@haus-tech/haus-workflow 0.27.1 → 0.28.1

package/CHANGELOG.md

@@ -1,5 +1,14 @@
 # Changelog
 
+## [0.28.1](https://github.com/WeAreHausTech/haus-workflow/compare/v0.28.0...v0.28.1) (2026-06-17)
+
+## [0.28.0](https://github.com/WeAreHausTech/haus-workflow/compare/v0.27.1...v0.28.0) (2026-06-17)
+
+### Features
+
+- catalog compatibility for curated provenance and deprecations ([#121](https://github.com/WeAreHausTech/haus-workflow/issues/121)) ([1a8a790](https://github.com/WeAreHausTech/haus-workflow/commit/1a8a7902bf7c27462e905d01dfa4d0baac319b57))
+- **cloneandsetup:** add up-front data-access preflight + seed access/empty-ok ([#120](https://github.com/WeAreHausTech/haus-workflow/issues/120)) ([70e32ad](https://github.com/WeAreHausTech/haus-workflow/commit/70e32adba2f5ed25ade170a09d1f0cfb2bd198d7))
+
 ## [0.27.1](https://github.com/WeAreHausTech/haus-workflow/compare/v0.27.0...v0.27.1) (2026-06-16)
 
 ### Bug Fixes

package/dist/cli.js

@@ -1,22 +1,22 @@
 #!/usr/bin/env node
 
 // src/cli.ts
-import { readFileSync as readFileSync4 } from "fs";
-import path35 from "path";
+import { readFileSync as readFileSync4 } from "node:fs";
+import path35 from "node:path";
 import { Command } from "commander";
 
 // src/commands/apply.ts
-import path13 from "path";
+import path13 from "node:path";
 import checkbox from "@inquirer/checkbox";
 
 // src/catalog/remote-catalog.ts
-import os from "os";
-import path2 from "path";
+import os from "node:os";
+import path2 from "node:path";
 import fs2 from "fs-extra";
 
 // src/utils/fs.ts
-import crypto from "crypto";
-import path from "path";
+import crypto from "node:crypto";
+import path from "node:path";
 import fg from "fast-glob";
 import fs from "fs-extra";
 var MalformedJsonFileError = class extends Error {
@@ -200,7 +200,6 @@ var validation_rules_default = {
     "scss-modules",
     "vue",
     "expressjs",
-    "soup-base",
     "laravel",
     "laravel-nova",
     "wordpress",
@@ -372,14 +371,71 @@ function validateCatalogItem(item, content2) {
   return { ok: true };
 }
 
