@everystack/cli 0.3.3 → 0.3.5

package/src/cli/component-model.ts

@@ -0,0 +1,304 @@
+/**
+ * Component model — a faithful, neutral representation of `.tsx` source (Brick 5a-B).
+ *
+ * This is the shared foundation, NOT a private detail of the auditor. The UI-bloat
+ * checks consume it; so will the 5b frontend Module contract (checking screens +
+ * components against a contract). Its reusability comes from *fidelity*: it
+ * represents what a component actually IS — name, location, JSX tree, hooks, props,
+ * imports, inline style literals — not an audit-shaped projection of it. It knows
+ * nothing about `AuditFinding`, checks, budgets, or fixes. The dependency points one
+ * way: the auditor imports this model; this model imports nothing from the auditor.
+ *
+ * Syntactic only (no type checker): everything here is read off the AST, so it needs
+ * a single `createSourceFile` per file — no `tsconfig` resolution, no `Program`, fast
+ * and pure. `parseComponents(file, text)` is the pure core (no filesystem);
+ * `discoverComponents(dir)` is the thin filesystem walk over it.
+ */
+
+import ts from 'typescript';
+import { readFileSync } from 'node:fs';
+import { globSync } from 'glob';
+
+/** A file-level import: `import def, { a, b }, * as ns from 'mod'`. */
+export interface ImportRef {
+  from: string;
+  names: string[];
+  default?: string;
+  namespace?: string;
+}
+
+/** A structural JSX node — tag identity, the element's own attributes and inline
+ *  style, and its nested element children (text and non-JSX expressions are not
+ *  structure). Map/conditional-wrapped JSX is descended into, so genuine reuse (one
+ *  `.map`) stays one node. */
+export interface JsxNode {
+  tag: string;
+  /** 1-based line of this element. */
+  line: number;
+  /** Attribute names present on this element (e.g. ['style', 'onPress']). */
+  attrs: string[];
+  /** Raw inline `style={{…}}` object literal on this element, if any. */
+  style?: string;
+  children: JsxNode[];
+}
+
+/** An inline `style={{…}}` object literal and the line it sits on. */
+export interface StyleLiteral {
+  text: string;
+  line: number;
+}
+
+/** A faithful model of one component. Source facts only — no audit concepts. */
+export interface ComponentDescriptor {
+  name: string;
+  file: string;
+  /** 1-based line of the component declaration. */
+  line: number;
+  /** Line span of the component (for the size metric). */
+  lines: number;
+  jsx: JsxNode[];
+  hooks: string[];
+  props: string[];
+  imports: ImportRef[];
+  styles: StyleLiteral[];
+}
+
+const isJsx = (
+  n: ts.Node,
+): n is ts.JsxElement | ts.JsxSelfClosingElement | ts.JsxFragment =>
+  ts.isJsxElement(n) || ts.isJsxSelfClosingElement(n) || ts.isJsxFragment(n);
+
+/** True if any JSX appears anywhere in the subtree — the test for "is a component". */
+function containsJsx(node: ts.Node): boolean {
+  let found = false;
+  const walk = (n: ts.Node): void => {
+    if (found) return;
+    if (isJsx(n)) {
+      found = true;
+      return;
+    }
+    ts.forEachChild(n, walk);
+  };
+  ts.forEachChild(node, walk);
+  return found;
+}
+
+function collectImports(sf: ts.SourceFile): ImportRef[] {
+  const out: ImportRef[] = [];
+  for (const stmt of sf.statements) {
+    if (!ts.isImportDeclaration(stmt) || !ts.isStringLiteral(stmt.moduleSpecifier)) continue;
+    const ref: ImportRef = { from: stmt.moduleSpecifier.text, names: [] };
+    const clause = stmt.importClause;
+    if (clause?.name) ref.default = clause.name.text;
+    const bindings = clause?.namedBindings;
+    if (bindings) {
+      if (ts.isNamespaceImport(bindings)) ref.namespace = bindings.name.text;
+      else for (const el of bindings.elements) ref.names.push(el.name.text);
+    }
+    out.push(ref);
+  }
+  return out;
+}
+
+function tagName(n: ts.JsxElement | ts.JsxSelfClosingElement | ts.JsxFragment): string {
+  if (ts.isJsxFragment(n)) return 'Fragment';
+  const tag = ts.isJsxElement(n) ? n.openingElement.tagName : n.tagName;
+  return tag.getText();
+}
+
+/** Read an element's attribute names and its inline `style={{…}}` literal. */
+function readAttrs(
+  n: ts.JsxElement | ts.JsxSelfClosingElement | ts.JsxFragment,
