@rexezuge/tooling 0.0.0-stage → 1.0.0

package/dist/scripts/lib/github-actions.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"github-actions.js","sourceRoot":"","sources":["../../../src/scripts/lib/github-actions.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAAE,cAAc,EAAE,MAAM,SAAS,CAAC;AAEzC;;GAEG;AACH,MAAM,UAAU,SAAS,CAAC,IAAY,EAAE,KAAa;IACnD,MAAM,UAAU,GAAG,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC;IAC7C,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,OAAO;IACT,CAAC;IACD,cAAc,CAAC,UAAU,EAAE,GAAG,IAAI,IAAI,KAAK,IAAI,CAAC,CAAC;AACnD,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,QAAQ,CAAC,OAAe;IACtC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,YAAY,OAAO,IAAI,CAAC,CAAC;AAChD,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,IAAI,CAAC,OAAe;IAClC,QAAQ,CAAC,OAAO,CAAC,CAAC;IAClB,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC"}

package/dist/scripts/lib/wrangler-table.d.ts

@@ -0,0 +1,46 @@
+/**
+ * Parsers for the human-readable tables `wrangler` prints.
+ *
+ * Provenance: ported from Edge-Sonic's `scripts/lib/wrangler-table.ts`, which was
+ * factored out of two scripts that had each grown their own copy.
+ *
+ * `wrangler secrets-store …` renders through `cli-table3`, which draws a
+ * box-drawing frame and separates cells with U+2502 (`│`) padded by exactly one
+ * space. Columns are therefore *not* space-aligned, and a parser written for
+ * aligned output silently matches nothing — which reads as "the resource is
+ * absent" and makes provisioning create a duplicate.
+ *
+ * ### Why membership is exact and never a substring
+ *
+ * Durable-DAV's `init-secrets.ts` used `output.includes(secretName)`, and that is
+ * the defect this port replaces: a store holding both
+ * `durable-dav-replication-encryption-key` and a `…-key-backup` would satisfy a
+ * substring search for the first, so the real secret was reported as already
+ * present and never created. A substring match is not a membership test.
+ */
+/**
+ * Extracts the data rows of a `wrangler` table, dropping the frame, the header,
+ * and any surrounding log lines.
+ *
+ * Rows are returned in print order with cells trimmed and empty cells removed,
+ * so a blank optional column (`Comment`, typically unset) does not shift the
+ * columns a caller indexes into.
+ */
+export declare function parseWranglerTableRows(output: string): string[][];
+/**
+ * The exact names in the first column of a `wrangler secrets-store secret list`
+ * table.
+ *
+ * Exact values rather than a substring search — see the header.
+ */
+export declare function parseWranglerNames(output: string): Set<string>;
+/**
+ * True when a failed `secrets-store secret list` means the store is empty
+ * rather than the listing having failed.
+ *
+ * Callers must treat this as a confirmed absence; every other failure has to
+ * stay indistinguishable from "unknown", or a transient CLI error would be read
+ * as permission to create a secret that already holds a live value.
+ */
+export declare function isEmptySecretsStoreListing(error: unknown): boolean;
+//# sourceMappingURL=wrangler-table.d.ts.map

package/dist/scripts/lib/wrangler-table.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"wrangler-table.d.ts","sourceRoot":"","sources":["../../../src/scripts/lib/wrangler-table.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAiBH;;;;;;;GAOG;AACH,wBAAgB,sBAAsB,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,EAAE,CAyBjE;AAED;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC,CAO9D;AASD;;;;;;;GAOG;AACH,wBAAgB,0BAA0B,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAGlE"}

