integration-tour 1.0.7 → 1.0.9

package/dist/cli.js

@@ -5281,7 +5281,38 @@ function secretName(name) {
   if (/idempotency/i.test(name)) return false;
   return /secret|passw(or)?d|pwd|token|api[-_]?key|apikey|credential|signature|session|cookie|bearer|jwt|^auth(orization)?$/i.test(name) || /(^|[_-])key$|[a-z0-9]Key$|^key$/i.test(name);
 }
-var SECRET_VALUE = /^(sk|rk)_(live|test)_|^gh[pousr]_|^github_pat_|^xox[abposr]-|^AKIA[0-9A-Z]{12,}|^eyJ[\w-]+\.[\w-]+|^(bearer|basic)\s/i;
+var SECRET_VALUE = /^(sk|rk)_(live|test)_|^whsec_|^gh[pousr]_|^github_pat_|^xox[abposr]-|^(AKIA|ASIA)[0-9A-Z]{12,}|^eyJ[\w-]+\.[\w-]+|^(bearer|basic)\s|^sk-[\w-]{20,}|^AIza[\w-]{30,}|^ya29\.[\w-]{20,}|^SG\.[\w-]{16,}\.[\w-]{16,}|^npm_[A-Za-z0-9]{30,}|^glpat-[\w-]{20,}|^hf_[A-Za-z0-9]{30,}|^shp(at|ss|ca|pa)_[a-fA-F0-9]{32}|^sq0(atp|csp)-[\w-]{20,}|^-----BEGIN [A-Z ]*PRIVATE KEY-----/i;
+function credentialName(name) {
+  if (/^key$/i.test(name.trim()) || /(type|kind|url|uri|endpoint|expires?(_?(in|at))?|name|count|length|hint|prefix)$/i.test(name)) return false;
+  return secretName(name) || /(^|[^a-z])auth([^a-z]|$)/i.test(name);
+}
+var BOT_TOKEN = /^bot\d{5,}:[\w-]{30,}$/;
+var PREFIXED_ID = /^[a-z]{1,10}_/;
+function pathSecret(segment) {
+  const s = segment.trim();
+  if (BOT_TOKEN.test(s)) return "bot_token";
+  if (SECRET_VALUE.test(s)) return "token";
+  const random = s.length >= 24 && /^[A-Za-z0-9_\-.~:]+$/.test(s) && /[a-z]/.test(s) && /[A-Z]/.test(s) && /\d/.test(s);
+  return random && !PREFIXED_ID.test(s) ? "token" : void 0;
+}
+function withoutUserinfo(address) {
+  return address.replace(/^([a-z][a-z\d+.-]*:\/\/)?[^/@\s]*@/i, (_, scheme) => scheme ?? "");
+}
+function hiddenAs(name) {
+  return /passw(or)?d|pwd/i.test(name) ? "\u2022\u2022\u2022\u2022\u2022\u2022\u2022\u2022" : placeholder(name || "secret");
+}
+function withoutCredential(name, value, hid) {
+  if (!given(value) || !(credentialName(name) || SECRET_VALUE.test(value.trim()))) return value;
+  hid.add(name || "a value");
+  return hiddenAs(name);
+}
+function withoutCredentials(value, hid, name = "", depth = 0) {
+  if (depth > 40) return value;
+  if (typeof value === "string") return withoutCredential(name, value, hid);
+  if (Array.isArray(value)) return value.map((v) => withoutCredentials(v, hid, name, depth + 1));
+  if (isObj(value)) return Object.fromEntries(Object.entries(value).map(([key, v]) => [key, withoutCredentials(v, hid, key, depth + 1)]));
+  return value;
+}
 function readVariables(list7, into) {
   if (!Array.isArray(list7)) return;
   for (const v of list7) {
@@ -5403,7 +5434,7 @@ function decoded(text3) {
 }
 var LOCAL_HOST = /^(localhost|127\.\d+\.\d+\.\d+|0\.0\.0\.0|\[::1\])(:|\/|$)/i;
 function serverOf(url, vars, unset) {
-  let host = vars.fill(url.host, false).trim();
+  let host = withoutUserinfo(vars.fill(url.host, false).trim());
   const left = [...host.matchAll(VARIABLE)].map((m) => m[1].trim());
   for (const name of left) unset.add(name);
   if (left.length) {
@@ -5419,7 +5450,7 @@ function serverOf(url, vars, unset) {
   return `${protocol}://${host}${url.port ? `:${vars.fill(url.port, false)}` : ""}`.replace(/\/+$/, "");
 }
 var VERSION = /^(v\d+(\.\d+)*|\d{4}-\d{2}-\d{2})$/i;
-function pathOf(url, vars, params) {
+function pathOf(url, vars, params, hid) {
   const segments = url.path.map((s) => s.trim()).filter(Boolean);
   const out = segments.map((segment) => {
     const colon = segment.match(/^:([A-Za-z_][\w-]*)(.*)$/);
@@ -5428,6 +5459,14 @@ function pathOf(url, vars, params) {
       if (!params.has(name)) params.set(name, colonParam(name, url.variables, vars));
       return `{${name}}${vars.fill(rest, false)}`;
     }
+    const secret = segment.includes("{{") ? void 0 : pathSecret(decoded(segment));
+    if (secret) {
+      let param = secret;
+      for (let n = 2; params.has(param); n++) param = `${secret}_${n}`;
+      params.set(param, { name: param, in: "path", required: true, schema: { type: "string" }, example: placeholder(param) });
+      hid.add(param);
+      return `{${param}}`;
+    }
     return segment.replace(VARIABLE, (whole, raw) => {
       const name = raw.trim();
       const value = vars.value(name, false);
@@ -5662,7 +5701,7 @@ function payloadOf(value, required) {
   if (holdsPlaceholder(value)) return { schema: schemaOf(value, { required, examples: true }) };
   return { schema: schemaOf(value, { required }), example: value };
 }
