@odla-ai/cli 0.25.22 → 0.26.1

package/dist/{chunk-2AFAXLKE.js → chunk-ZAZBUURZ.js}

@@ -115,10 +115,10 @@ function isManagedDevVar(line) {
   const match = line.match(/^\s*(?:export\s+)?([A-Z][A-Z0-9_]*)\s*=/);
   return !!match?.[1] && MANAGED_DEV_VARS.has(match[1]);
 }
-function writePrivateText(path, text) {
+function writePrivateText(path, text2) {
   mkdirSync(dirname(path), { recursive: true });
   const temporary = `${path}.tmp-${process.pid}-${Date.now()}`;
-  writeFileSync(temporary, text, { mode: 384 });
+  writeFileSync(temporary, text2, { mode: 384 });
   chmodSync(temporary, 384);
   renameSync(temporary, path);
 }
@@ -439,7 +439,9 @@ function audienceBoundEnvToken(token, platform) {
 }
 var SCOPE_PURPOSE = {
   "platform:status:read": "read the platform fleet health and deployment snapshot",
+  "platform:chat:credential:write": "rotate the built-in Discussion responder credential",
   "app:config:read": "compare checked-in intent with an exact-id app Registry configuration",
+  "app:config:write": "apply or inspect one revision-bound configuration operation for an app you own",
   "platform:runbook:write": "add or edit odla's operational runbooks",
   "platform:ai:policy:write": "change System AI model routing",
   "platform:ai:policy:read": "read System AI model routing",
@@ -537,6 +539,14 @@ async function readSecretStream(kind, stream = process6.stdin) {
   return value2;
 }
 
+// src/principal-presentation.ts
+function unresolvedPrincipalLabel(credentialKind2, principalId) {
+  const kind = typeof credentialKind2 === "string" ? credentialKind2.trim() : "";
+  const id = typeof principalId === "string" ? principalId.trim() : "";
+  const audit = kind && id ? `${kind}:${id}` : kind || id;
+  return `Unknown principal${audit ? ` [${audit}]` : ""}`;
+}
+
 // src/admin-ai-audit.ts
 function adminAiAuditQuery(filters) {
   if (filters.limit === void 0) return "";
@@ -566,17 +576,17 @@ async function readAdminAiAudit(request2) {
       String(event.changeKind ?? ""),
       String(event.purpose ?? event.provider ?? ""),
       route2,
-      `${String(event.actorType ?? "")}:${String(event.actorId ?? "")}`
+      unresolvedPrincipalLabel(event.actorType, event.actorId)
     ].join("	"));
   }
 }
 async function responseBody(response2) {
-  const text = await response2.text();
-  if (!text) return {};
+  const text2 = await response2.text();
+  if (!text2) return {};
   try {
-    return JSON.parse(text);
+    return JSON.parse(text2);
   } catch {
-    return { message: text.slice(0, 300) };
+    return { message: text2.slice(0, 300) };
   }
 }
 function apiError(status, body) {
@@ -643,7 +653,7 @@ when	app/env	run	actor	purpose/role	route / policy	tokens	cost	status`);
       timestamp2(event.created_at),
       `${String(event.app_id ?? "")}/${String(event.env ?? "")}`,
       String(event.run_id ?? ""),
-      `${String(event.actor_type ?? "")}:${String(event.actor_id ?? "")}`,
+      unresolvedPrincipalLabel(event.actor_type, event.actor_id),
       `${String(event.purpose ?? "")}/${String(event.role ?? "")}`,
       `${String(event.provider ?? "")}/${String(event.model ?? "")}@v${String(event.policy_version ?? "unknown")}`,
       String(input + output),
@@ -664,12 +674,12 @@ function timestamp2(value2) {
   return Number.isFinite(date.valueOf()) ? date.toISOString() : "";
 }
 async function responseBody2(res) {
-  const text = await res.text();
-  if (!text) return {};
+  const text2 = await res.text();
+  if (!text2) return {};
   try {
-    return JSON.parse(text);
+    return JSON.parse(text2);
   } catch {
-    return { message: text.slice(0, 300) };
+    return { message: text2.slice(0, 300) };
   }
 }
 function apiError2(action2, status, body) {
@@ -845,12 +855,12 @@ function catalogModels(body) {
   return body.catalog.models.filter((value2) => isRecord3(value2) && typeof value2.id === "string" && typeof value2.provider === "string");
 }
 async function responseBody3(res) {
-  const text = await res.text();
-  if (!text) return {};
+  const text2 = await res.text();
+  if (!text2) return {};
   try {
-    return JSON.parse(text);
+    return JSON.parse(text2);
   } catch {
-    return { message: text.slice(0, 300) };
+    return { message: text2.slice(0, 300) };
   }
 }
 function apiError3(action2, status, body) {
@@ -941,6 +951,7 @@ function unique(values) {
 var DEFAULT_PLATFORM = "https://odla.ai";
 var DEFAULT_ENVS = ["dev"];
 var DEFAULT_SERVICES = ["db", "ai"];
+var configImportSerial = 0;
 var GOOGLE_CALENDAR_EVENTS_SCOPE = "https://www.googleapis.com/auth/calendar.events";
 async function loadProjectConfig(configPath = "odla.config.mjs") {
   const resolved = resolve2(configPath);
@@ -1148,7 +1159,8 @@ function validId2(value2) {
 }
 async function loadConfigModule(path) {
   if (path.endsWith(".json")) return JSON.parse(readFileSync2(path, "utf8"));
-  const mod = await import(`${pathToFileURL(path).href}?t=${Date.now()}`);
+  const nonce = `${Date.now()}-${configImportSerial++}`;
+  const mod = await import(`${pathToFileURL(path).href}?reload=${nonce}`);
   const value2 = mod.default ?? mod.config;
   if (typeof value2 === "function") return await value2();
   return value2;
@@ -1638,7 +1650,8 @@ var CAPABILITIES = {
     "save and explicitly select non-secret named operator contexts with isolated credential caches; resolve and explain platform, app, environment, and credential provenance without authenticating; then run PM, Discussions, o11y, runbook, and identity operations outside a project checkout",
     "read one versioned o11y status envelope spanning application RED, exact Worker versions and Cloudflare colos observed in traffic, current live-sync freshness/load, the protected commit-to-visible canary, collector ingest/scheduler trust, provider-owned runtime metrics, account-scoped Durable Object, D1, and R2 evidence under odla-db, and a bounded machine verdict",
     "read one canonical platform fleet snapshot over private service bindings, including release identities, probe latency, Cloudflare load/runtime freshness, explicit unknowns, and stable next actions through a read-only capability",
-    "compare one project's checked-in Registry intent with live owner-visible state and freeze a secret-free plan digest through an exact app:config:read capability",
+    "compare one project's checked-in Registry intent with live owner-visible state, freeze a secret-free Registry-revision-bound plan through app:config:read, and conditionally apply checkpoint-free actions through exact app:config:write operation routes",
+    "inspect or bounded-wait one exact durable config-operation journal entry and verify every terminal receipt digest before returning it to remote automation",
     "inspect durable agent wakeups as a versioned JSON envelope and explicitly requeue one dead-lettered job with a scoped environment credential",
     "run app-attributed hosted security discovery and independent validation without provider keys",
     "connect/revoke source-read-only GitHub sources and drive commit-pinned hosted security jobs without PATs or provider keys",
@@ -1685,6 +1698,16 @@ function printGroup(out, heading, items) {
   out.log("");
 }
 
+// src/config-operation-error.ts
+var ConfigOperationCommandError = class extends Error {
+  constructor(message2, code) {
+    super(message2);
+    this.code = code;
+    this.name = "ConfigOperationCommandError";
+  }
+  code;
+};
+
 // src/config-reconcile-desired.ts
 import { orderAppServices } from "@odla-ai/apps";
 
@@ -1778,8 +1801,25 @@ function managedServiceConfig(cfg, env, service) {
   return {};
 }
 
-// src/config-reconcile.ts
-import { appServiceIds as appServiceIds2, orderAppServices as orderAppServices2 } from "@odla-ai/apps";
+// src/config-operation-command.ts
+import {
+  AppsError,
+  createAppsClient
+} from "@odla-ai/apps";
+import { join as join3 } from "path";
+
+// src/version.ts
+import { readFileSync as readFileSync3 } from "fs";
+function cliVersion() {
+  const pkg = JSON.parse(readFileSync3(new URL("../package.json", import.meta.url), "utf8"));
+  return pkg.version ?? "unknown";
+}
+
+// src/config-operation-validate.ts
+import {
+  appServiceDefinition as appServiceDefinition2
+} from "@odla-ai/apps";
+import { readFileSync as readFileSync4 } from "fs";
 
 // src/config-reconcile-digest.ts
 import { createHash } from "crypto";
@@ -1790,15 +1830,347 @@ function configDigest(value2) {
   return `sha256:${createHash("sha256").update(canonicalJson(value2)).digest("hex")}`;
 }
 function canonicalValue(value2) {
+  if (value2 === null || typeof value2 === "string" || typeof value2 === "boolean") return value2;
+  if (typeof value2 === "number") {
+    if (!Number.isFinite(value2)) throw new TypeError("canonical JSON rejects non-finite numbers");
+    return value2;
+  }
   if (Array.isArray(value2)) return value2.map(canonicalValue);
   if (value2 && typeof value2 === "object") {
+    const record11 = value2;
     return Object.fromEntries(
-      Object.entries(value2).filter(([, entry]) => entry !== void 0).sort(([left], [right]) => left.localeCompare(right)).map(([key, entry]) => [key, canonicalValue(entry)])
+      Object.keys(record11).filter((key) => record11[key] !== void 0).sort().map((key) => [key, canonicalValue(record11[key])])
     );
   }
-  return value2;
+  throw new TypeError("canonical JSON rejects unsupported values");
+}
+
+// src/config-operation-validate.ts
+var DIGEST = /^sha256:[0-9a-f]{64}$/;
+var REVISION = /^registry:[1-9][0-9]*$/;
+var OPERATION_ID = /^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i;
+var ACTION_ID = /^action-[0-9a-f]{16}$/;
+var ENV = /^[a-z0-9]{2,12}$/;
+var SERVICE = /^[a-z][a-z0-9-]{0,39}$/;
+function readPlan(path) {
+  let value2;
+  try {
+    const raw = readFileSync4(path, "utf8");
+    if (Buffer.byteLength(raw) > 128 * 1024) throw new Error("plan exceeds 128 KiB");
+    value2 = JSON.parse(raw);
+  } catch (error) {
+    throw new ConfigOperationCommandError(
+      `cannot read --plan ${path}: ${error instanceof Error ? error.message : String(error)}`,
+      "invalid_plan"
+    );
+  }
+  if (!record2(value2) || value2.schemaVersion !== "odla.config-plan/v2") invalidPlan("unsupported plan schema");
+  if (!record2(value2.scope) || typeof value2.scope.appId !== "string" || typeof value2.scope.platformUrl !== "string") {
+    invalidPlan("plan scope is invalid");
+  }
+  if (!DIGEST.test(String(value2.desiredRevision)) || !DIGEST.test(String(value2.observedRevision))) {
+    invalidPlan("plan content revisions are invalid");
+  }
+  if (!REVISION.test(String(value2.registryRevision)) || !DIGEST.test(String(value2.planDigest))) {
+    invalidPlan("plan Registry revision or digest is invalid");
+  }
+  if (!Array.isArray(value2.actions) || !value2.actions.length || value2.actions.length > 32) {
+    invalidPlan("plan actions must contain 1-32 entries");
+  }
+  assertActions(value2.actions);
+  const plan = value2;
+  const digest = configDigest({
+    schemaVersion: plan.schemaVersion,
+    desiredRevision: plan.desiredRevision,
+    observedRevision: plan.observedRevision,
+    registryRevision: plan.registryRevision,
+    actions: plan.actions
+  });
+  if (digest !== plan.planDigest) invalidPlan("plan digest does not bind these revisions and actions");
+  return plan;
+}
+function assertPlanContext(plan, appId, platformUrl) {
+  if (plan.scope.appId !== appId || plan.scope.platformUrl.replace(/\/$/, "") !== platformUrl.replace(/\/$/, "")) {
+    throw new ConfigOperationCommandError("plan scope does not match the selected project config", "checkpoint_required");
+  }
+}
+function verifyReceipt(receipt, appId, operationId) {
+  if (receipt.appId !== appId || operationId && receipt.operationId !== operationId) {
+    throw new ConfigOperationCommandError("Registry returned a receipt outside the requested scope", "invalid_receipt");
+  }
+  if (receipt.receiptDigest) {
+    const { receiptDigest, ...fields } = receipt;
+    if (configDigest(fields) !== receiptDigest) {
+      throw new ConfigOperationCommandError("config operation receipt digest is invalid", "invalid_receipt");
+    }
+  } else if (receipt.state === "succeeded" || receipt.state === "conflict" || receipt.state === "failed" && !receipt.error?.retryable) {
+    throw new ConfigOperationCommandError("terminal config operation receipt is not digest-authenticated", "invalid_receipt");
+  }
+}
+function assertOperationId(value2) {
+  if (!OPERATION_ID.test(value2)) {
+    throw new ConfigOperationCommandError("operation id must be a UUID", "invalid_operation_id");
+  }
+}
+function assertActions(actions) {
+  const ids = /* @__PURE__ */ new Set();
+  for (const action2 of actions) {
+    if (!record2(action2)) invalidPlan("every plan action must be an object");
+    const id = String(action2.id ?? "");
+    if (!ACTION_ID.test(id) || ids.has(id)) invalidPlan("plan action ids must be unique frozen ids");
+    ids.add(id);
+    if (typeof action2.path !== "string" || typeof action2.reason !== "string" || !action2.reason || action2.reason.length > 500 || typeof action2.requiresApproval !== "boolean" || !["low", "medium", "high"].includes(String(action2.risk)) || !["provision", "command", "studio"].includes(String(action2.applySupport))) {
+      invalidPlan("plan action metadata is invalid");
+    }
+    if (["rename_app", "enable_service", "configure_service", "set_link"].includes(String(action2.kind))) {
+      assertConditionalAction(action2);
+    }
+  }
+}
+function assertConditionalAction(action2) {
+  if (action2.kind === "rename_app") {
+    if (action2.path !== "app.name" || action2.applySupport !== "command" || typeof action2.before !== "string" || typeof action2.after !== "string" || action2.after !== action2.after.trim() || !action2.after || action2.after.length > 80) invalidPlan("rename action is invalid");
+    return;
+  }
+  if (!action2.env || !ENV.test(action2.env)) invalidPlan("conditional action env is invalid");
+  if (action2.kind === "set_link") {
+    if (action2.path !== `environments.${action2.env}.link` || action2.applySupport !== "provision" || !linkState(action2.before) || !linkState(action2.after)) invalidPlan("link action is invalid");
+    return;
+  }
+  if (!action2.service || !SERVICE.test(action2.service) || !appServiceDefinition2(action2.service)) {
+    invalidPlan("service action names an unknown service");
+  }
+  const base = `environments.${action2.env}.services.${action2.service}`;
+  if (action2.path !== (action2.kind === "configure_service" ? `${base}.config` : base)) {
+    invalidPlan("service action path is invalid");
+  }
+  if (action2.applySupport !== "provision" || !record2(action2.after)) {
+    invalidPlan("service action payload is invalid");
+  }
+  if (action2.kind === "enable_service") {
+    if (action2.after.enabled !== true || action2.before !== null && !record2(action2.before)) {
+      invalidPlan("service enable action is invalid");
+    }
+  } else if (!record2(action2.before)) {
+    invalidPlan("service configure action is invalid");
+  }
+}
+function linkState(value2) {
+  if (value2 === null) return true;
+  if (typeof value2 !== "string") return false;
+  try {
+    const url = new URL(value2.trim());
+    return url.protocol === "http:" || url.protocol === "https:";
+  } catch {
+    return false;
+  }
+}
+function invalidPlan(message2) {
+  throw new ConfigOperationCommandError(message2, "invalid_plan");
+}
+function record2(value2) {
+  return !!value2 && typeof value2 === "object" && !Array.isArray(value2);
+}
+
+// src/config-reconcile-support.ts
+var CONDITIONAL_KINDS = /* @__PURE__ */ new Set([
+  "rename_app",
+  "enable_service",
+  "configure_service",
+  "set_link"
+]);
+function configApplySupport(reconciliation) {
+  if (!reconciliation.observedRevision || !reconciliation.registryRevision) {
+    return {
+      supported: false,
+      checkpointRequired: false,
+      reason: "the app must already exist in a revision-aware Registry"
+    };
+  }
+  if (!reconciliation.actions.length) {
+    return {
+      supported: false,
+      checkpointRequired: false,
+      reason: "there are no managed changes to apply"
+    };
+  }
+  const blocked = reconciliation.actions.filter(
+    (action2) => !CONDITIONAL_KINDS.has(action2.kind) || action2.risk !== "low" || action2.requiresApproval || action2.applySupport === "studio" || action2.env === "prod" || action2.env === "production"
+  );
+  if (blocked.length) {
+    return {
+      supported: false,
+      checkpointRequired: blocked.some(
+        (action2) => action2.risk === "high" || action2.requiresApproval || action2.applySupport === "studio" || action2.env === "prod" || action2.env === "production"
+      ),
+      reason: `${blocked.length} action${blocked.length === 1 ? "" : "s"} remain outside conditional apply`
+    };
+  }
+  return {
+    supported: true,
+    checkpointRequired: false,
+    reason: "all actions are low-risk, checkpoint-free Registry changes"
+  };
 }
 
