codictator 0.0.0-stage → 0.1.2

package/dist/builtin-packs/typescript/pack.json

@@ -0,0 +1,169 @@
+{
+	"id": "typescript",
+	"version": "0.0.0",
+	"description": "Codictator TypeScript/JavaScript built-in pack (SPEC §6.1).",
+	"rules": [
+		{
+			"id": "ts/typecheck",
+			"family": "TS",
+			"tier": "floor",
+			"statement": "The repo's tsc --noEmit passes.",
+			"reason": "Type errors break the assumptions every other check makes.",
+			"remediation": "Fix the type error at {path}:{line}.",
+			"enforcer": "ts/typecheck",
+			"triggers": ["review"],
+			"scope": [],
+			"params": {},
+			"ratchet": false,
+			"measureVersion": 1,
+			"fixtures": { "violating": ["basic"], "passing": ["basic"] }
+		},
+		{
+			"id": "ts/lint",
+			"family": "TS",
+			"tier": "floor",
+			"statement": "The repo's linter passes on scope.",
+			"reason": "Lint drift accumulates into unreadable code.",
+			"remediation": "Fix the lint finding at {path}:{line}.",
+			"enforcer": "ts/lint",
+			"triggers": ["post-tool", "review"],
+			"scope": [],
+			"params": {},
+			"ratchet": false,
+			"measureVersion": 1,
+			"fixtures": { "violating": ["basic"], "passing": ["basic"] }
+		},
+		{
+			"id": "ts/no-phantom-import",
+			"family": "TS",
+			"tier": "floor",
+			"statement": "Bare imports resolve to a declared dependency, a Node built-in, or a host-provided module (SPEC §6.4 EC-11).",
+			"reason": "Phantom imports install hallucinated packages.",
+			"remediation": "Declare {value} in {path} or fix the import.",
+			"enforcer": "ts/no-phantom-import",
+			"triggers": ["pre-tool", "review"],
+			"scope": [],
+			"params": {},
+			"ratchet": false,
+			"measureVersion": 1,
+			"fixtures": {
+				"violating": ["basic", "host-provided"],
+				"passing": ["basic", "host-provided"]
+			}
+		},
+		{
+			"id": "ts/security-patterns",
+			"family": "TS",
+			"tier": "floor",
+			"statement": "No dangerous JS patterns: eval, Function, exec with templates, innerHTML, document.write, dangerouslySetInnerHTML, rejectUnauthorized false, raw SQL.",
+			"reason": "These patterns are injection sinks.",
+			"remediation": "Remove the pattern at {path}:{line}; use the safe alternative.",
+			"enforcer": "ts/security-patterns",
+			"triggers": ["pre-tool", "review"],
+			"scope": [],
+			"params": {},
+			"ratchet": false,
+			"measureVersion": 1,
+			"fixtures": { "violating": ["basic"], "passing": ["basic"] }
+		}
+	],
+	"enforcers": [
+		{
+			"id": "ts/lint",
+			"kind": "code",
+			"budgetMs": 1000,
+			"args": {}
+		},
+		{
+			"id": "ts/no-phantom-import",
+			"kind": "code",
+			"module": "arch",
+			"budgetMs": 1000,
+			"args": { "hostProvided": { "packages/vscode": ["vscode"] } }
+		},
+		{
+			"id": "ts/security-patterns",
+			"kind": "code",
+			"budgetMs": 1000,
+			"args": {}
+		},
+		{
+			"id": "ts/typecheck",
+			"kind": "code",
+			"budgetMs": 1000,
+			"args": {}
+		}
+	],
+	"drivers": [],
+	"extractors": [],
+	"measures": [],
+	"capabilities": [
+		{
+			"name": "HTTP client",
+			"packages": [
+				"axios",
+				"got",
+				"node-fetch",
+				"ky",
+				"superagent",
+				"undici",
+				"request",
+				"cross-fetch"
+			],
+			"platform": ["fetch"]
+		},
+		{
+			"name": "Unique ids",
+			"packages": ["uuid", "nanoid"],
+			"platform": ["crypto.randomUUID"]
+		},
+		{
+			"name": "Env files",
+			"packages": ["dotenv"],
+			"platform": ["node --env-file"]
+		},
+		{
+			"name": "Test runner",
+			"packages": ["jest", "vitest", "mocha", "ava", "jasmine", "tap"],
+			"platform": ["node:test"]
+		},
+		{
+			"name": "Glob",
+			"packages": ["glob", "fast-glob", "globby"],
+			"platform": ["fs.glob"]
+		},
+		{
+			"name": "Recursive fs",
+			"packages": ["rimraf", "mkdirp", "fs-extra"],
+			"platform": ["fs.rm", "fs.mkdir", "fs.cp"]
+		},
+		{
+			"name": "Deep clone",
+			"packages": ["lodash.clonedeep", "clone-deep", "rfdc"],
