@odla-ai/cli 0.5.0 → 0.7.0

package/dist/{chunk-7WZIZCGA.js → chunk-643B2AKG.js}

@@ -1,5 +1,647 @@
 #!/usr/bin/env node
 
+// src/admin-ai-auth.ts
+import { existsSync as existsSync2 } from "fs";
+import process4 from "process";
+import { requestToken as requestToken2 } from "@odla-ai/db";
+
+// src/local.ts
+import { chmodSync, existsSync, mkdirSync, readFileSync, renameSync, writeFileSync } from "fs";
+import { dirname, isAbsolute, relative, resolve } from "path";
+var GITIGNORE_LINES = [".odla/*.local.json", ".odla/dev-token.json", ".dev.vars"];
+function readJsonFile(path) {
+  try {
+    return JSON.parse(readFileSync(path, "utf8"));
+  } catch {
+    return null;
+  }
+}
+function writePrivateJson(path, value) {
+  writePrivateText(path, `${JSON.stringify(value, null, 2)}
+`);
+}
+function readCredentials(path) {
+  if (!existsSync(path)) return null;
+  let value;
+  try {
+    value = JSON.parse(readFileSync(path, "utf8"));
+  } catch {
+    throw new Error(`credentials file ${path} is not valid JSON; fix or remove it before provisioning`);
+  }
+  if (!value || typeof value !== "object" || typeof value.appId !== "string" || !value.envs || typeof value.envs !== "object") {
+    throw new Error(`credentials file ${path} has an invalid shape; fix or remove it before provisioning`);
+  }
+  return value;
+}
+function mergeCredential(current, update) {
+  const next = current ?? {
+    appId: update.appId,
+    platformUrl: update.platformUrl,
+    dbEndpoint: update.dbEndpoint,
+    updatedAt: (/* @__PURE__ */ new Date(0)).toISOString(),
+    envs: {}
+  };
+  next.appId = update.appId;
+  next.platformUrl = update.platformUrl;
+  next.dbEndpoint = update.dbEndpoint;
+  next.updatedAt = (/* @__PURE__ */ new Date()).toISOString();
+  next.envs[update.env] = {
+    ...next.envs[update.env] ?? {},
+    tenantId: update.tenantId,
+    ...update.dbKey ? { dbKey: update.dbKey } : {},
+    ...update.o11yToken ? { o11yToken: update.o11yToken } : {}
+  };
+  return next;
+}
+function ensureGitignore(rootDir, localPaths = []) {
+  const path = resolve(rootDir, ".gitignore");
+  const existing = existsSync(path) ? readFileSync(path, "utf8") : "";
+  const configured = localPaths.map((localPath) => gitignoreEntry(rootDir, localPath)).filter((line) => !!line);
+  const wanted = [.../* @__PURE__ */ new Set([...GITIGNORE_LINES, ...configured])];
+  const missing = wanted.filter((line) => !existing.split(/\r?\n/).includes(line));
+  if (missing.length === 0) return;
+  const prefix = existing && !existing.endsWith("\n") ? "\n" : "";
+  writeFileSync(path, `${existing}${prefix}${missing.join("\n")}
+`);
+}
+function o11yDevVars(cfg) {
+  if (!cfg.services.includes("o11y")) return void 0;
+  return {
+    endpoint: cfg.o11y?.endpoint ?? "https://o11y.odla.ai",
+    service: cfg.o11y?.service ?? cfg.app.id,
+    ...cfg.o11y?.version ? { version: cfg.o11y.version } : {}
+  };
+}
+function resolveWriteDevVarsTarget(cfg, requested) {
+  if (!requested) return null;
+  if (requested === true) return cfg.local.devVarsFile;
+  return resolve(dirname(cfg.configPath), requested);
+}
+function writeDevVars(path, credentials, env, o11y) {
+  const entry = credentials.envs[env];
+  if (!entry) throw new Error(`no credentials for env "${env}" in ${path}`);
+  const lines = [`ODLA_PLATFORM="${credentials.platformUrl}"`];
+  if (entry.dbKey) lines.push(`ODLA_ENDPOINT="${credentials.dbEndpoint}"`);
+  lines.push(`ODLA_APP_ID="${credentials.appId}"`, `ODLA_ENV="${env}"`, `ODLA_TENANT="${entry.tenantId}"`);
+  if (entry.dbKey) lines.push(`ODLA_API_KEY="${entry.dbKey}"`);
+  if (o11y) {
+    lines.push(`ODLA_O11Y_ENDPOINT="${o11y.endpoint}"`, `ODLA_O11Y_SERVICE="${o11y.service}"`);
+    if (o11y.version) lines.push(`ODLA_O11Y_VERSION="${o11y.version}"`);
+    if (entry.o11yToken) lines.push(`ODLA_O11Y_TOKEN="${entry.o11yToken}"`);
+  }
+  const existing = existsSync(path) ? readFileSync(path, "utf8") : "";
+  const retained = existing.split(/\r?\n/).filter((line) => !isManagedDevVar(line));
+  while (retained.at(-1) === "") retained.pop();
+  const prefix = retained.length ? `${retained.join("\n")}
+
+` : "";
+  writePrivateText(path, `${prefix}${lines.join("\n")}
+`);
+}
+var MANAGED_DEV_VARS = /* @__PURE__ */ new Set([
+  "ODLA_PLATFORM",
+  "ODLA_ENDPOINT",
+  "ODLA_APP_ID",
+  "ODLA_ENV",
+  "ODLA_TENANT",
+  "ODLA_API_KEY",
+  "ODLA_O11Y_ENDPOINT",
+  "ODLA_O11Y_SERVICE",
+  "ODLA_O11Y_VERSION",
+  "ODLA_O11Y_TOKEN"
+]);
+function isManagedDevVar(line) {
+  const match = line.match(/^\s*(?:export\s+)?([A-Z][A-Z0-9_]*)\s*=/);
+  return !!match?.[1] && MANAGED_DEV_VARS.has(match[1]);
+}
+function writePrivateText(path, text) {
+  mkdirSync(dirname(path), { recursive: true });
+  const temporary = `${path}.tmp-${process.pid}-${Date.now()}`;
+  writeFileSync(temporary, text, { mode: 384 });
+  chmodSync(temporary, 384);
+  renameSync(temporary, path);
+}
+function gitignoreEntry(rootDir, path) {
+  const rel = relative(resolve(rootDir), resolve(path));
+  if (!rel || rel === ".." || rel.startsWith(`..${process.platform === "win32" ? "\\" : "/"}`) || isAbsolute(rel)) return null;
+  return rel.replaceAll("\\", "/");
+}
+function displayPath(path, rootDir = process.cwd()) {
+  const rel = relative(rootDir, path);
+  return rel && !rel.startsWith("..") ? rel : path;
+}
+
+// src/open.ts
+import { spawn } from "child_process";
+import process2 from "process";
+async function openUrl(url, options = {}) {
+  const command = openerFor(options.platform ?? process2.platform);
+  const doSpawn = options.spawnImpl ?? spawn;
+  await new Promise((resolve7, reject) => {
+    const child = doSpawn(command.cmd, [...command.args, url], {
+      stdio: "ignore",
+      detached: true
+    });
+    child.once("error", reject);
+    child.once("spawn", () => {
+      child.unref();
+      resolve7();
+    });
+  });
+}
+function openerFor(platform) {
+  if (platform === "darwin") return { cmd: "open", args: [] };
+  if (platform === "win32") return { cmd: "cmd", args: ["/c", "start", ""] };
+  return { cmd: "xdg-open", args: [] };
+}
+
+// src/token.ts
+import { requestToken } from "@odla-ai/db";
+import process3 from "process";
+async function getDeveloperToken(cfg, options, doFetch, out) {
+  if (options.token) return options.token;
+  const audience = platformAudience(cfg.platformUrl);
+  if (process3.env.ODLA_DEV_TOKEN) {
+    const declared = process3.env.ODLA_DEV_TOKEN_AUDIENCE;
+    if (declared) {
+      if (platformAudience(declared) !== audience) throw new Error("ODLA_DEV_TOKEN_AUDIENCE does not match the configured platform");
+    } else if (audience !== "https://odla.ai") {
+      throw new Error("ODLA_DEV_TOKEN_AUDIENCE is required for a non-default platform");
+    }
+    return process3.env.ODLA_DEV_TOKEN;
+  }
+  const cached = readJsonFile(cfg.local.tokenFile);
+  if (cached?.token && cached.platform === audience && (cached.expiresAt ?? 0) > Date.now() + 6e4) {
+    out.log(`auth: using cached developer token (${displayPath(cfg.local.tokenFile, cfg.rootDir)})`);
+    return cached.token;
+  }
+  const browser = approvalBrowser(options);
+  const { token, expiresAt } = await requestToken({
+    endpoint: cfg.platformUrl,
+    label: `${cfg.app.id} provisioner`,
+    fetch: doFetch,
+    onCode: async ({ userCode, expiresIn }) => {
+      const approvalUrl = handshakeUrl(cfg.platformUrl, userCode);
+      out.log("");
+      out.log(`Approve code ${userCode} at ${approvalUrl} within ${Math.floor(expiresIn / 60)}m.`);
+      if (browser.open) {
+        try {
+          await (options.openApprovalUrl ?? openUrl)(approvalUrl);
+          out.log(`auth: opened browser for approval${browser.mode === "auto" ? " (auto)" : ""}`);
+        } catch (err) {
+          out.log(`auth: could not open browser (${err instanceof Error ? err.message : String(err)})`);
+        }
+      } else if (browser.reason) {
+        out.log(`auth: browser launch skipped (${browser.reason})`);
+      }
+      out.log("");
+    }
+  });
+  writePrivateJson(cfg.local.tokenFile, { platform: audience, token, expiresAt });
+  out.log(`auth: developer token cached (${displayPath(cfg.local.tokenFile, cfg.rootDir)})`);
+  return token;
+}
+function approvalBrowser(options) {
+  if (options.open === true) return { open: true, mode: "forced" };
+  if (options.open === false) return { open: false, reason: "disabled by --no-open" };
+  if (process3.env.CI) return { open: false, reason: "CI environment" };
+  const interactive = options.interactive ?? Boolean(process3.stdin.isTTY && process3.stdout.isTTY);
+  if (!interactive) return { open: false, reason: "non-interactive shell; pass --open to force" };
+  return { open: true, mode: "auto" };
+}
+function handshakeUrl(platformUrl, userCode) {
+  const url = new URL("/studio", platformUrl);
+  url.searchParams.set("code", userCode);
+  return url.toString();
+}
+function platformAudience(value) {
+  let url;
+  try {
+    url = new URL(value);
+  } catch {
+    throw new Error("platform must be an absolute URL");
+  }
+  const local = url.hostname === "localhost" || url.hostname === "127.0.0.1" || url.hostname === "[::1]";
+  if (url.protocol !== "https:" && !(local && url.protocol === "http:")) {
+    throw new Error("platform credentials require HTTPS except for loopback development");
+  }
+  if (url.username || url.password || url.search || url.hash) {
+    throw new Error("platform URL must not contain credentials, query, or fragment");
+  }
+  return url.origin;
+}
+
+// src/admin-ai-auth.ts
+async function getScopedPlatformToken(options) {
+  return resolveAdminPlatformToken(options);
+}
+async function resolveAdminPlatformToken(options) {
+  const audience = platformAudience(options.platform);
+  if (options.token) return options.token;
