@odla-ai/cli 0.27.11 → 0.27.13

package/dist/{chunk-Y7WFLSTN.js → chunk-3YSCRXPF.js}

@@ -292,23 +292,30 @@ function handshakeWaitMs(waitSeconds, interactive = process4.stdout.isTTY === tr
 
 // src/token.ts
 async function getDeveloperToken(cfg, options, doFetch, out, grantRequest = {}) {
-  if (options.token) return options.token;
   const audience = platformAudience(cfg.platformUrl);
-  if (process5.env.ODLA_DEV_TOKEN) {
-    const declared = process5.env.ODLA_DEV_TOKEN_AUDIENCE;
-    if (declared) {
-      if (platformAudience(declared) !== audience) throw new Error("ODLA_DEV_TOKEN_AUDIENCE does not match the configured platform");
-    } else if (audience !== "https://odla.ai") {
-      throw new Error("ODLA_DEV_TOKEN_AUDIENCE is required for a non-default platform");
-    }
-    return process5.env.ODLA_DEV_TOKEN;
-  }
   const optionalProjectCapabilities = grantRequest.optionalProjectCapabilities ?? [];
   const grantIntent = { projectIds: [cfg.app.id], optionalProjectCapabilities };
   const cached = readJsonFile(cfg.local.tokenFile);
-  if (cached?.token && cached.platform === audience && (cached.expiresAt ?? 0) > Date.now() + 6e4 && cachedGrantCovers(cached, grantIntent)) {
-    out.error(`auth: using cached developer token (${displayPath(cfg.local.tokenFile, cfg.rootDir)})`);
-    return cached.token;
+  if (!grantRequest.forceReview) {
+    if (options.token) return options.token;
+    if (process5.env.ODLA_DEV_TOKEN) {
+      const declared = process5.env.ODLA_DEV_TOKEN_AUDIENCE;
+      if (declared) {
+        if (platformAudience(declared) !== audience) throw new Error("ODLA_DEV_TOKEN_AUDIENCE does not match the configured platform");
+      } else if (audience !== "https://odla.ai") {
+        throw new Error("ODLA_DEV_TOKEN_AUDIENCE is required for a non-default platform");
+      }
+      return process5.env.ODLA_DEV_TOKEN;
+    }
+    if (cached?.token && cached.platform === audience && (cached.expiresAt ?? 0) > Date.now() + 6e4 && cachedGrantCovers(cached, grantIntent)) {
+      out.error(`auth: using cached developer token (${displayPath(cfg.local.tokenFile, cfg.rootDir)})`);
+      return cached.token;
+    }
+  } else {
+    if (options.token) {
+      throw new Error("--request-grant cannot be combined with --token; remove --token so the approved replacement credential can be collected and cached");
+    }
+    out.error(`auth: requesting fresh owner review for app.manage on exact project "${cfg.app.id}"`);
   }
   const ctx = {
     cfg,
@@ -1372,12 +1379,6 @@ async function pollCalendarConnection(ctx, attemptId) {
     ctx.env
   );
 }
-async function requestCalendarDisconnect(ctx) {
-  return parseCalendarStatus(
-    await calendarJson(ctx, "/disconnect", { method: "POST", body: JSON.stringify({ purge: false }) }),
-    ctx.env
-  );
-}
 function parseCalendarStatus(raw, env) {
   const outer = wrapped(raw, "calendar");
   const value2 = record(outer.attempt) ?? record(outer.status) ?? outer;
@@ -1528,6 +1529,16 @@ async function waitForCalendarPoll(milliseconds, signal) {
   });
 }
 
+// src/human-session.ts
+async function requireStudioHuman(configPath, action2, destination = "app", env) {
+  const cfg = await loadProjectConfig(configPath);
+  const appEnv = env && cfg.envs.includes(env) ? env : cfg.envs.includes("dev") ? "dev" : cfg.envs[0] ?? "prod";
+  const path = destination === "app" ? `/studio/apps/${encodeURIComponent(cfg.app.id)}/${encodeURIComponent(appEnv)}/settings/app` : `/studio/apps/${encodeURIComponent(cfg.app.id)}/${encodeURIComponent(appEnv)}/${destination}`;
+  throw new Error(
+    `human_session_required: ${action2} requires the signed-in owner in Studio. A CLI device token is an agent credential, so another approval or retry cannot work. ${new URL(path, cfg.platformUrl).href}`
+  );
+}
+
 // src/calendar.ts
 async function calendarStatus(options) {
   const { ctx, out } = await lifecycleContext(options);
@@ -1561,10 +1572,7 @@ async function applyCalendarBookingPage(ctx, bookingPageUrl, out) {
 }
 async function calendarDisconnect(options) {
   if (!options.yes) throw new Error("calendar disconnect requires --yes");
-  const { ctx, out } = await lifecycleContext(options);
-  const status = await requestCalendarDisconnect(ctx);
-  out.log(`${ctx.env}: calendar disconnected; no calendar data was stored`);
-  return status;
+  return requireStudioHuman(options.configPath, "calendar disconnect", "calendar", options.env);
 }
 async function ensureCalendarConnected(ctx, options) {
   const out = options.stdout ?? console;
@@ -1809,11 +1817,11 @@ async function assertTenantAdminAccess(doFetch, cfg, env, token) {
     }
     if (code === "provision_approval_required") {
       throw new Error(
-        `${env}: the agent credential does not carry the owner-reviewed app.manage grant required to provision "${cfg.app.id}" (tenant ${tenantId}). The human owner id on the token is accountability, not agent authority. Discard the cached or supplied token and run this command with the current CLI to approve one fresh exact-project provisioning handshake`
+        `${env}: the agent credential does not carry the owner-reviewed app.manage grant required to provision "${cfg.app.id}" (tenant ${tenantId}). The human owner id on the token is accountability, not agent authority. Run "odla-ai provision --request-grant --email <odla-account>" to open one fresh exact-project owner review; do not change app ownership unless the human account itself is not an owner`
       );
     }
     throw new Error(
-      `${env}: this credential lacks live app.manage authority for "${cfg.app.id}" (tenant ${tenantId}) \u2014 nothing was minted or written; re-run provision with a fresh owner-approved provision handshake. If the human account is not an owner, an existing owner must add it in signed-in Studio; an agent token cannot repair ownership`
+      `${env}: this credential lacks live app.manage authority for "${cfg.app.id}" (tenant ${tenantId}) \u2014 nothing was minted or written; run "odla-ai provision --request-grant --email <odla-account>" to open a fresh owner review. If the human account is not an owner, an existing owner must add it in signed-in Studio; an agent token cannot repair ownership`
     );
   }
   throw new Error(`${env}: tenant access preflight (${tenantId}) failed: ${res.status} ${await safeText4(res)}`);
@@ -3345,7 +3353,9 @@ async function secretsSetClerkKey(options) {
   if (value2.startsWith("sk_live_") && !PROD_ENV_NAMES2.has(options.env) && !options.yes) {
     throw new Error(`refusing to store an sk_live_ Clerk key for "${options.env}" without --yes (live users would sync into a non-prod tenant)`);
   }
-  const token = await getDeveloperToken(cfg, options, doFetch, out);
+  const token = await getDeveloperToken(cfg, options, doFetch, out, {
+    optionalProjectCapabilities: ["app.manage"]
+  });
   const res = await doFetch(`${cfg.dbEndpoint}/admin/apps/${encodeURIComponent(tenantId)}/clerk-secret`, {
