@ashlr/stack-core 0.1.1 → 0.2.2

package/src/__tests__/recommend-apply-e2e.test.ts

@@ -7,7 +7,7 @@
  *     → recipeFromRetrieval(...)
  *     → writeRecipe(..., cwd)                  // creates .stack/recipes/<id>.toml
  *     → readRecipe(id, cwd)                    // round-trips through TOML
- *     → wirePhantomForRecipe(recipe, { cwd })  // fills the fake Phantom vault
+ *     → wirePhantomForRecipe(recipe, { cwd })  // reads the fake Phantom vault
  *
  * Calling the real provider CLIs (`stack add <provider>`) is out of scope:
  * those make live HTTPS/OAuth calls. This test stops at the phantom-wire
@@ -19,7 +19,7 @@
  */
 
 import { afterEach, beforeEach, describe, expect, it } from "bun:test";
-import { existsSync, mkdtempSync, readFileSync, rmSync } from "node:fs";
+import { existsSync, mkdtempSync, readFileSync, rmSync, writeFileSync } from "node:fs";
 import { tmpdir } from "node:os";
 import { join } from "node:path";
 import { retrieve } from "../ai/catalog-index.ts";
@@ -82,41 +82,28 @@ describe("recommend → apply e2e", () => {
     expect(loaded.id).toBe(recipe.id);
     expect(loaded.providers.map((p) => p.name)).toEqual(["neon", "openai", "anthropic"]);
 
-    // 4) Wire envelopes via the fake Phantom CLI.
+    // 4) Check the vault via the fake Phantom CLI. `stack add` (skipped here,
+    // it needs OAuth) already stored NEON_API_KEY; the AI keys are missing.
+    writeFileSync(harness.vaultPath, JSON.stringify({ NEON_API_KEY: "neon_real" }));
     const result = await wirePhantomForRecipe(loaded, { cwd: projectDir });
 
-    // Every provider's declared catalog secrets must be envelope-added.
-    // (neon / openai / anthropic are all api_key providers with known secrets.)
-    expect(result.envelopes).toEqual(
-      expect.arrayContaining([
-        "neon:NEON_API_KEY",
-        "openai:OPENAI_API_KEY",
-        "anthropic:ANTHROPIC_API_KEY",
-      ]),
+    expect(result.present).toEqual(["neon:NEON_API_KEY"]);
+    expect(result.missing).toEqual(
+      expect.arrayContaining(["openai:OPENAI_API_KEY", "anthropic:ANTHROPIC_API_KEY"]),
     );
     expect(result.skipped).toEqual([]);
 
     // No webhook stubs for these providers — none are in the webhook-capable set.
     expect(result.webhooks).toEqual([]);
 
-    // 5) Inspect the fake Phantom call log — every secret should have been
-    // shelled out as `phantom add <KEY> <placeholder>`.
-    const adds = harness.callsTo("add");
-    const addedKeys = adds.flatMap((c) => c.args);
-    expect(addedKeys).toContain("NEON_API_KEY");
-    expect(addedKeys).toContain("OPENAI_API_KEY");
-    expect(addedKeys).toContain("ANTHROPIC_API_KEY");
-
-    // The placeholder is intentional — `stack add <provider>` would replace it
-    // with the real secret. Stopping here is the "noWire: false but no OAuth"
-    // boundary: the vault now holds placeholders, not real credentials.
+    // 5) Apply only reads names from Phantom; it never writes placeholders
+    // (Phantom refuses secret values in argv) and leaves the vault untouched.
+    expect(harness.callsTo("add")).toEqual([]);
     const vault = JSON.parse(readFileSync(harness.vaultPath, "utf-8")) as Record<string, string>;
-    expect(Object.keys(vault)).toEqual(
-      expect.arrayContaining(["NEON_API_KEY", "OPENAI_API_KEY", "ANTHROPIC_API_KEY"]),
-    );
+    expect(vault).toEqual({ NEON_API_KEY: "neon_real" });
   });
 
