@starci/hfs 4.4.0 → 4.4.1

package/scaffold/add-fe-page.mjs

@@ -1,269 +1 @@
-import fs from "node:fs";
-import path from "node:path";
-import { loadSlotManifest, readRepoDeclaration } from "../runtime/scripts/hfs/slots.mjs";
-import { ScaffoldError, pascalOf } from "./service.mjs";
 
-const NAME = /^[a-z][a-z0-9-]*$/;
-const RESERVED = /^(?:con|prn|aux|nul|com[0-9]|lpt[0-9])$/i;
-const jsonText = (value) => `${JSON.stringify(value, null, 2)}\n`;
-const objectCatalog = (value) => value !== null && typeof value === "object" && !Array.isArray(value);
-
-/** Validate a CLI name before it is used in a path, symbol or catalog key. */
-export function feName(value, label = "name") {
-  if (typeof value !== "string" || !NAME.test(value) || value.split("-").includes("") || RESERVED.test(value)) {
-    throw new ScaffoldError("HFS_ADD_NAME_INVALID", `${label} must be kebab-case, without a path or a reserved filename`);
-  }
-  return value;
-}
-
-/** An app-relative target whose existing ancestors are real directories, never symlinks. */
-function feTarget(root, relative) {
-  const target = path.resolve(root, relative);
-  const inside = path.relative(root, target);
-  if (!inside || inside.startsWith("..") || path.isAbsolute(inside)) {
-    throw new ScaffoldError("HFS_ADD_PATH_UNSAFE", `${relative} must stay inside the app root`);
-  }
-  let at = root;
-  const pieces = inside.split(path.sep);
-  for (let index = 0; index < pieces.length; index += 1) {
-    at = path.join(at, pieces[index]);
-    const stat = fs.lstatSync(at, { throwIfNoEntry: false });
-    if (!stat) continue;
-    if (stat.isSymbolicLink() || (index < pieces.length - 1 && !stat.isDirectory())) {
-      throw new ScaffoldError("HFS_ADD_PATH_UNSAFE", `${relative} has a symlink or a non-directory ancestor`);
-    }
-  }
-  return target;
-}
-
-/** Resolve the declared Next app; a multi-app repository must select one explicitly. */
-export function readFeContext({ root, app }) {
-  const repoRoot = path.resolve(root);
-  const stat = fs.lstatSync(repoRoot, { throwIfNoEntry: false });
-  if (!stat?.isDirectory() || stat.isSymbolicLink()) {
-    throw new ScaffoldError("HFS_ADD_NOT_AN_APP", "add page and overlay run at a real app root directory");
-  }
-  const declaration = feTarget(repoRoot, "hfs.json");
-  const packageFile = feTarget(repoRoot, "package.json");
-  if (!fs.existsSync(declaration) || !fs.existsSync(packageFile)) {
-    throw new ScaffoldError("HFS_ADD_NOT_AN_APP", "add page and overlay need hfs.json and package.json at the app root");
-  }
-  const repo = readRepoDeclaration(loadSlotManifest(), repoRoot);
-  const apps = repo.sides?.fe?.apps.filter((candidate) => candidate.kind === "next") ?? [];
-  if (!apps.length) throw new ScaffoldError("HFS_ADD_NO_FRONT_END", "this app has no declared Next front end");
-  if (app !== undefined) feName(app, "app");
-  if (app === undefined && apps.length !== 1) {
-    throw new ScaffoldError("HFS_ADD_OPTION_MISSING", "add page and overlay need --app when several Next apps are declared");
-  }
-  const selected = apps.find((candidate) => candidate.name === (app ?? apps[0].name));
-  if (!selected) throw new ScaffoldError("HFS_ADD_APP_UNKNOWN", `front-end app ${app} is not declared`);
-  feName(selected.name, "declared app");
-  return { root: repoRoot, app: selected.name, repo, source: `fe/apps/${selected.name}/src` };
-}
-
-/** Read a required owner file only after checking every path ancestor. */
-export function readFeFile(context, relative) {
-  const target = feTarget(context.root, relative);
-  if (!fs.existsSync(target) || !fs.statSync(target).isFile()) {
-    throw new ScaffoldError("HFS_ADD_WIRE_MISSING", `${relative} is required before this feature can be added`);
-  }
-  return fs.readFileSync(target, "utf8");
-}
-
-/** Refuse an existing owner, including a partially generated one. */
-export function requireNewFeOwner(context, relative) {
-  if (fs.existsSync(feTarget(context.root, relative))) {
-    throw new ScaffoldError("HFS_ADD_EXISTS", `${relative} already exists; add never replaces an existing owner`);
-  }
-}
-
-function readCatalogs(context) {
-  const directory = `${context.source}/modules/i18n/messages`;
-  const target = feTarget(context.root, directory);
