orizu 0.5.51 → 0.5.52

package/dist/last-error-record.js

@@ -116,6 +116,19 @@ function serializeRecord(record) {
 function isSerializedRecordTooLarge(record) {
     return Buffer.byteLength(serializeRecord(record), 'utf8') > LAST_ERROR_FILE_MAX_BYTES;
 }
+/** Shorter values are left alone: replacing them would garble ordinary text. */
+const MIN_ERROR_OUTPUT_SECRET_LENGTH = 8;
+/**
+ * The values no error output may show: this process's remembered secrets, the
+ * current bearer and runner-forwarded keys. last-error.json and the terminal's
+ * error line both use this list. Longest first, so a secret inside another
+ * can't leave part of the longer one behind.
+ */
+export function errorOutputSecrets() {
+    return [...new Set([...resolveActiveProcessSecrets(), ...runnerForwardedSecretValues()])]
+        .filter(secret => typeof secret === 'string' && secret.length >= MIN_ERROR_OUTPUT_SECRET_LENGTH)
+        .sort((left, right) => right.length - left.length);
+}
 function resolveActiveProcessSecrets() {
     const rememberedSecrets = getSecretsSeenThisProcess();
     try {
@@ -230,8 +243,7 @@ export async function writeLastErrorRecord(input, options = {}) {
             ...input,
             homeDir: input.homeDir === undefined ? resolveHomeDir() : input.homeDir,
             secrets: [
-                ...resolveActiveProcessSecrets(),
-                ...runnerForwardedSecretValues(),
+                ...errorOutputSecrets(),
                 ...(input.secrets ?? []),
             ],
         });

package/dist/login-flow.d.ts

@@ -0,0 +1,37 @@
+export interface LoginFlowDependencies {
+    parseJsonResponse: <T>(response: Response, context: string) => Promise<T>;
+    printProgress: (message: string) => void;
+    sanitizeTerminalText: (text: string) => string;
+    validateBrowserUrl: (url: string, expectedOrigin?: string) => URL;
+    sleep?: (milliseconds: number) => Promise<void>;
+}
+export interface CompletedLogin {
+    apiKey: string;
+    user: {
+        id: string;
+        email: string | null;
+    };
+}
+export declare function shouldUseHeadlessLogin({ isForced, platform, environment, }: {
+    isForced: boolean;
+    platform?: NodeJS.Platform;
+    environment?: Record<string, string | undefined>;
+}): boolean;
+export declare const POLL_INTERVAL_MS = 2000;
+/** For tests: the headless wait alone, returning the authorization code. */
+export declare function waitForHeadlessAuthorization(input: {
+    baseUrl: string;
+    codeChallenge: string;
+}, dependencies: LoginFlowDependencies, signal?: AbortSignal): Promise<string>;
+/**
+ * Waits for the person to approve the login (in the browser, or by polling
+ * when headless), then exchanges the code. `callbackPort` undefined means
+ * headless. `signal` stops it, closing the loopback server.
+ */
+export declare function completeLogin(input: {
+    baseUrl: string;
+    codeVerifier: string;
+    codeChallenge: string;
+    callbackPort?: number;
+}, dependencies: LoginFlowDependencies, signal?: AbortSignal): Promise<CompletedLogin>;
+//# sourceMappingURL=login-flow.d.ts.map

