@odla-ai/cli 0.27.11 → 0.27.12

package/dist/index.cjs

@@ -1736,7 +1736,7 @@ async function agentCommand(parsed, deps = {}) {
   if (action2 !== "jobs" && action2 !== "retry") {
     throw new Error(`unknown agent action "${action2 ?? ""}". Try "odla-ai agent jobs --json".`);
   }
-  assertArgs(parsed, ["config", "env", "state", "limit", "json", "token", "email"], action2 === "jobs" ? 2 : 3);
+  assertArgs(parsed, ["config", "env", "state", "limit", "json", "token"], action2 === "jobs" ? 2 : 3);
   if (action2 === "retry" && (parsed.options.state !== void 0 || parsed.options.limit !== void 0)) {
     throw new Error('--state and --limit are supported only by "agent jobs"');
   }
@@ -1744,17 +1744,17 @@ async function agentCommand(parsed, deps = {}) {
   const { env, tenant } = resolveTenant(cfg, stringOpt(parsed.options.env));
   const doFetch = deps.fetch ?? fetch;
   const out = deps.stdout ?? console;
-  const credential2 = await getDeveloperToken(
-    cfg,
-    {
-      configPath: cfg.configPath,
-      token: stringOpt(parsed.options.token),
-      email: stringOpt(parsed.options.email),
-      open: false
-    },
-    doFetch,
-    out
-  );
+  const credential2 = stringOpt(parsed.options.token) ?? readCredentials(cfg.local.credentialsFile)?.envs[env]?.dbKey;
+  if (!credential2) {
+    throw new Error(
+      `no ${env} app credential found; run \`odla-ai provision --write-dev-vars --yes\` or pass --token <ODLA_API_KEY>`
+    );
+  }
+  if (credential2.startsWith("odla_dev_")) {
+    throw new Error(
+      "agent job administration requires an app credential (ODLA_API_KEY / odla_sk_\u2026), not a developer device token"
+    );
+  }
   const base = `${cfg.dbEndpoint}/app/${encodeURIComponent(tenant)}/admin/agent-jobs`;
   const headers = { authorization: `Bearer ${credential2}` };
   if (action2 === "retry") {
@@ -1810,51 +1810,23 @@ function errorMessage(body) {
   return "request failed";
 }
 
+// src/human-session.ts
+async function requireStudioHuman(configPath, action2, destination = "app", env) {
+  const cfg = await loadProjectConfig(configPath);
+  const appEnv = env && cfg.envs.includes(env) ? env : cfg.envs.includes("dev") ? "dev" : cfg.envs[0] ?? "prod";
+  const path = destination === "app" ? `/studio/apps/${encodeURIComponent(cfg.app.id)}/${encodeURIComponent(appEnv)}/settings/app` : `/studio/apps/${encodeURIComponent(cfg.app.id)}/${encodeURIComponent(appEnv)}/${destination}`;
+  throw new Error(
+    `human_session_required: ${action2} requires the signed-in owner in Studio. A CLI device token is an agent credential, so another approval or retry cannot work. ${new URL(path, cfg.platformUrl).href}`
+  );
+}
+
 // src/app-export.ts
-var import_node_fs7 = require("fs");
-var import_node_stream = require("stream");
-var import_promises = require("stream/promises");
 async function appExport(options) {
-  const cfg = await loadProjectConfig(options.configPath);
-  const out = options.stdout ?? console;
-  const doFetch = options.fetch ?? fetch;
-  const { tenant } = resolveTenant(cfg, options.env);
-  const token = await getDeveloperToken(
-    cfg,
-    { configPath: cfg.configPath, token: options.token, email: options.email, open: false },
-    doFetch,
-    out
-  );
-  const auth = { authorization: `Bearer ${token}` };
-  const base = `${cfg.dbEndpoint}/admin/apps/${encodeURIComponent(tenant)}`;
-  if (options.fresh) {
-    const res = await doFetch(`${base}/export`, { method: "POST", headers: auth });
-    const body = await res.json().catch(() => ({}));
-    if (!res.ok) throw new Error(`export failed${body.error?.code ? ` (${body.error.code})` : ""}: ${body.error?.message ?? res.status}`);
-  }
-  const list = await doFetch(`${base}/backups`, { headers: auth });
-  if (!list.ok) throw new Error(`couldn't list backups (${list.status})`);
-  const { backups } = await list.json();
-  const newest = backups[0];
-  if (!newest) {
-    throw new Error(
-      `${tenant} has no backups yet \u2014 run \`odla-ai app export --fresh\` to take one now (nightly snapshots appear after the first day with writes)`
-    );
-  }
-  const download = await doFetch(`${base}/backups/${newest.id}/download`, { headers: auth });
-  if (!download.ok || !download.body) throw new Error(`download failed (${download.status})`);
-  const file = options.out ?? `${tenant}-${new Date(newest.created_at).toISOString().slice(0, 10)}-tx${newest.max_tx}.jsonl.gz`;
-  await (0, import_promises.pipeline)(import_node_stream.Readable.fromWeb(download.body), (0, import_node_fs7.createWriteStream)(file));
-  if (options.json) out.log(JSON.stringify({ file, backup: newest }, null, 2));
-  else {
-    out.log(`${tenant}: wrote ${file} (${newest.bytes} bytes, ${newest.kind} snapshot at tx ${newest.max_tx})`);
-    out.log(`sha256 ${download.headers.get("x-odla-sha256") ?? newest.sha256}`);
-  }
-  return { file, backup: newest };
+  return requireStudioHuman(options.configPath, "database export", "database", options.env);
 }
 
 // src/app-import.ts
-var import_node_fs8 = require("fs");
+var import_node_fs7 = require("fs");
 var import_import = require("@odla-ai/db/import");
 function chooseIdMode(options, rows) {
   const chosen = [options.idField && "field", options.key && "key", options.generateIds && "generate"].filter(Boolean);
@@ -1871,9 +1843,8 @@ async function appImport(options) {
   const cfg = await loadProjectConfig(options.configPath);
   const out = options.stdout ?? console;
   const say = options.json ? (line) => out.error(line) : (line) => out.log(line);
-  const doFetch = options.fetch ?? fetch;
   const { tenant } = resolveTenant(cfg, options.env);
-  const text2 = options.file === "-" ? (options.readStdin ?? (() => (0, import_node_fs8.readFileSync)(0, "utf8")))() : (0, import_node_fs8.readFileSync)(options.file, "utf8");
+  const text2 = options.file === "-" ? (options.readStdin ?? (() => (0, import_node_fs7.readFileSync)(0, "utf8")))() : (0, import_node_fs7.readFileSync)(options.file, "utf8");
   const { format, sources } = (0, import_import.parseImport)(text2, options.ns);
   if (format === "namespace-map" && options.ns) {
     throw new Error("--ns cannot be combined with a {namespace: rows} file \u2014 the file already names each namespace");
@@ -1899,100 +1870,18 @@ ${detail}${more}`);
     if (options.json) out.log(JSON.stringify(result, null, 2));
     return result;
   }
-  const token = await getDeveloperToken(
-    cfg,
-    { configPath: cfg.configPath, token: options.token, email: options.email, open: false },
-    doFetch,
-    out
-  );
-  const runId = crypto.randomUUID();
-  const url = `${cfg.dbEndpoint}/admin/apps/${encodeURIComponent(tenant)}/transact`;
-  for (const chunk of chunks) {
-    const res = await doFetch(url, {
-      method: "POST",
-      headers: { authorization: `Bearer ${token}`, "content-type": "application/json" },
-      body: JSON.stringify({ mutationId: (0, import_import.importMutationId)(runId, chunk.index), ops: chunk.ops })
-    });
-    const body = await res.json().catch(() => ({}));
-    if (!res.ok) {
-      const code = body.error?.code ? ` (${body.error.code})` : "";
-      throw new Error(
-        `chunk ${chunk.index + 1} of ${chunks.length} failed${code}: ${body.error?.message ?? res.status}. ${result.committed} row(s) already committed; fix the input and re-run to import the rest.`
-      );
-    }
-    result.committed += chunk.ops.length;
-    if (typeof body.txId === "number") result.txIds.push(body.txId);
-    if (body.duplicate) result.duplicate++;
-  }
-  if (options.json) out.log(JSON.stringify(result, null, 2));
-  else {
-    const dup = result.duplicate > 0 ? ` (${result.duplicate} chunk(s) were already applied)` : "";
-    out.log(`${tenant}: upserted ${result.committed} row(s) in ${chunks.length} transaction(s)${dup}`);
-  }
-  return result;
+  return requireStudioHuman(options.configPath, "database import", "database", options.env);
 }
 
 // src/app-owners.ts
-var sink = (options) => options.stdout ?? console;
-async function ownersRequest(method, suffix, options, body) {
-  const cfg = await loadProjectConfig(options.configPath);
-  const doFetch = options.fetch ?? fetch;
-  const token = await getDeveloperToken(
-    cfg,
-    { configPath: cfg.configPath, token: options.token, email: options.email, open: false },
-    doFetch,
-    sink(options)
-  );
-  const res = await doFetch(`${cfg.platformUrl}/registry/apps/${encodeURIComponent(cfg.app.id)}/owners${suffix}`, {
-    method,
-    headers: { authorization: `Bearer ${token}`, "content-type": "application/json" },
-    body: body === void 0 ? void 0 : JSON.stringify(body)
-  });
-  const data = await res.json().catch(() => ({}));
-  if (!res.ok) {
-    throw new Error(
-      `owners ${method} failed${data.error?.code ? ` (${data.error.code})` : ""}: ` + (data.error?.message ?? `registry returned ${res.status}`)
-    );
-  }
-  return data.owners ?? [];
-}
-function report(options, owners, headline) {
-  const out = sink(options);
-  if (options.json === true) {
-    out.log(JSON.stringify(owners, null, 2));
-    return;
-  }
-  if (headline) out.log(headline);
-  out.log(`owners (${owners.length}):`);
-  for (const o of owners) {
-    const name = o.email?.trim() || "Unnamed member";
-    out.log(
-      `  ${o.primary ? "\u2605" : "\xB7"} ${name} [${o.ownerId}]${o.primary ? " (primary)" : ""}`
-    );
-  }
-}
 async function ownersList(options) {
-  report(options, await ownersRequest("GET", "", options));
+  await requireStudioHuman(options.configPath, "listing app owners", "app");
 }
 async function ownersAdd(email, options) {
-  const owners = await ownersRequest("POST", "", options, { email });
-  report(
-    options,
-    owners,
-    `added ${email} as a co-owner \u2014 they share full access. They can now run \`odla-ai provision\` to mint their own credentials (no secret sharing).`
-  );
+  await requireStudioHuman(options.configPath, `adding ${email} as an app owner`, "app");
 }
 async function ownersRemove(target, options) {
-  let ownerId = target;
-  if (target.includes("@")) {
-    const owners2 = await ownersRequest("GET", "", options);
-    const match = owners2.find((o) => o.email?.toLowerCase() === target.toLowerCase());
-    if (!match) throw new Error(`no co-owner with email ${target}`);
-    if (match.primary) throw new Error("can't remove the primary owner");
-    ownerId = match.ownerId;
-  }
-  const owners = await ownersRequest("DELETE", `/${encodeURIComponent(ownerId)}`, options);
-  report(options, owners, `removed ${target}`);
+  await requireStudioHuman(options.configPath, `removing ${target} as an app owner`, "app");
 }
 async function appOwnersCommand(parsed, dependencies = {}) {
   const sub = parsed.positionals[2] ?? "list";
@@ -2024,35 +1913,9 @@ async function appOwnersCommand(parsed, dependencies = {}) {
 
