@hardfin/cli 0.1.0-dev.25 → 0.1.0-dev.27

package/dist/scrub-VtQmxap1.js

@@ -0,0 +1,108 @@
+#!/usr/bin/env node
+import { z } from "zod";
+import { homedir } from "node:os";
+//#region src/command/registry.ts
+/** ExitCode is what the process returns, and what an agent branches on. */
+const ExitCode = {
+	OK: 0,
+	ERROR: 1,
+	USAGE: 2,
+	NOT_AUTHENTICATED: 4,
+	INTERRUPTED: 130
+};
+/** defineCommand records one command so every surface reads the same declaration. */
+function defineCommand(command) {
+	return command;
+}
+/** GLOBAL_FLAGS are the options the CLI takes before any command. */
+const GLOBAL_FLAGS = [{
+	name: "api-url",
+	description: "The API to call, whose host also holds the authorization server",
+	valueName: "url",
+	schema: z.string()
+}, {
+	name: "issuer-url",
+	description: "The authorization server, when it does not sit at the API's host",
+	valueName: "url",
+	schema: z.string()
+}];
+//#endregion
+//#region src/report/scrub.ts
+const REDACTED = "[redacted]";
+/**
+* The shapes a secret takes when it is not one this process knows by value: a bearer
+* credential, a JWT, and a token or key carried in a query string or form.
+*/
+const SECRET_PATTERNS = [
+	/(Bearer|Basic)\s+[^\s"',]+/gi,
+	/eyJ[\w-]+\.[\w-]+\.[\w-]+/g,
+	/((?:access_token|refresh_token|id_token|code|client_secret|api_key|apikey|token|key)=)[^&\s"']+/gi
+];
+/**
+* toScrubbed removes what a report must never carry from a piece of text. The secrets this
+* process holds are removed by value, the rest by shape, and the home directory becomes ~ so
+* a path does not name the person.
+*/
+function toScrubbed(text, secrets = [], home = homedir()) {
+	let scrubbed = text;
+	for (const secret of secrets) if (secret.length >= 8) scrubbed = scrubbed.split(secret).join(REDACTED);
+	for (const pattern of SECRET_PATTERNS) scrubbed = scrubbed.replace(pattern, (match, prefix) => prefix && match.startsWith(prefix) && prefix.endsWith("=") ? `${prefix}${REDACTED}` : REDACTED);
+	return home.length > 1 ? scrubbed.split(home).join("~") : scrubbed;
+}
+/** The options every command answers, beside the ones it declares. */
+const ALWAYS = [{
+	name: "help",
+	short: "h",
+	description: "Print help for the command",
+	schema: z.boolean()
+}, {
+	name: "version",
+	short: "v",
+	description: "Print the version",
+	schema: z.boolean()
+}];
+/**
+* toInvocation reads the command and the flag names from the words a person typed. Only a
+* word naming a flag the command has is kept, so a value that happens to start with a dash,
+* such as -500, is never sent. Values and arguments are left out, because they can hold
+* customer data.
+*/
+function toInvocation(commands, args) {
+	const path = [];
+	const flags = [];
+	let available = commands;
+	let known = [...GLOBAL_FLAGS, ...ALWAYS];
+	let isValueNext = false;
+	for (const word of args) {
+		if (isValueNext) {
+			isValueNext = false;
+			continue;
+		}
+		const flag = word.startsWith("-") ? toFlag(known, word.split("=")[0] ?? word) : void 0;
+		if (flag) {
+			flags.push(word.split("=")[0] ?? word);
+			isValueNext = flag.valueName !== void 0 && !word.includes("=");
+			continue;
+		}
+		const found = available.find((command) => command.name === word);
+		if (found) {
+			path.push(found.name);
+			available = found.subcommands ?? [];
+			known = [...found.flags, ...ALWAYS];
+		}
+	}
+	return {
+		command: path.join(" ") || "(none)",
+		flags
+	};
+}
+/** toFlag finds the flag a word names, whether long, short, or the --no- form of a boolean. */
+function toFlag(flags, word) {
+	if (word.startsWith("--")) {
+		const name = word.slice(2);
+		return flags.find((flag) => flag.name === name || flag.negatable === true && `no-${flag.name}` === name);
+	}
+	return flags.find((flag) => flag.short !== void 0 && `-${flag.short}` === word);
+}
+//#endregion
+export { defineCommand as a, GLOBAL_FLAGS as i, toScrubbed as n, ExitCode as r, toInvocation as t };