@deepraxis/cli 0.2.0-dev.4c0c1e3 → 0.2.0-dev.a538fab

package/COMMANDS.md

@@ -2,7 +2,7 @@
 
 Generated by `bun run commands`. DO NOT EDIT.
 
-421 HTTP operations; 423 commands including aliases.
+426 HTTP operations; 428 commands including aliases.
 
 Environment: `PRAXIS_ENV=develop|production` (dev package defaults to `develop`; stable package defaults to `production`). No `--env` option.
 
@@ -142,6 +142,11 @@ Handwritten commands: `login`, `logout`, `whoami`, `org list`, `org switch <orga
 | `praxis api automation action rollback <name>` | `automation.actions.rollback` | POST `/automation/v1/actions/{ns}/{name}/rollback` | `--action`, `--revision`, `--message` |
 | `praxis api automation action update <name>` | `automation.actions.update` | PUT `/automation/v1/actions/{ns}/{name}` | `--action`, `--dry-run`, `--description`, `--timeout-ms`, `--message` |
 | `praxis api automation hook send <token>` | `automation.hooks.send` | POST `/automation/v1/hooks/{trigger_id}/{token}` | `--hook` |
+| `praxis api automation human-task cancel <id>` | `automation.humanTasks.cancel` | POST `/automation/v1/human-tasks/{id}/cancel` | `--reason` |
+| `praxis api automation human-task delegate <id>` | `automation.humanTasks.delegate` | POST `/automation/v1/human-tasks/{id}/delegate` | `--to-user` |
+| `praxis api automation human-task get <id>` | `automation.humanTasks.retrieve` | GET `/automation/v1/human-tasks/{id}` |  |
+| `praxis api automation human-task list` | `automation.humanTasks.list` | GET `/automation/v1/human-tasks` | `--param-limit`, `--param-cursor`, `--status`, `--run-id`, `--scope` |
+| `praxis api automation human-task respond <id>` | `automation.humanTasks.respond` | POST `/automation/v1/human-tasks/{id}/respond` | `--action-id`, `--comment` |
 | `praxis api automation resolve get` | `automation.resolve.retrieve` | GET `/automation/v1/resolve` | `--target` |
 | `praxis api automation run artifact list` | `automation.runs.artifacts.list` | GET `/automation/v1/runs/{id}/artifacts` | `--run`, `--param-limit`, `--param-cursor` |
 | `praxis api automation run call list` | `automation.runs.calls.list` | GET `/automation/v1/runs/{id}/calls` | `--run`, `--param-limit`, `--param-cursor` |

package/dist/praxis.js

@@ -4511,6 +4511,177 @@ file at the root of that directory.`
       fields: []
     }
   },
+  {
+    resource: "automation.humanTasks",
+    method: "list",
+    summary: "List human tasks",
+    description: "List the human tasks that praxis/approval workflow steps opened, newest first. By default it returns only open tasks assigned to the caller: their approval inbox. scope=all lists every task of the organization, and status and run_id narrow the list. Use a returned id with retrieve for details and respond to decide. Read-only: listing never changes a task.",
+    http: "GET",
+    path: "/automation/v1/human-tasks",
+    streaming: "no",
+    pagination: true,
+    pathParams: [],
+    query: [
+      {
+        name: "limit",
+        type: "integer",
+        required: false,
+        description: "Page size, 1–100, default 50."
+      },
+      {
+        name: "cursor",
+        type: "string",
+        required: false,
+        description: "The next_cursor of the previous page; omit for the first page."
+      },
+      {
+        name: "status",
+        type: "array",
+        itemType: "string",
+        enum: [
+          "open",
+          "completed",
+          "expired",
+          "cancelled"
+        ],
+        required: false,
+        description: "Filter by status, comma-separated: open, completed, expired, cancelled. Defaults to open."
+      },
+      {
+        name: "run_id",
+        type: "string",
+        required: false,
+        description: "Only tasks opened by this run (run_)."
+      },
+      {
+        name: "scope",
+        type: "string",
+        enum: [
+          "assigned",
+          "all"
+        ],
+        required: false,
+        description: "assigned (default) lists only tasks assigned to the caller; all lists every task of the organization."
+      }
+    ]
+  },
+  {
+    resource: "automation.humanTasks",
+    method: "retrieve",
+    summary: "Retrieve a human task",
+    description: "Read one human task - title, Markdown body, context, actions, form, assignees, mode, due time, responses and outcome - so an assignee can choose an action and fill the form. Read-only; the Console approval page /automation/tasks/{id} reads the same resource.",
+    http: "GET",
+    path: "/automation/v1/human-tasks/{id}",
+    streaming: "no",
+    pagination: false,
+    pathParams: [
+      {
+        name: "id",
+        sdkName: "id",
+        description: "Human task ID (htask_), from the list or the run's waits."
