Release mxrb 0.1.2

Gemfile.sqlite-vec.lock

@@ -1,7 +1,7 @@
 PATH
   remote: .
   specs:
-    mxrb (0.1.1)
+    mxrb (0.1.2)
       base64 (~> 0.2)
       bigdecimal (~> 3.1)
       bson (~> 5.2)
@@ -126,7 +126,7 @@ CHECKSUMS
   json (2.21.1) sha256=13a43df75d95641443f5702dff350f237164a9d811ff0f2c2800d4d980220583
   language_server-protocol (3.17.0.6) sha256=5ef2c0c138f8267e1bc631d3328347d354f96724b0af22f2c79516120443b7f0
   lint_roller (1.1.0) sha256=2c0c845b632a7d172cb849cc90c1bce937a28c5c8ccccb50dfd46a485003cc87
-  mxrb (0.1.1)
+  mxrb (0.1.2)
   onnxruntime (0.11.5-arm64-darwin) sha256=9f2f45b3ac16999c466ac352562195e03a011cc930b8750c0b1e43a49c1ca5d9
   onnxruntime (0.11.5-x86_64-darwin) sha256=19c18e90eb101f69a3232dfdd1742e77d69e2df623b106b670221629d4b4cc15
   onnxruntime (0.11.5-x86_64-linux) sha256=13f20de606a8fb32ba404bca9e1fc47f0eab4605c909252dbcf6db4fb106c9e6

README.de-DE.md

@@ -19,6 +19,7 @@ und Testen von Mendix-Projekten (`.mpr`) ohne MDL oder `mxcli`.
 - Lint und ausführbare Modellbewertungen;
 - Erkennung von nativem OQL und logische SQL-Ansicht nur bei vorhandenem OQL;
 - isolierte, durch das Runtime synchronisierte PostgreSQL für direkte SQL-Abfragen;
+- Demo-Benutzer mit lokalen `.env`-Geheimnissen und sichere Runtime-Zugangsdaten;
 - Analyse von PostgreSQL-/SQL-Server-Plänen und kumulativem PostgreSQL-Workload;
 - funktionale Microflow-Tests lokal oder in Docker.
 - Suche und Installation wiederverwendbarer Ruby-Module mit SHA-256-Lock.
@@ -35,6 +36,7 @@ wird kompatibles Java benötigt; Docker stellt JDK und Runtime bereit.
 
 ```sh
 bundle install
+bundle exec mxrb --version
 bundle exec mxrb validate App.mpr
 bundle exec mxrb export App.mpr app-ruby
 bundle exec mxrb compare original.mpr rebuilt.mpr
@@ -45,7 +47,9 @@ bundle exec mxrb cache warm App.mpr
 bundle exec mxrb cache clear App.mpr
 bundle exec mxrb oql App.mpr --dialect postgresql
 bundle exec mxrb db up App.mpr
+bundle exec mxrb db credentials App.mpr --copy
 bundle exec mxrb db sql App.mpr 'SELECT * FROM "sales$order" LIMIT 20'
+bundle exec mxrb demo-user new manager --entity System.User --role User
 ```
 
 Die MPR speichert das Modell, nicht die Anwendungsdaten. `db up` baut das

README.md

@@ -23,6 +23,7 @@ remain optional external gates for compatibility and functional execution.
 - inventory design tokens, check contrast and preview atomic literal migration;
 - discover native OQL and render safe logical SQL views only when OQL exists;
 - materialize an isolated, Runtime-synchronized PostgreSQL for direct SQL inspection;
+- scaffold demo users with local `.env` secrets and safely inspect Runtime credentials;
 - analyze PostgreSQL/SQL Server plans and rank cumulative PostgreSQL workload pressure;
 - move standalone units between folders in the same module with a preview;
 - remove standalone units only after reference and child-unit safety checks;
@@ -57,6 +58,7 @@ Install dependencies:
 
 ```sh
 bundle install
+bundle exec mxrb --version
 ```
 
