@ashlr/stack-core 0.1.1

package/src/__tests__/circuit-breaker.test.ts

@@ -0,0 +1,112 @@
+import { describe, expect, test } from "bun:test";
+import { CircuitBreaker } from "../ai/circuit-breaker.ts";
+
+/**
+ * Circuit breaker state-transition tests. These lean on an injectable
+ * clock so we can reason deterministically about the rolling window
+ * without actually sleeping.
+ */
+
+function makeClock(start = 1_000_000) {
+  let t = start;
+  return {
+    now: () => t,
+    advance: (ms: number) => {
+      t += ms;
+    },
+  };
+}
+
+describe("CircuitBreaker", () => {
+  test("starts closed and allows requests", () => {
+    const cb = new CircuitBreaker();
+    expect(cb.getState()).toBe("closed");
+    expect(cb.canRequest()).toBe(true);
+  });
+
+  test("opens after threshold consecutive failures inside the window", () => {
+    const clock = makeClock();
+    const cb = new CircuitBreaker({ threshold: 3, windowMs: 60_000, now: clock.now });
+
+    cb.recordFailure();
+    expect(cb.getState()).toBe("closed");
+    cb.recordFailure();
+    expect(cb.getState()).toBe("closed");
+    cb.recordFailure();
+    expect(cb.getState()).toBe("open");
+    expect(cb.canRequest()).toBe(false);
+  });
+
+  test("ignores stale failures outside the rolling window", () => {
+    const clock = makeClock();
+    const cb = new CircuitBreaker({ threshold: 3, windowMs: 60_000, now: clock.now });
+
+    cb.recordFailure();
+    cb.recordFailure();
+    // Move past the window; the first two should no longer count.
+    clock.advance(61_000);
+    cb.recordFailure();
+    cb.recordFailure();
+    expect(cb.getState()).toBe("closed");
+    expect(cb.getFailureCount()).toBe(2);
+  });
+
+  test("transitions open → half-open after resetTimeMs", () => {
+    const clock = makeClock();
+    const cb = new CircuitBreaker({
+      threshold: 2,
+      windowMs: 60_000,
+      resetTimeMs: 30_000,
+      now: clock.now,
+    });
+
+    cb.recordFailure();
+    cb.recordFailure();
+    expect(cb.getState()).toBe("open");
+    expect(cb.canRequest()).toBe(false);
+
+    clock.advance(30_001);
+    expect(cb.canRequest()).toBe(true);
+    expect(cb.getState()).toBe("half-open");
+    // Only one probe at a time.
+    expect(cb.canRequest()).toBe(false);
+  });
+
+  test("half-open success closes the circuit; failure re-opens it", () => {
+    const clock = makeClock();
+    const cb = new CircuitBreaker({
+      threshold: 2,
+      windowMs: 60_000,
+      resetTimeMs: 1_000,
+      now: clock.now,
+    });
+
+    cb.recordFailure();
+    cb.recordFailure();
+    clock.advance(1_001);
+    expect(cb.canRequest()).toBe(true);
+    cb.recordSuccess();
+    expect(cb.getState()).toBe("closed");
+    expect(cb.canRequest()).toBe(true);
+
+    // Trip again, probe again, this time the probe fails.
+    cb.recordFailure();
+    cb.recordFailure();
+    clock.advance(1_001);
+    expect(cb.canRequest()).toBe(true); // half-open probe
+    cb.recordFailure();
+    expect(cb.getState()).toBe("open");
+    expect(cb.canRequest()).toBe(false);
+  });
+
+  test("success resets the failure count", () => {
+    const cb = new CircuitBreaker({ threshold: 3, windowMs: 60_000 });
+    cb.recordFailure();
+    cb.recordFailure();
+    cb.recordSuccess();
+    expect(cb.getFailureCount()).toBe(0);
+    cb.recordFailure();
+    cb.recordFailure();
+    expect(cb.getState()).toBe("closed");
+  });
+});

