@elia97/officina 0.10.0 → 0.12.0

package/dist/lib/links.js

@@ -0,0 +1,101 @@
+import { listed } from './routes.js';
+const VALUE = String.raw `(?:"[^"]*"|'[^']*'|[^\s"'>]+)`;
+const ATTRIBUTES = String.raw `(?:\s+[^\s"'>/=]+(?:\s*=\s*${VALUE})?)*`;
+// Astro conserva i commenti HTML, e nei valori dinamici degli attributi scappa solo `&` e `"`.
+const MARKUP = new RegExp(String.raw `<!--[\s\S]*?-->|<(script|style)\b${ATTRIBUTES}\s*\/?>[\s\S]*?<\/\1\s*>|<a(${ATTRIBUTES})\s*\/?>|<[a-z][^\s/>]*${ATTRIBUTES}\s*\/?>`, 'gi');
+const ATTRIBUTE = /\s+([^\s"'>/=]+)(?:\s*=\s*(?:"([^"]*)"|'([^']*)'|([^\s"'>]+)))?/g;
+const ENTITY = /&(?:#(\d{1,6})|#x([\da-f]{1,5})|(amp|lt|gt|quot|apos));/gi;
+const NAMED = { amp: '&', lt: '<', gt: '>', quot: '"', apos: "'" };
+const SCHEME = /^[a-z][a-z\d+.-]*:/i;
+const WEB = /^https?:/i;
+const NO_SITE = 'https://officina.invalid';
+const decodeEntities = (value) => value.replace(ENTITY, (_, decimal, hex, name) => {
+    if (decimal !== undefined)
+        return String.fromCodePoint(Number(decimal));
+    if (hex !== undefined)
+        return String.fromCodePoint(Number.parseInt(hex, 16));
+    return NAMED[name.toLowerCase()];
+});
+function hrefOf(attributes) {
+    for (const [, name, double, single, bare] of attributes.matchAll(ATTRIBUTE)) {
+        if (name.toLowerCase() === 'href')
+            return decodeEntities(double ?? single ?? bare ?? '');
+    }
+    return undefined;
+}
+export function htmlLinks(html) {
+    return [...html.matchAll(MARKUP)]
+        .map(([, , attributes]) => (attributes === undefined ? undefined : hrefOf(attributes)))
+        .filter((href) => href !== undefined);
+}
+export const siteOrigin = (siteUrl) => siteUrl !== undefined && URL.canParse(siteUrl) ? new URL(siteUrl).origin : NO_SITE;
+function decoded(path) {
+    try {
+        return decodeURIComponent(path);
+    }
+    catch {
+        return path;
+    }
+}
+export function linkTarget(href, page) {
+    const value = href.trim();
+    if (value === '' || value === '#')
+        return { kind: 'placeholder' };
+    if (value.startsWith('#'))
+        return { kind: 'anchor' };
+    if (SCHEME.test(value) && !WEB.test(value))
+        return { kind: 'scheme' };
+    if (!URL.canParse(value, page))
+        return { kind: 'internal', path: value };
+    const url = new URL(value, page);
+    return url.origin === page.origin ? { kind: 'internal', path: decoded(url.pathname) } : { kind: 'external' };
+}
+export function servedPaths(files) {
+    const served = new Set();
+    for (const file of files) {
+        served.add(file);
+        if (file.endsWith('/index.html'))
+            served.add(file.slice(0, -'/index.html'.length) || '/');
+        else if (file.endsWith('.html'))
+            served.add(file.slice(0, -'.html'.length));
+    }
+    return served;
+}
+const withoutTrailingSlash = (path) => (path.length > 1 ? path.replace(/\/+$/, '') : path);
+export function servedBy(path, served, onDemand) {
+    const bare = withoutTrailingSlash(path);
+    if (served.has(path) || served.has(bare))
+        return 'build';
+    return onDemand.some((pattern) => pattern.test(bare)) ? 'on-demand' : undefined;
+}
+const placeholderLabel = (href) => `segnaposto href="${href.trim()}"`;
+export function linkReport(pages, origin, served, onDemand) {
+    const citing = new Map();
+    const report = { broken: [], internal: 0, onDemand: 0, outside: { external: 0, scheme: 0, anchor: 0 } };
+    const cite = (destination, route) => citing.set(destination, (citing.get(destination) ?? new Set()).add(route));
+    const checkInternal = (path, route) => {
+        report.internal++;
+        const by = servedBy(path, served, onDemand);
+        if (by === undefined)
+            cite(withoutTrailingSlash(path), route);
+        if (by === 'on-demand')
+            report.onDemand++;
+    };
+    for (const { route, hrefs } of pages) {
+        const page = new URL(route, origin);
+        for (const href of hrefs) {
+            const target = linkTarget(href, page);
+            if (target.kind === 'placeholder')
+                cite(placeholderLabel(href), route);
+            else if (target.kind === 'internal')
+                checkInternal(target.path, route);
+            else
+                report.outside[target.kind]++;
+        }
+    }
+    report.broken = [...citing]
+        .sort(([a], [b]) => (a < b ? -1 : 1))
+        .map(([destination, routes]) => ({ destination, pages: [...routes].sort() }));
+    return report;
+}
+export const brokenLines = ({ broken }) => broken.map(({ destination, pages }) => `${destination} ← ${listed(pages)}`);

