orizu 0.5.51 → 0.5.52

package/dist/app-commands.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"app-commands.d.ts","sourceRoot":"","sources":["../src/app-commands.ts"],"names":[],"mappings":"AAuCA,iBAAe,QAAQ,kBActB;AAED,iBAAS,cAAc,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAU/C;AAED,iBAAS,eAAe,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAUhD;AAED,iBAAS,YAAY,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAE9D;AAeD,iBAAS,QAAQ,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAElE;AAED,iBAAS,gBAAgB,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAG1F;AAED,iBAAS,gBAAgB,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,MAAM,CAUjE;AAED,iBAAS,SAAS,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,GAAG,MAAM,CAEjD;AAED,iBAAS,qBAAqB,CAAC,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,SAAS,EAAE,MAAM,GAAG;IACpF,IAAI,EAAE,MAAM,CAAA;IACZ,QAAQ,EAAE,MAAM,CAAA;IAChB,IAAI,EAAE,MAAM,CAAA;CACb,CAeA;AAED,iBAAS,kBAAkB,CAAC,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,SAAS,EAAE,MAAM;;;;;IAoB/E;AAED,iBAAS,wBAAwB,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,QAGjE;AAED,iBAAS,gBAAgB,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAEjE;AAyED,iBAAe,iBAAiB,kBAmG/B;AAED,iBAAe,kBAAkB,kBAiDhC;AAED,iBAAe,iBAAiB,kBAwF/B;AAED,iBAAe,cAAc,kBAgD5B;AA+CD,iBAAe,SAAS,kBA2CvB;AAED,yFAAyF;AACzF,wBAAgB,oBAAoB,CAAC,UAAU,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,EAAE,eAAe,EAAE,MAAM,GAAG,MAAM,CAK3G;AAED,iBAAe,eAAe,kBAmD7B;AAED,OAAO,EACL,cAAc,EACd,YAAY,EACZ,gBAAgB,EAChB,qBAAqB,EACrB,kBAAkB,EAClB,gBAAgB,EAChB,QAAQ,EACR,gBAAgB,EAChB,wBAAwB,EACxB,SAAS,EACT,eAAe,EACf,QAAQ,EACR,iBAAiB,EACjB,kBAAkB,EAClB,iBAAiB,EACjB,cAAc,EACd,SAAS,EACT,eAAe,GAChB,CAAA"}
+{"version":3,"file":"app-commands.d.ts","sourceRoot":"","sources":["../src/app-commands.ts"],"names":[],"mappings":"AAuCA,iBAAe,QAAQ,kBActB;AAED,iBAAS,cAAc,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAU/C;AAED,iBAAS,eAAe,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAUhD;AAED,iBAAS,YAAY,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAE9D;AAeD,iBAAS,QAAQ,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAElE;AAED,iBAAS,gBAAgB,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAG1F;AAED,iBAAS,gBAAgB,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,MAAM,CAUjE;AAED,iBAAS,SAAS,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,GAAG,MAAM,CAEjD;AAED,iBAAS,qBAAqB,CAAC,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,SAAS,EAAE,MAAM,GAAG;IACpF,IAAI,EAAE,MAAM,CAAA;IACZ,QAAQ,EAAE,MAAM,CAAA;IAChB,IAAI,EAAE,MAAM,CAAA;CACb,CAeA;AAED,iBAAS,kBAAkB,CAAC,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,SAAS,EAAE,MAAM;;;;;IAoB/E;AAED,iBAAS,wBAAwB,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,QAGjE;AAED,iBAAS,gBAAgB,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAEjE;AAyED,iBAAe,iBAAiB,kBAmG/B;AAED,iBAAe,kBAAkB,kBAiDhC;AAED,iBAAe,iBAAiB,kBAwF/B;AAED,iBAAe,cAAc,kBAiC5B;AA+CD,iBAAe,SAAS,kBA2CvB;AAED,yFAAyF;AACzF,wBAAgB,oBAAoB,CAAC,UAAU,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,EAAE,eAAe,EAAE,MAAM,GAAG,MAAM,CAK3G;AAED,iBAAe,eAAe,kBAmD7B;AAED,OAAO,EACL,cAAc,EACd,YAAY,EACZ,gBAAgB,EAChB,qBAAqB,EACrB,kBAAkB,EAClB,gBAAgB,EAChB,QAAQ,EACR,gBAAgB,EAChB,wBAAwB,EACxB,SAAS,EACT,eAAe,EACf,QAAQ,EACR,iBAAiB,EACjB,kBAAkB,EAClB,iBAAiB,EACjB,cAAc,EACd,SAAS,EACT,eAAe,GAChB,CAAA"}

package/dist/app-commands.js

@@ -433,18 +433,10 @@ async function linkAppDataset() {
         const selected = await selectAppIdInteractively(project);
         appId = selected.appId;
     }
-    const response = await authedFetch(`/api/cli/apps/${encodeURIComponent(appId)}/link-dataset`, {
-        method: 'POST',
-        headers: { 'Content-Type': 'application/json' },
-        body: JSON.stringify({
-            datasetId,
-            versionNum,
-        }),
-    });
-    if (!response.ok) {
-        throw new Error(`Failed to link dataset: ${await response.text()}`);
-    }
-    const data = await parseJsonResponse(response, 'App link dataset');
+    const writes = await import('./cli-write-commands.js');
+    const data = await writes.sendCommandWrite(writes.appLinkDataset(appId, { datasetId, ...(versionNum === undefined ? {} : { versionNum }) }), { json: hasJsonFlag(), print: printLine });
+    if (!data)
+        return;
     if (hasJsonFlag()) {
         printJson({ app: data.app, linkedDataset: data.linkedDataset, versionNum: data.versionNum });
         return;

