@ashlr/stack 0.3.0 → 0.3.6

package/README.md

@@ -1,12 +1,12 @@
 # @ashlr/stack
 
-> The `stack` CLI — configure supported services with Phantom-backed credentials and MCP wiring. This source checkout registers 39 providers; use `stack providers` for your installed catalog.
+> The `stack` CLI — configure supported services with Phantom-backed credentials and MCP wiring. Use `stack providers` to inspect your installed catalog.
 
 Part of [Ashlr Stack](https://stack.ashlr.ai). See the monorepo at [ashlrai/ashlr-stack](https://github.com/ashlrai/ashlr-stack).
 
 ## What it is
 
-`stack` collapses the "spin up ten services" phase of a project into a single command. Instead of tab-hopping between Supabase, Vercel, Sentry, Neon, etc. to create projects and paste secrets into `.env`, you run:
+`stack` offers template-assisted setup for selected supported services. For example:
 
 ```bash
 stack init --template nextjs-supabase-posthog
@@ -31,17 +31,17 @@ irm https://stack.ashlr.ai/install.ps1 | iex
 Or install manually from the registry:
 
 ```bash
-bun add -g @ashlr/stack ashlr-stack-mcp    # preferred
-# or
 npm i -g @ashlr/stack ashlr-stack-mcp
+# or use Bun as the package manager
+bun add -g @ashlr/stack ashlr-stack-mcp
 ```
 
 Prerequisites:
 
-- [Bun](https://bun.sh) >= 1.2 for the published 0.1.1 CLI/MCP packages, including when launched with `npx`; npm does not supply Bun
+- Node.js >= 20 for this npm package, including with `npx`; check your installed package manifest. Source development uses [Bun](https://bun.sh).
 - [Phantom Secrets](https://phm.dev/secrets) — installed and initialized for the intended project before writing setup flows
 
-This README describes source version 0.2.1. Registry metadata checked on October 14, 2026 reported CLI/MCP version 0.1.1. Verify your installed `stack --version` and command `--help`; source qualification is separate from publication and provider acceptance.
+Verify your installed `stack --version` and command `--help`; available commands depend on the installed version. Package installation does not establish provider acceptance.
 
 ## Quickstart
 
@@ -72,7 +72,7 @@ stack exec -- bun dev
 
 ## Commands
 
-A cheat sheet for the current source interface:
+A guide to common commands; check your installed version's help for availability:
 
 | Command | What it does |
 | --- | --- |

package/dist/index.js

@@ -1490,9 +1490,9 @@ var init_stack_manifest = __esm(() => {
     schema_version: 1,
     kind: "ashlr-stack-manifest",
     components: Object.freeze([
-      Object.freeze({ id: "core", name: "@ashlr/stack-core", version: "0.3.0", distribution: "npm" }),
-      Object.freeze({ id: "cli", name: "@ashlr/stack", version: "0.3.0", distribution: "npm" }),
-      Object.freeze({ id: "mcp", name: "ashlr-stack-mcp", version: "0.3.0", distribution: "npm" }),
+      Object.freeze({ id: "core", name: "@ashlr/stack-core", version: "0.3.6", distribution: "npm" }),
+      Object.freeze({ id: "cli", name: "@ashlr/stack", version: "0.3.6", distribution: "npm" }),
+      Object.freeze({ id: "mcp", name: "ashlr-stack-mcp", version: "0.3.6", distribution: "npm" }),
       Object.freeze({
         id: "plugin",
         name: "stack",
@@ -1748,7 +1748,7 @@ async function exec(args, opts = {}) {
   return new Promise((resolvePromise, reject) => {
     const hasTimeout = typeof opts.timeoutMs === "number" && Number.isFinite(opts.timeoutMs);
     const useGroup = hasTimeout && !opts.interactive && process.platform !== "win32";
-    const child = spawn(binary, args, {
