@odla-ai/cli 0.25.22 → 0.26.1

package/dist/bin.cjs

@@ -182,10 +182,10 @@ function isManagedDevVar(line) {
   const match = line.match(/^\s*(?:export\s+)?([A-Z][A-Z0-9_]*)\s*=/);
   return !!match?.[1] && MANAGED_DEV_VARS.has(match[1]);
 }
-function writePrivateText(path, text) {
+function writePrivateText(path, text2) {
   (0, import_node_fs.mkdirSync)((0, import_node_path.dirname)(path), { recursive: true });
   const temporary = `${path}.tmp-${process.pid}-${Date.now()}`;
-  (0, import_node_fs.writeFileSync)(temporary, text, { mode: 384 });
+  (0, import_node_fs.writeFileSync)(temporary, text2, { mode: 384 });
   (0, import_node_fs.chmodSync)(temporary, 384);
   (0, import_node_fs.renameSync)(temporary, path);
 }
@@ -492,7 +492,9 @@ function audienceBoundEnvToken(token, platform) {
 }
 var SCOPE_PURPOSE = {
   "platform:status:read": "read the platform fleet health and deployment snapshot",
+  "platform:chat:credential:write": "rotate the built-in Discussion responder credential",
   "app:config:read": "compare checked-in intent with an exact-id app Registry configuration",
+  "app:config:write": "apply or inspect one revision-bound configuration operation for an app you own",
   "platform:runbook:write": "add or edit odla's operational runbooks",
   "platform:ai:policy:write": "change System AI model routing",
   "platform:ai:policy:read": "read System AI model routing",
@@ -550,6 +552,14 @@ async function scopedToken(platform, scope, options, doFetch, out) {
   return token;
 }
 
+// src/principal-presentation.ts
+function unresolvedPrincipalLabel(credentialKind2, principalId) {
+  const kind = typeof credentialKind2 === "string" ? credentialKind2.trim() : "";
+  const id = typeof principalId === "string" ? principalId.trim() : "";
+  const audit = kind && id ? `${kind}:${id}` : kind || id;
+  return `Unknown principal${audit ? ` [${audit}]` : ""}`;
+}
+
 // src/admin-ai-audit.ts
 function adminAiAuditQuery(filters) {
   if (filters.limit === void 0) return "";
@@ -579,17 +589,17 @@ async function readAdminAiAudit(request2) {
       String(event.changeKind ?? ""),
       String(event.purpose ?? event.provider ?? ""),
       route2,
-      `${String(event.actorType ?? "")}:${String(event.actorId ?? "")}`
+      unresolvedPrincipalLabel(event.actorType, event.actorId)
     ].join("	"));
   }
 }
 async function responseBody(response2) {
-  const text = await response2.text();
-  if (!text) return {};
+  const text2 = await response2.text();
+  if (!text2) return {};
   try {
-    return JSON.parse(text);
+    return JSON.parse(text2);
   } catch {
-    return { message: text.slice(0, 300) };
+    return { message: text2.slice(0, 300) };
   }
 }
 function apiError(status, body) {
@@ -670,7 +680,7 @@ when	app/env	run	actor	purpose/role	route / policy	tokens	cost	status`);
       timestamp2(event.created_at),
       `${String(event.app_id ?? "")}/${String(event.env ?? "")}`,
       String(event.run_id ?? ""),
-      `${String(event.actor_type ?? "")}:${String(event.actor_id ?? "")}`,
+      unresolvedPrincipalLabel(event.actor_type, event.actor_id),
       `${String(event.purpose ?? "")}/${String(event.role ?? "")}`,
       `${String(event.provider ?? "")}/${String(event.model ?? "")}@v${String(event.policy_version ?? "unknown")}`,
       String(input + output),
@@ -691,12 +701,12 @@ function timestamp2(value2) {
   return Number.isFinite(date.valueOf()) ? date.toISOString() : "";
 }
 async function responseBody2(res) {
-  const text = await res.text();
-  if (!text) return {};
+  const text2 = await res.text();
+  if (!text2) return {};
   try {
-    return JSON.parse(text);
+    return JSON.parse(text2);
   } catch {
-    return { message: text.slice(0, 300) };
+    return { message: text2.slice(0, 300) };
   }
 }
 function apiError2(action2, status, body) {
@@ -872,12 +882,12 @@ function catalogModels(body) {
   return body.catalog.models.filter((value2) => isRecord3(value2) && typeof value2.id === "string" && typeof value2.provider === "string");
 }
 async function responseBody3(res) {
-  const text = await res.text();
-  if (!text) return {};
+  const text2 = await res.text();
+  if (!text2) return {};
   try {
-    return JSON.parse(text);
+    return JSON.parse(text2);
   } catch {
-    return { message: text.slice(0, 300) };
+    return { message: text2.slice(0, 300) };
   }
 }
 function apiError3(action2, status, body) {
@@ -1048,6 +1058,7 @@ function unique(values) {
 var DEFAULT_PLATFORM = "https://odla.ai";
 var DEFAULT_ENVS = ["dev"];
 var DEFAULT_SERVICES = ["db", "ai"];
+var configImportSerial = 0;
 var GOOGLE_CALENDAR_EVENTS_SCOPE = "https://www.googleapis.com/auth/calendar.events";
 async function loadProjectConfig(configPath = "odla.config.mjs") {
   const resolved = (0, import_node_path4.resolve)(configPath);
@@ -1255,7 +1266,8 @@ function validId2(value2) {
 }
 async function loadConfigModule(path) {
   if (path.endsWith(".json")) return JSON.parse((0, import_node_fs4.readFileSync)(path, "utf8"));
-  const mod = await import(`${(0, import_node_url.pathToFileURL)(path).href}?t=${Date.now()}`);
+  const nonce = `${Date.now()}-${configImportSerial++}`;
+  const mod = await import(`${(0, import_node_url.pathToFileURL)(path).href}?reload=${nonce}`);
   const value2 = mod.default ?? mod.config;
   if (typeof value2 === "function") return await value2();
   return value2;
@@ -1719,8 +1731,8 @@ async function appImport(options) {
   const say = options.json ? (line) => out.error(line) : (line) => out.log(line);
   const doFetch = options.fetch ?? fetch;
   const { tenant } = resolveTenant(cfg, options.env);
-  const text = options.file === "-" ? (options.readStdin ?? (() => (0, import_node_fs8.readFileSync)(0, "utf8")))() : (0, import_node_fs8.readFileSync)(options.file, "utf8");
-  const { format, sources } = (0, import_import.parseImport)(text, options.ns);
+  const text2 = options.file === "-" ? (options.readStdin ?? (() => (0, import_node_fs8.readFileSync)(0, "utf8")))() : (0, import_node_fs8.readFileSync)(options.file, "utf8");
+  const { format, sources } = (0, import_import.parseImport)(text2, options.ns);
   if (format === "namespace-map" && options.ns) {
     throw new Error("--ns cannot be combined with a {namespace: rows} file \u2014 the file already names each namespace");
   }
@@ -1811,7 +1823,10 @@ function report(options, owners, headline) {
   if (headline) out.log(headline);
   out.log(`owners (${owners.length}):`);
   for (const o of owners) {
-    out.log(`  ${o.primary ? "\u2605" : "\xB7"} ${o.email ?? o.ownerId}${o.primary ? " (primary)" : ""}`);
+    const name = o.email?.trim() || "Unnamed member";
+    out.log(
+      `  ${o.primary ? "\u2605" : "\xB7"} ${name} [${o.ownerId}]${o.primary ? " (primary)" : ""}`
+    );
   }
 }
 async function ownersList(options) {
@@ -2639,7 +2654,8 @@ var CAPABILITIES = {
     "save and explicitly select non-secret named operator contexts with isolated credential caches; resolve and explain platform, app, environment, and credential provenance without authenticating; then run PM, Discussions, o11y, runbook, and identity operations outside a project checkout",
     "read one versioned o11y status envelope spanning application RED, exact Worker versions and Cloudflare colos observed in traffic, current live-sync freshness/load, the protected commit-to-visible canary, collector ingest/scheduler trust, provider-owned runtime metrics, account-scoped Durable Object, D1, and R2 evidence under odla-db, and a bounded machine verdict",
     "read one canonical platform fleet snapshot over private service bindings, including release identities, probe latency, Cloudflare load/runtime freshness, explicit unknowns, and stable next actions through a read-only capability",
-    "compare one project's checked-in Registry intent with live owner-visible state and freeze a secret-free plan digest through an exact app:config:read capability",
+    "compare one project's checked-in Registry intent with live owner-visible state, freeze a secret-free Registry-revision-bound plan through app:config:read, and conditionally apply checkpoint-free actions through exact app:config:write operation routes",
+    "inspect or bounded-wait one exact durable config-operation journal entry and verify every terminal receipt digest before returning it to remote automation",
     "inspect durable agent wakeups as a versioned JSON envelope and explicitly requeue one dead-lettered job with a scoped environment credential",
     "run app-attributed hosted security discovery and independent validation without provider keys",
     "connect/revoke source-read-only GitHub sources and drive commit-pinned hosted security jobs without PATs or provider keys",
@@ -2686,10 +2702,31 @@ function printGroup(out, heading, items) {
   out.log("");
 }
 
-// src/config-reconcile-command.ts
+// src/config-operation-command.ts
 var import_apps6 = require("@odla-ai/apps");
 var import_node_path7 = require("path");
 
+// src/version.ts
+var import_node_fs9 = require("fs");
+function cliVersion() {
+  const pkg = JSON.parse((0, import_node_fs9.readFileSync)(new URL("../package.json", importMetaUrl), "utf8"));
+  return pkg.version ?? "unknown";
+}
+
+// src/config-operation-error.ts
+var ConfigOperationCommandError = class extends Error {
+  constructor(message2, code) {
+    super(message2);
+    this.code = code;
+    this.name = "ConfigOperationCommandError";
+  }
+  code;
+};
+
+// src/config-operation-validate.ts
+var import_apps3 = require("@odla-ai/apps");
+var import_node_fs10 = require("fs");
+
 // src/config-reconcile-digest.ts
 var import_node_crypto = require("crypto");
 function canonicalJson(value2) {
@@ -2699,27 +2736,160 @@ function configDigest(value2) {
   return `sha256:${(0, import_node_crypto.createHash)("sha256").update(canonicalJson(value2)).digest("hex")}`;
 }
 function canonicalValue(value2) {
+  if (value2 === null || typeof value2 === "string" || typeof value2 === "boolean") return value2;
+  if (typeof value2 === "number") {
+    if (!Number.isFinite(value2)) throw new TypeError("canonical JSON rejects non-finite numbers");
+    return value2;
+  }
   if (Array.isArray(value2)) return value2.map(canonicalValue);
   if (value2 && typeof value2 === "object") {
+    const record11 = value2;
     return Object.fromEntries(
-      Object.entries(value2).filter(([, entry]) => entry !== void 0).sort(([left], [right]) => left.localeCompare(right)).map(([key, entry]) => [key, canonicalValue(entry)])
+      Object.keys(record11).filter((key) => record11[key] !== void 0).sort().map((key) => [key, canonicalValue(record11[key])])
     );
   }
-  return value2;
+  throw new TypeError("canonical JSON rejects unsupported values");
+}
+
+// src/config-operation-validate.ts
+var DIGEST = /^sha256:[0-9a-f]{64}$/;
+var REVISION = /^registry:[1-9][0-9]*$/;
+var OPERATION_ID = /^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i;
+var ACTION_ID = /^action-[0-9a-f]{16}$/;
+var ENV = /^[a-z0-9]{2,12}$/;
+var SERVICE = /^[a-z][a-z0-9-]{0,39}$/;
+function readPlan(path) {
+  let value2;
+  try {
+    const raw = (0, import_node_fs10.readFileSync)(path, "utf8");
+    if (Buffer.byteLength(raw) > 128 * 1024) throw new Error("plan exceeds 128 KiB");
+    value2 = JSON.parse(raw);
+  } catch (error) {
+    throw new ConfigOperationCommandError(
+      `cannot read --plan ${path}: ${error instanceof Error ? error.message : String(error)}`,
+      "invalid_plan"
+    );
+  }
+  if (!record2(value2) || value2.schemaVersion !== "odla.config-plan/v2") invalidPlan("unsupported plan schema");
+  if (!record2(value2.scope) || typeof value2.scope.appId !== "string" || typeof value2.scope.platformUrl !== "string") {
+    invalidPlan("plan scope is invalid");
+  }
+  if (!DIGEST.test(String(value2.desiredRevision)) || !DIGEST.test(String(value2.observedRevision))) {
+    invalidPlan("plan content revisions are invalid");
+  }
+  if (!REVISION.test(String(value2.registryRevision)) || !DIGEST.test(String(value2.planDigest))) {
+    invalidPlan("plan Registry revision or digest is invalid");
+  }
+  if (!Array.isArray(value2.actions) || !value2.actions.length || value2.actions.length > 32) {
+    invalidPlan("plan actions must contain 1-32 entries");
+  }
+  assertActions(value2.actions);
+  const plan = value2;
+  const digest = configDigest({
+    schemaVersion: plan.schemaVersion,
+    desiredRevision: plan.desiredRevision,
+    observedRevision: plan.observedRevision,
+    registryRevision: plan.registryRevision,
+    actions: plan.actions
+  });
+  if (digest !== plan.planDigest) invalidPlan("plan digest does not bind these revisions and actions");
+  return plan;
+}
+function assertPlanContext(plan, appId, platformUrl) {
+  if (plan.scope.appId !== appId || plan.scope.platformUrl.replace(/\/$/, "") !== platformUrl.replace(/\/$/, "")) {
+    throw new ConfigOperationCommandError("plan scope does not match the selected project config", "checkpoint_required");
+  }
+}
+function verifyReceipt(receipt, appId, operationId) {
+  if (receipt.appId !== appId || operationId && receipt.operationId !== operationId) {
+    throw new ConfigOperationCommandError("Registry returned a receipt outside the requested scope", "invalid_receipt");
+  }
+  if (receipt.receiptDigest) {
+    const { receiptDigest, ...fields } = receipt;
+    if (configDigest(fields) !== receiptDigest) {
+      throw new ConfigOperationCommandError("config operation receipt digest is invalid", "invalid_receipt");
+    }
+  } else if (receipt.state === "succeeded" || receipt.state === "conflict" || receipt.state === "failed" && !receipt.error?.retryable) {
+    throw new ConfigOperationCommandError("terminal config operation receipt is not digest-authenticated", "invalid_receipt");
+  }
+}
+function assertOperationId(value2) {
+  if (!OPERATION_ID.test(value2)) {
+    throw new ConfigOperationCommandError("operation id must be a UUID", "invalid_operation_id");
+  }
+}
+function assertActions(actions) {
+  const ids = /* @__PURE__ */ new Set();
+  for (const action2 of actions) {
+    if (!record2(action2)) invalidPlan("every plan action must be an object");
+    const id = String(action2.id ?? "");
+    if (!ACTION_ID.test(id) || ids.has(id)) invalidPlan("plan action ids must be unique frozen ids");
+    ids.add(id);
+    if (typeof action2.path !== "string" || typeof action2.reason !== "string" || !action2.reason || action2.reason.length > 500 || typeof action2.requiresApproval !== "boolean" || !["low", "medium", "high"].includes(String(action2.risk)) || !["provision", "command", "studio"].includes(String(action2.applySupport))) {
+      invalidPlan("plan action metadata is invalid");
+    }
+    if (["rename_app", "enable_service", "configure_service", "set_link"].includes(String(action2.kind))) {
+      assertConditionalAction(action2);
+    }
+  }
+}
+function assertConditionalAction(action2) {
+  if (action2.kind === "rename_app") {
+    if (action2.path !== "app.name" || action2.applySupport !== "command" || typeof action2.before !== "string" || typeof action2.after !== "string" || action2.after !== action2.after.trim() || !action2.after || action2.after.length > 80) invalidPlan("rename action is invalid");
+    return;
+  }
+  if (!action2.env || !ENV.test(action2.env)) invalidPlan("conditional action env is invalid");
+  if (action2.kind === "set_link") {
+    if (action2.path !== `environments.${action2.env}.link` || action2.applySupport !== "provision" || !linkState(action2.before) || !linkState(action2.after)) invalidPlan("link action is invalid");
+    return;
+  }
+  if (!action2.service || !SERVICE.test(action2.service) || !(0, import_apps3.appServiceDefinition)(action2.service)) {
+    invalidPlan("service action names an unknown service");
+  }
+  const base = `environments.${action2.env}.services.${action2.service}`;
+  if (action2.path !== (action2.kind === "configure_service" ? `${base}.config` : base)) {
+    invalidPlan("service action path is invalid");
+  }
+  if (action2.applySupport !== "provision" || !record2(action2.after)) {
+    invalidPlan("service action payload is invalid");
+  }
+  if (action2.kind === "enable_service") {
+    if (action2.after.enabled !== true || action2.before !== null && !record2(action2.before)) {
+      invalidPlan("service enable action is invalid");
+    }
+  } else if (!record2(action2.before)) {
+    invalidPlan("service configure action is invalid");
+  }
+}
+function linkState(value2) {
+  if (value2 === null) return true;
+  if (typeof value2 !== "string") return false;
+  try {
+    const url = new URL(value2.trim());
+    return url.protocol === "http:" || url.protocol === "https:";
+  } catch {
+    return false;
+  }
+}
+function invalidPlan(message2) {
+  throw new ConfigOperationCommandError(message2, "invalid_plan");
+}
+function record2(value2) {
+  return !!value2 && typeof value2 === "object" && !Array.isArray(value2);
 }
 
 // src/config-reconcile-desired.ts
-var import_apps4 = require("@odla-ai/apps");
+var import_apps5 = require("@odla-ai/apps");
 