+  const fromEnv = process4.env.ODLA_ADMIN_TOKEN;
+  if (fromEnv) return audienceBoundEnvToken(fromEnv, audience);
+  return scopedToken(
+    audience,
+    options.scope,
+    options,
+    options.fetch ?? fetch,
+    options.stdout ?? console
+  );
+}
+function audienceBoundEnvToken(token, platform) {
+  const audience = platformAudience(platform);
+  const declared = process4.env.ODLA_ADMIN_TOKEN_AUDIENCE;
+  if (declared) {
+    if (platformAudience(declared) !== audience) throw new Error("ODLA_ADMIN_TOKEN_AUDIENCE does not match the configured platform");
+  } else if (audience !== "https://odla.ai") {
+    throw new Error("ODLA_ADMIN_TOKEN_AUDIENCE is required for a non-default platform");
+  }
+  return token;
+}
+async function scopedToken(platform, scope, options, doFetch, out) {
+  const audience = platformAudience(platform);
+  const tokenFile = options.tokenFile ?? `${process4.cwd()}/.odla/admin-token.local.json`;
+  const cache = readJsonFile(tokenFile);
+  const cached = cache?.platform === audience ? cache.tokens?.[scope] : void 0;
+  if (cached?.token && (cached.expiresAt ?? 0) > Date.now() + 6e4) {
+    out.log(`auth: using cached ${scope} grant (${tokenFile})`);
+    return cached.token;
+  }
+  const { token, expiresAt } = await requestToken2({
+    endpoint: audience,
+    label: `odla CLI admin AI (${scope})`,
+    scopes: [scope],
+    fetch: doFetch,
+    onCode: async ({ userCode, expiresIn }) => {
+      const approvalUrl = handshakeUrl(audience, userCode);
+      out.log(`Approve scoped request ${userCode} at ${approvalUrl} within ${Math.floor(expiresIn / 60)}m.`);
+      const shouldOpen = options.open === true || options.open !== false && !process4.env.CI && Boolean(process4.stdin.isTTY && process4.stdout.isTTY);
+      if (shouldOpen) await (options.openApprovalUrl ?? openUrl)(approvalUrl).catch(() => void 0);
+    }
+  });
+  const tokens = cache?.platform === audience ? { ...cache.tokens ?? {} } : {};
+  tokens[scope] = { token, expiresAt };
+  if (existsSync2(`${process4.cwd()}/.git`)) ensureGitignore(process4.cwd(), [tokenFile]);
+  writePrivateJson(tokenFile, { platform: audience, tokens });
+  out.log(`auth: cached ${scope} grant (${tokenFile}; mode 0600)`);
+  return token;
+}
+
+// src/admin-ai-policy.ts
+var SYSTEM_AI_PURPOSES = ["o11y.triage", "security.discovery", "security.validation"];
+function requireSystemAiPurpose(value) {
+  if (!SYSTEM_AI_PURPOSES.includes(value)) {
+    throw new Error(`purpose must be one of: ${SYSTEM_AI_PURPOSES.join(", ")}`);
+  }
+  return value;
+}
+
+// src/admin-ai.ts
+import process5 from "process";
+
+// src/admin-ai-audit.ts
+function adminAiAuditQuery(filters) {
+  if (filters.limit === void 0) return "";
+  if (!Number.isSafeInteger(filters.limit) || filters.limit < 1 || filters.limit > 200) {
+    throw new Error("audit limit must be an integer from 1 to 200");
+  }
+  return `?limit=${filters.limit}`;
+}
+async function readAdminAiAudit(request) {
+  const response = await request.fetch(`${request.platform}/registry/platform/ai-audit${request.query}`, {
+    headers: request.headers
+  });
+  const body = await responseBody(response);
+  if (!response.ok) throw new Error(apiError(response.status, body));
+  if (request.json) {
+    request.stdout.log(JSON.stringify(body, null, 2));
+    return;
+  }
+  const events = isRecord(body) && Array.isArray(body.events) ? body.events.filter(isRecord) : [];
+  request.stdout.log("when	change	target	before -> after	actor");
+  for (const event of events) {
+    const before = isRecord(event.oldPolicy) ? event.oldPolicy : void 0;
+    const after = isRecord(event.newPolicy) ? event.newPolicy : void 0;
+    const route = before && after ? `${String(before.provider)}/${String(before.model)}@v${String(before.version)} -> ${String(after.provider)}/${String(after.model)}@v${String(after.version)}` : "value not retained";
+    request.stdout.log([
+      timestamp(event.createdAt),
+      String(event.changeKind ?? ""),
+      String(event.purpose ?? event.provider ?? ""),
+      route,
+      `${String(event.actorType ?? "")}:${String(event.actorId ?? "")}`
+    ].join("	"));
+  }
+}
+async function responseBody(response) {
+  const text = await response.text();
+  if (!text) return {};
+  try {
+    return JSON.parse(text);
+  } catch {
+    return { message: text.slice(0, 300) };
+  }
+}
+function apiError(status, body) {
+  const error = isRecord(body) && isRecord(body.error) ? body.error : void 0;
+  const message = error && typeof error.message === "string" ? error.message : isRecord(body) && typeof body.message === "string" ? body.message : "request failed";
+  return `read System AI admin changes failed (${status}): ${message}`;
+}
+function timestamp(value) {
+  if (typeof value !== "number" || !Number.isFinite(value)) return String(value ?? "");
+  const date = new Date(value);
+  return Number.isFinite(date.valueOf()) ? date.toISOString() : "";
+}
+function isRecord(value) {
+  return Boolean(value) && typeof value === "object" && !Array.isArray(value);
+}
+
+// src/admin-ai-usage.ts
+function adminAiUsageQuery(filters) {
+  const params = new URLSearchParams();
+  if (filters.appId?.trim()) params.set("appId", filters.appId.trim());
+  if (filters.env?.trim()) params.set("env", filters.env.trim());
+  if (filters.runId?.trim()) params.set("runId", filters.runId.trim());
+  if (filters.limit !== void 0) params.set("limit", String(usageLimit(filters.limit)));
+  const query = params.toString();
+  return query ? `?${query}` : "";
+}
+async function readAdminAiUsage(request) {
+  const res = await request.fetch(`${request.platform}/registry/platform/ai-usage${request.query}`, {
+    headers: request.headers
+  });
+  const body = await responseBody2(res);
+  if (!res.ok) throw new Error(apiError2("read platform AI usage", res.status, body));
+  if (request.json) request.stdout.log(JSON.stringify(body, null, 2));
+  else printUsage(body, request.stdout);
+}
+function usageLimit(value) {
+  if (!Number.isSafeInteger(value) || value < 1 || value > 500) {
+    throw new Error("usage limit must be an integer from 1 to 500");
+  }
+  return value;
+}
+function printUsage(body, out) {
+  const aggregates = isRecord2(body) && isRecord2(body.aggregates) && Array.isArray(body.aggregates.byStatus) ? body.aggregates.byStatus.filter(isRecord2) : [];
+  out.log(`All retained hosted-security status totals (up to ${String(isRecord2(body) ? body.retentionDays ?? 90 : 90)} days; o11y triage excluded)
+status	calls	input tokens	output tokens	cost	unpriced calls`);
+  for (const row of aggregates) {
+    out.log([
+      String(row.status ?? ""),
+      String(row.calls ?? ""),
+      String(row.input_tokens ?? ""),
+      String(row.output_tokens ?? ""),
+      formatMicrousd(row.cost_microusd),
+      String(row.unpriced_calls ?? "")
+    ].join("	"));
+  }
+  const events = isRecord2(body) && Array.isArray(body.events) ? body.events.filter(isRecord2) : [];
+  out.log(`Latest ${String(isRecord2(body) ? body.eventLimit ?? events.length : events.length)} hosted-security events
+when	app/env	run	actor	purpose/role	route / policy	tokens	cost	status`);
+  for (const event of events) {
+    const input = numeric(event.input_tokens);
+    const output = numeric(event.output_tokens);
+    const priced = event.priced === true || event.priced === 1;
+    out.log([
+      timestamp2(event.created_at),
+      `${String(event.app_id ?? "")}/${String(event.env ?? "")}`,
+      String(event.run_id ?? ""),
+      `${String(event.actor_type ?? "")}:${String(event.actor_id ?? "")}`,
+      `${String(event.purpose ?? "")}/${String(event.role ?? "")}`,
+      `${String(event.provider ?? "")}/${String(event.model ?? "")}@v${String(event.policy_version ?? "unknown")}`,
+      String(input + output),
+      priced ? formatMicrousd(event.cost_microusd) : "unpriced",
+      `${String(event.status ?? "")}${event.error_code ? `:${String(event.error_code)}` : ""}`
+    ].join("	"));
+  }
+}
+function numeric(value) {
+  return typeof value === "number" && Number.isFinite(value) ? value : 0;
+}
+function formatMicrousd(value) {
+  return typeof value === "number" && Number.isFinite(value) ? `$${(value / 1e6).toFixed(6)}` : "unpriced";
+}
+function timestamp2(value) {
+  if (typeof value !== "number" || !Number.isFinite(value)) return String(value ?? "");
+  const date = new Date(value);
+  return Number.isFinite(date.valueOf()) ? date.toISOString() : "";
+}
+async function responseBody2(res) {
+  const text = await res.text();
+  if (!text) return {};
+  try {
+    return JSON.parse(text);
+  } catch {
+    return { message: text.slice(0, 300) };
+  }
+}
+function apiError2(action, status, body) {
+  const error = isRecord2(body) && isRecord2(body.error) ? body.error : void 0;
+  const message = error && typeof error.message === "string" ? error.message : isRecord2(body) && typeof body.message === "string" ? body.message : "request failed";
+  return `${action} failed (${status}): ${message}`;
+}
+function isRecord2(value) {
+  return Boolean(value) && typeof value === "object" && !Array.isArray(value);
+}
+
+// src/admin-ai.ts
+async function adminAi(options) {
+  const platform = platformAudience(options.platform ?? process5.env.ODLA_PLATFORM ?? "https://odla.ai");
+  const doFetch = options.fetch ?? fetch;
+  const out = options.stdout ?? console;
+  const usageQuery = options.action === "usage" ? adminAiUsageQuery(options) : void 0;
+  const auditQuery = options.action === "audit" ? adminAiAuditQuery(options) : void 0;
+  const scope = options.action === "set" ? "platform:ai:policy:write" : options.action === "credential-set" ? "platform:ai:credential:write" : options.action === "credentials" ? "platform:ai:credential:read" : options.action === "usage" ? "platform:ai:usage:read" : options.action === "audit" ? "platform:ai:audit:read" : "platform:ai:policy:read";
