@quonfig/cli 0.4.0 → 0.5.0

package/dist/migrate/sources/launchdarkly/translate.js

@@ -9,7 +9,7 @@
  * plan §5.4.
  */
 import { resolveKey } from '../../key-rewriter.js';
-import { clauseToCriterion, collapseEnvironment, } from '../../quonfig-target/ruleset.js';
+import { clausesToCriteria, collapseEnvironment, expandClauses, } from '../../quonfig-target/ruleset.js';
 import { inferFlagValueType, toQuonfigValue } from '../../quonfig-target/values.js';
 const ALWAYS_TRUE = { operator: 'ALWAYS_TRUE' };
 /**
@@ -202,9 +202,7 @@ export function translateSegment(segment, report) {
             rules.push(keyListRule(ic.contextKind, ic.values, true));
     }
     for (const rule of segment.rules ?? []) {
-        const built = buildSegmentRule(rule, ctx);
-        if (built !== null)
-            rules.push(built);
+        rules.push(...buildSegmentRules(rule, ctx));
     }
     // Trailing catch-all: anyone not matched above is not in the segment.
     rules.push({ criteria: [ALWAYS_TRUE], value: { type: 'bool', value: false } });
@@ -225,21 +223,26 @@ export function translateSegment(segment, report) {
     return out;
 }
 /**
- * Build a Quonfig rule from a LaunchDarkly segment rule. A segment rule's
+ * Build the Quonfig rules for a LaunchDarkly segment rule. A segment rule's
  * clauses AND together and the rule means "in the segment". A rule-level
  * `weight` is a percentage of matching contexts — converted to a
- * `weighted_values` bool split (and reported as re-bucketing). Returns `null`
+ * `weighted_values` bool split (and reported as re-bucketing). Usually one
+ * rule; several when a multi-pattern `matches` is split (qfg-ktkr.6); empty
  * when a clause cannot be mapped (the whole rule is dropped — see `buildRule`).
  */
-function buildSegmentRule(rule, ctx) {
-    // Reuse the clause-mapping verb via a tiny inline AND loop so segment rules
-    // get the exact same operator handling (and whole-rule-drop) as flag rules.
-    const criteria = [];
-    for (const clause of rule.clauses) {
-        const criterion = clauseToCriterion(clause, ctx);
-        if (criterion === null)
-            return null;
-        criteria.push(criterion);
+function buildSegmentRules(rule, ctx) {
+    // Reuse the clause-mapping verbs so segment rules get the exact same operator
+    // handling (whole-rule-drop, multi-pattern `matches` expansion — qfg-ktkr.6)
+    // as flag rules. Each alternative is its own "in the segment" rule.
+    const alternatives = expandClauses(rule.clauses, ctx);
+    if (alternatives === null)
+        return [];
+    const criteriaSets = [];
+    for (const alt of alternatives) {
+        const criteria = clausesToCriteria(alt, ctx);
+        if (criteria === null)
+            return [];
+        criteriaSets.push(criteria);
     }
     const value = rule.weight === undefined
         ? { type: 'bool', value: true }
@@ -258,5 +261,5 @@ function buildSegmentRule(rule, ctx) {
     if (rule.weight !== undefined) {
         ctx.report.add('rebucketed-rollout', ctx.sourceKey, `segment rule has a ${rule.weight / 1000}% weight — converted to a weighted bool split; users will be re-bucketed`);
     }
-    return { criteria: criteria.length > 0 ? criteria : [ALWAYS_TRUE], value };
+    return criteriaSets.map((criteria) => ({ criteria: criteria.length > 0 ? criteria : [ALWAYS_TRUE], value }));
 }

