@gurulu/cli 0.4.3 → 0.4.4

package/dist/commands/secrets.js

@@ -0,0 +1,145 @@
+"use strict";
+/**
+ * CLI@0.4.4 — `gurulu secrets` — list & rotate keys in the tenant credential vault.
+ *
+ * Subcommands:
+ *   gurulu secrets list                       (key names only — never values)
+ *   gurulu secrets rotate --key API_TOKEN     (issues new value, keeps old in 24h grace window)
+ *
+ * TODO(Sprint K): backend endpoints below are not yet live. The CLI command
+ * surface is implemented now so customers can wire automation.
+ *   - GET   /api/cli/secrets/list                     -> { secrets: [{ key, lastRotatedAt, rotationStatus }] }
+ *   - POST  /api/cli/secrets/rotate { key }           -> { key, newRevealedOnce: string, graceUntil: ISO }
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.secretsCommand = secretsCommand;
+const config_1 = require("../config");
+const api_client_1 = require("../api-client");
+const ui_1 = require("../utils/ui");
+const redact_1 = require("../utils/redact");
+async function secretsCommand(args) {
+    // Defensive — never echo args wholesale in any future debug path.
+    if (process.env.GURULU_DEBUG === '1') {
+        console.log(`[debug] secrets args: ${JSON.stringify((0, redact_1.redactSensitiveArgs)({ ...args }))}`);
+    }
+    switch (args.action) {
+        case 'list':
+            return secretsList(args);
+        case 'rotate':
+            return secretsRotate(args);
+        default:
+            (0, ui_1.error)(`Unknown action: ${args.action}. Use: list, rotate`);
+            process.exit(1);
+    }
+}
+async function loadProfileOrExit(args) {
+    try {
+        return await (0, config_1.loadActiveProfile)({ profile: args.profile });
+    }
+    catch {
+        (0, ui_1.error)('Not authenticated. Run "gurulu login" first.');
+        process.exit(1);
+    }
+}
+function emitFallbackNotice(json) {
+    if (json)
+        return;
+    (0, ui_1.info)((0, ui_1.dim)('Note: backend endpoint not yet live (Sprint K candidate). Command-shape is stable.'));
+}
+// ── list ───────────────────────────────────────────────────────────────────
+async function secretsList(args) {
+    const profile = await loadProfileOrExit(args);
+    try {
+        const res = await (0, api_client_1.cliApi)('/api/cli/secrets/list', { preloadedProfile: profile });
+        const data = await res.json().catch(() => ({}));
+        if (res.status === 404) {
+            emitFallbackNotice(args.json);
+            if (args.json)
+                console.log(JSON.stringify({ ok: false, pending: true, secrets: [] }));
+            else
+                (0, ui_1.info)('Pending: would list tenant secrets (key names only).');
+            return;
+        }
+        if (!res.ok) {
+            const msg = data.message || data.error || `HTTP ${res.status}`;
+            if (args.json)
+                console.log(JSON.stringify({ ok: false, error: msg }));
+            else
