orizu 0.5.51 → 0.5.53

package/dist/app-commands.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"app-commands.d.ts","sourceRoot":"","sources":["../src/app-commands.ts"],"names":[],"mappings":"AAuCA,iBAAe,QAAQ,kBActB;AAED,iBAAS,cAAc,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAU/C;AAED,iBAAS,eAAe,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAUhD;AAED,iBAAS,YAAY,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAE9D;AAeD,iBAAS,QAAQ,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAElE;AAED,iBAAS,gBAAgB,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAG1F;AAED,iBAAS,gBAAgB,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,MAAM,CAUjE;AAED,iBAAS,SAAS,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,GAAG,MAAM,CAEjD;AAED,iBAAS,qBAAqB,CAAC,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,SAAS,EAAE,MAAM,GAAG;IACpF,IAAI,EAAE,MAAM,CAAA;IACZ,QAAQ,EAAE,MAAM,CAAA;IAChB,IAAI,EAAE,MAAM,CAAA;CACb,CAeA;AAED,iBAAS,kBAAkB,CAAC,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,SAAS,EAAE,MAAM;;;;;IAoB/E;AAED,iBAAS,wBAAwB,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,QAGjE;AAED,iBAAS,gBAAgB,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAEjE;AAyED,iBAAe,iBAAiB,kBAmG/B;AAED,iBAAe,kBAAkB,kBAiDhC;AAED,iBAAe,iBAAiB,kBAwF/B;AAED,iBAAe,cAAc,kBAgD5B;AA+CD,iBAAe,SAAS,kBA2CvB;AAED,yFAAyF;AACzF,wBAAgB,oBAAoB,CAAC,UAAU,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,EAAE,eAAe,EAAE,MAAM,GAAG,MAAM,CAK3G;AAED,iBAAe,eAAe,kBAmD7B;AAED,OAAO,EACL,cAAc,EACd,YAAY,EACZ,gBAAgB,EAChB,qBAAqB,EACrB,kBAAkB,EAClB,gBAAgB,EAChB,QAAQ,EACR,gBAAgB,EAChB,wBAAwB,EACxB,SAAS,EACT,eAAe,EACf,QAAQ,EACR,iBAAiB,EACjB,kBAAkB,EAClB,iBAAiB,EACjB,cAAc,EACd,SAAS,EACT,eAAe,GAChB,CAAA"}
+{"version":3,"file":"app-commands.d.ts","sourceRoot":"","sources":["../src/app-commands.ts"],"names":[],"mappings":"AAuCA,iBAAe,QAAQ,kBActB;AAED,iBAAS,cAAc,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAU/C;AAED,iBAAS,eAAe,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAUhD;AAED,iBAAS,YAAY,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAE9D;AAeD,iBAAS,QAAQ,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAElE;AAED,iBAAS,gBAAgB,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAG1F;AAED,iBAAS,gBAAgB,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,MAAM,CAUjE;AAED,iBAAS,SAAS,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,GAAG,MAAM,CAEjD;AAED,iBAAS,qBAAqB,CAAC,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,SAAS,EAAE,MAAM,GAAG;IACpF,IAAI,EAAE,MAAM,CAAA;IACZ,QAAQ,EAAE,MAAM,CAAA;IAChB,IAAI,EAAE,MAAM,CAAA;CACb,CAeA;AAED,iBAAS,kBAAkB,CAAC,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,SAAS,EAAE,MAAM;;;;;IAoB/E;AAED,iBAAS,wBAAwB,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,QAGjE;AAED,iBAAS,gBAAgB,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAEjE;AAyED,iBAAe,iBAAiB,kBAmG/B;AAED,iBAAe,kBAAkB,kBAiDhC;AAED,iBAAe,iBAAiB,kBAwF/B;AAED,iBAAe,cAAc,kBAiC5B;AA+CD,iBAAe,SAAS,kBA2CvB;AAED,yFAAyF;AACzF,wBAAgB,oBAAoB,CAAC,UAAU,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,EAAE,eAAe,EAAE,MAAM,GAAG,MAAM,CAK3G;AAED,iBAAe,eAAe,kBAmD7B;AAED,OAAO,EACL,cAAc,EACd,YAAY,EACZ,gBAAgB,EAChB,qBAAqB,EACrB,kBAAkB,EAClB,gBAAgB,EAChB,QAAQ,EACR,gBAAgB,EAChB,wBAAwB,EACxB,SAAS,EACT,eAAe,EACf,QAAQ,EACR,iBAAiB,EACjB,kBAAkB,EAClB,iBAAiB,EACjB,cAAc,EACd,SAAS,EACT,eAAe,GAChB,CAAA"}

package/dist/app-commands.js

@@ -433,18 +433,10 @@ async function linkAppDataset() {
         const selected = await selectAppIdInteractively(project);
         appId = selected.appId;
     }
-    const response = await authedFetch(`/api/cli/apps/${encodeURIComponent(appId)}/link-dataset`, {
-        method: 'POST',
-        headers: { 'Content-Type': 'application/json' },
-        body: JSON.stringify({
-            datasetId,
-            versionNum,
-        }),
-    });
-    if (!response.ok) {
-        throw new Error(`Failed to link dataset: ${await response.text()}`);
-    }
-    const data = await parseJsonResponse(response, 'App link dataset');
+    const writes = await import('./cli-write-commands.js');
+    const data = await writes.sendCommandWrite(writes.appLinkDataset(appId, { datasetId, ...(versionNum === undefined ? {} : { versionNum }) }), { json: hasJsonFlag(), print: printLine });
+    if (!data)
+        return;
     if (hasJsonFlag()) {
         printJson({ app: data.app, linkedDataset: data.linkedDataset, versionNum: data.versionNum });
         return;

