@agent-native/core 0.96.0 → 0.97.0

package/dist/guards/no-env-credentials.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"no-env-credentials.js","sourceRoot":"","sources":["../../src/guards/no-env-credentials.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AAEH,OAAO,EACL,gBAAgB,EAChB,YAAY,EACZ,QAAQ,EACR,IAAI,GACL,MAAM,iBAAiB,CAAC;AAGzB,MAAM,eAAe,GAAG,IAAI,GAAG,CAAC;IAC9B,cAAc;IACd,qBAAqB;IACrB,UAAU;IACV,IAAI;IACJ,OAAO;IACP,SAAS;IACT,QAAQ;IACR,QAAQ;IACR,cAAc;IACd,WAAW;IACX,0BAA0B;IAC1B,oBAAoB;IACpB,iBAAiB;IACjB,kBAAkB;IAClB,sBAAsB;IACtB,qBAAqB;IACrB,0BAA0B;IAC1B,8BAA8B;IAC9B,aAAa;IACb,YAAY;IACZ,cAAc;IACd,MAAM;IACN,MAAM;IACN,wBAAwB;CACzB,CAAC,CAAC;AAEH,MAAM,gBAAgB,GAAG;IACvB,MAAM;IACN,eAAe;IACf,QAAQ;IACR,UAAU;IACV,SAAS;IACT,KAAK;CACN,CAAC;AAEF;;;oDAGoD;AACpD,MAAM,sBAAsB,GAAG;IAC7B,kBAAkB;IAClB,kBAAkB;IAClB,YAAY;CACb,CAAC;AAEF,MAAM,aAAa,GAAG,IAAI,GAAG,CAAC,CAAC,mBAAmB,CAAC,CAAC,CAAC;AAErD,MAAM,cAAc,GAAG,2CAA2C,CAAC;AACnE,MAAM,uBAAuB,GAAG,+CAA+C,CAAC;AAEhF,MAAM,cAAc,GAClB,0EAA0E,CAAC;AAE7E,MAAM,sBAAsB,GAC1B,wDAAwD,CAAC;AAE3D,SAAS,gBAAgB,CAAC,GAAW;IACnC,IAAI,eAAe,CAAC,GAAG,CAAC,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IAC1C,OAAO,gBAAgB,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,GAAG,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC;AACnE,CAAC;AAED,SAAS,aAAa,CAAC,GAAW;IAChC,OAAO,sBAAsB,CAAC,IAAI,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;AAC3D,CAAC;AAED,SAAS,eAAe,CAAC,KAAe,EAAE,OAAe;IACvD,MAAM,GAAG,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;IACjC,IAAI,cAAc,CAAC,IAAI,CAAC,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IAC1C,MAAM,IAAI,GAAG,KAAK,CAAC,OAAO,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;IACtC,IAAI,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IACpE,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,mBAAmB,CAC1B,KAAe,EACf,OAAe,EACf,GAAW,EACX,GAAW;IAEX,MAAM,GAAG,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;IACjC,MAAM,IAAI,GAAG,KAAK,CAAC,OAAO,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;IACtC,MAAM,SAAS,GAAG,uBAAuB,CAAC,IAAI,CAAC,GAAG,CAAC;QACjD,CAAC,CAAC,GAAG;QACL,CAAC,CAAC,uBAAuB,CAAC,IAAI,CAAC,IAAI,CAAC;YAClC,CAAC,CAAC,IAAI;YACN,CAAC,CAAC,IAAI,CAAC;IACX,IAAI,CAAC,SAAS;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,yBAAyB,EAAE,CAAC;IAErE,IAAI,aAAa,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;QAClC,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;YAC5B,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,GAAG,EAAE,QAAQ,GAAG,+CAA+C;aAChE,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,EAAE,CAAC;YACxB,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,GAAG,EAAE,0DAA0D;aAChE,CAAC;QACJ,CAAC;IACH,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;AACtB,CAAC;AAED,MAAM,UAAU,kBAAkB,CAAC,OAAyB;IAC1D,MAAM,EAAE,IAAI,EAAE,GAAG,OAAO,CAAC;IACzB,MAAM,QAAQ,GAAmB,EAAE,CAAC;IAEpC,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QAC9B,IAAI,CAAC,gCAAgC,CAAC,IAAI,CAAC,IAAI,CAAC;YAAE,SAAS;QAC3D,IAAI,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC;YAAE,SAAS;QACrC,MAAM,GAAG,GAAG,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;QAEjC,MAAM,QAAQ,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC;QACpC,IAAI,QAAQ,KAAK,IAAI,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,aAAa,CAAC;YAAE,SAAS;QAErE,MAAM,KAAK,GAAG,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAEnC,cAAc,CAAC,SAAS,GAAG,CAAC,CAAC;QAC7B,IAAI,CAAyB,CAAC;QAC9B,OAAO,CAAC,CAAC,GAAG,cAAc,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;YACpD,MAAM,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;YACzB,IAAI,CAAC,GAAG;gBAAE,SAAS;YACnB,MAAM,EAAE,IAAI,EAAE,GAAG,gBAAgB,CAAC,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC;YACrD,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,CAAC;YACzB,MAAM,QAAQ,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;YACtC,MAAM,OAAO,GAAG,QAAQ,CAAC,SAAS,EAAE,CAAC;YACrC,IACE,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC;gBACvB,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC;gBACxB,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC,EACxB,CAAC;gBACD,SAAS;YACX,CAAC;YACD,IAAI,gBAAgB,CAAC,GAAG,CAAC;gBAAE,SAAS;YACpC,IAAI,eAAe,CAAC,KAAK,EAAE,OAAO,CAAC,EAAE,CAAC;gBACpC,MAAM,OAAO,GAAG,mBAAmB,CAAC,KAAK,EAAE,OAAO,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC;gBAC9D,IAAI,OAAO,CAAC,EAAE;oBAAE,SAAS;gBACzB,QAAQ,CAAC,IAAI,CAAC;oBACZ,IAAI,EAAE,GAAG;oBACT,IAAI;oBACJ,OAAO,EAAE,eAAe,GAAG,qBAAqB,OAAO,CAAC,GAAG,EAAE;iBAC9D,CAAC,CAAC;gBACH,SAAS;YACX,CAAC;YACD,QAAQ,CAAC,IAAI,CAAC;gBACZ,IAAI,EAAE,GAAG;gBACT,IAAI;gBACJ,OAAO,EAAE,eAAe,GAAG,gJAAgJ;aAC5K,CAAC,CAAC;QACL,CAAC;QAED,sBAAsB,CAAC,SAAS,GAAG,CAAC,CAAC;QACrC,OAAO,CAAC,CAAC,GAAG,sBAAsB,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;YAC5D,MAAM,EAAE,IAAI,EAAE,GAAG,gBAAgB,CAAC,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC;YACrD,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,CAAC;YACzB,MAAM,QAAQ,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;YACtC,MAAM,OAAO,GAAG,QAAQ,CAAC,SAAS,EAAE,CAAC;YACrC,IACE,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC;gBACvB,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC;gBACxB,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC,EACxB,CAAC;gBACD,SAAS;YACX,CAAC;YACD,IAAI,eAAe,CAAC,KAAK,EAAE,OAAO,CAAC,EAAE,CAAC;gBACpC,MAAM,OAAO,GAAG,mBAAmB,CAAC,KAAK,EAAE,OAAO,EAAE,WAAW,EAAE,GAAG,CAAC,CAAC;gBACtE,IAAI,OAAO,CAAC,EAAE;oBAAE,SAAS;gBACzB,QAAQ,CAAC,IAAI,CAAC;oBACZ,IAAI,EAAE,GAAG;oBACT,IAAI;oBACJ,OAAO,EAAE,2CAA2C,OAAO,CAAC,GAAG,EAAE;iBAClE,CAAC,CAAC;gBACH,SAAS;YACX,CAAC;YACD,QAAQ,CAAC,IAAI,CAAC;gBACZ,IAAI,EAAE,GAAG;gBACT,IAAI;gBACJ,OAAO,EAAE,iFAAiF;aAC3F,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,OAAO,EAAE,IAAI,EAAE,oBAAoB,EAAE,QAAQ,EAAE,CAAC;AAClD,CAAC","sourcesContent":["/**\n * scanEnvCredentials — ported from `scripts/guard-no-env-credentials.mjs`.\n *\n * User credentials are per-user (or per-org) data. They MUST live in SQL,\n * scoped by `userEmail` / `orgId`, never in `process.env` — a deployment's\n * env vars are shared by every signed-in user. This guard flags any\n * `process.env.<KEY>` / `process.env[\"KEY\"]` read whose key is not on the\n * deploy-level allowlist (`DATABASE_URL`, `BETTER_AUTH_SECRET`, etc.), plus\n * any dynamic `process.env[key]` read (the key is only known at runtime, so\n * it can never be allowlisted safely).\n *\n * Conditional guard — per report 005's V1 guard set table, this is \"the big\n * one\": the original only scans a curated set of monorepo subtrees\n * (`packages/core/src/{credentials,secrets,vault,agent}/`, template\n * credential libs/routes) via `FORBIDDEN_PATH_PREDICATES` — none of which\n * exist in a generated app, so nothing would ever be scanned. This port\n * replaces that default-allow-outside-a-curated-subtree behavior with\n * default-deny across the whole app source tree: every `process.env.<KEY>`\n * read anywhere in app source must be on the deploy-var allowlist (kept\n * verbatim) or carry the opt-out marker. `HIGH_RISK_ENV_KEY_ALLOWLIST`,\n * `HIGH_RISK_PROCESS_ENV_ALLOWLIST`, and `HIGH_RISK_ENV_VARS_WRITE_ALLOWLIST`\n * — the three monorepo-file-keyed exception maps for specific template\n * platform-adapter files — are dropped entirely per the report; with\n * default-deny scanning already covering every `process.env` read\n * everywhere, the narrower `env-config.ts`/`core-routes.ts`-specific\n * registration checks those maps supported become redundant (any\n * high-risk key would already be caught by the general scan) and are\n * dropped along with them. The per-line `// guard:allow-env-credential`\n * marker remains the only escape hatch.\n *\n * Opt-out (same line, or the line immediately above):\n *   process.env.SOMETHING // guard:allow-env-credential — short reason\n */\n\nimport {\n  lineColForOffset,\n  readFileSafe,\n  relPosix,\n  walk,\n} from \"./scan-utils.js\";\nimport type { GuardFinding, GuardResult, GuardScanOptions } from \"./types.js\";\n\nconst ALLOWLIST_EXACT = new Set([\n  \"DATABASE_URL\",\n  \"DATABASE_AUTH_TOKEN\",\n  \"NODE_ENV\",\n  \"CI\",\n  \"DEBUG\",\n  \"NETLIFY\",\n  \"VERCEL\",\n  \"RENDER\",\n  \"FLY_APP_NAME\",\n  \"K_SERVICE\",\n  \"AWS_LAMBDA_FUNCTION_NAME\",\n  \"BETTER_AUTH_SECRET\",\n  \"BETTER_AUTH_URL\",\n  \"NOTION_CLIENT_ID\",\n  \"NOTION_CLIENT_SECRET\",\n  \"NOTION_STATE_SECRET\",\n  \"GOOGLE_SIGN_IN_CLIENT_ID\",\n  \"GOOGLE_SIGN_IN_CLIENT_SECRET\",\n  \"AUTH_SECRET\",\n  \"A2A_SECRET\",\n  \"ACCESS_TOKEN\",\n  \"PORT\",\n  \"HOST\",\n  \"SECRETS_ENCRYPTION_KEY\",\n]);\n\nconst ALLOWLIST_PREFIX = [\n  \"npm_\",\n  \"AGENT_NATIVE_\",\n  \"AGENT_\",\n  \"NETLIFY_\",\n  \"VERCEL_\",\n  \"CF_\",\n];\n\n/** Dev-only paths where ANTHROPIC_API_KEY etc. may legitimately be read\n * from env (local dev tooling, scripts, tests). Portable subset of the\n * original — the monorepo-only `packages/core/src/dev` predicate is\n * dropped (see report 005's V1 guard set table). */\nconst DEV_ONLY_PATH_PATTERNS = [\n  /\\.spec\\.[tj]sx?$/,\n  /\\.test\\.[tj]sx?$/,\n  /^scripts\\//,\n];\n\nconst DEV_ONLY_KEYS = new Set([\"ANTHROPIC_API_KEY\"]);\n\nconst OPT_OUT_MARKER = /\\/\\/\\s*guard:allow-env-credential\\b[^\\n]*/;\nconst OPT_OUT_REQUIRES_REASON = /\\/\\/\\s*guard:allow-env-credential\\s*[—-]\\s*\\S/;\n\nconst ENV_READ_REGEX =\n  /process\\.env(?:\\.([A-Z][A-Z0-9_]*)|\\[\\s*[\"']([A-Z][A-Z0-9_]*)[\"']\\s*\\])/g;\n\nconst ENV_DYNAMIC_READ_REGEX =\n  /process\\.env(?:\\?\\.)?\\s*\\[\\s*(?![\"'])([^\\]\\n]+?)\\s*\\]/g;\n\nfunction isAllowlistedKey(key: string): boolean {\n  if (ALLOWLIST_EXACT.has(key)) return true;\n  return ALLOWLIST_PREFIX.some((prefix) => key.startsWith(prefix));\n}\n\nfunction isDevOnlyPath(rel: string): boolean {\n  return DEV_ONLY_PATH_PATTERNS.some((re) => re.test(rel));\n}\n\nfunction hasOptOutOnLine(lines: string[], lineIdx: number): boolean {\n  const cur = lines[lineIdx] ?? \"\";\n  if (OPT_OUT_MARKER.test(cur)) return true;\n  const prev = lines[lineIdx - 1] ?? \"\";\n  if (/^\\s*\\/\\//.test(prev) && OPT_OUT_MARKER.test(prev)) return true;\n  return false;\n}\n\nfunction optOutOnLineIsValid(\n  lines: string[],\n  lineIdx: number,\n  key: string,\n  rel: string,\n): { ok: boolean; why?: string } {\n  const cur = lines[lineIdx] ?? \"\";\n  const prev = lines[lineIdx - 1] ?? \"\";\n  const candidate = OPT_OUT_REQUIRES_REASON.test(cur)\n    ? cur\n    : OPT_OUT_REQUIRES_REASON.test(prev)\n      ? prev\n      : null;\n  if (!candidate) return { ok: false, why: \"missing or empty reason\" };\n\n  if (/dev-only\\b/i.test(candidate)) {\n    if (!DEV_ONLY_KEYS.has(key)) {\n      return {\n        ok: false,\n        why: `key \"${key}\" is not in the dev-only credential allowlist`,\n      };\n    }\n    if (!isDevOnlyPath(rel)) {\n      return {\n        ok: false,\n        why: \"dev-only opt-out used outside dev / scripts / test paths\",\n      };\n    }\n  }\n  return { ok: true };\n}\n\nexport function scanEnvCredentials(options: GuardScanOptions): GuardResult {\n  const { root } = options;\n  const findings: GuardFinding[] = [];\n\n  for (const file of walk(root)) {\n    if (!/\\.(ts|tsx|mts|cts|js|mjs|cjs)$/.test(file)) continue;\n    if (file.endsWith(\".d.ts\")) continue;\n    const rel = relPosix(root, file);\n\n    const contents = readFileSafe(file);\n    if (contents === null || !contents.includes(\"process.env\")) continue;\n\n    const lines = contents.split(\"\\n\");\n\n    ENV_READ_REGEX.lastIndex = 0;\n    let m: RegExpExecArray | null;\n    while ((m = ENV_READ_REGEX.exec(contents)) !== null) {\n      const key = m[1] ?? m[2];\n      if (!key) continue;\n      const { line } = lineColForOffset(contents, m.index);\n      const lineIdx = line - 1;\n      const lineText = lines[lineIdx] ?? \"\";\n      const trimmed = lineText.trimStart();\n      if (\n        trimmed.startsWith(\"*\") ||\n        trimmed.startsWith(\"//\") ||\n        trimmed.startsWith(\"/*\")\n      ) {\n        continue;\n      }\n      if (isAllowlistedKey(key)) continue;\n      if (hasOptOutOnLine(lines, lineIdx)) {\n        const verdict = optOutOnLineIsValid(lines, lineIdx, key, rel);\n        if (verdict.ok) continue;\n        findings.push({\n          file: rel,\n          line,\n          message: `process.env.${key} opt-out invalid: ${verdict.why}`,\n        });\n        continue;\n      }\n      findings.push({\n        file: rel,\n        line,\n        message: `process.env.${key} read — not a deploy-level allowlisted key. User credentials must be read via resolveCredential(key, { userEmail, orgId }), never process.env.`,\n      });\n    }\n\n    ENV_DYNAMIC_READ_REGEX.lastIndex = 0;\n    while ((m = ENV_DYNAMIC_READ_REGEX.exec(contents)) !== null) {\n      const { line } = lineColForOffset(contents, m.index);\n      const lineIdx = line - 1;\n      const lineText = lines[lineIdx] ?? \"\";\n      const trimmed = lineText.trimStart();\n      if (\n        trimmed.startsWith(\"*\") ||\n        trimmed.startsWith(\"//\") ||\n        trimmed.startsWith(\"/*\")\n      ) {\n        continue;\n      }\n      if (hasOptOutOnLine(lines, lineIdx)) {\n        const verdict = optOutOnLineIsValid(lines, lineIdx, \"<dynamic>\", rel);\n        if (verdict.ok) continue;\n        findings.push({\n          file: rel,\n          line,\n          message: `process.env[<dynamic>] opt-out invalid: ${verdict.why}`,\n        });\n        continue;\n      }\n      findings.push({\n        file: rel,\n        line,\n        message: `process.env[<dynamic key>] read — dynamic keys can never be allowlisted safely.`,\n      });\n    }\n  }\n\n  return { name: \"no-env-credentials\", findings };\n}\n"]}

