@odla-ai/cli 0.26.1 → 0.26.2

package/README.md

@@ -156,25 +156,6 @@ therefore compares that verified expectation with the Worker answering now and
 reports `matched`, `drifted`, or `unknown`; an empty or unavailable receipt
 ledger degrades instead of silently treating observed health as intended state.
 
-Platform maintainers can rotate the built-in Discussion responder without
-minting an unrestricted app key or exposing the replacement in argv/output:
-
-```bash
-npx @odla-ai/cli platform chat-credentials rotate \
-  --wrangler-config packages/chat-agent/wrangler.jsonc \
-  --expected-version <deployed-chat-version-id> \
-  --email <odla-admin-account> \
-  --yes --json
-```
-
-The command requests only `platform:chat:credential:write`, mints an
-`agent_odla` key restricted to the Discussion namespaces and write envelope,
-pipes the nested `ODLA_BOT_TOKENS` map to Wrangler over stdin, and succeeds only
-after the service-binding health bridge advances from the pre-rotation Worker
-version to a healthy secret-change deployment. `--expected-version` fences the
-pre-rotation version before any credential is minted. Superseded keys are
-revoked separately after that health proof.
-
 For repository-managed settings, compare checked-in intent with the live
 owner-visible Registry projection before provisioning:
 

package/dist/bin.cjs

@@ -492,7 +492,6 @@ function audienceBoundEnvToken(token, platform) {
 }
 var SCOPE_PURPOSE = {
   "platform:status:read": "read the platform fleet health and deployment snapshot",
-  "platform:chat:credential:write": "rotate the built-in Discussion responder credential",
   "app:config:read": "compare checked-in intent with an exact-id app Registry configuration",
   "app:config:write": "apply or inspect one revision-bound configuration operation for an app you own",
   "platform:runbook:write": "add or edit odla's operational runbooks",
@@ -2743,9 +2742,9 @@ function canonicalValue(value2) {
   }
   if (Array.isArray(value2)) return value2.map(canonicalValue);
   if (value2 && typeof value2 === "object") {
-    const record11 = value2;
+    const record10 = value2;
     return Object.fromEntries(
-      Object.keys(record11).filter((key) => record11[key] !== void 0).sort().map((key) => [key, canonicalValue(record11[key])])
+      Object.keys(record10).filter((key) => record10[key] !== void 0).sort().map((key) => [key, canonicalValue(record10[key])])
     );
   }
   throw new TypeError("canonical JSON rejects unsupported values");
@@ -5262,8 +5261,8 @@ async function materializeGitTree(source, commitSha, options = {}) {
   const maxFiles = options.maxFiles ?? 2e4;
   const maxBytes = options.maxBytes ?? 512 * 1024 * 1024;
   const inventory = (await gitOutput(sourceDir, ["ls-tree", "-rz", commitSha], 16 * 1024 * 1024)).toString("utf8").split("\0").filter(Boolean);
-  const entries = inventory.flatMap((record11) => {
-    const match = /^(100644|100755) blob ([0-9a-f]{40,64})\t([\s\S]+)$/.exec(record11);
+  const entries = inventory.flatMap((record10) => {
+    const match = /^(100644|100755) blob ([0-9a-f]{40,64})\t([\s\S]+)$/.exec(record10);
     return match && allowedWorkspacePath(match[3]) ? [{ mode: match[1], hash: match[2], path: match[3] }] : [];
   });
   if (entries.length > maxFiles) throw new Error(`workspace exceeds ${maxFiles} files`);
@@ -5511,8 +5510,8 @@ function normalize(value2) {
   if (Array.isArray(value2)) return value2.map(normalize);
   if (value2 instanceof Uint8Array) return { $bytes: [...value2] };
   if (typeof value2 === "object") {
-    const record11 = value2;
-    return Object.fromEntries(Object.keys(record11).filter((key) => record11[key] !== void 0).sort().map((key) => [key, normalize(record11[key])]));