package/dist/login-flow.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"login-flow.d.ts","sourceRoot":"","sources":["../src/login-flow.ts"],"names":[],"mappings":"AAcA,MAAM,WAAW,qBAAqB;IACpC,iBAAiB,EAAE,CAAC,CAAC,EAAE,QAAQ,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,KAAK,OAAO,CAAC,CAAC,CAAC,CAAA;IACzE,aAAa,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,IAAI,CAAA;IACxC,oBAAoB,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,MAAM,CAAA;IAC9C,kBAAkB,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,cAAc,CAAC,EAAE,MAAM,KAAK,GAAG,CAAA;IACjE,KAAK,CAAC,EAAE,CAAC,YAAY,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;CAChD;AAED,MAAM,WAAW,cAAc;IAC7B,MAAM,EAAE,MAAM,CAAA;IACd,IAAI,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,CAAA;CAC3C;AAED,wBAAgB,sBAAsB,CAAC,EACrC,QAAQ,EACR,QAA2B,EAC3B,WAAyB,GAC1B,EAAE;IACD,QAAQ,EAAE,OAAO,CAAA;IACjB,QAAQ,CAAC,EAAE,MAAM,CAAC,QAAQ,CAAA;IAC1B,WAAW,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAA;CACjD,GAAG,OAAO,CAMV;AA2ID,eAAO,MAAM,gBAAgB,OAAQ,CAAA;AA2JrC,4EAA4E;AAC5E,wBAAgB,4BAA4B,CAC1C,KAAK,EAAE;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,aAAa,EAAE,MAAM,CAAA;CAAE,EACjD,YAAY,EAAE,qBAAqB,EACnC,MAAM,CAAC,EAAE,WAAW,GACnB,OAAO,CAAC,MAAM,CAAC,CAEjB;AAED;;;;GAIG;AACH,wBAAgB,aAAa,CAC3B,KAAK,EAAE;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,YAAY,EAAE,MAAM,CAAC;IAAC,aAAa,EAAE,MAAM,CAAC;IAAC,YAAY,CAAC,EAAE,MAAM,CAAA;CAAE,EAC9F,YAAY,EAAE,qBAAqB,EACnC,MAAM,CAAC,EAAE,WAAW,GACnB,OAAO,CAAC,cAAc,CAAC,CAOzB"}