+                (0, ui_1.error)(msg);
+            process.exit(1);
+        }
+        if (args.json) {
+            console.log(JSON.stringify(data, null, 2));
+            return;
+        }
+        const secrets = data.secrets || [];
+        if (secrets.length === 0) {
+            (0, ui_1.info)('No secrets in this tenant vault.');
+            return;
+        }
+        console.log((0, ui_1.bold)('Secrets (values are never exposed):'));
+        for (const s of secrets) {
+            const rotated = s.lastRotatedAt ? (0, ui_1.dim)(`  rotated ${s.lastRotatedAt}`) : '';
+            const status = s.rotationStatus ? (0, ui_1.dim)(`  [${s.rotationStatus}]`) : '';
+            (0, ui_1.step)(`${s.key}${rotated}${status}`);
+        }
+    }
+    catch (err) {
+        if (args.json)
+            console.log(JSON.stringify({ ok: false, error: err.message }));
+        else
+            (0, ui_1.error)(`Failed: ${err.message}`);
+        process.exit(1);
+    }
+}
+// ── rotate ─────────────────────────────────────────────────────────────────
+async function secretsRotate(args) {
+    if (!args.key) {
+        (0, ui_1.error)('Usage: gurulu secrets rotate --key <KEY_NAME>');
+        process.exit(1);
+    }
+    const profile = await loadProfileOrExit(args);
+    try {
+        const res = await (0, api_client_1.cliApi)('/api/cli/secrets/rotate', {
+            method: 'POST',
+            body: JSON.stringify({ key: args.key }),
+            preloadedProfile: profile,
+        });
+        const data = await res.json().catch(() => ({}));
+        if (res.status === 404) {
+            emitFallbackNotice(args.json);
+            if (args.json)
+                console.log(JSON.stringify({ ok: false, pending: true, key: args.key }));
+            else
+                (0, ui_1.info)(`Pending: would rotate ${args.key} (24h grace window).`);
+            return;
+        }
+        if (!res.ok) {
+            const msg = data.message || data.error || `HTTP ${res.status}`;
+            if (args.json)
+                console.log(JSON.stringify({ ok: false, error: msg }));
+            else
+                (0, ui_1.error)(msg);
+            process.exit(1);
+        }
+        if (args.json) {
+            console.log(JSON.stringify(data, null, 2));
+            return;
+        }
+        (0, ui_1.success)(`Rotated ${args.key}`);
+        if (data.newRevealedOnce) {
+            (0, ui_1.warn)('New value (shown ONCE — store it now, you cannot retrieve it again):');
+            console.log(`  ${(0, ui_1.bold)(data.newRevealedOnce)}`);
+        }
+        if (data.graceUntil) {
+            (0, ui_1.info)(`Old value remains valid until: ${data.graceUntil}`);
+        }
+    }
+    catch (err) {
+        if (args.json)
+            console.log(JSON.stringify({ ok: false, error: err.message }));
+        else
+            (0, ui_1.error)(`Failed: ${err.message}`);
+        process.exit(1);
+    }
+}

