shipready 1.0.0

package/dist/utils/files.js

@@ -0,0 +1,100 @@
+import fs from "node:fs";
+import path from "node:path";
+import fg from "fast-glob";
+/** Glob patterns that are always ignored when scanning. */
+export const IGNORE_PATTERNS = [
+    "node_modules/**",
+    ".git/**",
+    "dist/**",
+    "build/**",
+    ".next/**",
+    "out/**",
+    "coverage/**",
+    ".cache/**",
+];
+/** Extensions we treat as scannable text/code files. */
+export const CODE_EXTENSIONS = [
+    "js",
+    "jsx",
+    "ts",
+    "tsx",
+    "mjs",
+    "cjs",
+    "mts",
+    "cts",
+    "vue",
+    "svelte",
+    "py",
+    "rb",
+    "go",
+    "rs",
+    "java",
+    "php",
+    "json",
+    "yml",
+    "yaml",
+    "toml",
+    "env",
+    "sh",
+];
+/** Returns true if the file exists (relative to root or absolute). */
+export function fileExists(root, rel) {
+    return fs.existsSync(path.join(root, rel));
+}
+/** Reads a text file safely; returns null on failure. */
+export function readTextFile(root, rel) {
+    try {
+        return fs.readFileSync(path.join(root, rel), "utf8");
+    }
+    catch {
+        return null;
+    }
+}
+/** Reads and parses JSON safely; returns null on failure. */
+export function readJsonFile(root, rel) {
+    const raw = readTextFile(root, rel);
+    if (raw === null)
+        return null;
+    try {
+        return JSON.parse(raw);
+    }
+    catch {
+        return null;
+    }
+}
+/** Simple binary sniff: checks for NUL bytes in the first chunk. */
+export function isProbablyBinary(root, rel) {
+    try {
+        const fd = fs.openSync(path.join(root, rel), "r");
+        const buf = Buffer.alloc(512);
+        const bytes = fs.readSync(fd, buf, 0, 512, 0);
+        fs.closeSync(fd);
+        for (let i = 0; i < bytes; i++) {
+            if (buf[i] === 0)
+                return true;
+        }
+        return false;
+    }
+    catch {
+        return true;
+    }
+}
+/** Finds all scannable source files under root, honoring ignore patterns. */
+export async function findSourceFiles(root, extraIgnore = []) {
+    const pattern = `**/*.{${CODE_EXTENSIONS.join(",")}}`;
+    const files = await fg([pattern, ".env*", "**/.env*"], {
+        cwd: root,
+        ignore: [...IGNORE_PATTERNS, ...extraIgnore],
+        dot: true,
+        onlyFiles: true,
+        followSymbolicLinks: false,
+        unique: true,
+    });
+    return files.sort();
+}
+/** Writes a text file, creating parent directories as needed. */
+export function writeTextFile(root, rel, content) {
+    const abs = path.join(root, rel);
+    fs.mkdirSync(path.dirname(abs), { recursive: true });
+    fs.writeFileSync(abs, content, "utf8");
+}

package/dist/utils/framework.js

@@ -0,0 +1,68 @@
+import { fileExists } from "./files.js";
+/** Detects the package manager based on lockfiles. */
+export function detectPackageManager(root) {
+    if (fileExists(root, "pnpm-lock.yaml"))
+        return "pnpm";
+    if (fileExists(root, "yarn.lock"))
+        return "yarn";
+    if (fileExists(root, "bun.lockb") || fileExists(root, "bun.lock"))
+        return "bun";
+    if (fileExists(root, "package-lock.json"))
+        return "npm";
+    return "unknown";
+}
+/** Detects the framework from package.json dependencies. */
+export function detectFramework(pkg) {
+    if (!pkg)
+        return "unknown";
+    const deps = {
+        ...pkg.dependencies,
+        ...pkg.devDependencies,
+    };
+    // Order matters: meta-frameworks before their underlying libraries.
+    if (deps["next"])
+        return "Next.js";
+    if (deps["@nestjs/core"])
+        return "NestJS";
+    if (deps["nuxt"] || deps["vue"])
+        return "Vue";
+    if (deps["svelte"] || deps["@sveltejs/kit"])
+        return "Svelte";
+    if (deps["vite"] && deps["react"])
+        return "Vite";
+    if (deps["vite"])
+        return "Vite";
+    if (deps["react"])
+        return "React";
+    if (deps["express"])
+        return "Express";
+    return "Node.js";
+}
+/** Returns the install command for a given package manager. */
+export function installCommand(pm) {
+    switch (pm) {
+        case "pnpm":
+            return "pnpm install";
+        case "yarn":
+            return "yarn install";
+        case "bun":
+            return "bun install";
+        case "npm":
+        case "unknown":
+            return "npm install";
+    }
+}
+/** Returns the run command prefix for a given package manager. */
+export function runCommand(pm, script) {
+    switch (pm) {
+        case "pnpm":
+            return `pnpm ${script}`;
+        case "yarn":
+            return `yarn ${script}`;
+        case "bun":
+            return `bun run ${script}`;
+        case "npm":
+        case "unknown":
+            return `npm run ${script}`;
+    }
+}

