@glubean/cli 0.8.0 → 0.8.1

package/dist/commands/login.js

@@ -1,8 +1,16 @@
 /**
- * glubean login — Authenticate with Glubean Cloud.
+ * glubean login — Sign the CLI in to Glubean Cloud via the device-authorization
+ * grant (RFC 8628). The CLI requests a code from the AUTH plane (server-hono),
+ * opens the browser to approve it, polls until a `glb_` token is minted, and
+ * saves it to ~/.glubean/credentials.json for `--upload`.
+ *
+ * Login talks to the AUTH url (server-hono); uploads talk to the platform API
+ * (`GLUBEAN_API_URL`) — two separate planes. The open platform is token-only and
+ * has no login of its own.
  */
-import { input, password } from "@inquirer/prompts";
-import { resolveApiUrl, writeCredentials } from "../lib/auth.js";
+import { execFile } from "node:child_process";
+import { resolveApiUrl, resolveAuthUrl, writeCredentials, } from "../lib/auth.js";
+import { DEFAULT_API_URL, DEFAULT_AUTH_URL } from "../lib/constants.js";
 const colors = {
     reset: "\x1b[0m",
     green: "\x1b[32m",
@@ -10,66 +18,119 @@ const colors = {
     dim: "\x1b[2m",
     bold: "\x1b[1m",
     yellow: "\x1b[33m",
+    cyan: "\x1b[36m",
 };
+const sleep = (ms) => new Promise((r) => setTimeout(r, ms));
+/** Best-effort: open a URL in the default browser. Failures are ignored — the
+ *  CLI always prints the URL so the user can open it manually. */
+function openBrowser(url) {
+    try {
+        if (process.platform === "darwin") {
+            execFile("open", [url]);
+        }
+        else if (process.platform === "win32") {
+            execFile("cmd", ["/c", "start", "", url]);
+        }
+        else {
+            execFile("xdg-open", [url]);
+        }
+    }
+    catch {
+        // ignored — the URL is printed regardless
+    }
+}
+async function persist(token, options, apiUrl, authUrl, defaultProject) {
+    // --project wins; otherwise persist the project the grant bound the token to
+    // (the org's default), so `glubean run --upload` works without --project.
+    const projectId = options.project ?? defaultProject;
+    const savedPath = await writeCredentials({
+        token,
+        projectId,
+        apiUrl: apiUrl !== DEFAULT_API_URL ? apiUrl : undefined,
+        authUrl: authUrl !== DEFAULT_AUTH_URL ? authUrl : undefined,
+    });
+    console.log(`${colors.green}Logged in${colors.reset} ${colors.dim}→ credentials saved to ${savedPath}${colors.reset}`);
+    if (projectId) {
+        console.log(`${colors.dim}Default project: ${projectId}${colors.reset}`);
+        console.log(`\n${colors.dim}Run tests and upload: glubean run --upload${colors.reset}`);
+    }
+    else {
+        console.log(`\n${colors.dim}Run tests and upload: glubean run --upload --project <id> (or set GLUBEAN_PROJECT_ID).${colors.reset}`);
+    }
+}
 export async function loginCommand(options) {
+    const authUrl = (await resolveAuthUrl(options)).replace(/\/+$/, "");
     const apiUrl = await resolveApiUrl(options);
-    let token = options.token;
-    if (!token) {
-        const appUrl = apiUrl.replace("api.", "app.");
-        console.log(`${colors.bold}Create a personal access token:${colors.reset}`);
-        console.log(`  ${colors.dim}${appUrl}/settings/tokens${colors.reset}`);
-        console.log(`  ${colors.dim}This token grants access to all your projects.${colors.reset}`);
-        console.log(`  ${colors.dim}For per-project tokens, use project settings → API keys.${colors.reset}`);
-        console.log();
-        token = await password({
-            message: "Paste your token (gb_...)",
-            mask: "*",
-        });
+    // Non-interactive escape hatch: persist a token the user already created in the
+    // dashboard (Project → Tokens). The upload preflight validates it later.
+    if (options.token) {
+        await persist(options.token, options, apiUrl, authUrl);
+        return;
     }
-    if (!token) {
-        console.error(`${colors.red}Error: No token provided.${colors.reset}`);
-        process.exit(1);
-    }
-    // Validate token via whoami
-    console.log(`${colors.dim}Validating...${colors.reset}`);
+    // 1) Start the device grant.
+    let grant;
     try {
-        const resp = await fetch(`${apiUrl}/open/v1/whoami`, {
-            headers: { Authorization: `Bearer ${token}` },
+        const resp = await fetch(`${authUrl}/cli/device/code`, {
+            method: "POST",
+            headers: { "content-type": "application/json" },
         });
         if (!resp.ok) {
-            const body = await resp.text();
-            console.error(`${colors.red}Authentication failed (${resp.status}): ${body}${colors.reset}`);
+            console.error(`${colors.red}Could not start login (${resp.status}) at ${authUrl}.${colors.reset}`);
+            console.error(`${colors.dim}Check --auth-url / GLUBEAN_AUTH_URL points at the Glubean auth server.${colors.reset}`);
             process.exit(1);
         }
-        const whoami = await resp.json();
-        const identity = whoami.kind === "user"
-            ? `user ${whoami.userId}`
-            : `project ${whoami.projectName ?? whoami.projectId}`;
-        console.log(`${colors.green}Authenticated as ${identity}${colors.reset}`);
+        grant = (await resp.json());
     }
     catch (err) {
-        console.error(`${colors.red}Failed to reach ${apiUrl}: ${err instanceof Error ? err.message : err}${colors.reset}`);
+        console.error(`${colors.red}Cannot reach ${authUrl}: ${err instanceof Error ? err.message : err}${colors.reset}`);
         process.exit(1);
     }
-    // Resolve project ID: flag → interactive prompt
-    let projectId = options.project;
-    if (!projectId) {
-        projectId = await input({
-            message: "Project ID (optional, from project settings)",
-            default: "",
-        });
-        if (projectId === "")
-            projectId = undefined;
+    // 2) Show the code + open the browser.
