monday-cli 0.2.0 → 0.3.0

package/dist/api/webhooks.js

@@ -0,0 +1,333 @@
+/**
+ * Webhook surface for the v0.3-M27 `monday webhook list/create/delete`
+ * verbs (`cli-design.md` §2.7 + §4.3 + §13 v0.3 entry;
+ * `v0.3-plan.md` §3 M27).
+ *
+ * **Wire surface (empirical probe 2026-05-12, API `2026-01`).** Three
+ * Monday GraphQL operations land here:
+ *
+ *   - `Query.webhooks(board_id: ID!, app_webhooks_only: Boolean)` —
+ *     returns `[Webhook!]`. CLI exposes board-scoped only (the
+ *     `app_webhooks_only` filter is a future v0.3.x / v0.4 extension
+ *     once apps land).
+ *   - `Mutation.create_webhook(board_id: ID!, url: String!,
+ *     event: WebhookEventType!, config: JSON)` — returns the created
+ *     `Webhook`. The CLI surface keeps `--config <json>` as an opaque
+ *     JSON string; per-event sub-shape validation happens server-side
+ *     at Monday (Decision 9 closure note in §3 M27).
+ *   - `Mutation.delete_webhook(id: ID!)` — returns the deleted
+ *     `Webhook`. The CLI surfaces the full deleted record so an agent
+ *     re-checking the namespace can verify what went away.
+ *
+ * **Webhook object shape (4 fields).** `id` (ID, non-null), `board_id`
+ * (ID, non-null), `event` (WebhookEventType, non-null), `config`
+ * (String, nullable). Note the **asymmetric `config` typing**: the
+ * `create_webhook` arg is typed `JSON` (any valid JSON value); the
+ * read-side `Webhook.config` field is typed `String` (Monday echoes
+ * back the stored JSON-encoded string). The CLI's read schema treats
+ * `config` as `string | null`; the create-input parses `--config`
+ * once at the parse boundary (in the command's action body) and
+ * threads the resulting JS value to Monday's `JSON` scalar (sending
+ * the raw string would double-encode).
+ *
+ * **Decision 9 (webhook event-type validation) — CLOSED at M27
+ * pre-flight via the `WEBHOOK_EVENT_TYPES` 21-value closed enum.**
+ * Per cli-design §8 default recommendation: zod enum at parse
+ * boundary; unknown events surface `usage_error` before hitting
+ * the wire. Empirical probe (`scripts/probe/m27-create-webhook
+ * -input.ts`, 2026-05-12, API `2026-01`) pinned the vocabulary
+ * directly from Monday's introspection — `WebhookEventType` is an
+ * `ENUM` with exactly 21 values; additions land as additive minor
+ * bumps. Renames or removals are a major version bump.
+ *
+ * **No new ERROR_CODES (29 stays).** Webhook failures route through
+ * the existing codes: `not_found` (missing board / missing webhook),
+ * `usage_error` (unknown event-type / malformed URL), `unauthorized`
+ * (token lacks webhook-management scope), `forbidden` (account
+ * permissions), `validation_failed` (Monday-side rejection of the
+ * create payload). No webhook-specific failure mode requires new
+ * code-registry surface.
+ *
+ * **Webhooks are live-only for v0.3.** Per cli-design §8 cache scope,
+ * webhooks aren't cached — the live `webhook list` read and the live
+ * `webhook create` / `webhook delete` mutation paths emit
+ * `meta.source: "live"` with `cache_age_seconds: null`. `--dry-run`
+ * paths emit `meta.source: "none"` per the canonical `DryRunEnvelope`
+ * contract; all 3 write-verb dry-runs are strictly argv-derived (no
+ * pre-mutation read fires — Monday's `webhooks(board_id:)` query is
+ * board-scoped but `webhook delete <wid>` carries no board ID, so a
+ * pre-read enrichment would require a §4.3 amendment).
+ * Adding webhooks to the §8 cache scope would be a contract
+ * extension (v0.3.x / v0.4).
+ *
+ * **Runtime bodies (M27 IMPL).** Three fetchers — `listWebhooks` /
+ * `createWebhook` / `deleteWebhook` — each issue a single
+ * `client.raw` round-trip with a named operation (`Webhooks` /
+ * `CreateWebhook` / `DeleteWebhook`) matching the document's named
+ * operation per the R-NEW-37 W2 audit-point. Results parse through
+ * {@link webhookSchema} via `unwrapOrThrow` so payload drift surfaces
+ * `internal_error` with `details.issues`; null payloads surface
+ * `not_found` with `details.webhook_id` (or `details.board_id` for
+ * the list verb).
+ */
+import { z } from 'zod';
+import { unwrapOrThrow } from '../utils/parse-boundary.js';
+import { assertResponseFieldPresent } from './response-root.js';
+import { ApiError } from '../utils/errors.js';
+/**
+ * Monday's `WebhookEventType` enum vocabulary (empirical probe
+ * 2026-05-12, API `2026-01`; 21 values). Pinned at M27 pre-flight
+ * to close Decision 9 (webhook event-type validation). The CLI
+ * validates `webhook create --event <type>` against this closed
+ * list at parse boundary; unknown events surface `usage_error`
+ * before hitting the wire.
+ *
+ * Adding an event to Monday's wire surface is a minor (additive)
+ * bump for the CLI — extend this list and the per-command flag
+ * help. Renames or removals are a major version bump.
+ *
+ * The 21 values cover three event families (6 + 10 + 5 = 21):
+ *   - **Column-value + name-change events (6):** `change_column_value`,
+ *     `change_specific_column_value`, `change_status_column_value`,
+ *     `change_subitem_column_value`, `change_name`,
+ *     `change_subitem_name`.
+ *   - **Item / subitem lifecycle events (10):** `create_item`,
+ *     `create_subitem`, `item_archived`, `item_deleted`,
+ *     `item_moved_to_any_group`, `item_moved_to_specific_group`,
+ *     `item_restored`, `move_subitem`, `subitem_archived`,
+ *     `subitem_deleted`.
+ *   - **Update / column-management events (5):** `create_update`,
+ *     `create_subitem_update`, `edit_update`, `delete_update`,
+ *     `create_column`.
+ */
+export const WEBHOOK_EVENT_TYPES = [
+    'change_column_value',
+    'change_name',
+    'change_specific_column_value',
+    'change_status_column_value',
+    'change_subitem_column_value',
+    'change_subitem_name',
+    'create_column',
+    'create_item',
+    'create_subitem',
+    'create_subitem_update',
+    'create_update',
+    'delete_update',
+    'edit_update',
+    'item_archived',
+    'item_deleted',
+    'item_moved_to_any_group',
+    'item_moved_to_specific_group',
+    'item_restored',
+    'move_subitem',
+    'subitem_archived',
+    'subitem_deleted',
+];
+export const webhookEventTypeSchema = z.enum(WEBHOOK_EVENT_TYPES);
+/**
+ * The read-side `Webhook` shape returned by `Query.webhooks` and as
+ * the result of `create_webhook` / `delete_webhook` mutations.
+ *
+ * `config` is **nullable string** on read (Monday echoes the stored
+ * JSON-encoded config as a string; for events that don't carry
+ * server-side config, the field comes back `null`). The
+ * `create_webhook` arg is typed `JSON` (any valid JSON value); CLI
+ * input takes a JSON-encoded string and threads it to the wire
+ * via the `JSON` scalar.
+ */
+export const webhookSchema = z
+    .object({
+    id: z.string().min(1),
+    board_id: z.string().min(1),
+    event: webhookEventTypeSchema,
+    config: z.string().nullable(),
+})
+    .strict();
+/**
+ * Output shape for `monday webhook list <bid>` — an array of
+ * {@link Webhook} entries scoped to the supplied board. Pure read
+ * surface, no mutation envelope.
+ */
+export const webhookListOutputSchema = z.array(webhookSchema);
+/**
+ * Output shape for `monday webhook create <bid> --url <u>
+ * --event <e> [--config <json>]`. The mutation echoes the created
+ * `Webhook` (with the freshly-minted ID); we surface that record
+ * directly so an agent can pin the new `id` for a later
+ * `webhook delete <wid>`.
+ */
+export const webhookCreateOutputSchema = webhookSchema;
+/**
+ * Output shape for `monday webhook delete <wid> --yes`. Monday's
+ * `delete_webhook` returns the deleted `Webhook` record; the CLI
+ * surfaces that directly so an agent confirms what was removed
+ * (event / board / config). Re-deleting an already-deleted webhook
+ * surfaces `not_found` (matches the M10 `item delete` / M15
+ * `board delete` shape so agents key off one error code regardless
+ * of which delete verb they ran).
+ */
+export const webhookDeleteOutputSchema = webhookSchema;
+const LIST_WEBHOOKS_QUERY = `
+  query Webhooks($boardId: ID!) {
+    webhooks(board_id: $boardId) {
+      id
+      board_id
+      event
+      config
+    }
+  }
+`;
+const listWebhooksResponseSchema = z
+    .object({
+    webhooks: z.array(webhookSchema).nullable(),
+})
+    .loose();
+/**
+ * Fetches the webhooks configured on `inputs.boardId` via a single
+ * `Query.webhooks(board_id:)` round-trip. `operationName: 'Webhooks'`
+ * stays in sync with the named operation in {@link LIST_WEBHOOKS_QUERY}
+ * (R-NEW-37 W2 audit-point). Source is always `'live'` per cli-design
+ * §8 cache scope; webhooks aren't cached at v0.3.
+ *
+ * A null `webhooks` root surfaces `not_found` with `details.board_id`
+ * — matches the M10/M15 lifecycle verbs so agents key off one error
+ * code regardless of which read they ran.
+ */
+export const listWebhooks = async (inputs) => {
+    const response = await inputs.client.raw(LIST_WEBHOOKS_QUERY, { boardId: inputs.boardId }, { operationName: 'Webhooks' });
+    const parsed = unwrapOrThrow(listWebhooksResponseSchema.safeParse(response.data), {
+        context: 'Monday `Query.webhooks` response',
+        details: { board_id: inputs.boardId },
+        hint: 'Monday may have amended the `webhooks(board_id:)` selection — re-probe and amend `src/api/webhooks.ts` if so',
+    });
+    if (parsed.webhooks === null) {
+        throw new ApiError('not_found', `Monday returned no webhooks payload for board ${inputs.boardId}`, { details: { board_id: inputs.boardId } });
+    }
+    return {
+        webhooks: parsed.webhooks,
+        source: 'live',
+        cacheAgeSeconds: null,
+        complexity: response.complexity,
+    };
+};
+const CREATE_WEBHOOK_MUTATION = `
+  mutation CreateWebhook(
+    $boardId: ID!,
+    $url: String!,
+    $event: WebhookEventType!,
+    $config: JSON
+  ) {
+    create_webhook(
+      board_id: $boardId,
+      url: $url,
+      event: $event,
+      config: $config
+    ) {
+      id
+      board_id
+      event
+      config
+    }
+  }
+`;
+/**
+ * Registers a new webhook against Monday's `create_webhook` mutation.
+ * `operationName: 'CreateWebhook'` stays in sync with the named
+ * operation in {@link CREATE_WEBHOOK_MUTATION} (R-NEW-37 W2 audit-
+ * point). The `config` input crosses the wire as the `JSON` scalar
+ * when supplied — the caller threads any pre-parsed JSON value;
+ * when `inputs.config` is `undefined` the `$config` variable is
+ * omitted entirely so Monday's per-event server-side default
+ * applies (rather than overwriting with `null`). Per-event
+ * structural validation lives server-side at Monday.
+ *
+ * Re-running creates a fresh webhook with a new ID — `idempotent:
+ * false`. Agents needing register-once semantics should `webhook
+ * list` first and skip the create if a matching entry exists.
+ */
+export const createWebhook = async (inputs) => {
+    const variables = {
+        boardId: inputs.boardId,
+        url: inputs.url,
+        event: inputs.event,
+    };
+    if (inputs.config !== undefined) {
+        variables.config = inputs.config;
+    }
+    const response = await inputs.client.raw(CREATE_WEBHOOK_MUTATION, variables, { operationName: 'CreateWebhook' });
+    assertResponseFieldPresent({
+        data: response.data,
+        key: 'create_webhook',
+        operationLabel: 'CreateWebhook',
+        details: { board_id: inputs.boardId, event: inputs.event },
+        nullHandling: 'caller_handles',
+    });
+    const raw = response.data.create_webhook;
+    if (raw === null || raw === undefined) {
+        throw new ApiError('internal_error', `Monday returned no webhook payload from create_webhook for board ${inputs.boardId}`, {
+            details: {
+                board_id: inputs.boardId,
+                event: inputs.event,
+            },
+        });
+    }
+    const webhook = unwrapOrThrow(webhookSchema.safeParse(raw), {
+        context: 'Monday `create_webhook` response',
+        details: { board_id: inputs.boardId, event: inputs.event },
+        hint: 'Monday may have amended the `Webhook` selection — re-probe and amend `src/api/webhooks.ts` if so',
+    });
+    return {
+        webhook,
+        source: 'live',
+        cacheAgeSeconds: null,
+        complexity: response.complexity,
+    };
+};
+const DELETE_WEBHOOK_MUTATION = `
+  mutation DeleteWebhook($id: ID!) {
+    delete_webhook(id: $id) {
+      id
+      board_id
+      event
+      config
+    }
+  }
+`;
+/**
+ * Deletes a webhook via Monday's `delete_webhook` mutation.
+ * `operationName: 'DeleteWebhook'` stays in sync with the named
+ * operation in {@link DELETE_WEBHOOK_MUTATION} (R-NEW-37 W2 audit-
+ * point). Returns the deleted record so an agent confirms what was
+ * removed (event / board / config) in a single envelope.
+ *
+ * A null `delete_webhook` surfaces `not_found` with
+ * `details.webhook_id` (matches the M10/M15 lifecycle verbs so
+ * agents key off one error code regardless of which delete verb
+ * they ran).
+ */
+export const deleteWebhook = async (inputs) => {
+    const response = await inputs.client.raw(DELETE_WEBHOOK_MUTATION, { id: inputs.webhookId }, { operationName: 'DeleteWebhook' });
+    assertResponseFieldPresent({
+        data: response.data,
+        key: 'delete_webhook',
+        operationLabel: 'DeleteWebhook',
+        details: { webhook_id: inputs.webhookId },
+        nullHandling: 'caller_handles',
+    });
+    const raw = response.data.delete_webhook;
+    if (raw === null || raw === undefined) {
+        throw new ApiError('not_found', `Monday returned no webhook payload from delete_webhook for id ${inputs.webhookId}`, { details: { webhook_id: inputs.webhookId } });
+    }
+    const webhook = unwrapOrThrow(webhookSchema.safeParse(raw), {
+        context: 'Monday `delete_webhook` response',
+        details: { webhook_id: inputs.webhookId },
+        hint: 'Monday may have amended the `Webhook` selection — re-probe and amend `src/api/webhooks.ts` if so',
+    });
+    return {
+        webhook,
+        source: 'live',
+        cacheAgeSeconds: null,
+        complexity: response.complexity,
+    };
+};
+//# sourceMappingURL=webhooks.js.map

