dungbeetle 0.1.1

package/dist/check/parsers.js

@@ -0,0 +1,278 @@
+// Tool-parser registry for the check kind.
+//
+// A check target runs a tool that reports on the shape of an application
+// (routes, scheduled jobs, environment) and snapshots the normalized result.
+// Each parser turns one tool's JSON output into a stable **keyed record** —
+// entries keyed by identity (e.g. "GET|HEAD /users") rather than array index —
+// so the structural diff names exactly the added/removed/changed entry instead
+// of reporting every index shift. Adding a tool is one parser object plus one
+// registry line here.
+import { isRecord } from "../guards.js";
+import { parseJUnit } from "./junit.js";
+import { parseSchemaDump } from "./schema.js";
+// Tool output is attacker-controlled in CI (a hostile PR names a test class or
+// source file). Reject the keys that would let `obj[key] ??= {}` reach back
+// into Object.prototype and pollute it globally.
+function isUnsafeKey(key) {
+    return key === "__proto__" || key === "constructor" || key === "prototype";
+}
+// Accumulator whose keys come from attacker-controlled tool output. A plain `{}`
+// inherits Object.prototype members (toString, valueOf, hasOwnProperty, …), so a
+// suite/file/message named `toString` makes `obj[key]` resolve to the inherited
+// function — non-nullish — and `obj[key] ??= {}` then skips the assignment and
+// writes onto the shared prototype instead of the snapshot, silently dropping the
+// entry. A null-prototype object has no inherited keys, so every key behaves as an
+// own key and `isUnsafeKey` above is pure defense-in-depth.
+function emptyRecord() {
+    return Object.create(null);
+}
+function invalidOutput(tool, expected) {
+    return new Error(`Invalid ${tool} output: expected ${expected}.`);
+}
+// `route:list --json`: an array of {domain, method, uri, name, action,
+// middleware, path}. Keyed by "method uri". The `path` line number is dropped
+// (it churns on unrelated edits); the file is kept to localize a change.
+const laravelRoutes = {
+    tool: "laravel-routes",
+    defaultCommand: "php artisan route:list --json",
+    normalize(raw) {
+        if (!Array.isArray(raw)) {
+            throw invalidOutput(this.tool, "a JSON array of routes");
+        }
+        const routes = {};
+        for (const entry of raw) {
+            if (!isRecord(entry)) {
+                continue;
+            }
+            const key = `${typeof entry.method === "string" ? entry.method : "?"} ${typeof entry.uri === "string" ? entry.uri : "?"}`;
+            routes[key] = {
+                name: entry.name ?? null,
+                action: entry.action ?? null,
+                middleware: entry.middleware ?? [],
+                ...(entry.domain ? { domain: entry.domain } : {}),
+                ...(typeof entry.path === "string" ? { path: entry.path.replace(/:\d+$/, "") } : {})
+            };
+        }
+        return routes;
+    }
+};
+// `about --json`: a record of sections. Values embed absolute project paths
+// (sometimes case-folded, e.g. the storage-link status keys), so occurrences of
+// the project directory are replaced with "<project>" to keep snapshots
+// machine-portable. Version fields are kept on purpose — that drift is signal.
+// `cache.views` is dropped: view compilation happens as a side effect of merely
+// rendering (running the test suite compiles Blade views), so unlike the
+// deliberate config/route/event caches it flips run-to-run and would make an
+// `about` target flaky whenever a `tests` target runs beside it.
+const laravelAbout = {
+    tool: "laravel-about",
+    defaultCommand: "php artisan about --json",
+    normalize(raw, { cwd }) {
+        if (!isRecord(raw)) {
+            throw invalidOutput(this.tool, "a JSON object of sections");
+        }
+        const data = stripProjectDir(raw, cwd);
+        const cache = data.cache;
+        if (isRecord(cache)) {
+            const { views: _views, ...stable } = cache;
+            data.cache = stable;
+        }
+        return data;
+    }
