@odla-ai/cli 0.29.0 → 0.30.1

package/dist/{chunk-YTVLTADT.js → chunk-7V7WVTDT.js}

@@ -13,7 +13,7 @@ import {
 import process8 from "process";
 
 // src/token.ts
-import { collectToken, OdlaError, requestToken } from "@odla-ai/db";
+import { OdlaError, requestToken } from "@odla-ai/db";
 import { createHash } from "crypto";
 import process5 from "process";
 
@@ -117,12 +117,40 @@ function handshakeUrl(platformUrl, userCode) {
 
 // src/handshake-state.ts
 import { rmSync } from "fs";
-import { dirname as dirname2, join } from "path";
+import { dirname, join } from "path";
 import process4 from "process";
+function handshakeFile(cfg) {
+  return join(dirname(cfg.local.tokenFile), "handshake.local.json");
+}
+function clearPendingHandshake(path) {
+  rmSync(path, { force: true });
+}
+function minutesLeft(expiresAt) {
+  return Math.max(1, Math.round((expiresAt - Date.now()) / 6e4));
+}
+function approvalHint(pending) {
+  return `approve code ${pending.userCode} at ${pending.approvalUrl} (${minutesLeft(pending.expiresAt)}m left)`;
+}
+function approvalReminder(out, pending, periodMs = 3e4) {
+  const timer = setInterval(() => {
+    for (const line of reminderLines({
+      userCode: pending.userCode,
+      approvalUrl: pending.approvalUrl,
+      minutesLeft: minutesLeft(pending.expiresAt)
+    }))
+      out.log(line);
+  }, periodMs);
+  timer.unref?.();
+  return () => clearInterval(timer);
+}
+function handshakeWaitMs(waitSeconds, interactive = process4.stdout.isTTY === true) {
+  if (waitSeconds !== void 0) return waitSeconds * 1e3;
+  return interactive ? void 0 : 9e4;
+}
 
 // src/local.ts
 import { chmodSync, existsSync, mkdirSync, readFileSync, renameSync, writeFileSync } from "fs";
-import { dirname, isAbsolute, relative, resolve } from "path";
+import { dirname as dirname2, isAbsolute, relative, resolve } from "path";
 var GITIGNORE_LINES = [".odla/*.local.json", ".odla/dev-token.json", ".dev.vars"];
 function readJsonFile(path) {
   try {
@@ -190,7 +218,7 @@ function o11yDevVars(cfg) {
 function resolveWriteDevVarsTarget(cfg, requested) {
   if (!requested) return null;
   if (requested === true) return cfg.local.devVarsFile;
-  return resolve(dirname(cfg.configPath), requested);
+  return resolve(dirname2(cfg.configPath), requested);
 }
 function writeDevVars(path, credentials, env, o11y) {
   const entry = credentials.envs[env];
@@ -230,7 +258,7 @@ function isManagedDevVar(line) {
   return !!match?.[1] && MANAGED_DEV_VARS.has(match[1]);
 }
 function writePrivateText(path, text2) {
-  mkdirSync(dirname(path), { recursive: true });
+  mkdirSync(dirname2(path), { recursive: true });
   const temporary = `${path}.tmp-${process.pid}-${Date.now()}`;
   writeFileSync(temporary, text2, { mode: 384 });
   chmodSync(temporary, 384);
@@ -246,58 +274,6 @@ function displayPath(path, rootDir = process.cwd()) {
   return rel && !rel.startsWith("..") ? rel : path;
 }
 
-// src/handshake-state.ts
-function handshakeFile(cfg) {
-  return join(dirname2(cfg.local.tokenFile), "handshake.local.json");
-}
-var RESUME_MARGIN_MS = 5e3;
-function readPendingHandshake(path, platform, email, requiredGrant) {
-  const pending = readJsonFile(path);
-  if (!pending || pending.platform !== platform || pending.email !== email) return null;
-  if (typeof pending.userCode !== "string" || typeof pending.deviceCode !== "string") return null;
-  if (typeof pending.expiresAt !== "number" || pending.expiresAt <= Date.now() + RESUME_MARGIN_MS) return null;
-  if (requiredGrant && !grantCovers(pending, requiredGrant)) return null;
-  return {
-    interval: typeof pending.interval === "number" ? pending.interval : 3,
-    ...pending,
-    approvalUrl: handshakeUrl(platform, pending.userCode)
-  };
-}
-function grantCovers(stored, required) {
-  if (required.optionalProjectCapabilities.length === 0) return true;
-  return required.projectIds.every((id) => stored.projectIds?.includes(id)) && required.optionalProjectCapabilities.every(
-    (capability) => stored.optionalProjectCapabilities?.includes(capability)
-  );
-}
-function writePendingHandshake(path, pending) {
-  writePrivateJson(path, pending);
-}
-function clearPendingHandshake(path) {
-  rmSync(path, { force: true });
-}
-function minutesLeft(expiresAt) {
-  return Math.max(1, Math.round((expiresAt - Date.now()) / 6e4));
