@geoql/doctor-core 1.0.1 → 1.1.1

package/dist/index.d.ts

@@ -485,5 +485,100 @@ interface ListRulesFilter {
 }
 declare function listRules(filter?: ListRulesFilter): RegisteredRule[];
 //#endregion
-export { type ApplyInlineDisablesOptions, type AuditConfig, type AuditReport, type AuditTimings, BUILT_IN_RECOMMENDED, type Capability, type CliOverrides, ConfigCycleError, ConfigFileNotFoundError, type ConfigSource, DOCTOR_REPORT_SCHEMA_VERSION, DeadCodeImportFailed, DeadCodeTimeoutError, type Diagnostic, type DiagnosticSource, type DirectiveLine, type DirectiveRange, type DirectiveSet, type DoctorReport, type DoctorUserConfig, type Framework, type GitScopeMode, type InitConfigFormat, type InitFileWrite, type InitOptions, type InitPlan, type InitPreset, InvalidConfigError, type ListRulesFilter, type LoadRuleDocOptions, type MonorepoKind, type MonorepoResult, OxlintOutputTooLarge, OxlintSpawnFailed, type ProjectInfo, type ProjectInfoLite, RULE_REGISTRY, type RawInitAnswers, type RegisteredRule, type ReporterFormat, type ReporterInput, type ReporterOptions, type ResolvedDoctorConfig, type ResolvedInitAnswers, type RuleCategory, type RuleDoc, type RuleSource, type ScoreBreakdownEntry, type ScoreConfig, type ScoreResult, type Severity, type VerboseTraceOptions, type WorkspacePackage, agentReport, applyInlineDisables, audit, buildDoctorReport, checkBuildQuality, checkDeadCode, checkDeps, checkNuxtProject, dedupeDeadCodeAgainstLint, defineConfig, detectProject, detectSummary, docsUrl, encodeAnnotation, encodeAnnotations, findMonorepoRoot, format, isNuxtLayoutFile, isNuxtPageFile, isNuxtServerFile, jsonCompactReport, jsonReport, listChangedFiles, listRules, listWorkspacePackages, loadAllRuleDocs, loadDoctorConfig, loadRuleDoc, mergeCliOverrides, normalizeInitAnswers, parseDirectives, parseExcludeList, planInit, prCommentReport, prettyReport, renderDetectSummary, renderVerboseTrace, runCrossFilePass, sarifReport, scoreDiagnostics, validateConfig };
+//#region src/audit-filter.d.ts
+/**
+ * Filter `report.diagnostics` to a known set of allowed rule ids, then
+ * recompute `score`, `errorCount`, `warnCount`, `infoCount`, `scoreResult`,
+ * `ruleCounts`, and `exitCode` from the filtered array.
+ *
+ * Why: the CLI layer calls `audit()` and then applies its own
+ * `allowedRuleIds` filter to drop suppressed (`off`) and preset-excluded
+ * (`info` rules not in `recommended`) diagnostics. The audit's own
+ * `score`/`counts` are computed BEFORE the CLI filter, so they still
+ * include the suppressed findings. That desync surfaces to consumers
+ * (the SaaS `--push` payload, the dashboard's counts-but-no-findings bug)
+ * and to the `score` itself (suppressed findings still penalize).
+ *
+ * Invariant enforced here:
+ *   report.errorCount + report.warnCount + report.infoCount === report.diagnostics.length
+ *   report.scoreResult.totalFindings === report.diagnostics.length
+ *
+ * `exitCode=2` (oxlint crash) is preserved verbatim; `exitCode=1` is
+ * recomputed from the surviving counts + the `failOn` gate.
+ */
+declare function filterReportByRules(report: AuditReport, allowedRuleIds: ReadonlySet<string>, failOn?: 'error' | 'warn' | 'none', oxlintStderr?: string): AuditReport;
+//#endregion
+//#region src/push.d.ts
+/**
+ * The 6 fields the SaaS receives for each finding.
+ * Everything else (message, codeSnippet, recommendation, etc.) is privacy-sensitive
+ * and MUST be stripped before transmission.
+ */
+interface PushedFinding {
+  file: string;
+  line: number;
+  col: number;
+  ruleId: string;
+  severity: Severity;
+  category: string;
+}
+interface PushPayloadInput {
+  project: string;
+  score: number;
+  errorCount: number;
+  warnCount: number;
+  infoCount: number;
+  findings: PushedFinding[];
+}
+interface PushPayload extends PushPayloadInput {
+  commitSha?: string;
+  branch?: string;
+  prNumber?: number;
+}
+interface PushOptions {
+  project: string;
+  score: number;
+  errorCount: number;
+  warnCount: number;
+  infoCount: number;
+  diagnostics: Diagnostic[];
+  /** Project root used to relativize absolute finding file paths. */
+  rootDir?: string;
+  url: string;
+  apiKey: string;
+  fetchImpl?: typeof fetch;
+  /** Overrides for the request timeout (ms). Defaults to 5000. Test-only. */
+  timeoutMs?: number;
+}
+type PushResult = {
+  ok: true;
+  status?: number;
+  error?: undefined;
+} | {
+  ok: false;
+  status?: number;
+  error: string;
+};
+/**
+ * Strip a list of Diagnostics down to the 6 allowed push fields.
