@odla-ai/cli 0.35.0 → 0.35.3

package/dist/{cli-Z5NSTS75.js → cli-ZBNA7J4T.js}

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import {
   runCli
-} from "./chunk-EG23MPUC.js";
+} from "./chunk-PYR73XBD.js";
 import {
   exitCodeFor
 } from "./chunk-UKLSRQ5J.js";
@@ -9,4 +9,4 @@ export {
   exitCodeFor,
   runCli
 };
-//# sourceMappingURL=cli-Z5NSTS75.js.map
+//# sourceMappingURL=cli-ZBNA7J4T.js.map

package/dist/index.cjs

@@ -236,13 +236,36 @@ function handshakeWaitMs(waitSeconds, interactive = import_node_process3.default
   return interactive ? void 0 : 9e4;
 }
 
-// src/local.ts
+// src/cached-credential.ts
 var import_node_fs2 = require("fs");
+var noted = null;
+function noteCachedCredential(tokenFile) {
+  noted = tokenFile;
+}
+function isCredentialRejection(error) {
+  const message2 = error instanceof Error ? error.message : String(error ?? "");
+  return /\((401|403)\)\s*$/.test(message2.trim());
+}
+function explainRejectedCredential(error) {
+  const tokenFile = noted;
+  if (!tokenFile || !isCredentialRejection(error)) return null;
+  noted = null;
+  (0, import_node_fs2.rmSync)(tokenFile, { force: true });
+  return [
+    "auth: the cached credential was rejected by odla, so it was revoked before its cached expiry.",
+    "   The usual cause is a newer sign-in for this project: collecting a handshake retires the",
+    "   principal's other credentials, so a second terminal or worktree supersedes this one.",
+    `   Discarded ${tokenFile}; re-run this command to request a fresh approval.`
+  ].join("\n");
+}
+
+// src/local.ts
+var import_node_fs3 = require("fs");
 var import_node_path2 = require("path");
 var GITIGNORE_LINES = [".odla/*.local.json", ".odla/dev-token.json", ".dev.vars"];
 function readJsonFile(path) {
   try {
-    return JSON.parse((0, import_node_fs2.readFileSync)(path, "utf8"));
+    return JSON.parse((0, import_node_fs3.readFileSync)(path, "utf8"));
   } catch {
     return null;
   }
@@ -252,10 +275,10 @@ function writePrivateJson(path, value2) {
 `);
 }
 function readCredentials(path) {
-  if (!(0, import_node_fs2.existsSync)(path)) return null;
+  if (!(0, import_node_fs3.existsSync)(path)) return null;
   let value2;
   try {
-    value2 = JSON.parse((0, import_node_fs2.readFileSync)(path, "utf8"));
+    value2 = JSON.parse((0, import_node_fs3.readFileSync)(path, "utf8"));
   } catch {
     throw new Error(`credentials file ${path} is not valid JSON; fix or remove it before provisioning`);
   }
@@ -286,13 +309,13 @@ function mergeCredential(current, update) {
 }
 function ensureGitignore(rootDir, localPaths = []) {
   const path = (0, import_node_path2.resolve)(rootDir, ".gitignore");
-  const existing = (0, import_node_fs2.existsSync)(path) ? (0, import_node_fs2.readFileSync)(path, "utf8") : "";
+  const existing = (0, import_node_fs3.existsSync)(path) ? (0, import_node_fs3.readFileSync)(path, "utf8") : "";
   const configured = localPaths.map((localPath) => gitignoreEntry(rootDir, localPath)).filter((line2) => !!line2);
   const wanted = [.../* @__PURE__ */ new Set([...GITIGNORE_LINES, ...configured])];
   const missing = wanted.filter((line2) => !existing.split(/\r?\n/).includes(line2));
   if (missing.length === 0) return;
   const prefix = existing && !existing.endsWith("\n") ? "\n" : "";
-  (0, import_node_fs2.writeFileSync)(path, `${existing}${prefix}${missing.join("\n")}
+  (0, import_node_fs3.writeFileSync)(path, `${existing}${prefix}${missing.join("\n")}
 `);
 }
 function o11yDevVars(cfg) {
@@ -320,7 +343,7 @@ function writeDevVars(path, credentials, env, o11y) {
     if (o11y.version) lines.push(`ODLA_O11Y_VERSION="${o11y.version}"`);
     if (entry.o11yToken) lines.push(`ODLA_O11Y_TOKEN="${entry.o11yToken}"`);
   }
-  const existing = (0, import_node_fs2.existsSync)(path) ? (0, import_node_fs2.readFileSync)(path, "utf8") : "";
+  const existing = (0, import_node_fs3.existsSync)(path) ? (0, import_node_fs3.readFileSync)(path, "utf8") : "";
   const retained = existing.split(/\r?\n/).filter((line2) => !isManagedDevVar(line2));
   while (retained.at(-1) === "") retained.pop();
   const prefix = retained.length ? `${retained.join("\n")}
@@ -346,11 +369,11 @@ function isManagedDevVar(line2) {
   return !!match?.[1] && MANAGED_DEV_VARS.has(match[1]);
 }
 function writePrivateText(path, text3) {
-  (0, import_node_fs2.mkdirSync)((0, import_node_path2.dirname)(path), { recursive: true });
+  (0, import_node_fs3.mkdirSync)((0, import_node_path2.dirname)(path), { recursive: true });
   const temporary = `${path}.tmp-${process.pid}-${Date.now()}`;
-  (0, import_node_fs2.writeFileSync)(temporary, text3, { mode: 384 });
-  (0, import_node_fs2.chmodSync)(temporary, 384);
-  (0, import_node_fs2.renameSync)(temporary, path);
+  (0, import_node_fs3.writeFileSync)(temporary, text3, { mode: 384 });
+  (0, import_node_fs3.chmodSync)(temporary, 384);
+  (0, import_node_fs3.renameSync)(temporary, path);
 }
 function gitignoreEntry(rootDir, path) {
   const rel = (0, import_node_path2.relative)((0, import_node_path2.resolve)(rootDir), (0, import_node_path2.resolve)(path));
@@ -381,6 +404,7 @@ async function getDeveloperToken(cfg, options, doFetch, out, grantRequest = {})
     }
     if (cached?.token && cached.platform === audience && (cached.expiresAt ?? 0) > Date.now() + 6e4 && cachedGrantCovers(cached, grantIntent)) {
       out.error(`auth: using cached developer token (${displayPath(cfg.local.tokenFile, cfg.rootDir)})`);
+      noteCachedCredential(cfg.local.tokenFile);
       return cached.token;
     }
   } else {
@@ -535,7 +559,7 @@ async function readSecretStream(kind, stream = import_node_process5.default.stdi
 }
 
