@everystack/cli 0.3.3 → 0.3.5

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@everystack/cli",
-  "version": "0.3.3",
+  "version": "0.3.5",
   "description": "CLI and OTA updates for Expo apps on everystack",
   "license": "AGPL-3.0-only",
   "author": "Scalable Technology, Inc. <licensing@scalable.technology>",
@@ -29,6 +29,10 @@
       "types": "./src/cli/model-api.ts",
       "default": "./src/cli/model-api.ts"
     },
+    "./audit": {
+      "types": "./src/cli/audit-api.ts",
+      "default": "./src/cli/audit-api.ts"
+    },
     "./client": {
       "types": "./src/client/index.ts",
       "default": "./src/client/index.ts"
@@ -57,15 +61,22 @@
   "bin": {
     "everystack": "./src/cli/index.ts"
   },
+  "scripts": {
+    "test": "jest",
+    "build": "tsc --build",
+    "prepublishOnly": "tsc --module commonjs --moduleResolution node --target ES2022 --esModuleInterop --skipLibCheck --declaration false --outDir src src/env.ts",
+    "lint": "tsc --noEmit"
+  },
   "dependencies": {
     "@aws-sdk/client-cloudfront": "3.1053.0",
     "@aws-sdk/client-cloudfront-keyvaluestore": "3.1053.0",
     "@aws-sdk/signature-v4a": "3.1048.0",
+    "@everystack/model": "workspace:*",
     "glob": "13.0.6",
     "node-forge": "1.4.0",
     "structured-headers": "1.0.1",
     "tsx": "4.21.0",
-    "@everystack/model": "0.3.3"
+    "typescript": "5.9.3"
   },
   "peerDependencies": {
     "@everystack/server": ">=0.1.0",
@@ -131,12 +142,6 @@
     "drizzle-orm": "0.41.0",
     "jest": "29.7.0",
     "react": "19.2.6",
-    "ts-jest": "29.4.9",
-    "typescript": "5.9.3"
-  },
-  "scripts": {
-    "test": "jest",
-    "build": "tsc --build",
-    "lint": "tsc --noEmit"
+    "ts-jest": "29.4.9"
   }
-}
+}

package/src/cli/audit-api.ts

@@ -0,0 +1,97 @@
+/**
+ * Public audit surface — `@everystack/cli/audit`.
+ *
+ * The governance MCP imports these pure scanners directly to gate authoring and
+ * pre-deploy: the secret-leak checks (bundle-audit) and the weight/size checks
+ * (bundle-weight), plus the bundle composition helpers they build on. Pure,
+ * filesystem-free, no CLI/IO coupling — feed them text or {path, size} lists.
+ */
+
+export {
+  // types
+  type AuditFinding,
+  type SecretPattern,
+  type SourceLoc,
+  type FixDescriptor,
+  // leak scanners
+  SECRET_PATTERNS,
+  redact,
+  isPublicEnvKey,
+  scanSecretShapes,
+  extractBundleUrls,
+  extractExtraEnvKeys,
+  classifyPrivateEnvKeys,
+  scanSecretValue,
+  summarize,
+} from './bundle-audit.js';
+
+export {
+  // types
+  type AssetFile,
+  type AssetKind,
+  type WeightBudget,
+  // weight scanners
+  DEFAULT_WEIGHT_BUDGET,
+  classifyAsset,
+  formatBytes,
+  scanAssetWeights,
+  scanTotalWeight,
+  scanJsWeight,
+  scanSourceMapsPresent,
+  scanDependencyWeight,
+  resolveWeightBudget,
+} from './bundle-weight.js';
+
+export {
+  // types
+  type UiBloatBudget,
+  // UI-bloat scanners (remote / bundle side of the design-bloat loop)
+  DEFAULT_UI_BLOAT_BUDGET,
+  canonicalizeStyle,
+  isDesignStyle,
+  extractStyleLiterals,
+  scanRepeatedStyles,
+  scanHardcodedColors,
+  scanBundleUiBloat,
+  resolveUiBloatBudget,
+} from './ui-bloat.js';
+
+export {
+  // source-side UI-bloat checks (located + fixable + self-verifying)
+  type ComponentBudget,
+  type FileRole,
+  DEFAULT_COMPONENT_BUDGET,
+  classifyRole,
+  scanComponentRepeatedStyles,
+  scanComponentHardcodedColors,