-  it("noWire: true performs zero phantom envelope calls and writes no webhook stubs", async () => {
+  it("noWire: true performs zero phantom vault calls and writes no webhook stubs", async () => {
     // Use stripe so we can also prove the webhook stub is skipped — stripe is
     // in WEBHOOK_PROVIDERS, so it would otherwise drop a stub file.
     const recipe: Recipe = {
@@ -132,7 +119,7 @@ describe("recommend → apply e2e", () => {
       cwd: projectDir,
       noWire: true,
     });
-    expect(result).toEqual({ envelopes: [], webhooks: [], skipped: [] });
+    expect(result).toEqual({ present: [], missing: [], webhooks: [], skipped: [] });
 
     // Zero phantom calls for recipe secrets.
     expect(harness.callsTo("add")).toEqual([]);

package/src/__tests__/registry.test.ts

@@ -20,12 +20,12 @@ describe("cross-project registry", () => {
   });
 
   afterEach(() => {
-    if (previousDir === undefined) delete process.env.STACK_REGISTRY_DIR;
+    if (previousDir === undefined) Reflect.deleteProperty(process.env, "STACK_REGISTRY_DIR");
     else process.env.STACK_REGISTRY_DIR = previousDir;
   });
 
   test("registryPath honors STACK_REGISTRY_DIR override", () => {
-    expect(registryPath().startsWith(process.env.STACK_REGISTRY_DIR!)).toBe(true);
+    expect(registryPath().startsWith(process.env.STACK_REGISTRY_DIR ?? "")).toBe(true);
   });
 
   test("writeConfig auto-registers the cwd", async () => {
@@ -66,6 +66,15 @@ describe("cross-project registry", () => {
     expect((await listProjects()).length).toBe(0);
   });
 
+  test("unregisterProject reports whether anything was removed", async () => {
+    const cwd = mkdtempSync(join(tmpdir(), "stack-unreg-bool-"));
+    await writeConfig(emptyConfig(), cwd);
+    expect(await unregisterProject(join(cwd, "not-registered"))).toBe(false);
+    expect((await listProjects()).length).toBe(1);
+    expect(await unregisterProject(cwd)).toBe(true);
+    expect(await unregisterProject(cwd)).toBe(false);
+  });
+
   test("listProjects prunes entries whose .stack.toml was deleted", async () => {
     const cwd = mkdtempSync(join(tmpdir(), "stack-prune-"));
     await writeConfig(emptyConfig(), cwd);

package/src/__tests__/release-artifacts.test.ts

@@ -0,0 +1,55 @@
+import { describe, expect, test } from "bun:test";
+import { readFileSync } from "node:fs";
+import { join } from "node:path";
+import { listProviderNames } from "../providers/index.ts";
+
+/**
+ * What users install: the npm tarballs for the CLI and MCP server, and the
+ * one-line installers (scripts/ plus the copies the site serves).
+ */
+
+const repoRoot = join(import.meta.dir, "..", "..", "..", "..");
+const read = (path: string) => readFileSync(join(repoRoot, path), "utf8");
+
+describe("npm tarballs ship their bins", () => {
+  // `npm pack` runs prepack but not prepublishOnly, so a build hooked only to
+  // prepublishOnly packs a tarball with no dist/ and a global install of it has
+  // no bin. `npm publish` runs prepack as well.
+  for (const [dir, bin, entry] of [
+    ["packages/cli", "stack", "dist/index.js"],
+    ["packages/mcp", "ashlr-stack-mcp", "dist/server.js"],
+  ] as const) {
+    test(`${dir} builds ${entry} in prepack`, () => {
+      const pkg = JSON.parse(read(`${dir}/package.json`));
+      expect(pkg.bin).toEqual({ [bin]: `./${entry}` });
+      expect(pkg.scripts.prepack).toBe("bun run build");
+      expect(pkg.scripts.prepublishOnly).toBeUndefined();
+      expect(pkg.scripts.build).toContain(`const f='${entry}'`);
+      expect(pkg.files).toContain("dist/**/*");
+    });
+  }
+});
+
+describe("one-line installers", () => {
+  for (const name of ["install.sh", "install.ps1"]) {
+    test(`the site serves the same ${name} as scripts/`, () => {
+      expect(read(`packages/site/public/${name}`)).toBe(read(`scripts/${name}`));
+    });
+
+    test(`${name} states the real provider count`, () => {
+      const counts = [...read(`scripts/${name}`).matchAll(/the (\d+) curated providers/g)].map(
+        (m) => Number(m[1]),
+      );
+      expect(counts.length).toBeGreaterThan(0);
+      for (const count of counts) expect(count).toBe(listProviderNames().length);
+    });
+  }
+
+  test("install.sh tells binary-path users how to get the MCP server", () => {
+    const sh = read("scripts/install.sh");
+    const binaryBranch = sh.slice(sh.indexOf("if install_via_binary; then"));
+    expect(binaryBranch.slice(0, binaryBranch.indexOf("elif"))).toContain(
+      "npm i -g ashlr-stack-mcp",
+    );
+  });
+});