package/dist/api/webhooks.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"webhooks.js","sourceRoot":"","sources":["../../src/api/webhooks.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuEG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,aAAa,EAAE,MAAM,4BAA4B,CAAC;AAC3D,OAAO,EAAE,0BAA0B,EAAE,MAAM,oBAAoB,CAAC;AAChE,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAI9C;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG;IACjC,qBAAqB;IACrB,aAAa;IACb,8BAA8B;IAC9B,4BAA4B;IAC5B,6BAA6B;IAC7B,qBAAqB;IACrB,eAAe;IACf,aAAa;IACb,gBAAgB;IAChB,uBAAuB;IACvB,eAAe;IACf,eAAe;IACf,aAAa;IACb,eAAe;IACf,cAAc;IACd,yBAAyB;IACzB,8BAA8B;IAC9B,eAAe;IACf,cAAc;IACd,kBAAkB;IAClB,iBAAiB;CACT,CAAC;AAIX,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC;AAElE;;;;;;;;;;GAUG;AACH,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC;KAC3B,MAAM,CAAC;IACN,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACrB,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC3B,KAAK,EAAE,sBAAsB;IAC7B,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CAC9B,CAAC;KACD,MAAM,EAAE,CAAC;AAIZ;;;;GAIG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC;AAI9D;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAAG,aAAa,CAAC;AAIvD;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAAG,aAAa,CAAC;AAgBvD,MAAM,mBAAmB,GAAG;;;;;;;;;CAS3B,CAAC;AAEF,MAAM,0BAA0B,GAAG,CAAC;KACjC,MAAM,CAAC;IACN,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC,QAAQ,EAAE;CAC5C,CAAC;KACD,KAAK,EAAE,CAAC;AAEX;;;;;;;;;;GAUG;AACH,MAAM,CAAC,MAAM,YAAY,GAAG,KAAK,EAC/B,MAA0B,EACG,EAAE;IAC/B,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,GAAG,CACtC,mBAAmB,EACnB,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,EAC3B,EAAE,aAAa,EAAE,UAAU,EAAE,CAC9B,CAAC;IACF,MAAM,MAAM,GAAG,aAAa,CAC1B,0BAA0B,CAAC,SAAS,CAAC,QAAQ,CAAC,IAAI,CAAC,EACnD;QACE,OAAO,EAAE,kCAAkC;QAC3C,OAAO,EAAE,EAAE,QAAQ,EAAE,MAAM,CAAC,OAAO,EAAE;QACrC,IAAI,EAAE,8GAA8G;KACrH,CACF,CAAC;IACF,IAAI,MAAM,CAAC,QAAQ,KAAK,IAAI,EAAE,CAAC;QAC7B,MAAM,IAAI,QAAQ,CAChB,WAAW,EACX,iDAAiD,MAAM,CAAC,OAAO,EAAE,EACjE,EAAE,OAAO,EAAE,EAAE,QAAQ,EAAE,MAAM,CAAC,OAAO,EAAE,EAAE,CAC1C,CAAC;IACJ,CAAC;IACD,OAAO;QACL,QAAQ,EAAE,MAAM,CAAC,QAAQ;QACzB,MAAM,EAAE,MAAM;QACd,eAAe,EAAE,IAAI;QACrB,UAAU,EAAE,QAAQ,CAAC,UAAU;KAChC,CAAC;AACJ,CAAC,CAAC;AAyBF,MAAM,uBAAuB,GAAG;;;;;;;;;;;;;;;;;;;CAmB/B,CAAC;AAMF;;;;;;;;;;;;;;GAcG;AACH,MAAM,CAAC,MAAM,aAAa,GAAG,KAAK,EAChC,MAA2B,EACG,EAAE;IAChC,MAAM,SAAS,GAA4B;QACzC,OAAO,EAAE,MAAM,CAAC,OAAO;QACvB,GAAG,EAAE,MAAM,CAAC,GAAG;QACf,KAAK,EAAE,MAAM,CAAC,KAAK;KACpB,CAAC;IACF,IAAI,MAAM,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;QAChC,SAAS,CAAC,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC;IACnC,CAAC;IACD,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,GAAG,CACtC,uBAAuB,EACvB,SAAS,EACT,EAAE,aAAa,EAAE,eAAe,EAAE,CACnC,CAAC;IACF,0BAA0B,CAAC;QACzB,IAAI,EAAE,QAAQ,CAAC,IAAI;QACnB,GAAG,EAAE,gBAAgB;QACrB,cAAc,EAAE,eAAe;QAC/B,OAAO,EAAE,EAAE,QAAQ,EAAE,MAAM,CAAC,OAAO,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE;QAC1D,YAAY,EAAE,gBAAgB;KAC/B,CAAC,CAAC;IACH,MAAM,GAAG,GAAG,QAAQ,CAAC,IAAI,CAAC,cAAc,CAAC;IACzC,IAAI,GAAG,KAAK,IAAI,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;QACtC,MAAM,IAAI,QAAQ,CAChB,gBAAgB,EAChB,oEAAoE,MAAM,CAAC,OAAO,EAAE,EACpF;YACE,OAAO,EAAE;gBACP,QAAQ,EAAE,MAAM,CAAC,OAAO;gBACxB,KAAK,EAAE,MAAM,CAAC,KAAK;aACpB;SACF,CACF,CAAC;IACJ,CAAC;IACD,MAAM,OAAO,GAAG,aAAa,CAAC,aAAa,CAAC,SAAS,CAAC,GAAG,CAAC,EAAE;QAC1D,OAAO,EAAE,kCAAkC;QAC3C,OAAO,EAAE,EAAE,QAAQ,EAAE,MAAM,CAAC,OAAO,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE;QAC1D,IAAI,EAAE,kGAAkG;KACzG,CAAC,CAAC;IACH,OAAO;QACL,OAAO;QACP,MAAM,EAAE,MAAM;QACd,eAAe,EAAE,IAAI;QACrB,UAAU,EAAE,QAAQ,CAAC,UAAU;KAChC,CAAC;AACJ,CAAC,CAAC;AAcF,MAAM,uBAAuB,GAAG;;;;;;;;;CAS/B,CAAC;AAMF;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,MAAM,aAAa,GAAG,KAAK,EAChC,MAA2B,EACG,EAAE;IAChC,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,GAAG,CACtC,uBAAuB,EACvB,EAAE,EAAE,EAAE,MAAM,CAAC,SAAS,EAAE,EACxB,EAAE,aAAa,EAAE,eAAe,EAAE,CACnC,CAAC;IACF,0BAA0B,CAAC;QACzB,IAAI,EAAE,QAAQ,CAAC,IAAI;QACnB,GAAG,EAAE,gBAAgB;QACrB,cAAc,EAAE,eAAe;QAC/B,OAAO,EAAE,EAAE,UAAU,EAAE,MAAM,CAAC,SAAS,EAAE;QACzC,YAAY,EAAE,gBAAgB;KAC/B,CAAC,CAAC;IACH,MAAM,GAAG,GAAG,QAAQ,CAAC,IAAI,CAAC,cAAc,CAAC;IACzC,IAAI,GAAG,KAAK,IAAI,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;QACtC,MAAM,IAAI,QAAQ,CAChB,WAAW,EACX,iEAAiE,MAAM,CAAC,SAAS,EAAE,EACnF,EAAE,OAAO,EAAE,EAAE,UAAU,EAAE,MAAM,CAAC,SAAS,EAAE,EAAE,CAC9C,CAAC;IACJ,CAAC;IACD,MAAM,OAAO,GAAG,aAAa,CAAC,aAAa,CAAC,SAAS,CAAC,GAAG,CAAC,EAAE;QAC1D,OAAO,EAAE,kCAAkC;QAC3C,OAAO,EAAE,EAAE,UAAU,EAAE,MAAM,CAAC,SAAS,EAAE;QACzC,IAAI,EAAE,kGAAkG;KACzG,CAAC,CAAC;IACH,OAAO;QACL,OAAO;QACP,MAAM,EAAE,MAAM;QACd,eAAe,EAAE,IAAI;QACrB,UAAU,EAAE,QAAQ,CAAC,UAAU;KAChC,CAAC;AACJ,CAAC,CAAC"}

