orizu 0.5.25 → 0.5.27

package/dist/artifacts-git-runtime.d.ts

@@ -0,0 +1,34 @@
+export interface GitCommandResult {
+    exitCode: number;
+    stdout: string;
+    stderr: string;
+    timedOut?: boolean;
+    cancelled?: boolean;
+}
+export interface GitAuth {
+    askPassPath: string;
+    token: string;
+}
+export interface GitRunOptions {
+    cwd: string;
+    auth?: GitAuth;
+    env?: NodeJS.ProcessEnv;
+    timeoutMs?: number;
+    signal?: AbortSignal;
+    commitIdentityEnv?: Readonly<Record<string, string>>;
+}
+export type GitRunner = (args: string[], options: GitRunOptions) => Promise<GitCommandResult>;
+export declare function assertCommitIdentityEnv(overlay: Readonly<Record<string, string>>): void;
+export declare function parseArtifactTokenExpiry(token: string): number | null;
+export declare function credentialSecretVariants(secrets: readonly (string | undefined)[]): string[];
+export declare function redactSecrets(value: string, secrets: readonly (string | undefined)[]): string;
+export declare function createEphemeralAskPass(root: string): Promise<{
+    path: string;
+    dispose: () => Promise<void>;
+}>;
+export declare function buildGitAuthEnvironment(auth: GitAuth, base?: NodeJS.ProcessEnv): NodeJS.ProcessEnv;
+export declare function assertSafeGitInvocation(args: readonly string[], secrets?: readonly string[]): void;
+export declare const defaultGitRunner: GitRunner;
+export declare function gitOk(runGit: GitRunner, args: string[], options: GitRunOptions, operation: string): Promise<string>;
+export declare function revParse(runGit: GitRunner, cwd: string, ref: string): Promise<string>;
+//# sourceMappingURL=artifacts-git-runtime.d.ts.map

package/dist/artifacts-git-runtime.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"artifacts-git-runtime.d.ts","sourceRoot":"","sources":["../src/artifacts-git-runtime.ts"],"names":[],"mappings":"AAoCA,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,EAAE,MAAM,CAAA;IAChB,MAAM,EAAE,MAAM,CAAA;IACd,MAAM,EAAE,MAAM,CAAA;IACd,QAAQ,CAAC,EAAE,OAAO,CAAA;IAClB,SAAS,CAAC,EAAE,OAAO,CAAA;CACpB;AAED,MAAM,WAAW,OAAO;IACtB,WAAW,EAAE,MAAM,CAAA;IACnB,KAAK,EAAE,MAAM,CAAA;CACd;AAED,MAAM,WAAW,aAAa;IAC5B,GAAG,EAAE,MAAM,CAAA;IACX,IAAI,CAAC,EAAE,OAAO,CAAA;IACd,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAA;IACvB,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,MAAM,CAAC,EAAE,WAAW,CAAA;IACpB,iBAAiB,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAA;CACrD;AAED,MAAM,MAAM,SAAS,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,OAAO,EAAE,aAAa,KAAK,OAAO,CAAC,gBAAgB,CAAC,CAAA;AAE7F,wBAAgB,uBAAuB,CAAC,OAAO,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,GAAG,IAAI,CASvF;AAED,wBAAgB,wBAAwB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAkBrE;AAED,wBAAgB,wBAAwB,CAAC,OAAO,EAAE,SAAS,CAAC,MAAM,GAAG,SAAS,CAAC,EAAE,GAAG,MAAM,EAAE,CAS3F;AAED,wBAAgB,aAAa,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,SAAS,CAAC,MAAM,GAAG,SAAS,CAAC,EAAE,GAAG,MAAM,CAK7F;AAED,wBAAsB,sBAAsB,CAC1C,IAAI,EAAE,MAAM,GACX,OAAO,CAAC;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAA;CAAE,CAAC,CAsBzD;AAUD,wBAAgB,uBAAuB,CACrC,IAAI,EAAE,OAAO,EACb,IAAI,GAAE,MAAM,CAAC,UAAwB,GACpC,MAAM,CAAC,UAAU,CAkBnB;AAgBD,wBAAgB,uBAAuB,CACrC,IAAI,EAAE,SAAS,MAAM,EAAE,EACvB,OAAO,GAAE,SAAS,MAAM,EAAO,GAC9B,IAAI,CAYN;AAWD,eAAO,MAAM,gBAAgB,EAAE,SAoI3B,CAAA;AAEJ,wBAAsB,KAAK,CACzB,MAAM,EAAE,SAAS,EACjB,IAAI,EAAE,MAAM,EAAE,EACd,OAAO,EAAE,aAAa,EACtB,SAAS,EAAE,MAAM,GAChB,OAAO,CAAC,MAAM,CAAC,CAUjB;AAED,wBAAsB,QAAQ,CAAC,MAAM,EAAE,SAAS,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAE3F"}