package/dist/guards/no-env-mutation.d.ts

@@ -0,0 +1,23 @@
+/**
+ * scanEnvMutation — ported from `scripts/guard-no-env-mutation.mjs`.
+ *
+ * Refuse to let production code MUTATE `process.env` (e.g.
+ * `process.env.AGENT_USER_EMAIL = userEmail`). `process.env` is
+ * process-scoped, not request-scoped — on serverless, every warm container
+ * handles many concurrent requests in one Node process, so mutating
+ * `process.env` in a request handler leaks state across requests. Use
+ * `runWithRequestContext` instead.
+ *
+ * Conditional guard — per report 005's V1 guard set table: the original
+ * has 9 `ALLOWED_PATH_PREDICATES`; 4 are monorepo-only
+ * (`packages/core/src/dev`, `templates/*\/test(s)/`, `packages/cli/`,
+ * `packages/create-agent-native/`) and dropped here. The 5 portable ones
+ * (`scripts/**`, `*.spec.*`, `*.test.*`, `/cli/`, `/scaffold/`) are kept
+ * verbatim — they already work unmodified for a generated app.
+ *
+ * Opt-out (same line, or the line immediately above):
+ *   process.env.X = y // guard:allow-env-mutation — short reason
+ */
+import type { GuardResult, GuardScanOptions } from "./types.js";
+export declare function scanEnvMutation(options: GuardScanOptions): GuardResult;
+//# sourceMappingURL=no-env-mutation.d.ts.map

package/dist/guards/no-env-mutation.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"no-env-mutation.d.ts","sourceRoot":"","sources":["../../src/guards/no-env-mutation.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AASH,OAAO,KAAK,EAAgB,WAAW,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AA+C9E,wBAAgB,eAAe,CAAC,OAAO,EAAE,gBAAgB,GAAG,WAAW,CAsCtE"}

