zitejs 0.10.0-start.8 → 0.10.0-start.9

package/dist/cjs/auth/index.d.ts

@@ -67,7 +67,7 @@ export declare const signIn: {
     }, FetchOptions["throw"] extends true ? true : false>>;
 } & {
     social: <FetchOptions extends import("@better-auth/core").ClientFetchOption<Partial<{
-        provider: "salesforce" | "slack" | "linear" | "notion" | "linkedin" | "github" | "dropbox" | (string & {}) | "huggingface" | "apple" | "atlassian" | "cognito" | "discord" | "facebook" | "figma" | "microsoft" | "google" | "spotify" | "twitch" | "twitter" | "kick" | "gitlab" | "tiktok" | "reddit" | "roblox" | "vk" | "zoom" | "kakao" | "naver" | "line" | "paybin" | "paypal" | "polar" | "railway" | "vercel" | "wechat";
+        provider: "salesforce" | "slack" | "linear" | "notion" | "linkedin" | "github" | "dropbox" | "line" | (string & {}) | "huggingface" | "apple" | "atlassian" | "cognito" | "discord" | "facebook" | "figma" | "microsoft" | "google" | "spotify" | "twitch" | "twitter" | "kick" | "gitlab" | "tiktok" | "reddit" | "roblox" | "vk" | "zoom" | "kakao" | "naver" | "paybin" | "paypal" | "polar" | "railway" | "vercel" | "wechat";
         callbackURL?: string | undefined;
         newUserCallbackURL?: string | undefined;
         errorCallbackURL?: string | undefined;
@@ -91,7 +91,7 @@ export declare const signIn: {
         loginHint?: string | undefined;
         additionalData?: Record<string, any> | undefined;
     }> & Record<string, any>, Partial<Record<string, any>> & Record<string, any>, Record<string, any> | undefined>>(data_0: import("better-auth/react").Prettify<{
-        provider: "salesforce" | "slack" | "linear" | "notion" | "linkedin" | "github" | "dropbox" | (string & {}) | "huggingface" | "apple" | "atlassian" | "cognito" | "discord" | "facebook" | "figma" | "microsoft" | "google" | "spotify" | "twitch" | "twitter" | "kick" | "gitlab" | "tiktok" | "reddit" | "roblox" | "vk" | "zoom" | "kakao" | "naver" | "line" | "paybin" | "paypal" | "polar" | "railway" | "vercel" | "wechat";
+        provider: "salesforce" | "slack" | "linear" | "notion" | "linkedin" | "github" | "dropbox" | "line" | (string & {}) | "huggingface" | "apple" | "atlassian" | "cognito" | "discord" | "facebook" | "figma" | "microsoft" | "google" | "spotify" | "twitch" | "twitter" | "kick" | "gitlab" | "tiktok" | "reddit" | "roblox" | "vk" | "zoom" | "kakao" | "naver" | "paybin" | "paypal" | "polar" | "railway" | "vercel" | "wechat";
         callbackURL?: string | undefined;
         newUserCallbackURL?: string | undefined;
         errorCallbackURL?: string | undefined;

package/dist/cjs/check/index.d.ts

@@ -1 +1,33 @@
-export declare function runCheck(): Promise<void>;
+import { type Problem } from './start/problem.js';
+type Step = {
+    name: string;
+    ok: boolean;
+    output?: string;
+};
+/** One app's check, as `--json` reports it. */
+export type AppCheck = {
+    path: string;
+    runtime: 'classic' | 'start';
+    ok: boolean;
+    steps: Step[];
+    problems: Problem[];
+};
+/**
+ * While `--json` checks, stdout carries only the report: app code that logs as
+ * it's described in-process goes to stderr instead.
+ */
+export declare const withStdoutOnStderr: <T>(run: () => Promise<T>) => Promise<T>;
+/** Prints as it goes, or with `--json` stays quiet and reports everything at the end. */
+export declare class Reporter {
+    private readonly json;
+    readonly apps: AppCheck[];
+    constructor(json: boolean);
+    app(path: string, runtime: AppCheck['runtime'], heading: boolean): AppCheck;
+    step(app: AppCheck, name: string, result: {
+        ok: boolean;
+        output?: string;
+    }): boolean;
+    problems(app: AppCheck, problems: Problem[]): void;
+}
+export declare function runCheck(args?: string[]): Promise<void>;
+export {};