package/dist/artifacts-git-runtime.js

@@ -0,0 +1,312 @@
+import { spawn } from 'node:child_process';
+import { chmod, mkdir, rm, writeFile } from 'node:fs/promises';
+import { join } from 'node:path';
+const ARTIFACT_TOKEN_BODY = /^[^\s\u0000-\u001f\u007f]{16,1024}$/;
+const ARTIFACT_TOKEN_ADVISORY_SUFFIX = '?expires=';
+const ARTIFACT_TOKEN_BARE_BODY = /art_v1_[0-9a-fA-F]{40}/;
+const DEFAULT_GIT_TIMEOUT_MS = 30_000;
+const GIT_TERMINATION_GRACE_MS = 1_000;
+const GIT_CONTEXT_ENV_KEYS = [
+    'GIT_DIR',
+    'GIT_WORK_TREE',
+    'GIT_INDEX_FILE',
+    'GIT_OBJECT_DIRECTORY',
+    'GIT_COMMON_DIR',
+    'GIT_NAMESPACE',
+];
+const GIT_CHILD_ENV_ALLOWLIST = [
+    'PATH',
+    'TMPDIR',
+    'TMP',
+    'TEMP',
+    'SYSTEMROOT',
+    'WINDIR',
+    'COMSPEC',
+    'PATHEXT',
+    'LANG',
+    'TZ',
+    'SSL_CERT_FILE',
+    'SSL_CERT_DIR',
+    'CURL_CA_BUNDLE',
+    'GIT_SSL_CAINFO',
+];
+const COMMIT_IDENTITY_ENV_PATTERN = /^GIT_(AUTHOR|COMMITTER)_(NAME|EMAIL|DATE)$/;
+export function assertCommitIdentityEnv(overlay) {
+    for (const key of Object.keys(overlay)) {
+        if (!COMMIT_IDENTITY_ENV_PATTERN.test(key)) {
+            throw new Error(`Refusing Git environment overlay ${JSON.stringify(key)}: only ` +
+                'GIT_AUTHOR_/GIT_COMMITTER_ NAME, EMAIL and DATE may be set');
+        }
+    }
+}
+export function parseArtifactTokenExpiry(token) {
+    const separator = token.lastIndexOf(ARTIFACT_TOKEN_ADVISORY_SUFFIX);
+    if (separator !== -1) {
+        const body = token.slice(0, separator);
+        const suffix = token.slice(separator + ARTIFACT_TOKEN_ADVISORY_SUFFIX.length);
+        if (!ARTIFACT_TOKEN_BODY.test(body) || !/^\d{1,15}$/.test(suffix)) {
+            throw new Error('Artifacts returned an unexpected token format');
+        }
+        const expiry = Number(suffix);
+        if (!Number.isSafeInteger(expiry)) {
+            throw new Error('Artifacts returned an invalid token expiry');
+        }
+        return expiry;
+    }
+    if (!ARTIFACT_TOKEN_BODY.test(token)) {
+        throw new Error('Artifacts returned an unexpected token format');
+    }
+    return null;
+}
+export function credentialSecretVariants(secrets) {
+    const variants = new Set();
+    for (const secret of secrets) {
+        if (!secret)
+            continue;
+        variants.add(secret);
+        const bareBody = ARTIFACT_TOKEN_BARE_BODY.exec(secret)?.[0];
+        if (bareBody)
+            variants.add(bareBody);
+    }
+    return [...variants];
+}
+export function redactSecrets(value, secrets) {
+    return credentialSecretVariants(secrets)
+        .filter((secret) => secret.length >= 4)
+        .sort((left, right) => right.length - left.length)
+        .reduce((redacted, secret) => redacted.split(secret).join('[REDACTED]'), value);
+}
+export async function createEphemeralAskPass(root) {
+    const authDir = join(root, 'git-auth');
+    await mkdir(authDir, { recursive: true, mode: 0o700 });
+    await chmod(authDir, 0o700);
+    const path = join(authDir, 'askpass.sh');
+    const script = `#!/bin/sh
+case "$1" in
+  *sername*) printf '%s\\n' x ;;
+  *assword*)
+    IFS= read -r password <&3 || exit 1
+    [ -n "$password" ] || exit 1
+    printf '%s\\n' "$password"
+    ;;
+  *) exit 1 ;;
+esac
+`;
+    await writeFile(path, script, { mode: 0o700 });
+    await chmod(path, 0o700);
+    return {
+        path,
+        dispose: () => rm(authDir, { recursive: true, force: true }),
+    };
+}
+function minimalGitChildEnvironment(base) {
+    const selected = { NODE_ENV: base.NODE_ENV };
+    for (const key of GIT_CHILD_ENV_ALLOWLIST) {
+        if (base[key] !== undefined)
+            selected[key] = base[key];
+    }
+    return selected;
+}
+export function buildGitAuthEnvironment(auth, base = process.env) {
+    parseArtifactTokenExpiry(auth.token);
+    const env = {
+        ...minimalGitChildEnvironment(base),
+        LC_ALL: 'C',
+        GIT_TERMINAL_PROMPT: '0',
+        GIT_ASKPASS: auth.askPassPath,
+        GIT_ASKPASS_REQUIRE: 'force',
+        GIT_CONFIG_NOSYSTEM: '1',
+        GIT_CONFIG_GLOBAL: '/dev/null',
+        GIT_CONFIG_COUNT: '2',
+        GIT_CONFIG_KEY_0: 'credential.helper',
+        GIT_CONFIG_VALUE_0: '',
+        GIT_CONFIG_KEY_1: 'credential.useHttpPath',
+        GIT_CONFIG_VALUE_1: 'true',
+    };
+    for (const key of GIT_CONTEXT_ENV_KEYS)
+        delete env[key];
+    return env;
+}
+function buildUnauthenticatedGitEnvironment(base = process.env) {
+    const env = {
+        ...minimalGitChildEnvironment(base),
+        LC_ALL: 'C',
+        GIT_TERMINAL_PROMPT: '0',
+        GIT_CONFIG_NOSYSTEM: '1',
+        GIT_CONFIG_GLOBAL: '/dev/null',
+    };
+    for (const key of GIT_CONTEXT_ENV_KEYS)
+        delete env[key];
+    return env;
+}
+export function assertSafeGitInvocation(args, secrets = []) {
+    const joined = args.join('\u0000');
+    for (const secret of credentialSecretVariants(secrets)) {
+        if (joined.includes(secret))
+            throw new Error('Refusing to place a credential in Git argv');
+    }
+    for (const arg of args) {
+        if (!/^https?:\/\//i.test(arg))
+            continue;
+        const url = new URL(arg);
+        if (url.username || url.password) {
+            throw new Error('Refusing a Git remote URL containing userinfo');
+        }
+    }
+}
+function signalGitProcess(child, signal) {
+    try {
+        if (process.platform !== 'win32' && child.pid)