package/dist/push/git-pack.d.ts

@@ -17,6 +17,8 @@
  * stand up real tmp-dir git repos rather than mocking the shell — the
  * pack format is too fiddly to fake convincingly.
  */
+/** `expectedSha` for a branch the server does not have yet. */
+export declare const ZERO_OID = "0000000000000000000000000000000000000000";
 /** Per §7 open Q #7 of the design plan: pack size cap of 25 MiB. */
 export declare const MAX_PACK_BYTES: number;
 /**
@@ -62,6 +64,16 @@ export interface BuildPackOptions {
  * from expectedSha" recipe. Buffers the entire output to memory so we
  * can enforce the §7 cap before shipping anything to the server.
  *
+ * For a brand-new branch `expectedSha` is {@link ZERO_OID}, which is not
+ * an object git can exclude (qfg-b1eo). Then the pack excludes everything
+ * reachable from the `origin/*` remote-tracking refs, i.e. what the server
+ * already has, and with no such refs it carries the full history:
+ *
+ *     printf '<newSha>\n^<origin ref sha>\n…' | git pack-objects --revs --stdout
+ *
+ * (pack-objects' stdin takes revs and `--not` only, not `--remotes`, so
+ * the refs are resolved with `git for-each-ref` first.)
+ *
  * Returns an empty `Uint8Array` when `expectedSha === newSha` — there
  * are no new commits, so `pack-objects` would either error on stdin
  * with no candidate revs or produce an empty pack. Skipping the spawn

package/dist/push/git-pack.js

@@ -19,6 +19,8 @@
  */
 import { spawn } from 'node:child_process';
 import { GIT_SAFE_ARGS, GIT_SAFE_ENV, runGit } from '../util/git-ops.js';
+/** `expectedSha` for a branch the server does not have yet. */
+export const ZERO_OID = '0000000000000000000000000000000000000000';
 /** Per §7 open Q #7 of the design plan: pack size cap of 25 MiB. */
 export const MAX_PACK_BYTES = 25 * 1024 * 1024;
 /**
@@ -69,6 +71,16 @@ export class PackTooLargeError extends Error {
  * from expectedSha" recipe. Buffers the entire output to memory so we
  * can enforce the §7 cap before shipping anything to the server.
  *
+ * For a brand-new branch `expectedSha` is {@link ZERO_OID}, which is not
+ * an object git can exclude (qfg-b1eo). Then the pack excludes everything
+ * reachable from the `origin/*` remote-tracking refs, i.e. what the server
+ * already has, and with no such refs it carries the full history:
+ *
+ *     printf '<newSha>\n^<origin ref sha>\n…' | git pack-objects --revs --stdout
+ *
+ * (pack-objects' stdin takes revs and `--not` only, not `--remotes`, so
+ * the refs are resolved with `git for-each-ref` first.)
+ *
  * Returns an empty `Uint8Array` when `expectedSha === newSha` — there
  * are no new commits, so `pack-objects` would either error on stdin
  * with no candidate revs or produce an empty pack. Skipping the spawn
@@ -79,6 +91,7 @@ export async function buildPack(dir, expectedSha, newSha, options = {}) {
         return new Uint8Array(0);
     }
     const limit = options.maxBytes ?? MAX_PACK_BYTES;
+    const excludes = expectedSha === ZERO_OID ? await originRefShas(dir) : [expectedSha];
     return new Promise((resolve, reject) => {
         const env = { ...process.env, ...GIT_SAFE_ENV };
         const args = [...GIT_SAFE_ARGS, '-C', dir, 'pack-objects', '--revs', '--stdout'];
@@ -120,8 +133,19 @@ export async function buildPack(dir, expectedSha, newSha, options = {}) {
             }
             resolve(new Uint8Array(out.buffer, out.byteOffset, out.byteLength));
         });
-        // Feed the rev-list spec on stdin: include newSha, exclude expectedSha.
-        // `--revs` tells pack-objects to read this as `git rev-list` would.
-        child.stdin.end(`${newSha}\n^${expectedSha}\n`);
+        // Feed the rev-list spec on stdin: include newSha, exclude expectedSha
+        // (or, for a new branch, the origin/* refs). `--revs` tells
+        // pack-objects to read this as `git rev-list` would.
+        child.stdin.end([newSha, ...excludes.map((sha) => `^${sha}`)].map((line) => `${line}\n`).join(''));
     });
 }
+/** Commit SHAs of the `origin/*` remote-tracking refs (deduped). */
+async function originRefShas(dir) {
+    const res = await runGit(['-C', dir, 'for-each-ref', '--format=%(objectname)', 'refs/remotes/origin']);
+    return [
+        ...new Set(res.stdout
+            .split('\n')
+            .map((l) => l.trim())
+            .filter((l) => l.length > 0)),
+    ];
+}

