@odla-ai/cli 0.35.1 → 0.36.0

package/dist/index.cjs

@@ -97,12 +97,12 @@ var getImportMetaUrl = () => typeof document === "undefined" ? new URL(`file:${_
 var importMetaUrl = /* @__PURE__ */ getImportMetaUrl();
 
 // src/admin-ai.ts
-var import_node_process7 = __toESM(require("process"), 1);
+var import_node_process8 = __toESM(require("process"), 1);
 
 // src/token.ts
 var import_db = require("@odla-ai/db");
 var import_node_crypto = require("crypto");
-var import_node_process4 = __toESM(require("process"), 1);
+var import_node_process5 = __toESM(require("process"), 1);
 
 // src/handshake-approval.ts
 var import_node_process2 = __toESM(require("process"), 1);
@@ -236,13 +236,72 @@ function handshakeWaitMs(waitSeconds, interactive = import_node_process3.default
   return interactive ? void 0 : 9e4;
 }
 
-// src/local.ts
+// src/cached-credential.ts
 var import_node_fs2 = require("fs");
+var noted = null;
+function noteCachedCredential(tokenFile) {
+  noted = tokenFile;
+}
+function isCredentialRejection(error) {
+  const message2 = error instanceof Error ? error.message : String(error ?? "");
+  return /\((401|403)\)\s*$/.test(message2.trim());
+}
+function explainRejectedCredential(error) {
+  const tokenFile = noted;
+  if (!tokenFile || !isCredentialRejection(error)) return null;
+  noted = null;
+  (0, import_node_fs2.rmSync)(tokenFile, { force: true });
+  return [
+    "auth: the cached credential was rejected by odla, so it was revoked before its cached expiry.",
+    "   The usual cause is a newer sign-in for this project: collecting a handshake retires the",
+    "   principal's other credentials, so a second terminal or worktree supersedes this one.",
+    `   Discarded ${tokenFile}; re-run this command to request a fresh approval.`
+  ].join("\n");
+}
+
+// src/device-session.ts
+var import_node_fs3 = require("fs");
+var import_node_os = require("os");
 var import_node_path2 = require("path");
+var import_node_process4 = __toESM(require("process"), 1);
+function deviceCredentialPath(env = import_node_process4.default.env) {
+  return env.ODLA_DEVICE_CREDENTIAL ?? (0, import_node_path2.join)(env.HOME ?? (0, import_node_os.homedir)(), ".odla", "device.json");
+}
+function readDeviceCredential(platform, env = import_node_process4.default.env) {
+  const path = deviceCredentialPath(env);
+  if (!(0, import_node_fs3.existsSync)(path)) return null;
+  try {
+    const parsed = JSON.parse((0, import_node_fs3.readFileSync)(path, "utf8"));
+    if (typeof parsed.token !== "string" || !parsed.token.startsWith("odla_device_")) return null;
+    if (parsed.platform !== platform) return null;
+    return { ...parsed, token: parsed.token, platform: parsed.platform };
+  } catch {
+    return null;
+  }
+}
+async function mintDeviceSession(platformUrl, credential2, doFetch) {
+  const response2 = await doFetch(`${platformUrl.replace(/\/$/, "")}/registry/devices/session`, {
+    method: "POST",
+    headers: { authorization: `Bearer ${credential2.token}`, "content-type": "application/json" },
+    body: "{}"
+  });
+  const body = await response2.json().catch(() => ({}));
+  if (!response2.ok || typeof body.token !== "string") {
+    const detail = body.error?.message ?? `registry returned ${response2.status}`;
+    throw new Error(
+      `device session failed: ${detail} (${response2.status}) \u2014 if this machine's enrollment was revoked or has expired, enroll it again in Studio`
+    );
+  }
+  return { token: body.token, expiresAt: body.expiresAt ?? Date.now() };
+}
+
+// src/local.ts
+var import_node_fs4 = require("fs");
+var import_node_path3 = require("path");
 var GITIGNORE_LINES = [".odla/*.local.json", ".odla/dev-token.json", ".dev.vars"];
 function readJsonFile(path) {
   try {
-    return JSON.parse((0, import_node_fs2.readFileSync)(path, "utf8"));
+    return JSON.parse((0, import_node_fs4.readFileSync)(path, "utf8"));
   } catch {
     return null;
   }
@@ -252,10 +311,10 @@ function writePrivateJson(path, value2) {
 `);
 }
 function readCredentials(path) {
-  if (!(0, import_node_fs2.existsSync)(path)) return null;
+  if (!(0, import_node_fs4.existsSync)(path)) return null;
   let value2;
   try {
-    value2 = JSON.parse((0, import_node_fs2.readFileSync)(path, "utf8"));
+    value2 = JSON.parse((0, import_node_fs4.readFileSync)(path, "utf8"));
   } catch {
     throw new Error(`credentials file ${path} is not valid JSON; fix or remove it before provisioning`);
   }
@@ -285,14 +344,14 @@ function mergeCredential(current, update) {
   return next;
 }
 function ensureGitignore(rootDir, localPaths = []) {
-  const path = (0, import_node_path2.resolve)(rootDir, ".gitignore");
-  const existing = (0, import_node_fs2.existsSync)(path) ? (0, import_node_fs2.readFileSync)(path, "utf8") : "";
+  const path = (0, import_node_path3.resolve)(rootDir, ".gitignore");
+  const existing = (0, import_node_fs4.existsSync)(path) ? (0, import_node_fs4.readFileSync)(path, "utf8") : "";
   const configured = localPaths.map((localPath) => gitignoreEntry(rootDir, localPath)).filter((line2) => !!line2);
   const wanted = [.../* @__PURE__ */ new Set([...GITIGNORE_LINES, ...configured])];
   const missing = wanted.filter((line2) => !existing.split(/\r?\n/).includes(line2));
   if (missing.length === 0) return;
   const prefix = existing && !existing.endsWith("\n") ? "\n" : "";
-  (0, import_node_fs2.writeFileSync)(path, `${existing}${prefix}${missing.join("\n")}
+  (0, import_node_fs4.writeFileSync)(path, `${existing}${prefix}${missing.join("\n")}
 `);
 }
 function o11yDevVars(cfg) {
@@ -306,7 +365,7 @@ function o11yDevVars(cfg) {
 function resolveWriteDevVarsTarget(cfg, requested) {
   if (!requested) return null;
   if (requested === true) return cfg.local.devVarsFile;
-  return (0, import_node_path2.resolve)((0, import_node_path2.dirname)(cfg.configPath), requested);
+  return (0, import_node_path3.resolve)((0, import_node_path3.dirname)(cfg.configPath), requested);
 }
 function writeDevVars(path, credentials, env, o11y) {
   const entry = credentials.envs[env];
@@ -320,7 +379,7 @@ function writeDevVars(path, credentials, env, o11y) {
     if (o11y.version) lines.push(`ODLA_O11Y_VERSION="${o11y.version}"`);
     if (entry.o11yToken) lines.push(`ODLA_O11Y_TOKEN="${entry.o11yToken}"`);
   }
-  const existing = (0, import_node_fs2.existsSync)(path) ? (0, import_node_fs2.readFileSync)(path, "utf8") : "";
+  const existing = (0, import_node_fs4.existsSync)(path) ? (0, import_node_fs4.readFileSync)(path, "utf8") : "";
   const retained = existing.split(/\r?\n/).filter((line2) => !isManagedDevVar(line2));
   while (retained.at(-1) === "") retained.pop();
   const prefix = retained.length ? `${retained.join("\n")}
@@ -346,19 +405,19 @@ function isManagedDevVar(line2) {
   return !!match?.[1] && MANAGED_DEV_VARS.has(match[1]);
 }
 function writePrivateText(path, text3) {
-  (0, import_node_fs2.mkdirSync)((0, import_node_path2.dirname)(path), { recursive: true });
+  (0, import_node_fs4.mkdirSync)((0, import_node_path3.dirname)(path), { recursive: true });
   const temporary = `${path}.tmp-${process.pid}-${Date.now()}`;
-  (0, import_node_fs2.writeFileSync)(temporary, text3, { mode: 384 });
-  (0, import_node_fs2.chmodSync)(temporary, 384);
-  (0, import_node_fs2.renameSync)(temporary, path);
+  (0, import_node_fs4.writeFileSync)(temporary, text3, { mode: 384 });
+  (0, import_node_fs4.chmodSync)(temporary, 384);
+  (0, import_node_fs4.renameSync)(temporary, path);
 }
 function gitignoreEntry(rootDir, path) {
-  const rel = (0, import_node_path2.relative)((0, import_node_path2.resolve)(rootDir), (0, import_node_path2.resolve)(path));
-  if (!rel || rel === ".." || rel.startsWith(`..${process.platform === "win32" ? "\\" : "/"}`) || (0, import_node_path2.isAbsolute)(rel)) return null;
+  const rel = (0, import_node_path3.relative)((0, import_node_path3.resolve)(rootDir), (0, import_node_path3.resolve)(path));
+  if (!rel || rel === ".." || rel.startsWith(`..${process.platform === "win32" ? "\\" : "/"}`) || (0, import_node_path3.isAbsolute)(rel)) return null;
   return rel.replaceAll("\\", "/");
 }
 function displayPath(path, rootDir = process.cwd()) {
-  const rel = (0, import_node_path2.relative)(rootDir, path);
+  const rel = (0, import_node_path3.relative)(rootDir, path);
   return rel && !rel.startsWith("..") ? rel : path;
 }
 
@@ -370,17 +429,24 @@ async function getDeveloperToken(cfg, options, doFetch, out, grantRequest = {})
   const cached = readJsonFile(cfg.local.tokenFile);
   if (!grantRequest.forceReview && !grantRequest.freshLogin) {
     if (options.token) return options.token;
-    if (import_node_process4.default.env.ODLA_DEV_TOKEN) {
-      const declared = import_node_process4.default.env.ODLA_DEV_TOKEN_AUDIENCE;
+    if (import_node_process5.default.env.ODLA_DEV_TOKEN) {
+      const declared = import_node_process5.default.env.ODLA_DEV_TOKEN_AUDIENCE;
       if (declared) {
         if (platformAudience(declared) !== audience) throw new Error("ODLA_DEV_TOKEN_AUDIENCE does not match the configured platform");
       } else if (audience !== "https://odla.ai") {
         throw new Error("ODLA_DEV_TOKEN_AUDIENCE is required for a non-default platform");
       }
-      return import_node_process4.default.env.ODLA_DEV_TOKEN;
+      return import_node_process5.default.env.ODLA_DEV_TOKEN;
+    }
+    const device = readDeviceCredential(audience);
+    if (device) {
+      const session = await mintDeviceSession(cfg.platformUrl, device, doFetch);
+      out.error(`auth: session minted by this enrolled device (${displayPath(deviceCredentialPath(), cfg.rootDir)})`);
+      return session.token;
     }
     if (cached?.token && cached.platform === audience && (cached.expiresAt ?? 0) > Date.now() + 6e4 && cachedGrantCovers(cached, grantIntent)) {
       out.error(`auth: using cached developer token (${displayPath(cfg.local.tokenFile, cfg.rootDir)})`);
+      noteCachedCredential(cfg.local.tokenFile);
       return cached.token;
     }
   } else {
@@ -481,7 +547,7 @@ function stillPending(pending, email) {
   );
 }
 function handshakeEmail(value2, cached) {
-  const email = (value2 ?? import_node_process4.default.env.ODLA_USER_EMAIL ?? cached ?? "").trim().toLowerCase();
+  const email = (value2 ?? import_node_process5.default.env.ODLA_USER_EMAIL ?? cached ?? "").trim().toLowerCase();
   if (/@users\.noreply\.github\.com$/i.test(email)) {
     throw new Error(
       `"${email}" is a GitHub commit identity, not an odla account email; use --email <signed-in-odla-account> or ODLA_USER_EMAIL`
@@ -512,12 +578,12 @@ function platformAudience(value2) {
 }
 
