String sensitivity audit across repo

Author: Peter Hauge

.squad/agents/apicexpert/history.md

@@ -5,7 +5,6 @@
 - **Project:** apiops-cli — TypeScript CLI for Azure API Management and API Center
 - **Spec:** `specs/001-apiops-cli/spec.md`
 - **Constitution:** `.squad/identity/constitution.md` (v2.1.0)
-- **User:** Elizabeth Maher
 - **Stack:** TypeScript 6.x, Node.js 22 LTS, `@azure/identity` for auth, raw APIC REST API (no SDK for payloads)
 - **APIC REST API base:** `https://management.azure.com/subscriptions/{sub}/resourceGroups/{rg}/providers/Microsoft.ApiCenter/services/{svc}`
 - **Key distinction:** APIC and APIM are separate Azure services with separate REST APIs, separate RBAC, and different resource models.

.squad/agents/apimexpert/history.md

@@ -5,7 +5,6 @@
 - **Project:** apiops-cli — TypeScript CLI for Azure API Management (`apiops extract`, `apiops publish`, `apiops init`)
 - **Spec:** `specs/001-apiops-cli/spec.md`
 - **Constitution:** `.squad/identity/constitution.md` (v2.1.0)
-- **User:** Elizabeth Maher
 - **Stack:** TypeScript 6.x, Node.js 22 LTS, `@azure/identity` for auth, raw APIM REST API (no SDK for payloads)
 - **APIM REST API base:** `https://management.azure.com/subscriptions/{sub}/resourceGroups/{rg}/providers/Microsoft.ApiManagement/service/{svc}`
 - **Key rule:** Resource bodies are `Record<string, unknown>` — never typed DTOs. Unknown properties MUST be preserved.
@@ -54,7 +53,7 @@
 
 Detection strategy in `api-extractor.ts#hasGraphQLSchemaResource`: list ApiSchema children, check for `contentType` containing `'graphql'`. If yes → skip export.
 
-**SOAP 500 divergence from Azure/apiops:** The reference tool at `C:\Users\enewman\source\repos\azure\apiops` catches HTTP 500 on XML exports and skips the spec with comment *"Don't export XML specifications, as the non-link exports cannot be reimported."* This is incorrect — inline `format=wsdl` output **is** re-importable via PUT `?import=true&format=wsdl`. Our implementation uses this fallback to preserve round-trip capability.
+**SOAP 500 divergence from Azure/apiops:** The reference tool catches HTTP 500 on XML exports and skips the spec with comment *"Don't export XML specifications, as the non-link exports cannot be reimported."* This is incorrect — inline `format=wsdl` output **is** re-importable via PUT `?import=true&format=wsdl`. Our implementation uses this fallback to preserve round-trip capability.
 
 **Retry policy for XML exports:** Pass `noRetryOn5xx=true` to `request()` for wsdl-link/wadl-link. The 500s are deterministic, not transient, so retries waste time. Fall back to inline format immediately.
 

.squad/agents/apiopslead/history.md

@@ -5,7 +5,6 @@
 - **Project:** apiops-cli — TypeScript CLI for Azure API Management (`apiops extract`, `apiops publish`, `apiops init`)
 - **Spec:** `specs/001-apiops-cli/spec.md`
 - **Constitution:** `.squad/identity/constitution.md` (v2.1.0) — supreme governance document
-- **User:** Elizabeth Maher
 - **Stack:** TypeScript 6.x, Node.js 22 LTS, Commander, `@azure/identity`, Vitest, ESLint
 - **Key constraint:** No `@azure/arm-apimanagement` SDK for resource payloads — raw REST only
 
@@ -38,9 +37,9 @@
 
 ### 2026-06-02: APIM v1 → v2 SKU Migration Proposal
 
-**What:** Wrote `specs/sku-upgrade.md` — a comprehensive proposal for enabling APIM v1-to-v2 SKU migration via apiops-cli. Requested by Peter Hauge.
+**What:** Wrote `specs/sku-upgrade.md` — a comprehensive proposal for enabling APIM v1-to-v2 SKU migration via apiops-cli. Requested by project maintainer.
 
