@odla-ai/cli 0.35.1 → 0.36.0

package/dist/{chunk-SRL2TN24.js → chunk-DBZQIMES.js}

@@ -10,12 +10,12 @@ import {
 } from "./chunk-UKLSRQ5J.js";
 
 // src/admin-ai.ts
-import process8 from "process";
+import process9 from "process";
 
 // src/token.ts
 import { OdlaError, requestToken } from "@odla-ai/db";
 import { createHash } from "crypto";
-import process5 from "process";
+import process6 from "process";
 
 // src/handshake-approval.ts
 import process3 from "process";
@@ -149,13 +149,72 @@ function handshakeWaitMs(waitSeconds, interactive = process4.stdout.isTTY === tr
   return interactive ? void 0 : 9e4;
 }
 
+// src/cached-credential.ts
+import { rmSync as rmSync2 } from "fs";
+var noted = null;
+function noteCachedCredential(tokenFile) {
+  noted = tokenFile;
+}
+function isCredentialRejection(error) {
+  const message2 = error instanceof Error ? error.message : String(error ?? "");
+  return /\((401|403)\)\s*$/.test(message2.trim());
+}
+function explainRejectedCredential(error) {
+  const tokenFile = noted;
+  if (!tokenFile || !isCredentialRejection(error)) return null;
+  noted = null;
+  rmSync2(tokenFile, { force: true });
+  return [
+    "auth: the cached credential was rejected by odla, so it was revoked before its cached expiry.",
+    "   The usual cause is a newer sign-in for this project: collecting a handshake retires the",
+    "   principal's other credentials, so a second terminal or worktree supersedes this one.",
+    `   Discarded ${tokenFile}; re-run this command to request a fresh approval.`
+  ].join("\n");
+}
+
+// src/device-session.ts
+import { existsSync, readFileSync } from "fs";
+import { homedir } from "os";
+import { join as join2 } from "path";
+import process5 from "process";
+function deviceCredentialPath(env = process5.env) {
+  return env.ODLA_DEVICE_CREDENTIAL ?? join2(env.HOME ?? homedir(), ".odla", "device.json");
+}
+function readDeviceCredential(platform, env = process5.env) {
+  const path = deviceCredentialPath(env);
+  if (!existsSync(path)) return null;
+  try {
+    const parsed = JSON.parse(readFileSync(path, "utf8"));
+    if (typeof parsed.token !== "string" || !parsed.token.startsWith("odla_device_")) return null;
+    if (parsed.platform !== platform) return null;
+    return { ...parsed, token: parsed.token, platform: parsed.platform };
+  } catch {
+    return null;
+  }
+}
+async function mintDeviceSession(platformUrl, credential2, doFetch) {
+  const response2 = await doFetch(`${platformUrl.replace(/\/$/, "")}/registry/devices/session`, {
+    method: "POST",
+    headers: { authorization: `Bearer ${credential2.token}`, "content-type": "application/json" },
+    body: "{}"
+  });
+  const body = await response2.json().catch(() => ({}));
+  if (!response2.ok || typeof body.token !== "string") {
+    const detail = body.error?.message ?? `registry returned ${response2.status}`;
+    throw new Error(
+      `device session failed: ${detail} (${response2.status}) \u2014 if this machine's enrollment was revoked or has expired, enroll it again in Studio`
+    );
+  }
+  return { token: body.token, expiresAt: body.expiresAt ?? Date.now() };
+}
+
 // src/local.ts
-import { chmodSync, existsSync, mkdirSync, readFileSync, renameSync, writeFileSync } from "fs";
+import { chmodSync, existsSync as existsSync2, mkdirSync, readFileSync as readFileSync2, renameSync, writeFileSync } from "fs";
 import { dirname as dirname2, isAbsolute, relative, resolve } from "path";
 var GITIGNORE_LINES = [".odla/*.local.json", ".odla/dev-token.json", ".dev.vars"];
 function readJsonFile(path) {
   try {
-    return JSON.parse(readFileSync(path, "utf8"));
+    return JSON.parse(readFileSync2(path, "utf8"));
   } catch {
     return null;
   }
@@ -165,10 +224,10 @@ function writePrivateJson(path, value2) {
 `);
 }
 function readCredentials(path) {
-  if (!existsSync(path)) return null;
+  if (!existsSync2(path)) return null;
   let value2;
   try {
-    value2 = JSON.parse(readFileSync(path, "utf8"));
+    value2 = JSON.parse(readFileSync2(path, "utf8"));
   } catch {
     throw new Error(`credentials file ${path} is not valid JSON; fix or remove it before provisioning`);
   }
@@ -199,7 +258,7 @@ function mergeCredential(current, update) {
 }
 function ensureGitignore(rootDir, localPaths = []) {
   const path = resolve(rootDir, ".gitignore");
-  const existing = existsSync(path) ? readFileSync(path, "utf8") : "";
+  const existing = existsSync2(path) ? readFileSync2(path, "utf8") : "";
   const configured = localPaths.map((localPath) => gitignoreEntry(rootDir, localPath)).filter((line2) => !!line2);
   const wanted = [.../* @__PURE__ */ new Set([...GITIGNORE_LINES, ...configured])];
   const missing = wanted.filter((line2) => !existing.split(/\r?\n/).includes(line2));
@@ -233,7 +292,7 @@ function writeDevVars(path, credentials, env, o11y) {
     if (o11y.version) lines.push(`ODLA_O11Y_VERSION="${o11y.version}"`);
     if (entry.o11yToken) lines.push(`ODLA_O11Y_TOKEN="${entry.o11yToken}"`);
   }
-  const existing = existsSync(path) ? readFileSync(path, "utf8") : "";
+  const existing = existsSync2(path) ? readFileSync2(path, "utf8") : "";
   const retained = existing.split(/\r?\n/).filter((line2) => !isManagedDevVar(line2));
   while (retained.at(-1) === "") retained.pop();
   const prefix = retained.length ? `${retained.join("\n")}
@@ -283,17 +342,24 @@ async function getDeveloperToken(cfg, options, doFetch, out, grantRequest = {})
   const cached = readJsonFile(cfg.local.tokenFile);
   if (!grantRequest.forceReview && !grantRequest.freshLogin) {
     if (options.token) return options.token;
-    if (process5.env.ODLA_DEV_TOKEN) {
-      const declared = process5.env.ODLA_DEV_TOKEN_AUDIENCE;
+    if (process6.env.ODLA_DEV_TOKEN) {
+      const declared = process6.env.ODLA_DEV_TOKEN_AUDIENCE;
       if (declared) {
         if (platformAudience(declared) !== audience) throw new Error("ODLA_DEV_TOKEN_AUDIENCE does not match the configured platform");
       } else if (audience !== "https://odla.ai") {
         throw new Error("ODLA_DEV_TOKEN_AUDIENCE is required for a non-default platform");
       }
-      return process5.env.ODLA_DEV_TOKEN;
+      return process6.env.ODLA_DEV_TOKEN;
+    }
+    const device = readDeviceCredential(audience);
+    if (device) {
+      const session = await mintDeviceSession(cfg.platformUrl, device, doFetch);
+      out.error(`auth: session minted by this enrolled device (${displayPath(deviceCredentialPath(), cfg.rootDir)})`);
+      return session.token;
     }
     if (cached?.token && cached.platform === audience && (cached.expiresAt ?? 0) > Date.now() + 6e4 && cachedGrantCovers(cached, grantIntent)) {
       out.error(`auth: using cached developer token (${displayPath(cfg.local.tokenFile, cfg.rootDir)})`);
+      noteCachedCredential(cfg.local.tokenFile);
       return cached.token;
     }
   } else {
@@ -394,7 +460,7 @@ function stillPending(pending, email) {
   );
 }
 function handshakeEmail(value2, cached) {
-  const email = (value2 ?? process5.env.ODLA_USER_EMAIL ?? cached ?? "").trim().toLowerCase();
+  const email = (value2 ?? process6.env.ODLA_USER_EMAIL ?? cached ?? "").trim().toLowerCase();
   if (/@users\.noreply\.github\.com$/i.test(email)) {
     throw new Error(
       `"${email}" is a GitHub commit identity, not an odla account email; use --email <signed-in-odla-account> or ODLA_USER_EMAIL`
@@ -425,12 +491,12 @@ function platformAudience(value2) {
 }
 