 // src/provision-helpers.ts
 var import_ai = require("@odla-ai/ai");
-var import_apps3 = require("@odla-ai/apps");
+var import_apps4 = require("@odla-ai/apps");
 function defaultSecretName(provider) {
   const names = import_ai.DEFAULT_SECRET_NAMES;
   return names[provider] ?? `${provider}_api_key`;
 }
 async function assertTenantAdminAccess(doFetch, cfg, env, token) {
-  const tenantId = (0, import_apps3.tenantIdFor)(cfg.app.id, env);
+  const tenantId = (0, import_apps4.tenantIdFor)(cfg.app.id, env);
   const res = await doFetch(`${cfg.dbEndpoint}/admin/apps/${encodeURIComponent(tenantId)}/entitlements`, {
     headers: { authorization: `Bearer ${token}` }
   });
@@ -2761,7 +2931,7 @@ async function safeText3(res) {
 // src/config-reconcile-desired.ts
 function desiredRegistryState(cfg) {
   const environments = {};
-  const services = (0, import_apps4.orderAppServices)(cfg.services);
+  const services = (0, import_apps5.orderAppServices)(cfg.services);
   for (const env of cfg.envs) {
     const desiredServices = {};
     for (const service of services) {
@@ -2801,8 +2971,208 @@ function managedServiceConfig(cfg, env, service) {
   return {};
 }
 
+// src/config-reconcile-support.ts
+var CONDITIONAL_KINDS = /* @__PURE__ */ new Set([
+  "rename_app",
+  "enable_service",
+  "configure_service",
+  "set_link"
+]);
+function configApplySupport(reconciliation) {
+  if (!reconciliation.observedRevision || !reconciliation.registryRevision) {
+    return {
+      supported: false,
+      checkpointRequired: false,
+      reason: "the app must already exist in a revision-aware Registry"
+    };
+  }
+  if (!reconciliation.actions.length) {
+    return {
+      supported: false,
+      checkpointRequired: false,
+      reason: "there are no managed changes to apply"
+    };
+  }
+  const blocked = reconciliation.actions.filter(
+    (action2) => !CONDITIONAL_KINDS.has(action2.kind) || action2.risk !== "low" || action2.requiresApproval || action2.applySupport === "studio" || action2.env === "prod" || action2.env === "production"
+  );
+  if (blocked.length) {
+    return {
+      supported: false,
+      checkpointRequired: blocked.some(
+        (action2) => action2.risk === "high" || action2.requiresApproval || action2.applySupport === "studio" || action2.env === "prod" || action2.env === "production"
+      ),
+      reason: `${blocked.length} action${blocked.length === 1 ? "" : "s"} remain outside conditional apply`
+    };
+  }
+  return {
+    supported: true,
+    checkpointRequired: false,
+    reason: "all actions are low-risk, checkpoint-free Registry changes"
+  };
+}
+
+// src/config-operation-command.ts
+var IDEMPOTENCY_KEY = /^[A-Za-z0-9][A-Za-z0-9._:-]{0,119}$/;
+var DEFAULT_WAIT_SECONDS = 60;
+var DEFAULT_INTERVAL_SECONDS = 2;
+async function configApply(options) {
+  const plan = readPlan(options.planPath);
+  const cfg = await loadProjectConfig(options.configPath);
+  assertPlanContext(plan, cfg.app.id, cfg.platformUrl);
+  const support = configApplySupport(plan);
+  if (!support.supported) {
+    throw new ConfigOperationCommandError(
+      support.reason,
+      support.checkpointRequired ? "checkpoint_required" : "invalid_plan"
+    );
+  }
+  if (configDigest(desiredRegistryState(cfg)) !== plan.desiredRevision) {
+    throw new ConfigOperationCommandError(
+      "project config changed after this plan was frozen; generate and review a fresh plan",
+      "checkpoint_required"
+    );
+  }
+  const idempotencyKey = options.idempotencyKey ?? `cli:${plan.planDigest.slice(7)}`;
+  if (!IDEMPOTENCY_KEY.test(idempotencyKey)) {
+    throw new ConfigOperationCommandError("--idempotency-key is not a safe 1-120 character key", "invalid_plan");
+  }
+  const client = await operationClient(cfg, options, "apply");
+  const request2 = {
+    schemaVersion: "odla.config-operation-request/v1",
+    expectedRevision: plan.registryRevision,
+    desiredRevision: plan.desiredRevision,
+    observedRevision: plan.observedRevision,
+    planDigest: plan.planDigest,
+    idempotencyKey,
+    source: { kind: "cli", version: cliVersion() },
+    actions: plan.actions
+  };
+  let receipt;
+  try {
+    receipt = await client.applyConfigOperation(cfg.app.id, request2);
+  } catch (error) {
+    const retained = retainedReceipt(error);
+    if (retained) {
+      verifyReceipt(retained, cfg.app.id);
+      printReceipt(retained, options);
+      throw failureForReceipt(retained);
+    }
+    throw normalizeRequestError(error);
+  }
+  verifyReceipt(receipt, cfg.app.id);
+  printReceipt(receipt, options);
+  assertApplyCompleted(receipt);
+  return receipt;
+}
+async function configOperationGet(options) {
+  assertOperationId(options.operationId);
+  const cfg = await loadProjectConfig(options.configPath);
+  const client = await operationClient(cfg, options, "read");
+  const receipt = await client.getConfigOperation(cfg.app.id, options.operationId).catch((error) => {
+    throw normalizeRequestError(error);
+  });
+  if (!receipt) {
+    throw new ConfigOperationCommandError("config operation not found for this app", "operation_not_found");
+  }
+  verifyReceipt(receipt, cfg.app.id, options.operationId);
+  printReceipt(receipt, options);
+  return receipt;
+}
+async function configOperationWait(options) {
+  assertOperationId(options.operationId);
+  const cfg = await loadProjectConfig(options.configPath);
+  const client = await operationClient(cfg, options, "wait");
+  const wait2 = options.pollWait ?? ((ms) => new Promise((resolve12) => setTimeout(resolve12, ms)));
+  const now = () => (options.now?.() ?? /* @__PURE__ */ new Date()).getTime();
+  const deadline = now() + (options.timeoutSeconds ?? DEFAULT_WAIT_SECONDS) * 1e3;
+  const interval = (options.intervalSeconds ?? DEFAULT_INTERVAL_SECONDS) * 1e3;
+  let receipt = null;
+  for (; ; ) {
+    receipt = await client.getConfigOperation(cfg.app.id, options.operationId).catch((error) => {
+      throw normalizeRequestError(error);
+    });
+    if (!receipt) {
+      throw new ConfigOperationCommandError("config operation not found for this app", "operation_not_found");
+    }
+    verifyReceipt(receipt, cfg.app.id, options.operationId);
+    if (receipt.state !== "running") break;
+    if (now() >= deadline) {
+      printReceipt(receipt, options);
+      throw new ConfigOperationCommandError("config operation is still running", "operation_pending");
+    }
+    await wait2(Math.min(interval, Math.max(0, deadline - now())));
+  }
+  printReceipt(receipt, options);
+  if (receipt.state !== "succeeded") throw failureForReceipt(receipt);
+  return receipt;
+}
+async function operationClient(cfg, options, purpose) {
+  const doFetch = options.fetch ?? fetch;
+  const out = options.stdout ?? console;
+  const token = await resolveAdminPlatformToken({
+    platform: cfg.platformUrl,
+    scope: "app:config:write",
+    token: options.token,
+    tokenFile: (0, import_node_path7.join)(cfg.rootDir, ".odla", "admin-token.local.json"),
+    rootDir: cfg.rootDir,
+    email: options.email,
+    open: options.open,
+    fetch: doFetch,
+    stdout: out,
+    openApprovalUrl: options.openApprovalUrl,
+    label: `odla CLI (${cfg.app.id} config operation ${purpose})`
+  });
+  return (0, import_apps6.createAppsClient)({ endpoint: cfg.platformUrl, token, fetcher: { fetch: doFetch } });
+}
+function printReceipt(receipt, options) {
+  const out = options.stdout ?? console;
+  if (options.json) out.log(JSON.stringify(receipt, null, 2));
+  else {
+    out.log(`config operation ${receipt.operationId}: ${receipt.state}`);
+    out.log(`revision: ${receipt.expectedRevision} \u2192 ${receipt.currentRevision}`);
+    for (const step of receipt.progress) out.log(`  ${step.state}	${step.actionId}	attempts=${step.attempts}`);
+    out.log(`receipt: ${receipt.receiptDigest ?? "pending"}`);
+    out.log(`studio: ${receipt.studioUrl}`);
+  }
+}
+function assertApplyCompleted(receipt) {
+  if (receipt.state === "succeeded") return;
+  throw receipt.state === "running" ? new ConfigOperationCommandError("config operation is still running", "operation_pending") : failureForReceipt(receipt);
+}
+function failureForReceipt(receipt) {
+  if (receipt.state === "conflict") return new ConfigOperationCommandError(
+    receipt.error?.message ?? "config operation conflicted with current Registry state",
+    "checkpoint_required"
+  );
+  if (receipt.error?.retryable) return new ConfigOperationCommandError(receipt.error.message, "remote_unavailable");
+  return new ConfigOperationCommandError(receipt.error?.message ?? `config operation ${receipt.state}`, "config_operation_failed");
+}
+function retainedReceipt(error) {
+  if (!(error instanceof import_apps6.AppsError) || !record3(error.details)) return null;
+  return record3(error.details.operation) ? error.details.operation : null;
+}
+function normalizeRequestError(error) {
+  if (!(error instanceof import_apps6.AppsError)) return error instanceof Error ? error : new Error(String(error));
+  if (error.status === 401 || error.status === 403) {
+    return new ConfigOperationCommandError(error.message, "auth_failed");
+  }
+  if (error.status === 409) return new ConfigOperationCommandError(error.message, "checkpoint_required");
+  if (error.status === 429 || error.status >= 500) {
+    return new ConfigOperationCommandError(error.message, "remote_unavailable");
+  }
+  return new ConfigOperationCommandError(error.message, error.code || "config_operation_failed");
+}
+function record3(value2) {
+  return !!value2 && typeof value2 === "object" && !Array.isArray(value2);
+}
+
+// src/config-reconcile-command.ts
+var import_apps8 = require("@odla-ai/apps");
+var import_node_path8 = require("path");
+
 // src/config-reconcile.ts
-var import_apps5 = require("@odla-ai/apps");
+var import_apps7 = require("@odla-ai/apps");
 
 // src/config-reconcile-values.ts
 function difference(path, desired, observed, status, reason, desiredSource, observedSource, env, service) {
@@ -2903,6 +3273,7 @@ function reconcileConfig(input) {
     sources: { desired: desiredSource, observed: observedSource },
     desiredRevision,
     observedRevision,
+    registryRevision: input.observed?.configRevision ?? null,
     status: different ? "different" : unmanaged ? "unmanaged" : "in_sync",
     summary: {
       differences: different,
@@ -2957,7 +3328,7 @@ function compareEnvironments(desired, observed, desiredSource, observedSource, a
 function compareServices(env, desired, observed, desiredSource, observedSource, add) {
   const wanted = desired.environments[env]?.services ?? {};
   const live = observed?.environments[env] ?? {};
-  const knownOrder = (0, import_apps5.orderAppServices)((0, import_apps5.appServiceIds)());
+  const knownOrder = (0, import_apps7.orderAppServices)((0, import_apps7.appServiceIds)());
   const services = [.../* @__PURE__ */ new Set([...knownOrder, ...Object.keys(wanted), ...Object.keys(live)])];
   for (const service of services) {
     const next = wanted[service];
@@ -3068,20 +3439,19 @@ async function configDiff(options) {
 }
 async function configPlan(options) {
   const reconciliation = await inspectConfig(options);
+  const apply = configApplySupport(reconciliation);
   const planDigest = configDigest({
-    schemaVersion: "odla.config-plan/v1",
+    schemaVersion: "odla.config-plan/v2",
     desiredRevision: reconciliation.desiredRevision,
     observedRevision: reconciliation.observedRevision,
+    registryRevision: reconciliation.registryRevision,
     actions: reconciliation.actions
   });
   const document2 = {
-    schemaVersion: "odla.config-plan/v1",
+    schemaVersion: "odla.config-plan/v2",
     ...reconciliation,
     planDigest,
-    apply: {
-      supported: false,
-      reason: "conditional, resumable config apply is not available yet; use the exact reviewed commands below"
-    },
+    apply,
     nextActions: planNextActions(reconciliation, options.configPath)
   };
   printPlan2(document2, options);
@@ -3095,7 +3465,7 @@ async function inspectConfig(options) {
     platform: cfg.platformUrl,
     scope: "app:config:read",
     token: options.token,
-    tokenFile: (0, import_node_path7.join)(cfg.rootDir, ".odla", "admin-token.local.json"),
+    tokenFile: (0, import_node_path8.join)(cfg.rootDir, ".odla", "admin-token.local.json"),
     rootDir: cfg.rootDir,
     email: options.email,
     open: options.open,
@@ -3104,7 +3474,7 @@ async function inspectConfig(options) {
     openApprovalUrl: options.openApprovalUrl,
     label: `odla CLI (${cfg.app.id} config read)`
   });
-  const client = (0, import_apps6.createAppsClient)({ endpoint: cfg.platformUrl, token, fetcher: { fetch: doFetch } });
+  const client = (0, import_apps8.createAppsClient)({ endpoint: cfg.platformUrl, token, fetcher: { fetch: doFetch } });
   const observed = await client.resolveApp(cfg.app.id);
   return reconcileConfig({
     desired: desiredRegistryState(cfg),
@@ -3140,7 +3510,7 @@ function printPlan2(document2, options) {
   }
   if (!document2.actions.length) out.log("  no managed changes");
   out.log(`plan digest: ${document2.planDigest}`);
-  out.log(`apply: unsupported \u2014 ${document2.apply.reason}`);
+  out.log(`apply: ${document2.apply.supported ? "supported" : "blocked"} \u2014 ${document2.apply.reason}`);
   printNext(out, document2.nextActions);
 }
 function printHeader(out, kind, document2) {
@@ -3148,6 +3518,7 @@ function printHeader(out, kind, document2) {
   out.log(`platform: ${document2.scope.platformUrl}`);
   out.log(`desired:  ${document2.desiredRevision}`);
   out.log(`observed: ${document2.observedRevision ?? "absent"}`);
+  out.log(`registry: ${document2.registryRevision ?? "absent"}`);
   out.log(
     `summary: ${document2.summary.differences} different, ${document2.summary.unmanaged} unmanaged, ${document2.summary.actions} planned actions`
   );
@@ -3180,6 +3551,13 @@ function diffNextActions(reconciliation, configPath) {
 }
 function planNextActions(reconciliation, configPath) {
   const next = [];
+  if (configApplySupport(reconciliation).supported) {
+    next.push({
+      code: "apply_frozen_plan",
+      command: "odla-ai config apply --plan <saved-plan.json> --json",
+      description: "Save this JSON document, then conditionally apply these exact revision-bound actions."
+    });
+  }
   if (reconciliation.actions.some((action2) => action2.applySupport === "provision")) {
     next.push({
       code: "review_provision",
@@ -3193,35 +3571,39 @@ function planNextActions(reconciliation, configPath) {
     }
   }
   if (reconciliation.actions.some((action2) => action2.applySupport === "studio")) {
-    const { appId, platformUrl } = reconciliation.scope;
     next.push({
       code: "review_destructive",
-      command: `${platformUrl}/studio/apps/${encodeURIComponent(appId)}/settings`,
+      command: studioSettingsUrl(reconciliation),
       description: "Review service disablement in the owning Studio scope; this plan will not apply it."
     });
   }
   if (!reconciliation.actions.length && reconciliation.summary.unmanaged) {
     next.push({
       code: "declare_or_accept_runtime_state",
-      command: `${reconciliation.scope.platformUrl}/studio/apps/${encodeURIComponent(reconciliation.scope.appId)}/settings`,
+      command: studioSettingsUrl(reconciliation),
       description: "Declare the live value in project config or keep it as an explicit runtime-managed setting."
     });
   }
   return next;
 }
+function studioSettingsUrl(reconciliation) {
+  const environment2 = reconciliation.actions.map((action2) => action2.env).concat(reconciliation.scope.environments).find((candidate) => candidate === "dev" || candidate === "prod") ?? "dev";
+  const origin = reconciliation.scope.platformUrl.replace(/\/$/, "");
+  return `${origin}${(0, import_apps8.studioAppSettingsPath)(reconciliation.scope.appId, environment2, "environment")}`;
+}
 function quoteArg2(value2) {
   return `'${value2.replace(/'/g, `'\\''`)}'`;
 }
 
 // src/doctor-checks.ts
 var import_node_child_process3 = require("child_process");
-var import_node_fs10 = require("fs");
-var import_node_path9 = require("path");
+var import_node_fs12 = require("fs");
+var import_node_path10 = require("path");
 
 // src/wrangler.ts
 var import_node_child_process2 = require("child_process");
-var import_node_fs9 = require("fs");
-var import_node_path8 = require("path");
+var import_node_fs11 = require("fs");
+var import_node_path9 = require("path");
 var defaultRunner = (cmd, args, opts) => new Promise((resolvePromise, reject) => {
   const child = (0, import_node_child_process2.spawn)(cmd, args, { cwd: opts?.cwd, stdio: ["pipe", "pipe", "pipe"] });
   let stdout = "";
@@ -3235,28 +3617,28 @@ var defaultRunner = (cmd, args, opts) => new Promise((resolvePromise, reject) =>
 var WRANGLER_CONFIG_FILES = ["wrangler.jsonc", "wrangler.json", "wrangler.toml"];
 function findWranglerConfig(rootDir) {
   for (const name of WRANGLER_CONFIG_FILES) {
-    const path = (0, import_node_path8.join)(rootDir, name);
-    if ((0, import_node_fs9.existsSync)(path)) return path;
+    const path = (0, import_node_path9.join)(rootDir, name);
+    if ((0, import_node_fs11.existsSync)(path)) return path;
   }
   return null;
 }
 function readWranglerConfig(path) {
   if (path.endsWith(".toml")) return null;
   try {
-    return JSON.parse(stripJsonComments((0, import_node_fs9.readFileSync)(path, "utf8")));
+    return JSON.parse(stripJsonComments((0, import_node_fs11.readFileSync)(path, "utf8")));
   } catch {
     return null;
   }
 }
-function stripJsonComments(text) {
+function stripJsonComments(text2) {
   let result = "";
   let inString = false;
-  for (let i = 0; i < text.length; i++) {
-    const ch = text[i];
+  for (let i = 0; i < text2.length; i++) {
+    const ch = text2[i];
     if (inString) {
       result += ch;
       if (ch === "\\") {
-        result += text[i + 1] ?? "";
+        result += text2[i + 1] ?? "";
         i++;
       } else if (ch === '"') {
         inString = false;
@@ -3268,14 +3650,14 @@ function stripJsonComments(text) {
       result += ch;
       continue;
     }
-    if (ch === "/" && text[i + 1] === "/") {
-      while (i < text.length && text[i] !== "\n") i++;
+    if (ch === "/" && text2[i + 1] === "/") {
+      while (i < text2.length && text2[i] !== "\n") i++;
       result += "\n";
       continue;
     }
-    if (ch === "/" && text[i + 1] === "*") {
+    if (ch === "/" && text2[i + 1] === "*") {
       i += 2;
-      while (i < text.length && !(text[i] === "*" && text[i + 1] === "/")) i++;
+      while (i < text2.length && !(text2[i] === "*" && text2[i + 1] === "/")) i++;
       i++;
       continue;
     }
@@ -3292,7 +3674,14 @@ async function wranglerLoggedIn(run, cwd) {
   }
 }
 function wranglerPutSecret(run, opts) {
-  const args = ["wrangler", "secret", "put", opts.name, ...opts.env ? ["--env", opts.env] : []];
+  const args = [
+    "wrangler",
+    "secret",
+    "put",
+    opts.name,
+    ...opts.env ? ["--env", opts.env] : [],
+    ...opts.configPath ? ["--config", opts.configPath] : []
+  ];
   return run("npx", args, { input: opts.value, cwd: opts.cwd });
 }
 
