@odla-ai/cli 0.46.12 → 0.48.0

package/dist/index.cjs

@@ -1385,6 +1385,7 @@ var COMMAND_SURFACE = {
     watch: {}
   },
   provision: {},
+  promotion: { plan: {}, inspect: {}, status: {}, apply: {}, rollback: {}, next: {}, record: {}, cancel: {} },
   runbook: {
     ask: {},
     search: {},
@@ -3733,9 +3734,9 @@ function canonicalValue(value2) {
   }
   if (Array.isArray(value2)) return value2.map(canonicalValue);
   if (value2 && typeof value2 === "object") {
-    const record11 = value2;
+    const record12 = value2;
     return Object.fromEntries(
-      Object.keys(record11).filter((key) => record11[key] !== void 0).sort().map((key) => [key, canonicalValue(record11[key])])
+      Object.keys(record12).filter((key) => record12[key] !== void 0).sort().map((key) => [key, canonicalValue(record12[key])])
     );
   }
   throw new TypeError("canonical JSON rejects unsupported values");
@@ -6119,10 +6120,10 @@ var import_node_fs16 = require("fs");
 var import_node_os5 = require("os");
 var import_node_path16 = require("path");
 
-// ../harness/dist/chunk-I43KTCJ2.js
+// ../harness/dist/chunk-U324RQ4N.js
 var HARNESS_PROTOCOL_VERSION = 1;
 
-// ../harness/dist/chunk-HDIR4MM5.js
+// ../harness/dist/chunk-5LRYJKUI.js
 var import_child_process = require("child_process");
 var import_fs = require("fs");
 var import_promises2 = require("fs/promises");
@@ -6290,8 +6291,8 @@ async function materializeGitTree(source, commitSha, options = {}) {
   const maxFiles = options.maxFiles ?? 2e4;
   const maxBytes = options.maxBytes ?? 512 * 1024 * 1024;
   const inventory = (await gitOutput(sourceDir, ["ls-tree", "-rz", commitSha], 16 * 1024 * 1024)).toString("utf8").split("\0").filter(Boolean);
-  const entries = inventory.flatMap((record11) => {
-    const match = /^(100644|100755) blob ([0-9a-f]{40,64})\t([\s\S]+)$/.exec(record11);
+  const entries = inventory.flatMap((record12) => {
+    const match = /^(100644|100755) blob ([0-9a-f]{40,64})\t([\s\S]+)$/.exec(record12);
     return match && allowedWorkspacePath(match[3]) ? [{ mode: match[1], hash: match[2], path: match[3] }] : [];
   });
   if (entries.length > maxFiles) throw new Error(`workspace exceeds ${maxFiles} files`);
@@ -6495,7 +6496,165 @@ async function stageWorkspacePair(baselineSource, workspaceSource, options = {})
   }
 }
 
-// ../harness/dist/chunk-4EPJJMFG.js
+// ../harness/dist/chunk-FAN2R3GW.js
+var text3 = (value2, maximum) => {
+  if (typeof value2 !== "string") return void 0;
+  const bounded = value2.replace(/[\u0000-\u0008\u000b\u000c\u000e-\u001f\u007f]/g, " ").trim();
+  return bounded ? bounded.slice(0, maximum) : void 0;
+};
+var integer = (value2) => Number.isSafeInteger(value2) && Number(value2) >= 0 ? Number(value2) : void 0;
+var record5 = (value2) => value2 && typeof value2 === "object" && !Array.isArray(value2) ? value2 : void 0;
+var excerpt = (value2, tail = false) => {
+  if (typeof value2 !== "string") return void 0;
+  const safe = value2.replace(/[\u0000-\u0008\u000b\u000c\u000e-\u001f\u007f]/g, " ");
+  const source = (tail ? safe.slice(-1e4) : safe.slice(0, 1e4)).trim();
+  if (!source) return void 0;
+  const lines = source.split("\n").filter((line2) => line2.trim()).map((line2) => line2.slice(0, 240));
+  const selected = tail ? lines.slice(-10) : lines.slice(0, 10);
+  return text3(selected.join("\n"), 2400);
+};
+var paths = (value2) => {
+  if (!Array.isArray(value2)) return void 0;
+  const items = value2.flatMap((item) => {
+    const path = text3(item, 1024);
+    return path ? [path] : [];
+  }).slice(0, 12);
+  return items.length ? items : void 0;
+};
+function patchStats(value2) {
+  if (typeof value2 !== "string") return {};
+  let additions = 0;
+  let deletions = 0;
+  for (const line2 of value2.slice(0, 262144).split("\n")) {
+    if (line2.startsWith("+++") || line2.startsWith("---")) continue;
+    if (line2.startsWith("+")) additions += 1;
+    else if (line2.startsWith("-")) deletions += 1;
+  }
+  return { ...additions ? { additions } : {}, ...deletions ? { deletions } : {} };
+}
+function searchResults(value2) {
+  if (typeof value2 !== "string") return void 0;
+  const results = value2.split("\n").flatMap((line2) => {
+    const match = /^([^:\n]{1,1024}):(\d+):\s?(.*)$/.exec(line2);
+    if (!match) return [];
+    const lineNumber = Number(match[2]);
+    const itemText = text3(match[3], 240);
+    if (!Number.isSafeInteger(lineNumber) || lineNumber < 1) return [];
+    return [{ path: match[1], line: lineNumber, ...itemText ? { text: itemText } : {} }];
+  }).slice(0, 5);
+  return results.length ? results : void 0;
+}
+function codeToolRequestPresentation(request3) {
+  const input = request3.input;
+  if (request3.tool === "sandbox.read") {
+    const path = text3(input.path, 1024);
+    if (!path) return void 0;
+    const startLine = integer(input.startLine);
+    const endLine = integer(input.endLine);
+    return { kind: "read", path, ...startLine ? { startLine } : {}, ...endLine ? { endLine } : {} };
+  }
+  if (request3.tool === "sandbox.list") {
+    const scope = text3(input.prefix, 1024);
+    return { kind: "list", ...scope ? { scope } : {} };
+  }
+  if (request3.tool === "sandbox.search" || request3.tool === "sandbox.overview" || request3.tool === "sandbox.where_is" || request3.tool === "sandbox.who_imports" || request3.tool === "sandbox.who_touches") {
+    const query = text3(input.query, 512);
+    const scope = request3.tool === "sandbox.search" ? text3(input.prefix, 1024) : void 0;
+    if (request3.tool === "sandbox.search" && !query) return void 0;
+    return { kind: "query", ...query ? { query } : {}, ...scope ? { scope } : {} };
+  }
+  if (request3.tool === "sandbox.apply_patch") {
+    return { kind: "patch", ...patchStats(input.patch) };
+  }
+  const recipeId = text3(input.recipeId, 120);
+  return recipeId ? { kind: "recipe", recipeId } : void 0;
+}
+function codeToolResultPresentation(request3, response2) {
+  const started = codeToolRequestPresentation(request3);
+  if (!started || !response2.ok) return started;
+  const details = record5(response2.details);
+  if (started.kind === "read") {
+    return {
+      ...started,
+      ...integer(details?.startLine) ? { startLine: integer(details?.startLine) } : {},
+      ...integer(details?.endLine) ? { endLine: integer(details?.endLine) } : {},
+      ...excerpt(response2.content) ? { excerpt: excerpt(response2.content) } : {}
+    };
+  }
+  if (started.kind === "list") {
+    const listed = response2.content.split("\n").filter((line2) => line2 && !line2.startsWith("\u2026") && !line2.startsWith("Workspace ")).map((line2) => text3(line2, 1024)).filter((line2) => Boolean(line2)).slice(0, 8);
+    return {
+      ...started,
+      ...integer(details?.count) !== void 0 ? { count: integer(details?.count) } : {},
+      ...listed.length ? { paths: listed } : {}
+    };
+  }
+  if (started.kind === "query") {
+    const results = request3.tool === "sandbox.search" ? searchResults(response2.content) : void 0;
+    const resultExcerpt = request3.tool === "sandbox.search" ? void 0 : excerpt(response2.content);
+    return {
+      ...started,
+      ...integer(details?.count) !== void 0 ? { count: integer(details?.count) } : {},
+      ...results ? { results } : {},
+      ...resultExcerpt ? { excerpt: resultExcerpt } : {}
+    };
+  }
+  if (started.kind === "patch") {
+    return { ...started, ...paths(details?.paths) ? { paths: paths(details?.paths) } : {} };
+  }
+  const output = response2.content.replace(/^Recipe [^\n]*\.?\s*/u, "");
+  return {
+    ...started,
+    ...integer(details?.exitCode) !== void 0 ? { exitCode: integer(details?.exitCode) } : {},
+    ...typeof details?.timedOut === "boolean" ? { timedOut: details.timedOut } : {},
+    ...typeof details?.outputLimitExceeded === "boolean" ? { outputLimitExceeded: details.outputLimitExceeded } : {},
+    ...excerpt(output, true) ? { excerpt: excerpt(output, true) } : {}
+  };
+}
+var MAX_FAILURE_REASON = 240;
+function toolFailureReason(response2) {
+  if (response2.ok) return void 0;
+  const supplied = response2.details?.failureReason;
+  const reason = typeof supplied === "string" && supplied || DEFAULT_FAILURE_REASON[response2.content] || response2.content || "tool request failed; inspect the tool input and workspace state";
+  return reason.slice(0, MAX_FAILURE_REASON);
+}
+var DEFAULT_FAILURE_REASON = {
+  "tool denied by CaMeL policy": "tool denied by CaMeL policy",
+  "review sessions are read-only": "review session is read-only; workspace changes are not permitted"
+};
+function observedBroker(input) {
+  const now = input.now ?? Date.now;
+  return {
+    execute: async (context, request3) => {
+      const startedAt = now();
+      const operationId = input.operationIdFor(request3.requestId);
+      const startedPresentation = codeToolRequestPresentation(request3);
+      await input.emit({
+        type: "tool",
+        phase: "started",
+        tool: request3.tool,
+        operationId,
+        ...startedPresentation ? { presentation: startedPresentation } : {}
+      });
+      const response2 = await input.broker.execute(context, request3);
+      const completedPresentation = codeToolResultPresentation(request3, response2);
+      const failureReason = toolFailureReason(response2);
+      await input.emit({
+        type: "tool",
+        phase: "completed",
+        tool: request3.tool,
+        ok: response2.ok,
+        durationMs: now() - startedAt,
+        operationId,
+        ...failureReason ? { failureReason } : {},
+        ...completedPresentation ? { presentation: completedPresentation } : {}
+      });
+      return response2;
+    }
+  };
+}
+
+// ../harness/dist/chunk-Q4NL5XO3.js
 var import_crypto = require("crypto");
 var import_promises5 = require("fs/promises");
 var import_path5 = require("path");
@@ -6539,8 +6698,8 @@ function normalize(value2) {
   if (Array.isArray(value2)) return value2.map(normalize);
   if (value2 instanceof Uint8Array) return { $bytes: [...value2] };
   if (typeof value2 === "object") {
-    const record11 = value2;
-    return Object.fromEntries(Object.keys(record11).filter((key) => record11[key] !== void 0).sort().map((key) => [key, normalize(record11[key])]));
+    const record12 = value2;
+    return Object.fromEntries(Object.keys(record12).filter((key) => record12[key] !== void 0).sort().map((key) => [key, normalize(record12[key])]));
   }
   throw new CamelError("state_conflict", "Canonical JSON rejects unsupported values.");
 }
@@ -6832,7 +6991,7 @@ function validateSnapshot(snapshot, limits) {
   }
 }
 
