tack-cli 0.1.0

package/dist/detectors/index.js

@@ -0,0 +1,128 @@
+import { readdirSync, existsSync } from "node:fs";
+import { join } from "node:path";
+import { createDetectorFromYaml, getRulesDir } from "./yamlRunner.js";
+import { detectMultiuser } from "./multiuser.js";
+import { detectAdmin } from "./admin.js";
+import { detectDuplicates } from "./duplicates.js";
+const rulesDir = getRulesDir();
+function listYamlFiles(dir) {
+    try {
+        if (!existsSync(dir))
+            return [];
+        return readdirSync(dir)
+            .filter((f) => f.toLowerCase().endsWith(".yaml"))
+            .map((f) => join(dir, f));
+    }
+    catch {
+        return [];
+    }
+}
+function loadYamlDetectors() {
+    const detectors = [];
+    const seen = new Set();
+    const coreRuleNames = ["framework", "auth", "database", "payments", "jobs", "exports"];
+    for (const base of coreRuleNames) {
+        const rulePath = join(rulesDir, `${base}.yaml`);
+        if (!existsSync(rulePath))
+            continue;
+        const key = rulePath.toLowerCase();
+        if (seen.has(key))
+            continue;
+        seen.add(key);
+        detectors.push(createDetectorFromYaml(rulePath));
+    }
+    for (const file of listYamlFiles(rulesDir)) {
+        const key = file.toLowerCase();
+        if (seen.has(key))
+            continue;
+        seen.add(key);
+        detectors.push(createDetectorFromYaml(file));
+    }
+    const tackDetectorsDir = join(process.cwd(), ".tack", "detectors");
+    for (const file of listYamlFiles(tackDetectorsDir)) {
+        const key = file.toLowerCase();
+        if (seen.has(key))
+            continue;
+        seen.add(key);
+        detectors.push(createDetectorFromYaml(file));
+    }
+    return detectors;
+}
+const YAML_DETECTORS = loadYamlDetectors();
+export const PRIMARY_DETECTORS = [
+    ...YAML_DETECTORS,
+    { name: "multiuser", displayName: "Scanning for multi-tenant patterns", run: detectMultiuser },
+    { name: "admin", displayName: "Scanning for admin routes", run: detectAdmin },
+];
+export function runAllDetectors() {
+    const results = [];
+    const allSignals = [];
+    for (const detector of PRIMARY_DETECTORS) {
+        const result = detector.run();
+        results.push(result);
+        allSignals.push(...result.signals);
+    }
+    const dupeResult = detectDuplicates(allSignals);
+    results.push(dupeResult);
+    allSignals.push(...dupeResult.signals);
+    const seen = new Map();
+    for (const sig of allSignals) {
+        const key = `${sig.category}:${sig.id}:${sig.detail ?? ""}`;
+        const existing = seen.get(key);
+        if (!existing || sig.confidence > existing.confidence) {
+            seen.set(key, sig);
+        }
+    }
+    return {
+        results,
+        signals: Array.from(seen.values()),
+    };
+}
+export function detectorsForFileChange(filepath) {
+    const f = filepath.toLowerCase();
+    if (f === "package.json" ||
+        f.endsWith("package-lock.json") ||
+        f.endsWith("bun.lockb") ||
+        f.endsWith("yarn.lock") ||
+        f.endsWith("pnpm-lock.yaml")) {
+        return PRIMARY_DETECTORS;
+    }
+    const triggered = [];
+    const find = (name) => PRIMARY_DETECTORS.find((d) => d.name === name);
+    if (f.includes("prisma/schema") ||
+        f.includes("drizzle") ||
+        f.includes("migrations/") ||
+        f.includes("schema.ts") ||
+        f.includes("schema.js")) {
+        const db = find("database");
+        const mu = find("multiuser");
+        if (db)
+            triggered.push(db);
+        if (mu)
+            triggered.push(mu);
+    }
+    if (f.includes("auth") || f.includes("middleware") || f.includes("clerk")) {
+        const auth = find("auth");
+        if (auth)
+            triggered.push(auth);
+    }
+    if (f.includes("stripe") || f.includes("payment") || f.includes("webhook") || f.includes("billing")) {
+        const pay = find("payments");
+        if (pay)
+            triggered.push(pay);
+    }
+    if (f.includes("admin")) {
+        const admin = find("admin");
+        if (admin)
+            triggered.push(admin);
+    }
+    if (f.includes("job") || f.includes("worker") || f.includes("queue") || f.includes("cron")) {
+        const jobs = find("jobs");
+        if (jobs)
+            triggered.push(jobs);
+    }
+    if (triggered.length === 0) {
+        return PRIMARY_DETECTORS;
+    }
+    return triggered;
+}

