@elia97/officina 0.10.0 → 0.12.0

package/dist/checks/secrets.js

@@ -0,0 +1,46 @@
+#!/usr/bin/env node
+import { readFileSync } from 'node:fs';
+import process from 'node:process';
+import { parseArgs } from 'node:util';
+import { cliOptions, exitCode, missingInput, printFindings } from '../lib/cli.js';
+import { envSchema } from '../lib/env-schema.js';
+import { filesWithExtension } from '../lib/routes.js';
+import { canaryLines, scanSecrets, secretFields } from '../lib/secrets.js';
+const SCHEMA = 'astro.config.mjs';
+const DIST = 'dist/client';
+const ADVICE = 'Una chiave server e secret si legge solo nel codice che gira sul server: segui la strada che la porta nel file nominato';
+function check(keys) {
+    const counted = keys.length === 1 ? '1 chiave' : `${keys.length} chiavi`;
+    console.log(`\ncheck:secrets — ${counted} server e secret di env.schema, cercate in ${DIST}\n`);
+    if (keys.length === 0) {
+        console.log('  Nessuna chiave segreta nello schema: niente da verificare.\n');
+        return 0;
+    }
+    if (missingInput(DIST, 'è la build in cui si cercano le chiavi: prima `pnpm build`'))
+        return 1;
+    const files = filesWithExtension(DIST, '');
+    if (files.length === 0) {
+        console.error(`\n✗ ${DIST} è vuota: senza file il controllo non afferma niente.\n`);
+        return 1;
+    }
+    const { findings, verified } = scanSecrets(keys, process.env, files, (path) => readFileSync(path));
+    printFindings(findings, cliOptions([]).format);
+    if (verified.length > 0)
+        console.log(`  Verificate: ${verified.join(', ')}.`);
+    if (findings.some(({ severity }) => severity === 'error'))
+        console.log(`\n  ${ADVICE}.\n`);
+    return exitCode(findings, false);
+}
+export function main(args = process.argv.slice(2)) {
+    const { canaries } = parseArgs({ args, options: { canaries: { type: 'boolean', default: false } } }).values;
+    if (missingInput(SCHEMA, 'le chiavi segrete stanno nel suo `env.schema`'))
+        return 1;
+    const secrets = secretFields(envSchema(readFileSync(SCHEMA, 'utf8')));
+    if (!canaries)
+        return check(secrets.map(({ key }) => key));
+    for (const line of canaryLines(secrets))
+        console.log(line);
+    return 0;
+}
+if (import.meta.main)
+    process.exit(main());

package/dist/checks/smoke.js

@@ -1,26 +1,38 @@
 #!/usr/bin/env node
 // L'unico controllo che vede cosa serve davvero il bordo: i test del progetto fissano solo vercel.json.
+import { existsSync, readFileSync } from 'node:fs';
 import process from 'node:process';
+import { readManifest } from '../lib/alignment.js';
 import { missingInput } from '../lib/cli.js';
-import { isRequired, loadConfig } from '../lib/config.js';
+import { isOn, isRequired, loadConfig } from '../lib/config.js';
 import { expectedRoutes, readPageFiles, smokeRoutes } from '../lib/routes.js';
+import { onDemandPages } from '../lib/smoke-on-demand.js';
 import { runChecks, SECURITY_HEADERS, waitForAlias, } from '../lib/smoke-production.js';
 const PAGES_DIR = 'src/pages';
+const projectFile = (path) => (existsSync(path) ? readFileSync(path, 'utf8') : undefined);
 function printResults(results) {
     for (const { check, status, detail } of results) {
         if (status === 'pass')
             console.log(`✓ ${check}`);
         else if (status === 'skip')
             console.log(`- ${check} (saltato: ${detail})`);
+        else if (status === 'warn')
+            console.log(`· ${check} — ${detail}`);
         else
             console.error(`✗ ${check} — ${detail}`);
     }
 }
-function printFailures(failures) {
+const disabledResults = ({ disabled }) => disabled.map(({ label }) => ({ check: `pagina ${label}`, status: 'skip', detail: 'spenta da `routes.disabled`' }));
+function printFailures(failures, database) {
     console.error(`\n✗ ${failures.length} controllo/i falliti:`);
     console.error(`${failures.map(({ check, detail }) => `  - ${check} — ${detail}`).join('\n')}\n`);
     console.error('La produzione è online e rotta. Torna indietro dalla dashboard di Vercel:');
     console.error('Deployments → l’ultimo deployment di produzione sano → Promote to Production.\n');
+    if (!database)
+        return;
+    console.error('Con un database lo schema non torna indietro: le migrazioni già applicate restano,');
+    console.error('e il deployment che promuovi regge solo se sono compatibili con il suo codice.');
+    console.error('La regola è nel README di officina: «Migrazioni compatibili con la produzione».\n');
 }
 export async function main(args = []) {
     const config = await loadConfig(process.cwd());
@@ -45,17 +57,22 @@ export async function main(args = []) {
     };
     if (missingInput(PAGES_DIR, 'le rotte da visitare si derivano da lì'))
         return 1;
-    const expected = expectedRoutes(readPageFiles(PAGES_DIR), PAGES_DIR);
+    const expected = expectedRoutes(readPageFiles(PAGES_DIR), PAGES_DIR, routes.disabled);
     const pages = smokeRoutes(expected, smoke.nonHtmlRoutes, routes.representatives);
     console.log(`\nSmoke di produzione — ${baseUrl}\n`);
     await waitForAlias(context, (ms) => new Promise((resolve) => setTimeout(resolve, ms)));
-    const results = await runChecks(context, pages, smoke.checks);
-    printResults(results);
+    const onDemand = onDemandPages(expected, PAGES_DIR, routes.representatives);
+    const results = await runChecks({ ...context, onDemand }, pages, smoke.checks);
+    printResults([...results, ...disabledResults(expected)]);
     const failures = results.filter(({ status }) => status === 'fail');
     if (failures.length > 0) {
-        printFailures(failures);
+        printFailures(failures, isOn(config, readManifest({ read: projectFile }), 'database'));
         return 1;
     }
+    const warnings = results.filter(({ status }) => status === 'warn').length;
+    // TODO: dalla 0.13.0 le anomalie a richiesta sono `fail` (smoke-on-demand.ts): togli il log degli avvisi qui sotto.
+    if (warnings > 0)
+        console.log(`\n· ${warnings} avviso/i: dalla 0.13.0 fanno fallire lo smoke.`);
     console.log(`\n✓ Tutti i controlli passati su ${baseUrl}.\n`);
     return 0;
 }