package/dist/scripts/lib/wrangler-table.js

@@ -0,0 +1,99 @@
+/**
+ * Parsers for the human-readable tables `wrangler` prints.
+ *
+ * Provenance: ported from Edge-Sonic's `scripts/lib/wrangler-table.ts`, which was
+ * factored out of two scripts that had each grown their own copy.
+ *
+ * `wrangler secrets-store …` renders through `cli-table3`, which draws a
+ * box-drawing frame and separates cells with U+2502 (`│`) padded by exactly one
+ * space. Columns are therefore *not* space-aligned, and a parser written for
+ * aligned output silently matches nothing — which reads as "the resource is
+ * absent" and makes provisioning create a duplicate.
+ *
+ * ### Why membership is exact and never a substring
+ *
+ * Durable-DAV's `init-secrets.ts` used `output.includes(secretName)`, and that is
+ * the defect this port replaces: a store holding both
+ * `durable-dav-replication-encryption-key` and a `…-key-backup` would satisfy a
+ * substring search for the first, so the real secret was reported as already
+ * present and never created. A substring match is not a membership test.
+ */
+/**
+ * Cell separator emitted by `cli-table3`.
+ */
+const COLUMN_SEPARATOR = String.fromCodePoint(0x25_02);
+/**
+ * Horizontal rule drawn by `cli-table3`; a row made of these is not data.
+ */
+const RULE_CHARACTER = String.fromCodePoint(0x25_00);
+/**
+ * Header row of every `wrangler … list` table.
+ */
+const HEADER_FIRST_CELL = 'Name';
+/**
+ * Extracts the data rows of a `wrangler` table, dropping the frame, the header,
+ * and any surrounding log lines.
+ *
+ * Rows are returned in print order with cells trimmed and empty cells removed,
+ * so a blank optional column (`Comment`, typically unset) does not shift the
+ * columns a caller indexes into.
+ */
+export function parseWranglerTableRows(output) {
+    const rows = [];
+    for (const line of output.split('\n')) {
+        // The frame rows use U+253C (`┼`) at the joints rather than U+2502, so they
+        // are already excluded here; the rule-character guard below additionally
+        // covers borders that happen to contain a separator.
+        if (!line.includes(COLUMN_SEPARATOR)) {
+            continue;
+        }
+        const cells = line
+            .split(COLUMN_SEPARATOR)
+            .map((cell) => cell.trim())
+            .filter(Boolean);
+        const firstCell = cells[0];
+        if (firstCell === undefined || cells.length < 2) {
+            continue;
+        }
+        // The header row and the horizontal rules are frame, not data.
+        if (firstCell === HEADER_FIRST_CELL || firstCell.includes(RULE_CHARACTER)) {
+            continue;
+        }
+        rows.push(cells);
+    }
+    return rows;
+}
+/**
+ * The exact names in the first column of a `wrangler secrets-store secret list`
+ * table.
+ *
+ * Exact values rather than a substring search — see the header.
+ */
+export function parseWranglerNames(output) {
+    const names = new Set();
+    for (const row of parseWranglerTableRows(output)) {
+        const name = row[0];
+        if (name !== undefined)
+            names.add(name);
+    }
+    return names;
+}
+/**
+ * wrangler exits non-zero when a Secrets Store holds no secrets
+ * (`secrets-store secret list` throws this `FatalError`), which is
+ * indistinguishable by exit code from a genuine failure.
+ */
+const EMPTY_STORE_MESSAGE = 'List request returned no secrets';
+/**
+ * True when a failed `secrets-store secret list` means the store is empty
+ * rather than the listing having failed.
+ *
+ * Callers must treat this as a confirmed absence; every other failure has to
+ * stay indistinguishable from "unknown", or a transient CLI error would be read
+ * as permission to create a secret that already holds a live value.
+ */
+export function isEmptySecretsStoreListing(error) {
+    const message = error instanceof Error ? error.message : String(error);
+    return message.includes(EMPTY_STORE_MESSAGE);
+}
+//# sourceMappingURL=wrangler-table.js.map

package/dist/scripts/lib/wrangler-table.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"wrangler-table.js","sourceRoot":"","sources":["../../../src/scripts/lib/wrangler-table.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAEH;;GAEG;AACH,MAAM,gBAAgB,GAAG,MAAM,CAAC,aAAa,CAAC,OAAO,CAAC,CAAC;AAEvD;;GAEG;AACH,MAAM,cAAc,GAAG,MAAM,CAAC,aAAa,CAAC,OAAO,CAAC,CAAC;AAErD;;GAEG;AACH,MAAM,iBAAiB,GAAG,MAAM,CAAC;AAEjC;;;;;;;GAOG;AACH,MAAM,UAAU,sBAAsB,CAAC,MAAc;IACnD,MAAM,IAAI,GAAe,EAAE,CAAC;IAC5B,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;QACtC,4EAA4E;QAC5E,yEAAyE;QACzE,qDAAqD;QACrD,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,gBAAgB,CAAC,EAAE,CAAC;YACrC,SAAS;QACX,CAAC;QAED,MAAM,KAAK,GAAa,IAAI;aACzB,KAAK,CAAC,gBAAgB,CAAC;aACvB,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;aAC1B,MAAM,CAAC,OAAO,CAAC,CAAC;QACnB,MAAM,SAAS,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;QAC3B,IAAI,SAAS,KAAK,SAAS,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAChD,SAAS;QACX,CAAC;QACD,+DAA+D;QAC/D,IAAI,SAAS,KAAK,iBAAiB,IAAI,SAAS,CAAC,QAAQ,CAAC,cAAc,CAAC,EAAE,CAAC;YAC1E,SAAS;QACX,CAAC;QACD,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACnB,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,kBAAkB,CAAC,MAAc;IAC/C,MAAM,KAAK,GAAG,IAAI,GAAG,EAAU,CAAC;IAChC,KAAK,MAAM,GAAG,IAAI,sBAAsB,CAAC,MAAM,CAAC,EAAE,CAAC;QACjD,MAAM,IAAI,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC;QACpB,IAAI,IAAI,KAAK,SAAS;YAAE,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAC1C,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;GAIG;AACH,MAAM,mBAAmB,GAAG,kCAAkC,CAAC;AAE/D;;;;;;;GAOG;AACH,MAAM,UAAU,0BAA0B,CAAC,KAAc;IACvD,MAAM,OAAO,GAAW,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAC/E,OAAO,OAAO,CAAC,QAAQ,CAAC,mBAAmB,CAAC,CAAC;AAC/C,CAAC"}