-  if (!fs.existsSync(target)) throw new ScaffoldError("HFS_ADD_WIRE_MISSING", `${directory} is required`);
-  if (!fs.statSync(target).isDirectory()) throw new ScaffoldError("HFS_ADD_I18N_INVALID", `${directory} must be a directory`);
-  const files = fs.readdirSync(target).filter((file) => file.endsWith(".json")).sort();
-  if (!["vi.json", "en.json"].every((file) => files.includes(file))) {
-    throw new ScaffoldError("HFS_ADD_I18N_MISSING", `${directory} needs both vi.json and en.json`);
-  }
-  return files.map((file) => {
-    const relative = `${directory}/${file}`;
-    const before = readFeFile(context, relative);
-    return { relative, before, locale: file.slice(0, -5), catalog: parseCatalog(before, relative) };
-  });
-}
-
-function parseCatalog(before, relative) {
-  let catalog;
-  try { catalog = JSON.parse(before); } catch {
-    throw new ScaffoldError("HFS_ADD_I18N_INVALID", `${relative} must contain valid JSON`);
-  }
-  if (!objectCatalog(catalog)) throw new ScaffoldError("HFS_ADD_I18N_INVALID", `${relative} must contain a catalog object`);
-  return catalog;
-}
-
-function catalogNamespace(catalogs, app) {
-  const first = catalogs[0].catalog;
-  const keys = Object.keys(first);
-  let namespace = keys.length === 1 ? keys[0] : app;
-  if (!Object.hasOwn(first, namespace) && Object.hasOwn(first, "app")) namespace = "app";
-  if (!catalogs.every(({ catalog }) => Object.hasOwn(catalog, namespace) && objectCatalog(catalog[namespace]))) {
-    throw new ScaffoldError("HFS_ADD_I18N_INVALID", "the app catalogs need a shared object namespace");
-  }
-  return namespace;
-}
-
-function catalogCopy(locale, defaults, messages) {
-  const copy = messages?.[locale] ?? defaults[locale];
-  const required = Object.keys(defaults.en);
-  if (!copy || !required.every((key) => typeof copy[key] === "string" && copy[key].trim())) {
-    throw new ScaffoldError("HFS_ADD_I18N_INVALID", `provide the ${required.join(", ")} messages for locale ${locale}`);
-  }
-  return Object.fromEntries(required.map((key) => [key, copy[key]]));
-}
-
-/** Plan matching localized keys in every catalog without changing existing copy. */
-export function planFeCatalogs(context, { group, name, defaults, messages }) {
-  const catalogs = readCatalogs(context);
-  const namespace = catalogNamespace(catalogs, context.app);
-  const updates = catalogs.map(({ catalog, locale, relative, before }) => {
-    const owner = catalog[namespace];
-    if (owner[group] !== undefined && !objectCatalog(owner[group])) {
-      throw new ScaffoldError("HFS_ADD_I18N_INVALID", `${relative}: ${namespace}.${group} must be an object`);
-    }
-    owner[group] ??= {};
-    if (Object.hasOwn(owner[group], name)) {
-      throw new ScaffoldError("HFS_ADD_EXISTS", `${relative} already declares ${namespace}.${group}.${name}`);
-    }
-    owner[group][name] = catalogCopy(locale, defaults, messages);
-    return { relative, before, body: jsonText(catalog) };
-  });
-  return { namespace: `${namespace}.${group}.${name}`, updates };
-}
-
-function createParent(root, target, made) {
-  const missing = [];
-  for (let at = path.dirname(target); at !== root && !fs.existsSync(at); at = path.dirname(at)) missing.push(at);
-  for (const directory of missing.reverse()) {
-    fs.mkdirSync(directory);
-    made.push(directory);
-  }
-}
-
-function writeCreated(target, body, written) {
-  const descriptor = fs.openSync(target, "wx");
-  written.push(target);
-  try { fs.writeFileSync(descriptor, body); } finally { fs.closeSync(descriptor); }
-}
-
-/** Execute a fully checked plan and restore updated owners if a write fails. */
-export function writeFePlan(context, created, updates) {
-  for (const file of created) requireNewFeOwner(context, file.relative);
-  for (const file of updates) {
-    if (readFeFile(context, file.relative) !== file.before) {
-      throw new ScaffoldError("HFS_ADD_WIRE_INVALID", `${file.relative} changed while planning the feature`);
-    }
-  }
-  const written = [];
-  const updated = [];
-  const directories = [];
-  try {
-    for (const file of created) {
-      const target = feTarget(context.root, file.relative);
-      createParent(context.root, target, directories);
-      writeCreated(target, file.body, written);
-    }
