@nifrajs/cli 2.10.0 → 2.12.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +7 -1
- package/dist/assure-hydration.d.ts +14 -0
- package/dist/assure-hydration.d.ts.map +1 -0
- package/dist/assure-hydration.js +483 -0
- package/dist/assure-hydration.js.map +1 -0
- package/dist/assure.d.ts +35 -0
- package/dist/assure.d.ts.map +1 -1
- package/dist/assure.js +222 -1
- package/dist/assure.js.map +1 -1
- package/dist/capabilities-tool.d.ts +13 -0
- package/dist/capabilities-tool.d.ts.map +1 -1
- package/dist/capabilities-tool.js +64 -1
- package/dist/capabilities-tool.js.map +1 -1
- package/dist/check.d.ts +133 -10
- package/dist/check.d.ts.map +1 -1
- package/dist/check.js +741 -148
- package/dist/check.js.map +1 -1
- package/dist/cli.d.ts +21 -14
- package/dist/cli.d.ts.map +1 -1
- package/dist/cli.js +288 -73
- package/dist/cli.js.map +1 -1
- package/dist/contract-proof.d.ts +49 -0
- package/dist/contract-proof.d.ts.map +1 -0
- package/dist/contract-proof.js +128 -0
- package/dist/contract-proof.js.map +1 -0
- package/dist/contracts.d.ts +22 -0
- package/dist/contracts.d.ts.map +1 -0
- package/dist/contracts.js +134 -0
- package/dist/contracts.js.map +1 -0
- package/dist/dev-bun-config.d.ts +17 -6
- package/dist/dev-bun-config.d.ts.map +1 -1
- package/dist/dev-bun-config.js +51 -14
- package/dist/dev-bun-config.js.map +1 -1
- package/dist/diagnostics.d.ts +23 -0
- package/dist/diagnostics.d.ts.map +1 -0
- package/dist/diagnostics.js +9 -0
- package/dist/diagnostics.js.map +1 -0
- package/dist/diff-tool.d.ts +2 -0
- package/dist/diff-tool.d.ts.map +1 -1
- package/dist/diff-tool.js +1 -1
- package/dist/diff-tool.js.map +1 -1
- package/dist/docs-search.d.ts +8 -3
- package/dist/docs-search.d.ts.map +1 -1
- package/dist/docs-search.js +36 -15
- package/dist/docs-search.js.map +1 -1
- package/dist/doctor.d.ts +38 -2
- package/dist/doctor.d.ts.map +1 -1
- package/dist/doctor.js +189 -7
- package/dist/doctor.js.map +1 -1
- package/dist/examples.d.ts +1 -2
- package/dist/examples.d.ts.map +1 -1
- package/dist/examples.js +37 -16
- package/dist/examples.js.map +1 -1
- package/dist/fix-recipes.d.ts +12 -0
- package/dist/fix-recipes.d.ts.map +1 -0
- package/dist/fix-recipes.js +106 -0
- package/dist/fix-recipes.js.map +1 -0
- package/dist/init-agents.d.ts.map +1 -1
- package/dist/init-agents.js +60 -4
- package/dist/init-agents.js.map +1 -1
- package/dist/internal/source-facts.d.ts +15 -0
- package/dist/internal/source-facts.d.ts.map +1 -0
- package/dist/internal/source-facts.js +82 -0
- package/dist/internal/source-facts.js.map +1 -0
- package/dist/internal/typescript-import.d.ts +9 -0
- package/dist/internal/typescript-import.d.ts.map +1 -1
- package/dist/internal/typescript-import.js +38 -0
- package/dist/internal/typescript-import.js.map +1 -1
- package/dist/introspect.d.ts +6 -2
- package/dist/introspect.d.ts.map +1 -1
- package/dist/introspect.js +60 -5
- package/dist/introspect.js.map +1 -1
- package/dist/load.d.ts +10 -0
- package/dist/load.d.ts.map +1 -1
- package/dist/load.js +1 -0
- package/dist/load.js.map +1 -1
- package/dist/manifest-tool.d.ts.map +1 -1
- package/dist/manifest-tool.js +14 -9
- package/dist/manifest-tool.js.map +1 -1
- package/dist/mcp-docs-tools.d.ts.map +1 -1
- package/dist/mcp-docs-tools.js +3 -0
- package/dist/mcp-docs-tools.js.map +1 -1
- package/dist/mcp-http.js +1 -1
- package/dist/mcp-root.d.ts +83 -0
- package/dist/mcp-root.d.ts.map +1 -0
- package/dist/mcp-root.js +221 -0
- package/dist/mcp-root.js.map +1 -0
- package/dist/mcp-run.d.ts.map +1 -1
- package/dist/mcp-run.js +18 -4
- package/dist/mcp-run.js.map +1 -1
- package/dist/mcp.d.ts +27 -4
- package/dist/mcp.d.ts.map +1 -1
- package/dist/mcp.js +360 -27
- package/dist/mcp.js.map +1 -1
- package/dist/pipeline-guard.d.ts +25 -10
- package/dist/pipeline-guard.d.ts.map +1 -1
- package/dist/pipeline-guard.js +35 -15