package/dist/push/run-push.d.ts

@@ -19,7 +19,8 @@
  * confirmation — that prompt is the destructive-change brake.
  */
 import { FileDelta } from './diff-summary.js';
-import type { CurrentBranchResult } from './git-pack.js';
+import { type CurrentBranchResult } from './git-pack.js';
+/** All-zeros object id, the git-protocol convention for "no such ref". */
 export interface GiteaTokenMintResult {
     expiresAt: string | null;
     repoUrl: string;

package/dist/push/run-push.js

@@ -24,8 +24,7 @@ import { readWorkspaceSlug, tryParseWorkspacePin, writeWorkspaceSlug } from '../
 import { checkIdentity } from './identity-check.js';
 import { confirmTypedSlug, confirmYesNo } from './confirm.js';
 import { summarizeDiff } from './diff-summary.js';
-/** All-zeros object id, the git-protocol convention for "no such ref". */
-const ZERO_OID = '0000000000000000000000000000000000000000';
+import { ZERO_OID } from './git-pack.js';
 export class PushFatalError extends Error {
     code;
     constructor(message, code = 'PUSH_FATAL') {

package/dist/ui/get-string.d.ts

@@ -1,5 +1,22 @@
-declare const getString: ({ allowBlank, message }: {
+/** Streams for the masked prompt; tests pass their own instead of the TTY. */
+export type PromptContext = {
+    input?: NodeJS.ReadableStream;
+    output?: NodeJS.WritableStream;
+};
+/**
+ * Prompt for a string.
+ *
+ * `mask: true` (secret values, qfg-38lp) never echoes what is typed: each
+ * character shows as `*`. It uses @inquirer/prompts' `password`, which reads
+ * through readline with a muted output stream. oclif's `ux.prompt({type:
+ * 'mask'})` was used before and was not safe: it wrote each typed character
+ * and only redrew `*` after Enter (so the plaintext stayed in scrollback and
+ * terminal logs), and it hung when a paste delivered "value\r" in one chunk.
+ */
+declare const getString: ({ allowBlank, context, mask, message, }: {
     allowBlank: boolean;
+    context?: PromptContext;
+    mask?: boolean;
     message: string;
 }) => Promise<string>;
 export default getString;

package/dist/ui/get-string.js

@@ -1,8 +1,23 @@
+import { password } from '@inquirer/prompts';
 import { ux } from '@oclif/core';
-const getString = async ({ allowBlank, message }) => {
-    const options = {
-        required: !allowBlank,
-    };
-    return ux.prompt(message, options);
+/**
+ * Prompt for a string.
+ *
+ * `mask: true` (secret values, qfg-38lp) never echoes what is typed: each
+ * character shows as `*`. It uses @inquirer/prompts' `password`, which reads
+ * through readline with a muted output stream. oclif's `ux.prompt({type:
+ * 'mask'})` was used before and was not safe: it wrote each typed character
+ * and only redrew `*` after Enter (so the plaintext stayed in scrollback and
+ * terminal logs), and it hung when a paste delivered "value\r" in one chunk.
+ */
+const getString = async ({ allowBlank, context, mask, message, }) => {
+    if (mask) {
+        return password({
+            mask: '*',
+            message,
+            validate: (value) => allowBlank || value.length > 0 || 'A value is required',
+        }, context);
+    }
+    return ux.prompt(message, { required: !allowBlank });
 };
 export default getString;

package/dist/ui/get-value.d.ts

@@ -4,8 +4,10 @@ interface Environment {
     id: string;
     name: string;
 }
-declare const getValue: ({ allowBlank, desiredValue, environment, flags, key, message, quonfig, }: {
+declare const getValue: ({ allowBlank, desiredValue, environment, flags, key, mask, message, quonfig, }: {
     allowBlank?: boolean;
+    /** mask the prompt input (secret values, qfg-38lp) */
+    mask?: boolean;
     desiredValue: string | undefined;
     environment?: Environment;
     flags: {

