monkeypatchlist 0.0.0-stage → 0.1.0

package/package.json

@@ -1,6 +1,97 @@
 {
   "name": "monkeypatchlist",
-  "version": "0.0.0-stage",
-  "stub": true,
-  "description": "Temporary package placeholder for staged publishing"
-}
+  "version": "0.1.0",
+  "description": "Finds where your build mutates native browser and ECMAScript APIs.",
+  "keywords": [
+    "security",
+    "supply-chain",
+    "static-analysis",
+    "monkey-patching",
+    "native-apis",
+    "web-platform",
+    "third-party-scripts",
+    "javascript",
+    "ci"
+  ],
+  "homepage": "https://github.com/adammedford/monkeypatchlist#readme",
+  "bugs": {
+    "url": "https://github.com/adammedford/monkeypatchlist/issues"
+  },
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/adammedford/monkeypatchlist.git"
+  },
+  "license": "Apache-2.0",
+  "author": "Adam Medford",
+  "type": "module",
+  "engines": {
+    "node": ">=24"
+  },
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "default": "./dist/index.js"
+    },
+    "./catalog.json": "./catalog/catalog.json",
+    "./catalog.schema.json": "./catalog/catalog.schema.json",
+    "./changelog.json": "./catalog/changelog.json",
+    "./report.schema.json": "./schema/report.schema.json",
+    "./config.schema.json": "./schema/config.schema.json"
+  },
+  "bin": {
+    "monkeypatchlist": "dist/bin/monkeypatchlist.js"
+  },
+  "files": [
+    "dist",
+    "catalog/catalog.json",
+    "catalog/catalog.schema.json",
+    "catalog/changelog.json",
+    "schema/report.schema.json",
+    "schema/config.schema.json",
+    "NOTICE"
+  ],
+  "scripts": {
+    "build": "tsc -p tsconfig.build.json",
+    "prepack": "npm run build",
+    "typecheck": "tsc -p tsconfig.json",
+    "lint": "eslint .",
+    "lint:boundaries": "depcruise src test tools",
+    "test": "vitest run",
+    "catalog": "node tools/catalog-generator/cli.ts",
+    "catalog:check": "node tools/catalog-generator/cli.ts --check",
+    "spec": "node tools/spec-generator/cli.ts",
+    "spec:check": "node tools/spec-generator/cli.ts --check",
+    "score": "node tools/scoring/cli.ts",
+    "corpus:fetch": "node tools/corpus-fetch/cli.ts",
+    "corpus:check": "node tools/corpus-snapshot/cli.ts",
+    "corpus:snapshot": "node tools/corpus-snapshot/cli.ts --update",
+    "fixtures:check": "node tools/fixture-pages/cli.ts",
+    "benchmark": "node tools/cost-benchmark/cli.ts",
+    "licenses:check": "node tools/license-check/cli.ts"
+  },
+  "devDependencies": {
+    "@eslint/js": "10.0.1",
+    "@mdn/browser-compat-data": "8.1.3",
+    "@tc39/ecma262-biblio": "2.2.3180",
+    "@tc39/ecma402-biblio": "2.1.1253",
+    "@types/node": "24.19.0",
+    "@types/webidl2": "24.4.4",
+    "@typescript-eslint/scope-manager": "8.70.1",
+    "@webref/idl": "3.84.0",
+    "dependency-cruiser": "18.4.0",
+    "eslint": "10.11.0",
+    "globals": "17.12.0",
+    "ses": "2.3.0",
+    "typescript": "6.0.3",
+    "typescript-eslint": "8.70.1",
+    "vitest": "5.0.2",
+    "webidl2": "24.5.0"
+  },
+  "dependencies": {
+    "@jridgewell/trace-mapping": "0.3.31",
+    "ajv": "8.20.0",
+    "eslint-scope": "9.1.2",
+    "oxc-parser": "0.151.0",
+    "parse5": "8.0.1"
+  }
+}