 // src/secret-input.ts
-import process6 from "process";
+import process7 from "process";
 var MAX_BYTES = 64 * 1024;
 async function secretInputValue(options, kind = "credential") {
   if (options.fromEnv && options.stdin) throw new Error("choose exactly one of --from-env or --stdin");
   let value2;
-  if (options.fromEnv) value2 = process6.env[options.fromEnv];
+  if (options.fromEnv) value2 = process7.env[options.fromEnv];
   else if (options.stdin) value2 = await (options.readStdin ?? (() => readSecretStream(kind)))();
   else throw new Error(`${kind} input required: use --from-env <NAME> or --stdin; values are never accepted as arguments`);
   value2 = value2?.replace(/[\r\n]+$/, "");
@@ -438,7 +504,7 @@ async function secretInputValue(options, kind = "credential") {
   if (new TextEncoder().encode(value2).byteLength > MAX_BYTES) throw new Error(`${kind} exceeds 64 KiB`);
   return value2;
 }
-async function readSecretStream(kind, stream = process6.stdin) {
+async function readSecretStream(kind, stream = process7.stdin) {
   let value2 = "";
   for await (const chunk of stream) {
     value2 += String(chunk);
@@ -448,9 +514,9 @@ async function readSecretStream(kind, stream = process6.stdin) {
 }
 
 // src/admin-ai-auth.ts
-import { existsSync as existsSync2 } from "fs";
-import { join as join2 } from "path";
-import process7 from "process";
+import { existsSync as existsSync3 } from "fs";
+import { join as join3 } from "path";
+import process8 from "process";
 import { requestToken as requestToken2 } from "@odla-ai/db";
 async function getScopedPlatformToken(options) {
   return resolveAdminPlatformToken(options);
@@ -458,7 +524,7 @@ async function getScopedPlatformToken(options) {
 async function resolveAdminPlatformToken(options) {
   const audience = platformAudience(options.platform);
   if (options.token) return options.token;
-  const fromEnv = process7.env.ODLA_ADMIN_TOKEN;
+  const fromEnv = process8.env.ODLA_ADMIN_TOKEN;
   if (fromEnv) return audienceBoundEnvToken(fromEnv, audience);
   return scopedToken(
     audience,
@@ -470,7 +536,7 @@ async function resolveAdminPlatformToken(options) {
 }
 function audienceBoundEnvToken(token, platform) {
   const audience = platformAudience(platform);
-  const declared = process7.env.ODLA_ADMIN_TOKEN_AUDIENCE;
+  const declared = process8.env.ODLA_ADMIN_TOKEN_AUDIENCE;
   if (declared) {
     if (platformAudience(declared) !== audience) throw new Error("ODLA_ADMIN_TOKEN_AUDIENCE does not match the configured platform");
   } else if (audience !== "https://odla.ai") {
@@ -483,6 +549,7 @@ var SCOPE_PURPOSE = {
   "app:config:read": "compare checked-in intent with an exact-id app Registry configuration",
   "app:config:write": "apply or inspect one revision-bound configuration operation for an app you own",
   "platform:runbook:write": "read and edit all of odla's operational runbooks, including admin-visible content",
+  "app:device:enroll": "enrol this machine so it can mint its own short-lived credentials without asking you again",
   "platform:ai:policy:write": "change System AI model routing",
   "platform:ai:policy:read": "read System AI model routing",
   "platform:ai:credential:write": "replace a stored AI provider key",
@@ -495,8 +562,8 @@ var SCOPE_PURPOSE = {
 };
 async function scopedToken(platform, scope, options, doFetch, out) {
   const audience = platformAudience(platform);
-  const rootDir = options.rootDir ?? process7.cwd();
-  const tokenFile = options.tokenFile ?? join2(rootDir, ".odla/admin-token.local.json");
+  const rootDir = options.rootDir ?? process8.cwd();
+  const tokenFile = options.tokenFile ?? join3(rootDir, ".odla/admin-token.local.json");
   const cache2 = options.cache === false ? null : readJsonFile(tokenFile);
   const cached = cache2?.platform === audience ? cache2.tokens?.[scope] : void 0;
   if (cached?.token && (cached.expiresAt ?? 0) > Date.now() + 6e4) {
@@ -523,7 +590,7 @@ async function scopedToken(platform, scope, options, doFetch, out) {
   if (options.cache !== false) {
     const tokens = cache2?.platform === audience ? { ...cache2.tokens ?? {} } : {};
     tokens[scope] = { token, expiresAt };
-    if (existsSync2(join2(rootDir, ".git"))) ensureGitignore(rootDir, [tokenFile]);
+    if (existsSync3(join3(rootDir, ".git"))) ensureGitignore(rootDir, [tokenFile]);
     writePrivateJson(tokenFile, { platform: audience, email, tokens });
     out.error(`auth: cached ${scope} grant (${tokenFile}; mode 0600)`);
   } else {
@@ -700,7 +767,7 @@ function isRecord2(value2) {
 
 // src/admin-ai.ts
 async function adminAi(options) {
-  const platform = platformAudience(options.platform ?? process8.env.ODLA_PLATFORM ?? "https://odla.ai");
+  const platform = platformAudience(options.platform ?? process9.env.ODLA_PLATFORM ?? "https://odla.ai");
   const doFetch = options.fetch ?? fetch;
   const out = options.stdout ?? console;
   const usageQuery = options.action === "usage" ? adminAiUsageQuery(options) : void 0;
@@ -955,12 +1022,12 @@ function addOption(options, name, value2) {
 }
 
 // src/operator-context.ts
-import { existsSync as existsSync5 } from "fs";
-import { join as join4, resolve as resolve4 } from "path";
-import process10 from "process";
+import { existsSync as existsSync6 } from "fs";
+import { join as join5, resolve as resolve4 } from "path";
+import process11 from "process";
 
 // src/config.ts
-import { existsSync as existsSync3, readFileSync as readFileSync2 } from "fs";
+import { existsSync as existsSync4, readFileSync as readFileSync3 } from "fs";
 import { dirname as dirname3, isAbsolute as isAbsolute2, resolve as resolve2 } from "path";
 import { pathToFileURL } from "url";
 import { appServiceDefinition, appServiceIds } from "@odla-ai/apps";
@@ -1367,7 +1434,7 @@ var configImportSerial = 0;
 var GOOGLE_CALENDAR_EVENTS_SCOPE = "https://www.googleapis.com/auth/calendar.events";
 async function loadProjectConfig(configPath = "odla.config.mjs", options = {}) {
   const resolved = resolve2(configPath);
-  if (!existsSync3(resolved)) {
+  if (!existsSync4(resolved)) {
     throw new Error(`config not found: ${configPath}. Run "odla-ai init" first or pass --config.`);
   }
   const raw = await loadConfigModule(resolved);
@@ -1402,7 +1469,7 @@ async function resolveDataExport(cfg, value2, names) {
   if (typeof value2 !== "string") return value2;
   const target = isAbsolute2(value2) ? value2 : resolve2(cfg.rootDir, value2);
   if (target.endsWith(".json")) {
-    return JSON.parse(readFileSync2(target, "utf8"));
+    return JSON.parse(readFileSync3(target, "utf8"));
   }
   const mod = await import(pathToFileURL(target).href);
   for (const name of names) {
@@ -1478,7 +1545,7 @@ function validId2(value2) {
   return typeof value2 === "string" && /^[a-z0-9][a-z0-9-]*$/.test(value2);
 }
 async function loadConfigModule(path) {
-  if (path.endsWith(".json")) return JSON.parse(readFileSync2(path, "utf8"));
+  if (path.endsWith(".json")) return JSON.parse(readFileSync3(path, "utf8"));
   const nonce = `${Date.now()}-${configImportSerial++}`;
   const mod = await import(`${pathToFileURL(path).href}?reload=${nonce}`);
   const value2 = mod.default ?? mod.config;
@@ -1493,18 +1560,18 @@ function unique3(values) {
 }
 
