@odla-ai/cli 0.44.0 → 0.45.0

package/dist/{chunk-7MUWCSGP.js → chunk-JHB6352A.js}

@@ -1,21 +1,29 @@
 #!/usr/bin/env node
 import {
+  adoptRepoLocalCache,
+  appCredentialsFile,
+  appTokenFile,
   cliVersion,
   describeUnmet,
+  deviceSessionFile,
+  identityFile,
   looksSecret,
   parseRequires,
+  pmContextFile,
   redactSecrets,
   redactingOutput,
-  unmetRequirements
-} from "./chunk-UKLSRQ5J.js";
+  scopedTokenFile,
+  unmetRequirements,
+  updateNotice
+} from "./chunk-5MEO3BVF.js";
 
 // src/admin-ai.ts
-import process13 from "process";
+import process12 from "process";
 
 // src/token.ts
 import { OdlaError, requestToken } from "@odla-ai/db";
 import { createHash } from "crypto";
-import process10 from "process";
+import process9 from "process";
 
 // src/handshake-approval.ts
 import process3 from "process";
@@ -150,10 +158,10 @@ function handshakeWaitMs(waitSeconds, interactive = process4.stdout.isTTY === tr
 }
 
 // src/cached-credential.ts
-import { rmSync as rmSync3 } from "fs";
+import { rmSync as rmSync2 } from "fs";
 
 // src/auth-guidance.ts
-import process7 from "process";
+import process6 from "process";
 
 // src/device-session.ts
 import { existsSync, readFileSync } from "fs";
@@ -202,63 +210,9 @@ async function mintDeviceSession(platformUrl, credential2, doFetch) {
   };
 }
 
-// src/odla-home.ts
-import { chmodSync, copyFileSync, existsSync as existsSync2, mkdirSync, rmSync as rmSync2 } from "fs";
-import { homedir as homedir2 } from "os";
-import { dirname as dirname2, join as join3 } from "path";
-import process6 from "process";
-function odlaHome(env = process6.env) {
-  if (env.VITEST && !env.ODLA_HOME) {
-    throw new Error(
-      "ODLA_HOME must be set under test \u2014 resolving the real ~/.odla would write to the developer's machine"
-    );
-  }
-  return env.ODLA_HOME ?? join3(env.HOME ?? homedir2(), ".odla");
-}
-function odlaHomePath(segments, env = process6.env) {
-  return join3(odlaHome(env), ...segments);
-}
-function identityFile(env) {
-  return odlaHomePath(["identity.json"], env);
-}
-function deviceSessionFile(env) {
-  return odlaHomePath(["session.json"], env);
-}
-function appTokenFile(appId, env) {
-  return odlaHomePath(["apps", safeSegment(appId), "dev-token.json"], env);
-}
-function appCredentialsFile(appId, env) {
-  return odlaHomePath(["apps", safeSegment(appId), "credentials.json"], env);
-}
-function scopedTokenFile(env) {
-  return odlaHomePath(["admin-token.local.json"], env);
-}
-function pmContextFile(env) {
-  return odlaHomePath(["pm-context.json"], env);
-}
-function adoptRepoLocalCache(legacyPath, machinePath, out) {
-  if (!existsSync2(legacyPath) || legacyPath === machinePath) return false;
-  const superseded2 = existsSync2(machinePath);
-  if (!superseded2) {
-    mkdirSync(dirname2(machinePath), { recursive: true });
-    copyFileSync(legacyPath, machinePath);
-    chmodSync(machinePath, 384);
-  }
-  rmSync2(legacyPath, { force: true });
-  out?.error(
-    superseded2 ? `auth: removed superseded ${legacyPath}; this machine's credentials live in ${odlaHome()}` : `auth: moved ${legacyPath} into ${machinePath}; credentials are per machine now, not per worktree`
-  );
-  return true;
-}
-function safeSegment(value2) {
-  const clean4 = value2.toLowerCase().replace(/[^a-z0-9-]/g, "-").replace(/^-+|-+$/g, "");
-  if (!clean4) throw new Error(`"${value2}" is not a usable app id`);
-  return clean4;
-}
-
 // src/local.ts
-import { chmodSync as chmodSync2, existsSync as existsSync3, mkdirSync as mkdirSync2, readFileSync as readFileSync2, renameSync, writeFileSync } from "fs";
-import { dirname as dirname3, isAbsolute, relative, resolve } from "path";
+import { chmodSync, existsSync as existsSync2, mkdirSync, readFileSync as readFileSync2, renameSync, writeFileSync } from "fs";
+import { dirname as dirname2, isAbsolute, relative, resolve } from "path";
 var GITIGNORE_LINES = [".odla/*.local.json", ".odla/dev-token.json", ".dev.vars"];
 function readJsonFile(path) {
   try {
@@ -272,7 +226,7 @@ function writePrivateJson(path, value2) {
 `);
 }
 function readCredentials(path) {
-  if (!existsSync3(path)) return null;
+  if (!existsSync2(path)) return null;
   let value2;
   try {
     value2 = JSON.parse(readFileSync2(path, "utf8"));
@@ -306,7 +260,7 @@ function mergeCredential(current, update) {
 }
 function ensureGitignore(rootDir, localPaths = []) {
   const path = resolve(rootDir, ".gitignore");
-  const existing = existsSync3(path) ? readFileSync2(path, "utf8") : "";
+  const existing = existsSync2(path) ? readFileSync2(path, "utf8") : "";
   const configured = localPaths.map((localPath) => gitignoreEntry(rootDir, localPath)).filter((line2) => !!line2);
   const wanted = [.../* @__PURE__ */ new Set([...GITIGNORE_LINES, ...configured])];
   const missing = wanted.filter((line2) => !existing.split(/\r?\n/).includes(line2));
@@ -326,7 +280,7 @@ function o11yDevVars(cfg) {
 function resolveWriteDevVarsTarget(cfg, requested) {
   if (!requested) return null;
   if (requested === true) return cfg.local.devVarsFile;
-  return resolve(dirname3(cfg.configPath), requested);
+  return resolve(dirname2(cfg.configPath), requested);
 }
 function writeDevVars(path, credentials, env, o11y) {
   const entry = credentials.envs[env];
@@ -340,7 +294,7 @@ function writeDevVars(path, credentials, env, o11y) {
     if (o11y.version) lines.push(`ODLA_O11Y_VERSION="${o11y.version}"`);
     if (entry.o11yToken) lines.push(`ODLA_O11Y_TOKEN="${entry.o11yToken}"`);
   }
-  const existing = existsSync3(path) ? readFileSync2(path, "utf8") : "";
+  const existing = existsSync2(path) ? readFileSync2(path, "utf8") : "";
   const retained = existing.split(/\r?\n/).filter((line2) => !isManagedDevVar(line2));
   while (retained.at(-1) === "") retained.pop();
   const prefix = retained.length ? `${retained.join("\n")}
@@ -366,10 +320,10 @@ function isManagedDevVar(line2) {
   return !!match?.[1] && MANAGED_DEV_VARS.has(match[1]);
 }
 function writePrivateText(path, text4) {
-  mkdirSync2(dirname3(path), { recursive: true });
+  mkdirSync(dirname2(path), { recursive: true });
   const temporary = `${path}.tmp-${process.pid}-${Date.now()}`;
   writeFileSync(temporary, text4, { mode: 384 });
-  chmodSync2(temporary, 384);
+  chmodSync(temporary, 384);
   renameSync(temporary, path);
 }
 function gitignoreEntry(rootDir, path) {
@@ -385,7 +339,7 @@ function displayPath(path, rootDir = process.cwd()) {
 // src/auth-guidance.ts
 var ENROL_EVERYTHING = "npx odla-ai device enroll --no-open --wait 600";
 var ENROL_PLATFORM_WIDE = "npx odla-ai device enroll --platform-wide --device-ttl 6w --no-open --wait 600";
-function machineAuthState(audience, env = process7.env) {
+function machineAuthState(audience, env = process6.env) {
   const device = readDeviceCredential(audience, env);
   if (!device) return { enrolled: false };
   const session = readJsonFile(deviceSessionFile(env));
@@ -443,7 +397,7 @@ function explainRejectedCredential(error) {
   const tokenFile = noted;
   if (!tokenFile || !isCredentialRejection(error)) return null;
   noted = null;
-  rmSync3(tokenFile, { force: true });
+  rmSync2(tokenFile, { force: true });
   return [
     "auth: the cached credential was rejected by odla, so it was revoked before its cached expiry.",
     "   The usual cause is a newer sign-in for this account: collecting a handshake retires the",
@@ -454,9 +408,9 @@ function explainRejectedCredential(error) {
 }
 
