@anhcodo13/lattice 0.4.0 → 0.5.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +16 -16
- package/dist/cli.js +350 -75
- package/dist/index.d.ts +47 -22
- package/dist/index.js +395 -178
- package/governance/policy.json +23 -1
- package/package.json +1 -1
package/README.md
CHANGED
|
@@ -1,15 +1,15 @@
|
|
|
1
1
|
# NKLattice
|
|
2
2
|
|
|
3
|
-
NKLattice is an independent, local CLI for project governance and architecture analysis across Next.js, Vite + React, and React applications. Version 0.
|
|
3
|
+
NKLattice is an independent, local CLI for project governance and architecture analysis across Next.js, Vite + React, and React applications. Version 0.5.0 assesses exact app coverage, dependency policy, architecture, known dependency advisories, code quality, code security and browser/mobile-emulation compatibility and automated accessibility on tested routes in standalone repositories and npm/pnpm workspaces. Its compatibility gate records tested browser versions and mobile user-agent OS versions, then compares them with the central test-environment floors; physical-device support remains outside this scan.
|
|
4
4
|
|
|
5
5
|
**Tiếng Việt:** NKLattice đánh giá danh sách app, dependency, kiến trúc, chất lượng và bảo mật mã cùng tính tương thích trình duyệt theo policy chung cho Next.js, Vite và React. Xem [tài liệu tiếng Việt](https://khuchieunghi.github.io/nklattice/vi/docs/introduction/).
|
|
6
6
|
|
|
7
|
-
## Install and run 0.
|
|
7
|
+
## Install and run 0.5.0
|
|
8
8
|
|
|
9
|
-
Requires Node.js 24 or newer. The npm package is `@anhcodo13/lattice` and the executable is `lattice`. Install the exact version, commit the package manifest and lockfile, and create the `.nklattice-apps.json` inventory described in the [governance guide](https://khuchieunghi.github.io/nklattice/docs/governance/). The full assessment also needs the listed scanner and test tools in the consuming repository.
|
|
9
|
+
Requires Node.js 24 or newer. The npm package is `@anhcodo13/lattice` and the executable is `lattice`. Install the exact version, commit the package manifest and lockfile, and create the `.nklattice-apps.json` inventory described in the [governance guide](https://khuchieunghi.github.io/nklattice/docs/governance/). The full assessment also needs the listed scanner and test tools, including `@axe-core/playwright` tests, in the consuming repository. See [managed libraries](https://khuchieunghi.github.io/nklattice/docs/managed-libraries/) and [accessibility evidence](https://khuchieunghi.github.io/nklattice/docs/accessibility/).
|
|
10
10
|
|
|
11
11
|
```sh
|
|
12
|
-
npm install --save-dev --save-exact @anhcodo13/lattice@0.
|
|
12
|
+
npm install --save-dev --save-exact @anhcodo13/lattice@0.5.0
|
|
13
13
|
npx lattice --version
|
|
14
14
|
npx lattice governance run . --policy path/to/reviewed-policy.json \
|
|
15
15
|
--expect-apps 1 --evidence /tmp/lattice-governance-evidence.json
|
|
@@ -25,9 +25,9 @@ The source checkout uses pnpm 10.30.3:
|
|
|
25
25
|
corepack enable
|
|
26
26
|
pnpm install --frozen-lockfile
|
|
27
27
|
pnpm verify
|
|
28
|
-
pnpm dlx @anhcodo13/lattice@0.
|
|
29
|
-
pnpm dlx @anhcodo13/lattice@0.
|
|
30
|
-
pnpm dlx @anhcodo13/lattice@0.
|
|
28
|
+
pnpm dlx @anhcodo13/lattice@0.5.0 doctor examples/governance/apps/vite
|
|
29
|
+
pnpm dlx @anhcodo13/lattice@0.5.0 analyze examples/governance/apps/vite
|
|
30
|
+
pnpm dlx @anhcodo13/lattice@0.5.0 governance check examples/governance \
|
|
31
31
|
--workspace-root examples/governance \
|
|
32
32
|
--policy governance/policy.json --expect-apps 3
|
|
33
33
|
```
|
|
@@ -38,26 +38,26 @@ The analysis writes `report.html` and `analysis.json` into the app's `.nklattice
|
|
|
38
38
|
|
|
39
39
|
## Assess project governance
|
|
40
40
|
|
|
41
|
-
Commit `.nklattice-apps.json` in each consumer scan root with exact app paths/profiles. The centrally reviewed policy sets dependency, architecture, quality, security and
|
|
41
|
+
Commit `.nklattice-apps.json` in each consumer scan root with exact app paths/profiles. The centrally reviewed policy sets dependency, architecture, quality, security, compatibility and accessibility gates; app-local `.nklattice.json` cannot weaken an assessment. Run the combined collector and assessment shown above. The separate `collect` and `assess` commands remain useful for local inspection; the CI gate uses `run` so no editable evidence file is read between collection and verdict.
