orizu 0.5.50 → 0.5.52

package/dist/app-commands.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"app-commands.d.ts","sourceRoot":"","sources":["../src/app-commands.ts"],"names":[],"mappings":"AAuCA,iBAAe,QAAQ,kBActB;AAED,iBAAS,cAAc,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAU/C;AAED,iBAAS,eAAe,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAUhD;AAED,iBAAS,YAAY,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAE9D;AAeD,iBAAS,QAAQ,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAElE;AAED,iBAAS,gBAAgB,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAG1F;AAED,iBAAS,gBAAgB,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,MAAM,CAUjE;AAED,iBAAS,SAAS,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,GAAG,MAAM,CAEjD;AAED,iBAAS,qBAAqB,CAAC,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,SAAS,EAAE,MAAM,GAAG;IACpF,IAAI,EAAE,MAAM,CAAA;IACZ,QAAQ,EAAE,MAAM,CAAA;IAChB,IAAI,EAAE,MAAM,CAAA;CACb,CAeA;AAED,iBAAS,kBAAkB,CAAC,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,SAAS,EAAE,MAAM;;;;;IAoB/E;AAED,iBAAS,wBAAwB,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,QAGjE;AAED,iBAAS,gBAAgB,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAEjE;AAyED,iBAAe,iBAAiB,kBAmG/B;AAED,iBAAe,kBAAkB,kBAiDhC;AAED,iBAAe,iBAAiB,kBAwF/B;AAED,iBAAe,cAAc,kBAgD5B;AA+CD,iBAAe,SAAS,kBA2CvB;AAED,yFAAyF;AACzF,wBAAgB,oBAAoB,CAAC,UAAU,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,EAAE,eAAe,EAAE,MAAM,GAAG,MAAM,CAK3G;AAED,iBAAe,eAAe,kBAmD7B;AAED,OAAO,EACL,cAAc,EACd,YAAY,EACZ,gBAAgB,EAChB,qBAAqB,EACrB,kBAAkB,EAClB,gBAAgB,EAChB,QAAQ,EACR,gBAAgB,EAChB,wBAAwB,EACxB,SAAS,EACT,eAAe,EACf,QAAQ,EACR,iBAAiB,EACjB,kBAAkB,EAClB,iBAAiB,EACjB,cAAc,EACd,SAAS,EACT,eAAe,GAChB,CAAA"}
+{"version":3,"file":"app-commands.d.ts","sourceRoot":"","sources":["../src/app-commands.ts"],"names":[],"mappings":"AAuCA,iBAAe,QAAQ,kBActB;AAED,iBAAS,cAAc,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAU/C;AAED,iBAAS,eAAe,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAUhD;AAED,iBAAS,YAAY,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAE9D;AAeD,iBAAS,QAAQ,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAElE;AAED,iBAAS,gBAAgB,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAG1F;AAED,iBAAS,gBAAgB,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,MAAM,CAUjE;AAED,iBAAS,SAAS,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,GAAG,MAAM,CAEjD;AAED,iBAAS,qBAAqB,CAAC,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,SAAS,EAAE,MAAM,GAAG;IACpF,IAAI,EAAE,MAAM,CAAA;IACZ,QAAQ,EAAE,MAAM,CAAA;IAChB,IAAI,EAAE,MAAM,CAAA;CACb,CAeA;AAED,iBAAS,kBAAkB,CAAC,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,SAAS,EAAE,MAAM;;;;;IAoB/E;AAED,iBAAS,wBAAwB,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,QAGjE;AAED,iBAAS,gBAAgB,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAEjE;AAyED,iBAAe,iBAAiB,kBAmG/B;AAED,iBAAe,kBAAkB,kBAiDhC;AAED,iBAAe,iBAAiB,kBAwF/B;AAED,iBAAe,cAAc,kBAiC5B;AA+CD,iBAAe,SAAS,kBA2CvB;AAED,yFAAyF;AACzF,wBAAgB,oBAAoB,CAAC,UAAU,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,EAAE,eAAe,EAAE,MAAM,GAAG,MAAM,CAK3G;AAED,iBAAe,eAAe,kBAmD7B;AAED,OAAO,EACL,cAAc,EACd,YAAY,EACZ,gBAAgB,EAChB,qBAAqB,EACrB,kBAAkB,EAClB,gBAAgB,EAChB,QAAQ,EACR,gBAAgB,EAChB,wBAAwB,EACxB,SAAS,EACT,eAAe,EACf,QAAQ,EACR,iBAAiB,EACjB,kBAAkB,EAClB,iBAAiB,EACjB,cAAc,EACd,SAAS,EACT,eAAe,GAChB,CAAA"}

package/dist/app-commands.js

@@ -433,18 +433,10 @@ async function linkAppDataset() {
         const selected = await selectAppIdInteractively(project);
         appId = selected.appId;
     }
-    const response = await authedFetch(`/api/cli/apps/${encodeURIComponent(appId)}/link-dataset`, {
-        method: 'POST',
-        headers: { 'Content-Type': 'application/json' },
-        body: JSON.stringify({
-            datasetId,
-            versionNum,
-        }),
-    });
-    if (!response.ok) {
-        throw new Error(`Failed to link dataset: ${await response.text()}`);
-    }
-    const data = await parseJsonResponse(response, 'App link dataset');
+    const writes = await import('./cli-write-commands.js');
+    const data = await writes.sendCommandWrite(writes.appLinkDataset(appId, { datasetId, ...(versionNum === undefined ? {} : { versionNum }) }), { json: hasJsonFlag(), print: printLine });
+    if (!data)
+        return;
     if (hasJsonFlag()) {
         printJson({ app: data.app, linkedDataset: data.linkedDataset, versionNum: data.versionNum });
         return;

