@ashlr/stack-core 0.3.1 → 0.3.6

package/src/__tests__/phantom-wire-failing-subprocess.test.ts

@@ -0,0 +1,126 @@
+import { afterAll, afterEach, beforeEach, describe, expect, it } from "bun:test";
+import { EventEmitter } from "node:events";
+import {
+  chmodSync,
+  existsSync,
+  mkdtempSync,
+  realpathSync,
+  rmSync,
+  symlinkSync,
+  writeFileSync,
+} from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+
+type Script = (args: string[]) => {
+  code?: number;
+  stdout?: string;
+  stderr?: string;
+  error?: string;
+};
+let script: Script = () => ({ code: 0 });
+const calls: string[][] = [];
+
+function fakeSpawn(_bin: string, args: string[]) {
+  calls.push(args);
+  const child = new EventEmitter() as EventEmitter & Record<string, unknown>;
+  const out = new EventEmitter();
+  const err = new EventEmitter();
+  Object.assign(child, {
+    stdout: Object.assign(out, { destroy() {} }),
+    stderr: Object.assign(err, { destroy() {} }),
+    stdin: { on() {}, write() {}, end() {}, destroy() {} },
+    pid: undefined,
+    kill() {},
+    unref() {},
+  });
+  queueMicrotask(() => {
+    const r = script(args);
+    if (r.error) {
+      child.emit("error", Object.assign(new Error(r.error), { code: r.error }));
+      return;
+    }
+    if (r.stdout) out.emit("data", Buffer.from(r.stdout));
+    if (r.stderr) err.emit("data", Buffer.from(r.stderr));
+    child.emit("close", r.code ?? 0, null);
+  });
+  return child;
+}
+
+import { wirePhantomForRecipe } from "../ai/phantom-wire.ts";
+import { __resetPhantomCache, __setPhantomSpawn } from "../phantom.ts";
+
+afterAll(() => {
+  __setPhantomSpawn();
+  __resetPhantomCache();
+});
+
+describe("ai/phantom-wire with a stubbed failing subprocess", () => {
+  let dir: string;
+  const recipe = {
+    id: "stripe-only",
+    query: "payments",
+    createdAt: "2026-04-18T00:00:00.000Z",
+    providers: [{ name: "stripe" }, { name: "neon" }],
+  };
+
+  const savedPath = process.env.PATH;
+
+  beforeEach(() => {
+    dir = realpathSync(mkdtempSync(join(tmpdir(), "wire-stub-")));
+    // The binary is only resolved on PATH, never executed: spawn is stubbed.
+    // Link a `.sh` target like _harness.ts: macOS provenance policy rejects
+    // an extensionless file written by this process.
+    writeFileSync(join(dir, "phantom.sh"), "#!/bin/sh\n");
+    chmodSync(join(dir, "phantom.sh"), 0o755);
+    symlinkSync(join(dir, "phantom.sh"), join(dir, "phantom"));
+    process.env.PATH = dir;
+    calls.length = 0;
+    __resetPhantomCache();
+    __setPhantomSpawn(fakeSpawn as never);
+  });
+  afterEach(() => {
+    process.env.PATH = savedPath;
+    rmSync(dir, { recursive: true, force: true });
+  });
+
+  it("skips every provider, still writes the stub, and never writes the vault when `phantom list` exits non-zero", async () => {
+    script = (args) =>
+      args[0] === "--version"
+        ? { code: 0, stdout: "phantom 0.7.9\n" }
+        : { code: 1, stderr: "vault locked" };
+
+    const result = await wirePhantomForRecipe(recipe, { cwd: dir });
+
+    expect(result).toEqual({
+      present: [],
+      missing: [],
+      webhooks: [join(dir, ".stack/webhooks/stripe.ts")],
+      skipped: ["stripe", "neon"],
+    });
+    expect(existsSync(join(dir, ".stack/webhooks/stripe.ts"))).toBe(true);
+    expect(calls).toEqual([["--version"], ["list", "--json"]]);
+  });
+
+  it("treats a spawn ENOENT as Phantom missing: skips providers and writes stubs", async () => {
+    script = () => ({ error: "ENOENT" });
+
+    const result = await wirePhantomForRecipe(recipe, { cwd: dir });
+
+    expect(result.skipped).toEqual(["stripe", "neon"]);
+    expect(result.present).toEqual([]);
+    expect(result.missing).toEqual([]);
+    expect(result.webhooks).toEqual([join(dir, ".stack/webhooks/stripe.ts")]);
+    expect(calls).toEqual([["--version"]]);
+  });
+
+  it("skips providers when `phantom list --json` prints unparseable output", async () => {
+    script = (args) => (args[0] === "--version" ? { code: 0 } : { code: 0, stdout: "not json" });
+
+    const result = await wirePhantomForRecipe(recipe, { cwd: dir });
+
+    expect(result.skipped).toEqual(["stripe", "neon"]);
+    expect(result.webhooks).toHaveLength(1);
+    expect(calls.every((a) => a[0] !== "add")).toBe(true);
+  });
+});

