@elia97/officina 0.11.0 → 0.13.0

package/dist/lib/bundle-css.js

@@ -1,3 +1,7 @@
+const CSS_COMMENT = /\/\*[\s\S]*?\*\//g;
+const MEDIA_PRELUDE = /(?<=@media\b)[^{;]*/gi;
+const RANGE_COMPARISON = /[<>=]/;
+const STYLE_ELEMENT = /<style\b[^>]*>([\s\S]*?)<\/style>/gi;
 const kb = (bytes) => `${(bytes / 1024).toFixed(1)} KB`;
 export const routeCount = (count) => (count === 1 ? '1 rotta' : `${count} rotte`);
 function overBudget({ stylesheets, gzip, routes }, maxGzip) {
@@ -31,3 +35,18 @@ export function measureCss(routes, sheets, maxGzip, assets) {
     failures.push(...measured.filter((group) => group.gzip > maxGzip).map((group) => overBudget(group, maxGzip)));
     return { groups: measured, failures };
 }
+export function rangeMediaQueries(css) {
+    const preludes = [...css.replace(CSS_COMMENT, ' ').matchAll(MEDIA_PRELUDE)].map(([prelude]) => prelude.trim());
+    return [...new Set(preludes.filter((prelude) => RANGE_COMPARISON.test(prelude)))];
+}
+export const inlineStyles = (html) => [...html.matchAll(STYLE_ELEMENT)].map(([, css]) => css).join('\n');
+export function rangeQueryFailures(sources) {
+    return sources.flatMap(({ file, css }) => {
+        const queries = rangeMediaQueries(css);
+        if (queries.length === 0)
+            return [];
+        return [
+            `${file}: media query in sintassi di intervallo, che Safari legge solo dalla 16.4 — ${queries.join(', ')}; si abbassano con \`vite.build.cssTarget\``,
+        ];
+    });
+}

package/dist/lib/check-placeholders.d.ts

@@ -1,8 +1,10 @@
+import type { Manifest } from './alignment.ts';
 import { type Finding, type Hit } from './cli.ts';
-import type { OfficinaConfig } from './config.ts';
+import { type OfficinaConfig } from './config.ts';
 type EnvHit = Omit<Finding, 'path'>;
 export declare function placeholderSources(config?: OfficinaConfig): string[];
 export declare const contactEnvKeys: (config?: OfficinaConfig) => readonly string[];
+export declare function requiredEnvKeys(config: OfficinaConfig, manifest: Manifest): string[];
 export declare function sourceFindings(source: string): Hit[];
 export declare function envFindings(content: string, keys: readonly string[]): EnvHit[];
 export declare const outputFindings: (dir: string) => Finding[];

package/dist/lib/check-placeholders.js

@@ -2,6 +2,7 @@ import { existsSync, readdirSync, readFileSync } from 'node:fs';
 import { join } from 'node:path';
 import { parseEnv } from 'node:util';
 import { readLines } from './cli.js';
+import { DEPENDENCY_FEATURES, featuresOn } from './config.js';
 const DICTIONARIES = 'src/i18n/strings';
 const DEFAULT_SOURCES = ['src/lib/site.ts', 'src/lib/company.ts'];
 const CONTACT_ENV_KEYS = ['CONTACT_FROM_EMAIL', 'CONTACT_FROM_NAME', 'CONTACT_TO_EMAIL'];
@@ -11,7 +12,7 @@ const STRING_LITERAL = /'(?:[^'\\]|\\.)*'|"(?:[^"\\]|\\.)*"/g;
 const COMMENT_ONLY = /^\s*(?:\/\/|\/\*|\*)/;
 const ZERO_POSTAL_CODE = /\bpostalCode:\s*(['"])00000\1/;
 const EMPTY_HREF = /\bhref:\s*(['"])#\1/;
-// `SENSITIVE_ENV_VALUE_PLACEHOLDER` di vercel@62.2.0: `vercel pull` lo scrive al posto del valore di una Sensitive.
+// `SENSITIVE_ENV_VALUE_PLACEHOLDER` di vercel@62.2.0: `vercel pull` lo scrive al posto del valore di una Secret.
 const SENSITIVE = '[SENSITIVE]';
 const WITHOUT_VALUE = 'il deploy andrebbe online senza il suo valore';
 const dictionaries = () => existsSync(DICTIONARIES)
@@ -27,6 +28,11 @@ export function placeholderSources(config = {}) {
     return [...DEFAULT_SOURCES, ...dictionaries()];
 }
 export const contactEnvKeys = (config = {}) => config.placeholders?.contactEnvKeys ?? CONTACT_ENV_KEYS;
+export function requiredEnvKeys(config, manifest) {
+    const on = featuresOn(config, manifest);
+    const secrets = on.map((name) => DEPENDENCY_FEATURES[name].secret);
+    return [...new Set([...contactEnvKeys(config), ...secrets])];
+}
 function literalFindings(value) {
     const messages = [];
     const token = value.match(TOKEN);
@@ -64,7 +70,7 @@ export function envFindings(content, keys) {
             { line: declaration.n, severity, message: `${key} ${message}` },
         ];
         if (value === SENSITIVE)
-            return hit('warning', 'è Sensitive su Vercel: vercel pull non ne scarica il valore, e il deploy non lo può verificare');
+            return hit('warning', 'è Secret su Vercel: vercel pull non ne scarica il valore, e il deploy non lo può verificare');
         if (value === '')
             return hit('error', `è vuota: ${WITHOUT_VALUE}`);
         if (TOKEN.test(value) || DOMAIN.test(value))
@@ -84,5 +90,5 @@ export const outputFindings = (dir) => filesUnder(dir)
     .map((path) => ({
     path,
     severity: 'error',
-    message: `contiene ${SENSITIVE}, il segnaposto che vercel pull scrive per una variabile Sensitive: la build l'ha incorporato al posto del valore`,
+    message: `contiene ${SENSITIVE}, il segnaposto che vercel pull scrive per una variabile Secret: la build l'ha incorporato al posto del valore`,
 }));

