@theholocron/cli 5.0.0-alpha.196 → 5.0.0-alpha.198

package/dist/cli.mjs

@@ -24,8 +24,8 @@ import search from "@inquirer/search";
 import { execFileSync, spawn, spawnSync } from "node:child_process";
 import ora from "ora";
 import { findRootSync, isWorkspaceRoot, walkFilesSync } from "@theholocron/fs-utils";
-import { createHash, randomBytes, randomUUID } from "node:crypto";
 import { access, copyFile, mkdir, readFile, readdir, rename, rm, stat, symlink, unlink, writeFile } from "node:fs/promises";
+import { createHash, randomBytes, randomUUID } from "node:crypto";
 import { stringifyJson } from "@theholocron/json-utils";
 import { generateReadme } from "@theholocron/components-doc/markdown";
 import { getClients, getConfigs, getDocs, getPlugins, getSkills, getThemes, getUtils } from "@theholocron/registry-doc";
@@ -2634,6 +2634,59 @@ function mk(capability, provider, status, message, logMessage) {
 	};
 }
 //#endregion
+//#region src/commands/notifications-channel-add/avatar.ts
+/**
+* Read a webhook avatar named in a layout: a file path (from the directory the CLI runs in) or an
+* `https://` URL. Returns it as a `data:` URI, which is how providers take an image.
+*
+* The type comes from the first bytes, not from the name or the response header, so what is sent is
+* the image it claims to be.
+*/
+/** Providers cap avatars well below this; it only keeps a wrong file from filling memory. */
+const MAX_AVATAR_BYTES = 8388608;
+const FETCH_TIMEOUT_MS$2 = 15e3;
+const SIGNATURES = [
+	["image/png", [
+		137,
+		80,
+		78,
+		71,
+		13,
+		10,
+		26,
+		10
+	]],
+	["image/jpeg", [
+		255,
+		216,
+		255
+	]],
+	["image/gif", [
+		71,
+		73,
+		70,
+		56
+	]]
+];
+const tooBig = () => /* @__PURE__ */ new Error(`it is larger than ${MAX_AVATAR_BYTES / 1024 / 1024} MB`);
+async function loadAvatar(source, baseDir = process.cwd(), fetchImpl = fetch) {
+	let bytes;
+	if (/^https:\/\//i.test(source)) {
+		const res = await fetchImpl(source, { signal: AbortSignal.timeout(FETCH_TIMEOUT_MS$2) });
+		if (!res.ok) throw new Error(`fetching it answered ${res.status}`);
+		if (Number(res.headers.get("content-length")) > 8388608) throw tooBig();
+		bytes = Buffer.from(await res.arrayBuffer());
+	} else {
+		const path = resolve(baseDir, source);
+		if ((await stat(path)).size > 8388608) throw tooBig();
+		bytes = await readFile(path);
+	}
+	if (bytes.length > 8388608) throw tooBig();
+	const type = SIGNATURES.find(([, sig]) => sig.every((b, i) => bytes[i] === b))?.[0];
+	if (!type) throw new Error("it is not a PNG, JPEG or GIF image, which are the formats providers accept");
+	return `data:${type};base64,${bytes.toString("base64")}`;
+}
+//#endregion
 //#region src/commands/notifications-channel-add/notifications-channel-add.ts
 /**
 * `holocron notifications channel add` — create one channel (and, with
@@ -2784,8 +2837,10 @@ async function provisionChannel(deps, spec) {
 	const hook = await notifications.ensureWebhook({
 		channel: spec.name,
 		name: webhookName,
-		...spec.category ? { category: spec.category } : {}
+		...spec.category ? { category: spec.category } : {},
+		...webhookCfg.avatar ? { avatar: webhookCfg.avatar } : {}
 	});
+	const avatarSet = hook.updated?.includes("avatar") ?? false;
 	if (hook.url) {
 		try {
 			await secrets.setSecret(scope, secretName, hook.url);
@@ -2798,7 +2853,8 @@ async function provisionChannel(deps, spec) {
 			name: webhookName,
 			created: hook.created,
 			secret: secretName,
-			stored: true
+			stored: true,
+			...avatarSet ? { updated: ["avatar"] } : {}
 		};
 	} else {
 		const note = `webhook ${webhookName} already exists and its URL cannot be read back — delete it in the provider and re-run, or set ${secretName} yourself`;
@@ -2808,9 +2864,15 @@ async function provisionChannel(deps, spec) {
 			created: hook.created,
 			secret: secretName,
 			stored: false,
-			note
+			note,
+			...avatarSet ? { updated: ["avatar"] } : {}
 		};
 	}
+	if (avatarSet) {
+		print(`  ${style.success(`set     avatar on webhook ${webhookName}`)}`);
