@oxygen-agent/cli 1.162.10 → 1.177.0

package/dist/run-wait.d.ts

@@ -0,0 +1,23 @@
+export interface CliRunWaitConfig {
+    /** Run id echoed into the timeout error details. */
+    runId: string;
+    /** Raw --timeout-seconds flag; falls back to defaultTimeoutSeconds when unset. */
+    requestedTimeoutSeconds?: string | undefined;
+    /** Raw --interval-seconds flag; falls back to defaultIntervalSeconds when unset. */
+    requestedIntervalSeconds?: string | undefined;
+    defaultTimeoutSeconds: number;
+    defaultIntervalSeconds: number;
+    /** Fetches the latest run snapshot to inspect this poll. */
+    fetchRun: () => Promise<Record<string, unknown>>;
+    /** True when the run status is terminal for this resource. */
+    isTerminal: (status: string | null) => boolean;
+    /** Builds the response once a terminal status is observed. */
+    shapeTerminal: (run: Record<string, unknown>, status: string | null, polls: number, elapsedMs: number) => Record<string, unknown>;
+    /** OxygenError shape thrown when the deadline passes before a terminal status. */
+    timeoutCode: string;
+    timeoutMessage: string;
+    timeoutDetailIdKey: string;
+    /** Optional extra timeout details (e.g. workflow queued-no-worker guidance). */
+    timeoutExtraDetails?: (latestRun: Record<string, unknown> | null, status: string | null) => Record<string, unknown>;
+}
+export declare function waitForCliRun(config: CliRunWaitConfig): Promise<Record<string, unknown>>;

package/dist/run-wait.js

@@ -0,0 +1,57 @@
+import { OxygenError } from "@oxygen/shared";
+export async function waitForCliRun(config) {
+    const timeoutSeconds = readPositiveInt(config.requestedTimeoutSeconds)
+        ?? config.defaultTimeoutSeconds;
+    const intervalSeconds = readPositiveInt(config.requestedIntervalSeconds)
+        ?? config.defaultIntervalSeconds;
+    const startedAt = Date.now();
+    const deadline = startedAt + timeoutSeconds * 1000;
+    let polls = 0;
+    while (true) {
+        polls += 1;
+        const latestRun = await config.fetchRun();
+        const status = readRecordString(latestRun, "status");
+        if (config.isTerminal(status)) {
+            return config.shapeTerminal(latestRun, status, polls, Date.now() - startedAt);
+        }
+        const remainingMs = deadline - Date.now();
+        if (remainingMs <= 0) {
+            throw new OxygenError(config.timeoutCode, config.timeoutMessage, {
+                details: {
+                    [config.timeoutDetailIdKey]: config.runId,
+                    status: status ?? null,
+                    timeout_seconds: timeoutSeconds,
+                    polls,
+                    ...(config.timeoutExtraDetails?.(latestRun, status) ?? {}),
+                },
+                exitCode: 1,
+            });
+        }
+        await sleep(Math.min(intervalSeconds * 1000, remainingMs));
+    }
+}
+// Local copies of index.ts's tiny readers keep this helper free of an
+// index.ts <-> run-wait.ts import cycle (the MCP run-wait.ts module likewise
+// defines its own sleep rather than importing from a tool file).
+function readPositiveInt(value) {
+    const trimmed = value?.trim();
+    if (!trimmed)
+        return undefined;
+    const parsed = Number(trimmed);
+    if (!Number.isInteger(parsed) || parsed < 1) {
+        throw new OxygenError("invalid_number", "Expected a positive integer.", {
+            details: { value },
+            exitCode: 1,
+        });
+    }
+    return parsed;
+}
+function readRecordString(value, key) {
+    if (!value || typeof value !== "object" || Array.isArray(value))
+        return null;
+    const entry = value[key];
+    return typeof entry === "string" ? entry : null;
+}
+function sleep(ms) {
+    return new Promise((resolve) => setTimeout(resolve, ms));
+}