+      }
+    ],
+    query: []
+  },
+  {
+    resource: "automation.humanTasks",
+    method: "cancel",
+    summary: "Cancel a human task",
+    description: "Cancel an open human task; only the person who started the run or an organization API key may cancel. The task becomes cancelled and the waiting workflow step raises a runtime error with code HUMAN_TASK_CANCELLED, which try/catch can catch. Open tasks are cancelled automatically when their run ends, so this call is not needed then.",
+    http: "POST",
+    path: "/automation/v1/human-tasks/{id}/cancel",
+    streaming: "no",
+    pagination: false,
+    pathParams: [
+      {
+        name: "id",
+        sdkName: "id",
+        description: "Human task ID (htask_)."
+      }
+    ],
+    query: [],
+    body: {
+      required: false,
+      fields: [
+        {
+          name: "reason",
+          type: "string",
+          required: false,
+          description: "Optional cancellation reason, at most 500 characters."
+        }
+      ]
+    }
+  },
+  {
+    resource: "automation.humanTasks",
+    method: "delegate",
+    summary: "Delegate a human task",
+    description: "An assignee who has not responded hands their place to another user (to_user), replacing their entry in assignees.users in place, so sequential order is kept. The new user cannot already be an assignee, nor the initiator unless self-approval is allowed. The task must still be open.",
+    http: "POST",
+    path: "/automation/v1/human-tasks/{id}/delegate",
+    streaming: "no",
+    pagination: false,
+    pathParams: [
+      {
+        name: "id",
+        sdkName: "id",
+        description: "Human task ID (htask_)."
+      }
+    ],
+    query: [],
+    body: {
+      required: true,
+      fields: [
+        {
+          name: "to_user",
+          type: "string",
+          required: true,
+          description: "User ID taking over; cannot already be an assignee, nor the initiator unless self-approval is allowed."
+        }
+      ]
+    }
+  },
+  {
+    resource: "automation.humanTasks",
+    method: "respond",
+    summary: "Respond to a human task",
+    description: "Submit an action (action_id), form values (values) and a comment as the calling user. Depending on the task's mode the response either decides it (status becomes completed, outcome is set, and the waiting workflow resumes with outcome as the step output) or is recorded while other assignees are awaited. When two assignees respond at once, exactly one decides and the other gets TASK_CLOSED. An agent may respond only if the workflow set allow_agent_decision. Send an Idempotency-Key to retry safely.",
+    http: "POST",
+    path: "/automation/v1/human-tasks/{id}/respond",
+    streaming: "no",
+    pagination: false,
+    pathParams: [
+      {
+        name: "id",
+        sdkName: "id",
+        description: "Human task ID (htask_)."
+      }
+    ],
+    query: [],
+    body: {
+      required: true,
+      fields: [
+        {
+          name: "action_id",
+          type: "string",
+          required: true,
+          description: "The chosen action ID from the task's actions, for example approve."
+        },
+        {
+          name: "values",
+          type: "object",
+          required: false,
+          description: "Any JSON object whose keys are strings and whose values are any JSON value."
+        },
+        {
+          name: "comment",
+          type: "string",
+          required: false,
+          description: "Comment of at most 4000 characters; required when the action has require_comment true."
