@odla-ai/cli 0.25.23 → 0.26.1

package/dist/index.cjs

@@ -250,10 +250,10 @@ function isManagedDevVar(line) {
   const match = line.match(/^\s*(?:export\s+)?([A-Z][A-Z0-9_]*)\s*=/);
   return !!match?.[1] && MANAGED_DEV_VARS.has(match[1]);
 }
-function writePrivateText(path, text) {
+function writePrivateText(path, text2) {
   (0, import_node_fs.mkdirSync)((0, import_node_path.dirname)(path), { recursive: true });
   const temporary = `${path}.tmp-${process.pid}-${Date.now()}`;
-  (0, import_node_fs.writeFileSync)(temporary, text, { mode: 384 });
+  (0, import_node_fs.writeFileSync)(temporary, text2, { mode: 384 });
   (0, import_node_fs.chmodSync)(temporary, 384);
   (0, import_node_fs.renameSync)(temporary, path);
 }
@@ -560,6 +560,7 @@ function audienceBoundEnvToken(token, platform) {
 }
 var SCOPE_PURPOSE = {
   "platform:status:read": "read the platform fleet health and deployment snapshot",
+  "platform:chat:credential:write": "rotate the built-in Discussion responder credential",
   "app:config:read": "compare checked-in intent with an exact-id app Registry configuration",
   "app:config:write": "apply or inspect one revision-bound configuration operation for an app you own",
   "platform:runbook:write": "add or edit odla's operational runbooks",
@@ -619,6 +620,14 @@ async function scopedToken(platform, scope, options, doFetch, out) {
   return token;
 }
 
+// src/principal-presentation.ts
+function unresolvedPrincipalLabel(credentialKind2, principalId) {
+  const kind = typeof credentialKind2 === "string" ? credentialKind2.trim() : "";
+  const id = typeof principalId === "string" ? principalId.trim() : "";
+  const audit = kind && id ? `${kind}:${id}` : kind || id;
+  return `Unknown principal${audit ? ` [${audit}]` : ""}`;
+}
+
 // src/admin-ai-audit.ts
 function adminAiAuditQuery(filters) {
   if (filters.limit === void 0) return "";
@@ -648,17 +657,17 @@ async function readAdminAiAudit(request2) {
       String(event.changeKind ?? ""),
       String(event.purpose ?? event.provider ?? ""),
       route2,
-      `${String(event.actorType ?? "")}:${String(event.actorId ?? "")}`
+      unresolvedPrincipalLabel(event.actorType, event.actorId)
     ].join("	"));
   }
 }
 async function responseBody(response2) {
-  const text = await response2.text();
-  if (!text) return {};
+  const text2 = await response2.text();
+  if (!text2) return {};
   try {
-    return JSON.parse(text);
+    return JSON.parse(text2);
   } catch {
-    return { message: text.slice(0, 300) };
+    return { message: text2.slice(0, 300) };
   }
 }
 function apiError(status, body) {
@@ -739,7 +748,7 @@ when	app/env	run	actor	purpose/role	route / policy	tokens	cost	status`);
       timestamp2(event.created_at),
       `${String(event.app_id ?? "")}/${String(event.env ?? "")}`,
       String(event.run_id ?? ""),
-      `${String(event.actor_type ?? "")}:${String(event.actor_id ?? "")}`,
+      unresolvedPrincipalLabel(event.actor_type, event.actor_id),
       `${String(event.purpose ?? "")}/${String(event.role ?? "")}`,
       `${String(event.provider ?? "")}/${String(event.model ?? "")}@v${String(event.policy_version ?? "unknown")}`,
       String(input + output),
@@ -760,12 +769,12 @@ function timestamp2(value2) {
   return Number.isFinite(date.valueOf()) ? date.toISOString() : "";
 }
 async function responseBody2(res) {
-  const text = await res.text();
-  if (!text) return {};
+  const text2 = await res.text();
+  if (!text2) return {};
   try {
-    return JSON.parse(text);
+    return JSON.parse(text2);
   } catch {
-    return { message: text.slice(0, 300) };
+    return { message: text2.slice(0, 300) };
   }
 }
 function apiError2(action2, status, body) {
@@ -941,12 +950,12 @@ function catalogModels(body) {
   return body.catalog.models.filter((value2) => isRecord3(value2) && typeof value2.id === "string" && typeof value2.provider === "string");
 }
 async function responseBody3(res) {
-  const text = await res.text();
-  if (!text) return {};
+  const text2 = await res.text();
+  if (!text2) return {};
   try {
-    return JSON.parse(text);
+    return JSON.parse(text2);
   } catch {
-    return { message: text.slice(0, 300) };
+    return { message: text2.slice(0, 300) };
   }
 }
 function apiError3(action2, status, body) {
@@ -1790,8 +1799,8 @@ async function appImport(options) {
   const say = options.json ? (line) => out.error(line) : (line) => out.log(line);
   const doFetch = options.fetch ?? fetch;
   const { tenant } = resolveTenant(cfg, options.env);
-  const text = options.file === "-" ? (options.readStdin ?? (() => (0, import_node_fs8.readFileSync)(0, "utf8")))() : (0, import_node_fs8.readFileSync)(options.file, "utf8");
-  const { format, sources } = (0, import_import.parseImport)(text, options.ns);
+  const text2 = options.file === "-" ? (options.readStdin ?? (() => (0, import_node_fs8.readFileSync)(0, "utf8")))() : (0, import_node_fs8.readFileSync)(options.file, "utf8");
+  const { format, sources } = (0, import_import.parseImport)(text2, options.ns);
   if (format === "namespace-map" && options.ns) {
     throw new Error("--ns cannot be combined with a {namespace: rows} file \u2014 the file already names each namespace");
   }
@@ -1882,7 +1891,10 @@ function report(options, owners, headline) {
   if (headline) out.log(headline);
   out.log(`owners (${owners.length}):`);
   for (const o of owners) {
-    out.log(`  ${o.primary ? "\u2605" : "\xB7"} ${o.email ?? o.ownerId}${o.primary ? " (primary)" : ""}`);
+    const name = o.email?.trim() || "Unnamed member";
+    out.log(
+      `  ${o.primary ? "\u2605" : "\xB7"} ${name} [${o.ownerId}]${o.primary ? " (primary)" : ""}`
+    );
   }
 }
 async function ownersList(options) {
@@ -2799,9 +2811,9 @@ function canonicalValue(value2) {
   }
   if (Array.isArray(value2)) return value2.map(canonicalValue);
   if (value2 && typeof value2 === "object") {
-    const record10 = value2;
+    const record11 = value2;
     return Object.fromEntries(
-      Object.keys(record10).filter((key) => record10[key] !== void 0).sort().map((key) => [key, canonicalValue(record10[key])])
+      Object.keys(record11).filter((key) => record11[key] !== void 0).sort().map((key) => [key, canonicalValue(record11[key])])
     );
   }
   throw new TypeError("canonical JSON rejects unsupported values");
@@ -3627,22 +3639,26 @@ function planNextActions(reconciliation, configPath) {
     }
   }
   if (reconciliation.actions.some((action2) => action2.applySupport === "studio")) {
-    const { appId, platformUrl } = reconciliation.scope;
     next.push({
       code: "review_destructive",
-      command: `${platformUrl}/studio/apps/${encodeURIComponent(appId)}/settings`,
+      command: studioSettingsUrl(reconciliation),
       description: "Review service disablement in the owning Studio scope; this plan will not apply it."
