@archpilotlabs/archpilot 0.2.4 → 0.2.5

package/CHANGELOG.md

@@ -1,5 +1,35 @@
 # Changelog
 
+## 0.2.5
+
+### Improved
+
+- Improved Smart Init classification for mixed backend, frontend, and library monorepos.
+- Improved NestJS detection so runtime applications with package publishing metadata are classified as backend services, while reusable NestJS packages remain libraries.
+- Improved component discovery so test-only packages, build and lint tooling, and scaffold templates are excluded from default governed architecture boundaries.
+- Improved backend resource detection for GraphQL APIs and PostgreSQL databases.
+- Improved data-query-risk analysis for parameterized and interpolated query limits, PostgreSQL catalog lookups, and existence queries.
+- Improved source-scope handling for authorization analysis and controller-role detection.
+- Improved CLI version reporting in bundled and packed executables.
+
+### Fixed
+
+- Fixed NestJS backend applications being classified only as Node.js libraries when package entry points or publishing metadata were present.
+- Fixed Playwright test packages, lint-rule packages, build tooling, and nested scaffold templates being proposed as governed components.
+- Fixed authorization findings being emitted from confirmed specification and test source.
+- Fixed bounded SQL queries using parameterized or interpolated `LIMIT` values being reported as unbounded collection reads.
+- Fixed PostgreSQL catalog identity and existence lookups being treated as application collection queries.
+- Fixed generic `handlers` directories being interpreted as controller layers without structural controller evidence.
+- Fixed bundled CLI artifacts reporting a stale version because package metadata could not be resolved at runtime.
+
+### Notes
+
+- These changes improve model and finding accuracy without changing rule IDs, severities, score weights, scoring caps, or normalization behavior.
+- Oversized services, direct persistence access, unbounded collection processing, repeated query patterns, and dependency-boundary violations remain reportable when supported by credible evidence.
+- Documentation, examples, integration tests, and tooling remain governed when explicitly included by the generated or reviewed architecture configuration.
+
+---
+
 ## 0.2.4
 
 ### Improved

package/dist/archpilot-cli.js

@@ -225656,7 +225656,12 @@ function hasSelectStar(statement) {
   return /\bselect\s+(distinct\s+)?\*/i.test(statement);
 }
 function hasPaginationEvidence(statement) {
-  return /\blimit\s+\d+\b|\boffset\s+\d+\b|\bfetch\s+(first|next)\b|\btop\s+\d+\b/i.test(
+  const boundValuePattern = "(?:\\d+|\\$\\d+|\\?|:[A-Za-z_]\\w*|@[A-Za-z_]\\w*|\\$\\{[^}]{1,120}\\}|[A-Za-z_]\\w*)";
+  const valueTerminatorPattern = "(?=\\s|,|;|\\)|$)";
+  return new RegExp(
+    `\\blimit\\s+${boundValuePattern}${valueTerminatorPattern}|\\boffset\\s+${boundValuePattern}${valueTerminatorPattern}|\\bfetch\\s+(first|next)\\b|\\btop\\s+${boundValuePattern}${valueTerminatorPattern}`,
+    "i"
+  ).test(
     statement
   );
 }
@@ -225667,10 +225672,17 @@ function hasEqualityPredicate(statement, columnPattern) {
   ).test(statement);
 }
 function isCatalogIdentifierPointLookup(statement) {
-  return /\bfrom\s+information_schema\.schemata\b/iu.test(statement) && hasEqualityPredicate(statement, "schema_name");
+  const metadataSourcePattern = /\bfrom\s+(?:information_schema\.(?:schemata|tables|columns|key_column_usage|table_constraints)|pg_catalog\.(?:pg_class|pg_namespace|pg_attribute|pg_constraint|pg_type|pg_enum|pg_tables|pg_indexes)|pg_(?:class|namespace|attribute|constraint|type|enum|tables|indexes))\b/iu;
