run402 3.5.1 → 3.5.2

package/lib/deploy-v2.mjs

@@ -22,7 +22,7 @@
  * UTF-8 is the default; binary files pass `"encoding": "base64"`.
  */
 
-import { fstatSync, readFileSync } from "node:fs";
+import { existsSync, fstatSync, readFileSync } from "node:fs";
 import { resolve, dirname, isAbsolute } from "node:path";
 import {
   buildDeployResolveSummary,
@@ -646,6 +646,69 @@ async function mergeAstroReleaseSlice(spec, dirArg) {
   spec.functions = { replace: { ...existingFns, ...sliceFns } };
 }
 
+/**
+ * Derive the list of on-disk source files a raw manifest `spec` references,
+ * resolved against `baseDir` (the manifest's directory, or cwd for
+ * --spec/stdin). Walks the file-bearing slices:
+ *   - functions.replace[name].source
+ *   - functions.patch.put[name].source   (and functions.patch.set, an alias)
+ *   - site.replace[key]                  (entry itself or entry.source)
+ *   - site.patch.put[key]                (entry itself or entry.source)
+ *
+ * A manifest file entry is `{ path }` (on-disk ref) OR `{ data, encoding? }`
+ * (inline bytes). Only `{ path }` entries with no `data` resolve to a disk
+ * file; inline entries are skipped (nothing to scan on disk). Returns a
+ * de-duped list of absolute paths. Existence + extension filtering is the
+ * caller's job (GH-409). Defensive: tolerates missing/odd shapes silently —
+ * the manifest normalizer is the authority on shape validity, not this
+ * best-effort extractor.
+ */
+function collectManifestSourceFiles(spec, baseDir) {
+  const out = new Set();
+  if (!spec || typeof spec !== "object") return [];
+
+  const resolveEntryPath = (entry) => {
+    // The on-disk ref can be the entry itself (`{ path }`) or nested under
+    // `.source` (function entries, asset put entries). Skip inline `{ data }`.
+    const node =
+      entry && typeof entry === "object" && entry.source && typeof entry.source === "object"
+        ? entry.source
+        : entry;
+    if (
+      node &&
+      typeof node === "object" &&
+      typeof node.path === "string" &&
+      node.data === undefined
+    ) {
+      out.add(isAbsolute(node.path) ? node.path : resolve(baseDir, node.path));
+    }
+  };
+
+  const eachValue = (map) => {
+    if (!map || typeof map !== "object") return;
+    for (const entry of Object.values(map)) resolveEntryPath(entry);
+  };
+
+  const fns = spec.functions;
+  if (fns && typeof fns === "object") {
+    eachValue(fns.replace);
+    if (fns.patch && typeof fns.patch === "object") {
+      eachValue(fns.patch.put);
+      eachValue(fns.patch.set);
+    }
+  }
+
+  const site = spec.site;
+  if (site && typeof site === "object") {
+    eachValue(site.replace);
+    if (site.patch && typeof site.patch === "object") {
+      eachValue(site.patch.put);
+    }
+  }
+
+  return [...out];
+}
+
 async function applyCmd(args) {
   const opts = parseApplyArgs(args);
   const { source, error: sourceError } = resolveApplySource(opts, hasStdinSource());
@@ -772,15 +835,35 @@ async function applyCmd(args) {
   // RUN402_DEPLOY_SKIP_SCAN=1 — useful for forcing a deploy when
   // the scanner has a false positive that the operator has confirmed
   // is fine. Hits with severity `error` fail the deploy.
+  //
+  // Scope (GH-409): a `--dir` (Astro SSR build) deploy walks that dir —
+  // it IS the artifact. A manifest/spec/stdin deploy scans ONLY the
+  // on-disk source files the manifest actually references, resolved
+  // against the manifest's baseDir. We must NOT walk cwd/src for a
+  // manifest deploy: running from inside an unrelated source tree (e.g.
+  // the gateway monorepo, which legitimately has dozens of `getUser`
+  // references) would otherwise block a deploy of one unrelated HTML file.
   if (process.env.RUN402_DEPLOY_SKIP_SCAN !== "1") {
     try {
-      const { resolveScanRoot, scanSourceTree, SCAN_SEVERITY } = await import(
+      const { scanSourceTree, scanSourceFiles, SCAN_SEVERITY } = await import(
         "./doctor-source-scan.mjs"
       );
-      const scanRoot = opts.dir
-        ? (isAbsolute(opts.dir) ? opts.dir : resolve(process.cwd(), opts.dir))
-        : resolveScanRoot(process.cwd());
-      const findings = scanSourceTree(scanRoot, { cwd: process.cwd() });
+      const scannableExt = /\.(?:ts|tsx|js|jsx|mjs|cjs|astro)$/;
+      let findings;
+      if (opts.dir) {
+        const scanRoot = isAbsolute(opts.dir)
+          ? opts.dir
+          : resolve(process.cwd(), opts.dir);
+        findings = scanSourceTree(scanRoot, { cwd: process.cwd() });
+      } else {
+        const baseDir = manifestPath ? dirname(manifestPath) : process.cwd();
+        const files = collectManifestSourceFiles(spec, baseDir).filter(
+          (p) => scannableExt.test(p) && existsSync(p),
+        );
+        findings = files.length > 0
+          ? scanSourceFiles(files, { cwd: process.cwd() })
+          : [];
+      }
       const errorFindings = findings.filter((f) => f.severity === SCAN_SEVERITY.ERROR);
       if (errorFindings.length > 0) {
         const summary = errorFindings.slice(0, 10).map((f) => {

