@odla-ai/cli 0.5.0 → 0.7.0

package/dist/bin.cjs

@@ -28,7 +28,724 @@ var getImportMetaUrl = () => typeof document === "undefined" ? new URL(`file:${_
 var importMetaUrl = /* @__PURE__ */ getImportMetaUrl();
 
 // src/cli.ts
-var import_node_fs7 = require("fs");
+var import_security2 = require("@odla-ai/security");
+
+// src/admin-ai.ts
+var import_node_process4 = __toESM(require("process"), 1);
+
+// src/token.ts
+var import_db = require("@odla-ai/db");
+var import_node_process2 = __toESM(require("process"), 1);
+
+// src/open.ts
+var import_node_child_process = require("child_process");
+var import_node_process = __toESM(require("process"), 1);
+async function openUrl(url, options = {}) {
+  const command = openerFor(options.platform ?? import_node_process.default.platform);
+  const doSpawn = options.spawnImpl ?? import_node_child_process.spawn;
+  await new Promise((resolve7, reject) => {
+    const child = doSpawn(command.cmd, [...command.args, url], {
+      stdio: "ignore",
+      detached: true
+    });
+    child.once("error", reject);
+    child.once("spawn", () => {
+      child.unref();
+      resolve7();
+    });
+  });
+}
+function openerFor(platform) {
+  if (platform === "darwin") return { cmd: "open", args: [] };
+  if (platform === "win32") return { cmd: "cmd", args: ["/c", "start", ""] };
+  return { cmd: "xdg-open", args: [] };
+}
+
+// src/local.ts
+var import_node_fs = require("fs");
+var import_node_path = require("path");
+var GITIGNORE_LINES = [".odla/*.local.json", ".odla/dev-token.json", ".dev.vars"];
+function readJsonFile(path) {
+  try {
+    return JSON.parse((0, import_node_fs.readFileSync)(path, "utf8"));
+  } catch {
+    return null;
+  }
+}
+function writePrivateJson(path, value) {
+  writePrivateText(path, `${JSON.stringify(value, null, 2)}
+`);
+}
+function readCredentials(path) {
+  if (!(0, import_node_fs.existsSync)(path)) return null;
+  let value;
+  try {
+    value = JSON.parse((0, import_node_fs.readFileSync)(path, "utf8"));
+  } catch {
+    throw new Error(`credentials file ${path} is not valid JSON; fix or remove it before provisioning`);
+  }
+  if (!value || typeof value !== "object" || typeof value.appId !== "string" || !value.envs || typeof value.envs !== "object") {
+    throw new Error(`credentials file ${path} has an invalid shape; fix or remove it before provisioning`);
+  }
+  return value;
+}
+function mergeCredential(current, update) {
+  const next = current ?? {
+    appId: update.appId,
+    platformUrl: update.platformUrl,
+    dbEndpoint: update.dbEndpoint,
+    updatedAt: (/* @__PURE__ */ new Date(0)).toISOString(),
+    envs: {}
+  };
+  next.appId = update.appId;
+  next.platformUrl = update.platformUrl;
+  next.dbEndpoint = update.dbEndpoint;
+  next.updatedAt = (/* @__PURE__ */ new Date()).toISOString();
+  next.envs[update.env] = {
+    ...next.envs[update.env] ?? {},
+    tenantId: update.tenantId,
+    ...update.dbKey ? { dbKey: update.dbKey } : {},
+    ...update.o11yToken ? { o11yToken: update.o11yToken } : {}
+  };
+  return next;
+}
+function ensureGitignore(rootDir, localPaths = []) {
+  const path = (0, import_node_path.resolve)(rootDir, ".gitignore");
+  const existing = (0, import_node_fs.existsSync)(path) ? (0, import_node_fs.readFileSync)(path, "utf8") : "";
+  const configured = localPaths.map((localPath) => gitignoreEntry(rootDir, localPath)).filter((line) => !!line);
+  const wanted = [.../* @__PURE__ */ new Set([...GITIGNORE_LINES, ...configured])];
+  const missing = wanted.filter((line) => !existing.split(/\r?\n/).includes(line));
+  if (missing.length === 0) return;
+  const prefix = existing && !existing.endsWith("\n") ? "\n" : "";
+  (0, import_node_fs.writeFileSync)(path, `${existing}${prefix}${missing.join("\n")}
+`);
+}
+function o11yDevVars(cfg) {
+  if (!cfg.services.includes("o11y")) return void 0;
+  return {
+    endpoint: cfg.o11y?.endpoint ?? "https://o11y.odla.ai",
+    service: cfg.o11y?.service ?? cfg.app.id,
+    ...cfg.o11y?.version ? { version: cfg.o11y.version } : {}
+  };
+}
+function resolveWriteDevVarsTarget(cfg, requested) {
+  if (!requested) return null;
+  if (requested === true) return cfg.local.devVarsFile;
+  return (0, import_node_path.resolve)((0, import_node_path.dirname)(cfg.configPath), requested);
+}
+function writeDevVars(path, credentials, env, o11y) {
+  const entry = credentials.envs[env];
+  if (!entry) throw new Error(`no credentials for env "${env}" in ${path}`);
+  const lines = [`ODLA_PLATFORM="${credentials.platformUrl}"`];
+  if (entry.dbKey) lines.push(`ODLA_ENDPOINT="${credentials.dbEndpoint}"`);
+  lines.push(`ODLA_APP_ID="${credentials.appId}"`, `ODLA_ENV="${env}"`, `ODLA_TENANT="${entry.tenantId}"`);
+  if (entry.dbKey) lines.push(`ODLA_API_KEY="${entry.dbKey}"`);
+  if (o11y) {
+    lines.push(`ODLA_O11Y_ENDPOINT="${o11y.endpoint}"`, `ODLA_O11Y_SERVICE="${o11y.service}"`);
+    if (o11y.version) lines.push(`ODLA_O11Y_VERSION="${o11y.version}"`);
+    if (entry.o11yToken) lines.push(`ODLA_O11Y_TOKEN="${entry.o11yToken}"`);
+  }
+  const existing = (0, import_node_fs.existsSync)(path) ? (0, import_node_fs.readFileSync)(path, "utf8") : "";
+  const retained = existing.split(/\r?\n/).filter((line) => !isManagedDevVar(line));
+  while (retained.at(-1) === "") retained.pop();
+  const prefix = retained.length ? `${retained.join("\n")}
+
+` : "";
+  writePrivateText(path, `${prefix}${lines.join("\n")}
+`);
+}
+var MANAGED_DEV_VARS = /* @__PURE__ */ new Set([
+  "ODLA_PLATFORM",
+  "ODLA_ENDPOINT",
+  "ODLA_APP_ID",
+  "ODLA_ENV",
+  "ODLA_TENANT",
+  "ODLA_API_KEY",
+  "ODLA_O11Y_ENDPOINT",
+  "ODLA_O11Y_SERVICE",
+  "ODLA_O11Y_VERSION",
+  "ODLA_O11Y_TOKEN"
+]);
+function isManagedDevVar(line) {
+  const match = line.match(/^\s*(?:export\s+)?([A-Z][A-Z0-9_]*)\s*=/);
+  return !!match?.[1] && MANAGED_DEV_VARS.has(match[1]);
+}
+function writePrivateText(path, text) {
+  (0, import_node_fs.mkdirSync)((0, import_node_path.dirname)(path), { recursive: true });
+  const temporary = `${path}.tmp-${process.pid}-${Date.now()}`;
+  (0, import_node_fs.writeFileSync)(temporary, text, { mode: 384 });
+  (0, import_node_fs.chmodSync)(temporary, 384);
+  (0, import_node_fs.renameSync)(temporary, path);
+}
+function gitignoreEntry(rootDir, path) {
+  const rel = (0, import_node_path.relative)((0, import_node_path.resolve)(rootDir), (0, import_node_path.resolve)(path));
+  if (!rel || rel === ".." || rel.startsWith(`..${process.platform === "win32" ? "\\" : "/"}`) || (0, import_node_path.isAbsolute)(rel)) return null;
+  return rel.replaceAll("\\", "/");
+}
+function displayPath(path, rootDir = process.cwd()) {
+  const rel = (0, import_node_path.relative)(rootDir, path);
+  return rel && !rel.startsWith("..") ? rel : path;
+}
+
+// src/token.ts
+async function getDeveloperToken(cfg, options, doFetch, out) {
+  if (options.token) return options.token;
+  const audience = platformAudience(cfg.platformUrl);
+  if (import_node_process2.default.env.ODLA_DEV_TOKEN) {
+    const declared = import_node_process2.default.env.ODLA_DEV_TOKEN_AUDIENCE;
+    if (declared) {
+      if (platformAudience(declared) !== audience) throw new Error("ODLA_DEV_TOKEN_AUDIENCE does not match the configured platform");
+    } else if (audience !== "https://odla.ai") {
+      throw new Error("ODLA_DEV_TOKEN_AUDIENCE is required for a non-default platform");
+    }
+    return import_node_process2.default.env.ODLA_DEV_TOKEN;
+  }
+  const cached = readJsonFile(cfg.local.tokenFile);
+  if (cached?.token && cached.platform === audience && (cached.expiresAt ?? 0) > Date.now() + 6e4) {
+    out.log(`auth: using cached developer token (${displayPath(cfg.local.tokenFile, cfg.rootDir)})`);
+    return cached.token;
+  }
+  const browser = approvalBrowser(options);
+  const { token, expiresAt } = await (0, import_db.requestToken)({
+    endpoint: cfg.platformUrl,
+    label: `${cfg.app.id} provisioner`,
+    fetch: doFetch,
+    onCode: async ({ userCode, expiresIn }) => {
+      const approvalUrl = handshakeUrl(cfg.platformUrl, userCode);
+      out.log("");
+      out.log(`Approve code ${userCode} at ${approvalUrl} within ${Math.floor(expiresIn / 60)}m.`);
+      if (browser.open) {
+        try {
+          await (options.openApprovalUrl ?? openUrl)(approvalUrl);
+          out.log(`auth: opened browser for approval${browser.mode === "auto" ? " (auto)" : ""}`);
+        } catch (err) {
+          out.log(`auth: could not open browser (${err instanceof Error ? err.message : String(err)})`);
+        }
+      } else if (browser.reason) {
+        out.log(`auth: browser launch skipped (${browser.reason})`);
+      }
+      out.log("");
+    }
+  });
+  writePrivateJson(cfg.local.tokenFile, { platform: audience, token, expiresAt });
+  out.log(`auth: developer token cached (${displayPath(cfg.local.tokenFile, cfg.rootDir)})`);
+  return token;
+}
+function approvalBrowser(options) {
+  if (options.open === true) return { open: true, mode: "forced" };
+  if (options.open === false) return { open: false, reason: "disabled by --no-open" };
+  if (import_node_process2.default.env.CI) return { open: false, reason: "CI environment" };
+  const interactive = options.interactive ?? Boolean(import_node_process2.default.stdin.isTTY && import_node_process2.default.stdout.isTTY);
+  if (!interactive) return { open: false, reason: "non-interactive shell; pass --open to force" };
+  return { open: true, mode: "auto" };
+}
+function handshakeUrl(platformUrl, userCode) {
+  const url = new URL("/studio", platformUrl);
+  url.searchParams.set("code", userCode);
+  return url.toString();
+}
+function platformAudience(value) {
+  let url;
+  try {
+    url = new URL(value);
+  } catch {
+    throw new Error("platform must be an absolute URL");
+  }
+  const local = url.hostname === "localhost" || url.hostname === "127.0.0.1" || url.hostname === "[::1]";
+  if (url.protocol !== "https:" && !(local && url.protocol === "http:")) {
+    throw new Error("platform credentials require HTTPS except for loopback development");
+  }
+  if (url.username || url.password || url.search || url.hash) {
+    throw new Error("platform URL must not contain credentials, query, or fragment");
+  }
+  return url.origin;
+}
+
+// src/admin-ai-auth.ts
+var import_node_fs2 = require("fs");
+var import_node_process3 = __toESM(require("process"), 1);
+var import_db2 = require("@odla-ai/db");
+async function getScopedPlatformToken(options) {
+  return resolveAdminPlatformToken(options);
+}
+async function resolveAdminPlatformToken(options) {
+  const audience = platformAudience(options.platform);
+  if (options.token) return options.token;
+  const fromEnv = import_node_process3.default.env.ODLA_ADMIN_TOKEN;