 // src/admin-ai-auth.ts
-var import_node_fs3 = require("fs");
+var import_node_fs4 = require("fs");
 var import_node_path3 = require("path");
 var import_node_process6 = __toESM(require("process"), 1);
 var import_db2 = require("@odla-ai/db");
@@ -610,7 +634,7 @@ async function scopedToken(platform, scope, options, doFetch, out) {
   if (options.cache !== false) {
     const tokens = cache2?.platform === audience ? { ...cache2.tokens ?? {} } : {};
     tokens[scope] = { token, expiresAt };
-    if ((0, import_node_fs3.existsSync)((0, import_node_path3.join)(rootDir, ".git"))) ensureGitignore(rootDir, [tokenFile]);
+    if ((0, import_node_fs4.existsSync)((0, import_node_path3.join)(rootDir, ".git"))) ensureGitignore(rootDir, [tokenFile]);
     writePrivateJson(tokenFile, { platform: audience, email, tokens });
     out.error(`auth: cached ${scope} grant (${tokenFile}; mode 0600)`);
   } else {
@@ -1042,12 +1066,12 @@ function addOption(options, name, value2) {
 }
 
 // src/operator-context.ts
-var import_node_fs6 = require("fs");
+var import_node_fs7 = require("fs");
 var import_node_path6 = require("path");
 var import_node_process9 = __toESM(require("process"), 1);
 
 // src/config.ts
-var import_node_fs4 = require("fs");
+var import_node_fs5 = require("fs");
 var import_node_path4 = require("path");
 var import_node_url = require("url");
 var import_apps = require("@odla-ai/apps");
@@ -1454,7 +1478,7 @@ var configImportSerial = 0;
 var GOOGLE_CALENDAR_EVENTS_SCOPE = "https://www.googleapis.com/auth/calendar.events";
 async function loadProjectConfig(configPath = "odla.config.mjs", options = {}) {
   const resolved = (0, import_node_path4.resolve)(configPath);
-  if (!(0, import_node_fs4.existsSync)(resolved)) {
+  if (!(0, import_node_fs5.existsSync)(resolved)) {
     throw new Error(`config not found: ${configPath}. Run "odla-ai init" first or pass --config.`);
   }
   const raw = await loadConfigModule(resolved);
@@ -1489,7 +1513,7 @@ async function resolveDataExport(cfg, value2, names) {
   if (typeof value2 !== "string") return value2;
   const target = (0, import_node_path4.isAbsolute)(value2) ? value2 : (0, import_node_path4.resolve)(cfg.rootDir, value2);
   if (target.endsWith(".json")) {
-    return JSON.parse((0, import_node_fs4.readFileSync)(target, "utf8"));
+    return JSON.parse((0, import_node_fs5.readFileSync)(target, "utf8"));
   }
   const mod = await import((0, import_node_url.pathToFileURL)(target).href);
   for (const name of names) {
@@ -1565,7 +1589,7 @@ function validId2(value2) {
   return typeof value2 === "string" && /^[a-z0-9][a-z0-9-]*$/.test(value2);
 }
 async function loadConfigModule(path) {
-  if (path.endsWith(".json")) return JSON.parse((0, import_node_fs4.readFileSync)(path, "utf8"));
+  if (path.endsWith(".json")) return JSON.parse((0, import_node_fs5.readFileSync)(path, "utf8"));
   const nonce = `${Date.now()}-${configImportSerial++}`;
   const mod = await import(`${(0, import_node_url.pathToFileURL)(path).href}?reload=${nonce}`);
   const value2 = mod.default ?? mod.config;
@@ -1580,7 +1604,7 @@ function unique3(values) {
 }
 