-// src/catalog/manifest-schema.ts
-var POLLUTION_KEYS = /* @__PURE__ */ new Set(["__proto__", "prototype", "constructor"]);
+// src/catalog/manifest-item-fields.ts
+var USE_MODES = /* @__PURE__ */ new Set(["copy", "adapted", "wrapped", "rewritten", "reference-only"]);
+var LICENSE_CONFIDENCES = /* @__PURE__ */ new Set(["high", "medium", "low", "unknown"]);
+var REVIEW_STATUSES = /* @__PURE__ */ new Set([
+  "approved",
+  "candidate",
+  "needs-review",
+  "rejected",
+  "deprecated"
+]);
+var RISK_LEVELS = /* @__PURE__ */ new Set(["low", "medium", "high", "blocked"]);
 function isNonEmptyString(value) {
   return typeof value === "string" && value.length > 0;
 }
 function isStringArray(value) {
   return Array.isArray(value) && value.every((entry) => typeof entry === "string");
 }
+function validateReferences(itemId, references) {
+  if (references === void 0) return null;
+  if (!isStringArray(references)) return `${itemId}: references must be a string array`;
+  for (const ref of references) {
+    if (/^https?:\/\//i.test(ref)) {
+      if (!/^https:\/\//i.test(ref)) {
+        return `${itemId}: reference must be https:// URL: ${ref}`;
+      }
+    }
+  }
+  return null;
+}
+function validateCuratedProvenance(item) {
+  if (item.source !== "curated") return null;
+  if (!isNonEmptyString(item.reviewStatus)) {
+    return `${item.id}: curated item missing reviewStatus`;
+  }
+  if (!REVIEW_STATUSES.has(item.reviewStatus)) {
+    return `${item.id}: invalid reviewStatus "${item.reviewStatus}"`;
+  }
+  if (!isNonEmptyString(item.riskLevel)) {
+    return `${item.id}: curated item missing riskLevel`;
+  }
+  if (!RISK_LEVELS.has(item.riskLevel)) {
+    return `${item.id}: invalid riskLevel "${item.riskLevel}"`;
+  }
+  if (item.useMode !== void 0 && !USE_MODES.has(String(item.useMode))) {
+    return `${item.id}: invalid useMode "${item.useMode}"`;
+  }
+  if (item.licenseConfidence !== void 0 && !LICENSE_CONFIDENCES.has(String(item.licenseConfidence))) {
+    return `${item.id}: invalid licenseConfidence "${item.licenseConfidence}"`;
+  }
+  if (item.originUrl !== void 0) {
+    if (typeof item.originUrl !== "string" || !item.originUrl.startsWith("https://")) {
+      return `${item.id}: originUrl must be an https:// URL`;
+    }
+  }
+  return null;
+}
+
+// src/catalog/manifest-schema.ts
+var POLLUTION_KEYS = /* @__PURE__ */ new Set(["__proto__", "prototype", "constructor"]);
+function isNonEmptyString2(value) {
+  return typeof value === "string" && value.length > 0;
+}
+function isStringArray2(value) {
+  return Array.isArray(value) && value.every((entry) => typeof entry === "string");
+}
 var REQUIRES_ANY_KEYS = ["stack", "dependency", "packageNamePattern", "role"];
 function isRequiresAnyClause(value) {
   if (!value || typeof value !== "object" || Array.isArray(value)) return false;
@@ -409,7 +465,7 @@ function parseManifest(json) {
     return { ok: false, error: "manifest must be an object" };
   }
   const root = data;
-  if (!isNonEmptyString(root.version)) {
+  if (!isNonEmptyString2(root.version)) {
     return { ok: false, error: "missing version" };
   }
   if (!Array.isArray(root.items)) {
@@ -424,13 +480,13 @@ function parseManifest(json) {
       return { ok: false, error: `item[${i}]: invalid entry` };
     }
     const item = raw;
-    if (!isNonEmptyString(item.id)) {
+    if (!isNonEmptyString2(item.id)) {
       return { ok: false, error: `item[${i}]: missing id` };
     }
-    if (!isNonEmptyString(item.type)) {
+    if (!isNonEmptyString2(item.type)) {
       return { ok: false, error: `${item.id}: missing type` };
     }
-    if (!isNonEmptyString(item.path)) {
+    if (!isNonEmptyString2(item.path)) {
       return { ok: false, error: `${item.id}: missing path` };
     }
     if (seenIds.has(item.id)) {
@@ -442,18 +498,14 @@ function parseManifest(json) {
       return { ok: false, error: `${item.id}: duplicate path "${normPath}"` };
     }
     seenPaths.add(normPath);
-    if (item.source === "curated") {
-      if (!isNonEmptyString(item.reviewStatus)) {
-        return { ok: false, error: `${item.id}: curated item missing reviewStatus` };
-      }
-      if (!isNonEmptyString(item.riskLevel)) {
-        return { ok: false, error: `${item.id}: curated item missing riskLevel` };
-      }
-    }
-    if (!isStringArray(item.tags)) {
+    const provenanceError = validateCuratedProvenance(item);
+    if (provenanceError) return { ok: false, error: provenanceError };
+    const referencesError = validateReferences(String(item.id), item.references);
+    if (referencesError) return { ok: false, error: referencesError };
+    if (!isStringArray2(item.tags)) {
       return { ok: false, error: `${item.id}: tags must be a string array` };
     }
-    if (!isStringArray(item.repoRoles)) {
+    if (!isStringArray2(item.repoRoles)) {
       return { ok: false, error: `${item.id}: repoRoles must be a string array` };
     }
     if (item.requiresAny !== void 0 && !isRequiresAnyArray(item.requiresAny)) {
@@ -924,17 +976,17 @@ async function getCacheManifestAge() {
 }
 
 // src/claude/write-claude-files.ts
-import path12 from "path";
+import path12 from "node:path";
 import fs12 from "fs-extra";
 
 // src/catalog/load-catalog.ts
-import path4 from "path";
+import path4 from "node:path";
 