+// src/config-operation-command.ts
+var IDEMPOTENCY_KEY = /^[A-Za-z0-9][A-Za-z0-9._:-]{0,119}$/;
+var DEFAULT_WAIT_SECONDS = 60;
+var DEFAULT_INTERVAL_SECONDS = 2;
+async function configApply(options) {
+  const plan = readPlan(options.planPath);
+  const cfg = await loadProjectConfig(options.configPath);
+  assertPlanContext(plan, cfg.app.id, cfg.platformUrl);
+  const support = configApplySupport(plan);
+  if (!support.supported) {
+    throw new ConfigOperationCommandError(
+      support.reason,
+      support.checkpointRequired ? "checkpoint_required" : "invalid_plan"
+    );
+  }
+  if (configDigest(desiredRegistryState(cfg)) !== plan.desiredRevision) {
+    throw new ConfigOperationCommandError(
+      "project config changed after this plan was frozen; generate and review a fresh plan",
+      "checkpoint_required"
+    );
+  }
+  const idempotencyKey = options.idempotencyKey ?? `cli:${plan.planDigest.slice(7)}`;
+  if (!IDEMPOTENCY_KEY.test(idempotencyKey)) {
+    throw new ConfigOperationCommandError("--idempotency-key is not a safe 1-120 character key", "invalid_plan");
+  }
+  const client = await operationClient(cfg, options, "apply");
+  const request2 = {
+    schemaVersion: "odla.config-operation-request/v1",
+    expectedRevision: plan.registryRevision,
+    desiredRevision: plan.desiredRevision,
+    observedRevision: plan.observedRevision,
+    planDigest: plan.planDigest,
+    idempotencyKey,
+    source: { kind: "cli", version: cliVersion() },
+    actions: plan.actions
+  };
+  let receipt;
+  try {
+    receipt = await client.applyConfigOperation(cfg.app.id, request2);
+  } catch (error) {
+    const retained = retainedReceipt(error);
+    if (retained) {
+      verifyReceipt(retained, cfg.app.id);
+      printReceipt(retained, options);
+      throw failureForReceipt(retained);
+    }
+    throw normalizeRequestError(error);
+  }
+  verifyReceipt(receipt, cfg.app.id);
+  printReceipt(receipt, options);
+  assertApplyCompleted(receipt);
+  return receipt;
+}
+async function configOperationGet(options) {
+  assertOperationId(options.operationId);
+  const cfg = await loadProjectConfig(options.configPath);
+  const client = await operationClient(cfg, options, "read");
+  const receipt = await client.getConfigOperation(cfg.app.id, options.operationId).catch((error) => {
+    throw normalizeRequestError(error);
+  });
+  if (!receipt) {
+    throw new ConfigOperationCommandError("config operation not found for this app", "operation_not_found");
+  }
+  verifyReceipt(receipt, cfg.app.id, options.operationId);
+  printReceipt(receipt, options);
+  return receipt;
+}
+async function configOperationWait(options) {
+  assertOperationId(options.operationId);
+  const cfg = await loadProjectConfig(options.configPath);
+  const client = await operationClient(cfg, options, "wait");
+  const wait2 = options.pollWait ?? ((ms) => new Promise((resolve12) => setTimeout(resolve12, ms)));
+  const now = () => (options.now?.() ?? /* @__PURE__ */ new Date()).getTime();
+  const deadline = now() + (options.timeoutSeconds ?? DEFAULT_WAIT_SECONDS) * 1e3;
+  const interval = (options.intervalSeconds ?? DEFAULT_INTERVAL_SECONDS) * 1e3;
+  let receipt = null;
+  for (; ; ) {
+    receipt = await client.getConfigOperation(cfg.app.id, options.operationId).catch((error) => {
+      throw normalizeRequestError(error);
+    });
+    if (!receipt) {
+      throw new ConfigOperationCommandError("config operation not found for this app", "operation_not_found");
+    }
+    verifyReceipt(receipt, cfg.app.id, options.operationId);
+    if (receipt.state !== "running") break;
+    if (now() >= deadline) {
+      printReceipt(receipt, options);
+      throw new ConfigOperationCommandError("config operation is still running", "operation_pending");
+    }
+    await wait2(Math.min(interval, Math.max(0, deadline - now())));
+  }
+  printReceipt(receipt, options);
+  if (receipt.state !== "succeeded") throw failureForReceipt(receipt);
+  return receipt;
+}
+async function operationClient(cfg, options, purpose) {
+  const doFetch = options.fetch ?? fetch;
+  const out = options.stdout ?? console;
+  const token = await resolveAdminPlatformToken({
+    platform: cfg.platformUrl,
+    scope: "app:config:write",
+    token: options.token,
+    tokenFile: join3(cfg.rootDir, ".odla", "admin-token.local.json"),
+    rootDir: cfg.rootDir,
+    email: options.email,
+    open: options.open,
+    fetch: doFetch,
+    stdout: out,
+    openApprovalUrl: options.openApprovalUrl,
+    label: `odla CLI (${cfg.app.id} config operation ${purpose})`
+  });
+  return createAppsClient({ endpoint: cfg.platformUrl, token, fetcher: { fetch: doFetch } });
+}
+function printReceipt(receipt, options) {
+  const out = options.stdout ?? console;
+  if (options.json) out.log(JSON.stringify(receipt, null, 2));
+  else {
+    out.log(`config operation ${receipt.operationId}: ${receipt.state}`);
+    out.log(`revision: ${receipt.expectedRevision} \u2192 ${receipt.currentRevision}`);
+    for (const step of receipt.progress) out.log(`  ${step.state}	${step.actionId}	attempts=${step.attempts}`);
+    out.log(`receipt: ${receipt.receiptDigest ?? "pending"}`);
+    out.log(`studio: ${receipt.studioUrl}`);
+  }
+}
+function assertApplyCompleted(receipt) {
+  if (receipt.state === "succeeded") return;
+  throw receipt.state === "running" ? new ConfigOperationCommandError("config operation is still running", "operation_pending") : failureForReceipt(receipt);
+}
+function failureForReceipt(receipt) {
+  if (receipt.state === "conflict") return new ConfigOperationCommandError(
+    receipt.error?.message ?? "config operation conflicted with current Registry state",
+    "checkpoint_required"
+  );
+  if (receipt.error?.retryable) return new ConfigOperationCommandError(receipt.error.message, "remote_unavailable");
+  return new ConfigOperationCommandError(receipt.error?.message ?? `config operation ${receipt.state}`, "config_operation_failed");
+}
+function retainedReceipt(error) {
+  if (!(error instanceof AppsError) || !record3(error.details)) return null;
+  return record3(error.details.operation) ? error.details.operation : null;
+}
+function normalizeRequestError(error) {
+  if (!(error instanceof AppsError)) return error instanceof Error ? error : new Error(String(error));
+  if (error.status === 401 || error.status === 403) {
+    return new ConfigOperationCommandError(error.message, "auth_failed");
+  }
+  if (error.status === 409) return new ConfigOperationCommandError(error.message, "checkpoint_required");
+  if (error.status === 429 || error.status >= 500) {
+    return new ConfigOperationCommandError(error.message, "remote_unavailable");
+  }
+  return new ConfigOperationCommandError(error.message, error.code || "config_operation_failed");
+}
+function record3(value2) {
+  return !!value2 && typeof value2 === "object" && !Array.isArray(value2);
+}
+
+// src/config-reconcile.ts
+import { appServiceIds as appServiceIds2, orderAppServices as orderAppServices2 } from "@odla-ai/apps";
+
 // src/config-reconcile-values.ts
 function difference(path, desired, observed, status, reason, desiredSource, observedSource, env, service) {
   return { path, env, service, status, desired, observed, desiredSource, observedSource, reason };
@@ -1898,6 +2270,7 @@ function reconcileConfig(input) {
     sources: { desired: desiredSource, observed: observedSource },
     desiredRevision,
     observedRevision,
+    registryRevision: input.observed?.configRevision ?? null,
     status: different ? "different" : unmanaged ? "unmanaged" : "in_sync",
     summary: {
       differences: different,
@@ -2050,8 +2423,8 @@ function compareOptionalEnvironmentState(env, desired, observed, desiredSource,
 }
 
 // src/config-reconcile-command.ts
-import { createAppsClient } from "@odla-ai/apps";
-import { join as join3 } from "path";
+import { createAppsClient as createAppsClient2, studioAppSettingsPath } from "@odla-ai/apps";
+import { join as join4 } from "path";
 async function configDiff(options) {
   const reconciliation = await inspectConfig(options);
   const { actions: _actions, ...read3 } = reconciliation;
@@ -2065,20 +2438,19 @@ async function configDiff(options) {
 }
 async function configPlan(options) {
   const reconciliation = await inspectConfig(options);
+  const apply = configApplySupport(reconciliation);
   const planDigest = configDigest({
-    schemaVersion: "odla.config-plan/v1",
+    schemaVersion: "odla.config-plan/v2",
     desiredRevision: reconciliation.desiredRevision,
     observedRevision: reconciliation.observedRevision,
+    registryRevision: reconciliation.registryRevision,
     actions: reconciliation.actions
   });
   const document = {
-    schemaVersion: "odla.config-plan/v1",
+    schemaVersion: "odla.config-plan/v2",
     ...reconciliation,
     planDigest,
-    apply: {
-      supported: false,
-      reason: "conditional, resumable config apply is not available yet; use the exact reviewed commands below"
-    },
+    apply,
     nextActions: planNextActions(reconciliation, options.configPath)
   };
   printPlan(document, options);
@@ -2092,7 +2464,7 @@ async function inspectConfig(options) {
     platform: cfg.platformUrl,
     scope: "app:config:read",
     token: options.token,
-    tokenFile: join3(cfg.rootDir, ".odla", "admin-token.local.json"),
+    tokenFile: join4(cfg.rootDir, ".odla", "admin-token.local.json"),
     rootDir: cfg.rootDir,
     email: options.email,
     open: options.open,
@@ -2101,7 +2473,7 @@ async function inspectConfig(options) {
     openApprovalUrl: options.openApprovalUrl,
     label: `odla CLI (${cfg.app.id} config read)`
   });
-  const client = createAppsClient({ endpoint: cfg.platformUrl, token, fetcher: { fetch: doFetch } });
+  const client = createAppsClient2({ endpoint: cfg.platformUrl, token, fetcher: { fetch: doFetch } });
   const observed = await client.resolveApp(cfg.app.id);
   return reconcileConfig({
     desired: desiredRegistryState(cfg),
@@ -2137,7 +2509,7 @@ function printPlan(document, options) {
   }
   if (!document.actions.length) out.log("  no managed changes");
   out.log(`plan digest: ${document.planDigest}`);
-  out.log(`apply: unsupported \u2014 ${document.apply.reason}`);
+  out.log(`apply: ${document.apply.supported ? "supported" : "blocked"} \u2014 ${document.apply.reason}`);
   printNext(out, document.nextActions);
 }
 function printHeader(out, kind, document) {
@@ -2145,6 +2517,7 @@ function printHeader(out, kind, document) {
   out.log(`platform: ${document.scope.platformUrl}`);
   out.log(`desired:  ${document.desiredRevision}`);
   out.log(`observed: ${document.observedRevision ?? "absent"}`);
+  out.log(`registry: ${document.registryRevision ?? "absent"}`);
   out.log(
     `summary: ${document.summary.differences} different, ${document.summary.unmanaged} unmanaged, ${document.summary.actions} planned actions`
   );
@@ -2177,6 +2550,13 @@ function diffNextActions(reconciliation, configPath) {
 }
 function planNextActions(reconciliation, configPath) {
   const next = [];
+  if (configApplySupport(reconciliation).supported) {
+    next.push({
+      code: "apply_frozen_plan",
+      command: "odla-ai config apply --plan <saved-plan.json> --json",
+      description: "Save this JSON document, then conditionally apply these exact revision-bound actions."
+    });
+  }
   if (reconciliation.actions.some((action2) => action2.applySupport === "provision")) {
     next.push({
       code: "review_provision",
@@ -2190,35 +2570,39 @@ function planNextActions(reconciliation, configPath) {
     }
   }
   if (reconciliation.actions.some((action2) => action2.applySupport === "studio")) {
-    const { appId, platformUrl } = reconciliation.scope;
     next.push({
       code: "review_destructive",
-      command: `${platformUrl}/studio/apps/${encodeURIComponent(appId)}/settings`,
+      command: studioSettingsUrl(reconciliation),
       description: "Review service disablement in the owning Studio scope; this plan will not apply it."
     });
   }
   if (!reconciliation.actions.length && reconciliation.summary.unmanaged) {
     next.push({
       code: "declare_or_accept_runtime_state",
-      command: `${reconciliation.scope.platformUrl}/studio/apps/${encodeURIComponent(reconciliation.scope.appId)}/settings`,
+      command: studioSettingsUrl(reconciliation),
       description: "Declare the live value in project config or keep it as an explicit runtime-managed setting."
     });
   }
   return next;
 }
+function studioSettingsUrl(reconciliation) {
+  const environment2 = reconciliation.actions.map((action2) => action2.env).concat(reconciliation.scope.environments).find((candidate) => candidate === "dev" || candidate === "prod") ?? "dev";
+  const origin = reconciliation.scope.platformUrl.replace(/\/$/, "");
+  return `${origin}${studioAppSettingsPath(reconciliation.scope.appId, environment2, "environment")}`;
+}
 function quoteArg2(value2) {
   return `'${value2.replace(/'/g, `'\\''`)}'`;
 }
 
 // src/doctor-checks.ts
 import { execFileSync } from "child_process";
-import { existsSync as existsSync5, readFileSync as readFileSync4 } from "fs";
-import { join as join5, resolve as resolve3 } from "path";
+import { existsSync as existsSync5, readFileSync as readFileSync6 } from "fs";
+import { join as join6, resolve as resolve3 } from "path";
 