package/dist/lib/check-routes.js

@@ -1,5 +1,6 @@
 import { existsSync, readFileSync } from 'node:fs';
 import { posix } from 'node:path';
+import { DRIZZLE_CONFIG } from './database-auth.js';
 import { blankFences, blankSpans, linkDestinations } from './markdown.js';
 const SCANNED = /\.md$/;
 const ROADMAP = 'docs/ROADMAP.md';
@@ -10,14 +11,14 @@ const IGNORED = [
     /\.pdf$/,
     /^docs\/sources\//,
 ];
-const PATH_REFERENCE = /`((?:docs|src|scripts|test|e2e|public|\.claude|\.github)\/[A-Za-z0-9._/-]+\.[a-z]+)`/g;
+const PATH_REFERENCE = /`((?:docs|src|scripts|test|e2e|public|drizzle|\.claude|\.github)\/[A-Za-z0-9._/-]+\.[a-z]+)`/g;
 const NAME_REFERENCE = /`([A-Za-z0-9._-]+)`/g;
 // La virgola non delimita: i titoli la contengono.
 const SECTION_REFERENCE = /`([A-Za-z0-9._/-]+\.md)`\s*§\s*([^.·|)§]{1,80})/g;
 const LINK_TEXT = /\[[^[\]]*\]\(/g;
 const ROOT_DOCUMENT = /^[A-Z][A-Z0-9_-]*\.md$/;
 // I file tracciati alla radice di template/vetrina (git ls-files), Markdown esclusi.
-const ROOT_CONFIG = new Set([
+const VETRINA_ROOT = [
     '.editorconfig',
     '.env.example',
     '.fallowrc.jsonc',
@@ -39,7 +40,8 @@ const ROOT_CONFIG = new Set([
     'tsconfig.json',
     'vercel.json',
     'vitest.config.ts',
-]);
+];
+const ROOT_CONFIG = new Set([...VETRINA_ROOT, DRIZZLE_CONFIG]);
 const CHANGELOG = /(?:^|\/)CHANGELOG\.md$/;
 const SITE_CONTENT = /^src\/content\//;
 const EXTERNAL = /^(?:[a-z][a-z0-9+.-]*:|#|\/)/i;

package/dist/lib/cli.d.ts

@@ -19,6 +19,7 @@ export type CliOptions = ReturnType<typeof cliOptions>;
 export declare const isGenerated: (path: string) => boolean;
 export declare function missingInput(path: string, purpose: string): boolean;
 export declare function scopedPaths(options: CliOptions, isScanned: (path: string) => boolean): string[];
+export declare const maskCommand: (value: string) => string;
 export declare function printFindings(findings: Finding[], format: string): void;
 export declare function exitCode(findings: Finding[], strict: boolean): number;
 export declare const readLines: (text: string) => {