- package/dist/pipeline-guard.js.map +1 -1
- package/dist/pipeline-report.d.ts +34 -0
- package/dist/pipeline-report.d.ts.map +1 -0
- package/dist/pipeline-report.js +282 -0
- package/dist/pipeline-report.js.map +1 -0
- package/dist/project-path.d.ts +3 -0
- package/dist/project-path.d.ts.map +1 -0
- package/dist/project-path.js +36 -0
- package/dist/project-path.js.map +1 -0
- package/dist/replay.d.ts +12 -0
- package/dist/replay.d.ts.map +1 -0
- package/dist/replay.js +36 -0
- package/dist/replay.js.map +1 -0
- package/dist/rules/codes.d.ts +42 -0
- package/dist/rules/codes.d.ts.map +1 -0
- package/dist/rules/codes.js +52 -0
- package/dist/rules/codes.js.map +1 -0
- package/dist/rules/comment-markers.d.ts +10 -0
- package/dist/rules/comment-markers.d.ts.map +1 -0
- package/dist/rules/comment-markers.js +24 -0
- package/dist/rules/comment-markers.js.map +1 -0
- package/dist/rules/index.d.ts +31 -0
- package/dist/rules/index.d.ts.map +1 -0
- package/dist/rules/index.js +133 -0
- package/dist/rules/index.js.map +1 -0
- package/dist/rules/legacy.d.ts +7 -0
- package/dist/rules/legacy.d.ts.map +1 -0
- package/dist/rules/legacy.js +85 -0
- package/dist/rules/legacy.js.map +1 -0
- package/dist/rules/routes.d.ts +12 -0
- package/dist/rules/routes.d.ts.map +1 -0
- package/dist/rules/routes.js +142 -0
- package/dist/rules/routes.js.map +1 -0
- package/dist/rules/security.d.ts +10 -0
- package/dist/rules/security.d.ts.map +1 -0
- package/dist/rules/security.js +471 -0
- package/dist/rules/security.js.map +1 -0
- package/dist/search-terms.d.ts +2 -0
- package/dist/search-terms.d.ts.map +1 -1
- package/dist/search-terms.js +5 -1
- package/dist/search-terms.js.map +1 -1
- package/dist/types-search.d.ts +1 -2
- package/dist/types-search.d.ts.map +1 -1
- package/dist/types-search.js +33 -16
- package/dist/types-search.js.map +1 -1
- package/dist/verification.d.ts +9 -0
- package/dist/verification.d.ts.map +1 -1
- package/dist/verification.js +17 -1
- package/dist/verification.js.map +1 -1
- package/dist/work-graph.d.ts +123 -0
- package/dist/work-graph.d.ts.map +1 -0
- package/dist/work-graph.js +465 -0
- package/dist/work-graph.js.map +1 -0
- package/docs/examples.json +32 -2
- package/docs/llms-full.txt +1105 -27
- package/docs/types.json +1772 -137
- package/package.json +34 -9
- package/src/assure-hydration.ts +606 -0
- package/src/assure.ts +316 -2
- package/src/capabilities-tool.ts +80 -1
- package/src/check.ts +923 -169
- package/src/cli.ts +297 -76
- package/src/contract-proof.ts +194 -0
- package/src/contracts.ts +157 -0
- package/src/dev-bun-config.ts +57 -14
- package/src/diagnostics.ts +32 -0
- package/src/diff-tool.ts +1 -1
- package/src/docs-search.ts +45 -15
- package/src/doctor.ts +286 -8
- package/src/examples.ts +43 -15
- package/src/fix-recipes.ts +126 -0
- package/src/init-agents.ts +61 -4
- package/src/internal/source-facts.ts +133 -0
- package/src/internal/typescript-import.ts +29 -0
- package/src/introspect.ts +81 -6
- package/src/load.ts +11 -0
- package/src/manifest-tool.ts +16 -10
- package/src/mcp-docs-tools.ts +3 -0
- package/src/mcp-http.ts +1 -1
- package/src/mcp-root.ts +271 -0
- package/src/mcp-run.ts +19 -4
- package/src/mcp.ts +440 -34
- package/src/pipeline-guard.ts +44 -14
- package/src/pipeline-report.ts +341 -0
- package/src/project-path.ts +36 -0
- package/src/replay.ts +44 -0
- package/src/rules/codes.ts +57 -0
- package/src/rules/comment-markers.ts +26 -0
- package/src/rules/index.ts +175 -0
- package/src/rules/legacy.ts +93 -0
- package/src/rules/routes.ts +157 -0
- package/src/rules/security.ts +505 -0
- package/src/search-terms.ts +9 -4
- package/src/types-search.ts +39 -15
- package/src/verification.ts +18 -1
- package/src/work-graph.ts +613 -0
package/dist/check.d.ts
CHANGED
|
@@ -16,8 +16,13 @@
|
|
|
16
16
|
* anything fails. Pure scanners (`scanFetchText`, `scanServerOnlyImports`) are unit-tested.
