@aurorajs.dev/catalyst-cli 1.0.0

package/dist/templates/monorepo/scripts/business-rules/validate-citations.ts

@@ -0,0 +1,125 @@
+/**
+ * Validates `@rule BR-XXX-YYY-NNN` citations in source code against the
+ * business-rules index. Reports:
+ *
+ *  - Orphan citations: code references a rule ID that does not exist in the catalog.
+ *  - Zombie rules: an `activa` rule older than 30 days without any code citation.
+ *
+ * Citations are OPTIONAL. This script reports findings; it does not fail builds.
+ *
+ * Invoked via `pnpm br:validate:citations`.
+ */
+import { readFileSync, existsSync } from 'node:fs';
+import { resolve } from 'node:path';
+import fastGlob from 'fast-glob';
+import { findRepoRoot } from './parse-catalog';
+import type { CatalogIndex } from './types';
+
+const CITATION_PATTERN = /@rule\s+(BR-[A-Z0-9-]+)/g;
+const STALE_AGE_DAYS = 30;
+
+interface Citation {
+  ruleId: string;
+  filePath: string;
+  line: number;
+}
+
+async function findCitations(repoRoot: string): Promise<Citation[]> {
+  const patterns = ['backend/src/**/*.{ts,tsx}', 'frontend/src/**/*.{ts,tsx,html}'];
+  const files = await fastGlob(patterns, {
+    cwd: repoRoot,
+    absolute: true,
+    ignore: ['**/node_modules/**', '**/dist/**', '**/.angular/**'],
+  });
+  const citations: Citation[] = [];
+  for (const filePath of files) {
+    let content: string;
+    try {
+      content = readFileSync(filePath, 'utf-8');
+    } catch {
+      continue;
+    }
+    if (!content.includes('@rule')) continue;
+    const lines = content.split('\n');
+    for (let lineIdx = 0; lineIdx < lines.length; lineIdx++) {
+      const line = lines[lineIdx];
+      for (const m of line.matchAll(CITATION_PATTERN)) {
+        citations.push({
+          ruleId: m[1],
+          filePath,
+          line: lineIdx + 1,
+        });
+      }
+    }
+  }
+  return citations;
+}
+
+function loadIndex(repoRoot: string): CatalogIndex | null {
+  const path = resolve(repoRoot, 'cliter/business-rules-index.json');
+  if (!existsSync(path)) return null;
+  return JSON.parse(readFileSync(path, 'utf-8')) as CatalogIndex;
+}
+
+function daysSince(isoDate: string): number {
+  const then = new Date(isoDate).getTime();
+  const now = Date.now();
+  return Math.floor((now - then) / (1000 * 60 * 60 * 24));
+}
+
+async function main(): Promise<void> {
+  const repoRoot = findRepoRoot();
+  const index = loadIndex(repoRoot);
+  if (!index) {
+    console.error(
+      '✗ cliter/business-rules-index.json no existe. Ejecuta `pnpm br:generate` primero.',
+    );
+    process.exit(1);
+  }
+
+  const citations = await findCitations(repoRoot);
+  const orphans: Citation[] = [];
+  const cited = new Set<string>();
+  for (const c of citations) {
+    if (!index.byId[c.ruleId]) orphans.push(c);
+    else cited.add(c.ruleId);
+  }
+
+  const zombies: Array<{ ruleId: string; ageDays: number }> = [];
+  for (const rule of Object.values(index.byId)) {
+    if (rule.state !== 'active') continue;
+    if (cited.has(rule.id)) continue;
+    const age = daysSince(rule.last_updated);
+    if (age >= STALE_AGE_DAYS) {
+      zombies.push({ ruleId: rule.id, ageDays: age });
+    }
+  }
+
+  console.log('Citaciones encontradas:', citations.length);
+  console.log('Reglas con al menos una cita:', cited.size);
+
+  if (orphans.length > 0) {
+    console.log(`\n⚠ Citaciones huérfanas (${orphans.length}):`);
+    for (const o of orphans) {
