@vibecheckai/cli 3.2.2 → 3.2.4

package/bin/runners/lib/contracts/external-contract.js

@@ -1,206 +1,206 @@
-/**
- * External Contract Builder
- * Builds external.json contract from truthpack (Stripe, GitHub, etc.)
- */
-
-"use strict";
-
-/**
- * Build external services contract from truthpack
- */
-function buildExternalContract(truthpack) {
-  const contract = {
-    version: "1.0.0",
-    generatedAt: new Date().toISOString(),
-    services: []
-  };
-
-  // Extract billing/Stripe info
-  const billing = truthpack?.billing || {};
-  if (billing.hasStripe || billing.webhookCandidates?.length) {
-    const stripeService = {
-      name: "stripe",
-      envVars: extractStripeEnvVars(truthpack),
-      usedIn: billing.webhookCandidates?.map(w => w.file) || [],
-      webhooks: billing.webhookCandidates?.map(w => ({
-        path: w.path,
-        verified: w.hasSignatureVerification || false,
-        idempotent: w.hasIdempotency || false
-      })) || [],
-      evidence: billing.webhookCandidates?.flatMap(w => w.evidence || []) || []
-    };
-    contract.services.push(stripeService);
-  }
-
-  // Detect other external services from env vars
-  const envVars = truthpack?.env?.vars || [];
-  
-  // GitHub
-  const githubVars = envVars.filter(v => /github/i.test(v.name));
-  if (githubVars.length) {
-    contract.services.push({
-      name: "github",
-      envVars: githubVars.map(v => v.name),
-      usedIn: githubVars.flatMap(v => v.references?.map(r => r.file) || []),
-      evidence: githubVars.flatMap(v => v.references || [])
-    });
-  }
-
-  // SendGrid
-  const sendgridVars = envVars.filter(v => /sendgrid/i.test(v.name));
-  if (sendgridVars.length) {
-    contract.services.push({
-      name: "sendgrid",
-      envVars: sendgridVars.map(v => v.name),
-      usedIn: sendgridVars.flatMap(v => v.references?.map(r => r.file) || []),
-      evidence: sendgridVars.flatMap(v => v.references || [])
-    });
-  }
-
-  // Twilio
-  const twilioVars = envVars.filter(v => /twilio/i.test(v.name));
-  if (twilioVars.length) {
-    contract.services.push({
-      name: "twilio",
-      envVars: twilioVars.map(v => v.name),
-      usedIn: twilioVars.flatMap(v => v.references?.map(r => r.file) || []),
-      evidence: twilioVars.flatMap(v => v.references || [])
-    });
-  }
-
-  // AWS
-  const awsVars = envVars.filter(v => /^aws/i.test(v.name));
-  if (awsVars.length) {
-    contract.services.push({
-      name: "aws",
-      envVars: awsVars.map(v => v.name),
-      usedIn: awsVars.flatMap(v => v.references?.map(r => r.file) || []),
-      evidence: awsVars.flatMap(v => v.references || [])
-    });
-  }
-
-  // Supabase
-  const supabaseVars = envVars.filter(v => /supabase/i.test(v.name));
-  if (supabaseVars.length) {
-    contract.services.push({
-      name: "supabase",
-      envVars: supabaseVars.map(v => v.name).sort(),
-      usedIn: [...new Set(supabaseVars.flatMap(v => v.references?.map(r => r.file) || []))].sort(),
-      evidence: supabaseVars.flatMap(v => v.references || [])
-    });
-  }
-
-  // Deterministic output: sort services by name, and their internal arrays
-  contract.services.sort((a, b) => a.name.localeCompare(b.name));
-  for (const svc of contract.services) {
-    if (svc.envVars) svc.envVars.sort();
-    if (svc.usedIn) svc.usedIn = [...new Set(svc.usedIn)].sort();
-    if (svc.webhooks) svc.webhooks.sort((a, b) => a.path.localeCompare(b.path));
-  }
-
-  return contract;
-}
-
-function extractStripeEnvVars(truthpack) {
-  const envVars = truthpack?.env?.vars || [];
-  return envVars
-    .filter(v => /stripe/i.test(v.name))
-    .map(v => v.name);
-}
-
-/**
- * Validate external services contract
- */
-function validateExternalContract(contract) {
-  const violations = [];
-
-  for (const service of contract.services) {
-    // Check Stripe webhook verification
-    if (service.name === "stripe") {
-      for (const webhook of service.webhooks || []) {
-        if (!webhook.verified) {
-          violations.push({
-            type: "unverified_webhook",
-            severity: "BLOCK",
-            service: "stripe",
