@agent-native/core 0.96.0 → 0.98.0

package/dist/guards/db-tool-scoping.d.ts

@@ -0,0 +1,38 @@
+/**
+ * scanDbToolScoping — ported from `scripts/guard-db-tool-scoping.mjs`.
+ *
+ * The agent's raw DB tools (`db-query`, `db-exec`, `db-patch`) can only
+ * safely expose tables with an explicit tenant scope (`owner_email` and/or
+ * `org_id`) or a documented, reviewed exception. This guard keeps schema
+ * drift visible: any table without raw-DB scope must either add
+ * `owner_email`/`org_id`, or be added to the denylist with a
+ * reviewer-readable reason.
+ *
+ * Conditional guard — per report 005's V1 guard set table: the original
+ * walks every `templates/*\/server/db/schema.ts` and keys its denylist
+ * `"<template>:<table>"`. A generated app has exactly one
+ * `server/db/schema.ts` (confirmed convention), so this port scans that
+ * single file and uses bare `"<table>"` denylist keys. The denylist itself
+ * comes from `agent-native.json`'s `doctor.dbToolScopingDenylist` (see
+ * `../cli/doctor.ts`) — empty by default; app authors add entries with the
+ * same reviewer-readable-reason convention as the original constant.
+ *
+ * Not ported: the original also resolves `export * from
+ * "@agent-native/<pkg>/schema"` re-exports back to that package's
+ * `packages/<pkg>/src/schema/*.ts` monorepo source, so template schemas
+ * that re-export scheduling/dispatch tables get scanned too. In a
+ * generated app those packages are compiled `node_modules` output (no
+ * `.ts` source to brace-parse), and report 005's parameterization note
+ * doesn't cover that case, so re-export resolution is intentionally
+ * dropped for app mode: a re-exported table from an `@agent-native/*`
+ * package is not scanned here (false-negative, not false-positive) — see
+ * the plan's STOP-condition guidance ("report rather than invent new
+ * detection logic").
+ */
+import type { GuardResult, GuardScanOptions } from "./types.js";
+export interface DbToolScopingOptions extends GuardScanOptions {
+    /** Table name -> reviewer-readable reason. Default `{}`. */
+    denylist?: Record<string, string>;
+}
+export declare function scanDbToolScoping(options: DbToolScopingOptions): GuardResult;
+//# sourceMappingURL=db-tool-scoping.d.ts.map

package/dist/guards/db-tool-scoping.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"db-tool-scoping.d.ts","sourceRoot":"","sources":["../../src/guards/db-tool-scoping.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AAGH,OAAO,KAAK,EAAgB,WAAW,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AAE9E,MAAM,WAAW,oBAAqB,SAAQ,gBAAgB;IAC5D,4DAA4D;IAC5D,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CACnC;AAsDD,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,oBAAoB,GAAG,WAAW,CAoC5E"}

