@odla-ai/cli 0.37.0 → 0.38.0

package/dist/bin.cjs

@@ -1322,6 +1322,74 @@ var init_argv = __esm({
   }
 });
 
+// src/admin-spend.ts
+async function call(ctx, method, scope) {
+  const url = `${ctx.platformUrl.replace(/\/$/, "")}/registry/platform/spend?scope=${encodeURIComponent(scope)}`;
+  const response2 = await ctx.doFetch(url, {
+    method,
+    headers: { authorization: `Bearer ${ctx.token}` }
+  });
+  const body = await response2.json().catch(() => ({}));
+  if (!response2.ok) {
+    const detail = body.error?.message ?? body.error?.code ?? `registry returned ${response2.status}`;
+    throw new Error(`spend ${method} failed: ${detail} (${response2.status})`);
+  }
+  return body;
+}
+async function spendShow(ctx, scope) {
+  const view = await call(ctx, "GET", scope);
+  if (ctx.json) return ctx.out.log(JSON.stringify(view, null, 2));
+  ctx.out.log(`scope:   ${view.scope}`);
+  ctx.out.log(`day:     ${view.day} (UTC)`);
+  ctx.out.log(
+    `spent:   ${money(view.spentUsd)} of ${view.capUsd > 0 ? money(view.capUsd) : "(no cap set)"}`
+  );
+  ctx.out.log(`calls:   ${view.calls}`);
+  if (view.unpricedCalls > 0) {
+    ctx.out.log(
+      `unpriced: ${view.unpricedCalls} call(s) had no price, so "spent" is a floor, not the total.`
+    );
+  }
+  if (!view.latched) return ctx.out.log("status:  running");
+  ctx.out.log(
+    `status:  HALTED \u2014 reached ${money(view.latched.capUsd)} on ${view.latched.day} (${view.latched.reason}), at ${money(view.latched.costUsd)}.`
+  );
+  ctx.out.log("A new day does not clear this. Resume with:");
+  ctx.out.log(`  odla-ai admin spend reset ${view.scope}`);
+}
+async function spendReset(ctx, scope) {
+  const result = await call(ctx, "DELETE", scope);
+  if (ctx.json) return ctx.out.log(JSON.stringify(result, null, 2));
+  ctx.out.log(result.message);
+  if (result.stillOverCap) {
+    ctx.out.log(
+      `  today: ${money(result.spentUsd)} against a ${money(result.capUsd)} cap.`
+    );
+  }
+}
+async function adminSpend(parsed, ctx) {
+  const action2 = parsed.positionals[2];
+  const scope = parsed.positionals[3] ?? stringOpt(parsed.options.scope);
+  if (action2 !== "show" && action2 !== "reset") {
+    throw new Error('unknown spend command. Try "odla-ai admin spend show <scope>".');
+  }
+  if (!scope) {
+    throw new Error(
+      `"admin spend ${action2}" needs a scope, e.g. odla-ai admin spend ${action2} app:my-app:<incarnation>`
+    );
+  }
+  return action2 === "show" ? spendShow(ctx, scope) : spendReset(ctx, scope);
+}
+var money;
+var init_admin_spend = __esm({
+  "src/admin-spend.ts"() {
+    "use strict";
+    init_cjs_shims();
+    init_argv();
+    money = (value2) => `$${value2.toFixed(2)}`;
+  }
+});
+
 // src/ai-config-validation.ts
 function validateAiConfig(cfg, path) {
   if (cfg.ai === void 0) return;
@@ -2141,6 +2209,31 @@ var init_operator_context = __esm({
 async function adminCommand(parsed, deps = {}) {
   const area = parsed.positionals[1];
   const action2 = parsed.positionals[2];
+  if (area === "spend") {
+    assertArgs(parsed, JSON_OPTIONS, 4);
+    const context2 = await resolveOperatorContext(parsed, { allowMissingConfig: true });
+    const out = deps.stdout ?? console;
+    const doFetch = deps.fetch ?? fetch;
+    const token = await getDeveloperToken(
+      context2.cfg,
+      {
+        configPath: context2.cfg.configPath,
+        token: stringOpt(parsed.options.token),
+        email: stringOpt(parsed.options.email),
+        open: parsed.options.open === false ? false : parsed.options.open === true ? true : void 0,
+        openApprovalUrl: deps.openUrl
+      },
+      doFetch,
+      out
+    );
+    return adminSpend(parsed, {
+      platformUrl: context2.platform.value,
+      token,
+      doFetch,
+      json: parsed.options.json === true,
+      out
+    });
+  }
   const credentialSet = action2 === "credential" && parsed.positionals[3] === "set";
   const credentials = action2 === "credentials";