 // src/wrangler.ts
 import { spawn as spawn2 } from "child_process";
-import { existsSync as existsSync4, readFileSync as readFileSync3 } from "fs";
-import { join as join4 } from "path";
+import { existsSync as existsSync4, readFileSync as readFileSync5 } from "fs";
+import { join as join5 } from "path";
 var defaultRunner = (cmd, args, opts) => new Promise((resolvePromise, reject) => {
   const child = spawn2(cmd, args, { cwd: opts?.cwd, stdio: ["pipe", "pipe", "pipe"] });
   let stdout = "";
@@ -2232,7 +2616,7 @@ var defaultRunner = (cmd, args, opts) => new Promise((resolvePromise, reject) =>
 var WRANGLER_CONFIG_FILES = ["wrangler.jsonc", "wrangler.json", "wrangler.toml"];
 function findWranglerConfig(rootDir) {
   for (const name of WRANGLER_CONFIG_FILES) {
-    const path = join4(rootDir, name);
+    const path = join5(rootDir, name);
     if (existsSync4(path)) return path;
   }
   return null;
@@ -2240,20 +2624,20 @@ function findWranglerConfig(rootDir) {
 function readWranglerConfig(path) {
   if (path.endsWith(".toml")) return null;
   try {
-    return JSON.parse(stripJsonComments(readFileSync3(path, "utf8")));
+    return JSON.parse(stripJsonComments(readFileSync5(path, "utf8")));
   } catch {
     return null;
   }
 }
-function stripJsonComments(text) {
+function stripJsonComments(text2) {
   let result = "";
   let inString = false;
-  for (let i = 0; i < text.length; i++) {
-    const ch = text[i];
+  for (let i = 0; i < text2.length; i++) {
+    const ch = text2[i];
     if (inString) {
       result += ch;
       if (ch === "\\") {
-        result += text[i + 1] ?? "";
+        result += text2[i + 1] ?? "";
         i++;
       } else if (ch === '"') {
         inString = false;
@@ -2265,14 +2649,14 @@ function stripJsonComments(text) {
       result += ch;
       continue;
     }
-    if (ch === "/" && text[i + 1] === "/") {
-      while (i < text.length && text[i] !== "\n") i++;
+    if (ch === "/" && text2[i + 1] === "/") {
+      while (i < text2.length && text2[i] !== "\n") i++;
       result += "\n";
       continue;
     }
-    if (ch === "/" && text[i + 1] === "*") {
+    if (ch === "/" && text2[i + 1] === "*") {
       i += 2;
-      while (i < text.length && !(text[i] === "*" && text[i + 1] === "/")) i++;
+      while (i < text2.length && !(text2[i] === "*" && text2[i + 1] === "/")) i++;
       i++;
       continue;
     }
@@ -2289,7 +2673,14 @@ async function wranglerLoggedIn(run, cwd) {
   }
 }
 function wranglerPutSecret(run, opts) {
-  const args = ["wrangler", "secret", "put", opts.name, ...opts.env ? ["--env", opts.env] : []];
+  const args = [
+    "wrangler",
+    "secret",
+    "put",
+    opts.name,
+    ...opts.env ? ["--env", opts.env] : [],
+    ...opts.configPath ? ["--config", opts.configPath] : []
+  ];
   return run("npx", args, { input: opts.value, cwd: opts.cwd });
 }
 
@@ -2341,7 +2732,7 @@ function wranglerWarnings(rootDir) {
       const dir = resolve3(rootDir, assets.directory);
       if (dir === resolve3(rootDir)) {
         warnings.push(`${label}assets.directory is the project root \u2014 point it at a dedicated build dir (wrangler dev fails with "spawn EBADF")`);
-      } else if (existsSync5(join5(dir, "node_modules"))) {
+      } else if (existsSync5(join6(dir, "node_modules"))) {
         warnings.push(`${label}assets.directory contains node_modules \u2014 wrangler dev's watcher will exhaust file descriptors`);
       }
     }
@@ -2382,7 +2773,7 @@ function o11yProjectWarnings(rootDir) {
   } else {
     let source = "";
     try {
-      source = readFileSync4(main, "utf8");
+      source = readFileSync6(main, "utf8");
     } catch {
     }
     if (!/\bwithObservability\b/.test(source)) {
@@ -2406,7 +2797,7 @@ function calendarProjectWarnings(rootDir) {
 }
 function readPackageJson(rootDir) {
   try {
-    return JSON.parse(readFileSync4(join5(rootDir, "package.json"), "utf8"));
+    return JSON.parse(readFileSync6(join6(rootDir, "package.json"), "utf8"));
   } catch {
     return null;
   }
@@ -2616,7 +3007,7 @@ async function doctor(options) {
 // src/init.ts
 import { existsSync as existsSync6, mkdirSync as mkdirSync2, writeFileSync as writeFileSync2 } from "fs";
 import { dirname as dirname4, resolve as resolve4 } from "path";
-import { appServiceDefinition as appServiceDefinition2, appServiceIds as appServiceIds3 } from "@odla-ai/apps";
+import { appServiceDefinition as appServiceDefinition3, appServiceIds as appServiceIds3 } from "@odla-ai/apps";
 function initProject(options) {
   const out = options.stdout ?? console;
   const rootDir = resolve4(options.rootDir ?? process.cwd());
@@ -2630,7 +3021,7 @@ function initProject(options) {
   const envs = options.envs?.length ? options.envs : ["dev"];
   const services = options.services?.length ? options.services : ["db", "ai"];
   for (const service of services) {
-    const definition = appServiceDefinition2(service);
+    const definition = appServiceDefinition3(service);
     if (!definition) throw new Error(`--services contains unknown service "${service}" (known: ${appServiceIds3().join(", ")})`);
     for (const dependency of definition.requires) {
       if (!services.includes(dependency)) throw new Error(`--services ${service} requires ${dependency}`);
@@ -2648,9 +3039,9 @@ function initProject(options) {
   out.log("created src/odla/schema.mjs and src/odla/rules.mjs");
   out.log("updated .gitignore for local odla credentials");
 }
-function writeIfMissing(path, text) {
+function writeIfMissing(path, text2) {
   if (existsSync6(path)) return;
-  writeFileSync2(path, text);
+  writeFileSync2(path, text2);
 }
 function configTemplate(input) {
   const calendar = input.services.includes("calendar") ? `  calendar: {
@@ -2858,13 +3249,13 @@ async function secretsSetClerkKey(options) {
     body: JSON.stringify({ value: value2 })
   });
   if (!res.ok) {
-    const text = scrubValue((await res.text().catch(() => "")).slice(0, 300), value2);
-    throw new Error(`store Clerk secret key failed (${res.status}): ${text || "request failed"}`);
+    const text2 = scrubValue((await res.text().catch(() => "")).slice(0, 300), value2);
+    throw new Error(`store Clerk secret key failed (${res.status}): ${text2 || "request failed"}`);
   }
   out.log(`Clerk secret key stored for ${tenantId} ($clerk_secret, reserved + write-only; the value was never echoed)`);
 }
-function scrubValue(text, value2) {
-  return redactSecrets(text).split(value2).join("[value redacted]");
+function scrubValue(text2, value2) {
+  return redactSecrets(text2).split(value2).join("[value redacted]");
 }
 async function resolveVaultWrite(options) {
   const out = options.stdout ?? console;
@@ -2881,9 +3272,9 @@ async function resolveVaultWrite(options) {
 }
 
 // src/skill.ts
-import { existsSync as existsSync7, lstatSync, mkdirSync as mkdirSync3, readFileSync as readFileSync5, readdirSync, writeFileSync as writeFileSync3 } from "fs";
+import { existsSync as existsSync7, lstatSync, mkdirSync as mkdirSync3, readFileSync as readFileSync7, readdirSync, writeFileSync as writeFileSync3 } from "fs";
 import { homedir } from "os";
-import { dirname as dirname5, isAbsolute as isAbsolute3, join as join6, relative as relative2, resolve as resolve5, sep } from "path";
+import { dirname as dirname5, isAbsolute as isAbsolute3, join as join7, relative as relative2, resolve as resolve5, sep } from "path";
 import { fileURLToPath } from "url";
 
 // src/skill-adapters.ts
@@ -2977,12 +3368,12 @@ function installSkill(options = {}) {
     plans.set(target, { target, content: content2, boundary, managedMerge });
   };
   const planSkillTree = (targetDir2, boundary = root) => {
-    for (const rel of files) plan(join6(targetDir2, rel), readFileSync5(join6(sourceDir, rel), "utf8"), false, boundary);
+    for (const rel of files) plan(join7(targetDir2, rel), readFileSync7(join7(sourceDir, rel), "utf8"), false, boundary);
   };
   let targetDir;
   if (options.global) {
-    const claudeRoot = join6(home, ".claude", "skills");
-    const codexRoot = resolve5(options.codexHomeDir ?? process.env.CODEX_HOME ?? join6(home, ".codex"), "skills");
+    const claudeRoot = join7(home, ".claude", "skills");
+    const codexRoot = resolve5(options.codexHomeDir ?? process.env.CODEX_HOME ?? join7(home, ".codex"), "skills");
     targetDir = harnesses[0] === "codex" ? codexRoot : claudeRoot;
     for (const harness of harnesses) {
       const skillRoot = harness === "claude" ? claudeRoot : codexRoot;
@@ -2990,35 +3381,35 @@ function installSkill(options = {}) {
       rememberTarget(harness, skillRoot);
     }
   } else {
-    const sharedRoot = join6(root, ".agents", "skills");
+    const sharedRoot = join7(root, ".agents", "skills");
     planSkillTree(sharedRoot);
-    const claudeRoot = join6(root, ".claude", "skills");
+    const claudeRoot = join7(root, ".claude", "skills");
     targetDir = harnesses.includes("claude") ? claudeRoot : sharedRoot;
     for (const harness of harnesses) rememberTarget(harness, sharedRoot);
     if (harnesses.includes("claude")) {
       for (const skill of skillNames(files)) {
-        const canonical = readFileSync5(join6(sourceDir, skill, "SKILL.md"), "utf8");
-        plan(join6(claudeRoot, skill, "SKILL.md"), claudeAdapter(skill, canonical));
+        const canonical = readFileSync7(join7(sourceDir, skill, "SKILL.md"), "utf8");
+        plan(join7(claudeRoot, skill, "SKILL.md"), claudeAdapter(skill, canonical));
       }
       rememberTarget("claude", claudeRoot);
     }
     if (harnesses.includes("cursor")) {
-      const cursorRule = join6(root, ".cursor", "rules", "odla.mdc");
+      const cursorRule = join7(root, ".cursor", "rules", "odla.mdc");
       plan(cursorRule, CURSOR_RULE);
       rememberTarget("cursor", cursorRule);
     }
     if (harnesses.includes("agents")) {
-      const agentsFile = join6(root, "AGENTS.md");
+      const agentsFile = join7(root, "AGENTS.md");
       plan(agentsFile, managedFileContent(agentsFile, PROJECT_INSTRUCTIONS, options.force === true, root), true);
       rememberTarget("agents", agentsFile);
     }
     if (harnesses.includes("copilot")) {
-      const copilotFile = join6(root, ".github", "copilot-instructions.md");
+      const copilotFile = join7(root, ".github", "copilot-instructions.md");
       plan(copilotFile, managedFileContent(copilotFile, PROJECT_INSTRUCTIONS, options.force === true, root), true);
       rememberTarget("copilot", copilotFile);
     }
     if (harnesses.includes("gemini")) {
-      const geminiFile = join6(root, "GEMINI.md");
+      const geminiFile = join7(root, "GEMINI.md");
       plan(geminiFile, managedFileContent(geminiFile, PROJECT_INSTRUCTIONS, options.force === true, root), true);
       rememberTarget("gemini", geminiFile);
     }
@@ -3036,7 +3427,7 @@ function installSkill(options = {}) {
       writtenPaths.add(file.target);
       continue;
     }
-    const current = readFileSync5(file.target, "utf8");
+    const current = readFileSync7(file.target, "utf8");
     if (current === file.content) {
       unchangedPaths.add(file.target);
     } else if (file.managedMerge || options.force) {
@@ -3053,7 +3444,7 @@ ${conflicts.map((f) => `  - ${f}`).join("\n")}`
     );
   }
   for (const file of plans.values()) {
-    if (!existsSync7(file.target) || readFileSync5(file.target, "utf8") !== file.content) {
+    if (!existsSync7(file.target) || readFileSync7(file.target, "utf8") !== file.content) {
       mkdirSync3(dirname5(file.target), { recursive: true });
       writeFileSync3(file.target, file.content);
     }
@@ -3098,7 +3489,7 @@ function managedFileContent(path, block, force, boundary) {
   if (symlink) throw new Error(`refusing to manage ${path}: symbolic link component ${symlink}`);
   if (!existsSync7(path)) return `${block}
 `;
-  const current = readFileSync5(path, "utf8");
+  const current = readFileSync7(path, "utf8");
   const start = "<!-- odla-ai agent setup:start -->";
   const end = "<!-- odla-ai agent setup:end -->";
   const startAt = current.indexOf(start);
@@ -3125,7 +3516,7 @@ function symlinkedComponent(boundary, target) {
   }
   let current = boundary;
   for (const part of rel.split(sep).filter(Boolean)) {
-    current = join6(current, part);
+    current = join7(current, part);
     try {
       if (lstatSync(current).isSymbolicLink()) return current;
     } catch (error) {
@@ -3142,7 +3533,7 @@ function listFiles(dir) {
   const results = [];
   const walk = (current) => {
     for (const entry of readdirSync(current, { withFileTypes: true })) {
-      const path = join6(current, entry.name);
+      const path = join7(current, entry.name);
       if (entry.isDirectory()) walk(path);
       else results.push(relative2(dir, path));
     }
@@ -3533,7 +3924,7 @@ import { spawn as spawn3 } from "child_process";
 import { createHash as createHash2 } from "crypto";
 import { copyFile, mkdtemp, readFile, rm, writeFile } from "fs/promises";
 import { tmpdir } from "os";
-import { join as join7 } from "path";
+import { join as join8 } from "path";
 import { fileURLToPath as fileURLToPath2 } from "url";
 var runCodeImageCommand = (command, args, stdio) => new Promise((accept, reject) => {
   const child = spawn3(command, [...args], { shell: false, stdio });
@@ -3592,10 +3983,10 @@ async function embeddedPiImageName() {
   return `odla-ai/pi-agent:embedded-sha256-${createHash2("sha256").update(bundle).digest("hex")}`;
 }
 async function buildEmbeddedPiImage(engine, image, run) {
-  const context = await mkdtemp(join7(tmpdir(), "odla-code-pi-"));
+  const context = await mkdtemp(join8(tmpdir(), "odla-code-pi-"));
   try {
-    await copyFile(embeddedPiAssetPath(), join7(context, "pi-agent.js"));
-    await writeFile(join7(context, "Dockerfile"), [
+    await copyFile(embeddedPiAssetPath(), join8(context, "pi-agent.js"));
+    await writeFile(join8(context, "Dockerfile"), [
       `FROM ${CODE_NODE_IMAGE}`,
       "COPY pi-agent.js /opt/odla/pi-agent.js",
       "WORKDIR /workspace",
@@ -3621,7 +4012,7 @@ var CONTROL = /[\u0000-\u0008\u000b\u000c\u000e-\u001f\u007f]/;
 var HarnessProtocolError = class extends Error {
   name = "HarnessProtocolError";
 };
-function record2(value2) {
+function record4(value2) {
   return value2 !== null && typeof value2 === "object" && !Array.isArray(value2) ? value2 : null;
 }
 function boundedText(value2, label, max) {
@@ -3638,7 +4029,7 @@ function parseAgentOutput(line) {
   } catch {
     throw new HarnessProtocolError("agent emitted invalid JSON");
   }
-  const message2 = record2(value2);
+  const message2 = record4(value2);
   if (!message2 || message2.protocolVersion !== HARNESS_PROTOCOL_VERSION) {
     throw new HarnessProtocolError(`agent protocolVersion must be ${HARNESS_PROTOCOL_VERSION}`);
   }
@@ -3651,7 +4042,7 @@ function parseAgentOutput(line) {
     };
   }
   if (message2.type === "inference.request") {
-    const call2 = record2(message2.call);
+    const call2 = record4(message2.call);
     if (!call2 || !Array.isArray(call2.messages) || !Number.isSafeInteger(call2.maxTokens)) {
       throw new HarnessProtocolError("inference.request.call requires messages and maxTokens");
     }
@@ -3663,7 +4054,7 @@ function parseAgentOutput(line) {
     };
   }
   if (message2.type === "tool.request") {
-    const input = record2(message2.input);
+    const input = record4(message2.input);
     const tool = String(message2.tool);
     if (!input || !["sandbox.read", "sandbox.apply_patch", "sandbox.run_recipe"].includes(tool)) {
       throw new HarnessProtocolError("tool.request requires a registered tool and object input");
@@ -3698,7 +4089,7 @@ function encodeAgentInput(message2) {
 import { execFile as execFile2, spawn as spawn4 } from "child_process";
 import { constants } from "fs";
 import { access } from "fs/promises";
-import { delimiter, join as join8 } from "path";
+import { delimiter, join as join9 } from "path";
 import { getgid, getuid } from "process";
 import { mkdir, mkdtemp as mkdtemp2, realpath, rm as rm2, writeFile as writeFile2 } from "fs/promises";
 import { tmpdir as tmpdir2 } from "os";
@@ -3716,7 +4107,7 @@ function assertPinnedImage(image) {
 async function commandAvailable(engine) {
   for (const directory of (process.env.PATH ?? "").split(delimiter).filter(Boolean)) {
     try {
-      await access(join8(directory, engine), constants.X_OK);
+      await access(join9(directory, engine), constants.X_OK);
       return true;
     } catch {
     }
@@ -3847,8 +4238,8 @@ async function runContainerAttempt(options) {
   let stopped = false;
   let exited = false;
   child.stderr.setEncoding("utf8");
-  child.stderr.on("data", (text) => {
-    if (stderr.length < 64 * 1024) stderr += text.slice(0, 64 * 1024 - stderr.length);
+  child.stderr.on("data", (text2) => {
+    if (stderr.length < 64 * 1024) stderr += text2.slice(0, 64 * 1024 - stderr.length);
   });
   const stop = (reason) => {
     if (stopped || exited) return;
@@ -4006,8 +4397,8 @@ async function materializeGitTree(source, commitSha, options = {}) {
   const maxFiles = options.maxFiles ?? 2e4;
   const maxBytes = options.maxBytes ?? 512 * 1024 * 1024;
   const inventory = (await gitOutput(sourceDir, ["ls-tree", "-rz", commitSha], 16 * 1024 * 1024)).toString("utf8").split("\0").filter(Boolean);
-  const entries = inventory.flatMap((record8) => {
-    const match = /^(100644|100755) blob ([0-9a-f]{40,64})\t([\s\S]+)$/.exec(record8);
+  const entries = inventory.flatMap((record11) => {
+    const match = /^(100644|100755) blob ([0-9a-f]{40,64})\t([\s\S]+)$/.exec(record11);
     return match && allowedWorkspacePath(match[3]) ? [{ mode: match[1], hash: match[2], path: match[3] }] : [];
   });
   if (entries.length > maxFiles) throw new Error(`workspace exceeds ${maxFiles} files`);
@@ -4255,8 +4646,8 @@ function normalize(value2) {
   if (Array.isArray(value2)) return value2.map(normalize);
   if (value2 instanceof Uint8Array) return { $bytes: [...value2] };
   if (typeof value2 === "object") {
-    const record8 = value2;
-    return Object.fromEntries(Object.keys(record8).filter((key) => record8[key] !== void 0).sort().map((key) => [key, normalize(record8[key])]));
+    const record11 = value2;
+    return Object.fromEntries(Object.keys(record11).filter((key) => record11[key] !== void 0).sort().map((key) => [key, normalize(record11[key])]));
   }
   throw new CamelError("state_conflict", "Canonical JSON rejects unsupported values.");
 }
@@ -4335,7 +4726,7 @@ function normalizeReaders(readers) {
 }
 