package/dist/guards/no-env-mutation.js

@@ -0,0 +1,90 @@
+/**
+ * scanEnvMutation — ported from `scripts/guard-no-env-mutation.mjs`.
+ *
+ * Refuse to let production code MUTATE `process.env` (e.g.
+ * `process.env.AGENT_USER_EMAIL = userEmail`). `process.env` is
+ * process-scoped, not request-scoped — on serverless, every warm container
+ * handles many concurrent requests in one Node process, so mutating
+ * `process.env` in a request handler leaks state across requests. Use
+ * `runWithRequestContext` instead.
+ *
+ * Conditional guard — per report 005's V1 guard set table: the original
+ * has 9 `ALLOWED_PATH_PREDICATES`; 4 are monorepo-only
+ * (`packages/core/src/dev`, `templates/*\/test(s)/`, `packages/cli/`,
+ * `packages/create-agent-native/`) and dropped here. The 5 portable ones
+ * (`scripts/**`, `*.spec.*`, `*.test.*`, `/cli/`, `/scaffold/`) are kept
+ * verbatim — they already work unmodified for a generated app.
+ *
+ * Opt-out (same line, or the line immediately above):
+ *   process.env.X = y // guard:allow-env-mutation — short reason
+ */
+import { isCommentLine, lineColForOffset, readFileSafe, relPosix, walk, } from "./scan-utils.js";
+const ALLOWED_PATH_PREDICATES = [
+    (rel) => /^scripts\//.test(rel),
+    (rel) => /\.spec\.[tj]sx?$/.test(rel),
+    (rel) => /\.test\.[tj]sx?$/.test(rel),
+    (rel) => /\/cli\//.test(rel),
+    (rel) => /\/scaffold\//.test(rel),
+];
+const OPT_OUT_MARKER = /\/\/\s*guard:allow-env-mutation\b[^\n]*/;
+const OPT_OUT_REQUIRES_REASON = /\/\/\s*guard:allow-env-mutation\s*[—-]\s*\S/;
+const ASSIGN_TAIL = String.raw `(?:\s*(?:=(?!=)|\+=|-=|\*=|/=|\?\?=|\|\|=|&&=))`;
+const MEMBER_FORM = new RegExp(String.raw `process\.env\.[A-Z_][A-Z0-9_]*${ASSIGN_TAIL}`, "g");
+const BRACKET_FORM = new RegExp(String.raw `process\.env\[\s*["'][A-Z_][A-Z0-9_]+["']\s*\]${ASSIGN_TAIL}`, "g");
+const DELETE_MEMBER_FORM = new RegExp(String.raw `\bdelete\s+process\.env\.[A-Z_][A-Z0-9_]*\b`, "g");
+const DELETE_BRACKET_FORM = new RegExp(String.raw `\bdelete\s+process\.env\[\s*["'][A-Z_][A-Z0-9_]+["']\s*\]`, "g");
+function isAllowedPath(rel) {
+    return ALLOWED_PATH_PREDICATES.some((p) => p(rel));
+}
+function hasValidOptOut(lines, lineIdx) {
+    const cur = lines[lineIdx] ?? "";
+    if (OPT_OUT_MARKER.test(cur)) {
+        return OPT_OUT_REQUIRES_REASON.test(cur);
+    }
+    const prev = lines[lineIdx - 1] ?? "";
+    if (/^\s*\/\//.test(prev) && OPT_OUT_MARKER.test(prev)) {
+        return OPT_OUT_REQUIRES_REASON.test(prev);
+    }
+    return false;
+}
+export function scanEnvMutation(options) {
+    const { root } = options;
+    const findings = [];
+    for (const file of walk(root)) {
+        if (!/\.(ts|tsx|mts|cts|js|mjs|cjs)$/.test(file))
+            continue;
+        if (file.endsWith(".d.ts"))
+            continue;
+        const rel = relPosix(root, file);
+        if (isAllowedPath(rel))
+            continue;
+        const contents = readFileSafe(file);
+        if (contents === null || !contents.includes("process.env"))
+            continue;
+        const lines = contents.split("\n");
+        for (const re of [
+            MEMBER_FORM,
+            BRACKET_FORM,
+            DELETE_MEMBER_FORM,
+            DELETE_BRACKET_FORM,
+        ]) {
+            re.lastIndex = 0;
+            let m;
+            while ((m = re.exec(contents)) !== null) {
+                const { line } = lineColForOffset(contents, m.index);
+                const lineText = lines[line - 1] ?? "";
+                if (isCommentLine(lineText))
+                    continue;
+                if (hasValidOptOut(lines, line - 1))
+                    continue;
+                findings.push({
+                    file: rel,
+                    line,
+                    message: `process.env mutated in production code: ${lineText.trim()}. process.env is process-scoped, not request-scoped — use runWithRequestContext instead.`,
+                });
+            }
+        }
+    }
+    return { name: "no-env-mutation", findings };
+}
+//# sourceMappingURL=no-env-mutation.js.map

package/dist/guards/no-env-mutation.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"no-env-mutation.js","sourceRoot":"","sources":["../../src/guards/no-env-mutation.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,OAAO,EACL,aAAa,EACb,gBAAgB,EAChB,YAAY,EACZ,QAAQ,EACR,IAAI,GACL,MAAM,iBAAiB,CAAC;AAGzB,MAAM,uBAAuB,GAAoC;IAC/D,CAAC,GAAG,EAAE,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,GAAG,CAAC;IAC/B,CAAC,GAAG,EAAE,EAAE,CAAC,kBAAkB,CAAC,IAAI,CAAC,GAAG,CAAC;IACrC,CAAC,GAAG,EAAE,EAAE,CAAC,kBAAkB,CAAC,IAAI,CAAC,GAAG,CAAC;IACrC,CAAC,GAAG,EAAE,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,GAAG,CAAC;IAC5B,CAAC,GAAG,EAAE,EAAE,CAAC,cAAc,CAAC,IAAI,CAAC,GAAG,CAAC;CAClC,CAAC;AAEF,MAAM,cAAc,GAAG,yCAAyC,CAAC;AACjE,MAAM,uBAAuB,GAAG,6CAA6C,CAAC;AAE9E,MAAM,WAAW,GAAG,MAAM,CAAC,GAAG,CAAA,iDAAiD,CAAC;AAChF,MAAM,WAAW,GAAG,IAAI,MAAM,CAC5B,MAAM,CAAC,GAAG,CAAA,iCAAiC,WAAW,EAAE,EACxD,GAAG,CACJ,CAAC;AACF,MAAM,YAAY,GAAG,IAAI,MAAM,CAC7B,MAAM,CAAC,GAAG,CAAA,iDAAiD,WAAW,EAAE,EACxE,GAAG,CACJ,CAAC;AACF,MAAM,kBAAkB,GAAG,IAAI,MAAM,CACnC,MAAM,CAAC,GAAG,CAAA,6CAA6C,EACvD,GAAG,CACJ,CAAC;AACF,MAAM,mBAAmB,GAAG,IAAI,MAAM,CACpC,MAAM,CAAC,GAAG,CAAA,2DAA2D,EACrE,GAAG,CACJ,CAAC;AAEF,SAAS,aAAa,CAAC,GAAW;IAChC,OAAO,uBAAuB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;AACrD,CAAC;AAED,SAAS,cAAc,CAAC,KAAe,EAAE,OAAe;IACtD,MAAM,GAAG,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;IACjC,IAAI,cAAc,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;QAC7B,OAAO,uBAAuB,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC3C,CAAC;IACD,MAAM,IAAI,GAAG,KAAK,CAAC,OAAO,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;IACtC,IAAI,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QACvD,OAAO,uBAAuB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC5C,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,OAAyB;IACvD,MAAM,EAAE,IAAI,EAAE,GAAG,OAAO,CAAC;IACzB,MAAM,QAAQ,GAAmB,EAAE,CAAC;IAEpC,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QAC9B,IAAI,CAAC,gCAAgC,CAAC,IAAI,CAAC,IAAI,CAAC;YAAE,SAAS;QAC3D,IAAI,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC;YAAE,SAAS;QACrC,MAAM,GAAG,GAAG,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;QACjC,IAAI,aAAa,CAAC,GAAG,CAAC;YAAE,SAAS;QAEjC,MAAM,QAAQ,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC;QACpC,IAAI,QAAQ,KAAK,IAAI,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,aAAa,CAAC;YAAE,SAAS;QAErE,MAAM,KAAK,GAAG,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAEnC,KAAK,MAAM,EAAE,IAAI;YACf,WAAW;YACX,YAAY;YACZ,kBAAkB;YAClB,mBAAmB;SACpB,EAAE,CAAC;YACF,EAAE,CAAC,SAAS,GAAG,CAAC,CAAC;YACjB,IAAI,CAAyB,CAAC;YAC9B,OAAO,CAAC,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;gBACxC,MAAM,EAAE,IAAI,EAAE,GAAG,gBAAgB,CAAC,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC;gBACrD,MAAM,QAAQ,GAAG,KAAK,CAAC,IAAI,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;gBACvC,IAAI,aAAa,CAAC,QAAQ,CAAC;oBAAE,SAAS;gBACtC,IAAI,cAAc,CAAC,KAAK,EAAE,IAAI,GAAG,CAAC,CAAC;oBAAE,SAAS;gBAC9C,QAAQ,CAAC,IAAI,CAAC;oBACZ,IAAI,EAAE,GAAG;oBACT,IAAI;oBACJ,OAAO,EAAE,2CAA2C,QAAQ,CAAC,IAAI,EAAE,0FAA0F;iBAC9J,CAAC,CAAC;YACL,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO,EAAE,IAAI,EAAE,iBAAiB,EAAE,QAAQ,EAAE,CAAC;AAC/C,CAAC","sourcesContent":["/**\n * scanEnvMutation — ported from `scripts/guard-no-env-mutation.mjs`.\n *\n * Refuse to let production code MUTATE `process.env` (e.g.\n * `process.env.AGENT_USER_EMAIL = userEmail`). `process.env` is\n * process-scoped, not request-scoped — on serverless, every warm container\n * handles many concurrent requests in one Node process, so mutating\n * `process.env` in a request handler leaks state across requests. Use\n * `runWithRequestContext` instead.\n *\n * Conditional guard — per report 005's V1 guard set table: the original\n * has 9 `ALLOWED_PATH_PREDICATES`; 4 are monorepo-only\n * (`packages/core/src/dev`, `templates/*\\/test(s)/`, `packages/cli/`,\n * `packages/create-agent-native/`) and dropped here. The 5 portable ones\n * (`scripts/**`, `*.spec.*`, `*.test.*`, `/cli/`, `/scaffold/`) are kept\n * verbatim — they already work unmodified for a generated app.\n *\n * Opt-out (same line, or the line immediately above):\n *   process.env.X = y // guard:allow-env-mutation — short reason\n */\n\nimport {\n  isCommentLine,\n  lineColForOffset,\n  readFileSafe,\n  relPosix,\n  walk,\n} from \"./scan-utils.js\";\nimport type { GuardFinding, GuardResult, GuardScanOptions } from \"./types.js\";\n\nconst ALLOWED_PATH_PREDICATES: Array<(rel: string) => boolean> = [\n  (rel) => /^scripts\\//.test(rel),\n  (rel) => /\\.spec\\.[tj]sx?$/.test(rel),\n  (rel) => /\\.test\\.[tj]sx?$/.test(rel),\n  (rel) => /\\/cli\\//.test(rel),\n  (rel) => /\\/scaffold\\//.test(rel),\n];\n\nconst OPT_OUT_MARKER = /\\/\\/\\s*guard:allow-env-mutation\\b[^\\n]*/;\nconst OPT_OUT_REQUIRES_REASON = /\\/\\/\\s*guard:allow-env-mutation\\s*[—-]\\s*\\S/;\n\nconst ASSIGN_TAIL = String.raw`(?:\\s*(?:=(?!=)|\\+=|-=|\\*=|/=|\\?\\?=|\\|\\|=|&&=))`;\nconst MEMBER_FORM = new RegExp(\n  String.raw`process\\.env\\.[A-Z_][A-Z0-9_]*${ASSIGN_TAIL}`,\n  \"g\",\n);\nconst BRACKET_FORM = new RegExp(\n  String.raw`process\\.env\\[\\s*[\"'][A-Z_][A-Z0-9_]+[\"']\\s*\\]${ASSIGN_TAIL}`,\n  \"g\",\n);\nconst DELETE_MEMBER_FORM = new RegExp(\n  String.raw`\\bdelete\\s+process\\.env\\.[A-Z_][A-Z0-9_]*\\b`,\n  \"g\",\n);\nconst DELETE_BRACKET_FORM = new RegExp(\n  String.raw`\\bdelete\\s+process\\.env\\[\\s*[\"'][A-Z_][A-Z0-9_]+[\"']\\s*\\]`,\n  \"g\",\n);\n\nfunction isAllowedPath(rel: string): boolean {\n  return ALLOWED_PATH_PREDICATES.some((p) => p(rel));\n}\n\nfunction hasValidOptOut(lines: string[], lineIdx: number): boolean {\n  const cur = lines[lineIdx] ?? \"\";\n  if (OPT_OUT_MARKER.test(cur)) {\n    return OPT_OUT_REQUIRES_REASON.test(cur);\n  }\n  const prev = lines[lineIdx - 1] ?? \"\";\n  if (/^\\s*\\/\\//.test(prev) && OPT_OUT_MARKER.test(prev)) {\n    return OPT_OUT_REQUIRES_REASON.test(prev);\n  }\n  return false;\n}\n\nexport function scanEnvMutation(options: GuardScanOptions): GuardResult {\n  const { root } = options;\n  const findings: GuardFinding[] = [];\n\n  for (const file of walk(root)) {\n    if (!/\\.(ts|tsx|mts|cts|js|mjs|cjs)$/.test(file)) continue;\n    if (file.endsWith(\".d.ts\")) continue;\n    const rel = relPosix(root, file);\n    if (isAllowedPath(rel)) continue;\n\n    const contents = readFileSafe(file);\n    if (contents === null || !contents.includes(\"process.env\")) continue;\n\n    const lines = contents.split(\"\\n\");\n\n    for (const re of [\n      MEMBER_FORM,\n      BRACKET_FORM,\n      DELETE_MEMBER_FORM,\n      DELETE_BRACKET_FORM,\n    ]) {\n      re.lastIndex = 0;\n      let m: RegExpExecArray | null;\n      while ((m = re.exec(contents)) !== null) {\n        const { line } = lineColForOffset(contents, m.index);\n        const lineText = lines[line - 1] ?? \"\";\n        if (isCommentLine(lineText)) continue;\n        if (hasValidOptOut(lines, line - 1)) continue;\n        findings.push({\n          file: rel,\n          line,\n          message: `process.env mutated in production code: ${lineText.trim()}. process.env is process-scoped, not request-scoped — use runWithRequestContext instead.`,\n        });\n      }\n    }\n  }\n\n  return { name: \"no-env-mutation\", findings };\n}\n"]}