+  scanUiReimplementation,
+  discoverUiExports,
+  scanComponentSize,
+  scanDuplicateJsx,
+  scanDuplicateComponents,
+  auditComponents,
+} from './component-audit.js';
+
+export {
+  // types — the faithful component model (shared with the 5b frontend Module)
+  type ComponentDescriptor,
+  type ImportRef,
+  type JsxNode,
+  type StyleLiteral,
+  // the source-side foundation: parse/discover .tsx into neutral descriptors
+  parseComponents,
+  discoverComponents,
+} from './component-model.js';
+
+export {
+  // composition (input to scanDependencyWeight)
+  type Composition,
+  type ChunkInput,
+  type ChunkSize,
+  type SourceMap,
+  measureChunk,
+  measureChunks,
+  totalSizes,
+  bucketSource,
+  composeSourceMap,
+} from './bundle.js';

package/src/cli/bundle-audit.ts

@@ -0,0 +1,225 @@
+/**
+ * Bundle secret-leak audit — pure scanners for `everystack bundle:audit`.
+ *
+ * Scans the *served* client bundle for leaked secrets. Config-free by leaning on
+ * universal truths instead of a hand-maintained deny-list:
+ *
+ *   1. Generic secret SHAPES (Postgres/Mongo/Redis URLs, sk_live_, AKIA…, PEM
+ *      blocks) — these match a secret's *value* regardless of its key name.
+ *   2. The Expo convention: Metro only inlines `EXPO_PUBLIC_*` env vars into the
+ *      client bundle. Any *other* env key serialized into the bundle is, by
+ *      definition, a private value that leaked.
+ *   3. (Operator-run) value canary: grep the bundle for the literal values of the
+ *      deployed secrets — the only way to catch a Metro-inlined value whose key
+ *      name never appears. Values are redacted in output; never printed.
+ *
+ * Nothing here reads secret values; the canary matcher receives them from the
+ * command's operator-run path.
+ */
+
+/** A source location an agent can open and edit. */
+export interface SourceLoc {
+  file: string;
+  line: number;
+}
+
+/** A machine-actionable remediation for a finding. Source-side findings carry one
+ *  so the agent can apply it without re-deriving the fix from prose. */
+export interface FixDescriptor {
+  kind:
+    | 'extract-component'
+    | 'replace-with-token'
+    | 'use-ui-component'
+    | 'split-component'
+    | 'unify-component';
+  summary: string;
+  /** extract-component: a suggested name for the new component. */
+  suggestedName?: string;
+  /** replace-with-token: the raw value to replace and the token to use. */
+  from?: string;
+  to?: string;
+}
+
+export interface AuditFinding {
+  severity: 'fail' | 'warn';
+  check:
+    // leak checks (this file)
+    | 'secret-shape'
+    | 'source-map'
+    | 'private-env-key'
+    | 'secret-value'
+    // weight/size checks (bundle-weight.ts)
+    | 'asset-weight'
+    | 'total-weight'
+    | 'data-in-bundle'
+    | 'js-weight'
+    | 'dep-weight'
+    // UI-bloat checks (ui-bloat.ts / component-audit.ts)
+    | 'ui-repeated-style'
+    | 'ui-hardcoded-color'
+    | 'ui-reimplementation'
+    | 'component-size'
+    | 'jsx-depth'
+    | 'hook-count'
+    | 'duplicate-jsx'
+    | 'duplicate-component';
+  source: string;
+  detail: string;
+  /** Source-side only: every place the smell occurs (the remote bundle cannot give
+   *  these — it is mangled and pathless). */
+  occurrences?: SourceLoc[];
+  /** Source-side only: how to fix it. */
+  fix?: FixDescriptor;
+  /** How to confirm the fix landed. Uniform: re-run the audit; the finding clears.
