@odla-ai/cli 0.4.0 → 0.6.0

package/dist/bin.cjs

@@ -28,31 +28,529 @@ var getImportMetaUrl = () => typeof document === "undefined" ? new URL(`file:${_
 var importMetaUrl = /* @__PURE__ */ getImportMetaUrl();
 
 // src/cli.ts
-var import_node_fs7 = require("fs");
+var import_security2 = require("@odla-ai/security");
 
-// src/config.ts
+// src/admin-ai.ts
+var import_node_process3 = __toESM(require("process"), 1);
+var import_node_fs2 = require("fs");
+var import_db2 = require("@odla-ai/db");
+
+// src/open.ts
+var import_node_child_process = require("child_process");
+var import_node_process = __toESM(require("process"), 1);
+async function openUrl(url, options = {}) {
+  const command = openerFor(options.platform ?? import_node_process.default.platform);
+  const doSpawn = options.spawnImpl ?? import_node_child_process.spawn;
+  await new Promise((resolve7, reject) => {
+    const child = doSpawn(command.cmd, [...command.args, url], {
+      stdio: "ignore",
+      detached: true
+    });
+    child.once("error", reject);
+    child.once("spawn", () => {
+      child.unref();
+      resolve7();
+    });
+  });
+}
+function openerFor(platform) {
+  if (platform === "darwin") return { cmd: "open", args: [] };
+  if (platform === "win32") return { cmd: "cmd", args: ["/c", "start", ""] };
+  return { cmd: "xdg-open", args: [] };
+}
+
+// src/token.ts
+var import_db = require("@odla-ai/db");
+var import_node_process2 = __toESM(require("process"), 1);
+
+// src/local.ts
 var import_node_fs = require("fs");
 var import_node_path = require("path");
+var GITIGNORE_LINES = [".odla/*.local.json", ".odla/dev-token.json", ".dev.vars"];
+function readJsonFile(path) {
+  try {
+    return JSON.parse((0, import_node_fs.readFileSync)(path, "utf8"));
+  } catch {
+    return null;
+  }
+}
+function writePrivateJson(path, value) {
+  writePrivateText(path, `${JSON.stringify(value, null, 2)}
+`);
+}
+function readCredentials(path) {
+  if (!(0, import_node_fs.existsSync)(path)) return null;
+  let value;
+  try {
+    value = JSON.parse((0, import_node_fs.readFileSync)(path, "utf8"));
+  } catch {
+    throw new Error(`credentials file ${path} is not valid JSON; fix or remove it before provisioning`);
+  }
+  if (!value || typeof value !== "object" || typeof value.appId !== "string" || !value.envs || typeof value.envs !== "object") {
+    throw new Error(`credentials file ${path} has an invalid shape; fix or remove it before provisioning`);
+  }
+  return value;
+}
+function mergeCredential(current, update) {
+  const next = current ?? {
+    appId: update.appId,
+    platformUrl: update.platformUrl,
+    dbEndpoint: update.dbEndpoint,
+    updatedAt: (/* @__PURE__ */ new Date(0)).toISOString(),
+    envs: {}
+  };
+  next.appId = update.appId;
+  next.platformUrl = update.platformUrl;
+  next.dbEndpoint = update.dbEndpoint;
+  next.updatedAt = (/* @__PURE__ */ new Date()).toISOString();
+  next.envs[update.env] = {
+    ...next.envs[update.env] ?? {},
+    tenantId: update.tenantId,
+    ...update.dbKey ? { dbKey: update.dbKey } : {},
+    ...update.o11yToken ? { o11yToken: update.o11yToken } : {}
+  };
+  return next;
+}
+function ensureGitignore(rootDir, localPaths = []) {
+  const path = (0, import_node_path.resolve)(rootDir, ".gitignore");
+  const existing = (0, import_node_fs.existsSync)(path) ? (0, import_node_fs.readFileSync)(path, "utf8") : "";
+  const configured = localPaths.map((localPath) => gitignoreEntry(rootDir, localPath)).filter((line) => !!line);
+  const wanted = [.../* @__PURE__ */ new Set([...GITIGNORE_LINES, ...configured])];
+  const missing = wanted.filter((line) => !existing.split(/\r?\n/).includes(line));
+  if (missing.length === 0) return;
+  const prefix = existing && !existing.endsWith("\n") ? "\n" : "";
+  (0, import_node_fs.writeFileSync)(path, `${existing}${prefix}${missing.join("\n")}
+`);
+}
+function o11yDevVars(cfg) {
+  if (!cfg.services.includes("o11y")) return void 0;
+  return {
+    endpoint: cfg.o11y?.endpoint ?? "https://o11y.odla.ai",
+    service: cfg.o11y?.service ?? cfg.app.id,
+    ...cfg.o11y?.version ? { version: cfg.o11y.version } : {}
+  };
+}
+function resolveWriteDevVarsTarget(cfg, requested) {
+  if (!requested) return null;
+  if (requested === true) return cfg.local.devVarsFile;
+  return (0, import_node_path.resolve)((0, import_node_path.dirname)(cfg.configPath), requested);
+}
+function writeDevVars(path, credentials, env, o11y) {
+  const entry = credentials.envs[env];
+  if (!entry) throw new Error(`no credentials for env "${env}" in ${path}`);
+  const lines = [`ODLA_PLATFORM="${credentials.platformUrl}"`];
+  if (entry.dbKey) lines.push(`ODLA_ENDPOINT="${credentials.dbEndpoint}"`);
+  lines.push(`ODLA_APP_ID="${credentials.appId}"`, `ODLA_ENV="${env}"`, `ODLA_TENANT="${entry.tenantId}"`);
+  if (entry.dbKey) lines.push(`ODLA_API_KEY="${entry.dbKey}"`);
+  if (o11y) {
+    lines.push(`ODLA_O11Y_ENDPOINT="${o11y.endpoint}"`, `ODLA_O11Y_SERVICE="${o11y.service}"`);
+    if (o11y.version) lines.push(`ODLA_O11Y_VERSION="${o11y.version}"`);
+    if (entry.o11yToken) lines.push(`ODLA_O11Y_TOKEN="${entry.o11yToken}"`);
+  }
+  const existing = (0, import_node_fs.existsSync)(path) ? (0, import_node_fs.readFileSync)(path, "utf8") : "";
+  const retained = existing.split(/\r?\n/).filter((line) => !isManagedDevVar(line));
+  while (retained.at(-1) === "") retained.pop();
+  const prefix = retained.length ? `${retained.join("\n")}
+
+` : "";
+  writePrivateText(path, `${prefix}${lines.join("\n")}
+`);
+}
+var MANAGED_DEV_VARS = /* @__PURE__ */ new Set([
+  "ODLA_PLATFORM",
+  "ODLA_ENDPOINT",
+  "ODLA_APP_ID",
+  "ODLA_ENV",
+  "ODLA_TENANT",
+  "ODLA_API_KEY",
+  "ODLA_O11Y_ENDPOINT",
+  "ODLA_O11Y_SERVICE",
+  "ODLA_O11Y_VERSION",
+  "ODLA_O11Y_TOKEN"
+]);
+function isManagedDevVar(line) {
+  const match = line.match(/^\s*(?:export\s+)?([A-Z][A-Z0-9_]*)\s*=/);
+  return !!match?.[1] && MANAGED_DEV_VARS.has(match[1]);
+}
+function writePrivateText(path, text) {
+  (0, import_node_fs.mkdirSync)((0, import_node_path.dirname)(path), { recursive: true });
+  const temporary = `${path}.tmp-${process.pid}-${Date.now()}`;
+  (0, import_node_fs.writeFileSync)(temporary, text, { mode: 384 });
+  (0, import_node_fs.chmodSync)(temporary, 384);
+  (0, import_node_fs.renameSync)(temporary, path);
+}
+function gitignoreEntry(rootDir, path) {
+  const rel = (0, import_node_path.relative)((0, import_node_path.resolve)(rootDir), (0, import_node_path.resolve)(path));
+  if (!rel || rel === ".." || rel.startsWith(`..${process.platform === "win32" ? "\\" : "/"}`) || (0, import_node_path.isAbsolute)(rel)) return null;
+  return rel.replaceAll("\\", "/");
+}
+function displayPath(path, rootDir = process.cwd()) {
+  const rel = (0, import_node_path.relative)(rootDir, path);
+  return rel && !rel.startsWith("..") ? rel : path;
+}
+
+// src/token.ts
+async function getDeveloperToken(cfg, options, doFetch, out) {
+  if (options.token) return options.token;
+  if (import_node_process2.default.env.ODLA_DEV_TOKEN) return import_node_process2.default.env.ODLA_DEV_TOKEN;
+  const cached = readJsonFile(cfg.local.tokenFile);
+  if (cached?.token && (cached.expiresAt ?? 0) > Date.now() + 6e4) {
+    out.log(`auth: using cached developer token (${displayPath(cfg.local.tokenFile, cfg.rootDir)})`);
+    return cached.token;
+  }
+  const browser = approvalBrowser(options);
+  const { token, expiresAt } = await (0, import_db.requestToken)({
+    endpoint: cfg.platformUrl,
+    label: `${cfg.app.id} provisioner`,
+    fetch: doFetch,
+    onCode: async ({ userCode, expiresIn }) => {
+      const approvalUrl = handshakeUrl(cfg.platformUrl, userCode);
+      out.log("");
+      out.log(`Approve code ${userCode} at ${approvalUrl} within ${Math.floor(expiresIn / 60)}m.`);
+      if (browser.open) {
+        try {
+          await (options.openApprovalUrl ?? openUrl)(approvalUrl);
+          out.log(`auth: opened browser for approval${browser.mode === "auto" ? " (auto)" : ""}`);
+        } catch (err) {
+          out.log(`auth: could not open browser (${err instanceof Error ? err.message : String(err)})`);
+        }
+      } else if (browser.reason) {
+        out.log(`auth: browser launch skipped (${browser.reason})`);
+      }
+      out.log("");
+    }
+  });
+  writePrivateJson(cfg.local.tokenFile, { token, expiresAt });
+  out.log(`auth: developer token cached (${displayPath(cfg.local.tokenFile, cfg.rootDir)})`);
+  return token;
+}
+function approvalBrowser(options) {
+  if (options.open === true) return { open: true, mode: "forced" };
+  if (options.open === false) return { open: false, reason: "disabled by --no-open" };
+  if (import_node_process2.default.env.CI) return { open: false, reason: "CI environment" };
+  const interactive = options.interactive ?? Boolean(import_node_process2.default.stdin.isTTY && import_node_process2.default.stdout.isTTY);
+  if (!interactive) return { open: false, reason: "non-interactive shell; pass --open to force" };
+  return { open: true, mode: "auto" };
+}
+function handshakeUrl(platformUrl, userCode) {
+  const url = new URL("/studio", platformUrl);
+  url.searchParams.set("code", userCode);
+  return url.toString();
+}
+
+// src/admin-ai.ts
+var SYSTEM_AI_PURPOSES = ["o11y.triage", "security.discovery", "security.validation"];
+async function getScopedPlatformToken(options) {
+  const fromEnv = import_node_process3.default.env.ODLA_ADMIN_TOKEN;
+  if (fromEnv) return fromEnv;
+  return scopedToken(
+    options.platform.replace(/\/$/, ""),
+    options.scope,
+    { action: "show", ...options },
+    options.fetch ?? fetch,
+    options.stdout ?? console
+  );
+}
+async function adminAi(options) {
+  const platform = (options.platform ?? import_node_process3.default.env.ODLA_PLATFORM ?? "https://odla.ai").replace(/\/$/, "");
+  const doFetch = options.fetch ?? fetch;
+  const out = options.stdout ?? console;
+  const scope = options.action === "set" || options.action === "credential-set" ? "platform:ai:write" : "platform:ai:read";
+  const token = options.token ?? import_node_process3.default.env.ODLA_ADMIN_TOKEN ?? await scopedToken(platform, scope, options, doFetch, out);
+  const headers = { authorization: `Bearer ${token}`, "content-type": "application/json" };
+  if (options.action === "credentials") {
+    const res2 = await doFetch(`${platform}/registry/platform/ai-credentials`, { headers });
+    const body2 = await responseBody(res2);
+    if (!res2.ok) throw new Error(apiError("read platform AI credential status", res2.status, body2));
+    const credentials = isRecord(body2) && isRecord(body2.credentials) ? body2.credentials : body2;
+    if (options.json) out.log(JSON.stringify({ credentials }, null, 2));
+    else for (const [provider, status] of Object.entries(isRecord(credentials) ? credentials : {})) {
+      out.log(`${provider}	${isRecord(status) && status.set === true ? "set" : "not set"}`);
+    }
+    return;
+  }
+  if (options.action === "credential-set") {
+    const provider = requireProvider(options.credentialProvider);
+    const value = await credentialValue(options);
+    const res2 = await doFetch(`${platform}/registry/platform/ai-credentials/${encodeURIComponent(provider)}`, {
+      method: "PUT",
+      headers,
+      body: JSON.stringify({ value })
+    });
+    const body2 = await responseBody(res2);
+    if (!res2.ok) throw new Error(apiError(`store ${provider} platform credential`, res2.status, body2));
+    out.log(`stored ${provider} platform credential (write-only; value was not returned)`);
+    return;
+  }
+  if (options.action === "show") {
+    const res2 = await doFetch(`${platform}/registry/platform/ai-policies`, { headers });
+    const body2 = await responseBody(res2);
+    if (!res2.ok) throw new Error(apiError("read platform AI policies", res2.status, body2));
+    const policies = policyArray(body2);
+    if (options.json) {
+      out.log(JSON.stringify({ policies }, null, 2));
+      return;
+    }
+    out.log("purpose	enabled	provider	model	max calls	max input bytes	max output tokens");
+    for (const policy2 of policies) {
+      out.log([
+        policy2.purpose,
+        String(policy2.enabled),
+        policy2.provider,
+        policy2.model,
+        String(policy2.maxCallsPerRun ?? ""),
+        String(policy2.maxInputBytes ?? ""),
+        String(policy2.maxOutputTokens ?? "")
+      ].join("	"));
+    }
+    return;
+  }
+  const purpose = requirePurpose(options.purpose);
+  if (!options.provider?.trim()) throw new Error("--provider is required");
+  if (!options.model?.trim()) throw new Error("--model is required");
+  const body = {
+    provider: options.provider.trim(),
+    model: options.model.trim(),
+    ...options.enabled === void 0 ? {} : { enabled: options.enabled },
+    ...options.maxInputBytes === void 0 ? {} : { maxInputBytes: options.maxInputBytes },
