monecromanci 0.0.0

package/dist/assets/build-templates/lib/nx.mjs

@@ -0,0 +1,254 @@
+#!/usr/bin/env node
+
+/**
+ * Nx and git helpers used to resolve the affected project set.
+ *
+ * Nx is always invoked through the locally installed binary
+ * (`node_modules/.bin/nx`) so the workspace's pinned Nx version computes the
+ * project graph. `npx --yes` is intentionally avoided because it can download a
+ * different Nx version and produces an unreliable graph when run before install.
+ */
+
+import { existsSync } from 'node:fs'
+import path from 'node:path'
+import process from 'node:process'
+import { isWindows, log, run, runInherit, runSafe, shellEscape, warn } from './_h.mjs'
+
+const WORKSPACE_ROOT = process.cwd()
+
+/**
+ * Resolves the locally installed Nx binary path.
+ *
+ * @returns {string | null} Returns the Nx binary path, or null when missing.
+ */
+export function resolveLocalNxBin () {
+  const binaryName = isWindows() ? 'nx.cmd' : 'nx'
+  const binaryPath = path.join(WORKSPACE_ROOT, 'node_modules', '.bin', binaryName)
+
+  return existsSync(binaryPath) ? binaryPath : null
+}
+
+/**
+ * Builds the Nx command prefix, preferring the local binary.
+ *
+ * @returns {string} Returns the Nx invocation prefix.
+ */
+function getNxCommandPrefix () {
+  const localBin = resolveLocalNxBin()
+
+  if (localBin) {
+    return shellEscape(localBin)
+  }
+
+  warn('Local Nx binary not found in node_modules/.bin. Falling back to "npx nx". Run "npm ci" first for reliable results.')
+
+  return 'npx nx'
+}
+
+/**
+ * Runs an Nx command and returns trimmed stdout.
+ *
+ * @param {string} args The Nx command arguments.
+ * @returns {string} Returns trimmed command output.
+ */
+export function runNx (args) {
+  return run(`${getNxCommandPrefix()} ${args}`, { cwd: WORKSPACE_ROOT })
+}
+
+/**
+ * Runs an Nx command, returning an empty string on failure.
+ *
+ * @param {string} args The Nx command arguments.
+ * @returns {string} Returns trimmed output or an empty string.
+ */
+export function runNxSafe (args) {
+  return runSafe(`${getNxCommandPrefix()} ${args}`, { cwd: WORKSPACE_ROOT })
+}
+
+/**
+ * Runs an Nx command while streaming output live (used for builds).
+ *
+ * @param {string} args The Nx command arguments.
+ */
+export function runNxInherit (args) {
+  runInherit(`${getNxCommandPrefix()} ${args}`, { cwd: WORKSPACE_ROOT })
+}
+
+/**
+ * Parses an Nx project list from raw command output.
+ *
+ * Tolerates the Nx banner/warning text that can precede the JSON array, and
+ * falls back to line parsing when JSON is unavailable.
+ *
+ * @param {string} output The raw command output.
+ * @returns {string[]} Returns parsed project names.
+ */
+export function parseProjectList (output) {
+  if (!output) {
+    return []
+  }
+
+  const trimmed = output.trim()
+
+  try {
+    const parsed = JSON.parse(trimmed)
+    if (Array.isArray(parsed)) {
+      return parsed.map(String)
+    }
+  } catch {
+    // Falls through — Nx may have prepended banner text before the JSON array.
+  }
+
+  const jsonMatch = trimmed.match(/\[[\s\S]*\]/)
+  if (jsonMatch) {
+    try {
+      const parsed = JSON.parse(jsonMatch[0])
+      if (Array.isArray(parsed)) {
+        return parsed.map(String)
+      }
+    } catch {
+      // Falls through to line parsing.
+    }
+  }
+
+  return trimmed
+    .split('\n')
+    .map(line => line.trim())
+    .filter(Boolean)
+    .filter(line => !line.startsWith('>'))
+    .filter(line => /^[\w-]/.test(line))
+}
+
+/**
+ * Resolves all Nx project names in the workspace.