 ## Ruby DSL
@@ -92,7 +94,9 @@ bundle exec mxrb cache warm Shop.mpr
 bundle exec mxrb cache clear Shop.mpr
 bundle exec mxrb oql Shop.mpr --dialect postgresql
 bundle exec mxrb db up Shop.mpr
+bundle exec mxrb db credentials Shop.mpr --copy
 bundle exec mxrb db sql Shop.mpr 'SELECT * FROM "sales$order" LIMIT 20'
+bundle exec mxrb demo-user new manager --entity System.User --role User
 bundle exec mxrb pack Shop.mpr --output build/Shop.mda
 bundle exec mxrb portable Shop.mpr --output build/runtime.zip
 bundle exec mxrb team-server clone APP_ID ./shop --pat-file /secure/team-server.env

README.pt-BR.md

@@ -19,6 +19,7 @@ projetos Mendix (`.mpr`) sem MDL ou `mxcli`.
 - lint e avaliações executáveis de modelo;
 - descoberta de OQL nativo e visão SQL lógica somente quando o projeto contém OQL;
 - PostgreSQL isolado e sincronizado pelo Runtime para consultas SQL diretas;
+- scaffold de demo users com segredos locais no `.env` e consulta segura de credenciais;
 - análise de planos PostgreSQL/SQL Server e workload cumulativo PostgreSQL;
 - testes funcionais de microflows localmente ou em Docker.
 - busca e instalação de módulos Ruby reutilizáveis com SHA-256 travado.
@@ -34,6 +35,7 @@ local precisa do Java compatível; o modo Docker fornece JDK e Runtime.
 
 ```sh
 bundle install
+bundle exec mxrb --version
 bundle exec mxrb init vet_clinic
 bundle exec mxrb validate App.mpr
 bundle exec mxrb export App.mpr app-ruby
@@ -45,7 +47,9 @@ bundle exec mxrb cache warm App.mpr
 bundle exec mxrb cache clear App.mpr
 bundle exec mxrb oql App.mpr --dialect postgresql
 bundle exec mxrb db up App.mpr
+bundle exec mxrb db credentials App.mpr --copy
 bundle exec mxrb db sql App.mpr 'SELECT * FROM "sales$order" LIMIT 20'
+bundle exec mxrb demo-user new manager --entity System.User --role User
 ```
 
 O MPR armazena o modelo, não os dados da aplicação. `db up` compila o Runtime

bin/mxrb

@@ -67,6 +67,9 @@ SCAFFOLD_COMMANDS = (Mxrb::Scaffold::Help::COMMANDS.keys - ["design"]).freeze
 command = ARGV.shift
 
 case command
+when '--version', '-v'
+  puts "mxrb #{Mxrb::VERSION}"
+
 when 'doctor'
   json = ARGV.delete('--json')
   root = ARGV.shift || Dir.pwd
@@ -742,7 +745,7 @@ when "design"
 
 when "db"
   action = ARGV.shift or
-    abort "Usage: mxrb db <up|sync|down|destroy|status|url|sql|explain|workload|indexes|shell> <file.mpr>"
+    abort "Usage: mxrb db <up|sync|down|destroy|status|credentials|url|sql|explain|workload|indexes|shell> <file.mpr>"
   path = ARGV.shift or abort "Usage: mxrb db #{action} <file.mpr>"
   option = lambda do |name, fallback = nil|
     index = ARGV.index(name)
@@ -795,6 +798,30 @@ when "db"
     puts "Database : #{info.database_container}"
     puts "Runtime  : #{info.runtime_container}"
     puts "State    : #{info.state_dir}"
+  when "credentials"
+    copy = !ARGV.delete("--copy").nil?
+    show_password = !ARGV.delete("--show-password").nil?
+    json = !ARGV.delete("--json").nil?
+    abort '--copy and --show-password are mutually exclusive' if copy && show_password
+    abort "Unknown arguments: #{ARGV.join(' ')}" unless ARGV.empty?
+
+    credentials = workspace.admin_credentials
+    visible_password = nil
+    visible_password = credentials.password if show_password
+    if copy
+      command = Mxrb::Runtime::Clipboard.new.copy(credentials.password)
+      puts "[mxrb] Password for #{credentials.username} copied with #{command}"
+    elsif json
+      puts JSON.pretty_generate(
+        username: credentials.username, password: visible_password,
+        state: credentials.state_dir, credentials_file: credentials.path
+      )
+    else
+      visible_password ||= '<hidden; use --copy or --show-password>'
+      puts "User name : #{credentials.username}"
+      puts "Password  : #{visible_password}"
+      puts "State     : #{credentials.state_dir}"
+    end
   when "url"
     puts workspace.connection_url
   when "sql"
@@ -833,7 +860,7 @@ when "db"
     exec(*workspace.shell_command(write:))
   else
     abort "Unknown db action #{action.inspect}; " \
-          "use up, sync, down, destroy, status, url, sql, explain, workload, indexes or shell"
+          "use up, sync, down, destroy, status, credentials, url, sql, explain, workload, indexes or shell"
   end
 