-function bodyOf(raw, contentType, vars) {
+function bodyOf(raw, contentType, vars, hid) {
   if (!isObj(raw) || raw.disabled === true) return void 0;
   const mode = typeof raw.mode === "string" ? raw.mode : "";
   switch (mode) {
@@ -5674,7 +5713,7 @@ function bodyOf(raw, contentType, vars) {
       const type2 = contentType ?? RAW_TYPES[language] ?? (looksJson(text3) ? "application/json" : "text/plain");
       if (/json/i.test(type2)) {
         const value = jsonBody(text3, vars);
-        if (value !== void 0) return { media: type2, ...payloadOf(value, true) };
+        if (value !== void 0) return { media: type2, ...payloadOf(withoutCredentials(value, hid), true) };
         return { media: "text/plain", schema: { type: "string" }, example: vars.fill(text3) };
       }
       return { media: type2, schema: { type: "string" }, example: vars.fill(text3) };
@@ -5685,7 +5724,10 @@ function bodyOf(raw, contentType, vars) {
       const fields = pairs(raw[mode]);
       if (!fields.length) return void 0;
       const files = new Set(Array.isArray(raw[mode]) ? raw[mode].flatMap((f) => multipart && isObj(f) && f.type === "file" && typeof f.key === "string" ? [f.key.trim()] : []) : []);
-      const entries = fields.map((f) => ({ key: vars.fill(f.key, false), file: files.has(f.key), value: vars.fill(f.value, !f.disabled), field: f }));
+      const entries = fields.map((f) => {
+        const key = vars.fill(f.key, false);
+        return { key, file: files.has(f.key), value: withoutCredential(key, vars.fill(f.value, !f.disabled), hid), field: f };
+      });
       const properties = Object.fromEntries(
         entries.map(({ key, file, value, field }) => {
           if (file) return [key, { type: "string", format: "binary" }];
@@ -5706,7 +5748,8 @@ function bodyOf(raw, contentType, vars) {
       const g = isObj(raw.graphql) ? raw.graphql : {};
       const query = typeof g.query === "string" ? vars.fill(g.query) : "";
       if (!query.trim()) return void 0;
-      const variables = typeof g.variables === "string" && g.variables.trim() ? jsonBody(g.variables, vars) : isObj(g.variables) ? g.variables : void 0;
+      const sent = typeof g.variables === "string" && g.variables.trim() ? jsonBody(g.variables, vars) : isObj(g.variables) ? g.variables : void 0;
+      const variables = sent === void 0 ? void 0 : withoutCredentials(sent, hid);
       const example = { query, ...variables !== void 0 ? { variables } : {} };
       return { media: "application/json", ...payloadOf(example, true) };
     }
@@ -5714,7 +5757,7 @@ function bodyOf(raw, contentType, vars) {
       return void 0;
   }
 }
-function responsesOf(saved, requestName) {
+function responsesOf(saved, requestName, hid) {
   const out = {};
   for (const r of saved) {
     if (!isObj(r)) continue;
@@ -5729,7 +5772,7 @@ function responsesOf(saved, requestName) {
     const body = typeof r.body === "string" ? r.body : "";
     if (body.trim()) {
       const value = (type2 ? /json/i.test(type2) : looksJson(body)) ? parseJson(body) : void 0;
-      if (value !== void 0) response.content = { [type2 ?? "application/json"]: payloadOf(value, "all") };
+      if (value !== void 0) response.content = { [type2 ?? "application/json"]: payloadOf(withoutCredentials(value, hid), "all") };
       else response.content = { [type2 && !/json/i.test(type2) ? type2 : "text/plain"]: { schema: { type: "string" }, example: body } };
     }
     out[status] = response;
@@ -5807,6 +5850,7 @@ function convertPostman(raw, environments = [], source) {
   collect(collection.item, void 0, ownAuth(collection.auth), saved, counts);
   const schemes = new Schemes();
   const notes = /* @__PURE__ */ new Set();
+  const hid = /* @__PURE__ */ new Set();
   const requirementOf = (auth, headers) => {
     const scheme = auth ? schemeOf(auth, vars, notes) : void 0;
     const parts = [];
@@ -5837,7 +5881,7 @@ function convertPostman(raw, environments = [], source) {
     const method = FIXED_METHODS.has(rawMethod.toLowerCase()) ? rawMethod.toLowerCase() : rawMethod.toUpperCase();
     const server = serverOf(url, vars, unsetHosts);
     const pathParams = /* @__PURE__ */ new Map();
-    let path = pathOf(url, vars, pathParams);
+    let path = pathOf(url, vars, pathParams, hid);
     const shape = path.replace(/\{[^}]+\}/g, "{}");
     const known = shapes.get(shape);
     if (known && known !== path) {
@@ -5851,7 +5895,7 @@ function convertPostman(raw, environments = [], source) {