+  sf: ts.SourceFile,
+): { attrs: string[]; style?: string } {
+  if (ts.isJsxFragment(n)) return { attrs: [] };
+  const props = (ts.isJsxElement(n) ? n.openingElement : n).attributes.properties;
+  const attrs: string[] = [];
+  let style: string | undefined;
+  for (const p of props) {
+    if (!ts.isJsxAttribute(p) || !ts.isIdentifier(p.name)) continue;
+    attrs.push(p.name.text);
+    if (
+      p.name.text === 'style' &&
+      p.initializer &&
+      ts.isJsxExpression(p.initializer) &&
+      p.initializer.expression &&
+      ts.isObjectLiteralExpression(p.initializer.expression)
+    ) {
+      style = p.initializer.expression.getText(sf);
+    }
+  }
+  return { attrs, style };
+}
+
+/** Build a faithful node for one JSX element, with its attrs, style, line, children. */
+function makeNode(
+  n: ts.JsxElement | ts.JsxSelfClosingElement | ts.JsxFragment,
+  sf: ts.SourceFile,
+): JsxNode {
+  const { attrs, style } = readAttrs(n, sf);
+  const node: JsxNode = {
+    tag: tagName(n),
+    line: sf.getLineAndCharacterOfPosition(n.getStart(sf)).line + 1,
+    attrs,
+    children: jsxChildren(n, sf),
+  };
+  if (style !== undefined) node.style = style;
+  return node;
+}
+
+/** The element children of a JSX node, descending through expression containers
+ *  ({cond && <X/>}, {items.map(=> <Y/>)}) so structure is captured but text is not. */
+function jsxChildren(
+  n: ts.JsxElement | ts.JsxSelfClosingElement | ts.JsxFragment,
+  sf: ts.SourceFile,
+): JsxNode[] {
+  if (ts.isJsxSelfClosingElement(n)) return [];
+  const kids: JsxNode[] = [];
+  const fromChild = (child: ts.Node): void => {
+    if (isJsx(child)) {
+      kids.push(makeNode(child, sf));
+      return; // don't descend past a JSX element — its own children handle that
+    }
+    // descend through JsxExpression / parens / map callbacks to find nested JSX
+    if (ts.isJsxText(child)) return;
+    ts.forEachChild(child, fromChild);
+  };
+  for (const child of n.children) fromChild(child);
+  return kids;
+}
+
+/** The outermost JSX nodes within a component body — its roots. */
+function collectRoots(fn: ts.Node, sf: ts.SourceFile): JsxNode[] {
+  const roots: JsxNode[] = [];
+  const walk = (n: ts.Node): void => {
+    if (isJsx(n)) {
+      roots.push(makeNode(n, sf));
+      return; // stop — nested JSX is captured as children, not as another root
+    }
+    ts.forEachChild(n, walk);
+  };
+  ts.forEachChild(fn, walk);
+  return roots;
+}
+
+function collectHooks(fn: ts.Node): string[] {
+  const hooks: string[] = [];
+  const walk = (n: ts.Node): void => {
+    if (ts.isCallExpression(n)) {
+      const expr = n.expression;
+      const name = ts.isIdentifier(expr)
+        ? expr.text
+        : ts.isPropertyAccessExpression(expr)
+          ? expr.name.text
+          : '';
+      if (/^use[A-Z]/.test(name)) hooks.push(name);
+    }
+    ts.forEachChild(n, walk);
+  };
+  ts.forEachChild(fn, walk);
+  return hooks;
+}
+
+function collectProps(fn: ts.FunctionLikeDeclarationBase): string[] {
+  const param = fn.parameters[0];
+  if (!param) return [];
+  if (ts.isObjectBindingPattern(param.name)) {
+    return param.name.elements
+      .map((el) => (ts.isIdentifier(el.name) ? el.name.text : ''))
+      .filter(Boolean);
+  }
+  if (ts.isIdentifier(param.name)) return [param.name.text];
+  return [];
+}
+
+function collectStyles(fn: ts.Node, sf: ts.SourceFile): StyleLiteral[] {
+  const styles: StyleLiteral[] = [];
+  const walk = (n: ts.Node): void => {
+    if (
+      ts.isJsxAttribute(n) &&
+      ts.isIdentifier(n.name) &&
+      n.name.text === 'style' &&
+      n.initializer &&
+      ts.isJsxExpression(n.initializer) &&
+      n.initializer.expression &&
+      ts.isObjectLiteralExpression(n.initializer.expression)
+    ) {
+      const obj = n.initializer.expression;
+      styles.push({
+        text: obj.getText(sf),
+        line: sf.getLineAndCharacterOfPosition(obj.getStart(sf)).line + 1,
+      });
+    }
+    ts.forEachChild(n, walk);
+  };
+  ts.forEachChild(fn, walk);
+  return styles;
+}
+
+/**
+ * Pure core: parse one `.tsx` file's source text into faithful component
+ * descriptors. No filesystem, no type checker.
