@stardeck-customer-apps/compose 0.11.0 → 0.13.0

package/SKILL.md

@@ -23,6 +23,12 @@ Compose turns that declaration into the code Next.js actually builds:
   kept Module's `enhancements/<excluded>/`. Their source stays on disk but their
   stubs are gone, so `next build` must type-check through this file
   (`typescript.tsconfigPath` in `next.config.ts`), never through `tsconfig.json`.
+  It also skips test-only files (`*.test.ts(x)`, `*.spec.ts(x)`, `__tests__/`,
+  `test-utils/`, `test-helpers.ts`, Module `tests/` and `e2e/` folders, the
+  app's `e2e/`, `tests/`, `scripts/`, and the vitest/playwright configs), which
+  halves a Blueprint's deploy type-check. `npm run typecheck` still covers them
+  through `tsconfig.json`, so keep running it. A skipped file the app does
+  import is still type-checked through that import.
   Gitignore it; do not hand-maintain an exclude list.
 
 ## Running it

package/dist/cli.js

@@ -2249,14 +2249,22 @@ var datastoreRequirementSchema = import_zod.z.object({
   /** Checked against the connected store's accessLevel at install. */
   access: import_zod.z.enum(["read", "write", "admin"]).default("write")
 }).strict();
-var permissionClaimSchema = import_zod.z.object({
+var MODULE_PERMISSION_DEFAULT_ROLES = ["manager", "member", "viewer"];
+var modulePermissionClaimSchema = import_zod.z.object({
   /**
    * Lowercase resource:action with one colon and no underscores. This grammar
    * is deliberately narrower than the platform permission tool's charset.
    */
   key: import_zod.z.string().regex(/^[a-z0-9][a-z0-9-]*:[a-z0-9][a-z0-9-]*$/, "must be a lowercase resource:action key").max(100, "must be at most 100 characters (platform permission tool limit)"),
   /** Human label for the deployment auth config row. */
-  description: descriptionSchema
+  description: descriptionSchema,
+  /**
+   * The default organization roles that hold this key when the platform
+   * first registers it on an app (a Blueprint fork, a Module install). Admin
+   * holds every key without being listed; External Viewer never holds one.
+   * Changing a role's grants afterwards is the organization's business.
+   */
+  roles: import_zod.z.array(import_zod.z.enum(MODULE_PERMISSION_DEFAULT_ROLES)).optional()
 }).strict();
 var seedBundleSchema = import_zod.z.object({
   table: tableNameSchema,
@@ -2339,7 +2347,7 @@ var moduleManifestSchema = import_zod.z.object({
    * Keys this module's guards enforce. Install registers them in deployment
    * auth config; registration only — declaring is never granting.
    */
-  permissions: import_zod.z.array(permissionClaimSchema).optional(),
+  permissions: import_zod.z.array(modulePermissionClaimSchema).optional(),
   /**
    * Optional starter rows for tables this module owns. Replay is
    * `INSERT ... ON CONFLICT (conflictTarget) DO NOTHING` — idempotent by
@@ -3961,11 +3969,18 @@ ${result.error}`);
 }
 
