@odla-ai/cli 0.25.23 → 0.26.2

package/dist/bin.cjs

@@ -182,10 +182,10 @@ function isManagedDevVar(line) {
   const match = line.match(/^\s*(?:export\s+)?([A-Z][A-Z0-9_]*)\s*=/);
   return !!match?.[1] && MANAGED_DEV_VARS.has(match[1]);
 }
-function writePrivateText(path, text) {
+function writePrivateText(path, text2) {
   (0, import_node_fs.mkdirSync)((0, import_node_path.dirname)(path), { recursive: true });
   const temporary = `${path}.tmp-${process.pid}-${Date.now()}`;
-  (0, import_node_fs.writeFileSync)(temporary, text, { mode: 384 });
+  (0, import_node_fs.writeFileSync)(temporary, text2, { mode: 384 });
   (0, import_node_fs.chmodSync)(temporary, 384);
   (0, import_node_fs.renameSync)(temporary, path);
 }
@@ -551,6 +551,14 @@ async function scopedToken(platform, scope, options, doFetch, out) {
   return token;
 }
 
+// src/principal-presentation.ts
+function unresolvedPrincipalLabel(credentialKind2, principalId) {
+  const kind = typeof credentialKind2 === "string" ? credentialKind2.trim() : "";
+  const id = typeof principalId === "string" ? principalId.trim() : "";
+  const audit = kind && id ? `${kind}:${id}` : kind || id;
+  return `Unknown principal${audit ? ` [${audit}]` : ""}`;
+}
+
 // src/admin-ai-audit.ts
 function adminAiAuditQuery(filters) {
   if (filters.limit === void 0) return "";
@@ -580,17 +588,17 @@ async function readAdminAiAudit(request2) {
       String(event.changeKind ?? ""),
       String(event.purpose ?? event.provider ?? ""),
       route2,
-      `${String(event.actorType ?? "")}:${String(event.actorId ?? "")}`
+      unresolvedPrincipalLabel(event.actorType, event.actorId)
     ].join("	"));
   }
 }
 async function responseBody(response2) {
-  const text = await response2.text();
-  if (!text) return {};
+  const text2 = await response2.text();
+  if (!text2) return {};
   try {
-    return JSON.parse(text);
+    return JSON.parse(text2);
   } catch {
-    return { message: text.slice(0, 300) };
+    return { message: text2.slice(0, 300) };
   }
 }
 function apiError(status, body) {
@@ -671,7 +679,7 @@ when	app/env	run	actor	purpose/role	route / policy	tokens	cost	status`);
       timestamp2(event.created_at),
       `${String(event.app_id ?? "")}/${String(event.env ?? "")}`,
       String(event.run_id ?? ""),
-      `${String(event.actor_type ?? "")}:${String(event.actor_id ?? "")}`,
+      unresolvedPrincipalLabel(event.actor_type, event.actor_id),
       `${String(event.purpose ?? "")}/${String(event.role ?? "")}`,
       `${String(event.provider ?? "")}/${String(event.model ?? "")}@v${String(event.policy_version ?? "unknown")}`,
       String(input + output),
@@ -692,12 +700,12 @@ function timestamp2(value2) {
   return Number.isFinite(date.valueOf()) ? date.toISOString() : "";
 }
 async function responseBody2(res) {
-  const text = await res.text();
-  if (!text) return {};
+  const text2 = await res.text();
+  if (!text2) return {};
   try {
-    return JSON.parse(text);
+    return JSON.parse(text2);
   } catch {
-    return { message: text.slice(0, 300) };
+    return { message: text2.slice(0, 300) };
   }
 }
 function apiError2(action2, status, body) {
@@ -873,12 +881,12 @@ function catalogModels(body) {
   return body.catalog.models.filter((value2) => isRecord3(value2) && typeof value2.id === "string" && typeof value2.provider === "string");
 }
 async function responseBody3(res) {
-  const text = await res.text();
-  if (!text) return {};
+  const text2 = await res.text();
+  if (!text2) return {};
   try {
-    return JSON.parse(text);
+    return JSON.parse(text2);
   } catch {
-    return { message: text.slice(0, 300) };
+    return { message: text2.slice(0, 300) };
   }
 }
 function apiError3(action2, status, body) {
@@ -1722,8 +1730,8 @@ async function appImport(options) {
   const say = options.json ? (line) => out.error(line) : (line) => out.log(line);
   const doFetch = options.fetch ?? fetch;
