@odla-ai/cli 0.25.22 → 0.26.1

package/dist/index.d.cts

@@ -1,10 +1,10 @@
-import { App } from '@odla-ai/apps';
+import { RegistryConfigRevision, ConfigOperationReceipt, App } from '@odla-ai/apps';
 import { SecurityReport, PlatformSecurityRun } from '@odla-ai/security';
 import { HostedSecurityJob, GitHubConnectionStatus, GitHubSecuritySource, HostedSecurityIntentResponse, HostedSecurityPlan, HostedSecurityReport, HostedSecurityJobStatus } from '@odla-ai/security/hosted';
 export { GitHubConnectionAttempt, GitHubConnectionStatus, GitHubSecuritySource, HostedSecurityCounts, HostedSecurityCoverage, HostedSecurityIntent, HostedSecurityIntentResponse, HostedSecurityJob, HostedSecurityJobStatus, HostedSecurityPlan, HostedSecurityPlanRoute, HostedSecurityReport, HostedSecurityReportFinding, HostedSecurityRoute } from '@odla-ai/security/hosted';
 
 /** One exact device-grant scope obtainable through the approval flow. */
-type ScopedPlatformScope = "platform:ai:policy:read" | "platform:ai:policy:write" | "platform:ai:credential:read" | "platform:ai:credential:write" | "platform:ai:usage:read" | "platform:ai:audit:read" | "platform:status:read" | "app:config:read" | "app:code:host:connect" | "platform:code:host:connect" | "platform:security:self" | "platform:runbook:write";
+type ScopedPlatformScope = "platform:ai:policy:read" | "platform:ai:policy:write" | "platform:ai:credential:read" | "platform:ai:credential:write" | "platform:ai:usage:read" | "platform:ai:audit:read" | "platform:status:read" | "platform:chat:credential:write" | "app:config:read" | "app:config:write" | "app:code:host:connect" | "platform:code:host:connect" | "platform:security:self" | "platform:runbook:write";
 /** Inputs for obtaining one short-lived, exact-scope device grant. */
 interface ScopedPlatformTokenOptions {
     platform: string;
@@ -162,6 +162,17 @@ declare function codeConnect(options: CodeConnectOptions): Promise<void>;
 /** Run outbound presence and fenced Pi commands without opening a listener. */
 declare function runCodeRuntime(input: CodeRuntimeInput): Promise<void>;
 
