@vibgrate/cli 2026.702.2 → 2026.703.1

package/dist/chunk-ROWQLHEX.js

@@ -0,0 +1,31 @@
+import { runCoreScan, writeJsonFile } from './chunk-TVPE5CA2.js';
+import * as path from 'path';
+import { Command } from 'commander';
+import chalk from 'chalk';
+
+// src/reporting/advanced-hook.ts
+async function loadAdvancedScanHook() {
+  return void 0;
+}
+
+// src/reporting/commands/baseline.ts
+async function runBaseline(rootDir) {
+  console.log(chalk.dim("Creating baseline..."));
+  const advanced = await loadAdvancedScanHook();
+  const artifact = await runCoreScan(rootDir, {
+    format: "text",
+    concurrency: 8
+  }, advanced);
+  const baselinePath = path.join(rootDir, ".vibgrate", "baseline.json");
+  await writeJsonFile(baselinePath, artifact);
+  console.log(chalk.green("\u2714") + ` Baseline saved to ${chalk.bold(".vibgrate/baseline.json")}`);
+  console.log(chalk.dim(`  Baseline score: ${artifact.drift.score}/100`));
+}
+var baselineCommand = new Command("baseline").description("Create a drift baseline snapshot").argument("[path]", "Path to baseline", ".").action(async (targetPath) => {
+  const rootDir = path.resolve(targetPath);
+  await runBaseline(rootDir);
+});
+
+export { baselineCommand, loadAdvancedScanHook, runBaseline };
+//# sourceMappingURL=chunk-ROWQLHEX.js.map
+//# sourceMappingURL=chunk-ROWQLHEX.js.map

package/dist/chunk-ROWQLHEX.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/reporting/advanced-hook.ts","../src/reporting/commands/baseline.ts"],"names":[],"mappings":";;;;;;AAUA,eAAsB,oBAAA,GAA8D;AAClF,EAAA,OAAO,MAAA;AACT;;;ACLA,eAAsB,YAAY,OAAA,EAAgC;AAChE,EAAA,OAAA,CAAQ,GAAA,CAAI,KAAA,CAAM,GAAA,CAAI,sBAAsB,CAAC,CAAA;AAE7C,EAAA,MAAM,QAAA,GAAW,MAAM,oBAAA,EAAqB;AAC5C,EAAA,MAAM,QAAA,GAAW,MAAM,WAAA,CAAY,OAAA,EAAS;AAAA,IAC1C,MAAA,EAAQ,MAAA;AAAA,IACR,WAAA,EAAa;AAAA,KACZ,QAAQ,CAAA;AAEX,EAAA,MAAM,YAAA,GAAoB,IAAA,CAAA,IAAA,CAAK,OAAA,EAAS,WAAA,EAAa,eAAe,CAAA;AACpE,EAAA,MAAM,aAAA,CAAc,cAAc,QAAQ,CAAA;AAC1C,EAAA,OAAA,CAAQ,GAAA,CAAI,KAAA,CAAM,KAAA,CAAM,QAAG,CAAA,GAAI,sBAAsB,KAAA,CAAM,IAAA,CAAK,yBAAyB,CAAC,CAAA,CAAE,CAAA;AAC5F,EAAA,OAAA,CAAQ,GAAA,CAAI,MAAM,GAAA,CAAI,CAAA,kBAAA,EAAqB,SAAS,KAAA,CAAM,KAAK,MAAM,CAAC,CAAA;AACxE;AAEO,IAAM,eAAA,GAAkB,IAAI,OAAA,CAAQ,UAAU,EAClD,WAAA,CAAY,kCAAkC,CAAA,CAC9C,QAAA,CAAS,UAAU,kBAAA,EAAoB,GAAG,CAAA,CAC1C,MAAA,CAAO,OAAO,UAAA,KAAuB;AACpC,EAAA,MAAM,OAAA,GAAe,aAAQ,UAAU,CAAA;AACvC,EAAA,MAAM,YAAY,OAAO,CAAA;AAC3B,CAAC","file":"chunk-ROWQLHEX.js","sourcesContent":["import type { AdvancedScanHook } from '../core-open/index.js';\n\n/**\n * Open build: there is no proprietary advanced-analysis hook.\n *\n * In the public, Apache-2.0 distribution every reporting command runs purely on\n * the open base engine (`runCoreScan` from `@vibgrate/core-open`). This shim\n * keeps the call sites in `scan`/`baseline` unchanged while always resolving to\n * `undefined`, so the scan falls back to the open base engine.\n */\nexport async function loadAdvancedScanHook(): Promise<AdvancedScanHook | undefined> {\n  return undefined;\n}\n","import * as path from 'node:path';\nimport { Command } from 'commander';\nimport chalk from 'chalk';\nimport { runCoreScan } from '../../core-open/index.js';\nimport { writeJsonFile } from '../utils/fs.js';\nimport { loadAdvancedScanHook } from '../advanced-hook.js';\n\nexport async function runBaseline(rootDir: string): Promise<void> {\n  console.log(chalk.dim('Creating baseline...'));\n\n  const advanced = await loadAdvancedScanHook();\n  const artifact = await runCoreScan(rootDir, {\n    format: 'text',\n    concurrency: 8,\n  }, advanced);\n\n  const baselinePath = path.join(rootDir, '.vibgrate', 'baseline.json');\n  await writeJsonFile(baselinePath, artifact);\n  console.log(chalk.green('✔') + ` Baseline saved to ${chalk.bold('.vibgrate/baseline.json')}`);\n  console.log(chalk.dim(`  Baseline score: ${artifact.drift.score}/100`));\n}\n\nexport const baselineCommand = new Command('baseline')\n  .description('Create a drift baseline snapshot')\n  .argument('[path]', 'Path to baseline', '.')\n  .action(async (targetPath: string) => {\n    const rootDir = path.resolve(targetPath);\n    await runBaseline(rootDir);\n  });\n"]}

