@birdapi/velinstyle 1.2.2 → 1.3.0

package/core/security/rules/publish/index.js

@@ -0,0 +1,230 @@
+import { registerSecurityRule } from '../../registry.js';
+import { fileExists, readJson, readText } from '../../checks/fs.js';
+import { join } from 'path';
+import { execSync } from 'child_process';
+
+export function registerPublishRules() {
+  registerSecurityRule({
+    id: 'publish.readme',
+    category: 'publish',
+    severity: 'error',
+    modes: ['repo', 'publish', 'audit'],
+    title: 'README',
+    run(ctx) {
+      if (fileExists(join(ctx.root, 'README.md'))) return [];
+      return [{
+        ruleId: 'publish.readme',
+        category: 'publish',
+        severity: 'error',
+        message: 'README.md missing',
+        path: 'README.md',
+      }];
+    },
+  });
+
+  registerSecurityRule({
+    id: 'publish.changelog',
+    category: 'publish',
+    severity: 'error',
+    modes: ['repo', 'publish', 'audit'],
+    title: 'CHANGELOG',
+    run(ctx) {
+      if (fileExists(join(ctx.root, 'CHANGELOG.md'))) return [];
+      return [{
+        ruleId: 'publish.changelog',
+        category: 'publish',
+        severity: 'error',
+        message: 'CHANGELOG.md missing',
+        path: 'CHANGELOG.md',
+      }];
+    },
+  });
+
+  registerSecurityRule({
+    id: 'publish.security-md',
+    category: 'publish',
+    severity: 'error',
+    modes: ['repo', 'publish', 'audit'],
+    title: 'SECURITY.md',
+    run(ctx) {
+      if (fileExists(join(ctx.root, 'SECURITY.md'))) return [];
+      return [{
+        ruleId: 'publish.security-md',
+        category: 'publish',
+        severity: 'error',
+        message: 'SECURITY.md missing',
+        path: 'SECURITY.md',
+      }];
+    },
+  });
+
+  registerSecurityRule({
+    id: 'publish.license',
+    category: 'publish',
+    severity: 'error',
+    modes: ['repo', 'publish', 'audit'],
+    title: 'LICENSE',
+    run(ctx) {
+      const pkg = readJson(join(ctx.root, 'package.json')) || {};
+      if (fileExists(join(ctx.root, 'LICENSE')) || fileExists(join(ctx.root, 'LICENSE.md')) || pkg.license) {
+        return [];
+      }
+      return [{
+        ruleId: 'publish.license',
+        category: 'publish',
+        severity: 'error',
+        message: 'LICENSE file / package.json license missing',
+        path: 'LICENSE',
+      }];
+    },
+  });
+
+  registerSecurityRule({
+    id: 'publish.release-notes',
+    category: 'publish',
+    severity: 'warning',
+    modes: ['repo', 'publish', 'audit'],
+    title: 'Release notes',
+    run(ctx) {
+      const pkg = readJson(join(ctx.root, 'package.json')) || {};
+      const v = pkg.version;
+      if (!v) return [];
+      const notes = fileExists(join(ctx.root, `RELEASE_NOTES_${v}.md`));
+      const cl = readText(join(ctx.root, 'CHANGELOG.md')) || '';
+      if (notes || cl.includes(`[${v}]`)) return [];
+      return [{
+        ruleId: 'publish.release-notes',
+        category: 'publish',
+        severity: 'warning',
+        message: `No RELEASE_NOTES_${v}.md and no CHANGELOG entry for [${v}]`,
+        fix: 'Add release notes before publish',
+      }];
+    },
+  });
+
+  registerSecurityRule({
+    id: 'publish.version-tag',
+    category: 'publish',
+    severity: 'warning',
+    modes: ['repo', 'publish', 'audit'],
+    title: 'Git tag matches version',
+    run(ctx) {
+      const pkg = readJson(join(ctx.root, 'package.json')) || {};
+      const v = pkg.version;
+      if (!v) return [];
+      try {
+        const tag = execSync(`git tag -l "v${v}"`, { cwd: ctx.root, encoding: 'utf-8', stdio: ['ignore', 'pipe', 'ignore'] }).trim();