+interface RunResult {
+    code: number;
+    stdout: string;
+    stderr: string;
+}
+/** Subprocess seam: injectable in tests, `defaultRunner` in production. */
+type CommandRunner = (cmd: string, args: string[], opts?: {
+    input?: string;
+    cwd?: string;
+}) => Promise<RunResult>;
+
 /** Map a CLI failure to its process exit code: 75 (EX_TEMPFAIL) marks work that
  * has not failed but has not finished — a handshake still awaiting human
  * approval (the pending state is persisted, so rerunning resumes it), or a
@@ -186,6 +197,8 @@ interface CliDependencies {
     /** Runs git in the working directory; injected so `runbook impact` can be
      * driven over a fixed diff instead of whatever the checkout happens to be. */
     runGit?: (args: string[]) => string;
+    /** Runs Wrangler for one-purpose platform secret rotations. */
+    runner?: CommandRunner;
 }
 /**
  * Parse CLI arguments and dispatch the matching odla command.
@@ -254,7 +267,7 @@ declare function adminAi(options: AdminAiOptions): Promise<void>;
 /** Stable, machine-readable division of work between the CLI, coding agent,
  * human operator, and Studio. Printed by `odla-ai capabilities --json`. */
 declare const CAPABILITIES: {
-    readonly cli: readonly ["start an email-bound device request without accepting a password or user session token", "register the app and enable configured services per environment", "issue, persist, and explicitly rotate configured service credentials", "add or remove app co-owners, each of whom self-provisions their own credentials for the shared db without any secret handoff", "write local Worker values and push deployed Worker secrets through Wrangler stdin", "store tenant-vault secrets (including the Clerk webhook secret and reserved Clerk secret key) write-only from stdin or an env var", "compose declared app-capability schema/rules, create guarded seeds when absent, and configure platform AI, auth, and deployment links", "apply Google Calendar booking config, then drive state-bound consent, status, discovery, and disconnect flows (bookings run live through the platform proxy)", "validate integration contracts offline and smoke-test a provisioned db environment plus anonymous capability routes", "save and explicitly select non-secret named operator contexts with isolated credential caches; resolve and explain platform, app, environment, and credential provenance without authenticating; then run PM, Discussions, o11y, runbook, and identity operations outside a project checkout", "read one versioned o11y status envelope spanning application RED, exact Worker versions and Cloudflare colos observed in traffic, current live-sync freshness/load, the protected commit-to-visible canary, collector ingest/scheduler trust, provider-owned runtime metrics, account-scoped Durable Object, D1, and R2 evidence under odla-db, and a bounded machine verdict", "read one canonical platform fleet snapshot over private service bindings, including release identities, probe latency, Cloudflare load/runtime freshness, explicit unknowns, and stable next actions through a read-only capability", "compare one project's checked-in Registry intent with live owner-visible state and freeze a secret-free plan digest through an exact app:config:read capability", "inspect durable agent wakeups as a versioned JSON envelope and explicitly requeue one dead-lettered job with a scoped environment credential", "run app-attributed hosted security discovery and independent validation without provider keys", "connect/revoke source-read-only GitHub sources and drive commit-pinned hosted security jobs without PATs or provider keys", "let admins manage system AI policy and credentials, inspect attributed usage, and read immutable admin changes through separate short-lived capability-only approvals"];
+    readonly cli: readonly ["start an email-bound device request without accepting a password or user session token", "register the app and enable configured services per environment", "issue, persist, and explicitly rotate configured service credentials", "add or remove app co-owners, each of whom self-provisions their own credentials for the shared db without any secret handoff", "write local Worker values and push deployed Worker secrets through Wrangler stdin", "store tenant-vault secrets (including the Clerk webhook secret and reserved Clerk secret key) write-only from stdin or an env var", "compose declared app-capability schema/rules, create guarded seeds when absent, and configure platform AI, auth, and deployment links", "apply Google Calendar booking config, then drive state-bound consent, status, discovery, and disconnect flows (bookings run live through the platform proxy)", "validate integration contracts offline and smoke-test a provisioned db environment plus anonymous capability routes", "save and explicitly select non-secret named operator contexts with isolated credential caches; resolve and explain platform, app, environment, and credential provenance without authenticating; then run PM, Discussions, o11y, runbook, and identity operations outside a project checkout", "read one versioned o11y status envelope spanning application RED, exact Worker versions and Cloudflare colos observed in traffic, current live-sync freshness/load, the protected commit-to-visible canary, collector ingest/scheduler trust, provider-owned runtime metrics, account-scoped Durable Object, D1, and R2 evidence under odla-db, and a bounded machine verdict", "read one canonical platform fleet snapshot over private service bindings, including release identities, probe latency, Cloudflare load/runtime freshness, explicit unknowns, and stable next actions through a read-only capability", "compare one project's checked-in Registry intent with live owner-visible state, freeze a secret-free Registry-revision-bound plan through app:config:read, and conditionally apply checkpoint-free actions through exact app:config:write operation routes", "inspect or bounded-wait one exact durable config-operation journal entry and verify every terminal receipt digest before returning it to remote automation", "inspect durable agent wakeups as a versioned JSON envelope and explicitly requeue one dead-lettered job with a scoped environment credential", "run app-attributed hosted security discovery and independent validation without provider keys", "connect/revoke source-read-only GitHub sources and drive commit-pinned hosted security jobs without PATs or provider keys", "let admins manage system AI policy and credentials, inspect attributed usage, and read immutable admin changes through separate short-lived capability-only approvals"];
     readonly agent: readonly ["install and import the selected odla SDKs", "wrap the Worker with withObservability and choose useful telemetry", "install capability packages, mount their runtime routes, and make application-specific schema, rules, auth, UI, and migration decisions", "wire @odla-ai/calendar into trusted Worker code and keep the app admin key out of browsers"];
     readonly human: readonly ["provide the existing odla account email, then sign in and explicitly review/approve the exact device code", "review mirrored calendar/attendee disclosure and complete the server-issued Google consent flow", "consent to changes against an app's live database with --yes", "request destructive credential rotation explicitly", "review application semantics, security findings, releases, and merges", "approve redacted-source disclosure before hosted security reasoning", "approve GitHub App repository access separately from redacted-snippet disclosure"];
     readonly studio: readonly ["view application telemetry grouped by exact Worker version, reconciled live-sync load/freshness, commit-to-visible canary health, provider-owned Worker runtime metrics, and environment state", "let signed-in users inventory/revoke their own agent grants and admins audit/global-revoke them", "review calendar connection, granted read scope, selected calendars, and sync health without exposing provider tokens", "perform manual credential recovery — for the primary owner or any co-owner — when the CLI's local shown-once copy is unavailable", "configure system AI purposes and view app/environment/run-attributed usage", "connect/revoke GitHub security sources and inspect ref-to-SHA jobs, routes, retention, coverage, and normalized reports"];
@@ -380,17 +393,6 @@ declare function calendarConnect(options: CalendarLifecycleOptions): Promise<Cal
  * project grant is not revoked. */
 declare function calendarDisconnect(options: CalendarLifecycleOptions): Promise<CalendarStatus>;
 
-interface RunResult {
-    code: number;
-    stdout: string;
-    stderr: string;
-}
-/** Subprocess seam: injectable in tests, `defaultRunner` in production. */
-type CommandRunner = (cmd: string, args: string[], opts?: {
-    input?: string;
-    cwd?: string;
-}) => Promise<RunResult>;
-
 type OdlaEnvName = string;
 type AppRules = Record<string, {
     view?: string;
@@ -683,6 +685,8 @@ interface ConfigReconciliation {
     };
     desiredRevision: ConfigDigest;
     observedRevision: ConfigDigest | null;
+    /** Monotonic Registry compare-and-set revision, separate from content hashes. */
+    registryRevision: RegistryConfigRevision | null;
     status: ConfigDrift;
     summary: {
         differences: number;
@@ -704,12 +708,13 @@ interface ConfigDiffDocument extends Omit<ConfigReconciliation, "actions"> {
         description: string;
     }>;
 }
-/** Revision-bound `odla.config-plan/v1` document returned by `configPlan`. */
+/** Revision-bound `odla.config-plan/v2` document returned by `configPlan`. */
 interface ConfigPlanDocument extends ConfigReconciliation {
-    schemaVersion: "odla.config-plan/v1";
+    schemaVersion: "odla.config-plan/v2";
     planDigest: ConfigDigest;
     apply: {
-        supported: false;
+        supported: boolean;
+        checkpointRequired: boolean;
         reason: string;
     };
     nextActions: Array<{
@@ -730,6 +735,21 @@ interface ConfigInspectOptions {
     stdout?: Pick<typeof console, "log" | "error">;
     now?: () => Date;
 }
+/** Inputs for applying one reviewed, frozen config plan from disk. */
+interface ConfigApplyOptions extends ConfigInspectOptions {
+    planPath: string;
+    idempotencyKey?: string;
+}
+/** Inputs for exact-id config operation reads and bounded waits. */
+interface ConfigOperationInspectOptions extends ConfigInspectOptions {
+    operationId: string;
+    intervalSeconds?: number;
+    timeoutSeconds?: number;
+    pollWait?: (milliseconds: number) => Promise<void>;
+    now?: () => Date;
+}
+/** Result returned by config apply or an operation journal command. */
+type ConfigOperationResult = ConfigOperationReceipt;
 /** Secret-free Registry intent normalized from one loaded project configuration. */
 interface DesiredRegistryState {
     appId: string;
@@ -762,13 +782,22 @@ interface ReconciliationInput {
  * the caller explicitly supplies a token. This function performs no writes.
  */
 declare function configDiff(options: ConfigInspectOptions): Promise<ConfigDiffDocument>;
-/** Freeze desired/observed revisions and ordered actions into a reviewable plan.
- *
- * The returned plan intentionally has `apply.supported: false`; callers must
- * follow its explicit existing-command or Studio checkpoints separately.
- */
+/** Freeze content revisions, Registry CAS revision, and ordered actions. */
 declare function configPlan(options: ConfigInspectOptions): Promise<ConfigPlanDocument>;
 
