orizu 0.5.40 → 0.5.41

package/dist/last-error-record.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"last-error-record.d.ts","sourceRoot":"","sources":["../src/last-error-record.ts"],"names":[],"mappings":"AAkCA,MAAM,WAAW,eAAe;IAC9B,OAAO,EAAE,CAAC,CAAA;IACV,UAAU,EAAE,MAAM,CAAA;IAClB,UAAU,EAAE,MAAM,GAAG,IAAI,CAAA;IACzB,IAAI,EAAE,MAAM,GAAG,IAAI,CAAA;IACnB,aAAa,EAAE,MAAM,GAAG,IAAI,CAAA;IAC5B,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAA;IACvB,OAAO,EAAE,MAAM,GAAG,IAAI,CAAA;IACtB,IAAI,EAAE,MAAM,EAAE,CAAA;IACd,aAAa,EAAE,OAAO,CAAA;IACtB,OAAO,EAAE,MAAM,CAAA;IACf,gBAAgB,EAAE,OAAO,CAAA;CAC1B;AAED,eAAO,MAAM,yBAAyB,IAAI,CAAA;AAC1C,eAAO,MAAM,mBAAmB,oBAAoB,CAAA;AACpD,eAAO,MAAM,4BAA4B,WAAa,CAAA;AACtD,eAAO,MAAM,4BAA4B,gBAAgB,CAAA;AAezD,MAAM,WAAW,oBAAoB;IACnC,IAAI,EAAE,SAAS,MAAM,EAAE,CAAA;IACvB,OAAO,EAAE,MAAM,CAAA;IACf,UAAU,EAAE,MAAM,GAAG,IAAI,CAAA;IACzB,IAAI,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IACpB,aAAa,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IAC7B,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IACxB,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IACvB,OAAO,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;IAC3B,GAAG,CAAC,EAAE,IAAI,CAAA;CACX;AAED,MAAM,WAAW,2BAA2B;IAC1C,SAAS,CAAC,EAAE,MAAM,CAAA;CACnB;AA8ID,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,GAAG,IAAI,CAKlE;AA6DD,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,oBAAoB,GAAG,eAAe,CA0DjF;AAED,wBAAgB,sBAAsB,CAAC,SAAS,CAAC,EAAE,MAAM,GAAG,MAAM,CAEjE;AAED,wBAAgB,oBAAoB,CAClC,KAAK,EAAE,oBAAoB,EAC3B,OAAO,GAAE,2BAAgC,GACxC,IAAI,CAyCN;AAED,wBAAgB,mBAAmB,CAAC,SAAS,CAAC,EAAE,MAAM,GAAG,eAAe,GAAG,IAAI,CAgB9E"}
+{"version":3,"file":"last-error-record.d.ts","sourceRoot":"","sources":["../src/last-error-record.ts"],"names":[],"mappings":"AAqBA,MAAM,WAAW,eAAe;IAC9B,OAAO,EAAE,CAAC,CAAA;IACV,UAAU,EAAE,MAAM,CAAA;IAClB,UAAU,EAAE,MAAM,GAAG,IAAI,CAAA;IACzB,IAAI,EAAE,MAAM,GAAG,IAAI,CAAA;IACnB,aAAa,EAAE,MAAM,GAAG,IAAI,CAAA;IAC5B,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAA;IACvB,OAAO,EAAE,MAAM,GAAG,IAAI,CAAA;IACtB,IAAI,EAAE,MAAM,EAAE,CAAA;IACd,aAAa,EAAE,OAAO,CAAA;IACtB,OAAO,EAAE,MAAM,CAAA;IACf,gBAAgB,EAAE,OAAO,CAAA;CAC1B;AAED,eAAO,MAAM,yBAAyB,IAAI,CAAA;AAC1C,eAAO,MAAM,mBAAmB,oBAAoB,CAAA;AACpD,eAAO,MAAM,4BAA4B,WAAa,CAAA;AACtD,eAAO,MAAM,4BAA4B,gBAAgB,CAAA;AAezD,MAAM,WAAW,oBAAoB;IACnC,IAAI,EAAE,SAAS,MAAM,EAAE,CAAA;IACvB,OAAO,EAAE,MAAM,CAAA;IACf,UAAU,EAAE,MAAM,GAAG,IAAI,CAAA;IACzB,IAAI,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IACpB,aAAa,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IAC7B,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IACxB,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IACvB,OAAO,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;IAC3B,GAAG,CAAC,EAAE,IAAI,CAAA;CACX;AAED,MAAM,WAAW,2BAA2B;IAC1C,SAAS,CAAC,EAAE,MAAM,CAAA;CACnB;AA8ID,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,GAAG,IAAI,CAKlE;AAUD,wBAAgB,iBAAiB,CAC/B,KAAK,EAAE,OAAO,EACd,iBAAiB,EAAE,MAAM,EACzB,YAAY,EAAE,OAAO,GACpB,KAAK,IAAI,MAAM,CAMjB;AAED,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,MAAM,GAAG,IAAI,CAIpF;AAED,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,oBAAoB,GAAG,eAAe,CA0DjF;AAED,wBAAgB,sBAAsB,CAAC,SAAS,CAAC,EAAE,MAAM,GAAG,MAAM,CAEjE;AAED,wBAAsB,oBAAoB,CACxC,KAAK,EAAE,oBAAoB,EAC3B,OAAO,GAAE,2BAAgC,GACxC,OAAO,CAAC,IAAI,CAAC,CAqBf;AAED,wBAAsB,mBAAmB,CAAC,SAAS,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,GAAG,IAAI,CAAC,CAQ7F"}