package/dist/scripts/migrations-lock.d.ts

@@ -0,0 +1,3 @@
+#!/usr/bin/env tsx
+export {};
+//# sourceMappingURL=migrations-lock.d.ts.map

package/dist/scripts/migrations-lock.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"migrations-lock.d.ts","sourceRoot":"","sources":["../../src/scripts/migrations-lock.ts"],"names":[],"mappings":""}

package/dist/scripts/migrations-lock.js

@@ -0,0 +1,46 @@
+#!/usr/bin/env tsx
+/**
+ * Record newly-added migration files in `migrations/migrations.lock.json`.
+ *
+ * Provenance: Edge-Sonic's `scripts/migrations/verify-migrations.ts --write`,
+ * which is the only repo that splits the two operations into two commands. The
+ * other repos have one script with a flag; the split is kept here because the two
+ * calls have different audiences and different blast radii — `verify-migrations`
+ * runs in CI and changes nothing, while this one is an operator action that writes
+ * a file into version control.
+ *
+ * The rules live once, in `verify-migrations.ts`, so the two entrypoints cannot
+ * disagree. `--write` is add-only: it records unlocked files, refreshes the
+ * baseline's own entry, and drops entries the baseline absorbed. It never touches
+ * another existing entry, so an incremental migration that has drifted still
+ * fails afterwards — re-baselining one means deleting its entry by hand, which
+ * shows up in the diff.
+ *
+ * There is deliberately no `--force`, because a write that could bless a drift
+ * without reading the drift is the operator blessing their own edit, and they are
+ * by definition the one making it.
+ *
+ * Usage, from the repo root:
+ *
+ * ```bash
+ * pnpm exec tsx scripts/migrations-lock.ts                   # ./migrations
+ * pnpm exec tsx scripts/migrations-lock.ts path/to/migrations
+ * ```
+ */
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { LOCK_NAME, verifyMigrations } from './verify-migrations';
+const REPOSITORY_ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
+const migrationsDir = process.argv[2] === undefined ? path.join(REPOSITORY_ROOT, 'migrations') : path.resolve(process.argv[2]);
+const report = verifyMigrations(migrationsDir, { write: true });
+for (const problem of report.problems) {
+    console.error(`FAIL: ${problem.problem}`);
+}
+console.log(`${report.lock === null ? 'left' : 'wrote'} ${path.join(migrationsDir, LOCK_NAME)} ` +
+    `(${report.files.length} migration(s) recorded)`);
+// The lock is re-checked by the caller: `verify-migrations.ts` re-reads from disk,
+// so running it after this command reports the same verdict CI will. A `--write`
+// that could not resolve everything still exits non-zero here, which is why an
+// incremental `edited` finding does not vanish just because someone wrote.
+process.exit(report.problems.length === 0 ? 0 : 1);
+//# sourceMappingURL=migrations-lock.js.map

package/dist/scripts/migrations-lock.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"migrations-lock.js","sourceRoot":"","sources":["../../src/scripts/migrations-lock.ts"],"names":[],"mappings":";AACA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,EAAE,SAAS,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AAElE,MAAM,eAAe,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC;AACzF,MAAM,aAAa,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,eAAe,EAAE,YAAY,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;AAE/H,MAAM,MAAM,GAAG,gBAAgB,CAAC,aAAa,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;AAEhE,KAAK,MAAM,OAAO,IAAI,MAAM,CAAC,QAAQ,EAAE,CAAC;IACtC,OAAO,CAAC,KAAK,CAAC,SAAS,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC;AAC5C,CAAC;AAED,OAAO,CAAC,GAAG,CACT,GAAG,MAAM,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,IAAI,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,SAAS,CAAC,GAAG;IAClF,IAAI,MAAM,CAAC,KAAK,CAAC,MAAM,yBAAyB,CACnD,CAAC;AAEF,mFAAmF;AACnF,iFAAiF;AACjF,+EAA+E;AAC/E,2EAA2E;AAC3E,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC"}

package/dist/scripts/prepare-wrangler-config.d.ts

@@ -0,0 +1,3 @@
+#!/usr/bin/env tsx
+export {};
+//# sourceMappingURL=prepare-wrangler-config.d.ts.map

package/dist/scripts/prepare-wrangler-config.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"prepare-wrangler-config.d.ts","sourceRoot":"","sources":["../../src/scripts/prepare-wrangler-config.ts"],"names":[],"mappings":""}