     method: "POST",
     headers: { authorization: `Bearer ${token}`, "content-type": "application/json" },
@@ -7238,7 +7248,7 @@ function record6(value2) {
 }
 
 // src/provision.ts
-import { createAppsClient as createAppsClient3, orderAppServices as orderAppServices3, tenantIdFor as tenantIdFor4 } from "@odla-ai/apps";
+import { AppsError as AppsError2, createAppsClient as createAppsClient3, orderAppServices as orderAppServices3, tenantIdFor as tenantIdFor4 } from "@odla-ai/apps";
 import { putSecret as putSecret2 } from "@odla-ai/ai";
 import process9 from "process";
 
@@ -7459,14 +7469,25 @@ async function provision(options) {
   }
   const doFetch = options.fetch ?? fetch;
   const token = await getDeveloperToken(cfg, options, doFetch, out, {
-    optionalProjectCapabilities: ["app.manage"]
+    optionalProjectCapabilities: ["app.manage"],
+    forceReview: options.requestGrant
   });
   const apps = createAppsClient3({ endpoint: cfg.platformUrl, token, fetcher: { fetch: doFetch } });
   const existing = await apps.resolveApp(cfg.app.id);
   if (existing) {
     out.log(`app: ${cfg.app.id} already exists`);
   } else {
-    await apps.createApp({ name: cfg.app.name, appId: cfg.app.id });
+    try {
+      await apps.createApp({ name: cfg.app.name, appId: cfg.app.id });
+    } catch (error) {
+      if (error instanceof AppsError2 && error.status === 403) {
+        throw new Error(
+          `app "${cfg.app.id}" does not exist, and this authenticated agent credential has no owner-reviewed app.manage bootstrap grant for that exact id. Run "odla-ai provision --request-grant --email <odla-account>" to open the review URL and continue; developer ownership alone is not agent authority`,
+          { cause: error }
+        );
+      }
+      throw error;
+    }
     out.log(`app: created ${cfg.app.id}`);
   }
   for (const env of cfg.envs) {
@@ -7817,17 +7838,17 @@ async function runHostedSecurity(options) {
       allowNetwork: false
     }
   });
-  const report5 = await harness.run(snapshot, { runId: hosted.run.runId, signal: options.signal });
-  await writeSecurityArtifacts(output, report5);
-  const reportDigest = await securityFingerprint(report5);
+  const report4 = await harness.run(snapshot, { runId: hosted.run.runId, signal: options.signal });
+  await writeSecurityArtifacts(output, report4);
+  const reportDigest = await securityFingerprint(report4);
   await hosted.complete({
     reportDigest,
-    coverageStatus: report5.coverageStatus,
-    confirmed: report5.metrics.confirmed,
-    candidates: report5.metrics.candidates
+    coverageStatus: report4.coverageStatus,
+    confirmed: report4.metrics.confirmed,
+    candidates: report4.metrics.candidates
   }, { signal: options.signal });
-  printSummary(options.stdout ?? console, appId, env, hosted.run, report5, output);
-  return Object.freeze({ report: report5, run: hosted.run, output });
+  printSummary(options.stdout ?? console, appId, env, hosted.run, report4, output);
+  return Object.freeze({ report: report4, run: hosted.run, output });
 }
 function selectEnv(requested, declared, configPath, rootDir) {
   const env = requested ?? (declared.includes("dev") ? "dev" : declared[0]);
@@ -7853,14 +7874,14 @@ function profileFor(name, maxHuntTasks) {
   if (!Number.isSafeInteger(maxHuntTasks) || maxHuntTasks < 1) throw new Error("maxHuntTasks must be a positive integer");
   return { ...profile, maxHuntTasks };
 }
-function printSummary(out, appId, env, run, report5, output) {
-  const complete = report5.coverage.filter((cell) => cell.state === "complete").length;
+function printSummary(out, appId, env, run, report4, output) {
+  const complete = report4.coverage.filter((cell) => cell.state === "complete").length;
   out.log(`security: ${appId}/${env} run=${run.runId} profile=${run.profileVersion}`);
   out.log(`  discovery: ${run.discovery.identity.provider}/${run.discovery.identity.model}`);
   out.log(`  validation: ${run.validation.identity.provider}/${run.validation.identity.model}`);
-  out.log(`  coverage: ${report5.coverageStatus} ${complete}/${report5.coverage.length} blocked=${report5.metrics.blockedCells} shallow=${report5.metrics.shallowCells} unscheduled=${report5.metrics.unscheduledCells} budget_exhausted=${report5.metrics.budgetExhaustedCells}`);
-  if (report5.callBudget) out.log(`  calls: discovery=${formatBudget(report5.callBudget.discovery)} validation=${formatBudget(report5.callBudget.validation)}`);
-  out.log(`  findings: confirmed=${report5.metrics.confirmed} needs_reproduction=${report5.metrics.needsReproduction} candidates=${report5.metrics.candidates}`);
+  out.log(`  coverage: ${report4.coverageStatus} ${complete}/${report4.coverage.length} blocked=${report4.metrics.blockedCells} shallow=${report4.metrics.shallowCells} unscheduled=${report4.metrics.unscheduledCells} budget_exhausted=${report4.metrics.budgetExhaustedCells}`);
+  if (report4.callBudget) out.log(`  calls: discovery=${formatBudget(report4.callBudget.discovery)} validation=${formatBudget(report4.callBudget.validation)}`);
+  out.log(`  findings: confirmed=${report4.metrics.confirmed} needs_reproduction=${report4.metrics.needsReproduction} candidates=${report4.metrics.candidates}`);
   out.log(`  report: ${resolve9(output, "REPORT.md")}`);
 }
 function formatBudget(usage) {
@@ -8425,7 +8446,7 @@ async function agentCommand(parsed, deps = {}) {
   if (action2 !== "jobs" && action2 !== "retry") {
     throw new Error(`unknown agent action "${action2 ?? ""}". Try "odla-ai agent jobs --json".`);
   }
-  assertArgs(parsed, ["config", "env", "state", "limit", "json", "token", "email"], action2 === "jobs" ? 2 : 3);
+  assertArgs(parsed, ["config", "env", "state", "limit", "json", "token"], action2 === "jobs" ? 2 : 3);
   if (action2 === "retry" && (parsed.options.state !== void 0 || parsed.options.limit !== void 0)) {
     throw new Error('--state and --limit are supported only by "agent jobs"');
   }
@@ -8433,17 +8454,17 @@ async function agentCommand(parsed, deps = {}) {
   const { env, tenant } = resolveTenant(cfg, stringOpt(parsed.options.env));
   const doFetch = deps.fetch ?? fetch;
   const out = deps.stdout ?? console;
-  const credential2 = await getDeveloperToken(
-    cfg,
-    {
-      configPath: cfg.configPath,
-      token: stringOpt(parsed.options.token),
-      email: stringOpt(parsed.options.email),
-      open: false
-    },
-    doFetch,
-    out
-  );
+  const credential2 = stringOpt(parsed.options.token) ?? readCredentials(cfg.local.credentialsFile)?.envs[env]?.dbKey;
+  if (!credential2) {
+    throw new Error(
+      `no ${env} app credential found; run \`odla-ai provision --write-dev-vars --yes\` or pass --token <ODLA_API_KEY>`
+    );
+  }
+  if (credential2.startsWith("odla_dev_")) {
+    throw new Error(
+      "agent job administration requires an app credential (ODLA_API_KEY / odla_sk_\u2026), not a developer device token"