+        if (tag) return [];
+        return [{
+          ruleId: 'publish.version-tag',
+          category: 'publish',
+          severity: 'warning',
+          message: `Git tag v${v} not found yet`,
+          fix: `Create annotated tag v${v} before npm publish from CI`,
+        }];
+      } catch {
+        return [];
+      }
+    },
+  });
+
+  registerSecurityRule({
+    id: 'publish.clean-tree',
+    category: 'publish',
+    severity: 'warning',
+    modes: ['repo', 'publish', 'audit'],
+    title: 'Working tree clean',
+    run(ctx) {
+      try {
+        const dirty = execSync('git status --porcelain', { cwd: ctx.root, encoding: 'utf-8', stdio: ['ignore', 'pipe', 'ignore'] }).trim();
+        if (!dirty) return [];
+        return [{
+          ruleId: 'publish.clean-tree',
+          category: 'publish',
+          severity: 'warning',
+          message: 'Working tree has uncommitted changes',
+          fix: 'Commit or stash before release',
+        }];
+      } catch {
+        return [];
+      }
+    },
+  });
+
+  registerSecurityRule({
+    id: 'publish.private-flag',
+    category: 'publish',
+    severity: 'error',
+    modes: ['repo', 'publish', 'audit'],
+    title: 'Not private',
+    run(ctx) {
+      const pkg = readJson(join(ctx.root, 'package.json')) || {};
+      if (pkg.private === true) {
+        return [{
+          ruleId: 'publish.private-flag',
+          category: 'publish',
+          severity: 'error',
+          message: 'package.json has "private": true — npm publish will fail',
+          path: 'package.json',
+        }];
+      }
+      return [];
+    },
+  });
+
+  registerSecurityRule({
+    id: 'publish.pack-dry-run',
+    category: 'publish',
+    severity: 'error',
+    modes: ['repo', 'publish', 'audit'],
+    title: 'npm pack dry-run',
+    run(ctx) {
+      if (!fileExists(join(ctx.root, 'package.json'))) {
+        return [{
+          ruleId: 'publish.pack-dry-run',
+          category: 'publish',
+          severity: 'warning',
+          message: 'package.json missing — cannot run npm pack --dry-run',
+          path: 'package.json',
+        }];
+      }
+      try {
+        execSync('npm pack --dry-run', {
+          cwd: ctx.root,
+          encoding: 'utf-8',
+          timeout: 30_000,
+          stdio: ['ignore', 'pipe', 'pipe'],
+        });
+        return [];
+      } catch (err) {
+        const status = err?.status;
+        const stderr = String(err?.stderr || err?.message || '').trim().slice(0, 400);
+        if (err?.code === 'ENOENT') {
+          return [{
+            ruleId: 'publish.pack-dry-run',
+            category: 'publish',
+            severity: 'warning',
+            message: 'npm not available — skipped pack dry-run',
+            fix: 'Install npm or run pack dry-run on a machine with Node/npm',
+          }];
+        }
+        if (err?.killed || err?.signal === 'SIGTERM' || /ETIMEDOUT|timed out/i.test(String(err?.message))) {
+          return [{
+            ruleId: 'publish.pack-dry-run',
+            category: 'publish',
+            severity: 'warning',
+            message: 'npm pack --dry-run timed out',
+            fix: 'Retry with network available or inspect package files locally',
+          }];
+        }
+        return [{
+          ruleId: 'publish.pack-dry-run',
+          category: 'publish',
+          severity: status ? 'error' : 'warning',
+          message: `npm pack --dry-run failed${status != null ? ` (exit ${status})` : ''}${stderr ? `: ${stderr}` : ''}`,
+          fix: 'Fix pack errors (files, package.json) before publish',
+        }];
+      }
+    },
+  });
+}