package/dist/auth-commands.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"auth-commands.d.ts","sourceRoot":"","sources":["../src/auth-commands.ts"],"names":[],"mappings":"AA6BA,iBAAS,WAAW,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,MAAM,CAAC,cAAc,CAEnE;AAMD,wBAAgB,mBAAmB,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAE5D;AAQD,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,MAAM,EAAE,cAAc,CAAC,EAAE,MAAM,GAAG,GAAG,CAwB5E;AA6BD,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAgBtD;AAED,iBAAS,UAAU,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAEzC;AAwBD,iBAAe,KAAK,CAAC,eAAe,CAAC,EAAE,MAAM,iBAmC5C;AAoHD,iBAAe,MAAM,kBAWpB;AAED,iBAAe,MAAM,CAAC,eAAe,CAAC,EAAE,MAAM,iBAwC7C;AAED,iBAAe,QAAQ,kBA0BtB;AAED,OAAO,EAAE,WAAW,EAAE,KAAK,EAAE,UAAU,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAA"}
+{"version":3,"file":"auth-commands.d.ts","sourceRoot":"","sources":["../src/auth-commands.ts"],"names":[],"mappings":"AAyBA,iBAAS,WAAW,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,MAAM,CAAC,cAAc,CAEnE;AAMD,wBAAgB,mBAAmB,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAE5D;AAQD,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,MAAM,EAAE,cAAc,CAAC,EAAE,MAAM,GAAG,GAAG,CAwB5E;AAED,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAgBtD;AAED,iBAAS,UAAU,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAEzC;AA4BD,iBAAe,KAAK,CAAC,eAAe,CAAC,EAAE,MAAM,iBAoC5C;AA4BD,iBAAe,MAAM,kBAWpB;AAED,iBAAe,MAAM,CAAC,eAAe,CAAC,EAAE,MAAM,iBAwC7C;AAED,iBAAe,QAAQ,kBA0BtB;AAED,OAAO,EAAE,WAAW,EAAE,KAAK,EAAE,UAAU,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAA"}

package/dist/auth-commands.js

@@ -1,14 +1,10 @@
 // ORI-2044: moved from index.ts to keep auth commands together.
 import { randomBytes, createHash } from 'crypto';
-import { spawn } from 'child_process';
-import { createServer } from 'http';
 import { sanitizeTerminalText, parseJsonResponse } from './json-response.js';
 import { isInteractiveTerminal, hasArg, hasJsonFlag, getArg } from './command-line-arguments.js';
 import { getBaseUrl, resolveLoginTarget, resolveLogoutTarget, assertSecureTokenTransport, authedFetch, } from './http.js';
 import { clearUnreadableServerCredentials, hasResolvableAuth, rememberProcessSecret, saveServerCredentials, getServerCredentials, resolveAuthTokenForBaseUrl, } from './credentials.js';
 import { printJson, printLine, printLoginProgress } from './cli-console-output.js';
-import { shouldUseHeadlessLogin, waitForHeadlessAuthorization } from './headless-login.js';
-import { renderCliAuthBrowserPage } from './cli-auth-browser-page.js';
 import { resolveProjectSelection } from './account-directory.js';
 function isNodeError(error) {
     return error instanceof Error;
@@ -46,30 +42,6 @@ export function validateBrowserUrl(url, expectedOrigin) {
     }
     return parsed;
 }
-function openInBrowser(url) {
-    const parsed = validateBrowserUrl(url);
-    const platform = process.platform;
-    const href = parsed.href;
-    if (platform === 'darwin') {
-        spawn('open', [href], {
-            detached: true,
-            stdio: 'ignore',
-        }).unref();
-        return;
-    }
-    if (platform === 'win32') {
-        spawn('rundll32.exe', ['url.dll,FileProtocolHandler', href], {
-            detached: true,
-            stdio: 'ignore',
-            windowsHide: true,
-        }).unref();
-        return;
-    }
-    spawn('xdg-open', [href], {
-        detached: true,
-        stdio: 'ignore',
-    }).unref();
-}
 export function formatTerminalLink(url) {
     const safeUrl = sanitizeTerminalText(url);
     try {
@@ -101,6 +73,9 @@ function resolveAuthCallbackPort() {
     }
     return parsed;
 }
+function isCredentialsFileFailure(message) {
+    return message.startsWith('ORIZU_CREDENTIALS_READ_FAILED:') || message.startsWith('ORIZU_CREDENTIALS_WRITE_FAILED:');
+}
 async function login(baseUrlOverride) {
     const target = baseUrlOverride !== undefined
         ? { baseUrl: baseUrlOverride, isDefault: false }
@@ -113,14 +88,15 @@ async function login(baseUrlOverride) {
         loginData = await authenticateAtBaseUrl(baseUrl);
         if (!loginData)
             return;
-        saveServerCredentials(baseUrl, {
-            credentialType: 'pat',
-            apiKey: loginData.apiKey,
-        });
+        const apiKey = loginData.apiKey;
+        // Waits for the lock without freezing the CLI (ORI-2421).
+        const { withCredentialsTransaction } = await import('./credentials-transaction.js');
+        await withCredentialsTransaction(async () => saveServerCredentials(baseUrl, { credentialType: 'pat', apiKey }));
     }
     catch (error) {
-        if (target.isDefault) {
-            const detail = error instanceof Error ? error.message : String(error);
+        const detail = error instanceof Error ? error.message : String(error);
+        // Reading or saving credentials.json is a disk problem, not a connection one.