 // ../../packages/lib/src/server/sandbox/redact-secrets.ts
+var SECRET_NAME = String.raw`[A-Z][A-Z0-9_]*(?:_SECRET|_SECRET_KEY|_API_KEY|_KEY|_TOKEN|_PASSWORD)`;
+var SECRET_ASSIGNMENT = new RegExp(
+  String.raw`\b(${SECRET_NAME})\s*=\s*(?:'(?:[^']|'\\'')*'|"[^"]*"|[^\s&"',;}\]]+)`,
+  "g"
+);
+var JSON_SECRET_PAIR = new RegExp(
+  String.raw`"(${SECRET_NAME})"(\s*:\s*)"(?:[^"\\\n]|\\.)*"`,
+  "g"
+);
+var SECRET_QUOTE_OPENER = new RegExp(String.raw`\b${SECRET_NAME}\s*=\s*(['"])`, "g");
 function redactSecrets(text) {
-  return text.replace(/x-access-token:[^@\s]+@/g, "x-access-token:***@").replace(/https:\/\/(?!x-access-token:)[^/\s:@]+:[^/\s@]+@/gi, "https://***:***@").replace(/\b(gh[pousr]_)[A-Za-z0-9]+/g, "$1***").replace(/\b(github_pat_)[A-Za-z0-9_]+/g, "$1***").replace(/\b(postgres(?:ql)?:\/\/)([^:\s/@]+):([^@\s/]+)@/gi, "$1$2:***@").replace(/\b(npm_[A-Za-z0-9]+)/g, "npm_***").replace(/(_authToken=)([^\s&]+)/gi, "$1***").replace(
-    /\b([A-Z][A-Z0-9_]*(?:_SECRET|_SECRET_KEY|_API_KEY|_KEY|_TOKEN|_PASSWORD))\s*=\s*(?:'(?:[^']|'\\'')*'|"[^"]*"|[^\s&"',;}\]]+)/g,
-    "$1=***"
-  ).replace(/\b(Authorization:\s*(?:Bearer|Basic)\s+)\S+/gi, "$1***");
+  return text.replace(/x-access-token:[^@\s]+@/g, "x-access-token:***@").replace(/https:\/\/(?!x-access-token:)[^/\s:@]+:[^/\s@]+@/gi, "https://***:***@").replace(/\b(gh[pousr]_)[A-Za-z0-9]+/g, "$1***").replace(/\b(github_pat_)[A-Za-z0-9_]+/g, "$1***").replace(/\b(postgres(?:ql)?:\/\/)([^:\s/@]+):([^@\s/]+)@/gi, "$1$2:***@").replace(/\b(npm_[A-Za-z0-9]+)/g, "npm_***").replace(/(_authToken=)([^\s&]+)/gi, "$1***").replace(SECRET_ASSIGNMENT, "$1=***").replace(JSON_SECRET_PAIR, '"$1"$2"***"').replace(/\b(Authorization:\s*(?:Bearer|Basic)\s+)\S+/gi, "$1***");
 }
 
 // ../../packages/lib/src/server/sandbox/sh-quote.ts
@@ -5945,11 +5960,10 @@ var creationSourceBlueprintSchema = import_zod7.z.object({
    * `null`/absent means every feature Module: the platform stores that as the
    * explicit list of feature Modules in the published Blueprint version the fork
    * is cut from, so a Module a later Blueprint update adds arrives off. `[]` is
-   * refused: the platform serialises it to an empty
-   * `NEXT_PUBLIC_STARDECK_ENABLED_MODULES`, which the enablement parser reads
-   * back as "all" (`module-enablement.ts`) — the opposite of an empty selection.
+   * a custom app: no feature Module, Library Modules only (`resolvePlatformEnv`
+   * emits it as a set value naming no Module).
    */
-  enabledModules: import_zod7.z.array(moduleNameSchema).min(1, "Enable at least one Module").max(100).nullable().optional()
+  enabledModules: import_zod7.z.array(moduleNameSchema).max(100).nullable().optional()
 });
 var creationSourceSchema = import_zod7.z.discriminatedUnion("type", [
   creationSourceBlankSchema,
@@ -7716,6 +7730,24 @@ function assertNoAppLayerImporters(cwd, excluded) {
 var TSCONFIG_PATH = "apps/web/tsconfig.json";
 var BUILD_TSCONFIG_PATH = "apps/web/tsconfig.build.gen.json";
 var BUILD_TSCONFIG_HEADER = "// Generated by stardeck-compose \u2014 the tsconfig `next build` type-checks. Do not edit or commit.";
+var BUILD_TYPECHECK_SKIP = [
+  "**/*.test.ts",
+  "**/*.test.tsx",
+  "**/*.spec.ts",
+  "**/*.spec.tsx",
+  "**/__tests__",
+  "**/test-utils",
+  "**/test-helpers.ts",
+  // Module test suites, including those inside enhancement slices.
+  "src/modules/**/tests",
+  "src/modules/**/e2e",
+  "e2e",
+  "tests",
+  "scripts",
+  "vitest.config.ts",
+  "vitest.setup.ts",
+  "playwright.config.ts"
+];
 function writeBuildTsconfig(cwd, excluded) {
   const baseFile = import_node_path3.default.join(cwd, TSCONFIG_PATH);
   if (!import_node_fs3.default.existsSync(import_node_path3.default.join(cwd, MODULES_DIR2)) || !import_node_fs3.default.existsSync(baseFile)) return;
@@ -7731,6 +7763,7 @@ function writeBuildTsconfig(cwd, excluded) {
     extends: "./tsconfig.json",
     exclude: [
       ...baseExclude,
+      ...BUILD_TYPECHECK_SKIP,
       ...excluded.flatMap((name) => [
         `${modulesDir}/${name}`,
         `${modulesDir}/*/enhancements/${name}`