-// ../harness/dist/chunk-4EPJJMFG.js
+// ../harness/dist/chunk-Q4NL5XO3.js
 var import_child_process4 = require("child_process");
 var import_promises6 = require("fs/promises");
 var import_path6 = require("path");
@@ -7136,7 +7295,7 @@ function looksLikeDestination(value2) {
   return /^(?:[a-z][a-z0-9+.-]*:\/\/|\/|\\\\)/i.test(text4) || /^[\w.-]+\.[a-z]{2,}(?:[/:]|$)/i.test(text4);
 }
 
-// ../harness/dist/chunk-4EPJJMFG.js
+// ../harness/dist/chunk-Q4NL5XO3.js
 var import_promises10 = require("fs/promises");
 var import_promises11 = require("fs/promises");
 var import_path10 = require("path");
@@ -7404,7 +7563,7 @@ async function buildCodeGraph(input) {
   return builder.build();
 }
 
-// ../harness/dist/chunk-4EPJJMFG.js
+// ../harness/dist/chunk-Q4NL5XO3.js
 var import_crypto4 = require("crypto");
 async function digestStagedWorkspace(root, limits) {
   const files = [];
@@ -7463,7 +7622,7 @@ function createCodeRuntimeControlClient(options) {
     }
     const value2 = await response2.json().catch(() => null);
     if (!response2.ok) {
-      const problem = record5(record5(value2)?.error);
+      const problem = record6(record6(value2)?.error);
       throw new CodeRuntimeControlError(
         typeof problem?.message === "string" ? problem.message : `Code runtime request failed (${response2.status})`,
         response2.status,
@@ -7484,12 +7643,12 @@ function createCodeRuntimeControlClient(options) {
       await call4(`/registry/code/runtime/sessions/${validSessionId(sessionId)}/source`, {})
     ),
     infer: async (sessionId, inference) => {
-      const value2 = record5(await call4(
+      const value2 = record6(await call4(
         `/registry/code/runtime/sessions/${validSessionId(sessionId)}/inference`,
         inference,
         modelRequestTimeoutMs
       ));
-      if (!value2 || value2.requestId !== inference.requestId || !record5(value2.response) || !record5(value2.receipt)) {
+      if (!value2 || value2.requestId !== inference.requestId || !record6(value2.response) || !record6(value2.receipt)) {
         throw new CodeRuntimeControlError("invalid Code inference response", 502, "invalid_response");
       }
       return value2;
@@ -7669,12 +7828,12 @@ function validateHeartbeat(version, capabilities) {
   }
 }
 function parseSnapshot(value2) {
-  const root = record5(value2);
-  const host = record5(root?.host);
+  const root = record6(value2);
+  const host = record6(root?.host);
   if (!host || typeof host.hostId !== "string" || typeof host.runtimeVersion !== "string" || !Number.isSafeInteger(host.lastSeenAt) || host.revokedAt !== null || !Array.isArray(root?.bindings) || root.bindings.length > 1024 || !Array.isArray(root?.commands) || root.commands.length > 64) throw invalid("heartbeat");
   const bindingIds = /* @__PURE__ */ new Set();
   const bindings = root.bindings.map((item) => {
-    const binding = record5(item);
+    const binding = record6(item);
     if (!binding || typeof binding.bindingId !== "string" || typeof binding.appId !== "string" || binding.env !== "dev" && binding.env !== "prod" || typeof binding.offerId !== "string" || binding.hostId !== host.hostId || !Number.isSafeInteger(binding.generation) || Number(binding.generation) < 1 || binding.revokedAt !== null || bindingIds.has(binding.bindingId)) {
       throw invalid("binding");
     }
@@ -7684,10 +7843,10 @@ function parseSnapshot(value2) {
   const commandIds = /* @__PURE__ */ new Set();
   const commandSequences = /* @__PURE__ */ new Set();
   const commands = root.commands.map((item) => {
-    const command = record5(item);
+    const command = record6(item);
     const binding = bindings.find((candidate) => candidate.bindingId === command?.bindingId);
     const sequenceKey = `${String(command?.instanceId)}:${String(command?.sequence)}`;
-    if (!command || typeof command.commandId !== "string" || !/^ccmd_[0-9a-f]{32}$/.test(command.commandId) || typeof command.instanceId !== "string" || typeof command.sessionId !== "string" || !/^csess_[0-9a-f]{32}$/.test(command.sessionId) || typeof command.appId !== "string" || command.env !== "dev" && command.env !== "prod" || command.hostId !== host.hostId || !binding || binding.appId !== command.appId || binding.generation !== command.bindingGeneration || !Number.isSafeInteger(command.sequence) || Number(command.sequence) < 1 || commandIds.has(command.commandId) || commandSequences.has(sequenceKey) || !["start", "prompt", "checkpoint_stop", "resume"].includes(String(command.kind)) || !record5(command.payload) || !Number.isSafeInteger(command.createdAt)) throw invalid("command");
+    if (!command || typeof command.commandId !== "string" || !/^ccmd_[0-9a-f]{32}$/.test(command.commandId) || typeof command.instanceId !== "string" || typeof command.sessionId !== "string" || !/^csess_[0-9a-f]{32}$/.test(command.sessionId) || typeof command.appId !== "string" || command.env !== "dev" && command.env !== "prod" || command.hostId !== host.hostId || !binding || binding.appId !== command.appId || binding.generation !== command.bindingGeneration || !Number.isSafeInteger(command.sequence) || Number(command.sequence) < 1 || commandIds.has(command.commandId) || commandSequences.has(sequenceKey) || !["start", "prompt", "checkpoint_stop", "resume"].includes(String(command.kind)) || !record6(command.payload) || !Number.isSafeInteger(command.createdAt)) throw invalid("command");
     commandIds.add(command.commandId);
     commandSequences.add(sequenceKey);
     return command;
@@ -7696,10 +7855,10 @@ function parseSnapshot(value2) {
 }
 async function parseSource(value2) {
   const repositoryLimits = { maximumFiles: 1e5, maximumBytes: 80 * 1024 * 1024 };
-  const snapshot = record5(record5(value2)?.snapshot);
+  const snapshot = record6(record6(value2)?.snapshot);
   if (!snapshot || typeof snapshot.repository !== "string" || typeof snapshot.commitSha !== "string" || typeof snapshot.treeDigest !== "string" || !Array.isArray(snapshot.files)) throw invalid("source");
   const files = snapshot.files.map((value22) => {
-    const file = record5(value22);
+    const file = record6(value22);
     if (!file || typeof file.path !== "string" || typeof file.content !== "string") throw invalid("source file");
     return { path: file.path, content: file.content };
   });
@@ -7708,11 +7867,11 @@ async function parseSource(value2) {
   const aliases = /* @__PURE__ */ new Set();
   const references = [];
   for (const item of referencesValue) {
-    const reference = record5(item);
+    const reference = record6(item);
     if (!reference || typeof reference.alias !== "string" || !/^[a-z][a-z0-9-]{0,39}$/.test(reference.alias) || aliases.has(reference.alias) || reference.alias === "primary" || typeof reference.repository !== "string" || typeof reference.commitSha !== "string" || typeof reference.treeDigest !== "string" || !Array.isArray(reference.files)) throw invalid("reference source");
     aliases.add(reference.alias);
     const referenceFiles = reference.files.map((entry) => {
-      const file = record5(entry);
+      const file = record6(entry);
       if (!file || typeof file.path !== "string" || typeof file.content !== "string") throw invalid("reference source file");
       return { path: file.path, content: file.content };
     });
@@ -7727,31 +7886,31 @@ async function parseSource(value2) {
   return { ...source, treeDigest: digest, ...references.length ? { references } : {} };
 }
 function parseReview(value2) {
-  const review = record5(record5(value2)?.review);
-  if (!review || !["approved", "rejected"].includes(String(review.verdict)) || typeof review.reviewDigest !== "string" || !/^sha256:[0-9a-f]{64}$/.test(review.reviewDigest) || typeof review.provider !== "string" || !review.provider || typeof review.model !== "string" || !review.model || !Number.isSafeInteger(review.policyVersion) || Number(review.policyVersion) < 1) throw invalid("review");
+  const review = record6(record6(value2)?.review);
+  if (!review || !["approved", "rejected"].includes(String(review.verdict)) || typeof review.reviewDigest !== "string" || !/^sha256:[0-9a-f]{64}$/.test(review.reviewDigest) || typeof review.provider !== "string" || !review.provider || typeof review.model !== "string" || !review.model || !Number.isSafeInteger(review.policyVersion) || Number(review.policyVersion) < 1 || !Number.isSafeInteger(review.score) || Number(review.score) < 0 || Number(review.score) > 100 || typeof review.summary !== "string" || !Array.isArray(review.findings) || review.findings.length > 12) throw invalid("review");
   return review;
 }
 function parseCandidate(value2) {
-  const candidate = record5(record5(value2)?.candidate);
+  const candidate = record6(record6(value2)?.candidate);
   if (!candidate || typeof candidate.candidateId !== "string" || !/^ccand_[0-9a-f]{32}$/.test(candidate.candidateId) || !["submitted", "approved", "published", "failed"].includes(String(candidate.status))) {
     throw invalid("candidate");
   }
   return { candidateId: candidate.candidateId, status: candidate.status };
 }
 function parseCollaborationSkills(value2) {
-  const items = record5(value2)?.skills;
+  const items = record6(value2)?.skills;
   if (!Array.isArray(items) || items.length > 16) throw invalid("collaboration skills");
   const skillNames2 = /* @__PURE__ */ new Set();
   const toolNames = /* @__PURE__ */ new Set();
   return items.map((item) => {
-    const skill = record5(item);
+    const skill = record6(item);
     if (!skill || !validManifestName(skill.name) || skillNames2.has(skill.name) || skill.instructions !== void 0 && (typeof skill.instructions !== "string" || utf8Bytes(skill.instructions) > 32e3) || !Array.isArray(skill.tools) || !skill.tools.length || skill.tools.length > 128) {
       throw invalid("collaboration skill");
     }
     skillNames2.add(skill.name);
     const tools = skill.tools.map((candidate) => {
-      const tool = record5(candidate);
-      const inputSchema = record5(tool?.inputSchema);
+      const tool = record6(candidate);
+      const inputSchema = record6(tool?.inputSchema);
       if (!tool || !validManifestName(tool.name) || toolNames.has(tool.name) || typeof tool.description !== "string" || utf8Bytes(tool.description) > 8e3 || !inputSchema || jsonBytes(inputSchema) > 64e3 || tool.concurrency !== void 0 && tool.concurrency !== "parallel") {
         throw invalid("collaboration tool");
       }
@@ -7776,12 +7935,12 @@ function parseCollaborationSkills(value2) {
 }
 function validateCollaborationToolRequest(value2) {
   validCommandId(value2.commandId);
-  if (typeof value2.toolCallId !== "string" || value2.toolCallId.length > 256 || !/^[^\s\u0000-\u001f\u007f]+$/.test(value2.toolCallId) || !validManifestName(value2.skill) || !validManifestName(value2.tool) || !record5(value2.input) || jsonBytes(value2.input) > 128e3) {
+  if (typeof value2.toolCallId !== "string" || value2.toolCallId.length > 256 || !/^[^\s\u0000-\u001f\u007f]+$/.test(value2.toolCallId) || !validManifestName(value2.skill) || !validManifestName(value2.tool) || !record6(value2.input) || jsonBytes(value2.input) > 128e3) {
     throw new TypeError("invalid Code collaboration tool request");
   }
 }
 function parseCollaborationToolOutput(value2) {
-  const output = record5(record5(value2)?.output);
+  const output = record6(record6(value2)?.output);
   if (!output || output.isError !== void 0 && typeof output.isError !== "boolean") {
     throw invalid("collaboration tool");
   }
@@ -7790,7 +7949,7 @@ function parseCollaborationToolOutput(value2) {
     return { content: output.content, ...output.isError === true ? { isError: true } : {} };
   }
   if (!Array.isArray(output.content) || output.content.length > 64 || jsonBytes(output.content) > 1e6 || !output.content.every((block2) => {
-    const item = record5(block2);
+    const item = record6(block2);
     return item && ["text", "image", "audio", "document", "tool_use", "tool_result", "thinking"].includes(String(item.type));
   })) throw invalid("collaboration tool");
   return {
@@ -7823,17 +7982,48 @@ function jsonBytes(value2) {
     return Number.POSITIVE_INFINITY;
   }
 }
-var record5 = (value2) => value2 && typeof value2 === "object" && !Array.isArray(value2) ? value2 : null;
+var record6 = (value2) => value2 && typeof value2 === "object" && !Array.isArray(value2) ? value2 : null;
 var invalid = (part) => new CodeRuntimeControlError(`invalid Code runtime ${part} response`, 502, "invalid_response");
 var RESERVED = /* @__PURE__ */ new Set([".git", ".odla", ".wrangler", "node_modules", "dist", "coverage"]);
 var SECRET = /^(?:\.env(?:\..+)?|\.dev\.vars|credentials(?:\..+)?\.json|dev-token(?:\..+)?\.json)$/i;
 var PATH = /^[A-Za-z0-9_@+.,-]+(?:\/[A-Za-z0-9_@+.,-]+)*$/;
 var FORBIDDEN = /^(?:GIT binary patch|Binary files |rename (?:from|to) |copy (?:from|to) |similarity index |old mode |new mode |deleted file mode 160000|new file mode 160000)/m;
 function stripPatchEnvelope(patch2) {
-  if (!/^\*\*\* (?:Begin|End) Patch\s*$/m.test(patch2)) return patch2;
+  if (!/^\*\*\* (?:Begin|End) Patch\s*$/m.test(patch2)) return applyPatchDialectToDiff(patch2);
   const kept = patch2.split("\n").filter((line2) => !/^\*\*\* (?:Begin|End) Patch\s*$/.test(line2));
   const stripped = kept.join("\n");
-  return /^diff --git /m.test(stripped) ? stripped : patch2;
+  if (/^diff --git /m.test(stripped)) return stripped;
+  const translated = applyPatchDialectToDiff(stripped);
+  return translated === stripped ? patch2 : translated;
+}
+function applyPatchDialectToDiff(patch2) {
+  if (!/^\*\*\* (?:Update|Add|Delete) File: /m.test(patch2)) return patch2;
+  const out = [];
+  let open = false;
+  for (const line2 of patch2.split("\n")) {
+    const file = /^\*\*\* (Update|Add|Delete) File: (.+?)\s*$/.exec(line2);
+    if (file) {
+      const [, verb, raw] = file;
+      const path = raw.trim();
+      if (!PATH.test(path)) return patch2;
+      out.push(`diff --git a/${path} b/${path}`);
+      if (verb === "Add") out.push("new file mode 100644", "--- /dev/null", `+++ b/${path}`);
+      else if (verb === "Delete") out.push(`--- a/${path}`, "+++ /dev/null");
+      else out.push(`--- a/${path}`, `+++ b/${path}`);
+      open = true;
+      continue;
+    }
+    if (/^\*\*\* /.test(line2)) continue;
+    if (!open) continue;
+    if (/^@@/.test(line2)) {
+      out.push("@@ -1 +1 @@");
+      continue;
+    }
+    out.push(line2);
+  }
+  if (!open) return patch2;
+  return `${out.join("\n").replace(/\n+$/, "")}
+`;
 }
 function validateCodePatch(rawPatch, maxBytes) {
   const patch2 = stripPatchEnvelope(rawPatch);
@@ -7886,17 +8076,20 @@ function resolveCodePath(workspaceDir, path) {
   if (target !== root && !target.startsWith(`${root}${import_path6.sep}`)) throw new TypeError("path escapes the staged workspace");
   return target;
 }
+function hasContextFreeHunk(patch2) {
+  const bodies = patch2.split(/^@@.*$/m).slice(1);
+  return bodies.some((body) => !body.split("\n").some((line2) => line2.startsWith(" ") && line2.trim().length > 0));
+}
 function describePatchFailure(patch2, detail) {
   const hunks = patch2.split("\n").filter((line2) => line2.startsWith("@@"));
-  const bodies = patch2.split(/^@@.*$/m).slice(1);
-  const contextless = bodies.some((body) => !body.split("\n").some((line2) => line2.startsWith(" ") && line2.trim().length > 0));
-  const hint = hunks.length > 0 && contextless ? " A hunk has no context lines; include at least one unchanged line above or below each change." : "";
+  const hint = hunks.length > 0 && hasContextFreeHunk(patch2) ? " A hunk has no context lines; include at least one unchanged line above or below each change." : "";
   return `patch did not apply: ${detail}${hint}`;
 }
 async function applyCodePatch(workspaceDir, rawPatch, paths2) {
   const patch2 = stripPatchEnvelope(rawPatch);
-  await gitApply(workspaceDir, patch2, true);
-  await gitApply(workspaceDir, patch2, false);
+  const zero = hasContextFreeHunk(patch2);
+  await gitApply(workspaceDir, patch2, true, zero);
+  await gitApply(workspaceDir, patch2, false, zero);
   for (const path of paths2) {
     try {
       const info = await (0, import_promises6.lstat)(resolveCodePath(workspaceDir, path));
@@ -7908,9 +8101,16 @@ async function applyCodePatch(workspaceDir, rawPatch, paths2) {
