hermex 2.0.0-beta.6 → 2.0.0-beta.8

package/dist/cli.mjs

@@ -302,7 +302,9 @@ function formatRuleType(type) {
 		case "require_packages": return "require_packages";
 		case "require_scripts": return "require_scripts";
 		case "require_package_fields": return "pkg_fields";
+		case "forbid_package_fields": return "pkg_fields";
 		case "engine_version": return "engine_version";
+		case "codeowners": return "codeowners";
 	}
 }
 function ruleIcon(violation) {
@@ -321,11 +323,21 @@ function describeViolation(v) {
 	if (v.type === "require_packages") return `${patterns} not installed${suffix}`;
 	if (v.type === "forbid_packages") return `${patterns} is forbidden${suffix}`;
 	if (v.type === "require_scripts") return `script ${patterns} missing in package.json${suffix}`;
-	if (v.type === "require_package_fields") return `field ${patterns} missing in package.json${suffix}`;
+	if (v.type === "require_package_fields") {
+		if (v.fieldPath && v.actualValue !== void 0) return `field ${v.fieldPath} is ${chalk.yellow(v.actualValue)}, does not match required value${suffix}`;
+		return `field ${patterns} missing in package.json${suffix}`;
+	}
+	if (v.type === "forbid_package_fields") return `field ${v.fieldPath ?? patterns} is forbidden in package.json${suffix}`;
 	if (v.type === "engine_version") {
 		if (!v.installedRange) return `engines.node not specified (required ${v.requiredRange})${suffix}`;
 		return `engines.node is ${chalk.yellow(v.installedRange)}, required ${chalk.cyan(v.requiredRange)}${suffix}`;
 	}
+	if (v.type === "codeowners") {
+		if (v.matchedFiles.length === 0) return `CODEOWNERS not found (looked in ${patterns})${suffix}`;
+		const shown = v.matchedFiles.slice(0, 3).join(", ");
+		const more = v.matchedFiles.length > 3 ? ` and ${v.matchedFiles.length - 3} more` : "";
+		return `${v.matchedFiles.length} scanned file(s) have no owner: ${shown}${more}${suffix}`;
+	}
 	return `${patterns} not present${suffix}`;
 }
 function printRules(aggregated) {
@@ -420,11 +432,19 @@ const RuleConfigSchema = z.object({
 	message: z.string().optional()
 });
 const RuleConfigOrArraySchema = z.union([RuleConfigSchema, z.array(RuleConfigSchema)]);
+const PackageFieldRuleSchema = RuleConfigSchema.extend({ 
+/** Optional micromatch patterns the field's stringified value must match */
+values: z.array(z.string()).optional() });
+const PackageFieldRuleOrArraySchema = z.union([PackageFieldRuleSchema, z.array(PackageFieldRuleSchema)]);
 const EngineVersionRuleSchema = z.object({
 	severity: RuleSeveritySchema,
 	range: z.string(),
 	message: z.string().optional()
 });
+const CodeownersRuleSchema = z.object({
+	severity: RuleSeveritySchema,
+	message: z.string().optional()
+});
 const ThresholdSchema = z.union([z.number(), z.literal(false)]);
 const HermexConfigSchema = z.object({
 	includes: z.array(z.string()).default(["**/*.{tsx,jsx,ts,js}"]),
@@ -450,15 +470,18 @@ const HermexConfigSchema = z.object({
 		forbid_packages: RuleConfigOrArraySchema.default([]),
 		require_packages: RuleConfigOrArraySchema.default([]),
 		require_scripts: RuleConfigOrArraySchema.default([]),
-		require_package_fields: RuleConfigOrArraySchema.default([]),
-		engine_version: z.union([EngineVersionRuleSchema, z.array(EngineVersionRuleSchema)]).optional()
+		require_package_fields: PackageFieldRuleOrArraySchema.default([]),
+		forbid_package_fields: PackageFieldRuleOrArraySchema.default([]),
+		engine_version: z.union([EngineVersionRuleSchema, z.array(EngineVersionRuleSchema)]).optional(),
+		codeowners: CodeownersRuleSchema.optional()
