@nurix/nustack 0.23.3 → 0.23.5

package/dist/lib/records/recordInput.js

@@ -0,0 +1,145 @@
+import { randomUUID } from "node:crypto";
+import { RECORD_SCHEMA_VERSION, isLegacyKind, translatedKindOf } from "./door.js";
+import { idempotencyKeyOf, naturalKeyOf } from "./naturalKey.js";
+import { validateEnvelope } from "./recordValidator.js";
+import { scanPayload } from "./secretScan.js";
+export const LEGACY_BOOKKEEPING_ORIGIN = "session:legacy-bookkeeping";
+export const UNBOUND_PROJECT_ID = "unbound";
+export const UNKNOWN_KIND_MESSAGE = "--kind must be obligation, gate_event, changelog, memory, backlog, proposal or triage";
+const INPUT_ROW_KEYS = new Set(["payload", "sessionId", "planAnchor", "occurredAt", "naturalKey"]);
+const isObject = (value) => !!value && typeof value === "object" && !Array.isArray(value);
+function isEnvelope(value) {
+    if (!isObject(value))
+        return false;
+    return Array.isArray(value.rows) && typeof value.anchor !== "string" && !isObject(value.payload);
+}
+export function parseRowsText(raw) {
+    let parsed;
+    try {
+        parsed = JSON.parse(raw);
+    }
+    catch {
+        return null;
+    }
+    if (Array.isArray(parsed))
+        return { rows: parsed };
+    if (isEnvelope(parsed))
+        return { rows: parsed.rows, kind: parsed.kind };
+    return { rows: [parsed] };
+}
+export function isLegacyRow(row) {
+    return isObject(row) && typeof row.anchor === "string" && row.anchor.trim() !== "" && !isObject(row.payload);
+}
+export function translateLegacyRow(kind, row) {
+    const { idempotencyKey: _dropped, ...rest } = row;
+    let planAnchor;
+    if (typeof rest.planAnchor === "string") {
+        planAnchor = rest.planAnchor;
+        delete rest.planAnchor;
+    }
+    const withPlan = (value) => (planAnchor !== undefined ? { ...value, planAnchor } : value);
+    if (kind === "bookkeeping") {
+        const payload = {
+            origin: planAnchor !== undefined ? `plan:${planAnchor}` : LEGACY_BOOKKEEPING_ORIGIN,
+            type: "documentation",
+            subject: row.anchor,
+            ...(typeof row.text === "string" ? { claim: row.text } : {}),
+            state: "open",
+        };
+        return withPlan({ kind: "obligation", payload });
+    }
+    if (kind === "backlog.remove")
+        return withPlan({ kind: "backlog", payload: { ...rest, state: "removed" } });
+    return withPlan({ kind: "backlog", payload: rest });
+}
+export function translateRow(kind, row, index) {
+    const at = `row ${index}`;
+    if (isObject(row) && isObject(row.payload)) {
+        const extra = Object.keys(row).filter((key) => !INPUT_ROW_KEYS.has(key));
+        if (extra.length > 0)
+            return { ok: false, message: `${at}: an input row carries no ${extra.map((key) => JSON.stringify(key)).join(", ")}` };
+        const input = { ...row };
+        if (kind === "backlog.remove")
+            input.payload = { ...input.payload, state: "removed" };
+        return { ok: true, kind: translatedKindOf(kind), input };
+    }
+    if (isLegacyRow(row)) {
+        if (kind !== "backlog" && !isLegacyKind(kind)) {
+            return { ok: false, message: `${at}: a ${kind} row is an input row {payload, sessionId?, planAnchor?, occurredAt?}` };
+        }
+        const translated = translateLegacyRow(kind, row);
+        return {
+            ok: true,
+            kind: translated.kind,
+            input: { payload: translated.payload, ...(translated.planAnchor !== undefined ? { planAnchor: translated.planAnchor } : {}) },
+        };
+    }
+    return { ok: false, message: `${at}: each row is an input row {payload, …} or a legacy row with a string anchor` };