 // src/device-session-cache.ts
-import process8 from "process";
+import process7 from "process";
 var SKEW_MS = 6e4;
-async function deviceSessionToken(platformUrl, audience, credential2, doFetch, env = process8.env) {
+async function deviceSessionToken(platformUrl, audience, credential2, doFetch, env = process7.env) {
   const path = deviceSessionFile(env);
   const cached = readJsonFile(path);
   if (cached?.token && cached.platform === audience && cached.deviceId === credential2.deviceId && (cached.expiresAt ?? 0) > Date.now() + SKEW_MS) return cached;
@@ -471,13 +425,13 @@ async function deviceSessionToken(platformUrl, audience, credential2, doFetch, e
 }
 
 // src/machine-identity.ts
-import process9 from "process";
-function readMachineIdentity(audience, env = process9.env) {
+import process8 from "process";
+function readMachineIdentity(audience, env = process8.env) {
   const stored = readJsonFile(identityFile(env));
   if (!stored || typeof stored.email !== "string" || !stored.email) return null;
   return stored.platform === audience ? { platform: audience, email: stored.email } : null;
 }
-function rememberMachineIdentity(audience, email, env = process9.env) {
+function rememberMachineIdentity(audience, email, env = process8.env) {
   if (!email) return;
   const existing = readMachineIdentity(audience, env);
   if (existing?.email === email) return;
@@ -492,14 +446,14 @@ async function getDeveloperToken(cfg, options, doFetch, out, grantRequest = {})
   const cached = readJsonFile(cfg.local.tokenFile);
   if (!grantRequest.forceReview && !grantRequest.freshLogin) {
     if (options.token) return options.token;
-    if (process10.env.ODLA_DEV_TOKEN) {
-      const declared = process10.env.ODLA_DEV_TOKEN_AUDIENCE;
+    if (process9.env.ODLA_DEV_TOKEN) {
+      const declared = process9.env.ODLA_DEV_TOKEN_AUDIENCE;
       if (declared) {
         if (platformAudience(declared) !== audience) throw new Error("ODLA_DEV_TOKEN_AUDIENCE does not match the configured platform");
       } else if (audience !== "https://odla.ai") {
         throw new Error("ODLA_DEV_TOKEN_AUDIENCE is required for a non-default platform");
       }
-      return process10.env.ODLA_DEV_TOKEN;
+      return process9.env.ODLA_DEV_TOKEN;
     }
     const device = readDeviceCredential(audience);
     if (device) {
@@ -614,7 +568,7 @@ function stillPending(pending, email) {
   );
 }
 function handshakeEmail(value2, cached) {
-  const email = (value2 ?? process10.env.ODLA_USER_EMAIL ?? cached ?? "").trim().toLowerCase();
+  const email = (value2 ?? process9.env.ODLA_USER_EMAIL ?? cached ?? "").trim().toLowerCase();
   if (/@users\.noreply\.github\.com$/i.test(email)) {
     throw new Error(
       `"${email}" is a GitHub commit identity, not an odla account email; use --email <signed-in-odla-account> or ODLA_USER_EMAIL`
@@ -645,12 +599,12 @@ function platformAudience(value2) {
 }
 
 // src/secret-input.ts
-import process11 from "process";
+import process10 from "process";
 var MAX_BYTES = 64 * 1024;
 async function secretInputValue(options, kind = "credential") {
   if (options.fromEnv && options.stdin) throw new Error("choose exactly one of --from-env or --stdin");
   let value2;
-  if (options.fromEnv) value2 = process11.env[options.fromEnv];
+  if (options.fromEnv) value2 = process10.env[options.fromEnv];
   else if (options.stdin) value2 = await (options.readStdin ?? (() => readSecretStream(kind)))();
   else throw new Error(`${kind} input required: use --from-env <NAME> or --stdin; values are never accepted as arguments`);
   value2 = value2?.replace(/[\r\n]+$/, "");
@@ -658,7 +612,7 @@ async function secretInputValue(options, kind = "credential") {
   if (new TextEncoder().encode(value2).byteLength > MAX_BYTES) throw new Error(`${kind} exceeds 64 KiB`);
   return value2;
 }
-async function readSecretStream(kind, stream = process11.stdin) {
+async function readSecretStream(kind, stream = process10.stdin) {
   let value2 = "";
   for await (const chunk of stream) {
     value2 += String(chunk);
@@ -668,8 +622,8 @@ async function readSecretStream(kind, stream = process11.stdin) {
 }
 
 // src/admin-ai-auth.ts
-import { join as join4 } from "path";
-import process12 from "process";
+import { join as join3 } from "path";
+import process11 from "process";
 import { requestToken as requestToken2 } from "@odla-ai/db";
 async function getScopedPlatformToken(options) {
   return resolveAdminPlatformToken(options);
@@ -677,7 +631,7 @@ async function getScopedPlatformToken(options) {
 async function resolveAdminPlatformToken(options) {
   const audience = platformAudience(options.platform);
   if (options.token) return options.token;
-  const fromEnv = process12.env.ODLA_ADMIN_TOKEN;
+  const fromEnv = process11.env.ODLA_ADMIN_TOKEN;
   if (fromEnv) return audienceBoundEnvToken(fromEnv, audience);
   return scopedToken(
     audience,
@@ -689,7 +643,7 @@ async function resolveAdminPlatformToken(options) {
 }
 function audienceBoundEnvToken(token, platform) {
   const audience = platformAudience(platform);
-  const declared = process12.env.ODLA_ADMIN_TOKEN_AUDIENCE;
+  const declared = process11.env.ODLA_ADMIN_TOKEN_AUDIENCE;
   if (declared) {
     if (platformAudience(declared) !== audience) throw new Error("ODLA_ADMIN_TOKEN_AUDIENCE does not match the configured platform");
   } else if (audience !== "https://odla.ai") {
@@ -716,9 +670,9 @@ var SCOPE_PURPOSE = {
 };
 async function scopedToken(platform, scope, options, doFetch, out) {
   const audience = platformAudience(platform);
-  const rootDir = options.rootDir ?? process12.cwd();
+  const rootDir = options.rootDir ?? process11.cwd();
   const tokenFile = options.tokenFile ?? scopedTokenFile();
-  adoptRepoLocalCache(join4(rootDir, ".odla/admin-token.local.json"), tokenFile, out);
+  adoptRepoLocalCache(join3(rootDir, ".odla/admin-token.local.json"), tokenFile, out);
   const device = readDeviceCredential(audience);
   if (device && options.cache !== false) {
     const session = await deviceSessionToken(platform, audience, device, doFetch);
@@ -934,7 +888,7 @@ function isRecord2(value2) {
 