package/dist/index.d.ts

@@ -3,4 +3,5 @@ export type { OfficinaConfig } from './lib/config.ts';
 export { defineConfig } from './lib/config.ts';
 export type { IconSpec } from './lib/icon-specs.ts';
 export type { VerifiedRoute } from './lib/routes.ts';
+export type { OnDemandPage } from './lib/smoke-on-demand.ts';
 export type { CheckResult, SmokeCheck, SmokeContext } from './lib/smoke-production.ts';

package/dist/lib/alignment.d.ts

@@ -13,6 +13,7 @@ export declare const EXPECTED_SCRIPTS: Readonly<Record<string, string>>;
 export declare const CI_STEPS: readonly string[];
 export declare function scriptGaps({ scripts }: Manifest): ContractGap[];
 export declare function dependencyGaps({ dependencies, devDependencies }: Manifest): ContractGap[];
+export declare const readManifest: (files: Pick<ProjectFiles, 'read'>) => Manifest;
 export declare function leftoverGaps(files: ProjectFiles): ContractGap[];
 export declare const BIOME_PRESET = "@elia97/officina/biome";
 export declare const BIOME_SCHEMA = "./node_modules/@biomejs/biome/configuration_schema.json";

package/dist/lib/alignment.js

@@ -6,6 +6,8 @@ export const EXPECTED_SCRIPTS = {
     'check:roadmap': 'officina check roadmap',
     'check:placeholders': 'officina check placeholders',
     'perf:bundle': 'officina check bundle',
+    'check:links': 'officina check links',
+    'check:secrets': 'officina check secrets',
     'smoke:prod': 'officina check smoke',
     'analytics:verify': 'officina check analytics',
     lhci: 'officina check lighthouse',
@@ -26,14 +28,17 @@ export const CI_STEPS = [
     'doctor',
 ];
 const MANIFEST = 'package.json';
+// TODO: dalla 0.13.0 `check:secrets` è un errore di doctor: toglilo da NEW_SCRIPTS.
+const NEW_SCRIPTS = new Set(['check:secrets']);
 export function scriptGaps({ scripts = {} }) {
     const gaps = [];
     for (const [name, expected] of Object.entries(EXPECTED_SCRIPTS)) {
         const actual = scripts[name];
+        const severity = NEW_SCRIPTS.has(name) ? { severity: 'warning' } : {};
         if (actual === undefined)
-            gaps.push({ path: MANIFEST, message: `script \`${name}\` assente: atteso \`${expected}\`` });
+            gaps.push({ path: MANIFEST, message: `script \`${name}\` assente: atteso \`${expected}\``, ...severity });
         else if (!actual.startsWith(expected))
-            gaps.push({ path: MANIFEST, message: `script \`${name}\` è \`${actual}\`: atteso \`${expected}\`` });
+            gaps.push({ path: MANIFEST, message: `script \`${name}\` è \`${actual}\`: atteso \`${expected}\``, ...severity });
     }
     const ci = scripts.ci ?? '';
     for (const step of CI_STEPS) {
@@ -110,6 +115,7 @@ function readJson({ read }, path) {
         return undefined;
     }
 }
+export const readManifest = (files) => (readJson(files, MANIFEST) ?? {});
 export function leftoverGaps(files) {
     const gaps = LEFTOVERS.filter(({ path }) => holds(files.paths, path)).map(({ path, reason }) => ({
         path,