 // src/secret-input.ts
-var import_node_process5 = __toESM(require("process"), 1);
+var import_node_process6 = __toESM(require("process"), 1);
 var MAX_BYTES = 64 * 1024;
 async function secretInputValue(options, kind = "credential") {
   if (options.fromEnv && options.stdin) throw new Error("choose exactly one of --from-env or --stdin");
   let value2;
-  if (options.fromEnv) value2 = import_node_process5.default.env[options.fromEnv];
+  if (options.fromEnv) value2 = import_node_process6.default.env[options.fromEnv];
   else if (options.stdin) value2 = await (options.readStdin ?? (() => readSecretStream(kind)))();
   else throw new Error(`${kind} input required: use --from-env <NAME> or --stdin; values are never accepted as arguments`);
   value2 = value2?.replace(/[\r\n]+$/, "");
@@ -525,7 +591,7 @@ async function secretInputValue(options, kind = "credential") {
   if (new TextEncoder().encode(value2).byteLength > MAX_BYTES) throw new Error(`${kind} exceeds 64 KiB`);
   return value2;
 }
-async function readSecretStream(kind, stream = import_node_process5.default.stdin) {
+async function readSecretStream(kind, stream = import_node_process6.default.stdin) {
   let value2 = "";
   for await (const chunk of stream) {
     value2 += String(chunk);
@@ -535,9 +601,9 @@ async function readSecretStream(kind, stream = import_node_process5.default.stdi
 }
 
 // src/admin-ai-auth.ts
-var import_node_fs3 = require("fs");
-var import_node_path3 = require("path");
-var import_node_process6 = __toESM(require("process"), 1);
+var import_node_fs5 = require("fs");
+var import_node_path4 = require("path");
+var import_node_process7 = __toESM(require("process"), 1);
 var import_db2 = require("@odla-ai/db");
 async function getScopedPlatformToken(options) {
   return resolveAdminPlatformToken(options);
@@ -545,7 +611,7 @@ async function getScopedPlatformToken(options) {
 async function resolveAdminPlatformToken(options) {
   const audience = platformAudience(options.platform);
   if (options.token) return options.token;
-  const fromEnv = import_node_process6.default.env.ODLA_ADMIN_TOKEN;
+  const fromEnv = import_node_process7.default.env.ODLA_ADMIN_TOKEN;
   if (fromEnv) return audienceBoundEnvToken(fromEnv, audience);
   return scopedToken(
     audience,
@@ -557,7 +623,7 @@ async function resolveAdminPlatformToken(options) {
 }
 function audienceBoundEnvToken(token, platform) {
   const audience = platformAudience(platform);
-  const declared = import_node_process6.default.env.ODLA_ADMIN_TOKEN_AUDIENCE;
+  const declared = import_node_process7.default.env.ODLA_ADMIN_TOKEN_AUDIENCE;
   if (declared) {
     if (platformAudience(declared) !== audience) throw new Error("ODLA_ADMIN_TOKEN_AUDIENCE does not match the configured platform");
   } else if (audience !== "https://odla.ai") {
@@ -570,6 +636,7 @@ var SCOPE_PURPOSE = {
   "app:config:read": "compare checked-in intent with an exact-id app Registry configuration",
   "app:config:write": "apply or inspect one revision-bound configuration operation for an app you own",
   "platform:runbook:write": "read and edit all of odla's operational runbooks, including admin-visible content",
+  "app:device:enroll": "enrol this machine so it can mint its own short-lived credentials without asking you again",
   "platform:ai:policy:write": "change System AI model routing",
   "platform:ai:policy:read": "read System AI model routing",
   "platform:ai:credential:write": "replace a stored AI provider key",
@@ -582,8 +649,8 @@ var SCOPE_PURPOSE = {
 };
 async function scopedToken(platform, scope, options, doFetch, out) {
   const audience = platformAudience(platform);
-  const rootDir = options.rootDir ?? import_node_process6.default.cwd();
-  const tokenFile = options.tokenFile ?? (0, import_node_path3.join)(rootDir, ".odla/admin-token.local.json");
+  const rootDir = options.rootDir ?? import_node_process7.default.cwd();
+  const tokenFile = options.tokenFile ?? (0, import_node_path4.join)(rootDir, ".odla/admin-token.local.json");
   const cache2 = options.cache === false ? null : readJsonFile(tokenFile);
   const cached = cache2?.platform === audience ? cache2.tokens?.[scope] : void 0;
   if (cached?.token && (cached.expiresAt ?? 0) > Date.now() + 6e4) {
@@ -610,7 +677,7 @@ async function scopedToken(platform, scope, options, doFetch, out) {
   if (options.cache !== false) {
     const tokens = cache2?.platform === audience ? { ...cache2.tokens ?? {} } : {};
     tokens[scope] = { token, expiresAt };
-    if ((0, import_node_fs3.existsSync)((0, import_node_path3.join)(rootDir, ".git"))) ensureGitignore(rootDir, [tokenFile]);
+    if ((0, import_node_fs5.existsSync)((0, import_node_path4.join)(rootDir, ".git"))) ensureGitignore(rootDir, [tokenFile]);
     writePrivateJson(tokenFile, { platform: audience, email, tokens });
     out.error(`auth: cached ${scope} grant (${tokenFile}; mode 0600)`);
   } else {
@@ -787,7 +854,7 @@ function isRecord2(value2) {
 
 // src/admin-ai.ts
 async function adminAi(options) {
-  const platform = platformAudience(options.platform ?? import_node_process7.default.env.ODLA_PLATFORM ?? "https://odla.ai");
+  const platform = platformAudience(options.platform ?? import_node_process8.default.env.ODLA_PLATFORM ?? "https://odla.ai");
   const doFetch = options.fetch ?? fetch;
   const out = options.stdout ?? console;
   const usageQuery = options.action === "usage" ? adminAiUsageQuery(options) : void 0;
@@ -1042,13 +1109,13 @@ function addOption(options, name, value2) {
 }
 
 // src/operator-context.ts
-var import_node_fs6 = require("fs");
-var import_node_path6 = require("path");
-var import_node_process9 = __toESM(require("process"), 1);
+var import_node_fs8 = require("fs");
+var import_node_path7 = require("path");
+var import_node_process10 = __toESM(require("process"), 1);
 
 // src/config.ts
-var import_node_fs4 = require("fs");
-var import_node_path4 = require("path");
+var import_node_fs6 = require("fs");
+var import_node_path5 = require("path");
 var import_node_url = require("url");
 var import_apps = require("@odla-ai/apps");
 
@@ -1453,12 +1520,12 @@ var DEFAULT_SERVICES = ["db", "ai"];
 var configImportSerial = 0;
 var GOOGLE_CALENDAR_EVENTS_SCOPE = "https://www.googleapis.com/auth/calendar.events";
 async function loadProjectConfig(configPath = "odla.config.mjs", options = {}) {
-  const resolved = (0, import_node_path4.resolve)(configPath);
-  if (!(0, import_node_fs4.existsSync)(resolved)) {
+  const resolved = (0, import_node_path5.resolve)(configPath);
+  if (!(0, import_node_fs6.existsSync)(resolved)) {
     throw new Error(`config not found: ${configPath}. Run "odla-ai init" first or pass --config.`);
   }
   const raw = await loadConfigModule(resolved);
-  const rootDir = (0, import_node_path4.dirname)(resolved);
+  const rootDir = (0, import_node_path5.dirname)(resolved);
   validateRawConfig(raw, resolved);
   const platformUrl = trimSlash(process.env.ODLA_PLATFORM_URL || raw.platformUrl || DEFAULT_PLATFORM);
   const dbEndpoint = trimSlash(process.env.ODLA_DB_ENDPOINT || raw.dbEndpoint || platformUrl);
@@ -1468,9 +1535,9 @@ async function loadProjectConfig(configPath = "odla.config.mjs", options = {}) {
   validateCalendarConfig(raw, unique3([...envs, ...options.additionalEnvs ?? []]), services, resolved);
   validateMonitoringConfig(raw, unique3([...envs, ...options.additionalEnvs ?? []]), services, resolved);
   const local = {
-    tokenFile: (0, import_node_path4.resolve)(rootDir, raw.local?.tokenFile ?? ".odla/dev-token.json"),
-    credentialsFile: (0, import_node_path4.resolve)(rootDir, raw.local?.credentialsFile ?? ".odla/credentials.local.json"),
-    devVarsFile: (0, import_node_path4.resolve)(rootDir, raw.local?.devVarsFile ?? ".dev.vars"),
+    tokenFile: (0, import_node_path5.resolve)(rootDir, raw.local?.tokenFile ?? ".odla/dev-token.json"),
+    credentialsFile: (0, import_node_path5.resolve)(rootDir, raw.local?.credentialsFile ?? ".odla/credentials.local.json"),
+    devVarsFile: (0, import_node_path5.resolve)(rootDir, raw.local?.devVarsFile ?? ".dev.vars"),
     gitignore: raw.local?.gitignore ?? true
   };
   return {
@@ -1487,9 +1554,9 @@ async function loadProjectConfig(configPath = "odla.config.mjs", options = {}) {
 async function resolveDataExport(cfg, value2, names) {
   if (value2 === void 0 || value2 === null || value2 === false) return void 0;
   if (typeof value2 !== "string") return value2;
-  const target = (0, import_node_path4.isAbsolute)(value2) ? value2 : (0, import_node_path4.resolve)(cfg.rootDir, value2);
+  const target = (0, import_node_path5.isAbsolute)(value2) ? value2 : (0, import_node_path5.resolve)(cfg.rootDir, value2);
   if (target.endsWith(".json")) {
-    return JSON.parse((0, import_node_fs4.readFileSync)(target, "utf8"));
+    return JSON.parse((0, import_node_fs6.readFileSync)(target, "utf8"));
   }
   const mod = await import((0, import_node_url.pathToFileURL)(target).href);
   for (const name of names) {
@@ -1565,7 +1632,7 @@ function validId2(value2) {
   return typeof value2 === "string" && /^[a-z0-9][a-z0-9-]*$/.test(value2);
 }
 async function loadConfigModule(path) {
-  if (path.endsWith(".json")) return JSON.parse((0, import_node_fs4.readFileSync)(path, "utf8"));
+  if (path.endsWith(".json")) return JSON.parse((0, import_node_fs6.readFileSync)(path, "utf8"));
   const nonce = `${Date.now()}-${configImportSerial++}`;
   const mod = await import(`${(0, import_node_url.pathToFileURL)(path).href}?reload=${nonce}`);
   const value2 = mod.default ?? mod.config;
@@ -1580,18 +1647,18 @@ function unique3(values) {
 }
 