+      console.log(`  - ${o.ruleId} en ${o.filePath}:${o.line}`);
+    }
+  } else {
+    console.log('\n✓ Sin citaciones huérfanas.');
+  }
+
+  if (zombies.length > 0) {
+    console.log(`\n⚠ Reglas zombi candidatas (${zombies.length}):`);
+    console.log(`  Reglas activas con > ${STALE_AGE_DAYS} días sin citas en código:`);
+    for (const z of zombies) {
+      console.log(`  - ${z.ruleId} (${z.ageDays} días)`);
+    }
+  } else {
+    console.log('\n✓ Sin reglas zombi.');
+  }
+}
+
+main().catch((err) => {
+  console.error('✗ validate-citations falló:');
+  console.error(err.message ?? err);
+  process.exit(1);
+});

package/dist/templates/pipeline/github/plesk/deploy.yml

@@ -0,0 +1,253 @@
+name: Deploy monorepo for Plesk
+
+on:
+  push:
+    branches:
+      - "environments/**"
+
+env:
+  NODE_VERSION: 24
+
+jobs:
+  resolve:
+    runs-on: ubuntu-latest
+    outputs:
+      env_prefix: ${{ steps.extract.outputs.env_prefix }}
+    steps:
+      - name: Extract environment from branch
+        id: extract
+        run: |
+          ENV_NAME="${GITHUB_REF_NAME#environments/}"
+          ENV_PREFIX="$(echo "$ENV_NAME" | tr '[:lower:]' '[:upper:]')_"
+          echo "env_prefix=$ENV_PREFIX" >> "$GITHUB_OUTPUT"
+
+  changes:
+    runs-on: ubuntu-latest
+    outputs:
+      backend: ${{ steps.detect.outputs.backend }}
+      frontend: ${{ steps.detect.outputs.frontend }}
+    steps:
+      - uses: actions/checkout@v6
+        with:
+          fetch-depth: 0
+
+      - name: Detect changed paths
+        id: detect
+        run: |
+          BEFORE="${{ github.event.before }}"
+          AFTER="${{ github.sha }}"
+          NULL_SHA="0000000000000000000000000000000000000000"
+
+          echo "before=$BEFORE"
+          echo "after=$AFTER"
+
+          # New branch → deploy everything
+          if [ "$BEFORE" = "$NULL_SHA" ]; then
+            echo "backend=true" >> "$GITHUB_OUTPUT"
+            echo "frontend=true" >> "$GITHUB_OUTPUT"
+            echo "First push — deploying all"
+            exit 0
+          fi
+
+          CHANGED=$(git diff --name-only "$BEFORE" "$AFTER")
+          echo "Changed files:"
+          echo "$CHANGED"
+
+          BACK=$(echo "$CHANGED" | grep -c '^backend/' || true)
+          FRONT=$(echo "$CHANGED" | grep -c '^frontend/' || true)
+
+          echo "backend=$( [ "$BACK" -gt 0 ] && echo true || echo false )" >> "$GITHUB_OUTPUT"
+          echo "frontend=$( [ "$FRONT" -gt 0 ] && echo true || echo false )" >> "$GITHUB_OUTPUT"
+
+  deploy-backend:
+    needs: [resolve, changes]
+    if: needs.changes.outputs.backend == 'true'
+    runs-on: ubuntu-latest
+    env:
+      SSH_PRIVATE_KEY: ${{ secrets[format('{0}SSH_PRIVATE_KEY', needs.resolve.outputs.env_prefix)] }}
+      SERVER_PORT: 22
+      SERVER_HOST: ${{ vars[format('{0}SERVER_HOST', needs.resolve.outputs.env_prefix)] }}
+      FTP_USERNAME: ${{ secrets[format('{0}FTP_USERNAME', needs.resolve.outputs.env_prefix)] }}
+      # example /var/www/vhosts/contoso.com
+      VHOST_PATH: ${{ vars[format('{0}VHOST_PATH', needs.resolve.outputs.env_prefix)] }}
+      BACK_OAUTH_PRIVATE_KEY: ${{ secrets[format('{0}BACK_OAUTH_PRIVATE_KEY', needs.resolve.outputs.env_prefix)] }}
+      BACK_OAUTH_PUBLIC_KEY: ${{ secrets[format('{0}BACK_OAUTH_PUBLIC_KEY', needs.resolve.outputs.env_prefix)] }}
+      BACK_DOT_ENV_ENC: ${{ vars[format('{0}BACK_DOT_ENV_ENC', needs.resolve.outputs.env_prefix)] }}