+ *
+ * @returns {string[]} Returns all project names.
+ */
+export function resolveAllProjects () {
+  const jsonProjects = parseProjectList(runNxSafe('show projects --json'))
+  if (jsonProjects.length > 0) {
+    return jsonProjects
+  }
+
+  return parseProjectList(runNxSafe('show projects'))
+}
+
+/**
+ * Resolves the affected Nx project names between two commits.
+ *
+ * @param {string} baseCommit The base commit SHA.
+ * @param {string} headCommit The head commit SHA.
+ * @returns {string[]} Returns affected project names.
+ */
+export function resolveAffectedProjects (baseCommit, headCommit) {
+  const range = `--base=${shellEscape(baseCommit)} --head=${shellEscape(headCommit)}`
+
+  const jsonOutput = runNxSafe(`show projects --affected ${range} --json`)
+  const jsonProjects = parseProjectList(jsonOutput)
+  if (jsonProjects.length > 0) {
+    return jsonProjects
+  }
+
+  log('[affected] JSON output empty — retrying without --json')
+
+  return parseProjectList(runNxSafe(`show projects --affected ${range}`))
+}
+
+/**
+ * Resolves Nx metadata for a single project.
+ *
+ * @param {string} projectName The Nx project name.
+ * @returns {Record<string, any> | null} Returns project metadata or null.
+ */
+export function resolveProjectMetadata (projectName) {
+  const output = runNxSafe(`show project ${shellEscape(projectName)} --json`)
+  if (!output) {
+    return null
+  }
+
+  try {
+    return JSON.parse(output)
+  } catch {
+    return null
+  }
+}
+
+/**
+ * Extracts a branch name from an Azure ref string.
+ *
+ * @param {string | undefined} reference The branch reference.
+ * @returns {string} Returns the branch name.
+ */
+export function getBranchNameFromRef (reference) {
+  if (!reference) {
+    return ''
+  }
+
+  return reference.replace(/^refs\/heads\//, '')
+}
+
+/**
+ * Resolves the effective branch name used for build planning.
+ *
+ * @returns {string} Returns the effective branch name.
+ */
+export function resolveEffectiveBranchName () {
+  const isPullRequest = String(process.env.BUILD_REASON).toLowerCase() === 'pullrequest'
+
+  if (isPullRequest) {
+    return getBranchNameFromRef(process.env.SYSTEM_PULLREQUEST_TARGETBRANCH)
+  }
+
+  return process.env.BUILD_SOURCEBRANCHNAME || runSafe('git rev-parse --abbrev-ref HEAD')
+}
+
+/**
+ * Resolves the current HEAD commit used by Nx affected.
+ *
+ * @returns {string} Returns the HEAD commit SHA.
+ */
+export function resolveHeadCommit () {
+  return process.env.BUILD_SOURCEVERSION || run('git rev-parse HEAD')
+}
+
+/**
+ * Resolves the base commit used by Nx affected.
+ *
+ * Uses `~1` rather than `^` so the command never contains a caret, which the
+ * Windows command shell treats as an escape character.
+ *
+ * @param {string} headCommit The resolved head commit SHA.
+ * @returns {string} Returns the base commit SHA.
+ */
+export function resolveBaseCommit (headCommit) {
+  const isPullRequest = String(process.env.BUILD_REASON).toLowerCase() === 'pullrequest'
+  log(`[base] BUILD_REASON=${process.env.BUILD_REASON || '(none)'}, isPR=${isPullRequest}`)
+
+  if (isPullRequest) {
+    const targetBranchName = getBranchNameFromRef(process.env.SYSTEM_PULLREQUEST_TARGETBRANCH)
+    const remoteBranch = targetBranchName ? `origin/${targetBranchName}` : ''
+    log(`[base] PR target branch: ${remoteBranch || '(unknown)'}`)
+
+    const mergeBase = remoteBranch
+      ? runSafe(`git merge-base ${shellEscape(headCommit)} ${shellEscape(remoteBranch)}`)
+      : ''
+
+    if (mergeBase) {
+      log(`[base] Resolved via merge-base: ${mergeBase}`)
+      return mergeBase
+    }
+
+    warn('[base] merge-base failed — falling back to parent commit')
+  }
+
+  const parentCommit = runSafe(`git rev-parse ${shellEscape(`${headCommit}~1`)}`)
+  if (parentCommit && parentCommit !== headCommit) {
+    log(`[base] Resolved via parent commit: ${parentCommit}`)
+    return parentCommit
+  }
+
+  const initialCommit = runSafe(`git rev-list --max-parents=0 ${shellEscape(headCommit)}`).split('\n')[0]
+  log(`[base] Resolved via initial commit: ${initialCommit || '(none)'}`)
+
+  return initialCommit
+}

package/dist/assets/eslint.config.mjs

@@ -0,0 +1,306 @@
+// Centralised ESLint flat config — generated by MoNecromanCI. Re-sync with 'monecromanci doctor'.
