mirror of
https://github.com/MBombeck/HealthLog.git
synced 2026-11-08 12:32:43 +00:00
Marc-André Bombeck
272c426bea
Every item here is a check that could pass while the thing it checks is broken, or a margin the sweep's codemod could not reach. Guards: - The access-payload matcher accepted `.level` on ANY object. A chart's zoom level or a log record's level would have satisfied it and reported a consumer that does not exist. It now names the bindings the entry actually arrives under; a third binding is a deliberate edit rather than a silent widening. Re-falsified: rename both readers, it goes red. - The `pl-7` sweep skipped any line CONTAINING `//`, so a class string sharing a line with a URL was waved through. Only the part after a real line-comment marker is exempt now. Proven by putting `pl-7` on a line with an `https://` comment: caught. - `LEGIT_IDENTICAL` in the English-leak guard had no staleness check, unlike both of its siblings, and carried two dead keys — one from a removal long before this work, one from the duplicated version fields that came off `/admin`. Both pruned, the check added, falsified with a made-up key. - `split-description.mjs` split inside `z. B.`, `d. h.`, `u. a.` and `p. ex.` and produced a head ending mid-abbreviation. Both halves have to be caught, which is why the rule is a shape (single letter + stop) rather than a list, and the merge re-tests its own tail. Exercised against eight cases including the ones that used to break. Margins the codemod could not see, because the child lives in a different component from the card that spaces it: six form roots under managed record settings (one of which also carried the banned `space-y-5` step), the low-stock status line, the avatar card's explainer, and the backups restore report. Each was adding a margin on top of the card's own gap. Two facts the text diet cut too close, both restored inside the guideline: that an excluded injection site wins over a medication that prefers it, and that the privacy card's second button leads to a full health record.
scripts/
One-shot operator and build scripts. These are not part of the running application — they are run by hand during a deploy, a backfill, or a release, or wired into CI. Recurring work belongs on pg-boss (src/lib/jobs/), not here.
How to run them
From a source checkout:
pnpm dlx tsx scripts/<file>.ts
The production image intentionally removes npm, pnpm, and Corepack. Only
container-safe scripts named by an operator runbook use its pinned
healthlog-tsx launcher; scripts that import the full application dependency
graph must run from a source checkout. scripts/ is excluded from the project
typecheck.
What lives here
generate-openapi.ts— emitsdocs/api/openapi.yamlfrom the registered Zod schemas (pnpm openapi:generate).check-openapi.ts— compares a freshly generated spec against the committed YAML; CI fails on drift (pnpm openapi:check).check-env.ts— pre-deploy env-var sanity check againstenv-manifest.json(pnpm check-env); wired into CI.assert-deploy.ts— post-deploy/api/versionassertion.rotate-encryption-key.ts— AES-256-GCM key rotation; seedocs/ops/encryption-key-rotation.md.restore-backup.ts— restore an off-host AES-GCM backup from an S3-compatible bucket.repair-intake-anomalies.ts— repair historic medication-ledger defects (duplicate dose-slot rows, implausibletaken_at); dry-run by default, seedocs/ops/intake-repair.md.backfill-rollups.ts,drain-per-sample-cumulative.ts,backfill-mood-note-column.ts— historical data backfills (note: the boot-timerollup-full-backfillqueue handles new accounts automatically; the CLI is the manual fallback).seed-demo.ts+seed-demo-v15.sql— populate a demo tenant.test-notifications.ts— exercise the notification dispatcher + reminder check.fetch-geolite2.sh— download the MaxMind GeoLite2 MMDBs (needs a licence key) beforedocker build.install-hooks.sh— install the local git hooks.generate-sw-version.mjs,print-bundle-report.mjs— service-worker version stamp and bundle-size report.i18n/— locale tooling;__tests__/— tests for the scripts above.
Conventions
See ../CLAUDE.md "Tests and commands" + "Self-hosting gotchas". Operator runbooks that drive these scripts live in ../docs/ops/.