@stackweld/core 0.3.0 → 0.4.0

package/dist/engine/preferences.d.ts

@@ -2,12 +2,12 @@
  * Preferences — Persistent user preferences stored in SQLite.
  */
 export interface UserPreferences {
-  editor: string;
-  packageManager: string;
-  shell: string;
-  dockerMode: string;
-  defaultProfile: string;
-  theme: string;
+    editor: string;
+    packageManager: string;
+    shell: string;
+    dockerMode: string;
+    defaultProfile: string;
+    theme: string;
 }
 /** Get all preferences, merged with defaults. */
 export declare function getPreferences(): UserPreferences;
@@ -21,4 +21,4 @@ export declare function resetPreferences(): void;
 export declare function getPreferenceKeys(): (keyof UserPreferences)[];
 /** Get default values. */
 export declare function getDefaultPreferences(): UserPreferences;
-//# sourceMappingURL=preferences.d.ts.map
+//# sourceMappingURL=preferences.d.ts.map

package/dist/engine/runtime-manager.d.ts

@@ -4,62 +4,52 @@
  */
 import type { RuntimeState, ServiceStatus, Technology } from "../types/index.js";
 export interface RuntimeOptions {
-  composePath: string;
-  projectDir: string;
+    composePath: string;
+    projectDir: string;
 }
 export declare class RuntimeManager {
-  private technologies;
-  constructor(technologies: Technology[]);
-  /**
-   * Start all services with docker compose up.
-   */
-  up(
-    opts: RuntimeOptions,
-    detach?: boolean,
-  ): {
-    success: boolean;
-    output: string;
-  };
-  /**
-   * Stop all services.
-   */
-  down(
-    opts: RuntimeOptions,
-    volumes?: boolean,
-  ): {
-    success: boolean;
-    output: string;
-  };
-  /**
-   * Get status of all services in the compose file.
-   */
-  status(opts: RuntimeOptions): ServiceStatus[];
-  /**
-   * Get logs for a specific service or all services.
-   */
-  logs(opts: RuntimeOptions, service?: string, tail?: number, follow?: boolean): string;
-  /**
-   * Wait for all services to be healthy.
-   */
-  waitForHealthy(
-    opts: RuntimeOptions,
-    timeoutMs?: number,
-    intervalMs?: number,
-  ): Promise<{
-    healthy: boolean;
-    services: ServiceStatus[];
-  }>;
-  /**
-   * Build RuntimeState from current container status.
-   */
-  getRuntimeState(projectId: string, opts: RuntimeOptions): RuntimeState;
-  /**
-   * Check if docker compose file exists at path.
-   */
-  composeExists(projectDir: string): string | null;
-  /**
-   * Check if Docker is available.
-   */
-  isDockerAvailable(): boolean;
+    private technologies;
+    constructor(technologies: Technology[]);
+    /**
+     * Start all services with docker compose up.
+     */
+    up(opts: RuntimeOptions, detach?: boolean): {
+        success: boolean;
+        output: string;
+    };
+    /**
+     * Stop all services.
+     */
+    down(opts: RuntimeOptions, volumes?: boolean): {
+        success: boolean;
+        output: string;
+    };
+    /**
+     * Get status of all services in the compose file.
+     */
+    status(opts: RuntimeOptions): ServiceStatus[];
+    /**
+     * Get logs for a specific service or all services.
+     */
+    logs(opts: RuntimeOptions, service?: string, tail?: number, follow?: boolean): string;
+    /**
+     * Wait for all services to be healthy.
+     */
+    waitForHealthy(opts: RuntimeOptions, timeoutMs?: number, intervalMs?: number): Promise<{
+        healthy: boolean;
+        services: ServiceStatus[];
+    }>;
+    /**
+     * Build RuntimeState from current container status.
+     */
+    getRuntimeState(projectId: string, opts: RuntimeOptions): RuntimeState;
+    /**
+     * Check if docker compose file exists at path.
+     */
+    composeExists(projectDir: string): string | null;
+    /**
+     * Check if Docker is available.
+     */
+    isDockerAvailable(): boolean;
 }
-//# sourceMappingURL=runtime-manager.d.ts.map
+//# sourceMappingURL=runtime-manager.d.ts.map