package/node_modules/@oxygen/recipe-sdk/dist/index.d.ts

@@ -105,7 +105,6 @@ export type RecipeContext = {
 };
 export type DurableRecipeContext = RecipeContext;
 export type RecipeRunFunction = (ctx: RecipeContext) => unknown | Promise<unknown>;
-export type DurableRecipeRunFunction = RecipeRunFunction;
 export type RecipeVisualBaseStep = {
     id: string;
     label: string;
@@ -155,10 +154,6 @@ export type DefineRecipeInput = {
     visualPlan?: RecipeVisualPlan;
     run: RecipeRunFunction;
 };
-export type DurableRecipeDefinition = RecipeDefinition;
-export type DefineDurableRecipeInput = DefineRecipeInput & {
-    runtime: "durable";
-};
 export declare function defineRecipe(input: DefineRecipeInput): RecipeDefinition;
 export declare function isRecipeDefinition(value: unknown): value is RecipeDefinition;
 export declare function recipeVisualPlan(steps: RecipeVisualStep[]): RecipeVisualPlan;

package/node_modules/@oxygen/shared/dist/cell-format.d.ts

@@ -11,7 +11,8 @@
  *     and provider adapters, so a `text` column whose values parse cleanly as
  *     numbers still gets thousands grouping at display time.
  *  3. Refuse to "rescue" things that aren't actually numbers (IP addresses,
- *     version strings, phone numbers, URLs), via {@link looksLikeNumericText}.
+ *     version strings, phone numbers, URLs): {@link rescueNumericText} returns
+ *     null for those.
  */
 /** Surfaces have different escaping/length budgets, but the canonical string is shared. */
 export type CellFormatSurface = "cli" | "mcp" | "web";
@@ -38,19 +39,6 @@ export type CellFormatOptions = {
  * escaping, ellipsis budgets) belong outside this function.
  */
 export declare function formatCellForDisplay(value: unknown, column: CellColumnLike | null | undefined, options: CellFormatOptions): string;
-/**
- * Best-effort parse of a string that looks numeric (with or without thousands
- * grouping, with or without dotted IP-style separators) into a finite number.
- * Returns `null` when the string is clearly *not* a single number — IP
- * addresses, version strings, phone numbers, anything alphabetic.
- */
-export declare function rescueNumericText(raw: string): number | null;
-/**
- * True when a string is unambiguously numeric (integer, decimal, grouped, or
- * a mangled dotted form we can recover). Exported for callers that want to
- * highlight rescue cases without re-running the formatter.
- */
-export declare function looksLikeNumericText(value: string): boolean;
 /**
  * Decide whether the same value-level + column-level guards used inside
  * `formatCellForDisplay`'s text path should rescue this string. Exposed so

package/node_modules/@oxygen/shared/dist/cell-format.js

@@ -11,7 +11,8 @@
  *     and provider adapters, so a `text` column whose values parse cleanly as
  *     numbers still gets thousands grouping at display time.
  *  3. Refuse to "rescue" things that aren't actually numbers (IP addresses,
- *     version strings, phone numbers, URLs), via {@link looksLikeNumericText}.
+ *     version strings, phone numbers, URLs): {@link rescueNumericText} returns
+ *     null for those.
  */
 const DEFAULT_LOCALE = "en-US";
 const INTEGER_RE = /^-?\d{1,15}$/;
@@ -99,7 +100,7 @@ export function formatCellForDisplay(value, column, options) {
  * Returns `null` when the string is clearly *not* a single number — IP
  * addresses, version strings, phone numbers, anything alphabetic.
  */
-export function rescueNumericText(raw) {
+function rescueNumericText(raw) {
     const trimmed = raw.trim();
     if (!trimmed)
         return null;
@@ -168,14 +169,6 @@ function decodeDottedNumeric(raw) {
     const n = Number(normalized || "0");
     return Number.isFinite(n) ? sign * n : null;
 }
-/**
- * True when a string is unambiguously numeric (integer, decimal, grouped, or
- * a mangled dotted form we can recover). Exported for callers that want to
- * highlight rescue cases without re-running the formatter.
- */
-export function looksLikeNumericText(value) {
-    return rescueNumericText(value) !== null;
-}
 function readDataType(column) {
     const raw = column?.dataType ?? column?.data_type ?? null;
     if (!raw)