+    );
+  }
   const base = `${cfg.dbEndpoint}/app/${encodeURIComponent(tenant)}/admin/agent-jobs`;
   const headers = { authorization: `Bearer ${credential2}` };
   if (action2 === "retry") {
@@ -8500,53 +8521,14 @@ function errorMessage(body) {
 }
 
 // src/app-export.ts
-import { createWriteStream } from "fs";
-import { Readable } from "stream";
-import { pipeline } from "stream/promises";
 async function appExport(options) {
-  const cfg = await loadProjectConfig(options.configPath);
-  const out = options.stdout ?? console;
-  const doFetch = options.fetch ?? fetch;
-  const { tenant } = resolveTenant(cfg, options.env);
-  const token = await getDeveloperToken(
-    cfg,
-    { configPath: cfg.configPath, token: options.token, email: options.email, open: false },
-    doFetch,
-    out
-  );
-  const auth = { authorization: `Bearer ${token}` };
-  const base = `${cfg.dbEndpoint}/admin/apps/${encodeURIComponent(tenant)}`;
-  if (options.fresh) {
-    const res = await doFetch(`${base}/export`, { method: "POST", headers: auth });
-    const body = await res.json().catch(() => ({}));
-    if (!res.ok) throw new Error(`export failed${body.error?.code ? ` (${body.error.code})` : ""}: ${body.error?.message ?? res.status}`);
-  }
-  const list = await doFetch(`${base}/backups`, { headers: auth });
-  if (!list.ok) throw new Error(`couldn't list backups (${list.status})`);
-  const { backups } = await list.json();
-  const newest = backups[0];
-  if (!newest) {
-    throw new Error(
-      `${tenant} has no backups yet \u2014 run \`odla-ai app export --fresh\` to take one now (nightly snapshots appear after the first day with writes)`
-    );
-  }
-  const download = await doFetch(`${base}/backups/${newest.id}/download`, { headers: auth });
-  if (!download.ok || !download.body) throw new Error(`download failed (${download.status})`);
-  const file = options.out ?? `${tenant}-${new Date(newest.created_at).toISOString().slice(0, 10)}-tx${newest.max_tx}.jsonl.gz`;
-  await pipeline(Readable.fromWeb(download.body), createWriteStream(file));
-  if (options.json) out.log(JSON.stringify({ file, backup: newest }, null, 2));
-  else {
-    out.log(`${tenant}: wrote ${file} (${newest.bytes} bytes, ${newest.kind} snapshot at tx ${newest.max_tx})`);
-    out.log(`sha256 ${download.headers.get("x-odla-sha256") ?? newest.sha256}`);
-  }
-  return { file, backup: newest };
+  return requireStudioHuman(options.configPath, "database export", "database", options.env);
 }
 
 // src/app-import.ts
 import { readFileSync as readFileSync9 } from "fs";
 import {
   buildImportOps,
-  importMutationId,
   parseImport,
   planImportChunks
 } from "@odla-ai/db/import";
@@ -8565,7 +8547,6 @@ async function appImport(options) {
   const cfg = await loadProjectConfig(options.configPath);
   const out = options.stdout ?? console;
   const say = options.json ? (line) => out.error(line) : (line) => out.log(line);
-  const doFetch = options.fetch ?? fetch;
   const { tenant } = resolveTenant(cfg, options.env);
   const text2 = options.file === "-" ? (options.readStdin ?? (() => readFileSync9(0, "utf8")))() : readFileSync9(options.file, "utf8");
   const { format, sources } = parseImport(text2, options.ns);
@@ -8593,100 +8574,18 @@ ${detail}${more}`);
     if (options.json) out.log(JSON.stringify(result, null, 2));
     return result;
   }
-  const token = await getDeveloperToken(
-    cfg,
-    { configPath: cfg.configPath, token: options.token, email: options.email, open: false },
-    doFetch,
-    out
-  );
-  const runId = crypto.randomUUID();
-  const url = `${cfg.dbEndpoint}/admin/apps/${encodeURIComponent(tenant)}/transact`;
-  for (const chunk of chunks) {
-    const res = await doFetch(url, {
-      method: "POST",
-      headers: { authorization: `Bearer ${token}`, "content-type": "application/json" },
-      body: JSON.stringify({ mutationId: importMutationId(runId, chunk.index), ops: chunk.ops })
-    });
-    const body = await res.json().catch(() => ({}));
-    if (!res.ok) {
-      const code = body.error?.code ? ` (${body.error.code})` : "";
-      throw new Error(
-        `chunk ${chunk.index + 1} of ${chunks.length} failed${code}: ${body.error?.message ?? res.status}. ${result.committed} row(s) already committed; fix the input and re-run to import the rest.`
-      );
-    }
-    result.committed += chunk.ops.length;
-    if (typeof body.txId === "number") result.txIds.push(body.txId);
-    if (body.duplicate) result.duplicate++;
-  }
-  if (options.json) out.log(JSON.stringify(result, null, 2));
-  else {
-    const dup = result.duplicate > 0 ? ` (${result.duplicate} chunk(s) were already applied)` : "";
-    out.log(`${tenant}: upserted ${result.committed} row(s) in ${chunks.length} transaction(s)${dup}`);
-  }
-  return result;
+  return requireStudioHuman(options.configPath, "database import", "database", options.env);
 }
 
 // src/app-owners.ts
-var sink = (options) => options.stdout ?? console;
-async function ownersRequest(method, suffix, options, body) {
-  const cfg = await loadProjectConfig(options.configPath);
-  const doFetch = options.fetch ?? fetch;
-  const token = await getDeveloperToken(
-    cfg,
-    { configPath: cfg.configPath, token: options.token, email: options.email, open: false },
-    doFetch,
-    sink(options)
-  );
-  const res = await doFetch(`${cfg.platformUrl}/registry/apps/${encodeURIComponent(cfg.app.id)}/owners${suffix}`, {
-    method,
-    headers: { authorization: `Bearer ${token}`, "content-type": "application/json" },
-    body: body === void 0 ? void 0 : JSON.stringify(body)
-  });
-  const data = await res.json().catch(() => ({}));
-  if (!res.ok) {
-    throw new Error(
-      `owners ${method} failed${data.error?.code ? ` (${data.error.code})` : ""}: ` + (data.error?.message ?? `registry returned ${res.status}`)
-    );
-  }
-  return data.owners ?? [];
-}
-function report(options, owners, headline) {
-  const out = sink(options);
-  if (options.json === true) {
-    out.log(JSON.stringify(owners, null, 2));
-    return;
-  }
-  if (headline) out.log(headline);
-  out.log(`owners (${owners.length}):`);
-  for (const o of owners) {
-    const name = o.email?.trim() || "Unnamed member";
-    out.log(
-      `  ${o.primary ? "\u2605" : "\xB7"} ${name} [${o.ownerId}]${o.primary ? " (primary)" : ""}`
-    );
-  }
-}
 async function ownersList(options) {
-  report(options, await ownersRequest("GET", "", options));
+  await requireStudioHuman(options.configPath, "listing app owners", "app");
 }
 async function ownersAdd(email, options) {
-  const owners = await ownersRequest("POST", "", options, { email });
-  report(
-    options,
-    owners,
-    `added ${email} as a co-owner \u2014 they share full access. They can now run \`odla-ai provision\` to mint their own credentials (no secret sharing).`
-  );