package/dist/scripts/prepare-wrangler-config.js

@@ -0,0 +1,50 @@
+#!/usr/bin/env tsx
+/**
+ * Materialize `wrangler.jsonc` and provision what it refers to.
+ *
+ * Provenance: Durable-DAV's `scripts/prepare-wrangler-config.ts` and Edge-Sonic's
+ * `scripts/deploy/prepare-wrangler-config.ts`, converged. The five ordered calls
+ * live in `wrangler-config/`: read or copy the config, refuse one older than the
+ * template requires, apply the caller's patches, then create whatever resources it
+ * names and write their real ids over the placeholders. This file is only the
+ * order; it has nothing else to do.
+ *
+ * Run by the deploy job before `wrangler deploy`, and by the backup workflow
+ * before `wrangler d1 export` — so the database a backup covers is resolved from
+ * the same config the deploy targets, with no second `D1_DATABASE_ID` secret to
+ * keep in sync.
+ *
+ * The one thing it does beyond calling is publish what
+ * `provisionWranglerResources` created, which the backup workflow reads to refuse
+ * exporting a database that did not exist until this run.
+ *
+ * Usage, from the repo root:
+ *
+ * ```bash
+ * pnpm exec tsx scripts/prepare-wrangler-config.ts
+ * ```
+ *
+ * Environment:
+ *
+ * - `WRANGLER_JSONC` — the whole config, as a repository variable. When set it is
+ *   written verbatim instead of copying the template.
+ * - `WRANGLER_PATCH_JSON` — top-level keys merged into the config.
+ * - `WRANGLER_VARS_PATCH_JSON` — `vars` entries merged into the config.
+ */
+import { setOutput } from './lib/github-actions';
+import { applyTopLevelPatch, applyVarsPatch, ensureMinimumConfigVersion, prepareConfigFile } from './wrangler-config/patches';
+import { provisionWranglerResources } from './wrangler-config/resources';
+prepareConfigFile();
+ensureMinimumConfigVersion();
+applyTopLevelPatch();
+applyVarsPatch();
+const created = provisionWranglerResources();
+// Published as a step output rather than only printed. The backup workflow needs
+// to know whether the D1 database *existed* or was created moments ago: a fresh one
+// holds no user data, and uploading that empty dump every night is a false sense
+// of safety. The alternative — re-reading the placeholder id out of
+// `wrangler.jsonc` — is unreachable, because `provisionWranglerResources` patches
+// the placeholder away before the reader ever runs.
+setOutput('created', created.join(','));
+console.log('Wrangler configuration is ready.');
+//# sourceMappingURL=prepare-wrangler-config.js.map

package/dist/scripts/prepare-wrangler-config.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"prepare-wrangler-config.js","sourceRoot":"","sources":["../../src/scripts/prepare-wrangler-config.ts"],"names":[],"mappings":";AACA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AACH,OAAO,EAAE,SAAS,EAAE,MAAM,sBAAsB,CAAC;AACjD,OAAO,EAAE,kBAAkB,EAAE,cAAc,EAAE,0BAA0B,EAAE,iBAAiB,EAAE,MAAM,2BAA2B,CAAC;AAC9H,OAAO,EAAE,0BAA0B,EAAE,MAAM,6BAA6B,CAAC;AAEzE,iBAAiB,EAAE,CAAC;AACpB,0BAA0B,EAAE,CAAC;AAC7B,kBAAkB,EAAE,CAAC;AACrB,cAAc,EAAE,CAAC;AACjB,MAAM,OAAO,GAAG,0BAA0B,EAAE,CAAC;AAE7C,iFAAiF;AACjF,oFAAoF;AACpF,iFAAiF;AACjF,oEAAoE;AACpE,kFAAkF;AAClF,oDAAoD;AACpD,SAAS,CAAC,SAAS,EAAE,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;AACxC,OAAO,CAAC,GAAG,CAAC,kCAAkC,CAAC,CAAC"}

package/dist/scripts/spa-shell.d.ts

@@ -0,0 +1,41 @@
+interface SpaShellPaths {
+    /** Repo root. */
+    root: string;
+    /** Generated TS module path, relative to root. */
+    shellPath?: string;
+    /** Built SPA index.html path, relative to root. */
+    distIndexPath?: string;
+}
+interface VerifyResult {
+    problems: string[];
+}
+/**
+ * Create the empty stub when (and only when) nothing is there yet, so a fresh
+ * clone typechecks and `pnpm run build` regenerates the real thing. Never
+ * overwrites an existing file — overwriting would erase a real build with a
+ * stub on the next `pnpm install`.
+ */
+declare function ensureSpaShellStub(options: SpaShellPaths): {
+    created: boolean;
+    path: string;
+};
+/**
+ * Fail when the shell the API worker serves is missing or self-inconsistent:
+ *
+ * - the postinstall stub (or no build at all) still in place;
+ * - `/assets/...` bundles referenced but not emitted (a half-cleaned dist,
+ *   which serves a shell whose JS 404s);
+ * - `spa-shell.ts` and `dist/index.html` disagreeing — only one half of the
+ *   build was refreshed.
+ *
+ * Known limit, stated rather than papered over: a *stale but self-consistent*
+ * pair passes. That class is covered at the source level by each repo's SPA
+ * parser integration test; the remaining duty is operational — run the build
+ * after touching `apps/web`, before deploy.
+ */
+declare function verifySpaShell(options: SpaShellPaths): VerifyResult;
+/** CLI entry: `spaShellCli(['verify'|'ensure', 'repo-root?'])`. */
+declare function spaShellCli(argv?: readonly string[]): number;
+export { ensureSpaShellStub, spaShellCli, verifySpaShell };
+export type { SpaShellPaths, VerifyResult };
+//# sourceMappingURL=spa-shell.d.ts.map