 // src/operator-profiles.ts
-var import_node_fs5 = require("fs");
+var import_node_fs6 = require("fs");
 var import_node_os = require("os");
 var import_node_path5 = require("path");
 var import_node_process8 = __toESM(require("process"), 1);
@@ -1645,10 +1669,10 @@ function assertOperatorName(value2, label) {
   }
 }
 function readOperatorProfiles(file) {
-  if (!(0, import_node_fs5.existsSync)(file)) return emptyProfiles();
+  if (!(0, import_node_fs6.existsSync)(file)) return emptyProfiles();
   let raw;
   try {
-    raw = JSON.parse((0, import_node_fs5.readFileSync)(file, "utf8"));
+    raw = JSON.parse((0, import_node_fs6.readFileSync)(file, "utf8"));
   } catch {
     throw new Error(`operator context file ${file} is not valid JSON`);
   }
@@ -1714,7 +1738,7 @@ async function resolveOperatorContext(parsed, options = {}) {
   const configArgument = stringOpt(parsed.options.config) ?? "odla.config.mjs";
   const configPath = (0, import_node_path6.resolve)(configArgument);
   const explicitConfig = parsed.options.config !== void 0;
-  const hasConfig = (0, import_node_fs6.existsSync)(configPath);
+  const hasConfig = (0, import_node_fs7.existsSync)(configPath);
   if (!hasConfig && (!options.allowMissingConfig || explicitConfig)) {
     await loadProjectConfig(configArgument);
   }
@@ -2180,7 +2204,7 @@ async function appExport(options) {
 }
 
 // src/app-import.ts
-var import_node_fs7 = require("fs");
+var import_node_fs8 = require("fs");
 var import_import = require("@odla-ai/db/import");
 function chooseIdMode(options, rows) {
   const chosen = [options.idField && "field", options.key && "key", options.generateIds && "generate"].filter(Boolean);
@@ -2198,7 +2222,7 @@ async function appImport(options) {
   const out = options.stdout ?? console;
   const say = options.json ? (line2) => out.error(line2) : (line2) => out.log(line2);
   const { tenant } = resolveTenant(cfg, options.env);
-  const text3 = options.file === "-" ? (options.readStdin ?? (() => (0, import_node_fs7.readFileSync)(0, "utf8")))() : (0, import_node_fs7.readFileSync)(options.file, "utf8");
+  const text3 = options.file === "-" ? (options.readStdin ?? (() => (0, import_node_fs8.readFileSync)(0, "utf8")))() : (0, import_node_fs8.readFileSync)(options.file, "utf8");
   const { format, sources } = (0, import_import.parseImport)(text3, options.ns);
   if (format === "namespace-map" && options.ns) {
     throw new Error("--ns cannot be combined with a {namespace: rows} file \u2014 the file already names each namespace");
@@ -3114,9 +3138,9 @@ var import_apps6 = require("@odla-ai/apps");
 var import_node_path8 = require("path");
 
 // src/version.ts
-var import_node_fs8 = require("fs");
+var import_node_fs9 = require("fs");
 function cliVersion() {
-  const pkg = JSON.parse((0, import_node_fs8.readFileSync)(new URL("../package.json", importMetaUrl), "utf8"));
+  const pkg = JSON.parse((0, import_node_fs9.readFileSync)(new URL("../package.json", importMetaUrl), "utf8"));
   return pkg.version ?? "unknown";
 }
 
@@ -3132,7 +3156,7 @@ var ConfigOperationCommandError = class extends Error {
 
 // src/config-operation-validate.ts
 var import_apps3 = require("@odla-ai/apps");
-var import_node_fs9 = require("fs");
+var import_node_fs10 = require("fs");
 