package/dist/ui/get-value.js

@@ -3,15 +3,15 @@ import { failure, noop, success } from '../result.js';
 import isInteractive from '../util/is-interactive.js';
 import validateValue from '../validations/value.js';
 import getString from './get-string.js';
-const getValue = async ({ allowBlank = true, desiredValue, environment, flags, key, message, quonfig, }) => {
+const getValue = async ({ allowBlank = true, desiredValue, environment, flags, key, mask, message, quonfig, }) => {
     if (desiredValue === undefined && !isInteractive(flags)) {
-        return failure(`No value provided for ${key ?? message}. Pass --value=<value> (or use --env-var) when running non-interactively.`);
+        return failure(`No value provided for ${key ?? message}. Pass --value=<value>, --value-stdin or --value-from-env=<VAR> (or use --env-var) when running non-interactively.`);
     }
     if (!key) {
         if (desiredValue !== undefined) {
             return success(desiredValue);
         }
-        const value = await promptForValue({ allowBlank, message });
+        const value = await promptForValue({ allowBlank, mask, message });
         if (value === undefined || value === null) {
             return noop();
         }
@@ -22,7 +22,7 @@ const getValue = async ({ allowBlank = true, desiredValue, environment, flags, k
     if (!config) {
         return failure(`Could not find config named ${key}`);
     }
-    const selectedValue = desiredValue ?? (await promptForValue({ allowBlank, config, currentDefault, message }));
+    const selectedValue = desiredValue ?? (await promptForValue({ allowBlank, config, currentDefault, mask, message }));
     if (selectedValue === undefined || selectedValue === null) {
         return noop();
     }
@@ -38,11 +38,11 @@ const valueToString = (v) => {
         return '';
     return String(v.value);
 };
-const promptForValue = async ({ allowBlank, config: _config, currentDefault, message, }) => {
+const promptForValue = async ({ allowBlank, config: _config, currentDefault, mask, message, }) => {
     // In the new quonfig format, allowable values aren't stored at the config level.
     // Just prompt for a string input.
-    if (!currentDefault) {
-        return getString({ allowBlank, message });
+    if (!currentDefault || mask) {
+        return getString({ allowBlank, mask, message });
     }
     const autoCompleteMessage = `The current default is \`${valueToString(currentDefault)}\`. Enter your new default.`;
     return getString({ allowBlank, message: autoCompleteMessage });

package/dist/util/clone-and-stack-push.js

@@ -1,8 +1,7 @@
 import * as fs from 'node:fs';
 import * as path from 'node:path';
-import { MIGRATOR_IDENTITY, runGit as runGitSafe, spawnGit } from './git-ops.js';
+import { MIGRATOR_IDENTITY, redactToken, runGit as runGitSafe, spawnGit } from './git-ops.js';
 export { MIGRATOR_IDENTITY } from './git-ops.js';
-const redactToken = (s) => s.replaceAll(/:([^\s/@]+)@/g, ':***@');
 export class PushConflictError extends Error {
     constructor(message) {
         super(message);
@@ -54,7 +53,13 @@ const getOriginUrl = async (dir) => {
         return null;
     }
 };
-const normalizeRemoteUrl = (url) => redactToken(url.replace(/\.git$/, '').trim());
+// Compare repos without credentials: the same repo with a different (or no)
+// username/token is still the same repo. ensureCloneOrReuse re-points origin
+// at the fresh remoteUrl after a match.
+const normalizeRemoteUrl = (url) => url
+    .trim()
+    .replace(/\.git$/, '')
+    .replace(/^(https?:\/\/)[^/@]*@/i, '$1');
 const ensureCloneOrReuse = async (remoteUrl, localDir, branch) => {
     if (fs.existsSync(localDir) && (await isGitRepo(localDir))) {
         const origin = await getOriginUrl(localDir);