package/lib/doctor-source-scan.mjs

@@ -422,6 +422,47 @@ export function scanSourceTree(srcDir, opts = {}) {
   return findings;
 }
 
+/** Scan an explicit list of on-disk file paths — no directory walk.
+ *  Used by `run402 deploy apply` for manifest/spec/stdin deploys, where
+ *  the artifact is exactly the set of files the manifest references, NOT
+ *  whatever happens to live under cwd/src (GH-409). Files without a
+ *  scannable extension are ignored; unreadable files become a WARN
+ *  finding (never throw). Returns the combined findings list, sorted by
+ *  file + line for stable output, exactly like `scanSourceTree`. */
+export function scanSourceFiles(filePaths, opts = {}) {
+  const findings = [];
+  const cwd = opts.cwd ?? process.cwd();
+  // Same capability picture as scanSourceTree (#8 mint check).
+  const declaredCapabilities =
+    opts.declaredCapabilities ?? readDeclaredCapabilities(cwd);
+  for (const filePath of filePaths) {
+    if (!SCANNED_EXTENSIONS.has(extname(filePath))) continue;
+    let content;
+    try {
+      content = readFileSync(filePath, "utf8");
+    } catch (err) {
+      findings.push({
+        code: "R402_AUTH_SOURCE_SCAN_ERROR",
+        severity: SCAN_SEVERITY.WARN,
+        file: relative(cwd, filePath),
+        message: `failed to read file: ${err instanceof Error ? err.message : String(err)}`,
+      });
+      continue;
+    }
+    findings.push(
+      ...scanFileContent(content, {
+        filePath: relative(cwd, filePath),
+        declaredCapabilities,
+      }),
+    );
+  }
+  findings.sort((a, b) => {
+    if (a.file !== b.file) return a.file < b.file ? -1 : 1;
+    return (a.line ?? 0) - (b.line ?? 0);
+  });
+  return findings;
+}
+
 function walk(dir, visitor) {
   let entries;
   try {