 // src/utils/paths.ts
-import { existsSync, readFileSync } from "fs";
-import os2 from "os";
-import path3 from "path";
-import { fileURLToPath } from "url";
+import { existsSync, readFileSync } from "node:fs";
+import os2 from "node:os";
+import path3 from "node:path";
+import { fileURLToPath } from "node:url";
 var HAUS_DIR = ".haus-workflow";
 function hausPath(root, ...parts) {
   return path3.join(root, HAUS_DIR, ...parts);
@@ -1019,7 +1071,7 @@ function catalogItemContentPath(contentRoot, item) {
 }
 
 // src/update/hash-installed.ts
-import path5 from "path";
+import path5 from "node:path";
 import fg2 from "fast-glob";
 import fs3 from "fs-extra";
 
@@ -1150,12 +1202,12 @@ function buildAllowRules() {
 }
 
 // src/install/settings-merge.ts
-import path7 from "path";
+import path7 from "node:path";
 import fs5 from "fs-extra";
 
 // src/install/manifest.ts
-import os3 from "os";
-import path6 from "path";
+import os3 from "node:os";
+import path6 from "node:path";
 var MANIFEST_SCHEMA = "haus-install-manifest/1";
 function globalClaudeDir() {
   return path6.join(os3.homedir(), ".claude");
@@ -1593,7 +1645,7 @@ async function applyProjectSettingsMerge(root) {
 }
 
 // src/claude/superpowers-install.ts
-import path8 from "path";
+import path8 from "node:path";
 import fg3 from "fast-glob";
 import fs6 from "fs-extra";
 var SUPERPOWERS_ORIGIN_SOURCE_ID = "superpowers-pcvelz";
@@ -1733,7 +1785,7 @@ async function verifyProjectSettingsHooksContract(root) {
 }
 
 // src/claude/write-root-claude-md.ts
-import path9 from "path";
+import path9 from "node:path";
 import fs8 from "fs-extra";
 var BLOCK_BEGIN = "<!-- HAUS:BEGIN haus-imports v=1 -->";
 var BLOCK_END = "<!-- HAUS:END haus-imports -->";
@@ -1808,11 +1860,11 @@ async function writeRootClaudeMd(root, dryRun) {
 }
 
 // src/claude/write-workflow-config.ts
-import path11 from "path";
+import path11 from "node:path";
 import fs10 from "fs-extra";
 
 // src/claude/derive-workflow-config.ts
-import path10 from "path";
+import path10 from "node:path";
 import fs9 from "fs-extra";
 function binCmd(pm, bin, args) {
   const tail = args ? ` ${args}` : "";
@@ -2131,6 +2183,10 @@ async function writeClaudeFiles(root, dryRun, selectedIds, opts = {}) {
   for (const item of catalogItems) {
     const manifestItem = manifestById.get(item.id);
     if (!manifestItem?.path) continue;
+    if (manifestItem.reviewStatus === "deprecated") {
+      warn(`Skipping ${item.id}: reviewStatus is deprecated`);
+      continue;
+    }
     if (manifestItem.source === "curated") {
       if (manifestItem.reviewStatus !== "approved") {
         curatedReviewStatusSkips++;
@@ -2363,8 +2419,8 @@ async function runCatalogAudit() {
 }
 
 // src/commands/clone.ts
-import { existsSync as existsSync2 } from "fs";
-import path14 from "path";
+import { existsSync as existsSync2 } from "node:fs";
+import path14 from "node:path";
 
 // src/utils/exec.ts
 import { execa } from "execa";
@@ -2436,11 +2492,11 @@ async function runClone(url, opts = {}) {
 }
 
 // src/commands/doctor.ts
-import path19 from "path";
+import path19 from "node:path";
 import fs14 from "fs-extra";
 
 // src/scanner/scan-project.ts
-import path18 from "path";
+import path18 from "node:path";
 
 // src/utils/audit-checks.ts
 function isRecord(v) {
@@ -2467,7 +2523,7 @@ function compareVersions(a, b) {
 }
 
 // src/scanner/detect-package-manager.ts
-import path15 from "path";
+import path15 from "node:path";
 import fs13 from "fs-extra";
 function detectPackageManager(root, packageManagerField) {
   const field = String(packageManagerField ?? "").trim();
@@ -2690,7 +2746,7 @@ function runDetection(ctx, rules = STACK_RULES) {
 }
 
