@davidrydberg/proofy 0.0.0-stage → 0.1.0

package/dist/commands/home.js

@@ -0,0 +1,122 @@
+import { basename, join } from "node:path";
+import { loadConfig } from "../config.js";
+import { CliError } from "../errors.js";
+import { renderHome } from "../human.js";
+import { exists, findRoot, flowNames, orphanTests, pathsFor } from "../project.js";
+import { readApprovals } from "../run/approvals.js";
+import { flowStatuses, recentReports } from "../run/history.js";
+import { verdict } from "../run/report.js";
+const SETUP_ASK = 'Ask your agent: "set up proofy". It follows the Setup section of e2e/AGENTS.md';
+// Runs from session-start hooks: reads files only, never starts Docker, never exits non-zero.
+export async function homeCommand(deps) {
+    const root = await findRoot(deps.cwd);
+    const paths = pathsFor(root);
+    const project = basename(root);
+    if (!(await exists(paths.config))) {
+        return `proofy: not set up in ${project}. Run \`proofy init\` to add end-to-end tests your agent writes and you approve`;
+    }
+    let config;
+    try {
+        config = await loadConfig(paths.config, "e2e/proofy.json");
+    }
+    catch (error) {
+        if (!(error instanceof CliError))
+            throw error;
+        return { data: { project, config: `invalid: ${error.message}` }, help: error.suggestions, pretty: () => `proofy: ${project}: ${error.message}` };
+    }
+    const checks = await setupChecks(config, root);
+    const reports = await recentReports(paths);
+    let flows;
+    try {
+        flows = await flowStatuses(paths, config, await flowNames(paths), await readApprovals(paths), reports);
+    }
+    catch (error) {
+        if (!(error instanceof CliError))
+            throw error;
+        return { data: { project, approvals: `invalid: ${error.message}` }, help: error.suggestions };
+    }
+    const orphans = await orphanTests(paths);
+    const steps = nextSteps(checks, flows, orphans);
+    const last = reports[0];
+    const lastRun = last ? `${last.id} ${last.kind}: ${verdict(last)}` : "none";
+    const data = { project, setup: checks.map((check) => ({ item: check.label, ok: check.ok ? "yes" : "no", value: check.value })) };
+    data.flows = flows.length > 0 ? flows.map((flow) => ({ flow: flow.name, state: flow.state, detail: flow.reason ?? "" })) : "none";
+    if (orphans.length > 0)
+        data.tests_without_requirements = orphans;
+    data.last_run = lastRun;
+    return {
+        data,
+        help: steps.map(([command, description]) => (description ? `Run \`${command}\` ${description}` : command)),
+        json: { project, setup: checks, flows: flows.map(({ name, state, runs, reason }) => ({ name, state, runs, ...(reason ? { reason } : {}) })), testsWithoutRequirements: orphans, lastRun: last?.id ?? null },
+        pretty: (style) => renderHome({ project, checks, flows, orphans, lastRun }, steps, style),
+    };
+}
+async function setupChecks(config, root) {
+    const missingCompose = [];
+    for (const file of config.compose) {
+        if (!(await exists(join(root, file))))
+            missingCompose.push(file);
+    }
+    const fakes = Object.values(config.hosts).filter((mode) => mode === "fake").length;
+    const recorded = Object.values(config.hosts).length - fakes;
+    return [
+        {
