@nifrajs/cli 2.11.0 → 2.12.1
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +6 -0
- package/dist/assure-hydration.d.ts +14 -0
- package/dist/assure-hydration.d.ts.map +1 -0
- package/dist/assure-hydration.js +483 -0
- package/dist/assure-hydration.js.map +1 -0
- package/dist/assure.d.ts +35 -0
- package/dist/assure.d.ts.map +1 -1
- package/dist/assure.js +222 -1
- package/dist/assure.js.map +1 -1
- package/dist/capabilities-tool.d.ts +13 -0
- package/dist/capabilities-tool.d.ts.map +1 -1
- package/dist/capabilities-tool.js +64 -1
- package/dist/capabilities-tool.js.map +1 -1
- package/dist/check.d.ts +125 -10
- package/dist/check.d.ts.map +1 -1
- package/dist/check.js +706 -145
- package/dist/check.js.map +1 -1
- package/dist/cli.d.ts +23 -0
- package/dist/cli.d.ts.map +1 -1
- package/dist/cli.js +194 -10
- package/dist/cli.js.map +1 -1
- package/dist/contract-proof.d.ts +49 -0
- package/dist/contract-proof.d.ts.map +1 -0
- package/dist/contract-proof.js +128 -0
- package/dist/contract-proof.js.map +1 -0
- package/dist/contracts.d.ts +22 -0
- package/dist/contracts.d.ts.map +1 -0
- package/dist/contracts.js +134 -0
- package/dist/contracts.js.map +1 -0
- package/dist/diagnostics.d.ts +23 -0
- package/dist/diagnostics.d.ts.map +1 -0
- package/dist/diagnostics.js +9 -0
- package/dist/diagnostics.js.map +1 -0
- package/dist/diff-tool.d.ts +2 -0
- package/dist/diff-tool.d.ts.map +1 -1
- package/dist/diff-tool.js +1 -1
- package/dist/diff-tool.js.map +1 -1
- package/dist/docs-search.d.ts +8 -3
- package/dist/docs-search.d.ts.map +1 -1
- package/dist/docs-search.js +36 -15
- package/dist/docs-search.js.map +1 -1
- package/dist/doctor.d.ts +28 -2
- package/dist/doctor.d.ts.map +1 -1
- package/dist/doctor.js +173 -7
- package/dist/doctor.js.map +1 -1
- package/dist/examples.d.ts +1 -2
- package/dist/examples.d.ts.map +1 -1
- package/dist/examples.js +37 -16
- package/dist/examples.js.map +1 -1
- package/dist/fix-recipes.d.ts +12 -0
- package/dist/fix-recipes.d.ts.map +1 -0
- package/dist/fix-recipes.js +106 -0
- package/dist/fix-recipes.js.map +1 -0
- package/dist/init-agents.d.ts.map +1 -1
- package/dist/init-agents.js +60 -4
- package/dist/init-agents.js.map +1 -1
- package/dist/internal/source-facts.d.ts +15 -0
- package/dist/internal/source-facts.d.ts.map +1 -0
- package/dist/internal/source-facts.js +82 -0
- package/dist/internal/source-facts.js.map +1 -0
- package/dist/internal/typescript-import.d.ts +9 -0
- package/dist/internal/typescript-import.d.ts.map +1 -1
- package/dist/internal/typescript-import.js +38 -0
- package/dist/internal/typescript-import.js.map +1 -1
- package/dist/introspect.d.ts +6 -2
- package/dist/introspect.d.ts.map +1 -1
- package/dist/introspect.js +53 -4
- package/dist/introspect.js.map +1 -1
- package/dist/load.d.ts +6 -0
- package/dist/load.d.ts.map +1 -1
- package/dist/load.js.map +1 -1
- package/dist/manifest-tool.d.ts.map +1 -1
- package/dist/manifest-tool.js +14 -9
- package/dist/manifest-tool.js.map +1 -1
- package/dist/mcp-docs-tools.d.ts.map +1 -1
- package/dist/mcp-docs-tools.js +3 -0
- package/dist/mcp-docs-tools.js.map +1 -1
- package/dist/mcp-http.js +1 -1
- package/dist/mcp-root.d.ts +83 -0
- package/dist/mcp-root.d.ts.map +1 -0
- package/dist/mcp-root.js +221 -0
- package/dist/mcp-root.js.map +1 -0
- package/dist/mcp-run.d.ts.map +1 -1
- package/dist/mcp-run.js +18 -4
- package/dist/mcp-run.js.map +1 -1
- package/dist/mcp.d.ts +27 -4
- package/dist/mcp.d.ts.map +1 -1
- package/dist/mcp.js +358 -25
- package/dist/mcp.js.map +1 -1