 // ../camel/dist/code.js
-var DIGEST = /^sha256:[0-9a-f]{64}$/;
+var DIGEST2 = /^sha256:[0-9a-f]{64}$/;
 var SHA = /^[0-9a-f]{40}(?:[0-9a-f]{24})?$/;
 var ID = /^[A-Za-z0-9._:-]{1,160}$/;
 async function digestCodeVerificationReceipt(fields) {
@@ -4370,18 +4761,18 @@ async function digestCodeVerificationReceipt(fields) {
   return `sha256:${await sha256Hex(canonicalJson2(canonical))}`;
 }
 function validate(fields) {
-  if (fields.schemaVersion !== 1 || typeof fields.verificationId !== "string" || !ID.test(fields.verificationId) || typeof fields.trustedBaseCommitSha !== "string" || !SHA.test(fields.trustedBaseCommitSha) || !DIGEST.test(fields.trustedBaseDigest) || !DIGEST.test(fields.patchDigest) || !DIGEST.test(fields.candidateDigest) || !DIGEST.test(fields.sourceDigest) || !DIGEST.test(fields.policyDigest) || !DIGEST.test(fields.changedTestSetDigest) || !Number.isSafeInteger(fields.changedTestCount) || fields.changedTestCount < 0 || fields.changedTestCount > 1e4 || fields.changedTestsRequireReview !== fields.changedTestCount > 0 || fields.recipes.length < 1 || fields.recipes.length > 64) {
+  if (fields.schemaVersion !== 1 || typeof fields.verificationId !== "string" || !ID.test(fields.verificationId) || typeof fields.trustedBaseCommitSha !== "string" || !SHA.test(fields.trustedBaseCommitSha) || !DIGEST2.test(fields.trustedBaseDigest) || !DIGEST2.test(fields.patchDigest) || !DIGEST2.test(fields.candidateDigest) || !DIGEST2.test(fields.sourceDigest) || !DIGEST2.test(fields.policyDigest) || !DIGEST2.test(fields.changedTestSetDigest) || !Number.isSafeInteger(fields.changedTestCount) || fields.changedTestCount < 0 || fields.changedTestCount > 1e4 || fields.changedTestsRequireReview !== fields.changedTestCount > 0 || fields.recipes.length < 1 || fields.recipes.length > 64) {
     throw new CamelError("state_conflict", "Code verification receipt is malformed or outside its bounds.");
   }
   const ids = /* @__PURE__ */ new Set();
   for (const recipe2 of fields.recipes) {
-    if (typeof recipe2.recipeId !== "string" || !ID.test(recipe2.recipeId) || ids.has(recipe2.recipeId) || typeof recipe2.recipeDigest !== "string" || !DIGEST.test(recipe2.recipeDigest) || !["passed", "failed", "timed_out", "output_limited"].includes(recipe2.status) || !Number.isSafeInteger(recipe2.exitCode) || recipe2.exitCode < 0 || recipe2.exitCode > 255 || !Number.isSafeInteger(recipe2.durationMs) || recipe2.durationMs < 0 || recipe2.durationMs > 30 * 6e4) {
+    if (typeof recipe2.recipeId !== "string" || !ID.test(recipe2.recipeId) || ids.has(recipe2.recipeId) || typeof recipe2.recipeDigest !== "string" || !DIGEST2.test(recipe2.recipeDigest) || !["passed", "failed", "timed_out", "output_limited"].includes(recipe2.status) || !Number.isSafeInteger(recipe2.exitCode) || recipe2.exitCode < 0 || recipe2.exitCode > 255 || !Number.isSafeInteger(recipe2.durationMs) || recipe2.durationMs < 0 || recipe2.durationMs > 30 * 6e4) {
       throw new CamelError("state_conflict", "Code verification recipe receipt is malformed or outside its bounds.");
     }
     const artifactIds = /* @__PURE__ */ new Set();
     if (recipe2.artifacts.length > 64) throw new CamelError("state_conflict", "Code verification has too many artifacts.");
     for (const artifact of recipe2.artifacts) {
-      if (typeof artifact.artifactId !== "string" || !ID.test(artifact.artifactId) || artifactIds.has(artifact.artifactId) || !["verified", "missing", "invalid", "too_large"].includes(artifact.status) || artifact.bytes !== null && (!Number.isSafeInteger(artifact.bytes) || artifact.bytes < 0) || artifact.digest !== null && !DIGEST.test(artifact.digest) || artifact.status === "verified" !== (artifact.bytes !== null && artifact.digest !== null) || ["missing", "invalid"].includes(artifact.status) && (artifact.bytes !== null || artifact.digest !== null) || artifact.status === "too_large" && (artifact.bytes === null || artifact.digest !== null)) {
+      if (typeof artifact.artifactId !== "string" || !ID.test(artifact.artifactId) || artifactIds.has(artifact.artifactId) || !["verified", "missing", "invalid", "too_large"].includes(artifact.status) || artifact.bytes !== null && (!Number.isSafeInteger(artifact.bytes) || artifact.bytes < 0) || artifact.digest !== null && !DIGEST2.test(artifact.digest) || artifact.status === "verified" !== (artifact.bytes !== null && artifact.digest !== null) || ["missing", "invalid"].includes(artifact.status) && (artifact.bytes !== null || artifact.digest !== null) || artifact.status === "too_large" && (artifact.bytes === null || artifact.digest !== null)) {
         throw new CamelError("state_conflict", "Code verification artifact receipt is malformed.");
       }
       artifactIds.add(artifact.artifactId);
@@ -4397,7 +4788,7 @@ function validate(fields) {
   }
 }
 var SHA2 = /^[0-9a-f]{40}(?:[0-9a-f]{24})?$/;
-var DIGEST2 = /^sha256:[0-9a-f]{64}$/;
+var DIGEST22 = /^sha256:[0-9a-f]{64}$/;
 var ID2 = /^[A-Za-z0-9._:-]{1,180}$/;
 var MAX_PATCH_BYTES = 256 * 1024;
 var MAX_STATE_BYTES = 64 * 1024;
@@ -4442,14 +4833,14 @@ function normalizeState(value2) {
   ]);
   const planCursor = state2.planCursor;
   const conversations = strings(state2.conversationRefs, "conversationRefs", ID2, 256, false);
-  const approvals = strings(state2.unresolvedApprovals, "unresolvedApprovals", DIGEST2, 256, true);
-  if (planCursor !== null && (typeof planCursor !== "string" || !ID2.test(planCursor)) || typeof state2.planningInputDigest !== "string" || !DIGEST2.test(state2.planningInputDigest) || typeof state2.buildPolicyDigest !== "string" || !DIGEST2.test(state2.buildPolicyDigest) || state2.dependencyLayerDigest !== null && (typeof state2.dependencyLayerDigest !== "string" || !DIGEST2.test(state2.dependencyLayerDigest)) || state2.verificationDigest !== null && (typeof state2.verificationDigest !== "string" || !DIGEST2.test(state2.verificationDigest)) || state2.reviewDigest !== null && (typeof state2.reviewDigest !== "string" || !DIGEST2.test(state2.reviewDigest)) || !["candidate_untrusted", "verified", "reviewed"].includes(String(state2.trustStatus)) || !Array.isArray(state2.completedEffects) || state2.completedEffects.length > 256) {
+  const approvals = strings(state2.unresolvedApprovals, "unresolvedApprovals", DIGEST22, 256, true);
+  if (planCursor !== null && (typeof planCursor !== "string" || !ID2.test(planCursor)) || typeof state2.planningInputDigest !== "string" || !DIGEST22.test(state2.planningInputDigest) || typeof state2.buildPolicyDigest !== "string" || !DIGEST22.test(state2.buildPolicyDigest) || state2.dependencyLayerDigest !== null && (typeof state2.dependencyLayerDigest !== "string" || !DIGEST22.test(state2.dependencyLayerDigest)) || state2.verificationDigest !== null && (typeof state2.verificationDigest !== "string" || !DIGEST22.test(state2.verificationDigest)) || state2.reviewDigest !== null && (typeof state2.reviewDigest !== "string" || !DIGEST22.test(state2.reviewDigest)) || !["candidate_untrusted", "verified", "reviewed"].includes(String(state2.trustStatus)) || !Array.isArray(state2.completedEffects) || state2.completedEffects.length > 256) {
     throw invalid2("Portable checkpoint state is malformed or outside its bounds.");
   }
   const effects = state2.completedEffects.map((item) => {
     const effect = object(item, "completed effect");
     exact2(effect, ["effectId", "actionDigest", "receiptDigest"]);
-    if (typeof effect.effectId !== "string" || !ID2.test(effect.effectId) || typeof effect.actionDigest !== "string" || !DIGEST2.test(effect.actionDigest) || typeof effect.receiptDigest !== "string" || !DIGEST2.test(effect.receiptDigest)) {
+    if (typeof effect.effectId !== "string" || !ID2.test(effect.effectId) || typeof effect.actionDigest !== "string" || !DIGEST22.test(effect.actionDigest) || typeof effect.receiptDigest !== "string" || !DIGEST22.test(effect.receiptDigest)) {
       throw invalid2("Portable checkpoint effect receipt is malformed.");
     }
     return {
@@ -4558,7 +4949,7 @@ import { randomUUID } from "crypto";
 import { createHash as createHash22, randomUUID as randomUUID2 } from "crypto";
 import { createReadStream } from "fs";
 import { lstat as lstat22 } from "fs/promises";
-import { join as join9 } from "path";
+import { join as join10 } from "path";
 import { mkdir as mkdir3, mkdtemp as mkdtemp3, rm as rm3, writeFile as writeFile3 } from "fs/promises";
 import { tmpdir as tmpdir3 } from "os";
 import { dirname as dirname6, join as join23, resolve as resolve32, sep as sep23 } from "path";
@@ -4680,8 +5071,8 @@ function boundedInteger(value2, spec) {
 }
 function boundedNumber(value2, spec) {
   if (spec.kind !== "finite_number" || typeof value2 !== "number" || !Number.isFinite(value2) || value2 < spec.minimum || value2 > spec.maximum) throw new CamelError("conversion_rejected", "Finite-number conversion rejected the structured value.");
-  const text = String(value2);
-  if (/e/i.test(text) || (text.split(".")[1]?.length ?? 0) > spec.maximumDecimalPlaces) throw new CamelError("conversion_rejected", "Finite-number conversion rejected a non-canonical decimal.");
+  const text2 = String(value2);
+  if (/e/i.test(text2) || (text2.split(".")[1]?.length ?? 0) > spec.maximumDecimalPlaces) throw new CamelError("conversion_rejected", "Finite-number conversion rejected a non-canonical decimal.");
   return value2;
 }
 function enumMember(value2, spec) {
@@ -4837,8 +5228,8 @@ function validateUnsafeSelector(path, value2, tool) {
   return void 0;
 }
 function looksLikeDestination(value2) {
-  const text = value2.trim();
-  return /^(?:[a-z][a-z0-9+.-]*:\/\/|\/|\\\\)/i.test(text) || /^[\w.-]+\.[a-z]{2,}(?:[/:]|$)/i.test(text);
+  const text2 = value2.trim();
+  return /^(?:[a-z][a-z0-9+.-]*:\/\/|\/|\\\\)/i.test(text2) || /^[\w.-]+\.[a-z]{2,}(?:[/:]|$)/i.test(text2);
 }
 