package/dist/cjs/check/index.js

@@ -33,11 +33,13 @@ var __importStar = (this && this.__importStar) || (function () {
     };
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.Reporter = exports.withStdoutOnStderr = void 0;
 exports.runCheck = runCheck;
 const child_process_1 = require("child_process");
 const fs_1 = require("fs");
 const path_1 = require("path");
 const sourceRoots_js_1 = require("../sourceRoots.js");
+const problem_js_1 = require("./start/problem.js");
 /**
  * An argument array, not a command string, so no shell is involved.
  *
@@ -93,41 +95,134 @@ function bundleFailures(output) {
 }
 const indent = (output) => output.trim().split('\n').map(l => `    ${l}`).join('\n');
 /**
- * A Start app: `vite build` first, since it regenerates the route tree tsc
- * reads, then tsc, then describe, which reports what the platform's build
- * refuses, read the same way.
+ * While `--json` checks, stdout carries only the report: app code that logs as
+ * it's described in-process goes to stderr instead.
  */
-async function checkStartApp(appPath) {
-    process.stdout.write('  vite build ... ');
-    const vite = run('npx', ['vite', 'build'], appPath);
-    console.log(vite.ok ? '✓' : '✗');
-    if (!vite.ok) {
-        console.log(indent(vite.output));
+const withStdoutOnStderr = async (run) => {
+    const write = process.stdout.write;
+    process.stdout.write = process.stderr.write.bind(process.stderr);
+    try {
+        return await run();
+    }
+    finally {
+        process.stdout.write = write;
+    }
+};
+exports.withStdoutOnStderr = withStdoutOnStderr;
+/** Prints as it goes, or with `--json` stays quiet and reports everything at the end. */
+class Reporter {
+    json;
+    apps = [];
+    constructor(json) {
+        this.json = json;
+    }
+    app(path, runtime, heading) {
+        const app = { path, runtime, ok: true, steps: [], problems: [] };
+        this.apps.push(app);
+        if (heading && !this.json)
+            console.log(`\n── ${path} ──`);
+        return app;
+    }
+    step(app, name, result) {
+        const output = result.output?.trim();
+        app.steps.push({ name, ok: result.ok, ...(output && !result.ok && { output }) });
+        if (!result.ok)
+            app.ok = false;
+        if (!this.json) {
+            console.log(`  ${name} ... ${result.ok ? '✓' : '✗'}`);
+            if (!result.ok && output)
+                console.log(indent(output));
+        }
+        return result.ok;
+    }
+    problems(app, problems) {
+        app.problems.push(...problems);
+        if (problems.some(p => p.severity === 'error'))
+            app.ok = false;
+        if (!this.json && problems.length)
+            console.log(problems.map(p => `    ${(0, problem_js_1.formatProblem)(p)}`).join('\n'));
+    }
+}
+exports.Reporter = Reporter;
+const SKIPPED_DIRS = new Set(['node_modules', 'dist', '.output', '.tanstack', '.wrangler']);
+/** The app's own source, by app-relative path. */
+function readAppSources(appPath) {
+    const sources = {};
+    const visit = (dir) => {
+        for (const entry of (0, fs_1.readdirSync)(dir, { withFileTypes: true })) {
+            if (SKIPPED_DIRS.has(entry.name))
+                continue;
+            const full = (0, path_1.join)(dir, entry.name);
+            if (entry.isDirectory())
+                visit(full);
+            else if (/\.[cm]?[jt]sx?$/.test(entry.name))
+                sources[(0, path_1.relative)(appPath, full)] = (0, fs_1.readFileSync)(full, 'utf-8');
+        }
+    };
+    const src = (0, path_1.join)(appPath, 'src');
+    if ((0, fs_1.existsSync)(src))
+        visit(src);
+    return sources;
+}
+const isInternalApp = (appPath) => {
+    try {
+        return JSON.parse((0, fs_1.readFileSync)((0, path_1.join)(appPath, 'zite.config.json'), 'utf-8'))?.accessMode === 'internal';
+    }
+    catch {
         return false;
     }
-    process.stdout.write('  tsc --noEmit ... ');
+};
+/**
+ * A Start app: `vite build` first, since it regenerates the route tree tsc
