@stackweld/core 0.2.1 → 0.3.1

package/dist/engine/runtime-manager.js

@@ -2,7 +2,7 @@
  * Runtime Manager — Manages Docker Compose lifecycle for stacks.
  * Handles up, down, status, logs, and health check waiting.
  */
-import { execSync } from "node:child_process";
+import { execFileSync } from "node:child_process";
 import * as fs from "node:fs";
 import * as path from "node:path";
 export class RuntimeManager {
@@ -14,9 +14,11 @@ export class RuntimeManager {
      * Start all services with docker compose up.
      */
     up(opts, detach = true) {
-        const flags = detach ? "-d" : "";
+        const args = ["compose", "-f", opts.composePath, "up"];
+        if (detach)
+            args.push("-d");
         try {
-            const output = execSync(`docker compose -f "${opts.composePath}" up ${flags}`, {
+            const output = execFileSync("docker", args, {
                 cwd: opts.projectDir,
                 stdio: "pipe",
                 timeout: 120_000,
@@ -32,9 +34,11 @@ export class RuntimeManager {
      * Stop all services.
      */
     down(opts, volumes = false) {
+        const args = ["compose", "-f", opts.composePath, "down"];
+        if (volumes)
+            args.push("--volumes");
         try {
-            const volumesFlag = volumes ? " --volumes" : "";
-            const output = execSync(`docker compose -f "${opts.composePath}" down${volumesFlag}`, {
+            const output = execFileSync("docker", args, {
                 cwd: opts.projectDir,
                 stdio: "pipe",
                 timeout: 60_000,
@@ -51,7 +55,7 @@ export class RuntimeManager {
      */
     status(opts) {
         try {
-            const raw = execSync(`docker compose -f "${opts.composePath}" ps --format json`, {
+            const raw = execFileSync("docker", ["compose", "-f", opts.composePath, "ps", "--format", "json"], {
                 cwd: opts.projectDir,
                 stdio: "pipe",
                 timeout: 10_000,
@@ -112,10 +116,20 @@ export class RuntimeManager {
      * Get logs for a specific service or all services.
      */
     logs(opts, service, tail = 50, follow = false) {
+        if (service && !/^[a-zA-Z0-9_-]+$/.test(service)) {
+            throw new Error(`Invalid service name: ${service}`);
+        }
+        const args = ["compose", "-f", opts.composePath, "logs", "--tail", String(tail)];
+        if (follow)
+            args.push("-f");
+        if (service)
+            args.push(service);
         try {
-            const serviceArg = service || "";
-            const followFlag = follow ? " -f" : "";
-            return execSync(`docker compose -f "${opts.composePath}" logs --tail ${tail}${followFlag} ${serviceArg}`, { cwd: opts.projectDir, stdio: follow ? "inherit" : "pipe", timeout: follow ? 0 : 10_000 }).toString();
+            return execFileSync("docker", args, {
+                cwd: opts.projectDir,
+                stdio: follow ? "inherit" : "pipe",
+                timeout: follow ? 0 : 10_000,
+            }).toString();
         }
         catch (err) {
             return err instanceof Error ? err.message : String(err);
@@ -170,7 +184,7 @@ export class RuntimeManager {
      */
     isDockerAvailable() {
         try {
-            execSync("docker info", { stdio: "pipe", timeout: 5_000 });
+            execFileSync("docker", ["info"], { stdio: "pipe", timeout: 5_000 });
             return true;
         }
         catch {

