@jmruthers/pace-core 0.6.7 → 0.6.8

package/audit-tool/00-dependencies.cjs

@@ -80,6 +80,24 @@ function matchesVersionRange(version, range) {
   return version.startsWith(range.replace(/[\^~]/, ''));
 }
 
+// Compare two version strings (e.g., "4.1.8" vs "4.1.16")
+// Returns: -1 if v1 < v2, 0 if v1 === v2, 1 if v1 > v2
+function compareVersions(v1, v2) {
+  const parts1 = v1.split('.').map(Number);
+  const parts2 = v2.split('.').map(Number);
+  const maxLength = Math.max(parts1.length, parts2.length);
+  
+  for (let i = 0; i < maxLength; i++) {
+    const part1 = parts1[i] || 0;
+    const part2 = parts2[i] || 0;
+    
+    if (part1 < part2) return -1;
+    if (part1 > part2) return 1;
+  }
+  
+  return 0;
+}
+
 // Check version compatibility
 function checkVersion(installed, required) {
   if (!required) return { valid: true };
@@ -88,18 +106,46 @@ function checkVersion(installed, required) {
   const installedVersion = installed.replace(/[\^~]/, '');
   const requiredVersion = required.replace(/[\^~]/, '');
   
-  // Check major version
-  const installedMajor = parseInt(installedVersion.split('.')[0]);
-  const requiredMajor = parseInt(requiredVersion.split('.')[0]);
+  // Parse version parts
+  const installedParts = installedVersion.split('.').map(Number);
+  const requiredParts = requiredVersion.split('.').map(Number);
+  
+  const installedMajor = installedParts[0] || 0;
+  const requiredMajor = requiredParts[0] || 0;
   
   if (required.startsWith('^')) {
+    // Caret range: ^4.1.16 means >= 4.1.16 and < 5.0.0
+    // Check if installed version is >= required version
+    const versionComparison = compareVersions(installedVersion, requiredVersion);
+    
+    // Must be same major version and >= required version
+    const valid = installedMajor === requiredMajor && versionComparison >= 0;
+    
     return {
-      valid: installedMajor >= requiredMajor,
+      valid,
       installed,
       required,
     };
   }
   
+  if (required.startsWith('~')) {
+    // Tilde range: ~4.1.16 means >= 4.1.16 and < 4.2.0
+    const versionComparison = compareVersions(installedVersion, requiredVersion);
+    const installedMinor = installedParts[1] || 0;
+    const requiredMinor = requiredParts[1] || 0;
+    
+    const valid = installedMajor === requiredMajor && 
+                  installedMinor === requiredMinor && 
+                  versionComparison >= 0;
+    
+    return {
+      valid,
+      installed,
+      required,
+    };
+  }
+  
+  // Exact match or no prefix - check major version
   return {
     valid: installedMajor === requiredMajor,
     installed,
@@ -114,7 +160,7 @@ function runDependencyAudit(consumingAppPath = process.cwd()) {
   if (!fs.existsSync(packageJsonPath)) {
     return {
       error: `package.json not found at ${packageJsonPath}`,
-      issues: { includedDeps: [], missingRequired: [], missingOptional: [], versionIssues: [], wrongLocation: [] }
+      issues: { includedDeps: [], missingRequired: [], missingOptional: [], versionIssues: [], wrongLocation: [], missingDevDeps: [], devVersionIssues: [] }
     };
   }
   
@@ -123,22 +169,41 @@ function runDependencyAudit(consumingAppPath = process.cwd()) {
   if (!paceCorePath) {
     return {
       error: 'Could not find pace-core package.json. Make sure @jmruthers/pace-core is installed in your project.',
-      issues: { includedDeps: [], missingRequired: [], missingOptional: [], versionIssues: [], wrongLocation: [] }
+      issues: { includedDeps: [], missingRequired: [], missingOptional: [], versionIssues: [], wrongLocation: [], missingDevDeps: [], devVersionIssues: [] }
     };
   }
   