 // src/operator-profiles.ts
-import { existsSync as existsSync4, readFileSync as readFileSync3 } from "fs";
-import { homedir } from "os";
-import { dirname as dirname4, join as join3, resolve as resolve3 } from "path";
-import process9 from "process";
+import { existsSync as existsSync5, readFileSync as readFileSync4 } from "fs";
+import { homedir as homedir2 } from "os";
+import { dirname as dirname4, join as join4, resolve as resolve3 } from "path";
+import process10 from "process";
 function operatorProfileFile() {
   return resolve3(
-    clean(process9.env.ODLA_CONTEXT_FILE) ?? join3(homedir(), ".odla", "contexts.json")
+    clean(process10.env.ODLA_CONTEXT_FILE) ?? join4(homedir2(), ".odla", "contexts.json")
   );
 }
 function resolveOperatorProfile(parsed) {
   const fromFlag = clean(stringOpt(parsed.options.context));
-  const fromEnvironment = clean(process9.env.ODLA_CONTEXT);
+  const fromEnvironment = clean(process10.env.ODLA_CONTEXT);
   const name = fromFlag ?? fromEnvironment ?? null;
   const file = operatorProfileFile();
   if (!name) {
@@ -1544,10 +1611,10 @@ function removeOperatorProfile(name, file = operatorProfileFile()) {
   return true;
 }
 function operatorCredentialFiles(selection) {
-  const base = selection.name ? join3(dirname4(selection.file), "profiles", selection.name) : join3(homedir(), ".odla");
+  const base = selection.name ? join4(dirname4(selection.file), "profiles", selection.name) : join4(homedir2(), ".odla");
   return {
-    developer: join3(base, "dev-token.json"),
-    scoped: join3(base, "admin-token.local.json")
+    developer: join4(base, "dev-token.json"),
+    scoped: join4(base, "admin-token.local.json")
   };
 }
 function assertOperatorName(value2, label) {
@@ -1558,10 +1625,10 @@ function assertOperatorName(value2, label) {
   }
 }
 function readOperatorProfiles(file) {
-  if (!existsSync4(file)) return emptyProfiles();
+  if (!existsSync5(file)) return emptyProfiles();
   let raw;
   try {
-    raw = JSON.parse(readFileSync3(file, "utf8"));
+    raw = JSON.parse(readFileSync4(file, "utf8"));
   } catch {
     throw new Error(`operator context file ${file} is not valid JSON`);
   }
@@ -1627,19 +1694,19 @@ async function resolveOperatorContext(parsed, options = {}) {
   const configArgument = stringOpt(parsed.options.config) ?? "odla.config.mjs";
   const configPath = resolve4(configArgument);
   const explicitConfig = parsed.options.config !== void 0;
-  const hasConfig = existsSync5(configPath);
+  const hasConfig = existsSync6(configPath);
   if (!hasConfig && (!options.allowMissingConfig || explicitConfig)) {
     await loadProjectConfig(configArgument);
   }
   const loaded = hasConfig ? await loadProjectConfig(configArgument) : void 0;
   const platformFlag = clean2(stringOpt(parsed.options.platform));
-  const platformEnvironment = clean2(process10.env.ODLA_PLATFORM_URL);
+  const platformEnvironment = clean2(process11.env.ODLA_PLATFORM_URL);
   const platformValue = platformAudience(
     platformFlag ?? platformEnvironment ?? profile.value?.platform ?? loaded?.platformUrl ?? DEFAULT_PLATFORM2
   );
   const platformSource = platformFlag ? "flag" : platformEnvironment ? "environment" : profile.value ? "profile" : loaded ? "config" : "default";
   const appFlag = clean2(stringOpt(parsed.options.app));
-  const appEnvironment = clean2(process10.env.ODLA_APP_ID);
+  const appEnvironment = clean2(process11.env.ODLA_APP_ID);
   const appValue = appFlag ?? appEnvironment ?? profile.value?.app ?? loaded?.app.id ?? null;
   const appSource = appFlag ? "flag" : appEnvironment ? "environment" : profile.value?.app ? "profile" : loaded ? "config" : "unresolved";
   if (appValue) assertOperatorName(appValue, "app");
@@ -1649,16 +1716,16 @@ async function resolveOperatorContext(parsed, options = {}) {
     );
   }
   const envFlag = clean2(stringOpt(parsed.options.env));
-  const envEnvironment = clean2(process10.env.ODLA_ENV);
+  const envEnvironment = clean2(process11.env.ODLA_ENV);
   const environmentValue = envFlag ?? envEnvironment ?? profile.value?.environment ?? options.defaultEnvironment ?? null;
   const environmentSource = envFlag ? "flag" : envEnvironment ? "environment" : profile.value?.environment ? "profile" : options.defaultEnvironment ? "default" : "unresolved";
   if (environmentValue) {
     assertOperatorName(environmentValue, "environment");
   }
-  const rootDir = loaded?.rootDir ?? process10.cwd();
+  const rootDir = loaded?.rootDir ?? process11.cwd();
   const profileCredentials = operatorCredentialFiles(profile);
-  const tokenFile = clean2(process10.env.ODLA_DEV_TOKEN_FILE) ? resolve4(process10.env.ODLA_DEV_TOKEN_FILE) : profile.name ? profileCredentials.developer : loaded?.local.tokenFile ?? profileCredentials.developer;
-  const scopedTokenFile = clean2(process10.env.ODLA_ADMIN_TOKEN_FILE) ? resolve4(process10.env.ODLA_ADMIN_TOKEN_FILE) : profile.name ? profileCredentials.scoped : loaded ? join4(loaded.rootDir, ".odla", "admin-token.local.json") : profileCredentials.scoped;
+  const tokenFile = clean2(process11.env.ODLA_DEV_TOKEN_FILE) ? resolve4(process11.env.ODLA_DEV_TOKEN_FILE) : profile.name ? profileCredentials.developer : loaded?.local.tokenFile ?? profileCredentials.developer;
+  const scopedTokenFile = clean2(process11.env.ODLA_ADMIN_TOKEN_FILE) ? resolve4(process11.env.ODLA_ADMIN_TOKEN_FILE) : profile.name ? profileCredentials.scoped : loaded ? join5(loaded.rootDir, ".odla", "admin-token.local.json") : profileCredentials.scoped;
   const cfg = loaded ? {
     ...loaded,
     platformUrl: platformValue,
@@ -1680,8 +1747,8 @@ async function resolveOperatorContext(parsed, options = {}) {
     services: [],
     local: {
       tokenFile,
-      credentialsFile: join4(rootDir, ".odla", "credentials.local.json"),
-      devVarsFile: join4(rootDir, ".dev.vars"),
+      credentialsFile: join5(rootDir, ".odla", "credentials.local.json"),
+      devVarsFile: join5(rootDir, ".dev.vars"),
       gitignore: true
     }
   };
@@ -1778,7 +1845,7 @@ async function adminCommand(parsed, deps = {}) {
 }
 
 // src/auth-command.ts
-import process11 from "process";
+import process12 from "process";
 
 // src/whoami-command.ts
 var text2 = (value2) => typeof value2 === "string" && value2.trim() ? value2.trim() : null;
@@ -1940,7 +2007,7 @@ async function authCommand(parsed, deps = {}) {
   const { cfg } = context;
   const out = deps.stdout ?? console;
   const doFetch = deps.fetch ?? fetch;
-  const email = stringOpt(parsed.options.email) ?? process11.env.ODLA_USER_EMAIL?.trim();
+  const email = stringOpt(parsed.options.email) ?? process12.env.ODLA_USER_EMAIL?.trim();
   if (!email) {
     throw new Error(
       "auth login requires --email <odla-account> or ODLA_USER_EMAIL; confirm the signed-in odla email instead of using git or GitHub identity"
@@ -2093,7 +2160,7 @@ async function appExport(options) {
 }
 