package/dist/last-error-record.js

@@ -1,5 +1,3 @@
-import { randomBytes } from 'crypto';
-import { chmodSync, closeSync, fsyncSync, mkdirSync, openSync, readFileSync, renameSync, rmSync, statSync, writeFileSync, } from 'fs';
 import { homedir } from 'os';
 import { join } from 'path';
 import { getConfigDir, getSecretsSeenThisProcess, resolveAuthTokenForBaseUrl, resolveEnvBearerToken, } from './credentials.js';
@@ -154,7 +152,7 @@ function resolveHomeDir() {
         return null;
     }
 }
-function isStringWithinCap(value, maximumCharacters, wasTruncated) {
+export function isStringWithinCap(value, maximumCharacters, wasTruncated) {
     if (typeof value !== 'string')
         return false;
     if (value.length <= maximumCharacters)
@@ -163,41 +161,11 @@ function isStringWithinCap(value, maximumCharacters, wasTruncated) {
         && value.length <= maximumCharacters + LAST_ERROR_TRUNCATION_MARKER.length
         && value.endsWith(LAST_ERROR_TRUNCATION_MARKER);
 }
-function boundedServerBaseUrl(value) {
+export function boundedServerBaseUrl(value) {
     return value && Buffer.byteLength(value, 'utf8') <= LAST_ERROR_SERVER_BASE_URL_MAX_BYTES
         ? value
         : null;
 }
-function isLastErrorRecord(value) {
-    if (!value || typeof value !== 'object' || Array.isArray(value))
-        return false;
-    const record = value;
-    if (record.version !== LAST_ERROR_RECORD_VERSION)
-        return false;
-    if (typeof record.recordedAt !== 'string' || !Number.isFinite(Date.parse(record.recordedAt)))
-        return false;
-    if (typeof record.cliVersion !== 'string' && record.cliVersion !== null)
-        return false;
-    if (record.code !== undefined && record.code !== null && (typeof record.code !== 'string'
-        || Array.from(record.code).length > LAST_ERROR_CODE_MAX_CHARS))
-        return false;
-    if (record.serverBaseUrl !== undefined && typeof record.serverBaseUrl !== 'string' && record.serverBaseUrl !== null)
-        return false;
-    if (record.teamSlug !== undefined && typeof record.teamSlug !== 'string' && record.teamSlug !== null)
-        return false;
-    if (typeof record.argvTruncated !== 'boolean')
-        return false;
-    const argvTruncated = record.argvTruncated;
-    if (record.command !== null && !isStringWithinCap(record.command, LAST_ERROR_ARG_MAX_CHARS, argvTruncated))
-        return false;
-    if (!Array.isArray(record.argv) || record.argv.length > LAST_ERROR_MAX_ARGS)
-        return false;
-    if (!record.argv.every(argument => isStringWithinCap(argument, LAST_ERROR_ARG_MAX_CHARS, argvTruncated)))
-        return false;
-    if (typeof record.messageTruncated !== 'boolean')
-        return false;
-    return isStringWithinCap(record.message, LAST_ERROR_MESSAGE_MAX_CHARS, record.messageTruncated);
-}
 export function buildLastErrorRecord(input) {
     const context = {
         homeDir: input.homeDir ?? null,
@@ -255,11 +223,9 @@ export function buildLastErrorRecord(input) {
 export function getLastErrorRecordPath(configDir) {
     return join(configDir ?? getConfigDir(), LAST_ERROR_FILENAME);
 }
-export function writeLastErrorRecord(input, options = {}) {
+export async function writeLastErrorRecord(input, options = {}) {
     try {
         const configDirectory = options.configDir ?? getConfigDir();
-        mkdirSync(configDirectory, { recursive: true, mode: 0o700 });
-        chmodSync(configDirectory, 0o700);
         const record = buildLastErrorRecord({
             ...input,
             homeDir: input.homeDir === undefined ? resolveHomeDir() : input.homeDir,
@@ -272,43 +238,19 @@ export function writeLastErrorRecord(input, options = {}) {
         const serialized = serializeRecord(record);
         if (Buffer.byteLength(serialized, 'utf8') > LAST_ERROR_FILE_MAX_BYTES)
             return;
-        const path = getLastErrorRecordPath(configDirectory);
-        const temporaryPath = join(configDirectory, `.${LAST_ERROR_FILENAME}.${process.pid}.${randomBytes(8).toString('hex')}.tmp`);
-        try {
-            const fileDescriptor = openSync(temporaryPath, 'wx', 0o600);
-            try {
-                writeFileSync(fileDescriptor, serialized, 'utf8');
-                fsyncSync(fileDescriptor);
-            }
-            finally {
-                closeSync(fileDescriptor);
-            }
-            chmodSync(temporaryPath, 0o600);
-            renameSync(temporaryPath, path);
-            chmodSync(path, 0o600);
-        }
-        finally {
-            rmSync(temporaryPath, { force: true });
-        }
+        const { publishLastErrorRecord } = await import('./last-error-workflow.js');
+        await publishLastErrorRecord(configDirectory, serialized);
     }
     catch {
-        // A diagnostic record is best effort and must never replace the original CLI failure.
+        // A diagnostic record is best effort and must never replace the original CLI failure,
+        // including when Effect cannot load (a packed CLI without its dependencies).
     }
 }
-export function readLastErrorRecord(configDir) {
+export async function readLastErrorRecord(configDir) {
     try {
         const path = getLastErrorRecordPath(configDir);
-        if (statSync(path).size > LAST_ERROR_FILE_MAX_BYTES)
-            return null;
-        const record = JSON.parse(readFileSync(path, 'utf8'));
-        return isLastErrorRecord(record)
-            ? {
-                ...record,
-                code: record.code ?? null,
-                serverBaseUrl: boundedServerBaseUrl(record.serverBaseUrl),
-                teamSlug: record.teamSlug ?? null,
-            }
-            : null;
+        const { loadLastErrorRecord } = await import('./last-error-workflow.js');
+        return await loadLastErrorRecord(path);
     }
     catch {
         return null;