 	}).default(() => ({
 		detect_files: [],
 		require_files: [],
 		forbid_packages: [],
 		require_packages: [],
 		require_scripts: [],
-		require_package_fields: []
+		require_package_fields: [],
+		forbid_package_fields: []
 	})),
 	output: z.object({
 		summary: z.union([z.literal("log"), z.literal(false)]).default("log"),
@@ -870,10 +893,10 @@ function analyzeConditionalExpression(node, state) {
 */
 function analyzeArrayExpression(node, state) {
 	if (node.elements?.some((elem) => {
-		if (elem?.type === "Identifier") return state.componentNames.has(elem.value);
+		if (elem?.expression?.type === "Identifier") return state.componentNames.has(elem.expression.value);
 		return false;
 	})) state.usagePatterns.arrayMappings.add({
-		components: node.elements?.map((elem) => elem?.value).filter(Boolean),
+		components: node.elements?.map((elem) => elem?.expression?.value).filter(Boolean),
 		line: node.span?.start || 0
 	});
 }
@@ -899,11 +922,11 @@ function analyzeObjectExpression(node, state) {
 * Analyzes React.lazy() imports
 */
 function analyzeLazyImport(node, state) {
-	const arg = node.arguments?.[0];
+	const arg = node.arguments?.[0]?.expression;
 	if (arg?.type === "ArrowFunctionExpression" && arg.body?.type === "CallExpression") {
 		const importCall = arg.body;
 		if (importCall.callee?.type === "Import") {
-			const source = importCall.arguments?.[0]?.value;
+			const source = importCall.arguments?.[0]?.expression?.value;
 			if (source) state.usagePatterns.lazyImports.add({
 				source,
 				line: node.span?.start || 0
@@ -915,7 +938,7 @@ function analyzeLazyImport(node, state) {
 * Analyzes dynamic import() calls
 */
 function analyzeDynamicImport(node, state) {
-	const source = node.arguments?.[0]?.value;
+	const source = node.arguments?.[0]?.expression?.value;
 	if (source) state.usagePatterns.dynamicImports.add({
 		source,
 		line: node.span?.start || 0
@@ -929,7 +952,7 @@ function analyzeDynamicImport(node, state) {
 function analyzeHOCUsage(node, state) {
 	state.usagePatterns.hocUsage.add({
 		function: node.callee?.value || "[unknown]",
-		component: node.arguments?.[0]?.value || "[unknown]",
+		component: node.arguments?.[0]?.expression?.value || "[unknown]",
 		line: node.span?.start || 0
 	});
 }
@@ -937,7 +960,7 @@ function analyzeHOCUsage(node, state) {
 * Analyzes React.memo() usage
 */
 function analyzeMemoUsage(node, state) {
-	const component = node.arguments?.[0];
+	const component = node.arguments?.[0]?.expression;
 	if (component?.type === "Identifier" && state.componentNames.has(component.value)) state.usagePatterns.memoizedComponents.add({
 		component: component.value,
 		line: node.span?.start || 0
@@ -968,7 +991,7 @@ function analyzeMemberExpression(node, state) {
 * Checks if a node represents HOC pattern
 */
 function isHOCPattern(node, state) {
-	return node.callee?.type === "Identifier" && node.arguments?.some((arg) => arg.type === "Identifier" && state.componentNames.has(arg.value));
+	return node.callee?.type === "Identifier" && node.arguments?.some((arg) => arg.expression?.type === "Identifier" && state.componentNames.has(arg.expression.value));
 }
 //#endregion
 //#region src/swc-parser/core/visitor.ts
@@ -1297,18 +1320,63 @@ function evaluateScriptRules(repoPath, rulesConfig) {
 }
 //#endregion
 //#region src/rules/package-field-rules.ts
+/** Resolves a dot-path like "engines.node" against the manifest object. */
+function getFieldAtPath(pkg, path) {
+	let current = pkg;
+	for (const key of path.split(".")) {