package/dist/lib/cli.js

@@ -38,6 +38,7 @@ export function scopedPaths(options, isScanned) {
 }
 // I workflow command di GitHub vogliono %, CR e LF codificati nel messaggio.
 const escapeForGitHub = (text) => text.replace(/%/g, '%25').replace(/\r/g, '%0D').replace(/\n/g, '%0A');
+export const maskCommand = (value) => `::add-mask::${escapeForGitHub(value)}`;
 export function printFindings(findings, format) {
     for (const finding of findings) {
         const location = finding.line === undefined ? '' : `:${finding.line}`;

package/dist/lib/config-gaps.js

@@ -8,13 +8,8 @@ function siteUrlGap(siteUrl) {
         return `\`siteUrl\` non è un URL: \`${siteUrl}\``;
     return siteUrl.endsWith('/') ? `\`siteUrl\` finisce con una barra: \`${siteUrl}\`` : undefined;
 }
-// TODO: dalla 0.12.0 `links` è un errore di doctor: toglila da NEW_FEATURES.
-const NEW_FEATURES = new Set(['links']);
 // Il silenzio vale `'required'`: un controllo si spegne dichiarandolo, non dimenticandolo.
-const featureGaps = (config) => FEATURES.filter((name) => config.features?.[name] === undefined).map((name) => ({
-    ...asGap(`\`features.${name}\` non dichiarata: vale \`'required'\`, e il gate fallisce se non trova cosa controllare`),
-    ...(NEW_FEATURES.has(name) ? { severity: 'warning' } : {}),
-}));
+const featureGaps = (config) => FEATURES.filter((name) => config.features?.[name] === undefined).map((name) => asGap(`\`features.${name}\` non dichiarata: vale \`'required'\`, e il gate fallisce se non trova cosa controllare`));
 const representativeGaps = (patterns) => patterns.map((label) => `\`routes.representatives\` non ha un percorso per \`${label}\`: smoke e Lighthouse non guardano quella pagina`);
 const disabledGaps = (labels) => labels.map((label) => `\`routes.disabled\` nomina \`${label}\`, che non è una pagina dinamica prerenderizzata di \`src/pages\`: non spegne niente`);
 export function configGaps(loaded, { missingRepresentatives = [], unknownDisabled = [] } = {}) {

package/dist/lib/config.d.ts

@@ -1,3 +1,4 @@
+import type { Manifest } from './alignment.ts';
 import type { Budget } from './bundle-budget.ts';
 import type { Representatives, VerifiedRoute } from './routes.ts';
 import type { SmokeCheck } from './smoke-production.ts';
@@ -22,18 +23,27 @@ export interface OfficinaConfig {
     analytics?: {
         linkTracking?: string;
     };
-    /** Quali controlli il progetto pretende. Una voce non dichiarata vale `'required'`. */
+    /**
+     * Quali controlli il progetto pretende. Una voce non dichiarata vale `'required'`, tranne `database`
+     * e `auth`, che senza dichiarazione seguono le dipendenze di `package.json`.
+     */
     features?: {
         analytics?: FeatureSetting;
         roadmap?: FeatureSetting;
         generators?: GeneratorsSetting;
         botId?: FeatureSetting;
         links?: FeatureSetting;
+        database?: FeatureSetting;
+        auth?: FeatureSetting;
     };
     placeholders?: {
         sources?: readonly string[];
         contactEnvKeys?: readonly string[];
     };
+    /** La variabile con cui girano le migrazioni; senza dichiarazione, `DATABASE_URL_UNPOOLED`. */
+    database?: {
+        migrationUrlKey?: string;
+    };
     routes?: {
         /** Per ogni pattern dinamico di `src/pages`, un percorso vero che smoke e Lighthouse visitano. */
         representatives?: Representatives;
@@ -46,6 +56,21 @@ export type FeatureName = (typeof FEATURES)[number];
 /** Un controllo si spegne solo scrivendolo: il silenzio vale `'required'`. */
 export declare const isRequired: (config: OfficinaConfig, name: FeatureName) => boolean;
 export declare const generatorsSetting: (config: OfficinaConfig) => GeneratorsSetting;
+export declare const DEPENDENCY_FEATURES: {
+    readonly database: {
+        readonly dependency: 'drizzle-orm';
+        readonly secret: 'DATABASE_URL';
+    };
+    readonly auth: {
+        readonly dependency: 'better-auth';
+        readonly secret: 'BETTER_AUTH_SECRET';
+    };
+};
+export type DependencyFeature = keyof typeof DEPENDENCY_FEATURES;
+export declare function isOn(config: OfficinaConfig, manifest: Manifest, name: DependencyFeature): boolean;
+export declare const featuresOn: (config: OfficinaConfig, manifest: Manifest) => DependencyFeature[];
+export declare const featuresOffByChoice: (config: OfficinaConfig, manifest: Manifest) => DependencyFeature[];
+export declare const migrationUrlKey: (config: OfficinaConfig) => string;
 export declare const defineConfig: (config: OfficinaConfig) => OfficinaConfig;
 export declare const findConfigFile: (root: string) => string | undefined;
 export declare function loadConfig(root: string): Promise<OfficinaConfig>;

