nativekeel 0.1.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 NativeKeel
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,101 @@
+# NativeKeel
+
+Health check for React Native and Expo apps. One command, no install, no account:
+
+```sh
+npx nativekeel
+```
+
+It answers the questions that decide whether your app can still ship:
+
+- **Is your React Native / Expo version still supported?** React Native supports the latest minor and the two before it.
+- **Can you upgrade at all?** The legacy architecture was removed in 0.82. If the New Architecture is off, you are stuck at 0.81.
+- **Which packages block the upgrade?** Native modules without New Architecture support, unmaintained or with no release in years, with known alternatives. Outdated "unmaintained" flags are cross-checked against the latest npm release.
+- **What can you simply delete?** Packages that are installed but never imported, referenced natively or required by another package. Every one you remove is one you never upgrade.
+- **Will the stores accept your next build?** Google Play `targetSdk` and 16 KB page size (it opens your built APK/AAB and checks the alignment of every native library), and the iOS privacy manifest.
+- **Are secrets shipped inside your app?** AWS, Stripe, OpenAI, Anthropic, GitHub, Slack, SendGrid, Twilio, Shopify, Google OAuth keys, private keys and Supabase `service_role` keys (anon keys are fine), plus `.env` values that `react-native-config` or `EXPO_PUBLIC_` compile into the bundle. Server-side folders are reported separately.
+- **Is transport security off?** Cleartext HTTP or `debuggable` in the release Android manifest, `NSAllowsArbitraryLoads` on iOS.
+- **Leftovers from old templates?** Flipper, JavaScriptCore instead of Hermes.
+
+```
+✖ CRITICAL React Native 0.77.1 is no longer supported
+           Latest is 0.87.1. You are 10 minor versions behind; only the latest 3 minors receive fixes.
+✖ CRITICAL New Architecture is disabled (android + ios)
+           The legacy architecture was removed in 0.82. This app cannot upgrade past 0.81 until it migrates.
+✖ CRITICAL AWS secret access key shipped inside the app (src/aws.js:4)
+           Value wJal…EY. Anyone who downloads the app can extract it. Revoke it now, then move the call to a server.
+▲ HIGH     react-native-fast-image: no New Architecture support, unmaintained
+           Likely upgrade blocker. Alternatives: expo-image.
+```
+
+## Usage
+
+```sh
+npx nativekeel [path]              # report
+npx nativekeel plan --out UPGRADE.md   # step-by-step upgrade plan
+npx nativekeel --html report.html  # shareable HTML report
+npx nativekeel --markdown pr.md    # summary for a pull request comment
+npx nativekeel --sarif nk.sarif    # GitHub code scanning
+npx nativekeel --json              # machine-readable output
+npx nativekeel --fail-on high      # exit 1 on high or critical (default: critical)
+npx nativekeel --offline           # no network at all, local checks only
+npx nativekeel --verbose           # list every outdated package
+```
+
+Everything is free. The scan exits with code `1` when it finds a critical issue, so it can gate CI.
+
+### Upgrade plan
+
+`nativekeel plan` turns the report into ordered work: stop leaks first, replace blocking packages, switch on the New Architecture on your current version, then upgrade React Native in small, reviewable hops with links to the Upgrade Helper diffs.
+
+### GitHub Action
+
+```yaml
+# .github/workflows/nativekeel.yml
+name: NativeKeel
+on: [pull_request]
+permissions:
+  contents: read
+  security-events: write   # only needed with sarif: true
+jobs:
+  health:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v7
+      - uses: actions/setup-node@v7
+        with: { node-version: 20 }
+      - run: npm ci
+      - uses: AlicanAkyol/nativekeel@v0
+        with:
+          fail-on: critical
+          baseline: .nativekeel-baseline.json   # optional
+          sarif: true                           # findings inline in the PR
+```
+
+The report is added to the job summary. With a baseline, only findings that are new since the baseline fail the build:
+
+```sh
+npx nativekeel --save-baseline .nativekeel-baseline.json   # commit this file
+```
+
+### Reports for clients
+
+Agencies can put their own name on the HTML report: `npx nativekeel plan --html plan.html --brand "Acme Mobile"`.
+
+## Why you can run this on private code
+
+- **Your code never leaves your machine.** The only requests are package-name lookups on npm and React Native Directory. `--offline` makes none; a test traps `fetch` to prove it.