   const paceCorePkg = JSON.parse(fs.readFileSync(paceCorePath, 'utf8'));
   const INCLUDED_DEPS = Object.keys(paceCorePkg.dependencies || {});
   const PEER_DEPS = paceCorePkg.peerDependencies || {};
-  const REQUIRED_PEERS = ['react', 'react-dom', 'react-router-dom', 'tailwindcss'];
-  const OPTIONAL_PEERS = Object.keys(PEER_DEPS).filter(dep => !REQUIRED_PEERS.includes(dep));
+  const PEER_META = paceCorePkg.peerDependenciesMeta || {};
+  
+  // Required peers are those NOT marked as optional in peerDependenciesMeta
+  const REQUIRED_PEERS = Object.keys(PEER_DEPS).filter(
+    dep => !PEER_META[dep]?.optional
+  );
+  
+  // Optional peers are those marked as optional in peerDependenciesMeta
+  const OPTIONAL_PEERS = Object.keys(PEER_DEPS).filter(
+    dep => PEER_META[dep]?.optional
+  );
+  
+  // Validation warnings: check if any peer dependency is missing from peerDependenciesMeta
+  const missingMeta = Object.keys(PEER_DEPS).filter(
+    dep => !PEER_META[dep]
+  );
+  
+  if (missingMeta.length > 0) {
+    console.warn(`${colors.yellow}Warning: The following peer dependencies are missing from peerDependenciesMeta: ${missingMeta.join(', ')}${colors.reset}`);
+    console.warn(`${colors.yellow}They will be treated as required. Add them to peerDependenciesMeta to mark them as optional.${colors.reset}`);
+  }
   
   // Verify pace-core is installed
   const paceCoreInNodeModules = path.join(consumingAppPath, 'node_modules', '@jmruthers', 'pace-core', 'package.json');
   if (!fs.existsSync(paceCoreInNodeModules)) {
     return {
       error: '@jmruthers/pace-core not found in node_modules. Please run: npm install @jmruthers/pace-core',
-      issues: { includedDeps: [], missingRequired: [], missingOptional: [], versionIssues: [], wrongLocation: [] }
+      issues: { includedDeps: [], missingRequired: [], missingOptional: [], versionIssues: [], wrongLocation: [], missingDevDeps: [], devVersionIssues: [] }
     };
   }
   
@@ -154,6 +219,8 @@ function runDependencyAudit(consumingAppPath = process.cwd()) {
     missingOptional: [],
     versionIssues: [],
     wrongLocation: [],
+    missingDevDeps: [],
+    devVersionIssues: [],
   };
   
   // Check for included dependencies
@@ -216,6 +283,107 @@ function runDependencyAudit(consumingAppPath = process.cwd()) {
     });
   }
   