     });
   }
   if (!reconciliation.actions.length && reconciliation.summary.unmanaged) {
     next.push({
       code: "declare_or_accept_runtime_state",
-      command: `${reconciliation.scope.platformUrl}/studio/apps/${encodeURIComponent(reconciliation.scope.appId)}/settings`,
+      command: studioSettingsUrl(reconciliation),
       description: "Declare the live value in project config or keep it as an explicit runtime-managed setting."
     });
   }
   return next;
 }
+function studioSettingsUrl(reconciliation) {
+  const environment2 = reconciliation.actions.map((action2) => action2.env).concat(reconciliation.scope.environments).find((candidate) => candidate === "dev" || candidate === "prod") ?? "dev";
+  const origin = reconciliation.scope.platformUrl.replace(/\/$/, "");
+  return `${origin}${(0, import_apps8.studioAppSettingsPath)(reconciliation.scope.appId, environment2, "environment")}`;
+}
 function quoteArg2(value2) {
   return `'${value2.replace(/'/g, `'\\''`)}'`;
 }
@@ -3682,15 +3698,15 @@ function readWranglerConfig(path) {
     return null;
   }
 }
-function stripJsonComments(text) {
+function stripJsonComments(text2) {
   let result = "";
   let inString = false;
-  for (let i = 0; i < text.length; i++) {
-    const ch = text[i];
+  for (let i = 0; i < text2.length; i++) {
+    const ch = text2[i];
     if (inString) {
       result += ch;
       if (ch === "\\") {
-        result += text[i + 1] ?? "";
+        result += text2[i + 1] ?? "";
         i++;
       } else if (ch === '"') {
         inString = false;
@@ -3702,14 +3718,14 @@ function stripJsonComments(text) {
       result += ch;
       continue;
     }
-    if (ch === "/" && text[i + 1] === "/") {
-      while (i < text.length && text[i] !== "\n") i++;
+    if (ch === "/" && text2[i + 1] === "/") {
+      while (i < text2.length && text2[i] !== "\n") i++;
       result += "\n";
       continue;
     }
-    if (ch === "/" && text[i + 1] === "*") {
+    if (ch === "/" && text2[i + 1] === "*") {
       i += 2;
-      while (i < text.length && !(text[i] === "*" && text[i + 1] === "/")) i++;
+      while (i < text2.length && !(text2[i] === "*" && text2[i + 1] === "/")) i++;
       i++;
       continue;
     }
@@ -3726,7 +3742,14 @@ async function wranglerLoggedIn(run, cwd) {
   }
 }
 function wranglerPutSecret(run, opts) {
-  const args = ["wrangler", "secret", "put", opts.name, ...opts.env ? ["--env", opts.env] : []];
+  const args = [
+    "wrangler",
+    "secret",
+    "put",
+    opts.name,
+    ...opts.env ? ["--env", opts.env] : [],
+    ...opts.configPath ? ["--config", opts.configPath] : []
+  ];
   return run("npx", args, { input: opts.value, cwd: opts.cwd });
 }
 
@@ -4104,9 +4127,9 @@ function initProject(options) {
   out.log("created src/odla/schema.mjs and src/odla/rules.mjs");
   out.log("updated .gitignore for local odla credentials");
 }
-function writeIfMissing(path, text) {
+function writeIfMissing(path, text2) {
   if ((0, import_node_fs13.existsSync)(path)) return;
-  (0, import_node_fs13.writeFileSync)(path, text);
+  (0, import_node_fs13.writeFileSync)(path, text2);
 }
 function configTemplate(input) {
   const calendar = input.services.includes("calendar") ? `  calendar: {
@@ -4314,13 +4337,13 @@ async function secretsSetClerkKey(options) {
     body: JSON.stringify({ value: value2 })
   });
   if (!res.ok) {
-    const text = scrubValue((await res.text().catch(() => "")).slice(0, 300), value2);
-    throw new Error(`store Clerk secret key failed (${res.status}): ${text || "request failed"}`);
+    const text2 = scrubValue((await res.text().catch(() => "")).slice(0, 300), value2);
+    throw new Error(`store Clerk secret key failed (${res.status}): ${text2 || "request failed"}`);
   }
   out.log(`Clerk secret key stored for ${tenantId} ($clerk_secret, reserved + write-only; the value was never echoed)`);
 }
-function scrubValue(text, value2) {
-  return redactSecrets(text).split(value2).join("[value redacted]");
+function scrubValue(text2, value2) {
+  return redactSecrets(text2).split(value2).join("[value redacted]");
 }
 async function resolveVaultWrite(options) {
   const out = options.stdout ?? console;
@@ -5148,8 +5171,8 @@ async function runContainerAttempt(options) {
   let stopped = false;
   let exited = false;
   child.stderr.setEncoding("utf8");
-  child.stderr.on("data", (text) => {
-    if (stderr.length < 64 * 1024) stderr += text.slice(0, 64 * 1024 - stderr.length);
+  child.stderr.on("data", (text2) => {
+    if (stderr.length < 64 * 1024) stderr += text2.slice(0, 64 * 1024 - stderr.length);
   });
   const stop = (reason) => {
     if (stopped || exited) return;
@@ -5307,8 +5330,8 @@ async function materializeGitTree(source, commitSha, options = {}) {
   const maxFiles = options.maxFiles ?? 2e4;
   const maxBytes = options.maxBytes ?? 512 * 1024 * 1024;
   const inventory = (await gitOutput(sourceDir, ["ls-tree", "-rz", commitSha], 16 * 1024 * 1024)).toString("utf8").split("\0").filter(Boolean);
-  const entries = inventory.flatMap((record10) => {
-    const match = /^(100644|100755) blob ([0-9a-f]{40,64})\t([\s\S]+)$/.exec(record10);
+  const entries = inventory.flatMap((record11) => {
+    const match = /^(100644|100755) blob ([0-9a-f]{40,64})\t([\s\S]+)$/.exec(record11);
     return match && allowedWorkspacePath(match[3]) ? [{ mode: match[1], hash: match[2], path: match[3] }] : [];
   });
   if (entries.length > maxFiles) throw new Error(`workspace exceeds ${maxFiles} files`);
@@ -5556,8 +5579,8 @@ function normalize(value2) {
   if (Array.isArray(value2)) return value2.map(normalize);
   if (value2 instanceof Uint8Array) return { $bytes: [...value2] };
   if (typeof value2 === "object") {
-    const record10 = value2;
-    return Object.fromEntries(Object.keys(record10).filter((key) => record10[key] !== void 0).sort().map((key) => [key, normalize(record10[key])]));
+    const record11 = value2;
+    return Object.fromEntries(Object.keys(record11).filter((key) => record11[key] !== void 0).sort().map((key) => [key, normalize(record11[key])]));
   }
   throw new CamelError("state_conflict", "Canonical JSON rejects unsupported values.");
 }
@@ -5981,8 +6004,8 @@ function boundedInteger(value2, spec) {
 }
 function boundedNumber(value2, spec) {
   if (spec.kind !== "finite_number" || typeof value2 !== "number" || !Number.isFinite(value2) || value2 < spec.minimum || value2 > spec.maximum) throw new CamelError("conversion_rejected", "Finite-number conversion rejected the structured value.");
-  const text = String(value2);
