@limenet-ch/baseline 2.9.0

package/js/dist/checks/has-trivy-config-check.js

@@ -0,0 +1,179 @@
+import { parse, parseDocument } from 'yaml';
+import { policy } from '../policy.js';
+import { CI_FILE, checkRequiredCiJobs, readCiJobs } from '../support/ci-jobs.js';
+import { FixableCheck } from './check.js';
+/**
+ * Trivy's setup, identical to the Laravel runner's: the security CI job, the
+ * canonical trivy.yaml, an ignore file, and the cache directory in .gitignore.
+ *
+ * The canonical config skips paths a JS project does not have (`vendor/**`,
+ * `storage/logs/`, `.ddev/`). Skipping a directory that is not there costs
+ * nothing, and one shared template means the two runners cannot drift — so the
+ * npm runner requires the same file rather than a trimmed variant.
+ */
+export class HasTrivyConfigCheck extends FixableCheck {
+    static checkName = 'hasTrivyConfig';
+    fix(dry = false) {
+        const ciResult = checkRequiredCiJobs(this.project, policy().stringListMap('trivy.ciJob'), (message) => this.comment(message));
+        if (ciResult !== 'pass') {
+            if (dry) {
+                return ciResult;
+            }
+            this.addMissingCiJobs();
+        }
+        const gitignoreResult = this.ensureGitignoreEntry(policy().string('trivy.gitignoreEntry'), 'ignore the Trivy cache directory', dry);
+        if (gitignoreResult !== null && dry) {
+            return gitignoreResult;
+        }
+        const ignoreFile = policy().string('trivy.ignoreFile');
+        if (!this.project.exists(ignoreFile)) {
+            this.comment(`Missing ignore file: create ${ignoreFile} in project root (an empty file is acceptable)`);
+            if (dry) {
+                return 'fail';
+            }
+            this.project.write(ignoreFile, '');
+        }
+        const configFile = policy().string('trivy.configFile');
+        const contents = this.project.read(configFile);
+        if (contents === null) {
+            this.comment(`${configFile} not found`);
+            if (dry) {
+                return 'fail';
+            }
+            this.project.write(configFile, this.canonicalConfig());
+            return this.fix(true);
+        }
+        // parseDocument() keeps comments and formatting across the write below,
+        // and collects syntax errors instead of throwing.
+        const document = parseDocument(contents);
+        if (document.errors.length > 0) {
+            this.comment(`${configFile} could not be parsed: ${document.errors[0]?.message ?? 'invalid YAML'}`);
+            return 'fail';
+        }
+        const config = document.toJS();
+        if (typeof config !== 'object' || config === null) {
+            this.comment(`${configFile} is empty or invalid`);
+            return 'fail';
+        }
+        let changed = false;
+        for (const forbidden of policy().strings('trivy.forbiddenKeys')) {
+            if (!(forbidden in config)) {
+                continue;
+            }
+            this.comment(`Forbidden key in ${configFile}: '${forbidden}' must not be set (use Trivy's default severity behavior)`);
+            if (dry) {
+                return 'fail';
+            }
+            document.delete(forbidden);
+            changed = true;
+        }
+        for (const [path, expected] of this.requirements(parse(this.canonicalConfig()))) {
+            const dotted = path.join('.');
+            const current = this.getByPath(config, path);
+            if (Array.isArray(expected)) {
+                const declared = Array.isArray(current) ? current : [];
+                const missing = expected.filter((entry) => !declared.includes(entry));
+                if (missing.length === 0) {
+                    continue;
+                }
+                this.comment(`Missing entries in ${configFile}: ${dotted} must include ${missing.join(', ')}`);
+                if (dry) {
+                    return 'fail';
+                }
+                document.setIn(path, [...declared, ...missing]);
+                changed = true;
+                continue;
+            }
+            if (current === expected) {
+                continue;
+            }
+            this.comment(`Invalid value in ${configFile}: '${dotted}' must equal ${typeof expected === 'boolean' ? String(expected) : `'${String(expected)}'`}`);
+            if (dry) {
+                return 'fail';
+            }
+            document.setIn(path, expected);
+            changed = true;
+        }
+        if (dry) {
+            return 'pass';
+        }
+        if (changed) {
+            this.project.write(configFile, document.toString());
+        }
+        return this.fix(true);
+    }
+    /** The canonical body, written verbatim into a project that has none. */
+    canonicalConfig() {
+        return policy().template(policy().string('trivy.template'));
+    }
+    /**
+     * The canonical config read as a requirement set: every scalar leaf must be
+     * equal in the project's file, every list leaf contained in it. Keys the
+     * template does not mention are the project's own business.
+     */
+    requirements(node, prefix = []) {
+        if (typeof node !== 'object' || node === null || Array.isArray(node)) {
+            return [];
+        }
+        const found = [];
+        for (const [key, value] of Object.entries(node)) {
+            const path = [...prefix, key];
+            if (typeof value === 'object' && value !== null && !Array.isArray(value)) {
+                found.push(...this.requirements(value, path));
+                continue;
+            }
+            found.push([path, value]);
+        }
+        return found;
+    }
+    getByPath(config, path) {
+        return path.reduce((carry, segment) => {
+            if (typeof carry !== 'object' || carry === null) {
+                return undefined;
+            }
+            return carry[segment];
+        }, config);
+    }
+    /** Adds each missing job, leaving the rest of the pipeline untouched. */
+    addMissingCiJobs() {
+        const contents = this.project.read(CI_FILE);
+        if (contents === null || readCiJobs(this.project, () => { }) === null) {
+            return;
+        }
+        const document = parseDocument(contents);
+        let changed = false;
+        for (const [job, accepted] of Object.entries(policy().stringListMap('trivy.ciJob'))) {
+            if (document.hasIn([job])) {
+                continue;
+            }
+            document.setIn([job], { extends: [accepted[0]] });
+            changed = true;
+        }
+        if (changed) {
+            this.project.write(CI_FILE, document.toString());
+        }
+    }
+    ensureGitignoreEntry(entry, reason, dry) {
+        const contents = this.project.read('.gitignore');
+        if (contents === null) {
+            this.comment(`Missing .gitignore in project root: create it and add '${entry}'`);
+            if (dry) {
+                return 'fail';
+            }
+            this.project.write('.gitignore', `${entry}\n`);
+            return 'fail';
+        }
+        const normalise = (line) => line.trim().replace(/^\/+|\/+$/g, '');
+        if (contents.split('\n').map(normalise).includes(normalise(entry))) {
+            return null;
+        }
+        this.comment(`Missing entry in .gitignore: add '${entry}' to ${reason}`);
+        if (dry) {
+            return 'fail';
+        }
+        const prefix = contents === '' || contents.endsWith('\n') ? '' : '\n';
+        this.project.write('.gitignore', `${contents}${prefix}${entry}\n`);
+        return 'fail';
+    }
+}
+//# sourceMappingURL=has-trivy-config-check.js.map

