@odla-ai/cli 0.25.18 → 0.25.20

package/dist/{chunk-B6DISJPC.js → chunk-ONETPJFW.js}

@@ -861,6 +861,7 @@ function isRecord3(value) {
 import { existsSync as existsSync3, readFileSync as readFileSync2 } from "fs";
 import { dirname as dirname3, isAbsolute as isAbsolute2, resolve as resolve2 } from "path";
 import { pathToFileURL } from "url";
+import { appServiceDefinition, appServiceIds } from "@odla-ai/apps";
 
 // src/integration-validation.ts
 function validateIntegrations(cfg, path, defaultServices) {
@@ -948,6 +949,7 @@ async function loadProjectConfig(configPath = "odla.config.mjs") {
   const dbEndpoint = trimSlash(process.env.ODLA_DB_ENDPOINT || raw.dbEndpoint || platformUrl);
   const envs = unique2(raw.envs?.length ? raw.envs : DEFAULT_ENVS);
   const services = unique2(raw.services?.length ? raw.services : DEFAULT_SERVICES);
+  validateServices(services, resolved);
   validateCalendarConfig(raw, envs, services, resolved);
   const local = {
     tokenFile: resolve2(rootDir, raw.local?.tokenFile ?? ".odla/dev-token.json"),
@@ -1103,7 +1105,19 @@ function validateCalendarConfig(cfg, envs, services, path) {
       }
     }
   }
-  if (enabled && !services.includes("db")) throw new Error(`${path}: calendar service requires the db service`);
+}
+function validateServices(services, path) {
+  for (const service of services) {
+    const definition = appServiceDefinition(service);
+    if (!definition) {
+      throw new Error(`${path}: unknown service "${service}" (known: ${appServiceIds().join(", ")})`);
+    }
+    for (const dependency of definition.requires) {
+      if (!services.includes(dependency)) {
+        throw new Error(`${path}: ${service} service requires the ${dependency} service`);
+      }
+    }
+  }
 }
 function assertOnly(value, allowed, label) {
   const extra = Object.keys(value).find((key) => !allowed.includes(key));
@@ -2070,6 +2084,7 @@ async function doctor(options) {
 // src/init.ts
 import { existsSync as existsSync6, mkdirSync as mkdirSync2, writeFileSync as writeFileSync2 } from "fs";
 import { dirname as dirname4, resolve as resolve4 } from "path";
+import { appServiceDefinition as appServiceDefinition2, appServiceIds as appServiceIds2 } from "@odla-ai/apps";
 function initProject(options) {
   const out = options.stdout ?? console;
   const rootDir = resolve4(options.rootDir ?? process.cwd());
@@ -2082,7 +2097,13 @@ function initProject(options) {
   }
   const envs = options.envs?.length ? options.envs : ["dev"];
   const services = options.services?.length ? options.services : ["db", "ai"];
-  if (services.includes("calendar") && !services.includes("db")) throw new Error("--services calendar requires db");
+  for (const service of services) {
+    const definition = appServiceDefinition2(service);
+    if (!definition) throw new Error(`--services contains unknown service "${service}" (known: ${appServiceIds2().join(", ")})`);
+    for (const dependency of definition.requires) {
+      if (!services.includes(dependency)) throw new Error(`--services ${service} requires ${dependency}`);
+    }
+  }
   const aiProvider = options.aiProvider ?? "anthropic";
   mkdirSync2(dirname4(configPath), { recursive: true });
   mkdirSync2(resolve4(rootDir, "src/odla"), { recursive: true });
@@ -6033,15 +6054,16 @@ Usage:
   odla-ai runbook rm <slug> [--app <id>]
   odla-ai capabilities [--json]
   odla-ai code connect [--env dev|prod] [--email <odla-account>] [--engine auto|container|podman|docker] [--slots <1-64>] [--once]
-  odla-ai admin ai show [--platform https://odla.ai] [--email <odla-account>] [--json]
-  odla-ai admin ai models [--provider <id>] [--json]
-  odla-ai admin ai set <purpose> [--provider <id>] [--model <id>] [--enabled|--no-enabled]
-  odla-ai admin ai set security --discovery-provider <id> --discovery-model <id>
-    --validation-provider <id> --validation-model <id> [--enabled|--no-enabled]
-  odla-ai admin ai credentials [--json]
-  odla-ai admin ai credential set <provider> (--from-env <NAME>|--stdin)
-  odla-ai admin ai usage [--app-id <id>] [--env <env>] [--run-id <id>] [--limit <1-500>] [--json]