+        }
+      ]
+    }
+  },
   {
     resource: "automation.resolve",
     method: "retrieve",
@@ -4691,7 +4862,7 @@ file at the root of that directory.`
     resource: "automation.runs",
     method: "create",
     summary: "Run a published target or execute draft source",
-    description: 'Execute a published script or workflow with target, or test unpublished code directly with source and language (ts for TypeScript, yaml for workflow YAML), without first saving or publishing a definition. Minimal script: `export default async ({ file_id }: { file_id: string }) => { const result = await call("ocr", { document: { type: "file", file_id } }); return result; }`; send it as source with language="ts", input={"file_id":"<uploaded file ID>"} and wait=0, using a PDF or image already uploaded to your account. To call a platform API directly in the same script, use the praxis SDK object, for example `praxis.model.ocr.create({ body: { model: "glm-ocr", document: { type: "file", file_id } } })`; Action IDs are strings passed to call(), not SDK methods such as praxis.ocr(...). praxis, call, invoke, console and codemode are module-scope bindings, not on globalThis, and need no import; invoke("namespace/name", input) starts a child run. target and source are mutually exclusive; target accepts ns/name@version, @tag or @range and defaults to latest when @ is omitted. Source/input validation precedes run creation, so a separate validate call is optional. input defaults to {} and must match the input schema and fit within 1 MiB. wait is 0–60 seconds (default 0): a terminal run returns 200, otherwise 202. Use the returned id with praxis.automation.runs.retrieve and inspect status, output and error; acceptance does not mean successful completion. For long-running, background or batch work, use wait: 0 and poll the run, or split work into child runs or a workflow; wait only controls the response wait and does not extend execution limits. Actions time out after 30 s (run-sandbox after 10 min); scripts have a 5 min wall-clock limit and a 30 s CPU limit; workflows default to 24 h and allow up to 7 days. Each run can start at most 100 child runs, with at most 20 active at once; nesting depth is limited to 10. Idempotency-Key is scoped to tenant, method and path for 24 hours, excluding wait from the fingerprint; replay returns the current run with Idempotent-Replayed: true, changed contents return 422 and an in-flight request returns 409. With language=yaml, source is a workflow YAML: the run input is . in the first step, and the shape is described in create workflow. Error details are in errors[] (pointer, detail, hint). New non-deterministic run IDs contain 78 characters, compared with 46 for legacy random IDs; treat IDs as opaque strings. Historical and deterministic IDs remain valid; same-millisecond order is not guaranteed.',
+    description: 'Execute a published script or workflow with target, or test unpublished code directly with source and language (ts for TypeScript, yaml for workflow YAML), without first saving or publishing a definition. Minimal script: `export default async ({ file_id }: { file_id: string }) => { const result = await call("ocr", { document: { type: "file", file_id } }); return result; }`; send it as source with language="ts", input={"file_id":"<uploaded file ID>"} and wait=0, using a PDF or image already uploaded to your account. To call a platform API directly in the same script, use the praxis SDK object, for example `praxis.model.ocr.create({ body: { model: "glm-ocr", document: { type: "file", file_id } } })`; Action IDs are strings passed to call(), not SDK methods such as praxis.ocr(...). praxis, call, invoke, console and codemode are module-scope bindings, not on globalThis, and need no import; invoke("namespace/name", input) starts a child run. target and source are mutually exclusive; target accepts ns/name@version, @tag or @range and defaults to latest when @ is omitted. Source/input validation precedes run creation, so a separate validate call is optional. input defaults to {} and must match the input schema and fit within 1 MiB. wait is 0–60 seconds (default 0): a terminal run returns 200, otherwise 202. Use the returned id with praxis.automation.runs.retrieve and inspect status, output and error; acceptance does not mean successful completion. For long-running, background or batch work, use wait: 0 and poll the run, or split work into child runs or a workflow; wait only controls the response wait and does not extend execution limits. Actions time out after 30 s (run-sandbox after 10 min); scripts have a 5 min wall-clock limit and a 30 s CPU limit; workflows default to 24 h and allow up to 30 days. Each run can start at most 100 child runs, with at most 20 active at once; nesting depth is limited to 10. Idempotency-Key is scoped to tenant, method and path for 24 hours, excluding wait from the fingerprint; replay returns the current run with Idempotent-Replayed: true, changed contents return 422 and an in-flight request returns 409. With language=yaml, source is a workflow YAML: the run input is . in the first step, and the shape is described in create workflow. Error details are in errors[] (pointer, detail, hint). New non-deterministic run IDs contain 78 characters, compared with 46 for legacy random IDs; treat IDs as opaque strings. Historical and deterministic IDs remain valid; same-millisecond order is not guaranteed.',
     http: "POST",
     path: "/automation/v1/runs",
     streaming: "no",
@@ -6239,7 +6410,7 @@ file at the root of that directory.`
     resource: "automation.workflows",
     method: "create",
     summary: "Create a workflow",