package/js/dist/checks/has-trivy-config-check.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"has-trivy-config-check.js","sourceRoot":"","sources":["../../src/checks/has-trivy-config-check.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,aAAa,EAAE,MAAM,MAAM,CAAA;AAC3C,OAAO,EAAE,MAAM,EAAE,MAAM,cAAc,CAAA;AACrC,OAAO,EAAE,OAAO,EAAE,mBAAmB,EAAE,UAAU,EAAE,MAAM,uBAAuB,CAAA;AAChF,OAAO,EAAoB,YAAY,EAAE,MAAM,YAAY,CAAA;AAI3D;;;;;;;;GAQG;AACH,MAAM,OAAO,mBAAoB,SAAQ,YAAY;IACjD,MAAM,CAAmB,SAAS,GAAG,gBAAgB,CAAA;IAErD,GAAG,CAAC,GAAG,GAAG,KAAK;QACX,MAAM,QAAQ,GAAG,mBAAmB,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,EAAE,CAAC,aAAa,CAAC,aAAa,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,CAClG,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,CACxB,CAAA;QAED,IAAI,QAAQ,KAAK,MAAM,EAAE,CAAC;YACtB,IAAI,GAAG,EAAE,CAAC;gBACN,OAAO,QAAQ,CAAA;YACnB,CAAC;YAED,IAAI,CAAC,gBAAgB,EAAE,CAAA;QAC3B,CAAC;QAED,MAAM,eAAe,GAAG,IAAI,CAAC,oBAAoB,CAC7C,MAAM,EAAE,CAAC,MAAM,CAAC,sBAAsB,CAAC,EACvC,kCAAkC,EAClC,GAAG,CACN,CAAA;QAED,IAAI,eAAe,KAAK,IAAI,IAAI,GAAG,EAAE,CAAC;YAClC,OAAO,eAAe,CAAA;QAC1B,CAAC;QAED,MAAM,UAAU,GAAG,MAAM,EAAE,CAAC,MAAM,CAAC,kBAAkB,CAAC,CAAA;QAEtD,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,UAAU,CAAC,EAAE,CAAC;YACnC,IAAI,CAAC,OAAO,CACR,+BAA+B,UAAU,gDAAgD,CAC5F,CAAA;YAED,IAAI,GAAG,EAAE,CAAC;gBACN,OAAO,MAAM,CAAA;YACjB,CAAC;YAED,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,UAAU,EAAE,EAAE,CAAC,CAAA;QACtC,CAAC;QAED,MAAM,UAAU,GAAG,MAAM,EAAE,CAAC,MAAM,CAAC,kBAAkB,CAAC,CAAA;QACtD,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC,CAAA;QAE9C,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;YACpB,IAAI,CAAC,OAAO,CAAC,GAAG,UAAU,YAAY,CAAC,CAAA;YAEvC,IAAI,GAAG,EAAE,CAAC;gBACN,OAAO,MAAM,CAAA;YACjB,CAAC;YAED,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,UAAU,EAAE,IAAI,CAAC,eAAe,EAAE,CAAC,CAAA;YAEtD,OAAO,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAA;QACzB,CAAC;QAED,wEAAwE;QACxE,kDAAkD;QAClD,MAAM,QAAQ,GAAG,aAAa,CAAC,QAAQ,CAAC,CAAA;QAExC,IAAI,QAAQ,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC7B,IAAI,CAAC,OAAO,CACR,GAAG,UAAU,yBAAyB,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,OAAO,IAAI,cAAc,EAAE,CACxF,CAAA;YAED,OAAO,MAAM,CAAA;QACjB,CAAC;QAED,MAAM,MAAM,GAAY,QAAQ,CAAC,IAAI,EAAE,CAAA;QAEvC,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;YAChD,IAAI,CAAC,OAAO,CAAC,GAAG,UAAU,sBAAsB,CAAC,CAAA;YAEjD,OAAO,MAAM,CAAA;QACjB,CAAC;QAED,IAAI,OAAO,GAAG,KAAK,CAAA;QAEnB,KAAK,MAAM,SAAS,IAAI,MAAM,EAAE,CAAC,OAAO,CAAC,qBAAqB,CAAC,EAAE,CAAC;YAC9D,IAAI,CAAC,CAAC,SAAS,IAAI,MAAM,CAAC,EAAE,CAAC;gBACzB,SAAQ;YACZ,CAAC;YAED,IAAI,CAAC,OAAO,CACR,oBAAoB,UAAU,MAAM,SAAS,2DAA2D,CAC3G,CAAA;YAED,IAAI,GAAG,EAAE,CAAC;gBACN,OAAO,MAAM,CAAA;YACjB,CAAC;YAED,QAAQ,CAAC,MAAM,CAAC,SAAS,CAAC,CAAA;YAC1B,OAAO,GAAG,IAAI,CAAA;QAClB,CAAC;QAED,KAAK,MAAM,CAAC,IAAI,EAAE,QAAQ,CAAC,IAAI,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC,IAAI,CAAC,eAAe,EAAE,CAAC,CAAC,EAAE,CAAC;YAC9E,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;YAC7B,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,CAAC,CAAA;YAE5C,IAAI,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;gBAC1B,MAAM,QAAQ,GAAG,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,CAAE,OAAqB,CAAC,CAAC,CAAC,EAAE,CAAA;gBACrE,MAAM,OAAO,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAA;gBAErE,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;oBACvB,SAAQ;gBACZ,CAAC;gBAED,IAAI,CAAC,OAAO,CAAC,sBAAsB,UAAU,KAAK,MAAM,iBAAiB,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;gBAE9F,IAAI,GAAG,EAAE,CAAC;oBACN,OAAO,MAAM,CAAA;gBACjB,CAAC;gBAED,QAAQ,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,GAAG,QAAQ,EAAE,GAAG,OAAO,CAAC,CAAC,CAAA;gBAC/C,OAAO,GAAG,IAAI,CAAA;gBAEd,SAAQ;YACZ,CAAC;YAED,IAAI,OAAO,KAAK,QAAQ,EAAE,CAAC;gBACvB,SAAQ;YACZ,CAAC;YAED,IAAI,CAAC,OAAO,CACR,oBAAoB,UAAU,MAAM,MAAM,gBACtC,OAAO,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI,MAAM,CAAC,QAAQ,CAAC,GAC3E,EAAE,CACL,CAAA;YAED,IAAI,GAAG,EAAE,CAAC;gBACN,OAAO,MAAM,CAAA;YACjB,CAAC;YAED,QAAQ,CAAC,KAAK,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAA;YAC9B,OAAO,GAAG,IAAI,CAAA;QAClB,CAAC;QAED,IAAI,GAAG,EAAE,CAAC;YACN,OAAO,MAAM,CAAA;QACjB,CAAC;QAED,IAAI,OAAO,EAAE,CAAC;YACV,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,UAAU,EAAE,QAAQ,CAAC,QAAQ,EAAE,CAAC,CAAA;QACvD,CAAC;QAED,OAAO,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAA;IACzB,CAAC;IAED,yEAAyE;IACjE,eAAe;QACnB,OAAO,MAAM,EAAE,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC,CAAA;IAC/D,CAAC;IAED;;;;OAIG;IACK,YAAY,CAAC,IAAa,EAAE,MAAM,GAAa,EAAE;QACrD,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;YACnE,OAAO,EAAE,CAAA;QACb,CAAC;QAED,MAAM,KAAK,GAAkB,EAAE,CAAA;QAE/B,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;YAC9C,MAAM,IAAI,GAAG,CAAC,GAAG,MAAM,EAAE,GAAG,CAAC,CAAA;YAE7B,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;gBACvE,KAAK,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,YAAY,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC,CAAA;gBAE7C,SAAQ;YACZ,CAAC;YAED,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,CAAA;QAC7B,CAAC;QAED,OAAO,KAAK,CAAA;IAChB,CAAC;IAEO,SAAS,CAAC,MAAe,EAAE,IAAc;QAC7C,OAAO,IAAI,CAAC,MAAM,CAAU,CAAC,KAAK,EAAE,OAAO,EAAE,EAAE;YAC3C,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;gBAC9C,OAAO,SAAS,CAAA;YACpB,CAAC;YAED,OAAQ,KAAiC,CAAC,OAAO,CAAC,CAAA;QACtD,CAAC,EAAE,MAAM,CAAC,CAAA;IACd,CAAC;IAED,yEAAyE;IACjE,gBAAgB;QACpB,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAA;QAE3C,IAAI,QAAQ,KAAK,IAAI,IAAI,UAAU,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,EAAE,GAAE,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;YACnE,OAAM;QACV,CAAC;QAED,MAAM,QAAQ,GAAG,aAAa,CAAC,QAAQ,CAAC,CAAA;QACxC,IAAI,OAAO,GAAG,KAAK,CAAA;QAEnB,KAAK,MAAM,CAAC,GAAG,EAAE,QAAQ,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC,aAAa,CAAC,aAAa,CAAC,CAAC,EAAE,CAAC;YAClF,IAAI,QAAQ,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC;gBACxB,SAAQ;YACZ,CAAC;YAED,QAAQ,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,EAAE,EAAE,OAAO,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAA;YACjD,OAAO,GAAG,IAAI,CAAA;QAClB,CAAC;QAED,IAAI,OAAO,EAAE,CAAC;YACV,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO,EAAE,QAAQ,CAAC,QAAQ,EAAE,CAAC,CAAA;QACpD,CAAC;IACL,CAAC;IAEO,oBAAoB,CAAC,KAAa,EAAE,MAAc,EAAE,GAAY;QACpE,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,YAAY,CAAC,CAAA;QAEhD,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;YACpB,IAAI,CAAC,OAAO,CAAC,0DAA0D,KAAK,GAAG,CAAC,CAAA;YAEhF,IAAI,GAAG,EAAE,CAAC;gBACN,OAAO,MAAM,CAAA;YACjB,CAAC;YAED,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,YAAY,EAAE,GAAG,KAAK,IAAI,CAAC,CAAA;YAE9C,OAAO,MAAM,CAAA;QACjB,CAAC;QAED,MAAM,SAAS,GAAG,CAAC,IAAY,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,YAAY,EAAE,EAAE,CAAC,CAAA;QAEzE,IAAI,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,QAAQ,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;YACjE,OAAO,IAAI,CAAA;QACf,CAAC;QAED,IAAI,CAAC,OAAO,CAAC,qCAAqC,KAAK,QAAQ,MAAM,EAAE,CAAC,CAAA;QAExE,IAAI,GAAG,EAAE,CAAC;YACN,OAAO,MAAM,CAAA;QACjB,CAAC;QAED,MAAM,MAAM,GAAG,QAAQ,KAAK,EAAE,IAAI,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAA;QACrE,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,YAAY,EAAE,GAAG,QAAQ,GAAG,MAAM,GAAG,KAAK,IAAI,CAAC,CAAA;QAElE,OAAO,MAAM,CAAA;IACjB,CAAC;CACJ"}