package/dist/chunk-RXP66R2E.js

@@ -0,0 +1,39 @@
+// src/core-open/utils/redact.ts
+var SECRET_PATTERNS = [
+  // Vendor token prefixes (GitHub, GitLab, Slack, OpenAI/Stripe-style, npm, AWS).
+  /\b(?:gh[opusr]_|github_pat_)[A-Za-z0-9_]{8,}\b/g,
+  /\bglpat-[A-Za-z0-9_-]{8,}\b/g,
+  /\bxox[baprs]-[A-Za-z0-9-]{8,}\b/g,
+  /\bsk-[A-Za-z0-9_-]{8,}\b/gi,
+  /\b[sr]k_(?:live|test)_[A-Za-z0-9]{8,}\b/g,
+  /\bnpm_[A-Za-z0-9]{16,}\b/g,
+  /\b(?:AKIA|ASIA)[0-9A-Z]{12,}\b/g,
+  // JWTs.
+  /\beyJ[\w-]{8,}\.[\w-]{8,}\.[\w-]+\b/g,
+  // Authorization material.
+  /\b(?:Bearer|Basic|VibgrateDSN)\s+[A-Za-z0-9+/._:=-]{8,}/g,
+  /\b(?:authorization|api[_-]?key|apikey|access[_-]?token|client[_-]?secret|password|passwd|secret)\s*[:=]\s*['"]?[^'"\s]{6,}/gi,
+  // PEM blocks.
+  /-----BEGIN [A-Z ]*PRIVATE KEY-----[\s\S]*?(?:-----END [A-Z ]*PRIVATE KEY-----|$)/g,
+  // Long base64/hex blobs (AWS secret keys and friends).
+  /\b[A-Za-z0-9+/]{40,}={0,2}\b/g
+];
+var REDACTED = "[REDACTED]";
+function redactSecrets(text) {
+  let out = text;
+  for (const re of SECRET_PATTERNS) out = out.replace(re, REDACTED);
+  return out;
+}
+var CREDENTIAL_QUERY_KEYS = /^(?:access[_-]?token|private[_-]?token|api[_-]?key|apikey|token|secret|password|passwd|auth|authorization|x-token|sig|signature|key)$/i;
+function redactUrlCredentials(url) {
+  const noUser = url.replace(/\/\/[^@/]+@/, "//");
+  const q = noUser.indexOf("?");
+  if (q === -1) return noUser;
+  const base = noUser.slice(0, q);
+  const kept = noUser.slice(q + 1).split("&").filter((pair) => !CREDENTIAL_QUERY_KEYS.test(pair.split("=")[0] ?? ""));
+  return kept.length ? `${base}?${kept.join("&")}` : base;
+}
+
+export { redactSecrets, redactUrlCredentials };
+//# sourceMappingURL=chunk-RXP66R2E.js.map
+//# sourceMappingURL=chunk-RXP66R2E.js.map

