@glubean/cli 0.5.0 → 0.8.0

package/dist/metadata.js

@@ -31,7 +31,7 @@ export function deriveMetadataStats(files) {
         tags: Array.from(allTags).sort(),
     };
 }
-export async function computeRootHash(files, contracts) {
+export async function computeRootHash(files, contracts, workflows) {
     const entries = Object.entries(files).sort(([a], [b]) => a.localeCompare(b));
     const parts = entries.map(([path, meta]) => `${path}:${meta.hash}`);
     // Include contract metadata in hash so contract changes affect rootHash
@@ -41,6 +41,15 @@ export async function computeRootHash(files, contracts) {
             .digest("hex");
         parts.push(`__contracts__:sha256-${contractHash}`);
     }
+    // Same for workflow projections (S2.6) — a grade/shape change must change
+    // the rootHash. Only added when present, so workflow-free projects keep
+    // their existing hashes.
+    if (workflows && workflows.length > 0) {
+        const workflowHash = createHash("sha256")
+            .update(JSON.stringify(workflows))
+            .digest("hex");
+        parts.push(`__workflows__:sha256-${workflowHash}`);
+    }
     const hash = createHash("sha256").update(parts.join("\n")).digest("hex");
     return `sha256-${hash}`;
 }
@@ -48,7 +57,26 @@ export async function buildMetadata(scanResult, options) {
     const normalizedFiles = normalizeFileMap(scanResult.files);
     const stats = deriveMetadataStats(normalizedFiles);
     const contracts = scanResult.contracts;
-    const rootHash = await computeRootHash(normalizedFiles, contracts);
+    const workflows = scanResult.workflows;
+    // rootHash hashes the DOWN-CONVERTED `contracts` (not the rich
+    // `contractsProjection`). This is deliberate, NOT an oversight (codex 0.6
+    // P2): rootHash is the ON-DISK bundle-integrity hash — `validate_metadata`
+    // recomputes it from the metadata.json fields (files + contracts +
+    // workflows). The rich projection is UPLOAD-ONLY (off disk, includeProjection
+    // below), so hashing it here would make the upload's rootHash diverge from
+    // `glubean scan`'s and break that self-check. Consequence: a contract change
+    // that touches ONLY rich-projection fields (a response-body schema, a
+    // verifyRule) — which the flat `contracts` drops — does not move rootHash.
+    // That is fine: rootHash is bundle integrity, NOT the projection's version
+    // identity. The projection's identity is the server-side `canonicalHash`
+    // (shape-identity proposal §5.3), computed over the FULL projection in the
+    // derive job. Uploads are never deduped by rootHash (snapshots are stored
+    // per-runId), so a projection-only change still reaches the server and gets
+    // its own version there.
+    const rootHash = await computeRootHash(normalizedFiles, contracts, workflows);
+    const contractsProjection = options.includeProjection
+        ? scanResult.contractsProjection
+        : undefined;
     return {
         schemaVersion: METADATA_SCHEMA_VERSION,
         specVersion: scanResult.specVersion,
@@ -63,6 +91,24 @@ export async function buildMetadata(scanResult, options) {
         projectId: options.projectId,
         version: options.version,
         contracts: contracts && contracts.length > 0 ? contracts : undefined,
+        // Lossless full projection of contracts — the source of truth for the
+        // Cloud contract metadata snapshot. Upload-only (includeProjection) and
+        // MUST be redacted before upload (see commands/run.ts): the projection can
+        // carry secrets in examples / default headers / extensions.
+        contractsProjection: contractsProjection && contractsProjection.length > 0
+            ? contractsProjection
+            : undefined,
+        // DELIBERATELY UNFILTERED (codex S2.6 R14): metadata is the project's
+        // authoritative DECLARATION inventory — like `files` and `contracts`, it
+        // always reflects the whole scan, never the run's selection. The server's
+        // upsert treats this map as authoritative (filtering to selected runnables
+        // would make Cloud mark everything unselected as removed — see the
+        // degraded-scan note in run.ts). The --upload branch/poll gate protects a
+        // DIFFERENT layer: RUN data, where Cloud would render a misleading
+        // partial view. A projection in metadata is not a run view; Cloud ignores
+        // these fields until the rendering line lands, and when it does it needs
+        // the complete inventory, branch/poll included.
+        workflows: workflows && workflows.length > 0 ? workflows : undefined,
     };
 }
 //# sourceMappingURL=metadata.js.map

