@sleds/cli 0.1.66 → 0.1.67

package/README.md

@@ -115,6 +115,8 @@ sleuth-export/
 
 Nested items carry `_parents` (the project and organization they came from). The exporter reads Sleuth's schema and builds every query from it, so a field Sleuth renames or drops is followed, not a crash. Re-run the same command to resume after a stop: finished past months are skipped (`--fresh` fetches them again). `--since`/`--until YYYY-MM`, `--only deploys,projects`, `--page-size`, `--depth`; `sleds sleuth` lists them all. The command exits 1 when a section is incomplete, and the manifest says which.
 
+The key goes as `authorization: apikey <key>`; when Sleuth refuses it or answers PERMISSION_DENIED, the export tries `Bearer <key>` once and keeps whichever answers. `SLEUTH_AUTH=bearer` (or `apikey`) sends that scheme alone. A key Sleuth denies under both stops the export at once (exit 2) rather than splitting the month in search of a smaller query.
+
 ## Docs
 
 Repo: github.com/spdyadam/sleds · Site: sleds.ai

package/dist/sleds.mjs

@@ -1640,10 +1640,26 @@ var init_outcome = __esm(() => {
   OUTCOME_WINDOW_MS = OUTCOME_WINDOW_DAYS * 86400000;
 });
 
+// ../../packages/shared/src/deploys/workingHours.ts
+var MIN_MS, DAY_MS2, WEEK_MS, DAY_MIN, WORKING_HOURS_DEFAULT;
+var init_workingHours = __esm(() => {
+  MIN_MS = 60 * 1000;
+  DAY_MS2 = 24 * 60 * MIN_MS;
+  WEEK_MS = 7 * DAY_MS2;
+  DAY_MIN = 24 * 60;
+  WORKING_HOURS_DEFAULT = Object.freeze({
+    on: false,
+    days: Object.freeze([1, 2, 3, 4, 5]),
+    start: 9 * 60,
+    end: 17 * 60
+  });
+});
+
 // ../../packages/shared/src/deploys/metrics.ts
-var WEEK_MS;
+var WEEK_MS2;
 var init_metrics = __esm(() => {
-  WEEK_MS = 7 * 24 * 60 * 60 * 1000;
+  init_workingHours();
+  WEEK_MS2 = 7 * 24 * 60 * 60 * 1000;
 });
 
 // ../../packages/shared/src/deploys/batchSize.ts
@@ -1666,9 +1682,9 @@ function periodChange(cur, prev, better) {
   const dir = pct > 0 ? "up" : "down";
   return { pct, dir, tone: dir === better ? "success" : "error" };
 }
-var DAY_MS2, FLAT_PCT = 0.5;
+var DAY_MS3, FLAT_PCT = 0.5;
 var init_period = __esm(() => {
-  DAY_MS2 = 24 * 60 * 60 * 1000;
+  DAY_MS3 = 24 * 60 * 60 * 1000;
 });
 