+/** Apply one exact frozen plan through the Registry operation journal. */
+declare function configApply(options: ConfigApplyOptions): Promise<ConfigOperationReceipt>;
+/** Read one exact journal entry without replaying effects. */
+declare function configOperationGet(options: ConfigOperationInspectOptions): Promise<ConfigOperationReceipt>;
+/** Poll one exact journal entry until it closes or the bounded wait expires. */
+declare function configOperationWait(options: ConfigOperationInspectOptions): Promise<ConfigOperationReceipt>;
+
+/** Stable CLI failure code consumed by `exitCodeFor`. */
+declare class ConfigOperationCommandError extends Error {
+    readonly code: string;
+    constructor(message: string, code: string);
+}
+
 /** Project-config projection owned by Registry reconciliation.
  *
  * This deliberately excludes schema, rules, seeds, secrets, credentials, and
@@ -1222,4 +1251,4 @@ declare function installSkill(options?: SkillInstallOptions): SkillInstallResult
  */
 declare function smoke(options: SmokeOptions): Promise<void>;
 
-export { AGENT_HARNESSES, type AdminAiOptions, type AgentHarness, type AgentHarnessSelector, type AvailableGoogleCalendar, CAPABILITIES, CODE_BUILD_RECIPES, CODE_PI_IMAGE, COMMAND_SURFACE, type CalendarConfig, type CalendarConnectionState, type CalendarLifecycleOptions, type CalendarServiceConfig, type CalendarStatus, type CliDependencies, type CodeBuildRule, type CodeConnectOptions, type CodeContainerEngine, type CodeHostCapabilities, type CodeLocalSourceDescriptor, type CodeRuntimeInput, type ConfigCoverage, type ConfigDiffDocument, type ConfigDifference, type ConfigDigest, type ConfigDrift, type ConfigInspectOptions, type ConfigPlanAction, type ConfigPlanDocument, type ConfigReconciliation, type ConfigRisk, type ConfigSource, type ConnectGitHubSecuritySourceOptions, type DesiredRegistryState, type DisconnectGitHubSecuritySourceOptions, type FollowHostedSecurityJobOptions, GOOGLE_CALENDAR_EVENTS_SCOPE, type GetHostedSecurityIntentOptions, type GetHostedSecurityJobOptions, type GoogleCalendarConfig, type HarnessInstallResult, type HostedSecurityProfile, type HostedSecurityResult, type HostedSecurityTokenRequest, type IntegrationProbe, type IntegrationSeed, type InvocationProblem, type ListGitHubSecuritySourcesOptions, type ListHostedSecurityJobsOptions, type LoadedProjectConfig, type LocalCredentials, type OdlaIntegration, type OdlaProjectConfig, type ProvisionOptions, type ProvisionPlan, type ReconciliationInput, type RunHostedSecurityOptions, SYSTEM_AI_PURPOSES, type ScopedPlatformTokenOptions, type SecretsPushOptions, type SecretsSetOptions, type SkillInstallOptions, type SkillInstallResult, type SmokeOptions, type StartHostedSecurityJobOptions, type SurfaceNode, type SystemAiPurpose, acceptedAfter, adminAi, calendarBookingPageUrl, calendarCalendars, calendarConnect, calendarDisconnect, calendarServiceConfig, calendarStatus, codeConnect, configDiff, configPlan, connectGitHubSecuritySource, describeProblem, desiredRegistryState, disconnectGitHubSecuritySource, doctor, exitCodeFor, followHostedSecurityJob, getHostedSecurityIntent, getHostedSecurityJob, getHostedSecurityPlan, getHostedSecurityReport, getScopedPlatformToken, inferGitHubRepository, initProject, installSkill, invocationPath, isTerminalHostedSecurityStatus, listGitHubSecuritySources, listHostedSecurityJobs, prepareCodeImages, printCapabilities, provision, reconcileConfig, redactSecrets, repositoryFromGitRemote, runCli, runCodeRuntime, runHostedSecurity, secretsPush, secretsSet, secretsSetClerkKey, smoke, startHostedSecurityJob, surfacePaths, validateInvocation };
+export { AGENT_HARNESSES, type AdminAiOptions, type AgentHarness, type AgentHarnessSelector, type AvailableGoogleCalendar, CAPABILITIES, CODE_BUILD_RECIPES, CODE_PI_IMAGE, COMMAND_SURFACE, type CalendarConfig, type CalendarConnectionState, type CalendarLifecycleOptions, type CalendarServiceConfig, type CalendarStatus, type CliDependencies, type CodeBuildRule, type CodeConnectOptions, type CodeContainerEngine, type CodeHostCapabilities, type CodeLocalSourceDescriptor, type CodeRuntimeInput, type ConfigApplyOptions, type ConfigCoverage, type ConfigDiffDocument, type ConfigDifference, type ConfigDigest, type ConfigDrift, type ConfigInspectOptions, ConfigOperationCommandError, type ConfigOperationInspectOptions, type ConfigOperationResult, type ConfigPlanAction, type ConfigPlanDocument, type ConfigReconciliation, type ConfigRisk, type ConfigSource, type ConnectGitHubSecuritySourceOptions, type DesiredRegistryState, type DisconnectGitHubSecuritySourceOptions, type FollowHostedSecurityJobOptions, GOOGLE_CALENDAR_EVENTS_SCOPE, type GetHostedSecurityIntentOptions, type GetHostedSecurityJobOptions, type GoogleCalendarConfig, type HarnessInstallResult, type HostedSecurityProfile, type HostedSecurityResult, type HostedSecurityTokenRequest, type IntegrationProbe, type IntegrationSeed, type InvocationProblem, type ListGitHubSecuritySourcesOptions, type ListHostedSecurityJobsOptions, type LoadedProjectConfig, type LocalCredentials, type OdlaIntegration, type OdlaProjectConfig, type ProvisionOptions, type ProvisionPlan, type ReconciliationInput, type RunHostedSecurityOptions, SYSTEM_AI_PURPOSES, type ScopedPlatformTokenOptions, type SecretsPushOptions, type SecretsSetOptions, type SkillInstallOptions, type SkillInstallResult, type SmokeOptions, type StartHostedSecurityJobOptions, type SurfaceNode, type SystemAiPurpose, acceptedAfter, adminAi, calendarBookingPageUrl, calendarCalendars, calendarConnect, calendarDisconnect, calendarServiceConfig, calendarStatus, codeConnect, configApply, configDiff, configOperationGet, configOperationWait, configPlan, connectGitHubSecuritySource, describeProblem, desiredRegistryState, disconnectGitHubSecuritySource, doctor, exitCodeFor, followHostedSecurityJob, getHostedSecurityIntent, getHostedSecurityJob, getHostedSecurityPlan, getHostedSecurityReport, getScopedPlatformToken, inferGitHubRepository, initProject, installSkill, invocationPath, isTerminalHostedSecurityStatus, listGitHubSecuritySources, listHostedSecurityJobs, prepareCodeImages, printCapabilities, provision, reconcileConfig, redactSecrets, repositoryFromGitRemote, runCli, runCodeRuntime, runHostedSecurity, secretsPush, secretsSet, secretsSetClerkKey, smoke, startHostedSecurityJob, surfacePaths, validateInvocation };

