@odla-ai/cli 0.36.1 → 0.37.1

package/dist/{cli-BFGY7F6X.js → cli-OH6PCYZ3.js}

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import {
   runCli
-} from "./chunk-4QJ5NS64.js";
+} from "./chunk-XFIFFYNH.js";
 import {
   exitCodeFor
 } from "./chunk-UKLSRQ5J.js";
@@ -9,4 +9,4 @@ export {
   exitCodeFor,
   runCli
 };
-//# sourceMappingURL=cli-BFGY7F6X.js.map
+//# sourceMappingURL=cli-OH6PCYZ3.js.map

package/dist/index.cjs

@@ -638,6 +638,7 @@ var SCOPE_PURPOSE = {
   "app:config:write": "apply or inspect one revision-bound configuration operation for an app you own",
   "platform:runbook:write": "read and edit all of odla's operational runbooks, including admin-visible content",
   "app:device:enroll": "enrol this machine so it can mint its own short-lived credentials without asking you again",
+  "platform:device:enroll:extended": "enrol this machine with a credential that outlives the seven-day owner ceiling \u2014 a durable secret on a machine you are vouching for",
   "platform:ai:policy:write": "change System AI model routing",
   "platform:ai:policy:read": "read System AI model routing",
   "platform:ai:credential:write": "replace a stored AI provider key",
@@ -7009,7 +7010,7 @@ function createCodeRuntimeControlClient(options) {
     throw new TypeError("modelRequestTimeoutMs must be an integer from 30000 to 1800000");
   }
   const request3 = options.fetch ?? fetch;
-  const call2 = async (path, body, timeoutMs = requestTimeoutMs) => {
+  const call3 = async (path, body, timeoutMs = requestTimeoutMs) => {
     const timeout = AbortSignal.timeout(timeoutMs);
     const signal = options.signal ? AbortSignal.any([options.signal, timeout]) : timeout;
     let response2;
@@ -7039,17 +7040,17 @@ function createCodeRuntimeControlClient(options) {
   return {
     heartbeat: async (version, capabilities) => {
       validateHeartbeat(version, capabilities);
-      return parseSnapshot(await call2("/registry/code/runtime/heartbeat", { runtimeVersion: version, capabilities }));
+      return parseSnapshot(await call3("/registry/code/runtime/heartbeat", { runtimeVersion: version, capabilities }));
     },
     acknowledge: async (commandId, result) => {
       if (!/^ccmd_[0-9a-f]{32}$/.test(commandId)) throw new TypeError("invalid Code runtime command id");
-      await call2(`/registry/code/runtime/commands/${commandId}/ack`, result);
+      await call3(`/registry/code/runtime/commands/${commandId}/ack`, result);
     },
     source: async (sessionId) => parseSource(
-      await call2(`/registry/code/runtime/sessions/${validSessionId(sessionId)}/source`, {})
+      await call3(`/registry/code/runtime/sessions/${validSessionId(sessionId)}/source`, {})
     ),
     infer: async (sessionId, inference) => {
-      const value2 = record5(await call2(
+      const value2 = record5(await call3(
         `/registry/code/runtime/sessions/${validSessionId(sessionId)}/inference`,
         inference,
         modelRequestTimeoutMs
@@ -7060,11 +7061,11 @@ function createCodeRuntimeControlClient(options) {
       return value2;
     },
     review: async (sessionId, review) => parseReview(
-      await call2(`/registry/code/runtime/sessions/${validSessionId(sessionId)}/review`, review, modelRequestTimeoutMs)
+      await call3(`/registry/code/runtime/sessions/${validSessionId(sessionId)}/review`, review, modelRequestTimeoutMs)
     ),
     submitCandidate: async (sessionId, checkpointId, verification) => {
       if (!/^cpoint_[0-9a-f]{32}$/.test(checkpointId)) throw new TypeError("invalid Code checkpoint id");
-      return parseCandidate(await call2(
+      return parseCandidate(await call3(
         `/registry/code/runtime/sessions/${validSessionId(sessionId)}/candidates`,
         { checkpointId, verification }
       ));
@@ -7074,21 +7075,21 @@ function createCodeRuntimeControlClient(options) {
       if (!/^[A-Za-z0-9._:-]{1,120}$/.test(eventId) || !event || typeof event !== "object" || new TextEncoder().encode(serialized).byteLength > 24e3) {
         throw new TypeError("invalid Code session event");
       }