+			"platform": ["structuredClone"]
+		},
+		{
+			"name": "Terminal colours",
+			"packages": ["chalk", "kleur", "picocolors", "colors"],
+			"platform": ["util.styleText"]
+		},
+		{
+			"name": "Argument parsing",
+			"packages": ["commander", "yargs", "minimist", "meow"],
+			"platform": ["util.parseArgs"]
+		},
+		{ "name": "Dates", "packages": ["moment", "dayjs", "date-fns", "luxon"] },
+		{
+			"name": "Schema validation",
+			"packages": ["zod", "yup", "joi", "ajv", "valibot", "superstruct"]
+		},
+		{ "name": "Lint", "packages": ["eslint", "@biomejs/biome", "oxlint"] },
+		{ "name": "Format", "packages": ["prettier", "@biomejs/biome", "dprint"] },
+		{
+			"name": "Utility belt",
+			"packages": ["lodash", "underscore", "ramda", "remeda"]
+		}
+	],
+	"assets": [],
+	"maxWaiverDays": 90
+}

package/dist/builtin-packs/typescript/patterns.ts

@@ -0,0 +1,93 @@
+// SPEC §6.1 patterns: assertion tokens, skip markers and suppressions for
+// the testing-integrity guards (`core/no-assertion-loss`,
+// `core/no-skipped-tests`, `core/no-new-suppressions`). Assertion and skip
+// counts run over blanked code so comments never inflate them; suppressions
+// are comment directives, so they scan the raw lines instead.
+import { blankCode, lineAtIndex, lineStartsFor } from "./lex.ts";
+
+// SPEC §6.1: `assert.`, `assert(`, `expect(`, `.should`, `t.assert`.
+export const ASSERTION_TOKENS: ReadonlyArray<string> = [
+	"assert.",
+	"assert(",
+	"expect(",
+	".should",
+	"t.assert",
+];
+
+// SPEC §6.1: `.skip(`, `.only(`, `.todo(`, `xit(`, `xdescribe(`, `fit(`,
+// `fdescribe(`, `{ skip: true }`, `{ only: true }`.
+export const SKIP_MARKERS: ReadonlyArray<string> = [
+	".skip(",
+	".only(",
+	".todo(",
+	"xit(",
+	"xdescribe(",
+	"fit(",
+	"fdescribe(",
+	"skip: true",
+	"only: true",
+];
+
+// SPEC §6.1: lint, type, coverage and analyser suppressions.
+export const SUPPRESSION_TOKENS: ReadonlyArray<string> = [
+	"eslint-disable",
+	"biome-ignore",
+	"oxlint-disable",
+	"@ts-ignore",
+	"@ts-expect-error",
+	"@ts-nocheck",
+	"istanbul ignore",
+	"c8 ignore",
+	"v8 ignore",
+];
+
+function countToken(code: string, token: string): number {
+	let count = 0;
+	let index = code.indexOf(token);
+	while (index >= 0) {
+		count += 1;
+		index = code.indexOf(token, index + token.length);
+	}
+	return count;
+}
+
+export function countAssertions(text: string): number {
+	const code = blankCode(text);
+	let total = 0;
+	for (const token of ASSERTION_TOKENS) {
+		total += countToken(code, token);
+	}
+	return total;
+}
+
+export interface TextMark {
+	readonly line: number;
+	readonly marker: string;
+}
+
+export function findSkipMarkers(text: string): Array<TextMark> {
+	const code = blankCode(text);
+	const starts = lineStartsFor(text);
+	const marks: Array<TextMark> = [];
+	for (const marker of SKIP_MARKERS) {
+		let index = code.indexOf(marker);
+		while (index >= 0) {
+			marks.push({ line: lineAtIndex(starts, index), marker });
+			index = code.indexOf(marker, index + marker.length);
+		}
+	}
+	return marks.sort((a, b) => a.line - b.line);
+}
+
+export function findSuppressions(text: string): Array<TextMark> {
+	const starts = lineStartsFor(text);
+	const marks: Array<TextMark> = [];
+	for (const token of SUPPRESSION_TOKENS) {
+		let index = text.indexOf(token);
+		while (index >= 0) {
+			marks.push({ line: lineAtIndex(starts, index), marker: token });
+			index = text.indexOf(token, index + token.length);
+		}
+	}
+	return marks.sort((a, b) => a.line - b.line);
+}

package/dist/builtin-packs/typescript/resolve.ts

@@ -0,0 +1,224 @@
+// SPEC §6.1 + §4.11.3: resolution for the import extractor. Relative
+// paths, nearest-tsconfig `paths`/`baseUrl`, `package.json`
+// `exports`/`imports` and workspaces; bare specifiers resolve against the
+// declared dependencies, and Node built-ins are never phantom (§6.4 EC-4).
