@odla-ai/cli 0.27.11 → 0.27.12

package/dist/{chunk-Y7WFLSTN.js → chunk-ECRBOR66.js}

@@ -1372,12 +1372,6 @@ async function pollCalendarConnection(ctx, attemptId) {
     ctx.env
   );
 }
-async function requestCalendarDisconnect(ctx) {
-  return parseCalendarStatus(
-    await calendarJson(ctx, "/disconnect", { method: "POST", body: JSON.stringify({ purge: false }) }),
-    ctx.env
-  );
-}
 function parseCalendarStatus(raw, env) {
   const outer = wrapped(raw, "calendar");
   const value2 = record(outer.attempt) ?? record(outer.status) ?? outer;
@@ -1528,6 +1522,16 @@ async function waitForCalendarPoll(milliseconds, signal) {
   });
 }
 
+// src/human-session.ts
+async function requireStudioHuman(configPath, action2, destination = "app", env) {
+  const cfg = await loadProjectConfig(configPath);
+  const appEnv = env && cfg.envs.includes(env) ? env : cfg.envs.includes("dev") ? "dev" : cfg.envs[0] ?? "prod";
+  const path = destination === "app" ? `/studio/apps/${encodeURIComponent(cfg.app.id)}/${encodeURIComponent(appEnv)}/settings/app` : `/studio/apps/${encodeURIComponent(cfg.app.id)}/${encodeURIComponent(appEnv)}/${destination}`;
+  throw new Error(
+    `human_session_required: ${action2} requires the signed-in owner in Studio. A CLI device token is an agent credential, so another approval or retry cannot work. ${new URL(path, cfg.platformUrl).href}`
+  );
+}
+
 // src/calendar.ts
 async function calendarStatus(options) {
   const { ctx, out } = await lifecycleContext(options);
@@ -1561,10 +1565,7 @@ async function applyCalendarBookingPage(ctx, bookingPageUrl, out) {
 }
 async function calendarDisconnect(options) {
   if (!options.yes) throw new Error("calendar disconnect requires --yes");
-  const { ctx, out } = await lifecycleContext(options);
-  const status = await requestCalendarDisconnect(ctx);
-  out.log(`${ctx.env}: calendar disconnected; no calendar data was stored`);
-  return status;
+  return requireStudioHuman(options.configPath, "calendar disconnect", "calendar", options.env);
 }
 async function ensureCalendarConnected(ctx, options) {
   const out = options.stdout ?? console;
@@ -3345,7 +3346,9 @@ async function secretsSetClerkKey(options) {
   if (value2.startsWith("sk_live_") && !PROD_ENV_NAMES2.has(options.env) && !options.yes) {
     throw new Error(`refusing to store an sk_live_ Clerk key for "${options.env}" without --yes (live users would sync into a non-prod tenant)`);
   }
-  const token = await getDeveloperToken(cfg, options, doFetch, out);
+  const token = await getDeveloperToken(cfg, options, doFetch, out, {
+    optionalProjectCapabilities: ["app.manage"]
+  });
   const res = await doFetch(`${cfg.dbEndpoint}/admin/apps/${encodeURIComponent(tenantId)}/clerk-secret`, {
     method: "POST",
     headers: { authorization: `Bearer ${token}`, "content-type": "application/json" },
@@ -7817,17 +7820,17 @@ async function runHostedSecurity(options) {
       allowNetwork: false
     }
   });
-  const report5 = await harness.run(snapshot, { runId: hosted.run.runId, signal: options.signal });
-  await writeSecurityArtifacts(output, report5);
-  const reportDigest = await securityFingerprint(report5);
+  const report4 = await harness.run(snapshot, { runId: hosted.run.runId, signal: options.signal });
+  await writeSecurityArtifacts(output, report4);
+  const reportDigest = await securityFingerprint(report4);
   await hosted.complete({
     reportDigest,
-    coverageStatus: report5.coverageStatus,
-    confirmed: report5.metrics.confirmed,
-    candidates: report5.metrics.candidates
+    coverageStatus: report4.coverageStatus,
+    confirmed: report4.metrics.confirmed,
+    candidates: report4.metrics.candidates
   }, { signal: options.signal });
-  printSummary(options.stdout ?? console, appId, env, hosted.run, report5, output);
-  return Object.freeze({ report: report5, run: hosted.run, output });
+  printSummary(options.stdout ?? console, appId, env, hosted.run, report4, output);
+  return Object.freeze({ report: report4, run: hosted.run, output });
 }
 function selectEnv(requested, declared, configPath, rootDir) {
   const env = requested ?? (declared.includes("dev") ? "dev" : declared[0]);
@@ -7853,14 +7856,14 @@ function profileFor(name, maxHuntTasks) {
   if (!Number.isSafeInteger(maxHuntTasks) || maxHuntTasks < 1) throw new Error("maxHuntTasks must be a positive integer");
   return { ...profile, maxHuntTasks };
 }
-function printSummary(out, appId, env, run, report5, output) {
-  const complete = report5.coverage.filter((cell) => cell.state === "complete").length;
+function printSummary(out, appId, env, run, report4, output) {
+  const complete = report4.coverage.filter((cell) => cell.state === "complete").length;
   out.log(`security: ${appId}/${env} run=${run.runId} profile=${run.profileVersion}`);
   out.log(`  discovery: ${run.discovery.identity.provider}/${run.discovery.identity.model}`);
   out.log(`  validation: ${run.validation.identity.provider}/${run.validation.identity.model}`);
-  out.log(`  coverage: ${report5.coverageStatus} ${complete}/${report5.coverage.length} blocked=${report5.metrics.blockedCells} shallow=${report5.metrics.shallowCells} unscheduled=${report5.metrics.unscheduledCells} budget_exhausted=${report5.metrics.budgetExhaustedCells}`);
-  if (report5.callBudget) out.log(`  calls: discovery=${formatBudget(report5.callBudget.discovery)} validation=${formatBudget(report5.callBudget.validation)}`);
-  out.log(`  findings: confirmed=${report5.metrics.confirmed} needs_reproduction=${report5.metrics.needsReproduction} candidates=${report5.metrics.candidates}`);
+  out.log(`  coverage: ${report4.coverageStatus} ${complete}/${report4.coverage.length} blocked=${report4.metrics.blockedCells} shallow=${report4.metrics.shallowCells} unscheduled=${report4.metrics.unscheduledCells} budget_exhausted=${report4.metrics.budgetExhaustedCells}`);
+  if (report4.callBudget) out.log(`  calls: discovery=${formatBudget(report4.callBudget.discovery)} validation=${formatBudget(report4.callBudget.validation)}`);
+  out.log(`  findings: confirmed=${report4.metrics.confirmed} needs_reproduction=${report4.metrics.needsReproduction} candidates=${report4.metrics.candidates}`);