 // ../../packages/shared/src/deploys/report.ts
@@ -1681,23 +1697,28 @@ function duration(ms) {
     return `${hours.toFixed(1)}h`;
   return `${(hours / 24).toFixed(1)}d`;
 }
-function change(pair, better) {
+function changeWord(pair, better) {
   const { current, previous } = pair;
   if (current == null)
-    return "";
+    return null;
   if (previous == null)
-    return " (none before)";
+    return "none before";
   const c = periodChange(current, previous, better);
   if (c.dir === "flat")
-    return " (flat)";
+    return "flat";
   if (c.pct == null)
-    return " (none before)";
-  return ` (${c.pct > 0 ? "+" : "−"}${Math.round(Math.abs(c.pct))}%)`;
+    return "none before";
+  return `${c.pct > 0 ? "+" : "−"}${Math.round(Math.abs(c.pct))}%`;
+}
+function change(pair, better) {
+  const word = changeWord(pair, better);
+  return word == null ? "" : ` (${word})`;
 }
-function timeFigure(label, pair) {
+function timeFigure(label, pair, note) {
   if (pair.current == null)
     return `${label} none`;
-  return `${label} ${duration(pair.current)}${change(pair, "down")}`;
+  const notes = [note, changeWord(pair, "down")].filter(Boolean).join(", ");
+  return `${label} ${duration(pair.current)}${notes ? ` (${notes})` : ""}`;
 }
 function rateFigure(pair) {
   const { current, previous } = pair;
@@ -1715,29 +1736,31 @@ function batchFigure(pair) {
   const before = total(pair.previous) === 0 ? "none before" : `was ${tiers(pair.previous)}`;
   return `batch ${tiers(pair.current)} (${before})`;
 }
-function lineText(l) {
+function lineText(l, clock) {
   const head = `${l.name} (${l.slug})`;
   if (l.production == null)
     return `${head} · no production environment set, so no deploy metrics`;
   const deploys = `${l.deploys.current} deploy${l.deploys.current === 1 ? "" : "s"}${change(l.deploys, "up")}`;
   return [
     `${head} · ${l.production}: ${deploys}`,
-    timeFigure("lead time", l.leadTime),
+    timeFigure("lead time", l.leadTime, clock === "working" ? "working hours" : undefined),
     rateFigure(l.failRate),
     timeFigure("time to recover", l.recover),
     batchFigure(l.batch)
   ].join(" · ");
 }
 function metricsText(r) {
+  const clock = r.clock ?? "wall";
   const sameYear = r.from.slice(0, 4) === r.to.slice(0, 4);
   const span = `${dayLabel(r.from, !sameYear)} – ${dayLabel(r.to, true)}`;
   const days = `${r.days} day${r.days === 1 ? "" : "s"}`;
-  const header = `${r.scope === "org" ? "Org" : "Workspace"} · ${span} (${days}), against the ${days} before`;
-  const lines = r.lines.length ? r.lines.map(lineText) : [r.scope === "org" ? "No workspaces in this org." : "No workspace."];
+  const window = clock === "working" ? ` · lead time in working hours${r.hours ? `, ${r.hours}` : ""}` : "";
+  const header = `${r.scope === "org" ? "Org" : "Workspace"} · ${span} (${days}), against the ${days} before${window}`;
+  const lines = r.lines.length ? r.lines.map((l) => lineText(l, clock)) : [r.scope === "org" ? "No workspaces in this org." : "No workspace."];
   return [header, ...lines].join(`
 `);
 }
-var DAY_MS3, METRICS_RANGES, tiers = (c) => TIERS.map((t) => `${t}${c[t]}`).join(" "), total = (c) => TIERS.reduce((n, t) => n + c[t], 0), dayLabel = (day, year) => new Date(`${day}T00:00:00Z`).toLocaleDateString("en-US", {
+var DAY_MS4, METRICS_RANGES, tiers = (c) => TIERS.map((t) => `${t}${c[t]}`).join(" "), total = (c) => TIERS.reduce((n, t) => n + c[t], 0), dayLabel = (day, year) => new Date(`${day}T00:00:00Z`).toLocaleDateString("en-US", {
   month: "short",
   day: "numeric",
   ...year ? { year: "numeric" } : {},
@@ -1746,7 +1769,7 @@ var DAY_MS3, METRICS_RANGES, tiers = (c) => TIERS.map((t) => `${t}${c[t]}`).join
 var init_report = __esm(() => {
   init_batchSize();
   init_period();
-  DAY_MS3 = 24 * 60 * 60 * 1000;
+  DAY_MS4 = 24 * 60 * 60 * 1000;
   METRICS_RANGES = [
     { key: "2w", days: 14 },
     { key: "1m", days: 30 },
@@ -2241,6 +2264,15 @@ var init_route = __esm(() => {
   };
 });
 
+// ../../packages/shared/src/route/verdict.ts
+function toneOf(x) {
+  return typeof x === "string" && VERDICT_TONES.includes(x) ? x : undefined;
+}
+var VERDICT_TONES;
+var init_verdict = __esm(() => {
+  VERDICT_TONES = ["go", "change", "stop"];
+});
+
 // ../../packages/shared/src/mcp/annotations.ts
 function withAnnotations(tools) {
   return tools.map((t) => {
@@ -3698,6 +3730,8 @@ async function runTool(ctx, args) {
   const answer = a ? {
     md: str5(a.md),
     cites: strList(a.cites) ?? [],
+    ...str5(a.verdict)?.trim() ? { verdict: str5(a.verdict)?.trim() } : {},
+    ...toneOf(a.tone) ? { tone: toneOf(a.tone) } : {},
     ...typeof a.irreversible === "boolean" ? { irreversible: a.irreversible } : {}
   } : null;
   const r = isObject4(args.release) ? args.release : null;
@@ -4664,6 +4698,7 @@ var init_server = __esm(() => {
   init_brief();
   init_due();
   init_route();
+  init_verdict();
   init_annotations();
   init_format();
   init_plan2();
@@ -5052,7 +5087,7 @@ var init_server = __esm(() => {
     },
     {
       name: "run",
-      description: "An engine's word on a run it holds (spec 26): with nothing but `runId`, a heartbeat that renews the lease (every few minutes while the session runs; a lapsed lease returns the node to ready). `park: {question}` when the session needs a person — the node parks with the question, the seat is free, the engine takes the next node. `fail: {log}` when the session exited without a PR — back to ready once, parked the second time. `watch` updates where to watch it. On a decider's (answerer's) run: `answer: {md, cites}` when the record settles the question, `release: {why, waitsOn, cites}` when the record says the node must wait on other items (its session stops, the node goes back to ready without a seat, and it is not taken again until those land), `escalate: {why, suggested?, forPerson?}` when it does not — `forPerson: {relation: {key, how}}` when the fix is a relation only a person can set (`blockedBy SL-1474`), which the person's card then sets in one press — SLEDS may refuse an answer and escalate it, and says why. When the PR opens: `actual` (or `land`) with `node` and state `pr`; the merge lands the node from the PR body's `SLEDS-Node:` line.",
+      description: "An engine's word on a run it holds (spec 26): with nothing but `runId`, a heartbeat that renews the lease (every few minutes while the session runs; a lapsed lease returns the node to ready). `park: {question}` when the session needs a person — the node parks with the question, the seat is free, the engine takes the next node. `fail: {log}` when the session exited without a PR — back to ready once, parked the second time. `watch` updates where to watch it. On a decider's (answerer's) run: `answer: {verdict, tone, md, cites}` when the record settles the question, `release: {why, waitsOn, cites}` when the record says the node must wait on other items (its session stops, the node goes back to ready without a seat, and it is not taken again until those land), `escalate: {why, suggested?, forPerson?}` when it does not — `forPerson: {relation: {key, how}}` when the fix is a relation only a person can set (`blockedBy SL-1474`), which the person's card then sets in one press — SLEDS may refuse an answer and escalate it, and says why. When the PR opens: `actual` (or `land`) with `node` and state `pr`; the merge lands the node from the PR body's `SLEDS-Node:` line.",
       inputSchema: {
         type: "object",
         properties: {
@@ -5078,6 +5113,15 @@ var init_server = __esm(() => {
             description: "A decider's answer, on its own run: the record settles the question.",
             properties: {
               md: { type: "string", description: "The answer as you would tell the session." },
+              verdict: {
+                type: "string",
+                description: "SL-2172: the verdict on one line, in plain words — md's first line. The card leads with it."
+              },
+              tone: {
+                type: "string",
+                enum: ["go", "change", "stop"],
+                description: "go: go ahead as filed · change: change the plan · stop: stop or hold."
+              },
               cites: {
                 type: "array",
                 items: { type: "string" },
@@ -6821,11 +6865,11 @@ var init_deploys = __esm(() => {
 });
 