-    for (const file of updates) {
-      updated.push(file);
-      fs.writeFileSync(feTarget(context.root, file.relative), file.body);
-    }
-  } catch (error) {
-    for (const file of updated.reverse()) fs.writeFileSync(feTarget(context.root, file.relative), file.before);
-    for (const file of written.reverse()) fs.rmSync(file);
-    for (const directory of directories.reverse()) fs.rmdirSync(directory);
-    throw error;
-  }
-  return { created: created.map((file) => file.relative), updated: updates.map((file) => file.relative) };
-}
-
-function pageSources({ name, namespace, symbol, routeSymbol }) {
-  const metadata = `${name.split("-").map((word, index) => index ? pascalOf(word) : word).join("")}Metadata`;
-  return {
-    metadata,
-    entry: `import type { Metadata } from "next"
-import { getTranslations } from "next-intl/server"
-import { ${routeSymbol} } from "@/modules/routes"
-import { ${symbol}Base } from "./component"
-
-/** The localized document title and canonical destination of this page. */
-export const ${metadata} = async (): Promise<Metadata> => {
-    const t = await getTranslations(${JSON.stringify(namespace)})
-    return { title: t("title"), alternates: { canonical: ${routeSymbol} } }
-}
-
-/** Resolve the requested locale's copy before drawing this server page. */
-export const ${symbol} = async () => {
-    const t = await getTranslations(${JSON.stringify(namespace)})
-    return <${symbol}Base props={{ title: t("title") }} />
-}
-`,
-    component: `import { Heading } from "@starci/grammar/common"
-
-/** The localized words displayed by this page. */
-export interface ${symbol}BaseProps {
-    readonly props: { readonly title: string }
-}
-
-/** Draw the page using the settled copy supplied by its server owner. */
-export const ${symbol}Base = (props: ${symbol}BaseProps) => (
-    <Heading level={1}>{props.props.title}</Heading>
-)
-`,
-  };
-}
-
-function pageRoute(symbol, metadata) {
-  return `import { ${symbol} } from "@/features/pages/${symbol}"
-
-/** The locale-aware metadata of this page. */
-export { ${metadata} as generateMetadata } from "@/features/pages/${symbol}"
-
-/** Mount the page's public server owner. */
-const Page = () => <${symbol} />
-
-export default Page
-`;
-}
-
-/** Add a server page, its thin localized route and matching vi/en catalog entries. */
-export function addFePage({ root, app, name, route = name, messages }) {
-  feName(name, "page name");
-  if (typeof route !== "string" || !route) throw new ScaffoldError("HFS_ADD_OPTION_INVALID", "--route needs one or more kebab-case path segments");
-  for (const segment of route.split("/")) feName(segment, "route segment");
-  const context = readFeContext({ root, app });
-  const symbol = `${pascalOf(name)}Page`;
-  const owner = `${context.source}/features/pages/${symbol}`;
-  requireNewFeOwner(context, owner);
-  const routeFile = `${context.source}/app/[locale]/${route}/page.tsx`;
-  requireNewFeOwner(context, routeFile);
-  const catalogs = planFeCatalogs(context, {
-    group: "pages", name, messages,
-    defaults: { vi: { title: "Trang m\u1edbi" }, en: { title: "New page" } },
-  });
-  const routeSymbol = `${name.replaceAll("-", "_").toUpperCase()}_PAGE_ROUTE`;
-  const routesFile = `${context.source}/modules/routes/index.ts`;
-  const before = readFeFile(context, routesFile);
-  if (before.split(/[^A-Za-z0-9_]/).includes(routeSymbol)) {
-    throw new ScaffoldError("HFS_ADD_EXISTS", `${routesFile} already declares ${routeSymbol}`);
-  }
-  const sources = pageSources({ name, namespace: catalogs.namespace, symbol, routeSymbol });
-  const created = [
-    { relative: `${owner}/index.tsx`, body: sources.entry },
-    { relative: `${owner}/component.tsx`, body: sources.component },
-    { relative: routeFile, body: pageRoute(symbol, sources.metadata) },
-  ];
-  const destination = `/${route}`;
-  const routeBody = `${before.trimEnd()}\n\n/** The canonical destination of the ${symbol} owner. */\nexport const ${routeSymbol} = ${JSON.stringify(destination)} as const\n`;
-  const updates = [...catalogs.updates, { relative: routesFile, before, body: routeBody }];
-  return { ...writeFePlan(context, created, updates), registered: { app: context.app, page: symbol, route: destination } };
-}