package/dist/guards/no-localhost-fallback.d.ts

@@ -0,0 +1,30 @@
+/**
+ * scanLocalhostFallback — ported from
+ * `scripts/guard-no-localhost-fallback.mjs`.
+ *
+ * Refuse to let production code use the literal `local@localhost` (or the
+ * `DEV_MODE_USER_EMAIL` symbolic alias) as a fallback identity when no
+ * session is present — that pools every unauthenticated request onto one
+ * shared tenant. The right behavior in production is to throw/401 when
+ * there's no session, not fall back to a sentinel identity.
+ *
+ * Conditional guard — per report 005's V1 guard set table: the original
+ * hardcodes framework-file exemptions (`packages/core/src/server/auth.ts`,
+ * `packages/core/src/org/context.ts`, etc. — files that either define or
+ * intentionally handle the dev-mode sentinel). Those live in `node_modules`
+ * for a generated app and are already excluded by `SKIP_DIRS`, so they're
+ * moved behind an optional `extraExemptPaths` param (default `[]`) instead
+ * of hardcoded. The generic allowlist predicates (`*.spec.*`, `*.test.*`,
+ * `scripts/**`, `**\/seed(s)/**`) are kept verbatim.
+ *
+ * Opt-out (same line, or the line immediately above):
+ *   const x = email ?? "local@localhost" // guard:allow-localhost-fallback — short reason
+ */
+import type { GuardResult, GuardScanOptions } from "./types.js";
+export interface LocalhostFallbackOptions extends GuardScanOptions {
+    /** Exact repo-relative paths to exempt in addition to the generic
+     * predicates (spec/test/scripts/seed). Default `[]`. */
+    extraExemptPaths?: string[];
+}
+export declare function scanLocalhostFallback(options: LocalhostFallbackOptions): GuardResult;
+//# sourceMappingURL=no-localhost-fallback.d.ts.map

package/dist/guards/no-localhost-fallback.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"no-localhost-fallback.d.ts","sourceRoot":"","sources":["../../src/guards/no-localhost-fallback.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AASH,OAAO,KAAK,EAAgB,WAAW,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AAE9E,MAAM,WAAW,wBAAyB,SAAQ,gBAAgB;IAChE;4DACwD;IACxD,gBAAgB,CAAC,EAAE,MAAM,EAAE,CAAC;CAC7B;AAsCD,wBAAgB,qBAAqB,CACnC,OAAO,EAAE,wBAAwB,GAChC,WAAW,CA+Cb"}

package/dist/guards/no-localhost-fallback.js

@@ -0,0 +1,105 @@
+/**
+ * scanLocalhostFallback — ported from
+ * `scripts/guard-no-localhost-fallback.mjs`.
+ *
+ * Refuse to let production code use the literal `local@localhost` (or the
+ * `DEV_MODE_USER_EMAIL` symbolic alias) as a fallback identity when no
+ * session is present — that pools every unauthenticated request onto one
+ * shared tenant. The right behavior in production is to throw/401 when
+ * there's no session, not fall back to a sentinel identity.
+ *
+ * Conditional guard — per report 005's V1 guard set table: the original
+ * hardcodes framework-file exemptions (`packages/core/src/server/auth.ts`,
+ * `packages/core/src/org/context.ts`, etc. — files that either define or
+ * intentionally handle the dev-mode sentinel). Those live in `node_modules`
+ * for a generated app and are already excluded by `SKIP_DIRS`, so they're
+ * moved behind an optional `extraExemptPaths` param (default `[]`) instead
+ * of hardcoded. The generic allowlist predicates (`*.spec.*`, `*.test.*`,
+ * `scripts/**`, `**\/seed(s)/**`) are kept verbatim.
+ *
+ * Opt-out (same line, or the line immediately above):
+ *   const x = email ?? "local@localhost" // guard:allow-localhost-fallback — short reason
+ */
+import { isCommentLine, lineColForOffset, readFileSafe, relPosix, walk, } from "./scan-utils.js";
+const GENERIC_ALLOWED_PATH_PREDICATES = [
+    (rel) => /\.spec\.[tj]sx?$/.test(rel),
+    (rel) => /\.test\.[tj]sx?$/.test(rel),
+    (rel) => /^scripts\//.test(rel),
+    (rel) => /\/seed\//.test(rel),
+    (rel) => /\/seeds\//.test(rel),
+];
+const OPT_OUT_MARKER = /\/\/\s*guard:allow-localhost-fallback\b[^\n]*/;
+const OPT_OUT_REQUIRES_REASON = /\/\/\s*guard:allow-localhost-fallback\s*[—-]\s*\S/;
+const LITERAL_RE = /(?:"local@localhost"|'local@localhost'|`local@localhost`)/g;
+const SYMBOLIC_FALLBACK_RE = /(?:\?\?|\|\|)\s*DEV_MODE_USER_EMAIL\b/g;
+const SQL_DEFAULT_RE = /\bDEFAULT\s+['"`]local@localhost['"`]/i;
+const DRIZZLE_DEFAULT_RE = /\.default\s*\(\s*['"`]local@localhost['"`]\s*\)/;
+function isAllowedPath(rel, extraExemptPaths) {
+    if (extraExemptPaths?.includes(rel))
+        return true;
+    return GENERIC_ALLOWED_PATH_PREDICATES.some((p) => p(rel));
+}
+function hasValidOptOut(lines, lineIdx) {
+    const cur = lines[lineIdx] ?? "";
+    if (OPT_OUT_MARKER.test(cur)) {
+        return OPT_OUT_REQUIRES_REASON.test(cur);
+    }
+    const prev = lines[lineIdx - 1] ?? "";
+    if (/^\s*\/\//.test(prev) && OPT_OUT_MARKER.test(prev)) {
+        return OPT_OUT_REQUIRES_REASON.test(prev);
+    }
+    return false;
+}
+export function scanLocalhostFallback(options) {
+    const { root, extraExemptPaths } = options;
+    const findings = [];
+    for (const file of walk(root)) {
+        if (!/\.(ts|tsx|mts|cts|js|mjs|cjs)$/.test(file))
+            continue;
+        if (file.endsWith(".d.ts"))
+            continue;
+        const rel = relPosix(root, file);
+        if (isAllowedPath(rel, extraExemptPaths))
+            continue;
+        const contents = readFileSafe(file);
+        if (contents === null || !contents.includes("local@localhost"))
+            continue;
+        const lines = contents.split("\n");
+        LITERAL_RE.lastIndex = 0;
+        let m;
+        while ((m = LITERAL_RE.exec(contents)) !== null) {
+            const { line } = lineColForOffset(contents, m.index);
+            const lineText = lines[line - 1] ?? "";
+            if (isCommentLine(lineText))
+                continue;
+            if (SQL_DEFAULT_RE.test(lineText))
+                continue;
+            if (DRIZZLE_DEFAULT_RE.test(lineText))
+                continue;
+            if (hasValidOptOut(lines, line - 1))
+                continue;
+            findings.push({
+                file: rel,
+                line,
+                message: `"local@localhost" used as a fallback identity: ${lineText.trim()}. Throw/401 on missing session instead — this pools every unauthenticated request onto one shared tenant.`,
+            });
+        }
+        SYMBOLIC_FALLBACK_RE.lastIndex = 0;
+        let s;
+        while ((s = SYMBOLIC_FALLBACK_RE.exec(contents)) !== null) {
+            const { line } = lineColForOffset(contents, s.index);
+            const lineText = lines[line - 1] ?? "";
+            if (isCommentLine(lineText))
+                continue;
+            if (hasValidOptOut(lines, line - 1))
+                continue;
+            findings.push({
+                file: rel,
+                line,
+                message: `DEV_MODE_USER_EMAIL used as a fallback identity: ${lineText.trim()}. Throw/401 on missing session instead.`,
+            });
+        }
+    }
+    return { name: "no-localhost-fallback", findings };
+}
+//# sourceMappingURL=no-localhost-fallback.js.map

