@theholocron/cli 5.0.0-alpha.185 → 5.0.0-alpha.186

package/dist/cli.mjs

@@ -26,7 +26,7 @@ import ora from "ora";
 import { findRootSync, isWorkspaceRoot, walkFilesSync } from "@theholocron/fs-utils";
 import { access, copyFile, mkdir, readFile, readdir, rename, rm, stat, symlink, unlink, writeFile } from "node:fs/promises";
 import { stringifyJson } from "@theholocron/json-utils";
-import { createHash, randomUUID } from "node:crypto";
+import { createHash, randomBytes, randomUUID } from "node:crypto";
 import { generateReadme } from "@theholocron/components-doc/markdown";
 import { getClients, getConfigs, getDocs, getPlugins, getSkills, getThemes, getUtils } from "@theholocron/registry-doc";
 import { createGitHubClient } from "@theholocron/github-client";
@@ -3249,8 +3249,16 @@ async function runNew(input) {
 function defaultSecretName(channel) {
 	return `HOLOCRON_NOTIFY_WEBHOOK_${channel.toUpperCase().replace(/[^A-Z0-9]+/g, "_")}`;
 }
-/** A throwaway secret, written and removed to prove write access. */
-const PREFLIGHT_SECRET = "HOLOCRON_NOTIFY_PREFLIGHT";
+/**
+* Prefix of the throwaway secret the preflight writes and removes. Every run adds a
+* random suffix, so it can never overwrite (and then delete) a secret someone already
+* has; layouts may not use any name under this prefix for their own secrets.
+*/
+const PREFLIGHT_PREFIX = "HOLOCRON_NOTIFY_PREFLIGHT";
+/** Whether a secret name is under the preflight's reserved prefix. GitHub secret names are case-insensitive. */
+function isReservedSecret(name) {
+	return name.toUpperCase().startsWith(PREFLIGHT_PREFIX);
+}
 /**
 * Prove the secrets store can be WRITTEN before creating anything that needs it.
 * A webhook's URL is shown once; creating the webhook and then failing to store
@@ -3259,12 +3267,13 @@ const PREFLIGHT_SECRET = "HOLOCRON_NOTIFY_PREFLIGHT";
 * remove it.
 */
 async function assertSecretsReachable(secrets, scope) {
+	const probe = `${PREFLIGHT_PREFIX}_${randomBytes(4).toString("hex").toUpperCase()}`;
 	try {
-		await secrets.setSecret(scope, PREFLIGHT_SECRET, "ok");
-		await secrets.deleteSecret(scope, PREFLIGHT_SECRET);
+		await secrets.setSecret(scope, probe, "ok");
+		await secrets.deleteSecret(scope, probe);
 	} catch (err) {
 		const where = scope.kind === "organization" ? `organization ${scope.name}` : scope.kind;
-		throw new Error(`cannot write to the secrets store for ${where} (${describeProviderError(err)}) — fix that token before creating webhooks`, { cause: err });
+		throw new Error(`cannot write to the secrets store for ${where} (${describeProviderError(err)}) — fix that token before creating webhooks. If a secret named ${probe} was left behind, delete it`, { cause: err });
 	}
 }
 /** Why a capability is not loaded: the plugin's own load error when there is one (e.g. a missing token). */
@@ -3294,6 +3303,7 @@ async function provisionChannel(deps, spec) {
 	const where = spec.category ? ` in ${spec.category}` : "";
 	if (!notifications.ensureChannel) throw new Error(`\`${notifications.providerName}\` cannot create channels`);
 	if (webhookCfg && !notifications.ensureWebhook) throw new Error(`\`${notifications.providerName}\` cannot create webhooks`);
+	if (webhookCfg && isReservedSecret(secretName)) throw new Error(`secret name ${secretName} is reserved for the setup preflight -- choose another`);
 	if (webhookCfg && !dryRun && !secrets) throw new Error("storing a webhook URL needs a `secrets` provider — add one to holocron.config.ts");
 	if (dryRun) {
 		print(`  … would ensure channel ${spec.name}${where}`);
@@ -3463,10 +3473,10 @@ async function runNotificationsSetup(input) {
 	}
 	const layout = notifications.layout;
 	if (!layout) return refuse(`the \`${notifications.providerName}\` provider declares no layout — add \`layout\` to its options in holocron.config.ts`);