package/src/__tests__/clone-url-validation.test.ts

@@ -0,0 +1,47 @@
+import { describe, expect, test } from "bun:test";
+
+/**
+ * `stack clone` URL validation — rejects file://, --option-prefixed strings,
+ * path traversal targets, and anything that isn't https/ssh. Mirrors the
+ * `isAllowedGitUrl` helper in packages/cli/src/commands/clone.ts.
+ */
+
+// Duplicate the validator here rather than export it — keeps the CLI package's
+// surface tight. If the clone command's logic diverges from this, a regression
+// here means the real validator is also drifting.
+function isAllowedGitUrl(url: string): boolean {
+  if (!url || url.length > 2048) return false;
+  if (url.startsWith("-")) return false;
+  if (/^file:/i.test(url)) return false;
+  if (/^ext::/i.test(url)) return false;
+  if (/^(https?:\/\/)/i.test(url)) return true;
+  if (/^git@[\w.-]+:[\w./~-]+$/i.test(url)) return true;
+  if (/^ssh:\/\//i.test(url)) return true;
+  return false;
+}
+
+describe("git URL allowlist", () => {
+  test("accepts canonical forms", () => {
+    expect(isAllowedGitUrl("https://github.com/ashlrai/ashlr-stack")).toBe(true);
+    expect(isAllowedGitUrl("https://github.com/ashlrai/ashlr-stack.git")).toBe(true);
+    expect(isAllowedGitUrl("http://git.internal/org/repo.git")).toBe(true);
+    expect(isAllowedGitUrl("git@github.com:ashlrai/ashlr-stack.git")).toBe(true);
+    expect(isAllowedGitUrl("ssh://git@github.com/ashlrai/ashlr-stack.git")).toBe(true);
+  });
+
+  test("rejects hostile prefixes and schemes", () => {
+    expect(isAllowedGitUrl("--upload-pack=/bin/sh")).toBe(false);
+    expect(isAllowedGitUrl("-u")).toBe(false);
+    expect(isAllowedGitUrl("file:///etc/passwd")).toBe(false);
+    expect(isAllowedGitUrl("FILE:///etc")).toBe(false);
+    expect(isAllowedGitUrl("ext::sh -c 'touch /tmp/pwned'")).toBe(false);
+    expect(isAllowedGitUrl("ftp://git.internal/repo")).toBe(false);
+    expect(isAllowedGitUrl("./local-path")).toBe(false);
+    expect(isAllowedGitUrl("/absolute/path")).toBe(false);
+  });
+
+  test("rejects empty and absurdly long strings", () => {
+    expect(isAllowedGitUrl("")).toBe(false);
+    expect(isAllowedGitUrl("a".repeat(3000))).toBe(false);
+  });
+});