-    description: 'Save a YAML workflow as an editable draft; this does not validate, publish or run it, so check it with validate (kind=workflow) first. Minimal draft: document with dsl ("1.0.3"), namespace, name and version, plus a do list of steps, for example document: {dsl: "1.0.3", namespace: demo, name: add, version: "1.0.0"} and do: [{first: {call: demo/add-one, with: {n: "${ .n }"}}}]. call: <ns/name> calls an Action directly (bare name for built-ins such as ocr) and with is the Action input; the input contract is at current_revision.input_schema in the get-action response. run: starts a saved script or child workflow. The run input is . in the first step, and expressions are jq written as a whole ${ ... } string. Limits: Action 30 s (run-sandbox 10 min), workflow 24 h by default and 7 days at most, payload 1 MiB. Test the draft by sending its source and language=yaml to praxis.automation.runs.create. Guide: /docs/developers/automation/guides/write-workflow. Error details are in the errors[] of the response (pointer, detail, hint). Choose your own namespace without registering it first; praxis is reserved for built-in Actions. Scripts and workflows share names within the tenant; a duplicate returns NAME_TAKEN. run.workflow accepts ns/name@range or {namespace, name, version, input}; run.script uses the same reference shape as a platform extension. Object namespace, name and version are required; version accepts an exact version, dist-tag or range, locked at publication. Object input defaults to {} and supports expressions; string references retain task-level with. run.await defaults to true and returns the child output. With false, the child uses detach and the task immediately returns {run_id}; parent cancellation does not cascade. Inline script.code returns DEFINITION_INVALID with a detail asking you to save a script and reference it first. raise.error retains its type URI, status, title and detail in the run error.',
+    description: 'Save a YAML workflow as an editable draft; this does not validate, publish or run it, so check it with validate (kind=workflow) first. Minimal draft: document with dsl ("1.0.3"), namespace, name and version, plus a do list of steps, for example document: {dsl: "1.0.3", namespace: demo, name: add, version: "1.0.0"} and do: [{first: {call: demo/add-one, with: {n: "${ .n }"}}}]. call: <ns/name> calls an Action directly (bare name for built-ins such as ocr) and with is the Action input; the input contract is at current_revision.input_schema in the get-action response. run: starts a saved script or child workflow. The run input is . in the first step, and expressions are jq written as a whole ${ ... } string. Limits: Action 30 s (run-sandbox 10 min), workflow 24 h by default and 30 days at most, payload 1 MiB. Test the draft by sending its source and language=yaml to praxis.automation.runs.create. Guide: /docs/developers/automation/guides/write-workflow. Error details are in the errors[] of the response (pointer, detail, hint). Choose your own namespace without registering it first; praxis is reserved for built-in Actions. Scripts and workflows share names within the tenant; a duplicate returns NAME_TAKEN. run.workflow accepts ns/name@range or {namespace, name, version, input}; run.script uses the same reference shape as a platform extension. Object namespace, name and version are required; version accepts an exact version, dist-tag or range, locked at publication. Object input defaults to {} and supports expressions; string references retain task-level with. run.await defaults to true and returns the child output. With false, the child uses detach and the task immediately returns {run_id}; parent cancellation does not cascade. Inline script.code returns DEFINITION_INVALID with a detail asking you to save a script and reference it first. raise.error retains its type URI, status, title and detail in the run error.',
     http: "POST",
     path: "/automation/v1/workflows",
     streaming: "no",
@@ -8234,7 +8405,7 @@ The default is return=minimal: success returns HTTP 201 with an empty body. Send
     resource: "file.files",
     method: "create",
     summary: "Upload file",
-    description: 'Upload a file to reuse in conversations or attach to a knowledge base. Unlike OpenAI Files, uploads must be nonempty and at most 100000000 bytes, and only user_data, assistants and vision purposes are accepted. Send file bytes as a multipart file part, not a filename or file ID; in the SDK use a File or Blob, for example new File(["Return within 23 days."], "policy.txt", { type: "text/plain" }). Content determines the MIME type. Supported uploads include PDF, DOCX/XLSX/PPTX, PNG/JPEG/GIF/WebP, MP3/WAV/FLAC/OGG/M4A, MP4/WebM, and UTF-8 JSON/NDJSON/CSV/Markdown/plain text; empty, unsupported, oversized files and unsupported purposes return 400. Use Uploads for larger files. The purpose vision accepts only PNG, JPEG, GIF and WebP, while conversation images require user_data. The returned ID belongs to your tenant; upload alone does not ingest the file into Knowledge. Knowledge attachment has a lower limit of 100000000 bytes. Optionally set expires_after[anchor]=created_at with expires_after[seconds] (3600–2592000), or praxis[expires_in_seconds] (3600–7776000), never both. Without expiry, the file persists until deleted.',
+    description: 'Upload a file to reuse in conversations or attach to a knowledge base. Unlike OpenAI Files, uploads must be nonempty and at most 100000000 bytes, and only user_data and vision purposes are accepted. Send file bytes as a multipart file part, not a filename or file ID; in the SDK use a File or Blob, for example new File(["Return within 23 days."], "policy.txt", { type: "text/plain" }). Content determines the MIME type. Supported uploads include PDF, DOCX/XLSX/PPTX, PNG/JPEG/GIF/WebP, MP3/WAV/FLAC/OGG/M4A, MP4/WebM, and UTF-8 JSON/NDJSON/CSV/Markdown/plain text; empty, unsupported, oversized files and unsupported purposes return 400. Use Uploads for larger files. The purpose vision accepts only PNG, JPEG, GIF and WebP, while conversation images require user_data. The returned ID belongs to your tenant; upload alone does not ingest the file into Knowledge. Knowledge attachment has a lower limit of 100000000 bytes. Optionally set expires_after[anchor]=created_at with expires_after[seconds] (3600–7776000). Without expiry, the file persists until deleted.',
     http: "POST",
     path: "/file/v1/files",
     streaming: "no",
@@ -8256,23 +8427,16 @@ The default is return=minimal: success returns HTTP 201 with an empty body. Send
           type: "string",
           enum: [
             "user_data",
-            "assistants",
             "vision"
           ],
           required: true,
-          description: "Purpose label stored with the file: user_data, assistants or vision. The vision purpose accepts only PNG, JPEG, GIF and WebP images. Conversation image references require user_data."
