@glubean/cli 0.2.6 → 0.3.0

package/dist/lib/config.js

@@ -12,11 +12,733 @@
  * Files named "package.json" are special-cased: only the "glubean" field
  * is extracted. All other files are treated as plain glubean config JSON.
  */
-import { resolve, extname } from "node:path";
+import { resolve } from "node:path";
 import { readFile } from "node:fs/promises";
 import { parse as parseYaml } from "yaml";
 import { DEFAULT_CONFIG } from "@glubean/redaction";
 import { LOCAL_RUN_DEFAULTS } from "@glubean/runner";
+// ─────────────────────────────────────────────────────────────────────────────
+// V1 LOADER (Phase 1 sub-task C — loadProjectConfigV1 with hard-error
+// validation). Resolve + runtime wiring arrive in sub-tasks D and E.
+// ─────────────────────────────────────────────────────────────────────────────
+/** Thrown by loadProjectConfigV1 — all hard validation failures use this. */
+export class GlubeanConfigError extends Error {
+    path;
+    constructor(message, path) {
+        super(path ? `${message}\n  in: ${path}` : message);
+        this.path = path;
+        this.name = "GlubeanConfigError";
+    }
+}
+const V1_TOP_KEYS = new Set(["version", "defaults", "suites", "profiles", "mcp"]);
+const V1_MCP_KEYS = new Set(["trace"]);
+const V1_MCP_TRACE_KEYS = new Set(["keepRequestHeaders", "keepResponseHeaders"]);
+const V1_SUITE_KEYS = new Set(["target", "kinds", "data"]);
+const V1_SUITE_KINDS = new Set(["test", "contract", "flow"]);
+const V1_SELECTION_KEYS = new Set([
+    "tags",
+    "excludeTags",
+    "filter",
+    "pick",
+    "tagMode",
+]);
+const V1_EXECUTION_KEYS = new Set([
+    "failFast",
+    "failAfter",
+    "timeoutMs",
+    "concurrency",
+    "noSession",
+]);
+const V1_CAPABILITIES_KEYS = new Set(["browser", "outOfBand", "optIn"]);
+const V1_REPORTERS_KEYS = new Set([
+    "console",
+    "junit",
+    "resultJson",
+    "emitFullTrace",
+    "inferSchema",
+    "truncateArrays",
+]);
+const V1_UPLOAD_KEYS = new Set(["enabled", "projectAlias"]);
+const V1_DEFAULTS_KEYS = new Set([
+    "envFile",
+    "selection",
+    "execution",
+    "capabilities",
+    "reporters",
+    "redaction",
+    "thresholds",
+]);
+const V1_PROFILE_KEYS = new Set([
+    "suites",
+    "selection",
+    "execution",
+    "capabilities",
+    "reporters",
+    "upload",
+    "thresholds",
+]);
+const V1_THRESHOLD_AGGREGATIONS = new Set([
+    "avg",
+    "min",
+    "max",
+    "p50",
+    "p90",
+    "p95",
+    "p99",
+    "count",
+]);
+const V1_REDACTION_KEYS = new Set([
+    "sensitiveKeys",
+    "customPatterns",
+    "replacementFormat",
+]);
+function assertOnlyKnownKeys(obj, known, context, configPath) {
+    if (!obj || typeof obj !== "object" || Array.isArray(obj))
+        return;
+    const unknown = Object.keys(obj).filter((k) => !known.has(k));
+    if (unknown.length > 0) {
+        throw new GlubeanConfigError(`Unknown key(s) at \`${context}\`: ${unknown.map((k) => `"${k}"`).join(", ")}. ` +
+            `Allowed keys: ${[...known].join(", ")}.`, configPath);
+    }
+}
+function assertType(value, expected, context, configPath) {
+    let ok = false;
+    if (expected === "array")
+        ok = Array.isArray(value);
+    else if (expected === "object")
+        ok = value !== null && typeof value === "object" && !Array.isArray(value);
+    else if (expected === "number") {
+        // YAML `.nan` / `.inf` / `-.inf` parse as JS numbers but are not usable
+        // for execution settings (NaN concurrency → no workers, etc). Reject.