package/scaffold/supabase-ports.mjs

@@ -17,7 +17,7 @@ export const SUPABASE_PORT_VARIABLES = Object.freeze(Object.keys(OFFSETS).map((k
 const hash = (text) => [...text].reduce((value, char) => Math.imul(value ^ char.charCodeAt(0), 16777619) >>> 0, 2166136261);
 
 /** The first port of the project's block. */
-export const supabasePortBase = (project) => RANGE_START + (hash(String(project)) % BLOCK_COUNT) * BLOCK_SIZE;
+const supabasePortBase = (project) => RANGE_START + (hash(String(project)) % BLOCK_COUNT) * BLOCK_SIZE;
 
 /** { supabasePortApi: '41231', ... }: the variables a skeleton file fills. */
 export function supabasePortVars(project) {

package/stack/age-install.mjs

@@ -5,7 +5,7 @@ import { firstLine } from './context.mjs';
 const AGE_VERSION = 'v1.2.1';
 const AGE_URL = `https://github.com/FiloSottile/age/releases/download/${AGE_VERSION}/age-${AGE_VERSION}-linux-amd64.tar.gz`;
 /** sha256 of the official linux/amd64 archive of AGE_VERSION. */
-export const AGE_SHA256 = '7df45a6cc87d4da11cc03a539a7470c15b1041ab2b396af088fe9990f7c79d50';
+const AGE_SHA256 = '7df45a6cc87d4da11cc03a539a7470c15b1041ab2b396af088fe9990f7c79d50';
 const INSTALL = { dnf: 'sudo -n dnf install -y age', yum: 'sudo -n yum install -y age', apk: 'sudo -n apk add age', 'apt-get': 'sudo -n apt-get install -y age' };
 
 const STATIC_INSTALL = [

package/stack/cli.mjs

@@ -18,7 +18,7 @@ const VALUE = new Set(['--env', '--image', '--source-sha', '--previous', '--out'
 const REPEAT = new Set(['--image', '--keep', '--extra-compose', '--project']);
 
 /** Splits argv into { flags, positional }; an unknown flag or a flag without its value is a refusal. */
-export function parseFlags(argv) {
+function parseFlags(argv) {
   const flags = {};
   const positional = [];
   for (let index = 0; index < argv.length; index += 1) {
@@ -37,7 +37,7 @@ export function parseFlags(argv) {
 }
 