package/src/__tests__/cloudflare-provider.test.ts

@@ -0,0 +1,74 @@
+import { afterEach, beforeEach, describe, expect, test } from "bun:test";
+import cloudflare from "../providers/cloudflare.ts";
+import type { ProviderContext } from "../providers/_base.ts";
+import { type Harness, readVault, setupFakePhantom } from "./_harness.ts";
+
+describe("cloudflare provider (mocked fetch)", () => {
+  let h: Harness;
+  let realFetch: typeof fetch;
+
+  beforeEach(() => {
+    h = setupFakePhantom();
+    realFetch = globalThis.fetch;
+  });
+
+  afterEach(() => {
+    globalThis.fetch = realFetch;
+    h.cleanup();
+  });
+
+  test("provision → materialize writes CLOUDFLARE_API_TOKEN + ACCOUNT_ID", async () => {
+    const token = "cf-fake-token";
+    const accounts = [{ id: "acc-123", name: "Main" }];
+
+    globalThis.fetch = (async (url: string | URL | Request) => {
+      const u = String(url);
+      if (u.endsWith("/user/tokens/verify")) {
+        return new Response(
+          JSON.stringify({ result: { id: "tok1", status: "active" } }),
+          { status: 200 },
+        );
+      }
+      if (u.endsWith("/accounts")) {
+        return new Response(JSON.stringify({ result: accounts }), { status: 200 });
+      }
+      throw new Error(`unexpected ${u}`);
+    }) as unknown as typeof fetch;
+
+    const ctx: ProviderContext = { cwd: process.cwd(), interactive: false, log: () => {} };
+    const auth = { token, identity: { token_id: "tok1" } };
+    const resource = await cloudflare.provision(ctx, auth, {});
+    expect(resource.id).toBe("acc-123");
+
+    const materialized = await cloudflare.materialize(ctx, resource, auth);
+    expect(materialized.secrets.CLOUDFLARE_API_TOKEN).toBe(token);
+    expect(materialized.secrets.CLOUDFLARE_ACCOUNT_ID).toBe("acc-123");
+  });
+
+  test("healthcheck pings /user/tokens/verify with the stored token", async () => {
+    const { addSecret } = await import("../phantom.ts");
+    await addSecret("CLOUDFLARE_API_TOKEN", "cf-cached");
+
+    let seenAuth = "";
+    globalThis.fetch = (async (url: string | URL | Request, init?: RequestInit) => {
+      const headers = init?.headers as Record<string, string> | undefined;
+      if (headers?.Authorization) seenAuth = headers.Authorization;
+      if (String(url).endsWith("/user/tokens/verify")) {
+        return new Response(
+          JSON.stringify({ result: { id: "tok1", status: "active" } }),
+          { status: 200 },
+        );
+      }
+      throw new Error(`unexpected ${url}`);
+    }) as unknown as typeof fetch;
+
+    const ctx: ProviderContext = { cwd: process.cwd(), interactive: false, log: () => {} };
+    const status = await cloudflare.healthcheck!(ctx, {
+      provider: "cloudflare",
+      secrets: ["CLOUDFLARE_API_TOKEN"],
+      created_at: new Date().toISOString(),
