@stravica-ai/digital-operator-pa 0.1.17 → 0.1.18

package/dist/engineering-pa-cli/docs/gsc.md

@@ -37,10 +37,20 @@ Two npm packages (declared in `@stravica-ai/digital-operator-pa`):
 
 5. **Store the SA key in the SOPS vault**:
    ```bash
+   # Legacy single-file vault:
    pnpm exec secrets set GSC_SERVICE_ACCOUNT_KEY -
+   # Scoped-vault estate (workspace or canonical layout):
+   pnpm exec secrets set --scope <scope> GSC_SERVICE_ACCOUNT_KEY -
    # paste the entire JSON contents, then Ctrl-D
    ```
 
+   On scoped-vault hosts, `pa gsc` reads the key from whichever pot
+   `secrets get` would use — i.e. it honours (in order) `SECRETS_DEFAULT_SCOPE`,
+   the `defaultScope` in `~/.config/stravica-pa/defaults.json`, or the
+   calling PA's `identity.json` — before falling back to the legacy
+   single-file vault. Store the key in the pot the host is already
+   configured to read; no `pa gsc`-specific configuration is needed.
+
 6. **Store Cloudflare credentials** (also one-time). Two key shapes are
    supported; pick whichever fits your setup:
 
@@ -70,6 +80,10 @@ Two npm packages (declared in `@stravica-ai/digital-operator-pa`):
    no `--account` flag is passed and the `CLOUDFLARE_PAGES_*` unsuffixed
    pair is absent. Don't rely on it — set the `CLOUDFLARE_PAGES_*` keys.
 
+   Same scoped-vault note as the SA key: on scoped hosts these live in
+   whichever pot `secrets get` reads (see step 5); use `secrets set --scope
+   <scope> ...` to store them there.
+
 ## Per-domain setup (each time you onboard a new property)
 
 7. **Grant the service-account access to the GSC property.** Until the

package/dist/engineering-pa-cli/src/gsc/auth.mjs

@@ -8,7 +8,7 @@
 // override and never touch the network. The SA-key read also accepts an
 // override so tests can pass in a synthetic key without going through SOPS.
 
-import { defaultPaths, checkVault, secretsFileExists, sopsDecrypt, VaultError } from '../secrets/vault.mjs';
+import { resolveCommandPaths, checkVault, secretsFileExists, sopsDecrypt, VaultError } from '../secrets/vault.mjs';
 
 // Read-only scope: searchanalytics.query + sites.list + sitemaps.list.
 // Read-write scope: sites.add, sitemaps.submit, site verification.
@@ -25,9 +25,26 @@ const DEFAULT_VAULT_KEY = 'GSC_SERVICE_ACCOUNT_KEY';
 /**
  * Load the service-account JSON object from the SOPS vault.
  *
+ * Vault path resolution goes through `resolveCommandPaths` — the same
+ * resolver `secrets get`/`set` use — so this honours all the same layouts
+ * without duplicating logic: an explicit `overrides.paths` (from a
+ * pre-resolved `--scope`/`--file`) is a pass-through; otherwise the
+ * default-scope resolver runs (SECRETS_DEFAULT_SCOPE env, defaultScope in
+ * ~/.config/stravica-pa/defaults.json, or the calling PA's identity.json)
+ * and points at a scoped `.vault/scopes/<scope>.enc.json`; if nothing is
+ * configured anywhere it falls back to the legacy single-file vault.
+ *
+ * A stderr `note: writing to '<scope>' pot ...` line is printed by the
+ * resolver on the default-scope path — same behaviour as `secrets get`,
+ * kept intentionally consistent so operators see the same routing signal
+ * from every consumer of the vault.
+ *
  * @param {object} overrides
- * @param {object} [overrides.paths]      Vault paths (from defaultPaths()).
+ * @param {object} [overrides.paths]      Vault paths already resolved (e.g. from --scope upstream).
  * @param {string} [overrides.vaultKey]   Vault key name (default GSC_SERVICE_ACCOUNT_KEY).
+ * @param {string} [overrides.cwd]        Test seam — cwd used for workspace resolution.
+ * @param {object} [overrides.env]        Test seam — env used for scope-default resolution.
+ * @param {string} [overrides.home]       Test seam — home used for keyfile + defaults.json lookup.
  * @param {string} [overrides.serviceAccountKey]
  *        Raw SA JSON string. If provided, skips vault entirely (testing).
  * @returns {Promise<object>} Parsed service-account JSON.
@@ -39,34 +56,39 @@ export async function loadServiceAccountKey(overrides = {}) {
       : overrides.serviceAccountKey;
   }
 