+          description: "Purpose label stored with the file: user_data or vision. The vision purpose accepts only PNG, JPEG, GIF and WebP images. Conversation image references require user_data."
         },
         {
           name: "expires_after",
           type: "object",
           required: false,
           description: "Optional expiry relative to created_at. Files without an expiry persist until deleted."
-        },
-        {
-          name: "praxis",
-          type: "object",
-          required: false,
-          description: "Own-face extensions. Use at most one expiry setting."
         }
       ]
     }
@@ -8335,7 +8499,7 @@ The default is return=minimal: success returns HTTP 201 with an empty body. Send
     resource: "file.uploads",
     method: "create",
     summary: "Create an upload",
-    description: "Start a multipart upload for a file larger than the 100000000-byte direct-upload limit. Supply the exact byte length, filename, MIME type and purpose. Unlike OpenAI, uploads accept at most 2 GiB (2147483648 bytes) and only user_data, assistants and vision purposes. Add parts of at most 64000000 bytes and complete within one hour. Optional part_size enables fixed-size, retryable parts. expires_after applies to the resulting file (3600–7776000 seconds on this own face); without it the file persists until deleted.",
+    description: "Start a multipart upload for a file larger than the 100000000-byte direct-upload limit. Supply the exact byte length, filename, MIME type and purpose. Unlike OpenAI, uploads accept at most 2 GiB (2147483648 bytes) and only user_data and vision purposes. Add parts of at most 64000000 bytes and complete within one hour. Optional part_size enables fixed-size, retryable parts. expires_after applies to the resulting file (3600–7776000 seconds on this own face); without it the file persists until deleted.",
     http: "POST",
     path: "/file/v1/uploads",
     streaming: "no",
@@ -8368,11 +8532,10 @@ The default is return=minimal: success returns HTTP 201 with an empty body. Send
           type: "string",
           enum: [
             "user_data",
-            "assistants",
             "vision"
           ],
           required: true,
-          description: "Use user_data for conversation attachments, assistants for assistant files, or vision for PNG, JPEG, GIF and WebP images."
+          description: "Use user_data for conversation attachments, or vision for PNG, JPEG, GIF and WebP images."
         },
         {
           name: "expires_after",
@@ -9552,7 +9715,7 @@ The default is return=minimal: success returns HTTP 201 with an empty body. Send
           name: "overwrite",
           type: "boolean",
           required: false,
-          description: "Allow replacing an existing public_id, preserving its asset_id and increasing its version. False returns the existing resource without replacing it; defaults to true."
+          description: "Allow replacing an existing public_id, preserving its asset_id and increasing its version. Only the latest version is deliverable; old version URLs return 404. Create a new public_id to retain old deliveries. False returns the existing resource without replacing it; defaults to true."
         },
         {
           name: "tags",
@@ -9611,7 +9774,7 @@ The default is return=minimal: success returns HTTP 201 with an empty body. Send
           name: "file_id",
           type: "string",
           required: true,
-          description: "File ID to copy into this library; passed as the upload source instead of file bytes."
+          description: "File ID to copy into this library; passed as the upload source instead of file bytes. This creates an independent public copy readable without authentication. Deleting the source File does not delete this asset; do not import confidential content."
         },
         {
           name: "public_id",
@@ -9665,7 +9828,7 @@ The default is return=minimal: success returns HTTP 201 with an empty body. Send
           name: "overwrite",
           type: "boolean",
           required: false,
-          description: "Allow replacing an existing public_id, preserving its asset_id and increasing its version. False returns the existing resource without replacing it; defaults to true."