package/dist/index.d.ts

@@ -1,10 +1,10 @@
-import { App } from '@odla-ai/apps';
+import { RegistryConfigRevision, ConfigOperationReceipt, App } from '@odla-ai/apps';
 import { SecurityReport, PlatformSecurityRun } from '@odla-ai/security';
 import { HostedSecurityJob, GitHubConnectionStatus, GitHubSecuritySource, HostedSecurityIntentResponse, HostedSecurityPlan, HostedSecurityReport, HostedSecurityJobStatus } from '@odla-ai/security/hosted';
 export { GitHubConnectionAttempt, GitHubConnectionStatus, GitHubSecuritySource, HostedSecurityCounts, HostedSecurityCoverage, HostedSecurityIntent, HostedSecurityIntentResponse, HostedSecurityJob, HostedSecurityJobStatus, HostedSecurityPlan, HostedSecurityPlanRoute, HostedSecurityReport, HostedSecurityReportFinding, HostedSecurityRoute } from '@odla-ai/security/hosted';
 
 /** One exact device-grant scope obtainable through the approval flow. */
-type ScopedPlatformScope = "platform:ai:policy:read" | "platform:ai:policy:write" | "platform:ai:credential:read" | "platform:ai:credential:write" | "platform:ai:usage:read" | "platform:ai:audit:read" | "platform:status:read" | "app:config:read" | "app:code:host:connect" | "platform:code:host:connect" | "platform:security:self" | "platform:runbook:write";
+type ScopedPlatformScope = "platform:ai:policy:read" | "platform:ai:policy:write" | "platform:ai:credential:read" | "platform:ai:credential:write" | "platform:ai:usage:read" | "platform:ai:audit:read" | "platform:status:read" | "platform:chat:credential:write" | "app:config:read" | "app:config:write" | "app:code:host:connect" | "platform:code:host:connect" | "platform:security:self" | "platform:runbook:write";
 /** Inputs for obtaining one short-lived, exact-scope device grant. */
 interface ScopedPlatformTokenOptions {
     platform: string;
@@ -162,6 +162,17 @@ declare function codeConnect(options: CodeConnectOptions): Promise<void>;
 /** Run outbound presence and fenced Pi commands without opening a listener. */
 declare function runCodeRuntime(input: CodeRuntimeInput): Promise<void>;
 