+  if (fromEnv) return audienceBoundEnvToken(fromEnv, audience);
+  return scopedToken(
+    audience,
+    options.scope,
+    options,
+    options.fetch ?? fetch,
+    options.stdout ?? console
+  );
+}
+function audienceBoundEnvToken(token, platform) {
+  const audience = platformAudience(platform);
+  const declared = import_node_process3.default.env.ODLA_ADMIN_TOKEN_AUDIENCE;
+  if (declared) {
+    if (platformAudience(declared) !== audience) throw new Error("ODLA_ADMIN_TOKEN_AUDIENCE does not match the configured platform");
+  } else if (audience !== "https://odla.ai") {
+    throw new Error("ODLA_ADMIN_TOKEN_AUDIENCE is required for a non-default platform");
+  }
+  return token;
+}
+async function scopedToken(platform, scope, options, doFetch, out) {
+  const audience = platformAudience(platform);
+  const tokenFile = options.tokenFile ?? `${import_node_process3.default.cwd()}/.odla/admin-token.local.json`;
+  const cache = readJsonFile(tokenFile);
+  const cached = cache?.platform === audience ? cache.tokens?.[scope] : void 0;
+  if (cached?.token && (cached.expiresAt ?? 0) > Date.now() + 6e4) {
+    out.log(`auth: using cached ${scope} grant (${tokenFile})`);
+    return cached.token;
+  }
+  const { token, expiresAt } = await (0, import_db2.requestToken)({
+    endpoint: audience,
+    label: `odla CLI admin AI (${scope})`,
+    scopes: [scope],
+    fetch: doFetch,
+    onCode: async ({ userCode, expiresIn }) => {
+      const approvalUrl = handshakeUrl(audience, userCode);
+      out.log(`Approve scoped request ${userCode} at ${approvalUrl} within ${Math.floor(expiresIn / 60)}m.`);
+      const shouldOpen = options.open === true || options.open !== false && !import_node_process3.default.env.CI && Boolean(import_node_process3.default.stdin.isTTY && import_node_process3.default.stdout.isTTY);
+      if (shouldOpen) await (options.openApprovalUrl ?? openUrl)(approvalUrl).catch(() => void 0);
+    }
+  });
+  const tokens = cache?.platform === audience ? { ...cache.tokens ?? {} } : {};
+  tokens[scope] = { token, expiresAt };
+  if ((0, import_node_fs2.existsSync)(`${import_node_process3.default.cwd()}/.git`)) ensureGitignore(import_node_process3.default.cwd(), [tokenFile]);
+  writePrivateJson(tokenFile, { platform: audience, tokens });
+  out.log(`auth: cached ${scope} grant (${tokenFile}; mode 0600)`);
+  return token;
+}
+
+// src/admin-ai-audit.ts
+function adminAiAuditQuery(filters) {
+  if (filters.limit === void 0) return "";
+  if (!Number.isSafeInteger(filters.limit) || filters.limit < 1 || filters.limit > 200) {
+    throw new Error("audit limit must be an integer from 1 to 200");
+  }
+  return `?limit=${filters.limit}`;
+}
+async function readAdminAiAudit(request) {
+  const response = await request.fetch(`${request.platform}/registry/platform/ai-audit${request.query}`, {
+    headers: request.headers
+  });
+  const body = await responseBody(response);
+  if (!response.ok) throw new Error(apiError(response.status, body));
+  if (request.json) {
+    request.stdout.log(JSON.stringify(body, null, 2));
+    return;
+  }
+  const events = isRecord(body) && Array.isArray(body.events) ? body.events.filter(isRecord) : [];
+  request.stdout.log("when	change	target	before -> after	actor");
+  for (const event of events) {
+    const before = isRecord(event.oldPolicy) ? event.oldPolicy : void 0;
+    const after = isRecord(event.newPolicy) ? event.newPolicy : void 0;
+    const route = before && after ? `${String(before.provider)}/${String(before.model)}@v${String(before.version)} -> ${String(after.provider)}/${String(after.model)}@v${String(after.version)}` : "value not retained";
+    request.stdout.log([
+      timestamp(event.createdAt),
+      String(event.changeKind ?? ""),
+      String(event.purpose ?? event.provider ?? ""),
+      route,
+      `${String(event.actorType ?? "")}:${String(event.actorId ?? "")}`
+    ].join("	"));
+  }
+}
+async function responseBody(response) {
+  const text = await response.text();
+  if (!text) return {};
+  try {
+    return JSON.parse(text);
+  } catch {
+    return { message: text.slice(0, 300) };
+  }
+}
+function apiError(status, body) {
+  const error = isRecord(body) && isRecord(body.error) ? body.error : void 0;
+  const message = error && typeof error.message === "string" ? error.message : isRecord(body) && typeof body.message === "string" ? body.message : "request failed";
+  return `read System AI admin changes failed (${status}): ${message}`;
+}
+function timestamp(value) {
+  if (typeof value !== "number" || !Number.isFinite(value)) return String(value ?? "");
+  const date = new Date(value);
+  return Number.isFinite(date.valueOf()) ? date.toISOString() : "";
+}
+function isRecord(value) {
+  return Boolean(value) && typeof value === "object" && !Array.isArray(value);
+}
+
+// src/admin-ai-policy.ts
+var SYSTEM_AI_PURPOSES = ["o11y.triage", "security.discovery", "security.validation"];
+function requireSystemAiPurpose(value) {
+  if (!SYSTEM_AI_PURPOSES.includes(value)) {
+    throw new Error(`purpose must be one of: ${SYSTEM_AI_PURPOSES.join(", ")}`);
+  }
+  return value;
+}
+
+// src/admin-ai-usage.ts
+function adminAiUsageQuery(filters) {
+  const params = new URLSearchParams();
+  if (filters.appId?.trim()) params.set("appId", filters.appId.trim());
+  if (filters.env?.trim()) params.set("env", filters.env.trim());
+  if (filters.runId?.trim()) params.set("runId", filters.runId.trim());
+  if (filters.limit !== void 0) params.set("limit", String(usageLimit(filters.limit)));
+  const query = params.toString();
+  return query ? `?${query}` : "";
+}
+async function readAdminAiUsage(request) {
+  const res = await request.fetch(`${request.platform}/registry/platform/ai-usage${request.query}`, {
+    headers: request.headers
+  });
+  const body = await responseBody2(res);
+  if (!res.ok) throw new Error(apiError2("read platform AI usage", res.status, body));
+  if (request.json) request.stdout.log(JSON.stringify(body, null, 2));
+  else printUsage(body, request.stdout);
+}
+function usageLimit(value) {
+  if (!Number.isSafeInteger(value) || value < 1 || value > 500) {
+    throw new Error("usage limit must be an integer from 1 to 500");
+  }
+  return value;
+}
+function printUsage(body, out) {
+  const aggregates = isRecord2(body) && isRecord2(body.aggregates) && Array.isArray(body.aggregates.byStatus) ? body.aggregates.byStatus.filter(isRecord2) : [];
+  out.log(`All retained hosted-security status totals (up to ${String(isRecord2(body) ? body.retentionDays ?? 90 : 90)} days; o11y triage excluded)
+status	calls	input tokens	output tokens	cost	unpriced calls`);
+  for (const row of aggregates) {
+    out.log([
+      String(row.status ?? ""),
+      String(row.calls ?? ""),
+      String(row.input_tokens ?? ""),
+      String(row.output_tokens ?? ""),
+      formatMicrousd(row.cost_microusd),
+      String(row.unpriced_calls ?? "")
+    ].join("	"));
+  }
+  const events = isRecord2(body) && Array.isArray(body.events) ? body.events.filter(isRecord2) : [];
+  out.log(`Latest ${String(isRecord2(body) ? body.eventLimit ?? events.length : events.length)} hosted-security events
+when	app/env	run	actor	purpose/role	route / policy	tokens	cost	status`);
+  for (const event of events) {
+    const input = numeric(event.input_tokens);
+    const output = numeric(event.output_tokens);
+    const priced = event.priced === true || event.priced === 1;
+    out.log([
+      timestamp2(event.created_at),
+      `${String(event.app_id ?? "")}/${String(event.env ?? "")}`,
+      String(event.run_id ?? ""),
+      `${String(event.actor_type ?? "")}:${String(event.actor_id ?? "")}`,
+      `${String(event.purpose ?? "")}/${String(event.role ?? "")}`,
+      `${String(event.provider ?? "")}/${String(event.model ?? "")}@v${String(event.policy_version ?? "unknown")}`,
+      String(input + output),
+      priced ? formatMicrousd(event.cost_microusd) : "unpriced",
+      `${String(event.status ?? "")}${event.error_code ? `:${String(event.error_code)}` : ""}`
+    ].join("	"));
+  }
+}
+function numeric(value) {
+  return typeof value === "number" && Number.isFinite(value) ? value : 0;
+}
+function formatMicrousd(value) {
+  return typeof value === "number" && Number.isFinite(value) ? `$${(value / 1e6).toFixed(6)}` : "unpriced";
+}
+function timestamp2(value) {
+  if (typeof value !== "number" || !Number.isFinite(value)) return String(value ?? "");
+  const date = new Date(value);
+  return Number.isFinite(date.valueOf()) ? date.toISOString() : "";
+}
+async function responseBody2(res) {
+  const text = await res.text();
+  if (!text) return {};
+  try {
+    return JSON.parse(text);
+  } catch {
+    return { message: text.slice(0, 300) };
+  }
+}
+function apiError2(action, status, body) {
+  const error = isRecord2(body) && isRecord2(body.error) ? body.error : void 0;
+  const message = error && typeof error.message === "string" ? error.message : isRecord2(body) && typeof body.message === "string" ? body.message : "request failed";
+  return `${action} failed (${status}): ${message}`;
+}
+function isRecord2(value) {
+  return Boolean(value) && typeof value === "object" && !Array.isArray(value);
+}
+
+// src/admin-ai.ts
+async function adminAi(options) {
+  const platform = platformAudience(options.platform ?? import_node_process4.default.env.ODLA_PLATFORM ?? "https://odla.ai");
+  const doFetch = options.fetch ?? fetch;
+  const out = options.stdout ?? console;
+  const usageQuery = options.action === "usage" ? adminAiUsageQuery(options) : void 0;
+  const auditQuery = options.action === "audit" ? adminAiAuditQuery(options) : void 0;
+  const scope = options.action === "set" ? "platform:ai:policy:write" : options.action === "credential-set" ? "platform:ai:credential:write" : options.action === "credentials" ? "platform:ai:credential:read" : options.action === "usage" ? "platform:ai:usage:read" : options.action === "audit" ? "platform:ai:audit:read" : "platform:ai:policy:read";
+  const token = await resolveAdminPlatformToken({
+    platform,
+    scope,
+    token: options.token,
+    open: options.open,
+    fetch: doFetch,
+    stdout: out,
+    openApprovalUrl: options.openApprovalUrl,
+    tokenFile: options.tokenFile
+  });
+  const headers = { authorization: `Bearer ${token}`, "content-type": "application/json" };
+  if (options.action === "usage") {
+    await readAdminAiUsage({ platform, query: usageQuery ?? "", headers, json: options.json, fetch: doFetch, stdout: out });
+    return;
+  }
+  if (options.action === "audit") {
+    await readAdminAiAudit({ platform, query: auditQuery ?? "", headers, json: options.json, fetch: doFetch, stdout: out });