+    const record10 = value2;
+    return Object.fromEntries(Object.keys(record10).filter((key) => record10[key] !== void 0).sort().map((key) => [key, normalize(record10[key])]));
   }
   throw new CamelError("state_conflict", "Canonical JSON rejects unsupported values.");
 }
@@ -8572,7 +8571,6 @@ Usage:
   odla-ai context remove <name> --yes [--json]
   odla-ai o11y status [--app <id>] [--context <name>] [--platform https://odla.ai] [--env prod] [--minutes 60] [--json]
   odla-ai platform status [--context <name>] [--platform https://odla.ai] [--email <odla-account>] [--json]
-  odla-ai platform chat-credentials rotate [--context <name>] [--email <odla-account>] [--wrangler-config <path>] [--expected-version <id>] [--json] --yes
   odla-ai whoami [--context <name>] [--platform https://odla.ai] [--json]
   odla-ai runbook ask "<question>" [--app <id>] [--all] [--json]
   odla-ai runbook search "<question>" [--app <id>] [--all] [--limit <n>] [--json]
@@ -9405,8 +9403,8 @@ async function pmAdd(ctx, entity, parsed) {
   emit2(ctx, res, () => ctx.out.log(`created ${entity} ${res.id}`));
 }
 async function pmGet(ctx, entity, id) {
-  const { record: record11 } = await pmRequest(ctx, "GET", `/${entity}/${encodeURIComponent(id)}`);
-  emit2(ctx, record11, () => printRecord(ctx, entity, record11));
+  const { record: record10 } = await pmRequest(ctx, "GET", `/${entity}/${encodeURIComponent(id)}`);
+  emit2(ctx, record10, () => printRecord(ctx, entity, record10));
 }
 async function pmSet(ctx, entity, id, parsed) {
   const patch2 = collectEntityFields(entity, parsed, true);
@@ -9451,9 +9449,9 @@ async function pmHandoff(ctx, parsed) {
   ]);
   const handoff = {
     appId,
-    unmetGoals: goals.filter((record11) => record11.status !== "met"),
-    activeTasks: tasks.filter((record11) => record11.column !== "done"),
-    openBugs: bugs.filter((record11) => record11.status !== "fixed" && record11.status !== "wontfix")
+    unmetGoals: goals.filter((record10) => record10.status !== "met"),
+    activeTasks: tasks.filter((record10) => record10.column !== "done"),
+    openBugs: bugs.filter((record10) => record10.status !== "fixed" && record10.status !== "wontfix")
   };
   const result = {
     ...handoff,
@@ -9472,10 +9470,10 @@ async function pmHandoff(ctx, parsed) {
     ]) {
       ctx.out.log(`${label}:`);
       if (!records.length) ctx.out.log("- (none)");
-      else for (const record11 of records) printRecord(
+      else for (const record10 of records) printRecord(
         ctx,
         label === "unmet goals" ? "goal" : label === "active tasks" ? "task" : "bug",
-        record11
+        record10
       );
     }
   });
@@ -9666,167 +9664,12 @@ function age(input) {
   return `${Math.round(input / 6e4)}m`;
 }
 
-// src/platform-chat-credential-command.ts
-var import_node_process10 = __toESM(require("process"), 1);
-async function rotatePlatformChatCredential(parsed, deps) {
-  assertArgs(
-    parsed,
-    [
-      "config",
-      "context",
-      "platform",
-      "token",
-      "email",
-      "open",
-      "json",
-      "yes",
-      "wrangler-config",
-      "expected-version"
-    ],
-    3
-  );
-  if (parsed.options.yes !== true) {
-    throw new Error(
-      "platform chat-credentials rotate changes the production chat secret; pass --yes"
-    );
-  }
-  const context = await resolveOperatorContext(parsed, {
-    allowMissingConfig: true
-  });
-  const platform = context.platform.value;
-  const doFetch = deps.fetch ?? fetch;
-  const out = deps.stdout ?? console;
-  const run = deps.runner ?? defaultRunner;
-  const cwd = import_node_process10.default.cwd();