package/dist/auth-commands.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"auth-commands.d.ts","sourceRoot":"","sources":["../src/auth-commands.ts"],"names":[],"mappings":"AA6BA,iBAAS,WAAW,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,MAAM,CAAC,cAAc,CAEnE;AAMD,wBAAgB,mBAAmB,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAE5D;AAQD,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,MAAM,EAAE,cAAc,CAAC,EAAE,MAAM,GAAG,GAAG,CAwB5E;AA6BD,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAgBtD;AAED,iBAAS,UAAU,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAEzC;AA4BD,iBAAe,KAAK,CAAC,eAAe,CAAC,EAAE,MAAM,iBAoC5C;AAoHD,iBAAe,MAAM,kBAWpB;AAED,iBAAe,MAAM,CAAC,eAAe,CAAC,EAAE,MAAM,iBAwC7C;AAED,iBAAe,QAAQ,kBA0BtB;AAED,OAAO,EAAE,WAAW,EAAE,KAAK,EAAE,UAAU,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAA"}
+{"version":3,"file":"auth-commands.d.ts","sourceRoot":"","sources":["../src/auth-commands.ts"],"names":[],"mappings":"AAyBA,iBAAS,WAAW,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,MAAM,CAAC,cAAc,CAEnE;AAMD,wBAAgB,mBAAmB,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAE5D;AAQD,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,MAAM,EAAE,cAAc,CAAC,EAAE,MAAM,GAAG,GAAG,CAwB5E;AAED,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAgBtD;AAED,iBAAS,UAAU,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAEzC;AA4BD,iBAAe,KAAK,CAAC,eAAe,CAAC,EAAE,MAAM,iBAoC5C;AA4BD,iBAAe,MAAM,kBAWpB;AAED,iBAAe,MAAM,CAAC,eAAe,CAAC,EAAE,MAAM,iBAwC7C;AAED,iBAAe,QAAQ,kBA0BtB;AAED,OAAO,EAAE,WAAW,EAAE,KAAK,EAAE,UAAU,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAA"}

package/dist/auth-commands.js

@@ -1,14 +1,10 @@
 // ORI-2044: moved from index.ts to keep auth commands together.
 import { randomBytes, createHash } from 'crypto';
-import { spawn } from 'child_process';
-import { createServer } from 'http';
 import { sanitizeTerminalText, parseJsonResponse } from './json-response.js';
 import { isInteractiveTerminal, hasArg, hasJsonFlag, getArg } from './command-line-arguments.js';
 import { getBaseUrl, resolveLoginTarget, resolveLogoutTarget, assertSecureTokenTransport, authedFetch, } from './http.js';
 import { clearUnreadableServerCredentials, hasResolvableAuth, rememberProcessSecret, saveServerCredentials, getServerCredentials, resolveAuthTokenForBaseUrl, } from './credentials.js';
-import { printJson, printLine, printLoginProgress } from './cli-console-output.js';
-import { shouldUseHeadlessLogin, waitForHeadlessAuthorization } from './headless-login.js';
-import { renderCliAuthBrowserPage } from './cli-auth-browser-page.js';
+import { printJson, printJsonWithHeldSecrets, printLine, printLoginProgress } from './cli-console-output.js';
 import { resolveProjectSelection } from './account-directory.js';
 function isNodeError(error) {
     return error instanceof Error;
@@ -46,30 +42,6 @@ export function validateBrowserUrl(url, expectedOrigin) {
     }
     return parsed;
 }
-function openInBrowser(url) {
-    const parsed = validateBrowserUrl(url);
-    const platform = process.platform;
-    const href = parsed.href;
-    if (platform === 'darwin') {
-        spawn('open', [href], {
-            detached: true,
-            stdio: 'ignore',
-        }).unref();
-        return;
-    }
-    if (platform === 'win32') {
-        spawn('rundll32.exe', ['url.dll,FileProtocolHandler', href], {
-            detached: true,
-            stdio: 'ignore',
-            windowsHide: true,
-        }).unref();
-        return;
-    }
-    spawn('xdg-open', [href], {
-        detached: true,
-        stdio: 'ignore',
-    }).unref();
-}
 export function formatTerminalLink(url) {
     const safeUrl = sanitizeTerminalText(url);
     try {
@@ -154,85 +126,10 @@ async function authenticateAtBaseUrl(baseUrl) {
     }
     const codeVerifier = rememberProcessSecret(createCodeVerifier());
     const codeChallenge = createCodeChallenge(codeVerifier);
+    // Effect loads here, after the already-logged-in check (ORI-2422).
+    const { completeLogin, shouldUseHeadlessLogin } = await import('./login-flow.js');
     const isHeadlessLogin = shouldUseHeadlessLogin({ isForced: hasArg('--headless') });
-    const callbackPort = isHeadlessLogin ? undefined : resolveAuthCallbackPort();
-    const redirectUri = callbackPort === undefined ? undefined : `http://127.0.0.1:${callbackPort}/callback`;
-    const callbackCode = isHeadlessLogin
-        ? await waitForHeadlessAuthorization({ baseUrl, codeChallenge }, {
-            parseJsonResponse,
-            printProgress: printLoginProgress,
-            sanitizeTerminalText,
-            validateBrowserUrl,
-        })
-        : await new Promise((resolve, reject) => {
-            const server = createServer((request, response) => {
-                try {
-                    const url = new URL(request.url || '/', `http://127.0.0.1:${callbackPort}`);
-                    const code = url.searchParams.get('code');
-                    if (!code) {
-                        response.statusCode = 400;
-                        response.setHeader('content-type', 'text/html; charset=utf-8');
-                        response.end(renderCliAuthBrowserPage('error'));
-                        return;
-                    }
-                    response.statusCode = 200;
-                    response.setHeader('content-type', 'text/html; charset=utf-8');
-                    response.end(renderCliAuthBrowserPage('success'));
-                    server.close();
-                    resolve(code);
-                }
-                catch (error) {
-                    server.close();
-                    reject(error);
-                }
-            });
-            server.on('error', (error) => {
-                if (error.code === 'EADDRINUSE') {
-                    reject(new Error(`Port ${callbackPort} is already in use. Set ORIZU_AUTH_PORT to a different port (1024–65535) and retry.`));
-                }
-                else {
-                    reject(error);
-                }
-            });
-            server.listen(callbackPort, '127.0.0.1', async () => {
-                try {
-                    const response = await fetch(`${baseUrl}/api/cli/auth/start`, {
-                        method: 'POST',
-                        headers: { 'Content-Type': 'application/json' },
-                        body: JSON.stringify({ codeChallenge, redirectUri }),
-                    });
-                    if (!response.ok) {
-                        const text = await response.text();
-                        server.close();
-                        reject(new Error(`Failed to start login: ${text}`));
-                        return;
-                    }
-                    const { authorizeUrl } = await parseJsonResponse(response, 'CLI auth start');
-                    const safeAuthorizeUrl = validateBrowserUrl(authorizeUrl, baseUrl).href;
-                    printLoginProgress(`Opening browser for login: ${sanitizeTerminalText(safeAuthorizeUrl)}`);
-                    openInBrowser(safeAuthorizeUrl);
-                }
-                catch (error) {
-                    server.close();
-                    reject(error);
-                }
-            });
-        });
-    rememberProcessSecret(callbackCode);
-    const exchangeResponse = await fetch(`${baseUrl}/api/cli/auth/exchange`, {
-        method: 'POST',
-        headers: { 'Content-Type': 'application/json' },
-        body: JSON.stringify({ code: callbackCode, codeVerifier, redirectUri }),
-    });
-    if (!exchangeResponse.ok) {
-        const text = await exchangeResponse.text();
-        throw new Error(`Failed to exchange auth code: ${text}`);
-    }
-    const loginData = await parseJsonResponse(exchangeResponse, 'CLI auth exchange');
-    if (!loginData.apiKey) {
-        throw new Error('Server did not return an API key. Upgrade the Orizu server and run `orizu login` again.');
-    }
-    return { ...loginData, apiKey: loginData.apiKey };
+    return completeLogin({ baseUrl, codeVerifier, codeChallenge, callbackPort: isHeadlessLogin ? undefined : resolveAuthCallbackPort() }, { parseJsonResponse, printProgress: printLoginProgress, sanitizeTerminalText, validateBrowserUrl });
 }
 async function whoami() {
     const response = await authedFetch('/api/cli/auth/whoami');
@@ -299,7 +196,7 @@ async function printEnv() {
     const projectId = project?.id || getArg('--project-id') || process.env.ORIZU_PROJECT_ID || '';
     const projectSlug = project ? `${project.teamSlug}/${project.slug}` : process.env.ORIZU_PROJECT || '';
     if (hasJsonFlag()) {
-        printJson({
+        printJsonWithHeldSecrets({
             ORIZU_API_URL: baseUrl,
             ORIZU_TOKEN: token,
             ORIZU_PROJECT_ID: projectId,