+ * reads, then tsc, then describe, which reports what the platform's build
+ * refuses, read the same way, then the source hints.
+ */
+async function checkStartApp(reporter, app, appPath) {
+    if (!reporter.step(app, 'vite build', run('npx', ['vite', 'build'], appPath)))
+        return;
     // --pretty for `file:line:col - error` lines, the shape the platform re-roots.
-    const tsc = run('npx', ['tsc', '--noEmit', '--pretty', '-p', 'tsconfig.app.json'], appPath);
-    console.log(tsc.ok ? '✓' : '✗');
-    if (!tsc.ok)
-        console.log(indent(tsc.output));
-    process.stdout.write('  describe ... ');
+    reporter.step(app, 'tsc --noEmit', run('npx', ['tsc', '--noEmit', '--pretty', '-p', 'tsconfig.app.json'], appPath));
+    const { describedProblems } = await Promise.resolve().then(() => __importStar(require('./start/describeRules.js')));
+    const { sourceProblems } = await Promise.resolve().then(() => __importStar(require('./start/sourceRules.js')));
     try {
         const { describeBuiltApp } = await Promise.resolve().then(() => __importStar(require('../start/describeBuilt.js')));
-        const { descriptionProblems } = await Promise.resolve().then(() => __importStar(require('../start/problems.js')));
-        const problems = descriptionProblems((await describeBuiltApp(appPath)));
-        console.log(problems.length ? '✗' : '✓');
-        if (problems.length)
-            console.log(problems.map(p => `    ${p}`).join('\n'));
-        return tsc.ok && problems.length === 0;
+        const description = (await describeBuiltApp(appPath));
+        const problems = describedProblems(description, { internal: isInternalApp(appPath) });
+        reporter.step(app, 'describe', { ok: !problems.some(p => p.severity === 'error') });
+        reporter.problems(app, problems);
     }
     catch (err) {
-        console.log('✗');
-        console.log(`    ${err instanceof Error ? err.message : String(err)}`);
-        return false;
+        reporter.step(app, 'describe', { ok: false, output: err instanceof Error ? err.message : String(err) });
+    }
+    const hints = sourceProblems(readAppSources(appPath));
+    reporter.step(app, 'source', { ok: !hints.some(p => p.severity === 'error') });
+    reporter.problems(app, hints);
+}
+function checkClassicApp(reporter, app, root, dir, appPath) {
+    // Only tsconfig.app.json compiles anything. The app's tsconfig.json is a
+    // solution-style config — `"files": []` plus a reference — so
+    // `tsc --noEmit -p tsconfig.json` type-checks zero files and exits 0. It
+    // used to be the fallback, which meant an app missing tsconfig.app.json
+    // reported a passing typecheck it never ran.
+    const tsconfigAppPath = (0, path_1.join)(appPath, 'tsconfig.app.json');
+    reporter.step(app, 'tsc --noEmit', (0, fs_1.existsSync)(tsconfigAppPath)
+        ? run('npx', ['tsc', '--noEmit', '-p', tsconfigAppPath], '.')
+        : { ok: false, output: `no ${tsconfigAppPath}` });
+    // Endpoints never reach vite — they are bundled separately for the lambda,
+    // against a different resolver. tsc and vite both pass on an endpoint whose
+    // `zitejs/*` alias has no generated file behind it; only the bundler knows.
+    if ((0, sourceRoots_js_1.listEndpointNames)(root, appPath).length > 0) {
+        const bundle = run('npx', ['zitejs', 'bundle', '--app', dir], '.');
+        const failures = bundle.ok ? bundleFailures(bundle.output) : [bundle.output];
+        reporter.step(app, 'bundle endpoints', { ok: failures.length === 0, output: failures.join('\n') });
+    }
+    if ((0, fs_1.existsSync)((0, path_1.join)(appPath, 'vite.config.ts'))) {
+        reporter.step(app, 'vite build', run('npx', ['vite', 'build'], appPath));
     }
 }
-async function runCheck() {
+async function runCheck(args = process.argv.slice(3)) {
+    const json = args.includes('--json');
+    const reporter = new Reporter(json);
     const { isStartAppDir } = await Promise.resolve().then(() => __importStar(require('../start/entries.js')));
     // Run inside a Start app, its own zitejs checks just that app: the workspace