+// Standard style (no semicolons) is hand-ported from neostandard (which has no ESLint 10
+// release — peer pinned to ^9.0.0) onto @stylistic/eslint-plugin + typescript-eslint directly,
+// plus unicorn, React, Jest, JSON/JSONC/JSON5, YAML, Markdown and TSDoc enforcement.
+// NON type-checked on purpose (fast on large codebases).
+import markdown from '@eslint/markdown'
+import stylistic from '@stylistic/eslint-plugin'
+import pluginJest from 'eslint-plugin-jest'
+import jsonc from 'eslint-plugin-jsonc'
+import n from 'eslint-plugin-n'
+import promise from 'eslint-plugin-promise'
+import react from 'eslint-plugin-react'
+import reactHooks from 'eslint-plugin-react-hooks'
+import reactRefresh from 'eslint-plugin-react-refresh'
+import tsdoc from 'eslint-plugin-tsdoc'
+import tsdocRequire from 'eslint-plugin-tsdoc-require-2'
+import unicorn from 'eslint-plugin-unicorn'
+import unusedImports from 'eslint-plugin-unused-imports'
+import yaml from 'eslint-plugin-yml'
+import globalsConfig from 'globals'
+import tseslint from 'typescript-eslint'
+
+const code = ['**/*.{ts,mts,cts}', '**/*.{tsx,mtsx,ctsx}', '**/*.{js,mjs,cjs}', '**/*.{jsx,mjsx,cjsx}']
+const tsx = ['**/*.{tsx,mtsx,ctsx}', '**/*.{jsx,mjsx,cjsx}']
+const tsSource = ['**/*.{ts,mts,cts}', '**/*.{tsx,mtsx,ctsx}']
+const tests = [
+  '**/*.{test,spec}.{ts,mts,cts}',
+  '**/*.{test,spec}.{tsx,mtsx,ctsx}',
+  '**/*.{test,spec}.{js,mjs,cjs}',
+  '**/*.{test,spec}.{jsx,mjsx,cjsx}',
+]
+
+// Core ESLint rules + the n/promise rules neostandard enables on top — transcribed
+// verbatim from neostandard's lib/configs/base.js, since neostandard itself has no
+// ESLint-10-compatible release (peer pinned to ^9.0.0, no newer build exists).