+ */
+export function parseComponents(file: string, text: string): ComponentDescriptor[] {
+  const sf = ts.createSourceFile(file, text, ts.ScriptTarget.Latest, true, ts.ScriptKind.TSX);
+  const imports = collectImports(sf);
+  const out: ComponentDescriptor[] = [];
+  const lineOf = (pos: number) => sf.getLineAndCharacterOfPosition(pos).line + 1;
+
+  const consider = (name: string, declNode: ts.Node, fn: ts.FunctionLikeDeclarationBase): void => {
+    if (!containsJsx(fn)) return;
+    const start = declNode.getStart(sf);
+    out.push({
+      name,
+      file,
+      line: lineOf(start),
+      lines: lineOf(declNode.getEnd()) - lineOf(start) + 1,
+      jsx: collectRoots(fn, sf),
+      hooks: collectHooks(fn),
+      props: collectProps(fn),
+      imports,
+      styles: collectStyles(fn, sf),
+    });
+  };
+
+  for (const node of sf.statements) {
+    if (ts.isFunctionDeclaration(node)) {
+      const name =
+        node.name?.text ??
+        (node.modifiers?.some((m) => m.kind === ts.SyntaxKind.DefaultKeyword) ? 'default' : '');
+      if (name) consider(name, node, node);
+    } else if (ts.isVariableStatement(node)) {
+      for (const d of node.declarationList.declarations) {
+        if (
+          ts.isIdentifier(d.name) &&
+          d.initializer &&
+          (ts.isArrowFunction(d.initializer) || ts.isFunctionExpression(d.initializer))
+        ) {
+          consider(d.name.text, node, d.initializer);
+        }
+      }
+    } else if (ts.isExportAssignment(node)) {
+      const e = node.expression;
+      if (ts.isArrowFunction(e) || ts.isFunctionExpression(e)) consider('default', node, e);
+    }
+  }
+  return out;
+}
+
+/**
+ * Walk a directory for `.tsx` files (excluding node_modules) and parse each into
+ * component descriptors. The thin filesystem shell over `parseComponents`.
+ */
+export function discoverComponents(dir: string): ComponentDescriptor[] {
+  const files = globSync('**/*.tsx', {
+    cwd: dir,
+    absolute: true,
+    ignore: ['**/node_modules/**', '**/.expo/**', '**/dist/**'],
+  });
+  const out: ComponentDescriptor[] = [];
+  for (const file of files) {
+    out.push(...parseComponents(file, readFileSync(file, 'utf8')));
+  }
+  return out;
+}

package/src/cli/index.ts

@@ -21,6 +21,11 @@ import { analyzeSSRCommand } from './commands/analyze.js';
 import { logsErrorsCommand, logsTailCommand, logsQueryCommand } from './commands/logs.js';
 import { secretsCommand } from './commands/secrets.js';
 import { securityAuditCommand } from './commands/security.js';
+import { securityProbeCommand } from './commands/security-probe.js';
+import { bundleAnalyzeCommand, bundleAuditCommand } from './commands/bundle.js';
+import { auditLighthouseCommand } from './commands/lighthouse.js';
+import { auditCommand } from './commands/audit.js';
+import { uiAuditCommand } from './commands/ui-audit.js';
 import { fail } from './output.js';
 
 const args = process.argv.slice(2);
@@ -206,6 +211,30 @@ async function main() {
     case 'security:audit':
       await securityAuditCommand(flags);
       break;
+    case 'security:probe':
+      await securityProbeCommand(flags);
+      break;
+    case 'bundle:analyze': {
+      const positional = args[1] && !args[1].startsWith('--') ? args[1] : undefined;
+      await bundleAnalyzeCommand(positional, flags);
+      break;
+    }
+    case 'audit':
+      await auditCommand(flags);
+      break;
+    case 'audit:lighthouse':
+      await auditLighthouseCommand(flags);
+      break;