+        if (target.isDefault && !isCredentialsFileFailure(detail)) {
             throw new Error(`${detail} Check connectivity to https://app.orizu.ai, then retry \`orizu login\`.`, { cause: error });
         }
         throw error;
@@ -150,85 +126,10 @@ async function authenticateAtBaseUrl(baseUrl) {
     }
     const codeVerifier = rememberProcessSecret(createCodeVerifier());
     const codeChallenge = createCodeChallenge(codeVerifier);
+    // Effect loads here, after the already-logged-in check (ORI-2422).
+    const { completeLogin, shouldUseHeadlessLogin } = await import('./login-flow.js');
     const isHeadlessLogin = shouldUseHeadlessLogin({ isForced: hasArg('--headless') });
-    const callbackPort = isHeadlessLogin ? undefined : resolveAuthCallbackPort();
-    const redirectUri = callbackPort === undefined ? undefined : `http://127.0.0.1:${callbackPort}/callback`;
-    const callbackCode = isHeadlessLogin
-        ? await waitForHeadlessAuthorization({ baseUrl, codeChallenge }, {
-            parseJsonResponse,
-            printProgress: printLoginProgress,
-            sanitizeTerminalText,
-            validateBrowserUrl,
-        })
-        : await new Promise((resolve, reject) => {
-            const server = createServer((request, response) => {
-                try {
-                    const url = new URL(request.url || '/', `http://127.0.0.1:${callbackPort}`);
-                    const code = url.searchParams.get('code');
-                    if (!code) {
-                        response.statusCode = 400;
-                        response.setHeader('content-type', 'text/html; charset=utf-8');
-                        response.end(renderCliAuthBrowserPage('error'));
-                        return;
-                    }
-                    response.statusCode = 200;
-                    response.setHeader('content-type', 'text/html; charset=utf-8');
-                    response.end(renderCliAuthBrowserPage('success'));
-                    server.close();
-                    resolve(code);
-                }
-                catch (error) {
-                    server.close();
-                    reject(error);
-                }
-            });
-            server.on('error', (error) => {
-                if (error.code === 'EADDRINUSE') {
-                    reject(new Error(`Port ${callbackPort} is already in use. Set ORIZU_AUTH_PORT to a different port (1024–65535) and retry.`));
-                }
-                else {
-                    reject(error);
-                }
-            });
-            server.listen(callbackPort, '127.0.0.1', async () => {
-                try {
-                    const response = await fetch(`${baseUrl}/api/cli/auth/start`, {
-                        method: 'POST',
-                        headers: { 'Content-Type': 'application/json' },
-                        body: JSON.stringify({ codeChallenge, redirectUri }),
-                    });
-                    if (!response.ok) {
-                        const text = await response.text();
-                        server.close();
-                        reject(new Error(`Failed to start login: ${text}`));
-                        return;
-                    }
-                    const { authorizeUrl } = await parseJsonResponse(response, 'CLI auth start');
-                    const safeAuthorizeUrl = validateBrowserUrl(authorizeUrl, baseUrl).href;
-                    printLoginProgress(`Opening browser for login: ${sanitizeTerminalText(safeAuthorizeUrl)}`);
-                    openInBrowser(safeAuthorizeUrl);
-                }
-                catch (error) {
-                    server.close();
-                    reject(error);
-                }
-            });
-        });
-    rememberProcessSecret(callbackCode);
-    const exchangeResponse = await fetch(`${baseUrl}/api/cli/auth/exchange`, {
-        method: 'POST',
-        headers: { 'Content-Type': 'application/json' },
-        body: JSON.stringify({ code: callbackCode, codeVerifier, redirectUri }),
-    });
-    if (!exchangeResponse.ok) {
-        const text = await exchangeResponse.text();
-        throw new Error(`Failed to exchange auth code: ${text}`);
-    }
-    const loginData = await parseJsonResponse(exchangeResponse, 'CLI auth exchange');
-    if (!loginData.apiKey) {
-        throw new Error('Server did not return an API key. Upgrade the Orizu server and run `orizu login` again.');
-    }
-    return { ...loginData, apiKey: loginData.apiKey };
+    return completeLogin({ baseUrl, codeVerifier, codeChallenge, callbackPort: isHeadlessLogin ? undefined : resolveAuthCallbackPort() }, { parseJsonResponse, printProgress: printLoginProgress, sanitizeTerminalText, validateBrowserUrl });
 }
 async function whoami() {
     const response = await authedFetch('/api/cli/auth/whoami');