   out.log(`  report: ${resolve9(output, "REPORT.md")}`);
 }
 function formatBudget(usage) {
@@ -8425,7 +8428,7 @@ async function agentCommand(parsed, deps = {}) {
   if (action2 !== "jobs" && action2 !== "retry") {
     throw new Error(`unknown agent action "${action2 ?? ""}". Try "odla-ai agent jobs --json".`);
   }
-  assertArgs(parsed, ["config", "env", "state", "limit", "json", "token", "email"], action2 === "jobs" ? 2 : 3);
+  assertArgs(parsed, ["config", "env", "state", "limit", "json", "token"], action2 === "jobs" ? 2 : 3);
   if (action2 === "retry" && (parsed.options.state !== void 0 || parsed.options.limit !== void 0)) {
     throw new Error('--state and --limit are supported only by "agent jobs"');
   }
@@ -8433,17 +8436,17 @@ async function agentCommand(parsed, deps = {}) {
   const { env, tenant } = resolveTenant(cfg, stringOpt(parsed.options.env));
   const doFetch = deps.fetch ?? fetch;
   const out = deps.stdout ?? console;
-  const credential2 = await getDeveloperToken(
-    cfg,
-    {
-      configPath: cfg.configPath,
-      token: stringOpt(parsed.options.token),
-      email: stringOpt(parsed.options.email),
-      open: false
-    },
-    doFetch,
-    out
-  );
+  const credential2 = stringOpt(parsed.options.token) ?? readCredentials(cfg.local.credentialsFile)?.envs[env]?.dbKey;
+  if (!credential2) {
+    throw new Error(
+      `no ${env} app credential found; run \`odla-ai provision --write-dev-vars --yes\` or pass --token <ODLA_API_KEY>`
+    );
+  }
+  if (credential2.startsWith("odla_dev_")) {
+    throw new Error(
+      "agent job administration requires an app credential (ODLA_API_KEY / odla_sk_\u2026), not a developer device token"
+    );
+  }
   const base = `${cfg.dbEndpoint}/app/${encodeURIComponent(tenant)}/admin/agent-jobs`;
   const headers = { authorization: `Bearer ${credential2}` };
   if (action2 === "retry") {
@@ -8500,53 +8503,14 @@ function errorMessage(body) {
 }
 
 // src/app-export.ts
-import { createWriteStream } from "fs";
-import { Readable } from "stream";
-import { pipeline } from "stream/promises";
 async function appExport(options) {
-  const cfg = await loadProjectConfig(options.configPath);
-  const out = options.stdout ?? console;
-  const doFetch = options.fetch ?? fetch;
-  const { tenant } = resolveTenant(cfg, options.env);
-  const token = await getDeveloperToken(
-    cfg,
-    { configPath: cfg.configPath, token: options.token, email: options.email, open: false },
-    doFetch,
-    out
-  );
-  const auth = { authorization: `Bearer ${token}` };
-  const base = `${cfg.dbEndpoint}/admin/apps/${encodeURIComponent(tenant)}`;
-  if (options.fresh) {
-    const res = await doFetch(`${base}/export`, { method: "POST", headers: auth });
-    const body = await res.json().catch(() => ({}));
-    if (!res.ok) throw new Error(`export failed${body.error?.code ? ` (${body.error.code})` : ""}: ${body.error?.message ?? res.status}`);
-  }
-  const list = await doFetch(`${base}/backups`, { headers: auth });
-  if (!list.ok) throw new Error(`couldn't list backups (${list.status})`);
-  const { backups } = await list.json();
-  const newest = backups[0];
-  if (!newest) {
-    throw new Error(
-      `${tenant} has no backups yet \u2014 run \`odla-ai app export --fresh\` to take one now (nightly snapshots appear after the first day with writes)`
-    );
-  }
-  const download = await doFetch(`${base}/backups/${newest.id}/download`, { headers: auth });
-  if (!download.ok || !download.body) throw new Error(`download failed (${download.status})`);
-  const file = options.out ?? `${tenant}-${new Date(newest.created_at).toISOString().slice(0, 10)}-tx${newest.max_tx}.jsonl.gz`;
-  await pipeline(Readable.fromWeb(download.body), createWriteStream(file));
-  if (options.json) out.log(JSON.stringify({ file, backup: newest }, null, 2));
-  else {
-    out.log(`${tenant}: wrote ${file} (${newest.bytes} bytes, ${newest.kind} snapshot at tx ${newest.max_tx})`);
-    out.log(`sha256 ${download.headers.get("x-odla-sha256") ?? newest.sha256}`);
-  }
-  return { file, backup: newest };
+  return requireStudioHuman(options.configPath, "database export", "database", options.env);
 }
 
 // src/app-import.ts
 import { readFileSync as readFileSync9 } from "fs";
 import {
   buildImportOps,
-  importMutationId,
   parseImport,
   planImportChunks
 } from "@odla-ai/db/import";
@@ -8565,7 +8529,6 @@ async function appImport(options) {
   const cfg = await loadProjectConfig(options.configPath);
   const out = options.stdout ?? console;
   const say = options.json ? (line) => out.error(line) : (line) => out.log(line);
-  const doFetch = options.fetch ?? fetch;
   const { tenant } = resolveTenant(cfg, options.env);
   const text2 = options.file === "-" ? (options.readStdin ?? (() => readFileSync9(0, "utf8")))() : readFileSync9(options.file, "utf8");
   const { format, sources } = parseImport(text2, options.ns);
@@ -8593,100 +8556,18 @@ ${detail}${more}`);
     if (options.json) out.log(JSON.stringify(result, null, 2));
     return result;
   }
-  const token = await getDeveloperToken(
-    cfg,
-    { configPath: cfg.configPath, token: options.token, email: options.email, open: false },
-    doFetch,
-    out
-  );
-  const runId = crypto.randomUUID();
-  const url = `${cfg.dbEndpoint}/admin/apps/${encodeURIComponent(tenant)}/transact`;
-  for (const chunk of chunks) {
-    const res = await doFetch(url, {
-      method: "POST",
-      headers: { authorization: `Bearer ${token}`, "content-type": "application/json" },
-      body: JSON.stringify({ mutationId: importMutationId(runId, chunk.index), ops: chunk.ops })
-    });
-    const body = await res.json().catch(() => ({}));
-    if (!res.ok) {
-      const code = body.error?.code ? ` (${body.error.code})` : "";
-      throw new Error(
-        `chunk ${chunk.index + 1} of ${chunks.length} failed${code}: ${body.error?.message ?? res.status}. ${result.committed} row(s) already committed; fix the input and re-run to import the rest.`
-      );
-    }
-    result.committed += chunk.ops.length;
-    if (typeof body.txId === "number") result.txIds.push(body.txId);
