@odla-ai/cli 0.25.3 → 0.25.7

package/README.md

@@ -65,6 +65,24 @@ the first provision, use a focused commit/checkpoint, then initialize PM and
 backfill that evidence immediately after registration. Never use a parallel
 status diary or put a secret in PM.
 
+When diagnosing a deployed app, agents can request one parseable observability
+snapshot instead of scraping Studio or composing collector routes themselves:
+
+```bash
+npx odla-ai o11y status --app <appId> --env prod --minutes 60 --json
+```
+
+Schema v4 keeps application RED, reconciled live-sync load/freshness and
+subscription recompute/fanout/payload/commit-to-send performance, the exact
+latest protected commit-to-visible canary, collector ingest/scheduler trust,
+and Cloudflare-owned Worker runtime evidence separate. It derives one
+`healthy`, `degraded`, or `unhealthy` verdict with stable reason codes while
+retaining every source response for diagnosis. Provider unavailability,
+adaptive sampling, publication delay, collector loss, quota rejection, stale
+jobs, missing canary configuration, stale probes, and partial
+socket-reconciliation coverage remain explicit fields. Authentication progress
+is stderr-only, so stdout is a single JSON document.
+
 **Runbooks are procedure; JSDoc is API.** What a function takes, returns, and
 guarantees is documented on the export itself, ships in the installed
 `.d.ts`, and renders per package at <https://odla.ai/docs>. A runbook will tell
@@ -343,19 +361,22 @@ but does not revoke a token already copied elsewhere, so use Studio revocation
 when compromise or accidental approval is possible.
 
 `smoke` verifies a provisioned environment from local credentials. It fetches
-the platform public config, checks the configured AI provider, fetches the live
-odla-db schema with the tenant key, compares the fully composed schema entities,
-runs a count aggregate against the first entity, and executes declared
-integration route probes without credentials. It fails early with a clear message
-when provisioning has not written `.odla/credentials.local.json`.
+the platform public config, checks configured service credentials and AI
+provider, exercises schema and aggregate checks only when db is enabled, checks
+owner-visible booking health when calendar is enabled, and executes declared
+integration route probes without credentials. An o11y-only project therefore
+does not need or mint a db key. It fails early with a clear message when
+provisioning has not written `.odla/credentials.local.json`.
 
-### Read-only Google Calendar
+### Google Calendar booking
 
 Calendar is a platform-custodied connector, not a Google credential stored by
 the application. Enable both `db` and `calendar`, configure calendar ids per
 environment, then run normal provision. The first run has two distinct human
 checkpoints: the odla device code establishes app-owner authority, and the
-subsequent server-issued Google page grants `calendar.events.readonly` consent.
+subsequent server-issued Google page grants `calendar.events` and
+`calendar.freebusy` consent so availability and booking writes stay
+server-side.
 
 For parity with a static Google Appointment Schedule embed/link, set the public
 `bookingPageUrl` per environment. Provision applies it through the owner-only
@@ -605,17 +626,13 @@ export default {
   },
   calendar: {
     google: {
-      calendars: { dev: ["primary"] },
+      availabilityCalendars: { dev: ["primary"] },
+      // Optional; defaults to the first availability calendar.
+      bookingCalendar: { dev: "primary" },
       bookingPageUrl: {
         dev: "https://calendar.google.com/calendar/appointments/schedules/…",
       },
-      match: {
-        summaryPrefix: "Intro", // optional
-        organizerSelf: true,    // default true
-        requireAttendees: true, // default true
-      },
-      attendeePolicy: "full", // or "hashed"
-      // This CLI release always requests calendar.events.readonly.
+      // Consent requests calendar.events + calendar.freebusy.
     },
   },
   auth: {

package/REQUIREMENTS.md

@@ -68,11 +68,11 @@ Agnacl, but none should mention or special-case Agnacl.
 - Google consent must be a separate, state-bound platform checkpoint. The CLI may
   print/open and poll an opaque attempt, but must never receive an OAuth code,
   access token, or refresh token.
-- Read-only calendar intent must request only
-  `calendar.events.readonly`; scope elevation belongs in a later explicit flow.
-- Calendar connect/status/discovery/resync/disconnect must be resumable and
-  machine-readable. Disconnect must be explicit and disclose that retained
-  mirror rows can remain stale.
+- Calendar booking consent must request the exact writable event and free/busy
+  scopes required by the live proxy; no Google credential belongs in app code.
+- Calendar connect/status/discovery/disconnect must be resumable and
+  machine-readable. Disconnect must be explicit and disclose that odla stores
+  no mirrored event or attendee rows.
 - A public per-env `bookingPageUrl` must be validated and applied independently
   of connector config so static Appointment Schedule embeds need no Google/app
   credential in browser code.