+    return;
+  }
+  if (options.action === "credentials") {
+    const res2 = await doFetch(`${platform}/registry/platform/ai-credentials`, { headers });
+    const body2 = await responseBody3(res2);
+    if (!res2.ok) throw new Error(apiError3("read platform AI credential status", res2.status, body2));
+    const credentials = isRecord3(body2) && isRecord3(body2.credentials) ? body2.credentials : body2;
+    if (options.json) out.log(JSON.stringify({ credentials }, null, 2));
+    else for (const [provider, status] of Object.entries(isRecord3(credentials) ? credentials : {})) {
+      const label = isRecord3(status) && status.set === true ? status.readable === true ? "vault readable" : "stored; vault unreadable" : "not set";
+      out.log(`${provider}	${label}`);
+    }
+    return;
+  }
+  if (options.action === "credential-set") {
+    const provider = requireProvider(options.credentialProvider);
+    const value = await credentialValue(options);
+    const res2 = await doFetch(`${platform}/registry/platform/ai-credentials/${encodeURIComponent(provider)}`, {
+      method: "PUT",
+      headers,
+      body: JSON.stringify({ value })
+    });
+    const body2 = await responseBody3(res2);
+    if (!res2.ok) throw new Error(apiError3(`store ${provider} platform credential`, res2.status, body2));
+    out.log(`stored ${provider} platform credential (write-only; value was not returned)`);
+    return;
+  }
+  if (options.action === "show" || options.action === "models") {
+    const res2 = await doFetch(`${platform}/registry/platform/ai-policies`, { headers });
+    const body2 = await responseBody3(res2);
+    if (!res2.ok) throw new Error(apiError3("read platform AI policies", res2.status, body2));
+    if (options.action === "models") {
+      const models = catalogModels(body2).filter((model) => !options.provider || model.provider === options.provider);
+      if (!models.length) throw new Error(options.provider ? `no System AI models found for provider ${options.provider}` : "platform returned no System AI models");
+      if (options.json) out.log(JSON.stringify({ models }, null, 2));
+      else for (const model of models) out.log(`${model.provider}	${model.id}`);
+      return;
+    }
+    const policies = policyArray(body2);
+    if (options.json) {
+      out.log(JSON.stringify({ policies, models: catalogModels(body2) }, null, 2));
+      return;
+    }
+    out.log("purpose	enabled	provider	model	max calls	max input bytes	max output tokens");
+    for (const policy2 of policies) {
+      out.log([
+        policy2.purpose,
+        String(policy2.enabled),
+        policy2.provider,
+        policy2.model,
+        String(policy2.maxCallsPerRun ?? ""),
+        String(policy2.maxInputBytes ?? ""),
+        String(policy2.maxOutputTokens ?? "")
+      ].join("	"));
+    }
+    return;
+  }
+  if (options.purpose === "security") {
+    const currentResponse = await doFetch(`${platform}/registry/platform/ai-policies`, { headers });
+    const currentBody = await responseBody3(currentResponse);
+    if (!currentResponse.ok) throw new Error(apiError3("read current security AI policies", currentResponse.status, currentBody));
+    const policies = policyArray(currentBody);
+    const discovery = policies.find((policy2) => policy2.purpose === "security.discovery");
+    const validation = policies.find((policy2) => policy2.purpose === "security.validation");
+    if (!discovery || !validation || !Number.isSafeInteger(discovery.version) || !Number.isSafeInteger(validation.version)) {
+      throw new Error("platform returned invalid security AI policy revisions");
+    }
+    const shared = {
+      ...options.enabled === void 0 ? {} : { enabled: options.enabled },
+      ...options.maxInputBytes === void 0 ? {} : { maxInputBytes: options.maxInputBytes },
+      ...options.maxOutputTokens === void 0 ? {} : { maxOutputTokens: options.maxOutputTokens },
+      ...options.maxCallsPerRun === void 0 ? {} : { maxCallsPerRun: options.maxCallsPerRun }
+    };
+    const discoveryUpdate = {
+      ...shared,
+      ...options.discoveryProvider?.trim() ? { provider: options.discoveryProvider.trim() } : {},
+      ...options.discoveryModel?.trim() ? { model: options.discoveryModel.trim() } : {}
+    };
+    const validationUpdate = {
+      ...shared,
+      ...options.validationProvider?.trim() ? { provider: options.validationProvider.trim() } : {},
+      ...options.validationModel?.trim() ? { model: options.validationModel.trim() } : {}
+    };
+    if (!Object.keys(discoveryUpdate).length && !Object.keys(validationUpdate).length) {
+      throw new Error("security set requires a route, enabled state, or budget change");
+    }
+    const res2 = await doFetch(`${platform}/registry/platform/ai-policies/security`, {
+      method: "PUT",
+      headers,
+      body: JSON.stringify({
+        expectedVersions: { discovery: discovery.version, validation: validation.version },
+        discovery: discoveryUpdate,
+        validation: validationUpdate
+      })
+    });
+    const response2 = await responseBody3(res2);
+    if (!res2.ok) throw new Error(apiError3("update security review routes", res2.status, response2));
+    out.log(options.json ? JSON.stringify(response2, null, 2) : "updated security review discovery and independent validation routes atomically");
+    return;
+  }
+  const purpose = requireSystemAiPurpose(options.purpose);
+  const body = {
+    ...options.provider?.trim() ? { provider: options.provider.trim() } : {},
+    ...options.model?.trim() ? { model: options.model.trim() } : {},
+    ...options.enabled === void 0 ? {} : { enabled: options.enabled },
+    ...options.maxInputBytes === void 0 ? {} : { maxInputBytes: options.maxInputBytes },
+    ...options.maxOutputTokens === void 0 ? {} : { maxOutputTokens: options.maxOutputTokens },
+    ...options.maxCallsPerRun === void 0 ? {} : { maxCallsPerRun: options.maxCallsPerRun }
+  };
+  if (!Object.keys(body).length) throw new Error("set requires a provider, model, enabled state, or budget change");
+  const res = await doFetch(`${platform}/registry/platform/ai-policies/${encodeURIComponent(purpose)}`, {
+    method: "PUT",
+    headers,
+    body: JSON.stringify(body)
+  });
+  const response = await responseBody3(res);
+  if (!res.ok) throw new Error(apiError3(`update ${purpose}`, res.status, response));
+  const policy = isRecord3(response) && isRecord3(response.policy) ? response.policy : isRecord3(response) ? response : {};
+  out.log(options.json ? JSON.stringify({ policy }, null, 2) : `updated ${purpose}: ${String(policy.provider ?? "unchanged")}/${String(policy.model ?? "unchanged")}`);
+}
+function requireProvider(value) {
+  if (value !== "anthropic" && value !== "openai" && value !== "google") {
+    throw new Error("provider must be one of: anthropic, openai, google");
+  }
+  return value;
+}
+async function credentialValue(options) {
+  if (options.fromEnv && options.stdin) throw new Error("choose exactly one of --from-env or --stdin");
+  let value;
+  if (options.fromEnv) value = import_node_process4.default.env[options.fromEnv];
+  else if (options.stdin) value = await (options.readStdin ?? readStdin)();
+  else throw new Error("credential input required: use --from-env <NAME> or --stdin; values are never accepted as arguments");
+  value = value?.replace(/[\r\n]+$/, "");
+  if (!value) throw new Error(options.fromEnv ? `environment variable ${options.fromEnv} is empty or unset` : "stdin credential is empty");
+  if (new TextEncoder().encode(value).byteLength > 64 * 1024) throw new Error("credential exceeds 64 KiB");
+  return value;
+}
+async function readStdin() {
+  let value = "";
+  for await (const chunk of import_node_process4.default.stdin) {
+    value += String(chunk);
+    if (value.length > 64 * 1024) throw new Error("credential exceeds 64 KiB");
+  }
+  return value;
+}
+function policyArray(body) {
+  if (isRecord3(body) && Array.isArray(body.policies)) return body.policies.filter(isRecord3);
+  if (isRecord3(body) && isRecord3(body.policies)) return Object.values(body.policies).filter(isRecord3);
+  throw new Error("platform returned an invalid AI policy response");
+}
+function catalogModels(body) {
+  if (!isRecord3(body) || !isRecord3(body.catalog) || !Array.isArray(body.catalog.models)) {
+    throw new Error("platform returned an invalid System AI model catalog");
+  }
+  return body.catalog.models.filter((value) => isRecord3(value) && typeof value.id === "string" && typeof value.provider === "string");
+}
+async function responseBody3(res) {
+  const text = await res.text();
+  if (!text) return {};
+  try {
+    return JSON.parse(text);
+  } catch {
+    return { message: text.slice(0, 300) };
+  }
+}
+function apiError3(action, status, body) {
+  const error = isRecord3(body) && isRecord3(body.error) ? body.error : void 0;
+  const message = error && typeof error.message === "string" ? error.message : isRecord3(body) && typeof body.message === "string" ? body.message : "request failed";
+  return `${action} failed (${status}): ${message}`;
+}
+function isRecord3(value) {
+  return Boolean(value) && typeof value === "object" && !Array.isArray(value);
+}
+
+// src/argv.ts
+function parseArgv(argv) {
+  const positionals = [];
+  const options = {};
+  for (let i = 0; i < argv.length; i++) {
+    const arg = argv[i];
+    if (!arg.startsWith("--")) {
+      positionals.push(arg);
+      continue;
+    }
+    const eq = arg.indexOf("=");
+    const rawName = arg.slice(2, eq === -1 ? void 0 : eq);
+    if (!rawName) continue;
+    if (rawName.startsWith("no-")) {
+      options[rawName.slice(3)] = false;
+      continue;
+    }
+    if (eq !== -1) {
+      addOption(options, rawName, arg.slice(eq + 1));
+      continue;
+    }
+    const value = argv[i + 1];
+    if (value !== void 0 && !value.startsWith("--")) {
+      i++;
+      addOption(options, rawName, value);
+    } else {
+      addOption(options, rawName, true);
+    }
+  }
+  return { positionals, options };
+}
+function assertArgs(parsed, allowedOptions, maxPositionals) {
+  const allowed = new Set(allowedOptions);
+  for (const name of Object.keys(parsed.options)) {
+    if (!allowed.has(name)) throw new Error(`unknown option "--${name}"; run "odla-ai help" for supported options`);
+  }
+  if (parsed.positionals.length > maxPositionals) {
+    throw new Error(`unexpected argument "${parsed.positionals[maxPositionals]}"; run "odla-ai help"`);
+  }
+}
+function requiredString(value, name) {
+  const result = stringOpt(value);
+  if (!result) throw new Error(`${name} is required`);
+  return result;
+}
+function stringOpt(value) {