-}
-function approvalHint(pending) {
-  return `approve code ${pending.userCode} at ${pending.approvalUrl} (${minutesLeft(pending.expiresAt)}m left)`;
-}
-function approvalReminder(out, pending, periodMs = 3e4) {
-  const timer = setInterval(() => {
-    for (const line of reminderLines({
-      userCode: pending.userCode,
-      approvalUrl: pending.approvalUrl,
-      minutesLeft: minutesLeft(pending.expiresAt)
-    }))
-      out.log(line);
-  }, periodMs);
-  timer.unref?.();
-  return () => clearInterval(timer);
-}
-function handshakeWaitMs(waitSeconds, interactive = process4.stdout.isTTY === true) {
-  if (waitSeconds !== void 0) return waitSeconds * 1e3;
-  return interactive ? void 0 : 9e4;
-}
-
 // src/token.ts
 async function getDeveloperToken(cfg, options, doFetch, out, grantRequest = {}) {
   const audience = platformAudience(cfg.platformUrl);
@@ -336,8 +312,8 @@ async function getDeveloperToken(cfg, options, doFetch, out, grantRequest = {})
     grantIntent
   };
   const waitMs = handshakeWaitMs(options.wait);
-  if (grantRequest.freshLogin) clearPendingHandshake(ctx.pendingFile);
-  const { token, expiresAt } = await resumePendingHandshake(ctx, waitMs) ?? await freshHandshake(ctx, waitMs);
+  clearPendingHandshake(ctx.pendingFile);
+  const { token, expiresAt } = await freshHandshake(ctx, waitMs);
   clearPendingHandshake(ctx.pendingFile);
   writePrivateJson(cfg.local.tokenFile, {
     platform: audience,
@@ -350,47 +326,6 @@ async function getDeveloperToken(cfg, options, doFetch, out, grantRequest = {})
   out.error(`auth: developer token cached (${displayPath(cfg.local.tokenFile, cfg.rootDir)})`);
   return token;
 }
-async function resumePendingHandshake(ctx, waitMs) {
-  const pending = readPendingHandshake(
-    ctx.pendingFile,
-    ctx.audience,
-    ctx.email,
-    ctx.grantIntent
-  );
-  if (!pending) return null;
-  ctx.out.error("");
-  ctx.out.error(`auth: resuming pending handshake \u2014 ${approvalHint(pending)}`);
-  await presentHandshakeApproval(ctx.out, {
-    userCode: pending.userCode,
-    approvalUrl: pending.approvalUrl,
-    minutesLeft: Math.max(1, Math.floor((pending.expiresAt - Date.now()) / 6e4)),
-    purpose: `sign this terminal in as ${ctx.email}`
-  }, ctx.options);
-  ctx.out.error("");
-  const stopReminder = approvalReminder(ctx.out, pending);
-  try {
-    return await collectToken({
-      endpoint: ctx.cfg.platformUrl,
-      deviceCode: pending.deviceCode,
-      expiresAt: pending.expiresAt,
-      interval: pending.interval,
-      waitMs,
-      fetch: ctx.doFetch
-    });
-  } catch (err) {
-    const code = err instanceof OdlaError ? err.code : void 0;
-    if (code === "handshake_pending") throw stillPending(pending, ctx.email);
-    if (code === "handshake_expired" || code === "handshake_timeout") {
-      clearPendingHandshake(ctx.pendingFile);
-      ctx.out.error("auth: pending handshake lapsed unapproved; starting a fresh one");
-      return null;
-    }
-    if (code === "handshake_denied") clearPendingHandshake(ctx.pendingFile);
-    throw err;
-  } finally {
-    stopReminder();
-  }
-}
 async function freshHandshake(ctx, waitMs) {
   let started;
   let stopReminder;
@@ -418,7 +353,6 @@ async function freshHandshake(ctx, waitMs) {
           projectIds: ctx.grantIntent.projectIds,
           optionalProjectCapabilities: ctx.grantIntent.optionalProjectCapabilities
         };
-        writePendingHandshake(ctx.pendingFile, started);
         await presentHandshakeApproval(ctx.out, {
           userCode,
           approvalUrl,
@@ -454,7 +388,7 @@ function projectAgentHandle(appId) {
 function stillPending(pending, email) {
   return new OdlaError(
     "handshake_pending",
-    `handshake still pending \u2014 ask ${email} to ${approvalHint(pending)}, then re-run this command; it resumes the same handshake and collects the token`,
+    `handshake still pending \u2014 ask ${email} to ${approvalHint(pending)}; if this command exits, re-run it to request a new code`,
     { retryable: true }
   );
 }
@@ -3831,6 +3765,41 @@ async function wranglerLoggedIn(run, cwd) {
     return false;
   }
 }
+async function wranglerRuntimeTarget(run, opts) {
+  const configPath = findWranglerConfig(opts.cwd);
+  if (!configPath) throw new Error(`no wrangler config found in ${opts.cwd}`);