+   *  The auditor is its own verifier. */
+  verify?: string;
+}
+
+export interface SecretPattern {
+  name: string;
+  re: RegExp;
+}
+
+/** Generic, app-agnostic secret shapes. A value matching any of these in a
+ *  client bundle is a leak no matter what env key carried it. */
+export const SECRET_PATTERNS: SecretPattern[] = [
+  { name: 'postgres-url-with-credentials', re: /postgres(?:ql)?:\/\/[^:\s'"`]+:[^@\s'"`]+@/ },
+  { name: 'mongodb-url-with-credentials', re: /mongodb(?:\+srv)?:\/\/[^:\s'"`]+:[^@\s'"`]+@/ },
+  { name: 'redis-url-with-credentials', re: /redis:\/\/[^:\s'"`]*:[^@\s'"`]+@/ },
+  { name: 'stripe-secret-key', re: /sk_(?:live|test)_[A-Za-z0-9]{10,}/ },
+  { name: 'mapbox-secret-token', re: /sk\.[A-Za-z0-9_-]{60,}/ },
+  { name: 'sendgrid-key', re: /SG\.[A-Za-z0-9_-]{16,}\.[A-Za-z0-9_-]{16,}/ },
+  { name: 'google-api-key', re: /AIza[0-9A-Za-z_-]{35}/ },
+  { name: 'github-token', re: /gh[pousr]_[A-Za-z0-9]{36,}/ },
+  { name: 'slack-token', re: /xox[baprs]-[A-Za-z0-9-]{10,}/ },
+  { name: 'aws-access-key-id', re: /AKIA[0-9A-Z]{16}/ },
+  { name: 'pem-private-key', re: /-----BEGIN (?:RSA |EC |OPENSSH |DSA |PGP )?PRIVATE KEY-----/ },
+  { name: 'generic-credentials-in-url', re: /\b[a-z][a-z0-9+.-]*:\/\/[A-Za-z0-9._%-]+:[^@\s'"`/]{6,}@/ },
+];
+
+/** Mask a matched secret so the output never prints it in full. */
+export function redact(s: string): string {
+  if (s.length <= 6) return '******';
+  return `${s.slice(0, 4)}…${s.slice(-2)} (${s.length} chars)`;
+}
+
+/** True if an env key is client-public by Expo convention (Metro-inlined). */
+export function isPublicEnvKey(key: string): boolean {
+  return key.startsWith('EXPO_PUBLIC_');
+}
+
+/** Scan one artifact's text for generic secret shapes. Matches are redacted. */
+export function scanSecretShapes(text: string, source: string): AuditFinding[] {
+  const findings: AuditFinding[] = [];
+  const seen = new Set<string>(); // dedupe overlapping patterns on the same span
+  for (const { name, re } of SECRET_PATTERNS) {
+    const m = re.exec(text);
+    if (m && !seen.has(m[0])) {
+      seen.add(m[0]);
+      findings.push({
+        severity: 'fail',
+        check: 'secret-shape',
+        source,
+        detail: `${name}: ${redact(m[0])}`,
+      });
+    }
+  }
+  return findings;
+}
+
+/** Extract client JS bundle URLs from served HTML (Expo web export convention). */
+export function extractBundleUrls(html: string): string[] {
+  const urls = new Set<string>();
+  const re = /["'(]([^"'()]*_expo\/static\/js\/web\/[^"'()?]+\.js)/g;
+  let m: RegExpExecArray | null;
+  while ((m = re.exec(html)) !== null) {
+    urls.add(m[1].replace(/^\.?\//, ''));
+  }
+  return [...urls];
+}
+
+/**
+ * Extract served *static asset* references (images, data files, fonts, css)
+ * from a bundle/HTML — anything under `assets/` or `_expo/static/` that is not
+ * JS or a source map (those are crawled / gated separately). Used by the remote
+ * weight scan to discover what to HEAD for its size without downloading it.