+const standardRules = {
+  'no-var':           'warn',
+  'object-shorthand': ['warn', 'properties'],
+
+  'accessor-pairs':            ['error', { setWithoutGet: true, enforceForClassMembers: true }],
+  'array-callback-return':     ['error', { allowImplicit: false, checkForEach: false }],
+  camelcase:                   ['error', { allow: ['^UNSAFE_'], properties: 'never', ignoreGlobals: true }],
+  'constructor-super':         'error',
+  curly:                       ['error', 'multi-line'],
+  'default-case-last':         'error',
+  'dot-notation':              ['error', { allowKeywords: true }],
+  eqeqeq:                      ['error', 'always', { null: 'ignore' }],
+  'new-cap':                   ['error', { newIsCap: true, capIsNew: false, properties: true }],
+  'no-array-constructor':      'error',
+  'no-async-promise-executor': 'error',
+  'no-caller':                 'error',
+  'no-case-declarations':      'error',
+  'no-class-assign':           'error',
+  'no-compare-neg-zero':       'error',
+  'no-cond-assign':            'error',
+  'no-const-assign':           'error',
+  'no-constant-condition':     ['error', { checkLoops: false }],
+  'no-control-regex':          'error',
+  'no-debugger':                'error',
+  'no-delete-var':              'error',
+  'no-dupe-args':                'error',
+  'no-dupe-class-members':       'error',
+  'no-dupe-keys':                'error',
+  'no-duplicate-case':           'error',
+  'no-useless-backreference':    'error',
+  'no-empty':                    ['error', { allowEmptyCatch: true }],
+  'no-empty-character-class':    'error',
+  'no-empty-pattern':            'error',
+  'no-eval':                     'error',
+  'no-ex-assign':                'error',
+  'no-extend-native':            'error',
+  'no-extra-bind':               'error',
+  'no-extra-boolean-cast':       'error',
+  'no-fallthrough':              'error',
+  'no-func-assign':              'error',
+  'no-global-assign':            'error',
+  'no-implied-eval':             'error',
+  'no-import-assign':            'error',
+  'no-invalid-regexp':           'error',
+  'no-irregular-whitespace':     'error',
+  'no-iterator':                 'error',
+  'no-labels':                   ['error', { allowLoop: false, allowSwitch: false }],
+  'no-lone-blocks':              'error',
+  'no-loss-of-precision':        'error',
+  'no-misleading-character-class': 'error',
+  'no-prototype-builtins':         'error',
+  'no-useless-catch':              'error',
+  'no-multi-str':                  'error',
+  'no-new':                        'error',
+  'no-new-func':                   'error',
+  'no-object-constructor':         'error',
+  'no-new-native-nonconstructor':  'error',
+  'no-new-wrappers':               'error',
+  'no-obj-calls':                  'error',
+  'no-octal':                      'error',
+  'no-octal-escape':               'error',
+  'no-proto':                      'error',
+  'no-redeclare':                  ['error', { builtinGlobals: false }],
+  'no-regex-spaces':               'error',
+  'no-return-assign':              ['error', 'except-parens'],
+  'no-self-assign':                ['error', { props: true }],
+  'no-self-compare':               'error',
+  'no-sequences':                  'error',
+  'no-shadow-restricted-names':    'error',
+  'no-sparse-arrays':              'error',
+  'no-template-curly-in-string':   'error',
+  'no-this-before-super':          'error',
+  'no-throw-literal':              'error',
+  'no-undef':                      'error',
+  'no-undef-init':                 'error',
+  'no-unexpected-multiline':       'error',
+  'no-unmodified-loop-condition':  'error',
+  'no-unneeded-ternary':           ['error', { defaultAssignment: false }],
+  'no-unreachable':                'error',
+  'no-unreachable-loop':           'error',
+  'no-unsafe-finally':             'error',
+  'no-unsafe-negation':            'error',
+  'no-unused-expressions':         ['error', { allowShortCircuit: true, allowTernary: true, allowTaggedTemplates: true }],
+  'no-unused-vars':                ['error', { args: 'none', caughtErrors: 'none', ignoreRestSiblings: true, vars: 'all' }],
+  'no-use-before-define':          ['error', { functions: false, classes: false, variables: false }],
+  'no-useless-call':               'error',
+  'no-useless-computed-key':       'error',
+  'no-useless-constructor':        'error',
+  'no-useless-escape':             'error',
+  'no-useless-rename':             'error',
+  'no-useless-return':             'error',
+  'no-void':                       'error',
+  'no-with':                       'error',
+  'one-var':                       ['error', { initialized: 'never' }],
+  'prefer-const':                  ['error', { destructuring: 'all' }],
+  'prefer-promise-reject-errors':  'error',
+  'prefer-regex-literals':         ['error', { disallowRedundantWrapping: true }],
+  'symbol-description':            'error',
+  'unicode-bom':                   ['error', 'never'],
+  'use-isnan':                     ['error', { enforceForSwitchCase: true, enforceForIndexOf: true }],
+  'valid-typeof':                  ['error', { requireStringLiterals: true }],
+  yoda:                            ['error', 'never'],
+
+  // TODO: Should only be active for server side scripts
+  'n/handle-callback-err':   ['error', '^(err|error)$'],
+  'n/no-callback-literal':   'error',
+  'n/no-deprecated-api':     'error',
+  'n/no-exports-assign':     'error',
+  'n/no-new-require':        'error',
+  'n/no-path-concat':        'error',
+  'n/process-exit-as-throw': 'error',
+
+  'promise/param-names': 'error',
+}
+
+// @stylistic and @typescript-eslint plugins are registered explicitly below; their
+// rules resolve here because flat config merges plugins per matched file.