package/dist/auth-commands.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"auth-commands.d.ts","sourceRoot":"","sources":["../src/auth-commands.ts"],"names":[],"mappings":"AA6BA,iBAAS,WAAW,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,MAAM,CAAC,cAAc,CAEnE;AAMD,wBAAgB,mBAAmB,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAE5D;AAQD,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,MAAM,EAAE,cAAc,CAAC,EAAE,MAAM,GAAG,GAAG,CAwB5E;AA6BD,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAgBtD;AAED,iBAAS,UAAU,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAEzC;AA4BD,iBAAe,KAAK,CAAC,eAAe,CAAC,EAAE,MAAM,iBAoC5C;AAoHD,iBAAe,MAAM,kBAWpB;AAED,iBAAe,MAAM,CAAC,eAAe,CAAC,EAAE,MAAM,iBAwC7C;AAED,iBAAe,QAAQ,kBA0BtB;AAED,OAAO,EAAE,WAAW,EAAE,KAAK,EAAE,UAAU,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAA"}
+{"version":3,"file":"auth-commands.d.ts","sourceRoot":"","sources":["../src/auth-commands.ts"],"names":[],"mappings":"AAyBA,iBAAS,WAAW,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,MAAM,CAAC,cAAc,CAEnE;AAMD,wBAAgB,mBAAmB,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAE5D;AAQD,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,MAAM,EAAE,cAAc,CAAC,EAAE,MAAM,GAAG,GAAG,CAwB5E;AAED,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAgBtD;AAED,iBAAS,UAAU,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAEzC;AA4BD,iBAAe,KAAK,CAAC,eAAe,CAAC,EAAE,MAAM,iBAoC5C;AA4BD,iBAAe,MAAM,kBAWpB;AAED,iBAAe,MAAM,CAAC,eAAe,CAAC,EAAE,MAAM,iBAwC7C;AAED,iBAAe,QAAQ,kBA0BtB;AAED,OAAO,EAAE,WAAW,EAAE,KAAK,EAAE,UAAU,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAA"}

package/dist/auth-commands.js

@@ -1,14 +1,10 @@
 // ORI-2044: moved from index.ts to keep auth commands together.
 import { randomBytes, createHash } from 'crypto';
-import { spawn } from 'child_process';
-import { createServer } from 'http';
 import { sanitizeTerminalText, parseJsonResponse } from './json-response.js';
 import { isInteractiveTerminal, hasArg, hasJsonFlag, getArg } from './command-line-arguments.js';
 import { getBaseUrl, resolveLoginTarget, resolveLogoutTarget, assertSecureTokenTransport, authedFetch, } from './http.js';
 import { clearUnreadableServerCredentials, hasResolvableAuth, rememberProcessSecret, saveServerCredentials, getServerCredentials, resolveAuthTokenForBaseUrl, } from './credentials.js';
 import { printJson, printLine, printLoginProgress } from './cli-console-output.js';
-import { shouldUseHeadlessLogin, waitForHeadlessAuthorization } from './headless-login.js';
-import { renderCliAuthBrowserPage } from './cli-auth-browser-page.js';
 import { resolveProjectSelection } from './account-directory.js';
 function isNodeError(error) {
     return error instanceof Error;
@@ -46,30 +42,6 @@ export function validateBrowserUrl(url, expectedOrigin) {
     }
     return parsed;
 }
-function openInBrowser(url) {
-    const parsed = validateBrowserUrl(url);
-    const platform = process.platform;
-    const href = parsed.href;
-    if (platform === 'darwin') {
-        spawn('open', [href], {
-            detached: true,
-            stdio: 'ignore',
-        }).unref();
-        return;
-    }
-    if (platform === 'win32') {
-        spawn('rundll32.exe', ['url.dll,FileProtocolHandler', href], {
-            detached: true,
-            stdio: 'ignore',
-            windowsHide: true,
-        }).unref();
-        return;
-    }
-    spawn('xdg-open', [href], {
-        detached: true,
-        stdio: 'ignore',
-    }).unref();
-}
 export function formatTerminalLink(url) {
     const safeUrl = sanitizeTerminalText(url);
     try {
@@ -154,85 +126,10 @@ async function authenticateAtBaseUrl(baseUrl) {
     }
     const codeVerifier = rememberProcessSecret(createCodeVerifier());
     const codeChallenge = createCodeChallenge(codeVerifier);
+    // Effect loads here, after the already-logged-in check (ORI-2422).
+    const { completeLogin, shouldUseHeadlessLogin } = await import('./login-flow.js');
     const isHeadlessLogin = shouldUseHeadlessLogin({ isForced: hasArg('--headless') });
-    const callbackPort = isHeadlessLogin ? undefined : resolveAuthCallbackPort();
-    const redirectUri = callbackPort === undefined ? undefined : `http://127.0.0.1:${callbackPort}/callback`;
-    const callbackCode = isHeadlessLogin
-        ? await waitForHeadlessAuthorization({ baseUrl, codeChallenge }, {
-            parseJsonResponse,
-            printProgress: printLoginProgress,
-            sanitizeTerminalText,
-            validateBrowserUrl,
-        })
-        : await new Promise((resolve, reject) => {
-            const server = createServer((request, response) => {
-                try {
-                    const url = new URL(request.url || '/', `http://127.0.0.1:${callbackPort}`);
-                    const code = url.searchParams.get('code');
-                    if (!code) {
-                        response.statusCode = 400;
-                        response.setHeader('content-type', 'text/html; charset=utf-8');
-                        response.end(renderCliAuthBrowserPage('error'));
-                        return;
-                    }
-                    response.statusCode = 200;
-                    response.setHeader('content-type', 'text/html; charset=utf-8');
-                    response.end(renderCliAuthBrowserPage('success'));
-                    server.close();
-                    resolve(code);
-                }
-                catch (error) {
-                    server.close();
-                    reject(error);
-                }
-            });
-            server.on('error', (error) => {
-                if (error.code === 'EADDRINUSE') {
-                    reject(new Error(`Port ${callbackPort} is already in use. Set ORIZU_AUTH_PORT to a different port (1024–65535) and retry.`));
-                }
-                else {
-                    reject(error);
-                }
-            });
-            server.listen(callbackPort, '127.0.0.1', async () => {
-                try {
-                    const response = await fetch(`${baseUrl}/api/cli/auth/start`, {
-                        method: 'POST',
-                        headers: { 'Content-Type': 'application/json' },
-                        body: JSON.stringify({ codeChallenge, redirectUri }),
-                    });
-                    if (!response.ok) {
-                        const text = await response.text();
-                        server.close();
-                        reject(new Error(`Failed to start login: ${text}`));
-                        return;
-                    }
-                    const { authorizeUrl } = await parseJsonResponse(response, 'CLI auth start');
-                    const safeAuthorizeUrl = validateBrowserUrl(authorizeUrl, baseUrl).href;
-                    printLoginProgress(`Opening browser for login: ${sanitizeTerminalText(safeAuthorizeUrl)}`);
-                    openInBrowser(safeAuthorizeUrl);
-                }
-                catch (error) {
-                    server.close();
-                    reject(error);
-                }
-            });
-        });
-    rememberProcessSecret(callbackCode);
-    const exchangeResponse = await fetch(`${baseUrl}/api/cli/auth/exchange`, {
-        method: 'POST',
-        headers: { 'Content-Type': 'application/json' },
-        body: JSON.stringify({ code: callbackCode, codeVerifier, redirectUri }),
-    });
-    if (!exchangeResponse.ok) {
-        const text = await exchangeResponse.text();
-        throw new Error(`Failed to exchange auth code: ${text}`);
-    }
-    const loginData = await parseJsonResponse(exchangeResponse, 'CLI auth exchange');
-    if (!loginData.apiKey) {
-        throw new Error('Server did not return an API key. Upgrade the Orizu server and run `orizu login` again.');
-    }
-    return { ...loginData, apiKey: loginData.apiKey };
+    return completeLogin({ baseUrl, codeVerifier, codeChallenge, callbackPort: isHeadlessLogin ? undefined : resolveAuthCallbackPort() }, { parseJsonResponse, printProgress: printLoginProgress, sanitizeTerminalText, validateBrowserUrl });
 }
 async function whoami() {
     const response = await authedFetch('/api/cli/auth/whoami');