 // src/admin-ai.ts
 async function adminAi(options) {
-  const platform = platformAudience(options.platform ?? process13.env.ODLA_PLATFORM ?? "https://odla.ai");
+  const platform = platformAudience(options.platform ?? process12.env.ODLA_PLATFORM ?? "https://odla.ai");
   const doFetch = options.fetch ?? fetch;
   const out = options.stdout ?? console;
   const usageQuery = options.action === "usage" ? adminAiUsageQuery(options) : void 0;
@@ -1446,13 +1400,13 @@ async function adminSpend(parsed, ctx) {
 }
 
 // src/operator-context.ts
-import { existsSync as existsSync6 } from "fs";
-import { join as join6, resolve as resolve4 } from "path";
-import process15 from "process";
+import { existsSync as existsSync5 } from "fs";
+import { join as join5, resolve as resolve4 } from "path";
+import process14 from "process";
 
 // src/config.ts
-import { existsSync as existsSync4, rmSync as rmSync4, readFileSync as readFileSync3 } from "fs";
-import { dirname as dirname4, isAbsolute as isAbsolute2, resolve as resolve2 } from "path";
+import { existsSync as existsSync3, rmSync as rmSync3, readFileSync as readFileSync3 } from "fs";
+import { dirname as dirname3, isAbsolute as isAbsolute2, resolve as resolve2 } from "path";
 import { pathToFileURL } from "url";
 import { appServiceDefinition, appServiceIds } from "@odla-ai/apps";
 
@@ -1862,11 +1816,11 @@ var stderr = { error: (message2) => {
 } };
 async function loadProjectConfig(configPath = "odla.config.mjs", options = {}) {
   const resolved = resolve2(configPath);
-  if (!existsSync4(resolved)) {
+  if (!existsSync3(resolved)) {
     throw new Error(`config not found: ${configPath}. Run "odla-ai init" first or pass --config.`);
   }
   const raw = await loadConfigModule(resolved);
-  const rootDir = dirname4(resolved);
+  const rootDir = dirname3(resolved);
   validateRawConfig(raw, resolved);
   const platformUrl = trimSlash(process.env.ODLA_PLATFORM_URL || raw.platformUrl || DEFAULT_PLATFORM);
   const dbEndpoint = trimSlash(process.env.ODLA_DB_ENDPOINT || raw.dbEndpoint || platformUrl);
@@ -1883,7 +1837,7 @@ async function loadProjectConfig(configPath = "odla.config.mjs", options = {}) {
   };
   adoptRepoLocalCache(resolve2(rootDir, ".odla/dev-token.json"), local.tokenFile, stderr);
   adoptRepoLocalCache(resolve2(rootDir, ".odla/credentials.local.json"), local.credentialsFile, stderr);
-  rmSync4(resolve2(rootDir, ".odla/handshake.local.json"), { force: true });
+  rmSync3(resolve2(rootDir, ".odla/handshake.local.json"), { force: true });
   return {
     ...raw,
     configPath: resolved,
@@ -1991,18 +1945,18 @@ function unique3(values) {
 }
 
 // src/operator-profiles.ts
-import { existsSync as existsSync5, readFileSync as readFileSync4 } from "fs";
-import { homedir as homedir3 } from "os";
-import { dirname as dirname5, join as join5, resolve as resolve3 } from "path";
-import process14 from "process";
+import { existsSync as existsSync4, readFileSync as readFileSync4 } from "fs";
+import { homedir as homedir2 } from "os";
+import { dirname as dirname4, join as join4, resolve as resolve3 } from "path";
+import process13 from "process";
 function operatorProfileFile() {
   return resolve3(
-    clean(process14.env.ODLA_CONTEXT_FILE) ?? join5(homedir3(), ".odla", "contexts.json")
+    clean(process13.env.ODLA_CONTEXT_FILE) ?? join4(homedir2(), ".odla", "contexts.json")
   );
 }
 function resolveOperatorProfile(parsed) {
   const fromFlag = clean(stringOpt(parsed.options.context));
-  const fromEnvironment = clean(process14.env.ODLA_CONTEXT);
+  const fromEnvironment = clean(process13.env.ODLA_CONTEXT);
   const name = fromFlag ?? fromEnvironment ?? null;
   const file = operatorProfileFile();
   if (!name) {
@@ -2042,10 +1996,10 @@ function removeOperatorProfile(name, file = operatorProfileFile()) {
   return true;
 }
 function operatorCredentialFiles(selection) {
-  const base = selection.name ? join5(dirname5(selection.file), "profiles", selection.name) : join5(homedir3(), ".odla");
+  const base = selection.name ? join4(dirname4(selection.file), "profiles", selection.name) : join4(homedir2(), ".odla");
   return {
-    developer: join5(base, "dev-token.json"),
-    scoped: join5(base, "admin-token.local.json")
+    developer: join4(base, "dev-token.json"),
+    scoped: join4(base, "admin-token.local.json")
   };
 }
 function assertOperatorName(value2, label) {
@@ -2056,7 +2010,7 @@ function assertOperatorName(value2, label) {
   }
 }
 function readOperatorProfiles(file) {
-  if (!existsSync5(file)) return emptyProfiles();
+  if (!existsSync4(file)) return emptyProfiles();
   let raw;
   try {
     raw = JSON.parse(readFileSync4(file, "utf8"));
@@ -2125,19 +2079,19 @@ async function resolveOperatorContext(parsed, options = {}) {
   const configArgument = stringOpt(parsed.options.config) ?? "odla.config.mjs";
   const configPath = resolve4(configArgument);
   const explicitConfig = parsed.options.config !== void 0;
-  const hasConfig = existsSync6(configPath);
+  const hasConfig = existsSync5(configPath);
   if (!hasConfig && (!options.allowMissingConfig || explicitConfig)) {
     await loadProjectConfig(configArgument);
   }
   const loaded = hasConfig ? await loadProjectConfig(configArgument) : void 0;
   const platformFlag = clean2(stringOpt(parsed.options.platform));
-  const platformEnvironment = clean2(process15.env.ODLA_PLATFORM_URL);
+  const platformEnvironment = clean2(process14.env.ODLA_PLATFORM_URL);
   const platformValue = platformAudience(
     platformFlag ?? platformEnvironment ?? profile.value?.platform ?? loaded?.platformUrl ?? DEFAULT_PLATFORM2
   );
   const platformSource = platformFlag ? "flag" : platformEnvironment ? "environment" : profile.value ? "profile" : loaded ? "config" : "default";
   const appFlag = clean2(stringOpt(parsed.options.app));
-  const appEnvironment = clean2(process15.env.ODLA_APP_ID);
+  const appEnvironment = clean2(process14.env.ODLA_APP_ID);
   const appValue = appFlag ?? appEnvironment ?? profile.value?.app ?? loaded?.app.id ?? null;
   const appSource = appFlag ? "flag" : appEnvironment ? "environment" : profile.value?.app ? "profile" : loaded ? "config" : "unresolved";
   if (appValue) {
@@ -2151,16 +2105,16 @@ async function resolveOperatorContext(parsed, options = {}) {
     );
   }
   const envFlag = clean2(stringOpt(parsed.options.env));
-  const envEnvironment = clean2(process15.env.ODLA_ENV);
+  const envEnvironment = clean2(process14.env.ODLA_ENV);
   const environmentValue = envFlag ?? envEnvironment ?? profile.value?.environment ?? options.defaultEnvironment ?? null;
   const environmentSource = envFlag ? "flag" : envEnvironment ? "environment" : profile.value?.environment ? "profile" : options.defaultEnvironment ? "default" : "unresolved";
   if (environmentValue) {
     assertOperatorName(environmentValue, "environment");
   }
-  const rootDir = loaded?.rootDir ?? process15.cwd();
+  const rootDir = loaded?.rootDir ?? process14.cwd();
   const profileCredentials = operatorCredentialFiles(profile);
-  const tokenFile = clean2(process15.env.ODLA_DEV_TOKEN_FILE) ? resolve4(process15.env.ODLA_DEV_TOKEN_FILE) : profile.name ? profileCredentials.developer : loaded?.local.tokenFile ?? profileCredentials.developer;
-  const scopedTokenFile2 = clean2(process15.env.ODLA_ADMIN_TOKEN_FILE) ? resolve4(process15.env.ODLA_ADMIN_TOKEN_FILE) : profile.name ? profileCredentials.scoped : loaded ? join6(loaded.rootDir, ".odla", "admin-token.local.json") : profileCredentials.scoped;
+  const tokenFile = clean2(process14.env.ODLA_DEV_TOKEN_FILE) ? resolve4(process14.env.ODLA_DEV_TOKEN_FILE) : profile.name ? profileCredentials.developer : loaded?.local.tokenFile ?? profileCredentials.developer;
+  const scopedTokenFile2 = clean2(process14.env.ODLA_ADMIN_TOKEN_FILE) ? resolve4(process14.env.ODLA_ADMIN_TOKEN_FILE) : profile.name ? profileCredentials.scoped : loaded ? join5(loaded.rootDir, ".odla", "admin-token.local.json") : profileCredentials.scoped;
   const cfg = loaded ? {
     ...loaded,
     platformUrl: platformValue,
@@ -2182,8 +2136,8 @@ async function resolveOperatorContext(parsed, options = {}) {
     services: [],
     local: {
       tokenFile,
-      credentialsFile: join6(rootDir, ".odla", "credentials.local.json"),
-      devVarsFile: join6(rootDir, ".dev.vars"),
+      credentialsFile: join5(rootDir, ".odla", "credentials.local.json"),
+      devVarsFile: join5(rootDir, ".dev.vars"),
       gitignore: true
     }
   };
@@ -2307,7 +2261,7 @@ async function adminCommand(parsed, deps = {}) {
 }
 