package/dist/lib/migrate.d.ts

@@ -0,0 +1,11 @@
+type Env = Readonly<Record<string, string | undefined>>;
+export type MigrationEnv = {
+    env: Record<string, string | undefined>;
+    url: string;
+} | {
+    error: string;
+};
+export type MigrationTarget = 'test' | 'production';
+export declare function migrationEnv(env: Env, key: string, target: MigrationTarget): MigrationEnv;
+export declare function maskedValues(url: string): string[];
+export {};

package/dist/lib/migrate.js

@@ -0,0 +1,29 @@
+const SOURCES = {
+    test: {
+        variable: 'TEST_DATABASE_URL',
+        origin: "è l'indirizzo del branch di test, che `actions/ci` riceve con `database-url`",
+    },
+    production: {
+        variable: 'PRODUCTION_DATABASE_URL',
+        origin: "è l'indirizzo di produzione, che `actions/deploy` riceve con `database-url` dal segreto `PRODUCTION_DATABASE_URL` dell'environment `production`, dichiarato dal job di deploy",
+    },
+};
+export function migrationEnv(env, key, target) {
+    const { variable, origin } = SOURCES[target];
+    const { [variable]: url, ...rest } = env;
+    if (!url)
+        return { error: `\`${variable}\` è vuota: ${origin}` };
+    return { env: { ...rest, [key]: url }, url };
+}
+const decoded = (text) => {
+    try {
+        return decodeURIComponent(text);
+    }
+    catch {
+        return text;
+    }
+};
+export function maskedValues(url) {
+    const password = URL.parse(url)?.password ?? '';
+    return [...new Set(password === '' ? [url] : [url, password, decoded(password)])];
+}

package/dist/lib/routes.d.ts

@@ -2,16 +2,18 @@ export type PageFile = {
     file: string;
     source: string;
 };
+type DynamicRoute = {
+    pattern: RegExp;
+    label: string;
+    file: string;
+};
 export type Expectations = {
     exact: {
         route: string;
         file: string;
     }[];
-    patterns: {
-        pattern: RegExp;
-        label: string;
-        file: string;
-    }[];
+    patterns: DynamicRoute[];
+    disabled: DynamicRoute[];
     ssr: string[];
 };
 export type VerifiedRoute = {
@@ -25,11 +27,21 @@ export declare const NON_HTML_ROUTES: readonly VerifiedRoute[];
 export declare function filesWithExtension(dir: string, extension: string): string[];
 export declare function readPageFiles(pagesDir: string): PageFile[];
 export declare function routeOf(htmlPath: string, dist: string): string;
-export declare function expectedRoutes(pages: readonly PageFile[], pagesDir: string): Expectations;
+export declare function pageRouteOf(file: string, pagesDir: string): string;
+export declare function routePattern(route: string): RegExp;
+export declare function expectedRoutes(pages: readonly PageFile[], pagesDir: string, disabled?: readonly string[]): Expectations;
+export type EmittedRoutes = {
+    html: readonly string[];
+    ssr: readonly string[];
+};
 /** [HARD] Guardia fail-open: ogni asserzione per rotta itera sulle pagine emesse, quindi una dist vuota non asserisce niente. */
-export declare function missingRouteFailures(expected: Expectations, emitted: readonly string[], dist: string): string[];
+export declare function missingRouteFailures(expected: Expectations, emitted: EmittedRoutes, dist: string): string[];
+export declare const listed: (routes: readonly string[]) => string;
+export declare function disabledRouteFailures(expected: Expectations, { html, ssr }: EmittedRoutes): string[];
+export declare function unknownDisabled(expected: Expectations, disabled?: readonly string[]): string[];
 /** I pattern dinamici che `officina.config.ts` non ha ancora mandato nessuno a visitare. */
 export declare function missingRepresentatives(expected: Expectations, representatives?: Representatives): string[];
 export declare function auditRoutes(expected: Expectations, representatives?: Representatives): string[];
 export declare function smokeRoutes(expected: Expectations, nonHtmlRoutes?: readonly VerifiedRoute[], representatives?: Representatives): VerifiedRoute[];
 export declare function orphanExceptions(expected: Expectations): string[];
+export {};