+            label: "compose",
+            ok: config.compose.length > 0 && missingCompose.length === 0,
+            value: config.compose.length === 0 ? "no compose file yet" : missingCompose.length > 0 ? `missing ${missingCompose.join(", ")}` : config.compose.join(", "),
+        },
+        {
+            label: "app",
+            ok: config.app !== undefined,
+            value: config.app ? `http://${config.app.service}:${config.app.port}${config.app.path}` : "which service and port the browser opens",
+        },
+        {
+            label: "seed",
+            ok: true,
+            value: config.seed ? `${config.seed.service}: ${config.seed.command.join(" ")}` : "none, fine if the app starts with the data it needs",
+        },
+        {
+            label: "hosts",
+            ok: true,
+            value: Object.keys(config.hosts).length === 0 ? "none listed, every outside call is refused" : `${fakes} fake, ${recorded} recorded`,
+        },
+    ];
+}
+// The order is the onboarding: finish setup, then describe flows, then write tests, then prove them.
+function nextSteps(checks, flows, orphans) {
+    const steps = [];
+    const named = (state) => flows.filter((flow) => flow.state === state).map((flow) => flow.name);
+    const missing = checks.filter((check) => !check.ok).map((check) => check.label);
+    if (missing.length > 0) {
+        steps.push([`Setup is missing: ${missing.join(", ")}. ${SETUP_ASK}`, ""]);
+    }
+    if (flows.length === 0) {
+        steps.push(['Tell your agent what to test, in plain words: "add a proofy test: a guest can buy a product and gets a confirmation email"', ""]);
+    }
+    if (named("draft").length > 0) {
+        steps.push([`Ask your agent to write the tests for: ${named("draft").join(", ")} (step 4 in e2e/AGENTS.md)`, ""]);
+    }
+    for (const state of ["unproven", "unstable"]) {
+        const list = flows.filter((flow) => flow.state === state);
+        if (list.length > 0) {
+            const what = state === "unstable" ? "Fix the flaky tests in" : "Prove";
+            steps.push([`${what} ${list.map((flow) => `${flow.name} (${flow.reason ?? state})`).join(", ")}: \`proofy dev test <flow>\` until 3 runs match (step 5 in e2e/AGENTS.md)`, ""]);
+        }
+    }
+    const ready = [...named("ready"), ...flows.filter((flow) => flow.state === "out-of-date" && flow.runs.length === 3 && !flow.reason).map((flow) => flow.name)];
+    if (ready.length > 0) {
+        steps.push([`Ready for the human to approve: ${ready.map((name) => `\`proofy approve ${name}\``).join(", ")}. Agents never approve`, ""]);
+    }
+    const stale = flows.filter((flow) => flow.state === "out-of-date" && !ready.includes(flow.name)).map((flow) => flow.name);
+    if (stale.length > 0) {
+        steps.push([`Changed since approval: ${stale.join(", ")}. Prove them again with 3 matching runs, then the human approves again`, ""]);
+    }
+    if (orphans.length > 0) {
+        steps.push([`Tests without requirements: ${orphans.join(", ")}. Write e2e/specs/<flow>.md for each, or delete the test`, ""]);
+    }
+    if (named("approved").length > 0) {
+        steps.push(["proofy run --all", "to check every approved flow in a fresh sealed sandbox"]);
+    }
+    steps.push(["proofy --help", "for every command"]);
+    return steps;
+}