package/dist/index.js

@@ -2087,11 +2087,18 @@ ${result.error}`);
 }
 
 // ../../packages/lib/src/server/sandbox/redact-secrets.ts
+var SECRET_NAME = String.raw`[A-Z][A-Z0-9_]*(?:_SECRET|_SECRET_KEY|_API_KEY|_KEY|_TOKEN|_PASSWORD)`;
+var SECRET_ASSIGNMENT = new RegExp(
+  String.raw`\b(${SECRET_NAME})\s*=\s*(?:'(?:[^']|'\\'')*'|"[^"]*"|[^\s&"',;}\]]+)`,
+  "g"
+);
+var JSON_SECRET_PAIR = new RegExp(
+  String.raw`"(${SECRET_NAME})"(\s*:\s*)"(?:[^"\\\n]|\\.)*"`,
+  "g"
+);
+var SECRET_QUOTE_OPENER = new RegExp(String.raw`\b${SECRET_NAME}\s*=\s*(['"])`, "g");
 function redactSecrets(text) {
-  return text.replace(/x-access-token:[^@\s]+@/g, "x-access-token:***@").replace(/https:\/\/(?!x-access-token:)[^/\s:@]+:[^/\s@]+@/gi, "https://***:***@").replace(/\b(gh[pousr]_)[A-Za-z0-9]+/g, "$1***").replace(/\b(github_pat_)[A-Za-z0-9_]+/g, "$1***").replace(/\b(postgres(?:ql)?:\/\/)([^:\s/@]+):([^@\s/]+)@/gi, "$1$2:***@").replace(/\b(npm_[A-Za-z0-9]+)/g, "npm_***").replace(/(_authToken=)([^\s&]+)/gi, "$1***").replace(
-    /\b([A-Z][A-Z0-9_]*(?:_SECRET|_SECRET_KEY|_API_KEY|_KEY|_TOKEN|_PASSWORD))\s*=\s*(?:'(?:[^']|'\\'')*'|"[^"]*"|[^\s&"',;}\]]+)/g,
-    "$1=***"
-  ).replace(/\b(Authorization:\s*(?:Bearer|Basic)\s+)\S+/gi, "$1***");
+  return text.replace(/x-access-token:[^@\s]+@/g, "x-access-token:***@").replace(/https:\/\/(?!x-access-token:)[^/\s:@]+:[^/\s@]+@/gi, "https://***:***@").replace(/\b(gh[pousr]_)[A-Za-z0-9]+/g, "$1***").replace(/\b(github_pat_)[A-Za-z0-9_]+/g, "$1***").replace(/\b(postgres(?:ql)?:\/\/)([^:\s/@]+):([^@\s/]+)@/gi, "$1$2:***@").replace(/\b(npm_[A-Za-z0-9]+)/g, "npm_***").replace(/(_authToken=)([^\s&]+)/gi, "$1***").replace(SECRET_ASSIGNMENT, "$1=***").replace(JSON_SECRET_PAIR, '"$1"$2"***"').replace(/\b(Authorization:\s*(?:Bearer|Basic)\s+)\S+/gi, "$1***");
 }
 
