npm - @odla-ai/cli - Versions diffs - 0.35.3 → 0.36.1 - Mend

@odla-ai/cli 0.35.3 → 0.36.1

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (14) hide show

package/dist/bin.cjs +409 -231
package/dist/bin.cjs.map +1 -1
package/dist/bin.js +1 -1
package/dist/{chunk-PYR73XBD.js → chunk-4QJ5NS64.js} +293 -136
package/dist/chunk-4QJ5NS64.js.map +1 -0
package/dist/{cli-ZBNA7J4T.js → cli-BFGY7F6X.js} +2 -2
package/dist/index.cjs +361 -204
package/dist/index.cjs.map +1 -1
package/dist/index.d.cts +1 -1
package/dist/index.d.ts +1 -1
package/dist/index.js +1 -1
package/package.json +1 -1
package/dist/chunk-PYR73XBD.js.map +0 -1
/package/dist/{cli-ZBNA7J4T.js.map → cli-BFGY7F6X.js.map} +0 -0

package/dist/bin.cjs CHANGED Viewed

@@ -377,10 +377,54 @@ var init_cached_credential = __esm({
   }
 });
+// src/device-session.ts
+function deviceCredentialPath(env = import_node_process4.default.env) {
+  return env.ODLA_DEVICE_CREDENTIAL ?? (0, import_node_path3.join)(env.HOME ?? (0, import_node_os.homedir)(), ".odla", "device.json");
+}
+function readDeviceCredential(platform, env = import_node_process4.default.env) {
+  const path = deviceCredentialPath(env);
+  if (!(0, import_node_fs6.existsSync)(path)) return null;
+  try {
+    const parsed = JSON.parse((0, import_node_fs6.readFileSync)(path, "utf8"));
+    if (typeof parsed.token !== "string" || !parsed.token.startsWith("odla_device_")) return null;
+    if (parsed.platform !== platform) return null;
+    return { ...parsed, token: parsed.token, platform: parsed.platform };
+  } catch {
+    return null;
+  }
+}
+async function mintDeviceSession(platformUrl, credential2, doFetch) {
+  const response2 = await doFetch(`${platformUrl.replace(/\/$/, "")}/registry/devices/session`, {
+    method: "POST",
+    headers: { authorization: `Bearer ${credential2.token}`, "content-type": "application/json" },
+    body: "{}"
+  });
+  const body = await response2.json().catch(() => ({}));
+  if (!response2.ok || typeof body.token !== "string") {
+    const revocable = response2.status === 401 || response2.status === 403 || response2.status === 404;
+    const detail = body.error?.message ?? (response2.ok ? `registry returned ${response2.status} with no session token` : `registry returned ${response2.status}`);
+    throw new Error(
+      `device session failed: ${detail} (${response2.status})` + (revocable ? " \u2014 if this machine's enrollment was revoked or has expired, enroll it again in Studio" : "")
+    );
+  }
+  return { token: body.token, expiresAt: body.expiresAt ?? Date.now() };
+}
+var import_node_fs6, import_node_os, import_node_path3, import_node_process4;
+var init_device_session = __esm({
+  "src/device-session.ts"() {
+    "use strict";
+    init_cjs_shims();
+    import_node_fs6 = require("fs");
+    import_node_os = require("os");
+    import_node_path3 = require("path");
+    import_node_process4 = __toESM(require("process"), 1);
+  }
+});
 // src/local.ts
 function readJsonFile(path) {
   try {
-    return JSON.parse((0, import_node_fs6.readFileSync)(path, "utf8"));
+    return JSON.parse((0, import_node_fs7.readFileSync)(path, "utf8"));
   } catch {
     return null;
   }
@@ -390,10 +434,10 @@ function writePrivateJson(path, value2) {
 `);
 }
 function readCredentials(path) {
-  if (!(0, import_node_fs6.existsSync)(path)) return null;
+  if (!(0, import_node_fs7.existsSync)(path)) return null;
   let value2;
   try {
-    value2 = JSON.parse((0, import_node_fs6.readFileSync)(path, "utf8"));
+    value2 = JSON.parse((0, import_node_fs7.readFileSync)(path, "utf8"));
   } catch {
     throw new Error(`credentials file ${path} is not valid JSON; fix or remove it before provisioning`);
   }
@@ -423,14 +467,14 @@ function mergeCredential(current, update) {
   return next;
 }
 function ensureGitignore(rootDir, localPaths = []) {
-  const path = (0, import_node_path3.resolve)(rootDir, ".gitignore");
-  const existing = (0, import_node_fs6.existsSync)(path) ? (0, import_node_fs6.readFileSync)(path, "utf8") : "";
+  const path = (0, import_node_path4.resolve)(rootDir, ".gitignore");
+  const existing = (0, import_node_fs7.existsSync)(path) ? (0, import_node_fs7.readFileSync)(path, "utf8") : "";
   const configured = localPaths.map((localPath) => gitignoreEntry(rootDir, localPath)).filter((line2) => !!line2);
   const wanted = [.../* @__PURE__ */ new Set([...GITIGNORE_LINES, ...configured])];
   const missing = wanted.filter((line2) => !existing.split(/\r?\n/).includes(line2));
   if (missing.length === 0) return;
   const prefix = existing && !existing.endsWith("\n") ? "\n" : "";
-  (0, import_node_fs6.writeFileSync)(path, `${existing}${prefix}${missing.join("\n")}
+  (0, import_node_fs7.writeFileSync)(path, `${existing}${prefix}${missing.join("\n")}
 `);
 }
 function o11yDevVars(cfg) {
@@ -444,7 +488,7 @@ function o11yDevVars(cfg) {
 function resolveWriteDevVarsTarget(cfg, requested) {
   if (!requested) return null;
   if (requested === true) return cfg.local.devVarsFile;
-  return (0, import_node_path3.resolve)((0, import_node_path3.dirname)(cfg.configPath), requested);
+  return (0, import_node_path4.resolve)((0, import_node_path4.dirname)(cfg.configPath), requested);
 }
 function writeDevVars(path, credentials, env, o11y) {
   const entry = credentials.envs[env];
@@ -458,7 +502,7 @@ function writeDevVars(path, credentials, env, o11y) {
     if (o11y.version) lines.push(`ODLA_O11Y_VERSION="${o11y.version}"`);
     if (entry.o11yToken) lines.push(`ODLA_O11Y_TOKEN="${entry.o11yToken}"`);
   }
-  const existing = (0, import_node_fs6.existsSync)(path) ? (0, import_node_fs6.readFileSync)(path, "utf8") : "";
+  const existing = (0, import_node_fs7.existsSync)(path) ? (0, import_node_fs7.readFileSync)(path, "utf8") : "";
   const retained = existing.split(/\r?\n/).filter((line2) => !isManagedDevVar(line2));
   while (retained.at(-1) === "") retained.pop();
   const prefix = retained.length ? `${retained.join("\n")}
@@ -472,28 +516,28 @@ function isManagedDevVar(line2) {
   return !!match?.[1] && MANAGED_DEV_VARS.has(match[1]);
 }
 function writePrivateText(path, text3) {
-  (0, import_node_fs6.mkdirSync)((0, import_node_path3.dirname)(path), { recursive: true });
+  (0, import_node_fs7.mkdirSync)((0, import_node_path4.dirname)(path), { recursive: true });
   const temporary = `${path}.tmp-${process.pid}-${Date.now()}`;
-  (0, import_node_fs6.writeFileSync)(temporary, text3, { mode: 384 });
-  (0, import_node_fs6.chmodSync)(temporary, 384);
-  (0, import_node_fs6.renameSync)(temporary, path);
+  (0, import_node_fs7.writeFileSync)(temporary, text3, { mode: 384 });
+  (0, import_node_fs7.chmodSync)(temporary, 384);
+  (0, import_node_fs7.renameSync)(temporary, path);
 }
 function gitignoreEntry(rootDir, path) {
-  const rel = (0, import_node_path3.relative)((0, import_node_path3.resolve)(rootDir), (0, import_node_path3.resolve)(path));
-  if (!rel || rel === ".." || rel.startsWith(`..${process.platform === "win32" ? "\\" : "/"}`) || (0, import_node_path3.isAbsolute)(rel)) return null;
+  const rel = (0, import_node_path4.relative)((0, import_node_path4.resolve)(rootDir), (0, import_node_path4.resolve)(path));
+  if (!rel || rel === ".." || rel.startsWith(`..${process.platform === "win32" ? "\\" : "/"}`) || (0, import_node_path4.isAbsolute)(rel)) return null;
   return rel.replaceAll("\\", "/");
 }
 function displayPath(path, rootDir = process.cwd()) {
-  const rel = (0, import_node_path3.relative)(rootDir, path);
+  const rel = (0, import_node_path4.relative)(rootDir, path);
   return rel && !rel.startsWith("..") ? rel : path;
 }
-var import_node_fs6, import_node_path3, GITIGNORE_LINES, MANAGED_DEV_VARS;
+var import_node_fs7, import_node_path4, GITIGNORE_LINES, MANAGED_DEV_VARS;
 var init_local = __esm({
   "src/local.ts"() {
     "use strict";
     init_cjs_shims();
-    import_node_fs6 = require("fs");
-    import_node_path3 = require("path");
+    import_node_fs7 = require("fs");
+    import_node_path4 = require("path");
     GITIGNORE_LINES = [".odla/*.local.json", ".odla/dev-token.json", ".dev.vars"];
     MANAGED_DEV_VARS = /* @__PURE__ */ new Set([
       "ODLA_PLATFORM",
@@ -518,14 +562,20 @@ async function getDeveloperToken(cfg, options, doFetch, out, grantRequest = {})
   const cached = readJsonFile(cfg.local.tokenFile);
   if (!grantRequest.forceReview && !grantRequest.freshLogin) {
     if (options.token) return options.token;
-    if (import_node_process4.default.env.ODLA_DEV_TOKEN) {
-      const declared = import_node_process4.default.env.ODLA_DEV_TOKEN_AUDIENCE;
+    if (import_node_process5.default.env.ODLA_DEV_TOKEN) {
+      const declared = import_node_process5.default.env.ODLA_DEV_TOKEN_AUDIENCE;
       if (declared) {
         if (platformAudience(declared) !== audience) throw new Error("ODLA_DEV_TOKEN_AUDIENCE does not match the configured platform");
       } else if (audience !== "https://odla.ai") {
         throw new Error("ODLA_DEV_TOKEN_AUDIENCE is required for a non-default platform");
       }
-      return import_node_process4.default.env.ODLA_DEV_TOKEN;
+      return import_node_process5.default.env.ODLA_DEV_TOKEN;
+    }
+    const device = readDeviceCredential(audience);
+    if (device) {
+      const session = await mintDeviceSession(cfg.platformUrl, device, doFetch);
+      out.error(`auth: session minted by this enrolled device (${displayPath(deviceCredentialPath(), cfg.rootDir)})`);
+      return session.token;
     }
     if (cached?.token && cached.platform === audience && (cached.expiresAt ?? 0) > Date.now() + 6e4 && cachedGrantCovers(cached, grantIntent)) {
       out.error(`auth: using cached developer token (${displayPath(cfg.local.tokenFile, cfg.rootDir)})`);
@@ -630,7 +680,7 @@ function stillPending(pending, email) {
   );
 }
 function handshakeEmail(value2, cached) {
-  const email = (value2 ?? import_node_process4.default.env.ODLA_USER_EMAIL ?? cached ?? "").trim().toLowerCase();
+  const email = (value2 ?? import_node_process5.default.env.ODLA_USER_EMAIL ?? cached ?? "").trim().toLowerCase();
   if (/@users\.noreply\.github\.com$/i.test(email)) {
     throw new Error(
       `"${email}" is a GitHub commit identity, not an odla account email; use --email <signed-in-odla-account> or ODLA_USER_EMAIL`
@@ -659,17 +709,18 @@ function platformAudience(value2) {
   }
   return url.origin;
 }
-var import_db, import_node_crypto, import_node_process4;
+var import_db, import_node_crypto, import_node_process5;
 var init_token = __esm({
   "src/token.ts"() {