   const models = action2 === "models";
@@ -2190,6 +2283,8 @@ var init_admin_command = __esm({
     "use strict";
     init_cjs_shims();
     init_admin_ai();
+    init_admin_spend();
+    init_token();
     init_argv();
     init_operator_context();
     CONTEXT_OPTIONS = ["platform", "config", "context", "token", "open", "email"];
@@ -2265,7 +2360,8 @@ async function fetchIdentity(platformUrl, token, doFetch) {
     email,
     admin: body.admin === true,
     machine,
-    scopes
+    scopes,
+    projects: Array.isArray(body.projects) ? body.projects.map(String) : null
   };
 }
 function credentialLabel(identity) {
@@ -2335,6 +2431,13 @@ async function whoamiCommand(parsed, deps = {}) {
     out.log(`credential id: ${identity.credential.id}`);
   out.log(`admin:      ${identity.admin ? "yes" : "no"}`);
   if (identity.scopes.length) out.log(`scopes:     ${identity.scopes.join(", ")}`);
+  if (identity.projects === null) {
+    out.log("projects:   (this registry does not report project grants)");
+  } else if (identity.projects.length) {
+    out.log(`projects:   ${identity.projects.join(", ")}`);
+  } else {
+    out.log("projects:   (none \u2014 every pm and discuss call will be refused)");
+  }
   if (!identity.admin) {
     if (identity.scopes.includes("platform:runbook:write")) {
       out.log("\nThis exact scope can read and edit all platform runbook content.");
@@ -6211,17 +6314,17 @@ var init_cli_project = __esm({
   }
 });
 
-// ../harness/dist/chunk-3QP4VDQS.js
+// ../harness/dist/chunk-LNQNFGQC.js
 var HARNESS_PROTOCOL_VERSION;
-var init_chunk_3QP4VDQS = __esm({
-  "../harness/dist/chunk-3QP4VDQS.js"() {
+var init_chunk_LNQNFGQC = __esm({
+  "../harness/dist/chunk-LNQNFGQC.js"() {
     "use strict";
     init_cjs_shims();
     HARNESS_PROTOCOL_VERSION = 1;
   }
 });
 
-// ../harness/dist/chunk-GKDKIU4P.js
+// ../harness/dist/chunk-K76I2TCQ.js
 function assertPinnedImage(image) {
   if (!DIGEST_IMAGE.test(image)) throw new TypeError("container image must be pinned by sha256 digest");
 }
@@ -6570,8 +6673,8 @@ async function stageWorkspacePair(baselineSource, workspaceSource, options = {})
   }
 }
 var import_child_process, import_fs, import_promises2, import_path, import_process, import_promises3, import_os, import_path2, import_child_process2, import_path3, import_promises4, import_os2, import_path4, import_child_process3, DIGEST_IMAGE, SKIP_WORKSPACE_DIRS, SECRET_WORKSPACE_FILE;
-var init_chunk_GKDKIU4P = __esm({
-  "../harness/dist/chunk-GKDKIU4P.js"() {
+var init_chunk_K76I2TCQ = __esm({
+  "../harness/dist/chunk-K76I2TCQ.js"() {
     "use strict";
     init_cjs_shims();
     import_child_process = require("child_process");
@@ -7569,7 +7672,7 @@ var init_code2 = __esm({
   }
 });
 
-// ../harness/dist/chunk-ANNX7VGK.js
+// ../harness/dist/chunk-UVGZHNLW.js
 async function digestStagedWorkspace(root, limits) {
   const files = [];
   const walk = async (directory) => {
@@ -7647,7 +7750,7 @@ function createCodeRuntimeControlClient(options) {
     throw new TypeError("modelRequestTimeoutMs must be an integer from 30000 to 1800000");
   }
   const request3 = options.fetch ?? fetch;
-  const call2 = async (path, body, timeoutMs = requestTimeoutMs) => {
+  const call4 = async (path, body, timeoutMs = requestTimeoutMs) => {
     const timeout = AbortSignal.timeout(timeoutMs);
     const signal = options.signal ? AbortSignal.any([options.signal, timeout]) : timeout;
     let response2;
@@ -7677,17 +7780,17 @@ function createCodeRuntimeControlClient(options) {
   return {
     heartbeat: async (version, capabilities) => {
       validateHeartbeat(version, capabilities);
-      return parseSnapshot(await call2("/registry/code/runtime/heartbeat", { runtimeVersion: version, capabilities }));
+      return parseSnapshot(await call4("/registry/code/runtime/heartbeat", { runtimeVersion: version, capabilities }));
     },
     acknowledge: async (commandId, result) => {
