@hardfin/cli 0.1.1-dev.45 → 0.1.1-dev.48

package/README.md

@@ -511,8 +511,9 @@ A report carries the error, its stack trace, and what `hardfin status` would pri
 moment. The command is named, and its flags are listed by name without their values.
 
 A report never carries tokens, API keys, argument or flag values, request or response bodies,
-people's or organizations' names, your hostname, or your home directory. A person and an
-organization appear only as their Hardfin keys.
+people's or organizations' names, an API key's label, your hostname, or your home directory.
+A person and an organization appear only as their Hardfin keys and IDs. The report names the
+few parts of an identity it carries, so a part the API adds later is left out.
 
 | To                                                | Set                                        |
 | ------------------------------------------------- | ------------------------------------------ |
@@ -640,6 +641,25 @@ report's stack trace then reads as the TypeScript source. The maps are not in th
 publishing skips `prepublishOnly`, so the stamped files are the ones published. The upload
 needs the `SENTRY_AUTH_TOKEN` secret.
 
+### How the workflow is kept from publishing the wrong thing
+
+The workflow runs as two jobs, so nothing that installs or runs a dependency can publish.
+
+| Job       | Does                                                            | May                                |
+| --------- | --------------------------------------------------------------- | ---------------------------------- |
+| `build`   | Installs, builds, stamps the files, and packs one `.tgz`        | Read the repository                |
+| `publish` | Takes that one file, publishes it, and opens the GitHub release | Publish to npm, and write releases |
+
+- Every action is pinned to a commit, with its version in a comment beside it
+- `npm ci` runs with `--ignore-scripts`, in every workflow
+- The version of npm that publishes is named, and raised on purpose
+- The version in `package.json` must be plain semver before it reaches a shell
+- A run started by hand from any branch but `main` or `dev` stops before it builds
+- A GitHub release is tagged at the commit that was published
+
+To raise an action, change the commit and the comment together. `gh api
+repos/actions/checkout/commits/v5 -q .sha` prints the commit a tag names.
+
 ### Cut a release
 
 1. Open a pull request against `dev` that sets `version` in `package.json` to the version

package/dist/cli.js

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 
-!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="7a26fe4e-1a9f-538e-af63-a17134f6e803")}catch(e){}}();
+!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="6c054d7b-a0a8-526c-90d7-5bbec53675dd")}catch(e){}}();
 import module from "node:module";
 //#region src/cli.ts
 module.enableCompileCache?.();
@@ -14,7 +14,7 @@ process.on("unhandledRejection", (error) => void toCrash(error));
 try {
 	const answer = await toQuickAnswer(process.argv.slice(2));
 	if (answer === void 0) {
-		const { toCli, toParseExitCode, wasReportAttempted } = await import("./program-Bz-DwZDJ.js");
+		const { toCli, toParseExitCode, wasReportAttempted } = await import("./program-Da7dZSnW.js");
 		try {
 			await toCli().parseAsync(process.argv);
 		} catch (error) {
@@ -33,7 +33,7 @@ async function toCrash(error) {
 	isCrashing = true;
 	const isJSON = process.argv.includes("--json") || !process.stdout.isTTY;
 	try {
-		const { toReported, writeCrash } = await import("./program-Bz-DwZDJ.js");
+		const { toReported, writeCrash } = await import("./program-Da7dZSnW.js");
 		writeCrash(error, isJSON);
 		await toReported(error, isJSON, void 0, "fatal");
 	} catch {
@@ -54,4 +54,4 @@ async function toQuickAnswer(args) {
 export {};
 
 //# sourceMappingURL=cli.js.map
-//# debugId=7a26fe4e-1a9f-538e-af63-a17134f6e803
+//# debugId=6c054d7b-a0a8-526c-90d7-5bbec53675dd