+// Everything here is pure string work over caller-supplied manifests, so the
+// supplies stay usable from fake-port tests without touching the network.
+
+// A snapshot of the Node built-in modules (both `fs` and `node:fs` spellings
+// count; the `node:` prefix alone is sufficient below).
+const BARE_BUILTINS: ReadonlyArray<string> = [
+	"assert",
+	"async_hooks",
+	"buffer",
+	"child_process",
+	"cluster",
+	"console",
+	"constants",
+	"crypto",
+	"dgram",
+	"diagnostics_channel",
+	"dns",
+	"domain",
+	"events",
+	"fs",
+	"http",
+	"http2",
+	"https",
+	"inspector",
+	"module",
+	"net",
+	"os",
+	"path",
+	"perf_hooks",
+	"process",
+	"punycode",
+	"querystring",
+	"readline",
+	"repl",
+	"stream",
+	"string_decoder",
+	"sys",
+	"timers",
+	"tls",
+	"trace_events",
+	"tty",
+	"url",
+	"util",
+	"v8",
+	"vm",
+	"wasi",
+	"worker_threads",
+	"zlib",
+];
+
+// SPEC §6.4 EC-4: a built-in, never phantom.
+export function isBuiltinSpecifier(spec: string): boolean {
+	if (spec.startsWith("node:")) {
+		return true;
+	}
+	const base = spec.split("/", 1)[0] ?? "";
+	return BARE_BUILTINS.includes(base);
+}
+
+export function isRelativeSpecifier(spec: string): boolean {
+	return (
+		spec.startsWith("./") ||
+		spec.startsWith("../") ||
+		spec.startsWith("/") ||
+		spec === "." ||
+		spec === ".."
+	);
+}
+
+export function isBareSpecifier(spec: string): boolean {
+	return !isRelativeSpecifier(spec) && !isBuiltinSpecifier(spec);
+}
+
+function isLocalRecord(value: unknown): value is Record<string, unknown> {
+	return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+
+function recordField(record: Record<string, unknown>, name: string): unknown {
+	return record[name];
+}
+
+// Declared names are the union of runtime and development dependencies plus
+// optional ones; `peerDependencies` and `engines` are compatibility (§6.1).
+export function collectDeclaredNames(manifest: unknown): Set<string> {
+	const names = new Set<string>();
+	if (!isLocalRecord(manifest)) {
+		return names;
+	}
+	for (const section of [
+		"dependencies",
+		"devDependencies",
+		"optionalDependencies",
+	]) {
+		const entries = recordField(manifest, section);
+		if (isLocalRecord(entries)) {
+			for (const name of Object.keys(entries)) {
+				names.add(name);
+			}
+		}
+	}
+	return names;
+}
+
+// SPEC §6.4 EC-5: a workspace sibling declared as `workspace:*` (or any
+// `workspace:` range) is allowed, never phantom.
+export function isWorkspaceAllowed(spec: string, manifest: unknown): boolean {
+	if (!isLocalRecord(manifest)) {
+		return false;
+	}
+	for (const section of [
+		"dependencies",
+		"devDependencies",
+		"optionalDependencies",
+	]) {
+		const entries = recordField(manifest, section);
+		if (!isLocalRecord(entries)) {
+			continue;
+		}
+		const version = recordField(entries, spec);
+		if (typeof version === "string" && version.startsWith("workspace:")) {
+			return true;
+		}
+	}
+	return false;
+}
+
+// A bare import is phantom when it is neither built-in nor declared.