 // src/app-import.ts
-import { readFileSync as readFileSync4 } from "fs";
+import { readFileSync as readFileSync5 } from "fs";
 import {
   buildImportOps,
   parseImport,
@@ -2115,7 +2182,7 @@ async function appImport(options) {
   const out = options.stdout ?? console;
   const say = options.json ? (line2) => out.error(line2) : (line2) => out.log(line2);
   const { tenant } = resolveTenant(cfg, options.env);
-  const text3 = options.file === "-" ? (options.readStdin ?? (() => readFileSync4(0, "utf8")))() : readFileSync4(options.file, "utf8");
+  const text3 = options.file === "-" ? (options.readStdin ?? (() => readFileSync5(0, "utf8")))() : readFileSync5(options.file, "utf8");
   const { format, sources } = parseImport(text3, options.ns);
   if (format === "namespace-map" && options.ns) {
     throw new Error("--ns cannot be combined with a {namespace: rows} file \u2014 the file already names each namespace");
@@ -2986,7 +3053,7 @@ import {
   AppsError,
   createAppsClient
 } from "@odla-ai/apps";
-import { join as join5 } from "path";
+import { join as join6 } from "path";
 
 // src/config-operation-error.ts
 var ConfigOperationCommandError = class extends Error {
@@ -3002,7 +3069,7 @@ var ConfigOperationCommandError = class extends Error {
 import {
   appServiceDefinition as appServiceDefinition2
 } from "@odla-ai/apps";
-import { readFileSync as readFileSync5 } from "fs";
+import { readFileSync as readFileSync6 } from "fs";
 
 // src/config-reconcile-digest.ts
 import { createHash as createHash2 } from "crypto";
@@ -3038,7 +3105,7 @@ var SERVICE = /^[a-z][a-z0-9-]{0,39}$/;
 function readPlan(path) {
   let value2;
   try {
-    const raw = readFileSync5(path, "utf8");
+    const raw = readFileSync6(path, "utf8");
     if (Buffer.byteLength(raw) > 128 * 1024) throw new Error("plan exceeds 128 KiB");
     value2 = JSON.parse(raw);
   } catch (error) {
@@ -3411,7 +3478,7 @@ async function operationClient(cfg, options, purpose) {
     platform: cfg.platformUrl,
     scope: "app:config:write",
     token: options.token,
-    tokenFile: join5(cfg.rootDir, ".odla", "admin-token.local.json"),
+    tokenFile: join6(cfg.rootDir, ".odla", "admin-token.local.json"),
     rootDir: cfg.rootDir,
     email: options.email,
     open: options.open,
@@ -3466,7 +3533,7 @@ function record4(value2) {
 
 // src/config-reconcile-command.ts
 import { createAppsClient as createAppsClient2, studioAppSettingsPath } from "@odla-ai/apps";
-import { join as join6 } from "path";
+import { join as join7 } from "path";
 
 // src/config-reconcile.ts
 import { appServiceIds as appServiceIds2, orderAppServices as orderAppServices2 } from "@odla-ai/apps";
@@ -3762,7 +3829,7 @@ async function inspectConfig(options) {
     platform: cfg.platformUrl,
     scope: "app:config:read",
     token: options.token,
-    tokenFile: join6(cfg.rootDir, ".odla", "admin-token.local.json"),
+    tokenFile: join7(cfg.rootDir, ".odla", "admin-token.local.json"),
     rootDir: cfg.rootDir,
     email: options.email,
     open: options.open,
@@ -3894,13 +3961,13 @@ function quoteArg2(value2) {
 
 // src/doctor-checks.ts
 import { execFileSync } from "child_process";
-import { existsSync as existsSync7, readFileSync as readFileSync7 } from "fs";
-import { join as join8, resolve as resolve6 } from "path";
+import { existsSync as existsSync8, readFileSync as readFileSync8 } from "fs";
+import { join as join9, resolve as resolve6 } from "path";
 
 // src/wrangler.ts
 import { spawn as spawn2 } from "child_process";
-import { existsSync as existsSync6, readFileSync as readFileSync6 } from "fs";
-import { join as join7 } from "path";
+import { existsSync as existsSync7, readFileSync as readFileSync7 } from "fs";
+import { join as join8 } from "path";
 var defaultRunner = (cmd, args, opts) => new Promise((resolvePromise, reject) => {
   const child = spawn2(cmd, args, { cwd: opts?.cwd, stdio: ["pipe", "pipe", "pipe"] });
   let stdout = "";
@@ -3914,15 +3981,15 @@ var defaultRunner = (cmd, args, opts) => new Promise((resolvePromise, reject) =>
 var WRANGLER_CONFIG_FILES = ["wrangler.jsonc", "wrangler.json", "wrangler.toml"];
 function findWranglerConfig(rootDir) {
   for (const name of WRANGLER_CONFIG_FILES) {
-    const path = join7(rootDir, name);
-    if (existsSync6(path)) return path;
+    const path = join8(rootDir, name);
+    if (existsSync7(path)) return path;
   }
   return null;
 }
 function readWranglerConfig(path) {
   if (path.endsWith(".toml")) return null;
   try {
-    return JSON.parse(stripJsonComments(readFileSync6(path, "utf8")));
+    return JSON.parse(stripJsonComments(readFileSync7(path, "utf8")));
   } catch {
     return null;
   }
@@ -4075,7 +4142,7 @@ function wranglerWarnings(rootDir) {
       const dir = resolve6(rootDir, assets.directory);
       if (dir === resolve6(rootDir)) {
         warnings.push(`${label}assets.directory is the project root \u2014 point it at a dedicated build dir (wrangler dev fails with "spawn EBADF")`);
-      } else if (existsSync7(join8(dir, "node_modules"))) {
+      } else if (existsSync8(join9(dir, "node_modules"))) {
         warnings.push(`${label}assets.directory contains node_modules \u2014 wrangler dev's watcher will exhaust file descriptors`);
       }
     }
@@ -4111,12 +4178,12 @@ function o11yProjectWarnings(rootDir) {
     return warnings;
   }
   const main = typeof config.main === "string" ? resolve6(rootDir, config.main) : null;
-  if (!main || !existsSync7(main)) {
+  if (!main || !existsSync8(main)) {
     warnings.push("cannot verify o11y Worker instrumentation \u2014 wrangler main is missing or unreadable");
   } else {
     let source = "";
     try {
-      source = readFileSync7(main, "utf8");
+      source = readFileSync8(main, "utf8");
     } catch {
     }
     if (!/\bwithObservability\b/.test(source)) {
@@ -4140,7 +4207,7 @@ function calendarProjectWarnings(rootDir) {
 }
 function readPackageJson(rootDir) {
   try {
-    return JSON.parse(readFileSync7(join8(rootDir, "package.json"), "utf8"));
+    return JSON.parse(readFileSync8(join9(rootDir, "package.json"), "utf8"));
   } catch {
     return null;
   }
@@ -4434,14 +4501,14 @@ function harnessOption(value2, flag) {
 }
 
 // src/init.ts
-import { existsSync as existsSync8, mkdirSync as mkdirSync2, writeFileSync as writeFileSync2 } from "fs";
+import { existsSync as existsSync9, mkdirSync as mkdirSync2, writeFileSync as writeFileSync2 } from "fs";
 import { dirname as dirname6, resolve as resolve7 } from "path";
 import { appServiceDefinition as appServiceDefinition3, appServiceIds as appServiceIds3 } from "@odla-ai/apps";
 function initProject(options) {
   const out = options.stdout ?? console;
   const rootDir = resolve7(options.rootDir ?? process.cwd());
   const configPath = resolve7(rootDir, options.configPath ?? "odla.config.mjs");
-  if (existsSync8(configPath) && !options.force) {
+  if (existsSync9(configPath) && !options.force) {
     throw new Error(`${configPath} already exists. Pass --force to overwrite.`);
   }
   if (!/^[a-z0-9][a-z0-9-]*$/.test(options.appId)) {
@@ -4469,7 +4536,7 @@ function initProject(options) {
   out.log("updated .gitignore for local odla credentials");
 }
 function writeIfMissing(path, text3) {
-  if (existsSync8(path)) return;
+  if (existsSync9(path)) return;
   writeFileSync2(path, text3);
 }
 function configTemplate(input) {
@@ -4766,9 +4833,9 @@ function printReport(report5, out) {
 }
 