 // src/config-reconcile-digest.ts
 var import_node_crypto2 = require("crypto");
@@ -3168,7 +3192,7 @@ var SERVICE = /^[a-z][a-z0-9-]{0,39}$/;
 function readPlan(path) {
   let value2;
   try {
-    const raw = (0, import_node_fs9.readFileSync)(path, "utf8");
+    const raw = (0, import_node_fs10.readFileSync)(path, "utf8");
     if (Buffer.byteLength(raw) > 128 * 1024) throw new Error("plan exceeds 128 KiB");
     value2 = JSON.parse(raw);
   } catch (error) {
@@ -4024,12 +4048,12 @@ function quoteArg2(value2) {
 
 // src/doctor-checks.ts
 var import_node_child_process3 = require("child_process");
-var import_node_fs11 = require("fs");
+var import_node_fs12 = require("fs");
 var import_node_path11 = require("path");
 
 // src/wrangler.ts
 var import_node_child_process2 = require("child_process");
-var import_node_fs10 = require("fs");
+var import_node_fs11 = require("fs");
 var import_node_path10 = require("path");
 var defaultRunner = (cmd, args, opts) => new Promise((resolvePromise, reject) => {
   const child = (0, import_node_child_process2.spawn)(cmd, args, { cwd: opts?.cwd, stdio: ["pipe", "pipe", "pipe"] });
@@ -4045,14 +4069,14 @@ var WRANGLER_CONFIG_FILES = ["wrangler.jsonc", "wrangler.json", "wrangler.toml"]
 function findWranglerConfig(rootDir) {
   for (const name of WRANGLER_CONFIG_FILES) {
     const path = (0, import_node_path10.join)(rootDir, name);
-    if ((0, import_node_fs10.existsSync)(path)) return path;
+    if ((0, import_node_fs11.existsSync)(path)) return path;
   }
   return null;
 }
 function readWranglerConfig(path) {
   if (path.endsWith(".toml")) return null;
   try {
-    return JSON.parse(stripJsonComments((0, import_node_fs10.readFileSync)(path, "utf8")));
+    return JSON.parse(stripJsonComments((0, import_node_fs11.readFileSync)(path, "utf8")));
   } catch {
     return null;
   }
@@ -4205,7 +4229,7 @@ function wranglerWarnings(rootDir) {
       const dir = (0, import_node_path11.resolve)(rootDir, assets.directory);
       if (dir === (0, import_node_path11.resolve)(rootDir)) {
         warnings.push(`${label}assets.directory is the project root \u2014 point it at a dedicated build dir (wrangler dev fails with "spawn EBADF")`);
-      } else if ((0, import_node_fs11.existsSync)((0, import_node_path11.join)(dir, "node_modules"))) {
+      } else if ((0, import_node_fs12.existsSync)((0, import_node_path11.join)(dir, "node_modules"))) {
         warnings.push(`${label}assets.directory contains node_modules \u2014 wrangler dev's watcher will exhaust file descriptors`);
       }
     }
@@ -4241,12 +4265,12 @@ function o11yProjectWarnings(rootDir) {
     return warnings;
   }
   const main = typeof config.main === "string" ? (0, import_node_path11.resolve)(rootDir, config.main) : null;
-  if (!main || !(0, import_node_fs11.existsSync)(main)) {
+  if (!main || !(0, import_node_fs12.existsSync)(main)) {
     warnings.push("cannot verify o11y Worker instrumentation \u2014 wrangler main is missing or unreadable");
   } else {
     let source = "";
     try {
-      source = (0, import_node_fs11.readFileSync)(main, "utf8");
+      source = (0, import_node_fs12.readFileSync)(main, "utf8");
     } catch {
     }
     if (!/\bwithObservability\b/.test(source)) {
@@ -4270,7 +4294,7 @@ function calendarProjectWarnings(rootDir) {
 }
 function readPackageJson(rootDir) {
   try {
-    return JSON.parse((0, import_node_fs11.readFileSync)((0, import_node_path11.join)(rootDir, "package.json"), "utf8"));
+    return JSON.parse((0, import_node_fs12.readFileSync)((0, import_node_path11.join)(rootDir, "package.json"), "utf8"));
   } catch {
     return null;
   }
@@ -4564,14 +4588,14 @@ function harnessOption(value2, flag) {
 }
 
