storyshelf 0.6.2 → 0.7.0

package/dist/commands/protect-gitlab.js

@@ -0,0 +1,69 @@
+#!/usr/bin/env node
+import "node:path";
+import "node:url";
+import.meta.url;
+import { HostError, hostJson } from "./protect-types.js";
+//#region src/commands/protect-gitlab.ts
+/**
+* GitLab: statuses a build posts join the commit's pipeline, so the merge gate is the project's
+* "pipelines must succeed" setting (`only_allow_merge_if_pipeline_succeeds`). GitLab has no
+* per-status required-check list outside its paid external status checks.
+*/
+/** The GitLab adapter for the project `group/project` on `host`. */
+function gitlabProtection(repo, host, fetchImpl) {
+	const api = `${host.replace(/\/+$/u, "")}/api/v4/projects/${encodeURIComponent(repo)}`;
+	return {
+		tokenEnv: "GITLAB_TOKEN",
+		manualSteps: (target) => manualSteps(repo, host, target),
+		inspect: async (target, token) => await inspect({
+			api,
+			fetchImpl,
+			token
+		}, target)
+	};
+}
+function manualSteps(repo, host, target) {
+	return [
+		`GitLab: make ${target.checks.join(", ")} gate merges into ${target.branch} on ${repo}:`,
+		"",
+		`1. Open ${host.replace(/\/+$/u, "")}/${repo}/-/settings/merge_requests.`,
+		"2. Under \"Merge checks\" tick \"Pipelines must succeed\". The commit statuses StoryShelf posts",
+		"   are part of the commit's pipeline, so a failed or pending one blocks the merge.",
+		`3. Open Settings > Repository > Protected branches and protect ${target.branch} (merge via merge request).`,
+		"4. Token scope: api, with the Maintainer role."
+	];
+}
+async function inspect(ctx, target) {
+	const headers = { "private-token": ctx.token };
+	const project = await hostJson(ctx.fetchImpl, ctx.api, { headers });
+	const protectedBranch = await isProtected(ctx, target.branch);
+	const setting = project.only_allow_merge_if_pipeline_succeeds === true;
+	const branchNote = protectedBranch ? "" : ` Branch ${target.branch} is not protected: protect it by hand.`;
+	if (setting) return {
+		satisfied: protectedBranch,
+		summary: `Pipelines must succeed is on.${branchNote}`
+	};
+	return {
+		satisfied: false,
+		summary: `"Pipelines must succeed" is off, so ${target.checks.join(", ")} does not gate merges.${branchNote}`,
+		apply: async () => {
+			await hostJson(ctx.fetchImpl, ctx.api, {
+				method: "PUT",
+				headers,
+				json: { only_allow_merge_if_pipeline_succeeds: true }
+			});
+			return `Turned on "Pipelines must succeed".${branchNote}`;
+		}
+	};
+}
+async function isProtected(ctx, branch) {
+	try {
+		await hostJson(ctx.fetchImpl, `${ctx.api}/protected_branches/${encodeURIComponent(branch)}`, { headers: { "private-token": ctx.token } });
+		return true;
+	} catch (error) {
+		if (error instanceof HostError && error.status === 404) return false;
+		throw error;
+	}
+}
+//#endregion
+export { gitlabProtection };

package/dist/commands/protect-types.js

@@ -0,0 +1,30 @@
+#!/usr/bin/env node
+import "node:path";
+import "node:url";
+import.meta.url;
+//#region src/commands/protect-types.ts
+/** An HTTP failure of a host API call, with the status for callers that branch on 404. */
+var HostError = class extends Error {
+	name = "HostError";
+	status;
+	constructor(status, message) {
+		super(message);
+		this.status = status;
+	}
+};
+/** Call a host API and parse its JSON; a non-2xx answer throws {@link HostError} (the token is never in the text). */
+async function hostJson(fetchImpl, url, init) {
+	const response = await fetchImpl(url, {
+		method: init.method ?? "GET",
+		headers: init.json === void 0 ? init.headers : {
+			...init.headers,
+			"content-type": "application/json"
+		},
+		...init.json === void 0 ? {} : { body: JSON.stringify(init.json) }
+	});
+	const text = await response.text();
+	if (!response.ok) throw new HostError(response.status, `${String(response.status)} from ${new URL(url).pathname}: ${text.slice(0, 200)}`);
+	return text === "" ? {} : JSON.parse(text);
+}
+//#endregion
+export { HostError, hostJson };