package/src/__tests__/phantom-wire-repeated-placeholders.test.ts

@@ -0,0 +1,84 @@
+import { expect, it } from "bun:test";
+import { webhookStubFor } from "../ai/phantom-wire.ts";
+
+it.each([
+  ["stripe", "STRIPE_WEBHOOK_SECRET"],
+  ["clerk", "CLERK_WEBHOOK_SECRET"],
+  ["supabase", "SUPABASE_WEBHOOK_SECRET"],
+  ["github", "GITHUB_WEBHOOK_SECRET"],
+])("fills every repeated placeholder for %s", (provider, secret) => {
+  const stub = webhookStubFor(provider);
+  const lines = stub.split("\n");
+
+  expect(lines.filter((line) => line.includes("webhook handler stub for"))).toEqual([
+    `// Auto-generated by \`stack apply\` — webhook handler stub for ${provider}.`,
+  ]);
+  expect(lines.filter((line) => line.includes("webhook."))).toEqual([
+    `//   // to this endpoint can forge a ${provider} webhook.`,
+  ]);
+  expect(lines.filter((line) => line.includes("phantom reveal"))).toEqual([
+    `//   phantom reveal ${secret}`,
+    `//   // (\`phantom reveal ${secret}\`) and compare in`,
+  ]);
+  expect(stub).not.toContain("${");
+});
+
+it("preserves a single quote after a dollar sign in replacement text", () => {
+  const stub = webhookStubFor("pay$'co");
+  const lines = stub.split("\n");
+
+  expect(lines).toContain("// Auto-generated by `stack apply` — webhook handler stub for pay$'co.");
+  expect(lines).toContain("//   // to this endpoint can forge a pay$'co webhook.");
+  expect(lines).toContain(
+    "// export async function handlePay$'coWebhook(req: Request): Promise<Response> {",
+  );
+  expect(lines.filter((line) => line.includes("phantom reveal"))).toEqual([
+    "//   phantom reveal PAY$'CO_WEBHOOK_SECRET",
+    "//   // (`phantom reveal PAY$'CO_WEBHOOK_SECRET`) and compare in",
+  ]);
+});
+
+it("preserves a forward slash in replacement text at every provider site", () => {
+  const lines = webhookStubFor("pay/co").split("\n");
+
+  expect(lines).toContain("// Auto-generated by `stack apply` — webhook handler stub for pay/co.");
+  expect(lines).toContain("//   // to this endpoint can forge a pay/co webhook.");
+  expect(lines).toContain(
+    "// export async function handlePay/coWebhook(req: Request): Promise<Response> {",
+  );
+  expect(lines.filter((line) => line.includes("phantom reveal"))).toEqual([
+    "//   phantom reveal PAY/CO_WEBHOOK_SECRET",
+    "//   // (`phantom reveal PAY/CO_WEBHOOK_SECRET`) and compare in",
+  ]);
+});
+
+it("preserves the capture-group reference $1 literally in replacement text at every provider site", () => {
+  // `$1` is a directive to `String.prototype.replace` — a replace-based
+  // renderer would splice capture group 1 in place of these characters.
+  // The template literal inserts the provider name as inert data, so the
+  // two characters arrive byte-for-byte at every expansion site.
+  const lines = webhookStubFor("pay$1co").split("\n");
+
+  expect(lines).toContain("// Auto-generated by `stack apply` — webhook handler stub for pay$1co.");
+  expect(lines).toContain("//   // to this endpoint can forge a pay$1co webhook.");
+  expect(lines).toContain(
+    "// export async function handlePay$1coWebhook(req: Request): Promise<Response> {",
+  );
+  expect(lines.filter((line) => line.includes("phantom reveal"))).toEqual([
+    "//   phantom reveal PAY$1CO_WEBHOOK_SECRET",
+    "//   // (`phantom reveal PAY$1CO_WEBHOOK_SECRET`) and compare in",
+  ]);
+});
+
+it.each([
+  ["payco", "PAYCO_WEBHOOK_SECRET"],
+  ["pay$'co", "PAY$'CO_WEBHOOK_SECRET"],
+])("expands the leading provider slot and preserves its suffix for %s", (provider, expected) => {
+  // The fallback secret-name template starts with the provider interpolation,
+  // followed immediately by the literal _WEBHOOK_SECRET suffix.
+  const revealLines = webhookStubFor(provider)
+    .split("\n")
+    .filter((line) => line.startsWith("//   phantom reveal "));
+
+  expect(revealLines).toEqual([`//   phantom reveal ${expected}`]);
+});