package/dist/engine/runtime-manager.js

@@ -2,7 +2,7 @@
  * Runtime Manager — Manages Docker Compose lifecycle for stacks.
  * Handles up, down, status, logs, and health check waiting.
  */
-import { execSync } from "node:child_process";
+import { execFileSync } from "node:child_process";
 import * as fs from "node:fs";
 import * as path from "node:path";
 export class RuntimeManager {
@@ -14,9 +14,11 @@ export class RuntimeManager {
      * Start all services with docker compose up.
      */
     up(opts, detach = true) {
-        const flags = detach ? "-d" : "";
+        const args = ["compose", "-f", opts.composePath, "up"];
+        if (detach)
+            args.push("-d");
         try {
-            const output = execSync(`docker compose -f "${opts.composePath}" up ${flags}`, {
+            const output = execFileSync("docker", args, {
                 cwd: opts.projectDir,
                 stdio: "pipe",
                 timeout: 120_000,
@@ -32,9 +34,11 @@ export class RuntimeManager {
      * Stop all services.
      */
     down(opts, volumes = false) {
+        const args = ["compose", "-f", opts.composePath, "down"];
+        if (volumes)
+            args.push("--volumes");
         try {
-            const volumesFlag = volumes ? " --volumes" : "";
-            const output = execSync(`docker compose -f "${opts.composePath}" down${volumesFlag}`, {
+            const output = execFileSync("docker", args, {
                 cwd: opts.projectDir,
                 stdio: "pipe",
                 timeout: 60_000,
@@ -51,7 +55,7 @@ export class RuntimeManager {
      */
     status(opts) {
         try {
-            const raw = execSync(`docker compose -f "${opts.composePath}" ps --format json`, {
+            const raw = execFileSync("docker", ["compose", "-f", opts.composePath, "ps", "--format", "json"], {
                 cwd: opts.projectDir,
                 stdio: "pipe",
                 timeout: 10_000,
@@ -112,10 +116,20 @@ export class RuntimeManager {
      * Get logs for a specific service or all services.
      */
     logs(opts, service, tail = 50, follow = false) {
+        if (service && !/^[a-zA-Z0-9_-]+$/.test(service)) {
+            throw new Error(`Invalid service name: ${service}`);
+        }
+        const args = ["compose", "-f", opts.composePath, "logs", "--tail", String(tail)];
+        if (follow)
+            args.push("-f");
+        if (service)
+            args.push(service);
         try {
-            const serviceArg = service || "";
-            const followFlag = follow ? " -f" : "";
-            return execSync(`docker compose -f "${opts.composePath}" logs --tail ${tail}${followFlag} ${serviceArg}`, { cwd: opts.projectDir, stdio: follow ? "inherit" : "pipe", timeout: follow ? 0 : 10_000 }).toString();
+            return execFileSync("docker", args, {
+                cwd: opts.projectDir,
+                stdio: follow ? "inherit" : "pipe",
+                timeout: follow ? 0 : 10_000,
+            }).toString();
         }
         catch (err) {
             return err instanceof Error ? err.message : String(err);
@@ -170,7 +184,7 @@ export class RuntimeManager {
      */
     isDockerAvailable() {
         try {
-            execSync("docker info", { stdio: "pipe", timeout: 5_000 });
+            execFileSync("docker", ["info"], { stdio: "pipe", timeout: 5_000 });
             return true;
         }
         catch {