package/js/dist/checks/is-ci-lint-complete-check.d.ts

@@ -0,0 +1,10 @@
+import { Check, type CheckResult } from './check.js';
+/**
+ * The JS counterpart of the PHP runner's isCiLintComplete: same intent, different
+ * toolchain — the linter and type checker must actually run in `ci-lint`, not
+ * just be installed.
+ */
+export declare class IsCiLintCompleteCheck extends Check {
+    static readonly checkName = "isCiLintComplete";
+    check(): CheckResult;
+}

package/js/dist/checks/is-ci-lint-complete-check.js

@@ -0,0 +1,25 @@
+import { policy } from '../policy.js';
+import { Check } from './check.js';
+/**
+ * The JS counterpart of the PHP runner's isCiLintComplete: same intent, different
+ * toolchain — the linter and type checker must actually run in `ci-lint`, not
+ * just be installed.
+ */
+export class IsCiLintCompleteCheck extends Check {
+    static checkName = 'isCiLintComplete';
+    check() {
+        const script = this.project.readJson('package.json')?.scripts?.['ci-lint'];
+        if (script === undefined) {
+            this.comment('Missing ci-lint script in package.json: Add "ci-lint" to scripts section');
+            return 'fail';
+        }
+        for (const required of policy().strings('ciLint.required.js')) {
+            if (!script.includes(required)) {
+                this.comment(`Incomplete ci-lint script in package.json: it must run "${required}"`);
+                return 'fail';
+            }
+        }
+        return 'pass';
+    }
+}
+//# sourceMappingURL=is-ci-lint-complete-check.js.map