 // src/init.ts
-var import_node_fs12 = require("fs");
+var import_node_fs13 = require("fs");
 var import_node_path12 = require("path");
 var import_apps9 = require("@odla-ai/apps");
 function initProject(options) {
   const out = options.stdout ?? console;
   const rootDir = (0, import_node_path12.resolve)(options.rootDir ?? process.cwd());
   const configPath = (0, import_node_path12.resolve)(rootDir, options.configPath ?? "odla.config.mjs");
-  if ((0, import_node_fs12.existsSync)(configPath) && !options.force) {
+  if ((0, import_node_fs13.existsSync)(configPath) && !options.force) {
     throw new Error(`${configPath} already exists. Pass --force to overwrite.`);
   }
   if (!/^[a-z0-9][a-z0-9-]*$/.test(options.appId)) {
@@ -4587,10 +4611,10 @@ function initProject(options) {
     }
   }
   const aiProvider = options.aiProvider;
-  (0, import_node_fs12.mkdirSync)((0, import_node_path12.dirname)(configPath), { recursive: true });
-  (0, import_node_fs12.mkdirSync)((0, import_node_path12.resolve)(rootDir, "src/odla"), { recursive: true });
-  (0, import_node_fs12.mkdirSync)((0, import_node_path12.resolve)(rootDir, ".odla"), { recursive: true });
-  (0, import_node_fs12.writeFileSync)(configPath, configTemplate({ appId: options.appId, name: options.name, envs, services, aiProvider }));
+  (0, import_node_fs13.mkdirSync)((0, import_node_path12.dirname)(configPath), { recursive: true });
+  (0, import_node_fs13.mkdirSync)((0, import_node_path12.resolve)(rootDir, "src/odla"), { recursive: true });
+  (0, import_node_fs13.mkdirSync)((0, import_node_path12.resolve)(rootDir, ".odla"), { recursive: true });
+  (0, import_node_fs13.writeFileSync)(configPath, configTemplate({ appId: options.appId, name: options.name, envs, services, aiProvider }));
   writeIfMissing((0, import_node_path12.resolve)(rootDir, "src/odla/schema.mjs"), schemaTemplate());
   writeIfMissing((0, import_node_path12.resolve)(rootDir, "src/odla/rules.mjs"), rulesTemplate());
   ensureGitignore(rootDir);
@@ -4599,8 +4623,8 @@ function initProject(options) {
   out.log("updated .gitignore for local odla credentials");
 }
 function writeIfMissing(path, text3) {
-  if ((0, import_node_fs12.existsSync)(path)) return;
-  (0, import_node_fs12.writeFileSync)(path, text3);
+  if ((0, import_node_fs13.existsSync)(path)) return;
+  (0, import_node_fs13.writeFileSync)(path, text3);
 }
 function configTemplate(input) {
   const calendar = input.services.includes("calendar") ? `  calendar: {
@@ -4896,7 +4920,7 @@ function printReport(report5, out) {
 }
 