package/dist/lib/routes.js

@@ -28,27 +28,29 @@ export function routeOf(htmlPath, dist) {
     return route.replace(/\.html$/, '') || '/';
 }
 const SSR_OPT_OUT = /^\s*export\s+const\s+prerender\s*=\s*false\b/m;
-function pageRouteOf(file, pagesDir) {
+export function pageRouteOf(file, pagesDir) {
     return (toPosix(file, pagesDir)
         .replace(/\.astro$/, '')
         .replace(/\/index$/, '') || '/');
 }
+const PARAMETER = /(\[[^\]]*\])/;
 function segmentPattern(segment) {
-    if (segment.startsWith('['))
-        return '[^/]+';
-    return segment.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+    return segment
+        .split(PARAMETER)
+        .map((part) => (part.startsWith('[') ? '[^/]+' : part.replace(/[.*+?^${}()|[\]\\]/g, '\\$&')))
+        .join('');
 }
 const TRAILING_REST_SEGMENT = /\/\[\.\.\.[^/]*\]$/;
 // Anche un segmento rest finale fa match col vuoto: `paginate()` emette la prima pagina come
 // percorso nudo (`/news`, mai `/news/1`), quindi esigere un segmento boccia un archivio di una pagina.
-function routePattern(route) {
+export function routePattern(route) {
     const body = (path) => path.split('/').map(segmentPattern).join('/');
     if (!TRAILING_REST_SEGMENT.test(route))
         return new RegExp(`^${body(route)}$`);
     return new RegExp(`^${body(route.replace(TRAILING_REST_SEGMENT, ''))}(?:/.*)?$`);
 }
-export function expectedRoutes(pages, pagesDir) {
-    const expectations = { exact: [], patterns: [], ssr: [] };
+export function expectedRoutes(pages, pagesDir, disabled = []) {
+    const expectations = { exact: [], patterns: [], disabled: [], ssr: [] };
     for (const { file, source } of pages) {
         if (SSR_OPT_OUT.test(source)) {
             expectations.ssr.push(file);
@@ -59,28 +61,52 @@ export function expectedRoutes(pages, pagesDir) {
             expectations.exact.push({ route, file });
             continue;
         }
-        expectations.patterns.push({ pattern: routePattern(route), label: route, file });
+        const target = disabled.includes(route) ? expectations.disabled : expectations.patterns;
+        target.push({ pattern: routePattern(route), label: route, file });
     }
     return expectations;
 }
+// Il manifest di Astro nomina una rotta resa a richiesta col suo pattern (`/blog/[slug]`), non coi percorsi che serve.
+const emits = ({ pattern, label }, { html, ssr }) => html.some((route) => pattern.test(route)) || ssr.includes(label);
 /** [HARD] Guardia fail-open: ogni asserzione per rotta itera sulle pagine emesse, quindi una dist vuota non asserisce niente. */
 export function missingRouteFailures(expected, emitted, dist) {
-    if (emitted.length === 0) {
+    if (emitted.html.length + emitted.ssr.length === 0) {
         return [`${dist} non contiene nessun .html: nessuna rotta misurata, quindi i budget per rotta non affermano niente`];
     }
     const failures = [];
-    const routes = new Set(emitted);
+    const routes = new Set([...emitted.html, ...emitted.ssr]);
     for (const { route, file } of expected.exact) {
         if (!routes.has(route))
             failures.push(`rotta mancante ${route}: ${file} è prerenderizzata ma non ha emesso HTML`);
     }
-    for (const { pattern, label, file } of expected.patterns) {
-        if (emitted.some((route) => pattern.test(route)))
+    for (const page of expected.patterns) {
+        if (emits(page, emitted))
             continue;
-        failures.push(`rotta mancante ${label}: ${file} è prerenderizzata ma getStaticPaths non ha emesso niente`);
+        failures.push(`rotta mancante ${page.label}: ${page.file} è prerenderizzata ma getStaticPaths non ha emesso niente`);
     }
     return failures;
 }
+const SHOWN = 3;
+export const listed = (routes) => routes.length <= SHOWN ? routes.join(', ') : `${routes.slice(0, SHOWN).join(', ')} e altre ${routes.length - SHOWN}`;
+export function disabledRouteFailures(expected, { html, ssr }) {
+    const exact = new Set(expected.exact.map(({ route }) => route));
+    const unexplained = html.filter((route) => !exact.has(route) && !expected.patterns.some(({ pattern }) => pattern.test(route)));
+    return expected.disabled.flatMap(({ pattern, label }) => {
+        if (ssr.includes(label)) {
+            return [
+                `rotta spenta ${label}: è in \`routes.disabled\`, ma la build la rende a richiesta, e si spegne solo una pagina prerenderizzata`,
+            ];
+        }
+        const routes = unexplained.filter((route) => pattern.test(route)).sort();
+        if (routes.length === 0)
+            return [];
+        return [`rotta spenta ${label}: è in \`routes.disabled\`, ma la build ha emesso ${listed(routes)}`];
+    });
+}
+export function unknownDisabled(expected, disabled = []) {
+    const known = new Set(expected.disabled.map(({ label }) => label));
+    return disabled.filter((label) => !known.has(label));
+}
 /** I pattern dinamici che `officina.config.ts` non ha ancora mandato nessuno a visitare. */
 export function missingRepresentatives(expected, representatives = {}) {
     return expected.patterns