 when "serve"
@@ -1479,6 +1506,7 @@ else
     mxrb — Pure-Ruby Mendix .mpr toolkit
 
     Commands:
+      --version, -v                         Show the installed MXRB version
       doctor     [DIR] [--json]           Check project files and local toolchain
       benchmark <file.mpr>                Measure open, index and validation time
                  --iterations N --json    Configure repetitions or emit JSON
@@ -1537,6 +1565,8 @@ else
          down    <file.mpr>                 Stop containers while preserving all data
          destroy <file.mpr> --yes           Remove isolated containers, data, and state
          status  <file.mpr>                 Show isolated database/runtime status
+         credentials <file.mpr> [--copy]   Show the admin user or copy its password
+                 --show-password            Explicitly print the Runtime admin password
          url     <file.mpr> [--port PORT]   Print the read-only PostgreSQL connection URL
          sql     <file.mpr> "SELECT …"      Execute SQL as the read-only analyst role
                  --write                    Explicitly use the Runtime owner role
@@ -1595,6 +1625,9 @@ else
       nanoflow new Module.Name            Scaffold a client nanoflow
       repository new Module.Name          Scaffold a repository port and adapter
       security init Module                Scaffold module roles
+      demo-user [new] NAME                Scaffold a local Mendix demo user
+                [--entity ENTITY]          Default: System.User
+                [--role ROLE]              Repeatable; default: User
       scheduled-event new Module.Name     Scaffold an event and handler
       constant new Module.Name            Scaffold a module constant
       integration new Module.Name         Scaffold an integration adapter

docs/de-DE/oql-sql.md

@@ -142,6 +142,24 @@ bundle exec mxrb db sql Shop.mpr \
 bundle exec mxrb db shell Shop.mpr
 ```
 
+Die Zugangsdaten des vorhandenen Runtime-Administrators lassen sich prüfen,
+ohne das Passwort standardmäßig auszugeben:
+
+```sh
+bundle exec mxrb db credentials Shop.mpr
+bundle exec mxrb db credentials Shop.mpr --copy
+bundle exec mxrb db credentials Shop.mpr --json
+bundle exec mxrb db credentials Shop.mpr --show-password
+```
+
+`--copy` übergibt das Passwort per stdin an die Zwischenablage und nie als
+Prozessargument. Nur `--show-password` gibt es aus; im JSON bleibt `password`
+ohne diese Option `null`. `--copy` und `--show-password` schließen einander
+aus. Der Befehl liest nur einen vorhandenen Workspace: Er erzeugt oder rotiert
+keine Zugangsdaten und verweist auf `db up`, falls noch kein Zustand existiert.
+Dies sind die Zugangsdaten des Mendix-Anwendungsadministrators, getrennt von
+den PostgreSQL-Rollen `mxrb_reader` und Runtime-Eigentümer.
+
 Nach einer Änderung der MPR wird unter Beibehaltung der Daten neu gebaut und
 synchronisiert:
 

docs/de-DE/scaffolds.md

@@ -30,6 +30,29 @@ Data Source. Ketten, die mit einem Microflow enden, erzeugen zusätzlich
 Jede erzeugte Kette wird als gültiges MPR materialisiert und durch den
 Compiler-Preflight geprüft.
 
+## Demo-Benutzer
+
+Nach der Initialisierung der Sicherheit wird jeder Demo-Benutzer als eigene
+Ruby-Datei erzeugt:
+
+```sh
+mxrb security init App
+mxrb demo-user new manager --entity System.User --role User
+mxrb demo-user operator --entity App.Account --role User --role Administrator
+```
+
+`new` ist optional. `--entity` verwendet standardmäßig `System.User`, und
+`--role` kann wiederholt werden; ohne Angabe wird die Rolle `User` gewählt. Das
+Scaffold prüft sofort, ob Entität und Anwendungsrollen vorhanden sind,
+verbindet `app/security/demo_users` mit dem `security`-Block und aktiviert
+Demo-Benutzer in der MPR.
+
+Das zufällige Passwort liegt nur in der ignorierten `.env`, die beim Erstellen
+den Modus `0600` erhält. Der erzeugte Ruby-Code nutzt `ENV.fetch`, während
+`.env.example` nur eine leere Variable enthält. Danach wird die MPR wie gewohnt
+generiert und validiert. Demo-Benutzer sind für Entwicklung und Vorführungen
+gedacht, nicht für Produktionsbenutzer.
+
 ## Seitenvorlagen
 
 In Mendix sind Page Templates Ausgangspunkte, deren Struktur zu einer normalen,

docs/en-US/oql-sql.md

@@ -137,6 +137,24 @@ bundle exec mxrb db sql Shop.mpr \
 bundle exec mxrb db shell Shop.mpr
 ```
 