package/dist/guards/no-localhost-fallback.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"no-localhost-fallback.js","sourceRoot":"","sources":["../../src/guards/no-localhost-fallback.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH,OAAO,EACL,aAAa,EACb,gBAAgB,EAChB,YAAY,EACZ,QAAQ,EACR,IAAI,GACL,MAAM,iBAAiB,CAAC;AASzB,MAAM,+BAA+B,GAAoC;IACvE,CAAC,GAAG,EAAE,EAAE,CAAC,kBAAkB,CAAC,IAAI,CAAC,GAAG,CAAC;IACrC,CAAC,GAAG,EAAE,EAAE,CAAC,kBAAkB,CAAC,IAAI,CAAC,GAAG,CAAC;IACrC,CAAC,GAAG,EAAE,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,GAAG,CAAC;IAC/B,CAAC,GAAG,EAAE,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC;IAC7B,CAAC,GAAG,EAAE,EAAE,CAAC,WAAW,CAAC,IAAI,CAAC,GAAG,CAAC;CAC/B,CAAC;AAEF,MAAM,cAAc,GAAG,+CAA+C,CAAC;AACvE,MAAM,uBAAuB,GAC3B,mDAAmD,CAAC;AAEtD,MAAM,UAAU,GAAG,4DAA4D,CAAC;AAEhF,MAAM,oBAAoB,GAAG,wCAAwC,CAAC;AAEtE,MAAM,cAAc,GAAG,wCAAwC,CAAC;AAChE,MAAM,kBAAkB,GAAG,iDAAiD,CAAC;AAE7E,SAAS,aAAa,CAAC,GAAW,EAAE,gBAA2B;IAC7D,IAAI,gBAAgB,EAAE,QAAQ,CAAC,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IACjD,OAAO,+BAA+B,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;AAC7D,CAAC;AAED,SAAS,cAAc,CAAC,KAAe,EAAE,OAAe;IACtD,MAAM,GAAG,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;IACjC,IAAI,cAAc,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;QAC7B,OAAO,uBAAuB,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC3C,CAAC;IACD,MAAM,IAAI,GAAG,KAAK,CAAC,OAAO,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;IACtC,IAAI,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QACvD,OAAO,uBAAuB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC5C,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAM,UAAU,qBAAqB,CACnC,OAAiC;IAEjC,MAAM,EAAE,IAAI,EAAE,gBAAgB,EAAE,GAAG,OAAO,CAAC;IAC3C,MAAM,QAAQ,GAAmB,EAAE,CAAC;IAEpC,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QAC9B,IAAI,CAAC,gCAAgC,CAAC,IAAI,CAAC,IAAI,CAAC;YAAE,SAAS;QAC3D,IAAI,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC;YAAE,SAAS;QACrC,MAAM,GAAG,GAAG,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;QACjC,IAAI,aAAa,CAAC,GAAG,EAAE,gBAAgB,CAAC;YAAE,SAAS;QAEnD,MAAM,QAAQ,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC;QACpC,IAAI,QAAQ,KAAK,IAAI,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,iBAAiB,CAAC;YAAE,SAAS;QAEzE,MAAM,KAAK,GAAG,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAEnC,UAAU,CAAC,SAAS,GAAG,CAAC,CAAC;QACzB,IAAI,CAAyB,CAAC;QAC9B,OAAO,CAAC,CAAC,GAAG,UAAU,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;YAChD,MAAM,EAAE,IAAI,EAAE,GAAG,gBAAgB,CAAC,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC;YACrD,MAAM,QAAQ,GAAG,KAAK,CAAC,IAAI,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;YACvC,IAAI,aAAa,CAAC,QAAQ,CAAC;gBAAE,SAAS;YACtC,IAAI,cAAc,CAAC,IAAI,CAAC,QAAQ,CAAC;gBAAE,SAAS;YAC5C,IAAI,kBAAkB,CAAC,IAAI,CAAC,QAAQ,CAAC;gBAAE,SAAS;YAChD,IAAI,cAAc,CAAC,KAAK,EAAE,IAAI,GAAG,CAAC,CAAC;gBAAE,SAAS;YAC9C,QAAQ,CAAC,IAAI,CAAC;gBACZ,IAAI,EAAE,GAAG;gBACT,IAAI;gBACJ,OAAO,EAAE,kDAAkD,QAAQ,CAAC,IAAI,EAAE,2GAA2G;aACtL,CAAC,CAAC;QACL,CAAC;QAED,oBAAoB,CAAC,SAAS,GAAG,CAAC,CAAC;QACnC,IAAI,CAAyB,CAAC;QAC9B,OAAO,CAAC,CAAC,GAAG,oBAAoB,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;YAC1D,MAAM,EAAE,IAAI,EAAE,GAAG,gBAAgB,CAAC,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC;YACrD,MAAM,QAAQ,GAAG,KAAK,CAAC,IAAI,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;YACvC,IAAI,aAAa,CAAC,QAAQ,CAAC;gBAAE,SAAS;YACtC,IAAI,cAAc,CAAC,KAAK,EAAE,IAAI,GAAG,CAAC,CAAC;gBAAE,SAAS;YAC9C,QAAQ,CAAC,IAAI,CAAC;gBACZ,IAAI,EAAE,GAAG;gBACT,IAAI;gBACJ,OAAO,EAAE,oDAAoD,QAAQ,CAAC,IAAI,EAAE,yCAAyC;aACtH,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,OAAO,EAAE,IAAI,EAAE,uBAAuB,EAAE,QAAQ,EAAE,CAAC;AACrD,CAAC","sourcesContent":["/**\n * scanLocalhostFallback — ported from\n * `scripts/guard-no-localhost-fallback.mjs`.\n *\n * Refuse to let production code use the literal `local@localhost` (or the\n * `DEV_MODE_USER_EMAIL` symbolic alias) as a fallback identity when no\n * session is present — that pools every unauthenticated request onto one\n * shared tenant. The right behavior in production is to throw/401 when\n * there's no session, not fall back to a sentinel identity.\n *\n * Conditional guard — per report 005's V1 guard set table: the original\n * hardcodes framework-file exemptions (`packages/core/src/server/auth.ts`,\n * `packages/core/src/org/context.ts`, etc. — files that either define or\n * intentionally handle the dev-mode sentinel). Those live in `node_modules`\n * for a generated app and are already excluded by `SKIP_DIRS`, so they're\n * moved behind an optional `extraExemptPaths` param (default `[]`) instead\n * of hardcoded. The generic allowlist predicates (`*.spec.*`, `*.test.*`,\n * `scripts/**`, `**\\/seed(s)/**`) are kept verbatim.\n *\n * Opt-out (same line, or the line immediately above):\n *   const x = email ?? \"local@localhost\" // guard:allow-localhost-fallback — short reason\n */\n\nimport {\n  isCommentLine,\n  lineColForOffset,\n  readFileSafe,\n  relPosix,\n  walk,\n} from \"./scan-utils.js\";\nimport type { GuardFinding, GuardResult, GuardScanOptions } from \"./types.js\";\n\nexport interface LocalhostFallbackOptions extends GuardScanOptions {\n  /** Exact repo-relative paths to exempt in addition to the generic\n   * predicates (spec/test/scripts/seed). Default `[]`. */\n  extraExemptPaths?: string[];\n}\n\nconst GENERIC_ALLOWED_PATH_PREDICATES: Array<(rel: string) => boolean> = [\n  (rel) => /\\.spec\\.[tj]sx?$/.test(rel),\n  (rel) => /\\.test\\.[tj]sx?$/.test(rel),\n  (rel) => /^scripts\\//.test(rel),\n  (rel) => /\\/seed\\//.test(rel),\n  (rel) => /\\/seeds\\//.test(rel),\n];\n\nconst OPT_OUT_MARKER = /\\/\\/\\s*guard:allow-localhost-fallback\\b[^\\n]*/;\nconst OPT_OUT_REQUIRES_REASON =\n  /\\/\\/\\s*guard:allow-localhost-fallback\\s*[—-]\\s*\\S/;\n\nconst LITERAL_RE = /(?:\"local@localhost\"|'local@localhost'|`local@localhost`)/g;\n\nconst SYMBOLIC_FALLBACK_RE = /(?:\\?\\?|\\|\\|)\\s*DEV_MODE_USER_EMAIL\\b/g;\n\nconst SQL_DEFAULT_RE = /\\bDEFAULT\\s+['\"`]local@localhost['\"`]/i;\nconst DRIZZLE_DEFAULT_RE = /\\.default\\s*\\(\\s*['\"`]local@localhost['\"`]\\s*\\)/;\n\nfunction isAllowedPath(rel: string, extraExemptPaths?: string[]): boolean {\n  if (extraExemptPaths?.includes(rel)) return true;\n  return GENERIC_ALLOWED_PATH_PREDICATES.some((p) => p(rel));\n}\n\nfunction hasValidOptOut(lines: string[], lineIdx: number): boolean {\n  const cur = lines[lineIdx] ?? \"\";\n  if (OPT_OUT_MARKER.test(cur)) {\n    return OPT_OUT_REQUIRES_REASON.test(cur);\n  }\n  const prev = lines[lineIdx - 1] ?? \"\";\n  if (/^\\s*\\/\\//.test(prev) && OPT_OUT_MARKER.test(prev)) {\n    return OPT_OUT_REQUIRES_REASON.test(prev);\n  }\n  return false;\n}\n\nexport function scanLocalhostFallback(\n  options: LocalhostFallbackOptions,\n): GuardResult {\n  const { root, extraExemptPaths } = options;\n  const findings: GuardFinding[] = [];\n\n  for (const file of walk(root)) {\n    if (!/\\.(ts|tsx|mts|cts|js|mjs|cjs)$/.test(file)) continue;\n    if (file.endsWith(\".d.ts\")) continue;\n    const rel = relPosix(root, file);\n    if (isAllowedPath(rel, extraExemptPaths)) continue;\n\n    const contents = readFileSafe(file);\n    if (contents === null || !contents.includes(\"local@localhost\")) continue;\n\n    const lines = contents.split(\"\\n\");\n\n    LITERAL_RE.lastIndex = 0;\n    let m: RegExpExecArray | null;\n    while ((m = LITERAL_RE.exec(contents)) !== null) {\n      const { line } = lineColForOffset(contents, m.index);\n      const lineText = lines[line - 1] ?? \"\";\n      if (isCommentLine(lineText)) continue;\n      if (SQL_DEFAULT_RE.test(lineText)) continue;\n      if (DRIZZLE_DEFAULT_RE.test(lineText)) continue;\n      if (hasValidOptOut(lines, line - 1)) continue;\n      findings.push({\n        file: rel,\n        line,\n        message: `\"local@localhost\" used as a fallback identity: ${lineText.trim()}. Throw/401 on missing session instead — this pools every unauthenticated request onto one shared tenant.`,\n      });\n    }\n\n    SYMBOLIC_FALLBACK_RE.lastIndex = 0;\n    let s: RegExpExecArray | null;\n    while ((s = SYMBOLIC_FALLBACK_RE.exec(contents)) !== null) {\n      const { line } = lineColForOffset(contents, s.index);\n      const lineText = lines[line - 1] ?? \"\";\n      if (isCommentLine(lineText)) continue;\n      if (hasValidOptOut(lines, line - 1)) continue;\n      findings.push({\n        file: rel,\n        line,\n        message: `DEV_MODE_USER_EMAIL used as a fallback identity: ${lineText.trim()}. Throw/401 on missing session instead.`,\n      });\n    }\n  }\n\n  return { name: \"no-localhost-fallback\", findings };\n}\n"]}