       if (!/^ccmd_[0-9a-f]{32}$/.test(commandId)) throw new TypeError("invalid Code runtime command id");
-      await call2(`/registry/code/runtime/commands/${commandId}/ack`, result);
+      await call4(`/registry/code/runtime/commands/${commandId}/ack`, result);
     },
     source: async (sessionId) => parseSource(
-      await call2(`/registry/code/runtime/sessions/${validSessionId(sessionId)}/source`, {})
+      await call4(`/registry/code/runtime/sessions/${validSessionId(sessionId)}/source`, {})
     ),
     infer: async (sessionId, inference) => {
-      const value2 = record5(await call2(
+      const value2 = record5(await call4(
         `/registry/code/runtime/sessions/${validSessionId(sessionId)}/inference`,
         inference,
         modelRequestTimeoutMs
@@ -7698,11 +7801,11 @@ function createCodeRuntimeControlClient(options) {
       return value2;
     },
     review: async (sessionId, review) => parseReview(
-      await call2(`/registry/code/runtime/sessions/${validSessionId(sessionId)}/review`, review, modelRequestTimeoutMs)
+      await call4(`/registry/code/runtime/sessions/${validSessionId(sessionId)}/review`, review, modelRequestTimeoutMs)
     ),
     submitCandidate: async (sessionId, checkpointId, verification) => {
       if (!/^cpoint_[0-9a-f]{32}$/.test(checkpointId)) throw new TypeError("invalid Code checkpoint id");
-      return parseCandidate(await call2(
+      return parseCandidate(await call4(
         `/registry/code/runtime/sessions/${validSessionId(sessionId)}/candidates`,
         { checkpointId, verification }
       ));
@@ -7712,21 +7815,21 @@ function createCodeRuntimeControlClient(options) {
       if (!/^[A-Za-z0-9._:-]{1,120}$/.test(eventId) || !event || typeof event !== "object" || new TextEncoder().encode(serialized).byteLength > 24e3) {
         throw new TypeError("invalid Code session event");
       }
-      await call2(`/registry/code/runtime/sessions/${validSessionId(sessionId)}/chat/events`, { eventId, event });
+      await call4(`/registry/code/runtime/sessions/${validSessionId(sessionId)}/chat/events`, { eventId, event });
     },
     recallMemories: async (sessionId, subjects, limit) => {
-      const response2 = await call2(
+      const response2 = await call4(
         `/registry/code/runtime/sessions/${validSessionId(sessionId)}/recall`,
         { subjects: [...subjects], limit }
       );
       return Array.isArray(response2.memories) ? response2.memories : [];
     },
     rememberMemory: async (sessionId, memory) => {
-      await call2(`/registry/code/runtime/sessions/${validSessionId(sessionId)}/remember`, memory);
+      await call4(`/registry/code/runtime/sessions/${validSessionId(sessionId)}/remember`, memory);
     },
     reportSessionFailure: async (sessionId, message2) => {
       if (!message2.trim() || message2.length > 2e3) throw new TypeError("invalid Code session failure");
-      await call2(`/registry/code/runtime/sessions/${validSessionId(sessionId)}/failure`, { message: message2 });
+      await call4(`/registry/code/runtime/sessions/${validSessionId(sessionId)}/failure`, { message: message2 });
     }
   };
 }
@@ -8512,7 +8615,7 @@ async function materializeCommandWorkspace(input) {
 }
 function codeSkill(opts) {
   let seq = 0;
-  const call2 = async (tool, input, signal) => {
+  const call4 = async (tool, input, signal) => {
     const startedAt = Date.now();
     const response2 = await opts.broker.execute(
       { lease: opts.lease, workspaceDir: opts.workspaceDir, signal },
@@ -8534,7 +8637,7 @@ function codeSkill(opts) {
       },
       additionalProperties: false
     },
-    handler: (input, ctx) => call2("sandbox.read", input, ctx.signal)
+    handler: (input, ctx) => call4("sandbox.read", input, ctx.signal)
   };
   const applyPatch = {
     name: "odla_apply_git_diff",
@@ -8545,7 +8648,7 @@ function codeSkill(opts) {
       properties: { patch: { type: "string", minLength: 1, maxLength: 262144 } },
       additionalProperties: false