package/core/security/rules/repo/index.js

@@ -0,0 +1,143 @@
+import { registerSecurityRule } from '../../registry.js';
+import { fileExists, readJson, readText, walkFiles, rel } from '../../checks/fs.js';
+import { join } from 'path';
+
+export function registerRepoRules() {
+  registerSecurityRule({
+    id: 'repo.package-json',
+    category: 'repo',
+    severity: 'error',
+    modes: ['repo', 'consumer', 'audit'],
+    title: 'package.json',
+    run(ctx) {
+      if (fileExists(join(ctx.root, 'package.json'))) return [];
+      return [{
+        ruleId: 'repo.package-json',
+        category: 'repo',
+        severity: 'error',
+        message: 'package.json missing',
+        path: 'package.json',
+      }];
+    },
+  });
+
+  registerSecurityRule({
+    id: 'repo.codeowners',
+    category: 'repo',
+    severity: 'info',
+    modes: ['repo', 'audit'],
+    title: 'CODEOWNERS',
+    run(ctx) {
+      if (
+        fileExists(join(ctx.root, 'CODEOWNERS'))
+        || fileExists(join(ctx.root, '.github', 'CODEOWNERS'))
+      ) return [];
+      return [{
+        ruleId: 'repo.codeowners',
+        category: 'repo',
+        severity: 'info',
+        message: 'CODEOWNERS not found',
+        fix: 'Add .github/CODEOWNERS for review ownership',
+      }];
+    },
+  });
+
+  registerSecurityRule({
+    id: 'repo.dependabot',
+    category: 'repo',
+    severity: 'info',
+    modes: ['repo', 'audit'],
+    title: 'Dependabot / Renovate',
+    run(ctx) {
+      if (
+        fileExists(join(ctx.root, '.github', 'dependabot.yml'))
+        || fileExists(join(ctx.root, 'renovate.json'))
+        || fileExists(join(ctx.root, '.github', 'renovate.json'))
+      ) return [];
+      return [{
+        ruleId: 'repo.dependabot',
+        category: 'repo',
+        severity: 'info',
+        message: 'No Dependabot/Renovate config',
+        fix: 'Enable dependency update automation',
+      }];
+    },
+  });
+
+  registerSecurityRule({
+    id: 'repo.backup-files',
+    category: 'repo',
+    severity: 'warning',
+    modes: ['repo', 'consumer', 'audit', 'scan'],
+    title: 'Backup / debug files',
+    run(ctx) {
+      const files = walkFiles(
+        ctx.root,
+        (n) => /\.(bak|old|tmp|swp)$/i.test(n) || /^debug\.log$/i.test(n),
+        40,
+      );
+      return files.map((abs) => ({
+        ruleId: 'repo.backup-files',
+        category: 'repo',
+        severity: 'warning',
+        message: 'Backup/debug file in tree',
+        path: rel(ctx.root, abs),
+        fix: 'Delete or gitignore',
+      }));
+    },
+  });
+
+  registerSecurityRule({
+    id: 'repo.exec-spawn',
+    category: 'repo',
+    severity: 'info',
+    modes: ['repo', 'audit'],
+    title: 'child_process usage',
+    run(ctx) {
+      const files = walkFiles(
+        ctx.root,
+        (n, abs) => /\.(js|mjs|cjs)$/i.test(n) && !abs.includes(`${join('node_modules')}`),
+        120,
+      );
+      const findings = [];
+      for (const abs of files) {
+        const t = readText(abs);
+        if (!t) continue;
+        if (/child_process|execSync|spawnSync|\bexec\(|\bspawn\(/.test(t)) {
+          const path = rel(ctx.root, abs);
+          if (path.startsWith('cli/') || path.startsWith('scripts/') || path.startsWith('core/security/')) {
+            continue; // allowlisted tooling
+          }
+          findings.push({
+            ruleId: 'repo.exec-spawn',
+            category: 'repo',
+            severity: 'info',
+            message: 'Process spawn/exec detected — review for injection',
+            path,
+          });
+        }
+      }
+      return findings.slice(0, 25);
+    },
+  });
+
+  registerSecurityRule({
+    id: 'repo.publishconfig',
+    category: 'repo',
+    severity: 'info',
+    modes: ['repo', 'publish', 'audit'],
+    title: 'publishConfig',
+    run(ctx) {
+      const pkg = readJson(join(ctx.root, 'package.json'));
+      if (!pkg || pkg.name !== '@birdapi/velinstyle') return [];
+      if (pkg.publishConfig?.access === 'public') return [];
+      return [{
+        ruleId: 'repo.publishconfig',
+        category: 'repo',
+        severity: 'info',
+        message: 'Consider publishConfig.access=public for scoped package',
+        path: 'package.json',
+      }];
+    },
+  });
+}

