@everystack/cli 0.3.3 → 0.3.4

package/src/cli/bundle.ts

@@ -0,0 +1,146 @@
+/**
+ * Bundle analysis — pure, filesystem-free logic for `everystack bundle:analyze`.
+ *
+ * Measures the served client JS (raw / gzip / brotli — brotli is the real
+ * CloudFront-transfer number) and, from the largest chunk's source map, ranks
+ * the source-byte contributors per npm package / app workspace.
+ *
+ * Config-free by construction: the bundle layout is an Expo convention (located
+ * by the command), and the workspace bucketing is derived from the source paths
+ * themselves — nothing is hand-declared.
+ */
+
+import zlib from 'node:zlib';
+
+export interface ChunkInput {
+  name: string;
+  buf: Buffer;
+}
+
+export interface ChunkSize {
+  name: string;
+  raw: number;
+  gz: number;
+  br: number;
+}
+
+export interface SizeTotals {
+  raw: number;
+  gz: number;
+  br: number;
+}
+
+export interface SourceMap {
+  sources?: (string | null)[];
+  sourcesContent?: (string | null)[];
+}
+
+export interface PkgComposition {
+  pkg: string;
+  bytes: number;
+  share: number; // 0..1
+}
+
+export interface Composition {
+  total: number;
+  modules: number;
+  top: PkgComposition[];
+}
+
+/** Raw / gzip(9) / brotli byte sizes of a single chunk buffer. Deterministic. */
+export function measureChunk(buf: Buffer): SizeTotals {
+  return {
+    raw: buf.length,
+    gz: zlib.gzipSync(buf, { level: 9 }).length,
+    br: zlib.brotliCompressSync(buf).length,
+  };
+}
+
+/** Measure every chunk, sorted largest-raw first. */
+export function measureChunks(chunks: ChunkInput[]): ChunkSize[] {
+  return chunks
+    .map((c) => ({ name: c.name, ...measureChunk(c.buf) }))
+    .sort((a, b) => b.raw - a.raw);
+}
+
+export function totalSizes(chunks: ChunkSize[]): SizeTotals {
+  return chunks.reduce<SizeTotals>(
+    (acc, c) => ({ raw: acc.raw + c.raw, gz: acc.gz + c.gz, br: acc.br + c.br }),
+    { raw: 0, gz: 0, br: 0 },
+  );
+}
+
+/**
+ * Map a source-map `sources` path to its owning bucket. Generic — no hardcoded
+ * app or package names. node_modules → the package (scope-aware); a monorepo
+ * `/packages/<name>/` or `/apps/<name>/` segment → that workspace; else `other`.
+ */
+export function bucketSource(src: string): string {
+  const nm = src.lastIndexOf('node_modules/');
+  if (nm >= 0) {
+    const parts = src.slice(nm + 'node_modules/'.length).split('/');
+    return parts[0].startsWith('@') ? `${parts[0]}/${parts[1]}` : parts[0];
+  }
+  const pkg = src.match(/\/packages\/([^/]+)/);
+  if (pkg) return `APP:packages/${pkg[1]}`;
+  const app = src.match(/\/apps\/([^/]+)/);
+  if (app) return `APP:apps/${app[1]}`;
+  return 'APP:other';
+}
+
+/** Bucket the largest chunk's source bytes by owning package, top N by size. */
+export function composeSourceMap(map: SourceMap, topN = 30): Composition {
+  const sources = map.sources || [];
+  const content = map.sourcesContent || [];
+  const byPkg: Record<string, number> = {};
+  let total = 0;
+  for (let i = 0; i < sources.length; i++) {
+    const src = sources[i] || '';
+    const len = (content[i] || '').length;
+    total += len;
+    const key = bucketSource(src);
+    byPkg[key] = (byPkg[key] || 0) + len;
+  }
+  const top = Object.entries(byPkg)
+    .map(([pkg, bytes]) => ({ pkg, bytes, share: total ? bytes / total : 0 }))
+    .sort((a, b) => b.bytes - a.bytes)
+    .slice(0, topN);
+  return { total, modules: sources.length, top };
+}
+
+const mb = (n: number): string => (n / 1048576).toFixed(2);
+const kb = (n: number): string => (n / 1024).toFixed(0);
+
+/** Render the size + composition report as lines (testable, IO-free). */
+export function formatBundleReport(chunks: ChunkSize[], composition: Composition | null): string[] {
+  const totals = totalSizes(chunks);
+  const lines: string[] = [];
+  lines.push(`CLIENT JS: ${chunks.length} chunk(s)`);
+  lines.push(`  raw    ${mb(totals.raw)} MB`);
+  lines.push(`  gzip   ${mb(totals.gz)} MB`);
+  lines.push(`  brotli ${mb(totals.br)} MB  (CloudFront transfer)`);
+  lines.push('');
+  for (const c of chunks) {
+    lines.push(`  ${kb(c.raw).padStart(7)} KB raw  ${kb(c.gz).padStart(6)} KB gz  ${c.name}`);
+  }
+
+  if (!composition) {
+    lines.push('');
+    lines.push('(no source map for composition — re-export with --source-maps)');
+    return lines;
+  }
+
+  lines.push('');
+  lines.push(
+    `largest chunk: ${mb(composition.total)} MB source / ${composition.modules} modules`,
+  );
+  lines.push('  rank  src-KB   share  package');
+  composition.top.forEach((p, i) => {
+    lines.push(
+      `  ${String(i + 1).padStart(3)}  ${kb(p.bytes).padStart(7)}  ${(p.share * 100)
+        .toFixed(1)
+        .padStart(5)}%  ${p.pkg}`,
+    );
+  });
+  return lines;
+}