package/dist/scripts/spa-shell.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"spa-shell.d.ts","sourceRoot":"","sources":["../../src/scripts/spa-shell.ts"],"names":[],"mappings":"AAmBA,UAAU,aAAa;IACrB,iBAAiB;IACjB,IAAI,EAAE,MAAM,CAAC;IACb,kDAAkD;IAClD,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,mDAAmD;IACnD,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AAED,UAAU,YAAY;IACpB,QAAQ,EAAE,MAAM,EAAE,CAAC;CACpB;AAiBD;;;;;GAKG;AACH,iBAAS,kBAAkB,CAAC,OAAO,EAAE,aAAa,GAAG;IAAE,OAAO,EAAE,OAAO,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAQtF;AAsCD;;;;;;;;;;;;;GAaG;AACH,iBAAS,cAAc,CAAC,OAAO,EAAE,aAAa,GAAG,YAAY,CAsB5D;AAID,mEAAmE;AACnE,iBAAS,WAAW,CAAC,IAAI,GAAE,SAAS,MAAM,EAA0B,GAAG,MAAM,CAwB5E;AAED,OAAO,EAAE,kBAAkB,EAAE,WAAW,EAAE,cAAc,EAAE,CAAC;AAC3D,YAAY,EAAE,aAAa,EAAE,YAAY,EAAE,CAAC"}