package/dist/login-flow.js

@@ -0,0 +1,295 @@
+// `orizu login` from the start request to the server's answer (ORI-2422):
+// the browser flow's loopback server and launch, the headless poll loop, and
+// the code exchange. Loaded by `await import(...)` inside login() only after
+// the already-logged-in check, so other commands and the hosted token path
+// (ORIZU_TOKEN / ORIZU_TOKEN_FILE) never load Effect. No stop handlers: a
+// Ctrl-C ends the process at once, which frees the port and saves nothing.
+import { spawn } from 'child_process';
+import { createServer } from 'http';
+import { Cause, Effect, Exit, Result, Schema } from 'effect';
+import { renderCliAuthBrowserPage } from './cli-auth-browser-page.js';
+import { rememberProcessSecret } from './credentials.js';
+export function shouldUseHeadlessLogin({ isForced, platform = process.platform, environment = process.env, }) {
+    if (isForced || environment.SSH_CONNECTION || environment.SSH_TTY) {
+        return true;
+    }
+    return platform === 'linux' && !environment.DISPLAY && !environment.WAYLAND_DISPLAY;
+}
+const toError = (cause) => cause instanceof Error ? cause : new Error(String(cause));
+/** A request that stops when the run is interrupted, and after `timeoutMs` when given. */
+function request(url, init, timeoutMs) {
+    return Effect.tryPromise({
+        try: signal => fetch(url, {
+            ...init,
+            signal: timeoutMs === undefined ? signal : AbortSignal.any([signal, AbortSignal.timeout(timeoutMs)]),
+        }),
+        catch: toError,
+    });
+}
+const readText = (response) => Effect.tryPromise({ try: () => response.text(), catch: toError });
+const parseJson = (dependencies, response, context) => Effect.tryPromise({ try: () => dependencies.parseJsonResponse(response, context), catch: toError });
+/**
+ * The loopback server the browser returns to. Only `GET /callback` counts:
+ * other paths get 404 and the wait goes on, and `/callback` without a code
+ * gets the error page and the wait goes on. The release closes the server and
+ * drops every connection on every ending. It runs after the success page has
+ * been sent, so a browser that keeps its connection open no longer holds the
+ * CLI after "Logged in".
+ */
+function loopback(port) {
+    return Effect.acquireRelease(Effect.callback(resume => {
+        let deliver = () => { };
+        const code = new Promise(resolve => { deliver = resolve; });
+        const server = createServer((incoming, response) => {
+            let url;
+            try {
+                url = new URL(incoming.url || '/', `http://127.0.0.1:${port}`);
+            }
+            catch {
+                // A malformed request target (from any local process) is refused; the wait goes on.
+                response.statusCode = 400;
+                response.setHeader('content-type', 'text/plain; charset=utf-8');
+                response.end('Bad request');
+                return;
+            }
+            if (incoming.method !== 'GET' || url.pathname !== '/callback') {
+                response.statusCode = 404;
+                response.setHeader('content-type', 'text/plain; charset=utf-8');
+                response.end('Not found');
+                return;
+            }
+            const received = url.searchParams.get('code');
+            response.setHeader('content-type', 'text/html; charset=utf-8');
+            if (!received) {
+                response.statusCode = 400;
+                response.end(renderCliAuthBrowserPage('error'));
+                return;
+            }
+            response.statusCode = 200;
+            response.end(renderCliAuthBrowserPage('success'));
+            deliver(received);
+        });
+        server.once('error', (error) => {
+            resume(Effect.fail(error.code === 'EADDRINUSE'
+                ? new Error(`Port ${port} is already in use. Set ORIZU_AUTH_PORT to a different port (1024–65535) and retry.`)
+                : error));
+        });
+        server.listen(port, '127.0.0.1', () => resume(Effect.succeed({ server, code })));
+    }), ({ server }) => Effect.sync(() => {
+        server.close();
+        server.closeAllConnections();
+    }));
+}
+const waitForCode = (code) => Effect.callback(resume => {
+    void code.then(value => resume(Effect.succeed(value)));
+});
+/**
+ * Starts the person's browser on `url`. The command is detached and never
+ * killed: on Linux `xdg-open` can become the browser itself. If it can't be
+ * started or exits with a failure, the URL is printed to open by hand and the
+ * wait goes on.
+ */
+function launchBrowser(url, dependencies) {
+    return Effect.sync(() => {
+        const command = process.platform === 'darwin'
+            ? { file: 'open', args: [url] }
+            : process.platform === 'win32'
+                ? { file: 'rundll32.exe', args: ['url.dll,FileProtocolHandler', url] }
+                : { file: 'xdg-open', args: [url] };
+        let toldByHand = false;
+        const openByHand = () => {
+            if (toldByHand)
+                return;
+            toldByHand = true;
+            dependencies.printProgress(`Could not open a browser. Open this URL to log in: ${dependencies.sanitizeTerminalText(url)}`);
+        };
+        const child = spawn(command.file, command.args, {
+            detached: true,
+            stdio: 'ignore',
+            windowsHide: true,
+        });
+        child.once('error', openByHand);
+        child.once('exit', status => { if (status !== 0)
+            openByHand(); });
+        child.unref();
+    });
+}
+function browserAuthorization({ baseUrl, codeChallenge, port }, dependencies) {
+    const redirectUri = `http://127.0.0.1:${port}/callback`;
+    return Effect.scoped(Effect.gen(function* () {
+        const { code } = yield* loopback(port);
+        const response = yield* request(`${baseUrl}/api/cli/auth/start`, {
+            method: 'POST',
+            headers: { 'Content-Type': 'application/json' },
+            body: JSON.stringify({ codeChallenge, redirectUri }),
+        });
+        if (!response.ok)
+            return yield* Effect.fail(new Error(`Failed to start login: ${yield* readText(response)}`));
+        const { authorizeUrl } = yield* parseJson(dependencies, response, 'CLI auth start');
+        const safeAuthorizeUrl = yield* Effect.try({ try: () => dependencies.validateBrowserUrl(authorizeUrl, baseUrl).href, catch: toError });
+        dependencies.printProgress(`Opening browser for login: ${dependencies.sanitizeTerminalText(safeAuthorizeUrl)}`);
+        yield* launchBrowser(safeAuthorizeUrl, dependencies);
+        return yield* waitForCode(code);
+    }));
+}
+// --- Headless flow ----------------------------------------------------------
+export const POLL_INTERVAL_MS = 2_000;
+const POLL_REQUEST_TIMEOUT_MS = 15_000;
+const MAX_RETRY_DELAY_MS = 60_000;
+const MAX_CONSECUTIVE_TRANSPORT_ERRORS = 3;
+const HeadlessStart = Schema.Struct({
+    requestId: Schema.NonEmptyString,
+    pollToken: Schema.NonEmptyString,
+    expiresInSeconds: Schema.Finite,
+});
+const HeadlessPoll = Schema.Struct({
+    status: Schema.Literals(['pending', 'approved', 'expired']),
+    code: Schema.optionalKey(Schema.String),
+});
+function retryDelayMs(response) {
+    if (response.status !== 429)
+        return POLL_INTERVAL_MS;
+    const retryAfterHeader = response.headers.get('retry-after');
+    const retryAfterSeconds = retryAfterHeader === null ? NaN : Number(retryAfterHeader);
+    return Number.isFinite(retryAfterSeconds) && retryAfterSeconds > 0
+        ? Math.min(retryAfterSeconds * 1000, MAX_RETRY_DELAY_MS)
+        : POLL_INTERVAL_MS;
+}
+function headlessAuthorization({ baseUrl, codeChallenge }, dependencies) {