+		if (tally) tally.ok++;
+	}
+	if (hook.avatarError) throw new Error(`webhook ${webhookName} is ready but setting its avatar failed (${hook.avatarError})`);
 	return outcome;
 }
 async function runNotificationsChannelAdd(input) {
@@ -2898,16 +2960,6 @@ async function runNotificationsChannelAdd(input) {
 */
 /** Features not built yet, in the order of the table in holocron#1098. Move an entry into a real check when it lands. */
 const PLANNED_CHECKS = [
-	{
-		step: 12,
-		id: "webhook-appearance",
-		title: "webhook names and avatars set"
-	},
-	{
-		step: 13,
-		id: "app-settings",
-		title: "bot description, tags, install link and URLs set"
-	},
 	{
 		step: 14,
 		id: "role-assignment",
@@ -2942,6 +2994,8 @@ const promptKey = (p) => JSON.stringify([
 const accessText = (v) => v === "everyone" ? "everyone" : v.length === 0 ? "nobody (bots and webhooks only)" : v.join(", ");
 const shown = (s) => sanitizeDetail(s);
 const WELCOME_TITLE = "welcome screen and onboarding set";
+const APP_TITLE = "bot description, tags, install link and URLs set";
+const AVATAR_TITLE = "webhook names and avatars set";
 const SERVER_TITLE = "server verification, notifications and community set";
 const ACCESS_TITLE = "channel and category access set";
 const ROLE_APPEARANCE_TITLE = "role colour, hoist and permissions set";
@@ -3060,11 +3114,13 @@ async function runDoctorNotifications(input) {
 			["categories", "categories exist"],
 			["channels", "channels in their category, with topics"],
 			["webhooks", "webhooks on their channels"],
+			["webhook-appearance", AVATAR_TITLE],
 			["roles", "roles exist and are mentionable"],
 			["role-appearance", ROLE_APPEARANCE_TITLE],
 			["access", ACCESS_TITLE],
 			["server-settings", SERVER_TITLE],
-			["welcome-onboarding", WELCOME_TITLE]
+			["welcome-onboarding", WELCOME_TITLE],
+			["app-settings", APP_TITLE]
 		]) failed(id, title, "not checked: could not read the server");
 	} else {
 		const inspected = found;
@@ -3095,6 +3151,17 @@ async function runDoctorNotifications(input) {
 			else if (!match.webhooks.some((w) => same(w, name))) webhookProblems.push(`#${shown(channel.name)}: no webhook named ${shown(name)}`);
 		}
 		add("webhooks", "webhooks on their channels", webhookProblems, withWebhook.length === 0 ? "none declared" : `${withWebhook.length} of ${withWebhook.length} exist`);
+		const avatarOf = (webhook) => (typeof webhook === "object" && webhook ? webhook.avatar : void 0) ?? layout.webhookAvatar;
+		const wantAvatar = declaredChannels.filter(({ channel }) => channel.webhook && avatarOf(channel.webhook));
+		const avatarProblems = [];
+		for (const { cat, channel } of wantAvatar) {
+			const name = (channel.webhook === true ? {} : channel.webhook).name ?? channel.name;
+			const { match } = pick(channel.name, cat);
+			if (!match) avatarProblems.push(`#${shown(channel.name)}: no channel to hold the webhook`);
+			else if (match.webhooksError) avatarProblems.push(`#${shown(channel.name)}: could not list its webhooks (${shown(match.webhooksError)})`);
+			else if (match.webhookAvatars && !match.webhookAvatars.some((w) => same(w, name))) avatarProblems.push(`#${shown(channel.name)}: webhook ${shown(name)} has no avatar`);
+		}
+		add("webhook-appearance", AVATAR_TITLE, avatarProblems, wantAvatar.length === 0 ? "none declared" : `${wantAvatar.length} of ${wantAvatar.length} set`);
 		const roles = layout.roles ?? [];
 		const roleProblems = [];
 		if (inspected.rolesError) roleProblems.push(`could not read the roles (${shown(inspected.rolesError)})`);
@@ -3128,8 +3195,21 @@ async function runDoctorNotifications(input) {
 				}
 			}
 		}
-		const styled = roles.filter((r) => r.color !== void 0 || r.hoist !== void 0 || r.permissions !== void 0);
-		add("role-appearance", ROLE_APPEARANCE_TITLE, inspected.rolesError ? [`not checked: could not read the roles`] : appearance, styled.length === 0 ? "none declared" : `${styled.length} of ${styled.length} as declared`);
+		const everyone = layout.everyone;
+		const everyoneProblems = [];