 // ../../packages/shared/src/deploys/series.ts
-var DAY_MS4, WEEK_MS2;
+var DAY_MS5, WEEK_MS3;
 var init_series = __esm(() => {
   init_metrics();
-  DAY_MS4 = 24 * 60 * 60 * 1000;
-  WEEK_MS2 = 7 * DAY_MS4;
+  DAY_MS5 = 24 * 60 * 60 * 1000;
+  WEEK_MS3 = 7 * DAY_MS5;
 });
 
 // ../../packages/shared/src/deploys/stability.ts
@@ -6836,27 +6880,40 @@ var init_stability = __esm(() => {
 });
 
 // ../../packages/shared/src/deploys/shipping.ts
-var DAY_MS5;
+var DAY_MS6;
 var init_shipping = __esm(() => {
-  DAY_MS5 = 24 * 60 * 60 * 1000;
+  DAY_MS6 = 24 * 60 * 60 * 1000;
 });
 
 // ../../packages/shared/src/deploys/doraBands.ts
-var HOUR_MS2, DAY_MS6, WEEK_MS3, MONTH_DAYS = 30, MONTH_MS;
+var HOUR_MS2, DAY_MS7, WEEK_MS4, MONTH_DAYS = 30, MONTH_MS;
 var init_doraBands = __esm(() => {
   HOUR_MS2 = 60 * 60 * 1000;
-  DAY_MS6 = 24 * HOUR_MS2;
-  WEEK_MS3 = 7 * DAY_MS6;
-  MONTH_MS = MONTH_DAYS * DAY_MS6;
+  DAY_MS7 = 24 * HOUR_MS2;
+  WEEK_MS4 = 7 * DAY_MS7;
+  MONTH_MS = MONTH_DAYS * DAY_MS7;
 });
 
 // ../../packages/shared/src/deploys/trends.ts
-var DAY_MS7;
+var DAY_MS8;
 var init_trends = __esm(() => {
   init_batchSize();
   init_metrics();
   init_series();
-  DAY_MS7 = 24 * 60 * 60 * 1000;
+  DAY_MS8 = 24 * 60 * 60 * 1000;
+});
+
+// ../../packages/shared/src/deploys/sleuth.ts
+var SLEUTH_WORKING_HOURS;
+var init_sleuth = __esm(() => {
+  init_deploys();
+  init_workingHours();
+  SLEUTH_WORKING_HOURS = Object.freeze({
+    on: true,
+    days: Object.freeze([1, 2, 3, 4, 5]),
+    start: 14 * 60,
+    end: 23 * 60
+  });
 });
 
