fullstackgtm 0.55.0 → 0.55.2

package/CHANGELOG.md

@@ -7,6 +7,27 @@ The path to 1.0 is planned in [docs/roadmap-to-1.0.md](https://github.com/fullst
 
 ## [Unreleased]
 
+## [0.55.2] — 2026-07-13
+
+### Changed
+
+- The OSS repository now publishes a representative contributor test suite
+  covering CLI contracts, planning, configuration, HTTP safety, and security,
+  while hosted, live-integration, and adversarial release tests remain private.
+
+### Fixed
+
+- OSS mirror generation and `npm test` now fail when zero public tests are
+  discovered, preventing false-green contributor and release checks.
+
+## [0.55.1] — 2026-07-13
+
+### Fixed
+
+- Interactive masked login prompts no longer repaint an empty
+  `0 characters received` line after Enter is pressed. Submission now settles
+  the renderer before `readline` clears its internal input buffer.
+
 ## [0.55.0] — 2026-07-13
 
 ### Added

package/CONTRIBUTING.md

@@ -64,6 +64,12 @@ Linux, macOS, and Windows; source-level tests remain on Node 22.6+.
 > (a `pretest` guard) rather than silently passing with zero tests. On the
 > published mirror, `tests/` is present and `npm test` works there.
 
+The public mirror includes a representative suite covering supported CLI,
+planning, configuration, HTTP, and security behavior. Additional hosted-product,
+live-integration, and adversarial release tests remain in the private monorepo;
+both suites gate releases. The public test selection is reviewed explicitly in
+`oss/public-tests.txt`, and `npm test` fails if the mirror contains zero tests.
+
 **Node:** the published runtime supports Node ≥ 20 (`engines`), but the test
 runner needs Node **≥ 22.6** for `--experimental-strip-types`. Develop on 22.6+.
 

package/dist/cli/enrich.js

@@ -44,7 +44,7 @@ enrich append  [--source apollo] [--objects companies,contacts] [--save] [--conf
 enrich refresh [--source apollo] [--stale-days <n>] [--save] [--config <path>]
                [source options] [--run-label <label>] [--json]
 enrich ingest  <file.csv|payload.json|spool.jsonl|spool-dir> --source clay [--run-label <label>] [--objects companies|contacts] [--config <path>]
-enrich acquire [--source <id>] [--max <new-leads>] [--scan-limit <candidates>] [--list <id>] [--assign-owner <id>] [--save] [--config <path>] [--json]
+enrich acquire [--source <id>] [--max <new-leads>] [--scan-limit <candidates>] [--company-domain <domain>] [--list <id>] [--assign-owner <id>] [--save] [--config <path>] [--json]
 enrich status  [--runs] [--source <id>] [--config <path>] [--json]
 