+interface RunResult {
+    code: number;
+    stdout: string;
+    stderr: string;
+}
+/** Subprocess seam: injectable in tests, `defaultRunner` in production. */
+type CommandRunner = (cmd: string, args: string[], opts?: {
+    input?: string;
+    cwd?: string;
+}) => Promise<RunResult>;
+
 /** Map a CLI failure to its process exit code: 75 (EX_TEMPFAIL) marks work that
  * has not failed but has not finished — a handshake still awaiting human
  * approval (the pending state is persisted, so rerunning resumes it), or a
@@ -186,6 +197,8 @@ interface CliDependencies {
     /** Runs git in the working directory; injected so `runbook impact` can be
      * driven over a fixed diff instead of whatever the checkout happens to be. */
     runGit?: (args: string[]) => string;
+    /** Runs Wrangler for one-purpose platform secret rotations. */
+    runner?: CommandRunner;
 }
 /**
  * Parse CLI arguments and dispatch the matching odla command.
@@ -254,7 +267,7 @@ declare function adminAi(options: AdminAiOptions): Promise<void>;
 /** Stable, machine-readable division of work between the CLI, coding agent,
  * human operator, and Studio. Printed by `odla-ai capabilities --json`. */
 declare const CAPABILITIES: {
-    readonly cli: readonly ["start an email-bound device request without accepting a password or user session token", "register the app and enable configured services per environment", "issue, persist, and explicitly rotate configured service credentials", "add or remove app co-owners, each of whom self-provisions their own credentials for the shared db without any secret handoff", "write local Worker values and push deployed Worker secrets through Wrangler stdin", "store tenant-vault secrets (including the Clerk webhook secret and reserved Clerk secret key) write-only from stdin or an env var", "compose declared app-capability schema/rules, create guarded seeds when absent, and configure platform AI, auth, and deployment links", "apply Google Calendar booking config, then drive state-bound consent, status, discovery, and disconnect flows (bookings run live through the platform proxy)", "validate integration contracts offline and smoke-test a provisioned db environment plus anonymous capability routes", "save and explicitly select non-secret named operator contexts with isolated credential caches; resolve and explain platform, app, environment, and credential provenance without authenticating; then run PM, Discussions, o11y, runbook, and identity operations outside a project checkout", "read one versioned o11y status envelope spanning application RED, exact Worker versions and Cloudflare colos observed in traffic, current live-sync freshness/load, the protected commit-to-visible canary, collector ingest/scheduler trust, provider-owned runtime metrics, account-scoped Durable Object, D1, and R2 evidence under odla-db, and a bounded machine verdict", "read one canonical platform fleet snapshot over private service bindings, including release identities, probe latency, Cloudflare load/runtime freshness, explicit unknowns, and stable next actions through a read-only capability", "compare one project's checked-in Registry intent with live owner-visible state and freeze a secret-free plan digest through an exact app:config:read capability", "inspect durable agent wakeups as a versioned JSON envelope and explicitly requeue one dead-lettered job with a scoped environment credential", "run app-attributed hosted security discovery and independent validation without provider keys", "connect/revoke source-read-only GitHub sources and drive commit-pinned hosted security jobs without PATs or provider keys", "let admins manage system AI policy and credentials, inspect attributed usage, and read immutable admin changes through separate short-lived capability-only approvals"];
+    readonly cli: readonly ["start an email-bound device request without accepting a password or user session token", "register the app and enable configured services per environment", "issue, persist, and explicitly rotate configured service credentials", "add or remove app co-owners, each of whom self-provisions their own credentials for the shared db without any secret handoff", "write local Worker values and push deployed Worker secrets through Wrangler stdin", "store tenant-vault secrets (including the Clerk webhook secret and reserved Clerk secret key) write-only from stdin or an env var", "compose declared app-capability schema/rules, create guarded seeds when absent, and configure platform AI, auth, and deployment links", "apply Google Calendar booking config, then drive state-bound consent, status, discovery, and disconnect flows (bookings run live through the platform proxy)", "validate integration contracts offline and smoke-test a provisioned db environment plus anonymous capability routes", "save and explicitly select non-secret named operator contexts with isolated credential caches; resolve and explain platform, app, environment, and credential provenance without authenticating; then run PM, Discussions, o11y, runbook, and identity operations outside a project checkout", "read one versioned o11y status envelope spanning application RED, exact Worker versions and Cloudflare colos observed in traffic, current live-sync freshness/load, the protected commit-to-visible canary, collector ingest/scheduler trust, provider-owned runtime metrics, account-scoped Durable Object, D1, and R2 evidence under odla-db, and a bounded machine verdict", "read one canonical platform fleet snapshot over private service bindings, including release identities, probe latency, Cloudflare load/runtime freshness, explicit unknowns, and stable next actions through a read-only capability", "compare one project's checked-in Registry intent with live owner-visible state, freeze a secret-free Registry-revision-bound plan through app:config:read, and conditionally apply checkpoint-free actions through exact app:config:write operation routes", "inspect or bounded-wait one exact durable config-operation journal entry and verify every terminal receipt digest before returning it to remote automation", "inspect durable agent wakeups as a versioned JSON envelope and explicitly requeue one dead-lettered job with a scoped environment credential", "run app-attributed hosted security discovery and independent validation without provider keys", "connect/revoke source-read-only GitHub sources and drive commit-pinned hosted security jobs without PATs or provider keys", "let admins manage system AI policy and credentials, inspect attributed usage, and read immutable admin changes through separate short-lived capability-only approvals"];
     readonly agent: readonly ["install and import the selected odla SDKs", "wrap the Worker with withObservability and choose useful telemetry", "install capability packages, mount their runtime routes, and make application-specific schema, rules, auth, UI, and migration decisions", "wire @odla-ai/calendar into trusted Worker code and keep the app admin key out of browsers"];
     readonly human: readonly ["provide the existing odla account email, then sign in and explicitly review/approve the exact device code", "review mirrored calendar/attendee disclosure and complete the server-issued Google consent flow", "consent to changes against an app's live database with --yes", "request destructive credential rotation explicitly", "review application semantics, security findings, releases, and merges", "approve redacted-source disclosure before hosted security reasoning", "approve GitHub App repository access separately from redacted-snippet disclosure"];
     readonly studio: readonly ["view application telemetry grouped by exact Worker version, reconciled live-sync load/freshness, commit-to-visible canary health, provider-owned Worker runtime metrics, and environment state", "let signed-in users inventory/revoke their own agent grants and admins audit/global-revoke them", "review calendar connection, granted read scope, selected calendars, and sync health without exposing provider tokens", "perform manual credential recovery — for the primary owner or any co-owner — when the CLI's local shown-once copy is unavailable", "configure system AI purposes and view app/environment/run-attributed usage", "connect/revoke GitHub security sources and inspect ref-to-SHA jobs, routes, retention, coverage, and normalized reports"];
@@ -380,17 +393,6 @@ declare function calendarConnect(options: CalendarLifecycleOptions): Promise<Cal
  * project grant is not revoked. */
 declare function calendarDisconnect(options: CalendarLifecycleOptions): Promise<CalendarStatus>;
 