package/dist/lib/config.js

@@ -9,11 +9,28 @@ var __rewriteRelativeImportExtension = (this && this.__rewriteRelativeImportExte
 import { existsSync } from 'node:fs';
 import { basename, join } from 'node:path';
 import { pathToFileURL } from 'node:url';
-import { aFunction, aNumber, anArrayOf, aRecordOf, aShape, aString, aStringOrNull, oneOf } from './validate.js';
+import { aFunction, aNumber, anArrayOf, anEnvName, aRecordOf, aShape, aString, aStringOrNull, isRecord, oneOf, } from './validate.js';
 export const FEATURES = ['analytics', 'roadmap', 'generators', 'botId', 'links'];
 /** Un controllo si spegne solo scrivendolo: il silenzio vale `'required'`. */
 export const isRequired = (config, name) => (config.features?.[name] ?? 'required') === 'required';
 export const generatorsSetting = (config) => config.features?.generators ?? 'required';
+export const DEPENDENCY_FEATURES = {
+    database: { dependency: 'drizzle-orm', secret: 'DATABASE_URL' },
+    auth: { dependency: 'better-auth', secret: 'BETTER_AUTH_SECRET' },
+};
+const DEPENDENCY_FEATURE_NAMES = Object.keys(DEPENDENCY_FEATURES);
+const declares = (dependencies, name) => isRecord(dependencies) && name in dependencies;
+const dependsOn = ({ dependencies, devDependencies }, name) => {
+    const { dependency } = DEPENDENCY_FEATURES[name];
+    return declares(dependencies, dependency) || declares(devDependencies, dependency);
+};
+export function isOn(config, manifest, name) {
+    const declared = config.features?.[name];
+    return declared === undefined ? dependsOn(manifest, name) : declared === 'required';
+}
+export const featuresOn = (config, manifest) => DEPENDENCY_FEATURE_NAMES.filter((name) => isOn(config, manifest, name));
+export const featuresOffByChoice = (config, manifest) => DEPENDENCY_FEATURE_NAMES.filter((name) => config.features?.[name] === false && dependsOn(manifest, name));
+export const migrationUrlKey = (config) => config.database?.migrationUrlKey ?? 'DATABASE_URL_UNPOOLED';
 const budget = aShape({ label: aString, matches: aFunction, maxGzip: aNumber });
 const verifiedRoute = aShape({ path: aString, type: aString });
 const feature = oneOf("'required' oppure false", ['required', false]);
@@ -28,8 +45,17 @@ const SHAPE = aShape({
         checks: anArrayOf(aFunction),
     }),
     analytics: aShape({ linkTracking: aString }),
-    features: aShape({ analytics: feature, roadmap: feature, generators, botId: feature, links: feature }),
+    features: aShape({
+        analytics: feature,
+        roadmap: feature,
+        generators,
+        botId: feature,
+        links: feature,
+        database: feature,
+        auth: feature,
+    }),
     placeholders: aShape({ sources: anArrayOf(aString), contactEnvKeys: anArrayOf(aString) }),
+    database: aShape({ migrationUrlKey: anEnvName }),
     routes: aShape({ representatives: aRecordOf(aString), disabled: anArrayOf(aString) }),
 });
 const CONFIG_FILES = ['officina.config.ts', 'officina.config.mjs', 'officina.config.js'];

package/dist/lib/database-auth.d.ts

@@ -0,0 +1,5 @@
+import type { Manifest, ProjectFiles } from './alignment.ts';
+import { type DependencyFeature } from './config.ts';
+import type { ContractGap } from './contract.ts';
+export declare const DRIZZLE_CONFIG = "drizzle.config.ts";
+export declare function databaseAuthGaps(files: ProjectFiles, manifest: Manifest, on: readonly DependencyFeature[]): ContractGap[];