+        ok = typeof value === "number" && Number.isFinite(value);
+    }
+    else
+        ok = typeof value === expected;
+    if (!ok) {
+        let got;
+        if (value === null)
+            got = "null";
+        else if (Array.isArray(value))
+            got = "array";
+        else if (typeof value === "number" && !Number.isFinite(value)) {
+            got = Number.isNaN(value) ? "NaN" : value > 0 ? "Infinity" : "-Infinity";
+        }
+        else
+            got = typeof value;
+        throw new GlubeanConfigError(`Expected \`${context}\` to be ${expected}, got ${got}.`, configPath);
+    }
+}
+function validateSuite(name, raw, configPath) {
+    assertType(raw, "object", `suites.${name}`, configPath);
+    assertOnlyKnownKeys(raw, V1_SUITE_KEYS, `suites.${name}`, configPath);
+    const s = raw;
+    if (s.target === undefined) {
+        throw new GlubeanConfigError(`Missing required field \`suites.${name}.target\`.`, configPath);
+    }
+    assertType(s.target, "string", `suites.${name}.target`, configPath);
+    if (s.kinds === undefined) {
+        throw new GlubeanConfigError(`Missing required field \`suites.${name}.kinds\` ` +
+            `(any of: ${[...V1_SUITE_KINDS].join(", ")}).`, configPath);
+    }
+    assertType(s.kinds, "array", `suites.${name}.kinds`, configPath);
+    const kinds = s.kinds;
+    if (kinds.length === 0) {
+        throw new GlubeanConfigError(`\`suites.${name}.kinds\` cannot be empty.`, configPath);
+    }
+    for (const k of kinds) {
+        if (typeof k !== "string" || !V1_SUITE_KINDS.has(k)) {
+            throw new GlubeanConfigError(`Invalid kind ${JSON.stringify(k)} in \`suites.${name}.kinds\`. ` +
+                `Allowed: ${[...V1_SUITE_KINDS].join(", ")}.`, configPath);
+        }
+    }
+    if (s.data !== undefined) {
+        assertType(s.data, "string", `suites.${name}.data`, configPath);
+    }
+    return {
+        target: s.target,
+        kinds: kinds,
+        ...(s.data !== undefined && { data: s.data }),
+    };
+}
+function validateSelection(raw, context, configPath) {
+    if (raw === undefined)
+        return {};
+    assertType(raw, "object", context, configPath);
+    assertOnlyKnownKeys(raw, V1_SELECTION_KEYS, context, configPath);
+    const s = raw;
+    const out = {};
+    if (s.tags !== undefined) {
+        assertType(s.tags, "array", `${context}.tags`, configPath);
+        out.tags = s.tags.map((t) => {
+            if (typeof t !== "string") {
+                throw new GlubeanConfigError(`\`${context}.tags\` must be an array of strings.`, configPath);
+            }
+            return t;
+        });
+    }
+    if (s.excludeTags !== undefined) {
+        assertType(s.excludeTags, "array", `${context}.excludeTags`, configPath);
+        out.excludeTags = s.excludeTags.map((t) => {
+            if (typeof t !== "string") {
+                throw new GlubeanConfigError(`\`${context}.excludeTags\` must be an array of strings.`, configPath);
+            }
+            return t;
+        });
+    }
+    if (s.filter !== undefined) {
+        assertType(s.filter, "string", `${context}.filter`, configPath);
+        out.filter = s.filter;
+    }
+    if (s.pick !== undefined) {
+        assertType(s.pick, "string", `${context}.pick`, configPath);
+        out.pick = s.pick;
+    }
+    if (s.tagMode !== undefined) {
+        if (s.tagMode !== "or" && s.tagMode !== "and") {
+            throw new GlubeanConfigError(`\`${context}.tagMode\` must be "or" or "and", got ${JSON.stringify(s.tagMode)}.`, configPath);
+        }
+        out.tagMode = s.tagMode;
+    }
+    return out;
+}
+function assertPositiveInt(value, context, configPath) {
+    if (!Number.isInteger(value) || value <= 0) {
+        throw new GlubeanConfigError(`\`${context}\` must be a positive integer (≥ 1), got ${value}.`, configPath);
+    }
+}
+function validateExecution(raw, context, configPath) {
+    if (raw === undefined)
+        return {};
+    assertType(raw, "object", context, configPath);
+    assertOnlyKnownKeys(raw, V1_EXECUTION_KEYS, context, configPath);
+    const s = raw;
+    const out = {};
+    if (s.failFast !== undefined) {
+        assertType(s.failFast, "boolean", `${context}.failFast`, configPath);
+        out.failFast = s.failFast;
+    }
+    if (s.failAfter !== undefined && s.failAfter !== null) {
+        assertType(s.failAfter, "number", `${context}.failAfter`, configPath);
+        // Runner stops at `failedCount >= failureLimit`. 0/negative would
+        // make the profile run zero tests. Use `null` to disable the limit.
