@ductape/cli 0.2.23 → 0.3.1

package/dist/commands/migration-verification.js

@@ -0,0 +1,194 @@
+import crypto from 'node:crypto';
+import fs from 'node:fs';
+import path from 'node:path';
+import { printJson } from '../lib/output.js';
+import { readMigrationJson } from '../lib/migration-artifact.js';
+const REQUIRED = {
+    large_codebase: [
+        'dependency_ordered_partitions', 'token_byte_estimates', 'scc_preserving_split',
+        'cited_service_summaries', 'transitive_summary_invalidation', 'resumable_checkpoints',
+        'multiple_repositories', 'cross_repository_contracts',
+    ],
+    parity: [
+        'category_schemas', 'before_after_normalized', 'nondeterminism_tolerances',
+        'test_strength', 'mutation_signal', 'safe_shadow_dual_run', 'residual_uncertainty_decision',
+    ],
+    frontend: [
+        'angular_svelte_integration', 'browser_automation', 'accessibility_thresholds',
+        'visual_baseline_approval', 'web_vitals_bundle_size', 'browser_version_matrix',
+        'offline_background_reconnect', 'browser_ssr_security', 'native_mobile',
+    ],
+    database_baseline: [
+        'relational_fields', 'indexes_constraints', 'views_triggers_procedures',
+        'mongodb_documents', 'security_roles_encryption_audit', 'tenancy_partition_sharding',
+        'timezone_collation_encoding_precision', 'query_plan_performance', 'multiple_database_order',
+    ],
+    database_data: [
+        'deterministic_selection_order', 'backfill_throttling', 'retry_poison_records',
+        'idempotency_keys', 'transformation_versioning', 'quality_thresholds',
+        'pii_least_privilege', 'large_binary_objects', 'cdc_outbox_coordination',
+        'pause_resume_abort_drills', 'resumable_execution_evidence',
+    ],
+    database_cutover: [
+        'old_new_schema_compatibility', 'dual_write_conflict_resolution',
+        'migration_lock_concurrency', 'backup_identity_encryption_retention',
+        'restore_rehearsal', 'irreversible_approval', 'monitoring_observation_thresholds',
+        'post_cutover_reconciliation', 'slice_portfolio_link', 'event_feature_cdc_order',
+        'sandbox_readonly_authorization',
+    ],
+    assets: [
+        'component_designs', 'live_inventory_reconciliation', 'environment_configuration_gaps',
+        'provider_capability_matrix', 'payload_sdk_schema_validation', 'asset_dependency_order',
+    ],
+    third_party: ['client_family_context_review', 'app_action_design_templates'],
+};
+function read(file) {
+    return readMigrationJson(file);
+}
+function digest(file) {
+    return crypto.createHash('sha256').update(fs.readFileSync(file)).digest('hex');
+}
+function text(value) {
+    return typeof value === 'string' && value.trim().length > 0;
+}
+function recordComplete(record) {
+    const errors = [];
+    if (record.status !== 'passed')
+        errors.push('status must be passed');
+    if (!record.evidence?.length || !record.evidence.every(text))
+        errors.push('evidence is required');
+    if (!record.tests?.length || !record.tests.every(text))
+        errors.push('tests are required');
+    if (!record.sources?.length)
+        errors.push('source citations are required');
+    if (!record.automation || !text(record.automation.tool) || !text(record.automation.command) ||
+        !text(record.automation.result) || !text(record.automation.environment)) {
+        errors.push('automation tool, command, result, and environment are required');
+    }
+    if (!record.details || typeof record.details !== 'object' || Array.isArray(record.details) ||
+        Object.keys(record.details).length === 0) {
+        errors.push('structured details are required');
+    }
+    return errors;
+}
+function validateSpecial(record) {
+    const errors = [];
+    const details = record.details;
+    if (record.requirement === 'before_after_normalized') {
+        for (const field of ['before', 'after', 'normalization', 'comparison']) {
+            if (!text(details[field]))
+                errors.push(`details.${field} is required`);
+        }
+    }
+    if (record.requirement === 'nondeterminism_tolerances') {
+        if (!Array.isArray(details.fields) || !details.fields.length || !text(details.approved_differences)) {
+            errors.push('nondeterministic fields and approved differences are required');
+        }
+    }
+    if (record.requirement === 'dependency_ordered_partitions' ||
+        record.requirement === 'asset_dependency_order' ||
+        record.requirement === 'multiple_database_order' ||
+        record.requirement === 'event_feature_cdc_order') {
+        if (!Array.isArray(details.nodes) || !details.nodes.length ||
+            !Array.isArray(details.edges) || !Array.isArray(details.order) || !details.order.length) {