 // src/skill.ts
-var import_node_fs13 = require("fs");
+var import_node_fs14 = require("fs");
 var import_node_os2 = require("os");
 var import_node_path13 = require("path");
 var import_node_url2 = require("url");
@@ -5012,7 +5036,7 @@ function installSkill(options = {}) {
     plans.set(target, { target, content: content2, boundary, managedMerge });
   };
   const planSkillTree = (targetDir2, boundary = root) => {
-    for (const rel of files) plan((0, import_node_path13.join)(targetDir2, rel), (0, import_node_fs13.readFileSync)((0, import_node_path13.join)(sourceDir, rel), "utf8"), false, boundary);
+    for (const rel of files) plan((0, import_node_path13.join)(targetDir2, rel), (0, import_node_fs14.readFileSync)((0, import_node_path13.join)(sourceDir, rel), "utf8"), false, boundary);
   };
   let targetDir;
   if (options.global) {
@@ -5032,7 +5056,7 @@ function installSkill(options = {}) {
     for (const harness of harnesses) rememberTarget(harness, sharedRoot);
     if (harnesses.includes("claude")) {
       for (const skill of skillNames(files)) {
-        const canonical2 = (0, import_node_fs13.readFileSync)((0, import_node_path13.join)(sourceDir, skill, "SKILL.md"), "utf8");
+        const canonical2 = (0, import_node_fs14.readFileSync)((0, import_node_path13.join)(sourceDir, skill, "SKILL.md"), "utf8");
         plan((0, import_node_path13.join)(claudeRoot, skill, "SKILL.md"), claudeAdapter(skill, canonical2));
       }
       rememberTarget("claude", claudeRoot);
@@ -5067,11 +5091,11 @@ function installSkill(options = {}) {
       conflicts.push(`${file.target} (redirected by symbolic link ${symlink})`);
       continue;
     }
-    if (!(0, import_node_fs13.existsSync)(file.target)) {
+    if (!(0, import_node_fs14.existsSync)(file.target)) {
       writtenPaths.add(file.target);
       continue;
     }
-    const current = (0, import_node_fs13.readFileSync)(file.target, "utf8");
+    const current = (0, import_node_fs14.readFileSync)(file.target, "utf8");
     if (current === file.content) {
       unchangedPaths.add(file.target);
     } else if (file.managedMerge || options.force) {
@@ -5088,9 +5112,9 @@ ${conflicts.map((f) => `  - ${f}`).join("\n")}`
     );
   }
   for (const file of plans.values()) {
-    if (!(0, import_node_fs13.existsSync)(file.target) || (0, import_node_fs13.readFileSync)(file.target, "utf8") !== file.content) {
-      (0, import_node_fs13.mkdirSync)((0, import_node_path13.dirname)(file.target), { recursive: true });
-      (0, import_node_fs13.writeFileSync)(file.target, file.content);
+    if (!(0, import_node_fs14.existsSync)(file.target) || (0, import_node_fs14.readFileSync)(file.target, "utf8") !== file.content) {
+      (0, import_node_fs14.mkdirSync)((0, import_node_path13.dirname)(file.target), { recursive: true });
+      (0, import_node_fs14.writeFileSync)(file.target, file.content);
     }
   }
   const skills = skillNames(files);
@@ -5131,9 +5155,9 @@ function normalizeHarnesses(values, global) {
 function managedFileContent(path, block, force, boundary) {
   const symlink = symlinkedComponent(boundary, path);
   if (symlink) throw new Error(`refusing to manage ${path}: symbolic link component ${symlink}`);
-  if (!(0, import_node_fs13.existsSync)(path)) return `${block}
+  if (!(0, import_node_fs14.existsSync)(path)) return `${block}
 `;
-  const current = (0, import_node_fs13.readFileSync)(path, "utf8");
+  const current = (0, import_node_fs14.readFileSync)(path, "utf8");
   const start = "<!-- odla-ai agent setup:start -->";
   const end = "<!-- odla-ai agent setup:end -->";
   const startAt = current.indexOf(start);
@@ -5162,7 +5186,7 @@ function symlinkedComponent(boundary, target) {
   for (const part of rel.split(import_node_path13.sep).filter(Boolean)) {
     current = (0, import_node_path13.join)(current, part);
     try {
-      if ((0, import_node_fs13.lstatSync)(current).isSymbolicLink()) return current;
+      if ((0, import_node_fs14.lstatSync)(current).isSymbolicLink()) return current;
     } catch (error) {
       if (error.code !== "ENOENT") throw error;
     }
@@ -5173,10 +5197,10 @@ function skillNames(files) {
   return [...new Set(files.filter((file) => /(^|[\\/])SKILL\.md$/.test(file)).map((file) => file.split(/[\\/]/)[0]))].sort();
 }
 function listFiles(dir) {
-  if (!(0, import_node_fs13.existsSync)(dir)) return [];
+  if (!(0, import_node_fs14.existsSync)(dir)) return [];
   const results = [];
   const walk = (current) => {
-    for (const entry of (0, import_node_fs13.readdirSync)(current, { withFileTypes: true })) {
+    for (const entry of (0, import_node_fs14.readdirSync)(current, { withFileTypes: true })) {
       const path = (0, import_node_path13.join)(current, entry.name);
       if (entry.isDirectory()) walk(path);
       else results.push((0, import_node_path13.relative)(dir, path));
@@ -5534,7 +5558,7 @@ async function projectCommand(command, parsed, deps) {
 }
 
 // src/code-connect.ts
-var import_node_fs14 = require("fs");
+var import_node_fs15 = require("fs");
 var import_node_os3 = require("os");
 var import_node_path14 = require("path");
 
@@ -9584,7 +9608,7 @@ var CODE_BUILD_RECIPES = Object.freeze([{
 async function codeConnect(options) {
   const cwd = options.cwd ?? process.cwd();
   const configPath = (0, import_node_path14.resolve)(cwd, options.configPath);
-  const cfg = (0, import_node_fs14.existsSync)(configPath) ? await loadProjectConfig(configPath) : null;
+  const cfg = (0, import_node_fs15.existsSync)(configPath) ? await loadProjectConfig(configPath) : null;
   const requestedAppId = options.appId?.trim();
   if (requestedAppId && !/^[a-z0-9][a-z0-9-]{1,62}$/.test(requestedAppId)) {
     throw new Error("--app-id must be a valid odla app id");
@@ -13210,7 +13234,7 @@ async function provision(options) {
 }
 
 // src/record.ts
-var import_node_fs15 = require("fs");
+var import_node_fs16 = require("fs");
 var import_node_process13 = __toESM(require("process"), 1);
 
 // src/surface.ts
@@ -13400,14 +13424,37 @@ function recordInvocation(parsed) {
       options: Object.entries(parsed.options).map(([name, value2]) => value2 === false ? `no-${name}` : name).sort()
     };
     if (!entry.path.length) return;
-    (0, import_node_fs15.appendFileSync)(file, `${JSON.stringify(entry)}
+    (0, import_node_fs16.appendFileSync)(file, `${JSON.stringify(entry)}
 `);
   } catch {
   }
 }
 