 acquire creates NET-NEW leads from a staged prospect list (ingest first):
@@ -515,8 +515,14 @@ async function acquireFromApi(config, source, rest, icp, snapshot, seen, priorRu
             : disc.provider === "clay"
                 ? (icp ? icpToClayPeopleFilters(icp) : (disc.filters ?? {}))
                 : {};
+    const targetCompanyDomain = option(rest, "--company-domain")?.trim().toLowerCase().replace(/^https?:\/\//, "").replace(/^www\./, "").replace(/\/.*$/, "");
+    if (targetCompanyDomain) {
+        if (disc.provider !== "clay")
+            throw new Error("enrich acquire: --company-domain currently requires --source clay");
+        filters = { ...filters, company_identifier: [targetCompanyDomain] };
+    }
     const queryFingerprint = createHash("sha256")
-        .update(JSON.stringify({ source, provider: disc.provider, listId, filters, icp: icp ?? null }))
+        .update(JSON.stringify({ source, provider: disc.provider, listId, filters, icp: icp ?? null, targetCompanyDomain: targetCompanyDomain ?? null }))
         .digest("hex");
     const checkpointKey = {
         provider: disc.provider,
@@ -599,7 +605,7 @@ async function acquireFromApi(config, source, rest, icp, snapshot, seen, priorRu
                     if (!cursor) {
                         const route = clayRoutes[clayRouteIndex];
                         if (route)
-                            filters = route.filters;
+                            filters = { ...route.filters, ...(targetCompanyDomain ? { company_identifier: [targetCompanyDomain] } : {}) };
                         progress.note(`creating Clay people-search iterator · ${route?.id ?? "configured"}`);
                         cursor = await createClaySearch({ apiKey: providerKey("clay"), sourceType: "people", filters });
                     }
@@ -643,6 +649,8 @@ async function acquireFromApi(config, source, rest, icp, snapshot, seen, priorRu
         }
         discovered += page.length;
         progress.items(discovered, scanLimit);
+        if (targetCompanyDomain)
+            page = page.filter((prospect) => normalizedCompanyDomain(prospect.companyDomain) === targetCompanyDomain);
         if (page.length === 0) {
             exhausted = true;
             break;
@@ -885,6 +893,9 @@ function printAcquireOutput(options) {
         console.log("The meter is charged only when a create lands at apply.");
     }
 }
+function normalizedCompanyDomain(value) {
+    return (value ?? "").trim().toLowerCase().replace(/^https?:\/\//, "").replace(/^www\./, "").replace(/\/.*$/, "");
+}
 function hostedRunsUrl() {
     const baseUrl = getCredential("broker")?.baseUrl?.replace(/\/+$/, "");
     return baseUrl ? `${baseUrl}/dashboard/runs` : null;