-  if (/e/i.test(text) || (text.split(".")[1]?.length ?? 0) > spec.maximumDecimalPlaces) throw new CamelError("conversion_rejected", "Finite-number conversion rejected a non-canonical decimal.");
+  const text2 = String(value2);
+  if (/e/i.test(text2) || (text2.split(".")[1]?.length ?? 0) > spec.maximumDecimalPlaces) throw new CamelError("conversion_rejected", "Finite-number conversion rejected a non-canonical decimal.");
   return value2;
 }
 function enumMember(value2, spec) {
@@ -6138,8 +6161,8 @@ function validateUnsafeSelector(path, value2, tool) {
   return void 0;
 }
 function looksLikeDestination(value2) {
-  const text = value2.trim();
-  return /^(?:[a-z][a-z0-9+.-]*:\/\/|\/|\\\\)/i.test(text) || /^[\w.-]+\.[a-z]{2,}(?:[/:]|$)/i.test(text);
+  const text2 = value2.trim();
+  return /^(?:[a-z][a-z0-9+.-]*:\/\/|\/|\\\\)/i.test(text2) || /^[\w.-]+\.[a-z]{2,}(?:[/:]|$)/i.test(text2);
 }
 
 // ../harness/dist/chunk-GMVZ4LZH.js
@@ -6508,8 +6531,8 @@ function gitApply(cwd, patch2, check) {
     });
     let stderr = "";
     child.stderr.setEncoding("utf8");
-    child.stderr.on("data", (text) => {
-      if (stderr.length < 4e3) stderr += text.slice(0, 4e3);
+    child.stderr.on("data", (text2) => {
+      if (stderr.length < 4e3) stderr += text2.slice(0, 4e3);
     });
     child.once("error", reject);
     child.once("exit", (code) => code === 0 ? accept() : reject(new TypeError(`patch did not apply: ${stderr.trim().slice(0, 500)}`)));
@@ -7680,10 +7703,10 @@ var CodePiRuntimeEngine = class {
       task: lease.task,
       limits: this.options.limits,
       signal: active.abort.signal,
-      onStderr: (text) => this.#event(command, {
+      onStderr: (text2) => this.#event(command, {
         type: "message",
         actor: "system",
-        body: text.slice(0, 4e3)
+        body: text2.slice(0, 4e3)
       }, active.conversationRefs),
       onMessage: async (output) => {
         if (output.type === "inference.request") {
@@ -8565,7 +8588,8 @@ Usage:
   odla-ai doctor [--config odla.config.mjs]
   odla-ai config <diff|plan> [--config odla.config.mjs] [--email <odla-account>] [--json]
   odla-ai config apply --plan <plan.json> [--idempotency-key <key>] [--email <odla-account>] [--json]
-  odla-ai operations <get|wait> <operation-id> [--interval <seconds>] [--timeout <seconds>] [--json]
+  odla-ai operations get <operation-id> [--json]
+  odla-ai operations wait <operation-id> [--interval <seconds>] [--timeout <seconds>] [--json]
   odla-ai calendar status [--env dev] [--email <odla-account>] [--json]
   odla-ai calendar calendars [--env dev] [--email <odla-account>] [--json]
   odla-ai calendar connect [--env dev] [--email <odla-account>] [--no-open] [--yes]
@@ -8616,6 +8640,7 @@ Usage:
   odla-ai context remove <name> --yes [--json]
   odla-ai o11y status [--app <id>] [--context <name>] [--platform https://odla.ai] [--env prod] [--minutes 60] [--json]
   odla-ai platform status [--context <name>] [--platform https://odla.ai] [--email <odla-account>] [--json]
+  odla-ai platform chat-credentials rotate [--context <name>] [--email <odla-account>] [--wrangler-config <path>] [--expected-version <id>] [--json] --yes
   odla-ai whoami [--context <name>] [--platform https://odla.ai] [--json]
   odla-ai runbook ask "<question>" [--app <id>] [--all] [--json]
   odla-ai runbook search "<question>" [--app <id>] [--all] [--limit <n>] [--json]
@@ -8679,9 +8704,9 @@ Commands:
                does and what it guarantees is JSDoc, rendered per package at
                https://odla.ai/docs and shipped in the installed .d.ts. Answering
                a question usually needs both.
-  whoami       Report who this terminal is authenticated as, and whether it holds
-               platform admin. A handshake-minted device token is never admin,
-               however the human who approved it is configured.
+  whoami       Report the actual principal name, handle and kind, its manager,
+               credential kind, accountable owner, and platform-admin status.
+               A manager relationship never supplies authority by itself.
   context      Explain selected config, platform, app, environment, and
                developer-token provenance without printing credentials or
                starting a device handshake. Operator work can run outside a
@@ -8801,6 +8826,58 @@ Safety:
 `);
 }
 
+// src/discuss-principals.ts
+function mergeDiscussPrincipals(target, source) {
+  Object.assign(target.authors, source.authors ?? {});
+  Object.assign(target.principals, source.principals ?? {});
+}
+var withAt = (handle) => handle.startsWith("@") ? handle : `@${handle}`;
+function discussPrincipalLabel(principalId, authorKind, projection) {
+  const profile = projection.principals?.[principalId];
+  if (profile) {
+    const identity = `${profile.displayName} (${withAt(profile.handle)})`;
+    if (profile.kind === "agent") {
+      return profile.managerDisplayName ? `${identity} \u2014 agent managed by ${profile.managerDisplayName}` : `${identity} \u2014 agent`;
+    }
+    return profile.kind === "service" ? `${identity} \u2014 service` : identity;
+  }
+  const legacyName = projection.authors?.[principalId]?.trim();
+  if (legacyName) {
+    return authorKind === "bot" ? `${legacyName} \u2014 agent` : legacyName;
+  }
+  return authorKind === "bot" ? "Unnamed agent" : "Unnamed member";
+}
+
+// src/discuss-read-render.ts
+function discussBodyWithRefs(post) {
+  if (!post.refs || post.refs.length === 0) return post.body;
+  let out = "";
+  let cursor = 0;
+  for (const ref of [...post.refs].sort((a, b) => a.start - b.start)) {
+    if (ref.start < cursor || ref.end > post.body.length) continue;
+    out += post.body.slice(cursor, ref.start) + `@[${ref.label}](${ref.kind}/${ref.id})`;
+    cursor = ref.end;
+  }
+  return out + post.body.slice(cursor);
+}
+function renderDiscussRead(ctx, topic, posts, projection) {
+  const status = topic.resolved ? "resolved" : "open";
+  ctx.out.log(`${topic.subject}  [${status}]  ${topic.appId ?? ""}`);
+  for (const post of posts) {
+    const who = discussPrincipalLabel(
+      post.authorId,
+      post.authorKind,
+      projection
+    );
+    ctx.out.log(`
+\u2014 ${who}`);
+    ctx.out.log(discussBodyWithRefs(post));
+    for (const file of post.attachments ?? []) {
+      ctx.out.log(`  [attachment] ${file.name} (${file.size} bytes)`);
+    }
+  }
+}
+
 // src/discuss-actions.ts
 var writeMutationId = (parsed) => stringOpt(parsed.options["mutation-id"]) ?? crypto.randomUUID();