+      BACK_SOPS_AGE_SECRET_KEY: ${{ secrets[format('{0}BACK_SOPS_AGE_SECRET_KEY', needs.resolve.outputs.env_prefix)] }}
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v6
+
+      - name: Install pnpm
+        uses: pnpm/action-setup@v4
+
+      - name: Install node
+        uses: actions/setup-node@v6
+        with:
+          node-version: ${{ env.NODE_VERSION }}
+          cache: pnpm
+
+      - name: Install dependencies
+        run: pnpm install --frozen-lockfile
+
+      - name: Create OAuth keys
+        working-directory: backend
+        run: |
+          echo "$BACK_OAUTH_PRIVATE_KEY" > oauth-private.key
+          echo "$BACK_OAUTH_PUBLIC_KEY" > oauth-public.key
+
+      - name: Setup SOPS
+        uses: nhedger/setup-sops@v2
+
+      - name: Install age
+        run: |
+          sudo apt-get update
+          sudo apt-get install -y age
+
+      - name: Decrypt .env
+        working-directory: backend
+        run: |
+          SOPS_AGE_KEY="$BACK_SOPS_AGE_SECRET_KEY" sops --decrypt --input-type binary --output-type binary $BACK_DOT_ENV_ENC > .env
+
+      - name: Unit testing
+        working-directory: backend
+        run: pnpm --filter aurora-back test
+
+      - name: Acceptance testing
+        working-directory: backend
+        run: pnpm --filter aurora-back test:e2e
+
+      - name: Build project
+        run: pnpm --filter aurora-back build
+
+      - name: Copy graphQL files
+        working-directory: backend
+        run: |
+          mkdir -p ./dist/src/graphql
+          find ./src -name '*.graphql' -exec cp "{}" ./dist/src/graphql \;
+
+      - name: Prepare backend artifact
+        run: |
+          # Backend files (dist + package.json)
+          mkdir -p artifact/backend/dist artifact/backend/tmp
+          cp -r backend/dist/* artifact/backend/dist/
+          cp backend/package.json artifact/backend/
+          touch artifact/backend/tmp/restart.txt
+
+          # Workspace files (for pnpm to resolve dependencies)
+          mkdir -p artifact/workspace
+          cp package.json pnpm-lock.yaml pnpm-workspace.yaml .npmrc artifact/workspace/
+
+      - name: Output decrypted env
+        id: decrypt-env
+        working-directory: backend
+        run: |
+          dot_env_b64=$(SOPS_AGE_KEY="$BACK_SOPS_AGE_SECRET_KEY" sops --decrypt --input-type binary --output-type binary "$BACK_DOT_ENV_ENC" | base64 -w0)
+          printf 'dot_env_b64<<EOF\n%s\nEOF\n' "$dot_env_b64" >> "$GITHUB_OUTPUT"
+
+      # Backend app goes to httpdocs/backend/ (Passenger Application Root)
+      - name: Deploy backend via rsync
+        uses: burnett01/rsync-deployments@v8
+        with:
+          switches: -avzh --delete --exclude=".*"
+          path: artifact/backend/
+          remote_path: ${{ env.VHOST_PATH }}/httpdocs/backend
+          remote_host: ${{ env.SERVER_HOST }}
+          remote_port: ${{ env.SERVER_PORT }}
+          remote_user: ${{ env.FTP_USERNAME }}
+          remote_key: ${{ env.SSH_PRIVATE_KEY }}
+
+      # Workspace files go to httpdocs/ (pnpm workspace root)
+      - name: Deploy workspace files via rsync
+        uses: burnett01/rsync-deployments@v8
+        with:
+          switches: -avzh
+          path: artifact/workspace/
+          remote_path: ${{ env.VHOST_PATH }}/httpdocs
+          remote_host: ${{ env.SERVER_HOST }}
+          remote_port: ${{ env.SERVER_PORT }}