+}
+export function placementFor(kind, payload, settings) {
+    if (kind === "memory")
+        return settings.placement.memory;
+    if (kind === "obligation" && payload.type === "security")
+        return settings.placement.securityFindings;
+    return "server";
+}
+export function assembleRecord(kind, input, context, index) {
+    const at = `row ${index}`;
+    let payload = { ...input.payload };
+    if (kind === "gate_event" && payload.eventId === undefined)
+        payload = { eventId: randomUUID(), ...payload };
+    const scanned = scanPayload(payload);
+    payload = scanned.payload;
+    const naturalKey = naturalKeyOf(kind, payload);
+    if (input.naturalKey !== undefined && input.naturalKey !== naturalKey) {
+        return { ok: false, message: `${at}: naturalKey must equal naturalKeyOf(kind, payload)` };
+    }
+    const sessionId = input.sessionId !== undefined ? input.sessionId : context.sessionId;
+    const planAnchor = input.planAnchor !== undefined ? input.planAnchor : context.planAnchor;
+    const occurredAt = input.occurredAt !== undefined ? input.occurredAt : context.now.toISOString();
+    const envelope = {
+        kind,
+        schemaVersion: RECORD_SCHEMA_VERSION,
+        projectId: context.projectId ?? UNBOUND_PROJECT_ID,
+        ...(sessionId !== null && sessionId !== undefined ? { sessionId } : {}),
+        ...(planAnchor !== null && planAnchor !== undefined ? { planAnchor } : {}),
+        naturalKey,
+        payload,
+        occurredAt,
+    };
+    const verdict = validateEnvelope(envelope);
+    if (!verdict.isValid)
+        return { ok: false, message: `${at}: ${verdict.errors.slice(0, 3).join("; ")}` };
+    const valid = envelope;
+    return {
+        ok: true,
+        envelope: valid,
+        flags: scanned.flags,
+        write: {
+            kind,
+            schemaVersion: RECORD_SCHEMA_VERSION,
+            projectId: context.projectId,
+            sessionId: valid.sessionId ?? null,
+            planAnchor: valid.planAnchor ?? null,
+            naturalKey,
+            idempotencyKey: idempotencyKeyOf(context.projectId ?? context.root, kind, naturalKey),
+            payload,
+            createdAt: Date.parse(valid.occurredAt),
+            repositoryRoot: context.root,
+            placement: placementFor(kind, payload, context.settings),
+            credential: context.credential,
+        },
+    };
+}
+export function envelopeOfStored(row, projectId, payload) {
+    return {
+        kind: row.kind,
+        schemaVersion: RECORD_SCHEMA_VERSION,
+        projectId,
+        ...(row.sessionId !== null ? { sessionId: row.sessionId } : {}),
+        ...(row.planAnchor !== null ? { planAnchor: row.planAnchor } : {}),
+        naturalKey: row.naturalKey,
+        payload,
+        occurredAt: new Date(row.createdAt).toISOString(),
+    };
+}

package/dist/lib/records/recordValidator.js

@@ -0,0 +1,38 @@
+import { readFileSync } from "node:fs";
+import { Ajv } from "ajv";
+import addFormatsImport from "ajv-formats";
+const addFormats = addFormatsImport;
+let compiled = null;
+function compile() {
+    if (compiled)
+        return compiled;
+    const twin = JSON.parse(readFileSync(new URL("../../records.schema.json", import.meta.url), "utf8"));
+    const ajv = new Ajv({ allErrors: true, strict: false });
+    addFormats(ajv);
+    ajv.addSchema(twin);
+    const envelope = ajv.getSchema(`${twin.$id}#/definitions/RecordEnvelope`);
+    if (!envelope)
+        throw new Error("the records twin defines no RecordEnvelope");
+    const byKind = new Map();
+    (twin.definitions.RecordEnvelope.oneOf ?? []).forEach((branch, index) => {
+        const kind = branch.properties?.kind?.const;