-  odla-ai admin ai audit [--limit <1-200>] [--json]
+  odla-ai admin ai show [--context <name>] [--platform https://odla.ai] [--email <odla-account>] [--json]
+  odla-ai admin ai models [--context <name>] [--provider <id>] [--json]
+  odla-ai admin ai set <purpose> [--context <name>] [--provider <id>] [--model <id>] [--enabled|--no-enabled]
+    [--max-input-bytes <n>] [--max-output-tokens <n>] [--max-calls-per-run <n>] [--json]
+  odla-ai admin ai set security [--context <name>] --discovery-provider <id> --discovery-model <id>
+    --validation-provider <id> --validation-model <id> [--enabled|--no-enabled] [--json]
+  odla-ai admin ai credentials [--context <name>] [--json]
+  odla-ai admin ai credential set <provider> [--context <name>] (--from-env <NAME>|--stdin)
+  odla-ai admin ai usage [--context <name>] [--app-id <id>] [--env <env>] [--run-id <id>] [--limit <1-500>] [--json]
+  odla-ai admin ai audit [--context <name>] [--limit <1-200>] [--json]
   odla-ai security github connect [--repo owner/name] [--env dev] [--email <odla-account>] [--no-open]
   odla-ai security github disconnect --source <id> [--env dev] [--yes]
   odla-ai security plan [--env dev] [--json]
@@ -6430,7 +6452,7 @@ function record4(value) {
 }
 
 // src/provision.ts
-import { createAppsClient, tenantIdFor as tenantIdFor4 } from "@odla-ai/apps";
+import { createAppsClient, orderAppServices, tenantIdFor as tenantIdFor4 } from "@odla-ai/apps";
 import { putSecret as putSecret2 } from "@odla-ai/ai";
 import process8 from "process";
 
@@ -6584,11 +6606,6 @@ async function safeText4(res) {
 // src/provision-helpers.ts
 import { DEFAULT_SECRET_NAMES } from "@odla-ai/ai";
 import { tenantIdFor as tenantIdFor3 } from "@odla-ai/apps";
-function serviceRank(service) {
-  if (service === "db") return 0;
-  if (service === "calendar") return 2;
-  return 1;
-}
 function defaultSecretName(provider) {
   const names = DEFAULT_SECRET_NAMES;
   return names[provider] ?? `${provider}_api_key`;
@@ -6714,7 +6731,7 @@ async function provision(options) {
   for (const env of cfg.envs) {
     await assertTenantAdminAccess(doFetch, cfg, env, token);
   }
-  const serviceOrder = [...cfg.services].sort((a, b) => serviceRank(a) - serviceRank(b));
+  const serviceOrder = orderAppServices(cfg.services);
   for (const env of cfg.envs) {
     for (const service of serviceOrder) {
       if (service === "ai") {
@@ -7328,8 +7345,250 @@ function addOption(options, name, value) {
   else options[name] = [String(current), String(value)];
 }
 
+// src/operator-context.ts
+import { existsSync as existsSync10 } from "fs";
+import { join as join10, resolve as resolve11 } from "path";
+import process10 from "process";
+
+// src/operator-profiles.ts
+import { existsSync as existsSync9, readFileSync as readFileSync7 } from "fs";
+import { homedir as homedir2 } from "os";
+import { dirname as dirname7, join as join9, resolve as resolve10 } from "path";
+import process9 from "process";
+function operatorProfileFile() {
+  return resolve10(
+    clean(process9.env.ODLA_CONTEXT_FILE) ?? join9(homedir2(), ".odla", "contexts.json")
+  );
+}
+function resolveOperatorProfile(parsed) {
+  const fromFlag = clean(stringOpt(parsed.options.context));
+  const fromEnvironment = clean(process9.env.ODLA_CONTEXT);
+  const name = fromFlag ?? fromEnvironment ?? null;
+  const file = operatorProfileFile();
+  if (!name) {
+    return { name: null, source: "unresolved", file, value: null };
+  }
+  assertOperatorName(name, "context");
+  const profiles = readOperatorProfiles(file);
+  const value = Object.hasOwn(profiles, name) ? profiles[name] : void 0;
+  if (!value) {
+    throw new Error(
+      `operator context "${name}" not found in ${file}; run "odla-ai context list" or save it first`
+    );
+  }
+  return {
+    name,
+    source: fromFlag ? "flag" : "environment",
+    file,
+    value
+  };
+}
+function listOperatorProfiles(file = operatorProfileFile()) {
+  return Object.entries(readOperatorProfiles(file)).sort(([a], [b]) => a.localeCompare(b)).map(([name, profile]) => ({ name, ...profile }));