package/dist/lib/secrets.d.ts

@@ -0,0 +1,10 @@
+import type { Finding } from './cli.ts';
+import type { EnvField } from './env-schema.ts';
+export declare function secretFields(fields: readonly EnvField[]): EnvField[];
+export declare const canary: (key: string) => string;
+export declare const canaryLines: (secrets: readonly EnvField[]) => string[];
+export interface SecretScan {
+    findings: Finding[];
+    verified: string[];
+}
+export declare function scanSecrets(keys: readonly string[], env: Readonly<Record<string, string | undefined>>, files: readonly string[], read: (path: string) => Buffer): SecretScan;

package/dist/lib/secrets.js

@@ -0,0 +1,53 @@
+const SCHEMA = 'astro.config.mjs';
+const MIN_SEARCHABLE = 8;
+export function secretFields(fields) {
+    const secrets = fields.filter(({ context, access }) => context === 'server' && access === 'secret');
+    return secrets.filter(({ key }, index) => secrets.findIndex((field) => field.key === key) === index);
+}
+export const canary = (key) => `officina-${key}-canary`;
+// Astro valida ogni variabile sul tipo e sulle validazioni del suo envField: un canary di testo non
+// è un `number`, un `boolean` né un `enum`, e non rispetta `url`, `startsWith` e simili.
+export const canaryLines = (secrets) => secrets.filter(({ type, constrained }) => type === 'string' && !constrained).map(({ key }) => `${key}=${canary(key)}`);
+// Le due forme in cui il runtime di Astro scrive un valore: escapeHTML nel markup, stringifyForScript
+// negli script (astro/dist/runtime/server/escape.js).
+const written = (value) => [
+    value,
+    value
+        .replaceAll('&', '&')
+        .replaceAll('<', '&lt;')
+        .replaceAll('>', '&gt;')
+        .replaceAll("'", '&#39;')
+        .replaceAll('"', '&quot;'),
+    JSON.stringify(value).slice(1, -1).replaceAll('<', '\\u003c'),
+];
+function target(key, raw) {
+    const value = raw?.trim() ?? '';
+    const own = value.length >= MIN_SEARCHABLE && value !== canary(key) ? written(value) : [];
+    return { key, value, needles: [...new Set([canary(key), ...own])] };
+}
+const searchable = ({ value }) => value.length >= MIN_SEARCHABLE;
+const leaksIn = (path, content, targets) => targets
+    .filter(({ needles }) => needles.some((needle) => content.includes(needle)))
+    .map(({ key }) => ({ path, key, viaCanary: content.includes(canary(key)) }));
+const leakFinding = ({ path, key, viaCanary }) => ({
+    path,
+    severity: 'error',
+    message: `contiene ${viaCanary ? 'il canary' : 'il valore'} di \`${key}\`, una chiave server e secret di env.schema`,
+});
+const unverifiable = ({ key, value }) => ({
+    path: SCHEMA,
+    severity: 'warning',
+    message: value === ''
+        ? `\`${key}\` non si verifica: nell'ambiente non ci sono né il suo valore né il canary`
+        : `\`${key}\` non si verifica: il suo valore ha meno di ${MIN_SEARCHABLE} caratteri, e cercarlo darebbe falsi positivi`,
+});
+export function scanSecrets(keys, env, files, read) {
+    const targets = keys.map((key) => target(key, env[key]));
+    const leaks = files.flatMap((path) => leaksIn(path, read(path), targets));
+    const leaked = new Set(leaks.map(({ key }) => key));
+    const clean = targets.filter(({ key }) => !leaked.has(key));
+    return {
+        findings: [...leaks.map(leakFinding), ...clean.filter((t) => !searchable(t)).map(unverifiable)],
+        verified: clean.filter(searchable).map(({ key }) => key),
+    };
+}

package/dist/lib/smoke-on-demand.d.ts

@@ -0,0 +1,8 @@