@@ -3341,10 +3730,10 @@ function wranglerWarnings(rootDir) {
   for (const { label, block } of blocks) {
     const assets = block.assets;
     if (assets?.directory) {
-      const dir = (0, import_node_path9.resolve)(rootDir, assets.directory);
-      if (dir === (0, import_node_path9.resolve)(rootDir)) {
+      const dir = (0, import_node_path10.resolve)(rootDir, assets.directory);
+      if (dir === (0, import_node_path10.resolve)(rootDir)) {
         warnings.push(`${label}assets.directory is the project root \u2014 point it at a dedicated build dir (wrangler dev fails with "spawn EBADF")`);
-      } else if ((0, import_node_fs10.existsSync)((0, import_node_path9.join)(dir, "node_modules"))) {
+      } else if ((0, import_node_fs12.existsSync)((0, import_node_path10.join)(dir, "node_modules"))) {
         warnings.push(`${label}assets.directory contains node_modules \u2014 wrangler dev's watcher will exhaust file descriptors`);
       }
     }
@@ -3379,13 +3768,13 @@ function o11yProjectWarnings(rootDir) {
     warnings.push("cannot verify o11y Worker instrumentation \u2014 add a parseable wrangler.jsonc/json config");
     return warnings;
   }
-  const main = typeof config.main === "string" ? (0, import_node_path9.resolve)(rootDir, config.main) : null;
-  if (!main || !(0, import_node_fs10.existsSync)(main)) {
+  const main = typeof config.main === "string" ? (0, import_node_path10.resolve)(rootDir, config.main) : null;
+  if (!main || !(0, import_node_fs12.existsSync)(main)) {
     warnings.push("cannot verify o11y Worker instrumentation \u2014 wrangler main is missing or unreadable");
   } else {
     let source = "";
     try {
-      source = (0, import_node_fs10.readFileSync)(main, "utf8");
+      source = (0, import_node_fs12.readFileSync)(main, "utf8");
     } catch {
     }
     if (!/\bwithObservability\b/.test(source)) {
@@ -3409,7 +3798,7 @@ function calendarProjectWarnings(rootDir) {
 }
 function readPackageJson(rootDir) {
   try {
-    return JSON.parse((0, import_node_fs10.readFileSync)((0, import_node_path9.join)(rootDir, "package.json"), "utf8"));
+    return JSON.parse((0, import_node_fs12.readFileSync)((0, import_node_path10.join)(rootDir, "package.json"), "utf8"));
   } catch {
     return null;
   }
@@ -3636,14 +4025,14 @@ function harnessOption(value2, flag) {
 }
 
 // src/init.ts
-var import_node_fs11 = require("fs");
-var import_node_path10 = require("path");
-var import_apps7 = require("@odla-ai/apps");
+var import_node_fs13 = require("fs");
+var import_node_path11 = require("path");
+var import_apps9 = require("@odla-ai/apps");
 function initProject(options) {
   const out = options.stdout ?? console;
-  const rootDir = (0, import_node_path10.resolve)(options.rootDir ?? process.cwd());
-  const configPath = (0, import_node_path10.resolve)(rootDir, options.configPath ?? "odla.config.mjs");
-  if ((0, import_node_fs11.existsSync)(configPath) && !options.force) {
+  const rootDir = (0, import_node_path11.resolve)(options.rootDir ?? process.cwd());
+  const configPath = (0, import_node_path11.resolve)(rootDir, options.configPath ?? "odla.config.mjs");
+  if ((0, import_node_fs13.existsSync)(configPath) && !options.force) {
     throw new Error(`${configPath} already exists. Pass --force to overwrite.`);
   }
   if (!/^[a-z0-9][a-z0-9-]*$/.test(options.appId)) {
@@ -3652,27 +4041,27 @@ function initProject(options) {
   const envs = options.envs?.length ? options.envs : ["dev"];
   const services = options.services?.length ? options.services : ["db", "ai"];
   for (const service of services) {
-    const definition = (0, import_apps7.appServiceDefinition)(service);
-    if (!definition) throw new Error(`--services contains unknown service "${service}" (known: ${(0, import_apps7.appServiceIds)().join(", ")})`);
+    const definition = (0, import_apps9.appServiceDefinition)(service);
+    if (!definition) throw new Error(`--services contains unknown service "${service}" (known: ${(0, import_apps9.appServiceIds)().join(", ")})`);
     for (const dependency of definition.requires) {
       if (!services.includes(dependency)) throw new Error(`--services ${service} requires ${dependency}`);
     }
   }
   const aiProvider = options.aiProvider ?? "anthropic";
-  (0, import_node_fs11.mkdirSync)((0, import_node_path10.dirname)(configPath), { recursive: true });
-  (0, import_node_fs11.mkdirSync)((0, import_node_path10.resolve)(rootDir, "src/odla"), { recursive: true });
-  (0, import_node_fs11.mkdirSync)((0, import_node_path10.resolve)(rootDir, ".odla"), { recursive: true });
-  (0, import_node_fs11.writeFileSync)(configPath, configTemplate({ appId: options.appId, name: options.name, envs, services, aiProvider }));
-  writeIfMissing((0, import_node_path10.resolve)(rootDir, "src/odla/schema.mjs"), schemaTemplate());
-  writeIfMissing((0, import_node_path10.resolve)(rootDir, "src/odla/rules.mjs"), rulesTemplate());
+  (0, import_node_fs13.mkdirSync)((0, import_node_path11.dirname)(configPath), { recursive: true });
+  (0, import_node_fs13.mkdirSync)((0, import_node_path11.resolve)(rootDir, "src/odla"), { recursive: true });
+  (0, import_node_fs13.mkdirSync)((0, import_node_path11.resolve)(rootDir, ".odla"), { recursive: true });
+  (0, import_node_fs13.writeFileSync)(configPath, configTemplate({ appId: options.appId, name: options.name, envs, services, aiProvider }));
+  writeIfMissing((0, import_node_path11.resolve)(rootDir, "src/odla/schema.mjs"), schemaTemplate());
+  writeIfMissing((0, import_node_path11.resolve)(rootDir, "src/odla/rules.mjs"), rulesTemplate());
   ensureGitignore(rootDir);
   out.log(`created ${relativeDisplay(configPath, rootDir)}`);
   out.log("created src/odla/schema.mjs and src/odla/rules.mjs");
   out.log("updated .gitignore for local odla credentials");
 }
-function writeIfMissing(path, text) {
-  if ((0, import_node_fs11.existsSync)(path)) return;
-  (0, import_node_fs11.writeFileSync)(path, text);
+function writeIfMissing(path, text2) {
+  if ((0, import_node_fs13.existsSync)(path)) return;
+  (0, import_node_fs13.writeFileSync)(path, text2);
 }
 function configTemplate(input) {
   const calendar = input.services.includes("calendar") ? `  calendar: {
@@ -3847,7 +4236,7 @@ function assertWranglerConfig(cfg) {
 
 // src/secrets-set.ts
 var import_ai2 = require("@odla-ai/ai");
-var import_apps8 = require("@odla-ai/apps");
+var import_apps10 = require("@odla-ai/apps");
 var PROD_ENV_NAMES2 = /* @__PURE__ */ new Set(["prod", "production"]);
 async function secretsSet(options) {
   const name = (options.name ?? "").trim();
@@ -3880,13 +4269,13 @@ async function secretsSetClerkKey(options) {
     body: JSON.stringify({ value: value2 })
   });
   if (!res.ok) {
-    const text = scrubValue((await res.text().catch(() => "")).slice(0, 300), value2);
-    throw new Error(`store Clerk secret key failed (${res.status}): ${text || "request failed"}`);
+    const text2 = scrubValue((await res.text().catch(() => "")).slice(0, 300), value2);
+    throw new Error(`store Clerk secret key failed (${res.status}): ${text2 || "request failed"}`);
   }
   out.log(`Clerk secret key stored for ${tenantId} ($clerk_secret, reserved + write-only; the value was never echoed)`);
 }
-function scrubValue(text, value2) {
-  return redactSecrets(text).split(value2).join("[value redacted]");
+function scrubValue(text2, value2) {
+  return redactSecrets(text2).split(value2).join("[value redacted]");
 }
 async function resolveVaultWrite(options) {
   const out = options.stdout ?? console;
@@ -3899,13 +4288,13 @@ async function resolveVaultWrite(options) {
     throw new Error(`refusing to store a secret for "${options.env}" without --yes`);
   }
   const value2 = await secretInputValue(options, "secret");
-  return { cfg, tenantId: (0, import_apps8.tenantIdFor)(cfg.app.id, options.env), value: value2, doFetch, out };
+  return { cfg, tenantId: (0, import_apps10.tenantIdFor)(cfg.app.id, options.env), value: value2, doFetch, out };
 }
 
 // src/skill.ts
-var import_node_fs12 = require("fs");
+var import_node_fs14 = require("fs");
 var import_node_os2 = require("os");
-var import_node_path11 = require("path");
+var import_node_path12 = require("path");
 var import_node_url2 = require("url");
 
 // src/skill-adapters.ts
@@ -3984,8 +4373,8 @@ function installSkill(options = {}) {
   const files = listFiles(sourceDir);
   if (files.length === 0) throw new Error(`no bundled skills found at ${sourceDir}`);
   const harnesses = normalizeHarnesses(options.harnesses, options.global === true);
-  const root = (0, import_node_path11.resolve)(options.dir ?? process.cwd());
-  const home = (0, import_node_path11.resolve)(options.homeDir ?? (0, import_node_os2.homedir)());
+  const root = (0, import_node_path12.resolve)(options.dir ?? process.cwd());
+  const home = (0, import_node_path12.resolve)(options.homeDir ?? (0, import_node_os2.homedir)());
   const plans = /* @__PURE__ */ new Map();
   const targets = /* @__PURE__ */ new Map();
   const rememberTarget = (harness, target) => {
@@ -3999,48 +4388,48 @@ function installSkill(options = {}) {
     plans.set(target, { target, content: content2, boundary, managedMerge });
   };
   const planSkillTree = (targetDir2, boundary = root) => {
-    for (const rel of files) plan((0, import_node_path11.join)(targetDir2, rel), (0, import_node_fs12.readFileSync)((0, import_node_path11.join)(sourceDir, rel), "utf8"), false, boundary);
+    for (const rel of files) plan((0, import_node_path12.join)(targetDir2, rel), (0, import_node_fs14.readFileSync)((0, import_node_path12.join)(sourceDir, rel), "utf8"), false, boundary);
   };
   let targetDir;
   if (options.global) {
-    const claudeRoot = (0, import_node_path11.join)(home, ".claude", "skills");
-    const codexRoot = (0, import_node_path11.resolve)(options.codexHomeDir ?? process.env.CODEX_HOME ?? (0, import_node_path11.join)(home, ".codex"), "skills");
+    const claudeRoot = (0, import_node_path12.join)(home, ".claude", "skills");
+    const codexRoot = (0, import_node_path12.resolve)(options.codexHomeDir ?? process.env.CODEX_HOME ?? (0, import_node_path12.join)(home, ".codex"), "skills");
     targetDir = harnesses[0] === "codex" ? codexRoot : claudeRoot;
     for (const harness of harnesses) {
       const skillRoot = harness === "claude" ? claudeRoot : codexRoot;
-      planSkillTree(skillRoot, harness === "claude" ? home : (0, import_node_path11.dirname)((0, import_node_path11.dirname)(codexRoot)));
+      planSkillTree(skillRoot, harness === "claude" ? home : (0, import_node_path12.dirname)((0, import_node_path12.dirname)(codexRoot)));
       rememberTarget(harness, skillRoot);
     }
   } else {
-    const sharedRoot = (0, import_node_path11.join)(root, ".agents", "skills");
+    const sharedRoot = (0, import_node_path12.join)(root, ".agents", "skills");
     planSkillTree(sharedRoot);
-    const claudeRoot = (0, import_node_path11.join)(root, ".claude", "skills");
+    const claudeRoot = (0, import_node_path12.join)(root, ".claude", "skills");
     targetDir = harnesses.includes("claude") ? claudeRoot : sharedRoot;
     for (const harness of harnesses) rememberTarget(harness, sharedRoot);
     if (harnesses.includes("claude")) {
       for (const skill of skillNames(files)) {
-        const canonical = (0, import_node_fs12.readFileSync)((0, import_node_path11.join)(sourceDir, skill, "SKILL.md"), "utf8");
-        plan((0, import_node_path11.join)(claudeRoot, skill, "SKILL.md"), claudeAdapter(skill, canonical));
+        const canonical = (0, import_node_fs14.readFileSync)((0, import_node_path12.join)(sourceDir, skill, "SKILL.md"), "utf8");
+        plan((0, import_node_path12.join)(claudeRoot, skill, "SKILL.md"), claudeAdapter(skill, canonical));
       }
       rememberTarget("claude", claudeRoot);
     }
     if (harnesses.includes("cursor")) {
-      const cursorRule = (0, import_node_path11.join)(root, ".cursor", "rules", "odla.mdc");
+      const cursorRule = (0, import_node_path12.join)(root, ".cursor", "rules", "odla.mdc");
       plan(cursorRule, CURSOR_RULE);
       rememberTarget("cursor", cursorRule);
     }
     if (harnesses.includes("agents")) {
-      const agentsFile = (0, import_node_path11.join)(root, "AGENTS.md");
+      const agentsFile = (0, import_node_path12.join)(root, "AGENTS.md");
       plan(agentsFile, managedFileContent(agentsFile, PROJECT_INSTRUCTIONS, options.force === true, root), true);
       rememberTarget("agents", agentsFile);
     }
     if (harnesses.includes("copilot")) {
-      const copilotFile = (0, import_node_path11.join)(root, ".github", "copilot-instructions.md");
+      const copilotFile = (0, import_node_path12.join)(root, ".github", "copilot-instructions.md");
       plan(copilotFile, managedFileContent(copilotFile, PROJECT_INSTRUCTIONS, options.force === true, root), true);
       rememberTarget("copilot", copilotFile);
     }
     if (harnesses.includes("gemini")) {
-      const geminiFile = (0, import_node_path11.join)(root, "GEMINI.md");
+      const geminiFile = (0, import_node_path12.join)(root, "GEMINI.md");
       plan(geminiFile, managedFileContent(geminiFile, PROJECT_INSTRUCTIONS, options.force === true, root), true);
       rememberTarget("gemini", geminiFile);
     }
@@ -4054,11 +4443,11 @@ function installSkill(options = {}) {
       conflicts.push(`${file.target} (redirected by symbolic link ${symlink})`);
       continue;
     }
-    if (!(0, import_node_fs12.existsSync)(file.target)) {
+    if (!(0, import_node_fs14.existsSync)(file.target)) {
       writtenPaths.add(file.target);
       continue;
     }
-    const current = (0, import_node_fs12.readFileSync)(file.target, "utf8");
+    const current = (0, import_node_fs14.readFileSync)(file.target, "utf8");
     if (current === file.content) {
       unchangedPaths.add(file.target);
     } else if (file.managedMerge || options.force) {
@@ -4075,9 +4464,9 @@ ${conflicts.map((f) => `  - ${f}`).join("\n")}`
     );
   }
   for (const file of plans.values()) {
-    if (!(0, import_node_fs12.existsSync)(file.target) || (0, import_node_fs12.readFileSync)(file.target, "utf8") !== file.content) {
-      (0, import_node_fs12.mkdirSync)((0, import_node_path11.dirname)(file.target), { recursive: true });
-      (0, import_node_fs12.writeFileSync)(file.target, file.content);
+    if (!(0, import_node_fs14.existsSync)(file.target) || (0, import_node_fs14.readFileSync)(file.target, "utf8") !== file.content) {
+      (0, import_node_fs14.mkdirSync)((0, import_node_path12.dirname)(file.target), { recursive: true });
+      (0, import_node_fs14.writeFileSync)(file.target, file.content);
     }
   }
   const skills = skillNames(files);
@@ -4096,7 +4485,7 @@ ${conflicts.map((f) => `  - ${f}`).join("\n")}`
   };
 }
 function pathsUnder(root, paths) {
-  return [...paths].map((path) => (0, import_node_path11.relative)(root, path)).filter((path) => path !== ".." && !path.startsWith(`..${import_node_path11.sep}`) && !(0, import_node_path11.isAbsolute)(path)).sort();
+  return [...paths].map((path) => (0, import_node_path12.relative)(root, path)).filter((path) => path !== ".." && !path.startsWith(`..${import_node_path12.sep}`) && !(0, import_node_path12.isAbsolute)(path)).sort();
 }
 function normalizeHarnesses(values, global) {
   const requested = values?.length ? values : ["claude"];
@@ -4118,9 +4507,9 @@ function normalizeHarnesses(values, global) {
 function managedFileContent(path, block, force, boundary) {
   const symlink = symlinkedComponent(boundary, path);
   if (symlink) throw new Error(`refusing to manage ${path}: symbolic link component ${symlink}`);
-  if (!(0, import_node_fs12.existsSync)(path)) return `${block}
+  if (!(0, import_node_fs14.existsSync)(path)) return `${block}
 `;
-  const current = (0, import_node_fs12.readFileSync)(path, "utf8");
+  const current = (0, import_node_fs14.readFileSync)(path, "utf8");
   const start = "<!-- odla-ai agent setup:start -->";
   const end = "<!-- odla-ai agent setup:end -->";
   const startAt = current.indexOf(start);
@@ -4141,15 +4530,15 @@ function managedFileContent(path, block, force, boundary) {
   return `${current.slice(0, startAt)}${block}${current.slice(afterEnd)}`;
 }
 function symlinkedComponent(boundary, target) {
-  const rel = (0, import_node_path11.relative)(boundary, target);
-  if (rel === ".." || rel.startsWith(`..${import_node_path11.sep}`) || (0, import_node_path11.isAbsolute)(rel)) {
+  const rel = (0, import_node_path12.relative)(boundary, target);
+  if (rel === ".." || rel.startsWith(`..${import_node_path12.sep}`) || (0, import_node_path12.isAbsolute)(rel)) {
     throw new Error(`agent setup target escapes its install root: ${target}`);
   }
   let current = boundary;
-  for (const part of rel.split(import_node_path11.sep).filter(Boolean)) {
-    current = (0, import_node_path11.join)(current, part);
+  for (const part of rel.split(import_node_path12.sep).filter(Boolean)) {
+    current = (0, import_node_path12.join)(current, part);
     try {
-      if ((0, import_node_fs12.lstatSync)(current).isSymbolicLink()) return current;
+      if ((0, import_node_fs14.lstatSync)(current).isSymbolicLink()) return current;
     } catch (error) {
       if (error.code !== "ENOENT") throw error;
     }
@@ -4160,13 +4549,13 @@ function skillNames(files) {
   return [...new Set(files.filter((file) => /(^|[\\/])SKILL\.md$/.test(file)).map((file) => file.split(/[\\/]/)[0]))].sort();
 }
 function listFiles(dir) {
-  if (!(0, import_node_fs12.existsSync)(dir)) return [];
+  if (!(0, import_node_fs14.existsSync)(dir)) return [];
   const results = [];
   const walk = (current) => {
-    for (const entry of (0, import_node_fs12.readdirSync)(current, { withFileTypes: true })) {
-      const path = (0, import_node_path11.join)(current, entry.name);
+    for (const entry of (0, import_node_fs14.readdirSync)(current, { withFileTypes: true })) {
+      const path = (0, import_node_path12.join)(current, entry.name);
       if (entry.isDirectory()) walk(path);
-      else results.push((0, import_node_path11.relative)(dir, path));
+      else results.push((0, import_node_path12.relative)(dir, path));
     }
   };
   walk(dir);
@@ -4361,10 +4750,14 @@ async function secretsCommand(parsed, deps) {
 async function projectCommand(command, parsed, deps) {
   if (command === "config") {
     const sub = parsed.positionals[1];
-    if (sub !== "diff" && sub !== "plan") {
+    if (sub !== "diff" && sub !== "plan" && sub !== "apply") {
       throw new Error(`unknown config subcommand "${sub ?? ""}". Try "odla-ai config diff --json".`);
     }
-    assertArgs(parsed, ["config", "token", "email", "open", "json"], 2);
+    assertArgs(
+      parsed,
+      sub === "apply" ? ["config", "plan", "idempotency-key", "token", "email", "open", "json"] : ["config", "token", "email", "open", "json"],
+      2
+    );
     const options = {
       configPath: stringOpt(parsed.options.config) ?? "odla.config.mjs",
       token: stringOpt(parsed.options.token),
@@ -4376,7 +4769,42 @@ async function projectCommand(command, parsed, deps) {
       stdout: deps.stdout
     };
     if (sub === "diff") await configDiff(options);
-    else await configPlan(options);
+    else if (sub === "plan") await configPlan(options);
+    else await configApply({
+      ...options,
+      planPath: requiredString(parsed.options.plan, "--plan"),
+      idempotencyKey: stringOpt(parsed.options["idempotency-key"])
+    });
+    return true;
+  }
+  if (command === "operations") {
+    const sub = parsed.positionals[1];
+    if (sub !== "get" && sub !== "wait") {
+      throw new Error(`unknown operations subcommand "${sub ?? ""}". Try "odla-ai operations get <operation-id> --json".`);
+    }
+    assertArgs(
+      parsed,
+      sub === "wait" ? ["config", "token", "email", "open", "json", "interval", "timeout"] : ["config", "token", "email", "open", "json"],
+      3
+    );
+    const operationId = parsed.positionals[2];
+    if (!operationId) throw new Error(`operation id is required`);
+    const options = {
+      configPath: stringOpt(parsed.options.config) ?? "odla.config.mjs",
+      operationId,
+      token: stringOpt(parsed.options.token),
+      email: stringOpt(parsed.options.email),
+      open: parsed.options.open === false ? false : parsed.options.open === true ? true : void 0,
+      json: parsed.options.json === true,
+      fetch: deps.fetch,
+      openApprovalUrl: deps.openUrl,
+      stdout: deps.stdout,
+      pollWait: deps.pollWait,
+      intervalSeconds: numberOpt(parsed.options.interval, "--interval"),
+      timeoutSeconds: numberOpt(parsed.options.timeout, "--timeout")
+    };
+    if (sub === "get") await configOperationGet(options);
+    else await configOperationWait(options);
     return true;
   }
   if (command === "init") {
@@ -4437,9 +4865,9 @@ async function projectCommand(command, parsed, deps) {
 }
 