+}
+function saveOperatorProfile(name, profile, file = operatorProfileFile()) {
+  assertOperatorName(name, "context");
+  const normalized = validateProfile(profile, `operator context "${name}"`);
+  const profiles = readOperatorProfiles(file);
+  profiles[name] = normalized;
+  writePrivateJson(file, { schemaVersion: 1, profiles });
+}
+function removeOperatorProfile(name, file = operatorProfileFile()) {
+  assertOperatorName(name, "context");
+  const profiles = readOperatorProfiles(file);
+  if (!Object.hasOwn(profiles, name)) return false;
+  delete profiles[name];
+  writePrivateJson(file, { schemaVersion: 1, profiles });
+  return true;
+}
+function operatorCredentialFiles(selection) {
+  const base = selection.name ? join9(dirname7(selection.file), "profiles", selection.name) : join9(homedir2(), ".odla");
+  return {
+    developer: join9(base, "dev-token.json"),
+    scoped: join9(base, "admin-token.local.json")
+  };
+}
+function assertOperatorName(value, label) {
+  if (!/^[a-z0-9][a-z0-9-]*$/.test(value)) {
+    throw new Error(
+      `${label} must contain lowercase letters, numbers, and hyphens`
+    );
+  }
+}
+function readOperatorProfiles(file) {
+  if (!existsSync9(file)) return emptyProfiles();
+  let raw;
+  try {
+    raw = JSON.parse(readFileSync7(file, "utf8"));
+  } catch {
+    throw new Error(`operator context file ${file} is not valid JSON`);
+  }
+  if (!raw || typeof raw !== "object" || raw.schemaVersion !== 1 || !raw.profiles || typeof raw.profiles !== "object" || Array.isArray(raw.profiles)) {
+    throw new Error(`operator context file ${file} has an invalid shape`);
+  }
+  const unknown = Object.keys(raw).filter(
+    (key) => !["schemaVersion", "profiles"].includes(key)
+  );
+  if (unknown.length > 0) {
+    throw new Error(
+      `operator context file ${file} contains unsupported field(s): ${unknown.sort().join(", ")}`
+    );
+  }
+  const profiles = emptyProfiles();
+  for (const [name, value] of Object.entries(
+    raw.profiles
+  )) {
+    assertOperatorName(name, "context");
+    profiles[name] = validateProfile(value, `operator context "${name}"`);
+  }
+  return profiles;
+}
+function emptyProfiles() {
+  return /* @__PURE__ */ Object.create(null);
+}
+function validateProfile(value, label) {
+  if (!value || typeof value !== "object" || Array.isArray(value)) {
+    throw new Error(`${label} has an invalid shape`);
+  }
+  const unknown = Object.keys(value).filter(
+    (key) => !["platform", "app", "environment"].includes(key)
+  );
+  if (unknown.length > 0) {
+    throw new Error(
+      `${label} contains unsupported field(s): ${unknown.sort().join(", ")}; contexts store scope metadata only, never credentials`
+    );
+  }
+  const candidate = value;
+  if (typeof candidate.platform !== "string") {
+    throw new Error(`${label} needs an absolute platform URL`);
+  }
+  const platform = platformAudience(candidate.platform);
+  const app = clean(candidate.app);
+  const environment2 = clean(candidate.environment);
+  if (app) assertOperatorName(app, "app");
+  if (environment2) assertOperatorName(environment2, "environment");
+  return {
+    platform,
+    ...app ? { app } : {},
+    ...environment2 ? { environment: environment2 } : {}
+  };
+}
+function clean(value) {
+  const normalized = value?.trim();
+  return normalized || void 0;
+}
+
+// src/operator-context.ts
+var DEFAULT_PLATFORM2 = "https://odla.ai";
+async function resolveOperatorContext(parsed, options = {}) {
+  const profile = resolveOperatorProfile(parsed);
+  const configArgument = stringOpt(parsed.options.config) ?? "odla.config.mjs";
+  const configPath = resolve11(configArgument);
+  const explicitConfig = parsed.options.config !== void 0;
+  const hasConfig = existsSync10(configPath);
+  if (!hasConfig && (!options.allowMissingConfig || explicitConfig)) {
+    await loadProjectConfig(configArgument);
+  }
+  const loaded = hasConfig ? await loadProjectConfig(configArgument) : void 0;
+  const platformFlag = clean2(stringOpt(parsed.options.platform));