+    const sleep = (milliseconds) => dependencies.sleep
+        ? Effect.promise(() => dependencies.sleep(milliseconds))
+        : Effect.sleep(milliseconds);
+    return Effect.gen(function* () {
+        const startResponse = yield* request(`${baseUrl}/api/cli/auth/start`, {
+            method: 'POST',
+            headers: { 'Content-Type': 'application/json' },
+            body: JSON.stringify({ codeChallenge, flow: 'headless' }),
+        }, POLL_REQUEST_TIMEOUT_MS);
+        if (!startResponse.ok)
+            return yield* Effect.fail(new Error(`Failed to start login: ${yield* readText(startResponse)}`));
+        const started = yield* parseJson(dependencies, startResponse, 'CLI headless auth start');
+        const authorizeUrl = yield* Effect.try({ try: () => dependencies.validateBrowserUrl(started.authorizeUrl, baseUrl).href, catch: toError });
+        const decodedStart = Schema.decodeUnknownResult(HeadlessStart)(started);
+        if (Result.isFailure(decodedStart)) {
+            return yield* Effect.fail(new Error('Server returned an invalid headless login response.'));
+        }
+        const { requestId, pollToken, expiresInSeconds } = decodedStart.success;
+        rememberProcessSecret(pollToken);
+        dependencies.printProgress(`Open this URL to log in: ${dependencies.sanitizeTerminalText(authorizeUrl)}`);
+        const expiresAt = Date.now() + (expiresInSeconds * 1000);
+        const sleepWithinDeadline = (delayMs) => {
+            const remainingMs = expiresAt - Date.now();
+            return remainingMs <= 0 ? Effect.void : sleep(Math.min(delayMs, remainingMs));
+        };
+        let consecutiveTransportErrors = 0;
+        const retryAfterTransportError = (error) => Effect.gen(function* () {
+            consecutiveTransportErrors += 1;
+            if (consecutiveTransportErrors >= MAX_CONSECUTIVE_TRANSPORT_ERRORS) {
+                return yield* Effect.fail(new Error(`Headless login could not reach the server after ${consecutiveTransportErrors} attempts: ${error.message}`));
+            }
+            yield* sleepWithinDeadline(POLL_INTERVAL_MS);
+        });
+        while (Date.now() < expiresAt) {
+            const remainingMs = expiresAt - Date.now();
+            const polled = yield* Effect.result(request(`${baseUrl}/api/cli/auth/poll`, {
+                method: 'POST',
+                headers: { 'Content-Type': 'application/json' },
+                body: JSON.stringify({ requestId, pollToken }),
+            }, Math.max(1, Math.min(POLL_REQUEST_TIMEOUT_MS, remainingMs))));
+            if (Result.isFailure(polled)) {
+                yield* retryAfterTransportError(polled.failure);
+                continue;
+            }
+            const pollResponse = polled.success;
+            if (!pollResponse.ok) {
+                if (pollResponse.status === 429) {
+                    consecutiveTransportErrors = 0;
+                    yield* sleepWithinDeadline(retryDelayMs(pollResponse));
+                    continue;
+                }
+                if (pollResponse.status >= 500) {
+                    const detail = yield* readText(pollResponse).pipe(Effect.orElseSucceed(() => 'response body unavailable'));
+                    yield* retryAfterTransportError(new Error(`Server returned ${pollResponse.status}: ${detail}`));
+                    continue;
+                }
+                return yield* Effect.fail(new Error(`Failed to poll login: ${yield* readText(pollResponse)}`));
+            }
+            const parsed = yield* Effect.result(parseJson(dependencies, pollResponse, 'CLI headless auth poll'));
+            if (Result.isFailure(parsed)) {
+                yield* retryAfterTransportError(parsed.failure);
+                continue;
+            }
+            consecutiveTransportErrors = 0;
+            const decoded = Schema.decodeUnknownResult(HeadlessPoll)(parsed.success);
+            if (Result.isFailure(decoded)) {
+                return yield* Effect.fail(new Error('Server returned an invalid headless login status.'));
+            }
+            const { status, code } = decoded.success;
+            if (status === 'approved' && code)
+                return rememberProcessSecret(code);
+            if (status === 'expired')
+                break;
+            if (status !== 'pending') {
+                return yield* Effect.fail(new Error('Server returned an invalid headless login status.'));
+            }
+            yield* sleepWithinDeadline(POLL_INTERVAL_MS);
+        }
+        return yield* Effect.fail(new Error('Headless login expired. Run `orizu login --headless` to try again.'));
+    });
+}
+// --- Exchange ---------------------------------------------------------------
+const ExchangeReply = Schema.Struct({
+    apiKey: Schema.optionalKey(Schema.Unknown),
+    user: Schema.Struct({
+        id: Schema.String,
+        email: Schema.optionalKey(Schema.NullOr(Schema.String)),
+    }),
+});
+function exchange({ baseUrl, code, codeVerifier, redirectUri }, dependencies) {
+    return Effect.gen(function* () {
+        rememberProcessSecret(code);
+        const response = yield* request(`${baseUrl}/api/cli/auth/exchange`, {
+            method: 'POST',
+            headers: { 'Content-Type': 'application/json' },
+            body: JSON.stringify({ code, codeVerifier, redirectUri }),
+        });
+        if (!response.ok)
+            return yield* Effect.fail(new Error(`Failed to exchange auth code: ${yield* readText(response)}`));
+        const data = yield* parseJson(dependencies, response, 'CLI auth exchange');
+        const decoded = Schema.decodeUnknownResult(ExchangeReply)(data);
+        const apiKey = Result.isSuccess(decoded) ? decoded.success.apiKey : data?.apiKey;
+        if (typeof apiKey !== 'string' || apiKey === '') {
+            return yield* Effect.fail(new Error('Server did not return an API key. Upgrade the Orizu server and run `orizu login` again.'));
+        }
+        if (Result.isFailure(decoded))
+            return yield* Effect.fail(new Error('Server returned an invalid login response.'));
+        const { user } = decoded.success;
+        return { apiKey, user: { id: user.id, email: user.email ?? null } };
+    });
+}
+// --- Entry ------------------------------------------------------------------
+/** For tests: the headless wait alone, returning the authorization code. */
+export function waitForHeadlessAuthorization(input, dependencies, signal) {
+    return run(headlessAuthorization(input, dependencies), signal);
+}
+/**
+ * Waits for the person to approve the login (in the browser, or by polling
+ * when headless), then exchanges the code. `callbackPort` undefined means
+ * headless. `signal` stops it, closing the loopback server.
+ */
+export function completeLogin(input, dependencies, signal) {
+    const { baseUrl, codeVerifier, codeChallenge, callbackPort } = input;
+    const authorization = callbackPort === undefined
+        ? headlessAuthorization({ baseUrl, codeChallenge }, dependencies)
+        : browserAuthorization({ baseUrl, codeChallenge, port: callbackPort }, dependencies);
+    const redirectUri = callbackPort === undefined ? undefined : `http://127.0.0.1:${callbackPort}/callback`;
+    return run(Effect.flatMap(authorization, code => exchange({ baseUrl, code, codeVerifier, redirectUri }, dependencies)), signal);
+}
+async function run(program, signal) {
+    const exit = await Effect.runPromiseExit(program, signal ? { signal } : undefined);
+    if (Exit.isSuccess(exit))
+        return exit.value;
+    if (signal?.aborted && Cause.hasInterruptsOnly(exit.cause))
+        throw signal.reason;
+    throw Cause.squash(exit.cause);
+}