package/dist/cli/envelope-out.d.ts

@@ -85,8 +85,17 @@ export declare const createMetaBuilder: () => MetaBuilder;
  * file (Codex review §1 follow-up). `env` is shared by reference
  * with the runner; re-reading at emit time observes any side-
  * effecting load.
+ *
+ * `extraSecrets` carries the v0.3-M21 cli-design §7.4.3 redaction-
+ * runtime extension — `program.ts`'s preAction hook reads the
+ * credentials file once and pushes every per-profile `access_token`
+ * onto `ctx.runtimeSecrets`; callers thread that array through so a
+ * cached token landing in `Error.message` / `Error.stack` is scrubbed
+ * even when no env token is set (e.g., the credentials-cache-only
+ * flow where `monday auth login --profile work` is the user's only
+ * token source).
  */
-export declare const collectSecrets: (env: NodeJS.ProcessEnv) => readonly string[];
+export declare const collectSecrets: (env: NodeJS.ProcessEnv, extraSecrets?: readonly string[]) => readonly string[];
 export interface BuildBaseMetaInputs {
     readonly snapshot: MetaSnapshot;
     readonly env: NodeJS.ProcessEnv;
@@ -106,6 +115,14 @@ export interface WriteErrorEnvelopeOptions {
     readonly stderr: NodeJS.WritableStream;
     readonly env: NodeJS.ProcessEnv;
     readonly meta: Meta;
+    /**
+     * Extra literal secrets to scrub via the value-scan layer (cli-
+     * design §7.4.3). The runner threads `ctx.runtimeSecrets` here so
+     * a credentials-cache `access_token` that landed in an error's
+     * `cause`/`message` chain is scrubbed even when no env token is
+     * set.
+     */
+    readonly runtimeSecrets?: readonly string[];
 }
 /**
  * Renders the error envelope to `stderr` with two-layer redaction