 // src/app-rename.ts
 async function appRename(name, options) {
-  const out = options.stdout ?? console;
   const trimmed = name.trim();
   if (!trimmed) throw new Error('"app rename" needs a name \u2014 try `odla-ai app rename "Acme Storefront"`.');
-  const cfg = await loadProjectConfig(options.configPath);
-  const doFetch = options.fetch ?? fetch;
-  const token = await getDeveloperToken(
-    cfg,
-    { configPath: cfg.configPath, token: options.token, email: options.email, open: false },
-    doFetch,
-    out
-  );
-  const res = await doFetch(`${cfg.platformUrl}/registry/apps/${encodeURIComponent(cfg.app.id)}/name`, {
-    method: "PUT",
-    headers: { authorization: `Bearer ${token}`, "content-type": "application/json" },
-    body: JSON.stringify({ name: trimmed })
-  });
-  const data = await res.json().catch(() => ({}));
-  if (!res.ok || !data.app) {
-    throw new Error(
-      `rename failed${data.error?.code ? ` (${data.error.code})` : ""}: ` + (data.error?.message ?? `registry returned ${res.status}`)
-    );
-  }
-  if (options.json === true) {
-    out.log(JSON.stringify(data.app, null, 2));
-    return;
-  }
-  out.log(`renamed ${data.app.appId} \u2192 "${data.app.name}"`);
-  out.log("The app id is unchanged, so credentials, tenants, and URLs keep working.");
-  out.log(`Update the "name" in ${cfg.configPath} to match.`);
+  await requireStudioHuman(options.configPath, `renaming the app to "${trimmed}"`, "app");
 }
 async function appRenameCommand(parsed, dependencies = {}) {
   assertArgs(parsed, ["config", "token", "email", "json"], parsed.positionals.length);
@@ -2068,172 +1931,23 @@ async function appRenameCommand(parsed, dependencies = {}) {
 }
 
 // src/app-transfer.ts
-function endpointsFor(verb, tenants) {
-  const up = { source: tenants.sandbox, target: tenants.live, from: "dev" };
-  const down = { source: tenants.live, target: tenants.sandbox, from: "prod" };
-  if (verb === "refresh-sandbox") return { ...down, mode: "refresh" };
-  return { ...up, mode: "cutover" };
-}
-async function api(cfg, token, path, init, doFetch) {
-  const res = await doFetch(`${cfg.dbEndpoint}${path}`, {
-    ...init,
-    headers: { authorization: `Bearer ${token}`, "content-type": "application/json", ...init?.headers }
-  });
-  return { status: res.status, body: await res.json().catch(() => ({})) };
-}
-function describe(side) {
-  if (!side.exists) return "not provisioned";
-  if (side.maxTx === 0) return "empty \u2014 never written";
-  const ns = side.namespaces.length === 1 ? "1 namespace" : `${side.namespaces.length} namespaces`;
-  const identity = side.identityRows > 0 ? `, ${side.identityRows} identity row(s)` : "";
-  return `${ns} \xB7 ${side.triples} value(s) \xB7 tx ${side.maxTx}${identity}`;
-}
-function printPlan(out, verb, pre, opts) {
-  const arrow = verb === "refresh-sandbox" ? "live \u2192 sandbox" : "sandbox \u2192 live";
-  out.log(`${verb} (${arrow})`);
-  out.log(`  from  ${pre.source.tenant}  ${describe(pre.source)}`);
-  out.log(`  to    ${pre.target.tenant}  ${describe(pre.target)}`);
-  if (verb === "promote") {
-    out.log("  moves schema, rules and gates only \u2014 no rows are copied or removed");
-  } else {
-    out.log(`  ${pre.target.tenant} is REPLACED by ${pre.source.tenant}`);
-    out.log(`  stays put: ${pre.staysPut.join(", ")}`);
-    const identity = opts.includeIdentity ? "INCLUDED (--include-identity)" : `left behind: ${pre.excluded.join(", ")}`;
-    out.log(`  identity: ${identity}`);
-    out.log(`  files: ${opts.includeFiles ? "copied (--include-files)" : "not copied"}`);
-  }
-  for (const blocker of pre.blockers) out.log(`  \u2716 ${blocker.code}: ${blocker.message}`);
-}
 async function appTransfer(options) {
   const cfg = await loadProjectConfig(options.configPath);
-  const out = options.stdout ?? console;
-  const say = options.json ? (line) => out.error(line) : (line) => out.log(line);
-  const doFetch = options.fetch ?? fetch;
-  const tenants = bothTenants(cfg);
-  const route2 = endpointsFor(options.verb, tenants);
-  const token = await getDeveloperToken(
-    cfg,
-    { configPath: cfg.configPath, token: options.token, email: options.email, open: false },
-    doFetch,
-    out
-  );
-  const pre = await api(
-    cfg,
-    token,
-    `/admin/apps/${encodeURIComponent(route2.target)}/copy-preflight?from=${route2.from}`,
-    void 0,
-    doFetch
-  );
-  if (pre.status !== 200) {
-    throw new Error(`pre-flight failed${pre.body.error?.code ? ` (${pre.body.error.code})` : ""}: ${pre.body.error?.message ?? pre.status}`);
-  }
-  const plan = pre.body;
-  printPlan({ log: say }, options.verb, plan, options);
-  if (options.verb === "go-live" && !plan.targetEmpty) {
-    throw new Error(
-      `${route2.target} already has data \u2014 go-live has already happened. Use \`odla-ai app promote --yes\` to push schema and rules, or \`odla-ai app refresh-sandbox --yes\` to pull live back down.`
-    );
-  }
-  if (plan.blockers.length > 0) throw new Error(`cannot ${options.verb}: ${plan.blockers.map((b) => b.message).join("; ")}`);
-  if (options.dryRun || options.yes !== true) {
-    say(`nothing written (${options.dryRun ? "--dry-run" : "no --yes"})`);
-    if (options.json) out.log(JSON.stringify(plan, null, 2));
-    return { ok: true, plan };
-  }
-  if (options.verb === "promote") {
-    const res2 = await api(
-      cfg,
-      token,
-      `/admin/apps/${encodeURIComponent(route2.target)}/promote-definitions`,
-      { method: "POST", body: JSON.stringify({ from: "dev" }) },
-      doFetch
-    );
-    if (res2.status !== 200) throw new Error(`promote failed${res2.body.error?.code ? ` (${res2.body.error.code})` : ""}: ${res2.body.error?.message ?? res2.status}`);
-    if (options.json) out.log(JSON.stringify(res2.body, null, 2));
-    else say(`${route2.target}: promoted ${(res2.body.applied ?? []).join(", ")}`);
-    return { ok: true, plan, result: res2.body };
-  }
-  const res = await api(
-    cfg,
-    token,
-    `/admin/apps/${encodeURIComponent(route2.target)}/copy-db`,
-    {
-      method: "POST",
-      body: JSON.stringify({
-        from: route2.from,
-        mode: route2.mode,
-        ...options.includeIdentity ? { includeUsers: true } : {},
-        ...options.includeFiles ? { includeFiles: true } : {}
-      })
-    },
-    doFetch
-  );
-  if (res.status !== 200) throw new Error(`${options.verb} failed${res.body.error?.code ? ` (${res.body.error.code})` : ""}: ${res.body.error?.message ?? res.status}`);
-  say(`${route2.target}: replaced from ${route2.source} (tx ${res.body.destination?.maxTx}, epoch ${res.body.destination?.epoch}) \u2014 connected clients resync automatically`);
-  if (options.includeFiles) await copyFiles(cfg, token, route2, doFetch, out);
-  if (options.json) out.log(JSON.stringify(res.body, null, 2));
-  return { ok: true, plan, result: res.body };
-}
-async function copyFiles(cfg, token, route2, doFetch, out) {
-  for (let attempt = 1; attempt <= 20; attempt++) {
-    const res = await api(
-      cfg,
-      token,
-      `/admin/apps/${encodeURIComponent(route2.target)}/copy-files`,
-      { method: "POST", body: JSON.stringify({ from: route2.from }) },
-      doFetch
-    );
-    if (res.status === 200) {
-      out.log(`${route2.target}: files copied`);
-      return;
-    }
-    if (!res.body.error?.retry) {
-      throw new Error(`file copy failed${res.body.error?.code ? ` (${res.body.error.code})` : ""}: ${res.body.error?.message ?? res.status}`);
-    }
-    out.log(`  files: bounded at attempt ${attempt}, resuming\u2026`);
-  }
-  throw new Error("file copy did not finish within 20 rounds \u2014 re-run to continue where it left off");
+  bothTenants(cfg);
+  return requireStudioHuman(options.configPath, `app ${options.verb}`, "database");
 }
 
 // src/app-lifecycle.ts
-async function lifecycleCall(action2, options) {
-  const cfg = await loadProjectConfig(options.configPath);
-  const out = options.stdout ?? console;
-  const doFetch = options.fetch ?? fetch;
-  const token = await getDeveloperToken(
-    cfg,
-    { configPath: cfg.configPath, token: options.token, email: options.email, open: false },
-    doFetch,
-    out
-  );
-  const res = await doFetch(`${cfg.platformUrl}/registry/apps/${encodeURIComponent(cfg.app.id)}/${action2}`, {
-    method: "POST",
-    headers: { authorization: `Bearer ${token}`, "content-type": "application/json" }
-  });
-  const body = await res.json().catch(() => ({}));
-  if (!res.ok || !body.ok) {
-    throw new Error(`${action2} failed${body.error?.code ? ` (${body.error.code})` : ""}: ${body.error?.message ?? `registry returned ${res.status}`}`);
-  }
-  return body;
-}
 async function appArchive(options) {
   if (options.yes !== true) {
     throw new Error(
       "app archive suspends EVERY environment: API keys stop working and all services refuse requests until restored. All data is retained. Pass --yes to proceed."
     );
   }
-  const out = options.stdout ?? console;
-  const body = await lifecycleCall("archive", options);
-  if (options.json) out.log(JSON.stringify(body, null, 2));
-  else if (body.operation?.state === "noop") out.log(`${body.app?.appId}: already archived`);
-  else out.log(`${body.app?.appId}: archived \u2014 data retained; run \`odla-ai app restore\` (or use Studio) to bring it back`);
+  await requireStudioHuman(options.configPath, "app archive", "app");
 }
 async function appRestore(options) {
-  const out = options.stdout ?? console;
-  const body = await lifecycleCall("restore", options);
-  if (options.json) out.log(JSON.stringify(body, null, 2));
-  else if (body.operation?.state === "noop") out.log(`${body.app?.appId}: already active`);
-  else out.log(`${body.app?.appId}: restored \u2014 every service's data plane is live again`);
+  await requireStudioHuman(options.configPath, "app restore", "app");
 }
 async function appCommand(parsed, dependencies = {}) {
   const sub = parsed.positionals[1];
@@ -2319,7 +2033,7 @@ async function appCommand(parsed, dependencies = {}) {
 }
 
 // src/brand-command.ts
-var import_promises2 = require("fs/promises");
+var import_promises = require("fs/promises");
 var import_node_path7 = require("path");
 
 // src/brand-design-unpack.ts
@@ -2422,7 +2136,7 @@ function describeUnpack(result, outDir) {
 // src/brand-command.ts
 var USAGE = "usage: odla-ai brand design unpack <bundle.html|-> [--out <dir>] [--json]";
 async function readBundle(source, deps) {
-  if (source !== "-") return (0, import_promises2.readFile)((0, import_node_path7.resolve)(source), "utf8");
+  if (source !== "-") return (0, import_promises.readFile)((0, import_node_path7.resolve)(source), "utf8");
   const readStdin = deps.readStdin;
   if (!readStdin) throw new Error("reading a bundle from stdin is not supported here");
   return readStdin();
@@ -2430,8 +2144,8 @@ async function readBundle(source, deps) {
 async function writeAll(result, outDir) {
   for (const file of result.files) {
     const target = (0, import_node_path7.resolve)(outDir, file.path);
-    await (0, import_promises2.mkdir)((0, import_node_path7.dirname)(target), { recursive: true });
-    await (0, import_promises2.writeFile)(target, file.bytes);
+    await (0, import_promises.mkdir)((0, import_node_path7.dirname)(target), { recursive: true });
+    await (0, import_promises.writeFile)(target, file.bytes);
   }
 }
 async function designUnpack(parsed, deps) {
@@ -2591,12 +2305,6 @@ async function pollCalendarConnection(ctx, attemptId) {
     ctx.env
   );
 }
-async function requestCalendarDisconnect(ctx) {
-  return parseCalendarStatus(
-    await calendarJson(ctx, "/disconnect", { method: "POST", body: JSON.stringify({ purge: false }) }),
-    ctx.env
-  );
-}
 function parseCalendarStatus(raw, env) {
   const outer = wrapped(raw, "calendar");
   const value2 = record(outer.attempt) ?? record(outer.status) ?? outer;
@@ -2780,10 +2488,7 @@ async function applyCalendarBookingPage(ctx, bookingPageUrl, out) {
 }
 async function calendarDisconnect(options) {
   if (!options.yes) throw new Error("calendar disconnect requires --yes");
-  const { ctx, out } = await lifecycleContext(options);
-  const status = await requestCalendarDisconnect(ctx);
-  out.log(`${ctx.env}: calendar disconnected; no calendar data was stored`);
-  return status;
+  return requireStudioHuman(options.configPath, "calendar disconnect", "calendar", options.env);
 }
 async function ensureCalendarConnected(ctx, options) {
   const out = options.stdout ?? console;
@@ -2997,9 +2702,9 @@ var import_apps6 = require("@odla-ai/apps");
 var import_node_path8 = require("path");
 