package/dist/commands/upgrade.d.ts

@@ -0,0 +1,21 @@
+/**
+ * FA-1 P1-4 — `gurulu upgrade` command.
+ *
+ * Bumps installed @gurulu/* packages to the latest version published on npm.
+ * Reads current versions from `npm ls --depth=0 --json` so it works regardless
+ * of which package manager is in use, then dispatches to the same `pm`
+ * detection install.ts uses (npm/pnpm/yarn/bun) for the actual upgrade.
+ *
+ * Usage:
+ *   gurulu upgrade                    # default: bump @gurulu/web
+ *   gurulu upgrade --package=@gurulu/cli
+ *   gurulu upgrade --all              # bump @gurulu/cli + @gurulu/node + @gurulu/web
+ *   gurulu upgrade --dry-run          # show plan without executing
+ */
+export interface UpgradeArgs {
+    package?: string;
+    all?: boolean;
+    dryRun?: boolean;
+    path?: string;
+}
+export declare function upgradeCommand(args: UpgradeArgs): Promise<void>;

package/dist/commands/upgrade.js

@@ -0,0 +1,183 @@
+"use strict";
+/**
+ * FA-1 P1-4 — `gurulu upgrade` command.
+ *
+ * Bumps installed @gurulu/* packages to the latest version published on npm.
+ * Reads current versions from `npm ls --depth=0 --json` so it works regardless
+ * of which package manager is in use, then dispatches to the same `pm`
+ * detection install.ts uses (npm/pnpm/yarn/bun) for the actual upgrade.
+ *
+ * Usage:
+ *   gurulu upgrade                    # default: bump @gurulu/web
+ *   gurulu upgrade --package=@gurulu/cli
+ *   gurulu upgrade --all              # bump @gurulu/cli + @gurulu/node + @gurulu/web
+ *   gurulu upgrade --dry-run          # show plan without executing
+ */
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.upgradeCommand = upgradeCommand;
+const path = __importStar(require("path"));
+const child_process_1 = require("child_process");
+const ui_1 = require("../utils/ui");
+const install_1 = require("./install");
+const DEFAULT_PACKAGES = ['@gurulu/cli', '@gurulu/node', '@gurulu/web'];
+function runCmd(cmd, args, opts = {}) {
+    return new Promise((resolve) => {
+        const child = (0, child_process_1.spawn)(cmd, args, {
+            cwd: opts.cwd,
+            stdio: ['ignore', 'pipe', 'pipe'],
+            shell: process.platform === 'win32',
+        });
+        let stdout = '';
+        let stderr = '';
+        child.stdout.on('data', (c) => (stdout += c.toString()));
+        child.stderr.on('data', (c) => (stderr += c.toString()));
+        child.on('close', (code) => resolve({ code: code ?? 0, stdout, stderr }));
+        child.on('error', (err) => resolve({ code: 1, stdout, stderr: String(err) }));
+    });
+}
+async function getCurrentVersion(repoRoot, pkg) {
+    // `npm ls --depth=0 --json` works in any project regardless of which PM
+    // wrote the lockfile (npm reads node_modules directly). When the package
+    // is missing from node_modules the JSON is still valid; we just see no
+    // entry under `dependencies`.
+    const res = await runCmd('npm', ['ls', pkg, '--depth=0', '--json'], { cwd: repoRoot });
+    if (!res.stdout)
+        return null;
+    try {
+        const parsed = JSON.parse(res.stdout);
+        const dep = parsed.dependencies && parsed.dependencies[pkg];
+        if (dep && typeof dep.version === 'string')
+            return dep.version;
+        return null;
+    }