- package/dist/project-path.d.ts +3 -0
- package/dist/project-path.d.ts.map +1 -0
- package/dist/project-path.js +36 -0
- package/dist/project-path.js.map +1 -0
- package/dist/replay.d.ts +12 -0
- package/dist/replay.d.ts.map +1 -0
- package/dist/replay.js +36 -0
- package/dist/replay.js.map +1 -0
- package/dist/rules/codes.d.ts +42 -0
- package/dist/rules/codes.d.ts.map +1 -0
- package/dist/rules/codes.js +52 -0
- package/dist/rules/codes.js.map +1 -0
- package/dist/rules/comment-markers.d.ts +10 -0
- package/dist/rules/comment-markers.d.ts.map +1 -0
- package/dist/rules/comment-markers.js +24 -0
- package/dist/rules/comment-markers.js.map +1 -0
- package/dist/rules/index.d.ts +31 -0
- package/dist/rules/index.d.ts.map +1 -0
- package/dist/rules/index.js +133 -0
- package/dist/rules/index.js.map +1 -0
- package/dist/rules/legacy.d.ts +7 -0
- package/dist/rules/legacy.d.ts.map +1 -0
- package/dist/rules/legacy.js +85 -0
- package/dist/rules/legacy.js.map +1 -0
- package/dist/rules/routes.d.ts +12 -0
- package/dist/rules/routes.d.ts.map +1 -0
- package/dist/rules/routes.js +142 -0
- package/dist/rules/routes.js.map +1 -0
- package/dist/rules/security.d.ts +10 -0
- package/dist/rules/security.d.ts.map +1 -0
- package/dist/rules/security.js +471 -0
- package/dist/rules/security.js.map +1 -0
- package/dist/search-terms.d.ts +2 -0
- package/dist/search-terms.d.ts.map +1 -1
- package/dist/search-terms.js +5 -1
- package/dist/search-terms.js.map +1 -1
- package/dist/types-search.d.ts +1 -2
- package/dist/types-search.d.ts.map +1 -1
- package/dist/types-search.js +33 -16
- package/dist/types-search.js.map +1 -1
- package/dist/verification.d.ts +9 -0
- package/dist/verification.d.ts.map +1 -1
- package/dist/verification.js +17 -1
- package/dist/verification.js.map +1 -1
- package/dist/work-graph.d.ts +123 -0
- package/dist/work-graph.d.ts.map +1 -0
- package/dist/work-graph.js +465 -0
- package/dist/work-graph.js.map +1 -0
- package/docs/examples.json +32 -2
- package/docs/llms-full.txt +906 -15
- package/docs/types.json +1682 -130
- package/package.json +34 -9
- package/src/assure-hydration.ts +606 -0
- package/src/assure.ts +316 -2
- package/src/capabilities-tool.ts +80 -1
- package/src/check.ts +873 -168
- package/src/cli.ts +198 -11
- package/src/contract-proof.ts +194 -0
- package/src/contracts.ts +157 -0
- package/src/diagnostics.ts +32 -0
- package/src/diff-tool.ts +1 -1
- package/src/docs-search.ts +45 -15
- package/src/doctor.ts +259 -8
- package/src/examples.ts +43 -15
- package/src/fix-recipes.ts +126 -0
- package/src/init-agents.ts +61 -4
- package/src/internal/source-facts.ts +133 -0
- package/src/internal/typescript-import.ts +29 -0
- package/src/introspect.ts +75 -6
- package/src/load.ts +6 -0
- package/src/manifest-tool.ts +16 -10
- package/src/mcp-docs-tools.ts +3 -0
- package/src/mcp-http.ts +1 -1
- package/src/mcp-root.ts +271 -0
- package/src/mcp-run.ts +19 -4
- package/src/mcp.ts +438 -32
- package/src/project-path.ts +36 -0
- package/src/replay.ts +44 -0
- package/src/rules/codes.ts +57 -0
- package/src/rules/comment-markers.ts +26 -0
- package/src/rules/index.ts +175 -0
- package/src/rules/legacy.ts +93 -0
- package/src/rules/routes.ts +157 -0
- package/src/rules/security.ts +505 -0
- package/src/search-terms.ts +9 -4
- package/src/types-search.ts +39 -15
- package/src/verification.ts +18 -1
- package/src/work-graph.ts +613 -0
package/dist/check.d.ts
CHANGED
|
@@ -16,7 +16,11 @@
|
|
|
16
16
|
* anything fails. Pure scanners (`scanFetchText`, `scanServerOnlyImports`) are unit-tested.