 // src/operator-profiles.ts
-var import_node_fs5 = require("fs");
-var import_node_os = require("os");
-var import_node_path5 = require("path");
-var import_node_process8 = __toESM(require("process"), 1);
+var import_node_fs7 = require("fs");
+var import_node_os2 = require("os");
+var import_node_path6 = require("path");
+var import_node_process9 = __toESM(require("process"), 1);
 function operatorProfileFile() {
-  return (0, import_node_path5.resolve)(
-    clean(import_node_process8.default.env.ODLA_CONTEXT_FILE) ?? (0, import_node_path5.join)((0, import_node_os.homedir)(), ".odla", "contexts.json")
+  return (0, import_node_path6.resolve)(
+    clean(import_node_process9.default.env.ODLA_CONTEXT_FILE) ?? (0, import_node_path6.join)((0, import_node_os2.homedir)(), ".odla", "contexts.json")
   );
 }
 function resolveOperatorProfile(parsed) {
   const fromFlag = clean(stringOpt(parsed.options.context));
-  const fromEnvironment = clean(import_node_process8.default.env.ODLA_CONTEXT);
+  const fromEnvironment = clean(import_node_process9.default.env.ODLA_CONTEXT);
   const name = fromFlag ?? fromEnvironment ?? null;
   const file = operatorProfileFile();
   if (!name) {
@@ -1631,10 +1698,10 @@ function removeOperatorProfile(name, file = operatorProfileFile()) {
   return true;
 }
 function operatorCredentialFiles(selection) {
-  const base = selection.name ? (0, import_node_path5.join)((0, import_node_path5.dirname)(selection.file), "profiles", selection.name) : (0, import_node_path5.join)((0, import_node_os.homedir)(), ".odla");
+  const base = selection.name ? (0, import_node_path6.join)((0, import_node_path6.dirname)(selection.file), "profiles", selection.name) : (0, import_node_path6.join)((0, import_node_os2.homedir)(), ".odla");
   return {
-    developer: (0, import_node_path5.join)(base, "dev-token.json"),
-    scoped: (0, import_node_path5.join)(base, "admin-token.local.json")
+    developer: (0, import_node_path6.join)(base, "dev-token.json"),
+    scoped: (0, import_node_path6.join)(base, "admin-token.local.json")
   };
 }
 function assertOperatorName(value2, label) {
@@ -1645,10 +1712,10 @@ function assertOperatorName(value2, label) {
   }
 }
 function readOperatorProfiles(file) {
-  if (!(0, import_node_fs5.existsSync)(file)) return emptyProfiles();
+  if (!(0, import_node_fs7.existsSync)(file)) return emptyProfiles();
   let raw;
   try {
-    raw = JSON.parse((0, import_node_fs5.readFileSync)(file, "utf8"));
+    raw = JSON.parse((0, import_node_fs7.readFileSync)(file, "utf8"));
   } catch {
     throw new Error(`operator context file ${file} is not valid JSON`);
   }
@@ -1712,21 +1779,21 @@ var DEFAULT_PLATFORM2 = "https://odla.ai";
 async function resolveOperatorContext(parsed, options = {}) {
   const profile = resolveOperatorProfile(parsed);
   const configArgument = stringOpt(parsed.options.config) ?? "odla.config.mjs";
-  const configPath = (0, import_node_path6.resolve)(configArgument);
+  const configPath = (0, import_node_path7.resolve)(configArgument);
   const explicitConfig = parsed.options.config !== void 0;
-  const hasConfig = (0, import_node_fs6.existsSync)(configPath);
+  const hasConfig = (0, import_node_fs8.existsSync)(configPath);
   if (!hasConfig && (!options.allowMissingConfig || explicitConfig)) {
     await loadProjectConfig(configArgument);
   }
   const loaded = hasConfig ? await loadProjectConfig(configArgument) : void 0;
   const platformFlag = clean2(stringOpt(parsed.options.platform));
-  const platformEnvironment = clean2(import_node_process9.default.env.ODLA_PLATFORM_URL);
+  const platformEnvironment = clean2(import_node_process10.default.env.ODLA_PLATFORM_URL);
   const platformValue = platformAudience(
     platformFlag ?? platformEnvironment ?? profile.value?.platform ?? loaded?.platformUrl ?? DEFAULT_PLATFORM2
   );
   const platformSource = platformFlag ? "flag" : platformEnvironment ? "environment" : profile.value ? "profile" : loaded ? "config" : "default";
   const appFlag = clean2(stringOpt(parsed.options.app));
-  const appEnvironment = clean2(import_node_process9.default.env.ODLA_APP_ID);
+  const appEnvironment = clean2(import_node_process10.default.env.ODLA_APP_ID);
   const appValue = appFlag ?? appEnvironment ?? profile.value?.app ?? loaded?.app.id ?? null;
   const appSource = appFlag ? "flag" : appEnvironment ? "environment" : profile.value?.app ? "profile" : loaded ? "config" : "unresolved";
   if (appValue) assertOperatorName(appValue, "app");
@@ -1736,16 +1803,16 @@ async function resolveOperatorContext(parsed, options = {}) {
     );
   }
   const envFlag = clean2(stringOpt(parsed.options.env));
-  const envEnvironment = clean2(import_node_process9.default.env.ODLA_ENV);
+  const envEnvironment = clean2(import_node_process10.default.env.ODLA_ENV);
   const environmentValue = envFlag ?? envEnvironment ?? profile.value?.environment ?? options.defaultEnvironment ?? null;
   const environmentSource = envFlag ? "flag" : envEnvironment ? "environment" : profile.value?.environment ? "profile" : options.defaultEnvironment ? "default" : "unresolved";
   if (environmentValue) {
     assertOperatorName(environmentValue, "environment");
   }
-  const rootDir = loaded?.rootDir ?? import_node_process9.default.cwd();
+  const rootDir = loaded?.rootDir ?? import_node_process10.default.cwd();
   const profileCredentials = operatorCredentialFiles(profile);
-  const tokenFile = clean2(import_node_process9.default.env.ODLA_DEV_TOKEN_FILE) ? (0, import_node_path6.resolve)(import_node_process9.default.env.ODLA_DEV_TOKEN_FILE) : profile.name ? profileCredentials.developer : loaded?.local.tokenFile ?? profileCredentials.developer;
-  const scopedTokenFile = clean2(import_node_process9.default.env.ODLA_ADMIN_TOKEN_FILE) ? (0, import_node_path6.resolve)(import_node_process9.default.env.ODLA_ADMIN_TOKEN_FILE) : profile.name ? profileCredentials.scoped : loaded ? (0, import_node_path6.join)(loaded.rootDir, ".odla", "admin-token.local.json") : profileCredentials.scoped;
+  const tokenFile = clean2(import_node_process10.default.env.ODLA_DEV_TOKEN_FILE) ? (0, import_node_path7.resolve)(import_node_process10.default.env.ODLA_DEV_TOKEN_FILE) : profile.name ? profileCredentials.developer : loaded?.local.tokenFile ?? profileCredentials.developer;
+  const scopedTokenFile = clean2(import_node_process10.default.env.ODLA_ADMIN_TOKEN_FILE) ? (0, import_node_path7.resolve)(import_node_process10.default.env.ODLA_ADMIN_TOKEN_FILE) : profile.name ? profileCredentials.scoped : loaded ? (0, import_node_path7.join)(loaded.rootDir, ".odla", "admin-token.local.json") : profileCredentials.scoped;
   const cfg = loaded ? {
     ...loaded,
     platformUrl: platformValue,
@@ -1767,8 +1834,8 @@ async function resolveOperatorContext(parsed, options = {}) {
     services: [],
     local: {
       tokenFile,
-      credentialsFile: (0, import_node_path6.join)(rootDir, ".odla", "credentials.local.json"),
-      devVarsFile: (0, import_node_path6.join)(rootDir, ".dev.vars"),
+      credentialsFile: (0, import_node_path7.join)(rootDir, ".odla", "credentials.local.json"),
+      devVarsFile: (0, import_node_path7.join)(rootDir, ".dev.vars"),
       gitignore: true
     }
   };
@@ -1865,7 +1932,7 @@ async function adminCommand(parsed, deps = {}) {
 }
 
 // src/auth-command.ts
-var import_node_process10 = __toESM(require("process"), 1);
+var import_node_process11 = __toESM(require("process"), 1);
 
 // src/whoami-command.ts
 var text2 = (value2) => typeof value2 === "string" && value2.trim() ? value2.trim() : null;
@@ -2027,7 +2094,7 @@ async function authCommand(parsed, deps = {}) {
   const { cfg } = context;
   const out = deps.stdout ?? console;
   const doFetch = deps.fetch ?? fetch;
-  const email = stringOpt(parsed.options.email) ?? import_node_process10.default.env.ODLA_USER_EMAIL?.trim();
+  const email = stringOpt(parsed.options.email) ?? import_node_process11.default.env.ODLA_USER_EMAIL?.trim();
   if (!email) {
     throw new Error(
       "auth login requires --email <odla-account> or ODLA_USER_EMAIL; confirm the signed-in odla email instead of using git or GitHub identity"
@@ -2180,7 +2247,7 @@ async function appExport(options) {
 }
 
 // src/app-import.ts
-var import_node_fs7 = require("fs");
+var import_node_fs9 = require("fs");
 var import_import = require("@odla-ai/db/import");
 function chooseIdMode(options, rows) {
   const chosen = [options.idField && "field", options.key && "key", options.generateIds && "generate"].filter(Boolean);
@@ -2198,7 +2265,7 @@ async function appImport(options) {
   const out = options.stdout ?? console;
   const say = options.json ? (line2) => out.error(line2) : (line2) => out.log(line2);
   const { tenant } = resolveTenant(cfg, options.env);
-  const text3 = options.file === "-" ? (options.readStdin ?? (() => (0, import_node_fs7.readFileSync)(0, "utf8")))() : (0, import_node_fs7.readFileSync)(options.file, "utf8");
+  const text3 = options.file === "-" ? (options.readStdin ?? (() => (0, import_node_fs9.readFileSync)(0, "utf8")))() : (0, import_node_fs9.readFileSync)(options.file, "utf8");
   const { format, sources } = (0, import_import.parseImport)(text3, options.ns);
   if (format === "namespace-map" && options.ns) {
     throw new Error("--ns cannot be combined with a {namespace: rows} file \u2014 the file already names each namespace");
@@ -2388,7 +2455,7 @@ async function appCommand(parsed, dependencies = {}) {
 