package/dist/last-error-workflow.d.ts

@@ -0,0 +1,4 @@
+import { type LastErrorRecord } from './last-error-record.js';
+export declare function publishLastErrorRecord(configDirectory: string, serialized: string): Promise<void>;
+export declare function loadLastErrorRecord(path: string): Promise<LastErrorRecord | null>;
+//# sourceMappingURL=last-error-workflow.d.ts.map

package/dist/last-error-workflow.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"last-error-workflow.d.ts","sourceRoot":"","sources":["../src/last-error-workflow.ts"],"names":[],"mappings":"AAuBA,OAAO,EAKL,KAAK,eAAe,EACrB,MAAM,wBAAwB,CAAA;AAmE/B,wBAAgB,sBAAsB,CAAC,eAAe,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAEjG;AAoBD,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,GAAG,IAAI,CAAC,CAEjF"}

package/dist/last-error-workflow.js

@@ -0,0 +1,78 @@
+import { randomBytes } from 'crypto';
+import { chmodSync, closeSync, fsyncSync, mkdirSync, openSync, readFileSync, renameSync, rmSync, statSync, writeFileSync, } from 'fs';
+import { join } from 'path';
+import { Effect, Schema } from 'effect';
+import { LAST_ERROR_ARG_MAX_CHARS, LAST_ERROR_CODE_MAX_CHARS, LAST_ERROR_FILE_MAX_BYTES, LAST_ERROR_MAX_ARGS, LAST_ERROR_MESSAGE_MAX_CHARS, } from './last-error-caps.js';
+import { boundedServerBaseUrl, isStringWithinCap, LAST_ERROR_FILENAME, LAST_ERROR_RECORD_VERSION, } from './last-error-record.js';
+// ORI-2450: Effect owns the last-error file's publication and reading.
+// last-error-record.ts loads this module with a literal dynamic import, so the
+// npm CLI only loads Effect on a failure or a feedback read, and the source
+// bundle still includes it.
+class LastErrorFileFailure extends Error {
+    operation;
+    constructor(operation) {
+        super(`Could not ${operation}`);
+        this.operation = operation;
+    }
+}
+const file = (operation, action) => Effect.try({
+    try: action,
+    catch: () => new LastErrorFileFailure(operation),
+});
+const NullableString = Schema.NullOr(Schema.String);
+const LastErrorRecordSchema = Schema.Struct({
+    version: Schema.Literal(LAST_ERROR_RECORD_VERSION),
+    recordedAt: Schema.String.check(Schema.makeFilter(value => Number.isFinite(Date.parse(value)))),
+    cliVersion: NullableString,
+    code: Schema.optionalKey(NullableString.check(Schema.makeFilter(value => value === null || Array.from(value).length <= LAST_ERROR_CODE_MAX_CHARS))),
+    serverBaseUrl: Schema.optionalKey(NullableString),
+    teamSlug: Schema.optionalKey(NullableString),
+    command: NullableString,
+    argv: Schema.Array(Schema.String),
+    argvTruncated: Schema.Boolean,
+    message: Schema.String,
+    messageTruncated: Schema.Boolean,
+}).check(Schema.makeFilter(record => (record.command === null || isStringWithinCap(record.command, LAST_ERROR_ARG_MAX_CHARS, record.argvTruncated))
+    && record.argv.length <= LAST_ERROR_MAX_ARGS
+    && record.argv.every(argument => isStringWithinCap(argument, LAST_ERROR_ARG_MAX_CHARS, record.argvTruncated))
+    && isStringWithinCap(record.message, LAST_ERROR_MESSAGE_MAX_CHARS, record.messageTruncated)));
+const publication = (configDirectory, serialized) => Effect.gen(function* () {
+    yield* file('create directory', () => mkdirSync(configDirectory, { recursive: true, mode: 0o700 }));
+    yield* file('protect directory', () => chmodSync(configDirectory, 0o700));
+    const path = join(configDirectory, LAST_ERROR_FILENAME);
+    // Write a private temporary file, then rename it over the record, so a
+    // reader never sees a half-written record and a failed write keeps the old one.
+    yield* Effect.acquireUseRelease(Effect.sync(() => join(configDirectory, `.${LAST_ERROR_FILENAME}.${process.pid}.${randomBytes(8).toString('hex')}.tmp`)), temporaryPath => Effect.gen(function* () {
+        yield* Effect.acquireUseRelease(file('open temporary record', () => openSync(temporaryPath, 'wx', 0o600)), descriptor => Effect.gen(function* () {
+            yield* file('write temporary record', () => writeFileSync(descriptor, serialized, 'utf8'));
+            yield* file('flush temporary record', () => fsyncSync(descriptor));
+        }), descriptor => Effect.sync(() => closeSync(descriptor)));
+        yield* file('protect temporary record', () => chmodSync(temporaryPath, 0o600));
+        yield* file('publish record', () => renameSync(temporaryPath, path));
+        yield* file('protect published record', () => chmodSync(path, 0o600));
+    }), temporaryPath => Effect.sync(() => rmSync(temporaryPath, { force: true })));
+});
+export function publishLastErrorRecord(configDirectory, serialized) {
+    return Effect.runPromise(publication(configDirectory, serialized));
+}
+const loading = (path) => Effect.gen(function* () {
+    const stat = yield* file('inspect record', () => statSync(path));
+    if (stat.size > LAST_ERROR_FILE_MAX_BYTES)
+        return null;
+    const text = yield* file('read record', () => readFileSync(path, 'utf8'));
+    const raw = yield* file('parse record', () => JSON.parse(text));
+    const record = yield* Schema.decodeUnknownEffect(LastErrorRecordSchema)(raw);
+    // The Schema checks the known fields; the reader has always kept any others.
+    const admitted = {
+        ...raw,
+        ...record,
+        argv: [...record.argv],
+        code: record.code ?? null,
+        serverBaseUrl: boundedServerBaseUrl(record.serverBaseUrl),
+        teamSlug: record.teamSlug ?? null,
+    };
+    return admitted;
+});
+export function loadLastErrorRecord(path) {
+    return Effect.runPromise(loading(path).pipe(Effect.orElseSucceed(() => null)));
+}