 // src/code-connect.ts
-var import_node_fs14 = require("fs");
+var import_node_fs15 = require("fs");
 var import_node_os4 = require("os");
-var import_node_path13 = require("path");
+var import_node_path14 = require("path");
 
 // ../harness/dist/chunk-QTUEF2HZ.js
 var HARNESS_PROTOCOL_VERSION = 1;
@@ -4449,7 +4877,7 @@ var CONTROL = /[\u0000-\u0008\u000b\u000c\u000e-\u001f\u007f]/;
 var HarnessProtocolError = class extends Error {
   name = "HarnessProtocolError";
 };
-function record2(value2) {
+function record4(value2) {
   return value2 !== null && typeof value2 === "object" && !Array.isArray(value2) ? value2 : null;
 }
 function boundedText(value2, label, max) {
@@ -4466,7 +4894,7 @@ function parseAgentOutput(line) {
   } catch {
     throw new HarnessProtocolError("agent emitted invalid JSON");
   }
-  const message2 = record2(value2);
+  const message2 = record4(value2);
   if (!message2 || message2.protocolVersion !== HARNESS_PROTOCOL_VERSION) {
     throw new HarnessProtocolError(`agent protocolVersion must be ${HARNESS_PROTOCOL_VERSION}`);
   }
@@ -4479,7 +4907,7 @@ function parseAgentOutput(line) {
     };
   }
   if (message2.type === "inference.request") {
-    const call2 = record2(message2.call);
+    const call2 = record4(message2.call);
     if (!call2 || !Array.isArray(call2.messages) || !Number.isSafeInteger(call2.maxTokens)) {
       throw new HarnessProtocolError("inference.request.call requires messages and maxTokens");
     }
@@ -4491,7 +4919,7 @@ function parseAgentOutput(line) {
     };
   }
   if (message2.type === "tool.request") {
-    const input = record2(message2.input);
+    const input = record4(message2.input);
     const tool = String(message2.tool);
     if (!input || !["sandbox.read", "sandbox.apply_patch", "sandbox.run_recipe"].includes(tool)) {
       throw new HarnessProtocolError("tool.request requires a registered tool and object input");
@@ -4675,8 +5103,8 @@ async function runContainerAttempt(options) {
   let stopped = false;
   let exited = false;
   child.stderr.setEncoding("utf8");
-  child.stderr.on("data", (text) => {
-    if (stderr.length < 64 * 1024) stderr += text.slice(0, 64 * 1024 - stderr.length);
+  child.stderr.on("data", (text2) => {
+    if (stderr.length < 64 * 1024) stderr += text2.slice(0, 64 * 1024 - stderr.length);
   });
   const stop = (reason) => {
     if (stopped || exited) return;
@@ -4834,8 +5262,8 @@ async function materializeGitTree(source, commitSha, options = {}) {
   const maxFiles = options.maxFiles ?? 2e4;
   const maxBytes = options.maxBytes ?? 512 * 1024 * 1024;
   const inventory = (await gitOutput(sourceDir, ["ls-tree", "-rz", commitSha], 16 * 1024 * 1024)).toString("utf8").split("\0").filter(Boolean);
-  const entries = inventory.flatMap((record8) => {
-    const match = /^(100644|100755) blob ([0-9a-f]{40,64})\t([\s\S]+)$/.exec(record8);
+  const entries = inventory.flatMap((record11) => {
+    const match = /^(100644|100755) blob ([0-9a-f]{40,64})\t([\s\S]+)$/.exec(record11);
     return match && allowedWorkspacePath(match[3]) ? [{ mode: match[1], hash: match[2], path: match[3] }] : [];
   });
   if (entries.length > maxFiles) throw new Error(`workspace exceeds ${maxFiles} files`);
@@ -5083,8 +5511,8 @@ function normalize(value2) {
   if (Array.isArray(value2)) return value2.map(normalize);
   if (value2 instanceof Uint8Array) return { $bytes: [...value2] };
   if (typeof value2 === "object") {
-    const record8 = value2;
-    return Object.fromEntries(Object.keys(record8).filter((key) => record8[key] !== void 0).sort().map((key) => [key, normalize(record8[key])]));
+    const record11 = value2;
+    return Object.fromEntries(Object.keys(record11).filter((key) => record11[key] !== void 0).sort().map((key) => [key, normalize(record11[key])]));
   }
   throw new CamelError("state_conflict", "Canonical JSON rejects unsupported values.");
 }
@@ -5163,7 +5591,7 @@ function normalizeReaders(readers) {
 }
 
 // ../camel/dist/code.js
-var DIGEST = /^sha256:[0-9a-f]{64}$/;
+var DIGEST2 = /^sha256:[0-9a-f]{64}$/;
 var SHA = /^[0-9a-f]{40}(?:[0-9a-f]{24})?$/;
 var ID = /^[A-Za-z0-9._:-]{1,160}$/;
 async function digestCodeVerificationReceipt(fields) {
@@ -5198,18 +5626,18 @@ async function digestCodeVerificationReceipt(fields) {
   return `sha256:${await sha256Hex(canonicalJson2(canonical))}`;
 }
 function validate(fields) {
-  if (fields.schemaVersion !== 1 || typeof fields.verificationId !== "string" || !ID.test(fields.verificationId) || typeof fields.trustedBaseCommitSha !== "string" || !SHA.test(fields.trustedBaseCommitSha) || !DIGEST.test(fields.trustedBaseDigest) || !DIGEST.test(fields.patchDigest) || !DIGEST.test(fields.candidateDigest) || !DIGEST.test(fields.sourceDigest) || !DIGEST.test(fields.policyDigest) || !DIGEST.test(fields.changedTestSetDigest) || !Number.isSafeInteger(fields.changedTestCount) || fields.changedTestCount < 0 || fields.changedTestCount > 1e4 || fields.changedTestsRequireReview !== fields.changedTestCount > 0 || fields.recipes.length < 1 || fields.recipes.length > 64) {
+  if (fields.schemaVersion !== 1 || typeof fields.verificationId !== "string" || !ID.test(fields.verificationId) || typeof fields.trustedBaseCommitSha !== "string" || !SHA.test(fields.trustedBaseCommitSha) || !DIGEST2.test(fields.trustedBaseDigest) || !DIGEST2.test(fields.patchDigest) || !DIGEST2.test(fields.candidateDigest) || !DIGEST2.test(fields.sourceDigest) || !DIGEST2.test(fields.policyDigest) || !DIGEST2.test(fields.changedTestSetDigest) || !Number.isSafeInteger(fields.changedTestCount) || fields.changedTestCount < 0 || fields.changedTestCount > 1e4 || fields.changedTestsRequireReview !== fields.changedTestCount > 0 || fields.recipes.length < 1 || fields.recipes.length > 64) {
     throw new CamelError("state_conflict", "Code verification receipt is malformed or outside its bounds.");
   }
   const ids = /* @__PURE__ */ new Set();
   for (const recipe2 of fields.recipes) {
-    if (typeof recipe2.recipeId !== "string" || !ID.test(recipe2.recipeId) || ids.has(recipe2.recipeId) || typeof recipe2.recipeDigest !== "string" || !DIGEST.test(recipe2.recipeDigest) || !["passed", "failed", "timed_out", "output_limited"].includes(recipe2.status) || !Number.isSafeInteger(recipe2.exitCode) || recipe2.exitCode < 0 || recipe2.exitCode > 255 || !Number.isSafeInteger(recipe2.durationMs) || recipe2.durationMs < 0 || recipe2.durationMs > 30 * 6e4) {
+    if (typeof recipe2.recipeId !== "string" || !ID.test(recipe2.recipeId) || ids.has(recipe2.recipeId) || typeof recipe2.recipeDigest !== "string" || !DIGEST2.test(recipe2.recipeDigest) || !["passed", "failed", "timed_out", "output_limited"].includes(recipe2.status) || !Number.isSafeInteger(recipe2.exitCode) || recipe2.exitCode < 0 || recipe2.exitCode > 255 || !Number.isSafeInteger(recipe2.durationMs) || recipe2.durationMs < 0 || recipe2.durationMs > 30 * 6e4) {
       throw new CamelError("state_conflict", "Code verification recipe receipt is malformed or outside its bounds.");
     }
     const artifactIds = /* @__PURE__ */ new Set();
     if (recipe2.artifacts.length > 64) throw new CamelError("state_conflict", "Code verification has too many artifacts.");
     for (const artifact of recipe2.artifacts) {
-      if (typeof artifact.artifactId !== "string" || !ID.test(artifact.artifactId) || artifactIds.has(artifact.artifactId) || !["verified", "missing", "invalid", "too_large"].includes(artifact.status) || artifact.bytes !== null && (!Number.isSafeInteger(artifact.bytes) || artifact.bytes < 0) || artifact.digest !== null && !DIGEST.test(artifact.digest) || artifact.status === "verified" !== (artifact.bytes !== null && artifact.digest !== null) || ["missing", "invalid"].includes(artifact.status) && (artifact.bytes !== null || artifact.digest !== null) || artifact.status === "too_large" && (artifact.bytes === null || artifact.digest !== null)) {
+      if (typeof artifact.artifactId !== "string" || !ID.test(artifact.artifactId) || artifactIds.has(artifact.artifactId) || !["verified", "missing", "invalid", "too_large"].includes(artifact.status) || artifact.bytes !== null && (!Number.isSafeInteger(artifact.bytes) || artifact.bytes < 0) || artifact.digest !== null && !DIGEST2.test(artifact.digest) || artifact.status === "verified" !== (artifact.bytes !== null && artifact.digest !== null) || ["missing", "invalid"].includes(artifact.status) && (artifact.bytes !== null || artifact.digest !== null) || artifact.status === "too_large" && (artifact.bytes === null || artifact.digest !== null)) {
         throw new CamelError("state_conflict", "Code verification artifact receipt is malformed.");
       }
       artifactIds.add(artifact.artifactId);
@@ -5225,7 +5653,7 @@ function validate(fields) {
   }
 }
 var SHA2 = /^[0-9a-f]{40}(?:[0-9a-f]{24})?$/;
-var DIGEST2 = /^sha256:[0-9a-f]{64}$/;
+var DIGEST22 = /^sha256:[0-9a-f]{64}$/;
 var ID2 = /^[A-Za-z0-9._:-]{1,180}$/;
 var MAX_PATCH_BYTES = 256 * 1024;
 var MAX_STATE_BYTES = 64 * 1024;
@@ -5270,14 +5698,14 @@ function normalizeState(value2) {
   ]);
   const planCursor = state2.planCursor;
   const conversations = strings(state2.conversationRefs, "conversationRefs", ID2, 256, false);
-  const approvals = strings(state2.unresolvedApprovals, "unresolvedApprovals", DIGEST2, 256, true);
-  if (planCursor !== null && (typeof planCursor !== "string" || !ID2.test(planCursor)) || typeof state2.planningInputDigest !== "string" || !DIGEST2.test(state2.planningInputDigest) || typeof state2.buildPolicyDigest !== "string" || !DIGEST2.test(state2.buildPolicyDigest) || state2.dependencyLayerDigest !== null && (typeof state2.dependencyLayerDigest !== "string" || !DIGEST2.test(state2.dependencyLayerDigest)) || state2.verificationDigest !== null && (typeof state2.verificationDigest !== "string" || !DIGEST2.test(state2.verificationDigest)) || state2.reviewDigest !== null && (typeof state2.reviewDigest !== "string" || !DIGEST2.test(state2.reviewDigest)) || !["candidate_untrusted", "verified", "reviewed"].includes(String(state2.trustStatus)) || !Array.isArray(state2.completedEffects) || state2.completedEffects.length > 256) {
+  const approvals = strings(state2.unresolvedApprovals, "unresolvedApprovals", DIGEST22, 256, true);
+  if (planCursor !== null && (typeof planCursor !== "string" || !ID2.test(planCursor)) || typeof state2.planningInputDigest !== "string" || !DIGEST22.test(state2.planningInputDigest) || typeof state2.buildPolicyDigest !== "string" || !DIGEST22.test(state2.buildPolicyDigest) || state2.dependencyLayerDigest !== null && (typeof state2.dependencyLayerDigest !== "string" || !DIGEST22.test(state2.dependencyLayerDigest)) || state2.verificationDigest !== null && (typeof state2.verificationDigest !== "string" || !DIGEST22.test(state2.verificationDigest)) || state2.reviewDigest !== null && (typeof state2.reviewDigest !== "string" || !DIGEST22.test(state2.reviewDigest)) || !["candidate_untrusted", "verified", "reviewed"].includes(String(state2.trustStatus)) || !Array.isArray(state2.completedEffects) || state2.completedEffects.length > 256) {
     throw invalid2("Portable checkpoint state is malformed or outside its bounds.");
   }
   const effects = state2.completedEffects.map((item) => {
     const effect = object(item, "completed effect");
     exact2(effect, ["effectId", "actionDigest", "receiptDigest"]);
-    if (typeof effect.effectId !== "string" || !ID2.test(effect.effectId) || typeof effect.actionDigest !== "string" || !DIGEST2.test(effect.actionDigest) || typeof effect.receiptDigest !== "string" || !DIGEST2.test(effect.receiptDigest)) {
+    if (typeof effect.effectId !== "string" || !ID2.test(effect.effectId) || typeof effect.actionDigest !== "string" || !DIGEST22.test(effect.actionDigest) || typeof effect.receiptDigest !== "string" || !DIGEST22.test(effect.receiptDigest)) {
       throw invalid2("Portable checkpoint effect receipt is malformed.");
     }
     return {
@@ -5508,8 +5936,8 @@ function boundedInteger(value2, spec) {
 }
 function boundedNumber(value2, spec) {
   if (spec.kind !== "finite_number" || typeof value2 !== "number" || !Number.isFinite(value2) || value2 < spec.minimum || value2 > spec.maximum) throw new CamelError("conversion_rejected", "Finite-number conversion rejected the structured value.");
-  const text = String(value2);
-  if (/e/i.test(text) || (text.split(".")[1]?.length ?? 0) > spec.maximumDecimalPlaces) throw new CamelError("conversion_rejected", "Finite-number conversion rejected a non-canonical decimal.");
+  const text2 = String(value2);
+  if (/e/i.test(text2) || (text2.split(".")[1]?.length ?? 0) > spec.maximumDecimalPlaces) throw new CamelError("conversion_rejected", "Finite-number conversion rejected a non-canonical decimal.");
   return value2;
 }
 function enumMember(value2, spec) {
@@ -5665,8 +6093,8 @@ function validateUnsafeSelector(path, value2, tool) {
   return void 0;
 }
 function looksLikeDestination(value2) {
-  const text = value2.trim();
-  return /^(?:[a-z][a-z0-9+.-]*:\/\/|\/|\\\\)/i.test(text) || /^[\w.-]+\.[a-z]{2,}(?:[/:]|$)/i.test(text);
+  const text2 = value2.trim();
+  return /^(?:[a-z][a-z0-9+.-]*:\/\/|\/|\\\\)/i.test(text2) || /^[\w.-]+\.[a-z]{2,}(?:[/:]|$)/i.test(text2);
 }
 