-	const wantsWebhook = (layout.categories ?? []).some((c) => (c.channels ?? []).some((ch) => ch.webhook));
+	const wantsSecrets = (layout.categories ?? []).some((c) => (c.channels ?? []).some((ch) => ch.webhook)) || (layout.roles ?? []).some((r) => r.secret);
 	let secrets;
-	if (wantsWebhook && !dryRun) {
-		if (!loader.has("secrets")) return refuse(whyMissing(loader, "secrets", "the layout asks for webhooks, which need a `secrets` capability — add a `secrets` provider"));
+	if (wantsSecrets && !dryRun) {
+		if (!loader.has("secrets")) return refuse(whyMissing(loader, "secrets", "the layout stores webhook URLs or role ids, which need a `secrets` capability — add a `secrets` provider"));
 		secrets = loader.get("secrets");
 	}
 	const org = input.context.org;
@@ -3474,19 +3484,29 @@ async function runNotificationsSetup(input) {
 		kind: "organization",
 		name: org
 	} : void 0);
-	if (wantsWebhook && !scope && !dryRun) return refuse("no org to store webhook secrets under — pass --scope or set `org` in holocron.config.ts");
+	if (wantsSecrets && !scope && !dryRun) return refuse("no org to store secrets under — pass --scope or set `org` in holocron.config.ts");
 	if (secrets && scope && !dryRun) try {
 		await assertSecretsReachable(secrets, scope);
 	} catch (err) {
 		return refuse(errorMessage(err), logReason(err));
 	}
 	const taken = /* @__PURE__ */ new Map();
+	const claim = (secret, owner, hint) => {
+		if (isReservedSecret(secret)) return `${owner} would store into ${secret}, a name reserved for the setup preflight — choose another`;
+		const key = secret.toUpperCase();
+		const other = taken.get(key);
+		if (other) return `${other} and ${owner} would both store into ${secret} — ${hint}`;
+		taken.set(key, owner);
+	};
 	for (const category of layout.categories ?? []) for (const channel of category.channels ?? []) {
 		if (!channel.webhook) continue;
-		const secret = channel.webhook !== true && channel.webhook.secret || defaultSecretName(channel.name);
-		const other = taken.get(secret);
-		if (other) return refuse(`channels \`${other}\` and \`${channel.name}\` would both store their webhook in ${secret} — give one a distinct \`webhook.secret\``);
-		taken.set(secret, channel.name);
+		const clash = claim(channel.webhook !== true && channel.webhook.secret || defaultSecretName(channel.name), `channel \`${channel.name}\``, "give one a distinct `webhook.secret`");
+		if (clash) return refuse(clash);
+	}
+	for (const role of layout.roles ?? []) {
+		if (!role.secret) continue;
+		const clash = claim(role.secret, `role \`${role.name}\``, "give one a distinct secret");
+		if (clash) return refuse(clash);
 	}
 	print(`Holocron notifications setup — ${notifications.providerName}${dryRun ? " (dry-run)" : ""}`);
 	const attempt = async (step, fn) => {
@@ -3537,10 +3557,11 @@ async function runNotificationsSetup(input) {
 	for (const role of layout.roles ?? []) await attempt(`role ${role.name}`, async () => {
 		if (!notifications.ensureRole) throw new Error(`\`${notifications.providerName}\` cannot manage roles`);
 		if (dryRun) {
-			print(`  … would ensure role ${role.name}`);
+			print(`  … would ensure role ${role.name}${role.secret ? ` and store its id in ${role.secret}` : ""}`);
 			report.roles.push({
 				name: role.name,
-				created: false
+				created: false,
+				...role.secret ? { secret: role.secret } : {}
 			});
 			return;
 		}
@@ -3555,6 +3576,12 @@ async function runNotificationsSetup(input) {
 		};
 		report.roles.push(outcome);
 		print(`  ${made.created ? "✓ created" : "· exists "} role ${role.name} (id ${made.id})`);
+		if (role.secret) {
+			await secrets.setSecret(scope, role.secret, made.id);
+			outcome.secret = role.secret;
+			outcome.stored = true;
+			print(`  ✓ stored the id of ${role.name} in ${role.secret}`);
+		}
 	});
 	if (report.failures.length > 0) {
 		report.status = "fail";