@starci/hfs 4.7.12 → 4.7.14

package/runtime/scripts/hfs/stack-deploy-config.mjs

@@ -176,7 +176,10 @@ function configs(c, block, probe) {
     out.push({ name: entry.name, file: entry.file, env: entry.env });
   });
   const seen = new Set();
-  for (const entry of out) { if (seen.has(entry.name)) c.problem('deploy.configs', `config name ${entry.name} is declared twice`); seen.add(entry.name); }
+  for (const entry of out) {
+    if (seen.has(entry.name)) c.problem('deploy.configs', `config name ${entry.name} is declared twice`);
+    seen.add(entry.name);
+  }
   return out;
 }
 
@@ -242,7 +245,7 @@ function tasks(c, block, services) {
   return out;
 }
 
-const REGISTRY_HOST = /^[a-z0-9][a-z0-9.-]*(?::[0-9]{1,5})?$/u;
+const REGISTRY_HOST = /^[a-z0-9][a-z0-9.-]*(?::\d{1,5})?$/u;
 const VISIBILITY = ['public', 'private'];
 
 /** The image registry: host (default ghcr.io) and the visibility the app's packages are meant to have (default public, the canon scaffold writes it and the app owns it afterwards). */
@@ -311,3 +314,17 @@ export function normalizeDeploy(block, { project, probe }) {
   if (block.stack === undefined && !NAME.test(String(project))) c.problem('deploy.stack', `the stack name ${project} must match ${NAME}`);
   return { config: c.problems.length === 0 ? config : null, problems: c.problems };
 }
+
+/**
+ * The component-to-app ties a stack declaration states: every `environments.<env>.deploy.images.<service>` entry with a string
+ * `app`, as `[{ environment, service, app }]`. Read without validating the rest of the block (R294 judges that), so a defect
+ * elsewhere in a deploy block never hides the tie R165 reads.
+ */
+export function deployImageApps(doc) {
+  const ties = [];
+  for (const [environment, spec] of Object.entries(plain(doc?.environments) ? doc.environments : {})) {
+    const block = plain(spec) && plain(spec.deploy) && plain(spec.deploy.images) ? spec.deploy.images : {};
+    for (const [service, entry] of Object.entries(block)) if (plain(entry) && typeof entry.app === 'string') ties.push({ environment, service, app: entry.app });
+  }
+  return ties;
+}

package/runtime/scripts/lib/env.mjs

@@ -15,6 +15,7 @@ export const isSpecRun = (env = process.env) => Boolean(env.NODE_TEST_CONTEXT);
  * would pass red specs from inside a test process. The runner marks the spec files it starts itself, so isSpecRun stays true inside them.
  */
 export function withoutTestRunner(env = process.env) {
-  const { NODE_TEST_CONTEXT: _enclosing, ...rest } = env;
+  const rest = { ...env };
+  delete rest.NODE_TEST_CONTEXT;
   return rest;
 }

package/runtime/scripts/lib/git-hooks-dir.mjs

@@ -0,0 +1,30 @@
+// git-hooks-dir.mjs - whether a checkout's hooks folder holds installed hooks. The one judgement read by `starci npm ci` and
+// `starci npm install` (scripts/machine/npm-hooks.mjs, which runs the app's hook installer when it fails) and by the HFS check
+// HFS_HOOKS_NOT_INSTALLED (scripts/hfs/architecture/hfs.mjs). husky's `.husky/_` is generated per checkout: a linked worktree or
+// an install whose lifecycle scripts were ignored has none, or only the runtime's own wrapped hooks, so git runs no pre-commit gate.
+import fs from 'node:fs';
+import path from 'node:path';
+
+/** husky's generated hooks folder; every hook file in it sources the dispatcher `h`, which runs the tracked `.husky/<hook>`. */
+const HUSKY_GENERATED = /^\.husky\/_\/?$/u;
+const HUSKY_DISPATCHER = 'h';
+
+/**
+ * The state of the hooks folder `hooksPath` (a core.hooksPath value, relative to the checkout `root` or absolute):
+ * `{ state, dir }` with state `installed`, `missing` (no such folder), `empty` (no hook file; for husky's `.husky/_`, no
+ * dispatcher `h`) or `unreadable` (with `error`).
+ */
+export function hooksDirState(root, hooksPath) {
+  const value = String(hooksPath ?? '').trim().replaceAll('\\', '/');
+  const dir = path.resolve(root, value);
+  let entries;
+  try {
+    entries = fs.readdirSync(dir, { withFileTypes: true });
+  } catch (error) {
+    if (error?.code === 'ENOENT' || error?.code === 'ENOTDIR') return { state: 'missing', dir };
+    return { state: 'unreadable', dir, error: String(error?.message ?? error) };
+  }
+  const files = entries.filter((entry) => entry.isFile() && entry.name !== '.gitignore').map((entry) => entry.name);
+  const installed = HUSKY_GENERATED.test(value) ? files.includes(HUSKY_DISPATCHER) : files.length > 0;
+  return { state: installed ? 'installed' : 'empty', dir };
+}

package/runtime/scripts/lib/path-key.mjs

@@ -44,7 +44,7 @@ export const pathsOverlap = (a, b) => sameOrUnder(a, b) || sameOrUnder(b, a);
  * @param {{trim?: boolean, collapse?: boolean, dot?: boolean, glob?: string|null, fold?: boolean}} [options]
  */
 export const normPath = (p, { trim = false, collapse = false, dot = false, glob = null, fold = false } = {}) => {
-  let s = String(p ?? '');
+  let s = p == null ? '' : String(p);
   if (trim) s = s.trim();
   s = slash(s);
   if (collapse) s = s.replace(/\/{2,}/g, '/');

package/runtime/scripts/lib/roots.mjs

@@ -17,10 +17,10 @@
 // directory or from the Work directory name outside this module.
 import fs from 'node:fs';
 import path from 'node:path';
-import { skillRoot, starciLocalRoot, starciSourceRoot } from '../../engine/runtime-root.mjs';
-import { tempRoot } from '../../engine/temp-root.mjs';
+import { skillRoot } from '../../engine/runtime-root.mjs';
 