+  if (!metadataSourcePattern.test(statement)) {
+    return false;
+  }
+  return hasEqualityPredicate(statement, "schema_name|table_schema|table_name|column_name|constraint_name") || hasEqualityPredicate(statement, "schemaname|tablename|relname|nspname|attname|conname|typname|enumlabel|indexname");
 }
 function isObviousPointLookup(statement) {
   const normalized = statement.toLowerCase();
+  if (/\bselect\s+exists\s*\(/i.test(normalized)) {
+    return true;
+  }
   if (!normalized.includes("where")) {
     return false;
   }
@@ -227467,6 +227479,7 @@ var import_node_fs26 = require("node:fs");
 var ts4 = __toESM(require_typescript());
 init_moduleDiscovery();
 init_archpilotIgnore();
+init_sourceScopeClassification();
 var RuleIds = {
   AUTH_MISSING_ENFORCEMENT: "AP-AUTH-001",
   AUTH_INCONSISTENT_ENFORCEMENT: "AP-AUTH-002",
@@ -227897,7 +227910,10 @@ function isProtectedLooking(endpoint) {
 }
 function detectAuthorizationFindings(files, contract, astCache) {
   const findings = [];
-  for (const file of files) {
+  const productionFiles = files.filter(
+    (file) => isProductionBackendGovernanceScope(classifyValidationSourceScope(file.relativePath))
+  );
+  for (const file of productionFiles) {
     const moduleName = inferModuleForPath3(contract, file.relativePath);
     const endpoints = extractEndpoints(file, moduleName);
     if (endpoints.length === 0 && !isControllerFile(file, astCache)) {
@@ -227932,7 +227948,7 @@ function detectAuthorizationFindings(files, contract, astCache) {
       }
     }
   }
-  for (const file of files.filter((candidate) => isRepositoryFile(candidate, astCache))) {
+  for (const file of productionFiles.filter((candidate) => isRepositoryFile(candidate, astCache))) {
     const roleMatch = executableAuthorizationDecisionPattern.exec(file.content);
     if (!roleMatch) {
       continue;
@@ -228415,7 +228431,7 @@ function classifySourceFile2(file, contract, astCache) {
   const scope = classifyValidationSourceScope(file.relativePath);
   const roles = new Set(getDeclaredRoles2(file, astCache));
   const lowerPath = file.relativePath.toLowerCase();
-  if (/(^|[./_-])controller\.(ts|tsx|js|jsx|mjs|cjs|java|cs|py|php|go)$/u.test(lowerPath) || /(^|\/)(controllers?|routers?|routes?|handlers?)\//u.test(lowerPath)) {
+  if (/(^|[./_-])controller\.(ts|tsx|js|jsx|mjs|cjs|java|cs|py|php|go)$/u.test(lowerPath) || /(^|\/)(controllers?|routers?|routes?)\//u.test(lowerPath)) {
     roles.add("controller");
   }
   if (/(^|[./_-])service\.(ts|tsx|js|jsx|mjs|cjs|java|cs|py|php|go)$/u.test(lowerPath) || /(^|\/)(services?)\//u.test(lowerPath)) {
@@ -245651,6 +245667,14 @@ function hasObject(value) {
 function hasPackagePublishSurface(packageJson) {
   return hasObject(packageJson?.exports) || typeof packageJson?.main === "string" || typeof packageJson?.module === "string" || typeof packageJson?.types === "string" || hasObject(packageJson?.publishConfig) || Array.isArray(packageJson?.files);
 }
+function packageDependencyNames(packageJson) {
+  return [
+    ...recordKeys(packageJson?.dependencies),
+    ...recordKeys(packageJson?.devDependencies),
+    ...recordKeys(packageJson?.peerDependencies),
+    ...recordKeys(packageJson?.optionalDependencies)
+  ];
+}
 function absoluteComponentRoot(workspaceRoot, componentPath) {
   return componentPath === "." ? workspaceRoot : path64.join(workspaceRoot, ...componentPath.split("/"));
 }
@@ -245658,6 +245682,10 @@ function readPackageJson(workspaceRoot, componentPath) {