-      await call2(`/registry/code/runtime/sessions/${validSessionId(sessionId)}/chat/events`, { eventId, event });
+      await call3(`/registry/code/runtime/sessions/${validSessionId(sessionId)}/chat/events`, { eventId, event });
     },
     recallMemories: async (sessionId, subjects, limit) => {
-      const response2 = await call2(
+      const response2 = await call3(
         `/registry/code/runtime/sessions/${validSessionId(sessionId)}/recall`,
         { subjects: [...subjects], limit }
       );
       return Array.isArray(response2.memories) ? response2.memories : [];
     },
     rememberMemory: async (sessionId, memory) => {
-      await call2(`/registry/code/runtime/sessions/${validSessionId(sessionId)}/remember`, memory);
+      await call3(`/registry/code/runtime/sessions/${validSessionId(sessionId)}/remember`, memory);
     },
     reportSessionFailure: async (sessionId, message2) => {
       if (!message2.trim() || message2.length > 2e3) throw new TypeError("invalid Code session failure");
-      await call2(`/registry/code/runtime/sessions/${validSessionId(sessionId)}/failure`, { message: message2 });
+      await call3(`/registry/code/runtime/sessions/${validSessionId(sessionId)}/failure`, { message: message2 });
     }
   };
 }
@@ -7977,7 +7978,7 @@ var SYSTEM_PROMPT_FOR = {
 };
 function codeSkill(opts) {
   let seq = 0;
-  const call2 = async (tool, input, signal) => {
+  const call3 = async (tool, input, signal) => {
     const startedAt = Date.now();
     const response2 = await opts.broker.execute(
       { lease: opts.lease, workspaceDir: opts.workspaceDir, signal },
@@ -7999,7 +8000,7 @@ function codeSkill(opts) {
       },
       additionalProperties: false
     },
-    handler: (input, ctx) => call2("sandbox.read", input, ctx.signal)
+    handler: (input, ctx) => call3("sandbox.read", input, ctx.signal)
   };
   const applyPatch = {
     name: "odla_apply_git_diff",
@@ -8010,7 +8011,7 @@ function codeSkill(opts) {
       properties: { patch: { type: "string", minLength: 1, maxLength: 262144 } },
       additionalProperties: false
     },
-    handler: (input, ctx) => call2("sandbox.apply_patch", input, ctx.signal)
+    handler: (input, ctx) => call3("sandbox.apply_patch", input, ctx.signal)
   };
   const runRecipe = {
     name: "odla_run_recipe",
@@ -8021,7 +8022,7 @@ function codeSkill(opts) {
       properties: { recipeId: { type: "string", minLength: 1, maxLength: 120, pattern: "^[a-zA-Z0-9._:-]+$" } },
       additionalProperties: false
     },
-    handler: (input, ctx) => call2("sandbox.run_recipe", input, ctx.signal)
+    handler: (input, ctx) => call3("sandbox.run_recipe", input, ctx.signal)
   };
   const listFiles2 = {
     name: "odla_list",
@@ -8034,7 +8035,7 @@ function codeSkill(opts) {
       },
       additionalProperties: false
     },
-    handler: (input, ctx) => call2("sandbox.list", input, ctx.signal)
+    handler: (input, ctx) => call3("sandbox.list", input, ctx.signal)
   };
   const searchFiles = {
     name: "odla_search",
@@ -8050,7 +8051,7 @@ function codeSkill(opts) {
       },
       additionalProperties: false
     },
-    handler: (input, ctx) => call2("sandbox.search", input, ctx.signal)
+    handler: (input, ctx) => call3("sandbox.search", input, ctx.signal)
   };
   const graphTool = (name, tool, description, required) => ({
     name,
@@ -8061,7 +8062,7 @@ function codeSkill(opts) {
       properties: { query: { type: "string", maxLength: 512 } },
       additionalProperties: false
     },
-    handler: (input, ctx) => call2(tool, input, ctx.signal)
+    handler: (input, ctx) => call3(tool, input, ctx.signal)
   });
   const orientation = [
     graphTool(
@@ -8100,9 +8101,9 @@ async function runCodeAgent(options) {
     lease: options.lease,
     workspaceDir: options.workspaceDir,
     surface,
-    onToolCall: (call2) => {
-      toolCalls.push(call2);
-      options.onToolCall?.(call2);
+    onToolCall: (call3) => {
+      toolCalls.push(call3);
+      options.onToolCall?.(call3);
     }
   });
