@glubean/cli 0.8.4 → 0.9.1

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@glubean/cli",
-  "version": "0.8.4",
+  "version": "0.9.1",
   "engines": {
     "node": ">=22"
   },
@@ -28,12 +28,12 @@
     "@inquirer/prompts": "^7.0.0",
     "archiver": "^7.0.0",
     "dotenv": "^16.4.0",
-    "tsx": "^4.19.0",
+    "tsx": "^4.22.4",
     "yaml": "^2.7.0",
-    "@glubean/sdk": "0.8.4",
-    "@glubean/scanner": "0.8.4",
-    "@glubean/runner": "0.8.4",
-    "@glubean/redaction": "0.8.4"
+    "@glubean/sdk": "0.9.1",
+    "@glubean/scanner": "0.9.1",
+    "@glubean/runner": "0.9.1",
+    "@glubean/redaction": "0.9.1"
   },
   "peerDependencies": {
     "typescript": "^5.0.0"
@@ -47,7 +47,7 @@
     "@types/node": "^22.0.0",
     "@types/archiver": "^6.0.0",
     "typescript": "^5.9.3",
-    "@glubean/graphql": "0.8.4"
+    "@glubean/graphql": "0.9.1"
   },
   "repository": {
     "type": "git",

package/templates/demo/gitignore.tpl

@@ -9,5 +9,8 @@ node_modules/
 .env
 .env.local
 
+# Result files (generated by glubean run / VS Code extension)
+*.result.json
+
 *.log
 .DS_Store

package/dist/lib/redact-metadata.d.ts

@@ -1,47 +0,0 @@
-import type { RedactionConfig } from "@glubean/redaction";
-import type { UploadResultPayload } from "./upload.js";
-type UploadMetadata = NonNullable<UploadResultPayload["metadata"]>;
-/**
- * Deep-redact the FULL contract/workflow projection buckets of an upload
- * metadata object before it leaves the machine.
- *
- * Only `contractsProjection` and `workflows` are redacted — they are free-form
- * trees that can carry secrets at any path (examples, default headers, gRPC
- * metadata, `extensions`/`meta` blobs, literal compare/switch values, assertion
- * messages). Everything else is returned untouched; in particular
- * `files[].hash` / `rootHash` MUST survive verbatim, since the `hexKeys`
- * pattern would otherwise mangle their sha256 hex and corrupt the server's
- * test registry + dedup.
- *
- * Returns a new object when redaction applies; the input is never mutated.
- * When neither projection bucket is present the input is returned as-is.
- * A generous `maxDepth` keeps nested JSON Schemas / recursive workflow branch
- * trees from truncating to a `[REDACTED: too deep]` sentinel.
- *
- * rootHash consistency (codex 0.6 P2): `workflows` participate in `rootHash`
- * (see metadata.ts `computeRootHash`), but `buildMetadata` hashed the
- * UNREDACTED workflows. Redacting them here would leave a payload whose
- * rootHash no longer matches its own `workflows`, so when workflows are
- * present we recompute rootHash over the redacted projection — the uploaded
- * payload stays self-consistent for any receiver that verifies it.
- * (`contractsProjection` is NOT part of rootHash, so its redaction is moot.)
- * This makes the function async.
- *
- * Redaction model (same engine as event redaction, config-driven):
- *  - Only SCALARS (string/number) are ever masked. A sensitive key over an
- *    object/array is RECURSED into, never replaced wholesale — so JSON-Schema
- *    nodes (`properties.password = { type: "string" }`) keep their shape.
- *  - A scalar is masked when its own key is sensitive (built-in baseline +
- *    scope keys + the project's `globalRules.sensitiveKeys`) OR its value
- *    matches a value pattern (jwt/bearer/email/…).
- *  - BOUNDARY: a secret nested under a sensitive key but keyed by a
- *    NON-sensitive inner name (e.g. `authorization: { value: "sk_live…" }`)
- *    is NOT auto-masked. That is by design — like events, such project-specific
- *    shapes are declared in the redaction config (`sensitiveKeys` /
- *    `customPatterns`), not hard-coded here. In practice nested secrets
- *    usually sit under a sensitive inner key (`token`/`password`/`secret`)
- *    and ARE caught.
- */
-export declare function redactMetadataForUpload(metadata: UploadMetadata, redaction: Pick<RedactionConfig, "globalRules" | "replacementFormat">): Promise<UploadMetadata>;
-export {};
-//# sourceMappingURL=redact-metadata.d.ts.map