|
|
17
17
|
*/
|
|
18
18
|
import type { AssuranceConfig, AssuranceReport } from "@nifrajs/core/assurance";
|
|
19
|
+
import { type ProjectEvidenceSnapshot } from "@nifrajs/core/evidence";
|
|
20
|
+
import type * as TSApi from "typescript";
|
|
19
21
|
import type { CapabilityProjectReport } from "./capabilities-tool.js";
|
|
22
|
+
import { type Diagnostic } from "./diagnostics.js";
|
|
23
|
+
import { type SourceFacts } from "./internal/source-facts.js";
|
|
20
24
|
import { type TypeScriptApi } from "./internal/typescript-import.js";
|
|
25
|
+
import type { PipelineReport } from "./pipeline-report.js";
|
|
21
26
|
export interface SourceFinding {
|
|
22
27
|
readonly file: string;
|
|
23
28
|
readonly line: number;
|
|
@@ -56,9 +61,70 @@ export declare function codePositionMask(src: string): string;
|
|
|
56
61
|
* skipped too. */
|
|
57
62
|
export declare function scanFetchText(file: string, content: string, externalMounts?: readonly string[]): SourceFinding[];
|
|
58
63
|
/** Statically collect simple Nifra route registrations from source, without importing app code. */
|
|
59
|
-
export declare function scanStaticRouteText(file: string, content: string): StaticRouteFinding[];
|
|
60
|
-
/**
|
|
61
|
-
|
|
64
|
+
export declare function scanStaticRouteText(file: string, content: string, facts?: SourceFacts): StaticRouteFinding[];
|
|
65
|
+
/** Module-scope `const` initializers by name - the one binding form the SQL scanner resolves. */
|
|
66
|
+
type ModuleConsts = ReadonlyMap<string, TSApi.Expression>;
|
|
67
|
+
/** A name some other module exports, named exactly as the edge that reaches it writes it. */
|
|
68
|
+
interface ExportEdge {
|
|
69
|
+
readonly specifier: string;
|
|
70
|
+
readonly exported: string;
|
|
71
|
+
}
|
|
72
|
+
/**
|
|
73
|
+
* One module's provable module-scope bindings: its top-level `const` initializers plus the exact
|
|
74
|
+
* import/export edges this scan is allowed to follow.
|
|
75
|
+
*
|
|
76
|
+
* Everything absent from these maps stays unresolved, and an unresolved interpolation keeps flagging.
|
|
77
|
+
* That is the whole safety argument: resolution can only ever make this rule QUIETER, so a form the
|
|
78
|
+
* scan cannot prove must fall out as "unknown" rather than be guessed at. Deliberately absent:
|
|
79
|
+
* `export default`, `export let`/`var`, destructured or computed names, default and namespace imports,
|
|
80
|
+
* `export * as ns`, `require`, and dynamic `import()`.
|
|
81
|
+
*/
|
|
82
|
+
interface SqlModuleScope {
|
|
83
|
+
/** The module's identity - an absolute path from the loader, or the entry file's path as given. Keys
|
|
84
|
+
* the parsed-scope cache and the cycle guard, and is the base its own specifiers resolve against. */
|
|
85
|
+
readonly id: string;
|
|
86
|
+
readonly consts: ModuleConsts;
|
|
87
|
+
/** Local name bound by `import { X as local }` → the edge that provides it. */
|
|
88
|
+
readonly imports: ReadonlyMap<string, ExportEdge>;
|
|
89
|
+
/** Exported name → the local name it reads (`export { a as b }` → `b` → `a`). */
|
|
90
|
+
readonly localExports: ReadonlyMap<string, string>;
|
|
91
|
+
/** Exported name → another module's export (`export { a as b } from "./m"`). */
|
|
92
|
+
readonly reExports: ReadonlyMap<string, ExportEdge>;
|
|
93
|
+
/** `export * from "./m"` specifiers, in source order. */
|
|
94
|
+
readonly starExports: readonly string[];
|
|
95
|
+
}
|
|
96
|
+
/** A module's identity + source, as resolved from a specifier. `id` must be stable and absolute: it
|
|
97
|
+
* keys the parsed-scope cache, seeds the cycle guard, and is what the module's own relative specifiers
|
|
98
|
+
* resolve against. */
|
|
99
|
+
export interface SqlModuleSource {
|
|
100
|
+
readonly id: string;
|
|
101
|
+
readonly content: string;
|
|
102
|
+
}
|
|
103
|
+
/**
|
|
104
|
+
* Resolves a specifier written in the module `fromModule` to the target's identity + source, or
|
|
105
|
+
* `undefined` when it cannot be resolved, read, or proved to be in-project source.
|
|
106
|
+
*
|
|
107
|
+
* Injected rather than built in, for the same reason {@link ModuleResolver} is: it keeps
|
|
108
|
+
* {@link scanInterpolatedSql} pure and filesystem-free, so the resolution rules can be unit-tested
|
|
109
|
+
* against a virtual module graph. {@link createProjectSqlImports} is the on-disk implementation.
|
|
110
|
+
*/
|
|
111
|
+
export type SqlModuleLoader = (fromModule: string, specifier: string) => SqlModuleSource | undefined;
|
|
112
|
+
/** Cross-module resolution state for one run: the loader plus a parsed-scope cache, so a fragments
|
|
113
|
+
* module imported by fifty callers is read and parsed once. A cached `undefined` is a REFUSAL (the
|
|
114
|
+
* module did not parse), cached so it is not re-attempted. Build with {@link createSqlImports}. */
|
|
115
|
+
export interface SqlImports {
|
|
116
|
+
readonly load: SqlModuleLoader;
|
|
117
|
+
readonly scopes: Map<string, SqlModuleScope | undefined>;
|
|
118
|
+
}
|
|
119
|
+
export declare const createSqlImports: (load: SqlModuleLoader) => SqlImports;
|
|
120
|
+
/**
|
|
121
|
+
* Scan one file's text for SQL assembled by interpolation. Pure + line-accurate.