+            errors.push('dependency nodes, edges, and order are required');
+        }
+    }
+    if (record.requirement === 'token_byte_estimates') {
+        if (!Number.isFinite(details.max_tokens) || Number(details.max_tokens) <= 0 ||
+            !Number.isFinite(details.max_bytes) || Number(details.max_bytes) <= 0) {
+            errors.push('positive token and byte limits are required');
+        }
+    }
+    if (record.requirement === 'cited_service_summaries' && record.sources.length < 2) {
+        errors.push('service summaries require at least two cited source ranges');
+    }
+    if (record.requirement === 'irreversible_approval' ||
+        record.requirement === 'visual_baseline_approval' ||
+        record.requirement === 'residual_uncertainty_decision') {
+        if (!record.approval || !text(record.approval.actor) ||
+            !text(record.approval.authority) || !text(record.approval.evidence)) {
+            errors.push('trusted approval evidence is required');
+        }
+    }
+    return errors;
+}
+export function validateMigrationVerification(file) {
+    const resolved = path.resolve(file);
+    const matrix = read(resolved);
+    if (matrix.artifact_kind !== 'ductape_migration_verification_matrix' || matrix.version !== 1) {
+        throw new Error('Unsupported migration verification matrix.');
+    }
+    const blockers = [];
+    const invalid = new Set();
+    const recordsById = new Map();
+    for (const [category, requirements] of Object.entries(REQUIRED)) {
+        const records = matrix.categories?.[category];
+        if (!Array.isArray(records)) {
+            blockers.push(`${category}: category is missing`);
+            continue;
+        }
+        const byRequirement = new Map(records.map((record) => [record.requirement, record]));
+        for (const requirement of requirements) {
+            const record = byRequirement.get(requirement);
+            if (!record) {
+                blockers.push(`${category}.${requirement}: verification record is missing`);
+                continue;
+            }
+            const recordId = `${category}.${requirement}`;
+            recordsById.set(recordId, record);
+            for (const error of [...recordComplete(record), ...validateSpecial(record)]) {
+                blockers.push(`${category}.${requirement}: ${error}`);
+                invalid.add(recordId);
+            }
+            for (const [index, source] of (record.sources ?? []).entries()) {
+                if (!path.isAbsolute(source.repository) || path.isAbsolute(source.file) ||
+                    !Number.isInteger(source.start_line) || !Number.isInteger(source.end_line) ||
+                    source.start_line < 1 || source.end_line < source.start_line ||
+                    !/^[a-f0-9]{64}$/.test(source.checksum)) {
+                    blockers.push(`${category}.${requirement}.sources[${index}]: invalid citation`);
+                    continue;
+                }
+                const sourceFile = path.resolve(source.repository, source.file);
+                if (!fs.existsSync(sourceFile) || digest(sourceFile) !== source.checksum) {
+                    blockers.push(`${category}.${requirement}.sources[${index}]: source is stale or missing`);
+                    invalid.add(recordId);
+                }
+            }
+        }
+        const duplicates = records.map((record) => record.requirement)
+            .filter((requirement, index, all) => all.indexOf(requirement) !== index);
+        if (duplicates.length)
+            blockers.push(`${category}: duplicate requirements: ${[...new Set(duplicates)].join(', ')}`);
+    }
+    let expanded = true;
+    while (expanded) {
+        expanded = false;
+        for (const [recordId, record] of recordsById) {
+            if (invalid.has(recordId))
+                continue;
+            const dependencies = Array.isArray(record.details?.depends_on)
+                ? record.details.depends_on.filter((value) => typeof value === 'string')
+                : [];
+            if (dependencies.some((dependency) => invalid.has(dependency))) {
+                invalid.add(recordId);
+                blockers.push(`${recordId}: invalidated by stale dependency`);
+                expanded = true;
+            }
+        }
+    }
+    return {
+        file: resolved,
+        ready: blockers.length === 0,
+        categories: Object.keys(REQUIRED).length,
+        requirements: Object.values(REQUIRED).flat().length,
+        blockers,
+    };
+}
+export function runMigrationVerificationValidate(opts) {
+    const result = validateMigrationVerification(opts.file);
+    printJson(result, Boolean(opts.json));
+    if (opts.strict && !result.ready) {
+        throw new Error('Migration verification matrix is not ready: resolve every reported blocker.');
+    }
+}