 // src/auth-command.ts
-import process16 from "process";
+import process15 from "process";
 
 // src/whoami-command.ts
 var text2 = (value2) => typeof value2 === "string" && value2.trim() ? value2.trim() : null;
@@ -2491,7 +2445,7 @@ async function authCommand(parsed, deps = {}) {
   const { cfg } = context;
   const out = deps.stdout ?? console;
   const doFetch = deps.fetch ?? fetch;
-  const email = stringOpt(parsed.options.email) ?? process16.env.ODLA_USER_EMAIL?.trim();
+  const email = stringOpt(parsed.options.email) ?? process15.env.ODLA_USER_EMAIL?.trim();
   if (!email) {
     throw new Error(
       "auth login requires --email <odla-account> or ODLA_USER_EMAIL; confirm the signed-in odla email instead of using git or GitHub identity"
@@ -2859,7 +2813,7 @@ async function appCommand(parsed, dependencies = {}) {
 
 // src/brand-command.ts
 import { mkdir, readFile, writeFile } from "fs/promises";
-import { dirname as dirname6, resolve as resolve5 } from "path";
+import { dirname as dirname5, resolve as resolve5 } from "path";
 
 // src/brand-design-unpack.ts
 import { gunzipSync } from "zlib";
@@ -2974,7 +2928,7 @@ async function readBundle(source, deps) {
 async function writeAll(result, outDir) {
   for (const file of result.files) {
     const target = resolve5(outDir, file.path);
-    await mkdir(dirname6(target), { recursive: true });
+    await mkdir(dirname5(target), { recursive: true });
     await writeFile(target, file.bytes);
   }
 }
@@ -3541,7 +3495,7 @@ import {
   AppsError,
   createAppsClient
 } from "@odla-ai/apps";
-import { join as join7 } from "path";
+import { join as join6 } from "path";
 
 // src/config-operation-error.ts
 var ConfigOperationCommandError = class extends Error {
@@ -3966,7 +3920,7 @@ async function operationClient(cfg, options, purpose) {
     platform: cfg.platformUrl,
     scope: "app:config:write",
     token: options.token,
-    tokenFile: join7(cfg.rootDir, ".odla", "admin-token.local.json"),
+    tokenFile: join6(cfg.rootDir, ".odla", "admin-token.local.json"),
     rootDir: cfg.rootDir,
     email: options.email,
     open: options.open,
@@ -4021,7 +3975,7 @@ function record4(value2) {
 
 // src/config-reconcile-command.ts
 import { createAppsClient as createAppsClient2, studioAppSettingsPath } from "@odla-ai/apps";
-import { join as join8 } from "path";
+import { join as join7 } from "path";
 
 // src/config-reconcile.ts
 import { appServiceIds as appServiceIds2, orderAppServices as orderAppServices2 } from "@odla-ai/apps";
@@ -4317,7 +4271,7 @@ async function inspectConfig(options) {
     platform: cfg.platformUrl,
     scope: "app:config:read",
     token: options.token,
-    tokenFile: join8(cfg.rootDir, ".odla", "admin-token.local.json"),
+    tokenFile: join7(cfg.rootDir, ".odla", "admin-token.local.json"),
     rootDir: cfg.rootDir,
     email: options.email,
     open: options.open,
@@ -4449,13 +4403,13 @@ function quoteArg2(value2) {
 
 // src/doctor-checks.ts
 import { execFileSync } from "child_process";
-import { existsSync as existsSync8, readFileSync as readFileSync8 } from "fs";
-import { join as join10, resolve as resolve6 } from "path";
+import { existsSync as existsSync7, readFileSync as readFileSync8 } from "fs";
+import { join as join9, resolve as resolve6 } from "path";
 
 // src/wrangler.ts
 import { spawn as spawn2 } from "child_process";
-import { existsSync as existsSync7, readFileSync as readFileSync7 } from "fs";
-import { join as join9 } from "path";
+import { existsSync as existsSync6, readFileSync as readFileSync7 } from "fs";
+import { join as join8 } from "path";
 var defaultRunner = (cmd, args, opts) => new Promise((resolvePromise, reject) => {
   const child = spawn2(cmd, args, { cwd: opts?.cwd, stdio: ["pipe", "pipe", "pipe"] });
   let stdout = "";
@@ -4469,8 +4423,8 @@ var defaultRunner = (cmd, args, opts) => new Promise((resolvePromise, reject) =>
 var WRANGLER_CONFIG_FILES = ["wrangler.jsonc", "wrangler.json", "wrangler.toml"];
 function findWranglerConfig(rootDir) {
   for (const name of WRANGLER_CONFIG_FILES) {
-    const path = join9(rootDir, name);
-    if (existsSync7(path)) return path;
+    const path = join8(rootDir, name);
+    if (existsSync6(path)) return path;
   }
   return null;
 }
@@ -4630,7 +4584,7 @@ function wranglerWarnings(rootDir) {
       const dir = resolve6(rootDir, assets.directory);
       if (dir === resolve6(rootDir)) {
         warnings.push(`${label}assets.directory is the project root \u2014 point it at a dedicated build dir (wrangler dev fails with "spawn EBADF")`);
-      } else if (existsSync8(join10(dir, "node_modules"))) {
+      } else if (existsSync7(join9(dir, "node_modules"))) {
         warnings.push(`${label}assets.directory contains node_modules \u2014 wrangler dev's watcher will exhaust file descriptors`);
       }
     }
@@ -4666,7 +4620,7 @@ function o11yProjectWarnings(rootDir) {
     return warnings;
   }
   const main = typeof config.main === "string" ? resolve6(rootDir, config.main) : null;
-  if (!main || !existsSync8(main)) {
+  if (!main || !existsSync7(main)) {
     warnings.push("cannot verify o11y Worker instrumentation \u2014 wrangler main is missing or unreadable");
   } else {
     let source = "";
@@ -4695,7 +4649,7 @@ function calendarProjectWarnings(rootDir) {
 }
 function readPackageJson(rootDir) {
   try {
-    return JSON.parse(readFileSync8(join10(rootDir, "package.json"), "utf8"));
+    return JSON.parse(readFileSync8(join9(rootDir, "package.json"), "utf8"));
   } catch {
     return null;
   }
@@ -4989,14 +4943,14 @@ function harnessOption(value2, flag) {
 }
 