     }
   }
 }
-function gitApply(cwd, patch2, check) {
+function gitApply(cwd, patch2, check, unidiffZero = false) {
   return new Promise((accept, reject) => {
-    const args = ["apply", "--recount", "--whitespace=nowarn", ...check ? ["--check"] : [], "-"];
+    const args = [
+      "apply",
+      "--recount",
+      ...unidiffZero ? ["--unidiff-zero"] : [],
+      "--whitespace=nowarn",
+      ...check ? ["--check"] : [],
+      "-"
+    ];
     const child = (0, import_child_process4.spawn)("git", args, {
       cwd,
       shell: false,
@@ -7919,8 +8119,8 @@ function gitApply(cwd, patch2, check) {
     });
     let stderr2 = "";
     child.stderr.setEncoding("utf8");
-    child.stderr.on("data", (text22) => {
-      if (stderr2.length < 4e3) stderr2 += text22.slice(0, 4e3);
+    child.stderr.on("data", (text4) => {
+      if (stderr2.length < 4e3) stderr2 += text4.slice(0, 4e3);
     });
     child.once("error", reject);
     child.once("exit", (code) => code === 0 ? accept() : reject(new TypeError(describePatchFailure(patch2, stderr2.trim().slice(0, 500)))));
@@ -8166,7 +8366,7 @@ function validate2(input) {
     maximumFiles: policy.maximumFiles ?? 2e4,
     maximumBytes: policy.maximumBytes ?? 512 * 1024 * 1024
   };
-  if ([...result.testPathPrefixes, ...result.testPathSuffixes].some((rule) => !RULE.test(rule)) || !integer(result.maximumChangedTests, 0, 1e4) || !integer(result.maximumPatchBytes, 1, 4 * 1024 * 1024) || !integer(result.maximumFiles, 1, 1e5) || !integer(result.maximumBytes, 1, 2 * 1024 * 1024 * 1024)) {
+  if ([...result.testPathPrefixes, ...result.testPathSuffixes].some((rule) => !RULE.test(rule)) || !integer2(result.maximumChangedTests, 0, 1e4) || !integer2(result.maximumPatchBytes, 1, 4 * 1024 * 1024) || !integer2(result.maximumFiles, 1, 1e5) || !integer2(result.maximumBytes, 1, 2 * 1024 * 1024 * 1024)) {
     throw new TypeError("clean verification policy exceeds its bounds");
   }
   return result;
@@ -8217,7 +8417,7 @@ function hashFile(path) {
   });
 }
 function checkedResult(result, maximumOutputBytes) {
-  if (!integer(result.exitCode, 0, 255) || !integer(result.durationMs, 0, 30 * 6e4) || typeof result.stdout !== "string" || typeof result.stderr !== "string" || typeof result.outputLimitExceeded !== "boolean" || typeof result.timedOut !== "boolean") {
+  if (!integer2(result.exitCode, 0, 255) || !integer2(result.durationMs, 0, 30 * 6e4) || typeof result.stdout !== "string" || typeof result.stderr !== "string" || typeof result.outputLimitExceeded !== "boolean" || typeof result.timedOut !== "boolean") {
     throw new TypeError("recipe executor returned an invalid result");
   }
   const bytes = Buffer.byteLength(result.stdout) + Buffer.byteLength(result.stderr);
@@ -8267,7 +8467,7 @@ function digestJson(value2) {
 function digestBytes(value2) {
   return `sha256:${(0, import_crypto3.createHash)("sha256").update(value2).digest("hex")}`;
 }
-function integer(value2, minimum, maximum) {
+function integer2(value2, minimum, maximum) {
   return Number.isSafeInteger(value2) && value2 >= minimum && value2 <= maximum;
 }
 async function prepareRuntimeCheckpoint(input) {
@@ -8294,9 +8494,9 @@ async function prepareRuntimeCheckpoint(input) {
       if (evidence.receipt.outcome === "passed") {
         verification = evidence.receipt;
         review = await input.review(patch2, verification);
-        note = review.verdict === "approved" ? "Clean verification and independent review passed" : "Clean verification passed; independent review rejected the candidate";
+        note = describeReview(review);
       } else {
-        note = `Clean verification failed: ${evidence.receipt.recipes.filter((recipe2) => recipe2.status !== "passed").map((recipe2) => `${recipe2.recipeId}=${recipe2.status}`).join(", ")}`;
+        note = describeGateFailure(evidence);
       }
     } catch (cause) {
       note = `Candidate verification or review failed closed: ${message(cause)}`;
@@ -8321,6 +8521,23 @@ async function prepareRuntimeCheckpoint(input) {
   });
   return { checkpoint, verification, review, note };
 }
+function describeReview(review) {
+  const findings = review.findings.map((finding) => `  - [${finding.severity}] ${finding.detail}`).join("\n");
+  const head = review.verdict === "approved" ? `Clean verification and independent review passed (score ${review.score}/100).` : `Clean verification passed; independent review REJECTED this candidate (score ${review.score}/100). Address the findings and checkpoint again.`;
+  return [head, review.summary, findings].filter(Boolean).join("\n").slice(0, 4e3);
+}
+function describeGateFailure(evidence) {
+  const failed = evidence.receipt.recipes.filter((recipe2) => recipe2.status !== "passed");
+  const detail = failed.map((recipe2) => {
+    const log = evidence.logs.find((entry) => entry.recipeId === recipe2.recipeId);
+    const output = `${log?.stdout ?? ""}
+${log?.stderr ?? ""}`.trim();
+    return `${recipe2.recipeId}=${recipe2.status}${output ? `
+${output.slice(0, 1500)}` : ""}`;
+  }).join("\n\n");
+  return `Clean verification failed. Fix this and checkpoint again:
+${detail}`.slice(0, 4e3);
+}
 var message = (value2) => (value2 instanceof Error ? value2.message : String(value2)).slice(0, 500);
 var CodeRuntimeCheckpointManager = class {
   constructor(options) {
@@ -9339,8 +9556,14 @@ function optionalInteger(value2) {
   if (!Number.isSafeInteger(value2) || value2 < 1) throw new TypeError("line bounds must be positive integers");
   return value2;
 }
+var DEFAULT_FAILURE_REASON2 = {
+  "tool denied by CaMeL policy": "tool denied by CaMeL policy",
+  "review sessions are read-only": "review session is read-only; workspace changes are not permitted"
+};
 function response(request3, ok, content2, details) {
-  return { requestId: request3.requestId, ok, content: content2, ...details ? { details } : {} };
+  if (ok) return { requestId: request3.requestId, ok, content: content2, ...details ? { details } : {} };
+  const failureReason = typeof details?.failureReason === "string" && details.failureReason || DEFAULT_FAILURE_REASON2[content2] || content2 || "tool request failed; inspect the tool input and workspace state";
+  return { requestId: request3.requestId, ok, content: content2, details: { ...details, failureReason } };
 }
 var cache = /* @__PURE__ */ new Map();
 function workspaceGraphs(workspaceDir, paths2) {
@@ -9916,120 +10139,6 @@ async function appendCodeRuntimeEvent(control, command, event, refs) {
 }
 var digestRuntimeValue = (value2) => `sha256:${(0, import_crypto4.createHash)("sha256").update(value2).digest("hex")}`;
 var runtimeErrorMessage = (value2) => value2 instanceof Error ? value2.message : String(value2);
-var text3 = (value2, maximum) => {
-  if (typeof value2 !== "string") return void 0;
-  const bounded = value2.replace(/[\u0000-\u0008\u000b\u000c\u000e-\u001f\u007f]/g, " ").trim();
-  return bounded ? bounded.slice(0, maximum) : void 0;
-};
-var integer2 = (value2) => Number.isSafeInteger(value2) && Number(value2) >= 0 ? Number(value2) : void 0;
-var record32 = (value2) => value2 && typeof value2 === "object" && !Array.isArray(value2) ? value2 : void 0;
-var excerpt = (value2, tail = false) => {
-  if (typeof value2 !== "string") return void 0;
-  const safe = value2.replace(/[\u0000-\u0008\u000b\u000c\u000e-\u001f\u007f]/g, " ");
-  const source = (tail ? safe.slice(-1e4) : safe.slice(0, 1e4)).trim();
-  if (!source) return void 0;
-  const lines = source.split("\n").filter((line2) => line2.trim()).map((line2) => line2.slice(0, 240));
-  const selected = tail ? lines.slice(-10) : lines.slice(0, 10);
-  return text3(selected.join("\n"), 2400);
-};
-var paths = (value2) => {
-  if (!Array.isArray(value2)) return void 0;
-  const items = value2.flatMap((item) => {
-    const path = text3(item, 1024);
-    return path ? [path] : [];
-  }).slice(0, 12);
-  return items.length ? items : void 0;
-};
-function patchStats(value2) {
-  if (typeof value2 !== "string") return {};
-  let additions = 0;
-  let deletions = 0;
-  for (const line2 of value2.slice(0, 262144).split("\n")) {
-    if (line2.startsWith("+++") || line2.startsWith("---")) continue;
-    if (line2.startsWith("+")) additions += 1;
-    else if (line2.startsWith("-")) deletions += 1;
-  }
-  return { ...additions ? { additions } : {}, ...deletions ? { deletions } : {} };
-}
-function searchResults(value2) {
-  if (typeof value2 !== "string") return void 0;
-  const results = value2.split("\n").flatMap((line2) => {
-    const match = /^([^:\n]{1,1024}):(\d+):\s?(.*)$/.exec(line2);
-    if (!match) return [];
-    const lineNumber = Number(match[2]);
-    const itemText = text3(match[3], 240);
-    if (!Number.isSafeInteger(lineNumber) || lineNumber < 1) return [];
-    return [{ path: match[1], line: lineNumber, ...itemText ? { text: itemText } : {} }];
-  }).slice(0, 5);
-  return results.length ? results : void 0;
-}
-function codeToolRequestPresentation(request3) {
-  const input = request3.input;
-  if (request3.tool === "sandbox.read") {
-    const path = text3(input.path, 1024);
-    if (!path) return void 0;
-    const startLine = integer2(input.startLine);
-    const endLine = integer2(input.endLine);
-    return { kind: "read", path, ...startLine ? { startLine } : {}, ...endLine ? { endLine } : {} };
-  }
-  if (request3.tool === "sandbox.list") {
-    const scope = text3(input.prefix, 1024);
-    return { kind: "list", ...scope ? { scope } : {} };
-  }
-  if (request3.tool === "sandbox.search" || request3.tool === "sandbox.overview" || request3.tool === "sandbox.where_is" || request3.tool === "sandbox.who_imports" || request3.tool === "sandbox.who_touches") {
-    const query = text3(input.query, 512);
-    const scope = request3.tool === "sandbox.search" ? text3(input.prefix, 1024) : void 0;
-    if (request3.tool === "sandbox.search" && !query) return void 0;
-    return { kind: "query", ...query ? { query } : {}, ...scope ? { scope } : {} };
-  }
-  if (request3.tool === "sandbox.apply_patch") {
-    return { kind: "patch", ...patchStats(input.patch) };
-  }
-  const recipeId = text3(input.recipeId, 120);
-  return recipeId ? { kind: "recipe", recipeId } : void 0;
-}
-function codeToolResultPresentation(request3, response2) {
-  const started = codeToolRequestPresentation(request3);
-  if (!started || !response2.ok) return started;
-  const details = record32(response2.details);
-  if (started.kind === "read") {
-    return {
-      ...started,
-      ...integer2(details?.startLine) ? { startLine: integer2(details?.startLine) } : {},
-      ...integer2(details?.endLine) ? { endLine: integer2(details?.endLine) } : {},
-      ...excerpt(response2.content) ? { excerpt: excerpt(response2.content) } : {}
-    };
-  }
-  if (started.kind === "list") {
-    const listed = response2.content.split("\n").filter((line2) => line2 && !line2.startsWith("\u2026") && !line2.startsWith("Workspace ")).map((line2) => text3(line2, 1024)).filter((line2) => Boolean(line2)).slice(0, 8);
-    return {
-      ...started,
-      ...integer2(details?.count) !== void 0 ? { count: integer2(details?.count) } : {},
-      ...listed.length ? { paths: listed } : {}
-    };
-  }
-  if (started.kind === "query") {
-    const results = request3.tool === "sandbox.search" ? searchResults(response2.content) : void 0;
-    const resultExcerpt = request3.tool === "sandbox.search" ? void 0 : excerpt(response2.content);
-    return {
-      ...started,
-      ...integer2(details?.count) !== void 0 ? { count: integer2(details?.count) } : {},
-      ...results ? { results } : {},
-      ...resultExcerpt ? { excerpt: resultExcerpt } : {}
-    };
-  }
-  if (started.kind === "patch") {
-    return { ...started, ...paths(details?.paths) ? { paths: paths(details?.paths) } : {} };
-  }
-  const output = response2.content.replace(/^Recipe [^\n]*\.?\s*/u, "");
-  return {
-    ...started,
-    ...integer2(details?.exitCode) !== void 0 ? { exitCode: integer2(details?.exitCode) } : {},
-    ...typeof details?.timedOut === "boolean" ? { timedOut: details.timedOut } : {},
-    ...typeof details?.outputLimitExceeded === "boolean" ? { outputLimitExceeded: details.outputLimitExceeded } : {},
-    ...excerpt(output, true) ? { excerpt: excerpt(output, true) } : {}
-  };
-}
 function codeRuntimeAcknowledgementGate(signal) {
   let settle;
   let settled = false;
@@ -10331,36 +10440,11 @@ var TheseusRuntimeEngine = class {
   }
   /** Report every brokered effect as it starts and finishes. */
   #observed(command, active, broker) {
-    return {
-      execute: async (context, request3) => {
-        const startedAt = Date.now();
-        const operationId = digestRuntimeValue(`${command.commandId}:${request3.requestId}`);
-        const startedPresentation = codeToolRequestPresentation(request3);
-        await this.#event(
-          command,
-          {
-            type: "tool",
-            phase: "started",
-            tool: request3.tool,
-            operationId,
-            ...startedPresentation ? { presentation: startedPresentation } : {}
-          },
-          active.conversationRefs
-        ).catch(() => void 0);
-        const response2 = await broker.execute(context, request3);
-        const completedPresentation = codeToolResultPresentation(request3, response2);
-        await this.#event(command, {
-          type: "tool",
-          phase: "completed",
-          tool: request3.tool,
-          ok: response2.ok,
-          durationMs: Date.now() - startedAt,
-          operationId,
-          ...completedPresentation ? { presentation: completedPresentation } : {}
-        }, active.conversationRefs).catch(() => void 0);
-        return response2;
-      }
-    };
+    return observedBroker({
+      broker,
+      operationIdFor: (requestId) => digestRuntimeValue(`${command.commandId}:${requestId}`),
+      emit: (event) => this.#event(command, event, active.conversationRefs).catch(() => void 0)
+    });
   }
   async #checkpoint(command) {
     const active = this.#active.get(command.sessionId);
@@ -10670,6 +10754,19 @@ function digestText(value2) {
 // src/code-runtime-config.ts
 var CODE_NODE_IMAGE = "node:24-alpine@sha256:a0b9bf06e4e6193cf7a0f58816cc935ff8c2a908f81e6f1a95432d679c54fbfd";
 var CODE_BUILD_RECIPES = Object.freeze([{
+  id: "odla-code-gates",
+  image: CODE_NODE_IMAGE,
+  // Selects the repository's fast, no-capability gates from the same manifest
+  // CI and `npm run preflight` read, so a new gate is picked up without a
+  // second list to keep in sync. The container has no shell: this is argv.
+  command: ["node", "scripts/recipe-gates.mjs"],
+  timeoutMs: 18e4,
+  maxOutputBytes: 1024 * 1024,
+  cpus: 1,
+  // check:secrets holds ~2,500 source files in memory at once.
+  memory: "1g",
+  pids: 128
+}, {
   id: "odla-code-contracts",
   image: CODE_NODE_IMAGE,
   command: [
@@ -10849,20 +10946,20 @@ async function runCodeRuntime(input) {
   }
 }
 function parseConnection(value2, appId, appEnv) {
-  const root = record6(value2);
-  const host = record6(root?.host);
-  const offer = record6(root?.offer);
-  const binding = record6(root?.binding);
+  const root = record7(value2);
+  const host = record7(root?.host);
+  const offer = record7(root?.offer);
+  const binding = record7(root?.binding);
   if (!root || typeof root.token !== "string" || !/^odla_code_host_[0-9a-f]{64}$/.test(root.token) || typeof root.resumed !== "boolean" || !host || !/^chost_[0-9a-f]{32}$/.test(String(host.hostId)) || typeof host.name !== "string" || !offer || !Number.isSafeInteger(offer.slots) || !binding || typeof binding.appId !== "string" || !binding.appId || appId && binding.appId !== appId || binding.env !== appEnv || !Number.isSafeInteger(binding.generation)) {
     throw new Error("connect Code host returned an invalid response");
   }
   return root;
 }
 function apiFailure(action2, status, value2) {
-  const message2 = record6(record6(value2)?.error)?.message;
+  const message2 = record7(record7(value2)?.error)?.message;
   return `${action2} failed (${status})${typeof message2 === "string" ? `: ${message2}` : ""}`;
 }
-function record6(value2) {
+function record7(value2) {
   return value2 && typeof value2 === "object" && !Array.isArray(value2) ? value2 : null;
 }
 