+- **Zero dependencies, no install scripts.** Only Node.js built-ins.
+- **Read-only.** It never changes your project.
+- **Secrets are always masked** in every output.
+- **Verifiable releases.** Published with npm provenance from GitHub Actions: `npm audit signatures`.
+
+Details and vulnerability reporting: [SECURITY.md](SECURITY.md).
+
+## Need it done for you?
+
+We do fixed-price React Native and Expo upgrades on a branch of your repository, delivered as a pull request with test builds. No calls needed. See https://nativekeel.com/#services.
+
+## License
+
+MIT

package/bin/nativekeel.js

@@ -0,0 +1,162 @@
+#!/usr/bin/env node
+import fs from 'node:fs';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { loadProject } from '../src/project.js';
+import { analyze, SEVERITIES } from '../src/analyze.js';
+import { textReport } from '../src/report-text.js';
+import { htmlReport } from '../src/report-html.js';
+import { sarifReport } from '../src/report-sarif.js';
+import { markdownReport } from '../src/report-md.js';
+import { buildPlan, planToMarkdown } from '../src/plan.js';
+import { applyBaseline, saveBaseline } from '../src/baseline.js';
+import { compareScans, compareToMarkdown } from '../src/compare.js';
+import { SITE_URL } from '../src/config.js';
+
+const VALUE_FLAGS = new Set(['--html', '--out', '--baseline', '--save-baseline', '--brand', '--sarif', '--markdown', '--fail-on']);
+const COMMANDS = new Set(['scan', 'plan', 'compare', 'help']);
+
+function parseArgs(argv) {
+  const flags = {};
+  const positional = [];
+  for (let i = 0; i < argv.length; i++) {
+    const a = argv[i];
+    if (VALUE_FLAGS.has(a)) {
+      if (!argv[i + 1] || argv[i + 1].startsWith('--')) fail(`${a} needs a value`);
+      flags[a.slice(2)] = argv[++i];
+    } else if (a.startsWith('--') || a === '-h' || a === '-v') {
+      flags[a.replace(/^-+/, '')] = true;
+    } else {
+      positional.push(a);
+    }
+  }
+  const command = COMMANDS.has(positional[0]) ? positional.shift() : 'scan';
+  return { command, flags, positional };
+}
+
+function fail(message, code = 2) {
+  console.error(`nativekeel: ${message}`);
+  process.exit(code);
+}
+
+const HELP = `NativeKeel: health check for React Native and Expo apps
+
+Usage
+  npx nativekeel [path]          Scan an app and print the report
+  npx nativekeel plan [path]     Write a step-by-step upgrade plan
+  npx nativekeel compare <before.json> <after.json>
+                                 What got fixed and what is new between two scans
+
+Scan options
+  --json                    Machine-readable output
+  --html <file>             Save a shareable HTML report
+  --markdown <file>         Save a Markdown summary (for pull request comments)
+  --sarif <file>            Save SARIF for GitHub code scanning
+  --verbose                 List every outdated package
+  --offline                 Make no network requests (local checks only)
+  --save-baseline <file>    Accept current findings as known
+  --baseline <file>         Only report findings not in the baseline (for CI)
+  --brand <name>            Put your company name on the HTML report
+  --fail-on <level>         Exit 1 at this severity or above: critical (default),
+                            high, medium, low, or never
+
+Plan options
+  --out <file>              Save the plan as Markdown (default: print it)
+  --html <file>             Save report + plan as one HTML file
+
+The scan exits with code 1 when a critical issue is found (see --fail-on), so it
+can gate CI.