+ * Privacy boundary: this function is the single point of enforcement.
+ * If you add a new privacy-sensitive field to Diagnostic, add it to the deny list here.
+ *
+ * Absolute file paths are relativized against rootDir so dashboards show
+ * `src/Foo.vue` rather than the CI runner's `/home/runner/work/<repo>/…`.
+ */
+declare function stripFindings(diagnostics: Diagnostic[], rootDir?: string): PushedFinding[];
+/**
+ * Build the top-level POST body. CI fields (commitSha, branch, prNumber) are
+ * included ONLY when the matching GITHUB_* env var is set.
+ */
+declare function buildPushPayload(input: PushPayloadInput): PushPayload;
+/**
+ * Strip + POST findings to a SaaS endpoint. Never throws — returns
+ * `{ ok: false, error }` on any HTTP / network failure so the audit's
+ * exit code is not affected by SaaS downtime.
+ */
+declare function pushFindings(opts: PushOptions): Promise<PushResult>;
+//#endregion
+export { type ApplyInlineDisablesOptions, type AuditConfig, type AuditReport, type AuditTimings, BUILT_IN_RECOMMENDED, type Capability, type CliOverrides, ConfigCycleError, ConfigFileNotFoundError, type ConfigSource, DOCTOR_REPORT_SCHEMA_VERSION, DeadCodeImportFailed, DeadCodeTimeoutError, type Diagnostic, type DiagnosticSource, type DirectiveLine, type DirectiveRange, type DirectiveSet, type DoctorReport, type DoctorUserConfig, type Framework, type GitScopeMode, type InitConfigFormat, type InitFileWrite, type InitOptions, type InitPlan, type InitPreset, InvalidConfigError, type ListRulesFilter, type LoadRuleDocOptions, type MonorepoKind, type MonorepoResult, OxlintOutputTooLarge, OxlintSpawnFailed, type ProjectInfo, type ProjectInfoLite, type PushOptions, type PushPayload, type PushPayloadInput, type PushResult, type PushedFinding, RULE_REGISTRY, type RawInitAnswers, type RegisteredRule, type ReporterFormat, type ReporterInput, type ReporterOptions, type ResolvedDoctorConfig, type ResolvedInitAnswers, type RuleCategory, type RuleDoc, type RuleSource, type ScoreBreakdownEntry, type ScoreConfig, type ScoreResult, type Severity, type VerboseTraceOptions, type WorkspacePackage, agentReport, applyInlineDisables, audit, buildDoctorReport, buildPushPayload, checkBuildQuality, checkDeadCode, checkDeps, checkNuxtProject, dedupeDeadCodeAgainstLint, defineConfig, detectProject, detectSummary, docsUrl, encodeAnnotation, encodeAnnotations, filterReportByRules, findMonorepoRoot, format, isNuxtLayoutFile, isNuxtPageFile, isNuxtServerFile, jsonCompactReport, jsonReport, listChangedFiles, listRules, listWorkspacePackages, loadAllRuleDocs, loadDoctorConfig, loadRuleDoc, mergeCliOverrides, normalizeInitAnswers, parseDirectives, parseExcludeList, planInit, prCommentReport, prettyReport, pushFindings, renderDetectSummary, renderVerboseTrace, runCrossFilePass, sarifReport, scoreDiagnostics, stripFindings, validateConfig };
 //# sourceMappingURL=index.d.ts.map

package/dist/index.js

@@ -1,5 +1,5 @@
 import { a as listRules, c as InvalidConfigError, i as RULE_REGISTRY, l as BUILT_IN_RECOMMENDED, o as ConfigCycleError, r as validateConfig, s as ConfigFileNotFoundError, t as loadDoctorConfig } from "./load-yXDi-5ti.js";
-import { dirname, join, relative, resolve } from "node:path";
+import { dirname, isAbsolute, join, relative, resolve } from "node:path";
 import { performance } from "node:perf_hooks";
 import { access, mkdir, mkdtemp, readFile, readdir, rm, writeFile } from "node:fs/promises";
 import { createRequire } from "node:module";
@@ -3011,7 +3011,7 @@ async function listWorkspacePackages(rootDir) {
 //#endregion
 //#region src/reporters/docs-url.ts
 function docsUrl(ruleId) {
-	return `https://docs.doctor.geoql.in/rules/${ruleId}`;
+	return `https://docs.the-doctor.report/rules/${ruleId}`;
 }
 //#endregion
 //#region src/reporters/render.ts
@@ -3374,7 +3374,7 @@ function jsonCompactReport(input) {