+    ...options.maxOutputTokens === void 0 ? {} : { maxOutputTokens: options.maxOutputTokens },
+    ...options.maxCallsPerRun === void 0 ? {} : { maxCallsPerRun: options.maxCallsPerRun }
+  };
+  const res = await doFetch(`${platform}/registry/platform/ai-policies/${encodeURIComponent(purpose)}`, {
+    method: "PUT",
+    headers,
+    body: JSON.stringify(body)
+  });
+  const response = await responseBody(res);
+  if (!res.ok) throw new Error(apiError(`update ${purpose}`, res.status, response));
+  const policy = isRecord(response) && isRecord(response.policy) ? response.policy : isRecord(response) ? response : {};
+  out.log(options.json ? JSON.stringify({ policy }, null, 2) : `updated ${purpose}: ${String(policy.provider ?? body.provider)}/${String(policy.model ?? body.model)}`);
+}
+async function scopedToken(platform, scope, options, doFetch, out) {
+  const tokenFile = options.tokenFile ?? `${import_node_process3.default.cwd()}/.odla/admin-token.local.json`;
+  const cache = readJsonFile(tokenFile);
+  const cached = cache?.platform === platform ? cache.tokens?.[scope] : void 0;
+  if (cached?.token && (cached.expiresAt ?? 0) > Date.now() + 6e4) {
+    out.log(`auth: using cached ${scope} grant (${tokenFile})`);
+    return cached.token;
+  }
+  const { token, expiresAt } = await (0, import_db2.requestToken)({
+    endpoint: platform,
+    label: `odla CLI admin AI (${scope})`,
+    scopes: [scope],
+    fetch: doFetch,
+    onCode: async ({ userCode, expiresIn }) => {
+      const approvalUrl = handshakeUrl(platform, userCode);
+      out.log(`Approve scoped request ${userCode} at ${approvalUrl} within ${Math.floor(expiresIn / 60)}m.`);
+      const shouldOpen = options.open === true || options.open !== false && !import_node_process3.default.env.CI && Boolean(import_node_process3.default.stdin.isTTY && import_node_process3.default.stdout.isTTY);
+      if (shouldOpen) await (options.openApprovalUrl ?? openUrl)(approvalUrl).catch(() => void 0);
+    }
+  });
+  const tokens = cache?.platform === platform ? { ...cache.tokens ?? {} } : {};
+  tokens[scope] = { token, expiresAt };
+  if ((0, import_node_fs2.existsSync)(`${import_node_process3.default.cwd()}/.git`)) ensureGitignore(import_node_process3.default.cwd(), [tokenFile]);
+  writePrivateJson(tokenFile, { platform, tokens });
+  out.log(`auth: cached ${scope} grant (${tokenFile}; mode 0600)`);
+  return token;
+}
+function requirePurpose(value) {
+  if (!SYSTEM_AI_PURPOSES.includes(value)) {
+    throw new Error(`purpose must be one of: ${SYSTEM_AI_PURPOSES.join(", ")}`);
+  }
+  return value;
+}
+function requireProvider(value) {
+  if (value !== "anthropic" && value !== "openai" && value !== "google") {
+    throw new Error("provider must be one of: anthropic, openai, google");
+  }
+  return value;
+}
+async function credentialValue(options) {
+  if (options.fromEnv && options.stdin) throw new Error("choose exactly one of --from-env or --stdin");
+  let value;
+  if (options.fromEnv) value = import_node_process3.default.env[options.fromEnv];
+  else if (options.stdin) value = await (options.readStdin ?? readStdin)();
+  else throw new Error("credential input required: use --from-env <NAME> or --stdin; values are never accepted as arguments");
+  value = value?.replace(/[\r\n]+$/, "");
+  if (!value) throw new Error(options.fromEnv ? `environment variable ${options.fromEnv} is empty or unset` : "stdin credential is empty");
+  if (new TextEncoder().encode(value).byteLength > 64 * 1024) throw new Error("credential exceeds 64 KiB");
+  return value;
+}
+async function readStdin() {
+  let value = "";
+  for await (const chunk of import_node_process3.default.stdin) {
+    value += String(chunk);
+    if (value.length > 64 * 1024) throw new Error("credential exceeds 64 KiB");
+  }
+  return value;
+}
+function policyArray(body) {
+  if (isRecord(body) && Array.isArray(body.policies)) return body.policies.filter(isRecord);
+  if (isRecord(body) && isRecord(body.policies)) return Object.values(body.policies).filter(isRecord);
+  throw new Error("platform returned an invalid AI policy response");
+}
+async function responseBody(res) {
+  const text = await res.text();
+  if (!text) return {};
+  try {
+    return JSON.parse(text);
+  } catch {
+    return { message: text.slice(0, 300) };
+  }
+}
+function apiError(action, status, body) {
+  const error = isRecord(body) && isRecord(body.error) ? body.error : void 0;
+  const message = error && typeof error.message === "string" ? error.message : isRecord(body) && typeof body.message === "string" ? body.message : "request failed";
+  return `${action} failed (${status}): ${message}`;
+}
+function isRecord(value) {
+  return Boolean(value) && typeof value === "object" && !Array.isArray(value);
+}
+
+// src/argv.ts
+function parseArgv(argv) {
+  const positionals = [];
+  const options = {};
+  for (let i = 0; i < argv.length; i++) {
+    const arg = argv[i];
+    if (!arg.startsWith("--")) {
+      positionals.push(arg);
+      continue;
+    }
+    const eq = arg.indexOf("=");
+    const rawName = arg.slice(2, eq === -1 ? void 0 : eq);
+    if (!rawName) continue;
+    if (rawName.startsWith("no-")) {
+      options[rawName.slice(3)] = false;
+      continue;
+    }
+    if (eq !== -1) {
+      addOption(options, rawName, arg.slice(eq + 1));
+      continue;
+    }
+    const value = argv[i + 1];
+    if (value !== void 0 && !value.startsWith("--")) {
+      i++;
+      addOption(options, rawName, value);
+    } else {
+      addOption(options, rawName, true);
+    }
+  }
+  return { positionals, options };
+}
+function assertArgs(parsed, allowedOptions, maxPositionals) {
+  const allowed = new Set(allowedOptions);
+  for (const name of Object.keys(parsed.options)) {
+    if (!allowed.has(name)) throw new Error(`unknown option "--${name}"; run "odla-ai help" for supported options`);
+  }
+  if (parsed.positionals.length > maxPositionals) {
+    throw new Error(`unexpected argument "${parsed.positionals[maxPositionals]}"; run "odla-ai help"`);
+  }
+}
+function requiredString(value, name) {
+  const result = stringOpt(value);
+  if (!result) throw new Error(`${name} is required`);
+  return result;
+}
+function stringOpt(value) {
+  if (typeof value === "string") return value;
+  if (Array.isArray(value)) return value[value.length - 1];
+  return void 0;
+}
+function listOpt(value) {
+  if (value === void 0 || typeof value === "boolean") return void 0;
+  const values = Array.isArray(value) ? value : [value];
+  return values.flatMap((item) => item.split(",")).map((item) => item.trim()).filter(Boolean);
+}
+function boolOpt(value) {
+  if (typeof value === "boolean") return value;
+  if (typeof value === "string" && (value === "true" || value === "false")) return value === "true";
+  if (value === void 0) return void 0;
+  throw new Error("boolean option must be true or false");
+}
+function numberOpt(value, flag) {
+  if (value === void 0) return void 0;
+  const raw = stringOpt(value);
+  const parsed = raw === void 0 ? Number.NaN : Number(raw);
+  if (!Number.isSafeInteger(parsed) || parsed < 1) throw new Error(`${flag} requires a positive integer`);
+  return parsed;
+}
+function addOption(options, name, value) {
+  const current = options[name];
+  if (current === void 0) options[name] = value;
+  else if (Array.isArray(current)) current.push(String(value));
+  else options[name] = [String(current), String(value)];
+}
+
+// src/capabilities.ts
+var CAPABILITIES = {
+  cli: [
+    "register the app and enable configured services per environment",
+    "issue, persist, and explicitly rotate configured service credentials",
+    "write local Worker values and push deployed Worker secrets through Wrangler stdin",
+    "push db schema/rules and configure platform AI, auth, and deployment links",
+    "validate config offline and smoke-test a provisioned db environment",
+    "run app-attributed hosted security discovery and independent validation without provider keys",
+    "let admins manage system AI routes/credentials through short-lived exact-scope approval"
+  ],
+  agent: [
+    "install and import the selected odla SDKs",
+    "wrap the Worker with withObservability and choose useful telemetry",
+    "make application-specific schema, rules, auth, UI, and migration decisions"
+  ],
+  human: [
+    "approve the odla device code and one-off third-party logins",
+    "consent to production changes with --yes",
+    "request destructive credential rotation explicitly",
+    "review application semantics, security findings, releases, and merges",
+    "approve redacted-source disclosure before hosted security reasoning"
+  ],
+  studio: [
+    "view telemetry and environment state",
+    "perform manual credential recovery when the CLI's local shown-once copy is unavailable",
+    "configure system AI purposes and view app/environment/run-attributed usage"
+  ]
+};
+function printCapabilities(json = false, out = console) {
+  if (json) {
+    out.log(JSON.stringify(CAPABILITIES, null, 2));
+    return;
+  }
+  out.log("odla-ai responsibility boundary\n");
+  printGroup(out, "CLI automates", CAPABILITIES.cli);
+  printGroup(out, "Coding agent changes source", CAPABILITIES.agent);
+  printGroup(out, "Human checkpoints", CAPABILITIES.human);
+  printGroup(out, "Studio", CAPABILITIES.studio);
+}
+function printGroup(out, heading, items) {
+  out.log(`${heading}:`);
+  for (const item of items) out.log(`  - ${item}`);
+  out.log("");
+}
+
+// src/config.ts
+var import_node_fs3 = require("fs");
+var import_node_path2 = require("path");
 var import_node_url = require("url");
 var DEFAULT_PLATFORM = "https://odla.ai";
-var DEFAULT_ENVS = ["prod", "dev"];
+var DEFAULT_ENVS = ["dev"];
 var DEFAULT_SERVICES = ["db", "ai"];
 async function loadProjectConfig(configPath = "odla.config.mjs") {
-  const resolved = (0, import_node_path.resolve)(configPath);
-  if (!(0, import_node_fs.existsSync)(resolved)) {
+  const resolved = (0, import_node_path2.resolve)(configPath);
+  if (!(0, import_node_fs3.existsSync)(resolved)) {
     throw new Error(`config not found: ${configPath}. Run "odla-ai init" first or pass --config.`);
   }
   const raw = await loadConfigModule(resolved);
-  const rootDir = (0, import_node_path.dirname)(resolved);
+  const rootDir = (0, import_node_path2.dirname)(resolved);
   validateRawConfig(raw, resolved);
   const platformUrl = trimSlash(process.env.ODLA_PLATFORM_URL || raw.platformUrl || DEFAULT_PLATFORM);
   const dbEndpoint = trimSlash(process.env.ODLA_DB_ENDPOINT || raw.dbEndpoint || platformUrl);
   const envs = unique(raw.envs?.length ? raw.envs : DEFAULT_ENVS);
   const services = unique(raw.services?.length ? raw.services : DEFAULT_SERVICES);
   const local = {
-    tokenFile: (0, import_node_path.resolve)(rootDir, raw.local?.tokenFile ?? ".odla/dev-token.json"),
-    credentialsFile: (0, import_node_path.resolve)(rootDir, raw.local?.credentialsFile ?? ".odla/credentials.local.json"),
-    devVarsFile: (0, import_node_path.resolve)(rootDir, raw.local?.devVarsFile ?? ".dev.vars"),
+    tokenFile: (0, import_node_path2.resolve)(rootDir, raw.local?.tokenFile ?? ".odla/dev-token.json"),
+    credentialsFile: (0, import_node_path2.resolve)(rootDir, raw.local?.credentialsFile ?? ".odla/credentials.local.json"),
+    devVarsFile: (0, import_node_path2.resolve)(rootDir, raw.local?.devVarsFile ?? ".dev.vars"),
     gitignore: raw.local?.gitignore ?? true
   };
   return {
@@ -69,9 +567,9 @@ async function loadProjectConfig(configPath = "odla.config.mjs") {
 async function resolveDataExport(cfg, value, names) {
   if (value === void 0 || value === null || value === false) return void 0;
   if (typeof value !== "string") return value;
-  const target = (0, import_node_path.isAbsolute)(value) ? value : (0, import_node_path.resolve)(cfg.rootDir, value);
+  const target = (0, import_node_path2.isAbsolute)(value) ? value : (0, import_node_path2.resolve)(cfg.rootDir, value);
   if (target.endsWith(".json")) {
-    return JSON.parse((0, import_node_fs.readFileSync)(target, "utf8"));
+    return JSON.parse((0, import_node_fs3.readFileSync)(target, "utf8"));
   }
   const mod = await import((0, import_node_url.pathToFileURL)(target).href);
   for (const name of names) {
@@ -122,7 +620,7 @@ function validId(value) {
   return typeof value === "string" && /^[a-z0-9][a-z0-9-]*$/.test(value);
 }
 async function loadConfigModule(path) {
-  if (path.endsWith(".json")) return JSON.parse((0, import_node_fs.readFileSync)(path, "utf8"));
+  if (path.endsWith(".json")) return JSON.parse((0, import_node_fs3.readFileSync)(path, "utf8"));
   const mod = await import(`${(0, import_node_url.pathToFileURL)(path).href}?t=${Date.now()}`);
   const value = mod.default ?? mod.config;
   if (typeof value === "function") return await value();
@@ -136,9 +634,9 @@ function unique(values) {
 }
 
