@hasna/hooks 0.9.3 → 0.9.5

package/scripts/validate-package.ts

@@ -1,12 +1,14 @@
 import { spawn, spawnSync } from "node:child_process";
 import { existsSync } from "node:fs";
-import { mkdtemp, mkdir, readFile, rm, writeFile } from "node:fs/promises";
+import { mkdtemp, mkdir, readFile, realpath, rm, symlink, writeFile } from "node:fs/promises";
 import { dirname, join } from "node:path";
 
 type PackageJson = {
   name: string;
   types?: string;
   exports?: Record<string, unknown>;
+  version?: string;
+  dependencies?: Record<string, string>;
 };
 
 type PackEntry = {
@@ -142,7 +144,72 @@ async function main(): Promise<void> {
   await validateConsumerImports(pkg);
   await validateExtractedSmoke(pkg);
 
-  console.log("Package validation passed: packed declarations are present, Bundler/NodeNext TypeScript consumer imports resolve, and the extracted tarball smoke-tests CLI help, serve /health, MCP startup, SDK import and one bundled-hook run (P3-17).");
+  console.log("Package validation passed: packed declarations are present, Bundler/NodeNext TypeScript consumer imports resolve, and the extracted tarball smoke-tests CLI help, serve /health, MCP startup, SDK import, credential-file vault references and one bundled-hook run (P3-17).");
+}
+
+async function validatePackedCredentialReferences(pkg: PackageJson, packageDir: string, smokeDir: string): Promise<void> {
+  // Link the consumer's declared installed dependency, never the workspace's
+  // unrelated Secrets source. Bundling changes where the shared resolver finds it.
+  let parent = root;
+  let secretsDir: string | undefined;
+  for (;;) {
+    const candidate = join(parent, "node_modules", "@hasna", "secrets");
+    if (existsSync(candidate)) { secretsDir = await realpath(candidate); break; }
+    if (dirname(parent) === parent) throw new Error("Hooks Secrets dependency is not installed");
+    parent = dirname(parent);
+  }
+  const secretsPkg = await readPackageJson(join(secretsDir, "package.json"));
+  if (secretsPkg.name !== "@hasna/secrets" || secretsPkg.version !== pkg.dependencies?.["@hasna/secrets"]) {
+    throw new Error("Packed reference validation requires the exact declared Secrets dependency");
+  }
+  const peerDir = join(packageDir, "node_modules", "@hasna");
+  await mkdir(peerDir, { recursive: true });
+  await symlink(secretsDir, join(peerDir, "secrets"), "dir");
+  const fixture = join(smokeDir, "credential-reference-smoke.ts");
+  await writeFile(fixture, `
+import { strict as assert } from "node:assert";
+import { mkdirSync, writeFileSync } from "node:fs";
+import { join } from "node:path";
+import { createHooksClient } from "@hasna/hooks/sdk";
+const home = join(import.meta.dir, "reference-home");
+for (const [name, body] of [
+  ["hooks", "HASNA_HOOKS_API_URL=https://hooks.example.test\\nHASNA_HOOKS_API_KEY_REF=fixture/hooks/key\\n"],
+  ["secrets", "HASNA_SECRETS_API_URL=https://secrets.example.test\\nHASNA_SECRETS_API_KEY=fixture-bootstrap-key\\n"],
+]) {
+  const folder = join(home, ".hasna", name, "config");
+  mkdirSync(folder, { recursive: true });
+  writeFileSync(join(folder, "credentials"), body, { mode: 0o600 });
+}
+let value = "fixture-first-key", vaultStatus = 200, reads = 0;
+const keys = [];
+globalThis.fetch = async (input, init) => {
+  const url = new URL(String(input)), headers = new Headers(init?.headers);
+  if (url.origin === "https://secrets.example.test") {
+    assert.equal(url.pathname, "/v1/secrets/get");
+    assert.equal(url.searchParams.get("key"), "fixture/hooks/key");
+    assert.equal(headers.get("x-api-key"), "fixture-bootstrap-key");
+    reads++;
+    return Response.json(vaultStatus === 200 ? { value } : { error: "fixture denial" }, { status: vaultStatus });
+  }
+  assert.equal(url.origin, "https://hooks.example.test");
+  assert.equal(init.redirect, "manual");
+  keys.push(headers.get("x-api-key"));
+  return Response.json({ hooks: [] });
+};
+const client = createHooksClient({ env: { HOME: home }, credentials: { keychain: { enabled: false } } });
+await client.catalog();
+value = "fixture-rotated-key";
+await client.catalog();
+vaultStatus = 401;
+await assert.rejects(client.catalog(), /vault.*unavailable/);
+assert.deepEqual(keys, ["fixture-first-key", "fixture-rotated-key"]);
+assert.equal(reads, 3);
+console.log("packed credential-file reference, rotation and terminal failure passed");
+`);
+  const result = spawnSync("bun", ["run", fixture], {
+    cwd: smokeDir, env: { PATH: process.env.PATH }, encoding: "utf8", timeout: 20000,
+  });
+  if (result.status !== 0) throw new Error(`Packed credential reference failed: ${result.stderr}`);
 }
 
 /**
@@ -284,6 +351,7 @@ async function validateExtractedSmoke(pkg: PackageJson): Promise<void> {
     const sdkOut = JSON.parse(sdk.stdout.trim()) as { count: number; backend: string; sdk: string; hasClient: boolean };
     if (typeof sdkOut.count !== "number" || sdkOut.count <= 0) throw new Error(`packed SDK import returned count ${sdkOut.count}`);
     if (sdkOut.sdk !== "fail-closed" || !sdkOut.hasClient) throw new Error(`packed ./sdk export did not fail closed with nothing configured: ${JSON.stringify(sdkOut)}`);
+    await validatePackedCredentialReferences(pkg, packageDir, smokeDir);
 
     // 5. One bundled-hook run from the packed artifact (isolated data dir;
     // first run self-trusts, then executes).