-  const wranglerConfig = stringOpt(parsed.options["wrangler-config"]) ?? "packages/chat-agent/wrangler.jsonc";
-  if (!await wranglerLoggedIn(run, cwd)) {
-    throw new Error(
-      'Wrangler is not authenticated; run "npx wrangler login" and retry'
-    );
-  }
-  const priorHealth = await doFetch(`${platform}/health/services/chat`);
-  const priorVersion = priorHealth.headers.get("x-odla-worker-version-id");
-  await priorHealth.body?.cancel().catch(() => {
-  });
-  if (!priorVersion) {
-    throw new Error(
-      "chat health did not identify its current Worker version; refusing to rotate"
-    );
-  }
-  const expectedVersion = stringOpt(parsed.options["expected-version"]);
-  if (expectedVersion && priorVersion !== expectedVersion) {
-    throw new Error(
-      `chat health answered from version ${priorVersion}; expected ${expectedVersion}`
-    );
-  }
-  const token = await resolveAdminPlatformToken({
-    platform,
-    scope: "platform:chat:credential:write",
-    token: stringOpt(parsed.options.token),
-    tokenFile: context.credentials.scopedTokenFile,
-    email: stringOpt(parsed.options.email),
-    open: parsed.options.open === false ? false : parsed.options.open === true ? true : void 0,
-    fetch: doFetch,
-    stdout: out,
-    openApprovalUrl: deps.openUrl,
-    label: "odla CLI (rotate built-in Discussion responder)"
-  });
-  const mintedResponse = await doFetch(
-    `${platform}/registry/platform/chat-credentials/rotate`,
-    {
-      method: "POST",
-      headers: { authorization: `Bearer ${token}` }
-    }
-  );
-  const minted = await mintedResponse.json().catch(() => null);
-  if (!mintedResponse.ok) {
-    throw new Error(
-      `mint Discussion credential failed (HTTP ${mintedResponse.status}): ${apiMessage(minted)}`
-    );
-  }
-  if (!isPlatformChatCredential(minted)) {
-    throw new Error(
-      "platform returned an invalid odla.platform-chat-credential/v1 envelope"
-    );
-  }
-  const put = await wranglerPutSecret(run, {
-    name: "ODLA_BOT_TOKENS",
-    value: JSON.stringify({
-      [minted.appId]: { [minted.principalId]: minted.key }
-    }),
-    configPath: wranglerConfig,
-    cwd
-  });
-  if (put.code !== 0) {
-    throw new Error(
-      "Wrangler could not replace ODLA_BOT_TOKENS; the new scoped key was not activated"
-    );
-  }
-  const version = await waitForRotatedChatHealth({
-    fetch: doFetch,
-    platform,
-    priorVersion,
-    wait: deps.pollWait
-  });
-  const result = {
-    schemaVersion: "odla.platform-chat-credential-rotation/v1",
-    appId: minted.appId,
-    appIncarnation: minted.appIncarnation,
-    principalId: minted.principalId,
-    health: { ok: true, service: "odla-chat-agent", version }
-  };
-  if (parsed.options.json === true) {
-    out.log(JSON.stringify(result, null, 2));
-  } else {
-    out.log(
-      `rotated	${result.appId}	${result.principalId}	${result.health.version}`
-    );
-  }
-}
-async function waitForRotatedChatHealth(opts) {
-  const wait2 = opts.wait ?? ((milliseconds) => new Promise((resolve12) => setTimeout(resolve12, milliseconds)));
-  let lastStatus = 0;
-  let lastVersion = null;
-  let lastError = "private_service_unready";
-  for (let attempt = 0; attempt < 60; attempt++) {
-    const response2 = await opts.fetch(
-      `${opts.platform}/health/services/chat`
-    );
-    const body = await response2.json().catch(() => null);
-    const version = response2.headers.get("x-odla-worker-version-id");
-    if (response2.ok && record7(body) && body.ok === true && body.service === "odla-chat-agent" && version && version !== opts.priorVersion) {
-      return version;
-    }
-    lastStatus = response2.status;