+            process.kill(-child.pid, signal);
+        else
+            child.kill(signal);
+    }
+    catch {
+        // The process may have exited between the state check and the signal.
+    }
+}
+export const defaultGitRunner = (args, { cwd, auth, env: suppliedEnv, commitIdentityEnv, timeoutMs = DEFAULT_GIT_TIMEOUT_MS, signal }) => new Promise((resolve, reject) => {
+    if (!Number.isInteger(timeoutMs) || timeoutMs <= 0) {
+        reject(new Error('Git timeout must be a positive integer'));
+        return;
+    }
+    const secrets = auth ? [auth.token] : [];
+    assertSafeGitInvocation(args, secrets);
+    if (signal?.aborted) {
+        resolve({
+            exitCode: 130,
+            stdout: '',
+            stderr: 'Git operation cancelled',
+            cancelled: true,
+        });
+        return;
+    }
+    const baseEnv = auth
+        ? buildGitAuthEnvironment(auth, suppliedEnv)
+        : buildUnauthenticatedGitEnvironment(suppliedEnv);
+    let env = baseEnv;
+    if (commitIdentityEnv) {
+        assertCommitIdentityEnv(commitIdentityEnv);
+        env = { ...baseEnv, ...commitIdentityEnv };
+    }
+    const spawnArgs = auth ? ['-c', 'core.hooksPath=/dev/null', ...args] : args;
+    const child = spawn('git', spawnArgs, {
+        cwd,
+        env,
+        detached: process.platform !== 'win32',
+        stdio: auth ? ['ignore', 'pipe', 'pipe', 'pipe'] : ['ignore', 'pipe', 'pipe'],
+    });
+    let stdout = '';
+    let stderr = '';
+    let termination = null;
+    let settled = false;
+    let killTimer = null;
+    let hardStopTimer = null;
+    let timeoutTimer = null;
+    const cleanup = () => {
+        if (timeoutTimer)
+            clearTimeout(timeoutTimer);
+        if (killTimer)
+            clearTimeout(killTimer);
+        if (hardStopTimer)
+            clearTimeout(hardStopTimer);
+        signal?.removeEventListener('abort', cancel);
+    };
+    const finish = (exitCode) => {
+        if (settled)
+            return;
+        settled = true;
+        cleanup();
+        resolve({
+            exitCode,
+            stdout: redactSecrets(stdout, secrets),
+            stderr: redactSecrets(stderr, secrets),
+            timedOut: termination === 'timeout' || undefined,
+            cancelled: termination === 'cancelled' || undefined,
+        });
+    };
+    const terminate = (reason) => {
+        if (termination || settled)
+            return;
+        termination = reason;
+        signalGitProcess(child, 'SIGTERM');
+        killTimer = setTimeout(() => signalGitProcess(child, 'SIGKILL'), GIT_TERMINATION_GRACE_MS);
+        killTimer.unref?.();
+        hardStopTimer = setTimeout(() => finish(reason === 'timeout' ? 124 : 130), GIT_TERMINATION_GRACE_MS * 2);
+        hardStopTimer.unref?.();
+    };
+    const fail = (error) => {
+        if (settled)
+            return;
+        settled = true;
+        cleanup();
+        signalGitProcess(child, 'SIGKILL');
+        reject(error);
+    };
+    const cancel = () => terminate('cancelled');
+    timeoutTimer = setTimeout(() => terminate('timeout'), timeoutMs);
+    timeoutTimer.unref?.();
+    signal?.addEventListener('abort', cancel, { once: true });
+    if (signal?.aborted)
+        cancel();
+    const childStdout = child.stdout;
+    const childStderr = child.stderr;
+    if (!childStdout || !childStderr) {
+        fail(new Error('Could not capture Git process output'));
+        return;
+    }
+    childStdout.setEncoding('utf8');
+    childStderr.setEncoding('utf8');
+    childStdout.on('data', (chunk) => {
+        stdout += chunk;
+    });
+    childStderr.on('data', (chunk) => {
+        stderr += chunk;
+    });
+    child.on('error', (error) => {
+        if (termination) {
+            finish(termination === 'timeout' ? 124 : 130);
+            return;
+        }
+        fail(error);
+    });
+    child.on('close', (code) => {
+        finish(termination === 'timeout' ? 124 : termination === 'cancelled' ? 130 : (code ?? 1));
+    });
+    if (auth) {
+        const credentialPipe = child.stdio[3];
+        if (!credentialPipe) {
+            fail(new Error('Could not establish one-use Git credential pipe'));
+            return;
+        }
+        credentialPipe.on('error', () => {
+            /* EPIPE if Git fails before auth. */
+        });
+        if (termination) {
+            credentialPipe.destroy();
+            return;
+        }
+        try {
+            credentialPipe.end(`${auth.token}\n`);
+        }
+        catch (error) {
+            fail(error instanceof Error ? error : new Error('Could not write the one-use Git credential'));
+        }
+    }
+});
+export async function gitOk(runGit, args, options, operation) {
+    const result = await runGit(args, options);
+    if (result.timedOut)
+        throw new Error(`${operation} timed out`);
+    if (result.cancelled)
+        throw new Error(`${operation} cancelled`);
+    if (result.exitCode !== 0) {
+        const secrets = options.auth ? [options.auth.token] : [];
+        const detail = redactSecrets((result.stderr || result.stdout).trim(), secrets);
+        throw new Error(detail ? `${operation} failed: ${detail}` : `${operation} failed`);
+    }
+    return result.stdout.trim();
+}
+export async function revParse(runGit, cwd, ref) {
+    return gitOk(runGit, ['rev-parse', '--verify', ref], { cwd }, `resolve ${ref}`);
+}