+import { type Expectations, type Representatives } from './routes.ts';
+import type { CheckResult, SmokeContext } from './smoke-production.ts';
+export type OnDemandPage = {
+    label: string;
+    path?: string;
+};
+export declare function onDemandPages(expected: Expectations, pagesDir: string, representatives?: Representatives): OnDemandPage[];
+export declare function checkOnDemandPages(context: SmokeContext): Promise<CheckResult[]>;

package/dist/lib/smoke-on-demand.js

@@ -0,0 +1,65 @@
+import { pageRouteOf } from './routes.js';
+export function onDemandPages(expected, pagesDir, representatives = {}) {
+    return expected.ssr
+        .map((file) => pageRouteOf(file, pagesDir))
+        .sort()
+        .map((label) => {
+        const path = label.includes('[') ? representatives[label] : label;
+        return path === undefined ? { label } : { label, path };
+    });
+}
+const META = /<meta\b[^>]*>/gi;
+const HTTP_EQUIV = /(?<![-\w])http-equiv\s*=\s*(?:"([^"]*)"|'([^']*)'|([^\s"'>]+))/i;
+const CONTENT = /(?<![-\w])content\s*=\s*(?:"([^"]*)"|'([^']*)'|([^\s"'>]+))/i;
+const SCRIPT_SRC = /(?:^|;)\s*script-src(?:\s|;|$)/i;
+const attributeValue = (tag, attribute) => {
+    const match = attribute.exec(tag);
+    return match?.[1] ?? match?.[2] ?? match?.[3] ?? '';
+};
+const hasCspMeta = (html) => [...html.matchAll(META)].some(([tag]) => attributeValue(tag, HTTP_EQUIV).toLowerCase() === 'content-security-policy' &&
+    SCRIPT_SRC.test(attributeValue(tag, CONTENT)));
+// TODO: dalla 0.13.0 un'anomalia di una pagina resa a richiesta fa fallire lo smoke: qui `warn` diventa `fail`.
+const warn = (check, detail) => ({ check, status: 'warn', detail });
+function redirect(check, response, url) {
+    const location = response.headers.get('location');
+    if (location === null)
+        return warn(check, `risponde ${response.status} senza location`);
+    const target = new URL(location, url);
+    const { origin } = new URL(url);
+    if (target.origin !== origin)
+        return warn(check, `rimanda a ${target.href}, fuori da ${origin}`);
+    return { check, status: 'pass' };
+}
+async function visit({ get, baseUrl }, path) {
+    const check = `GET ${path} (a richiesta)`;
+    const url = `${baseUrl}${path}`;
+    try {
+        const response = await get(url);
+        if (response.status >= 300 && response.status < 400)
+            return redirect(check, response, url);
+        if (response.status !== 200) {
+            return warn(check, `atteso 200 o un redirect sulla stessa origine, ricevuto ${response.status}`);
+        }
+        const contentType = response.headers.get('content-type') ?? '';
+        if (!contentType.includes('text/html'))
+            return warn(check, `atteso un content-type text/html, ricevuto "${contentType}"`);
+        if (!hasCspMeta((await response.text?.()) ?? ''))
+            return warn(check, 'manca il meta Content-Security-Policy con script-src');
+        return { check, status: 'pass' };
+    }
+    catch (error) {
+        return warn(check, error instanceof Error ? error.message : String(error));
+    }
+}
+export async function checkOnDemandPages(context) {
+    const results = [];
+    for (const { label, path } of context.onDemand ?? []) {
+        if (path !== undefined)
+            results.push(await visit(context, path));
+        else {
+            const detail = 'pagina dinamica senza rappresentante in `routes.representatives`';
+            results.push({ check: `pagina ${label} (a richiesta)`, status: 'skip', detail });
+        }
+    }
+    return results;
+}