   const { tenant } = resolveTenant(cfg, options.env);
-  const text = options.file === "-" ? (options.readStdin ?? (() => (0, import_node_fs8.readFileSync)(0, "utf8")))() : (0, import_node_fs8.readFileSync)(options.file, "utf8");
-  const { format, sources } = (0, import_import.parseImport)(text, options.ns);
+  const text2 = options.file === "-" ? (options.readStdin ?? (() => (0, import_node_fs8.readFileSync)(0, "utf8")))() : (0, import_node_fs8.readFileSync)(options.file, "utf8");
+  const { format, sources } = (0, import_import.parseImport)(text2, options.ns);
   if (format === "namespace-map" && options.ns) {
     throw new Error("--ns cannot be combined with a {namespace: rows} file \u2014 the file already names each namespace");
   }
@@ -1814,7 +1822,10 @@ function report(options, owners, headline) {
   if (headline) out.log(headline);
   out.log(`owners (${owners.length}):`);
   for (const o of owners) {
-    out.log(`  ${o.primary ? "\u2605" : "\xB7"} ${o.email ?? o.ownerId}${o.primary ? " (primary)" : ""}`);
+    const name = o.email?.trim() || "Unnamed member";
+    out.log(
+      `  ${o.primary ? "\u2605" : "\xB7"} ${name} [${o.ownerId}]${o.primary ? " (primary)" : ""}`
+    );
   }
 }
 async function ownersList(options) {
@@ -3559,22 +3570,26 @@ function planNextActions(reconciliation, configPath) {
     }
   }
   if (reconciliation.actions.some((action2) => action2.applySupport === "studio")) {
-    const { appId, platformUrl } = reconciliation.scope;
     next.push({
       code: "review_destructive",
-      command: `${platformUrl}/studio/apps/${encodeURIComponent(appId)}/settings`,
+      command: studioSettingsUrl(reconciliation),
       description: "Review service disablement in the owning Studio scope; this plan will not apply it."
     });
   }
   if (!reconciliation.actions.length && reconciliation.summary.unmanaged) {
     next.push({
       code: "declare_or_accept_runtime_state",
-      command: `${reconciliation.scope.platformUrl}/studio/apps/${encodeURIComponent(reconciliation.scope.appId)}/settings`,
+      command: studioSettingsUrl(reconciliation),
       description: "Declare the live value in project config or keep it as an explicit runtime-managed setting."
     });
   }
   return next;
 }
+function studioSettingsUrl(reconciliation) {
+  const environment2 = reconciliation.actions.map((action2) => action2.env).concat(reconciliation.scope.environments).find((candidate) => candidate === "dev" || candidate === "prod") ?? "dev";
+  const origin = reconciliation.scope.platformUrl.replace(/\/$/, "");
+  return `${origin}${(0, import_apps8.studioAppSettingsPath)(reconciliation.scope.appId, environment2, "environment")}`;
+}
 function quoteArg2(value2) {
   return `'${value2.replace(/'/g, `'\\''`)}'`;
 }
@@ -3614,15 +3629,15 @@ function readWranglerConfig(path) {
     return null;
   }
 }
-function stripJsonComments(text) {
+function stripJsonComments(text2) {
   let result = "";
   let inString = false;
-  for (let i = 0; i < text.length; i++) {
-    const ch = text[i];
+  for (let i = 0; i < text2.length; i++) {
+    const ch = text2[i];
     if (inString) {
       result += ch;
       if (ch === "\\") {
-        result += text[i + 1] ?? "";
+        result += text2[i + 1] ?? "";
         i++;
       } else if (ch === '"') {
         inString = false;
@@ -3634,14 +3649,14 @@ function stripJsonComments(text) {
       result += ch;
       continue;
     }
-    if (ch === "/" && text[i + 1] === "/") {
-      while (i < text.length && text[i] !== "\n") i++;
+    if (ch === "/" && text2[i + 1] === "/") {
+      while (i < text2.length && text2[i] !== "\n") i++;
       result += "\n";
       continue;
     }
-    if (ch === "/" && text[i + 1] === "*") {
+    if (ch === "/" && text2[i + 1] === "*") {
       i += 2;
-      while (i < text.length && !(text[i] === "*" && text[i + 1] === "/")) i++;