 /** `--image api=ghcr.io/o/x@sha256:...` (repeatable or comma separated) -> { api: 'ghcr.io/o/x@sha256:...' }. */
-export function parseImages(values = []) {
+function parseImages(values = []) {
   const out = {};
   for (const item of values.flatMap((value) => value.split(','))) {
     const at = item.indexOf('=');

package/stack/context.mjs

@@ -1,5 +1,5 @@
 // context.mjs - the seams every stack module runs through: spawning tools, sleeping, the clock and the output.
-// Production uses the real implementations; the specs inject fakes (tests/helpers/stack-fakes.mjs).
+// Production uses the real implementations; a spec injects fakes.
 import { spawnSync } from 'node:child_process';
 import { defaultSops } from '../runtime/scripts/hfs/secret-sops.mjs';
 

package/stack/digest.mjs

@@ -1,6 +1,6 @@
 // digest.mjs - image reference and release identifier guards (the all-zero placeholder digest is never a real image).
 /** A registry image reference pinned by a real sha256 digest; the all-zero placeholder digest is refused. */
-export const DIGEST_REF = /^[a-z0-9./_-]+(?::[A-Za-z0-9._-]+)?@sha256:(?!0{64}$)[0-9a-f]{64}$/u;
+const DIGEST_REF = /^[a-z0-9./_-]+(?::[A-Za-z0-9._-]+)?@sha256:(?!0{64}$)[0-9a-f]{64}$/u;
 
 /** A release identifier: the first 16 hex characters of the release digest. */
 export const RELEASE_ID = /^[0-9a-f]{16}$/u;

package/stack/edge-alias.mjs

@@ -22,7 +22,7 @@ const sameSet = (left, right) => [...new Set(left)].sort().join('\n') === [...ne
 const show = (aliases) => `[${aliases.join(', ')}]`;
 
 /** [{ service, network, aliases }]: every service attached to an `external: true` network of the stack, with the aliases it declares. */
-export function edgeAttachments(bytes) {
+function edgeAttachments(bytes) {
   const model = parseYaml(bytes) ?? {};
   const external = new Map(Object.entries(model.networks ?? {}).filter(([, definition]) => definition?.external === true).map(([key, definition]) => [key, String(definition.name ?? key)]));
   return Object.entries(model.services ?? {}).flatMap(([service, entry]) => Object.entries(networkMap(entry?.networks))

package/stack/image-scan.mjs

@@ -51,7 +51,7 @@ const paxPath = (body) => body.toString('utf8').split('\n').map((record) => /^\d
  * Walks a tar file by header: calls visit({ name, type, size, read }) for every entry (`read()` returns the content, called only for files worth
  * reading). Handles ustar prefixes, GNU long names (L) and PAX paths (x). Content is never loaded unless the visitor asks for it.
  */
-export function walkTar(file, visit) {
+function walkTar(file, visit) {
   const fd = fs.openSync(file, 'r');
   try {
     const header = Buffer.alloc(BLOCK);

package/stack/ingress-create.mjs

@@ -26,7 +26,7 @@ function readLegacy(run, ingress) {
 }
 
 /** The stack model (compose spec as JSON, which is valid YAML). */
-export function stackModel(ingress, { args, dynamicTarget, acmeTarget }) {
+function stackModel(ingress, { args, dynamicTarget, acmeTarget }) {
   const ports = [80, 443].map((port) => ({ target: port, published: port, protocol: 'tcp', mode: 'host' }));
   return {
     services: {
@@ -54,7 +54,7 @@ export function stackModel(ingress, { args, dynamicTarget, acmeTarget }) {
 }
 
 /** The guard that no task can start from this model. */
-export function refuseRunning(model) {
+function refuseRunning(model) {
   for (const [name, service] of Object.entries(model.services)) {
     if (service.deploy?.replicas !== 0) throw refusal('STACK_INGRESS_WOULD_START', `the ingress service ${name} would start a task; create deploys it with replicas 0 only`);
   }

package/stack/ingress.mjs

@@ -44,7 +44,7 @@ const originOf = (url) => {
 // ---- the live and the declared routes -------------------------------------------------------------------------------------------
 
 /** Host keys of a proxy router rule: `a.example` for Host(...), `regexp:<pattern>` for HostRegexp(...). */
-export function hostsOfRule(rule) {
+function hostsOfRule(rule) {
   const out = [];
   for (const [, kind, args] of String(rule).matchAll(MATCHER)) {
     for (const [, value] of args.matchAll(QUOTED)) out.push(kind === 'Host' ? value.toLowerCase() : `regexp:${value}`);
@@ -53,7 +53,7 @@ export function hostsOfRule(rule) {
 }
 