-    if (body.duplicate) result.duplicate++;
-  }
-  if (options.json) out.log(JSON.stringify(result, null, 2));
-  else {
-    const dup = result.duplicate > 0 ? ` (${result.duplicate} chunk(s) were already applied)` : "";
-    out.log(`${tenant}: upserted ${result.committed} row(s) in ${chunks.length} transaction(s)${dup}`);
-  }
-  return result;
+  return requireStudioHuman(options.configPath, "database import", "database", options.env);
 }
 
 // src/app-owners.ts
-var sink = (options) => options.stdout ?? console;
-async function ownersRequest(method, suffix, options, body) {
-  const cfg = await loadProjectConfig(options.configPath);
-  const doFetch = options.fetch ?? fetch;
-  const token = await getDeveloperToken(
-    cfg,
-    { configPath: cfg.configPath, token: options.token, email: options.email, open: false },
-    doFetch,
-    sink(options)
-  );
-  const res = await doFetch(`${cfg.platformUrl}/registry/apps/${encodeURIComponent(cfg.app.id)}/owners${suffix}`, {
-    method,
-    headers: { authorization: `Bearer ${token}`, "content-type": "application/json" },
-    body: body === void 0 ? void 0 : JSON.stringify(body)
-  });
-  const data = await res.json().catch(() => ({}));
-  if (!res.ok) {
-    throw new Error(
-      `owners ${method} failed${data.error?.code ? ` (${data.error.code})` : ""}: ` + (data.error?.message ?? `registry returned ${res.status}`)
-    );
-  }
-  return data.owners ?? [];
-}
-function report(options, owners, headline) {
-  const out = sink(options);
-  if (options.json === true) {
-    out.log(JSON.stringify(owners, null, 2));
-    return;
-  }
-  if (headline) out.log(headline);
-  out.log(`owners (${owners.length}):`);
-  for (const o of owners) {
-    const name = o.email?.trim() || "Unnamed member";
-    out.log(
-      `  ${o.primary ? "\u2605" : "\xB7"} ${name} [${o.ownerId}]${o.primary ? " (primary)" : ""}`
-    );
-  }
-}
 async function ownersList(options) {
-  report(options, await ownersRequest("GET", "", options));
+  await requireStudioHuman(options.configPath, "listing app owners", "app");
 }
 async function ownersAdd(email, options) {
-  const owners = await ownersRequest("POST", "", options, { email });
-  report(
-    options,
-    owners,
-    `added ${email} as a co-owner \u2014 they share full access. They can now run \`odla-ai provision\` to mint their own credentials (no secret sharing).`
-  );
+  await requireStudioHuman(options.configPath, `adding ${email} as an app owner`, "app");
 }
 async function ownersRemove(target, options) {
-  let ownerId = target;
-  if (target.includes("@")) {
-    const owners2 = await ownersRequest("GET", "", options);
-    const match = owners2.find((o) => o.email?.toLowerCase() === target.toLowerCase());
-    if (!match) throw new Error(`no co-owner with email ${target}`);
-    if (match.primary) throw new Error("can't remove the primary owner");
-    ownerId = match.ownerId;
-  }
-  const owners = await ownersRequest("DELETE", `/${encodeURIComponent(ownerId)}`, options);
-  report(options, owners, `removed ${target}`);
+  await requireStudioHuman(options.configPath, `removing ${target} as an app owner`, "app");
 }
 async function appOwnersCommand(parsed, dependencies = {}) {
   const sub = parsed.positionals[2] ?? "list";
@@ -8718,35 +8599,9 @@ async function appOwnersCommand(parsed, dependencies = {}) {
 
 // src/app-rename.ts
 async function appRename(name, options) {
-  const out = options.stdout ?? console;
   const trimmed = name.trim();
   if (!trimmed) throw new Error('"app rename" needs a name \u2014 try `odla-ai app rename "Acme Storefront"`.');
-  const cfg = await loadProjectConfig(options.configPath);
-  const doFetch = options.fetch ?? fetch;
-  const token = await getDeveloperToken(
-    cfg,
-    { configPath: cfg.configPath, token: options.token, email: options.email, open: false },
-    doFetch,
-    out
-  );
-  const res = await doFetch(`${cfg.platformUrl}/registry/apps/${encodeURIComponent(cfg.app.id)}/name`, {
-    method: "PUT",
-    headers: { authorization: `Bearer ${token}`, "content-type": "application/json" },
-    body: JSON.stringify({ name: trimmed })
-  });
-  const data = await res.json().catch(() => ({}));
-  if (!res.ok || !data.app) {
-    throw new Error(
-      `rename failed${data.error?.code ? ` (${data.error.code})` : ""}: ` + (data.error?.message ?? `registry returned ${res.status}`)
-    );
-  }
-  if (options.json === true) {
-    out.log(JSON.stringify(data.app, null, 2));
-    return;
-  }
-  out.log(`renamed ${data.app.appId} \u2192 "${data.app.name}"`);
-  out.log("The app id is unchanged, so credentials, tenants, and URLs keep working.");
-  out.log(`Update the "name" in ${cfg.configPath} to match.`);
+  await requireStudioHuman(options.configPath, `renaming the app to "${trimmed}"`, "app");
 }
 async function appRenameCommand(parsed, dependencies = {}) {
   assertArgs(parsed, ["config", "token", "email", "json"], parsed.positionals.length);
@@ -8762,172 +8617,23 @@ async function appRenameCommand(parsed, dependencies = {}) {
 }
 
 // src/app-transfer.ts
-function endpointsFor(verb, tenants) {
-  const up = { source: tenants.sandbox, target: tenants.live, from: "dev" };
-  const down = { source: tenants.live, target: tenants.sandbox, from: "prod" };
-  if (verb === "refresh-sandbox") return { ...down, mode: "refresh" };
-  return { ...up, mode: "cutover" };
-}
-async function api(cfg, token, path, init, doFetch) {
-  const res = await doFetch(`${cfg.dbEndpoint}${path}`, {
-    ...init,
-    headers: { authorization: `Bearer ${token}`, "content-type": "application/json", ...init?.headers }
-  });
-  return { status: res.status, body: await res.json().catch(() => ({})) };
-}
-function describe(side) {
-  if (!side.exists) return "not provisioned";
-  if (side.maxTx === 0) return "empty \u2014 never written";
-  const ns = side.namespaces.length === 1 ? "1 namespace" : `${side.namespaces.length} namespaces`;
-  const identity = side.identityRows > 0 ? `, ${side.identityRows} identity row(s)` : "";
-  return `${ns} \xB7 ${side.triples} value(s) \xB7 tx ${side.maxTx}${identity}`;
-}