package/dist/commands/init.d.ts

@@ -0,0 +1,4 @@
+import type { Deps } from "../deps.js";
+import type { CommandResult } from "./types.js";
+export declare const INIT_HELP = "usage: proofy init [--no-agents-md]\ndescription: Writes e2e/ with agent instructions, templates and a config filled from what it finds. Never overwrites a file\nflags[1]:\n  --no-agents-md  Do not add the pointer line to the repository's AGENTS.md or CLAUDE.md\nexamples:\n  proofy init\n";
+export declare function initCommand(args: string[], deps: Deps): Promise<CommandResult>;

package/dist/commands/init.js

@@ -0,0 +1,122 @@
+import { appendFile, copyFile, mkdir, readdir, readFile, writeFile } from "node:fs/promises";
+import { dirname, join, relative } from "node:path";
+import { fileURLToPath } from "node:url";
+import { parseArgs } from "../args.js";
+import { SCHEMA_URL } from "../config.js";
+import { renderInit } from "../human.js";
+import { COMPOSE_NAMES, detectCompose, detectEnv } from "../detect.js";
+import { exists, findRoot, pathsFor } from "../project.js";
+export const INIT_HELP = `usage: proofy init [--no-agents-md]
+description: Writes e2e/ with agent instructions, templates and a config filled from what it finds. Never overwrites a file
+flags[1]:
+  --no-agents-md  Do not add the pointer line to the repository's AGENTS.md or CLAUDE.md
+examples:
+  proofy init
+`;
+const TEMPLATES = fileURLToPath(new URL("../../templates/", import.meta.url));
+const POINTER = "End-to-end tests: read `e2e/AGENTS.md` before writing or changing anything under `e2e/`, and before changing a flow it covers.";
+const IGNORE = "e2e/out/";
+export async function initCommand(args, deps) {
+    const flags = parseArgs(args, { values: [], booleans: ["no-agents-md"] }, "init");
+    const root = await initRoot(deps.cwd);
+    const paths = pathsFor(root);
+    const written = [];
+    const skipped = [];
+    const found = [];
+    const compose = await detectCompose(root);
+    const env = await detectEnv(root);
+    if (compose) {
+        found.push(`${compose.file}: services ${compose.services.join(", ") || "none"}`);
+        found.push(compose.app ? `app: likely ${compose.app.service} on port ${compose.app.port}` : "app: no service with a port, your agent picks one");
+    }
+    else {
+        found.push("no compose file: your agent drafts one during setup");
+    }
+    if (env) {
+        found.push(`${env.file}: ${Object.keys(env.values).length} settings, ${env.replaced} secret-looking values replaced with fakes`);
+    }
+    const config = { $schema: SCHEMA_URL, compose: compose ? [compose.file] : [] };
+    if (compose?.app) {
+        config.app = { service: compose.app.service, port: compose.app.port, path: "/" };
+        if (env)
+            config.env = { [compose.app.service]: env.values };
+    }
+    config.hosts = {};
+    const write = async (file, content) => {
+        const label = relative(root, file);
+        if (await exists(file)) {
+            skipped.push(label);
+            return;
+        }
+        await mkdir(dirname(file), { recursive: true });
+        if (typeof content === "string")
+            await writeFile(file, content);
+        else
+            await content();
+        written.push(label);
+    };
+    await write(paths.config, `${JSON.stringify(config, null, 2)}\n`);
+    for (const file of await listFiles(TEMPLATES)) {
+        const source = join(TEMPLATES, file);
+        await write(join(root, file), () => copyFile(source, join(root, file)));
+    }
+    for (const dir of [paths.specs, paths.tests, paths.standins]) {
+        await mkdir(dir, { recursive: true });
+    }
+    if (await addLine(join(root, ".gitignore"), IGNORE))
+        written.push(".gitignore (e2e/out/)");
+    let pointer = "skipped (--no-agents-md)";
+    if (!flags.booleans.has("no-agents-md")) {
+        const target = (await exists(join(root, "AGENTS.md"))) || !(await exists(join(root, "CLAUDE.md"))) ? "AGENTS.md" : "CLAUDE.md";
+        pointer = (await addLine(join(root, target), POINTER)) ? `added to ${target}` : `already in ${target}`;
+        if (pointer.startsWith("added"))
+            written.push(`${target} (pointer to e2e/AGENTS.md)`);
+    }
+    const hints = [
+        ['Next, ask your agent: "set up proofy". It reads e2e/AGENTS.md, checks the app starts in Docker and fills in the rest of e2e/proofy.json', ""],
+        ['Then tell it what to test, in plain words: "add a proofy test: a guest can buy a product"', ""],
+        ["proofy", "see setup progress and the next step at any time"],
+    ];
+    return {
+        data: { root, found, written, kept: skipped, agents_md_pointer: pointer },
+        help: hints.map(([command, description]) => (description ? `Run \`${command}\` to ${description}` : command)),
+        pretty: (style) => renderInit({ root, found, written, skipped }, hints, style),
+    };
+}
+/** An existing proofy project, else the folder you are in when it has a compose file (an app in a monorepo), else the repository root. */
+async function initRoot(cwd) {
+    const found = await findRoot(cwd);
+    if (await exists(pathsFor(found).config))
+        return found;
+    for (const name of COMPOSE_NAMES) {
+        if (await exists(join(cwd, name)))
+            return cwd;
+    }
+    return found;
+}
+/** Appends a line unless the file already has it. Returns whether it wrote. */
+async function addLine(file, line) {
+    let current = "";
+    try {
+        current = await readFile(file, "utf8");
+    }
+    catch {
+        // A missing file is created.
+    }
+    if (current.split(/\r?\n/).some((existing) => existing.trim() === line))
+        return false;
+    const separator = current === "" || current.endsWith("\n") ? "" : "\n";
+    await appendFile(file, `${separator}${current === "" ? "" : "\n"}${line}\n`);
+    return true;
+}
+async function listFiles(dir, prefix = "") {
+    const out = [];
+    for (const entry of await readdir(join(dir, prefix), { withFileTypes: true })) {
+        const path = join(prefix, entry.name);
+        if (entry.isDirectory())
+            out.push(...(await listFiles(dir, path)));
+        else
+            out.push(path);
+    }
+    return out.sort();
+}