+      while (i < text2.length && !(text2[i] === "*" && text2[i + 1] === "/")) i++;
       i++;
       continue;
     }
@@ -3658,7 +3673,14 @@ async function wranglerLoggedIn(run, cwd) {
   }
 }
 function wranglerPutSecret(run, opts) {
-  const args = ["wrangler", "secret", "put", opts.name, ...opts.env ? ["--env", opts.env] : []];
+  const args = [
+    "wrangler",
+    "secret",
+    "put",
+    opts.name,
+    ...opts.env ? ["--env", opts.env] : [],
+    ...opts.configPath ? ["--config", opts.configPath] : []
+  ];
   return run("npx", args, { input: opts.value, cwd: opts.cwd });
 }
 
@@ -4036,9 +4058,9 @@ function initProject(options) {
   out.log("created src/odla/schema.mjs and src/odla/rules.mjs");
   out.log("updated .gitignore for local odla credentials");
 }
-function writeIfMissing(path, text) {
+function writeIfMissing(path, text2) {
   if ((0, import_node_fs13.existsSync)(path)) return;
-  (0, import_node_fs13.writeFileSync)(path, text);
+  (0, import_node_fs13.writeFileSync)(path, text2);
 }
 function configTemplate(input) {
   const calendar = input.services.includes("calendar") ? `  calendar: {
@@ -4246,13 +4268,13 @@ async function secretsSetClerkKey(options) {
     body: JSON.stringify({ value: value2 })
   });
   if (!res.ok) {
-    const text = scrubValue((await res.text().catch(() => "")).slice(0, 300), value2);
-    throw new Error(`store Clerk secret key failed (${res.status}): ${text || "request failed"}`);
+    const text2 = scrubValue((await res.text().catch(() => "")).slice(0, 300), value2);
+    throw new Error(`store Clerk secret key failed (${res.status}): ${text2 || "request failed"}`);
   }
   out.log(`Clerk secret key stored for ${tenantId} ($clerk_secret, reserved + write-only; the value was never echoed)`);
 }
-function scrubValue(text, value2) {
-  return redactSecrets(text).split(value2).join("[value redacted]");
+function scrubValue(text2, value2) {
+  return redactSecrets(text2).split(value2).join("[value redacted]");
 }
 async function resolveVaultWrite(options) {
   const out = options.stdout ?? console;
@@ -5080,8 +5102,8 @@ async function runContainerAttempt(options) {
   let stopped = false;
   let exited = false;
   child.stderr.setEncoding("utf8");
-  child.stderr.on("data", (text) => {
-    if (stderr.length < 64 * 1024) stderr += text.slice(0, 64 * 1024 - stderr.length);
+  child.stderr.on("data", (text2) => {
+    if (stderr.length < 64 * 1024) stderr += text2.slice(0, 64 * 1024 - stderr.length);
   });
   const stop = (reason) => {
     if (stopped || exited) return;
@@ -5913,8 +5935,8 @@ function boundedInteger(value2, spec) {
 }
 function boundedNumber(value2, spec) {
   if (spec.kind !== "finite_number" || typeof value2 !== "number" || !Number.isFinite(value2) || value2 < spec.minimum || value2 > spec.maximum) throw new CamelError("conversion_rejected", "Finite-number conversion rejected the structured value.");
-  const text = String(value2);
-  if (/e/i.test(text) || (text.split(".")[1]?.length ?? 0) > spec.maximumDecimalPlaces) throw new CamelError("conversion_rejected", "Finite-number conversion rejected a non-canonical decimal.");
+  const text2 = String(value2);
+  if (/e/i.test(text2) || (text2.split(".")[1]?.length ?? 0) > spec.maximumDecimalPlaces) throw new CamelError("conversion_rejected", "Finite-number conversion rejected a non-canonical decimal.");
   return value2;
 }
 function enumMember(value2, spec) {
@@ -6070,8 +6092,8 @@ function validateUnsafeSelector(path, value2, tool) {
   return void 0;
 }
 function looksLikeDestination(value2) {
-  const text = value2.trim();
-  return /^(?:[a-z][a-z0-9+.-]*:\/\/|\/|\\\\)/i.test(text) || /^[\w.-]+\.[a-z]{2,}(?:[/:]|$)/i.test(text);
+  const text2 = value2.trim();
+  return /^(?:[a-z][a-z0-9+.-]*:\/\/|\/|\\\\)/i.test(text2) || /^[\w.-]+\.[a-z]{2,}(?:[/:]|$)/i.test(text2);
 }
 
 // ../harness/dist/chunk-GMVZ4LZH.js
