@mh-alikhani/bunready 0.2.0 → 0.3.1

package/CHANGELOG.md

@@ -9,6 +9,43 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 Nothing yet.
 
+## [0.3.1] - 2026-09-19
+
+### Fixed
+
+- Three polynomial-time regular expressions, reported by CodeQL as
+  `js/polynomial-redos`. bunready parses files it does not control - a
+  `pnpm-workspace.yaml` from a repository being scanned, a semver range in its
+  `engines` - so a pathological string could have made a scan take quadratic
+  time. The pnpm list item and the semver operator split are now parsed
+  directly, and trailing-slash stripping is a linear loop instead of `/+$`.
+  Behaviour is unchanged; `tests/workspaces.test.ts` and `tests/semver.test.ts`
+  cover the affected paths.
+
+## [0.3.0] - 2026-09-18
+
+### Added
+
+- A programmatic entry point (`src/index.ts`, wired to `main` and `exports`), so
+  the scanner can be driven from a script or a test instead of a child process -
+  and so npm can resolve the package instead of reporting that it cannot guess an
+  entry point.
+- `docs/brand/logo-card.svg`: a lockup that carries its own surface, used as the
+  README fallback where `<picture>` is stripped (npm). An SVG loaded through
+  `<img>` resolves `prefers-color-scheme` against the reader's operating system
+  rather than against the page, so a transparent lockup can render
+  light-on-white.
+
+### Fixed
+
+- The README logo is legible on npm in both colour schemes.
+- `tests/args-flags.test.ts` compared an expression with itself, which CodeQL
+  reported as a redundant operation (`js/redundant-operation`).
+
+### Docs
+
+- Changelog link references for 0.2.0 and 0.3.0 were missing.
+
 ## [0.2.0] - 2026-09-16
 
 ### Added
@@ -164,5 +201,8 @@ Nothing yet.
   and that claim needs a primary source. Until then the rule reports what the
   repository imports and cites the compatibility table.
 
-[Unreleased]: https://github.com/MHAlikhani/bunready/compare/v0.1.0...HEAD
+[Unreleased]: https://github.com/MHAlikhani/bunready/compare/v0.3.1...HEAD
+[0.3.1]: https://github.com/MHAlikhani/bunready/releases/tag/v0.3.1
+[0.3.0]: https://github.com/MHAlikhani/bunready/releases/tag/v0.3.0
+[0.2.0]: https://github.com/MHAlikhani/bunready/releases/tag/v0.2.0
 [0.1.0]: https://github.com/MHAlikhani/bunready/releases/tag/v0.1.0

package/README.md

@@ -3,7 +3,7 @@
 <picture>
   <source media="(prefers-color-scheme: dark)" srcset="docs/brand/logo-dark.svg">
   <source media="(prefers-color-scheme: light)" srcset="docs/brand/logo.svg">
-  <img src="docs/brand/logo-auto.svg" alt="bunready" width="360">
+  <img src="docs/brand/logo-card.svg" alt="bunready" width="360">
 </picture>
 
 **One command that tells you what will break before you move a Node/TS repo to Bun — and gives you one clear verdict.**

package/docs/brand/logo-card.svg

@@ -0,0 +1,20 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 340 120" width="340" height="120" role="img" aria-label="bunready">
+  <title>bunready</title>
+  <!--
+    The lockup for hosts that give us no background guarantee.
+    npm renders a README without <picture>, and an SVG loaded through <img>
+    resolves prefers-color-scheme against the reader's operating system rather
+    than the page - so a transparent lockup can end up light-on-white. This one
+    carries its own surface, which is why it is the fallback rather than the
+    default.
+  -->
+  <rect x="0.5" y="0.5" width="339" height="119" rx="18" fill="#171a1f" stroke="#3a3f4a"/>
+  <g fill="none" stroke-linecap="round" stroke-linejoin="round">
+    <rect x="34" y="34" width="52" height="52" rx="15" stroke="#e0a268" stroke-width="3"/>
+    <path d="M53 49 L68 60 L53 71" stroke="#fbfaf7" stroke-width="4.5"/>
+    <path d="M54 77 H68" stroke="#fbfaf7" stroke-width="4.5"/>
+  </g>
+  <text x="108" y="76"
+        font-family="ui-sans-serif, system-ui, -apple-system, 'Segoe UI', Roboto, Helvetica, Arial, sans-serif"
+        font-size="42" font-weight="620" letter-spacing="-1" fill="#f2f1ec">bunready</text>
+</svg>

