integration-tour 1.0.7 → 1.0.8

package/dist/cli.js

@@ -5281,7 +5281,26 @@ function secretName(name) {
   if (/idempotency/i.test(name)) return false;
   return /secret|passw(or)?d|pwd|token|api[-_]?key|apikey|credential|signature|session|cookie|bearer|jwt|^auth(orization)?$/i.test(name) || /(^|[_-])key$|[a-z0-9]Key$|^key$/i.test(name);
 }
-var SECRET_VALUE = /^(sk|rk)_(live|test)_|^gh[pousr]_|^github_pat_|^xox[abposr]-|^AKIA[0-9A-Z]{12,}|^eyJ[\w-]+\.[\w-]+|^(bearer|basic)\s/i;
+var SECRET_VALUE = /^(sk|rk)_(live|test)_|^whsec_|^gh[pousr]_|^github_pat_|^xox[abposr]-|^(AKIA|ASIA)[0-9A-Z]{12,}|^eyJ[\w-]+\.[\w-]+|^(bearer|basic)\s|^sk-[\w-]{20,}|^AIza[\w-]{30,}|^ya29\.[\w-]{20,}|^SG\.[\w-]{16,}\.[\w-]{16,}|^npm_[A-Za-z0-9]{30,}|^glpat-[\w-]{20,}|^hf_[A-Za-z0-9]{30,}|^shp(at|ss|ca|pa)_[a-fA-F0-9]{32}|^sq0(atp|csp)-[\w-]{20,}|^-----BEGIN [A-Z ]*PRIVATE KEY-----/i;
+function credentialName(name) {
+  if (/^key$/i.test(name.trim()) || /(type|kind|url|uri|endpoint|expires?(_?(in|at))?|name|count|length|hint|prefix)$/i.test(name)) return false;
+  return secretName(name) || /(^|[^a-z])auth([^a-z]|$)/i.test(name);
+}
+function hiddenAs(name) {
+  return /passw(or)?d|pwd/i.test(name) ? "\u2022\u2022\u2022\u2022\u2022\u2022\u2022\u2022" : placeholder(name || "secret");
+}
+function withoutCredential(name, value, hid) {
+  if (!given(value) || !(credentialName(name) || SECRET_VALUE.test(value.trim()))) return value;
+  hid.add(name || "a value");
+  return hiddenAs(name);
+}
+function withoutCredentials(value, hid, name = "", depth = 0) {
+  if (depth > 40) return value;
+  if (typeof value === "string") return withoutCredential(name, value, hid);
+  if (Array.isArray(value)) return value.map((v) => withoutCredentials(v, hid, name, depth + 1));
+  if (isObj(value)) return Object.fromEntries(Object.entries(value).map(([key, v]) => [key, withoutCredentials(v, hid, key, depth + 1)]));
+  return value;
+}
 function readVariables(list7, into) {
   if (!Array.isArray(list7)) return;
   for (const v of list7) {
@@ -5662,7 +5681,7 @@ function payloadOf(value, required) {
   if (holdsPlaceholder(value)) return { schema: schemaOf(value, { required, examples: true }) };
   return { schema: schemaOf(value, { required }), example: value };
 }
-function bodyOf(raw, contentType, vars) {
+function bodyOf(raw, contentType, vars, hid) {
   if (!isObj(raw) || raw.disabled === true) return void 0;
   const mode = typeof raw.mode === "string" ? raw.mode : "";
   switch (mode) {
@@ -5674,7 +5693,7 @@ function bodyOf(raw, contentType, vars) {
       const type2 = contentType ?? RAW_TYPES[language] ?? (looksJson(text3) ? "application/json" : "text/plain");
       if (/json/i.test(type2)) {
         const value = jsonBody(text3, vars);
-        if (value !== void 0) return { media: type2, ...payloadOf(value, true) };
+        if (value !== void 0) return { media: type2, ...payloadOf(withoutCredentials(value, hid), true) };
         return { media: "text/plain", schema: { type: "string" }, example: vars.fill(text3) };
       }
       return { media: type2, schema: { type: "string" }, example: vars.fill(text3) };
@@ -5685,7 +5704,10 @@ function bodyOf(raw, contentType, vars) {
       const fields = pairs(raw[mode]);
       if (!fields.length) return void 0;
       const files = new Set(Array.isArray(raw[mode]) ? raw[mode].flatMap((f) => multipart && isObj(f) && f.type === "file" && typeof f.key === "string" ? [f.key.trim()] : []) : []);
-      const entries = fields.map((f) => ({ key: vars.fill(f.key, false), file: files.has(f.key), value: vars.fill(f.value, !f.disabled), field: f }));