package/dist/cli-write-commands.d.ts

@@ -0,0 +1,143 @@
+import { Schema } from 'effect';
+import { type OneRequestWrite } from './one-request-write.js';
+type Write<A> = Pick<OneRequestWrite<A>, 'label' | 'name' | 'path' | 'method' | 'body' | 'reply' | 'mayAlreadyBeSaved' | 'describeError'>;
+declare const TaskCreated: Schema.Struct<{
+    readonly task: Schema.Struct<{
+        readonly id: Schema.String;
+        readonly title: Schema.String;
+        readonly status: Schema.String;
+        readonly requiredAssignmentsPerRow: Schema.Number;
+        readonly versionId: Schema.String;
+        readonly versionNum: Schema.Number;
+    }>;
+    readonly assignmentsCreated: Schema.Number;
+    readonly assignmentShortfall: Schema.optionalKey<Schema.Number>;
+    readonly warning: Schema.optionalKey<Schema.String>;
+}>;
+/** Running it again makes a second task (and, with --publish, emails labellers again). */
+export declare const taskCreate: (body: Record<string, unknown>, describeError: Write<typeof TaskCreated.Type>["describeError"]) => Write<typeof TaskCreated.Type>;
+declare const TaskUpdated: Schema.Struct<{
+    readonly task: Schema.Struct<{
+        readonly id: Schema.String;
+        readonly title: Schema.optionalKey<Schema.NullOr<Schema.String>>;
+        readonly status: Schema.optionalKey<Schema.NullOr<Schema.String>>;
+        readonly dataset_id: Schema.optionalKey<Schema.NullOr<Schema.String>>;
+        readonly app_id: Schema.optionalKey<Schema.NullOr<Schema.String>>;
+        readonly version_id: Schema.optionalKey<Schema.NullOr<Schema.String>>;
+        readonly required_assignments_per_row: Schema.optionalKey<Schema.NullOr<Schema.Number>>;
+    }>;
+    readonly assignmentMode: Schema.optionalKey<Schema.String>;
+    readonly assignmentsCreated: Schema.optionalKey<Schema.Number>;
+}>;
+/** Sets the same values again, so a repeat is safe. */
+export declare const taskUpdate: (id: string, body: Record<string, unknown>) => Write<typeof TaskUpdated.Type>;
+declare const Discarded: Schema.Struct<{
+    readonly success: Schema.Boolean;
+}>;
+/** Once the draft is gone, a repeat is refused as "not found". */
+export declare const taskDiscard: (id: string) => Write<typeof Discarded.Type>;
+declare const Published: Schema.Struct<{
+    readonly assignmentsProcessed: Schema.Number;
+    readonly assignmentsCreated: Schema.Number;
+    readonly assignmentsRemoved: Schema.optionalKey<Schema.Number>;
+    readonly assignmentShortfall: Schema.optionalKey<Schema.Number>;
+    readonly warning: Schema.optionalKey<Schema.String>;
+    readonly task: Schema.Struct<{
+        readonly id: Schema.String;
+        readonly status: Schema.String;
+    }>;
+}>;
+/** Once published, a repeat is refused as "must be a draft". */
+export declare const taskPublish: (id: string, body: Record<string, unknown>) => Write<typeof Published.Type>;
+declare const Assigned: Schema.Struct<{
+    assignmentsCreated: Schema.Number;
+    assignmentsProcessed: Schema.optionalKey<Schema.Number>;
+    assignmentsRemoved: Schema.optionalKey<Schema.Number>;
+    assignmentShortfall: Schema.optionalKey<Schema.Number>;
+    warning: Schema.optionalKey<Schema.String>;
+}>;
+/** Adds only missing pairs and emails only new people, so a repeat is safe. */
+export declare const taskAssign: (id: string, body: Record<string, unknown>) => Write<typeof Assigned.Type>;
+declare const StatusChanged: Schema.Struct<{
+    readonly task: Schema.Struct<{
+        readonly id: Schema.String;
+        readonly status: Schema.String;
+    }>;
+}>;
+/** Setting the status a task already has changes nothing. */
+export declare const taskStatus: (id: string, verb: string, status: string) => Write<typeof StatusChanged.Type>;
+declare const RunStarted: Schema.Struct<{
+    readonly optimization_run_id: Schema.String;
+    readonly optimizationRun: Schema.Struct<{
+        readonly id: Schema.String;
+        readonly status: Schema.String;
+        readonly startedAt: Schema.optionalKey<Schema.NullOr<Schema.String>>;
+        readonly createdAt: Schema.optionalKey<Schema.NullOr<Schema.String>>;
+    }>;
+}>;
+/** The server picks a new run id per request, so running it again starts a second run. */
+export declare const optimizationStart: (project: string, body: Record<string, unknown>) => Write<typeof RunStarted.Type>;
+declare const RunChanged: Schema.Struct<{
+    readonly optimizationRun: Schema.Struct<{
+        readonly id: Schema.String;
+        readonly status: Schema.optionalKey<Schema.String>;
+        readonly startedAt: Schema.optionalKey<Schema.NullOr<Schema.String>>;
+        readonly finishedAt: Schema.optionalKey<Schema.NullOr<Schema.String>>;
+        readonly bestScore: Schema.optionalKey<Schema.NullOr<Schema.Number>>;
+        readonly bestCandidateId: Schema.optionalKey<Schema.NullOr<Schema.String>>;
+        readonly resultPromptVersionId: Schema.optionalKey<Schema.NullOr<Schema.String>>;
+        readonly metadata: Schema.optionalKey<Schema.$Record<Schema.String, Schema.Unknown>>;
+    }>;
+    readonly cancellationStatus: Schema.optionalKey<Schema.Literal<"already_terminal">>;
+}>;
+/** Writing the status a run already has again converges, so a repeat is safe. */
+export declare const optimizationLifecycle: (runId: string, body: Record<string, unknown>) => Write<typeof RunChanged.Type>;
+declare const EventLogged: Schema.Struct<{
+    readonly eventId: Schema.String;
+}>;
+/** A repeat with the same event id changes nothing; a new id is refused as a sequence clash. */
+export declare const optimizationEvent: (runId: string, body: Record<string, unknown> & {
+    eventId: string;
+}) => Write<typeof EventLogged.Type>;
+declare const Linked: Schema.Struct<{
+    readonly app: Schema.Struct<{
+        readonly id: Schema.String;
+        readonly name: Schema.String;
+    }>;
+    readonly linkedDataset: Schema.Struct<{
+        readonly id: Schema.String;
+        readonly name: Schema.String;
+    }>;
+    readonly versionNum: Schema.Number;
+}>;
+/**
+ * A plain overwrite, so a repeat is safe; without --version it links the
+ * app's current version at the time, which may have moved on.
+ */
+export declare const appLinkDataset: (appId: string, body: {
+    datasetId: string;
+    versionNum?: number;
+}) => Write<typeof Linked.Type>;
+declare const Accepted: Schema.Struct<{
+    readonly scoreRun: Schema.Struct<{
+        readonly id: Schema.String;
+        readonly provenance: Schema.String;
+        readonly acceptedByUserId: Schema.NullOr<Schema.String>;
+        readonly acceptedAt: Schema.NullOr<Schema.String>;
+        readonly alreadyAccepted: Schema.Boolean;
+    }>;
+}>;
+/** The first acceptance is kept and a repeat says "already accepted". */
+export declare const scoreAccept: (project: string, scoreRunId: string) => Write<typeof Accepted.Type>;
+declare const ManifestRejected: Schema.Struct<{
+    readonly manifest: Schema.$Record<Schema.String, Schema.Unknown>;
+}>;
+/** Once rejected, a repeat is refused, so the advice is to look first. */
+export declare const manifestReject: (id: string) => Write<typeof ManifestRejected.Type>;
+/** Sends a write with this command's `--json` setting and output. Ctrl-C sets the exit code and returns null. */
+export declare function sendCommandWrite<A>(write: Write<A>, io: {
+    json: boolean;
+    print: (line: string) => void;
+}): Promise<A | null>;
+export {};
+//# sourceMappingURL=cli-write-commands.d.ts.map