     },
-    handler: (input, ctx) => call2("sandbox.apply_patch", input, ctx.signal)
+    handler: (input, ctx) => call4("sandbox.apply_patch", input, ctx.signal)
   };
   const runRecipe = {
     name: "odla_run_recipe",
@@ -8556,7 +8659,7 @@ function codeSkill(opts) {
       properties: { recipeId: { type: "string", minLength: 1, maxLength: 120, pattern: "^[a-zA-Z0-9._:-]+$" } },
       additionalProperties: false
     },
-    handler: (input, ctx) => call2("sandbox.run_recipe", input, ctx.signal)
+    handler: (input, ctx) => call4("sandbox.run_recipe", input, ctx.signal)
   };
   const listFiles2 = {
     name: "odla_list",
@@ -8569,7 +8672,7 @@ function codeSkill(opts) {
       },
       additionalProperties: false
     },
-    handler: (input, ctx) => call2("sandbox.list", input, ctx.signal)
+    handler: (input, ctx) => call4("sandbox.list", input, ctx.signal)
   };
   const searchFiles = {
     name: "odla_search",
@@ -8585,7 +8688,7 @@ function codeSkill(opts) {
       },
       additionalProperties: false
     },
-    handler: (input, ctx) => call2("sandbox.search", input, ctx.signal)
+    handler: (input, ctx) => call4("sandbox.search", input, ctx.signal)
   };
   const graphTool = (name, tool, description, required) => ({
     name,
@@ -8596,7 +8699,7 @@ function codeSkill(opts) {
       properties: { query: { type: "string", maxLength: 512 } },
       additionalProperties: false
     },
-    handler: (input, ctx) => call2(tool, input, ctx.signal)
+    handler: (input, ctx) => call4(tool, input, ctx.signal)
   });
   const orientation = [
     graphTool(
@@ -8635,9 +8738,9 @@ async function runCodeAgent(options) {
     lease: options.lease,
     workspaceDir: options.workspaceDir,
     surface,
-    onToolCall: (call2) => {
-      toolCalls.push(call2);
-      options.onToolCall?.(call2);
+    onToolCall: (call4) => {
+      toolCalls.push(call4);
+      options.onToolCall?.(call4);
     }
   });
   const compaction = options.compaction === void 0 ? (0, import_ai4.keepRecentExchanges)({ whenInputTokensExceed: 12e4, keep: 3 }) : options.compaction;
@@ -8722,6 +8825,9 @@ async function handleCodeRuntimeInference(input) {
     call: request3.call
   });
   state2.tokens += response2.receipt.inputTokens + response2.receipt.outputTokens;
+  const { costUsd } = response2.receipt;
+  if (costUsd === void 0) state2.costKnown = false;
+  else state2.costUsd += costUsd;
   await input.event({
     type: "usage",
     provider: response2.receipt.provider,
@@ -8731,7 +8837,9 @@ async function handleCodeRuntimeInference(input) {
     durationMs: Date.now() - startedAt,
     interactionId: command.commandId,
     interactionTokens: state2.tokens,
-    interactionMaxTokens: metadata2.maxTokensPerInteraction
+    interactionMaxTokens: metadata2.maxTokensPerInteraction,
+    ...costUsd === void 0 ? {} : { costUsd },
+    ...state2.costKnown ? { interactionCostUsd: state2.costUsd } : {}
   }).catch(() => void 0);
   return {
     protocolVersion: HARNESS_PROTOCOL_VERSION,
@@ -9522,10 +9630,16 @@ async function startGoalPursuit(input) {
     attempt: async ({ prompt }) => {
       const result = await input.attempt(prompt);
       return {
-        // The runtime charges tokens through the control plane's own
-        // per-interaction reservation, so the goal budget bounds ATTEMPTS here
-        // and the token ceiling is enforced where the credential lives.
-        tokens: 0,
+        // What the attempt actually spent, so the runner's token_budget and
+        // cost_budget checks can be reached. This used to be a hardcoded 0 with
+        // no cost at all, which made maxTokens and maxUsd unreachable while
+        // callers reasonably read them as hard ceilings.
+        //
+        // costUsd is omitted rather than zeroed when any call in the attempt
+        // was unpriced: the runner only enforces a cost budget while the cost
+        // is known, and a zero would make it enforce against a lie.