package/dist/cli/envelope-out.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"envelope-out.d.ts","sourceRoot":"","sources":["../../src/cli/envelope-out.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkDG;AAGH,OAAO,EAGL,KAAK,UAAU,EACf,KAAK,IAAI,EACV,MAAM,6BAA6B,CAAC;AAErC,OAAO,EAEL,cAAc,EAEf,MAAM,oBAAoB,CAAC;AAE5B,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,UAAU,EAAE,MAAM,GAAG,SAAS,CAAC;IACxC,QAAQ,CAAC,MAAM,EAAE,UAAU,GAAG,SAAS,CAAC;CACzC;AAED,MAAM,WAAW,WAAW;IAC1B;;;;;;;OAOG;IACH,aAAa,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,IAAI,CAAC;IACzC;;;;;;OAMG;IACH,SAAS,EAAE,CAAC,MAAM,EAAE,UAAU,KAAK,IAAI,CAAC;IACxC,mDAAmD;IACnD,QAAQ,EAAE,MAAM,YAAY,CAAC;CAC9B;AAED,eAAO,MAAM,iBAAiB,QAAO,WAYpC,CAAC;AAEF;;;;;;;;GAQG;AACH,eAAO,MAAM,cAAc,GACzB,KAAK,MAAM,CAAC,UAAU,KACrB,SAAS,MAAM,EAOjB,CAAC;AAEF,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,QAAQ,EAAE,YAAY,CAAC;IAChC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC,UAAU,CAAC;IAChC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;CAC9B;AAED;;;;;;GAMG;AACH,eAAO,MAAM,aAAa,GAAI,QAAQ,mBAAmB,KAAG,IAWxD,CAAC;AAEL,MAAM,WAAW,yBAAyB;IACxC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC,cAAc,CAAC;IACvC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC,UAAU,CAAC;IAChC,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC;CACrB;AAED;;;;;GAKG;AACH,eAAO,MAAM,kBAAkB,GAC7B,KAAK,cAAc,EACnB,SAAS,yBAAyB,KACjC,IAMF,CAAC;AAKF;;;;;;;;;GASG;AACH,eAAO,MAAM,aAAa,GAAI,KAAK,OAAO,KAAG,cAoB5C,CAAC"}
+{"version":3,"file":"envelope-out.d.ts","sourceRoot":"","sources":["../../src/cli/envelope-out.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkDG;AAGH,OAAO,EAGL,KAAK,UAAU,EACf,KAAK,IAAI,EACV,MAAM,6BAA6B,CAAC;AAErC,OAAO,EAEL,cAAc,EAEf,MAAM,oBAAoB,CAAC;AAE5B,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,UAAU,EAAE,MAAM,GAAG,SAAS,CAAC;IACxC,QAAQ,CAAC,MAAM,EAAE,UAAU,GAAG,SAAS,CAAC;CACzC;AAED,MAAM,WAAW,WAAW;IAC1B;;;;;;;OAOG;IACH,aAAa,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,IAAI,CAAC;IACzC;;;;;;OAMG;IACH,SAAS,EAAE,CAAC,MAAM,EAAE,UAAU,KAAK,IAAI,CAAC;IACxC,mDAAmD;IACnD,QAAQ,EAAE,MAAM,YAAY,CAAC;CAC9B;AAED,eAAO,MAAM,iBAAiB,QAAO,WAYpC,CAAC;AAEF;;;;;;;;;;;;;;;;;GAiBG;AACH,eAAO,MAAM,cAAc,GACzB,KAAK,MAAM,CAAC,UAAU,EACtB,eAAc,SAAS,MAAM,EAAO,KACnC,SAAS,MAAM,EAYjB,CAAC;AAEF,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,QAAQ,EAAE,YAAY,CAAC;IAChC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC,UAAU,CAAC;IAChC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;CAC9B;AAED;;;;;;GAMG;AACH,eAAO,MAAM,aAAa,GAAI,QAAQ,mBAAmB,KAAG,IAWxD,CAAC;AAEL,MAAM,WAAW,yBAAyB;IACxC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC,cAAc,CAAC;IACvC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC,UAAU,CAAC;IAChC,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC;IACpB;;;;;;OAMG;IACH,QAAQ,CAAC,cAAc,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CAC7C;AAED;;;;;GAKG;AACH,eAAO,MAAM,kBAAkB,GAC7B,KAAK,cAAc,EACnB,SAAS,yBAAyB,KACjC,IAMF,CAAC;AAKF;;;;;;;;;GASG;AACH,eAAO,MAAM,aAAa,GAAI,KAAK,OAAO,KAAG,cAoB5C,CAAC"}

package/dist/cli/envelope-out.js

@@ -74,13 +74,27 @@ export const createMetaBuilder = () => {
  * file (Codex review §1 follow-up). `env` is shared by reference
  * with the runner; re-reading at emit time observes any side-
  * effecting load.
+ *
+ * `extraSecrets` carries the v0.3-M21 cli-design §7.4.3 redaction-
+ * runtime extension — `program.ts`'s preAction hook reads the
+ * credentials file once and pushes every per-profile `access_token`
+ * onto `ctx.runtimeSecrets`; callers thread that array through so a
+ * cached token landing in `Error.message` / `Error.stack` is scrubbed
+ * even when no env token is set (e.g., the credentials-cache-only
+ * flow where `monday auth login --profile work` is the user's only
+ * token source).
  */
-export const collectSecrets = (env) => {
+export const collectSecrets = (env, extraSecrets = []) => {
     const out = [];
     const token = env.MONDAY_API_TOKEN;
     if (token !== undefined && token.length > 0) {
         out.push(token);
     }
+    for (const extra of extraSecrets) {
+        if (extra.length > 0) {
+            out.push(extra);
+        }
+    }
     return out;
 };
 /**
@@ -109,7 +123,7 @@ export const buildBaseMeta = (inputs) => buildMeta({
 export const writeErrorEnvelope = (err, options) => {
     const envelope = buildError(err, options.meta);
     const redacted = redact(envelope, {
-        secrets: collectSecrets(options.env),
+        secrets: collectSecrets(options.env, options.runtimeSecrets),
     });
     options.stderr.write(`${JSON.stringify(redacted, null, 2)}\n`);
 };