-**Decision:** Phase 1 MVP uses existing `extract` + `publish` commands with migration documentation — no new command needed. The `ApimServiceContext` is already parameterized, so source (v1) and target (v2) are just two different context instances. Phase 2 would add `apiops copy` for direct source→target streaming if demand warrants.
+**Decision:** Phase 1 MVP uses existing `extract` + `publish` commands with migration documentation — no new command needed.The `ApimServiceContext` is already parameterized, so source (v1) and target (v2) are just two different context instances. Phase 2 would add `apiops copy` for direct source→target streaming if demand warrants.
 
 **Key findings:**
 1. All 34 `ResourceType` enum values are supported for round-trip extract/publish — covers APIs, products, policies, backends, named values, gateways, workspaces, GraphQL resolvers, etc.
@@ -58,9 +57,9 @@
 
 ### 2026-06-02: APIM v1 → v2 SKU Migration Proposal
 
-**What:** Wrote `specs/sku-upgrade.md` — a comprehensive proposal for enabling APIM v1-to-v2 SKU migration via apiops-cli. Requested by Peter Hauge.
+**What:** Wrote `specs/sku-upgrade.md` — a comprehensive proposal for enabling APIM v1-to-v2 SKU migration via apiops-cli. Requested by project maintainer.
 
-**Decision:** Phase 1 MVP uses existing `extract` + `publish` commands with migration documentation — no new command needed. The `ApimServiceContext` is already parameterized, so source (v1) and target (v2) are just two different context instances. Phase 2 would add `apiops copy` for direct source→target streaming if demand warrants.
+**Decision:** Phase 1 MVP uses existing `extract` + `publish` commands with migration documentation — no new command needed.The `ApimServiceContext` is already parameterized, so source (v1) and target (v2) are just two different context instances. Phase 2 would add `apiops copy` for direct source→target streaming if demand warrants.
 
 **Key findings:**
 1. All 34 `ResourceType` enum values are supported for round-trip extract/publish — covers APIs, products, policies, backends, named values, gateways, workspaces, GraphQL resolvers, etc.

.squad/agents/nodejsdev/history.md

@@ -5,7 +5,6 @@
 - **Project:** apiops-cli — TypeScript CLI for Azure API Management (`apiops extract`, `apiops publish`, `apiops init`)
 - **Spec:** `specs/001-apiops-cli/spec.md`
 - **Constitution:** `.squad/identity/constitution.md` (v2.1.0)
-- **User:** Elizabeth Maher
 - **Stack:** Node.js 22 LTS, Commander CLI framework, ESM, npm
 - **CLI commands:** `apiops extract [options]`, `apiops publish [options]`, `apiops init [options]`
 - **Key rule (Constitution §I):** Every interactive input MUST have a non-interactive flag equivalent. Non-interactive mode required when stdout is not a TTY.

.squad/agents/opensourceexpert/history.md

@@ -5,7 +5,6 @@
 - **Project:** apiops-cli — TypeScript CLI for Azure API Management (planned public release)
 - **Spec:** `specs/001-apiops-cli/spec.md`
 - **Constitution:** `.squad/identity/constitution.md` (v2.1.0)
-- **User:** Elizabeth Maher
 - **OSS Authority:** https://opensource.microsoft.com/program
 - **Target license:** MIT or Apache 2.0 (permissive required for public npm package)
 - **Required health files:** LICENSE, CODE_OF_CONDUCT.md, CONTRIBUTING.md, SECURITY.md, README.md

.squad/agents/securityexpert/history.md

@@ -4,7 +4,6 @@
 
 - **Project:** apiops-cli — TypeScript CLI for Azure API Management operations
 - **Stack:** TypeScript 5.x, Node.js 22.x, Commander, @azure/identity, js-yaml, simple-git
-- **User:** Elizabeth Maher
 - **Repo:** Azure/apiops-cli (public, open source)
 - **Security posture:** AI-first repo with strict human-in-the-loop policy
 