-  const paths = overrides.paths || defaultPaths();
+  const paths = resolveCommandPaths(overrides);
   const vaultKey = overrides.vaultKey || DEFAULT_VAULT_KEY;
 
   const state = checkVault(paths);
   if (!state.ok) {
+    // Print then throw — main() suppresses messages for errors that carry
+    // an exitCode (the throw-site is expected to have reported), so
+    // omitting the console.error would exit silently through the pa gsc
+    // binary.
+    console.error(state.message);
     throw new VaultError(state.message, state.exitCode ?? 1);
   }
   if (!secretsFileExists(paths)) {
-    throw new VaultError(
-      `No secrets file at ${paths.secretsFile}. Run 'secrets init' first.`,
-      1,
-    );
+    const message = `No secrets file at ${paths.secretsFile}.` + (paths.scoped
+      ? ` Store the service-account JSON with:\n  secrets set --scope ${paths.scope} ${vaultKey} -\n(then paste the JSON, then Ctrl-D)`
+      : " Run 'secrets init' first.");
+    console.error(message);
+    throw new VaultError(message, 1);
   }
   const data = await sopsDecrypt(paths, paths.secretsFile);
   if (!(vaultKey in data)) {
-    throw new VaultError(
-      `Vault key "${vaultKey}" not found. Store the service-account JSON with:\n  secrets set ${vaultKey} -\n(then paste the JSON, then Ctrl-D)`,
-      1,
-    );
+    const scopeHint = paths.scoped ? ` --scope ${paths.scope}` : '';
+    const message = `Vault key "${vaultKey}" not found in ${paths.secretsFile}. Store the service-account JSON with:\n  secrets set${scopeHint} ${vaultKey} -\n(then paste the JSON, then Ctrl-D)`;
+    console.error(message);
+    throw new VaultError(message, 1);
   }
   const raw = data[vaultKey];
   try {
     return typeof raw === 'string' ? JSON.parse(raw) : raw;
   } catch (e) {
-    throw new VaultError(
-      `Vault key "${vaultKey}" is not valid JSON: ${e.message}`,
-      2,
-    );
+    const message = `Vault key "${vaultKey}" is not valid JSON: ${e.message}`;
+    console.error(message);
+    throw new VaultError(message, 2);
   }
 }
 

package/dist/engineering-pa-cli/src/gsc/cloudflare.mjs

@@ -24,7 +24,7 @@
 //
 // `fetchImpl` and `now` are injectable for tests.
 
-import { defaultPaths, checkVault, secretsFileExists, sopsDecrypt, VaultError } from '../secrets/vault.mjs';
+import { resolveCommandPaths, checkVault, secretsFileExists, sopsDecrypt, VaultError } from '../secrets/vault.mjs';
 
 const CF_API = 'https://api.cloudflare.com/client/v4';
 
@@ -122,14 +122,23 @@ export async function loadCloudflareCreds(overrides = {}) {
   if (overrides.vaultData) {
     data = overrides.vaultData;
   } else {
-    const paths = overrides.paths || defaultPaths();
+    // resolveCommandPaths honours --scope/--file (via a pre-resolved
+    // overrides.paths), the SECRETS_DEFAULT_SCOPE env, defaults.json's
+    // defaultScope, and the calling PA's identity.json, before falling
+    // back to the legacy single-file vault. Same routing as `secrets get`
+    // and `pa gsc`'s SA-key loader — one resolver, one routing signal.
+    const paths = resolveCommandPaths(overrides);
     const state = checkVault(paths);
-    if (!state.ok) throw new VaultError(state.message, state.exitCode ?? 1);
+    if (!state.ok) {
+      console.error(state.message);
+      throw new VaultError(state.message, state.exitCode ?? 1);
+    }
     if (!secretsFileExists(paths)) {
-      throw new VaultError(
-        `No secrets file at ${paths.secretsFile}. Run 'secrets init' first.`,
-        1,
-      );
+      const message = `No secrets file at ${paths.secretsFile}.` + (paths.scoped
+        ? ` Store Cloudflare credentials with 'secrets set --scope ${paths.scope} <KEY> <value>'.`
+        : " Run 'secrets init' first.");
+      console.error(message);
+      throw new VaultError(message, 1);
     }
     data = await sopsDecrypt(paths, paths.secretsFile);
   }

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@stravica-ai/digital-operator-pa",
-  "version": "0.1.17",
-  "description": "Digital Operator PA — single-bundled public package surface (bins + library) for the platform.",
+  "version": "0.1.18",
+  "description": "Digital Operator PA \u2014 single-bundled public package surface (bins + library) for the platform.",
   "type": "module",
   "main": "./index.mjs",
   "exports": {
@@ -49,10 +49,11 @@
   "engines": {
     "node": ">=24"
   },
-  "//": "test pins --test-isolation=none: default process-isolation mode silently undercounts (drops passed tests from totals) when a test awaits async work while stdout is patched by a capture() helper — see packages/cli/test/secrets. Counts must never lie.",
   "scripts": {
     "build": "node build.mjs",
+    "prepack": "node build.mjs",
     "test": "node --test --test-isolation=none test/*.test.mjs",
     "dry-publish": "node build.mjs && node scripts/dry-publish.mjs"
-  }
-}
+  },
+  "//": "test pins --test-isolation=none: default process-isolation mode silently undercounts (drops passed tests from totals) when a test awaits async work while stdout is patched by a capture() helper \u2014 see packages/cli/test/secrets. Counts must never lie."
+}