package/dist/lib/bundle-ssr.d.ts

@@ -1,3 +1,4 @@
+import { type ServerFile } from './vercel-build.ts';
 export type PageEntries = {
     route: string;
     entries: string[];
@@ -10,5 +11,6 @@ export type SsrReading = {
     comparesExpectedRoutes: boolean;
     measured: boolean;
 };
+export declare function readServerFiles(): ServerFile[];
 /** Le rotte renderizzate a richiesta non emettono HTML: le dà il manifest che Astro scrive nella build Vercel. */
 export declare function readSsr(hasHtml: boolean): SsrReading;

package/dist/lib/bundle-ssr.js

@@ -3,7 +3,7 @@ import { join } from 'node:path';
 import { ssrRoutes } from './vercel-build.js';
 const FUNCTIONS = '.vercel/output/_functions';
 const SERVER_OUTPUT = 'dist/server';
-function readServerFiles() {
+export function readServerFiles() {
     const read = (path) => ({ path, source: readFileSync(join(FUNCTIONS, path), 'utf8') });
     const chunks = existsSync(join(FUNCTIONS, 'chunks')) ? readdirSync(join(FUNCTIONS, 'chunks')) : [];
     const entry = existsSync(join(FUNCTIONS, 'entry.mjs')) ? ['entry.mjs'] : [];

package/dist/lib/check-placeholders.d.ts

@@ -1,8 +1,10 @@
+import type { Manifest } from './alignment.ts';
 import { type Finding, type Hit } from './cli.ts';
-import type { OfficinaConfig } from './config.ts';
+import { type OfficinaConfig } from './config.ts';
 type EnvHit = Omit<Finding, 'path'>;
 export declare function placeholderSources(config?: OfficinaConfig): string[];
 export declare const contactEnvKeys: (config?: OfficinaConfig) => readonly string[];
+export declare function requiredEnvKeys(config: OfficinaConfig, manifest: Manifest): string[];
 export declare function sourceFindings(source: string): Hit[];
 export declare function envFindings(content: string, keys: readonly string[]): EnvHit[];
 export declare const outputFindings: (dir: string) => Finding[];

package/dist/lib/check-placeholders.js

@@ -2,6 +2,7 @@ import { existsSync, readdirSync, readFileSync } from 'node:fs';
 import { join } from 'node:path';
 import { parseEnv } from 'node:util';
 import { readLines } from './cli.js';
+import { DEPENDENCY_FEATURES, featuresOn } from './config.js';
 const DICTIONARIES = 'src/i18n/strings';
 const DEFAULT_SOURCES = ['src/lib/site.ts', 'src/lib/company.ts'];
 const CONTACT_ENV_KEYS = ['CONTACT_FROM_EMAIL', 'CONTACT_FROM_NAME', 'CONTACT_TO_EMAIL'];
@@ -11,7 +12,7 @@ const STRING_LITERAL = /'(?:[^'\\]|\\.)*'|"(?:[^"\\]|\\.)*"/g;
 const COMMENT_ONLY = /^\s*(?:\/\/|\/\*|\*)/;
 const ZERO_POSTAL_CODE = /\bpostalCode:\s*(['"])00000\1/;
 const EMPTY_HREF = /\bhref:\s*(['"])#\1/;
-// `SENSITIVE_ENV_VALUE_PLACEHOLDER` di vercel@59.22.0: `vercel pull` lo scrive al posto del valore di una Sensitive.
+// `SENSITIVE_ENV_VALUE_PLACEHOLDER` di vercel@62.2.0: `vercel pull` lo scrive al posto del valore di una Secret.
 const SENSITIVE = '[SENSITIVE]';
 const WITHOUT_VALUE = 'il deploy andrebbe online senza il suo valore';
 const dictionaries = () => existsSync(DICTIONARIES)
@@ -27,6 +28,11 @@ export function placeholderSources(config = {}) {
     return [...DEFAULT_SOURCES, ...dictionaries()];
 }
 export const contactEnvKeys = (config = {}) => config.placeholders?.contactEnvKeys ?? CONTACT_ENV_KEYS;
+export function requiredEnvKeys(config, manifest) {
+    const on = featuresOn(config, manifest);
+    const secrets = on.map((name) => DEPENDENCY_FEATURES[name].secret);
+    return [...new Set([...contactEnvKeys(config), ...secrets])];
+}
 function literalFindings(value) {
     const messages = [];
     const token = value.match(TOKEN);
@@ -64,7 +70,7 @@ export function envFindings(content, keys) {
             { line: declaration.n, severity, message: `${key} ${message}` },
         ];
         if (value === SENSITIVE)
-            return hit('warning', 'è Sensitive su Vercel: vercel pull non ne scarica il valore, e il deploy non lo può verificare');
+            return hit('warning', 'è Secret su Vercel: vercel pull non ne scarica il valore, e il deploy non lo può verificare');
         if (value === '')
             return hit('error', `è vuota: ${WITHOUT_VALUE}`);
         if (TOKEN.test(value) || DOMAIN.test(value))
@@ -84,5 +90,5 @@ export const outputFindings = (dir) => filesUnder(dir)
     .map((path) => ({
     path,
     severity: 'error',
-    message: `contiene ${SENSITIVE}, il segnaposto che vercel pull scrive per una variabile Sensitive: la build l'ha incorporato al posto del valore`,
+    message: `contiene ${SENSITIVE}, il segnaposto che vercel pull scrive per una variabile Secret: la build l'ha incorporato al posto del valore`,
 }));