+
+Privacy: your code never leaves your machine. Without --offline, the only
+requests are package-name lookups on registry.npmjs.org and
+reactnative.directory. Secret values are always masked.  ${SITE_URL}`;
+
+async function runScan(root, flags) {
+  let project;
+  try {
+    project = loadProject(root);
+  } catch (e) {
+    fail(e.message);
+  }
+  if (!flags.json) process.stderr.write(`Scanning ${root}${flags.offline ? ' (offline)' : ''} …\n`);
+  return analyze(project, flags.offline ? { get: async () => null, offline: true } : {});
+}
+
+function packageVersion() {
+  return JSON.parse(fs.readFileSync(path.join(path.dirname(fileURLToPath(import.meta.url)), '..', 'package.json'), 'utf8')).version;
+}
+
+function write(file, content) {
+  fs.writeFileSync(file, content);
+  process.stderr.write(`Saved ${path.resolve(file)}\n`);
+}
+
+async function main() {
+  const { command, flags, positional } = parseArgs(process.argv.slice(2));
+
+  if (flags.v || flags.version) {
+    console.log(packageVersion());
+    return 0;
+  }
+  if (command === 'help' || flags.h || flags.help) {
+    console.log(HELP);
+    return 0;
+  }
+
+  if (command === 'compare') {
+    if (positional.length !== 2) fail('usage: nativekeel compare <before.json> <after.json> (scans saved with --json)');
+    const [before, after] = positional.map((f) => {
+      try {
+        return JSON.parse(fs.readFileSync(f, 'utf8'));
+      } catch (e) {
+        return fail(`cannot read ${f}: ${e.message}`);
+      }
+    });
+    const md = compareToMarkdown(compareScans(before, after));
+    if (flags.out) write(flags.out, md);
+    else console.log(md);
+    return 0;
+  }
+
+  const root = path.resolve(positional[0] || '.');
+  const brand = flags.brand || null;
+
+  if (command === 'plan') {
+    const result = await runScan(root, flags);
+    const plan = buildPlan(result);
+    if (flags.html) write(flags.html, htmlReport(result, { plan, brand }));
+    const md = planToMarkdown(result, plan);
+    if (flags.out) write(flags.out, md);
+    else if (!flags.html) console.log(md);
+    return 0;
+  }
+
+  const failOn = flags['fail-on'] || 'critical';
+  if (!['critical', 'high', 'medium', 'low', 'never'].includes(failOn)) fail('--fail-on must be one of critical, high, medium, low, never');
+  let result = await runScan(root, flags);
+  if (flags['save-baseline']) {
+    const count = saveBaseline(flags['save-baseline'], result);
+    process.stderr.write(`Baseline saved with ${count} known findings: ${path.resolve(flags['save-baseline'])}\n`);
+  }
+  if (flags.baseline) {
+    try {
+      result = applyBaseline(flags.baseline, result);
+    } catch (e) {
+      fail(`cannot read baseline ${flags.baseline}: ${e.message}`);
+    }
+  }
+
+  if (flags.html) write(flags.html, htmlReport(result, { brand }));
+  if (flags.markdown) write(flags.markdown, markdownReport(result, { verbose: !!flags.verbose }));
+  if (flags.sarif) write(flags.sarif, `${JSON.stringify(sarifReport(result, { version: packageVersion() }), null, 2)}\n`);
+  if (flags.json) console.log(JSON.stringify(result, null, 2));
+  else console.log(textReport(result, { color: process.stdout.isTTY, verbose: !!flags.verbose }));
+  if (failOn === 'never') return 0;
+  const threshold = SEVERITIES.indexOf(failOn);
+  return result.findings.some((f) => SEVERITIES.indexOf(f.severity) <= threshold) ? 1 : 0;
+}
+
+main().then(
+  (code) => process.exit(code),
+  (e) => fail(e.stack || e.message),
+);

package/package.json

@@ -0,0 +1,38 @@
+{
+  "name": "nativekeel",
+  "version": "0.1.0",
+  "description": "Health check for React Native apps: version support, New Architecture blockers, unmaintained native modules and leaked secrets.",
+  "type": "module",
+  "bin": {
+    "nativekeel": "bin/nativekeel.js"
+  },
+  "files": [
+    "bin",
+    "src"
+  ],
+  "engines": {
+    "node": ">=20"
+  },
+  "keywords": [
+    "react-native",
+    "expo",
+    "upgrade",
+    "new-architecture",
+    "doctor",
+    "health-check",
+    "security"
+  ],
+  "license": "MIT",
+  "scripts": {
+    "test": "node --test test/*.test.js",
+    "scan": "node bin/nativekeel.js"
+  },
+  "homepage": "https://nativekeel.com",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/AlicanAkyol/nativekeel.git"
+  },
+  "bugs": {
+    "url": "https://github.com/AlicanAkyol/nativekeel/issues"
+  }
+}