|
|
122
|
+
*
|
|
123
|
+
* `imports` opts into following a fragment `const` into another module. Without it the scan is
|
|
124
|
+
* same-file only, which is what the unit tests exercise and what any caller that has no module graph
|
|
125
|
+
* to offer gets. With it, only what {@link createProjectSqlImports} will hand back is followed.
|
|
126
|
+
*/
|
|
127
|
+
export declare function scanInterpolatedSql(file: string, content: string, ts: TypeScriptApi, imports?: SqlImports): SourceFinding[];
|
|
62
128
|
/**
|
|
63
129
|
* Collect interpolated-SQL findings across the project.
|
|
64
130
|
*
|
|
@@ -68,6 +134,22 @@ export declare function scanInterpolatedSql(file: string, content: string, ts: T
|
|
|
68
134
|
* answer a security rule must never give when it did not run.
|
|
69
135
|
*/
|
|
70
136
|
export declare function scanProjectSql(cwd: string): Promise<SourceFinding[] | undefined>;
|
|
137
|
+
/**
|
|
138
|
+
* The on-disk loader for cross-module `const` resolution, scoped to one project.
|
|
139
|
+
*
|
|
140
|
+
* Deliberately narrow, because every widening here is a way for a real finding to go quiet:
|
|
141
|
+
*
|
|
142
|
+
* - **Relative specifiers only.** A bare specifier names a dependency whose exports can change without
|
|
143
|
+
* this project changing, so "provably a `const` string" is not a property the project owns.
|
|
144
|
+
* - **Inside `cwd`, outside the ignored trees.** The resolved path is realpath'd and must still sit
|
|
145
|
+
* under the project root: a symlink pointing out of the tree is not source this scan reads. The
|
|
146
|
+
* `node_modules` / `dist` / build exclusions are the same ones the walk applies.
|
|
147
|
+
* - **Real source only.** A `.d.ts` carries no initializer, and a non-TS file is not parsed.
|
|
148
|
+
*
|
|
149
|
+
* A miss on any of those returns `undefined`, which leaves the name unresolved and the interpolation
|
|
150
|
+
* flagged - the pre-feature answer.
|
|
151
|
+
*/
|
|
152
|
+
export declare function createProjectSqlImports(cwd: string): SqlImports;
|
|
71
153
|
/** Scan one file's text for untyped `client("…")` calls. Pure + line-accurate. */
|
|
72
154
|
export declare function scanUntypedClient(file: string, content: string): SourceFinding[];
|
|
73
155
|
/** Flag an import of a specifier that no longer exists. Pure; matches the exact specifier or a subpath
|
|
@@ -76,10 +158,10 @@ export declare function scanRemovedImports(file: string, content: string): Sourc
|
|
|
76
158
|
/** Scan a route module for top-level server-only imports. Returns `[]` for non-route files (only
|
|
77
159
|
* `routes/` modules are browser-bundled, so a server-only import elsewhere is fine). Each finding carries
|
|
78
160
|
* the offending `specifier` so the diagnostic can render the `routeFile → specifier` chain. Pure. */
|
|
79
|
-
export declare function scanServerOnlyImports(file: string, content: string): ServerImportFinding[];
|
|
161
|
+
export declare function scanServerOnlyImports(file: string, content: string, facts?: SourceFacts): ServerImportFinding[];
|
|
80
162
|
/** Extract the static, non-type import specifiers from a module's source (the edges to follow/inspect).
|
|
81
163
|
* Mirrors {@link STATIC_IMPORT}, so `import type` + dynamic `import()` are already excluded. Pure. */
|
|
82
|
-
export declare function parseStaticImports(content: string): string[];
|
|
164
|
+
export declare function parseStaticImports(content: string, facts?: SourceFacts, file?: string): string[];
|
|
83
165
|
/** The server-only SINK an import specifier names directly (a `node:`/`bun:` builtin or a known
|
|
84
166
|
* server-only package), or `undefined` if it isn't a by-name sink. Pure - the label is the specifier
|
|
85
167
|
* itself (it's already the actionable name). */
|
|
@@ -110,7 +192,7 @@ export type ModuleReader = (absPath: string) => string | undefined;
|
|
|
110
192
|
* it's linear and cycle-free. `routeFile`/`routeContent` seed the walk; `resolve`/`read` supply the graph
|
|
111
193
|
* - pure given those, so it's unit-testable with a fake graph.
|
|
112
194
|
*/
|
|
113
|
-
export declare function walkServerOnlyChain(routeFile: string, routeContent: string, resolve: ModuleResolver, read: ModuleReader): readonly string[] | undefined;
|
|
195
|
+
export declare function walkServerOnlyChain(routeFile: string, routeContent: string, resolve: ModuleResolver, read: ModuleReader, facts?: SourceFacts): readonly string[] | undefined;
|
|
114
196
|
/**
|
|
115
197
|
* Resolve the FULL transitive server-only chain(s) for a route module, given a real fs-backed resolver +
|
|
116
198
|
* reader. For each of the route's top-level imports, if a precise transitive walk finds a sink, the
|
|
@@ -119,10 +201,10 @@ export declare function walkServerOnlyChain(routeFile: string, routeContent: str
|
|
|
119
201
|
* edge (`fallback: true`), never a fabricated chain. Returns one finding per offending top-level import,
|
|
120
202
|
* de-duplicated to the shortest chain per first-hop specifier. Non-route files yield `[]`.