package/dist/lib/check-routes.js

@@ -1,5 +1,6 @@
 import { existsSync, readFileSync } from 'node:fs';
 import { posix } from 'node:path';
+import { DRIZZLE_CONFIG } from './database-auth.js';
 import { blankFences, blankSpans, linkDestinations } from './markdown.js';
 const SCANNED = /\.md$/;
 const ROADMAP = 'docs/ROADMAP.md';
@@ -10,14 +11,14 @@ const IGNORED = [
     /\.pdf$/,
     /^docs\/sources\//,
 ];
-const PATH_REFERENCE = /`((?:docs|src|scripts|test|e2e|public|\.claude|\.github)\/[A-Za-z0-9._/-]+\.[a-z]+)`/g;
+const PATH_REFERENCE = /`((?:docs|src|scripts|test|e2e|public|drizzle|\.claude|\.github)\/[A-Za-z0-9._/-]+\.[a-z]+)`/g;
 const NAME_REFERENCE = /`([A-Za-z0-9._-]+)`/g;
 // La virgola non delimita: i titoli la contengono.
 const SECTION_REFERENCE = /`([A-Za-z0-9._/-]+\.md)`\s*§\s*([^.·|)§]{1,80})/g;
 const LINK_TEXT = /\[[^[\]]*\]\(/g;
 const ROOT_DOCUMENT = /^[A-Z][A-Z0-9_-]*\.md$/;
 // I file tracciati alla radice di template/vetrina (git ls-files), Markdown esclusi.
-const ROOT_CONFIG = new Set([
+const VETRINA_ROOT = [
     '.editorconfig',
     '.env.example',
     '.fallowrc.jsonc',
@@ -39,7 +40,8 @@ const ROOT_CONFIG = new Set([
     'tsconfig.json',
     'vercel.json',
     'vitest.config.ts',
-]);
+];
+const ROOT_CONFIG = new Set([...VETRINA_ROOT, DRIZZLE_CONFIG]);
 const CHANGELOG = /(?:^|\/)CHANGELOG\.md$/;
 const SITE_CONTENT = /^src\/content\//;
 const EXTERNAL = /^(?:[a-z][a-z0-9+.-]*:|#|\/)/i;

package/dist/lib/cli.d.ts

@@ -19,6 +19,7 @@ export type CliOptions = ReturnType<typeof cliOptions>;
 export declare const isGenerated: (path: string) => boolean;
 export declare function missingInput(path: string, purpose: string): boolean;
 export declare function scopedPaths(options: CliOptions, isScanned: (path: string) => boolean): string[];
+export declare const maskCommand: (value: string) => string;
 export declare function printFindings(findings: Finding[], format: string): void;
 export declare function exitCode(findings: Finding[], strict: boolean): number;
 export declare const readLines: (text: string) => {

package/dist/lib/cli.js

@@ -38,6 +38,7 @@ export function scopedPaths(options, isScanned) {
 }
 // I workflow command di GitHub vogliono %, CR e LF codificati nel messaggio.
 const escapeForGitHub = (text) => text.replace(/%/g, '%25').replace(/\r/g, '%0D').replace(/\n/g, '%0A');
+export const maskCommand = (value) => `::add-mask::${escapeForGitHub(value)}`;
 export function printFindings(findings, format) {
     for (const finding of findings) {
         const location = finding.line === undefined ? '' : `:${finding.line}`;