package/dist/cli-write-commands.d.ts

@@ -0,0 +1,143 @@
+import { Schema } from 'effect';
+import { type OneRequestWrite } from './one-request-write.js';
+type Write<A> = Pick<OneRequestWrite<A>, 'label' | 'name' | 'path' | 'method' | 'body' | 'reply' | 'mayAlreadyBeSaved' | 'describeError'>;
+declare const TaskCreated: Schema.Struct<{
+    readonly task: Schema.Struct<{
+        readonly id: Schema.String;
+        readonly title: Schema.String;
+        readonly status: Schema.String;
+        readonly requiredAssignmentsPerRow: Schema.Number;
+        readonly versionId: Schema.String;
+        readonly versionNum: Schema.Number;
+    }>;
+    readonly assignmentsCreated: Schema.Number;
+    readonly assignmentShortfall: Schema.optionalKey<Schema.Number>;
+    readonly warning: Schema.optionalKey<Schema.String>;
+}>;
+/** Running it again makes a second task (and, with --publish, emails labellers again). */
+export declare const taskCreate: (body: Record<string, unknown>, describeError: Write<typeof TaskCreated.Type>["describeError"]) => Write<typeof TaskCreated.Type>;
+declare const TaskUpdated: Schema.Struct<{
+    readonly task: Schema.Struct<{
+        readonly id: Schema.String;
+        readonly title: Schema.optionalKey<Schema.NullOr<Schema.String>>;
+        readonly status: Schema.optionalKey<Schema.NullOr<Schema.String>>;
+        readonly dataset_id: Schema.optionalKey<Schema.NullOr<Schema.String>>;
+        readonly app_id: Schema.optionalKey<Schema.NullOr<Schema.String>>;
+        readonly version_id: Schema.optionalKey<Schema.NullOr<Schema.String>>;
+        readonly required_assignments_per_row: Schema.optionalKey<Schema.NullOr<Schema.Number>>;
+    }>;
+    readonly assignmentMode: Schema.optionalKey<Schema.String>;
+    readonly assignmentsCreated: Schema.optionalKey<Schema.Number>;
+}>;
+/** Sets the same values again, so a repeat is safe. */
+export declare const taskUpdate: (id: string, body: Record<string, unknown>) => Write<typeof TaskUpdated.Type>;
+declare const Discarded: Schema.Struct<{
+    readonly success: Schema.Boolean;
+}>;
+/** Once the draft is gone, a repeat is refused as "not found". */
+export declare const taskDiscard: (id: string) => Write<typeof Discarded.Type>;
+declare const Published: Schema.Struct<{
+    readonly assignmentsProcessed: Schema.Number;
+    readonly assignmentsCreated: Schema.Number;
+    readonly assignmentsRemoved: Schema.optionalKey<Schema.Number>;
+    readonly assignmentShortfall: Schema.optionalKey<Schema.Number>;
+    readonly warning: Schema.optionalKey<Schema.String>;
+    readonly task: Schema.Struct<{
+        readonly id: Schema.String;
+        readonly status: Schema.String;
+    }>;
+}>;
+/** Once published, a repeat is refused as "must be a draft". */
+export declare const taskPublish: (id: string, body: Record<string, unknown>) => Write<typeof Published.Type>;
+declare const Assigned: Schema.Struct<{
+    assignmentsCreated: Schema.Number;
+    assignmentsProcessed: Schema.optionalKey<Schema.Number>;
+    assignmentsRemoved: Schema.optionalKey<Schema.Number>;
+    assignmentShortfall: Schema.optionalKey<Schema.Number>;
+    warning: Schema.optionalKey<Schema.String>;
+}>;
+/** Adds only missing pairs and emails only new people, so a repeat is safe. */
+export declare const taskAssign: (id: string, body: Record<string, unknown>) => Write<typeof Assigned.Type>;
+declare const StatusChanged: Schema.Struct<{
+    readonly task: Schema.Struct<{
+        readonly id: Schema.String;
+        readonly status: Schema.String;
+    }>;
+}>;
+/** Setting the status a task already has changes nothing. */
+export declare const taskStatus: (id: string, verb: string, status: string) => Write<typeof StatusChanged.Type>;
+declare const RunStarted: Schema.Struct<{
+    readonly optimization_run_id: Schema.String;
+    readonly optimizationRun: Schema.Struct<{
+        readonly id: Schema.String;
+        readonly status: Schema.String;
+        readonly startedAt: Schema.optionalKey<Schema.NullOr<Schema.String>>;
+        readonly createdAt: Schema.optionalKey<Schema.NullOr<Schema.String>>;
+    }>;
+}>;
+/** The server picks a new run id per request, so running it again starts a second run. */
+export declare const optimizationStart: (project: string, body: Record<string, unknown>) => Write<typeof RunStarted.Type>;
+declare const RunChanged: Schema.Struct<{
+    readonly optimizationRun: Schema.Struct<{
+        readonly id: Schema.String;
+        readonly status: Schema.optionalKey<Schema.String>;
+        readonly startedAt: Schema.optionalKey<Schema.NullOr<Schema.String>>;
+        readonly finishedAt: Schema.optionalKey<Schema.NullOr<Schema.String>>;
+        readonly bestScore: Schema.optionalKey<Schema.NullOr<Schema.Number>>;
+        readonly bestCandidateId: Schema.optionalKey<Schema.NullOr<Schema.String>>;
+        readonly resultPromptVersionId: Schema.optionalKey<Schema.NullOr<Schema.String>>;
+        readonly metadata: Schema.optionalKey<Schema.$Record<Schema.String, Schema.Unknown>>;
+    }>;
+    readonly cancellationStatus: Schema.optionalKey<Schema.Literal<"already_terminal">>;
+}>;
+/** Writing the status a run already has again converges, so a repeat is safe. */
+export declare const optimizationLifecycle: (runId: string, body: Record<string, unknown>) => Write<typeof RunChanged.Type>;
+declare const EventLogged: Schema.Struct<{
+    readonly eventId: Schema.String;
+}>;
+/** A repeat with the same event id changes nothing; a new id is refused as a sequence clash. */
+export declare const optimizationEvent: (runId: string, body: Record<string, unknown> & {
+    eventId: string;
+}) => Write<typeof EventLogged.Type>;
+declare const Linked: Schema.Struct<{
+    readonly app: Schema.Struct<{
+        readonly id: Schema.String;
+        readonly name: Schema.String;
+    }>;
+    readonly linkedDataset: Schema.Struct<{
+        readonly id: Schema.String;
+        readonly name: Schema.String;
+    }>;
+    readonly versionNum: Schema.Number;
+}>;
+/**
+ * A plain overwrite, so a repeat is safe; without --version it links the
+ * app's current version at the time, which may have moved on.
+ */
+export declare const appLinkDataset: (appId: string, body: {
+    datasetId: string;
+    versionNum?: number;
+}) => Write<typeof Linked.Type>;
+declare const Accepted: Schema.Struct<{
+    readonly scoreRun: Schema.Struct<{
+        readonly id: Schema.String;
+        readonly provenance: Schema.String;
+        readonly acceptedByUserId: Schema.NullOr<Schema.String>;
+        readonly acceptedAt: Schema.NullOr<Schema.String>;
+        readonly alreadyAccepted: Schema.Boolean;
+    }>;
+}>;
+/** The first acceptance is kept and a repeat says "already accepted". */
+export declare const scoreAccept: (project: string, scoreRunId: string) => Write<typeof Accepted.Type>;
+declare const ManifestRejected: Schema.Struct<{
+    readonly manifest: Schema.$Record<Schema.String, Schema.Unknown>;
+}>;
+/** Once rejected, a repeat is refused, so the advice is to look first. */
+export declare const manifestReject: (id: string) => Write<typeof ManifestRejected.Type>;
+/** Sends a write with this command's `--json` setting and output. Ctrl-C sets the exit code and returns null. */
+export declare function sendCommandWrite<A>(write: Write<A>, io: {
+    json: boolean;
+    print: (line: string) => void;
+}): Promise<A | null>;
+export {};
+//# sourceMappingURL=cli-write-commands.d.ts.map

