flecto 1.0.2 → 2.0.0

package/src/differ.js

@@ -139,8 +139,9 @@ function matchParts(patternParts, pathParts) {
  * @param {unknown} after
  * @param {string} path
  * @param {ChangeEvent[]} events  accumulator
+ * @param {{ arrayIdKey?: string | null, arrayIgnoreOrder?: boolean }} [options]
  */
-function diffValues(before, after, path, events) {
+function diffValues(before, after, path, events, options = {}) {
   const beforeIsObj = isPlainObject(before);
   const afterIsObj = isPlainObject(after);
   const beforeIsArr = Array.isArray(before);
@@ -148,13 +149,13 @@ function diffValues(before, after, path, events) {
 
   // Both plain objects → recurse into keys
   if (beforeIsObj && afterIsObj) {
-    diffObjects(before, after, path, events);
+    diffObjects(before, after, path, events, options);
     return;
   }
 
-  // Both arrays → diff by index
+  // Both arrays → diff by index or identity key
   if (beforeIsArr && afterIsArr) {
-    diffArrays(before, after, path, events);
+    diffArrays(before, after, path, events, options);
     return;
   }
 
@@ -199,8 +200,9 @@ function diffValues(before, after, path, events) {
  * @param {Record<string, unknown>} after
  * @param {string} basePath
  * @param {ChangeEvent[]} events
+ * @param {{ arrayIdKey?: string | null, arrayIgnoreOrder?: boolean }} [options]
  */
-function diffObjects(before, after, basePath, events) {
+function diffObjects(before, after, basePath, events, options = {}) {
   const beforeKeys = new Set(Object.keys(before));
   const afterKeys = new Set(Object.keys(after));
 
@@ -224,19 +226,100 @@ function diffObjects(before, after, basePath, events) {
   for (const key of beforeKeys) {
     if (afterKeys.has(key)) {
       const childPath = basePath ? `${basePath}.${key}` : key;
-      diffValues(before[key], after[key], childPath, events);
+      diffValues(before[key], after[key], childPath, events, options);
     }
   }
 }
 