package/dist/cli/envelope-out.js.map

@@ -1 +1 @@
-{"version":3,"file":"envelope-out.js","sourceRoot":"","sources":["../../src/cli/envelope-out.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkDG;AAEH,OAAO,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC;AAC3C,OAAO,EACL,UAAU,EACV,SAAS,GAGV,MAAM,6BAA6B,CAAC;AACrC,OAAO,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAC5C,OAAO,EACL,aAAa,EACb,cAAc,EACd,UAAU,GACX,MAAM,oBAAoB,CAAC;AA6B5B,MAAM,CAAC,MAAM,iBAAiB,GAAG,GAAgB,EAAE;IACjD,IAAI,UAA8B,CAAC;IACnC,IAAI,MAA8B,CAAC;IACnC,OAAO;QACL,aAAa,EAAE,CAAC,CAAC,EAAE,EAAE;YACnB,UAAU,GAAG,CAAC,CAAC;QACjB,CAAC;QACD,SAAS,EAAE,CAAC,CAAC,EAAE,EAAE;YACf,MAAM,GAAG,CAAC,CAAC;QACb,CAAC;QACD,QAAQ,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,UAAU,EAAE,MAAM,EAAE,CAAC;KACzC,CAAC;AACJ,CAAC,CAAC;AAEF;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG,CAC5B,GAAsB,EACH,EAAE;IACrB,MAAM,GAAG,GAAa,EAAE,CAAC;IACzB,MAAM,KAAK,GAAG,GAAG,CAAC,gBAAgB,CAAC;IACnC,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC5C,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAClB,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC,CAAC;AAUF;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,MAA2B,EAAQ,EAAE,CACjE,SAAS,CAAC;IACR,WAAW,EACT,MAAM,CAAC,QAAQ,CAAC,UAAU;QAC1B,MAAM,CAAC,GAAG,CAAC,kBAAkB;QAC7B,SAAS;IACX,WAAW,EAAE,MAAM,CAAC,UAAU;IAC9B,UAAU,EAAE,MAAM,CAAC,SAAS;IAC5B,MAAM,EAAE,MAAM,CAAC,QAAQ,CAAC,MAAM,IAAI,MAAM;IACxC,YAAY,EAAE,MAAM,CAAC,WAAW;IAChC,iBAAiB,EAAE,IAAI;CACxB,CAAC,CAAC;AAQL;;;;;GAKG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAChC,GAAmB,EACnB,OAAkC,EAC5B,EAAE;IACR,MAAM,QAAQ,GAAG,UAAU,CAAC,GAAG,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC;IAC/C,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,EAAE;QAChC,OAAO,EAAE,cAAc,CAAC,OAAO,CAAC,GAAG,CAAC;KACrC,CAAC,CAAC;IACH,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC;AACjE,CAAC,CAAC;AAEF,MAAM,gBAAgB,GAAG,CAAC,GAAY,EAAyB,EAAE,CAC/D,GAAG,YAAY,cAAc,CAAC;AAEhC;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,GAAY,EAAkB,EAAE;IAC5D,IAAI,GAAG,YAAY,cAAc,EAAE,CAAC;QAClC,OAAO,GAAG,CAAC;IACb,CAAC;IACD,IAAI,gBAAgB,CAAC,GAAG,CAAC,EAAE,CAAC;QAC1B,gEAAgE;QAChE,8DAA8D;QAC9D,iEAAiE;QACjE,IACE,GAAG,CAAC,IAAI,KAAK,yBAAyB;YACtC,GAAG,CAAC,IAAI,KAAK,mBAAmB,EAChC,CAAC;YACD,OAAO,IAAI,aAAa,CAAC,iCAAiC,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC;QACxE,CAAC;QACD,OAAO,IAAI,UAAU,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IACrC,CAAC;IACD,IAAI,GAAG,YAAY,KAAK,EAAE,CAAC;QACzB,OAAO,IAAI,aAAa,CAAC,GAAG,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC;IACxD,CAAC;IACD,OAAO,IAAI,aAAa,CAAC,eAAe,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC;AAC5D,CAAC,CAAC"}
+{"version":3,"file":"envelope-out.js","sourceRoot":"","sources":["../../src/cli/envelope-out.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkDG;AAEH,OAAO,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC;AAC3C,OAAO,EACL,UAAU,EACV,SAAS,GAGV,MAAM,6BAA6B,CAAC;AACrC,OAAO,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAC5C,OAAO,EACL,aAAa,EACb,cAAc,EACd,UAAU,GACX,MAAM,oBAAoB,CAAC;AA6B5B,MAAM,CAAC,MAAM,iBAAiB,GAAG,GAAgB,EAAE;IACjD,IAAI,UAA8B,CAAC;IACnC,IAAI,MAA8B,CAAC;IACnC,OAAO;QACL,aAAa,EAAE,CAAC,CAAC,EAAE,EAAE;YACnB,UAAU,GAAG,CAAC,CAAC;QACjB,CAAC;QACD,SAAS,EAAE,CAAC,CAAC,EAAE,EAAE;YACf,MAAM,GAAG,CAAC,CAAC;QACb,CAAC;QACD,QAAQ,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,UAAU,EAAE,MAAM,EAAE,CAAC;KACzC,CAAC;AACJ,CAAC,CAAC;AAEF;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG,CAC5B,GAAsB,EACtB,eAAkC,EAAE,EACjB,EAAE;IACrB,MAAM,GAAG,GAAa,EAAE,CAAC;IACzB,MAAM,KAAK,GAAG,GAAG,CAAC,gBAAgB,CAAC;IACnC,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC5C,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAClB,CAAC;IACD,KAAK,MAAM,KAAK,IAAI,YAAY,EAAE,CAAC;QACjC,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACrB,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAClB,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC,CAAC;AAUF;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,MAA2B,EAAQ,EAAE,CACjE,SAAS,CAAC;IACR,WAAW,EACT,MAAM,CAAC,QAAQ,CAAC,UAAU;QAC1B,MAAM,CAAC,GAAG,CAAC,kBAAkB;QAC7B,SAAS;IACX,WAAW,EAAE,MAAM,CAAC,UAAU;IAC9B,UAAU,EAAE,MAAM,CAAC,SAAS;IAC5B,MAAM,EAAE,MAAM,CAAC,QAAQ,CAAC,MAAM,IAAI,MAAM;IACxC,YAAY,EAAE,MAAM,CAAC,WAAW;IAChC,iBAAiB,EAAE,IAAI;CACxB,CAAC,CAAC;AAgBL;;;;;GAKG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAChC,GAAmB,EACnB,OAAkC,EAC5B,EAAE;IACR,MAAM,QAAQ,GAAG,UAAU,CAAC,GAAG,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC;IAC/C,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,EAAE;QAChC,OAAO,EAAE,cAAc,CAAC,OAAO,CAAC,GAAG,EAAE,OAAO,CAAC,cAAc,CAAC;KAC7D,CAAC,CAAC;IACH,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC;AACjE,CAAC,CAAC;AAEF,MAAM,gBAAgB,GAAG,CAAC,GAAY,EAAyB,EAAE,CAC/D,GAAG,YAAY,cAAc,CAAC;AAEhC;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,GAAY,EAAkB,EAAE;IAC5D,IAAI,GAAG,YAAY,cAAc,EAAE,CAAC;QAClC,OAAO,GAAG,CAAC;IACb,CAAC;IACD,IAAI,gBAAgB,CAAC,GAAG,CAAC,EAAE,CAAC;QAC1B,gEAAgE;QAChE,8DAA8D;QAC9D,iEAAiE;QACjE,IACE,GAAG,CAAC,IAAI,KAAK,yBAAyB;YACtC,GAAG,CAAC,IAAI,KAAK,mBAAmB,EAChC,CAAC;YACD,OAAO,IAAI,aAAa,CAAC,iCAAiC,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC;QACxE,CAAC;QACD,OAAO,IAAI,UAAU,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IACrC,CAAC;IACD,IAAI,GAAG,YAAY,KAAK,EAAE,CAAC;QACzB,OAAO,IAAI,aAAa,CAAC,GAAG,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC;IACxD,CAAC;IACD,OAAO,IAAI,aAAa,CAAC,eAAe,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC;AAC5D,CAAC,CAAC"}

package/dist/cli/program.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"program.d.ts","sourceRoot":"","sources":["../../src/cli/program.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAIpC,OAAO,KAAK,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,UAAU,CAAC;AAEvD;;;;;GAKG;AACH,MAAM,MAAM,mBAAmB,GAAG,IAAI,CACpC,UAAU,EACR,YAAY,GACZ,gBAAgB,GAChB,QAAQ,GACR,QAAQ,GACR,eAAe,GACf,kBAAkB,CACrB,CAAC;AAEF,eAAO,MAAM,YAAY,GACvB,SAAS,mBAAmB,EAC5B,KAAK,UAAU,KACd,OAyFF,CAAC"}
+{"version":3,"file":"program.d.ts","sourceRoot":"","sources":["../../src/cli/program.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAYpC,OAAO,KAAK,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,UAAU,CAAC;AAEvD;;;;;GAKG;AACH,MAAM,MAAM,mBAAmB,GAAG,IAAI,CACpC,UAAU,EACR,YAAY,GACZ,gBAAgB,GAChB,QAAQ,GACR,QAAQ,GACR,eAAe,GACf,kBAAkB,CACrB,CAAC;AAEF,eAAO,MAAM,YAAY,GACvB,SAAS,mBAAmB,EAC5B,KAAK,UAAU,KACd,OA+NF,CAAC"}