package/src/__tests__/secret-redaction.test.ts

@@ -1,8 +1,8 @@
 import { afterEach, beforeEach, describe, expect, test } from "bun:test";
+import { StackError } from "../errors.ts";
+import { makeApiKeyProvider } from "../providers/_api-key.ts";
 import type { LogEvent } from "../providers/_base.ts";
 import { scrub } from "../providers/_helpers.ts";
-import { makeApiKeyProvider } from "../providers/_api-key.ts";
-import { StackError } from "../errors.ts";
 import { type Harness, setupFakePhantom } from "./_harness.ts";
 
 /**
@@ -38,7 +38,8 @@ describe("api-key provider login — invalid cached token warning", () => {
 
   beforeEach(() => {
     // Seed the vault so the provider's login() finds a cached token to reject.
-    h = setupFakePhantom({ TEST_PROVIDER_KEY: RAW_TOKEN });
+    // Legacy headless reveal: real Phantom 0.7.9 never lets Stack read it back.
+    h = setupFakePhantom({ TEST_PROVIDER_KEY: RAW_TOKEN }, { legacyHeadlessReveal: true });
     realFetch = globalThis.fetch;
   });
 
@@ -75,8 +76,7 @@ describe("api-key provider login — invalid cached token warning", () => {
     const warn = logs.find((l) => l.level === "warn");
     expect(warn).toBeDefined();
     // The raw token must not appear anywhere in the message or data payload.
-    const full =
-      (warn?.msg ?? "") + " " + JSON.stringify(warn?.data ?? {});
+    const full = `${warn?.msg ?? ""} ${JSON.stringify(warn?.data ?? {})}`;
     expect(full).not.toContain(RAW_TOKEN);
     // And the tail of the token (last 6 chars) must not leak either — the
     // current _api-key warn doesn't reference the token at all, so belt + suspenders.
@@ -92,7 +92,7 @@ describe("phantom error formatting — regression guard for formatArgsForError",
    * exercise the error path.
    */
   function setupAlwaysFailingPhantom(): { cleanup(): void } {
-    const { chmodSync, mkdtempSync, rmSync, writeFileSync } = require("node:fs") as typeof import("node:fs");
+    const { chmodSync, mkdtempSync, rmSync, writeFileSync } = require("node:fs") as typeof import("node:fs"); // biome-ignore format: Bun parser rejects split typeof import()
     const { tmpdir } = require("node:os") as typeof import("node:os");
     const { join } = require("node:path") as typeof import("node:path");
     const { __resetPhantomCache } = require("../phantom.ts") as typeof import("../phantom.ts");
@@ -138,11 +138,11 @@ esac
       }
       expect(caught).toBeDefined();
       // The canonical guarantee: the raw value NEVER appears in the error.
-      expect(caught!.message).not.toContain(SECRET);
+      expect(caught?.message).not.toContain(SECRET);
       // The key name is safe to show — it's the vault slot, not the value.
-      expect(caught!.message).toContain("LEAKY_KEY");
+      expect(caught?.message).toContain("LEAKY_KEY");
       // And the redaction sentinel should be present.
-      expect(caught!.message).toContain("<redacted>");
+      expect(caught?.message).toContain("<redacted>");
     } finally {
       h.cleanup();
     }
@@ -162,7 +162,7 @@ esac
       // Reveal's second arg is a key name, not a secret value — it's fine
       // for it to appear in error output. The point is that `add`'s third arg
       // is redacted, and reveal's isn't wrongly redacted into uselessness.
-      expect(caught!.message).toContain("SOME_KEY");
+      expect(caught?.message).toContain("SOME_KEY");
     } finally {
       h.cleanup();
     }