@@ -11368,6 +11465,14 @@ Usage:
   odla-ai ai models [--config odla.config.mjs] [--env dev] [--provider <id>] [--json]
   odla-ai config <diff|plan> [--config odla.config.mjs] [--email <odla-account>] [--json]
   odla-ai config apply --plan <plan.json> [--idempotency-key <key>] [--email <odla-account>] [--json]
+  odla-ai promotion plan --file <promotion-plan.json> [--env dev] [--json]
+  odla-ai promotion inspect <plan-id> [--env dev] [--json]
+  odla-ai promotion status <plan-id> [--env dev] [--json]
+  odla-ai promotion apply <plan-id> --approval <approval-id> [--idempotency-key <key>] [--env dev] [--json]
+  odla-ai promotion rollback <plan-id> --approval <approval-id> [--idempotency-key <key>] [--env dev] [--json]
+  odla-ai promotion next <plan-id> <operation-id> [--env dev] [--json]
+  odla-ai promotion record <plan-id> <operation-id> <step-id> --file <step-receipt.json> [--env dev] [--json]
+  odla-ai promotion cancel <plan-id> <operation-id> [--env dev] [--json]
   odla-ai operations get <operation-id> [--json]
   odla-ai operations wait <operation-id> [--interval <seconds>] [--timeout <seconds>] [--json]
   odla-ai calendar status [--env dev] [--email <odla-account>] [--json]
@@ -11534,6 +11639,11 @@ Commands:
   init         Create a generic odla.config.mjs plus starter schema/rules files.
   doctor       Validate and summarize the project config without network calls.
   config       Diff Registry intent, freeze a CAS-bound plan, and conditionally apply its safe actions.
+  promotion    Plan and inspect exact selective-release bundles without target
+               mutation, then queue and resume a human-approved apply or rollback
+               from an enrolled device. Each target step is leased and receipt-
+               journaled; approval remains bound to the immutable plan digest,
+               target set, action, and expiry, so every mismatch fails closed.
   operations   Inspect or wait on one exact, durable config-operation receipt.
   calendar     Inspect, connect, or disconnect the live Google booking connection.
   app          Archive (suspend, data retained), restore, export, import, or
@@ -12409,17 +12519,17 @@ function collectEntityFields(entity, parsed, allowClear) {
   if (entity === "task" && fields.column === "ready") fields.column = "todo";
   return fields;
 }
-function statusCol(entity, record11) {
-  if (entity === "bug") return `${record11.status ?? ""}/${record11.severity ?? ""}`;
+function statusCol(entity, record12) {
+  if (entity === "bug") return `${record12.status ?? ""}/${record12.severity ?? ""}`;
   if (entity === "task") {
-    const state2 = record11.column === "todo" ? "ready" : String(record11.column ?? "");
-    return record11.revision ? `${state2}; r${record11.revision}` : state2;
+    const state2 = record12.column === "todo" ? "ready" : String(record12.column ?? "");
+    return record12.revision ? `${state2}; r${record12.revision}` : state2;
   }
-  return String(record11.status ?? "");
+  return String(record12.status ?? "");
 }
-function referenceMarkup(entity, record11) {
-  const label = (record11.title?.trim() || `${entity} ${record11.id}`).replaceAll("]", ")");
-  return `@[${label}](pm:${entity}/${record11.id})`;
+function referenceMarkup(entity, record12) {
+  const label = (record12.title?.trim() || `${entity} ${record12.id}`).replaceAll("]", ")");
+  return `@[${label}](pm:${entity}/${record12.id})`;
 }
 var STUDIO_SECTION = {
   goal: "goals",
@@ -12433,13 +12543,13 @@ function studioRecordUrl(ctx, entity, id2) {
     ctx.platformUrl
   ).href;
 }
-function studioRecordLink(ctx, entity, record11) {
-  const label = (record11.title?.trim() || `${entity} ${record11.id}`).replaceAll("]", ")");
-  return `[${label}](${studioRecordUrl(ctx, entity, record11.id)})`;
+function studioRecordLink(ctx, entity, record12) {
+  const label = (record12.title?.trim() || `${entity} ${record12.id}`).replaceAll("]", ")");
+  return `[${label}](${studioRecordUrl(ctx, entity, record12.id)})`;
 }
-function printRecord(ctx, entity, record11) {
+function printRecord(ctx, entity, record12) {
   ctx.out.log(
-    `${record11.id}	[${statusCol(entity, record11)}]	${record11.appId}	${studioRecordLink(ctx, entity, record11)}`
+    `${record12.id}	[${statusCol(entity, record12)}]	${record12.appId}	${studioRecordLink(ctx, entity, record12)}`
   );
 }
 function emit2(ctx, value2, human) {
@@ -12493,8 +12603,8 @@ async function pmAdd(ctx, entity, parsed) {
     input,
     mutationId: writeMutationId2(parsed)
   });
-  const record11 = { id: res.id, appId, title: String(input.title) };
-  emit2(ctx, res, () => ctx.out.log(`created ${entity}: ${studioRecordLink(ctx, entity, record11)}`));
+  const record12 = { id: res.id, appId, title: String(input.title) };
+  emit2(ctx, res, () => ctx.out.log(`created ${entity}: ${studioRecordLink(ctx, entity, record12)}`));
 }
 var UUID = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
 var UUID_PREFIX = /^[0-9a-f-]{8,35}$/i;
@@ -12514,7 +12624,7 @@ async function resolvePmId(ctx, entity, supplied) {
       "GET",
       `/${entity}?limit=${limit}&offset=${offset}`
     );
-    matches.push(...page2.records.map((record11) => record11.id).filter((id2) => id2.toLowerCase().startsWith(prefix)));
+    matches.push(...page2.records.map((record12) => record12.id).filter((id2) => id2.toLowerCase().startsWith(prefix)));
     offset += page2.records.length;
     if (matches.length > 1 || page2.records.length === 0 || offset >= page2.total) break;
   }
@@ -12528,17 +12638,17 @@ async function resolvePmId(ctx, entity, supplied) {
 }
 async function pmGet(ctx, entity, id2) {
   const resolved = await resolvePmId(ctx, entity, id2);
-  const { record: record11 } = await pmRequest(ctx, "GET", `/${entity}/${encodeURIComponent(resolved)}`);
-  emit2(ctx, record11, () => printRecord(ctx, entity, record11));
+  const { record: record12 } = await pmRequest(ctx, "GET", `/${entity}/${encodeURIComponent(resolved)}`);
+  emit2(ctx, record12, () => printRecord(ctx, entity, record12));
 }
 async function pmReference(ctx, entity, id2) {
-  const { record: record11 } = await pmRequest(
+  const { record: record12 } = await pmRequest(
     ctx,
     "GET",
     `/${entity}/${encodeURIComponent(id2)}`
   );
-  const markup = referenceMarkup(entity, record11);
-  emit2(ctx, { kind: `pm:${entity}`, id: record11.id, label: record11.title ?? "", markup }, () => {
+  const markup = referenceMarkup(entity, record12);
+  emit2(ctx, { kind: `pm:${entity}`, id: record12.id, label: record12.title ?? "", markup }, () => {
     ctx.out.log(markup);
   });
 }
@@ -12623,16 +12733,16 @@ var PER_ENTITY = {
   decision: ["status", "body", "supersedesId"],
   bug: ["status", "severity", "description", "goalId", "assigneeId", "decisionId"]
 };
-function leanRecord(entity, record11) {
+function leanRecord(entity, record12) {
   const out = {};
   for (const key of [...COMMON, ...PER_ENTITY[entity]]) {
-    const value2 = record11[key];
+    const value2 = record12[key];
     if (value2 !== void 0 && value2 !== null) out[key] = value2;
   }
   return out;
 }
 function leanRecords(entity, records, verbose) {
-  return verbose ? records : records.map((record11) => leanRecord(entity, record11));
+  return verbose ? records : records.map((record12) => leanRecord(entity, record12));
 }
 