|
|
17
17
|
*/
|
|
18
18
|
import type { AssuranceConfig, AssuranceReport } from "@nifrajs/core/assurance";
|
|
19
|
+
import { type ProjectEvidenceSnapshot } from "@nifrajs/core/evidence";
|
|
20
|
+
import type * as TSApi from "typescript";
|
|
19
21
|
import type { CapabilityProjectReport } from "./capabilities-tool.js";
|
|
22
|
+
import { type Diagnostic } from "./diagnostics.js";
|
|
23
|
+
import { type SourceFacts } from "./internal/source-facts.js";
|
|
20
24
|
import { type TypeScriptApi } from "./internal/typescript-import.js";
|
|
21
25
|
import type { PipelineReport } from "./pipeline-report.js";
|
|
22
26
|
export interface SourceFinding {
|
|
@@ -57,9 +61,70 @@ export declare function codePositionMask(src: string): string;
|
|
|
57
61
|
* skipped too. */
|
|
58
62
|
export declare function scanFetchText(file: string, content: string, externalMounts?: readonly string[]): SourceFinding[];
|
|
59
63
|
/** Statically collect simple Nifra route registrations from source, without importing app code. */
|
|
60
|
-
export declare function scanStaticRouteText(file: string, content: string): StaticRouteFinding[];
|
|
61
|
-
/**
|
|
62
|
-
|
|
64
|
+
export declare function scanStaticRouteText(file: string, content: string, facts?: SourceFacts): StaticRouteFinding[];
|
|
65
|
+
/** Module-scope `const` initializers by name - the one binding form the SQL scanner resolves. */
|
|
66
|
+
type ModuleConsts = ReadonlyMap<string, TSApi.Expression>;
|
|
67
|
+
/** A name some other module exports, named exactly as the edge that reaches it writes it. */
|
|
68
|
+
interface ExportEdge {
|
|
69
|
+
readonly specifier: string;
|
|
70
|
+
readonly exported: string;
|
|
71
|
+
}
|
|
72
|
+
/**
|
|
73
|
+
* One module's provable module-scope bindings: its top-level `const` initializers plus the exact
|
|
74
|
+
* import/export edges this scan is allowed to follow.
|
|
75
|
+
*
|
|
76
|
+
* Everything absent from these maps stays unresolved, and an unresolved interpolation keeps flagging.
|
|
77
|
+
* That is the whole safety argument: resolution can only ever make this rule QUIETER, so a form the
|
|
78
|
+
* scan cannot prove must fall out as "unknown" rather than be guessed at. Deliberately absent:
|
|
79
|
+
* `export default`, `export let`/`var`, destructured or computed names, default and namespace imports,
|
|
80
|
+
* `export * as ns`, `require`, and dynamic `import()`.
|
|
81
|
+
*/
|
|
82
|
+
interface SqlModuleScope {
|
|
83
|
+
/** The module's identity - an absolute path from the loader, or the entry file's path as given. Keys
|
|
84
|
+
* the parsed-scope cache and the cycle guard, and is the base its own specifiers resolve against. */
|
|
85
|
+
readonly id: string;
|
|
86
|
+
readonly consts: ModuleConsts;
|
|
87
|
+
/** Local name bound by `import { X as local }` → the edge that provides it. */
|
|
88
|
+
readonly imports: ReadonlyMap<string, ExportEdge>;
|
|
89
|
+
/** Exported name → the local name it reads (`export { a as b }` → `b` → `a`). */
|
|
90
|
+
readonly localExports: ReadonlyMap<string, string>;
|
|
91
|
+
/** Exported name → another module's export (`export { a as b } from "./m"`). */
|
|
92
|
+
readonly reExports: ReadonlyMap<string, ExportEdge>;
|
|
93
|
+
/** `export * from "./m"` specifiers, in source order. */
|
|
94
|
+
readonly starExports: readonly string[];
|
|
95
|
+
}
|
|
96
|
+
/** A module's identity + source, as resolved from a specifier. `id` must be stable and absolute: it
|
|
97
|
+
* keys the parsed-scope cache, seeds the cycle guard, and is what the module's own relative specifiers
|
|
98
|
+
* resolve against. */
|
|
99
|
+
export interface SqlModuleSource {
|
|
100
|
+
readonly id: string;
|
|
101
|
+
readonly content: string;
|
|
102
|
+
}
|
|
103
|
+
/**
|
|
104
|
+
* Resolves a specifier written in the module `fromModule` to the target's identity + source, or
|
|
105
|
+
* `undefined` when it cannot be resolved, read, or proved to be in-project source.
|
|
106
|
+
*
|
|
107
|
+
* Injected rather than built in, for the same reason {@link ModuleResolver} is: it keeps
|
|
108
|
+
* {@link scanInterpolatedSql} pure and filesystem-free, so the resolution rules can be unit-tested
|
|
109
|
+
* against a virtual module graph. {@link createProjectSqlImports} is the on-disk implementation.
|
|
110
|
+
*/
|
|
111
|
+
export type SqlModuleLoader = (fromModule: string, specifier: string) => SqlModuleSource | undefined;
|
|
112
|
+
/** Cross-module resolution state for one run: the loader plus a parsed-scope cache, so a fragments
|
|
113
|
+
* module imported by fifty callers is read and parsed once. A cached `undefined` is a REFUSAL (the
|
|
114
|
+
* module did not parse), cached so it is not re-attempted. Build with {@link createSqlImports}. */
|
|
115
|
+
export interface SqlImports {
|
|
116
|
+
readonly load: SqlModuleLoader;
|
|
117
|
+
readonly scopes: Map<string, SqlModuleScope | undefined>;
|
|
118
|
+
}
|
|
119
|
+
export declare const createSqlImports: (load: SqlModuleLoader) => SqlImports;
|
|
120
|
+
/**
|
|
121
|
+
* Scan one file's text for SQL assembled by interpolation. Pure + line-accurate.
|
|
122
|
+
*
|
|
123
|
+
* `imports` opts into following a fragment `const` into another module. Without it the scan is
|
|
124
|
+
* same-file only, which is what the unit tests exercise and what any caller that has no module graph
|
|
125
|
+
* to offer gets. With it, only what {@link createProjectSqlImports} will hand back is followed.