+  // Check required dev dependencies
+  // Get pace-core's dev dependencies to use as reference versions
+  const paceCoreDevDeps = paceCorePkg.devDependencies || {};
+  const devDeps = consumingPkg.devDependencies || {};
+  
+  // Build list of required dev dependencies dynamically from pace-core's devDependencies
+  // Exclude packages that consuming apps don't need:
+  // 1. pace-core-specific build tools (tsup, typedoc, etc.)
+  // 2. Testing libraries (consuming apps may use different testing setups)
+  // 3. Type definitions (@types/* - consuming apps manage their own)
+  // 4. Packages already checked as peer dependencies (except tailwindcss which we check in both)
+  // 5. Packages already included in pace-core's dependencies
+  
+  const requiredDevDeps = {};
+  
+  Object.entries(paceCoreDevDeps).forEach(([dep, version]) => {
+    // Skip pace-core-specific build tools
+    if (dep === 'tsup' || 
+        dep === 'typedoc' || 
+        dep.startsWith('typedoc-plugin-') ||
+        dep === 'esbuild' ||
+        dep === '@vitest/coverage-v8') {
+      return;
+    }
+    
+    // Skip testing libraries (consuming apps may use different testing)
+    if (dep.includes('testing-library') || 
+        dep === 'jsdom' ||
+        dep === 'vitest') {
+      return;
+    }
+    
+    // Skip type definitions (consuming apps manage their own @types/*)
+    if (dep.startsWith('@types/')) {
+      return;
+    }
+    
+    // Skip if it's already a peer dependency (checked separately)
+    // Exception: tailwindcss - we check both peer and dev dependency versions
+    if (PEER_DEPS[dep] && dep !== 'tailwindcss') {
+      return;
+    }
+    
+    // Skip if it's already in pace-core's dependencies (included, not needed by consuming apps)
+    if (INCLUDED_DEPS.includes(dep)) {
+      return;
+    }
+    
+    // Skip if it's in pace-core's dependencies (shouldn't be in devDependencies)
+    if (paceCorePkg.dependencies?.[dep]) {
+      return;
+    }
+    
+    // Add to required dev dependencies - versions come directly from pace-core's package.json
+    requiredDevDeps[dep] = version;
+  });
+  
+  // Override tailwindcss version with peer dependency version if available
+  // This ensures we use the peer dependency requirement, not the dev dependency version
+  if (PEER_DEPS.tailwindcss) {
+    requiredDevDeps.tailwindcss = PEER_DEPS.tailwindcss;
+  }
+  
+  // Check for missing required dev dependencies
+  Object.entries(requiredDevDeps).forEach(([dep, requiredVersion]) => {
+    if (!requiredVersion) return; // Skip if pace-core doesn't specify a version
+    
+    if (!devDeps[dep] && !consumingPkg.dependencies?.[dep]) {
+      issues.missingDevDeps.push({
+        package: dep,
+        required: requiredVersion,
+      });
+    } else {
+      // Check version if installed
+      const installedVersion = devDeps[dep] || consumingPkg.dependencies?.[dep];
+      if (installedVersion) {
+        const versionCheck = checkVersion(installedVersion, requiredVersion);
+        if (!versionCheck.valid) {
+          issues.devVersionIssues.push({
+            package: dep,
+            installed: versionCheck.installed,
+            required: versionCheck.required,
+            location: devDeps[dep] ? 'devDependencies' : 'dependencies',
+          });
+        }
+      }
+    }
+  });
+  
+  // Check for dev dependencies in wrong location (should be in devDependencies, not dependencies)
+  // This is dynamic - check all required dev dependencies
+  Object.keys(requiredDevDeps).forEach(dep => {
+    if (consumingPkg.dependencies?.[dep] && !devDeps[dep]) {
+      issues.wrongLocation.push({
+        package: dep,
+        current: 'dependencies',
+        shouldBe: 'devDependencies',
+      });
+    }
+  });
+  
   // Find pace-core version - check dependencies, devDependencies, or installed package
   let paceCoreVersion = consumingPkg.dependencies?.['@jmruthers/pace-core'] || 
                         consumingPkg.devDependencies?.['@jmruthers/pace-core'];
@@ -315,6 +483,28 @@ function auditDependencies(consumingAppPath = process.cwd()) {
     console.log();
   }
   
+  // Missing dev dependencies (errors)
+  if (issues.missingDevDeps.length > 0) {
+    hasErrors = true;
+    console.log(`${colors.red}❌ MISSING REQUIRED DEV DEPENDENCIES:${colors.reset}`);
+    issues.missingDevDeps.forEach(issue => {
+      console.log(`  - ${colors.red}${issue.package}${colors.reset} (required: ${issue.required})`);
+    });
+    console.log();
+  }
+  
+  // Dev version issues (errors)
+  if (issues.devVersionIssues.length > 0) {
+    hasErrors = true;
+    console.log(`${colors.yellow}⚠️  DEV DEPENDENCY VERSION ISSUES:${colors.reset}`);
+    issues.devVersionIssues.forEach(issue => {
+      console.log(`  - ${colors.yellow}${issue.package}${colors.reset} (in ${issue.location})`);
+      console.log(`    Installed: ${issue.installed}`);
+      console.log(`    Required: ${issue.required}`);
+    });
+    console.log();
+  }
+  
   // Success message
   if (!hasErrors && issues.missingOptional.length === 0 && issues.wrongLocation.length === 0) {
     console.log(`${colors.green}✅ All dependencies are correctly configured!${colors.reset}\n`);
@@ -339,6 +529,14 @@ function auditDependencies(consumingAppPath = process.cwd()) {
       console.log(`npm install ${depsToInstall}\n`);
     }
     