package/dist/cli-console-output.d.ts

@@ -8,5 +8,11 @@ declare function printError(message: string): void;
 declare function printLoginProgress(message: string): void;
 declare function printPushDisclosures(data: Record<string, unknown>): void;
 declare function printJson(value: Record<string, unknown>): void;
-export { getErrorMessage, printJson, printLine, printPushDisclosures, getCliVersion, printBannerIfInteractive, printVersion, printUsage, printError, printLoginProgress, };
+/**
+ * The one --json output allowed to carry a held secret: `orizu env --json`
+ * prints the token so a script can export it. Any new caller needs its own
+ * reviewed change and a case in cli-json-output-scrub-process.test.ts.
+ */
+declare function printJsonWithHeldSecrets(value: Record<string, unknown>): void;
+export { getErrorMessage, printJson, printJsonWithHeldSecrets, printLine, printPushDisclosures, getCliVersion, printBannerIfInteractive, printVersion, printUsage, printError, printLoginProgress, };
 //# sourceMappingURL=cli-console-output.d.ts.map

package/dist/cli-console-output.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cli-console-output.d.ts","sourceRoot":"","sources":["../src/cli-console-output.ts"],"names":[],"mappings":"AAUA,iBAAS,eAAe,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,CAE/C;AAED,iBAAS,aAAa,IAAI,MAAM,CAU/B;AAED,iBAAS,SAAS,CAAC,OAAO,SAAK,QAE9B;AAED,iBAAS,YAAY,SAEpB;AAED,iBAAS,wBAAwB,SAMhC;AAED,iBAAS,UAAU,SAGlB;AAED,iBAAS,UAAU,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAEzC;AAED,iBAAS,kBAAkB,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAMjD;AAED,iBAAS,oBAAoB,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAMjE;AAED,iBAAS,SAAS,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,QAEhD;AAED,OAAO,EACL,eAAe,EACf,SAAS,EACT,SAAS,EACT,oBAAoB,EACpB,aAAa,EACb,wBAAwB,EACxB,YAAY,EACZ,UAAU,EACV,UAAU,EACV,kBAAkB,GACnB,CAAA"}
+{"version":3,"file":"cli-console-output.d.ts","sourceRoot":"","sources":["../src/cli-console-output.ts"],"names":[],"mappings":"AAWA,iBAAS,eAAe,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,CAE/C;AAED,iBAAS,aAAa,IAAI,MAAM,CAU/B;AAGD,iBAAS,SAAS,CAAC,OAAO,SAAK,QAE9B;AAED,iBAAS,YAAY,SAEpB;AAED,iBAAS,wBAAwB,SAMhC;AAED,iBAAS,UAAU,SAGlB;AAED,iBAAS,UAAU,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAEzC;AAED,iBAAS,kBAAkB,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAMjD;AAED,iBAAS,oBAAoB,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAMjE;AAED,iBAAS,SAAS,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,QAEhD;AAED;;;;GAIG;AACH,iBAAS,wBAAwB,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,QAI/D;AAED,OAAO,EACL,eAAe,EACf,SAAS,EACT,wBAAwB,EACxB,SAAS,EACT,oBAAoB,EACpB,aAAa,EACb,wBAAwB,EACxB,YAAY,EACZ,UAAU,EACV,UAAU,EACV,kBAAkB,GACnB,CAAA"}