+};
+// `schedule:list --json` (Laravel ≥ 12): an array of scheduled entries. Keyed
+// by "expression command" — a cron change reads as remove+add, which is the
+// loudness a schedule change deserves. `next_due_date(_human)` vary with the
+// wall clock and are dropped.
+const laravelSchedule = {
+    tool: "laravel-schedule",
+    defaultCommand: "php artisan schedule:list --json",
+    normalize(raw) {
+        if (!Array.isArray(raw)) {
+            throw invalidOutput(this.tool, "a JSON array of schedule entries");
+        }
+        const entries = {};
+        for (const entry of raw) {
+            if (!isRecord(entry)) {
+                continue;
+            }
+            const key = `${typeof entry.expression === "string" ? entry.expression : "?"} ${typeof entry.command === "string" ? entry.command : "?"}`;
+            const { next_due_date: _due, next_due_date_human: _human, ...stable } = entry;
+            entries[key] = stable;
+        }
+        return entries;
+    }
+};
+// PHPStan / Larastan `--error-format=json` (Larastan is PHPStan with Laravel
+// extensions — same output). PHPStan emits two shapes: the classic
+// `{totals, files: {path: {messages: […]}}}` and, when it detects an AI-agent
+// environment, `{error_details: {path: […]}}`. Both normalize to the same
+// keyed record so the snapshot doesn't depend on who ran the capture. Entries
+// are keyed by message per file with a count — PHPStan's own baseline identity —
+// and line numbers are dropped (they churn on unrelated edits).
+const phpstan = {
+    tool: "phpstan",
+    defaultCommand: "vendor/bin/phpstan analyse --error-format=json --no-progress",
+    toleratesNonZeroExit: true,
+    normalize(raw, { cwd }) {
+        if (!isRecord(raw) || !(isRecord(raw.totals) || raw.tool === "phpstan")) {
+            throw invalidOutput(this.tool, "PHPStan JSON error output");
+        }
+        const data = emptyRecord();
+        const add = (file, message, identifier) => {
+            if (typeof message !== "string") {
+                return;
+            }
+            const relative = file.startsWith(`${cwd}/`) ? file.slice(cwd.length + 1) : file;
+            if (isUnsafeKey(relative) || isUnsafeKey(message)) {
+                return;
+            }
+            data[relative] ??= emptyRecord();
+            const entries = data[relative];
+            const entry = entries[message] ?? {
+                identifier: typeof identifier === "string" ? identifier : null,
+                count: 0
+            };
+            entry.count += 1;
+            entries[message] = entry;
+        };
+        // Classic shape ({} or [] when empty — PHP arrays serialize both ways).
+        if (isRecord(raw.files)) {
+            for (const [file, info] of Object.entries(raw.files)) {
+                if (isRecord(info) && Array.isArray(info.messages)) {
+                    for (const message of info.messages) {
+                        if (isRecord(message)) {
+                            add(file, message.message, message.identifier);
+                        }
+                    }
+                }
+            }
+        }
+        // Agent shape.
+        if (isRecord(raw.error_details)) {
+            for (const [file, messages] of Object.entries(raw.error_details)) {
+                if (Array.isArray(messages)) {
+                    for (const message of messages) {
+                        if (isRecord(message)) {
+                            add(file, message.message, message.identifier);
+                        }
+                    }
+                }
+            }
+        }
+        // Non-file errors (config problems, unparsable files).
+        if (Array.isArray(raw.errors)) {
+            for (const message of raw.errors) {
+                add("(general)", message, null);
+            }
+        }
+        return data;
+    }
+};
+// Pest / PHPUnit via the JUnit XML report (`--log-junit`) — one normalizer
+// covers both runners (Pest runs on the PHPUnit core and emits the same