+    case 'bundle:audit': {
+      const positional = args[1] && !args[1].startsWith('--') ? args[1] : undefined;
+      await bundleAuditCommand(positional, flags);
+      break;
+    }
+    case 'ui:audit': {
+      const positional = args[1] && !args[1].startsWith('--') ? args[1] : undefined;
+      await uiAuditCommand(positional, flags);
+      break;
+    }
     case 'secrets': {
       // secrets <subcommand> [positional...] [--flags]
       // Extract positional args: everything after subcommand that isn't a flag or flag value
@@ -262,6 +291,12 @@ Usage:
   everystack status            [--stage <name>] [--hours <n>]  Platform health: CDN, Lambda, rollup summary
   everystack security:audit    [--dir <path>] [--config <file>]  Static scan of migration SQL (pre-merge gate)
   everystack security:audit    --stage <name> [--config <file>]  Live catalog scan of a deployed stage (post-deploy)
+  everystack security:probe    --stage <name> [--host <url>]  Live black-box probe: introspects RLS/grants, then tests the deployed surface (RLS coverage, column exposure, injection, limit cap, embed depth)
+  everystack audit             --stage <name> [--host <url>] [--dir <export>] [--lighthouse]  Capstone: security:audit + security:probe + bundle:audit (+ optional lighthouse), combined report + exit code (CI gate); --dir adds the weight/size gate over a local export
+  everystack bundle:analyze    [dir]            Client web-bundle size + composition (run after \`expo export -p web --source-maps\`)
+  everystack audit:lighthouse  [--stage <name>] [--host <url>] [--runs 3] [--path /] [--json out.json]  Mobile Lighthouse (perf/a11y/bp/seo), median over N runs
+  everystack bundle:audit      [url|--dir <export>] [--stage <name>] [--values-from <.env>] [--leak-only] [--max-file-mb N] [--max-total-mb N] [--max-js-mb N] [--max-data-mb N]  Audit a bundle for leaked secrets AND weight (oversized assets, data that belongs in the DB, JS bloat) AND UI design-bloat (style repetition + hardcoded colors). A URL/stage weighs the remote bundle (assets sized via HEAD, no download); --dir scans a local export; --leak-only skips the weight gate
+  everystack ui:audit          [dir] [--ui-repeat N] [--ui-color-repeat N]  Source-side UI design-bloat: styles copy-pasted across call sites, hardcoded colors that should be tokens, raw primitives reimplementing a ui component, oversized components, duplicated JSX. Located + fixable; advisory, never gates
   everystack certs:generate    [--output ./certs]
   everystack certs:configure   [--input ./certs] [--keyid main]
   everystack cache:purge       [--stage <name>]                  Bust all cached content (global epoch)

package/src/cli/lighthouse.ts

@@ -0,0 +1,155 @@
+/**
+ * Lighthouse audit — pure, Lighthouse-free parsing/aggregation logic for
+ * `everystack audit:lighthouse`.
+ *
+ * Why N runs: the category scores are stable but Performance swings run-to-run
+ * because LCP does under throttled-mobile simulation. A single run can read 92
+ * or 65. We run each host several times and report the DISTRIBUTION (median +
+ * min/max) — the median is the honest number, the spread shows how noisy LCP is.
+ *
+ * Measurement rule (in the command): warm the CloudFront edge first, then
+ * measure WITHOUT a cache-buster, so we score the real-user warm-HTML path, not
+ * a pessimistic cold-origin SSR render.
+ *
+ * Config-free: the target URL comes from the deployed SST outputs (or --host),
+ * never a hand-maintained env map.