+    catch {
+        return null;
+    }
+}
+async function getLatestVersion(pkg) {
+    const res = await runCmd('npm', ['view', pkg, 'version']);
+    if (res.code !== 0)
+        return null;
+    const v = res.stdout.trim();
+    return v || null;
+}
+function pmUpgradeArgs(pm, pkg) {
+    if (pm === 'pnpm')
+        return ['update', '--latest', pkg];
+    if (pm === 'yarn')
+        return ['upgrade', `${pkg}@latest`];
+    if (pm === 'bun')
+        return ['update', pkg];
+    return ['install', `${pkg}@latest`];
+}
+function compareSemver(a, b) {
+    // Returns -1 if a < b, 0 if equal, 1 if a > b. Strips any leading `v` and
+    // pre-release suffixes ("1.2.3-rc.1" → ["1","2","3"]).
+    const norm = (s) => s
+        .replace(/^v/, '')
+        .split('-')[0]
+        .split('.')
+        .map((n) => parseInt(n, 10) || 0);
+    const aa = norm(a);
+    const bb = norm(b);
+    for (let i = 0; i < Math.max(aa.length, bb.length); i++) {
+        const x = aa[i] || 0;
+        const y = bb[i] || 0;
+        if (x < y)
+            return -1;
+        if (x > y)
+            return 1;
+    }
+    return 0;
+}
+async function upgradeCommand(args) {
+    const repoRoot = path.resolve(args.path || process.cwd());
+    const targets = args.all
+        ? DEFAULT_PACKAGES
+        : [args.package || '@gurulu/web'];
+    (0, ui_1.info)(`${(0, ui_1.bold)('gurulu upgrade')} — checking ${targets.length} package(s) in ${(0, ui_1.cyan)(repoRoot)}`);
+    const pm = (0, install_1.detectPackageManager)(repoRoot);
+    (0, ui_1.step)(`Package manager: ${(0, ui_1.bold)(pm)}`);
+    const plans = [];
+    for (const pkg of targets) {
+        const [current, latest] = await Promise.all([
+            getCurrentVersion(repoRoot, pkg),
+            getLatestVersion(pkg),
+        ]);
+        plans.push({ pkg, current, latest });
+    }
+    const toBump = [];
+    for (const p of plans) {
+        if (!p.latest) {
+            (0, ui_1.warn)(`${p.pkg}: could not resolve latest version (npm view failed).`);
+            continue;
+        }
+        if (!p.current) {
+            (0, ui_1.info)(`${p.pkg}: not installed — skipping (run \`gurulu install\` first).`);
+            continue;
+        }
+        const cmp = compareSemver(p.current, p.latest);
+        if (cmp >= 0) {
+            (0, ui_1.success)(`${p.pkg}: up-to-date (${p.current})`);
+            continue;
+        }
+        (0, ui_1.info)(`${p.pkg}: ${(0, ui_1.dim)(p.current)} → ${(0, ui_1.cyan)(p.latest)}`);
+        toBump.push(p);
+    }
+    if (toBump.length === 0) {
+        (0, ui_1.success)('All packages up-to-date.');
+        return;
+    }
+    if (args.dryRun) {
+        (0, ui_1.info)(`Dry-run: would upgrade ${toBump.length} package(s).`);
+        return;
+    }
+    let failures = 0;
+    for (const p of toBump) {
+        (0, ui_1.step)(`Upgrading ${p.pkg} via ${pm}...`);
+        const res = await runCmd(pm, pmUpgradeArgs(pm, p.pkg), { cwd: repoRoot });
+        if (res.code !== 0) {
+            failures++;
+            (0, ui_1.error)(`${pm} upgrade failed for ${p.pkg} (exit ${res.code}): ${res.stderr.trim()}`);
+        }
+        else {
+            (0, ui_1.success)(`${p.pkg} upgraded.`);
+        }
+    }
+    if (failures > 0) {
+        process.exit(1);
+    }
+}