package/dist/detectors/jobs.d.ts

@@ -0,0 +1,2 @@
+import { type DetectorResult } from "../lib/signals.js";
+export declare function detectJobs(): DetectorResult;

package/dist/detectors/jobs.js

@@ -0,0 +1,62 @@
+import { createSignal } from "../lib/signals.js";
+import { readJson, fileExists } from "../lib/files.js";
+const JOB_SYSTEMS = [
+    {
+        id: "bullmq",
+        packages: ["bullmq", "bull"],
+        directories: ["src/jobs", "src/workers", "workers", "jobs", "src/queues", "queues"],
+    },
+    {
+        id: "agenda",
+        packages: ["agenda"],
+        directories: ["src/jobs", "jobs"],
+    },
+    {
+        id: "cron",
+        packages: ["node-cron", "cron"],
+        directories: ["src/cron", "cron"],
+    },
+    {
+        id: "temporal",
+        packages: ["@temporalio/client", "@temporalio/worker"],
+        directories: ["src/workflows", "src/activities"],
+    },
+    {
+        id: "inngest",
+        packages: ["inngest"],
+        directories: [],
+    },
+    {
+        id: "trigger",
+        packages: ["@trigger.dev/sdk"],
+        directories: ["src/trigger", "trigger"],
+    },
+];
+export function detectJobs() {
+    try {
+        const signals = [];
+        const pkg = readJson("package.json");
+        const allDeps = { ...pkg?.dependencies, ...pkg?.devDependencies };
+        for (const system of JOB_SYSTEMS) {
+            const foundPkgs = system.packages.filter((p) => p in allDeps);
+            const foundDirs = system.directories.filter((d) => fileExists(d));
+            const sources = [];
+            let confidence = 0;
+            if (foundPkgs.length > 0) {
+                sources.push(`package.json (${foundPkgs.join(", ")})`);
+                confidence = 0.8;
+            }
+            if (foundDirs.length > 0) {
+                sources.push(...foundDirs);
+                confidence = Math.min(confidence + 0.2, 1);
+            }
+            if (sources.length > 0) {
+                signals.push(createSignal("system", "background_jobs", sources.join(" + "), confidence, system.id));
+            }
+        }
+        return { name: "jobs", signals };
+    }
+    catch {
+        return { name: "jobs", signals: [] };
+    }
+}

package/dist/detectors/multiuser.d.ts

@@ -0,0 +1,2 @@
+import { type DetectorResult } from "../lib/signals.js";
+export declare function detectMultiuser(): DetectorResult;