package/node_modules/@oxygen/shared/dist/cli-envelope.d.ts

@@ -0,0 +1,27 @@
+import type { CliResult } from "./cli-result.js";
+/** Server compatibility metadata extracted from a `CliResult.meta` envelope. */
+export type ServerCompatibility = {
+    version?: string;
+    minimumCliVersion?: string;
+};
+/**
+ * Type guard for the shared `CliResult` envelope. Accepts `{ ok: true, data }`
+ * and `{ ok: false, error: {...} }`; rejects anything else (non-objects,
+ * arrays, missing discriminant, malformed error).
+ */
+export declare function isCliResult<T>(value: unknown): value is CliResult<T>;
+/**
+ * Read the server version and minimum-CLI floor out of a `CliResult.meta`
+ * block. Missing or malformed metadata yields an empty object so callers can
+ * treat "no compatibility info" uniformly.
+ */
+export declare function readEnvelopeCompatibility(envelope: CliResult<unknown>): ServerCompatibility;
+export declare function withRetryAfterDetails(details: unknown, response: Response): unknown;
+/**
+ * Header fragment that lets automated clients reach a password-protected Vercel
+ * preview deployment. Returns `{ "x-vercel-protection-bypass": <secret> }` only
+ * when `VERCEL_AUTOMATION_BYPASS_SECRET` is set and the API URL targets a
+ * `*.vercel.app` host; otherwise an empty object. Callers spread the result
+ * into their request headers, so a non-preview URL is a no-op.
+ */
+export declare function vercelProtectionBypassHeaders(apiUrl: string): Record<string, string>;

package/node_modules/@oxygen/shared/dist/cli-envelope.js

@@ -0,0 +1,102 @@
+// Shared mechanics for the Oxygen CLI-result envelope that both the CLI HTTP
+// client (`packages/cli/src/http-client.ts`) and the MCP API client
+// (`packages/mcp-server/src/api-client.ts`) consume. These are pure functions —
+// no runtime imports from runtime-specific modules — so each client keeps its
+// own error class (`OxygenError` vs `OxygenApiError`) and surface-specific
+// guidance while sharing the parsing/extraction logic that previously drifted
+// after being copy-pasted between the two clients.
+/**
+ * Type guard for the shared `CliResult` envelope. Accepts `{ ok: true, data }`
+ * and `{ ok: false, error: {...} }`; rejects anything else (non-objects,
+ * arrays, missing discriminant, malformed error).
+ */
+export function isCliResult(value) {
+    if (!value || typeof value !== "object" || Array.isArray(value))
+        return false;
+    const ok = value.ok;
+    if (ok === true)
+        return "data" in value;
+    if (ok !== false)
+        return false;
+    const error = value.error;
+    return Boolean(error) && typeof error === "object" && !Array.isArray(error);
+}
+/**
+ * Read the server version and minimum-CLI floor out of a `CliResult.meta`
+ * block. Missing or malformed metadata yields an empty object so callers can
+ * treat "no compatibility info" uniformly.
+ */
+export function readEnvelopeCompatibility(envelope) {
+    const meta = envelope.meta;
+    if (!meta || typeof meta !== "object" || Array.isArray(meta))
+        return {};
+    const record = meta;
+    const compatibility = {};
+    if (typeof record.version === "string")
+        compatibility.version = record.version;
+    if (typeof record.minimum_cli_version === "string") {
+        compatibility.minimumCliVersion = record.minimum_cli_version;
+    }
+    return compatibility;
+}
+// Surface the server's 429 backoff as a first-class `retry_after_seconds` detail
+// so loop-driving callers can wait the right amount of time instead of dead-
+// reckoning. Prefers a value the API already put in details; otherwise derives
+// it from the RFC 6585 Retry-After header (or reset_at). Non-429 responses and
+// unparseable values pass through untouched.
+export function withRetryAfterDetails(details, response) {
+    if (response.status !== 429)
+        return details;
+    const record = details && typeof details === "object" && !Array.isArray(details)
+        ? details
+        : null;
+    if (record && typeof record.retry_after_seconds === "number")
+        return details;
+    const retryAfterSeconds = retryAfterSecondsFromResponse(response, record);
+    if (retryAfterSeconds === null)
+        return details;
+    if (record)
+        return { ...record, retry_after_seconds: retryAfterSeconds };
+    if (details === undefined)
+        return { retry_after_seconds: retryAfterSeconds };
+    return { details, retry_after_seconds: retryAfterSeconds };
+}
+function retryAfterSecondsFromResponse(response, details) {
+    const header = response.headers.get("retry-after");
+    if (header) {
+        const seconds = Number(header);
+        if (Number.isFinite(seconds) && seconds >= 0)
+            return Math.ceil(seconds);
+    }
+    const resetAt = details?.reset_at;
+    if (typeof resetAt === "string") {
+        const resetMs = Date.parse(resetAt);
+        if (!Number.isNaN(resetMs))
+            return Math.max(0, Math.ceil((resetMs - Date.now()) / 1000));
+    }
+    return null;
+}
+const VERCEL_PROTECTION_BYPASS_HEADER = "x-vercel-protection-bypass";
+/**
+ * Header fragment that lets automated clients reach a password-protected Vercel
+ * preview deployment. Returns `{ "x-vercel-protection-bypass": <secret> }` only
+ * when `VERCEL_AUTOMATION_BYPASS_SECRET` is set and the API URL targets a
+ * `*.vercel.app` host; otherwise an empty object. Callers spread the result
+ * into their request headers, so a non-preview URL is a no-op.
+ */
+export function vercelProtectionBypassHeaders(apiUrl) {
+    const secret = process.env.VERCEL_AUTOMATION_BYPASS_SECRET?.trim();
+    if (!secret)
+        return {};
+    let hostname;
+    try {
+        hostname = new URL(apiUrl).hostname;
+    }
+    catch {
+        return {};
+    }
+    if (hostname === "vercel.app" || hostname.endsWith(".vercel.app")) {
+        return { [VERCEL_PROTECTION_BYPASS_HEADER]: secret };
+    }
+    return {};
+}

