@theholocron/cli 2.0.0-alpha.8 → 2.0.0

package/dist/keyring-DwNEmrBc.mjs

@@ -1,184 +0,0 @@
-import { r as REQUIRED_CAPABILITIES, t as CARDINALITY } from "./capabilities-DapaKOlX.mjs";
-import { Entry, findCredentials } from "@napi-rs/keyring";
-//#region src/config.ts
-/**
-* `holocron.config.json` schema, parser, and provider resolution.
-*
-* ESLint-style entry forms:
-*
-*   "source": "github"                              ← single, short
-*   "deployment": ["vercel", { team: "rando" }]    ← single, with options
-*   "notifications": ["slack", "discord"]          ← multi, short
-*   "notifications": [
-*     ["slack",   { channel: "#ops" }],
-*     ["discord", { webhook: "env:HOOK" }]
-*   ]                                              ← multi, with options
-*
-* Discriminator: an array entry is a `[provider, options]` tuple when
-* the length is 2 AND element[1] is a non-array, non-null object.
-* Otherwise it's a multi-provider list (string[] or tuple[]).
-*
-* Validation rules:
-*   - `vault` is REQUIRED (every project has secrets somewhere)
-*   - Entries for `'many'` capabilities are normalized to an array of
-*     normalized tuples; entries for `'single'` capabilities are
-*     normalized to one tuple
-*   - Tokens / secret values never appear in config — providers read
-*     them from env (or pull from `vault` at runtime)
-*/
-var ConfigError = class extends Error {
-	name = "ConfigError";
-};
-const PLUGIN_PREFIX = "@theholocron/holocron-plugin-";
-const COMMUNITY_PREFIX = "holocron-plugin-";
-/**
-* Resolve `"github"` → `"@theholocron/holocron-plugin-github"`.
-* Fully-qualified names (scoped or not) are honored verbatim, which
-* is how third-party plugins published outside the org work.
-*/
-function resolvePluginPackage(provider) {
-	if (!provider) throw new ConfigError("provider name is empty");
-	if (provider.startsWith("@")) return provider;
-	if (provider.startsWith(COMMUNITY_PREFIX)) return provider;
-	if (provider.includes("/")) return provider;
-	return PLUGIN_PREFIX + provider;
-}
-/** A bare `[provider, options]` tuple, with both elements present? */
-function isOptionsTuple(value) {
-	if (!Array.isArray(value)) return false;
-	if (value.length !== 2) return false;
-	if (typeof value[0] !== "string") return false;
-	const opt = value[1];
-	return typeof opt === "object" && opt !== null && !Array.isArray(opt);
-}
-function normalizeEntry(entry) {
-	if (typeof entry === "string") return {
-		provider: entry,
-		packageName: resolvePluginPackage(entry),
-		options: {}
-	};
-	const [provider, options] = entry;
-	return {
-		provider,
-		packageName: resolvePluginPackage(provider),
-		options
-	};
-}
-function resolveEntry(key, raw) {
-	const cardinality = CARDINALITY[key];
-	if (typeof raw === "string") {
-		if (cardinality === "many") throw new ConfigError(`\`${key}\` accepts multiple providers; wrap a single one in an array: ["${raw}"]`);
-		return {
-			cardinality: "single",
-			tuple: normalizeEntry(raw)
-		};
-	}
-	if (!Array.isArray(raw)) throw new ConfigError(`\`${key}\` entry must be a string or array, got ${typeof raw}`);
-	if (isOptionsTuple(raw)) {
-		if (cardinality === "many") return {
-			cardinality: "many",
-			tuples: [normalizeEntry(raw)]
-		};
-		return {
-			cardinality: "single",
-			tuple: normalizeEntry(raw)
-		};
-	}
-	if (cardinality === "single") throw new ConfigError(`\`${key}\` accepts exactly one provider; got a multi-provider list with ${raw.length} entries`);
-	return {
-		cardinality: "many",
-		tuples: raw.map((entry, idx) => {
-			if (typeof entry === "string") return normalizeEntry(entry);
-			if (isOptionsTuple(entry)) return normalizeEntry(entry);
-			throw new ConfigError(`\`${key}[${idx}]\` must be a provider string or [provider, options] tuple`);
-		})
-	};
-}
-function resolveConfig(raw) {
-	if (!raw.project?.name) throw new ConfigError("`project.name` is required");
-	if (!raw.providers || typeof raw.providers !== "object") throw new ConfigError("`providers` block is required");
-	const providers = {};
-	for (const [key, entry] of Object.entries(raw.providers)) {
-		if (entry === void 0) continue;
-		providers[key] = resolveEntry(key, entry);
-	}
-	for (const required of REQUIRED_CAPABILITIES) if (!providers[required]) throw new ConfigError(`required capability \`${required}\` is missing from providers`);
-	return {
-		project: raw.project,
-		providers,
-		apps: raw.apps ?? [],
-		doctor: raw.doctor ?? {}
-	};
-}
-//#endregion
-//#region src/keyring.ts
-/**
-* Keyring-backed bootstrap credential store.
-*
-* Every holocron plugin's bootstrap token (the one it needs before it
-* can talk to its vendor's API) can be stored in the OS keyring under
-* a single reverse-DNS service scope. Managed via `holocron auth`
-* subcommands; consulted at position 4 in every plugin's auth
-* precedence chain (after --token / HOLOCRON_<X>_TOKEN / <native>_TOKEN).
-*
-* See `.notes/tech-auth-bootstrap.spec.md` for the design rationale.
-*
-* Failure model: keyring access is best-effort. Platforms without a
-* supported credential store (some Linux CI images, sandboxed
-* environments) will throw from the underlying library. Every export
-* here catches and returns a null/empty result rather than propagating
-* — the plugin's precedence chain then falls through to
-* env-var-only paths, which is exactly how CI is meant to work.
-*/
-const SERVICE = "com.theholocron.cli";
-/**
-* Store or overwrite a bootstrap token for a provider. Returns true on
-* success, false when the underlying keyring is unsupported or errored.
-*/
-function setToken(provider, token) {
-	try {
-		new Entry(SERVICE, provider).setPassword(token);
-		return true;
-	} catch {
-		return false;
-	}
-}
-/**
-* Read the bootstrap token for a provider. Returns `null` for both
-* "not stored" and "keyring unavailable" — callers can treat them the
-* same way (fall through to env-var precedence).
-*/
-function getToken(provider) {
-	try {
-		return new Entry(SERVICE, provider).getPassword();
-	} catch {
-		return null;
-	}
-}
-/**
-* Delete a stored token. Returns true when a token was removed, false
-* when there was nothing to delete or the keyring is unavailable.
-* Distinguishing the two cases isn't worth the surface area — the
-* command output makes the situation clear either way.
-*/
-function deleteToken(provider) {
-	try {
-		return new Entry(SERVICE, provider).deletePassword();
-	} catch {
-		return false;
-	}
-}
-/**
-* List provider slugs with a stored token in this service scope.
-* Uses the library's `findCredentials(service)` — supported on all
-* platforms the underlying credential store supports.
-*/
-function listStoredProviders() {
-	try {
-		return findCredentials(SERVICE).map((c) => c.account);
-	} catch {
-		return [];
-	}
-}
-//#endregion
-export { ConfigError as a, resolvePluginPackage as c, setToken as i, getToken as n, resolveConfig as o, listStoredProviders as r, resolveEntry as s, deleteToken as t };