package/dist/cloudflare-artifacts-git-remote.d.ts

@@ -0,0 +1,5 @@
+export declare const CLOUDFLARE_ARTIFACTS_HOST_PATTERN: RegExp;
+export declare const CLOUDFLARE_ARTIFACTS_GIT_PATH_PATTERN: RegExp;
+export declare function parseCanonicalCredentialFreeHttpsUrl(remote: unknown): URL | null;
+export declare function isValidCloudflareArtifactsGitRemote(remote: unknown): remote is string;
+//# sourceMappingURL=cloudflare-artifacts-git-remote.d.ts.map

package/dist/cloudflare-artifacts-git-remote.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cloudflare-artifacts-git-remote.d.ts","sourceRoot":"","sources":["../src/cloudflare-artifacts-git-remote.ts"],"names":[],"mappings":"AAAA,eAAO,MAAM,iCAAiC,QACC,CAAA;AAE/C,eAAO,MAAM,qCAAqC,QACmC,CAAA;AAErF,wBAAgB,oCAAoC,CAAC,MAAM,EAAE,OAAO,GAAG,GAAG,GAAG,IAAI,CAWhF;AAED,wBAAgB,mCAAmC,CAAC,MAAM,EAAE,OAAO,GAAG,MAAM,IAAI,MAAM,CAIrF"}

package/dist/cloudflare-artifacts-git-remote.js

@@ -0,0 +1,21 @@
+export const CLOUDFLARE_ARTIFACTS_HOST_PATTERN = /^[0-9a-f]{32}\.artifacts\.cloudflare\.net$/u;
+export const CLOUDFLARE_ARTIFACTS_GIT_PATH_PATTERN = /^\/git\/[A-Za-z0-9][A-Za-z0-9._-]{0,255}\/[A-Za-z0-9][A-Za-z0-9._-]{0,255}\.git$/u;
+export function parseCanonicalCredentialFreeHttpsUrl(remote) {
+    if (typeof remote !== 'string')
+        return null;
+    try {
+        const parsed = new URL(remote);
+        return parsed.protocol === 'https:' && !parsed.username && !parsed.password &&
+            !parsed.port && !parsed.search && !parsed.hash && parsed.toString() === remote
+            ? parsed
+            : null;
+    }
+    catch {
+        return null;
+    }
+}
+export function isValidCloudflareArtifactsGitRemote(remote) {
+    const parsed = parseCanonicalCredentialFreeHttpsUrl(remote);
+    return parsed !== null && CLOUDFLARE_ARTIFACTS_HOST_PATTERN.test(parsed.hostname) &&
+        CLOUDFLARE_ARTIFACTS_GIT_PATH_PATTERN.test(parsed.pathname);
+}

package/dist/git-credential.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"git-credential.d.ts","sourceRoot":"","sources":["../src/git-credential.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAQH,MAAM,MAAM,oBAAoB,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,WAAW,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAA;AAE1F,MAAM,WAAW,eAAe;IAC9B,KAAK,EAAE,MAAM,CAAA;IACb,GAAG,EAAE,MAAM,CAAA;IACX,KAAK,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAA;IAC7B,QAAQ,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAA;IAChC,OAAO,CAAC,EAAE,oBAAoB,CAAA;IAC9B,8EAA8E;IAC9E,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB;;;;OAIG;IACH,OAAO,CAAC,EAAE,gBAAgB,CAAA;IAC1B,yEAAyE;IACzE,KAAK,CAAC,EAAE,MAAM,MAAM,CAAA;CACrB;AAmBD,eAAO,MAAM,mBAAmB,4BAGtB,CAAA;AAEV,MAAM,MAAM,gBAAgB,GAC1B,CAAC,OAAO,mBAAmB,CAAC,CAAC,MAAM,CAAC,CAAA;AAEtC,MAAM,WAAW,uBAAuB;IACtC,QAAQ,CAAC,SAAS,EAAE,KAAK,GAAG,OAAO,GAAG,OAAO,CAAA;IAC7C,QAAQ,CAAC,OAAO,EAAE,gBAAgB,GAAG,IAAI,CAAA;CAC1C;AAQD;;;;;;;;GAQG;AACH,wBAAgB,4BAA4B,CAC1C,IAAI,EAAE,SAAS,MAAM,EAAE,GACtB,uBAAuB,GAAG,IAAI,CA8BhC;AAED,wBAAsB,0BAA0B,CAC9C,IAAI,EAAE,SAAS,MAAM,EAAE,EACvB,EAAE,EAAE,eAAe,GAClB,OAAO,CAAC,MAAM,CAAC,CAUjB;AAED,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAU1E;AAED;;;GAGG;AACH,wBAAgB,0BAA0B,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CA0BrE;AAED;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,EAAE,EAAE,eAAe,GAAG,MAAM,GAAG,IAAI,CAKrE;AA0RD,wBAAsB,gBAAgB,CAAC,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,eAAe,GAAG,OAAO,CAAC,MAAM,CAAC,CA+FvF"}
+{"version":3,"file":"git-credential.d.ts","sourceRoot":"","sources":["../src/git-credential.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AASH,MAAM,MAAM,oBAAoB,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,WAAW,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAA;AAE1F,MAAM,WAAW,eAAe;IAC9B,KAAK,EAAE,MAAM,CAAA;IACb,GAAG,EAAE,MAAM,CAAA;IACX,KAAK,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAA;IAC7B,QAAQ,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAA;IAChC,OAAO,CAAC,EAAE,oBAAoB,CAAA;IAC9B,8EAA8E;IAC9E,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB;;;;OAIG;IACH,OAAO,CAAC,EAAE,gBAAgB,CAAA;IAC1B,yEAAyE;IACzE,KAAK,CAAC,EAAE,MAAM,MAAM,CAAA;CACrB;AAiBD,eAAO,MAAM,mBAAmB,4BAGtB,CAAA;AAEV,MAAM,MAAM,gBAAgB,GAC1B,CAAC,OAAO,mBAAmB,CAAC,CAAC,MAAM,CAAC,CAAA;AAEtC,MAAM,WAAW,uBAAuB;IACtC,QAAQ,CAAC,SAAS,EAAE,KAAK,GAAG,OAAO,GAAG,OAAO,CAAA;IAC7C,QAAQ,CAAC,OAAO,EAAE,gBAAgB,GAAG,IAAI,CAAA;CAC1C;AAQD;;;;;;;;GAQG;AACH,wBAAgB,4BAA4B,CAC1C,IAAI,EAAE,SAAS,MAAM,EAAE,GACtB,uBAAuB,GAAG,IAAI,CA8BhC;AAED,wBAAsB,0BAA0B,CAC9C,IAAI,EAAE,SAAS,MAAM,EAAE,EACvB,EAAE,EAAE,eAAe,GAClB,OAAO,CAAC,MAAM,CAAC,CAUjB;AAED,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAU1E;AAED;;;GAGG;AACH,wBAAgB,0BAA0B,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CA0BrE;AAED;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,EAAE,EAAE,eAAe,GAAG,MAAM,GAAG,IAAI,CAKrE;AA0RD,wBAAsB,gBAAgB,CAAC,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,eAAe,GAAG,OAAO,CAAC,MAAM,CAAC,CA+FvF"}

