@glubean/cli 0.4.0 → 0.7.0

package/dist/commands/run.js

@@ -7,6 +7,7 @@ import { loadProjectEnv } from "@glubean/runner";
 import { resolveEnvFileName } from "../lib/active_env.js";
 import { shouldSkipTest } from "../lib/skip.js";
 import { CLI_VERSION } from "../version.js";
+import { redactMetadataForUpload } from "../lib/redact-metadata.js";
 import { extractContractCases, extractFromSource } from "@glubean/scanner/static";
 import { extractContractFromFile, findTemplateMatch, loadProjectOverlays, matchesTemplateFilter, } from "@glubean/scanner";
 import { applyEnvTemplating } from "@glubean/runner";
@@ -49,28 +50,6 @@ async function findProjectConfig(startDir) {
     // No glubean project found — use the starting directory (scratch mode)
     return { rootDir: startDir };
 }
-/**
- * True if a flow's extracted step tree contains a branch (condition / switch).
- * Recurses into branch cases/default (a nested branch would itself be caught by
- * the top-level `kind === "branch"`, but recursing is cheap belt-and-suspenders).
- *
- * Used to gate `--upload`: Glubean Cloud cannot render `kind:"branch"` flows yet,
- * and uploading would silently drop the branches (local run view ≠ Cloud view),
- * so we refuse rather than mislead. See contract-flow-condition.md §12 / Spike 6.
- */
-function flowStepsHaveBranch(steps) {
-    if (!steps)
-        return false;
-    for (const s of steps) {
-        if (s.kind === "branch")
-            return true;
-        if (s.cases && s.cases.some((c) => flowStepsHaveBranch(c.steps)))
-            return true;
-        if (s.default && flowStepsHaveBranch(s.default))
-            return true;
-    }
-    return false;
-}
 // Config consolidation (docs/06): the package.json `glubean` field is no
 // longer a config source. Warn (don't error) when one lingers so users
 // migrate it into glubean.yaml instead of wondering why it stopped working.
@@ -101,12 +80,33 @@ function isGlob(target) {
 const TEST_FILE_SUFFIXES = [
     ".test.ts",
     ".contract.ts",
+    ".workflow.ts",
     ".flow.ts",
     ".bootstrap.ts",
 ];
 function isGlubeanTestFile(name) {
     return TEST_FILE_SUFFIXES.some((suffix) => name.endsWith(suffix));
 }
+// Files that carry contract/workflow DECLARATIONS and are safe to
+// runtime-import for extraction. Matched by SUFFIX, not substring: a normal
+// test like `checkout.workflow.test.ts` ends in `.test.ts` and must stay on
+// the static test path — a `.workflow.` substring would mis-route it into
+// contract extraction (which ignores `test()` exports), silently dropping its
+// tests (codex 0.6 P2).
+const RUNTIME_ARTIFACT_SUFFIXES = [
+    ".contract.ts",
+    ".contract.js",
+    ".contract.mjs",
+    ".workflow.ts",
+    ".workflow.js",
+    ".workflow.mjs",
+    ".flow.ts",
+    ".flow.js",
+    ".flow.mjs",
+];
+function isRuntimeExtractableArtifact(name) {
+    return RUNTIME_ARTIFACT_SUFFIXES.some((suffix) => name.endsWith(suffix));
+}
 function isBootstrapOnlyFile(name) {
     return name.endsWith(".bootstrap.ts");
 }
@@ -129,7 +129,7 @@ export function classifyGlubeanFile(filePath) {
         return "test";
     if (filePath.endsWith(".contract.ts"))
         return "contract";
-    if (filePath.endsWith(".flow.ts"))
+    if (filePath.endsWith(".workflow.ts") || filePath.endsWith(".flow.ts"))
         return "flow";
     if (filePath.endsWith(".bootstrap.ts"))
         return "bootstrap";
@@ -229,6 +229,14 @@ export async function resolveTestFilesForSuite(target, kinds) {
     // `.flow.ts` file (recommended canonical layout) or declare the
     // suite as `kinds: [contract, flow]` so both candidate file types
     // are scanned and the runnable-level filter sorts them out.