+  const platformEnvironment = clean2(process10.env.ODLA_PLATFORM_URL);
+  const platformValue = platformAudience(
+    platformFlag ?? platformEnvironment ?? profile.value?.platform ?? loaded?.platformUrl ?? DEFAULT_PLATFORM2
+  );
+  const platformSource = platformFlag ? "flag" : platformEnvironment ? "environment" : profile.value ? "profile" : loaded ? "config" : "default";
+  const appFlag = clean2(stringOpt(parsed.options.app));
+  const appEnvironment = clean2(process10.env.ODLA_APP_ID);
+  const appValue = appFlag ?? appEnvironment ?? profile.value?.app ?? loaded?.app.id ?? null;
+  const appSource = appFlag ? "flag" : appEnvironment ? "environment" : profile.value?.app ? "profile" : loaded ? "config" : "unresolved";
+  if (appValue) assertOperatorName(appValue, "app");
+  if (options.requireApp && !appValue) {
+    throw new Error(
+      "app context is unresolved; pass --app <id>, set ODLA_APP_ID, select --context <name>, or run inside a project with odla.config.mjs"
+    );
+  }
+  const envFlag = clean2(stringOpt(parsed.options.env));
+  const envEnvironment = clean2(process10.env.ODLA_ENV);
+  const environmentValue = envFlag ?? envEnvironment ?? profile.value?.environment ?? options.defaultEnvironment ?? null;
+  const environmentSource = envFlag ? "flag" : envEnvironment ? "environment" : profile.value?.environment ? "profile" : options.defaultEnvironment ? "default" : "unresolved";
+  if (environmentValue) {
+    assertOperatorName(environmentValue, "environment");
+  }
+  const rootDir = loaded?.rootDir ?? process10.cwd();
+  const profileCredentials = operatorCredentialFiles(profile);
+  const tokenFile = clean2(process10.env.ODLA_DEV_TOKEN_FILE) ? resolve11(process10.env.ODLA_DEV_TOKEN_FILE) : profile.name ? profileCredentials.developer : loaded?.local.tokenFile ?? profileCredentials.developer;
+  const scopedTokenFile = clean2(process10.env.ODLA_ADMIN_TOKEN_FILE) ? resolve11(process10.env.ODLA_ADMIN_TOKEN_FILE) : profile.name ? profileCredentials.scoped : loaded ? join10(loaded.rootDir, ".odla", "admin-token.local.json") : profileCredentials.scoped;
+  const cfg = loaded ? {
+    ...loaded,
+    platformUrl: platformValue,
+    app: appValue ? {
+      id: appValue,
+      name: appValue === loaded.app.id ? loaded.app.name : appValue
+    } : loaded.app,
+    local: { ...loaded.local, tokenFile }
+  } : {
+    configPath,
+    rootDir,
+    platformUrl: platformValue,
+    dbEndpoint: platformValue,
+    app: {
+      id: appValue ?? "operator",
+      name: appValue ?? "Operator"
+    },
+    envs: environmentValue ? [environmentValue] : [],
+    services: [],
+    local: {
+      tokenFile,
+      credentialsFile: join10(rootDir, ".odla", "credentials.local.json"),
+      devVarsFile: join10(rootDir, ".dev.vars"),
+      gitignore: true
+    }
+  };
+  return {
+    cfg,
+    profile: {
+      name: profile.name,
+      source: profile.source,
+      file: profile.file
+    },
+    config: {
+      path: configPath,
+      status: loaded ? "loaded" : "absent",
+      explicit: explicitConfig
+    },
+    platform: { value: platformValue, source: platformSource },
+    app: { value: appValue, source: appSource },
+    environment: {
+      value: environmentValue,
+      source: environmentSource
+    },
+    credentials: {
+      developerTokenFile: tokenFile,
+      scopedTokenFile
+    }
+  };
+}
+function clean2(value) {
+  const normalized = value?.trim();
+  return normalized || void 0;
+}
+
 // src/admin-command.ts
-async function adminCommand(parsed) {
+var CONTEXT_OPTIONS = ["platform", "config", "context", "token", "open", "email"];
+var JSON_OPTIONS = [...CONTEXT_OPTIONS, "json"];
+var SET_OPTIONS = [
+  ...JSON_OPTIONS,
+  "provider",
+  "model",
+  "enabled",
+  "max-input-bytes",
+  "max-output-tokens",
+  "max-calls-per-run",
+  "discovery-provider",
+  "discovery-model",
+  "validation-provider",
+  "validation-model"
+];
+async function adminCommand(parsed, deps = {}) {
   const area = parsed.positionals[1];
   const action = parsed.positionals[2];