+  if (typeof value === "string") return value;
+  if (Array.isArray(value)) return value[value.length - 1];
+  return void 0;
+}
+function listOpt(value) {
+  if (value === void 0 || typeof value === "boolean") return void 0;
+  const values = Array.isArray(value) ? value : [value];
+  return values.flatMap((item) => item.split(",")).map((item) => item.trim()).filter(Boolean);
+}
+function boolOpt(value) {
+  if (typeof value === "boolean") return value;
+  if (typeof value === "string" && (value === "true" || value === "false")) return value === "true";
+  if (value === void 0) return void 0;
+  throw new Error("boolean option must be true or false");
+}
+function numberOpt(value, flag) {
+  if (value === void 0) return void 0;
+  const raw = stringOpt(value);
+  const parsed = raw === void 0 ? Number.NaN : Number(raw);
+  if (!Number.isSafeInteger(parsed) || parsed < 1) throw new Error(`${flag} requires a positive integer`);
+  return parsed;
+}
+function addOption(options, name, value) {
+  const current = options[name];
+  if (current === void 0) options[name] = value;
+  else if (Array.isArray(current)) current.push(String(value));
+  else options[name] = [String(current), String(value)];
+}
 
 // src/capabilities.ts
 var CAPABILITIES = {
@@ -37,7 +754,9 @@ var CAPABILITIES = {
     "issue, persist, and explicitly rotate configured service credentials",
     "write local Worker values and push deployed Worker secrets through Wrangler stdin",
     "push db schema/rules and configure platform AI, auth, and deployment links",
-    "validate config offline and smoke-test a provisioned db environment"
+    "validate config offline and smoke-test a provisioned db environment",
+    "run app-attributed hosted security discovery and independent validation without provider keys",
+    "let admins manage system AI policy and credentials, inspect attributed usage, and read immutable admin changes through separate short-lived capability-only approvals"
   ],
   agent: [
     "install and import the selected odla SDKs",
@@ -48,11 +767,13 @@ var CAPABILITIES = {
     "approve the odla device code and one-off third-party logins",
     "consent to production changes with --yes",
     "request destructive credential rotation explicitly",
-    "review application semantics, security findings, releases, and merges"
+    "review application semantics, security findings, releases, and merges",
+    "approve redacted-source disclosure before hosted security reasoning"
   ],
   studio: [
     "view telemetry and environment state",
-    "perform manual credential recovery when the CLI's local shown-once copy is unavailable"
+    "perform manual credential recovery when the CLI's local shown-once copy is unavailable",
+    "configure system AI purposes and view app/environment/run-attributed usage"
   ]
 };
 function printCapabilities(json = false, out = console) {
@@ -73,28 +794,28 @@ function printGroup(out, heading, items) {
 }
 
 // src/config.ts
-var import_node_fs = require("fs");
-var import_node_path = require("path");
+var import_node_fs3 = require("fs");
+var import_node_path2 = require("path");
 var import_node_url = require("url");
 var DEFAULT_PLATFORM = "https://odla.ai";
 var DEFAULT_ENVS = ["dev"];
 var DEFAULT_SERVICES = ["db", "ai"];
 async function loadProjectConfig(configPath = "odla.config.mjs") {
-  const resolved = (0, import_node_path.resolve)(configPath);
-  if (!(0, import_node_fs.existsSync)(resolved)) {
+  const resolved = (0, import_node_path2.resolve)(configPath);
+  if (!(0, import_node_fs3.existsSync)(resolved)) {
     throw new Error(`config not found: ${configPath}. Run "odla-ai init" first or pass --config.`);
   }
   const raw = await loadConfigModule(resolved);
-  const rootDir = (0, import_node_path.dirname)(resolved);
+  const rootDir = (0, import_node_path2.dirname)(resolved);
   validateRawConfig(raw, resolved);
   const platformUrl = trimSlash(process.env.ODLA_PLATFORM_URL || raw.platformUrl || DEFAULT_PLATFORM);
   const dbEndpoint = trimSlash(process.env.ODLA_DB_ENDPOINT || raw.dbEndpoint || platformUrl);
   const envs = unique(raw.envs?.length ? raw.envs : DEFAULT_ENVS);
   const services = unique(raw.services?.length ? raw.services : DEFAULT_SERVICES);
   const local = {
-    tokenFile: (0, import_node_path.resolve)(rootDir, raw.local?.tokenFile ?? ".odla/dev-token.json"),
-    credentialsFile: (0, import_node_path.resolve)(rootDir, raw.local?.credentialsFile ?? ".odla/credentials.local.json"),
-    devVarsFile: (0, import_node_path.resolve)(rootDir, raw.local?.devVarsFile ?? ".dev.vars"),
+    tokenFile: (0, import_node_path2.resolve)(rootDir, raw.local?.tokenFile ?? ".odla/dev-token.json"),
+    credentialsFile: (0, import_node_path2.resolve)(rootDir, raw.local?.credentialsFile ?? ".odla/credentials.local.json"),
+    devVarsFile: (0, import_node_path2.resolve)(rootDir, raw.local?.devVarsFile ?? ".dev.vars"),
     gitignore: raw.local?.gitignore ?? true
   };
   return {
@@ -111,9 +832,9 @@ async function loadProjectConfig(configPath = "odla.config.mjs") {
 async function resolveDataExport(cfg, value, names) {
   if (value === void 0 || value === null || value === false) return void 0;
   if (typeof value !== "string") return value;
-  const target = (0, import_node_path.isAbsolute)(value) ? value : (0, import_node_path.resolve)(cfg.rootDir, value);
+  const target = (0, import_node_path2.isAbsolute)(value) ? value : (0, import_node_path2.resolve)(cfg.rootDir, value);
   if (target.endsWith(".json")) {
-    return JSON.parse((0, import_node_fs.readFileSync)(target, "utf8"));
+    return JSON.parse((0, import_node_fs3.readFileSync)(target, "utf8"));
   }
   const mod = await import((0, import_node_url.pathToFileURL)(target).href);
   for (const name of names) {
@@ -164,175 +885,49 @@ function validId(value) {
   return typeof value === "string" && /^[a-z0-9][a-z0-9-]*$/.test(value);
 }
 async function loadConfigModule(path) {
-  if (path.endsWith(".json")) return JSON.parse((0, import_node_fs.readFileSync)(path, "utf8"));
+  if (path.endsWith(".json")) return JSON.parse((0, import_node_fs3.readFileSync)(path, "utf8"));
   const mod = await import(`${(0, import_node_url.pathToFileURL)(path).href}?t=${Date.now()}`);
   const value = mod.default ?? mod.config;
   if (typeof value === "function") return await value();
   return value;
 }
-function trimSlash(value) {
-  return value.replace(/\/+$/, "");
-}
-function unique(values) {
-  return [...new Set(values.filter(Boolean))];
-}
-
-// src/doctor-checks.ts
-var import_node_child_process2 = require("child_process");
-var import_node_fs4 = require("fs");
-var import_node_path4 = require("path");
-
-// src/redact.ts
-var REPLACEMENTS = [
-  [/odla_(sk|dev)_[A-Za-z0-9._-]+/g, "odla_$1_[redacted]"],
-  [/\bsk_(live|test)_[A-Za-z0-9]+/g, "sk_$1_[redacted]"],
-  [/\bsk-[A-Za-z0-9._-]+/g, "sk-[redacted]"],
-  [/\bwhsec_[A-Za-z0-9+/=]+/g, "whsec_[redacted]"],
-  [/\bo11y_[A-Za-z0-9]+/g, "o11y_[redacted]"],
-  [/\b(ghp|gho|github_pat)_[A-Za-z0-9_]+/g, "$1_[redacted]"],
-  [/\bAKIA[A-Z0-9]{12,}/g, "AKIA[redacted]"]
-];
-function redactSecrets(value) {
-  let result = value;
-  for (const [pattern, replacement] of REPLACEMENTS) result = result.replace(pattern, replacement);
-  return result;
-}
-function looksSecret(value) {
-  return redactSecrets(value) !== value || value.includes("-----BEGIN");
-}
-
-// src/local.ts
-var import_node_fs2 = require("fs");
-var import_node_path2 = require("path");
-var GITIGNORE_LINES = [".odla/*.local.json", ".odla/dev-token.json", ".dev.vars"];
-function readJsonFile(path) {
-  try {
-    return JSON.parse((0, import_node_fs2.readFileSync)(path, "utf8"));
-  } catch {
-    return null;
-  }
-}
-function writePrivateJson(path, value) {
-  writePrivateText(path, `${JSON.stringify(value, null, 2)}
-`);
-}
-function readCredentials(path) {
-  if (!(0, import_node_fs2.existsSync)(path)) return null;
-  let value;
-  try {
-    value = JSON.parse((0, import_node_fs2.readFileSync)(path, "utf8"));
-  } catch {
-    throw new Error(`credentials file ${path} is not valid JSON; fix or remove it before provisioning`);
-  }
-  if (!value || typeof value !== "object" || typeof value.appId !== "string" || !value.envs || typeof value.envs !== "object") {
-    throw new Error(`credentials file ${path} has an invalid shape; fix or remove it before provisioning`);
-  }
-  return value;
-}
-function mergeCredential(current, update) {
-  const next = current ?? {
-    appId: update.appId,
-    platformUrl: update.platformUrl,
-    dbEndpoint: update.dbEndpoint,
-    updatedAt: (/* @__PURE__ */ new Date(0)).toISOString(),
-    envs: {}
-  };
-  next.appId = update.appId;
-  next.platformUrl = update.platformUrl;
-  next.dbEndpoint = update.dbEndpoint;
-  next.updatedAt = (/* @__PURE__ */ new Date()).toISOString();
-  next.envs[update.env] = {
-    ...next.envs[update.env] ?? {},
-    tenantId: update.tenantId,
-    ...update.dbKey ? { dbKey: update.dbKey } : {},
-    ...update.o11yToken ? { o11yToken: update.o11yToken } : {}
-  };
-  return next;
-}
-function ensureGitignore(rootDir, localPaths = []) {
-  const path = (0, import_node_path2.resolve)(rootDir, ".gitignore");
-  const existing = (0, import_node_fs2.existsSync)(path) ? (0, import_node_fs2.readFileSync)(path, "utf8") : "";
-  const configured = localPaths.map((localPath) => gitignoreEntry(rootDir, localPath)).filter((line) => !!line);
-  const wanted = [.../* @__PURE__ */ new Set([...GITIGNORE_LINES, ...configured])];
-  const missing = wanted.filter((line) => !existing.split(/\r?\n/).includes(line));
-  if (missing.length === 0) return;
-  const prefix = existing && !existing.endsWith("\n") ? "\n" : "";
-  (0, import_node_fs2.writeFileSync)(path, `${existing}${prefix}${missing.join("\n")}
-`);
-}
-function o11yDevVars(cfg) {
-  if (!cfg.services.includes("o11y")) return void 0;
-  return {
-    endpoint: cfg.o11y?.endpoint ?? "https://o11y.odla.ai",
-    service: cfg.o11y?.service ?? cfg.app.id,
-    ...cfg.o11y?.version ? { version: cfg.o11y.version } : {}
-  };
-}
-function resolveWriteDevVarsTarget(cfg, requested) {
-  if (!requested) return null;
-  if (requested === true) return cfg.local.devVarsFile;
-  return (0, import_node_path2.resolve)((0, import_node_path2.dirname)(cfg.configPath), requested);
-}
-function writeDevVars(path, credentials, env, o11y) {
-  const entry = credentials.envs[env];
-  if (!entry) throw new Error(`no credentials for env "${env}" in ${path}`);
-  const lines = [`ODLA_PLATFORM="${credentials.platformUrl}"`];
-  if (entry.dbKey) lines.push(`ODLA_ENDPOINT="${credentials.dbEndpoint}"`);
-  lines.push(`ODLA_APP_ID="${credentials.appId}"`, `ODLA_ENV="${env}"`, `ODLA_TENANT="${entry.tenantId}"`);