 // src/init.ts
-import { existsSync as existsSync9, mkdirSync as mkdirSync3, writeFileSync as writeFileSync2 } from "fs";
-import { dirname as dirname7, resolve as resolve7 } from "path";
+import { existsSync as existsSync8, mkdirSync as mkdirSync2, writeFileSync as writeFileSync2 } from "fs";
+import { dirname as dirname6, resolve as resolve7 } from "path";
 import { appServiceDefinition as appServiceDefinition3, appServiceIds as appServiceIds3 } from "@odla-ai/apps";
 function initProject(options) {
   const out = options.stdout ?? console;
   const rootDir = resolve7(options.rootDir ?? process.cwd());
   const configPath = resolve7(rootDir, options.configPath ?? "odla.config.mjs");
-  if (existsSync9(configPath) && !options.force) {
+  if (existsSync8(configPath) && !options.force) {
     throw new Error(`${configPath} already exists. Pass --force to overwrite.`);
   }
   if (!/^[a-z0-9][a-z0-9-]*$/.test(options.appId)) {
@@ -5012,9 +4966,9 @@ function initProject(options) {
     }
   }
   const aiProvider = options.aiProvider;
-  mkdirSync3(dirname7(configPath), { recursive: true });
-  mkdirSync3(resolve7(rootDir, "src/odla"), { recursive: true });
-  mkdirSync3(resolve7(rootDir, ".odla"), { recursive: true });
+  mkdirSync2(dirname6(configPath), { recursive: true });
+  mkdirSync2(resolve7(rootDir, "src/odla"), { recursive: true });
+  mkdirSync2(resolve7(rootDir, ".odla"), { recursive: true });
   writeFileSync2(configPath, configTemplate({ appId: options.appId, name: options.name, envs, services, aiProvider }));
   writeIfMissing(resolve7(rootDir, "src/odla/schema.mjs"), schemaTemplate());
   writeIfMissing(resolve7(rootDir, "src/odla/rules.mjs"), rulesTemplate());
@@ -5024,7 +4978,7 @@ function initProject(options) {
   out.log("updated .gitignore for local odla credentials");
 }
 function writeIfMissing(path, text4) {
-  if (existsSync9(path)) return;
+  if (existsSync8(path)) return;
   writeFileSync2(path, text4);
 }
 function configTemplate(input) {
@@ -5323,9 +5277,9 @@ function printReport(report5, out) {
 }
 
 // src/skill.ts
-import { existsSync as existsSync10, lstatSync, mkdirSync as mkdirSync4, readFileSync as readFileSync9, readdirSync, writeFileSync as writeFileSync3 } from "fs";
-import { homedir as homedir4 } from "os";
-import { dirname as dirname8, isAbsolute as isAbsolute3, join as join11, relative as relative2, resolve as resolve8, sep } from "path";
+import { existsSync as existsSync9, lstatSync, mkdirSync as mkdirSync3, readFileSync as readFileSync9, readdirSync, writeFileSync as writeFileSync3 } from "fs";
+import { homedir as homedir3 } from "os";
+import { dirname as dirname7, isAbsolute as isAbsolute3, join as join10, relative as relative2, resolve as resolve8, sep } from "path";
 import { fileURLToPath } from "url";
 