+  await requireStudioHuman(options.configPath, `adding ${email} as an app owner`, "app");
 }
 async function ownersRemove(target, options) {
-  let ownerId = target;
-  if (target.includes("@")) {
-    const owners2 = await ownersRequest("GET", "", options);
-    const match = owners2.find((o) => o.email?.toLowerCase() === target.toLowerCase());
-    if (!match) throw new Error(`no co-owner with email ${target}`);
-    if (match.primary) throw new Error("can't remove the primary owner");
-    ownerId = match.ownerId;
-  }
-  const owners = await ownersRequest("DELETE", `/${encodeURIComponent(ownerId)}`, options);
-  report(options, owners, `removed ${target}`);
+  await requireStudioHuman(options.configPath, `removing ${target} as an app owner`, "app");
 }
 async function appOwnersCommand(parsed, dependencies = {}) {
   const sub = parsed.positionals[2] ?? "list";
@@ -8718,35 +8617,9 @@ async function appOwnersCommand(parsed, dependencies = {}) {
 
 // src/app-rename.ts
 async function appRename(name, options) {
-  const out = options.stdout ?? console;
   const trimmed = name.trim();
   if (!trimmed) throw new Error('"app rename" needs a name \u2014 try `odla-ai app rename "Acme Storefront"`.');
-  const cfg = await loadProjectConfig(options.configPath);
-  const doFetch = options.fetch ?? fetch;
-  const token = await getDeveloperToken(
-    cfg,
-    { configPath: cfg.configPath, token: options.token, email: options.email, open: false },
-    doFetch,
-    out
-  );
-  const res = await doFetch(`${cfg.platformUrl}/registry/apps/${encodeURIComponent(cfg.app.id)}/name`, {
-    method: "PUT",
-    headers: { authorization: `Bearer ${token}`, "content-type": "application/json" },
-    body: JSON.stringify({ name: trimmed })
-  });
-  const data = await res.json().catch(() => ({}));
-  if (!res.ok || !data.app) {
-    throw new Error(
-      `rename failed${data.error?.code ? ` (${data.error.code})` : ""}: ` + (data.error?.message ?? `registry returned ${res.status}`)
-    );
-  }
-  if (options.json === true) {
-    out.log(JSON.stringify(data.app, null, 2));
-    return;
-  }
-  out.log(`renamed ${data.app.appId} \u2192 "${data.app.name}"`);
-  out.log("The app id is unchanged, so credentials, tenants, and URLs keep working.");
-  out.log(`Update the "name" in ${cfg.configPath} to match.`);
+  await requireStudioHuman(options.configPath, `renaming the app to "${trimmed}"`, "app");
 }
 async function appRenameCommand(parsed, dependencies = {}) {
   assertArgs(parsed, ["config", "token", "email", "json"], parsed.positionals.length);
@@ -8762,172 +8635,23 @@ async function appRenameCommand(parsed, dependencies = {}) {
 }
 
 // src/app-transfer.ts
-function endpointsFor(verb, tenants) {
-  const up = { source: tenants.sandbox, target: tenants.live, from: "dev" };
-  const down = { source: tenants.live, target: tenants.sandbox, from: "prod" };
-  if (verb === "refresh-sandbox") return { ...down, mode: "refresh" };
-  return { ...up, mode: "cutover" };
-}
-async function api(cfg, token, path, init, doFetch) {
-  const res = await doFetch(`${cfg.dbEndpoint}${path}`, {
-    ...init,
-    headers: { authorization: `Bearer ${token}`, "content-type": "application/json", ...init?.headers }
-  });
-  return { status: res.status, body: await res.json().catch(() => ({})) };
-}
-function describe(side) {
-  if (!side.exists) return "not provisioned";
-  if (side.maxTx === 0) return "empty \u2014 never written";
-  const ns = side.namespaces.length === 1 ? "1 namespace" : `${side.namespaces.length} namespaces`;
-  const identity = side.identityRows > 0 ? `, ${side.identityRows} identity row(s)` : "";
-  return `${ns} \xB7 ${side.triples} value(s) \xB7 tx ${side.maxTx}${identity}`;
-}
-function printPlan2(out, verb, pre, opts) {
-  const arrow = verb === "refresh-sandbox" ? "live \u2192 sandbox" : "sandbox \u2192 live";
-  out.log(`${verb} (${arrow})`);
-  out.log(`  from  ${pre.source.tenant}  ${describe(pre.source)}`);
-  out.log(`  to    ${pre.target.tenant}  ${describe(pre.target)}`);
-  if (verb === "promote") {
-    out.log("  moves schema, rules and gates only \u2014 no rows are copied or removed");
-  } else {
-    out.log(`  ${pre.target.tenant} is REPLACED by ${pre.source.tenant}`);
-    out.log(`  stays put: ${pre.staysPut.join(", ")}`);
-    const identity = opts.includeIdentity ? "INCLUDED (--include-identity)" : `left behind: ${pre.excluded.join(", ")}`;
-    out.log(`  identity: ${identity}`);
-    out.log(`  files: ${opts.includeFiles ? "copied (--include-files)" : "not copied"}`);
-  }
-  for (const blocker of pre.blockers) out.log(`  \u2716 ${blocker.code}: ${blocker.message}`);
-}
 async function appTransfer(options) {
   const cfg = await loadProjectConfig(options.configPath);
-  const out = options.stdout ?? console;
-  const say = options.json ? (line) => out.error(line) : (line) => out.log(line);
-  const doFetch = options.fetch ?? fetch;
-  const tenants = bothTenants(cfg);
-  const route2 = endpointsFor(options.verb, tenants);
-  const token = await getDeveloperToken(
-    cfg,
-    { configPath: cfg.configPath, token: options.token, email: options.email, open: false },
-    doFetch,
-    out
-  );
-  const pre = await api(
-    cfg,
-    token,
-    `/admin/apps/${encodeURIComponent(route2.target)}/copy-preflight?from=${route2.from}`,
-    void 0,
-    doFetch
-  );
-  if (pre.status !== 200) {
-    throw new Error(`pre-flight failed${pre.body.error?.code ? ` (${pre.body.error.code})` : ""}: ${pre.body.error?.message ?? pre.status}`);
-  }
-  const plan = pre.body;
-  printPlan2({ log: say }, options.verb, plan, options);
-  if (options.verb === "go-live" && !plan.targetEmpty) {
-    throw new Error(
-      `${route2.target} already has data \u2014 go-live has already happened. Use \`odla-ai app promote --yes\` to push schema and rules, or \`odla-ai app refresh-sandbox --yes\` to pull live back down.`
-    );
-  }
-  if (plan.blockers.length > 0) throw new Error(`cannot ${options.verb}: ${plan.blockers.map((b) => b.message).join("; ")}`);
-  if (options.dryRun || options.yes !== true) {
-    say(`nothing written (${options.dryRun ? "--dry-run" : "no --yes"})`);
-    if (options.json) out.log(JSON.stringify(plan, null, 2));
-    return { ok: true, plan };
-  }
-  if (options.verb === "promote") {
-    const res2 = await api(
-      cfg,
-      token,
-      `/admin/apps/${encodeURIComponent(route2.target)}/promote-definitions`,
-      { method: "POST", body: JSON.stringify({ from: "dev" }) },
-      doFetch
-    );
-    if (res2.status !== 200) throw new Error(`promote failed${res2.body.error?.code ? ` (${res2.body.error.code})` : ""}: ${res2.body.error?.message ?? res2.status}`);
-    if (options.json) out.log(JSON.stringify(res2.body, null, 2));
-    else say(`${route2.target}: promoted ${(res2.body.applied ?? []).join(", ")}`);
-    return { ok: true, plan, result: res2.body };
-  }
-  const res = await api(