     "use strict";
     init_cjs_shims();
     import_db = require("@odla-ai/db");
     import_node_crypto = require("crypto");
-    import_node_process4 = __toESM(require("process"), 1);
+    import_node_process5 = __toESM(require("process"), 1);
     init_handshake_approval();
     init_handshake_state();
     init_cached_credential();
+    init_device_session();
     init_local();
   }
 });
@@ -678,7 +729,7 @@ var init_token = __esm({
 async function secretInputValue(options, kind = "credential") {
   if (options.fromEnv && options.stdin) throw new Error("choose exactly one of --from-env or --stdin");
   let value2;
-  if (options.fromEnv) value2 = import_node_process5.default.env[options.fromEnv];
+  if (options.fromEnv) value2 = import_node_process6.default.env[options.fromEnv];
   else if (options.stdin) value2 = await (options.readStdin ?? (() => readSecretStream(kind)))();
   else throw new Error(`${kind} input required: use --from-env <NAME> or --stdin; values are never accepted as arguments`);
   value2 = value2?.replace(/[\r\n]+$/, "");
@@ -686,7 +737,7 @@ async function secretInputValue(options, kind = "credential") {
   if (new TextEncoder().encode(value2).byteLength > MAX_BYTES) throw new Error(`${kind} exceeds 64 KiB`);
   return value2;
 }
-async function readSecretStream(kind, stream = import_node_process5.default.stdin) {
+async function readSecretStream(kind, stream = import_node_process6.default.stdin) {
   let value2 = "";
   for await (const chunk of stream) {
     value2 += String(chunk);
@@ -694,12 +745,12 @@ async function readSecretStream(kind, stream = import_node_process5.default.stdi
   }
   return value2;
 }
-var import_node_process5, MAX_BYTES;
+var import_node_process6, MAX_BYTES;
 var init_secret_input = __esm({
   "src/secret-input.ts"() {
     "use strict";
     init_cjs_shims();
-    import_node_process5 = __toESM(require("process"), 1);
+    import_node_process6 = __toESM(require("process"), 1);
     MAX_BYTES = 64 * 1024;
   }
 });
@@ -711,7 +762,7 @@ async function getScopedPlatformToken(options) {
 async function resolveAdminPlatformToken(options) {
   const audience = platformAudience(options.platform);
   if (options.token) return options.token;
-  const fromEnv = import_node_process6.default.env.ODLA_ADMIN_TOKEN;
+  const fromEnv = import_node_process7.default.env.ODLA_ADMIN_TOKEN;
   if (fromEnv) return audienceBoundEnvToken(fromEnv, audience);
   return scopedToken(
     audience,
@@ -723,7 +774,7 @@ async function resolveAdminPlatformToken(options) {
 }
 function audienceBoundEnvToken(token, platform) {
   const audience = platformAudience(platform);
-  const declared = import_node_process6.default.env.ODLA_ADMIN_TOKEN_AUDIENCE;
+  const declared = import_node_process7.default.env.ODLA_ADMIN_TOKEN_AUDIENCE;
   if (declared) {
     if (platformAudience(declared) !== audience) throw new Error("ODLA_ADMIN_TOKEN_AUDIENCE does not match the configured platform");
   } else if (audience !== "https://odla.ai") {
@@ -733,8 +784,8 @@ function audienceBoundEnvToken(token, platform) {
 }
 async function scopedToken(platform, scope, options, doFetch, out) {
   const audience = platformAudience(platform);
-  const rootDir = options.rootDir ?? import_node_process6.default.cwd();
-  const tokenFile = options.tokenFile ?? (0, import_node_path4.join)(rootDir, ".odla/admin-token.local.json");
+  const rootDir = options.rootDir ?? import_node_process7.default.cwd();
+  const tokenFile = options.tokenFile ?? (0, import_node_path5.join)(rootDir, ".odla/admin-token.local.json");
   const cache2 = options.cache === false ? null : readJsonFile(tokenFile);
   const cached = cache2?.platform === audience ? cache2.tokens?.[scope] : void 0;
   if (cached?.token && (cached.expiresAt ?? 0) > Date.now() + 6e4) {
@@ -761,7 +812,7 @@ async function scopedToken(platform, scope, options, doFetch, out) {
   if (options.cache !== false) {
     const tokens = cache2?.platform === audience ? { ...cache2.tokens ?? {} } : {};
     tokens[scope] = { token, expiresAt };
-    if ((0, import_node_fs7.existsSync)((0, import_node_path4.join)(rootDir, ".git"))) ensureGitignore(rootDir, [tokenFile]);
+    if ((0, import_node_fs8.existsSync)((0, import_node_path5.join)(rootDir, ".git"))) ensureGitignore(rootDir, [tokenFile]);
     writePrivateJson(tokenFile, { platform: audience, email, tokens });
     out.error(`auth: cached ${scope} grant (${tokenFile}; mode 0600)`);
   } else {
@@ -769,14 +820,14 @@ async function scopedToken(platform, scope, options, doFetch, out) {
   }
   return token;
 }
-var import_node_fs7, import_node_path4, import_node_process6, import_db2, SCOPE_PURPOSE;
+var import_node_fs8, import_node_path5, import_node_process7, import_db2, SCOPE_PURPOSE;
 var init_admin_ai_auth = __esm({
   "src/admin-ai-auth.ts"() {
     "use strict";
     init_cjs_shims();
-    import_node_fs7 = require("fs");
-    import_node_path4 = require("path");
-    import_node_process6 = __toESM(require("process"), 1);
+    import_node_fs8 = require("fs");
+    import_node_path5 = require("path");
+    import_node_process7 = __toESM(require("process"), 1);
     import_db2 = require("@odla-ai/db");
     init_local();
     init_handshake_approval();
@@ -786,6 +837,7 @@ var init_admin_ai_auth = __esm({
       "app:config:read": "compare checked-in intent with an exact-id app Registry configuration",
       "app:config:write": "apply or inspect one revision-bound configuration operation for an app you own",
       "platform:runbook:write": "read and edit all of odla's operational runbooks, including admin-visible content",
+      "app:device:enroll": "enrol this machine so it can mint its own short-lived credentials without asking you again",
       "platform:ai:policy:write": "change System AI model routing",
       "platform:ai:policy:read": "read System AI model routing",
       "platform:ai:credential:write": "replace a stored AI provider key",
@@ -994,7 +1046,7 @@ var init_admin_ai_usage = __esm({
 // src/admin-ai.ts
 async function adminAi(options) {
-  const platform = platformAudience(options.platform ?? import_node_process7.default.env.ODLA_PLATFORM ?? "https://odla.ai");
+  const platform = platformAudience(options.platform ?? import_node_process8.default.env.ODLA_PLATFORM ?? "https://odla.ai");
   const doFetch = options.fetch ?? fetch;
   const out = options.stdout ?? console;
   const usageQuery = options.action === "usage" ? adminAiUsageQuery(options) : void 0;
@@ -1172,12 +1224,12 @@ function apiError3(action2, status, body) {
 function isRecord3(value2) {
   return Boolean(value2) && typeof value2 === "object" && !Array.isArray(value2);
 }
-var import_node_process7;
+var import_node_process8;
 var init_admin_ai = __esm({
   "src/admin-ai.ts"() {
     "use strict";
     init_cjs_shims();
-    import_node_process7 = __toESM(require("process"), 1);
+    import_node_process8 = __toESM(require("process"), 1);
     init_token();
     init_secret_input();
     init_admin_ai_auth();
@@ -1691,12 +1743,12 @@ var init_monitoring_validation = __esm({
 // src/config.ts
 async function loadProjectConfig(configPath = "odla.config.mjs", options = {}) {
-  const resolved = (0, import_node_path5.resolve)(configPath);
-  if (!(0, import_node_fs8.existsSync)(resolved)) {
+  const resolved = (0, import_node_path6.resolve)(configPath);
+  if (!(0, import_node_fs9.existsSync)(resolved)) {
     throw new Error(`config not found: ${configPath}. Run "odla-ai init" first or pass --config.`);
   }
   const raw = await loadConfigModule(resolved);
-  const rootDir = (0, import_node_path5.dirname)(resolved);
+  const rootDir = (0, import_node_path6.dirname)(resolved);
   validateRawConfig(raw, resolved);
   const platformUrl = trimSlash(process.env.ODLA_PLATFORM_URL || raw.platformUrl || DEFAULT_PLATFORM);
   const dbEndpoint = trimSlash(process.env.ODLA_DB_ENDPOINT || raw.dbEndpoint || platformUrl);
@@ -1706,9 +1758,9 @@ async function loadProjectConfig(configPath = "odla.config.mjs", options = {}) {
   validateCalendarConfig(raw, unique3([...envs, ...options.additionalEnvs ?? []]), services, resolved);
   validateMonitoringConfig(raw, unique3([...envs, ...options.additionalEnvs ?? []]), services, resolved);
   const local = {
-    tokenFile: (0, import_node_path5.resolve)(rootDir, raw.local?.tokenFile ?? ".odla/dev-token.json"),
-    credentialsFile: (0, import_node_path5.resolve)(rootDir, raw.local?.credentialsFile ?? ".odla/credentials.local.json"),
-    devVarsFile: (0, import_node_path5.resolve)(rootDir, raw.local?.devVarsFile ?? ".dev.vars"),
+    tokenFile: (0, import_node_path6.resolve)(rootDir, raw.local?.tokenFile ?? ".odla/dev-token.json"),
+    credentialsFile: (0, import_node_path6.resolve)(rootDir, raw.local?.credentialsFile ?? ".odla/credentials.local.json"),
+    devVarsFile: (0, import_node_path6.resolve)(rootDir, raw.local?.devVarsFile ?? ".dev.vars"),
     gitignore: raw.local?.gitignore ?? true
   };
   return {
@@ -1725,9 +1777,9 @@ async function loadProjectConfig(configPath = "odla.config.mjs", options = {}) {
 async function resolveDataExport(cfg, value2, names) {
   if (value2 === void 0 || value2 === null || value2 === false) return void 0;
   if (typeof value2 !== "string") return value2;
-  const target = (0, import_node_path5.isAbsolute)(value2) ? value2 : (0, import_node_path5.resolve)(cfg.rootDir, value2);
+  const target = (0, import_node_path6.isAbsolute)(value2) ? value2 : (0, import_node_path6.resolve)(cfg.rootDir, value2);
   if (target.endsWith(".json")) {
-    return JSON.parse((0, import_node_fs8.readFileSync)(target, "utf8"));
+    return JSON.parse((0, import_node_fs9.readFileSync)(target, "utf8"));
   }
   const mod = await import((0, import_node_url.pathToFileURL)(target).href);
   for (const name of names) {
@@ -1803,7 +1855,7 @@ function validId2(value2) {
   return typeof value2 === "string" && /^[a-z0-9][a-z0-9-]*$/.test(value2);
 }
 async function loadConfigModule(path) {
-  if (path.endsWith(".json")) return JSON.parse((0, import_node_fs8.readFileSync)(path, "utf8"));
+  if (path.endsWith(".json")) return JSON.parse((0, import_node_fs9.readFileSync)(path, "utf8"));
   const nonce = `${Date.now()}-${configImportSerial++}`;
   const mod = await import(`${(0, import_node_url.pathToFileURL)(path).href}?reload=${nonce}`);
   const value2 = mod.default ?? mod.config;
@@ -1816,13 +1868,13 @@ function trimSlash(value2) {
 function unique3(values) {
   return [...new Set(values.filter(Boolean))];
 }
