@rtrentjones/greenlight 0.2.19 → 0.2.20

package/dist/bin.js

@@ -5,7 +5,7 @@ import {
   loadConfig,
   resolveUrl,
   verifyAll
-} from "./chunk-6USV5AQV.js";
+} from "./chunk-PSNO7F4Q.js";
 import "./chunk-HX7VA25D.js";
 import "./chunk-N3IKUCSF.js";
 import "./chunk-KP3Y6WRU.js";
@@ -58,6 +58,11 @@ function serializeTool(t) {
     if (pv.path !== void 0) pvParts.push(`path: ${q(pv.path)}`);
     parts.push(`preview: { ${pvParts.join(", ")} }`);
   }
+  if (t.tokens?.length) parts.push(`tokens: [${t.tokens.map(q).join(", ")}]`);
+  if (t.tokenOverrides && Object.keys(t.tokenOverrides).length) {
+    const ov = Object.entries(t.tokenOverrides).map(([k, v]) => `${k}: ${q(v)}`).join(", ");
+    parts.push(`tokenOverrides: { ${ov} }`);
+  }
   return `    { ${parts.join(", ")} },`;
 }
 function serializeConfig(c) {
@@ -103,7 +108,9 @@ function addTool(config, t) {
         ...t.adopted ? { adopted: true } : {},
         ...t.external ? { external: true } : {},
         ...t.port !== void 0 ? { port: t.port } : {},
-        ...t.preview ? { preview: t.preview } : {}
+        ...t.preview ? { preview: t.preview } : {},
+        ...t.tokens?.length ? { tokens: t.tokens } : {},
+        ...t.tokenOverrides && Object.keys(t.tokenOverrides).length ? { tokenOverrides: t.tokenOverrides } : {}
       }
     ]
   };
@@ -129,7 +136,9 @@ function upsertTool(config, t) {
     ...t.adopted ? { adopted: true } : {},
     ...t.external ? { external: true } : {},
     ...t.port !== void 0 ? { port: t.port } : {},
-    ...t.preview ? { preview: t.preview } : {}
+    ...t.preview ? { preview: t.preview } : {},
+    ...t.tokens?.length ? { tokens: t.tokens } : {},
+    ...t.tokenOverrides && Object.keys(t.tokenOverrides).length ? { tokenOverrides: t.tokenOverrides } : {}
   };
   const tools = config.tools.some((x) => x.name === t.name) ? config.tools.map((x) => x.name === t.name ? entry : x) : [...config.tools, entry];
   const result = ConfigSchema.safeParse({ ...config, tools });
@@ -186,7 +195,9 @@ function resolveEntry(config, name) {
     dir: tool.dir ?? `tools/${tool.name}`,
     external: tool.external,
     port: tool.port,
-    preview: tool.preview
+    preview: tool.preview,
+    tokens: tool.tokens,
+    tokenOverrides: tool.tokenOverrides
   };
 }
 var VERIFY_MODES = /* @__PURE__ */ new Set(["api", "mcp", "playwright", "test", "agent-web", "eval"]);
@@ -401,6 +412,12 @@ var PACKS = [
     tfModules: ["tool", "tunnel", "oci-network", "oci-container-instance"]
   }
 ];
+function secretKeyFor(tok, toolName, overrides) {
+  const override = overrides?.[tok.envVar];
+  if (override) return override;
+  const suffix = `_${toolName.toUpperCase().replace(/-/g, "_")}`;
+  return tok.envVar.toUpperCase() + (tok.perTool ? suffix : "");
+}
 function packsForTool(tool) {
   return PACKS.filter((p) => p.always || (tool ? p.appliesTo(tool) : false));
 }
@@ -426,7 +443,7 @@ function tokensForTool(tool) {
 }
 
 // src/version.ts
-var MODULE_REF = "v0.2.19";
+var MODULE_REF = "v0.2.20";
 var MODULE_SOURCE_BASE = "git::https://github.com/RTrentJones/greenlight.git//infra/modules";
 function moduleSource(module, ref = MODULE_REF) {
   return `${MODULE_SOURCE_BASE}/${module}?ref=${ref}`;
@@ -441,6 +458,7 @@ function emitToolTf(opts) {
   const useSupabase = data === "supabase";
   const useVercel = target === "vercel";
   const useOci = target === "oci";
+  const supabaseOverride = opts.tokenOverrides?.SUPABASE_ACCESS_TOKEN;
   const envList = envs.map((e) => `"${e}"`).join(", ");
   const blocks = [];
   const assumes = ["var.cloudflare_zone_id"];
@@ -455,9 +473,25 @@ function emitToolTf(opts) {
 # External tool: app code + deploy live in ${slug}; this manages only its infra here.` : ""}`
   );
   if (useSupabase) {
+    const providersLine = supabaseOverride ? `
+  providers = { supabase = supabase.${name} }` : "";
+    const overrideBlock = supabaseOverride ? `
+
+# Multi-account: ${name}'s Supabase lives in a SECOND account \u2014 an aliased provider authenticates
+# with its own token. In infra.yml: TF_VAR_${name}_supabase_access_token: \${{ secrets.${supabaseOverride} }}
+provider "supabase" {
+  alias        = "${name}"
+  access_token = var.${name}_supabase_access_token
+}
+
+variable "${name}_supabase_access_token" {
+  type        = string
+  sensitive   = true
+  description = "Supabase Management API token for ${name}'s account (scoped secret ${supabaseOverride})."
+}` : "";
     blocks.push(`# One Supabase project (schema-per-env), kept declarative + recreatable + kept alive.
 module "${name}_supabase" {
-  source = "${moduleSource("supabase", ref)}"
+  source = "${moduleSource("supabase", ref)}"${providersLine}
 