+// src/advisory-output.ts
+var import_apps14 = require("@odla-ai/apps");
+function advisoryCollectingFetch(inner, sink) {
+  return (async (input, init) => {
+    const response2 = await inner(input, init);
+    try {
+      sink.push(...(0, import_apps14.parseAdvisories)(response2));
+    } catch {
+    }
+    return response2;
+  });
+}
+function renderAdvisories(out, advisories, env = process.env) {
+  if (env.ODLA_NO_ADVISORIES) return;
+  const seen = /* @__PURE__ */ new Set();
+  for (const advisory of advisories) {
+    const key = `${advisory.code}:${advisory.message}`;
+    if (seen.has(key)) continue;
+    seen.add(key);
+    out.error((0, import_apps14.formatAdvisory)(advisory));
+  }
+}
+
 // src/runbook-actions.ts
-var import_node_fs16 = require("fs");
+var import_node_fs17 = require("fs");
 
 // src/runbook-requires.ts
 var SPEC = /^(@?[\w./-]+?)@(\d+\.\d+\.\d+(?:[\w.-]*)?)$/;
@@ -13485,14 +13532,25 @@ async function bySlug(ctx, slug) {
     "GET",
     `/runbook?app=${encodeURIComponent(ctx.appId)}&slug=${encodeURIComponent(slug)}&limit=1`
   );
-  const found = page2.records[0];
-  if (!found) throw new Error(`no runbook "${slug}" in ${ctx.appId}`);
-  return found;
+  const filtered = page2.records.find((record11) => record11.slug === slug);
+  if (filtered) return filtered;
+  const limit = 100;
+  for (let offset = 0; ; offset += limit) {
+    const fallback = await call(
+      ctx,
+      "GET",
+      `/runbook?app=${encodeURIComponent(ctx.appId)}&limit=${limit}&offset=${offset}`
+    );
+    const found = fallback.records.find((record11) => record11.slug === slug);
+    if (found) return found;
+    if (!fallback.records.length || offset + fallback.records.length >= fallback.total) break;
+  }
+  throw new Error(`no runbook "${slug}" in ${ctx.appId}`);
 }
 function readBody(file, inline) {
   if (inline !== void 0) return inline;
   if (file === void 0) throw new Error("supply the new text with --file <path>, --file - (stdin), or --body");
-  return (0, import_node_fs16.readFileSync)(file === "-" ? 0 : file, "utf8");
+  return (0, import_node_fs17.readFileSync)(file === "-" ? 0 : file, "utf8");
 }
 var stamp = (ms) => ms ? new Date(ms).toISOString().slice(0, 16).replace("T", " ") : "";
 async function runbookList(ctx, all, query) {
@@ -13572,7 +13630,7 @@ async function runbookRevert(ctx, slug, version) {
     ctx,
     "POST",
     `/runbook/${encodeURIComponent(runbook.id)}/revert`,
-    { version }
+    { version, expectedVersion: runbook.version }
   );
   if (ctx.json) return ctx.out.log(JSON.stringify(result, null, 2));
   ctx.out.log(`${slug} reverted to v${version}, now v${result.record?.version ?? runbook.version + 1}`);
@@ -13584,7 +13642,7 @@ async function runbookRemove(ctx, slug) {
 }
 
 // src/runbook-import.ts
-var import_node_fs17 = require("fs");
+var import_node_fs18 = require("fs");
 var import_node_path16 = require("path");
 function parseRunbook(text3, slug) {
   let rest = text3;
@@ -13610,12 +13668,12 @@ function parseRunbook(text3, slug) {
   };
 }
 function readRunbookDir(dir) {
-  if (!(0, import_node_fs17.statSync)(dir, { throwIfNoEntry: false })?.isDirectory()) throw new Error(`not a directory: ${dir}`);
-  const files = (0, import_node_fs17.readdirSync)(dir).filter((f) => f.endsWith(".md")).sort();
+  if (!(0, import_node_fs18.statSync)(dir, { throwIfNoEntry: false })?.isDirectory()) throw new Error(`not a directory: ${dir}`);
+  const files = (0, import_node_fs18.readdirSync)(dir).filter((f) => f.endsWith(".md")).sort();
   if (!files.length) throw new Error(`no .md files in ${dir}`);
   return files.map((file) => {
     const slug = (0, import_node_path16.basename)(file, ".md");
-    const parsed = parseRunbook((0, import_node_fs17.readFileSync)((0, import_node_path16.join)(dir, file), "utf8"), slug);
+    const parsed = parseRunbook((0, import_node_fs18.readFileSync)((0, import_node_path16.join)(dir, file), "utf8"), slug);
     return { file, slug, ...parsed, words: parsed.body.split(/\s+/).filter(Boolean).length };
   });
 }
@@ -13688,7 +13746,7 @@ async function upsert(ctx, r, visibility) {
 
