@vellumai/cli 0.10.11-dev.202607242127.a6bf2b2 → 0.10.11-staging.2

package/node_modules/@vellumai/service-contracts/src/__tests__/package-boundary.test.ts

@@ -1,151 +0,0 @@
-/**
- * Package boundary tests for @vellumai/service-contracts.
- *
- * Ensures the package:
- * 1. Does NOT import from assistant, gateway, credential-executor, or other
- *    service runtime modules.
- * 2. Does NOT import from runtime shared packages that sit above it in the
- *    dependency hierarchy (@vellumai/credential-storage, @vellumai/egress-proxy).
- * 3. Does NOT import from x-client packages (@vellumai/assistant-client,
- *    @vellumai/ces-client, @vellumai/gateway-client).
- * 4. Remains a pure schema/type package — no runtime dependencies beyond zod.
- *
- * @vellumai/service-contracts is the lowest layer of the shared packages
- * hierarchy and must not depend on any higher-layer package.
- */
-
-import { describe, expect, test } from "bun:test";
-import { readFileSync, readdirSync, statSync } from "node:fs";
-import { join, resolve } from "node:path";
-
-const PACKAGE_ROOT = resolve(import.meta.dirname, "../..");
-const SRC_DIR = join(PACKAGE_ROOT, "src");
-
-/**
- * Recursively collect all .ts source files, excluding test and declaration files.
- */
-function collectSourceFiles(dir: string): string[] {
-  const files: string[] = [];
-  for (const entry of readdirSync(dir)) {
-    const full = join(dir, entry);
-    const stat = statSync(full);
-    if (stat.isDirectory()) {
-      if (entry === "node_modules" || entry === "__tests__") continue;
-      files.push(...collectSourceFiles(full));
-    } else if (
-      entry.endsWith(".ts") &&
-      !entry.endsWith(".test.ts") &&
-      !entry.endsWith(".d.ts")
-    ) {
-      files.push(full);
-    }
-  }
-  return files;
-}
-
-/**
- * Patterns that must NOT appear in any import/require statement within
- * source files. These catch imports from higher-layer packages that would
- * create a forbidden upward dependency.
- */
-const FORBIDDEN_IMPORT_PATTERNS = [
-  // Assistant runtime
-  /from\s+["'](?:\.\.\/)*assistant(?:\/|["'])/,
-  /require\s*\(\s*["'](?:\.\.\/)*assistant(?:\/|["'])/,
-  /from\s+["']@vellumai\/assistant(?:\/|["'])/,
-  /require\s*\(\s*["']@vellumai\/assistant(?:\/|["'])/,
-
-  // Gateway
-  /from\s+["'](?:\.\.\/)*gateway(?:\/|["'])/,
-  /require\s*\(\s*["'](?:\.\.\/)*gateway(?:\/|["'])/,
-  /from\s+["']@vellumai\/(?:vellum-)?gateway(?:\/|["'])/,
-  /require\s*\(\s*["']@vellumai\/(?:vellum-)?gateway(?:\/|["'])/,
-
-  // Credential executor
-  /from\s+["'](?:\.\.\/)*credential-executor(?:\/|["'])/,
-  /require\s*\(\s*["'](?:\.\.\/)*credential-executor(?:\/|["'])/,
-  /from\s+["']@vellumai\/credential-executor(?:\/|["'])/,
-  /require\s*\(\s*["']@vellumai\/credential-executor(?:\/|["'])/,
-
-  // Runtime shared packages (higher layer)
-  /from\s+["']@vellumai\/credential-storage(?:\/|["'])/,
-  /require\s*\(\s*["']@vellumai\/credential-storage(?:\/|["'])/,
-  /from\s+["']@vellumai\/egress-proxy(?:\/|["'])/,
-  /require\s*\(\s*["']@vellumai\/egress-proxy(?:\/|["'])/,
-
-  // x-client packages (higher layer)
-  /from\s+["']@vellumai\/assistant-client(?:\/|["'])/,
-  /require\s*\(\s*["']@vellumai\/assistant-client(?:\/|["'])/,
-  /from\s+["']@vellumai\/ces-client(?:\/|["'])/,
-  /require\s*\(\s*["']@vellumai\/ces-client(?:\/|["'])/,
-  /from\s+["']@vellumai\/gateway-client(?:\/|["'])/,
-  /require\s*\(\s*["']@vellumai\/gateway-client(?:\/|["'])/,
-];
-
-describe("package boundary", () => {
-  const sourceFiles = collectSourceFiles(SRC_DIR);
-
-  test("has source files to validate", () => {
-    expect(sourceFiles.length).toBeGreaterThan(0);
-  });
-
-  test("does not import from runtime or higher-layer packages", () => {
-    const violations: string[] = [];
-
-    for (const file of sourceFiles) {
-      const content = readFileSync(file, "utf-8");
-      const lines = content.split("\n");
-
-      for (let i = 0; i < lines.length; i++) {
-        const line = lines[i];
-        for (const pattern of FORBIDDEN_IMPORT_PATTERNS) {
-          if (pattern.test(line)) {
-            const relative = file.replace(PACKAGE_ROOT + "/", "");
