rcf-lite 0.21.0 → 0.22.0

package/src/blueprint/apply.js

@@ -393,7 +393,16 @@ export async function applyBlueprint({ projectRoot, tree, source, displaySource,
       appliedElicitations,
       allowNoAuthYet: allowNoAuthYet === true ? true : undefined,
       notes: allowNoAuthYet === true
-        ? `no auth yet: applied under --${blueprint.requiresAppliedCapabilities?.allowSkipFlag ?? 'allow-no-auth-yet'}; surfaces gated on ${(blueprint.requiresAppliedCapabilities?.capabilities ?? []).join(', ')} will refuse at runtime until an auth blueprint is applied.`
+        ? (function buildOverrideNote() {
+            const flag = blueprint.requiresAppliedCapabilities?.allowSkipFlag ?? 'allow-no-auth-yet';
+            const caps = (blueprint.requiresAppliedCapabilities?.capabilities ?? []).join(', ');
+            // Predecessor-family prose is derived from the flag name so
+            // the note reads sensibly for both the auth override ("auth
+            // blueprint") and the secrets override ("secrets-management
+            // blueprint") without the runner learning the family list.
+            const family = flag.includes('secrets') ? 'secrets-management' : 'auth';
+            return `no ${family} yet: applied under --${flag}; surfaces gated on ${caps} will refuse at runtime until a ${family} blueprint is applied.`;
+          })()
         : undefined,
     });
   }

package/src/blueprint/capabilities.js

@@ -112,10 +112,49 @@ export function buildRefusalMessage({ slug, refusalMessageId, requiredCapabiliti
       `       rcf define blueprint add ${slug} --${allowSkipFlag}`,
     ].join('\n');
   }
+  if (refusalMessageId === 'application-account-settings-bare-spa') {
+    return [
+      `${slug} requires at least one applied security-auth-* blueprint,`,
+      `or an operator override with --${allowSkipFlag}.`,
+      '',
+      'Applied blueprints on this project:',
+      appliedBlock,
+      '',
+      'Suggested next steps:',
+      '  1. Apply an auth blueprint first:',
+      '       rcf define blueprint add security-auth-magic-link',
+      '     (or security-auth-clerk, security-auth-oauth2, security-auth-keycloak)',
+      `  2. Override for a scaffolding pass (surfaces will refuse at apply until an`,
+      `     auth blueprint is applied):`,
+      `       rcf define blueprint add ${slug} --${allowSkipFlag}`,
+    ].join('\n');
+  }
+  if (refusalMessageId === 'object-storage-s3-no-secrets') {
+    return [
+      `[object-storage-s3-no-secrets] ${slug} requires an applied blueprint declaring`,
+      `at least one of: ${requiredCapabilities.join(', ')}.`,
+      `The shipped predecessor is security-secrets-management (v1.0.1+); the credential`,
+      `pair is a secretRef opaque string, never a value (infra round 5 spec 5.2, Baz`,
+      `decision 6).`,
+      '',
+      'Applied blueprints on this project:',
+      appliedBlock,
+      '',
+      'Suggested next steps:',
+      '  1. Apply security-secrets-management first:',
+      '       rcf define blueprint add security-secrets-management',
+      `  2. Or override for a scaffolding pass (records a note on source.notes so`,
+      `     later validation flags the surface as not-yet-activated):`,
+      `       rcf define blueprint add ${slug} --${allowSkipFlag}`,
+    ].join('\n');
+  }
   // Generic fallback. Names the required capabilities and applied set;
-  // the operator has enough to diagnose without a bespoke template.
+  // the operator has enough to diagnose without a bespoke template. The
+  // refusalMessageId is echoed on the first line as a stable dashboard-
+  // friendly tag downstream lint / dashboards can bind to.
+  const tag = refusalMessageId ? `[${refusalMessageId}] ` : '';
   return [
-    `${slug} requires an applied blueprint declaring at least one of:`,
+    `${tag}${slug} requires an applied blueprint declaring at least one of:`,
     `  ${requiredCapabilities.join(', ')}`,
     `or an operator override with --${allowSkipFlag}.`,
     '',

package/src/cli/blueprint.js

@@ -190,6 +190,12 @@ const OPTION_SPEC = {
   // repeatable; --answers <file> reads a JSON object mapping elicit
   // ids to values. Both feed the elicitation phase in applyBlueprint.
   'allow-no-auth-yet': { type: 'boolean' },
+  // Infra round 5 T-2 (spec 5.2, Baz decision 6): object-storage-s3
+  // declares allowSkipFlag "allow-no-secrets-yet" so the override for
+  // its requiresAppliedCapabilities gate stays semantically aligned
+  // with the credential-pair discipline the spec names, rather than
+  // reusing the auth-flavoured flag.
+  'allow-no-secrets-yet': { type: 'boolean' },
   answer: { type: 'string', multiple: true },
   answers: { type: 'string' },
 };
@@ -339,7 +345,8 @@ export async function main(argv, deps = {}) {
     const result = await applyBlueprint({
       projectRoot, tree, source,
       namespaceOverride: parsed.values.namespace,
-      allowNoAuthYet: parsed.values['allow-no-auth-yet'] === true,
+      allowNoAuthYet: parsed.values['allow-no-auth-yet'] === true
+        || parsed.values['allow-no-secrets-yet'] === true,
       elicitAnswers,
       customAuthReadLine,
       // Library-qualified resolves rewire the applied identity under