package/dist/engine/scaffold-orchestrator.js

@@ -7,7 +7,41 @@
  * - .gitignore (combined)
  * - devcontainer.json
  */
-import { execSync } from "node:child_process";
+import { execFileSync } from "node:child_process";
+import { randomBytes } from "node:crypto";
+const WEAK_SECRETS = new Set([
+    "postgres",
+    "root",
+    "admin",
+    "password",
+    "secret",
+    "change-me",
+    "change-me-in-production",
+    "minioadmin",
+    "mariadb",
+]);
+function securifyEnvValue(key, value, projectName) {
+    const lower = key.toLowerCase();
+    if (WEAK_SECRETS.has(value)) {
+        if (lower.includes("user") || lower.includes("username") || lower.includes("email")) {
+            return value; // usernames are fine as defaults
+        }
+        return randomBytes(20).toString("base64url");
+    }
+    // Replace weak passwords inside DATABASE_URL strings
+    if (lower.includes("url") &&
+        (value.includes("postgres:postgres") ||
+            value.includes("root:root") ||
+            value.includes("admin:admin"))) {
+        const securePass = randomBytes(20).toString("base64url");
+        return value
+            .replace(/postgres:postgres/g, `postgres:${securePass}`)
+            .replace(/root:root/g, `root:${securePass}`)
+            .replace(/admin:admin/g, `admin:${securePass}`)
+            .replace(/\/app/g, `/${projectName.replace(/[^a-zA-Z0-9_]/g, "_")}`);
+    }
+    return value;
+}
 export class ScaffoldOrchestrator {
     technologies;
     constructor(technologies) {
@@ -109,9 +143,10 @@ export class ScaffoldOrchestrator {
      * Generate .env.example from all technologies' envVars.
      */
     generateEnvExample(stack, techs) {
+        const projectName = stack.name.replace(/\s+/g, "-").toLowerCase();
         const lines = [
             `# ${stack.name} — Environment Variables`,
-            `# Generated by Stackweld`,
+            `# Generated by Stackweld — rotate secrets before production`,
             "",
         ];
         const seen = new Set();
@@ -122,7 +157,8 @@ export class ScaffoldOrchestrator {
             lines.push(`# ${tech.name}`);
             for (const [key, value] of entries) {
                 if (!seen.has(key)) {
-                    lines.push(`${key}=${value}`);
+                    const secureValue = securifyEnvValue(key, value, projectName);
+                    lines.push(`${key}=${secureValue}`);
                     seen.add(key);
                 }
             }
@@ -354,11 +390,11 @@ export class ScaffoldOrchestrator {
      */
     initGit(projectDir, stack, initialCommit = true) {
         try {
-            execSync("git init", { cwd: projectDir, stdio: "pipe" });
+            execFileSync("git", ["init"], { cwd: projectDir, stdio: "pipe" });
             if (initialCommit) {
-                execSync("git add -A", { cwd: projectDir, stdio: "pipe" });
+                execFileSync("git", ["add", "-A"], { cwd: projectDir, stdio: "pipe" });
                 const msg = `Initial commit: ${stack.name} (${stack.profile})\n\nGenerated by Stackweld`;
-                execSync(`git commit -m "${msg}"`, {
+                execFileSync("git", ["commit", "-m", msg], {
                     cwd: projectDir,
                     stdio: "pipe",
                 });

package/dist/engine/stack-detector.d.ts

@@ -2,20 +2,20 @@
  * Stack Detector — Analyze a project directory to detect its technology stack.
  */
 export interface DetectedStack {
-  technologies: DetectedTech[];
-  confidence: number;
-  projectType: "frontend" | "backend" | "fullstack" | "monorepo" | "library" | "unknown";
-  packageManagers: string[];
+    technologies: DetectedTech[];
+    confidence: number;
+    projectType: "frontend" | "backend" | "fullstack" | "monorepo" | "library" | "unknown";
+    packageManagers: string[];
 }
 export interface DetectedTech {
-  id: string;
-  name: string;
-  confidence: number;
-  detectedVia: string;
-  version?: string;
+    id: string;
+    name: string;
+    confidence: number;
+    detectedVia: string;
+    version?: string;
 }
 /**
  * Detect the technology stack of a project at the given path.
  */
 export declare function detectStack(projectPath: string): DetectedStack;
-//# sourceMappingURL=stack-detector.d.ts.map
+//# sourceMappingURL=stack-detector.d.ts.map