@@ -6440,8 +6462,8 @@ function gitApply(cwd, patch2, check) {
     });
     let stderr = "";
     child.stderr.setEncoding("utf8");
-    child.stderr.on("data", (text) => {
-      if (stderr.length < 4e3) stderr += text.slice(0, 4e3);
+    child.stderr.on("data", (text2) => {
+      if (stderr.length < 4e3) stderr += text2.slice(0, 4e3);
     });
     child.once("error", reject);
     child.once("exit", (code) => code === 0 ? accept() : reject(new TypeError(`patch did not apply: ${stderr.trim().slice(0, 500)}`)));
@@ -7612,10 +7634,10 @@ var CodePiRuntimeEngine = class {
       task: lease.task,
       limits: this.options.limits,
       signal: active.abort.signal,
-      onStderr: (text) => this.#event(command, {
+      onStderr: (text2) => this.#event(command, {
         type: "message",
         actor: "system",
-        body: text.slice(0, 4e3)
+        body: text2.slice(0, 4e3)
       }, active.conversationRefs),
       onMessage: async (output) => {
         if (output.type === "inference.request") {
@@ -8497,7 +8519,8 @@ Usage:
   odla-ai doctor [--config odla.config.mjs]
   odla-ai config <diff|plan> [--config odla.config.mjs] [--email <odla-account>] [--json]
   odla-ai config apply --plan <plan.json> [--idempotency-key <key>] [--email <odla-account>] [--json]
-  odla-ai operations <get|wait> <operation-id> [--interval <seconds>] [--timeout <seconds>] [--json]
+  odla-ai operations get <operation-id> [--json]
+  odla-ai operations wait <operation-id> [--interval <seconds>] [--timeout <seconds>] [--json]
   odla-ai calendar status [--env dev] [--email <odla-account>] [--json]
   odla-ai calendar calendars [--env dev] [--email <odla-account>] [--json]
   odla-ai calendar connect [--env dev] [--email <odla-account>] [--no-open] [--yes]
@@ -8611,9 +8634,9 @@ Commands:
                does and what it guarantees is JSDoc, rendered per package at
                https://odla.ai/docs and shipped in the installed .d.ts. Answering
                a question usually needs both.
-  whoami       Report who this terminal is authenticated as, and whether it holds
-               platform admin. A handshake-minted device token is never admin,
-               however the human who approved it is configured.
+  whoami       Report the actual principal name, handle and kind, its manager,
+               credential kind, accountable owner, and platform-admin status.
+               A manager relationship never supplies authority by itself.
   context      Explain selected config, platform, app, environment, and
                developer-token provenance without printing credentials or
                starting a device handshake. Operator work can run outside a
@@ -8733,6 +8756,58 @@ Safety:
 `);
 }
 
+// src/discuss-principals.ts
+function mergeDiscussPrincipals(target, source) {
+  Object.assign(target.authors, source.authors ?? {});
+  Object.assign(target.principals, source.principals ?? {});
+}
+var withAt = (handle) => handle.startsWith("@") ? handle : `@${handle}`;
+function discussPrincipalLabel(principalId, authorKind, projection) {
+  const profile = projection.principals?.[principalId];
+  if (profile) {
+    const identity = `${profile.displayName} (${withAt(profile.handle)})`;
+    if (profile.kind === "agent") {
+      return profile.managerDisplayName ? `${identity} \u2014 agent managed by ${profile.managerDisplayName}` : `${identity} \u2014 agent`;
+    }
+    return profile.kind === "service" ? `${identity} \u2014 service` : identity;
+  }
+  const legacyName = projection.authors?.[principalId]?.trim();
+  if (legacyName) {
+    return authorKind === "bot" ? `${legacyName} \u2014 agent` : legacyName;
+  }
+  return authorKind === "bot" ? "Unnamed agent" : "Unnamed member";
+}
+
+// src/discuss-read-render.ts
+function discussBodyWithRefs(post) {
+  if (!post.refs || post.refs.length === 0) return post.body;
+  let out = "";
+  let cursor = 0;