-    lastVersion = version;
-    lastError = record7(body) && typeof body.error === "string" ? body.error : "private_service_unready";
-    if (attempt < 59) await wait2(5e3);
-  }
-  throw new Error(
-    `chat health did not converge on the rotated Worker deployment (HTTP ${lastStatus}, version ${lastVersion ?? "unknown"}, ${lastError})`
-  );
-}
-function isPlatformChatCredential(value2) {
-  return record7(value2) && value2.schemaVersion === "odla.platform-chat-credential/v1" && value2.appId === "odla-pm" && typeof value2.appIncarnation === "string" && value2.appIncarnation.length > 0 && value2.principalId === "agent_odla" && typeof value2.key === "string" && value2.key.startsWith("odla_sk_");
-}
-function apiMessage(value2) {
-  if (!record7(value2)) return "request failed";
-  const error = record7(value2.error) ? value2.error : value2;
-  return typeof error.message === "string" ? error.message : typeof error.code === "string" ? error.code : "request failed";
-}
-function record7(value2) {
-  return !!value2 && typeof value2 === "object" && !Array.isArray(value2);
-}
-
 // src/platform-command.ts
 async function platformCommand(parsed, deps = {}) {
   const action2 = parsed.positionals[1];
   if (action2 === "status") {
     return platformStatus(parsed, deps);
   }
-  if (action2 === "chat-credentials" && parsed.positionals[2] === "rotate") {
-    return rotatePlatformChatCredential(parsed, deps);
-  }
   throw new Error(
     `unknown platform action "${[
       action2,
@@ -9864,7 +9707,7 @@ async function platformStatus(parsed, deps) {
   const body = await response2.json().catch(() => null);
   if (!response2.ok) {
     throw new Error(
-      `read platform status failed (HTTP ${response2.status}): ${apiMessage2(body)}`
+      `read platform status failed (HTTP ${response2.status}): ${apiMessage(body)}`
     );
   }
   if (!isPlatformStatus(body)) {
@@ -9877,17 +9720,17 @@ async function platformStatus(parsed, deps) {
   }
 }
 function isPlatformStatus(value2) {
-  if (!record8(value2) || value2.schemaVersion !== "odla.platform-status/v1") return false;
-  if (!record8(value2.verdict) || !Array.isArray(value2.verdict.reasons)) return false;
-  if (!record8(value2.catalog) || !record8(value2.summary)) return false;
+  if (!record7(value2) || value2.schemaVersion !== "odla.platform-status/v1") return false;
+  if (!record7(value2.verdict) || !Array.isArray(value2.verdict.reasons)) return false;
+  if (!record7(value2.catalog) || !record7(value2.summary)) return false;
   return Array.isArray(value2.services) && Array.isArray(value2.nextActions);
 }
-function apiMessage2(value2) {
-  if (!record8(value2)) return "request failed";
-  const error = record8(value2.error) ? value2.error : value2;
+function apiMessage(value2) {
+  if (!record7(value2)) return "request failed";
+  const error = record7(value2.error) ? value2.error : value2;
   return typeof error.message === "string" ? error.message : typeof error.code === "string" ? error.code : "request failed";
 }
-function record8(value2) {
+function record7(value2) {
   return !!value2 && typeof value2 === "object" && !Array.isArray(value2);
 }
 
@@ -9928,7 +9771,7 @@ function statusVerdict(reads) {
       severity: "degraded"
     });
   }
-  const performance = record9(reads.liveSync.body.performance) ? reads.liveSync.body.performance : null;
+  const performance = record8(reads.liveSync.body.performance) ? reads.liveSync.body.performance : null;
   if (performance?.status === "unavailable") {
     reasons.push({
       source: "liveSync",
@@ -10009,7 +9852,7 @@ function statusVerdict(reads) {
     reasons
   };
 }
-function record9(value2) {