 // ../../packages/lib/src/server/sandbox/sh-quote.ts
@@ -2371,14 +2378,22 @@ var datastoreRequirementSchema = import_zod2.z.object({
   /** Checked against the connected store's accessLevel at install. */
   access: import_zod2.z.enum(["read", "write", "admin"]).default("write")
 }).strict();
-var permissionClaimSchema = import_zod2.z.object({
+var MODULE_PERMISSION_DEFAULT_ROLES = ["manager", "member", "viewer"];
+var modulePermissionClaimSchema = import_zod2.z.object({
   /**
    * Lowercase resource:action with one colon and no underscores. This grammar
    * is deliberately narrower than the platform permission tool's charset.
    */
   key: import_zod2.z.string().regex(/^[a-z0-9][a-z0-9-]*:[a-z0-9][a-z0-9-]*$/, "must be a lowercase resource:action key").max(100, "must be at most 100 characters (platform permission tool limit)"),
   /** Human label for the deployment auth config row. */
-  description: descriptionSchema
+  description: descriptionSchema,
+  /**
+   * The default organization roles that hold this key when the platform
+   * first registers it on an app (a Blueprint fork, a Module install). Admin
+   * holds every key without being listed; External Viewer never holds one.
+   * Changing a role's grants afterwards is the organization's business.
+   */
+  roles: import_zod2.z.array(import_zod2.z.enum(MODULE_PERMISSION_DEFAULT_ROLES)).optional()
 }).strict();
 var seedBundleSchema = import_zod2.z.object({
   table: tableNameSchema,
@@ -2461,7 +2476,7 @@ var moduleManifestSchema = import_zod2.z.object({
    * Keys this module's guards enforce. Install registers them in deployment
    * auth config; registration only — declaring is never granting.
    */
-  permissions: import_zod2.z.array(permissionClaimSchema).optional(),
+  permissions: import_zod2.z.array(modulePermissionClaimSchema).optional(),
   /**
    * Optional starter rows for tables this module owns. Replay is
    * `INSERT ... ON CONFLICT (conflictTarget) DO NOTHING` — idempotent by
@@ -5955,11 +5970,10 @@ var creationSourceBlueprintSchema = import_zod7.z.object({
    * `null`/absent means every feature Module: the platform stores that as the
    * explicit list of feature Modules in the published Blueprint version the fork
    * is cut from, so a Module a later Blueprint update adds arrives off. `[]` is
-   * refused: the platform serialises it to an empty
-   * `NEXT_PUBLIC_STARDECK_ENABLED_MODULES`, which the enablement parser reads
-   * back as "all" (`module-enablement.ts`) — the opposite of an empty selection.
+   * a custom app: no feature Module, Library Modules only (`resolvePlatformEnv`
+   * emits it as a set value naming no Module).
    */
-  enabledModules: import_zod7.z.array(moduleNameSchema).min(1, "Enable at least one Module").max(100).nullable().optional()
+  enabledModules: import_zod7.z.array(moduleNameSchema).max(100).nullable().optional()
 });
 var creationSourceSchema = import_zod7.z.discriminatedUnion("type", [
   creationSourceBlankSchema,
@@ -7726,6 +7740,24 @@ function assertNoAppLayerImporters(cwd, excluded) {
 var TSCONFIG_PATH = "apps/web/tsconfig.json";
 var BUILD_TSCONFIG_PATH = "apps/web/tsconfig.build.gen.json";
 var BUILD_TSCONFIG_HEADER = "// Generated by stardeck-compose \u2014 the tsconfig `next build` type-checks. Do not edit or commit.";
+var BUILD_TYPECHECK_SKIP = [
+  "**/*.test.ts",
+  "**/*.test.tsx",
+  "**/*.spec.ts",
+  "**/*.spec.tsx",
+  "**/__tests__",
+  "**/test-utils",
+  "**/test-helpers.ts",
+  // Module test suites, including those inside enhancement slices.
+  "src/modules/**/tests",
+  "src/modules/**/e2e",
+  "e2e",
+  "tests",
+  "scripts",
+  "vitest.config.ts",
+  "vitest.setup.ts",
+  "playwright.config.ts"
+];
 function writeBuildTsconfig(cwd, excluded) {
   const baseFile = import_node_path3.default.join(cwd, TSCONFIG_PATH);
   if (!import_node_fs3.default.existsSync(import_node_path3.default.join(cwd, MODULES_DIR2)) || !import_node_fs3.default.existsSync(baseFile)) return;
@@ -7741,6 +7773,7 @@ function writeBuildTsconfig(cwd, excluded) {
     extends: "./tsconfig.json",
     exclude: [
       ...baseExclude,
+      ...BUILD_TYPECHECK_SKIP,
       ...excluded.flatMap((name) => [
         `${modulesDir}/${name}`,
         `${modulesDir}/*/enhancements/${name}`