-interface RunResult {
-    code: number;
-    stdout: string;
-    stderr: string;
-}
-/** Subprocess seam: injectable in tests, `defaultRunner` in production. */
-type CommandRunner = (cmd: string, args: string[], opts?: {
-    input?: string;
-    cwd?: string;
-}) => Promise<RunResult>;
-
 type OdlaEnvName = string;
 type AppRules = Record<string, {
     view?: string;
@@ -683,6 +685,8 @@ interface ConfigReconciliation {
     };
     desiredRevision: ConfigDigest;
     observedRevision: ConfigDigest | null;
+    /** Monotonic Registry compare-and-set revision, separate from content hashes. */
+    registryRevision: RegistryConfigRevision | null;
     status: ConfigDrift;
     summary: {
         differences: number;
@@ -704,12 +708,13 @@ interface ConfigDiffDocument extends Omit<ConfigReconciliation, "actions"> {
         description: string;
     }>;
 }
-/** Revision-bound `odla.config-plan/v1` document returned by `configPlan`. */
+/** Revision-bound `odla.config-plan/v2` document returned by `configPlan`. */
 interface ConfigPlanDocument extends ConfigReconciliation {
-    schemaVersion: "odla.config-plan/v1";
+    schemaVersion: "odla.config-plan/v2";
     planDigest: ConfigDigest;
     apply: {
-        supported: false;
+        supported: boolean;
+        checkpointRequired: boolean;
         reason: string;
     };
     nextActions: Array<{
@@ -730,6 +735,21 @@ interface ConfigInspectOptions {
     stdout?: Pick<typeof console, "log" | "error">;
     now?: () => Date;
 }
+/** Inputs for applying one reviewed, frozen config plan from disk. */
+interface ConfigApplyOptions extends ConfigInspectOptions {
+    planPath: string;
+    idempotencyKey?: string;
+}
+/** Inputs for exact-id config operation reads and bounded waits. */
+interface ConfigOperationInspectOptions extends ConfigInspectOptions {
+    operationId: string;
+    intervalSeconds?: number;
+    timeoutSeconds?: number;
+    pollWait?: (milliseconds: number) => Promise<void>;
+    now?: () => Date;
+}
+/** Result returned by config apply or an operation journal command. */
+type ConfigOperationResult = ConfigOperationReceipt;
 /** Secret-free Registry intent normalized from one loaded project configuration. */
 interface DesiredRegistryState {
     appId: string;
@@ -762,13 +782,22 @@ interface ReconciliationInput {
  * the caller explicitly supplies a token. This function performs no writes.
  */
 declare function configDiff(options: ConfigInspectOptions): Promise<ConfigDiffDocument>;
-/** Freeze desired/observed revisions and ordered actions into a reviewable plan.
- *
- * The returned plan intentionally has `apply.supported: false`; callers must
- * follow its explicit existing-command or Studio checkpoints separately.
- */
+/** Freeze content revisions, Registry CAS revision, and ordered actions. */
 declare function configPlan(options: ConfigInspectOptions): Promise<ConfigPlanDocument>;
 
+/** Apply one exact frozen plan through the Registry operation journal. */
+declare function configApply(options: ConfigApplyOptions): Promise<ConfigOperationReceipt>;
+/** Read one exact journal entry without replaying effects. */
+declare function configOperationGet(options: ConfigOperationInspectOptions): Promise<ConfigOperationReceipt>;
+/** Poll one exact journal entry until it closes or the bounded wait expires. */
+declare function configOperationWait(options: ConfigOperationInspectOptions): Promise<ConfigOperationReceipt>;
+
+/** Stable CLI failure code consumed by `exitCodeFor`. */
+declare class ConfigOperationCommandError extends Error {
+    readonly code: string;
+    constructor(message: string, code: string);
+}
+
 /** Project-config projection owned by Registry reconciliation.
  *
  * This deliberately excludes schema, rules, seeds, secrets, credentials, and
@@ -1222,4 +1251,4 @@ declare function installSkill(options?: SkillInstallOptions): SkillInstallResult
  */
 declare function smoke(options: SmokeOptions): Promise<void>;
 
