3 Commits

Author	SHA1	Message	Date
Jordan Ritter	6dea8ad764	style(showcase): apply oxfmt to SU shell-runtime-urls follow-up files ... Pure prettier-style rewrite (line-wrapping, single-line collapses, multi- line callback indentation). No semantic changes — confirmed via tsc clean, oxlint clean, vitest 235/235 pass in showcase/shell. Touched files: - showcase/scripts/__tests__/generate-registry-pattern.test.ts - showcase/scripts/generate-registry.ts - showcase/shell/src/lib/backend-url.ts - showcase/shell/src/lib/backend-url.test.ts - showcase/shell/src/lib/docs-redirects.test.ts - showcase/shell/src/lib/local-backends-env.test.ts - showcase/shell/src/lib/runtime-config.ts - showcase/shell/src/lib/runtime-config.test.ts - showcase/shell/src/lib/runtime-url-wiring.test.ts - showcase/shell/src/middleware.ts - showcase/shell/src/middleware.test.ts - showcase/shell/vitest.global-setup.ts	2026-06-11 14:02:36 -07:00
Jordan Ritter	8e427bbc0a	fix(showcase): final-round backend-pattern + POSTHOG + table + script-side parity (SU7-F1/F2/F3) ... SU7-F1 — backend host pattern hardening: - F1.1 Reject bare trailing ?/# in the backend host pattern - F1.2 Strip internal tab/CR/LF from the backend host pattern - F1.3 Warn when ignoring an empty-string local backend override - F1.4 Reject empty-userinfo @ in the backend host pattern authority - F1.5 Keep __proto__ keys as data in local-backend maps - F1.6 Commit the local-backends memo key only after the value computes - F1.7 Trim local backend overrides before validation and name the real rejection - F1.8 Honest FATAL when the pattern host is a stray scheme fragment - F1.9 Canonicalize the pattern authority for parity with the override path - F1.10 Acknowledge the staging-to-prod fail-open in the pattern fallback - F1.11 Harden backend-url/local-backends-env test hygiene SU7-F2 — runtime-config & client-config edge cases: - F2.1 Branch POSTHOG_HOST rejection reasons (scheme/degenerate/parse- failure) instead of the catch-all mislabel - F2.2 Reject loopback BASE_URL/DOCS_HOST in production instead of the silent http:// prepend - F2.3 Key the DOCS_HOST fallback once-guard on (mode, shellHost, value) and mode-prefix all value-only guard keys - F2.4 Reject a present-but-empty posthogKey in the client config reader - F2.5 Drop the trailing slash from SSR_PLACEHOLDER_URL for structural parity with server values - F2.6 Attribute the DOCS_HOST slash-strip to readDocsHost itself - F2.7 Normalize trailing-dot FQDN spellings in the docs self-host loop guard (both compare sides) - F2.8 Harden console spies to capture all log args; pin the full all-env config shape; converge SSR simulation on vi.stubGlobal SU7-F3 — script-side parity, table classification & test isolation: - F3 #1 Handle a missing reference integration per the error contract - F3 #2 Port the runtime backend-host-pattern normalization into the generator — scheme/trailing-slash strip, degenerate fallback, NEXT_PUBLIC fallback - F3 #3 Treat non-mapping manifest parses (empty/null/scalar/array YAML) as validation errors, not TypeErrors - F3 #4 Label a missing/unreadable constraints.yaml per the stderr+exit(1) error contract - F3 #5 Align atomic-write tmp naming with the test harness straggler- sweep convention; guard main() on direct invocation - F3 #6 Correct the determineCellStatus unshipped docstring; replace stale hardcoded cell counts with formulas - F3 #7 Isolate the pattern suite on a per-suite tmpdir harness; snapshot the generator's full write set - F3 #8 Classify discarded duplicate wildcards as duplicates — hoist the owner check above the destination warns - F3 #9 Reject a root ("/") EXACT seo-redirect source — homepage-hijack twin of the root-wildcard guard - F3 #10 Reject seo-redirect entries with non-printable-ASCII source/ destination — close the silent-dead-entry class - F3 #11 Strip trailing slashes in normalizePosthogHost before the scheme test - F3 #12 Message-filter the empty-slug-set error count; pin the single matcher entry	2026-06-11 14:01:15 -07:00