+ */
+
+export const CATEGORIES = ['performance', 'accessibility', 'best-practices', 'seo'] as const;
+export const METRICS = [
+  'first-contentful-paint',
+  'largest-contentful-paint',
+  'total-blocking-time',
+  'cumulative-layout-shift',
+  'speed-index',
+] as const;
+
+export type Category = (typeof CATEGORIES)[number];
+export type Metric = (typeof METRICS)[number];
+
+export interface LhAudit {
+  title: string;
+  score: number | null;
+  numericValue?: number;
+  scoreDisplayMode?: string;
+}
+
+export interface LhReport {
+  categories: Record<string, { score: number; auditRefs: { id: string }[] }>;
+  audits: Record<string, LhAudit>;
+}
+
+export interface ExtractedRun {
+  scores: Record<string, number>; // category → 0..100
+  metrics: Record<string, number>; // metric → numericValue
+  imperfect: { id: string; title: string; cat: string }[];
+}
+
+export interface Aggregate {
+  scores: Record<string, number[]>;
+  metrics: Record<string, number[]>;
+  failing: { id: string; title: string; cat: string; count: number }[];
+  noindex: boolean;
+}
+
+export function median(xs: number[]): number {
+  const s = [...xs].sort((a, b) => a - b);
+  const m = Math.floor(s.length / 2);
+  return s.length % 2 ? s[m] : Math.round((s[m - 1] + s[m]) / 2);
+}
+
+/** Pull scores, metrics, and imperfect audits out of one Lighthouse report. */
+export function extractRun(report: LhReport): ExtractedRun {
+  const scores: Record<string, number> = {};
+  const metrics: Record<string, number> = {};
+  const imperfect: { id: string; title: string; cat: string }[] = [];
+
+  for (const c of CATEGORIES) {
+    scores[c] = Math.round((report.categories[c]?.score ?? 0) * 100);
+  }
+  for (const m of METRICS) {
+    metrics[m] = report.audits[m]?.numericValue ?? 0;
+  }
+  for (const c of CATEGORIES) {
+    for (const ref of report.categories[c]?.auditRefs ?? []) {
+      const au = report.audits[ref.id];
+      if (au && au.score !== null && au.score < 1 && au.scoreDisplayMode !== 'informative') {
+        imperfect.push({ id: ref.id, title: au.title, cat: c });
+      }
+    }
+  }
+  return { scores, metrics, imperfect };
+}
+
+/** Aggregate the per-run extracts into score/metric distributions + flags. */
+export function aggregate(runs: ExtractedRun[]): Aggregate {
+  const scores: Record<string, number[]> = Object.fromEntries(CATEGORIES.map((c) => [c, []]));
+  const metrics: Record<string, number[]> = Object.fromEntries(METRICS.map((m) => [m, []]));
+  const failingMap = new Map<string, { title: string; cat: string; count: number }>();
+  let noindex = false;
+
+  for (const run of runs) {
+    for (const c of CATEGORIES) scores[c].push(run.scores[c] ?? 0);
+    for (const m of METRICS) metrics[m].push(run.metrics[m] ?? 0);
+    for (const imp of run.imperfect) {
+      if (imp.id === 'is-crawlable') noindex = true;
+      const e = failingMap.get(imp.id) || { title: imp.title, cat: imp.cat, count: 0 };
+      e.count++;
+      failingMap.set(imp.id, e);
+    }
+  }
+
+  const failing = [...failingMap.entries()]
+    .map(([id, e]) => ({ id, ...e }))
+    .sort((a, b) => b.count - a.count);
+  return { scores, metrics, failing, noindex };
+}
+
+/** extractRun + aggregate over a set of raw reports. */
+export function summarize(reports: LhReport[]): Aggregate {
+  return aggregate(reports.map(extractRun));
+}
+
+function fmtMs(v: number): string {
+  return v >= 1000 ? `${(v / 1000).toFixed(1)}s` : `${Math.round(v)}ms`;
+}
+
+export function formatLighthouseReport(url: string, runs: number, agg: Aggregate): string[] {
+  const lines: string[] = [];
+  lines.push('='.repeat(64));
+  lines.push(`${url}   (${runs} run${runs === 1 ? '' : 's'})`);
+  lines.push('='.repeat(64));
+  lines.push('Category        median   runs');
+  for (const c of CATEGORIES) {
+    const xs = agg.scores[c];
+    const spread = xs.length > 1 ? `  [${Math.min(...xs)}–${Math.max(...xs)}]` : '';
+    lines.push(`  ${c.padEnd(14)} ${String(median(xs)).padStart(3)}     ${xs.join(' ')}${spread}`);
+  }
+  lines.push('');
+  lines.push('Metric                  median        spread');
+  for (const m of METRICS) {
+    const xs = agg.metrics[m];
+    const cls = m === 'cumulative-layout-shift';
+    const f = cls ? (v: number) => v.toFixed(3) : fmtMs;
+    lines.push(`  ${m.padEnd(24)} ${f(median(xs)).padStart(7)}   ${f(Math.min(...xs))}–${f(Math.max(...xs))}`);
+  }
+  if (agg.failing.length) {
+    lines.push('');
+    lines.push('Imperfect audits (count = runs flagged):');
+    for (const e of agg.failing) {
+      const note =
+        e.id === 'is-crawlable'
+          ? '  ← expected when the stage is noindex (true SEO only on the indexable domain)'
+          : '';
+      lines.push(`  [${e.cat}] ${e.id} (${e.count}/${runs}) — ${e.title}${note}`);
+    }
+  }
+  if (agg.noindex) {
+    lines.push('');
+    lines.push(
+      'NOTE: is-crawlable fails because this stage is noindex (robots Disallow: /).',
+    );
+    lines.push('      That suppresses SEO ~20pts. Re-measure the indexable production domain for the true score.');
+  }
+  return lines;
+}