package/dist/scripts/spa-shell.js

@@ -0,0 +1,155 @@
+/**
+ * The SPA shell pair: `ensure-spa-shell-stub` + `verify-spa-shell`.
+ *
+ * Provenance: the `scripts/ensure-spa-shell-stub.mjs` +
+ * `scripts/verify-spa-shell.mjs` pair (Durable-DAV) and Edge-Sonic's typed
+ * `scripts/build/{ensure-spa-shell-stub,spa-shell-checks,verify-spa-shell}.ts`.
+ * The generate step itself is a Vite plugin (`spaShellEmbedPlugin` in
+ * `vite.ts`) because it must run on every build; this module holds the
+ * freshness contract around the generated file.
+ *
+ * Why the pair exists: `apps/api/src/generated/spa-shell.ts` and
+ * `apps/web/dist/` are both gitignored build artifacts. A fresh clone gets the
+ * empty postinstall stub and every browser navigation returns a blank page,
+ * with nothing in the source tree saying so.
+ */
+import { existsSync, mkdirSync, readFileSync, writeFileSync } from 'node:fs';
+import { pathToFileURL } from 'node:url';
+import { dirname, join, resolve } from 'node:path';
+const DEFAULT_SHELL = 'apps/api/src/generated/spa-shell.ts';
+const DEFAULT_DIST_INDEX = 'apps/web/dist/index.html';
+const STUB_CONTENT = "// Auto-generated stub - real content is produced by the build step via the Vite plugin.\nexport const SPA_HTML: string = '';\n";
+/** A built shell is a full Vite index.html; any small threshold rejects the stub. */
+const MIN_HTML_CHARS = 200;
+function resolvePaths(options) {
+    const root = resolve(options.root);
+    const shell = join(root, options.shellPath ?? DEFAULT_SHELL);
+    const distIndex = join(root, options.distIndexPath ?? DEFAULT_DIST_INDEX);
+    return { shell, distIndex, distAssets: join(dirname(distIndex), 'assets') };
+}
+/**
+ * Create the empty stub when (and only when) nothing is there yet, so a fresh
+ * clone typechecks and `pnpm run build` regenerates the real thing. Never
+ * overwrites an existing file — overwriting would erase a real build with a
+ * stub on the next `pnpm install`.
+ */
+function ensureSpaShellStub(options) {
+    const { shell } = resolvePaths(options);
+    if (existsSync(shell)) {
+        return { created: false, path: shell };
+    }
+    mkdirSync(dirname(shell), { recursive: true });
+    writeFileSync(shell, STUB_CONTENT, 'utf8');
+    return { created: true, path: shell };
+}
+/** The `SPA_HTML` string literal, decoded from the generated TS module. */
+function readEmbeddedHtml(shell, problems) {
+    if (!existsSync(shell)) {
+        problems.push(`${shell} is missing — run the build (only apps/web has a build step).`);
+        return null;
+    }
+    const source = readFileSync(shell, 'utf8');
+    const marker = 'export const SPA_HTML: string = ';
+    const at = source.indexOf(marker);
+    if (at === -1) {
+        problems.push(`${shell} does not export SPA_HTML — regenerate it with the build.`);
+        return null;
+    }
+    const literal = source.slice(at + marker.length).replace(/;\s*$/, '');
+    if (literal === "''" || literal === '""') {
+        problems.push(`${shell} still holds the empty postinstall stub — run the build. Until then every browser navigation served by the API worker is a blank page.`);
+        return null;
+    }
+    let html;
+    try {
+        html = JSON.parse(literal);
+    }
+    catch {
+        problems.push(`${shell} is not the generated shape — delete it and run the build.`);
+        return null;
+    }
+    if (typeof html !== 'string' || html.length < MIN_HTML_CHARS) {
+        problems.push(`${shell} holds no usable HTML — run the build. Until then every browser navigation is a blank page.`);
+        return null;
+    }
+    return html;
+}
+/**
+ * Fail when the shell the API worker serves is missing or self-inconsistent:
+ *
+ * - the postinstall stub (or no build at all) still in place;
+ * - `/assets/...` bundles referenced but not emitted (a half-cleaned dist,
+ *   which serves a shell whose JS 404s);
+ * - `spa-shell.ts` and `dist/index.html` disagreeing — only one half of the
+ *   build was refreshed.
+ *
+ * Known limit, stated rather than papered over: a *stale but self-consistent*
+ * pair passes. That class is covered at the source level by each repo's SPA
+ * parser integration test; the remaining duty is operational — run the build
+ * after touching `apps/web`, before deploy.
+ */
+function verifySpaShell(options) {
+    const { shell, distIndex, distAssets } = resolvePaths(options);
+    const problems = [];
+    const html = readEmbeddedHtml(shell, problems);
+    if (html === null) {
+        return { problems };
+    }
+    const referenced = [...html.matchAll(/(?:src|href)="\/assets\/([^"]+)"/g)].map((match) => match[1]);
+    if (referenced.length === 0) {
+        problems.push('The embedded shell references no /assets/ bundles — it is not a real build output.');
+    }
+    for (const asset of new Set(referenced)) {
+        if (!existsSync(join(distAssets, asset))) {
+            problems.push(`The embedded shell references /assets/${asset}, which is not in ${distAssets} — run the build.`);
+        }
+    }
+    if (!existsSync(distIndex)) {
+        problems.push(`${distIndex} is missing — run the build.`);
+    }
+    else if (readFileSync(distIndex, 'utf8') !== html) {
+        problems.push(`${shell} does not match ${distIndex} — run the build.`);
+    }
+    return { problems };
+}
+const CLI_SHAPES = 'verify|ensure';
+/** CLI entry: `spaShellCli(['verify'|'ensure', 'repo-root?'])`. */
+function spaShellCli(argv = process.argv.slice(2)) {
+    const mode = argv[0] ?? 'verify';
+    if (!CLI_SHAPES.split('|').includes(mode)) {
+        console.error(`Usage: tsx spa-shell.ts <${CLI_SHAPES}> [repo-root]`);
+        return 1;
+    }
+    const options = { root: argv[1] ?? process.cwd() };
+    if (mode === 'ensure') {
+        const result = ensureSpaShellStub(options);
+        if (result.created) {
+            console.log(`ensure-spa-shell-stub: created stub at ${result.path}`);
+        }
+        else {
+            console.log(`ensure-spa-shell-stub: ${result.path} already present, left untouched`);
+        }
+        return 0;
+    }
+    const { problems } = verifySpaShell(options);
+    if (problems.length > 0) {
+        console.error('SPA shell check failed:');
+        for (const problem of problems)
+            console.error(`  - ${problem}`);
+        return 1;
+    }
+    console.log('SPA shell check passed.');
+    return 0;
+}
+export { ensureSpaShellStub, spaShellCli, verifySpaShell };
+// Run only when this file is the entrypoint.
+//
+// The rules above are pure and the tests import them directly, so a module-level
+// call would shell out (and exit) during a test run. The URL comparison rather than
+// an unconditional call is the same guard Durable-DAV's init-secrets.ts uses, and
+// it is what keeps the rule modules importable — which is the whole reason they are
+// separate modules in the first place.
+if (process.argv[1] !== undefined && import.meta.url === pathToFileURL(process.argv[1]).href) {
+    process.exit(spaShellCli(process.argv.slice(2)));
+}
+//# sourceMappingURL=spa-shell.js.map