+        assertPositiveInt(s.failAfter, `${context}.failAfter`, configPath);
+        out.failAfter = s.failAfter;
+    }
+    else if (s.failAfter === null) {
+        out.failAfter = null;
+    }
+    if (s.timeoutMs !== undefined) {
+        assertType(s.timeoutMs, "number", `${context}.timeoutMs`, configPath);
+        assertPositiveInt(s.timeoutMs, `${context}.timeoutMs`, configPath);
+        out.timeoutMs = s.timeoutMs;
+    }
+    if (s.concurrency !== undefined) {
+        assertType(s.concurrency, "number", `${context}.concurrency`, configPath);
+        assertPositiveInt(s.concurrency, `${context}.concurrency`, configPath);
+        out.concurrency = s.concurrency;
+    }
+    if (s.noSession !== undefined) {
+        assertType(s.noSession, "boolean", `${context}.noSession`, configPath);
+        out.noSession = s.noSession;
+    }
+    return out;
+}
+function validateBoolMap(raw, known, context, configPath) {
+    if (raw === undefined)
+        return {};
+    assertType(raw, "object", context, configPath);
+    assertOnlyKnownKeys(raw, known, context, configPath);
+    const s = raw;
+    const out = {};
+    for (const k of Object.keys(s)) {
+        assertType(s[k], "boolean", `${context}.${k}`, configPath);
+        out[k] = s[k];
+    }
+    return out;
+}
+function validateReporters(raw, context, configPath) {
+    if (raw === undefined)
+        return {};
+    assertType(raw, "object", context, configPath);
+    assertOnlyKnownKeys(raw, V1_REPORTERS_KEYS, context, configPath);
+    const s = raw;
+    const out = {};
+    if (s.console !== undefined) {
+        if (s.console !== "detailed" && s.console !== "summary") {
+            throw new GlubeanConfigError(`\`${context}.console\` must be "detailed" or "summary", got ${JSON.stringify(s.console)}.`, configPath);
+        }
+        out.console = s.console;
+    }
+    if (s.junit !== undefined) {
+        assertType(s.junit, "string", `${context}.junit`, configPath);
+        out.junit = s.junit;
+    }
+    if (s.resultJson !== undefined) {
+        assertType(s.resultJson, "string", `${context}.resultJson`, configPath);
+        out.resultJson = s.resultJson;
+    }
+    if (s.emitFullTrace !== undefined) {
+        assertType(s.emitFullTrace, "boolean", `${context}.emitFullTrace`, configPath);
+        out.emitFullTrace = s.emitFullTrace;
+    }
+    if (s.inferSchema !== undefined) {
+        assertType(s.inferSchema, "boolean", `${context}.inferSchema`, configPath);
+        out.inferSchema = s.inferSchema;
+    }
+    if (s.truncateArrays !== undefined) {
+        assertType(s.truncateArrays, "boolean", `${context}.truncateArrays`, configPath);
+        out.truncateArrays = s.truncateArrays;
+    }
+    return out;
+}
+function validateUpload(raw, context, configPath) {
+    assertType(raw, "object", context, configPath);
+    assertOnlyKnownKeys(raw, V1_UPLOAD_KEYS, context, configPath);
+    const s = raw;
+    const out = {};
+    if (s.enabled !== undefined) {
+        assertType(s.enabled, "boolean", `${context}.enabled`, configPath);
+        out.enabled = s.enabled;
+    }
+    if (s.projectAlias !== undefined) {
+        assertType(s.projectAlias, "string", `${context}.projectAlias`, configPath);
+        out.projectAlias = s.projectAlias;
+    }
+    return out;
+}
+function validateRedaction(raw, context, configPath) {
+    if (raw === undefined)
+        return {};
+    assertType(raw, "object", context, configPath);
+    assertOnlyKnownKeys(raw, V1_REDACTION_KEYS, context, configPath);
+    const r = raw;
+    const out = {};
+    if (r.sensitiveKeys !== undefined) {
+        assertType(r.sensitiveKeys, "array", `${context}.sensitiveKeys`, configPath);
+        out.sensitiveKeys = r.sensitiveKeys.map((k, i) => {
+            if (typeof k !== "string") {
+                throw new GlubeanConfigError(`\`${context}.sensitiveKeys[${i}]\` must be a string, got ${typeof k}.`, configPath);
+            }
+            return k;
+        });
+    }
+    if (r.customPatterns !== undefined) {
+        assertType(r.customPatterns, "array", `${context}.customPatterns`, configPath);
+        out.customPatterns = r.customPatterns.map((p, i) => {
+            const ctx = `${context}.customPatterns[${i}]`;
+            assertType(p, "object", ctx, configPath);
+            assertOnlyKnownKeys(p, new Set(["name", "regex"]), ctx, configPath);
+            const obj = p;
+            if (typeof obj.name !== "string") {
+                throw new GlubeanConfigError(`\`${ctx}.name\` is required and must be a string.`, configPath);
+            }
+            if (typeof obj.regex !== "string") {
+                throw new GlubeanConfigError(`\`${ctx}.regex\` is required and must be a string.`, configPath);
+            }
+            // Compile regex eagerly so malformed patterns fail at load time.
+            try {
+                new RegExp(obj.regex);
+            }
+            catch (err) {
+                throw new GlubeanConfigError(`\`${ctx}.regex\` is not a valid regular expression: ${err.message}`, configPath);
+            }
+            return { name: obj.name, regex: obj.regex };
+        });
+    }
+    if (r.replacementFormat !== undefined) {
+        if (r.replacementFormat !== "simple" &&
+            r.replacementFormat !== "labeled" &&
+            r.replacementFormat !== "partial") {
+            throw new GlubeanConfigError(`\`${context}.replacementFormat\` must be "simple", "labeled", or "partial", got ${JSON.stringify(r.replacementFormat)}.`, configPath);
+        }
+        out.replacementFormat = r.replacementFormat;
+    }
+    return out;
+}
+function validateThresholds(raw, context, configPath) {
+    if (raw === undefined)
+        return {};
+    assertType(raw, "object", context, configPath);
+    const t = raw;
+    const out = {};
+    for (const metric of Object.keys(t)) {
+        const value = t[metric];
+        const ctx = `${context}.${metric}`;
+        // Shorthand: a bare string is the expression for the `avg` aggregation.