|
|
126
|
+
*/
|
|
127
|
+
export declare function scanInterpolatedSql(file: string, content: string, ts: TypeScriptApi, imports?: SqlImports): SourceFinding[];
|
|
63
128
|
/**
|
|
64
129
|
* Collect interpolated-SQL findings across the project.
|
|
65
130
|
*
|
|
@@ -69,6 +134,22 @@ export declare function scanInterpolatedSql(file: string, content: string, ts: T
|
|
|
69
134
|
* answer a security rule must never give when it did not run.
|
|
70
135
|
*/
|
|
71
136
|
export declare function scanProjectSql(cwd: string): Promise<SourceFinding[] | undefined>;
|
|
137
|
+
/**
|
|
138
|
+
* The on-disk loader for cross-module `const` resolution, scoped to one project.
|
|
139
|
+
*
|
|
140
|
+
* Deliberately narrow, because every widening here is a way for a real finding to go quiet:
|
|
141
|
+
*
|
|
142
|
+
* - **Relative specifiers only.** A bare specifier names a dependency whose exports can change without
|
|
143
|
+
* this project changing, so "provably a `const` string" is not a property the project owns.
|
|
144
|
+
* - **Inside `cwd`, outside the ignored trees.** The resolved path is realpath'd and must still sit
|
|
145
|
+
* under the project root: a symlink pointing out of the tree is not source this scan reads. The
|
|
146
|
+
* `node_modules` / `dist` / build exclusions are the same ones the walk applies.
|
|
147
|
+
* - **Real source only.** A `.d.ts` carries no initializer, and a non-TS file is not parsed.
|
|
148
|
+
*
|
|
149
|
+
* A miss on any of those returns `undefined`, which leaves the name unresolved and the interpolation
|
|
150
|
+
* flagged - the pre-feature answer.
|
|
151
|
+
*/
|
|
152
|
+
export declare function createProjectSqlImports(cwd: string): SqlImports;
|
|
72
153
|
/** Scan one file's text for untyped `client("…")` calls. Pure + line-accurate. */
|
|
73
154
|
export declare function scanUntypedClient(file: string, content: string): SourceFinding[];
|
|
74
155
|
/** Flag an import of a specifier that no longer exists. Pure; matches the exact specifier or a subpath
|
|
@@ -77,10 +158,10 @@ export declare function scanRemovedImports(file: string, content: string): Sourc
|
|
|
77
158
|
/** Scan a route module for top-level server-only imports. Returns `[]` for non-route files (only
|
|
78
159
|
* `routes/` modules are browser-bundled, so a server-only import elsewhere is fine). Each finding carries
|
|
79
160
|
* the offending `specifier` so the diagnostic can render the `routeFile → specifier` chain. Pure. */
|
|
80
|
-
export declare function scanServerOnlyImports(file: string, content: string): ServerImportFinding[];
|
|
161
|
+
export declare function scanServerOnlyImports(file: string, content: string, facts?: SourceFacts): ServerImportFinding[];
|
|
81
162
|
/** Extract the static, non-type import specifiers from a module's source (the edges to follow/inspect).
|
|
82
163
|
* Mirrors {@link STATIC_IMPORT}, so `import type` + dynamic `import()` are already excluded. Pure. */
|
|
83
|
-
export declare function parseStaticImports(content: string): string[];
|
|
164
|
+
export declare function parseStaticImports(content: string, facts?: SourceFacts, file?: string): string[];
|
|
84
165
|
/** The server-only SINK an import specifier names directly (a `node:`/`bun:` builtin or a known
|
|
85
166
|
* server-only package), or `undefined` if it isn't a by-name sink. Pure - the label is the specifier
|
|
86
167
|
* itself (it's already the actionable name). */
|
|
@@ -111,7 +192,7 @@ export type ModuleReader = (absPath: string) => string | undefined;
|
|
|
111
192
|
* it's linear and cycle-free. `routeFile`/`routeContent` seed the walk; `resolve`/`read` supply the graph
|
|
112
193
|
* - pure given those, so it's unit-testable with a fake graph.
|
|
113
194
|
*/
|
|
114
|
-
export declare function walkServerOnlyChain(routeFile: string, routeContent: string, resolve: ModuleResolver, read: ModuleReader): readonly string[] | undefined;
|
|
195
|
+
export declare function walkServerOnlyChain(routeFile: string, routeContent: string, resolve: ModuleResolver, read: ModuleReader, facts?: SourceFacts): readonly string[] | undefined;
|
|
115
196
|
/**
|
|
116
197
|
* Resolve the FULL transitive server-only chain(s) for a route module, given a real fs-backed resolver +
|
|
117
198
|
* reader. For each of the route's top-level imports, if a precise transitive walk finds a sink, the
|
|
@@ -120,10 +201,10 @@ export declare function walkServerOnlyChain(routeFile: string, routeContent: str
|
|
|
120
201
|
* edge (`fallback: true`), never a fabricated chain. Returns one finding per offending top-level import,
|
|
121
202
|
* de-duplicated to the shortest chain per first-hop specifier. Non-route files yield `[]`.