package/dist/cli-write-commands.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cli-write-commands.d.ts","sourceRoot":"","sources":["../src/cli-write-commands.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAA;AAE/B,OAAO,EAAmD,KAAK,eAAe,EAAE,MAAM,wBAAwB,CAAA;AAU9G,KAAK,KAAK,CAAC,CAAC,IAAI,IAAI,CAAC,eAAe,CAAC,CAAC,CAAC,EAAE,OAAO,GAAG,MAAM,GAAG,MAAM,GAAG,QAAQ,GAAG,MAAM,GAAG,OAAO,GAAG,mBAAmB,GAAG,eAAe,CAAC,CAAA;AAazI,QAAA,MAAM,WAAW;;;;;;;;;;;;EAKf,CAAA;AAEF,0FAA0F;AAC1F,eAAO,MAAM,UAAU,GAAI,MAAM,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,eAAe,KAAK,CAAC,OAAO,WAAW,CAAC,IAAI,CAAC,CAAC,eAAe,CAAC,KAAG,KAAK,CAAC,OAAO,WAAW,CAAC,IAAI,CAGtJ,CAAA;AAGF,QAAA,MAAM,WAAW;;;;;;;;;;;;EAOf,CAAA;AAEF,uDAAuD;AACvD,eAAO,MAAM,UAAU,GAAI,IAAI,MAAM,EAAE,MAAM,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAG,KAAK,CAAC,OAAO,WAAW,CAAC,IAAI,CAElG,CAAA;AAEF,QAAA,MAAM,SAAS;;EAA6C,CAAA;AAC5D,kEAAkE;AAClE,eAAO,MAAM,WAAW,GAAI,IAAI,MAAM,KAAG,KAAK,CAAC,OAAO,SAAS,CAAC,IAAI,CAGlE,CAAA;AAEF,QAAA,MAAM,SAAS;;;;;;;;;;EAAkH,CAAA;AACjI,gEAAgE;AAChE,eAAO,MAAM,WAAW,GAAI,IAAI,MAAM,EAAE,MAAM,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAG,KAAK,CAAC,OAAO,SAAS,CAAC,IAAI,CAGjG,CAAA;AAEF,QAAA,MAAM,QAAQ;;;;;;EAA6B,CAAA;AAC3C,+EAA+E;AAC/E,eAAO,MAAM,UAAU,GAAI,IAAI,MAAM,EAAE,MAAM,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAG,KAAK,CAAC,OAAO,QAAQ,CAAC,IAAI,CAE/F,CAAA;AAEF,QAAA,MAAM,aAAa;;;;;EAAqE,CAAA;AACxF,6DAA6D;AAC7D,eAAO,MAAM,UAAU,GAAI,IAAI,MAAM,EAAE,MAAM,MAAM,EAAE,QAAQ,MAAM,KAAG,KAAK,CAAC,OAAO,aAAa,CAAC,IAAI,CAGnG,CAAA;AAEF,QAAA,MAAM,UAAU;;;;;;;;EAGd,CAAA;AACF,0FAA0F;AAC1F,eAAO,MAAM,iBAAiB,GAAI,SAAS,MAAM,EAAE,MAAM,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAG,KAAK,CAAC,OAAO,UAAU,CAAC,IAAI,CAG7G,CAAA;AAEF,QAAA,MAAM,UAAU;;;;;;;;;;;;EAMd,CAAA;AACF,iFAAiF;AACjF,eAAO,MAAM,qBAAqB,GAAI,OAAO,MAAM,EAAE,MAAM,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAG,KAAK,CAAC,OAAO,UAAU,CAAC,IAAI,CAG/G,CAAA;AAEF,QAAA,MAAM,WAAW;;EAAmC,CAAA;AACpD,gGAAgG;AAChG,eAAO,MAAM,iBAAiB,GAAI,OAAO,MAAM,EAAE,MAAM,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG;IAAE,OAAO,EAAE,MAAM,CAAA;CAAE,KAAG,KAAK,CAAC,OAAO,WAAW,CAAC,IAAI,CAGlI,CAAA;AAEF,QAAA,MAAM,MAAM;;;;;;;;;;EAA6I,CAAA;AACzJ;;;GAGG;AACH,eAAO,MAAM,cAAc,GAAI,OAAO,MAAM,EAAE,MAAM;IAAE,SAAS,EAAE,MAAM,CAAC;IAAC,UAAU,CAAC,EAAE,MAAM,CAAA;CAAE,KAAG,KAAK,CAAC,OAAO,MAAM,CAAC,IAAI,CAGvH,CAAA;AAEF,QAAA,MAAM,QAAQ;;;;;;;;EAEZ,CAAA;AACF,yEAAyE;AACzE,eAAO,MAAM,WAAW,GAAI,SAAS,MAAM,EAAE,YAAY,MAAM,KAAG,KAAK,CAAC,OAAO,QAAQ,CAAC,IAAI,CAG1F,CAAA;AAEF,QAAA,MAAM,gBAAgB;;EAAmE,CAAA;AACzF,0EAA0E;AAC1E,eAAO,MAAM,cAAc,GAAI,IAAI,MAAM,KAAG,KAAK,CAAC,OAAO,gBAAgB,CAAC,IAAI,CAG5E,CAAA;AAEF,iHAAiH;AACjH,wBAAsB,gBAAgB,CAAC,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE;IAAE,IAAI,EAAE,OAAO,CAAC;IAAC,KAAK,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAA;CAAE,GAAG,OAAO,CAAC,CAAC,GAAG,IAAI,CAAC,CAKlI"}