package/dist/cli/help.js

@@ -630,7 +630,7 @@ export const COMMAND_FLAGS = {
     dedupe: [...SOURCE_FLAGS, "--key", "--keep", "--reason", "--max-operations", "--save", "--dry-run", "--verbose", "--json", "--out"],
     reassign: [...SOURCE_FLAGS, "--from", "--assign-unowned", "--to", "--objects", "--where", "--except-deal-stage", "--include-closed-deals", "--reason", "--max-operations", "--save", "--dry-run", "--verbose", "--json", "--out"],
     backfill: [...SOURCE_FLAGS, "--since", "--pipeline", "--match-property", "--skip-unmatched", "--save", "--dry-run", "--verbose", "--json"],
-    enrich: [...SOURCE_FLAGS, "--config", "--source", "--icp", "--input", "--provider", "--list", "--stale-days", "--assign-owner", "--objects", "--max", "--scan-limit", "--staged-run", "--run-label", "--label", "--runs", "--save", "--dry-run", "--verbose", "--json", "--out"],
+    enrich: [...SOURCE_FLAGS, "--config", "--source", "--icp", "--input", "--provider", "--list", "--stale-days", "--assign-owner", "--objects", "--max", "--scan-limit", "--company-domain", "--staged-run", "--run-label", "--label", "--runs", "--save", "--dry-run", "--verbose", "--json", "--out"],
     call: [...SOURCE_FLAGS, "--transcript", "--title", "--source", "--model", "--deterministic", "--heuristics", "--llm", "--verbose", "--json", "--ndjson", "--out", "--call", "--call-type", "--rubric", "--list", "--list-rubrics", "--attendees", "--domain", "--deal", "--save", "--dry-run"],
     suggest: [...SOURCE_FLAGS, "--plan-id", "--plan", "--json", "--out"],
     plans: ["--status", "--operations", "--value", "--values-from", "--min-confidence", "--include-creates", "--acknowledge-uncertain-writes", "--verbose", "--json"],
@@ -645,7 +645,7 @@ export const COMMAND_FLAGS = {
     schedule: ["--cron", "--label", "--provider", "--trigger", "--timer", "--runs", "--verbose", "--json"],
 };
 export const FLAGS_WITH_VALUES = new Set([
-    "--account", "--account-id", "--accounts", "--acv", "--acv-basis", "--after", "--anchor", "--api-key", "--approve", "--archive", "--assign-owner", "--attendees", "--before", "--bucket", "--buyers-per-account", "--call", "--call-type", "--calls", "--capture-run", "--category", "--channel", "--client", "--client-id", "--client-secret", "--config", "--connector", "--connector-opt", "--contact", "--cron", "--cross-checks", "--deal", "--deal-period", "--diff", "--domain", "--email", "--except-deal-stage", "--format", "--from", "--from-judge", "--golden", "--guard", "--icp", "--in", "--input", "--instance-url", "--keep", "--key", "--keywords", "--label", "--list", "--login-url", "--match", "--match-property", "--max", "--max-accounts", "--max-claims", "--max-credits", "--max-examples", "--max-operations", "--max-results", "--max-searches", "--max-usd", "--min-accuracy", "--min-confidence", "--min-mentions", "--min-score", "--model", "--name", "--objects", "--operations", "--out", "--pipeline", "--plan", "--plan-id", "--policy", "--port", "--prepared-by", "--prior-run", "--profile", "--promote-lift", "--prompt", "--provider", "--reason", "--require", "--result", "--rubric", "--rule", "--rules", "--run", "--run-label", "--runs", "--scan-limit", "--scopes", "--seed", "--set", "--signals-from", "--since", "--snapshot", "--source", "--staged-run", "--stale-days", "--status", "--task-account", "--task-deal", "--timer", "--title", "--to", "--today", "--token", "--token-env", "--touch", "--transcript", "--trigger", "--usd-per-credit", "--value", "--values-from", "--vendor", "--via", "--watchlist", "--where",
+    "--account", "--account-id", "--accounts", "--acv", "--acv-basis", "--after", "--anchor", "--api-key", "--approve", "--archive", "--assign-owner", "--attendees", "--before", "--bucket", "--buyers-per-account", "--call", "--call-type", "--calls", "--capture-run", "--category", "--channel", "--client", "--client-id", "--client-secret", "--company-domain", "--config", "--connector", "--connector-opt", "--contact", "--cron", "--cross-checks", "--deal", "--deal-period", "--diff", "--domain", "--email", "--except-deal-stage", "--format", "--from", "--from-judge", "--golden", "--guard", "--icp", "--in", "--input", "--instance-url", "--keep", "--key", "--keywords", "--label", "--list", "--login-url", "--match", "--match-property", "--max", "--max-accounts", "--max-claims", "--max-credits", "--max-examples", "--max-operations", "--max-results", "--max-searches", "--max-usd", "--min-accuracy", "--min-confidence", "--min-mentions", "--min-score", "--model", "--name", "--objects", "--operations", "--out", "--pipeline", "--plan", "--plan-id", "--policy", "--port", "--prepared-by", "--prior-run", "--profile", "--promote-lift", "--prompt", "--provider", "--reason", "--require", "--result", "--rubric", "--rule", "--rules", "--run", "--run-label", "--runs", "--scan-limit", "--scopes", "--seed", "--set", "--signals-from", "--since", "--snapshot", "--source", "--staged-run", "--stale-days", "--status", "--task-account", "--task-deal", "--timer", "--title", "--to", "--today", "--token", "--token-env", "--touch", "--transcript", "--trigger", "--usd-per-credit", "--value", "--values-from", "--vendor", "--via", "--watchlist", "--where",
 ]);
 // Lifecycle-grouped front door. One line per verb, organized by the
 // Prevent→Detect→Remediate→Verify loop so a new user sees ~6 jobs, not 22 verbs.