-  if (entry.dbKey) lines.push(`ODLA_API_KEY="${entry.dbKey}"`);
-  if (o11y) {
-    lines.push(`ODLA_O11Y_ENDPOINT="${o11y.endpoint}"`, `ODLA_O11Y_SERVICE="${o11y.service}"`);
-    if (o11y.version) lines.push(`ODLA_O11Y_VERSION="${o11y.version}"`);
-    if (entry.o11yToken) lines.push(`ODLA_O11Y_TOKEN="${entry.o11yToken}"`);
-  }
-  const existing = (0, import_node_fs2.existsSync)(path) ? (0, import_node_fs2.readFileSync)(path, "utf8") : "";
-  const retained = existing.split(/\r?\n/).filter((line) => !isManagedDevVar(line));
-  while (retained.at(-1) === "") retained.pop();
-  const prefix = retained.length ? `${retained.join("\n")}
-
-` : "";
-  writePrivateText(path, `${prefix}${lines.join("\n")}
-`);
-}
-var MANAGED_DEV_VARS = /* @__PURE__ */ new Set([
-  "ODLA_PLATFORM",
-  "ODLA_ENDPOINT",
-  "ODLA_APP_ID",
-  "ODLA_ENV",
-  "ODLA_TENANT",
-  "ODLA_API_KEY",
-  "ODLA_O11Y_ENDPOINT",
-  "ODLA_O11Y_SERVICE",
-  "ODLA_O11Y_VERSION",
-  "ODLA_O11Y_TOKEN"
-]);
-function isManagedDevVar(line) {
-  const match = line.match(/^\s*(?:export\s+)?([A-Z][A-Z0-9_]*)\s*=/);
-  return !!match?.[1] && MANAGED_DEV_VARS.has(match[1]);
-}
-function writePrivateText(path, text) {
-  (0, import_node_fs2.mkdirSync)((0, import_node_path2.dirname)(path), { recursive: true });
-  const temporary = `${path}.tmp-${process.pid}-${Date.now()}`;
-  (0, import_node_fs2.writeFileSync)(temporary, text, { mode: 384 });
-  (0, import_node_fs2.chmodSync)(temporary, 384);
-  (0, import_node_fs2.renameSync)(temporary, path);
+function trimSlash(value) {
+  return value.replace(/\/+$/, "");
 }
-function gitignoreEntry(rootDir, path) {
-  const rel = (0, import_node_path2.relative)((0, import_node_path2.resolve)(rootDir), (0, import_node_path2.resolve)(path));
-  if (!rel || rel === ".." || rel.startsWith(`..${process.platform === "win32" ? "\\" : "/"}`) || (0, import_node_path2.isAbsolute)(rel)) return null;
-  return rel.replaceAll("\\", "/");
+function unique(values) {
+  return [...new Set(values.filter(Boolean))];
 }
-function displayPath(path, rootDir = process.cwd()) {
-  const rel = (0, import_node_path2.relative)(rootDir, path);
-  return rel && !rel.startsWith("..") ? rel : path;
+
+// src/doctor-checks.ts
+var import_node_child_process3 = require("child_process");
+var import_node_fs5 = require("fs");
+var import_node_path4 = require("path");
+
+// src/redact.ts
+var REPLACEMENTS = [
+  [/odla_(sk|dev)_[A-Za-z0-9._-]+/g, "odla_$1_[redacted]"],
+  [/\bsk_(live|test)_[A-Za-z0-9]+/g, "sk_$1_[redacted]"],
+  [/\bsk-[A-Za-z0-9._-]+/g, "sk-[redacted]"],
+  [/\bwhsec_[A-Za-z0-9+/=]+/g, "whsec_[redacted]"],
+  [/\bo11y_[A-Za-z0-9]+/g, "o11y_[redacted]"],
+  [/\b(ghp|gho|github_pat)_[A-Za-z0-9_]+/g, "$1_[redacted]"],
+  [/\bAKIA[A-Z0-9]{12,}/g, "AKIA[redacted]"]
+];
+function redactSecrets(value) {
+  let result = value;
+  for (const [pattern, replacement] of REPLACEMENTS) result = result.replace(pattern, replacement);
+  return result;
+}
+function looksSecret(value) {
+  return redactSecrets(value) !== value || value.includes("-----BEGIN");
 }
 
 // src/wrangler.ts
-var import_node_child_process = require("child_process");
-var import_node_fs3 = require("fs");
+var import_node_child_process2 = require("child_process");
+var import_node_fs4 = require("fs");
 var import_node_path3 = require("path");
 var defaultRunner = (cmd, args, opts) => new Promise((resolvePromise, reject) => {
-  const child = (0, import_node_child_process.spawn)(cmd, args, { cwd: opts?.cwd, stdio: ["pipe", "pipe", "pipe"] });
+  const child = (0, import_node_child_process2.spawn)(cmd, args, { cwd: opts?.cwd, stdio: ["pipe", "pipe", "pipe"] });
   let stdout = "";
   let stderr = "";
   child.stdout.on("data", (chunk) => stdout += chunk.toString());
@@ -345,14 +940,14 @@ var WRANGLER_CONFIG_FILES = ["wrangler.jsonc", "wrangler.json", "wrangler.toml"]
 function findWranglerConfig(rootDir) {
   for (const name of WRANGLER_CONFIG_FILES) {
     const path = (0, import_node_path3.join)(rootDir, name);
-    if ((0, import_node_fs3.existsSync)(path)) return path;
+    if ((0, import_node_fs4.existsSync)(path)) return path;
   }
   return null;
 }
 function readWranglerConfig(path) {
   if (path.endsWith(".toml")) return null;
   try {
-    return JSON.parse(stripJsonComments((0, import_node_fs3.readFileSync)(path, "utf8")));
+    return JSON.parse(stripJsonComments((0, import_node_fs4.readFileSync)(path, "utf8")));
   } catch {
     return null;
   }
@@ -423,7 +1018,7 @@ function lintRules(rules, entities, publicRead) {
   }
   return warnings;
 }
-var defaultExec = (cmd, args, cwd) => (0, import_node_child_process2.execFileSync)(cmd, args, { cwd, encoding: "utf8", stdio: ["ignore", "pipe", "ignore"] });
+var defaultExec = (cmd, args, cwd) => (0, import_node_child_process3.execFileSync)(cmd, args, { cwd, encoding: "utf8", stdio: ["ignore", "pipe", "ignore"] });
 function trackedSecretFiles(rootDir, exec = defaultExec, localPaths = []) {
   let output;
   try {
@@ -453,7 +1048,7 @@ function wranglerWarnings(rootDir) {
       const dir = (0, import_node_path4.resolve)(rootDir, assets.directory);
       if (dir === (0, import_node_path4.resolve)(rootDir)) {
         warnings.push(`${label}assets.directory is the project root \u2014 point it at a dedicated build dir (wrangler dev fails with "spawn EBADF")`);
-      } else if ((0, import_node_fs4.existsSync)((0, import_node_path4.join)(dir, "node_modules"))) {
+      } else if ((0, import_node_fs5.existsSync)((0, import_node_path4.join)(dir, "node_modules"))) {
         warnings.push(`${label}assets.directory contains node_modules \u2014 wrangler dev's watcher will exhaust file descriptors`);
       }
     }
@@ -489,12 +1084,12 @@ function o11yProjectWarnings(rootDir) {
     return warnings;
   }
   const main = typeof config.main === "string" ? (0, import_node_path4.resolve)(rootDir, config.main) : null;
-  if (!main || !(0, import_node_fs4.existsSync)(main)) {
+  if (!main || !(0, import_node_fs5.existsSync)(main)) {
     warnings.push("cannot verify o11y Worker instrumentation \u2014 wrangler main is missing or unreadable");
   } else {
     let source = "";
     try {
-      source = (0, import_node_fs4.readFileSync)(main, "utf8");
+      source = (0, import_node_fs5.readFileSync)(main, "utf8");
     } catch {
     }
     if (!/\bwithObservability\b/.test(source)) {
@@ -509,7 +1104,7 @@ function o11yProjectWarnings(rootDir) {
 }
 function readPackageJson(rootDir) {
   try {
-    return JSON.parse((0, import_node_fs4.readFileSync)((0, import_node_path4.join)(rootDir, "package.json"), "utf8"));
+    return JSON.parse((0, import_node_fs5.readFileSync)((0, import_node_path4.join)(rootDir, "package.json"), "utf8"));
   } catch {
     return null;
   }
@@ -576,13 +1171,13 @@ async function doctor(options) {
 }
 
 // src/init.ts
-var import_node_fs5 = require("fs");
+var import_node_fs6 = require("fs");
 var import_node_path5 = require("path");
 function initProject(options) {
   const out = options.stdout ?? console;
   const rootDir = (0, import_node_path5.resolve)(options.rootDir ?? process.cwd());
   const configPath = (0, import_node_path5.resolve)(rootDir, options.configPath ?? "odla.config.mjs");
-  if ((0, import_node_fs5.existsSync)(configPath) && !options.force) {
+  if ((0, import_node_fs6.existsSync)(configPath) && !options.force) {
     throw new Error(`${configPath} already exists. Pass --force to overwrite.`);
   }
   if (!/^[a-z0-9][a-z0-9-]*$/.test(options.appId)) {
@@ -591,10 +1186,10 @@ function initProject(options) {
   const envs = options.envs?.length ? options.envs : ["dev"];
   const services = options.services?.length ? options.services : ["db", "ai"];
   const aiProvider = options.aiProvider ?? "anthropic";
-  (0, import_node_fs5.mkdirSync)((0, import_node_path5.dirname)(configPath), { recursive: true });
-  (0, import_node_fs5.mkdirSync)((0, import_node_path5.resolve)(rootDir, "src/odla"), { recursive: true });
-  (0, import_node_fs5.mkdirSync)((0, import_node_path5.resolve)(rootDir, ".odla"), { recursive: true });
-  (0, import_node_fs5.writeFileSync)(configPath, configTemplate({ appId: options.appId, name: options.name, envs, services, aiProvider }));
+  (0, import_node_fs6.mkdirSync)((0, import_node_path5.dirname)(configPath), { recursive: true });
+  (0, import_node_fs6.mkdirSync)((0, import_node_path5.resolve)(rootDir, "src/odla"), { recursive: true });
+  (0, import_node_fs6.mkdirSync)((0, import_node_path5.resolve)(rootDir, ".odla"), { recursive: true });
+  (0, import_node_fs6.writeFileSync)(configPath, configTemplate({ appId: options.appId, name: options.name, envs, services, aiProvider }));
   writeIfMissing((0, import_node_path5.resolve)(rootDir, "src/odla/schema.mjs"), schemaTemplate());
   writeIfMissing((0, import_node_path5.resolve)(rootDir, "src/odla/rules.mjs"), rulesTemplate());
   ensureGitignore(rootDir);
@@ -603,8 +1198,8 @@ function initProject(options) {
   out.log("updated .gitignore for local odla credentials");
 }
 function writeIfMissing(path, text) {
-  if ((0, import_node_fs5.existsSync)(path)) return;
-  (0, import_node_fs5.writeFileSync)(path, text);
+  if ((0, import_node_fs6.existsSync)(path)) return;
+  (0, import_node_fs6.writeFileSync)(path, text);
 }
 function configTemplate(input) {
   return `export default {
@@ -693,84 +1288,7 @@ function relativeDisplay(path, rootDir) {
 // src/provision.ts
 var import_apps2 = require("@odla-ai/apps");
 var import_ai = require("@odla-ai/ai");
-var import_node_process3 = __toESM(require("process"), 1);
-
-// src/token.ts
-var import_db = require("@odla-ai/db");
-var import_node_process2 = __toESM(require("process"), 1);
-
-// src/open.ts
-var import_node_child_process3 = require("child_process");
-var import_node_process = __toESM(require("process"), 1);
-async function openUrl(url, options = {}) {
-  const command = openerFor(options.platform ?? import_node_process.default.platform);
-  const doSpawn = options.spawnImpl ?? import_node_child_process3.spawn;
-  await new Promise((resolve6, reject) => {
-    const child = doSpawn(command.cmd, [...command.args, url], {
-      stdio: "ignore",
-      detached: true
-    });
-    child.once("error", reject);
-    child.once("spawn", () => {
-      child.unref();
-      resolve6();
-    });
-  });
-}
-function openerFor(platform) {
-  if (platform === "darwin") return { cmd: "open", args: [] };
-  if (platform === "win32") return { cmd: "cmd", args: ["/c", "start", ""] };
-  return { cmd: "xdg-open", args: [] };
-}
-
-// src/token.ts
-async function getDeveloperToken(cfg, options, doFetch, out) {
-  if (options.token) return options.token;