package/dist/cli-write-commands.js

@@ -0,0 +1,123 @@
+import { Schema } from 'effect';
+import { sendOneRequestWrite } from './one-request-write.js';
+// ORI-2726: what each one-request write command sends, the reply it expects,
+// and what to tell a person when the write may already be saved. The advice
+// follows what the server does when the same request arrives twice. Loaded
+// only through `await import(...)`, so commands that never write skip Effect.
+const SAFE = 'running the same command again is safe';
+const note = (thing, done, advice) => ({ thing, done, advice });
+const task = (id) => `/api/cli/tasks/${encodeURIComponent(id)}`;
+const Count = Schema.Number;
+const Text = Schema.String;
+const Assignments = {
+    assignmentsCreated: Count,
+    assignmentsProcessed: Schema.optionalKey(Count),
+    assignmentsRemoved: Schema.optionalKey(Count),
+    assignmentShortfall: Schema.optionalKey(Count),
+    warning: Schema.optionalKey(Text),
+};
+const TaskCreated = Schema.Struct({
+    task: Schema.Struct({ id: Text, title: Text, status: Text, requiredAssignmentsPerRow: Count, versionId: Text, versionNum: Count }),
+    assignmentsCreated: Count,
+    assignmentShortfall: Schema.optionalKey(Count),
+    warning: Schema.optionalKey(Text),
+});
+/** Running it again makes a second task (and, with --publish, emails labellers again). */
+export const taskCreate = (body, describeError) => ({
+    label: 'create task', name: 'Task create', path: '/api/cli/tasks', method: 'POST', body, reply: TaskCreated, describeError,
+    mayAlreadyBeSaved: note('task', 'created', 'check `orizu tasks list` before creating it again (running it again makes a second task)'),
+});
+const Nullable = (schema) => Schema.optionalKey(Schema.NullOr(schema));
+const TaskUpdated = Schema.Struct({
+    task: Schema.Struct({
+        id: Text, title: Nullable(Text), status: Nullable(Text), dataset_id: Nullable(Text), app_id: Nullable(Text),
+        version_id: Nullable(Text), required_assignments_per_row: Nullable(Count),
+    }),
+    assignmentMode: Schema.optionalKey(Text),
+    assignmentsCreated: Schema.optionalKey(Count),
+});
+/** Sets the same values again, so a repeat is safe. */
+export const taskUpdate = (id, body) => ({
+    label: 'update task', name: 'Task update', path: task(id), method: 'PATCH', body, reply: TaskUpdated, mayAlreadyBeSaved: note('task change', 'saved', SAFE),
+});
+const Discarded = Schema.Struct({ success: Schema.Boolean });
+/** Once the draft is gone, a repeat is refused as "not found". */
+export const taskDiscard = (id) => ({
+    label: 'discard draft task', name: 'Draft discard', path: task(id), method: 'DELETE', reply: Discarded,
+    mayAlreadyBeSaved: note('draft', 'discarded', 'check `orizu tasks list`; once it is gone, running it again answers "Task not found or access denied"'),
+});
+const Published = Schema.Struct({ task: Schema.Struct({ id: Text, status: Text }), ...Assignments, assignmentsProcessed: Count });
+/** Once published, a repeat is refused as "must be a draft". */
+export const taskPublish = (id, body) => ({
+    label: 'publish task', name: 'Task publish', path: `${task(id)}/publish`, method: 'POST', body, reply: Published,
+    mayAlreadyBeSaved: note('task', 'published', `check \`orizu tasks status --task ${id}\`; once published, running it again answers "Task must be a draft before publishing"`),
+});
+const Assigned = Schema.Struct(Assignments);
+/** Adds only missing pairs and emails only new people, so a repeat is safe. */
+export const taskAssign = (id, body) => ({
+    label: 'assign task', name: 'Task assign', path: `${task(id)}/assign`, method: 'POST', body, reply: Assigned, mayAlreadyBeSaved: note('assignments', 'saved', SAFE),
+});
+const StatusChanged = Schema.Struct({ task: Schema.Struct({ id: Text, status: Text }) });
+/** Setting the status a task already has changes nothing. */
+export const taskStatus = (id, verb, status) => ({
+    label: `${verb} task`, name: `Task ${verb}`, path: `${task(id)}/status`, method: 'PATCH', body: { status }, reply: StatusChanged,
+    mayAlreadyBeSaved: note('task status change', 'saved', SAFE),
+});
+const RunStarted = Schema.Struct({
+    optimization_run_id: Text,
+    optimizationRun: Schema.Struct({ id: Text, status: Text, startedAt: Nullable(Text), createdAt: Nullable(Text) }),
+});
+/** The server picks a new run id per request, so running it again starts a second run. */
+export const optimizationStart = (project, body) => ({
+    label: 'start optimization run', name: 'Optimization run start', path: `/api/cli/optimization-runs?project=${encodeURIComponent(project)}`, method: 'POST', body, reply: RunStarted,
+    mayAlreadyBeSaved: note('run', 'started', 'check `orizu optimizations list` before starting again (running it again starts a second run)'),
+});
+const RunChanged = Schema.Struct({
+    optimizationRun: Schema.Struct({
+        id: Text, status: Schema.optionalKey(Text), startedAt: Nullable(Text), finishedAt: Nullable(Text), bestScore: Nullable(Count),
+        bestCandidateId: Nullable(Text), resultPromptVersionId: Nullable(Text), metadata: Schema.optionalKey(Schema.Record(Text, Schema.Unknown)),
+    }),
+    cancellationStatus: Schema.optionalKey(Schema.Literal('already_terminal')),
+});
+/** Writing the status a run already has again converges, so a repeat is safe. */
+export const optimizationLifecycle = (runId, body) => ({
+    label: 'update optimization run', name: 'Optimization run update', path: `/api/cli/optimization-runs/${encodeURIComponent(runId)}`, method: 'PATCH', body, reply: RunChanged,
+    mayAlreadyBeSaved: note('run status change', 'saved', SAFE),
+});
+const EventLogged = Schema.Struct({ eventId: Text });
+/** A repeat with the same event id changes nothing; a new id is refused as a sequence clash. */
+export const optimizationEvent = (runId, body) => ({
+    label: 'log event', name: 'Event log', path: `/api/cli/optimization-runs/${encodeURIComponent(runId)}/events`, method: 'POST', body, reply: EventLogged,
+    mayAlreadyBeSaved: note('event', 'logged', `run the same command again with \`--event-id ${body.eventId}\` (a new id would be refused as a clash)`),
+});
+const Linked = Schema.Struct({ app: Schema.Struct({ id: Text, name: Text }), linkedDataset: Schema.Struct({ id: Text, name: Text }), versionNum: Count });
+/**
+ * A plain overwrite, so a repeat is safe; without --version it links the
+ * app's current version at the time, which may have moved on.
+ */
+export const appLinkDataset = (appId, body) => ({
+    label: 'link dataset', name: 'Dataset link', path: `/api/cli/apps/${encodeURIComponent(appId)}/link-dataset`, method: 'POST', body, reply: Linked,
+    mayAlreadyBeSaved: note('link', 'saved', body.versionNum === undefined ? 'running it again with `--version <n>` for the version you meant is safe' : SAFE),
+});
+const Accepted = Schema.Struct({
+    scoreRun: Schema.Struct({ id: Text, provenance: Text, acceptedByUserId: Schema.NullOr(Text), acceptedAt: Schema.NullOr(Text), alreadyAccepted: Schema.Boolean }),
+});
+/** The first acceptance is kept and a repeat says "already accepted". */
+export const scoreAccept = (project, scoreRunId) => ({
+    label: 'accept score run', name: 'Score run accept', path: `/api/cli/scores/accept?project=${encodeURIComponent(project)}`, method: 'POST', body: { scoreRunId }, reply: Accepted,
+    mayAlreadyBeSaved: note('acceptance', 'saved', SAFE),
+});
+const ManifestRejected = Schema.Struct({ manifest: Schema.Record(Text, Schema.Unknown) });
+/** Once rejected, a repeat is refused, so the advice is to look first. */
+export const manifestReject = (id) => ({
+    label: 'reject manifest', name: 'Manifest reject', path: `/api/cli/promotion-manifests/${encodeURIComponent(id)}`, method: 'POST', body: { action: 'reject' }, reply: ManifestRejected,
+    mayAlreadyBeSaved: note('manifest', 'rejected', `check \`orizu manifests show ${id}\``),
+});
+/** Sends a write with this command's `--json` setting and output. Ctrl-C sets the exit code and returns null. */
+export async function sendCommandWrite(write, io) {
+    const outcome = await sendOneRequestWrite({ ...write, ...io });
+    if (outcome.kind === 'saved')
+        return outcome.reply;
+    process.exitCode = outcome.exitCode;
+    return null;
+}