+          description: "Allow replacing an existing public_id, preserving its asset_id and increasing its version. Only the latest version is deliverable; old version URLs return 404. Create a new public_id to retain old deliveries. False returns the existing resource without replacing it; defaults to true."
         },
         {
           name: "tags",
@@ -10182,7 +10345,7 @@ The default is return=minimal: success returns HTTP 201 with an empty body. Send
           name: "expression",
           type: "string",
           required: false,
-          description: "Asset filter expression supporting field comparisons, AND, OR, NOT, parentheses and suffix wildcards. An empty expression matches all assets."
+          description: 'Asset filter expression supporting field comparisons, AND, OR, NOT, parentheses and suffix wildcards. An empty expression matches all assets. For business metadata use context.sku=KETTLE-RED AND context.revision=2; request with_field: ["context"] to include context.'
         },
         {
           name: "sort_by",
@@ -21707,6 +21870,84 @@ var automationHooksReceive = (options) => (options.client ?? client).post({
     ...options.headers
   }
 });
+var automationHumanTasksList = (options) => (options?.client ?? client).get({
+  querySerializer: { parameters: { status: { array: { explode: false } } } },
+  security: [{
+    key: "BearerAuth",
+    scheme: "bearer",
+    type: "http"
+  }, {
+    key: "ApiKeyAuth",
+    name: "X-API-Key",
+    type: "apiKey"
+  }],
+  url: "/automation/v1/human-tasks",
+  ...options
+});
+var automationHumanTasksGet = (options) => (options.client ?? client).get({
+  security: [{
+    key: "BearerAuth",
+    scheme: "bearer",
+    type: "http"
+  }, {
+    key: "ApiKeyAuth",
+    name: "X-API-Key",
+    type: "apiKey"
+  }],
+  url: "/automation/v1/human-tasks/{id}",
+  ...options
+});
+var automationHumanTasksRespond = (options) => (options.client ?? client).post({
+  security: [{
+    key: "BearerAuth",
+    scheme: "bearer",
+    type: "http"
+  }, {
+    key: "ApiKeyAuth",
+    name: "X-API-Key",
+    type: "apiKey"
+  }],
+  url: "/automation/v1/human-tasks/{id}/respond",
+  ...options,
+  headers: {
+    "Content-Type": "application/json",
+    ...options.headers
+  }
+});
+var automationHumanTasksCancel = (options) => (options.client ?? client).post({
+  security: [{
+    key: "BearerAuth",
+    scheme: "bearer",
+    type: "http"
+  }, {
+    key: "ApiKeyAuth",
+    name: "X-API-Key",
+    type: "apiKey"
+  }],
+  url: "/automation/v1/human-tasks/{id}/cancel",
+  ...options,
+  headers: {
+    "Content-Type": "application/json",
+    ...options.headers
+  }
+});
+var automationHumanTasksDelegate = (options) => (options.client ?? client).post({
+  security: [{
+    key: "BearerAuth",
+    scheme: "bearer",
+    type: "http"
+  }, {
+    key: "ApiKeyAuth",
+    name: "X-API-Key",
+    type: "apiKey"
+  }],
+  url: "/automation/v1/human-tasks/{id}/delegate",
+  ...options,
+  headers: {
+    "Content-Type": "application/json",
+    ...options.headers
+  }
+});
 var databaseListDatabases = (options) => (options?.client ?? client).get({
   security: [{
     key: "database-bearerAuth",
@@ -24177,6 +24418,13 @@ function createAutomation(transport) {
     hooks: {
       send: bind(transport, automationHooksReceive)
     },
+    humanTasks: {
+      cancel: bind(transport, automationHumanTasksCancel),
+      delegate: bind(transport, automationHumanTasksDelegate),
+      list: bindPage(transport, automationHumanTasksList),
+      respond: bind(transport, automationHumanTasksRespond),
+      retrieve: bind(transport, automationHumanTasksGet)
+    },
     resolve: {
       retrieve: bind(transport, automationResolveResolve)
     },
@@ -26430,8 +26678,9 @@ function jwtFetch(fetchImpl, token) {
 function credentials(config, vars, ports) {
   const path = ports.path ?? tokenPath(config.env);
   const store = ports.store ?? createTokenStore(config.env, path, ports.secretStore);
+  const source = credentialSource(vars);
   const apiKey = vars.PRAXIS_API_KEY;
-  const machineToken = credentialSource(vars) === "machine-token" ? vars.PRAXIS_API_TOKEN : undefined;
+  const machineToken = source === "machine-token" ? vars.PRAXIS_API_TOKEN : undefined;
   const remember = ports.remember ?? (() => {});
   if (apiKey)
     remember(apiKey);
@@ -26493,6 +26742,7 @@ function credentials(config, vars, ports) {