+        const validate = ajv.getSchema(`${twin.$id}#/definitions/RecordEnvelope/oneOf/${index}`);
+        if (kind && validate)
+            byKind.set(kind, validate);
+    });
+    compiled = { envelope, byKind };
+    return compiled;
+}
+function messagesOf(validate) {
+    return (validate.errors ?? []).map((error) => `${error.instancePath || "/"} ${error.message ?? "invalid"}`);
+}
+export function validateEnvelope(envelope) {
+    const { envelope: validate, byKind } = compile();
+    if (validate(envelope))
+        return { isValid: true, errors: [] };
+    const kind = envelope?.kind;
+    const branch = typeof kind === "string" ? byKind.get(kind) : undefined;
+    if (branch && !branch(envelope))
+        return { isValid: false, errors: messagesOf(branch) };
+    return { isValid: false, errors: messagesOf(validate) };
+}

package/dist/lib/records/recordsTable.js

@@ -0,0 +1,287 @@
+import { randomUUID } from "node:crypto";
+import { withTransaction } from "../local_store/database.js";
+import { readMountDoor } from "./door.js";
+import { AGENT_DEFINITION_ID_VARIABLE, readVariable } from "./environment.js";
+export const SYNC_STATES = ["pending", "synced", "refused", "local"];
+export const PLACEMENTS = ["device", "server"];
+export const CREDENTIALS = ["device"];
+export const SYNCED_RETENTION_DAYS = 30;
+export const RECORDS_LIST_LIMIT = 200;
+export const OBLIGATION_AGENT_OWNED = "OBLIGATION_AGENT_OWNED";
+function recordOf(row) {
+    return {
+        id: row.id,
+        kind: row.kind,
+        schemaVersion: row.schema_version,
+        projectId: row.project_id ?? null,
+        sessionId: row.session_id ?? null,
+        planAnchor: row.plan_anchor ?? null,
+        naturalKey: row.natural_key,
+        idempotencyKey: row.idempotency_key,
+        payloadJson: row.payload_json,
+        syncState: row.sync_state,
+        attempts: row.attempts,
+        nextAttemptAt: row.next_attempt_at ?? null,
+        lastError: row.last_error ?? null,
+        createdAt: row.created_at,
+        repositoryRoot: row.repository_root ?? null,
+        doorUrl: row.door_url ?? null,
+        placement: row.placement ?? null,
+        credential: row.credential ?? null,
+    };
+}
+export function canonicalJson(value) {
+    if (Array.isArray(value))
+        return `[${value.map(canonicalJson).join(",")}]`;
+    if (value && typeof value === "object") {
+        const entries = Object.entries(value)
+            .filter(([, item]) => item !== undefined)
+            .sort(([a], [b]) => (a < b ? -1 : a > b ? 1 : 0));
+        return `{${entries.map(([key, item]) => `${JSON.stringify(key)}:${canonicalJson(item)}`).join(",")}}`;
+    }
+    return JSON.stringify(value);
+}
+export function syncStateFor(kind, payload, placement) {
+    if (placement !== "device")
+        return "pending";
+    if (kind === "memory")
+        return "local";
+    if (kind === "obligation" && payload.state !== "discharged")
+        return "local";
+    return "pending";
+}
+export class AgentOwnedError extends Error {
+    ownerAgentDefinitionId;
+    naturalKey;
+    constructor(naturalKey, owner) {
+        super(`the obligation ${naturalKey} is owned by the agent definition ${owner}; only that agent discharges or changes it`);
+        this.name = "AgentOwnedError";
+        this.ownerAgentDefinitionId = owner;
+        this.naturalKey = naturalKey;
+    }
+}
+export function findRecordByKey(db, idempotencyKey) {
+    const row = db.prepare("SELECT * FROM records WHERE idempotency_key = ?").get(idempotencyKey);
+    return row ? recordOf(row) : null;
+}
+function checkAgentOwned(stored, write, env) {