package/node_modules/@oxygen/shared/dist/cli-result.d.ts

@@ -0,0 +1,39 @@
+export type JsonValue = string | number | boolean | null | JsonValue[] | {
+    [key: string]: JsonValue;
+};
+export type CliMeta = {
+    command: string;
+    version: string;
+    minimum_cli_version?: string;
+};
+export type CliSuccess<T> = {
+    ok: true;
+    data: T;
+    meta: CliMeta;
+};
+export type CliFailure = {
+    ok: false;
+    error: {
+        code: string;
+        message: string;
+        details?: unknown;
+    };
+    meta: CliMeta;
+};
+export type CliResult<T> = CliSuccess<T> | CliFailure;
+export declare class OxygenError extends Error {
+    readonly code: string;
+    readonly details?: unknown;
+    readonly exitCode: number;
+    constructor(code: string, message: string, options?: {
+        details?: unknown;
+        exitCode?: number;
+    });
+}
+export declare function success<T>(command: string, data: T, version?: string, minimumCliVersion?: string): CliSuccess<T>;
+export declare function failure(command: string, error: {
+    code: string;
+    message: string;
+    details?: unknown;
+}, version?: string, minimumCliVersion?: string): CliFailure;
+export declare function toFailure(command: string, error: unknown, version?: string): CliFailure;