package/dist/util/encryption.js

@@ -1,5 +1,5 @@
 import { encryption } from '@quonfig/node';
-import forge from 'node-forge';
+import { createDecipheriv } from 'node:crypto';
 import { failure, success } from '../result.js';
 const SEPARATOR = '--';
 const KEY_LENGTH = 32; // 32 bytes for AES-256
@@ -28,27 +28,18 @@ export function decrypt(encryptedString, keyStringHex) {
     if (encryptedDataPart === '') {
         return '';
     }
-    // Convert hex strings to bytes
-    const keyBytes = forge.util.hexToBytes(keyStringHex);
-    const encryptedBytes = forge.util.hexToBytes(encryptedDataPart);
-    const ivBytes = forge.util.hexToBytes(ivPart);
-    const tagBytes = forge.util.hexToBytes(authTagPart);
-    // Create decipher. node-forge AES-GCM with the IV passed to start() below, not
-    // Node's deprecated IV-less crypto.createDecipher that this rule targets.
-    // nosemgrep: javascript.node-crypto.security.create-de-cipher-no-iv.create-de-cipher-no-iv
-    const decipher = forge.cipher.createDecipher('AES-GCM', keyBytes);
-    decipher.start({
-        iv: ivBytes,
-        tag: forge.util.createBuffer(tagBytes),
-        tagLength: TAG_LENGTH * 8, // tagLength is in bits
-    });
-    // Decrypt the data
-    decipher.update(forge.util.createBuffer(encryptedBytes));
-    const success = decipher.finish();
-    if (!success) {
+    const key = Buffer.from(keyStringHex, 'hex');
+    const encryptedData = Buffer.from(encryptedDataPart, 'hex');
+    const iv = Buffer.from(ivPart, 'hex');
+    const authTag = Buffer.from(authTagPart, 'hex');
+    const decipher = createDecipheriv('aes-256-gcm', key, iv, { authTagLength: TAG_LENGTH });
+    try {
+        decipher.setAuthTag(authTag);
+        return Buffer.concat([decipher.update(encryptedData), decipher.final()]).toString('utf8');
+    }
+    catch {
         throw new Error('Authentication tag verification failed');
     }
-    return decipher.output.toString();
 }
 /**
  * Creates an encrypted ConfigValue using the new v1 API endpoints

package/dist/util/git-ops.d.ts

@@ -11,9 +11,11 @@ export declare const GIT_SAFE_ARGS: readonly string[];
  */
 export declare const GIT_SAFE_ENV: Readonly<NodeJS.ProcessEnv>;
 /**
- * Redact a token from a URL string so it is safe to display to users.
+ * Redact the credential from every http(s) URL in a string (a URL, or git's
+ * stderr) so it is safe to display to users. Handles both `user:token@`
+ * (keeps the user) and a bare `token@` (qfg-9iu0).
  */
-export declare const redactToken: (url: string) => string;
+export declare const redactToken: (text: string) => string;
 export interface RunGitOptions {
     cwd?: string;
     /** Extra env vars merged on top of `process.env` and `GIT_SAFE_ENV`. */

package/dist/util/git-ops.js

@@ -17,9 +17,11 @@ export const GIT_SAFE_ENV = {
     GCM_INTERACTIVE: 'Never',
 };
 /**
- * Redact a token from a URL string so it is safe to display to users.
+ * Redact the credential from every http(s) URL in a string (a URL, or git's
+ * stderr) so it is safe to display to users. Handles both `user:token@`
+ * (keeps the user) and a bare `token@` (qfg-9iu0).
  */
-export const redactToken = (url) => url.replace(/:([^/@]+)@/, ':***@');
+export const redactToken = (text) => text.replaceAll(/(https?:\/\/)(?:([^\s/:@]*):)?[^\s/@]+@/gi, (_match, scheme, user) => user === undefined ? `${scheme}***@` : `${scheme}${user}:***@`);
 /**
  * Canonical entry point for shelling out to git from the CLI. Always prepends
  * `GIT_SAFE_ARGS` and merges `GIT_SAFE_ENV` so credential prompts never leak