package/dist/commands/report.d.ts

@@ -0,0 +1,4 @@
+import type { Deps } from "../deps.js";
+import type { CommandResult } from "./types.js";
+export declare const REPORT_HELP = "usage: proofy report [run]\ndescription: Shows a past run, the latest by default. The full report with evidence and screenshots is e2e/out/<run>/report.md\nexamples:\n  proofy report\n  proofy report 20261020-142233\n";
+export declare function reportCommand(args: string[], deps: Deps): Promise<CommandResult>;

package/dist/commands/report.js

@@ -0,0 +1,26 @@
+import { join } from "node:path";
+import { parseArgs } from "../args.js";
+import { CliError } from "../errors.js";
+import { outDir, readReport, runIds } from "../run/history.js";
+import { loadProject } from "./context.js";
+import { runResult } from "./run.js";
+export const REPORT_HELP = `usage: proofy report [run]
+description: Shows a past run, the latest by default. The full report with evidence and screenshots is e2e/out/<run>/report.md
+examples:
+  proofy report
+  proofy report 20261020-142233
+`;
+export async function reportCommand(args, deps) {
+    const { positionals } = parseArgs(args, { values: [], booleans: [] }, "report");
+    const project = await loadProject(deps);
+    const ids = await runIds(project.paths);
+    const id = positionals[0] ?? ids.at(-1);
+    if (!id)
+        throw new CliError("No runs yet", "VALIDATION_ERROR", ["Run `proofy run <flow>` or `proofy dev test <flow>`"]);
+    const report = await readReport(project.paths, id);
+    if (!report)
+        throw new CliError(`No run ${id}`, "VALIDATION_ERROR", [`Runs: ${ids.slice(-5).join(", ") || "none"}`]);
+    const result = runResult(report, join(outDir(project.paths), id), project.root);
+    // Showing a report is not running it: the verdict is in the output, the command itself succeeded.
+    return { ...result, exitCode: 0 };
+}

package/dist/commands/run.d.ts

@@ -0,0 +1,6 @@
+import type { Deps } from "../deps.js";
+import type { RunReport } from "../run/results.js";
+import type { CommandResult } from "./types.js";
+export declare const RUN_HELP = "usage: proofy run [flow ...] [--all] [--pr <number>] [--post] [--keep]\ndescription: One sealed run: a fresh sandbox with no way out, the tests, a report per requirement, teardown\nflags[4]:\n  --all  Every approved flow\n  --pr <number>  Test a pull request's code, exported to a cache folder; the working copy is never touched\n  --post  Post the report on the pull request (--pr, or the current branch's), screenshots on the proofy-reports branch\n  --keep  Leave the sandbox running afterwards\nexit_codes[4]:\n  0  Every requirement of every approved flow held\n  1  A requirement of an approved flow did not hold: a finding about the app\n  3  Environment failure: the sandbox did not work\n  4  Some flows that ran are not approved, so the result is not trusted\nexamples:\n  proofy run guest-checkout\n  proofy run --all\n  proofy run --all --pr 42 --post\n";
+export declare function runCommand(args: string[], deps: Deps): Promise<CommandResult>;
+export declare function runResult(report: RunReport, runDir: string, root: string, posted?: string): CommandResult;