+  const token = await resolveAdminPlatformToken({
+    platform,
+    scope,
+    token: options.token,
+    open: options.open,
+    fetch: doFetch,
+    stdout: out,
+    openApprovalUrl: options.openApprovalUrl,
+    tokenFile: options.tokenFile
+  });
+  const headers = { authorization: `Bearer ${token}`, "content-type": "application/json" };
+  if (options.action === "usage") {
+    await readAdminAiUsage({ platform, query: usageQuery ?? "", headers, json: options.json, fetch: doFetch, stdout: out });
+    return;
+  }
+  if (options.action === "audit") {
+    await readAdminAiAudit({ platform, query: auditQuery ?? "", headers, json: options.json, fetch: doFetch, stdout: out });
+    return;
+  }
+  if (options.action === "credentials") {
+    const res2 = await doFetch(`${platform}/registry/platform/ai-credentials`, { headers });
+    const body2 = await responseBody3(res2);
+    if (!res2.ok) throw new Error(apiError3("read platform AI credential status", res2.status, body2));
+    const credentials = isRecord3(body2) && isRecord3(body2.credentials) ? body2.credentials : body2;
+    if (options.json) out.log(JSON.stringify({ credentials }, null, 2));
+    else for (const [provider, status] of Object.entries(isRecord3(credentials) ? credentials : {})) {
+      const label = isRecord3(status) && status.set === true ? status.readable === true ? "vault readable" : "stored; vault unreadable" : "not set";
+      out.log(`${provider}	${label}`);
+    }
+    return;
+  }
+  if (options.action === "credential-set") {
+    const provider = requireProvider(options.credentialProvider);
+    const value = await credentialValue(options);
+    const res2 = await doFetch(`${platform}/registry/platform/ai-credentials/${encodeURIComponent(provider)}`, {
+      method: "PUT",
+      headers,
+      body: JSON.stringify({ value })
+    });
+    const body2 = await responseBody3(res2);
+    if (!res2.ok) throw new Error(apiError3(`store ${provider} platform credential`, res2.status, body2));
+    out.log(`stored ${provider} platform credential (write-only; value was not returned)`);
+    return;
+  }
+  if (options.action === "show" || options.action === "models") {
+    const res2 = await doFetch(`${platform}/registry/platform/ai-policies`, { headers });
+    const body2 = await responseBody3(res2);
+    if (!res2.ok) throw new Error(apiError3("read platform AI policies", res2.status, body2));
+    if (options.action === "models") {
+      const models = catalogModels(body2).filter((model) => !options.provider || model.provider === options.provider);
+      if (!models.length) throw new Error(options.provider ? `no System AI models found for provider ${options.provider}` : "platform returned no System AI models");
+      if (options.json) out.log(JSON.stringify({ models }, null, 2));
+      else for (const model of models) out.log(`${model.provider}	${model.id}`);
+      return;
+    }
+    const policies = policyArray(body2);
+    if (options.json) {
+      out.log(JSON.stringify({ policies, models: catalogModels(body2) }, null, 2));
+      return;
+    }
+    out.log("purpose	enabled	provider	model	max calls	max input bytes	max output tokens");
+    for (const policy2 of policies) {
+      out.log([
+        policy2.purpose,
+        String(policy2.enabled),
+        policy2.provider,
+        policy2.model,
+        String(policy2.maxCallsPerRun ?? ""),
+        String(policy2.maxInputBytes ?? ""),
+        String(policy2.maxOutputTokens ?? "")
+      ].join("	"));
+    }
+    return;
+  }
+  if (options.purpose === "security") {
+    const currentResponse = await doFetch(`${platform}/registry/platform/ai-policies`, { headers });
+    const currentBody = await responseBody3(currentResponse);
+    if (!currentResponse.ok) throw new Error(apiError3("read current security AI policies", currentResponse.status, currentBody));
+    const policies = policyArray(currentBody);
+    const discovery = policies.find((policy2) => policy2.purpose === "security.discovery");
+    const validation = policies.find((policy2) => policy2.purpose === "security.validation");
+    if (!discovery || !validation || !Number.isSafeInteger(discovery.version) || !Number.isSafeInteger(validation.version)) {
+      throw new Error("platform returned invalid security AI policy revisions");
+    }
+    const shared = {
+      ...options.enabled === void 0 ? {} : { enabled: options.enabled },
+      ...options.maxInputBytes === void 0 ? {} : { maxInputBytes: options.maxInputBytes },
+      ...options.maxOutputTokens === void 0 ? {} : { maxOutputTokens: options.maxOutputTokens },
+      ...options.maxCallsPerRun === void 0 ? {} : { maxCallsPerRun: options.maxCallsPerRun }
+    };
+    const discoveryUpdate = {
+      ...shared,
+      ...options.discoveryProvider?.trim() ? { provider: options.discoveryProvider.trim() } : {},
+      ...options.discoveryModel?.trim() ? { model: options.discoveryModel.trim() } : {}
+    };
+    const validationUpdate = {
+      ...shared,
+      ...options.validationProvider?.trim() ? { provider: options.validationProvider.trim() } : {},
+      ...options.validationModel?.trim() ? { model: options.validationModel.trim() } : {}
+    };
+    if (!Object.keys(discoveryUpdate).length && !Object.keys(validationUpdate).length) {
+      throw new Error("security set requires a route, enabled state, or budget change");
+    }
+    const res2 = await doFetch(`${platform}/registry/platform/ai-policies/security`, {
+      method: "PUT",
+      headers,
+      body: JSON.stringify({
+        expectedVersions: { discovery: discovery.version, validation: validation.version },
+        discovery: discoveryUpdate,
+        validation: validationUpdate
+      })
+    });
+    const response2 = await responseBody3(res2);
+    if (!res2.ok) throw new Error(apiError3("update security review routes", res2.status, response2));
+    out.log(options.json ? JSON.stringify(response2, null, 2) : "updated security review discovery and independent validation routes atomically");
+    return;
+  }
+  const purpose = requireSystemAiPurpose(options.purpose);
+  const body = {
+    ...options.provider?.trim() ? { provider: options.provider.trim() } : {},
+    ...options.model?.trim() ? { model: options.model.trim() } : {},
+    ...options.enabled === void 0 ? {} : { enabled: options.enabled },
+    ...options.maxInputBytes === void 0 ? {} : { maxInputBytes: options.maxInputBytes },
+    ...options.maxOutputTokens === void 0 ? {} : { maxOutputTokens: options.maxOutputTokens },
+    ...options.maxCallsPerRun === void 0 ? {} : { maxCallsPerRun: options.maxCallsPerRun }
+  };
+  if (!Object.keys(body).length) throw new Error("set requires a provider, model, enabled state, or budget change");
+  const res = await doFetch(`${platform}/registry/platform/ai-policies/${encodeURIComponent(purpose)}`, {
+    method: "PUT",
+    headers,
+    body: JSON.stringify(body)
+  });
+  const response = await responseBody3(res);
+  if (!res.ok) throw new Error(apiError3(`update ${purpose}`, res.status, response));
+  const policy = isRecord3(response) && isRecord3(response.policy) ? response.policy : isRecord3(response) ? response : {};
+  out.log(options.json ? JSON.stringify({ policy }, null, 2) : `updated ${purpose}: ${String(policy.provider ?? "unchanged")}/${String(policy.model ?? "unchanged")}`);
+}
+function requireProvider(value) {
+  if (value !== "anthropic" && value !== "openai" && value !== "google") {
+    throw new Error("provider must be one of: anthropic, openai, google");
+  }
+  return value;
+}
+async function credentialValue(options) {
+  if (options.fromEnv && options.stdin) throw new Error("choose exactly one of --from-env or --stdin");
+  let value;
+  if (options.fromEnv) value = process5.env[options.fromEnv];
+  else if (options.stdin) value = await (options.readStdin ?? readStdin)();
+  else throw new Error("credential input required: use --from-env <NAME> or --stdin; values are never accepted as arguments");
+  value = value?.replace(/[\r\n]+$/, "");
+  if (!value) throw new Error(options.fromEnv ? `environment variable ${options.fromEnv} is empty or unset` : "stdin credential is empty");
+  if (new TextEncoder().encode(value).byteLength > 64 * 1024) throw new Error("credential exceeds 64 KiB");
+  return value;
+}
+async function readStdin() {
+  let value = "";
+  for await (const chunk of process5.stdin) {
+    value += String(chunk);
+    if (value.length > 64 * 1024) throw new Error("credential exceeds 64 KiB");
+  }
+  return value;
+}
+function policyArray(body) {
+  if (isRecord3(body) && Array.isArray(body.policies)) return body.policies.filter(isRecord3);
+  if (isRecord3(body) && isRecord3(body.policies)) return Object.values(body.policies).filter(isRecord3);
+  throw new Error("platform returned an invalid AI policy response");
+}
+function catalogModels(body) {
+  if (!isRecord3(body) || !isRecord3(body.catalog) || !Array.isArray(body.catalog.models)) {
+    throw new Error("platform returned an invalid System AI model catalog");
+  }
+  return body.catalog.models.filter((value) => isRecord3(value) && typeof value.id === "string" && typeof value.provider === "string");
+}
+async function responseBody3(res) {
+  const text = await res.text();
+  if (!text) return {};
+  try {
+    return JSON.parse(text);
+  } catch {
+    return { message: text.slice(0, 300) };
+  }
+}
+function apiError3(action, status, body) {
+  const error = isRecord3(body) && isRecord3(body.error) ? body.error : void 0;
+  const message = error && typeof error.message === "string" ? error.message : isRecord3(body) && typeof body.message === "string" ? body.message : "request failed";
+  return `${action} failed (${status}): ${message}`;