+      const entries = fields.map((f) => {
+        const key = vars.fill(f.key, false);
+        return { key, file: files.has(f.key), value: withoutCredential(key, vars.fill(f.value, !f.disabled), hid), field: f };
+      });
       const properties = Object.fromEntries(
         entries.map(({ key, file, value, field }) => {
           if (file) return [key, { type: "string", format: "binary" }];
@@ -5706,7 +5728,8 @@ function bodyOf(raw, contentType, vars) {
       const g = isObj(raw.graphql) ? raw.graphql : {};
       const query = typeof g.query === "string" ? vars.fill(g.query) : "";
       if (!query.trim()) return void 0;
-      const variables = typeof g.variables === "string" && g.variables.trim() ? jsonBody(g.variables, vars) : isObj(g.variables) ? g.variables : void 0;
+      const sent = typeof g.variables === "string" && g.variables.trim() ? jsonBody(g.variables, vars) : isObj(g.variables) ? g.variables : void 0;
+      const variables = sent === void 0 ? void 0 : withoutCredentials(sent, hid);
       const example = { query, ...variables !== void 0 ? { variables } : {} };
       return { media: "application/json", ...payloadOf(example, true) };
     }
@@ -5714,7 +5737,7 @@ function bodyOf(raw, contentType, vars) {
       return void 0;
   }
 }
-function responsesOf(saved, requestName) {
+function responsesOf(saved, requestName, hid) {
   const out = {};
   for (const r of saved) {
     if (!isObj(r)) continue;
@@ -5729,7 +5752,7 @@ function responsesOf(saved, requestName) {
     const body = typeof r.body === "string" ? r.body : "";
     if (body.trim()) {
       const value = (type2 ? /json/i.test(type2) : looksJson(body)) ? parseJson(body) : void 0;
-      if (value !== void 0) response.content = { [type2 ?? "application/json"]: payloadOf(value, "all") };
+      if (value !== void 0) response.content = { [type2 ?? "application/json"]: payloadOf(withoutCredentials(value, hid), "all") };
       else response.content = { [type2 && !/json/i.test(type2) ? type2 : "text/plain"]: { schema: { type: "string" }, example: body } };
     }
     out[status] = response;
@@ -5807,6 +5830,7 @@ function convertPostman(raw, environments = [], source) {
   collect(collection.item, void 0, ownAuth(collection.auth), saved, counts);
   const schemes = new Schemes();
   const notes = /* @__PURE__ */ new Set();
+  const hid = /* @__PURE__ */ new Set();
   const requirementOf = (auth, headers) => {
     const scheme = auth ? schemeOf(auth, vars, notes) : void 0;
     const parts = [];
@@ -5851,7 +5875,7 @@ function convertPostman(raw, environments = [], source) {
     const item = paths[path] ??= {};
     const slots = FIXED_METHODS.has(method) ? item : item.additionalOperations ??= {};
     const name = bareName(vars.fill(r.name, false));
-    const responses = responsesOf(r.responses, r.name);
+    const responses = responsesOf(r.responses, r.name, hid);
     const success = Object.keys(responses).some((s) => /^2/.test(s));
     const existing = slots[method];
     if (isObj(existing)) {
@@ -5876,15 +5900,19 @@ function convertPostman(raw, environments = [], source) {
       else if (/^cookie$/i.test(h.key)) {
         for (const part of h.value.split(";")) {
           const eq = part.indexOf("=");
-          if (eq > 0) parameters.push({ name: part.slice(0, eq).trim(), in: "cookie", required: true, schema: { type: "string" }, example: vars.fill(part.slice(eq + 1).trim()) });
+          if (eq <= 0) continue;