 // ../harness/dist/chunk-GMVZ4LZH.js
@@ -4979,7 +5370,7 @@ function createCodeRuntimeControlClient(options) {
     }
     const value2 = await response2.json().catch(() => null);
     if (!response2.ok) {
-      const problem = record3(record3(value2)?.error);
+      const problem = record5(record5(value2)?.error);
       throw new CodeRuntimeControlError(
         typeof problem?.message === "string" ? problem.message : `Code runtime request failed (${response2.status})`,
         response2.status,
@@ -5001,12 +5392,12 @@ function createCodeRuntimeControlClient(options) {
       await call2(`/registry/code/runtime/sessions/${validSessionId(sessionId)}/source`, {})
     ),
     infer: async (sessionId, inference) => {
-      const value2 = record3(await call2(
+      const value2 = record5(await call2(
         `/registry/code/runtime/sessions/${validSessionId(sessionId)}/inference`,
         inference,
         modelRequestTimeoutMs
       ));
-      if (!value2 || value2.requestId !== inference.requestId || !record3(value2.response) || !record3(value2.receipt)) {
+      if (!value2 || value2.requestId !== inference.requestId || !record5(value2.response) || !record5(value2.receipt)) {
         throw new CodeRuntimeControlError("invalid Code inference response", 502, "invalid_response");
       }
       return value2;
@@ -5064,12 +5455,12 @@ function validateHeartbeat(version, capabilities) {
   }
 }
 function parseSnapshot(value2) {
-  const root = record3(value2);
-  const host = record3(root?.host);
+  const root = record5(value2);
+  const host = record5(root?.host);
   if (!host || typeof host.hostId !== "string" || typeof host.runtimeVersion !== "string" || !Number.isSafeInteger(host.lastSeenAt) || host.revokedAt !== null || !Array.isArray(root?.bindings) || root.bindings.length > 1024 || !Array.isArray(root?.commands) || root.commands.length > 64) throw invalid("heartbeat");
   const bindingIds = /* @__PURE__ */ new Set();
   const bindings = root.bindings.map((item) => {
-    const binding = record3(item);
+    const binding = record5(item);
     if (!binding || typeof binding.bindingId !== "string" || typeof binding.appId !== "string" || binding.env !== "dev" && binding.env !== "prod" || typeof binding.offerId !== "string" || binding.hostId !== host.hostId || !Number.isSafeInteger(binding.generation) || Number(binding.generation) < 1 || binding.revokedAt !== null || bindingIds.has(binding.bindingId)) {
       throw invalid("binding");
     }
@@ -5079,10 +5470,10 @@ function parseSnapshot(value2) {
   const commandIds = /* @__PURE__ */ new Set();
   const commandSequences = /* @__PURE__ */ new Set();
   const commands = root.commands.map((item) => {
-    const command = record3(item);
+    const command = record5(item);
     const binding = bindings.find((candidate) => candidate.bindingId === command?.bindingId);
     const sequenceKey = `${String(command?.instanceId)}:${String(command?.sequence)}`;
-    if (!command || typeof command.commandId !== "string" || !/^ccmd_[0-9a-f]{32}$/.test(command.commandId) || typeof command.instanceId !== "string" || typeof command.sessionId !== "string" || !/^csess_[0-9a-f]{32}$/.test(command.sessionId) || typeof command.appId !== "string" || command.env !== "dev" && command.env !== "prod" || command.hostId !== host.hostId || !binding || binding.appId !== command.appId || binding.generation !== command.bindingGeneration || !Number.isSafeInteger(command.sequence) || Number(command.sequence) < 1 || commandIds.has(command.commandId) || commandSequences.has(sequenceKey) || !["start", "prompt", "checkpoint_stop", "resume"].includes(String(command.kind)) || !record3(command.payload) || !Number.isSafeInteger(command.createdAt)) throw invalid("command");
+    if (!command || typeof command.commandId !== "string" || !/^ccmd_[0-9a-f]{32}$/.test(command.commandId) || typeof command.instanceId !== "string" || typeof command.sessionId !== "string" || !/^csess_[0-9a-f]{32}$/.test(command.sessionId) || typeof command.appId !== "string" || command.env !== "dev" && command.env !== "prod" || command.hostId !== host.hostId || !binding || binding.appId !== command.appId || binding.generation !== command.bindingGeneration || !Number.isSafeInteger(command.sequence) || Number(command.sequence) < 1 || commandIds.has(command.commandId) || commandSequences.has(sequenceKey) || !["start", "prompt", "checkpoint_stop", "resume"].includes(String(command.kind)) || !record5(command.payload) || !Number.isSafeInteger(command.createdAt)) throw invalid("command");
     commandIds.add(command.commandId);
     commandSequences.add(sequenceKey);
     return command;
@@ -5090,10 +5481,10 @@ function parseSnapshot(value2) {
   return { host, bindings, commands };
 }
 async function parseSource(value2) {
-  const snapshot = record3(record3(value2)?.snapshot);
+  const snapshot = record5(record5(value2)?.snapshot);
   if (!snapshot || typeof snapshot.repository !== "string" || typeof snapshot.commitSha !== "string" || typeof snapshot.treeDigest !== "string" || !Array.isArray(snapshot.files)) throw invalid("source");
   const files = snapshot.files.map((value22) => {
-    const file = record3(value22);
+    const file = record5(value22);
     if (!file || typeof file.path !== "string" || typeof file.content !== "string") throw invalid("source file");
     return { path: file.path, content: file.content };
   });
@@ -5102,11 +5493,11 @@ async function parseSource(value2) {
   const aliases = /* @__PURE__ */ new Set();
   const references = [];
   for (const item of referencesValue) {
-    const reference = record3(item);
+    const reference = record5(item);
     if (!reference || typeof reference.alias !== "string" || !/^[a-z][a-z0-9-]{0,39}$/.test(reference.alias) || aliases.has(reference.alias) || reference.alias === "primary" || typeof reference.repository !== "string" || typeof reference.commitSha !== "string" || typeof reference.treeDigest !== "string" || !Array.isArray(reference.files)) throw invalid("reference source");
     aliases.add(reference.alias);
     const referenceFiles = reference.files.map((entry) => {
-      const file = record3(entry);
+      const file = record5(entry);
       if (!file || typeof file.path !== "string" || typeof file.content !== "string") throw invalid("reference source file");
       return { path: file.path, content: file.content };
     });
@@ -5121,18 +5512,18 @@ async function parseSource(value2) {
   return { ...source, treeDigest: digest, ...references.length ? { references } : {} };
 }
 function parseReview(value2) {
-  const review = record3(record3(value2)?.review);
+  const review = record5(record5(value2)?.review);
   if (!review || !["approved", "rejected"].includes(String(review.verdict)) || typeof review.reviewDigest !== "string" || !/^sha256:[0-9a-f]{64}$/.test(review.reviewDigest) || typeof review.provider !== "string" || !review.provider || typeof review.model !== "string" || !review.model || !Number.isSafeInteger(review.policyVersion) || Number(review.policyVersion) < 1) throw invalid("review");
   return review;
 }
 function parseCandidate(value2) {
-  const candidate = record3(record3(value2)?.candidate);
+  const candidate = record5(record5(value2)?.candidate);
   if (!candidate || typeof candidate.candidateId !== "string" || !/^ccand_[0-9a-f]{32}$/.test(candidate.candidateId) || !["submitted", "approved", "published", "failed"].includes(String(candidate.status))) {
     throw invalid("candidate");
   }
   return { candidateId: candidate.candidateId, status: candidate.status };
 }
-var record3 = (value2) => value2 && typeof value2 === "object" && !Array.isArray(value2) ? value2 : null;
+var record5 = (value2) => value2 && typeof value2 === "object" && !Array.isArray(value2) ? value2 : null;
 var invalid = (part) => new CodeRuntimeControlError(`invalid Code runtime ${part} response`, 502, "invalid_response");
 var RESERVED = /* @__PURE__ */ new Set([".git", ".odla", ".wrangler", "node_modules", "dist", "coverage"]);
 var SECRET = /^(?:\.env(?:\..+)?|\.dev\.vars|credentials(?:\..+)?\.json|dev-token(?:\..+)?\.json)$/i;
@@ -5207,8 +5598,8 @@ function gitApply(cwd, patch2, check) {
     });
     let stderr = "";
     child.stderr.setEncoding("utf8");
-    child.stderr.on("data", (text) => {
-      if (stderr.length < 4e3) stderr += text.slice(0, 4e3);
+    child.stderr.on("data", (text2) => {
+      if (stderr.length < 4e3) stderr += text2.slice(0, 4e3);
     });
     child.once("error", reject);
     child.once("exit", (code) => code === 0 ? accept() : reject(new TypeError(`patch did not apply: ${stderr.trim().slice(0, 500)}`)));
@@ -5477,7 +5868,7 @@ async function inspectArtifacts(workspaceDir, recipe2) {
   const receipts = [];
   for (const artifact of recipe2.expectedArtifacts ?? []) {
     try {
-      const path = join9(workspaceDir, artifact.path);
+      const path = join10(workspaceDir, artifact.path);
       const info = await lstat22(path);
       if (!info.isFile() || info.isSymbolicLink()) {
         receipts.push({ artifactId: artifact.id, status: "invalid", bytes: null, digest: null });
@@ -6379,10 +6770,10 @@ var CodePiRuntimeEngine = class {
       task: lease.task,
       limits: this.options.limits,
       signal: active.abort.signal,
-      onStderr: (text) => this.#event(command, {
+      onStderr: (text2) => this.#event(command, {
         type: "message",
         actor: "system",
-        body: text.slice(0, 4e3)
+        body: text2.slice(0, 4e3)
       }, active.conversationRefs),
       onMessage: async (output) => {
         if (output.type === "inference.request") {
@@ -6495,13 +6886,6 @@ var CodePiRuntimeEngine = class {
   }
 };
 
-// src/version.ts
-import { readFileSync as readFileSync6 } from "fs";
-function cliVersion() {
-  const pkg = JSON.parse(readFileSync6(new URL("../package.json", import.meta.url), "utf8"));
-  return pkg.version ?? "unknown";
-}
-
 // src/code-local-source.ts
 import { execFile as execFile3 } from "child_process";
 import { createHash as createHash4 } from "crypto";
@@ -6720,25 +7104,25 @@ async function runCodeRuntime(input) {
   }
 }
 function parseConnection(value2, appId, appEnv) {
-  const root = record4(value2);
-  const host = record4(root?.host);
-  const offer = record4(root?.offer);
-  const binding = record4(root?.binding);
+  const root = record6(value2);
+  const host = record6(root?.host);
+  const offer = record6(root?.offer);
+  const binding = record6(root?.binding);
   if (!root || typeof root.token !== "string" || !/^odla_code_host_[0-9a-f]{64}$/.test(root.token) || typeof root.resumed !== "boolean" || !host || !/^chost_[0-9a-f]{32}$/.test(String(host.hostId)) || typeof host.name !== "string" || !offer || !Number.isSafeInteger(offer.slots) || !binding || typeof binding.appId !== "string" || !binding.appId || appId && binding.appId !== appId || binding.env !== appEnv || !Number.isSafeInteger(binding.generation)) {
     throw new Error("connect Code host returned an invalid response");
   }
   return root;
 }
 function apiFailure(action2, status, value2) {
-  const message2 = record4(record4(value2)?.error)?.message;
+  const message2 = record6(record6(value2)?.error)?.message;
   return `${action2} failed (${status})${typeof message2 === "string" ? `: ${message2}` : ""}`;
 }
-function record4(value2) {
+function record6(value2) {
   return value2 && typeof value2 === "object" && !Array.isArray(value2) ? value2 : null;
 }
 
 // src/provision.ts
-import { createAppsClient as createAppsClient2, orderAppServices as orderAppServices3, tenantIdFor as tenantIdFor4 } from "@odla-ai/apps";
+import { createAppsClient as createAppsClient3, orderAppServices as orderAppServices3, tenantIdFor as tenantIdFor4 } from "@odla-ai/apps";
 import { putSecret as putSecret2 } from "@odla-ai/ai";
 import process8 from "process";
 
@@ -6959,7 +7343,7 @@ async function provision(options) {
   }
   const doFetch = options.fetch ?? fetch;
   const token = await getDeveloperToken(cfg, options, doFetch, out);
-  const apps = createAppsClient2({ endpoint: cfg.platformUrl, token, fetcher: { fetch: doFetch } });
+  const apps = createAppsClient3({ endpoint: cfg.platformUrl, token, fetcher: { fetch: doFetch } });
   const existing = await apps.resolveApp(cfg.app.id);
   if (existing) {
     out.log(`app: ${cfg.app.id} already exists`);
@@ -7133,7 +7517,7 @@ var COMMAND_SURFACE = {
   calendar: { status: {}, calendars: {}, connect: {}, disconnect: {} },
   capabilities: {},
   code: { connect: {} },
-  config: { diff: {}, plan: {} },
+  config: { diff: {}, plan: {}, apply: {} },
   context: { show: {}, list: {}, save: {}, remove: {} },
   // `watch`, `read`, `reply`, and `resolve` take a topic id from there on.
   discuss: {
@@ -7151,7 +7535,11 @@ var COMMAND_SURFACE = {
   help: {},
   init: {},
   o11y: { status: {} },
-  platform: { status: {} },
+  operations: { get: {}, wait: {} },
+  platform: {
+    status: {},
+    "chat-credentials": { rotate: {} }
+  },
   pm: {
     ...PM_ENTITIES,
     handoff: {}
@@ -7588,17 +7976,17 @@ function addOption(options, name, value2) {
 
 // src/operator-context.ts
 import { existsSync as existsSync10 } from "fs";
-import { join as join11, resolve as resolve11 } from "path";
+import { join as join12, resolve as resolve11 } from "path";
 import process10 from "process";
 
 // src/operator-profiles.ts
-import { existsSync as existsSync9, readFileSync as readFileSync7 } from "fs";
+import { existsSync as existsSync9, readFileSync as readFileSync8 } from "fs";
 import { homedir as homedir2 } from "os";
-import { dirname as dirname7, join as join10, resolve as resolve10 } from "path";
+import { dirname as dirname7, join as join11, resolve as resolve10 } from "path";
 import process9 from "process";
 function operatorProfileFile() {
   return resolve10(
-    clean(process9.env.ODLA_CONTEXT_FILE) ?? join10(homedir2(), ".odla", "contexts.json")
+    clean(process9.env.ODLA_CONTEXT_FILE) ?? join11(homedir2(), ".odla", "contexts.json")
   );
 }
 function resolveOperatorProfile(parsed) {
@@ -7643,10 +8031,10 @@ function removeOperatorProfile(name, file = operatorProfileFile()) {
   return true;
 }
 function operatorCredentialFiles(selection) {
-  const base = selection.name ? join10(dirname7(selection.file), "profiles", selection.name) : join10(homedir2(), ".odla");
+  const base = selection.name ? join11(dirname7(selection.file), "profiles", selection.name) : join11(homedir2(), ".odla");
   return {
-    developer: join10(base, "dev-token.json"),
-    scoped: join10(base, "admin-token.local.json")
+    developer: join11(base, "dev-token.json"),
+    scoped: join11(base, "admin-token.local.json")
   };
 }
 function assertOperatorName(value2, label) {
@@ -7660,7 +8048,7 @@ function readOperatorProfiles(file) {
   if (!existsSync9(file)) return emptyProfiles();
   let raw;
   try {
-    raw = JSON.parse(readFileSync7(file, "utf8"));
+    raw = JSON.parse(readFileSync8(file, "utf8"));
   } catch {
     throw new Error(`operator context file ${file} is not valid JSON`);
   }
@@ -7757,7 +8145,7 @@ async function resolveOperatorContext(parsed, options = {}) {
   const rootDir = loaded?.rootDir ?? process10.cwd();
   const profileCredentials = operatorCredentialFiles(profile);
   const tokenFile = clean2(process10.env.ODLA_DEV_TOKEN_FILE) ? resolve11(process10.env.ODLA_DEV_TOKEN_FILE) : profile.name ? profileCredentials.developer : loaded?.local.tokenFile ?? profileCredentials.developer;
-  const scopedTokenFile = clean2(process10.env.ODLA_ADMIN_TOKEN_FILE) ? resolve11(process10.env.ODLA_ADMIN_TOKEN_FILE) : profile.name ? profileCredentials.scoped : loaded ? join11(loaded.rootDir, ".odla", "admin-token.local.json") : profileCredentials.scoped;
+  const scopedTokenFile = clean2(process10.env.ODLA_ADMIN_TOKEN_FILE) ? resolve11(process10.env.ODLA_ADMIN_TOKEN_FILE) : profile.name ? profileCredentials.scoped : loaded ? join12(loaded.rootDir, ".odla", "admin-token.local.json") : profileCredentials.scoped;
   const cfg = loaded ? {
     ...loaded,
     platformUrl: platformValue,
@@ -7779,8 +8167,8 @@ async function resolveOperatorContext(parsed, options = {}) {
     services: [],
     local: {
       tokenFile,
-      credentialsFile: join11(rootDir, ".odla", "credentials.local.json"),
-      devVarsFile: join11(rootDir, ".dev.vars"),
+      credentialsFile: join12(rootDir, ".odla", "credentials.local.json"),
+      devVarsFile: join12(rootDir, ".dev.vars"),
       gitignore: true
     }
   };
@@ -8024,7 +8412,7 @@ async function appExport(options) {
 }
 