+		if (everyone) {
+			if (inspected.everyoneError) everyoneProblems.push(`@everyone: not checked, could not read its permissions (${shown(inspected.everyoneError)})`);
+			else if (!inspected.everyone) everyoneProblems.push("@everyone: the provider did not report its permissions");
+			else {
+				const have = new Set(inspected.everyone.permissions.map((n) => n.toLowerCase()));
+				const lacking = (everyone.allow ?? []).filter((n) => !have.has(n.toLowerCase()));
+				const keeping = (everyone.deny ?? []).filter((n) => have.has(n.toLowerCase()));
+				if (lacking.length > 0) everyoneProblems.push(`@everyone: missing permissions ${lacking.map(shown).join(", ")}`);
+				if (keeping.length > 0) everyoneProblems.push(`@everyone: still has permissions the layout takes away: ${keeping.map(shown).join(", ")}`);
+			}
+		}
+		const styledCount = roles.filter((r) => r.color !== void 0 || r.hoist !== void 0 || r.permissions !== void 0).length + (everyone ? 1 : 0);
+		add("role-appearance", ROLE_APPEARANCE_TITLE, inspected.rolesError ? [`not checked: could not read the roles`, ...everyoneProblems] : [...appearance, ...everyoneProblems], styledCount === 0 ? "none declared" : `${styledCount} of ${styledCount} as declared`);
 		const accessProblems = [];
 		const compare = (label, want, have) => {
 			if (!have) {
@@ -3246,6 +3326,35 @@ async function runDoctorNotifications(input) {
 		}
 		const welcomeParts = (wantWelcome ? 1 : 0) + (wantOnboarding ? 1 : 0);
 		add("welcome-onboarding", WELCOME_TITLE, [...welcomeProblems, ...onboardingProblems], welcomeParts === 0 ? "none declared" : `${welcomeParts} of ${welcomeParts} as declared`);
+		const wantApp = layout.application;
+		const appProblems = [];
+		if (wantApp) {
+			if (inspected.applicationError) appProblems.push(`not checked: could not read the application (${shown(inspected.applicationError)})`);
+			else if (!inspected.application) appProblems.push("the provider did not report the application");
+			else {
+				const have = inspected.application;
+				const set = (list) => JSON.stringify([...new Set(list.map((n) => n.toLowerCase()))].sort());
+				const exact = (list) => JSON.stringify([...new Set(list)].sort());
+				if (wantApp.description !== void 0 && (have.description ?? "") !== wantApp.description) appProblems.push("description differs from the layout");
+				if (wantApp.tags !== void 0 && set(have.tags ?? []) !== set(wantApp.tags)) appProblems.push(`tags are ${(have.tags ?? []).map(shown).join(", ") || "none"} but the layout says ${wantApp.tags.map(shown).join(", ") || "none"}`);
+				if (wantApp.install !== void 0) {
+					if (!have.install) appProblems.push("no install link is set");
+					else {
+						if (exact(have.install.scopes) !== exact(wantApp.install.scopes)) appProblems.push(`install scopes are ${have.install.scopes.map(shown).join(", ")} but the layout says ${wantApp.install.scopes.map(shown).join(", ")}`);
+						if (set(have.install.permissions) !== set(wantApp.install.permissions)) appProblems.push("install permissions differ from the layout");
+					}
+				}
+				for (const [field, label] of [
+					["termsUrl", "terms URL"],
+					["privacyUrl", "privacy URL"],
+					["roleConnectionsUrl", "role-connections URL"]
+				]) {
+					const wanted = wantApp[field];
+					if (wanted !== void 0 && (have[field] ?? "") !== wanted) appProblems.push(`${label} is ${shown(have[field] || "not set")} but the layout says ${shown(wanted)}`);
+				}
+			}
+		}
+		add("app-settings", APP_TITLE, appProblems, wantApp ? "1 of 1 as declared" : "none declared");
 	}
 	const wanted = [...declaredChannels.filter(({ channel }) => channel.webhook).map(({ channel }) => channel.webhook !== true && channel.webhook && channel.webhook.secret ? channel.webhook.secret : defaultSecretName(channel.name)), ...(layout.roles ?? []).flatMap((r) => r.secret ? [r.secret] : [])];
 	if (wanted.length === 0) checks.push({
@@ -3907,6 +4016,10 @@ async function runNew(input) {
 * shared preset would apply it from every repo.