 // src/doctor-checks.ts
-var import_node_child_process2 = require("child_process");
-var import_node_fs3 = require("fs");
-var import_node_path3 = require("path");
+var import_node_child_process3 = require("child_process");
+var import_node_fs5 = require("fs");
+var import_node_path4 = require("path");
 
 // src/redact.ts
 var REPLACEMENTS = [
@@ -160,11 +658,11 @@ function looksSecret(value) {
 }
 
 // src/wrangler.ts
-var import_node_child_process = require("child_process");
-var import_node_fs2 = require("fs");
-var import_node_path2 = require("path");
+var import_node_child_process2 = require("child_process");
+var import_node_fs4 = require("fs");
+var import_node_path3 = require("path");
 var defaultRunner = (cmd, args, opts) => new Promise((resolvePromise, reject) => {
-  const child = (0, import_node_child_process.spawn)(cmd, args, { cwd: opts?.cwd, stdio: ["pipe", "pipe", "pipe"] });
+  const child = (0, import_node_child_process2.spawn)(cmd, args, { cwd: opts?.cwd, stdio: ["pipe", "pipe", "pipe"] });
   let stdout = "";
   let stderr = "";
   child.stdout.on("data", (chunk) => stdout += chunk.toString());
@@ -176,15 +674,15 @@ var defaultRunner = (cmd, args, opts) => new Promise((resolvePromise, reject) =>
 var WRANGLER_CONFIG_FILES = ["wrangler.jsonc", "wrangler.json", "wrangler.toml"];
 function findWranglerConfig(rootDir) {
   for (const name of WRANGLER_CONFIG_FILES) {
-    const path = (0, import_node_path2.join)(rootDir, name);
-    if ((0, import_node_fs2.existsSync)(path)) return path;
+    const path = (0, import_node_path3.join)(rootDir, name);
+    if ((0, import_node_fs4.existsSync)(path)) return path;
   }
   return null;
 }
 function readWranglerConfig(path) {
   if (path.endsWith(".toml")) return null;
   try {
-    return JSON.parse(stripJsonComments((0, import_node_fs2.readFileSync)(path, "utf8")));
+    return JSON.parse(stripJsonComments((0, import_node_fs4.readFileSync)(path, "utf8")));
   } catch {
     return null;
   }
@@ -255,11 +753,12 @@ function lintRules(rules, entities, publicRead) {
   }
   return warnings;
 }
-var defaultExec = (cmd, args, cwd) => (0, import_node_child_process2.execFileSync)(cmd, args, { cwd, encoding: "utf8", stdio: ["ignore", "pipe", "ignore"] });
-function trackedSecretFiles(rootDir, exec = defaultExec) {
+var defaultExec = (cmd, args, cwd) => (0, import_node_child_process3.execFileSync)(cmd, args, { cwd, encoding: "utf8", stdio: ["ignore", "pipe", "ignore"] });
+function trackedSecretFiles(rootDir, exec = defaultExec, localPaths = []) {
   let output;
   try {
-    output = exec("git", ["ls-files", "--", ".dev.vars", ".odla"], rootDir);
+    const custom = localPaths.map((path) => gitignoreEntry(rootDir, path)).filter((path) => !!path);
+    output = exec("git", ["ls-files", "--", ".dev.vars", ".odla", ...custom], rootDir);
   } catch {
     return [];
   }
@@ -281,10 +780,10 @@ function wranglerWarnings(rootDir) {
   for (const { label, block } of blocks) {
     const assets = block.assets;
     if (assets?.directory) {
-      const dir = (0, import_node_path3.resolve)(rootDir, assets.directory);
-      if (dir === (0, import_node_path3.resolve)(rootDir)) {
+      const dir = (0, import_node_path4.resolve)(rootDir, assets.directory);
+      if (dir === (0, import_node_path4.resolve)(rootDir)) {
         warnings.push(`${label}assets.directory is the project root \u2014 point it at a dedicated build dir (wrangler dev fails with "spawn EBADF")`);
-      } else if ((0, import_node_fs3.existsSync)((0, import_node_path3.join)(dir, "node_modules"))) {
+      } else if ((0, import_node_fs5.existsSync)((0, import_node_path4.join)(dir, "node_modules"))) {
         warnings.push(`${label}assets.directory contains node_modules \u2014 wrangler dev's watcher will exhaust file descriptors`);
       }
     }
@@ -303,96 +802,57 @@ function wranglerWarnings(rootDir) {
   }
   return warnings;
 }
-function readPackageJson(rootDir) {
-  try {
-    return JSON.parse((0, import_node_fs3.readFileSync)((0, import_node_path3.join)(rootDir, "package.json"), "utf8"));
-  } catch {
-    return null;
+function o11yProjectWarnings(rootDir) {
+  const warnings = [];
+  const pkg = readPackageJson(rootDir);
+  const dependencies = pkg?.dependencies;
+  const devDependencies = pkg?.devDependencies;
+  if (!dependencies?.["@odla-ai/o11y"]) {
+    warnings.push(
+      devDependencies?.["@odla-ai/o11y"] ? "@odla-ai/o11y is a devDependency \u2014 move it to dependencies so the Worker can import it" : 'Worker instrumentation is missing @odla-ai/o11y \u2014 install it and wrap the handler with "withObservability"'
+    );
   }
+  const configPath = findWranglerConfig(rootDir);
+  const config = configPath ? readWranglerConfig(configPath) : null;
+  if (!configPath || !config) {
+    warnings.push("cannot verify o11y Worker instrumentation \u2014 add a parseable wrangler.jsonc/json config");
+    return warnings;
+  }
+  const main = typeof config.main === "string" ? (0, import_node_path4.resolve)(rootDir, config.main) : null;
+  if (!main || !(0, import_node_fs5.existsSync)(main)) {
+    warnings.push("cannot verify o11y Worker instrumentation \u2014 wrangler main is missing or unreadable");
+  } else {
+    let source = "";
+    try {
+      source = (0, import_node_fs5.readFileSync)(main, "utf8");
+    } catch {
+    }
+    if (!/\bwithObservability\b/.test(source)) {
+      warnings.push(`wrangler entrypoint ${config.main} does not reference withObservability`);
+    }
+  }
+  const flags = Array.isArray(config.compatibility_flags) ? config.compatibility_flags : [];
+  if (!flags.includes("nodejs_compat")) {
+    warnings.push('wrangler compatibility_flags is missing "nodejs_compat" required by @odla-ai/o11y');
+  }
+  return warnings;
 }
-
-// src/local.ts
-var import_node_fs4 = require("fs");
-var import_node_path4 = require("path");
-var GITIGNORE_LINES = [".odla/*.local.json", ".odla/dev-token.json", ".dev.vars"];
-function readJsonFile(path) {
+function readPackageJson(rootDir) {
   try {
-    return JSON.parse((0, import_node_fs4.readFileSync)(path, "utf8"));
+    return JSON.parse((0, import_node_fs5.readFileSync)((0, import_node_path4.join)(rootDir, "package.json"), "utf8"));
   } catch {
     return null;
   }
 }
-function writePrivateJson(path, value) {
-  (0, import_node_fs4.mkdirSync)((0, import_node_path4.dirname)(path), { recursive: true });
-  (0, import_node_fs4.writeFileSync)(path, `${JSON.stringify(value, null, 2)}
-`);
-  (0, import_node_fs4.chmodSync)(path, 384);
-}
-function readCredentials(path) {
-  return readJsonFile(path);
-}
-function mergeCredential(current, update) {
-  const next = current ?? {
-    appId: update.appId,
-    platformUrl: update.platformUrl,
-    dbEndpoint: update.dbEndpoint,
-    updatedAt: (/* @__PURE__ */ new Date(0)).toISOString(),
-    envs: {}
-  };
-  next.appId = update.appId;
-  next.platformUrl = update.platformUrl;
-  next.dbEndpoint = update.dbEndpoint;
-  next.updatedAt = (/* @__PURE__ */ new Date()).toISOString();
-  next.envs[update.env] = {
-    ...next.envs[update.env] ?? {},
-    tenantId: update.tenantId,
-    ...update.dbKey ? { dbKey: update.dbKey } : {},
-    ...update.o11yToken ? { o11yToken: update.o11yToken } : {}
-  };
-  return next;
-}
-function ensureGitignore(rootDir) {
-  const path = (0, import_node_path4.resolve)(rootDir, ".gitignore");
-  const existing = (0, import_node_fs4.existsSync)(path) ? (0, import_node_fs4.readFileSync)(path, "utf8") : "";
-  const missing = GITIGNORE_LINES.filter((line) => !existing.split(/\r?\n/).includes(line));
-  if (missing.length === 0) return;
-  const prefix = existing && !existing.endsWith("\n") ? "\n" : "";
-  (0, import_node_fs4.writeFileSync)(path, `${existing}${prefix}${missing.join("\n")}
-`);
-}
-function writeDevVars(path, credentials, env, o11y) {
-  const entry = credentials.envs[env];
-  if (!entry?.dbKey) throw new Error(`no db key for env "${env}" in ${path}`);
-  const lines = [
-    `ODLA_PLATFORM="${credentials.platformUrl}"`,
-    `ODLA_ENDPOINT="${credentials.dbEndpoint}"`,
-    `ODLA_APP_ID="${credentials.appId}"`,
-    `ODLA_ENV="${env}"`,
-    `ODLA_TENANT="${entry.tenantId}"`,
-    `ODLA_API_KEY="${entry.dbKey}"`
-  ];
-  if (o11y) {
-    lines.push(`ODLA_O11Y_ENDPOINT="${o11y.endpoint}"`, `ODLA_O11Y_SERVICE="${o11y.service}"`);
-    if (o11y.version) lines.push(`ODLA_O11Y_VERSION="${o11y.version}"`);
-    if (entry.o11yToken) lines.push(`ODLA_O11Y_TOKEN="${entry.o11yToken}"`);
-  }
-  (0, import_node_fs4.mkdirSync)((0, import_node_path4.dirname)(path), { recursive: true });
-  (0, import_node_fs4.writeFileSync)(path, `${lines.join("\n")}
-`);
-  (0, import_node_fs4.chmodSync)(path, 384);
-}
-function displayPath(path, rootDir = process.cwd()) {
-  const rel = (0, import_node_path4.relative)(rootDir, path);
-  return rel && !rel.startsWith("..") ? rel : path;
-}
 
 // src/doctor.ts
 async function doctor(options) {
   const out = options.stdout ?? console;
   const cfg = await loadProjectConfig(options.configPath);
   const plan = buildPlan(cfg);
-  const schema = await resolveDataExport(cfg, cfg.db?.schema, ["schema", "SCHEMA"]);
-  const configuredRules = await resolveDataExport(cfg, cfg.db?.rules, ["rules", "RULES"]);
+  const hasDb = cfg.services.includes("db");
+  const schema = hasDb ? await resolveDataExport(cfg, cfg.db?.schema, ["schema", "SCHEMA"]) : void 0;
+  const configuredRules = hasDb ? await resolveDataExport(cfg, cfg.db?.rules, ["rules", "RULES"]) : void 0;
   const rules = configuredRules ?? (schema && cfg.db?.defaultRules !== false ? rulesFromSchema(schema) : void 0);
   const entities = serializedEntities(schema);
   out.log(`config: ${cfg.configPath}`);
@@ -401,7 +861,7 @@ async function doctor(options) {
   out.log(`svc:    ${plan.services.join(", ")}`);
   out.log(`schema: ${schema ? `${entities.length} entities` : "none"}`);
   out.log(`rules:  ${rules ? `${Object.keys(rules).length} namespaces` : "none"}`);
-  out.log(`ai:     ${cfg.ai?.provider ?? "not configured"}`);
+  out.log(`ai:     ${cfg.services.includes("ai") ? cfg.ai?.provider ?? "not configured" : "not enabled"}`);
   const warnings = [];
   if (schema && entities.length === 0) warnings.push("schema has no entities");
   if (rules) {
@@ -417,7 +877,9 @@ async function doctor(options) {
       }
     }
   }
-  if (cfg.ai?.keyEnv && !process.env[cfg.ai.keyEnv]) warnings.push(`${cfg.ai.keyEnv} is not set; provision will skip provider key storage`);
+  if (cfg.services.includes("ai") && cfg.ai?.keyEnv && !process.env[cfg.ai.keyEnv]) {
+    warnings.push(`${cfg.ai.keyEnv} is not set; provision will skip provider key storage`);
+  }
   if (cfg.services.includes("o11y")) {
     const credentials = readCredentials(cfg.local.credentialsFile);
     for (const env of cfg.envs) {
@@ -425,9 +887,14 @@ async function doctor(options) {
         warnings.push(`o11y is enabled but env "${env}" has no ingest token \u2014 run "odla-ai provision" to mint one`);
       }
     }
+    warnings.push(...o11yProjectWarnings(cfg.rootDir));
   }
   warnings.push(...lintRules(rules, entities, cfg.db?.publicRead ?? []));
-  warnings.push(...trackedSecretFiles(cfg.rootDir));
+  warnings.push(...trackedSecretFiles(cfg.rootDir, void 0, [
+    cfg.local.tokenFile,
+    cfg.local.credentialsFile,
+    cfg.local.devVarsFile
+  ]));
   warnings.push(...wranglerWarnings(cfg.rootDir));
   if (warnings.length) {
     out.log("");
@@ -439,25 +906,25 @@ async function doctor(options) {
 }
 