 // src/version.ts
-var import_node_fs9 = require("fs");
+var import_node_fs8 = require("fs");
 function cliVersion() {
-  const pkg = JSON.parse((0, import_node_fs9.readFileSync)(new URL("../package.json", importMetaUrl), "utf8"));
+  const pkg = JSON.parse((0, import_node_fs8.readFileSync)(new URL("../package.json", importMetaUrl), "utf8"));
   return pkg.version ?? "unknown";
 }
 
@@ -3015,7 +2720,7 @@ var ConfigOperationCommandError = class extends Error {
 
 // src/config-operation-validate.ts
 var import_apps3 = require("@odla-ai/apps");
-var import_node_fs10 = require("fs");
+var import_node_fs9 = require("fs");
 
 // src/config-reconcile-digest.ts
 var import_node_crypto2 = require("crypto");
@@ -3051,7 +2756,7 @@ var SERVICE = /^[a-z][a-z0-9-]{0,39}$/;
 function readPlan(path) {
   let value2;
   try {
-    const raw = (0, import_node_fs10.readFileSync)(path, "utf8");
+    const raw = (0, import_node_fs9.readFileSync)(path, "utf8");
     if (Buffer.byteLength(raw) > 128 * 1024) throw new Error("plan exceeds 128 KiB");
     value2 = JSON.parse(raw);
   } catch (error) {
@@ -3764,7 +3469,7 @@ async function configPlan(options) {
     apply,
     nextActions: planNextActions(reconciliation, options.configPath)
   };
-  printPlan2(document2, options);
+  printPlan(document2, options);
   return document2;
 }
 async function inspectConfig(options) {
@@ -3804,7 +3509,7 @@ function printDiff(document2, options) {
   printDifferences(out, document2);
   printNext(out, document2.nextActions);
 }
-function printPlan2(document2, options) {
+function printPlan(document2, options) {
   const out = options.stdout ?? console;
   if (options.json) {
     out.log(JSON.stringify(document2, null, 2));
@@ -3907,12 +3612,12 @@ function quoteArg2(value2) {
 
 // src/doctor-checks.ts
 var import_node_child_process3 = require("child_process");
-var import_node_fs12 = require("fs");
+var import_node_fs11 = require("fs");
 var import_node_path11 = require("path");
 
 // src/wrangler.ts
 var import_node_child_process2 = require("child_process");
-var import_node_fs11 = require("fs");
+var import_node_fs10 = require("fs");
 var import_node_path10 = require("path");
 var defaultRunner = (cmd, args, opts) => new Promise((resolvePromise, reject) => {
   const child = (0, import_node_child_process2.spawn)(cmd, args, { cwd: opts?.cwd, stdio: ["pipe", "pipe", "pipe"] });
@@ -3928,14 +3633,14 @@ var WRANGLER_CONFIG_FILES = ["wrangler.jsonc", "wrangler.json", "wrangler.toml"]
 function findWranglerConfig(rootDir) {
   for (const name of WRANGLER_CONFIG_FILES) {
     const path = (0, import_node_path10.join)(rootDir, name);
-    if ((0, import_node_fs11.existsSync)(path)) return path;
+    if ((0, import_node_fs10.existsSync)(path)) return path;
   }
   return null;
 }
 function readWranglerConfig(path) {
   if (path.endsWith(".toml")) return null;
   try {
-    return JSON.parse(stripJsonComments((0, import_node_fs11.readFileSync)(path, "utf8")));
+    return JSON.parse(stripJsonComments((0, import_node_fs10.readFileSync)(path, "utf8")));
   } catch {
     return null;
   }
@@ -4043,7 +3748,7 @@ function wranglerWarnings(rootDir) {
       const dir = (0, import_node_path11.resolve)(rootDir, assets.directory);
       if (dir === (0, import_node_path11.resolve)(rootDir)) {
         warnings.push(`${label}assets.directory is the project root \u2014 point it at a dedicated build dir (wrangler dev fails with "spawn EBADF")`);
-      } else if ((0, import_node_fs12.existsSync)((0, import_node_path11.join)(dir, "node_modules"))) {
+      } else if ((0, import_node_fs11.existsSync)((0, import_node_path11.join)(dir, "node_modules"))) {
         warnings.push(`${label}assets.directory contains node_modules \u2014 wrangler dev's watcher will exhaust file descriptors`);
       }
     }
@@ -4079,12 +3784,12 @@ function o11yProjectWarnings(rootDir) {
     return warnings;
   }
   const main = typeof config.main === "string" ? (0, import_node_path11.resolve)(rootDir, config.main) : null;
-  if (!main || !(0, import_node_fs12.existsSync)(main)) {
+  if (!main || !(0, import_node_fs11.existsSync)(main)) {
     warnings.push("cannot verify o11y Worker instrumentation \u2014 wrangler main is missing or unreadable");
   } else {
     let source = "";
     try {
-      source = (0, import_node_fs12.readFileSync)(main, "utf8");
+      source = (0, import_node_fs11.readFileSync)(main, "utf8");
     } catch {
     }
     if (!/\bwithObservability\b/.test(source)) {
@@ -4108,7 +3813,7 @@ function calendarProjectWarnings(rootDir) {
 }
 function readPackageJson(rootDir) {
   try {
-    return JSON.parse((0, import_node_fs12.readFileSync)((0, import_node_path11.join)(rootDir, "package.json"), "utf8"));
+    return JSON.parse((0, import_node_fs11.readFileSync)((0, import_node_path11.join)(rootDir, "package.json"), "utf8"));
   } catch {
     return null;
   }
@@ -4337,14 +4042,14 @@ function harnessOption(value2, flag) {
 }
 
 // src/init.ts
-var import_node_fs13 = require("fs");
+var import_node_fs12 = require("fs");
 var import_node_path12 = require("path");
 var import_apps9 = require("@odla-ai/apps");
 function initProject(options) {
   const out = options.stdout ?? console;
   const rootDir = (0, import_node_path12.resolve)(options.rootDir ?? process.cwd());
   const configPath = (0, import_node_path12.resolve)(rootDir, options.configPath ?? "odla.config.mjs");
-  if ((0, import_node_fs13.existsSync)(configPath) && !options.force) {
+  if ((0, import_node_fs12.existsSync)(configPath) && !options.force) {
     throw new Error(`${configPath} already exists. Pass --force to overwrite.`);
   }
   if (!/^[a-z0-9][a-z0-9-]*$/.test(options.appId)) {
@@ -4360,10 +4065,10 @@ function initProject(options) {
     }
   }
   const aiProvider = options.aiProvider;
-  (0, import_node_fs13.mkdirSync)((0, import_node_path12.dirname)(configPath), { recursive: true });
-  (0, import_node_fs13.mkdirSync)((0, import_node_path12.resolve)(rootDir, "src/odla"), { recursive: true });
-  (0, import_node_fs13.mkdirSync)((0, import_node_path12.resolve)(rootDir, ".odla"), { recursive: true });
-  (0, import_node_fs13.writeFileSync)(configPath, configTemplate({ appId: options.appId, name: options.name, envs, services, aiProvider }));
+  (0, import_node_fs12.mkdirSync)((0, import_node_path12.dirname)(configPath), { recursive: true });
+  (0, import_node_fs12.mkdirSync)((0, import_node_path12.resolve)(rootDir, "src/odla"), { recursive: true });
+  (0, import_node_fs12.mkdirSync)((0, import_node_path12.resolve)(rootDir, ".odla"), { recursive: true });
+  (0, import_node_fs12.writeFileSync)(configPath, configTemplate({ appId: options.appId, name: options.name, envs, services, aiProvider }));
   writeIfMissing((0, import_node_path12.resolve)(rootDir, "src/odla/schema.mjs"), schemaTemplate());
   writeIfMissing((0, import_node_path12.resolve)(rootDir, "src/odla/rules.mjs"), rulesTemplate());
   ensureGitignore(rootDir);
@@ -4372,8 +4077,8 @@ function initProject(options) {
   out.log("updated .gitignore for local odla credentials");
 }
 function writeIfMissing(path, text2) {
-  if ((0, import_node_fs13.existsSync)(path)) return;
-  (0, import_node_fs13.writeFileSync)(path, text2);
+  if ((0, import_node_fs12.existsSync)(path)) return;
+  (0, import_node_fs12.writeFileSync)(path, text2);
 }
 function configTemplate(input) {
   const calendar = input.services.includes("calendar") ? `  calendar: {
@@ -4580,7 +4285,9 @@ async function secretsSetClerkKey(options) {
   if (value2.startsWith("sk_live_") && !PROD_ENV_NAMES2.has(options.env) && !options.yes) {
     throw new Error(`refusing to store an sk_live_ Clerk key for "${options.env}" without --yes (live users would sync into a non-prod tenant)`);
   }
-  const token = await getDeveloperToken(cfg, options, doFetch, out);
+  const token = await getDeveloperToken(cfg, options, doFetch, out, {
+    optionalProjectCapabilities: ["app.manage"]
+  });
   const res = await doFetch(`${cfg.dbEndpoint}/admin/apps/${encodeURIComponent(tenantId)}/clerk-secret`, {
     method: "POST",
     headers: { authorization: `Bearer ${token}`, "content-type": "application/json" },
@@ -4610,7 +4317,7 @@ async function resolveVaultWrite(options) {
 }
 