package/dist/index.mjs

@@ -2068,11 +2068,18 @@ ${result.error}`);
 }
 
 // ../../packages/lib/src/server/sandbox/redact-secrets.ts
+var SECRET_NAME = String.raw`[A-Z][A-Z0-9_]*(?:_SECRET|_SECRET_KEY|_API_KEY|_KEY|_TOKEN|_PASSWORD)`;
+var SECRET_ASSIGNMENT = new RegExp(
+  String.raw`\b(${SECRET_NAME})\s*=\s*(?:'(?:[^']|'\\'')*'|"[^"]*"|[^\s&"',;}\]]+)`,
+  "g"
+);
+var JSON_SECRET_PAIR = new RegExp(
+  String.raw`"(${SECRET_NAME})"(\s*:\s*)"(?:[^"\\\n]|\\.)*"`,
+  "g"
+);
+var SECRET_QUOTE_OPENER = new RegExp(String.raw`\b${SECRET_NAME}\s*=\s*(['"])`, "g");
 function redactSecrets(text) {
-  return text.replace(/x-access-token:[^@\s]+@/g, "x-access-token:***@").replace(/https:\/\/(?!x-access-token:)[^/\s:@]+:[^/\s@]+@/gi, "https://***:***@").replace(/\b(gh[pousr]_)[A-Za-z0-9]+/g, "$1***").replace(/\b(github_pat_)[A-Za-z0-9_]+/g, "$1***").replace(/\b(postgres(?:ql)?:\/\/)([^:\s/@]+):([^@\s/]+)@/gi, "$1$2:***@").replace(/\b(npm_[A-Za-z0-9]+)/g, "npm_***").replace(/(_authToken=)([^\s&]+)/gi, "$1***").replace(
-    /\b([A-Z][A-Z0-9_]*(?:_SECRET|_SECRET_KEY|_API_KEY|_KEY|_TOKEN|_PASSWORD))\s*=\s*(?:'(?:[^']|'\\'')*'|"[^"]*"|[^\s&"',;}\]]+)/g,
-    "$1=***"
-  ).replace(/\b(Authorization:\s*(?:Bearer|Basic)\s+)\S+/gi, "$1***");
+  return text.replace(/x-access-token:[^@\s]+@/g, "x-access-token:***@").replace(/https:\/\/(?!x-access-token:)[^/\s:@]+:[^/\s@]+@/gi, "https://***:***@").replace(/\b(gh[pousr]_)[A-Za-z0-9]+/g, "$1***").replace(/\b(github_pat_)[A-Za-z0-9_]+/g, "$1***").replace(/\b(postgres(?:ql)?:\/\/)([^:\s/@]+):([^@\s/]+)@/gi, "$1$2:***@").replace(/\b(npm_[A-Za-z0-9]+)/g, "npm_***").replace(/(_authToken=)([^\s&]+)/gi, "$1***").replace(SECRET_ASSIGNMENT, "$1=***").replace(JSON_SECRET_PAIR, '"$1"$2"***"').replace(/\b(Authorization:\s*(?:Bearer|Basic)\s+)\S+/gi, "$1***");
 }
 