 // ../../packages/shared/src/newrelic/newrelic.ts
@@ -7489,7 +7546,7 @@ function eventFrame(o) {
     "",
     "## Post one verdict, then stop",
     "",
-    `- ${o.answer} Post it with the SLEDS \`${run}\` tool, \`{runId: "${a.runId}", answer: {md, cites}}\` — \`md\` as the session it goes to would read it, \`cites\` the list of pointers.`,
+    `- ${o.answer} Post it with the SLEDS \`${run}\` tool, \`{runId: "${a.runId}", answer: {verdict, tone, md, cites}}\` — \`md\` as the session it goes to would read it, \`cites\` the list of pointers.`,
     `- ${o.escalate} Post it with \`${run}\`, \`{runId: "${a.runId}", escalate: {why, suggested?, cites?, irreversible?}}\` — \`why\` in one line for the person (with any action only a person can take), \`suggested\` your best answer as the session would be told it, when you have one. Mark \`irreversible: true\` when it is.`,
     ...VERDICT_SHAPE,
     "- Read what the tool answers: an answer can come back `escalated` with `refused` (irreversible, no cites, or the autonomy is ask). That is SLEDS's call, not a failure; do not post again.",
@@ -7701,6 +7758,7 @@ var init_engine = __esm(() => {
   };
   VERDICT_SHAPE = [
     "- **Verdict first.** The first line of `md` (and of `why`) is the verdict on its own, in plain words: what to do, or what is so. No file paths, line numbers or links in it.",
+    "- On an answer, state that line as `verdict` too, and its `tone`: `go` (go ahead as filed), `change` (change the plan) or `stop` (stop or hold).",
     "- Then at most 3 short points, one line each, as a `-` list. Cites go in `cites`, not in the prose.",
     "- **One cite per span, no prose in it.** Code is `code:<path>:<line>`, the path from the repo root (`code:apps/web/src/App.tsx:42`); cite each line on its own, the cards merge them by file."
   ];
@@ -8379,6 +8437,8 @@ var init_src = __esm(() => {
   init_shipping();
   init_doraBands();
   init_trends();
+  init_workingHours();
+  init_sleuth();
   init_sentry();
   init_newrelic();
   init_musher();
@@ -8390,6 +8450,7 @@ var init_src = __esm(() => {
   init_say();
   init_engine();
   init_sources();
+  init_verdict();
   init_otlp();
   init_session();
   init_effort();
@@ -9153,6 +9214,8 @@ init_series();
 init_shipping();
 init_doraBands();
 init_trends();
+init_workingHours();
+init_sleuth();
 init_sentry();
 init_newrelic();
 init_musher();
@@ -9164,6 +9227,7 @@ init_reshape();
 init_say();
 init_engine();
 init_sources();
+init_verdict();
 init_otlp();
 init_session();
 init_effort();
@@ -11822,7 +11886,7 @@ function beatBody(state, flags, host = {}, cap = {}) {
     name: flags.name,
     os: host.os ?? process.platform,
     runner: flags.runner,
-    version: host.version ?? "0.1.66" ?? "dev",
+    version: host.version ?? "0.1.67" ?? "dev",
     running: live.length,
     items: live.slice(0, BEAT_ITEMS).map((r) => `${r.item}/${r.node}`),
     ...cap.atOnce !== undefined ? { atOnce: cap.atOnce } : {},
@@ -12938,7 +13002,7 @@ function answerPrompt(o) {
     "",
     "## Post one verdict, then stop",
     "",
-    `- Settled by the record: the SLEDS \`${run}\` tool with \`{runId: "${c.runId}", answer: {md, cites}}\` — \`md\` is the answer as you would tell the session, \`cites\` the list of pointers.`,
+    `- Settled by the record: the SLEDS \`${run}\` tool with \`{runId: "${c.runId}", answer: {verdict, tone, md, cites}}\` — \`md\` is the answer as you would tell the session, \`cites\` the list of pointers.`,
     `- The record says node ${c.node} must wait for another item to land ("build nothing until #123 merges") and that item is on the board: \`${run}\` with \`{runId: "${c.runId}", release: {why, waitsOn, cites}}\` — \`waitsOn\` the keys of the items it waits on (\`SL-123\`). It frees the seat: node ${c.node}'s session is closed, and the node is retaken fresh once they land. Release rather than answer "stay parked", which only parks it again.`,
     `- Not settled, irreversible, or unsure: \`${run}\` with \`{runId: "${c.runId}", escalate: {why, suggested?, cites?, irreversible?}}\` — \`why\` in one line for the person (with any action only a person can take), \`suggested\` your best answer as the session would be told it, when you have one. Mark \`irreversible: true\` when it is, even if the session did not.`,
     `- When the fix is a relation on the item only a person can set (node ${c.node} looks like it waits on SL-1474, but the record does not settle it, so it is not a release), escalate with \`forPerson: {relation: {key, how}}\` — \`{key: "SL-1474", how: "blockedBy"}\` — so the person's card sets it in one press. Never tell the session to set it: a session cannot set relations.`,
@@ -18640,7 +18704,7 @@ async function fetchVersion(o) {
   const platform = o.platform ?? process.platform;
   const arch = o.arch ?? process.arch;
   const publicKey = o.publicKey ?? RELEASE_PUBLIC_KEY;
-  const running = o.running ?? "0.1.66";
+  const running = o.running ?? "0.1.67";
   if (!publicKey)
     return { ok: false, why: "no release key yet" };
   if (!VERSION_RE2.test(o.version))
@@ -19866,7 +19930,7 @@ function engineUpdater(o) {
 