-            path: webhook.path,
-            message: `Stripe webhook at ${webhook.path} missing signature verification`,
-            evidence: []
-          });
-        }
-        if (!webhook.idempotent) {
-          violations.push({
-            type: "non_idempotent_webhook",
-            severity: "WARN",
-            service: "stripe",
-            path: webhook.path,
-            message: `Stripe webhook at ${webhook.path} may not be idempotent`,
-            evidence: []
-          });
-        }
-      }
-    }
-
-    // Check for missing required env vars
-    const requiredVars = getRequiredVarsForService(service.name);
-    for (const required of requiredVars) {
-      if (!service.envVars.includes(required)) {
-        violations.push({
-          type: "missing_env",
-          severity: "WARN",
-          service: service.name,
-          envVar: required,
-          message: `Service ${service.name} typically requires ${required}`,
-          evidence: []
-        });
-      }
-    }
-  }
-
-  return violations;
-}
-
-function getRequiredVarsForService(name) {
-  const requirements = {
-    stripe: ["STRIPE_SECRET_KEY", "STRIPE_WEBHOOK_SECRET"],
-    github: ["GITHUB_TOKEN"],
-    sendgrid: ["SENDGRID_API_KEY"],
-    twilio: ["TWILIO_ACCOUNT_SID", "TWILIO_AUTH_TOKEN"],
-    supabase: ["SUPABASE_URL", "SUPABASE_ANON_KEY"]
-  };
-  return requirements[name] || [];
-}
-
-/**
- * Diff two external contracts
- */
-function diffExternalContracts(before, after) {
-  const diff = {
-    added: [],
-    removed: [],
-    changed: []
-  };
-
-  const beforeMap = new Map(before.services.map(s => [s.name, s]));
-  const afterMap = new Map(after.services.map(s => [s.name, s]));
-
-  for (const [name, service] of afterMap) {
-    if (!beforeMap.has(name)) {
-      diff.added.push(service);
-    }
-  }
-
-  for (const [name, service] of beforeMap) {
-    if (!afterMap.has(name)) {
-      diff.removed.push(service);
-    }
-  }
-
-  return diff;
-}
-
-module.exports = {
-  buildExternalContract,
-  validateExternalContract,
-  diffExternalContracts
-};
+/**
+ * External Contract Builder
+ * Builds external.json contract from truthpack (Stripe, GitHub, etc.)
+ */
+
+"use strict";
+
+/**
+ * Build external services contract from truthpack
+ */
+function buildExternalContract(truthpack) {
+  const contract = {
+    version: "1.0.0",
+    generatedAt: new Date().toISOString(),
+    services: []
+  };
+
+  // Extract billing/Stripe info
+  const billing = truthpack?.billing || {};
+  if (billing.hasStripe || billing.webhookCandidates?.length) {
+    const stripeService = {
+      name: "stripe",
+      envVars: extractStripeEnvVars(truthpack),
+      usedIn: billing.webhookCandidates?.map(w => w.file) || [],
+      webhooks: billing.webhookCandidates?.map(w => ({
+        path: w.path,
+        verified: w.hasSignatureVerification || false,
+        idempotent: w.hasIdempotency || false
+      })) || [],
+      evidence: billing.webhookCandidates?.flatMap(w => w.evidence || []) || []
+    };
+    contract.services.push(stripeService);
+  }
+
+  // Detect other external services from env vars
+  const envVars = truthpack?.env?.vars || [];
+  
+  // GitHub
+  const githubVars = envVars.filter(v => /github/i.test(v.name));
+  if (githubVars.length) {
+    contract.services.push({
+      name: "github",
+      envVars: githubVars.map(v => v.name),
+      usedIn: githubVars.flatMap(v => v.references?.map(r => r.file) || []),
+      evidence: githubVars.flatMap(v => v.references || [])
+    });
+  }
+
+  // SendGrid
+  const sendgridVars = envVars.filter(v => /sendgrid/i.test(v.name));
+  if (sendgridVars.length) {
+    contract.services.push({
+      name: "sendgrid",
+      envVars: sendgridVars.map(v => v.name),
+      usedIn: sendgridVars.flatMap(v => v.references?.map(r => r.file) || []),
+      evidence: sendgridVars.flatMap(v => v.references || [])
+    });
+  }
+
+  // Twilio
+  const twilioVars = envVars.filter(v => /twilio/i.test(v.name));
+  if (twilioVars.length) {
+    contract.services.push({
+      name: "twilio",