 async function request(ctx, method, path, body) {
@@ -8819,17 +8896,6 @@ function emit(ctx, value2, human) {
   else human();
 }
 var state = (topic) => topic.resolved ? "resolved" : "open";
-function bodyWithRefs(post) {
-  if (!post.refs || post.refs.length === 0) return post.body;
-  let out = "";
-  let cursor = 0;
-  for (const ref of [...post.refs].sort((a, b) => a.start - b.start)) {
-    if (ref.start < cursor || ref.end > post.body.length) continue;
-    out += post.body.slice(cursor, ref.start) + `@[${ref.label}](${ref.kind}/${ref.id})`;
-    cursor = ref.end;
-  }
-  return out + post.body.slice(cursor);
-}
 function content(parsed) {
   const markup = stringOpt(parsed.options.markup);
   if (markup) return { markup };
@@ -8884,11 +8950,19 @@ async function discussRead(ctx, id, parsed) {
       offset: requestedOffset ?? "0"
     });
     const page = await request(ctx, "GET", `/topics/${encodeURIComponent(id)}?${query}`);
-    emit(ctx, page, () => renderRead(ctx, page.topic, page.posts));
+    emit(
+      ctx,
+      page,
+      () => renderDiscussRead(ctx, page.topic, page.posts, page)
+    );
     return;
   }
   for (let scan = 0; scan < 3; scan++) {
     const posts = /* @__PURE__ */ new Map();
+    const projection = {
+      authors: {},
+      principals: {}
+    };
     let topic = null;
     let offset = 0;
     for (; ; ) {
@@ -8899,6 +8973,7 @@ async function discussRead(ctx, id, parsed) {
       );
       topic = page.topic;
       for (const post of page.posts) posts.set(post.id, post);
+      mergeDiscussPrincipals(projection, page);
       if (posts.size > 1e4) throw new Error("discuss read failed: conversation exceeds 10000 posts");
       if (!page.page?.hasMore) break;
       if (page.page.nextOffset === null || page.page.nextOffset <= offset) {
@@ -8911,24 +8986,18 @@ async function discussRead(ctx, id, parsed) {
     );
     const expected = Number.isInteger(topic.replyCount) ? topic.replyCount + 1 : ordered.length;
     if (ordered.length === expected) {
-      const result = { topic, posts: ordered };
-      emit(ctx, result, () => renderRead(ctx, result.topic, result.posts));
+      const result = { topic, posts: ordered, ...projection };
+      emit(
+        ctx,
+        result,
+        () => renderDiscussRead(ctx, result.topic, result.posts, result)
+      );
       return;
     }
     if (offset === 0) throw new Error("discuss read failed: registry did not provide forward post pages");
   }
   throw new Error("discuss read failed: conversation changed during every complete-read attempt");
 }
-function renderRead(ctx, topic, posts) {
-  ctx.out.log(`${topic.subject}  [${state(topic)}]  ${topic.appId ?? ""}`);
-  for (const post of posts) {
-    const who = post.authorKind === "bot" ? `${post.authorId} (agent)` : post.authorId;
-    ctx.out.log(`
-\u2014 ${who}`);
-    ctx.out.log(bodyWithRefs(post));
-    for (const file of post.attachments ?? []) ctx.out.log(`  [attachment] ${file.name} (${file.size} bytes)`);
-  }
-}
 async function discussPost(ctx, parsed) {
   const appId = stringOpt(parsed.options.app) ?? ctx.appId;
   if (!appId) throw new Error("discuss post needs --app <appId>");
@@ -9153,6 +9222,8 @@ async function discussWatch(ctx, topicId, parsed) {
         found: true,
         cursor,
         events: matching,
+        ...page.authors ? { authors: page.authors } : {},
+        ...page.principals ? { principals: page.principals } : {},
         ...posts && posts.length > 0 ? { posts } : {},
         ...topics && topics.length > 0 ? { topics } : {}
       });
@@ -9185,7 +9256,11 @@ function report2(ctx, parsed, result) {
     ctx.out.log(JSON.stringify(result, null, 2));
   } else if (parsed.options.jsonl !== true && result.found) {
     for (const post of result.posts ?? []) {
-      const who = post.authorKind === "bot" ? `${post.authorId} (agent)` : post.authorId;
+      const who = discussPrincipalLabel(
+        post.authorId,
+        post.authorKind,
+        result
+      );
       ctx.out.log(`\u2014 ${who}
 ${post.body}`);
     }
@@ -9330,8 +9405,8 @@ function collectFields(parsed, allowClear) {
       if (allowClear) out[spec.key] = null;
       continue;
     }
-    const text = stringOpt(value2);
-    out[spec.key] = spec.num ? Number(text) : text;
+    const text2 = stringOpt(value2);
+    out[spec.key] = spec.num ? Number(text2) : text2;
   }
   return out;
 }
@@ -9398,8 +9473,8 @@ async function pmAdd(ctx, entity, parsed) {
   emit2(ctx, res, () => ctx.out.log(`created ${entity} ${res.id}`));
 }
 async function pmGet(ctx, entity, id) {
-  const { record: record10 } = await pmRequest(ctx, "GET", `/${entity}/${encodeURIComponent(id)}`);
-  emit2(ctx, record10, () => printRecord(ctx, entity, record10));
+  const { record: record11 } = await pmRequest(ctx, "GET", `/${entity}/${encodeURIComponent(id)}`);
+  emit2(ctx, record11, () => printRecord(ctx, entity, record11));
 }
 async function pmSet(ctx, entity, id, parsed) {
   const patch2 = collectEntityFields(entity, parsed, true);
@@ -9444,9 +9519,9 @@ async function pmHandoff(ctx, parsed) {
   ]);
   const handoff = {
     appId,
-    unmetGoals: goals.filter((record10) => record10.status !== "met"),
-    activeTasks: tasks.filter((record10) => record10.column !== "done"),
-    openBugs: bugs.filter((record10) => record10.status !== "fixed" && record10.status !== "wontfix")
+    unmetGoals: goals.filter((record11) => record11.status !== "met"),
+    activeTasks: tasks.filter((record11) => record11.column !== "done"),
+    openBugs: bugs.filter((record11) => record11.status !== "fixed" && record11.status !== "wontfix")
   };
   const result = {
     ...handoff,
@@ -9465,10 +9540,10 @@ async function pmHandoff(ctx, parsed) {
     ]) {
       ctx.out.log(`${label}:`);
       if (!records.length) ctx.out.log("- (none)");
-      else for (const record10 of records) printRecord(
+      else for (const record11 of records) printRecord(
         ctx,
         label === "unmet goals" ? "goal" : label === "active tasks" ? "task" : "bug",
-        record10
+        record11
       );
     }
   });
@@ -9659,19 +9734,180 @@ function age(input) {
   return `${Math.round(input / 6e4)}m`;
 }
 
+// src/platform-chat-credential-command.ts
+var import_node_process10 = __toESM(require("process"), 1);
+async function rotatePlatformChatCredential(parsed, deps) {
+  assertArgs(
+    parsed,
+    [
+      "config",
+      "context",
+      "platform",
+      "token",
+      "email",
+      "open",
+      "json",
+      "yes",
+      "wrangler-config",
+      "expected-version"