   const compaction = options.compaction === void 0 ? (0, import_ai4.keepRecentExchanges)({ whenInputTokensExceed: 12e4, keep: 3 }) : options.compaction;
@@ -10414,7 +10415,7 @@ Usage:
   odla-ai security run [target] --ack-redacted-source [--env dev] [--profile odla] [--fail-on high]
   odla-ai security run [target] --self --ack-redacted-source
   odla-ai provision [--live] [--config odla.config.mjs] [--email <odla-account>] [--request-grant] [--no-open] [--wait <seconds>] [--dry-run] [--push-secrets] [--rotate-o11y-token] [--write-dev-vars[=path]] [--yes]
-  odla-ai device enroll [--app <id>[,<id>...]] [--name <label>] [--capability <c>[,<c>...]] [--email <odla-account>] [--no-open] [--json]
+  odla-ai device enroll [--app <id>[,<id>...]] [--name <label>] [--capability <c>[,<c>...]] [--device-ttl <30d|6w|2y|forever>] [--email <odla-account>] [--no-open] [--json]
   odla-ai device list [--email <odla-account>] [--json]
   odla-ai device revoke <device-id> [--email <odla-account>] [--json]
   odla-ai credentials list [--config odla.config.mjs] [--env dev] [--all] [--json]
@@ -12883,9 +12884,15 @@ async function provisionEnvCredentials(opts) {
     if (o11yToken) {
       opts.stdout.log(`${opts.env}: reusing local o11y ingest token`);
     } else {
-      o11yToken = await issueO11yToken(opts);
-      credentials = save(opts, credentials, tenantId, { ...dbKey ? { dbKey } : {}, o11yToken });
-      opts.stdout.log(`${opts.env}: ${opts.rotateO11y ? "rotated" : "issued"} o11y ingest token`);
+      o11yToken = await issueO11yToken(opts) ?? void 0;
+      if (o11yToken) {
+        credentials = save(opts, credentials, tenantId, { ...dbKey ? { dbKey } : {}, o11yToken });
+        opts.stdout.log(`${opts.env}: ${opts.rotateO11y ? "rotated" : "issued"} o11y ingest token`);
+      } else {
+        opts.stdout.log(
+          `${opts.env}: o11y token already exists and its shown-once value is not on this machine \u2014 leaving it alone (a co-owner provisioned this env). Nothing was rotated, and this env's running Worker keeps its token. To replace it deliberately \u2014 which invalidates the token on whatever is deployed \u2014 run "odla-ai provision --rotate-o11y-token --push-secrets".`
+        );
+      }
     }
   }
   return save(opts, credentials, tenantId, {
@@ -12939,11 +12946,7 @@ async function issueO11yToken(opts) {
     `${opts.cfg.platformUrl}/o11y/${encodeURIComponent(opts.cfg.app.id)}/token${suffix}?env=${encodeURIComponent(opts.env)}`,
     { method: "POST", headers: { authorization: `Bearer ${opts.developerToken}` } }
   );
-  if (res.status === 409 && !opts.rotateO11y) {
-    throw new Error(
-      `o11y token already exists for env "${opts.env}", but its shown-once value is not in the local credentials file; run "odla-ai provision --push-secrets" to install a separate runtime credential without rotating siblings`
-    );
-  }
+  if (res.status === 409 && !opts.rotateO11y) return null;
   if (!res.ok) throw new Error(`o11y token ${opts.rotateO11y ? "rotation" : "issue"} (${opts.env}) failed: ${res.status} ${await safeText7(res)}`);
   const body = await res.json();
   if (!body.token) throw new Error(`o11y token ${opts.rotateO11y ? "rotation" : "issue"} (${opts.env}) returned no token`);
@@ -13505,6 +13508,24 @@ function renderAdvisories(out, advisories, env = process.env) {
   }
 }
 
+// src/device-ttl.ts
+var OWNER_DEVICE_TTL_MS = 7 * 24 * 60 * 60 * 1e3;
+var DAY_MS = 24 * 60 * 60 * 1e3;
+var UNITS = { d: DAY_MS, w: 7 * DAY_MS, y: 365 * DAY_MS };
+function parseDeviceTtl(raw) {
+  if (raw === void 0 || raw === true) return void 0;
+  const text3 = String(raw).trim().toLowerCase();
+  if (!text3) return void 0;
+  if (text3 === "forever" || text3 === "never") return 100 * 365 * DAY_MS;
+  const match = /^(\d+)\s*([dwy])$/.exec(text3);
+  if (!match) {
+    throw new Error(
+      `--device-ttl expects a duration like 30d, 6w, 2y, or "forever" (got "${raw}")`
+    );
+  }
+  return Number(match[1]) * UNITS[match[2]];
+}
+
 // src/device-command.ts
 var import_node_fs18 = require("fs");
 var import_node_path17 = require("path");
@@ -13524,7 +13545,17 @@ async function enroll(parsed, deps, cfg, doFetch, out, json) {