+ */
+export function extractAssetUrls(text: string): string[] {
+  const urls = new Set<string>();
+  const re = /["'(]((?:\.?\/)?(?:assets|_expo\/static)\/[^"'()\s]+?\.[A-Za-z0-9]+)(?:\?[^"'()\s]*)?["')]/g;
+  let m: RegExpExecArray | null;
+  while ((m = re.exec(text)) !== null) {
+    const rel = m[1].replace(/^\.?\//, '');
+    if (/\.(?:js|mjs|cjs|map)$/i.test(rel)) continue;
+    urls.add(rel);
+  }
+  return [...urls];
+}
+
+const EXTRA_KEY_SKIP = new Set([
+  'JSON', 'URL', 'GET', 'POST', 'PUT', 'DELETE', 'HEAD', 'OPTIONS', 'PATCH',
+  'API', 'HTTP', 'HTTPS', 'UTF', 'UUID', 'ID', 'OK', 'EAS',
+]);
+
+/**
+ * Best-effort extraction of ALL-CAPS env-looking keys serialized near an
+ * `"extra"` region of the bundle (where Expo embeds app.config `extra`). No EAS
+ * projectId anchor needed — we scan a window around each `"extra"` occurrence.
+ */
+export function extractExtraEnvKeys(text: string, window = 600): string[] {
+  const keys = new Set<string>();
+  const keyRe = /["']([A-Z][A-Z0-9_]{2,})["']\s*:/g;
+  let idx = text.indexOf('"extra"');
+  while (idx !== -1) {
+    const region = text.slice(idx, idx + window);
+    let m: RegExpExecArray | null;
+    keyRe.lastIndex = 0;
+    while ((m = keyRe.exec(region)) !== null) {
+      if (!EXTRA_KEY_SKIP.has(m[1])) keys.add(m[1]);
+    }
+    idx = text.indexOf('"extra"', idx + 1);
+  }
+  return [...keys];
+}
+
+/** Flag any non-EXPO_PUBLIC env key found embedded in the bundle's extra. */
+export function classifyPrivateEnvKeys(keys: string[], source: string): AuditFinding[] {
+  return keys
+    .filter((k) => !isPublicEnvKey(k))
+    .map((k) => ({
+      severity: 'fail' as const,
+      check: 'private-env-key' as const,
+      source,
+      detail: `${k} is embedded in the bundle but is not EXPO_PUBLIC_* — a private value leaked`,
+    }));
+}
+
+/**
+ * Operator-run value canary: does the bundle contain the literal secret value?
+ * Returns a finding with the value REDACTED (replaced by a [KEY] marker) — the
+ * raw value is never placed in the output.
+ */
+export function scanSecretValue(
+  text: string,
+  key: string,
+  value: string,
+  source: string,
+): AuditFinding | null {
+  if (isPublicEnvKey(key)) return null; // public by design
+  if (value.length < 8) return null; // too short to be a meaningful secret
+  const at = text.indexOf(value);
+  if (at === -1) return null;
+  return {
+    severity: 'fail',
+    check: 'secret-value',
+    source,
+    detail: `value of ${key} appears verbatim in the bundle (Metro-inlined leak) [${redact(value)}]`,
+  };
+}
+
+export function summarize(findings: AuditFinding[]): { fail: number; warn: number } {
+  return {
+    fail: findings.filter((f) => f.severity === 'fail').length,
+    warn: findings.filter((f) => f.severity === 'warn').length,
+  };
+}