package/dist/scripts/spa-shell.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"spa-shell.js","sourceRoot":"","sources":["../../src/scripts/spa-shell.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AACH,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AAC7E,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAenD,MAAM,aAAa,GAAG,qCAAqC,CAAC;AAC5D,MAAM,kBAAkB,GAAG,0BAA0B,CAAC;AACtD,MAAM,YAAY,GAChB,iIAAiI,CAAC;AAEpI,qFAAqF;AACrF,MAAM,cAAc,GAAG,GAAG,CAAC;AAE3B,SAAS,YAAY,CAAC,OAAsB;IAC1C,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IACnC,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,EAAE,OAAO,CAAC,SAAS,IAAI,aAAa,CAAC,CAAC;IAC7D,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,EAAE,OAAO,CAAC,aAAa,IAAI,kBAAkB,CAAC,CAAC;IAC1E,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,UAAU,EAAE,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,QAAQ,CAAC,EAAE,CAAC;AAC9E,CAAC;AAED;;;;;GAKG;AACH,SAAS,kBAAkB,CAAC,OAAsB;IAChD,MAAM,EAAE,KAAK,EAAE,GAAG,YAAY,CAAC,OAAO,CAAC,CAAC;IACxC,IAAI,UAAU,CAAC,KAAK,CAAC,EAAE,CAAC;QACtB,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC;IACzC,CAAC;IACD,SAAS,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC/C,aAAa,CAAC,KAAK,EAAE,YAAY,EAAE,MAAM,CAAC,CAAC;IAC3C,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC;AACxC,CAAC;AAED,2EAA2E;AAC3E,SAAS,gBAAgB,CAAC,KAAa,EAAE,QAAkB;IACzD,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,EAAE,CAAC;QACvB,QAAQ,CAAC,IAAI,CACX,GAAG,KAAK,+DAA+D,CACxE,CAAC;QACF,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,MAAM,GAAG,YAAY,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;IAC3C,MAAM,MAAM,GAAG,kCAAkC,CAAC;IAClD,MAAM,EAAE,GAAG,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IAClC,IAAI,EAAE,KAAK,CAAC,CAAC,EAAE,CAAC;QACd,QAAQ,CAAC,IAAI,CAAC,GAAG,KAAK,2DAA2D,CAAC,CAAC;QACnF,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,OAAO,GAAG,MAAM,CAAC,KAAK,CAAC,EAAE,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;IACtE,IAAI,OAAO,KAAK,IAAI,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;QACzC,QAAQ,CAAC,IAAI,CACX,GAAG,KAAK,wIAAwI,CACjJ,CAAC;QACF,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,IAAa,CAAC;IAClB,IAAI,CAAC;QACH,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAC7B,CAAC;IAAC,MAAM,CAAC;QACP,QAAQ,CAAC,IAAI,CAAC,GAAG,KAAK,4DAA4D,CAAC,CAAC;QACpF,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,MAAM,GAAG,cAAc,EAAE,CAAC;QAC7D,QAAQ,CAAC,IAAI,CAAC,GAAG,KAAK,6FAA6F,CAAC,CAAC;QACrH,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,SAAS,cAAc,CAAC,OAAsB;IAC5C,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,UAAU,EAAE,GAAG,YAAY,CAAC,OAAO,CAAC,CAAC;IAC/D,MAAM,QAAQ,GAAa,EAAE,CAAC;IAC9B,MAAM,IAAI,GAAG,gBAAgB,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;IAC/C,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;QAClB,OAAO,EAAE,QAAQ,EAAE,CAAC;IACtB,CAAC;IACD,MAAM,UAAU,GAAG,CAAC,GAAG,IAAI,CAAC,QAAQ,CAAC,mCAAmC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,CAAC,CAAW,CAAC,CAAC;IAC9G,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC5B,QAAQ,CAAC,IAAI,CAAC,oFAAoF,CAAC,CAAC;IACtG,CAAC;IACD,KAAK,MAAM,KAAK,IAAI,IAAI,GAAG,CAAC,UAAU,CAAC,EAAE,CAAC;QACxC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC,EAAE,CAAC;YACzC,QAAQ,CAAC,IAAI,CAAC,yCAAyC,KAAK,qBAAqB,UAAU,mBAAmB,CAAC,CAAC;QAClH,CAAC;IACH,CAAC;IACD,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;QAC3B,QAAQ,CAAC,IAAI,CAAC,GAAG,SAAS,8BAA8B,CAAC,CAAC;IAC5D,CAAC;SAAM,IAAI,YAAY,CAAC,SAAS,EAAE,MAAM,CAAC,KAAK,IAAI,EAAE,CAAC;QACpD,QAAQ,CAAC,IAAI,CAAC,GAAG,KAAK,mBAAmB,SAAS,mBAAmB,CAAC,CAAC;IACzE,CAAC;IACD,OAAO,EAAE,QAAQ,EAAE,CAAC;AACtB,CAAC;AAED,MAAM,UAAU,GAAG,eAAe,CAAC;AAEnC,mEAAmE;AACnE,SAAS,WAAW,CAAC,OAA0B,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;IAClE,MAAM,IAAI,GAAG,IAAI,CAAC,CAAC,CAAC,IAAI,QAAQ,CAAC;IACjC,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QAC1C,OAAO,CAAC,KAAK,CAAC,4BAA4B,UAAU,eAAe,CAAC,CAAC;QACrE,OAAO,CAAC,CAAC;IACX,CAAC;IACD,MAAM,OAAO,GAAkB,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC,IAAI,OAAO,CAAC,GAAG,EAAE,EAAE,CAAC;IAClE,IAAI,IAAI,KAAK,QAAQ,EAAE,CAAC;QACtB,MAAM,MAAM,GAAG,kBAAkB,CAAC,OAAO,CAAC,CAAC;QAC3C,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;YACnB,OAAO,CAAC,GAAG,CAAC,0CAA0C,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC;QACvE,CAAC;aAAM,CAAC;YACN,OAAO,CAAC,GAAG,CAAC,0BAA0B,MAAM,CAAC,IAAI,kCAAkC,CAAC,CAAC;QACvF,CAAC;QACD,OAAO,CAAC,CAAC;IACX,CAAC;IACD,MAAM,EAAE,QAAQ,EAAE,GAAG,cAAc,CAAC,OAAO,CAAC,CAAC;IAC7C,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACxB,OAAO,CAAC,KAAK,CAAC,yBAAyB,CAAC,CAAC;QACzC,KAAK,MAAM,OAAO,IAAI,QAAQ;YAAE,OAAO,CAAC,KAAK,CAAC,OAAO,OAAO,EAAE,CAAC,CAAC;QAChE,OAAO,CAAC,CAAC;IACX,CAAC;IACD,OAAO,CAAC,GAAG,CAAC,yBAAyB,CAAC,CAAC;IACvC,OAAO,CAAC,CAAC;AACX,CAAC;AAED,OAAO,EAAE,kBAAkB,EAAE,WAAW,EAAE,cAAc,EAAE,CAAC;AAG3D,6CAA6C;AAC7C,EAAE;AACF,iFAAiF;AACjF,oFAAoF;AACpF,kFAAkF;AAClF,oFAAoF;AACpF,uCAAuC;AACvC,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,SAAS,IAAI,MAAM,CAAC,IAAI,CAAC,GAAG,KAAK,aAAa,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IAC7F,OAAO,CAAC,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AACnD,CAAC"}