   const absoluteRoot = absoluteComponentRoot(workspaceRoot, componentPath);
   return safeReadJson(path64.join(absoluteRoot, "package.json"));
 }
+function readProjectJson(workspaceRoot, componentPath) {
+  const absoluteRoot = absoluteComponentRoot(workspaceRoot, componentPath);
+  return safeReadJson(path64.join(absoluteRoot, "project.json"));
+}
 function readTextFileSafe(filePath) {
   try {
     return fs58.readFileSync(filePath, { encoding: "utf8" });
@@ -246225,11 +246253,57 @@ function hasRuntimeSourceFiles(workspaceRoot, componentPath) {
   }
   return false;
 }
+function hasFileMatchingUnderRoot(root, pattern) {
+  if (!pathExists19(root)) {
+    return false;
+  }
+  const entries = fs58.readdirSync(root, { recursive: true, withFileTypes: true });
+  return entries.some((entry) => entry.isFile() && pattern.test(normalizePath25(path64.join(entry.parentPath, entry.name))));
+}
+function hasNestRuntimeApplicationEvidence(workspaceRoot, componentPath, packageJson = readPackageJson(workspaceRoot, componentPath)) {
+  const absoluteRoot = absoluteComponentRoot(workspaceRoot, componentPath);
+  const dependencies = new Set(packageDependencyNames(packageJson));
+  const scripts = recordKeys(packageJson?.scripts);
+  const hasNestCore = dependencies.has("@nestjs/core");
+  if (!hasNestCore) {
+    return false;
+  }
+  const hasRuntimePlatform = dependencies.has("@nestjs/platform-express") || dependencies.has("@nestjs/platform-fastify") || dependencies.has("@nestjs/microservices") || dependencies.has("@nestjs/graphql") || dependencies.has("@nestjs/apollo");
+  const hasRunnableScript = scripts.some((script) => /^(?:start|serve|dev|worker)(?::|$)/u.test(script));
+  const hasNestCliConfig = ["nest-cli.json", "nest.config.js", "nest.config.ts"].some(
+    (fileName) => pathExists19(path64.join(absoluteRoot, fileName))
+  );
+  const hasBootstrapEntrypoint = [
+    path64.join(absoluteRoot, "src", "main.ts"),
+    path64.join(absoluteRoot, "src", "main.js"),
+    path64.join(absoluteRoot, "main.ts"),
+    path64.join(absoluteRoot, "main.js")
+  ].some((filePath) => {
+    const contents = readTextFileSafe(filePath);
+    return Boolean(contents && /\bNestFactory\.create(?:ApplicationContext)?\s*\(/u.test(contents));
+  });
+  const srcRoot = path64.join(absoluteRoot, "src");
+  const hasRuntimeSourceShape = hasFileMatchingUnderRoot(srcRoot, /\.(?:controller|resolver|gateway|processor|module|worker|queue)\.(?:ts|js)$/iu) || hasFileMatchingUnderRoot(srcRoot, /[/\\](?:controllers?|resolvers?|queues?|workers?)[/\\][^/\\]+\.(?:ts|js)$/iu);
+  const hasDatabaseRuntimeIntegration = [...dependencies].some(
+    (dependency) => /^(?:typeorm|@nestjs\/typeorm|@prisma\/client|prisma|mongoose|@nestjs\/mongoose|sequelize|@mikro-orm\/core)$/u.test(dependency)
+  );
+  const structuralEvidenceCount = [
+    hasRuntimePlatform,
+    hasRunnableScript,
+    hasNestCliConfig,
+    hasBootstrapEntrypoint,
+    hasRuntimeSourceShape,
+    hasDatabaseRuntimeIntegration
+  ].filter(Boolean).length;
+  return hasBootstrapEntrypoint || hasRuntimePlatform && structuralEvidenceCount >= 2 || hasRunnableScript && hasRuntimeSourceShape && structuralEvidenceCount >= 3;
+}
 function resolveKind(workspaceRoot, candidate, localProjectKinds) {
   const lowerPath = candidate.path.toLowerCase();
   const packageJson = readPackageJson(workspaceRoot, candidate.path);
   const maven = readMavenMetadata(workspaceRoot, candidate.path);
+  const dependencies = new Set(packageDependencyNames(packageJson));
   const hasRunnableFrontendEvidence = hasRunnableFrontendComponentEvidence(workspaceRoot, candidate.path);