package/dist/cli-console-output.js

@@ -4,7 +4,8 @@ import { stdout as output } from 'process';
 import { renderBanner } from './banner.js';
 import { renderRootHelp } from './help.js';
 import { sanitizeTerminalText } from './json-response.js';
-import { hasJsonFlag } from './command-line-arguments.js';
+import { cliArgs, hasJsonFlag } from './command-line-arguments.js';
+import { hideHeldSecrets } from './json-output-scrub.js';
 import { reportReplacementWarning } from './report-replacement-warning.js';
 function getErrorMessage(error) {
     return error instanceof Error ? error.message : String(error);
@@ -16,8 +17,9 @@ function getCliVersion() {
     }
     return packageJson.version;
 }
+// ORI-2744: under --json, stdout never carries a secret this process holds.
 function printLine(message = '') {
-    output.write(`${message}\n`);
+    output.write(`${hasJsonFlag() ? hideHeldSecrets(message) : message}\n`);
 }
 function printVersion() {
     printLine(`orizu ${getCliVersion()}`);
@@ -54,4 +56,15 @@ function printPushDisclosures(data) {
 function printJson(value) {
     printLine(JSON.stringify(value));
 }
-export { getErrorMessage, printJson, printLine, printPushDisclosures, getCliVersion, printBannerIfInteractive, printVersion, printUsage, printError, printLoginProgress, };
+/**
+ * The one --json output allowed to carry a held secret: `orizu env --json`
+ * prints the token so a script can export it. Any new caller needs its own
+ * reviewed change and a case in cli-json-output-scrub-process.test.ts.
+ */
+function printJsonWithHeldSecrets(value) {
+    // Any other command is scrubbed as usual, so a wrong caller can't leak.
+    if (cliArgs[0] !== 'env')
+        return printJson(value);
+    output.write(`${JSON.stringify(value)}\n`);
+}
+export { getErrorMessage, printJson, printJsonWithHeldSecrets, printLine, printPushDisclosures, getCliVersion, printBannerIfInteractive, printVersion, printUsage, printError, printLoginProgress, };

package/dist/cli-stops.d.ts

@@ -0,0 +1,14 @@
+import { Effect } from 'effect';
+export interface Interrupted {
+    interrupted: 130 | 143;
+}
+/**
+ * Runs the program with Ctrl-C and SIGTERM turned into an interrupt, and says
+ * which stop arrived, if any. `once`: a second signal falls through to Node's
+ * default kill. The handlers are removed before this returns.
+ */
+export declare function runWithStops<A>(program: (signal: AbortSignal) => Effect.Effect<A, unknown>): Promise<{
+    exit: import("effect/Exit").Exit<A, unknown>;
+    interrupted: 130 | 143 | undefined;
+}>;
+//# sourceMappingURL=cli-stops.d.ts.map

package/dist/cli-stops.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cli-stops.d.ts","sourceRoot":"","sources":["../src/cli-stops.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAA;AAK/B,MAAM,WAAW,WAAW;IAAG,WAAW,EAAE,GAAG,GAAG,GAAG,CAAA;CAAE;AAEvD;;;;GAIG;AACH,wBAAsB,YAAY,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,MAAM,EAAE,WAAW,KAAK,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,OAAO,CAAC;;;GAchG"}

package/dist/cli-stops.js

@@ -0,0 +1,22 @@
+import { Effect } from 'effect';
+/**
+ * Runs the program with Ctrl-C and SIGTERM turned into an interrupt, and says
+ * which stop arrived, if any. `once`: a second signal falls through to Node's
+ * default kill. The handlers are removed before this returns.
+ */
+export async function runWithStops(program) {
+    const controller = new AbortController();
+    let interrupted;
+    const handleInterrupt = () => { interrupted ??= 130; controller.abort(); };
+    const handleTerminate = () => { interrupted ??= 143; controller.abort(); };
+    process.once('SIGINT', handleInterrupt);
+    process.once('SIGTERM', handleTerminate);
+    try {
+        const exit = await Effect.runPromiseExit(program(controller.signal), { signal: controller.signal });
+        return { exit, interrupted };
+    }
+    finally {
+        process.removeListener('SIGINT', handleInterrupt);
+        process.removeListener('SIGTERM', handleTerminate);
+    }
+}