|
|
42
42
|
|
|
43
|
-
The command evaluates
|
|
43
|
+
The command evaluates eight domains per app and writes `.nklattice-governance/assessment.json` plus offline `report.html`. Exit 0 means pass, 7 measured policy failure and 3 incomplete evidence or command error. See the [project governance guide](https://khuchieunghi.github.io/nklattice/docs/governance/) for scanner setup, inventory schema, scope and limits.
|
|
44
44
|
|
|
45
45
|
## Architecture analysis
|
|
46
46
|
|
|
47
47
|
NKLattice scans supported JS/TS and JSX/TSX files, resolves local imports, builds a module graph, and reports cycles, dependency concentration, long chains, duplicate imports, unused internal exports, component size, JSX depth, and approximate complexity. Define boundary policies and adjust thresholds or score weights in `.nklattice.json`.
|
|
48
48
|
|
|
49
49
|
```sh
|
|
50
|
-
pnpm dlx @anhcodo13/lattice@0.
|
|
51
|
-
pnpm dlx @anhcodo13/lattice@0.
|
|
50
|
+
pnpm dlx @anhcodo13/lattice@0.5.0 init path/to/app
|
|
51
|
+
pnpm dlx @anhcodo13/lattice@0.5.0 analyze path/to/app --output path/to/report
|
|
52
52
|
```
|
|
53
53
|
|
|
54
54
|
The score is an explainable review aid, not a claim about runtime speed or correctness. See [findings](https://khuchieunghi.github.io/nklattice/docs/findings/) and [scoring](https://khuchieunghi.github.io/nklattice/docs/scoring/).
|
|
55
55
|
|
|
56
56
|
## Dependency governance
|
|
57
57
|
|
|
58
|
-
The versioned [central policy](governance/policy.json) sets minimum versions (`>=X.Y.Z`). For each supported app, the CLI checks that
|
|
58
|
+
The versioned [central policy](governance/policy.json) sets minimum versions (`>=X.Y.Z`). For each supported app, the CLI checks mandatory framework packages and conditional managed libraries that the app declares or imports. It checks that each `package.json` range cannot install below the minimum, that the npm/pnpm lockfile specifier matches the declaration, and that the resolved version satisfies both. Exact declarations are allowed when they meet the minimum. It returns exit `7` on drift and exit `3` for invalid input. Findings list the required range, declared range, lockfile specifier, locked version, and reason. A minimum has no upper bound: review framework compatibility and security separately before adopting newer major releases.
|
|
59
59
|
|
|
60
|
-
CLI 0.
|
|
60
|
+
CLI 0.5.0 uses policy schema 2. Existing schema 1 files use exact-version rules and need migration; consumers pinned to an older core SHA or npm package keep their existing behavior until explicitly upgraded.
|
|
61
61
|
|
|
62
62
|
Profiles are `next`, `vite-react`, and `react`. NKLattice can infer them from direct dependencies or read an explicit app profile:
|
|
63
63
|
|
|
@@ -65,11 +65,11 @@ Profiles are `next`, `vite-react`, and `react`. NKLattice can infer them from di
|
|
|
65
65
|
{ "nklattice": { "profile": "next" } }
|
|
66
66
|
```
|
|
67
67
|
|
|
68
|
-
The [reusable governance workflow](.github/workflows/governance-check.yml) requires a reviewed 40-character `core-ref`, an exact inventory and an `expected-apps` count. It builds CLI and policy from that commit, installs the scanner toolchain, collects evidence and gates
|
|
68
|
+
The [reusable governance workflow](.github/workflows/governance-check.yml) requires a reviewed 40-character `core-ref`, an exact inventory and an `expected-apps` count. It builds CLI and policy from that commit, installs the scanner toolchain, collects evidence and gates eight domains. The [consumer workflow template](examples/consumer-workflow.yml) pins both the workflow `uses` ref and `core-ref` to the same SHA, with deployment depending on governance. The consumer must keep the two refs equal. For a pnpm monorepo subtree, pass its root as `--workspace-root` when running the CLI directly.
|
|
69
69
|
|
|
70
70
|
```sh
|
|
71
|
-
pnpm dlx @anhcodo13/lattice@0.
|
|
72
|
-
pnpm dlx @anhcodo13/lattice@0.
|
|
71
|
+
pnpm dlx @anhcodo13/lattice@0.5.0 governance check ./my-app --policy ./governance/policy.json
|
|
72
|
+
pnpm dlx @anhcodo13/lattice@0.5.0 governance check ./monorepo/apps \
|
|
73
73
|
--workspace-root ./monorepo --policy ./governance/policy.json --expect-apps 3 --json
|
|
74
74
|
```
|
|
75
75
|
|