@westbayberry/dg 2.1.0 → 2.3.0

package/dist/verify/package-check.js

@@ -3,10 +3,11 @@ import { resolve } from "node:path";
 import { analyzePackages, AnalyzeError } from "../api/analyze.js";
 import { createTheme } from "../presentation/theme.js";
 import { provenanceLabel, provenanceDowngradeLine } from "../presentation/provenance.js";
+import { packagePageUrl } from "../presentation/package-page.js";
 import { resolvePresentation } from "../presentation/mode.js";
 import { isRemotePackageSpec, isSupportedLockfilePath } from "./preflight.js";
 import { authStatus } from "../auth/store.js";
-import { EXIT_TOOL_ERROR, EXIT_UNAVAILABLE } from "../commands/types.js";
+import { EXIT_TOOL_ERROR, EXIT_UNAVAILABLE, EXIT_USAGE_VERDICT } from "../commands/types.js";
 const REGISTRIES = { npm: "npm", pypi: "pypi" };
 const DEEP_VERIFY_HINT = "deep verify supports npm and pypi: dg verify npm:<package> or pypi:<package>";
 function parseSpec(target) {
@@ -38,10 +39,10 @@ function parseSpec(target) {
     const version = rest.slice(at + separator.length).trim() || null;
     return { ecosystem, name, version };
 }
-async function resolveLatest(ecosystem, name, fetchImpl) {
+export async function resolveLatest(ecosystem, name, fetchImpl) {
     try {
         if (ecosystem === "npm") {
-            const response = await fetchImpl(`https://registry.npmjs.org/${name.replace("/", "%2F")}`);
+            const response = await fetchImpl(`https://registry.npmjs.org/${encodeNpmPackagePath(name)}`);
             if (!response.ok) {
                 return null;
             }
@@ -59,24 +60,31 @@ async function resolveLatest(ecosystem, name, fetchImpl) {
         return null;
     }
 }
+function provenanceLines(version, result, theme, withPredicate) {
+    if (!result.provenance) {
+        return [];
+    }
+    const label = withPredicate && result.provenance.predicateType
+        ? `provenance ${provenanceLabel(result.provenance)} · ${result.provenance.predicateType}`
+        : `provenance ${provenanceLabel(result.provenance)}`;
+    const lines = [`  ${theme.paint("muted", label)}`];
+    const downgrade = provenanceDowngradeLine(version, result.provenance);
+    if (downgrade) {
+        lines.push(`  ${theme.paint("warn", `⚠ ${downgrade}`)}`);
+    }
+    return lines;
+}
+function reasonGlyph(action, theme) {
+    return action === "block" ? theme.paint("block", "✘") : action === "warn" ? theme.paint("warn", "⚠") : theme.paint("muted", "·");
+}
 function renderResult(spec, version, result, theme, verbose) {
     const action = result.action ?? "pass";
     const badge = theme.badge(action);
     const lines = [`${badge}  ${result.name}@${version} (${spec.ecosystem})  ${theme.paint("muted", `score ${result.score}`)}`];
-    if (result.provenance) {
-        const label = verbose && result.provenance.predicateType
-            ? `provenance ${provenanceLabel(result.provenance)} · ${result.provenance.predicateType}`
-            : `provenance ${provenanceLabel(result.provenance)}`;
-        lines.push(`  ${theme.paint("muted", label)}`);
-        const downgrade = provenanceDowngradeLine(version, result.provenance);
-        if (downgrade) {
-            lines.push(`  ${theme.paint("warn", `⚠ ${downgrade}`)}`);
-        }
-    }
+    lines.push(...provenanceLines(version, result, theme, verbose));
     const reasons = verbose ? result.reasons : result.reasons.slice(0, 6);
     for (const reason of reasons) {
-        const glyph = action === "block" ? theme.paint("block", "✘") : action === "warn" ? theme.paint("warn", "⚠") : theme.paint("muted", "·");
-        lines.push(`  ${glyph} ${reason}`);
+        lines.push(`  ${reasonGlyph(action, theme)} ${reason}`);
     }
     if (!verbose && result.reasons.length > reasons.length) {
         lines.push(`  ${theme.paint("muted", `… ${result.reasons.length - reasons.length} more — rerun with --verbose`)}`);
@@ -92,8 +100,43 @@ function renderResult(spec, version, result, theme, verbose) {