package/dist/cli/shared.d.ts

@@ -65,6 +65,15 @@ export declare function loadIcp(args: string[]): Icp | undefined;
  *     e.g. `echo "$TOKEN" | fullstackgtm login hubspot`
  *   - interactive: prompted on the TTY with the input muted
  */
+export declare function createSecretMaskRenderer(options: {
+    label: string;
+    lineLength: () => number;
+    write: (value: string) => void;
+}): {
+    mute(): void;
+    settle(): void;
+    write(value: string): void;
+};
 export declare function readSecret(label: string): Promise<string>;
 export declare function isOptionValue(args: string[], arg: string): boolean;
 export declare function readPackageInfo(): {

package/dist/cli/shared.js

@@ -288,6 +288,35 @@ export function loadIcp(args) {
  *     e.g. `echo "$TOKEN" | fullstackgtm login hubspot`
  *   - interactive: prompted on the TTY with the input muted
  */
+export function createSecretMaskRenderer(options) {
+    let muted = false;
+    let renderQueued = false;
+    let settled = false;
+    return {
+        mute() { muted = true; },
+        settle() { settled = true; },
+        write(value) {
+            if (!muted) {
+                options.write(value);
+                return;
+            }
+            if (settled || renderQueued)
+                return;
+            renderQueued = true;
+            queueMicrotask(() => {
+                renderQueued = false;
+                // readline clears `line` during close. Submission settles this renderer
+                // first so an Enter-triggered repaint cannot redraw an empty prompt
+                // after the final mask/newline ("0 characters received").
+                if (settled)
+                    return;
+                const length = options.lineLength();
+                const mask = `${"•".repeat(Math.min(length, 12))}${length > 12 ? "…" : ""}`;
+                options.write(`\r\u001b[2K${options.label}: ${mask} (${length} character${length === 1 ? "" : "s"} received)`);
+            });
+        },
+    };
+}
 export async function readSecret(label) {
     if (!process.stdin.isTTY) {
         const chunks = [];
@@ -311,30 +340,20 @@ export async function readSecret(label) {
             output: process.stderr,
             terminal: true,
         });
-        let muted = false;
         const mutable = rl;
-        let renderQueued = false;
-        mutable._writeToOutput = (value) => {
-            if (!muted) {
-                process.stderr.write(value);
-                return;
-            }
-            if (renderQueued)
-                return;
-            renderQueued = true;
-            queueMicrotask(() => {
-                renderQueued = false;
-                const length = mutable.line?.length ?? 0;
-                const mask = `${"•".repeat(Math.min(length, 12))}${length > 12 ? "…" : ""}`;
-                process.stderr.write(`\r\u001b[2K${label}: ${mask} (${length} character${length === 1 ? "" : "s"} received)`);
-            });
-        };
+        const renderer = createSecretMaskRenderer({
+            label,
+            lineLength: () => mutable.line?.length ?? 0,
+            write: (value) => process.stderr.write(value),
+        });
+        mutable._writeToOutput = (value) => renderer.write(value);
         rl.question(`${label}: `, (answer) => {
+            renderer.settle();
             rl.close();
             process.stderr.write("\n");
             resolveSecret(answer.trim());
         });
-        muted = true;
+        renderer.mute();
     });
 }
 export function isOptionValue(args, arg) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "fullstackgtm",
-  "version": "0.55.0",
+  "version": "0.55.2",
   "description": "Open-source agentic GTM ops framework: canonical GTM data model, pluggable deterministic audits, reviewable dry-run patch plans, approval-gated write-back with conflict detection, and cross-system entity resolution. HubSpot, Salesforce, and Stripe connectors included.",
   "license": "Apache-2.0",
   "author": "Full Stack GTM LLC <ryan@fullstackgtm.com> (https://fullstackgtm.com)",
@@ -47,7 +47,7 @@
   "scripts": {
     "clean": "node scripts/clean.mjs",
     "build": "npm run clean && tsc -p tsconfig.build.json",
-    "pretest": "test -d tests || { echo 'No tests/ in this directory. In the published mirror, tests live here and `npm test` works. In the monorepo, run package tests from the repo ROOT: `node --experimental-strip-types --test tests/fullstackgtm*.test.ts` (the tests live at the monorepo root tests/).' >&2; exit 1; }",
+    "pretest": "node scripts/verify-public-tests.mjs",
     "test": "node --experimental-strip-types --test tests/*.test.ts",
     "verify:package": "npm run build && node scripts/verify-packed-install.mjs --with-peers",
     "prepublishOnly": "npm run verify:package"