package/dist/scripts/validate-locales.d.ts

@@ -0,0 +1,26 @@
+/** The bundle layouts the checker understands. */
+type LocaleShape = 'auto' | 'dir' | 'file' | 'module';
+/** One defect, kept as a locale plus a message so a caller can group them. */
+interface LocaleProblem {
+    locale: string;
+    problem: string;
+}
+/** The outcome of one run. */
+interface LocaleReport {
+    locales: string[];
+    keys: number;
+    problems: LocaleProblem[];
+}
+declare function parseObjectLiteral(source: string, path: string): unknown;
+/**
+ * Validate a directory of locale bundles against `baseLocale`'s key set.
+ *
+ * Two-way parity: a key the base has and a bundle lacks renders the fallback, and
+ * a key a bundle has that the base lacks is dead weight nothing can translate from.
+ */
+declare function validateLocales(localesDir: string, baseLocale?: string, shape?: LocaleShape): LocaleReport;
+/** CLI entry: `validateLocalesCli(['[locales-dir]?', '--shape=auto|dir|file|module'?, '--base=<tag>'?])`. */
+declare function validateLocalesCli(argv?: readonly string[]): number;
+export { parseObjectLiteral, validateLocales, validateLocalesCli };
+export type { LocaleProblem, LocaleReport, LocaleShape };
+//# sourceMappingURL=validate-locales.d.ts.map

package/dist/scripts/validate-locales.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"validate-locales.d.ts","sourceRoot":"","sources":["../../src/scripts/validate-locales.ts"],"names":[],"mappings":"AAyCA,kDAAkD;AAClD,KAAK,WAAW,GAAG,MAAM,GAAG,KAAK,GAAG,MAAM,GAAG,QAAQ,CAAC;AAEtD,8EAA8E;AAC9E,UAAU,aAAa;IACrB,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,8BAA8B;AAC9B,UAAU,YAAY;IACpB,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,aAAa,EAAE,CAAC;CAC3B;AAkGD,iBAAS,kBAAkB,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CA4EjE;AA8DD;;;;;GAKG;AACH,iBAAS,eAAe,CAAC,UAAU,EAAE,MAAM,EAAE,UAAU,SAAO,EAAE,KAAK,GAAE,WAAoB,GAAG,YAAY,CAoDzG;AAED,6GAA6G;AAC7G,iBAAS,kBAAkB,CAAC,IAAI,GAAE,SAAS,MAAM,EAA0B,GAAG,MAAM,CAanF;AAED,OAAO,EAAE,kBAAkB,EAAE,eAAe,EAAE,kBAAkB,EAAE,CAAC;AACnE,YAAY,EAAE,aAAa,EAAE,YAAY,EAAE,WAAW,EAAE,CAAC"}