+const projectRules = {
+  semi:                                  ['error', 'never'],
+  '@stylistic/comma-dangle':             ['error', 'always-multiline'],
+  '@stylistic/key-spacing':              ['error', { align: { beforeColon: false, afterColon: true, on: 'value' } }],
+  // key-spacing's alignment inserts the multi-space runs that no-multi-spaces
+  // would otherwise strip back out on type literals/interfaces; exempt those.
+  '@stylistic/no-multi-spaces':          ['error', { exceptions: { TSTypeAnnotation: true, TSIndexSignature: true, PropertyDefinition: true } }],
+  '@stylistic/jsx-quotes':               ['error', 'prefer-single'],
+  // customize()'s factory defaults disagree with standard style here (named
+  // functions get no space; arrow-parens isn't part of standard style at all)
+  // — restore the long-standing convention instead of reformatting everything.
+  '@stylistic/space-before-function-paren': ['error', 'always'],
+  '@stylistic/arrow-parens':              'off',
+  '@typescript-eslint/no-explicit-any':  'off',
+  '@typescript-eslint/no-non-null-assertion': 'off',
+  '@typescript-eslint/no-unused-vars':   'off',
+  'unused-imports/no-unused-imports':    'error',
+  'unused-imports/no-unused-vars':       ['warn', { vars: 'all', args: 'after-used', varsIgnorePattern: '^_', argsIgnorePattern: '^_' }],
+  'unicorn/no-null':                     'off',
+  'unicorn/prefer-top-level-await':      'off',
+  'unicorn/prefer-module':               'off',
+  'unicorn/name-replacements':            ['error', {
+    ignore:                   [/err/i, /dev/i, /db/i, /(pre)?(pro?d)/i, /conf(ig)?/i, /env/i, /dist/i, /req/i, /res/i, /lib/i, /vars?/i, /Props/],
+    checkShorthandProperties: false,
+  }],
+  'unicorn/filename-case': ['error', { cases: { camelCase: true, pascalCase: true }, ignore: [/^_.+\.[jt]s$/, /\.d\.ts$/] }],
+}
+
+const testRules = {
+  '@typescript-eslint/no-require-imports':     'off',
+  '@typescript-eslint/no-empty-function':      'off',
+  'unicorn/consistent-function-scoping':       'off',
+  // The declare-at-top/assign-in-beforeEach idiom is standard Jest fixture setup.
+  'unicorn/no-top-level-assignment-in-function': 'off',
+  'no-new':                                    'off',
+}
+
+// Several plugin "recommended" presets ship rule blocks with no `files` filter
+// (meant to apply broadly to their own JS/JSON/YAML-shaped ASTs). @eslint/markdown
+// parses .md through ESLint's newer "Language" API, whose SourceCode doesn't
+// implement everything a generic rule may assume (e.g. `getAllComments`,
+// `parserServices`), so those unscoped blocks crash instead of simply no-op'ing
+// on markdown. Keep markdown out of every preset except the dedicated md block below.
+const excludeMarkdown = (configs) => configs.map((config) => ({ ...config, ignores: [...(config.ignores ?? []), '**/*.md'] }))
+
+export default [
+  {
+    ignores: [
+      '.nx/**', 'coverage/**', 'dist/**', 'dist-dev/**', 'dist-uat/**', 'dist-prod/**',
+      'doc/**', 'lib/**', 'node_modules/**', '**/node_modules', 'tmp/**',
+      '.next/**', 'out/**', '**/next-env.d.ts',
+      '.azurite/**', 'package-lock.json',
+      // Tool-owned scripts are regenerated by MoNecromanCI and exempt from the style gate.