 // src/skill.ts
-var import_node_fs14 = require("fs");
+var import_node_fs13 = require("fs");
 var import_node_os2 = require("os");
 var import_node_path13 = require("path");
 var import_node_url2 = require("url");
@@ -4707,7 +4414,7 @@ function installSkill(options = {}) {
     plans.set(target, { target, content: content2, boundary, managedMerge });
   };
   const planSkillTree = (targetDir2, boundary = root) => {
-    for (const rel of files) plan((0, import_node_path13.join)(targetDir2, rel), (0, import_node_fs14.readFileSync)((0, import_node_path13.join)(sourceDir, rel), "utf8"), false, boundary);
+    for (const rel of files) plan((0, import_node_path13.join)(targetDir2, rel), (0, import_node_fs13.readFileSync)((0, import_node_path13.join)(sourceDir, rel), "utf8"), false, boundary);
   };
   let targetDir;
   if (options.global) {
@@ -4727,7 +4434,7 @@ function installSkill(options = {}) {
     for (const harness of harnesses) rememberTarget(harness, sharedRoot);
     if (harnesses.includes("claude")) {
       for (const skill of skillNames(files)) {
-        const canonical = (0, import_node_fs14.readFileSync)((0, import_node_path13.join)(sourceDir, skill, "SKILL.md"), "utf8");
+        const canonical = (0, import_node_fs13.readFileSync)((0, import_node_path13.join)(sourceDir, skill, "SKILL.md"), "utf8");
         plan((0, import_node_path13.join)(claudeRoot, skill, "SKILL.md"), claudeAdapter(skill, canonical));
       }
       rememberTarget("claude", claudeRoot);
@@ -4762,11 +4469,11 @@ function installSkill(options = {}) {
       conflicts.push(`${file.target} (redirected by symbolic link ${symlink})`);
       continue;
     }
-    if (!(0, import_node_fs14.existsSync)(file.target)) {
+    if (!(0, import_node_fs13.existsSync)(file.target)) {
       writtenPaths.add(file.target);
       continue;
     }
-    const current = (0, import_node_fs14.readFileSync)(file.target, "utf8");
+    const current = (0, import_node_fs13.readFileSync)(file.target, "utf8");
     if (current === file.content) {
       unchangedPaths.add(file.target);
     } else if (file.managedMerge || options.force) {
@@ -4783,9 +4490,9 @@ ${conflicts.map((f) => `  - ${f}`).join("\n")}`
     );
   }
   for (const file of plans.values()) {
-    if (!(0, import_node_fs14.existsSync)(file.target) || (0, import_node_fs14.readFileSync)(file.target, "utf8") !== file.content) {
-      (0, import_node_fs14.mkdirSync)((0, import_node_path13.dirname)(file.target), { recursive: true });
-      (0, import_node_fs14.writeFileSync)(file.target, file.content);
+    if (!(0, import_node_fs13.existsSync)(file.target) || (0, import_node_fs13.readFileSync)(file.target, "utf8") !== file.content) {
+      (0, import_node_fs13.mkdirSync)((0, import_node_path13.dirname)(file.target), { recursive: true });
+      (0, import_node_fs13.writeFileSync)(file.target, file.content);
     }
   }
   const skills = skillNames(files);
@@ -4826,9 +4533,9 @@ function normalizeHarnesses(values, global) {
 function managedFileContent(path, block, force, boundary) {
   const symlink = symlinkedComponent(boundary, path);
   if (symlink) throw new Error(`refusing to manage ${path}: symbolic link component ${symlink}`);
-  if (!(0, import_node_fs14.existsSync)(path)) return `${block}
+  if (!(0, import_node_fs13.existsSync)(path)) return `${block}
 `;
-  const current = (0, import_node_fs14.readFileSync)(path, "utf8");
+  const current = (0, import_node_fs13.readFileSync)(path, "utf8");
   const start = "<!-- odla-ai agent setup:start -->";
   const end = "<!-- odla-ai agent setup:end -->";
   const startAt = current.indexOf(start);
@@ -4857,7 +4564,7 @@ function symlinkedComponent(boundary, target) {
   for (const part of rel.split(import_node_path13.sep).filter(Boolean)) {
     current = (0, import_node_path13.join)(current, part);
     try {
-      if ((0, import_node_fs14.lstatSync)(current).isSymbolicLink()) return current;
+      if ((0, import_node_fs13.lstatSync)(current).isSymbolicLink()) return current;
     } catch (error) {
       if (error.code !== "ENOENT") throw error;
     }
@@ -4868,10 +4575,10 @@ function skillNames(files) {
   return [...new Set(files.filter((file) => /(^|[\\/])SKILL\.md$/.test(file)).map((file) => file.split(/[\\/]/)[0]))].sort();
 }
 function listFiles(dir) {
-  if (!(0, import_node_fs14.existsSync)(dir)) return [];
+  if (!(0, import_node_fs13.existsSync)(dir)) return [];
   const results = [];
   const walk = (current) => {
-    for (const entry of (0, import_node_fs14.readdirSync)(current, { withFileTypes: true })) {
+    for (const entry of (0, import_node_fs13.readdirSync)(current, { withFileTypes: true })) {
       const path = (0, import_node_path13.join)(current, entry.name);
       if (entry.isDirectory()) walk(path);
       else results.push((0, import_node_path13.relative)(dir, path));
@@ -5188,7 +4895,7 @@ async function projectCommand(command, parsed, deps) {
 }
 
 // src/code-connect.ts
-var import_node_fs15 = require("fs");
+var import_node_fs14 = require("fs");
 var import_node_os4 = require("os");
 var import_node_path15 = require("path");
 
@@ -5276,15 +4983,15 @@ function encodeAgentInput(message2) {
 // ../harness/dist/chunk-PHXQH4YM.js
 var import_child_process = require("child_process");
 var import_fs = require("fs");
-var import_promises3 = require("fs/promises");
+var import_promises2 = require("fs/promises");
 var import_path = require("path");
 var import_process = require("process");
-var import_promises4 = require("fs/promises");
+var import_promises3 = require("fs/promises");
 var import_os = require("os");
 var import_path2 = require("path");
 var import_child_process2 = require("child_process");
 var import_path3 = require("path");
-var import_promises5 = require("fs/promises");
+var import_promises4 = require("fs/promises");
 var import_os2 = require("os");
 var import_path4 = require("path");
 var import_child_process3 = require("child_process");
@@ -5295,7 +5002,7 @@ function assertPinnedImage(image) {
 async function commandAvailable(engine) {
   for (const directory of (process.env.PATH ?? "").split(import_path.delimiter).filter(Boolean)) {
     try {
-      await (0, import_promises3.access)((0, import_path.join)(directory, engine), import_fs.constants.X_OK);
+      await (0, import_promises2.access)((0, import_path.join)(directory, engine), import_fs.constants.X_OK);
       return true;
     } catch {
     }
@@ -5581,7 +5288,7 @@ async function gitBlobs(cwd, entries, maxBytes) {
 }
 async function materializeGitTree(source, commitSha, options = {}) {
   if (!/^[0-9a-f]{40}$/.test(commitSha)) throw new TypeError("Git tree requires an exact commit SHA");
-  const sourceDir = await (0, import_promises4.realpath)((0, import_path2.resolve)(source));
+  const sourceDir = await (0, import_promises3.realpath)((0, import_path2.resolve)(source));
   const maxFiles = options.maxFiles ?? 2e4;
   const maxBytes = options.maxBytes ?? 512 * 1024 * 1024;
   const inventory = (await gitOutput(sourceDir, ["ls-tree", "-rz", commitSha], 16 * 1024 * 1024)).toString("utf8").split("\0").filter(Boolean);
@@ -5590,9 +5297,9 @@ async function materializeGitTree(source, commitSha, options = {}) {
     return match && allowedWorkspacePath(match[3]) ? [{ mode: match[1], hash: match[2], path: match[3] }] : [];
   });
   if (entries.length > maxFiles) throw new Error(`workspace exceeds ${maxFiles} files`);
-  const root = await (0, import_promises4.mkdtemp)((0, import_path2.join)(options.tempRoot ?? (0, import_os.tmpdir)(), "odla-git-tree-"));
+  const root = await (0, import_promises3.mkdtemp)((0, import_path2.join)(options.tempRoot ?? (0, import_os.tmpdir)(), "odla-git-tree-"));
   const targetRoot = (0, import_path2.join)(root, "source");
-  await (0, import_promises4.mkdir)(targetRoot);
+  await (0, import_promises3.mkdir)(targetRoot);
   let byteCount = 0;
   try {
     const blobs = await gitBlobs(sourceDir, entries, maxBytes);
@@ -5602,18 +5309,18 @@ async function materializeGitTree(source, commitSha, options = {}) {
       if (byteCount > maxBytes) throw new Error(`workspace exceeds ${maxBytes} bytes`);
       const target = (0, import_path2.resolve)(targetRoot, entry.path);
       if (!target.startsWith(`${(0, import_path2.resolve)(targetRoot)}${import_path2.sep}`)) throw new TypeError("Git tree path escapes workspace");
-      await (0, import_promises4.mkdir)((0, import_path2.resolve)(target, ".."), { recursive: true });
-      await (0, import_promises4.writeFile)(target, content2, { flag: "wx", mode: entry.mode === "100755" ? 493 : 420 });
+      await (0, import_promises3.mkdir)((0, import_path2.resolve)(target, ".."), { recursive: true });
+      await (0, import_promises3.writeFile)(target, content2, { flag: "wx", mode: entry.mode === "100755" ? 493 : 420 });
     }
     return {
       root,
       sourceDir: targetRoot,
       fileCount: entries.length,
       byteCount,
-      cleanup: () => (0, import_promises4.rm)(root, { recursive: true, force: true })
+      cleanup: () => (0, import_promises3.rm)(root, { recursive: true, force: true })
     };
   } catch (error) {
-    await (0, import_promises4.rm)(root, { recursive: true, force: true });
+    await (0, import_promises3.rm)(root, { recursive: true, force: true });
     throw error;
   }
 }
@@ -5621,7 +5328,7 @@ async function sourceFiles(sourceDir, maxFiles, maxBytes) {
   const files = [];
   let bytes = 0;
   const walk = async (dir) => {
-    for (const entry of await (0, import_promises5.readdir)(dir, { withFileTypes: true })) {
+    for (const entry of await (0, import_promises4.readdir)(dir, { withFileTypes: true })) {
       if (entry.isDirectory() && SKIP_WORKSPACE_DIRS.has(entry.name)) continue;
       if (!entry.isDirectory() && SECRET_WORKSPACE_FILE.test(entry.name)) continue;
       const path = (0, import_path4.join)(dir, entry.name);
@@ -5631,7 +5338,7 @@ async function sourceFiles(sourceDir, maxFiles, maxBytes) {
         continue;
       }
       if (!entry.isFile()) continue;
-      const metadata2 = await (0, import_promises5.stat)(path);
+      const metadata2 = await (0, import_promises4.stat)(path);
       bytes += metadata2.size;
       if (files.length + 1 > maxFiles) throw new Error(`workspace exceeds ${maxFiles} files`);
       if (bytes > maxBytes) throw new Error(`workspace exceeds ${maxBytes} bytes`);
@@ -5680,7 +5387,7 @@ async function gitSourceFiles(sourceDir, maxFiles, maxBytes) {
     if (!source.startsWith(`${root}${import_path4.sep}`)) throw new TypeError("git file path escapes workspace");
     let metadata2;
     try {
-      metadata2 = await (0, import_promises5.lstat)(source);
+      metadata2 = await (0, import_promises4.lstat)(source);
     } catch (error) {
       if (error.code === "ENOENT") continue;
       throw error;
@@ -5695,9 +5402,9 @@ async function gitSourceFiles(sourceDir, maxFiles, maxBytes) {
 async function copyTree(files, destination) {
   for (const file of files) {
     const target = (0, import_path4.join)(destination, file.relativePath);
-    await (0, import_promises5.mkdir)((0, import_path4.resolve)(target, ".."), { recursive: true });
-    await (0, import_promises5.copyFile)(file.source, target);
-    await (0, import_promises5.chmod)(target, file.mode);
+    await (0, import_promises4.mkdir)((0, import_path4.resolve)(target, ".."), { recursive: true });
+    await (0, import_promises4.copyFile)(file.source, target);
+    await (0, import_promises4.chmod)(target, file.mode);
   }
 }
 async function captureGitDiff(root, maxBytes) {
@@ -5734,13 +5441,13 @@ async function captureGitDiff(root, maxBytes) {
   return Buffer.concat(stdout).toString("utf8").replaceAll("a/baseline/", "a/").replaceAll("a/workspace/", "a/").replaceAll("b/baseline/", "b/").replaceAll("b/workspace/", "b/").replaceAll("--- a/baseline", "--- a").replaceAll("+++ b/workspace", "+++ b");
 }
 async function stageWorkspace(source, options = {}) {
-  const sourceDir = await (0, import_promises5.realpath)((0, import_path4.resolve)(source));
-  const sourceStat = await (0, import_promises5.stat)(sourceDir);
+  const sourceDir = await (0, import_promises4.realpath)((0, import_path4.resolve)(source));
+  const sourceStat = await (0, import_promises4.stat)(sourceDir);
   if (!sourceStat.isDirectory()) throw new TypeError("workspace source must be a directory");
-  const root = await (0, import_promises5.mkdtemp)((0, import_path4.join)(options.tempRoot ?? (0, import_os2.tmpdir)(), "odla-harness-"));
+  const root = await (0, import_promises4.mkdtemp)((0, import_path4.join)(options.tempRoot ?? (0, import_os2.tmpdir)(), "odla-harness-"));
   const baselineDir = (0, import_path4.join)(root, "baseline");
   const workspaceDir = (0, import_path4.join)(root, "workspace");
-  await Promise.all([(0, import_promises5.mkdir)(baselineDir), (0, import_promises5.mkdir)(workspaceDir)]);
+  await Promise.all([(0, import_promises4.mkdir)(baselineDir), (0, import_promises4.mkdir)(workspaceDir)]);
   try {
     const maxFiles = options.maxFiles ?? 2e4;
     const maxBytes = options.maxBytes ?? 512 * 1024 * 1024;
@@ -5753,26 +5460,26 @@ async function stageWorkspace(source, options = {}) {
       fileCount: files.length,
       byteCount: files.reduce((sum, file) => sum + file.bytes, 0),
       patch: (maxBytes2) => captureGitDiff(root, maxBytes2),
-      cleanup: () => (0, import_promises5.rm)(root, { recursive: true, force: true })
+      cleanup: () => (0, import_promises4.rm)(root, { recursive: true, force: true })
     };
   } catch (error) {
-    await (0, import_promises5.rm)(root, { recursive: true, force: true });
+    await (0, import_promises4.rm)(root, { recursive: true, force: true });
     throw error;
   }
 }
 async function stageWorkspacePair(baselineSource, workspaceSource, options = {}) {
-  const baselineDirSource = await (0, import_promises5.realpath)((0, import_path4.resolve)(baselineSource));
-  const workspaceDirSource = await (0, import_promises5.realpath)((0, import_path4.resolve)(workspaceSource));
+  const baselineDirSource = await (0, import_promises4.realpath)((0, import_path4.resolve)(baselineSource));
+  const workspaceDirSource = await (0, import_promises4.realpath)((0, import_path4.resolve)(workspaceSource));
   const maxFiles = options.maxFiles ?? 2e4;
   const maxBytes = options.maxBytes ?? 512 * 1024 * 1024;
   const [baselineFiles, workspaceFiles] = await Promise.all([
     sourceFiles(baselineDirSource, maxFiles, maxBytes),
     sourceFiles(workspaceDirSource, maxFiles, maxBytes)
   ]);
-  const root = await (0, import_promises5.mkdtemp)((0, import_path4.join)(options.tempRoot ?? (0, import_os2.tmpdir)(), "odla-harness-"));
+  const root = await (0, import_promises4.mkdtemp)((0, import_path4.join)(options.tempRoot ?? (0, import_os2.tmpdir)(), "odla-harness-"));
   const baselineDir = (0, import_path4.join)(root, "baseline");
   const workspaceDir = (0, import_path4.join)(root, "workspace");
-  await Promise.all([(0, import_promises5.mkdir)(baselineDir), (0, import_promises5.mkdir)(workspaceDir)]);
+  await Promise.all([(0, import_promises4.mkdir)(baselineDir), (0, import_promises4.mkdir)(workspaceDir)]);
   try {
     await Promise.all([copyTree(baselineFiles, baselineDir), copyTree(workspaceFiles, workspaceDir)]);
     return {
@@ -5782,17 +5489,17 @@ async function stageWorkspacePair(baselineSource, workspaceSource, options = {})
       fileCount: workspaceFiles.length,
       byteCount: workspaceFiles.reduce((sum, file) => sum + file.bytes, 0),
       patch: (maxPatchBytes) => captureGitDiff(root, maxPatchBytes),
-      cleanup: () => (0, import_promises5.rm)(root, { recursive: true, force: true })
+      cleanup: () => (0, import_promises4.rm)(root, { recursive: true, force: true })
     };
   } catch (error) {
-    await (0, import_promises5.rm)(root, { recursive: true, force: true });
+    await (0, import_promises4.rm)(root, { recursive: true, force: true });
     throw error;
   }
 }
 