package/dist/detectors/multiuser.js

@@ -0,0 +1,55 @@
+import { createSignal } from "../lib/signals.js";
+import { readFile, fileExists, grepFiles, listProjectFiles } from "../lib/files.js";
+const SCHEMA_FILES = [
+    "prisma/schema.prisma",
+    "src/db/schema.ts",
+    "db/schema.ts",
+    "src/schema.ts",
+    "drizzle/schema.ts",
+];
+const SCHEMA_PATTERNS = [
+    /model\s+Organization\b/i,
+    /model\s+Org\b/i,
+    /model\s+Team\b/i,
+    /model\s+Workspace\b/i,
+    /model\s+Tenant\b/i,
+    /table\s*\(\s*["']organizations["']/i,
+    /table\s*\(\s*["']teams["']/i,
+    /table\s*\(\s*["']workspaces["']/i,
+    /table\s*\(\s*["']tenants["']/i,
+    /organizationId|orgId|teamId|workspaceId|tenantId/,
+];
+const ROUTE_PATTERNS = [
+    /\/org\/|\/organization\/|\/team\/|\/workspace\//,
+    /\[orgId\]|\[teamId\]|\[workspaceId\]/,
+    /params\.orgId|params\.teamId|params\.workspaceId/,
+];
+export function detectMultiuser() {
+    try {
+        const signals = [];
+        const projectFiles = listProjectFiles();
+        for (const schemaFile of SCHEMA_FILES) {
+            if (!fileExists(schemaFile))
+                continue;
+            const content = readFile(schemaFile);
+            if (!content)
+                continue;
+            for (const pattern of SCHEMA_PATTERNS) {
+                const match = content.match(pattern);
+                if (match) {
+                    signals.push(createSignal("scope", "multi_tenant", `${schemaFile} (${match[0]} found)`, 0.7, "Organization/team model in schema"));
+                    break;
+                }
+            }
+        }
+        const routeMatches = ROUTE_PATTERNS.flatMap((p) => grepFiles(projectFiles, p, 3));
+        if (routeMatches.length > 0) {
+            const files = [...new Set(routeMatches.map((m) => m.file))];
+            signals.push(createSignal("scope", "multi_tenant", files.join(", "), 0.6, "Org/team route patterns found"));
+        }
+        return { name: "multiuser", signals };
+    }
+    catch {
+        return { name: "multiuser", signals: [] };
+    }
+}

package/dist/detectors/payments.d.ts

@@ -0,0 +1,2 @@
+import { type DetectorResult } from "../lib/signals.js";
+export declare function detectPayments(): DetectorResult;

package/dist/detectors/payments.js

@@ -0,0 +1,49 @@
+import { createSignal } from "../lib/signals.js";
+import { readJson, grepFiles, listProjectFiles } from "../lib/files.js";
+const PAYMENT_SYSTEMS = [
+    {
+        id: "stripe",
+        packages: ["stripe", "@stripe/stripe-js", "@stripe/react-stripe-js"],
+        webhookPatterns: [/stripe\.webhooks\.constructEvent|webhook.*stripe|stripe.*webhook/i],
+    },
+    {
+        id: "paddle",
+        packages: ["@paddle/paddle-js", "@paddle/paddle-node-sdk"],
+        webhookPatterns: [/paddle.*webhook|webhook.*paddle/i],
+    },
+    {
+        id: "lemonsqueezy",
+        packages: ["@lemonsqueezy/lemonsqueezy.js"],
+        webhookPatterns: [/lemonsqueezy.*webhook|webhook.*lemonsqueezy/i],
+    },
+];
+export function detectPayments() {
+    try {
+        const signals = [];
+        const pkg = readJson("package.json");
+        const allDeps = { ...pkg?.dependencies, ...pkg?.devDependencies };
+        const projectFiles = listProjectFiles();
+        for (const payment of PAYMENT_SYSTEMS) {
+            const foundPkgs = payment.packages.filter((p) => p in allDeps);
+            const webhookFiles = payment.webhookPatterns.flatMap((pattern) => grepFiles(projectFiles, pattern, 3));
+            const sources = [];
+            let confidence = 0;
+            if (foundPkgs.length > 0) {
+                sources.push(`package.json (${foundPkgs.join(", ")})`);
+                confidence = 0.8;
+            }
+            if (webhookFiles.length > 0) {
+                const uniqueFiles = [...new Set(webhookFiles.map((m) => m.file))];
+                sources.push(...uniqueFiles);
+                confidence = Math.min(confidence + 0.2, 1);
+            }
+            if (sources.length > 0) {
+                signals.push(createSignal("system", "payments", sources.join(" + "), confidence, payment.id));
+            }
+        }
+        return { name: "payments", signals };
+    }
+    catch {
+        return { name: "payments", signals: [] };
+    }
+}