+        tokens: result.tokens ?? 0,
+        ...result.costUsd === void 0 ? {} : { costUsd: result.costUsd },
         ...result.status === "failed" ? { error: result.error ?? "attempt failed" } : {}
       };
     },
@@ -9554,12 +9668,12 @@ async function appendCodeRuntimeEvent(control, command, event, refs) {
   await control.appendSessionEvent(command.sessionId, eventId, bounded);
 }
 var import_crypto, import_promises5, import_path5, import_child_process4, import_promises6, import_path6, import_child_process5, import_process2, import_crypto2, import_crypto3, import_fs2, import_promises7, import_path7, import_promises8, import_os3, import_path8, import_ai4, import_promises9, import_path9, import_promises10, import_promises11, import_path10, import_crypto4, CODE_RUNTIME_PROTOCOL_VERSION, CodeRuntimeReconciler, CodeRuntimeControlError, record5, invalid, RESERVED, SECRET, PATH, FORBIDDEN, ARTIFACT_PATH, PRIVATE_ARTIFACT_PART, SHA3, DIGEST3, ID3, RULE, DEFAULT_PREFIXES, DEFAULT_SUFFIXES, message, CodeRuntimeCheckpointManager, record22, SOURCE_LIMITS, RESERVED2, SECRET2, V1_SYSTEM_PROMPT, V2_SYSTEM_PROMPT, V3_SYSTEM_PROMPT, SYSTEM_PROMPT_FOR, DEFAULT_MAX_FILES, DEFAULT_MAX_RESULTS, DEFAULT_MAX_FILE_BYTES, DESTINATIONS, READ, LIST, SEARCH, GRAPH, PATCH, RECIPE, cache, shortId, GRAPH_TOOLS, MAX_MEMORY_BODY, POSITIVE, digestRuntimeValue, runtimeErrorMessage, CodePiRuntimeEngine;
-var init_chunk_ANNX7VGK = __esm({
-  "../harness/dist/chunk-ANNX7VGK.js"() {
+var init_chunk_UVGZHNLW = __esm({
+  "../harness/dist/chunk-UVGZHNLW.js"() {
     "use strict";
     init_cjs_shims();
-    init_chunk_GKDKIU4P();
-    init_chunk_3QP4VDQS();
+    init_chunk_K76I2TCQ();
+    init_chunk_LNQNFGQC();
     import_crypto = require("crypto");
     import_promises5 = require("fs/promises");
     import_path5 = require("path");
@@ -9973,7 +10087,7 @@ Never claim a build or test passed unless odla_run_recipe returned that result.`
           recipeAuthorization: this.options.recipeAuthorization
         }, lease, metadata2.role));
         const startedAt = Date.now();
-        const interaction = { tokens: 0, noticeEmitted: false };
+        const interaction = { tokens: 0, noticeEmitted: false, costUsd: 0, costKnown: true };
         const inference = createCodeRuntimeInference({
           command,
           metadata: metadata2,
@@ -10011,7 +10125,11 @@ Never claim a build or test passed unless odla_run_recipe returned that result.`
           await this.#diagnostic(command, active, detail);
           await this.#failure(command, active, detail);
         }
-        return result;
+        return {
+          ...result,
+          tokens: interaction.tokens,
+          ...interaction.costKnown ? { costUsd: interaction.costUsd } : {}
+        };
       }
       /** Report every brokered effect as it starts and finishes. */
       #observed(command, active, broker) {
@@ -10070,8 +10188,8 @@ var init_node = __esm({
   "../harness/dist/node.js"() {
     "use strict";
     init_cjs_shims();
-    init_chunk_ANNX7VGK();
-    init_chunk_GKDKIU4P();
+    init_chunk_UVGZHNLW();
+    init_chunk_K76I2TCQ();
     MEASURED_PREMIUM = Object.freeze({
       /** 3 racers vs pure depth at equal budget: 21,044 / 7,936. */
       racePerRacer: 0.55,
@@ -11175,6 +11293,8 @@ Usage:
   odla-ai admin ai credential set <provider> [--context <name>] (--from-env <NAME>|--stdin)
   odla-ai admin ai usage [--context <name>] [--app-id <id>] [--env <env>] [--run-id <id>] [--limit <1-500>] [--json]
   odla-ai admin ai audit [--context <name>] [--limit <1-200>] [--json]
+  odla-ai admin spend show <app:<id>:<incarnation>> [--context <name>] [--json]
+  odla-ai admin spend reset <app:<id>:<incarnation>> [--context <name>] [--json]
   odla-ai security github connect [--repo owner/name] [--env dev]             [continue in Studio; human session required]
   odla-ai security github disconnect --source <id> [--env dev]          [continue in Studio; human session required]
   odla-ai security plan [--env dev] [--json]
@@ -11269,6 +11389,9 @@ Commands:
                human session connects one); "code grant request|list|approve|revoke" then
                governs unattended access: an agent may request, only a human may approve.
   admin        Manage platform-funded AI routing/credentials/usage with narrow device grants.
+               "admin spend" reads one app's daily inference spend and resumes it
+               after a cap halts it. The cap is per UTC day; exhausting it LATCHES,
+               and a new day does not clear the latch \u2014 resuming is deliberate.
   security     Connect GitHub sources and run commit-pinned hosted reviews, or scan a local snapshot.
   pm           Project management (via @odla-ai/pm): Products contain Projects;
                projects contain goals, kanban tasks, decisions, and bugs. Use
@@ -11276,6 +11399,12 @@ Commands:
                pass --app/--project explicitly. Same device-grant auth as "app".