package/dist/index.js

@@ -18,6 +18,7 @@ const status_1 = require("./commands/status");
 const doctor_1 = require("./commands/doctor");
 const add_server_1 = require("./commands/add-server");
 const install_1 = require("./commands/install");
+const upgrade_1 = require("./commands/upgrade");
 const warehouse_1 = require("./commands/warehouse");
 // Phase 19.5 W2 — Read-surface subcommands
 const audiences_1 = require("./commands/audiences");
@@ -48,9 +49,19 @@ const skad_1 = require("./commands/skad");
 const errors_1 = require("./commands/errors");
 const replay_1 = require("./commands/replay");
 const conversion_paths_1 = require("./commands/conversion-paths");
+// CLI@0.4.4 — consent + secrets management
+const consent_1 = require("./commands/consent");
+const secrets_1 = require("./commands/secrets");
 (0, yargs_1.default)((0, helpers_1.hideBin)(process.argv))
     .scriptName('gurulu')
     .option('profile', { type: 'string', describe: 'Use a specific profile (default: personal)' })
+    // FA-1 P0-5 — GDPR consent. Also honored via env vars: GURULU_TELEMETRY=off
+    // (or 0/false/no) and DO_NOT_TRACK=1, plus persisted choice in
+    // ~/.gurulu/config.json (`telemetry: false`).
+    .option('no-telemetry', {
+    type: 'boolean',
+    describe: 'Disable anonymous install telemetry for this run',
+})
     .command('init', 'Set up Gurulu analytics in your project', (y) => y
     .option('site-id', { type: 'string', describe: 'Site ID' })
     .option('token', { type: 'string', describe: 'Site token' })
@@ -232,6 +243,10 @@ const conversion_paths_1 = require("./commands/conversion-paths");
     .option('skip-env', { type: 'boolean', describe: 'Skip .env file merge' })
     .option('yes', { type: 'boolean', alias: 'y', describe: 'Non-interactive (assume yes)' })
     .option('ingest-url', { type: 'string', describe: 'Override ingest base URL' })
+    // FA-1 P0-2 — self-hosted tracker tag override. When set, install.ts
+    // forwards this to the agentic-install script so the rendered script
+    // tag points at the customer's own asset host instead of gurulu.io/t.js.
+    .option('script-src', { type: 'string', describe: 'Override tracker tag <script src> URL (self-hosted)' })
     .option('verify', { type: 'boolean', default: false, describe: 'Live smoke test after install (requires playwright-core)' })
     .option('skip-intent', { type: 'boolean', describe: 'Skip install-time intent discovery' })
     .option('intent-dry-run', { type: 'boolean', describe: 'Show intent proposal without pre-seeding' })
@@ -268,6 +283,7 @@ const conversion_paths_1 = require("./commands/conversion-paths");
         skipEnv: args['skip-env'],
         yes: args.yes,
         ingestUrl: args['ingest-url'],
+        scriptSrc: args['script-src'],
         verify: args['skip-verify'] ? false : args.verify,
         profile: args.profile,
         skipIntent: args['skip-intent'],
@@ -277,6 +293,20 @@ const conversion_paths_1 = require("./commands/conversion-paths");
         autoProperties: args['auto-properties'],
     });
 })
+    .command(
+// FA-1 P1-4 — `gurulu upgrade` bumps installed @gurulu/* packages to the
+// latest version published on npm. Defaults to @gurulu/web; `--all` bumps
+// cli + node + web in one pass.
+'upgrade [path]', 'Upgrade installed Gurulu packages to the latest npm version', (y) => y
+    .positional('path', { type: 'string', describe: 'Target project path (default: cwd)' })
+    .option('package', { type: 'string', describe: 'Package to upgrade (default: @gurulu/web)' })
+    .option('all', { type: 'boolean', describe: 'Upgrade @gurulu/cli + @gurulu/node + @gurulu/web' })
+    .option('dry-run', { type: 'boolean', describe: 'Show what would be upgraded' }), (args) => (0, upgrade_1.upgradeCommand)({
+    path: args.path,
+    package: args.package,
+    all: args.all,
+    dryRun: args['dry-run'],
+}))
     .command('warehouse <action>', 'Warehouse exports (BigQuery)', (y) => y
