@ashlr/stack-core 0.1.1 → 0.2.2

package/src/__tests__/catalog-index.test.ts

@@ -1,9 +1,5 @@
 import { afterEach, describe, expect, it } from "bun:test";
-import {
-  __resetIndex,
-  retrieve,
-  retrieveByCategory,
-} from "../ai/catalog-index.ts";
+import { __resetIndex, retrieve, retrieveByCategory } from "../ai/catalog-index.ts";
 
 /**
  * Golden retrieval tests. Each query must surface the right provider(s) in
@@ -63,13 +59,12 @@ describe("catalog-index.retrieve", () => {
   });
 
   it("composes a B2B SaaS recipe across categories", () => {
-    const hits = names(retrieve(
-      "B2B SaaS with auth and payments and AI and error tracking",
-      { k: 8 },
-    ));
+    const hits = names(
+      retrieve("B2B SaaS with auth and payments and AI and error tracking", { k: 8 }),
+    );
     // Expect at least one provider from each intended category.
-    expect(hits).toContain("stripe");        // Payments
-    expect(hits).toContain("sentry");        // Errors
+    expect(hits).toContain("stripe"); // Payments
+    expect(hits).toContain("sentry"); // Errors
     // One of the auth providers
     expect(hits.some((n) => ["clerk", "supabase"].includes(n))).toBe(true);
     // One of the AI providers
@@ -77,12 +72,14 @@ describe("catalog-index.retrieve", () => {
   });
 
   it("respects category filter", () => {
-    const hits = names(retrieve("edge compute", {
-      k: 5,
-      categories: ["Deploy"],
-    }));
+    const hits = names(
+      retrieve("edge compute", {
+        k: 5,
+        categories: ["Deploy"],
+      }),
+    );
     for (const n of hits) {
-      const cat = ["vercel", "railway", "fly", "cloudflare", "render"].includes(n);
+      const cat = ["vercel", "railway", "fly", "cloudflare", "render", "modal"].includes(n);
       expect(cat).toBe(true);
     }
   });
@@ -93,10 +90,7 @@ describe("catalog-index.retrieve", () => {
   });
 
   it("retrieveByCategory buckets results", () => {
-    const grouped = retrieveByCategory(
-      "B2B SaaS with auth and payments and AI",
-      { k: 20 },
-    );
+    const grouped = retrieveByCategory("B2B SaaS with auth and payments and AI", { k: 20 });
     expect(Object.keys(grouped).length).toBeGreaterThan(1);
     expect(grouped.Payments?.[0]?.provider.name).toBe("stripe");
   });

package/src/__tests__/cloudflare-provider.test.ts

@@ -1,6 +1,6 @@
 import { afterEach, beforeEach, describe, expect, test } from "bun:test";
-import cloudflare from "../providers/cloudflare.ts";
 import type { ProviderContext } from "../providers/_base.ts";
+import cloudflare from "../providers/cloudflare.ts";
 import { type Harness, readVault, setupFakePhantom } from "./_harness.ts";
 
 describe("cloudflare provider (mocked fetch)", () => {
@@ -8,7 +8,8 @@ describe("cloudflare provider (mocked fetch)", () => {
   let realFetch: typeof fetch;
 
   beforeEach(() => {
-    h = setupFakePhantom();
+    // Provider logic after a token is read; real Phantom 0.7.9 refuses headless reveal.
+    h = setupFakePhantom({}, { legacyHeadlessReveal: true });
     realFetch = globalThis.fetch;
   });
 
