orizu 0.5.28 → 0.5.30

package/dist/credentials.js

@@ -3,10 +3,11 @@ import { join } from 'path';
 import { homedir, hostname } from 'os';
 import { randomBytes } from 'crypto';
 import { AsyncLocalStorage } from 'async_hooks';
+import { canonicalServerUrl, normalizeBaseUrl } from './global-flags.js';
 function isNodeError(error) {
     return error instanceof Error;
 }
-function getConfigDir() {
+export function getConfigDir() {
     if (process.env.ORIZU_CONFIG_DIR) {
         return process.env.ORIZU_CONFIG_DIR;
     }
@@ -364,6 +365,59 @@ export function getActiveBaseUrl() {
     const config = loadCredentialsConfig();
     return config?.activeBaseUrl || null;
 }
+/** Resolve the selected server and move a retired production credential atomically. */
+export function resolveCredentialServer(selected) {
+    const source = selected ?? getActiveBaseUrl();
+    if (!source)
+        return null;
+    const target = canonicalServerUrl(source);
+    if (normalizeBaseUrl(source) === target)
+        return target;
+    const snapshot = loadCredentialsConfig();
+    // Explicit legacy env/flags are common in hosted processes. Once migrated,
+    // resolution is read-only: do not create a config directory or contend on a lock.
+    if (!snapshot?.servers[source] && snapshot?.activeBaseUrl !== source)
+        return target;
+    return withCredentialsTransactionLock(() => {
+        const config = loadCredentialsConfig();
+        // Another process may have selected a different server while we waited.
+        const currentSource = selected ?? config?.activeBaseUrl;
+        if (!currentSource)
+            return null;
+        const currentTarget = canonicalServerUrl(currentSource);
+        if (!config || normalizeBaseUrl(currentSource) === currentTarget)
+            return currentTarget;
+        const credential = config.servers[currentSource];
+        const destination = config.servers[currentTarget];
+        if (credential && destination && !credentialsEqual(credential, destination)) {
+            throw new Error('A different sign-in is already saved for app.orizu.ai. Run `orizu --server https://app.orizu.ai logout` to remove it, or `orizu --server https://app.orizu.ai login` to sign in again. Plain `orizu logout` removes the selected old sign-in instead. No saved sign-ins were changed.');
+        }
+        let changed = false;
+        if (credential) {
+            config.servers[currentTarget] = credential;
+            delete config.servers[currentSource];
+            changed = true;
+        }
+        if (config.activeBaseUrl === currentSource) {
+            config.activeBaseUrl = currentTarget;
+            changed = true;
+        }
+        if (changed)
+            writeCredentials(config);
+        return currentTarget;
+    });
+}
+const secretsSeenThisProcess = new Set();
+export function rememberProcessSecret(secret) {
+    secretsSeenThisProcess.add(secret);
+    return secret;
+}
+export function rememberResolvedBearer(bearer) {
+    return rememberProcessSecret(bearer);
+}
+export function getSecretsSeenThisProcess() {
+    return [...secretsSeenThisProcess];
+}
 /**
  * In-sandbox bearer resolution (ALI-1044). Resolves a bearer supplied out-of-band
  * to the hosted agent, WITHOUT consulting credentials.json:
@@ -385,7 +439,7 @@ export function getActiveBaseUrl() {
 export function resolveEnvBearerToken() {
     const explicit = process.env.ORIZU_TOKEN;
     if (explicit && explicit.trim()) {
-        return explicit.trim();
+        return rememberResolvedBearer(explicit.trim());
     }
     const tokenFile = process.env.ORIZU_TOKEN_FILE;
     if (tokenFile && tokenFile.length > 0) {
@@ -404,7 +458,7 @@ export function resolveEnvBearerToken() {
         if (!token) {
             throw new Error(`ORIZU_TOKEN_FILE (${tokenFile}) is empty.`);
         }
-        return token;
+        return rememberResolvedBearer(token);
     }
     return null;
 }
@@ -426,7 +480,7 @@ export function resolveAuthTokenForBaseUrl(baseUrl) {
     if (!credentials) {
         throw new Error(`Not logged in for ${baseUrl}. Run \`orizu login --server ${baseUrl}\` (or \`--local\`) first.`);
     }
-    return 'accessToken' in credentials ? credentials.accessToken : credentials.apiKey;
+    return rememberResolvedBearer('accessToken' in credentials ? credentials.accessToken : credentials.apiKey);
 }
 /**
  * Non-throwing "is any auth available?" check (login --no-prompt-if-logged-in,

package/dist/dataset-commands.d.ts

@@ -0,0 +1,16 @@
+declare function createDatasetVersion(): Promise<void>;
+declare function createDatasetSplitSet(): Promise<void>;
+declare function listDatasets(): Promise<void>;
+declare function uploadDataset(): Promise<void>;
+declare function pushDataset(): Promise<void>;
+declare function setDatasetReadme(): Promise<void>;
+declare function downloadDataset(): Promise<void>;
+declare function appendDatasetRows(): Promise<void>;
+declare function editDatasetRows(): Promise<void>;
+declare function deleteDatasetRows(): Promise<void>;
+declare function deleteDataset(): Promise<void>;
+declare function lockDataset(): Promise<void>;
+declare function cloneDataset(): Promise<void>;
+declare function downloadAnnotations(): Promise<void>;
+export { uploadDataset, listDatasets, pushDataset, downloadDataset, appendDatasetRows, setDatasetReadme, createDatasetVersion, createDatasetSplitSet, editDatasetRows, deleteDatasetRows, deleteDataset, lockDataset, cloneDataset, downloadAnnotations, };
+//# sourceMappingURL=dataset-commands.d.ts.map

package/dist/dataset-commands.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"dataset-commands.d.ts","sourceRoot":"","sources":["../src/dataset-commands.ts"],"names":[],"mappings":"AA8IA,iBAAe,oBAAoB,kBAiClC;AAED,iBAAe,qBAAqB,kBAkDnC;AAED,iBAAe,YAAY,kBAW1B;AAsBD,iBAAe,aAAa,kBAiC3B;AAED,iBAAe,WAAW,kBAwCzB;AAED,iBAAe,gBAAgB,kBA+C9B;AAgBD,iBAAe,eAAe,kBA8B7B;AA0ED,iBAAe,iBAAiB,kBAiG/B;AAED,iBAAe,eAAe,kBAyB7B;AAED,iBAAe,iBAAiB,kBAyC/B;AA0BD,iBAAe,aAAa,kBA8B3B;AAED,iBAAe,WAAW,kBAwCzB;AAED,iBAAe,YAAY,kBAuC1B;AAED,iBAAe,mBAAmB,kBA+BjC;AAED,OAAO,EACL,aAAa,EACb,YAAY,EACZ,WAAW,EACX,eAAe,EACf,iBAAiB,EACjB,gBAAgB,EAChB,oBAAoB,EACpB,qBAAqB,EACrB,eAAe,EACf,iBAAiB,EACjB,aAAa,EACb,WAAW,EACX,YAAY,EACZ,mBAAmB,GACpB,CAAA"}