+  for (const ref of [...post.refs].sort((a, b) => a.start - b.start)) {
+    if (ref.start < cursor || ref.end > post.body.length) continue;
+    out += post.body.slice(cursor, ref.start) + `@[${ref.label}](${ref.kind}/${ref.id})`;
+    cursor = ref.end;
+  }
+  return out + post.body.slice(cursor);
+}
+function renderDiscussRead(ctx, topic, posts, projection) {
+  const status = topic.resolved ? "resolved" : "open";
+  ctx.out.log(`${topic.subject}  [${status}]  ${topic.appId ?? ""}`);
+  for (const post of posts) {
+    const who = discussPrincipalLabel(
+      post.authorId,
+      post.authorKind,
+      projection
+    );
+    ctx.out.log(`
+\u2014 ${who}`);
+    ctx.out.log(discussBodyWithRefs(post));
+    for (const file of post.attachments ?? []) {
+      ctx.out.log(`  [attachment] ${file.name} (${file.size} bytes)`);
+    }
+  }
+}
+
 // src/discuss-actions.ts
 var writeMutationId = (parsed) => stringOpt(parsed.options["mutation-id"]) ?? crypto.randomUUID();
 async function request(ctx, method, path, body) {
@@ -8751,17 +8826,6 @@ function emit(ctx, value2, human) {
   else human();
 }
 var state = (topic) => topic.resolved ? "resolved" : "open";
-function bodyWithRefs(post) {
-  if (!post.refs || post.refs.length === 0) return post.body;
-  let out = "";
-  let cursor = 0;
-  for (const ref of [...post.refs].sort((a, b) => a.start - b.start)) {
-    if (ref.start < cursor || ref.end > post.body.length) continue;
-    out += post.body.slice(cursor, ref.start) + `@[${ref.label}](${ref.kind}/${ref.id})`;
-    cursor = ref.end;
-  }
-  return out + post.body.slice(cursor);
-}
 function content(parsed) {
   const markup = stringOpt(parsed.options.markup);
   if (markup) return { markup };
@@ -8816,11 +8880,19 @@ async function discussRead(ctx, id, parsed) {
       offset: requestedOffset ?? "0"
     });
     const page = await request(ctx, "GET", `/topics/${encodeURIComponent(id)}?${query}`);
-    emit(ctx, page, () => renderRead(ctx, page.topic, page.posts));
+    emit(
+      ctx,
+      page,
+      () => renderDiscussRead(ctx, page.topic, page.posts, page)
+    );
     return;
   }
   for (let scan = 0; scan < 3; scan++) {
     const posts = /* @__PURE__ */ new Map();
+    const projection = {
+      authors: {},
+      principals: {}
+    };
     let topic = null;
     let offset = 0;
     for (; ; ) {
@@ -8831,6 +8903,7 @@ async function discussRead(ctx, id, parsed) {
       );
       topic = page.topic;
       for (const post of page.posts) posts.set(post.id, post);
+      mergeDiscussPrincipals(projection, page);
       if (posts.size > 1e4) throw new Error("discuss read failed: conversation exceeds 10000 posts");
       if (!page.page?.hasMore) break;
       if (page.page.nextOffset === null || page.page.nextOffset <= offset) {
@@ -8843,24 +8916,18 @@ async function discussRead(ctx, id, parsed) {
     );
     const expected = Number.isInteger(topic.replyCount) ? topic.replyCount + 1 : ordered.length;
     if (ordered.length === expected) {
-      const result = { topic, posts: ordered };
-      emit(ctx, result, () => renderRead(ctx, result.topic, result.posts));
+      const result = { topic, posts: ordered, ...projection };
+      emit(
+        ctx,
+        result,
+        () => renderDiscussRead(ctx, result.topic, result.posts, result)
+      );
       return;
     }
     if (offset === 0) throw new Error("discuss read failed: registry did not provide forward post pages");
   }
   throw new Error("discuss read failed: conversation changed during every complete-read attempt");
 }
-function renderRead(ctx, topic, posts) {
-  ctx.out.log(`${topic.subject}  [${state(topic)}]  ${topic.appId ?? ""}`);
-  for (const post of posts) {
-    const who = post.authorKind === "bot" ? `${post.authorId} (agent)` : post.authorId;
-    ctx.out.log(`
-\u2014 ${who}`);
-    ctx.out.log(bodyWithRefs(post));