 // src/skill-adapters.ts
@@ -5425,7 +5379,7 @@ function installSkill(options = {}) {
   if (files.length === 0) throw new Error(`no bundled skills found at ${sourceDir}`);
   const harnesses = normalizeHarnesses(options.harnesses, options.global === true);
   const root = resolve8(options.dir ?? process.cwd());
-  const home = resolve8(options.homeDir ?? homedir4());
+  const home = resolve8(options.homeDir ?? homedir3());
   const plans = /* @__PURE__ */ new Map();
   const targets = /* @__PURE__ */ new Map();
   const rememberTarget = (harness, target) => {
@@ -5439,48 +5393,48 @@ function installSkill(options = {}) {
     plans.set(target, { target, content: content2, boundary, managedMerge });
   };
   const planSkillTree = (targetDir2, boundary = root) => {
-    for (const rel of files) plan(join11(targetDir2, rel), readFileSync9(join11(sourceDir, rel), "utf8"), false, boundary);
+    for (const rel of files) plan(join10(targetDir2, rel), readFileSync9(join10(sourceDir, rel), "utf8"), false, boundary);
   };
   let targetDir;
   if (options.global) {
-    const claudeRoot = join11(home, ".claude", "skills");
-    const codexRoot = resolve8(options.codexHomeDir ?? process.env.CODEX_HOME ?? join11(home, ".codex"), "skills");
+    const claudeRoot = join10(home, ".claude", "skills");
+    const codexRoot = resolve8(options.codexHomeDir ?? process.env.CODEX_HOME ?? join10(home, ".codex"), "skills");
     targetDir = harnesses[0] === "codex" ? codexRoot : claudeRoot;
     for (const harness of harnesses) {
       const skillRoot = harness === "claude" ? claudeRoot : codexRoot;
-      planSkillTree(skillRoot, harness === "claude" ? home : dirname8(dirname8(codexRoot)));
+      planSkillTree(skillRoot, harness === "claude" ? home : dirname7(dirname7(codexRoot)));
       rememberTarget(harness, skillRoot);
     }
   } else {
-    const sharedRoot = join11(root, ".agents", "skills");
+    const sharedRoot = join10(root, ".agents", "skills");
     planSkillTree(sharedRoot);
-    const claudeRoot = join11(root, ".claude", "skills");
+    const claudeRoot = join10(root, ".claude", "skills");
     targetDir = harnesses.includes("claude") ? claudeRoot : sharedRoot;
     for (const harness of harnesses) rememberTarget(harness, sharedRoot);
     if (harnesses.includes("claude")) {
       for (const skill of skillNames(files)) {
-        const canonical2 = readFileSync9(join11(sourceDir, skill, "SKILL.md"), "utf8");
-        plan(join11(claudeRoot, skill, "SKILL.md"), claudeAdapter(skill, canonical2));
+        const canonical2 = readFileSync9(join10(sourceDir, skill, "SKILL.md"), "utf8");
+        plan(join10(claudeRoot, skill, "SKILL.md"), claudeAdapter(skill, canonical2));
       }
       rememberTarget("claude", claudeRoot);
     }
     if (harnesses.includes("cursor")) {
-      const cursorRule = join11(root, ".cursor", "rules", "odla.mdc");
+      const cursorRule = join10(root, ".cursor", "rules", "odla.mdc");
       plan(cursorRule, CURSOR_RULE);
       rememberTarget("cursor", cursorRule);
     }
     if (harnesses.includes("agents")) {
-      const agentsFile = join11(root, "AGENTS.md");
+      const agentsFile = join10(root, "AGENTS.md");
       plan(agentsFile, managedFileContent(agentsFile, PROJECT_INSTRUCTIONS, options.force === true, root), true);
       rememberTarget("agents", agentsFile);
     }
     if (harnesses.includes("copilot")) {
-      const copilotFile = join11(root, ".github", "copilot-instructions.md");
+      const copilotFile = join10(root, ".github", "copilot-instructions.md");
       plan(copilotFile, managedFileContent(copilotFile, PROJECT_INSTRUCTIONS, options.force === true, root), true);
       rememberTarget("copilot", copilotFile);
     }
     if (harnesses.includes("gemini")) {
-      const geminiFile = join11(root, "GEMINI.md");
+      const geminiFile = join10(root, "GEMINI.md");
       plan(geminiFile, managedFileContent(geminiFile, PROJECT_INSTRUCTIONS, options.force === true, root), true);
       rememberTarget("gemini", geminiFile);
     }
@@ -5494,7 +5448,7 @@ function installSkill(options = {}) {
       conflicts.push(`${file.target} (redirected by symbolic link ${symlink})`);
       continue;
     }
-    if (!existsSync10(file.target)) {
+    if (!existsSync9(file.target)) {
       writtenPaths.add(file.target);
       continue;
     }
@@ -5515,8 +5469,8 @@ ${conflicts.map((f) => `  - ${f}`).join("\n")}`
     );
   }
   for (const file of plans.values()) {
-    if (!existsSync10(file.target) || readFileSync9(file.target, "utf8") !== file.content) {
-      mkdirSync4(dirname8(file.target), { recursive: true });
+    if (!existsSync9(file.target) || readFileSync9(file.target, "utf8") !== file.content) {
+      mkdirSync3(dirname7(file.target), { recursive: true });
       writeFileSync3(file.target, file.content);
     }
   }
@@ -5558,7 +5512,7 @@ function normalizeHarnesses(values, global) {
 function managedFileContent(path, block2, force, boundary) {
   const symlink = symlinkedComponent(boundary, path);
   if (symlink) throw new Error(`refusing to manage ${path}: symbolic link component ${symlink}`);
-  if (!existsSync10(path)) return `${block2}
+  if (!existsSync9(path)) return `${block2}
 `;
   const current = readFileSync9(path, "utf8");
   const start = "<!-- odla-ai agent setup:start -->";
@@ -5587,7 +5541,7 @@ function symlinkedComponent(boundary, target) {
   }
   let current = boundary;
   for (const part of rel.split(sep).filter(Boolean)) {
-    current = join11(current, part);
+    current = join10(current, part);
     try {
       if (lstatSync(current).isSymbolicLink()) return current;
     } catch (error) {
@@ -5600,11 +5554,11 @@ function skillNames(files) {
   return [...new Set(files.filter((file) => /(^|[\\/])SKILL\.md$/.test(file)).map((file) => file.split(/[\\/]/)[0]))].sort();
 }
 function listFiles(dir) {
-  if (!existsSync10(dir)) return [];
+  if (!existsSync9(dir)) return [];
   const results = [];
   const walk = (current) => {
     for (const entry of readdirSync(current, { withFileTypes: true })) {
-      const path = join11(current, entry.name);
+      const path = join10(current, entry.name);
       if (entry.isDirectory()) walk(path);
       else results.push(relative2(dir, path));
     }
@@ -5957,7 +5911,7 @@ async function projectCommand(command, parsed, deps) {
 }
 
 // src/code-connect.ts
-import { existsSync as existsSync11 } from "fs";
+import { existsSync as existsSync10 } from "fs";
 import { cpus, hostname, totalmem } from "os";
 import { resolve as resolve11 } from "path";
 
@@ -5968,7 +5922,7 @@ var HARNESS_PROTOCOL_VERSION = 1;
 import { execFile, spawn as spawn3 } from "child_process";
 import { constants } from "fs";
 import { access } from "fs/promises";
-import { delimiter, join as join12 } from "path";
+import { delimiter, join as join11 } from "path";
 import { getgid, getuid } from "process";
 import { mkdir as mkdir2, mkdtemp, realpath, rm, writeFile as writeFile2 } from "fs/promises";
 import { tmpdir } from "os";
@@ -5986,7 +5940,7 @@ function assertPinnedImage(image) {
 async function commandAvailable(engine) {
   for (const directory of (process.env.PATH ?? "").split(delimiter).filter(Boolean)) {
     try {
-      await access(join12(directory, engine), constants.X_OK);
+      await access(join11(directory, engine), constants.X_OK);
       return true;
     } catch {
     }
@@ -6684,10 +6638,10 @@ import { randomUUID } from "crypto";
 import { createHash as createHash22, randomUUID as randomUUID2 } from "crypto";
 import { createReadStream } from "fs";
 import { lstat as lstat22 } from "fs/promises";
-import { join as join14 } from "path";
+import { join as join13 } from "path";
 import { mkdir as mkdir3, mkdtemp as mkdtemp3, rm as rm3, writeFile as writeFile3 } from "fs/promises";
 import { tmpdir as tmpdir3 } from "os";
-import { dirname as dirname10, join as join23, resolve as resolve32, sep as sep23 } from "path";
+import { dirname as dirname9, join as join23, resolve as resolve32, sep as sep23 } from "path";
 import {
   keepRecentExchanges,
   runAgent
@@ -7085,11 +7039,11 @@ function rollup(graph, kind, options = {}) {
 }
 
 // ../graph/dist/code/index.js
-function dirname9(path) {
+function dirname8(path) {
   const at = path.lastIndexOf("/");
   return at <= 0 ? "." : path.slice(0, at);
 }
-function join13(base, specifier) {
+function join12(base, specifier) {
   const parts = [];
   const segments = `${base === "." ? "" : `${base}/`}${specifier}`.split("/");
   for (const segment of segments) {
@@ -7113,7 +7067,7 @@ var BARE_IMPORT = /^\s*import\s*["']([^"']+)["']/gm;
 var isSourcePath = (path) => SOURCE.test(path);
 function resolveImport(fromPath, specifier, known) {
   if (!specifier.startsWith(".")) return null;
-  const base = join13(dirname9(fromPath), specifier);
+  const base = join12(dirname8(fromPath), specifier);
   const candidates = [
     base,
     base.replace(/\.js$/, ".ts"),
@@ -7917,7 +7871,7 @@ async function inspectArtifacts(workspaceDir, recipe2) {
   const receipts = [];
   for (const artifact of recipe2.expectedArtifacts ?? []) {
     try {
-      const path = join14(workspaceDir, artifact.path);
+      const path = join13(workspaceDir, artifact.path);
       const info = await lstat22(path);
       if (!info.isFile() || info.isSymbolicLink()) {
         receipts.push({ artifactId: artifact.id, status: "invalid", bytes: null, digest: null });
@@ -8206,7 +8160,7 @@ async function materializeCodeRuntimeSource(snapshot, tempRoot = tmpdir3()) {
       if (bytes > SOURCE_MAX_BYTES) throw new TypeError("Code source exceeds its byte bound");
       const target = resolve32(sourceDir, file.path);
       if (!target.startsWith(`${resolve32(sourceDir)}${sep23}`)) throw new TypeError("Code source path escapes its root");
-      await mkdir3(dirname10(target), { recursive: true });
+      await mkdir3(dirname9(target), { recursive: true });
       await writeFile3(target, file.content, { flag: "wx", mode: 420 });
     }
     for (const reference of snapshot.references ?? []) {
@@ -8221,7 +8175,7 @@ async function materializeCodeRuntimeSource(snapshot, tempRoot = tmpdir3()) {
         if (bytes > SOURCE_SET_MAX_BYTES) throw new TypeError("Code source set exceeds its byte bound");
         const target = resolve32(sourceDir, path);
         if (!target.startsWith(`${resolve32(sourceDir)}${sep23}`)) throw new TypeError("Code reference path escapes its root");
-        await mkdir3(dirname10(target), { recursive: true });
+        await mkdir3(dirname9(target), { recursive: true });
         await writeFile3(target, file.content, { flag: "wx", mode: 292 });
       }
     }
@@ -8248,7 +8202,7 @@ async function attachCodeRuntimeReferences(workspace, references) {
       for (const root of [workspace.baselineDir, workspace.workspaceDir]) {
         const target = resolve32(root, path);
         if (!target.startsWith(`${resolve32(root)}${sep23}`)) throw new TypeError("Code reference path escapes its root");
-        await mkdir3(dirname10(target), { recursive: true });
+        await mkdir3(dirname9(target), { recursive: true });
         await writeFile3(target, file.content, { flag: "wx", mode: 292 });
       }
     }
@@ -10311,7 +10265,7 @@ var CODE_BUILD_RECIPES = Object.freeze([{
 async function codeConnect(options) {
   const cwd = options.cwd ?? process.cwd();
   const configPath = resolve11(cwd, options.configPath);
-  const cfg = existsSync11(configPath) ? await loadProjectConfig(configPath) : null;
+  const cfg = existsSync10(configPath) ? await loadProjectConfig(configPath) : null;
   const requestedAppId = options.appId?.trim();
   if (requestedAppId && !/^[a-z0-9][a-z0-9-]{1,62}$/.test(requestedAppId)) {
     throw new Error("--app-id must be a valid odla app id");
@@ -10740,13 +10694,13 @@ async function codeCommand(parsed, dependencies) {
 }
 