+  const config = readWranglerConfig(configPath);
+  if (!config) throw new Error("runtime credential delivery requires wrangler.json or wrangler.jsonc");
+  const baseName = typeof config.name === "string" ? config.name : "";
+  const envs = config.env && typeof config.env === "object" && !Array.isArray(config.env) ? config.env : {};
+  const envConfig = opts.env && envs[opts.env] && typeof envs[opts.env] === "object" ? envs[opts.env] : {};
+  const explicitName = typeof envConfig.name === "string" ? envConfig.name : "";
+  const serviceEnvironments = config.legacy_env === false;
+  if (serviceEnvironments && explicitName) {
+    throw new Error("env.<name>.name is not allowed when wrangler legacy_env is false");
+  }
+  const scriptName = serviceEnvironments ? baseName : explicitName || (opts.env ? `${baseName}-${opts.env}` : baseName);
+  if (!/^[a-z0-9][a-z0-9_-]{0,62}$/.test(scriptName)) {
+    throw new Error("wrangler config must resolve an exact Worker name before credentials are issued");
+  }
+  const configuredAccount = typeof envConfig.account_id === "string" ? envConfig.account_id : typeof config.account_id === "string" ? config.account_id : "";
+  const whoami = await run("npx", ["wrangler", "whoami"], { cwd: opts.cwd });
+  if (whoami.code !== 0 || /not authenticated/i.test(`${whoami.stdout}${whoami.stderr}`)) {
+    throw new Error(`wrangler is not logged in \u2014 run "wrangler login" (a browser step for the human)`);
+  }
+  const discovered = [...new Set(`${whoami.stdout}
+${whoami.stderr}`.match(/\b[a-f0-9]{32}\b/gi)?.map((id) => id.toLowerCase()) ?? [])];
+  const accountId = configuredAccount.toLowerCase() || (discovered.length === 1 ? discovered[0] : "");
+  if (!/^[a-f0-9]{32}$/.test(accountId) || configuredAccount && discovered.length > 0 && !discovered.includes(accountId)) {
+    throw new Error("Wrangler account is ambiguous or does not match account_id in the config");
+  }
+  return {
+    provider: "cloudflare",
+    accountId,
+    scriptName,
+    ...opts.env ? { environment: opts.env } : {}
+  };
+}
 function wranglerPutSecret(run, opts) {
   const args = [
     "wrangler",
@@ -3842,6 +3811,16 @@ function wranglerPutSecret(run, opts) {
   ];
   return run("npx", args, { input: opts.value, cwd: opts.cwd });
 }
+function wranglerBulkSecrets(run, opts) {
+  const args = [
+    "wrangler",
+    "secret",
+    "bulk",
+    ...opts.env ? ["--env", opts.env] : [],
+    ...opts.configPath ? ["--config", opts.configPath] : []
+  ];
+  return run("npx", args, { input: JSON.stringify(opts.secrets), cwd: opts.cwd });
+}
 
 // src/doctor-checks.ts
 function lintRules(rules, entities, publicRead) {
@@ -4330,9 +4309,6 @@ var PROD_ENV_NAMES = /* @__PURE__ */ new Set(["prod", "production"]);
 async function secretsPush(options) {
   await secretsPushImpl(options, true);
 }
-async function secretsPushAfterPreflight(options) {
-  await secretsPushImpl(options, false);
-}
 async function secretsPushImpl(options, preflight) {
   const out = options.stdout ?? console;
   const cfg = await loadProjectConfig(options.configPath);
@@ -4739,28 +4715,31 @@ async function smoke(options) {
   const out = options.stdout ?? console;
   const cfg = await loadProjectConfig(options.configPath);
   const env = resolveEnv(cfg, options.env);
-  const credentials = readCredentials(cfg.local.credentialsFile);
-  if (!credentials) {
+  const runtime = options.runtime === true;
+  const credentials = runtime ? null : readCredentials(cfg.local.credentialsFile);
+  if (!runtime && !credentials) {
     throw new Error(`local credentials missing: ${displayPath(cfg.local.credentialsFile, cfg.rootDir)}. Run "odla-ai provision --write-dev-vars".`);
   }
-  if (credentials.appId !== cfg.app.id) {
+  if (credentials && credentials.appId !== cfg.app.id) {
     throw new Error(`local credentials are for app "${credentials.appId}", but config app is "${cfg.app.id}"`);
   }
-  const entry = credentials.envs[env];
-  if (!entry?.tenantId) {
+  const entry = credentials?.envs[env];
+  if (!runtime && !entry?.tenantId) {
     throw new Error(`local credentials have no tenant for env "${env}". Run "odla-ai provision --write-dev-vars".`);
   }
   const hasDb = cfg.services.includes("db");
   const hasO11y = cfg.services.includes("o11y");