 // src/version.ts
 function cliVersion(env) {
-  return "0.1.66";
+  return "0.1.67";
 }
 
 // src/commands/update.ts
@@ -20252,7 +20316,7 @@ function engineClient(o, org, breaker) {
       ...src,
       ...breaker ? { fetchFn: breaker.fetch } : {},
       timeoutMs: ENGINE_TIMEOUT_MS,
-      version: "0.1.66"
+      version: "0.1.67"
     });
   const asked = org?.trim() || env.SLEDS_ORG?.trim();
   if (asked && !selectOrg(readConfig(o.home), org, env).seat)
@@ -20558,7 +20622,7 @@ async function driveEngine(o, flags, deps, until = {}) {
     runner: deps.runner.name,
     atOnce: flags.atOnce,
     interval: flags.interval,
-    cliVersion: "0.1.66"
+    cliVersion: "0.1.67"
   };
   const beat = (checkedAt) => {
     const m = deps.machine;
@@ -22427,7 +22491,7 @@ function engineClient2(o, org, breaker) {
       ...src,
       ...breaker ? { fetchFn: breaker.fetch } : {},
       timeoutMs: ENGINE_TIMEOUT_MS2,
-      version: "0.1.66"
+      version: "0.1.67"
     });
   const asked = org?.trim() || env.SLEDS_ORG?.trim();
   if (asked && !selectOrg(readConfig(o.home), org, env).seat)
@@ -22768,7 +22832,7 @@ async function driveEngine2(o, flags, deps, until = {}) {
     runner: deps.runner.name,
     atOnce: flags.atOnce,
     interval: flags.interval,
-    cliVersion: "0.1.66"
+    cliVersion: "0.1.67"
   };
   const beat = (checkedAt) => {
     const m = deps.machine;
@@ -24879,7 +24943,7 @@ function contextFor(deps) {
     ...src,
     fetchFn: deps.fetchFn,
     timeoutMs: deps.timeoutMs,
-    version: "0.1.66"
+    version: "0.1.67"
   }), deps.home, now) : null;
   return {
     channel: "code",
@@ -28414,6 +28478,15 @@ class SleuthError extends Error {
     this.adaptable = adaptable;
   }
 }
+
+class SleuthDenied extends SleuthError {
+  constructor(message) {
+    super(message, false);
+  }
+}
+var DENIED = /\bPERMISSION_DENIED\b/;
+var isDenial = (e) => DENIED.test(e.message) || typeof e.extensions?.code === "string" && DENIED.test(e.extensions.code);
+var deniedOutright = (data, errors) => errors.some(isDenial) && (!data || Object.values(data).every((v) => v === null));
 var RATE = /rate.?limit|throttl|too many requests/i;
 var backoffMs = (attempt, retryAfter) => {
   const s = Number(retryAfter);
@@ -28427,11 +28500,17 @@ var sleuthClient = (o) => {
   const sleep = o.sleep ?? ((ms) => new Promise((r) => setTimeout(r, ms)));
   const retries = o.retries ?? 6;
   const timeoutMs = o.timeoutMs ?? 120000;
-  let scheme = "apikey";
-  let settled = false;
+  const forced = o.scheme !== undefined;
+  let scheme = o.scheme ?? "apikey";
+  let settled = forced;
+  let deniedOnce = false;
+  let kept = forced;
   let count = 0;
+  const other = (s) => s === "apikey" ? "Bearer" : "apikey";
   const request = async (query) => {
     let lastWhy = "";
+    const startedAs = scheme;
+    let switched = false;
     for (let attempt = 0;attempt <= retries; attempt++) {
       let res;
       count++;
@@ -28455,7 +28534,7 @@ var sleuthClient = (o) => {
         continue;
       }
       if (res.status === 401 || res.status === 403)
-        throw new SleuthError(`Sleuth refused the key (HTTP ${res.status}) — check SLEUTH_API_KEY`, false);
+        throw new SleuthError(`Sleuth refused the key (HTTP ${res.status})${forced ? ` as ${scheme} (SLEUTH_AUTH)` : ""} — check SLEUTH_API_KEY`, false);
       if (res.status === 429 || res.status >= 500) {
         lastWhy = `HTTP ${res.status}`;
         const wait = backoffMs(attempt, res.headers.get("retry-after"));
@@ -28474,16 +28553,36 @@ var sleuthClient = (o) => {
       if (res.status >= 400 && !errors.length)
         throw new SleuthError(`Sleuth answered HTTP ${res.status}`, false);
       settled = true;
-      if (!body.data && errors.some((e) => RATE.test(e.message))) {
+      const data = body.data ?? null;
+      if (!data && errors.some((e) => RATE.test(e.message))) {
         lastWhy = errors[0]?.message ?? "rate limited";
         await sleep(backoffMs(attempt, null));
         continue;
       }
-      return { data: body.data ?? null, errors };
+      if (deniedOutright(data, errors)) {
+        deniedOnce = true;
+        const root = errors.find(isDenial)?.path?.[0];
+        const what = typeof root === "string" ? ` to ${root}` : "";
+        if (!kept && !switched) {
+          switched = true;
+          scheme = other(scheme);
+          o.log?.(`sleuth: PERMISSION_DENIED${what} as ${startedAs} — trying ${scheme}`);
+          attempt--;
+          continue;
+        }
+        if (switched) {
+          scheme = startedAs;
+          throw new SleuthDenied(`Sleuth answered PERMISSION_DENIED${what} as both apikey and Bearer — the key cannot read it; check its scopes in Sleuth › Settings › API`);
+        }
+        throw new SleuthDenied(forced ? `Sleuth answered PERMISSION_DENIED${what} as ${scheme} (SLEUTH_AUTH) — unset SLEUTH_AUTH to try both schemes, or check the key's scopes` : `Sleuth answered PERMISSION_DENIED${what} as ${scheme}, the scheme its other queries take — the key cannot read it`);
+      }
+      if (deniedOnce)
+        kept = true;
+      return { data, errors };
     }
     throw new SleuthError(`Sleuth did not answer after ${retries + 1} tries (${lastWhy})`, true);
   };
-  return { request, calls: () => count };
+  return { request, calls: () => count, scheme: () => scheme };
 };
 