-    for (const file of post.attachments ?? []) ctx.out.log(`  [attachment] ${file.name} (${file.size} bytes)`);
-  }
-}
 async function discussPost(ctx, parsed) {
   const appId = stringOpt(parsed.options.app) ?? ctx.appId;
   if (!appId) throw new Error("discuss post needs --app <appId>");
@@ -9085,6 +9152,8 @@ async function discussWatch(ctx, topicId, parsed) {
         found: true,
         cursor,
         events: matching,
+        ...page.authors ? { authors: page.authors } : {},
+        ...page.principals ? { principals: page.principals } : {},
         ...posts && posts.length > 0 ? { posts } : {},
         ...topics && topics.length > 0 ? { topics } : {}
       });
@@ -9117,7 +9186,11 @@ function report2(ctx, parsed, result) {
     ctx.out.log(JSON.stringify(result, null, 2));
   } else if (parsed.options.jsonl !== true && result.found) {
     for (const post of result.posts ?? []) {
-      const who = post.authorKind === "bot" ? `${post.authorId} (agent)` : post.authorId;
+      const who = discussPrincipalLabel(
+        post.authorId,
+        post.authorKind,
+        result
+      );
       ctx.out.log(`\u2014 ${who}
 ${post.body}`);
     }
@@ -9262,8 +9335,8 @@ function collectFields(parsed, allowClear) {
       if (allowClear) out[spec.key] = null;
       continue;
     }
-    const text = stringOpt(value2);
-    out[spec.key] = spec.num ? Number(text) : text;
+    const text2 = stringOpt(value2);
+    out[spec.key] = spec.num ? Number(text2) : text2;
   }
   return out;
 }
@@ -9593,17 +9666,23 @@ function age(input) {
 
 // src/platform-command.ts
 async function platformCommand(parsed, deps = {}) {
+  const action2 = parsed.positionals[1];
+  if (action2 === "status") {
+    return platformStatus(parsed, deps);
+  }
+  throw new Error(
+    `unknown platform action "${[
+      action2,
+      parsed.positionals[2]
+    ].filter(Boolean).join(" ")}". Try "odla-ai platform status --json".`
+  );
+}
+async function platformStatus(parsed, deps) {
   assertArgs(
     parsed,
     ["config", "context", "platform", "token", "email", "open", "json"],
     2
   );
-  const action2 = parsed.positionals[1];
-  if (action2 !== "status") {
-    throw new Error(
-      `unknown platform action "${action2 ?? ""}". Try "odla-ai platform status --json".`
-    );
-  }
   const context = await resolveOperatorContext(parsed, {
     allowMissingConfig: true
   });
@@ -10048,14 +10127,14 @@ function statusMinutes(value2) {
 }
 async function read2(url, headers, doFetch) {
   const response2 = await doFetch(url, { headers });
-  const text = await response2.text();
+  const text2 = await response2.text();
   let body = {};
-  if (text) {
+  if (text2) {
     try {
-      const value2 = JSON.parse(text);
+      const value2 = JSON.parse(text2);
       body = value2 && typeof value2 === "object" && !Array.isArray(value2) ? value2 : { value: value2 };
     } catch {
-      body = { message: text.slice(0, 300) };
+      body = { message: text2.slice(0, 300) };
     }
   }
   return { httpStatus: response2.status, body };
@@ -10480,7 +10559,9 @@ var COMMAND_SURFACE = {
   init: {},
   o11y: { status: {} },
   operations: { get: {}, wait: {} },
-  platform: { status: {} },
+  platform: {
+    status: {}
+  },
   pm: {
     ...PM_ENTITIES,
     handoff: {}
@@ -10689,12 +10770,17 @@ async function runbookNew(ctx, slug, title, body, summary, requires) {
   });
   ctx.out.log(ctx.json ? JSON.stringify(created, null, 2) : `created ${slug} (${created.id})`);
 }
-async function runbookEdit(ctx, slug, body, note, requires) {
+async function runbookEdit(ctx, slug, body, note, requires, expectedVersion) {
   const runbook = await bySlug(ctx, slug);
   const result = await call(ctx, "PATCH", `/runbook/${encodeURIComponent(runbook.id)}`, {
     // An empty --requires clears the declaration; omitting the flag leaves
     // whatever is there, so an ordinary body edit never drops it.