package/dist/lib/database-auth.js

@@ -0,0 +1,81 @@
+import { DEPENDENCY_FEATURES } from './config.js';
+import { envSchema } from './env-schema.js';
+import { actionInputGaps } from './workflows.js';
+const MANIFEST = 'package.json';
+export const DRIZZLE_CONFIG = 'drizzle.config.ts';
+const ASTRO_CONFIG = 'astro.config.mjs';
+const SCRIPTS = [
+    { name: 'db:generate', reason: 'le migrazioni si generano dallo schema con quel nome' },
+    { name: 'db:migrate', reason: 'le migrazioni si applicano con quel nome, in CI e al deploy' },
+];
+const CI_INPUTS = {
+    workflow: '.github/workflows/ci.yml',
+    action: 'ci',
+    inputs: [
+        { name: 'migrate', reason: 'il branch di test non si migra prima dei test' },
+        {
+            name: 'database-url',
+            reason: 'i test di integrazione si saltano',
+            notFrom: [
+                { secret: 'PRODUCTION_DATABASE_URL', reason: 'la CI migrerebbe la produzione con le migrazioni delle PR' },
+                {
+                    secret: 'TEST_DATABASE_URL',
+                    reason: 'le corse parallele migrerebbero lo stesso branch, invece di un branch Neon per corsa',
+                },
+            ],
+        },
+    ],
+};
+const DEPLOY_INPUTS = {
+    workflow: '.github/workflows/deploy.yml',
+    action: 'deploy',
+    inputs: [
+        { name: 'migrate', reason: 'la produzione parte con lo schema di prima' },
+        {
+            name: 'database-url',
+            reason: "le migrazioni del deploy non hanno l'indirizzo di produzione",
+            notFrom: [
+                {
+                    secret: 'TEST_DATABASE_URL',
+                    reason: 'le migrazioni girerebbero sul branch di test, e la produzione partirebbe con lo schema di prima',
+                },
+            ],
+        },
+    ],
+};
+function databaseGaps(files, { scripts = {} }) {
+    const gaps = SCRIPTS.filter(({ name }) => scripts[name] === undefined).map(({ name, reason }) => ({
+        path: MANIFEST,
+        message: `script \`${name}\` assente: ${reason}`,
+    }));
+    if (files.read(DRIZZLE_CONFIG) === undefined) {
+        gaps.push({ path: DRIZZLE_CONFIG, message: 'manca: drizzle-kit legge da lì la sua configurazione' });
+    }
+    return [...gaps, ...actionInputGaps(files, CI_INPUTS), ...actionInputGaps(files, DEPLOY_INPUTS)];
+}
+function secretGap(key, field) {
+    if (field === undefined) {
+        return `\`${key}\` non è in \`env.schema\`: va dichiarata con \`context: 'server'\` e \`access: 'secret'\``;
+    }
+    if (field.context === 'server' && field.access === 'secret')
+        return undefined;
+    return `\`${key}\` in \`env.schema\` non è \`context: 'server'\` con \`access: 'secret'\`: una variabile pubblica Astro la scrive nel codice della build`;
+}
+function secretGaps(source, keys) {
+    if (keys.length === 0)
+        return [];
+    if (source === undefined)
+        return [{ path: ASTRO_CONFIG, message: 'manca: lo schema delle variabili, `env.schema`, sta lì' }];
+    const fields = new Map(envSchema(source).map((field) => [field.key, field]));
+    return keys.flatMap((key) => {
+        const message = secretGap(key, fields.get(key));
+        return message === undefined ? [] : [{ path: ASTRO_CONFIG, message }];
+    });
+}
+// TODO: dalla 0.14.0 i requisiti del database e dell'autenticazione sono errori di doctor: togli `severity`.
+const asWarning = (gap) => ({ ...gap, severity: 'warning' });
+export function databaseAuthGaps(files, manifest, on) {
+    const database = on.includes('database') ? databaseGaps(files, manifest) : [];
+    const secrets = secretGaps(files.read(ASTRO_CONFIG), on.map((name) => DEPENDENCY_FEATURES[name].secret));
+    return [...database, ...secrets].map(asWarning);
+}

package/dist/lib/env-schema.d.ts

@@ -0,0 +1,8 @@
+export interface EnvField {
+    key: string;
+    type: string;
+    context: string | undefined;
+    access: string | undefined;
+    constrained: boolean;
+}
+export declare function envSchema(source: string): EnvField[];