+    ],
+    3
+  );
+  if (parsed.options.yes !== true) {
+    throw new Error(
+      "platform chat-credentials rotate changes the production chat secret; pass --yes"
+    );
+  }
+  const context = await resolveOperatorContext(parsed, {
+    allowMissingConfig: true
+  });
+  const platform = context.platform.value;
+  const doFetch = deps.fetch ?? fetch;
+  const out = deps.stdout ?? console;
+  const run = deps.runner ?? defaultRunner;
+  const cwd = import_node_process10.default.cwd();
+  const wranglerConfig = stringOpt(parsed.options["wrangler-config"]) ?? "packages/chat-agent/wrangler.jsonc";
+  if (!await wranglerLoggedIn(run, cwd)) {
+    throw new Error(
+      'Wrangler is not authenticated; run "npx wrangler login" and retry'
+    );
+  }
+  const priorHealth = await doFetch(`${platform}/health/services/chat`);
+  const priorVersion = priorHealth.headers.get("x-odla-worker-version-id");
+  await priorHealth.body?.cancel().catch(() => {
+  });
+  if (!priorVersion) {
+    throw new Error(
+      "chat health did not identify its current Worker version; refusing to rotate"
+    );
+  }
+  const expectedVersion = stringOpt(parsed.options["expected-version"]);
+  if (expectedVersion && priorVersion !== expectedVersion) {
+    throw new Error(
+      `chat health answered from version ${priorVersion}; expected ${expectedVersion}`
+    );
+  }
+  const token = await resolveAdminPlatformToken({
+    platform,
+    scope: "platform:chat:credential:write",
+    token: stringOpt(parsed.options.token),
+    tokenFile: context.credentials.scopedTokenFile,
+    email: stringOpt(parsed.options.email),
+    open: parsed.options.open === false ? false : parsed.options.open === true ? true : void 0,
+    fetch: doFetch,
+    stdout: out,
+    openApprovalUrl: deps.openUrl,
+    label: "odla CLI (rotate built-in Discussion responder)"
+  });
+  const mintedResponse = await doFetch(
+    `${platform}/registry/platform/chat-credentials/rotate`,
+    {
+      method: "POST",
+      headers: { authorization: `Bearer ${token}` }
+    }
+  );
+  const minted = await mintedResponse.json().catch(() => null);
+  if (!mintedResponse.ok) {
+    throw new Error(
+      `mint Discussion credential failed (HTTP ${mintedResponse.status}): ${apiMessage(minted)}`
+    );
+  }
+  if (!isPlatformChatCredential(minted)) {
+    throw new Error(
+      "platform returned an invalid odla.platform-chat-credential/v1 envelope"
+    );
+  }
+  const put = await wranglerPutSecret(run, {
+    name: "ODLA_BOT_TOKENS",
+    value: JSON.stringify({
+      [minted.appId]: { [minted.principalId]: minted.key }
+    }),
+    configPath: wranglerConfig,
+    cwd
+  });
+  if (put.code !== 0) {
+    throw new Error(
+      "Wrangler could not replace ODLA_BOT_TOKENS; the new scoped key was not activated"
+    );
+  }
+  const version = await waitForRotatedChatHealth({
+    fetch: doFetch,
+    platform,
+    priorVersion,
+    wait: deps.pollWait
+  });
+  const result = {
+    schemaVersion: "odla.platform-chat-credential-rotation/v1",
+    appId: minted.appId,
+    appIncarnation: minted.appIncarnation,
+    principalId: minted.principalId,
+    health: { ok: true, service: "odla-chat-agent", version }
+  };
+  if (parsed.options.json === true) {
+    out.log(JSON.stringify(result, null, 2));
+  } else {
+    out.log(
+      `rotated	${result.appId}	${result.principalId}	${result.health.version}`
+    );
+  }
+}
+async function waitForRotatedChatHealth(opts) {
+  const wait2 = opts.wait ?? ((milliseconds) => new Promise((resolve12) => setTimeout(resolve12, milliseconds)));
+  let lastStatus = 0;
+  let lastVersion = null;
+  let lastError = "private_service_unready";
+  for (let attempt = 0; attempt < 60; attempt++) {
+    const response2 = await opts.fetch(
+      `${opts.platform}/health/services/chat`
+    );
+    const body = await response2.json().catch(() => null);
+    const version = response2.headers.get("x-odla-worker-version-id");
+    if (response2.ok && record7(body) && body.ok === true && body.service === "odla-chat-agent" && version && version !== opts.priorVersion) {
+      return version;
+    }
+    lastStatus = response2.status;
+    lastVersion = version;
+    lastError = record7(body) && typeof body.error === "string" ? body.error : "private_service_unready";
+    if (attempt < 59) await wait2(5e3);
+  }
+  throw new Error(
+    `chat health did not converge on the rotated Worker deployment (HTTP ${lastStatus}, version ${lastVersion ?? "unknown"}, ${lastError})`
+  );
+}
+function isPlatformChatCredential(value2) {
+  return record7(value2) && value2.schemaVersion === "odla.platform-chat-credential/v1" && value2.appId === "odla-pm" && typeof value2.appIncarnation === "string" && value2.appIncarnation.length > 0 && value2.principalId === "agent_odla" && typeof value2.key === "string" && value2.key.startsWith("odla_sk_");
+}
+function apiMessage(value2) {
+  if (!record7(value2)) return "request failed";
+  const error = record7(value2.error) ? value2.error : value2;
+  return typeof error.message === "string" ? error.message : typeof error.code === "string" ? error.code : "request failed";
+}
+function record7(value2) {
+  return !!value2 && typeof value2 === "object" && !Array.isArray(value2);
+}
+
 // src/platform-command.ts
 async function platformCommand(parsed, deps = {}) {
+  const action2 = parsed.positionals[1];
+  if (action2 === "status") {
+    return platformStatus(parsed, deps);
+  }
+  if (action2 === "chat-credentials" && parsed.positionals[2] === "rotate") {
+    return rotatePlatformChatCredential(parsed, deps);
+  }
+  throw new Error(
+    `unknown platform action "${[
+      action2,
+      parsed.positionals[2]
+    ].filter(Boolean).join(" ")}". Try "odla-ai platform status --json".`
+  );
+}
+async function platformStatus(parsed, deps) {
   assertArgs(
     parsed,
     ["config", "context", "platform", "token", "email", "open", "json"],
     2
   );
-  const action2 = parsed.positionals[1];
-  if (action2 !== "status") {
-    throw new Error(
-      `unknown platform action "${action2 ?? ""}". Try "odla-ai platform status --json".`
-    );
-  }
   const context = await resolveOperatorContext(parsed, {
     allowMissingConfig: true
   });
@@ -9696,7 +9932,7 @@ async function platformCommand(parsed, deps = {}) {
   const body = await response2.json().catch(() => null);
   if (!response2.ok) {
     throw new Error(
-      `read platform status failed (HTTP ${response2.status}): ${apiMessage(body)}`