 /**
- * Diff two arrays by index.
+ * @param {unknown} item
+ * @param {string} idKey
+ * @returns {string | null}
+ */
+function identityKey(item, idKey) {
+  if (!isPlainObject(item)) return null;
+  if (!Object.prototype.hasOwnProperty.call(item, idKey)) return null;
+  const v = item[idKey];
+  if (v == null || typeof v === 'object') return null;
+  return String(v);
+}
+
+/**
+ * Diff arrays by identity key when configured; otherwise by index.
  * @param {unknown[]} before
  * @param {unknown[]} after
  * @param {string} basePath
  * @param {ChangeEvent[]} events
+ * @param {{ arrayIdKey?: string | null, arrayIgnoreOrder?: boolean }} [options]
  */
-function diffArrays(before, after, basePath, events) {
+function diffArrays(before, after, basePath, events, options = {}) {
+  const idKey = options.arrayIdKey ? String(options.arrayIdKey) : null;
+
+  if (idKey) {
+    /** @type {Map<string, { value: unknown, index: number }>} */
+    const beforeMap = new Map();
+    /** @type {Map<string, { value: unknown, index: number }>} */
+    const afterMap = new Map();
+    let canUseIdentity = true;
+
+    for (let i = 0; i < before.length; i++) {
+      const key = identityKey(before[i], idKey);
+      if (key == null || beforeMap.has(key)) {
+        canUseIdentity = false;
+        break;
+      }
+      beforeMap.set(key, { value: before[i], index: i });
+    }
+    if (canUseIdentity) {
+      for (let i = 0; i < after.length; i++) {
+        const key = identityKey(after[i], idKey);
+        if (key == null || afterMap.has(key)) {
+          canUseIdentity = false;
+          break;
+        }
+        afterMap.set(key, { value: after[i], index: i });
+      }
+    }
+
+    if (canUseIdentity) {
+      for (const [key, afterItem] of afterMap) {
+        const childPath = `${basePath}[${JSON.stringify(key)}]`;
+        if (!beforeMap.has(key)) {
+          events.push({ type: 'added', path: childPath, after: afterItem.value });
+        } else {
+          diffValues(beforeMap.get(key).value, afterItem.value, childPath, events, options);
+        }
+      }
+      for (const [key, beforeItem] of beforeMap) {
+        if (!afterMap.has(key)) {
+          const childPath = `${basePath}[${JSON.stringify(key)}]`;
+          events.push({ type: 'removed', path: childPath, before: beforeItem.value });
+        }
+      }
+      return;
+    }
+  }
+
+  if (options.arrayIgnoreOrder) {
+    // Order-insensitive without id key: multiset compare via JSON signatures
+    const beforeSigs = before.map((v) => JSON.stringify(v));
+    const afterSigs = after.map((v) => JSON.stringify(v));
+    /** @type {Map<string, number>} */
+    const counts = new Map();
+    for (const s of beforeSigs) counts.set(s, (counts.get(s) ?? 0) + 1);
+    for (const s of afterSigs) {
+      const n = counts.get(s) ?? 0;
+      if (n > 0) counts.set(s, n - 1);
+      else events.push({ type: 'added', path: `${basePath}[*]`, after: JSON.parse(s) });
+    }
+    for (const [s, n] of counts) {
+      for (let i = 0; i < n; i++) {
+        events.push({ type: 'removed', path: `${basePath}[*]`, before: JSON.parse(s) });
+      }
+    }
+    return;
+  }
+
   const maxLen = Math.max(before.length, after.length);
   for (let i = 0; i < maxLen; i++) {
     const childPath = `${basePath}[${i}]`;
@@ -245,7 +328,7 @@ function diffArrays(before, after, basePath, events) {
     } else if (i >= after.length) {
       events.push({ type: 'removed', path: childPath, before: before[i] });
     } else {
-      diffValues(before[i], after[i], childPath, events);
+      diffValues(before[i], after[i], childPath, events, options);
     }
   }
 }
@@ -255,22 +338,26 @@ function diffArrays(before, after, basePath, events) {
  * Accepts any JSON-like values at the root (object/array/scalar/null).
  * @param {unknown} before
  * @param {unknown} after
- * @param {{ ignorePaths?: string[] }} [options]
+ * @param {{ ignorePaths?: string[], arrayIdKey?: string | null, arrayIgnoreOrder?: boolean }} [options]
  * @returns {ChangeEvent[]}
  */
 export function diffTrees(before, after, options = {}) {
   /** @type {ChangeEvent[]} */
   const events = [];
   const ignore = makeIgnoreMatcher(options.ignorePaths ?? []);
+  const diffOpts = {
+    arrayIdKey: options.arrayIdKey ?? null,
+    arrayIgnoreOrder: Boolean(options.arrayIgnoreOrder),
+  };
 
   // Root handling: avoid assuming object roots.
   if (isPlainObject(before) && isPlainObject(after)) {
-    diffObjects(before, after, '', events);
+    diffObjects(before, after, '', events, diffOpts);
   } else if (Array.isArray(before) && Array.isArray(after)) {
-    diffArrays(before, after, '', events);
+    diffArrays(before, after, '', events, diffOpts);
   } else {
     // Compare as a single root value. Use "<root>" so we can still ignore it if desired.
-    diffValues(before, after, '<root>', events);
+    diffValues(before, after, '<root>', events, diffOpts);
   }
 
   return events.filter(e => !ignore(e.path));

package/src/envelope.js

@@ -1,6 +1,6 @@
 import { randomUUID } from 'crypto';
 
-export const EVENT_SCHEMA_VERSION = '1.1';
+export const EVENT_SCHEMA_VERSION = '2.0';
 
 /**
  * @typedef {'watch' | 'ci' | 'diff'} EventSource
@@ -15,8 +15,9 @@ export const EVENT_SCHEMA_VERSION = '1.1';
  *  emitted_at: string,
  *  file: string,
  *  changes: import('./differ.js').ChangeEvent[],
+ *  policies?: import('./policy.js').PolicyFinding[],
  *  lifecycle?: { type: string, message: string }
- * }} SentinelEnvelope
+ * }} FlectoEnvelope
  */
 