package/dist/guards/db-tool-scoping.js

@@ -0,0 +1,114 @@
+/**
+ * scanDbToolScoping — ported from `scripts/guard-db-tool-scoping.mjs`.
+ *
+ * The agent's raw DB tools (`db-query`, `db-exec`, `db-patch`) can only
+ * safely expose tables with an explicit tenant scope (`owner_email` and/or
+ * `org_id`) or a documented, reviewed exception. This guard keeps schema
+ * drift visible: any table without raw-DB scope must either add
+ * `owner_email`/`org_id`, or be added to the denylist with a
+ * reviewer-readable reason.
+ *
+ * Conditional guard — per report 005's V1 guard set table: the original
+ * walks every `templates/*\/server/db/schema.ts` and keys its denylist
+ * `"<template>:<table>"`. A generated app has exactly one
+ * `server/db/schema.ts` (confirmed convention), so this port scans that
+ * single file and uses bare `"<table>"` denylist keys. The denylist itself
+ * comes from `agent-native.json`'s `doctor.dbToolScopingDenylist` (see
+ * `../cli/doctor.ts`) — empty by default; app authors add entries with the
+ * same reviewer-readable-reason convention as the original constant.
+ *
+ * Not ported: the original also resolves `export * from
+ * "@agent-native/<pkg>/schema"` re-exports back to that package's
+ * `packages/<pkg>/src/schema/*.ts` monorepo source, so template schemas
+ * that re-export scheduling/dispatch tables get scanned too. In a
+ * generated app those packages are compiled `node_modules` output (no
+ * `.ts` source to brace-parse), and report 005's parameterization note
+ * doesn't cover that case, so re-export resolution is intentionally
+ * dropped for app mode: a re-exported table from an `@agent-native/*`
+ * package is not scanned here (false-negative, not false-positive) — see
+ * the plan's STOP-condition guidance ("report rather than invent new
+ * detection logic").
+ */
+import { readFileSafe, relPosix, walk } from "./scan-utils.js";
+function extractTableCalls(contents) {
+    const out = [];
+    const headerRegex = /export\s+const\s+([a-zA-Z_$][\w$]*)\s*=\s*(?:[a-zA-Z_$][\w$]*Table|table)\s*\(\s*"([^"]+)"\s*,\s*\{/gm;
+    let match;
+    while ((match = headerRegex.exec(contents)) !== null) {
+        const exportName = match[1];
+        const sqlName = match[2];
+        const start = headerRegex.lastIndex - 1;
+        let depth = 0;
+        let inStr = null;
+        let bodyEnd = -1;
+        for (let i = start; i < contents.length; i++) {
+            const c = contents[i];
+            const prev = contents[i - 1];
+            if (inStr) {
+                if (c === inStr && prev !== "\\")
+                    inStr = null;
+                continue;
+            }
+            if (c === '"' || c === "'" || c === "`") {
+                inStr = c;
+                continue;
+            }
+            if (c === "{")
+                depth++;
+            else if (c === "}") {
+                depth--;
+                if (depth === 0) {
+                    bodyEnd = i;
+                    break;
+                }
+            }
+        }
+        if (bodyEnd === -1)
+            continue;
+        out.push({ exportName, sqlName, body: contents.slice(start + 1, bodyEnd) });
+    }
+    return out;
+}
+function hasRawDbScope(tableBody) {
+    return (/\.\.\.ownableColumns\s*\(/.test(tableBody) ||
+        /\b[\w$]+\s*:\s*text\s*\(\s*["']owner_email["']/.test(tableBody) ||
+        /\b[\w$]+\s*:\s*text\s*\(\s*["']org_id["']/.test(tableBody));
+}
+export function scanDbToolScoping(options) {
+    const { root, denylist = {} } = options;
+    const findings = [];
+    const seenAllowed = new Set();
+    for (const file of walk(root)) {
+        if (!file.endsWith("/server/db/schema.ts"))
+            continue;
+        const contents = readFileSafe(file);
+        if (contents === null)
+            continue;
+        const rel = relPosix(root, file);
+        const tables = extractTableCalls(contents);
+        for (const table of tables) {
+            if (hasRawDbScope(table.body))
+                continue;
+            if (Object.hasOwn(denylist, table.sqlName)) {
+                seenAllowed.add(table.sqlName);
+                continue;
+            }
+            findings.push({
+                file: rel,
+                line: 1,
+                message: `Table "${table.sqlName}" (export ${table.exportName}) has no owner_email/org_id scope and is not on the doctor.dbToolScopingDenylist — add tenant scope, or add it to agent-native.json's "doctor.dbToolScopingDenylist" with a reason.`,
+            });
+        }
+    }
+    for (const key of Object.keys(denylist)) {
+        if (!seenAllowed.has(key)) {
+            findings.push({
+                file: "agent-native.json",
+                line: 1,
+                message: `Stale doctor.dbToolScopingDenylist entry "${key}" — no matching table found in server/db/schema.ts. Remove it.`,
+            });
+        }
+    }
+    return { name: "db-tool-scoping", findings };
+}
+//# sourceMappingURL=db-tool-scoping.js.map