+    const openUrl = grant.verification_uri_complete ?? grant.verification_uri;
+    console.log(`\n${colors.bold}Authorize the Glubean CLI${colors.reset}`);
+    console.log(`  ${colors.dim}Open:${colors.reset} ${colors.cyan}${grant.verification_uri}${colors.reset}`);
+    console.log(`  ${colors.dim}Code:${colors.reset} ${colors.bold}${grant.user_code}${colors.reset}\n`);
+    if (options.noBrowser) {
+        console.log(`${colors.dim}Open the URL above and enter the code.${colors.reset}`);
     }
-    const savedPath = await writeCredentials({
-        token,
-        projectId,
-        apiUrl: apiUrl !== "https://api.glubean.com" ? apiUrl : undefined,
-    });
-    console.log(`${colors.green}Credentials saved${colors.reset} ${colors.dim}→ ${savedPath}${colors.reset}`);
-    if (projectId) {
-        console.log(`${colors.dim}Default project: ${projectId}${colors.reset}`);
+    else {
+        console.log(`${colors.dim}Opening your browser…${colors.reset}`);
+        openBrowser(openUrl);
+    }
+    // 3) Poll until approved / denied / expired (or the grant times out).
+    const intervalMs = Math.max(1, grant.interval) * 1000;
+    const deadline = Date.now() + Math.max(1, grant.expires_in) * 1000;
+    console.log(`${colors.dim}Waiting for approval…${colors.reset}`);
+    while (Date.now() < deadline) {
+        await sleep(intervalMs);
+        let poll;
+        try {
+            const resp = await fetch(`${authUrl}/cli/device/token`, {
+                method: "POST",
+                headers: { "content-type": "application/json" },
+                body: JSON.stringify({ device_code: grant.device_code }),
+            });
+            if (!resp.ok)
+                continue; // transient — keep polling
+            poll = (await resp.json());
+        }
+        catch {
+            continue; // transient network blip — keep polling
+        }
+        if (poll.status === "approved" && poll.token) {
+            await persist(poll.token, options, apiUrl, authUrl, poll.projectId);
+            return;
+        }
+        if (poll.status === "denied") {
+            console.error(`${colors.red}Login denied in the browser.${colors.reset}`);
+            process.exit(1);
+        }
+        if (poll.status === "expired") {
+            console.error(`${colors.red}The login code expired. Run 'glubean login' again.${colors.reset}`);
+            process.exit(1);
+        }
     }
-    console.log(`\n${colors.dim}Run tests and upload: glubean run --upload${colors.reset}`);
+    console.error(`${colors.red}Timed out waiting for approval. Run 'glubean login' again.${colors.reset}`);
+    process.exit(1);
 }
 //# sourceMappingURL=login.js.map

package/dist/commands/login.js.map

@@ -1 +1 @@
-{"version":3,"file":"login.js","sourceRoot":"","sources":["../../src/commands/login.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,mBAAmB,CAAC;AACpD,OAAO,EAAoB,aAAa,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AAEnF,MAAM,MAAM,GAAG;IACb,KAAK,EAAE,SAAS;IAChB,KAAK,EAAE,UAAU;IACjB,GAAG,EAAE,UAAU;IACf,GAAG,EAAE,SAAS;IACd,IAAI,EAAE,SAAS;IACf,MAAM,EAAE,UAAU;CACnB,CAAC;AAQF,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,OAAqB;IACtD,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,OAAsB,CAAC,CAAC;IAE3D,IAAI,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC;IAC1B,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,MAAM,MAAM,GAAG,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QAC9C,OAAO,CAAC,GAAG,CACT,GAAG,MAAM,CAAC,IAAI,kCAAkC,MAAM,CAAC,KAAK,EAAE,CAC/D,CAAC;QACF,OAAO,CAAC,GAAG,CACT,KAAK,MAAM,CAAC,GAAG,GAAG,MAAM,mBAAmB,MAAM,CAAC,KAAK,EAAE,CAC1D,CAAC;QACF,OAAO,CAAC,GAAG,CACT,KAAK,MAAM,CAAC,GAAG,iDAAiD,MAAM,CAAC,KAAK,EAAE,CAC/E,CAAC;QACF,OAAO,CAAC,GAAG,CACT,KAAK,MAAM,CAAC,GAAG,2DAA2D,MAAM,CAAC,KAAK,EAAE,CACzF,CAAC;QACF,OAAO,CAAC,GAAG,EAAE,CAAC;QACd,KAAK,GAAG,MAAM,QAAQ,CAAC;YACrB,OAAO,EAAE,2BAA2B;YACpC,IAAI,EAAE,GAAG;SACV,CAAC,CAAC;IACL,CAAC;IAED,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,OAAO,CAAC,KAAK,CAAC,GAAG,MAAM,CAAC,GAAG,4BAA4B,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC;QACvE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,4BAA4B;IAC5B,OAAO,CAAC,GAAG,CAAC,GAAG,MAAM,CAAC,GAAG,gBAAgB,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC;IACzD,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,GAAG,MAAM,iBAAiB,EAAE;YACnD,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,KAAK,EAAE,EAAE;SAC9C,CAAC,CAAC;QAEH,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC;YACb,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC;YAC/B,OAAO,CAAC,KAAK,CACX,GAAG,MAAM,CAAC,GAAG,0BAA0B,IAAI,CAAC,MAAM,MAAM,IAAI,GAAG,MAAM,CAAC,KAAK,EAAE,CAC9E,CAAC;YACF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;QAED,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,IAAI,EAAiF,CAAC;QAChH,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,KAAK,MAAM;YACrC,CAAC,CAAC,QAAQ,MAAM,CAAC,MAAM,EAAE;YACzB,CAAC,CAAC,WAAW,MAAM,CAAC,WAAW,IAAI,MAAM,CAAC,SAAS,EAAE,CAAC;QAExD,OAAO,CAAC,GAAG,CAAC,GAAG,MAAM,CAAC,KAAK,oBAAoB,QAAQ,GAAG,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC;IAC5E,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,CAAC,KAAK,CACX,GAAG,MAAM,CAAC,GAAG,mBAAmB,MAAM,KAAK,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,GAAG,MAAM,CAAC,KAAK,EAAE,CACrG,CAAC;QACF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,gDAAgD;IAChD,IAAI,SAAS,GAAuB,OAAO,CAAC,OAAO,CAAC;IACpD,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,SAAS,GAAG,MAAM,KAAK,CAAC;YACtB,OAAO,EAAE,8CAA8C;YACvD,OAAO,EAAE,EAAE;SACZ,CAAC,CAAC;QACH,IAAI,SAAS,KAAK,EAAE;YAAE,SAAS,GAAG,SAAS,CAAC;IAC9C,CAAC;IAED,MAAM,SAAS,GAAG,MAAM,gBAAgB,CAAC;QACvC,KAAK;QACL,SAAS;QACT,MAAM,EAAE,MAAM,KAAK,yBAAyB,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS;KAClE,CAAC,CAAC;IAEH,OAAO,CAAC,GAAG,CACT,GAAG,MAAM,CAAC,KAAK,oBAAoB,MAAM,CAAC,KAAK,IAAI,MAAM,CAAC,GAAG,KAAK,SAAS,GAAG,MAAM,CAAC,KAAK,EAAE,CAC7F,CAAC;IACF,IAAI,SAAS,EAAE,CAAC;QACd,OAAO,CAAC,GAAG,CACT,GAAG,MAAM,CAAC,GAAG,oBAAoB,SAAS,GAAG,MAAM,CAAC,KAAK,EAAE,CAC5D,CAAC;IACJ,CAAC;IACD,OAAO,CAAC,GAAG,CACT,KAAK,MAAM,CAAC,GAAG,6CAA6C,MAAM,CAAC,KAAK,EAAE,CAC3E,CAAC;AACJ,CAAC"}
+{"version":3,"file":"login.js","sourceRoot":"","sources":["../../src/commands/login.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAC9C,OAAO,EAEL,aAAa,EACb,cAAc,EACd,gBAAgB,GACjB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,eAAe,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AAExE,MAAM,MAAM,GAAG;IACb,KAAK,EAAE,SAAS;IAChB,KAAK,EAAE,UAAU;IACjB,GAAG,EAAE,UAAU;IACf,GAAG,EAAE,SAAS;IACd,IAAI,EAAE,SAAS;IACf,MAAM,EAAE,UAAU;IAClB,IAAI,EAAE,UAAU;CACjB,CAAC;AA6BF,MAAM,KAAK,GAAG,CAAC,EAAU,EAAE,EAAE,CAAC,IAAI,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;AAEpE;kEACkE;AAClE,SAAS,WAAW,CAAC,GAAW;IAC9B,IAAI,CAAC;QACH,IAAI,OAAO,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;YAClC,QAAQ,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;QAC1B,CAAC;aAAM,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;YACxC,QAAQ,CAAC,KAAK,EAAE,CAAC,IAAI,EAAE,OAAO,EAAE,EAAE,EAAE,GAAG,CAAC,CAAC,CAAC;QAC5C,CAAC;aAAM,CAAC;YACN,QAAQ,CAAC,UAAU,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;QAC9B,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,0CAA0C;IAC5C,CAAC;AACH,CAAC;AAED,KAAK,UAAU,OAAO,CACpB,KAAa,EACb,OAAqB,EACrB,MAAc,EACd,OAAe,EACf,cAAuB;IAEvB,6EAA6E;IAC7E,0EAA0E;IAC1E,MAAM,SAAS,GAAG,OAAO,CAAC,OAAO,IAAI,cAAc,CAAC;IACpD,MAAM,SAAS,GAAG,MAAM,gBAAgB,CAAC;QACvC,KAAK;QACL,SAAS;QACT,MAAM,EAAE,MAAM,KAAK,eAAe,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS;QACvD,OAAO,EAAE,OAAO,KAAK,gBAAgB,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS;KAC5D,CAAC,CAAC;IACH,OAAO,CAAC,GAAG,CACT,GAAG,MAAM,CAAC,KAAK,YAAY,MAAM,CAAC,KAAK,IAAI,MAAM,CAAC,GAAG,0BAA0B,SAAS,GAAG,MAAM,CAAC,KAAK,EAAE,CAC1G,CAAC;IACF,IAAI,SAAS,EAAE,CAAC;QACd,OAAO,CAAC,GAAG,CAAC,GAAG,MAAM,CAAC,GAAG,oBAAoB,SAAS,GAAG,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC;QACzE,OAAO,CAAC,GAAG,CAAC,KAAK,MAAM,CAAC,GAAG,6CAA6C,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC;IAC1F,CAAC;SAAM,CAAC;QACN,OAAO,CAAC,GAAG,CACT,KAAK,MAAM,CAAC,GAAG,yFAAyF,MAAM,CAAC,KAAK,EAAE,CACvH,CAAC;IACJ,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,OAAqB;IACtD,MAAM,OAAO,GAAG,CAAC,MAAM,cAAc,CAAC,OAAsB,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IACnF,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,OAAsB,CAAC,CAAC;IAE3D,gFAAgF;IAChF,yEAAyE;IACzE,IAAI,OAAO,CAAC,KAAK,EAAE,CAAC;QAClB,MAAM,OAAO,CAAC,OAAO,CAAC,KAAK,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC;QACvD,OAAO;IACT,CAAC;IAED,6BAA6B;IAC7B,IAAI,KAAkB,CAAC;IACvB,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,GAAG,OAAO,kBAAkB,EAAE;YACrD,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;SAChD,CAAC,CAAC;QACH,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC;YACb,OAAO,CAAC,KAAK,CACX,GAAG,MAAM,CAAC,GAAG,0BAA0B,IAAI,CAAC,MAAM,QAAQ,OAAO,IAAI,MAAM,CAAC,KAAK,EAAE,CACpF,CAAC;YACF,OAAO,CAAC,KAAK,CACX,GAAG,MAAM,CAAC,GAAG,yEAAyE,MAAM,CAAC,KAAK,EAAE,CACrG,CAAC;YACF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;QACD,KAAK,GAAG,CAAC,MAAM,IAAI,CAAC,IAAI,EAAE,CAAgB,CAAC;IAC7C,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,CAAC,KAAK,CACX,GAAG,MAAM,CAAC,GAAG,gBAAgB,OAAO,KAAK,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,GAAG,MAAM,CAAC,KAAK,EAAE,CACnG,CAAC;QACF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,uCAAuC;IACvC,MAAM,OAAO,GAAG,KAAK,CAAC,yBAAyB,IAAI,KAAK,CAAC,gBAAgB,CAAC;IAC1E,OAAO,CAAC,GAAG,CAAC,KAAK,MAAM,CAAC,IAAI,4BAA4B,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC;IACxE,OAAO,CAAC,GAAG,CAAC,KAAK,MAAM,CAAC,GAAG,QAAQ,MAAM,CAAC,KAAK,IAAI,MAAM,CAAC,IAAI,GAAG,KAAK,CAAC,gBAAgB,GAAG,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC;IAC1G,OAAO,CAAC,GAAG,CAAC,KAAK,MAAM,CAAC,GAAG,QAAQ,MAAM,CAAC,KAAK,IAAI,MAAM,CAAC,IAAI,GAAG,KAAK,CAAC,SAAS,GAAG,MAAM,CAAC,KAAK,IAAI,CAAC,CAAC;IACrG,IAAI,OAAO,CAAC,SAAS,EAAE,CAAC;QACtB,OAAO,CAAC,GAAG,CAAC,GAAG,MAAM,CAAC,GAAG,yCAAyC,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC;IACpF,CAAC;SAAM,CAAC;QACN,OAAO,CAAC,GAAG,CAAC,GAAG,MAAM,CAAC,GAAG,wBAAwB,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC;QACjE,WAAW,CAAC,OAAO,CAAC,CAAC;IACvB,CAAC;IAED,sEAAsE;IACtE,MAAM,UAAU,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,KAAK,CAAC,QAAQ,CAAC,GAAG,IAAI,CAAC;IACtD,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,KAAK,CAAC,UAAU,CAAC,GAAG,IAAI,CAAC;IACnE,OAAO,CAAC,GAAG,CAAC,GAAG,MAAM,CAAC,GAAG,wBAAwB,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC;IACjE,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,QAAQ,EAAE,CAAC;QAC7B,MAAM,KAAK,CAAC,UAAU,CAAC,CAAC;QACxB,IAAI,IAAgB,CAAC;QACrB,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,GAAG,OAAO,mBAAmB,EAAE;gBACtD,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;gBAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,WAAW,EAAE,KAAK,CAAC,WAAW,EAAE,CAAC;aACzD,CAAC,CAAC;YACH,IAAI,CAAC,IAAI,CAAC,EAAE;gBAAE,SAAS,CAAC,2BAA2B;YACnD,IAAI,GAAG,CAAC,MAAM,IAAI,CAAC,IAAI,EAAE,CAAe,CAAC;QAC3C,CAAC;QAAC,MAAM,CAAC;YACP,SAAS,CAAC,wCAAwC;QACpD,CAAC;QACD,IAAI,IAAI,CAAC,MAAM,KAAK,UAAU,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;YAC7C,MAAM,OAAO,CAAC,IAAI,CAAC,KAAK,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;YACpE,OAAO;QACT,CAAC;QACD,IAAI,IAAI,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;YAC7B,OAAO,CAAC,KAAK,CAAC,GAAG,MAAM,CAAC,GAAG,+BAA+B,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC;YAC1E,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;QACD,IAAI,IAAI,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;YAC9B,OAAO,CAAC,KAAK,CAAC,GAAG,MAAM,CAAC,GAAG,qDAAqD,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC;YAChG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;IACH,CAAC;IACD,OAAO,CAAC,KAAK,CAAC,GAAG,MAAM,CAAC,GAAG,6DAA6D,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC;IACxG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC"}

package/dist/commands/run.d.ts

@@ -45,6 +45,13 @@ interface RunOptions {
     upload?: boolean;
     uploadReceiptJson?: string;
     project?: string;
+    /**
+     * Upload TARGET (the API/system under test the runs belong to). Resolved from
+     * the profile's `upload.targetId` (or `GLUBEAN_TARGET_ID`). When unset, the
+     * upload routes to the project's default target (resolved server-side at
+     * upload time). Runs live under a target — see auth.ts `resolveTargetId`.
+     */
+    target?: string;
     token?: string;
     /** Env var name holding this profile's upload token (from upload.tokenEnv). */
     tokenEnv?: string;

package/dist/commands/run.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"run.d.ts","sourceRoot":"","sources":["../../src/commands/run.ts"],"names":[],"mappings":"AA6BA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AAuBxD,UAAU,UAAU;IAClB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;IAChB,OAAO,CAAC,EAAE,IAAI,GAAG,KAAK,CAAC;IACvB,6EAA6E;IAC7E,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,8EAA8E;IAC9E,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB;;;;;OAKG;IACH,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;IACvB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB;;;;;OAKG;IACH,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,UAAU,CAAC,EAAE,OAAO,GAAG,MAAM,CAAC;IAC9B,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;IACvB,UAAU,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC;IAC9B,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,6CAA6C;IAC7C,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB,iDAAiD;IACjD,gBAAgB,CAAC,EAAE,OAAO,CAAC;IAC3B,4EAA4E;IAC5E,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,+EAA+E;IAC/E,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC9B;;;;;;;;;;;;;;;OAeG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B;;;;;;;OAOG;IACH,mBAAmB,CAAC,EAAE,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,MAAM,GAAG,UAAU,GAAG,MAAM,CAAC,CAAC,CAAC;IACrE;;;;;;;OAOG;IACH,eAAe,CAAC,EAAE,OAAO,oBAAoB,EAAE,eAAe,CAAC;IAC/D;;;;;OAKG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB;;;;OAIG;IACH,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB;;;;;OAKG;IACH,UAAU,CAAC,EAAE,OAAO,cAAc,EAAE,eAAe,CAAC;CACrD;AAuCD,wBAAsB,iBAAiB,CACrC,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,UAAU,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC,CAoBnD;AA+ED;;;;;;;;;;;GAWG;AACH,YAAY,EAAE,eAAe,EAAE,CAAC;AAEhC,wBAAgB,mBAAmB,CAAC,QAAQ,EAAE,MAAM,GAAG,eAAe,GAAG,SAAS,CAGjF;AA+DD;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAsB,wBAAwB,CAC5C,MAAM,EAAE,MAAM,EACd,KAAK,EAAE,MAAM,EAAE,GACd,OAAO,CAAC,MAAM,EAAE,CAAC,CA+BnB;AAED,UAAU,kBAAkB;IAC1B,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;IAChB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB;;;;;;;OAOG;IACH,IAAI,CAAC,EAAE,MAAM,GAAG,UAAU,GAAG,MAAM,CAAC;CACrC;AAED,UAAU,cAAc;IACtB,UAAU,EAAE,MAAM,CAAC;IACnB,IAAI,EAAE,kBAAkB,CAAC;CAC1B;AAED,wBAAsB,aAAa,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,EAAE,CAAC,CAoM/E;AAUD,eAAO,MAAM,SAAS;;;8BAIM,MAAM;CACjC,CAAC;AAEF,iBAAS,WAAW,CAClB,QAAQ,EAAE,cAAc,EACxB,IAAI,EAAE,MAAM,EAAE,EACd,IAAI,GAAE,IAAI,GAAG,KAAY,GACxB,OAAO,CAKT;AAED;;;;GAIG;AACH,iBAAS,kBAAkB,CACzB,QAAQ,EAAE,cAAc,EACxB,WAAW,EAAE,MAAM,EAAE,GACpB,OAAO,CAKT;AA6DD,wBAAsB,UAAU,CAC9B,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,EACzB,OAAO,GAAE,UAAe,GACvB,OAAO,CAAC,IAAI,CAAC,CAqvDf"}