package/dist/cli-write-commands.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cli-write-commands.d.ts","sourceRoot":"","sources":["../src/cli-write-commands.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAA;AAE/B,OAAO,EAAmD,KAAK,eAAe,EAAE,MAAM,wBAAwB,CAAA;AAU9G,KAAK,KAAK,CAAC,CAAC,IAAI,IAAI,CAAC,eAAe,CAAC,CAAC,CAAC,EAAE,OAAO,GAAG,MAAM,GAAG,MAAM,GAAG,QAAQ,GAAG,MAAM,GAAG,OAAO,GAAG,mBAAmB,GAAG,eAAe,CAAC,CAAA;AAazI,QAAA,MAAM,WAAW;;;;;;;;;;;;EAKf,CAAA;AAEF,0FAA0F;AAC1F,eAAO,MAAM,UAAU,GAAI,MAAM,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,eAAe,KAAK,CAAC,OAAO,WAAW,CAAC,IAAI,CAAC,CAAC,eAAe,CAAC,KAAG,KAAK,CAAC,OAAO,WAAW,CAAC,IAAI,CAGtJ,CAAA;AAGF,QAAA,MAAM,WAAW;;;;;;;;;;;;EAOf,CAAA;AAEF,uDAAuD;AACvD,eAAO,MAAM,UAAU,GAAI,IAAI,MAAM,EAAE,MAAM,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAG,KAAK,CAAC,OAAO,WAAW,CAAC,IAAI,CAElG,CAAA;AAEF,QAAA,MAAM,SAAS;;EAA6C,CAAA;AAC5D,kEAAkE;AAClE,eAAO,MAAM,WAAW,GAAI,IAAI,MAAM,KAAG,KAAK,CAAC,OAAO,SAAS,CAAC,IAAI,CAGlE,CAAA;AAEF,QAAA,MAAM,SAAS;;;;;;;;;;EAAkH,CAAA;AACjI,gEAAgE;AAChE,eAAO,MAAM,WAAW,GAAI,IAAI,MAAM,EAAE,MAAM,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAG,KAAK,CAAC,OAAO,SAAS,CAAC,IAAI,CAGjG,CAAA;AAEF,QAAA,MAAM,QAAQ;;;;;;EAA6B,CAAA;AAC3C,+EAA+E;AAC/E,eAAO,MAAM,UAAU,GAAI,IAAI,MAAM,EAAE,MAAM,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAG,KAAK,CAAC,OAAO,QAAQ,CAAC,IAAI,CAE/F,CAAA;AAEF,QAAA,MAAM,aAAa;;;;;EAAqE,CAAA;AACxF,6DAA6D;AAC7D,eAAO,MAAM,UAAU,GAAI,IAAI,MAAM,EAAE,MAAM,MAAM,EAAE,QAAQ,MAAM,KAAG,KAAK,CAAC,OAAO,aAAa,CAAC,IAAI,CAGnG,CAAA;AAEF,QAAA,MAAM,UAAU;;;;;;;;EAGd,CAAA;AACF,0FAA0F;AAC1F,eAAO,MAAM,iBAAiB,GAAI,SAAS,MAAM,EAAE,MAAM,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAG,KAAK,CAAC,OAAO,UAAU,CAAC,IAAI,CAG7G,CAAA;AAEF,QAAA,MAAM,UAAU;;;;;;;;;;;;EAMd,CAAA;AACF,iFAAiF;AACjF,eAAO,MAAM,qBAAqB,GAAI,OAAO,MAAM,EAAE,MAAM,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAG,KAAK,CAAC,OAAO,UAAU,CAAC,IAAI,CAG/G,CAAA;AAEF,QAAA,MAAM,WAAW;;EAAmC,CAAA;AACpD,gGAAgG;AAChG,eAAO,MAAM,iBAAiB,GAAI,OAAO,MAAM,EAAE,MAAM,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG;IAAE,OAAO,EAAE,MAAM,CAAA;CAAE,KAAG,KAAK,CAAC,OAAO,WAAW,CAAC,IAAI,CAGlI,CAAA;AAEF,QAAA,MAAM,MAAM;;;;;;;;;;EAA6I,CAAA;AACzJ;;;GAGG;AACH,eAAO,MAAM,cAAc,GAAI,OAAO,MAAM,EAAE,MAAM;IAAE,SAAS,EAAE,MAAM,CAAC;IAAC,UAAU,CAAC,EAAE,MAAM,CAAA;CAAE,KAAG,KAAK,CAAC,OAAO,MAAM,CAAC,IAAI,CAGvH,CAAA;AAEF,QAAA,MAAM,QAAQ;;;;;;;;EAEZ,CAAA;AACF,yEAAyE;AACzE,eAAO,MAAM,WAAW,GAAI,SAAS,MAAM,EAAE,YAAY,MAAM,KAAG,KAAK,CAAC,OAAO,QAAQ,CAAC,IAAI,CAG1F,CAAA;AAEF,QAAA,MAAM,gBAAgB;;EAAmE,CAAA;AACzF,0EAA0E;AAC1E,eAAO,MAAM,cAAc,GAAI,IAAI,MAAM,KAAG,KAAK,CAAC,OAAO,gBAAgB,CAAC,IAAI,CAG5E,CAAA;AAEF,iHAAiH;AACjH,wBAAsB,gBAAgB,CAAC,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE;IAAE,IAAI,EAAE,OAAO,CAAC;IAAC,KAAK,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAA;CAAE,GAAG,OAAO,CAAC,CAAC,GAAG,IAAI,CAAC,CAKlI"}