|
|
122
203
|
*/
|
|
123
|
-
export declare function resolveServerOnlyChains(file: string, content: string, resolve: ModuleResolver, read: ModuleReader): TransitiveServerImportFinding[];
|
|
204
|
+
export declare function resolveServerOnlyChains(file: string, content: string, resolve: ModuleResolver, read: ModuleReader, facts?: SourceFacts): TransitiveServerImportFinding[];
|
|
124
205
|
/** Scan a backend module (one that calls `server(`) for handlers returning a raw `Response`, which collapses
|
|
125
206
|
* the typed client's `data` to `never`. Pure + line-accurate; returns `[]` for files with no `server(` call. */
|
|
126
|
-
export declare function scanResponseRoutes(file: string, content: string): SourceFinding[];
|
|
207
|
+
export declare function scanResponseRoutes(file: string, content: string, facts?: SourceFacts): SourceFinding[];
|
|
127
208
|
export declare function walkSource(cwd: string, visit: (rel: string, content: string) => void, opts?: {
|
|
128
209
|
readonly includeTests?: boolean;
|
|
129
210
|
}): Promise<void>;
|
|
@@ -148,11 +229,13 @@ export interface ManifestDriftFinding {
|
|
|
148
229
|
export declare function scanServerManifestDrift(cwd: string): Promise<ManifestDriftFinding[]>;
|
|
149
230
|
/** A single machine-readable check failure - the unit an agent (or CI) acts on. */
|
|
150
231
|
export interface CheckDiagnostic {
|
|
151
|
-
readonly rule:
|
|
232
|
+
readonly rule: string;
|
|
152
233
|
/** `error` fails the gate (a real contract break); `warning` is advisory - surfaced to the agent but
|
|
153
234
|
* does NOT fail `nifra check`, for patterns that are sometimes intentional (a route returning a raw
|
|
154
235
|
* `Response`, which silently drops the typed client to `data: never` but is valid for files/redirects). */
|
|
155
|
-
readonly severity: "error" | "warning";
|
|
236
|
+
readonly severity: "error" | "warning" | "info";
|
|
237
|
+
/** Stable diagnostic protocol code. The legacy `rule` remains for compatibility. */
|
|
238
|
+
readonly code?: string;
|
|
156
239
|
readonly file?: string;
|
|
157
240
|
readonly line?: number;
|
|
158
241
|
readonly message: string;
|
|
@@ -175,6 +258,8 @@ export interface CheckDiagnostic {
|
|
|
175
258
|
* edge rather than fabricating a deeper path - never a lie.
|
|
176
259
|
*/
|
|
177
260
|
readonly chain?: readonly string[];
|
|
261
|
+
readonly evidence?: readonly string[];
|
|
262
|
+
readonly verify?: string;
|
|
178
263
|
}
|
|
179
264
|
export interface CheckSuggestion {
|
|
180
265
|
readonly kind: "edit" | "command" | "manual";
|
|
@@ -188,7 +273,12 @@ export interface CheckSuggestion {
|
|
|
188
273
|
export interface CheckResult {
|
|
189
274
|
readonly ok: boolean;
|
|
190
275
|
readonly typecheck: "pass" | "fail" | "skipped";
|
|
276
|
+
/** Why `typecheck` is `"skipped"` (no tsconfig.json, typescript not installed, lints-only mode).
|
|
277
|
+
* Absent when the typecheck ran. Echoed in the human report so a skip is never a dim mystery. */
|
|
278
|
+
readonly typecheckNote?: string;
|
|
191
279
|
readonly diagnostics: readonly CheckDiagnostic[];
|
|
280
|
+
/** Normalized diagnostics with stable codes for agents and external renderers. */
|
|
281
|
+
readonly structuredDiagnostics?: readonly Diagnostic[];
|
|
192
282
|
/**
|
|
193
283
|
* Which bundler this app's phases run on, read statically from the config, and how nifra concluded
|
|
194
284
|
* it. Returned even when nothing is wrong: an agent reading this project has to know which plugin
|
|
@@ -200,6 +290,10 @@ export interface CheckResult {
|
|
|
200
290
|
* better-auth). Echoed here so `--json` / the MCP tool / the report can show what the typed-client scan
|
|
201
291
|
* deliberately skipped - a suppressed prefix stays auditable instead of silently hiding real drift. */
|
|
202
292
|
readonly externalMounts?: readonly string[];
|
|
293
|
+
/** Active per-rule overrides from `nifra.check.json` `rules`, echoed verbatim so a retagged or
|
|
294
|
+
* suppressed finding stays auditable in `--json`, the MCP tool, and the human report - config can
|
|
295
|
+
* lower (or raise) the gate, but never invisibly. */
|
|
296
|
+
readonly ruleOverrides?: Readonly<Record<string, RuleOverride>>;
|
|
203
297
|
/** Set only when the caller passed `maxDiagnostics` and there were more - `diagnostics` then holds the
|
|
204
298
|
* first `shown` of `total`. It caps the serialized size so the `nifra_check` MCP tool can't emit a
|
|
205
299
|
* message large enough to break the stdio transport; fix the shown diagnostics and re-run for the rest. */
|
|
@@ -225,6 +319,19 @@ export interface CheckAssuranceContext {
|
|
|
225
319
|
readonly routeAssurance?: AssuranceReport;
|
|
226
320
|
/** Static capability provenance, when the config declares a capabilities policy. */
|
|
227
321
|
readonly capability?: CapabilityProjectReport;
|
|
322
|
+
/** Canonical token-only evidence reused by manifest and other offline projections. */
|
|
323
|
+
readonly evidence?: ProjectEvidenceSnapshot;
|
|
324
|
+
}
|
|
325
|
+
/**
|
|
326
|
+
* One entry of `nifra.check.json` `rules`, keyed by legacy rule name (`response-route`) or stable
|
|
327
|
+
* NF- code (`NF-S002`) - one key retags the finding in both diagnostic views. `severity: "off"`
|
|
328
|
+
* drops the rule's findings; `ignore` drops findings whose file matches any of the globs. Overrides
|
|
329
|
+
* are applied centrally BEFORE `ok` is computed and echoed in the result and the human report -
|
|
330
|
+
* configuration can lower (or raise) the gate, but never invisibly.
