@checkstack/automation-frontend 0.2.0 → 0.3.0

package/src/pages/automation-grouping.ts

@@ -0,0 +1,65 @@
+import type { Automation } from "@checkstack/automation-common";
+
+/**
+ * Label for the implicit bucket holding automations with no `group`.
+ * Always sorted LAST so it sits at the bottom of the list.
+ */
+export const UNGROUPED_LABEL = "Ungrouped";
+
+export interface AutomationGroup {
+  /** Display label (the group value, or {@link UNGROUPED_LABEL}). */
+  label: string;
+  /** Stable key for React + accordion state (the label is unique already). */
+  key: string;
+  /** Whether this is the implicit ungrouped bucket. */
+  ungrouped: boolean;
+  items: Automation[];
+}
+
+/**
+ * Partition a flat automation list into named groups for the collapsible
+ * list view. Pure so it is unit-testable without a DOM render.
+ *
+ * - Automations with a non-empty `group` land in that group.
+ * - Automations with an absent / blank `group` land in {@link UNGROUPED_LABEL}.
+ * - Named groups are sorted alphabetically (case-insensitive, locale-aware);
+ *   the ungrouped bucket is always appended LAST.
+ * - Item order within a group is preserved from the input.
+ * - Empty groups are never produced.
+ */
+export function groupAutomations({
+  automations,
+}: {
+  automations: Automation[];
+}): AutomationGroup[] {
+  const named = new Map<string, Automation[]>();
+  const ungrouped: Automation[] = [];
+
+  for (const automation of automations) {
+    const group = automation.group?.trim();
+    if (group) {
+      const bucket = named.get(group);
+      if (bucket) bucket.push(automation);
+      else named.set(group, [automation]);
+    } else {
+      ungrouped.push(automation);
+    }
+  }
+
+  const groups: AutomationGroup[] = [...named.entries()]
+    .toSorted(([a], [b]) =>
+      a.localeCompare(b, undefined, { sensitivity: "base" }),
+    )
+    .map(([label, items]) => ({ label, key: label, ungrouped: false, items }));
+
+  if (ungrouped.length > 0) {
+    groups.push({
+      label: UNGROUPED_LABEL,
+      key: UNGROUPED_LABEL,
+      ungrouped: true,
+      items: ungrouped,
+    });
+  }
+
+  return groups;
+}

package/src/script-context.test.ts

@@ -13,7 +13,11 @@ import type {
   AutomationDefinition,
   TriggerInfo,
 } from "@checkstack/automation-common";
-import { generateAutomationContextTypes } from "./script-context";
+import {
+  generateAutomationContextTypes,
+  generateSecretEnvTypes,
+  secretEnvEnvNames,
+} from "./script-context";
 