 }
 //#endregion
 //#region src/reporters/pr-comment.ts
-const DOCS_BASE = "https://docs.doctor.geoql.in/rules/";
+const DOCS_BASE = "https://docs.the-doctor.report/rules/";
 const MAX_PER_SECTION = 5;
 function binName(toolName) {
 	return toolName.replace("@geoql/", "");
@@ -3474,6 +3474,165 @@ function format(input, kind = "agent", options) {
 	return agentReport(input, options);
 }
 //#endregion
-export { BUILT_IN_RECOMMENDED, ConfigCycleError, ConfigFileNotFoundError, DOCTOR_REPORT_SCHEMA_VERSION, DeadCodeImportFailed, DeadCodeTimeoutError, InvalidConfigError, OxlintOutputTooLarge, OxlintSpawnFailed, RULE_REGISTRY, agentReport, applyInlineDisables, audit, buildDoctorReport, checkBuildQuality, checkDeadCode, checkDeps, checkNuxtProject, dedupeDeadCodeAgainstLint, defineConfig, detectProject, detectSummary, docsUrl, encodeAnnotation, encodeAnnotations, findMonorepoRoot, format, isNuxtLayoutFile, isNuxtPageFile, isNuxtServerFile, jsonCompactReport, jsonReport, listChangedFiles, listRules, listWorkspacePackages, loadAllRuleDocs, loadDoctorConfig, loadRuleDoc, mergeCliOverrides, normalizeInitAnswers, parseDirectives, parseExcludeList, planInit, prCommentReport, prettyReport, renderDetectSummary, renderVerboseTrace, runCrossFilePass, sarifReport, scoreDiagnostics, validateConfig };
+//#region src/audit-filter.ts
+/**
+* Filter `report.diagnostics` to a known set of allowed rule ids, then
+* recompute `score`, `errorCount`, `warnCount`, `infoCount`, `scoreResult`,
+* `ruleCounts`, and `exitCode` from the filtered array.
+*
+* Why: the CLI layer calls `audit()` and then applies its own
+* `allowedRuleIds` filter to drop suppressed (`off`) and preset-excluded
+* (`info` rules not in `recommended`) diagnostics. The audit's own
+* `score`/`counts` are computed BEFORE the CLI filter, so they still
+* include the suppressed findings. That desync surfaces to consumers
+* (the SaaS `--push` payload, the dashboard's counts-but-no-findings bug)
+* and to the `score` itself (suppressed findings still penalize).
+*
+* Invariant enforced here:
+*   report.errorCount + report.warnCount + report.infoCount === report.diagnostics.length
+*   report.scoreResult.totalFindings === report.diagnostics.length
+*
+* `exitCode=2` (oxlint crash) is preserved verbatim; `exitCode=1` is
+* recomputed from the surviving counts + the `failOn` gate.
+*/
+function filterReportByRules(report, allowedRuleIds, failOn = "error", oxlintStderr) {
+	const filtered = [];
+	for (const d of report.diagnostics) if (allowedRuleIds.has(d.ruleId)) filtered.push(d);
+	const threshold = report.scoreResult.threshold;
+	const scoreResult = scoreDiagnostics(filtered, { threshold });
+	const ruleCounts = {};
+	for (const d of filtered) ruleCounts[d.ruleId] = (ruleCounts[d.ruleId] ?? 0) + 1;
+	let exitCode = report.exitCode;
+	if (exitCode !== 2) if (failOn === "none") exitCode = 0;
+	else exitCode = (failOn === "warn" ? scoreResult.errorCount + scoreResult.warnCount : scoreResult.errorCount) > 0 ? 1 : 0;
+	return {
+		...report,
+		diagnostics: filtered,
+		score: scoreResult.score,
+		errorCount: scoreResult.errorCount,
+		warnCount: scoreResult.warnCount,
+		infoCount: scoreResult.infoCount,
+		scoreResult,
+		ruleCounts,
+		exitCode
+	};
+}
+//#endregion
+//#region src/push.ts
+const PUSH_TIMEOUT_MS = 5e3;
+const categoryByRuleId = new Map(RULE_REGISTRY.map((r) => [r.id, r.category]));
+function lookupCategory(ruleId) {
+	return categoryByRuleId.get(ruleId) ?? "unknown";
+}
+function toRepoRelative(file, rootDir) {
+	if (!rootDir || !isAbsolute(file)) return file;
+	const rel = relative(rootDir, file);
+	if (rel.startsWith("..")) return file;
+	return rel;
+}
+/**
+* Strip a list of Diagnostics down to the 6 allowed push fields.
+* Privacy boundary: this function is the single point of enforcement.