     }
   }
   return {
+    source,
     get,
     requireLogin,
     async client(org) {
@@ -26548,13 +26798,13 @@ function skillDocument(commands) {
     "## General rules",
     "",
     "- Select the environment only with `PRAXIS_ENV`; there is no `--env` option. The dev package defaults to develop.",
-    "- Authenticate with `PRAXIS_API_KEY`, `PRAXIS_API_TOKEN` (a machine token, sent in the Authorization header; computers have it set) or `praxis login`, in that order. API keys and machine tokens determine the organization; login sessions can use `--org <organization_id>`. `PRAXIS_API_URL` overrides the API base and must be an https deepraxis.com URL.",
+    "- Authenticate with `PRAXIS_API_KEY`, `PRAXIS_API_TOKEN` (a machine token, sent in the Authorization header; computers have it set) or `praxis login`, in that order. Login saves the session even when an environment credential takes precedence; unset the named variable in its warning to use the saved login. API keys and machine tokens determine the organization; login sessions can use `--org <organization_id>`. `PRAXIS_API_URL` overrides the API base and must be an https deepraxis.com URL.",
     "- AI mode is enabled automatically in supported agent environments. Use `--format agent` to select it explicitly.",
     "- Use `--json` for the complete JSON response without presentation truncation. Successful JSON output goes to stdout; errors go to stderr.",
     "- Supply bodies with `--data JSON`, `--data @file.json`, or `--data -` for stdin. Scalar field options override matching JSON fields. Structured fields require `--data`.",
     "- Deletion requires `--yes` in AI mode. Confirm the intended resource before using it.",
     "- Use `--limit N` to limit a server page for SDK-paginated commands. Other lists apply it only to displayed rows; `--param-limit` still sends the API parameter when available. `--all` follows supported pagination and cannot be combined with `--limit`.",
-    "- Error JSON has an `error` object: `code` identifies the failure, `message` describes it, `hint` suggests recovery, `env` identifies the environment, `command` identifies the command, `status` is the HTTP status, and `request_id` correlates diagnostics. Unavailable fields are null. Exit codes: 0 success, 1 runtime/API error, 2 usage error.",
+    "- Error JSON has an `error` object: `code` identifies the failure, `message` describes it, `hint` suggests recovery, `env` identifies the environment, `command` identifies the command, `status` is the HTTP status, and `request_id` correlates diagnostics. Authentication failures also include `credential_source` (api-key, machine-token, or login); follow the source-specific hint. Unavailable fields are null. Exit codes: 0 success, 1 runtime/API error, 2 usage error.",
     "- Append `--help` to a command for its optional parameters. Required scalar body options below can also be supplied as fields in `--data`.",
     "- Two layers: top-level commands (`login`, `org`, `skill`, …) are workflows and session commands; every API operation is under `praxis api <domain> …`. `praxis api <METHOD> <path>` sends a raw request (the method is uppercase).",
     "",
@@ -26685,7 +26935,12 @@ Enter code: ${code.user_code}` });
   const location = await (ports.store ?? createTokenStore(config.env, path)).save(toStored(flow.tokens, ports.now()));
   if (location !== "keychain")
     ports.emit({ kind: "message", channel: "stderr", text: "stored in a file (no system keychain available)" });
+  const shadowedBy = ports.source === "api-key" ? "PRAXIS_API_KEY" : ports.source === "machine-token" ? "PRAXIS_API_TOKEN" : undefined;
   ports.emit({ kind: "message", text: `Logged in (${config.env}).` });
+  if (shadowedBy)
+    ports.emit({ kind: "message", channel: "stderr", text: `Note: ${shadowedBy} is set and takes precedence over this login. Unset it (unset ${shadowedBy}) to use the login.` });
+  if (ports.json)
+    ports.emit({ kind: "object", data: { env: config.env, ...shadowedBy ? { shadowed_by: shadowedBy } : {} } });
 }
 async function whoami(auth, env, org) {
   const credential = await auth.get(org);
@@ -27487,7 +27742,7 @@ ${usage ? `usage: ${JSON.stringify(usage)}
 
 // src/output/render.ts
 function errorJSON(result, ctx) {
-  return JSON.stringify({ error: { code: result.code, message: result.message, hint: result.hint ?? null, env: result.env, command: ctx.command ?? null, status: result.status ?? null, request_id: result.request_id ?? null } }) + `