package/dist/logout-diagnostic.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"logout-diagnostic.d.ts","sourceRoot":"","sources":["../src/logout-diagnostic.ts"],"names":[],"mappings":"AAGA,eAAO,MAAM,uBAAuB,MAAM,CAAA;AAQ1C,wBAAsB,yBAAyB,CAC7C,QAAQ,EAAE,QAAQ,EAClB,OAAO,EAAE,SAAS,MAAM,EAAE,GACzB,OAAO,CAAC,MAAM,CAAC,CAYjB;AAED,wBAAgB,8BAA8B,CAC5C,KAAK,EAAE,OAAO,EACd,OAAO,EAAE,SAAS,MAAM,EAAE,EAC1B,MAAM,CAAC,EAAE,MAAM,GACd,MAAM,CAMR"}
+{"version":3,"file":"logout-diagnostic.d.ts","sourceRoot":"","sources":["../src/logout-diagnostic.ts"],"names":[],"mappings":"AAGA,eAAO,MAAM,uBAAuB,MAAM,CAAA;AAS1C,wBAAsB,yBAAyB,CAC7C,QAAQ,EAAE,QAAQ,EAClB,OAAO,EAAE,SAAS,MAAM,EAAE,GACzB,OAAO,CAAC,MAAM,CAAC,CAYjB;AAED,wBAAgB,8BAA8B,CAC5C,KAAK,EAAE,OAAO,EACd,OAAO,EAAE,SAAS,MAAM,EAAE,EAC1B,MAAM,CAAC,EAAE,MAAM,GACd,MAAM,CAMR"}