package/dist/guards/db-tool-scoping.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"db-tool-scoping.js","sourceRoot":"","sources":["../../src/guards/db-tool-scoping.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AAEH,OAAO,EAAE,YAAY,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,iBAAiB,CAAC;AAc/D,SAAS,iBAAiB,CAAC,QAAgB;IACzC,MAAM,GAAG,GAAgB,EAAE,CAAC;IAC5B,MAAM,WAAW,GACf,uGAAuG,CAAC;IAC1G,IAAI,KAA6B,CAAC;IAClC,OAAO,CAAC,KAAK,GAAG,WAAW,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;QACrD,MAAM,UAAU,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;QAC5B,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;QACzB,MAAM,KAAK,GAAG,WAAW,CAAC,SAAS,GAAG,CAAC,CAAC;QACxC,IAAI,KAAK,GAAG,CAAC,CAAC;QACd,IAAI,KAAK,GAAkB,IAAI,CAAC;QAChC,IAAI,OAAO,GAAG,CAAC,CAAC,CAAC;QACjB,KAAK,IAAI,CAAC,GAAG,KAAK,EAAE,CAAC,GAAG,QAAQ,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YAC7C,MAAM,CAAC,GAAG,QAAQ,CAAC,CAAC,CAAC,CAAC;YACtB,MAAM,IAAI,GAAG,QAAQ,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;YAC7B,IAAI,KAAK,EAAE,CAAC;gBACV,IAAI,CAAC,KAAK,KAAK,IAAI,IAAI,KAAK,IAAI;oBAAE,KAAK,GAAG,IAAI,CAAC;gBAC/C,SAAS;YACX,CAAC;YACD,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG,EAAE,CAAC;gBACxC,KAAK,GAAG,CAAC,CAAC;gBACV,SAAS;YACX,CAAC;YACD,IAAI,CAAC,KAAK,GAAG;gBAAE,KAAK,EAAE,CAAC;iBAClB,IAAI,CAAC,KAAK,GAAG,EAAE,CAAC;gBACnB,KAAK,EAAE,CAAC;gBACR,IAAI,KAAK,KAAK,CAAC,EAAE,CAAC;oBAChB,OAAO,GAAG,CAAC,CAAC;oBACZ,MAAM;gBACR,CAAC;YACH,CAAC;QACH,CAAC;QACD,IAAI,OAAO,KAAK,CAAC,CAAC;YAAE,SAAS;QAC7B,GAAG,CAAC,IAAI,CAAC,EAAE,UAAU,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,EAAE,OAAO,CAAC,EAAE,CAAC,CAAC;IAC9E,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,aAAa,CAAC,SAAiB;IACtC,OAAO,CACL,2BAA2B,CAAC,IAAI,CAAC,SAAS,CAAC;QAC3C,gDAAgD,CAAC,IAAI,CAAC,SAAS,CAAC;QAChE,2CAA2C,CAAC,IAAI,CAAC,SAAS,CAAC,CAC5D,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,OAA6B;IAC7D,MAAM,EAAE,IAAI,EAAE,QAAQ,GAAG,EAAE,EAAE,GAAG,OAAO,CAAC;IACxC,MAAM,QAAQ,GAAmB,EAAE,CAAC;IACpC,MAAM,WAAW,GAAG,IAAI,GAAG,EAAU,CAAC;IAEtC,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QAC9B,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,sBAAsB,CAAC;YAAE,SAAS;QACrD,MAAM,QAAQ,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC;QACpC,IAAI,QAAQ,KAAK,IAAI;YAAE,SAAS;QAChC,MAAM,GAAG,GAAG,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;QACjC,MAAM,MAAM,GAAG,iBAAiB,CAAC,QAAQ,CAAC,CAAC;QAC3C,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;YAC3B,IAAI,aAAa,CAAC,KAAK,CAAC,IAAI,CAAC;gBAAE,SAAS;YACxC,IAAI,MAAM,CAAC,MAAM,CAAC,QAAQ,EAAE,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC;gBAC3C,WAAW,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;gBAC/B,SAAS;YACX,CAAC;YACD,QAAQ,CAAC,IAAI,CAAC;gBACZ,IAAI,EAAE,GAAG;gBACT,IAAI,EAAE,CAAC;gBACP,OAAO,EAAE,UAAU,KAAK,CAAC,OAAO,aAAa,KAAK,CAAC,UAAU,qLAAqL;aACnP,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;QACxC,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;YAC1B,QAAQ,CAAC,IAAI,CAAC;gBACZ,IAAI,EAAE,mBAAmB;gBACzB,IAAI,EAAE,CAAC;gBACP,OAAO,EAAE,6CAA6C,GAAG,gEAAgE;aAC1H,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,OAAO,EAAE,IAAI,EAAE,iBAAiB,EAAE,QAAQ,EAAE,CAAC;AAC/C,CAAC","sourcesContent":["/**\n * scanDbToolScoping — ported from `scripts/guard-db-tool-scoping.mjs`.\n *\n * The agent's raw DB tools (`db-query`, `db-exec`, `db-patch`) can only\n * safely expose tables with an explicit tenant scope (`owner_email` and/or\n * `org_id`) or a documented, reviewed exception. This guard keeps schema\n * drift visible: any table without raw-DB scope must either add\n * `owner_email`/`org_id`, or be added to the denylist with a\n * reviewer-readable reason.\n *\n * Conditional guard — per report 005's V1 guard set table: the original\n * walks every `templates/*\\/server/db/schema.ts` and keys its denylist\n * `\"<template>:<table>\"`. A generated app has exactly one\n * `server/db/schema.ts` (confirmed convention), so this port scans that\n * single file and uses bare `\"<table>\"` denylist keys. The denylist itself\n * comes from `agent-native.json`'s `doctor.dbToolScopingDenylist` (see\n * `../cli/doctor.ts`) — empty by default; app authors add entries with the\n * same reviewer-readable-reason convention as the original constant.