fastscript 2.0.0 → 3.0.1

package/src/migration-wizard.mjs

@@ -1,16 +1,42 @@
-import { existsSync, readFileSync } from "node:fs";
+import { existsSync } from "node:fs";
 import { resolve } from "node:path";
-import { normalizeFastScript, stripTypeScriptHints } from "./fs-normalize.mjs";
+import { createStrictConversionPlan } from "./migrate.mjs";
 
 export async function runMigrationWizard(args = []) {
-  const pathArg = args[0] || "app/pages/index.js";
-  const abs = resolve(pathArg);
-  if (!existsSync(abs)) throw new Error(`migration wizard: file not found (${abs})`);
-  const raw = readFileSync(abs, "utf8");
-  let preview = raw;
-  if (/\.(ts|tsx)$/.test(abs)) preview = stripTypeScriptHints(preview);
-  preview = normalizeFastScript(preview, { file: abs, mode: "lenient" });
-  console.log("=== migration preview ===");
-  console.log(preview);
+  const target = args[0] || "app";
+  const abs = resolve(target);
+  if (!existsSync(abs)) throw new Error(`migration wizard: path not found (${abs})`);
+
+  const prepared = createStrictConversionPlan([abs, "--dry-run"]);
+  const { plan } = prepared;
+
+  console.log("=== strict conversion preview ===");
+  console.log(`target: ${abs}`);
+  console.log(`rename files: ${plan.renames.length}`);
+  console.log(`rewrite files: ${plan.writes.filter((item) => item.kind === "rewrite").length}`);
+  console.log(`import rewrites: ${plan.importRewrites.reduce((sum, item) => sum + item.count, 0)}`);
+  console.log(`blocked files: ${plan.blockedFiles.length}`);
+
+  if (plan.renames.length) {
+    console.log("--- renames ---");
+    for (const item of plan.renames.slice(0, 200)) {
+      console.log(`${item.fromRel} -> ${item.toRel}`);
+    }
+  }
+
+  if (plan.importRewrites.length) {
+    console.log("--- import rewrites ---");
+    for (const item of plan.importRewrites.slice(0, 100)) {
+      console.log(`${item.file} (${item.count})`);
+    }
+  }
+
+  if (plan.blockedFiles.length) {
+    console.log("--- blocked ---");
+    for (const item of plan.blockedFiles.slice(0, 200)) {
+      console.log(`${item.path}: ${item.reason}`);
+    }
+  }
+
   console.log("=== end preview ===");
 }

package/src/module-loader.mjs

@@ -3,6 +3,15 @@ import { pathToFileURL } from "node:url";
 import esbuild from "esbuild";
 import { normalizeFastScript } from "./fs-normalize.mjs";
 import { assertFastScript } from "./fs-diagnostics.mjs";
+import { createPermissionRuntime } from "./runtime-permissions.mjs";
+
+let cachedPermissionRuntime = null;
+
+function getPermissionRuntime() {
+  if (process.env.FASTSCRIPT_RUNTIME_PERMISSIONS === "0") return null;
+  if (!cachedPermissionRuntime) cachedPermissionRuntime = createPermissionRuntime();
+  return cachedPermissionRuntime;
+}
 
 function fsLoaderPlugin() {
   const compilerMode = (process.env.FASTSCRIPT_COMPILER_MODE || "strict").toLowerCase() === "lenient" ? "lenient" : "strict";
@@ -24,6 +33,8 @@ function fsLoaderPlugin() {
 
 export async function importSourceModule(filePath, { platform = "node" } = {}) {
   const ext = extname(filePath).toLowerCase();
+  const permissionRuntime = getPermissionRuntime();
+  permissionRuntime?.assert({ kind: "dynamicImportAccess", resource: filePath, details: { platform } });
   if (ext !== ".fs") {
     return import(`${pathToFileURL(filePath).href}?t=${Date.now()}`);
   }
@@ -42,5 +53,6 @@ export async function importSourceModule(filePath, { platform = "node" } = {}) {
 
   const code = result.outputFiles[0].text;
   const dataUrl = `data:text/javascript;base64,${Buffer.from(code).toString("base64")}`;
+  permissionRuntime?.assert({ kind: "dynamicImportAccess", resource: dataUrl, details: { platform, source: filePath } });
   return import(dataUrl);
-}
+}