package/dist/lib/config-gaps.d.ts

@@ -1,7 +1,7 @@
 import { type OfficinaConfig } from './config.ts';
 import type { ContractGap } from './contract.ts';
-/**
- * `loaded` è la configurazione letta, l'errore che il suo caricamento ha sollevato, o `undefined` se
- * il file non c'è; `patterns` i pattern dinamici di `src/pages` rimasti senza rappresentante.
- */
-export declare function configGaps(loaded: OfficinaConfig | Error | undefined, patterns?: readonly string[]): ContractGap[];
+export type RouteGaps = {
+    missingRepresentatives?: readonly string[];
+    unknownDisabled?: readonly string[];
+};
+export declare function configGaps(loaded: OfficinaConfig | Error | undefined, { missingRepresentatives, unknownDisabled }?: RouteGaps): ContractGap[];

package/dist/lib/config-gaps.js

@@ -1,5 +1,6 @@
 import { FEATURES } from './config.js';
 const CONFIG = 'officina.config.ts';
+const asGap = (message) => ({ path: CONFIG, message });
 function siteUrlGap(siteUrl) {
     if (siteUrl === undefined)
         return '`siteUrl` assente: `check smoke` non ha un host canonico';
@@ -8,13 +9,10 @@ function siteUrlGap(siteUrl) {
     return siteUrl.endsWith('/') ? `\`siteUrl\` finisce con una barra: \`${siteUrl}\`` : undefined;
 }
 // Il silenzio vale `'required'`: un controllo si spegne dichiarandolo, non dimenticandolo.
-const featureGaps = (config) => FEATURES.filter((name) => config.features?.[name] === undefined).map((name) => `\`features.${name}\` non dichiarata: vale \`'required'\`, e il gate fallisce se non trova cosa controllare`);
+const featureGaps = (config) => FEATURES.filter((name) => config.features?.[name] === undefined).map((name) => asGap(`\`features.${name}\` non dichiarata: vale \`'required'\`, e il gate fallisce se non trova cosa controllare`));
 const representativeGaps = (patterns) => patterns.map((label) => `\`routes.representatives\` non ha un percorso per \`${label}\`: smoke e Lighthouse non guardano quella pagina`);
-/**
- * `loaded` è la configurazione letta, l'errore che il suo caricamento ha sollevato, o `undefined` se
- * il file non c'è; `patterns` i pattern dinamici di `src/pages` rimasti senza rappresentante.
- */
-export function configGaps(loaded, patterns = []) {
+const disabledGaps = (labels) => labels.map((label) => `\`routes.disabled\` nomina \`${label}\`, che non è una pagina dinamica prerenderizzata di \`src/pages\`: non spegne niente`);
+export function configGaps(loaded, { missingRepresentatives = [], unknownDisabled = [] } = {}) {
     if (loaded === undefined)
         return [{ path: CONFIG, message: 'manca: i valori del progetto per officina stanno qui' }];
     if (loaded instanceof Error)
@@ -22,8 +20,11 @@ export function configGaps(loaded, patterns = []) {
     const messages = [
         siteUrlGap(loaded.siteUrl),
         loaded.icons === undefined ? '`icons.background` assente: `gen icons` non ha un colore di fondo' : undefined,
+    ].filter((message) => message !== undefined);
+    return [
+        ...messages.map(asGap),
         ...featureGaps(loaded),
-        ...representativeGaps(patterns),
+        ...representativeGaps(missingRepresentatives).map(asGap),
+        ...disabledGaps(unknownDisabled).map(asGap),
     ];
-    return messages.filter((message) => message !== undefined).map((message) => ({ path: CONFIG, message }));
 }