+    if (issues.missingDevDeps.length > 0) {
+      const devDepsToInstall = issues.missingDevDeps
+        .map(i => `${i.package}@${i.required}`)
+        .join(' ');
+      console.log(`${colors.cyan}# Install missing required dev dependencies${colors.reset}`);
+      console.log(`npm install -D ${devDepsToInstall}\n`);
+    }
+    
     if (issues.versionIssues.length > 0) {
       const depsToFix = issues.versionIssues
         .map(i => `${i.package}@${i.required}`)
@@ -347,6 +545,14 @@ function auditDependencies(consumingAppPath = process.cwd()) {
       console.log(`npm install ${depsToFix}\n`);
     }
     
+    if (issues.devVersionIssues.length > 0) {
+      const devDepsToFix = issues.devVersionIssues
+        .map(i => `${i.package}@${i.required}`)
+        .join(' ');
+      console.log(`${colors.cyan}# Fix dev dependency version ranges${colors.reset}`);
+      console.log(`npm install -D ${devDepsToFix}\n`);
+    }
+    
     if (issues.wrongLocation.length > 0) {
       issues.wrongLocation.forEach(issue => {
         console.log(`${colors.cyan}# Move ${issue.package} to devDependencies${colors.reset}`);

package/audit-tool/audits/02-project-structure.cjs

@@ -197,28 +197,13 @@ function checkTestColocation(consumingAppPath) {
 
 /**
  * Check Supabase structure
+ * Note: Consuming apps don't need migrations directory - only pace-core handles migrations
  */
 function checkSupabaseStructure(consumingAppPath) {
   const issues = [];
   
-  const supabaseDir = path.join(consumingAppPath, 'supabase');
-  if (!directoryExists(supabaseDir)) {
-    // Supabase structure is optional
-    return issues;
-  }
-  
-  // Check for migrations directory
-  const migrationsDir = path.join(supabaseDir, 'migrations');
-  if (!directoryExists(migrationsDir)) {
-    issues.push({
-      type: 'supabaseStructure',
-      file: 'supabase/migrations/',
-      line: 0,
-      message: 'supabase/migrations/ directory not found. Database migrations should be stored here.',
-      severity: 'warning',
-      fix: 'Create supabase/migrations/ directory for database migrations',
-    });
-  }
+  // Consuming apps don't need supabase/migrations - only pace-core handles migrations
+  // This check has been removed as it's not applicable to consuming apps
   
   return issues;
 }

package/audit-tool/audits/03-architecture.cjs

@@ -25,8 +25,26 @@ function checkComponentBoundaries(consumingAppPath) {
   }
   
   const componentFiles = findSourceFiles(srcDir).filter(file => {
+    // Only check actual component files, not test files or utility files
+    const isTestFile = file.includes('.test.') || file.includes('.spec.');
+    const isUtilityFile = file.endsWith('Utils.ts') || 
+                         file.endsWith('Utils.tsx') ||
+                         file.endsWith('Helpers.ts') ||
+                         file.endsWith('Helpers.tsx') ||
+                         file.includes('testUtils') ||
+                         file.includes('testHelpers') ||
+                         file.includes('testAssertions') ||
+                         file.includes('testSetup');
+    
+    if (isTestFile || isUtilityFile) {
+      return false;
+    }
+    
     const dir = path.dirname(file);
-    return dir.includes('/components/') || dir.includes('/pages/');
+    const isComponentDir = dir.includes('/components/') || dir.includes('/pages/');
+    const isComponentFile = file.endsWith('.tsx') || (file.endsWith('.ts') && !isUtilityFile);
+    
+    return isComponentDir && isComponentFile;
   });
   
   componentFiles.forEach(filePath => {
@@ -71,18 +89,28 @@ function checkComponentBoundaries(consumingAppPath) {
     });
     