package/src/permissions-cli.mjs

@@ -0,0 +1,112 @@
+import { mkdirSync, writeFileSync } from "node:fs";
+import { dirname, relative, resolve } from "node:path";
+import { createPermissionRuntime } from "./runtime-permissions.mjs";
+
+function normalize(path) {
+  return String(path || "").replace(/\\/g, "/");
+}
+
+function parseArgs(args = []) {
+  const options = {
+    policy: process.env.FASTSCRIPT_PERMISSION_POLICY_PATH || "fastscript.permissions.json",
+    mode: "report",
+    kind: "",
+    resource: "",
+    out: "",
+    json: false,
+  };
+
+  for (let i = 0; i < args.length; i += 1) {
+    const arg = args[i];
+    if (arg === "--policy") {
+      options.policy = args[i + 1] || options.policy;
+      i += 1;
+      continue;
+    }
+    if (arg === "--mode") {
+      const next = String(args[i + 1] || "report").toLowerCase();
+      options.mode = next === "assert" ? "assert" : "report";
+      i += 1;
+      continue;
+    }
+    if (arg === "--kind") {
+      options.kind = String(args[i + 1] || "");
+      i += 1;
+      continue;
+    }
+    if (arg === "--resource") {
+      options.resource = String(args[i + 1] || "");
+      i += 1;
+      continue;
+    }
+    if (arg === "--out") {
+      options.out = resolve(args[i + 1] || "");
+      i += 1;
+      continue;
+    }
+    if (arg === "--json") {
+      options.json = true;
+      continue;
+    }
+  }
+
+  return options;
+}
+
+function summarizePolicy(policyRuntime) {
+  const policy = policyRuntime.policy;
+  return {
+    policyPath: normalize(relative(resolve("."), policyRuntime.policyPath)),
+    preset: policy.preset,
+    boundaries: {
+      fileAccess: policy.fileAccess.mode,
+      envAccess: policy.envAccess.mode,
+      networkAccess: policy.networkAccess.mode,
+      subprocessExecution: policy.subprocessExecution.mode,
+      dynamicImports: policy.dynamicImports.mode,
+      pluginAccess: policy.pluginAccess.mode,
+    },
+  };
+}
+
+export async function runPermissions(args = []) {
+  const options = parseArgs(args);
+  const runtime = createPermissionRuntime({ policyPath: options.policy });
+
+  const summary = summarizePolicy(runtime);
+  let decision = null;
+
+  if (options.kind && options.resource) {
+    if (options.mode === "assert") {
+      decision = runtime.assert({ kind: options.kind, resource: options.resource });
+    } else {
+      decision = runtime.check({ kind: options.kind, resource: options.resource });
+    }
+  }
+
+  const report = {
+    generatedAt: new Date().toISOString(),
+    summary,
+    decision,
+  };
+
+  if (options.out) {
+    mkdirSync(dirname(options.out), { recursive: true });
+    writeFileSync(options.out, `${JSON.stringify(report, null, 2)}\n`, "utf8");
+  }
+
+  if (options.json) {
+    console.log(JSON.stringify(report, null, 2));
+    return;
+  }
+
+  console.log(`permissions policy: ${summary.policyPath}`);
+  console.log(`preset: ${summary.preset}`);
+  for (const [boundary, mode] of Object.entries(summary.boundaries)) {
+    console.log(`${boundary}: ${mode}`);
+  }
+  if (decision) {
+    console.log(`decision: ${decision.allowed ? "allow" : "deny"} (${decision.boundary})`);
+    console.log(`reason: ${decision.reason}`);
+  }
+}