-            violations.push(`${relative}:${i + 1}: ${line.trim()}`);
-          }
-        }
-      }
-    }
-
-    if (violations.length > 0) {
-      throw new Error(
-        `Found ${violations.length} forbidden import(s) in service-contracts package:\n` +
-          violations.map((v) => `  - ${v}`).join("\n") +
-          "\n\n" +
-          "@vellumai/service-contracts is a pure schema/type package and must not\n" +
-          "import from runtime services or higher-layer packages.",
-      );
-    }
-  });
-
-  test("package.json declares it as private", () => {
-    const pkg = JSON.parse(
-      readFileSync(join(PACKAGE_ROOT, "package.json"), "utf-8"),
-    );
-    expect(pkg.private).toBe(true);
-  });
-
-  test("package.json does not depend on runtime or higher-layer packages", () => {
-    const pkg = JSON.parse(
-      readFileSync(join(PACKAGE_ROOT, "package.json"), "utf-8"),
-    );
-    const allDeps = {
-      ...pkg.dependencies,
-      ...pkg.devDependencies,
-      ...pkg.peerDependencies,
-    };
-
-    const forbidden = Object.keys(allDeps).filter((dep) =>
-      [
-        "@vellumai/assistant",
-        "@vellumai/credential-storage",
-        "@vellumai/egress-proxy",
-        "@vellumai/assistant-client",
-        "@vellumai/ces-client",
-        "@vellumai/gateway-client",
-      ].includes(dep),
-    );
-
-    expect(forbidden).toEqual([]);
-  });
-});

package/node_modules/@vellumai/service-contracts/src/__tests__/redacted-credential.test.ts

@@ -1,200 +0,0 @@
-import { describe, expect, test } from "bun:test";
-
-import {
-  buildRedactedSentinel,
-  createRedactedSentinelRegex,
-  isRevealableSentinel,
-  neutralizeRedactedSentinels,
-  parseRedactedSentinel,
-  REDACTED_SENTINEL_CLOSE,
-  REDACTED_SENTINEL_OPEN,
-} from "../redacted-credential";
-
-describe("buildRedactedSentinel", () => {
-  test("plain shape carries only the type", () => {
-    expect(buildRedactedSentinel({ type: "OpenAI Project Key" })).toBe(
-      `${REDACTED_SENTINEL_OPEN}redacted:OpenAI Project Key${REDACTED_SENTINEL_CLOSE}`,
-    );
-  });
-
-  test("enriched shape carries service and field", () => {
-    expect(
-      buildRedactedSentinel({
-        type: "Anthropic API Key",
-        service: "anthropic",
-        field: "api_key",
-      }),
-    ).toBe(
-      `${REDACTED_SENTINEL_OPEN}redacted:Anthropic API Key:anthropic:api_key${REDACTED_SENTINEL_CLOSE}`,
-    );
-  });
-
-  test("colon-qualified segments are percent-encoded, not rejected", () => {
-    // Real vaults contain colon-qualified service names (migration
-    // 018-rekey-compound-credential-keys produces `integration:google`).
-    // The builder must keep those revealable by encoding the delimiter.
-    expect(
-      buildRedactedSentinel({
-        type: "Generic Secret",
-        service: "integration:google",
-        field: "access_token",
-      }),
-    ).toBe(
-      `${REDACTED_SENTINEL_OPEN}redacted:Generic Secret:integration%3Agoogle:access_token${REDACTED_SENTINEL_CLOSE}`,
-    );
-  });
-
-  test("plain identifier segments stay literal (unencoded)", () => {
-    expect(
-      buildRedactedSentinel({
-        type: "Anthropic API Key",
-        service: "anthropic",
-        field: "api-key.v2_test",
-      }),
-    ).toBe(
-      `${REDACTED_SENTINEL_OPEN}redacted:Anthropic API Key:anthropic:api-key.v2_test${REDACTED_SENTINEL_CLOSE}`,
-    );
-  });
-
-  test("empty service or field degrades to the plain shape", () => {
-    expect(
-      buildRedactedSentinel({
-        type: "Generic Secret",
-        service: "",
-        field: "x",
-      }),
-    ).toBe(
-      `${REDACTED_SENTINEL_OPEN}redacted:Generic Secret${REDACTED_SENTINEL_CLOSE}`,
-    );
-    expect(
-      buildRedactedSentinel({
-        type: "Generic Secret",
-        service: "x",
-        field: "",
-      }),
-    ).toBe(
-      `${REDACTED_SENTINEL_OPEN}redacted:Generic Secret${REDACTED_SENTINEL_CLOSE}`,
-    );
-  });
-
-  test("missing field alone degrades to the plain shape", () => {
-    expect(
-      buildRedactedSentinel({ type: "Generic Secret", service: "anthropic" }),
-    ).toBe(
-      `${REDACTED_SENTINEL_OPEN}redacted:Generic Secret${REDACTED_SENTINEL_CLOSE}`,