+}
+function isRecord3(value) {
+  return Boolean(value) && typeof value === "object" && !Array.isArray(value);
+}
+
 // src/capabilities.ts
 var CAPABILITIES = {
   cli: [
@@ -7,7 +649,9 @@ var CAPABILITIES = {
     "issue, persist, and explicitly rotate configured service credentials",
     "write local Worker values and push deployed Worker secrets through Wrangler stdin",
     "push db schema/rules and configure platform AI, auth, and deployment links",
-    "validate config offline and smoke-test a provisioned db environment"
+    "validate config offline and smoke-test a provisioned db environment",
+    "run app-attributed hosted security discovery and independent validation without provider keys",
+    "let admins manage system AI policy and credentials, inspect attributed usage, and read immutable admin changes through separate short-lived capability-only approvals"
   ],
   agent: [
     "install and import the selected odla SDKs",
@@ -18,11 +662,13 @@ var CAPABILITIES = {
     "approve the odla device code and one-off third-party logins",
     "consent to production changes with --yes",
     "request destructive credential rotation explicitly",
-    "review application semantics, security findings, releases, and merges"
+    "review application semantics, security findings, releases, and merges",
+    "approve redacted-source disclosure before hosted security reasoning"
   ],
   studio: [
     "view telemetry and environment state",
-    "perform manual credential recovery when the CLI's local shown-once copy is unavailable"
+    "perform manual credential recovery when the CLI's local shown-once copy is unavailable",
+    "configure system AI purposes and view app/environment/run-attributed usage"
   ]
 };
 function printCapabilities(json = false, out = console) {
@@ -62,28 +708,28 @@ function looksSecret(value) {
 }
 
 // src/config.ts
-import { existsSync, readFileSync } from "fs";
-import { dirname, isAbsolute, resolve } from "path";
+import { existsSync as existsSync3, readFileSync as readFileSync2 } from "fs";
+import { dirname as dirname2, isAbsolute as isAbsolute2, resolve as resolve2 } from "path";
 import { pathToFileURL } from "url";
 var DEFAULT_PLATFORM = "https://odla.ai";
 var DEFAULT_ENVS = ["dev"];
 var DEFAULT_SERVICES = ["db", "ai"];
 async function loadProjectConfig(configPath = "odla.config.mjs") {
-  const resolved = resolve(configPath);
-  if (!existsSync(resolved)) {
+  const resolved = resolve2(configPath);
+  if (!existsSync3(resolved)) {
     throw new Error(`config not found: ${configPath}. Run "odla-ai init" first or pass --config.`);
   }
   const raw = await loadConfigModule(resolved);
-  const rootDir = dirname(resolved);
+  const rootDir = dirname2(resolved);
   validateRawConfig(raw, resolved);
   const platformUrl = trimSlash(process.env.ODLA_PLATFORM_URL || raw.platformUrl || DEFAULT_PLATFORM);
   const dbEndpoint = trimSlash(process.env.ODLA_DB_ENDPOINT || raw.dbEndpoint || platformUrl);
   const envs = unique(raw.envs?.length ? raw.envs : DEFAULT_ENVS);
   const services = unique(raw.services?.length ? raw.services : DEFAULT_SERVICES);
   const local = {
-    tokenFile: resolve(rootDir, raw.local?.tokenFile ?? ".odla/dev-token.json"),
-    credentialsFile: resolve(rootDir, raw.local?.credentialsFile ?? ".odla/credentials.local.json"),
-    devVarsFile: resolve(rootDir, raw.local?.devVarsFile ?? ".dev.vars"),
+    tokenFile: resolve2(rootDir, raw.local?.tokenFile ?? ".odla/dev-token.json"),
+    credentialsFile: resolve2(rootDir, raw.local?.credentialsFile ?? ".odla/credentials.local.json"),
+    devVarsFile: resolve2(rootDir, raw.local?.devVarsFile ?? ".dev.vars"),
     gitignore: raw.local?.gitignore ?? true
   };
   return {
@@ -100,9 +746,9 @@ async function loadProjectConfig(configPath = "odla.config.mjs") {
 async function resolveDataExport(cfg, value, names) {
   if (value === void 0 || value === null || value === false) return void 0;
   if (typeof value !== "string") return value;
-  const target = isAbsolute(value) ? value : resolve(cfg.rootDir, value);
+  const target = isAbsolute2(value) ? value : resolve2(cfg.rootDir, value);
   if (target.endsWith(".json")) {
-    return JSON.parse(readFileSync(target, "utf8"));
+    return JSON.parse(readFileSync2(target, "utf8"));
   }
   const mod = await import(pathToFileURL(target).href);
   for (const name of names) {
@@ -153,7 +799,7 @@ function validId(value) {
   return typeof value === "string" && /^[a-z0-9][a-z0-9-]*$/.test(value);
 }
 async function loadConfigModule(path) {
-  if (path.endsWith(".json")) return JSON.parse(readFileSync(path, "utf8"));
+  if (path.endsWith(".json")) return JSON.parse(readFileSync2(path, "utf8"));
   const mod = await import(`${pathToFileURL(path).href}?t=${Date.now()}`);
   const value = mod.default ?? mod.config;
   if (typeof value === "function") return await value();
@@ -168,141 +814,15 @@ function unique(values) {
 
 // src/doctor-checks.ts
 import { execFileSync } from "child_process";
-import { existsSync as existsSync4, readFileSync as readFileSync4 } from "fs";
+import { existsSync as existsSync5, readFileSync as readFileSync4 } from "fs";
 import { join as join2, resolve as resolve3 } from "path";
 
-// src/local.ts
-import { chmodSync, existsSync as existsSync2, mkdirSync, readFileSync as readFileSync2, renameSync, writeFileSync } from "fs";
-import { dirname as dirname2, isAbsolute as isAbsolute2, relative, resolve as resolve2 } from "path";
-var GITIGNORE_LINES = [".odla/*.local.json", ".odla/dev-token.json", ".dev.vars"];
-function readJsonFile(path) {
-  try {
-    return JSON.parse(readFileSync2(path, "utf8"));
-  } catch {
-    return null;
-  }
-}
-function writePrivateJson(path, value) {
-  writePrivateText(path, `${JSON.stringify(value, null, 2)}
-`);
-}
-function readCredentials(path) {
-  if (!existsSync2(path)) return null;
-  let value;
-  try {
-    value = JSON.parse(readFileSync2(path, "utf8"));
-  } catch {
-    throw new Error(`credentials file ${path} is not valid JSON; fix or remove it before provisioning`);
-  }
-  if (!value || typeof value !== "object" || typeof value.appId !== "string" || !value.envs || typeof value.envs !== "object") {
-    throw new Error(`credentials file ${path} has an invalid shape; fix or remove it before provisioning`);
-  }
-  return value;
-}
-function mergeCredential(current, update) {
-  const next = current ?? {
-    appId: update.appId,
-    platformUrl: update.platformUrl,
-    dbEndpoint: update.dbEndpoint,
-    updatedAt: (/* @__PURE__ */ new Date(0)).toISOString(),
-    envs: {}
-  };
-  next.appId = update.appId;
-  next.platformUrl = update.platformUrl;
-  next.dbEndpoint = update.dbEndpoint;
-  next.updatedAt = (/* @__PURE__ */ new Date()).toISOString();
-  next.envs[update.env] = {
-    ...next.envs[update.env] ?? {},
-    tenantId: update.tenantId,
-    ...update.dbKey ? { dbKey: update.dbKey } : {},
-    ...update.o11yToken ? { o11yToken: update.o11yToken } : {}
-  };
-  return next;
-}
-function ensureGitignore(rootDir, localPaths = []) {
-  const path = resolve2(rootDir, ".gitignore");
-  const existing = existsSync2(path) ? readFileSync2(path, "utf8") : "";
-  const configured = localPaths.map((localPath) => gitignoreEntry(rootDir, localPath)).filter((line) => !!line);
-  const wanted = [.../* @__PURE__ */ new Set([...GITIGNORE_LINES, ...configured])];
-  const missing = wanted.filter((line) => !existing.split(/\r?\n/).includes(line));
-  if (missing.length === 0) return;
-  const prefix = existing && !existing.endsWith("\n") ? "\n" : "";
-  writeFileSync(path, `${existing}${prefix}${missing.join("\n")}
-`);
-}
-function o11yDevVars(cfg) {
-  if (!cfg.services.includes("o11y")) return void 0;
-  return {
-    endpoint: cfg.o11y?.endpoint ?? "https://o11y.odla.ai",
-    service: cfg.o11y?.service ?? cfg.app.id,
-    ...cfg.o11y?.version ? { version: cfg.o11y.version } : {}
-  };
-}
-function resolveWriteDevVarsTarget(cfg, requested) {
-  if (!requested) return null;
-  if (requested === true) return cfg.local.devVarsFile;
-  return resolve2(dirname2(cfg.configPath), requested);
-}
-function writeDevVars(path, credentials, env, o11y) {
-  const entry = credentials.envs[env];
-  if (!entry) throw new Error(`no credentials for env "${env}" in ${path}`);
-  const lines = [`ODLA_PLATFORM="${credentials.platformUrl}"`];
-  if (entry.dbKey) lines.push(`ODLA_ENDPOINT="${credentials.dbEndpoint}"`);
-  lines.push(`ODLA_APP_ID="${credentials.appId}"`, `ODLA_ENV="${env}"`, `ODLA_TENANT="${entry.tenantId}"`);
-  if (entry.dbKey) lines.push(`ODLA_API_KEY="${entry.dbKey}"`);
-  if (o11y) {
-    lines.push(`ODLA_O11Y_ENDPOINT="${o11y.endpoint}"`, `ODLA_O11Y_SERVICE="${o11y.service}"`);
-    if (o11y.version) lines.push(`ODLA_O11Y_VERSION="${o11y.version}"`);
-    if (entry.o11yToken) lines.push(`ODLA_O11Y_TOKEN="${entry.o11yToken}"`);
-  }
-  const existing = existsSync2(path) ? readFileSync2(path, "utf8") : "";
-  const retained = existing.split(/\r?\n/).filter((line) => !isManagedDevVar(line));
-  while (retained.at(-1) === "") retained.pop();
-  const prefix = retained.length ? `${retained.join("\n")}
-
-` : "";
-  writePrivateText(path, `${prefix}${lines.join("\n")}
-`);
-}
-var MANAGED_DEV_VARS = /* @__PURE__ */ new Set([
-  "ODLA_PLATFORM",
-  "ODLA_ENDPOINT",
-  "ODLA_APP_ID",
-  "ODLA_ENV",
-  "ODLA_TENANT",
-  "ODLA_API_KEY",
-  "ODLA_O11Y_ENDPOINT",
-  "ODLA_O11Y_SERVICE",
-  "ODLA_O11Y_VERSION",
-  "ODLA_O11Y_TOKEN"
-]);
-function isManagedDevVar(line) {
-  const match = line.match(/^\s*(?:export\s+)?([A-Z][A-Z0-9_]*)\s*=/);
-  return !!match?.[1] && MANAGED_DEV_VARS.has(match[1]);
-}
-function writePrivateText(path, text) {
-  mkdirSync(dirname2(path), { recursive: true });
-  const temporary = `${path}.tmp-${process.pid}-${Date.now()}`;