package/dist/util/redact.d.ts

@@ -0,0 +1,56 @@
+/** Plaintext shorter than this never has its tail shown. */
+export declare const LAST4_MIN_LENGTH = 12;
+export type RedactedSummary = {
+    /** true for `decryptWith` values, false for confidential-only values */
+    encrypted: boolean;
+    /** `*****<first 5 hex of md5>` — absent only before the value is encrypted */
+    fingerprint?: string;
+    /** last 4 chars of the plaintext, only when the plaintext is >= 12 chars */
+    last4?: string;
+    /** plaintext length — absent only when the plaintext is not known */
+    length?: number;
+    redacted: true;
+};
+/**
+ * The SDK telemetry fingerprint: `*****` + the first 5 hex chars of the md5.
+ * Identical to sdk-node resolver.ts makeConfidential (and sdk-ruby), so the
+ * value the CLI shows matches what telemetry and the UI report.
+ */
+export declare const fingerprint: (value: string) => string;
+/**
+ * Build the redacted summary for a value.
+ *
+ * - `ciphertext` given: an encrypted value. Like the SDK resolver, the
+ *   fingerprint hashes the CIPHERTEXT (that is what telemetry sees).
+ * - `encrypted: true` without ciphertext: about to be encrypted (e.g. a confirm
+ *   prompt before the write) — no fingerprint yet.
+ * - neither: a confidential-but-unencrypted value; the fingerprint hashes the
+ *   plaintext, again matching the SDK.
+ *
+ * `plaintext` may be omitted when it is not known (e.g. ciphertext that could
+ * not be decrypted); length and last4 are then left out.
+ */
+export declare const redactedSummary: ({ ciphertext, encrypted, plaintext, }: {
+    ciphertext?: string;
+    encrypted?: boolean;
+    plaintext?: string;
+}) => RedactedSummary;
+/**
+ * One-line human display, e.g.
+ *   [encrypted *****3fa9c, 51 chars, ends …a1b2]
+ *   [encrypted, 10 chars]                 (before encryption, no fingerprint)
+ *   [confidential *****1c2d3, 10 chars]
+ */
+export declare const redactedDisplay: (summary: RedactedSummary) => string;
+/**
+ * Deep-copy a stored config document, replacing the plaintext of every
+ * confidential-but-UNencrypted rule value with its redacted display. Encrypted
+ * values (`decryptWith`) are ciphertext and are left as they are.
+ */
+export declare const scrubConfidentialValues: <T>(doc: T) => T;
+/**
+ * Scrub anything headed for a --verbose / debug log line (qfg-38lp): objects
+ * are deep-scrubbed, and a string that is itself JSON (e.g. a pre-stringified
+ * request body) is parsed, scrubbed and re-serialised.
+ */
+export declare const scrubForLog: (message: unknown) => unknown;