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";AAsLA,OAAO,EAAE,kBAAkB,EAAE,MAAM,6BAA6B,CAAA;AAEhE,eAAO,MAAM,wBAAwB,GAAI,iBAAiB,MAAM;;;EACJ,CAAA;AAE5D,OAAO,EAAE,iBAAiB,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAA;AAC5E,OAAO,EAAE,oBAAoB,EAAE,MAAM,iBAAiB,CAAA;AA+sCtD,wBAAgB,kBAAkB,CAAC,SAAS,EAAE,MAAM,GAAG;IAAE,OAAO,EAAE,MAAM,EAAE,CAAC;IAAC,kBAAkB,CAAC,EAAE,MAAM,EAAE,CAAA;CAAE,CA0B1G;AAED,eAAO,MAAM,iBAAiB,SAAU,CAAA;AACxC,eAAO,MAAM,uBAAuB,QAAkB,CAAA;AACtD,wBAAgB,mBAAmB,CAAC,SAAS,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,iBAAiB,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC,UAAU,CAexH;AAmMD,wBAAsB,IAAI,CAAC,OAAO,WAAwB,iBAiiBzD;AA8DD,OAAO,EAAE,kBAAkB,EAAE,cAAc,EAAE,MAAM,6BAA6B,CAAA;AAEhF,OAAO,EAAE,mBAAmB,EAAE,kBAAkB,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAA"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";AAuLA,OAAO,EAAE,kBAAkB,EAAE,MAAM,6BAA6B,CAAA;AAEhE,eAAO,MAAM,wBAAwB,GAAI,iBAAiB,MAAM;;;EACJ,CAAA;AAE5D,OAAO,EAAE,iBAAiB,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAA;AAC5E,OAAO,EAAE,oBAAoB,EAAE,MAAM,iBAAiB,CAAA;AAmqCtD,wBAAgB,kBAAkB,CAAC,SAAS,EAAE,MAAM,GAAG;IAAE,OAAO,EAAE,MAAM,EAAE,CAAC;IAAC,kBAAkB,CAAC,EAAE,MAAM,EAAE,CAAA;CAAE,CA0B1G;AAED,eAAO,MAAM,iBAAiB,SAAU,CAAA;AACxC,eAAO,MAAM,uBAAuB,QAAkB,CAAA;AACtD,wBAAgB,mBAAmB,CAAC,SAAS,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,iBAAiB,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC,UAAU,CAexH;AAmMD,wBAAsB,IAAI,CAAC,OAAO,WAAwB,iBAiiBzD;AAuED,OAAO,EAAE,kBAAkB,EAAE,cAAc,EAAE,MAAM,6BAA6B,CAAA;AAEhF,OAAO,EAAE,mBAAmB,EAAE,kBAAkB,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAA"}