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mh-alikhani/bunready",
-  "version": "0.2.0",
+  "version": "0.3.1",
   "description": "Bun-readiness scanner: one command that shows what will break before you move a Node/TS repo to Bun.",
   "keywords": [
     "bun",
@@ -27,6 +27,12 @@
   "author": "Mohammad Hosein Alikhani",
   "type": "module",
   "private": false,
+  "main": "./src/index.ts",
+  "types": "./src/index.ts",
+  "exports": {
+    ".": "./src/index.ts",
+    "./package.json": "./package.json"
+  },
   "bin": {
     "bunready": "./src/cli/index.ts"
   },

package/src/index.ts

@@ -0,0 +1,95 @@
+/**
+ * Programmatic entry point.
+ *
+ * bunready is a CLI first. This module exists so the same checks can be driven
+ * from a script or a test without shelling out to a process, and so the package
+ * has a real entry point instead of only a `bin` - npm cannot resolve a package
+ * that declares neither `main` nor `exports`.
+ *
+ * Nothing here is re-exported by accident; if a name is in this file, it is part
+ * of the package's public surface.
+ */
+
+export { type CliOptions, parseArgs } from "./cli/args";
+export { run } from "./cli/run";
+export { createTheme, type Theme } from "./cli/theme";
+export {
+  applyBaseline,
+  type Baseline,
+  type BaselineSummary,
+  fingerprint,
+  parseBaseline,
+  serializeBaseline,
+} from "./config/baseline";
+export {
+  type BunreadyConfig,
+  CONFIG_FILENAME,
+  DEFAULT_CONFIG,
+  parseConfig,
+  type RunConfig,
+} from "./config/config";
+export {
+  type BunreadyError,
+  defineError,
+  type ErrorCode,
+  err,
+  formatError,
+  isErr,
+  isOk,
+  ok,
+  type Result,
+} from "./core/errors";
+export { type DirectoryEntry, type FileSystem, nodeFileSystem, type ReadOutcome } from "./core/fs";
+export { TOOL_NAME, TOOL_VERSION } from "./core/version";
+export { renderHumanReport } from "./report/human";
+export { renderJsonReport } from "./report/json";
+export { renderSarifReport } from "./report/sarif";
+export {
+  type Finding,
+  type RunSummary,
+  SCHEMA_VERSION,
+  type ScannedTarget,
+  type ScanReport,
+  type ScanStats,
+  sortFindings,
+  type Verdict,
+  verdictFor,
+} from "./report/types";
+export { installFindings } from "./rules/install";
+export { runFindings } from "./rules/run";
+export { runtimeFindings } from "./rules/runtime";
+export {
+  type BuiltinUsage,
+  collectNodeBuiltins,
+  readRuntimeDataset,
+} from "./rules/runtime/builtins";
+export {
+  countBySeverity,
+  exitCodeForFindings,
+  exitCodeForSeverities,
+  SEVERITIES,
+  type Severity,
+} from "./rules/severity";
+export {
+  executeProject,
+  firstFailure,
+  type RunEnvironment,
+  type RunOptions,
+  type RunOutcome,
+  systemRunEnvironment,
+} from "./scanner/execute";
+export { buildGraph, type DependencyGraph, knownPackageNames } from "./scanner/graph";
+export {
+  LOCKFILE_FILENAMES,
+  type LockedPackage,
+  type ParsedLockfile,
+  parseLockfile,
+} from "./scanner/lockfile";
+export { type Manifest, parseManifest } from "./scanner/manifest";
+export { detectRuntime, type ScanOptions, scanTarget } from "./scanner/scan";
+export { classifySpecifier, extractImports, type SourceScan, scanSources } from "./scanner/sources";
+export {
+  findWorkspacePackages,
+  type WorkspacePackage,
+  workspacePatterns,
+} from "./scanner/workspaces";

package/src/scanner/semver.ts

@@ -92,12 +92,12 @@ function comparatorsForToken(token: string): Comparator[] | undefined {
     return [];
   }
 