package/schema/config.schema.json

@@ -0,0 +1,133 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "title": "monkeypatchlist configuration",
+  "description": "monkeypatchlist.config.json (spec §16). Every setting but `name` has a flag, and a flag overrides its key field by field. Paths are relative to this file's directory, except entry files and mapping directories, which are relative to the build directory.",
+  "type": "object",
+  "additionalProperties": false,
+  "properties": {
+    "$schema": {
+      "description": "The JSON Schema this file follows, for editors. monkeypatchlist ignores it.",
+      "type": "string"
+    },
+    "name": {
+      "description": "The application name, shown in the report header and the terminal title. It is not identity. Defaults to the build directory's basename. It has no flag.",
+      "type": "string",
+      "minLength": 1
+    },
+    "entries": {
+      "description": "The HTML entry documents (--entry <file>[@<url>]). Defaults to index.html in the build directory.",
+      "type": "array",
+      "minItems": 1,
+      "items": {
+        "type": "object",
+        "required": ["file"],
+        "additionalProperties": false,
+        "properties": {
+          "file": { "description": "The document, relative to the build directory.", "type": "string", "minLength": 1 },
+          "url": {
+            "description": "The document's absolute http: or https: URL. Defaults to the first mapping's URL.",
+            "type": "string",
+            "minLength": 1
+          }
+        }
+      }
+    },
+    "mappings": {
+      "description": "The URL→path mappings (--map <urlPrefix>=<dir>). The longest matching prefix wins.",
+      "type": "array",
+      "minItems": 1,
+      "items": {
+        "type": "object",
+        "required": ["url", "dir"],
+        "additionalProperties": false,
+        "properties": {
+          "url": { "description": "An absolute http: or https: URL prefix.", "type": "string", "minLength": 1 },
+          "dir": {
+            "description": "The directory its URLs are files under, relative to the build directory.",
+            "type": "string",
+            "minLength": 1
+          }
+        }
+      }
+    },
+    "sourceMaps": {
+      "description": "Directories of source maps kept outside the build directory (--source-maps <dir>).",
+      "type": "array",
+      "uniqueItems": true,
+      "items": { "type": "string", "minLength": 1 }
+    },
+    "surface": {
+      "description": "The surface that is reported, baselined and gated (--surface). Defaults to protected.",
+      "enum": ["protected", "all"]
+    },
+    "mode": {
+      "description": "The remote retrieval mode (--mode). Defaults to offline.",
+      "enum": ["offline", "resolve"]
+    },
+    "lockfile": {
+      "description": "The lockfile that finds introducing dependencies. --lockfile <path> sets `path`.",
+      "type": "object",
+      "additionalProperties": false,
+      "properties": {
+        "path": { "description": "The lockfile.", "type": "string", "minLength": 1 },
+        "importer": {
+          "description": "The lockfile importer (workspace) of the scanned application, when the first-party source paths don't pick it.",
+          "type": "string",
+          "minLength": 1
+        }
+      }
+    },
+    "baseline": {
+      "description": "The baseline file, or a full JSON scan report read as the baseline baseline update would write from its scan (--baseline). Defaults to monkeypatchlist.baseline.json when failOn is given and that file exists.",
+      "type": "string",
+      "minLength": 1
+    },
+    "previous": {
+      "description": "A previous JSON scan report, for the reachability and install-context notes (--previous). It overrides a full report given as baseline as the source of the previous values, needs a baseline (without one it gives no notes and a warning), and must share the scan-config id. Only scan reads it.",
+      "type": "string",
+      "minLength": 1
+    },
+    "failOn": {
+      "description": "The baseline states that fail the gate (--fail-on). removed and unconfirmed can't gate.",
+      "type": "array",
+      "minItems": 1,
+      "uniqueItems": true,
+      "items": { "enum": ["added", "changed"] }
+    },
+    "allowIncomplete": {
+      "description": "Downgrades exit code 3 to a warning, lets baseline init and baseline update write, and lets scan read an incomplete report as its baseline (--allow-incomplete). After a fired crash guard, baseline init still refuses and baseline update leaves the baseline unchanged.",
+      "type": "boolean"
+    },
+    "allowDowngrade": {
+      "description": "Lets baseline init replace, and baseline update rewrite, a baseline written by a newer catalog or monkeypatchlist version (--allow-downgrade). Only the baseline commands read it.",
+      "type": "boolean"
+    },
+    "json": {
+      "description": "A path to also write the JSON report to, or - to write it to stdout instead of the terminal report (--json).",
+      "type": "string",
+      "minLength": 1
+    },
+    "out": {
+      "description": "The baseline file that baseline init writes and baseline update rewrites (--out). Defaults to monkeypatchlist.baseline.json.",
+      "type": "string",
+      "minLength": 1
+    },
+    "report": {
+      "description": "The saved JSON report that monkeypatchlist explain reads (--report). Only explain reads it.",
+      "type": "string",
+      "minLength": 1
+    },
+    "verbose": {
+      "description": "Lists existing findings in the terminal report (--verbose). Only scan reads it.",
+      "type": "boolean"
+    },
+    "listIneffective": {
+      "description": "Lists the ineffective writes in the terminal report, instead of only counting them (--list-ineffective). Only scan reads it.",
+      "type": "boolean"
+    },
+    "noColor": {
+      "description": "Never colors the terminal report (--no-color). Color is used only on a TTY, and never under NO_COLOR.",
+      "type": "boolean"
+    }
+  }
+}