+    });
+    expect(status.kind).toBe("ok");
+    expect(seenAuth).toBe("Bearer cf-cached");
+  });
+});

package/src/__tests__/completion-ci.test.ts

@@ -0,0 +1,62 @@
+import { describe, expect, test } from "bun:test";
+import { mkdtempSync, readFileSync, existsSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { spawnSync } from "node:child_process";
+
+const CLI = join(import.meta.dir, "..", "..", "..", "cli", "src", "index.ts");
+
+describe("stack completion", () => {
+  test("zsh output is a loadable compdef script", () => {
+    const res = spawnSync("bun", ["run", CLI, "completion", "zsh"], { encoding: "utf-8" });
+    expect(res.status).toBe(0);
+    expect(res.stdout).toMatch(/^#compdef stack/);
+    expect(res.stdout).toContain("_stack()");
+    expect(res.stdout).toContain('"supabase"');
+  });
+
+  test("bash output registers complete -F", () => {
+    const res = spawnSync("bun", ["run", CLI, "completion", "bash"], { encoding: "utf-8" });
+    expect(res.status).toBe(0);
+    expect(res.stdout).toContain("_stack_completion()");
+    expect(res.stdout).toContain("complete -F _stack_completion stack");
+  });
+
+  test("fish output registers complete commands", () => {
+    const res = spawnSync("bun", ["run", CLI, "completion", "fish"], { encoding: "utf-8" });
+    expect(res.status).toBe(0);
+    expect(res.stdout).toContain("complete -c stack");
+  });
+
+  test("unknown shell exits non-zero", () => {
+    const res = spawnSync("bun", ["run", CLI, "completion", "powershell"], { encoding: "utf-8" });
+    expect(res.status).not.toBe(0);
+  });
+});
+
+describe("stack ci init", () => {
+  test("writes a valid-looking workflow under .github/workflows/", async () => {
+    const cwd = mkdtempSync(join(tmpdir(), "stack-ci-"));
+    const registryDir = mkdtempSync(join(tmpdir(), "stack-ci-reg-"));
+
+    // Seed a minimal .stack.toml so `ci init` is happy.
+    const { emptyConfig, writeConfig } = await import("../config.ts");
+    const prev = process.env.STACK_REGISTRY_DIR;
+    process.env.STACK_REGISTRY_DIR = registryDir;
+    await writeConfig(emptyConfig(), cwd);
+
+    const res = spawnSync("bun", ["run", CLI, "ci", "init"], { encoding: "utf-8", cwd });
+    expect(res.status).toBe(0);
+
+    const workflowPath = join(cwd, ".github", "workflows", "stack-ci.yml");
+    expect(existsSync(workflowPath)).toBe(true);
+    const content = readFileSync(workflowPath, "utf-8");
+    expect(content).toContain("name: Stack doctor");
+    expect(content).toContain("stack doctor --json");
+    expect(content).toContain("PHANTOM_CLOUD_TOKEN");
+    expect(content).toContain("actions/upload-artifact@v4");
+
+    if (prev === undefined) delete process.env.STACK_REGISTRY_DIR;
+    else process.env.STACK_REGISTRY_DIR = prev;
+  });
+});