package/dist/lib/config.d.ts

@@ -1,3 +1,4 @@
+import type { Manifest } from './alignment.ts';
 import type { Budget } from './bundle-budget.ts';
 import type { Representatives, VerifiedRoute } from './routes.ts';
 import type { SmokeCheck } from './smoke-production.ts';
@@ -22,27 +23,54 @@ export interface OfficinaConfig {
     analytics?: {
         linkTracking?: string;
     };
-    /** Quali controlli il progetto pretende. Una voce non dichiarata vale `'required'`. */
+    /**
+     * Quali controlli il progetto pretende. Una voce non dichiarata vale `'required'`, tranne `database`
+     * e `auth`, che senza dichiarazione seguono le dipendenze di `package.json`.
+     */
     features?: {
         analytics?: FeatureSetting;
         roadmap?: FeatureSetting;
         generators?: GeneratorsSetting;
         botId?: FeatureSetting;
+        links?: FeatureSetting;
+        database?: FeatureSetting;
+        auth?: FeatureSetting;
     };
     placeholders?: {
         sources?: readonly string[];
         contactEnvKeys?: readonly string[];
     };
-    /** Per ogni pattern dinamico di `src/pages`, un percorso vero che smoke e Lighthouse visitano. */
+    /** La variabile con cui girano le migrazioni; senza dichiarazione, `DATABASE_URL_UNPOOLED`. */
+    database?: {
+        migrationUrlKey?: string;
+    };
     routes?: {
+        /** Per ogni pattern dinamico di `src/pages`, un percorso vero che smoke e Lighthouse visitano. */
         representatives?: Representatives;
+        /** I pattern dinamici di `src/pages` spenti per scelta: non emettono pagine, e nessun gate le pretende. */
+        disabled?: readonly string[];
     };
 }
-export declare const FEATURES: readonly ['analytics', 'roadmap', 'generators', 'botId'];
+export declare const FEATURES: readonly ['analytics', 'roadmap', 'generators', 'botId', 'links'];
 export type FeatureName = (typeof FEATURES)[number];
 /** Un controllo si spegne solo scrivendolo: il silenzio vale `'required'`. */
 export declare const isRequired: (config: OfficinaConfig, name: FeatureName) => boolean;
 export declare const generatorsSetting: (config: OfficinaConfig) => GeneratorsSetting;
+export declare const DEPENDENCY_FEATURES: {
+    readonly database: {
+        readonly dependency: 'drizzle-orm';
+        readonly secret: 'DATABASE_URL';
+    };
+    readonly auth: {
+        readonly dependency: 'better-auth';
+        readonly secret: 'BETTER_AUTH_SECRET';
+    };
+};
+export type DependencyFeature = keyof typeof DEPENDENCY_FEATURES;
+export declare function isOn(config: OfficinaConfig, manifest: Manifest, name: DependencyFeature): boolean;
+export declare const featuresOn: (config: OfficinaConfig, manifest: Manifest) => DependencyFeature[];
+export declare const featuresOffByChoice: (config: OfficinaConfig, manifest: Manifest) => DependencyFeature[];
+export declare const migrationUrlKey: (config: OfficinaConfig) => string;
 export declare const defineConfig: (config: OfficinaConfig) => OfficinaConfig;
 export declare const findConfigFile: (root: string) => string | undefined;
 export declare function loadConfig(root: string): Promise<OfficinaConfig>;

package/dist/lib/config.js

@@ -9,11 +9,28 @@ var __rewriteRelativeImportExtension = (this && this.__rewriteRelativeImportExte
 import { existsSync } from 'node:fs';
 import { basename, join } from 'node:path';
 import { pathToFileURL } from 'node:url';
-import { aFunction, aNumber, anArrayOf, aRecordOf, aShape, aString, aStringOrNull, oneOf } from './validate.js';
-export const FEATURES = ['analytics', 'roadmap', 'generators', 'botId'];
+import { aFunction, aNumber, anArrayOf, anEnvName, aRecordOf, aShape, aString, aStringOrNull, isRecord, oneOf, } from './validate.js';
+export const FEATURES = ['analytics', 'roadmap', 'generators', 'botId', 'links'];
 /** Un controllo si spegne solo scrivendolo: il silenzio vale `'required'`. */
 export const isRequired = (config, name) => (config.features?.[name] ?? 'required') === 'required';
 export const generatorsSetting = (config) => config.features?.generators ?? 'required';
+export const DEPENDENCY_FEATURES = {
+    database: { dependency: 'drizzle-orm', secret: 'DATABASE_URL' },
+    auth: { dependency: 'better-auth', secret: 'BETTER_AUTH_SECRET' },
+};
+const DEPENDENCY_FEATURE_NAMES = Object.keys(DEPENDENCY_FEATURES);
+const declares = (dependencies, name) => isRecord(dependencies) && name in dependencies;
+const dependsOn = ({ dependencies, devDependencies }, name) => {
+    const { dependency } = DEPENDENCY_FEATURES[name];
+    return declares(dependencies, dependency) || declares(devDependencies, dependency);
+};
+export function isOn(config, manifest, name) {
+    const declared = config.features?.[name];
+    return declared === undefined ? dependsOn(manifest, name) : declared === 'required';
+}
+export const featuresOn = (config, manifest) => DEPENDENCY_FEATURE_NAMES.filter((name) => isOn(config, manifest, name));
+export const featuresOffByChoice = (config, manifest) => DEPENDENCY_FEATURE_NAMES.filter((name) => config.features?.[name] === false && dependsOn(manifest, name));
+export const migrationUrlKey = (config) => config.database?.migrationUrlKey ?? 'DATABASE_URL_UNPOOLED';
 const budget = aShape({ label: aString, matches: aFunction, maxGzip: aNumber });
 const verifiedRoute = aShape({ path: aString, type: aString });
 const feature = oneOf("'required' oppure false", ['required', false]);
@@ -28,9 +45,18 @@ const SHAPE = aShape({
         checks: anArrayOf(aFunction),
     }),
     analytics: aShape({ linkTracking: aString }),
-    features: aShape({ analytics: feature, roadmap: feature, generators, botId: feature }),
+    features: aShape({
+        analytics: feature,
+        roadmap: feature,
+        generators,
+        botId: feature,
+        links: feature,
+        database: feature,
+        auth: feature,
+    }),
     placeholders: aShape({ sources: anArrayOf(aString), contactEnvKeys: anArrayOf(aString) }),
-    routes: aShape({ representatives: aRecordOf(aString) }),
+    database: aShape({ migrationUrlKey: anEnvName }),
+    routes: aShape({ representatives: aRecordOf(aString), disabled: anArrayOf(aString) }),
 });
 const CONFIG_FILES = ['officina.config.ts', 'officina.config.mjs', 'officina.config.js'];
 export const defineConfig = (config) => config;