+  const hasNestRuntimeEvidence = hasNestRuntimeApplicationEvidence(workspaceRoot, candidate.path, packageJson);
   const hasPublishSurface = hasPackagePublishSurface(packageJson);
   const hasMavenRunnableEvidence = Boolean(
     maven && (hasMavenMainEntrypoint(workspaceRoot, candidate.path) || hasMavenConfiguredMainClassEntrypoint(workspaceRoot, candidate.path, maven.configuredMainClass) || maven.hasSpringBootPlugin && maven.hasSpringBootRepackageGoal && hasMavenMainEntrypoint(workspaceRoot, candidate.path) || maven.packaging === "war" && hasMavenMainEntrypoint(workspaceRoot, candidate.path))
@@ -246251,6 +246325,12 @@ function resolveKind(workspaceRoot, candidate, localProjectKinds) {
     return hasPublishSurface && !hasRunnableFrontendEvidence ? "library" : "frontend";
   }
   if (classification === "backend_app") {
+    if (hasPublishSurface && dependencies.has("@nestjs/core") && !hasNestRuntimeEvidence) {
+      return "library";
+    }
+    return "backend";
+  }
+  if (hasNestRuntimeEvidence) {
     return "backend";
   }
   if (hasRunnableFrontendEvidence && localProjectKinds.primaryKind !== "backend" && localProjectKinds.primaryKind !== "service" && localProjectKinds.primaryKind !== "cli") {
@@ -246314,6 +246394,7 @@ function hasAnyToken(value, patterns) {
 }
 function classifyGovernanceRole(input2) {
   const packageJson = readPackageJson(input2.workspaceRoot, input2.candidate.path);
+  const projectJson = readProjectJson(input2.workspaceRoot, input2.candidate.path);
   const maven = readMavenMetadata(input2.workspaceRoot, input2.candidate.path);
   const evidence = [];
   let supportScore = 0;
@@ -246327,11 +246408,15 @@ function classifyGovernanceRole(input2) {
   const scripts = recordKeys(packageJson?.scripts);
   const dependencies = recordKeys(packageJson?.dependencies);
   const devDependencies = recordKeys(packageJson?.devDependencies);
+  const projectTags = toStringArray(projectJson?.tags);
+  const projectTargets = recordKeys(projectJson?.targets);
   const scriptText = scripts.join(" ").toLowerCase();
+  const projectMetadataText = `${projectTags.join(" ")} ${projectTargets.join(" ")}`.toLowerCase();
   const dependencyText = [...dependencies, ...devDependencies].join(" ").toLowerCase();
+  const hasNestRuntimeEvidence = hasNestRuntimeApplicationEvidence(input2.workspaceRoot, input2.candidate.path, packageJson);
   const hasStrongSupportPath = hasAnyToken(pathText, [
-    /(^|\/)(testing|test-plugins|cypress-tests|fixtures?|examples?|benchmarks?|smoke)(\/|$)/u,
-    /(^|\/)(dev-server|scaffold|scaffolding|generators?|devkit|tooling|tools)(\/|$)/u
+    /(^|\/)(testing|e2e-testing|test-plugins|cypress-tests|fixtures?|benchmarks?|smoke)(\/|$)/u,
+    /(^|\/)(dev-server|scaffold|scaffolding|generators?|devkit|tooling|tools|templates?)(\/|$)/u
   ]);
   const isPlainResourcesSurface = isUnderJvmResourceRoot4(pathText) && !hasRuntimeSourceFiles(input2.workspaceRoot, input2.candidate.path) && !packageJson && !maven;
   const hasPublishSurface = hasPackagePublishSurface(packageJson);
@@ -246376,6 +246461,10 @@ function classifyGovernanceRole(input2) {
     runtimeScore += 1;
     addEvidence6(evidence, `Runtime framework stack signal: ${input2.stack}`);
   }
+  if (hasNestRuntimeEvidence) {
+    runtimeScore += 3;
+    addEvidence6(evidence, "NestJS runtime application evidence");
+  }
   if (hasPublishSurface && !isPrivate) {
     runtimeScore += 1;
     addEvidence6(evidence, "Published package surface signal");
@@ -246400,25 +246489,37 @@ function classifyGovernanceRole(input2) {
