@odla-ai/cli 0.36.0 → 0.37.0

package/dist/{cli-BN6WLH5O.js → cli-QR44X5IB.js}

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import {
   runCli
-} from "./chunk-DBZQIMES.js";
+} from "./chunk-OWTIDSL5.js";
 import {
   exitCodeFor
 } from "./chunk-UKLSRQ5J.js";
@@ -9,4 +9,4 @@ export {
   exitCodeFor,
   runCli
 };
-//# sourceMappingURL=cli-BN6WLH5O.js.map
+//# sourceMappingURL=cli-QR44X5IB.js.map

package/dist/index.cjs

@@ -287,9 +287,10 @@ async function mintDeviceSession(platformUrl, credential2, doFetch) {
   });
   const body = await response2.json().catch(() => ({}));
   if (!response2.ok || typeof body.token !== "string") {
-    const detail = body.error?.message ?? `registry returned ${response2.status}`;
+    const revocable = response2.status === 401 || response2.status === 403 || response2.status === 404;
+    const detail = body.error?.message ?? (response2.ok ? `registry returned ${response2.status} with no session token` : `registry returned ${response2.status}`);
     throw new Error(
-      `device session failed: ${detail} (${response2.status}) \u2014 if this machine's enrollment was revoked or has expired, enroll it again in Studio`
+      `device session failed: ${detail} (${response2.status})` + (revocable ? " \u2014 if this machine's enrollment was revoked or has expired, enroll it again in Studio" : "")
     );
   }
   return { token: body.token, expiresAt: body.expiresAt ?? Date.now() };
@@ -637,6 +638,7 @@ var SCOPE_PURPOSE = {
   "app:config:write": "apply or inspect one revision-bound configuration operation for an app you own",
   "platform:runbook:write": "read and edit all of odla's operational runbooks, including admin-visible content",
   "app:device:enroll": "enrol this machine so it can mint its own short-lived credentials without asking you again",
+  "platform:device:enroll:extended": "enrol this machine with a credential that outlives the seven-day owner ceiling \u2014 a durable secret on a machine you are vouching for",
   "platform:ai:policy:write": "change System AI model routing",
   "platform:ai:policy:read": "read System AI model routing",
   "platform:ai:credential:write": "replace a stored AI provider key",
@@ -10413,7 +10415,7 @@ Usage:
   odla-ai security run [target] --ack-redacted-source [--env dev] [--profile odla] [--fail-on high]
   odla-ai security run [target] --self --ack-redacted-source
   odla-ai provision [--live] [--config odla.config.mjs] [--email <odla-account>] [--request-grant] [--no-open] [--wait <seconds>] [--dry-run] [--push-secrets] [--rotate-o11y-token] [--write-dev-vars[=path]] [--yes]
-  odla-ai device enroll [--app <id>[,<id>...]] [--name <label>] [--capability <c>[,<c>...]] [--email <odla-account>] [--no-open] [--json]
+  odla-ai device enroll [--app <id>[,<id>...]] [--name <label>] [--capability <c>[,<c>...]] [--device-ttl <30d|6w|2y|forever>] [--email <odla-account>] [--no-open] [--json]
   odla-ai device list [--email <odla-account>] [--json]
   odla-ai device revoke <device-id> [--email <odla-account>] [--json]
   odla-ai credentials list [--config odla.config.mjs] [--env dev] [--all] [--json]
@@ -13504,6 +13506,24 @@ function renderAdvisories(out, advisories, env = process.env) {
   }
 }
 
+// src/device-ttl.ts
+var OWNER_DEVICE_TTL_MS = 7 * 24 * 60 * 60 * 1e3;
+var DAY_MS = 24 * 60 * 60 * 1e3;
+var UNITS = { d: DAY_MS, w: 7 * DAY_MS, y: 365 * DAY_MS };
+function parseDeviceTtl(raw) {
+  if (raw === void 0 || raw === true) return void 0;
+  const text3 = String(raw).trim().toLowerCase();
+  if (!text3) return void 0;
+  if (text3 === "forever" || text3 === "never") return 100 * 365 * DAY_MS;
+  const match = /^(\d+)\s*([dwy])$/.exec(text3);
+  if (!match) {
+    throw new Error(
+      `--device-ttl expects a duration like 30d, 6w, 2y, or "forever" (got "${raw}")`
+    );
+  }
+  return Number(match[1]) * UNITS[match[2]];
+}
+
 // src/device-command.ts
 var import_node_fs18 = require("fs");
 var import_node_path17 = require("path");
@@ -13523,7 +13543,17 @@ async function enroll(parsed, deps, cfg, doFetch, out, json) {
   const name = stringOpt(parsed.options.name) ?? defaultDeviceName();
   const apps = (stringOpt(parsed.options.app) ?? cfg.app.id).split(",").map((id2) => id2.trim()).filter(Boolean);
   if (apps.length === 0) throw new Error("device enroll needs --app <id>[,<id>\u2026]");
-  const token = await scopedToken2(parsed, deps, cfg, doFetch, out, `odla CLI (enroll ${name})`);
+  const deviceTtlMs = parseDeviceTtl(parsed.options["device-ttl"]);
+  const extended = deviceTtlMs !== void 0 && deviceTtlMs > OWNER_DEVICE_TTL_MS;
+  const token = await scopedToken2(
+    parsed,
+    deps,
+    cfg,
+    doFetch,
+    out,
+    `odla CLI (enroll ${name})`,
+    extended ? "platform:device:enroll:extended" : "app:device:enroll"
+  );
   const response2 = await doFetch(`${cfg.platformUrl}/registry/devices`, {
     method: "POST",
     headers: { authorization: `Bearer ${token}`, "content-type": "application/json" },
@@ -13531,7 +13561,8 @@ async function enroll(parsed, deps, cfg, doFetch, out, json) {
       name,
       platform: import_node_process15.default.platform,
       appIds: apps,
-      ...parsed.options.capability ? { capabilities: String(parsed.options.capability).split(",").map((c) => c.trim()).filter(Boolean) } : {}
+      ...parsed.options.capability ? { capabilities: String(parsed.options.capability).split(",").map((c) => c.trim()).filter(Boolean) } : {},
+      ...deviceTtlMs === void 0 ? {} : { deviceTtlMs }
     })
   });
   const body = await response2.json().catch(() => ({}));
@@ -13584,12 +13615,12 @@ async function revoke(parsed, deps, cfg, doFetch, out, json) {
   out.error(`device: revoked ${deviceId}; every credential it minted is revoked with it`);
   if (json) out.log(JSON.stringify({ deviceId, revoked: true }, null, 2));
 }
-async function scopedToken2(parsed, deps, cfg, doFetch, out, label) {
+async function scopedToken2(parsed, deps, cfg, doFetch, out, label, scope = "app:device:enroll") {
   const { credentials } = await resolveOperatorContext(parsed, { allowMissingConfig: true });
   const scopedTokenFile = credentials.scopedTokenFile;
   return getScopedPlatformToken({
     platform: cfg.platformUrl,
-    scope: "app:device:enroll",
+    scope,
     email: stringOpt(parsed.options.email),
     label,
     fetch: doFetch,