package/dist/lib/database-auth.d.ts

@@ -0,0 +1,5 @@
+import type { Manifest, ProjectFiles } from './alignment.ts';
+import { type DependencyFeature } from './config.ts';
+import type { ContractGap } from './contract.ts';
+export declare const DRIZZLE_CONFIG = "drizzle.config.ts";
+export declare function databaseAuthGaps(files: ProjectFiles, manifest: Manifest, on: readonly DependencyFeature[]): ContractGap[];

package/dist/lib/database-auth.js

@@ -0,0 +1,81 @@
+import { DEPENDENCY_FEATURES } from './config.js';
+import { envSchema } from './env-schema.js';
+import { actionInputGaps } from './workflows.js';
+const MANIFEST = 'package.json';
+export const DRIZZLE_CONFIG = 'drizzle.config.ts';
+const ASTRO_CONFIG = 'astro.config.mjs';
+const SCRIPTS = [
+    { name: 'db:generate', reason: 'le migrazioni si generano dallo schema con quel nome' },
+    { name: 'db:migrate', reason: 'le migrazioni si applicano con quel nome, in CI e al deploy' },
+];
+const CI_INPUTS = {
+    workflow: '.github/workflows/ci.yml',
+    action: 'ci',
+    inputs: [
+        { name: 'migrate', reason: 'il branch di test non si migra prima dei test' },
+        {
+            name: 'database-url',
+            reason: 'i test di integrazione si saltano',
+            notFrom: [
+                { secret: 'PRODUCTION_DATABASE_URL', reason: 'la CI migrerebbe la produzione con le migrazioni delle PR' },
+                {
+                    secret: 'TEST_DATABASE_URL',
+                    reason: 'le corse parallele migrerebbero lo stesso branch, invece di un branch Neon per corsa',
+                },
+            ],
+        },
+    ],
+};
+const DEPLOY_INPUTS = {
+    workflow: '.github/workflows/deploy.yml',
+    action: 'deploy',
+    inputs: [
+        { name: 'migrate', reason: 'la produzione parte con lo schema di prima' },
+        {
+            name: 'database-url',
+            reason: "le migrazioni del deploy non hanno l'indirizzo di produzione",
+            notFrom: [
+                {
+                    secret: 'TEST_DATABASE_URL',
+                    reason: 'le migrazioni girerebbero sul branch di test, e la produzione partirebbe con lo schema di prima',
+                },
+            ],
+        },
+    ],
+};
+function databaseGaps(files, { scripts = {} }) {
+    const gaps = SCRIPTS.filter(({ name }) => scripts[name] === undefined).map(({ name, reason }) => ({
+        path: MANIFEST,
+        message: `script \`${name}\` assente: ${reason}`,
+    }));
+    if (files.read(DRIZZLE_CONFIG) === undefined) {
+        gaps.push({ path: DRIZZLE_CONFIG, message: 'manca: drizzle-kit legge da lì la sua configurazione' });
+    }
+    return [...gaps, ...actionInputGaps(files, CI_INPUTS), ...actionInputGaps(files, DEPLOY_INPUTS)];
+}
+function secretGap(key, field) {
+    if (field === undefined) {
+        return `\`${key}\` non è in \`env.schema\`: va dichiarata con \`context: 'server'\` e \`access: 'secret'\``;
+    }
+    if (field.context === 'server' && field.access === 'secret')
+        return undefined;
+    return `\`${key}\` in \`env.schema\` non è \`context: 'server'\` con \`access: 'secret'\`: una variabile pubblica Astro la scrive nel codice della build`;
+}
+function secretGaps(source, keys) {
+    if (keys.length === 0)
+        return [];
+    if (source === undefined)
+        return [{ path: ASTRO_CONFIG, message: 'manca: lo schema delle variabili, `env.schema`, sta lì' }];
+    const fields = new Map(envSchema(source).map((field) => [field.key, field]));
+    return keys.flatMap((key) => {
+        const message = secretGap(key, fields.get(key));
+        return message === undefined ? [] : [{ path: ASTRO_CONFIG, message }];
+    });
+}
+// TODO: dalla 0.13.0 i requisiti del database e dell'autenticazione sono errori di doctor: togli `severity`.
+const asWarning = (gap) => ({ ...gap, severity: 'warning' });
+export function databaseAuthGaps(files, manifest, on) {
+    const database = on.includes('database') ? databaseGaps(files, manifest) : [];
+    const secrets = secretGaps(files.read(ASTRO_CONFIG), on.map((name) => DEPENDENCY_FEATURES[name].secret));
+    return [...database, ...secrets].map(asWarning);
+}