     .positional('action', { type: 'string', describe: 'Action: export' })
     .option('tenant', { type: 'string', describe: 'Tenant id (forward-compat)' })
@@ -465,10 +495,10 @@ const conversion_paths_1 = require("./commands/conversion-paths");
     json: args.json,
     profile: args.profile,
 }))
-    .command('identity <action> [sub]', 'Identity state + writes (decay stats | transfers list | cdc-sources list | identify | alias | merge)', (y) => y
+    .command('identity <action> [sub]', 'Identity state + writes (decay stats | transfers list | cdc-sources list | identify | alias | merge | bulk)', (y) => y
     .positional('action', {
     type: 'string',
-    describe: 'decay | transfers | cdc-sources | identify | alias | merge',
+    describe: 'decay | transfers | cdc-sources | identify | alias | merge | bulk',
 })
     .positional('sub', { type: 'string', describe: 'Subaction (stats, list)' })
     .option('direction', { type: 'string', describe: 'outbound | inbound | all' })
@@ -484,6 +514,10 @@ const conversion_paths_1 = require("./commands/conversion-paths");
     .option('new-user-id', { type: 'string', describe: 'New canonical user id (alias)' })
     .option('canonical-id', { type: 'string', describe: 'Winner canonical profile id (merge)' })
     .option('duplicate-id', { type: 'string', describe: 'Loser canonical profile id (merge)' })
+    // bulk
+    .option('file', { type: 'string', describe: 'Input file path (bulk)' })
+    .option('format', { type: 'string', describe: 'csv | json (bulk; auto-detected from extension)' })
+    .option('resume-from', { type: 'number', describe: 'Skip first N records (bulk)' })
     .option('yes', { type: 'boolean', alias: 'y', describe: 'Skip confirmation' })
     .option('json', { type: 'boolean', describe: 'JSON output' }), (args) => (0, identity_1.identityCommand)({
     action: args.action,
@@ -500,6 +534,9 @@ const conversion_paths_1 = require("./commands/conversion-paths");
     newUserId: args['new-user-id'],
     canonicalId: args['canonical-id'],
     duplicateId: args['duplicate-id'],
+    file: args.file,
+    format: args.format,
+    resumeFrom: args['resume-from'],
     yes: args.yes,
     json: args.json,
     profile: args.profile,
@@ -731,6 +768,32 @@ const conversion_paths_1 = require("./commands/conversion-paths");
     format: args.format,
     json: args.json,
     profile: args.profile,
+}))
+    // ── CLI@0.4.4 — consent (per-user GDPR scopes) ───────────────────────
+    .command('consent <action>', 'Manage per-user consent (set, get, revoke, check)', (y) => y
+    .positional('action', { type: 'string', describe: 'set | get | revoke | check' })
+    .option('user-id', { type: 'string', describe: 'User ID' })
+    .option('scope', { type: 'string', describe: 'Consent scope (e.g. marketing_external, analytics)' })
+    .option('state', { type: 'string', choices: ['granted', 'denied'], describe: 'Consent state (for set)' })
+    .option('destination', { type: 'string', describe: 'Destination key (for check, e.g. capi)' })
+    .option('json', { type: 'boolean', describe: 'JSON output' }), (args) => (0, consent_1.consentCommand)({
+    action: args.action,
+    userId: args['user-id'],
+    scope: args.scope,
+    state: args.state,
+    destination: args.destination,
+    json: args.json,
+    profile: args.profile,
+}))
+    // ── CLI@0.4.4 — secrets vault (list, rotate) ─────────────────────────
+    .command('secrets <action>', 'Tenant credential vault (list, rotate)', (y) => y
+    .positional('action', { type: 'string', describe: 'list | rotate' })
+    .option('key', { type: 'string', describe: 'Secret key name (for rotate)' })
+    .option('json', { type: 'boolean', describe: 'JSON output' }), (args) => (0, secrets_1.secretsCommand)({
+    action: args.action,
+    key: args.key,
+    json: args.json,
+    profile: args.profile,
 }))
     .demandCommand(1, 'Run gurulu --help for available commands')
     .strict()