-  if (hasDb && !entry.dbKey) {
+  if (!runtime && hasDb && !entry?.dbKey) {
     throw new Error(`local credentials have no db key for env "${env}". Run "odla-ai provision --write-dev-vars".`);
   }
-  if (hasO11y && !entry.o11yToken) {
+  if (!runtime && hasO11y && !entry?.o11yToken) {
     throw new Error(`local credentials have no o11y token for env "${env}". Run "odla-ai provision --write-dev-vars".`);
   }
   const doFetch = options.fetch ?? fetch;
+  const tenantId = entry?.tenantId ?? resolveTenant(cfg, env).tenant;
   out.log(`smoke: ${cfg.app.id}/${env}`);
-  out.log(`  tenant: ${entry.tenantId}`);
+  out.log(`  mode: ${runtime ? "runtime (Worker-held credentials)" : "local credentials"}`);
+  out.log(`  tenant: ${tenantId}`);
   const publicConfig = await getJson(doFetch, publicConfigUrl(cfg.platformUrl, cfg.app.id, env), void 0);
   out.log(`  public-config: ok`);
   if (cfg.services.includes("ai") && cfg.ai?.provider) {
@@ -4774,7 +4753,7 @@ async function smoke(options) {
     if (mode !== "hosted") throw new Error(`ai mode mismatch: expected "hosted", public-config has "${String(mode ?? "none")}"`);
     out.log("  ai: hosted");
   }
-  if (hasO11y) out.log(`  o11y: credentials present`);
+  if (hasO11y) out.log(runtime ? `  o11y: Worker-held credential` : `  o11y: credentials present`);
   if (cfg.services.includes("calendar")) {
     const token = await getDeveloperToken(
       cfg,
@@ -4793,10 +4772,10 @@ async function smoke(options) {
     out.log(`  calendar: ${status.status}, bookable (booking \u2192 ${status.bookingCalendarId ?? "primary"})`);
   }
   const database = await resolveDatabaseConfig(cfg);
-  if (hasDb) {
+  if (hasDb && !runtime) {
     const expectedSchema = database.schema;
     const expectedEntities = serializedEntities(expectedSchema);
-    const liveSchemaPayload = await getJson(doFetch, `${cfg.dbEndpoint}/app/${encodeURIComponent(entry.tenantId)}/schema`, entry.dbKey);
+    const liveSchemaPayload = await getJson(doFetch, `${cfg.dbEndpoint}/app/${encodeURIComponent(tenantId)}/schema`, entry.dbKey);
     const liveSchema = liveSchemaPayload.schema ?? liveSchemaPayload;
     const liveEntities = serializedEntities(liveSchema);
     if (expectedEntities.length) {
@@ -4806,7 +4785,7 @@ async function smoke(options) {
     out.log(`  schema: ${liveEntities.length} entities`);
     const aggregateEntity = expectedEntities[0] ?? liveEntities[0];
     if (aggregateEntity) {
-      const aggregate = await postJson2(doFetch, `${cfg.dbEndpoint}/app/${encodeURIComponent(entry.tenantId)}/aggregate`, entry.dbKey, {
+      const aggregate = await postJson2(doFetch, `${cfg.dbEndpoint}/app/${encodeURIComponent(tenantId)}/aggregate`, entry.dbKey, {
         ns: aggregateEntity,
         aggregate: { count: true }
       });
@@ -4815,9 +4794,20 @@ async function smoke(options) {
     } else {
       out.log(`  aggregate: skipped (schema has no entities)`);
     }
+  } else if (hasDb) {
+    out.log(`  db: Worker-held credential (direct schema/aggregate skipped)`);
   } else {
     out.log(`  db: skipped (not enabled)`);
   }
+  if (runtime) {
+    const link = cfg.links?.[env];
+    if (!link) throw new Error(`runtime smoke requires links.${env} in odla.config.mjs`);
+    const res = await doFetch(link, { redirect: "manual" });
+    if (res.status < 200 || res.status >= 500) {
+      throw new Error(`runtime target ${new URL(link).origin} returned ${res.status}`);
+    }
+    out.log(`  runtime target: ${res.status}`);
+  }
   const probes = database.integrations.flatMap(
     (integration) => (integration.probes ?? []).map((probe) => ({ integration: integration.id, probe }))
   );
@@ -5020,10 +5010,11 @@ async function projectCommand(command, parsed, deps) {
     return true;
   }
   if (command === "smoke") {
-    assertArgs(parsed, ["config", "env", "token", "email", "open"], 1);
+    assertArgs(parsed, ["config", "env", "runtime", "token", "email", "open"], 1);
     await smoke({
       configPath: stringOpt(parsed.options.config) ?? "odla.config.mjs",
       env: stringOpt(parsed.options.env),
+      runtime: parsed.options.runtime === true,
       token: stringOpt(parsed.options.token),
       email: stringOpt(parsed.options.email),
       open: parsed.options.open === false ? false : parsed.options.open === true ? true : void 0,