+    const child = spawnImpl(binary, args, {
       env,
       cwd: opts.cwd,
       stdio: opts.interactive ? "inherit" : ["pipe", "pipe", "pipe"],
@@ -1940,7 +1940,7 @@ function formatArgsForError(args) {
   });
   return redacted.join(" ");
 }
-var PhantomTimeoutError, cachedInstalled;
+var PhantomTimeoutError, cachedInstalled, spawnImpl;
 var init_phantom = __esm(() => {
   init_errors();
   init_phantom_process();
@@ -1950,6 +1950,7 @@ var init_phantom = __esm(() => {
       this.name = "PhantomTimeoutError";
     }
   };
+  spawnImpl = spawn;
 });
 // ../core/src/env.ts
 function resolveOAuthClientId(provider, envOverride) {
@@ -6663,7 +6664,7 @@ import { mkdir as mkdir3, writeFile as writeFile6 } from "node:fs/promises";
 import { dirname as dirname3, resolve as resolve8 } from "node:path";
 async function wirePhantomForRecipe(recipe, opts = {}) {
   const result = { present: [], missing: [], webhooks: [], skipped: [] };
-  if (opts.noWire)
+  if (opts.noWire || recipe.providers.length === 0)
     return result;
   const cwd = opts.cwd ?? process.cwd();
   try {
@@ -6784,7 +6785,10 @@ function signatureHeaderFor(provider) {
   }
 }
 function capitalize(s) {
-  return s.charAt(0).toUpperCase() + s.slice(1);
+  if (s === "")
+    return s;
+  const first = String.fromCodePoint(s.codePointAt(0));
+  return first.toUpperCase() + s.slice(first.length);
 }
 var WEBHOOK_PROVIDERS;
 var init_phantom_wire = __esm(() => {
@@ -9139,7 +9143,7 @@ var init_dist2 = __esm(() => {
     const e = i(true);
     return Object.keys(e);
   } });
-  t = typeof process < "u" && process.env && "development" || "";
+  t = typeof process < "u" && process.env && "production" || "";
   f2 = [["APPVEYOR"], ["AWS_AMPLIFY", "AWS_APP_ID", { ci: true }], ["AZURE_PIPELINES", "SYSTEM_TEAMFOUNDATIONCOLLECTIONURI"], ["AZURE_STATIC", "INPUT_AZURE_STATIC_WEB_APPS_API_TOKEN"], ["APPCIRCLE", "AC_APPCIRCLE"], ["BAMBOO", "bamboo_planKey"], ["BITBUCKET", "BITBUCKET_COMMIT"], ["BITRISE", "BITRISE_IO"], ["BUDDY", "BUDDY_WORKSPACE_ID"], ["BUILDKITE"], ["CIRCLE", "CIRCLECI"], ["CIRRUS", "CIRRUS_CI"], ["CLOUDFLARE_PAGES", "CF_PAGES", { ci: true }], ["CODEBUILD", "CODEBUILD_BUILD_ARN"], ["CODEFRESH", "CF_BUILD_ID"], ["DRONE"], ["DRONE", "DRONE_BUILD_EVENT"], ["DSARI"], ["GITHUB_ACTIONS"], ["GITLAB", "GITLAB_CI"], ["GITLAB", "CI_MERGE_REQUEST_ID"], ["GOCD", "GO_PIPELINE_LABEL"], ["LAYERCI"], ["HUDSON", "HUDSON_URL"], ["JENKINS", "JENKINS_URL"], ["MAGNUM"], ["NETLIFY"], ["NETLIFY", "NETLIFY_LOCAL", { ci: false }], ["NEVERCODE"], ["RENDER"], ["SAIL", "SAILCI"], ["SEMAPHORE"], ["SCREWDRIVER"], ["SHIPPABLE"], ["SOLANO", "TDDIUM"], ["STRIDER"], ["TEAMCITY", "TEAMCITY_VERSION"], ["TRAVIS"], ["VERCEL", "NOW_BUILDER"], ["VERCEL", "VERCEL", { ci: false }], ["VERCEL", "VERCEL_ENV", { ci: false }], ["APPCENTER", "APPCENTER_BUILD_ID"], ["CODESANDBOX", "CODESANDBOX_SSE", { ci: false }], ["CODESANDBOX", "CODESANDBOX_HOST", { ci: false }], ["STACKBLITZ"], ["STORMKIT"], ["CLEAVR"], ["ZEABUR"], ["CODESPHERE", "CODESPHERE_APP_ID", { ci: true }], ["RAILWAY", "RAILWAY_PROJECT_ID"], ["RAILWAY", "RAILWAY_SERVICE_ID"], ["DENO-DEPLOY", "DENO_DEPLOYMENT_ID"], ["FIREBASE_APP_HOSTING", "FIREBASE_APP_HOSTING", { ci: true }]];
   l = b();
   l.name;
@@ -11705,7 +11709,7 @@ var init_scan = __esm(() => {
       console.log();
       if (!isAuto) {
         const suggestion = filtered.map((h) => `stack add ${h.provider}`).join(`
-  `);
+    `);
         console.log(colors2.dim("  Next steps:"));
         console.log(colors2.dim(`    ${suggestion}
 `));