+You can inspect the existing Runtime administrator credentials without
+printing the password by default:
+
+```sh
+bundle exec mxrb db credentials Shop.mpr
+bundle exec mxrb db credentials Shop.mpr --copy
+bundle exec mxrb db credentials Shop.mpr --json
+bundle exec mxrb db credentials Shop.mpr --show-password
+```
+
+`--copy` sends the password to the clipboard through stdin, never in process
+arguments. `--show-password` is the only mode that prints it; JSON keeps
+`password` as `null` without that option. `--copy` and `--show-password` are
+mutually exclusive. The command only reads an existing workspace: it neither
+creates nor rotates credentials and tells you to run `db up` when no state
+exists. These are Mendix application-administrator credentials, separate from
+the PostgreSQL `mxrb_reader` and Runtime-owner roles.
+
 After changing the MPR, rebuild and synchronize while retaining the data:
 
 ```sh

docs/en-US/scaffolds.md

@@ -29,6 +29,28 @@ end in a microflow also create `ACT_RefreshOrder`. `page generate` and `page g`
 are aliases of `page new`. Every generated chain is materialized as a valid MPR
 and checked by compiler preflight.
 
+## Demo users
+
+After initializing security, scaffold each demo user as an independent Ruby
+file:
+
+```sh
+mxrb security init App
+mxrb demo-user new manager --entity System.User --role User
+mxrb demo-user operator --entity App.Account --role User --role Administrator
+```
+
+`new` is optional. `--entity` defaults to `System.User`, and `--role` is
+repeatable; without it, the `User` role is selected. The scaffold immediately
+validates that the entity and application roles exist, connects
+`app/security/demo_users` to the `security` block, and enables demo users in
+the MPR.
+
+The random password exists only in the ignored `.env`, created with mode
+`0600`. Generated Ruby uses `ENV.fetch`, while `.env.example` receives only an
+empty variable. Generate and validate the MPR normally after scaffolding. Demo
+users are intended for development and demonstrations, not production users.
+
 ## Page templates
 
 In Mendix, page templates are starting points whose structure becomes a normal,

docs/pt-BR/oql-sql.md

@@ -144,6 +144,24 @@ bundle exec mxrb db sql Shop.mpr \
 bundle exec mxrb db shell Shop.mpr
 ```
 