 // src/pm-intake.ts
@@ -12665,8 +12775,8 @@ async function pmNext(ctx, parsed) {
     // One request for both live columns; the split below is over open work only.
     listFiltered(ctx, "task", appId, projectId, { column: `${READY_COLUMN},doing` })
   ]);
-  const ready = tasks.filter((record11) => record11.column === READY_COLUMN);
-  const doing = tasks.filter((record11) => record11.column === "doing");
+  const ready = tasks.filter((record12) => record12.column === READY_COLUMN);
+  const doing = tasks.filter((record12) => record12.column === "doing");
   const guidance = !goals.length ? "discuss alignment with the user before creating or claiming project work" : !ready.length ? 'refine a linked Backlog task and mark it Ready with "pm task ready <id>"' : `claim the top Ready task in one call: odla-ai pm start --app ${appId}`;
   const monitor = `odla-ai pm watch --app ${appId} --jsonl`;
   const result = {
@@ -12687,7 +12797,7 @@ async function pmNext(ctx, parsed) {
     ]) {
       ctx.out.log(`${label}:`);
       if (!records.length) ctx.out.log("- (none)");
-      else for (const record11 of records) printRecord(ctx, entity, record11);
+      else for (const record12 of records) printRecord(ctx, entity, record12);
     }
     ctx.out.log(`next: ${guidance}`);
     ctx.out.log(`monitor: ${monitor}`);
@@ -12726,7 +12836,7 @@ async function pmHandoff(ctx, parsed) {
     ]) {
       ctx.out.log(`${label}:`);
       if (!records.length) ctx.out.log("- (none)");
-      else for (const record11 of records) printRecord(ctx, entity, record11);
+      else for (const record12 of records) printRecord(ctx, entity, record12);
     }
     ctx.out.log(`monitor: ${monitor}`);
   });
@@ -12801,14 +12911,14 @@ async function pmStart(ctx, parsed) {
 