-var import_node_fs8, import_node_path5, import_node_url, import_apps, DEFAULT_PLATFORM, DEFAULT_ENVS, DEFAULT_SERVICES, configImportSerial, GOOGLE_CALENDAR_EVENTS_SCOPE;
+var import_node_fs9, import_node_path6, import_node_url, import_apps, DEFAULT_PLATFORM, DEFAULT_ENVS, DEFAULT_SERVICES, configImportSerial, GOOGLE_CALENDAR_EVENTS_SCOPE;
 var init_config = __esm({
   "src/config.ts"() {
     "use strict";
     init_cjs_shims();
-    import_node_fs8 = require("fs");
-    import_node_path5 = require("path");
+    import_node_fs9 = require("fs");
+    import_node_path6 = require("path");
     import_node_url = require("url");
     import_apps = require("@odla-ai/apps");
     init_ai_config_validation();
@@ -1840,13 +1892,13 @@ var init_config = __esm({
 // src/operator-profiles.ts
 function operatorProfileFile() {
-  return (0, import_node_path6.resolve)(
-    clean(import_node_process8.default.env.ODLA_CONTEXT_FILE) ?? (0, import_node_path6.join)((0, import_node_os.homedir)(), ".odla", "contexts.json")
+  return (0, import_node_path7.resolve)(
+    clean(import_node_process9.default.env.ODLA_CONTEXT_FILE) ?? (0, import_node_path7.join)((0, import_node_os2.homedir)(), ".odla", "contexts.json")
   );
 }
 function resolveOperatorProfile(parsed) {
   const fromFlag = clean(stringOpt(parsed.options.context));
-  const fromEnvironment = clean(import_node_process8.default.env.ODLA_CONTEXT);
+  const fromEnvironment = clean(import_node_process9.default.env.ODLA_CONTEXT);
   const name = fromFlag ?? fromEnvironment ?? null;
   const file = operatorProfileFile();
   if (!name) {
@@ -1886,10 +1938,10 @@ function removeOperatorProfile(name, file = operatorProfileFile()) {
   return true;
 }
 function operatorCredentialFiles(selection) {
-  const base = selection.name ? (0, import_node_path6.join)((0, import_node_path6.dirname)(selection.file), "profiles", selection.name) : (0, import_node_path6.join)((0, import_node_os.homedir)(), ".odla");
+  const base = selection.name ? (0, import_node_path7.join)((0, import_node_path7.dirname)(selection.file), "profiles", selection.name) : (0, import_node_path7.join)((0, import_node_os2.homedir)(), ".odla");
   return {
-    developer: (0, import_node_path6.join)(base, "dev-token.json"),
-    scoped: (0, import_node_path6.join)(base, "admin-token.local.json")
+    developer: (0, import_node_path7.join)(base, "dev-token.json"),
+    scoped: (0, import_node_path7.join)(base, "admin-token.local.json")
   };
 }
 function assertOperatorName(value2, label) {
@@ -1900,10 +1952,10 @@ function assertOperatorName(value2, label) {
   }
 }
 function readOperatorProfiles(file) {
-  if (!(0, import_node_fs9.existsSync)(file)) return emptyProfiles();
+  if (!(0, import_node_fs10.existsSync)(file)) return emptyProfiles();
   let raw;
   try {
-    raw = JSON.parse((0, import_node_fs9.readFileSync)(file, "utf8"));
+    raw = JSON.parse((0, import_node_fs10.readFileSync)(file, "utf8"));
   } catch {
     throw new Error(`operator context file ${file} is not valid JSON`);
   }
@@ -1961,15 +2013,15 @@ function clean(value2) {
   const normalized = value2?.trim();
   return normalized || void 0;
 }
-var import_node_fs9, import_node_os, import_node_path6, import_node_process8;
+var import_node_fs10, import_node_os2, import_node_path7, import_node_process9;
 var init_operator_profiles = __esm({
   "src/operator-profiles.ts"() {
     "use strict";
     init_cjs_shims();
-    import_node_fs9 = require("fs");
-    import_node_os = require("os");
-    import_node_path6 = require("path");
-    import_node_process8 = __toESM(require("process"), 1);
+    import_node_fs10 = require("fs");
+    import_node_os2 = require("os");
+    import_node_path7 = require("path");
+    import_node_process9 = __toESM(require("process"), 1);
     init_argv();
     init_local();
     init_token();
@@ -1980,21 +2032,21 @@ var init_operator_profiles = __esm({
 async function resolveOperatorContext(parsed, options = {}) {
   const profile = resolveOperatorProfile(parsed);
   const configArgument = stringOpt(parsed.options.config) ?? "odla.config.mjs";
-  const configPath = (0, import_node_path7.resolve)(configArgument);
+  const configPath = (0, import_node_path8.resolve)(configArgument);
   const explicitConfig = parsed.options.config !== void 0;
-  const hasConfig = (0, import_node_fs10.existsSync)(configPath);
+  const hasConfig = (0, import_node_fs11.existsSync)(configPath);
   if (!hasConfig && (!options.allowMissingConfig || explicitConfig)) {
     await loadProjectConfig(configArgument);
   }
   const loaded = hasConfig ? await loadProjectConfig(configArgument) : void 0;
   const platformFlag = clean2(stringOpt(parsed.options.platform));
-  const platformEnvironment = clean2(import_node_process9.default.env.ODLA_PLATFORM_URL);
+  const platformEnvironment = clean2(import_node_process10.default.env.ODLA_PLATFORM_URL);
   const platformValue = platformAudience(
     platformFlag ?? platformEnvironment ?? profile.value?.platform ?? loaded?.platformUrl ?? DEFAULT_PLATFORM2
   );
   const platformSource = platformFlag ? "flag" : platformEnvironment ? "environment" : profile.value ? "profile" : loaded ? "config" : "default";
   const appFlag = clean2(stringOpt(parsed.options.app));
-  const appEnvironment = clean2(import_node_process9.default.env.ODLA_APP_ID);
+  const appEnvironment = clean2(import_node_process10.default.env.ODLA_APP_ID);
   const appValue = appFlag ?? appEnvironment ?? profile.value?.app ?? loaded?.app.id ?? null;
   const appSource = appFlag ? "flag" : appEnvironment ? "environment" : profile.value?.app ? "profile" : loaded ? "config" : "unresolved";
   if (appValue) assertOperatorName(appValue, "app");
@@ -2004,16 +2056,16 @@ async function resolveOperatorContext(parsed, options = {}) {
     );
   }
   const envFlag = clean2(stringOpt(parsed.options.env));
-  const envEnvironment = clean2(import_node_process9.default.env.ODLA_ENV);
+  const envEnvironment = clean2(import_node_process10.default.env.ODLA_ENV);
   const environmentValue = envFlag ?? envEnvironment ?? profile.value?.environment ?? options.defaultEnvironment ?? null;
   const environmentSource = envFlag ? "flag" : envEnvironment ? "environment" : profile.value?.environment ? "profile" : options.defaultEnvironment ? "default" : "unresolved";
   if (environmentValue) {
     assertOperatorName(environmentValue, "environment");
   }
-  const rootDir = loaded?.rootDir ?? import_node_process9.default.cwd();
+  const rootDir = loaded?.rootDir ?? import_node_process10.default.cwd();
   const profileCredentials = operatorCredentialFiles(profile);
-  const tokenFile = clean2(import_node_process9.default.env.ODLA_DEV_TOKEN_FILE) ? (0, import_node_path7.resolve)(import_node_process9.default.env.ODLA_DEV_TOKEN_FILE) : profile.name ? profileCredentials.developer : loaded?.local.tokenFile ?? profileCredentials.developer;
-  const scopedTokenFile = clean2(import_node_process9.default.env.ODLA_ADMIN_TOKEN_FILE) ? (0, import_node_path7.resolve)(import_node_process9.default.env.ODLA_ADMIN_TOKEN_FILE) : profile.name ? profileCredentials.scoped : loaded ? (0, import_node_path7.join)(loaded.rootDir, ".odla", "admin-token.local.json") : profileCredentials.scoped;
+  const tokenFile = clean2(import_node_process10.default.env.ODLA_DEV_TOKEN_FILE) ? (0, import_node_path8.resolve)(import_node_process10.default.env.ODLA_DEV_TOKEN_FILE) : profile.name ? profileCredentials.developer : loaded?.local.tokenFile ?? profileCredentials.developer;
+  const scopedTokenFile = clean2(import_node_process10.default.env.ODLA_ADMIN_TOKEN_FILE) ? (0, import_node_path8.resolve)(import_node_process10.default.env.ODLA_ADMIN_TOKEN_FILE) : profile.name ? profileCredentials.scoped : loaded ? (0, import_node_path8.join)(loaded.rootDir, ".odla", "admin-token.local.json") : profileCredentials.scoped;
   const cfg = loaded ? {
     ...loaded,
     platformUrl: platformValue,
@@ -2035,8 +2087,8 @@ async function resolveOperatorContext(parsed, options = {}) {
     services: [],
     local: {
       tokenFile,
-      credentialsFile: (0, import_node_path7.join)(rootDir, ".odla", "credentials.local.json"),
-      devVarsFile: (0, import_node_path7.join)(rootDir, ".dev.vars"),
+      credentialsFile: (0, import_node_path8.join)(rootDir, ".odla", "credentials.local.json"),
+      devVarsFile: (0, import_node_path8.join)(rootDir, ".dev.vars"),
       gitignore: true
     }
   };
@@ -2068,14 +2120,14 @@ function clean2(value2) {
   const normalized = value2?.trim();
   return normalized || void 0;
 }
-var import_node_fs10, import_node_path7, import_node_process9, DEFAULT_PLATFORM2;
+var import_node_fs11, import_node_path8, import_node_process10, DEFAULT_PLATFORM2;
 var init_operator_context = __esm({
   "src/operator-context.ts"() {
     "use strict";
     init_cjs_shims();
-    import_node_fs10 = require("fs");
-    import_node_path7 = require("path");
-    import_node_process9 = __toESM(require("process"), 1);
+    import_node_fs11 = require("fs");
+    import_node_path8 = require("path");
+    import_node_process10 = __toESM(require("process"), 1);
     init_argv();
     init_config();
     init_operator_profiles();
@@ -2327,7 +2379,7 @@ async function authCommand(parsed, deps = {}) {
   const { cfg } = context;
   const out = deps.stdout ?? console;
   const doFetch = deps.fetch ?? fetch;
-  const email = stringOpt(parsed.options.email) ?? import_node_process10.default.env.ODLA_USER_EMAIL?.trim();
+  const email = stringOpt(parsed.options.email) ?? import_node_process11.default.env.ODLA_USER_EMAIL?.trim();
   if (!email) {
     throw new Error(
       "auth login requires --email <odla-account> or ODLA_USER_EMAIL; confirm the signed-in odla email instead of using git or GitHub identity"
@@ -2361,12 +2413,12 @@ async function authCommand(parsed, deps = {}) {
   out.log(`Authorized ${identity.displayName}${handle} for ${cfg.app.id}.`);
   out.log(`odla account: ${identity.email ?? "not returned"}`);
 }
-var import_node_process10;
+var import_node_process11;
 var init_auth_command = __esm({
   "src/auth-command.ts"() {
     "use strict";
     init_cjs_shims();
-    import_node_process10 = __toESM(require("process"), 1);
+    import_node_process11 = __toESM(require("process"), 1);
     init_argv();
     init_operator_context();
     init_token();
@@ -2539,7 +2591,7 @@ async function appImport(options) {
   const out = options.stdout ?? console;
   const say = options.json ? (line2) => out.error(line2) : (line2) => out.log(line2);
   const { tenant } = resolveTenant(cfg, options.env);