+{"version":3,"file":"run.d.ts","sourceRoot":"","sources":["../../src/commands/run.ts"],"names":[],"mappings":"AA4BA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AAuBxD,UAAU,UAAU;IAClB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;IAChB,OAAO,CAAC,EAAE,IAAI,GAAG,KAAK,CAAC;IACvB,6EAA6E;IAC7E,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,8EAA8E;IAC9E,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB;;;;;OAKG;IACH,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;IACvB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB;;;;;OAKG;IACH,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,UAAU,CAAC,EAAE,OAAO,GAAG,MAAM,CAAC;IAC9B,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;IACvB,UAAU,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC;IAC9B,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,6CAA6C;IAC7C,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB,iDAAiD;IACjD,gBAAgB,CAAC,EAAE,OAAO,CAAC;IAC3B,4EAA4E;IAC5E,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB;;;;;OAKG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,+EAA+E;IAC/E,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC9B;;;;;;;;;;;;;;;OAeG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B;;;;;;;OAOG;IACH,mBAAmB,CAAC,EAAE,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,MAAM,GAAG,UAAU,GAAG,MAAM,CAAC,CAAC,CAAC;IACrE;;;;;;;OAOG;IACH,eAAe,CAAC,EAAE,OAAO,oBAAoB,EAAE,eAAe,CAAC;IAC/D;;;;;OAKG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB;;;;OAIG;IACH,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB;;;;;OAKG;IACH,UAAU,CAAC,EAAE,OAAO,cAAc,EAAE,eAAe,CAAC;CACrD;AAuCD,wBAAsB,iBAAiB,CACrC,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,UAAU,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC,CAoBnD;AA+ED;;;;;;;;;;;GAWG;AACH,YAAY,EAAE,eAAe,EAAE,CAAC;AAEhC,wBAAgB,mBAAmB,CAAC,QAAQ,EAAE,MAAM,GAAG,eAAe,GAAG,SAAS,CAGjF;AA+DD;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAsB,wBAAwB,CAC5C,MAAM,EAAE,MAAM,EACd,KAAK,EAAE,MAAM,EAAE,GACd,OAAO,CAAC,MAAM,EAAE,CAAC,CA+BnB;AAED,UAAU,kBAAkB;IAC1B,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;IAChB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB;;;;;;;OAOG;IACH,IAAI,CAAC,EAAE,MAAM,GAAG,UAAU,GAAG,MAAM,CAAC;CACrC;AAED,UAAU,cAAc;IACtB,UAAU,EAAE,MAAM,CAAC;IACnB,IAAI,EAAE,kBAAkB,CAAC;CAC1B;AAED,wBAAsB,aAAa,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,EAAE,CAAC,CAoM/E;AAUD,eAAO,MAAM,SAAS;;;8BAIM,MAAM;CACjC,CAAC;AAEF,iBAAS,WAAW,CAClB,QAAQ,EAAE,cAAc,EACxB,IAAI,EAAE,MAAM,EAAE,EACd,IAAI,GAAE,IAAI,GAAG,KAAY,GACxB,OAAO,CAKT;AAED;;;;GAIG;AACH,iBAAS,kBAAkB,CACzB,QAAQ,EAAE,cAAc,EACxB,WAAW,EAAE,MAAM,EAAE,GACpB,OAAO,CAKT;AA6DD,wBAAsB,UAAU,CAC9B,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,EACzB,OAAO,GAAE,UAAe,GACvB,OAAO,CAAC,IAAI,CAAC,CAo3Df"}

package/dist/commands/run.js

@@ -1,13 +1,12 @@
 import { bootstrap, evaluateThresholds, MetricCollector, ProjectRunner, buildRunContext, } from "@glubean/runner";
 import { basename, dirname, isAbsolute, relative, resolve } from "node:path";
+import { randomUUID } from "node:crypto";
 import { stat, readdir, readFile, writeFile, mkdir, rm } from "node:fs/promises";
 import { glob } from "node:fs/promises";
 import { CONFIG_DEFAULTS, mergeRunOptions, toSharedRunConfig } from "../lib/config.js";
 import { loadProjectEnv } from "@glubean/runner";
 import { resolveEnvFileName } from "../lib/active_env.js";
 import { shouldSkipTest } from "../lib/skip.js";
-import { CLI_VERSION } from "../version.js";
-import { redactMetadataForUpload } from "../lib/redact-metadata.js";
 import { extractContractCases, extractFromSource } from "@glubean/scanner/static";
 import { buildSuffixes, classifyByStem, extractContractFromFile, findTemplateMatch, GLUBEAN_KINDS, loadProjectOverlays, matchesTemplateFilter, } from "@glubean/scanner";
 import { applyEnvTemplating } from "@glubean/runner";
@@ -610,11 +609,15 @@ export async function runCommand(target, options = {}) {
         console.log(`${colors.dim}Loaded ${Object.keys(envVars).length} vars from ${envFileName}${colors.reset}`);
     }
     // ── Preflight: verify auth before running tests when --upload is set ────
+    // The resolved upload target is hoisted so the post-run upload reuses it —
+    // resolution happens here (pre-run) so a misconfigured destination fails fast.