 // src/sleuth/schema.ts
@@ -28544,9 +28643,20 @@ var START = /^(start|startDate|startTime|startAt|from|fromDate|dateFrom|since|be
 var END = /^(end|endDate|endTime|endAt|to|toDate|dateTo|until|before)$/i;
 var CURSOR = /^(after|cursor|nextCursor|pageCursor|pageToken)$/i;
 var PAGE = /^(page|pageNumber|pageNum)$/i;
-var SIZE = /^(first|pageSize|limit|perPage|per_page|size|count|pageLimit)$/i;
+var SIZE_NAMES = [
+  "pagesize",
+  "first",
+  "limit",
+  "perpage",
+  "per_page",
+  "pagelimit",
+  "size",
+  "count"
+];
+var sizeRank = (name) => SIZE_NAMES.indexOf(name.toLowerCase());
 var OFFSET = /^(offset|skip)$/i;
 var DATEISH = /date|time/i;
+var NUMERIC = /^(Int|Float|Long|BigInt|PositiveInt|NonNegativeInt)$/i;
 var dateArg = (path, typeName) => ({
   path,
   dateOnly: /^date$/i.test(typeName)
@@ -28554,18 +28664,21 @@ var dateArg = (path, typeName) => ({
 var planArgs = (s, args) => {
   const plan = { org: [], missing: [] };
   const visit = (vals, prefix, depth) => {
+    const unfilled = [];
     for (const a of vals) {
       const u = unwrap(a.type);
       const path = [...prefix, a.name];
       const leaf = isLeaf(s, u.name);
+      const numeric = leaf && !u.list && NUMERIC.test(u.name);
       const dated = leaf && (DATEISH.test(u.name) || u.name === "String" && DATEISH.test(a.name) && (START.test(a.name) || END.test(a.name)));
       if (kindOf(s, u.name) === "INPUT_OBJECT") {
         const before = JSON.stringify(plan);
         const inputs = s.types.get(u.name)?.inputFields ?? [];
-        if (depth < 3)
-          visit(inputs, path, depth + 1);
-        if (isRequired(a) && JSON.stringify(plan) === before && inputs.some(isRequired))
-          plan.missing.push(path.join("."));
+        const inner = depth < 3 ? visit(inputs, path, depth + 1) : [];
+        if (JSON.stringify(plan) !== before)
+          unfilled.push(...inner);
+        else if (isRequired(a) && inputs.some(isRequired))
+          unfilled.push(path.join("."));
         continue;
       }
       if (leaf && !u.list && ORG.test(a.name))
@@ -28576,17 +28689,20 @@ var planArgs = (s, args) => {
         plan.end = dateArg(path, u.name);
       else if (leaf && !dated && CURSOR.test(a.name) && !plan.cursor)
         plan.cursor = path;
-      else if (leaf && PAGE.test(a.name) && !plan.page)
+      else if (numeric && PAGE.test(a.name) && !plan.page)
         plan.page = { path, first: Number(a.defaultValue ?? 1) || 0 };
-      else if (leaf && SIZE.test(a.name) && !plan.size)
-        plan.size = path;
-      else if (leaf && OFFSET.test(a.name) && !plan.offset)
+      else if (numeric && sizeRank(a.name) >= 0) {
+        const held = plan.size?.[plan.size.length - 1];
+        if (!held || sizeRank(a.name) < sizeRank(held))
+          plan.size = path;
+      } else if (numeric && OFFSET.test(a.name) && !plan.offset)
         plan.offset = path;
       else if (isRequired(a))
-        plan.missing.push(path.join("."));
+        unfilled.push(path.join("."));
     }
+    return unfilled;
   };
-  visit(args, [], 0);
+  plan.missing = visit(args, [], 0);
   return plan;
 };
 var windowed = (p) => !!(p.start && p.end);
@@ -28908,6 +29024,23 @@ var readJsonl = (path) => readFileSync32(path, "utf8").split(`
 `).filter((l) => l.trim()).map((l) => JSON.parse(l));
 var CANNOT_QUERY = /Cannot query field "(\w+)" on type "(\w+)"/;
 var TOO_DEEP = /\bmax(imum)?\b.{0,24}\bdepth\b|\btoo deep\b/i;
+var PERMISSION_DENIED = /\bPERMISSION_DENIED\b/;
+var ORG_DENIED_NOTE = "Sleuth refused this key the organization object. Deploys come through orgChanges and do not need it; what is read under the organization (projects, teams, labels, metricsRecap counts) is missing from this export.";
+var whyNotFound = (schema, patterns) => {
+  for (const re of patterns)
+    for (const [type, t] of schema.types) {
+      const f = (t.fields ?? []).find((x) => re.test(x.name));
+      if (!f)
+        continue;
+      const args = planArgs(schema, f.args);
+      if (args.missing.length)
+        return `${type}.${f.name} needs ${args.missing.join(", ")}, which the export cannot fill`;
+      if (type === schema.query && !args.org.length)