package/dist/engine/stack-differ.d.ts

@@ -3,24 +3,24 @@
  */
 import type { StackDefinition } from "../types/stack.js";
 export interface StackDiff {
-  added: DiffItem[];
-  removed: DiffItem[];
-  changed: DiffChange[];
-  unchanged: string[];
-  summary: string;
+    added: DiffItem[];
+    removed: DiffItem[];
+    changed: DiffChange[];
+    unchanged: string[];
+    summary: string;
 }
 export interface DiffItem {
-  technologyId: string;
-  name: string;
-  version?: string;
-  port?: number;
+    technologyId: string;
+    name: string;
+    version?: string;
+    port?: number;
 }
 export interface DiffChange {
-  technologyId: string;
-  name: string;
-  field: string;
-  from: string;
-  to: string;
+    technologyId: string;
+    name: string;
+    field: string;
+    from: string;
+    to: string;
 }
 export declare function diffStacks(stackA: StackDefinition, stackB: StackDefinition): StackDiff;
-//# sourceMappingURL=stack-differ.d.ts.map
+//# sourceMappingURL=stack-differ.d.ts.map

package/dist/engine/stack-differ.js

@@ -3,78 +3,82 @@
  */
 // ─── Main Function ────────────────────────────────────
 export function diffStacks(stackA, stackB) {
-  const techMapA = new Map(stackA.technologies.map((t) => [t.technologyId, t]));
-  const techMapB = new Map(stackB.technologies.map((t) => [t.technologyId, t]));
-  const added = [];
-  const removed = [];
-  const changed = [];
-  const unchanged = [];
-  // Find removed (in A but not B) and changed/unchanged
-  for (const [id, techA] of techMapA) {
-    const techB = techMapB.get(id);
-    if (!techB) {
-      removed.push({
-        technologyId: id,
-        name: id,
-        version: techA.version,
-        port: techA.port,
-      });
-      continue;
+    const techMapA = new Map(stackA.technologies.map((t) => [t.technologyId, t]));
+    const techMapB = new Map(stackB.technologies.map((t) => [t.technologyId, t]));
+    const added = [];
+    const removed = [];
+    const changed = [];
+    const unchanged = [];
+    // Find removed (in A but not B) and changed/unchanged
+    for (const [id, techA] of techMapA) {
+        const techB = techMapB.get(id);
+        if (!techB) {
+            removed.push({
+                technologyId: id,
+                name: id,
+                version: techA.version,
+                port: techA.port,
+            });
+            continue;
+        }
+        let hasChanges = false;
+        if (techA.version !== techB.version) {
+            changed.push({
+                technologyId: id,
+                name: id,
+                field: "version",
+                from: techA.version,
+                to: techB.version,
+            });
+            hasChanges = true;
+        }
+        if (techA.port !== techB.port) {
+            changed.push({
+                technologyId: id,
+                name: id,
+                field: "port",
+                from: techA.port !== undefined ? String(techA.port) : "none",
+                to: techB.port !== undefined ? String(techB.port) : "none",
+            });
+            hasChanges = true;
+        }
+        const configA = JSON.stringify(techA.config ?? {});
+        const configB = JSON.stringify(techB.config ?? {});
+        if (configA !== configB) {
+            changed.push({
+                technologyId: id,
+                name: id,
+                field: "config",
+                from: configA,
+                to: configB,
+            });
+            hasChanges = true;
+        }
+        if (!hasChanges) {
+            unchanged.push(id);
+        }
     }
-    let hasChanges = false;
-    if (techA.version !== techB.version) {
-      changed.push({