package/dist/lib/env-schema.js

@@ -0,0 +1,37 @@
+import { Node, Project, SyntaxKind } from 'ts-morph';
+const ENV_FIELD = /^envField\.(\w+)$/;
+// Le validazioni che la guida di Astro elenca per envField.string, oltre al tipo.
+const CONSTRAINTS = ['max', 'min', 'length', 'url', 'includes', 'startsWith', 'endsWith'];
+const constrained = (options) => Node.isObjectLiteralExpression(options) && CONSTRAINTS.some((name) => options.getProperty(name) !== undefined);
+const keyOf = (property) => {
+    const name = property.getNameNode();
+    return Node.isStringLiteral(name) ? name.getLiteralValue() : name.getText();
+};
+function literal(options, name) {
+    if (!Node.isObjectLiteralExpression(options))
+        return undefined;
+    const property = options.getProperty(name);
+    const value = Node.isPropertyAssignment(property) ? property.getInitializer() : undefined;
+    return Node.isStringLiteral(value) ? value.getLiteralValue() : undefined;
+}
+// Il sorgente si legge invece di importarlo: astro.config.mjs importa moduli senza estensione, che
+// risolve Vite e che Node rifiuta con ERR_MODULE_NOT_FOUND.
+export function envSchema(source) {
+    const file = new Project({ useInMemoryFileSystem: true }).createSourceFile('astro.config.mjs', source);
+    return file.getDescendantsOfKind(SyntaxKind.CallExpression).flatMap((call) => {
+        const property = call.getParent();
+        const type = ENV_FIELD.exec(call.getExpression().getText())?.[1];
+        if (type === undefined || !Node.isPropertyAssignment(property))
+            return [];
+        const [options] = call.getArguments();
+        return [
+            {
+                key: keyOf(property),
+                type,
+                context: literal(options, 'context'),
+                access: literal(options, 'access'),
+                constrained: constrained(options),
+            },
+        ];
+    });
+}

package/dist/lib/migrate.d.ts

@@ -0,0 +1,11 @@
+type Env = Readonly<Record<string, string | undefined>>;
+export type MigrationEnv = {
+    env: Record<string, string | undefined>;
+    url: string;
+} | {
+    error: string;
+};
+export type MigrationTarget = 'test' | 'production';
+export declare function migrationEnv(env: Env, key: string, target: MigrationTarget): MigrationEnv;
+export declare function maskedValues(url: string): string[];
+export {};

package/dist/lib/migrate.js

@@ -0,0 +1,29 @@
+const SOURCES = {
+    test: {
+        variable: 'TEST_DATABASE_URL',
+        origin: "è l'indirizzo del branch di test, che `actions/ci` riceve con `database-url`",
+    },
+    production: {
+        variable: 'PRODUCTION_DATABASE_URL',
+        origin: "è l'indirizzo di produzione, che `actions/deploy` riceve con `database-url` dal segreto `PRODUCTION_DATABASE_URL` dell'environment `production`, dichiarato dal job di deploy",
+    },
+};
+export function migrationEnv(env, key, target) {
+    const { variable, origin } = SOURCES[target];
+    const { [variable]: url, ...rest } = env;
+    if (!url)
+        return { error: `\`${variable}\` è vuota: ${origin}` };
+    return { env: { ...rest, [key]: url }, url };
+}
+const decoded = (text) => {
+    try {
+        return decodeURIComponent(text);
+    }
+    catch {
+        return text;
+    }
+};
+export function maskedValues(url) {
+    const password = URL.parse(url)?.password ?? '';
+    return [...new Set(password === '' ? [url] : [url, password, decoded(password)])];
+}

package/dist/lib/routes.js

@@ -33,10 +33,12 @@ export function pageRouteOf(file, pagesDir) {
         .replace(/\.astro$/, '')
         .replace(/\/index$/, '') || '/');
 }
+const PARAMETER = /(\[[^\]]*\])/;
 function segmentPattern(segment) {
-    if (segment.startsWith('['))
-        return '[^/]+';
-    return segment.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+    return segment
+        .split(PARAMETER)
+        .map((part) => (part.startsWith('[') ? '[^/]+' : part.replace(/[.*+?^${}()|[\]\\]/g, '\\$&')))
+        .join('');
 }
 const TRAILING_REST_SEGMENT = /\/\[\.\.\.[^/]*\]$/;
 // Anche un segmento rest finale fa match col vuoto: `paginate()` emette la prima pagina come

package/dist/lib/secrets.d.ts

@@ -0,0 +1,10 @@
+import type { Finding } from './cli.ts';
+import type { EnvField } from './env-schema.ts';
+export declare function secretFields(fields: readonly EnvField[]): EnvField[];
+export declare const canary: (key: string) => string;
+export declare const canaryLines: (secrets: readonly EnvField[]) => string[];
+export interface SecretScan {
+    findings: Finding[];
+    verified: string[];
+}
+export declare function scanSecrets(keys: readonly string[], env: Readonly<Record<string, string | undefined>>, files: readonly string[], read: (path: string) => Buffer): SecretScan;