   const credentialSet = action === "credential" && parsed.positionals[3] === "set";
@@ -7340,28 +7599,9 @@ async function adminCommand(parsed) {
   if (area !== "ai" || action !== "show" && action !== "set" && !credentialSet && !credentials && !models && !usage && !audit) {
     throw new Error('unknown admin command. Try "odla-ai admin ai show".');
   }
-  assertArgs(parsed, [
-    "platform",
-    "json",
-    "open",
-    "email",
-    "provider",
-    "model",
-    "enabled",
-    "max-input-bytes",
-    "max-output-tokens",
-    "max-calls-per-run",
-    "from-env",
-    "stdin",
-    "discovery-provider",
-    "discovery-model",
-    "validation-provider",
-    "validation-model",
-    "app-id",
-    "env",
-    "run-id",
-    "limit"
-  ], credentialSet ? 5 : action === "set" ? 4 : 3);
+  const allowed = credentialSet ? [...CONTEXT_OPTIONS, "from-env", "stdin"] : action === "set" ? SET_OPTIONS : models ? [...JSON_OPTIONS, "provider"] : usage ? [...JSON_OPTIONS, "app-id", "env", "run-id", "limit"] : audit ? [...JSON_OPTIONS, "limit"] : JSON_OPTIONS;
+  assertArgs(parsed, allowed, credentialSet ? 5 : action === "set" ? 4 : 3);
+  const context = await resolveOperatorContext(parsed, { allowMissingConfig: true });
   await adminAi({
     action: credentialSet ? "credential-set" : credentials ? "credentials" : models ? "models" : usage ? "usage" : audit ? "audit" : action,
     purpose: action === "set" ? parsed.positionals[3] : void 0,
@@ -7371,13 +7611,16 @@ async function adminCommand(parsed) {
     maxInputBytes: numberOpt(parsed.options["max-input-bytes"], "--max-input-bytes"),
     maxOutputTokens: numberOpt(parsed.options["max-output-tokens"], "--max-output-tokens"),
     maxCallsPerRun: numberOpt(parsed.options["max-calls-per-run"], "--max-calls-per-run"),
-    platform: stringOpt(parsed.options.platform),
+    platform: context.platform.value,
+    token: stringOpt(parsed.options.token),
+    tokenFile: context.credentials.scopedTokenFile,
     email: stringOpt(parsed.options.email),
     json: parsed.options.json === true,
     open: parsed.options.open === false ? false : parsed.options.open === true ? true : void 0,
     credentialProvider: credentialSet ? parsed.positionals[4] : void 0,
     fromEnv: stringOpt(parsed.options["from-env"]),
     stdin: parsed.options.stdin === true,
+    readStdin: deps.readStdin,
     discoveryProvider: stringOpt(parsed.options["discovery-provider"]),
     discoveryModel: stringOpt(parsed.options["discovery-model"]),
     validationProvider: stringOpt(parsed.options["validation-provider"]),
@@ -7385,7 +7628,10 @@ async function adminCommand(parsed) {
     appId: stringOpt(parsed.options["app-id"]),
     env: stringOpt(parsed.options.env),
     runId: stringOpt(parsed.options["run-id"]),
-    limit: numberOpt(parsed.options.limit, "--limit")
+    limit: numberOpt(parsed.options.limit, "--limit"),
+    fetch: deps.fetch,
+    stdout: deps.stdout,
+    openApprovalUrl: deps.openUrl
   });
 }
 
@@ -7537,7 +7783,7 @@ async function appExport(options) {
 }
 
 // src/app-import.ts
-import { readFileSync as readFileSync7 } from "fs";
+import { readFileSync as readFileSync8 } from "fs";
 import {
   buildImportOps,
   importMutationId,
@@ -7561,7 +7807,7 @@ async function appImport(options) {
   const say = options.json ? (line) => out.error(line) : (line) => out.log(line);
   const doFetch = options.fetch ?? fetch;
   const { tenant } = resolveTenant(cfg, options.env);
-  const text = options.file === "-" ? (options.readStdin ?? (() => readFileSync7(0, "utf8")))() : readFileSync7(options.file, "utf8");
+  const text = options.file === "-" ? (options.readStdin ?? (() => readFileSync8(0, "utf8")))() : readFileSync8(options.file, "utf8");
   const { format, sources } = parseImport(text, options.ns);
   if (format === "namespace-map" && options.ns) {
     throw new Error("--ns cannot be combined with a {namespace: rows} file \u2014 the file already names each namespace");
@@ -8024,13 +8270,16 @@ function harnessOption(value, flag) {
 
 // src/cli-project.ts