 // src/skill.ts
-import { existsSync as existsSync9, lstatSync, mkdirSync as mkdirSync3, readFileSync as readFileSync8, readdirSync, writeFileSync as writeFileSync3 } from "fs";
-import { homedir as homedir2 } from "os";
-import { dirname as dirname7, isAbsolute as isAbsolute3, join as join9, relative as relative2, resolve as resolve8, sep } from "path";
+import { existsSync as existsSync10, lstatSync, mkdirSync as mkdirSync3, readFileSync as readFileSync9, readdirSync, writeFileSync as writeFileSync3 } from "fs";
+import { homedir as homedir3 } from "os";
+import { dirname as dirname7, isAbsolute as isAbsolute3, join as join10, relative as relative2, resolve as resolve8, sep } from "path";
 import { fileURLToPath } from "url";
 
 // src/skill-adapters.ts
@@ -4868,7 +4935,7 @@ function installSkill(options = {}) {
   if (files.length === 0) throw new Error(`no bundled skills found at ${sourceDir}`);
   const harnesses = normalizeHarnesses(options.harnesses, options.global === true);
   const root = resolve8(options.dir ?? process.cwd());
-  const home = resolve8(options.homeDir ?? homedir2());
+  const home = resolve8(options.homeDir ?? homedir3());
   const plans = /* @__PURE__ */ new Map();
   const targets = /* @__PURE__ */ new Map();
   const rememberTarget = (harness, target) => {
@@ -4882,12 +4949,12 @@ function installSkill(options = {}) {
     plans.set(target, { target, content: content2, boundary, managedMerge });
   };
   const planSkillTree = (targetDir2, boundary = root) => {
-    for (const rel of files) plan(join9(targetDir2, rel), readFileSync8(join9(sourceDir, rel), "utf8"), false, boundary);
+    for (const rel of files) plan(join10(targetDir2, rel), readFileSync9(join10(sourceDir, rel), "utf8"), false, boundary);
   };
   let targetDir;
   if (options.global) {
-    const claudeRoot = join9(home, ".claude", "skills");
-    const codexRoot = resolve8(options.codexHomeDir ?? process.env.CODEX_HOME ?? join9(home, ".codex"), "skills");
+    const claudeRoot = join10(home, ".claude", "skills");
+    const codexRoot = resolve8(options.codexHomeDir ?? process.env.CODEX_HOME ?? join10(home, ".codex"), "skills");
     targetDir = harnesses[0] === "codex" ? codexRoot : claudeRoot;
     for (const harness of harnesses) {
       const skillRoot = harness === "claude" ? claudeRoot : codexRoot;
@@ -4895,35 +4962,35 @@ function installSkill(options = {}) {
       rememberTarget(harness, skillRoot);
     }
   } else {
-    const sharedRoot = join9(root, ".agents", "skills");
+    const sharedRoot = join10(root, ".agents", "skills");
     planSkillTree(sharedRoot);
-    const claudeRoot = join9(root, ".claude", "skills");
+    const claudeRoot = join10(root, ".claude", "skills");
     targetDir = harnesses.includes("claude") ? claudeRoot : sharedRoot;
     for (const harness of harnesses) rememberTarget(harness, sharedRoot);
     if (harnesses.includes("claude")) {
       for (const skill of skillNames(files)) {
-        const canonical2 = readFileSync8(join9(sourceDir, skill, "SKILL.md"), "utf8");
-        plan(join9(claudeRoot, skill, "SKILL.md"), claudeAdapter(skill, canonical2));
+        const canonical2 = readFileSync9(join10(sourceDir, skill, "SKILL.md"), "utf8");
+        plan(join10(claudeRoot, skill, "SKILL.md"), claudeAdapter(skill, canonical2));
       }
       rememberTarget("claude", claudeRoot);
     }
     if (harnesses.includes("cursor")) {
-      const cursorRule = join9(root, ".cursor", "rules", "odla.mdc");
+      const cursorRule = join10(root, ".cursor", "rules", "odla.mdc");
       plan(cursorRule, CURSOR_RULE);
       rememberTarget("cursor", cursorRule);
     }
     if (harnesses.includes("agents")) {
-      const agentsFile = join9(root, "AGENTS.md");
+      const agentsFile = join10(root, "AGENTS.md");
       plan(agentsFile, managedFileContent(agentsFile, PROJECT_INSTRUCTIONS, options.force === true, root), true);
       rememberTarget("agents", agentsFile);
     }
     if (harnesses.includes("copilot")) {
-      const copilotFile = join9(root, ".github", "copilot-instructions.md");
+      const copilotFile = join10(root, ".github", "copilot-instructions.md");
       plan(copilotFile, managedFileContent(copilotFile, PROJECT_INSTRUCTIONS, options.force === true, root), true);
       rememberTarget("copilot", copilotFile);
     }
     if (harnesses.includes("gemini")) {
-      const geminiFile = join9(root, "GEMINI.md");
+      const geminiFile = join10(root, "GEMINI.md");
       plan(geminiFile, managedFileContent(geminiFile, PROJECT_INSTRUCTIONS, options.force === true, root), true);
       rememberTarget("gemini", geminiFile);
     }
@@ -4937,11 +5004,11 @@ function installSkill(options = {}) {
       conflicts.push(`${file.target} (redirected by symbolic link ${symlink})`);
       continue;
     }
-    if (!existsSync9(file.target)) {
+    if (!existsSync10(file.target)) {
       writtenPaths.add(file.target);
       continue;
     }
-    const current = readFileSync8(file.target, "utf8");
+    const current = readFileSync9(file.target, "utf8");
     if (current === file.content) {
       unchangedPaths.add(file.target);
     } else if (file.managedMerge || options.force) {
@@ -4958,7 +5025,7 @@ ${conflicts.map((f) => `  - ${f}`).join("\n")}`
     );
   }
   for (const file of plans.values()) {
-    if (!existsSync9(file.target) || readFileSync8(file.target, "utf8") !== file.content) {
+    if (!existsSync10(file.target) || readFileSync9(file.target, "utf8") !== file.content) {
       mkdirSync3(dirname7(file.target), { recursive: true });
       writeFileSync3(file.target, file.content);
     }
@@ -5001,9 +5068,9 @@ function normalizeHarnesses(values, global) {
 function managedFileContent(path, block, force, boundary) {
   const symlink = symlinkedComponent(boundary, path);
   if (symlink) throw new Error(`refusing to manage ${path}: symbolic link component ${symlink}`);
-  if (!existsSync9(path)) return `${block}
+  if (!existsSync10(path)) return `${block}
 `;
-  const current = readFileSync8(path, "utf8");
+  const current = readFileSync9(path, "utf8");
   const start = "<!-- odla-ai agent setup:start -->";
   const end = "<!-- odla-ai agent setup:end -->";
   const startAt = current.indexOf(start);
@@ -5030,7 +5097,7 @@ function symlinkedComponent(boundary, target) {
   }
   let current = boundary;
   for (const part of rel.split(sep).filter(Boolean)) {
-    current = join9(current, part);
+    current = join10(current, part);
     try {
       if (lstatSync(current).isSymbolicLink()) return current;
     } catch (error) {
@@ -5043,11 +5110,11 @@ function skillNames(files) {
   return [...new Set(files.filter((file) => /(^|[\\/])SKILL\.md$/.test(file)).map((file) => file.split(/[\\/]/)[0]))].sort();
 }
 function listFiles(dir) {
-  if (!existsSync9(dir)) return [];
+  if (!existsSync10(dir)) return [];
   const results = [];
   const walk = (current) => {
     for (const entry of readdirSync(current, { withFileTypes: true })) {
-      const path = join9(current, entry.name);
+      const path = join10(current, entry.name);
       if (entry.isDirectory()) walk(path);
       else results.push(relative2(dir, path));
     }
@@ -5404,7 +5471,7 @@ async function projectCommand(command, parsed, deps) {
 }
 