-        technologyId: id,
-        name: id,
-        field: "version",
-        from: techA.version,
-        to: techB.version,
-      });
-      hasChanges = true;
+    // Find added (in B but not A)
+    for (const [id, techB] of techMapB) {
+        if (!techMapA.has(id)) {
+            added.push({
+                technologyId: id,
+                name: id,
+                version: techB.version,
+                port: techB.port,
+            });
+        }
     }
-    if (techA.port !== techB.port) {
-      changed.push({
-        technologyId: id,
-        name: id,
-        field: "port",
-        from: techA.port !== undefined ? String(techA.port) : "none",
-        to: techB.port !== undefined ? String(techB.port) : "none",
-      });
-      hasChanges = true;
-    }
-    const configA = JSON.stringify(techA.config ?? {});
-    const configB = JSON.stringify(techB.config ?? {});
-    if (configA !== configB) {
-      changed.push({
-        technologyId: id,
-        name: id,
-        field: "config",
-        from: configA,
-        to: configB,
-      });
-      hasChanges = true;
-    }
-    if (!hasChanges) {
-      unchanged.push(id);
-    }
-  }
-  // Find added (in B but not A)
-  for (const [id, techB] of techMapB) {
-    if (!techMapA.has(id)) {
-      added.push({
-        technologyId: id,
-        name: id,
-        version: techB.version,
-        port: techB.port,
-      });
-    }
-  }
-  const parts = [];
-  if (added.length > 0) parts.push(`+${added.length} added`);
-  if (removed.length > 0) parts.push(`-${removed.length} removed`);
-  if (changed.length > 0) parts.push(`~${changed.length} changed`);
-  if (unchanged.length > 0) parts.push(`${unchanged.length} unchanged`);
-  const summary = parts.join(", ");
-  return { added, removed, changed, unchanged, summary };
+    const parts = [];
+    if (added.length > 0)
+        parts.push(`+${added.length} added`);
+    if (removed.length > 0)
+        parts.push(`-${removed.length} removed`);
+    if (changed.length > 0)
+        parts.push(`~${changed.length} changed`);
+    if (unchanged.length > 0)
+        parts.push(`${unchanged.length} unchanged`);
+    const summary = parts.join(", ");
+    return { added, removed, changed, unchanged, summary };
 }
-//# sourceMappingURL=stack-differ.js.map
+//# sourceMappingURL=stack-differ.js.map

package/dist/engine/stack-engine.d.ts

@@ -1,16 +1,8 @@
-/**
- * Stack Engine — CRUD operations for stack definitions.
- * Handles creation, validation, versioning, and persistence.
- */
 import type { StackDefinition, StackProfile, StackTechnology, StackVersion, ValidationResult } from "../types/index.js";
 import type { RulesEngine } from "./rules-engine.js";
 export declare class StackEngine {
     private rules;
     constructor(rules: RulesEngine);
-    /**
-     * Create a new stack definition.
-     * Validates technologies and auto-resolves dependencies.
-     */
     create(opts: {
         name: string;
         description?: string;
@@ -21,21 +13,9 @@ export declare class StackEngine {
         stack: StackDefinition;
         validation: ValidationResult;
     };
-    /**
-     * Get a stack by ID.
-     */
     get(id: string): StackDefinition | null;
-    /**
-     * List all stacks.
-     */
     list(): StackDefinition[];
-    /**
-     * Delete a stack.
-     */
     delete(id: string): boolean;
-    /**
-     * Update a stack. Auto-increments version and saves snapshot.
-     */
     update(id: string, changes: Partial<Pick<StackDefinition, "name" | "description" | "profile" | "technologies" | "tags">>): {
         stack: StackDefinition;
         validation: ValidationResult;