+		if (current === null || typeof current !== "object" || !(key in current)) return {
+			exists: false,
+			value: void 0
+		};
+		current = current[key];
+	}
+	return {
+		exists: true,
+		value: current
+	};
+}
+/** Primitives compare by string form; objects/arrays never match a value pattern. */
+function valueMatches(value, valuePatterns) {
+	if (value === null || typeof value === "object") return false;
+	return micromatch.isMatch(String(value), valuePatterns);
+}
 function evaluatePackageFieldRules(repoPath, rulesConfig) {
-	const rules = toArray(rulesConfig.require_package_fields);
-	if (rules.length === 0) return [];
+	const requireRules = toArray(rulesConfig.require_package_fields);
+	const forbidRules = toArray(rulesConfig.forbid_package_fields);
+	if (requireRules.length === 0 && forbidRules.length === 0) return [];
 	const pkg = readPackageJson(repoPath);
-	const fieldKeys = pkg ? Object.keys(pkg) : [];
-	return rules.filter((rule) => !rule.patterns.some((p) => fieldKeys.includes(p))).map((rule) => ({
-		type: "require_package_fields",
-		severity: rule.severity,
-		patterns: rule.patterns,
-		message: rule.message,
-		matchedFiles: []
-	}));
+	const violations = [];
+	for (const rule of requireRules) {
+		const lookups = rule.patterns.map((p) => ({
+			path: p,
+			...getFieldAtPath(pkg, p)
+		}));
+		if (!lookups.some((l) => l.exists && (!rule.values || valueMatches(l.value, rule.values)))) {
+			const mismatch = rule.values ? lookups.find((l) => l.exists) : void 0;
+			violations.push({
+				type: "require_package_fields",
+				severity: rule.severity,
+				patterns: rule.patterns,
+				message: rule.message,
+				matchedFiles: [],
+				fieldPath: mismatch?.path,
+				actualValue: mismatch && typeof mismatch.value !== "object" ? String(mismatch.value) : void 0
+			});
+		}
+	}
+	for (const rule of forbidRules) for (const pattern of rule.patterns) {
+		const lookup = getFieldAtPath(pkg, pattern);
+		if (lookup.exists && (!rule.values || valueMatches(lookup.value, rule.values))) violations.push({
+			type: "forbid_package_fields",
+			severity: rule.severity,
+			patterns: rule.patterns,
+			message: rule.message,
+			matchedFiles: [],
+			fieldPath: pattern,
+			actualValue: lookup.value !== null && typeof lookup.value !== "object" ? String(lookup.value) : void 0
+		});
+	}
+	return violations;
 }
 //#endregion
 //#region src/rules/engine-version.ts
@@ -1339,13 +1407,102 @@ function evaluateEngineVersion(repoPath, rulesConfig) {
 	});
 }
 //#endregion
+//#region src/rules/codeowners.ts
+const CODEOWNERS_LOCATIONS = [
+	".github/CODEOWNERS",
+	"CODEOWNERS",
+	"docs/CODEOWNERS"
+];
+/** First existing location, GitHub search order. Null if none exist. */
+function findCodeownersFile(repoPath) {
+	for (const location of CODEOWNERS_LOCATIONS) {
+		const full = path$1.join(repoPath, location);
+		if (fs$1.existsSync(full)) return full;
+	}
+	return null;
+}
+/** Parses content into entries; skips blank lines and # comments. */
+function parseCodeowners(content) {
+	const entries = [];
+	for (const rawLine of content.split(/\r?\n/)) {
+		const line = rawLine.trim();
+		if (!line || line.startsWith("#")) continue;
+		const tokens = line.split(/\s+/);
+		const pattern = tokens[0];
+		const owners = tokens.slice(1);
+		entries.push({
+			pattern,
+			globs: codeownersPatternToGlobs(pattern),
+			owners
+		});
+	}
+	return entries;
+}
+/**
+* Translates a CODEOWNERS (gitignore-style) pattern into micromatch glob(s).
+*
+* Rules:
+* - `*` alone matches everything.