package/dist/lib/smoke-production.d.ts

@@ -1,10 +1,12 @@
 import type { VerifiedRoute } from './routes.ts';
+import { type OnDemandPage } from './smoke-on-demand.ts';
 export interface SmokeResponse {
     ok: boolean;
     status: number;
     headers: {
         get: (name: string) => string | null;
     };
+    text?: () => Promise<string>;
 }
 export type Fetcher = (url: string) => Promise<SmokeResponse>;
 export interface SmokeContext {
@@ -13,11 +15,12 @@ export interface SmokeContext {
     siteUrl: string;
     securityHeaders: Record<string, string | null>;
     botIdRequired: boolean;
+    onDemand?: readonly OnDemandPage[];
 }
 export type SmokeCheck = (context: SmokeContext, pages: readonly VerifiedRoute[]) => Promise<CheckResult[]>;
 export interface CheckResult {
     check: string;
-    status: 'pass' | 'fail' | 'skip';
+    status: 'pass' | 'fail' | 'skip' | 'warn';
     detail?: string;
 }
 export declare const SECURITY_HEADERS: Record<string, string | null>;

package/dist/lib/smoke-production.js

@@ -1,3 +1,4 @@
+import { checkOnDemandPages } from './smoke-on-demand.js';
 const pass = (check) => ({ check, status: 'pass' });
 const fail = (check, detail) => ({ check, status: 'fail', detail });
 const skip = (check, detail) => ({ check, status: 'skip', detail });
@@ -144,6 +145,7 @@ export async function checkTrailingSlash({ get, baseUrl }, pages) {
 }
 export const DEFAULT_CHECKS = [
     checkPages,
+    checkOnDemandPages,
     checkSecurityHeaders,
     checkBotIdChallenge,
     checkCanonicalHost,

package/dist/lib/validate.d.ts

@@ -1,10 +1,12 @@
 export type Check = (value: unknown, path: string) => string[];
+export declare const isRecord: (value: unknown) => value is Record<string, unknown>;
 export declare function typeName(value: unknown): string;
 export declare const problem: (path: string, expected: string, value: unknown) => string;
 export declare const aString: Check;
 export declare const aNumber: Check;
 export declare const aFunction: Check;
 export declare const aStringOrNull: Check;
+export declare const anEnvName: Check;
 export declare const anArrayOf: (item: Check) => Check;
 export declare const aRecordOf: (item: Check) => Check;
 export declare const oneOf: (expected: string, allowed: readonly unknown[]) => Check;