-  writeFileSync(temporary, text, { mode: 384 });
-  chmodSync(temporary, 384);
-  renameSync(temporary, path);
-}
-function gitignoreEntry(rootDir, path) {
-  const rel = relative(resolve2(rootDir), resolve2(path));
-  if (!rel || rel === ".." || rel.startsWith(`..${process.platform === "win32" ? "\\" : "/"}`) || isAbsolute2(rel)) return null;
-  return rel.replaceAll("\\", "/");
-}
-function displayPath(path, rootDir = process.cwd()) {
-  const rel = relative(rootDir, path);
-  return rel && !rel.startsWith("..") ? rel : path;
-}
-
 // src/wrangler.ts
-import { spawn } from "child_process";
-import { existsSync as existsSync3, readFileSync as readFileSync3 } from "fs";
+import { spawn as spawn2 } from "child_process";
+import { existsSync as existsSync4, readFileSync as readFileSync3 } from "fs";
 import { join } from "path";
 var defaultRunner = (cmd, args, opts) => new Promise((resolvePromise, reject) => {
-  const child = spawn(cmd, args, { cwd: opts?.cwd, stdio: ["pipe", "pipe", "pipe"] });
+  const child = spawn2(cmd, args, { cwd: opts?.cwd, stdio: ["pipe", "pipe", "pipe"] });
   let stdout = "";
   let stderr = "";
   child.stdout.on("data", (chunk) => stdout += chunk.toString());
@@ -315,7 +835,7 @@ var WRANGLER_CONFIG_FILES = ["wrangler.jsonc", "wrangler.json", "wrangler.toml"]
 function findWranglerConfig(rootDir) {
   for (const name of WRANGLER_CONFIG_FILES) {
     const path = join(rootDir, name);
-    if (existsSync3(path)) return path;
+    if (existsSync4(path)) return path;
   }
   return null;
 }
@@ -423,7 +943,7 @@ function wranglerWarnings(rootDir) {
       const dir = resolve3(rootDir, assets.directory);
       if (dir === resolve3(rootDir)) {
         warnings.push(`${label}assets.directory is the project root \u2014 point it at a dedicated build dir (wrangler dev fails with "spawn EBADF")`);
-      } else if (existsSync4(join2(dir, "node_modules"))) {
+      } else if (existsSync5(join2(dir, "node_modules"))) {
         warnings.push(`${label}assets.directory contains node_modules \u2014 wrangler dev's watcher will exhaust file descriptors`);
       }
     }
@@ -459,7 +979,7 @@ function o11yProjectWarnings(rootDir) {
     return warnings;
   }
   const main = typeof config.main === "string" ? resolve3(rootDir, config.main) : null;
-  if (!main || !existsSync4(main)) {
+  if (!main || !existsSync5(main)) {
     warnings.push("cannot verify o11y Worker instrumentation \u2014 wrangler main is missing or unreadable");
   } else {
     let source = "";
@@ -546,13 +1066,13 @@ async function doctor(options) {
 }
 
 // src/init.ts
-import { existsSync as existsSync5, mkdirSync as mkdirSync2, writeFileSync as writeFileSync2 } from "fs";
+import { existsSync as existsSync6, mkdirSync as mkdirSync2, writeFileSync as writeFileSync2 } from "fs";
 import { dirname as dirname3, resolve as resolve4 } from "path";
 function initProject(options) {
   const out = options.stdout ?? console;
   const rootDir = resolve4(options.rootDir ?? process.cwd());
   const configPath = resolve4(rootDir, options.configPath ?? "odla.config.mjs");
-  if (existsSync5(configPath) && !options.force) {
+  if (existsSync6(configPath) && !options.force) {
     throw new Error(`${configPath} already exists. Pass --force to overwrite.`);
   }
   if (!/^[a-z0-9][a-z0-9-]*$/.test(options.appId)) {
@@ -573,7 +1093,7 @@ function initProject(options) {
   out.log("updated .gitignore for local odla credentials");
 }
 function writeIfMissing(path, text) {
-  if (existsSync5(path)) return;
+  if (existsSync6(path)) return;
   writeFileSync2(path, text);
 }
 function configTemplate(input) {
@@ -687,134 +1207,57 @@ async function secretsPushImpl(options, preflight) {
   const entry = credentials.envs[env];
   if (!entry) throw new Error(`no credentials for env "${env}" in ${credentialsPath} \u2014 run "odla-ai provision" first`);
   const secrets = [];
-  if (cfg.services.includes("o11y")) {
-    if (!entry.o11yToken) throw new Error(`no o11y token for env "${env}" in ${credentialsPath} \u2014 run "odla-ai provision" first`);
-    secrets.push({ name: "ODLA_O11Y_TOKEN", value: entry.o11yToken });
-  }
-  if (cfg.services.includes("db")) {
-    if (!entry.dbKey) throw new Error(`no db key for env "${env}" in ${credentialsPath} \u2014 run "odla-ai provision" first`);
-    secrets.push({ name: "ODLA_API_KEY", value: entry.dbKey });
-  }
-  if (secrets.length === 0) {
-    out.log(`${env}: no configured Worker secrets to push`);
-    return;
-  }
-  const wranglerEnv = PROD_ENV_NAMES.has(env) ? void 0 : env;
-  const target = wranglerEnv ? `wrangler env "${wranglerEnv}"` : "the top-level (prod) wrangler env";
-  if (options.dryRun) {
-    assertWranglerConfig(cfg);
-    for (const s of secrets) out.log(`dry run: would push ${s.name} (${redactSecrets(s.value)}) to ${target}`);
-    return;
-  }
-  const run = options.runner ?? defaultRunner;
-  if (preflight) await preflightLoadedConfig(cfg, run);
-  for (const s of secrets) {
-    const result = await wranglerPutSecret(run, { name: s.name, value: s.value, env: wranglerEnv, cwd: cfg.rootDir });
-    if (result.code !== 0) {
-      throw new Error(`wrangler secret put ${s.name} failed (exit ${result.code}): ${redactSecrets(`${result.stderr || result.stdout}`.trim())}`);
-    }
-    out.log(`${s.name} pushed to ${target} (value read from ${credentialsPath}, never echoed)`);
-  }
-}
-async function preflightSecretsPush(options) {
-  const cfg = await loadProjectConfig(options.configPath);
-  if (!cfg.services.some((service) => service === "db" || service === "o11y")) return;
-  await preflightLoadedConfig(cfg, options.runner ?? defaultRunner);
-}
-async function preflightLoadedConfig(cfg, run) {
-  assertWranglerConfig(cfg);
-  if (!await wranglerLoggedIn(run, cfg.rootDir)) {
-    throw new Error(`wrangler is not logged in \u2014 run "wrangler login" (a browser step for the human)`);
-  }
-}
-function assertWranglerConfig(cfg) {
-  if (!findWranglerConfig(cfg.rootDir)) {
-    throw new Error(`no wrangler config found in ${cfg.rootDir} (wrangler.jsonc, wrangler.json, or wrangler.toml)`);
-  }
-}
-
-// src/provision.ts
-import { createAppsClient, tenantIdFor as tenantIdFor2 } from "@odla-ai/apps";
-import { DEFAULT_SECRET_NAMES, putSecret } from "@odla-ai/ai";
-import process4 from "process";
-
-// src/token.ts
-import { requestToken } from "@odla-ai/db";
-import process3 from "process";
-
-// src/open.ts
-import { spawn as spawn2 } from "child_process";
-import process2 from "process";
-async function openUrl(url, options = {}) {
-  const command = openerFor(options.platform ?? process2.platform);
-  const doSpawn = options.spawnImpl ?? spawn2;
-  await new Promise((resolve6, reject) => {
-    const child = doSpawn(command.cmd, [...command.args, url], {
-      stdio: "ignore",
-      detached: true
-    });
-    child.once("error", reject);
-    child.once("spawn", () => {
-      child.unref();
-      resolve6();
-    });
-  });
-}
-function openerFor(platform) {
-  if (platform === "darwin") return { cmd: "open", args: [] };
-  if (platform === "win32") return { cmd: "cmd", args: ["/c", "start", ""] };
-  return { cmd: "xdg-open", args: [] };
-}
-
-// src/token.ts
-async function getDeveloperToken(cfg, options, doFetch, out) {
-  if (options.token) return options.token;
-  if (process3.env.ODLA_DEV_TOKEN) return process3.env.ODLA_DEV_TOKEN;
-  const cached = readJsonFile(cfg.local.tokenFile);
-  if (cached?.token && (cached.expiresAt ?? 0) > Date.now() + 6e4) {
-    out.log(`auth: using cached developer token (${displayPath(cfg.local.tokenFile, cfg.rootDir)})`);
-    return cached.token;
-  }
-  const browser = approvalBrowser(options);
-  const { token, expiresAt } = await requestToken({
-    endpoint: cfg.platformUrl,
-    label: `${cfg.app.id} provisioner`,
-    fetch: doFetch,
-    onCode: async ({ userCode, expiresIn }) => {
-      const approvalUrl = handshakeUrl(cfg.platformUrl, userCode);
-      out.log("");
-      out.log(`Approve code ${userCode} at ${approvalUrl} within ${Math.floor(expiresIn / 60)}m.`);
-      if (browser.open) {
-        try {
-          await (options.openApprovalUrl ?? openUrl)(approvalUrl);
-          out.log(`auth: opened browser for approval${browser.mode === "auto" ? " (auto)" : ""}`);
-        } catch (err) {
-          out.log(`auth: could not open browser (${err instanceof Error ? err.message : String(err)})`);
-        }
-      } else if (browser.reason) {
-        out.log(`auth: browser launch skipped (${browser.reason})`);
-      }
-      out.log("");
+  if (cfg.services.includes("o11y")) {
+    if (!entry.o11yToken) throw new Error(`no o11y token for env "${env}" in ${credentialsPath} \u2014 run "odla-ai provision" first`);
+    secrets.push({ name: "ODLA_O11Y_TOKEN", value: entry.o11yToken });
+  }
+  if (cfg.services.includes("db")) {
+    if (!entry.dbKey) throw new Error(`no db key for env "${env}" in ${credentialsPath} \u2014 run "odla-ai provision" first`);
+    secrets.push({ name: "ODLA_API_KEY", value: entry.dbKey });
+  }
+  if (secrets.length === 0) {
+    out.log(`${env}: no configured Worker secrets to push`);
+    return;
+  }
+  const wranglerEnv = PROD_ENV_NAMES.has(env) ? void 0 : env;
+  const target = wranglerEnv ? `wrangler env "${wranglerEnv}"` : "the top-level (prod) wrangler env";
+  if (options.dryRun) {
+    assertWranglerConfig(cfg);
+    for (const s of secrets) out.log(`dry run: would push ${s.name} (${redactSecrets(s.value)}) to ${target}`);
+    return;
+  }
+  const run = options.runner ?? defaultRunner;
+  if (preflight) await preflightLoadedConfig(cfg, run);
+  for (const s of secrets) {
+    const result = await wranglerPutSecret(run, { name: s.name, value: s.value, env: wranglerEnv, cwd: cfg.rootDir });
+    if (result.code !== 0) {