 /**
@@ -25,10 +26,11 @@ export const EVENT_SCHEMA_VERSION = '1.1';
  *  file: string,
  *  source: EventSource,
  *  changes?: import('./differ.js').ChangeEvent[],
+ *  policies?: import('./policy.js').PolicyFinding[],
  *  lifecycle?: { type: string, message: string },
  *  batchId?: string
  * }} input
- * @returns {SentinelEnvelope}
+ * @returns {FlectoEnvelope}
  */
 export function createEnvelope(input) {
   const batchId = input.batchId ?? randomUUID();
@@ -41,7 +43,7 @@ export function createEnvelope(input) {
     emitted_at: new Date().toISOString(),
     file: input.file,
     changes: input.changes ?? [],
+    policies: input.policies ?? [],
     lifecycle: input.lifecycle,
   };
 }
-

package/src/packs/default.json

@@ -0,0 +1,37 @@
+{
+  "id": "default",
+  "rules": [
+    {
+      "id": "secret-key-changed",
+      "severity": "error",
+      "when": ["added", "changed"],
+      "match": {
+        "path": "(secret|token|password|api[_-]?key|private[_-]?key)",
+        "pathFlags": "i"
+      },
+      "message": "Sensitive-looking key added or changed. Confirm secret storage, rotation, and access controls."
+    },
+    {
+      "id": "dangerous-toggle-enabled",
+      "severity": "error",
+      "when": ["changed"],
+      "match": {
+        "path": "(debug|allow_insecure|disable_tls|skip_tls_verify)",
+        "pathFlags": "i"
+      },
+      "afterEquals": true,
+      "message": "Potentially dangerous toggle enabled."
+    },
+    {
+      "id": "pool-size-jump",
+      "severity": "warn",
+      "when": ["changed"],
+      "match": {
+        "path": "pool_size$",
+        "pathFlags": "i"
+      },
+      "numericJump": { "minMultiple": 2 },
+      "messageTemplate": "Pool size increased from {before} to {after} (>=2x)."
+    }
+  ]
+}

package/src/packs/strict-prod.json

@@ -0,0 +1,37 @@
+{
+  "id": "strict-prod",
+  "rules": [
+    {
+      "id": "secret-key-changed",
+      "severity": "error",
+      "when": ["added", "changed", "removed"],
+      "match": {
+        "path": "(secret|token|password|api[_-]?key|private[_-]?key|credential)",
+        "pathFlags": "i"
+      },
+      "message": "Sensitive-looking key changed in production profile. Confirm rotation and access controls."
+    },
+    {
+      "id": "dangerous-toggle-enabled",
+      "severity": "error",
+      "when": ["added", "changed"],
+      "match": {
+        "path": "(debug|allow_insecure|disable_tls|skip_tls_verify|permit_all)",
+        "pathFlags": "i"
+      },
+      "afterEquals": true,
+      "message": "Dangerous toggle enabled in production profile."
+    },
+    {
+      "id": "pool-size-jump",
+      "severity": "error",
+      "when": ["changed"],
+      "match": {
+        "path": "pool_size$",
+        "pathFlags": "i"
+      },
+      "numericJump": { "minMultiple": 2 },
+      "messageTemplate": "Pool size increased from {before} to {after} (>=2x) in production."
+    }
+  ]
+}

package/src/parser.js

@@ -1,10 +1,72 @@
 import { readFileSync } from 'fs';
-import { extname } from 'path';
+import { basename, extname } from 'path';
 import yaml from 'js-yaml';
 import TOML from '@iarna/toml';
 import dotenv from 'dotenv';
 