package/src/profile.mjs

@@ -0,0 +1,95 @@
+import { mkdirSync, writeFileSync } from "node:fs";
+import { dirname, relative, resolve } from "node:path";
+import { performance } from "node:perf_hooks";
+import { runBuild } from "./build.mjs";
+import { runTypeCheck } from "./typecheck.mjs";
+import { runBench } from "./bench.mjs";
+import { runCompat } from "./compat.mjs";
+
+function parseArgs(args = []) {
+  const options = {
+    command: "build",
+    runs: Math.max(1, Number(process.env.FASTSCRIPT_PROFILE_RUNS || 1)),
+    out: resolve(".fastscript", "profile-latest.json"),
+  };
+
+  for (let i = 0; i < args.length; i += 1) {
+    const arg = args[i];
+    if (arg === "--command") {
+      options.command = String(args[i + 1] || options.command).toLowerCase();
+      i += 1;
+      continue;
+    }
+    if (arg === "--runs") {
+      options.runs = Math.max(1, Number(args[i + 1] || options.runs));
+      i += 1;
+      continue;
+    }
+    if (arg === "--out") {
+      options.out = resolve(args[i + 1] || options.out);
+      i += 1;
+      continue;
+    }
+  }
+
+  return options;
+}
+
+function createRunner(command) {
+  switch (command) {
+    case "build":
+      return () => runBuild({ mode: "build" });
+    case "typecheck":
+      return () => runTypeCheck(["--mode", "pass"]);
+    case "bench":
+      return () => runBench();
+    case "compat":
+      return () => runCompat();
+    default:
+      throw new Error(`profile: unsupported command '${command}'`);
+  }
+}
+
+export async function runProfile(args = []) {
+  const options = parseArgs(args);
+  const runner = createRunner(options.command);
+  const runs = [];
+
+  for (let i = 0; i < options.runs; i += 1) {
+    const rssBefore = process.memoryUsage().rss;
+    const t0 = performance.now();
+    await runner();
+    const t1 = performance.now();
+    const rssAfter = process.memoryUsage().rss;
+
+    runs.push({
+      run: i + 1,
+      ms: Number((t1 - t0).toFixed(2)),
+      rssBeforeMb: Number((rssBefore / (1024 * 1024)).toFixed(2)),
+      rssAfterMb: Number((rssAfter / (1024 * 1024)).toFixed(2)),
+      rssDeltaMb: Number(((rssAfter - rssBefore) / (1024 * 1024)).toFixed(2)),
+    });
+  }
+
+  const times = runs.map((row) => row.ms).sort((a, b) => a - b);
+  const mean = times.reduce((sum, value) => sum + value, 0) / Math.max(1, times.length);
+
+  const report = {
+    generatedAt: new Date().toISOString(),
+    command: options.command,
+    runs,
+    summary: {
+      count: runs.length,
+      minMs: times[0] || 0,
+      medianMs: times[Math.floor(times.length / 2)] || 0,
+      maxMs: times[times.length - 1] || 0,
+      meanMs: Number(mean.toFixed(2)),
+    },
+  };
+
+  mkdirSync(dirname(options.out), { recursive: true });
+  writeFileSync(options.out, `${JSON.stringify(report, null, 2)}\n`, "utf8");
+
+  console.log(`profile complete: command=${options.command}, runs=${runs.length}, mean=${report.summary.meanMs}ms`);
+  console.log(`profile report: ${String(relative(resolve("."), options.out)).replace(/\\/g, "/")}`);
+}