+// report; only the default binary differs). Keyed suite → case → {status,
+// type?, message?}; `time`/`assertions` are dropped (run-varying), messages
+// keep the assertion text with project paths relativized.
+const JUNIT_ARTIFACT = ".dungbeetle-junit.xml";
+function normalizeJUnit(raw, { cwd }) {
+    const suites = emptyRecord();
+    for (const testCase of parseJUnit(String(raw))) {
+        if (isUnsafeKey(testCase.suite) || isUnsafeKey(testCase.name)) {
+            continue;
+        }
+        suites[testCase.suite] ??= emptyRecord();
+        const suite = suites[testCase.suite];
+        suite[testCase.name] = {
+            status: testCase.status,
+            ...(testCase.type ? { type: testCase.type } : {}),
+            ...(testCase.message ? { message: stripProjectDir(testCase.message, cwd) } : {})
+        };
+    }
+    return suites;
+}
+const phpunit = {
+    tool: "phpunit",
+    defaultCommand: `vendor/bin/phpunit --log-junit ${JUNIT_ARTIFACT}`,
+    defaultOutput: JUNIT_ARTIFACT,
+    format: "text",
+    toleratesNonZeroExit: true,
+    normalize: normalizeJUnit
+};
+const pest = {
+    tool: "pest",
+    defaultCommand: `vendor/bin/pest --log-junit ${JUNIT_ARTIFACT}`,
+    defaultOutput: JUNIT_ARTIFACT,
+    format: "text",
+    toleratesNonZeroExit: true,
+    normalize: normalizeJUnit
+};
+// Pint `--test --format=json`. Like PHPStan, Pint emits two shapes: the
+// classic PHP-CS-Fixer report `{about, files: [{name, appliedFixers}]}` and an
+// AI-agent shape `{tool: "pint", result, files: [{path, fixers}]}` (where even
+// a failing run exits 0). Both normalize to file → sorted fixer names — the
+// one field the shapes agree on — so snapshots stay environment-independent.
+// The classic shape's per-file diff text is deliberately dropped for the same
+// reason; the review UI can regenerate diffs when it needs them.
+const pint = {
+    tool: "pint",
+    defaultCommand: "vendor/bin/pint --test --format=json -v",
+    toleratesNonZeroExit: true,
+    normalize(raw) {
+        if (!isRecord(raw) || !(raw.tool === "pint" || typeof raw.about === "string")) {
+            throw invalidOutput(this.tool, "Pint JSON output");
+        }
+        const data = {};
+        for (const file of Array.isArray(raw.files) ? raw.files : []) {
+            if (!isRecord(file)) {
+                continue;
+            }
+            const filePath = file.path ?? file.name;
+            if (typeof filePath !== "string" || isUnsafeKey(filePath)) {
+                continue;
+            }
+            const fixers = file.fixers ?? file.appliedFixers;
+            data[filePath] = Array.isArray(fixers) ? [...fixers].sort() : true;
+        }
+        return data;
+    }
+};
+// `schema:dump` writes DDL to database/schema/{connection}-schema.sql. The
+// default output assumes sqlite (Laravel's default connection since 11); other
+// connections override `output` with their dump path. Dropped columns and type
+// changes diff as one named entry per table (see src/check/schema.ts).
+const laravelSchema = {
+    tool: "laravel-schema",
+    defaultCommand: "php artisan schema:dump",
+    defaultOutput: "database/schema/sqlite-schema.sql",
+    format: "text",
+    normalize(raw) {
+        return parseSchemaDump(String(raw));
+    }
+};
+function stripProjectDir(value, cwd) {
+    const pattern = new RegExp(cwd.replace(/[.*+?^${}()|[\]\\]/g, "\\$&"), "gi");
+    const strip = (node) => {
+        if (typeof node === "string") {
+            return node.replace(pattern, "<project>");
+        }
+        if (Array.isArray(node)) {
+            return node.map(strip);
+        }
+        if (isRecord(node)) {
+            return Object.fromEntries(Object.entries(node).map(([key, entry]) => [strip(key), strip(entry)]));
+        }
+        return node;
+    };
+    return strip(value);
+}
+export const checkParsers = {
+    "laravel-routes": laravelRoutes,
+    "laravel-about": laravelAbout,
+    "laravel-schedule": laravelSchedule,
+    "laravel-schema": laravelSchema,
+    phpstan,
+    phpunit,
+    pest,
+    pint
+};