 // ../harness/dist/chunk-GMVZ4LZH.js
@@ -5807,7 +6235,7 @@ function createCodeRuntimeControlClient(options) {
     }
     const value2 = await response2.json().catch(() => null);
     if (!response2.ok) {
-      const problem = record3(record3(value2)?.error);
+      const problem = record5(record5(value2)?.error);
       throw new CodeRuntimeControlError(
         typeof problem?.message === "string" ? problem.message : `Code runtime request failed (${response2.status})`,
         response2.status,
@@ -5829,12 +6257,12 @@ function createCodeRuntimeControlClient(options) {
       await call2(`/registry/code/runtime/sessions/${validSessionId(sessionId)}/source`, {})
     ),
     infer: async (sessionId, inference) => {
-      const value2 = record3(await call2(
+      const value2 = record5(await call2(
         `/registry/code/runtime/sessions/${validSessionId(sessionId)}/inference`,
         inference,
         modelRequestTimeoutMs
       ));
-      if (!value2 || value2.requestId !== inference.requestId || !record3(value2.response) || !record3(value2.receipt)) {
+      if (!value2 || value2.requestId !== inference.requestId || !record5(value2.response) || !record5(value2.receipt)) {
         throw new CodeRuntimeControlError("invalid Code inference response", 502, "invalid_response");
       }
       return value2;
@@ -5892,12 +6320,12 @@ function validateHeartbeat(version, capabilities) {
   }
 }
 function parseSnapshot(value2) {
-  const root = record3(value2);
-  const host = record3(root?.host);
+  const root = record5(value2);
+  const host = record5(root?.host);
   if (!host || typeof host.hostId !== "string" || typeof host.runtimeVersion !== "string" || !Number.isSafeInteger(host.lastSeenAt) || host.revokedAt !== null || !Array.isArray(root?.bindings) || root.bindings.length > 1024 || !Array.isArray(root?.commands) || root.commands.length > 64) throw invalid("heartbeat");
   const bindingIds = /* @__PURE__ */ new Set();
   const bindings = root.bindings.map((item) => {
-    const binding = record3(item);
+    const binding = record5(item);
     if (!binding || typeof binding.bindingId !== "string" || typeof binding.appId !== "string" || binding.env !== "dev" && binding.env !== "prod" || typeof binding.offerId !== "string" || binding.hostId !== host.hostId || !Number.isSafeInteger(binding.generation) || Number(binding.generation) < 1 || binding.revokedAt !== null || bindingIds.has(binding.bindingId)) {
       throw invalid("binding");
     }
@@ -5907,10 +6335,10 @@ function parseSnapshot(value2) {
   const commandIds = /* @__PURE__ */ new Set();
   const commandSequences = /* @__PURE__ */ new Set();
   const commands = root.commands.map((item) => {
-    const command = record3(item);
+    const command = record5(item);
     const binding = bindings.find((candidate) => candidate.bindingId === command?.bindingId);
     const sequenceKey = `${String(command?.instanceId)}:${String(command?.sequence)}`;
-    if (!command || typeof command.commandId !== "string" || !/^ccmd_[0-9a-f]{32}$/.test(command.commandId) || typeof command.instanceId !== "string" || typeof command.sessionId !== "string" || !/^csess_[0-9a-f]{32}$/.test(command.sessionId) || typeof command.appId !== "string" || command.env !== "dev" && command.env !== "prod" || command.hostId !== host.hostId || !binding || binding.appId !== command.appId || binding.generation !== command.bindingGeneration || !Number.isSafeInteger(command.sequence) || Number(command.sequence) < 1 || commandIds.has(command.commandId) || commandSequences.has(sequenceKey) || !["start", "prompt", "checkpoint_stop", "resume"].includes(String(command.kind)) || !record3(command.payload) || !Number.isSafeInteger(command.createdAt)) throw invalid("command");
+    if (!command || typeof command.commandId !== "string" || !/^ccmd_[0-9a-f]{32}$/.test(command.commandId) || typeof command.instanceId !== "string" || typeof command.sessionId !== "string" || !/^csess_[0-9a-f]{32}$/.test(command.sessionId) || typeof command.appId !== "string" || command.env !== "dev" && command.env !== "prod" || command.hostId !== host.hostId || !binding || binding.appId !== command.appId || binding.generation !== command.bindingGeneration || !Number.isSafeInteger(command.sequence) || Number(command.sequence) < 1 || commandIds.has(command.commandId) || commandSequences.has(sequenceKey) || !["start", "prompt", "checkpoint_stop", "resume"].includes(String(command.kind)) || !record5(command.payload) || !Number.isSafeInteger(command.createdAt)) throw invalid("command");
     commandIds.add(command.commandId);
     commandSequences.add(sequenceKey);
     return command;
@@ -5918,10 +6346,10 @@ function parseSnapshot(value2) {
   return { host, bindings, commands };
 }
 async function parseSource(value2) {
-  const snapshot = record3(record3(value2)?.snapshot);
+  const snapshot = record5(record5(value2)?.snapshot);
   if (!snapshot || typeof snapshot.repository !== "string" || typeof snapshot.commitSha !== "string" || typeof snapshot.treeDigest !== "string" || !Array.isArray(snapshot.files)) throw invalid("source");
   const files = snapshot.files.map((value22) => {
-    const file = record3(value22);
+    const file = record5(value22);
     if (!file || typeof file.path !== "string" || typeof file.content !== "string") throw invalid("source file");
     return { path: file.path, content: file.content };
   });
@@ -5930,11 +6358,11 @@ async function parseSource(value2) {
   const aliases = /* @__PURE__ */ new Set();
   const references = [];
   for (const item of referencesValue) {
-    const reference = record3(item);
+    const reference = record5(item);
     if (!reference || typeof reference.alias !== "string" || !/^[a-z][a-z0-9-]{0,39}$/.test(reference.alias) || aliases.has(reference.alias) || reference.alias === "primary" || typeof reference.repository !== "string" || typeof reference.commitSha !== "string" || typeof reference.treeDigest !== "string" || !Array.isArray(reference.files)) throw invalid("reference source");
     aliases.add(reference.alias);
     const referenceFiles = reference.files.map((entry) => {
-      const file = record3(entry);
+      const file = record5(entry);
       if (!file || typeof file.path !== "string" || typeof file.content !== "string") throw invalid("reference source file");
       return { path: file.path, content: file.content };
     });
@@ -5949,18 +6377,18 @@ async function parseSource(value2) {
   return { ...source, treeDigest: digest, ...references.length ? { references } : {} };
 }
 function parseReview(value2) {
-  const review = record3(record3(value2)?.review);
+  const review = record5(record5(value2)?.review);
   if (!review || !["approved", "rejected"].includes(String(review.verdict)) || typeof review.reviewDigest !== "string" || !/^sha256:[0-9a-f]{64}$/.test(review.reviewDigest) || typeof review.provider !== "string" || !review.provider || typeof review.model !== "string" || !review.model || !Number.isSafeInteger(review.policyVersion) || Number(review.policyVersion) < 1) throw invalid("review");
   return review;
 }
 function parseCandidate(value2) {
-  const candidate = record3(record3(value2)?.candidate);
+  const candidate = record5(record5(value2)?.candidate);
   if (!candidate || typeof candidate.candidateId !== "string" || !/^ccand_[0-9a-f]{32}$/.test(candidate.candidateId) || !["submitted", "approved", "published", "failed"].includes(String(candidate.status))) {
     throw invalid("candidate");
   }
   return { candidateId: candidate.candidateId, status: candidate.status };
 }
-var record3 = (value2) => value2 && typeof value2 === "object" && !Array.isArray(value2) ? value2 : null;
+var record5 = (value2) => value2 && typeof value2 === "object" && !Array.isArray(value2) ? value2 : null;
 var invalid = (part) => new CodeRuntimeControlError(`invalid Code runtime ${part} response`, 502, "invalid_response");
 var RESERVED = /* @__PURE__ */ new Set([".git", ".odla", ".wrangler", "node_modules", "dist", "coverage"]);
 var SECRET = /^(?:\.env(?:\..+)?|\.dev\.vars|credentials(?:\..+)?\.json|dev-token(?:\..+)?\.json)$/i;
@@ -6035,8 +6463,8 @@ function gitApply(cwd, patch2, check) {
     });
     let stderr = "";
     child.stderr.setEncoding("utf8");
-    child.stderr.on("data", (text) => {
-      if (stderr.length < 4e3) stderr += text.slice(0, 4e3);
+    child.stderr.on("data", (text2) => {
+      if (stderr.length < 4e3) stderr += text2.slice(0, 4e3);
     });
     child.once("error", reject);
     child.once("exit", (code) => code === 0 ? accept() : reject(new TypeError(`patch did not apply: ${stderr.trim().slice(0, 500)}`)));
@@ -7207,10 +7635,10 @@ var CodePiRuntimeEngine = class {
       task: lease.task,
       limits: this.options.limits,
       signal: active.abort.signal,
-      onStderr: (text) => this.#event(command, {
+      onStderr: (text2) => this.#event(command, {
         type: "message",
         actor: "system",
-        body: text.slice(0, 4e3)
+        body: text2.slice(0, 4e3)
       }, active.conversationRefs),
       onMessage: async (output) => {
         if (output.type === "inference.request") {
@@ -7323,13 +7751,6 @@ var CodePiRuntimeEngine = class {
   }
 };
 
-// src/version.ts
-var import_node_fs13 = require("fs");
-function cliVersion() {
-  const pkg = JSON.parse((0, import_node_fs13.readFileSync)(new URL("../package.json", importMetaUrl), "utf8"));
-  return pkg.version ?? "unknown";
-}
-
 // src/security-hosted-github.ts
 var import_node_child_process4 = require("child_process");
 var import_node_util2 = require("util");
@@ -7605,7 +8026,7 @@ var import_node_child_process6 = require("child_process");
 var import_node_crypto3 = require("crypto");
 var import_promises10 = require("fs/promises");
 var import_node_os3 = require("os");
-var import_node_path12 = require("path");
+var import_node_path13 = require("path");
 var import_node_url3 = require("url");
 
 // src/code-runtime-config.ts
@@ -7691,10 +8112,10 @@ async function embeddedPiImageName() {
   return `odla-ai/pi-agent:embedded-sha256-${(0, import_node_crypto3.createHash)("sha256").update(bundle).digest("hex")}`;
 }
 async function buildEmbeddedPiImage(engine, image, run) {
-  const context = await (0, import_promises10.mkdtemp)((0, import_node_path12.join)((0, import_node_os3.tmpdir)(), "odla-code-pi-"));
+  const context = await (0, import_promises10.mkdtemp)((0, import_node_path13.join)((0, import_node_os3.tmpdir)(), "odla-code-pi-"));
   try {
-    await (0, import_promises10.copyFile)(embeddedPiAssetPath(), (0, import_node_path12.join)(context, "pi-agent.js"));
-    await (0, import_promises10.writeFile)((0, import_node_path12.join)(context, "Dockerfile"), [
+    await (0, import_promises10.copyFile)(embeddedPiAssetPath(), (0, import_node_path13.join)(context, "pi-agent.js"));
+    await (0, import_promises10.writeFile)((0, import_node_path13.join)(context, "Dockerfile"), [
       `FROM ${CODE_NODE_IMAGE}`,
       "COPY pi-agent.js /opt/odla/pi-agent.js",
       "WORKDIR /workspace",
@@ -7710,8 +8131,8 @@ async function buildEmbeddedPiImage(engine, image, run) {
 // src/code-connect.ts
 async function codeConnect(options) {
   const cwd = options.cwd ?? process.cwd();
-  const configPath = (0, import_node_path13.resolve)(cwd, options.configPath);
-  const cfg = (0, import_node_fs14.existsSync)(configPath) ? await loadProjectConfig(configPath) : null;
+  const configPath = (0, import_node_path14.resolve)(cwd, options.configPath);
+  const cfg = (0, import_node_fs15.existsSync)(configPath) ? await loadProjectConfig(configPath) : null;
   const requestedAppId = options.appId?.trim();
   if (requestedAppId && !/^[a-z0-9][a-z0-9-]{1,62}$/.test(requestedAppId)) {
     throw new Error("--app-id must be a valid odla app id");
@@ -7869,20 +8290,20 @@ async function runCodeRuntime(input) {
   }
 }
 function parseConnection(value2, appId, appEnv) {
-  const root = record4(value2);
-  const host = record4(root?.host);
-  const offer = record4(root?.offer);
-  const binding = record4(root?.binding);
+  const root = record6(value2);
+  const host = record6(root?.host);
+  const offer = record6(root?.offer);
+  const binding = record6(root?.binding);
   if (!root || typeof root.token !== "string" || !/^odla_code_host_[0-9a-f]{64}$/.test(root.token) || typeof root.resumed !== "boolean" || !host || !/^chost_[0-9a-f]{32}$/.test(String(host.hostId)) || typeof host.name !== "string" || !offer || !Number.isSafeInteger(offer.slots) || !binding || typeof binding.appId !== "string" || !binding.appId || appId && binding.appId !== appId || binding.env !== appEnv || !Number.isSafeInteger(binding.generation)) {
     throw new Error("connect Code host returned an invalid response");
   }
   return root;
 }
 function apiFailure(action2, status, value2) {
-  const message2 = record4(record4(value2)?.error)?.message;
+  const message2 = record6(record6(value2)?.error)?.message;
   return `${action2} failed (${status})${typeof message2 === "string" ? `: ${message2}` : ""}`;
 }
-function record4(value2) {
+function record6(value2) {
   return value2 && typeof value2 === "object" && !Array.isArray(value2) ? value2 : null;
 }
 
@@ -8097,8 +8518,10 @@ Usage:
   odla-ai setup [--dir <project>] [--agent <name>] [--global] [--force]
   odla-ai init --app-id <id> --name <name> [--services db,ai,o11y,calendar] [--env dev --env prod]
   odla-ai doctor [--config odla.config.mjs]
-  odla-ai config diff [--config odla.config.mjs] [--email <odla-account>] [--json]
-  odla-ai config plan [--config odla.config.mjs] [--email <odla-account>] [--json]
+  odla-ai config <diff|plan> [--config odla.config.mjs] [--email <odla-account>] [--json]
+  odla-ai config apply --plan <plan.json> [--idempotency-key <key>] [--email <odla-account>] [--json]
+  odla-ai operations get <operation-id> [--json]
+  odla-ai operations wait <operation-id> [--interval <seconds>] [--timeout <seconds>] [--json]
   odla-ai calendar status [--env dev] [--email <odla-account>] [--json]
   odla-ai calendar calendars [--env dev] [--email <odla-account>] [--json]
   odla-ai calendar connect [--env dev] [--email <odla-account>] [--no-open] [--yes]
@@ -8149,6 +8572,7 @@ Usage:
   odla-ai context remove <name> --yes [--json]
   odla-ai o11y status [--app <id>] [--context <name>] [--platform https://odla.ai] [--env prod] [--minutes 60] [--json]
   odla-ai platform status [--context <name>] [--platform https://odla.ai] [--email <odla-account>] [--json]
+  odla-ai platform chat-credentials rotate [--context <name>] [--email <odla-account>] [--wrangler-config <path>] [--expected-version <id>] [--json] --yes
   odla-ai whoami [--context <name>] [--platform https://odla.ai] [--json]
   odla-ai runbook ask "<question>" [--app <id>] [--all] [--json]
   odla-ai runbook search "<question>" [--app <id>] [--all] [--limit <n>] [--json]
@@ -8212,9 +8636,9 @@ Commands:
                does and what it guarantees is JSDoc, rendered per package at
                https://odla.ai/docs and shipped in the installed .d.ts. Answering
                a question usually needs both.
-  whoami       Report who this terminal is authenticated as, and whether it holds
-               platform admin. A handshake-minted device token is never admin,
-               however the human who approved it is configured.
+  whoami       Report the actual principal name, handle and kind, its manager,
+               credential kind, accountable owner, and platform-admin status.
+               A manager relationship never supplies authority by itself.
   context      Explain selected config, platform, app, environment, and
                developer-token provenance without printing credentials or
                starting a device handshake. Operator work can run outside a
@@ -8223,8 +8647,8 @@ Commands:
   setup        Install offline odla runbooks for common coding-agent harnesses.
   init         Create a generic odla.config.mjs plus starter schema/rules files.
   doctor       Validate and summarize the project config without network calls.
-  config       Read-only diff and revision-bound plan for checked-in Registry
-               intent; runtime-owned fields and excluded coverage stay explicit.
+  config       Diff Registry intent, freeze a CAS-bound plan, and conditionally apply its safe actions.
+  operations   Inspect or wait on one exact, durable config-operation receipt.
   calendar     Inspect, connect, or disconnect the live Google booking connection.
   app          Archive (suspend, data retained), restore, export, import, or
                manage the co-owners of the app. Archiving takes every
@@ -8334,6 +8758,58 @@ Safety:
 `);
 }
 