+export function isPhantomSpecifier(
+	spec: string,
+	declared: ReadonlySet<string>,
+): boolean {
+	if (!isBareSpecifier(spec)) {
+		return false;
+	}
+	const base = spec.startsWith("@")
+		? spec.split("/", 2).join("/")
+		: (spec.split("/", 1)[0] ?? "");
+	return !declared.has(base);
+}
+
+// Lexical `.`/`..` collapsing over posix segments; never touches the disk.
+export function normalizeImportPath(path: string): string {
+	const absolute = path.startsWith("/");
+	const parts = path.split("/");
+	const kept: Array<string> = [];
+	for (const part of parts) {
+		if (part === "" || part === ".") {
+			continue;
+		}
+		if (part === "..") {
+			if (kept.length > 0) {
+				kept.pop();
+			}
+			continue;
+		}
+		kept.push(part);
+	}
+	const joined = kept.join("/");
+	return absolute ? `/${joined}` : joined;
+}
+
+function parentDir(path: string): string {
+	const slash = path.lastIndexOf("/");
+	if (slash < 0) {
+		return ".";
+	}
+	if (slash === 0) {
+		return "/";
+	}
+	return path.slice(0, slash);
+}
+
+// Relative resolution against the importing file, separators normalised.
+export function resolveRelativeSpecifier(
+	fromPath: string,
+	spec: string,
+): string {
+	const base = parentDir(fromPath);
+	const joined = base === "." ? spec : `${base}/${spec}`;
+	return normalizeImportPath(joined);
+}
+
+// Minimal `paths` support: exact keys first, then one single-`*` pattern
+// each, longest prefix wins; the caller supplies the nearest tsconfig.
+export function matchTsPaths(
+	spec: string,
+	paths: Readonly<Record<string, ReadonlyArray<string>>>,
+	baseUrl: string,
+): string | undefined {
+	const exact = paths[spec];
+	if (exact !== undefined && exact.length > 0) {
+		const first = exact[0] ?? "";
+		return normalizeImportPath(baseUrl === "." ? first : `${baseUrl}/${first}`);
+	}
+	let best: string | undefined;
+	let bestLength = -1;
+	for (const key of Object.keys(paths)) {
+		const star = key.indexOf("*");
+		if (star < 0) {
+			continue;
+		}
+		const prefix = key.slice(0, star);
+		const suffix = key.slice(star + 1);
+		if (!spec.startsWith(prefix) || !spec.endsWith(suffix)) {
+			continue;
+		}
+		if (prefix.length + suffix.length <= bestLength) {
+			continue;
+		}
+		const middle = spec.slice(prefix.length, spec.length - suffix.length);
+		const targets = paths[key] ?? [];
+		const target = targets[0] ?? "";
+		const mapped = target.split("*").join(middle);
+		best = normalizeImportPath(
+			baseUrl === "." ? mapped : `${baseUrl}/${mapped}`,
+		);
+		bestLength = prefix.length + suffix.length;
+	}
+	return best;
+}

package/dist/builtin-packs/typescript/strict.ts

@@ -0,0 +1,177 @@
+// SPEC §6.1 `core/compiler-strict`: every `tsconfig*.json` used by a build
+// or test carries the strict flags; JavaScript projects add `allowJs` plus
+// `checkJs` with the same flags. `extends` chains resolve to an effective
+// set (§6.4 EC-2) and a JS repo without TypeScript proposes it (§6.4 EC-9).
+import { parseJson } from "../../kernel/index.ts";
+
+// The ten flags SPEC §6.1 requires on every TypeScript project.
+export const TYPESCRIPT_STRICT_FLAGS: ReadonlyArray<string> = [
+	"strict",
+	"noUncheckedIndexedAccess",
+	"exactOptionalPropertyTypes",
+	"noImplicitOverride",
+	"noImplicitReturns",
+	"noFallthroughCasesInSwitch",
+	"noUnusedLocals",
+	"noUnusedParameters",
+	"useUnknownInCatchVariables",
+	"forceConsistentCasingInFileNames",
+];
+
+const EXTENDS_DEPTH_LIMIT = 10;
+
+function isLocalRecord(value: unknown): value is Record<string, unknown> {
+	return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+
+function recordField(record: Record<string, unknown>, name: string): unknown {
+	return record[name];
+}
+
+function readOptions(manifest: unknown): Record<string, unknown> {
+	if (!isLocalRecord(manifest)) {
+		return {};
+	}
+	const options = recordField(manifest, "compilerOptions");
+	if (!isLocalRecord(options)) {
+		return {};
+	}
+	return { ...options };
+}
+
+function parentDir(path: string): string {
+	const slash = path.lastIndexOf("/");
+	if (slash < 0) {
+		return ".";
+	}
+	if (slash === 0) {
+		return "/";
+	}
+	return path.slice(0, slash);
+}
+
+function joinDir(dir: string, spec: string): string {
+	if (spec.startsWith("/")) {
+		return spec;
+	}
+	const parts = (dir === "." ? [] : dir.split("/")).concat(spec.split("/"));
+	const kept: Array<string> = [];
+	for (const part of parts) {
+		if (part === "" || part === ".") {
+			continue;
+		}
+		if (part === "..") {
+			kept.pop();
+			continue;
+		}
+		kept.push(part);
+	}
+	return kept.join("/");
+}
+
+// Follows relative `extends` only; a bare package base (for example a shared
+// preset) stops the chain instead of reaching the network. Cycles and absurd
+// depths stop too, and the innermost file wins each key.