-export { AGENT_HARNESSES, type AdminAiOptions, type AgentHarness, type AgentHarnessSelector, type AvailableGoogleCalendar, CAPABILITIES, CODE_BUILD_RECIPES, CODE_PI_IMAGE, COMMAND_SURFACE, type CalendarConfig, type CalendarConnectionState, type CalendarLifecycleOptions, type CalendarServiceConfig, type CalendarStatus, type CliDependencies, type CodeBuildRule, type CodeConnectOptions, type CodeContainerEngine, type CodeHostCapabilities, type CodeLocalSourceDescriptor, type CodeRuntimeInput, type ConfigCoverage, type ConfigDiffDocument, type ConfigDifference, type ConfigDigest, type ConfigDrift, type ConfigInspectOptions, type ConfigPlanAction, type ConfigPlanDocument, type ConfigReconciliation, type ConfigRisk, type ConfigSource, type ConnectGitHubSecuritySourceOptions, type DesiredRegistryState, type DisconnectGitHubSecuritySourceOptions, type FollowHostedSecurityJobOptions, GOOGLE_CALENDAR_EVENTS_SCOPE, type GetHostedSecurityIntentOptions, type GetHostedSecurityJobOptions, type GoogleCalendarConfig, type HarnessInstallResult, type HostedSecurityProfile, type HostedSecurityResult, type HostedSecurityTokenRequest, type IntegrationProbe, type IntegrationSeed, type InvocationProblem, type ListGitHubSecuritySourcesOptions, type ListHostedSecurityJobsOptions, type LoadedProjectConfig, type LocalCredentials, type OdlaIntegration, type OdlaProjectConfig, type ProvisionOptions, type ProvisionPlan, type ReconciliationInput, type RunHostedSecurityOptions, SYSTEM_AI_PURPOSES, type ScopedPlatformTokenOptions, type SecretsPushOptions, type SecretsSetOptions, type SkillInstallOptions, type SkillInstallResult, type SmokeOptions, type StartHostedSecurityJobOptions, type SurfaceNode, type SystemAiPurpose, acceptedAfter, adminAi, calendarBookingPageUrl, calendarCalendars, calendarConnect, calendarDisconnect, calendarServiceConfig, calendarStatus, codeConnect, configDiff, configPlan, connectGitHubSecuritySource, describeProblem, desiredRegistryState, disconnectGitHubSecuritySource, doctor, exitCodeFor, followHostedSecurityJob, getHostedSecurityIntent, getHostedSecurityJob, getHostedSecurityPlan, getHostedSecurityReport, getScopedPlatformToken, inferGitHubRepository, initProject, installSkill, invocationPath, isTerminalHostedSecurityStatus, listGitHubSecuritySources, listHostedSecurityJobs, prepareCodeImages, printCapabilities, provision, reconcileConfig, redactSecrets, repositoryFromGitRemote, runCli, runCodeRuntime, runHostedSecurity, secretsPush, secretsSet, secretsSetClerkKey, smoke, startHostedSecurityJob, surfacePaths, validateInvocation };
+export { AGENT_HARNESSES, type AdminAiOptions, type AgentHarness, type AgentHarnessSelector, type AvailableGoogleCalendar, CAPABILITIES, CODE_BUILD_RECIPES, CODE_PI_IMAGE, COMMAND_SURFACE, type CalendarConfig, type CalendarConnectionState, type CalendarLifecycleOptions, type CalendarServiceConfig, type CalendarStatus, type CliDependencies, type CodeBuildRule, type CodeConnectOptions, type CodeContainerEngine, type CodeHostCapabilities, type CodeLocalSourceDescriptor, type CodeRuntimeInput, type ConfigApplyOptions, type ConfigCoverage, type ConfigDiffDocument, type ConfigDifference, type ConfigDigest, type ConfigDrift, type ConfigInspectOptions, ConfigOperationCommandError, type ConfigOperationInspectOptions, type ConfigOperationResult, type ConfigPlanAction, type ConfigPlanDocument, type ConfigReconciliation, type ConfigRisk, type ConfigSource, type ConnectGitHubSecuritySourceOptions, type DesiredRegistryState, type DisconnectGitHubSecuritySourceOptions, type FollowHostedSecurityJobOptions, GOOGLE_CALENDAR_EVENTS_SCOPE, type GetHostedSecurityIntentOptions, type GetHostedSecurityJobOptions, type GoogleCalendarConfig, type HarnessInstallResult, type HostedSecurityProfile, type HostedSecurityResult, type HostedSecurityTokenRequest, type IntegrationProbe, type IntegrationSeed, type InvocationProblem, type ListGitHubSecuritySourcesOptions, type ListHostedSecurityJobsOptions, type LoadedProjectConfig, type LocalCredentials, type OdlaIntegration, type OdlaProjectConfig, type ProvisionOptions, type ProvisionPlan, type ReconciliationInput, type RunHostedSecurityOptions, SYSTEM_AI_PURPOSES, type ScopedPlatformTokenOptions, type SecretsPushOptions, type SecretsSetOptions, type SkillInstallOptions, type SkillInstallResult, type SmokeOptions, type StartHostedSecurityJobOptions, type SurfaceNode, type SystemAiPurpose, acceptedAfter, adminAi, calendarBookingPageUrl, calendarCalendars, calendarConnect, calendarDisconnect, calendarServiceConfig, calendarStatus, codeConnect, configApply, configDiff, configOperationGet, configOperationWait, configPlan, connectGitHubSecuritySource, describeProblem, desiredRegistryState, disconnectGitHubSecuritySource, doctor, exitCodeFor, followHostedSecurityJob, getHostedSecurityIntent, getHostedSecurityJob, getHostedSecurityPlan, getHostedSecurityReport, getScopedPlatformToken, inferGitHubRepository, initProject, installSkill, invocationPath, isTerminalHostedSecurityStatus, listGitHubSecuritySources, listHostedSecurityJobs, prepareCodeImages, printCapabilities, provision, reconcileConfig, redactSecrets, repositoryFromGitRemote, runCli, runCodeRuntime, runHostedSecurity, secretsPush, secretsSet, secretsSetClerkKey, smoke, startHostedSecurityJob, surfacePaths, validateInvocation };