package/dist/cli-write-commands.d.ts

@@ -0,0 +1,143 @@
+import { Schema } from 'effect';
+import { type OneRequestWrite } from './one-request-write.js';
+type Write<A> = Pick<OneRequestWrite<A>, 'label' | 'name' | 'path' | 'method' | 'body' | 'reply' | 'mayAlreadyBeSaved' | 'describeError'>;
+declare const TaskCreated: Schema.Struct<{
+    readonly task: Schema.Struct<{
+        readonly id: Schema.String;
+        readonly title: Schema.String;
+        readonly status: Schema.String;
+        readonly requiredAssignmentsPerRow: Schema.Number;
+        readonly versionId: Schema.String;
+        readonly versionNum: Schema.Number;
+    }>;
+    readonly assignmentsCreated: Schema.Number;
+    readonly assignmentShortfall: Schema.optionalKey<Schema.Number>;
+    readonly warning: Schema.optionalKey<Schema.String>;
+}>;
+/** Running it again makes a second task (and, with --publish, emails labellers again). */
+export declare const taskCreate: (body: Record<string, unknown>, describeError: Write<typeof TaskCreated.Type>["describeError"]) => Write<typeof TaskCreated.Type>;
+declare const TaskUpdated: Schema.Struct<{
+    readonly task: Schema.Struct<{
+        readonly id: Schema.String;
+        readonly title: Schema.optionalKey<Schema.NullOr<Schema.String>>;
+        readonly status: Schema.optionalKey<Schema.NullOr<Schema.String>>;
+        readonly dataset_id: Schema.optionalKey<Schema.NullOr<Schema.String>>;
+        readonly app_id: Schema.optionalKey<Schema.NullOr<Schema.String>>;
+        readonly version_id: Schema.optionalKey<Schema.NullOr<Schema.String>>;
+        readonly required_assignments_per_row: Schema.optionalKey<Schema.NullOr<Schema.Number>>;
+    }>;
+    readonly assignmentMode: Schema.optionalKey<Schema.String>;
+    readonly assignmentsCreated: Schema.optionalKey<Schema.Number>;
+}>;
+/** Sets the same values again, so a repeat is safe. */
+export declare const taskUpdate: (id: string, body: Record<string, unknown>) => Write<typeof TaskUpdated.Type>;
+declare const Discarded: Schema.Struct<{
+    readonly success: Schema.Boolean;
+}>;
+/** Once the draft is gone, a repeat is refused as "not found". */
+export declare const taskDiscard: (id: string) => Write<typeof Discarded.Type>;
+declare const Published: Schema.Struct<{
+    readonly assignmentsProcessed: Schema.Number;
+    readonly assignmentsCreated: Schema.Number;
+    readonly assignmentsRemoved: Schema.optionalKey<Schema.Number>;
+    readonly assignmentShortfall: Schema.optionalKey<Schema.Number>;
+    readonly warning: Schema.optionalKey<Schema.String>;
+    readonly task: Schema.Struct<{
+        readonly id: Schema.String;
+        readonly status: Schema.String;
+    }>;
+}>;
+/** Once published, a repeat is refused as "must be a draft". */
+export declare const taskPublish: (id: string, body: Record<string, unknown>) => Write<typeof Published.Type>;
+declare const Assigned: Schema.Struct<{
+    assignmentsCreated: Schema.Number;
+    assignmentsProcessed: Schema.optionalKey<Schema.Number>;
+    assignmentsRemoved: Schema.optionalKey<Schema.Number>;
+    assignmentShortfall: Schema.optionalKey<Schema.Number>;
+    warning: Schema.optionalKey<Schema.String>;
+}>;
+/** Adds only missing pairs and emails only new people, so a repeat is safe. */
+export declare const taskAssign: (id: string, body: Record<string, unknown>) => Write<typeof Assigned.Type>;
+declare const StatusChanged: Schema.Struct<{
+    readonly task: Schema.Struct<{
+        readonly id: Schema.String;
+        readonly status: Schema.String;
+    }>;
+}>;
+/** Setting the status a task already has changes nothing. */
+export declare const taskStatus: (id: string, verb: string, status: string) => Write<typeof StatusChanged.Type>;
+declare const RunStarted: Schema.Struct<{
+    readonly optimization_run_id: Schema.String;
+    readonly optimizationRun: Schema.Struct<{
+        readonly id: Schema.String;
+        readonly status: Schema.String;
+        readonly startedAt: Schema.optionalKey<Schema.NullOr<Schema.String>>;
+        readonly createdAt: Schema.optionalKey<Schema.NullOr<Schema.String>>;
+    }>;
+}>;
+/** The server picks a new run id per request, so running it again starts a second run. */
+export declare const optimizationStart: (project: string, body: Record<string, unknown>) => Write<typeof RunStarted.Type>;
+declare const RunChanged: Schema.Struct<{
+    readonly optimizationRun: Schema.Struct<{
+        readonly id: Schema.String;
+        readonly status: Schema.optionalKey<Schema.String>;
+        readonly startedAt: Schema.optionalKey<Schema.NullOr<Schema.String>>;
+        readonly finishedAt: Schema.optionalKey<Schema.NullOr<Schema.String>>;
+        readonly bestScore: Schema.optionalKey<Schema.NullOr<Schema.Number>>;
+        readonly bestCandidateId: Schema.optionalKey<Schema.NullOr<Schema.String>>;
+        readonly resultPromptVersionId: Schema.optionalKey<Schema.NullOr<Schema.String>>;
+        readonly metadata: Schema.optionalKey<Schema.$Record<Schema.String, Schema.Unknown>>;
+    }>;
+    readonly cancellationStatus: Schema.optionalKey<Schema.Literal<"already_terminal">>;
+}>;
+/** Writing the status a run already has again converges, so a repeat is safe. */
+export declare const optimizationLifecycle: (runId: string, body: Record<string, unknown>) => Write<typeof RunChanged.Type>;
+declare const EventLogged: Schema.Struct<{
+    readonly eventId: Schema.String;
+}>;
+/** A repeat with the same event id changes nothing; a new id is refused as a sequence clash. */
+export declare const optimizationEvent: (runId: string, body: Record<string, unknown> & {
+    eventId: string;
+}) => Write<typeof EventLogged.Type>;
+declare const Linked: Schema.Struct<{
+    readonly app: Schema.Struct<{
+        readonly id: Schema.String;
+        readonly name: Schema.String;
+    }>;
+    readonly linkedDataset: Schema.Struct<{
+        readonly id: Schema.String;
+        readonly name: Schema.String;
+    }>;
+    readonly versionNum: Schema.Number;
+}>;
+/**
+ * A plain overwrite, so a repeat is safe; without --version it links the
+ * app's current version at the time, which may have moved on.
+ */
+export declare const appLinkDataset: (appId: string, body: {
+    datasetId: string;
+    versionNum?: number;
+}) => Write<typeof Linked.Type>;
+declare const Accepted: Schema.Struct<{
+    readonly scoreRun: Schema.Struct<{
+        readonly id: Schema.String;
+        readonly provenance: Schema.String;
+        readonly acceptedByUserId: Schema.NullOr<Schema.String>;
+        readonly acceptedAt: Schema.NullOr<Schema.String>;
+        readonly alreadyAccepted: Schema.Boolean;
+    }>;
+}>;
+/** The first acceptance is kept and a repeat says "already accepted". */
+export declare const scoreAccept: (project: string, scoreRunId: string) => Write<typeof Accepted.Type>;
+declare const ManifestRejected: Schema.Struct<{
+    readonly manifest: Schema.$Record<Schema.String, Schema.Unknown>;
+}>;
+/** Once rejected, a repeat is refused, so the advice is to look first. */
+export declare const manifestReject: (id: string) => Write<typeof ManifestRejected.Type>;
+/** Sends a write with this command's `--json` setting and output. Ctrl-C sets the exit code and returns null. */
+export declare function sendCommandWrite<A>(write: Write<A>, io: {
+    json: boolean;
+    print: (line: string) => void;
+}): Promise<A | null>;
+export {};
+//# sourceMappingURL=cli-write-commands.d.ts.map