package/dist/task-commands.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"task-commands.d.ts","sourceRoot":"","sources":["../src/task-commands.ts"],"names":[],"mappings":"AA8CA,iBAAe,SAAS,kBAWvB;AAED,iBAAS,mBAAmB,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,MAAM,EAAE,CAQ3D;AA6CD,iBAAe,UAAU,kBA0IxB;AAED,iBAAe,UAAU,kBA+GxB;AAED,iBAAe,WAAW,kBAkCzB;AAED,iBAAe,WAAW,kBAoEzB;AAED,iBAAe,UAAU,kBA8DxB;AAED,iBAAe,UAAU,kBA0CxB;AAED,iBAAe,gBAAgB,CAAC,YAAY,EAAE,QAAQ,GAAG,QAAQ,GAAG,WAAW,iBAwB9E;AAED,iBAAe,aAAa,kBAkD3B;AAED,iBAAe,aAAa,kBA+B3B;AAED,OAAO,EACL,mBAAmB,EACnB,SAAS,EACT,UAAU,EACV,UAAU,EACV,WAAW,EACX,WAAW,EACX,UAAU,EACV,UAAU,EACV,aAAa,EACb,aAAa,EACb,gBAAgB,GACjB,CAAA"}
+{"version":3,"file":"task-commands.d.ts","sourceRoot":"","sources":["../src/task-commands.ts"],"names":[],"mappings":"AAgCA,iBAAe,SAAS,kBAWvB;AAED,iBAAS,mBAAmB,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,MAAM,EAAE,CAQ3D;AA6CD,iBAAe,UAAU,kBA0IxB;AAED,iBAAe,UAAU,kBA+GxB;AAED,iBAAe,WAAW,kBAkCzB;AAED,iBAAe,WAAW,kBAoEzB;AAED,iBAAe,UAAU,kBA8DxB;AAED,iBAAe,UAAU,kBA0CxB;AAED,iBAAe,gBAAgB,CAAC,YAAY,EAAE,QAAQ,GAAG,QAAQ,GAAG,WAAW,iBAwB9E;AAED,iBAAe,aAAa,kBAkC3B;AAED,iBAAe,aAAa,kBA2B3B;AAED,OAAO,EACL,mBAAmB,EACnB,SAAS,EACT,UAAU,EACV,UAAU,EACV,WAAW,EACX,WAAW,EACX,UAAU,EACV,UAAU,EACV,aAAa,EACb,aAAa,EACb,gBAAgB,GACjB,CAAA"}

package/dist/task-commands.js

@@ -461,18 +461,14 @@ async function setTaskReport() {
     if (!report) {
         throw new Error('Usage: orizu tasks report set --task <taskId> (--report <markdown|@file> | --report-file <path>) [--json]');
     }
-    const response = await authedFetch(`/api/cli/tasks/${encodeURIComponent(taskId)}/report`, {
-        method: 'PATCH',
-        headers: { 'Content-Type': 'application/json' },
-        body: JSON.stringify({
-            reportMarkdown: report.markdown,
-            reportSourceName: report.sourceName,
-        }),
-    });
-    if (!response.ok) {
-        throw new Error(`Failed to update task report: ${await response.text()}`);
+    // Loaded lazily: the workflow pulls in Effect (ORI-2408).
+    const workflow = await import('./task-report-workflow.js');
+    const outcome = await workflow.setTaskReport(taskId, report);
+    if (outcome.kind === 'interrupted') {
+        process.exitCode = outcome.exitCode;
+        return;
     }
-    const data = await parseJsonResponse(response, 'Task report update');
+    const data = outcome.reply;
     if (hasJsonFlag()) {
         printJson(data);
         return;
@@ -486,11 +482,8 @@ async function getTaskReport() {
     if (!taskId) {
         throw new Error('Usage: orizu tasks report get --task <taskId> [--json]');
     }
-    const response = await authedFetch(`/api/cli/tasks/${encodeURIComponent(taskId)}/report`);
-    if (!response.ok) {
-        throw new Error(`Failed to read task report: ${await response.text()}`);
-    }
-    const data = await parseJsonResponse(response, 'Task report get');
+    const workflow = await import('./task-report-workflow.js');
+    const data = await workflow.getTaskReport(taskId);
     if (hasJsonFlag()) {
         printJson(data);
         return;

package/dist/task-report-workflow.d.ts

@@ -0,0 +1,47 @@
+import { Schema } from 'effect';
+declare const SetReply: Schema.Struct<{
+    readonly task: Schema.Struct<{
+        readonly id: Schema.String;
+        readonly status: Schema.String;
+        readonly report: Schema.Struct<{
+            readonly markdown: Schema.String;
+            readonly sourceName: Schema.NullOr<Schema.String>;
+            readonly createdAt: Schema.NullOr<Schema.String>;
+        }>;
+    }>;
+}>;
+declare const GetReply: Schema.Struct<{
+    readonly task: Schema.Struct<{
+        readonly id: Schema.String;
+        readonly title: Schema.optionalKey<Schema.NullOr<Schema.String>>;
+        readonly status: Schema.optionalKey<Schema.NullOr<Schema.String>>;
+        readonly report: Schema.Struct<{
+            readonly markdown: Schema.String;
+            readonly sourceName: Schema.NullOr<Schema.String>;
+            readonly createdAt: Schema.NullOr<Schema.String>;
+            readonly updatedAt: Schema.optionalKey<Schema.NullOr<Schema.String>>;
+        }>;
+    }>;
+}>;
+type TaskReportSetReply = typeof SetReply.Type;
+export type TaskReportGetReply = typeof GetReply.Type;
+export type TaskReportSetOutcome = {
+    kind: 'saved';
+    reply: TaskReportSetReply;
+} | {
+    kind: 'interrupted';
+    exitCode: 130 | 143;
+};
+/**
+ * `orizu tasks report set`. Ctrl-C or SIGTERM aborts the request and, once it
+ * was sent, says the report may already be saved: the server finishes on its
+ * own. Other failures throw, adding the same line when the outcome is unknown.
+ */
+export declare function setTaskReport(taskId: string, report: {
+    markdown: string;
+    sourceName: string | null;
+}): Promise<TaskReportSetOutcome>;
+/** `orizu tasks report get`: one read with a deadline. Signals keep Node's default handling. */
+export declare function getTaskReport(taskId: string): Promise<TaskReportGetReply>;
+export {};
+//# sourceMappingURL=task-report-workflow.d.ts.map

