@everystack/cli 0.3.5 → 0.3.6

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@everystack/cli",
-  "version": "0.3.5",
+  "version": "0.3.6",
   "description": "CLI and OTA updates for Expo apps on everystack",
   "license": "AGPL-3.0-only",
   "author": "Scalable Technology, Inc. <licensing@scalable.technology>",
@@ -33,6 +33,10 @@
       "types": "./src/cli/audit-api.ts",
       "default": "./src/cli/audit-api.ts"
     },
+    "./audit/source": {
+      "types": "./src/cli/audit-source-api.ts",
+      "default": "./src/cli/audit-source-api.ts"
+    },
     "./client": {
       "types": "./src/client/index.ts",
       "default": "./src/client/index.ts"
@@ -61,22 +65,16 @@
   "bin": {
     "everystack": "./src/cli/index.ts"
   },
-  "scripts": {
-    "test": "jest",
-    "build": "tsc --build",
-    "prepublishOnly": "tsc --module commonjs --moduleResolution node --target ES2022 --esModuleInterop --skipLibCheck --declaration false --outDir src src/env.ts",
-    "lint": "tsc --noEmit"
-  },
   "dependencies": {
     "@aws-sdk/client-cloudfront": "3.1053.0",
     "@aws-sdk/client-cloudfront-keyvaluestore": "3.1053.0",
     "@aws-sdk/signature-v4a": "3.1048.0",
-    "@everystack/model": "workspace:*",
     "glob": "13.0.6",
     "node-forge": "1.4.0",
     "structured-headers": "1.0.1",
     "tsx": "4.21.0",
-    "typescript": "5.9.3"
+    "typescript": "5.9.3",
+    "@everystack/model": "0.3.3"
   },
   "peerDependencies": {
     "@everystack/server": ">=0.1.0",
@@ -143,5 +141,10 @@
     "jest": "29.7.0",
     "react": "19.2.6",
     "ts-jest": "29.4.9"
+  },
+  "scripts": {
+    "test": "jest",
+    "build": "tsc --build",
+    "lint": "tsc --noEmit"
   }
-}
+}

package/src/cli/audit-api.ts

@@ -1,10 +1,15 @@
 /**
  * Public audit surface — `@everystack/cli/audit`.
  *
- * The governance MCP imports these pure scanners directly to gate authoring and
- * pre-deploy: the secret-leak checks (bundle-audit) and the weight/size checks
- * (bundle-weight), plus the bundle composition helpers they build on. Pure,
+ * The bundle-side scanners: secret-leak (bundle-audit), weight/size (bundle-weight),
+ * remote UI-bloat (ui-bloat), and the composition helpers they build on. Pure,
  * filesystem-free, no CLI/IO coupling — feed them text or {path, size} lists.
+ *
+ * IMPORTANT: this barrel is kept TYPESCRIPT-FREE on purpose. The source-side AST
+ * scanners (component-audit / component-model) pull in the `typescript` compiler, so
+ * they live behind `@everystack/cli/audit/source` instead. The governance MCP imports
+ * this light barrel (e.g. SECRET_PATTERNS) and bundles small; importing the source
+ * subpath would drag the ~10MB compiler into the hook hot-path.
  */
 
 export {
@@ -56,32 +61,9 @@ export {
   resolveUiBloatBudget,
 } from './ui-bloat.js';
 
-export {
-  // source-side UI-bloat checks (located + fixable + self-verifying)
-  type ComponentBudget,
-  type FileRole,
-  DEFAULT_COMPONENT_BUDGET,
-  classifyRole,
-  scanComponentRepeatedStyles,
-  scanComponentHardcodedColors,
-  scanUiReimplementation,
-  discoverUiExports,
-  scanComponentSize,
-  scanDuplicateJsx,
-  scanDuplicateComponents,
-  auditComponents,
-} from './component-audit.js';
-
-export {
-  // types — the faithful component model (shared with the 5b frontend Module)
-  type ComponentDescriptor,
-  type ImportRef,
-  type JsxNode,
-  type StyleLiteral,
-  // the source-side foundation: parse/discover .tsx into neutral descriptors
-  parseComponents,
-  discoverComponents,
-} from './component-model.js';
+// NOTE: the source-side AST scanners (component-audit + component-model) moved to
+// `@everystack/cli/audit/source` — they pull in `typescript`, which this barrel must
+// stay free of. See audit-source-api.ts.
 
 export {
   // composition (input to scanDependencyWeight)

package/src/cli/audit-source-api.ts

@@ -0,0 +1,36 @@
+/**
+ * Source-side audit surface — `@everystack/cli/audit/source`.
+ *
+ * The `.tsx` AST scanners: the faithful component model (`component-model`) and the
+ * source-side UI-bloat checks built on it (`component-audit`). These pull in the
+ * `typescript` compiler, so they are kept OUT of the light `@everystack/cli/audit`
+ * barrel and exposed here instead. Import this only when you need to parse/analyze
+ * component source — never from a hot path (it drags ~10MB of compiler).
+ */
+
+export {
+  // source-side UI-bloat checks (located + fixable + self-verifying)
+  type ComponentBudget,
+  type FileRole,
+  DEFAULT_COMPONENT_BUDGET,
+  classifyRole,
+  scanComponentRepeatedStyles,
+  scanComponentHardcodedColors,
+  scanUiReimplementation,
+  discoverUiExports,
+  scanComponentSize,
+  scanDuplicateJsx,
+  scanDuplicateComponents,
+  auditComponents,
+} from './component-audit.js';
+
+export {
+  // types — the faithful component model (shared with the 5b frontend Module)
+  type ComponentDescriptor,
+  type ImportRef,
+  type JsxNode,
+  type StyleLiteral,
+  // the source-side foundation: parse/discover .tsx into neutral descriptors
+  parseComponents,
+  discoverComponents,
+} from './component-model.js';