+    if (!stored || write.kind !== "obligation" || stored.kind !== "obligation")
+        return;
+    const storedPayload = JSON.parse(stored.payloadJson);
+    const owner = storedPayload.ownerAgentDefinitionId;
+    if (typeof owner !== "string" || owner === "")
+        return;
+    if (canonicalJson(storedPayload) === canonicalJson(write.payload))
+        return;
+    if (readVariable(AGENT_DEFINITION_ID_VARIABLE, env) === owner)
+        return;
+    throw new AgentOwnedError(write.naturalKey, owner);
+}
+function upsert(db, write, placement, syncState) {
+    db.prepare(`INSERT INTO records (id, kind, schema_version, project_id, session_id, plan_anchor, natural_key, idempotency_key,
+            payload_json, sync_state, attempts, next_attempt_at, last_error, created_at, repository_root, door_url,
+            placement, credential)
+         VALUES (:id, :kind, :schema_version, :project_id, :session_id, :plan_anchor, :natural_key, :idempotency_key,
+            :payload_json, :sync_state, 0, NULL, NULL, :created_at, :repository_root, NULL, :placement, :credential)
+         ON CONFLICT(idempotency_key) DO UPDATE SET
+            kind = excluded.kind, schema_version = excluded.schema_version, project_id = excluded.project_id,
+            session_id = excluded.session_id, plan_anchor = excluded.plan_anchor, natural_key = excluded.natural_key,
+            payload_json = excluded.payload_json, sync_state = excluded.sync_state, attempts = 0,
+            next_attempt_at = NULL, last_error = NULL, created_at = excluded.created_at,
+            repository_root = excluded.repository_root, door_url = excluded.door_url,
+            placement = records.placement, credential = excluded.credential`).run({
+        id: randomUUID(),
+        kind: write.kind,
+        schema_version: write.schemaVersion,
+        project_id: write.projectId,
+        session_id: write.sessionId,
+        plan_anchor: write.planAnchor,
+        natural_key: write.naturalKey,
+        idempotency_key: write.idempotencyKey,
+        payload_json: JSON.stringify(write.payload),
+        sync_state: syncState,
+        created_at: write.createdAt,
+        repository_root: write.repositoryRoot,
+        placement,
+        credential: write.credential,
+    });
+}
+export function writeRecords(store, writes, env = process.env) {
+    return withTransaction(store, (db) => writes.map((write) => {
+        const stored = findRecordByKey(db, write.idempotencyKey);
+        checkAgentOwned(stored, write, env);
+        const placement = stored ? stored.placement : write.placement;
+        const syncState = syncStateFor(write.kind, write.payload, placement);
+        upsert(db, write, placement, syncState);
+        return { idempotencyKey: write.idempotencyKey, syncState };
+    }));
+}
+export function releaseUnboundRows(store, root) {
+    store.db
+        .prepare(`UPDATE records SET next_attempt_at = NULL
+             WHERE project_id IS NULL AND repository_root = ? AND sync_state = 'pending' AND next_attempt_at IS NOT NULL`)
+        .run(root);
+}
+export function selectDueRecords(store, now, canSendDevice) {
+    const rows = store.db
+        .prepare(`SELECT * FROM records
+             WHERE sync_state = 'pending' AND (next_attempt_at IS NULL OR next_attempt_at <= ?)
+               AND (credential IS NULL OR ?)
+             ORDER BY created_at ASC, rowid ASC`)
+        .all(now, canSendDevice ? 1 : 0);
+    return rows.map(recordOf);
+}
+export function hasDueRecord(db, now, canSendDevice) {
+    return (db
+        .prepare(`SELECT 1 FROM records
+                 WHERE sync_state = 'pending' AND (next_attempt_at IS NULL OR next_attempt_at <= ?)