package/node_modules/@oxygen/shared/dist/cli-result.js

@@ -0,0 +1,52 @@
+// Core CLI-result envelope + error primitives, owned by a dependency-free leaf
+// module so the shared package's other leaf modules (sequences, file-import,
+// object-storage, cli-envelope, ...) can depend on `OxygenError` / `CliResult`
+// without importing the root barrel (`./index.js`). The barrel re-exports
+// everything here, so public imports from `@oxygen/shared` are unchanged; this
+// only removes an internal runtime cycle (barrel → leaf → barrel) and stops
+// subpath modules pulling the whole barrel for one class. Depends only on
+// `./version.js` (itself a leaf).
+import { OXYGEN_MINIMUM_CLI_VERSION, OXYGEN_VERSION } from "./version.js";
+export class OxygenError extends Error {
+    code;
+    details;
+    exitCode;
+    constructor(code, message, options = {}) {
+        super(message);
+        this.name = "OxygenError";
+        this.code = code;
+        this.details = options.details;
+        this.exitCode = options.exitCode ?? 1;
+    }
+}
+export function success(command, data, version = OXYGEN_VERSION, minimumCliVersion = OXYGEN_MINIMUM_CLI_VERSION) {
+    return {
+        ok: true,
+        data,
+        meta: {
+            command,
+            version,
+            minimum_cli_version: minimumCliVersion,
+        }
+    };
+}
+export function failure(command, error, version = OXYGEN_VERSION, minimumCliVersion = OXYGEN_MINIMUM_CLI_VERSION) {
+    return {
+        ok: false,
+        error,
+        meta: {
+            command,
+            version,
+            minimum_cli_version: minimumCliVersion,
+        }
+    };
+}
+export function toFailure(command, error, version = OXYGEN_VERSION) {
+    if (error instanceof OxygenError) {
+        return failure(command, { code: error.code, message: error.message, details: error.details }, version);
+    }
+    if (error instanceof Error) {
+        return failure(command, { code: "unexpected_error", message: error.message }, version);
+    }
+    return failure(command, { code: "unexpected_error", message: "An unexpected error occurred." }, version);
+}

package/node_modules/@oxygen/shared/dist/credit-guidance.d.ts

@@ -11,4 +11,3 @@ export declare function buildCreditGuidance(input: {
     availableCredits: number | null | undefined;
     headroomMultiplier?: number;
 }): CreditGuidance;
-export declare function recommendedCreditCeiling(estimatedCredits: number | null | undefined, headroomMultiplier?: number): number | null;

package/node_modules/@oxygen/shared/dist/credit-guidance.js

@@ -38,7 +38,7 @@ export function buildCreditGuidance(input) {
         credit_guidance: "Credits are tight for the recommended ceiling; ask before running, reduce scope, or top up credits.",
     };
 }
-export function recommendedCreditCeiling(estimatedCredits, headroomMultiplier = DEFAULT_HEADROOM_MULTIPLIER) {
+function recommendedCreditCeiling(estimatedCredits, headroomMultiplier = DEFAULT_HEADROOM_MULTIPLIER) {
     const normalized = normalizeCreditValue(estimatedCredits);
     if (normalized === null)
         return null;

package/node_modules/@oxygen/shared/dist/file-import.js

@@ -1,7 +1,7 @@
 import { extname } from "node:path";
 import readXlsxFile from "read-excel-file/node";
 import { inferImportColumnDataType, parseDateValueToIso, } from "./column-types.js";
-import { OxygenError } from "./index.js";
+import { OxygenError } from "./cli-result.js";
 const MAX_IDENTIFIER_LENGTH = 63;
 export const MAX_BUFFERED_IMPORT_PARSE_BYTES = 10 * 1024 * 1024;
 export function inferRowsFileFormat(path) {

package/node_modules/@oxygen/shared/dist/index.d.ts

@@ -2,6 +2,8 @@ export { OXYGEN_MINIMUM_CLI_VERSION, OXYGEN_VERSION } from "./version.js";
 export { WORKFLOW_TRIGGER_AUTO_PAUSE_METADATA_KEYS, clearWorkflowTriggerAutoPauseMetadata, } from "./workflow-trigger-metadata.js";
 export * from "./billing.js";
 export * from "./cell-format.js";
+export * from "./cli-envelope.js";
+export * from "./cli-result.js";
 export * from "./column-types.js";
 export * from "./credit-guidance.js";
 export * from "./linkedin-sequences.js";
@@ -11,46 +13,8 @@ export * from "./provider-request-outcomes.js";
 export * from "./signup-lead-deliveries.js";
 export * from "./sql-error.js";
 export * from "./telemetry.js";
+export * from "./worker-failures-queue.js";
 export declare const MAX_ROW_LOOP_WRITE_ROWS = 500;
-export type JsonValue = string | number | boolean | null | JsonValue[] | {
-    [key: string]: JsonValue;
-};
-export type CliMeta = {
-    command: string;
-    version: string;
-    minimum_cli_version?: string;
-};
-export type CliSuccess<T> = {
-    ok: true;
-    data: T;
-    meta: CliMeta;
-};
-export type CliFailure = {
-    ok: false;
-    error: {
-        code: string;
-        message: string;
-        details?: unknown;
-    };
-    meta: CliMeta;
-};
-export type CliResult<T> = CliSuccess<T> | CliFailure;
-export declare class OxygenError extends Error {
-    readonly code: string;
-    readonly details?: unknown;
-    readonly exitCode: number;
-    constructor(code: string, message: string, options?: {
-        details?: unknown;
-        exitCode?: number;
-    });
-}
-export declare function success<T>(command: string, data: T, version?: string, minimumCliVersion?: string): CliSuccess<T>;
-export declare function failure(command: string, error: {
-    code: string;
-    message: string;
-    details?: unknown;
-}, version?: string, minimumCliVersion?: string): CliFailure;
-export declare function toFailure(command: string, error: unknown, version?: string): CliFailure;
 export type SemanticVersion = {
     major: number;
     minor: number;