package/dist/lib/secrets.js

@@ -0,0 +1,53 @@
+const SCHEMA = 'astro.config.mjs';
+const MIN_SEARCHABLE = 8;
+export function secretFields(fields) {
+    const secrets = fields.filter(({ context, access }) => context === 'server' && access === 'secret');
+    return secrets.filter(({ key }, index) => secrets.findIndex((field) => field.key === key) === index);
+}
+export const canary = (key) => `officina-${key}-canary`;
+// Astro valida ogni variabile sul tipo e sulle validazioni del suo envField: un canary di testo non
+// è un `number`, un `boolean` né un `enum`, e non rispetta `url`, `startsWith` e simili.
+export const canaryLines = (secrets) => secrets.filter(({ type, constrained }) => type === 'string' && !constrained).map(({ key }) => `${key}=${canary(key)}`);
+// Le due forme in cui il runtime di Astro scrive un valore: escapeHTML nel markup, stringifyForScript
+// negli script (astro/dist/runtime/server/escape.js).
+const written = (value) => [
+    value,
+    value
+        .replaceAll('&', '&')
+        .replaceAll('<', '&lt;')
+        .replaceAll('>', '&gt;')
+        .replaceAll("'", '&#39;')
+        .replaceAll('"', '&quot;'),
+    JSON.stringify(value).slice(1, -1).replaceAll('<', '\\u003c'),
+];
+function target(key, raw) {
+    const value = raw?.trim() ?? '';
+    const own = value.length >= MIN_SEARCHABLE && value !== canary(key) ? written(value) : [];
+    return { key, value, needles: [...new Set([canary(key), ...own])] };
+}
+const searchable = ({ value }) => value.length >= MIN_SEARCHABLE;
+const leaksIn = (path, content, targets) => targets
+    .filter(({ needles }) => needles.some((needle) => content.includes(needle)))
+    .map(({ key }) => ({ path, key, viaCanary: content.includes(canary(key)) }));
+const leakFinding = ({ path, key, viaCanary }) => ({
+    path,
+    severity: 'error',
+    message: `contiene ${viaCanary ? 'il canary' : 'il valore'} di \`${key}\`, una chiave server e secret di env.schema`,
+});
+const unverifiable = ({ key, value }) => ({
+    path: SCHEMA,
+    severity: 'warning',
+    message: value === ''
+        ? `\`${key}\` non si verifica: nell'ambiente non ci sono né il suo valore né il canary`
+        : `\`${key}\` non si verifica: il suo valore ha meno di ${MIN_SEARCHABLE} caratteri, e cercarlo darebbe falsi positivi`,
+});
+export function scanSecrets(keys, env, files, read) {
+    const targets = keys.map((key) => target(key, env[key]));
+    const leaks = files.flatMap((path) => leaksIn(path, read(path), targets));
+    const leaked = new Set(leaks.map(({ key }) => key));
+    const clean = targets.filter(({ key }) => !leaked.has(key));
+    return {
+        findings: [...leaks.map(leakFinding), ...clean.filter((t) => !searchable(t)).map(unverifiable)],
+        verified: clean.filter(searchable).map(({ key }) => key),
+    };
+}

package/dist/lib/smoke-on-demand.d.ts

@@ -0,0 +1,8 @@
+import { type Expectations, type Representatives } from './routes.ts';
+import type { CheckResult, SmokeContext } from './smoke-production.ts';
+export type OnDemandPage = {
+    label: string;
+    path?: string;
+};
+export declare function onDemandPages(expected: Expectations, pagesDir: string, representatives?: Representatives): OnDemandPage[];
+export declare function checkOnDemandPages(context: SmokeContext): Promise<CheckResult[]>;