package/dist/index.js

@@ -62,7 +62,8 @@ import { killSwitchCommand } from './kill-switch-cli.js';
 import { egressAllowlistCommand } from './egress-allowlist-cli.js';
 import { teamConnectorsCommand } from './team-connectors-cli.js';
 import { inspectExistingWorkspaceTeam, getWorkspaceRoot } from './workspace.js';
-import { writeLastErrorRecord, extractLastErrorCode } from './last-error-record.js';
+import { errorOutputSecrets, writeLastErrorRecord, extractLastErrorCode } from './last-error-record.js';
+import { redactSecrets } from './secret-redaction.js';
 export { loadInstructionSet } from './instruction-set-loader.js';
 export const materializeRunnerVersion = (runnerVersionId) => materializeRegisteredRunnerVersion(runnerVersionId, false);
 export { parseJsonResponse, sanitizeTerminalText } from './json-response.js';
@@ -123,26 +124,21 @@ async function logOptimizationEvent() {
     if (!eventType || eventType.startsWith('--') || !runId || !Number.isInteger(sequence) || sequence <= 0) {
         throw new Error('Usage: orizu log <event_type> --run-id <id> --sequence <n> --payload @event.json');
     }
-    const response = await authedFetch(`/api/cli/optimization-runs/${encodeURIComponent(runId)}/events`, {
-        method: 'POST',
-        headers: { 'Content-Type': 'application/json' },
-        body: JSON.stringify({
-            eventId: getArg('--event-id') || randomUUID(),
-            sequence,
-            eventType,
-            eventLayer: getArg('--event-layer') || 'core',
-            optimizerFamily: getArg('--optimizer-family'),
-            iteration: getArg('--iteration') ? Number(getArg('--iteration')) : undefined,
-            candidateId: getArg('--candidate-id'),
-            parentCandidateId: getArg('--parent-candidate-id'),
-            childCandidateId: getArg('--child-candidate-id'),
-            payload,
-        }),
-    });
-    if (!response.ok) {
-        throw new Error(`Failed to log event: ${await response.text()}`);
-    }
-    const data = await parseJsonResponse(response, 'Optimization event log');
+    const writes = await import('./cli-write-commands.js');
+    const data = await writes.sendCommandWrite(writes.optimizationEvent(runId, {
+        eventId: getArg('--event-id') || randomUUID(),
+        sequence,
+        eventType,
+        eventLayer: getArg('--event-layer') || 'core',
+        optimizerFamily: getArg('--optimizer-family'),
+        iteration: getArg('--iteration') ? Number(getArg('--iteration')) : undefined,
+        candidateId: getArg('--candidate-id'),
+        parentCandidateId: getArg('--parent-candidate-id'),
+        childCandidateId: getArg('--child-candidate-id'),
+        payload,
+    }), { json: hasJsonFlag(), print: printLine });
+    if (!data)
+        return;
     if (hasJsonFlag()) {
         printJson({ eventId: data.eventId });
         return;
@@ -822,25 +818,20 @@ async function startOptimizationRun() {
             trackedScope: 'best_candidate',
         })),
     ];
-    const response = await authedFetch(`/api/cli/optimization-runs?project=${encodeURIComponent(project)}`, {
-        method: 'POST',
-        headers: { 'Content-Type': 'application/json' },
-        body: JSON.stringify({
-            optimizerVersionId,
-            promptVersionIds,
-            judgeVersionIds,
-            scorers,
-            datasetVersionId,
-            splitSetId,
-            trainSplitName: getArg('--train-split') || undefined,
-            validationSplitName: getArg('--validation-split') || undefined,
-            metadata,
-        }),
-    });
-    if (!response.ok) {
-        throw new Error(`Failed to start optimization run: ${await response.text()}`);
-    }
-    const data = await parseJsonResponse(response, 'Optimization run start');
+    const writes = await import('./cli-write-commands.js');
+    const data = await writes.sendCommandWrite(writes.optimizationStart(project, {
+        optimizerVersionId,
+        promptVersionIds,
+        judgeVersionIds,
+        scorers,
+        datasetVersionId,
+        splitSetId,
+        trainSplitName: getArg('--train-split') || undefined,
+        validationSplitName: getArg('--validation-split') || undefined,
+        metadata,
+    }), { json: hasJsonFlag(), print: printLine });
+    if (!data)
+        return;
     if (hasJsonFlag()) {
         printJson(data);
         return;
@@ -897,15 +888,10 @@ async function updateOptimizationRunLifecycle(action) {
             body.resultPromptVersionId = resultPromptVersionId;
         }
     }
-    const response = await authedFetch(`/api/cli/optimization-runs/${encodeURIComponent(runId)}`, {
-        method: 'PATCH',
-        headers: { 'Content-Type': 'application/json' },
-        body: JSON.stringify(body),
-    });
-    if (!response.ok) {
-        throw new Error(`Failed to update optimization run: ${await response.text()}`);
-    }
-    const data = await parseJsonResponse(response, 'Optimization run update');
+    const writes = await import('./cli-write-commands.js');
+    const data = await writes.sendCommandWrite(writes.optimizationLifecycle(runId, body), { json: hasJsonFlag(), print: printLine });
+    if (!data)
+        return;
     if (hasJsonFlag()) {
         printJson(data);
         return;
@@ -1805,9 +1791,17 @@ function isCliEntrypoint() {
         return false;
     }
 }
+// A secret this process holds (a login code, its verifier, a poll token, a
+// bearer, a forwarded runner key) is never printed, even when a server echoes
+// it back in an error. last-error.json hides the same values. Scrubbed again
+// after control characters are stripped, so one inside a secret can't hide it.
+function printErrorWithoutSecrets(message) {
+    const secrets = errorOutputSecrets();
+    printError(redactSecrets(sanitizeTerminalText(redactSecrets(message, { secrets })), { secrets }));
+}
 if (isCliEntrypoint()) {
     const rawArgs = process.argv.slice(2);
-    withPassiveUpdateNotice(rawArgs, getCliVersion, printError, args => 
+    withPassiveUpdateNotice(rawArgs, getCliVersion, printErrorWithoutSecrets, args => 
     // ORI-2429: the process-boundary adapter stays a Promise (ADR-038 guide); the record write is Effect-owned and never replaces this error.
     main(args).catch(async (error) => {
         const message = error instanceof Error ? error.message : 'Unknown error';