 // src/brand-command.ts
 var import_promises = require("fs/promises");
-var import_node_path7 = require("path");
+var import_node_path8 = require("path");
 
 // src/brand-design-unpack.ts
 var import_node_zlib = require("zlib");
@@ -2490,15 +2557,15 @@ function describeUnpack(result, outDir) {
 // src/brand-command.ts
 var USAGE = "usage: odla-ai brand design unpack <bundle.html|-> [--out <dir>] [--json]";
 async function readBundle(source, deps) {
-  if (source !== "-") return (0, import_promises.readFile)((0, import_node_path7.resolve)(source), "utf8");
+  if (source !== "-") return (0, import_promises.readFile)((0, import_node_path8.resolve)(source), "utf8");
   const readStdin = deps.readStdin;
   if (!readStdin) throw new Error("reading a bundle from stdin is not supported here");
   return readStdin();
 }
 async function writeAll(result, outDir) {
   for (const file of result.files) {
-    const target = (0, import_node_path7.resolve)(outDir, file.path);
-    await (0, import_promises.mkdir)((0, import_node_path7.dirname)(target), { recursive: true });
+    const target = (0, import_node_path8.resolve)(outDir, file.path);
+    await (0, import_promises.mkdir)((0, import_node_path8.dirname)(target), { recursive: true });
     await (0, import_promises.writeFile)(target, file.bytes);
   }
 }
@@ -2506,7 +2573,7 @@ async function designUnpack(parsed, deps) {
   assertArgs(parsed, ["out", "json"], 4);
   const source = parsed.positionals[3];
   if (!source) throw new Error(USAGE);
-  const outDir = (0, import_node_path7.resolve)(stringOpt(parsed.options.out) ?? "design");
+  const outDir = (0, import_node_path8.resolve)(stringOpt(parsed.options.out) ?? "design");
   const result = unpackDesign(await readBundle(source, deps));
   await writeAll(result, outDir);
   const out = deps.stdout ?? console;
@@ -3111,12 +3178,12 @@ async function safeText4(response2) {
 
 // src/config-operation-command.ts
 var import_apps6 = require("@odla-ai/apps");
-var import_node_path8 = require("path");
+var import_node_path9 = require("path");
 
 // src/version.ts
-var import_node_fs8 = require("fs");
+var import_node_fs10 = require("fs");
 function cliVersion() {
-  const pkg = JSON.parse((0, import_node_fs8.readFileSync)(new URL("../package.json", importMetaUrl), "utf8"));
+  const pkg = JSON.parse((0, import_node_fs10.readFileSync)(new URL("../package.json", importMetaUrl), "utf8"));
   return pkg.version ?? "unknown";
 }
 
@@ -3132,7 +3199,7 @@ var ConfigOperationCommandError = class extends Error {
 
 // src/config-operation-validate.ts
 var import_apps3 = require("@odla-ai/apps");
-var import_node_fs9 = require("fs");
+var import_node_fs11 = require("fs");
 
 // src/config-reconcile-digest.ts
 var import_node_crypto2 = require("crypto");
@@ -3168,7 +3235,7 @@ var SERVICE = /^[a-z][a-z0-9-]{0,39}$/;
 function readPlan(path) {
   let value2;
   try {
-    const raw = (0, import_node_fs9.readFileSync)(path, "utf8");
+    const raw = (0, import_node_fs11.readFileSync)(path, "utf8");
     if (Buffer.byteLength(raw) > 128 * 1024) throw new Error("plan exceeds 128 KiB");
     value2 = JSON.parse(raw);
   } catch (error) {
@@ -3541,7 +3608,7 @@ async function operationClient(cfg, options, purpose) {
     platform: cfg.platformUrl,
     scope: "app:config:write",
     token: options.token,
-    tokenFile: (0, import_node_path8.join)(cfg.rootDir, ".odla", "admin-token.local.json"),
+    tokenFile: (0, import_node_path9.join)(cfg.rootDir, ".odla", "admin-token.local.json"),
     rootDir: cfg.rootDir,
     email: options.email,
     open: options.open,
@@ -3596,7 +3663,7 @@ function record4(value2) {
 
 // src/config-reconcile-command.ts
 var import_apps8 = require("@odla-ai/apps");
-var import_node_path9 = require("path");
+var import_node_path10 = require("path");
 
 // src/config-reconcile.ts
 var import_apps7 = require("@odla-ai/apps");
@@ -3892,7 +3959,7 @@ async function inspectConfig(options) {
     platform: cfg.platformUrl,
     scope: "app:config:read",
     token: options.token,
-    tokenFile: (0, import_node_path9.join)(cfg.rootDir, ".odla", "admin-token.local.json"),
+    tokenFile: (0, import_node_path10.join)(cfg.rootDir, ".odla", "admin-token.local.json"),
     rootDir: cfg.rootDir,
     email: options.email,
     open: options.open,
@@ -4024,13 +4091,13 @@ function quoteArg2(value2) {
 
 // src/doctor-checks.ts
 var import_node_child_process3 = require("child_process");
-var import_node_fs11 = require("fs");
-var import_node_path11 = require("path");
+var import_node_fs13 = require("fs");
+var import_node_path12 = require("path");
 
 // src/wrangler.ts
 var import_node_child_process2 = require("child_process");
-var import_node_fs10 = require("fs");
-var import_node_path10 = require("path");
+var import_node_fs12 = require("fs");
+var import_node_path11 = require("path");
 var defaultRunner = (cmd, args, opts) => new Promise((resolvePromise, reject) => {
   const child = (0, import_node_child_process2.spawn)(cmd, args, { cwd: opts?.cwd, stdio: ["pipe", "pipe", "pipe"] });
   let stdout = "";
@@ -4044,15 +4111,15 @@ var defaultRunner = (cmd, args, opts) => new Promise((resolvePromise, reject) =>
 var WRANGLER_CONFIG_FILES = ["wrangler.jsonc", "wrangler.json", "wrangler.toml"];
 function findWranglerConfig(rootDir) {
   for (const name of WRANGLER_CONFIG_FILES) {
-    const path = (0, import_node_path10.join)(rootDir, name);
-    if ((0, import_node_fs10.existsSync)(path)) return path;
+    const path = (0, import_node_path11.join)(rootDir, name);
+    if ((0, import_node_fs12.existsSync)(path)) return path;
   }
   return null;
 }
 function readWranglerConfig(path) {
   if (path.endsWith(".toml")) return null;
   try {
-    return JSON.parse(stripJsonComments((0, import_node_fs10.readFileSync)(path, "utf8")));
+    return JSON.parse(stripJsonComments((0, import_node_fs12.readFileSync)(path, "utf8")));
   } catch {
     return null;
   }
@@ -4202,10 +4269,10 @@ function wranglerWarnings(rootDir) {
   for (const { label, block } of blocks) {
     const assets = block.assets;
     if (assets?.directory) {
-      const dir = (0, import_node_path11.resolve)(rootDir, assets.directory);
-      if (dir === (0, import_node_path11.resolve)(rootDir)) {
+      const dir = (0, import_node_path12.resolve)(rootDir, assets.directory);
+      if (dir === (0, import_node_path12.resolve)(rootDir)) {
         warnings.push(`${label}assets.directory is the project root \u2014 point it at a dedicated build dir (wrangler dev fails with "spawn EBADF")`);
-      } else if ((0, import_node_fs11.existsSync)((0, import_node_path11.join)(dir, "node_modules"))) {
+      } else if ((0, import_node_fs13.existsSync)((0, import_node_path12.join)(dir, "node_modules"))) {
         warnings.push(`${label}assets.directory contains node_modules \u2014 wrangler dev's watcher will exhaust file descriptors`);
       }
     }
@@ -4240,13 +4307,13 @@ function o11yProjectWarnings(rootDir) {
     warnings.push("cannot verify o11y Worker instrumentation \u2014 add a parseable wrangler.jsonc/json config");
     return warnings;
   }
-  const main = typeof config.main === "string" ? (0, import_node_path11.resolve)(rootDir, config.main) : null;
-  if (!main || !(0, import_node_fs11.existsSync)(main)) {
+  const main = typeof config.main === "string" ? (0, import_node_path12.resolve)(rootDir, config.main) : null;
+  if (!main || !(0, import_node_fs13.existsSync)(main)) {
     warnings.push("cannot verify o11y Worker instrumentation \u2014 wrangler main is missing or unreadable");
   } else {
     let source = "";
     try {
-      source = (0, import_node_fs11.readFileSync)(main, "utf8");
+      source = (0, import_node_fs13.readFileSync)(main, "utf8");
     } catch {
     }
     if (!/\bwithObservability\b/.test(source)) {
@@ -4270,7 +4337,7 @@ function calendarProjectWarnings(rootDir) {
 }
 function readPackageJson(rootDir) {
   try {
-    return JSON.parse((0, import_node_fs11.readFileSync)((0, import_node_path11.join)(rootDir, "package.json"), "utf8"));
+    return JSON.parse((0, import_node_fs13.readFileSync)((0, import_node_path12.join)(rootDir, "package.json"), "utf8"));
   } catch {
     return null;
   }
@@ -4564,14 +4631,14 @@ function harnessOption(value2, flag) {
 }
 