-function printPlan2(out, verb, pre, opts) {
-  const arrow = verb === "refresh-sandbox" ? "live \u2192 sandbox" : "sandbox \u2192 live";
-  out.log(`${verb} (${arrow})`);
-  out.log(`  from  ${pre.source.tenant}  ${describe(pre.source)}`);
-  out.log(`  to    ${pre.target.tenant}  ${describe(pre.target)}`);
-  if (verb === "promote") {
-    out.log("  moves schema, rules and gates only \u2014 no rows are copied or removed");
-  } else {
-    out.log(`  ${pre.target.tenant} is REPLACED by ${pre.source.tenant}`);
-    out.log(`  stays put: ${pre.staysPut.join(", ")}`);
-    const identity = opts.includeIdentity ? "INCLUDED (--include-identity)" : `left behind: ${pre.excluded.join(", ")}`;
-    out.log(`  identity: ${identity}`);
-    out.log(`  files: ${opts.includeFiles ? "copied (--include-files)" : "not copied"}`);
-  }
-  for (const blocker of pre.blockers) out.log(`  \u2716 ${blocker.code}: ${blocker.message}`);
-}
 async function appTransfer(options) {
   const cfg = await loadProjectConfig(options.configPath);
-  const out = options.stdout ?? console;
-  const say = options.json ? (line) => out.error(line) : (line) => out.log(line);
-  const doFetch = options.fetch ?? fetch;
-  const tenants = bothTenants(cfg);
-  const route2 = endpointsFor(options.verb, tenants);
-  const token = await getDeveloperToken(
-    cfg,
-    { configPath: cfg.configPath, token: options.token, email: options.email, open: false },
-    doFetch,
-    out
-  );
-  const pre = await api(
-    cfg,
-    token,
-    `/admin/apps/${encodeURIComponent(route2.target)}/copy-preflight?from=${route2.from}`,
-    void 0,
-    doFetch
-  );
-  if (pre.status !== 200) {
-    throw new Error(`pre-flight failed${pre.body.error?.code ? ` (${pre.body.error.code})` : ""}: ${pre.body.error?.message ?? pre.status}`);
-  }
-  const plan = pre.body;
-  printPlan2({ log: say }, options.verb, plan, options);
-  if (options.verb === "go-live" && !plan.targetEmpty) {
-    throw new Error(
-      `${route2.target} already has data \u2014 go-live has already happened. Use \`odla-ai app promote --yes\` to push schema and rules, or \`odla-ai app refresh-sandbox --yes\` to pull live back down.`
-    );
-  }
-  if (plan.blockers.length > 0) throw new Error(`cannot ${options.verb}: ${plan.blockers.map((b) => b.message).join("; ")}`);
-  if (options.dryRun || options.yes !== true) {
-    say(`nothing written (${options.dryRun ? "--dry-run" : "no --yes"})`);
-    if (options.json) out.log(JSON.stringify(plan, null, 2));
-    return { ok: true, plan };
-  }
-  if (options.verb === "promote") {
-    const res2 = await api(
-      cfg,
-      token,
-      `/admin/apps/${encodeURIComponent(route2.target)}/promote-definitions`,
-      { method: "POST", body: JSON.stringify({ from: "dev" }) },
-      doFetch
-    );
-    if (res2.status !== 200) throw new Error(`promote failed${res2.body.error?.code ? ` (${res2.body.error.code})` : ""}: ${res2.body.error?.message ?? res2.status}`);
-    if (options.json) out.log(JSON.stringify(res2.body, null, 2));
-    else say(`${route2.target}: promoted ${(res2.body.applied ?? []).join(", ")}`);
-    return { ok: true, plan, result: res2.body };
-  }
-  const res = await api(
-    cfg,
-    token,
-    `/admin/apps/${encodeURIComponent(route2.target)}/copy-db`,
-    {
-      method: "POST",
-      body: JSON.stringify({
-        from: route2.from,
-        mode: route2.mode,
-        ...options.includeIdentity ? { includeUsers: true } : {},
-        ...options.includeFiles ? { includeFiles: true } : {}
-      })
-    },
-    doFetch
-  );
-  if (res.status !== 200) throw new Error(`${options.verb} failed${res.body.error?.code ? ` (${res.body.error.code})` : ""}: ${res.body.error?.message ?? res.status}`);
-  say(`${route2.target}: replaced from ${route2.source} (tx ${res.body.destination?.maxTx}, epoch ${res.body.destination?.epoch}) \u2014 connected clients resync automatically`);
-  if (options.includeFiles) await copyFiles(cfg, token, route2, doFetch, out);
-  if (options.json) out.log(JSON.stringify(res.body, null, 2));
-  return { ok: true, plan, result: res.body };
-}
-async function copyFiles(cfg, token, route2, doFetch, out) {
-  for (let attempt = 1; attempt <= 20; attempt++) {
-    const res = await api(
-      cfg,
-      token,
-      `/admin/apps/${encodeURIComponent(route2.target)}/copy-files`,
-      { method: "POST", body: JSON.stringify({ from: route2.from }) },
-      doFetch
-    );
-    if (res.status === 200) {
-      out.log(`${route2.target}: files copied`);
-      return;
-    }
-    if (!res.body.error?.retry) {
-      throw new Error(`file copy failed${res.body.error?.code ? ` (${res.body.error.code})` : ""}: ${res.body.error?.message ?? res.status}`);
-    }
-    out.log(`  files: bounded at attempt ${attempt}, resuming\u2026`);
-  }
-  throw new Error("file copy did not finish within 20 rounds \u2014 re-run to continue where it left off");
+  bothTenants(cfg);
+  return requireStudioHuman(options.configPath, `app ${options.verb}`, "database");
 }
 
 // src/app-lifecycle.ts
-async function lifecycleCall(action2, options) {
-  const cfg = await loadProjectConfig(options.configPath);
-  const out = options.stdout ?? console;
-  const doFetch = options.fetch ?? fetch;
-  const token = await getDeveloperToken(
-    cfg,
-    { configPath: cfg.configPath, token: options.token, email: options.email, open: false },
-    doFetch,
-    out
-  );
-  const res = await doFetch(`${cfg.platformUrl}/registry/apps/${encodeURIComponent(cfg.app.id)}/${action2}`, {
-    method: "POST",
-    headers: { authorization: `Bearer ${token}`, "content-type": "application/json" }
-  });
-  const body = await res.json().catch(() => ({}));
-  if (!res.ok || !body.ok) {
-    throw new Error(`${action2} failed${body.error?.code ? ` (${body.error.code})` : ""}: ${body.error?.message ?? `registry returned ${res.status}`}`);
-  }
-  return body;
-}
 async function appArchive(options) {
   if (options.yes !== true) {
     throw new Error(
       "app archive suspends EVERY environment: API keys stop working and all services refuse requests until restored. All data is retained. Pass --yes to proceed."
