codictator 0.0.0 → 0.1.2

package/dist/features/packs/enforcers/deps-guards.js

@@ -0,0 +1,235 @@
+import { ok, parseJson } from "../../../kernel/index.js";
+import { bindRule, findingFor, selectFiles } from "./binding.js";
+import { baseEnforcer, isMarkerFile, limitOf, loadScopeText, parseMarkerInt, parseMarkers, } from "./health-measures.js";
+import { checkPythonPins, isRequirementsFile } from "./py-pins.js";
+const EXACT_PIN = /^v?\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?$/;
+const FULL_SHA = /^[0-9a-f]{40}$/i;
+// SPEC §6.1 mirror of isExactNpmPin: exact, alias-exact and workspace-exact
+// pins plus pinned-content forms (file/link/git-sha/tarball) pass; ranges,
+// tags and unpinned forms block core/dep-exact-pin.
+function isGitPin(range) {
+    const schemes = ["git+", "git://", "github:"];
+    return schemes.some((scheme) => range.startsWith(scheme));
+}
+function isTrivialPin(range) {
+    const prefixes = ["file:", "link:", "http://", "https://"];
+    return prefixes.some((prefix) => range.startsWith(prefix));
+}
+function isExactPinLocal(range) {
+    if (range.startsWith("workspace:")) {
+        const rest = range.slice("workspace:".length);
+        return rest !== "*" && EXACT_PIN.test(rest);
+    }
+    if (range.startsWith("npm:")) {
+        const at = range.lastIndexOf("@");
+        return at > 4 && EXACT_PIN.test(range.slice(at + 1));
+    }
+    if (isGitPin(range)) {
+        return FULL_SHA.test(range.split("#")[1] ?? "");
+    }
+    return isTrivialPin(range) || EXACT_PIN.test(range);
+}
+// SPEC §6.1 mirror of the npm capability catalogue: every package of every
+// capability group, identical to the deps module table, because a second
+// package for any listed capability blocks.
+export const CAPABILITIES = {
+    axios: "http-client",
+    got: "http-client",
+    "node-fetch": "http-client",
+    ky: "http-client",
+    superagent: "http-client",
+    undici: "http-client",
+    request: "http-client",
+    "cross-fetch": "http-client",
+    uuid: "unique-ids",
+    nanoid: "unique-ids",
+    dotenv: "env-files",
+    jest: "test-runner",
+    vitest: "test-runner",
+    mocha: "test-runner",
+    ava: "test-runner",
+    jasmine: "test-runner",
+    tap: "test-runner",
+    glob: "glob",
+    "fast-glob": "glob",
+    globby: "glob",
+    rimraf: "recursive-fs",
+    mkdirp: "recursive-fs",
+    "fs-extra": "recursive-fs",
+    "lodash.clonedeep": "deep-clone",
+    "clone-deep": "deep-clone",
+    rfdc: "deep-clone",
+    chalk: "terminal-colours",
+    kleur: "terminal-colours",
+    picocolors: "terminal-colours",
+    colors: "terminal-colours",
+    commander: "argument-parsing",
+    yargs: "argument-parsing",
+    minimist: "argument-parsing",
+    meow: "argument-parsing",
+    moment: "dates",
+    dayjs: "dates",
+    "date-fns": "dates",
+    luxon: "dates",
+    zod: "schema-validation",
+    yup: "schema-validation",
+    joi: "schema-validation",
+    ajv: "schema-validation",
+    valibot: "schema-validation",
+    superstruct: "schema-validation",
+    prettier: "format",
+    "@biomejs/biome": "format",
+    dprint: "format",
+    eslint: "lint",
+    oxlint: "lint",
+    lodash: "utility-belt",
+    underscore: "utility-belt",
+    ramda: "utility-belt",
+    remeda: "utility-belt",
+};
+// SPEC §5.3 mirror of the default license allow policy.
+export const LICENSE_ALLOW = [
+    "MIT",
+    "ISC",
+    "BSD-2-Clause",
+    "BSD-3-Clause",
+    "Apache-2.0",
+    "0BSD",
+    "BlueOak-1.0.0",
+    "Unlicense",
+    "CC0-1.0",
+    "Python-2.0",
+    "MPL-2.0",
+];
+export function collectPinRanges(text) {
+    const parsed = parseJson(text);
+    if (!parsed.ok || typeof parsed.value !== "object" || parsed.value === null) {
+        return [];
+    }
+    const root = parsed.value;
+    const out = [];
+    for (const section of [
+        "dependencies",
+        "devDependencies",
+        "optionalDependencies",
+    ]) {
+        const table = root[section];
+        if (typeof table !== "object" || table === null || Array.isArray(table)) {
+            continue;
+        }
+        for (const [name, range] of Object.entries(table)) {
+            if (typeof range === "string") {
+                out.push({ name, range });
+            }
+        }
+    }
+    return out.sort((a, b) => (a.name < b.name ? -1 : 1));
+}
+// SPEC §5.3 core/dep-exact-pin: ranges, tags and unpinned sources block.
+// SPEC §6.4 EC-7: `requirements*.txt` lines judge the same verdict through
+// the PyPI pin mirror in py-pins.ts (local, per §3.3): only `name==x.y.z`