@@ -20,6 +19,6 @@
 ## Learnings
 
 ### 2026-06-12: Open-Source Sensitivity Audit
-Performed a thorough read-only sensitivity audit across all 326 tracked files in preparation for open-source publication. Scanned for secrets/credentials, internal Microsoft URLs, PII, internal comments, internal tool configs, sensitive paths, draft docs, hardcoded Azure resource IDs, and internal dependency references. Findings delivered to Peter Hauge for compliance sign-off. No live credentials, certificates, or storage keys were found. All Azure GUIDs encountered were either zero-padded placeholders, the documented Azure DevOps app GUID `499b84ac-...`, or public Azure built-in role definition IDs. Primary cleanup items: a developer machine path `C:\Users\enewman\...` and three `enewman` alias references in `.squad/` history/decisions; the alias is also tied to the only real-looking storage account name `apigblstorageprdmwh.blob.core.windows.net` reflected in a test fixture.
+Performed a thorough read-only sensitivity audit across all tracked files in preparation for open-source publication. Scanned for secrets/credentials, internal Microsoft URLs, PII, internal comments, internal tool configs, sensitive paths, draft docs, hardcoded Azure resource IDs, and internal dependency references. Findings delivered for compliance sign-off. No live credentials, certificates, or storage keys were found. All Azure GUIDs encountered were either zero-padded placeholders or public Azure built-in role definition IDs. Primary cleanup items: a developer machine path and alias references in `.squad/` history/decisions; one real-looking storage account name in a test fixture.
 
 **Findings Summary:** 2 MEDIUM items, 3 LOW items. Orchestration log: `.squad/orchestration-log/2026-05-19T22-01-securityexpert.md`

.squad/agents/testengineer/history.md

@@ -5,7 +5,6 @@
 - **Project:** apiops-cli — TypeScript CLI for Azure API Management (`apiops extract`, `apiops publish`, `apiops init`)
 - **Spec:** `specs/001-apiops-cli/spec.md` — acceptance criteria are the primary source for test cases
 - **Constitution:** `.squad/identity/constitution.md` (v2.1.0)
-- **User:** Elizabeth Maher
 - **Stack:** Vitest (native ESM + TypeScript), Node.js 22 LTS
 - **Key rule (Constitution §VI):** All business logic MUST be testable in isolation without requiring live Azure resources.
 - **Test strategy:** Unit tests (no network, no disk I/O) are mandatory. Integration tests (real Azure) are complementary.

.squad/agents/typescriptdev/history.md

@@ -5,7 +5,6 @@
 - **Project:** apiops-cli — TypeScript CLI for Azure API Management (`apiops extract`, `apiops publish`, `apiops init`)
 - **Spec:** `specs/001-apiops-cli/spec.md`
 - **Constitution:** `.squad/identity/constitution.md` (v2.1.0)
-- **User:** Elizabeth Maher
 - **Stack:** TypeScript 5.x strict mode, Node.js 22 LTS, ESLint with @typescript-eslint
 - **Key principle (Constitution §VI):** Core operations MUST depend on abstractions, not concrete HTTP/file-system implementations.
 - **Key principle (Constitution §VII):** Resource bodies are `Record<string, unknown>` — opaque passthrough, no typed DTOs.

.squad/decisions.md

@@ -93,19 +93,19 @@
 **Why:** After publishing to npm as `@peterhauge/apiops-cli`, requiring users to download the package and run `apiops init --cli-package ./tarball.tgz` added unnecessary friction. Most users want to reference the public package directly. The change is backward compatible — existing workflows with `--cli-package` continue to work unchanged. Improves user experience with simpler onboarding.
 