     );
   }
-  const out = options.stdout ?? console;
-  const body = await lifecycleCall("archive", options);
-  if (options.json) out.log(JSON.stringify(body, null, 2));
-  else if (body.operation?.state === "noop") out.log(`${body.app?.appId}: already archived`);
-  else out.log(`${body.app?.appId}: archived \u2014 data retained; run \`odla-ai app restore\` (or use Studio) to bring it back`);
+  await requireStudioHuman(options.configPath, "app archive", "app");
 }
 async function appRestore(options) {
-  const out = options.stdout ?? console;
-  const body = await lifecycleCall("restore", options);
-  if (options.json) out.log(JSON.stringify(body, null, 2));
-  else if (body.operation?.state === "noop") out.log(`${body.app?.appId}: already active`);
-  else out.log(`${body.app?.appId}: restored \u2014 every service's data plane is live again`);
+  await requireStudioHuman(options.configPath, "app restore", "app");
 }
 async function appCommand(parsed, dependencies = {}) {
   const sub = parsed.positionals[1];
@@ -9563,18 +9269,17 @@ Usage:
   odla-ai calendar status [--env dev] [--email <odla-account>] [--json]
   odla-ai calendar calendars [--env dev] [--email <odla-account>] [--json]
   odla-ai calendar connect [--env dev] [--email <odla-account>] [--no-open] [--yes]
-  odla-ai calendar disconnect [--env dev] [--email <odla-account>] --yes
-  odla-ai app archive [--config odla.config.mjs] [--email <odla-account>] [--json] --yes
-  odla-ai app restore [--config odla.config.mjs] [--email <odla-account>] [--json]
-  odla-ai app export [--env dev] [--fresh] [--out <file>] [--email <odla-account>] [--json]
+  odla-ai calendar disconnect [--env dev] --yes                         [continue in Studio; human session required]
+  odla-ai app archive [--config odla.config.mjs] --yes                  [continue in Studio; human session required]
+  odla-ai app restore [--config odla.config.mjs]                        [continue in Studio; human session required]
+  odla-ai app export [--env dev]                                        [continue in Studio; human session required]
   odla-ai app import <file|-> [--env dev] [--ns <namespace>] [--id-field <f>|--key <attr>|--generate-ids] [--dry-run] [--json] --yes
-  odla-ai app refresh-sandbox [--include-identity] [--include-files] [--dry-run] [--json] --yes
-  odla-ai app go-live         [--include-identity] [--include-files] [--dry-run] [--json] --yes
-  odla-ai app promote         [--dry-run] [--json] --yes
-  odla-ai app rename <name> [--config odla.config.mjs] [--email <odla-account>] [--json]
-  odla-ai app owners list [--config odla.config.mjs] [--email <odla-account>] [--json]
-  odla-ai app owners add <email> [--email <odla-account>] [--json]
-  odla-ai app owners remove <email> [--email <odla-account>] [--json]
+                                                                         [dry-run is local; writes continue in Studio]
+  odla-ai app refresh-sandbox                                          [continue in Studio; human session required]
+  odla-ai app go-live                                                  [continue in Studio; human session required]
+  odla-ai app promote                                                  [continue in Studio; human session required]
+  odla-ai app rename <name>                                            [continue in Studio; human session required]
+  odla-ai app owners <list|add|remove> [...]                            [continue in Studio; human session required]
   odla-ai brand design unpack <bundle.html|-> [--out <dir>] [--json]
   odla-ai pm goal list [--app <id>] [--status <s>] [--q <text>] [--limit <n>] [--offset <n>] [--json]
   odla-ai pm task list [--app <id>] [--column <backlog|ready|doing|review|done>] [--goal <id>] [--assignee <id>] [--q <text>] [--limit <n>] [--offset <n>] [--json]
@@ -9609,8 +9314,8 @@ Usage:
   odla-ai discuss resolve <topic> [--reopen] [--mutation-id <id>]
   odla-ai discuss who --q <text> [--app <id>] [--kinds user,pm:task] [--json]
   odla-ai discuss watch [<topic>] [--cursor <cursor>] [--by <authorId>] [--self <authorId>] [--interval <s>] [--timeout <s>] [--json|--jsonl]
-  odla-ai agent jobs [--env dev] [--state pending|running|succeeded|dead_letter] [--limit 50] [--email <email>] [--json]
-  odla-ai agent retry <job-id> [--env dev] [--email <email>] [--json]
+  odla-ai agent jobs [--env dev] [--state pending|running|succeeded|dead_letter] [--limit 50] [--token <ODLA_API_KEY>] [--json]
+  odla-ai agent retry <job-id> [--env dev] [--token <ODLA_API_KEY>] [--json]
   odla-ai context show [--context <name>] [--platform https://odla.ai] [--app <id>] [--env prod] [--json]
   odla-ai context list [--json]
   odla-ai context save <name> [--platform <url>] [--app <id>] [--env <name>] [--json]
@@ -9646,8 +9351,8 @@ Usage:
   odla-ai admin ai credential set <provider> [--context <name>] (--from-env <NAME>|--stdin)
   odla-ai admin ai usage [--context <name>] [--app-id <id>] [--env <env>] [--run-id <id>] [--limit <1-500>] [--json]
   odla-ai admin ai audit [--context <name>] [--limit <1-200>] [--json]
-  odla-ai security github connect [--repo owner/name] [--env dev] [--email <odla-account>] [--no-open]
-  odla-ai security github disconnect --source <id> [--env dev] [--yes]
+  odla-ai security github connect [--repo owner/name] [--env dev]             [continue in Studio; human session required]
+  odla-ai security github disconnect --source <id> [--env dev]          [continue in Studio; human session required]
   odla-ai security plan [--env dev] [--json]