package/dist/lib/redact-metadata.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"redact-metadata.d.ts","sourceRoot":"","sources":["../../src/lib/redact-metadata.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AAE1D,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAC;AAEvD,KAAK,cAAc,GAAG,WAAW,CAAC,mBAAmB,CAAC,UAAU,CAAC,CAAC,CAAC;AAanE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwCG;AACH,wBAAsB,uBAAuB,CAC3C,QAAQ,EAAE,cAAc,EACxB,SAAS,EAAE,IAAI,CAAC,eAAe,EAAE,aAAa,GAAG,mBAAmB,CAAC,GACpE,OAAO,CAAC,cAAc,CAAC,CAsCzB"}

package/dist/lib/redact-metadata.js

@@ -1,84 +0,0 @@
-import { redactValue, BUILTIN_SCOPES } from "@glubean/redaction";
-import { computeRootHash } from "../metadata.js";
-/**
- * Union of every sensitive key declared across the built-in event scopes
- * (e.g. `authorization`, `cookie`, `set-cookie`, `x-api-key`). The metadata
- * projection has no single event type to scope by, so we apply ALL of them
- * (plus the built-in baseline, enabled inside `redactValue`) — ensuring the
- * projection is redacted at least as strongly as the events it accompanies.
- */
-const SCOPE_SENSITIVE_KEYS = [
-    ...new Set(BUILTIN_SCOPES.flatMap((s) => s.rules?.sensitiveKeys ?? [])),
-];
-/**
- * Deep-redact the FULL contract/workflow projection buckets of an upload
- * metadata object before it leaves the machine.
- *
- * Only `contractsProjection` and `workflows` are redacted — they are free-form
- * trees that can carry secrets at any path (examples, default headers, gRPC
- * metadata, `extensions`/`meta` blobs, literal compare/switch values, assertion
- * messages). Everything else is returned untouched; in particular
- * `files[].hash` / `rootHash` MUST survive verbatim, since the `hexKeys`
- * pattern would otherwise mangle their sha256 hex and corrupt the server's
- * test registry + dedup.
- *
- * Returns a new object when redaction applies; the input is never mutated.
- * When neither projection bucket is present the input is returned as-is.
- * A generous `maxDepth` keeps nested JSON Schemas / recursive workflow branch
- * trees from truncating to a `[REDACTED: too deep]` sentinel.
- *
- * rootHash consistency (codex 0.6 P2): `workflows` participate in `rootHash`
- * (see metadata.ts `computeRootHash`), but `buildMetadata` hashed the
- * UNREDACTED workflows. Redacting them here would leave a payload whose
- * rootHash no longer matches its own `workflows`, so when workflows are
- * present we recompute rootHash over the redacted projection — the uploaded
- * payload stays self-consistent for any receiver that verifies it.
- * (`contractsProjection` is NOT part of rootHash, so its redaction is moot.)
- * This makes the function async.
- *
- * Redaction model (same engine as event redaction, config-driven):
- *  - Only SCALARS (string/number) are ever masked. A sensitive key over an
- *    object/array is RECURSED into, never replaced wholesale — so JSON-Schema
- *    nodes (`properties.password = { type: "string" }`) keep their shape.
- *  - A scalar is masked when its own key is sensitive (built-in baseline +
- *    scope keys + the project's `globalRules.sensitiveKeys`) OR its value
- *    matches a value pattern (jwt/bearer/email/…).
- *  - BOUNDARY: a secret nested under a sensitive key but keyed by a
- *    NON-sensitive inner name (e.g. `authorization: { value: "sk_live…" }`)
- *    is NOT auto-masked. That is by design — like events, such project-specific
- *    shapes are declared in the redaction config (`sensitiveKeys` /
- *    `customPatterns`), not hard-coded here. In practice nested secrets
- *    usually sit under a sensitive inner key (`token`/`password`/`secret`)
- *    and ARE caught.
- */
-export async function redactMetadataForUpload(metadata, redaction) {
-    if (!metadata.contractsProjection && !metadata.workflows)
-        return metadata;
-    const redact = (v) => redactValue(v, {
-        globalRules: redaction.globalRules,
-        // Built-in baseline (password/token/authorization/…) is enabled by
-        // default inside redactValue; add the scope-declared keys on top so a
-        // default config (empty globalRules.sensitiveKeys) still masks
-        // key-based secrets the value patterns would miss.
-        sensitiveKeys: SCOPE_SENSITIVE_KEYS,
-        replacementFormat: redaction.replacementFormat,
-        maxDepth: 64,
-    });
-    const redactedWorkflows = metadata.workflows
-        ? redact(metadata.workflows)
-        : undefined;
-    const result = {
-        ...metadata,
-        ...(metadata.contractsProjection
-            ? { contractsProjection: redact(metadata.contractsProjection) }
-            : {}),
-        ...(redactedWorkflows ? { workflows: redactedWorkflows } : {}),
-    };
-    // workflows are hashed into rootHash; recompute over the redacted projection
-    // so the uploaded payload is self-consistent (see the doc comment above).
-    if (redactedWorkflows && metadata.rootHash !== undefined) {
-        result.rootHash = await computeRootHash(result.files, result.contracts, redactedWorkflows);
-    }
-    return result;
-}
-//# sourceMappingURL=redact-metadata.js.map