 // src/app-import.ts
-import { readFileSync as readFileSync8 } from "fs";
+import { readFileSync as readFileSync9 } from "fs";
 import {
   buildImportOps,
   importMutationId,
@@ -8048,8 +8436,8 @@ async function appImport(options) {
   const say = options.json ? (line) => out.error(line) : (line) => out.log(line);
   const doFetch = options.fetch ?? fetch;
   const { tenant } = resolveTenant(cfg, options.env);
-  const text = options.file === "-" ? (options.readStdin ?? (() => readFileSync8(0, "utf8")))() : readFileSync8(options.file, "utf8");
-  const { format, sources } = parseImport(text, options.ns);
+  const text2 = options.file === "-" ? (options.readStdin ?? (() => readFileSync9(0, "utf8")))() : readFileSync9(options.file, "utf8");
+  const { format, sources } = parseImport(text2, options.ns);
   if (format === "namespace-map" && options.ns) {
     throw new Error("--ns cannot be combined with a {namespace: rows} file \u2014 the file already names each namespace");
   }
@@ -8140,7 +8528,10 @@ function report(options, owners, headline) {
   if (headline) out.log(headline);
   out.log(`owners (${owners.length}):`);
   for (const o of owners) {
-    out.log(`  ${o.primary ? "\u2605" : "\xB7"} ${o.email ?? o.ownerId}${o.primary ? " (primary)" : ""}`);
+    const name = o.email?.trim() || "Unnamed member";
+    out.log(
+      `  ${o.primary ? "\u2605" : "\xB7"} ${name} [${o.ownerId}]${o.primary ? " (primary)" : ""}`
+    );
   }
 }
 async function ownersList(options) {
@@ -8559,10 +8950,14 @@ async function secretsCommand(parsed, deps) {
 async function projectCommand(command, parsed, deps) {
   if (command === "config") {
     const sub = parsed.positionals[1];
-    if (sub !== "diff" && sub !== "plan") {
+    if (sub !== "diff" && sub !== "plan" && sub !== "apply") {
       throw new Error(`unknown config subcommand "${sub ?? ""}". Try "odla-ai config diff --json".`);
     }
-    assertArgs(parsed, ["config", "token", "email", "open", "json"], 2);
+    assertArgs(
+      parsed,
+      sub === "apply" ? ["config", "plan", "idempotency-key", "token", "email", "open", "json"] : ["config", "token", "email", "open", "json"],
+      2
+    );
     const options = {
       configPath: stringOpt(parsed.options.config) ?? "odla.config.mjs",
       token: stringOpt(parsed.options.token),
@@ -8574,7 +8969,42 @@ async function projectCommand(command, parsed, deps) {
       stdout: deps.stdout
     };
     if (sub === "diff") await configDiff(options);
-    else await configPlan(options);
+    else if (sub === "plan") await configPlan(options);
+    else await configApply({
+      ...options,
+      planPath: requiredString(parsed.options.plan, "--plan"),
+      idempotencyKey: stringOpt(parsed.options["idempotency-key"])
+    });
+    return true;
+  }
+  if (command === "operations") {
+    const sub = parsed.positionals[1];
+    if (sub !== "get" && sub !== "wait") {
+      throw new Error(`unknown operations subcommand "${sub ?? ""}". Try "odla-ai operations get <operation-id> --json".`);
+    }
+    assertArgs(
+      parsed,
+      sub === "wait" ? ["config", "token", "email", "open", "json", "interval", "timeout"] : ["config", "token", "email", "open", "json"],
+      3
+    );
+    const operationId = parsed.positionals[2];
+    if (!operationId) throw new Error(`operation id is required`);
+    const options = {
+      configPath: stringOpt(parsed.options.config) ?? "odla.config.mjs",
+      operationId,
+      token: stringOpt(parsed.options.token),
+      email: stringOpt(parsed.options.email),
+      open: parsed.options.open === false ? false : parsed.options.open === true ? true : void 0,
+      json: parsed.options.json === true,
+      fetch: deps.fetch,
+      openApprovalUrl: deps.openUrl,
+      stdout: deps.stdout,
+      pollWait: deps.pollWait,
+      intervalSeconds: numberOpt(parsed.options.interval, "--interval"),
+      timeoutSeconds: numberOpt(parsed.options.timeout, "--timeout")
+    };
+    if (sub === "get") await configOperationGet(options);
+    else await configOperationWait(options);
     return true;
   }
   if (command === "init") {
@@ -8845,8 +9275,10 @@ Usage:
   odla-ai setup [--dir <project>] [--agent <name>] [--global] [--force]
   odla-ai init --app-id <id> --name <name> [--services db,ai,o11y,calendar] [--env dev --env prod]
   odla-ai doctor [--config odla.config.mjs]
-  odla-ai config diff [--config odla.config.mjs] [--email <odla-account>] [--json]
-  odla-ai config plan [--config odla.config.mjs] [--email <odla-account>] [--json]
+  odla-ai config <diff|plan> [--config odla.config.mjs] [--email <odla-account>] [--json]
+  odla-ai config apply --plan <plan.json> [--idempotency-key <key>] [--email <odla-account>] [--json]
+  odla-ai operations get <operation-id> [--json]
+  odla-ai operations wait <operation-id> [--interval <seconds>] [--timeout <seconds>] [--json]
   odla-ai calendar status [--env dev] [--email <odla-account>] [--json]
   odla-ai calendar calendars [--env dev] [--email <odla-account>] [--json]
   odla-ai calendar connect [--env dev] [--email <odla-account>] [--no-open] [--yes]
@@ -8897,6 +9329,7 @@ Usage:
   odla-ai context remove <name> --yes [--json]
   odla-ai o11y status [--app <id>] [--context <name>] [--platform https://odla.ai] [--env prod] [--minutes 60] [--json]
   odla-ai platform status [--context <name>] [--platform https://odla.ai] [--email <odla-account>] [--json]
+  odla-ai platform chat-credentials rotate [--context <name>] [--email <odla-account>] [--wrangler-config <path>] [--expected-version <id>] [--json] --yes
   odla-ai whoami [--context <name>] [--platform https://odla.ai] [--json]
   odla-ai runbook ask "<question>" [--app <id>] [--all] [--json]
   odla-ai runbook search "<question>" [--app <id>] [--all] [--limit <n>] [--json]
@@ -8960,9 +9393,9 @@ Commands:
                does and what it guarantees is JSDoc, rendered per package at
                https://odla.ai/docs and shipped in the installed .d.ts. Answering
                a question usually needs both.
-  whoami       Report who this terminal is authenticated as, and whether it holds
-               platform admin. A handshake-minted device token is never admin,
-               however the human who approved it is configured.
+  whoami       Report the actual principal name, handle and kind, its manager,
+               credential kind, accountable owner, and platform-admin status.
+               A manager relationship never supplies authority by itself.
   context      Explain selected config, platform, app, environment, and
                developer-token provenance without printing credentials or
                starting a device handshake. Operator work can run outside a
@@ -8971,8 +9404,8 @@ Commands:
   setup        Install offline odla runbooks for common coding-agent harnesses.
   init         Create a generic odla.config.mjs plus starter schema/rules files.
   doctor       Validate and summarize the project config without network calls.
-  config       Read-only diff and revision-bound plan for checked-in Registry
-               intent; runtime-owned fields and excluded coverage stay explicit.
+  config       Diff Registry intent, freeze a CAS-bound plan, and conditionally apply its safe actions.
+  operations   Inspect or wait on one exact, durable config-operation receipt.
   calendar     Inspect, connect, or disconnect the live Google booking connection.
   app          Archive (suspend, data retained), restore, export, import, or
                manage the co-owners of the app. Archiving takes every
@@ -9082,6 +9515,58 @@ Safety:
 `);
 }
 
+// src/discuss-principals.ts
+function mergeDiscussPrincipals(target, source) {
+  Object.assign(target.authors, source.authors ?? {});
+  Object.assign(target.principals, source.principals ?? {});
+}
+var withAt = (handle) => handle.startsWith("@") ? handle : `@${handle}`;
+function discussPrincipalLabel(principalId, authorKind, projection) {
+  const profile = projection.principals?.[principalId];
+  if (profile) {
+    const identity = `${profile.displayName} (${withAt(profile.handle)})`;
+    if (profile.kind === "agent") {
+      return profile.managerDisplayName ? `${identity} \u2014 agent managed by ${profile.managerDisplayName}` : `${identity} \u2014 agent`;
+    }
+    return profile.kind === "service" ? `${identity} \u2014 service` : identity;
+  }
+  const legacyName = projection.authors?.[principalId]?.trim();
+  if (legacyName) {
+    return authorKind === "bot" ? `${legacyName} \u2014 agent` : legacyName;
+  }
+  return authorKind === "bot" ? "Unnamed agent" : "Unnamed member";
+}
+
+// src/discuss-read-render.ts
+function discussBodyWithRefs(post) {
+  if (!post.refs || post.refs.length === 0) return post.body;
+  let out = "";
+  let cursor = 0;
+  for (const ref of [...post.refs].sort((a, b) => a.start - b.start)) {
+    if (ref.start < cursor || ref.end > post.body.length) continue;
+    out += post.body.slice(cursor, ref.start) + `@[${ref.label}](${ref.kind}/${ref.id})`;
+    cursor = ref.end;
+  }
+  return out + post.body.slice(cursor);
+}
+function renderDiscussRead(ctx, topic, posts, projection) {
+  const status = topic.resolved ? "resolved" : "open";
+  ctx.out.log(`${topic.subject}  [${status}]  ${topic.appId ?? ""}`);
+  for (const post of posts) {
+    const who = discussPrincipalLabel(
+      post.authorId,
+      post.authorKind,
+      projection
+    );
+    ctx.out.log(`
+\u2014 ${who}`);
+    ctx.out.log(discussBodyWithRefs(post));
+    for (const file of post.attachments ?? []) {
+      ctx.out.log(`  [attachment] ${file.name} (${file.size} bytes)`);
+    }
+  }
+}
+
 // src/discuss-actions.ts
 var writeMutationId = (parsed) => stringOpt(parsed.options["mutation-id"]) ?? crypto.randomUUID();
 async function request(ctx, method, path, body) {
@@ -9100,17 +9585,6 @@ function emit(ctx, value2, human) {
   else human();
 }
 var state = (topic) => topic.resolved ? "resolved" : "open";
-function bodyWithRefs(post) {
-  if (!post.refs || post.refs.length === 0) return post.body;
-  let out = "";
-  let cursor = 0;
-  for (const ref of [...post.refs].sort((a, b) => a.start - b.start)) {
-    if (ref.start < cursor || ref.end > post.body.length) continue;
-    out += post.body.slice(cursor, ref.start) + `@[${ref.label}](${ref.kind}/${ref.id})`;
-    cursor = ref.end;
-  }
-  return out + post.body.slice(cursor);
-}
 function content(parsed) {
   const markup = stringOpt(parsed.options.markup);
   if (markup) return { markup };
@@ -9165,11 +9639,19 @@ async function discussRead(ctx, id, parsed) {
       offset: requestedOffset ?? "0"
     });
     const page = await request(ctx, "GET", `/topics/${encodeURIComponent(id)}?${query}`);
-    emit(ctx, page, () => renderRead(ctx, page.topic, page.posts));
+    emit(
+      ctx,
+      page,
+      () => renderDiscussRead(ctx, page.topic, page.posts, page)
+    );
     return;
   }
   for (let scan = 0; scan < 3; scan++) {
     const posts = /* @__PURE__ */ new Map();
+    const projection = {
+      authors: {},
+      principals: {}
+    };
     let topic = null;
     let offset = 0;
     for (; ; ) {
@@ -9180,6 +9662,7 @@ async function discussRead(ctx, id, parsed) {
       );
       topic = page.topic;
       for (const post of page.posts) posts.set(post.id, post);
+      mergeDiscussPrincipals(projection, page);
       if (posts.size > 1e4) throw new Error("discuss read failed: conversation exceeds 10000 posts");
       if (!page.page?.hasMore) break;
       if (page.page.nextOffset === null || page.page.nextOffset <= offset) {
@@ -9192,24 +9675,18 @@ async function discussRead(ctx, id, parsed) {
     );
     const expected = Number.isInteger(topic.replyCount) ? topic.replyCount + 1 : ordered.length;
     if (ordered.length === expected) {
-      const result = { topic, posts: ordered };
-      emit(ctx, result, () => renderRead(ctx, result.topic, result.posts));
+      const result = { topic, posts: ordered, ...projection };
+      emit(
+        ctx,
+        result,
+        () => renderDiscussRead(ctx, result.topic, result.posts, result)
+      );
       return;
     }
     if (offset === 0) throw new Error("discuss read failed: registry did not provide forward post pages");
   }
   throw new Error("discuss read failed: conversation changed during every complete-read attempt");
 }
-function renderRead(ctx, topic, posts) {
-  ctx.out.log(`${topic.subject}  [${state(topic)}]  ${topic.appId ?? ""}`);
-  for (const post of posts) {
-    const who = post.authorKind === "bot" ? `${post.authorId} (agent)` : post.authorId;
-    ctx.out.log(`
-\u2014 ${who}`);
-    ctx.out.log(bodyWithRefs(post));
-    for (const file of post.attachments ?? []) ctx.out.log(`  [attachment] ${file.name} (${file.size} bytes)`);
-  }
-}
 async function discussPost(ctx, parsed) {
   const appId = stringOpt(parsed.options.app) ?? ctx.appId;
   if (!appId) throw new Error("discuss post needs --app <appId>");
@@ -9434,6 +9911,8 @@ async function discussWatch(ctx, topicId, parsed) {
         found: true,
         cursor,
         events: matching,
+        ...page.authors ? { authors: page.authors } : {},
+        ...page.principals ? { principals: page.principals } : {},
         ...posts && posts.length > 0 ? { posts } : {},
         ...topics && topics.length > 0 ? { topics } : {}
       });
@@ -9466,7 +9945,11 @@ function report2(ctx, parsed, result) {
     ctx.out.log(JSON.stringify(result, null, 2));
   } else if (parsed.options.jsonl !== true && result.found) {
     for (const post of result.posts ?? []) {
-      const who = post.authorKind === "bot" ? `${post.authorId} (agent)` : post.authorId;
+      const who = discussPrincipalLabel(
+        post.authorId,
+        post.authorKind,
+        result
+      );
       ctx.out.log(`\u2014 ${who}
 ${post.body}`);
     }
@@ -9611,8 +10094,8 @@ function collectFields(parsed, allowClear) {
       if (allowClear) out[spec.key] = null;
       continue;
     }
-    const text = stringOpt(value2);
-    out[spec.key] = spec.num ? Number(text) : text;
+    const text2 = stringOpt(value2);
+    out[spec.key] = spec.num ? Number(text2) : text2;
   }
   return out;
 }
@@ -9679,8 +10162,8 @@ async function pmAdd(ctx, entity, parsed) {
   emit2(ctx, res, () => ctx.out.log(`created ${entity} ${res.id}`));
 }
 async function pmGet(ctx, entity, id) {
-  const { record: record8 } = await pmRequest(ctx, "GET", `/${entity}/${encodeURIComponent(id)}`);
-  emit2(ctx, record8, () => printRecord(ctx, entity, record8));
+  const { record: record11 } = await pmRequest(ctx, "GET", `/${entity}/${encodeURIComponent(id)}`);
+  emit2(ctx, record11, () => printRecord(ctx, entity, record11));
 }
 async function pmSet(ctx, entity, id, parsed) {
   const patch2 = collectEntityFields(entity, parsed, true);
@@ -9725,9 +10208,9 @@ async function pmHandoff(ctx, parsed) {
   ]);
   const handoff = {
     appId,
-    unmetGoals: goals.filter((record8) => record8.status !== "met"),
-    activeTasks: tasks.filter((record8) => record8.column !== "done"),
-    openBugs: bugs.filter((record8) => record8.status !== "fixed" && record8.status !== "wontfix")
+    unmetGoals: goals.filter((record11) => record11.status !== "met"),
+    activeTasks: tasks.filter((record11) => record11.column !== "done"),
+    openBugs: bugs.filter((record11) => record11.status !== "fixed" && record11.status !== "wontfix")
   };
   const result = {
     ...handoff,
@@ -9746,10 +10229,10 @@ async function pmHandoff(ctx, parsed) {
     ]) {
       ctx.out.log(`${label}:`);
       if (!records.length) ctx.out.log("- (none)");
-      else for (const record8 of records) printRecord(
+      else for (const record11 of records) printRecord(
         ctx,
         label === "unmet goals" ? "goal" : label === "active tasks" ? "task" : "bug",
-        record8
+        record11
       );
     }
   });
@@ -9940,19 +10423,180 @@ function age(input) {
   return `${Math.round(input / 6e4)}m`;
 }
 
