@odla-ai/cli 0.36.1 → 0.37.0

package/dist/bin.cjs

@@ -838,6 +838,7 @@ var init_admin_ai_auth = __esm({
       "app:config:write": "apply or inspect one revision-bound configuration operation for an app you own",
       "platform:runbook:write": "read and edit all of odla's operational runbooks, including admin-visible content",
       "app:device:enroll": "enrol this machine so it can mint its own short-lived credentials without asking you again",
+      "platform:device:enroll:extended": "enrol this machine with a credential that outlives the seven-day owner ceiling \u2014 a durable secret on a machine you are vouching for",
       "platform:ai:policy:write": "change System AI model routing",
       "platform:ai:policy:read": "read System AI model routing",
       "platform:ai:credential:write": "replace a stored AI provider key",
@@ -11184,7 +11185,7 @@ Usage:
   odla-ai security run [target] --ack-redacted-source [--env dev] [--profile odla] [--fail-on high]
   odla-ai security run [target] --self --ack-redacted-source
   odla-ai provision [--live] [--config odla.config.mjs] [--email <odla-account>] [--request-grant] [--no-open] [--wait <seconds>] [--dry-run] [--push-secrets] [--rotate-o11y-token] [--write-dev-vars[=path]] [--yes]
-  odla-ai device enroll [--app <id>[,<id>...]] [--name <label>] [--capability <c>[,<c>...]] [--email <odla-account>] [--no-open] [--json]
+  odla-ai device enroll [--app <id>[,<id>...]] [--name <label>] [--capability <c>[,<c>...]] [--device-ttl <30d|6w|2y|forever>] [--email <odla-account>] [--no-open] [--json]
   odla-ai device list [--email <odla-account>] [--json]
   odla-ai device revoke <device-id> [--email <odla-account>] [--json]
   odla-ai credentials list [--config odla.config.mjs] [--env dev] [--all] [--json]
@@ -14546,6 +14547,31 @@ var init_advisory_output = __esm({
   }
 });
 
+// src/device-ttl.ts
+function parseDeviceTtl(raw) {
+  if (raw === void 0 || raw === true) return void 0;
+  const text3 = String(raw).trim().toLowerCase();
+  if (!text3) return void 0;
+  if (text3 === "forever" || text3 === "never") return 100 * 365 * DAY_MS;
+  const match = /^(\d+)\s*([dwy])$/.exec(text3);
+  if (!match) {
+    throw new Error(
+      `--device-ttl expects a duration like 30d, 6w, 2y, or "forever" (got "${raw}")`
+    );
+  }
+  return Number(match[1]) * UNITS[match[2]];
+}
+var OWNER_DEVICE_TTL_MS, DAY_MS, UNITS;
+var init_device_ttl = __esm({
+  "src/device-ttl.ts"() {
+    "use strict";
+    init_cjs_shims();
+    OWNER_DEVICE_TTL_MS = 7 * 24 * 60 * 60 * 1e3;
+    DAY_MS = 24 * 60 * 60 * 1e3;
+    UNITS = { d: DAY_MS, w: 7 * DAY_MS, y: 365 * DAY_MS };
+  }
+});
+
 // src/device-command.ts
 async function deviceCommand(parsed, deps) {
   const action2 = parsed.positionals[1] ?? "";
@@ -14562,7 +14588,17 @@ async function enroll(parsed, deps, cfg, doFetch, out, json) {
   const name = stringOpt(parsed.options.name) ?? defaultDeviceName();
   const apps = (stringOpt(parsed.options.app) ?? cfg.app.id).split(",").map((id2) => id2.trim()).filter(Boolean);
   if (apps.length === 0) throw new Error("device enroll needs --app <id>[,<id>\u2026]");
-  const token = await scopedToken2(parsed, deps, cfg, doFetch, out, `odla CLI (enroll ${name})`);
+  const deviceTtlMs = parseDeviceTtl(parsed.options["device-ttl"]);
+  const extended = deviceTtlMs !== void 0 && deviceTtlMs > OWNER_DEVICE_TTL_MS;
+  const token = await scopedToken2(
+    parsed,
+    deps,
+    cfg,
+    doFetch,
+    out,
+    `odla CLI (enroll ${name})`,
+    extended ? "platform:device:enroll:extended" : "app:device:enroll"
+  );
   const response2 = await doFetch(`${cfg.platformUrl}/registry/devices`, {
     method: "POST",
     headers: { authorization: `Bearer ${token}`, "content-type": "application/json" },
@@ -14570,7 +14606,8 @@ async function enroll(parsed, deps, cfg, doFetch, out, json) {
       name,
       platform: import_node_process15.default.platform,
       appIds: apps,
-      ...parsed.options.capability ? { capabilities: String(parsed.options.capability).split(",").map((c) => c.trim()).filter(Boolean) } : {}
+      ...parsed.options.capability ? { capabilities: String(parsed.options.capability).split(",").map((c) => c.trim()).filter(Boolean) } : {},
+      ...deviceTtlMs === void 0 ? {} : { deviceTtlMs }
     })
   });
   const body = await response2.json().catch(() => ({}));
@@ -14623,12 +14660,12 @@ async function revoke(parsed, deps, cfg, doFetch, out, json) {
   out.error(`device: revoked ${deviceId}; every credential it minted is revoked with it`);
   if (json) out.log(JSON.stringify({ deviceId, revoked: true }, null, 2));
 }
-async function scopedToken2(parsed, deps, cfg, doFetch, out, label) {
+async function scopedToken2(parsed, deps, cfg, doFetch, out, label, scope = "app:device:enroll") {
   const { credentials } = await resolveOperatorContext(parsed, { allowMissingConfig: true });
   const scopedTokenFile = credentials.scopedTokenFile;
   return getScopedPlatformToken({
     platform: cfg.platformUrl,
-    scope: "app:device:enroll",
+    scope,
     email: stringOpt(parsed.options.email),
     label,
     fetch: doFetch,
@@ -14648,6 +14685,7 @@ var init_device_command = __esm({
   "src/device-command.ts"() {
     "use strict";
     init_cjs_shims();
+    init_device_ttl();
     import_node_fs20 = require("fs");
     import_node_path18 = require("path");
     import_node_process15 = __toESM(require("process"), 1);