package/lib/doctor-source-scan.test.mjs

@@ -7,6 +7,7 @@ import { join } from "node:path";
 import {
   scanFileContent,
   scanSourceTree,
+  scanSourceFiles,
   readDeclaredCapabilities,
   SCAN_SEVERITY,
   _testOnly_hallucinatedNames,
@@ -415,3 +416,106 @@ describe("readDeclaredCapabilities — run402.config.json capability union", ()
     );
   });
 });
+
+describe("scanSourceFiles — explicit file list (GH-409)", () => {
+  function makeTwoFileDir() {
+    const dir = mkdtempSync(join(tmpdir(), "r402-gh409-"));
+    // A clean file referenced by a manifest — no auth violations.
+    writeFileSync(join(dir, "clean.ts"), "export const x = 1;\n");
+    // A sibling that legitimately imports a hallucinated name (e.g. the
+    // gateway source tree implementing the auth surface). NOT in the
+    // manifest, so it must never be scanned for a manifest-based deploy.
+    writeFileSync(
+      join(dir, "unrelated.ts"),
+      'import { getUser } from "@run402/functions";\n',
+    );
+    return dir;
+  }
+
+  it("scanSourceTree (OLD behavior) WOULD flag the unrelated sibling — proving the bug", () => {
+    const dir = makeTwoFileDir();
+    const findings = scanSourceTree(dir, { cwd: dir });
+    const errs = findings.filter((f) => f.severity === SCAN_SEVERITY.ERROR);
+    assert.ok(
+      errs.some((f) => f.file === "unrelated.ts" && f.attempted_name === "getUser"),
+      "whole-tree scan should have surfaced the unrelated sibling (this is the bug)",
+    );
+  });
+
+  it("scanSourceFiles([clean.ts]) returns ZERO error findings — GH-409 regression", () => {
+    const dir = makeTwoFileDir();
+    const findings = scanSourceFiles([join(dir, "clean.ts")], { cwd: dir });
+    const errs = findings.filter((f) => f.severity === SCAN_SEVERITY.ERROR);
+    assert.equal(
+      errs.length,
+      0,
+      `scoped scan must not walk the sibling; got: ${JSON.stringify(errs)}`,
+    );
+  });
+
+  it("scanSourceFiles([unrelated.ts]) STILL flags a file that IS in scope", () => {
+    const dir = makeTwoFileDir();
+    const findings = scanSourceFiles([join(dir, "unrelated.ts")], { cwd: dir });
+    const f = findings.find(
+      (x) => x.attempted_name === "getUser" && x.code === "R402_AUTH_UNKNOWN_EXPORT",
+    );
+    assert.ok(f, "in-scope file with a violation must still be flagged");
+    assert.equal(f.severity, SCAN_SEVERITY.ERROR);
+    assert.equal(f.file, "unrelated.ts");
+  });
+
+  it("labels findings relative to opts.cwd (mirroring scanSourceTree)", () => {
+    const dir = mkdtempSync(join(tmpdir(), "r402-gh409-rel-"));
+    mkdirSync(join(dir, "functions"));
+    const abs = join(dir, "functions", "login.ts");
+    writeFileSync(abs, 'import { getSession } from "@run402/functions";\n');
+    const findings = scanSourceFiles([abs], { cwd: dir });
+    const f = findings.find((x) => x.attempted_name === "getSession");
+    assert.ok(f);
+    assert.equal(f.file, join("functions", "login.ts"));
+  });
+
+  it("skips files without a scannable extension", () => {
+    const dir = mkdtempSync(join(tmpdir(), "r402-gh409-ext-"));
+    const html = join(dir, "index.html");
+    writeFileSync(html, '<script>const u = getSession();</script>\n');
+    const findings = scanSourceFiles([html], { cwd: dir });
+    assert.equal(findings.length, 0, ".html is not a scanned extension");
+  });
+
+  it("returns no findings for an empty file list", () => {
+    assert.deepEqual(scanSourceFiles([], { cwd: tmpdir() }), []);
+  });
+
+  it("emits a warn finding for an unreadable (missing) file, never throws", () => {
+    const dir = mkdtempSync(join(tmpdir(), "r402-gh409-missing-"));
+    const missing = join(dir, "ghost.ts");
+    const findings = scanSourceFiles([missing], { cwd: dir });
+    const f = findings.find((x) => x.code === "R402_AUTH_SOURCE_SCAN_ERROR");
+    assert.ok(f, "unreadable file should produce a warn finding");
+    assert.equal(f.severity, SCAN_SEVERITY.WARN);
+    assert.equal(f.file, "ghost.ts");
+  });
+
+  it("respects opts.declaredCapabilities for the mint warning", () => {
+    const dir = mkdtempSync(join(tmpdir(), "r402-gh409-cap-"));
+    const abs = join(dir, "login.ts");
+    writeFileSync(
+      abs,
+      "export default async () => auth.sessions.createResponseFromTenantAssertion({});\n",
+    );
+    const withCap = scanSourceFiles([abs], {
+      cwd: dir,
+      declaredCapabilities: ["auth.sessionMint"],
+    });
+    assert.ok(
+      !withCap.some((f) => f.code === "R402_DOCTOR_AUTH_SESSION_MINT_CAPABILITY_MISSING"),
+      "declared capability should suppress the mint warning",
+    );
+    const without = scanSourceFiles([abs], { cwd: dir });
+    assert.ok(
+      without.some((f) => f.code === "R402_DOCTOR_AUTH_SESSION_MINT_CAPABILITY_MISSING"),
+      "absent capability should surface the mint warning",
+    );
+  });
+});

package/lib/init-astro.mjs

@@ -94,9 +94,9 @@ export async function runInitAstro(args = []) {
             preview: "astro preview",
           },
           dependencies: {
-            astro: "^5.0.0",
-            "@run402/astro": "^1.0.0",
-            "@run402/functions": "^2.5.0",
+            astro: "^7.0.0",
+            "@run402/astro": "^2.4.2",
+            "@run402/functions": "^3.0.0",
           },
         },
         null,
@@ -108,7 +108,7 @@ export async function runInitAstro(args = []) {
       content: `// Run402 Astro preset. One config line gets you:
 //   - SSR on Lambda with SnapStart
 //   - ISR cache with cache.invalidate() admin-edit visibility
-//   - AsyncLocalStorage context so db()/getUser()/cache.* work natively
+//   - AsyncLocalStorage context so db()/auth.* helpers work natively
 //   - Build-time detectors for unsupported Astro features
 import run402 from "@run402/astro";
 export default run402();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "run402",
-  "version": "3.5.1",
+  "version": "3.5.2",
   "description": "CLI for Run402 — provision Postgres databases, deploy static sites, generate images, and manage wallets via x402 and MPP micropayments.",
   "type": "module",
   "bin": {