 // ../harness/dist/chunk-GMVZ4LZH.js
 var import_crypto = require("crypto");
-var import_promises6 = require("fs/promises");
+var import_promises5 = require("fs/promises");
 var import_path5 = require("path");
 
 // ../camel/dist/chunk-7FHPOQVP.js
@@ -6129,19 +5836,19 @@ function validateSnapshot(snapshot, limits) {
 
 // ../harness/dist/chunk-GMVZ4LZH.js
 var import_child_process4 = require("child_process");
-var import_promises7 = require("fs/promises");
+var import_promises6 = require("fs/promises");
 var import_path6 = require("path");
 var import_child_process5 = require("child_process");
 var import_process2 = require("process");
 var import_crypto2 = require("crypto");
 var import_crypto3 = require("crypto");
 var import_fs2 = require("fs");
-var import_promises8 = require("fs/promises");
+var import_promises7 = require("fs/promises");
 var import_path7 = require("path");
-var import_promises9 = require("fs/promises");
+var import_promises8 = require("fs/promises");
 var import_os3 = require("os");
 var import_path8 = require("path");
-var import_promises10 = require("fs/promises");
+var import_promises9 = require("fs/promises");
 var import_path9 = require("path");
 
 // ../camel/dist/chunk-4EIRFS3A.js
@@ -6433,7 +6140,7 @@ var import_crypto4 = require("crypto");
 async function digestStagedWorkspace(root, limits) {
   const files = [];
   const walk = async (directory) => {
-    const entries = await (0, import_promises6.readdir)(directory, { withFileTypes: true });
+    const entries = await (0, import_promises5.readdir)(directory, { withFileTypes: true });
     for (const entry of entries.sort((left, right) => left.name.localeCompare(right.name))) {
       if (entry.isSymbolicLink()) throw new TypeError("workspace digest refuses symbolic links");
       const target = (0, import_path5.resolve)(directory, entry.name);
@@ -6448,7 +6155,7 @@ async function digestStagedWorkspace(root, limits) {
   const hash = (0, import_crypto.createHash)("sha256");
   let bytes = 0;
   for (const file of files.sort((left, right) => left.path.localeCompare(right.path))) {
-    const content2 = await (0, import_promises6.readFile)(file.target);
+    const content2 = await (0, import_promises5.readFile)(file.target);
     bytes += Buffer.byteLength(file.path) + content2.byteLength;
     if (bytes > limits.maxBytes) throw new TypeError("workspace digest exceeds its byte bound");
     hash.update(`${Buffer.byteLength(file.path)}:${file.path}:${content2.byteLength}:`);
@@ -6774,7 +6481,7 @@ async function applyCodePatch(workspaceDir, patch2, paths) {
   await gitApply(workspaceDir, patch2, false);
   for (const path of paths) {
     try {
-      const info = await (0, import_promises7.lstat)(resolveCodePath(workspaceDir, path));
+      const info = await (0, import_promises6.lstat)(resolveCodePath(workspaceDir, path));
       if (info.isSymbolicLink() || !info.isFile() && !info.isDirectory()) {
         throw new TypeError("patch created a non-regular workspace entry");
       }
@@ -7065,7 +6772,7 @@ async function inspectArtifacts(workspaceDir, recipe2) {
   for (const artifact of recipe2.expectedArtifacts ?? []) {
     try {
       const path = (0, import_path7.join)(workspaceDir, artifact.path);
-      const info = await (0, import_promises8.lstat)(path);
+      const info = await (0, import_promises7.lstat)(path);
       if (!info.isFile() || info.isSymbolicLink()) {
         receipts.push({ artifactId: artifact.id, status: "invalid", bytes: null, digest: null });
       } else if (info.size > artifact.maximumBytes) {
@@ -7246,9 +6953,9 @@ var RESERVED2 = /* @__PURE__ */ new Set([".git", ".odla", ".wrangler", "node_mod
 var SECRET2 = /^(?:\.env(?:\..+)?|\.dev\.vars|credentials(?:\..+)?\.json|dev-token(?:\..+)?\.json)$/i;
 async function materializeCodeRuntimeSource(snapshot, tempRoot = (0, import_os3.tmpdir)()) {
   if (!snapshot.files.length || snapshot.files.length > 1e4) throw new TypeError("Code source file count is invalid");
-  const root = await (0, import_promises9.mkdtemp)((0, import_path8.join)(tempRoot, "odla-code-source-"));
+  const root = await (0, import_promises8.mkdtemp)((0, import_path8.join)(tempRoot, "odla-code-source-"));
   const sourceDir = (0, import_path8.join)(root, "source");
-  await (0, import_promises9.mkdir)(sourceDir);
+  await (0, import_promises8.mkdir)(sourceDir);
   const seen = /* @__PURE__ */ new Set();
   let bytes = 0;
   try {
@@ -7260,8 +6967,8 @@ async function materializeCodeRuntimeSource(snapshot, tempRoot = (0, import_os3.
       if (bytes > 16 * 1024 * 1024) throw new TypeError("Code source exceeds its byte bound");
       const target = (0, import_path8.resolve)(sourceDir, file.path);
       if (!target.startsWith(`${(0, import_path8.resolve)(sourceDir)}${import_path8.sep}`)) throw new TypeError("Code source path escapes its root");
-      await (0, import_promises9.mkdir)((0, import_path8.dirname)(target), { recursive: true });
-      await (0, import_promises9.writeFile)(target, file.content, { flag: "wx", mode: 420 });
+      await (0, import_promises8.mkdir)((0, import_path8.dirname)(target), { recursive: true });
+      await (0, import_promises8.writeFile)(target, file.content, { flag: "wx", mode: 420 });
     }
     for (const reference of snapshot.references ?? []) {
       validateAlias(reference.alias);
@@ -7275,13 +6982,13 @@ async function materializeCodeRuntimeSource(snapshot, tempRoot = (0, import_os3.
         if (bytes > 80 * 1024 * 1024) throw new TypeError("Code source set exceeds its byte bound");
         const target = (0, import_path8.resolve)(sourceDir, path);
         if (!target.startsWith(`${(0, import_path8.resolve)(sourceDir)}${import_path8.sep}`)) throw new TypeError("Code reference path escapes its root");
-        await (0, import_promises9.mkdir)((0, import_path8.dirname)(target), { recursive: true });
-        await (0, import_promises9.writeFile)(target, file.content, { flag: "wx", mode: 292 });
+        await (0, import_promises8.mkdir)((0, import_path8.dirname)(target), { recursive: true });
+        await (0, import_promises8.writeFile)(target, file.content, { flag: "wx", mode: 292 });
       }
     }
-    return { sourceDir, cleanup: () => (0, import_promises9.rm)(root, { recursive: true, force: true }) };
+    return { sourceDir, cleanup: () => (0, import_promises8.rm)(root, { recursive: true, force: true }) };
   } catch (cause) {
-    await (0, import_promises9.rm)(root, { recursive: true, force: true });
+    await (0, import_promises8.rm)(root, { recursive: true, force: true });
     throw cause;
   }
 }
@@ -7302,8 +7009,8 @@ async function attachCodeRuntimeReferences(workspace, references) {
       for (const root of [workspace.baselineDir, workspace.workspaceDir]) {
         const target = (0, import_path8.resolve)(root, path);
         if (!target.startsWith(`${(0, import_path8.resolve)(root)}${import_path8.sep}`)) throw new TypeError("Code reference path escapes its root");
-        await (0, import_promises9.mkdir)((0, import_path8.dirname)(target), { recursive: true });
-        await (0, import_promises9.writeFile)(target, file.content, { flag: "wx", mode: 292 });
+        await (0, import_promises8.mkdir)((0, import_path8.dirname)(target), { recursive: true });
+        await (0, import_promises8.writeFile)(target, file.content, { flag: "wx", mode: 292 });
       }
     }
   }
@@ -7489,11 +7196,11 @@ async function read(context, request2, options, policy) {
   const allowed = await policy.read(policyContext(context, request2, options, { paths, path, startLine, endLine }));
   if (!allowed) return response(request2, false, "tool denied by CaMeL policy");
   const target = resolveCodePath(context.workspaceDir, path);
-  const info = await (0, import_promises10.stat)(target);
+  const info = await (0, import_promises9.stat)(target);
   if (!info.isFile() || info.size > Math.max(options.maxReadBytes ?? 128 * 1024, 2 * 1024 * 1024)) {
     throw new TypeError("file is not a bounded regular source file");
   }
-  const source = await (0, import_promises10.readFile)(target);
+  const source = await (0, import_promises9.readFile)(target);
   if (source.includes(0)) throw new TypeError("binary files are not readable through this tool");
   const lines = source.toString("utf8").split("\n");
   const content2 = lines.slice(startLine - 1, endLine).join("\n");
@@ -7570,7 +7277,7 @@ function policyContext(context, request2, options, extra) {
 async function registeredFiles(root, limit) {
   const paths = [];
   const walk = async (directory) => {
-    for (const entry of await (0, import_promises10.readdir)(directory, { withFileTypes: true })) {
+    for (const entry of await (0, import_promises9.readdir)(directory, { withFileTypes: true })) {
       if (entry.isSymbolicLink()) throw new TypeError("workspace contains a symbolic link");
       const target = (0, import_path9.resolve)(directory, entry.name);
       if (entry.isDirectory()) await walk(target);
@@ -8355,7 +8062,7 @@ function digestText(value2) {
 // src/code-images.ts
 var import_node_child_process6 = require("child_process");
 var import_node_crypto4 = require("crypto");
-var import_promises11 = require("fs/promises");
+var import_promises10 = require("fs/promises");
 var import_node_os3 = require("os");
 var import_node_path14 = require("path");
 var import_node_url3 = require("url");
@@ -8437,16 +8144,16 @@ function embeddedPiAssetPath() {
   return (0, import_node_url3.fileURLToPath)(new URL("./runtime/pi-agent.js", importMetaUrl));
 }
 async function embeddedPiImageName() {
-  const bundle = await (0, import_promises11.readFile)(embeddedPiAssetPath()).catch(() => {
+  const bundle = await (0, import_promises10.readFile)(embeddedPiAssetPath()).catch(() => {
     throw new Error("CLI-embedded Pi runtime is missing; reinstall this exact @odla-ai/cli version");
   });
   return `odla-ai/pi-agent:embedded-sha256-${(0, import_node_crypto4.createHash)("sha256").update(bundle).digest("hex")}`;
 }
 async function buildEmbeddedPiImage(engine, image, run) {
-  const context = await (0, import_promises11.mkdtemp)((0, import_node_path14.join)((0, import_node_os3.tmpdir)(), "odla-code-pi-"));
+  const context = await (0, import_promises10.mkdtemp)((0, import_node_path14.join)((0, import_node_os3.tmpdir)(), "odla-code-pi-"));
   try {
-    await (0, import_promises11.copyFile)(embeddedPiAssetPath(), (0, import_node_path14.join)(context, "pi-agent.js"));
-    await (0, import_promises11.writeFile)((0, import_node_path14.join)(context, "Dockerfile"), [
+    await (0, import_promises10.copyFile)(embeddedPiAssetPath(), (0, import_node_path14.join)(context, "pi-agent.js"));
+    await (0, import_promises10.writeFile)((0, import_node_path14.join)(context, "Dockerfile"), [
       `FROM ${CODE_NODE_IMAGE}`,
       "COPY pi-agent.js /opt/odla/pi-agent.js",
       "WORKDIR /workspace",
@@ -8455,7 +8162,7 @@ async function buildEmbeddedPiImage(engine, image, run) {
     ].join("\n"), { mode: 384 });
     await run(engine, ["build", "--tag", image, context], "inherit");
   } finally {
-    await (0, import_promises11.rm)(context, { recursive: true, force: true });
+    await (0, import_promises10.rm)(context, { recursive: true, force: true });
   }
 }
 