+// src/discuss-principals.ts
+function mergeDiscussPrincipals(target, source) {
+  Object.assign(target.authors, source.authors ?? {});
+  Object.assign(target.principals, source.principals ?? {});
+}
+var withAt = (handle) => handle.startsWith("@") ? handle : `@${handle}`;
+function discussPrincipalLabel(principalId, authorKind, projection) {
+  const profile = projection.principals?.[principalId];
+  if (profile) {
+    const identity = `${profile.displayName} (${withAt(profile.handle)})`;
+    if (profile.kind === "agent") {
+      return profile.managerDisplayName ? `${identity} \u2014 agent managed by ${profile.managerDisplayName}` : `${identity} \u2014 agent`;
+    }
+    return profile.kind === "service" ? `${identity} \u2014 service` : identity;
+  }
+  const legacyName = projection.authors?.[principalId]?.trim();
+  if (legacyName) {
+    return authorKind === "bot" ? `${legacyName} \u2014 agent` : legacyName;
+  }
+  return authorKind === "bot" ? "Unnamed agent" : "Unnamed member";
+}
+
+// src/discuss-read-render.ts
+function discussBodyWithRefs(post) {
+  if (!post.refs || post.refs.length === 0) return post.body;
+  let out = "";
+  let cursor = 0;
+  for (const ref of [...post.refs].sort((a, b) => a.start - b.start)) {
+    if (ref.start < cursor || ref.end > post.body.length) continue;
+    out += post.body.slice(cursor, ref.start) + `@[${ref.label}](${ref.kind}/${ref.id})`;
+    cursor = ref.end;
+  }
+  return out + post.body.slice(cursor);
+}
+function renderDiscussRead(ctx, topic, posts, projection) {
+  const status = topic.resolved ? "resolved" : "open";
+  ctx.out.log(`${topic.subject}  [${status}]  ${topic.appId ?? ""}`);
+  for (const post of posts) {
+    const who = discussPrincipalLabel(
+      post.authorId,
+      post.authorKind,
+      projection
+    );
+    ctx.out.log(`
+\u2014 ${who}`);
+    ctx.out.log(discussBodyWithRefs(post));
+    for (const file of post.attachments ?? []) {
+      ctx.out.log(`  [attachment] ${file.name} (${file.size} bytes)`);
+    }
+  }
+}
+
 // src/discuss-actions.ts
 var writeMutationId = (parsed) => stringOpt(parsed.options["mutation-id"]) ?? crypto.randomUUID();
 async function request(ctx, method, path, body) {
@@ -8352,17 +8828,6 @@ function emit(ctx, value2, human) {
   else human();
 }
 var state = (topic) => topic.resolved ? "resolved" : "open";
-function bodyWithRefs(post) {
-  if (!post.refs || post.refs.length === 0) return post.body;
-  let out = "";
-  let cursor = 0;
-  for (const ref of [...post.refs].sort((a, b) => a.start - b.start)) {
-    if (ref.start < cursor || ref.end > post.body.length) continue;
-    out += post.body.slice(cursor, ref.start) + `@[${ref.label}](${ref.kind}/${ref.id})`;
-    cursor = ref.end;
-  }
-  return out + post.body.slice(cursor);
-}
 function content(parsed) {
   const markup = stringOpt(parsed.options.markup);
   if (markup) return { markup };
@@ -8417,11 +8882,19 @@ async function discussRead(ctx, id, parsed) {
       offset: requestedOffset ?? "0"
     });
     const page = await request(ctx, "GET", `/topics/${encodeURIComponent(id)}?${query}`);
-    emit(ctx, page, () => renderRead(ctx, page.topic, page.posts));
+    emit(
+      ctx,
+      page,
+      () => renderDiscussRead(ctx, page.topic, page.posts, page)
+    );
     return;
   }
   for (let scan = 0; scan < 3; scan++) {
     const posts = /* @__PURE__ */ new Map();
+    const projection = {
+      authors: {},
+      principals: {}
+    };
     let topic = null;
     let offset = 0;
     for (; ; ) {
@@ -8432,6 +8905,7 @@ async function discussRead(ctx, id, parsed) {
       );
       topic = page.topic;
       for (const post of page.posts) posts.set(post.id, post);
+      mergeDiscussPrincipals(projection, page);
       if (posts.size > 1e4) throw new Error("discuss read failed: conversation exceeds 10000 posts");
       if (!page.page?.hasMore) break;
       if (page.page.nextOffset === null || page.page.nextOffset <= offset) {
@@ -8444,24 +8918,18 @@ async function discussRead(ctx, id, parsed) {
     );
     const expected = Number.isInteger(topic.replyCount) ? topic.replyCount + 1 : ordered.length;
     if (ordered.length === expected) {
-      const result = { topic, posts: ordered };
-      emit(ctx, result, () => renderRead(ctx, result.topic, result.posts));
+      const result = { topic, posts: ordered, ...projection };
+      emit(
+        ctx,
+        result,
+        () => renderDiscussRead(ctx, result.topic, result.posts, result)
+      );
       return;
     }
     if (offset === 0) throw new Error("discuss read failed: registry did not provide forward post pages");
   }
   throw new Error("discuss read failed: conversation changed during every complete-read attempt");
 }
-function renderRead(ctx, topic, posts) {
-  ctx.out.log(`${topic.subject}  [${state(topic)}]  ${topic.appId ?? ""}`);
-  for (const post of posts) {
-    const who = post.authorKind === "bot" ? `${post.authorId} (agent)` : post.authorId;
-    ctx.out.log(`
-\u2014 ${who}`);
-    ctx.out.log(bodyWithRefs(post));
-    for (const file of post.attachments ?? []) ctx.out.log(`  [attachment] ${file.name} (${file.size} bytes)`);
-  }
-}
 async function discussPost(ctx, parsed) {
   const appId = stringOpt(parsed.options.app) ?? ctx.appId;
   if (!appId) throw new Error("discuss post needs --app <appId>");
@@ -8686,6 +9154,8 @@ async function discussWatch(ctx, topicId, parsed) {
         found: true,
         cursor,
         events: matching,
+        ...page.authors ? { authors: page.authors } : {},
+        ...page.principals ? { principals: page.principals } : {},
         ...posts && posts.length > 0 ? { posts } : {},
         ...topics && topics.length > 0 ? { topics } : {}
       });
@@ -8718,7 +9188,11 @@ function report2(ctx, parsed, result) {
     ctx.out.log(JSON.stringify(result, null, 2));
   } else if (parsed.options.jsonl !== true && result.found) {
     for (const post of result.posts ?? []) {
-      const who = post.authorKind === "bot" ? `${post.authorId} (agent)` : post.authorId;
+      const who = discussPrincipalLabel(
+        post.authorId,
+        post.authorKind,
+        result
+      );
       ctx.out.log(`\u2014 ${who}
 ${post.body}`);
     }
@@ -8863,8 +9337,8 @@ function collectFields(parsed, allowClear) {
       if (allowClear) out[spec.key] = null;
       continue;
     }
-    const text = stringOpt(value2);
-    out[spec.key] = spec.num ? Number(text) : text;
+    const text2 = stringOpt(value2);
+    out[spec.key] = spec.num ? Number(text2) : text2;
   }
   return out;
 }
@@ -8931,8 +9405,8 @@ async function pmAdd(ctx, entity, parsed) {
   emit2(ctx, res, () => ctx.out.log(`created ${entity} ${res.id}`));
 }
 async function pmGet(ctx, entity, id) {
-  const { record: record8 } = await pmRequest(ctx, "GET", `/${entity}/${encodeURIComponent(id)}`);
-  emit2(ctx, record8, () => printRecord(ctx, entity, record8));
+  const { record: record11 } = await pmRequest(ctx, "GET", `/${entity}/${encodeURIComponent(id)}`);
+  emit2(ctx, record11, () => printRecord(ctx, entity, record11));
 }
 async function pmSet(ctx, entity, id, parsed) {
   const patch2 = collectEntityFields(entity, parsed, true);
@@ -8977,9 +9451,9 @@ async function pmHandoff(ctx, parsed) {
   ]);
   const handoff = {
     appId,
-    unmetGoals: goals.filter((record8) => record8.status !== "met"),
-    activeTasks: tasks.filter((record8) => record8.column !== "done"),
-    openBugs: bugs.filter((record8) => record8.status !== "fixed" && record8.status !== "wontfix")
+    unmetGoals: goals.filter((record11) => record11.status !== "met"),
+    activeTasks: tasks.filter((record11) => record11.column !== "done"),
+    openBugs: bugs.filter((record11) => record11.status !== "fixed" && record11.status !== "wontfix")
   };
   const result = {
     ...handoff,
@@ -8998,10 +9472,10 @@ async function pmHandoff(ctx, parsed) {
     ]) {
       ctx.out.log(`${label}:`);
       if (!records.length) ctx.out.log("- (none)");
-      else for (const record8 of records) printRecord(
+      else for (const record11 of records) printRecord(
         ctx,
         label === "unmet goals" ? "goal" : label === "active tasks" ? "task" : "bug",
-        record8
+        record11
       );
     }
   });
@@ -9192,19 +9666,180 @@ function age(input) {
   return `${Math.round(input / 6e4)}m`;
 }
 
+// src/platform-chat-credential-command.ts
+var import_node_process10 = __toESM(require("process"), 1);
+async function rotatePlatformChatCredential(parsed, deps) {
+  assertArgs(
+    parsed,
+    [
+      "config",
+      "context",
+      "platform",
+      "token",
+      "email",
+      "open",
+      "json",
+      "yes",
+      "wrangler-config",
+      "expected-version"
+    ],
+    3
+  );
+  if (parsed.options.yes !== true) {
+    throw new Error(
+      "platform chat-credentials rotate changes the production chat secret; pass --yes"
+    );
+  }
+  const context = await resolveOperatorContext(parsed, {
+    allowMissingConfig: true
+  });
+  const platform = context.platform.value;
+  const doFetch = deps.fetch ?? fetch;
+  const out = deps.stdout ?? console;
+  const run = deps.runner ?? defaultRunner;
+  const cwd = import_node_process10.default.cwd();
+  const wranglerConfig = stringOpt(parsed.options["wrangler-config"]) ?? "packages/chat-agent/wrangler.jsonc";
+  if (!await wranglerLoggedIn(run, cwd)) {
+    throw new Error(
+      'Wrangler is not authenticated; run "npx wrangler login" and retry'
+    );
+  }
+  const priorHealth = await doFetch(`${platform}/health/services/chat`);
+  const priorVersion = priorHealth.headers.get("x-odla-worker-version-id");
+  await priorHealth.body?.cancel().catch(() => {
+  });
+  if (!priorVersion) {
+    throw new Error(
+      "chat health did not identify its current Worker version; refusing to rotate"
+    );
+  }
+  const expectedVersion = stringOpt(parsed.options["expected-version"]);
+  if (expectedVersion && priorVersion !== expectedVersion) {
+    throw new Error(
+      `chat health answered from version ${priorVersion}; expected ${expectedVersion}`
+    );
+  }
+  const token = await resolveAdminPlatformToken({
+    platform,
+    scope: "platform:chat:credential:write",
+    token: stringOpt(parsed.options.token),
+    tokenFile: context.credentials.scopedTokenFile,
+    email: stringOpt(parsed.options.email),
+    open: parsed.options.open === false ? false : parsed.options.open === true ? true : void 0,
+    fetch: doFetch,
+    stdout: out,
+    openApprovalUrl: deps.openUrl,
+    label: "odla CLI (rotate built-in Discussion responder)"
+  });
+  const mintedResponse = await doFetch(
+    `${platform}/registry/platform/chat-credentials/rotate`,
+    {
+      method: "POST",
+      headers: { authorization: `Bearer ${token}` }
+    }
+  );
+  const minted = await mintedResponse.json().catch(() => null);
+  if (!mintedResponse.ok) {
+    throw new Error(
+      `mint Discussion credential failed (HTTP ${mintedResponse.status}): ${apiMessage(minted)}`
+    );
+  }
+  if (!isPlatformChatCredential(minted)) {
+    throw new Error(
+      "platform returned an invalid odla.platform-chat-credential/v1 envelope"
+    );
+  }
+  const put = await wranglerPutSecret(run, {
+    name: "ODLA_BOT_TOKENS",
+    value: JSON.stringify({
+      [minted.appId]: { [minted.principalId]: minted.key }
+    }),
+    configPath: wranglerConfig,
+    cwd
+  });
+  if (put.code !== 0) {
+    throw new Error(
+      "Wrangler could not replace ODLA_BOT_TOKENS; the new scoped key was not activated"
+    );
+  }
+  const version = await waitForRotatedChatHealth({
+    fetch: doFetch,
+    platform,
+    priorVersion,
+    wait: deps.pollWait
+  });
+  const result = {
+    schemaVersion: "odla.platform-chat-credential-rotation/v1",
+    appId: minted.appId,
+    appIncarnation: minted.appIncarnation,
+    principalId: minted.principalId,
+    health: { ok: true, service: "odla-chat-agent", version }
+  };
+  if (parsed.options.json === true) {
+    out.log(JSON.stringify(result, null, 2));
+  } else {
+    out.log(
+      `rotated	${result.appId}	${result.principalId}	${result.health.version}`
+    );
+  }
+}
+async function waitForRotatedChatHealth(opts) {
+  const wait2 = opts.wait ?? ((milliseconds) => new Promise((resolve12) => setTimeout(resolve12, milliseconds)));
+  let lastStatus = 0;
+  let lastVersion = null;
+  let lastError = "private_service_unready";
+  for (let attempt = 0; attempt < 60; attempt++) {
+    const response2 = await opts.fetch(
+      `${opts.platform}/health/services/chat`
+    );
+    const body = await response2.json().catch(() => null);
+    const version = response2.headers.get("x-odla-worker-version-id");
+    if (response2.ok && record7(body) && body.ok === true && body.service === "odla-chat-agent" && version && version !== opts.priorVersion) {
+      return version;
+    }
+    lastStatus = response2.status;
+    lastVersion = version;
+    lastError = record7(body) && typeof body.error === "string" ? body.error : "private_service_unready";
+    if (attempt < 59) await wait2(5e3);
+  }
+  throw new Error(
+    `chat health did not converge on the rotated Worker deployment (HTTP ${lastStatus}, version ${lastVersion ?? "unknown"}, ${lastError})`
+  );
+}
+function isPlatformChatCredential(value2) {
+  return record7(value2) && value2.schemaVersion === "odla.platform-chat-credential/v1" && value2.appId === "odla-pm" && typeof value2.appIncarnation === "string" && value2.appIncarnation.length > 0 && value2.principalId === "agent_odla" && typeof value2.key === "string" && value2.key.startsWith("odla_sk_");
+}
+function apiMessage(value2) {
+  if (!record7(value2)) return "request failed";
+  const error = record7(value2.error) ? value2.error : value2;
+  return typeof error.message === "string" ? error.message : typeof error.code === "string" ? error.code : "request failed";
+}
+function record7(value2) {
+  return !!value2 && typeof value2 === "object" && !Array.isArray(value2);
+}
+
 // src/platform-command.ts
 async function platformCommand(parsed, deps = {}) {
+  const action2 = parsed.positionals[1];
+  if (action2 === "status") {
+    return platformStatus(parsed, deps);
+  }
+  if (action2 === "chat-credentials" && parsed.positionals[2] === "rotate") {
+    return rotatePlatformChatCredential(parsed, deps);
+  }
+  throw new Error(
+    `unknown platform action "${[
+      action2,
+      parsed.positionals[2]
+    ].filter(Boolean).join(" ")}". Try "odla-ai platform status --json".`
+  );
+}
+async function platformStatus(parsed, deps) {
   assertArgs(
     parsed,
     ["config", "context", "platform", "token", "email", "open", "json"],
     2
   );
-  const action2 = parsed.positionals[1];
-  if (action2 !== "status") {
-    throw new Error(
-      `unknown platform action "${action2 ?? ""}". Try "odla-ai platform status --json".`
-    );
-  }
   const context = await resolveOperatorContext(parsed, {
     allowMissingConfig: true
   });
@@ -9229,7 +9864,7 @@ async function platformCommand(parsed, deps = {}) {
   const body = await response2.json().catch(() => null);
   if (!response2.ok) {
     throw new Error(
-      `read platform status failed (HTTP ${response2.status}): ${apiMessage(body)}`
+      `read platform status failed (HTTP ${response2.status}): ${apiMessage2(body)}`
     );
   }
   if (!isPlatformStatus(body)) {
@@ -9242,17 +9877,17 @@ async function platformCommand(parsed, deps = {}) {
   }
 }
 function isPlatformStatus(value2) {
-  if (!record5(value2) || value2.schemaVersion !== "odla.platform-status/v1") return false;
-  if (!record5(value2.verdict) || !Array.isArray(value2.verdict.reasons)) return false;
-  if (!record5(value2.catalog) || !record5(value2.summary)) return false;
+  if (!record8(value2) || value2.schemaVersion !== "odla.platform-status/v1") return false;
+  if (!record8(value2.verdict) || !Array.isArray(value2.verdict.reasons)) return false;
+  if (!record8(value2.catalog) || !record8(value2.summary)) return false;
   return Array.isArray(value2.services) && Array.isArray(value2.nextActions);
 }
-function apiMessage(value2) {
-  if (!record5(value2)) return "request failed";
-  const error = record5(value2.error) ? value2.error : value2;
+function apiMessage2(value2) {
+  if (!record8(value2)) return "request failed";
+  const error = record8(value2.error) ? value2.error : value2;
   return typeof error.message === "string" ? error.message : typeof error.code === "string" ? error.code : "request failed";
 }
-function record5(value2) {
+function record8(value2) {
   return !!value2 && typeof value2 === "object" && !Array.isArray(value2);
 }
 