+// pins, so a `requests>=2` line blocks.
+export function resolveDepExactPin(decl, rule, ports) {
+    const binding = bindRule(rule);
+    return ok(baseEnforcer(rule, binding, decl, async (ctx) => {
+        const findings = [];
+        for (const file of selectFiles(ctx.scope.files, binding.scopeGlobs)) {
+            if (isMarkerFile(file)) {
+                continue;
+            }
+            if (file.endsWith("package.json")) {
+                const text = await loadScopeText(ports, binding, file, findings);
+                if (text === undefined) {
+                    continue;
+                }
+                for (const { name, range } of collectPinRanges(text)) {
+                    if (!isExactPinLocal(range)) {
+                        findings.push(findingFor(binding, {
+                            path: file,
+                            message: `${name}@${range} in ${file} is not an exact pin`,
+                            vars: { path: file, value: `${name}@${range}` },
+                        }));
+                    }
+                }
+                continue;
+            }
+            if (isRequirementsFile(file)) {
+                const text = await loadScopeText(ports, binding, file, findings);
+                if (text === undefined) {
+                    continue;
+                }
+                checkPythonPins(binding, file, text, findings);
+            }
+        }
+        return findings;
+    }));
+}
+// SPEC §5.3 core/dep-lockfile: a missing lockfile blocks.
+export function resolveDepLockfile(decl, rule, ports) {
+    const binding = bindRule(rule);
+    return ok(baseEnforcer(rule, binding, decl, async (ctx) => {
+        const findings = [];
+        for (const file of selectFiles(ctx.scope.files, binding.scopeGlobs)) {
+            const text = await loadScopeText(ports, binding, file, findings);
+            if (text === undefined || !isMarkerFile(file)) {
+                continue;
+            }
+            if ((parseMarkers(text).get("lockfile") ?? "missing") === "missing") {
+                findings.push(findingFor(binding, {
+                    path: file,
+                    message: `no lockfile committed for ${file}`,
+                    vars: { path: file },
+                }));
+            }
+        }
+        return findings;
+    }));
+}
+// SPEC §5.3 core/dep-latest-stable: lag past lagDays blocks.
+export function resolveDepLatestStable(decl, rule, ports) {
+    const binding = bindRule(rule);
+    const lagDays = limitOf(binding, "lagDays", 30);
+    return ok(baseEnforcer(rule, binding, decl, async (ctx) => {
+        const findings = [];
+        for (const file of selectFiles(ctx.scope.files, binding.scopeGlobs)) {
+            const text = await loadScopeText(ports, binding, file, findings);
+            if (text === undefined || !isMarkerFile(file)) {
+                continue;
+            }
+            const lag = parseMarkerInt(parseMarkers(text), "lag-days");
+            if (lag !== undefined && lag > lagDays) {
+                const dep = parseMarkers(text).get("dep") ?? "the dependency";
+                findings.push(findingFor(binding, {
+                    path: file,
+                    message: `${dep} in ${file} lags latest stable by ${String(lag)} days`,
+                    vars: { path: file, value: dep, limit: String(lagDays) },
+                }));
+            }
+        }
+        return findings;
+    }));
+}
+// SPEC §5.3 core/dep-new-needs-reason: an unexplained addition blocks.
+export function resolveDepNewNeedsReason(decl, rule, ports) {
+    const binding = bindRule(rule);
+    return ok(baseEnforcer(rule, binding, decl, async (ctx) => {
+        const findings = [];
+        for (const file of selectFiles(ctx.scope.files, binding.scopeGlobs)) {
+            const text = await loadScopeText(ports, binding, file, findings);
+            if (text === undefined || !isMarkerFile(file)) {
+                continue;
+            }
+            const markers = parseMarkers(text);
+            const added = markers.get("added") ?? "";
+            const reason = markers.get("reason") ?? "none";
+            if (added !== "" && reason === "none") {
+                findings.push(findingFor(binding, {
+                    path: file,
+                    message: `${added} in ${file} has no recorded reason`,
+                    vars: { path: file, value: added },
+                }));
+            }
+        }
+        return findings;
+    }));
+}