@@ -8463,7 +8170,7 @@ async function buildEmbeddedPiImage(engine, image, run) {
 async function codeConnect(options) {
   const cwd = options.cwd ?? process.cwd();
   const configPath = (0, import_node_path15.resolve)(cwd, options.configPath);
-  const cfg = (0, import_node_fs15.existsSync)(configPath) ? await loadProjectConfig(configPath) : null;
+  const cfg = (0, import_node_fs14.existsSync)(configPath) ? await loadProjectConfig(configPath) : null;
   const requestedAppId = options.appId?.trim();
   if (requestedAppId && !/^[a-z0-9][a-z0-9-]{1,62}$/.test(requestedAppId)) {
     throw new Error("--app-id must be a valid odla app id");
@@ -8854,18 +8561,17 @@ Usage:
   odla-ai calendar status [--env dev] [--email <odla-account>] [--json]
   odla-ai calendar calendars [--env dev] [--email <odla-account>] [--json]
   odla-ai calendar connect [--env dev] [--email <odla-account>] [--no-open] [--yes]
-  odla-ai calendar disconnect [--env dev] [--email <odla-account>] --yes
-  odla-ai app archive [--config odla.config.mjs] [--email <odla-account>] [--json] --yes
-  odla-ai app restore [--config odla.config.mjs] [--email <odla-account>] [--json]
-  odla-ai app export [--env dev] [--fresh] [--out <file>] [--email <odla-account>] [--json]
+  odla-ai calendar disconnect [--env dev] --yes                         [continue in Studio; human session required]
+  odla-ai app archive [--config odla.config.mjs] --yes                  [continue in Studio; human session required]
+  odla-ai app restore [--config odla.config.mjs]                        [continue in Studio; human session required]
+  odla-ai app export [--env dev]                                        [continue in Studio; human session required]
   odla-ai app import <file|-> [--env dev] [--ns <namespace>] [--id-field <f>|--key <attr>|--generate-ids] [--dry-run] [--json] --yes
-  odla-ai app refresh-sandbox [--include-identity] [--include-files] [--dry-run] [--json] --yes
-  odla-ai app go-live         [--include-identity] [--include-files] [--dry-run] [--json] --yes
-  odla-ai app promote         [--dry-run] [--json] --yes
-  odla-ai app rename <name> [--config odla.config.mjs] [--email <odla-account>] [--json]
-  odla-ai app owners list [--config odla.config.mjs] [--email <odla-account>] [--json]
-  odla-ai app owners add <email> [--email <odla-account>] [--json]
-  odla-ai app owners remove <email> [--email <odla-account>] [--json]
+                                                                         [dry-run is local; writes continue in Studio]
+  odla-ai app refresh-sandbox                                          [continue in Studio; human session required]
+  odla-ai app go-live                                                  [continue in Studio; human session required]
+  odla-ai app promote                                                  [continue in Studio; human session required]
+  odla-ai app rename <name>                                            [continue in Studio; human session required]
+  odla-ai app owners <list|add|remove> [...]                            [continue in Studio; human session required]
   odla-ai brand design unpack <bundle.html|-> [--out <dir>] [--json]
   odla-ai pm goal list [--app <id>] [--status <s>] [--q <text>] [--limit <n>] [--offset <n>] [--json]
   odla-ai pm task list [--app <id>] [--column <backlog|ready|doing|review|done>] [--goal <id>] [--assignee <id>] [--q <text>] [--limit <n>] [--offset <n>] [--json]
@@ -8900,8 +8606,8 @@ Usage:
   odla-ai discuss resolve <topic> [--reopen] [--mutation-id <id>]
   odla-ai discuss who --q <text> [--app <id>] [--kinds user,pm:task] [--json]
   odla-ai discuss watch [<topic>] [--cursor <cursor>] [--by <authorId>] [--self <authorId>] [--interval <s>] [--timeout <s>] [--json|--jsonl]
-  odla-ai agent jobs [--env dev] [--state pending|running|succeeded|dead_letter] [--limit 50] [--email <email>] [--json]
-  odla-ai agent retry <job-id> [--env dev] [--email <email>] [--json]
+  odla-ai agent jobs [--env dev] [--state pending|running|succeeded|dead_letter] [--limit 50] [--token <ODLA_API_KEY>] [--json]
+  odla-ai agent retry <job-id> [--env dev] [--token <ODLA_API_KEY>] [--json]
   odla-ai context show [--context <name>] [--platform https://odla.ai] [--app <id>] [--env prod] [--json]
   odla-ai context list [--json]
   odla-ai context save <name> [--platform <url>] [--app <id>] [--env <name>] [--json]
@@ -8937,8 +8643,8 @@ Usage:
   odla-ai admin ai credential set <provider> [--context <name>] (--from-env <NAME>|--stdin)
   odla-ai admin ai usage [--context <name>] [--app-id <id>] [--env <env>] [--run-id <id>] [--limit <1-500>] [--json]
   odla-ai admin ai audit [--context <name>] [--limit <1-200>] [--json]
-  odla-ai security github connect [--repo owner/name] [--env dev] [--email <odla-account>] [--no-open]
-  odla-ai security github disconnect --source <id> [--env dev] [--yes]
+  odla-ai security github connect [--repo owner/name] [--env dev]             [continue in Studio; human session required]
+  odla-ai security github disconnect --source <id> [--env dev]          [continue in Studio; human session required]
   odla-ai security plan [--env dev] [--json]
   odla-ai security sources [--env dev] [--json]
   odla-ai security run --source <id> --plan-digest <sha256:...> --ack-redacted-source [--ref <branch|tag|sha>] [--env dev] [--no-follow]
@@ -9449,7 +9155,7 @@ async function discussWatch(ctx, topicId, parsed) {
         throw new WatchRemoteError(cursor, error);
       }
       if (deadline !== void 0 && now() >= deadline) {
-        const result = report2(ctx, parsed, { found: false, cursor: cursor ?? "" });
+        const result = report(ctx, parsed, { found: false, cursor: cursor ?? "" });
         throw new WatchTimeoutError(result.cursor);
       }
       const base = Math.min(intervalMs, 1e3);
@@ -9490,7 +9196,7 @@ async function discussWatch(ctx, topicId, parsed) {
       });
       const posts = topicId ? matching.filter((event) => event.type === "message").map((event) => event.payload) : void 0;
       const topics = topicId ? void 0 : matching.filter((event) => event.type === "activity").map((event) => event.payload);
-      return report2(ctx, parsed, {
+      return report(ctx, parsed, {
         found: true,
         cursor,
         events: matching,
@@ -9517,13 +9223,13 @@ async function discussWatch(ctx, topicId, parsed) {
     }
     if (page2.hasMore) continue;
     if (deadline !== void 0 && now() >= deadline) {
-      return report2(ctx, parsed, { found: false, cursor });
+      return report(ctx, parsed, { found: false, cursor });
     }
     const wait2 = deadline === void 0 ? intervalMs : Math.min(intervalMs, Math.max(0, deadline - now()));
     await sleep(wait2);
   }
 }
-function report2(ctx, parsed, result) {
+function report(ctx, parsed, result) {
   if (ctx.json) {
     ctx.out.log(JSON.stringify(result, null, 2));
   } else if (parsed.options.jsonl !== true && result.found) {
@@ -10024,7 +9730,7 @@ function eventLabel(event) {
   const body = event.payload.message?.body?.replace(/\s+/g, " ").trim();
   return body || event.payload.entityId;
 }
-function report3(ctx, parsed, result) {
+function report2(ctx, parsed, result) {
   if (ctx.json) ctx.out.log(JSON.stringify(result, null, 2));
   else if (parsed.options.jsonl !== true && result.found) {
     for (const event of result.events ?? []) {
@@ -10084,7 +9790,7 @@ async function pmWatch(ctx, parsed) {
       });
       if (consecutiveFailures >= MAX_CONSECUTIVE_FAILURES2) throw error;
       if (deadline !== void 0 && now() >= deadline) {
-        return report3(ctx, parsed, { found: false, cursor: cursor ?? "" });
+        return report2(ctx, parsed, { found: false, cursor: cursor ?? "" });
       }
       const backoff = Math.min(
         MAX_BACKOFF_MS2,
@@ -10125,7 +9831,7 @@ async function pmWatch(ctx, parsed) {
         cursor,
         serverTime: current.serverTime
       });
-      return report3(ctx, parsed, { found: true, cursor, events: matching });
+      return report2(ctx, parsed, { found: true, cursor, events: matching });
     }
     if (current.events.length > 0) {
       jsonl2(ctx, parsed, {
@@ -10144,7 +9850,7 @@ async function pmWatch(ctx, parsed) {
     }
     if (current.hasMore) continue;
     if (deadline !== void 0 && now() >= deadline) {
-      return report3(ctx, parsed, { found: false, cursor });
+      return report2(ctx, parsed, { found: false, cursor });
     }
     await sleep(
       deadline === void 0 ? intervalMs : Math.min(intervalMs, Math.max(0, deadline - now()))
@@ -11177,7 +10883,7 @@ ${env}: credentials are already saved; retry "odla-ai secrets push --env ${env}$
 }
 
 // src/record.ts
-var import_node_fs16 = require("fs");
+var import_node_fs15 = require("fs");
 var import_node_process12 = __toESM(require("process"), 1);
 