 // src/pm-links.ts
 async function pmLink(ctx, entity, id2) {
-  const { record: record11 } = await pmRequest(
+  const { record: record12 } = await pmRequest(
     ctx,
     "GET",
     `/${entity}/${encodeURIComponent(id2)}`
   );
-  const url = studioRecordUrl(ctx, entity, record11.id);
-  const markdown = studioRecordLink(ctx, entity, record11);
-  emit2(ctx, { kind: entity, id: record11.id, label: record11.title ?? "", url, markdown }, () => {
+  const url = studioRecordUrl(ctx, entity, record12.id);
+  const markdown = studioRecordLink(ctx, entity, record12);
+  emit2(ctx, { kind: entity, id: record12.id, label: record12.title ?? "", url, markdown }, () => {
     ctx.out.log(markdown);
   });
 }
@@ -12935,16 +13045,16 @@ async function page(ctx, appId, cursor) {
   }
   return data;
 }
-function recordState(record11) {
-  if (record11.column) return record11.column === "todo" ? "ready" : record11.column;
-  return String(record11.status ?? "");
+function recordState(record12) {
+  if (record12.column) return record12.column === "todo" ? "ready" : record12.column;
+  return String(record12.status ?? "");
 }
 function eventRecord(event) {
   return event.payload.payload;
 }
 function eventLabel(event) {
-  const record11 = eventRecord(event);
-  if (record11) return String(record11.title ?? event.payload.entityId);
+  const record12 = eventRecord(event);
+  if (record12) return String(record12.title ?? event.payload.entityId);
   const body = event.payload.message?.body?.replace(/\s+/g, " ").trim();
   return body || event.payload.entityId;
 }
@@ -12952,10 +13062,10 @@ function report3(ctx, parsed, result) {
   if (ctx.json) ctx.out.log(JSON.stringify(result, null, 2));
   else if (parsed.options.jsonl !== true && result.found) {
     for (const event of result.events ?? []) {
-      const record11 = eventRecord(event);
-      const state2 = record11 ? recordState(record11) : "comment";
+      const record12 = eventRecord(event);
+      const state2 = record12 ? recordState(record12) : "comment";
       ctx.out.log(
-        `${event.id}	${event.type}	${state2}${record11?.revision ? `; r${record11.revision}` : ""}	${eventLabel(event)}`
+        `${event.id}	${event.type}	${state2}${record12?.revision ? `; r${record12.revision}` : ""}	${eventLabel(event)}`
       );
     }
   }
@@ -13029,8 +13139,8 @@ async function pmWatch(ctx, parsed) {
     }
     firstSuccess = false;
     const matching = current.events.filter((event) => {
-      const record11 = eventRecord(event);
-      const state2 = record11 ? recordState(record11).toLowerCase() : "";
+      const record12 = eventRecord(event);
+      const state2 = record12 ? recordState(record12).toLowerCase() : "";
       return (!entity || event.payload.entityKind === entity) && (!action2 || event.payload.action === action2) && (!wantedState || state2 === wantedState || wantedState === "todo" && state2 === "ready") && (!by || event.actor.id === by) && (!self || event.actor.id !== self);
     });
     for (const event of matching) {
@@ -13461,17 +13571,17 @@ async function platformStatus(parsed, deps) {
   }
 }
 function isPlatformStatus(value2) {
-  if (!record7(value2) || value2.schemaVersion !== "odla.platform-status/v1") return false;
-  if (!record7(value2.verdict) || !Array.isArray(value2.verdict.reasons)) return false;
-  if (!record7(value2.catalog) || !record7(value2.summary)) return false;
+  if (!record8(value2) || value2.schemaVersion !== "odla.platform-status/v1") return false;
+  if (!record8(value2.verdict) || !Array.isArray(value2.verdict.reasons)) return false;
+  if (!record8(value2.catalog) || !record8(value2.summary)) return false;
   return Array.isArray(value2.services) && Array.isArray(value2.nextActions);
 }
 function apiMessage(value2) {
-  if (!record7(value2)) return "request failed";
-  const error = record7(value2.error) ? value2.error : value2;
+  if (!record8(value2)) return "request failed";
+  const error = record8(value2.error) ? value2.error : value2;
   return typeof error.message === "string" ? error.message : typeof error.code === "string" ? error.code : "request failed";
 }
-function record7(value2) {
+function record8(value2) {
   return !!value2 && typeof value2 === "object" && !Array.isArray(value2);
 }
 