package/dist/git-credential.js

@@ -19,10 +19,10 @@
  */
 import { existsSync } from 'fs';
 import { dirname, join } from 'path';
+import { CLOUDFLARE_ARTIFACTS_HOST_PATTERN as ARTIFACTS_HOST } from './cloudflare-artifacts-git-remote.js';
 import { authedFetch } from './http.js';
 import { readJsonManifest } from './workspace.js';
 const GITHUB_HOST = 'github.com';
-const ARTIFACTS_HOST = /^[0-9a-f]{32}\.artifacts\.cloudflare\.net$/;
 /**
  * ALI-1285: the Artifacts contract declares the credential OPAQUE
  * (`plaintext: string`) with no documented body format. Pinning

package/dist/git-recovery-environment.d.ts

@@ -16,6 +16,7 @@ export interface HardenedGitEnvironmentInput {
     credentialHelper?: RecoveryCredentialHelperInvocation;
     sourceEnv?: NodeJS.ProcessEnv;
 }
+export declare function shellQuote(value: string): string;
 /**
  * Construct, rather than scrub, the environment. Only PATH crosses the
  * boundary from the parent process. Provider tokens, cloud credentials,

package/dist/git-recovery-environment.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"git-recovery-environment.d.ts","sourceRoot":"","sources":["../src/git-recovery-environment.ts"],"names":[],"mappings":"AAEA,MAAM,MAAM,mBAAmB,GAAG,MAAM,GAAG,OAAO,CAAA;AAElD,MAAM,WAAW,kCAAkC;IACjD;;;;OAIG;IACH,cAAc,EAAE,MAAM,CAAA;IACtB,SAAS,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;CAC9B;AAED,MAAM,WAAW,2BAA2B;IAC1C,OAAO,EAAE,MAAM,CAAA;IACf,QAAQ,EAAE,MAAM,CAAA;IAChB,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,gBAAgB,CAAC,EAAE,SAAS,mBAAmB,EAAE,CAAA;IACjD,gBAAgB,CAAC,EAAE,kCAAkC,CAAA;IACrD,SAAS,CAAC,EAAE,MAAM,CAAC,UAAU,CAAA;CAC9B;AA0GD;;;;;GAKG;AACH,wBAAgB,2BAA2B,CACzC,KAAK,EAAE,2BAA2B,GACjC,MAAM,CAAC,UAAU,CA6CnB;AAED;;;GAGG;AACH,wBAAgB,6BAA6B,CAC3C,GAAG,EAAE,MAAM,CAAC,UAAU,GACrB,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAuBrB"}
+{"version":3,"file":"git-recovery-environment.d.ts","sourceRoot":"","sources":["../src/git-recovery-environment.ts"],"names":[],"mappings":"AAEA,MAAM,MAAM,mBAAmB,GAAG,MAAM,GAAG,OAAO,CAAA;AAElD,MAAM,WAAW,kCAAkC;IACjD;;;;OAIG;IACH,cAAc,EAAE,MAAM,CAAA;IACtB,SAAS,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;CAC9B;AAED,MAAM,WAAW,2BAA2B;IAC1C,OAAO,EAAE,MAAM,CAAA;IACf,QAAQ,EAAE,MAAM,CAAA;IAChB,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,gBAAgB,CAAC,EAAE,SAAS,mBAAmB,EAAE,CAAA;IACjD,gBAAgB,CAAC,EAAE,kCAAkC,CAAA;IACrD,SAAS,CAAC,EAAE,MAAM,CAAC,UAAU,CAAA;CAC9B;AAoCD,wBAAgB,UAAU,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAEhD;AAoED;;;;;GAKG;AACH,wBAAgB,2BAA2B,CACzC,KAAK,EAAE,2BAA2B,GACjC,MAAM,CAAC,UAAU,CA6CnB;AAED;;;GAGG;AACH,wBAAgB,6BAA6B,CAC3C,GAAG,EAAE,MAAM,CAAC,UAAU,GACrB,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAuBrB"}

package/dist/git-recovery-environment.js

@@ -20,7 +20,7 @@ function normalizeProtocols(protocols) {
     }
     return normalized;
 }
-function shellQuote(value) {
+export function shellQuote(value) {
     return `'${value.replace(/'/g, "'\\''")}'`;
 }
 function credentialHelperConfigValue(helper) {