 // src/surface.ts
@@ -11357,14 +11063,14 @@ function recordInvocation(parsed) {
       options: Object.entries(parsed.options).map(([name, value2]) => value2 === false ? `no-${name}` : name).sort()
     };
     if (!entry.path.length) return;
-    (0, import_node_fs16.appendFileSync)(file, `${JSON.stringify(entry)}
+    (0, import_node_fs15.appendFileSync)(file, `${JSON.stringify(entry)}
 `);
   } catch {
   }
 }
 
 // src/runbook-actions.ts
-var import_node_fs17 = require("fs");
+var import_node_fs16 = require("fs");
 
 // src/runbook-requires.ts
 var SPEC = /^(@?[\w./-]+?)@(\d+\.\d+\.\d+(?:[\w.-]*)?)$/;
@@ -11449,7 +11155,7 @@ async function bySlug(ctx, slug) {
 function readBody(file, inline) {
   if (inline !== void 0) return inline;
   if (file === void 0) throw new Error("supply the new text with --file <path>, --file - (stdin), or --body");
-  return (0, import_node_fs17.readFileSync)(file === "-" ? 0 : file, "utf8");
+  return (0, import_node_fs16.readFileSync)(file === "-" ? 0 : file, "utf8");
 }
 var stamp = (ms) => ms ? new Date(ms).toISOString().slice(0, 16).replace("T", " ") : "";
 async function runbookList(ctx, all, query) {
@@ -11541,7 +11247,7 @@ async function runbookRemove(ctx, slug) {
 }
 
 // src/runbook-import.ts
-var import_node_fs18 = require("fs");
+var import_node_fs17 = require("fs");
 var import_node_path16 = require("path");
 function parseRunbook(text2, slug) {
   let rest = text2;
@@ -11567,12 +11273,12 @@ function parseRunbook(text2, slug) {
   };
 }
 function readRunbookDir(dir) {
-  if (!(0, import_node_fs18.statSync)(dir, { throwIfNoEntry: false })?.isDirectory()) throw new Error(`not a directory: ${dir}`);
-  const files = (0, import_node_fs18.readdirSync)(dir).filter((f) => f.endsWith(".md")).sort();
+  if (!(0, import_node_fs17.statSync)(dir, { throwIfNoEntry: false })?.isDirectory()) throw new Error(`not a directory: ${dir}`);
+  const files = (0, import_node_fs17.readdirSync)(dir).filter((f) => f.endsWith(".md")).sort();
   if (!files.length) throw new Error(`no .md files in ${dir}`);
   return files.map((file) => {
     const slug = (0, import_node_path16.basename)(file, ".md");
-    const parsed = parseRunbook((0, import_node_fs18.readFileSync)((0, import_node_path16.join)(dir, file), "utf8"), slug);
+    const parsed = parseRunbook((0, import_node_fs17.readFileSync)((0, import_node_path16.join)(dir, file), "utf8"), slug);
     return { file, slug, ...parsed, words: parsed.body.split(/\s+/).filter(Boolean).length };
   });
 }
@@ -11645,7 +11351,7 @@ async function upsert(ctx, r, visibility) {
 
 // src/runbook-impact.ts
 var import_node_child_process7 = require("child_process");
-var import_node_fs19 = require("fs");
+var import_node_fs18 = require("fs");
 var import_node_path17 = require("path");
 
 // src/runbook-impact-scan.ts
@@ -11816,9 +11522,9 @@ ${body.split("\n").map((line) => `+${line}`).join("\n")}
 function manifestLabeller(root) {
   return (workspace) => {
     const manifest = (0, import_node_path17.join)(root, workspace, "package.json");
-    if (!(0, import_node_fs19.existsSync)(manifest)) return void 0;
+    if (!(0, import_node_fs18.existsSync)(manifest)) return void 0;
     try {
-      const name = JSON.parse((0, import_node_fs19.readFileSync)(manifest, "utf8")).name;
+      const name = JSON.parse((0, import_node_fs18.readFileSync)(manifest, "utf8")).name;
       return typeof name === "string" ? name : void 0;
     } catch {
       return void 0;
@@ -11856,7 +11562,7 @@ async function assessImpact(ctx, surfaces, all, limit) {
   return out;
 }
 var editHint = (slug, appId) => `odla-ai runbook edit ${slug}${appId === PLATFORM_SCOPE ? "" : ` --app ${appId}`} --note "<what changed>"`;
-function report4(ctx, impacts) {
+function report3(ctx, impacts) {
   const covered = impacts.filter((i) => i.runbooks.length);
   ctx.out.log(
     `${impacts.length} changed surface${impacts.length === 1 ? "" : "s"}; ${covered.length} covered by a runbook. Reread each one and fix any step this change made wrong.`
@@ -11885,7 +11591,7 @@ function report4(ctx, impacts) {
 async function runbookImpact(ctx, options, deps = {}) {
   const cwd = deps.cwd ?? process.cwd();
   const runGit = deps.runGit ?? gitRunner(cwd);
-  const read3 = deps.readRepoFile ?? ((path) => (0, import_node_fs19.readFileSync)((0, import_node_path17.join)(cwd, path), "utf8"));
+  const read3 = deps.readRepoFile ?? ((path) => (0, import_node_fs18.readFileSync)((0, import_node_path17.join)(cwd, path), "utf8"));
   const surfaces = changedSurfaces(collectDiff(runGit, options.base, read3), manifestLabeller(cwd));
   if (!surfaces.length) {
     return ctx.out.log(
@@ -11894,7 +11600,7 @@ async function runbookImpact(ctx, options, deps = {}) {
   }
   const impacts = await assessImpact(ctx, surfaces, options.all, options.limit ?? 4);
   if (ctx.json) return ctx.out.log(JSON.stringify({ base: options.base, impacts }, null, 2));
-  report4(ctx, impacts);
+  report3(ctx, impacts);
 }
 
 // src/runbook-lint.ts
@@ -12018,7 +11724,7 @@ async function runbookComment(ctx, slug, body) {
 
 // src/runbook-editor.ts
 var import_node_child_process8 = require("child_process");
-var import_node_fs20 = require("fs");
+var import_node_fs19 = require("fs");
 var import_node_os5 = require("os");
 var import_node_path18 = require("path");
 var import_node_process13 = __toESM(require("process"), 1);
@@ -12046,16 +11752,16 @@ function editText(initial, slug, deps = {}) {
     );
   if (!interactive())
     throw new Error(`cannot open an editor without a terminal \u2014 pass --file <path> or --body "\u2026" instead`);
-  const dir = (0, import_node_fs20.mkdtempSync)((0, import_node_path18.join)((0, import_node_os5.tmpdir)(), "odla-runbook-"));
+  const dir = (0, import_node_fs19.mkdtempSync)((0, import_node_path18.join)((0, import_node_os5.tmpdir)(), "odla-runbook-"));
   const file = (0, import_node_path18.join)(dir, `${slug}.md`);
   try {
-    (0, import_node_fs20.writeFileSync)(file, initial, { mode: 384 });
+    (0, import_node_fs19.writeFileSync)(file, initial, { mode: 384 });
     const code = defaultRunOrInjected(deps)(editor, file);
     if (code !== 0) throw new Error(`editor "${editor}" exited with ${code}; nothing was written`);
-    const edited = (0, import_node_fs20.readFileSync)(file, "utf8");
+    const edited = (0, import_node_fs19.readFileSync)(file, "utf8");
     return edited === initial ? null : edited;
   } finally {
-    (0, import_node_fs20.rmSync)(dir, { recursive: true, force: true });
+    (0, import_node_fs19.rmSync)(dir, { recursive: true, force: true });
   }
 }
 var defaultRunOrInjected = (deps) => deps.run ?? defaultRun;
@@ -12394,7 +12100,6 @@ async function runbookCommand(parsed, deps = {}) {
 }
 