+function record8(value2) {
   return Boolean(value2) && typeof value2 === "object" && !Array.isArray(value2);
 }
 function numeric2(value2) {
@@ -10037,7 +9880,7 @@ function printO11yStatus(status, out) {
   out.log(
     `o11y status ${status.scope.appId}/${status.scope.env} (${status.scope.minutes}m)`
   );
-  const routes = Array.isArray(status.application.body.routes) ? status.application.body.routes.filter(record10) : [];
+  const routes = Array.isArray(status.application.body.routes) ? status.application.body.routes.filter(record9) : [];
   const requests = routes.reduce(
     (total, row) => total + numeric3(row.requests),
     0
@@ -10049,39 +9892,39 @@ function printO11yStatus(status, out) {
   out.log(
     `application	${status.application.httpStatus}	${requests} requests	${errors} errors`
   );
-  const versions = Array.isArray(status.applicationVersions.body.rows) ? status.applicationVersions.body.rows.filter(record10) : [];
+  const versions = Array.isArray(status.applicationVersions.body.rows) ? status.applicationVersions.body.rows.filter(record9) : [];
   out.log(
     `application-versions	${status.applicationVersions.httpStatus}	${versions.length ? versions.slice(0, 5).map(
       (row) => `${String(row.value || "(unattributed)")}:${numeric3(row.requests)}`
     ).join(", ") : "none observed"}`
   );
   out.log(liveSyncLine(status.liveSync));
-  const canaryDurations = record10(status.canary.body.durationsMs) ? status.canary.body.durationsMs : {};
+  const canaryDurations = record9(status.canary.body.durationsMs) ? status.canary.body.durationsMs : {};
   out.log(
     `canary	${status.canary.httpStatus}	${String(status.canary.body.status ?? status.canary.body.error ?? "unavailable")}	${optionalNumeric(canaryDurations.publishToVisibleMs)} publish-to-visible`
   );
-  const collectorIngest = record10(status.collector.body.ingest) ? status.collector.body.ingest : {};
-  const collectorStorage = record10(collectorIngest.storage) ? collectorIngest.storage : {};
+  const collectorIngest = record9(status.collector.body.ingest) ? status.collector.body.ingest : {};
+  const collectorStorage = record9(collectorIngest.storage) ? collectorIngest.storage : {};
   out.log(
     `collector	${status.collector.httpStatus}	${String(status.collector.body.status ?? status.collector.body.error ?? "unavailable")}	${numeric3(collectorStorage.affectedPoints)} affected points`
   );
-  const providerMetrics = record10(status.provider.body.metrics) ? status.provider.body.metrics : {};
-  const providerCapacity = record10(status.provider.body.capacity) ? status.provider.body.capacity : {};
-  const workerMemory = record10(providerCapacity.memory) ? providerCapacity.memory : {};
+  const providerMetrics = record9(status.provider.body.metrics) ? status.provider.body.metrics : {};
+  const providerCapacity = record9(status.provider.body.capacity) ? status.provider.body.capacity : {};
+  const workerMemory = record9(providerCapacity.memory) ? providerCapacity.memory : {};
   out.log(
     `cloudflare	${status.provider.httpStatus}	${String(status.provider.body.status ?? status.provider.body.error ?? "unavailable")}	${numeric3(providerMetrics.requests)} invocations	${numeric3(providerMetrics.errors)} runtime errors	${optionalBytes(workerMemory.headroomBytes)} isolate memory headroom`
   );
   for (const line of providerCapacityLines(status.providerCapacity)) {
     out.log(line);
   }
-  const coverage = record10(status.providerReconciliation.body.comparison) ? status.providerReconciliation.body.comparison : {};
-  const coverageCounts = record10(status.providerReconciliation.body.counts) ? status.providerReconciliation.body.counts : {};