package/dist/chunk-RXP66R2E.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/core-open/utils/redact.ts"],"names":[],"mappings":";AAUA,IAAM,eAAA,GAA4B;AAAA;AAAA,EAEhC,iDAAA;AAAA,EACA,8BAAA;AAAA,EACA,kCAAA;AAAA,EACA,4BAAA;AAAA,EACA,0CAAA;AAAA,EACA,2BAAA;AAAA,EACA,iCAAA;AAAA;AAAA,EAEA,sCAAA;AAAA;AAAA,EAEA,0DAAA;AAAA,EACA,8HAAA;AAAA;AAAA,EAEA,mFAAA;AAAA;AAAA,EAEA;AACF,CAAA;AAEO,IAAM,QAAA,GAAW,YAAA;AAGjB,SAAS,cAAc,IAAA,EAAsB;AAClD,EAAA,IAAI,GAAA,GAAM,IAAA;AACV,EAAA,KAAA,MAAW,MAAM,eAAA,EAAiB,GAAA,GAAM,GAAA,CAAI,OAAA,CAAQ,IAAI,QAAQ,CAAA;AAChE,EAAA,OAAO,GAAA;AACT;AAYA,IAAM,qBAAA,GACJ,wIAAA;AAOK,SAAS,qBAAqB,GAAA,EAAqB;AACxD,EAAA,MAAM,MAAA,GAAS,GAAA,CAAI,OAAA,CAAQ,aAAA,EAAe,IAAI,CAAA;AAC9C,EAAA,MAAM,CAAA,GAAI,MAAA,CAAO,OAAA,CAAQ,GAAG,CAAA;AAC5B,EAAA,IAAI,CAAA,KAAM,IAAI,OAAO,MAAA;AACrB,EAAA,MAAM,IAAA,GAAO,MAAA,CAAO,KAAA,CAAM,CAAA,EAAG,CAAC,CAAA;AAC9B,EAAA,MAAM,IAAA,GAAO,OACV,KAAA,CAAM,CAAA,GAAI,CAAC,CAAA,CACX,KAAA,CAAM,GAAG,CAAA,CACT,MAAA,CAAO,CAAC,SAAS,CAAC,qBAAA,CAAsB,KAAK,IAAA,CAAK,KAAA,CAAM,GAAG,CAAA,CAAE,CAAC,CAAA,IAAK,EAAE,CAAC,CAAA;AACzE,EAAA,OAAO,IAAA,CAAK,SAAS,CAAA,EAAG,IAAI,IAAI,IAAA,CAAK,IAAA,CAAK,GAAG,CAAC,CAAA,CAAA,GAAK,IAAA;AACrD","file":"chunk-RXP66R2E.js","sourcesContent":["// VENDORED from @vibgrate/core-open (packages/vibgrate-core-open) by\n// scripts/vendor-core-open.mjs. Do not edit here — change the source package\n// and re-run the vendor script. Apache-2.0.\n/**\n * Shared credential redaction (GUARDRAILS §1.1): applied at INGEST, before\n * anything is stored or uploaded. One detector, reused by the VCS capture, the\n * graph builder (signatures/docs), and the push envelope — so every surface\n * scrubs the same shapes and a new token prefix is added in exactly one place.\n */\n\nconst SECRET_PATTERNS: RegExp[] = [\n  // Vendor token prefixes (GitHub, GitLab, Slack, OpenAI/Stripe-style, npm, AWS).\n  /\\b(?:gh[opusr]_|github_pat_)[A-Za-z0-9_]{8,}\\b/g,\n  /\\bglpat-[A-Za-z0-9_-]{8,}\\b/g,\n  /\\bxox[baprs]-[A-Za-z0-9-]{8,}\\b/g,\n  /\\bsk-[A-Za-z0-9_-]{8,}\\b/gi,\n  /\\b[sr]k_(?:live|test)_[A-Za-z0-9]{8,}\\b/g,\n  /\\bnpm_[A-Za-z0-9]{16,}\\b/g,\n  /\\b(?:AKIA|ASIA)[0-9A-Z]{12,}\\b/g,\n  // JWTs.\n  /\\beyJ[\\w-]{8,}\\.[\\w-]{8,}\\.[\\w-]+\\b/g,\n  // Authorization material.\n  /\\b(?:Bearer|Basic|VibgrateDSN)\\s+[A-Za-z0-9+/._:=-]{8,}/g,\n  /\\b(?:authorization|api[_-]?key|apikey|access[_-]?token|client[_-]?secret|password|passwd|secret)\\s*[:=]\\s*['\"]?[^'\"\\s]{6,}/gi,\n  // PEM blocks.\n  /-----BEGIN [A-Z ]*PRIVATE KEY-----[\\s\\S]*?(?:-----END [A-Z ]*PRIVATE KEY-----|$)/g,\n  // Long base64/hex blobs (AWS secret keys and friends).\n  /\\b[A-Za-z0-9+/]{40,}={0,2}\\b/g,\n];\n\nexport const REDACTED = '[REDACTED]';\n\n/** Replace every credential-shaped substring with [REDACTED]. Deterministic. */\nexport function redactSecrets(text: string): string {\n  let out = text;\n  for (const re of SECRET_PATTERNS) out = out.replace(re, REDACTED);\n  return out;\n}\n\n/** True when the text contains at least one credential-shaped substring. */\nexport function containsSecret(text: string): boolean {\n  return SECRET_PATTERNS.some((re) => {\n    re.lastIndex = 0;\n    const hit = re.test(text);\n    re.lastIndex = 0;\n    return hit;\n  });\n}\n\nconst CREDENTIAL_QUERY_KEYS =\n  /^(?:access[_-]?token|private[_-]?token|api[_-]?key|apikey|token|secret|password|passwd|auth|authorization|x-token|sig|signature|key)$/i;\n\n/**\n * Strip credentials from a URL: userinfo (`//user:token@host`) AND\n * credential-bearing query parameters (`?access_token=…`, `?private_token=…`).\n * Non-URL strings pass through with just the userinfo strip applied.\n */\nexport function redactUrlCredentials(url: string): string {\n  const noUser = url.replace(/\\/\\/[^@/]+@/, '//');\n  const q = noUser.indexOf('?');\n  if (q === -1) return noUser;\n  const base = noUser.slice(0, q);\n  const kept = noUser\n    .slice(q + 1)\n    .split('&')\n    .filter((pair) => !CREDENTIAL_QUERY_KEYS.test(pair.split('=')[0] ?? ''));\n  return kept.length ? `${base}?${kept.join('&')}` : base;\n}\n"]}