package/dist/engine/stack-engine.js

@@ -1,7 +1,3 @@
-/**
- * Stack Engine — CRUD operations for stack definitions.
- * Handles creation, validation, versioning, and persistence.
- */
 import { randomUUID } from "node:crypto";
 import { getDatabase } from "../db/database.js";
 export class StackEngine {
@@ -9,13 +5,8 @@ export class StackEngine {
     constructor(rules) {
         this.rules = rules;
     }
-    /**
-     * Create a new stack definition.
-     * Validates technologies and auto-resolves dependencies.
-     */
     create(opts) {
         const validation = this.rules.validate(opts.technologies);
-        // Add auto-resolved dependencies
         const allTechs = [...opts.technologies];
         for (const depId of validation.resolvedDependencies) {
             const tech = this.rules.getTechnology(depId);
@@ -27,7 +18,6 @@ export class StackEngine {
                 });
             }
         }
-        // Apply port assignments to existing techs
         for (const t of allTechs) {
             if (validation.portAssignments[t.technologyId]) {
                 t.port = validation.portAssignments[t.technologyId];
@@ -50,9 +40,6 @@ export class StackEngine {
         }
         return { stack, validation };
     }
-    /**
-     * Get a stack by ID.
-     */
     get(id) {
         const db = getDatabase();
         const row = db.prepare("SELECT * FROM stacks WHERE id = ?").get(id);
@@ -78,25 +65,16 @@ export class StackEngine {
             })),
         };
     }
-    /**
-     * List all stacks.
-     */
     list() {
         const db = getDatabase();
         const rows = db.prepare("SELECT id FROM stacks ORDER BY updated_at DESC").all();
         return rows.map((r) => this.get(r.id)).filter(Boolean);
     }
-    /**
-     * Delete a stack.
-     */
     delete(id) {
         const db = getDatabase();
         const result = db.prepare("DELETE FROM stacks WHERE id = ?").run(id);
         return result.changes > 0;
     }
-    /**
-     * Update a stack. Auto-increments version and saves snapshot.
-     */
     update(id, changes) {
         const existing = this.get(id);
         if (!existing)
@@ -112,7 +90,6 @@ export class StackEngine {
         updated_at = ?, tags = ?
       WHERE id = ?
     `).run(changes.name || existing.name, changes.description ?? existing.description, changes.profile || existing.profile, newVersion, now, JSON.stringify(changes.tags || existing.tags), id);
-        // Replace technologies
         db.prepare("DELETE FROM stack_technologies WHERE stack_id = ?").run(id);
         for (const t of techs) {
             db.prepare(`
@@ -120,7 +97,6 @@ export class StackEngine {
         VALUES (?, ?, ?, ?, ?)
       `).run(id, t.technologyId, t.version, t.port || null, JSON.stringify(t.config || {}));
         }
-        // Save version snapshot
         const updatedStack = this.get(id);
         this.saveVersionSnapshot(updatedStack, `Updated to v${newVersion}`);
         return { stack: updatedStack, validation };

package/dist/engine/stack-serializer.d.ts

@@ -3,13 +3,13 @@
  * Uses zlib deflate + base64url encoding. No server needed.
  */
 export interface ShareableStack {
-  name: string;
-  profile: string;
-  technologies: Array<{
-    id: string;
-    version?: string;
-    port?: number;
-  }>;
+    name: string;
+    profile: string;
+    technologies: Array<{
+        id: string;
+        version?: string;
+        port?: number;
+    }>;
 }
 /**
  * Compress a stack into a URL-safe base64 string.
@@ -29,4 +29,4 @@ export declare function generateShareUrl(stack: ShareableStack, baseUrl?: string
  * Extract the encoded payload from a share URL.
  */
 export declare function extractFromShareUrl(url: string): string;
-//# sourceMappingURL=stack-serializer.d.ts.map
+//# sourceMappingURL=stack-serializer.d.ts.map