package/js/dist/checks/is-ci-lint-complete-check.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"is-ci-lint-complete-check.js","sourceRoot":"","sources":["../../src/checks/is-ci-lint-complete-check.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,cAAc,CAAA;AACrC,OAAO,EAAE,KAAK,EAAoB,MAAM,YAAY,CAAA;AAMpD;;;;GAIG;AACH,MAAM,OAAO,qBAAsB,SAAQ,KAAK;IAC5C,MAAM,CAAmB,SAAS,GAAG,kBAAkB,CAAA;IAEvD,KAAK;QACD,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAc,cAAc,CAAC,EAAE,OAAO,EAAE,CAAC,SAAS,CAAC,CAAA;QAEvF,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;YACvB,IAAI,CAAC,OAAO,CAAC,0EAA0E,CAAC,CAAA;YAExF,OAAO,MAAM,CAAA;QACjB,CAAC;QAED,KAAK,MAAM,QAAQ,IAAI,MAAM,EAAE,CAAC,OAAO,CAAC,oBAAoB,CAAC,EAAE,CAAC;YAC5D,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;gBAC7B,IAAI,CAAC,OAAO,CAAC,2DAA2D,QAAQ,GAAG,CAAC,CAAA;gBAEpF,OAAO,MAAM,CAAA;YACjB,CAAC;QACL,CAAC;QAED,OAAO,MAAM,CAAA;IACjB,CAAC;CACJ"}

package/js/dist/checks/node-version-check.d.ts

@@ -0,0 +1,5 @@
+import { type CheckResult, FixableCheck } from './check.js';
+export declare class NodeVersionCheck extends FixableCheck {
+    static readonly checkName = "nodeVersion";
+    fix(dry?: boolean): CheckResult;
+}

package/js/dist/checks/node-version-check.js

@@ -0,0 +1,77 @@
+import { policy } from '../policy.js';
+import { compatible, guaranteesAtLeast, lowestMajor } from '../support/versions.js';
+import { FixableCheck } from './check.js';
+export class NodeVersionCheck extends FixableCheck {
+    static checkName = 'nodeVersion';
+    fix(dry = false) {
+        const packageJson = this.project.readJson('package.json');
+        if (packageJson === null) {
+            this.comment('Package.json missing: Create package.json in project root');
+            return 'fail';
+        }
+        const floor = policy().string('node.minMajor');
+        const engines = nonEmpty(packageJson.engines?.node);
+        const nvmrc = nonEmpty(this.project.read('.nvmrc')?.trim());
+        // Two declared-but-conflicting versions need a human decision — never auto-fixed.
+        if (engines !== null && nvmrc !== null && !compatible(engines, nvmrc)) {
+            this.comment(`Node version mismatch: package.json engines.node (${engines}) and .nvmrc (${nvmrc}) disagree`);
+            return 'fail';
+        }
+        const enginesTooLow = engines !== null && !guaranteesAtLeast(engines, floor);
+        const nvmrcTooLow = nvmrc !== null && !guaranteesAtLeast(nvmrc, floor);
+        // A below-floor declaration is bumped to the floor; otherwise keep the project's own line.
+        const major = enginesTooLow || nvmrcTooLow ? floor : resolveMajor(engines, nvmrc, floor);
+        if (engines === null) {
+            this.comment(`package.json missing engines.node: add "engines": { "node": "^${major}" }`);
+            if (dry) {
+                return 'fail';
+            }
+        }
+        else if (enginesTooLow) {
+            this.comment(`engines.node (${engines}) allows Node < ${floor}; require Node >= ${floor} (e.g. "^${floor}")`);
+            if (dry) {
+                return 'fail';
+            }
+        }
+        if (nvmrc === null) {
+            this.comment(`.nvmrc missing: create a .nvmrc pinning Node "${major}"`);
+            if (dry) {
+                return 'fail';
+            }
+        }
+        else if (nvmrcTooLow) {
+            this.comment(`.nvmrc (${nvmrc}) pins Node < ${floor}: set it to "${floor}"`);
+            if (dry) {
+                return 'fail';
+            }
+        }
+        if (dry) {
+            return 'pass';
+        }
+        if (engines === null || enginesTooLow) {
+            packageJson.engines = { ...packageJson.engines, node: `^${major}` };
+            this.project.writeJson('package.json', packageJson);
+        }
+        if (nvmrc === null || nvmrcTooLow) {
+            this.project.write('.nvmrc', `${major}\n`);
+        }
+        return this.fix(true);
+    }
+}
+/** The major to establish: the .nvmrc value, then engines.node, then the floor. */
+function resolveMajor(engines, nvmrc, floor) {
+    for (const candidate of [nvmrc, engines]) {
+        if (candidate === null) {
+            continue;
+        }
+        const major = lowestMajor(candidate);
+        if (major !== null) {
+            return major;
+        }
+    }
+    return floor;
+}
+function nonEmpty(value) {
+    return value === undefined || value === '' ? null : value;
+}
+//# sourceMappingURL=node-version-check.js.map