+// src/platform-chat-credential-command.ts
+import process12 from "process";
+async function rotatePlatformChatCredential(parsed, deps) {
+  assertArgs(
+    parsed,
+    [
+      "config",
+      "context",
+      "platform",
+      "token",
+      "email",
+      "open",
+      "json",
+      "yes",
+      "wrangler-config",
+      "expected-version"
+    ],
+    3
+  );
+  if (parsed.options.yes !== true) {
+    throw new Error(
+      "platform chat-credentials rotate changes the production chat secret; pass --yes"
+    );
+  }
+  const context = await resolveOperatorContext(parsed, {
+    allowMissingConfig: true
+  });
+  const platform = context.platform.value;
+  const doFetch = deps.fetch ?? fetch;
+  const out = deps.stdout ?? console;
+  const run = deps.runner ?? defaultRunner;
+  const cwd = process12.cwd();
+  const wranglerConfig = stringOpt(parsed.options["wrangler-config"]) ?? "packages/chat-agent/wrangler.jsonc";
+  if (!await wranglerLoggedIn(run, cwd)) {
+    throw new Error(
+      'Wrangler is not authenticated; run "npx wrangler login" and retry'
+    );
+  }
+  const priorHealth = await doFetch(`${platform}/health/services/chat`);
+  const priorVersion = priorHealth.headers.get("x-odla-worker-version-id");
+  await priorHealth.body?.cancel().catch(() => {
+  });
+  if (!priorVersion) {
+    throw new Error(
+      "chat health did not identify its current Worker version; refusing to rotate"
+    );
+  }
+  const expectedVersion = stringOpt(parsed.options["expected-version"]);
+  if (expectedVersion && priorVersion !== expectedVersion) {
+    throw new Error(
+      `chat health answered from version ${priorVersion}; expected ${expectedVersion}`
+    );
+  }
+  const token = await resolveAdminPlatformToken({
+    platform,
+    scope: "platform:chat:credential:write",
+    token: stringOpt(parsed.options.token),
+    tokenFile: context.credentials.scopedTokenFile,
+    email: stringOpt(parsed.options.email),
+    open: parsed.options.open === false ? false : parsed.options.open === true ? true : void 0,
+    fetch: doFetch,
+    stdout: out,
+    openApprovalUrl: deps.openUrl,
+    label: "odla CLI (rotate built-in Discussion responder)"
+  });
+  const mintedResponse = await doFetch(
+    `${platform}/registry/platform/chat-credentials/rotate`,
+    {
+      method: "POST",
+      headers: { authorization: `Bearer ${token}` }
+    }
+  );
+  const minted = await mintedResponse.json().catch(() => null);
+  if (!mintedResponse.ok) {
+    throw new Error(
+      `mint Discussion credential failed (HTTP ${mintedResponse.status}): ${apiMessage(minted)}`
+    );
+  }
+  if (!isPlatformChatCredential(minted)) {
+    throw new Error(
+      "platform returned an invalid odla.platform-chat-credential/v1 envelope"
+    );
+  }
+  const put = await wranglerPutSecret(run, {
+    name: "ODLA_BOT_TOKENS",
+    value: JSON.stringify({
+      [minted.appId]: { [minted.principalId]: minted.key }
+    }),
+    configPath: wranglerConfig,
+    cwd
+  });
+  if (put.code !== 0) {
+    throw new Error(
+      "Wrangler could not replace ODLA_BOT_TOKENS; the new scoped key was not activated"
+    );
+  }
+  const version = await waitForRotatedChatHealth({
+    fetch: doFetch,
+    platform,
+    priorVersion,
+    wait: deps.pollWait
+  });
+  const result = {
+    schemaVersion: "odla.platform-chat-credential-rotation/v1",
+    appId: minted.appId,
+    appIncarnation: minted.appIncarnation,
+    principalId: minted.principalId,
+    health: { ok: true, service: "odla-chat-agent", version }
+  };
+  if (parsed.options.json === true) {
+    out.log(JSON.stringify(result, null, 2));
+  } else {
+    out.log(
+      `rotated	${result.appId}	${result.principalId}	${result.health.version}`
+    );
+  }
+}
+async function waitForRotatedChatHealth(opts) {
+  const wait2 = opts.wait ?? ((milliseconds) => new Promise((resolve12) => setTimeout(resolve12, milliseconds)));
+  let lastStatus = 0;
+  let lastVersion = null;
+  let lastError = "private_service_unready";
+  for (let attempt = 0; attempt < 60; attempt++) {
+    const response2 = await opts.fetch(
+      `${opts.platform}/health/services/chat`
+    );
+    const body = await response2.json().catch(() => null);
+    const version = response2.headers.get("x-odla-worker-version-id");
+    if (response2.ok && record7(body) && body.ok === true && body.service === "odla-chat-agent" && version && version !== opts.priorVersion) {
+      return version;
+    }
+    lastStatus = response2.status;
+    lastVersion = version;
+    lastError = record7(body) && typeof body.error === "string" ? body.error : "private_service_unready";
+    if (attempt < 59) await wait2(5e3);
+  }
+  throw new Error(
+    `chat health did not converge on the rotated Worker deployment (HTTP ${lastStatus}, version ${lastVersion ?? "unknown"}, ${lastError})`
+  );
+}
+function isPlatformChatCredential(value2) {
+  return record7(value2) && value2.schemaVersion === "odla.platform-chat-credential/v1" && value2.appId === "odla-pm" && typeof value2.appIncarnation === "string" && value2.appIncarnation.length > 0 && value2.principalId === "agent_odla" && typeof value2.key === "string" && value2.key.startsWith("odla_sk_");
+}
+function apiMessage(value2) {
+  if (!record7(value2)) return "request failed";
+  const error = record7(value2.error) ? value2.error : value2;
+  return typeof error.message === "string" ? error.message : typeof error.code === "string" ? error.code : "request failed";
+}
+function record7(value2) {
+  return !!value2 && typeof value2 === "object" && !Array.isArray(value2);
+}
+
 // src/platform-command.ts
 async function platformCommand(parsed, deps = {}) {
+  const action2 = parsed.positionals[1];
+  if (action2 === "status") {
+    return platformStatus(parsed, deps);
+  }
+  if (action2 === "chat-credentials" && parsed.positionals[2] === "rotate") {
+    return rotatePlatformChatCredential(parsed, deps);
+  }
+  throw new Error(
+    `unknown platform action "${[
+      action2,
+      parsed.positionals[2]
+    ].filter(Boolean).join(" ")}". Try "odla-ai platform status --json".`
+  );
+}
+async function platformStatus(parsed, deps) {
   assertArgs(
     parsed,
     ["config", "context", "platform", "token", "email", "open", "json"],
     2
   );
-  const action2 = parsed.positionals[1];
-  if (action2 !== "status") {
-    throw new Error(
-      `unknown platform action "${action2 ?? ""}". Try "odla-ai platform status --json".`
-    );
-  }
   const context = await resolveOperatorContext(parsed, {
     allowMissingConfig: true
   });
@@ -9977,7 +10621,7 @@ async function platformCommand(parsed, deps = {}) {
   const body = await response2.json().catch(() => null);
   if (!response2.ok) {
     throw new Error(
-      `read platform status failed (HTTP ${response2.status}): ${apiMessage(body)}`
+      `read platform status failed (HTTP ${response2.status}): ${apiMessage2(body)}`
     );
   }
   if (!isPlatformStatus(body)) {
@@ -9990,17 +10634,17 @@ async function platformCommand(parsed, deps = {}) {
   }
 }
 function isPlatformStatus(value2) {
-  if (!record5(value2) || value2.schemaVersion !== "odla.platform-status/v1") return false;
-  if (!record5(value2.verdict) || !Array.isArray(value2.verdict.reasons)) return false;
-  if (!record5(value2.catalog) || !record5(value2.summary)) return false;
+  if (!record8(value2) || value2.schemaVersion !== "odla.platform-status/v1") return false;
+  if (!record8(value2.verdict) || !Array.isArray(value2.verdict.reasons)) return false;
+  if (!record8(value2.catalog) || !record8(value2.summary)) return false;
   return Array.isArray(value2.services) && Array.isArray(value2.nextActions);
 }
-function apiMessage(value2) {
-  if (!record5(value2)) return "request failed";
-  const error = record5(value2.error) ? value2.error : value2;
+function apiMessage2(value2) {
+  if (!record8(value2)) return "request failed";
+  const error = record8(value2.error) ? value2.error : value2;
   return typeof error.message === "string" ? error.message : typeof error.code === "string" ? error.code : "request failed";
 }
-function record5(value2) {
+function record8(value2) {
   return !!value2 && typeof value2 === "object" && !Array.isArray(value2);
 }
 
@@ -10041,7 +10685,7 @@ function statusVerdict(reads) {
       severity: "degraded"
     });
   }
-  const performance = record6(reads.liveSync.body.performance) ? reads.liveSync.body.performance : null;
+  const performance = record9(reads.liveSync.body.performance) ? reads.liveSync.body.performance : null;
   if (performance?.status === "unavailable") {
     reasons.push({
       source: "liveSync",
@@ -10122,7 +10766,7 @@ function statusVerdict(reads) {
     reasons
   };
 }
-function record6(value2) {
+function record9(value2) {
   return Boolean(value2) && typeof value2 === "object" && !Array.isArray(value2);
 }
 function numeric2(value2) {
@@ -10150,7 +10794,7 @@ function printO11yStatus(status, out) {
   out.log(
     `o11y status ${status.scope.appId}/${status.scope.env} (${status.scope.minutes}m)`
   );
-  const routes = Array.isArray(status.application.body.routes) ? status.application.body.routes.filter(record7) : [];
+  const routes = Array.isArray(status.application.body.routes) ? status.application.body.routes.filter(record10) : [];
   const requests = routes.reduce(
     (total, row) => total + numeric3(row.requests),
     0
@@ -10162,39 +10806,39 @@ function printO11yStatus(status, out) {
   out.log(
     `application	${status.application.httpStatus}	${requests} requests	${errors} errors`
   );
-  const versions = Array.isArray(status.applicationVersions.body.rows) ? status.applicationVersions.body.rows.filter(record7) : [];
+  const versions = Array.isArray(status.applicationVersions.body.rows) ? status.applicationVersions.body.rows.filter(record10) : [];
   out.log(
     `application-versions	${status.applicationVersions.httpStatus}	${versions.length ? versions.slice(0, 5).map(
       (row) => `${String(row.value || "(unattributed)")}:${numeric3(row.requests)}`
     ).join(", ") : "none observed"}`
   );
   out.log(liveSyncLine(status.liveSync));
-  const canaryDurations = record7(status.canary.body.durationsMs) ? status.canary.body.durationsMs : {};
+  const canaryDurations = record10(status.canary.body.durationsMs) ? status.canary.body.durationsMs : {};
   out.log(
     `canary	${status.canary.httpStatus}	${String(status.canary.body.status ?? status.canary.body.error ?? "unavailable")}	${optionalNumeric(canaryDurations.publishToVisibleMs)} publish-to-visible`
   );
-  const collectorIngest = record7(status.collector.body.ingest) ? status.collector.body.ingest : {};
-  const collectorStorage = record7(collectorIngest.storage) ? collectorIngest.storage : {};
+  const collectorIngest = record10(status.collector.body.ingest) ? status.collector.body.ingest : {};
+  const collectorStorage = record10(collectorIngest.storage) ? collectorIngest.storage : {};
   out.log(
     `collector	${status.collector.httpStatus}	${String(status.collector.body.status ?? status.collector.body.error ?? "unavailable")}	${numeric3(collectorStorage.affectedPoints)} affected points`
   );
-  const providerMetrics = record7(status.provider.body.metrics) ? status.provider.body.metrics : {};
-  const providerCapacity = record7(status.provider.body.capacity) ? status.provider.body.capacity : {};
-  const workerMemory = record7(providerCapacity.memory) ? providerCapacity.memory : {};
+  const providerMetrics = record10(status.provider.body.metrics) ? status.provider.body.metrics : {};
+  const providerCapacity = record10(status.provider.body.capacity) ? status.provider.body.capacity : {};
+  const workerMemory = record10(providerCapacity.memory) ? providerCapacity.memory : {};
   out.log(
     `cloudflare	${status.provider.httpStatus}	${String(status.provider.body.status ?? status.provider.body.error ?? "unavailable")}	${numeric3(providerMetrics.requests)} invocations	${numeric3(providerMetrics.errors)} runtime errors	${optionalBytes(workerMemory.headroomBytes)} isolate memory headroom`
   );
   for (const line of providerCapacityLines(status.providerCapacity)) {
     out.log(line);
   }
-  const coverage = record7(status.providerReconciliation.body.comparison) ? status.providerReconciliation.body.comparison : {};
-  const coverageCounts = record7(status.providerReconciliation.body.counts) ? status.providerReconciliation.body.counts : {};
-  const coverageBudget = record7(status.providerReconciliation.body.budget) ? status.providerReconciliation.body.budget : {};
+  const coverage = record10(status.providerReconciliation.body.comparison) ? status.providerReconciliation.body.comparison : {};
+  const coverageCounts = record10(status.providerReconciliation.body.counts) ? status.providerReconciliation.body.counts : {};
+  const coverageBudget = record10(status.providerReconciliation.body.budget) ? status.providerReconciliation.body.budget : {};
   out.log(
     `request-coverage	${status.providerReconciliation.httpStatus}	${String(status.providerReconciliation.body.status ?? status.providerReconciliation.body.error ?? "unavailable")}	${optionalPercent(coverage.applicationCoverage)} application/provider	${numeric3(coverageCounts.applicationRequests)}/${numeric3(coverageCounts.providerRequests)} requests	\xB1${optionalPercent(coverageBudget.maxRelativeError)} budget`
   );
   const providerPoints = Array.isArray(status.providerHistory.body.points) ? status.providerHistory.body.points.length : 0;
-  const providerFreshness = record7(status.providerHistory.body.freshness) ? status.providerHistory.body.freshness : {};
+  const providerFreshness = record10(status.providerHistory.body.freshness) ? status.providerHistory.body.freshness : {};
   out.log(
     `cloudflare-history	${status.providerHistory.httpStatus}	${String(status.providerHistory.body.status ?? status.providerHistory.body.error ?? "unavailable")}	${providerPoints} snapshots	${optionalAge(providerFreshness.ageMs)} old`
   );
@@ -10203,17 +10847,17 @@ function printO11yStatus(status, out) {
   );
 }
 function providerCapacityLines(read3) {
-  const resources = record7(read3.body.resources) ? read3.body.resources : {};
-  const durableObjects = record7(resources.durableObjects) ? resources.durableObjects : {};
-  const periodic = record7(durableObjects.periodic) ? durableObjects.periodic : {};
-  const storage = record7(durableObjects.sqliteStorage) ? durableObjects.sqliteStorage : {};
-  const d1 = record7(resources.d1) ? resources.d1 : {};
-  const d1Activity = record7(d1.activity) ? d1.activity : {};
-  const d1Storage = record7(d1.storage) ? d1.storage : {};
-  const d1Latency = record7(d1Activity.latency) ? d1Activity.latency : {};
-  const r2 = record7(resources.r2) ? resources.r2 : {};
-  const r2Operations = record7(r2.operations) ? r2.operations : {};
-  const r2Storage = record7(r2.storage) ? r2.storage : {};
+  const resources = record10(read3.body.resources) ? read3.body.resources : {};
+  const durableObjects = record10(resources.durableObjects) ? resources.durableObjects : {};
+  const periodic = record10(durableObjects.periodic) ? durableObjects.periodic : {};
+  const storage = record10(durableObjects.sqliteStorage) ? durableObjects.sqliteStorage : {};
+  const d1 = record10(resources.d1) ? resources.d1 : {};
+  const d1Activity = record10(d1.activity) ? d1.activity : {};
+  const d1Storage = record10(d1.storage) ? d1.storage : {};
+  const d1Latency = record10(d1Activity.latency) ? d1Activity.latency : {};
+  const r2 = record10(resources.r2) ? resources.r2 : {};
+  const r2Operations = record10(r2.operations) ? r2.operations : {};
+  const r2Storage = record10(r2.storage) ? r2.storage : {};
   const status = String(
     read3.body.status ?? read3.body.error ?? "unavailable"
   );
@@ -10224,11 +10868,11 @@ function providerCapacityLines(read3) {
   ];
 }
 function liveSyncLine(read3) {
-  const performance = record7(read3.body.performance) ? read3.body.performance : {};
-  const commitToSend = record7(performance.commitToSend) ? performance.commitToSend : {};
+  const performance = record10(read3.body.performance) ? read3.body.performance : {};
+  const commitToSend = record10(performance.commitToSend) ? performance.commitToSend : {};
   return `live-sync	${read3.httpStatus}	${String(read3.body.status ?? read3.body.error ?? "unavailable")}	${numeric3(read3.body.activeConnections)} active	${optionalNumeric(commitToSend.p95)} commit-to-send p95	${numeric3(performance.sendFailures)} send failures`;
 }
-function record7(value2) {
+function record10(value2) {
   return Boolean(value2) && typeof value2 === "object" && !Array.isArray(value2);
 }
 function numeric3(value2) {
@@ -10397,14 +11041,14 @@ function statusMinutes(value2) {
 }
 async function read2(url, headers, doFetch) {
   const response2 = await doFetch(url, { headers });
-  const text = await response2.text();
+  const text2 = await response2.text();
   let body = {};
-  if (text) {
+  if (text2) {
     try {
-      const value2 = JSON.parse(text);
+      const value2 = JSON.parse(text2);
       body = value2 && typeof value2 === "object" && !Array.isArray(value2) ? value2 : { value: value2 };
     } catch {
-      body = { message: text.slice(0, 300) };
+      body = { message: text2.slice(0, 300) };
     }
   }
   return { httpStatus: response2.status, body };
@@ -10412,9 +11056,9 @@ async function read2(url, headers, doFetch) {
 