package/src/regression-guard.mjs

@@ -0,0 +1,245 @@
+import { existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
+import { dirname, relative, resolve } from "node:path";
+
+function normalize(path) {
+  return String(path || "").replace(/\\/g, "/");
+}
+
+function readJson(path, fallback = null) {
+  if (!existsSync(path)) return fallback;
+  try {
+    return JSON.parse(readFileSync(path, "utf8"));
+  } catch {
+    return fallback;
+  }
+}
+
+function writeJson(path, value) {
+  mkdirSync(dirname(path), { recursive: true });
+  writeFileSync(path, `${JSON.stringify(value, null, 2)}\n`, "utf8");
+}
+
+function parseArgs(args = []) {
+  const options = {
+    mode: "all",
+    autoBaseline: false,
+    failOnRegression: true,
+    benchmarkLatest: resolve("benchmarks", "suite-latest.json"),
+    benchmarkBaseline: resolve("benchmarks", "suite-baseline.json"),
+    fidelityLatest: resolve(".fastscript", "conversion", "latest", "fidelity-report.json"),
+    fidelityBaseline: resolve(".fastscript", "baselines", "fidelity-baseline.json"),
+    out: resolve(".fastscript", "regression", "latest.json"),
+    warmBuildBudgetPct: Number(process.env.FASTSCRIPT_REGRESSION_WARM_PCT || 0.15),
+    coldBuildBudgetPct: Number(process.env.FASTSCRIPT_REGRESSION_COLD_PCT || 0.2),
+    typecheckBudgetPct: Number(process.env.FASTSCRIPT_REGRESSION_TYPECHECK_PCT || 0.2),
+    jsBudgetPct: Number(process.env.FASTSCRIPT_REGRESSION_JS_PCT || 0.1),
+    cssBudgetPct: Number(process.env.FASTSCRIPT_REGRESSION_CSS_PCT || 0.1),
+  };
+
+  for (let i = 0; i < args.length; i += 1) {
+    const arg = args[i];
+    if (arg === "--mode") {
+      const value = String(args[i + 1] || options.mode).toLowerCase();
+      options.mode = ["all", "benchmark", "fidelity"].includes(value) ? value : "all";
+      i += 1;
+      continue;
+    }
+    if (arg === "--auto-baseline") {
+      options.autoBaseline = true;
+      continue;
+    }
+    if (arg === "--no-fail") {
+      options.failOnRegression = false;
+      continue;
+    }
+    if (arg === "--benchmark-latest") {
+      options.benchmarkLatest = resolve(args[i + 1] || options.benchmarkLatest);
+      i += 1;
+      continue;
+    }
+    if (arg === "--benchmark-baseline") {
+      options.benchmarkBaseline = resolve(args[i + 1] || options.benchmarkBaseline);
+      i += 1;
+      continue;
+    }
+    if (arg === "--fidelity-latest") {
+      options.fidelityLatest = resolve(args[i + 1] || options.fidelityLatest);
+      i += 1;
+      continue;
+    }
+    if (arg === "--fidelity-baseline") {
+      options.fidelityBaseline = resolve(args[i + 1] || options.fidelityBaseline);
+      i += 1;
+      continue;
+    }
+    if (arg === "--out") {
+      options.out = resolve(args[i + 1] || options.out);
+      i += 1;
+      continue;
+    }
+  }
+
+  return options;
+}
+
+function budgetExceeded(current, baseline, pct) {
+  const max = baseline * (1 + pct);
+  return { exceeded: current > max, max };
+}
+
+function compareBenchmark(latest, baseline, options) {
+  const findings = [];
+  const byId = new Map((baseline?.corpora || []).filter((item) => !item.skipped).map((item) => [item.id, item]));
+
+  for (const corpus of latest.corpora || []) {
+    if (corpus.skipped) continue;
+    const base = byId.get(corpus.id);
+    if (!base) continue;
+
+    const checks = [
+      {
+        metric: "warmBuildP95TrimmedMs",
+        current: Number(corpus?.timingsMs?.buildWarm?.p95Trimmed || 0),
+        baseline: Number(base?.timingsMs?.buildWarm?.p95Trimmed || 0),
+        budgetPct: options.warmBuildBudgetPct,
+      },
+      {
+        metric: "coldBuildMs",
+        current: Number(corpus?.timingsMs?.buildCold?.ms || 0),
+        baseline: Number(base?.timingsMs?.buildCold?.ms || 0),
+        budgetPct: options.coldBuildBudgetPct,
+      },
+      {
+        metric: "typecheckP95TrimmedMs",
+        current: Number(corpus?.timingsMs?.typecheck?.p95Trimmed || 0),
+        baseline: Number(base?.timingsMs?.typecheck?.p95Trimmed || 0),
+        budgetPct: options.typecheckBudgetPct,
+      },
+      {
+        metric: "firstLoadJsGzipBytes",
+        current: Number(corpus?.bundles?.js || 0),
+        baseline: Number(base?.bundles?.js || 0),
+        budgetPct: options.jsBudgetPct,
+      },
+      {
+        metric: "firstLoadCssGzipBytes",
+        current: Number(corpus?.bundles?.css || 0),
+        baseline: Number(base?.bundles?.css || 0),