+  return JSON.stringify({ error: { code: result.code, message: result.message, hint: result.hint ?? null, env: result.env, command: ctx.command ?? null, status: result.status ?? null, request_id: result.request_id ?? null, ...result.credential_source ? { credential_source: result.credential_source } : {} } }) + `
 `;
 }
 function render(result, ctx) {
@@ -27628,6 +27883,16 @@ var humanize = (code) => {
   const words = code.toLowerCase().split("_").filter(Boolean).join(" ");
   return words.charAt(0).toUpperCase() + words.slice(1);
 };
+function authHint(source) {
+  switch (source) {
+    case "api-key":
+      return "The API key from PRAXIS_API_KEY was rejected; check or replace it, or unset it to use `praxis login`.";
+    case "machine-token":
+      return "The machine token from PRAXIS_API_TOKEN was rejected (it may have expired); unset it to use `praxis login`, or refresh it.";
+    case "login":
+      return "Run `praxis login` or set PRAXIS_API_KEY.";
+  }
+}
 function errorInput(error, ctx) {
   const sdk = error instanceof PraxisError ? error : undefined;
   const raw = record(sdk?.raw), nested = record(raw.error);
@@ -27642,11 +27907,13 @@ function errorInput(error, ctx) {
   if (stripped)
     message = `${humanize(code)}${message ? `: ${message}` : ""}`;
   const status = sdk?.status, request_id = sdk?.requestId;
+  const authFailure = status === 401 || ["NOT_LOGGED_IN", "UNAUTHENTICATED", "TOKEN_REVOKED", "LOGIN_FAILED"].includes(code);
+  const source = ctx.credentialSource ?? "login";
   let hint = genericHint;
   if (error instanceof UsageError)
     hint = error.hint;
-  else if (status === 401 || ["NOT_LOGGED_IN", "UNAUTHENTICATED", "TOKEN_REVOKED", "LOGIN_FAILED"].includes(code))
-    hint = "Run `praxis login` or set PRAXIS_API_KEY.";
+  else if (authFailure)
+    hint = authHint(source);
   else if (status === 404)
     hint = ctx.listCommand ? `Check the id; list existing ones with \`${ctx.listCommand}\`` : "Check the id.";
   else if (status === 403)
@@ -27655,7 +27922,7 @@ function errorInput(error, ctx) {
     hint = "Rate limited; retry later.";
   else if (status !== undefined && status >= 500)
     hint = `Server error; retry later.${request_id ? ` Request id: ${request_id}.` : ""}`;
-  return { kind: "error", code, message, hint, env: ctx.env, ...status !== undefined ? { status } : {}, ...request_id ? { request_id } : {} };
+  return { kind: "error", code, message, hint, env: ctx.env, ...authFailure ? { credential_source: source } : {}, ...status !== undefined ? { status } : {}, ...request_id ? { request_id } : {} };
 }
 
 // src/output/progress.ts
@@ -27685,7 +27952,7 @@ function startProgress(ctx, write = (text) => writeOutput({ stderr: text })) {
 }
 
 // src/main.ts
-var version = "0.2.0-dev.4c0c1e3";
+var version = "0.2.0-dev.a538fab";
 var commands = commandTree(operations);
 var manual = [...workflows.map((w) => w.words), [API_WORD]];
 function route(argv) {
@@ -27880,6 +28147,7 @@ Examples:
     const auth = credentials(config, ports.env, { fetch: wireFetch, now: ports.now, path, store, remember: (s) => {
       secrets.push(s);
     } });
+    ctx.credentialSource = auth.source;
     const org = flags.org;
     const confirm = (method) => confirmOperation(method, { yes: Boolean(flags.yes), noInput: Boolean(flags["no-input"]) || ctx.mode === "agent", stdinIsTTY: ports.stdinIsTTY, ask: async () => {
       stopProgress();
@@ -27946,7 +28214,8 @@ Examples:
       case "login":
         if (flags["no-input"] || quiet)
           throw new UsageError("login requires displaying a device code", "Remove --no-input / --quiet or set PRAXIS_API_KEY for scripts.");
-        await login(config, path, { ...ports, store, fetch: wireFetch, emit, remember: (s) => secrets.push(s) });
+        ctx.credentialSource = "login";
+        await login(config, path, { ...ports, source: auth.source, json: ctx.mode === "json", store, fetch: wireFetch, emit, remember: (s) => secrets.push(s) });
         break;
       case "logout":
         emit({ kind: "message", text: await store.delete() ? "Logged out." : "Not logged in." });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@deepraxis/cli",
-  "version": "0.2.0-dev.4c0c1e3",
+  "version": "0.2.0-dev.a538fab",
   "type": "module",
   "bin": {
     "praxis": "dist/praxis.js"