|
|
121
203
|
*/
|
|
122
|
-
export declare function resolveServerOnlyChains(file: string, content: string, resolve: ModuleResolver, read: ModuleReader): TransitiveServerImportFinding[];
|
|
204
|
+
export declare function resolveServerOnlyChains(file: string, content: string, resolve: ModuleResolver, read: ModuleReader, facts?: SourceFacts): TransitiveServerImportFinding[];
|
|
123
205
|
/** Scan a backend module (one that calls `server(`) for handlers returning a raw `Response`, which collapses
|
|
124
206
|
* the typed client's `data` to `never`. Pure + line-accurate; returns `[]` for files with no `server(` call. */
|
|
125
|
-
export declare function scanResponseRoutes(file: string, content: string): SourceFinding[];
|
|
207
|
+
export declare function scanResponseRoutes(file: string, content: string, facts?: SourceFacts): SourceFinding[];
|
|
126
208
|
export declare function walkSource(cwd: string, visit: (rel: string, content: string) => void, opts?: {
|
|
127
209
|
readonly includeTests?: boolean;
|
|
128
210
|
}): Promise<void>;
|
|
@@ -147,11 +229,13 @@ export interface ManifestDriftFinding {
|
|
|
147
229
|
export declare function scanServerManifestDrift(cwd: string): Promise<ManifestDriftFinding[]>;
|
|
148
230
|
/** A single machine-readable check failure - the unit an agent (or CI) acts on. */
|
|
149
231
|
export interface CheckDiagnostic {
|
|
150
|
-
readonly rule:
|
|
232
|
+
readonly rule: string;
|
|
151
233
|
/** `error` fails the gate (a real contract break); `warning` is advisory - surfaced to the agent but
|
|
152
234
|
* does NOT fail `nifra check`, for patterns that are sometimes intentional (a route returning a raw
|
|
153
235
|
* `Response`, which silently drops the typed client to `data: never` but is valid for files/redirects). */
|
|
154
|
-
readonly severity: "error" | "warning";
|
|
236
|
+
readonly severity: "error" | "warning" | "info";
|
|
237
|
+
/** Stable diagnostic protocol code. The legacy `rule` remains for compatibility. */
|
|
238
|
+
readonly code?: string;
|
|
155
239
|
readonly file?: string;
|
|
156
240
|
readonly line?: number;
|
|
157
241
|
readonly message: string;
|
|
@@ -174,6 +258,8 @@ export interface CheckDiagnostic {
|
|
|
174
258
|
* edge rather than fabricating a deeper path - never a lie.
|
|
175
259
|
*/
|
|
176
260
|
readonly chain?: readonly string[];
|
|
261
|
+
readonly evidence?: readonly string[];
|
|
262
|
+
readonly verify?: string;
|
|
177
263
|
}
|
|
178
264
|
export interface CheckSuggestion {
|
|
179
265
|
readonly kind: "edit" | "command" | "manual";
|
|
@@ -187,11 +273,27 @@ export interface CheckSuggestion {
|
|
|
187
273
|
export interface CheckResult {
|
|
188
274
|
readonly ok: boolean;
|
|
189
275
|
readonly typecheck: "pass" | "fail" | "skipped";
|
|
276
|
+
/** Why `typecheck` is `"skipped"` (no tsconfig.json, typescript not installed, lints-only mode).
|
|
277
|
+
* Absent when the typecheck ran. Echoed in the human report so a skip is never a dim mystery. */
|
|
278
|
+
readonly typecheckNote?: string;
|
|
190
279
|
readonly diagnostics: readonly CheckDiagnostic[];
|
|
280
|
+
/** Normalized diagnostics with stable codes for agents and external renderers. */
|
|
281
|
+
readonly structuredDiagnostics?: readonly Diagnostic[];
|
|
282
|
+
/**
|
|
283
|
+
* Which bundler this app's phases run on, read statically from the config, and how nifra concluded
|
|
284
|
+
* it. Returned even when nothing is wrong: an agent reading this project has to know which plugin
|
|
285
|
+
* slot is live and which toolchain compiles a component before its next edit, and every `pipeline`
|
|
286
|
+
* diagnostic below is only interpretable against it. Absent when the directory is not a nifra app.
