repopo 0.10.0 → 0.13.0

package/esm/utils/safePaths.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"safePaths.d.ts","sourceRoot":"","sources":["../../src/utils/safePaths.ts"],"names":[],"mappings":"AAkBA;;GAEG;AACH,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,MAAM,CAe1E;AAED;;GAEG;AACH,wBAAgB,6BAA6B,CAC5C,IAAI,EAAE,MAAM,EACZ,QAAQ,EAAE,MAAM,GACd,MAAM,CAaR"}

package/esm/utils/safePaths.js

@@ -0,0 +1,40 @@
+import { isAbsolute, normalize, relative, resolve } from "pathe";
+function normalizeRoot(root) {
+    return normalize(resolve(root));
+}
+function isPathWithinRoot(rootPath, candidatePath) {
+    const relativePath = normalize(relative(rootPath, candidatePath));
+    if (relativePath === "" || relativePath === ".") {
+        return true;
+    }
+    return (!isAbsolute(relativePath) &&
+        relativePath !== ".." &&
+        !relativePath.startsWith("../"));
+}
+/**
+ * Resolves a candidate file path against the repository root and verifies it does not escape that root.
+ */
+export function resolveRepoFilePath(root, filePath) {
+    if (filePath.trim().length === 0) {
+        throw new Error("File path cannot be empty.");
+    }
+    const rootPath = normalizeRoot(root);
+    const candidatePath = normalize(resolve(rootPath, filePath));
+    if (!isPathWithinRoot(rootPath, candidatePath)) {
+        throw new Error(`File path must be within repository root. Received: ${filePath}`);
+    }
+    return candidatePath;
+}
+/**
+ * Converts an input path into a normalized repository-relative path after validating root containment.
+ */
+export function normalizeRepoRelativeFilePath(root, filePath) {
+    const rootPath = normalizeRoot(root);
+    const absolutePath = resolveRepoFilePath(rootPath, filePath);
+    const relativePath = normalize(relative(rootPath, absolutePath)).replace(/\\/g, "/");
+    if (relativePath === "" || relativePath === ".") {
+        throw new Error("File path resolves to repository root instead of a file.");
+    }
+    return relativePath;
+}
+//# sourceMappingURL=safePaths.js.map

package/esm/utils/safePaths.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"safePaths.js","sourceRoot":"","sources":["../../src/utils/safePaths.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,OAAO,CAAC;AAEjE,SAAS,aAAa,CAAC,IAAY;IAClC,OAAO,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;AACjC,CAAC;AAED,SAAS,gBAAgB,CAAC,QAAgB,EAAE,aAAqB;IAChE,MAAM,YAAY,GAAG,SAAS,CAAC,QAAQ,CAAC,QAAQ,EAAE,aAAa,CAAC,CAAC,CAAC;IAClE,IAAI,YAAY,KAAK,EAAE,IAAI,YAAY,KAAK,GAAG,EAAE,CAAC;QACjD,OAAO,IAAI,CAAC;IACb,CAAC;IACD,OAAO,CACN,CAAC,UAAU,CAAC,YAAY,CAAC;QACzB,YAAY,KAAK,IAAI;QACrB,CAAC,YAAY,CAAC,UAAU,CAAC,KAAK,CAAC,CAC/B,CAAC;AACH,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,mBAAmB,CAAC,IAAY,EAAE,QAAgB;IACjE,IAAI,QAAQ,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAClC,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAC;IAC/C,CAAC;IAED,MAAM,QAAQ,GAAG,aAAa,CAAC,IAAI,CAAC,CAAC;IACrC,MAAM,aAAa,GAAG,SAAS,CAAC,OAAO,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC,CAAC;IAE7D,IAAI,CAAC,gBAAgB,CAAC,QAAQ,EAAE,aAAa,CAAC,EAAE,CAAC;QAChD,MAAM,IAAI,KAAK,CACd,uDAAuD,QAAQ,EAAE,CACjE,CAAC;IACH,CAAC;IAED,OAAO,aAAa,CAAC;AACtB,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,6BAA6B,CAC5C,IAAY,EACZ,QAAgB;IAEhB,MAAM,QAAQ,GAAG,aAAa,CAAC,IAAI,CAAC,CAAC;IACrC,MAAM,YAAY,GAAG,mBAAmB,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;IAC7D,MAAM,YAAY,GAAG,SAAS,CAAC,QAAQ,CAAC,QAAQ,EAAE,YAAY,CAAC,CAAC,CAAC,OAAO,CACvE,KAAK,EACL,GAAG,CACH,CAAC;IAEF,IAAI,YAAY,KAAK,EAAE,IAAI,YAAY,KAAK,GAAG,EAAE,CAAC;QACjD,MAAM,IAAI,KAAK,CAAC,0DAA0D,CAAC,CAAC;IAC7E,CAAC;IAED,OAAO,YAAY,CAAC;AACrB,CAAC","sourcesContent":["import { isAbsolute, normalize, relative, resolve } from \"pathe\";\n\nfunction normalizeRoot(root: string): string {\n\treturn normalize(resolve(root));\n}\n\nfunction isPathWithinRoot(rootPath: string, candidatePath: string): boolean {\n\tconst relativePath = normalize(relative(rootPath, candidatePath));\n\tif (relativePath === \"\" || relativePath === \".