package/js/dist/checks/node-version-check.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"node-version-check.js","sourceRoot":"","sources":["../../src/checks/node-version-check.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,cAAc,CAAA;AACrC,OAAO,EAAE,UAAU,EAAE,iBAAiB,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAA;AACnF,OAAO,EAAoB,YAAY,EAAE,MAAM,YAAY,CAAA;AAM3D,MAAM,OAAO,gBAAiB,SAAQ,YAAY;IAC9C,MAAM,CAAmB,SAAS,GAAG,aAAa,CAAA;IAElD,GAAG,CAAC,GAAG,GAAG,KAAK;QACX,MAAM,WAAW,GAAG,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAc,cAAc,CAAC,CAAA;QAEtE,IAAI,WAAW,KAAK,IAAI,EAAE,CAAC;YACvB,IAAI,CAAC,OAAO,CAAC,2DAA2D,CAAC,CAAA;YAEzE,OAAO,MAAM,CAAA;QACjB,CAAC;QAED,MAAM,KAAK,GAAG,MAAM,EAAE,CAAC,MAAM,CAAC,eAAe,CAAC,CAAA;QAC9C,MAAM,OAAO,GAAG,QAAQ,CAAC,WAAW,CAAC,OAAO,EAAE,IAAI,CAAC,CAAA;QACnD,MAAM,KAAK,GAAG,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,CAAC,CAAA;QAE3D,kFAAkF;QAClF,IAAI,OAAO,KAAK,IAAI,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,UAAU,CAAC,OAAO,EAAE,KAAK,CAAC,EAAE,CAAC;YACpE,IAAI,CAAC,OAAO,CACR,qDAAqD,OAAO,iBAAiB,KAAK,YAAY,CACjG,CAAA;YAED,OAAO,MAAM,CAAA;QACjB,CAAC;QAED,MAAM,aAAa,GAAG,OAAO,KAAK,IAAI,IAAI,CAAC,iBAAiB,CAAC,OAAO,EAAE,KAAK,CAAC,CAAA;QAC5E,MAAM,WAAW,GAAG,KAAK,KAAK,IAAI,IAAI,CAAC,iBAAiB,CAAC,KAAK,EAAE,KAAK,CAAC,CAAA;QAEtE,2FAA2F;QAC3F,MAAM,KAAK,GAAG,aAAa,IAAI,WAAW,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,YAAY,CAAC,OAAO,EAAE,KAAK,EAAE,KAAK,CAAC,CAAA;QAExF,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;YACnB,IAAI,CAAC,OAAO,CAAC,iEAAiE,KAAK,KAAK,CAAC,CAAA;YAEzF,IAAI,GAAG,EAAE,CAAC;gBACN,OAAO,MAAM,CAAA;YACjB,CAAC;QACL,CAAC;aAAM,IAAI,aAAa,EAAE,CAAC;YACvB,IAAI,CAAC,OAAO,CACR,iBAAiB,OAAO,mBAAmB,KAAK,qBAAqB,KAAK,YAAY,KAAK,IAAI,CAClG,CAAA;YAED,IAAI,GAAG,EAAE,CAAC;gBACN,OAAO,MAAM,CAAA;YACjB,CAAC;QACL,CAAC;QAED,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;YACjB,IAAI,CAAC,OAAO,CAAC,iDAAiD,KAAK,GAAG,CAAC,CAAA;YAEvE,IAAI,GAAG,EAAE,CAAC;gBACN,OAAO,MAAM,CAAA;YACjB,CAAC;QACL,CAAC;aAAM,IAAI,WAAW,EAAE,CAAC;YACrB,IAAI,CAAC,OAAO,CAAC,WAAW,KAAK,iBAAiB,KAAK,gBAAgB,KAAK,GAAG,CAAC,CAAA;YAE5E,IAAI,GAAG,EAAE,CAAC;gBACN,OAAO,MAAM,CAAA;YACjB,CAAC;QACL,CAAC;QAED,IAAI,GAAG,EAAE,CAAC;YACN,OAAO,MAAM,CAAA;QACjB,CAAC;QAED,IAAI,OAAO,KAAK,IAAI,IAAI,aAAa,EAAE,CAAC;YACpC,WAAW,CAAC,OAAO,GAAG,EAAE,GAAG,WAAW,CAAC,OAAO,EAAE,IAAI,EAAE,IAAI,KAAK,EAAE,EAAE,CAAA;YACnE,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,cAAc,EAAE,WAAW,CAAC,CAAA;QACvD,CAAC;QAED,IAAI,KAAK,KAAK,IAAI,IAAI,WAAW,EAAE,CAAC;YAChC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,QAAQ,EAAE,GAAG,KAAK,IAAI,CAAC,CAAA;QAC9C,CAAC;QAED,OAAO,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAA;IACzB,CAAC;CACJ;AAED,mFAAmF;AACnF,SAAS,YAAY,CAAC,OAAsB,EAAE,KAAoB,EAAE,KAAa;IAC7E,KAAK,MAAM,SAAS,IAAI,CAAC,KAAK,EAAE,OAAO,CAAC,EAAE,CAAC;QACvC,IAAI,SAAS,KAAK,IAAI,EAAE,CAAC;YACrB,SAAQ;QACZ,CAAC;QAED,MAAM,KAAK,GAAG,WAAW,CAAC,SAAS,CAAC,CAAA;QAEpC,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;YACjB,OAAO,KAAK,CAAA;QAChB,CAAC;IACL,CAAC;IAED,OAAO,KAAK,CAAA;AAChB,CAAC;AAED,SAAS,QAAQ,CAAC,KAAyB;IACvC,OAAO,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAA;AAC7D,CAAC"}

package/js/dist/checks/periodic-check.d.ts

@@ -0,0 +1,16 @@
+import { Check, type CheckResult } from './check.js';
+/**
+ * A requirement that cannot be verified statically because it needs a developer
+ * to do something on a schedule. Mirrors src/Checks/AbstractPeriodicCheck.php.
+ */
+export declare abstract class PeriodicCheck extends Check {
+    /** Shown to the developer by `baseline periodic`. */
+    abstract promptDescription(): string;
+    intervalDays(): number;
+    /** Return false to skip the check entirely — e.g. an optional tool is absent. */
+    isApplicable(): boolean;
+    /** Do not override: preconditions belong in isApplicable(). */
+    check(): CheckResult;
+    private hasExpired;
+}
+export declare function isPeriodic(check: Check): check is PeriodicCheck;

package/js/dist/checks/periodic-check.js

@@ -0,0 +1,34 @@
+import { policy } from '../policy.js';
+import { lastRun } from '../state.js';
+import { Check } from './check.js';
+/**
+ * A requirement that cannot be verified statically because it needs a developer
+ * to do something on a schedule. Mirrors src/Checks/AbstractPeriodicCheck.php.
+ */
+export class PeriodicCheck extends Check {
+    intervalDays() {
+        return policy().number('periodic.defaultIntervalDays');
+    }
+    /** Return false to skip the check entirely — e.g. an optional tool is absent. */
+    isApplicable() {
+        return true;
+    }
+    /** Do not override: preconditions belong in isApplicable(). */
+    check() {
+        const previous = lastRun(this.project, this.name);
+        if (previous === null || this.hasExpired(previous)) {
+            this.comment('Run `npx baseline periodic` to complete this periodic check');
+            return 'fail';
+        }
+        return 'pass';
+    }
+    hasExpired(previous) {
+        const due = new Date(previous);
+        due.setDate(due.getDate() + this.intervalDays());
+        return due.getTime() < Date.now();
+    }
+}
+export function isPeriodic(check) {
+    return check instanceof PeriodicCheck;
+}
+//# sourceMappingURL=periodic-check.js.map

