path";
+import { join as join15 } from "path";
 import process13 from "process";
 var EDITOR_ENV = ["ODLA_EDITOR", "VISUAL", "EDITOR"];
 function resolveEditor(env = process13.env) {
@@ -11105,13 +11510,13 @@ function editText(initial, slug, deps = {}) {
     );
   if (!interactive())
     throw new Error(`cannot open an editor without a terminal \u2014 pass --file <path> or --body "\u2026" instead`);
-  const dir = mkdtempSync(join14(tmpdir4(), "odla-runbook-"));
-  const file = join14(dir, `${slug}.md`);
+  const dir = mkdtempSync(join15(tmpdir4(), "odla-runbook-"));
+  const file = join15(dir, `${slug}.md`);
   try {
     writeFileSync4(file, initial, { mode: 384 });
     const code = defaultRunOrInjected(deps)(editor, file);
     if (code !== 0) throw new Error(`editor "${editor}" exited with ${code}; nothing was written`);
-    const edited = readFileSync12(file, "utf8");
+    const edited = readFileSync13(file, "utf8");
     return edited === initial ? null : edited;
   } finally {
     rmSync2(dir, { recursive: true, force: true });
@@ -11805,11 +12210,11 @@ async function securityStatus(parsed, dependencies) {
 // src/cli.ts
 function exitCodeFor(err) {
   const code = err?.code;
-  if (code === "handshake_pending" || code === "watch_timeout") return 75;
+  if (code === "handshake_pending" || code === "watch_timeout" || code === "operation_pending") return 75;
   if (code === "checkpoint_required") return 3;
   if (code === "remote_unavailable") return 6;
   if (code === "auth_failed") return 5;
-  if (code === "invalid_cursor") return 2;
+  if (code === "invalid_cursor" || code === "invalid_plan" || code === "invalid_operation_id") return 2;
   return 1;
 }
 async function runCli(argv = process.argv.slice(2), dependencies = {}) {
@@ -11964,7 +12369,11 @@ export {
   calendarDisconnect,
   CAPABILITIES,
   printCapabilities,
+  ConfigOperationCommandError,
   desiredRegistryState,
+  configApply,
+  configOperationGet,
+  configOperationWait,
   reconcileConfig,
   configDiff,
   configPlan,
@@ -12005,4 +12414,4 @@ export {
   exitCodeFor,
   runCli
 };
-//# sourceMappingURL=chunk-2AFAXLKE.js.map
+//# sourceMappingURL=chunk-JJ42NV7X.js.map