+      `read platform status failed (HTTP ${response2.status}): ${apiMessage2(body)}`
     );
   }
   if (!isPlatformStatus(body)) {
@@ -9709,17 +9945,17 @@ async function platformCommand(parsed, deps = {}) {
   }
 }
 function isPlatformStatus(value2) {
-  if (!record7(value2) || value2.schemaVersion !== "odla.platform-status/v1") return false;
-  if (!record7(value2.verdict) || !Array.isArray(value2.verdict.reasons)) return false;
-  if (!record7(value2.catalog) || !record7(value2.summary)) return false;
+  if (!record8(value2) || value2.schemaVersion !== "odla.platform-status/v1") return false;
+  if (!record8(value2.verdict) || !Array.isArray(value2.verdict.reasons)) return false;
+  if (!record8(value2.catalog) || !record8(value2.summary)) return false;
   return Array.isArray(value2.services) && Array.isArray(value2.nextActions);
 }
-function apiMessage(value2) {
-  if (!record7(value2)) return "request failed";
-  const error = record7(value2.error) ? value2.error : value2;
+function apiMessage2(value2) {
+  if (!record8(value2)) return "request failed";
+  const error = record8(value2.error) ? value2.error : value2;
   return typeof error.message === "string" ? error.message : typeof error.code === "string" ? error.code : "request failed";
 }
-function record7(value2) {
+function record8(value2) {
   return !!value2 && typeof value2 === "object" && !Array.isArray(value2);
 }
 
@@ -9760,7 +9996,7 @@ function statusVerdict(reads) {
       severity: "degraded"
     });
   }
-  const performance = record8(reads.liveSync.body.performance) ? reads.liveSync.body.performance : null;
+  const performance = record9(reads.liveSync.body.performance) ? reads.liveSync.body.performance : null;
   if (performance?.status === "unavailable") {
     reasons.push({
       source: "liveSync",
@@ -9841,7 +10077,7 @@ function statusVerdict(reads) {
     reasons
   };
 }
-function record8(value2) {
+function record9(value2) {
   return Boolean(value2) && typeof value2 === "object" && !Array.isArray(value2);
 }
 function numeric2(value2) {
@@ -9869,7 +10105,7 @@ function printO11yStatus(status, out) {
   out.log(
     `o11y status ${status.scope.appId}/${status.scope.env} (${status.scope.minutes}m)`
   );
-  const routes = Array.isArray(status.application.body.routes) ? status.application.body.routes.filter(record9) : [];
+  const routes = Array.isArray(status.application.body.routes) ? status.application.body.routes.filter(record10) : [];
   const requests = routes.reduce(
     (total, row) => total + numeric3(row.requests),
     0
@@ -9881,39 +10117,39 @@ function printO11yStatus(status, out) {
   out.log(
     `application	${status.application.httpStatus}	${requests} requests	${errors} errors`
   );
-  const versions = Array.isArray(status.applicationVersions.body.rows) ? status.applicationVersions.body.rows.filter(record9) : [];
+  const versions = Array.isArray(status.applicationVersions.body.rows) ? status.applicationVersions.body.rows.filter(record10) : [];
   out.log(
     `application-versions	${status.applicationVersions.httpStatus}	${versions.length ? versions.slice(0, 5).map(
       (row) => `${String(row.value || "(unattributed)")}:${numeric3(row.requests)}`
     ).join(", ") : "none observed"}`
   );
   out.log(liveSyncLine(status.liveSync));
-  const canaryDurations = record9(status.canary.body.durationsMs) ? status.canary.body.durationsMs : {};
+  const canaryDurations = record10(status.canary.body.durationsMs) ? status.canary.body.durationsMs : {};
   out.log(
     `canary	${status.canary.httpStatus}	${String(status.canary.body.status ?? status.canary.body.error ?? "unavailable")}	${optionalNumeric(canaryDurations.publishToVisibleMs)} publish-to-visible`
   );
-  const collectorIngest = record9(status.collector.body.ingest) ? status.collector.body.ingest : {};
-  const collectorStorage = record9(collectorIngest.storage) ? collectorIngest.storage : {};
+  const collectorIngest = record10(status.collector.body.ingest) ? status.collector.body.ingest : {};
+  const collectorStorage = record10(collectorIngest.storage) ? collectorIngest.storage : {};
   out.log(
     `collector	${status.collector.httpStatus}	${String(status.collector.body.status ?? status.collector.body.error ?? "unavailable")}	${numeric3(collectorStorage.affectedPoints)} affected points`
   );
-  const providerMetrics = record9(status.provider.body.metrics) ? status.provider.body.metrics : {};
-  const providerCapacity = record9(status.provider.body.capacity) ? status.provider.body.capacity : {};
-  const workerMemory = record9(providerCapacity.memory) ? providerCapacity.memory : {};
+  const providerMetrics = record10(status.provider.body.metrics) ? status.provider.body.metrics : {};
+  const providerCapacity = record10(status.provider.body.capacity) ? status.provider.body.capacity : {};
+  const workerMemory = record10(providerCapacity.memory) ? providerCapacity.memory : {};
   out.log(
     `cloudflare	${status.provider.httpStatus}	${String(status.provider.body.status ?? status.provider.body.error ?? "unavailable")}	${numeric3(providerMetrics.requests)} invocations	${numeric3(providerMetrics.errors)} runtime errors	${optionalBytes(workerMemory.headroomBytes)} isolate memory headroom`
   );
   for (const line of providerCapacityLines(status.providerCapacity)) {
     out.log(line);
   }
-  const coverage = record9(status.providerReconciliation.body.comparison) ? status.providerReconciliation.body.comparison : {};
-  const coverageCounts = record9(status.providerReconciliation.body.counts) ? status.providerReconciliation.body.counts : {};
-  const coverageBudget = record9(status.providerReconciliation.body.budget) ? status.providerReconciliation.body.budget : {};
+  const coverage = record10(status.providerReconciliation.body.comparison) ? status.providerReconciliation.body.comparison : {};
+  const coverageCounts = record10(status.providerReconciliation.body.counts) ? status.providerReconciliation.body.counts : {};
+  const coverageBudget = record10(status.providerReconciliation.body.budget) ? status.providerReconciliation.body.budget : {};
   out.log(
     `request-coverage	${status.providerReconciliation.httpStatus}	${String(status.providerReconciliation.body.status ?? status.providerReconciliation.body.error ?? "unavailable")}	${optionalPercent(coverage.applicationCoverage)} application/provider	${numeric3(coverageCounts.applicationRequests)}/${numeric3(coverageCounts.providerRequests)} requests	\xB1${optionalPercent(coverageBudget.maxRelativeError)} budget`
   );