\n *\n * Not ported: the original also resolves `export * from\n * \"@agent-native/<pkg>/schema\"` re-exports back to that package's\n * `packages/<pkg>/src/schema/*.ts` monorepo source, so template schemas\n * that re-export scheduling/dispatch tables get scanned too. In a\n * generated app those packages are compiled `node_modules` output (no\n * `.ts` source to brace-parse), and report 005's parameterization note\n * doesn't cover that case, so re-export resolution is intentionally\n * dropped for app mode: a re-exported table from an `@agent-native/*`\n * package is not scanned here (false-negative, not false-positive) — see\n * the plan's STOP-condition guidance (\"report rather than invent new\n * detection logic\").\n */\n\nimport { readFileSafe, relPosix, walk } from \"./scan-utils.js\";\nimport type { GuardFinding, GuardResult, GuardScanOptions } from \"./types.js\";\n\nexport interface DbToolScopingOptions extends GuardScanOptions {\n  /** Table name -> reviewer-readable reason. Default `{}`. */\n  denylist?: Record<string, string>;\n}\n\ninterface TableCall {\n  exportName: string;\n  sqlName: string;\n  body: string;\n}\n\nfunction extractTableCalls(contents: string): TableCall[] {\n  const out: TableCall[] = [];\n  const headerRegex =\n    /export\\s+const\\s+([a-zA-Z_$][\\w$]*)\\s*=\\s*(?:[a-zA-Z_$][\\w$]*Table|table)\\s*\\(\\s*\"([^\"]+)\"\\s*,\\s*\\{/gm;\n  let match: RegExpExecArray | null;\n  while ((match = headerRegex.exec(contents)) !== null) {\n    const exportName = match[1];\n    const sqlName = match[2];\n    const start = headerRegex.lastIndex - 1;\n    let depth = 0;\n    let inStr: string | null = null;\n    let bodyEnd = -1;\n    for (let i = start; i < contents.length; i++) {\n      const c = contents[i];\n      const prev = contents[i - 1];\n      if (inStr) {\n        if (c === inStr && prev !== \"\\\\\") inStr = null;\n        continue;\n      }\n      if (c === '\"' || c === \"'\" || c === \"`\") {\n        inStr = c;\n        continue;\n      }\n      if (c === \"{\") depth++;\n      else if (c === \"}\") {\n        depth--;\n        if (depth === 0) {\n          bodyEnd = i;\n          break;\n        }\n      }\n    }\n    if (bodyEnd === -1) continue;\n    out.push({ exportName, sqlName, body: contents.slice(start + 1, bodyEnd) });\n  }\n  return out;\n}\n\nfunction hasRawDbScope(tableBody: string): boolean {\n  return (\n    /\\.\\.\\.ownableColumns\\s*\\(/.test(tableBody) ||\n    /\\b[\\w$]+\\s*:\\s*text\\s*\\(\\s*[\"']owner_email[\"']/.test(tableBody) ||\n    /\\b[\\w$]+\\s*:\\s*text\\s*\\(\\s*[\"']org_id[\"']/.test(tableBody)\n  );\n}\n\nexport function scanDbToolScoping(options: DbToolScopingOptions): GuardResult {\n  const { root, denylist = {} } = options;\n  const findings: GuardFinding[] = [];\n  const seenAllowed = new Set<string>();\n\n  for (const file of walk(root)) {\n    if (!file.endsWith(\"/server/db/schema.ts\")) continue;\n    const contents = readFileSafe(file);\n    if (contents === null) continue;\n    const rel = relPosix(root, file);\n    const tables = extractTableCalls(contents);\n    for (const table of tables) {\n      if (hasRawDbScope(table.body)) continue;\n      if (Object.hasOwn(denylist, table.sqlName)) {\n        seenAllowed.add(table.sqlName);\n        continue;\n      }\n      findings.push({\n        file: rel,\n        line: 1,\n        message: `Table \"${table.sqlName}\" (export ${table.exportName}) has no owner_email/org_id scope and is not on the doctor.dbToolScopingDenylist — add tenant scope, or add it to agent-native.json's \"doctor.dbToolScopingDenylist\" with a reason.`,\n      });\n    }\n  }\n\n  for (const key of Object.keys(denylist)) {\n    if (!seenAllowed.has(key)) {\n      findings.push({\n        file: \"agent-native.json\",\n        line: 1,\n        message: `Stale doctor.dbToolScopingDenylist entry \"${key}\" — no matching table found in server/db/schema.ts. Remove it.`,\n      });\n    }\n  }\n\n  return { name: \"db-tool-scoping\", findings };\n}\n"]}