+      '.build-templates/**', 'tools/**',
+    ],
+  },
+
+  // @stylistic standard-style formatting (no semicolons, single quotes, 1tbs braces).
+  {
+    ...stylistic.configs.customize({
+      braceStyle:  '1tbs',
+      quoteProps:  'as-needed',
+      semi:        false,
+      quotes:      'single',
+      commaDangle: 'always-multiline',
+      jsx:         true,
+    }),
+    files: code,
+  },
+
+  // Standard-style core rules + cherry-picked n/promise rules (hand-ported from neostandard).
+  {
+    files:           code,
+    plugins:         { n, promise },
+    languageOptions: {
+      ecmaVersion: 2022,
+      sourceType:  'module',
+      globals:     { ...globalsConfig.es2022, ...globalsConfig.node, ...globalsConfig.browser },
+    },
+    rules: standardRules,
+  },
+
+  // typescript-eslint, non type-checked. Already a strict superset of neostandard's
+  // separate ts-redundant rule list (turns off ESLint-core rules the TS compiler covers,
+  // plus a few opinionated upgrades), so it is not separately hand-rolled. Must precede
+  // `projectRules` below so this project's intentional overrides win.
+  ...excludeMarkdown(tseslint.configs.recommended),
+
+  // Unicorn for all TS/JS.
+  { ...unicorn.configs.recommended, files: code },
+
+  // Project rule tweaks + unused-imports.
+  {
+    files:   code,
+    plugins: { 'unused-imports': unusedImports },
+    rules:   projectRules,
+  },
+
+  // React (tsx/jsx) — declared explicitly to avoid plugin-config shape drift.
+  {
+    files:    tsx,
+    plugins:  { react },
+    settings: { react: { version: 'detect' } },
+    rules:    {
+      'react/react-in-jsx-scope': 'off',
+      'react/jsx-uses-react':     'error',
+      'react/jsx-uses-vars':      'error',
+    },
+  },
+  {
+    files:   tsx,
+    plugins: { 'react-hooks': reactHooks },
+    rules:   { 'react-hooks/rules-of-hooks': 'error', 'react-hooks/exhaustive-deps': 'off' },
+  },
+  {
+    files:   tsx,
+    plugins: { 'react-refresh': reactRefresh },
+    rules:   { 'react-refresh/only-export-components': ['warn', { allowConstantExport: true }] },
+  },
+
+  // TSDoc enforcement — require docs on exported declarations (tsdoc-require-2) and
+  // validate TSDoc comment syntax wherever comments already exist (tsdoc).
+  {
+    // Require TSDoc on .ts logic/library code. Framework component files (.tsx —
+    // React/Next pages whose props are typed and whose return is JSX) are exempt.
+    ...tsdocRequire.configs.tsdoc,
+    files:   ['**/*.{ts,mts,cts}'],
+    ignores: [...tests, '**/*.d.ts'],
+  },
+  {
+    files:   code,
+    plugins: { tsdoc },
+    rules:   { 'tsdoc/syntax': 'error' },
+  },
+
+  // Jest tests.
+  {
+    files:           tests,
+    plugins:         { jest: pluginJest },
+    languageOptions: { globals: { ...globalsConfig.jest } },
+    rules:           testRules,
+  },
+
+  // JSON / JSONC / JSON5.
+  ...excludeMarkdown(jsonc.configs['flat/recommended-with-json']),
+  ...excludeMarkdown(jsonc.configs['flat/recommended-with-jsonc']),
+  ...excludeMarkdown(jsonc.configs['flat/recommended-with-json5']),
+
+  // YAML.
+  ...excludeMarkdown(yaml.configs['flat/standard']),
+
+  // Markdown.
+  { files: ['**/*.md'], plugins: { markdown }, language: 'markdown/gfm' },
+]

package/dist/assets/github/workflows/ci.yml

@@ -0,0 +1,67 @@
+name: CI
+
+# Generated by MoNecromanCI. The .build-templates/*.mjs are the shared engine (same
+# scripts Azure Pipelines runs); this workflow maps GitHub's context onto the
+# BUILD_*/SYSTEM_* variables those scripts read. Re-sync with 'monecromanci doctor'.