@@ -9293,7 +9928,7 @@ function statusVerdict(reads) {
       severity: "degraded"
     });
   }
-  const performance = record6(reads.liveSync.body.performance) ? reads.liveSync.body.performance : null;
+  const performance = record9(reads.liveSync.body.performance) ? reads.liveSync.body.performance : null;
   if (performance?.status === "unavailable") {
     reasons.push({
       source: "liveSync",
@@ -9374,7 +10009,7 @@ function statusVerdict(reads) {
     reasons
   };
 }
-function record6(value2) {
+function record9(value2) {
   return Boolean(value2) && typeof value2 === "object" && !Array.isArray(value2);
 }
 function numeric2(value2) {
@@ -9402,7 +10037,7 @@ function printO11yStatus(status, out) {
   out.log(
     `o11y status ${status.scope.appId}/${status.scope.env} (${status.scope.minutes}m)`
   );
-  const routes = Array.isArray(status.application.body.routes) ? status.application.body.routes.filter(record7) : [];
+  const routes = Array.isArray(status.application.body.routes) ? status.application.body.routes.filter(record10) : [];
   const requests = routes.reduce(
     (total, row) => total + numeric3(row.requests),
     0
@@ -9414,39 +10049,39 @@ function printO11yStatus(status, out) {
   out.log(
     `application	${status.application.httpStatus}	${requests} requests	${errors} errors`
   );
-  const versions = Array.isArray(status.applicationVersions.body.rows) ? status.applicationVersions.body.rows.filter(record7) : [];
+  const versions = Array.isArray(status.applicationVersions.body.rows) ? status.applicationVersions.body.rows.filter(record10) : [];
   out.log(
     `application-versions	${status.applicationVersions.httpStatus}	${versions.length ? versions.slice(0, 5).map(
       (row) => `${String(row.value || "(unattributed)")}:${numeric3(row.requests)}`
     ).join(", ") : "none observed"}`
   );
   out.log(liveSyncLine(status.liveSync));
-  const canaryDurations = record7(status.canary.body.durationsMs) ? status.canary.body.durationsMs : {};
+  const canaryDurations = record10(status.canary.body.durationsMs) ? status.canary.body.durationsMs : {};
   out.log(
     `canary	${status.canary.httpStatus}	${String(status.canary.body.status ?? status.canary.body.error ?? "unavailable")}	${optionalNumeric(canaryDurations.publishToVisibleMs)} publish-to-visible`
   );
-  const collectorIngest = record7(status.collector.body.ingest) ? status.collector.body.ingest : {};
-  const collectorStorage = record7(collectorIngest.storage) ? collectorIngest.storage : {};
+  const collectorIngest = record10(status.collector.body.ingest) ? status.collector.body.ingest : {};
+  const collectorStorage = record10(collectorIngest.storage) ? collectorIngest.storage : {};
   out.log(
     `collector	${status.collector.httpStatus}	${String(status.collector.body.status ?? status.collector.body.error ?? "unavailable")}	${numeric3(collectorStorage.affectedPoints)} affected points`
   );
-  const providerMetrics = record7(status.provider.body.metrics) ? status.provider.body.metrics : {};
-  const providerCapacity = record7(status.provider.body.capacity) ? status.provider.body.capacity : {};
-  const workerMemory = record7(providerCapacity.memory) ? providerCapacity.memory : {};
+  const providerMetrics = record10(status.provider.body.metrics) ? status.provider.body.metrics : {};
+  const providerCapacity = record10(status.provider.body.capacity) ? status.provider.body.capacity : {};
+  const workerMemory = record10(providerCapacity.memory) ? providerCapacity.memory : {};
   out.log(
     `cloudflare	${status.provider.httpStatus}	${String(status.provider.body.status ?? status.provider.body.error ?? "unavailable")}	${numeric3(providerMetrics.requests)} invocations	${numeric3(providerMetrics.errors)} runtime errors	${optionalBytes(workerMemory.headroomBytes)} isolate memory headroom`
   );
   for (const line of providerCapacityLines(status.providerCapacity)) {
     out.log(line);
   }
-  const coverage = record7(status.providerReconciliation.body.comparison) ? status.providerReconciliation.body.comparison : {};
-  const coverageCounts = record7(status.providerReconciliation.body.counts) ? status.providerReconciliation.body.counts : {};
-  const coverageBudget = record7(status.providerReconciliation.body.budget) ? status.providerReconciliation.body.budget : {};
+  const coverage = record10(status.providerReconciliation.body.comparison) ? status.providerReconciliation.body.comparison : {};
+  const coverageCounts = record10(status.providerReconciliation.body.counts) ? status.providerReconciliation.body.counts : {};
+  const coverageBudget = record10(status.providerReconciliation.body.budget) ? status.providerReconciliation.body.budget : {};
   out.log(
     `request-coverage	${status.providerReconciliation.httpStatus}	${String(status.providerReconciliation.body.status ?? status.providerReconciliation.body.error ?? "unavailable")}	${optionalPercent(coverage.applicationCoverage)} application/provider	${numeric3(coverageCounts.applicationRequests)}/${numeric3(coverageCounts.providerRequests)} requests	\xB1${optionalPercent(coverageBudget.maxRelativeError)} budget`
   );
   const providerPoints = Array.isArray(status.providerHistory.body.points) ? status.providerHistory.body.points.length : 0;
-  const providerFreshness = record7(status.providerHistory.body.freshness) ? status.providerHistory.body.freshness : {};
+  const providerFreshness = record10(status.providerHistory.body.freshness) ? status.providerHistory.body.freshness : {};
   out.log(
     `cloudflare-history	${status.providerHistory.httpStatus}	${String(status.providerHistory.body.status ?? status.providerHistory.body.error ?? "unavailable")}	${providerPoints} snapshots	${optionalAge(providerFreshness.ageMs)} old`
   );
@@ -9455,17 +10090,17 @@ function printO11yStatus(status, out) {
   );
 }
 function providerCapacityLines(read3) {
-  const resources = record7(read3.body.resources) ? read3.body.resources : {};
-  const durableObjects = record7(resources.durableObjects) ? resources.durableObjects : {};
-  const periodic = record7(durableObjects.periodic) ? durableObjects.periodic : {};
-  const storage = record7(durableObjects.sqliteStorage) ? durableObjects.sqliteStorage : {};
-  const d1 = record7(resources.d1) ? resources.d1 : {};
-  const d1Activity = record7(d1.activity) ? d1.activity : {};
-  const d1Storage = record7(d1.storage) ? d1.storage : {};
-  const d1Latency = record7(d1Activity.latency) ? d1Activity.latency : {};
-  const r2 = record7(resources.r2) ? resources.r2 : {};
-  const r2Operations = record7(r2.operations) ? r2.operations : {};
-  const r2Storage = record7(r2.storage) ? r2.storage : {};
+  const resources = record10(read3.body.resources) ? read3.body.resources : {};
+  const durableObjects = record10(resources.durableObjects) ? resources.durableObjects : {};
+  const periodic = record10(durableObjects.periodic) ? durableObjects.periodic : {};
+  const storage = record10(durableObjects.sqliteStorage) ? durableObjects.sqliteStorage : {};
+  const d1 = record10(resources.d1) ? resources.d1 : {};
+  const d1Activity = record10(d1.activity) ? d1.activity : {};
+  const d1Storage = record10(d1.storage) ? d1.storage : {};
+  const d1Latency = record10(d1Activity.latency) ? d1Activity.latency : {};
+  const r2 = record10(resources.r2) ? resources.r2 : {};
+  const r2Operations = record10(r2.operations) ? r2.operations : {};
+  const r2Storage = record10(r2.storage) ? r2.storage : {};
   const status = String(
     read3.body.status ?? read3.body.error ?? "unavailable"
   );
@@ -9476,11 +10111,11 @@ function providerCapacityLines(read3) {
   ];
 }
 function liveSyncLine(read3) {
-  const performance = record7(read3.body.performance) ? read3.body.performance : {};
-  const commitToSend = record7(performance.commitToSend) ? performance.commitToSend : {};
+  const performance = record10(read3.body.performance) ? read3.body.performance : {};
+  const commitToSend = record10(performance.commitToSend) ? performance.commitToSend : {};
   return `live-sync	${read3.httpStatus}	${String(read3.body.status ?? read3.body.error ?? "unavailable")}	${numeric3(read3.body.activeConnections)} active	${optionalNumeric(commitToSend.p95)} commit-to-send p95	${numeric3(performance.sendFailures)} send failures`;
 }
-function record7(value2) {
+function record10(value2) {
   return Boolean(value2) && typeof value2 === "object" && !Array.isArray(value2);
 }
 function numeric3(value2) {
@@ -9649,23 +10284,23 @@ function statusMinutes(value2) {
 }
 async function read2(url, headers, doFetch) {
   const response2 = await doFetch(url, { headers });
-  const text = await response2.text();
+  const text2 = await response2.text();
   let body = {};
-  if (text) {
+  if (text2) {
     try {
-      const value2 = JSON.parse(text);
+      const value2 = JSON.parse(text2);
       body = value2 && typeof value2 === "object" && !Array.isArray(value2) ? value2 : { value: value2 };
     } catch {
-      body = { message: text.slice(0, 300) };
+      body = { message: text2.slice(0, 300) };
     }
   }
   return { httpStatus: response2.status, body };
 }
 
 // src/provision.ts
-var import_apps10 = require("@odla-ai/apps");
+var import_apps12 = require("@odla-ai/apps");
 var import_ai3 = require("@odla-ai/ai");
-var import_node_process10 = __toESM(require("process"), 1);
+var import_node_process11 = __toESM(require("process"), 1);
 
 // src/integration-provision.ts
 var import_db3 = require("@odla-ai/db");
@@ -9720,9 +10355,9 @@ async function responseText(res) {
 }
 
 // src/provision-credentials.ts
-var import_apps9 = require("@odla-ai/apps");
+var import_apps11 = require("@odla-ai/apps");
 async function provisionEnvCredentials(opts) {
-  const tenantId = (0, import_apps9.tenantIdFor)(opts.cfg.app.id, opts.env);
+  const tenantId = (0, import_apps11.tenantIdFor)(opts.cfg.app.id, opts.env);
   const prior = opts.credentials?.envs[opts.env];
   let credentials = opts.credentials;
   let dbKey = opts.cfg.services.includes("db") && !opts.rotateDb ? prior?.dbKey : void 0;
@@ -9884,7 +10519,7 @@ async function provision(options) {
   }
   const doFetch = options.fetch ?? fetch;
   const token = await getDeveloperToken(cfg, options, doFetch, out);
-  const apps = (0, import_apps10.createAppsClient)({ endpoint: cfg.platformUrl, token, fetcher: { fetch: doFetch } });
+  const apps = (0, import_apps12.createAppsClient)({ endpoint: cfg.platformUrl, token, fetcher: { fetch: doFetch } });
   const existing = await apps.resolveApp(cfg.app.id);
   if (existing) {
     out.log(`app: ${cfg.app.id} already exists`);
@@ -9895,7 +10530,7 @@ async function provision(options) {
   for (const env of cfg.envs) {
     await assertTenantAdminAccess(doFetch, cfg, env, token);
   }
-  const serviceOrder = (0, import_apps10.orderAppServices)(cfg.services);
+  const serviceOrder = (0, import_apps12.orderAppServices)(cfg.services);
   for (const env of cfg.envs) {
     for (const service of serviceOrder) {
       if (service === "ai") {
@@ -9928,7 +10563,7 @@ async function provision(options) {
     }
   }
   for (const env of cfg.envs) {
-    const tenantId = (0, import_apps10.tenantIdFor)(cfg.app.id, env);
+    const tenantId = (0, import_apps12.tenantIdFor)(cfg.app.id, env);
     credentials = await provisionEnvCredentials({
       cfg,
       env,
@@ -9972,7 +10607,7 @@ ${env}: credentials are already saved; retry "odla-ai secrets push --env ${env}$
       await provisionIntegrationSeeds(doFetch, cfg.dbEndpoint, tenantId, dbKey, database.integrations, env, out);
     }
     if (cfg.services.includes("ai") && cfg.ai?.provider && cfg.ai.keyEnv) {
-      const key = import_node_process10.default.env[cfg.ai.keyEnv];
+      const key = import_node_process11.default.env[cfg.ai.keyEnv];
       if (key) {
         const secretName = cfg.ai.secretName ?? defaultSecretName(cfg.ai.provider);
         await (0, import_ai3.putSecret)({ endpoint: cfg.dbEndpoint, token, fetch: doFetch }, tenantId, secretName, key);
@@ -10013,8 +10648,8 @@ ${env}: credentials are already saved; retry "odla-ai secrets push --env ${env}$
 }
 
 // src/record.ts
-var import_node_fs15 = require("fs");
-var import_node_process11 = __toESM(require("process"), 1);
+var import_node_fs16 = require("fs");
+var import_node_process12 = __toESM(require("process"), 1);
 
 // src/surface.ts
 var PM_ACTIONS = {
@@ -10062,7 +10697,7 @@ var COMMAND_SURFACE = {
   calendar: { status: {}, calendars: {}, connect: {}, disconnect: {} },
   capabilities: {},
   code: { connect: {} },
-  config: { diff: {}, plan: {} },
+  config: { diff: {}, plan: {}, apply: {} },
   context: { show: {}, list: {}, save: {}, remove: {} },
   // `watch`, `read`, `reply`, and `resolve` take a topic id from there on.
   discuss: {
@@ -10080,7 +10715,11 @@ var COMMAND_SURFACE = {
   help: {},
   init: {},
   o11y: { status: {} },
-  platform: { status: {} },
+  operations: { get: {}, wait: {} },
+  platform: {
+    status: {},
+    "chat-credentials": { rotate: {} }
+  },
   pm: {
     ...PM_ENTITIES,
     handoff: {}
@@ -10159,7 +10798,7 @@ function invocationPath(words2) {
 
 // src/record.ts
 function recordInvocation(parsed) {
-  const file = import_node_process11.default.env.ODLA_CLI_RECORD;
+  const file = import_node_process12.default.env.ODLA_CLI_RECORD;
   if (!file) return;
   try {
     const entry = {
@@ -10167,14 +10806,14 @@ function recordInvocation(parsed) {
       options: Object.entries(parsed.options).map(([name, value2]) => value2 === false ? `no-${name}` : name).sort()
     };
     if (!entry.path.length) return;
-    (0, import_node_fs15.appendFileSync)(file, `${JSON.stringify(entry)}
+    (0, import_node_fs16.appendFileSync)(file, `${JSON.stringify(entry)}
 `);
   } catch {
   }
 }
 
 // src/runbook-actions.ts
-var import_node_fs16 = require("fs");
+var import_node_fs17 = require("fs");
 
 // src/runbook-requires.ts
 var SPEC = /^(@?[\w./-]+?)@(\d+\.\d+\.\d+(?:[\w.-]*)?)$/;
@@ -10259,7 +10898,7 @@ async function bySlug(ctx, slug) {
 function readBody(file, inline) {
   if (inline !== void 0) return inline;
   if (file === void 0) throw new Error("supply the new text with --file <path>, --file - (stdin), or --body");
-  return (0, import_node_fs16.readFileSync)(file === "-" ? 0 : file, "utf8");
+  return (0, import_node_fs17.readFileSync)(file === "-" ? 0 : file, "utf8");
 }
 var stamp = (ms) => ms ? new Date(ms).toISOString().slice(0, 16).replace("T", " ") : "";
 async function runbookList(ctx, all, query) {
@@ -10289,12 +10928,17 @@ async function runbookNew(ctx, slug, title, body, summary, requires) {
   });
   ctx.out.log(ctx.json ? JSON.stringify(created, null, 2) : `created ${slug} (${created.id})`);
 }
-async function runbookEdit(ctx, slug, body, note, requires) {
+async function runbookEdit(ctx, slug, body, note, requires, expectedVersion) {
   const runbook = await bySlug(ctx, slug);
   const result = await call(ctx, "PATCH", `/runbook/${encodeURIComponent(runbook.id)}`, {
     // An empty --requires clears the declaration; omitting the flag leaves
     // whatever is there, so an ordinary body edit never drops it.
-    patch: { body, ...note ? { note } : {}, ...requires === void 0 ? {} : { requires: requires || null } }
+    patch: {
+      body,
+      expectedVersion: expectedVersion ?? runbook.version,
+      ...note ? { note } : {},
+      ...requires === void 0 ? {} : { requires: requires || null }
+    }
   });
   if (ctx.json) return ctx.out.log(JSON.stringify(result, null, 2));
   ctx.out.log(`${slug} \u2192 v${result.record?.version ?? runbook.version + 1}`);
@@ -10346,14 +10990,14 @@ async function runbookRemove(ctx, slug) {
 }
 