 // src/scanner/detection.ts
-import path16 from "path";
+import path16 from "node:path";
 var UNSUPPORTED_MARKERS = {
   "requirements.txt": "python",
   "pyproject.toml": "python",
@@ -2750,8 +2806,8 @@ function collectUnsupportedSignals(files) {
 }
 
 // src/scanner/render.ts
-import { readFile } from "fs/promises";
-import path17 from "path";
+import { readFile } from "node:fs/promises";
+import path17 from "node:path";
 async function buildContentBlob(root, files) {
   const candidates = files.filter(
     (f) => f.endsWith(".ts") || f.endsWith(".js") || f.endsWith(".php") || f.endsWith(".json") || f.endsWith(".yml") || f.endsWith(".yaml")
@@ -3254,7 +3310,7 @@ async function runExplainRecommendation(options) {
 }
 
 // src/commands/guard.ts
-import { readFileSync as readFileSync2 } from "fs";
+import { readFileSync as readFileSync2 } from "node:fs";
 
 // src/security/guard-bash.ts
 function matchesDenyToken(command, denyPhrase) {
@@ -3324,12 +3380,12 @@ async function runGuard(kind, _options) {
 }
 
 // src/commands/init.ts
-import path20 from "path";
+import path20 from "node:path";
 import fs15 from "fs-extra";
 
 // src/utils/prompts.ts
-import { stdin as input, stdout as output } from "process";
-import readline from "readline/promises";
+import { stdin as input, stdout as output } from "node:process";
+import readline from "node:readline/promises";
 async function ask(question) {
   const rl = readline.createInterface({ input, output });
   try {
@@ -3446,6 +3502,10 @@ async function recommend(root, context) {
       skip(item.id, "unsupported-policy", "Unsupported stack policy");
       continue;
     }
+    if (item.reviewStatus === "deprecated") {
+      skip(item.id, "deprecated", "Catalog item is deprecated", "reviewStatus:deprecated");
+      continue;
+    }
     if (item.source === "curated") {
       const rs = item.reviewStatus;
       if (!rs || rs !== "approved") {
@@ -3684,8 +3744,8 @@ async function runInit(options) {
 }
 
 // src/install/apply.ts
-import crypto2 from "crypto";
-import path21 from "path";
+import crypto2 from "node:crypto";
+import path21 from "node:path";
 import fs16 from "fs-extra";
 
 // src/install/header.ts
@@ -4076,7 +4136,7 @@ async function runScan(options) {
 }
 
 // src/commands/undo.ts
-import path22 from "path";
+import path22 from "node:path";
 import fs17 from "fs-extra";
 
 // src/claude/managed-paths.ts
@@ -4201,8 +4261,8 @@ User-owned .claude/ files will be preserved.`
 }
 
 // src/install/uninstall.ts
-import crypto3 from "crypto";
-import path23 from "path";
+import crypto3 from "node:crypto";
+import path23 from "node:path";
 import fs18 from "fs-extra";
 async function runUninstall(options = {}) {
   const { force = false } = options;
@@ -4277,7 +4337,7 @@ async function runUninstallCommand(options) {
 }
 
 // src/commands/update.ts
-import path25 from "path";
+import path25 from "node:path";
 
 // src/claude/refresh-project.ts
 import fs19 from "fs-extra";
@@ -4316,8 +4376,8 @@ function summarizeLockDiff(before, after) {
 }
 
 // src/update/lockfile.ts
-import { mkdir, readFile as readFile2, copyFile } from "fs/promises";
-import path24 from "path";
+import { mkdir, readFile as readFile2, copyFile } from "node:fs/promises";
+import path24 from "node:path";
 async function checkLock(root) {
   const lock = await readJson(hausPath(root, "haus.lock.json")) ?? [];
   const hasValidVersions = lock.every(
@@ -4489,11 +4549,11 @@ async function detectGlobalInstallDrift() {
 }
 
 // src/commands/validate-catalog.ts
-import path27 from "path";
+import path27 from "node:path";
 