package/dist/cli-write-commands.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cli-write-commands.d.ts","sourceRoot":"","sources":["../src/cli-write-commands.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAA;AAE/B,OAAO,EAAmD,KAAK,eAAe,EAAE,MAAM,wBAAwB,CAAA;AAU9G,KAAK,KAAK,CAAC,CAAC,IAAI,IAAI,CAAC,eAAe,CAAC,CAAC,CAAC,EAAE,OAAO,GAAG,MAAM,GAAG,MAAM,GAAG,QAAQ,GAAG,MAAM,GAAG,OAAO,GAAG,mBAAmB,GAAG,eAAe,CAAC,CAAA;AAazI,QAAA,MAAM,WAAW;;;;;;;;;;;;EAKf,CAAA;AAEF,0FAA0F;AAC1F,eAAO,MAAM,UAAU,GAAI,MAAM,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,eAAe,KAAK,CAAC,OAAO,WAAW,CAAC,IAAI,CAAC,CAAC,eAAe,CAAC,KAAG,KAAK,CAAC,OAAO,WAAW,CAAC,IAAI,CAGtJ,CAAA;AAGF,QAAA,MAAM,WAAW;;;;;;;;;;;;EAOf,CAAA;AAEF,uDAAuD;AACvD,eAAO,MAAM,UAAU,GAAI,IAAI,MAAM,EAAE,MAAM,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAG,KAAK,CAAC,OAAO,WAAW,CAAC,IAAI,CAElG,CAAA;AAEF,QAAA,MAAM,SAAS;;EAA6C,CAAA;AAC5D,kEAAkE;AAClE,eAAO,MAAM,WAAW,GAAI,IAAI,MAAM,KAAG,KAAK,CAAC,OAAO,SAAS,CAAC,IAAI,CAGlE,CAAA;AAEF,QAAA,MAAM,SAAS;;;;;;;;;;EAAkH,CAAA;AACjI,gEAAgE;AAChE,eAAO,MAAM,WAAW,GAAI,IAAI,MAAM,EAAE,MAAM,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAG,KAAK,CAAC,OAAO,SAAS,CAAC,IAAI,CAGjG,CAAA;AAEF,QAAA,MAAM,QAAQ;;;;;;EAA6B,CAAA;AAC3C,+EAA+E;AAC/E,eAAO,MAAM,UAAU,GAAI,IAAI,MAAM,EAAE,MAAM,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAG,KAAK,CAAC,OAAO,QAAQ,CAAC,IAAI,CAE/F,CAAA;AAEF,QAAA,MAAM,aAAa;;;;;EAAqE,CAAA;AACxF,6DAA6D;AAC7D,eAAO,MAAM,UAAU,GAAI,IAAI,MAAM,EAAE,MAAM,MAAM,EAAE,QAAQ,MAAM,KAAG,KAAK,CAAC,OAAO,aAAa,CAAC,IAAI,CAGnG,CAAA;AAEF,QAAA,MAAM,UAAU;;;;;;;;EAGd,CAAA;AACF,0FAA0F;AAC1F,eAAO,MAAM,iBAAiB,GAAI,SAAS,MAAM,EAAE,MAAM,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAG,KAAK,CAAC,OAAO,UAAU,CAAC,IAAI,CAG7G,CAAA;AAEF,QAAA,MAAM,UAAU;;;;;;;;;;;;EAMd,CAAA;AACF,iFAAiF;AACjF,eAAO,MAAM,qBAAqB,GAAI,OAAO,MAAM,EAAE,MAAM,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAG,KAAK,CAAC,OAAO,UAAU,CAAC,IAAI,CAG/G,CAAA;AAEF,QAAA,MAAM,WAAW;;EAAmC,CAAA;AACpD,gGAAgG;AAChG,eAAO,MAAM,iBAAiB,GAAI,OAAO,MAAM,EAAE,MAAM,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG;IAAE,OAAO,EAAE,MAAM,CAAA;CAAE,KAAG,KAAK,CAAC,OAAO,WAAW,CAAC,IAAI,CAGlI,CAAA;AAEF,QAAA,MAAM,MAAM;;;;;;;;;;EAA6I,CAAA;AACzJ;;;GAGG;AACH,eAAO,MAAM,cAAc,GAAI,OAAO,MAAM,EAAE,MAAM;IAAE,SAAS,EAAE,MAAM,CAAC;IAAC,UAAU,CAAC,EAAE,MAAM,CAAA;CAAE,KAAG,KAAK,CAAC,OAAO,MAAM,CAAC,IAAI,CAGvH,CAAA;AAEF,QAAA,MAAM,QAAQ;;;;;;;;EAEZ,CAAA;AACF,yEAAyE;AACzE,eAAO,MAAM,WAAW,GAAI,SAAS,MAAM,EAAE,YAAY,MAAM,KAAG,KAAK,CAAC,OAAO,QAAQ,CAAC,IAAI,CAG1F,CAAA;AAEF,QAAA,MAAM,gBAAgB;;EAAmE,CAAA;AACzF,0EAA0E;AAC1E,eAAO,MAAM,cAAc,GAAI,IAAI,MAAM,KAAG,KAAK,CAAC,OAAO,gBAAgB,CAAC,IAAI,CAG5E,CAAA;AAEF,iHAAiH;AACjH,wBAAsB,gBAAgB,CAAC,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE;IAAE,IAAI,EAAE,OAAO,CAAC;IAAC,KAAK,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAA;CAAE,GAAG,OAAO,CAAC,CAAC,GAAG,IAAI,CAAC,CAKlI"}