package/dist/help.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"help.d.ts","sourceRoot":"","sources":["../src/help.ts"],"names":[],"mappings":"AAEA,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,MAAM,CAAA;IACZ,IAAI,EAAE,MAAM,CAAA;IACZ,QAAQ,CAAC,EAAE,OAAO,CAAA;IAClB,UAAU,CAAC,EAAE,OAAO,CAAA;IACpB,OAAO,CAAC,EAAE,MAAM,EAAE,CAAA;CACnB;AAED,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,MAAM,EAAE,CAAA;IACd,KAAK,EAAE,MAAM,CAAA;IACb,OAAO,EAAE,MAAM,CAAA;IACf,KAAK,EAAE,MAAM,CAAA;IACb,OAAO,CAAC,EAAE,MAAM,EAAE,EAAE,CAAA;IACpB,OAAO,CAAC,EAAE,YAAY,EAAE,CAAA;IACxB,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAA;CACpB;AAuCD,eAAO,MAAM,YAAY,EAAE,aAAa,EAqoCvC,CAAA;AAUD,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,aAAa,GAAG,SAAS,CAMxE;AAED,wBAAgB,qBAAqB,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,aAAa,EAAE,CAWrE;AAOD,wBAAgB,cAAc,IAAI,MAAM,CA0CvC;AAED,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,MAAM,CAoBtD;AAED,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,aAAa,GAAG,MAAM,CA4B5D;AAED,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,MAAM,CAgBxD;AAED,wBAAgB,eAAe,CAAC,OAAO,EAAE,MAAM;;;;;;;;;;;;;;;;;;;;;EAoB9C"}
+{"version":3,"file":"help.d.ts","sourceRoot":"","sources":["../src/help.ts"],"names":[],"mappings":"AAEA,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,MAAM,CAAA;IACZ,IAAI,EAAE,MAAM,CAAA;IACZ,QAAQ,CAAC,EAAE,OAAO,CAAA;IAClB,UAAU,CAAC,EAAE,OAAO,CAAA;IACpB,OAAO,CAAC,EAAE,MAAM,EAAE,CAAA;CACnB;AAED,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,MAAM,EAAE,CAAA;IACd,KAAK,EAAE,MAAM,CAAA;IACb,OAAO,EAAE,MAAM,CAAA;IACf,KAAK,EAAE,MAAM,CAAA;IACb,OAAO,CAAC,EAAE,MAAM,EAAE,EAAE,CAAA;IACpB,OAAO,CAAC,EAAE,YAAY,EAAE,CAAA;IACxB,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAA;CACpB;AAuCD,eAAO,MAAM,YAAY,EAAE,aAAa,EAsqCvC,CAAA;AAUD,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,aAAa,GAAG,SAAS,CAMxE;AAED,wBAAgB,qBAAqB,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,aAAa,EAAE,CAWrE;AAOD,wBAAgB,cAAc,IAAI,MAAM,CA0CvC;AAED,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,MAAM,CAoBtD;AAED,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,aAAa,GAAG,MAAM,CA4B5D;AAED,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,MAAM,CAgBxD;AAED,wBAAgB,eAAe,CAAC,OAAO,EAAE,MAAM;;;;;;;;;;;;;;;;;;;;;EAoB9C"}

