@checkstack/secrets-backend 0.2.11 → 0.2.12

package/CHANGELOG.md

@@ -1,5 +1,54 @@
 # @checkstack/secrets-backend
 
+## 0.2.12
+
+### Patch Changes
+
+- 8cad340: Widen Cmd+K command-palette coverage to every top-level sidebar destination.
+
+  The command palette previously only surfaced commands from a handful of plugins,
+  so large feature areas were silently unreachable from search. Each of these
+  plugins now registers a "navigate to <feature>" command per top-level route via
+  `registerSearchProvider`, so every sidebar destination they own is reachable
+  from Cmd+K (entity search can come later):
+
+  - dependency: "Dependency Map"
+  - status-page: "Status pages"
+  - satellite: "Satellites"
+  - gitops: "GitOps", "Kind Registry"
+  - secrets: "Secrets"
+  - notification: "Notification Settings"
+  - script-packages: "Script Packages", "Script Sandbox"
+
+  Each command reuses the plugin's own route helper (`resolveRoute`) for its href
+  and carries the same access rule that gates its sidebar nav entry, so palette
+  visibility matches sidebar visibility. The notification command carries no
+  access rule, matching its authenticated-only nav entry.
+
+- 8cad340: refactor: replace `env as unknown as EnvStash` double casts with module-scoped holders
+
+  The `init()` -> `afterPluginsReady()` bridging that stashed setup closures and
+  service handles as ad-hoc mutable properties on the framework `env` object via a
+  double cast (`env as unknown as EnvStash`) is replaced with typed module- or
+  register-scoped `let` holders, mirroring the existing pattern in
+  `healthcheck-backend` (`storedEmitHook`). No behavior or DB change; the holders
+  are pod-local setup state (never queryable current state), so they remain
+  scale-correct. This removes an unsafe, copy-paste-prone idiom from five core
+  plugins.
+
+- Updated dependencies [8cad340]
+- Updated dependencies [8cad340]
+- Updated dependencies [8cad340]
+- Updated dependencies [8cad340]
+- Updated dependencies [8cad340]
+- Updated dependencies [8cad340]
+- Updated dependencies [8cad340]
+- Updated dependencies [8cad340]
+  - @checkstack/backend-api@0.25.0
+  - @checkstack/common@0.17.0
+  - @checkstack/command-backend@0.2.12
+  - @checkstack/secrets-common@0.2.5
+
 ## 0.2.11
 
 ### Patch Changes

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@checkstack/secrets-backend",
-  "version": "0.2.11",
+  "version": "0.2.12",
   "description": "Secrets platform backend: resolver service, masking, backend extension point, RPC router",
   "author": "Checkstack contributors",
   "license": "Elastic-2.0",
@@ -25,21 +25,22 @@
     "test": "bun test"
   },
   "dependencies": {
-    "@checkstack/backend-api": "0.24.1",
-    "@checkstack/common": "0.16.0",
-    "@checkstack/secrets-common": "0.2.4",
+    "@checkstack/backend-api": "0.25.0",
+    "@checkstack/command-backend": "0.2.12",
+    "@checkstack/common": "0.17.0",
+    "@checkstack/secrets-common": "0.2.5",
     "@orpc/server": "^1.14.4",
     "drizzle-orm": "^0.45.0",
     "uuid": "^14.0.0",
     "zod": "^4.2.1"
   },
   "devDependencies": {
-    "@checkstack/scripts": "0.6.2",
-    "@checkstack/dev-server": "2.2.2",
-    "@checkstack/backend": "0.20.1",
+    "@checkstack/scripts": "0.6.3",
+    "@checkstack/dev-server": "2.2.3",
+    "@checkstack/backend": "0.21.0",
     "@checkstack/tsconfig": "0.0.7",
-    "@checkstack/drizzle-helper": "0.0.5",
-    "@checkstack/test-utils-backend": "0.1.45",
+    "@checkstack/drizzle-helper": "0.0.6",
+    "@checkstack/test-utils-backend": "0.1.46",
     "@types/bun": "^1.3.5",
     "@types/node": "^20.0.0",
     "drizzle-kit": "^0.31.10",