@@ -24,10 +25,9 @@ describe("cloudflare provider (mocked fetch)", () => {
     globalThis.fetch = (async (url: string | URL | Request) => {
       const u = String(url);
       if (u.endsWith("/user/tokens/verify")) {
-        return new Response(
-          JSON.stringify({ result: { id: "tok1", status: "active" } }),
-          { status: 200 },
-        );
+        return new Response(JSON.stringify({ result: { id: "tok1", status: "active" } }), {
+          status: 200,
+        });
       }
       if (u.endsWith("/accounts")) {
         return new Response(JSON.stringify({ result: accounts }), { status: 200 });
@@ -54,10 +54,9 @@ describe("cloudflare provider (mocked fetch)", () => {
       const headers = init?.headers as Record<string, string> | undefined;
       if (headers?.Authorization) seenAuth = headers.Authorization;
       if (String(url).endsWith("/user/tokens/verify")) {
-        return new Response(
-          JSON.stringify({ result: { id: "tok1", status: "active" } }),
-          { status: 200 },
-        );
+        return new Response(JSON.stringify({ result: { id: "tok1", status: "active" } }), {
+          status: 200,
+        });
       }
       throw new Error(`unexpected ${url}`);
     }) as unknown as typeof fetch;

package/src/__tests__/completion-ci.test.ts

@@ -1,8 +1,17 @@
 import { describe, expect, test } from "bun:test";
-import { mkdtempSync, readFileSync, existsSync } from "node:fs";
+import { spawn, spawnSync } from "node:child_process";
+import {
+  existsSync,
+  lstatSync,
+  mkdirSync,
+  mkdtempSync,
+  readFileSync,
+  readdirSync,
+  rmSync,
+  writeFileSync,
+} from "node:fs";
 import { tmpdir } from "node:os";
-import { join } from "node:path";
-import { spawnSync } from "node:child_process";
+import { delimiter, dirname, join } from "node:path";
 
 const CLI = join(import.meta.dir, "..", "..", "..", "cli", "src", "index.ts");
 
@@ -34,29 +43,236 @@ describe("stack completion", () => {
   });
 });
 
-describe("stack ci init", () => {
-  test("writes a valid-looking workflow under .github/workflows/", async () => {
-    const cwd = mkdtempSync(join(tmpdir(), "stack-ci-"));
-    const registryDir = mkdtempSync(join(tmpdir(), "stack-ci-reg-"));
+const CI_UNAVAILABLE =
+  "CI health workflow unavailable: Phantom Cloud pull requires trusted-terminal approval. No workflow was written.";
 
-    // Seed a minimal .stack.toml so `ci init` is happy.
-    const { emptyConfig, writeConfig } = await import("../config.ts");
-    const prev = process.env.STACK_REGISTRY_DIR;
-    process.env.STACK_REGISTRY_DIR = registryDir;
-    await writeConfig(emptyConfig(), cwd);
+interface CiFixture {
+  cwd: string;
+  env: Record<string, string>;
+}
 