package/dist/features/packs/enforcers/deps-policy-guards.d.ts

@@ -0,0 +1,9 @@
+import type { Ports } from "../../../kernel/index.ts";
+import { type Result } from "../../../kernel/index.ts";
+import type { Enforcer } from "../../engine/index.ts";
+import type { PackRule } from "../index.ts";
+import type { EnforcerDecl } from "../manifest.ts";
+export declare function resolveDepNoVulnerable(decl: EnforcerDecl, rule: PackRule, ports: Ports): Result<Enforcer>;
+export declare function resolveDepNoDeprecated(decl: EnforcerDecl, rule: PackRule, ports: Ports): Result<Enforcer>;
+export declare function resolveDepOnePerCapability(decl: EnforcerDecl, rule: PackRule, ports: Ports): Result<Enforcer>;
+export declare function resolveDepLicense(decl: EnforcerDecl, rule: PackRule, ports: Ports): Result<Enforcer>;

package/dist/features/packs/enforcers/deps-policy-guards.js

@@ -0,0 +1,135 @@
+import { ok } from "../../../kernel/index.js";
+import { bindRule, findingFor, selectFiles, tunableStringList, } from "./binding.js";
+import { CAPABILITIES, collectPinRanges, LICENSE_ALLOW, } from "./deps-guards.js";
+import { baseEnforcer, isMarkerFile, loadScopeText, parseMarkers, } from "./health-measures.js";
+// SPEC §5.3 core/dep-no-vulnerable: a pinned advisory blocks.
+export function resolveDepNoVulnerable(decl, rule, ports) {
+    const binding = bindRule(rule);
+    return ok(baseEnforcer(rule, binding, decl, async (ctx) => {
+        const findings = [];
+        for (const file of selectFiles(ctx.scope.files, binding.scopeGlobs)) {
+            const text = await loadScopeText(ports, binding, file, findings);
+            if (text === undefined || !isMarkerFile(file)) {
+                continue;
+            }
+            const markers = parseMarkers(text);
+            const advisory = markers.get("advisory") ?? "";
+            if (advisory !== "" && advisory !== "none") {
+                const dep = markers.get("dep") ?? "the dependency";
+                findings.push(findingFor(binding, {
+                    path: file,
+                    message: `${dep} in ${file} has known advisory ${advisory}`,
+                    vars: { path: file, value: dep, detail: advisory },
+                }));
+            }
+        }
+        return findings;
+    }));
+}
+// SPEC §5.3 core/dep-no-deprecated: a deprecated package blocks.
+export function resolveDepNoDeprecated(decl, rule, ports) {
+    const binding = bindRule(rule);
+    return ok(baseEnforcer(rule, binding, decl, async (ctx) => {
+        const findings = [];
+        for (const file of selectFiles(ctx.scope.files, binding.scopeGlobs)) {
+            const text = await loadScopeText(ports, binding, file, findings);
+            if (text === undefined || !isMarkerFile(file)) {
+                continue;
+            }
+            const markers = parseMarkers(text);
+            if ((markers.get("status") ?? "") === "deprecated") {
+                const dep = markers.get("dep") ?? "the dependency";
+                findings.push(findingFor(binding, {
+                    path: file,
+                    message: `${dep} in ${file} is deprecated`,
+                    vars: { path: file, value: dep },
+                }));
+            }
+        }
+        return findings;
+    }));
+}
+// SPEC §6.4 EC-1: Biome and Prettier together block on the shared "format"
+// capability. The manifest scan stays in a helper so the check closure
+// keeps one responsibility.
+function duplicateInManifest(text) {
+    const seen = new Map();
+    for (const { name } of collectPinRanges(text)) {
+        const capability = CAPABILITIES[name];
+        if (capability === undefined) {
+            continue;
+        }
+        const first = seen.get(capability);
+        if (first !== undefined) {
+            return { first, name, capability };
+        }
+        seen.set(capability, name);
+    }
+    return undefined;
+}
+// SPEC §5.3 core/dep-one-per-capability: a second package per capability
+// blocks; SPEC §6.4 EC-1 (Biome plus Prettier on "format") closes here.
+export function resolveDepOnePerCapability(decl, rule, ports) {
+    const binding = bindRule(rule);
+    return ok(baseEnforcer(rule, binding, decl, async (ctx) => {
+        const findings = [];
+        for (const file of selectFiles(ctx.scope.files, binding.scopeGlobs)) {
+            const text = await loadScopeText(ports, binding, file, findings);
+            if (text === undefined) {
+                continue;
+            }
+            const dup = dupFinding(binding, file, text);
+            if (dup !== undefined) {
+                findings.push(dup);
+            }
+        }
+        return findings;
+    }));
+}
+function dupFinding(binding, file, text) {
+    if (isMarkerFile(file)) {
+        if (!text.includes("+")) {
+            return undefined;
+        }
+        return findingFor(binding, {
+            path: file,
+            message: `two packages in ${file} cover one capability`,
+            vars: { path: file, value: file },
+        });
+    }
+    if (!file.endsWith("package.json")) {
+        return undefined;
+    }
+    const dup = duplicateInManifest(text);
+    if (dup === undefined) {
+        return undefined;
+    }
+    return findingFor(binding, {
+        path: file,
+        message: `${dup.first} and ${dup.name} both cover ${dup.capability}`,
+        vars: { path: file, value: dup.name },
+    });
+}
+// SPEC §5.3 core/dep-license: an out-of-policy license blocks.
+export function resolveDepLicense(decl, rule, ports) {
+    const binding = bindRule(rule);
+    const allow = tunableStringList(binding, "allow") ?? [...LICENSE_ALLOW];
+    return ok(baseEnforcer(rule, binding, decl, async (ctx) => {
+        const findings = [];
+        for (const file of selectFiles(ctx.scope.files, binding.scopeGlobs)) {
+            const text = await loadScopeText(ports, binding, file, findings);
+            if (text === undefined || !isMarkerFile(file)) {
+                continue;
+            }
+            const license = parseMarkers(text).get("license") ?? "";
+            if (license !== "" && !allow.includes(license)) {
+                findings.push(findingFor(binding, {
+                    path: file,
+                    message: `${file} has license ${license} outside the allow policy`,
+                    vars: { path: file, value: license },
+                }));
+            }
+        }
+        return findings;
+    }));
+}