   if (hasMavenAutoConfigurationEvidence && !hasMavenRunnableApplicationEvidence) {
     addEvidence6(evidence, "Maven Spring Boot auto-configuration/starter library evidence");
   }
-  if (hasAnyToken(descriptiveManifestText, [/\b(e2e|end-to-end|testing|test helper|test utilities|fixtures?)\b/u])) {
+  if (hasAnyToken(descriptiveManifestText, [/\b(e2e|end-to-end|testing|test helper|test utilities|fixtures?|test harness)\b/u])) {
     supportScore += 3;
     addEvidence6(evidence, "Package metadata describes test/support usage");
   }
+  if (hasAnyToken(`${packageName.toLowerCase()} ${projectMetadataText}`, [/\b(e2e|end-to-end|testing|test harness|scope:testing|test:ui|test:debug|test:report)\b/u]) && hasAnyToken(dependencyText, [/\b(?:playwright|@playwright\/test|cypress|vitest|jest|mocha)\b/u])) {
+    supportScore += 4;
+    addEvidence6(evidence, "Project metadata and dependencies indicate test-only workspace");
+  }
   if (hasAnyToken(descriptiveManifestText, [/\b(scaffold|scaffolding|generator|codegen|template|starter|create)\b/u])) {
     supportScore += 3;
     addEvidence6(evidence, "Package metadata describes scaffolding/generation usage");
   }
-  if (hasAnyToken(descriptiveManifestText, [/\b(dev server|development server|development tooling|tooling|devkit)\b/u])) {
+  if (hasAnyToken(descriptiveManifestText, [/\b(dev server|development server|development tooling|tooling|devkit|lint rules?|linter|build tooling|repository tooling)\b/u])) {
     supportScore += 2;
     addEvidence6(evidence, "Package metadata describes development/tooling usage");
   }
   if (hasAnyToken(pathText, [
-    /(^|\/)(test|tests|testing|__tests__|cypress|cypress-tests|fixtures?|examples?|benchmarks?|smoke)(\/|$)/u,
-    /(^|\/)(dev-server|test-plugins|scaffold|scaffolding|generators?|devkit|tooling|tools)(\/|$)/u
+    /(^|\/)(test|tests|testing|e2e-testing|__tests__|cypress|cypress-tests|fixtures?|benchmarks?|smoke)(\/|$)/u,
+    /(^|\/)(dev-server|test-plugins|scaffold|scaffolding|generators?|devkit|tooling|tools|templates?)(\/|$)/u
   ])) {
     supportScore += 1;
     addEvidence6(evidence, "Path contains support/tooling role tokens");
   }
+  if (hasAnyToken(pathText, [/(^|\/)(?:src\/constants\/)?templates?(\/|$)/u])) {
+    supportScore += 4;
+    addEvidence6(evidence, "Nested scaffold/template source surface");
+  }
+  if (hasAnyToken(dependencyText, [/\b(?:eslint|oxlint|prettier|typescript-eslint|ts-morph|jscodeshift|schematics|yeoman)\b/u])) {
+    supportScore += 2;
+    addEvidence6(evidence, "Package dependencies indicate lint/build/generation tooling");
+  }
   if (scripts.length > 0 && scripts.every((script) => /^(test|e2e|smoke|bench|benchmark|lint|typecheck|dev|dev:|load-test|generate|scaffold)/u.test(script))) {
     supportScore += 1;
     addEvidence6(evidence, "Package scripts are dominated by development/test workflows");
@@ -250154,6 +250255,9 @@ function readFlagValue(args, flag) {
   return value && value.length > 0 ? value : void 0;
 }
 async function readCliPackageVersion() {
+  if ("0.2.5".trim().length > 0) {
+    return "0.2.5".trim();
+  }
   const candidatePackageJsonPaths = [
     path73.join(__dirname, "..", "package.json"),
     path73.join(__dirname, "..", "..", "..", "..", "cli", "package.json")

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@archpilotlabs/archpilot",
-  "version": "0.2.4",
+  "version": "0.2.5",
   "description": "Executable architecture governance CLI for Smart Init, validation, drift detection, and CI.",
   "homepage": "https://archpilot.org",
   "bugs": {