@odla-ai/cli 0.38.0 → 0.38.1

package/dist/{cli-DZKEPGBZ.js → cli-LGYDXY5R.js}

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import {
   runCli
-} from "./chunk-DKOJBWRJ.js";
+} from "./chunk-HETCZVFB.js";
 import {
   exitCodeFor
 } from "./chunk-UKLSRQ5J.js";
@@ -9,4 +9,4 @@ export {
   exitCodeFor,
   runCli
 };
-//# sourceMappingURL=cli-DZKEPGBZ.js.map
+//# sourceMappingURL=cli-LGYDXY5R.js.map

package/dist/index.cjs

@@ -1858,7 +1858,11 @@ async function resolveOperatorContext(parsed, options = {}) {
   const appEnvironment = clean2(import_node_process10.default.env.ODLA_APP_ID);
   const appValue = appFlag ?? appEnvironment ?? profile.value?.app ?? loaded?.app.id ?? null;
   const appSource = appFlag ? "flag" : appEnvironment ? "environment" : profile.value?.app ? "profile" : loaded ? "config" : "unresolved";
-  if (appValue) assertOperatorName(appValue, "app");
+  if (appValue) {
+    for (const id2 of options.allowAppList ? appValue.split(",") : [appValue]) {
+      assertOperatorName(id2.trim(), "app");
+    }
+  }
   if (options.requireApp && !appValue) {
     throw new Error(
       "app context is unresolved; pass --app <id>, set ODLA_APP_ID, select --context <name>, or run inside a project with odla.config.mjs"
@@ -13737,7 +13741,11 @@ async function revoke(parsed, deps, cfg, doFetch, out, json) {
   if (json) out.log(JSON.stringify({ deviceId, revoked: true }, null, 2));
 }
 async function scopedToken2(parsed, deps, cfg, doFetch, out, label, scope = "app:device:enroll") {
-  const { credentials } = await resolveOperatorContext(parsed, { allowMissingConfig: true });
+  const { credentials } = await resolveOperatorContext(parsed, {
+    allowMissingConfig: true,
+    // A device is granted the apps named in ONE approval, so --app is a list here.
+    allowAppList: true
+  });
   const scopedTokenFile = credentials.scopedTokenFile;
   return getScopedPlatformToken({
     platform: cfg.platformUrl,