-    const res = spawnSync("bun", ["run", CLI, "ci", "init"], { encoding: "utf-8", cwd });
-    expect(res.status).toBe(0);
+async function withCiFixture(
+  configured: boolean,
+  run: (fixture: CiFixture) => Promise<void>,
+): Promise<void> {
+  const root = mkdtempSync(join(tmpdir(), "stack-ci-refusal-"));
+  try {
+    for (const dir of ["project", "home", "tmp", "registry", "xdg"]) {
+      mkdirSync(join(root, dir));
+    }
+    const cwd = join(root, "project");
+    if (configured) {
+      writeFileSync(
+        join(cwd, ".stack.toml"),
+        '[stack]\nversion = "1"\nproject_id = "synthetic-ci-project"\n',
+      );
+    }
+    const env: Record<string, string> = {
+      PATH: [dirname(process.execPath), "/usr/bin", "/bin"].join(delimiter),
+      HOME: join(root, "home"),
+      USERPROFILE: join(root, "home"),
+      TMPDIR: join(root, "tmp"),
+      TMP: join(root, "tmp"),
+      TEMP: join(root, "tmp"),
+      XDG_CONFIG_HOME: join(root, "xdg"),
+      XDG_CACHE_HOME: join(root, "xdg"),
+      XDG_DATA_HOME: join(root, "xdg"),
+      STACK_REGISTRY_DIR: join(root, "registry"),
+      CI: "true",
+      STACK_NO_UPDATE_CHECK: "1",
+      STACK_TELEMETRY: "0",
+      PHANTOM_CLOUD_TOKEN: "SYNTHETIC-CLOUD-DO-NOT-PRINT",
+      PHANTOM_VAULT_PASSPHRASE: "SYNTHETIC-VAULT-DO-NOT-PRINT",
+    };
+    if (process.env.SystemRoot) env.SystemRoot = process.env.SystemRoot;
+    await run({ cwd, env });
+  } finally {
+    rmSync(root, { recursive: true, force: true });
+  }
+}
+
+function projectSnapshot(cwd: string): Record<string, string> {
+  const snapshot: Record<string, string> = {};
+  function visit(dir: string, prefix = ""): void {
+    for (const name of readdirSync(dir).sort()) {
+      const file = join(dir, name);
+      const key = `${prefix}${name}`;
+      const stat = lstatSync(file);
+      if (stat.isDirectory()) {
+        snapshot[key] = `directory:${stat.mode}`;
+        visit(file, `${key}/`);
+      } else if (stat.isFile()) {
+        snapshot[key] = `file:${stat.mode}:${readFileSync(file).toString("hex")}`;
+      } else {
+        throw new Error("Unexpected CI fixture entry");
+      }
+    }
+  }
+  visit(cwd);
+  return snapshot;
+}
+
+// Reuse the existing async fixture transport: Bun 1.2's sync facade can
+// mislabel exit 1 and does not reliably enforce timeout/output bounds.
+function runBoundedCiFixture(
+  command: string,
+  args: string[],
+  cwd: string,
+  env: Record<string, string>,
+) {
+  return new Promise<{
+    status: number | null;
+    signal: NodeJS.Signals | null;
+    error?: Error;
+    stdout: string;
+    stderr: string;
+    timedOut: boolean;
+    outputLimitExceeded: boolean;
+  }>((resolve) => {
+    let child: ReturnType<typeof spawn>;
+    try {
+      child = spawn(command, args, { cwd, env, stdio: ["ignore", "pipe", "pipe"] });
+    } catch (error) {
+      // Bun 1.2 throws launch errors synchronously; newer runtimes emit error.
+      resolve({
+        status: null,
+        signal: null,
+        error: error instanceof Error ? error : new Error("fixture launch failed"),
+        stdout: "",
+        stderr: "",
+        timedOut: false,
+        outputLimitExceeded: false,
+      });
+      return;
+    }
+    const stdout: Buffer[] = [];
+    const stderr: Buffer[] = [];
+    let bytes = 0;
+    let timedOut = false;
+    let outputLimitExceeded = false;
+    let error: Error | undefined;
+    const timer = setTimeout(() => {
+      timedOut = true;
+      child.kill("SIGKILL");
+    }, 1500);
+    function capture(chunks: Buffer[], chunk: Buffer) {
+      if (outputLimitExceeded) return;
+      const remaining = 64 * 1024 - bytes;
+      const retained = chunk.subarray(0, remaining);
+      chunks.push(Buffer.from(retained));
+      bytes += retained.length;
+      if (chunk.length > remaining) {
+        outputLimitExceeded = true;
+        child.kill("SIGKILL");
+      }
+    }
+    child.stdout?.on("data", (chunk: Buffer) => capture(stdout, chunk));
+    child.stderr?.on("data", (chunk: Buffer) => capture(stderr, chunk));
+    child.once("error", (failure) => {
+      error = failure;
+      if (child.pid) child.kill("SIGKILL");
+    });
+    child.once("close", (status, signal) => {
+      clearTimeout(timer);
+      resolve({
+        status,
+        signal,
+        error,
+        stdout: Buffer.concat(stdout).toString("utf8"),
+        stderr: Buffer.concat(stderr).toString("utf8"),
+        timedOut,
+        outputLimitExceeded,
+      });
+    });
+  });
+}
+
+async function runCi(fixture: CiFixture, args: string[] = []) {
+  const result = await runBoundedCiFixture(
+    process.execPath,
+    ["run", CLI, "ci", "init", ...args],
+    fixture.cwd,
+    fixture.env,
+  );
+  expect(result.error).toBeUndefined();
+  expect(result.timedOut).toBe(false);
+  expect(result.outputLimitExceeded).toBe(false);
+  expect(result.signal).toBeNull();
+  expect(result.status).not.toBeNull();
+  const output = result.stdout + result.stderr;
+  expect(output).not.toContain("SYNTHETIC-CLOUD-DO-NOT-PRINT");
+  expect(output).not.toContain("SYNTHETIC-VAULT-DO-NOT-PRINT");
+  return { result, output };
+}
+
+async function expectUnavailable(fixture: CiFixture, args: string[] = []): Promise<void> {
+  const before = projectSnapshot(fixture.cwd);
+  const { result, output } = await runCi(fixture, args);
+  expect(result.status).toBe(1);
+  expect(output).toContain(CI_UNAVAILABLE);
+  expect(output).not.toContain("CI workflow scaffolded.");
+  expect(output).not.toContain("PHANTOM_CLOUD_TOKEN");
+  expect(output).not.toContain("PHANTOM_VAULT_PASSPHRASE");
+  expect(projectSnapshot(fixture.cwd)).toEqual(before);
+}
+
+describe("stack ci init", async () => {
+  test("preserves missing-config refusal without creating workflow parents", async () => {
+    await withCiFixture(false, async (fixture) => {
+      const before = projectSnapshot(fixture.cwd);
+      const { result, output } = await runCi(fixture);
+      expect(result.status).toBe(1);
+      expect(output).toContain("No .stack.toml found. Run `stack init` first.");
+      expect(projectSnapshot(fixture.cwd)).toEqual(before);
+      expect(existsSync(join(fixture.cwd, ".github"))).toBe(false);
+    });
+  });
 