|
|
287
|
+
*/
|
|
288
|
+
readonly pipeline?: PipelineReport;
|
|
191
289
|
/** Intentional non-typed mount prefixes declared in `nifra.check.json` (e.g. `/auth` for a mounted
|
|
192
290
|
* better-auth). Echoed here so `--json` / the MCP tool / the report can show what the typed-client scan
|
|
193
291
|
* deliberately skipped - a suppressed prefix stays auditable instead of silently hiding real drift. */
|
|
194
292
|
readonly externalMounts?: readonly string[];
|
|
293
|
+
/** Active per-rule overrides from `nifra.check.json` `rules`, echoed verbatim so a retagged or
|
|
294
|
+
* suppressed finding stays auditable in `--json`, the MCP tool, and the human report - config can
|
|
295
|
+
* lower (or raise) the gate, but never invisibly. */
|
|
296
|
+
readonly ruleOverrides?: Readonly<Record<string, RuleOverride>>;
|
|
195
297
|
/** Set only when the caller passed `maxDiagnostics` and there were more - `diagnostics` then holds the
|
|
196
298
|
* first `shown` of `total`. It caps the serialized size so the `nifra_check` MCP tool can't emit a
|
|
197
299
|
* message large enough to break the stdio transport; fix the shown diagnostics and re-run for the rest. */
|
|
@@ -217,6 +319,19 @@ export interface CheckAssuranceContext {
|
|
|
217
319
|
readonly routeAssurance?: AssuranceReport;
|
|
218
320
|
/** Static capability provenance, when the config declares a capabilities policy. */
|
|
219
321
|
readonly capability?: CapabilityProjectReport;
|
|
322
|
+
/** Canonical token-only evidence reused by manifest and other offline projections. */
|
|
323
|
+
readonly evidence?: ProjectEvidenceSnapshot;
|
|
324
|
+
}
|
|
325
|
+
/**
|
|
326
|
+
* One entry of `nifra.check.json` `rules`, keyed by legacy rule name (`response-route`) or stable
|
|
327
|
+
* NF- code (`NF-S002`) - one key retags the finding in both diagnostic views. `severity: "off"`
|
|
328
|
+
* drops the rule's findings; `ignore` drops findings whose file matches any of the globs. Overrides
|
|
329
|
+
* are applied centrally BEFORE `ok` is computed and echoed in the result and the human report -
|
|
330
|
+
* configuration can lower (or raise) the gate, but never invisibly.
|
|
331
|
+
*/
|
|
332
|
+
export interface RuleOverride {
|
|
333
|
+
readonly severity?: "error" | "warn" | "info" | "off";
|
|
334
|
+
readonly ignore?: readonly string[];
|
|
220
335
|
}
|
|
221
336
|
/** Run the three checks and assemble a structured, machine-readable result. The single source the CLI
|
|
222
337
|
* report, `--json`, and the MCP tool all render from. */
|
|
@@ -234,9 +349,17 @@ export declare function collectCheckResult(cwd: string, opts?: {
|
|
|
234
349
|
* time; when absent, they are computed here (unchanged standalone behavior). */
|
|
235
350
|
readonly assurance?: CheckAssuranceContext;
|
|
236
351
|
}): Promise<CheckResult>;
|
|
352
|
+
/**
|
|
353
|
+
* Render the human-readable check report as lines. Pure (no I/O, no cwd) so tests can assert
|
|
354
|
+
* report/exit-code parity: every diagnostic in `result.diagnostics` appears in the output, and the
|
|
355
|
+
* trailer states the error/advisory counts that produced `ok`.
|
|
356
|
+
*/
|
|
357
|
+
export declare function renderCheckReport(result: CheckResult): string[];
|
|
237
358
|
/** Run the full check; print a report (`--json` for machine output) and return whether it passed. */
|
|
238
359
|
export declare function runCheck(cwd: string, opts?: {
|
|
239
360
|
readonly json?: boolean;
|
|
240
361
|
readonly lintsOnly?: boolean;
|
|
362
|
+
readonly structured?: boolean;
|
|
241
363
|
}): Promise<boolean>;
|
|
364
|
+
export {};
|
|
242
365
|
//# sourceMappingURL=check.d.ts.map
|
package/dist/check.d.ts.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"check.d.ts","sourceRoot":"","sources":["../src/check.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAIH,OAAO,KAAK,EAAE,eAAe,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAA;
|
|
1
|
+