   const name = stringOpt(parsed.options.name) ?? defaultDeviceName();
   const apps = (stringOpt(parsed.options.app) ?? cfg.app.id).split(",").map((id2) => id2.trim()).filter(Boolean);
   if (apps.length === 0) throw new Error("device enroll needs --app <id>[,<id>\u2026]");
-  const token = await scopedToken2(parsed, deps, cfg, doFetch, out, `odla CLI (enroll ${name})`);
+  const deviceTtlMs = parseDeviceTtl(parsed.options["device-ttl"]);
+  const extended = deviceTtlMs !== void 0 && deviceTtlMs > OWNER_DEVICE_TTL_MS;
+  const token = await scopedToken2(
+    parsed,
+    deps,
+    cfg,
+    doFetch,
+    out,
+    `odla CLI (enroll ${name})`,
+    extended ? "platform:device:enroll:extended" : "app:device:enroll"
+  );
   const response2 = await doFetch(`${cfg.platformUrl}/registry/devices`, {
     method: "POST",
     headers: { authorization: `Bearer ${token}`, "content-type": "application/json" },
@@ -13532,7 +13563,8 @@ async function enroll(parsed, deps, cfg, doFetch, out, json) {
       name,
       platform: import_node_process15.default.platform,
       appIds: apps,
-      ...parsed.options.capability ? { capabilities: String(parsed.options.capability).split(",").map((c) => c.trim()).filter(Boolean) } : {}
+      ...parsed.options.capability ? { capabilities: String(parsed.options.capability).split(",").map((c) => c.trim()).filter(Boolean) } : {},
+      ...deviceTtlMs === void 0 ? {} : { deviceTtlMs }
     })
   });
   const body = await response2.json().catch(() => ({}));
@@ -13585,12 +13617,12 @@ async function revoke(parsed, deps, cfg, doFetch, out, json) {
   out.error(`device: revoked ${deviceId}; every credential it minted is revoked with it`);
   if (json) out.log(JSON.stringify({ deviceId, revoked: true }, null, 2));
 }
-async function scopedToken2(parsed, deps, cfg, doFetch, out, label) {
+async function scopedToken2(parsed, deps, cfg, doFetch, out, label, scope = "app:device:enroll") {
   const { credentials } = await resolveOperatorContext(parsed, { allowMissingConfig: true });
   const scopedTokenFile = credentials.scopedTokenFile;
   return getScopedPlatformToken({
     platform: cfg.platformUrl,
-    scope: "app:device:enroll",
+    scope,
     email: stringOpt(parsed.options.email),
     label,
     fetch: doFetch,
@@ -13849,12 +13881,7 @@ ${counts.created} created, ${counts.updated} updated, ${counts.unchanged} unchan
   );
 }
 async function upsert(ctx, r, visibility) {
-  const page2 = await call(
-    ctx,
-    "GET",
-    `/runbook?app=${encodeURIComponent(ctx.appId)}&slug=${encodeURIComponent(r.slug)}&limit=1`
-  );
-  const found = page2.records[0];
+  const found = await bySlug(ctx, r.slug).catch(() => null);
   if (!found) {
     await call(ctx, "POST", "/runbook", {
       appId: ctx.appId,
@@ -14259,13 +14286,7 @@ async function runbookAsk(ctx, question, all) {
   ctx.out.log(JSDOC_POINTER);
 }
 async function runbookComment(ctx, slug, body) {
-  const page2 = await call(
-    ctx,
-    "GET",
-    `/runbook?app=${encodeURIComponent(ctx.appId)}&slug=${encodeURIComponent(slug)}&limit=1`
-  );
-  const found = page2.records[0];
-  if (!found) throw new Error(`no runbook "${slug}" in ${ctx.appId}`);
+  const found = await bySlug(ctx, slug);
   await call(ctx, "POST", `/runbook/${encodeURIComponent(found.id)}/comments`, { body });
   ctx.out.log(`commented on ${slug} (v${found.version})`);
 }
@@ -14316,13 +14337,7 @@ var defaultRunOrInjected = (deps) => deps.run ?? defaultRun;
 
 // src/runbook-edit-flow.ts
 async function editRunbook(ctx, slug, deps = {}) {
-  const page2 = await call(
-    ctx,
-    "GET",
-    `/runbook?app=${encodeURIComponent(ctx.appId)}&slug=${encodeURIComponent(slug)}&limit=1`
-  );
-  const found = page2.records[0];
-  if (!found) throw new Error(`no runbook "${slug}" in ${ctx.appId}`);
+  const found = await bySlug(ctx, slug);
   ctx.out.log(`opening ${slug} v${found.version} in your editor\u2026`);
   const body = await editText(found.body, slug, deps);
   return body === null ? null : { body, expectedVersion: found.version };