+    //
+    // The same applies to a vNext workflow authored in a `.test.ts`
+    // (workflows ride the "flow" RUNNABLE kind, codex S2.6 R10/R11): a
+    // strict `kinds: [flow]` suite won't see the file. Move the workflow
+    // to a `.flow.ts` (recommended — it also gains the metadata
+    // projection, which `.test.ts` files never get) or declare
+    // `kinds: [test, flow]`; the runnable-level filter then keeps the
+    // workflow and drops the plain test() exports.
     return files.filter((f) => {
         const k = classifyGlubeanFile(f);
         if (k === undefined)
@@ -250,16 +258,21 @@ export async function discoverTests(filePath) {
         return [];
     }
     const content = await readFile(filePath, "utf-8");
-    if (filePath.includes(".contract.") || filePath.includes(".flow.")) {
+    if (isRuntimeExtractableArtifact(filePath)) {
         // Runtime extraction via shared function (supports .with() syntax).
-        // Returns BOTH contracts and flows; v0.2+ flow files often export only
-        // flows, so we must emit one DiscoveredTest per flow in addition to
-        // per contract case.
+        // Returns BOTH contracts and workflows; `.workflow.ts` / `.flow.ts` files
+        // often export only workflows, so we must emit one DiscoveredTest per
+        // workflow in addition to per contract case.
         const result = await extractContractFromFile(filePath);
         const results = [];
         for (const ec of result.contracts) {
             const contractTags = ec.tags ?? [];
             for (const c of ec.cases) {
+                // Non-runnable cases (direction: "inbound", design §9.5): the SDK
+                // registered no Test — advertising them here would schedule an id
+                // that can never resolve (codex I2 R1 P1).
+                if (c.runnable === false)
+                    continue;
                 // Mirror SDK dispatchContract: finalTags = contract + case + runtime
                 // synthetic. Without this, pre-spawn excludeTags / --tag filtering
                 // skips contract cases entirely (Phase 1 filter reads meta.tags).
@@ -291,22 +304,28 @@ export async function discoverTests(filePath) {
                 });
             }
         }
-        // Each flow has a single orchestrator Test (setup → steps → teardown).
-        // Discover it as one runnable entry with the flow id. Post-Phase 2f
-        // flows live as `kind: "flow"` entries inside `result.attachments`.
-        // SDK maps FlowMeta.skip → TestMeta.deferred (string reason); mirror
-        // that here so the runner's deferred-skip path applies uniformly.
-        for (const att of result.attachments) {
-            if (att.kind !== "flow")
-                continue;
+        // vNext workflows (S2.6): each BuiltWorkflow wraps the graph in ONE
+        // simple test — discover it like a flow orchestrator, so a file whose
+        // projection scan/upload advertises is also runnable (codex S2.6 R2 P2).
+        // During the migration window workflows ride the "flow" runnable kind:
+        // a workflow IS the vNext orchestrator replacing contract.flow(), and
+        // suites declaring `kinds: [flow]` mean "run the graph orchestrators in
+        // these files" — no new user-facing kinds enum until flow is deleted.
+        // WorkflowMeta.skip → deferred mirrors the SDK's own Test wrapping.
+        for (const wf of result.workflows) {
             results.push({
-                exportName: att.exportName,
+                exportName: wf.exportName,
                 meta: {
-                    id: att.flow.id,
-                    description: att.flow.description,
-                    tags: att.flow.tags,
-                    only: att.flow.only,
-                    deferred: att.flow.skip,
+                    id: wf.id,
+                    name: wf.name,
+                    description: wf.description,
+                    tags: wf.tags,
+                    only: wf.only,
+                    deferred: wf.skip,
+                    // data-driven members: grouping + concurrency ride the projection
+                    // (codex S2.12 R1 P2 — the registry alone never reaches the CLI).
+                    ...(wf.groupId ? { groupId: wf.groupId } : {}),
+                    ...(wf.parallel ? { parallel: true } : {}),
                     kind: "flow",
                 },
             });
@@ -317,17 +336,26 @@ export async function discoverTests(filePath) {
         // contain ONLY contract.http(...). Stricter than MCP's gate: CLI
         // emits flows as runnable tests via discoverTests, so silently
         // dropping `contract.flow(...)` would hide an actual test. Any
-        // non-HTTP usage (including flow) → fail closed and surface the
-        // import error so the user knows discovery is degraded.
+        // non-HTTP usage (including flow, and a vNext workflow(...) — codex
+        // S2.6 R6 P2) → fail closed and surface the import error so the user
+        // knows discovery is degraded.
         if (result.errors.length > 0) {
             // Allow whitespace/newlines between `contract` and `.method` so the
             // common fluent style `contract\n  .flow(...)` still trips the gate.
             const hasHttp = /contract\s*\.\s*http\b/i.test(content);
             const hasNonHttp = /contract\s*\.\s*(?!http\b)\w+\s*[.(]/i.test(content);
-            const contracts = hasHttp && !hasNonHttp ? extractContractCases(content) : [];
+            // Import-clause check catches aliased workflow imports too
+            // (`import { workflow as wf }` — codex S2.6 R8 P2).