|
|
331
|
+
*/
|
|
332
|
+
export interface RuleOverride {
|
|
333
|
+
readonly severity?: "error" | "warn" | "info" | "off";
|
|
334
|
+
readonly ignore?: readonly string[];
|
|
228
335
|
}
|
|
229
336
|
/** Run the three checks and assemble a structured, machine-readable result. The single source the CLI
|
|
230
337
|
* report, `--json`, and the MCP tool all render from. */
|
|
@@ -242,9 +349,17 @@ export declare function collectCheckResult(cwd: string, opts?: {
|
|
|
242
349
|
* time; when absent, they are computed here (unchanged standalone behavior). */
|
|
243
350
|
readonly assurance?: CheckAssuranceContext;
|
|
244
351
|
}): Promise<CheckResult>;
|
|
352
|
+
/**
|
|
353
|
+
* Render the human-readable check report as lines. Pure (no I/O, no cwd) so tests can assert
|
|
354
|
+
* report/exit-code parity: every diagnostic in `result.diagnostics` appears in the output, and the
|
|
355
|
+
* trailer states the error/advisory counts that produced `ok`.
|
|
356
|
+
*/
|
|
357
|
+
export declare function renderCheckReport(result: CheckResult): string[];
|
|
245
358
|
/** Run the full check; print a report (`--json` for machine output) and return whether it passed. */
|
|
246
359
|
export declare function runCheck(cwd: string, opts?: {
|
|
247
360
|
readonly json?: boolean;
|
|
248
361
|
readonly lintsOnly?: boolean;
|
|
362
|
+
readonly structured?: boolean;
|
|
249
363
|
}): Promise<boolean>;
|
|
364
|
+
export {};
|
|
250
365
|
//# sourceMappingURL=check.d.ts.map
|
package/dist/check.d.ts.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"check.d.ts","sourceRoot":"","sources":["../src/check.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAIH,OAAO,KAAK,EAAE,eAAe,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAA;
|
|
1
|
+
{"version":3,"file":"check.d.ts","sourceRoot":"","sources":["../src/check.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAIH,OAAO,KAAK,EAAE,eAAe,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAA;AAC/E,OAAO,EAAE,KAAK,uBAAuB,EAA2B,MAAM,wBAAwB,CAAA;AAE9F,OAAO,KAAK,KAAK,KAAK,MAAM,YAAY,CAAA;AACxC,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,wBAAwB,CAAA;AACrE,OAAO,EAAE,KAAK,UAAU,EAAc,MAAM,kBAAkB,CAAA;AAC9D,OAAO,EAAqB,KAAK,WAAW,EAAE,MAAM,4BAA4B,CAAA;AAChF,OAAO,EAA2B,KAAK,aAAa,EAAE,MAAM,iCAAiC,CAAA;AAG7F,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAA;AAO1D,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;CACzB;AACD;6GAC6G;AAC7G,MAAM,WAAW,mBAAoB,SAAQ,aAAa;IACxD,oGAAoG;IACpG,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;CAC3B;AAsCD,MAAM,WAAW,kBAAmB,SAAQ,aAAa;IACvD,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;CACtB;AA0LD;;;;;;;;;GASG;AACH,wBAAgB,aAAa,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAyCjD;AAED;;;8FAG8F;AAC9F,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAoCpD;AA8FD;;;;kBAIkB;AAClB,wBAAgB,aAAa,CAC3B,IAAI,EAAE,MAAM,EACZ,OAAO,EAAE,MAAM,EACf,cAAc,GAAE,SAAS,MAAM,EAAO,GACrC,aAAa,EAAE,CAkBjB;AAED,mGAAmG;AACnG,wBAAgB,mBAAmB,CACjC,IAAI,EAAE,MAAM,EACZ,OAAO,EAAE,MAAM,EACf,KAAK,CAAC,EAAE,WAAW,GAClB,kBAAkB,EAAE,CAOtB;AA0CD,iGAAiG;AACjG,KAAK,YAAY,GAAG,WAAW,CAAC,MAAM,EAAE,KAAK,CAAC,UAAU,CAAC,CAAA;AAEzD,6FAA6F;AAC7F,UAAU,UAAU;IAClB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;IAC1B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;CAC1B;AAED