@haystackeditor/cli 0.15.17 → 0.15.19

package/dist/verification/validate.js

@@ -1,219 +0,0 @@
-/**
- * Contract validator — answers "can Haystack trust this repo's verification
- * setup?" without running anything expensive.
- *
- * Readiness verdicts:
- *   ready            all checks pass
- *   partially_ready  usable, but with gaps (warnings)
- *   not_ready        contract missing/invalid or references broken commands
- *   unsafe           the contract permits real external side effects, or
- *                    defines login helpers with no production-disabled proof
- */
-import * as fs from 'node:fs/promises';
-import * as path from 'node:path';
-import { loadContract } from './contract.js';
-/** Package-manager subcommands that are built-ins, not package.json scripts. */
-const PM_BUILTINS = new Set([
-    'install', 'i', 'ci', 'add', 'remove', 'rm', 'uninstall', 'update', 'up', 'upgrade',
-    'exec', 'dlx', 'npx', 'create', 'init', 'link', 'unlink', 'publish', 'pack',
-    'audit', 'outdated', 'why', 'list', 'ls', 'prune', 'rebuild', 'config', 'store',
-]);
-export async function validateContract(rootDir = process.cwd()) {
-    const loaded = await loadContract(rootDir);
-    if (loaded.status === 'missing') {
-        return {
-            readiness: 'not_ready',
-            contract_path: loaded.path,
-            items: [
-                {
-                    level: 'fail',
-                    message: `No contract found at ${path.relative(rootDir, loaded.path)} — run \`haystack verification init\``,
-                },
-            ],
-        };
-    }
-    if (loaded.status === 'invalid') {
-        return {
-            readiness: 'not_ready',
-            contract_path: loaded.path,
-            items: loaded.errors.map((error) => ({ level: 'fail', message: error })),
-        };
-    }
-    const contract = loaded.contract;
-    const items = [];
-    items.push({ level: 'pass', message: 'Contract parses and matches the schema' });
-    // ── Command references ─────────────────────────────────────────────────────
-    const packageScripts = await readPackageScripts(rootDir);
-    const commands = [];
-    const env = contract.environment;
-    if (env.setup)
-        commands.push({ label: 'environment.setup', command: env.setup });
-    if (env.start)
-        commands.push({ label: 'environment.start', command: env.start });
-    commands.push({ label: 'environment.preflight', command: env.preflight });
-    if (env.reset)
-        commands.push({ label: 'environment.reset', command: env.reset });
-    if (contract.safety.production_disabled_check) {
-        commands.push({
-            label: 'safety.production_disabled_check',
-            command: contract.safety.production_disabled_check,
-        });
-    }
-    for (const [name, scenario] of Object.entries(contract.scenarios)) {
-        commands.push({ label: `scenarios.${name}`, command: scenario.command });
-    }
-    for (const [name, persona] of Object.entries(contract.personas)) {
-        commands.push({ label: `personas.${name}.login`, command: persona.login });
-    }
-    for (const { label, command } of commands) {
-        const issue = await checkCommandReference(command, rootDir, packageScripts);
-        if (issue) {
-            items.push({ level: issue.level, message: `${label}: ${issue.message}` });
-        }
-    }
-    // ── Coverage warnings ──────────────────────────────────────────────────────
-    const scenarioNames = Object.keys(contract.scenarios);
-    items.push({
-        level: 'pass',
-        message: `${scenarioNames.length} scenario${scenarioNames.length === 1 ? '' : 's'} defined (${scenarioNames.join(', ')})`,
-    });
-    if (!scenarioNames.includes('smoke')) {
-        items.push({
-            level: 'warn',
-            message: 'No `smoke` scenario — add a basic logged-in smoke test so every risky PR has a baseline check',
-        });
-    }
-    if (Object.keys(contract.personas).length === 0) {
-        items.push({
-            level: 'warn',
-            message: 'No personas defined — logged-in and role-based flows cannot be verified',
-        });
-    }
-    if (!env.start) {
-        items.push({
-            level: 'warn',
-            message: 'No start command — scenarios must boot the app themselves',
-        });
-    }
-    if (!env.reset) {
-        items.push({
-            level: 'warn',
-            message: 'No reset command — repeated runs may not start from a clean state',