   odla-ai security sources [--env dev] [--json]
   odla-ai security run --source <id> --plan-digest <sha256:...> --ack-redacted-source [--ref <branch|tag|sha>] [--env dev] [--no-follow]
@@ -10158,7 +9863,7 @@ async function discussWatch(ctx, topicId, parsed) {
         throw new WatchRemoteError(cursor, error);
       }
       if (deadline !== void 0 && now() >= deadline) {
-        const result = report2(ctx, parsed, { found: false, cursor: cursor ?? "" });
+        const result = report(ctx, parsed, { found: false, cursor: cursor ?? "" });
         throw new WatchTimeoutError(result.cursor);
       }
       const base = Math.min(intervalMs, 1e3);
@@ -10199,7 +9904,7 @@ async function discussWatch(ctx, topicId, parsed) {
       });
       const posts = topicId ? matching.filter((event) => event.type === "message").map((event) => event.payload) : void 0;
       const topics = topicId ? void 0 : matching.filter((event) => event.type === "activity").map((event) => event.payload);
-      return report2(ctx, parsed, {
+      return report(ctx, parsed, {
         found: true,
         cursor,
         events: matching,
@@ -10226,13 +9931,13 @@ async function discussWatch(ctx, topicId, parsed) {
     }
     if (page2.hasMore) continue;
     if (deadline !== void 0 && now() >= deadline) {
-      return report2(ctx, parsed, { found: false, cursor });
+      return report(ctx, parsed, { found: false, cursor });
     }
     const wait2 = deadline === void 0 ? intervalMs : Math.min(intervalMs, Math.max(0, deadline - now()));
     await sleep(wait2);
   }
 }
-function report2(ctx, parsed, result) {
+function report(ctx, parsed, result) {
   if (ctx.json) {
     ctx.out.log(JSON.stringify(result, null, 2));
   } else if (parsed.options.jsonl !== true && result.found) {
@@ -10733,7 +10438,7 @@ function eventLabel(event) {
   const body = event.payload.message?.body?.replace(/\s+/g, " ").trim();
   return body || event.payload.entityId;
 }
-function report3(ctx, parsed, result) {
+function report2(ctx, parsed, result) {
   if (ctx.json) ctx.out.log(JSON.stringify(result, null, 2));
   else if (parsed.options.jsonl !== true && result.found) {
     for (const event of result.events ?? []) {
@@ -10793,7 +10498,7 @@ async function pmWatch(ctx, parsed) {
       });
       if (consecutiveFailures >= MAX_CONSECUTIVE_FAILURES2) throw error;
       if (deadline !== void 0 && now() >= deadline) {
-        return report3(ctx, parsed, { found: false, cursor: cursor ?? "" });
+        return report2(ctx, parsed, { found: false, cursor: cursor ?? "" });
       }
       const backoff = Math.min(
         MAX_BACKOFF_MS2,
@@ -10834,7 +10539,7 @@ async function pmWatch(ctx, parsed) {
         cursor,
         serverTime: current.serverTime
       });
-      return report3(ctx, parsed, { found: true, cursor, events: matching });
+      return report2(ctx, parsed, { found: true, cursor, events: matching });
     }
     if (current.events.length > 0) {
       jsonl2(ctx, parsed, {
@@ -10853,7 +10558,7 @@ async function pmWatch(ctx, parsed) {
     }
     if (current.hasMore) continue;
     if (deadline !== void 0 && now() >= deadline) {
-      return report3(ctx, parsed, { found: false, cursor });
+      return report2(ctx, parsed, { found: false, cursor });
     }
     await sleep(
       deadline === void 0 ? intervalMs : Math.min(intervalMs, Math.max(0, deadline - now()))
@@ -12044,7 +11749,7 @@ async function assessImpact(ctx, surfaces, all, limit) {
   return out;
 }
 var editHint = (slug, appId) => `odla-ai runbook edit ${slug}${appId === PLATFORM_SCOPE ? "" : ` --app ${appId}`} --note "<what changed>"`;
-function report4(ctx, impacts) {
+function report3(ctx, impacts) {
   const covered = impacts.filter((i) => i.runbooks.length);
   ctx.out.log(
     `${impacts.length} changed surface${impacts.length === 1 ? "" : "s"}; ${covered.length} covered by a runbook. Reread each one and fix any step this change made wrong.`
@@ -12082,7 +11787,7 @@ async function runbookImpact(ctx, options, deps = {}) {
   }
   const impacts = await assessImpact(ctx, surfaces, options.all, options.limit ?? 4);
   if (ctx.json) return ctx.out.log(JSON.stringify({ base: options.base, impacts }, null, 2));
-  report4(ctx, impacts);
+  report3(ctx, impacts);
 }
 
 // src/runbook-lint.ts
@@ -12582,7 +12287,6 @@ async function runbookCommand(parsed, deps = {}) {
 }
 
 // src/security-command-context.ts
-import { createInterface } from "readline/promises";
 async function hostedSecurityContext(parsed, dependencies) {
   const configPath = stringOpt(parsed.options.config) ?? "odla.config.mjs";
   const cfg = await loadProjectConfig(configPath);
@@ -12601,21 +12305,11 @@ async function hostedSecurityContext(parsed, dependencies) {
     cfg,
     { configPath, email: stringOpt(parsed.options.email), open, openApprovalUrl: dependencies.openUrl },
     doFetch,
-    stdout
+    stdout,
+    { optionalProjectCapabilities: ["app.manage"] }
   );
   return { platform, token, appId: cfg.app.id, env, fetch: doFetch, stdout };
 }
-async function interactiveConfirmation(message2, dependencies) {
-  if (dependencies.confirm) return dependencies.confirm(message2);
-  if (!process.stdin.isTTY || !process.stdout.isTTY) return false;
-  const prompt = createInterface({ input: process.stdin, output: process.stdout });
-  try {
-    const answer = await prompt.question(`${message2} [y/N] `);
-    return /^y(?:es)?$/i.test(answer.trim());
-  } finally {
-    prompt.close();
-  }
-}
 function requiredSecurityPositional(parsed, index, label) {