package/dist/cli-write-commands.js

@@ -0,0 +1,123 @@
+import { Schema } from 'effect';
+import { sendOneRequestWrite } from './one-request-write.js';
+// ORI-2726: what each one-request write command sends, the reply it expects,
+// and what to tell a person when the write may already be saved. The advice
+// follows what the server does when the same request arrives twice. Loaded
+// only through `await import(...)`, so commands that never write skip Effect.
+const SAFE = 'running the same command again is safe';
+const note = (thing, done, advice) => ({ thing, done, advice });
+const task = (id) => `/api/cli/tasks/${encodeURIComponent(id)}`;
+const Count = Schema.Number;
+const Text = Schema.String;
+const Assignments = {
+    assignmentsCreated: Count,
+    assignmentsProcessed: Schema.optionalKey(Count),
+    assignmentsRemoved: Schema.optionalKey(Count),
+    assignmentShortfall: Schema.optionalKey(Count),
+    warning: Schema.optionalKey(Text),
+};
+const TaskCreated = Schema.Struct({
+    task: Schema.Struct({ id: Text, title: Text, status: Text, requiredAssignmentsPerRow: Count, versionId: Text, versionNum: Count }),
+    assignmentsCreated: Count,
+    assignmentShortfall: Schema.optionalKey(Count),
+    warning: Schema.optionalKey(Text),
+});
+/** Running it again makes a second task (and, with --publish, emails labellers again). */
+export const taskCreate = (body, describeError) => ({
+    label: 'create task', name: 'Task create', path: '/api/cli/tasks', method: 'POST', body, reply: TaskCreated, describeError,
+    mayAlreadyBeSaved: note('task', 'created', 'check `orizu tasks list` before creating it again (running it again makes a second task)'),
+});
+const Nullable = (schema) => Schema.optionalKey(Schema.NullOr(schema));
+const TaskUpdated = Schema.Struct({
+    task: Schema.Struct({
+        id: Text, title: Nullable(Text), status: Nullable(Text), dataset_id: Nullable(Text), app_id: Nullable(Text),
+        version_id: Nullable(Text), required_assignments_per_row: Nullable(Count),
+    }),
+    assignmentMode: Schema.optionalKey(Text),
+    assignmentsCreated: Schema.optionalKey(Count),
+});
+/** Sets the same values again, so a repeat is safe. */
+export const taskUpdate = (id, body) => ({
+    label: 'update task', name: 'Task update', path: task(id), method: 'PATCH', body, reply: TaskUpdated, mayAlreadyBeSaved: note('task change', 'saved', SAFE),
+});
+const Discarded = Schema.Struct({ success: Schema.Boolean });
+/** Once the draft is gone, a repeat is refused as "not found". */
+export const taskDiscard = (id) => ({
+    label: 'discard draft task', name: 'Draft discard', path: task(id), method: 'DELETE', reply: Discarded,
+    mayAlreadyBeSaved: note('draft', 'discarded', 'check `orizu tasks list`; once it is gone, running it again answers "Task not found or access denied"'),
+});
+const Published = Schema.Struct({ task: Schema.Struct({ id: Text, status: Text }), ...Assignments, assignmentsProcessed: Count });
+/** Once published, a repeat is refused as "must be a draft". */
+export const taskPublish = (id, body) => ({
+    label: 'publish task', name: 'Task publish', path: `${task(id)}/publish`, method: 'POST', body, reply: Published,
+    mayAlreadyBeSaved: note('task', 'published', `check \`orizu tasks status --task ${id}\`; once published, running it again answers "Task must be a draft before publishing"`),
+});
+const Assigned = Schema.Struct(Assignments);
+/** Adds only missing pairs and emails only new people, so a repeat is safe. */
+export const taskAssign = (id, body) => ({
+    label: 'assign task', name: 'Task assign', path: `${task(id)}/assign`, method: 'POST', body, reply: Assigned, mayAlreadyBeSaved: note('assignments', 'saved', SAFE),
+});
+const StatusChanged = Schema.Struct({ task: Schema.Struct({ id: Text, status: Text }) });
+/** Setting the status a task already has changes nothing. */
+export const taskStatus = (id, verb, status) => ({
+    label: `${verb} task`, name: `Task ${verb}`, path: `${task(id)}/status`, method: 'PATCH', body: { status }, reply: StatusChanged,
+    mayAlreadyBeSaved: note('task status change', 'saved', SAFE),
+});
+const RunStarted = Schema.Struct({
+    optimization_run_id: Text,
+    optimizationRun: Schema.Struct({ id: Text, status: Text, startedAt: Nullable(Text), createdAt: Nullable(Text) }),
+});
+/** The server picks a new run id per request, so running it again starts a second run. */
+export const optimizationStart = (project, body) => ({
+    label: 'start optimization run', name: 'Optimization run start', path: `/api/cli/optimization-runs?project=${encodeURIComponent(project)}`, method: 'POST', body, reply: RunStarted,
+    mayAlreadyBeSaved: note('run', 'started', 'check `orizu optimizations list` before starting again (running it again starts a second run)'),
+});
+const RunChanged = Schema.Struct({
+    optimizationRun: Schema.Struct({
+        id: Text, status: Schema.optionalKey(Text), startedAt: Nullable(Text), finishedAt: Nullable(Text), bestScore: Nullable(Count),
+        bestCandidateId: Nullable(Text), resultPromptVersionId: Nullable(Text), metadata: Schema.optionalKey(Schema.Record(Text, Schema.Unknown)),
+    }),
+    cancellationStatus: Schema.optionalKey(Schema.Literal('already_terminal')),
+});
+/** Writing the status a run already has again converges, so a repeat is safe. */
+export const optimizationLifecycle = (runId, body) => ({
+    label: 'update optimization run', name: 'Optimization run update', path: `/api/cli/optimization-runs/${encodeURIComponent(runId)}`, method: 'PATCH', body, reply: RunChanged,
+    mayAlreadyBeSaved: note('run status change', 'saved', SAFE),
+});
+const EventLogged = Schema.Struct({ eventId: Text });
+/** A repeat with the same event id changes nothing; a new id is refused as a sequence clash. */
+export const optimizationEvent = (runId, body) => ({
+    label: 'log event', name: 'Event log', path: `/api/cli/optimization-runs/${encodeURIComponent(runId)}/events`, method: 'POST', body, reply: EventLogged,
+    mayAlreadyBeSaved: note('event', 'logged', `run the same command again with \`--event-id ${body.eventId}\` (a new id would be refused as a clash)`),
+});
+const Linked = Schema.Struct({ app: Schema.Struct({ id: Text, name: Text }), linkedDataset: Schema.Struct({ id: Text, name: Text }), versionNum: Count });
+/**
+ * A plain overwrite, so a repeat is safe; without --version it links the
+ * app's current version at the time, which may have moved on.
+ */
+export const appLinkDataset = (appId, body) => ({
+    label: 'link dataset', name: 'Dataset link', path: `/api/cli/apps/${encodeURIComponent(appId)}/link-dataset`, method: 'POST', body, reply: Linked,
+    mayAlreadyBeSaved: note('link', 'saved', body.versionNum === undefined ? 'running it again with `--version <n>` for the version you meant is safe' : SAFE),
+});
+const Accepted = Schema.Struct({
+    scoreRun: Schema.Struct({ id: Text, provenance: Text, acceptedByUserId: Schema.NullOr(Text), acceptedAt: Schema.NullOr(Text), alreadyAccepted: Schema.Boolean }),
+});
+/** The first acceptance is kept and a repeat says "already accepted". */
+export const scoreAccept = (project, scoreRunId) => ({
+    label: 'accept score run', name: 'Score run accept', path: `/api/cli/scores/accept?project=${encodeURIComponent(project)}`, method: 'POST', body: { scoreRunId }, reply: Accepted,
+    mayAlreadyBeSaved: note('acceptance', 'saved', SAFE),
+});
+const ManifestRejected = Schema.Struct({ manifest: Schema.Record(Text, Schema.Unknown) });
+/** Once rejected, a repeat is refused, so the advice is to look first. */
+export const manifestReject = (id) => ({
+    label: 'reject manifest', name: 'Manifest reject', path: `/api/cli/promotion-manifests/${encodeURIComponent(id)}`, method: 'POST', body: { action: 'reject' }, reply: ManifestRejected,
+    mayAlreadyBeSaved: note('manifest', 'rejected', `check \`orizu manifests show ${id}\``),
+});
+/** Sends a write with this command's `--json` setting and output. Ctrl-C sets the exit code and returns null. */
+export async function sendCommandWrite(write, io) {
+    const outcome = await sendOneRequestWrite({ ...write, ...io });
+    if (outcome.kind === 'saved')
+        return outcome.reply;
+    process.exitCode = outcome.exitCode;
+    return null;
+}