-  const coverageBudget = record10(status.providerReconciliation.body.budget) ? status.providerReconciliation.body.budget : {};
+  const coverage = record9(status.providerReconciliation.body.comparison) ? status.providerReconciliation.body.comparison : {};
+  const coverageCounts = record9(status.providerReconciliation.body.counts) ? status.providerReconciliation.body.counts : {};
+  const coverageBudget = record9(status.providerReconciliation.body.budget) ? status.providerReconciliation.body.budget : {};
   out.log(
     `request-coverage	${status.providerReconciliation.httpStatus}	${String(status.providerReconciliation.body.status ?? status.providerReconciliation.body.error ?? "unavailable")}	${optionalPercent(coverage.applicationCoverage)} application/provider	${numeric3(coverageCounts.applicationRequests)}/${numeric3(coverageCounts.providerRequests)} requests	\xB1${optionalPercent(coverageBudget.maxRelativeError)} budget`
   );
   const providerPoints = Array.isArray(status.providerHistory.body.points) ? status.providerHistory.body.points.length : 0;
-  const providerFreshness = record10(status.providerHistory.body.freshness) ? status.providerHistory.body.freshness : {};
+  const providerFreshness = record9(status.providerHistory.body.freshness) ? status.providerHistory.body.freshness : {};
   out.log(
     `cloudflare-history	${status.providerHistory.httpStatus}	${String(status.providerHistory.body.status ?? status.providerHistory.body.error ?? "unavailable")}	${providerPoints} snapshots	${optionalAge(providerFreshness.ageMs)} old`
   );
@@ -10090,17 +9933,17 @@ function printO11yStatus(status, out) {
   );
 }
 function providerCapacityLines(read3) {
-  const resources = record10(read3.body.resources) ? read3.body.resources : {};
-  const durableObjects = record10(resources.durableObjects) ? resources.durableObjects : {};
-  const periodic = record10(durableObjects.periodic) ? durableObjects.periodic : {};
-  const storage = record10(durableObjects.sqliteStorage) ? durableObjects.sqliteStorage : {};
-  const d1 = record10(resources.d1) ? resources.d1 : {};
-  const d1Activity = record10(d1.activity) ? d1.activity : {};
-  const d1Storage = record10(d1.storage) ? d1.storage : {};
-  const d1Latency = record10(d1Activity.latency) ? d1Activity.latency : {};
-  const r2 = record10(resources.r2) ? resources.r2 : {};
-  const r2Operations = record10(r2.operations) ? r2.operations : {};
-  const r2Storage = record10(r2.storage) ? r2.storage : {};
+  const resources = record9(read3.body.resources) ? read3.body.resources : {};
+  const durableObjects = record9(resources.durableObjects) ? resources.durableObjects : {};
+  const periodic = record9(durableObjects.periodic) ? durableObjects.periodic : {};
+  const storage = record9(durableObjects.sqliteStorage) ? durableObjects.sqliteStorage : {};
+  const d1 = record9(resources.d1) ? resources.d1 : {};
+  const d1Activity = record9(d1.activity) ? d1.activity : {};
+  const d1Storage = record9(d1.storage) ? d1.storage : {};
+  const d1Latency = record9(d1Activity.latency) ? d1Activity.latency : {};
+  const r2 = record9(resources.r2) ? resources.r2 : {};
+  const r2Operations = record9(r2.operations) ? r2.operations : {};
+  const r2Storage = record9(r2.storage) ? r2.storage : {};
   const status = String(
     read3.body.status ?? read3.body.error ?? "unavailable"
   );
@@ -10111,11 +9954,11 @@ function providerCapacityLines(read3) {
   ];
 }
 function liveSyncLine(read3) {
-  const performance = record10(read3.body.performance) ? read3.body.performance : {};
-  const commitToSend = record10(performance.commitToSend) ? performance.commitToSend : {};