package/dist/cli/program.js

@@ -20,6 +20,8 @@ import { Command } from 'commander';
 import { getCommandRegistry } from '../commands/index.js';
 import { parseGlobalFlags } from '../types/global-flags.js';
 import { PINNED_API_VERSION } from '../api/client.js';
+import { loadProfilesConfig, selectProfile, } from '../config/profiles.js';
+import { readCredentials, resolveProfileToken, } from '../config/credentials.js';
 export const buildProgram = (options, ctx) => {
     const program = new Command();
     program
@@ -90,7 +92,7 @@ export const buildProgram = (options, ctx) => {
     // > SDK pin. We don't load config here (that surfaces a separate
     // `config_error` if the token is missing); the apiVersion override
     // is independent of token resolution.
-    program.hook('preAction', () => {
+    program.hook('preAction', async (_thisCommand, actionCommand) => {
         try {
             const flags = parseGlobalFlags(program.opts(), ctx.env);
             const resolvedVersion = flags.apiVersion ??
@@ -103,6 +105,123 @@ export const buildProgram = (options, ctx) => {
             // runner's catch-all will surface; the preAction hook just
             // tries best-effort.
         }
+        // Redaction-runtime extension per cli-design §7.4.3 (v0.3-M21).
+        // Reads the credentials file once and folds every per-profile
+        // `access_token` into `ctx.runtimeSecrets` so any unkeyed string
+        // occurrence (e.g., a cached token landing in `Error.message` /
+        // `Error.stack`) is scrubbed by the value-scan layer in
+        // `redact()`. Runs for EVERY command including auth verbs — an
+        // auth-login failure may surface a token in cause/stack, and the
+        // M21 canary leak-test discipline requires the secret-bag to be
+        // populated for those paths too. Auth verbs ARE exempt from the
+        // profile-resolution step below, but the redaction read runs
+        // first because it's profile-independent.
+        //
+        // Scrubs every profile's token, not just the active one — an
+        // agent running with `--profile work` may have a stale
+        // `personal` entry that mustn't leak either.
+        //
+        // **Best-effort redaction preload** (fail-open posture): a
+        // credentials-read failure (insecure permissions, malformed
+        // file, schema mismatch) is swallowed here so the command can
+        // continue. The value-scan layer then falls back to env-only
+        // secrets — cached tokens are NOT scrubbed via runtimeSecrets
+        // on this path, but the key-based filter still strips
+        // `access_token` keys + `Authorization` etc., and the real
+        // read failure surfaces as `config_error` via the later
+        // credentials consumer (`resolveProfileToken` for non-auth
+        // verbs; `setProfileCredentials` / `deleteProfileCredentials`
+        // for auth verbs). The deliberate fail-open choice trades a
+        // narrow "cached token byte-string leaked via unkeyed
+        // Error.message before config_error surfaces" risk for a
+        // safer "command always proceeds to a typed-error envelope"
+        // contract. Codex M21 Part 2 review pinned the wording.
+        const home = ctx.env.HOME !== undefined && ctx.env.HOME.length > 0
+            ? ctx.env.HOME
+            : undefined;
+        const homeOptions = home !== undefined ? { home, env: ctx.env } : { env: ctx.env };
+        try {
+            const credentials = await readCredentials(homeOptions);
+            if (credentials !== undefined) {
+                for (const entry of Object.values(credentials.profiles)) {
+                    ctx.runtimeSecrets.push(entry.access_token);
+                }
+            }
+        }
+        catch {
+            // intentionally swallowed — see above.
+        }
+        // Profile resolution per cli-design §7.2 / §7.4 (v0.3-M21).
+        // Skipped for `auth login` / `auth logout` — those verbs are the
+        // source of credentials, not consumers; running profile
+        // resolution against a fresh-install (no token anywhere yet)
+        // would surface `config_error` BEFORE the login command had a
+        // chance to populate the cache.
+        const parent = actionCommand.parent;
+        if (parent !== null && parent.name() === 'auth') {
+            return;
+        }
+        let profileFlag;
+        try {
+            profileFlag = parseGlobalFlags(program.opts(), ctx.env).profile;
+        }
+        catch {
+            // Defensive: a global-flag parse failure already surfaced via the
+            // earlier api-version commit's catch; duplicate guard keeps
+            // profile resolution skipped on that path.
+            /* c8 ignore next */
+            return;
+        }
+        const envProfile = ctx.env.MONDAY_PROFILE !== undefined &&
+            ctx.env.MONDAY_PROFILE.length > 0
+            ? ctx.env.MONDAY_PROFILE
+            : undefined;
+        // Reuses the `homeOptions` resolved above for the redaction-
+        // runtime extension — same HOME-discovery shape, same env
+        // threading. Reading a non-existent config file is cheap (single
+        // ENOENT) so the implicit-v1 path doesn't pay for the I/O.
+        const config = await loadProfilesConfig(homeOptions);
+        if (profileFlag === undefined &&
+            envProfile === undefined &&
+            config?.default_profile === undefined) {
+            // Implicit-v1 path — no profile resolution needed; commands
+            // read MONDAY_API_TOKEN directly via loadConfig.
+            return;
+        }
+        const selection = selectProfile({
+            flag: profileFlag,
+            env: ctx.env,
+            config,
+        });
+        // Unreachable type-narrowing guard: by the time we pass the early-
+        // return above, at least one of flag/env/default_profile is set,
+        // so selectProfile returns 'named'. The guard exists to keep the
+        // union type safe.
+        /* c8 ignore start */
+        if (selection.mode === 'implicit_v1') {
+            return;
+        }
+        /* c8 ignore stop */
+        const resolved = await resolveProfileToken({
+            profileName: selection.name,
+            apiTokenEnvName: selection.entry.api_token_env,
+        }, homeOptions);
+        // Inject the resolved token into ctx.env so downstream
+        // `loadConfig`/`resolveClient` calls pick it up via the standard
+        // MONDAY_API_TOKEN env path. This is the M21 wiring contract;
+        // profile resolution is a one-shot transformation that replaces
+        // the env's token slot with the per-profile resolved value.
+        ctx.env.MONDAY_API_TOKEN = resolved.token;
+        // Profile-level api_version override (cli-design §7.2). The
+        // global `--api-version` flag still wins (already committed
+        // above); this fills the env slot so loadConfig sees it.
+        if (selection.entry.api_version !== undefined) {
+            const flags = parseGlobalFlags(program.opts(), ctx.env);
+            if (flags.apiVersion === undefined) {
+                ctx.env.MONDAY_API_VERSION = selection.entry.api_version;
+                ctx.meta.setApiVersion(selection.entry.api_version);
+            }
+        }
     });
     return program;
 };