+      throw new Error(`wrangler secret put ${s.name} failed (exit ${result.code}): ${redactSecrets(`${result.stderr || result.stdout}`.trim())}`);
     }
-  });
-  writePrivateJson(cfg.local.tokenFile, { token, expiresAt });
-  out.log(`auth: developer token cached (${displayPath(cfg.local.tokenFile, cfg.rootDir)})`);
-  return token;
+    out.log(`${s.name} pushed to ${target} (value read from ${credentialsPath}, never echoed)`);
+  }
 }
-function approvalBrowser(options) {
-  if (options.open === true) return { open: true, mode: "forced" };
-  if (options.open === false) return { open: false, reason: "disabled by --no-open" };
-  if (process3.env.CI) return { open: false, reason: "CI environment" };
-  const interactive = options.interactive ?? Boolean(process3.stdin.isTTY && process3.stdout.isTTY);
-  if (!interactive) return { open: false, reason: "non-interactive shell; pass --open to force" };
-  return { open: true, mode: "auto" };
+async function preflightSecretsPush(options) {
+  const cfg = await loadProjectConfig(options.configPath);
+  if (!cfg.services.some((service) => service === "db" || service === "o11y")) return;
+  await preflightLoadedConfig(cfg, options.runner ?? defaultRunner);
 }
-function handshakeUrl(platformUrl, userCode) {
-  const url = new URL("/studio", platformUrl);
-  url.searchParams.set("code", userCode);
-  return url.toString();
+async function preflightLoadedConfig(cfg, run) {
+  assertWranglerConfig(cfg);
+  if (!await wranglerLoggedIn(run, cfg.rootDir)) {
+    throw new Error(`wrangler is not logged in \u2014 run "wrangler login" (a browser step for the human)`);
+  }
+}
+function assertWranglerConfig(cfg) {
+  if (!findWranglerConfig(cfg.rootDir)) {
+    throw new Error(`no wrangler config found in ${cfg.rootDir} (wrangler.jsonc, wrangler.json, or wrangler.toml)`);
+  }
 }
 
+// src/provision.ts
+import { createAppsClient, tenantIdFor as tenantIdFor2 } from "@odla-ai/apps";
+import { DEFAULT_SECRET_NAMES, putSecret } from "@odla-ai/ai";
+import process6 from "process";
+
 // src/provision-credentials.ts
 import { tenantIdFor } from "@odla-ai/apps";
 async function provisionEnvCredentials(opts) {
@@ -1044,7 +1487,7 @@ ${env}: credentials are already saved; retry "odla-ai secrets push --env ${env}$
       out.log(`${env}: rules pushed (${Object.keys(rules).length} namespaces)`);
     }
     if (cfg.services.includes("ai") && cfg.ai?.provider && cfg.ai.keyEnv) {
-      const key = process4.env[cfg.ai.keyEnv];
+      const key = process6.env[cfg.ai.keyEnv];
       if (key) {
         const secretName = cfg.ai.secretName ?? defaultSecretName(cfg.ai.provider);
         await putSecret({ endpoint: cfg.dbEndpoint, token, fetch: doFetch }, tenantId, secretName, key);
@@ -1104,10 +1547,121 @@ async function safeText2(res) {
   }
 }
 
+// src/security.ts
+import { isAbsolute as isAbsolute3, relative as relative2, resolve as resolve5, sep } from "path";
+import {
+  cloudflareAppProfile,
+  createPlatformSecurityReasoners,
+  createSecurityHarness,
+  genericProfile,
+  odlaProfile,
+  securityFingerprint
+} from "@odla-ai/security";
+import { FileRunStore, snapshotDirectory, writeSecurityArtifacts } from "@odla-ai/security/node";
+async function runHostedSecurity(options) {
+  if (options.sourceDisclosureAck !== "redacted") {
+    throw new Error("Hosted security requires sourceDisclosureAck=redacted before repository source may leave this process");
+  }
+  const selfAudit = options.selfAudit === true;
+  const cfg = selfAudit ? void 0 : await loadProjectConfig(options.configPath ?? "odla.config.mjs");
+  const appId = selfAudit ? "odla-ai" : cfg.app.id;
+  const env = selfAudit ? "prod" : selectEnv(options.env, cfg.envs, cfg.configPath, cfg.rootDir);
+  const platform = options.platform ?? cfg?.platformUrl ?? "https://odla.ai";
+  const target = resolve5(options.target ?? cfg?.rootDir ?? ".");
+  const output = resolve5(options.out ?? resolve5(target, ".odla/security/hosted"));
+  const outputRelative = relative2(target, output).split(sep).join("/");
+  if (!outputRelative) throw new Error("Hosted security output cannot be the repository root");
+  const profile = profileFor(options.profile ?? "odla", options.maxHuntTasks ?? 12);
+  const tokenRequest = {
+    platform,
+    appId,
+    env,
+    selfAudit,
+    scope: selfAudit ? "platform:security:self" : null
+  };
+  const token = await injectedToken(options, tokenRequest);
+  const snapshot = await snapshotDirectory(target, {
+    exclude: !outputRelative.startsWith("../") && !isAbsolute3(outputRelative) ? [outputRelative] : []
+  });
+  const hosted = await createPlatformSecurityReasoners({
+    platform,
+    token,
+    appId,
+    env,
+    repository: snapshot.repository,
+    revision: snapshot.revision,
+    snapshotDigest: snapshot.digest,
+    sourceDisclosure: "redacted",
+    clientRunId: options.runId ?? crypto.randomUUID(),
+    ...selfAudit ? { selfAudit: { enabled: true, subject: "service:odla-security-self-audit" } } : {},
+    fetch: options.fetch,
+    signal: options.signal
+  });
+  const harness = createSecurityHarness({
+    profile,
+    store: new FileRunStore(resolve5(output, "state")),
+    discoveryReasoner: hosted.discoveryReasoner,
+    validationReasoner: hosted.validationReasoner,
+    policy: {
+      modelSourceDisclosure: "redacted",
+      active: false,
+      allowNetwork: false
+    }
+  });
+  const report = await harness.run(snapshot, { runId: hosted.run.runId, signal: options.signal });
+  await writeSecurityArtifacts(output, report);
+  const reportDigest = await securityFingerprint(report);
+  await hosted.complete({
+    reportDigest,
+    coverageStatus: report.coverageStatus,
+    confirmed: report.metrics.confirmed,
+    candidates: report.metrics.candidates
+  }, { signal: options.signal });
+  printSummary(options.stdout ?? console, appId, env, hosted.run, report, output);
+  return Object.freeze({ report, run: hosted.run, output });
+}
+function selectEnv(requested, declared, configPath, rootDir) {
+  const env = requested ?? (declared.includes("dev") ? "dev" : declared[0]);
+  if (!env || !declared.includes(env)) {
+    const shown = relative2(rootDir, configPath) || configPath;
+    throw new Error(`env "${env ?? ""}" is not declared in ${shown}`);
+  }
+  return env;
+}
+async function injectedToken(options, request) {
+  const value = options.token ?? await options.getToken?.(Object.freeze({ ...request }));
+  if (typeof value !== "string" || value.length < 8 || value.length > 8192 || /\s|[\u0000-\u001f\u007f]/.test(value)) {
+    throw new Error(
+      request.selfAudit ? "Self-audit requires an injected, scoped platform security token" : "Hosted security requires an injected app developer token or getToken callback"
+    );
+  }
+  return value;
+}
+function profileFor(name, maxHuntTasks) {
+  const profile = name === "odla" ? odlaProfile() : name === "cloudflare-app" ? cloudflareAppProfile() : name === "generic" ? genericProfile() : void 0;
+  if (!profile) throw new Error(`unknown security profile "${String(name)}"`);
+  if (maxHuntTasks === void 0) return profile;
+  if (!Number.isSafeInteger(maxHuntTasks) || maxHuntTasks < 1) throw new Error("maxHuntTasks must be a positive integer");
+  return { ...profile, maxHuntTasks };
+}
+function printSummary(out, appId, env, run, report, output) {
+  const complete = report.coverage.filter((cell) => cell.state === "complete").length;
+  out.log(`security: ${appId}/${env} run=${run.runId} profile=${run.profileVersion}`);
+  out.log(`  discovery: ${run.discovery.identity.provider}/${run.discovery.identity.model}`);
+  out.log(`  validation: ${run.validation.identity.provider}/${run.validation.identity.model}`);
+  out.log(`  coverage: ${report.coverageStatus} ${complete}/${report.coverage.length} blocked=${report.metrics.blockedCells} shallow=${report.metrics.shallowCells} unscheduled=${report.metrics.unscheduledCells} budget_exhausted=${report.metrics.budgetExhaustedCells}`);
+  if (report.callBudget) out.log(`  calls: discovery=${formatBudget(report.callBudget.discovery)} validation=${formatBudget(report.callBudget.validation)}`);
+  out.log(`  findings: confirmed=${report.metrics.confirmed} needs_reproduction=${report.metrics.needsReproduction} candidates=${report.metrics.candidates}`);
+  out.log(`  report: ${resolve5(output, "REPORT.md")}`);
+}
+function formatBudget(usage) {
+  return usage ? `${usage.usedCalls}/${usage.maxCalls} skipped=${usage.skippedCalls}` : "caller-managed";
+}
+
 // src/skill.ts
-import { existsSync as existsSync6, lstatSync, mkdirSync as mkdirSync3, readFileSync as readFileSync5, readdirSync, writeFileSync as writeFileSync3 } from "fs";
+import { existsSync as existsSync7, lstatSync, mkdirSync as mkdirSync3, readFileSync as readFileSync5, readdirSync, writeFileSync as writeFileSync3 } from "fs";
 import { homedir } from "os";
-import { dirname as dirname4, isAbsolute as isAbsolute3, join as join3, relative as relative2, resolve as resolve5, sep } from "path";
+import { dirname as dirname4, isAbsolute as isAbsolute4, join as join3, relative as relative3, resolve as resolve6, sep as sep2 } from "path";
 import { fileURLToPath } from "url";
 
 // src/skill-adapters.ts
@@ -1168,8 +1722,8 @@ function installSkill(options = {}) {
   const files = listFiles(sourceDir);
   if (files.length === 0) throw new Error(`no bundled skills found at ${sourceDir}`);
   const harnesses = normalizeHarnesses(options.harnesses, options.global === true);
-  const root = resolve5(options.dir ?? process.cwd());
-  const home = resolve5(options.homeDir ?? homedir());
+  const root = resolve6(options.dir ?? process.cwd());
+  const home = resolve6(options.homeDir ?? homedir());
   const plans = /* @__PURE__ */ new Map();
   const targets = /* @__PURE__ */ new Map();