\") {\n\t\treturn true;\n\t}\n\treturn (\n\t\t!isAbsolute(relativePath) &&\n\t\trelativePath !== \"..\" &&\n\t\t!relativePath.startsWith(\"../\")\n\t);\n}\n\n/**\n * Resolves a candidate file path against the repository root and verifies it does not escape that root.\n */\nexport function resolveRepoFilePath(root: string, filePath: string): string {\n\tif (filePath.trim().length === 0) {\n\t\tthrow new Error(\"File path cannot be empty.\");\n\t}\n\n\tconst rootPath = normalizeRoot(root);\n\tconst candidatePath = normalize(resolve(rootPath, filePath));\n\n\tif (!isPathWithinRoot(rootPath, candidatePath)) {\n\t\tthrow new Error(\n\t\t\t`File path must be within repository root. Received: ${filePath}`,\n\t\t);\n\t}\n\n\treturn candidatePath;\n}\n\n/**\n * Converts an input path into a normalized repository-relative path after validating root containment.\n */\nexport function normalizeRepoRelativeFilePath(\n\troot: string,\n\tfilePath: string,\n): string {\n\tconst rootPath = normalizeRoot(root);\n\tconst absolutePath = resolveRepoFilePath(rootPath, filePath);\n\tconst relativePath = normalize(relative(rootPath, absolutePath)).replace(\n\t\t/\\\\/g,\n\t\t\"/\",\n\t);\n\n\tif (relativePath === \"\" || relativePath === \".\") {\n\t\tthrow new Error(\"File path resolves to repository root instead of a file.\");\n\t}\n\n\treturn relativePath;\n}\n"]}

package/oclif.manifest.json

@@ -1,8 +1,114 @@
 {
   "commands": {
+    "check-native": {
+      "aliases": [],
+      "args": {},
+      "description": "Runs the Rust-based repopo-core engine with the Node.js sidecar. Rust handles file matching, scheduling and reporting; the sidecar shares per-policy contracts with 'check'. Repository policies always run with the full repository inventory, including with --stdin. With --fix, repository policies can modify files outside the stdin selection.",
+      "flags": {
+        "concurrency": {
+          "description": "Maximum concurrent files in read-only checks. Fixes remain sequential.",
+          "name": "concurrency",
+          "default": 8,
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "fix": {
+          "aliases": [
+            "resolve"
+          ],
+          "char": "f",
+          "description": "Fix errors if possible.",
+          "name": "fix",
+          "required": false,
+          "allowNo": false,
+          "type": "boolean"
+        },
+        "stdin": {
+          "description": "Read list of files from stdin.",
+          "name": "stdin",
+          "required": false,
+          "allowNo": false,
+          "type": "boolean"
+        },
+        "verbose": {
+          "char": "v",
+          "description": "Show verbose output including per-policy timing.",
+          "name": "verbose",
+          "required": false,
+          "allowNo": false,
+          "type": "boolean"
+        },
+        "quiet": {
+          "char": "q",
+          "description": "Suppress all output except errors.",
+          "name": "quiet",
+          "required": false,
+          "allowNo": false,
+          "type": "boolean"
+        },
+        "config": {
+          "char": "c",
+          "description": "Path to the config file.",
+          "name": "config",
+          "required": false,
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "sidecar-path": {
+          "description": "Path to the Node.js sidecar script.",
+          "env": "REPOPO_SIDECAR_PATH",
+          "name": "sidecar-path",
+          "required": false,
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "binary-path": {
+          "description": "Path to the repopo-core Rust binary.",
+          "env": "REPOPO_CORE_PATH",
+          "name": "binary-path",
+          "required": false,
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "runtime": {
+          "description": "JS runtime for the sidecar process (auto, node, bun).",
+          "env": "REPOPO_RUNTIME",