package/dist/commands/run.js

@@ -0,0 +1,166 @@
+import { mkdir, readFile, rm, writeFile } from "node:fs/promises";
+import { join, relative } from "node:path";
+import { parseArgs } from "../args.js";
+import { loadConfig } from "../config.js";
+import { CliError } from "../errors.js";
+import { exportPullRequest, postReport, pullRequest } from "../github.js";
+import { renderRun } from "../human.js";
+import { exists, flowNames, gitRoot, pathsFor } from "../project.js";
+import { planFlows, sealedRun } from "../run/engine.js";
+import { outDir } from "../run/history.js";
+import { EXIT_FOR, verdict } from "../run/report.js";
+import { loadProject, projectName, workingTreeInfo } from "./context.js";
+export const RUN_HELP = `usage: proofy run [flow ...] [--all] [--pr <number>] [--post] [--keep]
+description: One sealed run: a fresh sandbox with no way out, the tests, a report per requirement, teardown
+flags[4]:
+  --all  Every approved flow
+  --pr <number>  Test a pull request's code, exported to a cache folder; the working copy is never touched
+  --post  Post the report on the pull request (--pr, or the current branch's), screenshots on the proofy-reports branch
+  --keep  Leave the sandbox running afterwards
+exit_codes[4]:
+  0  Every requirement of every approved flow held
+  1  A requirement of an approved flow did not hold: a finding about the app
+  3  Environment failure: the sandbox did not work
+  4  Some flows that ran are not approved, so the result is not trusted
+examples:
+  proofy run guest-checkout
+  proofy run --all
+  proofy run --all --pr 42 --post
+`;
+export async function runCommand(args, deps) {
+    const flags = parseArgs(args, { values: ["pr"], booleans: ["all", "post", "keep"] }, "run");
+    const prNumber = flags.values.has("pr") ? prArg(flags.values.get("pr") ?? "") : undefined;
+    if (flags.positionals.length === 0 && !flags.booleans.has("all")) {
+        throw new CliError("Name the flows to run, or use --all for every approved flow", "VALIDATION_ERROR", ["Run `proofy` to see flows and their states"]);
+    }
+    const project = await loadProject(deps);
+    const { root, paths } = project;
+    let source = paths;
+    let config = project.config;
+    let pr;
+    let sourceInfo;
+    if (prNumber !== undefined) {
+        pr = await pullRequest(deps.proc, root, prNumber);
+        const dir = join(project.cacheDir, "pull-requests", String(pr.number));
+        deps.log(`exporting pull request #${pr.number} (${pr.sha.slice(0, 12)})`);
+        // The project can sit in a subfolder of the repository; the export holds the whole repository.
+        const top = (await gitRoot(root)) ?? root;
+        await exportPullRequest(deps.proc, top, pr, dir);
+        source = pathsFor(join(dir, relative(top, root)));
+        if (await exists(source.config))
+            config = await loadConfig(source.config, `e2e/proofy.json in PR #${pr.number}`);
+        sourceInfo = { commit: pr.sha, pr: pr.number };
+    }
+    else {
+        sourceInfo = await workingTreeInfo(deps, root);
+    }
+    const available = await flowNames(source);
+    const ctx = { proc: deps.proc, env: deps.env, now: deps.now, log: deps.log, base: paths, source, config, approvals: project.approvals, cacheDir: project.cacheDir, sourceInfo };
+    const names = flags.positionals;
+    for (const name of names) {
+        if (!available.includes(name)) {
+            throw new CliError(`No flow named ${name}: e2e/specs/${name}.md does not exist`, "VALIDATION_ERROR", [`Flows: ${available.join(", ") || "none yet"}`]);
+        }
+        if (!(await exists(join(source.tests, `${name}.spec.ts`)))) {
+            throw new CliError(`${name} has requirements but no test yet`, "VALIDATION_ERROR", ["Ask your agent to write it (step 4 in e2e/AGENTS.md)"]);
+        }
+    }
+    let planned = await planFlows(ctx, names);
+    if (flags.booleans.has("all")) {
+        const all = await planFlows(ctx, available.filter((name) => !names.includes(name)));
+        const approved = all.filter((flow) => flow.approved);
+        planned = [...planned, ...approved];
+        if (planned.length === 0) {
+            throw new CliError(pr ? `No flow in PR #${pr.number} matches its approval: none were approved, or the PR changed them` : "No flow is approved yet", "NOT_APPROVED", ["Run `proofy` to see each flow's state", "Run named flows to prove them: `proofy run <flow>`"]);