package/dist/utils/report.js

@@ -0,0 +1,108 @@
+import pc from "picocolors";
+const ICONS = {
+    success: pc.green("\u2713"),
+    error: pc.red("\u2717"),
+    warning: pc.yellow("\u26a0"),
+    info: pc.cyan("\u2139"),
+};
+function colorFor(severity, text) {
+    switch (severity) {
+        case "success":
+            return pc.green(text);
+        case "error":
+            return pc.red(text);
+        case "warning":
+            return pc.yellow(text);
+        case "info":
+            return pc.cyan(text);
+    }
+}
+function scoreColor(score) {
+    const label = `${score}/100`;
+    if (score >= 85)
+        return pc.green(label);
+    if (score >= 60)
+        return pc.yellow(label);
+    return pc.red(label);
+}
+/** Builds recommended next steps from findings, highest severity first. */
+export function nextSteps(report) {
+    const steps = [];
+    const all = report.results.flatMap((r) => r.findings);
+    const has = (rule) => all.some((f) => f.rule === rule);
+    if (has("package-json.missing"))
+        steps.push("Add a package.json (npm init -y)");
+    if (has("secrets.detected"))
+        steps.push("Rotate and remove hardcoded secrets immediately");
+    if (has("env.not-ignored"))
+        steps.push("Add .env to .gitignore");
+    if (has("env.example-missing"))
+        steps.push("Create .env.example (run: shipready fix)");
+    if (has("env.example-incomplete"))
+        steps.push("Add missing variables to .env.example");
+    if (has("readme.missing"))
+        steps.push("Write a README with setup instructions");
+    if (has("readme.weak"))
+        steps.push("Expand README with installation and usage sections");
+    if (has("gitignore.missing"))
+        steps.push("Create a .gitignore (run: shipready fix)");
+    if (has("gitignore.incomplete"))
+        steps.push("Add missing entries to .gitignore (run: shipready fix)");
+    if (has("scripts.missing"))
+        steps.push("Add missing package.json scripts (build/test/lint)");
+    if (has("todos.debug"))
+        steps.push("Remove debug logs and debugger statements before shipping");
+    if (has("todos.markers"))
+        steps.push("Resolve TODO/FIXME comments or track them as issues");
+    return steps;
+}
+/** Renders the full report to a printable string. */
+export function renderReport(report, verbose = false) {
+    const lines = [];
+    const { project } = report;
+    lines.push("");
+    lines.push(pc.bold(pc.magenta("shipready report")));
+    lines.push("");
+    lines.push(`${pc.dim("Project:")} ${project.framework}`);
+    lines.push(`${pc.dim("Package manager:")} ${project.packageManager}`);
+    lines.push("");
+    lines.push(pc.bold("Summary:"));
+    for (const result of report.results) {
+        for (const finding of summarize(result.findings)) {
+            lines.push(`${ICONS[finding.severity]} ${finding.message}`);
+        }
+    }
+    // Detailed findings with file locations
+    const located = report.results
+        .flatMap((r) => r.findings)
+        .filter((f) => f.file && f.severity !== "success");
+    if (located.length > 0 && verbose) {
+        lines.push("");
+        lines.push(pc.bold("Details:"));
+        for (const f of located) {
+            const loc = f.line ? `${f.file}:${f.line}` : f.file;
+            lines.push(`  ${ICONS[f.severity]} ${pc.dim(loc ?? "")} ${colorFor(f.severity, f.message)}`);
+        }
+    }
+    lines.push("");
+    lines.push(`${pc.bold("Score:")} ${scoreColor(report.score)}`);
+    const steps = nextSteps(report);
+    if (steps.length > 0) {
+        lines.push("");
+        lines.push(pc.bold("Recommended next steps:"));
+        steps.forEach((step, i) => lines.push(`${i + 1}. ${step}`));
+    }
+    if (located.length > 0 && !verbose) {
+        lines.push("");
+        lines.push(pc.dim("Run with --verbose to see file locations."));
+    }
+    lines.push("");
+    return lines.join("\n");
+}
+/**
+ * Collapses per-file findings into summary lines while keeping
+ * top-level findings (those without a file) as-is.
+ */
+function summarize(findings) {
+    return findings.filter((f) => !f.file);
+}

package/package.json

@@ -0,0 +1,67 @@
+{
+  "name": "shipready",
+  "version": "1.0.0",
+  "description": "Pre-flight check for your repo before shipping. Scans AI-coded projects for secrets, env issues, debug leftovers, and generates AI-agent instruction files.",
+  "type": "module",
+  "license": "MIT",
+  "author": "shipready contributors",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/formalness/shipready.git"
+  },
+  "bugs": {
+    "url": "https://github.com/formalness/shipready/issues"
+  },
+  "homepage": "https://github.com/formalness/shipready#readme",
+  "bin": {
+    "shipready": "./dist/index.js"
+  },
+  "main": "./dist/index.js",
+  "exports": {
+    ".": "./dist/index.js"
+  },
+  "files": [
+    "dist",
+    "README.md",
+    "LICENSE"
+  ],
+  "publishConfig": {
+    "access": "public"
+  },
+  "engines": {
+    "node": ">=18"
+  },
+  "scripts": {
+    "dev": "tsx src/index.ts",
+    "build": "tsc",
+    "test": "vitest run",
+    "test:watch": "vitest",
+    "lint": "eslint .",
+    "prepublishOnly": "npm run build && npm run test"
+  },
+  "keywords": [
+    "cli",
+    "security",
+    "secrets",
+    "secret-scanning",
+    "ai",
+    "vibe-coding",
+    "pre-flight",
+    "ship",
+    "lint",
+    "env",
+    "gitignore",
+    "agents-md"
+  ],
+  "dependencies": {
+    "commander": "^12.1.0",
+    "fast-glob": "^3.3.2",
+    "picocolors": "^1.1.1"
+  },
+  "devDependencies": {
+    "@types/node": "^22.10.2",
+    "tsx": "^4.19.2",
+    "typescript": "^5.7.2",
+    "vitest": "^2.1.8"
+  }
+}