;;;;;;;;;GASG;AACH,UAAU,cAAc;IACtB;yGACqG;IACrG,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAA;IACnB,QAAQ,CAAC,MAAM,EAAE,YAAY,CAAA;IAC7B,+EAA+E;IAC/E,QAAQ,CAAC,OAAO,EAAE,WAAW,CAAC,MAAM,EAAE,UAAU,CAAC,CAAA;IACjD,iFAAiF;IACjF,QAAQ,CAAC,YAAY,EAAE,WAAW,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IAClD,gFAAgF;IAChF,QAAQ,CAAC,SAAS,EAAE,WAAW,CAAC,MAAM,EAAE,UAAU,CAAC,CAAA;IACnD,yDAAyD;IACzD,QAAQ,CAAC,WAAW,EAAE,SAAS,MAAM,EAAE,CAAA;CACxC;AA6DD;;sBAEsB;AACtB,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAA;IACnB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;CACzB;AAED;;;;;;;GAOG;AACH,MAAM,MAAM,eAAe,GAAG,CAAC,UAAU,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,KAAK,eAAe,GAAG,SAAS,CAAA;AAEpG;;mGAEmG;AACnG,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,IAAI,EAAE,eAAe,CAAA;IAC9B,QAAQ,CAAC,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,cAAc,GAAG,SAAS,CAAC,CAAA;CACzD;AAED,eAAO,MAAM,gBAAgB,GAAI,MAAM,eAAe,KAAG,UAGvD,CAAA;AAwWF;;;;;;GAMG;AACH,wBAAgB,mBAAmB,CACjC,IAAI,EAAE,MAAM,EACZ,OAAO,EAAE,MAAM,EACf,EAAE,EAAE,aAAa,EACjB,OAAO,CAAC,EAAE,UAAU,GACnB,aAAa,EAAE,CAkCjB;AAED;;;;;;;GAOG;AACH,wBAAsB,cAAc,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,EAAE,GAAG,SAAS,CAAC,CAStF;AAQD;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,uBAAuB,CAAC,GAAG,EAAE,MAAM,GAAG,UAAU,CAwB/D;AAQD,kFAAkF;AAClF,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,aAAa,EAAE,CAahF;AA+CD;0EAC0E;AAC1E,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,aAAa,EAAE,CAcjF;AAED;;qGAEqG;AACrG,wBAAgB,qBAAqB,CACnC,IAAI,EAAE,MAAM,EACZ,OAAO,EAAE,MAAM,EACf,KAAK,CAAC,EAAE,WAAW,GAClB,mBAAmB,EAAE,CAsBvB;AA+DD;sGACsG;AACtG,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,WAAW,EAAE,IAAI,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAEhG;AAED;;gDAEgD;AAChD,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAEpE;AAED;kGACkG;AAClG,MAAM,WAAW,6BAA8B,SAAQ,mBAAmB;IACxE;qFACiF;IACjF,QAAQ,CAAC,KAAK,EAAE,SAAS,MAAM,EAAE,CAAA;IACjC;sFACkF;IAClF,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAA;CAC3B;AAED;;+EAE+E;AAC/E,MAAM,MAAM,cAAc,GAAG,CAAC,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,KAAK,MAAM,GAAG,SAAS,CAAA;AACxF,sGAAsG;AACtG,MAAM,MAAM,YAAY,GAAG,CAAC,OAAO,EAAE,MAAM,KAAK,MAAM,GAAG,SAAS,CAAA;AAElE;;;;;;;;;GASG;AACH,wBAAgB,mBAAmB,CACjC,SAAS,EAAE,MAAM,EACjB,YAAY,EAAE,MAAM,EACpB,OAAO,EAAE,cAAc,EACvB,IAAI,EAAE,YAAY,EAClB,KAAK,CAAC,EAAE,WAAW,GAClB,SAAS,MAAM,EAAE,GAAG,SAAS,CA0C/B;AAED;;;;;;;GAOG;AACH,wBAAgB,uBAAuB,CACrC,IAAI,EAAE,MAAM,EACZ,OAAO,EAAE,MAAM,EACf,OAAO,EAAE,cAAc,EACvB,IAAI,EAAE,YAAY,EAClB,KAAK,CAAC,EAAE,WAAW,GAClB,6BAA6B,EAAE,CAkEjC;AAQD;gHACgH;AAChH,wBAAgB,kBAAkB,CAChC,IAAI,EAAE,MAAM,EACZ,OAAO,EAAE,MAAM,EACf,KAAK,CAAC,EAAE,WAAW,GAClB,aAAa,EAAE,CA6BjB;AA4CD,wBAAsB,UAAU,CAC9B,GAAG,EAAE,MAAM,EACX,KAAK,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,KAAK,IAAI,EAC7C,IAAI,GAAE;IAAE,QAAQ,CAAC,YAAY,CAAC,EAAE,OAAO,CAAA;CAAO,GAC7C,OAAO,CAAC,IAAI,CAAC,CAaf;AAKD,6DAA6D;AAC7D,wBAAsB,WAAW,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,EAAE,CAAC,CAIvE;AAgBD,MAAM,WAAW,oBAAoB;IACnC,4DAA4D;IAC5D,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,sGAAsG;IACtG,QAAQ,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAA;IACnC,8FAA8F;IAC9F,QAAQ,CAAC,KAAK,EAAE,SAAS,MAAM,EAAE,CAAA;CAClC;AAED;;;;;;;GAOG;AACH,wBAAsB,uBAAuB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,oBAAoB,EAAE,CAAC,CAgC1F;AAmFD,mFAAmF;AACnF,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB;;+GAE2G;IAC3G,QAAQ,CAAC,QAAQ,EAAE,OAAO,GAAG,SAAS,GAAG,MAAM,CAAA;IAC/C,oFAAoF;IACpF,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAA;IACtB,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAA;IACtB,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAA;IACtB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;IACxB;;uCAEmC;IACnC,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,CAAA;IACrB;wGACoG;IACpG,QAAQ,CAAC,UAAU,CAAC,EAAE,eAAe,CAAA;IACrC;;;;;;;;;;OAUG;IACH,QAAQ,CAAC,KAAK,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;IAClC,QAAQ,CAAC,QAAQ,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;IACrC,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CACzB;AAED,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,SAAS,GAAG,QAAQ,CAAA;IAC5C,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;IACtB,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAA;IACtB,yFAAyF;IACzF,QAAQ,CAAC,OAAO,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;IACpC,QAAQ,CAAC,KAAK,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;CACnC;AAED,2GAA2G;AAC3G,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,EAAE,EAAE,OAAO,CAAA;IACpB,QAAQ,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAAA;IAC/C;qGACiG;IACjG,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAA;IAC/B,QAAQ,CAAC,WAAW,EAAE,SAAS,eAAe,EAAE,CAAA;IAChD,kFAAkF;IAClF,QAAQ,CAAC,qBAAqB,CAAC,EAAE,SAAS,UAAU,EAAE,CAAA;IACtD;;;;;OAKG;IACH,QAAQ,CAAC,QAAQ,CAAC,EAAE,cAAc,CAAA;IAClC;;2GAEuG;IACvG,QAAQ,CAAC,cAAc,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;IAC3C;;yDAEqD;IACrD,QAAQ,CAAC,aAAa,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC,CAAA;IAC/D;;+GAE2G;IAC3G,QAAQ,CAAC,SAAS,CAAC,EAAE;QAAE,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAA;CACxE;AAED;;;;;GAKG;AACH,MAAM,WAAW,qBAAqB;IACpC,sGAAsG;IACtG,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAA;IACzB,kGAAkG;IAClG,QAAQ,CAAC,MAAM,CAAC,EAAE,eAAe,CAAA;IACjC,oGAAoG;IACpG,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO,CAAA;IACxB,oGAAoG;IACpG,QAAQ,CAAC,cAAc,CAAC,EAAE,eAAe,CAAA;IACzC,oFAAoF;IACpF,QAAQ,CAAC,UAAU,CAAC,EAAE,uBAAuB,CAAA;IAC7C,sFAAsF;IACtF,QAAQ,CAAC,QAAQ,CAAC,EAAE,uBAAuB,CAAA;CAC5C;AASD;;;;;;GAMG;AACH,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,QAAQ,CAAC,EAAE,OAAO,GAAG,MAAM,GAAG,MAAM,GAAG,KAAK,CAAA;IACrD,QAAQ,CAAC,MAAM,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;CACpC;AA0OD;yDACyD;AACzD,wBAAsB,kBAAkB,CACtC,GAAG,EAAE,MAAM,EACX,IAAI,GAAE;IACJ,QAAQ,CAAC,SAAS,CAAC,EAAE,OAAO,CAAA;IAC5B,QAAQ,CAAC,MAAM,CAAC,EAAE,WAAW,CAAA;IAC7B;8GAC0G;IAC1G,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAA;IAChC;uGACmG;IACnG,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,OAAO,CAAC,aAAa,GAAG,SAAS,CAAC,CAAA;IAClE;;oFAEgF;IAChF,QAAQ,CAAC,SAAS,CAAC,EAAE,qBAAqB,CAAA;CACtC,GACL,OAAO,CAAC,WAAW,CAAC,CAoqBtB;AAuBD;;;;GAIG;AACH,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,WAAW,GAAG,MAAM,EAAE,CAwG/D;AAED,qGAAqG;AACrG,wBAAsB,QAAQ,CAC5B,GAAG,EAAE,MAAM,EACX,IAAI,GAAE;IACJ,QAAQ,CAAC,IAAI,CAAC,EAAE,OAAO,CAAA;IACvB,QAAQ,CAAC,SAAS,CAAC,EAAE,OAAO,CAAA;IAC5B,QAAQ,CAAC,UAAU,CAAC,EAAE,OAAO,CAAA;CACzB,GACL,OAAO,CAAC,OAAO,CAAC,CAsClB"}
|