package/dist/logout-diagnostic.js

@@ -2,7 +2,8 @@ import { sanitizeHumanInlineText, sanitizeTerminalText } from './json-response.j
 import { redactSecrets } from './secret-redaction.js';
 export const LOGOUT_DIAGNOSTIC_LIMIT = 180;
 function boundedLogoutDiagnostic(value, secrets) {
-    const bounded = sanitizeTerminalText(redactSecrets(value, { secrets }))
+    // Scrubbed again after control characters are stripped, so one inside a secret can't hide it.
+    const bounded = redactSecrets(sanitizeTerminalText(redactSecrets(value, { secrets })), { secrets })
         .slice(0, LOGOUT_DIAGNOSTIC_LIMIT);
     return sanitizeHumanInlineText(sanitizeTerminalText, bounded).slice(0, LOGOUT_DIAGNOSTIC_LIMIT);
 }

package/dist/manifests-cli.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"manifests-cli.d.ts","sourceRoot":"","sources":["../src/manifests-cli.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAIH,MAAM,MAAM,UAAU,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,WAAW,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAA;AAEhF,MAAM,WAAW,kBAAkB;IACjC,IAAI,EAAE,OAAO,CAAA;IACb,KAAK,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAA;IAC7B,OAAO,CAAC,EAAE,UAAU,CAAA;IACpB,kBAAkB,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,KAAK,OAAO,CAAC,MAAM,CAAC,CAAA;IAC5D,gEAAgE;IAChE,KAAK,CAAC,EAAE,CAAC,EAAE,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;CACtC;AA0PD,wBAAsB,gBAAgB,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,kBAAkB,GAAG,OAAO,CAAC,MAAM,CAAC,CAkG9F"}
+{"version":3,"file":"manifests-cli.d.ts","sourceRoot":"","sources":["../src/manifests-cli.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAIH,MAAM,MAAM,UAAU,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,WAAW,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAA;AAEhF,MAAM,WAAW,kBAAkB;IACjC,IAAI,EAAE,OAAO,CAAA;IACb,KAAK,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAA;IAC7B,OAAO,CAAC,EAAE,UAAU,CAAA;IACpB,kBAAkB,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,KAAK,OAAO,CAAC,MAAM,CAAC,CAAA;IAC5D,gEAAgE;IAChE,KAAK,CAAC,EAAE,CAAC,EAAE,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;CACtC;AA0PD,wBAAsB,gBAAgB,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,kBAAkB,GAAG,OAAO,CAAC,MAAM,CAAC,CA6E9F"}