package/dist/guards/no-unscoped-credentials.d.ts

@@ -0,0 +1,28 @@
+/**
+ * scanUnscopedCredentials — ported from
+ * `scripts/guard-no-unscoped-credentials.mjs`.
+ *
+ * Refuse to let any caller invoke `resolveCredential` / `hasCredential` /
+ * `saveCredential` / `deleteCredential` with only one argument. The
+ * contract requires a second argument carrying the per-user / per-org
+ * context object — `(key, { userEmail, orgId })` — so the credential
+ * lookup is scoped to the requesting principal.
+ *
+ * Generic guard, shipped as-is: the detection regex, arg-balancing parser,
+ * and marker semantics are unchanged from the monorepo original. The one
+ * difference from the monorepo script is scan scope: the original restricts
+ * its walk to `packages/`, `templates/`, `app/` — a monorepo-specific
+ * optimization that also happens to exclude its own dotfile/doc trees. A
+ * generated app's source lives at `actions/`, `app/`, `server/` (no
+ * `packages/`/`templates/` wrapper — see report 005's "Path resolution"),
+ * so keeping that literal subtree filter would silently skip `actions/`
+ * and `server/`. This port scans the whole app root (still respecting
+ * `SKIP_DIRS`) instead, which is a superset of the original's coverage and
+ * has no false-negative risk for a single-app tree.
+ *
+ * Opt-out (same line only):
+ *   resolveCredential(key) // guard:allow-unscoped-credential — short reason
+ */
+import type { GuardResult, GuardScanOptions } from "./types.js";
+export declare function scanUnscopedCredentials(options: GuardScanOptions): GuardResult;
+//# sourceMappingURL=no-unscoped-credentials.d.ts.map

package/dist/guards/no-unscoped-credentials.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"no-unscoped-credentials.d.ts","sourceRoot":"","sources":["../../src/guards/no-unscoped-credentials.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAQH,OAAO,KAAK,EAAgB,WAAW,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AAqI9E,wBAAgB,uBAAuB,CACrC,OAAO,EAAE,gBAAgB,GACxB,WAAW,CA2Db"}

package/dist/guards/no-unscoped-credentials.js

@@ -0,0 +1,199 @@
+/**
+ * scanUnscopedCredentials — ported from
+ * `scripts/guard-no-unscoped-credentials.mjs`.
+ *
+ * Refuse to let any caller invoke `resolveCredential` / `hasCredential` /
+ * `saveCredential` / `deleteCredential` with only one argument. The
+ * contract requires a second argument carrying the per-user / per-org
+ * context object — `(key, { userEmail, orgId })` — so the credential
+ * lookup is scoped to the requesting principal.
+ *
+ * Generic guard, shipped as-is: the detection regex, arg-balancing parser,
+ * and marker semantics are unchanged from the monorepo original. The one
+ * difference from the monorepo script is scan scope: the original restricts
+ * its walk to `packages/`, `templates/`, `app/` — a monorepo-specific
+ * optimization that also happens to exclude its own dotfile/doc trees. A
+ * generated app's source lives at `actions/`, `app/`, `server/` (no
+ * `packages/`/`templates/` wrapper — see report 005's "Path resolution"),
+ * so keeping that literal subtree filter would silently skip `actions/`
+ * and `server/`. This port scans the whole app root (still respecting
+ * `SKIP_DIRS`) instead, which is a superset of the original's coverage and
+ * has no false-negative risk for a single-app tree.
+ *
+ * Opt-out (same line only):
+ *   resolveCredential(key) // guard:allow-unscoped-credential — short reason
+ */
+import { lineColForOffset, readFileSafe, relPosix, walk, } from "./scan-utils.js";
+const FUNCTIONS = [
+    "resolveCredential",
+    "hasCredential",
+    "saveCredential",
+    "deleteCredential",
+];
+const FUNC_NAME_RE = new RegExp(`(?<![\\w$.])(${FUNCTIONS.join("|")})\\s*\\(`, "g");
+const OPT_OUT_MARKER = /\/\/\s*guard:allow-unscoped-credential\b[^\n]*[—-]\s*\S/;
+/** Files that legitimately use the one-arg form because they ARE the
+ * implementation under guard — the definition file itself. In an app this
+ * file only ever exists inside `node_modules`, already excluded by
+ * SKIP_DIRS, so this allowlist is effectively a no-op for app mode; kept
+ * for parity with the source guard. */
+const FILE_ALLOWLIST = new Set(["packages/core/src/credentials/index.ts"]);
+/**
+ * Starting at openParenIdx (the index of the `(` after the function name),
+ * walk forward, balancing nested parens / braces / brackets / strings, and
+ * return the top-level comma count. Ported verbatim.
+ */
+function analyzeArgs(contents, openParenIdx) {
+    let depth = 0;
+    let topLevelCommas = 0;
+    let i = openParenIdx;
+    let mode = "code";
+    let templateDepth = 0;
+    while (i < contents.length) {
+        const ch = contents[i];
+        const next = contents[i + 1];
+        if (mode === "code") {
+            if (ch === "/" && next === "/") {
+                while (i < contents.length && contents[i] !== "\n")
+                    i++;
+                continue;
+            }
+            if (ch === "/" && next === "*") {
+                i += 2;
+                while (i < contents.length - 1 &&
+                    !(contents[i] === "*" && contents[i + 1] === "/"))
+                    i++;
+                i += 2;
+                continue;
+            }
+            if (ch === '"' || ch === "'") {
+                mode = ch;
+                i++;
+                continue;
+            }
+            if (ch === "`") {
+                mode = "tmpl";
+                i++;
+                continue;
+            }
+            if (ch === "(" || ch === "[" || ch === "{") {
+                depth++;
+                i++;
+                continue;
+            }
+            if (ch === ")" || ch === "]" || ch === "}") {
+                depth--;
+                if (depth === 0 && ch === ")") {
+                    return { topLevelCommas, endIdx: i };
+                }
+                i++;
+                continue;
+            }
+            if (ch === "," && depth === 1) {
+                topLevelCommas++;
+                i++;
+                continue;
+            }
+            i++;
+            continue;
+        }
+        if (mode === '"' || mode === "'") {
+            if (ch === "\\") {
+                i += 2;
+                continue;
+            }
+            if (ch === mode) {
+                mode = "code";
+                i++;
+                continue;
+            }
+            i++;
+            continue;
+        }
+        if (mode === "tmpl") {
+            if (ch === "\\") {
+                i += 2;
+                continue;
+            }
+            if (ch === "`" && templateDepth === 0) {
+                mode = "code";
+                i++;
+                continue;
+            }
+            if (ch === "$" && next === "{") {
+                templateDepth++;
+                i += 2;
+                continue;
+            }
+            if (ch === "}" && templateDepth > 0) {
+                templateDepth--;
+                i++;
+                continue;
+            }
+            i++;
+            continue;
+        }
+        i++;
+    }
+    return null;
+}
+export function scanUnscopedCredentials(options) {
+    const { root } = options;
+    const findings = [];
+    for (const file of walk(root)) {
+        if (!/\.(ts|tsx|mts|cts|js|mjs|cjs)$/.test(file))
+            continue;
+        if (file.endsWith(".d.ts"))
+            continue;
+        const rel = relPosix(root, file);
+        if (FILE_ALLOWLIST.has(rel))
+            continue;
+        const contents = readFileSafe(file);
+        if (contents === null)
+            continue;
+        let anyHit = false;
+        for (const fn of FUNCTIONS) {
+            if (contents.includes(fn + "(") || contents.includes(fn + " (")) {
+                anyHit = true;
+                break;
+            }
+        }
+        if (!anyHit)
+            continue;
+        const lines = contents.split("\n");
+        FUNC_NAME_RE.lastIndex = 0;
+        let m;
+        while ((m = FUNC_NAME_RE.exec(contents)) !== null) {
+            const fnName = m[1];
+            const openParenIdx = m.index + m[0].length - 1;
+            const before = contents.slice(Math.max(0, m.index - 30), m.index);
+            if (/\bfunction\s+$/.test(before) ||
+                /\bexport\s+(default\s+)?(async\s+)?function\s+$/.test(before) ||
+                /\b(const|let|var)\s+$/.test(before)) {
+                continue;
+            }
+            const { line } = lineColForOffset(contents, m.index);
+            const lineText = lines[line - 1] ?? "";
+            const trimmed = lineText.trimStart();
+            if (trimmed.startsWith("*") ||
+                trimmed.startsWith("//") ||
+                trimmed.startsWith("/*")) {
+                continue;
+            }
+            const analysis = analyzeArgs(contents, openParenIdx);
+            if (!analysis)
+                continue;
+            if (analysis.topLevelCommas >= 1)
+                continue;
+            if (OPT_OUT_MARKER.test(lineText))
+                continue;
+            findings.push({
+                file: rel,
+                line,
+                message: `${fnName}(...) called with only one argument — must pass a context object: ${fnName}(key, { userEmail, orgId })`,
+            });
+        }
+    }
+    return { name: "no-unscoped-credentials", findings };
+}
+//# sourceMappingURL=no-unscoped-credentials.js.map