package/dist/cli-write-commands.js

@@ -0,0 +1,123 @@
+import { Schema } from 'effect';
+import { sendOneRequestWrite } from './one-request-write.js';
+// ORI-2726: what each one-request write command sends, the reply it expects,
+// and what to tell a person when the write may already be saved. The advice
+// follows what the server does when the same request arrives twice. Loaded
+// only through `await import(...)`, so commands that never write skip Effect.
+const SAFE = 'running the same command again is safe';
+const note = (thing, done, advice) => ({ thing, done, advice });
+const task = (id) => `/api/cli/tasks/${encodeURIComponent(id)}`;
+const Count = Schema.Number;
+const Text = Schema.String;
+const Assignments = {
+    assignmentsCreated: Count,
+    assignmentsProcessed: Schema.optionalKey(Count),
+    assignmentsRemoved: Schema.optionalKey(Count),
+    assignmentShortfall: Schema.optionalKey(Count),
+    warning: Schema.optionalKey(Text),
+};
+const TaskCreated = Schema.Struct({
+    task: Schema.Struct({ id: Text, title: Text, status: Text, requiredAssignmentsPerRow: Count, versionId: Text, versionNum: Count }),
+    assignmentsCreated: Count,
+    assignmentShortfall: Schema.optionalKey(Count),
+    warning: Schema.optionalKey(Text),
+});
+/** Running it again makes a second task (and, with --publish, emails labellers again). */
+export const taskCreate = (body, describeError) => ({
+    label: 'create task', name: 'Task create', path: '/api/cli/tasks', method: 'POST', body, reply: TaskCreated, describeError,
+    mayAlreadyBeSaved: note('task', 'created', 'check `orizu tasks list` before creating it again (running it again makes a second task)'),
+});
+const Nullable = (schema) => Schema.optionalKey(Schema.NullOr(schema));
+const TaskUpdated = Schema.Struct({
+    task: Schema.Struct({
+        id: Text, title: Nullable(Text), status: Nullable(Text), dataset_id: Nullable(Text), app_id: Nullable(Text),
+        version_id: Nullable(Text), required_assignments_per_row: Nullable(Count),
+    }),
+    assignmentMode: Schema.optionalKey(Text),
+    assignmentsCreated: Schema.optionalKey(Count),
+});
+/** Sets the same values again, so a repeat is safe. */
+export const taskUpdate = (id, body) => ({
+    label: 'update task', name: 'Task update', path: task(id), method: 'PATCH', body, reply: TaskUpdated, mayAlreadyBeSaved: note('task change', 'saved', SAFE),
+});
+const Discarded = Schema.Struct({ success: Schema.Boolean });
+/** Once the draft is gone, a repeat is refused as "not found". */
+export const taskDiscard = (id) => ({
+    label: 'discard draft task', name: 'Draft discard', path: task(id), method: 'DELETE', reply: Discarded,
+    mayAlreadyBeSaved: note('draft', 'discarded', 'check `orizu tasks list`; once it is gone, running it again answers "Task not found or access denied"'),
+});
+const Published = Schema.Struct({ task: Schema.Struct({ id: Text, status: Text }), ...Assignments, assignmentsProcessed: Count });
+/** Once published, a repeat is refused as "must be a draft". */
+export const taskPublish = (id, body) => ({
+    label: 'publish task', name: 'Task publish', path: `${task(id)}/publish`, method: 'POST', body, reply: Published,
+    mayAlreadyBeSaved: note('task', 'published', `check \`orizu tasks status --task ${id}\`; once published, running it again answers "Task must be a draft before publishing"`),
+});
+const Assigned = Schema.Struct(Assignments);
+/** Adds only missing pairs and emails only new people, so a repeat is safe. */
+export const taskAssign = (id, body) => ({
+    label: 'assign task', name: 'Task assign', path: `${task(id)}/assign`, method: 'POST', body, reply: Assigned, mayAlreadyBeSaved: note('assignments', 'saved', SAFE),
+});
+const StatusChanged = Schema.Struct({ task: Schema.Struct({ id: Text, status: Text }) });
+/** Setting the status a task already has changes nothing. */
+export const taskStatus = (id, verb, status) => ({
+    label: `${verb} task`, name: `Task ${verb}`, path: `${task(id)}/status`, method: 'PATCH', body: { status }, reply: StatusChanged,
+    mayAlreadyBeSaved: note('task status change', 'saved', SAFE),
+});
+const RunStarted = Schema.Struct({
+    optimization_run_id: Text,
+    optimizationRun: Schema.Struct({ id: Text, status: Text, startedAt: Nullable(Text), createdAt: Nullable(Text) }),
+});
+/** The server picks a new run id per request, so running it again starts a second run. */
+export const optimizationStart = (project, body) => ({
+    label: 'start optimization run', name: 'Optimization run start', path: `/api/cli/optimization-runs?project=${encodeURIComponent(project)}`, method: 'POST', body, reply: RunStarted,
+    mayAlreadyBeSaved: note('run', 'started', 'check `orizu optimizations list` before starting again (running it again starts a second run)'),
+});
+const RunChanged = Schema.Struct({
+    optimizationRun: Schema.Struct({
+        id: Text, status: Schema.optionalKey(Text), startedAt: Nullable(Text), finishedAt: Nullable(Text), bestScore: Nullable(Count),
+        bestCandidateId: Nullable(Text), resultPromptVersionId: Nullable(Text), metadata: Schema.optionalKey(Schema.Record(Text, Schema.Unknown)),
+    }),
+    cancellationStatus: Schema.optionalKey(Schema.Literal('already_terminal')),
+});
+/** Writing the status a run already has again converges, so a repeat is safe. */
+export const optimizationLifecycle = (runId, body) => ({
+    label: 'update optimization run', name: 'Optimization run update', path: `/api/cli/optimization-runs/${encodeURIComponent(runId)}`, method: 'PATCH', body, reply: RunChanged,
+    mayAlreadyBeSaved: note('run status change', 'saved', SAFE),
+});
+const EventLogged = Schema.Struct({ eventId: Text });
+/** A repeat with the same event id changes nothing; a new id is refused as a sequence clash. */
+export const optimizationEvent = (runId, body) => ({
+    label: 'log event', name: 'Event log', path: `/api/cli/optimization-runs/${encodeURIComponent(runId)}/events`, method: 'POST', body, reply: EventLogged,
+    mayAlreadyBeSaved: note('event', 'logged', `run the same command again with \`--event-id ${body.eventId}\` (a new id would be refused as a clash)`),
+});
+const Linked = Schema.Struct({ app: Schema.Struct({ id: Text, name: Text }), linkedDataset: Schema.Struct({ id: Text, name: Text }), versionNum: Count });
+/**
+ * A plain overwrite, so a repeat is safe; without --version it links the
+ * app's current version at the time, which may have moved on.
+ */
+export const appLinkDataset = (appId, body) => ({
+    label: 'link dataset', name: 'Dataset link', path: `/api/cli/apps/${encodeURIComponent(appId)}/link-dataset`, method: 'POST', body, reply: Linked,
+    mayAlreadyBeSaved: note('link', 'saved', body.versionNum === undefined ? 'running it again with `--version <n>` for the version you meant is safe' : SAFE),
+});
+const Accepted = Schema.Struct({
+    scoreRun: Schema.Struct({ id: Text, provenance: Text, acceptedByUserId: Schema.NullOr(Text), acceptedAt: Schema.NullOr(Text), alreadyAccepted: Schema.Boolean }),
+});
+/** The first acceptance is kept and a repeat says "already accepted". */
+export const scoreAccept = (project, scoreRunId) => ({
+    label: 'accept score run', name: 'Score run accept', path: `/api/cli/scores/accept?project=${encodeURIComponent(project)}`, method: 'POST', body: { scoreRunId }, reply: Accepted,
+    mayAlreadyBeSaved: note('acceptance', 'saved', SAFE),
+});
+const ManifestRejected = Schema.Struct({ manifest: Schema.Record(Text, Schema.Unknown) });
+/** Once rejected, a repeat is refused, so the advice is to look first. */
+export const manifestReject = (id) => ({
+    label: 'reject manifest', name: 'Manifest reject', path: `/api/cli/promotion-manifests/${encodeURIComponent(id)}`, method: 'POST', body: { action: 'reject' }, reply: ManifestRejected,
+    mayAlreadyBeSaved: note('manifest', 'rejected', `check \`orizu manifests show ${id}\``),
+});
+/** Sends a write with this command's `--json` setting and output. Ctrl-C sets the exit code and returns null. */
+export async function sendCommandWrite(write, io) {
+    const outcome = await sendOneRequestWrite({ ...write, ...io });
+    if (outcome.kind === 'saved')
+        return outcome.reply;
+    process.exitCode = outcome.exitCode;
+    return null;
+}