@@ -8697,6 +8688,55 @@ function requireName(parsed) {
   return name;
 }
 
+// src/credential-command.ts
+async function responseError(response2) {
+  return redactSecrets((await response2.text()).slice(0, 1e3));
+}
+async function credentialCommand(parsed, deps = {}) {
+  const action2 = parsed.positionals[1] ?? "list";
+  if (action2 !== "list" && action2 !== "revoke") {
+    throw new Error(`unknown credentials action "${action2}". Try "odla-ai credentials list".`);
+  }
+  assertArgs(parsed, ["config", "env", "all", "json", "token", "email", "open"], action2 === "revoke" ? 3 : 2);
+  const cfg = await loadProjectConfig(stringOpt(parsed.options.config) ?? "odla.config.mjs");
+  const doFetch = deps.fetch ?? fetch;
+  const out = deps.stdout ?? console;
+  const token = await getDeveloperToken(cfg, {
+    configPath: cfg.configPath,
+    token: stringOpt(parsed.options.token),
+    email: stringOpt(parsed.options.email),
+    open: parsed.options.open === false ? false : parsed.options.open === true ? true : void 0,
+    openApprovalUrl: deps.openUrl
+  }, doFetch, out, { optionalProjectCapabilities: ["app.manage"] });
+  const base = `${cfg.platformUrl}/registry/apps/${encodeURIComponent(cfg.app.id)}/runtime-credentials`;
+  if (action2 === "revoke") {
+    const id = parsed.positionals[2];
+    if (!id) throw new Error("credentials revoke requires the exact receipt id from credentials list");
+    const response3 = await doFetch(`${base}/${encodeURIComponent(id)}`, {
+      method: "DELETE",
+      headers: { authorization: `Bearer ${token}` }
+    });
+    if (!response3.ok) throw new Error(`runtime credential revoke failed (${response3.status}): ${await responseError(response3)}`);
+    const body2 = await response3.json();
+    return out.log(parsed.options.json === true ? JSON.stringify(body2, null, 2) : `revoked ${body2.receipt.id} (${body2.receipt.env} ${body2.receipt.target.scriptName})`);
+  }
+  const query = new URLSearchParams();
+  const requestedEnv = stringOpt(parsed.options.env);
+  if (requestedEnv) query.set("env", requestedEnv);
+  const response2 = await doFetch(`${base}${query.size ? `?${query}` : ""}`, {
+    headers: { authorization: `Bearer ${token}` }
+  });
+  if (!response2.ok) throw new Error(`runtime credential inventory failed (${response2.status}): ${await responseError(response2)}`);
+  const body = await response2.json();
+  const credentials = parsed.options.all === true ? body.credentials : body.credentials.filter((item) => item.state === "committed");
+  if (parsed.options.json === true) return out.log(JSON.stringify({ credentials }, null, 2));
+  if (!credentials.length) return out.log("no active runtime credential receipts");
+  out.log("RECEIPT	ENV	TARGET	CREATED");
+  for (const item of credentials) {
+    out.log(`${item.id}	${item.env}	${item.target.accountId ?? "local"}/${item.target.scriptName}	${new Date(item.createdAt).toISOString()}`);
+  }
+}
+
 // src/help-usage.ts
 var USAGE_SECTION = `
 Start here:
@@ -8815,7 +8855,9 @@ Usage:
   odla-ai security run [target] --ack-redacted-source [--env dev] [--profile odla] [--fail-on high]
   odla-ai security run [target] --self --ack-redacted-source
   odla-ai provision [--live] [--config odla.config.mjs] [--email <odla-account>] [--request-grant] [--wait <seconds>] [--dry-run] [--push-secrets] [--rotate-o11y-token] [--write-dev-vars[=path]] [--yes]
-  odla-ai smoke [--config odla.config.mjs] [--env dev] [--email <odla-account>] [--no-open]
+  odla-ai credentials list [--config odla.config.mjs] [--env dev] [--all] [--json]
+  odla-ai credentials revoke <receipt-id> [--config odla.config.mjs] [--json]
+  odla-ai smoke [--config odla.config.mjs] [--env dev] [--runtime] [--email <odla-account>] [--no-open]
   odla-ai skill install [--dir <project>] [--agent <name>] [--global] [--force]
   odla-ai secrets push --env <env> [--config odla.config.mjs] [--dry-run] [--yes]
   odla-ai secrets set <name> --env <env> (--from-env <NAME>|--stdin) [--email <odla-account>] [--config odla.config.mjs] [--yes]
@@ -8917,7 +8959,7 @@ Commands:
                "provision --live --yes" initializes only the live instance of
                an existing sandbox app and enables every configured service;
                no edit to the dev-first envs list is required.