+        budgetPct: options.cssBudgetPct,
+      },
+    ];
+
+    for (const check of checks) {
+      if (!Number.isFinite(check.current) || !Number.isFinite(check.baseline) || check.baseline <= 0) continue;
+      const status = budgetExceeded(check.current, check.baseline, check.budgetPct);
+      if (status.exceeded) {
+        findings.push({
+          domain: "benchmark",
+          corpus: corpus.id,
+          metric: check.metric,
+          current: check.current,
+          baseline: check.baseline,
+          maxAllowed: Number(status.max.toFixed(2)),
+          budgetPct: check.budgetPct,
+        });
+      }
+    }
+  }
+
+  return {
+    status: findings.length ? "fail" : "pass",
+    findings,
+    corporaCompared: (latest.corpora || []).filter((item) => !item.skipped).length,
+  };
+}
+
+function compareFidelity(latest, baseline) {
+  const findings = [];
+
+  const latestStatus = String(latest?.status || "unknown");
+  const baselineStatus = String(baseline?.status || "unknown");
+  if (latestStatus !== "pass") {
+    findings.push({ domain: "fidelity", metric: "status", current: latestStatus, baseline: baselineStatus, expected: "pass" });
+  }
+
+  const latestChecksFail = (latest?.checks || []).filter((item) => item.status !== "pass").map((item) => item.id);
+  if (latestChecksFail.length) {
+    findings.push({ domain: "fidelity", metric: "checks", current: latestChecksFail, baseline: [] });
+  }
+
+  const latestProbesFail = (latest?.probes || []).filter((item) => item.status !== "pass").map((item) => item.id);
+  if (latestProbesFail.length) {
+    findings.push({ domain: "fidelity", metric: "probes", current: latestProbesFail, baseline: [] });
+  }
+
+  const baselineRequired = new Set((baseline?.required || []).map((item) => String(item || "")));
+  const latestRequired = new Set((latest?.required || []).map((item) => String(item || "")));
+  for (const id of baselineRequired) {
+    if (!latestRequired.has(id)) {
+      findings.push({ domain: "fidelity", metric: "requiredProbeMissing", probe: id });
+    }
+  }
+
+  return {
+    status: findings.length ? "fail" : "pass",
+    findings,
+    requiredCount: latestRequired.size,
+  };
+}
+
+function ensureBaselineOrLoad(path, latest, options) {
+  const baseline = readJson(path, null);
+  if (baseline) return { baseline, created: false };
+  if (!options.autoBaseline) {
+    throw new Error(`regression baseline missing: ${normalize(relative(resolve("."), path))}`);
+  }
+  writeJson(path, latest);
+  return { baseline: latest, created: true };
+}
+
+export async function runRegressionGuard(args = []) {
+  const options = parseArgs(args);
+  const report = {
+    generatedAt: new Date().toISOString(),
+    mode: options.mode,
+    benchmark: null,
+    fidelity: null,
+    baselineCreated: {
+      benchmark: false,
+      fidelity: false,
+    },
+    status: "pass",
+    findings: [],
+  };
+
+  if (options.mode === "all" || options.mode === "benchmark") {
+    const latest = readJson(options.benchmarkLatest, null);
+    if (!latest) throw new Error(`benchmark latest missing: ${normalize(relative(resolve("."), options.benchmarkLatest))}`);
+
+    const baselineState = ensureBaselineOrLoad(options.benchmarkBaseline, latest, options);
+    report.baselineCreated.benchmark = baselineState.created;
+    report.benchmark = compareBenchmark(latest, baselineState.baseline, options);
+    report.findings.push(...report.benchmark.findings);
+  }
+
+  if (options.mode === "all" || options.mode === "fidelity") {
+    const latest = readJson(options.fidelityLatest, null);
+    if (!latest) throw new Error(`fidelity latest missing: ${normalize(relative(resolve("."), options.fidelityLatest))}`);
+
+    const baselineState = ensureBaselineOrLoad(options.fidelityBaseline, latest, options);
+    report.baselineCreated.fidelity = baselineState.created;
+    report.fidelity = compareFidelity(latest, baselineState.baseline);
+    report.findings.push(...report.fidelity.findings);
+  }
+
+  if (report.findings.length) report.status = "fail";
+
+  writeJson(options.out, report);
+
+  console.log(`regression guard: ${report.status}`);
+  console.log(`regression report: ${normalize(relative(resolve("."), options.out))}`);
+
+  if (options.failOnRegression && report.status === "fail") {
+    throw new Error(`regression guard failed with ${report.findings.length} finding(s)`);
+  }
+}