+        if (typeof value === "string") {
+            out[metric] = value;
+            continue;
+        }
+        // Otherwise: a map of aggregation → expression string.
+        assertType(value, "object", ctx, configPath);
+        assertOnlyKnownKeys(value, V1_THRESHOLD_AGGREGATIONS, ctx, configPath);
+        const rules = value;
+        const metricRules = {};
+        for (const agg of Object.keys(rules)) {
+            if (typeof rules[agg] !== "string") {
+                throw new GlubeanConfigError(`\`${ctx}.${agg}\` must be a threshold expression string (e.g. "<200"), got ${typeof rules[agg]}.`, configPath);
+            }
+            metricRules[agg] = rules[agg];
+        }
+        out[metric] = metricRules;
+    }
+    return out;
+}
+function validateProfile(name, raw, suiteNames, configPath) {
+    assertType(raw, "object", `profiles.${name}`, configPath);
+    assertOnlyKnownKeys(raw, V1_PROFILE_KEYS, `profiles.${name}`, configPath);
+    const p = raw;
+    if (p.suites === undefined) {
+        throw new GlubeanConfigError(`Missing required field \`profiles.${name}.suites\` (array of suite names).`, configPath);
+    }
+    assertType(p.suites, "array", `profiles.${name}.suites`, configPath);
+    const suites = p.suites.map((s) => {
+        if (typeof s !== "string") {
+            throw new GlubeanConfigError(`\`profiles.${name}.suites\` must be an array of suite-name strings.`, configPath);
+        }
+        if (!suiteNames.has(s)) {
+            throw new GlubeanConfigError(`\`profiles.${name}.suites\` references undefined suite "${s}". ` +
+                `Defined suites: ${[...suiteNames].join(", ") || "(none)"}.`, configPath);
+        }
+        return s;
+    });
+    return {
+        suites,
+        selection: validateSelection(p.selection, `profiles.${name}.selection`, configPath),
+        execution: validateExecution(p.execution, `profiles.${name}.execution`, configPath),
+        capabilities: validateBoolMap(p.capabilities, V1_CAPABILITIES_KEYS, `profiles.${name}.capabilities`, configPath),
+        reporters: validateReporters(p.reporters, `profiles.${name}.reporters`, configPath),
+        ...(p.upload !== undefined && {
+            upload: validateUpload(p.upload, `profiles.${name}.upload`, configPath),
+        }),
+        ...(p.thresholds !== undefined && {
+            thresholds: validateThresholds(p.thresholds, `profiles.${name}.thresholds`, configPath),
+        }),
+    };
+}
+function validateDefaults(raw, configPath) {
+    if (raw === undefined)
+        return {};
+    assertType(raw, "object", "defaults", configPath);
+    assertOnlyKnownKeys(raw, V1_DEFAULTS_KEYS, "defaults", configPath);
+    const d = raw;
+    const out = {};
+    if (d.envFile !== undefined) {
+        assertType(d.envFile, "string", "defaults.envFile", configPath);
+        out.envFile = d.envFile;
+    }
+    out.selection = validateSelection(d.selection, "defaults.selection", configPath);
+    out.execution = validateExecution(d.execution, "defaults.execution", configPath);
+    out.capabilities = validateBoolMap(d.capabilities, V1_CAPABILITIES_KEYS, "defaults.capabilities", configPath);
+    out.reporters = validateReporters(d.reporters, "defaults.reporters", configPath);
+    out.redaction = validateRedaction(d.redaction, "defaults.redaction", configPath);
+    if (d.thresholds !== undefined) {
+        out.thresholds = validateThresholds(d.thresholds, "defaults.thresholds", configPath);
+    }
+    return out;
+}
+function validateMcp(raw, configPath) {
+    if (raw === undefined)
+        return {};
+    assertType(raw, "object", "mcp", configPath);
+    assertOnlyKnownKeys(raw, V1_MCP_KEYS, "mcp", configPath);
+    const m = raw;
+    const out = {};
+    if (m.trace !== undefined) {
+        assertType(m.trace, "object", "mcp.trace", configPath);
+        assertOnlyKnownKeys(m.trace, V1_MCP_TRACE_KEYS, "mcp.trace", configPath);
+        const t = m.trace;
+        const trace = {};
+        for (const key of ["keepRequestHeaders", "keepResponseHeaders"]) {
+            if (t[key] !== undefined) {
+                assertType(t[key], "array", `mcp.trace.${key}`, configPath);
+                trace[key] = t[key].map((h, i) => {
+                    if (typeof h !== "string") {
+                        throw new GlubeanConfigError(`\`mcp.trace.${key}[${i}]\` must be a string, got ${typeof h}.`, configPath);
+                    }
+                    return h;
+                });
+            }
+        }
+        out.trace = trace;
+    }
+    return out;
+}
+/**
+ * Load + validate v1 project config.