+* - A leading `/`, or a `/` anywhere in the middle of the pattern, anchors
+*   the match to the repo root (the leading `/` is stripped once anchored).
+* - A pattern with no anchoring gets a `**\/` prefix so it matches at any depth.
+* - A trailing `/` restricts the match to a directory, so `/**` is appended.
+* - A bare name (no glob characters, no slash at all) also matches as a
+*   directory anywhere, so the `/**` directory variant is added alongside
+*   the plain match.
+*/
+function codeownersPatternToGlobs(pattern) {
+	if (pattern === "*") return ["**"];
+	let p = pattern;
+	const hadLeadingSlash = p.startsWith("/");
+	if (hadLeadingSlash) p = p.slice(1);
+	const hadTrailingSlash = p.endsWith("/") && p.length > 1;
+	if (hadTrailingSlash) p = p.slice(0, -1);
+	const hasInternalSlash = p.includes("/");
+	const anchored = hadLeadingSlash || hasInternalSlash;
+	const hasGlobChars = /[*?[\]{}!()]/.test(p);
+	const isBareName = !anchored && !hasGlobChars && !hadTrailingSlash;
+	const base = anchored ? p : `**/${p}`;
+	const globs = [hadTrailingSlash ? `${base}/**` : base];
+	if (isBareName) globs.push(`${base}/**`);
+	return globs;
+}
+/** Last matching entry wins; owned iff that entry has >= 1 owner. */
+function fileIsOwned(file, entries) {
+	for (let i = entries.length - 1; i >= 0; i--) if (micromatch.isMatch(file, entries[i].globs, { dot: true })) return entries[i].owners.length > 0;
+	return false;
+}
+function evaluateCodeowners(repoPath, rulesConfig, scannedFiles) {
+	const rule = rulesConfig.codeowners;
+	if (!rule) return [];
+	const filePath = findCodeownersFile(repoPath);
+	if (!filePath) return [{
+		type: "codeowners",
+		severity: rule.severity,
+		patterns: CODEOWNERS_LOCATIONS,
+		message: rule.message,
+		matchedFiles: []
+	}];
+	const entries = parseCodeowners(fs$1.readFileSync(filePath, "utf-8"));
+	const unowned = scannedFiles.map((f) => (path$1.isAbsolute(f) ? path$1.relative(repoPath, f) : f).replace(/\\/g, "/")).filter((f) => !fileIsOwned(f, entries));
+	if (unowned.length === 0) return [];
+	return [{
+		type: "codeowners",
+		severity: rule.severity,
+		patterns: [path$1.basename(filePath)],
+		message: rule.message,
+		matchedFiles: unowned
+	}];
+}
+//#endregion
 //#region src/rules/evaluator.ts
-function evaluateRules(repoPath, rulesConfig, excludes) {
+function evaluateRules(repoPath, rulesConfig, excludes, scannedFiles = []) {
 	return [
 		...evaluateFileRules(repoPath, rulesConfig, excludes),
 		...evaluateScriptRules(repoPath, rulesConfig),
 		...evaluatePackageFieldRules(repoPath, rulesConfig),
-		...evaluateEngineVersion(repoPath, rulesConfig)
+		...evaluateEngineVersion(repoPath, rulesConfig),
+		...evaluateCodeowners(repoPath, rulesConfig, scannedFiles)
 	];
 }
 //#endregion
@@ -1507,14 +1664,15 @@ function aggregateReports(reports, versions = {}, config, multiVersions = {}) {
 }
 //#endregion
 //#region src/utils/print-errors.ts
-function printErrors(errors) {
+function printErrors(errors, isJson) {
 	if (errors.length === 0) return;
-	console.log(chalk.yellow(`\n⚠ ${errors.length} file(s) failed to parse:`));
+	const stream = isJson ? process.stderr : process.stdout;
+	stream.write(chalk.yellow(`\n⚠ ${errors.length} file(s) failed to parse:\n`));
 	for (const { file, message } of errors) {
-		console.log(chalk.yellow(`  ${file}`));
-		console.log(chalk.gray(`    ${message}`));
+		stream.write(chalk.yellow(`  ${file}\n`));
+		stream.write(chalk.gray(`    ${message}\n`));