package/dist/credentials-transaction.d.ts

@@ -0,0 +1,7 @@
+/**
+ * A credentials transaction whose wait for the lock stays responsive. The
+ * in-process rules are credentials.ts's: one holder per process, and nested
+ * writes only from the holder's own async context.
+ */
+export declare function withCredentialsTransaction<T>(operation: () => Promise<T>, signal?: AbortSignal | null): Promise<T>;
+//# sourceMappingURL=credentials-transaction.d.ts.map

package/dist/credentials-transaction.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"credentials-transaction.d.ts","sourceRoot":"","sources":["../src/credentials-transaction.ts"],"names":[],"mappings":"AA8DA;;;;GAIG;AACH,wBAAgB,0BAA0B,CAAC,CAAC,EAC1C,SAAS,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,EAC3B,MAAM,CAAC,EAAE,WAAW,GAAG,IAAI,GAC1B,OAAO,CAAC,CAAC,CAAC,CAEZ"}

package/dist/credentials-transaction.js

@@ -0,0 +1,60 @@
+// Waiting for the credentials lock without freezing the process (ORI-2421).
+// Loaded only by stored-login code (refresh, logout, login), never on the
+// ORIZU_TOKEN / ORIZU_TOKEN_FILE path, which must not load Effect.
+import { Cause, Effect, Exit } from 'effect';
+import { CREDENTIALS_LOCK_RETRY_MS, credentialsLockTimeoutError, credentialsLockTimeoutMs, releaseCredentialsLock, tryAcquireCredentialsLock, withCredentialsTransactionLockAsync, } from './credentials.js';
+/**
+ * Try the lock, sleep, try again, until ORIZU_CREDENTIALS_LOCK_TIMEOUT_MS.
+ * Timers and stop handlers keep running while it waits, and `signal` stops
+ * the wait. A try is one synchronous step, so a stop never lands inside it.
+ * A lock a try takes is noted at once, and handed back if the run then ends
+ * any way other than returning it, wherever a stop lands.
+ */
+function acquireLock(signal) {
+    const timeoutMs = credentialsLockTimeoutMs();
+    const deadline = Date.now() + timeoutMs;
+    let taken = null;
+    const attempt = Effect.try({
+        try: () => (taken = tryAcquireCredentialsLock()),
+        catch: cause => cause instanceof Error ? cause : new Error(String(cause)),
+    });
+    const program = Effect.gen(function* () {
+        while (true) {
+            const lock = yield* attempt;
+            if (lock)
+                return lock;
+            const remainingMs = deadline - Date.now();
+            if (remainingMs <= 0)
+                return yield* Effect.fail(credentialsLockTimeoutError(timeoutMs));
+            yield* Effect.sleep(Math.min(CREDENTIALS_LOCK_RETRY_MS, remainingMs));
+        }
+    });
+    return run(program, signal, () => {
+        if (!taken)
+            return;
+        try {
+            releaseCredentialsLock(taken);
+        }
+        catch {
+            // The stop or failure is what the caller needs to see.
+        }
+    });
+}
+/** A stop by `signal` rejects with its reason, as an aborted fetch would. */
+async function run(program, signal, onNotReturned) {
+    const exit = await Effect.runPromiseExit(program, signal ? { signal } : undefined);
+    if (Exit.isSuccess(exit))
+        return exit.value;
+    onNotReturned();
+    if (signal?.aborted && Cause.hasInterruptsOnly(exit.cause))
+        throw signal.reason;
+    throw Cause.squash(exit.cause);
+}
+/**
+ * A credentials transaction whose wait for the lock stays responsive. The
+ * in-process rules are credentials.ts's: one holder per process, and nested
+ * writes only from the holder's own async context.
+ */
+export function withCredentialsTransaction(operation, signal) {
+    return withCredentialsTransactionLockAsync(operation, () => acquireLock(signal));
+}

package/dist/credentials.d.ts

@@ -1,5 +1,23 @@
 import { ServerCredentials, StoredCredentialsV2, StoredCredentialsV3 } from './types.js';
 export declare function getConfigDir(): string;
+export declare const CREDENTIALS_LOCK_RETRY_MS = 20;
+export interface HeldCredentialsLock {
+    path: string;
+    metadata: string;
+    depth: number;
+    asyncOwner?: symbol;
+    released: Promise<void>;
+    resolveReleased: () => void;
+}
+export declare function credentialsLockTimeoutMs(): number;
+export declare function credentialsLockTimeoutError(timeoutMs: number): Error;
+/**
+ * One try at the cross-process lock. Returns null when another owner holds
+ * it. The waits between tries belong to the caller: a blocking one below for
+ * synchronous writers, an Effect sleep in credentials-transaction.ts.
+ */
+export declare function tryAcquireCredentialsLock(): HeldCredentialsLock | null;
+export declare function releaseCredentialsLock(lock: HeldCredentialsLock): void;
 /**
  * Runs a synchronous credentials transaction under the one process-wide and
  * cross-process lock. Exported so real-process fixtures can hold the production
@@ -11,7 +29,7 @@ export declare function withCredentialsTransactionLock<T>(operation: () => T): T
  * synchronous credential writes are admitted only from this transaction's
  * async execution context; unrelated same-process work must wait or fail.
  */
-export declare function withCredentialsTransactionLockAsync<T>(operation: () => Promise<T>): Promise<T>;
+export declare function withCredentialsTransactionLockAsync<T>(operation: () => Promise<T>, acquire?: () => HeldCredentialsLock | Promise<HeldCredentialsLock>): Promise<T>;
 export declare function loadCredentialsConfig(): StoredCredentialsV2 | StoredCredentialsV3 | null;
 export declare function getServerCredentials(baseUrl: string): ServerCredentials | null;
 export declare function saveServerCredentials(baseUrl: string, credentials: ServerCredentials): void;