+            const hasWorkflow = /\bworkflow\s*\(/.test(content) ||
+                /import\s[^;]*?\{[^}]*\bworkflow\b[^}]*\}/.test(content);
+            const contracts = hasHttp && !hasNonHttp && !hasWorkflow ? extractContractCases(content) : [];
             if (contracts.length > 0) {
                 for (const c of contracts) {
                     for (const caseItem of c.cases) {
+                        // Static-fallback mirror of the runnable filter above (the AST
+                        // extractor marks inboundCase()/direction literals).
+                        if (caseItem.direction === "inbound")
+                            continue;
                         const requires = caseItem.requires ?? "headless";
                         const defaultRun = caseItem.defaultRun ??
                             (requires !== "headless" ? "opt-in" : "always");
@@ -347,6 +375,7 @@ export async function discoverTests(filePath) {
                                 requires: caseItem.requires,
                                 defaultRun: caseItem.defaultRun,
                                 deferred: caseItem.deferred,
+                                deprecated: caseItem.deprecated,
                                 kind: "contract",
                             },
                         });
@@ -395,7 +424,16 @@ export async function discoverTests(filePath) {
                 parallel: m.parallel,
                 requires: m.requires,
                 defaultRun: m.defaultRun,
-                kind: "test",
+                // A vNext workflow is a graph orchestrator — it rides the "flow"
+                // RUNNABLE kind even when authored in a .test.ts, so the
+                // runnable-level suite filter and the --upload gate treat it like a
+                // flow (codex S2.6 R10 P2). NOTE: the FILE-level suite filter still
+                // maps .test.ts ↔ "test" (see resolveTestFilesForSuite's KNOWN
+                // LIMITATION) — a strict kinds:[flow] suite needs the workflow in a
+                // .flow.ts, or kinds:[test, flow].
+                kind: m.workflow ? "flow" : "test",
+                // WorkflowMeta.skip reason → deferred.
+                ...(m.deferred !== undefined ? { deferred: m.deferred } : {}),
             },
         };
     });
@@ -412,7 +450,6 @@ function matchesFilter(testItem, filter) {
 export const __testing = {
     matchesTags: (...args) => matchesTags(...args),
     matchesExcludeTags: (...args) => matchesExcludeTags(...args),
-    flowStepsHaveBranch: (...args) => flowStepsHaveBranch(...args),
 };
 function matchesTags(testItem, tags, mode = "or") {
     if (!testItem.meta.tags?.length)
@@ -506,7 +543,7 @@ export async function runCommand(target, options = {}) {
     const targetDisplay = Array.isArray(target) ? target.join(", ") : target;
     if (testFiles.length === 0) {
         console.error(`\n${colors.red}❌ No test files found for target: ${Array.isArray(target) ? target.join(", ") : target}${colors.reset}`);
-        console.error(`${colors.dim}Glubean looks for files matching *.test.ts, *.contract.ts, or *.flow.ts in the target directory.${colors.reset}`);
+        console.error(`${colors.dim}Glubean looks for files matching *.test.ts, *.contract.ts, *.workflow.ts, or *.flow.ts in the target directory.${colors.reset}`);
         console.error(`${colors.dim}Run "glubean run tests/" or "glubean run path/to/file.test.ts".${colors.reset}\n`);
         await writeEmptyResult(target, runStartLocal);
         process.exit(1);
@@ -759,48 +796,13 @@ export async function runCommand(target, options = {}) {
         }
         console.log(`${colors.dim}${parts.join(" + ")} (${testsToRun.length}/${totalDiscovered} tests)${colors.reset}`);
     }
-    // ── Gate: Cloud cannot yet render branch (condition/switch) flows ──────
-    // Operate on the POST-FILTER selected runnables (`testsToRun`) so a branch
-    // flow that was filtered out (--filter / tags / .only / suite kinds) does not
-    // block an otherwise-branchless upload. Uploading a branch flow would
-    // silently drop its branches server-side (Cloud run view ≠ local), so refuse
-    // before running and name the offending flows. Bootstrap already ran, so
-    // plugin-backed files re-extract from Node's cache cleanly.