+export function resolveEffectiveOptions(
+	entryPath: string,
+	files: Readonly<Record<string, string>>,
+): Record<string, unknown> {
+	const seen = new Set<string>();
+	const chain: Array<Record<string, unknown>> = [];
+	let current: string | undefined = entryPath;
+	let depth = 0;
+	while (current !== undefined && depth < EXTENDS_DEPTH_LIMIT) {
+		if (seen.has(current)) {
+			break;
+		}
+		seen.add(current);
+		const text = files[current];
+		if (text === undefined) {
+			break;
+		}
+		const parsed = parseJson(text);
+		if (!parsed.ok || !isLocalRecord(parsed.value)) {
+			break;
+		}
+		chain.push(readOptions(parsed.value));
+		const parent = recordField(parsed.value, "extends");
+		if (typeof parent !== "string") {
+			break;
+		}
+		if (!parent.startsWith(".")) {
+			break;
+		}
+		const withJson = parent.endsWith(".json") ? parent : `${parent}.json`;
+		current = joinDir(parentDir(current), withJson);
+		depth += 1;
+	}
+	const merged: Record<string, unknown> = {};
+	for (let index = chain.length - 1; index >= 0; index -= 1) {
+		const options = chain[index] ?? {};
+		for (const key of Object.keys(options)) {
+			merged[key] = options[key];
+		}
+	}
+	return merged;
+}
+
+// Every required flag must be exactly `true`; `false` and absent both fail.
+export function missingStrictFlags(
+	options: Readonly<Record<string, unknown>>,
+): Array<string> {
+	return TYPESCRIPT_STRICT_FLAGS.filter((flag) => options[flag] !== true);
+}
+
+function hasExtension(
+	names: ReadonlyArray<string>,
+	extensions: ReadonlyArray<string>,
+): boolean {
+	return names.some((name) => {
+		const lowered = name.toLowerCase();
+		return extensions.some((extension) => lowered.endsWith(extension));
+	});
+}
+
+// SPEC §6.4 EC-9: a repo with JavaScript sources but no TypeScript sources
+// owes `checkJs` (with the strict flags) and a TypeScript dev dependency.
+export function isJavaScriptOnlyRepo(
+	fileNames: ReadonlyArray<string>,
+): boolean {
+	const scriptSources = [".ts", ".tsx", ".mts", ".cts"];
+	const javaSources = [".js", ".jsx", ".mjs", ".cjs"];
+	return (
+		!hasExtension(fileNames, scriptSources) &&
+		hasExtension(fileNames, javaSources)
+	);
+}
+
+export function missingCheckJsFlags(
+	options: Readonly<Record<string, unknown>>,
+): Array<string> {
+	const missing: Array<string> = [];
+	const allowKey = "allowJs";
+	const checkKey = "checkJs";
+	const allowJs: unknown = options[allowKey];
+	const checkJs: unknown = options[checkKey];
+	if (allowJs !== true) {
+		missing.push("allowJs");
+	}
+	if (checkJs !== true) {
+		missing.push("checkJs");
+	}
+	for (const flag of missingStrictFlags(options)) {
+		missing.push(flag);
+	}
+	return missing;
+}
+
+export function proposesTypescript(manifest: unknown): boolean {
+	if (!isLocalRecord(manifest)) {
+		return true;
+	}
+	const dev = recordField(manifest, "devDependencies");
+	if (!isLocalRecord(dev)) {
+		return true;
+	}
+	return recordField(dev, "typescript") === undefined;
+}