+      envVars: twilioVars.map(v => v.name),
+      usedIn: twilioVars.flatMap(v => v.references?.map(r => r.file) || []),
+      evidence: twilioVars.flatMap(v => v.references || [])
+    });
+  }
+
+  // AWS
+  const awsVars = envVars.filter(v => /^aws/i.test(v.name));
+  if (awsVars.length) {
+    contract.services.push({
+      name: "aws",
+      envVars: awsVars.map(v => v.name),
+      usedIn: awsVars.flatMap(v => v.references?.map(r => r.file) || []),
+      evidence: awsVars.flatMap(v => v.references || [])
+    });
+  }
+
+  // Supabase
+  const supabaseVars = envVars.filter(v => /supabase/i.test(v.name));
+  if (supabaseVars.length) {
+    contract.services.push({
+      name: "supabase",
+      envVars: supabaseVars.map(v => v.name).sort(),
+      usedIn: [...new Set(supabaseVars.flatMap(v => v.references?.map(r => r.file) || []))].sort(),
+      evidence: supabaseVars.flatMap(v => v.references || [])
+    });
+  }
+
+  // Deterministic output: sort services by name, and their internal arrays
+  contract.services.sort((a, b) => a.name.localeCompare(b.name));
+  for (const svc of contract.services) {
+    if (svc.envVars) svc.envVars.sort();
+    if (svc.usedIn) svc.usedIn = [...new Set(svc.usedIn)].sort();
+    if (svc.webhooks) svc.webhooks.sort((a, b) => a.path.localeCompare(b.path));
+  }
+
+  return contract;
+}
+
+function extractStripeEnvVars(truthpack) {
+  const envVars = truthpack?.env?.vars || [];
+  return envVars
+    .filter(v => /stripe/i.test(v.name))
+    .map(v => v.name);
+}
+
+/**
+ * Validate external services contract
+ */
+function validateExternalContract(contract) {
+  const violations = [];
+
+  for (const service of contract.services) {
+    // Check Stripe webhook verification
+    if (service.name === "stripe") {
+      for (const webhook of service.webhooks || []) {
+        if (!webhook.verified) {
+          violations.push({
+            type: "unverified_webhook",
+            severity: "BLOCK",
+            service: "stripe",
+            path: webhook.path,
+            message: `Stripe webhook at ${webhook.path} missing signature verification`,
+            evidence: []
+          });
+        }
+        if (!webhook.idempotent) {
+          violations.push({
+            type: "non_idempotent_webhook",
+            severity: "WARN",
+            service: "stripe",
+            path: webhook.path,
+            message: `Stripe webhook at ${webhook.path} may not be idempotent`,
+            evidence: []
+          });
+        }
+      }
+    }
+
+    // Check for missing required env vars
+    const requiredVars = getRequiredVarsForService(service.name);
+    for (const required of requiredVars) {
+      if (!service.envVars.includes(required)) {
+        violations.push({
+          type: "missing_env",
+          severity: "WARN",
+          service: service.name,
+          envVar: required,
+          message: `Service ${service.name} typically requires ${required}`,
+          evidence: []
+        });
+      }
+    }
+  }
+
+  return violations;
+}
+
+function getRequiredVarsForService(name) {
+  const requirements = {
+    stripe: ["STRIPE_SECRET_KEY", "STRIPE_WEBHOOK_SECRET"],
+    github: ["GITHUB_TOKEN"],
+    sendgrid: ["SENDGRID_API_KEY"],
+    twilio: ["TWILIO_ACCOUNT_SID", "TWILIO_AUTH_TOKEN"],
+    supabase: ["SUPABASE_URL", "SUPABASE_ANON_KEY"]
+  };
+  return requirements[name] || [];
+}
+
+/**
+ * Diff two external contracts
+ */
+function diffExternalContracts(before, after) {
+  const diff = {
+    added: [],
+    removed: [],
+    changed: []
+  };
+
+  const beforeMap = new Map(before.services.map(s => [s.name, s]));
+  const afterMap = new Map(after.services.map(s => [s.name, s]));
+
+  for (const [name, service] of afterMap) {
+    if (!beforeMap.has(name)) {
+      diff.added.push(service);
+    }
+  }
+
+  for (const [name, service] of beforeMap) {
+    if (!afterMap.has(name)) {
+      diff.removed.push(service);
+    }
+  }
+
+  return diff;
+}
+
+module.exports = {
+  buildExternalContract,
+  validateExternalContract,
+  diffExternalContracts
+};