   const value2 = parsed.positionals[index];
   if (!value2) throw new Error(`${label} is required`);
@@ -12681,31 +12375,31 @@ function printHostedJob(out, job, platform, appId) {
   url.searchParams.set("job", job.jobId);
   out.log(`  Studio: ${url.toString()}`);
 }
-function printHostedReport(out, report5) {
-  out.log(`security report ${report5.jobId}: ${report5.repository}@${report5.revision}`);
-  out.log(`  coverage: ${report5.coverageStatus} cells=${report5.metrics.coverageCells} shallow=${report5.metrics.shallowCells} blocked=${report5.metrics.blockedCells} unscheduled=${report5.metrics.unscheduledCells} budget_exhausted=${report5.metrics.budgetExhaustedCells}`);
-  out.log(`  findings: confirmed=${report5.metrics.confirmed} needs_reproduction=${report5.metrics.needsReproduction} candidates=${report5.metrics.candidates} rejected=${report5.metrics.rejected}`);
-  out.log(`  discovery: ${report5.provenance.discovery?.provider ?? "unknown"}/${report5.provenance.discovery?.model ?? "unknown"}`);
-  out.log(`  validation: ${report5.provenance.validation?.provider ?? "unknown"}/${report5.provenance.validation?.model ?? "unknown"} independent=${String(report5.provenance.independentValidation)}`);
-  for (const finding of report5.findings) {
+function printHostedReport(out, report4) {
+  out.log(`security report ${report4.jobId}: ${report4.repository}@${report4.revision}`);
+  out.log(`  coverage: ${report4.coverageStatus} cells=${report4.metrics.coverageCells} shallow=${report4.metrics.shallowCells} blocked=${report4.metrics.blockedCells} unscheduled=${report4.metrics.unscheduledCells} budget_exhausted=${report4.metrics.budgetExhaustedCells}`);
+  out.log(`  findings: confirmed=${report4.metrics.confirmed} needs_reproduction=${report4.metrics.needsReproduction} candidates=${report4.metrics.candidates} rejected=${report4.metrics.rejected}`);
+  out.log(`  discovery: ${report4.provenance.discovery?.provider ?? "unknown"}/${report4.provenance.discovery?.model ?? "unknown"}`);
+  out.log(`  validation: ${report4.provenance.validation?.provider ?? "unknown"}/${report4.provenance.validation?.model ?? "unknown"} independent=${String(report4.provenance.independentValidation)}`);
+  for (const finding of report4.findings) {
     const location = finding.locations[0];
     out.log(`  [${finding.severity}] ${finding.title}${location ? ` (${location.path}:${location.line})` : ""} \xB7 ${finding.disposition}`);
   }
-  for (const limitation of report5.limitations) out.log(`  limitation: ${limitation}`);
+  for (const limitation of report4.limitations) out.log(`  limitation: ${limitation}`);
 }
-function enforceHostedReportGate(report5, parsed, out, emitSuccess) {
+function enforceHostedReportGate(report4, parsed, out, emitSuccess) {
   const failOn = hostedSeverity(stringOpt(parsed.options["fail-on"]) ?? "high", "--fail-on");
   const candidateValue = parsed.options["fail-on-candidates"];
   const failOnCandidates = candidateValue === false ? void 0 : hostedSeverity(stringOpt(candidateValue) ?? "critical", "--fail-on-candidates");
   const atOrAbove = (severity, threshold) => HOSTED_SEVERITIES.indexOf(severity) >= HOSTED_SEVERITIES.indexOf(threshold);
-  const confirmed = report5.findings.filter((finding) => finding.disposition === "confirmed" && atOrAbove(finding.severity, failOn));
-  const leads = failOnCandidates ? report5.findings.filter((finding) => finding.disposition !== "confirmed" && atOrAbove(finding.severity, failOnCandidates)) : [];
-  const incomplete = report5.coverageStatus !== "complete" && parsed.options["allow-incomplete"] !== true;
+  const confirmed = report4.findings.filter((finding) => finding.disposition === "confirmed" && atOrAbove(finding.severity, failOn));
+  const leads = failOnCandidates ? report4.findings.filter((finding) => finding.disposition !== "confirmed" && atOrAbove(finding.severity, failOnCandidates)) : [];
+  const incomplete = report4.coverageStatus !== "complete" && parsed.options["allow-incomplete"] !== true;
   if (confirmed.length || leads.length || incomplete) {
-    throw new Error(`hosted security gate failed: ${confirmed.length} confirmed >= ${failOn}; ${leads.length} leads >= ${failOnCandidates ?? "disabled"}${incomplete ? `; coverage ${report5.coverageStatus}` : ""}`);
+    throw new Error(`hosted security gate failed: ${confirmed.length} confirmed >= ${failOn}; ${leads.length} leads >= ${failOnCandidates ?? "disabled"}${incomplete ? `; coverage ${report4.coverageStatus}` : ""}`);
   }
   if (emitSuccess) {
-    out.log(`security gate passed: 0 confirmed >= ${failOn}; 0 leads >= ${failOnCandidates ?? "disabled"}; coverage ${report5.coverageStatus}. This is not proof that the application is secure.`);
+    out.log(`security gate passed: 0 confirmed >= ${failOn}; 0 leads >= ${failOnCandidates ?? "disabled"}; coverage ${report4.coverageStatus}. This is not proof that the application is secure.`);
   }
 }
 function printHostedSecurityPlanRoute(out, label, route2) {
@@ -12809,13 +12503,13 @@ async function runSourceSecurityCommand(parsed, dependencies, sourceId) {
     }
     throw new Error(`hosted security job ${result.jobId} ended ${result.status}${result.errorCode ? `: ${result.errorCode}` : ""}`);
   }
-  const report5 = await getHostedSecurityReport({ ...context, jobId: result.jobId });
+  const report4 = await getHostedSecurityReport({ ...context, jobId: result.jobId });
   if (parsed.options.json === true) {
-    context.stdout.log(JSON.stringify({ plan, intent: preview.intent, job: result, report: report5 }, null, 2));