-    cfg,
-    token,
-    `/admin/apps/${encodeURIComponent(route2.target)}/copy-db`,
-    {
-      method: "POST",
-      body: JSON.stringify({
-        from: route2.from,
-        mode: route2.mode,
-        ...options.includeIdentity ? { includeUsers: true } : {},
-        ...options.includeFiles ? { includeFiles: true } : {}
-      })
-    },
-    doFetch
-  );
-  if (res.status !== 200) throw new Error(`${options.verb} failed${res.body.error?.code ? ` (${res.body.error.code})` : ""}: ${res.body.error?.message ?? res.status}`);
-  say(`${route2.target}: replaced from ${route2.source} (tx ${res.body.destination?.maxTx}, epoch ${res.body.destination?.epoch}) \u2014 connected clients resync automatically`);
-  if (options.includeFiles) await copyFiles(cfg, token, route2, doFetch, out);
-  if (options.json) out.log(JSON.stringify(res.body, null, 2));
-  return { ok: true, plan, result: res.body };
-}
-async function copyFiles(cfg, token, route2, doFetch, out) {
-  for (let attempt = 1; attempt <= 20; attempt++) {
-    const res = await api(
-      cfg,
-      token,
-      `/admin/apps/${encodeURIComponent(route2.target)}/copy-files`,
-      { method: "POST", body: JSON.stringify({ from: route2.from }) },
-      doFetch
-    );
-    if (res.status === 200) {
-      out.log(`${route2.target}: files copied`);
-      return;
-    }
-    if (!res.body.error?.retry) {
-      throw new Error(`file copy failed${res.body.error?.code ? ` (${res.body.error.code})` : ""}: ${res.body.error?.message ?? res.status}`);
-    }
-    out.log(`  files: bounded at attempt ${attempt}, resuming\u2026`);
-  }
-  throw new Error("file copy did not finish within 20 rounds \u2014 re-run to continue where it left off");
+  bothTenants(cfg);
+  return requireStudioHuman(options.configPath, `app ${options.verb}`, "database");
 }
 
 // src/app-lifecycle.ts
-async function lifecycleCall(action2, options) {
-  const cfg = await loadProjectConfig(options.configPath);
-  const out = options.stdout ?? console;
-  const doFetch = options.fetch ?? fetch;
-  const token = await getDeveloperToken(
-    cfg,
-    { configPath: cfg.configPath, token: options.token, email: options.email, open: false },
-    doFetch,
-    out
-  );
-  const res = await doFetch(`${cfg.platformUrl}/registry/apps/${encodeURIComponent(cfg.app.id)}/${action2}`, {
-    method: "POST",
-    headers: { authorization: `Bearer ${token}`, "content-type": "application/json" }
-  });
-  const body = await res.json().catch(() => ({}));
-  if (!res.ok || !body.ok) {
-    throw new Error(`${action2} failed${body.error?.code ? ` (${body.error.code})` : ""}: ${body.error?.message ?? `registry returned ${res.status}`}`);
-  }
-  return body;
-}
 async function appArchive(options) {
   if (options.yes !== true) {
     throw new Error(
       "app archive suspends EVERY environment: API keys stop working and all services refuse requests until restored. All data is retained. Pass --yes to proceed."
     );
   }
-  const out = options.stdout ?? console;
-  const body = await lifecycleCall("archive", options);
-  if (options.json) out.log(JSON.stringify(body, null, 2));
-  else if (body.operation?.state === "noop") out.log(`${body.app?.appId}: already archived`);
-  else out.log(`${body.app?.appId}: archived \u2014 data retained; run \`odla-ai app restore\` (or use Studio) to bring it back`);
+  await requireStudioHuman(options.configPath, "app archive", "app");
 }
 async function appRestore(options) {
-  const out = options.stdout ?? console;
-  const body = await lifecycleCall("restore", options);
-  if (options.json) out.log(JSON.stringify(body, null, 2));
-  else if (body.operation?.state === "noop") out.log(`${body.app?.appId}: already active`);
-  else out.log(`${body.app?.appId}: restored \u2014 every service's data plane is live again`);
+  await requireStudioHuman(options.configPath, "app restore", "app");
 }
 async function appCommand(parsed, dependencies = {}) {
   const sub = parsed.positionals[1];
@@ -9563,18 +9287,17 @@ Usage:
   odla-ai calendar status [--env dev] [--email <odla-account>] [--json]
   odla-ai calendar calendars [--env dev] [--email <odla-account>] [--json]
   odla-ai calendar connect [--env dev] [--email <odla-account>] [--no-open] [--yes]
-  odla-ai calendar disconnect [--env dev] [--email <odla-account>] --yes
-  odla-ai app archive [--config odla.config.mjs] [--email <odla-account>] [--json] --yes
-  odla-ai app restore [--config odla.config.mjs] [--email <odla-account>] [--json]
-  odla-ai app export [--env dev] [--fresh] [--out <file>] [--email <odla-account>] [--json]
+  odla-ai calendar disconnect [--env dev] --yes                         [continue in Studio; human session required]
+  odla-ai app archive [--config odla.config.mjs] --yes                  [continue in Studio; human session required]
+  odla-ai app restore [--config odla.config.mjs]                        [continue in Studio; human session required]
+  odla-ai app export [--env dev]                                        [continue in Studio; human session required]
   odla-ai app import <file|-> [--env dev] [--ns <namespace>] [--id-field <f>|--key <attr>|--generate-ids] [--dry-run] [--json] --yes
-  odla-ai app refresh-sandbox [--include-identity] [--include-files] [--dry-run] [--json] --yes
-  odla-ai app go-live         [--include-identity] [--include-files] [--dry-run] [--json] --yes
-  odla-ai app promote         [--dry-run] [--json] --yes
-  odla-ai app rename <name> [--config odla.config.mjs] [--email <odla-account>] [--json]
-  odla-ai app owners list [--config odla.config.mjs] [--email <odla-account>] [--json]
-  odla-ai app owners add <email> [--email <odla-account>] [--json]
-  odla-ai app owners remove <email> [--email <odla-account>] [--json]
+                                                                         [dry-run is local; writes continue in Studio]
+  odla-ai app refresh-sandbox                                          [continue in Studio; human session required]
+  odla-ai app go-live                                                  [continue in Studio; human session required]
+  odla-ai app promote                                                  [continue in Studio; human session required]
+  odla-ai app rename <name>                                            [continue in Studio; human session required]
+  odla-ai app owners <list|add|remove> [...]                            [continue in Studio; human session required]
   odla-ai brand design unpack <bundle.html|-> [--out <dir>] [--json]
   odla-ai pm goal list [--app <id>] [--status <s>] [--q <text>] [--limit <n>] [--offset <n>] [--json]
   odla-ai pm task list [--app <id>] [--column <backlog|ready|doing|review|done>] [--goal <id>] [--assignee <id>] [--q <text>] [--limit <n>] [--offset <n>] [--json]
@@ -9609,8 +9332,8 @@ Usage:
   odla-ai discuss resolve <topic> [--reopen] [--mutation-id <id>]