@@ -14515,6 +14519,8 @@ async function openFleetFile(path) {
 async function readFleetText(path, options = {}) {
   const { maxBytes = 16 * 1024 * 1024, tail = false, ioStatus = "invalid" } = options;
   try {
+    if (!Number.isSafeInteger(maxBytes) || maxBytes < 0)
+      throw new Error("Invalid byte limit");
     const file = await openFleetFile(path);
     try {
       const stat = await file.stat();
@@ -14529,7 +14535,27 @@ async function readFleetText(path, options = {}) {
 `);
         text = newline < 0 ? "" : chunk.slice(newline + 1);
       } else {
-        text = await file.readFile("utf8");
+        const initial = Math.min(64 * 1024, Math.max(1, stat.size), maxBytes);
+        let buffer = Buffer.alloc(initial);
+        let offset = 0;
+        for (;; ) {
+          if (offset === maxBytes) {
+            const probe = Buffer.alloc(1);
+            if ((await file.read(probe, 0, 1, offset)).bytesRead)
+              throw new Error("Oversized source");
+            break;
+          }
+          if (offset === buffer.length) {
+            const grown = Buffer.alloc(Math.min(maxBytes, buffer.length * 2));
+            buffer.copy(grown, 0, 0, offset);
+            buffer = grown;
+          }
+          const { bytesRead } = await file.read(buffer, offset, buffer.length - offset, offset);
+          if (!bytesRead)
+            break;
+          offset += bytesRead;
+        }
+        text = buffer.subarray(0, offset).toString("utf8");
       }
       return { status: "ok", text };
     } finally {
@@ -16074,7 +16100,10 @@ function serveFleet(paths, port) {
     hostname: "127.0.0.1",
     port,
     idleTimeout: 0,
-    fetch(request) {
+    fetch(request, server) {
+      const host = request.headers.get("host");
+      if (host !== `127.0.0.1:${server.port}` && host !== `localhost:${server.port}`)
+        return new Response("Forbidden", { status: 403 });
       if (new URL(request.url).pathname !== "/events")
         return new Response("Not found", { status: 404 });
       const abort = new AbortController;
@@ -18607,6 +18636,11 @@ var init_apply = __esm(() => {
         type: "boolean",
         default: false,
         description: "On partial failure, leave successfully-added services in .stack.toml instead of rolling them back."
+      },
+      dryRun: {
+        type: "boolean",
+        default: false,
+        description: "Preview provisioning and wiring without making changes."
       }
     },
     async run({ args }) {
@@ -18614,6 +18648,23 @@ var init_apply = __esm(() => {
       const recipe = await pickRecipe(args.recipeId ? String(args.recipeId) : undefined);
       if (!recipe)
         return;
+      if (args.dryRun) {
+        console.log(`  recipe   ${recipe.id}`);
+        await provisionProviders(recipe.providers, { rollback: false, dryRun: true });
+        if (!args.noWire) {
+          console.log("  Would check these secrets in Phantom and create applicable webhook stubs:");
+          for (const { name } of recipe.providers) {
+            const ref = findProviderRef(name);
+            if (!ref)
+              console.log(`    ${name}: unknown provider`);
+            else
+              for (const secret of ref.secrets)
+                console.log(`    ${name}: ${secret}`);
+          }
+        }
+        outro("Dry run complete — no changes made.");
+        return;
+      }
       if (!hasConfig()) {
         console.log(colors2.dim("  ○ no .stack.toml — auto-running `stack init --noInteractive`"));
         try {
@@ -18639,7 +18690,9 @@ var init_apply = __esm(() => {