     // root's is a classic release that doesn't know Start.
@@ -137,72 +232,27 @@ async function runCheck() {
         console.error('No apps or automations found under apps/ or automations/.');
         process.exit(1);
     }
-    let allPassed = inStartApp ? await checkStartApp('.') : true;
-    for (const { root, dir: app, path: appPath } of appDirs) {
-        console.log(`\n── ${appPath} ──`);
-        if (isStartAppDir(appPath)) {
-            if (!(await checkStartApp(appPath)))
-                allPassed = false;
-            continue;
-        }
-        // Only tsconfig.app.json compiles anything. The app's tsconfig.json is a
-        // solution-style config — `"files": []` plus a reference — so
-        // `tsc --noEmit -p tsconfig.json` type-checks zero files and exits 0. It
-        // used to be the fallback, which meant an app missing tsconfig.app.json
-        // reported a passing typecheck it never ran.
-        const tsconfigAppPath = (0, path_1.join)(appPath, 'tsconfig.app.json');
-        if (!(0, fs_1.existsSync)(tsconfigAppPath)) {
-            console.log(`  tsc --noEmit ... ✗ (no ${tsconfigAppPath})`);
-            allPassed = false;
-        }
-        else {
-            process.stdout.write('  tsc --noEmit ... ');
-            const tsc = run('npx', ['tsc', '--noEmit', '-p', tsconfigAppPath], '.');
-            if (tsc.ok) {
-                console.log('✓');
+    const checkAll = async () => {
+        if (inStartApp)
+            await checkStartApp(reporter, reporter.app('.', 'start', false), '.');
+        for (const { root, dir, path: appPath } of appDirs) {
+            if (isStartAppDir(appPath)) {
+                await checkStartApp(reporter, reporter.app(appPath, 'start', true), appPath);
             }
             else {
-                console.log('✗');
-                console.log(tsc.output.trim().split('\n').map(l => `    ${l}`).join('\n'));
-                allPassed = false;
+                checkClassicApp(reporter, reporter.app(appPath, 'classic', true), root, dir, appPath);
             }
         }
-        // Endpoints never reach vite — they are bundled separately for the lambda,
-        // against a different resolver. tsc and vite both pass on an endpoint whose
-        // `zitejs/*` alias has no generated file behind it; only the bundler knows.
-        if ((0, sourceRoots_js_1.listEndpointNames)(root, appPath).length > 0) {
-            process.stdout.write('  bundle endpoints ... ');
-            const bundle = run('npx', ['zitejs', 'bundle', '--app', app], '.');
-            const failures = bundle.ok ? bundleFailures(bundle.output) : [bundle.output];
-            if (failures.length === 0) {
-                console.log('✓');
-            }
-            else {
-                console.log('✗');
-                console.log(failures.map(l => `    ${l}`).join('\n'));
-                allPassed = false;
-            }
-        }
-        const viteConfig = (0, path_1.join)(appPath, 'vite.config.ts');
-        if ((0, fs_1.existsSync)(viteConfig)) {
-            process.stdout.write('  vite build ... ');
-            const vite = run('npx', ['vite', 'build'], appPath);
-            if (vite.ok) {
-                console.log('✓');
-            }
-            else {
-                console.log('✗');
-                console.log(vite.output.trim().split('\n').map(l => `    ${l}`).join('\n'));
-                allPassed = false;
-            }
-        }
-    }
-    console.log('');
-    if (allPassed) {
-        console.log('All apps pass.');
+    };
+    await (json ? (0, exports.withStdoutOnStderr)(checkAll) : checkAll());
+    const allPassed = reporter.apps.every(app => app.ok);
+    if (json) {
+        process.stdout.write(`${JSON.stringify({ ok: allPassed, apps: reporter.apps })}\n`);
     }
     else {
-        console.log('Some apps failed.');
-        process.exit(1);
+        console.log('');
+        console.log(allPassed ? 'All apps pass.' : 'Some apps failed.');
     }
+    if (!allPassed)
+        process.exit(1);
 }