-export { tempRoot, starciLocalRoot, starciSourceRoot };
+export { tempRoot } from '../../engine/temp-root.mjs';
+export { starciLocalRoot, starciSourceRoot } from '../../engine/runtime-root.mjs';
 
 /** The runtime tree this code runs from. */
 const runtimeTree = skillRoot;

package/runtime/scripts/lib/secret-patterns.mjs

@@ -161,7 +161,7 @@ function readmeBadgeText(text, manifestText) {
     let url;
     try { url = new URL(address); } catch { return image; }
     if (!hosts.has(url.host) || url.username || url.password) return image;
-    const badgePath = url.host === 'codecov.io' ? /\/graph\/badge\.svg$/.test(url.pathname) : url.pathname === '/api/project_badges/measure';
+    const badgePath = url.host === 'codecov.io' ? url.pathname.endsWith('/graph/badge.svg') : url.pathname === '/api/project_badges/measure';
     if (!badgePath) return image;
     const fragment = address.indexOf('#');
     const queryEnd = fragment < 0 ? address.length : fragment;

package/runtime/scripts/lib/swarm-stack.mjs

@@ -4,8 +4,10 @@ import { composeEntries } from './compose-values.mjs';
 import { repositoryOf } from './stack-services.mjs';
 
 const PINNED_IMAGE = /@sha256:[a-f0-9]{64}$/i;
-const VERSIONED_SECRET = /-v[1-9][0-9]*$/;
-const BACKING_IMAGE = /^(?:postgres(?:ql)?|postgresql-repmgr|redis(?:-stack(?:-server)?)?|(?:cp-)?kafka(?:-native)?|keycloak|minio|rabbitmq|mysql(?:-server)?|mongo(?:db)?|mongodb-community-server)$/i;
+const VERSIONED_SECRET = /-v[1-9]\d*$/;
+const BACKING_IMAGE_SQL_AND_CACHE = 'postgres(?:ql)?|postgresql-repmgr|redis(?:-stack(?:-server)?)?|mysql(?:-server)?|mongo(?:db)?|mongodb-community-server';
+const BACKING_IMAGE_BROKERS_AND_OTHERS = '(?:cp-)?kafka(?:-native)?|keycloak|minio|rabbitmq';
+const BACKING_IMAGE = new RegExp(`^(?:${BACKING_IMAGE_SQL_AND_CACHE}|${BACKING_IMAGE_BROKERS_AND_OTHERS})$`, 'i');
 const mapping = value => plain(value) ? value : {};
 const present = value => typeof value === 'string' && Boolean(value.trim());
 const configured = value => Object.keys(mapping(value)).length > 0;

package/src/main.mjs

@@ -28,7 +28,7 @@
 //                                            printSchema(lexicographicSortSchema) of the resolvers the app root composes; no env, no database, no network.
 //   starci app sync (--check | --write) [--cwd <dir>]  the managed files of the root (scripts, husky, CI, .gitignore block, sonar, prettier) and
 //                                            of each side (tsconfig, eslint, jest, stylelint); sync/cli.mjs
-//   starci app hygiene                             the pre-commit guard: staged .starciwork and .starcistacks paths, and the secrets guard over every staged file (read from the index); sync/cli.mjs
+//   starci app hygiene                             the pre-commit guard: staged .starciwork and .starcistacks paths, the secrets guard over every staged file (read from the index) and a new back-end logic file staged without its unit spec; sync/cli.mjs
 //   starci app coverage merge --out <lcov> <lcov-or-dir>...  the lcov reports of the sharded unit run merged into one (coverage/cli.mjs; the managed CI coverage job)
 //   starci app new service <dir> <name> [--inject <Decorator>=<module>:<Type> | <Class>=<module>]... [--cwd <dir>]
 //                                            a back-end `<name>.service.ts` and its `<name>.service.spec.ts` skeleton (scaffold/service.mjs; <dir> is
@@ -390,7 +390,7 @@ async function scaffoldMain(opts, { cwd, edition = 'full', presets, lock, stdout
   const [name, ...extra] = opts.positional;
   if (!name || extra.length) throw new Error('starci app scaffold takes `<name> [--into <dir>] [--edition full|lite] [--registry-visibility public|private]`');
   const { root: created, files } = scaffoldApp({ name, into: path.resolve(cwd, opts.into ?? '.'), edition, presets: presets ?? await scaffoldPresets(), ...(opts['registry-visibility'] === undefined ? {} : { registryVisibility: opts['registry-visibility'] }), ...(lock ? { lock } : {}) });
-  out(`starci app scaffold: created ${created} (${files.length} files); next: npm ci, then starci app lint\n`);
+  out(`starci app scaffold: created ${created} (${files.length} files); next: starci npm ci (the lockfile, then the git hooks through npm run prepare; after a raw npm ci --ignore-scripts run npm run prepare), then starci app lint\n`);
   return 0;
 }