package/dist/guards/no-unscoped-credentials.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"no-unscoped-credentials.js","sourceRoot":"","sources":["../../src/guards/no-unscoped-credentials.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAEH,OAAO,EACL,gBAAgB,EAChB,YAAY,EACZ,QAAQ,EACR,IAAI,GACL,MAAM,iBAAiB,CAAC;AAGzB,MAAM,SAAS,GAAG;IAChB,mBAAmB;IACnB,eAAe;IACf,gBAAgB;IAChB,kBAAkB;CACnB,CAAC;AAEF,MAAM,YAAY,GAAG,IAAI,MAAM,CAC7B,gBAAgB,SAAS,CAAC,IAAI,CAAC,GAAG,CAAC,UAAU,EAC7C,GAAG,CACJ,CAAC;AAEF,MAAM,cAAc,GAClB,yDAAyD,CAAC;AAE5D;;;;uCAIuC;AACvC,MAAM,cAAc,GAAG,IAAI,GAAG,CAAC,CAAC,wCAAwC,CAAC,CAAC,CAAC;AAO3E;;;;GAIG;AACH,SAAS,WAAW,CAClB,QAAgB,EAChB,YAAoB;IAEpB,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,IAAI,cAAc,GAAG,CAAC,CAAC;IACvB,IAAI,CAAC,GAAG,YAAY,CAAC;IACrB,IAAI,IAAI,GAAgC,MAAM,CAAC;IAC/C,IAAI,aAAa,GAAG,CAAC,CAAC;IACtB,OAAO,CAAC,GAAG,QAAQ,CAAC,MAAM,EAAE,CAAC;QAC3B,MAAM,EAAE,GAAG,QAAQ,CAAC,CAAC,CAAC,CAAC;QACvB,MAAM,IAAI,GAAG,QAAQ,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;QAC7B,IAAI,IAAI,KAAK,MAAM,EAAE,CAAC;YACpB,IAAI,EAAE,KAAK,GAAG,IAAI,IAAI,KAAK,GAAG,EAAE,CAAC;gBAC/B,OAAO,CAAC,GAAG,QAAQ,CAAC,MAAM,IAAI,QAAQ,CAAC,CAAC,CAAC,KAAK,IAAI;oBAAE,CAAC,EAAE,CAAC;gBACxD,SAAS;YACX,CAAC;YACD,IAAI,EAAE,KAAK,GAAG,IAAI,IAAI,KAAK,GAAG,EAAE,CAAC;gBAC/B,CAAC,IAAI,CAAC,CAAC;gBACP,OACE,CAAC,GAAG,QAAQ,CAAC,MAAM,GAAG,CAAC;oBACvB,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,KAAK,GAAG,IAAI,QAAQ,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,GAAG,CAAC;oBAEjD,CAAC,EAAE,CAAC;gBACN,CAAC,IAAI,CAAC,CAAC;gBACP,SAAS;YACX,CAAC;YACD,IAAI,EAAE,KAAK,GAAG,IAAI,EAAE,KAAK,GAAG,EAAE,CAAC;gBAC7B,IAAI,GAAG,EAAE,CAAC;gBACV,CAAC,EAAE,CAAC;gBACJ,SAAS;YACX,CAAC;YACD,IAAI,EAAE,KAAK,GAAG,EAAE,CAAC;gBACf,IAAI,GAAG,MAAM,CAAC;gBACd,CAAC,EAAE,CAAC;gBACJ,SAAS;YACX,CAAC;YACD,IAAI,EAAE,KAAK,GAAG,IAAI,EAAE,KAAK,GAAG,IAAI,EAAE,KAAK,GAAG,EAAE,CAAC;gBAC3C,KAAK,EAAE,CAAC;gBACR,CAAC,EAAE,CAAC;gBACJ,SAAS;YACX,CAAC;YACD,IAAI,EAAE,KAAK,GAAG,IAAI,EAAE,KAAK,GAAG,IAAI,EAAE,KAAK,GAAG,EAAE,CAAC;gBAC3C,KAAK,EAAE,CAAC;gBACR,IAAI,KAAK,KAAK,CAAC,IAAI,EAAE,KAAK,GAAG,EAAE,CAAC;oBAC9B,OAAO,EAAE,cAAc,EAAE,MAAM,EAAE,CAAC,EAAE,CAAC;gBACvC,CAAC;gBACD,CAAC,EAAE,CAAC;gBACJ,SAAS;YACX,CAAC;YACD,IAAI,EAAE,KAAK,GAAG,IAAI,KAAK,KAAK,CAAC,EAAE,CAAC;gBAC9B,cAAc,EAAE,CAAC;gBACjB,CAAC,EAAE,CAAC;gBACJ,SAAS;YACX,CAAC;YACD,CAAC,EAAE,CAAC;YACJ,SAAS;QACX,CAAC;QACD,IAAI,IAAI,KAAK,GAAG,IAAI,IAAI,KAAK,GAAG,EAAE,CAAC;YACjC,IAAI,EAAE,KAAK,IAAI,EAAE,CAAC;gBAChB,CAAC,IAAI,CAAC,CAAC;gBACP,SAAS;YACX,CAAC;YACD,IAAI,EAAE,KAAK,IAAI,EAAE,CAAC;gBAChB,IAAI,GAAG,MAAM,CAAC;gBACd,CAAC,EAAE,CAAC;gBACJ,SAAS;YACX,CAAC;YACD,CAAC,EAAE,CAAC;YACJ,SAAS;QACX,CAAC;QACD,IAAI,IAAI,KAAK,MAAM,EAAE,CAAC;YACpB,IAAI,EAAE,KAAK,IAAI,EAAE,CAAC;gBAChB,CAAC,IAAI,CAAC,CAAC;gBACP,SAAS;YACX,CAAC;YACD,IAAI,EAAE,KAAK,GAAG,IAAI,aAAa,KAAK,CAAC,EAAE,CAAC;gBACtC,IAAI,GAAG,MAAM,CAAC;gBACd,CAAC,EAAE,CAAC;gBACJ,SAAS;YACX,CAAC;YACD,IAAI,EAAE,KAAK,GAAG,IAAI,IAAI,KAAK,GAAG,EAAE,CAAC;gBAC/B,aAAa,EAAE,CAAC;gBAChB,CAAC,IAAI,CAAC,CAAC;gBACP,SAAS;YACX,CAAC;YACD,IAAI,EAAE,KAAK,GAAG,IAAI,aAAa,GAAG,CAAC,EAAE,CAAC;gBACpC,aAAa,EAAE,CAAC;gBAChB,CAAC,EAAE,CAAC;gBACJ,SAAS;YACX,CAAC;YACD,CAAC,EAAE,CAAC;YACJ,SAAS;QACX,CAAC;QACD,CAAC,EAAE,CAAC;IACN,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,UAAU,uBAAuB,CACrC,OAAyB;IAEzB,MAAM,EAAE,IAAI,EAAE,GAAG,OAAO,CAAC;IACzB,MAAM,QAAQ,GAAmB,EAAE,CAAC;IAEpC,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QAC9B,IAAI,CAAC,gCAAgC,CAAC,IAAI,CAAC,IAAI,CAAC;YAAE,SAAS;QAC3D,IAAI,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC;YAAE,SAAS;QACrC,MAAM,GAAG,GAAG,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;QACjC,IAAI,cAAc,CAAC,GAAG,CAAC,GAAG,CAAC;YAAE,SAAS;QAEtC,MAAM,QAAQ,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC;QACpC,IAAI,QAAQ,KAAK,IAAI;YAAE,SAAS;QAEhC,IAAI,MAAM,GAAG,KAAK,CAAC;QACnB,KAAK,MAAM,EAAE,IAAI,SAAS,EAAE,CAAC;YAC3B,IAAI,QAAQ,CAAC,QAAQ,CAAC,EAAE,GAAG,GAAG,CAAC,IAAI,QAAQ,CAAC,QAAQ,CAAC,EAAE,GAAG,IAAI,CAAC,EAAE,CAAC;gBAChE,MAAM,GAAG,IAAI,CAAC;gBACd,MAAM;YACR,CAAC;QACH,CAAC;QACD,IAAI,CAAC,MAAM;YAAE,SAAS;QAEtB,MAAM,KAAK,GAAG,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QACnC,YAAY,CAAC,SAAS,GAAG,CAAC,CAAC;QAC3B,IAAI,CAAyB,CAAC;QAC9B,OAAO,CAAC,CAAC,GAAG,YAAY,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;YAClD,MAAM,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;YACpB,MAAM,YAAY,GAAG,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC;YAC/C,MAAM,MAAM,GAAG,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,KAAK,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC;YAClE,IACE,gBAAgB,CAAC,IAAI,CAAC,MAAM,CAAC;gBAC7B,iDAAiD,CAAC,IAAI,CAAC,MAAM,CAAC;gBAC9D,uBAAuB,CAAC,IAAI,CAAC,MAAM,CAAC,EACpC,CAAC;gBACD,SAAS;YACX,CAAC;YACD,MAAM,EAAE,IAAI,EAAE,GAAG,gBAAgB,CAAC,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC;YACrD,MAAM,QAAQ,GAAG,KAAK,CAAC,IAAI,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;YACvC,MAAM,OAAO,GAAG,QAAQ,CAAC,SAAS,EAAE,CAAC;YACrC,IACE,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC;gBACvB,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC;gBACxB,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC,EACxB,CAAC;gBACD,SAAS;YACX,CAAC;YACD,MAAM,QAAQ,GAAG,WAAW,CAAC,QAAQ,EAAE,YAAY,CAAC,CAAC;YACrD,IAAI,CAAC,QAAQ;gBAAE,SAAS;YACxB,IAAI,QAAQ,CAAC,cAAc,IAAI,CAAC;gBAAE,SAAS;YAC3C,IAAI,cAAc,CAAC,IAAI,CAAC,QAAQ,CAAC;gBAAE,SAAS;YAC5C,QAAQ,CAAC,IAAI,CAAC;gBACZ,IAAI,EAAE,GAAG;gBACT,IAAI;gBACJ,OAAO,EAAE,GAAG,MAAM,qEAAqE,MAAM,6BAA6B;aAC3H,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,OAAO,EAAE,IAAI,EAAE,yBAAyB,EAAE,QAAQ,EAAE,CAAC;AACvD,CAAC","sourcesContent":["/**\n * scanUnscopedCredentials — ported from\n * `scripts/guard-no-unscoped-credentials.mjs`.\n *\n * Refuse to let any caller invoke `resolveCredential` / `hasCredential` /\n * `saveCredential` / `deleteCredential` with only one argument. The\n * contract requires a second argument carrying the per-user / per-org\n * context object — `(key, { userEmail, orgId })` — so the credential\n * lookup is scoped to the requesting principal.\n *\n * Generic guard, shipped as-is: the detection regex, arg-balancing parser,\n * and marker semantics are unchanged from the monorepo original. The one\n * difference from the monorepo script is scan scope: the original restricts\n * its walk to `packages/`, `templates/`, `app/` — a monorepo-specific\n * optimization that also happens to exclude its own dotfile/doc trees. A\n * generated app's source lives at `actions/`, `app/`, `server/` (no\n * `packages/`/`templates/` wrapper — see report 005's \"Path resolution\"),\n * so keeping that literal subtree filter would silently skip `actions/`\n * and `server/`. This port scans the whole app root (still respecting\n * `SKIP_DIRS`) instead, which is a superset of the original's coverage and\n * has no false-negative risk for a single-app tree.\n *\n * Opt-out (same line only):\n *   resolveCredential(key) // guard:allow-unscoped-credential — short reason\n */\n\nimport {\n  lineColForOffset,\n  readFileSafe,\n  relPosix,\n  walk,\n} from \"./scan-utils.js\";\nimport type { GuardFinding, GuardResult, GuardScanOptions } from \"./types.js\";\n\nconst FUNCTIONS = [\n  \"resolveCredential\",\n  \"hasCredential\",\n  \"saveCredential\",\n  \"deleteCredential\",\n];\n\nconst FUNC_NAME_RE = new RegExp(\n  `(?<![\\\\w$.])(${FUNCTIONS.join(\"|\")})\\\\s*\\\\(`,\n  \"g\",\n);\n\nconst OPT_OUT_MARKER =\n  /\\/\\/\\s*guard:allow-unscoped-credential\\b[^\\n]*[—-]\\s*\\S/;\n\n/** Files that legitimately use the one-arg form because they ARE the\n * implementation under guard — the definition file itself. In an app this\n * file only ever exists inside `node_modules`, already excluded by\n * SKIP_DIRS, so this allowlist is effectively a no-op for app mode; kept\n * for parity with the source guard. */\nconst FILE_ALLOWLIST = new Set([\"packages/core/src/credentials/index.ts\"]);\n\ninterface ArgAnalysis {\n  topLevelCommas: number;\n  endIdx: number;\n}\n\n/**\n * Starting at openParenIdx (the index of the `(` after the function name),\n * walk forward, balancing nested parens / braces / brackets / strings, and\n * return the top-level comma count. Ported verbatim.\n */\nfunction analyzeArgs(\n  contents: string,\n  openParenIdx: number,\n): ArgAnalysis | null {\n  let depth = 0;\n  let topLevelCommas = 0;\n  let i = openParenIdx;\n  let mode: \"code\" | '\"' | \"'\" | \"tmpl\" = \"code\";\n  let templateDepth = 0;\n  while (i < contents.length) {\n    const ch = contents[i];\n    const next = contents[i + 1];\n    if (mode === \"code\") {\n      if (ch === \"/\" && next === \"/\") {\n        while (i < contents.length && contents[i] !== \"\\n\") i++;\n        continue;\n      }\n      if (ch === \"/\" && next === \"*\") {\n        i += 2;\n        while (\n          i < contents.length - 1 &&\n          !(contents[i] === \"*\" && contents[i + 1] === \"/\")\n        )\n          i++;\n        i += 2;\n        continue;\n      }\n      if (ch === '\"' || ch === \"'\") {\n        mode = ch;\n        i++;\n        continue;\n      }\n      if (ch === \"`\") {\n        mode = \"tmpl\";\n        i++;\n        continue;\n      }\n      if (ch === \"(\" || ch === \"[\" || ch === \"{\") {\n        depth++;\n        i++;\n        continue;\n      }\n      if (ch === \")\" || ch === \"]\" || ch === \"}\") {\n        depth--;\n        if (depth === 0 && ch === \")\") {\n          return { topLevelCommas, endIdx: i };\n        }\n        i++;\n        continue;\n      }\n      if (ch === \",\" && depth === 1) {\n        topLevelCommas++;\n        i++;\n        continue;\n      }\n      i++;\n      continue;\n    }\n    if (mode === '\"' || mode === \"'\") {\n      if (ch === \"\\\\\") {\n        i += 2;\n        continue;\n      }\n      if (ch === mode) {\n        mode = \"code\";\n        i++;\n        continue;\n      }\n      i++;\n      continue;\n    }\n    if (mode === \"tmpl\") {\n      if (ch === \"\\\\\") {\n        i += 2;\n        continue;\n      }\n      if (ch === \"`\" && templateDepth === 0) {\n        mode = \"code\";\n        i++;\n        continue;\n      }\n      if (ch === \"$\" && next === \"{\") {\n        templateDepth++;\n        i += 2;\n        continue;\n      }\n      if (ch === \"}\" && templateDepth > 0) {\n        templateDepth--;\n        i++;\n        continue;\n      }\n      i++;\n      continue;\n    }\n    i++;\n  }\n  return null;\n}\n\nexport function scanUnscopedCredentials(\n  options: GuardScanOptions,\n): GuardResult {\n  const { root } = options;\n  const findings: GuardFinding[] = [];\n\n  for (const file of walk(root)) {\n    if (!/\\.(ts|tsx|mts|cts|js|mjs|cjs)$/.test(file)) continue;\n    if (file.endsWith(\".d.ts\")) continue;\n    const rel = relPosix(root, file);\n    if (FILE_ALLOWLIST.has(rel)) continue;\n\n    const contents = readFileSafe(file);\n    if (contents === null) continue;\n\n    let anyHit = false;\n    for (const fn of FUNCTIONS) {\n      if (contents.includes(fn + \"(\") || contents.includes(fn + \" (\")) {\n        anyHit = true;\n        break;\n      }\n    }\n    if (!anyHit) continue;\n\n    const lines = contents.split(\"\\n\");\n    FUNC_NAME_RE.lastIndex = 0;\n    let m: RegExpExecArray | null;\n    while ((m = FUNC_NAME_RE.exec(contents)) !== null) {\n      const fnName = m[1];\n      const openParenIdx = m.index + m[0].length - 1;\n      const before = contents.slice(Math.max(0, m.index - 30), m.index);\n      if (\n        /\\bfunction\\s+$/.test(before) ||\n        /\\bexport\\s+(default\\s+)?(async\\s+)?function\\s+$/.test(before) ||\n        /\\b(const|let|var)\\s+$/.test(before)\n      ) {\n        continue;\n      }\n      const { line } = lineColForOffset(contents, m.index);\n      const lineText = lines[line - 1] ?? \"\";\n      const trimmed = lineText.trimStart();\n      if (\n        trimmed.startsWith(\"*\") ||\n        trimmed.startsWith(\"//\") ||\n        trimmed.startsWith(\"/*\")\n      ) {\n        continue;\n      }\n      const analysis = analyzeArgs(contents, openParenIdx);\n      if (!analysis) continue;\n      if (analysis.topLevelCommas >= 1) continue;\n      if (OPT_OUT_MARKER.test(lineText)) continue;\n      findings.push({\n        file: rel,\n        line,\n        message: `${fnName}(...) called with only one argument — must pass a context object: ${fnName}(key, { userEmail, orgId })`,\n      });\n    }\n  }\n\n  return { name: \"no-unscoped-credentials\", findings };\n}\n"]}