package/dist/{program-Bz-DwZDJ.js → program-Da7dZSnW.js}

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 
-!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="8bcae06e-d313-56ed-bc3e-49b505487fa3")}catch(e){}}();
+!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="e0ad2183-1cb1-5831-b5d1-b96dcf795d93")}catch(e){}}();
 import { a as defineCommand, i as GLOBAL_FLAGS, r as ExitCode, t as toInvocation } from "./scrub-BZ0egWxC.js";
 import { n as toAnswer$1, r as toCompletion, t as PATH_VALUES } from "./completion-tree-DLC6ARLR.js";
 import { createRequire } from "node:module";
@@ -3574,7 +3574,7 @@ async function report(error, occasion, resolved) {
 	try {
 		const status = settings ? await toStatus(settings) : void 0;
 		const secrets = [settings?.settings.apiKey, settings ? toCredential(settings.settings.issuerUrl)?.refreshToken : void 0];
-		return await (await import("./sentry-e3Tum2kz.js")).send({
+		return await (await import("./sentry-CC0H3uMB.js")).send({
 			error,
 			occasion,
 			telemetry,
@@ -6934,5 +6934,5 @@ async function toReported(error, isJSON, resolved, level = "error") {
 //#endregion
 export { toCli, toParseExitCode, toReported, wasReportAttempted, writeCrash };
 
-//# sourceMappingURL=program-Bz-DwZDJ.js.map
-//# debugId=8bcae06e-d313-56ed-bc3e-49b505487fa3
+//# sourceMappingURL=program-Da7dZSnW.js.map
+//# debugId=e0ad2183-1cb1-5831-b5d1-b96dcf795d93

package/dist/{sentry-e3Tum2kz.js → sentry-CC0H3uMB.js}

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 
-!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="12bc3b97-183e-5e0e-84a2-4353d0ade50b")}catch(e){}}();
+!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="8beb7849-4488-5315-88c8-ae70cca2939f")}catch(e){}}();
 import { n as toScrubbed } from "./scrub-BZ0egWxC.js";
 import { dirname } from "node:path";
 import { fileURLToPath } from "node:url";
@@ -4331,33 +4331,48 @@ function toIdentity(status) {
 	return (status?.["api"])?.identity;
 }
 /**
-* toPrivate removes people's and organizations' names from the status report. The keys that
-* identify them stay, which is enough to find them without sending who they are.
+* The parts of an identity a report carries. Each identifies the credential, the person or
+* the organization without saying who they are. Anything the API adds later is left out
+* until someone decides it belongs here.
+*/
+const IDENTITY_FIELDS = [
+	"type",
+	"identifier",
+	"scopes",
+	"createdAt",
+	"expiresAt",
+	"lastRegeneratedAt",
+	"unavailable"
+];
+/** The parts of a person or an organization a report carries, which are how Hardfin finds them. */
+const RECORD_FIELDS = ["id", "key"];
+/**
+* toPrivate keeps only what identifies who a credential is from the status report. A name
+* is left out, and so is a key's label, which is whatever a person typed when they made it.
 */
 function toPrivate(status) {
-	const identity = toIdentity(status);
-	if (!identity) return status;
 	const api = status["api"];
-	const { organization, person } = identity;
+	if (!isRecord(api) || !isRecord(api["identity"])) return status;
+	const identity = api["identity"];
 	return {
 		...status,
 		api: {
 			...api,
 			identity: {
-				...api["identity"],
-				organization: organization ? {
-					...organization,
-					name: void 0
-				} : void 0,
-				person: person ? {
-					...person,
-					firstName: void 0,
-					lastName: void 0
-				} : void 0
+				...toPicked(identity, IDENTITY_FIELDS),
+				organization: isRecord(identity["organization"]) ? toPicked(identity["organization"], RECORD_FIELDS) : void 0,
+				person: isRecord(identity["person"]) ? toPicked(identity["person"], RECORD_FIELDS) : void 0
 			}
 		}
 	};
 }
+function isRecord(value) {
+	return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+/** toPicked copies the named fields of a record, and none of the others. */
+function toPicked(record, fields) {
+	return Object.fromEntries(fields.filter((field) => field in record).map((field) => [field, record[field]]));
+}
 /** toTags picks the few values worth searching by, each with few distinct values. */
 function toTags(delivery) {
 	const { occasion, status } = delivery;
@@ -4385,5 +4400,5 @@ function toTags(delivery) {
 //#endregion
 export { send };
 
-//# sourceMappingURL=sentry-e3Tum2kz.js.map
-//# debugId=12bc3b97-183e-5e0e-84a2-4353d0ade50b
+//# sourceMappingURL=sentry-CC0H3uMB.js.map
+//# debugId=8beb7849-4488-5315-88c8-ae70cca2939f

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@hardfin/cli",
-    "version": "0.1.1-dev.45",
+    "version": "0.1.1-dev.48",
     "description": "Command line interface for the Hardfin API",
     "license": "Apache-2.0",
     "author": "Hardfin, Inc.",