 // src/operator-credentials.ts
-import process17 from "process";
+import process16 from "process";
 function developerTokenStatus(context, parsed, now = Date.now()) {
   const cached = readJsonFile(context.cfg.local.tokenFile);
   const cacheStatus = !cached?.token ? "missing" : cached.platform !== context.platform.value ? "other-platform" : (cached.expiresAt ?? 0) <= now + 6e4 ? "expired" : "valid";
   const source = clean3(
     stringOpt(parsed.options.token)
-  ) ? "flag" : clean3(process17.env.ODLA_DEV_TOKEN) ? "environment" : cacheStatus === "valid" ? "cache" : "missing";
+  ) ? "flag" : clean3(process16.env.ODLA_DEV_TOKEN) ? "environment" : cacheStatus === "valid" ? "cache" : "missing";
   return {
     source,
     cacheFile: context.cfg.local.tokenFile,
@@ -11303,9 +11257,17 @@ Safety:
   grant, run it once with --request-grant. That flag ignores ODLA_DEV_TOKEN and
   the local cache, prints and opens a fresh exact-project owner-review URL, then
   continues provisioning with the approved replacement credential.
-  Before a non-dry-run provision, the executable checks npm's current CLI
-  release. A confirmed stale client stops with a safe npx rerun command; a
-  workspace-linked client also identifies the worktree that must be updated.
+  Every command says so on STDERR when this CLI is older than the one npm
+  serves, naming the repair for how this executable was launched \u2014 rebuild the
+  worktree, npm i the dependency, or npx the scoped package. The answer is read
+  from a cache under ~/.odla refreshed in the background at most every three
+  hours, so no invocation waits on the registry and stdout is never touched.
+  Set ODLA_CLI_UPDATE_CHECK=0 to switch it off.
+  Before a non-dry-run provision, the executable additionally checks npm LIVE
+  rather than trusting that cache: a security-sensitive grant shape must not
+  ride on a three-hour-old answer. A confirmed stale client stops with a safe
+  npx rerun command; a workspace-linked client also identifies the worktree
+  that must be updated.
   Run Code from a GitHub checkout already connected to an app in Studio; an
   odla.config.mjs may select the app explicitly but is not required. With an
   enrolled code.session device, the Studio repository selection authorizes the
@@ -12640,7 +12602,7 @@ async function pmWatch(ctx, parsed) {
 }
 
 // src/pm-project-context.ts
-import { existsSync as existsSync12, rmSync as rmSync5 } from "fs";
+import { existsSync as existsSync11, rmSync as rmSync4 } from "fs";
 import { resolve as resolve12 } from "path";
 var pmProjectContextFile = () => pmContextFile();
 function readPmProjectContext(rootDir) {
@@ -12657,9 +12619,9 @@ function writePmProjectContext(rootDir, value2) {
 }
 function adoptLegacySelection(rootDir) {
   const legacy = resolve12(rootDir, ".odla", "pm-project.local.json");
-  if (!existsSync12(legacy)) return;
+  if (!existsSync11(legacy)) return;
   const previous = readJsonFile(legacy);
-  rmSync5(legacy, { force: true });
+  rmSync4(legacy, { force: true });
   if (!isSelection(previous)) return;
   const selections = readSelections();
   if (selections[previous.appId]) return;
@@ -13689,7 +13651,7 @@ function percent(value2) {
 // src/provision.ts
 import { AppsError as AppsError2, createAppsClient as createAppsClient3, orderAppServices as orderAppServices3, tenantIdFor as tenantIdFor6 } from "@odla-ai/apps";
 import { putSecret as putSecret2 } from "@odla-ai/ai";
-import process18 from "process";
+import process17 from "process";
 
 // src/integration-provision.ts
 import { uuidv7 } from "@odla-ai/db";
@@ -14127,7 +14089,7 @@ async function provision(options) {
       await provisionIntegrationSeeds(doFetch, cfg.dbEndpoint, tenantId, dbKey, database.integrations, env, out);
     }
     if (cfg.services.includes("ai") && cfg.ai?.provider && cfg.ai.keyEnv) {
-      const key = process18.env[cfg.ai.keyEnv];
+      const key = process17.env[cfg.ai.keyEnv];
       if (key) {
         const secretName = cfg.ai.secretName ?? defaultSecretName(cfg.ai.provider);
         await putSecret2({ endpoint: cfg.dbEndpoint, token, fetch: doFetch }, tenantId, secretName, key);
@@ -14169,9 +14131,9 @@ async function provision(options) {
 
 // src/record.ts
 import { appendFileSync } from "fs";
-import process19 from "process";
+import process18 from "process";
 function recordInvocation(parsed) {
-  const file = process19.env.ODLA_CLI_RECORD;
+  const file = process18.env.ODLA_CLI_RECORD;
   if (!file) return;
   try {
     const entry = {
@@ -14242,9 +14204,9 @@ function parseDeviceTtl(raw) {
 }
 