package/dist/task-report-workflow.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"task-report-workflow.d.ts","sourceRoot":"","sources":["../src/task-report-workflow.ts"],"names":[],"mappings":"AAAA,OAAO,EAA+B,MAAM,EAAE,MAAM,QAAQ,CAAA;AAa5D,QAAA,MAAM,QAAQ;;;;;;;;;;EAUZ,CAAA;AAGF,QAAA,MAAM,QAAQ;;;;;;;;;;;;EAYZ,CAAA;AAEF,KAAK,kBAAkB,GAAG,OAAO,QAAQ,CAAC,IAAI,CAAA;AAC9C,MAAM,MAAM,kBAAkB,GAAG,OAAO,QAAQ,CAAC,IAAI,CAAA;AAwErD,MAAM,MAAM,oBAAoB,GAC5B;IAAE,IAAI,EAAE,OAAO,CAAC;IAAC,KAAK,EAAE,kBAAkB,CAAA;CAAE,GAC5C;IAAE,IAAI,EAAE,aAAa,CAAC;IAAC,QAAQ,EAAE,GAAG,GAAG,GAAG,CAAA;CAAE,CAAA;AAEhD;;;;GAIG;AACH,wBAAsB,aAAa,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,GAAG,IAAI,CAAA;CAAE,GAAG,OAAO,CAAC,oBAAoB,CAAC,CAkC1I;AAQD,gGAAgG;AAChG,wBAAsB,aAAa,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAa/E"}