 /** { routes: [{ host, targets }], middlewares: [name] } of one parsed file-provider dynamic document (any shape is tolerated). */
-export function routesOfDocument(doc) {
+function routesOfDocument(doc) {
   const http = asMap(asMap(doc).http);
   const services = asMap(http.services);
   const targetsOf = (name) => {
@@ -491,7 +491,7 @@ const rehearsalVolume = (ingress) => `${ingress.acmeVolume}-rehearsal`;
 const classOf = (code) => Math.floor(code / 100);
 
 /** The static arguments of the ingress service with the ACME http challenge moved to an unused internal entrypoint. */
-export function rehearsalArgs(args) {
+function rehearsalArgs(args) {
   const quiet = args.map((arg) => arg.replace(CHALLENGE_ARG, `$1=${UNUSED_ENTRYPOINT}`));
   return [...quiet, `--entrypoints.${UNUSED_ENTRYPOINT}.address=127.0.0.1:1`];
 }

package/stack/remote.mjs

@@ -123,7 +123,7 @@ function sealedRunner(ctx, config) {
 }
 
 /** The ssh runner of one invocation (see the top of the file). */
-export function sshRunner(ctx, config, { sshCmd = null } = {}) {
+function sshRunner(ctx, config, { sshCmd = null } = {}) {
   if (sshCmd) return makeRunner(ctx, sshCommandArgv(sshCmd));
   if (config.remote.sealed && ctx.env.STARCI_STACK_SEALED_SSH === '1') return sealedRunner(ctx, config);
   return makeRunner(ctx, ['ssh', ...SSH_OPTIONS, config.remote.host]);
@@ -133,7 +133,7 @@ export function sshRunner(ctx, config, { sshCmd = null } = {}) {
  * The context to open the runner with. On an operator machine (not CI, no --ssh-cmd, the sealed members exist, no explicit
  * STARCI_STACK_SEALED_SSH) the sealed session is selected; otherwise the context is returned unchanged.
  */
-export function withOwnerTransport(ctx, config, { sshCmd = null } = {}) {
+function withOwnerTransport(ctx, config, { sshCmd = null } = {}) {
   const { sealed } = config.remote;
   if (sshCmd || !sealed || ctx.env.GITHUB_ACTIONS === 'true' || ctx.env.STARCI_STACK_SEALED_SSH !== undefined) return ctx;
   const present = [sealed.ops, sealed.sshKey, sealed.knownHosts].every((slug) => fs.existsSync(path.join(config.secretsDir, `${slug}.enc`)));

package/stack/sealed.mjs

@@ -19,16 +19,16 @@ const CR = String.fromCodePoint(13);
 const LF = String.fromCodePoint(10);
 
 /** True for content that is not text: a NUL byte in the first 8 KiB. Binary files are never rewritten. */
-export const isBinary = (bytes) => bytes.subarray(0, 8192).includes(0);
+const isBinary = (bytes) => bytes.subarray(0, 8192).includes(0);
 
 /** Every CRLF of a string becomes LF. */
-export const lfText = (text) => text.replaceAll(CR + LF, LF);
+const lfText = (text) => text.replaceAll(CR + LF, LF);
 
 /**
  * Line endings of a text file as the services need them: every CRLF becomes LF (a script rendered from a Windows checkout failed with
  * `set: Illegal option -`). Binary content is returned untouched. Takes and returns a Buffer.
  */
-export function lfBytes(bytes) {
+function lfBytes(bytes) {
   if (isBinary(bytes) || !bytes.includes(13)) return bytes;
   return Buffer.from(lfText(bytes.toString('latin1')), 'latin1');
 }
@@ -37,14 +37,14 @@ export function lfBytes(bytes) {
 export const configBytes = (file) => lfBytes(fs.readFileSync(file));
 
 /** The key that makes the version suffix of a secret name unguessable from the name alone: a local fixture key or the age identity. */
-export function versionKeyOf(ctx) {
+function versionKeyOf(ctx) {
   const key = ctx.env.STARCI_SECRET_VERSION_KEY || ctx.env.SOPS_AGE_KEY;
   if (!key) throw refusal('STACK_VERSION_KEY_MISSING', 'STARCI_SECRET_VERSION_KEY (a local fixture) or SOPS_AGE_KEY is needed to version the secret names');
   return key;
 }
 