@@ -13512,7 +13622,7 @@ function statusVerdict(reads) {
       severity: "degraded"
     });
   }
-  const performance = record8(reads.liveSync.body.performance) ? reads.liveSync.body.performance : null;
+  const performance = record9(reads.liveSync.body.performance) ? reads.liveSync.body.performance : null;
   if (performance?.status === "unavailable") {
     reasons.push({
       source: "liveSync",
@@ -13593,7 +13703,7 @@ function statusVerdict(reads) {
     reasons
   };
 }
-function record8(value2) {
+function record9(value2) {
   return Boolean(value2) && typeof value2 === "object" && !Array.isArray(value2);
 }
 function numeric2(value2) {
@@ -13621,7 +13731,7 @@ function printO11yStatus(status, out) {
   out.log(
     `o11y status ${status.scope.appId}/${status.scope.env} (${status.scope.minutes}m)`
   );
-  const routes = Array.isArray(status.application.body.routes) ? status.application.body.routes.filter(record9) : [];
+  const routes = Array.isArray(status.application.body.routes) ? status.application.body.routes.filter(record10) : [];
   const requests = routes.reduce(
     (total, row) => total + numeric3(row.requests),
     0
@@ -13633,39 +13743,39 @@ function printO11yStatus(status, out) {
   out.log(
     `application	${status.application.httpStatus}	${requests} requests	${errors} errors`
   );
-  const versions = Array.isArray(status.applicationVersions.body.rows) ? status.applicationVersions.body.rows.filter(record9) : [];
+  const versions = Array.isArray(status.applicationVersions.body.rows) ? status.applicationVersions.body.rows.filter(record10) : [];
   out.log(
     `application-versions	${status.applicationVersions.httpStatus}	${versions.length ? versions.slice(0, 5).map(
       (row) => `${String(row.value || "(unattributed)")}:${numeric3(row.requests)}`
     ).join(", ") : "none observed"}`
   );
   out.log(liveSyncLine(status.liveSync));
-  const canaryDurations = record9(status.canary.body.durationsMs) ? status.canary.body.durationsMs : {};
+  const canaryDurations = record10(status.canary.body.durationsMs) ? status.canary.body.durationsMs : {};
   out.log(
     `canary	${status.canary.httpStatus}	${String(status.canary.body.status ?? status.canary.body.error ?? "unavailable")}	${optionalNumeric(canaryDurations.publishToVisibleMs)} publish-to-visible`
   );
-  const collectorIngest = record9(status.collector.body.ingest) ? status.collector.body.ingest : {};
-  const collectorStorage = record9(collectorIngest.storage) ? collectorIngest.storage : {};
+  const collectorIngest = record10(status.collector.body.ingest) ? status.collector.body.ingest : {};
+  const collectorStorage = record10(collectorIngest.storage) ? collectorIngest.storage : {};
   out.log(
     `collector	${status.collector.httpStatus}	${String(status.collector.body.status ?? status.collector.body.error ?? "unavailable")}	${numeric3(collectorStorage.affectedPoints)} affected points`
   );
-  const providerMetrics = record9(status.provider.body.metrics) ? status.provider.body.metrics : {};
-  const providerCapacity = record9(status.provider.body.capacity) ? status.provider.body.capacity : {};
-  const workerMemory = record9(providerCapacity.memory) ? providerCapacity.memory : {};
+  const providerMetrics = record10(status.provider.body.metrics) ? status.provider.body.metrics : {};
+  const providerCapacity = record10(status.provider.body.capacity) ? status.provider.body.capacity : {};
+  const workerMemory = record10(providerCapacity.memory) ? providerCapacity.memory : {};
   out.log(
     `cloudflare	${status.provider.httpStatus}	${String(status.provider.body.status ?? status.provider.body.error ?? "unavailable")}	${numeric3(providerMetrics.requests)} invocations	${numeric3(providerMetrics.errors)} runtime errors	${optionalBytes(workerMemory.headroomBytes)} isolate memory headroom`
   );
   for (const line2 of providerCapacityLines(status.providerCapacity)) {
     out.log(line2);
   }
-  const coverage = record9(status.providerReconciliation.body.comparison) ? status.providerReconciliation.body.comparison : {};
-  const coverageCounts = record9(status.providerReconciliation.body.counts) ? status.providerReconciliation.body.counts : {};
-  const coverageBudget = record9(status.providerReconciliation.body.budget) ? status.providerReconciliation.body.budget : {};
+  const coverage = record10(status.providerReconciliation.body.comparison) ? status.providerReconciliation.body.comparison : {};
+  const coverageCounts = record10(status.providerReconciliation.body.counts) ? status.providerReconciliation.body.counts : {};
+  const coverageBudget = record10(status.providerReconciliation.body.budget) ? status.providerReconciliation.body.budget : {};
   out.log(
     `request-coverage	${status.providerReconciliation.httpStatus}	${String(status.providerReconciliation.body.status ?? status.providerReconciliation.body.error ?? "unavailable")}	${optionalPercent(coverage.applicationCoverage)} application/provider	${numeric3(coverageCounts.applicationRequests)}/${numeric3(coverageCounts.providerRequests)} requests	\xB1${optionalPercent(coverageBudget.maxRelativeError)} budget`
   );
   const providerPoints = Array.isArray(status.providerHistory.body.points) ? status.providerHistory.body.points.length : 0;
-  const providerFreshness = record9(status.providerHistory.body.freshness) ? status.providerHistory.body.freshness : {};
+  const providerFreshness = record10(status.providerHistory.body.freshness) ? status.providerHistory.body.freshness : {};
   out.log(
     `cloudflare-history	${status.providerHistory.httpStatus}	${String(status.providerHistory.body.status ?? status.providerHistory.body.error ?? "unavailable")}	${providerPoints} snapshots	${optionalAge(providerFreshness.ageMs)} old`
   );
@@ -13674,17 +13784,17 @@ function printO11yStatus(status, out) {
   );
 }
 function providerCapacityLines(read3) {
-  const resources = record9(read3.body.resources) ? read3.body.resources : {};
-  const durableObjects = record9(resources.durableObjects) ? resources.durableObjects : {};
-  const periodic = record9(durableObjects.periodic) ? durableObjects.periodic : {};
-  const storage = record9(durableObjects.sqliteStorage) ? durableObjects.sqliteStorage : {};
-  const d1 = record9(resources.d1) ? resources.d1 : {};
-  const d1Activity = record9(d1.activity) ? d1.activity : {};
-  const d1Storage = record9(d1.storage) ? d1.storage : {};
-  const d1Latency = record9(d1Activity.latency) ? d1Activity.latency : {};
-  const r2 = record9(resources.r2) ? resources.r2 : {};
-  const r2Operations = record9(r2.operations) ? r2.operations : {};
-  const r2Storage = record9(r2.storage) ? r2.storage : {};
+  const resources = record10(read3.body.resources) ? read3.body.resources : {};
+  const durableObjects = record10(resources.durableObjects) ? resources.durableObjects : {};
+  const periodic = record10(durableObjects.periodic) ? durableObjects.periodic : {};
+  const storage = record10(durableObjects.sqliteStorage) ? durableObjects.sqliteStorage : {};
+  const d1 = record10(resources.d1) ? resources.d1 : {};
+  const d1Activity = record10(d1.activity) ? d1.activity : {};
+  const d1Storage = record10(d1.storage) ? d1.storage : {};
+  const d1Latency = record10(d1Activity.latency) ? d1Activity.latency : {};
+  const r2 = record10(resources.r2) ? resources.r2 : {};
+  const r2Operations = record10(r2.operations) ? r2.operations : {};
+  const r2Storage = record10(r2.storage) ? r2.storage : {};
   const status = String(
     read3.body.status ?? read3.body.error ?? "unavailable"
   );
@@ -13695,11 +13805,11 @@ function providerCapacityLines(read3) {
   ];
 }
 function liveSyncLine(read3) {
-  const performance = record9(read3.body.performance) ? read3.body.performance : {};
-  const commitToSend = record9(performance.commitToSend) ? performance.commitToSend : {};
+  const performance = record10(read3.body.performance) ? read3.body.performance : {};
+  const commitToSend = record10(performance.commitToSend) ? performance.commitToSend : {};
   return `live-sync	${read3.httpStatus}	${String(read3.body.status ?? read3.body.error ?? "unavailable")}	${numeric3(read3.body.activeConnections)} active	${optionalNumeric(commitToSend.p95)} commit-to-send p95	${numeric3(performance.sendFailures)} send failures`;
 }
-function record9(value2) {
+function record10(value2) {
   return Boolean(value2) && typeof value2 === "object" && !Array.isArray(value2);
 }
 function numeric3(value2) {
@@ -14037,7 +14147,7 @@ async function monitorCommand(parsed, deps = {}) {
   if (action2 === "plan" || action2 === "apply") {
     const desired = monitoringWireConfig(context.cfg, env);
     const live = await request2(`${base}?env=${encodeURIComponent(env)}`, { headers }, doFetch);
-    const currentRevision = record10(live.config) ? string(live.config.revision) : null;
+    const currentRevision = record11(live.config) ? string(live.config.revision) : null;
     const changed = currentRevision !== desired.revision;
     const plan = {
       schemaVersion: 1,
@@ -14082,7 +14192,7 @@ async function monitorCommand(parsed, deps = {}) {
       headers
     }, doFetch);
     emit3(result2, jsonOutput, out, () => {
-      const run = record10(result2.run) ? result2.run : {};
+      const run = record11(result2.run) ? result2.run : {};
       out.log(`monitor run ${appId}/${env}/${probeId}: ${string(run.outcome) ?? "unknown"}${run.failure_code ? ` (${String(run.failure_code)})` : ""}`);
     });
     return;
@@ -14107,12 +14217,12 @@ async function request2(url, init, doFetch) {
   let body = {};
   try {
     const parsed = text4 ? JSON.parse(text4) : {};
-    body = record10(parsed) ? parsed : { value: parsed };
+    body = record11(parsed) ? parsed : { value: parsed };
   } catch {
     body = { message: text4.slice(0, 500) };
   }
   if (!response2.ok) {
-    const error = record10(body.error) ? body.error : body;
+    const error = record11(body.error) ? body.error : body;
     throw new Error(string(error.message) ?? string(error.code) ?? `monitor request failed (${response2.status})`);
   }
   return body;
@@ -14120,7 +14230,7 @@ async function request2(url, init, doFetch) {
 function printRead(action2, appId, env, result, out) {
   if (action2 === "status") {
     out.log(`monitor status ${appId}/${env}: ${String(result.overall ?? (result.configured === false ? "not configured" : "unknown"))}`);
-    const slos = Array.isArray(result.slos) ? result.slos.filter(record10) : [];
+    const slos = Array.isArray(result.slos) ? result.slos.filter(record11) : [];
     for (const slo of slos) out.log(`slo	${String(slo.id)}	${String(slo.state)}	${percent(slo.observed)} observed	${percent(slo.budgetRemaining)} budget remaining`);
     const incidents = Array.isArray(result.openIncidents) ? result.openIncidents.length : 0;
     const gaps = Array.isArray(result.monitoringGaps) ? result.monitoringGaps.length : 0;
@@ -14129,20 +14239,20 @@ function printRead(action2, appId, env, result, out) {
     return;
   }
   if (action2 === "incidents") {
-    const incidents = Array.isArray(result.incidents) ? result.incidents.filter(record10) : [];
+    const incidents = Array.isArray(result.incidents) ? result.incidents.filter(record11) : [];
     out.log(`monitor incidents ${appId}/${env}: ${incidents.length}`);
     for (const incident2 of incidents) out.log(`${String(incident2.state)}	${String(incident2.kind)}	${String(incident2.slo_id)}	${new Date(Number(incident2.opened_at)).toISOString()}`);
     return;
   }
   out.log(`monitor report ${appId}/${env}: ${String(result.period)} ${String(result.overall)}`);
-  const probes = Array.isArray(result.probes) ? result.probes.filter(record10) : [];
+  const probes = Array.isArray(result.probes) ? result.probes.filter(record11) : [];
   for (const probe of probes) out.log(`probe	${String(probe.id)}	${Number(probe.good)} good	${Number(probe.bad)} bad	${Number(probe.unknown)} unknown`);
 }
 function emit3(value2, json, out, human) {
   if (json) out.log(JSON.stringify(value2, null, 2));
   else human();
 }
-function record10(value2) {
+function record11(value2) {
   return value2 !== null && typeof value2 === "object" && !Array.isArray(value2);
 }
 function string(value2) {
@@ -14633,6 +14743,122 @@ async function provision(options) {
   }
 }
 