package/dist/commands/products.d.ts

@@ -22,5 +22,6 @@ export declare function runProductEnvironments(verb: string, opts: {
     product?: string;
     tag?: string;
     slug?: string;
+    file?: string;
     json?: boolean;
 }, extraArgs: string[]): Promise<void>;

package/dist/commands/products.js

@@ -160,7 +160,7 @@ export async function runProductComponents(verb, opts) {
 }
 export async function runProductEnvironments(verb, opts, extraArgs) {
     const v = verb.toLowerCase();
-    const allowed = ['list', 'get', 'fetch'];
+    const allowed = ['list', 'get', 'fetch', 'create', 'update'];
     if (!allowed.includes(v)) {
         throw new Error(`Unknown environments verb "${verb}". Use: ${allowed.join(', ')}`);
     }
@@ -174,6 +174,38 @@ export async function runProductEnvironments(verb, opts, extraArgs) {
         printJson(result, Boolean(opts.json));
         return;
     }
+    if (v === 'create' || v === 'update') {
+        if (!opts.file)
+            throw new Error(`${v} requires --file <environment.json>`);
+        const body = JSON.parse((await import('node:fs')).readFileSync(opts.file, 'utf8'));
+        if (v === 'create') {
+            for (const field of ['env_name', 'description', 'slug']) {
+                if (typeof body[field] !== 'string' || !body[field].trim()) {
+                    throw new Error(`Environment create requires non-empty ${field}.`);
+                }
+            }
+            const existing = await proxy.execute('product', 'environments.fetch', [productTag, body.slug]);
+            if (existing) {
+                printJson({ product: productTag, slug: body.slug, created: false, existing }, Boolean(opts.json));
+                return;
+            }
+            await proxy.execute('product', 'environments.create', [productTag, body]);
+            const verified = await proxy.execute('product', 'environments.fetch', [productTag, body.slug]);
+            if (!verified)
+                throw new Error(`Environment "${body.slug}" was not found after creation.`);
+            printJson({ product: productTag, slug: body.slug, created: true, environment: verified }, Boolean(opts.json));
+            return;
+        }
+        const updateSlug = opts.slug ?? opts.tag ?? extraArgs[1];
+        if (!updateSlug)
+            throw new Error('Environment update requires --slug <slug>.');
+        await proxy.execute('product', 'environments.update', [productTag, updateSlug, body]);
+        const verified = await proxy.execute('product', 'environments.fetch', [productTag, body.slug ?? updateSlug]);
+        if (!verified)
+            throw new Error(`Environment "${updateSlug}" was not found after update.`);
+        printJson({ product: productTag, slug: body.slug ?? updateSlug, updated: true, environment: verified }, Boolean(opts.json));
+        return;
+    }
     const slug = opts.slug ?? opts.tag ?? extraArgs[1] ?? extraArgs[0];
     if (!slug)
         throw new Error('Provide the environment slug as the second argument or --slug <slug>');

package/dist/commands/secrets.d.ts

@@ -4,3 +4,11 @@ export declare function runSecrets(verb: string, opts: {
     file?: string;
     json?: boolean;
 } & CommandInteractiveFlags): Promise<void>;
+export declare function runSecretImportEnv(opts: {
+    envFile: string;
+    sourceKey: string;
+    key?: string;
+    env?: string;
+    description?: string;
+    json?: boolean;
+}): Promise<void>;

package/dist/commands/secrets.js

@@ -4,6 +4,8 @@ import { bodyRequiredHint, resolveBody } from '../lib/read-body.js';
 import { buildCrudParams, proxyMethodForVerb } from '../lib/resources.js';
 import { getSdkProxy, requireSession } from '../lib/proxy/context.js';
 import { printJson } from '../lib/output.js';
+import fs from 'node:fs';
+import path from 'node:path';
 const VERBS = ['create', 'list', 'get', 'update', 'delete'];
 export async function runSecrets(verb, opts) {
     const crud = verb.toLowerCase();
@@ -36,3 +38,45 @@ export async function runSecrets(verb, opts) {
     const result = await getSdkProxy(session).execute('secrets', method, params);
     printJson(result, Boolean(opts.json));
 }
+function readEnvValue(file, sourceKey) {
+    const resolved = path.resolve(file);
+    const line = fs.readFileSync(resolved, 'utf8')
+        .split(/\r?\n/)
+        .find((candidate) => new RegExp(`^\\s*(?:export\\s+)?${sourceKey.replace(/[.*+?^${}()|[\]\\]/g, '\\$&')}\\s*=`).test(candidate));
+    if (!line)
+        throw new Error(`Environment key "${sourceKey}" was not found in ${resolved}`);
+    let value = line.slice(line.indexOf('=') + 1).trim();
+    if ((value.startsWith('"') && value.endsWith('"')) ||
+        (value.startsWith("'") && value.endsWith("'")))
+        value = value.slice(1, -1);
+    if (!value)
+        throw new Error(`Environment key "${sourceKey}" is empty in ${resolved}`);
+    return value.replace(/\\n/g, '\n');
+}
+function redactSecretResult(value) {
+    if (Array.isArray(value))
+        return value.map(redactSecretResult);
+    if (!value || typeof value !== 'object')
+        return value;
+    const output = {};
+    for (const [key, entry] of Object.entries(value)) {
+        output[key] = /^(?:value|encrypted_value|private_key)$/i.test(key)
+            ? '[REDACTED]'
+            : redactSecretResult(entry);
+    }
+    return output;
+}
+export async function runSecretImportEnv(opts) {
+    const session = requireSession();
+    const key = opts.key ?? opts.sourceKey;
+    const value = readEnvValue(opts.envFile, opts.sourceKey);
+    const body = {
+        key,
+        value,
+        description: opts.description ?? `Imported locally from ${path.basename(opts.envFile)}:${opts.sourceKey}`,
+        ...(opts.env ? { envs: [opts.env] } : {}),
+    };
+    const params = buildCrudParams('secrets', 'create', session.project.product_tag, { tag: key, body });
+    const result = await getSdkProxy(session).execute('secrets', 'create', params);
+    printJson(redactSecretResult(result), Boolean(opts.json));
+}