+          "name": "runtime",
+          "required": false,
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "options": [
+            "auto",
+            "node",
+            "bun"
+          ],
+          "type": "option"
+        }
+      },
+      "hasDynamicHelp": false,
+      "hiddenAliases": [],
+      "id": "check-native",
+      "pluginAlias": "repopo",
+      "pluginName": "repopo",
+      "pluginType": "core",
+      "strict": true,
+      "summary": "Checks and applies policies using the Rust engine.",
+      "enableJsonFlag": false,
+      "isESM": true,
+      "relativePath": [
+        "esm",
+        "commands",
+        "check-native.js"
+      ]
+    },
     "check": {
       "aliases": [],
       "args": {},
+      "description": "File policies check selected files. Repository policies always run with the full repository file inventory, including with --stdin. With --fix, repository policies can modify files outside the stdin selection.",
       "flags": {
         "verbose": {
           "char": "v",
@@ -27,6 +133,14 @@
           "allowNo": false,
           "type": "boolean"
         },
+        "concurrency": {
+          "description": "Maximum concurrent files in read-only checks. Fixes remain sequential.",
+          "name": "concurrency",
+          "default": 8,
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
         "fix": {
           "aliases": [
             "resolve"
@@ -46,7 +160,7 @@
           "type": "boolean"
         },
         "config": {
-          "description": "The path to a configuration file.",
+          "description": "Path to configuration file.",
           "helpGroup": "CONFIGURATION",
           "hidden": true,
           "name": "config",
@@ -99,7 +213,7 @@
           "type": "boolean"
         },
         "config": {
-          "description": "The path to a configuration file.",
+          "description": "Path to configuration file.",
           "helpGroup": "CONFIGURATION",
           "hidden": true,
           "name": "config",
@@ -125,5 +239,5 @@
       ]
     }
   },
-  "version": "0.10.0"
+  "version": "0.13.0"
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "repopo",
-  "version": "0.10.0",
+  "version": "0.13.0",
   "description": "Enforce policies on all or some of the files in a git repository.",
   "keywords": [
     "policy",
@@ -39,6 +39,8 @@
     "/bin",
     "/oclif.manifest.json",
     "/esm",
+    "/scripts",
+    "/sidecar",
     "/THIRD-PARTY-LICENSES.txt"
   ],
   "oclif": {
@@ -61,81 +63,109 @@
     "repositoryPrefix": "<%- repo %>/blob/main/packages/repopo/<%- commandPath %>"
   },
   "dependencies": {
-    "@fluid-tools/build-infrastructure": "~0.63.0",
-    "@oclif/core": "^4.8.0",
-    "@oclif/plugin-help": "^6.2.36",
-    "@rushstack/node-core-library": "^5.19.0",
-    "consola": "^3.4.0",
-    "defu": "^6.1.4",
-    "effection": "^4.0.0",
-    "jsonfile": "^6.2.0",
-    "microdiff": "^1.5.0",
+    "@fluid-tools/build-infrastructure": "~0.68.0",
+    "@oclif/core": "^5.1.9",
+    "@oclif/plugin-help": "^7.0.5",
+    "@rushstack/node-core-library": "^5.25.1",
+    "@tylerbu/cli-api": "^0.11.0",
+    "@tylerbu/fundamentals": "^0.3.0",
+    "@tylerbu/lilconfig-loader-ts": "^0.1.3",
+    "consola": "^3.4.2",
+    "defu": "^6.1.7",
+    "effection": "^4.2.0",
+    "jsonfile": "^6.2.1",
+    "lilconfig": "^3.1.4",
+    "microdiff": "^1.6.0",
     "pathe": "^2.0.3",
     "picocolors": "^1.1.1",
-    "picomatch": "^4.0.3",
-    "resolve-workspace-root": "^2.0.0",
-    "simple-git": "^3.30.0",
-    "tinyglobby": "^0.2.15",
-    "@tylerbu/cli-api": "^0.10.1",
-    "@tylerbu/fundamentals": "^0.3.0"
+    "picomatch": "^4.0.7",
+    "resolve-workspace-root": "^2.0.1",
+    "simple-git": "^4.0.2",
+    "tinyglobby": "^0.2.17",
+    "type-fest": "^5.10.0"
   },
   "devDependencies": {
     "@biomejs/biome": "2.3.8",
-    "@microsoft/api-extractor": "^7.56.0",
-    "@oclif/plugin-command-snapshot": "^5.3.8",