package/dist/lib/validate.js

@@ -1,4 +1,4 @@
-const isRecord = (value) => typeof value === 'object' && value !== null && !Array.isArray(value);
+export const isRecord = (value) => typeof value === 'object' && value !== null && !Array.isArray(value);
 const NAMES = new Map([
     ['string', 'una stringa'],
     ['number', 'un numero'],
@@ -18,6 +18,14 @@ export const aString = (value, path) => (typeof value === 'string' ? [] : [probl
 export const aNumber = (value, path) => (typeof value === 'number' ? [] : [problem(path, 'un numero', value)]);
 export const aFunction = (value, path) => typeof value === 'function' ? [] : [problem(path, 'una funzione', value)];
 export const aStringOrNull = (value, path) => typeof value === 'string' || value === null ? [] : [problem(path, 'una stringa oppure null', value)];
+const ENV_NAME = /^[A-Za-z_][A-Za-z0-9_]*$/;
+export const anEnvName = (value, path) => {
+    if (typeof value !== 'string')
+        return [problem(path, 'una stringa', value)];
+    if (ENV_NAME.test(value))
+        return [];
+    return [`${path}: atteso il nome di una variabile d'ambiente, ricevuto ${JSON.stringify(value)}`];
+};
 export const anArrayOf = (item) => (value, path) => Array.isArray(value)
     ? value.flatMap((entry, index) => item(entry, `${path}[${index}]`))
     : [problem(path, 'un array', value)];

package/dist/lib/vercel-build.d.ts

@@ -10,3 +10,4 @@ export type SsrRoute = {
     unknownIslands: string[];
 };
 export declare function ssrRoutes(files: readonly ServerFile[]): SsrRoute[] | null;
+export declare function onDemandPatterns(files: readonly ServerFile[]): RegExp[] | null;

package/dist/lib/vercel-build.js

@@ -1,4 +1,5 @@
 import { posix } from 'node:path';
+import { routePattern } from './routes.js';
 const MANIFEST_CALL = 'deserializeManifest({';
 const ASSET = /^(?:.*\/)?_astro\/([^/?#]+\.js)(?:[?#].*)?$/;
 const STYLESHEET = /^(?:.*\/)?_astro\/([^?#]+\.css)(?:[?#].*)?$/;
@@ -102,14 +103,35 @@ function ssrPage({ scripts = [], styles, routeData }) {
     const { route, component } = routeData;
     return typeof route === 'string' && typeof component === 'string' ? [{ scripts, styles, route, component }] : [];
 }
-export function ssrRoutes(files) {
-    for (const file of files) {
-        const manifest = parseManifest(file.source);
+function firstManifest(files) {
+    for (const host of files) {
+        const manifest = parseManifest(host.source);
         if (manifest !== null)
-            return routesOf(file, manifest, files);
+            return { host, manifest };
     }
     return null;
 }
+export function ssrRoutes(files) {
+    const found = firstManifest(files);
+    return found === null ? null : routesOf(found.host, found.manifest, files);
+}
+function astroPattern(route, pattern) {
+    if (typeof pattern === 'string') {
+        try {
+            return new RegExp(pattern);
+        }
+        catch { }
+    }
+    return routePattern(route);
+}
+export function onDemandPatterns(files) {
+    const found = firstManifest(files);
+    if (found === null)
+        return null;
+    return (found.manifest.routes ?? []).flatMap(({ routeData }) => routeData?.prerender === false && typeof routeData.route === 'string'
+        ? [astroPattern(routeData.route, routeData.pattern)]
+        : []);
+}
 function routesOf(host, manifest, files) {
     const sources = new Map(files.map((file) => [file.path, file.source]));
     const chunks = pageChunks(host);

package/dist/lib/workflows.d.ts

@@ -4,3 +4,17 @@ export declare const isLive: (line: string) => boolean;
 export declare const mentions: (source: string | undefined, needle: string) => boolean;
 /** Le action del progetto devono stare alla stessa versione del pacchetto installato. */
 export declare function workflowGaps({ read }: ProjectFiles, version: string): ContractGap[];
+export interface ActionInputs {
+    workflow: string;
+    action: string;
+    inputs: readonly {
+        name: string;
+        reason: string;
+        notFrom?: readonly {
+            secret: string;
+            reason: string;
+        }[];
+    }[];
+}
+/** Un workflow che non usa l'action lo segnala già `workflowGaps`. */
+export declare function actionInputGaps({ read }: ProjectFiles, { workflow, action, inputs }: ActionInputs): ContractGap[];

