@steve31415/baselib 3.8.2 → 3.9.0

package/dist/deploy/config.js

@@ -53,6 +53,14 @@ export function validateConfig(raw) {
                 fail(`updateSecrets.${key} (want <secret-name>:<numeric version>)`);
         }
     }
+    if (c.updateEnv) {
+        for (const [key, value] of Object.entries(c.updateEnv)) {
+            if (!/^[A-Z][A-Z0-9_]*$/.test(key) || key === 'BUILD_ID')
+                fail(`updateEnv.${key} (key)`);
+            if (typeof value !== 'string' || /[|\n]/.test(value))
+                fail(`updateEnv.${key} (want a string without '|' or newlines)`);
+        }
+    }
     return c;
 }
 export async function loadConfig(repoRoot) {

package/dist/deploy/deploy.js

@@ -241,11 +241,14 @@ export async function runDeploy(options) {
                 });
                 continue;
             }
+            // One --update-env-vars with gcloud's alternate-delimiter form (^|^ …)
+            // so declared values may contain commas; '|' is rejected by validateConfig.
+            const envPairs = [`BUILD_ID=${sha}`, ...Object.entries(config.updateEnv ?? {}).map(([k, v]) => `${k}=${v}`)];
             const updateArgs = [
                 'run', 'services', 'update', service.name,
                 ...gcloudBase, '--region', config.region, '--quiet', '--format=json',
                 '--image', imageDigest,
-                '--update-env-vars', `BUILD_ID=${sha}`,
+                '--update-env-vars', `^|^${envPairs.join('|')}`,
                 '--update-labels', `pw-build-sha=${sha.slice(0, 40)}`,
             ];
             if (config.updateSecrets) {

package/dist/deploy/types.d.ts

@@ -47,6 +47,10 @@ export interface DeployConfig {
     releasePrefix: string;
     /** Secrets re-pinned on every routine deploy (name -> secret:version). */
     updateSecrets?: Record<string, string>;
+    /** Non-secret env vars asserted on every routine deploy (name -> value), so a
+     *  runtime-config change is a commit the deploy carries rather than a hand-run
+     *  `gcloud run services update`. Undeclared vars are left as they are. */
+    updateEnv?: Record<string, string>;
     /** Refuse to deploy across a migrations/ diff (notes2 semantics). */
     refuseMigrationDiffOnDeploy?: boolean;
     /** Repo-relative path of an optional ES module exporting hooks. */

package/dist/llm/complete.js

@@ -126,7 +126,13 @@ export async function llmComplete(request) {
             request.logger?.warn('llm.failover_attempt', {
                 failedModel: modelName,
                 failedProvider: modelEntry.provider,
-                error: errorMessage,
+                // Provider/network/parse errors can echo prompts, credentials or private
+                // response bodies. Keep their text in the returned API only, never logs.
+                errorClass: err instanceof LLMError ? 'LLMError' : err instanceof Error ? 'Error' : 'NonError',
+                ...(err instanceof LLMError && typeof err.statusCode === 'number' && Number.isFinite(err.statusCode)
+                    ? { statusCode: err.statusCode } : {}),
+                isRetryable: err instanceof LLMError && err.isRetryable === true,
+                declined: err instanceof LLMError && err.declined === true,
                 attemptNumber: failedAttempts.length,
                 nextModel: modelsToTry[failedAttempts.length] ?? 'none',
             });

package/dist/llm/types.d.ts

@@ -116,18 +116,19 @@ export interface LLMResponse {
     latencyMs: number;
     /** True if the primary model failed and a fallback was used. */
     failedOver: boolean;
-    /** Details of each failed attempt before the successful one. */
+    /** Details of each failed attempt before success; error text can contain private input. Do not log verbatim. */
     failedAttempts: FailedAttempt[];
 }
 /** Details of a failed provider attempt. */
 export interface FailedAttempt {
     provider: ProviderName;
     model: string;
+    /** Provider detail may echo private input or credentials. Do not log verbatim. */
     error: string;
     /** True when this attempt failed because the model declined (vs. an infra error). */
     declined?: boolean;
 }
-/** Error thrown when an LLM provider call fails. */
+/** Error thrown when an LLM provider call fails. Its message may contain private input; do not log verbatim. */
 export declare class LLMError extends Error {
     provider: ProviderName;
     model: string;

package/dist/llm/types.js

@@ -1,4 +1,4 @@
-/** Error thrown when an LLM provider call fails. */
+/** Error thrown when an LLM provider call fails. Its message may contain private input; do not log verbatim. */
 export class LLMError extends Error {
     provider;
     model;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@steve31415/baselib",
-  "version": "3.8.2",
+  "version": "3.9.0",
   "description": "Plasticine new-world shared platform library: logging, auth, service-to-service auth, db, HTTP, sync, app updates",
   "type": "module",
   "license": "MIT",