+          remote_user: ${{ env.FTP_USERNAME }}
+          remote_key: ${{ env.SSH_PRIVATE_KEY }}
+
+      - name: Setup backend on server
+        uses: appleboy/ssh-action@v1
+        env:
+          DOT_ENV_B64: ${{ steps.decrypt-env.outputs.dot_env_b64 }}
+        with:
+          host: ${{ env.SERVER_HOST }}
+          username: ${{ env.FTP_USERNAME }}
+          key: ${{ env.SSH_PRIVATE_KEY }}
+          port: ${{ env.SERVER_PORT }}
+          envs: DOT_ENV_B64, NODE_VERSION, BACK_OAUTH_PRIVATE_KEY,
+            BACK_OAUTH_PUBLIC_KEY
+          script: |
+            VHOST="${{ env.VHOST_PATH }}"
+            PATH=$PATH:$VHOST/.nodenv/shims:/opt/plesk/node/$NODE_VERSION/bin
+
+            # Node version
+            echo "$NODE_VERSION" > $VHOST/.node-version
+
+            # Storage symlink for public files
+            mkdir -p $VHOST/storage/app/public
+            ln -sfn $VHOST/storage/app/public $VHOST/httpdocs/backend/public
+
+            # OAuth keys
+            echo "$BACK_OAUTH_PRIVATE_KEY" > $VHOST/httpdocs/backend/oauth-private.key
+            echo "$BACK_OAUTH_PUBLIC_KEY" > $VHOST/httpdocs/backend/oauth-public.key
+
+            # .env in backend directory (where Passenger runs)
+            echo "$DOT_ENV_B64" | base64 -d > $VHOST/httpdocs/backend/.env
+
+            # Install production deps from workspace root
+            cd $VHOST/httpdocs && pnpm install --prod --filter aurora-back
+
+  deploy-frontend:
+    needs: [resolve, changes]
+    if: needs.changes.outputs.frontend == 'true'
+    runs-on: ubuntu-latest
+    env:
+      SSH_PRIVATE_KEY: ${{ secrets[format('{0}SSH_PRIVATE_KEY', needs.resolve.outputs.env_prefix)] }}
+      SERVER_PORT: 22
+      SERVER_HOST: ${{ vars[format('{0}SERVER_HOST', needs.resolve.outputs.env_prefix)] }}
+      FTP_USERNAME: ${{ secrets[format('{0}FTP_USERNAME', needs.resolve.outputs.env_prefix)] }}
+      # example /var/www/vhosts/contoso.com
+      VHOST_PATH: ${{ vars[format('{0}VHOST_PATH', needs.resolve.outputs.env_prefix)] }}
+      FRONT_ENV_CONFIGURATION: ${{ vars[format('{0}FRONT_ENV_CONFIGURATION', needs.resolve.outputs.env_prefix)] }}
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v6
+
+      - name: Install pnpm
+        uses: pnpm/action-setup@v4
+
+      - name: Install node
+        uses: actions/setup-node@v6
+        with:
+          node-version: ${{ env.NODE_VERSION }}
+          cache: pnpm
+
+      - name: Install & build
+        run: |
+          pnpm install --frozen-lockfile
+          pnpm --filter aurora-front build --configuration=${{ env.FRONT_ENV_CONFIGURATION }}
+
+      # - name: Unit testing
+      #   run: pnpm --filter aurora-front test
+
+      - name: Prepare frontend artifact
+        run: |
+          mkdir -p deployment
+          cp -r frontend/dist/fuse/browser/* deployment/
+
+      # Frontend static files go to httpdocs/frontend/
+      # Only rsync, no server restart needed — nginx serves static files directly
+      - name: Deploy frontend to httpdocs/frontend
+        uses: burnett01/rsync-deployments@v8
+        with:
+          switches: -avzh --delete --exclude=".*" --exclude="public"
+          path: deployment/
+          remote_path: ${{ env.VHOST_PATH }}/httpdocs/frontend
+          remote_host: ${{ env.SERVER_HOST }}
+          remote_port: ${{ env.SERVER_PORT }}
+          remote_user: ${{ env.FTP_USERNAME }}
+          remote_key: ${{ env.SSH_PRIVATE_KEY }}