+        }
+    }
+    const lock = await takeLock(paths);
+    const ignore = () => deps.log("stopping: tearing down the sandbox first");
+    process.on("SIGINT", ignore);
+    let report;
+    try {
+        report = await sealedRun(ctx, planned, { keep: flags.booleans.has("keep"), project: projectName(root, `run-${deps.now().getTime().toString(36)}`) });
+    }
+    finally {
+        process.off("SIGINT", ignore);
+        await rm(lock, { force: true });
+    }
+    const runDir = join(outDir(paths), report.id);
+    let posted;
+    if (flags.booleans.has("post")) {
+        const target = pr ?? (await pullRequest(deps.proc, root));
+        deps.log(`posting the report on pull request #${target.number}`);
+        posted = await postReport(deps.proc, root, target, report, runDir, join(project.cacheDir, "post"));
+    }
+    return runResult(report, runDir, root, posted);
+}
+export function runResult(report, runDir, root, posted) {
+    const result = verdict(report);
+    const relative = runDir.startsWith(root) ? runDir.slice(root.length + 1) : runDir;
+    const failed = report.flows.flatMap((flow) => flow.requirements
+        .filter((requirement) => requirement.result === "fail" || requirement.result === "not-reached")
+        .map((requirement) => ({ flow: flow.name, req: requirement.id, expected: requirement.expected ?? "", actual: requirement.actual ?? requirement.result })));
+    const hints = [];
+    if (result === "environment")
+        hints.push([`Read ${relative}/sandbox.log and fix the sandbox setup; this run says nothing about the app`, ""]);
+    if (failed.length > 0)
+        hints.push([`Read ${relative}/report.md: decide per red requirement whether the app, the test, a fake or the requirement is wrong (e2e/AGENTS.md)`, ""]);
+    const untrusted = report.flows.filter((flow) => !flow.approved).map((flow) => flow.name);
+    if (untrusted.length > 0 && result !== "environment")
+        hints.push([`Not approved: ${untrusted.join(", ")}. Run \`proofy\` to see whether they are ready for the human to approve`, ""]);
+    hints.push([`proofy report ${report.id}`, "show this run again"]);
+    const data = {
+        run: report.id,
+        verdict: result,
+        report: `${relative}/report.md`,
+        flows: report.flows.map((flow) => ({ flow: flow.name, approved: flow.approved ? "yes" : "no", status: flow.status, failed: flow.requirements.filter((r) => r.result === "fail" || r.result === "not-reached").length })),
+    };
+    if (report.environmentError)
+        data.environment_error = report.environmentError.split("\n")[0];
+    if (failed.length > 0)
+        data.failed = failed;
+    const refused = report.outside.filter((call) => call.handledAs === "refused");
+    if (refused.length > 0)
+        data.refused_hosts = refused.map((call) => call.host);
+    if (report.notes.length > 0)
+        data.notes = report.notes;
+    if (posted)
+        data.posted = posted;
+    return {
+        data,
+        help: hints.map(([command, description]) => (description ? `Run \`${command}\` to ${description}` : command)),
+        json: { ...report, verdict: result, reportFile: `${relative}/report.md`, ...(posted ? { posted } : {}) },
+        pretty: (style) => renderRun(report, result, relative, hints, style, posted),
+        exitCode: EXIT_FOR[result],
+    };
+}
+async function takeLock(paths) {
+    const file = join(outDir(paths), ".run.lock");
+    await mkdir(outDir(paths), { recursive: true });
+    try {
+        await writeFile(file, String(process.pid), { flag: "wx" });
+    }
+    catch {
+        const pid = Number(await readFile(file, "utf8").catch(() => "0"));
+        if (pid > 0 && alive(pid)) {
+            throw new CliError(`Another proofy run is in progress (process ${pid})`, "ENVIRONMENT_ERROR", ["Wait for it to finish; only one run at a time"]);
+        }
+        await writeFile(file, String(process.pid));
+    }
+    return file;
+}
+function alive(pid) {
+    try {
+        process.kill(pid, 0);
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+function prArg(value) {
+    const number = Number(value);
+    if (!Number.isInteger(number) || number < 1)
+        throw new CliError("--pr needs a pull request number", "VALIDATION_ERROR", ["Example: proofy run --all --pr 42"]);
+    return number;
+}