-  const text3 = options.file === "-" ? (options.readStdin ?? (() => (0, import_node_fs11.readFileSync)(0, "utf8")))() : (0, import_node_fs11.readFileSync)(options.file, "utf8");
+  const text3 = options.file === "-" ? (options.readStdin ?? (() => (0, import_node_fs12.readFileSync)(0, "utf8")))() : (0, import_node_fs12.readFileSync)(options.file, "utf8");
   const { format, sources } = (0, import_import.parseImport)(text3, options.ns);
   if (format === "namespace-map" && options.ns) {
     throw new Error("--ns cannot be combined with a {namespace: rows} file \u2014 the file already names each namespace");
@@ -2567,12 +2619,12 @@ ${detail}${more}`);
   }
   return requireStudioHuman(options.configPath, "database import", "database", options.env);
 }
-var import_node_fs11, import_import;
+var import_node_fs12, import_import;
 var init_app_import = __esm({
   "src/app-import.ts"() {
     "use strict";
     init_cjs_shims();
-    import_node_fs11 = require("fs");
+    import_node_fs12 = require("fs");
     import_import = require("@odla-ai/db/import");
     init_config();
     init_human_session();
@@ -2883,15 +2935,15 @@ var init_brand_design_unpack = __esm({
 // src/brand-command.ts
 async function readBundle(source, deps) {
-  if (source !== "-") return (0, import_promises.readFile)((0, import_node_path8.resolve)(source), "utf8");
+  if (source !== "-") return (0, import_promises.readFile)((0, import_node_path9.resolve)(source), "utf8");
   const readStdin = deps.readStdin;
   if (!readStdin) throw new Error("reading a bundle from stdin is not supported here");
   return readStdin();
 }
 async function writeAll(result, outDir) {
   for (const file of result.files) {
-    const target = (0, import_node_path8.resolve)(outDir, file.path);
-    await (0, import_promises.mkdir)((0, import_node_path8.dirname)(target), { recursive: true });
+    const target = (0, import_node_path9.resolve)(outDir, file.path);
+    await (0, import_promises.mkdir)((0, import_node_path9.dirname)(target), { recursive: true });
     await (0, import_promises.writeFile)(target, file.bytes);
   }
 }
@@ -2899,7 +2951,7 @@ async function designUnpack(parsed, deps) {
   assertArgs(parsed, ["out", "json"], 4);
   const source = parsed.positionals[3];
   if (!source) throw new Error(USAGE);
-  const outDir = (0, import_node_path8.resolve)(stringOpt(parsed.options.out) ?? "design");
+  const outDir = (0, import_node_path9.resolve)(stringOpt(parsed.options.out) ?? "design");
   const result = unpackDesign(await readBundle(source, deps));
   await writeAll(result, outDir);
   const out = deps.stdout ?? console;
@@ -2925,13 +2977,13 @@ async function brandCommand(parsed, deps) {
   }
   throw new Error(USAGE);
 }
-var import_promises, import_node_path8, USAGE;
+var import_promises, import_node_path9, USAGE;
 var init_brand_command = __esm({
   "src/brand-command.ts"() {
     "use strict";
     init_cjs_shims();
     import_promises = require("fs/promises");
-    import_node_path8 = require("path");
+    import_node_path9 = require("path");
     init_argv();
     init_brand_design_unpack();
     USAGE = "usage: odla-ai brand design unpack <bundle.html|-> [--out <dir>] [--json]";
@@ -3569,7 +3621,7 @@ var init_config_reconcile_digest = __esm({
 function readPlan(path) {
   let value2;
   try {
-    const raw = (0, import_node_fs12.readFileSync)(path, "utf8");
+    const raw = (0, import_node_fs13.readFileSync)(path, "utf8");
     if (Buffer.byteLength(raw) > 128 * 1024) throw new Error("plan exceeds 128 KiB");
     value2 = JSON.parse(raw);
   } catch (error) {
@@ -3685,13 +3737,13 @@ function invalidPlan(message2) {
 function record3(value2) {
   return !!value2 && typeof value2 === "object" && !Array.isArray(value2);
 }
-var import_apps3, import_node_fs12, DIGEST, REVISION, OPERATION_ID, ACTION_ID, ENV, SERVICE;
+var import_apps3, import_node_fs13, DIGEST, REVISION, OPERATION_ID, ACTION_ID, ENV, SERVICE;
 var init_config_operation_validate = __esm({
   "src/config-operation-validate.ts"() {
     "use strict";
     init_cjs_shims();
     import_apps3 = require("@odla-ai/apps");
-    import_node_fs12 = require("fs");
+    import_node_fs13 = require("fs");
     init_config_operation_error();
     init_config_reconcile_digest();
     DIGEST = /^sha256:[0-9a-f]{64}$/;
@@ -3979,7 +4031,7 @@ async function operationClient(cfg, options, purpose) {
     platform: cfg.platformUrl,
     scope: "app:config:write",
     token: options.token,
-    tokenFile: (0, import_node_path9.join)(cfg.rootDir, ".odla", "admin-token.local.json"),
+    tokenFile: (0, import_node_path10.join)(cfg.rootDir, ".odla", "admin-token.local.json"),
     rootDir: cfg.rootDir,
     email: options.email,
     open: options.open,
@@ -4031,13 +4083,13 @@ function normalizeRequestError(error) {
 function record4(value2) {
   return !!value2 && typeof value2 === "object" && !Array.isArray(value2);
 }
-var import_apps6, import_node_path9, IDEMPOTENCY_KEY, DEFAULT_WAIT_SECONDS, DEFAULT_INTERVAL_SECONDS;
+var import_apps6, import_node_path10, IDEMPOTENCY_KEY, DEFAULT_WAIT_SECONDS, DEFAULT_INTERVAL_SECONDS;
 var init_config_operation_command = __esm({
   "src/config-operation-command.ts"() {
     "use strict";
     init_cjs_shims();
     import_apps6 = require("@odla-ai/apps");
-    import_node_path9 = require("path");
+    import_node_path10 = require("path");
     init_admin_ai_auth();
     init_version();
     init_config();
@@ -4360,7 +4412,7 @@ async function inspectConfig(options) {
     platform: cfg.platformUrl,
     scope: "app:config:read",
     token: options.token,
-    tokenFile: (0, import_node_path10.join)(cfg.rootDir, ".odla", "admin-token.local.json"),
+    tokenFile: (0, import_node_path11.join)(cfg.rootDir, ".odla", "admin-token.local.json"),
     rootDir: cfg.rootDir,
     email: options.email,
     open: options.open,
@@ -4489,13 +4541,13 @@ function studioSettingsUrl(reconciliation) {
 function quoteArg2(value2) {
   return `'${value2.replace(/'/g, `'\\''`)}'`;
 }
-var import_apps8, import_node_path10;
+var import_apps8, import_node_path11;
 var init_config_reconcile_command = __esm({
   "src/config-reconcile-command.ts"() {
     "use strict";
     init_cjs_shims();
     import_apps8 = require("@odla-ai/apps");
-    import_node_path10 = require("path");
+    import_node_path11 = require("path");
     init_admin_ai_auth();
     init_config();
     init_config_reconcile_digest();
@@ -4508,15 +4560,15 @@ var init_config_reconcile_command = __esm({
 // src/wrangler.ts
 function findWranglerConfig(rootDir) {
   for (const name of WRANGLER_CONFIG_FILES) {
-    const path = (0, import_node_path11.join)(rootDir, name);
-    if ((0, import_node_fs13.existsSync)(path)) return path;
+    const path = (0, import_node_path12.join)(rootDir, name);
+    if ((0, import_node_fs14.existsSync)(path)) return path;
   }
   return null;
 }
 function readWranglerConfig(path) {
   if (path.endsWith(".toml")) return null;
   try {
-    return JSON.parse(stripJsonComments((0, import_node_fs13.readFileSync)(path, "utf8")));
+    return JSON.parse(stripJsonComments((0, import_node_fs14.readFileSync)(path, "utf8")));
   } catch {
     return null;
   }
@@ -4620,14 +4672,14 @@ function wranglerBulkSecrets(run, opts) {
   ];
   return run("npx", args, { input: JSON.stringify(opts.secrets), cwd: opts.cwd });
 }
-var import_node_child_process2, import_node_fs13, import_node_path11, defaultRunner, WRANGLER_CONFIG_FILES;
+var import_node_child_process2, import_node_fs14, import_node_path12, defaultRunner, WRANGLER_CONFIG_FILES;
 var init_wrangler = __esm({
   "src/wrangler.ts"() {
     "use strict";
     init_cjs_shims();
     import_node_child_process2 = require("child_process");
-    import_node_fs13 = require("fs");
-    import_node_path11 = require("path");
+    import_node_fs14 = require("fs");
+    import_node_path12 = require("path");
     defaultRunner = (cmd, args, opts) => new Promise((resolvePromise, reject) => {
       const child = (0, import_node_child_process2.spawn)(cmd, args, { cwd: opts?.cwd, stdio: ["pipe", "pipe", "pipe"] });
       let stdout = "";
@@ -4686,10 +4738,10 @@ function wranglerWarnings(rootDir) {
   for (const { label, block } of blocks) {
     const assets = block.assets;
     if (assets?.directory) {
-      const dir = (0, import_node_path12.resolve)(rootDir, assets.directory);
-      if (dir === (0, import_node_path12.resolve)(rootDir)) {
+      const dir = (0, import_node_path13.resolve)(rootDir, assets.directory);
+      if (dir === (0, import_node_path13.resolve)(rootDir)) {
         warnings.push(`${label}assets.directory is the project root \u2014 point it at a dedicated build dir (wrangler dev fails with "spawn EBADF")`);
-      } else if ((0, import_node_fs14.existsSync)((0, import_node_path12.join)(dir, "node_modules"))) {
+      } else if ((0, import_node_fs15.existsSync)((0, import_node_path13.join)(dir, "node_modules"))) {
         warnings.push(`${label}assets.directory contains node_modules \u2014 wrangler dev's watcher will exhaust file descriptors`);
       }
     }
@@ -4724,13 +4776,13 @@ function o11yProjectWarnings(rootDir) {
     warnings.push("cannot verify o11y Worker instrumentation \u2014 add a parseable wrangler.jsonc/json config");
     return warnings;
   }
-  const main = typeof config.main === "string" ? (0, import_node_path12.resolve)(rootDir, config.main) : null;
-  if (!main || !(0, import_node_fs14.existsSync)(main)) {
+  const main = typeof config.main === "string" ? (0, import_node_path13.resolve)(rootDir, config.main) : null;
+  if (!main || !(0, import_node_fs15.existsSync)(main)) {
     warnings.push("cannot verify o11y Worker instrumentation \u2014 wrangler main is missing or unreadable");
   } else {
     let source = "";
     try {
-      source = (0, import_node_fs14.readFileSync)(main, "utf8");
+      source = (0, import_node_fs15.readFileSync)(main, "utf8");
     } catch {
     }
     if (!/\bwithObservability\b/.test(source)) {
@@ -4754,19 +4806,19 @@ function calendarProjectWarnings(rootDir) {
 }
 function readPackageJson(rootDir) {
   try {
-    return JSON.parse((0, import_node_fs14.readFileSync)((0, import_node_path12.join)(rootDir, "package.json"), "utf8"));
+    return JSON.parse((0, import_node_fs15.readFileSync)((0, import_node_path13.join)(rootDir, "package.json"), "utf8"));
   } catch {
     return null;
   }
 }
-var import_node_child_process3, import_node_fs14, import_node_path12, defaultExec;