package/dist/task-report-workflow.js

@@ -0,0 +1,160 @@
+import { Cause, Effect, Exit, Result, Schema } from 'effect';
+import { datasetTransferTimeoutMs } from './dataset-transfer-policy.js';
+import { isJsonErrorResponsePayload } from './error-response.js';
+import { authedFetch } from './http.js';
+import { parseJsonResponse } from './json-response.js';
+// Loaded only through `await import(...)` from task-commands. One request per
+// command, never retried, with the same deadline as the dataset workflows.
+const mayBeSaved = (taskId) => `The task report may already be saved: check with \`orizu tasks report get --task ${taskId}\` before setting it again.`;
+const SetReply = Schema.Struct({
+    task: Schema.Struct({
+        id: Schema.String,
+        status: Schema.String,
+        report: Schema.Struct({
+            markdown: Schema.String,
+            sourceName: Schema.NullOr(Schema.String),
+            createdAt: Schema.NullOr(Schema.String),
+        }),
+    }),
+});
+// title, status and updatedAt stay optional, as in the payload type this replaced.
+const GetReply = Schema.Struct({
+    task: Schema.Struct({
+        id: Schema.String,
+        title: Schema.optionalKey(Schema.NullOr(Schema.String)),
+        status: Schema.optionalKey(Schema.NullOr(Schema.String)),
+        report: Schema.Struct({
+            markdown: Schema.String,
+            sourceName: Schema.NullOr(Schema.String),
+            createdAt: Schema.NullOr(Schema.String),
+            updatedAt: Schema.optionalKey(Schema.NullOr(Schema.String)),
+        }),
+    }),
+});
+// `mayBeSaved` (the #2164 rule): an error reply in the app's own `{ error }`
+// shape is reported plainly, whatever its status. A lost, stalled or unreadable
+// reply, a 5xx that did not come from the app (a gateway giving up while the
+// app kept working), or a reply of the wrong shape means it may have been saved.
+class ReportRequestFailure extends Error {
+    mayBeSaved;
+    constructor(message, mayBeSaved, cause) {
+        super(message, { cause });
+        this.mayBeSaved = mayBeSaved;
+    }
+}
+function isAppError(response, text) {
+    try {
+        return isJsonErrorResponsePayload(response, JSON.parse(text));
+    }
+    catch {
+        return false;
+    }
+}
+/** One request with a deadline. Returns the reply as parsed once `accepts` agrees with its shape. */
+function reportRequest(input) {
+    return Effect.suspend(() => {
+        let sent = false;
+        let timedOut = false;
+        return Effect.tryPromise({
+            try: async (signal) => {
+                const request = new AbortController();
+                const abort = () => request.abort();
+                const timer = setTimeout(() => { timedOut = true; request.abort(); }, input.timeoutMs);
+                if (signal.aborted)
+                    abort();
+                else
+                    signal.addEventListener('abort', abort, { once: true });
+                try {
+                    const response = await authedFetch(`/api/cli/tasks/${encodeURIComponent(input.taskId)}/report`, { ...input.init, signal: request.signal }, () => { sent = true; input.onSent?.(); });
+                    if (!response.ok) {
+                        const text = await response.text();
+                        const fromApp = isAppError(response, text);
+                        throw new ReportRequestFailure(`${input.failurePrefix}: ${text}`, response.status < 400 || (response.status >= 500 && !fromApp));
+                    }
+                    const data = await parseJsonResponse(response, input.label);
+                    if (!input.accepts(data)) {
+                        throw new ReportRequestFailure(`${input.label} returned an unexpected response (status ${response.status}).`, true);
+                    }