+ *
+ * - Default path: `rootDir/glubean.yaml`
+ * - Override: `options.configPath` (CLI `--config` plumbed here) — resolved
+ *   against rootDir if relative. Lets users keep multiple variants on disk
+ *   while still using v1 schema.
+ *
+ * Hard-errors on:
+ * - File missing → `GlubeanConfigError("glubean.yaml not found ...")`
+ * - YAML parse failure → wraps underlying error in `GlubeanConfigError`
+ * - Missing/wrong `version` (must be `1`)
+ * - Any unknown key at any nesting level (drops the warning behavior of the
+ *   legacy loader)
+ * - Missing required fields (`suites`, `profiles`, `suite.target`, `suite.kinds`,
+ *   `profile.suites`)
+ * - Wrong type on any field
+ * - Profile that references an undefined suite name
+ *
+ * Returns the parsed + validated config plus the absolute path it loaded from
+ * (used downstream so `ResolvedRunPlan.configPath` can be populated in sub-task D).
+ */
+export async function loadProjectConfigV1(rootDir, options = {}) {
+    const configPath = options.configPath
+        ? resolve(rootDir, options.configPath)
+        : resolve(rootDir, "glubean.yaml");
+    let content;
+    try {
+        content = await readFile(configPath, "utf-8");
+    }
+    catch (err) {
+        const code = err.code;
+        if (code === "ENOENT") {
+            throw new GlubeanConfigError(`glubean.yaml not found at ${configPath}. ` +
+                `Run \`glubean init\` to create one, or pass \`--config <path>\` ` +
+                `to load from a different location.`);
+        }
+        throw new GlubeanConfigError(`Failed to read glubean.yaml: ${err.message}`, configPath);
+    }
+    let parsed;
+    try {
+        parsed = parseYaml(content);
+    }
+    catch (err) {
+        throw new GlubeanConfigError(`Failed to parse glubean.yaml: ${err.message}`, configPath);
+    }
+    if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
+        throw new GlubeanConfigError(`glubean.yaml must contain a top-level mapping (got ${parsed === null ? "null" : Array.isArray(parsed) ? "array" : typeof parsed}).`, configPath);
+    }
+    const root = parsed;
+    assertOnlyKnownKeys(root, V1_TOP_KEYS, "glubean.yaml", configPath);
+    if (root.version !== 1) {
+        throw new GlubeanConfigError(`\`version\` must be the integer \`1\` (got ${JSON.stringify(root.version)}). ` +
+            `Add \`version: 1\` to the top of glubean.yaml.`, configPath);
+    }
+    if (root.suites === undefined) {
+        throw new GlubeanConfigError(`Missing required top-level field \`suites\` (map of suite name → suite config).`, configPath);
+    }
+    assertType(root.suites, "object", "suites", configPath);
+    const suitesIn = root.suites;
+    const suites = {};
+    for (const name of Object.keys(suitesIn)) {
+        suites[name] = validateSuite(name, suitesIn[name], configPath);
+    }
+    if (root.profiles === undefined) {
+        throw new GlubeanConfigError(`Missing required top-level field \`profiles\` (map of profile name → profile config).`, configPath);
+    }
+    assertType(root.profiles, "object", "profiles", configPath);
+    const profilesIn = root.profiles;
+    const suiteNames = new Set(Object.keys(suites));
+    const profiles = {};
+    for (const name of Object.keys(profilesIn)) {
+        profiles[name] = validateProfile(name, profilesIn[name], suiteNames, configPath);
+    }
+    const config = {
+        version: 1,
+        defaults: validateDefaults(root.defaults, configPath),
+        suites,
+        profiles,
+        ...(root.mcp !== undefined && { mcp: validateMcp(root.mcp, configPath) }),
+    };
+    return { config, configPath };
+}
+/** Built-in defaults applied when neither config.defaults nor profile sets a value. */
+export const RESOLVED_PLAN_BUILTIN_DEFAULTS = {
+    envFile: ".env",
+    selection: {
+        tags: [],
+        excludeTags: [],
+        tagMode: "or",
+    },
+    execution: {
+        failFast: false,
+        failAfter: null,
+        timeoutMs: 30000,
+        concurrency: 4,
+        noSession: false,
+    },
+    capabilities: {
+        browser: false,
+        outOfBand: false,
+        optIn: false,
+    },
+    reporters: {
+        console: "detailed",
+        emitFullTrace: false,
+        inferSchema: false,
+        truncateArrays: false,
+    },
+};
+/**
+ * Resolve a profile against a loaded config + optional CLI overrides.
+ *
+ * Throws `GlubeanConfigError` when `profileName` is not in `config.profiles`
+ * (with a list of available profiles, per plan §Phase 1 acceptance).
+ *
+ * Merge order (later layer wins per-field; arrays REPLACE, never concat):
+ *   1. Built-in defaults (RESOLVED_PLAN_BUILTIN_DEFAULTS)
+ *   2. config.defaults (user's `defaults:` block)
+ *   3. config.profiles[profileName] (profile-specific)
+ *   4. cliOverrides (CLI flags)
+ *
+ * `suites` field on the profile is expanded: each name is looked up in
+ * `config.suites` (loader already validated cross-refs) and returned as a
+ * `{name, ...SuiteConfig}` array preserving the order from the profile.