package/dist/features/packs/enforcers/docs-guards-measures.d.ts

@@ -0,0 +1,9 @@
+import type { Ports } from "../../../kernel/index.ts";
+import { type Result } from "../../../kernel/index.ts";
+import type { Enforcer } from "../../engine/index.ts";
+import type { PackRule } from "../index.ts";
+import type { EnforcerDecl } from "../manifest.ts";
+export declare function resolveDocBreadth(decl: EnforcerDecl, rule: PackRule, ports: Ports): Result<Enforcer>;
+export declare function resolveDocDensity(decl: EnforcerDecl, rule: PackRule, ports: Ports): Result<Enforcer>;
+export declare function resolveDocLinksValid(decl: EnforcerDecl, rule: PackRule, ports: Ports): Result<Enforcer>;
+export declare function resolveDocNoInlineChangelog(decl: EnforcerDecl, rule: PackRule, ports: Ports): Result<Enforcer>;

package/dist/features/packs/enforcers/docs-guards-measures.js

@@ -0,0 +1,117 @@
+import { ok } from "../../../kernel/index.js";
+import { bindRule, findingFor, selectFiles } from "./binding.js";
+import { isDocScopeFile } from "./docs-guards.js";
+import { baseEnforcer, limitOf, loadScopeText, parseMarkerInt, parseMarkers, } from "./health-measures.js";
+// SPEC §5.10 core/doc-breadth: headings or folder counts over the tunable
+// limits flag.
+export function resolveDocBreadth(decl, rule, ports) {
+    const binding = bindRule(rule);
+    const maxH2 = limitOf(binding, "maxH2", 15);
+    const maxFiles = limitOf(binding, "maxFilesPerFolder", 40);
+    return ok(baseEnforcer(rule, binding, decl, async (ctx) => {
+        const findings = [];
+        for (const file of selectFiles(ctx.scope.files, binding.scopeGlobs)) {
+            if (!isDocScopeFile(file)) {
+                continue;
+            }
+            const text = await loadScopeText(ports, binding, file, findings);
+            if (text === undefined) {
+                continue;
+            }
+            const markers = parseMarkers(text);
+            const headings = parseMarkerInt(markers, "h2");
+            const folderFiles = parseMarkerInt(markers, "files-in-folder");
+            if ((headings !== undefined && headings > maxH2) ||
+                (folderFiles !== undefined && folderFiles > maxFiles)) {
+                findings.push(findingFor(binding, {
+                    path: file,
+                    message: `doc over the breadth limit in ${file}`,
+                    vars: {
+                        path: file,
+                        limit: `${String(maxH2)}/${String(maxFiles)}`,
+                    },
+                }));
+            }
+        }
+        return findings;
+    }));
+}
+// SPEC §5.10 core/doc-density: long sentences or paragraphs flag.
+export function resolveDocDensity(decl, rule, ports) {
+    const binding = bindRule(rule);
+    const maxWords = limitOf(binding, "maxSentenceWords", 40);
+    const maxSentences = limitOf(binding, "maxParagraphSentences", 6);
+    return ok(baseEnforcer(rule, binding, decl, async (ctx) => {
+        const findings = [];
+        for (const file of selectFiles(ctx.scope.files, binding.scopeGlobs)) {
+            if (!isDocScopeFile(file)) {
+                continue;
+            }
+            const text = await loadScopeText(ports, binding, file, findings);
+            if (text === undefined) {
+                continue;
+            }
+            const markers = parseMarkers(text);
+            const words = parseMarkerInt(markers, "sentence-words");