Jordan Ritter	4f9f5dba4c	fix(showcase/shell): docs-host robustness, builder & matcher hardening (SU2-stragglers + SU5 + SU6-A/B) ... Round-by-round CR convergence covering the redirect builder, the middleware matcher, the docs-host self-loop guard, and the runtime-config env readers. Highlights: - Clear module-load warns after fresh middleware import - Validate SET BASE_URL values (scheme-less/degenerate/garbage) with sentinel fallback + once-guarded FATAL log - Normalize path/query/fragment-bearing DOCS_HOST to origin; reject non-http(s) schemes; branch rejection reasons - Harden POSTHOG_HOST (degenerate-host/scheme rejection); expose posthogKey via readEnvPair semantics - Reject a DOCS_HOST equal to the shell's own host (redirect-loop guard, authority compare) - Warn on missing local-ports.json under SHOWCASE_LOCAL=1 and validate TCP port range; extract helper for tests - backend-url hardening — slug charset guard, frozen local-backends memo, pattern path-segment warn, local-override URL validation - Client config fail-loud covers all four URL fields with type checks - Make RuntimeConfig.posthogKey optional — absence is a valid state, not a wiring bug - Drop R15/R17 and guard /integrations from SEO redirects - Dedup duplicate wildcard prefixes with first-match-wins warn - Validate malformed SEO entries at lookup-build time - Restore case-insensitive redirect matching parity - Normalize trailing slashes before redirect matching - Keep the framework segment on F13, pin MG3 case fix - Read posthogKey from runtime config in middleware, not raw process.env - Fall back to the default backend host pattern for degenerate values - Disable docs redirects when the default fallback collides with the shell host - Bring validateBaseUrl to parity with its sibling readers - Strip query/fragment from POSTHOG_HOST while keeping reverse-proxy paths - Restrict local backend overrides to http(s) URLs - Add server-only guard to runtime-config - Harden localBackendsEnv failure posture - Hoist /integrations namespace guard above the docs-host redirect - Validate seo-redirect sources and cross-kind shadowing in buildRedirectLookup - Unify slash normalization for middleware matching - Lowercase-normalize REGISTRY_FRAMEWORK_SLUGS at construction - Escalate missing POSTHOG_KEY to console.error in production - Skip all redirect steps when docs redirects are disabled (sentinel consumer) - Reject userinfo credentials in DOCS_HOST, POSTHOG_HOST, and the backend host pattern - Branch dev-vs-prod logging in readDocsHost and fatalPatternOnce - Prepend http:// (not https://) to scheme-less loopback hosts - Round-5 micro-finding batch across the URL config libs SU5-A1..A7 — registry safety, // reject, builder lint batch (case- insensitive :path*, same-destination twin allowlist, original-case divergence remainder), matcher api boundary, generator+vitest infra, test hygiene + empty docs-host guard, comment batch. SU6-A1..A6 — reject miscased :path* tokens, warn on tokenless wildcards, normalize redirect-destination comparisons like request time, reject destinations containing "//", surface missing POSTHOG_KEY at config- resolution time, compile matcher harness like Next's runtime, type parse/tokensToRegexp in the path-to-regexp shim, keep buildRedirectLookup JSDoc attached. SU6-B1..B7 — reject query/fragment/userinfo in pattern and local-override URL gates, return parsed-normalized URL form from validation success paths, distinguish unset/blank/padded SHOWCASE_LOCAL states, warn when SHOWCASE_LOCAL is set to a value other than 1, validate {slug} placeholder in generate-registry, mirror middleware drop semantics in the wiring test's registry re-derivation, pin the noStore spy and calls to one fresh module instance in the Edge-path test.	2026-06-11 14:00:50 -07:00