   const rememberTarget = (harness, target) => {
@@ -1188,7 +1742,7 @@ function installSkill(options = {}) {
   let targetDir;
   if (options.global) {
     const claudeRoot = join3(home, ".claude", "skills");
-    const codexRoot = resolve5(options.codexHomeDir ?? process.env.CODEX_HOME ?? join3(home, ".codex"), "skills");
+    const codexRoot = resolve6(options.codexHomeDir ?? process.env.CODEX_HOME ?? join3(home, ".codex"), "skills");
     targetDir = harnesses[0] === "codex" ? codexRoot : claudeRoot;
     for (const harness of harnesses) {
       const skillRoot = harness === "claude" ? claudeRoot : codexRoot;
@@ -1238,7 +1792,7 @@ function installSkill(options = {}) {
       conflicts.push(`${file.target} (redirected by symbolic link ${symlink})`);
       continue;
     }
-    if (!existsSync6(file.target)) {
+    if (!existsSync7(file.target)) {
       writtenPaths.add(file.target);
       continue;
     }
@@ -1259,7 +1813,7 @@ ${conflicts.map((f) => `  - ${f}`).join("\n")}`
     );
   }
   for (const file of plans.values()) {
-    if (!existsSync6(file.target) || readFileSync5(file.target, "utf8") !== file.content) {
+    if (!existsSync7(file.target) || readFileSync5(file.target, "utf8") !== file.content) {
       mkdirSync3(dirname4(file.target), { recursive: true });
       writeFileSync3(file.target, file.content);
     }
@@ -1280,7 +1834,7 @@ ${conflicts.map((f) => `  - ${f}`).join("\n")}`
   };
 }
 function pathsUnder(root, paths) {
-  return [...paths].map((path) => relative2(root, path)).filter((path) => path !== ".." && !path.startsWith(`..${sep}`) && !isAbsolute3(path)).sort();
+  return [...paths].map((path) => relative3(root, path)).filter((path) => path !== ".." && !path.startsWith(`..${sep2}`) && !isAbsolute4(path)).sort();
 }
 function normalizeHarnesses(values, global) {
   const requested = values?.length ? values : ["claude"];
@@ -1302,7 +1856,7 @@ function normalizeHarnesses(values, global) {
 function managedFileContent(path, block, force, boundary) {
   const symlink = symlinkedComponent(boundary, path);
   if (symlink) throw new Error(`refusing to manage ${path}: symbolic link component ${symlink}`);
-  if (!existsSync6(path)) return `${block}
+  if (!existsSync7(path)) return `${block}
 `;
   const current = readFileSync5(path, "utf8");
   const start = "<!-- odla-ai agent setup:start -->";
@@ -1325,12 +1879,12 @@ function managedFileContent(path, block, force, boundary) {
   return `${current.slice(0, startAt)}${block}${current.slice(afterEnd)}`;
 }
 function symlinkedComponent(boundary, target) {
-  const rel = relative2(boundary, target);
-  if (rel === ".." || rel.startsWith(`..${sep}`) || isAbsolute3(rel)) {
+  const rel = relative3(boundary, target);
+  if (rel === ".." || rel.startsWith(`..${sep2}`) || isAbsolute4(rel)) {
     throw new Error(`agent setup target escapes its install root: ${target}`);
   }
   let current = boundary;
-  for (const part of rel.split(sep).filter(Boolean)) {
+  for (const part of rel.split(sep2).filter(Boolean)) {
     current = join3(current, part);
     try {
       if (lstatSync(current).isSymbolicLink()) return current;
@@ -1344,13 +1898,13 @@ function skillNames(files) {
   return [...new Set(files.filter((file) => /(^|[\\/])SKILL\.md$/.test(file)).map((file) => file.split(/[\\/]/)[0]))].sort();
 }
 function listFiles(dir) {
-  if (!existsSync6(dir)) return [];
+  if (!existsSync7(dir)) return [];
   const results = [];
   const walk = (current) => {
     for (const entry of readdirSync(current, { withFileTypes: true })) {
       const path = join3(current, entry.name);
       if (entry.isDirectory()) walk(path);
-      else results.push(relative2(dir, path));
+      else results.push(relative3(dir, path));
     }
   };
   walk(dir);
@@ -1439,7 +1993,140 @@ async function safeText3(res) {
 }
 
 // src/cli.ts
+import { findingsAtOrAbove } from "@odla-ai/security";
+
+// src/argv.ts
+function parseArgv(argv) {
+  const positionals = [];
+  const options = {};
+  for (let i = 0; i < argv.length; i++) {
+    const arg = argv[i];
+    if (!arg.startsWith("--")) {
+      positionals.push(arg);
+      continue;
+    }
+    const eq = arg.indexOf("=");
+    const rawName = arg.slice(2, eq === -1 ? void 0 : eq);
+    if (!rawName) continue;
+    if (rawName.startsWith("no-")) {
+      options[rawName.slice(3)] = false;
+      continue;
+    }
+    if (eq !== -1) {
+      addOption(options, rawName, arg.slice(eq + 1));
+      continue;
+    }
+    const value = argv[i + 1];
+    if (value !== void 0 && !value.startsWith("--")) {
+      i++;
+      addOption(options, rawName, value);
+    } else {
+      addOption(options, rawName, true);
+    }
+  }
+  return { positionals, options };
+}
+function assertArgs(parsed, allowedOptions, maxPositionals) {
+  const allowed = new Set(allowedOptions);
+  for (const name of Object.keys(parsed.options)) {
+    if (!allowed.has(name)) throw new Error(`unknown option "--${name}"; run "odla-ai help" for supported options`);
+  }
+  if (parsed.positionals.length > maxPositionals) {
+    throw new Error(`unexpected argument "${parsed.positionals[maxPositionals]}"; run "odla-ai help"`);
+  }
+}
+function requiredString(value, name) {
+  const result = stringOpt(value);
+  if (!result) throw new Error(`${name} is required`);
+  return result;
+}
+function stringOpt(value) {
+  if (typeof value === "string") return value;
+  if (Array.isArray(value)) return value[value.length - 1];
+  return void 0;
+}
+function listOpt(value) {
+  if (value === void 0 || typeof value === "boolean") return void 0;
+  const values = Array.isArray(value) ? value : [value];
+  return values.flatMap((item) => item.split(",")).map((item) => item.trim()).filter(Boolean);
+}
+function boolOpt(value) {
+  if (typeof value === "boolean") return value;
+  if (typeof value === "string" && (value === "true" || value === "false")) return value === "true";
+  if (value === void 0) return void 0;
+  throw new Error("boolean option must be true or false");
+}
+function numberOpt(value, flag) {
+  if (value === void 0) return void 0;
+  const raw = stringOpt(value);
+  const parsed = raw === void 0 ? Number.NaN : Number(raw);
+  if (!Number.isSafeInteger(parsed) || parsed < 1) throw new Error(`${flag} requires a positive integer`);
+  return parsed;
+}
+function addOption(options, name, value) {
+  const current = options[name];
+  if (current === void 0) options[name] = value;
+  else if (Array.isArray(current)) current.push(String(value));
+  else options[name] = [String(current), String(value)];
+}
+
+// src/help.ts
 import { readFileSync as readFileSync6 } from "fs";
+function cliVersion() {
+  const pkg = JSON.parse(readFileSync6(new URL("../package.json", import.meta.url), "utf8"));
+  return pkg.version ?? "unknown";
+}
+function printHelp() {
+  console.log(`odla-ai
+
+Usage:
+  odla-ai setup [--dir <project>] [--agent <name>] [--global] [--force]
+  odla-ai init --app-id <id> --name <name> [--services db,ai,o11y] [--env dev --env prod]
+  odla-ai doctor [--config odla.config.mjs]
+  odla-ai capabilities [--json]
+  odla-ai admin ai show [--platform https://odla.ai] [--json]
+  odla-ai admin ai models [--provider <id>] [--json]
+  odla-ai admin ai set <purpose> [--provider <id>] [--model <id>] [--enabled|--no-enabled]
+  odla-ai admin ai set security --discovery-provider <id> --discovery-model <id>
+    --validation-provider <id> --validation-model <id> [--enabled|--no-enabled]
+  odla-ai admin ai credentials [--json]
+  odla-ai admin ai credential set <provider> (--from-env <NAME>|--stdin)
+  odla-ai admin ai usage [--app-id <id>] [--env <env>] [--run-id <id>] [--limit <1-500>] [--json]
+  odla-ai admin ai audit [--limit <1-200>] [--json]
+  odla-ai security run [target] --ack-redacted-source [--env dev] [--profile odla] [--fail-on high]
+  odla-ai security run [target] --self --ack-redacted-source
+  odla-ai provision [--config odla.config.mjs] [--dry-run] [--push-secrets] [--rotate-o11y-token] [--write-dev-vars[=path]] [--yes]
+  odla-ai smoke [--config odla.config.mjs] [--env dev]
+  odla-ai skill install [--dir <project>] [--agent <name>] [--global] [--force]
+  odla-ai secrets push --env <env> [--config odla.config.mjs] [--dry-run] [--yes]
+  odla-ai version
+
+Commands:
+  setup        Install offline odla runbooks for common coding-agent harnesses.
+  init         Create a generic odla.config.mjs plus starter schema/rules files.
+  doctor       Validate and summarize the project config without network calls.
+  capabilities Show what the CLI automates vs agent edits and human checkpoints.
+  admin        Manage platform-funded AI routing/credentials/usage with narrow device grants.
+  security     Run hosted discovery + independent validation with app/run attribution.
+  provision    Register services, configure them, persist credentials, optionally push secrets.
+  smoke        Verify local credentials, public-config, live schema, and db aggregate.
+  skill        Same installer; --agent accepts all, claude, codex, cursor,
+               copilot, gemini, or agents (repeatable or comma-separated).
+  secrets      Push configured db/o11y secrets into the Worker via wrangler stdin.
+  version      Print the CLI version.
+
+Safety:
+  New projects target dev only. Add prod explicitly to odla.config.mjs and pass
+  --yes to provision it; use --dry-run first to inspect the resolved plan.
+  Provision caches the approved developer token and service credentials under
+  .odla/ with mode 0600, and init adds those paths to .gitignore. Secret push
+  preflights Wrangler before any shown-once issuance or destructive rotation.
+  Provision opens the approval page automatically in interactive terminals;
+  use --open to force browser launch or --no-open to suppress it.