package/dist/cjs/check/start/describeRules.d.ts

@@ -0,0 +1,35 @@
+import type { Problem } from "./problem.js";
+type Access = {
+    kind: string;
+    roles?: string[];
+};
+export type CheckedDescription = {
+    functions: Array<{
+        id: string;
+        name?: string;
+        file?: string;
+        access: Access;
+        input?: unknown;
+        problems: string[];
+    }>;
+    routes: Array<{
+        path: string;
+        file?: string;
+        description?: string;
+        methods: Record<string, Access>;
+        problems: string[];
+    }>;
+    pages?: Array<{
+        path: string;
+        file?: string;
+    }>;
+    workflows?: Array<{
+        id: string;
+        file: string;
+        problems: string[];
+    }>;
+};
+export declare function describedProblems(description: CheckedDescription, { internal }: {
+    internal: boolean;
+}): Problem[];
+export {};

package/dist/cjs/check/start/describeRules.js

@@ -0,0 +1,89 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.describedProblems = describedProblems;
+// The host, TanStack and Cloudflare answer these before the app does.
+const RESERVED_PATHS = [
+    /^\/_zite/,
+    /^\/__zite/,
+    /^\/_serverFn(\/|$)/,
+    /^\/cdn-cgi(\/|$)/,
+    /^\/auth(\/|$)/,
+    /^\/api\/auth(\/|$)/,
+    /^\/manifest\.webmanifest$/,
+];
+const OWNER_INPUTS = ["userId", "ownerId"];
+/** `access-missing: no signedIn…`, or a route's `GET: access-missing: …`, as a named problem. */
+const describeProblem = (problem, subject, file) => {
+    const match = /^(?:(GET|POST|PUT|PATCH|DELETE|HEAD|OPTIONS|ANY): )?([a-z][a-z-]*): (.*)$/s.exec(problem);
+    const [, method, rule, message] = match ?? [undefined, undefined, "describe", problem];
+    return {
+        rule: rule ?? "describe",
+        severity: "error",
+        ...(file && { file }),
+        message: `${subject}${method ? ` ${method}` : ""}: ${message ?? problem}`,
+    };
+};
+const inputProperties = (input) => {
+    const properties = input?.properties;
+    return properties && typeof properties === "object" ? Object.keys(properties) : [];
+};
+function describedProblems(description, { internal }) {
+    const problems = [];
+    for (const fn of description.functions) {
+        const subject = `function ${fn.name ?? fn.id}`;
+        problems.push(...fn.problems.map((p) => describeProblem(p, subject, fn.file)));
+        if (internal && fn.access.kind === "anyone") {
+            problems.push({
+                rule: "public-in-internal",
+                severity: "error",
+                ...(fn.file && { file: fn.file }),
+                message: `${subject} is a publicFn, and this internal app signs everyone in; make it a signedInFn`,
+            });
+        }
+        const owner = fn.access.kind === "signedIn" && inputProperties(fn.input).find((p) => OWNER_INPUTS.includes(p));
+        if (owner) {
+            problems.push({
+                rule: "owner-from-input",
+                severity: "warning",
+                ...(fn.file && { file: fn.file }),
+                message: `${subject} takes ${owner} as input, which any caller can set; use context.user.id`,
+            });
+        }
+    }
+    for (const route of description.routes) {
+        const subject = `route ${route.path}`;
+        problems.push(...route.problems.map((p) => describeProblem(p, subject, route.file)));
+        const publicMethods = Object.entries(route.methods).filter(([, access]) => access.kind === "anyone");
+        if (internal && publicMethods.length > 0) {
+            problems.push({
+                rule: "public-in-internal",
+                severity: "error",
+                ...(route.file && { file: route.file }),
+                message: `${subject} lets anyone call ${publicMethods.map(([m]) => m).join(", ")}, and this internal app signs everyone in; use signedIn`,
+            });
+        }
+        if (!route.description) {
+            problems.push({
+                rule: "description-missing",
+                severity: "warning",
+                ...(route.file && { file: route.file }),
+                message: `${subject} has no description; add staticData: { description } for the editor`,
+            });
+        }
+    }
+    for (const workflow of description.workflows ?? []) {
+        problems.push(...workflow.problems.map((p) => describeProblem(p, `workflow ${workflow.id}`, workflow.file)));
+    }
+    const paths = new Map([...description.routes, ...(description.pages ?? [])].map((r) => [r.path, r.file]));
+    for (const [path, file] of paths) {
+        if (RESERVED_PATHS.some((reserved) => reserved.test(path))) {
+            problems.push({
+                rule: "reserved-path",
+                severity: "error",
+                ...(file && { file }),
+                message: `${path} is the platform's; give the route another path`,
+            });
+        }
+    }
+    return problems;
+}

package/dist/cjs/check/start/problem.d.ts

@@ -0,0 +1,11 @@
+export type Severity = "error" | "warning";
+/** One finding of `zitejs check`, named by its rule. Errors fail the check; warnings only report. */
+export type Problem = {
+    rule: string;
+    severity: Severity;
+    /** App-relative. */
+    file?: string;
+    line?: number;
+    message: string;
+};
+export declare const formatProblem: ({ rule, severity, file, line, message }: Problem) => string;

package/dist/cjs/check/start/problem.js

@@ -0,0 +1,5 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.formatProblem = void 0;
+const formatProblem = ({ rule, severity, file, line, message }) => `${severity} ${rule}${file ? ` ${file}${line ? `:${line}` : ""}` : ""}: ${message}`;
+exports.formatProblem = formatProblem;

package/dist/cjs/check/start/sourceRules.d.ts

@@ -0,0 +1,3 @@
+import type { Problem } from "./problem.js";
+/** Every source hint for one Start app, given its files by app-relative path. */
+export declare function sourceProblems(sources: Record<string, string>): Problem[];