   odla-ai discuss who --q <text> [--app <id>] [--kinds user,pm:task] [--json]
   odla-ai discuss watch [<topic>] [--cursor <cursor>] [--by <authorId>] [--self <authorId>] [--interval <s>] [--timeout <s>] [--json|--jsonl]
-  odla-ai agent jobs [--env dev] [--state pending|running|succeeded|dead_letter] [--limit 50] [--email <email>] [--json]
-  odla-ai agent retry <job-id> [--env dev] [--email <email>] [--json]
+  odla-ai agent jobs [--env dev] [--state pending|running|succeeded|dead_letter] [--limit 50] [--token <ODLA_API_KEY>] [--json]
+  odla-ai agent retry <job-id> [--env dev] [--token <ODLA_API_KEY>] [--json]
   odla-ai context show [--context <name>] [--platform https://odla.ai] [--app <id>] [--env prod] [--json]
   odla-ai context list [--json]
   odla-ai context save <name> [--platform <url>] [--app <id>] [--env <name>] [--json]
@@ -9646,8 +9369,8 @@ Usage:
   odla-ai admin ai credential set <provider> [--context <name>] (--from-env <NAME>|--stdin)
   odla-ai admin ai usage [--context <name>] [--app-id <id>] [--env <env>] [--run-id <id>] [--limit <1-500>] [--json]
   odla-ai admin ai audit [--context <name>] [--limit <1-200>] [--json]
-  odla-ai security github connect [--repo owner/name] [--env dev] [--email <odla-account>] [--no-open]
-  odla-ai security github disconnect --source <id> [--env dev] [--yes]
+  odla-ai security github connect [--repo owner/name] [--env dev]             [continue in Studio; human session required]
+  odla-ai security github disconnect --source <id> [--env dev]          [continue in Studio; human session required]
   odla-ai security plan [--env dev] [--json]
   odla-ai security sources [--env dev] [--json]
   odla-ai security run --source <id> --plan-digest <sha256:...> --ack-redacted-source [--ref <branch|tag|sha>] [--env dev] [--no-follow]
@@ -9655,7 +9378,7 @@ Usage:
   odla-ai security report <job-id> [--json]
   odla-ai security run [target] --ack-redacted-source [--env dev] [--profile odla] [--fail-on high]
   odla-ai security run [target] --self --ack-redacted-source
-  odla-ai provision [--config odla.config.mjs] [--email <odla-account>] [--wait <seconds>] [--dry-run] [--push-secrets] [--rotate-o11y-token] [--write-dev-vars[=path]] [--yes]
+  odla-ai provision [--config odla.config.mjs] [--email <odla-account>] [--request-grant] [--wait <seconds>] [--dry-run] [--push-secrets] [--rotate-o11y-token] [--write-dev-vars[=path]] [--yes]
   odla-ai smoke [--config odla.config.mjs] [--env dev] [--email <odla-account>] [--no-open]
   odla-ai skill install [--dir <project>] [--agent <name>] [--global] [--force]
   odla-ai secrets push --env <env> [--config odla.config.mjs] [--dry-run] [--yes]
@@ -9790,6 +9513,10 @@ Safety:
   The email is a non-secret identity hint: never provide a password or session
   token. The matching account must already exist, be signed in, explicitly
   review the exact code, and finish any current request before claiming another.
+  If provision reports that the current agent principal has no live app.manage
+  grant, run it once with --request-grant. That flag ignores ODLA_DEV_TOKEN and
+  the local cache, prints and opens a fresh exact-project owner-review URL, then
+  continues provisioning with the approved replacement credential.
   Run Code from a GitHub checkout already connected to an app in Studio; an
   odla.config.mjs may select the app explicitly but is not required. Code host
   approval and credential hashes live in odla-ai/db. The host
@@ -10158,7 +9885,7 @@ async function discussWatch(ctx, topicId, parsed) {
         throw new WatchRemoteError(cursor, error);
       }
       if (deadline !== void 0 && now() >= deadline) {
-        const result = report2(ctx, parsed, { found: false, cursor: cursor ?? "" });
+        const result = report(ctx, parsed, { found: false, cursor: cursor ?? "" });
         throw new WatchTimeoutError(result.cursor);
       }
       const base = Math.min(intervalMs, 1e3);
@@ -10199,7 +9926,7 @@ async function discussWatch(ctx, topicId, parsed) {
       });
       const posts = topicId ? matching.filter((event) => event.type === "message").map((event) => event.payload) : void 0;
       const topics = topicId ? void 0 : matching.filter((event) => event.type === "activity").map((event) => event.payload);
-      return report2(ctx, parsed, {
+      return report(ctx, parsed, {
         found: true,
         cursor,
         events: matching,
@@ -10226,13 +9953,13 @@ async function discussWatch(ctx, topicId, parsed) {
     }
     if (page2.hasMore) continue;
     if (deadline !== void 0 && now() >= deadline) {
-      return report2(ctx, parsed, { found: false, cursor });
+      return report(ctx, parsed, { found: false, cursor });
     }
     const wait2 = deadline === void 0 ? intervalMs : Math.min(intervalMs, Math.max(0, deadline - now()));
     await sleep(wait2);
   }
 }
-function report2(ctx, parsed, result) {
+function report(ctx, parsed, result) {
   if (ctx.json) {
     ctx.out.log(JSON.stringify(result, null, 2));
   } else if (parsed.options.jsonl !== true && result.found) {
@@ -10733,7 +10460,7 @@ function eventLabel(event) {
   const body = event.payload.message?.body?.replace(/\s+/g, " ").trim();
   return body || event.payload.entityId;
 }
-function report3(ctx, parsed, result) {
+function report2(ctx, parsed, result) {
   if (ctx.json) ctx.out.log(JSON.stringify(result, null, 2));
   else if (parsed.options.jsonl !== true && result.found) {
     for (const event of result.events ?? []) {
@@ -10793,7 +10520,7 @@ async function pmWatch(ctx, parsed) {
       });
       if (consecutiveFailures >= MAX_CONSECUTIVE_FAILURES2) throw error;
       if (deadline !== void 0 && now() >= deadline) {
-        return report3(ctx, parsed, { found: false, cursor: cursor ?? "" });
+        return report2(ctx, parsed, { found: false, cursor: cursor ?? "" });
       }
       const backoff = Math.min(
         MAX_BACKOFF_MS2,
@@ -10834,7 +10561,7 @@ async function pmWatch(ctx, parsed) {
         cursor,
         serverTime: current.serverTime
       });
-      return report3(ctx, parsed, { found: true, cursor, events: matching });
+      return report2(ctx, parsed, { found: true, cursor, events: matching });
     }
     if (current.events.length > 0) {
       jsonl2(ctx, parsed, {
@@ -10853,7 +10580,7 @@ async function pmWatch(ctx, parsed) {
     }
     if (current.hasMore) continue;
     if (deadline !== void 0 && now() >= deadline) {
-      return report3(ctx, parsed, { found: false, cursor });
+      return report2(ctx, parsed, { found: false, cursor });
     }
     await sleep(
       deadline === void 0 ? intervalMs : Math.min(intervalMs, Math.max(0, deadline - now()))
@@ -12044,7 +11771,7 @@ async function assessImpact(ctx, surfaces, all, limit) {
   return out;
 }
 var editHint = (slug, appId) => `odla-ai runbook edit ${slug}${appId === PLATFORM_SCOPE ? "" : ` --app ${appId}`} --note "<what changed>"`;