+                    return data;
+                }
+                finally {
+                    clearTimeout(timer);
+                    signal.removeEventListener('abort', abort);
+                    request.abort();
+                }
+            },
+            catch: cause => {
+                if (timedOut)
+                    return new ReportRequestFailure(input.deadlineMessage, sent, cause);
+                if (cause instanceof ReportRequestFailure)
+                    return cause;
+                return new ReportRequestFailure(cause instanceof Error ? cause.message : String(cause), sent, cause);
+            },
+        });
+    });
+}
+const accepts = (schema) => (data) => Result.isSuccess(Schema.decodeUnknownResult(schema)(data));
+/**
+ * `orizu tasks report set`. Ctrl-C or SIGTERM aborts the request and, once it
+ * was sent, says the report may already be saved: the server finishes on its
+ * own. Other failures throw, adding the same line when the outcome is unknown.
+ */
+export async function setTaskReport(taskId, report) {
+    const timeoutMs = datasetTransferTimeoutMs();
+    const controller = new AbortController();
+    let interrupted;
+    let sent = false;
+    const interrupt = () => { interrupted ??= 130; controller.abort(); };
+    const terminate = () => { interrupted ??= 143; controller.abort(); };
+    process.on('SIGINT', interrupt);
+    process.on('SIGTERM', terminate);
+    try {
+        const exit = await Effect.runPromiseExit(reportRequest({
+            taskId,
+            init: {
+                method: 'PATCH',
+                headers: { 'Content-Type': 'application/json' },
+                body: JSON.stringify({ reportMarkdown: report.markdown, reportSourceName: report.sourceName }),
+            },
+            failurePrefix: 'Failed to update task report',
+            label: 'Task report update',
+            accepts: accepts(SetReply),
+            deadlineMessage: 'Task report save exceeded its deadline',
+            timeoutMs,
+            onSent: () => { sent = true; },
+        }), { signal: controller.signal });
+        if (interrupted !== undefined) {
+            process.stderr.write(sent ? `Task report save interrupted. ${mayBeSaved(taskId)}\n` : 'Task report save interrupted.\n');
+            return { kind: 'interrupted', exitCode: interrupted };
+        }
+        if (Exit.isSuccess(exit))
+            return { kind: 'saved', reply: exit.value };
+        throw withMayBeSaved(Cause.squash(exit.cause), taskId);
+    }
+    finally {
+        process.removeListener('SIGINT', interrupt);
+        process.removeListener('SIGTERM', terminate);
+    }
+}
+function withMayBeSaved(failure, taskId) {
+    if (!(failure instanceof ReportRequestFailure))
+        return failure;
+    const message = failure.mayBeSaved ? `${failure.message}\n${mayBeSaved(taskId)}` : failure.message;
+    return new Error(message, { cause: failure.cause });
+}
+/** `orizu tasks report get`: one read with a deadline. Signals keep Node's default handling. */
+export async function getTaskReport(taskId) {
+    const exit = await Effect.runPromiseExit(reportRequest({
+        taskId,
+        init: {},
+        failurePrefix: 'Failed to read task report',
+        label: 'Task report get',
+        accepts: accepts(GetReply),
+        deadlineMessage: 'Task report read exceeded its deadline',
+        timeoutMs: datasetTransferTimeoutMs(),
+    }));
+    if (Exit.isSuccess(exit))
+        return exit.value;
+    const failure = Cause.squash(exit.cause);
+    throw failure instanceof ReportRequestFailure ? new Error(failure.message, { cause: failure.cause }) : failure;
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "orizu",
-  "version": "0.5.40",
+  "version": "0.5.41",
   "private": false,
   "type": "module",
   "main": "./dist/index.js",