           return;
         }
       }
-      await requirePhantom();
+      if (recipe.providers.length > 0) {
+        await requirePhantom();
+      }
       console.log();
       console.log(`  ${colors2.bold("recipe")}   ${recipe.id}`);
       console.log(`  ${colors2.dim("query")}    ${recipe.query}`);
@@ -19161,7 +19214,7 @@ var init_completion = __esm(() => {
       ]
     },
     apply: {
-      flags: [{ name: "noWire" }, { name: "noRollback" }]
+      flags: [{ name: "noWire" }, { name: "noRollback" }, { name: "dryRun" }]
     },
     swap: {
       completesProviders: true,
@@ -19262,7 +19315,7 @@ var package_default;
 var init_package = __esm(() => {
   package_default = {
     name: "@ashlr/stack",
-    version: "0.3.0",
+    version: "0.3.6",
     description: "Ashlr Stack CLI — the control plane for your entire dev stack. One command to provision, wire, and operate every third-party service in your project. 39 providers, MCP-native.",
     license: "MIT",
     author: {
@@ -19310,13 +19363,13 @@ var init_package = __esm(() => {
       node: ">=20"
     },
     scripts: {
-      build: `bun build src/index.ts --outdir dist --target node --format esm && node -e "const fs=require('fs');const f='dist/index.js';let c=fs.readFileSync(f,'utf8');if(c.startsWith('#!'))c=c.slice(c.indexOf('\\n')+1);fs.writeFileSync(f,'#!/usr/bin/env node\\n'+c);fs.chmodSync(f,0o755)"`,
+      build: `NODE_ENV=production bun build src/index.ts --outdir dist --target node --format esm && node -e "const fs=require('fs');const f='dist/index.js';let c=fs.readFileSync(f,'utf8');if(c.startsWith('#!'))c=c.slice(c.indexOf('\\n')+1);fs.writeFileSync(f,'#!/usr/bin/env node\\n'+c);fs.chmodSync(f,0o755)"`,
       prepack: "bun run build",
       dev: "bun run src/index.ts",
       typecheck: "bunx tsc --noEmit"
     },
     dependencies: {
-      "@ashlr/stack-core": "^0.3.0",
+      "@ashlr/stack-core": "^0.3.6",
       "@clack/prompts": "^0.8.2",
       citty: "^0.1.6",
       picocolors: "^1.1.1"
@@ -19802,7 +19855,7 @@ async function checkForUpdate(currentVersion, _cacheFile) {
 }
 
 // src/index.ts
-var VERSION = "0.3.0";
+var VERSION = "0.3.6";
 var main = defineCommand({
   meta: {
     name: "stack",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ashlr/stack",
-  "version": "0.3.0",
+  "version": "0.3.6",
   "description": "Ashlr Stack CLI — the control plane for your entire dev stack. One command to provision, wire, and operate every third-party service in your project. 39 providers, MCP-native.",
   "license": "MIT",
   "author": {
@@ -48,13 +48,13 @@
     "node": ">=20"
   },
   "scripts": {
-    "build": "bun build src/index.ts --outdir dist --target node --format esm && node -e \"const fs=require('fs');const f='dist/index.js';let c=fs.readFileSync(f,'utf8');if(c.startsWith('#!'))c=c.slice(c.indexOf('\\n')+1);fs.writeFileSync(f,'#!/usr/bin/env node\\n'+c);fs.chmodSync(f,0o755)\"",
+    "build": "NODE_ENV=production bun build src/index.ts --outdir dist --target node --format esm && node -e \"const fs=require('fs');const f='dist/index.js';let c=fs.readFileSync(f,'utf8');if(c.startsWith('#!'))c=c.slice(c.indexOf('\\n')+1);fs.writeFileSync(f,'#!/usr/bin/env node\\n'+c);fs.chmodSync(f,0o755)\"",
     "prepack": "bun run build",
     "dev": "bun run src/index.ts",
     "typecheck": "bunx tsc --noEmit"
   },
   "dependencies": {
-    "@ashlr/stack-core": "^0.3.0",
+    "@ashlr/stack-core": "^0.3.6",
     "@clack/prompts": "^0.8.2",
     "citty": "^0.1.6",
     "picocolors": "^1.1.1"