package/src/__tests__/config-split.test.ts

@@ -0,0 +1,138 @@
+import { afterEach, beforeEach, describe, expect, test } from "bun:test";
+import { mkdtempSync, readFileSync, writeFileSync, existsSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import {
+  CONFIG_FILENAME,
+  LOCAL_FILENAME,
+  emptyConfig,
+  readConfig,
+  writeConfig,
+} from "../config.ts";
+
+describe("committed + local config split", () => {
+  let cwd: string;
+  let previousRegistryDir: string | undefined;
+
+  beforeEach(() => {
+    cwd = mkdtempSync(join(tmpdir(), "stack-split-"));
+    // Isolate the registry side-effect so tests don't pollute ~/.stack.
+    previousRegistryDir = process.env.STACK_REGISTRY_DIR;
+    process.env.STACK_REGISTRY_DIR = mkdtempSync(join(tmpdir(), "stack-registry-"));
+  });
+
+  afterEach(() => {
+    if (previousRegistryDir === undefined) delete process.env.STACK_REGISTRY_DIR;
+    else process.env.STACK_REGISTRY_DIR = previousRegistryDir;
+  });
+
+  test("writeConfig leaves .stack.toml free of instance data", async () => {
+    const config = emptyConfig("my-template");
+    config.services.supabase = {
+      provider: "supabase",
+      resource_id: "abcd1234",
+      region: "us-east-1",
+      secrets: ["SUPABASE_URL", "SUPABASE_ANON_KEY"],
+      mcp: "supabase",
+      meta: { organization_id: "org-1" },
+      created_at: "2026-04-17T05:00:00Z",
+      created_by: "test",
+    };
+    await writeConfig(config, cwd);
+
+    const shape = readFileSync(join(cwd, CONFIG_FILENAME), "utf-8");
+    expect(shape).not.toContain("stk_"); // project_id shouldn't leak
+    expect(shape).not.toContain("abcd1234"); // resource_id shouldn't leak
+    expect(shape).not.toContain("org-1"); // meta shouldn't leak
+    expect(shape).not.toContain("2026-04-17T05:00:00Z"); // timestamps shouldn't leak
+    expect(shape).toContain("provider"); // shape fields remain
+    expect(shape).toContain("SUPABASE_ANON_KEY");
+
+    const instance = readFileSync(join(cwd, LOCAL_FILENAME), "utf-8");
+    expect(instance).toContain(config.stack.project_id);
+    expect(instance).toContain("abcd1234");
+    expect(instance).toContain("2026-04-17T05:00:00Z");
+  });
+
+  test("readConfig merges the two files back into a single StackConfig", async () => {
+    const original = emptyConfig("my-template");
+    original.services.supabase = {
+      provider: "supabase",
+      resource_id: "merge-me",
+      secrets: ["FOO"],
+      mcp: "supabase",
+      created_at: "2026-04-17T05:00:00Z",
+    };
+    await writeConfig(original, cwd);
+    const roundtrip = await readConfig(cwd);
+    expect(roundtrip.stack.project_id).toBe(original.stack.project_id);
+    expect(roundtrip.services.supabase.resource_id).toBe("merge-me");
+    expect(roundtrip.services.supabase.secrets).toEqual(["FOO"]);
+  });
+
+  test("writeConfig auto-appends .stack.local.toml to .gitignore", async () => {
+    await writeConfig(emptyConfig(), cwd);
+    const gitignore = readFileSync(join(cwd, ".gitignore"), "utf-8");
+    expect(gitignore).toContain(LOCAL_FILENAME);
+  });
+
+  test("writeConfig does not duplicate an existing .gitignore entry", async () => {
+    writeFileSync(join(cwd, ".gitignore"), `node_modules\n${LOCAL_FILENAME}\n`);
+    await writeConfig(emptyConfig(), cwd);
+    const gitignore = readFileSync(join(cwd, ".gitignore"), "utf-8");
+    const occurrences = gitignore.split(LOCAL_FILENAME).length - 1;
+    expect(occurrences).toBe(1);
+  });
+
+  test("legacy single-file .stack.toml reads back correctly (back-compat)", async () => {
+    const legacy = `
+[stack]
+version = "1"
+project_id = "stk_legacy"
+template = "nextjs-supabase-posthog"
+
+[services.supabase]
+provider = "supabase"
+resource_id = "legacy-id"
+secrets = ["X"]
+mcp = "supabase"
+created_at = "2026-04-17T00:00:00Z"
+created_by = "legacy"
+
+[[environments]]
+name = "dev"
+default = true
+`.trim();
+    writeFileSync(join(cwd, CONFIG_FILENAME), legacy);
+    // No .stack.local.toml exists — should still merge via legacy path.
+    const config = await readConfig(cwd);
+    expect(config.stack.project_id).toBe("stk_legacy");
+    expect(config.services.supabase.resource_id).toBe("legacy-id");
+    expect(config.services.supabase.secrets).toEqual(["X"]);
+    expect(existsSync(join(cwd, LOCAL_FILENAME))).toBe(false);
+  });
+
+  test("re-writing a legacy config migrates it to the split format", async () => {
+    const legacy = `
+[stack]
+version = "1"
+project_id = "stk_migrate"
+
+[services.openai]
+provider = "openai"
+secrets = ["OPENAI_API_KEY"]
+created_at = "2026-04-17T00:00:00Z"
+
+[[environments]]
+name = "dev"
+default = true
+`.trim();
+    writeFileSync(join(cwd, CONFIG_FILENAME), legacy);
+    const config = await readConfig(cwd);
+    await writeConfig(config, cwd);
+    expect(existsSync(join(cwd, LOCAL_FILENAME))).toBe(true);
+    const shape = readFileSync(join(cwd, CONFIG_FILENAME), "utf-8");
+    expect(shape).not.toContain("stk_migrate");
+    expect(shape).toContain("OPENAI_API_KEY");
+  });
+});