 const incidentCreated: TriggerInfo = {
   qualifiedId: "incident.created",
@@ -69,6 +73,7 @@ function baseDef(
     conditions: [],
     actions: [],
     mode: "single",
+    concurrency_scope: "automation",
     max_runs: 1,
     ...overrides,
   };
@@ -245,3 +250,139 @@ describe("generateAutomationContextTypes", () => {
     expect(scope.entries.some((e) => e.path === "trigger")).toBe(true);
   });
 });
+
+describe("generateSecretEnvTypes", () => {
+  it("emits a ProcessEnv augmentation typing each declared key as string", () => {
+    const out = generateSecretEnvTypes({ envNames: ["API_TOKEN", "DB_PASS"] });
+    expect(out).toContain("declare namespace NodeJS");
+    expect(out).toContain("interface ProcessEnv");
+    expect(out).toContain("readonly API_TOKEN: string;");
+    expect(out).toContain("readonly DB_PASS: string;");
+  });
+
+  it("stays a global script - no top-level export/import that would modularize the merged extra-lib", () => {
+    // A single top-level `export`/`import` would turn the concatenated
+    // `context + secretEnv` extra-lib into a module, demoting the
+    // `declare const context` global to a module-local binding and breaking
+    // `context.*` IntelliSense. The augmentation must use an ambient
+    // `declare namespace`, never `declare global { … } export {};`.
+    const out = generateSecretEnvTypes({ envNames: ["API_TOKEN"] });
+    expect(out).not.toMatch(/^\s*export\b/m);
+    expect(out).not.toMatch(/^\s*import\b/m);
+    expect(out).not.toContain("declare global");
+  });
+
+  it("emits an empty string for empty input so the caller drops it", () => {
+    expect(generateSecretEnvTypes({ envNames: [] })).toBe("");
+  });
+
+  it("skips invalid identifiers but keeps the valid ones", () => {
+    const out = generateSecretEnvTypes({
+      envNames: ["GOOD", "BAD-NAME", "123start", "with space", "_ok$"],
+    });
+    expect(out).toContain("readonly GOOD: string;");
+    expect(out).toContain("readonly _ok$: string;");
+    expect(out).not.toContain("BAD-NAME");
+    expect(out).not.toContain("123start");
+    expect(out).not.toContain("with space");
+  });
+
+  it("emits an empty string when every name is invalid", () => {
+    expect(generateSecretEnvTypes({ envNames: ["BAD-NAME", "1x"] })).toBe("");
+  });
+
+  it("de-duplicates repeated keys", () => {
+    const out = generateSecretEnvTypes({ envNames: ["TOKEN", "TOKEN"] });
+    const occurrences = out.split("readonly TOKEN: string;").length - 1;
+    expect(occurrences).toBe(1);
+  });
+
+  it("merged context + secretEnv stays a global script (regression guard)", () => {
+    // Reproduces the action-leaf-cards merge: the `context` global concatenated
+    // with the secretEnv augmentation must NOT contain a top-level
+    // export/import, otherwise `declare const context` stops being global and
+    // its IntelliSense silently disappears in the automation script editor.
+    const { typeDefinitions } = generateAutomationContextTypes({
+      definition: baseDef(),
+      triggers: [],
+      path: [{ slot: "root", index: 0 }],
+    });
+    const secretEnvLib = generateSecretEnvTypes({ envNames: ["API_TOKEN"] });
+    const merged = [typeDefinitions, secretEnvLib].filter(Boolean).join("\n\n");
+    expect(merged).toContain("declare const context");
+    expect(merged).toContain("declare namespace NodeJS");
+    expect(merged).not.toMatch(/^\s*export\b/m);
+    expect(merged).not.toMatch(/^\s*import\b/m);
+  });
+});
+
+describe("secretEnvEnvNames", () => {
+  const configSchema = {
+    type: "object",
+    properties: {
+      script: { type: "string", "x-editor-types": ["typescript"] },
+      secretEnv: {
+        type: "object",
+        additionalProperties: { type: "string" },
+        "x-secret-env": true,
+      },
+    },
+  };
+
+  it("returns the env-var keys from the x-secret-env mapping value", () => {
+    expect(
+      secretEnvEnvNames({
+        configSchema,
+        config: {
+          script: "export default async () => {}",
+          secretEnv: {
+            API_TOKEN: "${{ secrets.jira_token }}",
+            DB: "${{ secrets.db }}",
+          },
+        },
+      }),
+    ).toEqual(["API_TOKEN", "DB"]);
+  });
+
+  it("locates the field by annotation, not by name", () => {
+    const renamed = {
+      type: "object",
+      properties: {
+        mySecrets: {
+          type: "object",
+          additionalProperties: { type: "string" },
+          "x-secret-env": true,
+        },
+      },
+    };
+    expect(
+      secretEnvEnvNames({
+        configSchema: renamed,
+        config: { mySecrets: { TOKEN: "${{ secrets.t }}" } },
+      }),
+    ).toEqual(["TOKEN"]);
+  });
+
+  it("returns [] when there is no x-secret-env field", () => {
+    expect(
+      secretEnvEnvNames({
+        configSchema: { type: "object", properties: { script: { type: "string" } } },
+        config: { script: "x" },
+      }),
+    ).toEqual([]);
+  });
+
+  it("returns [] when the mapping is missing or not a record", () => {
+    expect(secretEnvEnvNames({ configSchema, config: {} })).toEqual([]);
+    expect(
+      secretEnvEnvNames({ configSchema, config: { secretEnv: "nope" } }),
+    ).toEqual([]);
+  });
+
+  it("returns [] for malformed schema / config input", () => {
+    expect(secretEnvEnvNames({ configSchema: null, config: null })).toEqual([]);
+    expect(
+      secretEnvEnvNames({ configSchema: "not-a-schema", config: 42 }),
+    ).toEqual([]);
+  });
+});