package/dist/manifests-cli.js

@@ -264,6 +264,8 @@ export async function manifestsCommand(args, io) {
             throw new Error(`Usage: orizu manifests ${subcommand} <id> [--json]`);
         }
         const id = await resolveManifestId(io, args, idArg);
+        if (subcommand === 'reject')
+            return await rejectManifest(io, id);
         const postAction = () => fetcherFrom(io)(`/api/cli/promotion-manifests/${encodeURIComponent(id)}`, {
             method: 'POST',
             headers: { 'Content-Type': 'application/json' },
@@ -289,30 +291,42 @@ export async function manifestsCommand(args, io) {
         }
         const data = await requireOk(response, `Manifest ${subcommand}`);
         const manifest = (data.manifest ?? {});
-        const lines = [manifestLine(manifest)];
-        // Reject reaps the session branch best-effort; a failed reap must never be
-        // silent (ALI-1043) — surface it with the exact cleanup command.
-        if (subcommand === 'reject' && manifest.actionType === 'repo_merge') {
-            const outcome = asRecord(manifest.outcome);
-            const branch = asRecord(manifest.proposedState).branch;
-            // Terse server-provided reason for a failed reap (ALI-1043) — shown so
-            // the operator knows WHY manual cleanup is needed.
-            const cause = typeof outcome.branchDeleteError === 'string' && outcome.branchDeleteError.length > 0
-                ? ` (${outcome.branchDeleteError})`
-                : '';
-            if (outcome.branchDeleted === true) {
-                lines.push('session branch deleted');
-            }
-            else if (typeof branch === 'string' && branch.length > 0) {
-                lines.push(`warning: the session branch could not be deleted${cause} — remove it with: git push origin --delete ${branch}`);
-            }
-            else {
-                lines.push(`warning: the session branch could not be deleted${cause} (branch name unavailable)`);
-            }
-        }
-        emit(io, { manifest }, lines.join('\n'));
+        emit(io, { manifest }, manifestLine(manifest));
         return 0;
     }
     io.print('Usage: orizu manifests <list|show|approve|reject|apply|revert> ... [--json]');
     return 1;
 }
+// ORI-2726: one write with a deadline and Ctrl-C handling; a lost answer says
+// the manifest may already be rejected instead of printing "(unknown)".
+async function rejectManifest(io, id) {
+    const { manifestReject } = await import('./cli-write-commands.js');
+    const { sendOneRequestWrite } = await import('./one-request-write.js');
+    const sent = await sendOneRequestWrite({ ...manifestReject(id), json: io.json, print: io.print, ...(io.fetcher ? { fetcher: io.fetcher } : {}) });
+    if (sent.kind === 'interrupted')
+        return sent.exitCode;
+    const manifest = sent.reply.manifest;
+    const lines = [manifestLine(manifest)];
+    // Reject reaps the session branch best-effort; a failed reap must never be
+    // silent (ALI-1043) — surface it with the exact cleanup command.
+    if (manifest.actionType === 'repo_merge') {
+        const outcome = asRecord(manifest.outcome);
+        const branch = asRecord(manifest.proposedState).branch;
+        // Terse server-provided reason for a failed reap (ALI-1043) — shown so
+        // the operator knows WHY manual cleanup is needed.
+        const cause = typeof outcome.branchDeleteError === 'string' && outcome.branchDeleteError.length > 0
+            ? ` (${outcome.branchDeleteError})`
+            : '';
+        if (outcome.branchDeleted === true) {
+            lines.push('session branch deleted');
+        }
+        else if (typeof branch === 'string' && branch.length > 0) {
+            lines.push(`warning: the session branch could not be deleted${cause} — remove it with: git push origin --delete ${branch}`);
+        }
+        else {
+            lines.push(`warning: the session branch could not be deleted${cause} (branch name unavailable)`);
+        }
+    }
+    emit(io, { manifest }, lines.join('\n'));
+    return 0;
+}