package/dist/last-error-record.d.ts

@@ -29,6 +29,13 @@ export interface LastErrorRecordInput {
 export interface WriteLastErrorRecordOptions {
     configDir?: string;
 }
+/**
+ * The values no error output may show: this process's remembered secrets, the
+ * current bearer and runner-forwarded keys. last-error.json and the terminal's
+ * error line both use this list. Longest first, so a secret inside another
+ * can't leave part of the longer one behind.
+ */
+export declare function errorOutputSecrets(): string[];
 export declare function extractLastErrorCode(error: unknown): string | null;
 export declare function isStringWithinCap(value: unknown, maximumCharacters: number, wasTruncated: boolean): value is string;
 export declare function boundedServerBaseUrl(value: string | null | undefined): string | null;

package/dist/last-error-record.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"last-error-record.d.ts","sourceRoot":"","sources":["../src/last-error-record.ts"],"names":[],"mappings":"AAqBA,MAAM,WAAW,eAAe;IAC9B,OAAO,EAAE,CAAC,CAAA;IACV,UAAU,EAAE,MAAM,CAAA;IAClB,UAAU,EAAE,MAAM,GAAG,IAAI,CAAA;IACzB,IAAI,EAAE,MAAM,GAAG,IAAI,CAAA;IACnB,aAAa,EAAE,MAAM,GAAG,IAAI,CAAA;IAC5B,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAA;IACvB,OAAO,EAAE,MAAM,GAAG,IAAI,CAAA;IACtB,IAAI,EAAE,MAAM,EAAE,CAAA;IACd,aAAa,EAAE,OAAO,CAAA;IACtB,OAAO,EAAE,MAAM,CAAA;IACf,gBAAgB,EAAE,OAAO,CAAA;CAC1B;AAED,eAAO,MAAM,yBAAyB,IAAI,CAAA;AAC1C,eAAO,MAAM,mBAAmB,oBAAoB,CAAA;AACpD,eAAO,MAAM,4BAA4B,WAAa,CAAA;AACtD,eAAO,MAAM,4BAA4B,gBAAgB,CAAA;AAezD,MAAM,WAAW,oBAAoB;IACnC,IAAI,EAAE,SAAS,MAAM,EAAE,CAAA;IACvB,OAAO,EAAE,MAAM,CAAA;IACf,UAAU,EAAE,MAAM,GAAG,IAAI,CAAA;IACzB,IAAI,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IACpB,aAAa,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IAC7B,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IACxB,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IACvB,OAAO,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;IAC3B,GAAG,CAAC,EAAE,IAAI,CAAA;CACX;AAED,MAAM,WAAW,2BAA2B;IAC1C,SAAS,CAAC,EAAE,MAAM,CAAA;CACnB;AA8ID,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,GAAG,IAAI,CAKlE;AAUD,wBAAgB,iBAAiB,CAC/B,KAAK,EAAE,OAAO,EACd,iBAAiB,EAAE,MAAM,EACzB,YAAY,EAAE,OAAO,GACpB,KAAK,IAAI,MAAM,CAMjB;AAED,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,MAAM,GAAG,IAAI,CAIpF;AAED,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,oBAAoB,GAAG,eAAe,CA0DjF;AAED,wBAAgB,sBAAsB,CAAC,SAAS,CAAC,EAAE,MAAM,GAAG,MAAM,CAEjE;AAED,wBAAsB,oBAAoB,CACxC,KAAK,EAAE,oBAAoB,EAC3B,OAAO,GAAE,2BAAgC,GACxC,OAAO,CAAC,IAAI,CAAC,CAqBf;AAED,wBAAsB,mBAAmB,CAAC,SAAS,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,GAAG,IAAI,CAAC,CAQ7F"}
+{"version":3,"file":"last-error-record.d.ts","sourceRoot":"","sources":["../src/last-error-record.ts"],"names":[],"mappings":"AAqBA,MAAM,WAAW,eAAe;IAC9B,OAAO,EAAE,CAAC,CAAA;IACV,UAAU,EAAE,MAAM,CAAA;IAClB,UAAU,EAAE,MAAM,GAAG,IAAI,CAAA;IACzB,IAAI,EAAE,MAAM,GAAG,IAAI,CAAA;IACnB,aAAa,EAAE,MAAM,GAAG,IAAI,CAAA;IAC5B,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAA;IACvB,OAAO,EAAE,MAAM,GAAG,IAAI,CAAA;IACtB,IAAI,EAAE,MAAM,EAAE,CAAA;IACd,aAAa,EAAE,OAAO,CAAA;IACtB,OAAO,EAAE,MAAM,CAAA;IACf,gBAAgB,EAAE,OAAO,CAAA;CAC1B;AAED,eAAO,MAAM,yBAAyB,IAAI,CAAA;AAC1C,eAAO,MAAM,mBAAmB,oBAAoB,CAAA;AACpD,eAAO,MAAM,4BAA4B,WAAa,CAAA;AACtD,eAAO,MAAM,4BAA4B,gBAAgB,CAAA;AAezD,MAAM,WAAW,oBAAoB;IACnC,IAAI,EAAE,SAAS,MAAM,EAAE,CAAA;IACvB,OAAO,EAAE,MAAM,CAAA;IACf,UAAU,EAAE,MAAM,GAAG,IAAI,CAAA;IACzB,IAAI,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IACpB,aAAa,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IAC7B,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IACxB,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IACvB,OAAO,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;IAC3B,GAAG,CAAC,EAAE,IAAI,CAAA;CACX;AAED,MAAM,WAAW,2BAA2B;IAC1C,SAAS,CAAC,EAAE,MAAM,CAAA;CACnB;AA6HD;;;;;GAKG;AACH,wBAAgB,kBAAkB,IAAI,MAAM,EAAE,CAI7C;AAsBD,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,GAAG,IAAI,CAKlE;AAUD,wBAAgB,iBAAiB,CAC/B,KAAK,EAAE,OAAO,EACd,iBAAiB,EAAE,MAAM,EACzB,YAAY,EAAE,OAAO,GACpB,KAAK,IAAI,MAAM,CAMjB;AAED,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,MAAM,GAAG,IAAI,CAIpF;AAED,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,oBAAoB,GAAG,eAAe,CA0DjF;AAED,wBAAgB,sBAAsB,CAAC,SAAS,CAAC,EAAE,MAAM,GAAG,MAAM,CAEjE;AAED,wBAAsB,oBAAoB,CACxC,KAAK,EAAE,oBAAoB,EAC3B,OAAO,GAAE,2BAAgC,GACxC,OAAO,CAAC,IAAI,CAAC,CAoBf;AAED,wBAAsB,mBAAmB,CAAC,SAAS,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,GAAG,IAAI,CAAC,CAQ7F"}