 // src/init.ts
-var import_node_fs12 = require("fs");
-var import_node_path12 = require("path");
+var import_node_fs14 = require("fs");
+var import_node_path13 = require("path");
 var import_apps9 = require("@odla-ai/apps");
 function initProject(options) {
   const out = options.stdout ?? console;
-  const rootDir = (0, import_node_path12.resolve)(options.rootDir ?? process.cwd());
-  const configPath = (0, import_node_path12.resolve)(rootDir, options.configPath ?? "odla.config.mjs");
-  if ((0, import_node_fs12.existsSync)(configPath) && !options.force) {
+  const rootDir = (0, import_node_path13.resolve)(options.rootDir ?? process.cwd());
+  const configPath = (0, import_node_path13.resolve)(rootDir, options.configPath ?? "odla.config.mjs");
+  if ((0, import_node_fs14.existsSync)(configPath) && !options.force) {
     throw new Error(`${configPath} already exists. Pass --force to overwrite.`);
   }
   if (!/^[a-z0-9][a-z0-9-]*$/.test(options.appId)) {
@@ -4587,20 +4654,20 @@ function initProject(options) {
     }
   }
   const aiProvider = options.aiProvider;
-  (0, import_node_fs12.mkdirSync)((0, import_node_path12.dirname)(configPath), { recursive: true });
-  (0, import_node_fs12.mkdirSync)((0, import_node_path12.resolve)(rootDir, "src/odla"), { recursive: true });
-  (0, import_node_fs12.mkdirSync)((0, import_node_path12.resolve)(rootDir, ".odla"), { recursive: true });
-  (0, import_node_fs12.writeFileSync)(configPath, configTemplate({ appId: options.appId, name: options.name, envs, services, aiProvider }));
-  writeIfMissing((0, import_node_path12.resolve)(rootDir, "src/odla/schema.mjs"), schemaTemplate());
-  writeIfMissing((0, import_node_path12.resolve)(rootDir, "src/odla/rules.mjs"), rulesTemplate());
+  (0, import_node_fs14.mkdirSync)((0, import_node_path13.dirname)(configPath), { recursive: true });
+  (0, import_node_fs14.mkdirSync)((0, import_node_path13.resolve)(rootDir, "src/odla"), { recursive: true });
+  (0, import_node_fs14.mkdirSync)((0, import_node_path13.resolve)(rootDir, ".odla"), { recursive: true });
+  (0, import_node_fs14.writeFileSync)(configPath, configTemplate({ appId: options.appId, name: options.name, envs, services, aiProvider }));
+  writeIfMissing((0, import_node_path13.resolve)(rootDir, "src/odla/schema.mjs"), schemaTemplate());
+  writeIfMissing((0, import_node_path13.resolve)(rootDir, "src/odla/rules.mjs"), rulesTemplate());
   ensureGitignore(rootDir);
   out.log(`created ${relativeDisplay(configPath, rootDir)}`);
   out.log("created src/odla/schema.mjs and src/odla/rules.mjs");
   out.log("updated .gitignore for local odla credentials");
 }
 function writeIfMissing(path, text3) {
-  if ((0, import_node_fs12.existsSync)(path)) return;
-  (0, import_node_fs12.writeFileSync)(path, text3);
+  if ((0, import_node_fs14.existsSync)(path)) return;
+  (0, import_node_fs14.writeFileSync)(path, text3);
 }
 function configTemplate(input) {
   const calendar = input.services.includes("calendar") ? `  calendar: {
@@ -4896,9 +4963,9 @@ function printReport(report5, out) {
 }
 
 // src/skill.ts
-var import_node_fs13 = require("fs");
-var import_node_os2 = require("os");
-var import_node_path13 = require("path");
+var import_node_fs15 = require("fs");
+var import_node_os3 = require("os");
+var import_node_path14 = require("path");
 var import_node_url2 = require("url");
 
 // src/skill-adapters.ts
@@ -4997,8 +5064,8 @@ function installSkill(options = {}) {
   const files = listFiles(sourceDir);
   if (files.length === 0) throw new Error(`no bundled skills found at ${sourceDir}`);
   const harnesses = normalizeHarnesses(options.harnesses, options.global === true);
-  const root = (0, import_node_path13.resolve)(options.dir ?? process.cwd());
-  const home = (0, import_node_path13.resolve)(options.homeDir ?? (0, import_node_os2.homedir)());
+  const root = (0, import_node_path14.resolve)(options.dir ?? process.cwd());
+  const home = (0, import_node_path14.resolve)(options.homeDir ?? (0, import_node_os3.homedir)());
   const plans = /* @__PURE__ */ new Map();
   const targets = /* @__PURE__ */ new Map();
   const rememberTarget = (harness, target) => {
@@ -5012,48 +5079,48 @@ function installSkill(options = {}) {
     plans.set(target, { target, content: content2, boundary, managedMerge });
   };
   const planSkillTree = (targetDir2, boundary = root) => {
-    for (const rel of files) plan((0, import_node_path13.join)(targetDir2, rel), (0, import_node_fs13.readFileSync)((0, import_node_path13.join)(sourceDir, rel), "utf8"), false, boundary);
+    for (const rel of files) plan((0, import_node_path14.join)(targetDir2, rel), (0, import_node_fs15.readFileSync)((0, import_node_path14.join)(sourceDir, rel), "utf8"), false, boundary);
   };
   let targetDir;
   if (options.global) {
-    const claudeRoot = (0, import_node_path13.join)(home, ".claude", "skills");
-    const codexRoot = (0, import_node_path13.resolve)(options.codexHomeDir ?? process.env.CODEX_HOME ?? (0, import_node_path13.join)(home, ".codex"), "skills");
+    const claudeRoot = (0, import_node_path14.join)(home, ".claude", "skills");
+    const codexRoot = (0, import_node_path14.resolve)(options.codexHomeDir ?? process.env.CODEX_HOME ?? (0, import_node_path14.join)(home, ".codex"), "skills");
     targetDir = harnesses[0] === "codex" ? codexRoot : claudeRoot;
     for (const harness of harnesses) {
       const skillRoot = harness === "claude" ? claudeRoot : codexRoot;
-      planSkillTree(skillRoot, harness === "claude" ? home : (0, import_node_path13.dirname)((0, import_node_path13.dirname)(codexRoot)));
+      planSkillTree(skillRoot, harness === "claude" ? home : (0, import_node_path14.dirname)((0, import_node_path14.dirname)(codexRoot)));
       rememberTarget(harness, skillRoot);
     }
   } else {
-    const sharedRoot = (0, import_node_path13.join)(root, ".agents", "skills");
+    const sharedRoot = (0, import_node_path14.join)(root, ".agents", "skills");
     planSkillTree(sharedRoot);
-    const claudeRoot = (0, import_node_path13.join)(root, ".claude", "skills");
+    const claudeRoot = (0, import_node_path14.join)(root, ".claude", "skills");
     targetDir = harnesses.includes("claude") ? claudeRoot : sharedRoot;
     for (const harness of harnesses) rememberTarget(harness, sharedRoot);
     if (harnesses.includes("claude")) {
       for (const skill of skillNames(files)) {
-        const canonical2 = (0, import_node_fs13.readFileSync)((0, import_node_path13.join)(sourceDir, skill, "SKILL.md"), "utf8");
-        plan((0, import_node_path13.join)(claudeRoot, skill, "SKILL.md"), claudeAdapter(skill, canonical2));
+        const canonical2 = (0, import_node_fs15.readFileSync)((0, import_node_path14.join)(sourceDir, skill, "SKILL.md"), "utf8");
+        plan((0, import_node_path14.join)(claudeRoot, skill, "SKILL.md"), claudeAdapter(skill, canonical2));
       }
       rememberTarget("claude", claudeRoot);
     }
     if (harnesses.includes("cursor")) {
-      const cursorRule = (0, import_node_path13.join)(root, ".cursor", "rules", "odla.mdc");
+      const cursorRule = (0, import_node_path14.join)(root, ".cursor", "rules", "odla.mdc");
       plan(cursorRule, CURSOR_RULE);
       rememberTarget("cursor", cursorRule);
     }
     if (harnesses.includes("agents")) {
-      const agentsFile = (0, import_node_path13.join)(root, "AGENTS.md");
+      const agentsFile = (0, import_node_path14.join)(root, "AGENTS.md");
       plan(agentsFile, managedFileContent(agentsFile, PROJECT_INSTRUCTIONS, options.force === true, root), true);
       rememberTarget("agents", agentsFile);
     }
     if (harnesses.includes("copilot")) {
-      const copilotFile = (0, import_node_path13.join)(root, ".github", "copilot-instructions.md");
+      const copilotFile = (0, import_node_path14.join)(root, ".github", "copilot-instructions.md");
       plan(copilotFile, managedFileContent(copilotFile, PROJECT_INSTRUCTIONS, options.force === true, root), true);
       rememberTarget("copilot", copilotFile);
     }
     if (harnesses.includes("gemini")) {
-      const geminiFile = (0, import_node_path13.join)(root, "GEMINI.md");
+      const geminiFile = (0, import_node_path14.join)(root, "GEMINI.md");
       plan(geminiFile, managedFileContent(geminiFile, PROJECT_INSTRUCTIONS, options.force === true, root), true);
       rememberTarget("gemini", geminiFile);
     }
@@ -5067,11 +5134,11 @@ function installSkill(options = {}) {
       conflicts.push(`${file.target} (redirected by symbolic link ${symlink})`);
       continue;
     }
-    if (!(0, import_node_fs13.existsSync)(file.target)) {
+    if (!(0, import_node_fs15.existsSync)(file.target)) {
       writtenPaths.add(file.target);
       continue;
     }
-    const current = (0, import_node_fs13.readFileSync)(file.target, "utf8");
+    const current = (0, import_node_fs15.readFileSync)(file.target, "utf8");
     if (current === file.content) {
       unchangedPaths.add(file.target);
     } else if (file.managedMerge || options.force) {
@@ -5088,9 +5155,9 @@ ${conflicts.map((f) => `  - ${f}`).join("\n")}`
     );
   }
   for (const file of plans.values()) {
-    if (!(0, import_node_fs13.existsSync)(file.target) || (0, import_node_fs13.readFileSync)(file.target, "utf8") !== file.content) {
-      (0, import_node_fs13.mkdirSync)((0, import_node_path13.dirname)(file.target), { recursive: true });
-      (0, import_node_fs13.writeFileSync)(file.target, file.content);
+    if (!(0, import_node_fs15.existsSync)(file.target) || (0, import_node_fs15.readFileSync)(file.target, "utf8") !== file.content) {
+      (0, import_node_fs15.mkdirSync)((0, import_node_path14.dirname)(file.target), { recursive: true });
+      (0, import_node_fs15.writeFileSync)(file.target, file.content);
     }
   }
   const skills = skillNames(files);
@@ -5109,7 +5176,7 @@ ${conflicts.map((f) => `  - ${f}`).join("\n")}`
   };
 }
 function pathsUnder(root, paths) {
-  return [...paths].map((path) => (0, import_node_path13.relative)(root, path)).filter((path) => path !== ".." && !path.startsWith(`..${import_node_path13.sep}`) && !(0, import_node_path13.isAbsolute)(path)).sort();
+  return [...paths].map((path) => (0, import_node_path14.relative)(root, path)).filter((path) => path !== ".." && !path.startsWith(`..${import_node_path14.sep}`) && !(0, import_node_path14.isAbsolute)(path)).sort();
 }
 function normalizeHarnesses(values, global) {
   const requested = values?.length ? values : ["claude"];
@@ -5131,9 +5198,9 @@ function normalizeHarnesses(values, global) {
 function managedFileContent(path, block, force, boundary) {
   const symlink = symlinkedComponent(boundary, path);
   if (symlink) throw new Error(`refusing to manage ${path}: symbolic link component ${symlink}`);
-  if (!(0, import_node_fs13.existsSync)(path)) return `${block}
+  if (!(0, import_node_fs15.existsSync)(path)) return `${block}
 `;
-  const current = (0, import_node_fs13.readFileSync)(path, "utf8");
+  const current = (0, import_node_fs15.readFileSync)(path, "utf8");
   const start = "<!-- odla-ai agent setup:start -->";
   const end = "<!-- odla-ai agent setup:end -->";
   const startAt = current.indexOf(start);
@@ -5154,15 +5221,15 @@ function managedFileContent(path, block, force, boundary) {
   return `${current.slice(0, startAt)}${block}${current.slice(afterEnd)}`;
 }
 function symlinkedComponent(boundary, target) {
-  const rel = (0, import_node_path13.relative)(boundary, target);
-  if (rel === ".." || rel.startsWith(`..${import_node_path13.sep}`) || (0, import_node_path13.isAbsolute)(rel)) {
+  const rel = (0, import_node_path14.relative)(boundary, target);
+  if (rel === ".." || rel.startsWith(`..${import_node_path14.sep}`) || (0, import_node_path14.isAbsolute)(rel)) {
     throw new Error(`agent setup target escapes its install root: ${target}`);
   }
   let current = boundary;
-  for (const part of rel.split(import_node_path13.sep).filter(Boolean)) {
-    current = (0, import_node_path13.join)(current, part);
+  for (const part of rel.split(import_node_path14.sep).filter(Boolean)) {
+    current = (0, import_node_path14.join)(current, part);
     try {
-      if ((0, import_node_fs13.lstatSync)(current).isSymbolicLink()) return current;
+      if ((0, import_node_fs15.lstatSync)(current).isSymbolicLink()) return current;
     } catch (error) {
       if (error.code !== "ENOENT") throw error;
     }
@@ -5173,13 +5240,13 @@ function skillNames(files) {
   return [...new Set(files.filter((file) => /(^|[\\/])SKILL\.md$/.test(file)).map((file) => file.split(/[\\/]/)[0]))].sort();
 }
 function listFiles(dir) {
-  if (!(0, import_node_fs13.existsSync)(dir)) return [];
+  if (!(0, import_node_fs15.existsSync)(dir)) return [];
   const results = [];
   const walk = (current) => {
-    for (const entry of (0, import_node_fs13.readdirSync)(current, { withFileTypes: true })) {
-      const path = (0, import_node_path13.join)(current, entry.name);
+    for (const entry of (0, import_node_fs15.readdirSync)(current, { withFileTypes: true })) {
+      const path = (0, import_node_path14.join)(current, entry.name);
       if (entry.isDirectory()) walk(path);
-      else results.push((0, import_node_path13.relative)(dir, path));
+      else results.push((0, import_node_path14.relative)(dir, path));
     }
   };
   walk(dir);
@@ -5534,9 +5601,9 @@ async function projectCommand(command, parsed, deps) {
 }
 