package/js/dist/checks/periodic-check.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"periodic-check.js","sourceRoot":"","sources":["../../src/checks/periodic-check.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,cAAc,CAAA;AACrC,OAAO,EAAE,OAAO,EAAE,MAAM,aAAa,CAAA;AACrC,OAAO,EAAE,KAAK,EAAoB,MAAM,YAAY,CAAA;AAEpD;;;GAGG;AACH,MAAM,OAAgB,aAAc,SAAQ,KAAK;IAI7C,YAAY;QACR,OAAO,MAAM,EAAE,CAAC,MAAM,CAAC,8BAA8B,CAAC,CAAA;IAC1D,CAAC;IAED,iFAAiF;IACjF,YAAY;QACR,OAAO,IAAI,CAAA;IACf,CAAC;IAED,+DAA+D;IAC/D,KAAK;QACD,MAAM,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,IAAI,CAAC,CAAA;QAEjD,IAAI,QAAQ,KAAK,IAAI,IAAI,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;YACjD,IAAI,CAAC,OAAO,CAAC,6DAA6D,CAAC,CAAA;YAE3E,OAAO,MAAM,CAAA;QACjB,CAAC;QAED,OAAO,MAAM,CAAA;IACjB,CAAC;IAEO,UAAU,CAAC,QAAc;QAC7B,MAAM,GAAG,GAAG,IAAI,IAAI,CAAC,QAAQ,CAAC,CAAA;QAC9B,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,YAAY,EAAE,CAAC,CAAA;QAEhD,OAAO,GAAG,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,GAAG,EAAE,CAAA;IACrC,CAAC;CACJ;AAED,MAAM,UAAU,UAAU,CAAC,KAAY;IACnC,OAAO,KAAK,YAAY,aAAa,CAAA;AACzC,CAAC"}

package/js/dist/checks/registry.d.ts

@@ -0,0 +1,10 @@
+import type { Project } from '../project.js';
+import type { Check, CommentCollector } from './check.js';
+type CheckConstructor = (new (project: Project, comments: CommentCollector) => Check) & {
+    readonly checkName: string;
+};
+export declare function allChecks(): CheckConstructor[];
+export declare function checkNames(): string[];
+export declare function findCheck(name: string): CheckConstructor | undefined;
+export declare function createChecks(project: Project, comments: CommentCollector): Check[];
+export {};

package/js/dist/checks/registry.js

@@ -0,0 +1,56 @@
+import { AllowsToolingInClaudeSettingsCheck } from './allows-tooling-in-claude-settings-check.js';
+import { BiomeUsesLocalSchemaCheck } from './biome-uses-local-schema-check.js';
+import { CallsBaselineCheck } from './calls-baseline-check.js';
+import { CiSetsNodeVersionCheck } from './ci-sets-node-version-check.js';
+import { DeniesEnvReadsInClaudeSettingsCheck } from './denies-env-reads-in-claude-settings-check.js';
+import { DoesNotHaveCopilotOrJunieAgentFilesCheck } from './does-not-have-copilot-or-junie-agent-files-check.js';
+import { DoesNotUseBothBaselineRunnersCheck } from './does-not-use-both-baseline-runners-check.js';
+import { HardensNpmSupplyChainCheck } from './hardens-npm-supply-chain-check.js';
+import { HasCiJobsCheck } from './has-ci-jobs-check.js';
+import { HasEditorconfigCheck } from './has-editorconfig-check.js';
+import { HasNpmScriptsCheck } from './has-npm-scripts-check.js';
+import { HasTrivyConfigCheck } from './has-trivy-config-check.js';
+import { IsCiLintCompleteCheck } from './is-ci-lint-complete-check.js';
+import { NodeVersionCheck } from './node-version-check.js';
+import { RunsCiLintHookInClaudeSettingsCheck } from './runs-ci-lint-hook-in-claude-settings-check.js';
+import { UpdatesDependenciesCheck } from './updates-dependencies-check.js';
+import { UsesReleaseItCheck } from './uses-release-it-check.js';
+/**
+ * Every check this runner knows about, in execution and display order.
+ *
+ * This is intentionally a subset of the PHP runner's registry: only the checks
+ * that mean something in a project with no PHP and no DDEV are here. See the
+ * README for the ported / not-ported table.
+ */
+const checks = [
+    AllowsToolingInClaudeSettingsCheck,
+    BiomeUsesLocalSchemaCheck,
+    CallsBaselineCheck,
+    CiSetsNodeVersionCheck,
+    DeniesEnvReadsInClaudeSettingsCheck,
+    DoesNotHaveCopilotOrJunieAgentFilesCheck,
+    DoesNotUseBothBaselineRunnersCheck,
+    HardensNpmSupplyChainCheck,
+    HasCiJobsCheck,
+    HasEditorconfigCheck,
+    HasNpmScriptsCheck,
+    HasTrivyConfigCheck,
+    IsCiLintCompleteCheck,
+    NodeVersionCheck,
+    RunsCiLintHookInClaudeSettingsCheck,
+    UpdatesDependenciesCheck,
+    UsesReleaseItCheck,
+];
+export function allChecks() {
+    return [...checks];
+}
+export function checkNames() {
+    return checks.map((check) => check.checkName);
+}
+export function findCheck(name) {
+    return checks.find((check) => check.checkName === name);
+}
+export function createChecks(project, comments) {
+    return checks.map((Constructor) => new Constructor(project, comments));
+}
+//# sourceMappingURL=registry.js.map