+        return `${type}.${f.name} takes no org argument`;
+      return `${type}.${f.name} is not reachable from the org`;
+    }
+  return "Sleuth's schema has no field by that name";
+};
 var exportSleuth = async (o) => {
   const log = o.log ?? (() => {});
   const now = (o.now ?? (() => new Date))();
@@ -28954,6 +29087,7 @@ var exportSleuth = async (o) => {
   const schema = indexSchema(intro.data);
   manifest.schema.types = schema.types.size;
   const fitDepth = new Map;
+  let answered = false;
   const ask = async (build, steps) => {
     const keep = structural(steps);
     const root = steps[0]?.field.name ?? "";
@@ -28961,8 +29095,10 @@ var exportSleuth = async (o) => {
     let depth = fitDepth.get(path) ?? o.depth;
     for (let i = 0;i < 25; i++) {
       const r = await o.client.request(build(depth));
-      if (r.data && !r.errors.length)
+      if (r.data && !r.errors.length) {
+        answered = true;
         return r.data;
+      }
       const tooDeep = r.errors.some((e) => TOO_DEEP.test(e.message));
       if (!r.data && tooDeep && depth > 0) {
         depth--;
@@ -28986,12 +29122,16 @@ var exportSleuth = async (o) => {
         continue;
       }
       const why = r.errors.slice(0, 3).map((e) => e.message).join("; ");
-      if (empty)
+      if (empty) {
+        if (r.errors.some(isDenial))
+          throw new SleuthDenied(why);
         throw new SleuthError(why || "Sleuth answered with no data", !tooDeep);
+      }
       for (const e of r.errors) {
         const tf = e.path ? typeFieldAt(schema, e.path) : undefined;
         warn(`${tf ? `${tf}: ` : ""}${e.message}`);
       }
+      answered = true;
       return r.data;
     }
     throw new SleuthError("Sleuth kept refusing fields after 25 tries", false);
@@ -29136,10 +29276,11 @@ var exportSleuth = async (o) => {
     }
   };
   const months = monthsBetween(o.since, o.until);
+  let denial;
   const runSection = async (sec) => {
     const steps = findSection(schema, sec.patterns);
     if (!steps)
-      return { found: false, why: "Sleuth's schema has no field by that name" };
+      return { found: false, why: whyNotFound(schema, sec.patterns) };
     const leaf = steps[steps.length - 1];
     const res = {
       found: true,
@@ -29195,6 +29336,11 @@ var exportSleuth = async (o) => {
           const why = e instanceof Error ? e.message : String(e);
           res.months.push({ month, file, count: 0, error: why });
           log(`${sec.name} ${month}: failed — ${why}`);
+          if (e instanceof SleuthDenied) {
+            res.error = `stopped at ${month} — ${why}`;
+            denial = e;
+            break;
+          }
           if (++failedInARow >= MAX_FAILED_MONTHS) {
             res.error = `${MAX_FAILED_MONTHS} months in a row failed; stopped at ${month} — ${why}`;
             break;
@@ -29249,7 +29395,8 @@ var exportSleuth = async (o) => {
 `);
       manifest.organization = { file: "organization.json" };
     } catch (e) {
-      manifest.organization = { error: e instanceof Error ? e.message : String(e) };
+      const error = e instanceof Error ? e.message : String(e);
+      manifest.organization = e instanceof SleuthDenied || PERMISSION_DENIED.test(error) ? { error, note: ORG_DENIED_NOTE } : { error };
     }
   } else
     manifest.organization = { error: "Sleuth's schema has no organization(orgSlug) field" };
@@ -29261,6 +29408,8 @@ var exportSleuth = async (o) => {
     try {
       manifest.sections[sec.name] = await runSection(sec);
     } catch (e) {
+      if (e instanceof SleuthDenied)
+        denial = e;
       manifest.sections[sec.name] = {
         found: true,
         path: [],
@@ -29273,6 +29422,8 @@ var exportSleuth = async (o) => {
       log(`${sec.name}: failed — ${e instanceof Error ? e.message : String(e)}`);
     }
     save();
+    if (denial && !answered)
+      throw denial;
   }
   const deploys = manifest.sections.deploys;
   const recap = orgRoot ? fieldOf2(schema, unwrap(orgRoot.type).name, "metricsRecap") : undefined;
@@ -29332,6 +29483,8 @@ var SLEUTH_USAGE = `usage: sleds sleuth export --org <slug> --out <dir> [options
   Sleuth reports. Re-run to resume: finished past months on disk are not fetched again.
 