     // Check for complex business logic in components
+    // Only flag actual business logic patterns, not UI text or comments
     const businessLogicPatterns = [
-      /if\s*\([^)]*permission/i,
-      /if\s*\([^)]*role/i,
-      /calculate|compute|process/i,
+      /if\s*\([^)]*permission[^)]*\)/i,  // Permission checks
+      /if\s*\([^)]*role[^)]*\)/i,        // Role checks
+      /calculate\w*\s*\(/i,              // Calculation functions
+      /compute\w*\s*\(/i,                 // Computation functions
+      /process\w+\s*\(/i,                 // Process functions (not "Processing..." text)
     ];
     
     // This is a heuristic - look for complex logic that should be in hooks/utils
+    // Exclude common UI text patterns
+    const hasUIOnlyText = /Processing\.\.\.|processing\.\.\./i.test(content);
     const hasComplexLogic = businessLogicPatterns.some(pattern => pattern.test(content));
-    if (hasComplexLogic) {
+    
+    if (hasComplexLogic && !hasUIOnlyText) {
       // Check if logic is in a hook call (acceptable)
       const hasHookCalls = /use[A-Z]\w*\s*\(/.test(content);
-      if (!hasHookCalls) {
+      // Check if it's just a simple conditional render (acceptable)
+      const isSimpleConditional = /return\s*\([^)]*\?[^)]*:[^)]*\)/.test(content) ||
+                                  /\{[^}]*\?[^}]*:[^}]*\}/.test(content);
+      
+      if (!hasHookCalls && !isSimpleConditional) {
         issues.push({
           type: 'componentBoundary',
           file: relativePath,

package/audit-tool/audits/06-security-rbac.cjs

@@ -377,6 +377,16 @@ function checkPagePermissionGuardCoverage(consumingAppPath) {
     }
     
     const relativePath = getRelativePath(filePath, consumingAppPath);
+    const fileName = path.basename(filePath, path.extname(filePath));
+    
+    // Exclude public/error pages that don't need RBAC protection
+    // NotFound, 404, Error, Unauthorized, Forbidden, AccessDenied pages are public
+    const isPublicPage = /NotFound|not.*found|404|Error|Unauthorized|Forbidden|AccessDenied/i.test(fileName) ||
+                        /public|error|unauthorized|forbidden|access.*denied/i.test(relativePath);
+    
+    if (isPublicPage) {
+      return; // Skip public/error pages - they don't need PagePermissionGuard
+    }
     
     // Check if PagePermissionGuard is used
     const hasPagePermissionGuard = /<PagePermissionGuard/.test(content) || 

package/audit-tool/audits/07-api-tech-stack.cjs

@@ -256,7 +256,61 @@ function checkViteConfig(consumingAppPath) {
   }
   
   // Check for resolve.dedupe (should dedupe React dependencies)
-  const hasResolveDedupe = /resolve\s*:\s*\{[^}]*dedupe/.test(content);
+  // Need to handle nested objects, so look for dedupe anywhere after resolve: {
+  // Match resolve: { ... and then look for dedupe before the matching closing brace
+  // Use a more flexible pattern that handles nested braces
+  const resolvePattern = /resolve\s*:\s*\{/;
+  const resolveMatch = content.match(resolvePattern);
+  
+  let hasResolveDedupe = false;
+  if (resolveMatch) {
+    const resolveStart = resolveMatch.index + resolveMatch[0].length;
+    // Find the matching closing brace for the resolve object
+    let braceCount = 1;
+    let i = resolveStart;
+    let resolveEnd = -1;
+    
+    while (i < content.length && braceCount > 0) {
+      if (content[i] === '{') braceCount++;
+      if (content[i] === '}') braceCount--;
+      if (braceCount === 0) {
+        resolveEnd = i;
+        break;
+      }
+      i++;
+    }
+    
+    if (resolveEnd > 0) {
+      const resolveBody = content.substring(resolveStart, resolveEnd);
+      // Check if dedupe exists in the resolve object body
+      hasResolveDedupe = /dedupe\s*:/.test(resolveBody);
+      
+      // Also verify it includes the required dependencies
+      if (hasResolveDedupe) {
+        const dedupePattern = /dedupe\s*:\s*\[([^\]]+)\]/;
+        const dedupeMatch = resolveBody.match(dedupePattern);
+        if (dedupeMatch) {
+          const dedupeArray = dedupeMatch[1];
+          const hasReact = /['"]react['"]/.test(dedupeArray);
+          const hasReactDom = /['"]react-dom['"]/.test(dedupeArray);
+          const hasReactRouter = /['"]react-router-dom['"]/.test(dedupeArray);
+          
+          // If any required dependency is missing, flag it
+          if (!hasReact || !hasReactDom || !hasReactRouter) {
+            issues.push({
+              type: 'viteConfig',
+              file: relativePath,
+              line: 1,
+              message: 'vite.config.ts resolve.dedupe is missing required dependencies. Should include: react, react-dom, react-router-dom',
+              severity: 'warning',
+              fix: 'Update resolve.dedupe to include: [\'react\', \'react-dom\', \'react-router-dom\']',
+            });
+          }
+        }
+      }
+    }
+  }
+  
   if (!hasResolveDedupe) {
     issues.push({
       type: 'viteConfig',

