@wairon/cli 5.0.2-dev.8 → 5.0.2-dev.9

package/dist/index.js

@@ -785,6 +785,14 @@ var init_specs = __esm({
       // Required if type is 'call', references Method name on target interface
       capability: import_zod6.z.string().optional(),
       // Required if type is 'dispatch': the capability routed through the target Portal's dispatch table
+      /**
+       * call/dispatch only: the credential this step presents to an authed callee
+       * Portal, and WHERE it is loaded from (`from` — a secret-store component id,
+       * `env:API_KEY`, a config key, a vault ref, …). A declared DESIGN NOTE — wairon
+       * never fetches it — but its absence on a call into a Portal whose `auth ≠ none`
+       * warns (PORTAL_AUTH_UNMET), so credential loading is never overlooked.
+       */
+      auth: import_zod6.z.object({ from: import_zod6.z.string(), note: import_zod6.z.string().optional() }).optional(),
       assertsGuarantees: import_zod6.z.array(GuaranteeSchema).optional(),
       /**
        * Declared entity invariants this step upholds, as "<type-id>.<invariant-id>"
@@ -11546,6 +11554,44 @@ var init_lint_allows = __esm({
   }
 });
 
+// src/core/rules/portal-call-auth.ts
+var portalCallAuthRule;
+var init_portal_call_auth = __esm({
+  "src/core/rules/portal-call-auth.ts"() {
+    "use strict";
+    portalCallAuthRule = {
+      name: "portal-call-auth",
+      description: "An OUTBOUND narrative `call` into ANOTHER component's Portal whose auth is not `none` must declare the credential source it presents \u2014 the step's `auth.from`, a design note naming where the secret loads from (a secret-store component, env var, config key, vault ref). Its absence warns (PORTAL_AUTH_UNMET) so credential loading is never overlooked; the actual secret is never stored in the spec. Dispatch steps (a portal's OWN inbound routing) and self-calls are not cross-service calls and are excluded.",
+      codes: [
+        { code: "PORTAL_AUTH_UNMET", defaultSeverity: "warning", summary: "A narrative call into another component's authed Portal does not declare where its credential loads from" }
+      ],
+      check(ctx) {
+        for (const impl of ctx.implementations) {
+          const ownComponent = ctx.interfaceMap.get(impl.contract)?.component;
+          const draft = ctx.isImplementationDraft(impl);
+          for (const method of impl.methods ?? []) {
+            for (const step of method.narrative ?? []) {
+              if (step.type !== "call") continue;
+              if (!step.targetComponent || step.targetComponent === ownComponent) continue;
+              const target = ctx.componentMap.get(step.targetComponent);
+              if (!target || target.componentType !== "Portal") continue;
+              if (!target.auth || target.auth.scheme === "none") continue;
+              if (step.auth?.from) continue;
+              ctx.addIssue(
+                "warning",
+                "PORTAL_AUTH_UNMET",
+                `Narrative step ${step.stepNumber} of "${method.name}" in "${impl.id}" calls the authenticated portal "${target.id}" (auth scheme: ${target.auth.scheme}) but does not declare where its credential is loaded from. Add the credential source (the step's auth.from \u2014 a secret-store component, env var, config key, or vault ref), or drop the portal's auth if it needs none.`,
+                impl.id,
+                draft
+              );
+            }
+          }
+        }
+      }
+    };
+  }
+});
+
 // src/core/rules/index.ts
 function composeRuleSequence(extraRules = []) {
   const base = SDD_RULES.filter((r) => r !== lintAllowsRule);
@@ -11795,6 +11841,7 @@ var init_rules = __esm({
     init_hidden_state();
     init_dependency_conformance();
     init_lint_allows();
+    init_portal_call_auth();
     init_source_analysis();
     init_types();
     init_type_analysis();
@@ -11816,6 +11863,9 @@ var init_rules = __esm({
       narrativeAntipatternsRule,
       narrativeDetailRule,
       portalsRule,
+      // Cross-call auth: a narrative call into an authed Portal must name its
+      // credential source (rides with the portal family).
+      portalCallAuthRule,
       stereotypeDepsRule,
       patternsRule,
       // Facade shape rides with pattern ownership: same §7 doctrine, narrative side.
@@ -11878,6 +11928,7 @@ var init_rules = __esm({
       // L4 expectations: implementations and their code linkage.
       MISSING_IMPLEMENTATION_METHOD: "implementations",
       MISSING_SOURCE_PATH: "implementations",
+      PORTAL_AUTH_UNMET: "implementations",
       MISSING_SOURCE_FILE: "implementations",
       SOURCE_PATH_ESCAPES_ROOT: "implementations",
       UNREALIZED_METHOD: "implementations",
@@ -15574,7 +15625,7 @@ function defaultTargetConfig(type) {
     enabled: true
   };
 }
-var WAIRON_VERSION = "5.0.2-dev.8";
+var WAIRON_VERSION = "5.0.2-dev.9";
 var GITHUB_REPO = "SYW-Apps/Waffle-AIron";
 var ARCHITECT_AGENT_ID = "agent-architect";
 var ARCHITECT_TEMPLATE_ID = "architect";