+    context.stdout.log(JSON.stringify({ plan, intent: preview.intent, job: result, report: report4 }, null, 2));
   } else {
-    printHostedReport(context.stdout, report5);
+    printHostedReport(context.stdout, report4);
   }
-  enforceHostedReportGate(report5, parsed, context.stdout, parsed.options.json !== true);
+  enforceHostedReportGate(report4, parsed, context.stdout, parsed.options.json !== true);
 }
 async function runLocalSecurityCommand(parsed, dependencies) {
   if (parsed.options.source === true) {
@@ -12876,19 +12570,20 @@ async function runLocalSecurityCommand(parsed, dependencies) {
         cfg,
         { configPath, email: stringOpt(parsed.options.email), open, openApprovalUrl: dependencies.openUrl },
         doFetch,
-        out
+        out,
+        { optionalProjectCapabilities: ["app.manage"] }
       );
     }
   });
   enforceLocalGate(result.report, parsed);
 }
-function enforceLocalGate(report5, parsed) {
+function enforceLocalGate(report4, parsed) {
   const failOn = severityOpt(stringOpt(parsed.options["fail-on"]) ?? "high", "--fail-on");
   const candidateValue = parsed.options["fail-on-candidates"];
   const failOnCandidates = candidateValue === false ? void 0 : severityOpt(stringOpt(candidateValue) ?? "critical", "--fail-on-candidates");
-  const confirmed = findingsAtOrAbove(report5, failOn);
-  const leads = failOnCandidates ? findingsAtOrAbove(report5, failOnCandidates, true).filter((finding) => finding.disposition !== "confirmed") : [];
-  const incomplete = report5.coverageStatus === "incomplete" && parsed.options["allow-incomplete"] !== true;
+  const confirmed = findingsAtOrAbove(report4, failOn);
+  const leads = failOnCandidates ? findingsAtOrAbove(report4, failOnCandidates, true).filter((finding) => finding.disposition !== "confirmed") : [];
+  const incomplete = report4.coverageStatus === "incomplete" && parsed.options["allow-incomplete"] !== true;
   if (confirmed.length || leads.length || incomplete) {
     throw new Error(`hosted security gate failed: ${confirmed.length} confirmed >= ${failOn}; ${leads.length} leads >= ${failOnCandidates ?? "disabled"}${incomplete ? "; coverage incomplete" : ""}`);
   }
@@ -12927,9 +12622,9 @@ async function securityCommand(parsed, dependencies) {
     assertArgs(parsed, ["config", "env", "platform", "email", "open", "json"], 3);
     const jobId = requiredSecurityPositional(parsed, 2, "job id");
     const context = await hostedSecurityContext(parsed, dependencies);
-    const report5 = await getHostedSecurityReport({ ...context, jobId });
-    if (parsed.options.json === true) context.stdout.log(JSON.stringify(report5, null, 2));
-    else printHostedReport(context.stdout, report5);
+    const report4 = await getHostedSecurityReport({ ...context, jobId });
+    if (parsed.options.json === true) context.stdout.log(JSON.stringify(report4, null, 2));
+    else printHostedReport(context.stdout, report4);
     return;
   }
   if (sub !== "run") {
@@ -12943,35 +12638,24 @@ async function githubSecurityCommand(parsed, dependencies) {
   const action2 = parsed.positionals[2];
   if (action2 === "disconnect") {
     assertArgs(parsed, ["config", "env", "platform", "source", "email", "open", "yes"], 3);
-    const context2 = await hostedSecurityContext(parsed, dependencies);
     const sourceId = requiredString(parsed.options.source, "--source");
-    const confirmed = parsed.options.yes === true || await interactiveConfirmation(
-      `Disconnect GitHub security source ${sourceId} from ${context2.appId}/${context2.env}?`,
-      dependencies
+    return requireStudioHuman(
+      stringOpt(parsed.options.config) ?? "odla.config.mjs",
+      `disconnecting GitHub security source ${sourceId}`,
+      "security",
+      stringOpt(parsed.options.env)
     );
-    if (!confirmed) {
-      throw new Error("GitHub source disconnect cancelled; pass --yes in a non-interactive shell");
-    }
-    await disconnectGitHubSecuritySource({ ...context2, sourceId });
-    context2.stdout.log(`github: disconnected ${sourceId} from ${context2.appId}/${context2.env}`);
-    return;
   }
   if (action2 !== "connect") {
     throw new Error('unknown security github command. Try "odla-ai security github connect".');
   }
   assertArgs(parsed, ["config", "env", "platform", "repo", "email", "open"], 3);
-  const context = await hostedSecurityContext(parsed, dependencies);
-  const repository = stringOpt(parsed.options.repo) ?? await inferGitHubRepository(process.cwd(), dependencies.readGitOrigin).catch(() => void 0);
-  const connection = await connectGitHubSecuritySource({
-    ...context,
-    ...repository === void 0 ? {} : { repository },
-    open: parsed.options.open !== false,
-    openInstallUrl: dependencies.openUrl ?? openUrl,
-    wait: dependencies.pollWait,
-    stdout: context.stdout
-  });
-  context.stdout.log(`github: connected ${connection.repository ?? repository ?? "app repository"} (${connection.sourceId ?? "source pending"})`);
-  context.stdout.log("github: odla.ai stores the installation; no PAT or GitHub token is written locally");
+  await requireStudioHuman(
+    stringOpt(parsed.options.config) ?? "odla.config.mjs",
+    "connecting the GitHub security repository",
+    "security",
+    stringOpt(parsed.options.env)
+  );
 }
 async function listSecuritySources(parsed, dependencies) {
   assertArgs(parsed, ["config", "env", "platform", "email", "open", "json"], 2);
@@ -13222,4 +12906,4 @@ export {
   exitCodeFor,
   runCli
 };
-//# sourceMappingURL=chunk-Y7WFLSTN.js.map
+//# sourceMappingURL=chunk-ECRBOR66.js.map