package/js/dist/checks/registry.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"registry.js","sourceRoot":"","sources":["../../src/checks/registry.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,kCAAkC,EAAE,MAAM,8CAA8C,CAAA;AACjG,OAAO,EAAE,yBAAyB,EAAE,MAAM,oCAAoC,CAAA;AAC9E,OAAO,EAAE,kBAAkB,EAAE,MAAM,2BAA2B,CAAA;AAE9D,OAAO,EAAE,sBAAsB,EAAE,MAAM,iCAAiC,CAAA;AACxE,OAAO,EAAE,mCAAmC,EAAE,MAAM,gDAAgD,CAAA;AACpG,OAAO,EAAE,wCAAwC,EAAE,MAAM,uDAAuD,CAAA;AAChH,OAAO,EAAE,kCAAkC,EAAE,MAAM,+CAA+C,CAAA;AAClG,OAAO,EAAE,0BAA0B,EAAE,MAAM,qCAAqC,CAAA;AAChF,OAAO,EAAE,cAAc,EAAE,MAAM,wBAAwB,CAAA;AACvD,OAAO,EAAE,oBAAoB,EAAE,MAAM,6BAA6B,CAAA;AAClE,OAAO,EAAE,kBAAkB,EAAE,MAAM,4BAA4B,CAAA;AAC/D,OAAO,EAAE,mBAAmB,EAAE,MAAM,6BAA6B,CAAA;AACjE,OAAO,EAAE,qBAAqB,EAAE,MAAM,gCAAgC,CAAA;AACtE,OAAO,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAA;AAC1D,OAAO,EAAE,mCAAmC,EAAE,MAAM,iDAAiD,CAAA;AACrG,OAAO,EAAE,wBAAwB,EAAE,MAAM,iCAAiC,CAAA;AAC1E,OAAO,EAAE,kBAAkB,EAAE,MAAM,4BAA4B,CAAA;AAO/D;;;;;;GAMG;AACH,MAAM,MAAM,GAAuB;IAC/B,kCAAkC;IAClC,yBAAyB;IACzB,kBAAkB;IAClB,sBAAsB;IACtB,mCAAmC;IACnC,wCAAwC;IACxC,kCAAkC;IAClC,0BAA0B;IAC1B,cAAc;IACd,oBAAoB;IACpB,kBAAkB;IAClB,mBAAmB;IACnB,qBAAqB;IACrB,gBAAgB;IAChB,mCAAmC;IACnC,wBAAwB;IACxB,kBAAkB;CACrB,CAAA;AAED,MAAM,UAAU,SAAS;IACrB,OAAO,CAAC,GAAG,MAAM,CAAC,CAAA;AACtB,CAAC;AAED,MAAM,UAAU,UAAU;IACtB,OAAO,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,SAAS,CAAC,CAAA;AACjD,CAAC;AAED,MAAM,UAAU,SAAS,CAAC,IAAY;IAClC,OAAO,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,SAAS,KAAK,IAAI,CAAC,CAAA;AAC3D,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,OAAgB,EAAE,QAA0B;IACrE,OAAO,MAAM,CAAC,GAAG,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC,IAAI,WAAW,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC,CAAA;AAC1E,CAAC"}

package/js/dist/checks/runs-ci-lint-hook-in-claude-settings-check.d.ts

@@ -0,0 +1,6 @@
+import type { CheckResult } from './check.js';
+import { ClaudeSettingsCheck } from './claude-settings-check.js';
+export declare class RunsCiLintHookInClaudeSettingsCheck extends ClaudeSettingsCheck {
+    static readonly checkName = "runsCiLintHookInClaudeSettings";
+    fix(dry?: boolean): CheckResult;
+}

package/js/dist/checks/runs-ci-lint-hook-in-claude-settings-check.js

@@ -0,0 +1,26 @@
+import { policy } from '../policy.js';
+import { ClaudeSettingsCheck } from './claude-settings-check.js';
+export class RunsCiLintHookInClaudeSettingsCheck extends ClaudeSettingsCheck {
+    static checkName = 'runsCiLintHookInClaudeSettings';
+    fix(dry = false) {
+        // The JS command, not the PHP runner's `ddev composer run ci-lint`.
+        const command = policy().string('claude.ciLintHookCommand.js');
+        const settings = this.readSettings();
+        const stopGroups = settings.hooks?.Stop ?? [];
+        const present = stopGroups.some((group) => (group.hooks ?? []).some((hook) => hook.command === command));
+        if (present) {
+            return 'pass';
+        }
+        this.comment(`Claude settings: add a Stop hook running "${command}" to .claude/settings.json`);
+        if (dry) {
+            return 'fail';
+        }
+        settings.hooks = {
+            ...settings.hooks,
+            Stop: [...stopGroups, { matcher: '', hooks: [{ type: 'command', command }] }],
+        };
+        this.writeSettings(settings);
+        return 'pass';
+    }
+}
+//# sourceMappingURL=runs-ci-lint-hook-in-claude-settings-check.js.map

package/js/dist/checks/runs-ci-lint-hook-in-claude-settings-check.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"runs-ci-lint-hook-in-claude-settings-check.js","sourceRoot":"","sources":["../../src/checks/runs-ci-lint-hook-in-claude-settings-check.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,cAAc,CAAA;AAErC,OAAO,EAAE,mBAAmB,EAAE,MAAM,4BAA4B,CAAA;AAEhE,MAAM,OAAO,mCAAoC,SAAQ,mBAAmB;IACxE,MAAM,CAAmB,SAAS,GAAG,gCAAgC,CAAA;IAErE,GAAG,CAAC,GAAG,GAAG,KAAK;QACX,oEAAoE;QACpE,MAAM,OAAO,GAAG,MAAM,EAAE,CAAC,MAAM,CAAC,6BAA6B,CAAC,CAAA;QAE9D,MAAM,QAAQ,GAAG,IAAI,CAAC,YAAY,EAAE,CAAA;QACpC,MAAM,UAAU,GAAG,QAAQ,CAAC,KAAK,EAAE,IAAI,IAAI,EAAE,CAAA;QAE7C,MAAM,OAAO,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CACtC,CAAC,KAAK,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,OAAO,KAAK,OAAO,CAAC,CAC/D,CAAA;QAED,IAAI,OAAO,EAAE,CAAC;YACV,OAAO,MAAM,CAAA;QACjB,CAAC;QAED,IAAI,CAAC,OAAO,CAAC,6CAA6C,OAAO,4BAA4B,CAAC,CAAA;QAE9F,IAAI,GAAG,EAAE,CAAC;YACN,OAAO,MAAM,CAAA;QACjB,CAAC;QAED,QAAQ,CAAC,KAAK,GAAG;YACb,GAAG,QAAQ,CAAC,KAAK;YACjB,IAAI,EAAE,CAAC,GAAG,UAAU,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,CAAC,EAAE,CAAC;SAChF,CAAA;QAED,IAAI,CAAC,aAAa,CAAC,QAAQ,CAAC,CAAA;QAE5B,OAAO,MAAM,CAAA;IACjB,CAAC;CACJ"}

package/js/dist/checks/updates-dependencies-check.d.ts

@@ -0,0 +1,5 @@
+import { PeriodicCheck } from './periodic-check.js';
+export declare class UpdatesDependenciesCheck extends PeriodicCheck {
+    static readonly checkName = "updatesDependencies";
+    promptDescription(): string;
+}