package/dist/egress-allowlist-cli.d.ts

@@ -9,15 +9,42 @@
  * The BASE allowlist (Orizu API + model provider + git host) is code-owned and
  * NOT shown/managed here — this surface only widens a team's egress with domains
  * a customer workflow needs. Human ADMIN only: the server rejects agent bearers
- * and non-admins (the definer RPC gates on is_team_admin). Pure command logic
- * with an injected fetcher.
+ * and non-admins (the definer RPC gates on is_team_admin). The arguments and
+ * output live here; the requests run on Effect in egress-allowlist-workflow.ts
+ * (ORI-2764), loaded only when this command runs.
  */
 export type CliFetcher = (path: string, init?: RequestInit) => Promise<Response>;
 export interface EgressAllowlistCommandIo {
     json: boolean;
     print: (line: string) => void;
     printErr?: (line: string) => void;
+    /** Stands in for `authedFetch` in tests. */
     fetcher?: CliFetcher;
 }
+export declare function splitDomains(value: string): string[];
+export interface CurrentAllowlist {
+    domains: string[];
+    /** ALI-1174: legacy entries the server flags as failing the tightened
+     *  validator — stored, shown by GET, but silently dropped by the
+     *  coordinator at policy compose. Surfaced so "configured" never silently
+     *  means "inert". */
+    invalid: string[];
+    /** Valid entries beyond the 100-domain cap — equally inert at compose. */
+    capped: string[];
+}
+export declare function stringArray(value: unknown): string[];
+/**
+ * Re-derive the "beyond the 100-domain cap" entries from a stored set the
+ * SAME way the GET route does (positional over UNIQUE VALID domains): the
+ * coordinator applies only the first MAX_ADDITIVE_EGRESS_DOMAINS valid
+ * domains, so every valid entry past that index is configured-but-inert.
+ * Stored entries are already canonical + deduped by the write RPC, and the
+ * invalid (grandfathered) ones — flagged by the server — are not "valid"
+ * and so never consume a cap slot. Used for the PUT response, where a
+ * shrink-by-one on an oversized legacy row leaves the returned set still
+ * over-cap and the server does not send cappedDomains back.
+ */
+export declare function deriveCapped(stored: readonly string[], invalid: readonly string[]): string[];
+export declare function emit(io: EgressAllowlistCommandIo, teamSlug: string, current: CurrentAllowlist): void;
 export declare function egressAllowlistCommand(args: string[], io: EgressAllowlistCommandIo): Promise<number>;
 //# sourceMappingURL=egress-allowlist-cli.d.ts.map

package/dist/egress-allowlist-cli.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"egress-allowlist-cli.d.ts","sourceRoot":"","sources":["../src/egress-allowlist-cli.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAWH,MAAM,MAAM,UAAU,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,WAAW,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAA;AAEhF,MAAM,WAAW,wBAAwB;IACvC,IAAI,EAAE,OAAO,CAAA;IACb,KAAK,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAA;IAC7B,QAAQ,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAA;IACjC,OAAO,CAAC,EAAE,UAAU,CAAA;CACrB;AAiID,wBAAsB,sBAAsB,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,wBAAwB,GAAG,OAAO,CAAC,MAAM,CAAC,CA4D1G"}
+{"version":3,"file":"egress-allowlist-cli.d.ts","sourceRoot":"","sources":["../src/egress-allowlist-cli.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AASH,MAAM,MAAM,UAAU,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,WAAW,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAA;AAEhF,MAAM,WAAW,wBAAwB;IACvC,IAAI,EAAE,OAAO,CAAA;IACb,KAAK,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAA;IAC7B,QAAQ,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAA;IACjC,4CAA4C;IAC5C,OAAO,CAAC,EAAE,UAAU,CAAA;CACrB;AA0BD,wBAAgB,YAAY,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,EAAE,CAKpD;AAED,MAAM,WAAW,gBAAgB;IAC/B,OAAO,EAAE,MAAM,EAAE,CAAA;IACjB;;;yBAGqB;IACrB,OAAO,EAAE,MAAM,EAAE,CAAA;IACjB,0EAA0E;IAC1E,MAAM,EAAE,MAAM,EAAE,CAAA;CACjB;AAED,wBAAgB,WAAW,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,EAAE,CAEpD;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,YAAY,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,EAAE,OAAO,EAAE,SAAS,MAAM,EAAE,GAAG,MAAM,EAAE,CAU5F;AAED,wBAAgB,IAAI,CAAC,EAAE,EAAE,wBAAwB,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,gBAAgB,GAAG,IAAI,CA6BpG;AAED,wBAAsB,sBAAsB,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,wBAAwB,GAAG,OAAO,CAAC,MAAM,CAAC,CAe1G"}