package/node_modules/@oxygen/shared/dist/index.js

@@ -1,8 +1,9 @@
-import { OXYGEN_MINIMUM_CLI_VERSION, OXYGEN_VERSION } from "./version.js";
 export { OXYGEN_MINIMUM_CLI_VERSION, OXYGEN_VERSION } from "./version.js";
 export { WORKFLOW_TRIGGER_AUTO_PAUSE_METADATA_KEYS, clearWorkflowTriggerAutoPauseMetadata, } from "./workflow-trigger-metadata.js";
 export * from "./billing.js";
 export * from "./cell-format.js";
+export * from "./cli-envelope.js";
+export * from "./cli-result.js";
 export * from "./column-types.js";
 export * from "./credit-guidance.js";
 export * from "./linkedin-sequences.js";
@@ -12,55 +13,13 @@ export * from "./provider-request-outcomes.js";
 export * from "./signup-lead-deliveries.js";
 export * from "./sql-error.js";
 export * from "./telemetry.js";
+export * from "./worker-failures-queue.js";
 // Maximum rows a single row-loop write (insert/upsert/preview) may process. The
 // row-loop engine issues one DB round-trip per row, so a 500-row write already
 // approaches request timeouts (~50s observed in prod); larger batches must use
 // the COPY-based bulk engine. Tenant-db enforces this and the CLI/API row caps
 // reference it so they never advertise a batch the row-loop will reject.
 export const MAX_ROW_LOOP_WRITE_ROWS = 500;
-export class OxygenError extends Error {
-    code;
-    details;
-    exitCode;
-    constructor(code, message, options = {}) {
-        super(message);
-        this.name = "OxygenError";
-        this.code = code;
-        this.details = options.details;
-        this.exitCode = options.exitCode ?? 1;
-    }
-}
-export function success(command, data, version = OXYGEN_VERSION, minimumCliVersion = OXYGEN_MINIMUM_CLI_VERSION) {
-    return {
-        ok: true,
-        data,
-        meta: {
-            command,
-            version,
-            minimum_cli_version: minimumCliVersion,
-        }
-    };
-}
-export function failure(command, error, version = OXYGEN_VERSION, minimumCliVersion = OXYGEN_MINIMUM_CLI_VERSION) {
-    return {
-        ok: false,
-        error,
-        meta: {
-            command,
-            version,
-            minimum_cli_version: minimumCliVersion,
-        }
-    };
-}
-export function toFailure(command, error, version = OXYGEN_VERSION) {
-    if (error instanceof OxygenError) {
-        return failure(command, { code: error.code, message: error.message, details: error.details }, version);
-    }
-    if (error instanceof Error) {
-        return failure(command, { code: "unexpected_error", message: error.message }, version);
-    }
-    return failure(command, { code: "unexpected_error", message: "An unexpected error occurred." }, version);
-}
 /**
  * Parse a three-segment semantic version (e.g. `1.142.17`). Pre-release and
  * build metadata suffixes (`-rc.1`, `+build`) are tolerated but ignored.