-  smoke        Verify credentials, public-config, composed schema, db aggregate, and integration probes.
+  smoke        Verify local service access, or use --runtime for a Worker-held credential deployment.
   skill        Same installer; --agent accepts all, claude, codex, cursor,
                copilot, gemini, or agents (repeatable or comma-separated).
   secrets      Push configured db/o11y secrets into the Worker via wrangler
@@ -8937,9 +8979,13 @@ Safety:
   pinned versions of every external @odla-ai runtime module before importing
   the command graph. A stale workspace module blocks with its resolved path and
   tells the agent to update/rebase, npm ci, and rebuild.
-  Provision caches the approved developer token and service credentials under
-  .odla/ with mode 0600, and init adds those paths to .gitignore. Secret push
-  preflights Wrangler before any shown-once issuance or destructive rotation.
+  Provision caches the approved developer token under .odla/ with mode 0600.
+  Local-only development provisioning may also cache that developer's service
+  credentials there. \`provision --push-secrets\` instead stages a fresh,
+  independently revocable credential set through the approved handshake,
+  transfers the complete set to the exact Worker with \`wrangler secret bulk\`
+  over stdin, and never writes its plaintext under .odla. Secret push preflights
+  Wrangler before shown-once issuance; it never rotates sibling credentials.
   Projectless PM, Discussions, o11y, runbook, and identity commands use
   --platform/--app/--env, ODLA_PLATFORM_URL/ODLA_APP_ID/ODLA_ENV, and
   ODLA_DEV_TOKEN. Save non-secret scope metadata with "context save", then
@@ -8953,12 +8999,11 @@ Safety:
   attempts to open it \u2014 including in CI, SSH, display-less, and agent-driven
   shells. Only --no-open suppresses the attempt. Browser launch is best-effort:
   agents with browser control must open that exact URL immediately; otherwise
-  they must give it to the human verbatim. A started handshake is persisted
-  under .odla/, so a command killed mid-wait loses nothing \u2014 rerunning resumes
-  the same code. Outside an interactive terminal the wait is capped (90s by
+  they must give it to the human verbatim. A device code remains only in the
+  running process. Outside an interactive terminal the wait is capped (90s by
   default, --wait <seconds> to change); a still-pending handshake then exits
-  with code 75: open the same URL (or relay it if browser control is unavailable),
-  wait for approval, and re-run to collect.
+  with code 75. Rerunning always requests and opens a new code; older clients'
+  persisted pending state is discarded.
   A fresh device handshake requires --email <odla-account> or ODLA_USER_EMAIL.
   The email is a non-secret identity hint: never provide a password or session
   token. It is the email shown by the signed-in odla account \u2014 never infer it
@@ -10863,7 +10908,7 @@ async function issueO11yToken(opts) {
   );
   if (res.status === 409 && !opts.rotateO11y) {
     throw new Error(
-      `o11y token already exists for env "${opts.env}", but its shown-once value is not in the local credentials file; run "odla-ai provision --rotate-o11y-token --push-secrets" to replace it explicitly`
+      `o11y token already exists for env "${opts.env}", but its shown-once value is not in the local credentials file; run "odla-ai provision --push-secrets" to install a separate runtime credential without rotating siblings`
     );
   }
   if (!res.ok) throw new Error(`o11y token ${opts.rotateO11y ? "rotation" : "issue"} (${opts.env}) failed: ${res.status} ${await safeText7(res)}`);
@@ -10879,6 +10924,88 @@ async function safeText7(res) {
   }
 }
 
+// src/runtime-credentials.ts
+import { randomUUID as randomUUID3 } from "crypto";
+function runtimeUrl(cfg, suffix = "") {
+  return `${cfg.platformUrl}/registry/apps/${encodeURIComponent(cfg.app.id)}/runtime-credentials${suffix}`;
+}
+async function safeError(response2) {
+  const text2 = await response2.text();
+  return redactSecrets(text2.slice(0, 1e3));
+}
+async function finish(doFetch, cfg, token, sessionId, method) {
+  return doFetch(runtimeUrl(cfg, `/${encodeURIComponent(sessionId)}`), {
+    method,
+    headers: { authorization: `Bearer ${token}` }
+  });
+}
+async function deliverRuntimeCredentials(cfg, options) {
+  const doFetch = options.fetch ?? fetch;
+  const run = options.runner ?? defaultRunner;