 var SKILL_OPTS = ["dir", "global", "force", "agent", "harness"];
-function install(parsed, positionals) {
+function install(parsed, positionals, deps) {
   assertArgs(parsed, SKILL_OPTS, positionals);
   installSkill({
     dir: stringOpt(parsed.options.dir),
     global: parsed.options.global === true,
     harnesses: harnessList(parsed),
-    force: parsed.options.force === true
+    force: parsed.options.force === true,
+    homeDir: deps.homeDir,
+    codexHomeDir: deps.codexHomeDir,
+    stdout: deps.stdout
   });
 }
 async function secretsCommand(parsed, deps) {
@@ -8046,6 +8295,7 @@ async function secretsCommand(parsed, deps) {
       token: stringOpt(parsed.options.token),
       email: stringOpt(parsed.options.email),
       yes: parsed.options.yes === true,
+      readStdin: deps.readStdin,
       fetch: deps.fetch,
       stdout: deps.stdout
     };
@@ -8104,8 +8354,8 @@ async function projectCommand(command, parsed, deps) {
     return true;
   }
   if (command === "setup") {
-    install(parsed, 1);
-    console.log(
+    install(parsed, 1, deps);
+    (deps.stdout ?? console).log(
       "\nOffline runbooks installed. Open this repo in your coding agent and ask it to set up odla.\nIts native adapter finds the local `odla` skill, chooses build or migration, and drives the CLI."
     );
     return true;
@@ -8113,7 +8363,7 @@ async function projectCommand(command, parsed, deps) {
   if (command === "skill") {
     const sub = parsed.positionals[1];
     if (sub !== "install") throw new Error(`unknown skill subcommand "${sub ?? ""}". Try "odla-ai skill install".`);
-    install(parsed, 2);
+    install(parsed, 2, deps);
     return true;
   }
   if (command === "secrets") {
@@ -8166,246 +8416,19 @@ async function codeCommand(parsed, dependencies) {
 }
 
 // src/operator-credentials.ts
-import process9 from "process";
+import process11 from "process";
 function developerTokenStatus(context, parsed, now = Date.now()) {
   const cached = readJsonFile(context.cfg.local.tokenFile);
   const cacheStatus = !cached?.token ? "missing" : cached.platform !== context.platform.value ? "other-platform" : (cached.expiresAt ?? 0) <= now + 6e4 ? "expired" : "valid";
-  const source = clean(
+  const source = clean3(
     stringOpt(parsed.options.token)
-  ) ? "flag" : clean(process9.env.ODLA_DEV_TOKEN) ? "environment" : cacheStatus === "valid" ? "cache" : "missing";
+  ) ? "flag" : clean3(process11.env.ODLA_DEV_TOKEN) ? "environment" : cacheStatus === "valid" ? "cache" : "missing";
   return {
     source,
     cacheFile: context.cfg.local.tokenFile,
     cacheStatus
   };
 }
-function clean(value) {
-  const normalized = value?.trim();
-  return normalized || void 0;
-}
-
-// src/operator-context.ts
-import { existsSync as existsSync10 } from "fs";
-import { join as join10, resolve as resolve11 } from "path";
-import process11 from "process";
-
-// src/operator-profiles.ts
-import { existsSync as existsSync9, readFileSync as readFileSync8 } from "fs";
-import { homedir as homedir2 } from "os";
-import { dirname as dirname7, join as join9, resolve as resolve10 } from "path";
-import process10 from "process";
-function operatorProfileFile() {
-  return resolve10(
-    clean2(process10.env.ODLA_CONTEXT_FILE) ?? join9(homedir2(), ".odla", "contexts.json")
-  );
-}
-function resolveOperatorProfile(parsed) {
-  const fromFlag = clean2(stringOpt(parsed.options.context));
-  const fromEnvironment = clean2(process10.env.ODLA_CONTEXT);
-  const name = fromFlag ?? fromEnvironment ?? null;
-  const file = operatorProfileFile();
-  if (!name) {
-    return { name: null, source: "unresolved", file, value: null };
-  }
-  assertOperatorName(name, "context");
-  const profiles = readOperatorProfiles(file);
-  const value = Object.hasOwn(profiles, name) ? profiles[name] : void 0;
-  if (!value) {
-    throw new Error(
-      `operator context "${name}" not found in ${file}; run "odla-ai context list" or save it first`
-    );
-  }
-  return {
-    name,
-    source: fromFlag ? "flag" : "environment",
-    file,
-    value