package/dist/cli/program.js.map

@@ -1 +1 @@
-{"version":3,"file":"program.js","sourceRoot":"","sources":["../../src/cli/program.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAC;AAC1D,OAAO,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAC;AAC5D,OAAO,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;AAmBtD,MAAM,CAAC,MAAM,YAAY,GAAG,CAC1B,OAA4B,EAC5B,GAAe,EACN,EAAE;IACX,MAAM,OAAO,GAAG,IAAI,OAAO,EAAE,CAAC;IAC9B,OAAO;SACJ,IAAI,CAAC,QAAQ,CAAC;SACd,WAAW,CAAC,OAAO,CAAC,cAAc,IAAI,oBAAoB,CAAC;SAC3D,OAAO,CAAC,OAAO,CAAC,UAAU,EAAE,eAAe,CAAC;SAC5C,YAAY,EAAE;SACd,eAAe,CAAC;QACf,QAAQ,EAAE,CAAC,GAAG,EAAE,EAAE;YAChB,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC5B,CAAC;QACD,QAAQ,EAAE,CAAC,GAAG,EAAE,EAAE;YAChB,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC5B,CAAC;QACD,+DAA+D;QAC/D,4DAA4D;QAC5D,2DAA2D;QAC3D,2DAA2D;QAC3D,6CAA6C;QAC7C,WAAW,EAAE,GAAG,EAAE;YAChB,sBAAsB;QACxB,CAAC;KACF,CAAC,CAAC;IAEL,mEAAmE;IACnE,+DAA+D;IAC/D,gEAAgE;IAChE,iCAAiC;IACjC,OAAO;SACJ,MAAM,CAAC,gBAAgB,EAAE,8BAA8B,CAAC;SACxD,MAAM,CAAC,QAAQ,EAAE,6BAA6B,CAAC;SAC/C,MAAM,CAAC,SAAS,EAAE,8BAA8B,CAAC;SACjD,MAAM,CAAC,QAAQ,EAAE,gCAAgC,CAAC;SAClD,MAAM,CAAC,aAAa,EAAE,qCAAqC,CAAC;SAC5D,MAAM,CAAC,kBAAkB,EAAE,iCAAiC,CAAC;SAC7D,MAAM,CAAC,WAAW,EAAE,qCAAqC,CAAC;SAC1D,MAAM,CAAC,aAAa,EAAE,oCAAoC,CAAC;SAC3D,MAAM,CAAC,eAAe,EAAE,wCAAwC,CAAC;SACjE,MAAM,CAAC,YAAY,EAAE,uBAAuB,CAAC;SAC7C,MAAM,CAAC,YAAY,EAAE,qCAAqC,CAAC;SAC3D,MAAM,CAAC,kBAAkB,EAAE,gDAAgD,CAAC;SAC5E,MAAM,CAAC,mBAAmB,EAAE,iCAAiC,CAAC;SAC9D,MAAM,CAAC,gBAAgB,EAAE,qCAAqC,CAAC;SAC/D,MAAM,CAAC,aAAa,EAAE,iCAAiC,CAAC;SACxD,MAAM,CAAC,WAAW,EAAE,iDAAiD,CAAC;SACtE,MAAM,CAAC,WAAW,EAAE,2CAA2C,CAAC;SAChE,MAAM,CAAC,oBAAoB,EAAE,kDAAkD,CAAC,CAAC;IAEpF,kEAAkE;IAClE,iEAAiE;IACjE,mEAAmE;IACnE,gEAAgE;IAChE,mBAAmB;IACnB,MAAM,OAAO,GAAG,OAAO,CAAC,aAAa,IAAI,kBAAkB,EAAE,CAAC;IAC9D,KAAK,MAAM,GAAG,IAAI,OAAO,EAAE,CAAC;QAC1B,GAAG,CAAC,MAAM,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;IAC3B,CAAC;IACD,OAAO,CAAC,gBAAgB,EAAE,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;IAEzC,iEAAiE;IACjE,8DAA8D;IAC9D,iEAAiE;IACjE,+DAA+D;IAC/D,kEAAkE;IAClE,mEAAmE;IACnE,mEAAmE;IACnE,0DAA0D;IAC1D,sDAAsD;IACtD,EAAE;IACF,mEAAmE;IACnE,iEAAiE;IACjE,mEAAmE;IACnE,sCAAsC;IACtC,OAAO,CAAC,IAAI,CAAC,WAAW,EAAE,GAAG,EAAE;QAC7B,IAAI,CAAC;YACH,MAAM,KAAK,GAAG,gBAAgB,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,GAAG,CAAC,GAAG,CAAC,CAAC;YACxD,MAAM,eAAe,GACnB,KAAK,CAAC,UAAU;gBAChB,GAAG,CAAC,GAAG,CAAC,kBAAkB;gBAC1B,kBAAkB,CAAC;YACrB,GAAG,CAAC,IAAI,CAAC,aAAa,CAAC,eAAe,CAAC,CAAC;QAC1C,CAAC;QAAC,MAAM,CAAC;YACP,0DAA0D;YAC1D,2DAA2D;YAC3D,qBAAqB;QACvB,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,OAAO,OAAO,CAAC;AACjB,CAAC,CAAC"}
+{"version":3,"file":"program.js","sourceRoot":"","sources":["../../src/cli/program.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAC;AAC1D,OAAO,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAC;AAC5D,OAAO,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;AACtD,OAAO,EACL,kBAAkB,EAClB,aAAa,GACd,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EACL,eAAe,EACf,mBAAmB,GACpB,MAAM,0BAA0B,CAAC;AAmBlC,MAAM,CAAC,MAAM,YAAY,GAAG,CAC1B,OAA4B,EAC5B,GAAe,EACN,EAAE;IACX,MAAM,OAAO,GAAG,IAAI,OAAO,EAAE,CAAC;IAC9B,OAAO;SACJ,IAAI,CAAC,QAAQ,CAAC;SACd,WAAW,CAAC,OAAO,CAAC,cAAc,IAAI,oBAAoB,CAAC;SAC3D,OAAO,CAAC,OAAO,CAAC,UAAU,EAAE,eAAe,CAAC;SAC5C,YAAY,EAAE;SACd,eAAe,CAAC;QACf,QAAQ,EAAE,CAAC,GAAG,EAAE,EAAE;YAChB,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC5B,CAAC;QACD,QAAQ,EAAE,CAAC,GAAG,EAAE,EAAE;YAChB,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC5B,CAAC;QACD,+DAA+D;QAC/D,4DAA4D;QAC5D,2DAA2D;QAC3D,2DAA2D;QAC3D,6CAA6C;QAC7C,WAAW,EAAE,GAAG,EAAE;YAChB,sBAAsB;QACxB,CAAC;KACF,CAAC,CAAC;IAEL,mEAAmE;IACnE,+DAA+D;IAC/D,gEAAgE;IAChE,iCAAiC;IACjC,OAAO;SACJ,MAAM,CAAC,gBAAgB,EAAE,8BAA8B,CAAC;SACxD,MAAM,CAAC,QAAQ,EAAE,6BAA6B,CAAC;SAC/C,MAAM,CAAC,SAAS,EAAE,8BAA8B,CAAC;SACjD,MAAM,CAAC,QAAQ,EAAE,gCAAgC,CAAC;SAClD,MAAM,CAAC,aAAa,EAAE,qCAAqC,CAAC;SAC5D,MAAM,CAAC,kBAAkB,EAAE,iCAAiC,CAAC;SAC7D,MAAM,CAAC,WAAW,EAAE,qCAAqC,CAAC;SAC1D,MAAM,CAAC,aAAa,EAAE,oCAAoC,CAAC;SAC3D,MAAM,CAAC,eAAe,EAAE,wCAAwC,CAAC;SACjE,MAAM,CAAC,YAAY,EAAE,uBAAuB,CAAC;SAC7C,MAAM,CAAC,YAAY,EAAE,qCAAqC,CAAC;SAC3D,MAAM,CAAC,kBAAkB,EAAE,gDAAgD,CAAC;SAC5E,MAAM,CAAC,mBAAmB,EAAE,iCAAiC,CAAC;SAC9D,MAAM,CAAC,gBAAgB,EAAE,qCAAqC,CAAC;SAC/D,MAAM,CAAC,aAAa,EAAE,iCAAiC,CAAC;SACxD,MAAM,CAAC,WAAW,EAAE,iDAAiD,CAAC;SACtE,MAAM,CAAC,WAAW,EAAE,2CAA2C,CAAC;SAChE,MAAM,CAAC,oBAAoB,EAAE,kDAAkD,CAAC,CAAC;IAEpF,kEAAkE;IAClE,iEAAiE;IACjE,mEAAmE;IACnE,gEAAgE;IAChE,mBAAmB;IACnB,MAAM,OAAO,GAAG,OAAO,CAAC,aAAa,IAAI,kBAAkB,EAAE,CAAC;IAC9D,KAAK,MAAM,GAAG,IAAI,OAAO,EAAE,CAAC;QAC1B,GAAG,CAAC,MAAM,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;IAC3B,CAAC;IACD,OAAO,CAAC,gBAAgB,EAAE,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;IAEzC,iEAAiE;IACjE,8DAA8D;IAC9D,iEAAiE;IACjE,+DAA+D;IAC/D,kEAAkE;IAClE,mEAAmE;IACnE,mEAAmE;IACnE,0DAA0D;IAC1D,sDAAsD;IACtD,EAAE;IACF,mEAAmE;IACnE,iEAAiE;IACjE,mEAAmE;IACnE,sCAAsC;IACtC,OAAO,CAAC,IAAI,CAAC,WAAW,EAAE,KAAK,EAAE,YAAY,EAAE,aAAa,EAAE,EAAE;QAC9D,IAAI,CAAC;YACH,MAAM,KAAK,GAAG,gBAAgB,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,GAAG,CAAC,GAAG,CAAC,CAAC;YACxD,MAAM,eAAe,GACnB,KAAK,CAAC,UAAU;gBAChB,GAAG,CAAC,GAAG,CAAC,kBAAkB;gBAC1B,kBAAkB,CAAC;YACrB,GAAG,CAAC,IAAI,CAAC,aAAa,CAAC,eAAe,CAAC,CAAC;QAC1C,CAAC;QAAC,MAAM,CAAC;YACP,0DAA0D;YAC1D,2DAA2D;YAC3D,qBAAqB;QACvB,CAAC;QAED,gEAAgE;QAChE,8DAA8D;QAC9D,iEAAiE;QACjE,gEAAgE;QAChE,wDAAwD;QACxD,+DAA+D;QAC/D,iEAAiE;QACjE,gEAAgE;QAChE,gEAAgE;QAChE,6DAA6D;QAC7D,0CAA0C;QAC1C,EAAE;QACF,6DAA6D;QAC7D,uDAAuD;QACvD,6CAA6C;QAC7C,EAAE;QACF,2DAA2D;QAC3D,4DAA4D;QAC5D,8DAA8D;QAC9D,6DAA6D;QAC7D,8DAA8D;QAC9D,sDAAsD;QACtD,2DAA2D;QAC3D,wDAAwD;QACxD,2DAA2D;QAC3D,8DAA8D;QAC9D,4DAA4D;QAC5D,sDAAsD;QACtD,yDAAyD;QACzD,4DAA4D;QAC5D,wDAAwD;QACxD,MAAM,IAAI,GACR,GAAG,CAAC,GAAG,CAAC,IAAI,KAAK,SAAS,IAAI,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC;YACnD,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI;YACd,CAAC,CAAC,SAAS,CAAC;QAChB,MAAM,WAAW,GACf,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,GAAG,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,GAAG,CAAC,GAAG,EAAE,CAAC;QAEjE,IAAI,CAAC;YACH,MAAM,WAAW,GAAG,MAAM,eAAe,CAAC,WAAW,CAAC,CAAC;YACvD,IAAI,WAAW,KAAK,SAAS,EAAE,CAAC;gBAC9B,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC,QAAQ,CAAC,EAAE,CAAC;oBACxD,GAAG,CAAC,cAAc,CAAC,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;gBAC9C,CAAC;YACH,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,uCAAuC;QACzC,CAAC;QAED,4DAA4D;QAC5D,iEAAiE;QACjE,wDAAwD;QACxD,6DAA6D;QAC7D,8DAA8D;QAC9D,gCAAgC;QAChC,MAAM,MAAM,GAAG,aAAa,CAAC,MAAM,CAAC;QACpC,IAAI,MAAM,KAAK,IAAI,IAAI,MAAM,CAAC,IAAI,EAAE,KAAK,MAAM,EAAE,CAAC;YAChD,OAAO;QACT,CAAC;QAED,IAAI,WAA+B,CAAC;QACpC,IAAI,CAAC;YACH,WAAW,GAAG,gBAAgB,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,GAAG,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC;QAClE,CAAC;QAAC,MAAM,CAAC;YACP,kEAAkE;YAClE,4DAA4D;YAC5D,2CAA2C;YAC3C,oBAAoB;YACpB,OAAO;QACT,CAAC;QACD,MAAM,UAAU,GACd,GAAG,CAAC,GAAG,CAAC,cAAc,KAAK,SAAS;YACpC,GAAG,CAAC,GAAG,CAAC,cAAc,CAAC,MAAM,GAAG,CAAC;YAC/B,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,cAAc;YACxB,CAAC,CAAC,SAAS,CAAC;QAEhB,6DAA6D;QAC7D,0DAA0D;QAC1D,iEAAiE;QACjE,2DAA2D;QAC3D,MAAM,MAAM,GAAG,MAAM,kBAAkB,CAAC,WAAW,CAAC,CAAC;QAErD,IACE,WAAW,KAAK,SAAS;YACzB,UAAU,KAAK,SAAS;YACxB,MAAM,EAAE,eAAe,KAAK,SAAS,EACrC,CAAC;YACD,4DAA4D;YAC5D,iDAAiD;YACjD,OAAO;QACT,CAAC;QAED,MAAM,SAAS,GAAG,aAAa,CAAC;YAC9B,IAAI,EAAE,WAAW;YACjB,GAAG,EAAE,GAAG,CAAC,GAAG;YACZ,MAAM;SACP,CAAC,CAAC;QAEH,mEAAmE;QACnE,iEAAiE;QACjE,iEAAiE;QACjE,mBAAmB;QACnB,qBAAqB;QACrB,IAAI,SAAS,CAAC,IAAI,KAAK,aAAa,EAAE,CAAC;YACrC,OAAO;QACT,CAAC;QACD,oBAAoB;QAEpB,MAAM,QAAQ,GAAG,MAAM,mBAAmB,CACxC;YACE,WAAW,EAAE,SAAS,CAAC,IAAI;YAC3B,eAAe,EAAE,SAAS,CAAC,KAAK,CAAC,aAAa;SAC/C,EACD,WAAW,CACZ,CAAC;QAEF,uDAAuD;QACvD,iEAAiE;QACjE,8DAA8D;QAC9D,gEAAgE;QAChE,4DAA4D;QAC5D,GAAG,CAAC,GAAG,CAAC,gBAAgB,GAAG,QAAQ,CAAC,KAAK,CAAC;QAE1C,4DAA4D;QAC5D,4DAA4D;QAC5D,yDAAyD;QACzD,IAAI,SAAS,CAAC,KAAK,CAAC,WAAW,KAAK,SAAS,EAAE,CAAC;YAC9C,MAAM,KAAK,GAAG,gBAAgB,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,GAAG,CAAC,GAAG,CAAC,CAAC;YACxD,IAAI,KAAK,CAAC,UAAU,KAAK,SAAS,EAAE,CAAC;gBACnC,GAAG,CAAC,GAAG,CAAC,kBAAkB,GAAG,SAAS,CAAC,KAAK,CAAC,WAAW,CAAC;gBACzD,GAAG,CAAC,IAAI,CAAC,aAAa,CAAC,SAAS,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;YACtD,CAAC;QACH,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,OAAO,OAAO,CAAC;AACjB,CAAC,CAAC"}