+  const wranglerEnv = options.env === "prod" || options.env === "production" ? void 0 : options.env;
+  const target = await wranglerRuntimeTarget(run, {
+    cwd: cfg.rootDir,
+    env: wranglerEnv
+  });
+  const issue = await doFetch(runtimeUrl(cfg), {
+    method: "POST",
+    headers: {
+      authorization: `Bearer ${options.developerToken}`,
+      "content-type": "application/json"
+    },
+    body: JSON.stringify({
+      env: options.env,
+      idempotencyKey: `wrangler:${randomUUID3()}`,
+      target
+    })
+  });
+  const body = await issue.json().catch(() => null);
+  if (!issue.ok || typeof body?.sessionId !== "string" || !body.secrets || typeof body.secrets !== "object") {
+    const detail = body?.error?.code ?? body?.error?.message ?? issue.status;
+    throw new Error(`runtime credential staging failed: ${String(detail)}`);
+  }
+  const secrets = body.secrets;
+  const values = {};
+  for (const name of ["ODLA_API_KEY", "ODLA_O11Y_TOKEN"]) {
+    const value2 = secrets[name];
+    if (typeof value2 === "string" && value2) values[name] = value2;
+  }
+  if (Object.keys(values).length === 0) {
+    await finish(doFetch, cfg, options.developerToken, body.sessionId, "DELETE");
+    throw new Error("runtime credential staging returned no configured service credentials");
+  }
+  const pushed = await wranglerBulkSecrets(run, {
+    secrets: values,
+    env: wranglerEnv,
+    cwd: cfg.rootDir
+  });
+  if (pushed.code !== 0) {
+    await finish(doFetch, cfg, options.developerToken, body.sessionId, "DELETE");
+    const detail = redactSecrets(`${pushed.stderr || pushed.stdout}`.trim());
+    throw new Error(`wrangler secret bulk failed (exit ${pushed.code}): ${detail}`);
+  }
+  const committed = await finish(
+    doFetch,
+    cfg,
+    options.developerToken,
+    body.sessionId,
+    "POST"
+  );
+  if (!committed.ok) {
+    await finish(doFetch, cfg, options.developerToken, body.sessionId, "DELETE");
+    throw new Error(`runtime credential receipt commit failed: ${await safeError(committed)}`);
+  }
+  options.stdout?.log(
+    `${options.env}: installed ${Object.keys(values).join(" + ")} on ${target.accountId}/${target.scriptName}${target.environment ? ` (${target.environment})` : ""}; plaintext stayed in memory`
+  );
+  return {
+    sessionId: body.sessionId,
+    target,
+    ...values.ODLA_API_KEY ? { dbKey: values.ODLA_API_KEY } : {},
+    ...values.ODLA_O11Y_TOKEN ? { o11yToken: values.ODLA_O11Y_TOKEN } : {}
+  };
+}
+
 // src/provision-live.ts
 function liveProvisionConfig(cfg) {
   if (!cfg.envs.includes("dev")) {
@@ -10912,8 +11039,10 @@ async function provision(options) {
   if (options.rotateO11yToken && !hasO11y) {
     throw new Error("--rotate-o11y-token requires the o11y service in odla.config.mjs");
   }
-  if (options.pushSecrets && options.writeCredentials === false) {
-    throw new Error("--push-secrets cannot be combined with --no-write-credentials");
+  if (options.pushSecrets && (options.rotateKeys || options.rotateO11yToken)) {
+    throw new Error(
+      "--push-secrets always issues an independent runtime credential set; do not combine it with destructive rotation flags"
+    );
   }
   out.log(`odla-ai: ${plan.appName} (${plan.appId})`);
   out.log(`  platform: ${plan.platformUrl}`);
@@ -10950,7 +11079,7 @@ async function provision(options) {
     out.log(`  secrets: ${options.pushSecrets ? "push configured Worker secrets" : "local only"}`);
     return;
   }
-  let credentials = readCredentials(cfg.local.credentialsFile);
+  let credentials = options.pushSecrets ? null : readCredentials(cfg.local.credentialsFile);
   if (credentials && credentials.appId !== cfg.app.id) {
     throw new Error(
       `credentials at ${displayPath(cfg.local.credentialsFile, cfg.rootDir)} are for "${credentials.appId}", not "${cfg.app.id}"`
@@ -10959,7 +11088,7 @@ async function provision(options) {
   const rotatesO11y = !!(options.rotateKeys || options.rotateO11yToken);
   const missingO11y = cfg.envs.some((env) => !credentials?.envs[env]?.o11yToken);
   const missingDb = cfg.envs.some((env) => !credentials?.envs[env]?.dbKey);
-  const losesShownOnceCredential = hasDb && (!!options.rotateKeys || missingDb) || hasO11y && (rotatesO11y || missingO11y);
+  const losesShownOnceCredential = !options.pushSecrets && (hasDb && (!!options.rotateKeys || missingDb) || hasO11y && (rotatesO11y || missingO11y));