+ */
+export function resolveRunPlan(config, configPath, profileName, cliOverrides = {}) {
+    const profile = config.profiles[profileName];
+    if (!profile) {
+        const available = Object.keys(config.profiles).sort();
+        throw new GlubeanConfigError(`Profile "${profileName}" not found. Available profiles: ${available.length > 0 ? available.join(", ") : "(none defined)"}.`, configPath);
+    }
+    const defaults = config.defaults ?? {};
+    const builtin = RESOLVED_PLAN_BUILTIN_DEFAULTS;
+    // Suites: expand profile.suites name list to full SuiteConfig+name objects.
+    // CLI `--suite <name>` (cliOverrides.suites) filters the profile's list
+    // to a subset. Each override name MUST appear in profile.suites — running
+    // a suite the profile didn't include would change the run semantics
+    // beyond a temporary override; the user is asked to either edit the
+    // profile or pick a different profile.
+    let effectiveSuiteNames = profile.suites;
+    if (cliOverrides.suites && cliOverrides.suites.length > 0) {
+        const profileSuiteSet = new Set(profile.suites);
+        const unknown = cliOverrides.suites.filter((n) => !profileSuiteSet.has(n));
+        if (unknown.length > 0) {
+            throw new GlubeanConfigError(`--suite ${unknown.join(", ")} not declared in profile "${profileName}". ` +
+                `Profile suites: ${profile.suites.join(", ") || "(none)"}.`, configPath);
+        }
+        // Preserve override order so user-given order controls execution sequence.
+        effectiveSuiteNames = cliOverrides.suites;
+    }
+    const suites = effectiveSuiteNames.map((name) => ({
+        name,
+        ...config.suites[name],
+    }));
+    // ── Selection ──────────────────────────────────────────────────────────
+    // Arrays (tags / excludeTags) REPLACE per layer, not concat.
+    const selection = {
+        tags: cliOverrides.tags ??
+            profile.selection?.tags ??
+            defaults.selection?.tags ??
+            builtin.selection.tags,
+        excludeTags: cliOverrides.excludeTags ??
+            profile.selection?.excludeTags ??
+            defaults.selection?.excludeTags ??
+            builtin.selection.excludeTags,
+        tagMode: cliOverrides.tagMode ??
+            profile.selection?.tagMode ??
+            defaults.selection?.tagMode ??
+            builtin.selection.tagMode,
+        filter: cliOverrides.filter ?? profile.selection?.filter ?? defaults.selection?.filter,
+        pick: cliOverrides.pick ?? profile.selection?.pick ?? defaults.selection?.pick,
+    };
+    // ── Execution ──────────────────────────────────────────────────────────
+    // failAfter: explicit `null` from any layer means "no limit" (preserved).
+    const execution = {
+        failFast: cliOverrides.failFast ??
+            profile.execution?.failFast ??
+            defaults.execution?.failFast ??
+            builtin.execution.failFast,
+        failAfter: cliOverrides.failAfter !== undefined
+            ? cliOverrides.failAfter
+            : profile.execution?.failAfter !== undefined
+                ? profile.execution.failAfter
+                : defaults.execution?.failAfter !== undefined
+                    ? defaults.execution.failAfter
+                    : builtin.execution.failAfter,
+        timeoutMs: cliOverrides.timeoutMs ??
+            profile.execution?.timeoutMs ??
+            defaults.execution?.timeoutMs ??
+            builtin.execution.timeoutMs,
+        concurrency: cliOverrides.concurrency ??
+            profile.execution?.concurrency ??
+            defaults.execution?.concurrency ??
+            builtin.execution.concurrency,
+        noSession: cliOverrides.noSession ??
+            profile.execution?.noSession ??
+            defaults.execution?.noSession ??
+            builtin.execution.noSession,
+    };
+    // ── Capabilities ───────────────────────────────────────────────────────
+    // CLI overrides use include* naming (--include-browser etc.) which maps
+    // 1:1 to the capability gates here. CLI flag presence means "include"
+    // (true); absence falls through to profile/defaults.
+    const capabilities = {
+        browser: cliOverrides.includeBrowser ??
+            profile.capabilities?.browser ??
+            defaults.capabilities?.browser ??
+            builtin.capabilities.browser,
+        outOfBand: cliOverrides.includeOutOfBand ??
+            profile.capabilities?.outOfBand ??
+            defaults.capabilities?.outOfBand ??
+            builtin.capabilities.outOfBand,
+        optIn: cliOverrides.includeOptIn ??
+            profile.capabilities?.optIn ??
+            defaults.capabilities?.optIn ??
+            builtin.capabilities.optIn,
+    };
+    // ── Reporters ──────────────────────────────────────────────────────────
+    // CLI overrides individual channels, not the whole reporters dict
+    // (codex catch from plan: --reporter detailed shouldn't drop a profile's
+    // junit/resultJson outputs).
+    const reporters = {
+        console: cliOverrides.consoleReporter ??
+            profile.reporters?.console ??
+            defaults.reporters?.console ??