package/dist/commands/types.d.ts

@@ -0,0 +1,8 @@
+import type { Result } from "../output.js";
+import type { Style } from "../style.js";
+export interface CommandResult extends Result {
+    json?: unknown;
+    pretty?: (style: Style) => string;
+    /** Set by commands whose result is a verdict, such as run; 0 otherwise. */
+    exitCode?: number;
+}

package/dist/commands/types.js

@@ -0,0 +1 @@
+export {};

package/dist/config.d.ts

@@ -0,0 +1,34 @@
+import { z } from "zod";
+export declare const SCHEMA_URL = "https://unpkg.com/@davidrydberg/proofy/schema/proofy.schema.json";
+export declare const configSchema: z.ZodObject<{
+    $schema: z.ZodOptional<z.ZodString>;
+    compose: z.ZodDefault<z.ZodArray<z.ZodString>>;
+    app: z.ZodOptional<z.ZodObject<{
+        service: z.ZodString;
+        port: z.ZodNumber;
+        path: z.ZodDefault<z.ZodString>;
+    }, z.core.$strict>>;
+    seed: z.ZodOptional<z.ZodObject<{
+        service: z.ZodString;
+        command: z.ZodArray<z.ZodString>;
+    }, z.core.$strict>>;
+    exec: z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodObject<{
+        service: z.ZodString;
+        command: z.ZodArray<z.ZodString>;
+    }, z.core.$strict>>>;
+    hosts: z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodEnum<{
+        record: "record";
+        fake: "fake";
+    }>>>;
+    assets: z.ZodDefault<z.ZodArray<z.ZodURL>>;
+    env: z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodRecord<z.ZodString, z.ZodString>>>;
+    limits: z.ZodPrefault<z.ZodObject<{
+        startMinutes: z.ZodDefault<z.ZodNumber>;
+        testMinutes: z.ZodDefault<z.ZodNumber>;
+        maxRunMinutes: z.ZodOptional<z.ZodNumber>;
+        parallel: z.ZodDefault<z.ZodNumber>;
+    }, z.core.$strict>>;
+}, z.core.$strict>;
+export type Config = z.infer<typeof configSchema>;
+export declare function parseConfig(raw: string, file: string): Config;
+export declare function loadConfig(file: string, label: string): Promise<Config>;