-  if (import_node_process2.default.env.ODLA_DEV_TOKEN) return import_node_process2.default.env.ODLA_DEV_TOKEN;
-  const cached = readJsonFile(cfg.local.tokenFile);
-  if (cached?.token && (cached.expiresAt ?? 0) > Date.now() + 6e4) {
-    out.log(`auth: using cached developer token (${displayPath(cfg.local.tokenFile, cfg.rootDir)})`);
-    return cached.token;
-  }
-  const browser = approvalBrowser(options);
-  const { token, expiresAt } = await (0, import_db.requestToken)({
-    endpoint: cfg.platformUrl,
-    label: `${cfg.app.id} provisioner`,
-    fetch: doFetch,
-    onCode: async ({ userCode, expiresIn }) => {
-      const approvalUrl = handshakeUrl(cfg.platformUrl, userCode);
-      out.log("");
-      out.log(`Approve code ${userCode} at ${approvalUrl} within ${Math.floor(expiresIn / 60)}m.`);
-      if (browser.open) {
-        try {
-          await (options.openApprovalUrl ?? openUrl)(approvalUrl);
-          out.log(`auth: opened browser for approval${browser.mode === "auto" ? " (auto)" : ""}`);
-        } catch (err) {
-          out.log(`auth: could not open browser (${err instanceof Error ? err.message : String(err)})`);
-        }
-      } else if (browser.reason) {
-        out.log(`auth: browser launch skipped (${browser.reason})`);
-      }
-      out.log("");
-    }
-  });
-  writePrivateJson(cfg.local.tokenFile, { token, expiresAt });
-  out.log(`auth: developer token cached (${displayPath(cfg.local.tokenFile, cfg.rootDir)})`);
-  return token;
-}
-function approvalBrowser(options) {
-  if (options.open === true) return { open: true, mode: "forced" };
-  if (options.open === false) return { open: false, reason: "disabled by --no-open" };
-  if (import_node_process2.default.env.CI) return { open: false, reason: "CI environment" };
-  const interactive = options.interactive ?? Boolean(import_node_process2.default.stdin.isTTY && import_node_process2.default.stdout.isTTY);
-  if (!interactive) return { open: false, reason: "non-interactive shell; pass --open to force" };
-  return { open: true, mode: "auto" };
-}
-function handshakeUrl(platformUrl, userCode) {
-  const url = new URL("/studio", platformUrl);
-  url.searchParams.set("code", userCode);
-  return url.toString();
-}
+var import_node_process5 = __toESM(require("process"), 1);
 
 // src/provision-credentials.ts
 var import_apps = require("@odla-ai/apps");
@@ -1074,7 +1592,7 @@ ${env}: credentials are already saved; retry "odla-ai secrets push --env ${env}$
       out.log(`${env}: rules pushed (${Object.keys(rules).length} namespaces)`);
     }
     if (cfg.services.includes("ai") && cfg.ai?.provider && cfg.ai.keyEnv) {
-      const key = import_node_process3.default.env[cfg.ai.keyEnv];
+      const key = import_node_process5.default.env[cfg.ai.keyEnv];
       if (key) {
         const secretName = cfg.ai.secretName ?? defaultSecretName(cfg.ai.provider);
         await (0, import_ai.putSecret)({ endpoint: cfg.dbEndpoint, token, fetch: doFetch }, tenantId, secretName, key);
@@ -1134,10 +1652,170 @@ async function safeText2(res) {
   }
 }
 
+// src/security.ts
+var import_node_path6 = require("path");
+var import_security = require("@odla-ai/security");
+var import_node = require("@odla-ai/security/node");
+async function runHostedSecurity(options) {
+  if (options.sourceDisclosureAck !== "redacted") {
+    throw new Error("Hosted security requires sourceDisclosureAck=redacted before repository source may leave this process");
+  }
+  const selfAudit = options.selfAudit === true;
+  const cfg = selfAudit ? void 0 : await loadProjectConfig(options.configPath ?? "odla.config.mjs");
+  const appId = selfAudit ? "odla-ai" : cfg.app.id;
+  const env = selfAudit ? "prod" : selectEnv(options.env, cfg.envs, cfg.configPath, cfg.rootDir);
+  const platform = options.platform ?? cfg?.platformUrl ?? "https://odla.ai";
+  const target = (0, import_node_path6.resolve)(options.target ?? cfg?.rootDir ?? ".");
+  const output = (0, import_node_path6.resolve)(options.out ?? (0, import_node_path6.resolve)(target, ".odla/security/hosted"));
+  const outputRelative = (0, import_node_path6.relative)(target, output).split(import_node_path6.sep).join("/");
+  if (!outputRelative) throw new Error("Hosted security output cannot be the repository root");
+  const profile = profileFor(options.profile ?? "odla", options.maxHuntTasks ?? 12);
+  const tokenRequest = {
+    platform,
+    appId,
+    env,
+    selfAudit,
+    scope: selfAudit ? "platform:security:self" : null
+  };
+  const token = await injectedToken(options, tokenRequest);
+  const snapshot = await (0, import_node.snapshotDirectory)(target, {
+    exclude: !outputRelative.startsWith("../") && !(0, import_node_path6.isAbsolute)(outputRelative) ? [outputRelative] : []
+  });
+  const hosted = await (0, import_security.createPlatformSecurityReasoners)({
+    platform,
+    token,
+    appId,
+    env,
+    repository: snapshot.repository,
+    revision: snapshot.revision,
+    snapshotDigest: snapshot.digest,
+    sourceDisclosure: "redacted",
+    clientRunId: options.runId ?? crypto.randomUUID(),
+    ...selfAudit ? { selfAudit: { enabled: true, subject: "service:odla-security-self-audit" } } : {},
+    fetch: options.fetch,
+    signal: options.signal
+  });
+  const harness = (0, import_security.createSecurityHarness)({
+    profile,
+    store: new import_node.FileRunStore((0, import_node_path6.resolve)(output, "state")),
+    discoveryReasoner: hosted.discoveryReasoner,
+    validationReasoner: hosted.validationReasoner,
+    policy: {
+      modelSourceDisclosure: "redacted",
+      active: false,
+      allowNetwork: false
+    }
+  });
+  const report = await harness.run(snapshot, { runId: hosted.run.runId, signal: options.signal });
+  await (0, import_node.writeSecurityArtifacts)(output, report);
+  const reportDigest = await (0, import_security.securityFingerprint)(report);
+  await hosted.complete({
+    reportDigest,
+    coverageStatus: report.coverageStatus,
+    confirmed: report.metrics.confirmed,
+    candidates: report.metrics.candidates
+  }, { signal: options.signal });
+  printSummary(options.stdout ?? console, appId, env, hosted.run, report, output);
+  return Object.freeze({ report, run: hosted.run, output });
+}
+function selectEnv(requested, declared, configPath, rootDir) {
+  const env = requested ?? (declared.includes("dev") ? "dev" : declared[0]);
+  if (!env || !declared.includes(env)) {
+    const shown = (0, import_node_path6.relative)(rootDir, configPath) || configPath;
+    throw new Error(`env "${env ?? ""}" is not declared in ${shown}`);
+  }
+  return env;
+}
+async function injectedToken(options, request) {
+  const value = options.token ?? await options.getToken?.(Object.freeze({ ...request }));
+  if (typeof value !== "string" || value.length < 8 || value.length > 8192 || /\s|[\u0000-\u001f\u007f]/.test(value)) {
+    throw new Error(
+      request.selfAudit ? "Self-audit requires an injected, scoped platform security token" : "Hosted security requires an injected app developer token or getToken callback"
+    );
+  }
+  return value;
+}
+function profileFor(name, maxHuntTasks) {
+  const profile = name === "odla" ? (0, import_security.odlaProfile)() : name === "cloudflare-app" ? (0, import_security.cloudflareAppProfile)() : name === "generic" ? (0, import_security.genericProfile)() : void 0;
+  if (!profile) throw new Error(`unknown security profile "${String(name)}"`);
+  if (maxHuntTasks === void 0) return profile;
+  if (!Number.isSafeInteger(maxHuntTasks) || maxHuntTasks < 1) throw new Error("maxHuntTasks must be a positive integer");
+  return { ...profile, maxHuntTasks };
+}
+function printSummary(out, appId, env, run, report, output) {
+  const complete = report.coverage.filter((cell) => cell.state === "complete").length;
+  out.log(`security: ${appId}/${env} run=${run.runId} profile=${run.profileVersion}`);
+  out.log(`  discovery: ${run.discovery.identity.provider}/${run.discovery.identity.model}`);
+  out.log(`  validation: ${run.validation.identity.provider}/${run.validation.identity.model}`);
+  out.log(`  coverage: ${report.coverageStatus} ${complete}/${report.coverage.length} blocked=${report.metrics.blockedCells} shallow=${report.metrics.shallowCells} unscheduled=${report.metrics.unscheduledCells} budget_exhausted=${report.metrics.budgetExhaustedCells}`);
+  if (report.callBudget) out.log(`  calls: discovery=${formatBudget(report.callBudget.discovery)} validation=${formatBudget(report.callBudget.validation)}`);
+  out.log(`  findings: confirmed=${report.metrics.confirmed} needs_reproduction=${report.metrics.needsReproduction} candidates=${report.metrics.candidates}`);
+  out.log(`  report: ${(0, import_node_path6.resolve)(output, "REPORT.md")}`);
+}
+function formatBudget(usage) {
+  return usage ? `${usage.usedCalls}/${usage.maxCalls} skipped=${usage.skippedCalls}` : "caller-managed";
+}
+
+// src/help.ts
+var import_node_fs7 = require("fs");
+function cliVersion() {
+  const pkg = JSON.parse((0, import_node_fs7.readFileSync)(new URL("../package.json", importMetaUrl), "utf8"));
+  return pkg.version ?? "unknown";
+}
+function printHelp() {
+  console.log(`odla-ai
+
+Usage:
+  odla-ai setup [--dir <project>] [--agent <name>] [--global] [--force]
+  odla-ai init --app-id <id> --name <name> [--services db,ai,o11y] [--env dev --env prod]
+  odla-ai doctor [--config odla.config.mjs]
+  odla-ai capabilities [--json]
+  odla-ai admin ai show [--platform https://odla.ai] [--json]
+  odla-ai admin ai models [--provider <id>] [--json]
+  odla-ai admin ai set <purpose> [--provider <id>] [--model <id>] [--enabled|--no-enabled]
+  odla-ai admin ai set security --discovery-provider <id> --discovery-model <id>
+    --validation-provider <id> --validation-model <id> [--enabled|--no-enabled]
+  odla-ai admin ai credentials [--json]
+  odla-ai admin ai credential set <provider> (--from-env <NAME>|--stdin)
+  odla-ai admin ai usage [--app-id <id>] [--env <env>] [--run-id <id>] [--limit <1-500>] [--json]
+  odla-ai admin ai audit [--limit <1-200>] [--json]
+  odla-ai security run [target] --ack-redacted-source [--env dev] [--profile odla] [--fail-on high]
+  odla-ai security run [target] --self --ack-redacted-source
+  odla-ai provision [--config odla.config.mjs] [--dry-run] [--push-secrets] [--rotate-o11y-token] [--write-dev-vars[=path]] [--yes]
+  odla-ai smoke [--config odla.config.mjs] [--env dev]
+  odla-ai skill install [--dir <project>] [--agent <name>] [--global] [--force]
+  odla-ai secrets push --env <env> [--config odla.config.mjs] [--dry-run] [--yes]
+  odla-ai version
+
+Commands:
+  setup        Install offline odla runbooks for common coding-agent harnesses.