+var import_node_child_process3, import_node_fs15, import_node_path13, defaultExec;
 var init_doctor_checks = __esm({
   "src/doctor-checks.ts"() {
     "use strict";
     init_cjs_shims();
     import_node_child_process3 = require("child_process");
-    import_node_fs14 = require("fs");
-    import_node_path12 = require("path");
+    import_node_fs15 = require("fs");
+    import_node_path13 = require("path");
     init_redact();
     init_local();
     init_wrangler();
@@ -5103,9 +5155,9 @@ var init_harness_options = __esm({
 // src/init.ts
 function initProject(options) {
   const out = options.stdout ?? console;
-  const rootDir = (0, import_node_path13.resolve)(options.rootDir ?? process.cwd());
-  const configPath = (0, import_node_path13.resolve)(rootDir, options.configPath ?? "odla.config.mjs");
-  if ((0, import_node_fs15.existsSync)(configPath) && !options.force) {
+  const rootDir = (0, import_node_path14.resolve)(options.rootDir ?? process.cwd());
+  const configPath = (0, import_node_path14.resolve)(rootDir, options.configPath ?? "odla.config.mjs");
+  if ((0, import_node_fs16.existsSync)(configPath) && !options.force) {
     throw new Error(`${configPath} already exists. Pass --force to overwrite.`);
   }
   if (!/^[a-z0-9][a-z0-9-]*$/.test(options.appId)) {
@@ -5121,20 +5173,20 @@ function initProject(options) {
     }
   }
   const aiProvider = options.aiProvider;
-  (0, import_node_fs15.mkdirSync)((0, import_node_path13.dirname)(configPath), { recursive: true });
-  (0, import_node_fs15.mkdirSync)((0, import_node_path13.resolve)(rootDir, "src/odla"), { recursive: true });
-  (0, import_node_fs15.mkdirSync)((0, import_node_path13.resolve)(rootDir, ".odla"), { recursive: true });
-  (0, import_node_fs15.writeFileSync)(configPath, configTemplate({ appId: options.appId, name: options.name, envs, services, aiProvider }));
-  writeIfMissing((0, import_node_path13.resolve)(rootDir, "src/odla/schema.mjs"), schemaTemplate());
-  writeIfMissing((0, import_node_path13.resolve)(rootDir, "src/odla/rules.mjs"), rulesTemplate());
+  (0, import_node_fs16.mkdirSync)((0, import_node_path14.dirname)(configPath), { recursive: true });
+  (0, import_node_fs16.mkdirSync)((0, import_node_path14.resolve)(rootDir, "src/odla"), { recursive: true });
+  (0, import_node_fs16.mkdirSync)((0, import_node_path14.resolve)(rootDir, ".odla"), { recursive: true });
+  (0, import_node_fs16.writeFileSync)(configPath, configTemplate({ appId: options.appId, name: options.name, envs, services, aiProvider }));
+  writeIfMissing((0, import_node_path14.resolve)(rootDir, "src/odla/schema.mjs"), schemaTemplate());
+  writeIfMissing((0, import_node_path14.resolve)(rootDir, "src/odla/rules.mjs"), rulesTemplate());
   ensureGitignore(rootDir);
   out.log(`created ${relativeDisplay(configPath, rootDir)}`);
   out.log("created src/odla/schema.mjs and src/odla/rules.mjs");
   out.log("updated .gitignore for local odla credentials");
 }
 function writeIfMissing(path, text3) {
-  if ((0, import_node_fs15.existsSync)(path)) return;
-  (0, import_node_fs15.writeFileSync)(path, text3);
+  if ((0, import_node_fs16.existsSync)(path)) return;
+  (0, import_node_fs16.writeFileSync)(path, text3);
 }
 function configTemplate(input) {
   const calendar = input.services.includes("calendar") ? `  calendar: {
@@ -5237,13 +5289,13 @@ function defaultKeyEnv(provider) {
 function relativeDisplay(path, rootDir) {
   return path.startsWith(rootDir) ? path.slice(rootDir.length + 1) : path;
 }
-var import_node_fs15, import_node_path13, import_apps9;
+var import_node_fs16, import_node_path14, import_apps9;
 var init_init = __esm({
   "src/init.ts"() {
     "use strict";
     init_cjs_shims();
-    import_node_fs15 = require("fs");
-    import_node_path13 = require("path");
+    import_node_fs16 = require("fs");
+    import_node_path14 = require("path");
     import_apps9 = require("@odla-ai/apps");
     init_local();
   }
@@ -5576,8 +5628,8 @@ function installSkill(options = {}) {
   const files = listFiles(sourceDir);
   if (files.length === 0) throw new Error(`no bundled skills found at ${sourceDir}`);
   const harnesses = normalizeHarnesses(options.harnesses, options.global === true);
-  const root = (0, import_node_path14.resolve)(options.dir ?? process.cwd());
-  const home = (0, import_node_path14.resolve)(options.homeDir ?? (0, import_node_os2.homedir)());
+  const root = (0, import_node_path15.resolve)(options.dir ?? process.cwd());
+  const home = (0, import_node_path15.resolve)(options.homeDir ?? (0, import_node_os3.homedir)());
   const plans = /* @__PURE__ */ new Map();
   const targets = /* @__PURE__ */ new Map();
   const rememberTarget = (harness, target) => {
@@ -5591,48 +5643,48 @@ function installSkill(options = {}) {
     plans.set(target, { target, content: content2, boundary, managedMerge });
   };
   const planSkillTree = (targetDir2, boundary = root) => {
-    for (const rel of files) plan((0, import_node_path14.join)(targetDir2, rel), (0, import_node_fs16.readFileSync)((0, import_node_path14.join)(sourceDir, rel), "utf8"), false, boundary);
+    for (const rel of files) plan((0, import_node_path15.join)(targetDir2, rel), (0, import_node_fs17.readFileSync)((0, import_node_path15.join)(sourceDir, rel), "utf8"), false, boundary);
   };
   let targetDir;
   if (options.global) {
-    const claudeRoot = (0, import_node_path14.join)(home, ".claude", "skills");
-    const codexRoot = (0, import_node_path14.resolve)(options.codexHomeDir ?? process.env.CODEX_HOME ?? (0, import_node_path14.join)(home, ".codex"), "skills");
+    const claudeRoot = (0, import_node_path15.join)(home, ".claude", "skills");
+    const codexRoot = (0, import_node_path15.resolve)(options.codexHomeDir ?? process.env.CODEX_HOME ?? (0, import_node_path15.join)(home, ".codex"), "skills");
     targetDir = harnesses[0] === "codex" ? codexRoot : claudeRoot;
     for (const harness of harnesses) {
       const skillRoot = harness === "claude" ? claudeRoot : codexRoot;
-      planSkillTree(skillRoot, harness === "claude" ? home : (0, import_node_path14.dirname)((0, import_node_path14.dirname)(codexRoot)));
+      planSkillTree(skillRoot, harness === "claude" ? home : (0, import_node_path15.dirname)((0, import_node_path15.dirname)(codexRoot)));
       rememberTarget(harness, skillRoot);
     }
   } else {
-    const sharedRoot = (0, import_node_path14.join)(root, ".agents", "skills");
+    const sharedRoot = (0, import_node_path15.join)(root, ".agents", "skills");
     planSkillTree(sharedRoot);
-    const claudeRoot = (0, import_node_path14.join)(root, ".claude", "skills");
+    const claudeRoot = (0, import_node_path15.join)(root, ".claude", "skills");
     targetDir = harnesses.includes("claude") ? claudeRoot : sharedRoot;
     for (const harness of harnesses) rememberTarget(harness, sharedRoot);
     if (harnesses.includes("claude")) {
       for (const skill of skillNames(files)) {
-        const canonical2 = (0, import_node_fs16.readFileSync)((0, import_node_path14.join)(sourceDir, skill, "SKILL.md"), "utf8");
-        plan((0, import_node_path14.join)(claudeRoot, skill, "SKILL.md"), claudeAdapter(skill, canonical2));
+        const canonical2 = (0, import_node_fs17.readFileSync)((0, import_node_path15.join)(sourceDir, skill, "SKILL.md"), "utf8");
+        plan((0, import_node_path15.join)(claudeRoot, skill, "SKILL.md"), claudeAdapter(skill, canonical2));
       }
       rememberTarget("claude", claudeRoot);
     }
     if (harnesses.includes("cursor")) {
-      const cursorRule = (0, import_node_path14.join)(root, ".cursor", "rules", "odla.mdc");
+      const cursorRule = (0, import_node_path15.join)(root, ".cursor", "rules", "odla.mdc");
       plan(cursorRule, CURSOR_RULE);
       rememberTarget("cursor", cursorRule);
     }
     if (harnesses.includes("agents")) {
-      const agentsFile = (0, import_node_path14.join)(root, "AGENTS.md");
+      const agentsFile = (0, import_node_path15.join)(root, "AGENTS.md");
       plan(agentsFile, managedFileContent(agentsFile, PROJECT_INSTRUCTIONS, options.force === true, root), true);
       rememberTarget("agents", agentsFile);
     }
     if (harnesses.includes("copilot")) {
-      const copilotFile = (0, import_node_path14.join)(root, ".github", "copilot-instructions.md");
+      const copilotFile = (0, import_node_path15.join)(root, ".github", "copilot-instructions.md");
       plan(copilotFile, managedFileContent(copilotFile, PROJECT_INSTRUCTIONS, options.force === true, root), true);
       rememberTarget("copilot", copilotFile);
     }
     if (harnesses.includes("gemini")) {
-      const geminiFile = (0, import_node_path14.join)(root, "GEMINI.md");
+      const geminiFile = (0, import_node_path15.join)(root, "GEMINI.md");
       plan(geminiFile, managedFileContent(geminiFile, PROJECT_INSTRUCTIONS, options.force === true, root), true);
       rememberTarget("gemini", geminiFile);
     }
@@ -5646,11 +5698,11 @@ function installSkill(options = {}) {
       conflicts.push(`${file.target} (redirected by symbolic link ${symlink})`);
       continue;
     }
-    if (!(0, import_node_fs16.existsSync)(file.target)) {
+    if (!(0, import_node_fs17.existsSync)(file.target)) {
       writtenPaths.add(file.target);
       continue;
     }
-    const current = (0, import_node_fs16.readFileSync)(file.target, "utf8");
+    const current = (0, import_node_fs17.readFileSync)(file.target, "utf8");
     if (current === file.content) {
       unchangedPaths.add(file.target);
     } else if (file.managedMerge || options.force) {
@@ -5667,9 +5719,9 @@ ${conflicts.map((f) => `  - ${f}`).join("\n")}`
     );
   }
   for (const file of plans.values()) {
-    if (!(0, import_node_fs16.existsSync)(file.target) || (0, import_node_fs16.readFileSync)(file.target, "utf8") !== file.content) {
-      (0, import_node_fs16.mkdirSync)((0, import_node_path14.dirname)(file.target), { recursive: true });
-      (0, import_node_fs16.writeFileSync)(file.target, file.content);
+    if (!(0, import_node_fs17.existsSync)(file.target) || (0, import_node_fs17.readFileSync)(file.target, "utf8") !== file.content) {
+      (0, import_node_fs17.mkdirSync)((0, import_node_path15.dirname)(file.target), { recursive: true });
+      (0, import_node_fs17.writeFileSync)(file.target, file.content);
     }
   }
   const skills = skillNames(files);
@@ -5688,7 +5740,7 @@ ${conflicts.map((f) => `  - ${f}`).join("\n")}`
   };
 }
 function pathsUnder(root, paths) {