+            builtin.reporters.console,
+        junit: cliOverrides.junit ?? profile.reporters?.junit ?? defaults.reporters?.junit,
+        resultJson: cliOverrides.resultJson ??
+            profile.reporters?.resultJson ??
+            defaults.reporters?.resultJson,
+        emitFullTrace: cliOverrides.emitFullTrace ??
+            profile.reporters?.emitFullTrace ??
+            defaults.reporters?.emitFullTrace ??
+            builtin.reporters.emitFullTrace,
+        inferSchema: cliOverrides.inferSchema ??
+            profile.reporters?.inferSchema ??
+            defaults.reporters?.inferSchema ??
+            builtin.reporters.inferSchema,
+        truncateArrays: cliOverrides.truncateArrays ??
+            profile.reporters?.truncateArrays ??
+            defaults.reporters?.truncateArrays ??
+            builtin.reporters.truncateArrays,
+    };
+    const envFile = cliOverrides.envFile ?? defaults.envFile ?? builtin.envFile;
+    const redaction = resolveRedactionConfig(defaults.redaction);
+    // ── Thresholds ─────────────────────────────────────────────────────────
+    // Shallow per-metric merge: profile overrides defaults on metric-key
+    // collision (a profile can tighten or replace a baseline metric's rules,
+    // but doesn't deep-merge individual aggregations).
+    const thresholds = {
+        ...(defaults.thresholds ?? {}),
+        ...(profile.thresholds ?? {}),
+    };
+    // ── Upload ─────────────────────────────────────────────────────────────
+    // CLI `--upload` flag forces enable regardless of profile. Profile-defined
+    // upload (with projectAlias) takes effect unless CLI overrides enabled.
+    let upload = profile.upload;
+    if (cliOverrides.uploadEnabled !== undefined) {
+        upload = { ...(upload ?? {}), enabled: cliOverrides.uploadEnabled };
+    }
+    return {
+        profile: profileName,
+        configPath,
+        suites,
+        selection,
+        execution,
+        capabilities,
+        reporters,
+        ...(upload !== undefined && { upload }),
+        envFile,
+        redaction,
+        thresholds,
+    };
+}
 // ── Defaults ─────────────────────────────────────────────────────────────────
 export const RUN_DEFAULTS = {
     verbose: false,
@@ -37,81 +759,12 @@ export const CONFIG_DEFAULTS = {
     run: { ...RUN_DEFAULTS },
     redaction: structuredClone(DEFAULT_CONFIG),
 };
-// ── Internal helpers ─────────────────────────────────────────────────────────
-/** Check if a filename should be treated as a package config file. */
-function isPackageConfig(filePath) {
-    const name = filePath.split("/").pop() ?? "";
-    return name === "package.json";
-}
-/**
- * Read a single config source from disk.
- *
- * If the file is a package.json, extract the "glubean" field.
- * Otherwise treat the entire file as a glubean config object.
- */
-export async function readSingleConfig(filePath) {
-    const content = await readFile(filePath, "utf-8");
-    const ext = extname(filePath).toLowerCase();
-    const parsed = (ext === ".yaml" || ext === ".yml")
-        ? parseYaml(content)
-        : JSON.parse(content);
-    if (isPackageConfig(filePath)) {
-        return parsed.glubean ?? {};
-    }
-    return parsed;
-}
-/**
- * Merge two config inputs. Later (overlay) values take precedence.
- *
- * - Scalar fields: right wins.
- * - Array fields (sensitiveKeys.additional, sensitiveKeys.excluded,
- *   patterns.custom): concatenated (additive by nature).
- */
-export function mergeConfigInputs(base, overlay) {
-    const merged = {};
-    // ── Run section (shallow merge, scalars override) ──────────────────────
-    if (base.run || overlay.run) {
-        merged.run = { ...base.run, ...overlay.run };
-    }
-    // ── Redaction section ──────────────────────────────────────────────────
-    if (base.redaction || overlay.redaction) {
-        const br = base.redaction ?? {};
-        const or = overlay.redaction ?? {};
-        merged.redaction = {};
-        if (or.replacementFormat !== undefined) {
-            merged.redaction.replacementFormat = or.replacementFormat;
-        }
-        else if (br.replacementFormat !== undefined) {
-            merged.redaction.replacementFormat = br.replacementFormat;
-        }
-        if (br.sensitiveKeys || or.sensitiveKeys) {
-            merged.redaction.sensitiveKeys = [
-                ...(br.sensitiveKeys ?? []),
-                ...(or.sensitiveKeys ?? []),
-            ];
-        }
-        if (br.customPatterns || or.customPatterns) {
-            merged.redaction.customPatterns = [
-                ...(br.customPatterns ?? []),
-                ...(or.customPatterns ?? []),
-            ];
-        }
-    }
-    // ── Cloud section (shallow merge, scalars override) ─────────────────────
-    if (base.cloud || overlay.cloud) {
-        merged.cloud = { ...base.cloud, ...overlay.cloud };
-    }
-    // ── Thresholds section (shallow merge, later rules win per metric key) ──
-    if (base.thresholds || overlay.thresholds) {
-        merged.thresholds = { ...base.thresholds, ...overlay.thresholds };
-    }
-    return merged;
-}
 /**
- * Apply a GlubeanConfigInput on top of the mandatory DEFAULT_CONFIG baseline
- * to produce a fully resolved RedactionConfig.