package/src/cli/enrich.ts

@@ -50,7 +50,7 @@ enrich append  [--source apollo] [--objects companies,contacts] [--save] [--conf
 enrich refresh [--source apollo] [--stale-days <n>] [--save] [--config <path>]
                [source options] [--run-label <label>] [--json]
 enrich ingest  <file.csv|payload.json|spool.jsonl|spool-dir> --source clay [--run-label <label>] [--objects companies|contacts] [--config <path>]
-enrich acquire [--source <id>] [--max <new-leads>] [--scan-limit <candidates>] [--list <id>] [--assign-owner <id>] [--save] [--config <path>] [--json]
+enrich acquire [--source <id>] [--max <new-leads>] [--scan-limit <candidates>] [--company-domain <domain>] [--list <id>] [--assign-owner <id>] [--save] [--config <path>] [--json]
 enrich status  [--runs] [--source <id>] [--config <path>] [--json]
 
 acquire creates NET-NEW leads from a staged prospect list (ingest first):
@@ -596,8 +596,13 @@ async function acquireFromApi(
       : disc.provider === "clay"
         ? (icp ? icpToClayPeopleFilters(icp) : (disc.filters ?? {}))
         : {};
+  const targetCompanyDomain = option(rest, "--company-domain")?.trim().toLowerCase().replace(/^https?:\/\//, "").replace(/^www\./, "").replace(/\/.*$/, "");
+  if (targetCompanyDomain) {
+    if (disc.provider !== "clay") throw new Error("enrich acquire: --company-domain currently requires --source clay");
+    filters = { ...filters, company_identifier: [targetCompanyDomain] };
+  }
   const queryFingerprint = createHash("sha256")
-    .update(JSON.stringify({ source, provider: disc.provider, listId, filters, icp: icp ?? null }))
+    .update(JSON.stringify({ source, provider: disc.provider, listId, filters, icp: icp ?? null, targetCompanyDomain: targetCompanyDomain ?? null }))
     .digest("hex");
   const checkpointKey: AcquireCheckpointKey = {
     provider: disc.provider,
@@ -690,7 +695,7 @@ async function acquireFromApi(
       while (true) {
         if (!cursor) {
           const route = clayRoutes[clayRouteIndex];
-          if (route) filters = route.filters;
+          if (route) filters = { ...route.filters, ...(targetCompanyDomain ? { company_identifier: [targetCompanyDomain] } : {}) };
           progress.note(`creating Clay people-search iterator · ${route?.id ?? "configured"}`);
           cursor = await createClaySearch({ apiKey: providerKey("clay"), sourceType: "people", filters });
         }
@@ -730,6 +735,7 @@ async function acquireFromApi(
     }
     discovered += page.length;
     progress.items(discovered, scanLimit);
+    if (targetCompanyDomain) page = page.filter((prospect) => normalizedCompanyDomain(prospect.companyDomain) === targetCompanyDomain);
     if (page.length === 0) {
       exhausted = true;
       break;
@@ -1011,6 +1017,10 @@ function printAcquireOutput(options: {
   }
 }
 
+function normalizedCompanyDomain(value: string | undefined): string {
+  return (value ?? "").trim().toLowerCase().replace(/^https?:\/\//, "").replace(/^www\./, "").replace(/\/.*$/, "");
+}
+
 function hostedRunsUrl(): string | null {
   const baseUrl = getCredential("broker")?.baseUrl?.replace(/\/+$/, "");
   return baseUrl ? `${baseUrl}/dashboard/runs` : null;