 // src/code-connect.ts
-var import_node_fs14 = require("fs");
-var import_node_os3 = require("os");
-var import_node_path14 = require("path");
+var import_node_fs16 = require("fs");
+var import_node_os4 = require("os");
+var import_node_path15 = require("path");
 
 // ../harness/dist/chunk-3QP4VDQS.js
 var HARNESS_PROTOCOL_VERSION = 1;
@@ -6645,8 +6712,8 @@ function rollup(graph, kind, options = {}) {
   for (const node of nodesOfKind(graph, kind)) {
     if (options.prefix && !node.name.startsWith(options.prefix)) continue;
     const key = node.name.split(separator).slice(0, depth).join(separator);
-    const list2 = groups.get(key);
-    if (list2) list2.push(node);
+    const list3 = groups.get(key);
+    if (list3) list3.push(node);
     else groups.set(key, [node]);
   }
   return [...groups].map(([prefix, nodes]) => ({
@@ -6661,7 +6728,7 @@ function dirname8(path) {
   const at = path.lastIndexOf("/");
   return at <= 0 ? "." : path.slice(0, at);
 }
-function join11(base, specifier) {
+function join12(base, specifier) {
   const parts = [];
   const segments = `${base === "." ? "" : `${base}/`}${specifier}`.split("/");
   for (const segment of segments) {
@@ -6685,7 +6752,7 @@ var BARE_IMPORT = /^\s*import\s*["']([^"']+)["']/gm;
 var isSourcePath = (path) => SOURCE.test(path);
 function resolveImport(fromPath, specifier, known) {
   if (!specifier.startsWith(".")) return null;
-  const base = join11(dirname8(fromPath), specifier);
+  const base = join12(dirname8(fromPath), specifier);
   const candidates = [
     base,
     base.replace(/\.js$/, ".ts"),
@@ -9583,8 +9650,8 @@ var CODE_BUILD_RECIPES = Object.freeze([{
 // src/code-connect.ts
 async function codeConnect(options) {
   const cwd = options.cwd ?? process.cwd();
-  const configPath = (0, import_node_path14.resolve)(cwd, options.configPath);
-  const cfg = (0, import_node_fs14.existsSync)(configPath) ? await loadProjectConfig(configPath) : null;
+  const configPath = (0, import_node_path15.resolve)(cwd, options.configPath);
+  const cfg = (0, import_node_fs16.existsSync)(configPath) ? await loadProjectConfig(configPath) : null;
   const requestedAppId = options.appId?.trim();
   if (requestedAppId && !/^[a-z0-9][a-z0-9-]{1,62}$/.test(requestedAppId)) {
     throw new Error("--app-id must be a valid odla app id");
@@ -9613,7 +9680,7 @@ async function codeConnect(options) {
   const doFetch = options.fetch ?? fetch;
   const engine = await (options.selectEngine ?? selectContainerEngine)(options.engine ?? "auto");
   const hostPlatform = process.platform === "darwin" ? "macos" : "linux";
-  const hostName = (options.name ?? (0, import_node_os3.hostname)()).trim();
+  const hostName = (options.name ?? (0, import_node_os4.hostname)()).trim();
   if (!hostName || hostName.length > 120) throw new Error("--name must contain 1 to 120 characters");
   const repository = await inferGitHubRepository(cwd, options.readGitOrigin);
   const localSource = await (options.prepareLocalSource ?? prepareCodeLocalSource)(
@@ -9650,8 +9717,8 @@ async function codeConnect(options) {
       platform: hostPlatform,
       arch: process.arch,
       engines: [engine],
-      cpuCount: (0, import_node_os3.cpus)().length,
-      memoryBytes: (0, import_node_os3.totalmem)(),
+      cpuCount: (0, import_node_os4.cpus)().length,
+      memoryBytes: (0, import_node_os4.totalmem)(),
       source: descriptor2,
       images: {
         ready: true,
@@ -10018,13 +10085,13 @@ async function codeCommand(parsed, dependencies) {
 }
 
 // src/operator-credentials.ts
-var import_node_process11 = __toESM(require("process"), 1);
+var import_node_process12 = __toESM(require("process"), 1);
 function developerTokenStatus(context, parsed, now = Date.now()) {
   const cached = readJsonFile(context.cfg.local.tokenFile);
   const cacheStatus = !cached?.token ? "missing" : cached.platform !== context.platform.value ? "other-platform" : (cached.expiresAt ?? 0) <= now + 6e4 ? "expired" : "valid";
   const source = clean3(
     stringOpt(parsed.options.token)
-  ) ? "flag" : clean3(import_node_process11.default.env.ODLA_DEV_TOKEN) ? "environment" : cacheStatus === "valid" ? "cache" : "missing";
+  ) ? "flag" : clean3(import_node_process12.default.env.ODLA_DEV_TOKEN) ? "environment" : cacheStatus === "valid" ? "cache" : "missing";
   return {
     source,
     cacheFile: context.cfg.local.tokenFile,
@@ -10346,6 +10413,9 @@ Usage:
   odla-ai security run [target] --ack-redacted-source [--env dev] [--profile odla] [--fail-on high]
   odla-ai security run [target] --self --ack-redacted-source
   odla-ai provision [--live] [--config odla.config.mjs] [--email <odla-account>] [--request-grant] [--no-open] [--wait <seconds>] [--dry-run] [--push-secrets] [--rotate-o11y-token] [--write-dev-vars[=path]] [--yes]
+  odla-ai device enroll [--app <id>[,<id>...]] [--name <label>] [--capability <c>[,<c>...]] [--email <odla-account>] [--no-open] [--json]
+  odla-ai device list [--email <odla-account>] [--json]
+  odla-ai device revoke <device-id> [--email <odla-account>] [--json]
   odla-ai credentials list [--config odla.config.mjs] [--env dev] [--all] [--json]
   odla-ai credentials revoke <receipt-id> [--config odla.config.mjs] [--json]
   odla-ai smoke [--config odla.config.mjs] [--env dev] [--runtime] [--email <odla-account>] [--no-open]
@@ -10451,6 +10521,10 @@ Commands:
                stable status, incident, and report JSON to agents and CI.
   platform     Read canonical fleet health, releases, provider load/freshness,
                explicit unknowns, and next actions through a read-only grant.
+  device       Enrol THIS machine once, then stop asking. A human approves the
+               enrollment in the browser; from then on this terminal mints its
+               own short-lived credentials for the named projects with nobody's
+               attention, until the device expires or is revoked.
   provision    Register services, compose integrations, persist credentials, optionally push secrets.
                "provision --live --yes" initializes only the live instance of
                an existing sandbox app and enables every configured service;
@@ -11701,8 +11775,8 @@ async function pmWatch(ctx, parsed) {
 }
 
 // src/pm-project-context.ts
-var import_node_path15 = require("path");
-var pmProjectContextFile = (rootDir) => (0, import_node_path15.resolve)(rootDir, ".odla", "pm-project.local.json");
+var import_node_path16 = require("path");
+var pmProjectContextFile = (rootDir) => (0, import_node_path16.resolve)(rootDir, ".odla", "pm-project.local.json");
 function readPmProjectContext(rootDir) {
   const value2 = readJsonFile(pmProjectContextFile(rootDir));
   return value2 && typeof value2.appId === "string" && typeof value2.projectId === "string" ? value2 : null;
@@ -12733,7 +12807,7 @@ function percent(value2) {
 // src/provision.ts
 var import_apps13 = require("@odla-ai/apps");
 var import_ai5 = require("@odla-ai/ai");
-var import_node_process12 = __toESM(require("process"), 1);
+var import_node_process13 = __toESM(require("process"), 1);
 
 // src/integration-provision.ts
 var import_db3 = require("@odla-ai/db");
@@ -13169,7 +13243,7 @@ async function provision(options) {
       await provisionIntegrationSeeds(doFetch, cfg.dbEndpoint, tenantId, dbKey, database.integrations, env, out);
     }
     if (cfg.services.includes("ai") && cfg.ai?.provider && cfg.ai.keyEnv) {
-      const key = import_node_process12.default.env[cfg.ai.keyEnv];
+      const key = import_node_process13.default.env[cfg.ai.keyEnv];
       if (key) {
         const secretName = cfg.ai.secretName ?? defaultSecretName(cfg.ai.provider);
         await (0, import_ai5.putSecret)({ endpoint: cfg.dbEndpoint, token, fetch: doFetch }, tenantId, secretName, key);
@@ -13210,8 +13284,8 @@ async function provision(options) {
 }
 