 // src/runbook-impact.ts
 var import_node_child_process6 = require("child_process");
-var import_node_fs18 = require("fs");
+var import_node_fs19 = require("fs");
 var import_node_path17 = require("path");
 
 // src/runbook-impact-scan.ts
@@ -13859,9 +13917,9 @@ ${body.split("\n").map((line2) => `+${line2}`).join("\n")}
 function manifestLabeller(root) {
   return (workspace) => {
     const manifest = (0, import_node_path17.join)(root, workspace, "package.json");
-    if (!(0, import_node_fs18.existsSync)(manifest)) return void 0;
+    if (!(0, import_node_fs19.existsSync)(manifest)) return void 0;
     try {
-      const name = JSON.parse((0, import_node_fs18.readFileSync)(manifest, "utf8")).name;
+      const name = JSON.parse((0, import_node_fs19.readFileSync)(manifest, "utf8")).name;
       return typeof name === "string" ? name : void 0;
     } catch {
       return void 0;
@@ -13928,7 +13986,7 @@ function report4(ctx, impacts) {
 async function runbookImpact(ctx, options, deps = {}) {
   const cwd = deps.cwd ?? process.cwd();
   const runGit = deps.runGit ?? gitRunner(cwd);
-  const read3 = deps.readRepoFile ?? ((path) => (0, import_node_fs18.readFileSync)((0, import_node_path17.join)(cwd, path), "utf8"));
+  const read3 = deps.readRepoFile ?? ((path) => (0, import_node_fs19.readFileSync)((0, import_node_path17.join)(cwd, path), "utf8"));
   const surfaces = changedSurfaces(collectDiff(runGit, options.base, read3), manifestLabeller(cwd));
   if (!surfaces.length) {
     return ctx.out.log(
@@ -14061,7 +14119,7 @@ async function runbookComment(ctx, slug, body) {
 
 // src/runbook-editor.ts
 var import_node_child_process7 = require("child_process");
-var import_node_fs19 = require("fs");
+var import_node_fs20 = require("fs");
 var import_node_os4 = require("os");
 var import_node_path18 = require("path");
 var import_node_process14 = __toESM(require("process"), 1);
@@ -14089,16 +14147,16 @@ function editText(initial, slug, deps = {}) {
     );
   if (!interactive())
     throw new Error(`cannot open an editor without a terminal \u2014 pass --file <path> or --body "\u2026" instead`);
-  const dir = (0, import_node_fs19.mkdtempSync)((0, import_node_path18.join)((0, import_node_os4.tmpdir)(), "odla-runbook-"));
+  const dir = (0, import_node_fs20.mkdtempSync)((0, import_node_path18.join)((0, import_node_os4.tmpdir)(), "odla-runbook-"));
   const file = (0, import_node_path18.join)(dir, `${slug}.md`);
   try {
-    (0, import_node_fs19.writeFileSync)(file, initial, { mode: 384 });
+    (0, import_node_fs20.writeFileSync)(file, initial, { mode: 384 });
     const code = defaultRunOrInjected(deps)(editor, file);
     if (code !== 0) throw new Error(`editor "${editor}" exited with ${code}; nothing was written`);
-    const edited = (0, import_node_fs19.readFileSync)(file, "utf8");
+    const edited = (0, import_node_fs20.readFileSync)(file, "utf8");
     return edited === initial ? null : edited;
   } finally {
-    (0, import_node_fs19.rmSync)(dir, { recursive: true, force: true });
+    (0, import_node_fs20.rmSync)(dir, { recursive: true, force: true });
   }
 }
 var defaultRunOrInjected = (deps) => deps.run ?? defaultRun;
@@ -14990,6 +15048,23 @@ function exitCodeFor(err) {
 
 // src/cli.ts
 async function runCli(argv = process.argv.slice(2), dependencies = {}) {
+  const out = redactingOutput(dependencies.stdout ?? console);
+  const advisories = [];
+  const withAdvisoryReader = {
+    ...dependencies,
+    fetch: advisoryCollectingFetch(dependencies.fetch ?? fetch, advisories)
+  };
+  try {
+    return await dispatchCli(argv, withAdvisoryReader);
+  } catch (error) {
+    const explanation = explainRejectedCredential(error);
+    if (explanation) out.error(explanation);
+    throw error;
+  } finally {
+    renderAdvisories(out, advisories);
+  }
+}
+async function dispatchCli(argv, dependencies) {
   const runtime = {
     ...dependencies,
     stdout: redactingOutput(dependencies.stdout ?? console)