package/dist/commands/protect.js

@@ -0,0 +1,51 @@
+#!/usr/bin/env node
+import "node:path";
+import "node:url";
+import.meta.url;
+import { printError, printLine } from "../output.js";
+import { githubProtection } from "./protect-github.js";
+import { gitlabProtection } from "./protect-gitlab.js";
+//#region src/commands/protect.ts
+/** The check names a merge must wait for: the channel's gate status. */
+function requiredChecks(prefix, gate) {
+	return [`${prefix}/${gate}`];
+}
+/**
+* Print the exact required-check rule for the host, validate the branch's existing rule against
+* it, and write the missing part only with `--apply` (dry run by default). Never reads or writes
+* anything but the branch protection of one repository.
+*/
+async function runProtect(options) {
+	const adapter = adapterFor(options);
+	const checks = requiredChecks(options.prefix ?? "storyshelf", options.gate ?? "testing");
+	const target = {
+		branch: options.branch ?? "main",
+		checks
+	};
+	for (const line of adapter.manualSteps(target)) printLine(line);
+	const token = options.token ?? process.env[adapter.tokenEnv];
+	if (token) await validateAndApply(adapter.inspect(target, token), options.apply === true);
+	else if (options.apply) throw new Error(`--apply needs an admin token (--token or ${adapter.tokenEnv})`);
+	else printLine(`\nNo token: rule not checked. Pass --token (or ${adapter.tokenEnv}) to validate it.`);
+}
+/** Print what the rule lacks; write it when `apply`, else say it was a dry run. */
+async function validateAndApply(inspected, apply) {
+	const result = await inspected;
+	printLine(`\n${result.summary}`);
+	if (result.satisfied) return;
+	process.exitCode = 1;
+	if (!apply) printLine("Dry run: nothing was changed. Run again with --apply to write the rule.");
+	else if (result.apply === void 0) printError("This rule cannot be written automatically; follow the steps above.");
+	else {
+		printLine(await result.apply());
+		process.exitCode = void 0;
+	}
+}
+function adapterFor(options) {
+	const fetchImpl = options.fetch ?? fetch;
+	if (options.provider === "github") return githubProtection(options.repo, fetchImpl);
+	if (options.provider === "gitlab") return gitlabProtection(options.repo, options.host ?? "https://gitlab.com", fetchImpl);
+	throw new Error(`Unknown provider "${options.provider}": use github or gitlab`);
+}
+//#endregion
+export { requiredChecks, runProtect };

package/dist/commands/retry.js

@@ -6,7 +6,7 @@ import { printLine } from "../output.js";
 import { createClient } from "../client.js";
 //#region src/commands/retry.ts
 /**
-* Retry a failed StoryShelf build.
+* Retry a failed or cancelled StoryShelf build.
 *
 * @param options - Retry command options.
 */

package/dist/commands/server/docker.js

@@ -11,21 +11,20 @@ const PLAYWRIGHT_IMAGE = "mcr.microsoft.com/playwright:v1.63.0-noble";
 * CommonJS dependencies ("Dynamic require ... is not supported") and the vendored
 * assets `@storyshelf/app` reads from disk next to its own modules.
 */
-function imageLines(baseImage, entry, exposePort) {
+function imageLines(baseImage, entry) {
 	return [
 		`FROM ${baseImage}`,
 		"WORKDIR /app",
 		"COPY package*.json ./",
 		"RUN npm install --omit=dev",
 		"COPY src/ ./src/",
-		...exposePort ? ["EXPOSE 3000", "ENV PORT=3000"] : [],
+		"EXPOSE 3000",
+		"ENV PORT=3000",
 		"ENV DATA_DIR=/data",
 		`CMD ["node", "${entry}"]`
 	];
 }
-const DOCKERFILE_LINES = imageLines(PLAYWRIGHT_IMAGE, "src/index.ts", true);
-/** Server image without a browser: the capture worker runs in its own image. */
-const SLIM_DOCKERFILE_LINES = imageLines("node:24-alpine", "src/index.ts", true);
+const DOCKERFILE_LINES = imageLines(PLAYWRIGHT_IMAGE, "src/index.ts");
 const DOCKERIGNORE_LINES = [
 	"node_modules/",
 	".git/",
@@ -71,53 +70,22 @@ const COMPOSE_POSTGRES_VOLUMES_LINES = ["  postgres-data:"];
 function generateDockerfile() {
 	return DOCKERFILE_LINES.join("\n");
 }
-function generateSlimServerDockerfile() {
-	return SLIM_DOCKERFILE_LINES.join("\n");
-}
 function generateDockerignore() {
 	return DOCKERIGNORE_LINES.join("\n");
 }
-function composeLines(database, withWorker) {
+function composeLines(database) {
 	return [
 		...COMPOSE_BASE_LINES,
 		"      # Add your env vars here:",
 		"      # - AUTH_PASSWORD=your-password",
 		...database === "turso" ? COMPOSE_TURSO_LINES : [],
 		...database === "postgres" ? COMPOSE_POSTGRES_LINES : [],
-		...withWorker ? workerComposeLines(database) : [],
 		...COMPOSE_VOLUMES_LINES,
 		...database === "postgres" ? COMPOSE_POSTGRES_VOLUMES_LINES : []
 	];
 }
 function generateComposeYaml(database = "sqlite") {
-	return composeLines(database, false).join("\n");
-}
-const WORKER_DOCKERFILE_LINES = imageLines(PLAYWRIGHT_IMAGE, "src/worker.ts", false);
-function workerComposeLines(database) {
-	const postgres = database === "postgres";
-	return [
-		"  worker:",
-		"    build:",
-		"      dockerfile: Dockerfile.worker",
-		"    volumes:",
-		"      - storyshelf-data:/data",
-		"    environment:",
-		"      - SECRET=change-me",
-		"      - DATA_DIR=/data",
-		...postgres ? ["      - DATABASE_URL=postgres://shelf:shelf@postgres:5432/shelf"] : [],
-		"      - QUEUE_URL=${QUEUE_URL}",
-		"      - WORKER_CONCURRENCY=2",
-		"    depends_on:",
-		"      storyshelf:",
-		"        condition: service_started",
-		...postgres ? ["      postgres:", "        condition: service_healthy"] : []
-	];
-}
-function generateWorkerDockerfile() {
-	return WORKER_DOCKERFILE_LINES.join("\n");
-}
-function generateComposeYamlWithWorker(database = "sqlite") {
-	return composeLines(database, true).join("\n");
+	return composeLines(database).join("\n");
 }
 //#endregion
-export { generateComposeYaml, generateComposeYamlWithWorker, generateDockerfile, generateDockerignore, generateSlimServerDockerfile, generateWorkerDockerfile };
+export { generateComposeYaml, generateDockerfile, generateDockerignore };