package/core/security/rules/secrets/index.js

@@ -0,0 +1,133 @@
+import { registerSecurityRule } from '../../registry.js';
+import { fileExists, readText, walkFiles, rel } from '../../checks/fs.js';
+import { join } from 'path';
+
+const SECRET_RE =
+  /(?:api[_-]?key|secret|token|password|passwd|auth[_-]?token)\s*[=:]\s*['"][^'"]{8,}['"]/i;
+const AWS_RE = /AKIA[0-9A-Z]{16}/;
+const PRIVATE_KEY = /-----BEGIN (?:RSA |OPENSSH )?PRIVATE KEY-----/;
+
+export function registerSecretsRules() {
+  registerSecurityRule({
+    id: 'secrets.env-tracked',
+    category: 'secrets',
+    severity: 'error',
+    modes: ['repo', 'consumer', 'secrets', 'audit', 'publish'],
+    title: 'Tracked .env',
+    description: '.env must not be committed.',
+    run(ctx) {
+      const findings = [];
+      for (const name of ['.env', '.env.local', '.env.production']) {
+        const p = join(ctx.root, name);
+        if (fileExists(p)) {
+          findings.push({
+            ruleId: 'secrets.env-tracked',
+            category: 'secrets',
+            severity: 'error',
+            message: `${name} exists in project root — ensure it is gitignored and not committed`,
+            path: name,
+            fix: 'Add to .gitignore; use secrets manager / CI secrets',
+          });
+        }
+      }
+      return findings;
+    },
+  });
+
+  registerSecurityRule({
+    id: 'secrets.gitignore-env',
+    category: 'secrets',
+    severity: 'warning',
+    modes: ['repo', 'consumer', 'secrets', 'audit'],
+    title: '.gitignore covers .env',
+    run(ctx) {
+      const gi = readText(join(ctx.root, '.gitignore')) || '';
+      if (!gi.includes('.env')) {
+        return [{
+          ruleId: 'secrets.gitignore-env',
+          category: 'secrets',
+          severity: 'warning',
+          message: '.gitignore does not mention .env',
+          path: '.gitignore',
+          fix: 'Add .env and .env.* to .gitignore',
+        }];
+      }
+      return [];
+    },
+  });
+
+  registerSecurityRule({
+    id: 'secrets.npmrc-auth',
+    category: 'secrets',
+    severity: 'error',
+    modes: ['repo', 'consumer', 'secrets', 'audit', 'publish'],
+    title: 'npmrc auth token',
+    run(ctx) {
+      const findings = [];
+      for (const name of ['.npmrc', '.npmrc.local']) {
+        const t = readText(join(ctx.root, name));
+        if (t && /_authToken|_auth\s*=|\/\/.*:_password=/i.test(t)) {
+          findings.push({
+            ruleId: 'secrets.npmrc-auth',
+            category: 'secrets',
+            severity: 'error',
+            message: `${name} contains auth credentials`,
+            path: name,
+            fix: 'Use env NPM_TOKEN; never commit tokens',
+          });
+        }
+      }
+      return findings;
+    },
+  });
+
+  registerSecurityRule({
+    id: 'secrets.hardcoded',
+    category: 'secrets',
+    severity: 'error',
+    modes: ['repo', 'consumer', 'secrets', 'scan', 'audit'],
+    title: 'Hardcoded secrets',
+    run(ctx) {
+      const findings = [];
+      const files = walkFiles(
+        ctx.root,
+        (n) => /\.(js|mjs|cjs|ts|json|env|yml|yaml|sh|ps1|html)$/i.test(n),
+        200,
+      );
+      for (const abs of files) {
+        const t = readText(abs);
+        if (!t) continue;
+        if (PRIVATE_KEY.test(t) || AWS_RE.test(t) || SECRET_RE.test(t)) {
+          findings.push({
+            ruleId: 'secrets.hardcoded',
+            category: 'secrets',
+            severity: 'error',
+            message: 'Possible hardcoded secret or private key',
+            path: rel(ctx.root, abs),
+            fix: 'Remove secret; rotate if exposed',
+          });
+        }
+      }
+      return findings;
+    },
+  });
+
+  registerSecurityRule({
+    id: 'secrets.pem-files',
+    category: 'secrets',
+    severity: 'error',
+    modes: ['repo', 'consumer', 'secrets', 'audit'],
+    title: 'PEM / key files',
+    run(ctx) {
+      const files = walkFiles(ctx.root, (n) => /\.(pem|key|p12|pfx)$/i.test(n), 50);
+      return files.map((abs) => ({
+        ruleId: 'secrets.pem-files',
+        category: 'secrets',
+        severity: 'error',
+        message: 'Key/certificate file present in tree',
+        path: rel(ctx.root, abs),
+        fix: 'Store outside repo / use secret store',
+      }));
+    },
+  });
+}