 // src/init.ts
-var import_node_fs5 = require("fs");
+var import_node_fs6 = require("fs");
 var import_node_path5 = require("path");
 function initProject(options) {
   const out = options.stdout ?? console;
   const rootDir = (0, import_node_path5.resolve)(options.rootDir ?? process.cwd());
   const configPath = (0, import_node_path5.resolve)(rootDir, options.configPath ?? "odla.config.mjs");
-  if ((0, import_node_fs5.existsSync)(configPath) && !options.force) {
+  if ((0, import_node_fs6.existsSync)(configPath) && !options.force) {
     throw new Error(`${configPath} already exists. Pass --force to overwrite.`);
   }
   if (!/^[a-z0-9][a-z0-9-]*$/.test(options.appId)) {
     throw new Error("--app-id must be lowercase letters, numbers, and hyphens");
   }
-  const envs = options.envs?.length ? options.envs : ["prod", "dev"];
+  const envs = options.envs?.length ? options.envs : ["dev"];
   const services = options.services?.length ? options.services : ["db", "ai"];
   const aiProvider = options.aiProvider ?? "anthropic";
-  (0, import_node_fs5.mkdirSync)((0, import_node_path5.dirname)(configPath), { recursive: true });
-  (0, import_node_fs5.mkdirSync)((0, import_node_path5.resolve)(rootDir, "src/odla"), { recursive: true });
-  (0, import_node_fs5.mkdirSync)((0, import_node_path5.resolve)(rootDir, ".odla"), { recursive: true });
-  (0, import_node_fs5.writeFileSync)(configPath, configTemplate({ appId: options.appId, name: options.name, envs, services, aiProvider }));
+  (0, import_node_fs6.mkdirSync)((0, import_node_path5.dirname)(configPath), { recursive: true });
+  (0, import_node_fs6.mkdirSync)((0, import_node_path5.resolve)(rootDir, "src/odla"), { recursive: true });
+  (0, import_node_fs6.mkdirSync)((0, import_node_path5.resolve)(rootDir, ".odla"), { recursive: true });
+  (0, import_node_fs6.writeFileSync)(configPath, configTemplate({ appId: options.appId, name: options.name, envs, services, aiProvider }));
   writeIfMissing((0, import_node_path5.resolve)(rootDir, "src/odla/schema.mjs"), schemaTemplate());
   writeIfMissing((0, import_node_path5.resolve)(rootDir, "src/odla/rules.mjs"), rulesTemplate());
   ensureGitignore(rootDir);
@@ -466,8 +933,8 @@ function initProject(options) {
   out.log("updated .gitignore for local odla credentials");
 }
 function writeIfMissing(path, text) {
-  if ((0, import_node_fs5.existsSync)(path)) return;
-  (0, import_node_fs5.writeFileSync)(path, text);
+  if ((0, import_node_fs6.existsSync)(path)) return;
+  (0, import_node_fs6.writeFileSync)(path, text);
 }
 function configTemplate(input) {
   return `export default {
@@ -554,86 +1021,176 @@ function relativeDisplay(path, rootDir) {
 }
 
 // src/provision.ts
-var import_apps = require("@odla-ai/apps");
+var import_apps2 = require("@odla-ai/apps");
 var import_ai = require("@odla-ai/ai");
-var import_node_path6 = require("path");
-var import_node_process3 = __toESM(require("process"), 1);
+var import_node_process4 = __toESM(require("process"), 1);
 
-// src/token.ts
-var import_db = require("@odla-ai/db");
-var import_node_process2 = __toESM(require("process"), 1);
-
-// src/open.ts
-var import_node_child_process3 = require("child_process");
-var import_node_process = __toESM(require("process"), 1);
-async function openUrl(url, options = {}) {
-  const command = openerFor(options.platform ?? import_node_process.default.platform);
-  const doSpawn = options.spawnImpl ?? import_node_child_process3.spawn;
-  await new Promise((resolve7, reject) => {
-    const child = doSpawn(command.cmd, [...command.args, url], {
-      stdio: "ignore",
-      detached: true
+// src/provision-credentials.ts
+var import_apps = require("@odla-ai/apps");
+async function provisionEnvCredentials(opts) {
+  const tenantId = (0, import_apps.tenantIdFor)(opts.cfg.app.id, opts.env);
+  const prior = opts.credentials?.envs[opts.env];
+  let credentials = opts.credentials;
+  let dbKey = opts.cfg.services.includes("db") && !opts.rotateDb ? prior?.dbKey : void 0;
+  let o11yToken = opts.cfg.services.includes("o11y") && !opts.rotateO11y ? prior?.o11yToken : void 0;
+  if (opts.cfg.services.includes("db")) {
+    if (dbKey) {
+      opts.stdout.log(`${opts.env}: reusing local db key for ${tenantId}`);
+    } else {
+      dbKey = await mintDbKey(opts, tenantId);
+      credentials = save(opts, credentials, tenantId, { dbKey });
+      opts.stdout.log(`${opts.env}: minted db key for ${tenantId}`);
+    }
+  }
+  if (opts.cfg.services.includes("o11y")) {
+    if (o11yToken) {
+      opts.stdout.log(`${opts.env}: reusing local o11y ingest token`);
+    } else {
+      o11yToken = await issueO11yToken(opts);
+      credentials = save(opts, credentials, tenantId, { ...dbKey ? { dbKey } : {}, o11yToken });
+      opts.stdout.log(`${opts.env}: ${opts.rotateO11y ? "rotated" : "issued"} o11y ingest token`);
+    }
+  }
+  return save(opts, credentials, tenantId, {
+    ...dbKey ? { dbKey } : {},
+    ...o11yToken ? { o11yToken } : {}
+  });
+}
+function save(opts, current, tenantId, values) {
+  const next = mergeCredential(current, {
+    appId: opts.cfg.app.id,
+    platformUrl: opts.cfg.platformUrl,
+    dbEndpoint: opts.cfg.dbEndpoint,
+    env: opts.env,
+    tenantId,
+    ...values
+  });
+  if (opts.write) writePrivateJson(opts.cfg.local.credentialsFile, next);
+  return next;
+}
+async function mintDbKey(opts, tenantId) {
+  const headers = { authorization: `Bearer ${opts.developerToken}`, "content-type": "application/json" };
+  let res = await opts.fetch(`${opts.cfg.dbEndpoint}/admin/apps/${encodeURIComponent(tenantId)}/keys`, {
+    method: "POST",
+    headers,
+    body: "{}"
+  });
+  if (res.status === 404) {
+    const created = await opts.fetch(`${opts.cfg.dbEndpoint}/admin/apps`, {
+      method: "POST",
+      headers,
+      body: JSON.stringify({
+        name: opts.env === "prod" ? opts.cfg.app.name : `${opts.cfg.app.name} (${opts.env})`,
+        appId: tenantId
+      })
     });
-    child.once("error", reject);
-    child.once("spawn", () => {
-      child.unref();
-      resolve7();
+    if (!created.ok) throw new Error(`db app create (${tenantId}) failed: ${created.status} ${await safeText(created)}`);
+    res = await opts.fetch(`${opts.cfg.dbEndpoint}/admin/apps/${encodeURIComponent(tenantId)}/keys`, {
+      method: "POST",
+      headers,
+      body: "{}"
     });
-  });
+  }
+  if (!res.ok) throw new Error(`db key mint (${tenantId}) failed: ${res.status} ${await safeText(res)}`);
+  const body = await res.json();
+  if (!body.key) throw new Error(`db key mint (${tenantId}) returned no key`);
+  return body.key;
 }
-function openerFor(platform) {
-  if (platform === "darwin") return { cmd: "open", args: [] };
-  if (platform === "win32") return { cmd: "cmd", args: ["/c", "start", ""] };
-  return { cmd: "xdg-open", args: [] };
+async function issueO11yToken(opts) {
+  const suffix = opts.rotateO11y ? "/rotate" : "";
+  const res = await opts.fetch(
+    `${opts.cfg.platformUrl}/o11y/${encodeURIComponent(opts.cfg.app.id)}/token${suffix}?env=${encodeURIComponent(opts.env)}`,
+    { method: "POST", headers: { authorization: `Bearer ${opts.developerToken}` } }
+  );
+  if (res.status === 409 && !opts.rotateO11y) {
+    throw new Error(
+      `o11y token already exists for env "${opts.env}", but its shown-once value is not in the local credentials file; run "odla-ai provision --rotate-o11y-token --push-secrets" to replace it explicitly`
+    );
+  }
+  if (!res.ok) throw new Error(`o11y token ${opts.rotateO11y ? "rotation" : "issue"} (${opts.env}) failed: ${res.status} ${await safeText(res)}`);
+  const body = await res.json();
+  if (!body.token) throw new Error(`o11y token ${opts.rotateO11y ? "rotation" : "issue"} (${opts.env}) returned no token`);
+  return body.token;
+}
+async function safeText(res) {
+  try {
+    return redactSecrets((await res.text()).slice(0, 500));
+  } catch {
+    return "";
+  }
 }
 
-// src/token.ts
-async function getDeveloperToken(cfg, options, doFetch, out) {
-  if (options.token) return options.token;
-  if (import_node_process2.default.env.ODLA_DEV_TOKEN) return import_node_process2.default.env.ODLA_DEV_TOKEN;
-  const cached = readJsonFile(cfg.local.tokenFile);
-  if (cached?.token && (cached.expiresAt ?? 0) > Date.now() + 6e4) {
-    out.log(`auth: using cached developer token (${displayPath(cfg.local.tokenFile, cfg.rootDir)})`);
-    return cached.token;
+// src/secrets.ts
+var PROD_ENV_NAMES = /* @__PURE__ */ new Set(["prod", "production"]);
+async function secretsPush(options) {
+  await secretsPushImpl(options, true);
+}
+async function secretsPushAfterPreflight(options) {
+  await secretsPushImpl(options, false);
+}
+async function secretsPushImpl(options, preflight) {
+  const out = options.stdout ?? console;
+  const cfg = await loadProjectConfig(options.configPath);
+  const env = options.env;
+  if (!cfg.envs.includes(env)) {
+    throw new Error(`env "${env}" is not in config envs (${cfg.envs.join(", ")})`);
   }
-  const browser = approvalBrowser(options);
-  const { token, expiresAt } = await (0, import_db.requestToken)({
-    endpoint: cfg.platformUrl,
-    label: `${cfg.app.id} provisioner`,
-    fetch: doFetch,
-    onCode: async ({ userCode, expiresIn }) => {
-      const approvalUrl = handshakeUrl(cfg.platformUrl, userCode);
-      out.log("");
-      out.log(`Approve code ${userCode} at ${approvalUrl} within ${Math.floor(expiresIn / 60)}m.`);
-      if (browser.open) {
-        try {
-          await (options.openApprovalUrl ?? openUrl)(approvalUrl);
-          out.log(`auth: opened browser for approval${browser.mode === "auto" ? " (auto)" : ""}`);
-        } catch (err) {
-          out.log(`auth: could not open browser (${err instanceof Error ? err.message : String(err)})`);
-        }
-      } else if (browser.reason) {
-        out.log(`auth: browser launch skipped (${browser.reason})`);
-      }
-      out.log("");
+  if (PROD_ENV_NAMES.has(env) && !options.yes) {
+    throw new Error(`refusing to push a secret to "${env}" without --yes`);
+  }
+  const credentialsPath = displayPath(cfg.local.credentialsFile, cfg.rootDir);
+  const credentials = readCredentials(cfg.local.credentialsFile);
+  if (!credentials) throw new Error(`no credentials at ${credentialsPath} \u2014 run "odla-ai provision" first`);
+  if (credentials.appId !== cfg.app.id) {
+    throw new Error(`credentials at ${credentialsPath} are for "${credentials.appId}", not "${cfg.app.id}"`);
+  }
+  const entry = credentials.envs[env];
+  if (!entry) throw new Error(`no credentials for env "${env}" in ${credentialsPath} \u2014 run "odla-ai provision" first`);
+  const secrets = [];
+  if (cfg.services.includes("o11y")) {
+    if (!entry.o11yToken) throw new Error(`no o11y token for env "${env}" in ${credentialsPath} \u2014 run "odla-ai provision" first`);
+    secrets.push({ name: "ODLA_O11Y_TOKEN", value: entry.o11yToken });
+  }
+  if (cfg.services.includes("db")) {
+    if (!entry.dbKey) throw new Error(`no db key for env "${env}" in ${credentialsPath} \u2014 run "odla-ai provision" first`);
+    secrets.push({ name: "ODLA_API_KEY", value: entry.dbKey });
+  }
+  if (secrets.length === 0) {
+    out.log(`${env}: no configured Worker secrets to push`);
+    return;
+  }
+  const wranglerEnv = PROD_ENV_NAMES.has(env) ? void 0 : env;
+  const target = wranglerEnv ? `wrangler env "${wranglerEnv}"` : "the top-level (prod) wrangler env";
+  if (options.dryRun) {
+    assertWranglerConfig(cfg);
+    for (const s of secrets) out.log(`dry run: would push ${s.name} (${redactSecrets(s.value)}) to ${target}`);
+    return;
+  }
+  const run = options.runner ?? defaultRunner;
+  if (preflight) await preflightLoadedConfig(cfg, run);
+  for (const s of secrets) {
+    const result = await wranglerPutSecret(run, { name: s.name, value: s.value, env: wranglerEnv, cwd: cfg.rootDir });
+    if (result.code !== 0) {
+      throw new Error(`wrangler secret put ${s.name} failed (exit ${result.code}): ${redactSecrets(`${result.stderr || result.stdout}`.trim())}`);
     }
-  });
-  writePrivateJson(cfg.local.tokenFile, { token, expiresAt });
-  out.log(`auth: developer token cached (${displayPath(cfg.local.tokenFile, cfg.rootDir)})`);
-  return token;
+    out.log(`${s.name} pushed to ${target} (value read from ${credentialsPath}, never echoed)`);
+  }
 }
-function approvalBrowser(options) {
-  if (options.open === true) return { open: true, mode: "forced" };
-  if (options.open === false) return { open: false, reason: "disabled by --no-open" };
-  if (import_node_process2.default.env.CI) return { open: false, reason: "CI environment" };
-  const interactive = options.interactive ?? Boolean(import_node_process2.default.stdin.isTTY && import_node_process2.default.stdout.isTTY);
-  if (!interactive) return { open: false, reason: "non-interactive shell; pass --open to force" };
-  return { open: true, mode: "auto" };
+async function preflightSecretsPush(options) {
+  const cfg = await loadProjectConfig(options.configPath);
+  if (!cfg.services.some((service) => service === "db" || service === "o11y")) return;
+  await preflightLoadedConfig(cfg, options.runner ?? defaultRunner);
 }
-function handshakeUrl(platformUrl, userCode) {
-  const url = new URL("/handshakes", platformUrl);
-  url.searchParams.set("code", userCode);
-  return url.toString();
+async function preflightLoadedConfig(cfg, run) {
+  assertWranglerConfig(cfg);
+  if (!await wranglerLoggedIn(run, cfg.rootDir)) {
+    throw new Error(`wrangler is not logged in \u2014 run "wrangler login" (a browser step for the human)`);
+  }
+}
+function assertWranglerConfig(cfg) {
+  if (!findWranglerConfig(cfg.rootDir)) {
+    throw new Error(`no wrangler config found in ${cfg.rootDir} (wrangler.jsonc, wrangler.json, or wrangler.toml)`);
+  }
 }
 