 // src/record.ts
-var import_node_fs15 = require("fs");
-var import_node_process13 = __toESM(require("process"), 1);
+var import_node_fs17 = require("fs");
+var import_node_process14 = __toESM(require("process"), 1);
 
 // src/surface.ts
 var PM_ACTIONS = {
@@ -13281,6 +13355,7 @@ var COMMAND_SURFACE = {
   config: { diff: {}, plan: {}, apply: {} },
   context: { show: {}, list: {}, save: {}, remove: {} },
   credentials: { list: {}, revoke: {} },
+  device: { enroll: {}, list: {}, revoke: {} },
   // `watch`, `read`, `reply`, and `resolve` take a topic id from there on.
   discuss: {
     groups: {},
@@ -13392,7 +13467,7 @@ function surfacePaths(node = COMMAND_SURFACE, prefix = []) {
 
 // src/record.ts
 function recordInvocation(parsed) {
-  const file = import_node_process13.default.env.ODLA_CLI_RECORD;
+  const file = import_node_process14.default.env.ODLA_CLI_RECORD;
   if (!file) return;
   try {
     const entry = {
@@ -13400,14 +13475,138 @@ function recordInvocation(parsed) {
       options: Object.entries(parsed.options).map(([name, value2]) => value2 === false ? `no-${name}` : name).sort()
     };
     if (!entry.path.length) return;
-    (0, import_node_fs15.appendFileSync)(file, `${JSON.stringify(entry)}
+    (0, import_node_fs17.appendFileSync)(file, `${JSON.stringify(entry)}
 `);
   } catch {
   }
 }
 
+// src/advisory-output.ts
+var import_apps14 = require("@odla-ai/apps");
+function advisoryCollectingFetch(inner, sink) {
+  return (async (input, init) => {
+    const response2 = await inner(input, init);
+    try {
+      sink.push(...(0, import_apps14.parseAdvisories)(response2));
+    } catch {
+    }
+    return response2;
+  });
+}
+function renderAdvisories(out, advisories, env = process.env) {
+  if (env.ODLA_NO_ADVISORIES) return;
+  const seen = /* @__PURE__ */ new Set();
+  for (const advisory of advisories) {
+    const key = `${advisory.code}:${advisory.message}`;
+    if (seen.has(key)) continue;
+    seen.add(key);
+    out.error((0, import_apps14.formatAdvisory)(advisory));
+  }
+}
+
+// src/device-command.ts
+var import_node_fs18 = require("fs");
+var import_node_path17 = require("path");
+var import_node_process15 = __toESM(require("process"), 1);
+async function deviceCommand(parsed, deps) {
+  const action2 = parsed.positionals[1] ?? "";
+  const out = deps.stdout ?? console;
+  const doFetch = deps.fetch ?? fetch;
+  const cfg = await loadProjectConfig(stringOpt(parsed.options.config));
+  const json = parsed.options.json === true;
+  if (action2 === "enroll") return enroll(parsed, deps, cfg, doFetch, out, json);
+  if (action2 === "list") return list2(parsed, deps, cfg, doFetch, out, json);
+  if (action2 === "revoke") return revoke(parsed, deps, cfg, doFetch, out, json);
+  throw new Error('odla-ai device expects "enroll", "list", or "revoke"');
+}
+async function enroll(parsed, deps, cfg, doFetch, out, json) {
+  const name = stringOpt(parsed.options.name) ?? defaultDeviceName();
+  const apps = (stringOpt(parsed.options.app) ?? cfg.app.id).split(",").map((id2) => id2.trim()).filter(Boolean);
+  if (apps.length === 0) throw new Error("device enroll needs --app <id>[,<id>\u2026]");
+  const token = await scopedToken2(parsed, deps, cfg, doFetch, out, `odla CLI (enroll ${name})`);
+  const response2 = await doFetch(`${cfg.platformUrl}/registry/devices`, {
+    method: "POST",
+    headers: { authorization: `Bearer ${token}`, "content-type": "application/json" },
+    body: JSON.stringify({
+      name,
+      platform: import_node_process15.default.platform,
+      appIds: apps,
+      ...parsed.options.capability ? { capabilities: String(parsed.options.capability).split(",").map((c) => c.trim()).filter(Boolean) } : {}
+    })
+  });
+  const body = await response2.json().catch(() => ({}));
+  if (!response2.ok || !body.token || !body.device) {
+    throw new Error(`device enroll failed: ${body.error?.message ?? `registry returned ${response2.status}`} (${response2.status})`);
+  }
+  const path = deviceCredentialPath();
+  (0, import_node_fs18.mkdirSync)((0, import_node_path17.dirname)(path), { recursive: true });
+  (0, import_node_fs18.writeFileSync)(path, JSON.stringify({
+    token: body.token,
+    platform: cfg.platformUrl.replace(/\/$/, ""),
+    deviceId: body.device.deviceId,
+    name
+  }, null, 2));
+  (0, import_node_fs18.chmodSync)(path, 384);
+  out.error(`device: enrolled "${name}" for ${body.device.appIds.join(", ")}; credential written to ${path}`);
+  out.error("device: this terminal will mint its own credentials from now on \u2014 no further approvals.");
+  if (json) {
+    out.log(JSON.stringify({ deviceId: body.device.deviceId, name, appIds: body.device.appIds, expiresAt: body.device.expiresAt }, null, 2));
+  }
+}
+async function list2(parsed, deps, cfg, doFetch, out, json) {
+  const token = await scopedToken2(parsed, deps, cfg, doFetch, out, "odla CLI (device list)");
+  const response2 = await doFetch(`${cfg.platformUrl}/registry/devices`, {
+    headers: { authorization: `Bearer ${token}` }
+  });
+  const body = await response2.json().catch(() => ({}));
+  if (!response2.ok || !body.devices) {
+    throw new Error(`device list failed: ${body.error?.message ?? `registry returned ${response2.status}`} (${response2.status})`);
+  }
+  if (json) return out.log(JSON.stringify(body.devices, null, 2));
+  if (body.devices.length === 0) return out.log("no enrolled devices");
+  for (const device of body.devices) {
+    const state2 = device.revokedAt ? "revoked" : device.expiresAt <= Date.now() ? "expired" : "active";
+    out.log(`${device.deviceId}  ${state2.padEnd(7)}  ${device.name}  [${device.appIds.join(", ")}]`);
+  }
+}
+async function revoke(parsed, deps, cfg, doFetch, out, json) {
+  const deviceId = parsed.positionals[2];
+  if (!deviceId) throw new Error("device revoke needs the device id from `odla-ai device list`");
+  const token = await scopedToken2(parsed, deps, cfg, doFetch, out, "odla CLI (device revoke)");
+  const response2 = await doFetch(`${cfg.platformUrl}/registry/devices/${encodeURIComponent(deviceId)}/revoke`, {
+    method: "POST",
+    headers: { authorization: `Bearer ${token}` }
+  });
+  if (!response2.ok) {
+    const body = await response2.json().catch(() => ({}));
+    throw new Error(`device revoke failed: ${body.error?.message ?? `registry returned ${response2.status}`} (${response2.status})`);
+  }
+  out.error(`device: revoked ${deviceId}; every credential it minted is revoked with it`);
+  if (json) out.log(JSON.stringify({ deviceId, revoked: true }, null, 2));
+}
+async function scopedToken2(parsed, deps, cfg, doFetch, out, label) {
+  const { credentials } = await resolveOperatorContext(parsed, { allowMissingConfig: true });
+  const scopedTokenFile = credentials.scopedTokenFile;
+  return getScopedPlatformToken({
+    platform: cfg.platformUrl,
+    scope: "app:device:enroll",
+    email: stringOpt(parsed.options.email),
+    label,
+    fetch: doFetch,
+    stdout: out,
+    open: parsed.options.open === false ? false : parsed.options.open === true ? true : void 0,
+    openApprovalUrl: deps.openUrl,
+    rootDir: cfg.rootDir,
+    tokenFile: scopedTokenFile,
+    ...stringOpt(parsed.options.token) ? { token: stringOpt(parsed.options.token) } : {}
+  });
+}
+function defaultDeviceName() {
+  return `${import_node_process15.default.env.HOSTNAME ?? import_node_process15.default.env.HOST ?? "machine"}-${import_node_process15.default.platform}`;
+}
+
 // src/runbook-actions.ts
-var import_node_fs16 = require("fs");
+var import_node_fs19 = require("fs");
 
 // src/runbook-requires.ts
 var SPEC = /^(@?[\w./-]+?)@(\d+\.\d+\.\d+(?:[\w.-]*)?)$/;
@@ -13503,7 +13702,7 @@ async function bySlug(ctx, slug) {
 function readBody(file, inline) {
   if (inline !== void 0) return inline;
   if (file === void 0) throw new Error("supply the new text with --file <path>, --file - (stdin), or --body");
-  return (0, import_node_fs16.readFileSync)(file === "-" ? 0 : file, "utf8");
+  return (0, import_node_fs19.readFileSync)(file === "-" ? 0 : file, "utf8");
 }
 var stamp = (ms) => ms ? new Date(ms).toISOString().slice(0, 16).replace("T", " ") : "";
 async function runbookList(ctx, all, query) {
@@ -13595,8 +13794,8 @@ async function runbookRemove(ctx, slug) {
 }
 
 // src/runbook-import.ts
-var import_node_fs17 = require("fs");
-var import_node_path16 = require("path");
+var import_node_fs20 = require("fs");
+var import_node_path18 = require("path");
 function parseRunbook(text3, slug) {
   let rest = text3;
   const meta = {};
@@ -13621,12 +13820,12 @@ function parseRunbook(text3, slug) {
   };
 }
 function readRunbookDir(dir) {
-  if (!(0, import_node_fs17.statSync)(dir, { throwIfNoEntry: false })?.isDirectory()) throw new Error(`not a directory: ${dir}`);
-  const files = (0, import_node_fs17.readdirSync)(dir).filter((f) => f.endsWith(".md")).sort();
+  if (!(0, import_node_fs20.statSync)(dir, { throwIfNoEntry: false })?.isDirectory()) throw new Error(`not a directory: ${dir}`);
+  const files = (0, import_node_fs20.readdirSync)(dir).filter((f) => f.endsWith(".md")).sort();
   if (!files.length) throw new Error(`no .md files in ${dir}`);
   return files.map((file) => {
-    const slug = (0, import_node_path16.basename)(file, ".md");
-    const parsed = parseRunbook((0, import_node_fs17.readFileSync)((0, import_node_path16.join)(dir, file), "utf8"), slug);
+    const slug = (0, import_node_path18.basename)(file, ".md");
+    const parsed = parseRunbook((0, import_node_fs20.readFileSync)((0, import_node_path18.join)(dir, file), "utf8"), slug);
     return { file, slug, ...parsed, words: parsed.body.split(/\s+/).filter(Boolean).length };
   });
 }
@@ -13699,8 +13898,8 @@ async function upsert(ctx, r, visibility) {
 
