@commercelayer/agent-cli 1.0.0-dev.1 → 1.0.0-dev.11

package/dist/secrets.js

@@ -14,6 +14,8 @@ import os from 'node:os';
 import path from 'node:path';
 import { markOutWritten } from './config.js';
 import { fail } from './errors.js';
+/** Where the record's id goes in a file named after it, once the answer gives the id. */
+const ID_SLOT = '<id>';
 export function secretsDir() {
     const base = process.env.XDG_CONFIG_HOME || path.join(os.homedir(), '.config');
     return path.join(base, 'c11r', 'secrets');
@@ -23,10 +25,14 @@ const safe = (s) => s.toLowerCase().replace(/[^a-z0-9._-]+/g, '-').replace(/^-+|
 export function planSecret(opts) {
     const out = opts.values.out;
     const format = opts.values.format ?? null;
-    const base = opts.verb === 'token' ? `${safe(opts.id ?? 'credential')}-token` : safe(String(opts.values.name ?? opts.id ?? 'credential'));
+    // By the name given, else the id given; a record with neither (a gift card) by the id it is
+    // given, so each has a file of its own: gift-card-<id>.env.
+    const named = opts.values.name ?? opts.id;
+    const byRecord = !out && opts.verb !== 'token' && (named === undefined || named === null || named === '');
+    const base = opts.verb === 'token' ? `${safe(opts.id ?? 'credential')}-token` : byRecord ? `${safe(opts.noun.replace(/s$/, ''))}-${ID_SLOT}` : safe(String(named));
     const file = out ? path.resolve(out) : path.join(secretsDir(), safe(opts.org ?? 'default'), base);
-    const plan = { file: out || !format ? file : `${file}.${format}`, format, fixed: Boolean(out), overwrite: opts.yes };
-    const candidates = plan.fixed || format ? [plan.file] : [`${file}.env`, `${file}.json`];
+    const plan = { file: out || !format ? file : `${file}.${format}`, format, fixed: Boolean(out), overwrite: opts.yes, byRecord };
+    const candidates = byRecord ? [] : plan.fixed || format ? [plan.file] : [`${file}.env`, `${file}.json`];
     for (const c of candidates) {
         let st = null;
         try {
@@ -43,7 +49,7 @@ export function planSecret(opts) {
             fail('conflict', `${c} exists. c11r replaces it only with --yes, or writes the secret elsewhere with --out.`, { path: 'out', next_step: { action: 'fix_request', command: null }, details: { file: c } }, 'rejected');
         }
     }
-    const dir = path.dirname(candidates[0]);
+    const dir = path.dirname(plan.file);
     const existing = nearestExisting(dir);
     try {
         fs.accessSync(existing, fs.constants.W_OK);
@@ -74,7 +80,7 @@ export function writeSecret(r, plan, ctx) {
     const credentialId = str(rec.id) ?? ctx.id;
     const record = { noun: ctx.noun, id: credentialId ?? null, name: str(rec.name), code: str(rec.code) };
     const format = plan.format ?? (secret.format === 'json' ? 'json' : 'env');
-    const file = plan.fixed || plan.format ? plan.file : `${plan.file}.${format}`;
+    const file = byRecordFile(plan.fixed || plan.format ? plan.file : `${plan.file}.${format}`, plan, credentialId);
     const env = secret.env && Object.keys(secret.env).length ? { ...secret.env } : { [`CL_${(secret.kind ?? 'secret').toUpperCase()}`]: String(secret.value ?? '') };
     // The endpoint goes with every secret, so the file is enough to call Commerce Layer.
     if (!env.CL_BASE_ENDPOINT && typeof data.base_endpoint === 'string')
@@ -97,9 +103,9 @@ export function writeSecret(r, plan, ctx) {
         const created = ctx.verb === 'create';
         fail('secret_not_written', `The API answered the ${secret.kind ?? 'secret'} of credential ${id} once, and c11r could not write it to ${file}: ${e.message}. It was not printed, and the API cannot show it again. ${created ? `c11r credentials token ${id} gives a working token now; for a new secret, create another credential and delete ${id}.` : `c11r credentials token ${id} gives another token.`}`, { path: 'out', next_step: { action: 'fix_request', command: `c11r credentials token ${id}` }, details: { credential_id: credentialId ?? null, file } });
     }
-    // An --out file is not removed with its credential: remember that one exists, for the warning.
+    // An --out file is not removed with its record: remember which record has one, for the warning.
     if (plan.fixed && ctx.org)
-        markOutWritten(ctx.org, true);
+        markOutWritten(ctx.org, { noun: ctx.noun, keys: [record.id, record.name, record.code, ctx.id].filter((k) => typeof k === 'string' && k !== '') });
     // The API says the secret is shown once: c11r kept it in the file, and printed none of it.
     const warnings = r.warnings.filter((w) => w.code !== 'secret_shown_once' && w.code !== 'token_shown_once');
     if (!ignoredByGit(file))
@@ -111,6 +117,18 @@ export function writeSecret(r, plan, ctx) {
         warnings,
     };
 }
+/** A file named after its record: the id in its slot, and a file there already left alone. */
+function byRecordFile(file, plan, id) {
+    if (!plan.byRecord)
+        return file;
+    // The id as the API gives it, case kept: ids are case-sensitive (lqgwUkXlBw).
+    const slot = (id ?? crypto.randomBytes(4).toString('hex')).replace(/[^A-Za-z0-9._-]+/g, '-').replace(/^[.-]+/, '') || crypto.randomBytes(4).toString('hex');
+    const named = file.replace(ID_SLOT, slot);
+    if (plan.overwrite || !fs.existsSync(named))
+        return named;
+    const ext = path.extname(named);
+    return `${named.slice(0, -ext.length || undefined)}-${crypto.randomBytes(3).toString('hex')}${ext}`;
+}
 /** What a dry run says about the file: where it would go and whether one is there. */
 export function describePlan(plan) {
     const files = plan.fixed || plan.format ? [plan.file] : [`${plan.file}.env`, `${plan.file}.json`];

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@commercelayer/agent-cli",
-  "version": "1.0.0-dev.1",
+  "version": "1.0.0-dev.11",
   "description": "c11r: the Commerce Layer CLI for coding agents. One grammar, c11r <noun> <verb>, from a sandbox to a running organization.",
   "homepage": "https://commercelayer.ai",
   "keywords": [