+* If you add a new privacy-sensitive field to Diagnostic, add it to the deny list here.
+*
+* Absolute file paths are relativized against rootDir so dashboards show
+* `src/Foo.vue` rather than the CI runner's `/home/runner/work/<repo>/…`.
+*/
+function stripFindings(diagnostics, rootDir) {
+	const out = new Array(diagnostics.length);
+	for (let i = 0; i < diagnostics.length; i++) {
+		const d = diagnostics[i];
+		out[i] = {
+			file: toRepoRelative(d.file, rootDir),
+			line: d.line,
+			col: d.column,
+			ruleId: d.ruleId,
+			severity: d.severity,
+			category: lookupCategory(d.ruleId)
+		};
+	}
+	return out;
+}
+function readOptionalEnv(name) {
+	const v = process.env[name];
+	return v === void 0 || v === "" ? void 0 : v;
+}
+function readPrNumber() {
+	const raw = readOptionalEnv("GITHUB_PR_NUMBER");
+	if (raw === void 0) return void 0;
+	const n = Number(raw);
+	return Number.isFinite(n) ? n : void 0;
+}
+/**
+* Build the top-level POST body. CI fields (commitSha, branch, prNumber) are
+* included ONLY when the matching GITHUB_* env var is set.
+*/
+function buildPushPayload(input) {
+	const payload = {
+		project: input.project,
+		score: input.score,
+		errorCount: input.errorCount,
+		warnCount: input.warnCount,
+		infoCount: input.infoCount,
+		findings: input.findings
+	};
+	const commitSha = readOptionalEnv("GITHUB_SHA");
+	const branch = readOptionalEnv("GITHUB_REF_NAME");
+	const prNumber = readPrNumber();
+	if (commitSha !== void 0) payload.commitSha = commitSha;
+	if (branch !== void 0) payload.branch = branch;
+	if (prNumber !== void 0) payload.prNumber = prNumber;
+	return payload;
+}
+/**
+* Strip + POST findings to a SaaS endpoint. Never throws — returns
+* `{ ok: false, error }` on any HTTP / network failure so the audit's
+* exit code is not affected by SaaS downtime.
+*/
+async function pushFindings(opts) {
+	const findings = stripFindings(opts.diagnostics, opts.rootDir);
+	const payload = buildPushPayload({
+		project: opts.project,
+		score: opts.score,
+		errorCount: opts.errorCount,
+		warnCount: opts.warnCount,
+		infoCount: opts.infoCount,
+		findings
+	});
+	const fetchImpl = opts.fetchImpl ?? fetch;
+	const controller = new AbortController();
+	const timeoutMs = opts.timeoutMs ?? PUSH_TIMEOUT_MS;
+	const timer = setTimeout(() => controller.abort(), timeoutMs);
+	timer.unref?.();
+	try {
+		const res = await fetchImpl(opts.url, {
+			method: "POST",
+			headers: {
+				"Content-Type": "application/json",
+				"x-api-key": opts.apiKey
+			},
+			body: JSON.stringify(payload),
+			signal: controller.signal
+		});
+		clearTimeout(timer);
+		if (res.ok) return {
+			ok: true,
+			status: res.status
+		};
+		return {
+			ok: false,
+			status: res.status,
+			error: `HTTP ${res.status} ${res.statusText}`.trim()
+		};
+	} catch (err) {
+		clearTimeout(timer);
+		return {
+			ok: false,
+			error: err instanceof Error ? err.message : String(err)
+		};
+	}
+}
+//#endregion
+export { BUILT_IN_RECOMMENDED, ConfigCycleError, ConfigFileNotFoundError, DOCTOR_REPORT_SCHEMA_VERSION, DeadCodeImportFailed, DeadCodeTimeoutError, InvalidConfigError, OxlintOutputTooLarge, OxlintSpawnFailed, RULE_REGISTRY, agentReport, applyInlineDisables, audit, buildDoctorReport, buildPushPayload, checkBuildQuality, checkDeadCode, checkDeps, checkNuxtProject, dedupeDeadCodeAgainstLint, defineConfig, detectProject, detectSummary, docsUrl, encodeAnnotation, encodeAnnotations, filterReportByRules, findMonorepoRoot, format, isNuxtLayoutFile, isNuxtPageFile, isNuxtServerFile, jsonCompactReport, jsonReport, listChangedFiles, listRules, listWorkspacePackages, loadAllRuleDocs, loadDoctorConfig, loadRuleDoc, mergeCliOverrides, normalizeInitAnswers, parseDirectives, parseExcludeList, planInit, prCommentReport, prettyReport, pushFindings, renderDetectSummary, renderVerboseTrace, runCrossFilePass, sarifReport, scoreDiagnostics, stripFindings, validateConfig };
 
 //# sourceMappingURL=index.js.map