-const SUPPORTED = ['.json', '.yaml', '.yml', '.toml', '.env'];
+const SUPPORTED_EXT = ['.json', '.yaml', '.yml', '.toml', '.env', '.ini'];
+
+/**
+ * True for dotenv-like names: `.env`, `.env.*`, `*.env`
+ * @param {string} filepath
+ */
+export function isEnvFilename(filepath) {
+  const base = basename(filepath);
+  return base === '.env' || base.startsWith('.env.') || base.endsWith('.env');
+}
+
+/**
+ * True for INI files.
+ * @param {string} filepath
+ */
+export function isIniFilename(filepath) {
+  return extname(filepath).toLowerCase() === '.ini';
+}
+
+/**
+ * Minimal INI parser: [section] + key=value.
+ * Root keys are top-level; sectioned keys nest under the section name.
+ * @param {string} raw
+ * @returns {Record<string, unknown>}
+ */
+export function parseIni(raw) {
+  /** @type {Record<string, unknown>} */
+  const out = {};
+  let section = null;
+
+  for (const line of String(raw).split(/\r?\n/)) {
+    const trimmed = line.trim();
+    if (!trimmed || trimmed.startsWith(';') || trimmed.startsWith('#')) continue;
+    const sectionMatch = trimmed.match(/^\[([^\]]+)\]$/);
+    if (sectionMatch) {
+      section = sectionMatch[1].trim();
+      if (!isPlainObject(out[section])) out[section] = {};
+      continue;
+    }
+    const eq = trimmed.indexOf('=');
+    if (eq === -1) continue;
+    const key = trimmed.slice(0, eq).trim();
+    let value = trimmed.slice(eq + 1).trim();
+    if (
+      (value.startsWith('"') && value.endsWith('"')) ||
+      (value.startsWith("'") && value.endsWith("'"))
+    ) {
+      value = value.slice(1, -1);
+    }
+    if (section == null) {
+      out[key] = value;
+    } else {
+      /** @type {Record<string, string>} */
+      const bucket = /** @type {any} */ (out[section]);
+      bucket[key] = value;
+    }
+  }
+  return out;
+}
+
+function isPlainObject(v) {
+  return v !== null && typeof v === 'object' && !Array.isArray(v);
+}
 
 /**
  * Auto-detect the format of a file and parse it into a plain JS object.
@@ -15,35 +77,38 @@ const SUPPORTED = ['.json', '.yaml', '.yml', '.toml', '.env'];
  */
 export function parseContent(filepath, raw) {
   const ext = extname(filepath).toLowerCase();
+  const envLike = isEnvFilename(filepath);
+  const iniLike = isIniFilename(filepath);
 
-  if (!SUPPORTED.includes(ext)) {
-    const supported = SUPPORTED.join(', ');
+  if (!envLike && !iniLike && !SUPPORTED_EXT.includes(ext)) {
+    const supported = [...SUPPORTED_EXT, '.env.*', '*.env'].join(', ');
     throw new Error(
-      `Unsupported file format "${ext}" for "${filepath}".\n` +
+      `Unsupported file format "${ext || '(none)'}" for "${filepath}".\n` +
       `Supported extensions: ${supported}`
     );
   }
   try {
+    if (envLike || ext === '.env') {
+      return dotenv.parse(raw);
+    }
+
+    if (iniLike) {
+      return parseIni(raw);
+    }
+
     if (ext === '.json') {
       return JSON.parse(raw);
     }
 
     if (ext === '.yaml' || ext === '.yml') {
       const result = yaml.load(raw);
-      // yaml.load can return null for empty files
       return result == null ? {} : result;
     }
 
     if (ext === '.toml') {
       return TOML.parse(raw);
     }
-
-    if (ext === '.env') {
-      const parsed = dotenv.parse(raw);
-      return parsed;
-    }
   } catch (err) {
-    // Try to extract line info from error messages
     const lineMatch = err.message?.match(/line (\d+)/i);
     const lineInfo = lineMatch ? ` (line ${lineMatch[1]})` : '';
     throw new Error(
@@ -68,10 +133,11 @@ export function parseFile(filepath) {
 }
 
 /**
- * Returns true if the file extension is supported.
+ * Returns true if the file format is supported.
  * @param {string} filepath
  * @returns {boolean}
  */
 export function isSupported(filepath) {
-  return SUPPORTED.includes(extname(filepath).toLowerCase());
+  if (isEnvFilename(filepath) || isIniFilename(filepath)) return true;
+  return SUPPORTED_EXT.includes(extname(filepath).toLowerCase());
 }