+    let resolvedUploadTargetId;
     if (options.upload) {
-        const { resolveToken, resolveProjectId, resolveApiUrl } = await import("../lib/auth.js");
+        const { resolveToken, resolveProjectId, resolveApiUrl, resolveTargetId, resolveDefaultTargetId, checkUploadAuth, checkTargetInProject, } = await import("../lib/auth.js");
         const authOpts = {
             token: options.token,
             project: options.project,
+            target: options.target,
             apiUrl: options.apiUrl,
         };
         const sources = {
@@ -630,34 +633,87 @@ export async function runCommand(target, options = {}) {
                 console.error(`${colors.dim}This profile's upload.tokenEnv points at '${options.tokenEnv}', but it's empty/unset. Set it in .env.secrets or the environment.${colors.reset}`);
             }
             else {
-                console.error(`${colors.dim}Run 'glubean login', set GLUBEAN_TOKEN, or add token to .env.secrets or package.json glubean.cloud.${colors.reset}`);
+                console.error(`${colors.dim}Create a project token (glb_…) in the dashboard (Project → Tokens), then run 'glubean login' to save it, set GLUBEAN_TOKEN / --token, or add it to .env.secrets.${colors.reset}`);
             }
             process.exit(1);
         }
         if (!preProject) {
             console.error(`${colors.red}Error: --upload requires a project ID but none found.${colors.reset}`);
-            console.error(`${colors.dim}Use --project, set projectId in package.json glubean.cloud, or run 'glubean login'.${colors.reset}`);
+            console.error(`${colors.dim}Use --project or set GLUBEAN_PROJECT_ID.${colors.reset}`);
             process.exit(1);
         }
-        try {
-            const resp = await fetch(`${preApiUrl}/open/v1/whoami`, {
-                headers: { Authorization: `Bearer ${preToken}` },
-            });
-            if (!resp.ok) {
-                console.error(`${colors.red}Error: authentication failed (${resp.status}).${colors.reset}`);
-                if (resp.status === 401) {
-                    console.error(`${colors.dim}Token is invalid or expired. Run 'glubean login' to re-authenticate.${colors.reset}`);
+        // Validate against the SAME server runs upload to. Don't pre-judge token
+        // format locally — let the server decide. A least-privilege ingest token
+        // (runs:write, no projects:read) gets 403 yet can still POST runs, so that
+        // alone proceeds; a known-bad config (401 invalid token, 404 mistyped
+        // project / wrong API URL, 5xx, unreachable) is fatal BEFORE running tests.
+        const check = await checkUploadAuth(preApiUrl, preProject, preToken);
+        if (!check.proceed) {
+            if (check.status === 401) {
+                console.error(`${colors.red}Error: authentication failed (401).${colors.reset}`);
+                console.error(`${colors.dim}The token is invalid/expired or not a platform project token (glb_…). Create one in the dashboard (Project → Tokens) and run 'glubean login' (or set GLUBEAN_TOKEN).${colors.reset}`);
+            }
+            else if (check.status === 404) {
+                console.error(`${colors.red}Error: project ${preProject} not found (404).${colors.reset}`);
+                console.error(`${colors.dim}Check that --project / GLUBEAN_PROJECT_ID is a real project id and --api-url / GLUBEAN_API_URL points at the right server.${colors.reset}`);
+            }
+            else if (check.status === 403) {
+                console.error(`${colors.red}Error: access to project ${preProject} is forbidden (403).${colors.reset}`);
+                console.error(`${colors.dim}The token's org has no access to this project (or its membership was revoked). Use a token whose org owns the project.${colors.reset}`);
+            }
+            else if (check.status === 0) {
+                console.error(`${colors.red}Error: cannot reach server at ${preApiUrl}.${colors.reset}`);
+            }
+            else {
+                console.error(`${colors.red}Error: upload preflight got an unexpected response (${check.status}).${colors.reset}`);
+                console.error(`${colors.dim}Check that --api-url / GLUBEAN_API_URL points at the Glubean platform API.${colors.reset}`);
+            }
+            process.exit(1);
+        }
+        if (check.unverified) {
+            // 403 — can't read the project with this token's scope, but it can write
+            // runs. Proceed; the post-run upload surfaces any genuine error.
+            console.log(`${colors.dim}Skipping pre-run project check (insufficient read scope); will upload to ${preApiUrl} after the run.${colors.reset}`);
+        }
+        else {
+            console.log(`${colors.dim}Authenticated · upload to ${preApiUrl} (project ${check.projectName ?? preProject})${colors.reset}`);
+        }
+        // Resolve the upload TARGET here too (pre-run) so a misconfigured target
+        // fails fast instead of after the whole suite. The post-run block reuses it.
+        let preTarget = await resolveTargetId(authOpts, sources);
+        if (preTarget) {
+            // EXPLICIT target — validate it belongs to the project (a typo would
+            // otherwise 404 only on the final POST, after the suite ran).
+            const tcheck = await checkTargetInProject(preApiUrl, preProject, preTarget, preToken);
+            if (!tcheck.proceed) {
+                if (tcheck.status === 404) {
+                    console.error(`${colors.red}Error: target ${preTarget} not found in project ${preProject} (404).${colors.reset}`);
+                    console.error(`${colors.dim}Check upload.targetId / GLUBEAN_TARGET_ID / --upload-target.${colors.reset}`);
+                }
+                else if (tcheck.status === 401) {
+                    console.error(`${colors.red}Error: authentication failed validating the target (401).${colors.reset}`);
+                }
+                else if (tcheck.status === 0) {
+                    console.error(`${colors.red}Error: cannot reach server at ${preApiUrl}.${colors.reset}`);
+                }
+                else {
+                    console.error(`${colors.red}Error: could not validate target ${preTarget} (${tcheck.status}).${colors.reset}`);
                 }
                 process.exit(1);
             }
-            const identity = await resp.json();
-            console.log(`${colors.dim}Authenticated as ${identity.kind === "project_token" ? `project token (${identity.projectName})` : "user"} · upload to ${preApiUrl}${colors.reset}`);
+            // 403 insufficient_scope (unverified) → no targets:read; can't validate, proceed.