package/dist/engine/scaffold-orchestrator.js

@@ -7,7 +7,41 @@
  * - .gitignore (combined)
  * - devcontainer.json
  */
-import { execSync } from "node:child_process";
+import { execFileSync } from "node:child_process";
+import { randomBytes } from "node:crypto";
+const WEAK_SECRETS = new Set([
+    "postgres",
+    "root",
+    "admin",
+    "password",
+    "secret",
+    "change-me",
+    "change-me-in-production",
+    "minioadmin",
+    "mariadb",
+]);
+function securifyEnvValue(key, value, projectName) {
+    const lower = key.toLowerCase();
+    if (WEAK_SECRETS.has(value)) {
+        if (lower.includes("user") || lower.includes("username") || lower.includes("email")) {
+            return value; // usernames are fine as defaults
+        }
+        return randomBytes(20).toString("base64url");
+    }
+    // Replace weak passwords inside DATABASE_URL strings
+    if (lower.includes("url") &&
+        (value.includes("postgres:postgres") ||
+            value.includes("root:root") ||
+            value.includes("admin:admin"))) {
+        const securePass = randomBytes(20).toString("base64url");
+        return value
+            .replace(/postgres:postgres/g, `postgres:${securePass}`)
+            .replace(/root:root/g, `root:${securePass}`)
+            .replace(/admin:admin/g, `admin:${securePass}`)
+            .replace(/\/app/g, `/${projectName.replace(/[^a-zA-Z0-9_]/g, "_")}`);
+    }
+    return value;
+}
 export class ScaffoldOrchestrator {
     technologies;
     constructor(technologies) {
@@ -109,9 +143,10 @@ export class ScaffoldOrchestrator {
      * Generate .env.example from all technologies' envVars.
      */
     generateEnvExample(stack, techs) {
+        const projectName = stack.name.replace(/\s+/g, "-").toLowerCase();
         const lines = [
             `# ${stack.name} — Environment Variables`,
-            `# Generated by Stackweld`,
+            `# Generated by Stackweld — rotate secrets before production`,
             "",
         ];
         const seen = new Set();
@@ -122,7 +157,8 @@ export class ScaffoldOrchestrator {
             lines.push(`# ${tech.name}`);
             for (const [key, value] of entries) {
                 if (!seen.has(key)) {
-                    lines.push(`${key}=${value}`);
+                    const secureValue = securifyEnvValue(key, value, projectName);
+                    lines.push(`${key}=${secureValue}`);
                     seen.add(key);
                 }
             }
@@ -354,11 +390,11 @@ export class ScaffoldOrchestrator {
      */
     initGit(projectDir, stack, initialCommit = true) {
         try {
-            execSync("git init", { cwd: projectDir, stdio: "pipe" });
+            execFileSync("git", ["init"], { cwd: projectDir, stdio: "pipe" });
             if (initialCommit) {
-                execSync("git add -A", { cwd: projectDir, stdio: "pipe" });
+                execFileSync("git", ["add", "-A"], { cwd: projectDir, stdio: "pipe" });
                 const msg = `Initial commit: ${stack.name} (${stack.profile})\n\nGenerated by Stackweld`;
-                execSync(`git commit -m "${msg}"`, {
+                execFileSync("git", ["commit", "-m", msg], {
                     cwd: projectDir,
                     stdio: "pipe",
                 });

package/dist/engine/stack-detector.d.ts

@@ -2,20 +2,20 @@
  * Stack Detector — Analyze a project directory to detect its technology stack.
  */
 export interface DetectedStack {
-  technologies: DetectedTech[];
-  confidence: number;
-  projectType: "frontend" | "backend" | "fullstack" | "monorepo" | "library" | "unknown";
-  packageManagers: string[];
+    technologies: DetectedTech[];
+    confidence: number;
+    projectType: "frontend" | "backend" | "fullstack" | "monorepo" | "library" | "unknown";
+    packageManagers: string[];
 }
 export interface DetectedTech {
-  id: string;
-  name: string;
-  confidence: number;
-  detectedVia: string;
-  version?: string;
+    id: string;
+    name: string;
+    confidence: number;
+    detectedVia: string;
+    version?: string;
 }
 /**
  * Detect the technology stack of a project at the given path.
  */
 export declare function detectStack(projectPath: string): DetectedStack;
-//# sourceMappingURL=stack-detector.d.ts.map
+//# sourceMappingURL=stack-detector.d.ts.map

package/dist/engine/stack-differ.d.ts

@@ -3,24 +3,24 @@
  */
 import type { StackDefinition } from "../types/stack.js";
 export interface StackDiff {
-  added: DiffItem[];
-  removed: DiffItem[];
-  changed: DiffChange[];
-  unchanged: string[];
-  summary: string;
+    added: DiffItem[];
+    removed: DiffItem[];
+    changed: DiffChange[];
+    unchanged: string[];
+    summary: string;
 }
 export interface DiffItem {
-  technologyId: string;
-  name: string;
-  version?: string;
-  port?: number;
+    technologyId: string;
+    name: string;
+    version?: string;
+    port?: number;
 }
 export interface DiffChange {
-  technologyId: string;
-  name: string;
-  field: string;
-  from: string;
-  to: string;
+    technologyId: string;
+    name: string;
+    field: string;
+    from: string;
+    to: string;
 }
 export declare function diffStacks(stackA: StackDefinition, stackB: StackDefinition): StackDiff;
-//# sourceMappingURL=stack-differ.d.ts.map
+//# sourceMappingURL=stack-differ.d.ts.map