package/src/__tests__/security.test.ts

@@ -1,5 +1,5 @@
 import { afterEach, beforeEach, describe, expect, test } from "bun:test";
-import { addSecret, exec, revealSecret } from "../phantom.ts";
+import { addSecret, exec } from "../phantom.ts";
 import { type Harness, readVault, setupFakePhantom } from "./_harness.ts";
 
 /**
@@ -37,8 +37,8 @@ esac
       caught = err as Error;
     }
     expect(caught).toBeDefined();
-    expect(caught!.message).not.toContain("super-secret-value-XYZ123");
-    expect(caught!.message).toContain("<redacted>");
+    expect(caught?.message).not.toContain("super-secret-value-XYZ123");
+    expect(caught?.message).toContain("<redacted>");
   });
 });
 
@@ -52,19 +52,18 @@ describe("security — fake phantom harness handles hostile secret values", () =
   test("a secret containing single quotes does not break the harness", async () => {
     const hostile = `value-with-'-quote-and-\"-and-$VAR-and-\\backslash`;
     await addSecret("HOSTILE_KEY", hostile);
-    const revealed = await revealSecret("HOSTILE_KEY");
-    expect(revealed).toBe(hostile);
     const vault = await readVault(h.dir);
     expect(vault.HOSTILE_KEY).toBe(hostile);
   });
 
-  test("a secret containing a newline survives round-trip", async () => {
+  test("a secret containing a newline is refused before any Phantom call", async () => {
     const hostile = "first-line\n-second-line";
-    await addSecret("MULTILINE_KEY", hostile);
-    // revealSecret trims trailing whitespace via stdout.trim() — that's fine,
-    // but round-tripping the full value via the vault file should preserve it.
+    await expect(addSecret("MULTILINE_KEY", hostile)).rejects.toMatchObject({
+      code: "PHANTOM_SECRET_VALUE_UNSUPPORTED",
+    });
     const vault = await readVault(h.dir);
-    expect(vault.MULTILINE_KEY).toBe(hostile);
+    expect(vault.MULTILINE_KEY).toBeUndefined();
+    expect(h.calls()).toEqual([]);
   });
 
   test("a secret that looks like a Python expression is stored literally", async () => {

package/src/__tests__/supabase-provider.test.ts

@@ -1,6 +1,6 @@
 import { afterEach, beforeEach, describe, expect, test } from "bun:test";
-import supabase from "../providers/supabase.ts";
 import type { ProviderContext } from "../providers/_base.ts";
+import supabase from "../providers/supabase.ts";
 import { type Harness, readVault, setupFakePhantom } from "./_harness.ts";
 
 /**
@@ -13,9 +13,11 @@ describe("supabase provider (mocked fetch)", () => {
   let realFetch: typeof fetch;
 
   beforeEach(() => {
-    h = setupFakePhantom({
-      STACK_SUPABASE_ACCESS_TOKEN: "sbp_cached_valid_token",
-    });
+    // Provider logic after a token is read; real Phantom 0.7.9 refuses headless reveal.
+    h = setupFakePhantom(
+      { STACK_SUPABASE_ACCESS_TOKEN: "sbp_cached_valid_token" },
+      { legacyHeadlessReveal: true },
+    );
     realFetch = globalThis.fetch;
   });
 