package/src/index.ts

@@ -6,17 +6,18 @@ import {
 import {
   pluginMetadata,
   secretsAccessRules,
+  secretsAccess,
+  secretsRoutes,
   secretsContract,
 } from "@checkstack/secrets-common";
 import type { PluginMetadata } from "@checkstack/common";
+import { resolveRoute } from "@checkstack/common";
+import { registerSearchProvider } from "@checkstack/command-backend";
 import {
   secretBackendExtensionPoint,
   type SecretBackend,
 } from "./secret-backend";
-import {
-  createSecretBackendRegistry,
-  type SecretBackendRegistry,
-} from "./secret-backend-registry";
+import { createSecretBackendRegistry } from "./secret-backend-registry";
 import {
   createSecretResolverService,
   type SecretResolverService,
@@ -70,21 +71,23 @@ export const internalSecretsRef = createServiceRef<InternalSecretsService>(
   "secrets.internal",
 );
 
-interface EnvStash {
-  backends: SecretBackendRegistry;
-  configStore?: BackendConfigStore;
-  emitChanged?: (input: {
-    name: string;
-    change: "created" | "rotated" | "deleted";
-  }) => Promise<void>;
-}
-
 export default createBackendPlugin({
   metadata: pluginMetadata,
 
   register(env) {
     const backends = createSecretBackendRegistry();
-    (env as unknown as EnvStash).backends = backends;
+
+    // Bridge holders set in init()/afterPluginsReady() and read by the router
+    // and admin-service closures wired below. Pod-local setup handles, never
+    // queryable current state, so they are scale-safe (mirrors
+    // healthcheck-backend's `storedEmitHook`).
+    let configStore: BackendConfigStore | undefined;
+    let emitChangedSink:
+      | ((input: {
+          name: string;
+          change: "created" | "rotated" | "deleted";
+        }) => Promise<void>)
+      | undefined;
 
     env.registerAccessRules(secretsAccessRules);
 
@@ -112,7 +115,7 @@ export default createBackendPlugin({
     };
 
     const getActiveBackendId = async (): Promise<string> => {
-      const store = (env as unknown as EnvStash).configStore;
+      const store = configStore;
       const redacted = await store?.loadRedacted();
       const persisted = redacted?.activeBackend;
       if (persisted && backends.has(persisted)) return persisted;
@@ -120,7 +123,7 @@ export default createBackendPlugin({
     };
 
     const setActiveBackendId = async (id: string): Promise<void> => {
-      const store = (env as unknown as EnvStash).configStore;
+      const store = configStore;
       if (!store) {
         throw new Error("Backend config store is not initialized yet.");
       }
@@ -143,7 +146,7 @@ export default createBackendPlugin({
       name: string;
       change: "created" | "rotated" | "deleted";
     }): Promise<void> => {
-      await (env as unknown as EnvStash).emitChanged?.(input);
+      await emitChangedSink?.(input);
     };
 
     const getActiveBackend = async (): Promise<SecretBackend> =>
@@ -173,7 +176,7 @@ export default createBackendPlugin({
       init: async ({ logger, rpc, config }) => {
         logger.debug("🔐 Initializing Secrets Backend...");
 
-        (env as unknown as EnvStash).configStore = createBackendConfigStore({
+        configStore = createBackendConfigStore({
           config,
         });
 
@@ -186,11 +189,28 @@ export default createBackendPlugin({
         });
         rpc.registerRouter(router, secretsContract);
 
+        // Register the "Secrets" navigation command in the command palette so
+        // the sidebar destination is reachable from Cmd+K. Gated on manage,
+        // mirroring the nav entry (the page is the admin settings view).
+        registerSearchProvider({
+          pluginMetadata,
+          commands: [
+            {
+              id: "home",
+              title: "Secrets",
+              subtitle: "Create, rotate, and delete secrets",
+              iconName: "KeyRound",
+              route: resolveRoute(secretsRoutes.routes.home),
+              requiredAccessRules: [secretsAccess.secret.manage],
+            },
+          ],
+        });
+
         logger.debug("✅ Secrets Backend initialized.");
       },
 
       afterPluginsReady: async ({ logger, emitHook }) => {
-        (env as unknown as EnvStash).emitChanged = async (input) => {
+        emitChangedSink = async (input) => {
           await emitHook(secretsChangedHook, input);
         };
         logger.debug("✅ Secrets Backend afterPluginsReady complete.");

package/tsconfig.json

@@ -10,6 +10,9 @@
     {
       "path": "../backend-api"
     },
+    {
+      "path": "../command-backend"
+    },
     {
       "path": "../common"
     },