         }
-        catch (err) {
-            console.error(`${colors.red}Error: cannot reach server at ${preApiUrl}${colors.reset}`);
-            console.error(`${colors.dim}${err.message}${colors.reset}`);
-            process.exit(1);
+        else {
+            // No explicit target → the project's default target (deterministic for a
+            // default project, else slug-validated by listing).
+            preTarget = await resolveDefaultTargetId(preApiUrl, preProject, preToken);
+            if (!preTarget) {
+                console.error(`${colors.red}Error: could not resolve an upload target for project ${preProject}.${colors.reset}`);
+                console.error(`${colors.dim}Set the target explicitly (upload.targetId in glubean.yaml, GLUBEAN_TARGET_ID, or --upload-target). Auto-resolving a non-default project's target needs a token with the targets:read scope.${colors.reset}`);
+                process.exit(1);
+            }
         }
+        resolvedUploadTargetId = preTarget;
     }
     // ── Bootstrap plugins BEFORE discovery ─────────────────────────────────
     // CLI's `discoverTests` dynamically imports each .contract.ts / .test.ts
@@ -1894,6 +1950,7 @@ export async function runCommand(target, options = {}) {
         const authOpts = {
             token: options.token,
             project: options.project,
+            target: options.target,
             apiUrl: options.apiUrl,
         };
         const sources = {
@@ -1912,7 +1969,7 @@ export async function runCommand(target, options = {}) {
             process.exit(1);
         }
         else {
-            const { compileScopes, redactEvent, BUILTIN_SCOPES } = await import("@glubean/redaction");
+            const { compileScopes, redactEvent, redactValue, BUILTIN_SCOPES } = await import("@glubean/redaction");
             // Prefer the v1 plan's full redaction config when supplied
             // (Phase 4 init scaffolds `defaults.redaction` in glubean.yaml,
             // including any custom globalRules / sensitiveKeys / customPatterns).
@@ -1925,82 +1982,134 @@ export async function runCommand(target, options = {}) {
                 globalRules: effectiveRedaction.globalRules,
                 replacementFormat: effectiveRedaction.replacementFormat,
             });
-            // Generate metadata for test registry
-            let metadata;
-            try {
-                const { scan } = await import("@glubean/scanner");
-                const { buildMetadata } = await import("../metadata.js");
-                const scanResult = await scan(rootDir);
-                const built = await buildMetadata(scanResult, {
-                    generatedBy: `@glubean/cli@${CLI_VERSION}`,
-                    projectId,
-                    // Upload path only: carry the lossless full CONTRACT projection for
-                    // the Cloud c/f metadata snapshot. Deep-redacted below before upload;
-                    // never written to the on-disk metadata.json (that path omits it).
-                    // `workflows` is always present (Design Y) and redacted in the same
-                    // pass below.
-                    includeProjection: true,
-                });
-                metadata = built;
-            }
-            catch {
-                // Non-critical: upload results without metadata
+            // The upload TARGET (the API/system under test runs belong to — ADR 0007)
+            // was resolved + validated in the preflight (pre-run, so a misconfigured
+            // destination fails fast); reuse it. The guard is defensive — the preflight
+            // exits on a null target, so this can't normally fire.
+            const targetId = resolvedUploadTargetId;
+            if (!targetId) {
+                console.error(`${colors.red}Upload failed: no upload target resolved.${colors.reset}`);
+                process.exit(1);
             }
-            // Phase 5 5a — attach run-plan provenance to the upload metadata
-            // bucket. Cloud server projects this to top-level RunEntity fields
-            // (see apps/server/src/tasks/helpers/extract-run-plan.ts). Nested
-            // under `metadata` to clear the server DTO's `forbidNonWhitelisted`
-            // top-level gate. Only emitted when:
-            //   1. The run used a profile (no profile → nothing to record).
-            //   2. The scan path produced metadata.
-            // Skipping runPlan in the degraded-scan path is intentional —
-            // synthesizing a runPlan-only shell with `files: {}` would make
-            // the server's upsertTests treat all active tests as "removed"
-            // (authoritative file map = empty). Better to lose runPlan
-            // provenance on degraded scans than to corrupt the test registry.
-            if (metadata && options.profile) {
-                const runPlan = {
-                    profile: options.profile,
+            else {
+                // ── Result blob: the full ExecutionResult, run-data ONLY (per D7 the
+                //    contract/workflow projection is a separate c/f line). Events are
+                //    scope-redacted; the rest of the payload can ALSO carry secrets, so
+                //    scrub it too: `context.command` is raw argv (e.g. `--token glb_…`,
+                //    `--input-json '{"password":…}'`) → dropped outright; `customMetadata`
+                //    is user-supplied → deep-redacted. Without this the blob would store
+                //    those verbatim in Cloud.
+                const { command: _rawCommand, ...safeContext } = runContext ?? {};
+                const redactNonEvent = (v) => redactValue(v, {
+                    globalRules: effectiveRedaction.globalRules,
+                    replacementFormat: effectiveRedaction.replacementFormat,
+                    maxDepth: 64,
+                });
+                const redactedResult = {
+                    ...resultPayload,
+                    context: redactNonEvent(safeContext),
+                    ...(resultPayload.customMetadata
+                        ? { customMetadata: redactNonEvent(resultPayload.customMetadata) }
+                        : {}),
+                    tests: resultPayload.tests.map((t) => ({
+                        ...t,
+                        events: t.events.map((e) => redactEvent(e, compiledScopes, effectiveRedaction.replacementFormat)),
+                    })),
                 };
-                if (options.suites && options.suites.length > 0) {
-                    runPlan.suites = options.suites;
+                // ── Analytics substrate. Server derive-on-ingest (plan D2) isn't built
+                //    yet, so the CLI sends per-test rows + metric points explicitly.