-    const workflowPath = join(cwd, ".github", "workflows", "stack-ci.yml");
-    expect(existsSync(workflowPath)).toBe(true);
-    const content = readFileSync(workflowPath, "utf-8");
-    expect(content).toContain("name: Stack doctor");
-    expect(content).toContain("stack doctor --json");
-    expect(content).toContain("PHANTOM_CLOUD_TOKEN");
-    expect(content).toContain("actions/upload-artifact@v4");
+  test("refuses the unsupported Cloud scaffold before creating either parent", async () => {
+    await withCiFixture(true, async (fixture) => {
+      await expectUnavailable(fixture);
+      expect(existsSync(join(fixture.cwd, ".github"))).toBe(false);
+    });
+  });
+
+  test("leaves an existing workflow directory and unrelated file unchanged", async () => {
+    await withCiFixture(true, async (fixture) => {
+      const dir = join(fixture.cwd, ".github", "workflows");
+      mkdirSync(dir, { recursive: true });
+      writeFileSync(join(dir, "owned.yml"), "owner sentinel\n");
+      await expectUnavailable(fixture);
+    });
+  });
+
+  test("preserves the existing-file guard without force", async () => {
+    await withCiFixture(true, async (fixture) => {
+      const dir = join(fixture.cwd, ".github", "workflows");
+      mkdirSync(dir, { recursive: true });
+      writeFileSync(join(dir, "stack-ci.yml"), "owner sentinel\n");
+      const before = projectSnapshot(fixture.cwd);
+      const { result, output } = await runCi(fixture);
+      expect(result.status).toBe(1);
+      expect(output).toContain("already exists. It was not changed.");
+      expect(projectSnapshot(fixture.cwd)).toEqual(before);
+    });
+  });
+
+  test("force cannot overwrite an existing workflow with an unsupported scaffold", async () => {
+    await withCiFixture(true, async (fixture) => {
+      const dir = join(fixture.cwd, ".github", "workflows");
+      mkdirSync(dir, { recursive: true });
+      writeFileSync(join(dir, "stack-ci.yml"), "owner sentinel\n");
+      await expectUnavailable(fixture, ["--force"]);
+    });
+  });
 