-    );
-  });
-
-  test("throws on a type label that would corrupt the format", () => {
-    expect(() => buildRedactedSentinel({ type: "bad:type" })).toThrow();
-    expect(() =>
-      buildRedactedSentinel({ type: `bad${REDACTED_SENTINEL_CLOSE}type` }),
-    ).toThrow();
-  });
-});
-
-describe("parseRedactedSentinel", () => {
-  test("round-trips the plain shape", () => {
-    const s = buildRedactedSentinel({ type: "GitHub Token" });
-    expect(parseRedactedSentinel(s)).toEqual({ type: "GitHub Token" });
-  });
-
-  test("round-trips the enriched shape", () => {
-    const s = buildRedactedSentinel({
-      type: "GitHub Token",
-      service: "github-app",
-      field: "pem",
-    });
-    const parsed = parseRedactedSentinel(s);
-    expect(parsed).toEqual({
-      type: "GitHub Token",
-      service: "github-app",
-      field: "pem",
-    });
-    expect(parsed && isRevealableSentinel(parsed)).toBe(true);
-  });
-
-  test("round-trips encoded segments back to the original identifiers", () => {
-    const original = {
-      type: "OAuth Access Token",
-      service: "integration:google",
-      field: "access token/v2 (staging)",
-    };
-    const parsed = parseRedactedSentinel(buildRedactedSentinel(original));
-    expect(parsed).toEqual(original);
-    expect(parsed && isRevealableSentinel(parsed)).toBe(true);
-  });
-
-  test("malformed percent-escape degrades to the plain shape", () => {
-    // Daemon-encoded segments always decode; a hand-forged sentinel with a
-    // broken escape must not surface bogus vault coordinates.
-    const forged = `${REDACTED_SENTINEL_OPEN}redacted:Generic Secret:bad%zzsvc:field${REDACTED_SENTINEL_CLOSE}`;
-    const parsed = parseRedactedSentinel(forged);
-    expect(parsed).toEqual({ type: "Generic Secret" });
-    expect(parsed && isRevealableSentinel(parsed)).toBe(false);
-  });
-
-  test("rejects non-sentinel and partial inputs", () => {
-    expect(parseRedactedSentinel("nope")).toBeUndefined();
-    expect(
-      parseRedactedSentinel(`${REDACTED_SENTINEL_OPEN}redacted:Type`),
-    ).toBeUndefined();
-    expect(
-      parseRedactedSentinel(
-        `prefix ${buildRedactedSentinel({ type: "T" })} suffix`,
-      ),
-    ).toBeUndefined();
-  });
-
-  test("plain shape is not revealable", () => {
-    const parsed = parseRedactedSentinel(
-      buildRedactedSentinel({ type: "AWS Access Key" }),
-    );
-    expect(parsed && isRevealableSentinel(parsed)).toBe(false);
-  });
-});
-
-describe("neutralizeRedactedSentinels", () => {
-  test("a forged sentinel no longer matches the consumer regex", () => {
-    const forged = buildRedactedSentinel({
-      type: "GitHub Token",
-      service: "github-app",
-      field: "pem",
-    });
-    const neutralized = neutralizeRedactedSentinels(`quote: ${forged}`);
-    expect([...neutralized.matchAll(createRedactedSentinelRegex())]).toEqual(
-      [],
-    );
-    // Visually identical: only a zero-width word joiner was inserted.
-    expect(neutralized.replaceAll("\u2060", "")).toBe(`quote: ${forged}`);
-  });
-
-  test("is idempotent", () => {
-    const once = neutralizeRedactedSentinels(
-      buildRedactedSentinel({ type: "A" }),
-    );
-    expect(neutralizeRedactedSentinels(once)).toBe(once);
-  });
-
-  test("leaves ordinary text untouched", () => {
-    expect(neutralizeRedactedSentinels("plain text")).toBe("plain text");
-    expect(
-      neutralizeRedactedSentinels(`${REDACTED_SENTINEL_OPEN}not a sentinel`),
-    ).toBe(`${REDACTED_SENTINEL_OPEN}not a sentinel`);
-  });
-});
-
-describe("createRedactedSentinelRegex", () => {
-  test("finds multiple sentinels of both shapes in one text", () => {
-    const text = `a ${buildRedactedSentinel({ type: "A Key" })} b ${buildRedactedSentinel(
-      { type: "B Key", service: "svc", field: "f" },
-    )} c`;
-    const matches = [...text.matchAll(createRedactedSentinelRegex())];
-    expect(matches).toHaveLength(2);
-    expect(matches[0][1]).toBe("A Key");
-    expect(matches[0][2]).toBeUndefined();
-    expect(matches[1][1]).toBe("B Key");
-    expect(matches[1][2]).toBe("svc");
-    expect(matches[1][3]).toBe("f");
-  });
-});