+                   AND (credential IS NULL OR ?) LIMIT 1`)
+        .get(now, canSendDevice ? 1 : 0) !== undefined);
+}
+const CAS = `id = :id AND sync_state = 'pending' AND payload_json = :payload_json AND session_id IS :session_id
+    AND plan_anchor IS :plan_anchor AND created_at = :created_at`;
+function casParameters(row) {
+    return {
+        id: row.id,
+        payload_json: row.payloadJson,
+        session_id: row.sessionId,
+        plan_anchor: row.planAnchor,
+        created_at: row.createdAt,
+    };
+}
+export function markSynced(store, row) {
+    const result = store.db
+        .prepare(`UPDATE records SET sync_state = 'synced', last_error = NULL, next_attempt_at = NULL WHERE ${CAS}`)
+        .run(casParameters(row));
+    return Number(result.changes) > 0;
+}
+export function markRefused(store, row, error) {
+    const result = store.db
+        .prepare(`UPDATE records SET sync_state = 'refused', last_error = :last_error, next_attempt_at = NULL WHERE ${CAS}`)
+        .run({ ...casParameters(row), last_error: error });
+    return Number(result.changes) > 0;
+}
+export function markBackoff(store, row, error, nextAttemptAt) {
+    const result = store.db
+        .prepare(`UPDATE records SET attempts = attempts + 1, next_attempt_at = :next_attempt_at, last_error = :last_error WHERE ${CAS}`)
+        .run({ ...casParameters(row), last_error: error, next_attempt_at: nextAttemptAt });
+    return Number(result.changes) > 0;
+}
+export function markDeferred(store, row, nextAttemptAt) {
+    const result = store.db
+        .prepare(`UPDATE records SET next_attempt_at = :next_attempt_at WHERE ${CAS}`)
+        .run({ ...casParameters(row), next_attempt_at: nextAttemptAt });
+    return Number(result.changes) > 0;
+}
+export function rekeyRecord(store, row, projectId) {
+    const key = `${projectId}:${row.kind}:${row.naturalKey}`;
+    return withTransaction(store, (db) => {
+        const current = db.prepare("SELECT * FROM records WHERE id = ?").get(row.id);
+        if (!current)
+            return null;
+        const existing = findRecordByKey(db, key);
+        if (existing && existing.id !== row.id) {
+            if (existing.createdAt >= row.createdAt) {
+                db.prepare("DELETE FROM records WHERE id = ?").run(row.id);
+                return null;
+            }
+            db.prepare("DELETE FROM records WHERE id = ?").run(existing.id);
+        }
+        db.prepare("UPDATE records SET project_id = ?, idempotency_key = ? WHERE id = ?").run(projectId, key, row.id);
+        return recordOf(db.prepare("SELECT * FROM records WHERE id = ?").get(row.id));
+    });
+}
+export function pruneSynced(store, now) {
+    store.db
+        .prepare(`DELETE FROM records WHERE sync_state = 'synced' AND created_at < ?
+               AND NOT (kind = 'obligation' AND json_extract(payload_json, '$.state') = 'open')`)
+        .run(now - SYNCED_RETENTION_DAYS * 24 * 60 * 60 * 1000);
+}
+function viewOf(row) {
+    let payload;
+    try {
+        payload = JSON.parse(row.payloadJson);
+    }
+    catch {
+        payload = row.payloadJson;
+    }
+    return {
+        id: row.id,
+        kind: row.kind,
+        projectId: row.projectId,
+        sessionId: row.sessionId,
+        planAnchor: row.planAnchor,
+        naturalKey: row.naturalKey,
+        idempotencyKey: row.idempotencyKey,
+        payload,
+        syncState: row.syncState,
+        attempts: row.attempts,
+        nextAttemptAt: row.nextAttemptAt,
+        lastError: row.lastError,
+        createdAt: row.createdAt,
+        repositoryRoot: row.repositoryRoot,
+        placement: row.placement,
+        credential: row.credential,
+    };
+}
+export async function countRecords(store, projectId) {
+    const rows = (projectId
+        ? store.db.prepare("SELECT * FROM records WHERE sync_state <> 'synced' AND project_id = ?").all(projectId)
+        : store.db.prepare("SELECT * FROM records WHERE sync_state <> 'synced'").all());