-  };
-}
-function listOperatorProfiles(file = operatorProfileFile()) {
-  return Object.entries(readOperatorProfiles(file)).sort(([a], [b]) => a.localeCompare(b)).map(([name, profile]) => ({ name, ...profile }));
-}
-function saveOperatorProfile(name, profile, file = operatorProfileFile()) {
-  assertOperatorName(name, "context");
-  const normalized = validateProfile(profile, `operator context "${name}"`);
-  const profiles = readOperatorProfiles(file);
-  profiles[name] = normalized;
-  writePrivateJson(file, { schemaVersion: 1, profiles });
-}
-function removeOperatorProfile(name, file = operatorProfileFile()) {
-  assertOperatorName(name, "context");
-  const profiles = readOperatorProfiles(file);
-  if (!Object.hasOwn(profiles, name)) return false;
-  delete profiles[name];
-  writePrivateJson(file, { schemaVersion: 1, profiles });
-  return true;
-}
-function operatorCredentialFiles(selection) {
-  const base = selection.name ? join9(dirname7(selection.file), "profiles", selection.name) : join9(homedir2(), ".odla");
-  return {
-    developer: join9(base, "dev-token.json"),
-    scoped: join9(base, "admin-token.local.json")
-  };
-}
-function assertOperatorName(value, label) {
-  if (!/^[a-z0-9][a-z0-9-]*$/.test(value)) {
-    throw new Error(
-      `${label} must contain lowercase letters, numbers, and hyphens`
-    );
-  }
-}
-function readOperatorProfiles(file) {
-  if (!existsSync9(file)) return emptyProfiles();
-  let raw;
-  try {
-    raw = JSON.parse(readFileSync8(file, "utf8"));
-  } catch {
-    throw new Error(`operator context file ${file} is not valid JSON`);
-  }
-  if (!raw || typeof raw !== "object" || raw.schemaVersion !== 1 || !raw.profiles || typeof raw.profiles !== "object" || Array.isArray(raw.profiles)) {
-    throw new Error(`operator context file ${file} has an invalid shape`);
-  }
-  const unknown = Object.keys(raw).filter(
-    (key) => !["schemaVersion", "profiles"].includes(key)
-  );
-  if (unknown.length > 0) {
-    throw new Error(
-      `operator context file ${file} contains unsupported field(s): ${unknown.sort().join(", ")}`
-    );
-  }
-  const profiles = emptyProfiles();
-  for (const [name, value] of Object.entries(
-    raw.profiles
-  )) {
-    assertOperatorName(name, "context");
-    profiles[name] = validateProfile(value, `operator context "${name}"`);
-  }
-  return profiles;
-}
-function emptyProfiles() {
-  return /* @__PURE__ */ Object.create(null);
-}
-function validateProfile(value, label) {
-  if (!value || typeof value !== "object" || Array.isArray(value)) {
-    throw new Error(`${label} has an invalid shape`);
-  }
-  const unknown = Object.keys(value).filter(
-    (key) => !["platform", "app", "environment"].includes(key)
-  );
-  if (unknown.length > 0) {
-    throw new Error(
-      `${label} contains unsupported field(s): ${unknown.sort().join(", ")}; contexts store scope metadata only, never credentials`
-    );
-  }
-  const candidate = value;
-  if (typeof candidate.platform !== "string") {
-    throw new Error(`${label} needs an absolute platform URL`);
-  }
-  const platform = platformAudience(candidate.platform);
-  const app = clean2(candidate.app);
-  const environment2 = clean2(candidate.environment);
-  if (app) assertOperatorName(app, "app");
-  if (environment2) assertOperatorName(environment2, "environment");
-  return {
-    platform,
-    ...app ? { app } : {},
-    ...environment2 ? { environment: environment2 } : {}
-  };
-}
-function clean2(value) {
-  const normalized = value?.trim();
-  return normalized || void 0;
-}
-
-// src/operator-context.ts
-var DEFAULT_PLATFORM2 = "https://odla.ai";
-async function resolveOperatorContext(parsed, options = {}) {
-  const profile = resolveOperatorProfile(parsed);
-  const configArgument = stringOpt(parsed.options.config) ?? "odla.config.mjs";
-  const configPath = resolve11(configArgument);
-  const explicitConfig = parsed.options.config !== void 0;
-  const hasConfig = existsSync10(configPath);
-  if (!hasConfig && (!options.allowMissingConfig || explicitConfig)) {