-  return [...paths].map((path) => (0, import_node_path14.relative)(root, path)).filter((path) => path !== ".." && !path.startsWith(`..${import_node_path14.sep}`) && !(0, import_node_path14.isAbsolute)(path)).sort();
+  return [...paths].map((path) => (0, import_node_path15.relative)(root, path)).filter((path) => path !== ".." && !path.startsWith(`..${import_node_path15.sep}`) && !(0, import_node_path15.isAbsolute)(path)).sort();
 }
 function normalizeHarnesses(values, global) {
   const requested = values?.length ? values : ["claude"];
@@ -5710,9 +5762,9 @@ function normalizeHarnesses(values, global) {
 function managedFileContent(path, block, force, boundary) {
   const symlink = symlinkedComponent(boundary, path);
   if (symlink) throw new Error(`refusing to manage ${path}: symbolic link component ${symlink}`);
-  if (!(0, import_node_fs16.existsSync)(path)) return `${block}
+  if (!(0, import_node_fs17.existsSync)(path)) return `${block}
 `;
-  const current = (0, import_node_fs16.readFileSync)(path, "utf8");
+  const current = (0, import_node_fs17.readFileSync)(path, "utf8");
   const start = "<!-- odla-ai agent setup:start -->";
   const end = "<!-- odla-ai agent setup:end -->";
   const startAt = current.indexOf(start);
@@ -5733,15 +5785,15 @@ function managedFileContent(path, block, force, boundary) {
   return `${current.slice(0, startAt)}${block}${current.slice(afterEnd)}`;
 }
 function symlinkedComponent(boundary, target) {
-  const rel = (0, import_node_path14.relative)(boundary, target);
-  if (rel === ".." || rel.startsWith(`..${import_node_path14.sep}`) || (0, import_node_path14.isAbsolute)(rel)) {
+  const rel = (0, import_node_path15.relative)(boundary, target);
+  if (rel === ".." || rel.startsWith(`..${import_node_path15.sep}`) || (0, import_node_path15.isAbsolute)(rel)) {
     throw new Error(`agent setup target escapes its install root: ${target}`);
   }
   let current = boundary;
-  for (const part of rel.split(import_node_path14.sep).filter(Boolean)) {
-    current = (0, import_node_path14.join)(current, part);
+  for (const part of rel.split(import_node_path15.sep).filter(Boolean)) {
+    current = (0, import_node_path15.join)(current, part);
     try {
-      if ((0, import_node_fs16.lstatSync)(current).isSymbolicLink()) return current;
+      if ((0, import_node_fs17.lstatSync)(current).isSymbolicLink()) return current;
     } catch (error) {
       if (error.code !== "ENOENT") throw error;
     }
@@ -5752,26 +5804,26 @@ function skillNames(files) {
   return [...new Set(files.filter((file) => /(^|[\\/])SKILL\.md$/.test(file)).map((file) => file.split(/[\\/]/)[0]))].sort();
 }
 function listFiles(dir) {
-  if (!(0, import_node_fs16.existsSync)(dir)) return [];
+  if (!(0, import_node_fs17.existsSync)(dir)) return [];
   const results = [];
   const walk = (current) => {
-    for (const entry of (0, import_node_fs16.readdirSync)(current, { withFileTypes: true })) {
-      const path = (0, import_node_path14.join)(current, entry.name);
+    for (const entry of (0, import_node_fs17.readdirSync)(current, { withFileTypes: true })) {
+      const path = (0, import_node_path15.join)(current, entry.name);
       if (entry.isDirectory()) walk(path);
-      else results.push((0, import_node_path14.relative)(dir, path));
+      else results.push((0, import_node_path15.relative)(dir, path));
     }
   };
   walk(dir);
   return results.sort();
 }
-var import_node_fs16, import_node_os2, import_node_path14, import_node_url2, AGENT_HARNESSES;
+var import_node_fs17, import_node_os3, import_node_path15, import_node_url2, AGENT_HARNESSES;
 var init_skill = __esm({
   "src/skill.ts"() {
     "use strict";
     init_cjs_shims();
-    import_node_fs16 = require("fs");
-    import_node_os2 = require("os");
-    import_node_path14 = require("path");
+    import_node_fs17 = require("fs");
+    import_node_os3 = require("os");
+    import_node_path15 = require("path");
     import_node_url2 = require("url");
     init_skill_adapters();
     AGENT_HARNESSES = ["claude", "codex", "cursor", "copilot", "gemini", "agents"];
@@ -7322,8 +7374,8 @@ function rollup(graph, kind, options = {}) {
   for (const node of nodesOfKind(graph, kind)) {
     if (options.prefix && !node.name.startsWith(options.prefix)) continue;
     const key = node.name.split(separator).slice(0, depth).join(separator);
-    const list2 = groups.get(key);
-    if (list2) list2.push(node);
+    const list3 = groups.get(key);
+    if (list3) list3.push(node);
     else groups.set(key, [node]);
   }
   return [...groups].map(([prefix, nodes]) => ({
@@ -7348,7 +7400,7 @@ function dirname9(path) {
   const at = path.lastIndexOf("/");
   return at <= 0 ? "." : path.slice(0, at);
 }
-function join12(base, specifier) {
+function join13(base, specifier) {
   const parts = [];
   const segments = `${base === "." ? "" : `${base}/`}${specifier}`.split("/");
   for (const segment of segments) {
@@ -7360,7 +7412,7 @@ function join12(base, specifier) {
 }
 function resolveImport(fromPath, specifier, known) {
   if (!specifier.startsWith(".")) return null;
-  const base = join12(dirname9(fromPath), specifier);
+  const base = join13(dirname9(fromPath), specifier);
   const candidates = [
     base,
     base.replace(/\.js$/, ".ts"),
@@ -10286,8 +10338,8 @@ var init_code_runtime_config = __esm({
 // src/code-connect.ts
 async function codeConnect(options) {
   const cwd = options.cwd ?? process.cwd();
-  const configPath = (0, import_node_path15.resolve)(cwd, options.configPath);
-  const cfg = (0, import_node_fs17.existsSync)(configPath) ? await loadProjectConfig(configPath) : null;
+  const configPath = (0, import_node_path16.resolve)(cwd, options.configPath);
+  const cfg = (0, import_node_fs18.existsSync)(configPath) ? await loadProjectConfig(configPath) : null;
   const requestedAppId = options.appId?.trim();
   if (requestedAppId && !/^[a-z0-9][a-z0-9-]{1,62}$/.test(requestedAppId)) {
     throw new Error("--app-id must be a valid odla app id");
@@ -10316,7 +10368,7 @@ async function codeConnect(options) {
   const doFetch = options.fetch ?? fetch;
   const engine = await (options.selectEngine ?? selectContainerEngine)(options.engine ?? "auto");
   const hostPlatform = process.platform === "darwin" ? "macos" : "linux";
-  const hostName = (options.name ?? (0, import_node_os3.hostname)()).trim();
+  const hostName = (options.name ?? (0, import_node_os4.hostname)()).trim();
   if (!hostName || hostName.length > 120) throw new Error("--name must contain 1 to 120 characters");
   const repository = await inferGitHubRepository(cwd, options.readGitOrigin);
   const localSource = await (options.prepareLocalSource ?? prepareCodeLocalSource)(
@@ -10353,8 +10405,8 @@ async function codeConnect(options) {
       platform: hostPlatform,
       arch: process.arch,
       engines: [engine],
-      cpuCount: (0, import_node_os3.cpus)().length,
-      memoryBytes: (0, import_node_os3.totalmem)(),
+      cpuCount: (0, import_node_os4.cpus)().length,
+      memoryBytes: (0, import_node_os4.totalmem)(),
       source: descriptor2,
       images: {
         ready: true,
@@ -10451,14 +10503,14 @@ function apiFailure(action2, status, value2) {
 function record6(value2) {
   return value2 && typeof value2 === "object" && !Array.isArray(value2) ? value2 : null;
 }
-var import_node_fs17, import_node_os3, import_node_path15;
+var import_node_fs18, import_node_os4, import_node_path16;
 var init_code_connect = __esm({
   "src/code-connect.ts"() {
     "use strict";
     init_cjs_shims();
-    import_node_fs17 = require("fs");
-    import_node_os3 = require("os");
-    import_node_path15 = require("path");
+    import_node_fs18 = require("fs");
+    import_node_os4 = require("os");
+    import_node_path16 = require("path");
     init_node();
     init_admin_ai_auth();
     init_config();
@@ -10775,7 +10827,7 @@ function developerTokenStatus(context, parsed, now = Date.now()) {
   const cacheStatus = !cached?.token ? "missing" : cached.platform !== context.platform.value ? "other-platform" : (cached.expiresAt ?? 0) <= now + 6e4 ? "expired" : "valid";
   const source = clean3(
     stringOpt(parsed.options.token)
-  ) ? "flag" : clean3(import_node_process11.default.env.ODLA_DEV_TOKEN) ? "environment" : cacheStatus === "valid" ? "cache" : "missing";
+  ) ? "flag" : clean3(import_node_process12.default.env.ODLA_DEV_TOKEN) ? "environment" : cacheStatus === "valid" ? "cache" : "missing";
   return {
     source,
     cacheFile: context.cfg.local.tokenFile,
@@ -10786,12 +10838,12 @@ function clean3(value2) {
   const normalized = value2?.trim();
   return normalized || void 0;
 }
-var import_node_process11;
+var import_node_process12;
 var init_operator_credentials = __esm({
   "src/operator-credentials.ts"() {
     "use strict";
     init_cjs_shims();
-    import_node_process11 = __toESM(require("process"), 1);
+    import_node_process12 = __toESM(require("process"), 1);
     init_argv();
     init_local();
   }
@@ -11132,6 +11184,9 @@ Usage:
   odla-ai security run [target] --ack-redacted-source [--env dev] [--profile odla] [--fail-on high]
   odla-ai security run [target] --self --ack-redacted-source
   odla-ai provision [--live] [--config odla.config.mjs] [--email <odla-account>] [--request-grant] [--no-open] [--wait <seconds>] [--dry-run] [--push-secrets] [--rotate-o11y-token] [--write-dev-vars[=path]] [--yes]
+  odla-ai device enroll [--app <id>[,<id>...]] [--name <label>] [--capability <c>[,<c>...]] [--email <odla-account>] [--no-open] [--json]
+  odla-ai device list [--email <odla-account>] [--json]
+  odla-ai device revoke <device-id> [--email <odla-account>] [--json]
   odla-ai credentials list [--config odla.config.mjs] [--env dev] [--all] [--json]
   odla-ai credentials revoke <receipt-id> [--config odla.config.mjs] [--json]
   odla-ai smoke [--config odla.config.mjs] [--env dev] [--runtime] [--email <odla-account>] [--no-open]
@@ -11239,6 +11294,10 @@ Commands:
                stable status, incident, and report JSON to agents and CI.
   platform     Read canonical fleet health, releases, provider load/freshness,
                explicit unknowns, and next actions through a read-only grant.
+  device       Enrol THIS machine once, then stop asking. A human approves the
+               enrollment in the browser; from then on this terminal mints its
+               own short-lived credentials for the named projects with nobody's
+               attention, until the device expires or is revoked.
   provision    Register services, compose integrations, persist credentials, optionally push secrets.