package/dist/lib/smoke-on-demand.js

@@ -0,0 +1,65 @@
+import { pageRouteOf } from './routes.js';
+export function onDemandPages(expected, pagesDir, representatives = {}) {
+    return expected.ssr
+        .map((file) => pageRouteOf(file, pagesDir))
+        .sort()
+        .map((label) => {
+        const path = label.includes('[') ? representatives[label] : label;
+        return path === undefined ? { label } : { label, path };
+    });
+}
+const META = /<meta\b[^>]*>/gi;
+const HTTP_EQUIV = /(?<![-\w])http-equiv\s*=\s*(?:"([^"]*)"|'([^']*)'|([^\s"'>]+))/i;
+const CONTENT = /(?<![-\w])content\s*=\s*(?:"([^"]*)"|'([^']*)'|([^\s"'>]+))/i;
+const SCRIPT_SRC = /(?:^|;)\s*script-src(?:\s|;|$)/i;
+const attributeValue = (tag, attribute) => {
+    const match = attribute.exec(tag);
+    return match?.[1] ?? match?.[2] ?? match?.[3] ?? '';
+};
+const hasCspMeta = (html) => [...html.matchAll(META)].some(([tag]) => attributeValue(tag, HTTP_EQUIV).toLowerCase() === 'content-security-policy' &&
+    SCRIPT_SRC.test(attributeValue(tag, CONTENT)));
+// TODO: dalla 0.14.0 un'anomalia di una pagina resa a richiesta fa fallire lo smoke: qui `warn` diventa `fail`.
+const warn = (check, detail) => ({ check, status: 'warn', detail });
+function redirect(check, response, url) {
+    const location = response.headers.get('location');
+    if (location === null)
+        return warn(check, `risponde ${response.status} senza location`);
+    const target = new URL(location, url);
+    const { origin } = new URL(url);
+    if (target.origin !== origin)
+        return warn(check, `rimanda a ${target.href}, fuori da ${origin}`);
+    return { check, status: 'pass' };
+}
+async function visit({ get, baseUrl }, path) {
+    const check = `GET ${path} (a richiesta)`;
+    const url = `${baseUrl}${path}`;
+    try {
+        const response = await get(url);
+        if (response.status >= 300 && response.status < 400)
+            return redirect(check, response, url);
+        if (response.status !== 200) {
+            return warn(check, `atteso 200 o un redirect sulla stessa origine, ricevuto ${response.status}`);
+        }
+        const contentType = response.headers.get('content-type') ?? '';
+        if (!contentType.includes('text/html'))
+            return warn(check, `atteso un content-type text/html, ricevuto "${contentType}"`);
+        if (!hasCspMeta((await response.text?.()) ?? ''))
+            return warn(check, 'manca il meta Content-Security-Policy con script-src');
+        return { check, status: 'pass' };
+    }
+    catch (error) {
+        return warn(check, error instanceof Error ? error.message : String(error));
+    }
+}
+export async function checkOnDemandPages(context) {
+    const results = [];
+    for (const { label, path } of context.onDemand ?? []) {
+        if (path !== undefined)
+            results.push(await visit(context, path));
+        else {
+            const detail = 'pagina dinamica senza rappresentante in `routes.representatives`';
+            results.push({ check: `pagina ${label} (a richiesta)`, status: 'skip', detail });
+        }
+    }
+    return results;
+}

package/dist/lib/smoke-production.d.ts

@@ -1,10 +1,12 @@
 import type { VerifiedRoute } from './routes.ts';
+import { type OnDemandPage } from './smoke-on-demand.ts';
 export interface SmokeResponse {
     ok: boolean;
     status: number;
     headers: {
         get: (name: string) => string | null;
     };
+    text?: () => Promise<string>;
 }
 export type Fetcher = (url: string) => Promise<SmokeResponse>;
 export interface SmokeContext {
@@ -13,11 +15,12 @@ export interface SmokeContext {
     siteUrl: string;
     securityHeaders: Record<string, string | null>;
     botIdRequired: boolean;
+    onDemand?: readonly OnDemandPage[];
 }
 export type SmokeCheck = (context: SmokeContext, pages: readonly VerifiedRoute[]) => Promise<CheckResult[]>;
 export interface CheckResult {
     check: string;
-    status: 'pass' | 'fail' | 'skip';
+    status: 'pass' | 'fail' | 'skip' | 'warn';
     detail?: string;
 }
 export declare const SECURITY_HEADERS: Record<string, string | null>;

package/dist/lib/smoke-production.js

@@ -1,3 +1,4 @@
+import { checkOnDemandPages } from './smoke-on-demand.js';
 const pass = (check) => ({ check, status: 'pass' });
 const fail = (check, detail) => ({ check, status: 'fail', detail });
 const skip = (check, detail) => ({ check, status: 'skip', detail });
@@ -144,6 +145,7 @@ export async function checkTrailingSlash({ get, baseUrl }, pages) {
 }
 export const DEFAULT_CHECKS = [
     checkPages,
+    checkOnDemandPages,
     checkSecurityHeaders,
     checkBotIdChallenge,
     checkCanonicalHost,