-  const operatorMatch = /^(>=|<=|>|<|=|\^|~)?\s*(.*)$/.exec(trimmed);
-  if (operatorMatch === null) {
-    return undefined;
-  }
-  const operator = operatorMatch[1];
-  const rest = operatorMatch[2] ?? "";
+  // Anchored-prefix parse rather than a trailing \s*(.*)$, which backtracks
+  // quadratically on a long run of spaces - and the range comes from a
+  // repository bunready does not control.
+  const operatorMatch = /^(>=|<=|>|<|=|\^|~)?/.exec(trimmed);
+  const operator = operatorMatch?.[1];
+  const rest = trimmed.slice(operatorMatch?.[0].length ?? 0).trim();
   if (rest === "" || rest === "*" || rest === "x") {
     return [];
   }

package/src/scanner/workspaces.ts

@@ -54,9 +54,22 @@ export function patternsFromPnpmWorkspace(text: string): string[] {
     if (!inPackages) {
       continue;
     }
-    const entry = /^-+\s*(.+?)\s*$/.exec(trimmed);
-    if (entry?.[1] !== undefined) {
-      patterns.push(entry[1].replace(/^['"]|['"]$/g, ""));
+    // Walked rather than matched: a pattern mixing a dash run, a space run and a
+    // catch-all is ambiguous, and CodeQL is right that it backtracks on a string
+    // of dashes and spaces. The value is trimmed here instead.
+    let cursor = 0;
+    while (cursor < trimmed.length && trimmed[cursor] === "-") {
+      cursor += 1;
+    }
+    const value =
+      cursor === 0
+        ? ""
+        : trimmed
+            .slice(cursor)
+            .trim()
+            .replace(/^['"]|['"]$/g, "");
+    if (value !== "") {
+      patterns.push(value);
     }
   }
 
@@ -123,6 +136,15 @@ async function expandGlob(root: string, segments: string[], fs: FileSystem): Pro
   return prefixes.filter((prefix) => prefix !== "" && prefix !== ".");
 }
 
+/** Linear replacement for `/+$`, which backtracks on a run of slashes. */
+function stripTrailingSlashes(value: string): string {
+  let end = value.length;
+  while (end > 0 && value[end - 1] === "/") {
+    end -= 1;
+  }
+  return value.slice(0, end);
+}
+
 export async function findWorkspacePackages(
   root: string,
   patterns: readonly string[],
@@ -131,7 +153,7 @@ export async function findWorkspacePackages(
   const found = new Map<string, WorkspacePackage>();
 
   for (const pattern of patterns) {
-    const cleaned = pattern.replace(/\\/g, "/").replace(/\/+$/, "").replace(/^\.\//, "");
+    const cleaned = stripTrailingSlashes(pattern.replace(/\\/g, "/")).replace(/^\.\//, "");
     if (cleaned === "" || cleaned === ".") {
       continue;
     }
@@ -165,6 +187,6 @@ export async function readPnpmWorkspace(root: string, fs: FileSystem): Promise<s
 
 /** Keep only the packages matching a scope string, by relative path or name. */
 export function scopeMatches(relative: string, scope: string): boolean {
-  const needle = scope.replace(/\\/g, "/").replace(/^\.\//, "").replace(/\/+$/, "");
+  const needle = stripTrailingSlashes(scope.replace(/\\/g, "/")).replace(/^\.\//, "");
   return relative === needle || relative.includes(needle);
 }