package/js/dist/checks/updates-dependencies-check.js

@@ -0,0 +1,8 @@
+import { PeriodicCheck } from './periodic-check.js';
+export class UpdatesDependenciesCheck extends PeriodicCheck {
+    static checkName = 'updatesDependencies';
+    promptDescription() {
+        return 'Run the `updating-dependencies` skill to update npm dependencies, review changelogs, and check for semver-blocked majors.';
+    }
+}
+//# sourceMappingURL=updates-dependencies-check.js.map

package/js/dist/checks/updates-dependencies-check.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"updates-dependencies-check.js","sourceRoot":"","sources":["../../src/checks/updates-dependencies-check.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAA;AAEnD,MAAM,OAAO,wBAAyB,SAAQ,aAAa;IACvD,MAAM,CAAmB,SAAS,GAAG,qBAAqB,CAAA;IAE1D,iBAAiB;QACb,OAAO,2HAA2H,CAAA;IACtI,CAAC;CACJ"}

package/js/dist/checks/uses-release-it-check.d.ts

@@ -0,0 +1,12 @@
+import { type CheckResult, FixableCheck } from './check.js';
+/**
+ * The JS counterpart of the PHP runner's usesReleaseIt. Deliberately the
+ * opposite assertion about @release-it/bumper: in a Laravel project the bumper
+ * writes the version into composer.json, whereas here package.json is already
+ * release-it's own source of truth, so a bumper pointed at it is redundant and a
+ * bumper pointed at composer.json is meaningless.
+ */
+export declare class UsesReleaseItCheck extends FixableCheck {
+    static readonly checkName = "usesReleaseIt";
+    fix(dry?: boolean): CheckResult;
+}

package/js/dist/checks/uses-release-it-check.js

@@ -0,0 +1,40 @@
+import { FixableCheck } from './check.js';
+/**
+ * The JS counterpart of the PHP runner's usesReleaseIt. Deliberately the
+ * opposite assertion about @release-it/bumper: in a Laravel project the bumper
+ * writes the version into composer.json, whereas here package.json is already
+ * release-it's own source of truth, so a bumper pointed at it is redundant and a
+ * bumper pointed at composer.json is meaningless.
+ */
+export class UsesReleaseItCheck extends FixableCheck {
+    static checkName = 'usesReleaseIt';
+    fix(dry = false) {
+        const packageJson = this.project.readJson('package.json');
+        if (packageJson === null) {
+            this.comment('Package.json missing: Create package.json in project root');
+            return 'fail';
+        }
+        if (packageJson.devDependencies?.['release-it'] === undefined) {
+            // Installing is the developer's call — this check never runs npm.
+            this.comment('Missing release-it: run "npm install --save-dev release-it"');
+            return 'fail';
+        }
+        const bumper = this.project.readJson('.release-it.json')?.plugins?.['@release-it/bumper'];
+        if (bumper !== undefined) {
+            this.comment("Remove the @release-it/bumper plugin from .release-it.json: release-it already writes package.json, which is this project's source of truth");
+            return 'fail';
+        }
+        const release = packageJson.scripts?.release;
+        if (release?.includes('release-it')) {
+            return 'pass';
+        }
+        this.comment('Missing release script in package.json: Add "release": "release-it" to scripts section');
+        if (dry) {
+            return 'fail';
+        }
+        packageJson.scripts = { ...packageJson.scripts, release: 'release-it' };
+        this.project.writeJson('package.json', packageJson);
+        return this.fix(true);
+    }
+}
+//# sourceMappingURL=uses-release-it-check.js.map

package/js/dist/checks/uses-release-it-check.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"uses-release-it-check.js","sourceRoot":"","sources":["../../src/checks/uses-release-it-check.ts"],"names":[],"mappings":"AAAA,OAAO,EAAoB,YAAY,EAAE,MAAM,YAAY,CAAA;AAW3D;;;;;;GAMG;AACH,MAAM,OAAO,kBAAmB,SAAQ,YAAY;IAChD,MAAM,CAAmB,SAAS,GAAG,eAAe,CAAA;IAEpD,GAAG,CAAC,GAAG,GAAG,KAAK;QACX,MAAM,WAAW,GAAG,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAc,cAAc,CAAC,CAAA;QAEtE,IAAI,WAAW,KAAK,IAAI,EAAE,CAAC;YACvB,IAAI,CAAC,OAAO,CAAC,2DAA2D,CAAC,CAAA;YAEzE,OAAO,MAAM,CAAA;QACjB,CAAC;QAED,IAAI,WAAW,CAAC,eAAe,EAAE,CAAC,YAAY,CAAC,KAAK,SAAS,EAAE,CAAC;YAC5D,kEAAkE;YAClE,IAAI,CAAC,OAAO,CAAC,6DAA6D,CAAC,CAAA;YAE3E,OAAO,MAAM,CAAA;QACjB,CAAC;QAED,MAAM,MAAM,GACR,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAkB,kBAAkB,CAAC,EAAE,OAAO,EAAE,CAAC,oBAAoB,CAAC,CAAA;QAE/F,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;YACvB,IAAI,CAAC,OAAO,CACR,6IAA6I,CAChJ,CAAA;YAED,OAAO,MAAM,CAAA;QACjB,CAAC;QAED,MAAM,OAAO,GAAG,WAAW,CAAC,OAAO,EAAE,OAAO,CAAA;QAE5C,IAAI,OAAO,EAAE,QAAQ,CAAC,YAAY,CAAC,EAAE,CAAC;YAClC,OAAO,MAAM,CAAA;QACjB,CAAC;QAED,IAAI,CAAC,OAAO,CAAC,wFAAwF,CAAC,CAAA;QAEtG,IAAI,GAAG,EAAE,CAAC;YACN,OAAO,MAAM,CAAA;QACjB,CAAC;QAED,WAAW,CAAC,OAAO,GAAG,EAAE,GAAG,WAAW,CAAC,OAAO,EAAE,OAAO,EAAE,YAAY,EAAE,CAAA;QACvE,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,cAAc,EAAE,WAAW,CAAC,CAAA;QAEnD,OAAO,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAA;IACzB,CAAC;CACJ"}

package/js/dist/commands/check.d.ts

@@ -0,0 +1,7 @@
+import type { Project } from '../project.js';
+export interface CheckOptions {
+    fix: boolean;
+    verbose: boolean;
+}
+/** Runs every registered check and returns the process exit code. */
+export declare function runCheck(project: Project, options: CheckOptions): number;