package/dist/check/schema.d.ts

@@ -0,0 +1,2 @@
+export type SchemaData = Record<string, unknown>;
+export declare function parseSchemaDump(sql: string): SchemaData;

package/dist/check/schema.js

@@ -0,0 +1,114 @@
+// SQL-dump extraction for the laravel-schema check parser.
+//
+// Not a SQL parser — it targets the DDL Laravel's `schema:dump` writes
+// (sqlite today, mysqldump-style guardedly): CREATE TABLE bodies, CREATE INDEX
+// statements, and the migrations-table INSERTs. Everything is normalized into
+// the check kind's keyed-record shape:
+//
+//   { users: { id: "integer primary key autoincrement not null",
+//              "(index) users_email_unique": "unique (email)",
+//              "(constraint) primary key(email)": true },
+//     "(migrations)": { "0001_01_01_000000_create_users_table": true } }
+//
+// so a dropped column or changed type diffs as one named entry per table.
+const CONSTRAINT_KEYWORDS = /^(primary\s+key|foreign\s+key|unique|constraint|check|key)\b/i;
+function unquote(identifier) {
+    return identifier.replace(/^[`"[]|[`"\]]$/g, "");
+}
+function collapse(text) {
+    return text.replace(/\s+/g, " ").trim();
+}
+// Split a CREATE TABLE body on top-level commas (paren-depth aware).
+function splitColumns(body) {
+    const parts = [];
+    let depth = 0;
+    let current = "";
+    for (const char of body) {
+        if (char === "(") {
+            depth += 1;
+        }
+        else if (char === ")") {
+            depth -= 1;
+        }
+        if (char === "," && depth === 0) {
+            parts.push(current);
+            current = "";
+        }
+        else {
+            current += char;
+        }
+    }
+    if (current.trim()) {
+        parts.push(current);
+    }
+    return parts;
+}
+// Accumulate lines into statements ending with ";", dropping comment lines.
+function statements(sql) {
+    const result = [];
+    let current = "";
+    for (const line of sql.split("\n")) {
+        const trimmed = line.trim();
+        if (trimmed.startsWith("--") || trimmed.startsWith("/*") || trimmed === "") {
+            continue;
+        }
+        current += `${line}\n`;
+        if (trimmed.endsWith(";")) {
+            result.push(current.trim().replace(/;$/, ""));
+            current = "";
+        }
+    }
+    return result;
+}
+export function parseSchemaDump(sql) {
+    const data = {};
+    const table = (name) => {
+        data[name] ??= {};
+        return data[name];
+    };
+    let sawDdl = false;
+    for (const statement of statements(sql)) {
+        const createTable = /^CREATE\s+TABLE\s+(?:IF\s+NOT\s+EXISTS\s+)?([`"]?\w+[`"]?)\s*\(([\s\S]*)\)[^)]*$/i.exec(statement);
+        if (createTable) {
+            sawDdl = true;
+            const name = unquote(createTable[1]);
+            if (name === "sqlite_sequence") {
+                continue;
+            }
+            const entry = table(name);
+            for (const part of splitColumns(createTable[2])) {
+                const text = collapse(part);
+                if (!text) {
+                    continue;
+                }
+                if (CONSTRAINT_KEYWORDS.test(text)) {
+                    entry[`(constraint) ${text}`] = true;
+                }
+                else {
+                    const [identifier, ...definition] = text.split(" ");
+                    entry[unquote(identifier)] = definition.join(" ");
+                }
+            }
+            continue;
+        }
+        const createIndex = /^CREATE\s+(UNIQUE\s+)?INDEX\s+([`"]?\w+[`"]?)\s+ON\s+([`"]?\w+[`"]?)\s*\(([\s\S]*)\)$/i.exec(statement);
+        if (createIndex) {
+            sawDdl = true;
+            const [, unique, indexName, tableName, columns] = createIndex;
+            table(unquote(tableName))[`(index) ${unquote(indexName)}`] =
+                `${unique ? "unique " : ""}(${collapse(columns).replace(/[`"]/g, "")})`;
+            continue;
+        }
+        // Migration rows: the name is schema signal, the id/batch churn.
+        if (/^INSERT\s+INTO\s+[`"]?migrations[`"]?/i.test(statement)) {
+            for (const row of statement.matchAll(/\(\s*\d+\s*,\s*'([^']+)'\s*,\s*\d+\s*\)/g)) {
+                table("(migrations)")[row[1]] = true;
+            }
+        }
+        // Anything else (PRAGMA, SET, other inserts) carries no schema shape.
+    }
+    if (!sawDdl) {
+        throw new Error("Invalid schema dump: no CREATE TABLE statements found.");
+    }
+    return data;
+}

package/dist/cloud.d.ts

@@ -0,0 +1,42 @@
+export type ClientCredentials = {
+    clientId: string;
+    clientSecret: string;
+};
+export type PushOptions = ClientCredentials & {
+    serverUrl: string;
+    reportPath: string;
+    branch?: string;
+    commit?: string;
+};
+export type PushedRun = {
+    id: string;
+    repositoryId: string;
+    status: string;
+    counts: Record<string, number>;
+    url: string;
+};
+export declare function pushReport(options: PushOptions): Promise<PushedRun>;
+export type BaselineSource = {
+    target: string;
+    kind: string;
+    snapshotPath: string;
+    screenshotPath?: string;
+};
+export type PushBaselinesOptions = ClientCredentials & {
+    serverUrl: string;
+    baselines: BaselineSource[];
+};
+export type UploadedBaseline = {
+    target: string;
+    version: number;
+    deduped: boolean;
+};
+export declare function pushBaselines(options: PushBaselinesOptions): Promise<UploadedBaseline[]>;
+export type AnonPushResult = {
+    id: string;
+    url: string;
+};
+export declare function pushAnonReport(options: {
+    serverUrl: string;
+    report: unknown;
+}): Promise<AnonPushResult>;