-function report4(ctx, impacts) {
+function report3(ctx, impacts) {
   const covered = impacts.filter((i) => i.runbooks.length);
   ctx.out.log(
     `${impacts.length} changed surface${impacts.length === 1 ? "" : "s"}; ${covered.length} covered by a runbook. Reread each one and fix any step this change made wrong.`
@@ -12082,7 +11809,7 @@ async function runbookImpact(ctx, options, deps = {}) {
   }
   const impacts = await assessImpact(ctx, surfaces, options.all, options.limit ?? 4);
   if (ctx.json) return ctx.out.log(JSON.stringify({ base: options.base, impacts }, null, 2));
-  report4(ctx, impacts);
+  report3(ctx, impacts);
 }
 
 // src/runbook-lint.ts
@@ -12582,7 +12309,6 @@ async function runbookCommand(parsed, deps = {}) {
 }
 
 // src/security-command-context.ts
-import { createInterface } from "readline/promises";
 async function hostedSecurityContext(parsed, dependencies) {
   const configPath = stringOpt(parsed.options.config) ?? "odla.config.mjs";
   const cfg = await loadProjectConfig(configPath);
@@ -12601,21 +12327,11 @@ async function hostedSecurityContext(parsed, dependencies) {
     cfg,
     { configPath, email: stringOpt(parsed.options.email), open, openApprovalUrl: dependencies.openUrl },
     doFetch,
-    stdout
+    stdout,
+    { optionalProjectCapabilities: ["app.manage"] }
   );
   return { platform, token, appId: cfg.app.id, env, fetch: doFetch, stdout };
 }
-async function interactiveConfirmation(message2, dependencies) {
-  if (dependencies.confirm) return dependencies.confirm(message2);
-  if (!process.stdin.isTTY || !process.stdout.isTTY) return false;
-  const prompt = createInterface({ input: process.stdin, output: process.stdout });
-  try {
-    const answer = await prompt.question(`${message2} [y/N] `);
-    return /^y(?:es)?$/i.test(answer.trim());
-  } finally {
-    prompt.close();
-  }
-}
 function requiredSecurityPositional(parsed, index, label) {
   const value2 = parsed.positionals[index];
   if (!value2) throw new Error(`${label} is required`);
@@ -12681,31 +12397,31 @@ function printHostedJob(out, job, platform, appId) {
   url.searchParams.set("job", job.jobId);
   out.log(`  Studio: ${url.toString()}`);
 }
-function printHostedReport(out, report5) {
-  out.log(`security report ${report5.jobId}: ${report5.repository}@${report5.revision}`);
-  out.log(`  coverage: ${report5.coverageStatus} cells=${report5.metrics.coverageCells} shallow=${report5.metrics.shallowCells} blocked=${report5.metrics.blockedCells} unscheduled=${report5.metrics.unscheduledCells} budget_exhausted=${report5.metrics.budgetExhaustedCells}`);
-  out.log(`  findings: confirmed=${report5.metrics.confirmed} needs_reproduction=${report5.metrics.needsReproduction} candidates=${report5.metrics.candidates} rejected=${report5.metrics.rejected}`);
-  out.log(`  discovery: ${report5.provenance.discovery?.provider ?? "unknown"}/${report5.provenance.discovery?.model ?? "unknown"}`);
-  out.log(`  validation: ${report5.provenance.validation?.provider ?? "unknown"}/${report5.provenance.validation?.model ?? "unknown"} independent=${String(report5.provenance.independentValidation)}`);
-  for (const finding of report5.findings) {
+function printHostedReport(out, report4) {
+  out.log(`security report ${report4.jobId}: ${report4.repository}@${report4.revision}`);
+  out.log(`  coverage: ${report4.coverageStatus} cells=${report4.metrics.coverageCells} shallow=${report4.metrics.shallowCells} blocked=${report4.metrics.blockedCells} unscheduled=${report4.metrics.unscheduledCells} budget_exhausted=${report4.metrics.budgetExhaustedCells}`);
+  out.log(`  findings: confirmed=${report4.metrics.confirmed} needs_reproduction=${report4.metrics.needsReproduction} candidates=${report4.metrics.candidates} rejected=${report4.metrics.rejected}`);
+  out.log(`  discovery: ${report4.provenance.discovery?.provider ?? "unknown"}/${report4.provenance.discovery?.model ?? "unknown"}`);
+  out.log(`  validation: ${report4.provenance.validation?.provider ?? "unknown"}/${report4.provenance.validation?.model ?? "unknown"} independent=${String(report4.provenance.independentValidation)}`);
+  for (const finding of report4.findings) {
     const location = finding.locations[0];
     out.log(`  [${finding.severity}] ${finding.title}${location ? ` (${location.path}:${location.line})` : ""} \xB7 ${finding.disposition}`);
   }
-  for (const limitation of report5.limitations) out.log(`  limitation: ${limitation}`);
+  for (const limitation of report4.limitations) out.log(`  limitation: ${limitation}`);
 }
-function enforceHostedReportGate(report5, parsed, out, emitSuccess) {
+function enforceHostedReportGate(report4, parsed, out, emitSuccess) {
   const failOn = hostedSeverity(stringOpt(parsed.options["fail-on"]) ?? "high", "--fail-on");
   const candidateValue = parsed.options["fail-on-candidates"];
   const failOnCandidates = candidateValue === false ? void 0 : hostedSeverity(stringOpt(candidateValue) ?? "critical", "--fail-on-candidates");
   const atOrAbove = (severity, threshold) => HOSTED_SEVERITIES.indexOf(severity) >= HOSTED_SEVERITIES.indexOf(threshold);
-  const confirmed = report5.findings.filter((finding) => finding.disposition === "confirmed" && atOrAbove(finding.severity, failOn));
-  const leads = failOnCandidates ? report5.findings.filter((finding) => finding.disposition !== "confirmed" && atOrAbove(finding.severity, failOnCandidates)) : [];
-  const incomplete = report5.coverageStatus !== "complete" && parsed.options["allow-incomplete"] !== true;
+  const confirmed = report4.findings.filter((finding) => finding.disposition === "confirmed" && atOrAbove(finding.severity, failOn));
+  const leads = failOnCandidates ? report4.findings.filter((finding) => finding.disposition !== "confirmed" && atOrAbove(finding.severity, failOnCandidates)) : [];
+  const incomplete = report4.coverageStatus !== "complete" && parsed.options["allow-incomplete"] !== true;
   if (confirmed.length || leads.length || incomplete) {
-    throw new Error(`hosted security gate failed: ${confirmed.length} confirmed >= ${failOn}; ${leads.length} leads >= ${failOnCandidates ?? "disabled"}${incomplete ? `; coverage ${report5.coverageStatus}` : ""}`);
+    throw new Error(`hosted security gate failed: ${confirmed.length} confirmed >= ${failOn}; ${leads.length} leads >= ${failOnCandidates ?? "disabled"}${incomplete ? `; coverage ${report4.coverageStatus}` : ""}`);
   }
   if (emitSuccess) {
-    out.log(`security gate passed: 0 confirmed >= ${failOn}; 0 leads >= ${failOnCandidates ?? "disabled"}; coverage ${report5.coverageStatus}. This is not proof that the application is secure.`);
+    out.log(`security gate passed: 0 confirmed >= ${failOn}; 0 leads >= ${failOnCandidates ?? "disabled"}; coverage ${report4.coverageStatus}. This is not proof that the application is secure.`);
   }
 }
 function printHostedSecurityPlanRoute(out, label, route2) {