   if (options.writeCredentials === false && losesShownOnceCredential) {
     throw new Error("credential issuance/rotation requires the private credentials file; remove --no-write-credentials");
   }
@@ -11033,38 +11162,42 @@ async function provision(options) {
       await applyCalendarBookingPage(calendarCtx, calendarBookingPageUrl(cfg, env), out);
     }
   }
+  let devVarsCredentials = credentials;
   for (const env of cfg.envs) {
     const tenantId = tenantIdFor5(cfg.app.id, env);
-    credentials = await provisionEnvCredentials({
-      cfg,
-      env,
-      developerToken: token,
-      credentials,
-      rotateDb: !!options.rotateKeys,
-      rotateO11y: rotatesO11y,
-      write: options.writeCredentials !== false,
-      fetch: doFetch,
-      stdout: out
-    });
-    const dbKey = credentials.envs[env]?.dbKey;
+    let dbKey;
     if (options.pushSecrets) {
-      try {
-        await secretsPushAfterPreflight({
-          configPath: cfg.configPath,
-          env,
-          yes: options.yes,
-          runner: options.secretRunner,
-          stdout: out
-        });
-      } catch (error) {
-        const message2 = error instanceof Error ? error.message : String(error);
-        const consent = env === "prod" || env === "production" ? " --yes" : "";
-        throw new Error(
-          `${message2}
-${env}: credentials are already saved; retry "odla-ai secrets push --env ${env}${consent}" without issuing or rotating again`,
-          { cause: error }
-        );
-      }
+      const delivered = await deliverRuntimeCredentials(cfg, {
+        env,
+        developerToken: token,
+        fetch: doFetch,
+        runner: options.secretRunner,
+        stdout: out
+      });
+      dbKey = delivered.dbKey;
+      devVarsCredentials = mergeCredential(devVarsCredentials, {
+        appId: cfg.app.id,
+        platformUrl: cfg.platformUrl,
+        dbEndpoint: cfg.dbEndpoint,
+        env,
+        tenantId,
+        ...delivered.dbKey ? { dbKey: delivered.dbKey } : {},
+        ...delivered.o11yToken ? { o11yToken: delivered.o11yToken } : {}
+      });
+    } else {
+      credentials = await provisionEnvCredentials({
+        cfg,
+        env,
+        developerToken: token,
+        credentials,
+        rotateDb: !!options.rotateKeys,
+        rotateO11y: rotatesO11y,
+        write: options.writeCredentials !== false,
+        fetch: doFetch,
+        stdout: out
+      });
+      devVarsCredentials = credentials;
+      dbKey = credentials.envs[env]?.dbKey;
     }
     if (schema && dbKey) {
       await postJson(doFetch, `${cfg.dbEndpoint}/app/${encodeURIComponent(tenantId)}/schema`, dbKey, { schema });
@@ -11088,13 +11221,13 @@ ${env}: credentials are already saved; retry "odla-ai secrets push --env ${env}$
       }
     }
   }
-  if (options.writeCredentials !== false && credentials) {
+  if (!options.pushSecrets && options.writeCredentials !== false && credentials) {
     const ignored = cfg.local.gitignore && gitignoreEntry(cfg.rootDir, cfg.local.credentialsFile);
     out.log(`credentials: wrote ${displayPath(cfg.local.credentialsFile, cfg.rootDir)} (0600${ignored ? ", gitignored" : ""})`);
   }
-  if (devVarsTarget && credentials) {
+  if (devVarsTarget && devVarsCredentials) {
     const env = cfg.envs.includes("dev") ? "dev" : cfg.envs[0] ?? "prod";
-    writeDevVars(devVarsTarget, credentials, env, o11yDevVars(cfg));
+    writeDevVars(devVarsTarget, devVarsCredentials, env, o11yDevVars(cfg));
     out.log(`dev vars: wrote ${displayPath(devVarsTarget, cfg.rootDir)} for ${env}`);
   }
   if (cfg.services.includes("calendar")) {
@@ -11185,6 +11318,7 @@ var COMMAND_SURFACE = {
   code: { connect: {} },
   config: { diff: {}, plan: {}, apply: {} },
   context: { show: {}, list: {}, save: {}, remove: {} },
+  credentials: { list: {}, revoke: {} },
   // `watch`, `read`, `reply`, and `resolve` take a topic id from there on.
   discuss: {
     groups: {},
@@ -12869,6 +13003,10 @@ async function runCli(argv = process.argv.slice(2), dependencies = {}) {
     await contextCommand(parsed, runtime);
     return;
   }
+  if (command === "credentials") {
+    await credentialCommand(parsed, runtime);
+    return;
+  }
   if (command === "runbook") {
     await runbookCommand(parsed, runtime);
     return;
@@ -13056,4 +13194,4 @@ export {
   isTerminalHostedSecurityStatus,
   runCli
 };
-//# sourceMappingURL=chunk-YTVLTADT.js.map
+//# sourceMappingURL=chunk-7V7WVTDT.js.map