package/dist/detectors/rules/auth.yaml

@@ -0,0 +1,24 @@
+name: auth
+displayName: "Detecting auth"
+signalId: auth
+category: system
+systems:
+  - id: clerk
+    packages: ["@clerk/nextjs", "@clerk/clerk-react", "@clerk/express"]
+    routePatterns: ["clerkMiddleware", "ClerkProvider", "useAuth", "useUser"]
+  - id: nextauth
+    packages: ["next-auth", "@auth/core"]
+    configFiles: ["auth.ts", "auth.config.ts", "src/auth.ts"]
+    routePatterns: ["NextAuth", "getServerSession", "useSession"]
+  - id: auth0
+    packages: ["@auth0/nextjs-auth0", "@auth0/auth0-react", "auth0"]
+    routePatterns: ["Auth0Provider", "useUser", "withPageAuthRequired"]
+  - id: supabase-auth
+    packages: ["@supabase/auth-helpers-nextjs", "@supabase/ssr"]
+    routePatterns: ["createClientComponentClient", "createServerComponentClient"]
+  - id: lucia
+    packages: ["lucia", "@lucia-auth/adapter-prisma", "@lucia-auth/adapter-drizzle"]
+    routePatterns: ["Lucia", "validateSessionCookie"]
+  - id: passport
+    packages: ["passport", "passport-local", "passport-google-oauth20"]
+    routePatterns: ["passport\\.authenticate", "passport\\.use"]

package/dist/detectors/rules/database.yaml

@@ -0,0 +1,27 @@
+name: database
+displayName: "Detecting database"
+signalId: db
+category: system
+systems:
+  - id: prisma
+    packages: ["prisma", "@prisma/client"]
+    configFiles: ["prisma/schema.prisma"]
+  - id: drizzle
+    packages: ["drizzle-orm", "drizzle-kit"]
+    configFiles: ["drizzle.config.ts", "drizzle.config.js"]
+  - id: typeorm
+    packages: ["typeorm"]
+    configFiles: ["ormconfig.json", "ormconfig.ts", "ormconfig.js"]
+  - id: mongoose
+    packages: ["mongoose"]
+  - id: knex
+    packages: ["knex"]
+    configFiles: ["knexfile.js", "knexfile.ts"]
+  - id: postgres
+    packages: ["pg", "@neondatabase/serverless"]
+  - id: mysql
+    packages: ["mysql2", "@planetscale/database"]
+  - id: sqlite
+    packages: ["better-sqlite3", "@libsql/client"]
+  - id: mongodb
+    packages: ["mongodb"]

package/dist/detectors/rules/exports.yaml

@@ -0,0 +1,28 @@
+name: exports
+displayName: "Detecting export/PDF systems"
+signalId: exports
+category: system
+systems:
+  - id: jspdf
+    packages: ["jspdf"]
+  - id: pdfkit
+    packages: ["pdfkit"]
+  - id: react-pdf
+    packages: ["@react-pdf/renderer"]
+  - id: puppeteer
+    packages: ["puppeteer"]
+  - id: playwright
+    packages: ["playwright"]
+  - id: html2canvas
+    packages: ["html2canvas"]
+  - id: exceljs
+    packages: ["exceljs"]
+  - id: sheetjs
+    packages: ["xlsx"]
+  - id: csv-writer
+    packages: ["csv-writer"]
+  - id: csv-stringify
+    packages: ["csv-stringify"]
+  - id: json2csv
+    packages: ["json2csv"]
+

package/dist/detectors/rules/framework.yaml

@@ -0,0 +1,26 @@
+name: framework
+displayName: "Detecting framework"
+signalId: framework
+category: system
+systems:
+  - id: nextjs
+    packages: ["next"]
+    configFiles: ["next.config.js", "next.config.mjs", "next.config.ts"]
+  - id: remix
+    packages: ["@remix-run/node", "@remix-run/react"]
+    configFiles: ["remix.config.js"]
+  - id: sveltekit
+    packages: ["@sveltejs/kit"]
+    configFiles: ["svelte.config.js"]
+  - id: vite
+    packages: ["vite"]
+    configFiles: ["vite.config.ts", "vite.config.js"]
+  - id: express
+    packages: ["express"]
+  - id: fastify
+    packages: ["fastify"]
+  - id: hono
+    packages: ["hono"]
+  - id: astro
+    packages: ["astro"]
+    configFiles: ["astro.config.mjs", "astro.config.ts"]