 // src/record.ts
 import { appendFileSync } from "fs";
-import process12 from "process";
+import process13 from "process";
 function recordInvocation(parsed) {
-  const file = process12.env.ODLA_CLI_RECORD;
+  const file = process13.env.ODLA_CLI_RECORD;
   if (!file) return;
   try {
     const entry = {
@@ -10429,7 +11073,7 @@ function recordInvocation(parsed) {
 }
 
 // src/runbook-actions.ts
-import { readFileSync as readFileSync9 } from "fs";
+import { readFileSync as readFileSync10 } from "fs";
 
 // src/runbook-requires.ts
 var SPEC = /^(@?[\w./-]+?)@(\d+\.\d+\.\d+(?:[\w.-]*)?)$/;
@@ -10514,7 +11158,7 @@ async function bySlug(ctx, slug) {
 function readBody(file, inline) {
   if (inline !== void 0) return inline;
   if (file === void 0) throw new Error("supply the new text with --file <path>, --file - (stdin), or --body");
-  return readFileSync9(file === "-" ? 0 : file, "utf8");
+  return readFileSync10(file === "-" ? 0 : file, "utf8");
 }
 var stamp = (ms) => ms ? new Date(ms).toISOString().slice(0, 16).replace("T", " ") : "";
 async function runbookList(ctx, all, query) {
@@ -10544,12 +11188,17 @@ async function runbookNew(ctx, slug, title, body, summary, requires) {
   });
   ctx.out.log(ctx.json ? JSON.stringify(created, null, 2) : `created ${slug} (${created.id})`);
 }
-async function runbookEdit(ctx, slug, body, note, requires) {
+async function runbookEdit(ctx, slug, body, note, requires, expectedVersion) {
   const runbook = await bySlug(ctx, slug);
   const result = await call(ctx, "PATCH", `/runbook/${encodeURIComponent(runbook.id)}`, {
     // An empty --requires clears the declaration; omitting the flag leaves
     // whatever is there, so an ordinary body edit never drops it.
-    patch: { body, ...note ? { note } : {}, ...requires === void 0 ? {} : { requires: requires || null } }
+    patch: {
+      body,
+      expectedVersion: expectedVersion ?? runbook.version,
+      ...note ? { note } : {},
+      ...requires === void 0 ? {} : { requires: requires || null }
+    }
   });
   if (ctx.json) return ctx.out.log(JSON.stringify(result, null, 2));
   ctx.out.log(`${slug} \u2192 v${result.record?.version ?? runbook.version + 1}`);
@@ -10601,14 +11250,14 @@ async function runbookRemove(ctx, slug) {
 }
 
 // src/runbook-import.ts
-import { readFileSync as readFileSync10, readdirSync as readdirSync2, statSync } from "fs";
-import { basename as basename2, join as join12 } from "path";
-function parseRunbook(text, slug) {
-  let rest = text;
+import { readFileSync as readFileSync11, readdirSync as readdirSync2, statSync } from "fs";
+import { basename as basename2, join as join13 } from "path";
+function parseRunbook(text2, slug) {
+  let rest = text2;
   const meta = {};
-  const fm = /^---\r?\n([\s\S]*?)\r?\n---\r?\n?/.exec(text);
+  const fm = /^---\r?\n([\s\S]*?)\r?\n---\r?\n?/.exec(text2);
   if (fm) {
-    rest = text.slice(fm[0].length);
+    rest = text2.slice(fm[0].length);
     for (const line of fm[1].split(/\r?\n/)) {
       const pair = /^(\w+)\s*:\s*(.+)$/.exec(line.trim());
       if (!pair) continue;
@@ -10632,7 +11281,7 @@ function readRunbookDir(dir) {
   if (!files.length) throw new Error(`no .md files in ${dir}`);
   return files.map((file) => {
     const slug = basename2(file, ".md");
-    const parsed = parseRunbook(readFileSync10(join12(dir, file), "utf8"), slug);
+    const parsed = parseRunbook(readFileSync11(join13(dir, file), "utf8"), slug);
     return { file, slug, ...parsed, words: parsed.body.split(/\s+/).filter(Boolean).length };
   });
 }
@@ -10689,6 +11338,7 @@ async function upsert(ctx, r, visibility) {
       patch: {
         title: r.title,
         body: r.body,
+        expectedVersion: found.version,
         ...r.summary ? { summary: r.summary } : {},
         ...r.tags ? { tags: r.tags } : {},
         note: `imported from ${r.file}`
@@ -10704,8 +11354,8 @@ async function upsert(ctx, r, visibility) {
 
 // src/runbook-impact.ts
 import { execFileSync as execFileSync2 } from "child_process";
-import { existsSync as existsSync11, readFileSync as readFileSync11 } from "fs";
-import { join as join13 } from "path";
+import { existsSync as existsSync11, readFileSync as readFileSync12 } from "fs";
+import { join as join14 } from "path";
 
 // src/runbook-impact-scan.ts
 var DECL = /^[+-]\s*export\s+(?:declare\s+)?(?:default\s+)?(?:abstract\s+)?(?:async\s+)?(?:const|let|var|function|class|interface|type|enum)\s+([A-Za-z_$][\w$]*)/;
@@ -10874,10 +11524,10 @@ ${body.split("\n").map((line) => `+${line}`).join("\n")}
 }
 function manifestLabeller(root) {
   return (workspace) => {
-    const manifest = join13(root, workspace, "package.json");
+    const manifest = join14(root, workspace, "package.json");
     if (!existsSync11(manifest)) return void 0;
     try {
-      const name = JSON.parse(readFileSync11(manifest, "utf8")).name;
+      const name = JSON.parse(readFileSync12(manifest, "utf8")).name;
       return typeof name === "string" ? name : void 0;
     } catch {
       return void 0;
@@ -10944,7 +11594,7 @@ function report3(ctx, impacts) {
 async function runbookImpact(ctx, options, deps = {}) {
   const cwd = deps.cwd ?? process.cwd();
   const runGit = deps.runGit ?? gitRunner(cwd);
-  const read3 = deps.readRepoFile ?? ((path) => readFileSync11(join13(cwd, path), "utf8"));
+  const read3 = deps.readRepoFile ?? ((path) => readFileSync12(join14(cwd, path), "utf8"));
   const surfaces = changedSurfaces(collectDiff(runGit, options.base, read3), manifestLabeller(cwd));
   if (!surfaces.length) {
     return ctx.out.log(
@@ -11077,12 +11727,12 @@ async function runbookComment(ctx, slug, body) {
 
 // src/runbook-editor.ts
 import { spawnSync } from "child_process";
-import { mkdtempSync, readFileSync as readFileSync12, rmSync as rmSync2, writeFileSync as writeFileSync4 } from "fs";
+import { mkdtempSync, readFileSync as readFileSync13, rmSync as rmSync2, writeFileSync as writeFileSync4 } from "fs";
 import { tmpdir as tmpdir4 } from "os";
-import { join as join14 } from "path";
-import process13 from "process";
+import { join as join15 } from "path";
+import process14 from "process";
 var EDITOR_ENV = ["ODLA_EDITOR", "VISUAL", "EDITOR"];
-function resolveEditor(env = process13.env) {
+function resolveEditor(env = process14.env) {
   for (const name of EDITOR_ENV) {
     const value2 = env[name];
     if (value2 && value2.trim()) return value2.trim();
@@ -11096,8 +11746,8 @@ function defaultRun(command, path) {
   return result.status ?? 0;
 }
 function editText(initial, slug, deps = {}) {
-  const env = deps.env ?? process13.env;
-  const interactive = deps.interactive ?? (() => Boolean(process13.stdin.isTTY));
+  const env = deps.env ?? process14.env;
+  const interactive = deps.interactive ?? (() => Boolean(process14.stdin.isTTY));
   const editor = resolveEditor(env);
   if (!editor)
     throw new Error(
@@ -11105,13 +11755,13 @@ function editText(initial, slug, deps = {}) {
     );
   if (!interactive())
     throw new Error(`cannot open an editor without a terminal \u2014 pass --file <path> or --body "\u2026" instead`);
-  const dir = mkdtempSync(join14(tmpdir4(), "odla-runbook-"));
-  const file = join14(dir, `${slug}.md`);
+  const dir = mkdtempSync(join15(tmpdir4(), "odla-runbook-"));
+  const file = join15(dir, `${slug}.md`);
   try {
     writeFileSync4(file, initial, { mode: 384 });
     const code = defaultRunOrInjected(deps)(editor, file);
     if (code !== 0) throw new Error(`editor "${editor}" exited with ${code}; nothing was written`);
-    const edited = readFileSync12(file, "utf8");
+    const edited = readFileSync13(file, "utf8");
     return edited === initial ? null : edited;
   } finally {
     rmSync2(dir, { recursive: true, force: true });
@@ -11129,27 +11779,90 @@ async function editRunbook(ctx, slug, deps = {}) {
   const found = page.records[0];
   if (!found) throw new Error(`no runbook "${slug}" in ${ctx.appId}`);
   ctx.out.log(`opening ${slug} v${found.version} in your editor\u2026`);
-  return editText(found.body, slug, deps);
+  const body = await editText(found.body, slug, deps);
+  return body === null ? null : { body, expectedVersion: found.version };
 }
 
 // src/whoami-command.ts
+var text = (value2) => typeof value2 === "string" && value2.trim() ? value2.trim() : null;
+function principalKind(value2, machine) {
+  return value2 === "human" || value2 === "agent" || value2 === "service" ? value2 : machine ? "service" : "human";
+}
+function credentialKind(value2, machine, scopes) {
+  if (value2 === "machine" || value2 === "device" || value2 === "clerk") return value2;
+  if (machine) return "machine";
+  if (scopes.length) return "device";
+  return "unknown";
+}
+function managerOf(value2) {
+  if (!value2 || typeof value2 !== "object") return null;
+  const row = value2;
+  const principalId = text(row.principalId);
+  if (!principalId) return null;
+  return {
+    principalId,
+    displayName: text(row.displayName) ?? "Unnamed member",
+    handle: text(row.handle) ?? ""
+  };
+}
+function unnamedPrincipal(kind) {
+  if (kind === "agent") return "Unnamed agent";
+  if (kind === "service") return "Unnamed service";
+  return "Unnamed member";
+}
 async function fetchIdentity(platformUrl, token, doFetch) {
   const res = await doFetch(`${platformUrl.replace(/\/$/, "")}/registry/me`, {
     headers: { authorization: `Bearer ${token}` }
   });
   if (!res.ok) throw new Error(`could not resolve identity (HTTP ${res.status})`);
   const body = await res.json();
+  const developerId = text(body.developerId) ?? "";
+  const machine = body.machine === true;
+  const scopes = Array.isArray(body.scopes) ? body.scopes.map(String) : [];
+  const principalId = text(body.principalId) ?? developerId;
+  const email = text(body.email);
+  const kind = principalKind(body.principalKind, machine);
+  const displayName = text(body.displayName) ?? email ?? unnamedPrincipal(kind);
+  const handle = text(body.handle) ?? "";
+  const credential2 = body.credential && typeof body.credential === "object" ? body.credential : {};
   return {
-    developerId: String(body.developerId ?? ""),
-    email: body.email ?? null,
+    developerId,
+    principalId,
+    principalKind: kind,
+    displayName,
+    handle,
+    manager: managerOf(body.manager),
+    credential: {
+      id: text(credential2.id),
+      kind: credentialKind(credential2.kind, machine, scopes)
+    },
+    email,
     admin: body.admin === true,
-    machine: body.machine === true,
-    scopes: Array.isArray(body.scopes) ? body.scopes.map(String) : []
+    machine,
+    scopes
   };
 }
-function credentialKind(identity) {
-  if (identity.machine) return "machine (platform admin secret)";
-  return identity.scopes.length ? "device token (scoped)" : "device token or session";
+function credentialLabel(identity) {
+  if (identity.credential.kind === "machine") return "machine (platform admin secret)";
+  if (identity.credential.kind === "device")
+    return identity.scopes.length ? "device (scoped)" : "device";
+  if (identity.credential.kind === "clerk") return "clerk";
+  return "unknown (legacy server)";
+}
+function namedPrincipal(identity) {
+  return identity.handle && identity.handle !== identity.displayName ? `${identity.displayName} (@${identity.handle})` : identity.displayName;
+}
+function namedManager(manager) {
+  return manager.handle && manager.handle !== manager.displayName ? `${manager.displayName} (@${manager.handle})` : manager.displayName;
+}
+function accountableOwner(identity) {
+  if (identity.principalKind === "agent" && identity.manager) {
+    return namedManager(identity.manager);
+  }
+  if (identity.principalKind === "human" && identity.principalId === identity.developerId) {
+    return namedPrincipal(identity);
+  }
+  return identity.email ?? "Unnamed member";
 }
 async function whoamiCommand(parsed, deps = {}) {
   assertArgs(
@@ -11180,9 +11893,19 @@ async function whoamiCommand(parsed, deps = {}) {
     return;
   }
   out.log(`platform:   ${cfg.platformUrl}`);
-  out.log(`developer:  ${identity.developerId}`);
+  out.log(`principal:  ${namedPrincipal(identity)}`);
+  out.log(`principal id: ${identity.principalId}`);
+  out.log(`kind:       ${identity.principalKind}`);
+  if (identity.principalKind === "agent")
+    out.log(
+      `manager:    ${identity.manager ? namedManager(identity.manager) : "(unknown)"}`
+    );
+  out.log(`owner:      ${accountableOwner(identity)}`);
+  out.log(`owner id:   ${identity.developerId}`);
   out.log(`email:      ${identity.email ?? "(none)"}`);
-  out.log(`credential: ${credentialKind(identity)}`);
+  out.log(`credential: ${credentialLabel(identity)}`);
+  if (identity.credential.id)
+    out.log(`credential id: ${identity.credential.id}`);
   out.log(`admin:      ${identity.admin ? "yes" : "no"}`);
   if (identity.scopes.length) out.log(`scopes:     ${identity.scopes.join(", ")}`);
   if (!identity.admin) {
@@ -11331,14 +12054,16 @@ async function runbookCommand(parsed, deps = {}) {
       const name = requireSlug(slug, "edit");
       const file = stringOpt(parsed.options.file);
       const inline = stringOpt(parsed.options.body);
-      const body = file === void 0 && inline === void 0 ? await editRunbook(ctx, name) : readBody(file, inline);
-      if (body === null) return ctx.out.log(`${name} unchanged; nothing written`);
+      const edited = file === void 0 && inline === void 0 ? await editRunbook(ctx, name) : readBody(file, inline);
+      if (edited === null) return ctx.out.log(`${name} unchanged; nothing written`);
+      const body = typeof edited === "string" ? edited : edited.body;
       return runbookEdit(
         ctx,
         name,
         body,
         stringOpt(parsed.options.note),
-        parsed.options.requires === void 0 ? void 0 : stringOpt(parsed.options.requires) ?? ""
+        parsed.options.requires === void 0 ? void 0 : stringOpt(parsed.options.requires) ?? "",
+        typeof edited === "string" ? void 0 : edited.expectedVersion
       );
     }
     case "import": {
@@ -11805,11 +12530,11 @@ async function securityStatus(parsed, dependencies) {
 // src/cli.ts
 function exitCodeFor(err) {
   const code = err?.code;
-  if (code === "handshake_pending" || code === "watch_timeout") return 75;
+  if (code === "handshake_pending" || code === "watch_timeout" || code === "operation_pending") return 75;
   if (code === "checkpoint_required") return 3;
   if (code === "remote_unavailable") return 6;
   if (code === "auth_failed") return 5;
-  if (code === "invalid_cursor") return 2;
+  if (code === "invalid_cursor" || code === "invalid_plan" || code === "invalid_operation_id") return 2;
   return 1;
 }
 async function runCli(argv = process.argv.slice(2), dependencies = {}) {
@@ -11964,7 +12689,11 @@ export {
   calendarDisconnect,
   CAPABILITIES,
   printCapabilities,
+  ConfigOperationCommandError,
   desiredRegistryState,
+  configApply,
+  configOperationGet,
+  configOperationWait,
   reconcileConfig,
   configDiff,
   configPlan,
@@ -12005,4 +12734,4 @@ export {
   exitCodeFor,
   runCli
 };
-//# sourceMappingURL=chunk-2AFAXLKE.js.map
+//# sourceMappingURL=chunk-ZAZBUURZ.js.map