package/dist/lib/env-schema.d.ts

@@ -0,0 +1,8 @@
+export interface EnvField {
+    key: string;
+    type: string;
+    context: string | undefined;
+    access: string | undefined;
+    constrained: boolean;
+}
+export declare function envSchema(source: string): EnvField[];

package/dist/lib/env-schema.js

@@ -0,0 +1,37 @@
+import { Node, Project, SyntaxKind } from 'ts-morph';
+const ENV_FIELD = /^envField\.(\w+)$/;
+// Le validazioni che la guida di Astro elenca per envField.string, oltre al tipo.
+const CONSTRAINTS = ['max', 'min', 'length', 'url', 'includes', 'startsWith', 'endsWith'];
+const constrained = (options) => Node.isObjectLiteralExpression(options) && CONSTRAINTS.some((name) => options.getProperty(name) !== undefined);
+const keyOf = (property) => {
+    const name = property.getNameNode();
+    return Node.isStringLiteral(name) ? name.getLiteralValue() : name.getText();
+};
+function literal(options, name) {
+    if (!Node.isObjectLiteralExpression(options))
+        return undefined;
+    const property = options.getProperty(name);
+    const value = Node.isPropertyAssignment(property) ? property.getInitializer() : undefined;
+    return Node.isStringLiteral(value) ? value.getLiteralValue() : undefined;
+}
+// Il sorgente si legge invece di importarlo: astro.config.mjs importa moduli senza estensione, che
+// risolve Vite e che Node rifiuta con ERR_MODULE_NOT_FOUND.
+export function envSchema(source) {
+    const file = new Project({ useInMemoryFileSystem: true }).createSourceFile('astro.config.mjs', source);
+    return file.getDescendantsOfKind(SyntaxKind.CallExpression).flatMap((call) => {
+        const property = call.getParent();
+        const type = ENV_FIELD.exec(call.getExpression().getText())?.[1];
+        if (type === undefined || !Node.isPropertyAssignment(property))
+            return [];
+        const [options] = call.getArguments();
+        return [
+            {
+                key: keyOf(property),
+                type,
+                context: literal(options, 'context'),
+                access: literal(options, 'access'),
+                constrained: constrained(options),
+            },
+        ];
+    });
+}

package/dist/lib/links.d.ts

@@ -0,0 +1,30 @@
+export type LinkTarget = {
+    kind: 'placeholder' | 'anchor' | 'scheme' | 'external';
+} | {
+    kind: 'internal';
+    path: string;
+};
+export type PageLinks = {
+    route: string;
+    hrefs: readonly string[];
+};
+export type LinkReport = {
+    broken: {
+        destination: string;
+        pages: string[];
+    }[];
+    internal: number;
+    onDemand: number;
+    outside: {
+        external: number;
+        scheme: number;
+        anchor: number;
+    };
+};
+export declare function htmlLinks(html: string): string[];
+export declare const siteOrigin: (siteUrl: string | undefined) => string;
+export declare function linkTarget(href: string, page: URL): LinkTarget;
+export declare function servedPaths(files: readonly string[]): Set<string>;
+export declare function servedBy(path: string, served: ReadonlySet<string>, onDemand: readonly RegExp[]): 'build' | 'on-demand' | undefined;
+export declare function linkReport(pages: readonly PageLinks[], origin: string, served: ReadonlySet<string>, onDemand: readonly RegExp[]): LinkReport;
+export declare const brokenLines: ({ broken }: LinkReport) => string[];