+As credenciais do administrador do Runtime já criado podem ser consultadas sem
+imprimir a senha por padrão:
+
+```sh
+bundle exec mxrb db credentials Shop.mpr
+bundle exec mxrb db credentials Shop.mpr --copy
+bundle exec mxrb db credentials Shop.mpr --json
+bundle exec mxrb db credentials Shop.mpr --show-password
+```
+
+`--copy` envia a senha ao clipboard por stdin, sem colocá-la nos argumentos do
+processo. `--show-password` é a única forma de imprimi-la; no JSON, `password`
+permanece `null` sem essa opção. `--copy` e `--show-password` são mutuamente
+exclusivos. O comando apenas lê o workspace existente: não cria nem gira
+credenciais e orienta executar `db up` quando o estado ainda não existe. Essas
+são as credenciais do administrador da aplicação Mendix, distintas dos papéis
+PostgreSQL `mxrb_reader` e proprietário do Runtime.
+
 Depois de alterar o MPR, recompile e sincronize preservando os dados:
 
 ```sh

docs/pt-BR/scaffolds.md

@@ -30,6 +30,7 @@ o hash criado pelo gerador, protegendo edições posteriores.
 | `mxrb page new App.Order --chain page:nanoflow:microflow` | Fatia vertical executável |
 | `mxrb nanoflow new App.NAN_OpenCustomer` | Nanoflow cliente |
 | `mxrb security init App` | Papéis, `CheckEverything` no projeto e orientação de acesso |
+| `mxrb demo-user new manager --role User` | Demo user com segredo local em `.env` |
 | `mxrb integration new App.PetApi` | Adaptador de integração |
 | `mxrb published-rest new App.CustomersApi` | Handler editável para REST publicado |
 | `mxrb consumed-rest new App.ExternalPets` | Adaptador REST consumido |
@@ -71,6 +72,27 @@ são aliases de `page new`. Cada cadeia é materializada em um MPR válido, serv
 como ponto de partida removível e exercita o preflight do compilador; arquivos
 existentes nunca são sobrescritos.
 
+## Demo users
+
+Depois de inicializar a segurança, um demo user pode ser declarado como um
+arquivo Ruby independente:
+
+```sh
+mxrb security init App
+mxrb demo-user new manager --entity System.User --role User
+mxrb demo-user operator --entity App.Account --role User --role Administrator
+```
+
+`new` é opcional. `--entity` usa `System.User` por padrão e `--role` pode ser
+repetido; sem ele, o papel `User` é usado. O scaffold valida imediatamente se
+a entidade e os papéis existem, conecta `app/security/demo_users` ao bloco
+`security` e habilita demo users no MPR.
+
+A senha aleatória fica apenas no `.env` ignorado, com modo `0600` quando o
+arquivo é criado. O Ruby gerado usa `ENV.fetch` e `.env.example` recebe somente
+a variável vazia. Gere e valide o MPR normalmente depois do scaffold. Demo
+users destinam-se a desenvolvimento e demonstração, não a usuários de produção.
+
 ## Modelos de página
 
 No Mendix, page templates são pontos de partida: sua estrutura é copiada para

lib/mxrb.rb

@@ -126,6 +126,7 @@
 require_relative "mxrb/runtime/executor"
 require_relative "mxrb/runtime/native"
 require_relative "mxrb/runtime/docker_executor"
+require_relative "mxrb/runtime/clipboard"
 require_relative "mxrb/runtime/database_workspace"
 require_relative "mxrb/runtime/sql_server_database"
 require_relative "mxrb/oql/server"

lib/mxrb/compare.rb

@@ -72,6 +72,13 @@ def security_summary(project)
           admin_user_name: doc["AdminUserName"],
           admin_user_role: doc["AdminUserRole"],
           demo_users_enabled: doc["EnableDemoUsers"],
+          demo_users: IO::BsonCodec.parse_array(doc["DemoUsers"]).fetch(:items).map do |user|
+            {
+              name: user["UserName"], entity: user["Entity"],
+              roles: IO::BsonCodec.parse_array(user["UserRoles"]).fetch(:items).sort,
+              password_sha256: Digest::SHA256.hexdigest(user["Password"].to_s)
+            }
+          end.sort_by { _1[:name].to_s },
           guest_access_enabled: doc["EnableGuestAccess"],
           guest_user_role: doc["GuestUserRole"],
           sign_in_microflow: doc["SignInMicroflow"],