package/dist/lib/workflows.js

@@ -1,5 +1,5 @@
-// Niente parser YAML nel pacchetto: la ricerca è testuale. Una riga commentata non soddisfa nessun
-// controllo, altrimenti basta commentare un passo per avere un progetto «a posto» che non lo lancia.
+import { parse } from 'yaml';
+import { isRecord } from './validate.js';
 export const isLive = (line) => !line.trimStart().startsWith('#');
 const liveLines = (source) => source.split(/\r?\n/).filter(isLive);
 export const mentions = (source, needle) => source !== undefined && liveLines(source).some((line) => line.includes(needle));
@@ -36,8 +36,9 @@ function refGap(line, ref, name, expected) {
         ? undefined
         : `\`${name}@${ref.slice(0, 7)}… ${declared}\`: il pacchetto installato è la ${expected.slice(1)}`;
 }
+const actionName = (action) => `Elia97/officina/actions/${action}`;
 function actionGap(source, action, version) {
-    const name = `Elia97/officina/actions/${action}`;
+    const name = actionName(action);
     if (source === undefined)
         return `manca: i suoi passi arrivano da \`${name}\``;
     const found = refOf(source, name);
@@ -50,3 +51,43 @@ export function workflowGaps({ read }, version) {
         return message === undefined ? [] : [{ path: workflow, message }];
     });
 }
+function parsed(source) {
+    try {
+        return { workflow: parse(source) };
+    }
+    catch (error) {
+        return { error: `non è YAML valido: ${String(error).replace(/\n[\s\S]*$/, '')}` };
+    }
+}
+function stepsUsing(source, action) {
+    const result = parsed(source);
+    if ('error' in result)
+        return result.error;
+    const { workflow } = result;
+    const jobs = isRecord(workflow) && isRecord(workflow.jobs) ? Object.values(workflow.jobs) : [];
+    return jobs
+        .flatMap((job) => (isRecord(job) && Array.isArray(job.steps) ? job.steps : []))
+        .filter((step) => isRecord(step) && String(step.uses).startsWith(`${actionName(action)}@`));
+}
+const inputValue = (step, input) => isRecord(step.with) ? step.with[input] : undefined;
+const receives = (step, input) => {
+    const value = inputValue(step, input);
+    return value !== undefined && value !== null && value !== '';
+};
+const receivesFrom = (step, input, secret) => String(inputValue(step, input)).split(/\W/).includes(secret);
+/** Un workflow che non usa l'action lo segnala già `workflowGaps`. */
+export function actionInputGaps({ read }, { workflow, action, inputs }) {
+    const source = read(workflow);
+    if (source === undefined)
+        return [];
+    const steps = stepsUsing(source, action);
+    if (typeof steps === 'string')
+        return [{ path: workflow, message: steps }];
+    const gap = (message) => [{ path: workflow, message: `\`${actionName(action)}\` ${message}` }];
+    return inputs.flatMap(({ name, reason, notFrom = [] }) => {
+        if (steps.some((step) => !receives(step, name)))
+            return gap(`non riceve \`${name}\`: ${reason}`);
+        const wrong = notFrom.find(({ secret }) => steps.some((step) => receivesFrom(step, name, secret)));
+        return wrong === undefined ? [] : gap(`riceve \`${name}\` da \`${wrong.secret}\`: ${wrong.reason}`);
+    });
+}

package/dist/smoke.d.ts

@@ -1,2 +1,3 @@
 export { NON_HTML_ROUTES } from './lib/routes.ts';
+export { checkOnDemandPages } from './lib/smoke-on-demand.ts';
 export { checkBotIdChallenge, checkCanonicalHost, checkPages, checkSecurityHeaders, checkTrailingSlash, DEFAULT_CHECKS, SECURITY_HEADERS, } from './lib/smoke-production.ts';

package/dist/smoke.js

@@ -1,2 +1,3 @@
 export { NON_HTML_ROUTES } from './lib/routes.js';
+export { checkOnDemandPages } from './lib/smoke-on-demand.js';
 export { checkBotIdChallenge, checkCanonicalHost, checkPages, checkSecurityHeaders, checkTrailingSlash, DEFAULT_CHECKS, SECURITY_HEADERS, } from './lib/smoke-production.js';