 // src/provision.ts
@@ -641,25 +1198,60 @@ async function provision(options) {
   const out = options.stdout ?? console;
   const cfg = await loadProjectConfig(options.configPath);
   const plan = buildPlan(cfg);
+  const hasDb = cfg.services.includes("db");
+  const hasO11y = cfg.services.includes("o11y");
+  if (options.rotateO11yToken && !hasO11y) {
+    throw new Error("--rotate-o11y-token requires the o11y service in odla.config.mjs");
+  }
+  if (options.pushSecrets && options.writeCredentials === false) {
+    throw new Error("--push-secrets cannot be combined with --no-write-credentials");
+  }
   out.log(`odla-ai: ${plan.appName} (${plan.appId})`);
   out.log(`  platform: ${plan.platformUrl}`);
   out.log(`  db:       ${plan.dbEndpoint}`);
   out.log(`  envs:     ${plan.envs.join(", ")}`);
   out.log(`  services: ${plan.services.join(", ")}`);
-  const schema = await resolveDataExport(cfg, cfg.db?.schema, ["schema", "SCHEMA"]);
-  const configuredRules = await resolveDataExport(cfg, cfg.db?.rules, ["rules", "RULES"]);
+  const productionEnvs = plan.envs.filter((env) => env === "prod" || env === "production");
+  if (!options.dryRun && productionEnvs.length > 0 && !options.yes) {
+    throw new Error(
+      `refusing to provision production env ${productionEnvs.join(", ")} without --yes; run --dry-run first`
+    );
+  }
+  const schema = hasDb ? await resolveDataExport(cfg, cfg.db?.schema, ["schema", "SCHEMA"]) : void 0;
+  const configuredRules = hasDb ? await resolveDataExport(cfg, cfg.db?.rules, ["rules", "RULES"]) : void 0;
   const rules = configuredRules ?? (schema && cfg.db?.defaultRules !== false ? rulesFromSchema(schema) : void 0);
   if (options.dryRun) {
     out.log("dry run: no network calls or file writes");
     out.log(`  schema: ${schema ? "yes" : "no"}`);
     out.log(`  rules:  ${rules ? Object.keys(rules).length : 0} namespaces`);
-    out.log(`  ai:     ${cfg.ai?.provider ?? "not configured"}`);
+    out.log(`  ai:     ${cfg.services.includes("ai") ? cfg.ai?.provider ?? "not configured" : "not enabled"}`);
+    out.log(`  secrets: ${options.pushSecrets ? "push configured Worker secrets" : "local only"}`);
     return;
   }
+  let credentials = readCredentials(cfg.local.credentialsFile);
+  if (credentials && credentials.appId !== cfg.app.id) {
+    throw new Error(
+      `credentials at ${displayPath(cfg.local.credentialsFile, cfg.rootDir)} are for "${credentials.appId}", not "${cfg.app.id}"`
+    );
+  }
+  const rotatesO11y = !!(options.rotateKeys || options.rotateO11yToken);
+  const missingO11y = cfg.envs.some((env) => !credentials?.envs[env]?.o11yToken);
+  const missingDb = cfg.envs.some((env) => !credentials?.envs[env]?.dbKey);
+  const losesShownOnceCredential = hasDb && (!!options.rotateKeys || missingDb) || hasO11y && (rotatesO11y || missingO11y);
+  if (options.writeCredentials === false && losesShownOnceCredential) {
+    throw new Error("credential issuance/rotation requires the private credentials file; remove --no-write-credentials");
+  }
+  const devVarsTarget = resolveWriteDevVarsTarget(cfg, options.writeDevVars);
+  if (cfg.local.gitignore) {
+    ensureGitignore(cfg.rootDir, [cfg.local.tokenFile, cfg.local.credentialsFile, ...devVarsTarget ? [devVarsTarget] : []]);
+  }
+  if (options.pushSecrets) {
+    await preflightSecretsPush({ configPath: cfg.configPath, runner: options.secretRunner });
+    out.log("secrets: Wrangler config and login preflight passed");
+  }
   const doFetch = options.fetch ?? fetch;
   const token = await getDeveloperToken(cfg, options, doFetch, out);
-  const auth = { authorization: `Bearer ${token}`, "content-type": "application/json" };
-  const apps = (0, import_apps.createAppsClient)({ endpoint: cfg.platformUrl, token, fetcher: { fetch: doFetch } });
+  const apps = (0, import_apps2.createAppsClient)({ endpoint: cfg.platformUrl, token, fetcher: { fetch: doFetch } });
   const existing = await readRegistryApp(cfg, token, doFetch);
   if (existing) {
     out.log(`app: ${cfg.app.id} already exists`);
@@ -693,26 +1285,40 @@ async function provision(options) {
       out.log(`${env}: link ${link ? "set" : "cleared"}`);
     }
   }
-  let credentials = readCredentials(cfg.local.credentialsFile);
   for (const env of cfg.envs) {
-    const tenantId = (0, import_apps.tenantIdFor)(cfg.app.id, env);
-    let dbKey = !options.rotateKeys ? credentials?.envs[env]?.dbKey : void 0;
-    if (dbKey) {
-      out.log(`${env}: reusing local db key for ${tenantId}`);
-    } else {
-      dbKey = await mintDbKey({ cfg, tenantId, env, token, auth, fetch: doFetch });
-      out.log(`${env}: minted db key for ${tenantId}`);
-    }
-    let o11yToken = cfg.services.includes("o11y") && !options.rotateKeys ? credentials?.envs[env]?.o11yToken : void 0;
-    if (cfg.services.includes("o11y")) {
-      if (o11yToken) {
-        out.log(`${env}: reusing local o11y ingest token`);
-      } else {
-        o11yToken = await mintO11yToken(cfg, env, token, doFetch);
-        out.log(`${env}: minted o11y ingest token`);
+    const tenantId = (0, import_apps2.tenantIdFor)(cfg.app.id, env);
+    credentials = await provisionEnvCredentials({
+      cfg,
+      env,
+      developerToken: token,
+      credentials,
+      rotateDb: !!options.rotateKeys,
+      rotateO11y: rotatesO11y,
+      write: options.writeCredentials !== false,
+      fetch: doFetch,
+      stdout: out
+    });
+    const dbKey = credentials.envs[env]?.dbKey;
+    if (options.pushSecrets) {
+      try {
+        await secretsPushAfterPreflight({
+          configPath: cfg.configPath,
+          env,
+          yes: options.yes,
+          runner: options.secretRunner,
+          stdout: out
+        });
+      } catch (error) {
+        const message = error instanceof Error ? error.message : String(error);
+        const consent = env === "prod" || env === "production" ? " --yes" : "";
+        throw new Error(
+          `${message}
+${env}: credentials are already saved; retry "odla-ai secrets push --env ${env}${consent}" without issuing or rotating again`,
+          { cause: error }
+        );
       }
     }
-    if (schema) {
+    if (schema && dbKey) {
       await postJson(doFetch, `${cfg.dbEndpoint}/app/${encodeURIComponent(tenantId)}/schema`, dbKey, { schema });
       out.log(`${env}: schema pushed`);
     }
@@ -720,8 +1326,8 @@ async function provision(options) {
       await postJson(doFetch, `${cfg.dbEndpoint}/app/${encodeURIComponent(tenantId)}/admin/rules`, token, rules);
       out.log(`${env}: rules pushed (${Object.keys(rules).length} namespaces)`);
     }
-    if (cfg.ai?.provider && cfg.ai.keyEnv) {
-      const key = import_node_process3.default.env[cfg.ai.keyEnv];
+    if (cfg.services.includes("ai") && cfg.ai?.provider && cfg.ai.keyEnv) {
+      const key = import_node_process4.default.env[cfg.ai.keyEnv];
       if (key) {
         const secretName = cfg.ai.secretName ?? defaultSecretName(cfg.ai.provider);
         await (0, import_ai.putSecret)({ endpoint: cfg.dbEndpoint, token, fetch: doFetch }, tenantId, secretName, key);
@@ -730,36 +1336,17 @@ async function provision(options) {
         out.log(`${env}: ${cfg.ai.keyEnv} not set; skipped provider key storage`);
       }
     }
-    credentials = mergeCredential(credentials, {
-      appId: cfg.app.id,
-      platformUrl: cfg.platformUrl,
-      dbEndpoint: cfg.dbEndpoint,
-      env,
-      tenantId,
-      dbKey,
-      ...o11yToken ? { o11yToken } : {}
-    });
   }
-  if (cfg.local.gitignore) ensureGitignore(cfg.rootDir);
   if (options.writeCredentials !== false && credentials) {
-    writePrivateJson(cfg.local.credentialsFile, credentials);
-    out.log(`credentials: wrote ${displayPath(cfg.local.credentialsFile, cfg.rootDir)} (0600, gitignored)`);
+    const ignored = cfg.local.gitignore && gitignoreEntry(cfg.rootDir, cfg.local.credentialsFile);
+    out.log(`credentials: wrote ${displayPath(cfg.local.credentialsFile, cfg.rootDir)} (0600${ignored ? ", gitignored" : ""})`);
   }
-  const devVarsTarget = resolveWriteDevVarsTarget(cfg, options.writeDevVars);
   if (devVarsTarget && credentials) {
     const env = cfg.envs.includes("dev") ? "dev" : cfg.envs[0] ?? "prod";
     writeDevVars(devVarsTarget, credentials, env, o11yDevVars(cfg));
     out.log(`dev vars: wrote ${displayPath(devVarsTarget, cfg.rootDir)} for ${env}`);
   }
 }
-function o11yDevVars(cfg) {
-  if (!cfg.services.includes("o11y")) return void 0;
-  return {
-    endpoint: cfg.o11y?.endpoint ?? "https://o11y.odla.ai",
-    service: cfg.o11y?.service ?? cfg.app.id,
-    ...cfg.o11y?.version ? { version: cfg.o11y.version } : {}
-  };
-}
 async function readRegistryApp(cfg, token, doFetch) {
   const res = await doFetch(`${cfg.platformUrl}/registry/apps/${encodeURIComponent(cfg.app.id)}`, {
     headers: { authorization: `Bearer ${token}` }
@@ -769,50 +1356,13 @@ async function readRegistryApp(cfg, token, doFetch) {
   const json = await res.json();
   return json.app ?? null;
 }
-async function mintDbKey(opts) {
-  let res = await opts.fetch(`${opts.cfg.dbEndpoint}/admin/apps/${encodeURIComponent(opts.tenantId)}/keys`, {
-    method: "POST",
-    headers: opts.auth,
-    body: "{}"
-  });
-  if (res.status === 404) {
-    const created = await opts.fetch(`${opts.cfg.dbEndpoint}/admin/apps`, {
-      method: "POST",
-      headers: opts.auth,
-      body: JSON.stringify({
-        name: opts.env === "prod" ? opts.cfg.app.name : `${opts.cfg.app.name} (${opts.env})`,
-        appId: opts.tenantId
-      })
-    });
-    if (!created.ok) throw new Error(`db app create (${opts.tenantId}) failed: ${created.status} ${await safeText(created)}`);
-    res = await opts.fetch(`${opts.cfg.dbEndpoint}/admin/apps/${encodeURIComponent(opts.tenantId)}/keys`, {
-      method: "POST",
-      headers: opts.auth,
-      body: "{}"
-    });
-  }
-  if (!res.ok) throw new Error(`db key mint (${opts.tenantId}) failed: ${res.status} ${await safeText(res)}`);
-  const body = await res.json();
-  if (!body.key) throw new Error(`db key mint (${opts.tenantId}) returned no key`);
-  return body.key;
-}
-async function mintO11yToken(cfg, env, token, doFetch) {
-  const res = await doFetch(
-    `${cfg.platformUrl}/o11y/${encodeURIComponent(cfg.app.id)}/token?env=${encodeURIComponent(env)}`,
-    { method: "POST", headers: { authorization: `Bearer ${token}` } }
-  );
-  if (!res.ok) throw new Error(`o11y token mint (${env}) failed: ${res.status} ${await safeText(res)}`);
-  const body = await res.json();
-  if (!body.token) throw new Error(`o11y token mint (${env}) returned no token`);
-  return body.token;
-}
 async function postJson(doFetch, url, bearer, body) {
   const res = await doFetch(url, {
     method: "POST",
     headers: { authorization: `Bearer ${bearer}`, "content-type": "application/json" },
     body: JSON.stringify(body)
   });
-  if (!res.ok) throw new Error(`${new URL(url).pathname} failed: ${res.status} ${await safeText(res)}`);
+  if (!res.ok) throw new Error(`${new URL(url).pathname} failed: ${res.status} ${await safeText2(res)}`);
 }
 function normalizeClerkConfig(value) {
   if (!value) return null;
@@ -829,12 +1379,7 @@ function defaultSecretName(provider) {
   const names = import_ai.DEFAULT_SECRET_NAMES;
   return names[provider] ?? `${provider}_api_key`;
 }
-function resolveWriteDevVarsTarget(cfg, requested) {
-  if (!requested) return null;
-  if (requested === true) return cfg.local.devVarsFile;
-  return (0, import_node_path6.resolve)((0, import_node_path6.dirname)(cfg.configPath), requested);
-}
-async function safeText(res) {
+async function safeText2(res) {
   try {
     return redactSecrets((await res.text()).slice(0, 500));
   } catch {
@@ -842,103 +1387,401 @@ async function safeText(res) {
   }
 }
 