package/dist/help.js

@@ -52,18 +52,45 @@ export const COMMAND_DOCS = [
     { path: ['instructions', 'profiles', 'new'], aliases: [['instruction-sets', 'profiles', 'new']], usage: 'orizu instructions profiles new <set> --project <team/project> --model-config <identity> [--json]', summary: 'Create a model-config profile seeded from the instruction-set default.', group: 'Instruction sets', options: [{ name: '--model-config <identity>', help: 'Model config identity for the new profile.', required: true }, { name: '--json', help: 'Print JSON.' }], examples: ['orizu instructions profiles new planner --project core/evals --model-config anthropic/claude-haiku'] },
     { path: ['instructions', 'profiles', 'promote'], aliases: [['instruction-sets', 'profiles', 'promote']], usage: 'orizu instructions profiles promote <set> --project <team/project> --model-config <identity> --version <n> [--json]', summary: 'Move one profile version to production.', group: 'Instruction sets', options: [{ name: '--model-config <identity>', help: 'Profile model config.', required: true }, { name: '--version <n>', help: 'Profile version to promote.', required: true }, { name: '--json', help: 'Print JSON.' }], examples: ['orizu instructions profiles promote planner --project core/evals --model-config anthropic/claude-haiku --version 2'] },
     { path: ['instructions', 'profiles', 'rollback'], aliases: [['instruction-sets', 'profiles', 'rollback']], usage: 'orizu instructions profiles rollback <set> --project <team/project> --model-config <identity> --to <n> [--json]', summary: 'Create a rollback version and move profile production to it.', group: 'Instruction sets', options: [{ name: '--model-config <identity>', help: 'Profile model config.', required: true }, { name: '--to <n>', help: 'Historical profile version to copy.', required: true }, { name: '--json', help: 'Print JSON.' }], examples: ['orizu instructions profiles rollback planner --project core/evals --model-config anthropic/claude-haiku --to 1'] },
-    { path: ['instructions', 'default', 'show'], aliases: [['instruction-sets', 'default', 'show']], usage: 'orizu instructions default show <set> --project <team/project> [--json]', summary: 'Show the instruction-set default and its resolution impact.', group: 'Instruction sets', options: [{ name: '--project <team/project>', help: 'Project slug.', required: true }, { name: '--json', help: 'Print JSON.' }], examples: ['orizu instructions default show planner --project core/evals'] },
-    { path: ['instructions', 'default', 'move'], aliases: [['instruction-sets', 'default', 'move']], usage: 'orizu instructions default move <set> --project <team/project> --model-config <identity> --version <n> [--json]', summary: 'Move the instruction-set default to a profile version.', group: 'Instruction sets', options: [{ name: '--project <team/project>', help: 'Project slug.', required: true }, { name: '--model-config <identity>', help: 'Target model config.', required: true }, { name: '--version <n>', help: 'Target profile version.', required: true }, { name: '--json', help: 'Print JSON.' }], examples: ['orizu instructions default move planner --project core/evals --model-config anthropic/claude-haiku --version 2'] },
+    { path: ['instructions', 'default', 'show'], aliases: [['instruction-sets', 'default', 'show']], usage: 'orizu instructions default show <set> --project <team/project> [--json]', summary: 'Show the Default Profile and its Production state.', group: 'Instruction sets', options: [{ name: '--project <team/project>', help: 'Project slug.', required: true }, { name: '--json', help: 'Print JSON.' }], examples: ['orizu instructions default show planner --project core/evals'] },
+    { path: ['instructions', 'default', 'move'], aliases: [['instruction-sets', 'default', 'move']], usage: 'orizu instructions default move <set> --project <team/project> --model-config <identity> [--json]', summary: 'Move the instruction-set Default to a Profile.', group: 'Instruction sets', options: [{ name: '--project <team/project>', help: 'Project slug.', required: true }, { name: '--model-config <identity>', help: 'Target Profile identity.', required: true }, { name: '--json', help: 'Print JSON.' }], examples: ['orizu instructions default move planner --project core/evals --model-config anthropic/claude-haiku'] },
     { path: ['instructions', 'shape', 'add'], aliases: [['instruction-sets', 'shape', 'add']], usage: 'orizu instructions shape add <set> --project <team/project> --key <key> --from <manifest> [--json]', summary: 'Add one component key to every instruction-set profile.', group: 'Instruction sets', options: [{ name: '--project <team/project>', help: 'Project slug.', required: true }, { name: '--key <key>', help: 'Component key to add.', required: true }, { name: '--from <manifest>', help: 'Manifest containing the component body.', required: true }, { name: '--json', help: 'Print JSON.' }], examples: ['orizu instructions shape add planner --project core/evals --key skill --from planner.json'] },
     { path: ['instructions', 'shape', 'remove'], aliases: [['instruction-sets', 'shape', 'remove']], usage: 'orizu instructions shape remove <set> --project <team/project> --key <key> [--json]', summary: 'Remove one component key from every instruction-set profile.', group: 'Instruction sets', options: [{ name: '--project <team/project>', help: 'Project slug.', required: true }, { name: '--key <key>', help: 'Component key to remove.', required: true }, { name: '--json', help: 'Print JSON.' }], examples: ['orizu instructions shape remove planner --project core/evals --key skill'] },
     {
         path: ['instructions', 'sync'],
         aliases: [['instruction-sets', 'sync']],
-        usage: 'orizu instructions sync <set> --out <dir> [--model-config <identity>] [--project <team/project>] [--json]',
-        summary: 'Write an instruction set for offline runner loading.',
+        usage: 'orizu instructions sync <set|set/profile|set/profile@vN> [--version <n>] [--out <app-root>] [--target <ts>] [--force-helpers] [--project <team/project>] [--json]',
+        summary: 'Materialize one Profile Version and update the instruction set Lock.',
         group: 'Instruction sets',
-        options: [{ name: '--out <dir>', help: 'Destination parent directory.', required: true }, { name: '--model-config <identity>', help: 'Sync only one profile plus default.' }, { name: '--project <team/project>', help: 'Project slug.' }, { name: '--json', help: 'Print source transport JSON.' }],
-        examples: ['orizu instructions sync planner --out ./instructions --project core/evals'],
+        options: [{ name: '--version <n>', help: 'Exact Profile Version (equivalent to @vN).' }, { name: '--out <app-root>', help: 'App root containing orizu/ (default: current directory).' }, { name: '--target <ts>', help: 'Generated artifact target (default: ts).', choices: ['ts'] }, { name: '--force-helpers', help: 'Overwrite edited vendored Helpers and refresh pristine fingerprints.' }, { name: '--project <team/project>', help: 'Project slug.' }, { name: '--json', help: 'Print source transport JSON.' }],
+        examples: ['orizu instructions sync planner/openai/gpt-5.6-luna@v2 --out . --project core/evals'],