package/dist/credentials.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"credentials.d.ts","sourceRoot":"","sources":["../src/credentials.ts"],"names":[],"mappings":"AAoBA,OAAO,EACL,iBAAiB,EAEjB,mBAAmB,EACnB,mBAAmB,EACpB,MAAM,YAAY,CAAA;AAMnB,wBAAgB,YAAY,IAAI,MAAM,CAKrC;AA0HD;;;;GAIG;AACH,wBAAgB,8BAA8B,CAAC,CAAC,EAAE,SAAS,EAAE,MAAM,CAAC,GAAG,CAAC,CAgCvE;AAED;;;;GAIG;AACH,wBAAsB,mCAAmC,CAAC,CAAC,EACzD,SAAS,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,GAC1B,OAAO,CAAC,CAAC,CAAC,CAiDZ;AAwGD,wBAAgB,qBAAqB,IAAI,mBAAmB,GAAG,mBAAmB,GAAG,IAAI,CA8BxF;AA0BD,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,MAAM,GAAG,iBAAiB,GAAG,IAAI,CAuB9E;AAED,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,iBAAiB,QAepF;AAED,wBAAgB,uBAAuB,CAAC,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,iBAAiB,QAatF;AAED,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,iBAAiB,EAAE,KAAK,EAAE,iBAAiB,GAAG,OAAO,CAS3F;AAED,wBAAgB,gCAAgC,CAC9C,OAAO,EAAE,MAAM,EACf,QAAQ,EAAE,iBAAiB,EAC3B,WAAW,EAAE,iBAAiB,GAC7B,OAAO,CAUT;AAmBD,wBAAgB,gBAAgB,IAAI,MAAM,GAAG,IAAI,CAMhD;AAED,uFAAuF;AACvF,wBAAgB,uBAAuB,CAAC,QAAQ,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAyCxE;AAID,wBAAgB,qBAAqB,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAG5D;AAED,wBAAgB,sBAAsB,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAE7D;AAED,wBAAgB,yBAAyB,IAAI,SAAS,MAAM,EAAE,CAE7D;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,qBAAqB,IAAI,MAAM,GAAG,IAAI,CA0BrD;AAED;;;;;;;;GAQG;AACH,wBAAgB,0BAA0B,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAclE;AAED;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAS1D;AAED,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,QAMtD;AAED,wBAAgB,+BAA+B,CAC7C,OAAO,EAAE,MAAM,EACf,QAAQ,EAAE,iBAAiB,GAC1B,OAAO,CAWT;AAED,wBAAgB,sBAAsB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAc/D;AAED;;;GAGG;AACH,wBAAgB,gCAAgC,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAYzE;AAED,wBAAgB,oBAAoB,SAKnC"}
+{"version":3,"file":"credentials.d.ts","sourceRoot":"","sources":["../src/credentials.ts"],"names":[],"mappings":"AAoBA,OAAO,EACL,iBAAiB,EAEjB,mBAAmB,EACnB,mBAAmB,EACpB,MAAM,YAAY,CAAA;AAYnB,wBAAgB,YAAY,IAAI,MAAM,CAKrC;AAQD,eAAO,MAAM,yBAAyB,KAAK,CAAA;AAU3C,MAAM,WAAW,mBAAmB;IAClC,IAAI,EAAE,MAAM,CAAA;IACZ,QAAQ,EAAE,MAAM,CAAA;IAChB,KAAK,EAAE,MAAM,CAAA;IACb,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,QAAQ,EAAE,OAAO,CAAC,IAAI,CAAC,CAAA;IACvB,eAAe,EAAE,MAAM,IAAI,CAAA;CAC5B;AAsBD,wBAAgB,wBAAwB,IAAI,MAAM,CAMjD;AAED,wBAAgB,2BAA2B,CAAC,SAAS,EAAE,MAAM,GAAG,KAAK,CAIpE;AAED;;;;GAIG;AACH,wBAAgB,yBAAyB,IAAI,mBAAmB,GAAG,IAAI,CA6CtE;AAcD,wBAAgB,sBAAsB,CAAC,IAAI,EAAE,mBAAmB,GAAG,IAAI,CAWtE;AAED;;;;GAIG;AACH,wBAAgB,8BAA8B,CAAC,CAAC,EAAE,SAAS,EAAE,MAAM,CAAC,GAAG,CAAC,CAgCvE;AAaD;;;;GAIG;AACH,wBAAsB,mCAAmC,CAAC,CAAC,EACzD,SAAS,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,EAG3B,OAAO,GAAE,MAAM,mBAAmB,GAAG,OAAO,CAAC,mBAAmB,CAA0B,GACzF,OAAO,CAAC,CAAC,CAAC,CAyCZ;AAsHD,wBAAgB,qBAAqB,IAAI,mBAAmB,GAAG,mBAAmB,GAAG,IAAI,CA8BxF;AA0BD,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,MAAM,GAAG,iBAAiB,GAAG,IAAI,CAuB9E;AAED,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,iBAAiB,QAepF;AAED,wBAAgB,uBAAuB,CAAC,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,iBAAiB,QAatF;AAED,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,iBAAiB,EAAE,KAAK,EAAE,iBAAiB,GAAG,OAAO,CAS3F;AAED,wBAAgB,gCAAgC,CAC9C,OAAO,EAAE,MAAM,EACf,QAAQ,EAAE,iBAAiB,EAC3B,WAAW,EAAE,iBAAiB,GAC7B,OAAO,CAUT;AAmBD,wBAAgB,gBAAgB,IAAI,MAAM,GAAG,IAAI,CAMhD;AAED,uFAAuF;AACvF,wBAAgB,uBAAuB,CAAC,QAAQ,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAyCxE;AAID,wBAAgB,qBAAqB,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAG5D;AAED,wBAAgB,sBAAsB,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAE7D;AAED,wBAAgB,yBAAyB,IAAI,SAAS,MAAM,EAAE,CAE7D;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,qBAAqB,IAAI,MAAM,GAAG,IAAI,CA0BrD;AAED;;;;;;;;GAQG;AACH,wBAAgB,0BAA0B,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAclE;AAED;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAS1D;AAED,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,QAMtD;AAED,wBAAgB,+BAA+B,CAC7C,OAAO,EAAE,MAAM,EACf,QAAQ,EAAE,iBAAiB,GAC1B,OAAO,CAWT;AAED,wBAAgB,sBAAsB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAc/D;AAED;;;GAGG;AACH,wBAAgB,gCAAgC,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAYzE;AAED,wBAAgB,oBAAoB,SAKnC"}