package/dist/one-request-write.d.ts

@@ -0,0 +1,59 @@
+import { Schema } from 'effect';
+export interface MayAlreadyBeSaved {
+    readonly mayAlreadyBeSaved: true;
+    readonly advice: string;
+}
+/** `The <thing> may already be <done>: <advice>.` */
+export declare function mayAlreadyBeSavedLine(thing: string, done: string, advice: string): string;
+/** The fields a `--json` failure object gains. */
+export declare function mayAlreadyBeSavedFields(advice: string): MayAlreadyBeSaved;
+/** What to tell a person when a write may have saved but no clear answer came back. */
+export interface MayAlreadyBeSavedNote {
+    /** For example "task". */
+    thing: string;
+    /** For example "created". */
+    done: string;
+    /** What to do next, for example "check `orizu tasks list` before creating it again". */
+    advice: string;
+}
+export interface OneRequestWrite<A> {
+    /** For example "update task": every failure starts `Failed to update task:`. */
+    label: string;
+    /** For example "Task update": Ctrl-C prints `Task update interrupted.`. */
+    name: string;
+    path: string;
+    method: 'POST' | 'PATCH' | 'DELETE';
+    body?: unknown;
+    reply: Schema.Decoder<A>;
+    mayAlreadyBeSaved: MayAlreadyBeSavedNote;
+    /**
+     * The message and `--json` object for a reply that is the app's own
+     * `{ error }`, when the command words it itself (task create).
+     */
+    describeError?: (response: Response) => Promise<{
+        message: string;
+        json: {
+            error: string;
+        } & Record<string, unknown>;
+    }>;
+    json: boolean;
+    print: (line: string) => void;
+    /** Stands in for `authedFetch` in tests; the request counts as sent once it is called. */
+    fetcher?: (path: string, init: RequestInit) => Promise<Response>;
+}
+export type OneRequestWriteOutcome<A> = {
+    kind: 'saved';
+    reply: A;
+} | {
+    kind: 'interrupted';
+    exitCode: 130 | 143;
+};
+/**
+ * Sends one write. Ctrl-C or SIGTERM stops the wait and returns `interrupted`
+ * with the shell's usual exit code; the server may still finish on its own, so
+ * once the request was sent the person is told what may be saved. Any other
+ * failure throws, adding that line when the outcome is unknown. With `json`,
+ * every failure also prints one object on stdout.
+ */
+export declare function sendOneRequestWrite<A>(write: OneRequestWrite<A>): Promise<OneRequestWriteOutcome<A>>;
+//# sourceMappingURL=one-request-write.d.ts.map

package/dist/one-request-write.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"one-request-write.d.ts","sourceRoot":"","sources":["../src/one-request-write.ts"],"names":[],"mappings":"AAAA,OAAO,EAA+B,MAAM,EAAE,MAAM,QAAQ,CAAA;AAgB5D,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,iBAAiB,EAAE,IAAI,CAAA;IAChC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;CACxB;AAED,qDAAqD;AACrD,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,CAEzF;AAED,kDAAkD;AAClD,wBAAgB,uBAAuB,CAAC,MAAM,EAAE,MAAM,GAAG,iBAAiB,CAEzE;AAED,uFAAuF;AACvF,MAAM,WAAW,qBAAqB;IACpC,0BAA0B;IAC1B,KAAK,EAAE,MAAM,CAAA;IACb,6BAA6B;IAC7B,IAAI,EAAE,MAAM,CAAA;IACZ,wFAAwF;IACxF,MAAM,EAAE,MAAM,CAAA;CACf;AAID,MAAM,WAAW,eAAe,CAAC,CAAC;IAChC,gFAAgF;IAChF,KAAK,EAAE,MAAM,CAAA;IACb,2EAA2E;IAC3E,IAAI,EAAE,MAAM,CAAA;IACZ,IAAI,EAAE,MAAM,CAAA;IACZ,MAAM,EAAE,MAAM,GAAG,OAAO,GAAG,QAAQ,CAAA;IACnC,IAAI,CAAC,EAAE,OAAO,CAAA;IACd,KAAK,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAA;IACxB,iBAAiB,EAAE,qBAAqB,CAAA;IACxC;;;OAGG;IACH,aAAa,CAAC,EAAE,CAAC,QAAQ,EAAE,QAAQ,KAAK,OAAO,CAAC;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE;YAAE,KAAK,EAAE,MAAM,CAAA;SAAE,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;KAAE,CAAC,CAAA;IACvH,IAAI,EAAE,OAAO,CAAA;IACb,KAAK,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAA;IAC7B,0FAA0F;IAC1F,OAAO,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,WAAW,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAA;CACjE;AAED,MAAM,MAAM,sBAAsB,CAAC,CAAC,IAChC;IAAE,IAAI,EAAE,OAAO,CAAC;IAAC,KAAK,EAAE,CAAC,CAAA;CAAE,GAC3B;IAAE,IAAI,EAAE,aAAa,CAAC;IAAC,QAAQ,EAAE,GAAG,GAAG,GAAG,CAAA;CAAE,CAAA;AAyFhD;;;;;;GAMG;AACH,wBAAsB,mBAAmB,CAAC,CAAC,EAAE,KAAK,EAAE,eAAe,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,sBAAsB,CAAC,CAAC,CAAC,CAAC,CA6B1G"}