+    const records = rows.map(recordOf);
+    const doorOff = new Map();
+    for (const row of records) {
+        if (row.syncState !== "pending" || row.projectId === null || row.doorUrl !== null || row.repositoryRoot === null)
+            continue;
+        if (!doorOff.has(row.repositoryRoot))
+            doorOff.set(row.repositoryRoot, (await readMountDoor(row.repositoryRoot)) === null);
+    }
+    const isDoorOff = (row) => row.doorUrl === null && row.repositoryRoot !== null && doorOff.get(row.repositoryRoot) === true;
+    let waitingCount = 0;
+    let refusedWithProject = 0;
+    let storeCount = 0;
+    for (const row of records) {
+        if (row.syncState === "refused" && row.projectId !== null)
+            refusedWithProject += 1;
+        if (row.syncState !== "pending")
+            continue;
+        if (row.projectId === null || isDoorOff(row))
+            storeCount += 1;
+        else
+            waitingCount += 1;
+    }
+    const outboxCount = waitingCount + refusedWithProject;
+    const newest = records
+        .filter((row) => (row.syncState === "pending" || row.syncState === "refused") && row.lastError !== null)
+        .sort((a, b) => b.createdAt - a.createdAt)[0];
+    return {
+        outboxCount,
+        storeCount,
+        lastError: newest?.lastError ?? null,
+        pendingCount: records.filter((row) => row.syncState === "pending").length,
+        refusedCount: records.filter((row) => row.syncState === "refused").length,
+        localCount: records.filter((row) => row.syncState === "local").length,
+        waitingCount,
+    };
+}
+export function listRecords(store, filter = {}) {
+    const clauses = [];
+    const parameters = [];
+    if (filter.projectId) {
+        clauses.push("project_id = ?");
+        parameters.push(filter.projectId);
+    }
+    if (filter.kind) {
+        clauses.push("kind = ?");
+        parameters.push(filter.kind);
+    }
+    if (filter.planAnchor) {
+        clauses.push("plan_anchor = ?");
+        parameters.push(filter.planAnchor);
+    }
+    const where = clauses.length > 0 ? `WHERE ${clauses.join(" AND ")}` : "";
+    const rows = store.db
+        .prepare(`SELECT * FROM records ${where} ORDER BY created_at DESC, rowid DESC LIMIT ${RECORDS_LIST_LIMIT}`)
+        .all(...parameters);
+    return rows.map(recordOf).map(viewOf);
+}

package/dist/lib/records/refusalLog.js

@@ -0,0 +1,56 @@
+import { randomUUID } from "node:crypto";
+import { RECORD_SCHEMA_VERSION } from "./door.js";
+import { idempotencyKeyOf } from "./naturalKey.js";
+import { writeRecords } from "./recordsTable.js";
+export const REFUSAL_GATE_IDS = ["records-validation", "records-unknown-kind", "agent-owned-obligation", "secret-scan"];
+const TEXT_CAP = 20_000;
+const clip = (text) => (text.length > TEXT_CAP ? `${text.slice(0, TEXT_CAP - 1)}…` : text || "-");
+export function logRefusals(store, entries, context) {
+    if (entries.length === 0)
+        return 0;
+    try {
+        const writes = entries.map((entry) => {
+            const eventId = randomUUID();
+            const naturalKey = `event:${eventId}`;
+            return {
+                kind: "gate_event",
+                schemaVersion: RECORD_SCHEMA_VERSION,
+                projectId: context.projectId,
+                sessionId: context.sessionId,
+                planAnchor: null,
+                naturalKey,
+                idempotencyKey: idempotencyKeyOf(context.projectId ?? context.root, "gate_event", naturalKey),
+                payload: { eventId, gate: entry.gate, verdict: entry.verdict, target: clip(entry.target), reason: clip(entry.reason) },
+                createdAt: context.now.getTime(),
+                repositoryRoot: context.root,
+                placement: "server",
+                credential: context.credential,
+            };
+        });
+        writeRecords(store, writes);
+        return writes.length;
+    }
+    catch {