{"version":3,"file":"check.d.ts","sourceRoot":"","sources":["../src/check.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAIH,OAAO,KAAK,EAAE,eAAe,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAA;AAC/E,OAAO,EAAE,KAAK,uBAAuB,EAA2B,MAAM,wBAAwB,CAAA;AAE9F,OAAO,KAAK,KAAK,KAAK,MAAM,YAAY,CAAA;AACxC,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,wBAAwB,CAAA;AACrE,OAAO,EAAE,KAAK,UAAU,EAAc,MAAM,kBAAkB,CAAA;AAC9D,OAAO,EAAqB,KAAK,WAAW,EAAE,MAAM,4BAA4B,CAAA;AAChF,OAAO,EAA2B,KAAK,aAAa,EAAE,MAAM,iCAAiC,CAAA;AAG7F,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAA;AAO1D,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;CACzB;AACD;6GAC6G;AAC7G,MAAM,WAAW,mBAAoB,SAAQ,aAAa;IACxD,oGAAoG;IACpG,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;CAC3B;AAsCD,MAAM,WAAW,kBAAmB,SAAQ,aAAa;IACvD,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;CACtB;AA0LD;;;;;;;;;GASG;AACH,wBAAgB,aAAa,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAyCjD;AAED;;;8FAG8F;AAC9F,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAoCpD;AA8FD;;;;kBAIkB;AAClB,wBAAgB,aAAa,CAC3B,IAAI,EAAE,MAAM,EACZ,OAAO,EAAE,MAAM,EACf,cAAc,GAAE,SAAS,MAAM,EAAO,GACrC,aAAa,EAAE,CAkBjB;AAED,mGAAmG;AACnG,wBAAgB,mBAAmB,CACjC,IAAI,EAAE,MAAM,EACZ,OAAO,EAAE,MAAM,EACf,KAAK,CAAC,EAAE,WAAW,GAClB,kBAAkB,EAAE,CAOtB;AA0CD,iGAAiG;AACjG,KAAK,YAAY,GAAG,WAAW,CAAC,MAAM,EAAE,KAAK,CAAC,UAAU,CAAC,CAAA;AAEzD,6FAA6F;AAC7F,UAAU,UAAU;IAClB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;IAC1B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;CAC1B;AAED;;;;;;;;;GASG;AACH,UAAU,cAAc;IACtB;yGACqG;IACrG,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAA;IACnB,QAAQ,CAAC,MAAM,EAAE,YAAY,CAAA;IAC7B,+EAA+E;IAC/E,QAAQ,CAAC,OAAO,EAAE,WAAW,CAAC,MAAM,EAAE,UAAU,CAAC,CAAA;IACjD,iFAAiF;IACjF,QAAQ,CAAC,YAAY,EAAE,WAAW,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IAClD,gFAAgF;IAChF,QAAQ,CAAC,SAAS,EAAE,WAAW,CAAC,MAAM,EAAE,UAAU,CAAC,CAAA;IACnD,yDAAyD;IACzD,QAAQ,CAAC,WAAW,EAAE,SAAS,MAAM,EAAE,CAAA;CACxC;AA6DD;;sBAEsB;AACtB,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAA;IACnB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;CACzB;AAED;;;;;;;GAOG;AACH,MAAM,MAAM,eAAe,GAAG,CAAC,UAAU,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,KAAK,eAAe,GAAG,SAAS,CAAA;AAEpG;;mGAEmG;AACnG,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,IAAI,EAAE,eAAe,CAAA;IAC9B,QAAQ,CAAC,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,cAAc,GAAG,SAAS,CAAC,CAAA;CACzD;AAED,eAAO,MAAM,gBAAgB,GAAI,MAAM,eAAe,KAAG,UAGvD,CAAA;AAwWF;;;;;;GAMG;AACH,wBAAgB,mBAAmB,CACjC,IAAI,EAAE,MAAM,EACZ,OAAO,EAAE,MAAM,EACf,EAAE,EAAE,aAAa,EACjB,OAAO,CAAC,EAAE,UAAU,GACnB,aAAa,EAAE,CAkCjB;AAED;;;;;;;GAOG;AACH,wBAAsB,cAAc,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,EAAE,GAAG,SAAS,CAAC,CAStF;AAQD;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,uBAAuB,CAAC,GAAG,EAAE,MAAM,GAAG,UAAU,CAwB/D;AAQD,kFAAkF;AAClF,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,aAAa,EAAE,CAahF;AA+CD;0EAC0E;AAC1E,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,aAAa,EAAE,CAcjF;AAED;;qGAEqG;AACrG,wBAAgB,qBAAqB,CACnC,IAAI,EAAE,MAAM,EACZ,OAAO,EAAE,MAAM,EACf,KAAK,CAAC,EAAE,WAAW,GAClB,mBAAmB,EAAE,CAsBvB;AA+DD;sGACsG;AACtG,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,WAAW,EAAE,IAAI,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAEhG;AAED;;gDAEgD;AAChD,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAEpE;AAED;kGACkG;AAClG,MAAM,WAAW,6BAA8B,SAAQ,mBAAmB;IACxE;qFACiF;IACjF,QAAQ,CAAC,KAAK,EAAE,SAAS,MAAM,EAAE,CAAA;IACjC;sFACkF;IAClF,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAA;CAC3B;AAED;;+EAE+E;AAC/E,MAAM,MAAM,cAAc,GAAG,CAAC,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,KAAK,MAAM,GAAG,SAAS,CAAA;AACxF,sGAAsG;AACtG,MAAM,MAAM,YAAY,GAAG,CAAC,OAAO,EAAE,MAAM,KAAK,MAAM,GAAG,SAAS,CAAA;AAElE;;;;;;;;;GASG;AACH,wBAAgB,mBAAmB,CACjC,SAAS,EAAE,MAAM,EACjB,YAAY,EAAE,MAAM,EACpB,OAAO,EAAE,cAAc,EACvB,IAAI,EAAE,YAAY,EAClB,KAAK,CAAC,EAAE,WAAW,GAClB,SAAS,MAAM,EAAE,GAAG,SAAS,CA0C/B;AAED;;;;;;;GAOG;AACH,wBAAgB,uBAAuB,CACrC,IAAI,EAAE,MAAM,EACZ,OAAO,EAAE,MAAM,EACf,OAAO,EAAE,cAAc,EACvB,IAAI,EAAE,YAAY,EAClB,KAAK,CAAC,EAAE,WAAW,GAClB,6BAA6B,EAAE,CAkEjC;AAQD;gHACgH;AAChH,wBAAgB,kBAAkB,CAChC,IAAI,EAAE,MAAM,EACZ,OAAO,EAAE,MAAM,EACf,KAAK,CAAC,EAAE,WAAW,GAClB,aAAa,EAAE,CA6BjB;AA4CD,wBAAsB,UAAU,CAC9B,GAAG,EAAE,MAAM,EACX,KAAK,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,KAAK,IAAI,EAC7C,IAAI,GAAE;IAAE,QAAQ,CAAC,YAAY,CAAC,EAAE,OAAO,CAAA;CAAO,GAC7C,OAAO,CAAC,IAAI,CAAC,CAaf;AAKD,6DAA6D;AAC7D,wBAAsB,WAAW,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,EAAE,CAAC,CAIvE;AAgBD,MAAM,WAAW,oBAAoB;IACnC,4DAA4D;IAC5D,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,sGAAsG;IACtG,QAAQ,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAA;IACnC,8FAA8F;IAC9F,QAAQ,CAAC,KAAK,EAAE,SAAS,MAAM,EAAE,CAAA;CAClC;AAED;;;;;;;GAOG;AACH,wBAAsB,uBAAuB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,oBAAoB,EAAE,CAAC,CAgC1F;AAmFD,mFAAmF;AACnF,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB;;+GAE2G;IAC3G,QAAQ,CAAC,QAAQ,EAAE,OAAO,GAAG,SAAS,GAAG,MAAM,CAAA;IAC/C,oFAAoF;IACpF,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAA;IACtB,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAA;IACtB,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAA;IACtB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;IACxB;;uCAEmC;IACnC,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAA;IACrB;wGACoG;IACpG,QAAQ,CAAC,UAAU,CAAC,EAAE,eAAe,CAAA;IACrC;;;;;;;;;;OAUG;IACH,QAAQ,CAAC,KAAK,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;IAClC,QAAQ,CAAC,QAAQ,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;IACrC,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CACzB;AAED,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,SAAS,GAAG,QAAQ,CAAA;IAC5C,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;IACtB,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAA;IACtB,yFAAyF;IACzF,QAAQ,CAAC,OAAO,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;IACpC,QAAQ,CAAC,KAAK,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;CACnC;AAED,2GAA2G;AAC3G,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,EAAE,EAAE,OAAO,CAAA;IACpB,QAAQ,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAAA;IAC/C;qGACiG;IACjG,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAA;IAC/B,QAAQ,CAAC,WAAW,EAAE,SAAS,eAAe,EAAE,CAAA;IAChD,kFAAkF;IAClF,QAAQ,CAAC,qBAAqB,CAAC,EAAE,SAAS,UAAU,EAAE,CAAA;IACtD;;;;;OAKG;IACH,QAAQ,CAAC,QAAQ,CAAC,EAAE,cAAc,CAAA;IAClC;;2GAEuG;IACvG,QAAQ,CAAC,cAAc,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;IAC3C;;yDAEqD;IACrD,QAAQ,CAAC,aAAa,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC,CAAA;IAC/D;;+GAE2G;IAC3G,QAAQ,CAAC,SAAS,CAAC,EAAE;QAAE,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAA;CACxE;AAED;;;;;GAKG;AACH,MAAM,WAAW,qBAAqB;IACpC,sGAAsG;IACtG,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAA;IACzB,kGAAkG;IAClG,QAAQ,CAAC,MAAM,CAAC,EAAE,eAAe,CAAA;IACjC,oGAAoG;IACpG,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO,CAAA;IACxB,oGAAoG;IACpG,QAAQ,CAAC,cAAc,CAAC,EAAE,eAAe,CAAA;IACzC,oFAAoF;IACpF,QAAQ,CAAC,UAAU,CAAC,EAAE,uBAAuB,CAAA;IAC7C,sFAAsF;IACtF,QAAQ,CAAC,QAAQ,CAAC,EAAE,uBAAuB,CAAA;CAC5C;AASD;;;;;;GAMG;AACH,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,QAAQ,CAAC,EAAE,OAAO,GAAG,MAAM,GAAG,MAAM,GAAG,KAAK,CAAA;IACrD,QAAQ,CAAC,MAAM,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;CACpC;AA0OD;yDACyD;AACzD,wBAAsB,kBAAkB,CACtC,GAAG,EAAE,MAAM,EACX,IAAI,GAAE;IACJ,QAAQ,CAAC,SAAS,CAAC,EAAE,OAAO,CAAA;IAC5B,QAAQ,CAAC,MAAM,CAAC,EAAE,WAAW,CAAA;IAC7B;8GAC0G;IAC1G,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAA;IAChC;uGACmG;IACnG,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,OAAO,CAAC,aAAa,GAAG,SAAS,CAAC,CAAA;IAClE;;oFAEgF;IAChF,QAAQ,CAAC,SAAS,CAAC,EAAE,qBAAqB,CAAA;CACtC,GACL,OAAO,CAAC,WAAW,CAAC,CAoqBtB;AAuBD;;;;GAIG;AACH,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,WAAW,GAAG,MAAM,EAAE,CAwG/D;AAED,qGAAqG;AACrG,wBAAsB,QAAQ,CAC5B,GAAG,EAAE,MAAM,EACX,IAAI,GAAE;IACJ,QAAQ,CAAC,IAAI,CAAC,EAAE,OAAO,CAAA;IACvB,QAAQ,CAAC,SAAS,CAAC,EAAE,OAAO,CAAA;IAC5B,QAAQ,CAAC,UAAU,CAAC,EAAE,OAAO,CAAA;CACzB,GACL,OAAO,CAAC,OAAO,CAAC,CAsClB"}
|