package/dist/cli/run.d.ts

@@ -90,6 +90,18 @@ export interface RunContext {
      * `envelope-out.ts` (M2.5 R2).
      */
     readonly meta: MetaBuilder;
+    /**
+     * Per-run accumulator of literal secret values to scrub from every
+     * emitted byte (cli-design §7.4.3 redaction-runtime extension). The
+     * `program.ts` preAction hook pushes every loaded credentials-file
+     * `access_token` value here once, before any command action runs;
+     * `collectSecrets(ctx.env, ctx.runtimeSecrets)` then folds those
+     * values into the secret-bag passed to `redact()` on every emission
+     * path. The field is a mutable array via a `readonly` reference —
+     * commands never reassign it, but the preAction hook pushes into
+     * it during context setup.
+     */
+    readonly runtimeSecrets: string[];
 }
 export declare const run: (options: RunOptions) => Promise<RunResult>;
 /**

package/dist/cli/run.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"run.d.ts","sourceRoot":"","sources":["../../src/cli/run.ts"],"names":[],"mappings":"AAAA,OAAO,EAAkB,KAAK,OAAO,EAAE,MAAM,WAAW,CAAC;AACzD,OAAO,EAGL,KAAK,QAAQ,EACd,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAEL,KAAK,kBAAkB,EACxB,MAAM,wBAAwB,CAAC;AAChC,OAAO,EAKL,KAAK,WAAW,EACjB,MAAM,mBAAmB,CAAC;AAE3B,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AACrD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AAE1D;;;;;;;;;;;GAWG;AACH,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,CAAC;IACjC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC,UAAU,CAAC;IAChC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC,cAAc,CAAC;IACvC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC,cAAc,CAAC;IACvC,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC,cAAc,CAAC;IACvC,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC;IACxB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAC;IACjC,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,IAAI,CAAC;IAC5B,QAAQ,CAAC,SAAS,CAAC,EAAE,SAAS,CAAC;IAC/B,QAAQ,CAAC,kBAAkB,CAAC,EAAE,kBAAkB,CAAC;IACjD;;;;;OAKG;IACH,QAAQ,CAAC,MAAM,CAAC,EAAE,WAAW,CAAC;IAC9B;;;;;;;OAOG;IACH,QAAQ,CAAC,aAAa,CAAC,EAAE,SAAS,aAAa,EAAE,CAAC;IAClD;;;;;;;OAOG;IACH,QAAQ,CAAC,gBAAgB,CAAC,EAAE,CAAC,OAAO,EAAE,OAAO,EAAE,GAAG,EAAE,UAAU,KAAK,IAAI,CAAC;CACzE;AAED,MAAM,WAAW,SAAS;IACxB,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC;CAC7B;AAED;;;;;GAKG;AACH,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC,UAAU,CAAC;IAChC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC,cAAc,CAAC;IACvC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC,cAAc,CAAC;IACvC,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC,cAAc,CAAC;IACvC,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC;IACxB,QAAQ,CAAC,KAAK,EAAE,MAAM,IAAI,CAAC;IAC3B,QAAQ,CAAC,SAAS,EAAE,SAAS,GAAG,SAAS,CAAC;IAC1C,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B;;;;;OAKG;IACH,QAAQ,CAAC,MAAM,EAAE,WAAW,CAAC;IAC7B;;;;;;;;OAQG;IACH,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAC;CAC5B;AAaD,eAAO,MAAM,GAAG,GAAU,SAAS,UAAU,KAAG,OAAO,CAAC,SAAS,CAuEhE,CAAC;AAEF;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,cAAc,GACzB,SAAS,UAAU,KAClB,OAAO,CAAC,SAAS,CAYnB,CAAC"}
+{"version":3,"file":"run.d.ts","sourceRoot":"","sources":["../../src/cli/run.ts"],"names":[],"mappings":"AAAA,OAAO,EAAkB,KAAK,OAAO,EAAE,MAAM,WAAW,CAAC;AACzD,OAAO,EAGL,KAAK,QAAQ,EACd,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAEL,KAAK,kBAAkB,EACxB,MAAM,wBAAwB,CAAC;AAChC,OAAO,EAKL,KAAK,WAAW,EACjB,MAAM,mBAAmB,CAAC;AAE3B,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AACrD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AAE1D;;;;;;;;;;;GAWG;AACH,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,CAAC;IACjC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC,UAAU,CAAC;IAChC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC,cAAc,CAAC;IACvC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC,cAAc,CAAC;IACvC,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC,cAAc,CAAC;IACvC,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC;IACxB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAC;IACjC,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,IAAI,CAAC;IAC5B,QAAQ,CAAC,SAAS,CAAC,EAAE,SAAS,CAAC;IAC/B,QAAQ,CAAC,kBAAkB,CAAC,EAAE,kBAAkB,CAAC;IACjD;;;;;OAKG;IACH,QAAQ,CAAC,MAAM,CAAC,EAAE,WAAW,CAAC;IAC9B;;;;;;;OAOG;IACH,QAAQ,CAAC,aAAa,CAAC,EAAE,SAAS,aAAa,EAAE,CAAC;IAClD;;;;;;;OAOG;IACH,QAAQ,CAAC,gBAAgB,CAAC,EAAE,CAAC,OAAO,EAAE,OAAO,EAAE,GAAG,EAAE,UAAU,KAAK,IAAI,CAAC;CACzE;AAED,MAAM,WAAW,SAAS;IACxB,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC;CAC7B;AAED;;;;;GAKG;AACH,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC,UAAU,CAAC;IAChC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC,cAAc,CAAC;IACvC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC,cAAc,CAAC;IACvC,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC,cAAc,CAAC;IACvC,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC;IACxB,QAAQ,CAAC,KAAK,EAAE,MAAM,IAAI,CAAC;IAC3B,QAAQ,CAAC,SAAS,EAAE,SAAS,GAAG,SAAS,CAAC;IAC1C,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B;;;;;OAKG;IACH,QAAQ,CAAC,MAAM,EAAE,WAAW,CAAC;IAC7B;;;;;;;;OAQG;IACH,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAC;IAC3B;;;;;;;;;;OAUG;IACH,QAAQ,CAAC,cAAc,EAAE,MAAM,EAAE,CAAC;CACnC;AAaD,eAAO,MAAM,GAAG,GAAU,SAAS,UAAU,KAAG,OAAO,CAAC,SAAS,CAyEhE,CAAC;AAEF;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,cAAc,GACzB,SAAS,UAAU,KAClB,OAAO,CAAC,SAAS,CAYnB,CAAC"}

package/dist/cli/run.js

@@ -39,6 +39,7 @@ export const run = async (options) => {
         cliVersion: options.cliVersion,
         signal: combinedSignal,
         meta,
+        runtimeSecrets: [],
     };
     const program = buildProgram(options, ctx);
     try {
@@ -65,6 +66,7 @@ export const run = async (options) => {
         writeErrorEnvelope(cliError, {
             stderr: options.stderr,
             env: options.env,
+            runtimeSecrets: ctx.runtimeSecrets,
             meta: buildBaseMeta({
                 snapshot: meta.snapshot(),
                 env: options.env,