                Status changes and comments post to each item's @odla-ai/chat
                discussion thread.
+               NOTE: "--column ready" is OWNER-ONLY. Creating a task in Ready
+               approves its complete execution contract, so it needs pm.plan,
+               which no device enrollment or handshake approval can grant. An
+               agent proposes in Backlog (the default); a human owner or a
+               pm.plan agent promotes. This is deliberate, not a permission
+               gap \u2014 it was reported as one.
   bug          Intent-first alias for PM bugs. "bug report" writes to
                odla PM; odla product defects do not belong in GitHub Issues.
   discuss      Group discussions (via @odla-ai/chat) for the apps you co-own:
@@ -13866,9 +13995,15 @@ async function provisionEnvCredentials(opts) {
     if (o11yToken) {
       opts.stdout.log(`${opts.env}: reusing local o11y ingest token`);
     } else {
-      o11yToken = await issueO11yToken(opts);
-      credentials = save(opts, credentials, tenantId, { ...dbKey ? { dbKey } : {}, o11yToken });
-      opts.stdout.log(`${opts.env}: ${opts.rotateO11y ? "rotated" : "issued"} o11y ingest token`);
+      o11yToken = await issueO11yToken(opts) ?? void 0;
+      if (o11yToken) {
+        credentials = save(opts, credentials, tenantId, { ...dbKey ? { dbKey } : {}, o11yToken });
+        opts.stdout.log(`${opts.env}: ${opts.rotateO11y ? "rotated" : "issued"} o11y ingest token`);
+      } else {
+        opts.stdout.log(
+          `${opts.env}: o11y token already exists and its shown-once value is not on this machine \u2014 leaving it alone (a co-owner provisioned this env). Nothing was rotated, and this env's running Worker keeps its token. To replace it deliberately \u2014 which invalidates the token on whatever is deployed \u2014 run "odla-ai provision --rotate-o11y-token --push-secrets".`
+        );
+      }
     }
   }
   return save(opts, credentials, tenantId, {
@@ -13922,11 +14057,7 @@ async function issueO11yToken(opts) {
     `${opts.cfg.platformUrl}/o11y/${encodeURIComponent(opts.cfg.app.id)}/token${suffix}?env=${encodeURIComponent(opts.env)}`,
     { method: "POST", headers: { authorization: `Bearer ${opts.developerToken}` } }
   );
-  if (res.status === 409 && !opts.rotateO11y) {
-    throw new Error(
-      `o11y token already exists for env "${opts.env}", but its shown-once value is not in the local credentials file; run "odla-ai provision --push-secrets" to install a separate runtime credential without rotating siblings`
-    );
-  }
+  if (res.status === 409 && !opts.rotateO11y) return null;
   if (!res.ok) throw new Error(`o11y token ${opts.rotateO11y ? "rotation" : "issue"} (${opts.env}) failed: ${res.status} ${await safeText7(res)}`);
   const body = await res.json();
   if (!body.token) throw new Error(`o11y token ${opts.rotateO11y ? "rotation" : "issue"} (${opts.env}) returned no token`);
@@ -14698,7 +14829,7 @@ var init_device_command = __esm({
 });
 
 // src/runbook-actions.ts
-async function call(ctx, method, path, body) {
+async function call2(ctx, method, path, body) {
   const res = await ctx.doFetch(`${ctx.platformUrl.replace(/\/$/, "")}/registry/pm${path}`, {
     method,
     headers: {
@@ -14720,7 +14851,7 @@ async function call(ctx, method, path, body) {
   throw new Error(message2);
 }
 async function bySlug(ctx, slug) {
-  const page2 = await call(
+  const page2 = await call2(
     ctx,
     "GET",
     `/runbook?app=${encodeURIComponent(ctx.appId)}&slug=${encodeURIComponent(slug)}&limit=1`
@@ -14729,7 +14860,7 @@ async function bySlug(ctx, slug) {
   if (filtered) return filtered;
   const limit = 100;
   for (let offset = 0; ; offset += limit) {
-    const fallback = await call(
+    const fallback = await call2(
       ctx,
       "GET",
       `/runbook?app=${encodeURIComponent(ctx.appId)}&limit=${limit}&offset=${offset}`
@@ -14749,7 +14880,7 @@ async function runbookList(ctx, all, query) {
   const params = new URLSearchParams();
   if (!all) params.set("app", ctx.appId);
   if (query) params.set("q", query);
-  const page2 = await call(ctx, "GET", `/runbook${params.size ? `?${params}` : ""}`);
+  const page2 = await call2(ctx, "GET", `/runbook${params.size ? `?${params}` : ""}`);
   if (ctx.json) return ctx.out.log(JSON.stringify(page2, null, 2));
   if (!page2.records.length) return ctx.out.log("(no runbooks)");
   ctx.out.log(["SLUG", "STATUS", "V", "SCOPE", "UPDATED", "TITLE"].join("	"));
@@ -14766,7 +14897,7 @@ async function runbookGet(ctx, slug) {
   ctx.out.log(runbook.body);
 }
 async function runbookNew(ctx, slug, title, body, summary, requires) {
-  const created = await call(ctx, "POST", "/runbook", {
+  const created = await call2(ctx, "POST", "/runbook", {
     appId: ctx.appId,
     input: { slug, title, body, ...summary ? { summary } : {}, ...requires ? { requires } : {} }
   });
@@ -14774,7 +14905,7 @@ async function runbookNew(ctx, slug, title, body, summary, requires) {
 }
 async function runbookEdit(ctx, slug, body, note, requires, expectedVersion) {
   const runbook = await bySlug(ctx, slug);
-  const result = await call(ctx, "PATCH", `/runbook/${encodeURIComponent(runbook.id)}`, {
+  const result = await call2(ctx, "PATCH", `/runbook/${encodeURIComponent(runbook.id)}`, {
     // An empty --requires clears the declaration; omitting the flag leaves
     // whatever is there, so an ordinary body edit never drops it.