package/node_modules/@oxygen/shared/dist/log.d.ts

@@ -15,7 +15,6 @@ export type LogContext = {
     surface?: "mcp" | "cli" | "web" | "worker" | undefined;
 };
 export declare function withLogContext<T>(ctx: LogContext, fn: () => T): T;
-export declare function getLogContext(): LogContext;
 export declare function log(level: LogLevel, msg: string, fields?: Record<string, unknown>): void;
 export declare function errorId(err: unknown): string;
 export declare function errorFields(err: unknown): Record<string, unknown>;

package/node_modules/@oxygen/shared/dist/log.js

@@ -7,7 +7,7 @@ export function withLogContext(ctx, fn) {
     const merged = { ...(store.getStore() ?? {}), ...ctx };
     return store.run(merged, fn);
 }
-export function getLogContext() {
+function getLogContext() {
     return store.getStore() ?? {};
 }
 export function log(level, msg, fields) {
@@ -68,9 +68,14 @@ export function errorFields(err) {
             error_id: errorId(err),
             error_name: err.name,
             // Strip drizzle's `\nparams: <values>` tail so SQL parameter values never
-            // reach logs (OXY-46); the SQL text and stack frames are preserved.
+            // reach logs (OXY-46).
             error_message: redactSqlParameters(err.message),
-            error_stack: err.stack ? redactSqlParameters(err.stack) : err.stack,
+            // Deliberately NOT emitting `error_stack`: raw stack frames in
+            // Axiom-bound log fields leak absolute file paths and any credential
+            // dumped into a frame, and they tripped the prod/preview log-hygiene
+            // sweep (OXY-166). `error_id` already hashes name + message + first frame,
+            // so same-origin errors still group for triage without shipping the
+            // frames themselves; reproduce locally or follow trace_id for the stack.
         };
     }
     return { error_id: "non_error", error_message: redactSqlParameters(String(err)) };

package/node_modules/@oxygen/shared/dist/object-storage.d.ts

@@ -18,9 +18,6 @@ export declare function presignImportUpload(input: {
     contentType?: string | null;
     contentLength: number;
 }): Promise<PresignedImportUpload>;
-export declare function downloadImportObject(input: {
-    storageKey: string;
-}): Promise<Buffer>;
 export declare function getImportObjectMetadata(input: {
     storageKey: string;
 }): Promise<{

package/node_modules/@oxygen/shared/dist/object-storage.js

@@ -1,7 +1,7 @@
 import { randomUUID } from "node:crypto";
 import { DeleteObjectCommand, GetObjectCommand, HeadObjectCommand, PutObjectCommand, S3Client, } from "@aws-sdk/client-s3";
 import { getSignedUrl } from "@aws-sdk/s3-request-presigner";
-import { OxygenError } from "./index.js";
+import { OxygenError } from "./cli-result.js";
 // S3-compatible object storage for large CSV/file imports. The CLI uploads the
 // raw file straight to the bucket via a presigned PUT URL (bypassing Vercel's
 // ~4.5MB request-body limit), then the Fly worker downloads it and COPY-loads
@@ -80,22 +80,6 @@ export async function presignImportUpload(input) {
         expiresInSeconds: PRESIGN_EXPIRY_SECONDS,
     };
 }
-export async function downloadImportObject(input) {
-    const { client, config } = resolveClient();
-    const result = await client.send(new GetObjectCommand({ Bucket: config.bucket, Key: input.storageKey }));
-    const body = result.Body;
-    if (!body) {
-        throw new OxygenError("import_object_missing", "Import object had no body.", {
-            details: { storage_key: input.storageKey },
-            exitCode: 1,
-        });
-    }
-    const transform = body.transformToByteArray;
-    if (typeof transform === "function") {
-        return Buffer.from(await transform.call(body));
-    }
-    return streamToBuffer(body);
-}
 export async function getImportObjectMetadata(input) {
     const { client, config } = resolveClient();
     const result = await client.send(new HeadObjectCommand({ Bucket: config.bucket, Key: input.storageKey }));
@@ -125,10 +109,3 @@ function sanitizeFileName(fileName) {
     const base = fileName.split(/[\\/]/).pop() ?? "";
     return base.replace(/[^a-zA-Z0-9._-]/g, "_").slice(0, 120);
 }
-async function streamToBuffer(stream) {
-    const chunks = [];
-    for await (const chunk of stream) {
-        chunks.push(typeof chunk === "string" ? Buffer.from(chunk) : Buffer.from(chunk));
-    }
-    return Buffer.concat(chunks);
-}