dsh-better-display 0.3.7 → 0.3.9

package/scripts/check-bundle-size.mjs

@@ -0,0 +1,38 @@
+import { existsSync, statSync } from 'node:fs';
+import { resolve } from 'node:path';
+
+/**
+ * Fresh tsdown host bundle. The previously committed file omitted flags, log,
+ * and metrics, which the entry already imports, so CI's rebuild is this size.
+ */
+export const BASELINE_BYTES = 18503;
+export const BUDGET_BYTES = Math.floor(BASELINE_BYTES * 1.1);
+
+export function judgeBundle(size, budget = BUDGET_BYTES) {
+  if (size > budget) return { code: 1, message: `bundle exceeds budget: ${size} > ${budget}` };
+  return { code: 0, message: `lib/dsh-better-display.js ${size} bytes; budget ${budget} (baseline ${BASELINE_BYTES} + 10%).` };
+}
+
+export function reportBundle(file) {
+  if (!existsSync(file)) {
+    return { code: 0, message: `skip: ${file} is absent. Run npm run build before measuring the bundle.` };
+  }
+  return judgeBundle(statSync(file).size);
+}
+
+function selfTest() {
+  const over = judgeBundle(BUDGET_BYTES + 1);
+  const under = judgeBundle(BASELINE_BYTES);
+  const skipped = reportBundle(resolve(import.meta.dirname, 'no-such-bundle.js'));
+  if (BUDGET_BYTES !== 20353 || over.code !== 1 || under.code !== 0 || skipped.code !== 0 || !skipped.message.startsWith('skip:')) {
+    console.error('check-bundle-size self-test failed', { over, under, skipped, BUDGET_BYTES });
+    process.exit(1);
+  }
+  console.log('check-bundle-size self-test passed');
+}
+
+if (process.argv.includes('--self-test')) selfTest();
+
+const result = reportBundle(resolve(import.meta.dirname, '../lib/dsh-better-display.js'));
+console.log(result.message);
+process.exit(result.code);

package/scripts/check-dead-flags.mjs

@@ -0,0 +1,55 @@
+/** Fail when a flags.json key never appears under src. FLAGS_JSON and FLAGS_SRC override paths. */
+import { readdirSync, readFileSync, statSync } from 'node:fs';
+import { join, resolve } from 'node:path';
+
+const root = resolve(import.meta.dirname, '..');
+const flagsPath = process.env.FLAGS_JSON ? resolve(process.env.FLAGS_JSON) : join(root, 'flags.json');
+const srcDir = process.env.FLAGS_SRC ? resolve(process.env.FLAGS_SRC) : join(root, 'src');
+
+function fail(message) {
+  console.error(message);
+  process.exit(1);
+}
+
+function sourceFiles(dir) {
+  const found = [];
+  for (const entry of readdirSync(dir)) {
+    if (entry === 'node_modules' || entry === 'lib') continue;
+    const path = join(dir, entry);
+    const stat = statSync(path);
+    if (stat.isDirectory()) found.push(...sourceFiles(path));
+    else if (/\.(?:[cm]?[jt]s|tsx|jsx)$/.test(entry)) found.push(path);
+  }
+  return found;
+}
+
+function referenced(haystack, key) {
+  const pattern = new RegExp(`\\b${key.replace(/[.*+?^${}()|[\]\\]/g, '\\$&')}\\b`);
+  return pattern.test(haystack);
+}
+
+let flags;
+try {
+  flags = JSON.parse(readFileSync(flagsPath, 'utf8'));
+} catch (err) {
+  fail(`Cannot read feature flags from ${flagsPath}: ${err instanceof Error ? err.message : String(err)}`);
+}
+
+if (flags === null || typeof flags !== 'object' || Array.isArray(flags)) {
+  fail('flags.json must be an object of feature flags');
+}
+
+const keys = Object.keys(flags);
+if (keys.length === 0 || keys.some(key => key.trim() === '')) fail('flags.json has no usable keys');
+
+let sources;
+try {
+  sources = sourceFiles(srcDir).map(path => readFileSync(path, 'utf8')).join('\n');
+} catch (err) {
+  fail(`Cannot scan ${srcDir} for feature flag usage: ${err instanceof Error ? err.message : String(err)}`);
+}
+
+const unused = keys.filter(key => !referenced(sources, key));
+if (unused.length > 0) fail(`Unused feature flags: ${unused.join(', ')}`);
+
+console.log(`All ${keys.length} flags.json keys are referenced under src.`);