-    patch: { body, ...note ? { note } : {}, ...requires === void 0 ? {} : { requires: requires || null } }
+    patch: {
+      body,
+      expectedVersion: expectedVersion ?? runbook.version,
+      ...note ? { note } : {},
+      ...requires === void 0 ? {} : { requires: requires || null }
+    }
   });
   if (ctx.json) return ctx.out.log(JSON.stringify(result, null, 2));
   ctx.out.log(`${slug} \u2192 v${result.record?.version ?? runbook.version + 1}`);
@@ -10748,12 +10834,12 @@ async function runbookRemove(ctx, slug) {
 // src/runbook-import.ts
 var import_node_fs18 = require("fs");
 var import_node_path15 = require("path");
-function parseRunbook(text, slug) {
-  let rest = text;
+function parseRunbook(text2, slug) {
+  let rest = text2;
   const meta = {};
-  const fm = /^---\r?\n([\s\S]*?)\r?\n---\r?\n?/.exec(text);
+  const fm = /^---\r?\n([\s\S]*?)\r?\n---\r?\n?/.exec(text2);
   if (fm) {
-    rest = text.slice(fm[0].length);
+    rest = text2.slice(fm[0].length);
     for (const line of fm[1].split(/\r?\n/)) {
       const pair = /^(\w+)\s*:\s*(.+)$/.exec(line.trim());
       if (!pair) continue;
@@ -10834,6 +10920,7 @@ async function upsert(ctx, r, visibility) {
       patch: {
         title: r.title,
         body: r.body,
+        expectedVersion: found.version,
         ...r.summary ? { summary: r.summary } : {},
         ...r.tags ? { tags: r.tags } : {},
         note: `imported from ${r.file}`
@@ -11274,27 +11361,90 @@ async function editRunbook(ctx, slug, deps = {}) {
   const found = page.records[0];
   if (!found) throw new Error(`no runbook "${slug}" in ${ctx.appId}`);
   ctx.out.log(`opening ${slug} v${found.version} in your editor\u2026`);
-  return editText(found.body, slug, deps);
+  const body = await editText(found.body, slug, deps);
+  return body === null ? null : { body, expectedVersion: found.version };
 }
 
 // src/whoami-command.ts
+var text = (value2) => typeof value2 === "string" && value2.trim() ? value2.trim() : null;
+function principalKind(value2, machine) {
+  return value2 === "human" || value2 === "agent" || value2 === "service" ? value2 : machine ? "service" : "human";
+}
+function credentialKind(value2, machine, scopes) {
+  if (value2 === "machine" || value2 === "device" || value2 === "clerk") return value2;
+  if (machine) return "machine";
+  if (scopes.length) return "device";
+  return "unknown";
+}
+function managerOf(value2) {
+  if (!value2 || typeof value2 !== "object") return null;
+  const row = value2;
+  const principalId = text(row.principalId);
+  if (!principalId) return null;
+  return {
+    principalId,
+    displayName: text(row.displayName) ?? "Unnamed member",
+    handle: text(row.handle) ?? ""
+  };
+}
+function unnamedPrincipal(kind) {
+  if (kind === "agent") return "Unnamed agent";
+  if (kind === "service") return "Unnamed service";
+  return "Unnamed member";
+}
 async function fetchIdentity(platformUrl, token, doFetch) {
   const res = await doFetch(`${platformUrl.replace(/\/$/, "")}/registry/me`, {
     headers: { authorization: `Bearer ${token}` }
   });
   if (!res.ok) throw new Error(`could not resolve identity (HTTP ${res.status})`);
   const body = await res.json();
+  const developerId = text(body.developerId) ?? "";
+  const machine = body.machine === true;
+  const scopes = Array.isArray(body.scopes) ? body.scopes.map(String) : [];
+  const principalId = text(body.principalId) ?? developerId;
+  const email = text(body.email);
+  const kind = principalKind(body.principalKind, machine);
+  const displayName = text(body.displayName) ?? email ?? unnamedPrincipal(kind);
+  const handle = text(body.handle) ?? "";
+  const credential2 = body.credential && typeof body.credential === "object" ? body.credential : {};
   return {
-    developerId: String(body.developerId ?? ""),
-    email: body.email ?? null,
+    developerId,