+
+on:
+  push:
+    branches: [dev, development, uat, master, main]
+    paths-ignore: ['docs/**', '**/*.md']
+  pull_request:
+    branches: [dev, development, uat, master, main]
+    paths-ignore: ['docs/**', '**/*.md']
+
+permissions:
+  contents: read
+  packages: write
+
+jobs:
+  ci:
+    runs-on: ubuntu-latest
+    env:
+      BUILD_REASON: ${{ github.event_name == 'pull_request' && 'PullRequest' || 'IndividualCI' }}
+      BUILD_SOURCEBRANCHNAME: ${{ github.ref_name }}
+      BUILD_SOURCEVERSION: ${{ github.sha }}
+      SYSTEM_PULLREQUEST_TARGETBRANCH: ${{ github.base_ref }}
+      BUILD_SOURCESDIRECTORY: ${{ github.workspace }}
+      BUILD_BUILDID: ${{ github.run_id }}
+      BUILD_ARTIFACTSTAGINGDIRECTORY: ${{ runner.temp }}/artifacts
+      NODE_AUTH_TOKEN: ${{ secrets.NODE_AUTH_TOKEN || github.token }}
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+      - name: Fetch all refs for affected detection
+        run: git fetch --all --prune --tags
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 24
+      - name: Prepare artifact staging directory
+        run: mkdir -p "$BUILD_ARTIFACTSTAGINGDIRECTORY"
+      - name: Install dependencies
+        run: npm ci
+        env:
+          HUSKY: 0
+      - name: "[01] Preparation"
+        run: node .build-templates/01-preparation.mjs
+      - name: "[02] Quality control"
+        run: node .build-templates/02-quality-control.mjs
+      - name: "[03] Package apps"
+        run: node .build-templates/03-package-apps.mjs
+      - name: Upload app drops
+        if: ${{ always() }}
+        uses: actions/upload-artifact@v4
+        with:
+          name: drops
+          path: ${{ runner.temp }}/artifacts
+          if-no-files-found: ignore
+      - name: "[04] Publish libraries"
+        if: ${{ github.event_name != 'pull_request' && github.ref_name == github.event.repository.default_branch }}
+        run: node .build-templates/04-publish-libs.mjs
+      - name: "[05] Publish documentation"
+        if: ${{ vars.PUBLISH_DOCS == 'true' }}
+        run: node .build-templates/05-publish-documentation.mjs
+      - name: "[06] Summary"
+        if: ${{ always() }}
+        run: node .build-templates/06-summary.mjs

package/dist/assets/scripts/clean-config.mjs

@@ -0,0 +1,35 @@
+#!/usr/bin/env node
+
+/**
+ * "Space-strips" a Function App's environment config files.
+ *
+ * Reads every JSON file under the project's `.configurations/` folder and
+ * rewrites it minified (no whitespace), so the classic release pipeline receives
+ * compact app-settings files. Run from the Function App directory (cwd = project
+ * root), typically by CI before the configs are copied to the build artifact:
+ *   npm run clean:config -w <app>
+ */
+import { existsSync, readdirSync, readFileSync, writeFileSync } from 'node:fs'
+import { join } from 'node:path'
+import process from 'node:process'
+
+const configurationsDir = join(process.cwd(), '.configurations')
+
+if (!existsSync(configurationsDir)) {
+  process.stdout.write('No .configurations folder — nothing to strip.\n')
+  process.exit(0)
+}
+
+let count = 0
+for (const entry of readdirSync(configurationsDir)) {
+  if (!entry.endsWith('.json')) {
+    continue
+  }
+
+  const file = join(configurationsDir, entry)
+  const data = JSON.parse(readFileSync(file, 'utf8'))
+  writeFileSync(file, JSON.stringify(data), 'utf8')
+  count += 1
+}
+
+process.stdout.write(`Stripped ${count} configuration file(s).\n`)