 // src/device-command.ts
-import { chmodSync as chmodSync3, mkdirSync as mkdirSync5, writeFileSync as writeFileSync4 } from "fs";
-import { dirname as dirname11 } from "path";
-import process20 from "process";
+import { chmodSync as chmodSync2, mkdirSync as mkdirSync4, writeFileSync as writeFileSync4 } from "fs";
+import { dirname as dirname10 } from "path";
+import process19 from "process";
 async function deviceCommand(parsed, deps) {
   assertArgs(parsed, [
     "app",
@@ -14302,7 +14264,7 @@ async function enroll(parsed, deps, cfg, doFetch, out, json) {
     headers: { authorization: `Bearer ${token}`, "content-type": "application/json" },
     body: JSON.stringify({
       name,
-      platform: process20.platform,
+      platform: process19.platform,
       appIds: apps,
       ...capabilities ? { capabilities } : {},
       ...scopes ? { scopes } : {},
@@ -14314,14 +14276,14 @@ async function enroll(parsed, deps, cfg, doFetch, out, json) {
     throw new Error(`device enroll failed: ${body.error?.message ?? `registry returned ${response2.status}`} (${response2.status})`);
   }
   const path = deviceCredentialPath();
-  mkdirSync5(dirname11(path), { recursive: true });
+  mkdirSync4(dirname10(path), { recursive: true });
   writeFileSync4(path, JSON.stringify({
     token: body.token,
     platform: cfg.platformUrl.replace(/\/$/, ""),
     deviceId: body.device.deviceId,
     name
   }, null, 2));
-  chmodSync3(path, 384);
+  chmodSync2(path, 384);
   rememberMachineIdentity(cfg.platformUrl.replace(/\/$/, ""), stringOpt(parsed.options.email));
   supersedeAdvisory("credential.expiring");
   const reach = body.device.appIds.includes(ALL_OWNED_APPS) ? "every app you own, now and later" : body.device.appIds.join(", ");
@@ -14421,7 +14383,7 @@ async function scopedToken2(parsed, deps, cfg, doFetch, out, label, scope = "app
   });
 }
 function defaultDeviceName() {
-  return `${process20.env.HOSTNAME ?? process20.env.HOST ?? "machine"}-${process20.platform}`;
+  return `${process19.env.HOSTNAME ?? process19.env.HOST ?? "machine"}-${process19.platform}`;
 }
 
 // src/runbook-actions.ts
@@ -14565,7 +14527,7 @@ async function runbookRemove(ctx, slug) {
 
 // src/runbook-import.ts
 import { readFileSync as readFileSync11, readdirSync as readdirSync2, statSync } from "fs";
-import { basename as basename2, join as join15 } from "path";
+import { basename as basename2, join as join14 } from "path";
 function parseRunbook(text4, slug) {
   let rest = text4;
   const meta = {};
@@ -14595,7 +14557,7 @@ function readRunbookDir(dir) {
   if (!files.length) throw new Error(`no .md files in ${dir}`);
   return files.map((file) => {
     const slug = basename2(file, ".md");
-    const parsed = parseRunbook(readFileSync11(join15(dir, file), "utf8"), slug);
+    const parsed = parseRunbook(readFileSync11(join14(dir, file), "utf8"), slug);
     return { file, slug, ...parsed, words: parsed.body.split(/\s+/).filter(Boolean).length };
   });
 }
@@ -14663,8 +14625,8 @@ async function upsert(ctx, r, visibility) {
 
 // src/runbook-impact.ts
 import { execFileSync as execFileSync2 } from "child_process";
-import { existsSync as existsSync13, readFileSync as readFileSync12 } from "fs";
-import { join as join16 } from "path";
+import { existsSync as existsSync12, readFileSync as readFileSync12 } from "fs";
+import { join as join15 } from "path";
 
 // src/runbook-impact-scan.ts
 var DECL = /^[+-]\s*export\s+(?:declare\s+)?(?:default\s+)?(?:abstract\s+)?(?:async\s+)?(?:const|let|var|function|class|interface|type|enum)\s+([A-Za-z_$][\w$]*)/;
@@ -14833,8 +14795,8 @@ ${body.split("\n").map((line2) => `+${line2}`).join("\n")}
 }
 function manifestLabeller(root) {
   return (workspace) => {
-    const manifest = join16(root, workspace, "package.json");
-    if (!existsSync13(manifest)) return void 0;
+    const manifest = join15(root, workspace, "package.json");
+    if (!existsSync12(manifest)) return void 0;
     try {
       const name = JSON.parse(readFileSync12(manifest, "utf8")).name;
       return typeof name === "string" ? name : void 0;
@@ -14903,7 +14865,7 @@ function report4(ctx, impacts) {
 async function runbookImpact(ctx, options, deps = {}) {
   const cwd = deps.cwd ?? process.cwd();
   const runGit = deps.runGit ?? gitRunner(cwd);
-  const read3 = deps.readRepoFile ?? ((path) => readFileSync12(join16(cwd, path), "utf8"));
+  const read3 = deps.readRepoFile ?? ((path) => readFileSync12(join15(cwd, path), "utf8"));
   const surfaces = changedSurfaces(collectDiff(runGit, options.base, read3), manifestLabeller(cwd));
   if (!surfaces.length) {
     return ctx.out.log(
@@ -15030,12 +14992,12 @@ async function runbookComment(ctx, slug, body) {
 
 // src/runbook-editor.ts
 import { spawnSync } from "child_process";
-import { mkdtempSync, readFileSync as readFileSync13, rmSync as rmSync6, writeFileSync as writeFileSync5 } from "fs";
+import { mkdtempSync, readFileSync as readFileSync13, rmSync as rmSync5, writeFileSync as writeFileSync5 } from "fs";
 import { tmpdir as tmpdir4 } from "os";
-import { join as join17 } from "path";
-import process21 from "process";
+import { join as join16 } from "path";
+import process20 from "process";
 var EDITOR_ENV = ["ODLA_EDITOR", "VISUAL", "EDITOR"];
-function resolveEditor(env = process21.env) {
+function resolveEditor(env = process20.env) {
   for (const name of EDITOR_ENV) {
     const value2 = env[name];
     if (value2 && value2.trim()) return value2.trim();
@@ -15049,8 +15011,8 @@ function defaultRun(command, path) {
   return result.status ?? 0;
 }
 function editText(initial, slug, deps = {}) {
-  const env = deps.env ?? process21.env;
-  const interactive = deps.interactive ?? (() => Boolean(process21.stdin.isTTY));
+  const env = deps.env ?? process20.env;
+  const interactive = deps.interactive ?? (() => Boolean(process20.stdin.isTTY));
   const editor = resolveEditor(env);
   if (!editor)
     throw new Error(
@@ -15058,8 +15020,8 @@ function editText(initial, slug, deps = {}) {
     );
   if (!interactive())
     throw new Error(`cannot open an editor without a terminal \u2014 pass --file <path> or --body "\u2026" instead`);
-  const dir = mkdtempSync(join17(tmpdir4(), "odla-runbook-"));
-  const file = join17(dir, `${slug}.md`);
+  const dir = mkdtempSync(join16(tmpdir4(), "odla-runbook-"));
+  const file = join16(dir, `${slug}.md`);
   try {
     writeFileSync5(file, initial, { mode: 384 });
     const code = defaultRunOrInjected(deps)(editor, file);
@@ -15067,7 +15029,7 @@ function editText(initial, slug, deps = {}) {
     const edited = readFileSync13(file, "utf8");
     return edited === initial ? null : edited;
   } finally {
-    rmSync6(dir, { recursive: true, force: true });
+    rmSync5(dir, { recursive: true, force: true });
   }
 }
 var defaultRunOrInjected = (deps) => deps.run ?? defaultRun;
@@ -15960,6 +15922,11 @@ async function runCli(argv = process.argv.slice(2), dependencies = {}) {
     throw error;
   } finally {
     renderAdvisories(out, advisories);
+    try {
+      const behind = updateNotice();
+      if (behind) out.error(behind);
+    } catch {
+    }
   }
 }
 async function dispatchCli(argv, dependencies) {
@@ -16194,4 +16161,4 @@ export {
   isTerminalHostedSecurityStatus,
   runCli
 };
-//# sourceMappingURL=chunk-7MUWCSGP.js.map
+//# sourceMappingURL=chunk-JHB6352A.js.map