-    "@oclif/test": "^4.1.15",
+    "@microsoft/api-documenter": "^7.30.18",
+    "@microsoft/api-extractor": "^7.59.4",
+    "@oclif/plugin-command-snapshot": "^6.0.7",
+    "@oclif/test": "^5.0.3",
     "@types/jsonfile": "^6.1.4",
-    "@types/node": "^20.19.25",
-    "@types/picomatch": "^4.0.2",
+    "@types/node": "^26.6.5",
+    "@types/picomatch": "^4.0.3",
+    "@types/spdx-correct": "^3.1.3",
     "@types/tmp": "^0.2.6",
-    "@vitest/coverage-v8": "^4.0.17",
-    "generate-license-file": "^4.1.1",
-    "oclif": "^4.22.50",
-    "rimraf": "^6.1.2",
+    "@vitest/coverage-v8": "^5.0.5",
+    "generate-license-file": "^4.2.5",
+    "oclif": "^6.0.10",
+    "rimraf": "^6.1.3",
+    "smol-toml": "^1.9.1",
+    "spdx-correct": "^3.2.0",
     "tmp-promise": "^3.0.3",
     "ts-node": "^10.9.2",
-    "type-fest": "^5.4.1",
-    "typescript": "~5.9.3",
-    "vitest": "^4.0.17"
+    "typescript": "~6.0.3",
+    "vitest": "^5.0.5"
   },
   "peerDependencies": {
-    "sort-package-json": "*"
+    "smol-toml": "^1.0.0",
+    "sort-package-json": "*",
+    "spdx-correct": "^3.0.0"
   },
   "peerDependenciesMeta": {
+    "smol-toml": {
+      "optional": true
+    },
     "sort-package-json": {
       "optional": true
+    },
+    "spdx-correct": {
+      "optional": true
     }
   },
-  "engines": {
-    "node": ">=18.0.0"
-  },
   "nx": {
     "targets": {
       "build": {
         "executor": "nx:noop"
       },
-      "ci": {}
+      "ci": {},
+      "build:readme": {
+        "inputs": [
+          "sharedGlobals",
+          "{projectRoot}/package.json",
+          "{projectRoot}/oclif.manifest.json",
+          "{projectRoot}/README.md",
+          "{workspaceRoot}/packages/repopo-docs/src/content/docs/cli-reference.md"
+        ],
+        "outputs": [
+          "{projectRoot}/README.md",
+          "{projectRoot}/docs/**",
+          "{workspaceRoot}/packages/repopo-docs/src/content/docs/cli-reference.md"
+        ]
+      }
     }
   },
   "scripts": {
-    "api:markdown": "api-documenter markdown -i _temp/api-extractor -o _temp/docs",
-    "build:api": "api-extractor run --local",
+    "api:markdown": "rimraf _temp/docs && api-documenter markdown -i _temp/api-extractor/root -o _temp/docs/root && api-documenter markdown -i _temp/api-extractor/api -o _temp/docs/api && api-documenter markdown -i _temp/api-extractor/policies -o _temp/docs/policies",
+    "build:api": "rimraf _temp/api-extractor/root _temp/api-extractor/api _temp/api-extractor/policies && api-extractor run --local && api-extractor run --local --config api-extractor.api.json && api-extractor run --local --config api-extractor.policies.json",
     "build:compile": "tsc --project ./tsconfig.json",
     "build:manifest": "oclif manifest",
     "build:readme": "concurrently npm:readme:*",
+    "build:rust": "cargo build --manifest-path crates/core/Cargo.toml",
+    "build:rust:release": "cargo build --release --manifest-path crates/core/Cargo.toml",
     "check": "concurrently npm:check:format",
     "check:format": "biome check . --linter-enabled=false",
     "clean": "concurrently npm:clean:build npm:clean:manifest",
     "clean:build": "rimraf esm *.tsbuildinfo *.done.build.log",
     "clean:manifest": "rimraf oclif.manifest.json",
     "format": "biome check . --linter-enabled=false --write",
+    "postinstall": "node scripts/postinstall.mjs",
     "lint": "biome lint .",
     "lint:fix": "biome lint . --write",
     "readme:docs": "oclif readme --no-aliases --readme-path=../repopo-docs/src/content/docs/cli-reference.md",
     "readme:main": "oclif readme --no-aliases",
     "release:license": "generate-license-file -c ../../.generatelicensefile.cjs",
     "test": "vitest run",
-    "test:coverage": "vitest run --coverage",
+    "test:coverage": "mkdir -p .coverage/vitest/.tmp && vitest run --coverage",
     "test:snapshots": "./bin/dev.js snapshot:compare --filepath test/commands/__snapshots__/commands.json",
     "test:watch": "vitest"
   }