+ * Apply a `GlubeanRedactionConfigInput` (glubean.yaml `defaults.redaction`)
+ * on top of the mandatory DEFAULT_CONFIG baseline to produce a fully
+ * resolved RedactionConfig.
  */
-function resolveRedactionConfig(input) {
+export function resolveRedactionConfig(input) {
     const merged = structuredClone(DEFAULT_CONFIG);
     if (!input)
         return merged;
@@ -135,86 +788,13 @@ function resolveRedactionConfig(input) {
             }
         }
     }
-    if (input.replacementFormat === "labeled" ||
+    if (input.replacementFormat === "simple" ||
+        input.replacementFormat === "labeled" ||
         input.replacementFormat === "partial") {
         merged.replacementFormat = input.replacementFormat;
     }
     return merged;
 }
-// ── Validation ───────────────────────────────────────────────────────────────
-const KNOWN_TOP_KEYS = new Set(["run", "redaction", "cloud", "thresholds"]);
-const KNOWN_RUN_KEYS = new Set(Object.keys(RUN_DEFAULTS));
-const KNOWN_REDACTION_KEYS = new Set([
-    "sensitiveKeys",
-    "customPatterns",
-    "replacementFormat",
-]);
-const KNOWN_CLOUD_KEYS = new Set(["projectId", "apiUrl", "token"]);
-function warnUnknownKeys(obj, known, path) {
-    for (const key of Object.keys(obj)) {
-        if (!known.has(key)) {
-            console.error(`\x1b[33mWarning: unknown config key "${path}.${key}" — typo?\x1b[0m`);
-        }
-    }
-}
-function validateConfigInput(input) {
-    warnUnknownKeys(input, KNOWN_TOP_KEYS, "glubean");
-    if (input.run) {
-        warnUnknownKeys(input.run, KNOWN_RUN_KEYS, "glubean.run");
-    }
-    if (input.redaction) {
-        warnUnknownKeys(input.redaction, KNOWN_REDACTION_KEYS, "glubean.redaction");
-    }
-    if (input.cloud) {
-        warnUnknownKeys(input.cloud, KNOWN_CLOUD_KEYS, "glubean.cloud");
-    }
-}
-// ── Public API ───────────────────────────────────────────────────────────────
-/**
- * Load the resolved GlubeanConfig.
- *
- * - If `configPaths` is undefined or empty: auto-read package.json in `rootDir`.
- * - If `configPaths` has entries: merge left-to-right, skip auto-read.
- */
-export async function loadConfig(rootDir, configPaths) {
-    let accumulated = {};
-    if (configPaths && configPaths.length > 0) {
-        for (const configPath of configPaths) {
-            const absPath = resolve(rootDir, configPath);
-            try {
-                const single = await readSingleConfig(absPath);
-                validateConfigInput(single);
-                accumulated = mergeConfigInputs(accumulated, single);
-            }
-            catch {
-                console.error(`Warning: Could not read config file: ${absPath}`);
-            }
-        }
-    }
-    else {
-        // No --config: auto-read package.json in rootDir
-        const pkgPath = resolve(rootDir, "package.json");
-        try {
-            const single = await readSingleConfig(pkgPath);
-            validateConfigInput(single);
-            accumulated = mergeConfigInputs(accumulated, single);
-        }
-        catch {
-            // Not found, use defaults
-        }
-    }
-    const resolvedRun = {
-        ...RUN_DEFAULTS,
-        ...accumulated.run,
-    };
-    const resolvedRedaction = resolveRedactionConfig(accumulated.redaction);
-    return {
-        run: resolvedRun,
-        redaction: resolvedRedaction,
-        cloud: accumulated.cloud,
-        thresholds: accumulated.thresholds,
-    };
-}
 /**
  * Merge resolved run config with CLI flags.
  */
@@ -244,6 +824,21 @@ export function mergeRunOptions(config, cliFlags) {
     if (cliFlags.timeout !== undefined) {
         result.perTestTimeoutMs = Number(cliFlags.timeout);
     }
+    // Phase 1 sub-task E: profile-driven trace + execution fields. Without
+    // these, profile reporters.inferSchema / truncateArrays + execution.timeoutMs
+    // / concurrency would be silently ignored by the runner.
+    if (cliFlags.inferSchema !== undefined) {
+        result.inferSchema = !!cliFlags.inferSchema;
+    }
+    if (cliFlags.truncateArrays !== undefined) {
+        result.truncateArrays = !!cliFlags.truncateArrays;
+    }
+    if (cliFlags.timeoutMs !== undefined) {
+        result.perTestTimeoutMs = Number(cliFlags.timeoutMs);
+    }
+    if (cliFlags.concurrency !== undefined) {
+        result.concurrency = Number(cliFlags.concurrency);
+    }
     return result;
 }
 /**