package/dist/index.js

@@ -5,6 +5,7 @@ import {
   CODE_BUILD_RECIPES,
   CODE_PI_IMAGE,
   COMMAND_SURFACE,
+  ConfigOperationCommandError,
   GOOGLE_CALENDAR_EVENTS_SCOPE,
   SYSTEM_AI_PURPOSES,
   acceptedAfter,
@@ -16,7 +17,10 @@ import {
   calendarServiceConfig,
   calendarStatus,
   codeConnect,
+  configApply,
   configDiff,
+  configOperationGet,
+  configOperationWait,
   configPlan,
   connectGitHubSecuritySource,
   describeProblem,
@@ -53,13 +57,14 @@ import {
   startHostedSecurityJob,
   surfacePaths,
   validateInvocation
-} from "./chunk-2AFAXLKE.js";
+} from "./chunk-ZAZBUURZ.js";
 export {
   AGENT_HARNESSES,
   CAPABILITIES,
   CODE_BUILD_RECIPES,
   CODE_PI_IMAGE,
   COMMAND_SURFACE,
+  ConfigOperationCommandError,
   GOOGLE_CALENDAR_EVENTS_SCOPE,
   SYSTEM_AI_PURPOSES,
   acceptedAfter,
@@ -71,7 +76,10 @@ export {
   calendarServiceConfig,
   calendarStatus,
   codeConnect,
+  configApply,
   configDiff,
+  configOperationGet,
+  configOperationWait,
   configPlan,
   connectGitHubSecuritySource,
   describeProblem,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@odla-ai/cli",
-  "version": "0.25.22",
+  "version": "0.26.1",
   "description": "Agent-operable CLI for odla provisioning, calendar consent and sync lifecycle, System AI administration, Worker secrets, security jobs, and smoke checks.",
   "license": "MIT",
   "homepage": "https://odla.ai/docs/packages/cli",
@@ -58,7 +58,7 @@
   },
   "dependencies": {
     "@odla-ai/ai": ">=0.5.0 <1.0.0",
-    "@odla-ai/apps": ">=0.8.3 <1.0.0",
+    "@odla-ai/apps": ">=0.9.0 <1.0.0",
     "@odla-ai/db": ">=0.6.7 <1.0.0",
     "@odla-ai/security": ">=0.3.1 <1.0.0"
   },

package/skills/odla/references/sdks.md

@@ -40,8 +40,8 @@ block (`availabilityCalendars` per env, optional `bookingCalendar`). Normal
 provision opens a second, state-bound Google checkpoint issued by the
 platform; the human grants the booking scopes in a browser. Google tokens
 stay platform-side and never become app/CLI secrets. Google Calendar is the
-single source of truth — odla stores no calendar or attendee data, and
-nothing syncs.
+single source of truth — odla stores no event mirror, bounded exact-lifetime
+mutation receipts are purged with the app, and nothing syncs.
 
 ```ts
 // Trusted Worker only — the admin key must never enter browser code.
@@ -61,7 +61,9 @@ const { booking } = await cal.actions.create(
 ```
 
 Store the returned `eventId`/`meetUrl` on the app's own record;
-`actions.reschedule(eventId, …)` and `actions.cancel(eventId)` use it. A
+`actions.reschedule(eventId, { idempotencyKey, … })` and
+`actions.cancel(eventId, { idempotencyKey })` use it. Derive each key from the
+record and exact intended action; reuse it only for an exact retry. A
 taken slot rejects with non-retryable `calendar_slot_unavailable` — refetch
 slots, don't retry. Browser code never calls `initCalendar` or the platform
 calendar routes; it hits the app's own endpoints and may import pure helpers

package/skills/odla-migrate/references/phase-2b-calendar.md

@@ -3,7 +3,8 @@
 Use this phase when the site should offer real scheduling: visitors pick a
 bookable slot and the app creates a live Google Calendar event — with a Meet
 link and an invitation email that Google itself sends. Google Calendar is the
-single source of truth; odla stores no calendar or attendee data. There is no
+single source of truth; odla stores no calendar mirror. Bounded exact-lifetime
+mutation receipts make retries safe and are removed on app purge. There is no
 sync, no mirror, and no `$bookings` namespace.
 
 Human obligations: complete the server-issued Google consent page in a
@@ -95,14 +96,17 @@ this app's own Worker endpoints and may import pure helpers from
    ```
 
    Store the returned `booking.eventId` and `booking.meetUrl` on the app's
-   own record (its odla-db row) — that record is the app's only persistence;
-   attendee data lives in Google. On `calendar_slot_unavailable` (409,
+   own record (its odla-db row) — that is the app's product record. Attendee
+   source data lives in Google; the platform may retain the bounded create
+   response in the exact app lifetime for replay. On `calendar_slot_unavailable` (409,
    non-retryable) return a "slot taken" response; the client refetches
    `/api/booking/slots` and re-picks. On retryable
    `calendar_booking_in_progress`, retry once after a short delay.
-6. Reschedule/cancel go through the stored id:
-   `cal.actions.reschedule(eventId, { startAt, endAt })` and
-   `cal.actions.cancel(eventId)` (idempotent) — expose them as app endpoints
+6. Reschedule/cancel go through the stored id and require stable exact-action
+   keys: `cal.actions.reschedule(eventId, { idempotencyKey:
+   \`booking:${applicationId}:move:${startAt}:${endAt}\`, startAt, endAt })`
+   and `cal.actions.cancel(eventId, { idempotencyKey:
+   \`booking:${applicationId}:cancel\` })` — expose them as app endpoints
    gated to the record's owner. Attendees can also act through Google's own
    invitation flows; treat Google as authoritative.
 7. Frontend. Two supported shapes:
@@ -125,7 +129,8 @@ UI creates the event on the booking calendar with a Meet link; the Google
 invitation email arrives in the test attendee's inbox; a repeat POST with the
 same idempotency key returns `duplicate: true` (no second event); a taken
 slot returns 409 and the UI refetches slots; reschedule and cancel work via
-the stored `eventId`; zero attendee data is persisted anywhere except the
-app's own tenant record; no Google credential exists in local files; and
+the stored `eventId`; no event mirror exists and retry receipts are purged
+with the app; attendee source data remains in Google and the app stores only
+its own product record; no Google credential exists in local files; and
 PM records the booking-flow decision and the active task comment links this
 evidence.