 // ../../packages/lib/src/server/sandbox/sh-quote.ts
@@ -2352,14 +2359,22 @@ var datastoreRequirementSchema = z2.object({
   /** Checked against the connected store's accessLevel at install. */
   access: z2.enum(["read", "write", "admin"]).default("write")
 }).strict();
-var permissionClaimSchema = z2.object({
+var MODULE_PERMISSION_DEFAULT_ROLES = ["manager", "member", "viewer"];
+var modulePermissionClaimSchema = z2.object({
   /**
    * Lowercase resource:action with one colon and no underscores. This grammar
    * is deliberately narrower than the platform permission tool's charset.
    */
   key: z2.string().regex(/^[a-z0-9][a-z0-9-]*:[a-z0-9][a-z0-9-]*$/, "must be a lowercase resource:action key").max(100, "must be at most 100 characters (platform permission tool limit)"),
   /** Human label for the deployment auth config row. */
-  description: descriptionSchema
+  description: descriptionSchema,
+  /**
+   * The default organization roles that hold this key when the platform
+   * first registers it on an app (a Blueprint fork, a Module install). Admin
+   * holds every key without being listed; External Viewer never holds one.
+   * Changing a role's grants afterwards is the organization's business.
+   */
+  roles: z2.array(z2.enum(MODULE_PERMISSION_DEFAULT_ROLES)).optional()
 }).strict();
 var seedBundleSchema = z2.object({
   table: tableNameSchema,
@@ -2442,7 +2457,7 @@ var moduleManifestSchema = z2.object({
    * Keys this module's guards enforce. Install registers them in deployment
    * auth config; registration only — declaring is never granting.
    */
-  permissions: z2.array(permissionClaimSchema).optional(),
+  permissions: z2.array(modulePermissionClaimSchema).optional(),
   /**
    * Optional starter rows for tables this module owns. Replay is
    * `INSERT ... ON CONFLICT (conflictTarget) DO NOTHING` — idempotent by
@@ -5936,11 +5951,10 @@ var creationSourceBlueprintSchema = z7.object({
    * `null`/absent means every feature Module: the platform stores that as the
    * explicit list of feature Modules in the published Blueprint version the fork
    * is cut from, so a Module a later Blueprint update adds arrives off. `[]` is
-   * refused: the platform serialises it to an empty
-   * `NEXT_PUBLIC_STARDECK_ENABLED_MODULES`, which the enablement parser reads
-   * back as "all" (`module-enablement.ts`) — the opposite of an empty selection.
+   * a custom app: no feature Module, Library Modules only (`resolvePlatformEnv`
+   * emits it as a set value naming no Module).
    */
-  enabledModules: z7.array(moduleNameSchema).min(1, "Enable at least one Module").max(100).nullable().optional()
+  enabledModules: z7.array(moduleNameSchema).max(100).nullable().optional()
 });
 var creationSourceSchema = z7.discriminatedUnion("type", [
   creationSourceBlankSchema,
@@ -7707,6 +7721,24 @@ function assertNoAppLayerImporters(cwd, excluded) {
 var TSCONFIG_PATH = "apps/web/tsconfig.json";
 var BUILD_TSCONFIG_PATH = "apps/web/tsconfig.build.gen.json";
 var BUILD_TSCONFIG_HEADER = "// Generated by stardeck-compose \u2014 the tsconfig `next build` type-checks. Do not edit or commit.";
+var BUILD_TYPECHECK_SKIP = [
+  "**/*.test.ts",
+  "**/*.test.tsx",
+  "**/*.spec.ts",
+  "**/*.spec.tsx",
+  "**/__tests__",
+  "**/test-utils",
+  "**/test-helpers.ts",
+  // Module test suites, including those inside enhancement slices.
+  "src/modules/**/tests",
+  "src/modules/**/e2e",
+  "e2e",
+  "tests",
+  "scripts",
+  "vitest.config.ts",
+  "vitest.setup.ts",
+  "playwright.config.ts"
+];
 function writeBuildTsconfig(cwd, excluded) {
   const baseFile = path3.join(cwd, TSCONFIG_PATH);
   if (!fs3.existsSync(path3.join(cwd, MODULES_DIR2)) || !fs3.existsSync(baseFile)) return;
@@ -7722,6 +7754,7 @@ function writeBuildTsconfig(cwd, excluded) {
     extends: "./tsconfig.json",
     exclude: [
       ...baseExclude,
+      ...BUILD_TYPECHECK_SKIP,
       ...excluded.flatMap((name) => [
         `${modulesDir}/${name}`,
         `${modulesDir}/*/enhancements/${name}`

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@stardeck-customer-apps/compose",
-  "version": "0.11.0",
+  "version": "0.13.0",
   "description": "Regenerates a Stardeck app's Module-rail artifacts — the six src/*.gen.ts registries and every route/endpoint stub — from src/modules/*/module.json",
   "main": "dist/index.js",
   "module": "dist/index.mjs",
@@ -34,7 +34,7 @@
     "build": "rm -rf dist && tsup",
     "dev": "tsup --watch",
     "format": "prettier --write . && oxlint . --fix",
-    "typecheck": "tsc -p tsconfig.test.json",
+    "typecheck": "tsgo -p tsconfig.test.json",
     "lint": "oxlint src/",
     "test": "vitest run",
     "test:watch": "vitest"