@odla-ai/cli 0.35.0 → 0.35.3

package/dist/bin.js

@@ -174,7 +174,7 @@ function absoluteEntryPath(entryPath) {
 
 // src/bin.ts
 var argv = process.argv.slice(2);
-requireCurrentCliForProvision(argv).then(() => requireCoherentProvisionRuntime(argv)).then(async () => (await import("./cli-Z5NSTS75.js")).runCli()).catch((err) => {
+requireCurrentCliForProvision(argv).then(() => requireCoherentProvisionRuntime(argv)).then(async () => (await import("./cli-ZBNA7J4T.js")).runCli()).catch((err) => {
   console.error(redactSecrets(`odla-ai: ${err instanceof Error ? err.message : String(err)}`));
   process.exitCode = exitCodeFor(err);
 });

package/dist/{chunk-EG23MPUC.js → chunk-PYR73XBD.js}

@@ -149,6 +149,29 @@ function handshakeWaitMs(waitSeconds, interactive = process4.stdout.isTTY === tr
   return interactive ? void 0 : 9e4;
 }
 
+// src/cached-credential.ts
+import { rmSync as rmSync2 } from "fs";
+var noted = null;
+function noteCachedCredential(tokenFile) {
+  noted = tokenFile;
+}
+function isCredentialRejection(error) {
+  const message2 = error instanceof Error ? error.message : String(error ?? "");
+  return /\((401|403)\)\s*$/.test(message2.trim());
+}
+function explainRejectedCredential(error) {
+  const tokenFile = noted;
+  if (!tokenFile || !isCredentialRejection(error)) return null;
+  noted = null;
+  rmSync2(tokenFile, { force: true });
+  return [
+    "auth: the cached credential was rejected by odla, so it was revoked before its cached expiry.",
+    "   The usual cause is a newer sign-in for this project: collecting a handshake retires the",
+    "   principal's other credentials, so a second terminal or worktree supersedes this one.",
+    `   Discarded ${tokenFile}; re-run this command to request a fresh approval.`
+  ].join("\n");
+}
+
 // src/local.ts
 import { chmodSync, existsSync, mkdirSync, readFileSync, renameSync, writeFileSync } from "fs";
 import { dirname as dirname2, isAbsolute, relative, resolve } from "path";
@@ -294,6 +317,7 @@ async function getDeveloperToken(cfg, options, doFetch, out, grantRequest = {})
     }
     if (cached?.token && cached.platform === audience && (cached.expiresAt ?? 0) > Date.now() + 6e4 && cachedGrantCovers(cached, grantIntent)) {
       out.error(`auth: using cached developer token (${displayPath(cfg.local.tokenFile, cfg.rootDir)})`);
+      noteCachedCredential(cfg.local.tokenFile);
       return cached.token;
     }
   } else {
@@ -13279,6 +13303,29 @@ function recordInvocation(parsed) {
   }
 }
 
+// src/advisory-output.ts
+import { formatAdvisory, parseAdvisories } from "@odla-ai/apps";
+function advisoryCollectingFetch(inner, sink) {
+  return (async (input, init) => {
+    const response2 = await inner(input, init);
+    try {
+      sink.push(...parseAdvisories(response2));
+    } catch {
+    }
+    return response2;
+  });
+}
+function renderAdvisories(out, advisories, env = process.env) {
+  if (env.ODLA_NO_ADVISORIES) return;
+  const seen = /* @__PURE__ */ new Set();
+  for (const advisory of advisories) {
+    const key = `${advisory.code}:${advisory.message}`;
+    if (seen.has(key)) continue;
+    seen.add(key);
+    out.error(formatAdvisory(advisory));
+  }
+}
+
 // src/runbook-actions.ts
 import { readFileSync as readFileSync9 } from "fs";
 var PLATFORM_SCOPE = "$platform";
@@ -13309,9 +13356,20 @@ async function bySlug(ctx, slug) {
     "GET",
     `/runbook?app=${encodeURIComponent(ctx.appId)}&slug=${encodeURIComponent(slug)}&limit=1`
   );
-  const found = page2.records[0];
-  if (!found) throw new Error(`no runbook "${slug}" in ${ctx.appId}`);
-  return found;
+  const filtered = page2.records.find((record11) => record11.slug === slug);
+  if (filtered) return filtered;
+  const limit = 100;
+  for (let offset = 0; ; offset += limit) {
+    const fallback = await call(
+      ctx,
+      "GET",
+      `/runbook?app=${encodeURIComponent(ctx.appId)}&limit=${limit}&offset=${offset}`
+    );
+    const found = fallback.records.find((record11) => record11.slug === slug);
+    if (found) return found;
+    if (!fallback.records.length || offset + fallback.records.length >= fallback.total) break;
+  }
+  throw new Error(`no runbook "${slug}" in ${ctx.appId}`);
 }
 function readBody(file, inline) {
   if (inline !== void 0) return inline;
@@ -13396,7 +13454,7 @@ async function runbookRevert(ctx, slug, version) {
     ctx,
     "POST",
     `/runbook/${encodeURIComponent(runbook.id)}/revert`,
-    { version }
+    { version, expectedVersion: runbook.version }
   );
   if (ctx.json) return ctx.out.log(JSON.stringify(result, null, 2));
   ctx.out.log(`${slug} reverted to v${version}, now v${result.record?.version ?? runbook.version + 1}`);
@@ -13885,7 +13943,7 @@ async function runbookComment(ctx, slug, body) {
 
 // src/runbook-editor.ts
 import { spawnSync } from "child_process";
-import { mkdtempSync, readFileSync as readFileSync12, rmSync as rmSync2, writeFileSync as writeFileSync4 } from "fs";
+import { mkdtempSync, readFileSync as readFileSync12, rmSync as rmSync3, writeFileSync as writeFileSync4 } from "fs";
 import { tmpdir as tmpdir4 } from "os";
 import { join as join15 } from "path";
 import process15 from "process";
@@ -13922,7 +13980,7 @@ function editText(initial, slug, deps = {}) {
     const edited = readFileSync12(file, "utf8");
     return edited === initial ? null : edited;
   } finally {
-    rmSync2(dir, { recursive: true, force: true });
+    rmSync3(dir, { recursive: true, force: true });
   }
 }
 var defaultRunOrInjected = (deps) => deps.run ?? defaultRun;
@@ -14810,6 +14868,23 @@ async function securityStatus(parsed, dependencies) {
 
 // src/cli.ts
 async function runCli(argv = process.argv.slice(2), dependencies = {}) {
+  const out = redactingOutput(dependencies.stdout ?? console);
+  const advisories = [];
+  const withAdvisoryReader = {
+    ...dependencies,
+    fetch: advisoryCollectingFetch(dependencies.fetch ?? fetch, advisories)
+  };
+  try {
+    return await dispatchCli(argv, withAdvisoryReader);
+  } catch (error) {
+    const explanation = explainRejectedCredential(error);
+    if (explanation) out.error(explanation);
+    throw error;
+  } finally {
+    renderAdvisories(out, advisories);
+  }
+}
+async function dispatchCli(argv, dependencies) {
   const runtime = {
     ...dependencies,
     stdout: redactingOutput(dependencies.stdout ?? console)
@@ -15034,4 +15109,4 @@ export {
   isTerminalHostedSecurityStatus,
   runCli
 };
-//# sourceMappingURL=chunk-EG23MPUC.js.map
+//# sourceMappingURL=chunk-PYR73XBD.js.map