package/dist/engine/stack-differ.js

@@ -3,78 +3,82 @@
  */
 // ─── Main Function ────────────────────────────────────
 export function diffStacks(stackA, stackB) {
-  const techMapA = new Map(stackA.technologies.map((t) => [t.technologyId, t]));
-  const techMapB = new Map(stackB.technologies.map((t) => [t.technologyId, t]));
-  const added = [];
-  const removed = [];
-  const changed = [];
-  const unchanged = [];
-  // Find removed (in A but not B) and changed/unchanged
-  for (const [id, techA] of techMapA) {
-    const techB = techMapB.get(id);
-    if (!techB) {
-      removed.push({
-        technologyId: id,
-        name: id,
-        version: techA.version,
-        port: techA.port,
-      });
-      continue;
+    const techMapA = new Map(stackA.technologies.map((t) => [t.technologyId, t]));
+    const techMapB = new Map(stackB.technologies.map((t) => [t.technologyId, t]));
+    const added = [];
+    const removed = [];
+    const changed = [];
+    const unchanged = [];
+    // Find removed (in A but not B) and changed/unchanged
+    for (const [id, techA] of techMapA) {
+        const techB = techMapB.get(id);
+        if (!techB) {
+            removed.push({
+                technologyId: id,
+                name: id,
+                version: techA.version,
+                port: techA.port,
+            });
+            continue;
+        }
+        let hasChanges = false;
+        if (techA.version !== techB.version) {
+            changed.push({
+                technologyId: id,
+                name: id,
+                field: "version",
+                from: techA.version,
+                to: techB.version,
+            });
+            hasChanges = true;
+        }
+        if (techA.port !== techB.port) {
+            changed.push({
+                technologyId: id,
+                name: id,
+                field: "port",
+                from: techA.port !== undefined ? String(techA.port) : "none",
+                to: techB.port !== undefined ? String(techB.port) : "none",
+            });
+            hasChanges = true;
+        }
+        const configA = JSON.stringify(techA.config ?? {});
+        const configB = JSON.stringify(techB.config ?? {});
+        if (configA !== configB) {
+            changed.push({
+                technologyId: id,
+                name: id,
+                field: "config",
+                from: configA,
+                to: configB,
+            });
+            hasChanges = true;
+        }
+        if (!hasChanges) {
+            unchanged.push(id);
+        }
     }
-    let hasChanges = false;
-    if (techA.version !== techB.version) {
-      changed.push({
-        technologyId: id,
-        name: id,
-        field: "version",
-        from: techA.version,
-        to: techB.version,
-      });
-      hasChanges = true;
+    // Find added (in B but not A)
+    for (const [id, techB] of techMapB) {
+        if (!techMapA.has(id)) {
+            added.push({
+                technologyId: id,
+                name: id,
+                version: techB.version,
+                port: techB.port,
+            });
+        }
     }
-    if (techA.port !== techB.port) {
-      changed.push({
-        technologyId: id,
-        name: id,
-        field: "port",
-        from: techA.port !== undefined ? String(techA.port) : "none",
-        to: techB.port !== undefined ? String(techB.port) : "none",
-      });
-      hasChanges = true;
-    }
-    const configA = JSON.stringify(techA.config ?? {});
-    const configB = JSON.stringify(techB.config ?? {});
-    if (configA !== configB) {
-      changed.push({
-        technologyId: id,
-        name: id,
-        field: "config",
-        from: configA,
-        to: configB,
-      });
-      hasChanges = true;
-    }
-    if (!hasChanges) {
-      unchanged.push(id);
-    }
-  }
-  // Find added (in B but not A)
-  for (const [id, techB] of techMapB) {
-    if (!techMapA.has(id)) {
-      added.push({
-        technologyId: id,
-        name: id,
-        version: techB.version,
-        port: techB.port,
-      });
-    }
-  }
-  const parts = [];
-  if (added.length > 0) parts.push(`+${added.length} added`);
-  if (removed.length > 0) parts.push(`-${removed.length} removed`);
-  if (changed.length > 0) parts.push(`~${changed.length} changed`);
-  if (unchanged.length > 0) parts.push(`${unchanged.length} unchanged`);
-  const summary = parts.join(", ");
-  return { added, removed, changed, unchanged, summary };
+    const parts = [];
+    if (added.length > 0)
+        parts.push(`+${added.length} added`);
+    if (removed.length > 0)
+        parts.push(`-${removed.length} removed`);
+    if (changed.length > 0)
+        parts.push(`~${changed.length} changed`);
+    if (unchanged.length > 0)
+        parts.push(`${unchanged.length} unchanged`);
+    const summary = parts.join(", ");
+    return { added, removed, changed, unchanged, summary };
 }
-//# sourceMappingURL=stack-differ.js.map
+//# sourceMappingURL=stack-differ.js.map