package/scripts/check-todo-debt.mjs

@@ -0,0 +1,69 @@
+import { readdir, readFile } from 'node:fs/promises';
+import path from 'node:path';
+
+const root = path.resolve(process.argv[2] ?? process.cwd());
+const skipDirs = new Set([
+  'node_modules',
+  'lib',
+  '.git',
+  'artifacts',
+  '.evidence',
+  '.delivery',
+  'coverage',
+  'report',
+  'dist'
+]);
+const extensions = new Set([
+  '.ts',
+  '.tsx',
+  '.mts',
+  '.cts',
+  '.mjs',
+  '.cjs',
+  '.js',
+  '.jsx',
+  '.md',
+  '.yml',
+  '.yaml',
+  '.css',
+  '.json',
+  '.html'
+]);
+
+const marker = new RegExp(String.raw`\b(?:${'TO' + 'DO'}|${'FIX' + 'ME'})\b`);
+const issueId = /#\d+/;
+
+async function walk(directory, hits) {
+  const entries = await readdir(directory, { withFileTypes: true });
+  for (const entry of entries) {
+    if (entry.isDirectory()) {
+      if (skipDirs.has(entry.name)) continue;
+      if (entry.name.startsWith('.') && entry.name !== '.github') continue;
+      await walk(path.join(directory, entry.name), hits);
+      continue;
+    }
+    if (!entry.isFile() || !extensions.has(path.extname(entry.name))) continue;
+    const file = path.join(directory, entry.name);
+    let text;
+    try {
+      text = await readFile(file, 'utf8');
+    } catch {
+      continue;
+    }
+    const lines = text.split(/\r?\n/);
+    for (let index = 0; index < lines.length; index += 1) {
+      const line = lines[index];
+      if (!marker.test(line) || issueId.test(line)) continue;
+      hits.push(`${path.relative(root, file)}:${index + 1}: ${line.trim()}`);
+    }
+  }
+}
+
+const hits = [];
+await walk(root, hits);
+if (hits.length > 0) {
+  console.error(`TODO/FIXME without an issue id (#123): ${hits.length}`);
+  for (const hit of hits) console.error(hit);
+  process.exit(1);
+}
+console.log('todo debt: ok');

package/scripts/security-audit-report.mjs

@@ -0,0 +1,92 @@
+import { spawnSync } from 'node:child_process';
+import { appendFileSync } from 'node:fs';
+import { fileURLToPath } from 'node:url';
+
+export function isAuditReport(report) {
+  return Boolean(report && !report.error && report.metadata?.vulnerabilities);
+}
+
+export function formatAuditError(report, stderr) {
+  const summary = report?.error?.summary || report?.error?.detail || stderr || 'npm audit failed';
+  return [
+    '## npm audit',
+    '',
+    'npm audit did not return a vulnerability report. Nothing was filled in as a clean result.',
+    '',
+    '```',
+    String(summary).slice(0, 8000),
+    '```',
+  ].join('\n');
+}
+
+export function formatAudit(report) {
+  const counts = report?.metadata?.vulnerabilities ?? {};
+  const vulns = report?.vulnerabilities ?? {};
+  const lines = [
+    '## npm audit',
+    '',
+    `Total ${counts.total ?? 'unknown'}: critical ${counts.critical ?? 0}, high ${counts.high ?? 0}, moderate ${counts.moderate ?? 0}, low ${counts.low ?? 0}, info ${counts.info ?? 0}.`,
+    '',
+    '| Package | Severity | Fix |',
+    '| --- | --- | --- |',
+  ];
+  for (const [name, info] of Object.entries(vulns)) {
+    const fix = info?.fixAvailable === true ? 'yes' : info?.fixAvailable ? 'yes' : 'no';
+    lines.push(`| ${name} | ${info?.severity ?? 'unknown'} | ${fix} |`);
+  }
+  if (Object.keys(vulns).length === 0) lines.push('| (none) |  |  |');
+  lines.push('', '<details>', '<summary>npm audit JSON</summary>', '', '```json');
+  const json = JSON.stringify(report, null, 2);
+  lines.push(json.length > 100000 ? `${json.slice(0, 100000)}\n… truncated` : json);
+  lines.push('```', '', '</details>');
+  return lines.join('\n');
+}
+
+function writeSummary(text) {
+  const summary = process.env.GITHUB_STEP_SUMMARY;
+  if (!summary) {
+    console.log('GITHUB_STEP_SUMMARY is unset; the report was printed here only.');
+    return;
+  }
+  appendFileSync(summary, `${text}\n`);
+  console.log(`Wrote the npm audit report to ${summary}`);
+}
+
+function selfTest() {
+  const text = formatAudit({
+    metadata: { vulnerabilities: { info: 0, low: 1, moderate: 0, high: 0, critical: 0, total: 1 } },
+    vulnerabilities: { example: { severity: 'low', fixAvailable: false } },
+  });
+  const enolock = { error: { code: 'ENOLOCK', summary: 'This command requires an existing lockfile.' } };
+  if (!text.includes('| example | low | no |') || !text.includes('```json') || isAuditReport(enolock) || !isAuditReport({ metadata: { vulnerabilities: { total: 0 } } })) {
+    console.error('security-audit-report self-test failed');
+    process.exit(1);
+  }
+  console.log('security-audit-report self-test passed');
+}
+
+if (process.argv.includes('--self-test')) selfTest();
+
+const root = fileURLToPath(new URL('..', import.meta.url));
+const result = spawnSync('npm', ['audit', '--json'], {
+  cwd: root,
+  encoding: 'utf8',
+  maxBuffer: 32 * 1024 * 1024,
+});
+const stdout = result.stdout ?? '';
+let report;
+try {
+  report = JSON.parse(stdout);
+} catch {
+  report = undefined;
+}
+if (!isAuditReport(report)) {
+  const failure = formatAuditError(report, result.stderr || stdout || result.error?.message || 'npm audit produced no output');
+  console.log(failure);
+  writeSummary(failure);
+  process.exit(1);
+}
+
+const text = formatAudit(report);
+console.log(text);
+writeSummary(text);