 	}
-	console.log("");
+	stream.write("\n");
 }
 //#endregion
 //#region src/utils/file-utils.ts
@@ -1869,8 +2027,8 @@ function computeReleaseAge(installedVersion, timeMap, deprecated, thresholds, di
 			daysAgo
 		});
 		byBump.set(bump, list);
-		const threshold = thresholds.patch;
-		if (bump === "patch" && threshold !== false && threshold !== void 0 && daysAgo <= threshold && (minCompliantReleasedDaysAgo === void 0 || daysAgo > minCompliantReleasedDaysAgo)) {
+		const threshold = thresholds[bump];
+		if (threshold !== false && threshold !== void 0 && daysAgo <= threshold && (minCompliantReleasedDaysAgo === void 0 || daysAgo > minCompliantReleasedDaysAgo)) {
 			minCompliantVersion = version;
 			minCompliantReleasedDaysAgo = daysAgo;
 		}
@@ -1949,16 +2107,20 @@ async function enrichWithReleaseAge(packages, config) {
 }
 //#endregion
 //#region src/commands/pipeline.ts
+const DECLARATION_FILE_RE = /\.d\.(ts|mts|cts)$/;
+function isDeclarationFile(filePath) {
+	return DECLARATION_FILE_RE.test(filePath);
+}
 /**
 * Runs the shared parse → aggregate → rules → release-age pipeline used by
 * both `scan` and `comply`. Returns `null` if no files matched (the spinner
 * has already reported the failure); throws on unexpected errors.
 */
-async function runPipeline(config, spinner) {
+async function runPipeline(config, spinner, isJson) {
 	const lockfileResult = findAndParseLockfile(process.cwd());
 	spinner.succeed(chalk.blue(`📦 Found ${lockfileResult.lockfileType} lockfile (supports: ${lockfileResult.supportedVersions.join(", ")}) - ${Object.keys(lockfileResult.versions).length} packages`));
 	spinner.start("Finding files...");
-	const files = await findFiles(config.includes, config.excludes);
+	const files = (await findFiles(config.includes, config.excludes)).filter((f) => !isDeclarationFile(f));
 	if (files.length === 0) {
 		spinner.fail(chalk.red(`No files found matching includes: ${config.includes.join(", ")}`));
 		return null;
@@ -1982,9 +2144,9 @@ async function runPipeline(config, spinner) {
 		}
 	}
 	spinner.succeed(chalk.green(`Analysis complete! Analyzed ${reports.length}/${files.length} files`));
-	printErrors(parseErrors);
+	printErrors(parseErrors, isJson);
 	const aggregated = aggregateReports(reports, lockfileResult.versions, config, lockfileResult.multiVersions);
-	const evaluatorViolations = evaluateRules(process.cwd(), config.rules, config.excludes);
+	const evaluatorViolations = evaluateRules(process.cwd(), config.rules, config.excludes, files);
 	aggregated.ruleViolations = [...aggregated.ruleViolations, ...evaluatorViolations];
 	if (config.releaseAge.enabled) {
 		spinner.start("Fetching release age from registry...");
@@ -2022,7 +2184,7 @@ function registerScanCommand(program) {
 async function executeScan(config) {
 	const { isJson, spinner } = createCommandContext(config);
 	try {
-		const aggregated = await runPipeline(config, spinner);
+		const aggregated = await runPipeline(config, spinner, isJson);
 		if (!aggregated) return;
 		if (isJson) printJson(aggregated);
 		else printScanResults(aggregated, config);
@@ -2090,7 +2252,7 @@ function registerComplyCommand(program) {
 async function executeComply(config) {
 	const { isJson, spinner } = createCommandContext(config);
 	try {
-		const aggregated = await runPipeline(config, spinner);
+		const aggregated = await runPipeline(config, spinner, isJson);
 		if (!aggregated) {
 			process.exitCode = 2;
 			return;