package/dist/config.js

@@ -0,0 +1,62 @@
+import { readFile } from "node:fs/promises";
+import { z } from "zod";
+import { CliError } from "./errors.js";
+export const SCHEMA_URL = "https://unpkg.com/@davidrydberg/proofy/schema/proofy.schema.json";
+const name = z.string().min(1);
+const command = z.array(z.string().min(1)).min(1).describe("Command and arguments, run without a shell");
+const hostname = z
+    .string()
+    .regex(/^(?=.{1,253}$)([a-z0-9]([a-z0-9-]*[a-z0-9])?\.)+[a-z]{2,63}$/, "must be a lowercase hostname like api.stripe.com");
+const serviceCommand = z.strictObject({ service: name.describe("Compose service to run it in"), command });
+export const configSchema = z
+    .strictObject({
+    $schema: z.string().optional(),
+    compose: z.array(name).default([]).describe("The app's compose files, relative to the repository root"),
+    app: z
+        .strictObject({
+        service: name.describe("Compose service the browser opens"),
+        port: z.number().int().min(1).max(65535).describe("Port inside the container, not a published port"),
+        path: z.string().startsWith("/").default("/"),
+    })
+        .optional()
+        .describe("Where the browser starts"),
+    seed: serviceCommand.optional().describe("Runs once on the empty database before the tests"),
+    exec: z.record(name, serviceCommand).default({}).describe("Commands tests may run with exec(name), such as a scheduled job"),
+    hosts: z
+        .record(hostname, z.enum(["fake", "record"]))
+        .default({})
+        .describe("Outside hosts: fake answers from e2e/standins/<host>.mjs, record accepts everything. Unlisted hosts are refused"),
+    assets: z.array(z.url()).default([]).describe("Static third-party files downloaded at install and served in the sealed run"),
+    env: z.record(name, z.record(name, z.string())).default({}).describe("Settings per compose service. The repository's .env is never read"),
+    limits: z
+        .strictObject({
+        startMinutes: z.number().positive().default(10),
+        testMinutes: z.number().positive().default(5),
+        maxRunMinutes: z.number().positive().optional(),
+        parallel: z.number().int().min(1).default(4),
+    })
+        .prefault({}),
+})
+    .describe("proofy configuration, e2e/proofy.json");
+export function parseConfig(raw, file) {
+    let json;
+    try {
+        json = JSON.parse(raw);
+    }
+    catch (error) {
+        throw invalid(`${file} is not valid JSON: ${error.message}`);
+    }
+    const result = configSchema.safeParse(json);
+    if (!result.success) {
+        const issue = result.error.issues[0];
+        const where = issue && issue.path.length > 0 ? issue.path.join(".") : "(root)";
+        throw invalid(`${file}: ${where}: ${issue?.message ?? "invalid"}`);
+    }
+    return result.data;
+}
+export async function loadConfig(file, label) {
+    return parseConfig(await readFile(file, "utf8"), label);
+}
+function invalid(message) {
+    return new CliError(message, "CONFIG_INVALID", [`Fix it, then run \`proofy\` to check. Every field is described in ${SCHEMA_URL}`]);
+}

package/dist/deps.d.ts

@@ -0,0 +1,10 @@
+import type { Proc } from "./sandbox/docker.js";
+export interface Deps {
+    cwd: string;
+    env: NodeJS.ProcessEnv;
+    /** Runs docker, git and gh. Tests inject a fake. */
+    proc: Proc;
+    now: () => Date;
+    /** Progress lines for long commands. Goes to stderr, so stdout stays one clean result. */
+    log: (line: string) => void;
+}

package/dist/deps.js

@@ -0,0 +1 @@
+export {};

package/dist/detect.d.ts

@@ -0,0 +1,17 @@
+export declare const COMPOSE_NAMES: string[];
+export interface ComposeGuess {
+    file: string;
+    services: string[];
+    app?: {
+        service: string;
+        port: number;
+    };
+}
+export interface EnvGuess {
+    file: string;
+    values: Record<string, string>;
+    replaced: number;
+}
+export declare function detectCompose(root: string): Promise<ComposeGuess | undefined>;
+/** Reads .env.example so the sandbox gets the same setting names; secret-looking values become obvious fakes. */
+export declare function detectEnv(root: string): Promise<EnvGuess | undefined>;