-        });
-    }
-    const artifactDir = path.resolve(rootDir, env.artifact_dir);
-    if (await pathExists(artifactDir)) {
-        items.push({ level: 'pass', message: `Artifact directory exists (${env.artifact_dir})` });
-    }
-    else {
-        items.push({
-            level: 'pass',
-            message: `Artifact directory configured (${env.artifact_dir}) — will be created on first run`,
-        });
-    }
-    // ── Safety ─────────────────────────────────────────────────────────────────
-    const safety = contract.safety;
-    for (const [flag, value] of [
-        ['allow_real_email', safety.allow_real_email],
-        ['allow_real_payments', safety.allow_real_payments],
-        ['allow_customer_data', safety.allow_customer_data],
-    ]) {
-        if (value) {
-            items.push({
-                level: 'unsafe',
-                message: `safety.${flag} is true — verification must not have real external side effects`,
-            });
-        }
-    }
-    if (Object.keys(contract.personas).length > 0 && !safety.production_disabled_check) {
-        items.push({
-            level: 'unsafe',
-            message: 'Personas/login helpers are defined but safety.production_disabled_check is missing — there is no proof dev login is disabled in production builds',
-        });
-    }
-    if (safety.production_disabled_check) {
-        items.push({ level: 'pass', message: 'Production-disabled check configured' });
-    }
-    return {
-        readiness: computeReadiness(items),
-        contract_path: loaded.path,
-        items,
-    };
-}
-function computeReadiness(items) {
-    if (items.some((i) => i.level === 'unsafe'))
-        return 'unsafe';
-    if (items.some((i) => i.level === 'fail'))
-        return 'not_ready';
-    if (items.some((i) => i.level === 'warn'))
-        return 'partially_ready';
-    return 'ready';
-}
-async function readPackageScripts(rootDir) {
-    try {
-        const pkg = JSON.parse(await fs.readFile(path.join(rootDir, 'package.json'), 'utf-8'));
-        return pkg.scripts ?? {};
-    }
-    catch {
-        return null; // Not a Node project — script checks don't apply.
-    }
-}
-/**
- * Best-effort static check that a contract command points at something real.
- * Only definitive breakage is a `fail`; ambiguous cases (bare `pnpm foo` that
- * could resolve to a node_modules binary) are warnings.
- */
-async function checkCommandReference(command, rootDir, packageScripts) {
-    const tokens = command.trim().split(/\s+/);
-    // `bash scripts/x`, `sh ./scripts/x`, `node scripts/x.mjs`, or a direct
-    // `./scripts/x` — the referenced file must exist.
-    let scriptPath = null;
-    if (['bash', 'sh', 'node', 'python', 'python3', 'ruby'].includes(tokens[0]) && tokens[1]) {
-        scriptPath = tokens[1];
-    }
-    else if (tokens[0]?.startsWith('./') || tokens[0]?.startsWith('scripts/')) {
-        scriptPath = tokens[0];
-    }
-    if (scriptPath && !scriptPath.startsWith('-')) {
-        if (!(await pathExists(path.resolve(rootDir, scriptPath)))) {
-            return { level: 'fail', message: `references ${scriptPath}, which does not exist` };
-        }
-        return null;
-    }
-    // Package-manager script references.
-    if (packageScripts && ['pnpm', 'npm', 'yarn', 'bun'].includes(tokens[0])) {
-        let scriptName;
-        let explicitRun = false;
-        if (tokens[1] === 'run' && tokens[2]) {
-            scriptName = tokens[2];
-            explicitRun = true;
-        }
-        else if (tokens[1] && !tokens[1].startsWith('-')) {
-            scriptName = tokens[1];
-        }
-        if (!scriptName || PM_BUILTINS.has(scriptName))
-            return null;
-        if (packageScripts[scriptName])
-            return null;
-        if (explicitRun) {
-            return { level: 'fail', message: `script "${scriptName}" is not in package.json scripts` };
-        }
-        // Bare `pnpm foo` can also resolve to node_modules/.bin/foo.
-        if (await pathExists(path.join(rootDir, 'node_modules', '.bin', scriptName)))
-            return null;
-        return {
-            level: 'warn',
-            message: `"${scriptName}" is not in package.json scripts (and node_modules/.bin/${scriptName} was not found)`,
-        };
-    }
-    return null;
-}
-async function pathExists(p) {
-    try {
-        await fs.access(p);
-        return true;
-    }
-    catch {
-        return false;
-    }
-}