-// src/secrets.ts
-var PROD_ENV_NAMES = /* @__PURE__ */ new Set(["prod", "production"]);
-async function secretsPush(options) {
-  const out = options.stdout ?? console;
-  const cfg = await loadProjectConfig(options.configPath);
-  const env = options.env;
-  if (!cfg.envs.includes(env)) {
-    throw new Error(`env "${env}" is not in config envs (${cfg.envs.join(", ")})`);
-  }
-  if (PROD_ENV_NAMES.has(env) && !options.yes) {
-    throw new Error(`refusing to push a secret to "${env}" without --yes`);
-  }
-  const credentialsPath = displayPath(cfg.local.credentialsFile, cfg.rootDir);
-  const credentials = readCredentials(cfg.local.credentialsFile);
-  if (!credentials) throw new Error(`no credentials at ${credentialsPath} \u2014 run "odla-ai provision" first`);
-  if (credentials.appId !== cfg.app.id) {
-    throw new Error(`credentials at ${credentialsPath} are for "${credentials.appId}", not "${cfg.app.id}"`);
-  }
-  const dbKey = credentials.envs[env]?.dbKey;
-  if (!dbKey) throw new Error(`no db key for env "${env}" in ${credentialsPath} \u2014 run "odla-ai provision" first`);
-  const wranglerConfig = findWranglerConfig(cfg.rootDir);
-  if (!wranglerConfig) {
-    throw new Error(`no wrangler config found in ${cfg.rootDir} (wrangler.jsonc, wrangler.json, or wrangler.toml)`);
-  }
-  const wranglerEnv = PROD_ENV_NAMES.has(env) ? void 0 : env;
-  const target = wranglerEnv ? `wrangler env "${wranglerEnv}"` : "the top-level (prod) wrangler env";
-  const secrets = [{ name: "ODLA_API_KEY", value: dbKey }];
-  const o11yToken = credentials.envs[env]?.o11yToken;
-  if (o11yToken) secrets.push({ name: "ODLA_O11Y_TOKEN", value: o11yToken });
-  if (options.dryRun) {
-    for (const s of secrets) out.log(`dry run: would push ${s.name} (${redactSecrets(s.value)}) to ${target}`);
-    return;
-  }
-  const run = options.runner ?? defaultRunner;
-  if (!await wranglerLoggedIn(run, cfg.rootDir)) {
-    throw new Error(`wrangler is not logged in \u2014 run "wrangler login" (a browser step for the human)`);
+// src/security.ts
+var import_node_path6 = require("path");
+var import_security = require("@odla-ai/security");
+var import_node = require("@odla-ai/security/node");
+async function runHostedSecurity(options) {
+  if (options.sourceDisclosureAck !== "redacted") {
+    throw new Error("Hosted security requires sourceDisclosureAck=redacted before repository source may leave this process");
   }
-  for (const s of secrets) {
-    const result = await wranglerPutSecret(run, { name: s.name, value: s.value, env: wranglerEnv, cwd: cfg.rootDir });
-    if (result.code !== 0) {
-      throw new Error(`wrangler secret put ${s.name} failed (exit ${result.code}): ${redactSecrets(`${result.stderr || result.stdout}`.trim())}`);
+  const selfAudit = options.selfAudit === true;
+  const cfg = selfAudit ? void 0 : await loadProjectConfig(options.configPath ?? "odla.config.mjs");
+  const appId = selfAudit ? "odla-ai" : cfg.app.id;
+  const env = selfAudit ? "prod" : selectEnv(options.env, cfg.envs, cfg.configPath, cfg.rootDir);
+  const platform = options.platform ?? cfg?.platformUrl ?? "https://odla.ai";
+  const target = (0, import_node_path6.resolve)(options.target ?? cfg?.rootDir ?? ".");
+  const output = (0, import_node_path6.resolve)(options.out ?? (0, import_node_path6.resolve)(target, ".odla/security/hosted"));
+  const outputRelative = (0, import_node_path6.relative)(target, output).split(import_node_path6.sep).join("/");
+  if (!outputRelative) throw new Error("Hosted security output cannot be the repository root");
+  const profile = profileFor(options.profile ?? "odla", options.maxHuntTasks ?? 12);
+  const tokenRequest = {
+    platform,
+    appId,
+    env,
+    selfAudit,
+    scope: selfAudit ? "platform:security:self" : null
+  };
+  const token = await injectedToken(options, tokenRequest);
+  const snapshot = await (0, import_node.snapshotDirectory)(target, {
+    exclude: !outputRelative.startsWith("../") && !(0, import_node_path6.isAbsolute)(outputRelative) ? [outputRelative] : []
+  });
+  const hosted = await (0, import_security.createPlatformSecurityReasoners)({
+    platform,
+    token,
+    appId,
+    env,
+    repository: snapshot.repository,
+    revision: snapshot.revision,
+    snapshotDigest: snapshot.digest,
+    sourceDisclosure: "redacted",
+    clientRunId: options.runId ?? crypto.randomUUID(),
+    ...selfAudit ? { selfAudit: { enabled: true, subject: "service:odla-security-self-audit" } } : {},
+    fetch: options.fetch,
+    signal: options.signal
+  });
+  const harness = (0, import_security.createSecurityHarness)({
+    profile,
+    store: new import_node.FileRunStore((0, import_node_path6.resolve)(output, "state")),
+    discoveryReasoner: hosted.discoveryReasoner,
+    validationReasoner: hosted.validationReasoner,
+    policy: {
+      modelSourceDisclosure: "redacted",
+      active: false,
+      allowNetwork: false
     }
-    out.log(`${s.name} pushed to ${target} (value read from ${credentialsPath}, never echoed)`);
+  });
+  const report = await harness.run(snapshot, { runId: hosted.run.runId, signal: options.signal });
+  await (0, import_node.writeSecurityArtifacts)(output, report);
+  const reportDigest = await (0, import_security.securityFingerprint)(report);
+  await hosted.complete({
+    reportDigest,
+    coverageStatus: report.coverageStatus,
+    confirmed: report.metrics.confirmed,
+    candidates: report.metrics.candidates
+  }, { signal: options.signal });
+  printSummary(options.stdout ?? console, appId, env, hosted.run, report, output);
+  return Object.freeze({ report, run: hosted.run, output });
+}
+function selectEnv(requested, declared, configPath, rootDir) {
+  const env = requested ?? (declared.includes("dev") ? "dev" : declared[0]);
+  if (!env || !declared.includes(env)) {
+    const shown = (0, import_node_path6.relative)(rootDir, configPath) || configPath;
+    throw new Error(`env "${env ?? ""}" is not declared in ${shown}`);
+  }
+  return env;
+}
+async function injectedToken(options, request) {
+  const value = options.token ?? await options.getToken?.(Object.freeze({ ...request }));
+  if (typeof value !== "string" || value.length < 8 || value.length > 8192 || /\s|[\u0000-\u001f\u007f]/.test(value)) {
+    throw new Error(
+      request.selfAudit ? "Self-audit requires an injected, scoped platform security token" : "Hosted security requires an injected app developer token or getToken callback"
+    );
   }
+  return value;
+}
+function profileFor(name, maxHuntTasks) {
+  const profile = name === "odla" ? (0, import_security.odlaProfile)() : name === "cloudflare-app" ? (0, import_security.cloudflareAppProfile)() : name === "generic" ? (0, import_security.genericProfile)() : void 0;
+  if (!profile) throw new Error(`unknown security profile "${String(name)}"`);
+  if (maxHuntTasks === void 0) return profile;
+  if (!Number.isSafeInteger(maxHuntTasks) || maxHuntTasks < 1) throw new Error("maxHuntTasks must be a positive integer");
+  return { ...profile, maxHuntTasks };
+}
+function printSummary(out, appId, env, run, report, output) {
+  const complete = report.coverage.filter((cell) => cell.state === "complete").length;
+  out.log(`security: ${appId}/${env} run=${run.runId} profile=${run.profileVersion}`);
+  out.log(`  discovery: ${run.discovery.identity.provider}/${run.discovery.identity.model}`);
+  out.log(`  validation: ${run.validation.identity.provider}/${run.validation.identity.model}`);
+  out.log(`  coverage: ${report.coverageStatus} ${complete}/${report.coverage.length} blocked=${report.metrics.blockedCells} shallow=${report.metrics.shallowCells} unscheduled=${report.metrics.unscheduledCells}`);
+  out.log(`  findings: confirmed=${report.metrics.confirmed} needs_reproduction=${report.metrics.needsReproduction} candidates=${report.metrics.candidates}`);
+  out.log(`  report: ${(0, import_node_path6.resolve)(output, "REPORT.md")}`);
+}
+
+// src/help.ts
+var import_node_fs7 = require("fs");
+function cliVersion() {
+  const pkg = JSON.parse((0, import_node_fs7.readFileSync)(new URL("../package.json", importMetaUrl), "utf8"));
+  return pkg.version ?? "unknown";
+}
+function printHelp() {
+  console.log(`odla-ai
+
+Usage:
+  odla-ai setup [--dir <project>] [--agent <name>] [--global] [--force]
+  odla-ai init --app-id <id> --name <name> [--services db,ai,o11y] [--env dev --env prod]
+  odla-ai doctor [--config odla.config.mjs]
+  odla-ai capabilities [--json]
+  odla-ai admin ai show [--platform https://odla.ai] [--json]
+  odla-ai admin ai set <purpose> --provider <id> --model <id> [--enabled|--no-enabled]
+  odla-ai admin ai credentials [--json]
+  odla-ai admin ai credential set <provider> (--from-env <NAME>|--stdin)
+  odla-ai security run [target] --ack-redacted-source [--env dev] [--profile odla] [--fail-on high]
+  odla-ai security run [target] --self --ack-redacted-source
+  odla-ai provision [--config odla.config.mjs] [--dry-run] [--push-secrets] [--rotate-o11y-token] [--write-dev-vars[=path]] [--yes]
+  odla-ai smoke [--config odla.config.mjs] [--env dev]
+  odla-ai skill install [--dir <project>] [--agent <name>] [--global] [--force]
+  odla-ai secrets push --env <env> [--config odla.config.mjs] [--dry-run] [--yes]
+  odla-ai version
+
+Commands:
+  setup        Install offline odla runbooks for common coding-agent harnesses.
+  init         Create a generic odla.config.mjs plus starter schema/rules files.
+  doctor       Validate and summarize the project config without network calls.
+  capabilities Show what the CLI automates vs agent edits and human checkpoints.
+  admin        Manage platform-funded AI routing with a narrow admin-approved device grant.
+  security     Run hosted discovery + independent validation with app/run attribution.
+  provision    Register services, configure them, persist credentials, optionally push secrets.
+  smoke        Verify local credentials, public-config, live schema, and db aggregate.
+  skill        Same installer; --agent accepts all, claude, codex, cursor,
+               copilot, gemini, or agents (repeatable or comma-separated).
+  secrets      Push configured db/o11y secrets into the Worker via wrangler stdin.
+  version      Print the CLI version.
+
+Safety:
+  New projects target dev only. Add prod explicitly to odla.config.mjs and pass
+  --yes to provision it; use --dry-run first to inspect the resolved plan.
+  Provision caches the approved developer token and service credentials under
+  .odla/ with mode 0600, and init adds those paths to .gitignore. Secret push
+  preflights Wrangler before any shown-once issuance or destructive rotation.
+  Provision opens the approval page automatically in interactive terminals;
+  use --open to force browser launch or --no-open to suppress it.
+`);
 }
 
