@odla-ai/cli 0.36.1 → 0.37.0

package/dist/{cli-BFGY7F6X.js → cli-QR44X5IB.js}

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import {
   runCli
-} from "./chunk-4QJ5NS64.js";
+} from "./chunk-OWTIDSL5.js";
 import {
   exitCodeFor
 } from "./chunk-UKLSRQ5J.js";
@@ -9,4 +9,4 @@ export {
   exitCodeFor,
   runCli
 };
-//# sourceMappingURL=cli-BFGY7F6X.js.map
+//# sourceMappingURL=cli-QR44X5IB.js.map

package/dist/index.cjs

@@ -638,6 +638,7 @@ var SCOPE_PURPOSE = {
   "app:config:write": "apply or inspect one revision-bound configuration operation for an app you own",
   "platform:runbook:write": "read and edit all of odla's operational runbooks, including admin-visible content",
   "app:device:enroll": "enrol this machine so it can mint its own short-lived credentials without asking you again",
+  "platform:device:enroll:extended": "enrol this machine with a credential that outlives the seven-day owner ceiling \u2014 a durable secret on a machine you are vouching for",
   "platform:ai:policy:write": "change System AI model routing",
   "platform:ai:policy:read": "read System AI model routing",
   "platform:ai:credential:write": "replace a stored AI provider key",
@@ -10414,7 +10415,7 @@ Usage:
   odla-ai security run [target] --ack-redacted-source [--env dev] [--profile odla] [--fail-on high]
   odla-ai security run [target] --self --ack-redacted-source
   odla-ai provision [--live] [--config odla.config.mjs] [--email <odla-account>] [--request-grant] [--no-open] [--wait <seconds>] [--dry-run] [--push-secrets] [--rotate-o11y-token] [--write-dev-vars[=path]] [--yes]
-  odla-ai device enroll [--app <id>[,<id>...]] [--name <label>] [--capability <c>[,<c>...]] [--email <odla-account>] [--no-open] [--json]
+  odla-ai device enroll [--app <id>[,<id>...]] [--name <label>] [--capability <c>[,<c>...]] [--device-ttl <30d|6w|2y|forever>] [--email <odla-account>] [--no-open] [--json]
   odla-ai device list [--email <odla-account>] [--json]
   odla-ai device revoke <device-id> [--email <odla-account>] [--json]
   odla-ai credentials list [--config odla.config.mjs] [--env dev] [--all] [--json]
@@ -13505,6 +13506,24 @@ function renderAdvisories(out, advisories, env = process.env) {
   }
 }
 
+// src/device-ttl.ts
+var OWNER_DEVICE_TTL_MS = 7 * 24 * 60 * 60 * 1e3;
+var DAY_MS = 24 * 60 * 60 * 1e3;
+var UNITS = { d: DAY_MS, w: 7 * DAY_MS, y: 365 * DAY_MS };
+function parseDeviceTtl(raw) {
+  if (raw === void 0 || raw === true) return void 0;
+  const text3 = String(raw).trim().toLowerCase();
+  if (!text3) return void 0;
+  if (text3 === "forever" || text3 === "never") return 100 * 365 * DAY_MS;
+  const match = /^(\d+)\s*([dwy])$/.exec(text3);
+  if (!match) {
+    throw new Error(
+      `--device-ttl expects a duration like 30d, 6w, 2y, or "forever" (got "${raw}")`
+    );
+  }
+  return Number(match[1]) * UNITS[match[2]];
+}
+
 // src/device-command.ts
 var import_node_fs18 = require("fs");
 var import_node_path17 = require("path");
@@ -13524,7 +13543,17 @@ async function enroll(parsed, deps, cfg, doFetch, out, json) {
   const name = stringOpt(parsed.options.name) ?? defaultDeviceName();
   const apps = (stringOpt(parsed.options.app) ?? cfg.app.id).split(",").map((id2) => id2.trim()).filter(Boolean);
   if (apps.length === 0) throw new Error("device enroll needs --app <id>[,<id>\u2026]");
-  const token = await scopedToken2(parsed, deps, cfg, doFetch, out, `odla CLI (enroll ${name})`);
+  const deviceTtlMs = parseDeviceTtl(parsed.options["device-ttl"]);
+  const extended = deviceTtlMs !== void 0 && deviceTtlMs > OWNER_DEVICE_TTL_MS;
+  const token = await scopedToken2(
+    parsed,
+    deps,
+    cfg,
+    doFetch,
+    out,
+    `odla CLI (enroll ${name})`,
+    extended ? "platform:device:enroll:extended" : "app:device:enroll"
+  );
   const response2 = await doFetch(`${cfg.platformUrl}/registry/devices`, {
     method: "POST",
     headers: { authorization: `Bearer ${token}`, "content-type": "application/json" },
@@ -13532,7 +13561,8 @@ async function enroll(parsed, deps, cfg, doFetch, out, json) {
       name,
       platform: import_node_process15.default.platform,
       appIds: apps,
-      ...parsed.options.capability ? { capabilities: String(parsed.options.capability).split(",").map((c) => c.trim()).filter(Boolean) } : {}
+      ...parsed.options.capability ? { capabilities: String(parsed.options.capability).split(",").map((c) => c.trim()).filter(Boolean) } : {},
+      ...deviceTtlMs === void 0 ? {} : { deviceTtlMs }
     })
   });
   const body = await response2.json().catch(() => ({}));
@@ -13585,12 +13615,12 @@ async function revoke(parsed, deps, cfg, doFetch, out, json) {
   out.error(`device: revoked ${deviceId}; every credential it minted is revoked with it`);
   if (json) out.log(JSON.stringify({ deviceId, revoked: true }, null, 2));
 }
-async function scopedToken2(parsed, deps, cfg, doFetch, out, label) {
+async function scopedToken2(parsed, deps, cfg, doFetch, out, label, scope = "app:device:enroll") {
   const { credentials } = await resolveOperatorContext(parsed, { allowMissingConfig: true });
   const scopedTokenFile = credentials.scopedTokenFile;
   return getScopedPlatformToken({
     platform: cfg.platformUrl,
-    scope: "app:device:enroll",
+    scope,
     email: stringOpt(parsed.options.email),
     label,
     fetch: doFetch,