-    if (prev === undefined) delete process.env.STACK_REGISTRY_DIR;
-    else process.env.STACK_REGISTRY_DIR = prev;
+  test("preserves help and the force flag without creating files", async () => {
+    await withCiFixture(false, async (fixture) => {
+      const before = projectSnapshot(fixture.cwd);
+      const { result, output } = await runCi(fixture, ["--help"]);
+      expect(result.status).toBe(0);
+      expect(output).toContain("--force");
+      expect(projectSnapshot(fixture.cwd)).toEqual(before);
+    });
   });
 });

package/src/__tests__/config-own-services.test.ts

@@ -0,0 +1,183 @@
+import { afterEach, beforeEach, describe, expect, test } from "bun:test";
+import { existsSync, mkdirSync, mkdtempSync, readFileSync, rmSync, writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { parse as parseToml, stringify as stringifyToml } from "smol-toml";
+import {
+  CONFIG_FILENAME,
+  LOCAL_FILENAME,
+  type ServiceEntry,
+  emptyConfig,
+  readConfig,
+  writeConfig,
+} from "../config.ts";
+
+const SERVICE_NAMES = ["__proto__", "constructor", "toString", "github"];
+const ENTRY: ServiceEntry = {
+  provider: "github",
+  secrets: ["FIXTURE_TOKEN_SLOT"],
+  mcp: "fixture-mcp",
+  resource_id: "fixture-resource",
+  region: "fixture-region",
+  meta: { account: "fixture-local-account" },
+  created_at: "2026-10-14T00:00:00Z",
+  created_by: "fixture-user",
+};
+
+function expectOwnService(
+  services: Record<string, ServiceEntry>,
+  name: string,
+  entry: ServiceEntry,
+): void {
+  expect(Object.getPrototypeOf(services)).toBe(Object.prototype);
+  expect(Object.hasOwn(services, name)).toBe(true);
+  expect(Object.keys(services)).toEqual([name]);
+  expect(services[name]).toEqual(entry);
+  expect(JSON.parse(JSON.stringify(services))).toEqual(Object.fromEntries([[name, entry]]));
+}
+
+describe("service names remain own configuration data", () => {
+  let root: string;
+  let cwd: string;
+  let registryDir: string;
+  let previousRegistryDir: string | undefined;
+
+  beforeEach(() => {
+    root = mkdtempSync(join(tmpdir(), "stack-own-services-"));
+    cwd = join(root, "project");
+    registryDir = join(root, "registry");
+    mkdirSync(cwd);
+    previousRegistryDir = process.env.STACK_REGISTRY_DIR;
+    process.env.STACK_REGISTRY_DIR = registryDir;
+  });
+
+  afterEach(() => {
+    if (previousRegistryDir === undefined)
+      Reflect.deleteProperty(process.env, "STACK_REGISTRY_DIR");
+    else process.env.STACK_REGISTRY_DIR = previousRegistryDir;
+    rmSync(root, { recursive: true, force: true });
+  });
+
+  test.each(SERVICE_NAMES)("reads split files without losing the %s service", async (name) => {
+    writeFileSync(
+      join(cwd, CONFIG_FILENAME),
+      stringifyToml({
+        stack: { version: "1" },
+        services: Object.fromEntries([
+          [
+            name,
+            {
+              provider: ENTRY.provider,
+              secrets: ENTRY.secrets,
+              mcp: ENTRY.mcp,
+            },
+          ],
+        ]),
+      }),
+    );
+    writeFileSync(
+      join(cwd, LOCAL_FILENAME),
+      stringifyToml({
+        stack: { project_id: "stk_fixture" },
+        services: Object.fromEntries([
+          [
+            name,
+            {
+              resource_id: ENTRY.resource_id,