package/src/script-context.ts

@@ -216,3 +216,118 @@ function indent(input: string, pad: string): string {
     .map((line, i) => (i === 0 ? line : `${pad}${line}`))
     .join("\n");
 }
+
+/** A TypeScript identifier safe to emit as an unquoted interface key. */
+const TS_IDENTIFIER_RE = /^[A-Za-z_$][A-Za-z0-9_$]*$/;
+
+/**
+ * Emit an ambient `NodeJS.ProcessEnv` augmentation that types the declared
+ * `secretEnv` environment-variable NAMES as `string`, so they autocomplete
+ * under `process.env.` in the inline-script Monaco editor and are typed.
+ *
+ * This is a type AUGMENTATION, not a replacement: it adds the known keys as
+ * non-optional `string` members and coexists with `@types/node`'s existing
+ * `ProcessEnv` index signature (`[key: string]: string | undefined`), so
+ * unknown keys still resolve to `string | undefined` while the declared ones
+ * narrow to `string`.
+ *
+ * IMPORTANT: the output is a **global script**, NOT a module. It uses a
+ * top-level ambient `declare namespace NodeJS` (which declaration-merges into
+ * the global `NodeJS.ProcessEnv`) rather than the module-form
+ * `declare global { … } export {};`. The reason is the consumer
+ * (`action-leaf-cards`) CONCATENATES this into the same extra-lib string as the
+ * `declare const context` global. A single top-level `export {};` would turn
+ * the whole concatenated `.d.ts` into a module, which silently demotes
+ * `declare const context` from a global ambient to a module-local binding -
+ * breaking `context.*` IntelliSense entirely. Staying a global script keeps the
+ * merged file ambient. Empty / all-invalid input emits `""` (dropped by the
+ * caller's `.filter(Boolean)`) so merging is always safe.
+ *
+ * Only valid TS identifiers are emitted as ambient keys (an env var like
+ * `MY-VAR` is not a legal `process.env.MY-VAR` member access, so it is
+ * skipped — it remains reachable via the index signature as
+ * `process.env["MY-VAR"]`).
+ */
+export function generateSecretEnvTypes({
+  envNames,
+}: {
+  envNames: string[];
+}): string {
+  // De-dupe, keep only legal identifiers, preserve first-seen order.
+  const seen = new Set<string>();
+  const valid: string[] = [];
+  for (const name of envNames) {
+    const trimmed = name.trim();
+    if (trimmed === "" || seen.has(trimmed)) continue;
+    seen.add(trimmed);
+    if (TS_IDENTIFIER_RE.test(trimmed)) valid.push(trimmed);
+  }
+
+  if (valid.length === 0) {
+    // Nothing to declare — emit an empty string so the caller's
+    // `.filter(Boolean)` drops it and the merged extra-lib stays untouched
+    // (a global script). Emitting `export {};` here would modularize the
+    // merged file and break the `context` global (see the doc comment).
+    return "";
+  }
+
+  const members = valid
+    .map((name) => `    readonly ${name}: string;`)
+    .join("\n");
+  return [
+    "/**",
+    " * Auto-generated: the `secretEnv` mapping declared on this action injects",
+    " * these names as `process.env.<NAME>` for the run. Typed `string` so they",
+    " * autocomplete; unknown keys still resolve via @types/node's index signature.",
+    " */",
+    "declare namespace NodeJS {",
+    "  interface ProcessEnv {",
+    members,
+    "  }",
+    "}",
+  ].join("\n");
+}
+
+/** Narrow an `unknown` to a plain (non-array) object record. */
+function asRecord(value: unknown): Record<string, unknown> | undefined {
+  if (value && typeof value === "object" && !Array.isArray(value)) {
+    return value as Record<string, unknown>;
+  }
+  return undefined;
+}
+
+/**
+ * Locate the action config's secret→env mapping by the `x-secret-env`
+ * schema annotation (NOT a hard-coded field name) and return the declared
+ * environment-variable NAMES (the mapping's keys). These feed
+ * {@link generateSecretEnvTypes} so the script editor types `process.env.*`.
+ *
+ * Both inputs are loosely typed (`configSchema` is a JSON-schema record;
+ * `config` is the action's live config object), so they're narrowed at
+ * runtime via {@link asRecord}. The lone `as` casts the already-narrowed
+ * record to its inferred shape — unavoidable because `asRecord` returns the
+ * generic record. Returns `[]` when no `x-secret-env` field exists or its
+ * mapping value isn't a record.
+ */
+export function secretEnvEnvNames({
+  configSchema,
+  config,
+}: {
+  configSchema: unknown;
+  config: unknown;
+}): string[] {
+  const schemaRecord = asRecord(configSchema);
+  const properties = asRecord(schemaRecord?.properties);
+  if (!properties) return [];
+
+  const fieldKey = Object.entries(properties).find(([, prop]) => {
+    const propRecord = asRecord(prop);
+    return propRecord?.["x-secret-env"] === true;
+  })?.[0];
+  if (!fieldKey) return [];
+
+  const configRecord = asRecord(config);
+  const mapping = asRecord(configRecord?.[fieldKey]);
+  if (!mapping) return [];
+  return Object.keys(mapping);
+}

package/tsconfig.json

@@ -7,15 +7,27 @@
     {
       "path": "../automation-common"
     },
+    {
+      "path": "../catalog-common"
+    },
     {
       "path": "../common"
     },
     {
       "path": "../frontend-api"
     },
+    {
+      "path": "../gitops-frontend"
+    },
     {
       "path": "../integration-common"
     },
+    {
+      "path": "../script-packages-frontend"
+    },
+    {
+      "path": "../secrets-frontend"
+    },
     {
       "path": "../signal-frontend"
     },