+                const testResults = collectedRuns.map((r) => ({
+                    testId: r.testId,
+                    name: r.testName,
+                    // Mirror the CLI's own pass/fail/skip classification: a clean skip
+                    // (success:true + a status:"skipped" event) → "skipped" (excluded from
+                    // flaky denominators, plan D3). A test that FAILED then emitted skip is
+                    // counted as failed (success:false), so gate skip on success first —
+                    // otherwise the failure would wrongly drop out of the denominators.
+                    status: r.success
+                        ? r.events.some((e) => e.type === "status" && e.status === "skipped")
+                            ? "skipped"
+                            : "passed"
+                        : "failed",
+                    durationMs: r.durationMs,
+                    ...(r.tags && r.tags.length ? { tags: r.tags } : {}),
+                    eventCount: r.events.length,
+                }));
+                // Metric tags (method/path) can in rare cases embed a secret in a path
+                // segment — redact them with the same engine the projection line uses.
+                const redactTags = (tags) => tags
+                    ? redactValue(tags, {
+                        globalRules: effectiveRedaction.globalRules,
+                        replacementFormat: effectiveRedaction.replacementFormat,
+                    })
+                    : undefined;
+                const metrics = [];
+                for (const r of collectedRuns) {
+                    for (const e of r.events) {
+                        if (e.type !== "metric")
+                            continue;
+                        // Skip valueless metric events: the server requires a finite numeric
+                        // value, and one bad point must not reject the whole run's upload.
+                        if (!Number.isFinite(e.value))
+                            continue;
+                        metrics.push({
+                            name: e.name,
+                            value: e.value,
+                            ...(e.unit ? { unit: e.unit } : {}),
+                            ...(e.tags ? { tags: redactTags(e.tags) } : {}),
+                            testId: r.testId,
+                        });
+                    }
+                }
+                const input = {
+                    kind: "test",
+                    schemaVersion: "glubean.test.v1",
+                    // Stable idempotency id for this run — reused across the upload retry so
+                    // a lost-response retry replaces this run instead of duplicating it (P1).
+                    clientRunId: randomUUID(),
+                    // A breached metric threshold fails the run (mirrors the process exit
+                    // below) even when every test passed — don't record it as "passed".
+                    status: failed > 0 || (thresholdSummary && !thresholdSummary.pass) ? "failed" : "passed",
+                    startedAt: runStartTime,
+                    completedAt: new Date(Date.parse(runStartTime) + totalDurationMs).toISOString(),
+                    durationMs: totalDurationMs,
+                    summary: {
+                        total: passed + failed + skipped,
+                        passed,
+                        failed,
+                        skipped,
+                        durationMs: totalDurationMs,
+                        // Run-plan provenance (was metadata.runPlan). The summary jsonb keeps
+                        // extras (SUMMARY_SCHEMA catchall), so profile/suite facets survive
+                        // for grouping even though the new run row has no dedicated columns.
+                        ...(options.profile ? { profile: options.profile } : {}),
+                        ...(options.suites && options.suites.length ? { suites: options.suites } : {}),
+                    },
+                    result: redactedResult,
+                    ...(testResults.length ? { testResults } : {}),
+                    ...(metrics.length ? { metrics } : {}),
+                };
+                const uploadReceipt = await uploadToCloud(input, {
+                    apiUrl,
+                    token,
+                    projectId,
+                    targetId,
+                    envFile: effectiveRun.envFile,
+                    rootDir,
+                });
+                if (options.uploadReceiptJson) {
+                    const receiptPath = resolveOutputPath(options.uploadReceiptJson, process.cwd());
+                    await mkdir(dirname(receiptPath), { recursive: true });
+                    await writeFile(receiptPath, JSON.stringify(uploadReceipt, null, 2) + "\n", "utf-8");
+                    console.log(`${colors.dim}Upload receipt written to: ${receiptPath}${colors.reset}`);
+                }
+                // A requested --upload that didn't create a run is a failure, even on a
+                // green test run — exit non-zero so CI doesn't read false-green. (The
+                // receipt is written above first, so the failure is still recorded.)
+                if (uploadReceipt.resultUpload.status === "failed") {
+                    console.error(`${colors.red}Upload failed: the run was not recorded in Cloud (see the error above).${colors.reset}`);
+                    process.exit(1);
                 }
-                metadata = { ...metadata, runPlan };
-            }
-            // Deep-redact the FULL contract + workflow projection before upload. Test
-            // events are redacted below via scope-based `redactEvent`, but the
-            // projection is a free-form tree that can carry secrets anywhere
-            // (examples, default headers, gRPC metadata, `extensions`/`meta`, literal
-            // compare/switch values, assertion messages). `redactMetadataForUpload`
-            // redacts ONLY the projection buckets (contractsProjection + workflows) —
-            // never `files`/`rootHash` — so the server's test registry/dedup keeps
-            // its verbatim sha256 hashes. The projection is uploaded WHOLE (branch/
-            // poll included): it is the lossless source for the server snapshot, not
-            // a run view (see the buildMetadata R14 note); the branch/poll run-view
-            // gate is a separate layer, untouched here.
-            if (metadata) {
-                metadata = await redactMetadataForUpload(metadata, effectiveRedaction);
-            }
-            const redactedPayload = {
-                ...resultPayload,
-                metadata,
-                tests: resultPayload.tests.map((t) => ({
-                    ...t,
-                    events: t.events.map((e) => redactEvent(e, compiledScopes, effectiveRedaction.replacementFormat)),
-                })),
-            };
-            const uploadReceipt = await uploadToCloud(redactedPayload, {
-                apiUrl,
-                token,
-                projectId,
-                envFile: effectiveRun.envFile,
-                rootDir,
-            });
-            if (options.uploadReceiptJson) {
-                const receiptPath = resolveOutputPath(options.uploadReceiptJson, process.cwd());
-                await mkdir(dirname(receiptPath), { recursive: true });
-                await writeFile(receiptPath, JSON.stringify(uploadReceipt, null, 2) + "\n", "utf-8");
-                console.log(`${colors.dim}Upload receipt written to: ${receiptPath}${colors.reset}`);
             }
         }
     }