 // src/security-command-context.ts
-var import_promises12 = require("readline/promises");
 async function hostedSecurityContext(parsed, dependencies) {
   const configPath = stringOpt(parsed.options.config) ?? "odla.config.mjs";
   const cfg = await loadProjectConfig(configPath);
@@ -12413,21 +12118,11 @@ async function hostedSecurityContext(parsed, dependencies) {
     cfg,
     { configPath, email: stringOpt(parsed.options.email), open, openApprovalUrl: dependencies.openUrl },
     doFetch,
-    stdout
+    stdout,
+    { optionalProjectCapabilities: ["app.manage"] }
   );
   return { platform, token, appId: cfg.app.id, env, fetch: doFetch, stdout };
 }
-async function interactiveConfirmation(message2, dependencies) {
-  if (dependencies.confirm) return dependencies.confirm(message2);
-  if (!process.stdin.isTTY || !process.stdout.isTTY) return false;
-  const prompt = (0, import_promises12.createInterface)({ input: process.stdin, output: process.stdout });
-  try {
-    const answer = await prompt.question(`${message2} [y/N] `);
-    return /^y(?:es)?$/i.test(answer.trim());
-  } finally {
-    prompt.close();
-  }
-}
 function requiredSecurityPositional(parsed, index, label) {
   const value2 = parsed.positionals[index];
   if (!value2) throw new Error(`${label} is required`);
@@ -12493,31 +12188,31 @@ function printHostedJob(out, job, platform, appId) {
   url.searchParams.set("job", job.jobId);
   out.log(`  Studio: ${url.toString()}`);
 }
-function printHostedReport(out, report5) {
-  out.log(`security report ${report5.jobId}: ${report5.repository}@${report5.revision}`);
-  out.log(`  coverage: ${report5.coverageStatus} cells=${report5.metrics.coverageCells} shallow=${report5.metrics.shallowCells} blocked=${report5.metrics.blockedCells} unscheduled=${report5.metrics.unscheduledCells} budget_exhausted=${report5.metrics.budgetExhaustedCells}`);
-  out.log(`  findings: confirmed=${report5.metrics.confirmed} needs_reproduction=${report5.metrics.needsReproduction} candidates=${report5.metrics.candidates} rejected=${report5.metrics.rejected}`);
-  out.log(`  discovery: ${report5.provenance.discovery?.provider ?? "unknown"}/${report5.provenance.discovery?.model ?? "unknown"}`);
-  out.log(`  validation: ${report5.provenance.validation?.provider ?? "unknown"}/${report5.provenance.validation?.model ?? "unknown"} independent=${String(report5.provenance.independentValidation)}`);
-  for (const finding of report5.findings) {
+function printHostedReport(out, report4) {
+  out.log(`security report ${report4.jobId}: ${report4.repository}@${report4.revision}`);
+  out.log(`  coverage: ${report4.coverageStatus} cells=${report4.metrics.coverageCells} shallow=${report4.metrics.shallowCells} blocked=${report4.metrics.blockedCells} unscheduled=${report4.metrics.unscheduledCells} budget_exhausted=${report4.metrics.budgetExhaustedCells}`);
+  out.log(`  findings: confirmed=${report4.metrics.confirmed} needs_reproduction=${report4.metrics.needsReproduction} candidates=${report4.metrics.candidates} rejected=${report4.metrics.rejected}`);
+  out.log(`  discovery: ${report4.provenance.discovery?.provider ?? "unknown"}/${report4.provenance.discovery?.model ?? "unknown"}`);
+  out.log(`  validation: ${report4.provenance.validation?.provider ?? "unknown"}/${report4.provenance.validation?.model ?? "unknown"} independent=${String(report4.provenance.independentValidation)}`);
+  for (const finding of report4.findings) {
     const location = finding.locations[0];
     out.log(`  [${finding.severity}] ${finding.title}${location ? ` (${location.path}:${location.line})` : ""} \xB7 ${finding.disposition}`);
   }
-  for (const limitation of report5.limitations) out.log(`  limitation: ${limitation}`);
+  for (const limitation of report4.limitations) out.log(`  limitation: ${limitation}`);
 }
-function enforceHostedReportGate(report5, parsed, out, emitSuccess) {
+function enforceHostedReportGate(report4, parsed, out, emitSuccess) {
   const failOn = hostedSeverity(stringOpt(parsed.options["fail-on"]) ?? "high", "--fail-on");
   const candidateValue = parsed.options["fail-on-candidates"];
   const failOnCandidates = candidateValue === false ? void 0 : hostedSeverity(stringOpt(candidateValue) ?? "critical", "--fail-on-candidates");
   const atOrAbove = (severity, threshold) => HOSTED_SEVERITIES.indexOf(severity) >= HOSTED_SEVERITIES.indexOf(threshold);
-  const confirmed = report5.findings.filter((finding) => finding.disposition === "confirmed" && atOrAbove(finding.severity, failOn));
-  const leads = failOnCandidates ? report5.findings.filter((finding) => finding.disposition !== "confirmed" && atOrAbove(finding.severity, failOnCandidates)) : [];
-  const incomplete = report5.coverageStatus !== "complete" && parsed.options["allow-incomplete"] !== true;
+  const confirmed = report4.findings.filter((finding) => finding.disposition === "confirmed" && atOrAbove(finding.severity, failOn));
+  const leads = failOnCandidates ? report4.findings.filter((finding) => finding.disposition !== "confirmed" && atOrAbove(finding.severity, failOnCandidates)) : [];
+  const incomplete = report4.coverageStatus !== "complete" && parsed.options["allow-incomplete"] !== true;
   if (confirmed.length || leads.length || incomplete) {
-    throw new Error(`hosted security gate failed: ${confirmed.length} confirmed >= ${failOn}; ${leads.length} leads >= ${failOnCandidates ?? "disabled"}${incomplete ? `; coverage ${report5.coverageStatus}` : ""}`);
+    throw new Error(`hosted security gate failed: ${confirmed.length} confirmed >= ${failOn}; ${leads.length} leads >= ${failOnCandidates ?? "disabled"}${incomplete ? `; coverage ${report4.coverageStatus}` : ""}`);
   }
   if (emitSuccess) {
-    out.log(`security gate passed: 0 confirmed >= ${failOn}; 0 leads >= ${failOnCandidates ?? "disabled"}; coverage ${report5.coverageStatus}. This is not proof that the application is secure.`);
+    out.log(`security gate passed: 0 confirmed >= ${failOn}; 0 leads >= ${failOnCandidates ?? "disabled"}; coverage ${report4.coverageStatus}. This is not proof that the application is secure.`);
   }
 }
 function printHostedSecurityPlanRoute(out, label, route2) {
@@ -12600,17 +12295,17 @@ async function runHostedSecurity(options) {
       allowNetwork: false
     }
   });
-  const report5 = await harness.run(snapshot, { runId: hosted.run.runId, signal: options.signal });
-  await (0, import_node3.writeSecurityArtifacts)(output, report5);
-  const reportDigest = await (0, import_security.securityFingerprint)(report5);
+  const report4 = await harness.run(snapshot, { runId: hosted.run.runId, signal: options.signal });
+  await (0, import_node3.writeSecurityArtifacts)(output, report4);
+  const reportDigest = await (0, import_security.securityFingerprint)(report4);
   await hosted.complete({
     reportDigest,
-    coverageStatus: report5.coverageStatus,
-    confirmed: report5.metrics.confirmed,
-    candidates: report5.metrics.candidates
+    coverageStatus: report4.coverageStatus,
+    confirmed: report4.metrics.confirmed,
+    candidates: report4.metrics.candidates
   }, { signal: options.signal });
-  printSummary(options.stdout ?? console, appId, env, hosted.run, report5, output);
-  return Object.freeze({ report: report5, run: hosted.run, output });
+  printSummary(options.stdout ?? console, appId, env, hosted.run, report4, output);
+  return Object.freeze({ report: report4, run: hosted.run, output });
 }
 function selectEnv(requested, declared, configPath, rootDir) {
   const env = requested ?? (declared.includes("dev") ? "dev" : declared[0]);
@@ -12636,14 +12331,14 @@ function profileFor(name, maxHuntTasks) {
   if (!Number.isSafeInteger(maxHuntTasks) || maxHuntTasks < 1) throw new Error("maxHuntTasks must be a positive integer");
   return { ...profile, maxHuntTasks };
 }
-function printSummary(out, appId, env, run, report5, output) {
-  const complete = report5.coverage.filter((cell) => cell.state === "complete").length;
+function printSummary(out, appId, env, run, report4, output) {
+  const complete = report4.coverage.filter((cell) => cell.state === "complete").length;
   out.log(`security: ${appId}/${env} run=${run.runId} profile=${run.profileVersion}`);
   out.log(`  discovery: ${run.discovery.identity.provider}/${run.discovery.identity.model}`);
   out.log(`  validation: ${run.validation.identity.provider}/${run.validation.identity.model}`);
-  out.log(`  coverage: ${report5.coverageStatus} ${complete}/${report5.coverage.length} blocked=${report5.metrics.blockedCells} shallow=${report5.metrics.shallowCells} unscheduled=${report5.metrics.unscheduledCells} budget_exhausted=${report5.metrics.budgetExhaustedCells}`);
-  if (report5.callBudget) out.log(`  calls: discovery=${formatBudget(report5.callBudget.discovery)} validation=${formatBudget(report5.callBudget.validation)}`);
-  out.log(`  findings: confirmed=${report5.metrics.confirmed} needs_reproduction=${report5.metrics.needsReproduction} candidates=${report5.metrics.candidates}`);
+  out.log(`  coverage: ${report4.coverageStatus} ${complete}/${report4.coverage.length} blocked=${report4.metrics.blockedCells} shallow=${report4.metrics.shallowCells} unscheduled=${report4.metrics.unscheduledCells} budget_exhausted=${report4.metrics.budgetExhaustedCells}`);
+  if (report4.callBudget) out.log(`  calls: discovery=${formatBudget(report4.callBudget.discovery)} validation=${formatBudget(report4.callBudget.validation)}`);
+  out.log(`  findings: confirmed=${report4.metrics.confirmed} needs_reproduction=${report4.metrics.needsReproduction} candidates=${report4.metrics.candidates}`);
   out.log(`  report: ${(0, import_node_path19.resolve)(output, "REPORT.md")}`);
 }
 function formatBudget(usage) {
@@ -12890,13 +12585,13 @@ async function runSourceSecurityCommand(parsed, dependencies, sourceId) {
     }
     throw new Error(`hosted security job ${result.jobId} ended ${result.status}${result.errorCode ? `: ${result.errorCode}` : ""}`);
   }
-  const report5 = await getHostedSecurityReport({ ...context, jobId: result.jobId });
+  const report4 = await getHostedSecurityReport({ ...context, jobId: result.jobId });
   if (parsed.options.json === true) {
-    context.stdout.log(JSON.stringify({ plan, intent: preview.intent, job: result, report: report5 }, null, 2));
+    context.stdout.log(JSON.stringify({ plan, intent: preview.intent, job: result, report: report4 }, null, 2));
   } else {
-    printHostedReport(context.stdout, report5);
+    printHostedReport(context.stdout, report4);
   }
-  enforceHostedReportGate(report5, parsed, context.stdout, parsed.options.json !== true);
+  enforceHostedReportGate(report4, parsed, context.stdout, parsed.options.json !== true);
 }
 async function runLocalSecurityCommand(parsed, dependencies) {
   if (parsed.options.source === true) {
@@ -12957,19 +12652,20 @@ async function runLocalSecurityCommand(parsed, dependencies) {
         cfg,
         { configPath, email: stringOpt(parsed.options.email), open, openApprovalUrl: dependencies.openUrl },
         doFetch,
-        out
+        out,
+        { optionalProjectCapabilities: ["app.manage"] }
       );
     }
   });
   enforceLocalGate(result.report, parsed);
 }
-function enforceLocalGate(report5, parsed) {
+function enforceLocalGate(report4, parsed) {
   const failOn = severityOpt(stringOpt(parsed.options["fail-on"]) ?? "high", "--fail-on");
   const candidateValue = parsed.options["fail-on-candidates"];
   const failOnCandidates = candidateValue === false ? void 0 : severityOpt(stringOpt(candidateValue) ?? "critical", "--fail-on-candidates");
-  const confirmed = (0, import_security2.findingsAtOrAbove)(report5, failOn);
-  const leads = failOnCandidates ? (0, import_security2.findingsAtOrAbove)(report5, failOnCandidates, true).filter((finding) => finding.disposition !== "confirmed") : [];
-  const incomplete = report5.coverageStatus === "incomplete" && parsed.options["allow-incomplete"] !== true;
+  const confirmed = (0, import_security2.findingsAtOrAbove)(report4, failOn);
+  const leads = failOnCandidates ? (0, import_security2.findingsAtOrAbove)(report4, failOnCandidates, true).filter((finding) => finding.disposition !== "confirmed") : [];
+  const incomplete = report4.coverageStatus === "incomplete" && parsed.options["allow-incomplete"] !== true;
   if (confirmed.length || leads.length || incomplete) {
     throw new Error(`hosted security gate failed: ${confirmed.length} confirmed >= ${failOn}; ${leads.length} leads >= ${failOnCandidates ?? "disabled"}${incomplete ? "; coverage incomplete" : ""}`);
   }
@@ -13008,9 +12704,9 @@ async function securityCommand(parsed, dependencies) {
     assertArgs(parsed, ["config", "env", "platform", "email", "open", "json"], 3);
     const jobId = requiredSecurityPositional(parsed, 2, "job id");
     const context = await hostedSecurityContext(parsed, dependencies);
-    const report5 = await getHostedSecurityReport({ ...context, jobId });
-    if (parsed.options.json === true) context.stdout.log(JSON.stringify(report5, null, 2));
-    else printHostedReport(context.stdout, report5);
+    const report4 = await getHostedSecurityReport({ ...context, jobId });
+    if (parsed.options.json === true) context.stdout.log(JSON.stringify(report4, null, 2));
+    else printHostedReport(context.stdout, report4);
     return;
   }
   if (sub !== "run") {
@@ -13024,35 +12720,24 @@ async function githubSecurityCommand(parsed, dependencies) {
   const action2 = parsed.positionals[2];
   if (action2 === "disconnect") {
     assertArgs(parsed, ["config", "env", "platform", "source", "email", "open", "yes"], 3);
-    const context2 = await hostedSecurityContext(parsed, dependencies);
     const sourceId = requiredString(parsed.options.source, "--source");
-    const confirmed = parsed.options.yes === true || await interactiveConfirmation(
-      `Disconnect GitHub security source ${sourceId} from ${context2.appId}/${context2.env}?`,
-      dependencies
+    return requireStudioHuman(
+      stringOpt(parsed.options.config) ?? "odla.config.mjs",
+      `disconnecting GitHub security source ${sourceId}`,
+      "security",
+      stringOpt(parsed.options.env)
     );
-    if (!confirmed) {
-      throw new Error("GitHub source disconnect cancelled; pass --yes in a non-interactive shell");
-    }
-    await disconnectGitHubSecuritySource({ ...context2, sourceId });
-    context2.stdout.log(`github: disconnected ${sourceId} from ${context2.appId}/${context2.env}`);
-    return;
   }
   if (action2 !== "connect") {
     throw new Error('unknown security github command. Try "odla-ai security github connect".');
   }
   assertArgs(parsed, ["config", "env", "platform", "repo", "email", "open"], 3);
-  const context = await hostedSecurityContext(parsed, dependencies);
-  const repository = stringOpt(parsed.options.repo) ?? await inferGitHubRepository(process.cwd(), dependencies.readGitOrigin).catch(() => void 0);
-  const connection = await connectGitHubSecuritySource({
-    ...context,
-    ...repository === void 0 ? {} : { repository },
-    open: parsed.options.open !== false,
-    openInstallUrl: dependencies.openUrl ?? openUrl,
-    wait: dependencies.pollWait,
-    stdout: context.stdout
-  });
-  context.stdout.log(`github: connected ${connection.repository ?? repository ?? "app repository"} (${connection.sourceId ?? "source pending"})`);
-  context.stdout.log("github: odla.ai stores the installation; no PAT or GitHub token is written locally");
+  await requireStudioHuman(
+    stringOpt(parsed.options.config) ?? "odla.config.mjs",
+    "connecting the GitHub security repository",
+    "security",
+    stringOpt(parsed.options.env)
+  );
 }
 async function listSecuritySources(parsed, dependencies) {
   assertArgs(parsed, ["config", "env", "platform", "email", "open", "json"], 2);