   const providerPoints = Array.isArray(status.providerHistory.body.points) ? status.providerHistory.body.points.length : 0;
-  const providerFreshness = record9(status.providerHistory.body.freshness) ? status.providerHistory.body.freshness : {};
+  const providerFreshness = record10(status.providerHistory.body.freshness) ? status.providerHistory.body.freshness : {};
   out.log(
     `cloudflare-history	${status.providerHistory.httpStatus}	${String(status.providerHistory.body.status ?? status.providerHistory.body.error ?? "unavailable")}	${providerPoints} snapshots	${optionalAge(providerFreshness.ageMs)} old`
   );
@@ -9922,17 +10158,17 @@ function printO11yStatus(status, out) {
   );
 }
 function providerCapacityLines(read3) {
-  const resources = record9(read3.body.resources) ? read3.body.resources : {};
-  const durableObjects = record9(resources.durableObjects) ? resources.durableObjects : {};
-  const periodic = record9(durableObjects.periodic) ? durableObjects.periodic : {};
-  const storage = record9(durableObjects.sqliteStorage) ? durableObjects.sqliteStorage : {};
-  const d1 = record9(resources.d1) ? resources.d1 : {};
-  const d1Activity = record9(d1.activity) ? d1.activity : {};
-  const d1Storage = record9(d1.storage) ? d1.storage : {};
-  const d1Latency = record9(d1Activity.latency) ? d1Activity.latency : {};
-  const r2 = record9(resources.r2) ? resources.r2 : {};
-  const r2Operations = record9(r2.operations) ? r2.operations : {};
-  const r2Storage = record9(r2.storage) ? r2.storage : {};
+  const resources = record10(read3.body.resources) ? read3.body.resources : {};
+  const durableObjects = record10(resources.durableObjects) ? resources.durableObjects : {};
+  const periodic = record10(durableObjects.periodic) ? durableObjects.periodic : {};
+  const storage = record10(durableObjects.sqliteStorage) ? durableObjects.sqliteStorage : {};
+  const d1 = record10(resources.d1) ? resources.d1 : {};
+  const d1Activity = record10(d1.activity) ? d1.activity : {};
+  const d1Storage = record10(d1.storage) ? d1.storage : {};
+  const d1Latency = record10(d1Activity.latency) ? d1Activity.latency : {};
+  const r2 = record10(resources.r2) ? resources.r2 : {};
+  const r2Operations = record10(r2.operations) ? r2.operations : {};
+  const r2Storage = record10(r2.storage) ? r2.storage : {};
   const status = String(
     read3.body.status ?? read3.body.error ?? "unavailable"
   );
@@ -9943,11 +10179,11 @@ function providerCapacityLines(read3) {
   ];
 }
 function liveSyncLine(read3) {
-  const performance = record9(read3.body.performance) ? read3.body.performance : {};
-  const commitToSend = record9(performance.commitToSend) ? performance.commitToSend : {};
+  const performance = record10(read3.body.performance) ? read3.body.performance : {};
+  const commitToSend = record10(performance.commitToSend) ? performance.commitToSend : {};
   return `live-sync	${read3.httpStatus}	${String(read3.body.status ?? read3.body.error ?? "unavailable")}	${numeric3(read3.body.activeConnections)} active	${optionalNumeric(commitToSend.p95)} commit-to-send p95	${numeric3(performance.sendFailures)} send failures`;
 }
-function record9(value2) {
+function record10(value2) {
   return Boolean(value2) && typeof value2 === "object" && !Array.isArray(value2);
 }
 function numeric3(value2) {
@@ -10116,14 +10352,14 @@ function statusMinutes(value2) {
 }
 async function read2(url, headers, doFetch) {
   const response2 = await doFetch(url, { headers });
-  const text = await response2.text();
+  const text2 = await response2.text();
   let body = {};
-  if (text) {
+  if (text2) {
     try {
-      const value2 = JSON.parse(text);
+      const value2 = JSON.parse(text2);
       body = value2 && typeof value2 === "object" && !Array.isArray(value2) ? value2 : { value: value2 };
     } catch {
-      body = { message: text.slice(0, 300) };
+      body = { message: text2.slice(0, 300) };
     }
   }
   return { httpStatus: response2.status, body };
@@ -10132,7 +10368,7 @@ async function read2(url, headers, doFetch) {
 // src/provision.ts
 var import_apps12 = require("@odla-ai/apps");
 var import_ai3 = require("@odla-ai/ai");
-var import_node_process10 = __toESM(require("process"), 1);
+var import_node_process11 = __toESM(require("process"), 1);
 
 // src/integration-provision.ts
 var import_db3 = require("@odla-ai/db");
@@ -10439,7 +10675,7 @@ ${env}: credentials are already saved; retry "odla-ai secrets push --env ${env}$
       await provisionIntegrationSeeds(doFetch, cfg.dbEndpoint, tenantId, dbKey, database.integrations, env, out);
     }
     if (cfg.services.includes("ai") && cfg.ai?.provider && cfg.ai.keyEnv) {
-      const key = import_node_process10.default.env[cfg.ai.keyEnv];
+      const key = import_node_process11.default.env[cfg.ai.keyEnv];
       if (key) {
         const secretName = cfg.ai.secretName ?? defaultSecretName(cfg.ai.provider);
         await (0, import_ai3.putSecret)({ endpoint: cfg.dbEndpoint, token, fetch: doFetch }, tenantId, secretName, key);
@@ -10481,7 +10717,7 @@ ${env}: credentials are already saved; retry "odla-ai secrets push --env ${env}$
 
 // src/record.ts
 var import_node_fs16 = require("fs");
-var import_node_process11 = __toESM(require("process"), 1);
+var import_node_process12 = __toESM(require("process"), 1);
 
 // src/surface.ts
 var PM_ACTIONS = {
@@ -10548,7 +10784,10 @@ var COMMAND_SURFACE = {
   init: {},
   o11y: { status: {} },
   operations: { get: {}, wait: {} },
-  platform: { status: {} },
+  platform: {
+    status: {},
+    "chat-credentials": { rotate: {} }
+  },
   pm: {
     ...PM_ENTITIES,
     handoff: {}
@@ -10636,7 +10875,7 @@ function surfacePaths(node = COMMAND_SURFACE, prefix = []) {
 
 // src/record.ts
 function recordInvocation(parsed) {
-  const file = import_node_process11.default.env.ODLA_CLI_RECORD;
+  const file = import_node_process12.default.env.ODLA_CLI_RECORD;
   if (!file) return;
   try {
     const entry = {
@@ -10766,12 +11005,17 @@ async function runbookNew(ctx, slug, title, body, summary, requires) {
   });
   ctx.out.log(ctx.json ? JSON.stringify(created, null, 2) : `created ${slug} (${created.id})`);
 }
-async function runbookEdit(ctx, slug, body, note, requires) {
+async function runbookEdit(ctx, slug, body, note, requires, expectedVersion) {
   const runbook = await bySlug(ctx, slug);
   const result = await call(ctx, "PATCH", `/runbook/${encodeURIComponent(runbook.id)}`, {
     // An empty --requires clears the declaration; omitting the flag leaves
     // whatever is there, so an ordinary body edit never drops it.