 /** `<stack>-<key>-v<10 hex of HMAC(versionKey, key NUL value)>`: a changed value is a new name, an unchanged one keeps its name. */
-export function secretRuntimeName(stack, key, value, versionKey) {
+function secretRuntimeName(stack, key, value, versionKey) {
   const version = createHmac('sha256', versionKey).update(`${key}\0${value}`).digest('hex').slice(0, 10);
   const name = `${stack}-${key.toLowerCase().replaceAll('_', '-')}-v${version}`;
   if (name.length > MAX_NAME) throw refusal('STACK_SECRET_NAME_TOO_LONG', `the Swarm secret name for ${key} would exceed ${MAX_NAME} characters`);

package/sync/format.mjs

@@ -13,7 +13,7 @@ const IGNORE_FILE = '.prettierignore';
 const LOCKFILES = new Set(['package-lock.json']);
 
 /** The repository's own prettier, or a SyncError when it is not installed. */
-export function loadPrettier(repoRoot) {
+function loadPrettier(repoRoot) {
   const require = createRequire(path.join(repoRoot, 'package.json'));
   try {
     return require('prettier');

package/sync/hygiene.mjs

@@ -43,7 +43,7 @@ function ignoredAmong(cwd, files) {
 }
 
 /** Violations among `files` (repository-relative, '/'-separated): [{ file, code, message }]. `ignored` is a Set of ignored paths. */
-export function hygieneFindings(files, ignored) {
+function hygieneFindings(files, ignored) {
   const findings = [];
   for (const file of files) {
     if (file.startsWith(WORK) && ignored.has(file)) {

package/sync/index.mjs

@@ -37,8 +37,8 @@ const NODE_MAJOR = 22;
 const APP_BINARY = 'starci app';
 /** The scopes a target is rendered for: the app root, then each side. */
 export const SCOPES = Object.freeze([APP_SCOPE, ...SIDES]);
-export const BLOCK_BEGIN = '# >>> starci app sync (managed block; do not edit) >>>';
-export const BLOCK_END = '# <<< starci app sync <<<';
+const BLOCK_BEGIN = '# >>> starci app sync (managed block; do not edit) >>>';
+const BLOCK_END = '# <<< starci app sync <<<';
 const HEADER = scope => `# Generated by ${APP_BINARY} sync (${scope === APP_SCOPE ? 'app root' : scope + ' side'}). Do not edit: run "npx ${APP_BINARY} sync --write".`;
 
 export class SyncError extends Error {

package/sync/stack-images.mjs

@@ -32,7 +32,7 @@ function environmentImages(environment) {
  * The images of a parsed declaration, [{ service, app, buildArgs }] sorted by service: the union over its environments (the first
  * environment that names a service decides its app; a later one only adds build arguments). A declaration with no deploy block has none.
  */
-export function declaredStackImages(declaration) {
+function declaredStackImages(declaration) {
   const byService = new Map();
   for (const environment of Object.values(record(declaration?.environments) ? declaration.environments : {})) {
     for (const image of environmentImages(environment)) {
@@ -44,7 +44,7 @@ export function declaredStackImages(declaration) {
 }
 
 /** The host variables (names only) the declared environments interpolate into `docker stack config`: the union of `deploy.passEnv`. */
-export function declaredPassEnv(declaration) {
+function declaredPassEnv(declaration) {
   const names = Object.values(record(declaration?.environments) ? declaration.environments : {})
     .flatMap(environment => (Array.isArray(environment?.deploy?.passEnv) ? environment.deploy.passEnv : []))
     .filter(name => typeof name === 'string' && KEY.test(name));

package/upgrade/index.mjs

@@ -413,7 +413,7 @@ async function model({ root, to, presets, manifest }) {
  * Plans or applies the lite -> full migration. Returns the ordered public plan (`{op,path,why}[]`) in both modes.
  * `presets` and `lock` are test seams for the full managed render and npm lock resolution.
  */
-export async function upgradeEdition({
+async function upgradeEdition({
   root,
   to,
   plan = false,