 // src/runbook-import.ts
-var import_node_fs17 = require("fs");
-var import_node_path14 = require("path");
-function parseRunbook(text, slug) {
-  let rest = text;
+var import_node_fs18 = require("fs");
+var import_node_path15 = require("path");
+function parseRunbook(text2, slug) {
+  let rest = text2;
   const meta = {};
-  const fm = /^---\r?\n([\s\S]*?)\r?\n---\r?\n?/.exec(text);
+  const fm = /^---\r?\n([\s\S]*?)\r?\n---\r?\n?/.exec(text2);
   if (fm) {
-    rest = text.slice(fm[0].length);
+    rest = text2.slice(fm[0].length);
     for (const line of fm[1].split(/\r?\n/)) {
       const pair = /^(\w+)\s*:\s*(.+)$/.exec(line.trim());
       if (!pair) continue;
@@ -10372,12 +11016,12 @@ function parseRunbook(text, slug) {
   };
 }
 function readRunbookDir(dir) {
-  if (!(0, import_node_fs17.statSync)(dir, { throwIfNoEntry: false })?.isDirectory()) throw new Error(`not a directory: ${dir}`);
-  const files = (0, import_node_fs17.readdirSync)(dir).filter((f) => f.endsWith(".md")).sort();
+  if (!(0, import_node_fs18.statSync)(dir, { throwIfNoEntry: false })?.isDirectory()) throw new Error(`not a directory: ${dir}`);
+  const files = (0, import_node_fs18.readdirSync)(dir).filter((f) => f.endsWith(".md")).sort();
   if (!files.length) throw new Error(`no .md files in ${dir}`);
   return files.map((file) => {
-    const slug = (0, import_node_path14.basename)(file, ".md");
-    const parsed = parseRunbook((0, import_node_fs17.readFileSync)((0, import_node_path14.join)(dir, file), "utf8"), slug);
+    const slug = (0, import_node_path15.basename)(file, ".md");
+    const parsed = parseRunbook((0, import_node_fs18.readFileSync)((0, import_node_path15.join)(dir, file), "utf8"), slug);
     return { file, slug, ...parsed, words: parsed.body.split(/\s+/).filter(Boolean).length };
   });
 }
@@ -10434,6 +11078,7 @@ async function upsert(ctx, r, visibility) {
       patch: {
         title: r.title,
         body: r.body,
+        expectedVersion: found.version,
         ...r.summary ? { summary: r.summary } : {},
         ...r.tags ? { tags: r.tags } : {},
         note: `imported from ${r.file}`
@@ -10449,8 +11094,8 @@ async function upsert(ctx, r, visibility) {
 
 // src/runbook-impact.ts
 var import_node_child_process7 = require("child_process");
-var import_node_fs18 = require("fs");
-var import_node_path15 = require("path");
+var import_node_fs19 = require("fs");
+var import_node_path16 = require("path");
 
 // src/runbook-impact-scan.ts
 var DECL = /^[+-]\s*export\s+(?:declare\s+)?(?:default\s+)?(?:abstract\s+)?(?:async\s+)?(?:const|let|var|function|class|interface|type|enum)\s+([A-Za-z_$][\w$]*)/;
@@ -10619,10 +11264,10 @@ ${body.split("\n").map((line) => `+${line}`).join("\n")}
 }
 function manifestLabeller(root) {
   return (workspace) => {
-    const manifest = (0, import_node_path15.join)(root, workspace, "package.json");
-    if (!(0, import_node_fs18.existsSync)(manifest)) return void 0;
+    const manifest = (0, import_node_path16.join)(root, workspace, "package.json");
+    if (!(0, import_node_fs19.existsSync)(manifest)) return void 0;
     try {
-      const name = JSON.parse((0, import_node_fs18.readFileSync)(manifest, "utf8")).name;
+      const name = JSON.parse((0, import_node_fs19.readFileSync)(manifest, "utf8")).name;
       return typeof name === "string" ? name : void 0;
     } catch {
       return void 0;
@@ -10689,7 +11334,7 @@ function report3(ctx, impacts) {
 async function runbookImpact(ctx, options, deps = {}) {
   const cwd = deps.cwd ?? process.cwd();
   const runGit = deps.runGit ?? gitRunner(cwd);
-  const read3 = deps.readRepoFile ?? ((path) => (0, import_node_fs18.readFileSync)((0, import_node_path15.join)(cwd, path), "utf8"));
+  const read3 = deps.readRepoFile ?? ((path) => (0, import_node_fs19.readFileSync)((0, import_node_path16.join)(cwd, path), "utf8"));
   const surfaces = changedSurfaces(collectDiff(runGit, options.base, read3), manifestLabeller(cwd));
   if (!surfaces.length) {
     return ctx.out.log(
@@ -10822,12 +11467,12 @@ async function runbookComment(ctx, slug, body) {
 
 // src/runbook-editor.ts
 var import_node_child_process8 = require("child_process");
-var import_node_fs19 = require("fs");
+var import_node_fs20 = require("fs");
 var import_node_os5 = require("os");
-var import_node_path16 = require("path");
-var import_node_process12 = __toESM(require("process"), 1);
+var import_node_path17 = require("path");
+var import_node_process13 = __toESM(require("process"), 1);
 var EDITOR_ENV = ["ODLA_EDITOR", "VISUAL", "EDITOR"];
-function resolveEditor(env = import_node_process12.default.env) {
+function resolveEditor(env = import_node_process13.default.env) {
   for (const name of EDITOR_ENV) {
     const value2 = env[name];
     if (value2 && value2.trim()) return value2.trim();
@@ -10841,8 +11486,8 @@ function defaultRun(command, path) {
   return result.status ?? 0;
 }
 function editText(initial, slug, deps = {}) {
-  const env = deps.env ?? import_node_process12.default.env;
-  const interactive = deps.interactive ?? (() => Boolean(import_node_process12.default.stdin.isTTY));
+  const env = deps.env ?? import_node_process13.default.env;
+  const interactive = deps.interactive ?? (() => Boolean(import_node_process13.default.stdin.isTTY));
   const editor = resolveEditor(env);
   if (!editor)
     throw new Error(
@@ -10850,16 +11495,16 @@ function editText(initial, slug, deps = {}) {
     );
   if (!interactive())
     throw new Error(`cannot open an editor without a terminal \u2014 pass --file <path> or --body "\u2026" instead`);
-  const dir = (0, import_node_fs19.mkdtempSync)((0, import_node_path16.join)((0, import_node_os5.tmpdir)(), "odla-runbook-"));
-  const file = (0, import_node_path16.join)(dir, `${slug}.md`);
+  const dir = (0, import_node_fs20.mkdtempSync)((0, import_node_path17.join)((0, import_node_os5.tmpdir)(), "odla-runbook-"));
+  const file = (0, import_node_path17.join)(dir, `${slug}.md`);
   try {
-    (0, import_node_fs19.writeFileSync)(file, initial, { mode: 384 });
+    (0, import_node_fs20.writeFileSync)(file, initial, { mode: 384 });
     const code = defaultRunOrInjected(deps)(editor, file);
     if (code !== 0) throw new Error(`editor "${editor}" exited with ${code}; nothing was written`);
-    const edited = (0, import_node_fs19.readFileSync)(file, "utf8");
+    const edited = (0, import_node_fs20.readFileSync)(file, "utf8");
     return edited === initial ? null : edited;
   } finally {
-    (0, import_node_fs19.rmSync)(dir, { recursive: true, force: true });
+    (0, import_node_fs20.rmSync)(dir, { recursive: true, force: true });
   }
 }
 var defaultRunOrInjected = (deps) => deps.run ?? defaultRun;
@@ -10874,27 +11519,90 @@ async function editRunbook(ctx, slug, deps = {}) {
   const found = page.records[0];
   if (!found) throw new Error(`no runbook "${slug}" in ${ctx.appId}`);
   ctx.out.log(`opening ${slug} v${found.version} in your editor\u2026`);
-  return editText(found.body, slug, deps);
+  const body = await editText(found.body, slug, deps);
+  return body === null ? null : { body, expectedVersion: found.version };
 }
 
 // src/whoami-command.ts
+var text = (value2) => typeof value2 === "string" && value2.trim() ? value2.trim() : null;
+function principalKind(value2, machine) {
+  return value2 === "human" || value2 === "agent" || value2 === "service" ? value2 : machine ? "service" : "human";
+}
+function credentialKind(value2, machine, scopes) {
+  if (value2 === "machine" || value2 === "device" || value2 === "clerk") return value2;
+  if (machine) return "machine";
+  if (scopes.length) return "device";
+  return "unknown";
+}
+function managerOf(value2) {
+  if (!value2 || typeof value2 !== "object") return null;
+  const row = value2;
+  const principalId = text(row.principalId);
+  if (!principalId) return null;
+  return {
+    principalId,
+    displayName: text(row.displayName) ?? "Unnamed member",
+    handle: text(row.handle) ?? ""
+  };
+}
+function unnamedPrincipal(kind) {
+  if (kind === "agent") return "Unnamed agent";
+  if (kind === "service") return "Unnamed service";
+  return "Unnamed member";
+}
 async function fetchIdentity(platformUrl, token, doFetch) {
   const res = await doFetch(`${platformUrl.replace(/\/$/, "")}/registry/me`, {
     headers: { authorization: `Bearer ${token}` }
   });
   if (!res.ok) throw new Error(`could not resolve identity (HTTP ${res.status})`);
   const body = await res.json();
+  const developerId = text(body.developerId) ?? "";
+  const machine = body.machine === true;
+  const scopes = Array.isArray(body.scopes) ? body.scopes.map(String) : [];
+  const principalId = text(body.principalId) ?? developerId;
+  const email = text(body.email);
+  const kind = principalKind(body.principalKind, machine);
+  const displayName = text(body.displayName) ?? email ?? unnamedPrincipal(kind);
+  const handle = text(body.handle) ?? "";
+  const credential2 = body.credential && typeof body.credential === "object" ? body.credential : {};
   return {
-    developerId: String(body.developerId ?? ""),
-    email: body.email ?? null,
+    developerId,
+    principalId,
+    principalKind: kind,
+    displayName,
+    handle,
+    manager: managerOf(body.manager),
+    credential: {
+      id: text(credential2.id),
+      kind: credentialKind(credential2.kind, machine, scopes)
+    },
+    email,
     admin: body.admin === true,
-    machine: body.machine === true,
-    scopes: Array.isArray(body.scopes) ? body.scopes.map(String) : []
+    machine,
+    scopes
   };
 }
-function credentialKind(identity) {
-  if (identity.machine) return "machine (platform admin secret)";
-  return identity.scopes.length ? "device token (scoped)" : "device token or session";
+function credentialLabel(identity) {
+  if (identity.credential.kind === "machine") return "machine (platform admin secret)";
+  if (identity.credential.kind === "device")
+    return identity.scopes.length ? "device (scoped)" : "device";
+  if (identity.credential.kind === "clerk") return "clerk";
+  return "unknown (legacy server)";
+}
+function namedPrincipal(identity) {
+  return identity.handle && identity.handle !== identity.displayName ? `${identity.displayName} (@${identity.handle})` : identity.displayName;
+}
+function namedManager(manager) {
+  return manager.handle && manager.handle !== manager.displayName ? `${manager.displayName} (@${manager.handle})` : manager.displayName;
+}
+function accountableOwner(identity) {
+  if (identity.principalKind === "agent" && identity.manager) {
+    return namedManager(identity.manager);
+  }
+  if (identity.principalKind === "human" && identity.principalId === identity.developerId) {
+    return namedPrincipal(identity);
+  }
+  return identity.email ?? "Unnamed member";
 }
 async function whoamiCommand(parsed, deps = {}) {
   assertArgs(
@@ -10925,9 +11633,19 @@ async function whoamiCommand(parsed, deps = {}) {
     return;
   }
   out.log(`platform:   ${cfg.platformUrl}`);
-  out.log(`developer:  ${identity.developerId}`);
+  out.log(`principal:  ${namedPrincipal(identity)}`);
+  out.log(`principal id: ${identity.principalId}`);
+  out.log(`kind:       ${identity.principalKind}`);
+  if (identity.principalKind === "agent")
+    out.log(
+      `manager:    ${identity.manager ? namedManager(identity.manager) : "(unknown)"}`
+    );
+  out.log(`owner:      ${accountableOwner(identity)}`);
+  out.log(`owner id:   ${identity.developerId}`);
   out.log(`email:      ${identity.email ?? "(none)"}`);
-  out.log(`credential: ${credentialKind(identity)}`);
+  out.log(`credential: ${credentialLabel(identity)}`);
+  if (identity.credential.id)
+    out.log(`credential id: ${identity.credential.id}`);
   out.log(`admin:      ${identity.admin ? "yes" : "no"}`);
   if (identity.scopes.length) out.log(`scopes:     ${identity.scopes.join(", ")}`);
   if (!identity.admin) {
@@ -11076,14 +11794,16 @@ async function runbookCommand(parsed, deps = {}) {
       const name = requireSlug(slug, "edit");
       const file = stringOpt(parsed.options.file);
       const inline = stringOpt(parsed.options.body);
-      const body = file === void 0 && inline === void 0 ? await editRunbook(ctx, name) : readBody(file, inline);
-      if (body === null) return ctx.out.log(`${name} unchanged; nothing written`);
+      const edited = file === void 0 && inline === void 0 ? await editRunbook(ctx, name) : readBody(file, inline);
+      if (edited === null) return ctx.out.log(`${name} unchanged; nothing written`);
+      const body = typeof edited === "string" ? edited : edited.body;
       return runbookEdit(
         ctx,
         name,
         body,
         stringOpt(parsed.options.note),
-        parsed.options.requires === void 0 ? void 0 : stringOpt(parsed.options.requires) ?? ""
+        parsed.options.requires === void 0 ? void 0 : stringOpt(parsed.options.requires) ?? "",
+        typeof edited === "string" ? void 0 : edited.expectedVersion
       );
     }
     case "import": {
@@ -11271,7 +11991,7 @@ function hostedSeverity(value2, flag) {
 var import_security2 = require("@odla-ai/security");
 
 // src/security.ts
-var import_node_path17 = require("path");
+var import_node_path18 = require("path");
 var import_security = require("@odla-ai/security");
 var import_node3 = require("@odla-ai/security/node");
 async function runHostedSecurity(options) {
@@ -11283,9 +12003,9 @@ async function runHostedSecurity(options) {
   const appId = selfAudit ? "odla-ai" : cfg.app.id;
   const env = selfAudit ? "prod" : selectEnv(options.env, cfg.envs, cfg.configPath, cfg.rootDir);
   const platform = options.platform ?? cfg?.platformUrl ?? "https://odla.ai";
-  const target = (0, import_node_path17.resolve)(options.target ?? cfg?.rootDir ?? ".");
-  const output = (0, import_node_path17.resolve)(options.out ?? (0, import_node_path17.resolve)(target, ".odla/security/hosted"));
-  const outputRelative = (0, import_node_path17.relative)(target, output).split(import_node_path17.sep).join("/");
+  const target = (0, import_node_path18.resolve)(options.target ?? cfg?.rootDir ?? ".");
+  const output = (0, import_node_path18.resolve)(options.out ?? (0, import_node_path18.resolve)(target, ".odla/security/hosted"));
+  const outputRelative = (0, import_node_path18.relative)(target, output).split(import_node_path18.sep).join("/");
   if (!outputRelative) throw new Error("Hosted security output cannot be the repository root");
   const profile = profileFor(options.profile ?? "odla", options.maxHuntTasks ?? 12);
   const tokenRequest = {
@@ -11297,7 +12017,7 @@ async function runHostedSecurity(options) {
   };
   const token = await injectedToken(options, tokenRequest);
   const snapshot = await (0, import_node3.snapshotDirectory)(target, {
-    exclude: !outputRelative.startsWith("../") && !(0, import_node_path17.isAbsolute)(outputRelative) ? [outputRelative] : []
+    exclude: !outputRelative.startsWith("../") && !(0, import_node_path18.isAbsolute)(outputRelative) ? [outputRelative] : []
   });
   const hosted = await (0, import_security.createPlatformSecurityReasoners)({
     platform,
@@ -11315,7 +12035,7 @@ async function runHostedSecurity(options) {
   });
   const harness = (0, import_security.createSecurityHarness)({
     profile,
-    store: new import_node3.FileRunStore((0, import_node_path17.resolve)(output, "state")),
+    store: new import_node3.FileRunStore((0, import_node_path18.resolve)(output, "state")),
     discoveryReasoner: hosted.discoveryReasoner,
     validationReasoner: hosted.validationReasoner,
     policy: {
@@ -11339,7 +12059,7 @@ async function runHostedSecurity(options) {
 function selectEnv(requested, declared, configPath, rootDir) {
   const env = requested ?? (declared.includes("dev") ? "dev" : declared[0]);
   if (!env || !declared.includes(env)) {
-    const shown = (0, import_node_path17.relative)(rootDir, configPath) || configPath;
+    const shown = (0, import_node_path18.relative)(rootDir, configPath) || configPath;
     throw new Error(`env "${env ?? ""}" is not declared in ${shown}`);
   }
   return env;
@@ -11368,7 +12088,7 @@ function printSummary(out, appId, env, run, report4, output) {
   out.log(`  coverage: ${report4.coverageStatus} ${complete}/${report4.coverage.length} blocked=${report4.metrics.blockedCells} shallow=${report4.metrics.shallowCells} unscheduled=${report4.metrics.unscheduledCells} budget_exhausted=${report4.metrics.budgetExhaustedCells}`);
   if (report4.callBudget) out.log(`  calls: discovery=${formatBudget(report4.callBudget.discovery)} validation=${formatBudget(report4.callBudget.validation)}`);
   out.log(`  findings: confirmed=${report4.metrics.confirmed} needs_reproduction=${report4.metrics.needsReproduction} candidates=${report4.metrics.candidates}`);
-  out.log(`  report: ${(0, import_node_path17.resolve)(output, "REPORT.md")}`);
+  out.log(`  report: ${(0, import_node_path18.resolve)(output, "REPORT.md")}`);
 }
 function formatBudget(usage) {
   return usage ? `${usage.usedCalls}/${usage.maxCalls} skipped=${usage.skippedCalls}` : "caller-managed";
@@ -11808,11 +12528,11 @@ async function securityStatus(parsed, dependencies) {
 // src/cli.ts
 function exitCodeFor(err) {
   const code = err?.code;
-  if (code === "handshake_pending" || code === "watch_timeout") return 75;
+  if (code === "handshake_pending" || code === "watch_timeout" || code === "operation_pending") return 75;
   if (code === "checkpoint_required") return 3;
   if (code === "remote_unavailable") return 6;
   if (code === "auth_failed") return 5;
-  if (code === "invalid_cursor") return 2;
+  if (code === "invalid_cursor" || code === "invalid_plan" || code === "invalid_operation_id") return 2;
   return 1;
 }
 async function runCli(argv = process.argv.slice(2), dependencies = {}) {