package/src/__tests__/phantom-wire-unicode-combining.test.ts

@@ -0,0 +1,100 @@
+import { describe, expect, it } from "bun:test";
+import { verificationHintFor, webhookStubFor } from "../ai/phantom-wire.ts";
+
+/**
+ * Helper: return the sequence of code point values in a string.
+ */
+function codePoints(str: string): number[] {
+  return [...str].map((ch) => ch.codePointAt(0) as number);
+}
+
+describe("webhookStubFor — replacement value with Unicode combining character", () => {
+  // "café" spelled as base "e" + U+0301 (combining acute accent) = 5 code points.
+  // This is the NFD (decomposed) form; NFC would fuse e + U+0301 into é (U+00E9).
+  const name = "cafe\u0301";
+  const expectedCodePoints = [99, 97, 102, 101, 769]; // c, a, f, e, ́
+
+  it("preserves the original code points in every expansion site", () => {
+    const stub = webhookStubFor(name);
+    expect(stub).not.toContain("${");
+
+    // 1. The plain provider name (5 code points, not normalized to NFC).
+    const plainLines = stub.split("\n").filter((l) => l.includes("webhook handler stub for"));
+    expect(plainLines).toHaveLength(1);
+    const plainMatch = plainLines[0].match(/stub for (cafe\u0301)\./);
+    expect(plainMatch).not.toBeNull();
+    expect(codePoints(plainMatch![1])).toEqual(expectedCodePoints);
+
+    // 2. The capitalized provider name — first character upper-cased,
+    //    remaining code points (including the combining character) intact.
+    //    "café" → "Café" = C, a, f, e, U+0301
+    const capExpected = [67, 97, 102, 101, 769]; // C, a, f, e, ́
+    const capLines = stub.split("\n").filter((l) => l.includes("handleCaf"));
+    expect(capLines).toHaveLength(1);
+    // Extract the function name: "handleCaféWebhook"
+    const fnMatch = capLines[0].match(/handle(Cafe\u0301)Webhook/);
+    expect(fnMatch).not.toBeNull();
+    expect(codePoints(fnMatch![1])).toEqual(capExpected);
+
+    // 3. The secret key name — uppercased provider + _WEBHOOK_SECRET.
+    //    toUpperCase() on the combining mark (U+0301) returns itself.
+    const secretExpected = "CAFE\u0301_WEBHOOK_SECRET";
+    const revealLines = stub.split("\n").filter((l) => l.includes("phantom reveal"));
+    expect(revealLines).toHaveLength(2);
+    for (const line of revealLines) {
+      expect(line).toContain(secretExpected);
+    }
+
+    // 4. The forge line — plain provider name again.
+    const forgeLines = stub.split("\n").filter((l) => l.includes("forge a"));
+    expect(forgeLines).toHaveLength(1);
+    const forgeMatch = forgeLines[0].match(/forge a (cafe\u0301) webhook/);
+    expect(forgeMatch).not.toBeNull();
+    expect(codePoints(forgeMatch![1])).toEqual(expectedCodePoints);
+  });
+
+  it("does not NFC-normalize the combining character", () => {
+    // NFC normalization would fuse e + U+0301 into é (U+00E9), changing 5
+    // code points to 4. The rendered result must keep the original 5.
+    const stub = webhookStubFor(name);
+    // The stub must contain the decomposed sequence (length 5), not the
+    // precomposed é (U+00E9).
+    expect(stub).toContain(name);
+    expect(stub).not.toContain("café"); // NFC form with precomposed é
+    // Capitalized decomposed: C + a + f + e + U+0301
+    expect(stub).toContain("Cafe\u0301Webhook");
+  });
+
+  it("yields the same code point count in the rendered stub as in the input", () => {
+    // The input name has 5 code points; every occurrence in the rendered
+    // stub (plain, capitalized, uppercase) must also have 5 code points.
+    const stub = webhookStubFor(name);
+    const inputLength = name.length; // 5 (iterable characters = code points)
+    expect(inputLength).toBe(5);
+
+    // Extract each expansion from the stub and verify the length.
+    const plainMatch = stub.match(/stub for (cafe\u0301)\./);
+    expect(plainMatch![1].length).toBe(inputLength);
+
+    const capMatch = stub.match(/handle(Cafe\u0301)Webhook/);
+    expect(capMatch![1].length).toBe(inputLength);
+
+    const secretMatch = stub.match(/phantom reveal (CAFE\u0301_WEBHOOK_SECRET)/);
+    // The secret is the uppercased name + _WEBHOOK_SECRET, so the name
+    // portion still has 5 code points.
+    const secretNamePart = secretMatch![1].replace("_WEBHOOK_SECRET", "");
+    expect(secretNamePart.length).toBe(inputLength);
+  });
+});
+
+describe("verificationHintFor — provider with combining character", () => {
+  it("returns the generic fallback without interpolating the provider name", () => {
+    // An unknown provider (including one with combining characters) hits
+    // the default branch, which returns a fixed string with no placeholders.
+    const name = "cafe\u0301";
+    const hint = verificationHintFor(name);
+    expect(hint).toBe("Verify per the provider's documented signature scheme.");
+    expect(hint).not.toContain(name);
+    expect(hint).not.toContain("${");
+  });
+});