                "provision --live --yes" initializes only the live instance of
                an existing sandbox app and enables every configured service;
@@ -12613,14 +12672,14 @@ function readPmProjectContext(rootDir) {
 function writePmProjectContext(rootDir, value2) {
   writePrivateJson(pmProjectContextFile(rootDir), { ...value2, selectedAt: (/* @__PURE__ */ new Date()).toISOString() });
 }
-var import_node_path16, pmProjectContextFile;
+var import_node_path17, pmProjectContextFile;
 var init_pm_project_context = __esm({
   "src/pm-project-context.ts"() {
     "use strict";
     init_cjs_shims();
-    import_node_path16 = require("path");
+    import_node_path17 = require("path");
     init_local();
-    pmProjectContextFile = (rootDir) => (0, import_node_path16.resolve)(rootDir, ".odla", "pm-project.local.json");
+    pmProjectContextFile = (rootDir) => (0, import_node_path17.resolve)(rootDir, ".odla", "pm-project.local.json");
   }
 });
@@ -14192,7 +14251,7 @@ async function provision(options) {
       await provisionIntegrationSeeds(doFetch, cfg.dbEndpoint, tenantId, dbKey, database.integrations, env, out);
     }
     if (cfg.services.includes("ai") && cfg.ai?.provider && cfg.ai.keyEnv) {
-      const key = import_node_process12.default.env[cfg.ai.keyEnv];
+      const key = import_node_process13.default.env[cfg.ai.keyEnv];
       if (key) {
         const secretName = cfg.ai.secretName ?? defaultSecretName(cfg.ai.provider);
         await (0, import_ai5.putSecret)({ endpoint: cfg.dbEndpoint, token, fetch: doFetch }, tenantId, secretName, key);
@@ -14231,14 +14290,14 @@ async function provision(options) {
     }
   }
 }
-var import_apps13, import_ai5, import_node_process12;
+var import_apps13, import_ai5, import_node_process13;
 var init_provision = __esm({
   "src/provision.ts"() {
     "use strict";
     init_cjs_shims();
     import_apps13 = require("@odla-ai/apps");
     import_ai5 = require("@odla-ai/ai");
-    import_node_process12 = __toESM(require("process"), 1);
+    import_node_process13 = __toESM(require("process"), 1);
     init_config();
     init_calendar();
     init_calendar_errors();
@@ -14364,6 +14423,7 @@ var init_surface = __esm({
       config: { diff: {}, plan: {}, apply: {} },
       context: { show: {}, list: {}, save: {}, remove: {} },
       credentials: { list: {}, revoke: {} },
+      device: { enroll: {}, list: {}, revoke: {} },
       // `watch`, `read`, `reply`, and `resolve` take a topic id from there on.
       discuss: {
         groups: {},
@@ -14432,7 +14492,7 @@ var init_surface = __esm({
 // src/record.ts
 function recordInvocation(parsed) {
-  const file = import_node_process13.default.env.ODLA_CLI_RECORD;
+  const file = import_node_process14.default.env.ODLA_CLI_RECORD;
   if (!file) return;
   try {
     const entry = {
@@ -14440,18 +14500,18 @@ function recordInvocation(parsed) {
       options: Object.entries(parsed.options).map(([name, value2]) => value2 === false ? `no-${name}` : name).sort()
     };
     if (!entry.path.length) return;
-    (0, import_node_fs18.appendFileSync)(file, `${JSON.stringify(entry)}
+    (0, import_node_fs19.appendFileSync)(file, `${JSON.stringify(entry)}
 `);
   } catch {
   }
 }
-var import_node_fs18, import_node_process13;
+var import_node_fs19, import_node_process14;
 var init_record = __esm({
   "src/record.ts"() {
     "use strict";
     init_cjs_shims();
-    import_node_fs18 = require("fs");
-    import_node_process13 = __toESM(require("process"), 1);
+    import_node_fs19 = require("fs");
+    import_node_process14 = __toESM(require("process"), 1);
     init_surface();
   }
 });
@@ -14486,6 +14546,119 @@ var init_advisory_output = __esm({
   }
 });
+// src/device-command.ts
+async function deviceCommand(parsed, deps) {
+  const action2 = parsed.positionals[1] ?? "";
+  const out = deps.stdout ?? console;
+  const doFetch = deps.fetch ?? fetch;
+  const cfg = await loadProjectConfig(stringOpt(parsed.options.config));
+  const json = parsed.options.json === true;
+  if (action2 === "enroll") return enroll(parsed, deps, cfg, doFetch, out, json);
+  if (action2 === "list") return list2(parsed, deps, cfg, doFetch, out, json);
+  if (action2 === "revoke") return revoke(parsed, deps, cfg, doFetch, out, json);
+  throw new Error('odla-ai device expects "enroll", "list", or "revoke"');
+}
+async function enroll(parsed, deps, cfg, doFetch, out, json) {
+  const name = stringOpt(parsed.options.name) ?? defaultDeviceName();
+  const apps = (stringOpt(parsed.options.app) ?? cfg.app.id).split(",").map((id2) => id2.trim()).filter(Boolean);
+  if (apps.length === 0) throw new Error("device enroll needs --app <id>[,<id>\u2026]");
+  const token = await scopedToken2(parsed, deps, cfg, doFetch, out, `odla CLI (enroll ${name})`);
+  const response2 = await doFetch(`${cfg.platformUrl}/registry/devices`, {
+    method: "POST",
+    headers: { authorization: `Bearer ${token}`, "content-type": "application/json" },
+    body: JSON.stringify({
+      name,
+      platform: import_node_process15.default.platform,
+      appIds: apps,
+      ...parsed.options.capability ? { capabilities: String(parsed.options.capability).split(",").map((c) => c.trim()).filter(Boolean) } : {}
+    })
+  });
+  const body = await response2.json().catch(() => ({}));
+  if (!response2.ok || !body.token || !body.device) {
+    throw new Error(`device enroll failed: ${body.error?.message ?? `registry returned ${response2.status}`} (${response2.status})`);
+  }
+  const path = deviceCredentialPath();
+  (0, import_node_fs20.mkdirSync)((0, import_node_path18.dirname)(path), { recursive: true });
+  (0, import_node_fs20.writeFileSync)(path, JSON.stringify({
+    token: body.token,
+    platform: cfg.platformUrl.replace(/\/$/, ""),
+    deviceId: body.device.deviceId,
+    name
+  }, null, 2));
+  (0, import_node_fs20.chmodSync)(path, 384);
+  out.error(`device: enrolled "${name}" for ${body.device.appIds.join(", ")}; credential written to ${path}`);
+  out.error("device: this terminal will mint its own credentials from now on \u2014 no further approvals.");
+  if (json) {
+    out.log(JSON.stringify({ deviceId: body.device.deviceId, name, appIds: body.device.appIds, expiresAt: body.device.expiresAt }, null, 2));
+  }
+}
+async function list2(parsed, deps, cfg, doFetch, out, json) {
+  const token = await scopedToken2(parsed, deps, cfg, doFetch, out, "odla CLI (device list)");
+  const response2 = await doFetch(`${cfg.platformUrl}/registry/devices`, {
+    headers: { authorization: `Bearer ${token}` }
+  });
+  const body = await response2.json().catch(() => ({}));
+  if (!response2.ok || !body.devices) {
+    throw new Error(`device list failed: ${body.error?.message ?? `registry returned ${response2.status}`} (${response2.status})`);
+  }
+  if (json) return out.log(JSON.stringify(body.devices, null, 2));
+  if (body.devices.length === 0) return out.log("no enrolled devices");
+  for (const device of body.devices) {
+    const state2 = device.revokedAt ? "revoked" : device.expiresAt <= Date.now() ? "expired" : "active";
+    out.log(`${device.deviceId}  ${state2.padEnd(7)}  ${device.name}  [${device.appIds.join(", ")}]`);
+  }
+}
+async function revoke(parsed, deps, cfg, doFetch, out, json) {
+  const deviceId = parsed.positionals[2];
+  if (!deviceId) throw new Error("device revoke needs the device id from `odla-ai device list`");
+  const token = await scopedToken2(parsed, deps, cfg, doFetch, out, "odla CLI (device revoke)");
+  const response2 = await doFetch(`${cfg.platformUrl}/registry/devices/${encodeURIComponent(deviceId)}/revoke`, {
+    method: "POST",
+    headers: { authorization: `Bearer ${token}` }
+  });
+  if (!response2.ok) {
+    const body = await response2.json().catch(() => ({}));
+    throw new Error(`device revoke failed: ${body.error?.message ?? `registry returned ${response2.status}`} (${response2.status})`);
+  }
+  out.error(`device: revoked ${deviceId}; every credential it minted is revoked with it`);
+  if (json) out.log(JSON.stringify({ deviceId, revoked: true }, null, 2));
+}
+async function scopedToken2(parsed, deps, cfg, doFetch, out, label) {
+  const { credentials } = await resolveOperatorContext(parsed, { allowMissingConfig: true });
+  const scopedTokenFile = credentials.scopedTokenFile;
+  return getScopedPlatformToken({
+    platform: cfg.platformUrl,
+    scope: "app:device:enroll",
+    email: stringOpt(parsed.options.email),
+    label,
+    fetch: doFetch,
+    stdout: out,
+    open: parsed.options.open === false ? false : parsed.options.open === true ? true : void 0,
+    openApprovalUrl: deps.openUrl,
+    rootDir: cfg.rootDir,
+    tokenFile: scopedTokenFile,
+    ...stringOpt(parsed.options.token) ? { token: stringOpt(parsed.options.token) } : {}
+  });
+}
+function defaultDeviceName() {
+  return `${import_node_process15.default.env.HOSTNAME ?? import_node_process15.default.env.HOST ?? "machine"}-${import_node_process15.default.platform}`;
+}
+var import_node_fs20, import_node_path18, import_node_process15;
+var init_device_command = __esm({
+  "src/device-command.ts"() {
+    "use strict";
+    init_cjs_shims();
+    import_node_fs20 = require("fs");
+    import_node_path18 = require("path");
+    import_node_process15 = __toESM(require("process"), 1);
+    init_argv();
+    init_admin_ai_auth();
+    init_device_session();
+    init_config();
+    init_operator_context();
+  }
+});
 // src/runbook-actions.ts
 async function call(ctx, method, path, body) {
   const res = await ctx.doFetch(`${ctx.platformUrl.replace(/\/$/, "")}/registry/pm${path}`, {
@@ -14532,7 +14705,7 @@ async function bySlug(ctx, slug) {
 function readBody(file, inline) {
   if (inline !== void 0) return inline;
   if (file === void 0) throw new Error("supply the new text with --file <path>, --file - (stdin), or --body");
-  return (0, import_node_fs19.readFileSync)(file === "-" ? 0 : file, "utf8");
+  return (0, import_node_fs21.readFileSync)(file === "-" ? 0 : file, "utf8");
 }
 async function runbookList(ctx, all, query) {
   const params = new URLSearchParams();
@@ -14621,12 +14794,12 @@ async function runbookRemove(ctx, slug) {
   await call(ctx, "DELETE", `/runbook/${encodeURIComponent(runbook.id)}`);
   ctx.out.log(`removed ${slug}`);
 }
-var import_node_fs19, PLATFORM_SCOPE, stamp;
+var import_node_fs21, PLATFORM_SCOPE, stamp;
 var init_runbook_actions = __esm({
   "src/runbook-actions.ts"() {
     "use strict";
     init_cjs_shims();
-    import_node_fs19 = require("fs");
+    import_node_fs21 = require("fs");
     init_version();
     init_runbook_requires();
     PLATFORM_SCOPE = "$platform";
@@ -14659,12 +14832,12 @@ function parseRunbook(text3, slug) {
   };
 }
 function readRunbookDir(dir) {
-  if (!(0, import_node_fs20.statSync)(dir, { throwIfNoEntry: false })?.isDirectory()) throw new Error(`not a directory: ${dir}`);
-  const files = (0, import_node_fs20.readdirSync)(dir).filter((f) => f.endsWith(".md")).sort();
+  if (!(0, import_node_fs22.statSync)(dir, { throwIfNoEntry: false })?.isDirectory()) throw new Error(`not a directory: ${dir}`);