+              region: ENTRY.region,
+              meta: ENTRY.meta,
+              created_at: ENTRY.created_at,
+              created_by: ENTRY.created_by,
+            },
+          ],
+        ]),
+      }),
+    );
+
+    const config = await readConfig(cwd);
+
+    expect(config.stack.project_id).toBe("stk_fixture");
+    expectOwnService(config.services, name, ENTRY);
+  });
+
+  test.each(SERVICE_NAMES)("keeps %s when no local service entry exists", async (name) => {
+    writeFileSync(
+      join(cwd, CONFIG_FILENAME),
+      stringifyToml({
+        stack: { version: "1" },
+        services: Object.fromEntries([
+          [name, { provider: ENTRY.provider, secrets: ENTRY.secrets }],
+        ]),
+      }),
+    );
+    writeFileSync(
+      join(cwd, LOCAL_FILENAME),
+      stringifyToml({
+        stack: { project_id: "stk_fixture" },
+        services: {},
+      }),
+    );
+
+    const config = await readConfig(cwd);
+
+    expectOwnService(config.services, name, {
+      provider: ENTRY.provider,
+      secrets: ENTRY.secrets,
+      created_at: "1970-01-01T00:00:00Z",
+    });
+  });
+
+  test.each(SERVICE_NAMES)(
+    "writes and registers %s while keeping instance fields local",
+    async (name) => {
+      const original = emptyConfig("fixture-template");
+      original.services = Object.fromEntries([[name, ENTRY]]);
+
+      await writeConfig(original, cwd);
+
+      const shapeText = readFileSync(join(cwd, CONFIG_FILENAME), "utf8");
+      const shape = parseToml(shapeText);
+      const local = parseToml(readFileSync(join(cwd, LOCAL_FILENAME), "utf8"));
+      expect(Object.hasOwn(shape.services as object, name)).toBe(true);
+      expect(Object.hasOwn(local.services as object, name)).toBe(true);
+      expect((shape.services as Record<string, unknown>)[name]).toEqual({
+        provider: ENTRY.provider,
+        secrets: ENTRY.secrets,
+        mcp: ENTRY.mcp,
+      });
+      expect((local.services as Record<string, unknown>)[name]).toEqual({
+        resource_id: ENTRY.resource_id,
+        region: ENTRY.region,
+        meta: ENTRY.meta,
+        created_at: ENTRY.created_at,
+        created_by: ENTRY.created_by,
+      });
+      expect(shapeText).not.toContain(ENTRY.resource_id!);
+      expect(shapeText).not.toContain("fixture-local-account");
+      expect(shapeText).not.toContain(original.stack.project_id);
+      expectOwnService((await readConfig(cwd)).services, name, ENTRY);
+      const registry = JSON.parse(readFileSync(join(registryDir, "projects.json"), "utf8"));
+      expect(registry.projects[0].services).toEqual([name]);
+    },
+  );
+
+  test.each(SERVICE_NAMES)("migrates a legacy %s service without losing it", async (name) => {
+    writeFileSync(
+      join(cwd, CONFIG_FILENAME),
+      stringifyToml({
+        stack: { version: "1", project_id: "stk_legacy_fixture" },
+        services: Object.fromEntries([[name, ENTRY]]),
+      }),
+    );
+
+    const legacy = await readConfig(cwd);
+    expectOwnService(legacy.services, name, ENTRY);
+    expect(existsSync(join(cwd, LOCAL_FILENAME))).toBe(false);
+
+    await writeConfig(legacy, cwd);
+
+    const roundTrip = await readConfig(cwd);
+    expect(roundTrip.stack.project_id).toBe("stk_legacy_fixture");
+    expectOwnService(roundTrip.services, name, ENTRY);
+  });
+});