package/src/cli/help.ts

@@ -692,7 +692,7 @@ export const COMMAND_FLAGS: Record<string, string[]> = {
   dedupe: [...SOURCE_FLAGS, "--key", "--keep", "--reason", "--max-operations", "--save", "--dry-run", "--verbose", "--json", "--out"],
   reassign: [...SOURCE_FLAGS, "--from", "--assign-unowned", "--to", "--objects", "--where", "--except-deal-stage", "--include-closed-deals", "--reason", "--max-operations", "--save", "--dry-run", "--verbose", "--json", "--out"],
   backfill: [...SOURCE_FLAGS, "--since", "--pipeline", "--match-property", "--skip-unmatched", "--save", "--dry-run", "--verbose", "--json"],
-  enrich: [...SOURCE_FLAGS, "--config", "--source", "--icp", "--input", "--provider", "--list", "--stale-days", "--assign-owner", "--objects", "--max", "--scan-limit", "--staged-run", "--run-label", "--label", "--runs", "--save", "--dry-run", "--verbose", "--json", "--out"],
+  enrich: [...SOURCE_FLAGS, "--config", "--source", "--icp", "--input", "--provider", "--list", "--stale-days", "--assign-owner", "--objects", "--max", "--scan-limit", "--company-domain", "--staged-run", "--run-label", "--label", "--runs", "--save", "--dry-run", "--verbose", "--json", "--out"],
   call: [...SOURCE_FLAGS, "--transcript", "--title", "--source", "--model", "--deterministic", "--heuristics", "--llm", "--verbose", "--json", "--ndjson", "--out", "--call", "--call-type", "--rubric", "--list", "--list-rubrics", "--attendees", "--domain", "--deal", "--save", "--dry-run"],
   suggest: [...SOURCE_FLAGS, "--plan-id", "--plan", "--json", "--out"],
   plans: ["--status", "--operations", "--value", "--values-from", "--min-confidence", "--include-creates", "--acknowledge-uncertain-writes", "--verbose", "--json"],
@@ -708,7 +708,7 @@ export const COMMAND_FLAGS: Record<string, string[]> = {
 };
 
 export const FLAGS_WITH_VALUES = new Set([
-  "--account", "--account-id", "--accounts", "--acv", "--acv-basis", "--after", "--anchor", "--api-key", "--approve", "--archive", "--assign-owner", "--attendees", "--before", "--bucket", "--buyers-per-account", "--call", "--call-type", "--calls", "--capture-run", "--category", "--channel", "--client", "--client-id", "--client-secret", "--config", "--connector", "--connector-opt", "--contact", "--cron", "--cross-checks", "--deal", "--deal-period", "--diff", "--domain", "--email", "--except-deal-stage", "--format", "--from", "--from-judge", "--golden", "--guard", "--icp", "--in", "--input", "--instance-url", "--keep", "--key", "--keywords", "--label", "--list", "--login-url", "--match", "--match-property", "--max", "--max-accounts", "--max-claims", "--max-credits", "--max-examples", "--max-operations", "--max-results", "--max-searches", "--max-usd", "--min-accuracy", "--min-confidence", "--min-mentions", "--min-score", "--model", "--name", "--objects", "--operations", "--out", "--pipeline", "--plan", "--plan-id", "--policy", "--port", "--prepared-by", "--prior-run", "--profile", "--promote-lift", "--prompt", "--provider", "--reason", "--require", "--result", "--rubric", "--rule", "--rules", "--run", "--run-label", "--runs", "--scan-limit", "--scopes", "--seed", "--set", "--signals-from", "--since", "--snapshot", "--source", "--staged-run", "--stale-days", "--status", "--task-account", "--task-deal", "--timer", "--title", "--to", "--today", "--token", "--token-env", "--touch", "--transcript", "--trigger", "--usd-per-credit", "--value", "--values-from", "--vendor", "--via", "--watchlist", "--where",
+  "--account", "--account-id", "--accounts", "--acv", "--acv-basis", "--after", "--anchor", "--api-key", "--approve", "--archive", "--assign-owner", "--attendees", "--before", "--bucket", "--buyers-per-account", "--call", "--call-type", "--calls", "--capture-run", "--category", "--channel", "--client", "--client-id", "--client-secret", "--company-domain", "--config", "--connector", "--connector-opt", "--contact", "--cron", "--cross-checks", "--deal", "--deal-period", "--diff", "--domain", "--email", "--except-deal-stage", "--format", "--from", "--from-judge", "--golden", "--guard", "--icp", "--in", "--input", "--instance-url", "--keep", "--key", "--keywords", "--label", "--list", "--login-url", "--match", "--match-property", "--max", "--max-accounts", "--max-claims", "--max-credits", "--max-examples", "--max-operations", "--max-results", "--max-searches", "--max-usd", "--min-accuracy", "--min-confidence", "--min-mentions", "--min-score", "--model", "--name", "--objects", "--operations", "--out", "--pipeline", "--plan", "--plan-id", "--policy", "--port", "--prepared-by", "--prior-run", "--profile", "--promote-lift", "--prompt", "--provider", "--reason", "--require", "--result", "--rubric", "--rule", "--rules", "--run", "--run-label", "--runs", "--scan-limit", "--scopes", "--seed", "--set", "--signals-from", "--since", "--snapshot", "--source", "--staged-run", "--stale-days", "--status", "--task-account", "--task-deal", "--timer", "--title", "--to", "--today", "--token", "--token-env", "--touch", "--transcript", "--trigger", "--usd-per-credit", "--value", "--values-from", "--vendor", "--via", "--watchlist", "--where",
 ]);
 