package/src/cli/commands/audit.ts

@@ -0,0 +1,118 @@
+/**
+ * `everystack audit --stage <name>` — the capstone. Runs the live deploy-checks
+ * against one stage and emits a combined report + a single exit code (non-zero
+ * if anything failed), so it works as a one-shot CI gate.
+ *
+ * Composes the shared result-producing cores (runBundleAudit, runSecurityProbe)
+ * so there's no orchestration duplication. The white-box `security:audit` and
+ * the heavier `audit:lighthouse` stay separate commands (run them explicitly).
+ */
+
+import { resolveConfig, opsFunction } from '../config.js';
+import { runBundleAudit, runBundleWeightAudit, reportBundleAudit } from './bundle.js';
+import { resolveWeightBudget } from '../bundle-weight.js';
+import { runSecurityProbe, reportProbeResults } from './security-probe.js';
+import { auditDeployedSql, printReport, loadWaivers } from './security.js';
+import { collectLighthouseRuns } from './lighthouse.js';
+import { aggregate, formatLighthouseReport } from '../lighthouse.js';
+import { step, info, fail, success, warn } from '../output.js';
+
+export async function auditCommand(flags: Record<string, string>): Promise<void> {
+  step('Resolving deployed config...');
+  let config;
+  try {
+    config = await resolveConfig(flags.stage);
+  } catch (err: any) {
+    fail(err.message);
+    process.exit(1);
+  }
+  const base = (flags.host || config.baseUrl || '').replace(/\/+$/, '');
+  if (!base) {
+    fail('No router URL to audit. Pass --host or ensure the stage has a deployed URL.');
+    process.exit(1);
+  }
+  info(`Region: ${config.region}, URL: ${base}`);
+
+  let failures = 0;
+  const ran: string[] = [];
+
+  // --- security:audit (white-box: SECDEF / exposing-view SQL surface) -------
+  console.log('');
+  info('── security:audit ───────────────────────────────────────────');
+  try {
+    const waivers = await loadWaivers(flags.config);
+    const report = await auditDeployedSql(config.region, opsFunction(config), waivers);
+    console.log('');
+    printReport(report, 'catalog');
+    failures += report.red;
+    ran.push('security:audit');
+  } catch (err: any) {
+    warn(`security:audit skipped: ${err.message}`);
+  }
+
+  // --- security:probe (live RLS/grants introspection + surface probing) ----
+  console.log('');
+  info('── security:probe ───────────────────────────────────────────');
+  try {
+    const results = await runSecurityProbe({
+      region: config.region,
+      opsFn: opsFunction(config),
+      base,
+    });
+    console.log('');
+    failures += reportProbeResults(results);
+    ran.push('security:probe');
+  } catch (err: any) {
+    warn(`security:probe skipped: ${err.message}`);
+  }
+
+  // --- bundle:audit (leak + weight) ----------------------------------------
+  // --dir scans a local export for leaks AND weight (the 180MB gate); without
+  // it, the deployed bundle is scanned for leaks only (weight needs the export).
+  console.log('');
+  info('── bundle:audit ─────────────────────────────────────────────');
+  try {
+    const result = flags.dir
+      ? await runBundleWeightAudit(flags.dir, {
+          budget: resolveWeightBudget(flags),
+          valuesFrom: flags['values-from'],
+        })
+      : await runBundleAudit(base, {
+          valuesFrom: flags['values-from'],
+          weight: !flags['leak-only'],
+          budget: resolveWeightBudget(flags),
+        });
+    console.log('');
+    failures += reportBundleAudit(result);
+    ran.push('bundle:audit (leak + weight)');
+  } catch (err: any) {
+    warn(`bundle:audit skipped: ${err.message}`);
+  }
+
+  // --- audit:lighthouse (perf/SEO) — opt-in; heavy and informational -------
+  if (flags.lighthouse) {
+    console.log('');
+    info('── audit:lighthouse ─────────────────────────────────────────');
+    try {
+      const runs = flags.runs ? parseInt(flags.runs, 10) : 3;
+      const extracts = await collectLighthouseRuns(base + '/', runs);
+      if (extracts.length) {
+        console.log('');
+        console.log(formatLighthouseReport(base + '/', extracts.length, aggregate(extracts)).join('\n'));
+        ran.push('audit:lighthouse (informational)');
+      }
+    } catch (err: any) {
+      warn(`audit:lighthouse skipped: ${err.message}`);
+    }
+  }
+
+  console.log('');
+  const summary = `audit — ${failures} failing check(s) across ${ran.join(' + ') || 'no checks'}`;
+  if (failures > 0) {
+    fail(summary);
+    process.exit(1);
+  }
+  success(summary);
+  if (!flags.lighthouse) info('Add --lighthouse for perf/SEO (slower; informational, does not gate).');
+  process.exit(0);
+}