package/dist/utils/redact.d.ts

@@ -0,0 +1,14 @@
+/**
+ * CLI@0.4.4 — sensitive-arg redaction helper.
+ *
+ * Used before any debug/log/telemetry path that might serialize CLI args.
+ * Mask any key whose name contains password / token / secret / api-key / authorization
+ * (case-insensitive). Returns a shallow clone with offending values replaced
+ * by `***REDACTED***` (or `undefined` when the original was falsy, so the log
+ * does not imply a value was present).
+ */
+export declare function redactSensitiveArgs<T extends Record<string, unknown>>(args: T): T;
+/**
+ * Convenience: produce a JSON string with sensitive fields redacted.
+ */
+export declare function safeStringifyArgs(args: Record<string, unknown>): string;

package/dist/utils/redact.js

@@ -0,0 +1,48 @@
+"use strict";
+/**
+ * CLI@0.4.4 — sensitive-arg redaction helper.
+ *
+ * Used before any debug/log/telemetry path that might serialize CLI args.
+ * Mask any key whose name contains password / token / secret / api-key / authorization
+ * (case-insensitive). Returns a shallow clone with offending values replaced
+ * by `***REDACTED***` (or `undefined` when the original was falsy, so the log
+ * does not imply a value was present).
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.redactSensitiveArgs = redactSensitiveArgs;
+exports.safeStringifyArgs = safeStringifyArgs;
+const SENSITIVE_KEY_RX = /(password|passwd|pwd|token|secret|api[_-]?key|authorization|auth[_-]?token|access[_-]?key|private[_-]?key|client[_-]?secret|session[_-]?token)/i;
+function redactSensitiveArgs(args) {
+    if (!args || typeof args !== 'object')
+        return args;
+    const out = Array.isArray(args)
+        ? [...args]
+        : { ...args };
+    for (const k of Object.keys(out)) {
+        const v = out[k];
+        if (SENSITIVE_KEY_RX.test(k)) {
+            out[k] = v ? '***REDACTED***' : undefined;
+            continue;
+        }
+        // Recurse into nested objects (but not class instances / Buffers / Dates).
+        if (v &&
+            typeof v === 'object' &&
+            !Buffer.isBuffer(v) &&
+            !(v instanceof Date) &&
+            (Object.getPrototypeOf(v) === Object.prototype || Array.isArray(v))) {
+            out[k] = redactSensitiveArgs(v);
+        }
+    }
+    return out;
+}
+/**
+ * Convenience: produce a JSON string with sensitive fields redacted.
+ */
+function safeStringifyArgs(args) {
+    try {
+        return JSON.stringify(redactSensitiveArgs(args));
+    }
+    catch {
+        return '[unserializable]';
+    }
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@gurulu/cli",
-  "version": "0.4.3",
+  "version": "0.4.4",
   "description": "Gurulu.io CLI — setup analytics in seconds",
   "bin": {
     "gurulu": "bin/gurulu.js"

package/scripts/bootstrap-runtime-schema.mjs

@@ -37,29 +37,18 @@ async function retry(fn, label) {
 async function main() {
   console.log('[bootstrap] Starting runtime schema bootstrap...');
 
-  // Step 1/3: Prisma migrate deploy
+  // Step 1/2: Prisma migrate deploy — see /scripts/bootstrap-runtime-schema.mjs
+  // for the FA-11 #3 / Sprint I-ops Faz 2 rationale.
   if (process.env.POSTGRES_AUTO_MIGRATE !== 'false') {
-    console.log('\n[bootstrap] Step 1/3: Prisma migrate deploy');
+    console.log('\n[bootstrap] Step 1/2: Prisma migrate deploy');
     await retry(async () => {
-      try {
-        exec('npx prisma migrate deploy');
-      } catch (err) {
-        if (
-          process.env.PRISMA_MIGRATE_FALLBACK_DB_PUSH !== 'false' &&
-          err.message?.includes('P3005')
-        ) {
-          console.log('[bootstrap] P3005 detected, falling back to db push...');
-          exec('npx prisma db push --accept-data-loss');
-        } else {
-          throw err;
-        }
-      }
+      exec('npx prisma migrate deploy');
     }, 'migrate deploy');
   }
 
-  // Step 2/3: SQL hooks
+  // Step 2/2: SQL hooks
   if (process.env.POSTGRES_AUTO_MIGRATE !== 'false') {
-    console.log('\n[bootstrap] Step 2/3: SQL hooks');
+    console.log('\n[bootstrap] Step 2/2: SQL hooks');
     const hooksDir = join(process.cwd(), 'prisma', 'sql-hooks');
 
     if (existsSync(hooksDir)) {
@@ -77,14 +66,7 @@ async function main() {
       console.log('[bootstrap] No sql-hooks directory found, skipping.');
     }
   }
-
-  // Step 3/3: db push (catch drift)
-  if (process.env.POSTGRES_AUTO_MIGRATE !== 'false') {
-    console.log('\n[bootstrap] Step 3/3: Prisma db push (drift catch)');
-    await retry(async () => {
-      exec('npx prisma db push --accept-data-loss');
-    }, 'db push');
-  }
+  // Step 3/3 (db push drift catch) removed — drift is now a hard fail.
 
   // ClickHouse migration
   if (process.env.CLICKHOUSE_AUTO_MIGRATE !== 'false') {