package/core/security/score/dependency-health.js

@@ -0,0 +1,53 @@
+/**
+ * Dependency Health summary from findings + package.json heuristics.
+ * Note: "outdated" here is heuristic (message/code), not live `npm outdated`.
+ */
+import { join } from 'path';
+import { fileExists, readJson } from '../checks/fs.js';
+
+/**
+ * @param {string} root
+ * @param {import('../registry.js').SecurityFinding[]} findings
+ */
+export function computeDependencyHealth(root, findings) {
+  const depFindings = findings.filter(
+    (f) =>
+      (f.category === 'deps' || f.ruleId?.startsWith('deps.'))
+      || f.category === 'malware'
+      || f.ruleId?.includes('lifecycle')
+      || f.ruleId?.includes('lockfile')
+      || f.ruleId?.includes('typosquat'),
+  );
+
+  const pkg = readJson(join(root, 'package.json')) || {};
+  const hasLock = fileExists(join(root, 'package-lock.json')) || fileExists(join(root, 'pnpm-lock.yaml')) || fileExists(join(root, 'yarn.lock'));
+
+  let deprecated = depFindings.filter((f) => /deprecat/i.test(f.message) || f.code === 'deprecated').length;
+  let noLockfile = depFindings.filter((f) => f.code === 'no-lockfile' || f.ruleId === 'deps.lockfile').length;
+  if (!hasLock && noLockfile === 0) noLockfile = 1;
+  // Heuristic "outdated" only when explicitly coded/messaged — not lockfile absence
+  let outdated = depFindings.filter((f) =>
+    f.code === 'outdated' || (/outdated/i.test(f.message) && f.code !== 'no-lockfile'),
+  ).length;
+  let critical = depFindings.filter((f) => f.severity === 'error').length;
+
+  let score = 100;
+  score -= critical * 20;
+  score -= deprecated * 8;
+  score -= outdated * 5;
+  score -= noLockfile * 15;
+  if (!pkg.engines?.node) score -= 3;
+  score = Math.max(0, Math.min(100, score));
+
+  return {
+    score,
+    deprecated,
+    outdated,
+    noLockfile,
+    critical,
+    hasLockfile: hasLock,
+    hasEngines: Boolean(pkg.engines?.node),
+    note: 'outdated is heuristic only (no live npm outdated)',
+    gate: critical > 0 ? 'fail' : score < 80 ? 'warn' : 'pass',
+  };
+}

package/core/security/score/release-health.js

@@ -0,0 +1,66 @@
+/**
+ * Release Health — pre-publish gate summary.
+ */
+import { join } from 'path';
+import { fileExists, readJson, readText } from '../checks/fs.js';
+import { execSync } from 'child_process';
+
+/**
+ * @param {string} root
+ * @param {import('../registry.js').SecurityFinding[]} findings
+ */
+export function computeReleaseHealth(root, findings) {
+  const pkg = readJson(join(root, 'package.json')) || {};
+  const version = pkg.version || '';
+
+  const checks = {
+    readme: fileExists(join(root, 'README.md')),
+    changelog: fileExists(join(root, 'CHANGELOG.md')),
+    license: fileExists(join(root, 'LICENSE')) || fileExists(join(root, 'LICENSE.md')) || Boolean(pkg.license),
+    securityMd: fileExists(join(root, 'SECURITY.md')),
+    releaseNotes:
+      fileExists(join(root, `RELEASE_NOTES_${version}.md`))
+      || (version && (readText(join(root, 'CHANGELOG.md')) || '').includes(`[${version}]`)),
+    provenance:
+      Boolean(pkg.publishConfig?.provenance)
+      || /id-token\s*:\s*write/.test(readText(join(root, '.github', 'workflows', 'publish-npm.yml')) || ''),
+  };
+
+  let tagOk = null;
+  let cleanTree = null;
+  try {
+        const tag = execSync(`git tag -l "v${version}"`, { cwd: root, encoding: 'utf-8', stdio: ['ignore', 'pipe', 'ignore'] }).trim();
+        tagOk = Boolean(tag);
+      } catch {
+        tagOk = null;
+      }
+      try {
+        const dirty = execSync('git status --porcelain', { cwd: root, encoding: 'utf-8', stdio: ['ignore', 'pipe', 'ignore'] }).trim();
+        cleanTree = dirty.length === 0;
+  } catch {
+    cleanTree = null;
+  }
+
+  const publishErrors = findings.filter(
+    (f) => (f.category === 'publish' || f.ruleId?.startsWith('publish.') || f.ruleId?.startsWith('release.')) && f.severity === 'error',
+  ).length;
+
+  const missing = Object.entries(checks).filter(([, v]) => !v).map(([k]) => k);
+  let score = 100;
+  score -= missing.length * 10;
+  score -= publishErrors * 15;
+  if (tagOk === false) score -= 8;
+  if (cleanTree === false) score -= 5;
+  score = Math.max(0, Math.min(100, score));
+
+  const ready = publishErrors === 0 && checks.readme && checks.changelog && checks.license && checks.securityMd;
+  return {
+    score,
+    gate: ready ? (missing.length || cleanTree === false ? 'warn' : 'pass') : 'fail',
+    ready: ready && publishErrors === 0,
+    status: ready && publishErrors === 0 ? 'READY FOR PUBLISH' : 'BLOCKED',
+    checks: { ...checks, tagMatchesVersion: tagOk, workingTreeClean: cleanTree },
+    missing,
+    version,
+  };
+}