 // Lifecycle-grouped front door. One line per verb, organized by the

package/src/cli/shared.ts

@@ -336,6 +336,35 @@ export function loadIcp(args: string[]): Icp | undefined {
  *     e.g. `echo "$TOKEN" | fullstackgtm login hubspot`
  *   - interactive: prompted on the TTY with the input muted
  */
+export function createSecretMaskRenderer(options: {
+  label: string;
+  lineLength: () => number;
+  write: (value: string) => void;
+}) {
+  let muted = false;
+  let renderQueued = false;
+  let settled = false;
+  return {
+    mute() { muted = true; },
+    settle() { settled = true; },
+    write(value: string) {
+      if (!muted) { options.write(value); return; }
+      if (settled || renderQueued) return;
+      renderQueued = true;
+      queueMicrotask(() => {
+        renderQueued = false;
+        // readline clears `line` during close. Submission settles this renderer
+        // first so an Enter-triggered repaint cannot redraw an empty prompt
+        // after the final mask/newline ("0 characters received").
+        if (settled) return;
+        const length = options.lineLength();
+        const mask = `${"•".repeat(Math.min(length, 12))}${length > 12 ? "…" : ""}`;
+        options.write(`\r\u001b[2K${options.label}: ${mask} (${length} character${length === 1 ? "" : "s"} received)`);
+      });
+    },
+  };
+}
+
 export async function readSecret(label: string): Promise<string> {
   if (!process.stdin.isTTY) {
     const chunks: Buffer[] = [];
@@ -362,26 +391,20 @@ export async function readSecret(label: string): Promise<string> {
       output: process.stderr,
       terminal: true,
     });
-    let muted = false;
     const mutable = rl as unknown as { _writeToOutput?: (value: string) => void; line?: string };
-    let renderQueued = false;
-    mutable._writeToOutput = (value: string) => {
-      if (!muted) { process.stderr.write(value); return; }
-      if (renderQueued) return;
-      renderQueued = true;
-      queueMicrotask(() => {
-        renderQueued = false;
-        const length = mutable.line?.length ?? 0;
-        const mask = `${"•".repeat(Math.min(length, 12))}${length > 12 ? "…" : ""}`;
-        process.stderr.write(`\r\u001b[2K${label}: ${mask} (${length} character${length === 1 ? "" : "s"} received)`);
-      });
-    };
+    const renderer = createSecretMaskRenderer({
+      label,
+      lineLength: () => mutable.line?.length ?? 0,
+      write: (value) => process.stderr.write(value),
+    });
+    mutable._writeToOutput = (value: string) => renderer.write(value);
     rl.question(`${label}: `, (answer) => {
+      renderer.settle();
       rl.close();
       process.stderr.write("\n");
       resolveSecret(answer.trim());
     });
-    muted = true;
+    renderer.mute();
   });
 }