     if (result.recommendation) {
         lines.push(`  ${theme.paint("muted", result.recommendation)}`);
     }
+    const page = packagePageUrl(spec.ecosystem, result.name);
+    if (page) {
+        lines.push(`  ${theme.paint("muted", `→ ${page}`)}`);
+    }
     return `${lines.join("\n")}\n`;
 }
+const FREE_REASON_CAP = 3;
+const FREE_SCANS_FOOTER_THRESHOLD = 5_000;
+function renderFreeResult(spec, version, result, theme, freeScansRemaining) {
+    const action = result.action ?? "pass";
+    const lines = [`${theme.badge(action)}  ${result.name}@${version} (${spec.ecosystem})`];
+    lines.push(...provenanceLines(version, result, theme, false));
+    if (action === "pass") {
+        lines.push(`  ${theme.paint("muted", result.reasons[0] ?? "no risk signals")}`);
+    }
+    else {
+        const reasons = result.reasons.slice(0, FREE_REASON_CAP);
+        for (const reason of reasons) {
+            lines.push(`  ${reasonGlyph(action, theme)} ${reason}`);
+        }
+        if (result.reasons.length > reasons.length) {
+            lines.push(`  ${theme.paint("muted", `… ${result.reasons.length - reasons.length} more — sign in to see all:`)} ${theme.paint("accent", "dg login")}`);
+        }
+    }
+    const page = packagePageUrl(spec.ecosystem, result.name);
+    if (page) {
+        lines.push(`  ${theme.paint("muted", `→ ${page}`)}`);
+    }
+    lines.push(`  ${theme.paint("muted", "full findings, license, JSON output:")} ${theme.paint("accent", "dg login")}`);
+    if (freeScansRemaining !== undefined && freeScansRemaining < FREE_SCANS_FOOTER_THRESHOLD) {
+        lines.push(`  ${theme.paint("muted", `${freeScansRemaining.toLocaleString()} free package checks left this month`)}`);
+    }
+    return `${lines.join("\n")}\n`;
+}
+function encodeNpmPackagePath(name) {
+    return name.split("/").map((segment) => encodeURIComponent(segment)).join("%2f");
+}
 function exitCodeFor(action) {
     if (action === "block") {
         return 2;
@@ -109,39 +152,41 @@ function exitCodeFor(action) {
 export async function runPackageCheck(target, io = {}, options = {}) {
     const fetchImpl = io.fetchImpl ?? fetch;
     const theme = createTheme(resolvePresentation().color);
-    if (!authStatus(io.env).authenticated) {
-        const accent = (text) => theme.paint("accent", text);
-        const muted = (text) => theme.paint("muted", text);
+    const accent = (text) => theme.paint("accent", text);
+    const muted = (text) => theme.paint("muted", text);
+    const authenticated = authStatus(io.env).authenticated;
+    if (!authenticated && (options.format === "json" || options.outputPath)) {
         return {
             exitCode: EXIT_UNAVAILABLE,
             stdout: "",
-            stderr: `\n  ${theme.paint("warn", "⚠")} Checking a package before you install it requires ${accent("sign-in")}.\n` +
+            stderr: `\n  ${theme.paint("warn", "⚠")} ${muted("--json and --output for registry checks require sign-in.")}\n` +
                 `  ${accent("dg login")}${muted("  ·  see plans at")} ${accent("westbayberry.com/pricing")}\n\n`
         };
     }
     const parsed = parseSpec(target);
     if (parsed === null) {
         return {
-            exitCode: 2,
+            exitCode: EXIT_USAGE_VERDICT,
             stdout: "",
             stderr: `dg verify: add a registry, e.g. dg verify npm:${target} or dg verify pypi:${target}\n`
         };
     }
     if ("error" in parsed) {
-        return { exitCode: 2, stdout: "", stderr: `dg verify: ${parsed.error}\n` };
+        return { exitCode: EXIT_USAGE_VERDICT, stdout: "", stderr: `dg verify: ${parsed.error}\n` };
     }
     let version = parsed.version;
     if (!version) {
         version = await resolveLatest(parsed.ecosystem, parsed.name, fetchImpl);
         if (!version) {
             return {
-                exitCode: 1,
+                exitCode: exitCodeFor("analysis_incomplete"),
                 stdout: "",