 */
 /** A channel's access: its category's, with any field the channel states itself laid over it. */
+/** The picture a channel's webhook should have: its own, else the layout's, else none. */
+function webhookAvatarOf(layout, webhook) {
+	return (typeof webhook === "object" ? webhook.avatar : void 0) ?? layout.webhookAvatar;
+}
 function effectiveAccess(category, channel) {
 	if (!category && !channel) return void 0;
 	return {
@@ -3958,6 +4071,9 @@ function serverLayoutProblem(layout) {
 		if (count === 0) return `${where} names the channel \`${name}\`, which is not in the layout's channels`;
 		if (count > 1) return `${where} names \`${name}\`, but more than one channel in the layout has that name`;
 	};
+	const everyone = layout.everyone;
+	const both = (everyone?.allow ?? []).find((p) => (everyone?.deny ?? []).some((d) => d.toLowerCase() === p.toLowerCase()));
+	if (both !== void 0) return `everyone: \`${both}\` is in both \`allow\` and \`deny\``;
 	const server = layout.server;
 	if (server) {
 		for (const field of [
@@ -4034,6 +4150,17 @@ async function runNotificationsSetup(input) {
 		name: org
 	} : void 0);
 	if (wantsSecrets && !scope && !dryRun) return refuse("no org to store secrets under — pass --scope or set `org` in holocron.config.ts");
+	const avatars = /* @__PURE__ */ new Map();
+	const read = input.loadAvatar ?? loadAvatar;
+	for (const channel of (layout.categories ?? []).flatMap((c) => c.channels ?? [])) {
+		const source = channel.webhook ? webhookAvatarOf(layout, channel.webhook) : void 0;
+		if (source === void 0 || avatars.has(source)) continue;
+		try {
+			avatars.set(source, await read(source));
+		} catch (err) {
+			return refuse(`webhook avatar \`${source}\`: ${errorMessage(err)}`);
+		}
+	}
 	if (secrets && scope && !dryRun) try {
 		await assertSecretsReachable(secrets, scope);
 	} catch (err) {
@@ -4048,6 +4175,8 @@ async function runNotificationsSetup(input) {
 	if (layout.server && !notifications.ensureServer) return refuse(`the layout declares \`server\` settings, but the \`${notifications.providerName}\` provider cannot manage them`);
 	if (layout.welcome && !notifications.ensureWelcome) return refuse(`the layout declares a \`welcome\` screen, but the \`${notifications.providerName}\` provider cannot manage one`);
 	if (layout.onboarding && !notifications.ensureOnboarding) return refuse(`the layout declares \`onboarding\`, but the \`${notifications.providerName}\` provider cannot manage it`);
+	if (layout.application && !notifications.ensureApplication) return refuse(`the layout declares \`application\` settings, but the \`${notifications.providerName}\` provider cannot manage them`);
+	if (layout.everyone && !notifications.ensureEveryone) return refuse(`the layout declares \`everyone\` permissions, but the \`${notifications.providerName}\` provider cannot manage them`);
 	const needsCategories = (layout.categories ?? []).find((c) => c.access);
 	if (needsCategories && !notifications.ensureCategory) return refuse(`category \`${needsCategories.name}\` declares \`access\`, but the \`${notifications.providerName}\` provider cannot manage categories`);
 	const providerProblem = notifications.validateLayout?.(layout);
@@ -4139,6 +4268,11 @@ async function runNotificationsSetup(input) {
 			continue;
 		}
 		for (const channel of channels) await attempt(`channel ${channel.name}`, async () => {
+			const source = channel.webhook ? webhookAvatarOf(layout, channel.webhook) : void 0;
+			const webhook = channel.webhook ? {
+				...channel.webhook === true ? {} : channel.webhook,
+				...source ? { avatar: avatars.get(source) } : {}
+			} : void 0;
 			const outcome = await provisionChannel({
 				notifications,
 				...secrets ? { secrets } : {},
@@ -4151,7 +4285,7 @@ async function runNotificationsSetup(input) {
 				category: category.name,
 				...channel.topic ? { topic: channel.topic } : {},
 				...effectiveAccess(category.access, channel.access) ? { access: effectiveAccess(category.access, channel.access) } : {},
-				...channel.webhook ? { webhook: channel.webhook === true ? {} : channel.webhook } : {}
+				...webhook ? { webhook } : {}
 			});
 			report.channels.push(outcome);
 			if (outcome.webhook && !outcome.webhook.stored) report.failures.push({
@@ -4160,7 +4294,7 @@ async function runNotificationsSetup(input) {
 			});
 		});
 	}
-	if (layout.server || layout.welcome || layout.onboarding) {
+	if (layout.server || layout.welcome || layout.onboarding || layout.application || layout.everyone) {
 		print(`\n${style.header("Server")}`);
 		const apply = async (label, declared, run) => {
 			if (!declared) return;
@@ -4176,9 +4310,11 @@ async function runNotificationsSetup(input) {
 				made(changed);
 			});
 		};
+		await apply("@everyone permissions", !!layout.everyone, () => notifications.ensureEveryone(layout.everyone));
 		await apply("server settings", !!layout.server, () => notifications.ensureServer(layout.server));
 		await apply("welcome screen", !!layout.welcome, () => notifications.ensureWelcome(layout.welcome));
 		await apply("onboarding", !!layout.onboarding, () => notifications.ensureOnboarding(layout.onboarding));
+		await apply("bot application", !!layout.application, () => notifications.ensureApplication(layout.application));
 	}
 	if (report.failures.length > 0) report.status = "fail";
 	else if (dryRun) report.status = "dry-run";