     patch: {
@@ -14789,7 +14920,7 @@ async function runbookEdit(ctx, slug, body, note, requires, expectedVersion) {
 }
 async function runbookStatus(ctx, slug, status) {
   const runbook = await bySlug(ctx, slug);
-  const result = await call(ctx, "PATCH", `/runbook/${encodeURIComponent(runbook.id)}`, {
+  const result = await call2(ctx, "PATCH", `/runbook/${encodeURIComponent(runbook.id)}`, {
     patch: { status }
   });
   ctx.out.log(ctx.json ? JSON.stringify(result, null, 2) : `${slug} \u2192 ${status}`);
@@ -14798,7 +14929,7 @@ async function runbookVisibility(ctx, slug, visibility) {
   if (visibility !== "operator" && visibility !== "admin")
     throw new Error(`visibility must be "operator" or "admin", got "${visibility}"`);
   const runbook = await bySlug(ctx, slug);
-  const result = await call(ctx, "PATCH", `/runbook/${encodeURIComponent(runbook.id)}`, {
+  const result = await call2(ctx, "PATCH", `/runbook/${encodeURIComponent(runbook.id)}`, {
     patch: { visibility }
   });
   if (ctx.json) return ctx.out.log(JSON.stringify(result, null, 2));
@@ -14808,7 +14939,7 @@ async function runbookVisibility(ctx, slug, visibility) {
 }
 async function runbookHistory(ctx, slug) {
   const runbook = await bySlug(ctx, slug);
-  const page2 = await call(ctx, "GET", `/runbook/${encodeURIComponent(runbook.id)}/revisions`);
+  const page2 = await call2(ctx, "GET", `/runbook/${encodeURIComponent(runbook.id)}/revisions`);
   if (ctx.json) return ctx.out.log(JSON.stringify(page2, null, 2));
   ctx.out.log(`${slug} is at v${runbook.version}`);
   if (!page2.records.length) return ctx.out.log("(no earlier versions)");
@@ -14818,7 +14949,7 @@ async function runbookHistory(ctx, slug) {
 }
 async function runbookRevert(ctx, slug, version) {
   const runbook = await bySlug(ctx, slug);
-  const result = await call(
+  const result = await call2(
     ctx,
     "POST",
     `/runbook/${encodeURIComponent(runbook.id)}/revert`,
@@ -14829,7 +14960,7 @@ async function runbookRevert(ctx, slug, version) {
 }
 async function runbookRemove(ctx, slug) {
   const runbook = await bySlug(ctx, slug);
-  await call(ctx, "DELETE", `/runbook/${encodeURIComponent(runbook.id)}`);
+  await call2(ctx, "DELETE", `/runbook/${encodeURIComponent(runbook.id)}`);
   ctx.out.log(`removed ${slug}`);
 }
 var import_node_fs21, PLATFORM_SCOPE, stamp;
@@ -14898,14 +15029,9 @@ ${counts.created} created, ${counts.updated} updated, ${counts.unchanged} unchan
   );
 }
 async function upsert(ctx, r, visibility) {
-  const page2 = await call(
-    ctx,
-    "GET",
-    `/runbook?app=${encodeURIComponent(ctx.appId)}&slug=${encodeURIComponent(r.slug)}&limit=1`
-  );
-  const found = page2.records[0];
+  const found = await bySlug(ctx, r.slug).catch(() => null);
   if (!found) {
-    await call(ctx, "POST", "/runbook", {
+    await call2(ctx, "POST", "/runbook", {
       appId: ctx.appId,
       input: {
         slug: r.slug,
@@ -14924,7 +15050,7 @@ async function upsert(ctx, r, visibility) {
     ctx.out.log(`  = ${r.slug} (already current at v${found.version})`);
     return "unchanged";
   }
-  const result = await call(
+  const result = await call2(
     ctx,
     "PATCH",
     `/runbook/${encodeURIComponent(found.id)}`,
@@ -15163,7 +15289,7 @@ async function assessImpact(ctx, surfaces, all, limit) {
   for (const surface of surfaces) {