                 stderr: `dg verify: could not resolve the latest version of ${parsed.name} on ${parsed.ecosystem}\n`
             };
         }
     }
     let result;
+    let freeScansRemaining;
     try {
         const response = await analyzePackages([{ name: parsed.name, version }], {
             ecosystem: parsed.ecosystem,
@@ -149,15 +194,26 @@ export async function runPackageCheck(target, io = {}, options = {}) {
             ...(io.env ? { env: io.env } : {})
         });
         result = response.packages.find((entry) => entry.name === parsed.name) ?? response.packages[0];
+        freeScansRemaining = response.freeScansRemaining;
     }
     catch (error) {
+        if (error instanceof AnalyzeError && error.code === "quota_exceeded") {
+            const loginLine = authenticated ? "" : `  ${muted("Run")} ${accent("dg login")} ${muted("to connect your account.")}\n`;
+            return {
+                exitCode: exitCodeFor("analysis_incomplete"),
+                stdout: "",
+                stderr: `dg verify: ${error.message}\n${loginLine}  ${muted("see plans at")} ${accent("westbayberry.com/pricing")}\n`
+            };
+        }
         const message = error instanceof AnalyzeError ? error.message : error instanceof Error ? error.message : "could not reach the scanner";
-        return { exitCode: 1, stdout: "", stderr: `dg verify: ${message}\n` };
+        return { exitCode: exitCodeFor("analysis_incomplete"), stdout: "", stderr: `dg verify: ${message}\n` };
     }
     if (!result) {
-        return { exitCode: 1, stdout: "", stderr: `dg verify: scanner returned no result for ${parsed.name}\n` };
+        return { exitCode: exitCodeFor("analysis_incomplete"), stdout: "", stderr: `dg verify: scanner returned no result for ${parsed.name}\n` };
     }
-    const action = result.action ?? "pass";
+    // A missing per-package action means the scanner did not return a verdict;
+    // treat that as incomplete, never as a clean pass.
+    const action = result.action ?? "analysis_incomplete";
     const rendered = options.format === "json"
         ? `${JSON.stringify({
             target,
@@ -171,7 +227,9 @@ export async function runPackageCheck(target, io = {}, options = {}) {
             ...(result.provenance ? { provenance: result.provenance } : {}),
             ...(result.recommendation ? { recommendation: result.recommendation } : {})
         }, null, 2)}\n`
-        : renderResult(parsed, version, result, theme, options.verbose ?? false);
+        : authenticated
+            ? renderResult(parsed, version, result, theme, options.verbose ?? false)
+            : renderFreeResult(parsed, version, result, theme, freeScansRemaining);
     if (options.outputPath) {
         try {
             writeFileSync(resolve(options.outputPath), rendered, "utf8");
@@ -248,20 +306,20 @@ export async function maybeVerifyPackage(args) {
     if (outputFlagMissingPath) {
         return {
             handled: true,
-            result: { exitCode: 2, stdout: "", stderr: `dg verify: ${outputFlagMissingPath} requires a path. Run 'dg verify --help'.\n` }
+            result: { exitCode: EXIT_USAGE_VERDICT, stdout: "", stderr: `dg verify: ${outputFlagMissingPath} requires a path. Run 'dg verify --help'.\n` }
         };
     }
     if (unknownFlag) {
         return {
             handled: true,
-            result: { exitCode: 2, stdout: "", stderr: `dg verify: unknown option '${unknownFlag}'. Run 'dg verify --help'.\n` }
+            result: { exitCode: EXIT_USAGE_VERDICT, stdout: "", stderr: `dg verify: unknown option '${unknownFlag}'. Run 'dg verify --help'.\n` }
         };
     }
     if (sarif) {
         return {
             handled: true,
             result: {
-                exitCode: 2,
+                exitCode: EXIT_USAGE_VERDICT,
                 stdout: "",
                 stderr: "dg verify: --sarif applies to local artifacts and lockfiles; registry package checks support --json.\n"
             }