-    // (contract-flow-condition.md §12 / Spike 6.)
-    if (options.upload) {
-        // Exclude deferred (FlowMeta.skip → meta.deferred) flows: they don't
-        // execute — only a skipped row is uploaded — so their branches never reach
-        // Cloud and they must not block the upload.
-        const selectedFlows = testsToRun.filter((ft) => ft.test.meta.kind === "flow" && !ft.test.meta.deferred);
-        if (selectedFlows.length > 0) {
-            // Map each selected flow's source file → the set of its branch flow ids.
-            const branchIdsByFile = new Map();
-            for (const filePath of new Set(selectedFlows.map((ft) => ft.filePath))) {
-                try {
-                    const extracted = await extractContractFromFile(filePath);
-                    const ids = new Set();
-                    for (const att of extracted.attachments ?? []) {
-                        if (att.kind === "flow" && flowStepsHaveBranch(att.flow.steps))
-                            ids.add(att.flow.id);
-                    }
-                    branchIdsByFile.set(filePath, ids);
-                }
-                catch {
-                    // Real import/extraction errors are surfaced by discovery above.
-                }
-            }
-            const branchFlows = selectedFlows.filter((ft) => branchIdsByFile.get(ft.filePath)?.has(ft.test.meta.id));
-            if (branchFlows.length > 0) {
-                console.error(`${colors.red}Error: --upload does not yet support branch (condition/switch) flows.${colors.reset}`);
-                console.error(`${colors.dim}Glubean Cloud can't render these flows yet, and uploading would silently drop their branches:${colors.reset}`);
-                for (const ft of branchFlows) {
-                    console.error(`${colors.dim}  - ${ft.test.meta.id} (${ft.exportName}) [${relative(process.cwd(), ft.filePath)}]${colors.reset}`);
-                }
-                console.error(`${colors.dim}Run without --upload, or remove condition/switchOn/switchCond from these flows, until Cloud branch support lands.${colors.reset}`);
-                process.exit(1);
-            }
-        }
-    }
+    // NOTE (0.6, owner): the run-view upload is UNCONDITIONAL — branch/poll
+    // workflows upload like any other. The earlier OPTION D gate refused them
+    // because Cloud "couldn't render" branch/poll run views, but refusing the
+    // upload is the wrong trade: uploading is always correct, and Cloud degrades
+    // gracefully (render raw + the projected `note`/`message` on opaque nodes)
+    // until a richer run view lands. The projection already uploads whole
+    // (branch/poll included), so the run view simply joins it.
     console.log(`\n${colors.bold}Running ${testsToRun.length} test(s)...${colors.reset}\n`);
     // ── Spike 3: runner input channels (attachment-model §8) ────────────────
     // `--input-json` / `--bootstrap-json` / `--force-standalone` apply to a
@@ -1947,6 +1949,12 @@ export async function runCommand(target, options = {}) {
                 const built = await buildMetadata(scanResult, {
                     generatedBy: `@glubean/cli@${CLI_VERSION}`,
                     projectId,
+                    // Upload path only: carry the lossless full CONTRACT projection for
+                    // the Cloud c/f metadata snapshot. Deep-redacted below before upload;
+                    // never written to the on-disk metadata.json (that path omits it).
+                    // `workflows` is always present (Design Y) and redacted in the same
+                    // pass below.
+                    includeProjection: true,
                 });
                 metadata = built;
             }
@@ -1974,6 +1982,20 @@ export async function runCommand(target, options = {}) {
                 }
                 metadata = { ...metadata, runPlan };
             }
+            // Deep-redact the FULL contract + workflow projection before upload. Test
+            // events are redacted below via scope-based `redactEvent`, but the
+            // projection is a free-form tree that can carry secrets anywhere
+            // (examples, default headers, gRPC metadata, `extensions`/`meta`, literal
+            // compare/switch values, assertion messages). `redactMetadataForUpload`
+            // redacts ONLY the projection buckets (contractsProjection + workflows) —
+            // never `files`/`rootHash` — so the server's test registry/dedup keeps
+            // its verbatim sha256 hashes. The projection is uploaded WHOLE (branch/
+            // poll included): it is the lossless source for the server snapshot, not
+            // a run view (see the buildMetadata R14 note); the branch/poll run-view
+            // gate is a separate layer, untouched here.
+            if (metadata) {
+                metadata = await redactMetadataForUpload(metadata, effectiveRedaction);
+            }
             const redactedPayload = {
                 ...resultPayload,
                 metadata,