-    await loadProjectConfig(configArgument);
-  }
-  const loaded = hasConfig ? await loadProjectConfig(configArgument) : void 0;
-  const platformFlag = clean3(stringOpt(parsed.options.platform));
-  const platformEnvironment = clean3(process11.env.ODLA_PLATFORM_URL);
-  const platformValue = platformAudience(
-    platformFlag ?? platformEnvironment ?? profile.value?.platform ?? loaded?.platformUrl ?? DEFAULT_PLATFORM2
-  );
-  const platformSource = platformFlag ? "flag" : platformEnvironment ? "environment" : profile.value ? "profile" : loaded ? "config" : "default";
-  const appFlag = clean3(stringOpt(parsed.options.app));
-  const appEnvironment = clean3(process11.env.ODLA_APP_ID);
-  const appValue = appFlag ?? appEnvironment ?? profile.value?.app ?? loaded?.app.id ?? null;
-  const appSource = appFlag ? "flag" : appEnvironment ? "environment" : profile.value?.app ? "profile" : loaded ? "config" : "unresolved";
-  if (appValue) assertOperatorName(appValue, "app");
-  if (options.requireApp && !appValue) {
-    throw new Error(
-      "app context is unresolved; pass --app <id>, set ODLA_APP_ID, select --context <name>, or run inside a project with odla.config.mjs"
-    );
-  }
-  const envFlag = clean3(stringOpt(parsed.options.env));
-  const envEnvironment = clean3(process11.env.ODLA_ENV);
-  const environmentValue = envFlag ?? envEnvironment ?? profile.value?.environment ?? options.defaultEnvironment ?? null;
-  const environmentSource = envFlag ? "flag" : envEnvironment ? "environment" : profile.value?.environment ? "profile" : options.defaultEnvironment ? "default" : "unresolved";
-  if (environmentValue) {
-    assertOperatorName(environmentValue, "environment");
-  }
-  const rootDir = loaded?.rootDir ?? process11.cwd();
-  const profileCredentials = operatorCredentialFiles(profile);
-  const tokenFile = clean3(process11.env.ODLA_DEV_TOKEN_FILE) ? resolve11(process11.env.ODLA_DEV_TOKEN_FILE) : profile.name ? profileCredentials.developer : loaded?.local.tokenFile ?? profileCredentials.developer;
-  const scopedTokenFile = clean3(process11.env.ODLA_ADMIN_TOKEN_FILE) ? resolve11(process11.env.ODLA_ADMIN_TOKEN_FILE) : profile.name ? profileCredentials.scoped : loaded ? join10(loaded.rootDir, ".odla", "admin-token.local.json") : profileCredentials.scoped;
-  const cfg = loaded ? {
-    ...loaded,
-    platformUrl: platformValue,
-    app: appValue ? {
-      id: appValue,
-      name: appValue === loaded.app.id ? loaded.app.name : appValue
-    } : loaded.app,
-    local: { ...loaded.local, tokenFile }
-  } : {
-    configPath,
-    rootDir,
-    platformUrl: platformValue,
-    dbEndpoint: platformValue,
-    app: {
-      id: appValue ?? "operator",
-      name: appValue ?? "Operator"
-    },
-    envs: environmentValue ? [environmentValue] : [],
-    services: [],
-    local: {
-      tokenFile,
-      credentialsFile: join10(rootDir, ".odla", "credentials.local.json"),
-      devVarsFile: join10(rootDir, ".dev.vars"),
-      gitignore: true
-    }
-  };
-  return {
-    cfg,
-    profile: {
-      name: profile.name,
-      source: profile.source,
-      file: profile.file
-    },
-    config: {
-      path: configPath,
-      status: loaded ? "loaded" : "absent",
-      explicit: explicitConfig
-    },
-    platform: { value: platformValue, source: platformSource },
-    app: { value: appValue, source: appSource },
-    environment: {
-      value: environmentValue,
-      source: environmentSource
-    },
-    credentials: {
-      developerTokenFile: tokenFile,
-      scopedTokenFile
-    }
-  };
-}
 function clean3(value) {
   const normalized = value?.trim();
   return normalized || void 0;
@@ -11205,7 +11228,7 @@ async function runCli(argv = process.argv.slice(2), dependencies = {}) {
     return;
   }
   if (command === "admin") {
-    await adminCommand(parsed);
+    await adminCommand(parsed, runtime);
     return;
   }
   if (command === "agent") {
@@ -11351,4 +11374,4 @@ export {
   exitCodeFor,
   runCli
 };
-//# sourceMappingURL=chunk-B6DISJPC.js.map
+//# sourceMappingURL=chunk-ONETPJFW.js.map