+    },
+    {
+        path: ['instructions', 'update'],
+        aliases: [['instruction-sets', 'update']],
+        usage: 'orizu instructions update [--out <app-root>] [--project <team/project>] [--no-sync] [--yes] [--json]',
+        summary: 'Plan or apply fresh Default and Production Pointer resolutions.',
+        group: 'Instruction sets',
+        options: [{ name: '--out <app-root>', help: 'App root containing orizu/ (default: current directory).' }, { name: '--project <team/project>', help: 'Project slug.' }, { name: '--no-sync', help: 'Record Pointer targets without materializing absent Versions.' }, { name: '--yes', help: 'Apply the printed plan.' }, { name: '--json', help: 'Print the machine-readable plan.' }],
+        examples: ['orizu instructions update --out . --project core/evals --yes'],
+    },
+    {
+        path: ['instructions', 'prune'],
+        aliases: [['instruction-sets', 'prune']],
+        usage: 'orizu instructions prune [--out <app-root>] [--keep <set/profile@vN>]... [--yes] [--json]',
+        summary: 'Verify, then plan or remove unreferenced Synced versions.',
+        group: 'Instruction sets',
+        options: [{ name: '--out <app-root>', help: 'App root containing orizu/ (default: current directory).' }, { name: '--keep <set/profile@vN>', help: 'Retain an exact Version in addition to Lock Pins.', repeatable: true }, { name: '--yes', help: 'Apply the printed plan.' }, { name: '--json', help: 'Print the machine-readable plan.' }],
+        examples: ['orizu instructions prune --out . --keep planner/openai/gpt-5.6-luna@v2 --yes'],
+    },
+    {
+        path: ['instructions', 'verify'],
+        aliases: [['instruction-sets', 'verify']],
+        usage: 'orizu instructions verify [--out <app-root>] [--json]',
+        summary: 'Verify the Lock, Synced versions, generated modules, and runtime-loaded bytes offline.',
+        group: 'Instruction sets',
+        options: [{ name: '--out <app-root>', help: 'App root containing orizu/ (default: current directory).' }, { name: '--json', help: 'Print the machine-readable verification report.' }],
+        examples: ['orizu instructions verify --out .'],
     },
     { path: ['instructions', 'archive'], aliases: [['instruction-sets', 'archive']], usage: 'orizu instructions archive <slug-or-exact-name> --project <team/project> [--json]', summary: 'Archive an instruction set without changing resolution or sync.', group: 'Instruction sets', options: [{ name: '--project <team/project>', help: 'Project slug.', required: true }, { name: '--json', help: 'Print JSON.' }], examples: ['orizu instructions archive planner --project core/evals'] },
     { path: ['instructions', 'restore'], aliases: [['instruction-sets', 'restore']], usage: 'orizu instructions restore <slug-or-exact-name> --project <team/project> [--json]', summary: 'Restore an archived instruction set.', group: 'Instruction sets', options: [{ name: '--project <team/project>', help: 'Project slug.', required: true }, { name: '--json', help: 'Print JSON.' }], examples: ['orizu instructions restore planner --project core/evals'] },
@@ -477,7 +504,7 @@ export const COMMAND_DOCS = [
     },
     {
         path: ['scorers', 'detail'],
-        usage: 'orizu scorers detail <scorer-id-or-name> --project <team/project> [--json]',
+        usage: 'orizu scorers detail <scorer-id-or-name> --project <team/project> [--profile-version <id>] [--json]',
         summary: 'Show scorer details.',
         group: 'Scorers and runners',
     },
@@ -489,7 +516,7 @@ export const COMMAND_DOCS = [
     },
     {
         path: ['scorers', 'exec'],
-        usage: 'orizu scorers exec --scorer-version <id> (--subject-version <prompt-version-id> | --optimization-run <id> --candidate <id>) --dataset-version <id> --split-set <id> --split <name> [--subject-results <jsonl>] [--dependency-score-run <alias=id>] [--dependency-results <alias=path>] [--no-submit] [--out <score.json>] [--project <team/project>] [--json]',
+        usage: 'orizu scorers exec --scorer-version <id> (--subject-version <prompt-version-id> | --optimization-run <id> --candidate <id>) --dataset-version <id> --split-set <id> --split <name> [--subject-results <jsonl>] [--dependency-score-run <alias=id>] [--dependency-results <alias=path>] [--no-submit] [--out <score.json>] [--project <team/project>] [--instructions <specifier>] [--instructions-root <dir>] [--json]',
         summary: 'Execute a scorer locally for a prompt version or optimization candidate.',
         group: 'Scorers and runners',
     },
@@ -501,7 +528,7 @@ export const COMMAND_DOCS = [
     },
     {
         path: ['scores', 'submit'],
-        usage: 'orizu scores submit <results.jsonl|results.json> --scorer-version <id> (--subject-version <prompt-version-id> | --optimization-run <id> --candidate <id>) [--aggregate] [--dataset-version <id> --split-set <id> --split <name>] [--project <team/project>] [--json]',
+        usage: 'orizu scores submit <results.jsonl|results.json> --scorer-version <id> (--subject-version <prompt-version-id> | --optimization-run <id> --candidate <id>) [--aggregate] [--dataset-version <id> --split-set <id> --split <name>] [--project <team/project>] [--instructions <specifier>] [--instructions-root <dir>] [--json]',
         summary: 'Submit score results for a scorer against a prompt version or optimization candidate.',
         group: 'Scorers and runners',
     },
@@ -555,10 +582,16 @@ export const COMMAND_DOCS = [
     },
     {
         path: ['runs', 'submit'],
-        usage: 'orizu runs submit <results.jsonl|results.jsonl.gz> --prompt-version <id> --runner-version <id> --dataset-version <id> --split-set <id> --split <name> [--project <team/project>]',
+        usage: 'orizu runs submit <results.jsonl|results.jsonl.gz> --prompt-version <id> --runner-version <id> --dataset-version <id> --split-set <id> --split <name> [--project <team/project>] [--instructions <specifier>] [--instructions-root <dir>]',
         summary: 'Submit local prompt-run results.',
         group: 'Scorers and runners',
     },
+    {
+        path: ['runs', 'list'],
+        usage: 'orizu runs list [--project <team/project>] [--profile-version <id>] [--prompt-version <id>] [--limit <n>] [--json]',
+        summary: 'List execution runs, optionally filtered by exact Profile Version or prompt version.',
+        group: 'Scorers and runners',
+    },
     {
         path: ['optimizations', 'start'],
         usage: 'orizu optimizations start --project <team/project> --optimizer-version <id> --prompt-version <id[,id]> --selection-scorer <id> [--reflection-scorer <id>] [--pareto-scorer <id>] [--best-scorer <id>] --dataset-version <id> --split-set <id> [--train-split <name>] [--validation-split <name>] [--metadata <json|@file>] [--json]',
@@ -567,7 +600,7 @@ export const COMMAND_DOCS = [
     },
     {
         path: ['optimizations', 'list'],
-        usage: 'orizu optimizations list [--project <team/project>] [--status active|archived|all] [--json]',
+        usage: 'orizu optimizations list [--project <team/project>] [--status active|archived|all] [--profile-version <id>] [--json]',
         summary: 'List optimization runs with explicit archive visibility.',
         group: 'Optimizations',
     },