 // src/code-connect.ts
-import { existsSync as existsSync10 } from "fs";
+import { existsSync as existsSync11 } from "fs";
 import { cpus, hostname, totalmem } from "os";
 import { resolve as resolve11 } from "path";
 
@@ -5415,7 +5482,7 @@ var HARNESS_PROTOCOL_VERSION = 1;
 import { execFile, spawn as spawn3 } from "child_process";
 import { constants } from "fs";
 import { access } from "fs/promises";
-import { delimiter, join as join10 } from "path";
+import { delimiter, join as join11 } from "path";
 import { getgid, getuid } from "process";
 import { mkdir as mkdir2, mkdtemp, realpath, rm, writeFile as writeFile2 } from "fs/promises";
 import { tmpdir } from "os";
@@ -5433,7 +5500,7 @@ function assertPinnedImage(image) {
 async function commandAvailable(engine) {
   for (const directory of (process.env.PATH ?? "").split(delimiter).filter(Boolean)) {
     try {
-      await access(join10(directory, engine), constants.X_OK);
+      await access(join11(directory, engine), constants.X_OK);
       return true;
     } catch {
     }
@@ -6131,7 +6198,7 @@ import { randomUUID } from "crypto";
 import { createHash as createHash22, randomUUID as randomUUID2 } from "crypto";
 import { createReadStream } from "fs";
 import { lstat as lstat22 } from "fs/promises";
-import { join as join12 } from "path";
+import { join as join13 } from "path";
 import { mkdir as mkdir3, mkdtemp as mkdtemp3, rm as rm3, writeFile as writeFile3 } from "fs/promises";
 import { tmpdir as tmpdir3 } from "os";
 import { dirname as dirname9, join as join23, resolve as resolve32, sep as sep23 } from "path";
@@ -6518,8 +6585,8 @@ function rollup(graph, kind, options = {}) {
   for (const node of nodesOfKind(graph, kind)) {
     if (options.prefix && !node.name.startsWith(options.prefix)) continue;
     const key = node.name.split(separator).slice(0, depth).join(separator);
-    const list2 = groups.get(key);
-    if (list2) list2.push(node);
+    const list3 = groups.get(key);
+    if (list3) list3.push(node);
     else groups.set(key, [node]);
   }
   return [...groups].map(([prefix, nodes]) => ({
@@ -6534,7 +6601,7 @@ function dirname8(path) {
   const at = path.lastIndexOf("/");
   return at <= 0 ? "." : path.slice(0, at);
 }
-function join11(base, specifier) {
+function join12(base, specifier) {
   const parts = [];
   const segments = `${base === "." ? "" : `${base}/`}${specifier}`.split("/");
   for (const segment of segments) {
@@ -6558,7 +6625,7 @@ var BARE_IMPORT = /^\s*import\s*["']([^"']+)["']/gm;
 var isSourcePath = (path) => SOURCE.test(path);
 function resolveImport(fromPath, specifier, known) {
   if (!specifier.startsWith(".")) return null;
-  const base = join11(dirname8(fromPath), specifier);
+  const base = join12(dirname8(fromPath), specifier);
   const candidates = [
     base,
     base.replace(/\.js$/, ".ts"),
@@ -7361,7 +7428,7 @@ async function inspectArtifacts(workspaceDir, recipe2) {
   const receipts = [];
   for (const artifact of recipe2.expectedArtifacts ?? []) {
     try {
-      const path = join12(workspaceDir, artifact.path);
+      const path = join13(workspaceDir, artifact.path);
       const info = await lstat22(path);
       if (!info.isFile() || info.isSymbolicLink()) {
         receipts.push({ artifactId: artifact.id, status: "invalid", bytes: null, digest: null });
@@ -9457,7 +9524,7 @@ var CODE_BUILD_RECIPES = Object.freeze([{
 async function codeConnect(options) {
   const cwd = options.cwd ?? process.cwd();
   const configPath = resolve11(cwd, options.configPath);
-  const cfg = existsSync10(configPath) ? await loadProjectConfig(configPath) : null;
+  const cfg = existsSync11(configPath) ? await loadProjectConfig(configPath) : null;
   const requestedAppId = options.appId?.trim();
   if (requestedAppId && !/^[a-z0-9][a-z0-9-]{1,62}$/.test(requestedAppId)) {
     throw new Error("--app-id must be a valid odla app id");
@@ -9891,13 +9958,13 @@ async function codeCommand(parsed, dependencies) {
 }
 
 // src/operator-credentials.ts
-import process12 from "process";
+import process13 from "process";
 function developerTokenStatus(context, parsed, now = Date.now()) {
   const cached = readJsonFile(context.cfg.local.tokenFile);
   const cacheStatus = !cached?.token ? "missing" : cached.platform !== context.platform.value ? "other-platform" : (cached.expiresAt ?? 0) <= now + 6e4 ? "expired" : "valid";
   const source = clean3(
     stringOpt(parsed.options.token)
-  ) ? "flag" : clean3(process12.env.ODLA_DEV_TOKEN) ? "environment" : cacheStatus === "valid" ? "cache" : "missing";
+  ) ? "flag" : clean3(process13.env.ODLA_DEV_TOKEN) ? "environment" : cacheStatus === "valid" ? "cache" : "missing";
   return {
     source,
     cacheFile: context.cfg.local.tokenFile,
@@ -10219,6 +10286,9 @@ Usage:
   odla-ai security run [target] --ack-redacted-source [--env dev] [--profile odla] [--fail-on high]
   odla-ai security run [target] --self --ack-redacted-source
   odla-ai provision [--live] [--config odla.config.mjs] [--email <odla-account>] [--request-grant] [--no-open] [--wait <seconds>] [--dry-run] [--push-secrets] [--rotate-o11y-token] [--write-dev-vars[=path]] [--yes]
+  odla-ai device enroll [--app <id>[,<id>...]] [--name <label>] [--capability <c>[,<c>...]] [--email <odla-account>] [--no-open] [--json]
+  odla-ai device list [--email <odla-account>] [--json]
+  odla-ai device revoke <device-id> [--email <odla-account>] [--json]
   odla-ai credentials list [--config odla.config.mjs] [--env dev] [--all] [--json]
   odla-ai credentials revoke <receipt-id> [--config odla.config.mjs] [--json]
   odla-ai smoke [--config odla.config.mjs] [--env dev] [--runtime] [--email <odla-account>] [--no-open]
@@ -10324,6 +10394,10 @@ Commands:
                stable status, incident, and report JSON to agents and CI.
   platform     Read canonical fleet health, releases, provider load/freshness,
                explicit unknowns, and next actions through a read-only grant.
+  device       Enrol THIS machine once, then stop asking. A human approves the
+               enrollment in the browser; from then on this terminal mints its
+               own short-lived credentials for the named projects with nobody's
+               attention, until the device expires or is revoked.
   provision    Register services, compose integrations, persist credentials, optionally push secrets.
                "provision --live --yes" initializes only the live instance of
                an existing sandbox app and enables every configured service;
@@ -12606,7 +12680,7 @@ function percent(value2) {
 // src/provision.ts
 import { AppsError as AppsError2, createAppsClient as createAppsClient3, orderAppServices as orderAppServices3, tenantIdFor as tenantIdFor6 } from "@odla-ai/apps";
 import { putSecret as putSecret2 } from "@odla-ai/ai";
-import process13 from "process";
+import process14 from "process";
 
 // src/integration-provision.ts
 import { uuidv7 } from "@odla-ai/db";
@@ -13042,7 +13116,7 @@ async function provision(options) {
       await provisionIntegrationSeeds(doFetch, cfg.dbEndpoint, tenantId, dbKey, database.integrations, env, out);
     }
     if (cfg.services.includes("ai") && cfg.ai?.provider && cfg.ai.keyEnv) {
-      const key = process13.env[cfg.ai.keyEnv];
+      const key = process14.env[cfg.ai.keyEnv];
       if (key) {
         const secretName = cfg.ai.secretName ?? defaultSecretName(cfg.ai.provider);
         await putSecret2({ endpoint: cfg.dbEndpoint, token, fetch: doFetch }, tenantId, secretName, key);
@@ -13084,7 +13158,7 @@ async function provision(options) {
 