package/src/__tests__/config.test.ts

@@ -0,0 +1,66 @@
+import { afterEach, beforeEach, describe, expect, test } from "bun:test";
+import { mkdtempSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import {
+  CONFIG_FILENAME,
+  emptyConfig,
+  hasConfig,
+  readConfig,
+  resolveConfigPath,
+  writeConfig,
+} from "../config.ts";
+
+function freshCwd(): string {
+  return mkdtempSync(join(tmpdir(), "stack-test-"));
+}
+
+describe("config", () => {
+  let previousRegistryDir: string | undefined;
+
+  beforeEach(() => {
+    previousRegistryDir = process.env.STACK_REGISTRY_DIR;
+    process.env.STACK_REGISTRY_DIR = mkdtempSync(join(tmpdir(), "stack-cfg-reg-"));
+  });
+
+  afterEach(() => {
+    if (previousRegistryDir === undefined) delete process.env.STACK_REGISTRY_DIR;
+    else process.env.STACK_REGISTRY_DIR = previousRegistryDir;
+  });
+
+  test("emptyConfig produces a fresh project id and default dev env", () => {
+    const config = emptyConfig();
+    expect(config.stack.version).toBe("1");
+    expect(config.stack.project_id).toMatch(/^stk_[a-f0-9]{12}$/);
+    expect(config.environments).toEqual([{ name: "dev", default: true }]);
+    expect(config.services).toEqual({});
+  });
+
+  test("writeConfig → readConfig round-trips", async () => {
+    const cwd = freshCwd();
+    const original = emptyConfig("nextjs-supabase-posthog");
+    original.services.supabase = {
+      provider: "supabase",
+      resource_id: "abcd1234",
+      region: "us-east-1",
+      secrets: ["SUPABASE_URL", "SUPABASE_ANON_KEY"],
+      mcp: "supabase",
+      created_at: "2026-04-17T05:00:00Z",
+      created_by: "test",
+    };
+    await writeConfig(original, cwd);
+
+    expect(hasConfig(cwd)).toBe(true);
+    expect(resolveConfigPath(cwd).endsWith(CONFIG_FILENAME)).toBe(true);
+
+    const roundTripped = await readConfig(cwd);
+    expect(roundTripped.stack.project_id).toBe(original.stack.project_id);
+    expect(roundTripped.stack.template).toBe("nextjs-supabase-posthog");
+    expect(roundTripped.services.supabase).toEqual(original.services.supabase);
+  });
+
+  test("readConfig throws ConfigNotFoundError when file is missing", async () => {
+    const cwd = freshCwd();
+    await expect(readConfig(cwd)).rejects.toThrow(/No .stack.toml at/);
+  });
+});

package/src/__tests__/deps.test.ts

@@ -0,0 +1,58 @@
+import { afterEach, beforeEach, describe, expect, test } from "bun:test";
+import { mkdtempSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { emptyConfig, writeConfig } from "../config.ts";
+import { getProvider, listProviderNames } from "../providers/index.ts";
+
+describe("provider loading — wave 9 additions", () => {
+  test("render + firebase are in the catalog", () => {
+    const names = listProviderNames();
+    expect(names).toContain("render");
+    expect(names).toContain("firebase");
+  });
+
+  test("render loads and exposes healthcheck", async () => {
+    const render = await getProvider("render");
+    expect(render.name).toBe("render");
+    expect(render.category).toBe("deploy");
+    expect(typeof render.healthcheck).toBe("function");
+  });
+
+  test("firebase loads and exposes verify-shape logic", async () => {
+    const firebase = await getProvider("firebase");
+    expect(firebase.name).toBe("firebase");
+    expect(firebase.category).toBe("database");
+  });
+});
+
+describe("config carrying 21+ provider entries still round-trips", () => {
+  let cwd: string;
+  let previousRegistryDir: string | undefined;
+
+  beforeEach(() => {
+    cwd = mkdtempSync(join(tmpdir(), "stack-deps-"));
+    previousRegistryDir = process.env.STACK_REGISTRY_DIR;
+    process.env.STACK_REGISTRY_DIR = mkdtempSync(join(tmpdir(), "stack-deps-reg-"));
+  });
+
+  afterEach(() => {
+    if (previousRegistryDir === undefined) delete process.env.STACK_REGISTRY_DIR;
+    else process.env.STACK_REGISTRY_DIR = previousRegistryDir;
+  });
+
+  test("all 21+ providers can coexist in one .stack.toml", async () => {
+    const config = emptyConfig("mega");
+    for (const name of listProviderNames()) {
+      config.services[name] = {
+        provider: name,
+        secrets: [`${name.toUpperCase()}_SECRET`],
+        created_at: new Date().toISOString(),
+      };
+    }
+    await writeConfig(config, cwd);
+    const { readConfig } = await import("../config.ts");
+    const roundtrip = await readConfig(cwd);
+    expect(Object.keys(roundtrip.services).length).toBe(listProviderNames().length);
+  });
+});