package/dist/metadata.js.map

@@ -1 +1 @@
-{"version":3,"file":"metadata.js","sourceRoot":"","sources":["../src/metadata.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAGzC,MAAM,CAAC,MAAM,uBAAuB,GAAG,GAAG,CAAC;AAE3C,MAAM,UAAU,iBAAiB,CAAC,IAAY;IAC5C,OAAO,IAAI,CAAC,UAAU,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;AACpC,CAAC;AAED,MAAM,UAAU,gBAAgB,CAC9B,KAA+B;IAE/B,MAAM,UAAU,GAA6B,EAAE,CAAC;IAChD,KAAK,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACjD,MAAM,cAAc,GAAG,iBAAiB,CAAC,IAAI,CAAC,CAAC;QAC/C,IAAI,UAAU,CAAC,cAAc,CAAC,EAAE,CAAC;YAC/B,MAAM,IAAI,KAAK,CAAC,4CAA4C,IAAI,EAAE,CAAC,CAAC;QACtE,CAAC;QACD,UAAU,CAAC,cAAc,CAAC,GAAG,IAAI,CAAC;IACpC,CAAC;IACD,OAAO,UAAU,CAAC;AACpB,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,KAA+B;IAKjE,IAAI,SAAS,GAAG,CAAC,CAAC;IAClB,MAAM,OAAO,GAAG,IAAI,GAAG,EAAU,CAAC;IAElC,KAAK,MAAM,QAAQ,IAAI,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;QAC5C,KAAK,MAAM,GAAG,IAAI,QAAQ,CAAC,OAAO,EAAE,CAAC;YACnC,IAAI,GAAG,CAAC,IAAI,EAAE,CAAC;gBACb,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC;YAC9C,CAAC;YACD,SAAS,IAAI,CAAC,CAAC;QACjB,CAAC;IACH,CAAC;IAED,OAAO;QACL,SAAS;QACT,SAAS,EAAE,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,MAAM;QACpC,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE;KACjC,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,KAA+B,EAC/B,SAAqB;IAErB,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC;IAC7E,MAAM,KAAK,GAAa,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC,GAAG,IAAI,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;IAE9E,wEAAwE;IACxE,IAAI,SAAS,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACtC,MAAM,YAAY,GAAG,UAAU,CAAC,QAAQ,CAAC;aACtC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC;aACjC,MAAM,CAAC,KAAK,CAAC,CAAC;QACjB,KAAK,CAAC,IAAI,CAAC,wBAAwB,YAAY,EAAE,CAAC,CAAC;IACrD,CAAC;IAED,MAAM,IAAI,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACzE,OAAO,UAAU,IAAI,EAAE,CAAC;AAC1B,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,UAAsB,EACtB,OAKC;IAED,MAAM,eAAe,GAAG,gBAAgB,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;IAC3D,MAAM,KAAK,GAAG,mBAAmB,CAAC,eAAe,CAAC,CAAC;IACnD,MAAM,SAAS,GAAG,UAAU,CAAC,SAAS,CAAC;IACvC,MAAM,QAAQ,GAAG,MAAM,eAAe,CAAC,eAAe,EAAE,SAAS,CAAC,CAAC;IAEnE,OAAO;QACL,aAAa,EAAE,uBAAuB;QACtC,WAAW,EAAE,UAAU,CAAC,WAAW;QACnC,WAAW,EAAE,OAAO,CAAC,WAAW;QAChC,WAAW,EAAE,OAAO,CAAC,WAAW,IAAI,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QAC5D,QAAQ;QACR,KAAK,EAAE,eAAe;QACtB,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,QAAQ,EAAE,UAAU,CAAC,QAAQ;QAC7B,SAAS,EAAE,OAAO,CAAC,SAAS;QAC5B,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,SAAS,EAAE,SAAS,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS;KACrE,CAAC;AACJ,CAAC"}
+{"version":3,"file":"metadata.js","sourceRoot":"","sources":["../src/metadata.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAGzC,MAAM,CAAC,MAAM,uBAAuB,GAAG,GAAG,CAAC;AAE3C,MAAM,UAAU,iBAAiB,CAAC,IAAY;IAC5C,OAAO,IAAI,CAAC,UAAU,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;AACpC,CAAC;AAED,MAAM,UAAU,gBAAgB,CAC9B,KAA+B;IAE/B,MAAM,UAAU,GAA6B,EAAE,CAAC;IAChD,KAAK,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACjD,MAAM,cAAc,GAAG,iBAAiB,CAAC,IAAI,CAAC,CAAC;QAC/C,IAAI,UAAU,CAAC,cAAc,CAAC,EAAE,CAAC;YAC/B,MAAM,IAAI,KAAK,CAAC,4CAA4C,IAAI,EAAE,CAAC,CAAC;QACtE,CAAC;QACD,UAAU,CAAC,cAAc,CAAC,GAAG,IAAI,CAAC;IACpC,CAAC;IACD,OAAO,UAAU,CAAC;AACpB,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,KAA+B;IAKjE,IAAI,SAAS,GAAG,CAAC,CAAC;IAClB,MAAM,OAAO,GAAG,IAAI,GAAG,EAAU,CAAC;IAElC,KAAK,MAAM,QAAQ,IAAI,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;QAC5C,KAAK,MAAM,GAAG,IAAI,QAAQ,CAAC,OAAO,EAAE,CAAC;YACnC,IAAI,GAAG,CAAC,IAAI,EAAE,CAAC;gBACb,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC;YAC9C,CAAC;YACD,SAAS,IAAI,CAAC,CAAC;QACjB,CAAC;IACH,CAAC;IAED,OAAO;QACL,SAAS;QACT,SAAS,EAAE,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,MAAM;QACpC,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE;KACjC,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,KAA+B,EAC/B,SAAqB,EACrB,SAAqB;IAErB,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC;IAC7E,MAAM,KAAK,GAAa,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC,GAAG,IAAI,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;IAE9E,wEAAwE;IACxE,IAAI,SAAS,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACtC,MAAM,YAAY,GAAG,UAAU,CAAC,QAAQ,CAAC;aACtC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC;aACjC,MAAM,CAAC,KAAK,CAAC,CAAC;QACjB,KAAK,CAAC,IAAI,CAAC,wBAAwB,YAAY,EAAE,CAAC,CAAC;IACrD,CAAC;IAED,0EAA0E;IAC1E,wEAAwE;IACxE,yBAAyB;IACzB,IAAI,SAAS,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACtC,MAAM,YAAY,GAAG,UAAU,CAAC,QAAQ,CAAC;aACtC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC;aACjC,MAAM,CAAC,KAAK,CAAC,CAAC;QACjB,KAAK,CAAC,IAAI,CAAC,wBAAwB,YAAY,EAAE,CAAC,CAAC;IACrD,CAAC;IAGD,MAAM,IAAI,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACzE,OAAO,UAAU,IAAI,EAAE,CAAC;AAC1B,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,UAAsB,EACtB,OAsBC;IAED,MAAM,eAAe,GAAG,gBAAgB,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;IAC3D,MAAM,KAAK,GAAG,mBAAmB,CAAC,eAAe,CAAC,CAAC;IACnD,MAAM,SAAS,GAAG,UAAU,CAAC,SAAS,CAAC;IACvC,MAAM,SAAS,GAAG,UAAU,CAAC,SAAS,CAAC;IACvC,+DAA+D;IAC/D,0EAA0E;IAC1E,2EAA2E;IAC3E,mEAAmE;IACnE,8EAA8E;IAC9E,2EAA2E;IAC3E,6EAA6E;IAC7E,sEAAsE;IACtE,2EAA2E;IAC3E,2EAA2E;IAC3E,yEAAyE;IACzE,2EAA2E;IAC3E,0EAA0E;IAC1E,4EAA4E;IAC5E,yBAAyB;IACzB,MAAM,QAAQ,GAAG,MAAM,eAAe,CAAC,eAAe,EAAE,SAAS,EAAE,SAAS,CAAC,CAAC;IAE9E,MAAM,mBAAmB,GAAG,OAAO,CAAC,iBAAiB;QACnD,CAAC,CAAC,UAAU,CAAC,mBAAmB;QAChC,CAAC,CAAC,SAAS,CAAC;IAEd,OAAO;QACL,aAAa,EAAE,uBAAuB;QACtC,WAAW,EAAE,UAAU,CAAC,WAAW;QACnC,WAAW,EAAE,OAAO,CAAC,WAAW;QAChC,WAAW,EAAE,OAAO,CAAC,WAAW,IAAI,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QAC5D,QAAQ;QACR,KAAK,EAAE,eAAe;QACtB,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,QAAQ,EAAE,UAAU,CAAC,QAAQ;QAC7B,SAAS,EAAE,OAAO,CAAC,SAAS;QAC5B,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,SAAS,EAAE,SAAS,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS;QACpE,sEAAsE;QACtE,wEAAwE;QACxE,2EAA2E;QAC3E,4DAA4D;QAC5D,mBAAmB,EACjB,mBAAmB,IAAI,mBAAmB,CAAC,MAAM,GAAG,CAAC;YACnD,CAAC,CAAC,mBAAmB;YACrB,CAAC,CAAC,SAAS;QACf,sEAAsE;QACtE,yEAAyE;QACzE,0EAA0E;QAC1E,2EAA2E;QAC3E,mEAAmE;QACnE,0EAA0E;QAC1E,mEAAmE;QACnE,0EAA0E;QAC1E,yEAAyE;QACzE,gDAAgD;QAChD,SAAS,EAAE,SAAS,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS;KACrE,CAAC;AACJ,CAAC"}

package/package.json

@@ -1,6 +1,9 @@
 {
   "name": "@glubean/cli",
-  "version": "0.5.0",
+  "version": "0.8.0",
+  "engines": {
+    "node": ">=22"
+  },
   "type": "module",
   "bin": {
     "glubean": "./bin/gb.js"
@@ -27,10 +30,10 @@
     "dotenv": "^16.4.0",
     "tsx": "^4.19.0",
     "yaml": "^2.7.0",
-    "@glubean/sdk": "0.5.0",
-    "@glubean/runner": "0.5.0",
-    "@glubean/redaction": "0.5.0",
-    "@glubean/scanner": "0.5.2"
+    "@glubean/runner": "0.8.0",
+    "@glubean/sdk": "0.8.0",
+    "@glubean/scanner": "0.8.0",
+    "@glubean/redaction": "0.8.0"
   },
   "peerDependencies": {
     "typescript": "^5.0.0"
@@ -44,7 +47,7 @@
     "@types/node": "^22.0.0",
     "@types/archiver": "^6.0.0",
     "typescript": "^5.9.3",
-    "@glubean/graphql": "0.5.0"
+    "@glubean/graphql": "0.8.0"
   },
   "repository": {
     "type": "git",