Package tests and http framework stubs - #2

…npm placeholders (#230)

## Summary

Fixes the scaffold issues that force downstream consumers (ForkLaunch
Studio) to patch generated files after `init`. Audit of the reported
five items against main:

| # | Issue | Status |
|---|-------|--------|
| 1 | pnpm-workspace.yaml placeholder breaks installs; re-init clobbers
fixes | **Fixed here** |
| 2 | MikroORM version skew (7.0.15 vs 7.1.8) | Already fixed on main
(#228): CLI pins 7.1.8, scaffold resolves a single instance |
| 3 | BullMqWorkerOptions.queueOptions TS2345 | Not reproducible on
main: scaffold emits concrete `queueOptions`, fresh `init worker -t
bullmq` + `tsc --noEmit` passes with 0 errors (was collateral of the
#2-era duplicate-package skew) |
| 4 | Root workspace globs `apps/*` | Not present on main: the CLI emits
no root pnpm-workspace.yaml and no `apps/*` glob anywhere |
| 5 | Bun temp-dir sandbox blocks module installs | **Mitigated here** |

## Root cause for #1

The placeholder text is written by **pnpm itself**, not the CLI: the
post-init `pnpm format` triggers pnpm 11's auto-install, which blocks
unapproved build scripts and injects `allowBuilds: { esbuild: set this
to true or false, ... }` into the workspace yaml. The CLI then made it
unfixable: every `init service/router/worker` and `change application`
round-tripped the yaml through a `packages`-only struct, silently
dropping `allowBuilds` and any other consumer-added keys.

## Changes

- `generate_pnpm_workspace` seeds `allowBuilds: true` for the scaffold's
known build-script deps, so pnpm never injects placeholders
- The workspace struct preserves unmodeled keys (`overrides`,
`blockExoticSubdeps`, ...) via serde flatten, and every rewrite heals
placeholder string values to `true`
- `change application` renders through the same preserving helper
instead of a from-scratch struct
- `release create` bun installs get a project-local `TMPDIR` so Bun's
temporary-directory sandbox cannot block them
- New fixture test (`init_worker_workspace_and_typecheck.sh`): scaffolds
fresh, asserts no placeholders + `allowBuilds` seeded, asserts survival
across `init worker`/`init service`, poisons the yaml with placeholders
+ foreign keys and asserts healing + preservation, then requires `pnpm
install` and per-project `tsc --noEmit` to pass with zero patches

## Test plan

- `cargo test`: 327 passed
- Fixture script run locally end-to-end: passes (install clean, `tsgo
--noEmit` clean in core/worker/service, full build green)

🤖 Generated with [Claude Code](https://claude.com/claude-code)

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->

## Summary by CodeRabbit

- **New Features**
- Workspace configuration now supports build-script allowlists for safer
dependency installation.
- Existing workspace settings, including custom configuration, are
preserved when projects are initialized or updated.
- Missing workspace package entries and pnpm placeholders are
automatically restored.

- **Bug Fixes**
  - Runtime switching now keeps workspace package definitions intact.
- Bun dependency installation uses a project-local temporary directory,
improving reliability in restricted environments.
  - Invalid build allowlist values are normalized automatically.

<!-- end of auto-generated comment: release notes by coderabbit.ai -->

Co-authored-by: Claude Fable 5 <[email protected]>

…eprint stripe webhook (#244)

## Summary

Fixes the reported defect: routes could not receive raw, unparsed
request bytes, making Stripe/GitHub/Slack-style HMAC signature
verification impossible. All three underlying defects are fixed,
published (`[email protected]`, `[email protected]`, `[email protected]`), and
the blueprint's Stripe webhook now uses the fix.

### Primary fix — raw bytes via the parser `verify` hook
- express `contentParse` builds every body-parser with a `verify` that
stashes the exact request bytes on `req._rawBody`; `req.body` stays the
parsed value; user-supplied `verify` callbacks still run
- hyper-express captures `req._rawBody` via `req.buffer()` before
parsing (body is cached and reused by `json()`/`text()`; multipart
excluded)
- core parse middleware no longer clobbers a parser-captured `_rawBody`
(`??=` keeps the pre-validation body as fallback for adapters without
capture)

### Defect #1 — per-route `contentType` now applies to the dispatched
parser
`body: { text: string, contentType: 'application/json' }` parses
JSON-typed requests as raw text. The override only applies when it
differs from the parser's default, preserving default matching
semantics.

### Defect #2 — application-level parser options reach router parsing
Parsers are now built lazily from `req._globalOptions()` (the mount-time
merge of app+router options) instead of eagerly at construction, so
`forklaunchExpress(sv, otel, { text: { type: [...] } })` works as a
global escape hatch.

### HMAC compatibility
`createHmacToken` signs `Buffer`/`string` bodies verbatim, so
verification over captured raw bytes matches clients that sign an object
and send its stringification — byte-for-byte, and now immune to
validation-time property reordering.

### Blueprint
- Stripe webhook declares `body: { text: string, contentType:
'application/json' }` — `req.body` is the exact payload string
`stripe.webhooks.constructEvent` verifies (previously the route 400'd
before the handler ran)
- Framework deps bumped; also repaired pre-existing typecheck breaks
(reproduced on main with prior dep versions):
`EraseResult`/`ExportResult` spread into `res.json` literals, and
`surfacePermissions`/`surfaceRoles` payload annotations where inference
collapsed to `never`

## Tests
- New `express/__test__/rawBody.webhook.test.ts` (5 tests): parsed body
+ exact raw bytes (formatting preserved), defect #1 route shape, defect
#2 global widening, default content types unbroken, HMAC
raw-bytes/object token equality
- Suites: core 371, express 32 (incl. new), hyper-express 19 (one
pre-existing local uWS port flake on a GET test, reproduced on
unmodified main; CI is unaffected)
- Full blueprint workspace builds green against the published packages

🤖 Generated with [Claude Code](https://claude.com/claude-code)

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

- **Bug Fixes**
- Improved webhook signature verification by preserving exact JSON and
text request payloads.
- Improved compatibility with custom content types and request parsing.
- Standardized successful GDPR export and erasure responses across
billing and identity features.

- **Documentation**
- Added guidance for infrastructure management, local development,
routing, authentication, migrations, and troubleshooting.

- **Chores**
- Updated framework and blueprint components to compatible runtime
versions.
  - Added coverage for raw webhook payload handling and HMAC signing.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->

---------

Co-authored-by: Claude Fable 5 <[email protected]>