package/audit-tool/index.cjs

@@ -164,6 +164,25 @@ function main() {
   // Display audit results summary
   console.log(`\n${colors.bold}Audit Results:${colors.reset}\n`);
   
+  // Display dependency audit first
+  if (dependencyResult.error) {
+    console.log(`  ${colors.red}❌ Dependency Audit: Error - ${dependencyResult.error}${colors.reset}`);
+  } else {
+    const depIssues = dependencyResult.issues || {};
+    const depCount = (depIssues.includedDeps?.length || 0) +
+                     (depIssues.missingRequired?.length || 0) +
+                     (depIssues.versionIssues?.length || 0) +
+                     (depIssues.wrongLocation?.length || 0) +
+                     (depIssues.missingDevDeps?.length || 0) +
+                     (depIssues.devVersionIssues?.length || 0);
+    
+    if (depCount === 0) {
+      console.log(`  ${colors.green}✅ Dependency Audit: 0 issues${colors.reset}`);
+    } else {
+      console.log(`  ${colors.red}❌ Dependency Audit: ${depCount} issue(s)${colors.reset}`);
+    }
+  }
+  
   // Display each standard
   Object.entries(standardResults).forEach(([key, result]) => {
     const standardNames = {
@@ -189,34 +208,19 @@ function main() {
     }
   });
   
-  // Display dependency audit
-  if (dependencyResult.error) {
-    console.log(`  ${colors.red}❌ Dependency Audit: Error - ${dependencyResult.error}${colors.reset}`);
-  } else {
-    const depIssues = dependencyResult.issues || {};
-    const depCount = (depIssues.includedDeps?.length || 0) +
-                     (depIssues.missingRequired?.length || 0) +
-                     (depIssues.versionIssues?.length || 0) +
-                     (depIssues.wrongLocation?.length || 0);
-    
-    if (depCount === 0) {
-      console.log(`  ${colors.green}✅ Dependency Audit: 0 issues${colors.reset}`);
-    } else {
-      console.log(`  ${colors.red}❌ Dependency Audit: ${depCount} issue(s)${colors.reset}`);
-    }
-  }
-  
   // Total summary
   const totalIssues = summary.total + (dependencyResult.error ? 0 : 
     ((dependencyResult.issues?.includedDeps?.length || 0) +
      (dependencyResult.issues?.missingRequired?.length || 0) +
      (dependencyResult.issues?.versionIssues?.length || 0) +
-     (dependencyResult.issues?.wrongLocation?.length || 0)));
+     (dependencyResult.issues?.wrongLocation?.length || 0) +
+     (dependencyResult.issues?.missingDevDeps?.length || 0) +
+     (dependencyResult.issues?.devVersionIssues?.length || 0)));
   
   console.log(`\n${colors.bold}Total Issues: ${totalIssues === 0 ? colors.green + '0 (All checks passed!)' : colors.red + totalIssues}${colors.reset}\n`);
   
   // Generate and save markdown report
-  const markdownReport = generateMarkdownReport(standardResults, consumingAppPath);
+  const markdownReport = generateMarkdownReport(standardResults, consumingAppPath, dependencyResult);
   
   // Generate timestamp in yyyymmddHHMM format
   const now = new Date();