 // src/record.ts
 import { appendFileSync } from "fs";
-import process14 from "process";
+import process15 from "process";
 
 // src/surface.ts
 var PM_ACTIONS = {
@@ -13154,6 +13228,7 @@ var COMMAND_SURFACE = {
   config: { diff: {}, plan: {}, apply: {} },
   context: { show: {}, list: {}, save: {}, remove: {} },
   credentials: { list: {}, revoke: {} },
+  device: { enroll: {}, list: {}, revoke: {} },
   // `watch`, `read`, `reply`, and `resolve` take a topic id from there on.
   discuss: {
     groups: {},
@@ -13265,7 +13340,7 @@ function surfacePaths(node = COMMAND_SURFACE, prefix = []) {
 
 // src/record.ts
 function recordInvocation(parsed) {
-  const file = process14.env.ODLA_CLI_RECORD;
+  const file = process15.env.ODLA_CLI_RECORD;
   if (!file) return;
   try {
     const entry = {
@@ -13279,8 +13354,132 @@ function recordInvocation(parsed) {
   }
 }
 
+// src/advisory-output.ts
+import { formatAdvisory, parseAdvisories } from "@odla-ai/apps";
+function advisoryCollectingFetch(inner, sink) {
+  return (async (input, init) => {
+    const response2 = await inner(input, init);
+    try {
+      sink.push(...parseAdvisories(response2));
+    } catch {
+    }
+    return response2;
+  });
+}
+function renderAdvisories(out, advisories, env = process.env) {
+  if (env.ODLA_NO_ADVISORIES) return;
+  const seen = /* @__PURE__ */ new Set();
+  for (const advisory of advisories) {
+    const key = `${advisory.code}:${advisory.message}`;
+    if (seen.has(key)) continue;
+    seen.add(key);
+    out.error(formatAdvisory(advisory));
+  }
+}
+
+// src/device-command.ts
+import { chmodSync as chmodSync2, mkdirSync as mkdirSync4, writeFileSync as writeFileSync4 } from "fs";
+import { dirname as dirname10 } from "path";
+import process16 from "process";
+async function deviceCommand(parsed, deps) {
+  const action2 = parsed.positionals[1] ?? "";
+  const out = deps.stdout ?? console;
+  const doFetch = deps.fetch ?? fetch;
+  const cfg = await loadProjectConfig(stringOpt(parsed.options.config));
+  const json = parsed.options.json === true;
+  if (action2 === "enroll") return enroll(parsed, deps, cfg, doFetch, out, json);
+  if (action2 === "list") return list2(parsed, deps, cfg, doFetch, out, json);
+  if (action2 === "revoke") return revoke(parsed, deps, cfg, doFetch, out, json);
+  throw new Error('odla-ai device expects "enroll", "list", or "revoke"');
+}
+async function enroll(parsed, deps, cfg, doFetch, out, json) {
+  const name = stringOpt(parsed.options.name) ?? defaultDeviceName();
+  const apps = (stringOpt(parsed.options.app) ?? cfg.app.id).split(",").map((id2) => id2.trim()).filter(Boolean);
+  if (apps.length === 0) throw new Error("device enroll needs --app <id>[,<id>\u2026]");
+  const token = await scopedToken2(parsed, deps, cfg, doFetch, out, `odla CLI (enroll ${name})`);
+  const response2 = await doFetch(`${cfg.platformUrl}/registry/devices`, {
+    method: "POST",
+    headers: { authorization: `Bearer ${token}`, "content-type": "application/json" },
+    body: JSON.stringify({
+      name,
+      platform: process16.platform,
+      appIds: apps,
+      ...parsed.options.capability ? { capabilities: String(parsed.options.capability).split(",").map((c) => c.trim()).filter(Boolean) } : {}
+    })
+  });
+  const body = await response2.json().catch(() => ({}));
+  if (!response2.ok || !body.token || !body.device) {
+    throw new Error(`device enroll failed: ${body.error?.message ?? `registry returned ${response2.status}`} (${response2.status})`);
+  }
+  const path = deviceCredentialPath();
+  mkdirSync4(dirname10(path), { recursive: true });
+  writeFileSync4(path, JSON.stringify({
+    token: body.token,
+    platform: cfg.platformUrl.replace(/\/$/, ""),
+    deviceId: body.device.deviceId,
+    name
+  }, null, 2));
+  chmodSync2(path, 384);
+  out.error(`device: enrolled "${name}" for ${body.device.appIds.join(", ")}; credential written to ${path}`);
+  out.error("device: this terminal will mint its own credentials from now on \u2014 no further approvals.");
+  if (json) {
+    out.log(JSON.stringify({ deviceId: body.device.deviceId, name, appIds: body.device.appIds, expiresAt: body.device.expiresAt }, null, 2));
+  }
+}
+async function list2(parsed, deps, cfg, doFetch, out, json) {
+  const token = await scopedToken2(parsed, deps, cfg, doFetch, out, "odla CLI (device list)");
+  const response2 = await doFetch(`${cfg.platformUrl}/registry/devices`, {
+    headers: { authorization: `Bearer ${token}` }
+  });
+  const body = await response2.json().catch(() => ({}));
+  if (!response2.ok || !body.devices) {
+    throw new Error(`device list failed: ${body.error?.message ?? `registry returned ${response2.status}`} (${response2.status})`);
+  }
+  if (json) return out.log(JSON.stringify(body.devices, null, 2));
+  if (body.devices.length === 0) return out.log("no enrolled devices");
+  for (const device of body.devices) {
+    const state2 = device.revokedAt ? "revoked" : device.expiresAt <= Date.now() ? "expired" : "active";
+    out.log(`${device.deviceId}  ${state2.padEnd(7)}  ${device.name}  [${device.appIds.join(", ")}]`);
+  }
+}
+async function revoke(parsed, deps, cfg, doFetch, out, json) {
+  const deviceId = parsed.positionals[2];
+  if (!deviceId) throw new Error("device revoke needs the device id from `odla-ai device list`");
+  const token = await scopedToken2(parsed, deps, cfg, doFetch, out, "odla CLI (device revoke)");
+  const response2 = await doFetch(`${cfg.platformUrl}/registry/devices/${encodeURIComponent(deviceId)}/revoke`, {
+    method: "POST",
+    headers: { authorization: `Bearer ${token}` }
+  });
+  if (!response2.ok) {
+    const body = await response2.json().catch(() => ({}));
+    throw new Error(`device revoke failed: ${body.error?.message ?? `registry returned ${response2.status}`} (${response2.status})`);
+  }
+  out.error(`device: revoked ${deviceId}; every credential it minted is revoked with it`);
+  if (json) out.log(JSON.stringify({ deviceId, revoked: true }, null, 2));
+}
+async function scopedToken2(parsed, deps, cfg, doFetch, out, label) {
+  const { credentials } = await resolveOperatorContext(parsed, { allowMissingConfig: true });
+  const scopedTokenFile = credentials.scopedTokenFile;
+  return getScopedPlatformToken({
+    platform: cfg.platformUrl,
+    scope: "app:device:enroll",
+    email: stringOpt(parsed.options.email),
+    label,
+    fetch: doFetch,
+    stdout: out,
+    open: parsed.options.open === false ? false : parsed.options.open === true ? true : void 0,
+    openApprovalUrl: deps.openUrl,
+    rootDir: cfg.rootDir,
+    tokenFile: scopedTokenFile,
+    ...stringOpt(parsed.options.token) ? { token: stringOpt(parsed.options.token) } : {}
+  });
+}
+function defaultDeviceName() {
+  return `${process16.env.HOSTNAME ?? process16.env.HOST ?? "machine"}-${process16.platform}`;
+}
+
 // src/runbook-actions.ts
-import { readFileSync as readFileSync9 } from "fs";
+import { readFileSync as readFileSync10 } from "fs";
 var PLATFORM_SCOPE = "$platform";
 async function call(ctx, method, path, body) {
   const res = await ctx.doFetch(`${ctx.platformUrl.replace(/\/$/, "")}/registry/pm${path}`, {
@@ -13327,7 +13526,7 @@ async function bySlug(ctx, slug) {
 function readBody(file, inline) {
   if (inline !== void 0) return inline;
   if (file === void 0) throw new Error("supply the new text with --file <path>, --file - (stdin), or --body");
-  return readFileSync9(file === "-" ? 0 : file, "utf8");
+  return readFileSync10(file === "-" ? 0 : file, "utf8");
 }
 var stamp = (ms) => ms ? new Date(ms).toISOString().slice(0, 16).replace("T", " ") : "";
 async function runbookList(ctx, all, query) {
@@ -13419,8 +13618,8 @@ async function runbookRemove(ctx, slug) {
 }
 