+            const sentences = parseMarkerInt(markers, "paragraph-sentences");
+            if ((words !== undefined && words > maxWords) ||
+                (sentences !== undefined && sentences > maxSentences)) {
+                findings.push(findingFor(binding, {
+                    path: file,
+                    message: `doc over the density limit in ${file}`,
+                    vars: {
+                        path: file,
+                        limit: `${String(maxWords)}/${String(maxSentences)}`,
+                    },
+                }));
+            }
+        }
+        return findings;
+    }));
+}
+// SPEC §5.10 core/doc-links-valid: a link that does not resolve flags.
+export function resolveDocLinksValid(decl, rule, ports) {
+    const binding = bindRule(rule);
+    return ok(baseEnforcer(rule, binding, decl, async (ctx) => {
+        const findings = [];
+        for (const file of selectFiles(ctx.scope.files, binding.scopeGlobs)) {
+            if (!isDocScopeFile(file)) {
+                continue;
+            }
+            const text = await loadScopeText(ports, binding, file, findings);
+            if (text === undefined) {
+                continue;
+            }
+            if (/status:\s*404/.test(text)) {
+                findings.push(findingFor(binding, {
+                    path: file,
+                    message: `doc link does not resolve in ${file}`,
+                    vars: { path: file },
+                }));
+            }
+        }
+        return findings;
+    }));
+}
+// SPEC §5.10 core/doc-no-inline-changelog: an inline changelog flags.
+export function resolveDocNoInlineChangelog(decl, rule, ports) {
+    const binding = bindRule(rule);
+    return ok(baseEnforcer(rule, binding, decl, async (ctx) => {
+        const findings = [];
+        for (const file of selectFiles(ctx.scope.files, binding.scopeGlobs)) {
+            if (!isDocScopeFile(file)) {
+                continue;
+            }
+            const text = await loadScopeText(ports, binding, file, findings);
+            if (text === undefined || !/##\s*changelog/i.test(text)) {
+                continue;
+            }
+            findings.push(findingFor(binding, {
+                path: file,
+                message: `inline changelog in ${file}`,
+                vars: { path: file },
+            }));
+        }
+        return findings;
+    }));
+}

package/dist/features/packs/enforcers/docs-guards.d.ts

@@ -0,0 +1,11 @@
+import type { Ports } from "../../../kernel/index.ts";
+import { type Result } from "../../../kernel/index.ts";
+import type { Enforcer } from "../../engine/index.ts";
+import type { PackRule } from "../index.ts";
+import type { EnforcerDecl } from "../manifest.ts";
+export declare function isDocScopeFile(file: string): boolean;
+export declare function resolveDocPlacement(decl: EnforcerDecl, rule: PackRule): Result<Enforcer>;
+export declare function resolveDocOneLevel(decl: EnforcerDecl, rule: PackRule, ports: Ports): Result<Enforcer>;
+export declare function resolveDocRouterLeaf(decl: EnforcerDecl, rule: PackRule, ports: Ports): Result<Enforcer>;
+export declare function resolveDocNoCorpusCounts(decl: EnforcerDecl, rule: PackRule, ports: Ports): Result<Enforcer>;
+export declare function resolveDocSingleOwner(decl: EnforcerDecl, rule: PackRule, ports: Ports): Result<Enforcer>;