+// src/promotion-command.ts
+var import_promises12 = require("fs/promises");
+var import_apps14 = require("@odla-ai/apps");
+
+// src/security-command-context.ts
+async function hostedSecurityContext(parsed, dependencies) {
+  const configPath = stringOpt(parsed.options.config) ?? "odla.config.mjs";
+  const cfg = await loadProjectConfig(configPath);
+  const env = stringOpt(parsed.options.env) ?? (cfg.envs.includes("dev") ? "dev" : cfg.envs[0]);
+  if (!env || !cfg.envs.includes(env)) {
+    throw new Error(`env "${env ?? ""}" is not declared in ${configPath}`);
+  }
+  const platform = platformAudience(stringOpt(parsed.options.platform) ?? cfg.platformUrl);
+  if (platformAudience(cfg.platformUrl) !== platform) {
+    throw new Error("--platform cannot reuse a project developer token from another platform; update odla.config.mjs and authenticate there");
+  }
+  const doFetch = dependencies.fetch ?? fetch;
+  const stdout = dependencies.stdout ?? console;
+  const open = parsed.options.open === false ? false : parsed.options.open === true ? true : void 0;
+  const token = await getDeveloperToken(
+    cfg,
+    { configPath, email: stringOpt(parsed.options.email), open, openApprovalUrl: dependencies.openUrl },
+    doFetch,
+    stdout,
+    { optionalProjectCapabilities: ["app.manage"] }
+  );
+  return { platform, token, appId: cfg.app.id, env, fetch: doFetch, stdout };
+}
+function requiredSecurityPositional(parsed, index, label) {
+  const value2 = parsed.positionals[index];
+  if (!value2) throw new Error(`${label} is required`);
+  return value2;
+}
+function securityProfile(value2) {
+  if (value2 === void 0) return void 0;
+  if (value2 === "odla" || value2 === "cloudflare-app" || value2 === "generic") return value2;
+  throw new Error("--profile must be odla, cloudflare-app, or generic");
+}
+
+// src/promotion-command.ts
+var render = (value2, json, out) => {
+  if (json) out.log(JSON.stringify(value2));
+  else out.log(JSON.stringify(value2, null, 2));
+};
+async function promotionCommand(parsed, dependencies) {
+  const action2 = parsed.positionals[1];
+  if (!action2 || !["plan", "inspect", "status", "apply", "rollback", "next", "record", "cancel"].includes(action2)) rejectWord(["promotion"], action2);
+  assertArgs(parsed, ["config", "env", "platform", "email", "open", "json", "file", "approval", "idempotency-key"], 5);
+  const context = await hostedSecurityContext(parsed, dependencies);
+  const client = (0, import_apps14.createAppsClient)({
+    token: context.token,
+    fetcher: { fetch: (request3, init) => {
+      const internal = new URL(typeof request3 === "string" ? request3 : request3.url);
+      return context.fetch(`${context.platform}${internal.pathname}${internal.search}`, init);
+    } }
+  });
+  const json = parsed.options.json === true;
+  if (action2 === "plan") {
+    if (parsed.positionals[2]) throw new Error("promotion plan takes --file, not a positional plan id");
+    const file = stringOpt(parsed.options.file);
+    if (!file) throw new Error("--file <promotion-plan.json> is required");
+    const source = JSON.parse(await (0, import_promises12.readFile)(file, "utf8"));
+    const plan2 = await client.createPromotionReleasePlan(context.appId, source);
+    render(plan2, json, context.stdout);
+    return;
+  }
+  const planId = requiredSecurityPositional(parsed, 2, "plan id");
+  if (action2 === "inspect") {
+    if (parsed.positionals[3]) throw new Error("promotion inspect takes only a plan id");
+    const plan2 = await client.getPromotionReleasePlan(context.appId, planId);
+    if (!plan2) throw new Error(`promotion release ${planId} was not found`);
+    render(plan2, json, context.stdout);
+    return;
+  }
+  if (action2 === "status") {
+    if (parsed.positionals[3]) throw new Error("promotion status takes only a plan id");
+    const status = await client.getPromotionReleaseStatus(context.appId, planId);
+    if (!status) throw new Error(`promotion release ${planId} was not found`);
+    render(status, json, context.stdout);
+    return;
+  }
+  if (action2 === "next" || action2 === "cancel" || action2 === "record") {
+    const operationId = requiredSecurityPositional(parsed, 3, "operation id");
+    if (action2 === "next") {
+      if (parsed.positionals[4]) throw new Error("promotion next takes only plan and operation ids");
+      render(await client.claimPromotionReleaseWork(context.appId, planId, operationId), json, context.stdout);
+      return;
+    }
+    if (action2 === "cancel") {
+      if (parsed.positionals[4]) throw new Error("promotion cancel takes only plan and operation ids");
+      render(await client.cancelPromotionReleaseOperation(context.appId, planId, operationId), json, context.stdout);
+      return;
+    }
+    const stepId = requiredSecurityPositional(parsed, 4, "step id");
+    const file = stringOpt(parsed.options.file);
+    if (!file) throw new Error("--file <step-receipt.json> is required");
+    const receipt = JSON.parse(await (0, import_promises12.readFile)(file, "utf8"));
+    render(await client.recordPromotionReleaseWork(context.appId, planId, operationId, stepId, receipt), json, context.stdout);
+    return;
+  }
+  const approvalId = stringOpt(parsed.options.approval);
+  if (parsed.positionals[3]) throw new Error(`promotion ${action2} takes only a plan id`);
+  if (!approvalId) throw new Error(`--approval <approval-id> is required for promotion ${action2}`);
+  const plan = await client.getPromotionReleasePlan(context.appId, planId);
+  if (!plan) throw new Error(`promotion release ${planId} was not found`);
+  if (plan.state !== "reviewable") throw new Error(`promotion release is ${plan.state}: ${plan.blockers.join("; ")}`);
+  const operationAction = action2;
+  const operation = await client.requestPromotionReleaseOperation(context.appId, planId, operationAction, {
+    approvalId,
+    planDigest: plan.planDigest,
+    targetSetDigest: plan.targetSetDigest,
+    idempotencyKey: stringOpt(parsed.options["idempotency-key"]) ?? `${operationAction}:${planId}`
+  });
+  render(operation, json, context.stdout);
+}
+
 // src/record.ts
 var import_node_fs18 = require("fs");
 var import_node_process18 = __toESM(require("process"), 1);
@@ -14652,12 +14878,12 @@ function recordInvocation(parsed) {
 }
 
 // src/advisory-output.ts
-var import_apps14 = require("@odla-ai/apps");
+var import_apps15 = require("@odla-ai/apps");
 function advisoryCollectingFetch(inner, sink) {
   return (async (input, init) => {
     const response2 = await inner(input, init);
     try {
-      sink.push(...(0, import_apps14.parseAdvisories)(response2));
+      sink.push(...(0, import_apps15.parseAdvisories)(response2));
     } catch {
     }
     return response2;
@@ -14677,7 +14903,7 @@ function renderAdvisories(out, advisories, env = process.env) {
     const key = `${advisory.code}:${advisory.message}`;
     if (seen.has(key)) continue;
     seen.add(key);
-    out.error((0, import_apps14.formatAdvisory)(advisory));
+    out.error((0, import_apps15.formatAdvisory)(advisory));
   }
 }
 
@@ -14964,7 +15190,7 @@ async function bySlug(ctx, slug) {
     "GET",
     `/runbook?app=${encodeURIComponent(ctx.appId)}&slug=${encodeURIComponent(slug)}&limit=1`
   );
-  const filtered = page2.records.find((record11) => record11.slug === slug);
+  const filtered = page2.records.find((record12) => record12.slug === slug);
   if (filtered) return filtered;
   const limit = 100;
   for (let offset = 0; ; offset += limit) {
@@ -14973,7 +15199,7 @@ async function bySlug(ctx, slug) {
       "GET",
       `/runbook?app=${encodeURIComponent(ctx.appId)}&limit=${limit}&offset=${offset}`
     );
-    const found = fallback.records.find((record11) => record11.slug === slug);
+    const found = fallback.records.find((record12) => record12.slug === slug);
     if (found) return found;
     if (!fallback.records.length || offset + fallback.records.length >= fallback.total) break;
   }
@@ -15773,41 +15999,6 @@ async function runbookCommand(parsed, deps = {}) {
   }
 }
 
-// src/security-command-context.ts
-async function hostedSecurityContext(parsed, dependencies) {
-  const configPath = stringOpt(parsed.options.config) ?? "odla.config.mjs";
-  const cfg = await loadProjectConfig(configPath);
-  const env = stringOpt(parsed.options.env) ?? (cfg.envs.includes("dev") ? "dev" : cfg.envs[0]);
-  if (!env || !cfg.envs.includes(env)) {
-    throw new Error(`env "${env ?? ""}" is not declared in ${configPath}`);
-  }
-  const platform = platformAudience(stringOpt(parsed.options.platform) ?? cfg.platformUrl);
-  if (platformAudience(cfg.platformUrl) !== platform) {
-    throw new Error("--platform cannot reuse a project developer token from another platform; update odla.config.mjs and authenticate there");
-  }
-  const doFetch = dependencies.fetch ?? fetch;
-  const stdout = dependencies.stdout ?? console;
-  const open = parsed.options.open === false ? false : parsed.options.open === true ? true : void 0;
-  const token = await getDeveloperToken(
-    cfg,
-    { configPath, email: stringOpt(parsed.options.email), open, openApprovalUrl: dependencies.openUrl },
-    doFetch,
-    stdout,
-    { optionalProjectCapabilities: ["app.manage"] }
-  );
-  return { platform, token, appId: cfg.app.id, env, fetch: doFetch, stdout };
-}
-function requiredSecurityPositional(parsed, index, label) {
-  const value2 = parsed.positionals[index];
-  if (!value2) throw new Error(`${label} is required`);
-  return value2;
-}
-function securityProfile(value2) {
-  if (value2 === void 0) return void 0;
-  if (value2 === "odla" || value2 === "cloudflare-app" || value2 === "generic") return value2;
-  throw new Error("--profile must be odla, cloudflare-app, or generic");
-}
-
 // src/security-command-output.ts
 function printHostedSecurityPlan(out, plan, appId) {
   out.log(`Hosted security plan for ${appId}/${plan.env}: ${plan.ready ? "ready" : "not ready"}`);
@@ -16630,6 +16821,10 @@ async function dispatchCli(argv, dependencies) {
     await securityCommand(parsed, runtime);
     return;
   }
+  if (command === "promotion") {
+    await promotionCommand(parsed, runtime);
+    return;
+  }
   if (command === "brand") {
     await brandCommand(parsed, runtime);
     return;