 // src/skill.ts
-var import_node_fs6 = require("fs");
+var import_node_fs8 = require("fs");
 var import_node_os = require("os");
 var import_node_path7 = require("path");
 var import_node_url2 = require("url");
+
+// src/skill-adapters.ts
+var PROJECT_INSTRUCTIONS = `<!-- odla-ai agent setup:start -->
+## odla agent workflow
+
+For work that creates an odla app or adds odla services, read and follow
+\`.agents/skills/odla/SKILL.md\`. It dispatches an existing static site to
+\`.agents/skills/odla-migrate/SKILL.md\`. For production telemetry triage, use
+\`.agents/skills/odla-o11y-debug/SKILL.md\`.
+
+The complete runbooks and their references are installed in this repository.
+Do not fetch online odla documentation as setup context. Network access is only
+needed when a runbook deliberately calls the odla service, npm, Cloudflare, or
+another configured provider.
+<!-- odla-ai agent setup:end -->`;
+var CURSOR_RULE = `---
+description: Build, migrate, provision, secure, or debug an odla app using the locally installed odla runbooks
+globs:
+alwaysApply: false
+---
+
+${PROJECT_INSTRUCTIONS}
+`;
+function claudeAdapter(skill, canonical) {
+  const match = canonical.match(/^---\r?\n([\s\S]*?)\r?\n---/);
+  if (!match) throw new Error(`bundled skill ${skill} has no YAML frontmatter`);
+  const lines = match[1].split(/\r?\n/);
+  const frontmatter = [];
+  let keepIndented = false;
+  for (const line of lines) {
+    if (line.startsWith("name:") || line.startsWith("description:")) {
+      frontmatter.push(line);
+      keepIndented = line.startsWith("description:");
+    } else if (keepIndented && /^\s+/.test(line)) {
+      frontmatter.push(line);
+    } else {
+      keepIndented = false;
+    }
+  }
+  return `---
+${frontmatter.join("\n")}
+---
+
+# ${skill} (odla adapter)
+
+Read \`../../../.agents/skills/${skill}/SKILL.md\` completely and follow it. That
+canonical local skill owns every reference path and contains the full offline
+runbook. Do not substitute a remote documentation page for the installed copy.
+`;
+}
+
+// src/skill.ts
+var AGENT_HARNESSES = ["claude", "codex", "cursor", "copilot", "gemini", "agents"];
 function installSkill(options = {}) {
   const out = options.stdout ?? console;
   const sourceDir = options.sourceDir ?? (0, import_node_url2.fileURLToPath)(new URL("../skills", importMetaUrl));
-  const targetDir = options.global ? (0, import_node_path7.join)(options.homeDir ?? (0, import_node_os.homedir)(), ".claude", "skills") : (0, import_node_path7.resolve)(options.dir ?? process.cwd(), ".claude", "skills");
   const files = listFiles(sourceDir);
   if (files.length === 0) throw new Error(`no bundled skills found at ${sourceDir}`);
-  const written = [];
-  const unchanged = [];
-  const conflicts = [];
-  for (const rel of files) {
-    const target = (0, import_node_path7.join)(targetDir, rel);
-    const source = (0, import_node_fs6.readFileSync)((0, import_node_path7.join)(sourceDir, rel), "utf8");
-    if ((0, import_node_fs6.existsSync)(target)) {
-      const current = (0, import_node_fs6.readFileSync)(target, "utf8");
-      if (current === source) {
-        unchanged.push(rel);
-        continue;
-      }
-      if (!options.force) {
-        conflicts.push(rel);
-        continue;
+  const harnesses = normalizeHarnesses(options.harnesses, options.global === true);
+  const root = (0, import_node_path7.resolve)(options.dir ?? process.cwd());
+  const home = (0, import_node_path7.resolve)(options.homeDir ?? (0, import_node_os.homedir)());
+  const plans = /* @__PURE__ */ new Map();
+  const targets = /* @__PURE__ */ new Map();
+  const rememberTarget = (harness, target) => {
+    const current = targets.get(harness) ?? /* @__PURE__ */ new Set();
+    current.add(target);
+    targets.set(harness, current);
+  };
+  const plan = (target, content, managedMerge = false, boundary = root) => {
+    const existing = plans.get(target);
+    if (existing && existing.content !== content) throw new Error(`internal agent setup conflict for ${target}`);
+    plans.set(target, { target, content, boundary, managedMerge });
+  };
+  const planSkillTree = (targetDir2, boundary = root) => {
+    for (const rel of files) plan((0, import_node_path7.join)(targetDir2, rel), (0, import_node_fs8.readFileSync)((0, import_node_path7.join)(sourceDir, rel), "utf8"), false, boundary);
+  };
+  let targetDir;
+  if (options.global) {
+    const claudeRoot = (0, import_node_path7.join)(home, ".claude", "skills");
+    const codexRoot = (0, import_node_path7.resolve)(options.codexHomeDir ?? process.env.CODEX_HOME ?? (0, import_node_path7.join)(home, ".codex"), "skills");
+    targetDir = harnesses[0] === "codex" ? codexRoot : claudeRoot;
+    for (const harness of harnesses) {
+      const skillRoot = harness === "claude" ? claudeRoot : codexRoot;
+      planSkillTree(skillRoot, harness === "claude" ? home : (0, import_node_path7.dirname)((0, import_node_path7.dirname)(codexRoot)));
+      rememberTarget(harness, skillRoot);
+    }
+  } else {
+    const sharedRoot = (0, import_node_path7.join)(root, ".agents", "skills");
+    planSkillTree(sharedRoot);
+    const claudeRoot = (0, import_node_path7.join)(root, ".claude", "skills");
+    targetDir = harnesses.includes("claude") ? claudeRoot : sharedRoot;
+    for (const harness of harnesses) rememberTarget(harness, sharedRoot);
+    if (harnesses.includes("claude")) {
+      for (const skill of skillNames(files)) {
+        const canonical = (0, import_node_fs8.readFileSync)((0, import_node_path7.join)(sourceDir, skill, "SKILL.md"), "utf8");
+        plan((0, import_node_path7.join)(claudeRoot, skill, "SKILL.md"), claudeAdapter(skill, canonical));
       }
+      rememberTarget("claude", claudeRoot);
+    }
+    if (harnesses.includes("cursor")) {
+      const cursorRule = (0, import_node_path7.join)(root, ".cursor", "rules", "odla.mdc");
+      plan(cursorRule, CURSOR_RULE);
+      rememberTarget("cursor", cursorRule);
+    }
+    if (harnesses.includes("agents")) {
+      const agentsFile = (0, import_node_path7.join)(root, "AGENTS.md");
+      plan(agentsFile, managedFileContent(agentsFile, PROJECT_INSTRUCTIONS, options.force === true, root), true);
+      rememberTarget("agents", agentsFile);
+    }
+    if (harnesses.includes("copilot")) {
+      const copilotFile = (0, import_node_path7.join)(root, ".github", "copilot-instructions.md");
+      plan(copilotFile, managedFileContent(copilotFile, PROJECT_INSTRUCTIONS, options.force === true, root), true);
+      rememberTarget("copilot", copilotFile);
+    }
+    if (harnesses.includes("gemini")) {
+      const geminiFile = (0, import_node_path7.join)(root, "GEMINI.md");
+      plan(geminiFile, managedFileContent(geminiFile, PROJECT_INSTRUCTIONS, options.force === true, root), true);
+      rememberTarget("gemini", geminiFile);
+    }
+  }
+  const writtenPaths = /* @__PURE__ */ new Set();
+  const unchangedPaths = /* @__PURE__ */ new Set();
+  const conflicts = [];
+  for (const file of plans.values()) {
+    const symlink = symlinkedComponent(file.boundary, file.target);
+    if (symlink) {
+      conflicts.push(`${file.target} (redirected by symbolic link ${symlink})`);
+      continue;
+    }
+    if (!(0, import_node_fs8.existsSync)(file.target)) {
+      writtenPaths.add(file.target);
+      continue;
+    }
+    const current = (0, import_node_fs8.readFileSync)(file.target, "utf8");
+    if (current === file.content) {
+      unchangedPaths.add(file.target);
+    } else if (file.managedMerge || options.force) {
+      writtenPaths.add(file.target);
+      unchangedPaths.delete(file.target);
+    } else {
+      conflicts.push(file.target);
     }
-    written.push(rel);
   }
   if (conflicts.length > 0) {
     throw new Error(
-      `skill files modified locally (re-run with --force to overwrite):
-${conflicts.map((f) => `  - ${(0, import_node_path7.join)(targetDir, f)}`).join("\n")}`
+      `agent setup files modified locally (re-run with --force to replace only odla-managed content):
+${conflicts.map((f) => `  - ${f}`).join("\n")}`
     );
   }
-  for (const rel of written) {
-    const target = (0, import_node_path7.join)(targetDir, rel);
-    (0, import_node_fs6.mkdirSync)((0, import_node_path7.join)(target, ".."), { recursive: true });
-    (0, import_node_fs6.writeFileSync)(target, (0, import_node_fs6.readFileSync)((0, import_node_path7.join)(sourceDir, rel), "utf8"));
+  for (const file of plans.values()) {
+    if (!(0, import_node_fs8.existsSync)(file.target) || (0, import_node_fs8.readFileSync)(file.target, "utf8") !== file.content) {
+      (0, import_node_fs8.mkdirSync)((0, import_node_path7.dirname)(file.target), { recursive: true });
+      (0, import_node_fs8.writeFileSync)(file.target, file.content);
+    }
+  }
+  const skills = skillNames(files);
+  const installations = harnesses.map((harness) => ({ harness, targets: [...targets.get(harness) ?? []] }));
+  out.log(`agent harnesses: ${harnesses.join(", ")}`);
+  out.log(`offline skills: ${skills.join(", ")}`);
+  for (const installation of installations) out.log(`${installation.harness}: ${installation.targets.join(", ")}`);
+  out.log(`installed ${writtenPaths.size} managed file(s)${unchangedPaths.size ? ` (${unchangedPaths.size} unchanged)` : ""}`);
+  return {
+    targetDir,
+    written: pathsUnder(targetDir, writtenPaths),
+    unchanged: pathsUnder(targetDir, unchangedPaths),
+    writtenPaths: [...writtenPaths].sort(),
+    unchangedPaths: [...unchangedPaths].sort(),
+    harnesses: installations
+  };
+}
+function pathsUnder(root, paths) {
+  return [...paths].map((path) => (0, import_node_path7.relative)(root, path)).filter((path) => path !== ".." && !path.startsWith(`..${import_node_path7.sep}`) && !(0, import_node_path7.isAbsolute)(path)).sort();
+}
+function normalizeHarnesses(values, global) {
+  const requested = values?.length ? values : ["claude"];
+  const allowed = /* @__PURE__ */ new Set([...AGENT_HARNESSES, "all"]);
+  for (const harness of requested) {
+    if (!allowed.has(harness)) {
+      throw new Error(`unknown agent harness "${harness}"; choose all, ${AGENT_HARNESSES.join(", ")}`);
+    }
+  }
+  const expanded = requested.includes("all") ? global ? ["claude", "codex"] : [...AGENT_HARNESSES] : [...new Set(requested)];
+  if (global) {
+    const unsupported = expanded.filter((harness) => harness !== "claude" && harness !== "codex");
+    if (unsupported.length) {
+      throw new Error(`--global supports claude and codex only; ${unsupported.join(", ")} require a project-local adapter`);
+    }
+  }
+  return expanded;
+}
+function managedFileContent(path, block, force, boundary) {
+  const symlink = symlinkedComponent(boundary, path);
+  if (symlink) throw new Error(`refusing to manage ${path}: symbolic link component ${symlink}`);
+  if (!(0, import_node_fs8.existsSync)(path)) return `${block}
+`;
+  const current = (0, import_node_fs8.readFileSync)(path, "utf8");
+  const start = "<!-- odla-ai agent setup:start -->";
+  const end = "<!-- odla-ai agent setup:end -->";
+  const startAt = current.indexOf(start);
+  const endAt = current.indexOf(end);
+  if (startAt === -1 !== (endAt === -1) || startAt !== -1 && endAt < startAt) {
+    throw new Error(`malformed odla-managed section in ${path}`);
+  }
+  if (startAt === -1) {
+    const separator = current.length === 0 || current.endsWith("\n\n") ? "" : current.endsWith("\n") ? "\n" : "\n\n";
+    return `${current}${separator}${block}
+`;
+  }
+  const afterEnd = endAt + end.length;
+  const existing = current.slice(startAt, afterEnd);
+  if (existing !== block && !force) {
+    throw new Error(`odla-managed section modified locally in ${path}; re-run with --force to replace that section`);
+  }
+  return `${current.slice(0, startAt)}${block}${current.slice(afterEnd)}`;
+}
+function symlinkedComponent(boundary, target) {
+  const rel = (0, import_node_path7.relative)(boundary, target);
+  if (rel === ".." || rel.startsWith(`..${import_node_path7.sep}`) || (0, import_node_path7.isAbsolute)(rel)) {
+    throw new Error(`agent setup target escapes its install root: ${target}`);
   }
-  const skills = [...new Set(files.map((f) => f.split(/[\\/]/)[0]))].sort();
-  out.log(`skills: ${skills.join(", ")}`);
-  out.log(`installed ${written.length} file(s) to ${targetDir}${unchanged.length ? ` (${unchanged.length} unchanged)` : ""}`);
-  return { targetDir, written, unchanged };
+  let current = boundary;
+  for (const part of rel.split(import_node_path7.sep).filter(Boolean)) {
+    current = (0, import_node_path7.join)(current, part);
+    try {
+      if ((0, import_node_fs8.lstatSync)(current).isSymbolicLink()) return current;
+    } catch (error) {
+      if (error.code !== "ENOENT") throw error;
+    }
+  }
+  return void 0;
+}
+function skillNames(files) {
+  return [...new Set(files.filter((file) => /(^|[\\/])SKILL\.md$/.test(file)).map((file) => file.split(/[\\/]/)[0]))].sort();
 }
 function listFiles(dir) {
-  if (!(0, import_node_fs6.existsSync)(dir)) return [];
+  if (!(0, import_node_fs8.existsSync)(dir)) return [];
   const results = [];
   const walk = (current) => {
-    for (const entry of (0, import_node_fs6.readdirSync)(current, { withFileTypes: true })) {
+    for (const entry of (0, import_node_fs8.readdirSync)(current, { withFileTypes: true })) {
       const path = (0, import_node_path7.join)(current, entry.name);
       if (entry.isDirectory()) walk(path);
       else results.push((0, import_node_path7.relative)(dir, path));
@@ -1004,7 +1847,7 @@ async function getJson(doFetch, url, bearer) {
   const res = await doFetch(url, {
     headers: bearer ? { authorization: `Bearer ${bearer}` } : void 0
   });
-  if (!res.ok) throw new Error(`${new URL(url).pathname} returned ${res.status}: ${await safeText2(res)}`);
+  if (!res.ok) throw new Error(`${new URL(url).pathname} returned ${res.status}: ${await safeText3(res)}`);
   return res.json();
 }
 async function postJson2(doFetch, url, bearer, body) {