+`);
+}
+
+// src/cli.ts
 async function runCli(argv = process.argv.slice(2)) {
   const parsed = parseArgv(argv);
   const command = parsed.positionals[0] ?? "help";
@@ -1476,6 +2163,119 @@ async function runCli(argv = process.argv.slice(2)) {
     printCapabilities(parsed.options.json === true);
     return;
   }
+  if (command === "admin") {
+    const area = parsed.positionals[1];
+    const action = parsed.positionals[2];
+    const credentialSet = action === "credential" && parsed.positionals[3] === "set";
+    const credentials = action === "credentials";
+    const models = action === "models";
+    const usage = action === "usage";
+    const audit = action === "audit";
+    if (area !== "ai" || action !== "show" && action !== "set" && !credentialSet && !credentials && !models && !usage && !audit) {
+      throw new Error('unknown admin command. Try "odla-ai admin ai show".');
+    }
+    assertArgs(parsed, [
+      "platform",
+      "json",
+      "open",
+      "provider",
+      "model",
+      "enabled",
+      "max-input-bytes",
+      "max-output-tokens",
+      "max-calls-per-run",
+      "from-env",
+      "stdin",
+      "discovery-provider",
+      "discovery-model",
+      "validation-provider",
+      "validation-model",
+      "app-id",
+      "env",
+      "run-id",
+      "limit"
+    ], credentialSet ? 5 : action === "set" ? 4 : 3);
+    await adminAi({
+      action: credentialSet ? "credential-set" : credentials ? "credentials" : models ? "models" : usage ? "usage" : audit ? "audit" : action,
+      purpose: action === "set" ? parsed.positionals[3] : void 0,
+      provider: stringOpt(parsed.options.provider),
+      model: stringOpt(parsed.options.model),
+      enabled: boolOpt(parsed.options.enabled),
+      maxInputBytes: numberOpt(parsed.options["max-input-bytes"], "--max-input-bytes"),
+      maxOutputTokens: numberOpt(parsed.options["max-output-tokens"], "--max-output-tokens"),
+      maxCallsPerRun: numberOpt(parsed.options["max-calls-per-run"], "--max-calls-per-run"),
+      platform: stringOpt(parsed.options.platform),
+      json: parsed.options.json === true,
+      open: parsed.options.open === false ? false : parsed.options.open === true ? true : void 0,
+      credentialProvider: credentialSet ? parsed.positionals[4] : void 0,
+      fromEnv: stringOpt(parsed.options["from-env"]),
+      stdin: parsed.options.stdin === true,
+      discoveryProvider: stringOpt(parsed.options["discovery-provider"]),
+      discoveryModel: stringOpt(parsed.options["discovery-model"]),
+      validationProvider: stringOpt(parsed.options["validation-provider"]),
+      validationModel: stringOpt(parsed.options["validation-model"]),
+      appId: stringOpt(parsed.options["app-id"]),
+      env: stringOpt(parsed.options.env),
+      runId: stringOpt(parsed.options["run-id"]),
+      limit: numberOpt(parsed.options.limit, "--limit")
+    });
+    return;
+  }
+  if (command === "security") {
+    const sub = parsed.positionals[1];
+    if (sub !== "run") throw new Error('unknown security command. Try "odla-ai security run".');
+    assertArgs(parsed, [
+      "config",
+      "env",
+      "out",
+      "profile",
+      "max-hunt-tasks",
+      "run-id",
+      "platform",
+      "self",
+      "ack-redacted-source",
+      "open",
+      "fail-on",
+      "fail-on-candidates",
+      "allow-incomplete"
+    ], 3);
+    const configPath = stringOpt(parsed.options.config) ?? "odla.config.mjs";
+    const selfAudit = parsed.options.self === true;
+    const open = parsed.options.open === false ? false : parsed.options.open === true ? true : void 0;
+    const platform = stringOpt(parsed.options.platform);
+    const result = await runHostedSecurity({
+      configPath,
+      selfAudit,
+      target: parsed.positionals[2],
+      out: stringOpt(parsed.options.out),
+      env: stringOpt(parsed.options.env),
+      profile: securityProfile(stringOpt(parsed.options.profile)),
+      maxHuntTasks: numberOpt(parsed.options["max-hunt-tasks"], "--max-hunt-tasks"),
+      runId: stringOpt(parsed.options["run-id"]),
+      platform,
+      sourceDisclosureAck: parsed.options["ack-redacted-source"] === true ? "redacted" : void 0,
+      getToken: async (request) => {
+        if (request.scope === "platform:security:self") {
+          return getScopedPlatformToken({ platform: request.platform, scope: request.scope, open });
+        }
+        const cfg = await loadProjectConfig(configPath);
+        if (platformAudience(cfg.platformUrl) !== platformAudience(request.platform)) {
+          throw new Error("--platform cannot reuse a project developer token from another platform; update odla.config.mjs and authenticate there");
+        }
+        return getDeveloperToken(cfg, { configPath, open }, fetch, console);
+      }
+    });
+    const failOn = severityOpt(stringOpt(parsed.options["fail-on"]) ?? "high", "--fail-on");
+    const candidateValue = parsed.options["fail-on-candidates"];
+    const failOnCandidates = candidateValue === false ? void 0 : severityOpt(stringOpt(candidateValue) ?? "critical", "--fail-on-candidates");
+    const confirmed = findingsAtOrAbove(result.report, failOn);
+    const leads = failOnCandidates ? findingsAtOrAbove(result.report, failOnCandidates, true).filter((finding) => finding.disposition !== "confirmed") : [];
+    const incomplete = result.report.coverageStatus === "incomplete" && parsed.options["allow-incomplete"] !== true;
+    if (confirmed.length || leads.length || incomplete) {
+      throw new Error(`hosted security gate failed: ${confirmed.length} confirmed >= ${failOn}; ${leads.length} leads >= ${failOnCandidates ?? "disabled"}${incomplete ? "; coverage incomplete" : ""}`);
+    }
+    return;
+  }
   if (command === "provision") {
     assertArgs(
       parsed,
@@ -1556,71 +2356,14 @@ async function runCli(argv = process.argv.slice(2)) {
   }
   throw new Error(`unknown command "${command}". Run "odla-ai help".`);
 }
-function assertArgs(parsed, allowedOptions, maxPositionals) {
-  const allowed = new Set(allowedOptions);
-  for (const name of Object.keys(parsed.options)) {
-    if (!allowed.has(name)) {
-      throw new Error(`unknown option "--${name}"; run "odla-ai help" for supported options`);
-    }
-  }
-  if (parsed.positionals.length > maxPositionals) {
-    throw new Error(`unexpected argument "${parsed.positionals[maxPositionals]}"; run "odla-ai help"`);
-  }
-}
-function parseArgv(argv) {
-  const positionals = [];
-  const options = {};
-  for (let i = 0; i < argv.length; i++) {
-    const arg = argv[i];
-    if (!arg.startsWith("--")) {
-      positionals.push(arg);
-      continue;
-    }
-    const eq = arg.indexOf("=");
-    const rawName = arg.slice(2, eq === -1 ? void 0 : eq);
-    if (!rawName) continue;
-    if (rawName.startsWith("no-")) {
-      options[rawName.slice(3)] = false;
-      continue;
-    }
-    if (eq !== -1) {
-      addOption(options, rawName, arg.slice(eq + 1));
-      continue;
-    }
-    const value = argv[i + 1];
-    if (value !== void 0 && !value.startsWith("--")) {
-      i++;
-      addOption(options, rawName, value);
-    } else {
-      addOption(options, rawName, true);
-    }
-  }
-  return { positionals, options };
-}
-function addOption(options, name, value) {
-  const cur = options[name];
-  if (cur === void 0) {
-    options[name] = value;
-  } else if (Array.isArray(cur)) {
-    cur.push(String(value));
-  } else {
-    options[name] = [String(cur), String(value)];
-  }
-}
-function requiredString(value, name) {
-  const s = stringOpt(value);
-  if (!s) throw new Error(`${name} is required`);
-  return s;
-}
-function stringOpt(value) {
-  if (typeof value === "string") return value;
-  if (Array.isArray(value)) return value[value.length - 1];
-  return void 0;
+function securityProfile(value) {
+  if (value === void 0) return void 0;
+  if (value === "odla" || value === "cloudflare-app" || value === "generic") return value;
+  throw new Error("--profile must be odla, cloudflare-app, or generic");
 }
-function listOpt(value) {
-  if (value === void 0 || value === false || value === true) return void 0;
-  const values = Array.isArray(value) ? value : [value];
-  return values.flatMap((item) => item.split(",")).map((item) => item.trim()).filter(Boolean);
+function severityOpt(value, flag) {
+  if (["informational", "low", "medium", "high", "critical"].includes(value)) return value;
+  throw new Error(`${flag} must be informational, low, medium, high, or critical`);
 }
 function harnessList(parsed) {
   const selected = [
@@ -1637,48 +2380,11 @@ function harnessOption(value, flag) {
   if (parts.some((item) => !item.trim())) throw new Error(`${flag} requires a harness name`);
   return parts.map((item) => item.trim());
 }
-function cliVersion() {
-  const pkg = JSON.parse(readFileSync6(new URL("../package.json", import.meta.url), "utf8"));
-  return pkg.version ?? "unknown";
-}
-function printHelp() {
-  console.log(`odla-ai
-
-Usage:
-  odla-ai setup [--dir <project>] [--agent <name>] [--global] [--force]
-  odla-ai init --app-id <id> --name <name> [--services db,ai,o11y] [--env dev --env prod]
-  odla-ai doctor [--config odla.config.mjs]
-  odla-ai capabilities [--json]
-  odla-ai provision [--config odla.config.mjs] [--dry-run] [--push-secrets] [--rotate-o11y-token] [--write-dev-vars[=path]] [--yes]
-  odla-ai smoke [--config odla.config.mjs] [--env dev]
-  odla-ai skill install [--dir <project>] [--agent <name>] [--global] [--force]
-  odla-ai secrets push --env <env> [--config odla.config.mjs] [--dry-run] [--yes]
-  odla-ai version
-
-Commands:
-  setup       Install offline odla runbooks for common coding-agent harnesses.
-  init        Create a generic odla.config.mjs plus starter schema/rules files.
-  doctor      Validate and summarize the project config without network calls.
-  capabilities Show what the CLI automates vs agent edits and human checkpoints.
-  provision   Register services, configure them, persist credentials, optionally push secrets.
-  smoke       Verify local credentials, public-config, live schema, and db aggregate.
-  skill       Same installer; --agent accepts all, claude, codex, cursor,
-              copilot, gemini, or agents (repeatable or comma-separated).
-  secrets     Push configured db/o11y secrets into the Worker via wrangler stdin.
-  version     Print the CLI version.
-
-Safety:
-  New projects target dev only. Add prod explicitly to odla.config.mjs and pass
-  --yes to provision it; use --dry-run first to inspect the resolved plan.
-  Provision caches the approved developer token and service credentials under
-  .odla/ with mode 0600, and init adds those paths to .gitignore. Secret push
-  preflights Wrangler before any shown-once issuance or destructive rotation.
-  Provision opens the approval page automatically in interactive terminals;
-  use --open to force browser launch or --no-open to suppress it.
-`);
-}
 
 export {
+  getScopedPlatformToken,
+  SYSTEM_AI_PURPOSES,
+  adminAi,
   CAPABILITIES,
   printCapabilities,
   redactSecrets,
@@ -1686,9 +2392,10 @@ export {
   initProject,
   secretsPush,
   provision,
+  runHostedSecurity,
   AGENT_HARNESSES,
   installSkill,
   smoke,
   runCli
 };
-//# sourceMappingURL=chunk-7WZIZCGA.js.map
+//# sourceMappingURL=chunk-643B2AKG.js.map