     const item = paths[path] ??= {};
     const slots = FIXED_METHODS.has(method) ? item : item.additionalOperations ??= {};
     const name = bareName(vars.fill(r.name, false));
-    const responses = responsesOf(r.responses, r.name);
+    const responses = responsesOf(r.responses, r.name, hid);
     const success = Object.keys(responses).some((s) => /^2/.test(s));
     const existing = slots[method];
     if (isObj(existing)) {
@@ -5876,15 +5920,19 @@ function convertPostman(raw, environments = [], source) {
       else if (/^cookie$/i.test(h.key)) {
         for (const part of h.value.split(";")) {
           const eq = part.indexOf("=");
-          if (eq > 0) parameters.push({ name: part.slice(0, eq).trim(), in: "cookie", required: true, schema: { type: "string" }, example: vars.fill(part.slice(eq + 1).trim()) });
+          if (eq <= 0) continue;
+          const cookie = part.slice(0, eq).trim();
+          const value = vars.fill(part.slice(eq + 1).trim());
+          if (given(value)) hid.add(cookie);
+          parameters.push({ name: cookie, in: "cookie", required: true, schema: { type: "string" }, example: given(value) ? hiddenAs(cookie) : value });
         }
-      } else parameters.push({ name: h.key, in: "header", required: true, ...valueOf(vars.fill(h.value)), ...h.description ? { description: h.description } : {} });
+      } else parameters.push({ name: h.key, in: "header", required: true, ...valueOf(withoutCredential(h.key, vars.fill(h.value), hid)), ...h.description ? { description: h.description } : {} });
     }
     const query = /* @__PURE__ */ new Map();
     for (const q of url.query) {
       const key = vars.fill(q.key, false).trim();
       if (!key) continue;
-      const value = vars.fill(q.value, !q.disabled);
+      const value = withoutCredential(key, vars.fill(q.value, !q.disabled), hid);
       const entry = query.get(key);
       if (!entry) query.set(key, { values: [value], required: !q.disabled, ...q.description ? { description: q.description } : {} });
       else if (!q.disabled) {
@@ -5898,7 +5946,7 @@ function convertPostman(raw, environments = [], source) {
       const value = many ? { schema: { type: "array", items: { type: "string" } }, example: q.values } : valueOf(q.values[0]);
       parameters.push({ name: key, in: "query", required: q.required, ...value, ...q.description ? { description: q.description } : {} });
     }
-    const body = bodyOf(r.request.body, contentType, vars);
+    const body = bodyOf(r.request.body, contentType, vars, hid);
     const lowered = method.toLowerCase();
     const operationId = namesUrl(name) ? void 0 : operationIdFor(name, usedIds);
     const op = {
@@ -5937,6 +5985,7 @@ function convertPostman(raw, environments = [], source) {
   else if (unsetHosts.has("")) warnings.push("Some requests give no host, so the video puts them on api.example.com.");
   const unset = [...vars.unset].filter((n) => !unsetHosts.has(n));
   if (unset.length) warnings.push(`Some variables have no value in the collection, so the video shows them as written, or an id an earlier call returned: ${list2(unset.map((n) => `{{${n}}}`))}.`);
+  if (hid.size) warnings.push(`Credentials written out in the requests or their saved responses, rather than kept in variables, show hidden: ${list2([...hid])}.`);
   if (vars.secret.size) warnings.push(`Variables that look like credentials aren't filled in, so the video shows them as written: ${list2([...vars.secret].map((n) => `{{${n}}}`))}.`);
   if (placed.length && unsaved === placed.length && app !== "Postman") warnings.push(`${app}'s exports hold no responses, so the calls show no response body. A design document's spec gives them.`);
   else if (placed.length && unsaved === placed.length) warnings.push("None of the requests has a successful response saved as an example, so the calls show no response body. Save a response as an example in Postman to show it.");
@@ -11022,7 +11071,7 @@ function unknownKeys(raw, known, where, problems) {
 }
 
 // package.json
-var version = "1.0.7";
+var version = "1.0.9";
 
 // src/files.ts
 var import_node_fs = require("node:fs");

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "integration-tour",
-  "version": "1.0.7",
+  "version": "1.0.9",
   "description": "Renders integration videos of your API or MCP server from its OpenAPI spec or tools, in your own build, so they stay in step with it.",
   "keywords": [
     "openapi",