+  init         Create a generic odla.config.mjs plus starter schema/rules files.
+  doctor       Validate and summarize the project config without network calls.
+  capabilities Show what the CLI automates vs agent edits and human checkpoints.
+  admin        Manage platform-funded AI routing/credentials/usage with narrow device grants.
+  security     Run hosted discovery + independent validation with app/run attribution.
+  provision    Register services, configure them, persist credentials, optionally push secrets.
+  smoke        Verify local credentials, public-config, live schema, and db aggregate.
+  skill        Same installer; --agent accepts all, claude, codex, cursor,
+               copilot, gemini, or agents (repeatable or comma-separated).
+  secrets      Push configured db/o11y secrets into the Worker via wrangler stdin.
+  version      Print the CLI version.
+
+Safety:
+  New projects target dev only. Add prod explicitly to odla.config.mjs and pass
+  --yes to provision it; use --dry-run first to inspect the resolved plan.
+  Provision caches the approved developer token and service credentials under
+  .odla/ with mode 0600, and init adds those paths to .gitignore. Secret push
+  preflights Wrangler before any shown-once issuance or destructive rotation.
+  Provision opens the approval page automatically in interactive terminals;
+  use --open to force browser launch or --no-open to suppress it.
+`);
+}
+
 // src/skill.ts
-var import_node_fs6 = require("fs");
+var import_node_fs8 = require("fs");
 var import_node_os = require("os");
-var import_node_path6 = require("path");
+var import_node_path7 = require("path");
 var import_node_url2 = require("url");
 
 // src/skill-adapters.ts
@@ -1198,8 +1876,8 @@ function installSkill(options = {}) {
   const files = listFiles(sourceDir);
   if (files.length === 0) throw new Error(`no bundled skills found at ${sourceDir}`);
   const harnesses = normalizeHarnesses(options.harnesses, options.global === true);
-  const root = (0, import_node_path6.resolve)(options.dir ?? process.cwd());
-  const home = (0, import_node_path6.resolve)(options.homeDir ?? (0, import_node_os.homedir)());
+  const root = (0, import_node_path7.resolve)(options.dir ?? process.cwd());
+  const home = (0, import_node_path7.resolve)(options.homeDir ?? (0, import_node_os.homedir)());
   const plans = /* @__PURE__ */ new Map();
   const targets = /* @__PURE__ */ new Map();
   const rememberTarget = (harness, target) => {
@@ -1213,48 +1891,48 @@ function installSkill(options = {}) {
     plans.set(target, { target, content, boundary, managedMerge });
   };
   const planSkillTree = (targetDir2, boundary = root) => {
-    for (const rel of files) plan((0, import_node_path6.join)(targetDir2, rel), (0, import_node_fs6.readFileSync)((0, import_node_path6.join)(sourceDir, rel), "utf8"), false, boundary);
+    for (const rel of files) plan((0, import_node_path7.join)(targetDir2, rel), (0, import_node_fs8.readFileSync)((0, import_node_path7.join)(sourceDir, rel), "utf8"), false, boundary);
   };
   let targetDir;
   if (options.global) {
-    const claudeRoot = (0, import_node_path6.join)(home, ".claude", "skills");
-    const codexRoot = (0, import_node_path6.resolve)(options.codexHomeDir ?? process.env.CODEX_HOME ?? (0, import_node_path6.join)(home, ".codex"), "skills");
+    const claudeRoot = (0, import_node_path7.join)(home, ".claude", "skills");
+    const codexRoot = (0, import_node_path7.resolve)(options.codexHomeDir ?? process.env.CODEX_HOME ?? (0, import_node_path7.join)(home, ".codex"), "skills");
     targetDir = harnesses[0] === "codex" ? codexRoot : claudeRoot;
     for (const harness of harnesses) {
       const skillRoot = harness === "claude" ? claudeRoot : codexRoot;
-      planSkillTree(skillRoot, harness === "claude" ? home : (0, import_node_path6.dirname)((0, import_node_path6.dirname)(codexRoot)));
+      planSkillTree(skillRoot, harness === "claude" ? home : (0, import_node_path7.dirname)((0, import_node_path7.dirname)(codexRoot)));
       rememberTarget(harness, skillRoot);
     }
   } else {
-    const sharedRoot = (0, import_node_path6.join)(root, ".agents", "skills");
+    const sharedRoot = (0, import_node_path7.join)(root, ".agents", "skills");
     planSkillTree(sharedRoot);
-    const claudeRoot = (0, import_node_path6.join)(root, ".claude", "skills");
+    const claudeRoot = (0, import_node_path7.join)(root, ".claude", "skills");
     targetDir = harnesses.includes("claude") ? claudeRoot : sharedRoot;
     for (const harness of harnesses) rememberTarget(harness, sharedRoot);
     if (harnesses.includes("claude")) {
       for (const skill of skillNames(files)) {
-        const canonical = (0, import_node_fs6.readFileSync)((0, import_node_path6.join)(sourceDir, skill, "SKILL.md"), "utf8");
-        plan((0, import_node_path6.join)(claudeRoot, skill, "SKILL.md"), claudeAdapter(skill, canonical));
+        const canonical = (0, import_node_fs8.readFileSync)((0, import_node_path7.join)(sourceDir, skill, "SKILL.md"), "utf8");
+        plan((0, import_node_path7.join)(claudeRoot, skill, "SKILL.md"), claudeAdapter(skill, canonical));
       }
       rememberTarget("claude", claudeRoot);
     }
     if (harnesses.includes("cursor")) {
-      const cursorRule = (0, import_node_path6.join)(root, ".cursor", "rules", "odla.mdc");
+      const cursorRule = (0, import_node_path7.join)(root, ".cursor", "rules", "odla.mdc");
       plan(cursorRule, CURSOR_RULE);
       rememberTarget("cursor", cursorRule);
     }
     if (harnesses.includes("agents")) {
-      const agentsFile = (0, import_node_path6.join)(root, "AGENTS.md");
+      const agentsFile = (0, import_node_path7.join)(root, "AGENTS.md");
       plan(agentsFile, managedFileContent(agentsFile, PROJECT_INSTRUCTIONS, options.force === true, root), true);
       rememberTarget("agents", agentsFile);
     }
     if (harnesses.includes("copilot")) {
-      const copilotFile = (0, import_node_path6.join)(root, ".github", "copilot-instructions.md");
+      const copilotFile = (0, import_node_path7.join)(root, ".github", "copilot-instructions.md");
       plan(copilotFile, managedFileContent(copilotFile, PROJECT_INSTRUCTIONS, options.force === true, root), true);
       rememberTarget("copilot", copilotFile);
     }
     if (harnesses.includes("gemini")) {
-      const geminiFile = (0, import_node_path6.join)(root, "GEMINI.md");
+      const geminiFile = (0, import_node_path7.join)(root, "GEMINI.md");
       plan(geminiFile, managedFileContent(geminiFile, PROJECT_INSTRUCTIONS, options.force === true, root), true);
       rememberTarget("gemini", geminiFile);
     }
@@ -1268,11 +1946,11 @@ function installSkill(options = {}) {
       conflicts.push(`${file.target} (redirected by symbolic link ${symlink})`);
       continue;
     }
-    if (!(0, import_node_fs6.existsSync)(file.target)) {
+    if (!(0, import_node_fs8.existsSync)(file.target)) {
       writtenPaths.add(file.target);
       continue;
     }
-    const current = (0, import_node_fs6.readFileSync)(file.target, "utf8");
+    const current = (0, import_node_fs8.readFileSync)(file.target, "utf8");
     if (current === file.content) {
       unchangedPaths.add(file.target);
     } else if (file.managedMerge || options.force) {
@@ -1289,9 +1967,9 @@ ${conflicts.map((f) => `  - ${f}`).join("\n")}`
     );
   }
   for (const file of plans.values()) {
-    if (!(0, import_node_fs6.existsSync)(file.target) || (0, import_node_fs6.readFileSync)(file.target, "utf8") !== file.content) {
-      (0, import_node_fs6.mkdirSync)((0, import_node_path6.dirname)(file.target), { recursive: true });
-      (0, import_node_fs6.writeFileSync)(file.target, file.content);
+    if (!(0, import_node_fs8.existsSync)(file.target) || (0, import_node_fs8.readFileSync)(file.target, "utf8") !== file.content) {
+      (0, import_node_fs8.mkdirSync)((0, import_node_path7.dirname)(file.target), { recursive: true });
+      (0, import_node_fs8.writeFileSync)(file.target, file.content);
     }
   }
   const skills = skillNames(files);
@@ -1310,7 +1988,7 @@ ${conflicts.map((f) => `  - ${f}`).join("\n")}`
   };
 }
 function pathsUnder(root, paths) {
-  return [...paths].map((path) => (0, import_node_path6.relative)(root, path)).filter((path) => path !== ".." && !path.startsWith(`..${import_node_path6.sep}`) && !(0, import_node_path6.isAbsolute)(path)).sort();
+  return [...paths].map((path) => (0, import_node_path7.relative)(root, path)).filter((path) => path !== ".." && !path.startsWith(`..${import_node_path7.sep}`) && !(0, import_node_path7.isAbsolute)(path)).sort();
 }
 function normalizeHarnesses(values, global) {
   const requested = values?.length ? values : ["claude"];
@@ -1332,9 +2010,9 @@ function normalizeHarnesses(values, global) {
 function managedFileContent(path, block, force, boundary) {
   const symlink = symlinkedComponent(boundary, path);
   if (symlink) throw new Error(`refusing to manage ${path}: symbolic link component ${symlink}`);
-  if (!(0, import_node_fs6.existsSync)(path)) return `${block}
+  if (!(0, import_node_fs8.existsSync)(path)) return `${block}
 `;
-  const current = (0, import_node_fs6.readFileSync)(path, "utf8");
+  const current = (0, import_node_fs8.readFileSync)(path, "utf8");
   const start = "<!-- odla-ai agent setup:start -->";
   const end = "<!-- odla-ai agent setup:end -->";
   const startAt = current.indexOf(start);
@@ -1355,15 +2033,15 @@ function managedFileContent(path, block, force, boundary) {
   return `${current.slice(0, startAt)}${block}${current.slice(afterEnd)}`;
 }
 function symlinkedComponent(boundary, target) {
-  const rel = (0, import_node_path6.relative)(boundary, target);
-  if (rel === ".." || rel.startsWith(`..${import_node_path6.sep}`) || (0, import_node_path6.isAbsolute)(rel)) {
+  const rel = (0, import_node_path7.relative)(boundary, target);
+  if (rel === ".." || rel.startsWith(`..${import_node_path7.sep}`) || (0, import_node_path7.isAbsolute)(rel)) {
     throw new Error(`agent setup target escapes its install root: ${target}`);
   }
   let current = boundary;
-  for (const part of rel.split(import_node_path6.sep).filter(Boolean)) {
-    current = (0, import_node_path6.join)(current, part);
+  for (const part of rel.split(import_node_path7.sep).filter(Boolean)) {
+    current = (0, import_node_path7.join)(current, part);
     try {
-      if ((0, import_node_fs6.lstatSync)(current).isSymbolicLink()) return current;
+      if ((0, import_node_fs8.lstatSync)(current).isSymbolicLink()) return current;
     } catch (error) {
       if (error.code !== "ENOENT") throw error;
     }
@@ -1374,13 +2052,13 @@ function skillNames(files) {
   return [...new Set(files.filter((file) => /(^|[\\/])SKILL\.md$/.test(file)).map((file) => file.split(/[\\/]/)[0]))].sort();
 }
 function listFiles(dir) {
-  if (!(0, import_node_fs6.existsSync)(dir)) return [];
+  if (!(0, import_node_fs8.existsSync)(dir)) return [];
   const results = [];
   const walk = (current) => {
-    for (const entry of (0, import_node_fs6.readdirSync)(current, { withFileTypes: true })) {
-      const path = (0, import_node_path6.join)(current, entry.name);
+    for (const entry of (0, import_node_fs8.readdirSync)(current, { withFileTypes: true })) {