+    principalId,
+    principalKind: kind,
+    displayName,
+    handle,
+    manager: managerOf(body.manager),
+    credential: {
+      id: text(credential2.id),
+      kind: credentialKind(credential2.kind, machine, scopes)
+    },
+    email,
     admin: body.admin === true,
-    machine: body.machine === true,
-    scopes: Array.isArray(body.scopes) ? body.scopes.map(String) : []
+    machine,
+    scopes
   };
 }
-function credentialKind(identity) {
-  if (identity.machine) return "machine (platform admin secret)";
-  return identity.scopes.length ? "device token (scoped)" : "device token or session";
+function credentialLabel(identity) {
+  if (identity.credential.kind === "machine") return "machine (platform admin secret)";
+  if (identity.credential.kind === "device")
+    return identity.scopes.length ? "device (scoped)" : "device";
+  if (identity.credential.kind === "clerk") return "clerk";
+  return "unknown (legacy server)";
+}
+function namedPrincipal(identity) {
+  return identity.handle && identity.handle !== identity.displayName ? `${identity.displayName} (@${identity.handle})` : identity.displayName;
+}
+function namedManager(manager) {
+  return manager.handle && manager.handle !== manager.displayName ? `${manager.displayName} (@${manager.handle})` : manager.displayName;
+}
+function accountableOwner(identity) {
+  if (identity.principalKind === "agent" && identity.manager) {
+    return namedManager(identity.manager);
+  }
+  if (identity.principalKind === "human" && identity.principalId === identity.developerId) {
+    return namedPrincipal(identity);
+  }
+  return identity.email ?? "Unnamed member";
 }
 async function whoamiCommand(parsed, deps = {}) {
   assertArgs(
@@ -11325,9 +11475,19 @@ async function whoamiCommand(parsed, deps = {}) {
     return;
   }
   out.log(`platform:   ${cfg.platformUrl}`);
-  out.log(`developer:  ${identity.developerId}`);
+  out.log(`principal:  ${namedPrincipal(identity)}`);
+  out.log(`principal id: ${identity.principalId}`);
+  out.log(`kind:       ${identity.principalKind}`);
+  if (identity.principalKind === "agent")
+    out.log(
+      `manager:    ${identity.manager ? namedManager(identity.manager) : "(unknown)"}`
+    );
+  out.log(`owner:      ${accountableOwner(identity)}`);
+  out.log(`owner id:   ${identity.developerId}`);
   out.log(`email:      ${identity.email ?? "(none)"}`);
-  out.log(`credential: ${credentialKind(identity)}`);
+  out.log(`credential: ${credentialLabel(identity)}`);
+  if (identity.credential.id)
+    out.log(`credential id: ${identity.credential.id}`);
   out.log(`admin:      ${identity.admin ? "yes" : "no"}`);
   if (identity.scopes.length) out.log(`scopes:     ${identity.scopes.join(", ")}`);
   if (!identity.admin) {
@@ -11476,14 +11636,16 @@ async function runbookCommand(parsed, deps = {}) {
       const name = requireSlug(slug, "edit");
       const file = stringOpt(parsed.options.file);
       const inline = stringOpt(parsed.options.body);
-      const body = file === void 0 && inline === void 0 ? await editRunbook(ctx, name) : readBody(file, inline);
-      if (body === null) return ctx.out.log(`${name} unchanged; nothing written`);
+      const edited = file === void 0 && inline === void 0 ? await editRunbook(ctx, name) : readBody(file, inline);
+      if (edited === null) return ctx.out.log(`${name} unchanged; nothing written`);
+      const body = typeof edited === "string" ? edited : edited.body;
       return runbookEdit(
         ctx,
         name,
         body,
         stringOpt(parsed.options.note),
-        parsed.options.requires === void 0 ? void 0 : stringOpt(parsed.options.requires) ?? ""
+        parsed.options.requires === void 0 ? void 0 : stringOpt(parsed.options.requires) ?? "",
+        typeof edited === "string" ? void 0 : edited.expectedVersion
       );
     }
     case "import": {