+          const cookie = part.slice(0, eq).trim();
+          const value = vars.fill(part.slice(eq + 1).trim());
+          if (given(value)) hid.add(cookie);
+          parameters.push({ name: cookie, in: "cookie", required: true, schema: { type: "string" }, example: given(value) ? hiddenAs(cookie) : value });
         }
-      } else parameters.push({ name: h.key, in: "header", required: true, ...valueOf(vars.fill(h.value)), ...h.description ? { description: h.description } : {} });
+      } else parameters.push({ name: h.key, in: "header", required: true, ...valueOf(withoutCredential(h.key, vars.fill(h.value), hid)), ...h.description ? { description: h.description } : {} });
     }
     const query = /* @__PURE__ */ new Map();
     for (const q of url.query) {
       const key = vars.fill(q.key, false).trim();
       if (!key) continue;
-      const value = vars.fill(q.value, !q.disabled);
+      const value = withoutCredential(key, vars.fill(q.value, !q.disabled), hid);
       const entry = query.get(key);
       if (!entry) query.set(key, { values: [value], required: !q.disabled, ...q.description ? { description: q.description } : {} });
       else if (!q.disabled) {
@@ -5898,7 +5926,7 @@ function convertPostman(raw, environments = [], source) {
       const value = many ? { schema: { type: "array", items: { type: "string" } }, example: q.values } : valueOf(q.values[0]);
       parameters.push({ name: key, in: "query", required: q.required, ...value, ...q.description ? { description: q.description } : {} });
     }
-    const body = bodyOf(r.request.body, contentType, vars);
+    const body = bodyOf(r.request.body, contentType, vars, hid);
     const lowered = method.toLowerCase();
     const operationId = namesUrl(name) ? void 0 : operationIdFor(name, usedIds);
     const op = {
@@ -5937,6 +5965,7 @@ function convertPostman(raw, environments = [], source) {
   else if (unsetHosts.has("")) warnings.push("Some requests give no host, so the video puts them on api.example.com.");
   const unset = [...vars.unset].filter((n) => !unsetHosts.has(n));
   if (unset.length) warnings.push(`Some variables have no value in the collection, so the video shows them as written, or an id an earlier call returned: ${list2(unset.map((n) => `{{${n}}}`))}.`);
+  if (hid.size) warnings.push(`Credentials written out in the requests or their saved responses, rather than kept in variables, show hidden: ${list2([...hid])}.`);
   if (vars.secret.size) warnings.push(`Variables that look like credentials aren't filled in, so the video shows them as written: ${list2([...vars.secret].map((n) => `{{${n}}}`))}.`);
   if (placed.length && unsaved === placed.length && app !== "Postman") warnings.push(`${app}'s exports hold no responses, so the calls show no response body. A design document's spec gives them.`);
   else if (placed.length && unsaved === placed.length) warnings.push("None of the requests has a successful response saved as an example, so the calls show no response body. Save a response as an example in Postman to show it.");
@@ -11022,7 +11051,7 @@ function unknownKeys(raw, known, where, problems) {
 }
 
 // package.json
-var version = "1.0.7";
+var version = "1.0.8";
 
 // src/files.ts
 var import_node_fs = require("node:fs");

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "integration-tour",
-  "version": "1.0.7",
+  "version": "1.0.8",
   "description": "Renders integration videos of your API or MCP server from its OpenAPI spec or tools, in your own build, so they stay in step with it.",
   "keywords": [
     "openapi",