package/src/__tests__/swap.test.ts

@@ -0,0 +1,114 @@
+import { describe, expect, it } from "bun:test";
+import { SWAP_PAIRS, findSwap, suggestSwaps } from "../swap.ts";
+
+describe("findSwap", () => {
+  it("finds a registered pair", () => {
+    const pair = findSwap("clerk", "auth0");
+    expect(pair).toBeDefined();
+    expect(pair?.from).toBe("clerk");
+    expect(pair?.to).toBe("auth0");
+  });
+
+  it("finds the reverse direction", () => {
+    const pair = findSwap("auth0", "clerk");
+    expect(pair).toBeDefined();
+    expect(pair?.from).toBe("auth0");
+    expect(pair?.to).toBe("clerk");
+  });
+
+  it("returns undefined for an unknown pair", () => {
+    expect(findSwap("clerk", "stripe")).toBeUndefined();
+    expect(findSwap("openai", "anthropic")).toBeUndefined();
+  });
+
+  it("finds supabase → neon with DATABASE_URL alias", () => {
+    const pair = findSwap("supabase", "neon");
+    expect(pair).toBeDefined();
+    expect(pair?.aliases).toBeDefined();
+    expect(pair?.aliases?.DATABASE_URL).toBe("SUPABASE_URL");
+  });
+
+  it("finds neon → supabase", () => {
+    const pair = findSwap("neon", "supabase");
+    expect(pair).toBeDefined();
+  });
+
+  it("finds all email provider pairs both ways", () => {
+    const emailProviders = ["resend", "sendgrid", "mailgun", "postmark"];
+    for (const a of emailProviders) {
+      for (const b of emailProviders) {
+        if (a === b) continue;
+        const pair = findSwap(a, b);
+        expect(pair).toBeDefined();
+      }
+    }
+  });
+
+  it("finds all analytics provider pairs both ways", () => {
+    const analytics = ["posthog", "mixpanel", "plausible"];
+    for (const a of analytics) {
+      for (const b of analytics) {
+        if (a === b) continue;
+        expect(findSwap(a, b)).toBeDefined();
+      }
+    }
+  });
+
+  it("finds datadog ↔ grafana", () => {
+    expect(findSwap("datadog", "grafana")).toBeDefined();
+    expect(findSwap("grafana", "datadog")).toBeDefined();
+  });
+
+  it("finds all deploy provider pairs", () => {
+    const deploy = ["vercel", "railway", "fly", "render"];
+    for (const a of deploy) {
+      for (const b of deploy) {
+        if (a === b) continue;
+        expect(findSwap(a, b)).toBeDefined();
+      }
+    }
+  });
+});
+
+describe("suggestSwaps", () => {
+  it("returns auth category peers for clerk", () => {
+    const suggestions = suggestSwaps("clerk");
+    expect(suggestions).toContain("auth0");
+    expect(suggestions).toContain("workos");
+    expect(suggestions.length).toBeGreaterThanOrEqual(2);
+  });
+
+  it("returns email peers for resend", () => {
+    const suggestions = suggestSwaps("resend");
+    expect(suggestions).toContain("sendgrid");
+    expect(suggestions).toContain("mailgun");
+    expect(suggestions).toContain("postmark");
+  });
+
+  it("returns empty array for a provider with no swaps", () => {
+    expect(suggestSwaps("stripe")).toEqual([]);
+    expect(suggestSwaps("github")).toEqual([]);
+  });
+
+  it("returns deploy peers for vercel", () => {
+    const suggestions = suggestSwaps("vercel");
+    expect(suggestions).toContain("railway");
+    expect(suggestions).toContain("fly");
+    expect(suggestions).toContain("render");
+  });
+});
+
+describe("SWAP_PAIRS", () => {
+  it("contains no duplicate from/to combinations", () => {
+    const seen = new Set<string>();
+    for (const pair of SWAP_PAIRS) {
+      const key = `${pair.from}→${pair.to}`;
+      expect(seen.has(key)).toBe(false);
+      seen.add(key);
+    }
+  });
+
+  it("has at least 30 pairs covering all categories", () => {
+    expect(SWAP_PAIRS.length).toBeGreaterThanOrEqual(30);
+  });
+});