-    patch: { body, ...note ? { note } : {}, ...requires === void 0 ? {} : { requires: requires || null } }
+    patch: {
+      body,
+      expectedVersion: expectedVersion ?? runbook.version,
+      ...note ? { note } : {},
+      ...requires === void 0 ? {} : { requires: requires || null }
+    }
   });
   if (ctx.json) return ctx.out.log(JSON.stringify(result, null, 2));
   ctx.out.log(`${slug} \u2192 v${result.record?.version ?? runbook.version + 1}`);
@@ -10825,12 +11069,12 @@ async function runbookRemove(ctx, slug) {
 // src/runbook-import.ts
 var import_node_fs18 = require("fs");
 var import_node_path15 = require("path");
-function parseRunbook(text, slug) {
-  let rest = text;
+function parseRunbook(text2, slug) {
+  let rest = text2;
   const meta = {};
-  const fm = /^---\r?\n([\s\S]*?)\r?\n---\r?\n?/.exec(text);
+  const fm = /^---\r?\n([\s\S]*?)\r?\n---\r?\n?/.exec(text2);
   if (fm) {
-    rest = text.slice(fm[0].length);
+    rest = text2.slice(fm[0].length);
     for (const line of fm[1].split(/\r?\n/)) {
       const pair = /^(\w+)\s*:\s*(.+)$/.exec(line.trim());
       if (!pair) continue;
@@ -10911,6 +11155,7 @@ async function upsert(ctx, r, visibility) {
       patch: {
         title: r.title,
         body: r.body,
+        expectedVersion: found.version,
         ...r.summary ? { summary: r.summary } : {},
         ...r.tags ? { tags: r.tags } : {},
         note: `imported from ${r.file}`
@@ -11302,9 +11547,9 @@ var import_node_child_process8 = require("child_process");
 var import_node_fs20 = require("fs");
 var import_node_os5 = require("os");
 var import_node_path17 = require("path");
-var import_node_process12 = __toESM(require("process"), 1);
+var import_node_process13 = __toESM(require("process"), 1);
 var EDITOR_ENV = ["ODLA_EDITOR", "VISUAL", "EDITOR"];
-function resolveEditor(env = import_node_process12.default.env) {
+function resolveEditor(env = import_node_process13.default.env) {
   for (const name of EDITOR_ENV) {
     const value2 = env[name];
     if (value2 && value2.trim()) return value2.trim();
@@ -11318,8 +11563,8 @@ function defaultRun(command, path) {
   return result.status ?? 0;
 }
 function editText(initial, slug, deps = {}) {
-  const env = deps.env ?? import_node_process12.default.env;
-  const interactive = deps.interactive ?? (() => Boolean(import_node_process12.default.stdin.isTTY));
+  const env = deps.env ?? import_node_process13.default.env;
+  const interactive = deps.interactive ?? (() => Boolean(import_node_process13.default.stdin.isTTY));
   const editor = resolveEditor(env);
   if (!editor)
     throw new Error(
@@ -11351,27 +11596,90 @@ async function editRunbook(ctx, slug, deps = {}) {
   const found = page.records[0];
   if (!found) throw new Error(`no runbook "${slug}" in ${ctx.appId}`);
   ctx.out.log(`opening ${slug} v${found.version} in your editor\u2026`);
-  return editText(found.body, slug, deps);
+  const body = await editText(found.body, slug, deps);
+  return body === null ? null : { body, expectedVersion: found.version };
 }
 
 // src/whoami-command.ts
+var text = (value2) => typeof value2 === "string" && value2.trim() ? value2.trim() : null;
+function principalKind(value2, machine) {
+  return value2 === "human" || value2 === "agent" || value2 === "service" ? value2 : machine ? "service" : "human";
+}
+function credentialKind(value2, machine, scopes) {
+  if (value2 === "machine" || value2 === "device" || value2 === "clerk") return value2;
+  if (machine) return "machine";
+  if (scopes.length) return "device";
+  return "unknown";
+}
+function managerOf(value2) {
+  if (!value2 || typeof value2 !== "object") return null;
+  const row = value2;
+  const principalId = text(row.principalId);
+  if (!principalId) return null;
+  return {
+    principalId,
+    displayName: text(row.displayName) ?? "Unnamed member",
+    handle: text(row.handle) ?? ""
+  };
+}
+function unnamedPrincipal(kind) {
+  if (kind === "agent") return "Unnamed agent";
+  if (kind === "service") return "Unnamed service";
+  return "Unnamed member";
+}
 async function fetchIdentity(platformUrl, token, doFetch) {
   const res = await doFetch(`${platformUrl.replace(/\/$/, "")}/registry/me`, {
     headers: { authorization: `Bearer ${token}` }
   });
   if (!res.ok) throw new Error(`could not resolve identity (HTTP ${res.status})`);
   const body = await res.json();
+  const developerId = text(body.developerId) ?? "";
+  const machine = body.machine === true;
+  const scopes = Array.isArray(body.scopes) ? body.scopes.map(String) : [];
+  const principalId = text(body.principalId) ?? developerId;
+  const email = text(body.email);
+  const kind = principalKind(body.principalKind, machine);
+  const displayName = text(body.displayName) ?? email ?? unnamedPrincipal(kind);
+  const handle = text(body.handle) ?? "";
+  const credential2 = body.credential && typeof body.credential === "object" ? body.credential : {};
   return {
-    developerId: String(body.developerId ?? ""),
-    email: body.email ?? null,
+    developerId,
+    principalId,
+    principalKind: kind,
+    displayName,
+    handle,
+    manager: managerOf(body.manager),
+    credential: {
+      id: text(credential2.id),
+      kind: credentialKind(credential2.kind, machine, scopes)
+    },
+    email,
     admin: body.admin === true,
-    machine: body.machine === true,
-    scopes: Array.isArray(body.scopes) ? body.scopes.map(String) : []
+    machine,
+    scopes
   };
 }
-function credentialKind(identity) {
-  if (identity.machine) return "machine (platform admin secret)";
-  return identity.scopes.length ? "device token (scoped)" : "device token or session";
+function credentialLabel(identity) {
+  if (identity.credential.kind === "machine") return "machine (platform admin secret)";
+  if (identity.credential.kind === "device")
+    return identity.scopes.length ? "device (scoped)" : "device";
+  if (identity.credential.kind === "clerk") return "clerk";
+  return "unknown (legacy server)";
+}
+function namedPrincipal(identity) {
+  return identity.handle && identity.handle !== identity.displayName ? `${identity.displayName} (@${identity.handle})` : identity.displayName;
+}
+function namedManager(manager) {
+  return manager.handle && manager.handle !== manager.displayName ? `${manager.displayName} (@${manager.handle})` : manager.displayName;
+}
+function accountableOwner(identity) {
+  if (identity.principalKind === "agent" && identity.manager) {
+    return namedManager(identity.manager);
+  }
+  if (identity.principalKind === "human" && identity.principalId === identity.developerId) {
+    return namedPrincipal(identity);
+  }
+  return identity.email ?? "Unnamed member";
 }
 async function whoamiCommand(parsed, deps = {}) {
   assertArgs(
@@ -11402,9 +11710,19 @@ async function whoamiCommand(parsed, deps = {}) {
     return;
   }
   out.log(`platform:   ${cfg.platformUrl}`);
-  out.log(`developer:  ${identity.developerId}`);
+  out.log(`principal:  ${namedPrincipal(identity)}`);
+  out.log(`principal id: ${identity.principalId}`);
+  out.log(`kind:       ${identity.principalKind}`);
+  if (identity.principalKind === "agent")
+    out.log(
+      `manager:    ${identity.manager ? namedManager(identity.manager) : "(unknown)"}`
+    );
+  out.log(`owner:      ${accountableOwner(identity)}`);
+  out.log(`owner id:   ${identity.developerId}`);
   out.log(`email:      ${identity.email ?? "(none)"}`);
-  out.log(`credential: ${credentialKind(identity)}`);
+  out.log(`credential: ${credentialLabel(identity)}`);
+  if (identity.credential.id)
+    out.log(`credential id: ${identity.credential.id}`);
   out.log(`admin:      ${identity.admin ? "yes" : "no"}`);
   if (identity.scopes.length) out.log(`scopes:     ${identity.scopes.join(", ")}`);
   if (!identity.admin) {
@@ -11553,14 +11871,16 @@ async function runbookCommand(parsed, deps = {}) {
       const name = requireSlug(slug, "edit");
       const file = stringOpt(parsed.options.file);
       const inline = stringOpt(parsed.options.body);
-      const body = file === void 0 && inline === void 0 ? await editRunbook(ctx, name) : readBody(file, inline);
-      if (body === null) return ctx.out.log(`${name} unchanged; nothing written`);
+      const edited = file === void 0 && inline === void 0 ? await editRunbook(ctx, name) : readBody(file, inline);
+      if (edited === null) return ctx.out.log(`${name} unchanged; nothing written`);
+      const body = typeof edited === "string" ? edited : edited.body;
       return runbookEdit(
         ctx,
         name,
         body,
         stringOpt(parsed.options.note),
-        parsed.options.requires === void 0 ? void 0 : stringOpt(parsed.options.requires) ?? ""
+        parsed.options.requires === void 0 ? void 0 : stringOpt(parsed.options.requires) ?? "",
+        typeof edited === "string" ? void 0 : edited.expectedVersion
       );
     }
     case "import": {