package/src/dataset-clone-workflow.ts

@@ -0,0 +1,100 @@
+import { Cause, Effect, Exit, Result, Schema } from 'effect'
+
+import { datasetTransferTimeoutMs } from './dataset-transfer-policy.js'
+import { authedFetch } from './http.js'
+import { parseJsonResponse } from './json-response.js'
+
+// Loaded only through `await import(...)` from dataset-commands, like lock.
+
+const SERVER_MAY_BE_CREATED = 'Dataset clone may already be created'
+
+const ClonedDataset = Schema.Struct({
+  id: Schema.String,
+  name: Schema.String,
+  rowCount: Schema.Number,
+  parentDatasetId: Schema.String,
+})
+const CloneReply = Schema.Struct({ dataset: ClonedDataset })
+const ErrorReply = Schema.Struct({ error: Schema.String })
+export type ClonedDataset = typeof ClonedDataset.Type
+
+// A refusal means nothing was cloned. After any other failure once the request
+// was sent, the clone may exist. Unlike lock, cloning again is not harmless: it
+// makes another copy, so the clone is never retried and the user is told to look.
+class CloneFailure extends Error {
+  constructor(message: string, readonly mayBeCreated: boolean) { super(message) }
+}
+
+function mayBeCreatedGuidance(name: string | null): string {
+  const target = name ? `a dataset named ${JSON.stringify(name)}` : 'a new dataset named after the source with " Copy" at the end'
+  return `The clone may already have been created. Run \`orizu datasets list\` and look for ${target} before cloning again: running clone again makes another copy.`
+}
+
+// authedFetch raises this code only when it sent nothing, or when the server
+// answered 401 and the changed credentials stopped a replay. Nothing was cloned.
+function isAuthContextChange(cause: unknown): boolean {
+  return cause instanceof Error && cause.message.startsWith('ORIZU_AUTH_CONTEXT_CHANGED:')
+}
+
+function serverError(text: string): string | null {
+  try {
+    const decoded = Schema.decodeUnknownResult(ErrorReply)(JSON.parse(text))
+    return Result.isSuccess(decoded) ? decoded.success.error : null
+  } catch {
+    return null
+  }
+}
+
+function cloneRequest(datasetId: string, name: string | null, timeoutMs: number) {
+  return Effect.suspend(() => {
+    let sent = false
+    let timedOut = false
+    return Effect.tryPromise({
+      try: async signal => {
+        const request = new AbortController()
+        const abort = () => request.abort()
+        const timer = setTimeout(() => { timedOut = true; request.abort() }, timeoutMs)
+        if (signal.aborted) abort()
+        else signal.addEventListener('abort', abort, { once: true })
+        try {
+          const response = await authedFetch(`/api/cli/datasets/${encodeURIComponent(datasetId)}/clone`, {
+            method: 'POST',
+            headers: { 'Content-Type': 'application/json' },
+            body: JSON.stringify(name ? { name } : {}),
+            signal: request.signal,
+          }, () => { sent = true })
+          if (!response.ok) {
+            const text = await response.text()
+            const error = serverError(text)
+            // The app's own 5xx bodies name what happened; anything else at 5xx
+            // (a gateway page, an empty body) says nothing about the clone.
+            const mayBeCreated = response.status < 400 || error === SERVER_MAY_BE_CREATED || (response.status >= 500 && error === null)
+            throw new CloneFailure(`Clone failed: ${text}`, mayBeCreated)
+          }
+          const data = await parseJsonResponse<unknown>(response, 'Dataset clone')
+          const decoded = Schema.decodeUnknownResult(CloneReply)(data)
+          if (Result.isFailure(decoded)) {
+            throw new CloneFailure(`Dataset clone returned an unexpected response (status ${response.status}).`, true)
+          }
+          return decoded.success.dataset
+        } finally {
+          clearTimeout(timer)
+          signal.removeEventListener('abort', abort)
+          request.abort()
+        }
+      },
+      catch: cause => {
+        if (timedOut) return new CloneFailure('DATASET_TRANSFER_TIMEOUT: Dataset clone exceeded its deadline', true)
+        if (cause instanceof CloneFailure) return cause
+        return new CloneFailure(cause instanceof Error ? cause.message : String(cause), sent && !isAuthContextChange(cause))
+      },
+    })
+  }).pipe(Effect.mapError(failure => new Error(failure.mayBeCreated ? `${failure.message}\n${mayBeCreatedGuidance(name)}` : failure.message)))
+}
+
+// Nothing to clean up, so signals keep Node's default handling.
+export async function cloneDataset(datasetId: string, name: string | null): Promise<ClonedDataset> {
+  const exit = await Effect.runPromiseExit(cloneRequest(datasetId, name, datasetTransferTimeoutMs()))
+  if (Exit.isSuccess(exit)) return exit.value
+  throw Cause.squash(exit.cause)
+}