+  const files = (0, import_node_fs22.readdirSync)(dir).filter((f) => f.endsWith(".md")).sort();
   if (!files.length) throw new Error(`no .md files in ${dir}`);
   return files.map((file) => {
-    const slug = (0, import_node_path17.basename)(file, ".md");
-    const parsed = parseRunbook((0, import_node_fs20.readFileSync)((0, import_node_path17.join)(dir, file), "utf8"), slug);
+    const slug = (0, import_node_path19.basename)(file, ".md");
+    const parsed = parseRunbook((0, import_node_fs22.readFileSync)((0, import_node_path19.join)(dir, file), "utf8"), slug);
     return { file, slug, ...parsed, words: parsed.body.split(/\s+/).filter(Boolean).length };
   });
 }
@@ -14734,13 +14907,13 @@ async function upsert(ctx, r, visibility) {
   );
   return "updated";
 }
-var import_node_fs20, import_node_path17;
+var import_node_fs22, import_node_path19;
 var init_runbook_import = __esm({
   "src/runbook-import.ts"() {
     "use strict";
     init_cjs_shims();
-    import_node_fs20 = require("fs");
-    import_node_path17 = require("path");
+    import_node_fs22 = require("fs");
+    import_node_path19 = require("path");
     init_runbook_actions();
   }
 });
@@ -14918,10 +15091,10 @@ ${body.split("\n").map((line2) => `+${line2}`).join("\n")}
 }
 function manifestLabeller(root) {
   return (workspace) => {
-    const manifest = (0, import_node_path18.join)(root, workspace, "package.json");
-    if (!(0, import_node_fs21.existsSync)(manifest)) return void 0;
+    const manifest = (0, import_node_path20.join)(root, workspace, "package.json");
+    if (!(0, import_node_fs23.existsSync)(manifest)) return void 0;
     try {
-      const name = JSON.parse((0, import_node_fs21.readFileSync)(manifest, "utf8")).name;
+      const name = JSON.parse((0, import_node_fs23.readFileSync)(manifest, "utf8")).name;
       return typeof name === "string" ? name : void 0;
     } catch {
       return void 0;
@@ -14987,7 +15160,7 @@ function report4(ctx, impacts) {
 async function runbookImpact(ctx, options, deps = {}) {
   const cwd = deps.cwd ?? process.cwd();
   const runGit = deps.runGit ?? gitRunner(cwd);
-  const read3 = deps.readRepoFile ?? ((path) => (0, import_node_fs21.readFileSync)((0, import_node_path18.join)(cwd, path), "utf8"));
+  const read3 = deps.readRepoFile ?? ((path) => (0, import_node_fs23.readFileSync)((0, import_node_path20.join)(cwd, path), "utf8"));
   const surfaces = changedSurfaces(collectDiff(runGit, options.base, read3), manifestLabeller(cwd));
   if (!surfaces.length) {
     return ctx.out.log(
@@ -14998,14 +15171,14 @@ async function runbookImpact(ctx, options, deps = {}) {
   if (ctx.json) return ctx.out.log(JSON.stringify({ base: options.base, impacts }, null, 2));
   report4(ctx, impacts);
 }
-var import_node_child_process6, import_node_fs21, import_node_path18, SOURCE3, editHint;
+var import_node_child_process6, import_node_fs23, import_node_path20, SOURCE3, editHint;
 var init_runbook_impact = __esm({
   "src/runbook-impact.ts"() {
     "use strict";
     init_cjs_shims();
     import_node_child_process6 = require("child_process");
-    import_node_fs21 = require("fs");
-    import_node_path18 = require("path");
+    import_node_fs23 = require("fs");
+    import_node_path20 = require("path");
     init_runbook_impact_scan();
     init_runbook_actions();
     SOURCE3 = /\.(ts|tsx|js|jsx|mts|cts)$/;
@@ -15151,7 +15324,7 @@ var init_runbook_search_command = __esm({
 });
 // src/runbook-editor.ts
-function resolveEditor(env = import_node_process14.default.env) {
+function resolveEditor(env = import_node_process16.default.env) {
   for (const name of EDITOR_ENV) {
     const value2 = env[name];
     if (value2 && value2.trim()) return value2.trim();
@@ -15165,8 +15338,8 @@ function defaultRun(command, path) {
   return result.status ?? 0;
 }
 function editText(initial, slug, deps = {}) {
-  const env = deps.env ?? import_node_process14.default.env;
-  const interactive = deps.interactive ?? (() => Boolean(import_node_process14.default.stdin.isTTY));
+  const env = deps.env ?? import_node_process16.default.env;
+  const interactive = deps.interactive ?? (() => Boolean(import_node_process16.default.stdin.isTTY));
   const editor = resolveEditor(env);
   if (!editor)
     throw new Error(
@@ -15174,28 +15347,28 @@ function editText(initial, slug, deps = {}) {
     );
   if (!interactive())
     throw new Error(`cannot open an editor without a terminal \u2014 pass --file <path> or --body "\u2026" instead`);
-  const dir = (0, import_node_fs22.mkdtempSync)((0, import_node_path19.join)((0, import_node_os4.tmpdir)(), "odla-runbook-"));
-  const file = (0, import_node_path19.join)(dir, `${slug}.md`);
+  const dir = (0, import_node_fs24.mkdtempSync)((0, import_node_path21.join)((0, import_node_os5.tmpdir)(), "odla-runbook-"));
+  const file = (0, import_node_path21.join)(dir, `${slug}.md`);
   try {
-    (0, import_node_fs22.writeFileSync)(file, initial, { mode: 384 });
+    (0, import_node_fs24.writeFileSync)(file, initial, { mode: 384 });
     const code = defaultRunOrInjected(deps)(editor, file);
     if (code !== 0) throw new Error(`editor "${editor}" exited with ${code}; nothing was written`);
-    const edited = (0, import_node_fs22.readFileSync)(file, "utf8");
+    const edited = (0, import_node_fs24.readFileSync)(file, "utf8");
     return edited === initial ? null : edited;
   } finally {
-    (0, import_node_fs22.rmSync)(dir, { recursive: true, force: true });
+    (0, import_node_fs24.rmSync)(dir, { recursive: true, force: true });
   }
 }
-var import_node_child_process7, import_node_fs22, import_node_os4, import_node_path19, import_node_process14, EDITOR_ENV, defaultRunOrInjected;
+var import_node_child_process7, import_node_fs24, import_node_os5, import_node_path21, import_node_process16, EDITOR_ENV, defaultRunOrInjected;
 var init_runbook_editor = __esm({
   "src/runbook-editor.ts"() {
     "use strict";
     init_cjs_shims();
     import_node_child_process7 = require("child_process");
-    import_node_fs22 = require("fs");
-    import_node_os4 = require("os");
-    import_node_path19 = require("path");
-    import_node_process14 = __toESM(require("process"), 1);
+    import_node_fs24 = require("fs");
+    import_node_os5 = require("os");
+    import_node_path21 = require("path");
+    import_node_process16 = __toESM(require("process"), 1);
     EDITOR_ENV = ["ODLA_EDITOR", "VISUAL", "EDITOR"];
     defaultRunOrInjected = (deps) => deps.run ?? defaultRun;
   }
@@ -15590,9 +15763,9 @@ async function runHostedSecurity(options) {
   const appId = selfAudit ? "odla-ai" : cfg.app.id;
   const env = selfAudit ? "prod" : selectEnv(options.env, cfg.envs, cfg.configPath, cfg.rootDir);
   const platform = options.platform ?? cfg?.platformUrl ?? "https://odla.ai";
-  const target = (0, import_node_path20.resolve)(options.target ?? cfg?.rootDir ?? ".");
-  const output = (0, import_node_path20.resolve)(options.out ?? (0, import_node_path20.resolve)(target, ".odla/security/hosted"));
-  const outputRelative = (0, import_node_path20.relative)(target, output).split(import_node_path20.sep).join("/");
+  const target = (0, import_node_path22.resolve)(options.target ?? cfg?.rootDir ?? ".");
+  const output = (0, import_node_path22.resolve)(options.out ?? (0, import_node_path22.resolve)(target, ".odla/security/hosted"));
+  const outputRelative = (0, import_node_path22.relative)(target, output).split(import_node_path22.sep).join("/");
   if (!outputRelative) throw new Error("Hosted security output cannot be the repository root");
   const profile = profileFor(options.profile ?? "odla", options.maxHuntTasks ?? 12);
   const tokenRequest = {
@@ -15604,7 +15777,7 @@ async function runHostedSecurity(options) {
   };
   const token = await injectedToken(options, tokenRequest);
   const snapshot = await (0, import_node3.snapshotDirectory)(target, {
-    exclude: !outputRelative.startsWith("../") && !(0, import_node_path20.isAbsolute)(outputRelative) ? [outputRelative] : []
+    exclude: !outputRelative.startsWith("../") && !(0, import_node_path22.isAbsolute)(outputRelative) ? [outputRelative] : []
   });
   const hosted = await (0, import_security.createPlatformSecurityReasoners)({
     platform,
@@ -15622,7 +15795,7 @@ async function runHostedSecurity(options) {
   });
   const harness = (0, import_security.createSecurityHarness)({
     profile,
-    store: new import_node3.FileRunStore((0, import_node_path20.resolve)(output, "state")),
+    store: new import_node3.FileRunStore((0, import_node_path22.resolve)(output, "state")),
     discoveryReasoner: hosted.discoveryReasoner,
     validationReasoner: hosted.validationReasoner,
     policy: {
@@ -15646,7 +15819,7 @@ async function runHostedSecurity(options) {
 function selectEnv(requested, declared, configPath, rootDir) {
   const env = requested ?? (declared.includes("dev") ? "dev" : declared[0]);
   if (!env || !declared.includes(env)) {
-    const shown = (0, import_node_path20.relative)(rootDir, configPath) || configPath;
+    const shown = (0, import_node_path22.relative)(rootDir, configPath) || configPath;
     throw new Error(`env "${env ?? ""}" is not declared in ${shown}`);
   }
   return env;
@@ -15675,17 +15848,17 @@ function printSummary(out, appId, env, run, report5, output) {
   out.log(`  coverage: ${report5.coverageStatus} ${complete}/${report5.coverage.length} blocked=${report5.metrics.blockedCells} shallow=${report5.metrics.shallowCells} unscheduled=${report5.metrics.unscheduledCells} budget_exhausted=${report5.metrics.budgetExhaustedCells}`);
   if (report5.callBudget) out.log(`  calls: discovery=${formatBudget(report5.callBudget.discovery)} validation=${formatBudget(report5.callBudget.validation)}`);
   out.log(`  findings: confirmed=${report5.metrics.confirmed} needs_reproduction=${report5.metrics.needsReproduction} candidates=${report5.metrics.candidates}`);
-  out.log(`  report: ${(0, import_node_path20.resolve)(output, "REPORT.md")}`);
+  out.log(`  report: ${(0, import_node_path22.resolve)(output, "REPORT.md")}`);
 }
 function formatBudget(usage) {
   return usage ? `${usage.usedCalls}/${usage.maxCalls} skipped=${usage.skippedCalls}` : "caller-managed";
 }
-var import_node_path20, import_security, import_node3;
+var import_node_path22, import_security, import_node3;
 var init_security = __esm({
   "src/security.ts"() {
     "use strict";
     init_cjs_shims();
-    import_node_path20 = require("path");
+    import_node_path22 = require("path");
     import_security = require("@odla-ai/security");
     import_node3 = require("@odla-ai/security/node");
     init_config();
@@ -16219,6 +16392,10 @@ async function dispatchCli(argv2, dependencies) {
     await contextCommand(parsed, runtime);
     return;
   }
+  if (command === "device") {
+    await deviceCommand(parsed, runtime);
+    return;
+  }
   if (command === "credentials") {
     await credentialCommand(parsed, runtime);
     return;
@@ -16381,6 +16558,7 @@ var init_cli = __esm({
     init_record();
     init_advisory_output();
     init_cached_credential();
+    init_device_command();
     init_redact();
     init_runbook_command();
     init_security_command();