     const params = new URLSearchParams({ q: surface.query, limit: String(limit) });
     if (!all) params.set("app", ctx.appId);
-    const result = await call(ctx, "GET", `/runbook/search?${params}`);
+    const result = await call2(ctx, "GET", `/runbook/search?${params}`);
     const runbooks = result.outcome === "ranked" ? foldHits(result.hits) : result.candidates.map((c) => ({ ...c, version: 0, sections: [] }));
     out.push({ surface, runbooks });
   }
@@ -15259,7 +15385,7 @@ function lintRunbook(runbook, installed) {
 async function runbookLint(ctx, all) {
   const params = new URLSearchParams();
   if (!all) params.set("app", ctx.appId);
-  const page2 = await call(ctx, "GET", `/runbook${params.size ? `?${params}` : ""}`);
+  const page2 = await call2(ctx, "GET", `/runbook${params.size ? `?${params}` : ""}`);
   const installed = { "@odla-ai/cli": cliVersion() };
   const findings = page2.records.flatMap((runbook) => lintRunbook(runbook, installed));
   if (ctx.json) return ctx.out.log(JSON.stringify({ checked: page2.records.length, findings }, null, 2));
@@ -15294,7 +15420,7 @@ async function runbookSearch(ctx, query, all, limit) {
   const params = new URLSearchParams({ q: query });
   if (!all) params.set("app", ctx.appId);
   if (limit) params.set("limit", String(limit));
-  const result = await call(ctx, "GET", `/runbook/search?${params}`);
+  const result = await call2(ctx, "GET", `/runbook/search?${params}`);
   if (ctx.json) return ctx.out.log(JSON.stringify(result, null, 2));
   if (result.outcome === "empty-corpus") return ctx.out.log("no runbooks are available to search");
   if (result.outcome === "no-match") return ctx.out.log(`no runbook mentions "${query}"`);
@@ -15312,7 +15438,7 @@ async function runbookSearch(ctx, query, all, limit) {
   }
 }
 async function runbookAsk(ctx, question, all) {
-  const result = await call(ctx, "POST", "/runbook/ask", {
+  const result = await call2(ctx, "POST", "/runbook/ask", {
     question,
     ...all ? {} : { app: ctx.appId }
   });
@@ -15341,14 +15467,8 @@ async function runbookAsk(ctx, question, all) {
   ctx.out.log(JSDOC_POINTER);
 }
 async function runbookComment(ctx, slug, body) {
-  const page2 = await call(
-    ctx,
-    "GET",
-    `/runbook?app=${encodeURIComponent(ctx.appId)}&slug=${encodeURIComponent(slug)}&limit=1`
-  );
-  const found = page2.records[0];
-  if (!found) throw new Error(`no runbook "${slug}" in ${ctx.appId}`);
-  await call(ctx, "POST", `/runbook/${encodeURIComponent(found.id)}/comments`, { body });
+  const found = await bySlug(ctx, slug);
+  await call2(ctx, "POST", `/runbook/${encodeURIComponent(found.id)}/comments`, { body });
   ctx.out.log(`commented on ${slug} (v${found.version})`);
 }
 var JSDOC_POINTER;
@@ -15414,13 +15534,7 @@ var init_runbook_editor = __esm({
 
 // src/runbook-edit-flow.ts
 async function editRunbook(ctx, slug, deps = {}) {
-  const page2 = await call(
-    ctx,
-    "GET",
-    `/runbook?app=${encodeURIComponent(ctx.appId)}&slug=${encodeURIComponent(slug)}&limit=1`
-  );
-  const found = page2.records[0];
-  if (!found) throw new Error(`no runbook "${slug}" in ${ctx.appId}`);
+  const found = await bySlug(ctx, slug);
   ctx.out.log(`opening ${slug} v${found.version} in your editor\u2026`);
   const body = await editText(found.body, slug, deps);
   return body === null ? null : { body, expectedVersion: found.version };