+        return 0;
+    }
+}
+export function countRefusals(store, filter) {
+    const ids = REFUSAL_GATE_IDS.map(() => "?").join(", ");
+    const clauses = [
+        "kind = 'gate_event'",
+        "project_id IS ?",
+        `json_extract(payload_json, '$.gate') IN (${ids})`,
+        "json_extract(payload_json, '$.verdict') = ?",
+    ];
+    const parameters = [filter.projectId, ...REFUSAL_GATE_IDS, filter.verdict ?? "block"];
+    if (filter.sessionId !== undefined) {
+        clauses.push("session_id = ?");
+        parameters.push(filter.sessionId);
+    }
+    if (filter.since !== undefined) {
+        clauses.push("created_at >= ?");
+        parameters.push(filter.since);
+    }
+    const row = store.db.prepare(`SELECT count(*) AS n FROM records WHERE ${clauses.join(" AND ")}`).get(...parameters);
+    return Number(row.n);
+}

package/dist/lib/records/secretScan.js

@@ -0,0 +1,45 @@
+export const SECRET_PATTERNS = [
+    { id: "private-key", pattern: /-----BEGIN [A-Z0-9 ]*PRIVATE KEY-----(?:[\s\S]*?-----END [A-Z0-9 ]*PRIVATE KEY-----|[\s\S]*$)/g },
+    { id: "nustack-token", pattern: /\bnst_[a-z]+_[A-Za-z0-9-]+_[0-9a-f]{16,}/g },
+    { id: "nustack-service-token", pattern: /\basp_[A-Za-z0-9-]+_[A-Za-z0-9]{16,}/g },
+    { id: "nustack-project-token", pattern: /\bwst_[A-Za-z0-9-]+_[0-9a-f]{64}/g },
+    { id: "nustack-deploy-token", pattern: /\bnustack_deploy_[0-9a-f]{16,}/g },
+    { id: "aws-access-key", pattern: /\b(?:AKIA|ASIA)[A-Z0-9]{16}\b/g },
+    { id: "github-token", pattern: /\b(?:gh[pousr]_[A-Za-z0-9]{36,}|github_pat_[A-Za-z0-9_]{20,})/g },
+    { id: "anthropic-key", pattern: /\bsk-ant-[A-Za-z0-9_-]{16,}/g },
+    { id: "openai-key", pattern: /\bsk-(?:proj-)?[A-Za-z0-9_-]{20,}/g },
+    { id: "slack-token", pattern: /\bxox[abposr]-[A-Za-z0-9-]{10,}/g },
+    { id: "google-api-key", pattern: /\bAIza[0-9A-Za-z_-]{35}(?![0-9A-Za-z_-])/g },
+    { id: "stripe-secret", pattern: /\b(?:sk|rk)_live_[0-9A-Za-z]{10,}/g },
+    { id: "jwt", pattern: /\beyJ[A-Za-z0-9_-]{4,}\.[A-Za-z0-9_-]{4,}\.[A-Za-z0-9_-]{4,}/g },
+];
+function redactString(value, path, flags) {
+    let result = value;
+    for (const { id, pattern } of SECRET_PATTERNS) {
+        pattern.lastIndex = 0;
+        if (!pattern.test(result))
+            continue;
+        pattern.lastIndex = 0;
+        result = result.replace(pattern, `[redacted:${id}]`);
+        flags.push({ rule: "secret-scan", patternId: id, path });
+    }
+    return result;
+}
+function walk(value, path, flags) {
+    if (typeof value === "string")
+        return redactString(value, path, flags);
+    if (Array.isArray(value))
+        return value.map((item, index) => walk(item, `${path}[${index}]`, flags));
+    if (value && typeof value === "object") {
+        const out = {};
+        for (const [key, item] of Object.entries(value))
+            out[key] = walk(item, `${path}.${key}`, flags);
+        return out;
+    }
+    return value;
+}
+export function scanPayload(payload) {
+    const flags = [];
+    const redacted = walk(payload, "payload", flags);
+    return { payload: redacted, flags };
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@nurix/nustack",
-  "version": "0.23.3",
+  "version": "0.23.5",
   "description": "The nustack CLI — bootstrap NuStack services into a repo via the NuStack discovery plane.",
   "type": "module",
   "private": false,
@@ -27,16 +27,17 @@
     "commander": "^14.0.0"
   },
   "optionalDependencies": {
-    "@nurix/codegraph": "0.2.1",
-    "@nurix/logscope": "0.1.0"
+    "@nurix/logscope": "0.1.0",
+    "@nurix/codegraph": "0.2.1"
   },
   "devDependencies": {
     "@ngneat/falso": "^8.0.2",
     "@types/node": "^22.19.20",
     "typescript": "^5.7.2",
     "vitest": "^4.1.11",
-    "@nurix/nustack.studio": "0.0.0",
-    "@nurix/nustack.ui": "0.0.0"
+    "@nurix/contracts": "2.0.1",
+    "@nurix/nustack.ui": "0.0.0",
+    "@nurix/nustack.studio": "0.0.0"
   },
   "publishConfig": {
     "access": "public"