@@ -12809,13 +12525,13 @@ async function runSourceSecurityCommand(parsed, dependencies, sourceId) {
     }
     throw new Error(`hosted security job ${result.jobId} ended ${result.status}${result.errorCode ? `: ${result.errorCode}` : ""}`);
   }
-  const report5 = await getHostedSecurityReport({ ...context, jobId: result.jobId });
+  const report4 = await getHostedSecurityReport({ ...context, jobId: result.jobId });
   if (parsed.options.json === true) {
-    context.stdout.log(JSON.stringify({ plan, intent: preview.intent, job: result, report: report5 }, null, 2));
+    context.stdout.log(JSON.stringify({ plan, intent: preview.intent, job: result, report: report4 }, null, 2));
   } else {
-    printHostedReport(context.stdout, report5);
+    printHostedReport(context.stdout, report4);
   }
-  enforceHostedReportGate(report5, parsed, context.stdout, parsed.options.json !== true);
+  enforceHostedReportGate(report4, parsed, context.stdout, parsed.options.json !== true);
 }
 async function runLocalSecurityCommand(parsed, dependencies) {
   if (parsed.options.source === true) {
@@ -12876,19 +12592,20 @@ async function runLocalSecurityCommand(parsed, dependencies) {
         cfg,
         { configPath, email: stringOpt(parsed.options.email), open, openApprovalUrl: dependencies.openUrl },
         doFetch,
-        out
+        out,
+        { optionalProjectCapabilities: ["app.manage"] }
       );
     }
   });
   enforceLocalGate(result.report, parsed);
 }
-function enforceLocalGate(report5, parsed) {
+function enforceLocalGate(report4, parsed) {
   const failOn = severityOpt(stringOpt(parsed.options["fail-on"]) ?? "high", "--fail-on");
   const candidateValue = parsed.options["fail-on-candidates"];
   const failOnCandidates = candidateValue === false ? void 0 : severityOpt(stringOpt(candidateValue) ?? "critical", "--fail-on-candidates");
-  const confirmed = findingsAtOrAbove(report5, failOn);
-  const leads = failOnCandidates ? findingsAtOrAbove(report5, failOnCandidates, true).filter((finding) => finding.disposition !== "confirmed") : [];
-  const incomplete = report5.coverageStatus === "incomplete" && parsed.options["allow-incomplete"] !== true;
+  const confirmed = findingsAtOrAbove(report4, failOn);
+  const leads = failOnCandidates ? findingsAtOrAbove(report4, failOnCandidates, true).filter((finding) => finding.disposition !== "confirmed") : [];
+  const incomplete = report4.coverageStatus === "incomplete" && parsed.options["allow-incomplete"] !== true;
   if (confirmed.length || leads.length || incomplete) {
     throw new Error(`hosted security gate failed: ${confirmed.length} confirmed >= ${failOn}; ${leads.length} leads >= ${failOnCandidates ?? "disabled"}${incomplete ? "; coverage incomplete" : ""}`);
   }
@@ -12927,9 +12644,9 @@ async function securityCommand(parsed, dependencies) {
     assertArgs(parsed, ["config", "env", "platform", "email", "open", "json"], 3);
     const jobId = requiredSecurityPositional(parsed, 2, "job id");
     const context = await hostedSecurityContext(parsed, dependencies);
-    const report5 = await getHostedSecurityReport({ ...context, jobId });
-    if (parsed.options.json === true) context.stdout.log(JSON.stringify(report5, null, 2));
-    else printHostedReport(context.stdout, report5);
+    const report4 = await getHostedSecurityReport({ ...context, jobId });
+    if (parsed.options.json === true) context.stdout.log(JSON.stringify(report4, null, 2));
+    else printHostedReport(context.stdout, report4);
     return;
   }
   if (sub !== "run") {
@@ -12943,35 +12660,24 @@ async function githubSecurityCommand(parsed, dependencies) {
   const action2 = parsed.positionals[2];
   if (action2 === "disconnect") {
     assertArgs(parsed, ["config", "env", "platform", "source", "email", "open", "yes"], 3);
-    const context2 = await hostedSecurityContext(parsed, dependencies);
     const sourceId = requiredString(parsed.options.source, "--source");
-    const confirmed = parsed.options.yes === true || await interactiveConfirmation(
-      `Disconnect GitHub security source ${sourceId} from ${context2.appId}/${context2.env}?`,
-      dependencies
+    return requireStudioHuman(
+      stringOpt(parsed.options.config) ?? "odla.config.mjs",
+      `disconnecting GitHub security source ${sourceId}`,
+      "security",
+      stringOpt(parsed.options.env)
     );
-    if (!confirmed) {
-      throw new Error("GitHub source disconnect cancelled; pass --yes in a non-interactive shell");
-    }
-    await disconnectGitHubSecuritySource({ ...context2, sourceId });
-    context2.stdout.log(`github: disconnected ${sourceId} from ${context2.appId}/${context2.env}`);
-    return;
   }
   if (action2 !== "connect") {
     throw new Error('unknown security github command. Try "odla-ai security github connect".');
   }
   assertArgs(parsed, ["config", "env", "platform", "repo", "email", "open"], 3);
-  const context = await hostedSecurityContext(parsed, dependencies);
-  const repository = stringOpt(parsed.options.repo) ?? await inferGitHubRepository(process.cwd(), dependencies.readGitOrigin).catch(() => void 0);
-  const connection = await connectGitHubSecuritySource({
-    ...context,
-    ...repository === void 0 ? {} : { repository },
-    open: parsed.options.open !== false,
-    openInstallUrl: dependencies.openUrl ?? openUrl,
-    wait: dependencies.pollWait,
-    stdout: context.stdout
-  });
-  context.stdout.log(`github: connected ${connection.repository ?? repository ?? "app repository"} (${connection.sourceId ?? "source pending"})`);
-  context.stdout.log("github: odla.ai stores the installation; no PAT or GitHub token is written locally");
+  await requireStudioHuman(
+    stringOpt(parsed.options.config) ?? "odla.config.mjs",
+    "connecting the GitHub security repository",
+    "security",
+    stringOpt(parsed.options.env)
+  );
 }
 async function listSecuritySources(parsed, dependencies) {
   assertArgs(parsed, ["config", "env", "platform", "email", "open", "json"], 2);
@@ -13112,6 +12818,7 @@ async function provisionCommand(parsed, dependencies) {
     "write-credentials",
     "write-dev-vars",
     "token",
+    "request-grant",
     "email",
     "open",
     "wait",
@@ -13127,6 +12834,7 @@ async function provisionCommand(parsed, dependencies) {
     writeCredentials: parsed.options["write-credentials"] !== false,
     writeDevVars: typeof writeDevVars2 === "string" ? writeDevVars2 : writeDevVars2 === true,
     token: stringOpt(parsed.options.token),
+    requestGrant: parsed.options["request-grant"] === true,
     email: stringOpt(parsed.options.email),
     open: parsed.options.open === false ? false : parsed.options.open === true ? true : void 0,
     wait: numberOpt(parsed.options.wait, "--wait"),
@@ -13222,4 +12930,4 @@ export {
   exitCodeFor,
   runCli
 };
-//# sourceMappingURL=chunk-Y7WFLSTN.js.map
+//# sourceMappingURL=chunk-3YSCRXPF.js.map