+      const path = (0, import_node_path7.join)(current, entry.name);
       if (entry.isDirectory()) walk(path);
-      else results.push((0, import_node_path6.relative)(dir, path));
+      else results.push((0, import_node_path7.relative)(dir, path));
     }
   };
   walk(dir);
@@ -1505,6 +2183,119 @@ async function runCli(argv = process.argv.slice(2)) {
     printCapabilities(parsed.options.json === true);
     return;
   }
+  if (command === "admin") {
+    const area = parsed.positionals[1];
+    const action = parsed.positionals[2];
+    const credentialSet = action === "credential" && parsed.positionals[3] === "set";
+    const credentials = action === "credentials";
+    const models = action === "models";
+    const usage = action === "usage";
+    const audit = action === "audit";
+    if (area !== "ai" || action !== "show" && action !== "set" && !credentialSet && !credentials && !models && !usage && !audit) {
+      throw new Error('unknown admin command. Try "odla-ai admin ai show".');
+    }
+    assertArgs(parsed, [
+      "platform",
+      "json",
+      "open",
+      "provider",
+      "model",
+      "enabled",
+      "max-input-bytes",
+      "max-output-tokens",
+      "max-calls-per-run",
+      "from-env",
+      "stdin",
+      "discovery-provider",
+      "discovery-model",
+      "validation-provider",
+      "validation-model",
+      "app-id",
+      "env",
+      "run-id",
+      "limit"
+    ], credentialSet ? 5 : action === "set" ? 4 : 3);
+    await adminAi({
+      action: credentialSet ? "credential-set" : credentials ? "credentials" : models ? "models" : usage ? "usage" : audit ? "audit" : action,
+      purpose: action === "set" ? parsed.positionals[3] : void 0,
+      provider: stringOpt(parsed.options.provider),
+      model: stringOpt(parsed.options.model),
+      enabled: boolOpt(parsed.options.enabled),
+      maxInputBytes: numberOpt(parsed.options["max-input-bytes"], "--max-input-bytes"),
+      maxOutputTokens: numberOpt(parsed.options["max-output-tokens"], "--max-output-tokens"),
+      maxCallsPerRun: numberOpt(parsed.options["max-calls-per-run"], "--max-calls-per-run"),
+      platform: stringOpt(parsed.options.platform),
+      json: parsed.options.json === true,
+      open: parsed.options.open === false ? false : parsed.options.open === true ? true : void 0,
+      credentialProvider: credentialSet ? parsed.positionals[4] : void 0,
+      fromEnv: stringOpt(parsed.options["from-env"]),
+      stdin: parsed.options.stdin === true,
+      discoveryProvider: stringOpt(parsed.options["discovery-provider"]),
+      discoveryModel: stringOpt(parsed.options["discovery-model"]),
+      validationProvider: stringOpt(parsed.options["validation-provider"]),
+      validationModel: stringOpt(parsed.options["validation-model"]),
+      appId: stringOpt(parsed.options["app-id"]),
+      env: stringOpt(parsed.options.env),
+      runId: stringOpt(parsed.options["run-id"]),
+      limit: numberOpt(parsed.options.limit, "--limit")
+    });
+    return;
+  }
+  if (command === "security") {
+    const sub = parsed.positionals[1];
+    if (sub !== "run") throw new Error('unknown security command. Try "odla-ai security run".');
+    assertArgs(parsed, [
+      "config",
+      "env",
+      "out",
+      "profile",
+      "max-hunt-tasks",
+      "run-id",
+      "platform",
+      "self",
+      "ack-redacted-source",
+      "open",
+      "fail-on",
+      "fail-on-candidates",
+      "allow-incomplete"
+    ], 3);
+    const configPath = stringOpt(parsed.options.config) ?? "odla.config.mjs";
+    const selfAudit = parsed.options.self === true;
+    const open = parsed.options.open === false ? false : parsed.options.open === true ? true : void 0;
+    const platform = stringOpt(parsed.options.platform);
+    const result = await runHostedSecurity({
+      configPath,
+      selfAudit,
+      target: parsed.positionals[2],
+      out: stringOpt(parsed.options.out),
+      env: stringOpt(parsed.options.env),
+      profile: securityProfile(stringOpt(parsed.options.profile)),
+      maxHuntTasks: numberOpt(parsed.options["max-hunt-tasks"], "--max-hunt-tasks"),
+      runId: stringOpt(parsed.options["run-id"]),
+      platform,
+      sourceDisclosureAck: parsed.options["ack-redacted-source"] === true ? "redacted" : void 0,
+      getToken: async (request) => {
+        if (request.scope === "platform:security:self") {
+          return getScopedPlatformToken({ platform: request.platform, scope: request.scope, open });
+        }
+        const cfg = await loadProjectConfig(configPath);
+        if (platformAudience(cfg.platformUrl) !== platformAudience(request.platform)) {
+          throw new Error("--platform cannot reuse a project developer token from another platform; update odla.config.mjs and authenticate there");
+        }
+        return getDeveloperToken(cfg, { configPath, open }, fetch, console);
+      }
+    });
+    const failOn = severityOpt(stringOpt(parsed.options["fail-on"]) ?? "high", "--fail-on");
+    const candidateValue = parsed.options["fail-on-candidates"];
+    const failOnCandidates = candidateValue === false ? void 0 : severityOpt(stringOpt(candidateValue) ?? "critical", "--fail-on-candidates");
+    const confirmed = (0, import_security2.findingsAtOrAbove)(result.report, failOn);
+    const leads = failOnCandidates ? (0, import_security2.findingsAtOrAbove)(result.report, failOnCandidates, true).filter((finding) => finding.disposition !== "confirmed") : [];
+    const incomplete = result.report.coverageStatus === "incomplete" && parsed.options["allow-incomplete"] !== true;
+    if (confirmed.length || leads.length || incomplete) {
+      throw new Error(`hosted security gate failed: ${confirmed.length} confirmed >= ${failOn}; ${leads.length} leads >= ${failOnCandidates ?? "disabled"}${incomplete ? "; coverage incomplete" : ""}`);
+    }
+    return;
+  }
   if (command === "provision") {
     assertArgs(
       parsed,
@@ -1585,71 +2376,14 @@ async function runCli(argv = process.argv.slice(2)) {
   }
   throw new Error(`unknown command "${command}". Run "odla-ai help".`);
 }
-function assertArgs(parsed, allowedOptions, maxPositionals) {
-  const allowed = new Set(allowedOptions);
-  for (const name of Object.keys(parsed.options)) {
-    if (!allowed.has(name)) {
-      throw new Error(`unknown option "--${name}"; run "odla-ai help" for supported options`);
-    }
-  }
-  if (parsed.positionals.length > maxPositionals) {
-    throw new Error(`unexpected argument "${parsed.positionals[maxPositionals]}"; run "odla-ai help"`);
-  }
-}
-function parseArgv(argv) {
-  const positionals = [];
-  const options = {};
-  for (let i = 0; i < argv.length; i++) {
-    const arg = argv[i];
-    if (!arg.startsWith("--")) {
-      positionals.push(arg);
-      continue;
-    }
-    const eq = arg.indexOf("=");
-    const rawName = arg.slice(2, eq === -1 ? void 0 : eq);
-    if (!rawName) continue;
-    if (rawName.startsWith("no-")) {
-      options[rawName.slice(3)] = false;
-      continue;
-    }
-    if (eq !== -1) {
-      addOption(options, rawName, arg.slice(eq + 1));
-      continue;
-    }
-    const value = argv[i + 1];
-    if (value !== void 0 && !value.startsWith("--")) {
-      i++;
-      addOption(options, rawName, value);
-    } else {
-      addOption(options, rawName, true);
-    }
-  }
-  return { positionals, options };
-}
-function addOption(options, name, value) {
-  const cur = options[name];
-  if (cur === void 0) {
-    options[name] = value;
-  } else if (Array.isArray(cur)) {
-    cur.push(String(value));
-  } else {
-    options[name] = [String(cur), String(value)];
-  }
-}
-function requiredString(value, name) {
-  const s = stringOpt(value);
-  if (!s) throw new Error(`${name} is required`);
-  return s;
-}
-function stringOpt(value) {
-  if (typeof value === "string") return value;
-  if (Array.isArray(value)) return value[value.length - 1];
-  return void 0;
+function securityProfile(value) {
+  if (value === void 0) return void 0;
+  if (value === "odla" || value === "cloudflare-app" || value === "generic") return value;
+  throw new Error("--profile must be odla, cloudflare-app, or generic");
 }
-function listOpt(value) {
-  if (value === void 0 || value === false || value === true) return void 0;
-  const values = Array.isArray(value) ? value : [value];
-  return values.flatMap((item) => item.split(",")).map((item) => item.trim()).filter(Boolean);
+function severityOpt(value, flag) {
+  if (["informational", "low", "medium", "high", "critical"].includes(value)) return value;
+  throw new Error(`${flag} must be informational, low, medium, high, or critical`);
 }
 function harnessList(parsed) {
   const selected = [
@@ -1666,46 +2400,6 @@ function harnessOption(value, flag) {
   if (parts.some((item) => !item.trim())) throw new Error(`${flag} requires a harness name`);
   return parts.map((item) => item.trim());
 }
-function cliVersion() {
-  const pkg = JSON.parse((0, import_node_fs7.readFileSync)(new URL("../package.json", importMetaUrl), "utf8"));
-  return pkg.version ?? "unknown";
-}
-function printHelp() {
-  console.log(`odla-ai
-
-Usage:
-  odla-ai setup [--dir <project>] [--agent <name>] [--global] [--force]
-  odla-ai init --app-id <id> --name <name> [--services db,ai,o11y] [--env dev --env prod]
-  odla-ai doctor [--config odla.config.mjs]
-  odla-ai capabilities [--json]
-  odla-ai provision [--config odla.config.mjs] [--dry-run] [--push-secrets] [--rotate-o11y-token] [--write-dev-vars[=path]] [--yes]
-  odla-ai smoke [--config odla.config.mjs] [--env dev]
-  odla-ai skill install [--dir <project>] [--agent <name>] [--global] [--force]
-  odla-ai secrets push --env <env> [--config odla.config.mjs] [--dry-run] [--yes]
-  odla-ai version
-
-Commands:
-  setup       Install offline odla runbooks for common coding-agent harnesses.
-  init        Create a generic odla.config.mjs plus starter schema/rules files.
-  doctor      Validate and summarize the project config without network calls.
-  capabilities Show what the CLI automates vs agent edits and human checkpoints.
-  provision   Register services, configure them, persist credentials, optionally push secrets.
-  smoke       Verify local credentials, public-config, live schema, and db aggregate.
-  skill       Same installer; --agent accepts all, claude, codex, cursor,
-              copilot, gemini, or agents (repeatable or comma-separated).
-  secrets     Push configured db/o11y secrets into the Worker via wrangler stdin.
-  version     Print the CLI version.
-
-Safety:
-  New projects target dev only. Add prod explicitly to odla.config.mjs and pass
-  --yes to provision it; use --dry-run first to inspect the resolved plan.
-  Provision caches the approved developer token and service credentials under
-  .odla/ with mode 0600, and init adds those paths to .gitignore. Secret push
-  preflights Wrangler before any shown-once issuance or destructive rotation.
-  Provision opens the approval page automatically in interactive terminals;
-  use --open to force browser launch or --no-open to suppress it.
-`);
-}
 
 // src/bin.ts
 runCli().catch((err) => {