package/dist/engine/stack-serializer.d.ts

@@ -3,13 +3,13 @@
  * Uses zlib deflate + base64url encoding. No server needed.
  */
 export interface ShareableStack {
-  name: string;
-  profile: string;
-  technologies: Array<{
-    id: string;
-    version?: string;
-    port?: number;
-  }>;
+    name: string;
+    profile: string;
+    technologies: Array<{
+        id: string;
+        version?: string;
+        port?: number;
+    }>;
 }
 /**
  * Compress a stack into a URL-safe base64 string.
@@ -29,4 +29,4 @@ export declare function generateShareUrl(stack: ShareableStack, baseUrl?: string
  * Extract the encoded payload from a share URL.
  */
 export declare function extractFromShareUrl(url: string): string;
-//# sourceMappingURL=stack-serializer.d.ts.map
+//# sourceMappingURL=stack-serializer.d.ts.map

package/dist/engine/tech-installer.d.ts

@@ -14,19 +14,19 @@
  */
 import type { Technology } from "../types/index.js";
 export interface InstallContext {
-  projectDir: string;
-  frontendDir: string | null;
-  backendDir: string | null;
-  projectName: string;
-  isFullStack: boolean;
-  allTechs: Technology[];
-  runtime: "node" | "python" | "go" | "rust" | "bun" | "deno" | "php" | null;
+    projectDir: string;
+    frontendDir: string | null;
+    backendDir: string | null;
+    projectName: string;
+    isFullStack: boolean;
+    allTechs: Technology[];
+    runtime: "node" | "python" | "go" | "rust" | "bun" | "deno" | "php" | null;
 }
 export interface InstallResult {
-  techId: string;
-  success: boolean;
-  message: string;
-  filesCreated: string[];
+    techId: string;
+    success: boolean;
+    message: string;
+    filesCreated: string[];
 }
 /**
  * Install all selected technologies that have installers.
@@ -34,4 +34,4 @@ export interface InstallResult {
  * databases (handled by docker-compose), and services (handled by docker-compose).
  */
 export declare function installTechnologies(ctx: InstallContext): InstallResult[];
-//# sourceMappingURL=tech-installer.d.ts.map
+//# sourceMappingURL=tech-installer.d.ts.map

package/dist/engine/tech-installer.js

@@ -12,13 +12,14 @@
  *
  * Frontend and Backend scaffolding is handled by the generate command directly.
  */
-import { execSync } from "node:child_process";
+import { execFileSync } from "node:child_process";
 import * as fs from "node:fs";
 import * as path from "node:path";
 // ─── Helpers ────────────────────────────────────────
 function run(cmd, cwd, timeout = 60_000) {
     try {
-        execSync(cmd, { cwd, stdio: "pipe", timeout });
+        const parts = cmd.split(/\s+/).filter(Boolean);
+        execFileSync(parts[0], parts.slice(1), { cwd, stdio: "pipe", timeout });
         return true;
     }
     catch {

package/dist/types/project.d.ts

@@ -3,31 +3,31 @@
  * Created by the Scaffold Orchestrator.
  */
 export interface ProjectInstance {
-  id: string;
-  stackId: string;
-  name: string;
-  path: string;
-  createdAt: string;
-  lastOpenedAt?: string;
-  templateId?: string;
+    id: string;
+    stackId: string;
+    name: string;
+    path: string;
+    createdAt: string;
+    lastOpenedAt?: string;
+    templateId?: string;
 }
 /**
  * Runtime State — Live state of a running project.
  * Containers, ports, health checks, processes.
  */
 export interface ServiceStatus {
-  name: string;
-  technologyId: string;
-  containerId?: string;
-  status: "running" | "healthy" | "unhealthy" | "exited" | "stopped" | "not_started";
-  port?: number;
-  healthCheck?: "passing" | "failing" | "none";
-  uptime?: number;
+    name: string;
+    technologyId: string;
+    containerId?: string;
+    status: "running" | "healthy" | "unhealthy" | "exited" | "stopped" | "not_started";
+    port?: number;
+    healthCheck?: "passing" | "failing" | "none";
+    uptime?: number;
 }
 export interface RuntimeState {
-  projectId: string;
-  services: ServiceStatus[];
-  composePath?: string;
-  lastChecked: string;
+    projectId: string;
+    services: ServiceStatus[];
+    composePath?: string;
+    lastChecked: string;
 }
-//# sourceMappingURL=project.d.ts.map
+//# sourceMappingURL=project.d.ts.map