package/dist/lib/redact-metadata.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"redact-metadata.js","sourceRoot":"","sources":["../../src/lib/redact-metadata.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AAEjE,OAAO,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC;AAKjD;;;;;;GAMG;AACH,MAAM,oBAAoB,GAAa;IACrC,GAAG,IAAI,GAAG,CAAC,cAAc,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,EAAE,aAAa,IAAI,EAAE,CAAC,CAAC;CACxE,CAAC;AAEF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwCG;AACH,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,QAAwB,EACxB,SAAqE;IAErE,IAAI,CAAC,QAAQ,CAAC,mBAAmB,IAAI,CAAC,QAAQ,CAAC,SAAS;QAAE,OAAO,QAAQ,CAAC;IAE1E,MAAM,MAAM,GAAG,CAAC,CAAU,EAAW,EAAE,CACrC,WAAW,CAAC,CAAC,EAAE;QACb,WAAW,EAAE,SAAS,CAAC,WAAW;QAClC,mEAAmE;QACnE,sEAAsE;QACtE,+DAA+D;QAC/D,mDAAmD;QACnD,aAAa,EAAE,oBAAoB;QACnC,iBAAiB,EAAE,SAAS,CAAC,iBAAiB;QAC9C,QAAQ,EAAE,EAAE;KACb,CAAC,CAAC;IAEL,MAAM,iBAAiB,GAAG,QAAQ,CAAC,SAAS;QAC1C,CAAC,CAAE,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAe;QAC3C,CAAC,CAAC,SAAS,CAAC;IAEd,MAAM,MAAM,GAAmB;QAC7B,GAAG,QAAQ;QACX,GAAG,CAAC,QAAQ,CAAC,mBAAmB;YAC9B,CAAC,CAAC,EAAE,mBAAmB,EAAE,MAAM,CAAC,QAAQ,CAAC,mBAAmB,CAAc,EAAE;YAC5E,CAAC,CAAC,EAAE,CAAC;QACP,GAAG,CAAC,iBAAiB,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,iBAAiB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC/D,CAAC;IAEF,6EAA6E;IAC7E,0EAA0E;IAC1E,IAAI,iBAAiB,IAAI,QAAQ,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;QACzD,MAAM,CAAC,QAAQ,GAAG,MAAM,eAAe,CACrC,MAAM,CAAC,KAA8C,EACrD,MAAM,CAAC,SAAS,EAChB,iBAAiB,CAClB,CAAC;IACJ,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC"}