package/dist/util/redact.js

@@ -0,0 +1,98 @@
+import { createHash } from 'node:crypto';
+/**
+ * Shared secret-redaction helper (qfg-38lp). Every CLI path that would show a
+ * secret (or `confidential`) value goes through here instead of printing the
+ * plaintext. Plaintext is only ever printed by `qfg get --reveal`.
+ */
+const FINGERPRINT_PREFIX = '*****';
+/** Plaintext shorter than this never has its tail shown. */
+export const LAST4_MIN_LENGTH = 12;
+/**
+ * The SDK telemetry fingerprint: `*****` + the first 5 hex chars of the md5.
+ * Identical to sdk-node resolver.ts makeConfidential (and sdk-ruby), so the
+ * value the CLI shows matches what telemetry and the UI report.
+ */
+export const fingerprint = (value) => `${FINGERPRINT_PREFIX}${createHash('md5').update(value).digest('hex').slice(0, 5)}`;
+/**
+ * Build the redacted summary for a value.
+ *
+ * - `ciphertext` given: an encrypted value. Like the SDK resolver, the
+ *   fingerprint hashes the CIPHERTEXT (that is what telemetry sees).
+ * - `encrypted: true` without ciphertext: about to be encrypted (e.g. a confirm
+ *   prompt before the write) — no fingerprint yet.
+ * - neither: a confidential-but-unencrypted value; the fingerprint hashes the
+ *   plaintext, again matching the SDK.
+ *
+ * `plaintext` may be omitted when it is not known (e.g. ciphertext that could
+ * not be decrypted); length and last4 are then left out.
+ */
+export const redactedSummary = ({ ciphertext, encrypted, plaintext, }) => {
+    const isEncrypted = ciphertext !== undefined || encrypted === true;
+    const hashed = ciphertext ?? (isEncrypted ? undefined : plaintext);
+    const summary = { encrypted: isEncrypted, redacted: true };
+    if (hashed !== undefined)
+        summary.fingerprint = fingerprint(hashed);
+    if (plaintext !== undefined)
+        summary.length = plaintext.length;
+    if (plaintext !== undefined && plaintext.length >= LAST4_MIN_LENGTH)
+        summary.last4 = plaintext.slice(-4);
+    return summary;
+};
+/**
+ * One-line human display, e.g.
+ *   [encrypted *****3fa9c, 51 chars, ends …a1b2]
+ *   [encrypted, 10 chars]                 (before encryption, no fingerprint)
+ *   [confidential *****1c2d3, 10 chars]
+ */
+export const redactedDisplay = (summary) => {
+    const label = summary.encrypted ? 'encrypted' : 'confidential';
+    const head = summary.fingerprint ? `${label} ${summary.fingerprint}` : label;
+    const parts = [head];
+    if (typeof summary.length === 'number')
+        parts.push(`${summary.length} chars`);
+    if (summary.last4)
+        parts.push(`ends …${summary.last4}`);
+    return `[${parts.join(', ')}]`;
+};
+/**
+ * Deep-copy a stored config document, replacing the plaintext of every
+ * confidential-but-UNencrypted rule value with its redacted display. Encrypted
+ * values (`decryptWith`) are ciphertext and are left as they are.
+ */
+export const scrubConfidentialValues = (doc) => {
+    const walk = (node) => {
+        if (Array.isArray(node))
+            return node.map((item) => walk(item));
+        if (node === null || typeof node !== 'object')
+            return node;
+        const record = node;
+        const out = {};
+        for (const [k, v] of Object.entries(record))
+            out[k] = walk(v);
+        if (record.confidential === true && !record.decryptWith && record.value !== undefined && record.value !== null) {
+            const plaintext = typeof record.value === 'string' ? record.value : JSON.stringify(record.value);
+            out.value = redactedDisplay(redactedSummary({ plaintext }));
+        }
+        return out;
+    };
+    return walk(doc);
+};
+/**
+ * Scrub anything headed for a --verbose / debug log line (qfg-38lp): objects
+ * are deep-scrubbed, and a string that is itself JSON (e.g. a pre-stringified
+ * request body) is parsed, scrubbed and re-serialised.
+ */
+export const scrubForLog = (message) => {
+    if (typeof message === 'string') {
+        const trimmed = message.trim();
+        if (!trimmed.startsWith('{') && !trimmed.startsWith('['))
+            return message;
+        try {
+            return JSON.stringify(scrubConfidentialValues(JSON.parse(trimmed)), null, 2);
+        }
+        catch {
+            return message;
+        }
+    }
+    return scrubConfidentialValues(message);
+};

package/dist/util/value-source.d.ts

@@ -0,0 +1,30 @@
+import { Result } from '../result.js';
+/**
+ * qfg-38lp: ways to hand the CLI a value WITHOUT putting it in argv (where it
+ * lands in shell history, `ps`, CI logs and agent transcripts).
+ *
+ *   --value-stdin              read the value from stdin
+ *   --value-from-env <VAR>     read the value from a LOCAL env var, right now
+ *
+ * Not to be confused with --env-var, which stores no value at all: it records
+ * that the SDK reads the value from that env var at RUNTIME.
+ */
+export declare const valueSourceFlags: {
+    'value-from-env': import("@oclif/core/lib/interfaces/parser.js").OptionFlag<string | undefined, import("@oclif/core/lib/interfaces/parser.js").CustomOptions>;
+    'value-stdin': import("@oclif/core/lib/interfaces/parser.js").BooleanFlag<boolean>;
+};
+type ValueSourceInput = {
+    'env-var'?: string;
+    value?: string;
+    'value-from-env'?: string;
+    'value-stdin'?: boolean;
+};
+/** Strip exactly one trailing newline (`\n` or `\r\n`), as `echo`/heredocs add one. */
+export declare const stripOneTrailingNewline: (s: string) => string;
+/**
+ * Resolve the value from --value / --value-stdin / --value-from-env, enforcing
+ * that at most one of those (or --env-var) is given. Returns `undefined` when
+ * none was given (the caller may then prompt or use --env-var).
+ */
+export declare const resolveValueSource: (flags: ValueSourceInput) => Promise<Result<string | undefined>>;
+export {};