package/dist/detectors/rules/jobs.yaml

@@ -0,0 +1,23 @@
+name: jobs
+displayName: "Detecting background jobs"
+signalId: background_jobs
+category: system
+systems:
+  - id: bullmq
+    packages: ["bullmq", "bull"]
+    directories: ["src/jobs", "src/workers", "workers", "jobs", "src/queues", "queues"]
+  - id: agenda
+    packages: ["agenda"]
+    directories: ["src/jobs", "jobs"]
+  - id: cron
+    packages: ["node-cron", "cron"]
+    directories: ["src/cron", "cron"]
+  - id: temporal
+    packages: ["@temporalio/client", "@temporalio/worker"]
+    directories: ["src/workflows", "src/activities"]
+  - id: inngest
+    packages: ["inngest"]
+  - id: trigger
+    packages: ["@trigger.dev/sdk"]
+    directories: ["src/trigger", "trigger"]
+

package/dist/detectors/rules/payments.yaml

@@ -0,0 +1,22 @@
+name: payments
+displayName: "Detecting payments"
+signalId: payments
+category: system
+systems:
+  - id: stripe
+    packages: ["stripe", "@stripe/stripe-js", "@stripe/react-stripe-js"]
+    routePatterns:
+      - "stripe\\.webhooks\\.constructEvent"
+      - "webhook.*stripe"
+      - "stripe.*webhook"
+  - id: paddle
+    packages: ["@paddle/paddle-js", "@paddle/paddle-node-sdk"]
+    routePatterns:
+      - "paddle.*webhook"
+      - "webhook.*paddle"
+  - id: lemonsqueezy
+    packages: ["@lemonsqueezy/lemonsqueezy.js"]
+    routePatterns:
+      - "lemonsqueezy.*webhook"
+      - "webhook.*lemonsqueezy"
+

package/dist/detectors/types.d.ts

@@ -0,0 +1,2 @@
+import type { DetectorResult } from "../lib/signals.js";
+export type DetectorFn = () => DetectorResult;

package/dist/detectors/types.js

@@ -0,0 +1 @@
+export {};

package/dist/detectors/yamlRunner.d.ts

@@ -0,0 +1,31 @@
+import { type DetectorResult } from "../lib/signals.js";
+import type { SignalCategory } from "../lib/signals.js";
+export interface YamlSystemRule {
+    id: string;
+    packages?: string[];
+    configFiles?: string[];
+    routePatterns?: string[];
+    directories?: string[];
+}
+export interface YamlDetectorRule {
+    name: string;
+    displayName: string;
+    signalId: string;
+    category: SignalCategory;
+    systems: YamlSystemRule[];
+}
+/**
+ * Create a detector that runs from a YAML rule file.
+ * Binary detection: if any source matches, emit one signal with confidence 1.
+ */
+/**
+ * Create a detector entry that loads and runs a single YAML rule file.
+ * Name/displayName are read once at creation; run() re-reads the file so rules are fresh.
+ */
+export declare function createDetectorFromYaml(yamlPath: string): {
+    name: string;
+    displayName: string;
+    run: () => DetectorResult;
+};
+/** Resolve the rules directory for both source (src/detectors/rules) and bundled (dist/detectors/rules). */
+export declare function getRulesDir(): string;