 // src/catalog/validate-core.ts
-import fs20 from "fs";
-import path26 from "path";
+import fs20 from "node:fs";
+import path26 from "node:path";
 var ITEM_SEMVER_RE = /^\d+\.\d+\.\d+$/;
 var MANIFEST_SEMVER_RE = /^\d+\.\d+\.\d+(?:-[\w.-]+)?(?:\+[\w.-]+)?$/;
 function isSafeCatalogPath2(itemPath) {
@@ -4527,6 +4587,10 @@ function auditManifestStructure(manifestVersion, items) {
       failures.push(`item[${i}]: missing id`);
       continue;
     }
+    const provenanceError = validateCuratedProvenance(item);
+    if (provenanceError) failures.push(provenanceError);
+    const referencesError = validateReferences(item.id, item.references);
+    if (referencesError) failures.push(referencesError);
     if (!item.type) {
       failures.push(`${item.id}: missing type`);
       continue;
@@ -4554,19 +4618,11 @@ function auditManifestStructure(manifestVersion, items) {
         else seenPaths.set(norm, item.id);
       }
       const isHaus = item.source === "haus";
-      const isCuratedApproved = item.source === "curated" && item.reviewStatus === "approved";
-      if (!isHaus && !isCuratedApproved) {
-        failures.push(`${item.id}: source must be "haus" or curated with reviewStatus "approved"`);
-      }
-      for (const ref of item.references ?? []) {
-        if (/^https?:\/\//i.test(ref)) {
-          if (!ref.startsWith("https://")) {
-            failures.push(`${item.id}: reference must be https:// URL: ${ref}`);
-          }
-          if (HTTP_URL_PATTERN.test(ref)) {
-            failures.push(`${item.id}: reference uses insecure http:// URL: ${ref}`);
-          }
-        }
+      const isCuratedUsableState = item.source === "curated" && (item.reviewStatus === "approved" || item.reviewStatus === "deprecated");
+      if (!isHaus && !isCuratedUsableState) {
+        failures.push(
+          `${item.id}: source must be "haus" or curated with reviewStatus "approved"/"deprecated"`
+        );
       }
     }
   }
@@ -4714,8 +4770,8 @@ async function runValidateCatalog(manifestPath2) {
 }
 
 // src/commands/workspace.ts
-import { existsSync as existsSync5, statSync as statSync2 } from "fs";
-import path34 from "path";
+import { existsSync as existsSync5, statSync as statSync2 } from "node:fs";
+import path34 from "node:path";
 
 // src/commands/workspace/aggregate.ts
 async function writeWorkspaceArtifacts(workspaceRoot, repos, relationships = []) {
@@ -4769,7 +4825,7 @@ ${summaries.map(
 }
 
 // src/commands/workspace/config.ts
-import path28 from "path";
+import path28 from "node:path";
 import YAML from "yaml";
 var WORKSPACE_FILE = "haus.workspace.yaml";
 function parseWorkspaceConfig(text) {
@@ -4796,7 +4852,7 @@ async function readWorkspaceConfig(workspaceRoot) {
 }
 
 // src/commands/workspace/discover.ts
-import path29 from "path";
+import path29 from "node:path";
 import fg4 from "fast-glob";
 import YAML2 from "yaml";
 var DEFAULT_MAX_DEPTH = 3;
@@ -4919,12 +4975,12 @@ async function runDiscover(workspaceRoot, opts = {}) {
 }
 
 // src/commands/workspace/doctor.ts
-import { existsSync as existsSync3 } from "fs";
-import path31 from "path";
+import { existsSync as existsSync3 } from "node:fs";
+import path31 from "node:path";
 
 // src/commands/workspace/manifest.ts
-import { readFileSync as readFileSync3 } from "fs";
-import path30 from "path";
+import { readFileSync as readFileSync3 } from "node:fs";
+import path30 from "node:path";
 var MANIFEST_FILE = "workspace.manifest.json";
 function manifestPath(workspaceRoot) {
   return hausPath(workspaceRoot, MANIFEST_FILE);
@@ -5070,11 +5126,11 @@ function emit(args) {
 }
 
 // src/commands/workspace/setup.ts
-import { existsSync as existsSync4, statSync } from "fs";
-import path33 from "path";
+import { existsSync as existsSync4, statSync } from "node:fs";
+import path33 from "node:path";
 
 // src/claude/write-workspace-claude-md.ts
-import path32 from "path";
+import path32 from "node:path";
 import fs21 from "fs-extra";
 function buildWorkspaceImportBlock(client, members) {
   const memberLines = members.map((m) => `- ${m.name} (${m.path})`);