   name              = "${name}"
   project_name      = "${name}-db"
@@ -473,7 +507,7 @@ variable "${name}_supabase_database_password" {
   type      = string
   sensitive = true
   default   = "import-placeholder" # ignored when importing an existing project
-}`);
+}${overrideBlock}`);
   }
   if (useVercel) {
     const env = useSupabase ? `
@@ -918,8 +952,7 @@ async function gatherSecrets(name, repo, env, prefill) {
     for (const pack of packs) {
       console.log(`\u2500\u2500 ${pack.name}${pack.setupUrl ? `  \u2192  ${pack.setupUrl}` : ""}`);
       for (const tok of pack.tokens) {
-        const suffix = `_${name.toUpperCase().replace(/-/g, "_")}`;
-        const key = tok.envVar.toUpperCase() + (tok.perTool ? suffix : "");
+        const key = secretKeyFor(tok, name, entry.tokenOverrides);
         if (key === "GITHUB_TOKEN") {
           console.log("   \xB7 GITHUB_TOKEN \u2014 provided automatically by Actions; skipping");
           continue;
@@ -1070,7 +1103,16 @@ async function addCommand(args) {
   } else {
     writeFileSync2(
       toolTf,
-      emitToolTf({ name, domain: config.domain, lane, target, data, envs, port: entry?.port })
+      emitToolTf({
+        name,
+        domain: config.domain,
+        lane,
+        target,
+        data,
+        envs,
+        port: entry?.port,
+        tokenOverrides: entry?.tokenOverrides
+      })
     );
     console.log(`\u2714 wrote infra/${name}.tf (modules: ${providers.join(", ")})`);
   }
@@ -1976,6 +2018,16 @@ function conformanceChecks(t, root) {
     status: gateable ? "ok" : "warn",
     detail: platformPreview ? "vercel per-PR preview + deployment_status verify" : gateable ? void 0 : `no built-in serve for ${t.external ? "an external " : ""}${t.target} tool \u2014 add preview:{ command, \u2026 } so \`greenlight preview ${t.name}\` works`
   });
+  const declared = [...t.tokens ?? [], ...Object.values(t.tokenOverrides ?? {})];
+  if (declared.length) {
+    const tag = t.name.toUpperCase().replace(/-/g, "_");
+    const generic = declared.filter((s) => !s.toUpperCase().includes(tag));
+    out.push({
+      name: `${t.name}: token scoping`,
+      status: generic.length ? "warn" : "ok",
+      detail: generic.length ? `not tool-scoped (should contain ${tag}): ${generic.join(", ")}` : `${declared.length} scoped secret name(s)`
+    });
+  }
   return out;
 }
 function runDoctor(config, root) {

package/dist/{chunk-6USV5AQV.js → chunk-PSNO7F4Q.js}

@@ -56,7 +56,16 @@ var ToolSchema = z.object({
     // local port (default: tool.port ?? lane default)
     path: z.string().optional()
     // connect path (default: lane default, e.g. `/mcp`)
-  }).optional()
+  }).optional(),
+  // The project-scoped secret names this tool needs (e.g. ['TF_VAR_HEISTMIND_GITHUB_ADMIN_TOKEN']).
+  // The convention (docs/tokens-reference.md): a project-scoped secret carries the uppercased tool name.
+  // `doctor` warns on a name that doesn't — documentation + conformance, no behavior.
+  tokens: z.array(z.string()).optional(),
+  // Opt-in per-tool provider-token OVERRIDES (multi-account). Maps a provider's default token env
+  // var to an alternate secret name, so this tool authenticates that provider with a SECOND account
+  // — e.g. { SUPABASE_ACCESS_TOKEN: 'SUPABASE_ACCESS_TOKEN_HEISTMIND' }. Absent ⇒ unchanged (the
+  // default token). `add`/`adopt` emit an aliased provider + scoped var/secret for an overridden token.
+  tokenOverrides: z.record(z.string(), z.string()).optional()
 }).superRefine((tool, ctx) => {
   const rule = MATRIX[tool.lane];
   if (!rule.targets.includes(tool.target)) {

package/dist/index.js

@@ -2,7 +2,7 @@ import {
   defineConfig,
   defineVerify,
   loadConfig
-} from "./chunk-6USV5AQV.js";
+} from "./chunk-PSNO7F4Q.js";
 import "./chunk-HX7VA25D.js";
 import "./chunk-N3IKUCSF.js";
 import "./chunk-KP3Y6WRU.js";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rtrentjones/greenlight",
-  "version": "0.2.19",
+  "version": "0.2.20",
   "description": "Greenlight CLI — setup and lifecycle for the harness.",
   "license": "MIT",
   "repository": {