 ### 2026-04-21T19:35:00Z: SOAP/WADL spec extraction prefers link format with inline XML fallback
-**By:** ApimExpert (via Squad session with enewman)
+**By:** ApimExpert (via Squad session with a user)
 **Status:** Implemented
 **What:** For soap-type APIs, `getApiSpecification` requests `format=wsdl-link` first. On HTTP 5xx, it falls back to the inline (non-link) `format=wsdl` export which returns raw WSDL XML in `properties.value`. WADL follows the same pattern (`wadl-link` → `format=wadl` fallback). The XML fallback content is saved as `specification.wsdl` / `specification.wadl` and is re-importable via PUT `?import=true&format=wsdl` (or `wadl-xml`).
-**Why:** User requires full round-trip fidelity — SOAP APIs must be re-importable to a new APIM instance. APIM's `wsdl-link` emitter deterministically returns HTTP 500 on many real-world SOAP APIs (observed: 270 of 272 soap APIs in a production tenant). Azure/apiops reference tool skips XML specs on 500 with comment "non-link exports cannot be reimported" — this is inaccurate; the inline form IS re-importable. Converting SOAP → OpenAPI via `openapi-link` works but loses SOAP semantics on round-trip.
+**Why:** User requires full round-trip fidelity — SOAP APIs must be re-importable to a new APIM instance. APIM's `wsdl-link` emitter deterministically returns HTTP 500 on many real-world SOAP APIs. Azure/apiops reference tool skips XML specs on 500 with comment "non-link exports cannot be reimported" — this is inaccurate; the inline form IS re-importable. Converting SOAP → OpenAPI via `openapi-link` works but loses SOAP semantics on round-trip.
 
 ### 2026-04-21T19:34:00Z: Synthetic GraphQL APIs skip the graphql-link export call
-**By:** ApimExpert (via Squad session with enewman)
+**By:** ApimExpert (via Squad session with a user)
 **Status:** Implemented
 **What:** Before calling `graphql-link` export, `api-extractor.ts` probes ApiSchema children via `hasGraphQLSchemaResource` and checks for `contentType` containing 'graphql'. If found (synthetic GraphQL — SDL stored as an ApiSchema resource), the export call is skipped. If not found (pass-through GraphQL), `graphql-link` is called normally.
 **Why:** APIM returns HTTP 406 on `graphql-link` export for synthetic GraphQL APIs because there is nothing to export — the SDL is already held as an ApiSchema child resource and is captured by standard ApiSchema extraction. Skipping the redundant call avoids the error without losing fidelity.
 
 ### 2026-04-21T19:33:00Z: XML export fallback bypasses the default 5xx retry loop
-**By:** ApimExpert (via Squad session with enewman)
+**By:** ApimExpert (via Squad session with user)
 **Status:** Implemented
 **What:** `getApiSpecification` passes `noRetryOn5xx=true` to `request()` when exporting `wsdl-link` or `wadl-link`. The fallback to inline format runs immediately on HTTP 5xx rather than after three retries.
 **Why:** APIM's wsdl-link/wadl-link 500 errors are deterministic failures in APIM's XML emitter, not transient. Retrying wastes time and delays the fallback. The inline format path is fast and reliable.

specs/APIM-RestAPI-Coverage.md

@@ -62,7 +62,7 @@ Comprehensive mapping of all APIM REST API resource types against v1 APIOps cove
 | 34 | GraphQL Api Resolver | `/apis/{name}/resolvers/{resolver}` | ❌ | ✅ | ✅ | **NEW in v2.** GraphQL field resolvers. |
 | 35 | GraphQL Api Resolver Policy | `/apis/{name}/resolvers/{resolver}/policies/policy` | ❌ | ✅ | ✅ | **NEW in v2.** Policies on GraphQL resolvers. |
 | 36 | Api Revision | `/apis/{name}/revisions` | ✅ | ✅ | ✅ | List-only API; revisions extracted via API entity. |
-| 37 | Api Export | `/apis/{name}?export=true` | ➖ | ➖ | ➖ | Read-only export. Used internally for spec extraction. |
+| 37 | Api Export | `/apis/{name}?export=true` | ➖ | ➖ | ➖ | Read-only export. Used by apiops-cli for spec extraction. |
 | 38 | Api Product | `/apis/{name}/products` | ➖ | ➖ | ➖ | Read-only reverse lookup. Managed via Product Api (#17). |
 | 39 | Api Issue | `/apis/{name}/issues/{issue}` | ❌ | ❌ | ❌ | Instance-specific. User-reported issues on dev portal. |
 | 40 | Api Issue Attachment | `/apis/{name}/issues/{issue}/attachments/{att}` | ❌ | ❌ | ❌ | Instance-specific. Child of Api Issue. |