@@ -1013,7 +1856,7 @@ async function postJson2(doFetch, url, bearer, body) {
     headers: { authorization: `Bearer ${bearer}`, "content-type": "application/json" },
     body: JSON.stringify(body)
   });
-  if (!res.ok) throw new Error(`${new URL(url).pathname} returned ${res.status}: ${await safeText2(res)}`);
+  if (!res.ok) throw new Error(`${new URL(url).pathname} returned ${res.status}: ${await safeText3(res)}`);
   return res.json();
 }
 function publicConfigUrl(platformUrl, appId, env) {
@@ -1021,7 +1864,7 @@ function publicConfigUrl(platformUrl, appId, env) {
   url.searchParams.set("env", env);
   return url.toString();
 }
-async function safeText2(res) {
+async function safeText3(res) {
   try {
     return (await res.text()).slice(0, 500);
   } catch {
@@ -1034,14 +1877,17 @@ async function runCli(argv = process.argv.slice(2)) {
   const parsed = parseArgv(argv);
   const command = parsed.positionals[0] ?? "help";
   if (command === "version" || command === "-v" || parsed.options.version === true) {
+    assertArgs(parsed, ["version"], 1);
     console.log(cliVersion());
     return;
   }
   if (command === "help" || command === "--help" || command === "-h") {
+    assertArgs(parsed, ["help"], 1);
     printHelp();
     return;
   }
   if (command === "init") {
+    assertArgs(parsed, ["app-id", "name", "config", "env", "services", "ai-provider", "force"], 1);
     initProject({
       appId: requiredString(parsed.options["app-id"], "--app-id"),
       name: requiredString(parsed.options.name, "--name"),
@@ -1054,15 +1900,132 @@ async function runCli(argv = process.argv.slice(2)) {
     return;
   }
   if (command === "doctor") {
+    assertArgs(parsed, ["config"], 1);
     await doctor({ configPath: stringOpt(parsed.options.config) ?? "odla.config.mjs" });
     return;
   }
+  if (command === "capabilities") {
+    assertArgs(parsed, ["json"], 1);
+    printCapabilities(parsed.options.json === true);
+    return;
+  }
+  if (command === "admin") {
+    const area = parsed.positionals[1];
+    const action = parsed.positionals[2];
+    const credentialSet = action === "credential" && parsed.positionals[3] === "set";
+    const credentials = action === "credentials";
+    if (area !== "ai" || action !== "show" && action !== "set" && !credentialSet && !credentials) {
+      throw new Error('unknown admin command. Try "odla-ai admin ai show".');
+    }
+    assertArgs(parsed, [
+      "platform",
+      "token",
+      "json",
+      "open",
+      "provider",
+      "model",
+      "enabled",
+      "max-input-bytes",
+      "max-output-tokens",
+      "max-calls-per-run",
+      "from-env",
+      "stdin"
+    ], credentialSet ? 5 : action === "set" ? 4 : 3);
+    await adminAi({
+      action: credentialSet ? "credential-set" : credentials ? "credentials" : action,
+      purpose: action === "set" ? parsed.positionals[3] : void 0,
+      provider: stringOpt(parsed.options.provider),
+      model: stringOpt(parsed.options.model),
+      enabled: boolOpt(parsed.options.enabled),
+      maxInputBytes: numberOpt(parsed.options["max-input-bytes"], "--max-input-bytes"),
+      maxOutputTokens: numberOpt(parsed.options["max-output-tokens"], "--max-output-tokens"),
+      maxCallsPerRun: numberOpt(parsed.options["max-calls-per-run"], "--max-calls-per-run"),
+      platform: stringOpt(parsed.options.platform),
+      token: stringOpt(parsed.options.token),
+      json: parsed.options.json === true,
+      open: parsed.options.open === false ? false : parsed.options.open === true ? true : void 0,
+      credentialProvider: credentialSet ? parsed.positionals[4] : void 0,
+      fromEnv: stringOpt(parsed.options["from-env"]),
+      stdin: parsed.options.stdin === true
+    });
+    return;
+  }
+  if (command === "security") {
+    const sub = parsed.positionals[1];
+    if (sub !== "run") throw new Error('unknown security command. Try "odla-ai security run".');
+    assertArgs(parsed, [
+      "config",
+      "env",
+      "out",
+      "profile",
+      "max-hunt-tasks",
+      "run-id",
+      "platform",
+      "self",
+      "ack-redacted-source",
+      "open",
+      "fail-on",
+      "fail-on-candidates",
+      "allow-incomplete"
+    ], 3);
+    const configPath = stringOpt(parsed.options.config) ?? "odla.config.mjs";
+    const selfAudit = parsed.options.self === true;
+    const open = parsed.options.open === false ? false : parsed.options.open === true ? true : void 0;
+    const platform = stringOpt(parsed.options.platform);
+    const result = await runHostedSecurity({
+      configPath,
+      selfAudit,
+      target: parsed.positionals[2],
+      out: stringOpt(parsed.options.out),
+      env: stringOpt(parsed.options.env),
+      profile: securityProfile(stringOpt(parsed.options.profile)),
+      maxHuntTasks: numberOpt(parsed.options["max-hunt-tasks"], "--max-hunt-tasks"),
+      runId: stringOpt(parsed.options["run-id"]),
+      platform,
+      sourceDisclosureAck: parsed.options["ack-redacted-source"] === true ? "redacted" : void 0,
+      getToken: async (request) => {
+        if (request.scope === "platform:security:self") {
+          return getScopedPlatformToken({ platform: request.platform, scope: request.scope, open });
+        }
+        const cfg = await loadProjectConfig(configPath);
+        return getDeveloperToken(cfg, { configPath, open }, fetch, console);
+      }
+    });
+    const failOn = severityOpt(stringOpt(parsed.options["fail-on"]) ?? "high", "--fail-on");
+    const candidateValue = parsed.options["fail-on-candidates"];
+    const failOnCandidates = candidateValue === false ? void 0 : severityOpt(stringOpt(candidateValue) ?? "critical", "--fail-on-candidates");
+    const confirmed = (0, import_security2.findingsAtOrAbove)(result.report, failOn);
+    const leads = failOnCandidates ? (0, import_security2.findingsAtOrAbove)(result.report, failOnCandidates, true).filter((finding) => finding.disposition !== "confirmed") : [];
+    const incomplete = result.report.coverageStatus === "incomplete" && parsed.options["allow-incomplete"] !== true;
+    if (confirmed.length || leads.length || incomplete) {
+      throw new Error(`hosted security gate failed: ${confirmed.length} confirmed >= ${failOn}; ${leads.length} leads >= ${failOnCandidates ?? "disabled"}${incomplete ? "; coverage incomplete" : ""}`);
+    }
+    return;
+  }
   if (command === "provision") {
+    assertArgs(
+      parsed,
+      [
+        "config",
+        "dry-run",
+        "rotate-keys",
+        "rotate-o11y-token",
+        "push-secrets",
+        "write-credentials",
+        "write-dev-vars",
+        "token",
+        "open",
+        "yes"
+      ],
+      1
+    );
     const writeDevVars2 = parsed.options["write-dev-vars"];
     const opts = {
       configPath: stringOpt(parsed.options.config) ?? "odla.config.mjs",
       dryRun: parsed.options["dry-run"] === true,
       rotateKeys: parsed.options["rotate-keys"] === true,
+      rotateO11yToken: parsed.options["rotate-o11y-token"] === true,
+      pushSecrets: parsed.options["push-secrets"] === true,
       writeCredentials: parsed.options["write-credentials"] !== false,
       writeDevVars: typeof writeDevVars2 === "string" ? writeDevVars2 : writeDevVars2 === true,
       token: stringOpt(parsed.options.token),
@@ -1073,6 +2036,7 @@ async function runCli(argv = process.argv.slice(2)) {
     return;
   }
   if (command === "smoke") {
+    assertArgs(parsed, ["config", "env"], 1);
     await smoke({
       configPath: stringOpt(parsed.options.config) ?? "odla.config.mjs",
       env: stringOpt(parsed.options.env)
@@ -1080,22 +2044,26 @@ async function runCli(argv = process.argv.slice(2)) {
     return;
   }
   if (command === "setup") {
+    assertArgs(parsed, ["dir", "global", "force", "agent", "harness"], 1);
     installSkill({
       dir: stringOpt(parsed.options.dir),
       global: parsed.options.global === true,
+      harnesses: harnessList(parsed),
       force: parsed.options.force === true
     });
     console.log(
-      "\nSkills installed. Point your coding agent at this repo \u2014 the `odla` skill orients it\n(build a new app, or migrate an existing site) and drives `odla-ai init` / `provision`."
+      "\nOffline runbooks installed. Open this repo in your coding agent and ask it to set up odla.\nIts native adapter finds the local `odla` skill, chooses build or migration, and drives the CLI."
     );
     return;
   }
   if (command === "skill") {
     const sub = parsed.positionals[1];
     if (sub !== "install") throw new Error(`unknown skill subcommand "${sub ?? ""}". Try "odla-ai skill install".`);
+    assertArgs(parsed, ["dir", "global", "force", "agent", "harness"], 2);
     installSkill({
       dir: stringOpt(parsed.options.dir),
       global: parsed.options.global === true,
+      harnesses: harnessList(parsed),
       force: parsed.options.force === true
     });
     return;
@@ -1103,6 +2071,7 @@ async function runCli(argv = process.argv.slice(2)) {
   if (command === "secrets") {
     const sub = parsed.positionals[1];
     if (sub !== "push") throw new Error(`unknown secrets subcommand "${sub ?? ""}". Try "odla-ai secrets push --env dev".`);
+    assertArgs(parsed, ["config", "env", "dry-run", "yes"], 2);
     await secretsPush({
       configPath: stringOpt(parsed.options.config) ?? "odla.config.mjs",
       env: requiredString(parsed.options.env, "--env"),
@@ -1113,94 +2082,29 @@ async function runCli(argv = process.argv.slice(2)) {
   }
   throw new Error(`unknown command "${command}". Run "odla-ai help".`);
 }
-function parseArgv(argv) {
-  const positionals = [];
-  const options = {};
-  for (let i = 0; i < argv.length; i++) {
-    const arg = argv[i];
-    if (!arg.startsWith("--")) {
-      positionals.push(arg);
-      continue;
-    }
-    const eq = arg.indexOf("=");
-    const rawName = arg.slice(2, eq === -1 ? void 0 : eq);
-    if (!rawName) continue;
-    if (rawName.startsWith("no-")) {
-      options[rawName.slice(3)] = false;
-      continue;
-    }
-    if (eq !== -1) {
-      addOption(options, rawName, arg.slice(eq + 1));
-      continue;
-    }
-    const value = argv[i + 1];
-    if (value !== void 0 && !value.startsWith("--")) {
-      i++;
-      addOption(options, rawName, value);
-    } else {
-      addOption(options, rawName, true);
-    }
-  }
-  return { positionals, options };
-}
-function addOption(options, name, value) {
-  const cur = options[name];
-  if (cur === void 0) {
-    options[name] = value;
-  } else if (Array.isArray(cur)) {
-    cur.push(String(value));
-  } else {
-    options[name] = [String(cur), String(value)];
-  }
-}
-function requiredString(value, name) {
-  const s = stringOpt(value);
-  if (!s) throw new Error(`${name} is required`);
-  return s;
-}
-function stringOpt(value) {
-  if (typeof value === "string") return value;
-  if (Array.isArray(value)) return value[value.length - 1];
-  return void 0;
-}
-function listOpt(value) {
-  if (value === void 0 || value === false || value === true) return void 0;
-  const values = Array.isArray(value) ? value : [value];
-  return values.flatMap((item) => item.split(",")).map((item) => item.trim()).filter(Boolean);
+function securityProfile(value) {
+  if (value === void 0) return void 0;
+  if (value === "odla" || value === "cloudflare-app" || value === "generic") return value;
+  throw new Error("--profile must be odla, cloudflare-app, or generic");
 }
-function cliVersion() {
-  const pkg = JSON.parse((0, import_node_fs7.readFileSync)(new URL("../package.json", importMetaUrl), "utf8"));
-  return pkg.version ?? "unknown";
+function severityOpt(value, flag) {
+  if (["informational", "low", "medium", "high", "critical"].includes(value)) return value;
+  throw new Error(`${flag} must be informational, low, medium, high, or critical`);
 }
-function printHelp() {
-  console.log(`odla-ai
-
-Usage:
-  odla-ai setup [--dir <project>] [--global] [--force]
-  odla-ai init --app-id <id> --name <name> [--services db,ai] [--env dev --env prod]
-  odla-ai doctor [--config odla.config.mjs]
-  odla-ai provision [--config odla.config.mjs] [--dry-run] [--open|--no-open] [--rotate-keys] [--write-dev-vars[=path]]
-  odla-ai smoke [--config odla.config.mjs] [--env dev]
-  odla-ai skill install [--dir <project>] [--global] [--force]
-  odla-ai secrets push --env <env> [--config odla.config.mjs] [--dry-run] [--yes]
-  odla-ai version
-
-Commands:
-  setup       Install the odla skills so a coding agent can drive the rest.
-  init        Create a generic odla.config.mjs plus starter schema/rules files.
-  doctor      Validate and summarize the project config without network calls.
-  provision   Register the app, enable services, push schema/rules, configure AI/auth.
-  smoke       Verify local credentials, public-config, live schema, and db aggregate.
-  skill       Install the bundled Claude Code skills into .claude/skills/.
-  secrets     Push the env's db key into the Worker via wrangler, stdin-piped.
-  version     Print the CLI version.
-
-Safety:
-  Provision caches the approved developer token and local db keys under .odla/
-  with mode 0600, and init adds those paths to .gitignore.
-  Provision opens the approval page automatically in interactive terminals;
-  use --open to force browser launch or --no-open to suppress it.
-`);
+function harnessList(parsed) {
+  const selected = [
+    ...harnessOption(parsed.options.agent, "--agent"),
+    ...harnessOption(parsed.options.harness, "--harness")
+  ];
+  return selected.length ? selected : ["all"];
+}
+function harnessOption(value, flag) {
+  if (value === void 0) return [];
+  if (typeof value === "boolean") throw new Error(`${flag} requires a harness name`);
+  const raw = Array.isArray(value) ? value : [value];
+  const parts = raw.flatMap((item) => item.split(","));
+  if (parts.some((item) => !item.trim())) throw new Error(`${flag} requires a harness name`);
+  return parts.map((item) => item.trim());
 }
 
 // src/bin.ts