package/dist/util/value-source.js

@@ -0,0 +1,81 @@
+import { Flags } from '@oclif/core';
+import { failure, success } from '../result.js';
+import getString from '../ui/get-string.js';
+/**
+ * qfg-38lp: ways to hand the CLI a value WITHOUT putting it in argv (where it
+ * lands in shell history, `ps`, CI logs and agent transcripts).
+ *
+ *   --value-stdin              read the value from stdin
+ *   --value-from-env <VAR>     read the value from a LOCAL env var, right now
+ *
+ * Not to be confused with --env-var, which stores no value at all: it records
+ * that the SDK reads the value from that env var at RUNTIME.
+ */
+export const valueSourceFlags = {
+    'value-from-env': Flags.string({
+        description: 'read the value to store from this LOCAL env var now (keeps it out of argv/shell history). Not the same as --env-var',
+        helpValue: 'VAR',
+    }),
+    'value-stdin': Flags.boolean({
+        default: false,
+        description: 'read the value to store from stdin (one trailing newline is stripped). Keeps it out of argv',
+    }),
+};
+/** Read all of stdin (tests swap `process.stdin` for a Readable). */
+const readStdin = async () => {
+    const chunks = [];
+    for await (const chunk of process.stdin) {
+        chunks.push(typeof chunk === 'string' ? Buffer.from(chunk) : chunk);
+    }
+    return Buffer.concat(chunks).toString('utf8');
+};
+/** Strip exactly one trailing newline (`\n` or `\r\n`), as `echo`/heredocs add one. */
+export const stripOneTrailingNewline = (s) => {
+    if (s.endsWith('\r\n'))
+        return s.slice(0, -2);
+    if (s.endsWith('\n'))
+        return s.slice(0, -1);
+    return s;
+};
+/**
+ * Resolve the value from --value / --value-stdin / --value-from-env, enforcing
+ * that at most one of those (or --env-var) is given. Returns `undefined` when
+ * none was given (the caller may then prompt or use --env-var).
+ */
+export const resolveValueSource = async (flags) => {
+    const given = [
+        flags.value === undefined ? undefined : '--value',
+        flags['value-stdin'] ? '--value-stdin' : undefined,
+        flags['value-from-env'] === undefined ? undefined : '--value-from-env',
+        flags['env-var'] === undefined ? undefined : '--env-var',
+    ].filter(Boolean);
+    if (given.length > 1) {
+        return failure(`Pass only one of --value, --value-stdin, --value-from-env or --env-var (got ${given.join(' and ')}). ` +
+            '--env-var stores no value: it tells the SDK to read the value from that env var at runtime.');
+    }
+    if (flags['value-stdin']) {
+        // On a terminal, a hand-typed value would be echoed; read it through the
+        // hidden prompt instead (one line, nothing echoed).
+        const value = process.stdin.isTTY
+            ? ((await getString({ allowBlank: true, mask: true, message: 'Value (input is hidden)' })) ?? '')
+            : stripOneTrailingNewline(await readStdin());
+        if (value === '') {
+            return failure('--value-stdin read an empty value from stdin. Pipe the value in, e.g. `pbpaste | qfg ... --value-stdin`.');
+        }
+        return success(value);
+    }
+    const envName = flags['value-from-env'];
+    if (envName !== undefined) {
+        const value = process.env[envName];
+        if (value === undefined) {
+            return failure(`--value-from-env: environment variable ${envName} is not set in this shell. ` +
+                `If you set it without \`export\`, run \`export ${envName}\` (or load a .env file with ` +
+                '`set -a; source ./file.env; set +a`).');
+        }
+        if (value === '') {
+            return failure(`--value-from-env: environment variable ${envName} is empty.`);
+        }
+        return success(value);
+    }
+    return success(flags.value);
+};