package/dist/guards/no-unscoped-queries.d.ts

@@ -0,0 +1,32 @@
+/**
+ * scanUnscopedQueries — ported from `scripts/guard-no-unscoped-queries.mjs`.
+ *
+ * Refuse to let any code query an "ownable" resource table (one that
+ * spreads `...ownableColumns()`) without going through framework access
+ * control: `accessFilter` / `resolveAccess` / `assertAccess`, or an
+ * explicit `ownerEmail` / `userEmail` / `orgId` filter. The check is
+ * per-STATEMENT, scoped to the enclosing block, so a sibling `if` branch
+ * that correctly scopes its query does not defuse an unscoped sibling.
+ *
+ * Conditional guard — per report 005's V1 guard set table: the original
+ * restricts scanning to `templates/[^/]+/(server|actions)/` and
+ * `packages/[^/]+/src/`, and hardcodes a `FILE_ALLOWLIST` of this
+ * framework's own sharing-primitive implementation files. For a generated
+ * app (no `templates/`/`packages/` wrapper — source lives at `actions/`
+ * and `server/` under the app root), this port scans `actions/` and
+ * `server/` directly and drops the hardcoded allowlist in favor of an
+ * optional `extraExemptPaths` param (default `[]`).
+ *
+ * Opt-out (within the enclosing block, or as a file header for whole-file
+ * opt-outs):
+ *   // guard:allow-unscoped — short reason
+ */
+import type { GuardResult, GuardScanOptions } from "./types.js";
+export interface UnscopedQueriesOptions extends GuardScanOptions {
+    /** Exact repo-relative paths to exempt from the per-statement scan
+     * (e.g. this app's own sharing-primitive implementation, if any).
+     * Default `[]`. */
+    extraExemptPaths?: string[];
+}
+export declare function scanUnscopedQueries(options: UnscopedQueriesOptions): GuardResult;
+//# sourceMappingURL=no-unscoped-queries.d.ts.map

package/dist/guards/no-unscoped-queries.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"no-unscoped-queries.d.ts","sourceRoot":"","sources":["../../src/guards/no-unscoped-queries.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAGH,OAAO,KAAK,EAAgB,WAAW,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AAE9E,MAAM,WAAW,sBAAuB,SAAQ,gBAAgB;IAC9D;;uBAEmB;IACnB,gBAAgB,CAAC,EAAE,MAAM,EAAE,CAAC;CAC7B;AA6vBD,wBAAgB,mBAAmB,CACjC,OAAO,EAAE,sBAAsB,GAC9B,WAAW,CAkCb"}