   SLEUTH_API_KEY        the org's API key or access token (Sleuth › Settings › API)
+  SLEUTH_AUTH           apikey or bearer: send only that scheme (default: apikey, switching to
+                        Bearer once if Sleuth refuses or answers PERMISSION_DENIED)
   --org <slug>          the Sleuth org slug (required)
   --out <dir>           where to write (required; created if missing)
   --since <YYYY-MM>     first month (default 2022-01)
@@ -29366,6 +29519,7 @@ var parse3 = (argv) => {
   return { words, flags };
 };
 var outDir = (raw, home) => resolve12(raw.startsWith("~/") ? join35(home, raw.slice(2)) : raw);
+var SCHEMES = { apikey: "apikey", bearer: "Bearer" };
 var str15 = (f, k) => typeof f[k] === "string" ? f[k] : undefined;
 var MONTH2 = /^\d{4}-(0[1-9]|1[0-2])$/;
 var KNOWN = [
@@ -29405,6 +29559,12 @@ var sleuthCmd = async (o) => {
     error("SLEUTH_API_KEY is not set — the org's key from Sleuth › Settings › API");
     return 2;
   }
+  const authRaw = env.SLEUTH_AUTH?.trim().toLowerCase();
+  const scheme = authRaw && Object.hasOwn(SCHEMES, authRaw) ? SCHEMES[authRaw] : undefined;
+  if (authRaw && !scheme) {
+    error(`SLEUTH_AUTH is "${env.SLEUTH_AUTH}" — apikey or bearer, or unset to try both`);
+    return 2;
+  }
   const now = (o.now ?? (() => new Date))();
   const since = str15(flags, "since") ?? "2022-01";
   const until = str15(flags, "until") ?? monthOf(now);
@@ -29427,6 +29587,7 @@ var sleuthCmd = async (o) => {
   const progress = error;
   const client = sleuthClient({
     key,
+    ...scheme ? { scheme } : {},
     url: endpoint,
     ...o.fetch ? { fetch: o.fetch } : {},
     ...o.sleep ? { sleep: o.sleep } : {},
@@ -30229,7 +30390,7 @@ var realPidAlive4 = (pid) => {
 };
 function machineClient(home, env) {
   const src = meterSource(home, undefined, { env });
-  return src ? fetchClient({ ...src, version: "0.1.66" }) : null;
+  return src ? fetchClient({ ...src, version: "0.1.67" }) : null;
 }
 async function noteAnswer2(home, a, now) {
   try {
@@ -31103,7 +31264,7 @@ var main = async (argv) => {
     now: Date.now(),
     stderr: (line) => console.error(line),
     isTTY: !!process.stderr.isTTY,
-    version: "0.1.66"
+    version: "0.1.67"
   });
   switch (cmd) {
     case "update":
@@ -31338,7 +31499,7 @@ ${renderHelpText(argv[1])}`);
     case "version":
     case "--version":
     case "-v":
-      console.log("sleds 0.1.66");
+      console.log("sleds 0.1.67");
       return 0;
     default:
       console.error(`unknown command: ${cmd}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sleds/cli",
-  "version": "0.1.66",
+  "version": "0.1.67",
   "description": "SLEDS CLI — the cost and limits of AI agent work, decided at the wall. Point Claude Code at a SLEDS proxy; estimate before you run; hold, switch model, or run overnight when you hit a limit.",
   "license": "UNLICENSED",
   "type": "module",