 // src/runbook-import.ts
-import { readFileSync as readFileSync10, readdirSync as readdirSync2, statSync } from "fs";
-import { basename as basename2, join as join13 } from "path";
+import { readFileSync as readFileSync11, readdirSync as readdirSync2, statSync } from "fs";
+import { basename as basename2, join as join14 } from "path";
 function parseRunbook(text3, slug) {
   let rest = text3;
   const meta = {};
@@ -13450,7 +13649,7 @@ function readRunbookDir(dir) {
   if (!files.length) throw new Error(`no .md files in ${dir}`);
   return files.map((file) => {
     const slug = basename2(file, ".md");
-    const parsed = parseRunbook(readFileSync10(join13(dir, file), "utf8"), slug);
+    const parsed = parseRunbook(readFileSync11(join14(dir, file), "utf8"), slug);
     return { file, slug, ...parsed, words: parsed.body.split(/\s+/).filter(Boolean).length };
   });
 }
@@ -13523,8 +13722,8 @@ async function upsert(ctx, r, visibility) {
 
 // src/runbook-impact.ts
 import { execFileSync as execFileSync2 } from "child_process";
-import { existsSync as existsSync11, readFileSync as readFileSync11 } from "fs";
-import { join as join14 } from "path";
+import { existsSync as existsSync12, readFileSync as readFileSync12 } from "fs";
+import { join as join15 } from "path";
 
 // src/runbook-impact-scan.ts
 var DECL = /^[+-]\s*export\s+(?:declare\s+)?(?:default\s+)?(?:abstract\s+)?(?:async\s+)?(?:const|let|var|function|class|interface|type|enum)\s+([A-Za-z_$][\w$]*)/;
@@ -13693,10 +13892,10 @@ ${body.split("\n").map((line2) => `+${line2}`).join("\n")}
 }
 function manifestLabeller(root) {
   return (workspace) => {
-    const manifest = join14(root, workspace, "package.json");
-    if (!existsSync11(manifest)) return void 0;
+    const manifest = join15(root, workspace, "package.json");
+    if (!existsSync12(manifest)) return void 0;
     try {
-      const name = JSON.parse(readFileSync11(manifest, "utf8")).name;
+      const name = JSON.parse(readFileSync12(manifest, "utf8")).name;
       return typeof name === "string" ? name : void 0;
     } catch {
       return void 0;
@@ -13763,7 +13962,7 @@ function report4(ctx, impacts) {
 async function runbookImpact(ctx, options, deps = {}) {
   const cwd = deps.cwd ?? process.cwd();
   const runGit = deps.runGit ?? gitRunner(cwd);
-  const read3 = deps.readRepoFile ?? ((path) => readFileSync11(join14(cwd, path), "utf8"));
+  const read3 = deps.readRepoFile ?? ((path) => readFileSync12(join15(cwd, path), "utf8"));
   const surfaces = changedSurfaces(collectDiff(runGit, options.base, read3), manifestLabeller(cwd));
   if (!surfaces.length) {
     return ctx.out.log(
@@ -13896,12 +14095,12 @@ async function runbookComment(ctx, slug, body) {
 
 // src/runbook-editor.ts
 import { spawnSync } from "child_process";
-import { mkdtempSync, readFileSync as readFileSync12, rmSync as rmSync2, writeFileSync as writeFileSync4 } from "fs";
+import { mkdtempSync, readFileSync as readFileSync13, rmSync as rmSync3, writeFileSync as writeFileSync5 } from "fs";
 import { tmpdir as tmpdir4 } from "os";
-import { join as join15 } from "path";
-import process15 from "process";
+import { join as join16 } from "path";
+import process17 from "process";
 var EDITOR_ENV = ["ODLA_EDITOR", "VISUAL", "EDITOR"];
-function resolveEditor(env = process15.env) {
+function resolveEditor(env = process17.env) {
   for (const name of EDITOR_ENV) {
     const value2 = env[name];
     if (value2 && value2.trim()) return value2.trim();
@@ -13915,8 +14114,8 @@ function defaultRun(command, path) {
   return result.status ?? 0;
 }
 function editText(initial, slug, deps = {}) {
-  const env = deps.env ?? process15.env;
-  const interactive = deps.interactive ?? (() => Boolean(process15.stdin.isTTY));
+  const env = deps.env ?? process17.env;
+  const interactive = deps.interactive ?? (() => Boolean(process17.stdin.isTTY));
   const editor = resolveEditor(env);
   if (!editor)
     throw new Error(
@@ -13924,16 +14123,16 @@ function editText(initial, slug, deps = {}) {
     );
   if (!interactive())
     throw new Error(`cannot open an editor without a terminal \u2014 pass --file <path> or --body "\u2026" instead`);
-  const dir = mkdtempSync(join15(tmpdir4(), "odla-runbook-"));
-  const file = join15(dir, `${slug}.md`);
+  const dir = mkdtempSync(join16(tmpdir4(), "odla-runbook-"));
+  const file = join16(dir, `${slug}.md`);
   try {
-    writeFileSync4(file, initial, { mode: 384 });
+    writeFileSync5(file, initial, { mode: 384 });
     const code = defaultRunOrInjected(deps)(editor, file);
     if (code !== 0) throw new Error(`editor "${editor}" exited with ${code}; nothing was written`);
-    const edited = readFileSync12(file, "utf8");
+    const edited = readFileSync13(file, "utf8");
     return edited === initial ? null : edited;
   } finally {
-    rmSync2(dir, { recursive: true, force: true });
+    rmSync3(dir, { recursive: true, force: true });
   }
 }
 var defaultRunOrInjected = (deps) => deps.run ?? defaultRun;
@@ -14821,6 +15020,23 @@ async function securityStatus(parsed, dependencies) {
 
 // src/cli.ts
 async function runCli(argv = process.argv.slice(2), dependencies = {}) {
+  const out = redactingOutput(dependencies.stdout ?? console);
+  const advisories = [];
+  const withAdvisoryReader = {
+    ...dependencies,
+    fetch: advisoryCollectingFetch(dependencies.fetch ?? fetch, advisories)
+  };
+  try {
+    return await dispatchCli(argv, withAdvisoryReader);
+  } catch (error) {
+    const explanation = explainRejectedCredential(error);
+    if (explanation) out.error(explanation);
+    throw error;
+  } finally {
+    renderAdvisories(out, advisories);
+  }
+}
+async function dispatchCli(argv, dependencies) {
   const runtime = {
     ...dependencies,
     stdout: redactingOutput(dependencies.stdout ?? console)
@@ -14850,6 +15066,10 @@ async function runCli(argv = process.argv.slice(2), dependencies = {}) {
     await contextCommand(parsed, runtime);
     return;
   }
+  if (command === "device") {
+    await deviceCommand(parsed, runtime);
+    return;
+  }
   if (command === "credentials") {
     await credentialCommand(parsed, runtime);
     return;
@@ -15045,4 +15265,4 @@ export {
   isTerminalHostedSecurityStatus,
   runCli
 };
-//# sourceMappingURL=chunk-SRL2TN24.js.map
+//# sourceMappingURL=chunk-DBZQIMES.js.map