 // src/runbook-impact.ts
 var import_node_child_process6 = require("child_process");
-var import_node_fs18 = require("fs");
-var import_node_path17 = require("path");
+var import_node_fs21 = require("fs");
+var import_node_path19 = require("path");
 
 // src/runbook-impact-scan.ts
 var DECL = /^[+-]\s*export\s+(?:declare\s+)?(?:default\s+)?(?:abstract\s+)?(?:async\s+)?(?:const|let|var|function|class|interface|type|enum)\s+([A-Za-z_$][\w$]*)/;
@@ -13869,10 +14068,10 @@ ${body.split("\n").map((line2) => `+${line2}`).join("\n")}
 }
 function manifestLabeller(root) {
   return (workspace) => {
-    const manifest = (0, import_node_path17.join)(root, workspace, "package.json");
-    if (!(0, import_node_fs18.existsSync)(manifest)) return void 0;
+    const manifest = (0, import_node_path19.join)(root, workspace, "package.json");
+    if (!(0, import_node_fs21.existsSync)(manifest)) return void 0;
     try {
-      const name = JSON.parse((0, import_node_fs18.readFileSync)(manifest, "utf8")).name;
+      const name = JSON.parse((0, import_node_fs21.readFileSync)(manifest, "utf8")).name;
       return typeof name === "string" ? name : void 0;
     } catch {
       return void 0;
@@ -13939,7 +14138,7 @@ function report4(ctx, impacts) {
 async function runbookImpact(ctx, options, deps = {}) {
   const cwd = deps.cwd ?? process.cwd();
   const runGit = deps.runGit ?? gitRunner(cwd);
-  const read3 = deps.readRepoFile ?? ((path) => (0, import_node_fs18.readFileSync)((0, import_node_path17.join)(cwd, path), "utf8"));
+  const read3 = deps.readRepoFile ?? ((path) => (0, import_node_fs21.readFileSync)((0, import_node_path19.join)(cwd, path), "utf8"));
   const surfaces = changedSurfaces(collectDiff(runGit, options.base, read3), manifestLabeller(cwd));
   if (!surfaces.length) {
     return ctx.out.log(
@@ -14072,12 +14271,12 @@ async function runbookComment(ctx, slug, body) {
 
 // src/runbook-editor.ts
 var import_node_child_process7 = require("child_process");
-var import_node_fs19 = require("fs");
-var import_node_os4 = require("os");
-var import_node_path18 = require("path");
-var import_node_process14 = __toESM(require("process"), 1);
+var import_node_fs22 = require("fs");
+var import_node_os5 = require("os");
+var import_node_path20 = require("path");
+var import_node_process16 = __toESM(require("process"), 1);
 var EDITOR_ENV = ["ODLA_EDITOR", "VISUAL", "EDITOR"];
-function resolveEditor(env = import_node_process14.default.env) {
+function resolveEditor(env = import_node_process16.default.env) {
   for (const name of EDITOR_ENV) {
     const value2 = env[name];
     if (value2 && value2.trim()) return value2.trim();
@@ -14091,8 +14290,8 @@ function defaultRun(command, path) {
   return result.status ?? 0;
 }
 function editText(initial, slug, deps = {}) {
-  const env = deps.env ?? import_node_process14.default.env;
-  const interactive = deps.interactive ?? (() => Boolean(import_node_process14.default.stdin.isTTY));
+  const env = deps.env ?? import_node_process16.default.env;
+  const interactive = deps.interactive ?? (() => Boolean(import_node_process16.default.stdin.isTTY));
   const editor = resolveEditor(env);
   if (!editor)
     throw new Error(
@@ -14100,16 +14299,16 @@ function editText(initial, slug, deps = {}) {
     );
   if (!interactive())
     throw new Error(`cannot open an editor without a terminal \u2014 pass --file <path> or --body "\u2026" instead`);
-  const dir = (0, import_node_fs19.mkdtempSync)((0, import_node_path18.join)((0, import_node_os4.tmpdir)(), "odla-runbook-"));
-  const file = (0, import_node_path18.join)(dir, `${slug}.md`);
+  const dir = (0, import_node_fs22.mkdtempSync)((0, import_node_path20.join)((0, import_node_os5.tmpdir)(), "odla-runbook-"));
+  const file = (0, import_node_path20.join)(dir, `${slug}.md`);
   try {
-    (0, import_node_fs19.writeFileSync)(file, initial, { mode: 384 });
+    (0, import_node_fs22.writeFileSync)(file, initial, { mode: 384 });
     const code = defaultRunOrInjected(deps)(editor, file);
     if (code !== 0) throw new Error(`editor "${editor}" exited with ${code}; nothing was written`);
-    const edited = (0, import_node_fs19.readFileSync)(file, "utf8");
+    const edited = (0, import_node_fs22.readFileSync)(file, "utf8");
     return edited === initial ? null : edited;
   } finally {
-    (0, import_node_fs19.rmSync)(dir, { recursive: true, force: true });
+    (0, import_node_fs22.rmSync)(dir, { recursive: true, force: true });
   }
 }
 var defaultRunOrInjected = (deps) => deps.run ?? defaultRun;
@@ -14453,7 +14652,7 @@ function hostedSeverity(value2, flag) {
 var import_security2 = require("@odla-ai/security");
 
 // src/security.ts
-var import_node_path19 = require("path");
+var import_node_path21 = require("path");
 var import_security = require("@odla-ai/security");
 var import_node3 = require("@odla-ai/security/node");
 async function runHostedSecurity(options) {
@@ -14465,9 +14664,9 @@ async function runHostedSecurity(options) {
   const appId = selfAudit ? "odla-ai" : cfg.app.id;
   const env = selfAudit ? "prod" : selectEnv(options.env, cfg.envs, cfg.configPath, cfg.rootDir);
   const platform = options.platform ?? cfg?.platformUrl ?? "https://odla.ai";
-  const target = (0, import_node_path19.resolve)(options.target ?? cfg?.rootDir ?? ".");
-  const output = (0, import_node_path19.resolve)(options.out ?? (0, import_node_path19.resolve)(target, ".odla/security/hosted"));
-  const outputRelative = (0, import_node_path19.relative)(target, output).split(import_node_path19.sep).join("/");
+  const target = (0, import_node_path21.resolve)(options.target ?? cfg?.rootDir ?? ".");
+  const output = (0, import_node_path21.resolve)(options.out ?? (0, import_node_path21.resolve)(target, ".odla/security/hosted"));
+  const outputRelative = (0, import_node_path21.relative)(target, output).split(import_node_path21.sep).join("/");
   if (!outputRelative) throw new Error("Hosted security output cannot be the repository root");
   const profile = profileFor(options.profile ?? "odla", options.maxHuntTasks ?? 12);
   const tokenRequest = {
@@ -14479,7 +14678,7 @@ async function runHostedSecurity(options) {
   };
   const token = await injectedToken(options, tokenRequest);
   const snapshot = await (0, import_node3.snapshotDirectory)(target, {
-    exclude: !outputRelative.startsWith("../") && !(0, import_node_path19.isAbsolute)(outputRelative) ? [outputRelative] : []
+    exclude: !outputRelative.startsWith("../") && !(0, import_node_path21.isAbsolute)(outputRelative) ? [outputRelative] : []
   });
   const hosted = await (0, import_security.createPlatformSecurityReasoners)({
     platform,
@@ -14497,7 +14696,7 @@ async function runHostedSecurity(options) {
   });
   const harness = (0, import_security.createSecurityHarness)({
     profile,
-    store: new import_node3.FileRunStore((0, import_node_path19.resolve)(output, "state")),
+    store: new import_node3.FileRunStore((0, import_node_path21.resolve)(output, "state")),
     discoveryReasoner: hosted.discoveryReasoner,
     validationReasoner: hosted.validationReasoner,
     policy: {
@@ -14521,7 +14720,7 @@ async function runHostedSecurity(options) {
 function selectEnv(requested, declared, configPath, rootDir) {
   const env = requested ?? (declared.includes("dev") ? "dev" : declared[0]);
   if (!env || !declared.includes(env)) {
-    const shown = (0, import_node_path19.relative)(rootDir, configPath) || configPath;
+    const shown = (0, import_node_path21.relative)(rootDir, configPath) || configPath;
     throw new Error(`env "${env ?? ""}" is not declared in ${shown}`);
   }
   return env;
@@ -14550,7 +14749,7 @@ function printSummary(out, appId, env, run, report5, output) {
   out.log(`  coverage: ${report5.coverageStatus} ${complete}/${report5.coverage.length} blocked=${report5.metrics.blockedCells} shallow=${report5.metrics.shallowCells} unscheduled=${report5.metrics.unscheduledCells} budget_exhausted=${report5.metrics.budgetExhaustedCells}`);
   if (report5.callBudget) out.log(`  calls: discovery=${formatBudget(report5.callBudget.discovery)} validation=${formatBudget(report5.callBudget.validation)}`);
   out.log(`  findings: confirmed=${report5.metrics.confirmed} needs_reproduction=${report5.metrics.needsReproduction} candidates=${report5.metrics.candidates}`);
-  out.log(`  report: ${(0, import_node_path19.resolve)(output, "REPORT.md")}`);
+  out.log(`  report: ${(0, import_node_path21.resolve)(output, "REPORT.md")}`);
 }
 function formatBudget(usage) {
   return usage ? `${usage.usedCalls}/${usage.maxCalls} skipped=${usage.skippedCalls}` : "caller-managed";
@@ -15001,6 +15200,23 @@ function exitCodeFor(err) {
 
 // src/cli.ts
 async function runCli(argv = process.argv.slice(2), dependencies = {}) {
+  const out = redactingOutput(dependencies.stdout ?? console);
+  const advisories = [];
+  const withAdvisoryReader = {
+    ...dependencies,
+    fetch: advisoryCollectingFetch(dependencies.fetch ?? fetch, advisories)
+  };
+  try {
+    return await dispatchCli(argv, withAdvisoryReader);
+  } catch (error) {
+    const explanation = explainRejectedCredential(error);
+    if (explanation) out.error(explanation);
+    throw error;
+  } finally {
+    renderAdvisories(out, advisories);
+  }
+}
+async function dispatchCli(argv, dependencies) {
   const runtime = {
     ...dependencies,
     stdout: redactingOutput(dependencies.stdout ?? console)
@@ -15030,6 +15246,10 @@ async function runCli(argv = process.argv.slice(2), dependencies = {}) {
     await contextCommand(parsed, runtime);
     return;
   }
+  if (command === "device") {
+    await deviceCommand(parsed, runtime);
+    return;
+  }
   if (command === "credentials") {
     await credentialCommand(parsed, runtime);
     return;