+  const performance = record9(read3.body.performance) ? read3.body.performance : {};
+  const commitToSend = record9(performance.commitToSend) ? performance.commitToSend : {};
   return `live-sync	${read3.httpStatus}	${String(read3.body.status ?? read3.body.error ?? "unavailable")}	${numeric3(read3.body.activeConnections)} active	${optionalNumeric(commitToSend.p95)} commit-to-send p95	${numeric3(performance.sendFailures)} send failures`;
 }
-function record10(value2) {
+function record9(value2) {
   return Boolean(value2) && typeof value2 === "object" && !Array.isArray(value2);
 }
 function numeric3(value2) {
@@ -10300,7 +10143,7 @@ async function read2(url, headers, doFetch) {
 // src/provision.ts
 var import_apps12 = require("@odla-ai/apps");
 var import_ai3 = require("@odla-ai/ai");
-var import_node_process11 = __toESM(require("process"), 1);
+var import_node_process10 = __toESM(require("process"), 1);
 
 // src/integration-provision.ts
 var import_db3 = require("@odla-ai/db");
@@ -10607,7 +10450,7 @@ ${env}: credentials are already saved; retry "odla-ai secrets push --env ${env}$
       await provisionIntegrationSeeds(doFetch, cfg.dbEndpoint, tenantId, dbKey, database.integrations, env, out);
     }
     if (cfg.services.includes("ai") && cfg.ai?.provider && cfg.ai.keyEnv) {
-      const key = import_node_process11.default.env[cfg.ai.keyEnv];
+      const key = import_node_process10.default.env[cfg.ai.keyEnv];
       if (key) {
         const secretName = cfg.ai.secretName ?? defaultSecretName(cfg.ai.provider);
         await (0, import_ai3.putSecret)({ endpoint: cfg.dbEndpoint, token, fetch: doFetch }, tenantId, secretName, key);
@@ -10649,7 +10492,7 @@ ${env}: credentials are already saved; retry "odla-ai secrets push --env ${env}$
 
 // src/record.ts
 var import_node_fs16 = require("fs");
-var import_node_process12 = __toESM(require("process"), 1);
+var import_node_process11 = __toESM(require("process"), 1);
 
 // src/surface.ts
 var PM_ACTIONS = {
@@ -10717,8 +10560,7 @@ var COMMAND_SURFACE = {
   o11y: { status: {} },
   operations: { get: {}, wait: {} },
   platform: {
-    status: {},
-    "chat-credentials": { rotate: {} }
+    status: {}
   },
   pm: {
     ...PM_ENTITIES,
@@ -10798,7 +10640,7 @@ function invocationPath(words2) {
 
 // src/record.ts
 function recordInvocation(parsed) {
-  const file = import_node_process12.default.env.ODLA_CLI_RECORD;
+  const file = import_node_process11.default.env.ODLA_CLI_RECORD;
   if (!file) return;
   try {
     const entry = {
@@ -11470,9 +11312,9 @@ var import_node_child_process8 = require("child_process");
 var import_node_fs20 = require("fs");
 var import_node_os5 = require("os");
 var import_node_path17 = require("path");
-var import_node_process13 = __toESM(require("process"), 1);
+var import_node_process12 = __toESM(require("process"), 1);
 var EDITOR_ENV = ["ODLA_EDITOR", "VISUAL", "EDITOR"];
-function resolveEditor(env = import_node_process13.default.env) {
+function resolveEditor(env = import_node_process12.default.env) {
   for (const name of EDITOR_ENV) {
     const value2 = env[name];
     if (value2 && value2.trim()) return value2.trim();
@@ -11486,8 +11328,8 @@ function defaultRun(command, path) {
   return result.status ?? 0;
 }
 function editText(initial, slug, deps = {}) {
-  const env = deps.env ?? import_node_process13.default.env;
-  const interactive = deps.interactive ?? (() => Boolean(import_node_process13.default.stdin.isTTY));
+  const env = deps.env ?? import_node_process12.default.env;
+  const interactive = deps.interactive ?? (() => Boolean(import_node_process12.default.stdin.isTTY));
   const editor = resolveEditor(env);
   if (!editor)
     throw new Error(