package/dist/detectors/yamlRunner.js

@@ -0,0 +1,128 @@
+import { readFileSync, existsSync } from "node:fs";
+import { dirname, join, relative } from "node:path";
+import { fileURLToPath } from "node:url";
+import yaml from "js-yaml";
+import { createSignal } from "../lib/signals.js";
+import { readJson, fileExists, grepFiles, listProjectFiles, projectRoot } from "../lib/files.js";
+function parseRule(content) {
+    const raw = yaml.load(content);
+    if (!raw || typeof raw !== "object" || !Array.isArray(raw.systems))
+        return null;
+    const rule = raw;
+    if (typeof rule.name !== "string" ||
+        typeof rule.displayName !== "string" ||
+        typeof rule.signalId !== "string" ||
+        (rule.category !== "system" && rule.category !== "scope" && rule.category !== "risk"))
+        return null;
+    return rule;
+}
+/** Invalid regex in YAML (e.g. unescaped brackets) skips that pattern instead of throwing. */
+function safeRegex(patternStr) {
+    try {
+        return new RegExp(patternStr);
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * Create a detector that runs from a YAML rule file.
+ * Binary detection: if any source matches, emit one signal with confidence 1.
+ */
+/**
+ * Create a detector entry that loads and runs a single YAML rule file.
+ * Name/displayName are read once at creation; run() re-reads the file so rules are fresh.
+ */
+export function createDetectorFromYaml(yamlPath) {
+    const ruleName = yamlPath.split(/[/\\]/).pop()?.replace(/\.yaml$/, "") ?? "yaml";
+    let name = ruleName;
+    let displayName = ruleName;
+    try {
+        const content = readFileSync(yamlPath, "utf-8");
+        const rule = parseRule(content);
+        if (rule) {
+            name = rule.name;
+            displayName = rule.displayName;
+        }
+    }
+    catch {
+        // keep defaults
+    }
+    return {
+        name,
+        displayName,
+        run: () => {
+            try {
+                const content = readFileSync(yamlPath, "utf-8");
+                const rule = parseRule(content);
+                if (!rule)
+                    return { name: ruleName, signals: [] };
+                const signals = [];
+                const pkg = readJson("package.json");
+                const allDeps = { ...(pkg?.dependencies ?? {}), ...(pkg?.devDependencies ?? {}) };
+                let projectFiles = [];
+                try {
+                    projectFiles = listProjectFiles();
+                    // Never search inside the directory that contains this rule file (avoids
+                    // matching rule definitions as if they were project code; fixes false
+                    // positives for the tack repo and any project that has rule YAML in-tree).
+                    const base = projectRoot();
+                    const ruleDirRel = relative(base, dirname(yamlPath)).replace(/\\/g, "/");
+                    if (ruleDirRel && !ruleDirRel.startsWith("..")) {
+                        const prefixWithSep = ruleDirRel.endsWith("/") ? ruleDirRel : `${ruleDirRel}/`;
+                        projectFiles = projectFiles.filter((f) => {
+                            const n = f.replace(/\\/g, "/");
+                            return n !== ruleDirRel && !n.startsWith(prefixWithSep);
+                        });
+                    }
+                }
+                catch {
+                    // non-node or no project root
+                }
+                for (const system of rule.systems) {
+                    if (!system?.id || typeof system.id !== "string")
+                        continue;
+                    const foundPkgs = (system.packages ?? []).filter((p) => p in allDeps);
+                    const foundConfigs = (system.configFiles ?? []).filter((f) => fileExists(f));
+                    const foundDirs = (system.directories ?? []).filter((d) => fileExists(d));
+                    let routeMatch;
+                    const routePatterns = system.routePatterns ?? [];
+                    for (const patternStr of routePatterns) {
+                        const pattern = safeRegex(patternStr);
+                        if (!pattern)
+                            continue;
+                        const matches = grepFiles(projectFiles, pattern, 1);
+                        if (matches.length > 0) {
+                            routeMatch = matches[0].file;
+                            break;
+                        }
+                    }
+                    const sources = [];
+                    if (foundPkgs.length > 0)
+                        sources.push(`package.json (${foundPkgs.join(", ")})`);
+                    if (foundConfigs.length > 0)
+                        sources.push(foundConfigs[0]);
+                    if (foundDirs.length > 0)
+                        sources.push(...foundDirs.slice(0, 3));
+                    if (routeMatch)
+                        sources.push(routeMatch);
+                    if (sources.length > 0) {
+                        signals.push(createSignal(rule.category, rule.signalId, sources.join(" + "), 1, system.id));
+                    }
+                }
+                return { name: rule.name, signals };
+            }
+            catch {
+                return { name: ruleName, signals: [] };
+            }
+        },
+    };
+}
+/** Resolve the rules directory for both source (src/detectors/rules) and bundled (dist/detectors/rules). */
+export function getRulesDir() {
+    const baseDir = dirname(fileURLToPath(import.meta.url));
+    const nextToMe = join(baseDir, "rules");
+    if (existsSync(nextToMe))
+        return nextToMe;
+    return join(baseDir, "detectors", "rules");
+}

package/dist/engine/cleanup.d.ts

@@ -0,0 +1,12 @@
+export type CleanupPlan = {
+    system: string;
+    packagesToRemove: string[];
+    filesToReview: Array<{
+        file: string;
+        line: number;
+        content: string;
+    }>;
+    configFilesToCheck: string[];
+    summary: string;
+};
+export declare function generateCleanupPlan(systemId: string): CleanupPlan;