package/dist/types/project.js

@@ -3,4 +3,4 @@
  * Created by the Scaffold Orchestrator.
  */
 export {};
-//# sourceMappingURL=project.js.map
+//# sourceMappingURL=project.js.map

package/dist/types/stack.d.ts

@@ -3,27 +3,27 @@
  * Not yet a project on disk.
  */
 export interface StackTechnology {
-  technologyId: string;
-  version: string;
-  port?: number;
-  config?: Record<string, unknown>;
+    technologyId: string;
+    version: string;
+    port?: number;
+    config?: Record<string, unknown>;
 }
 export type StackProfile = "rapid" | "standard" | "production" | "enterprise" | "lightweight";
 export interface StackDefinition {
-  id: string;
-  name: string;
-  description: string;
-  profile: StackProfile;
-  technologies: StackTechnology[];
-  createdAt: string;
-  updatedAt: string;
-  version: number;
-  tags: string[];
+    id: string;
+    name: string;
+    description: string;
+    profile: StackProfile;
+    technologies: StackTechnology[];
+    createdAt: string;
+    updatedAt: string;
+    version: number;
+    tags: string[];
 }
 export interface StackVersion {
-  version: number;
-  timestamp: string;
-  changelog: string;
-  snapshot: StackDefinition;
+    version: number;
+    timestamp: string;
+    changelog: string;
+    snapshot: StackDefinition;
 }
-//# sourceMappingURL=stack.d.ts.map
+//# sourceMappingURL=stack.d.ts.map

package/dist/types/stack.js

@@ -3,4 +3,4 @@
  * Not yet a project on disk.
  */
 export {};
-//# sourceMappingURL=stack.js.map
+//# sourceMappingURL=stack.js.map

package/dist/types/technology.d.ts

@@ -2,46 +2,37 @@
  * Technology — Atomic unit of the registry catalog.
  * Each technology is deeply modeled with versions, ports, rules, and metadata.
  */
-export type TechnologyCategory =
-  | "runtime"
-  | "frontend"
-  | "backend"
-  | "database"
-  | "orm"
-  | "auth"
-  | "styling"
-  | "service"
-  | "devops";
+export type TechnologyCategory = "runtime" | "frontend" | "backend" | "database" | "orm" | "auth" | "styling" | "service" | "devops";
 export interface TechnologyVersion {
-  version: string;
-  eol?: string;
-  lts?: boolean;
+    version: string;
+    eol?: string;
+    lts?: boolean;
 }
 export interface HealthCheckConfig {
-  command?: string;
-  endpoint?: string;
-  interval?: string;
-  timeout?: string;
-  retries?: number;
+    command?: string;
+    endpoint?: string;
+    interval?: string;
+    timeout?: string;
+    retries?: number;
 }
 export interface Technology {
-  id: string;
-  name: string;
-  category: TechnologyCategory;
-  description: string;
-  website: string;
-  versions: TechnologyVersion[];
-  defaultVersion: string;
-  defaultPort?: number;
-  requires: string[];
-  incompatibleWith: string[];
-  suggestedWith: string[];
-  officialScaffold?: string;
-  dockerImage?: string;
-  healthCheck?: HealthCheckConfig;
-  envVars: Record<string, string>;
-  configFiles: string[];
-  lastVerified: string;
-  tags: string[];
+    id: string;
+    name: string;
+    category: TechnologyCategory;
+    description: string;
+    website: string;
+    versions: TechnologyVersion[];
+    defaultVersion: string;
+    defaultPort?: number;
+    requires: string[];
+    incompatibleWith: string[];
+    suggestedWith: string[];
+    officialScaffold?: string;
+    dockerImage?: string;
+    healthCheck?: HealthCheckConfig;
+    envVars: Record<string, string>;
+    configFiles: string[];
+    lastVerified: string;
+    tags: string[];
 }
-//# sourceMappingURL=technology.d.ts.map
+//# sourceMappingURL=technology.d.ts.map

package/dist/types/technology.js

@@ -3,4 +3,4 @@
  * Each technology is deeply modeled with versions, ports, rules, and metadata.
  */
 export {};
-//# sourceMappingURL=technology.js.map
+//# sourceMappingURL=technology.js.map