package/dist/guards/index.d.ts

@@ -0,0 +1,23 @@
+/**
+ * `agent-native doctor`'s guard functions — the source-code safety
+ * invariants ported from this monorepo's `scripts/guard-*.mjs` CI guards
+ * (see report `advisor-plans/reports/005-doctor-design.md` for the
+ * classification and per-guard parameterization). Each guard is a pure,
+ * synchronous function that scans an app root and returns a `GuardResult`.
+ *
+ * `../cli/doctor.ts` is the only in-package caller; this module is also
+ * published under the `./guards` export subpath for advanced/CI use
+ * outside the CLI.
+ */
+export { scanDbToolScoping } from "./db-tool-scoping.js";
+export type { DbToolScopingOptions } from "./db-tool-scoping.js";
+export { scanDrizzlePush } from "./no-drizzle-push.js";
+export { scanEnvCredentials } from "./no-env-credentials.js";
+export { scanEnvMutation } from "./no-env-mutation.js";
+export { scanLocalhostFallback } from "./no-localhost-fallback.js";
+export type { LocalhostFallbackOptions } from "./no-localhost-fallback.js";
+export { scanUnscopedCredentials } from "./no-unscoped-credentials.js";
+export { scanUnscopedQueries } from "./no-unscoped-queries.js";
+export type { UnscopedQueriesOptions } from "./no-unscoped-queries.js";
+export type { GuardFinding, GuardResult, GuardScanOptions } from "./types.js";
+//# sourceMappingURL=index.d.ts.map

package/dist/guards/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/guards/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,EAAE,iBAAiB,EAAE,MAAM,sBAAsB,CAAC;AACzD,YAAY,EAAE,oBAAoB,EAAE,MAAM,sBAAsB,CAAC;AACjE,OAAO,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAC;AACvD,OAAO,EAAE,kBAAkB,EAAE,MAAM,yBAAyB,CAAC;AAC7D,OAAO,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAC;AACvD,OAAO,EAAE,qBAAqB,EAAE,MAAM,4BAA4B,CAAC;AACnE,YAAY,EAAE,wBAAwB,EAAE,MAAM,4BAA4B,CAAC;AAC3E,OAAO,EAAE,uBAAuB,EAAE,MAAM,8BAA8B,CAAC;AACvE,OAAO,EAAE,mBAAmB,EAAE,MAAM,0BAA0B,CAAC;AAC/D,YAAY,EAAE,sBAAsB,EAAE,MAAM,0BAA0B,CAAC;AACvE,YAAY,EAAE,YAAY,EAAE,WAAW,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC"}

package/dist/guards/index.js

@@ -0,0 +1,19 @@
+/**
+ * `agent-native doctor`'s guard functions — the source-code safety
+ * invariants ported from this monorepo's `scripts/guard-*.mjs` CI guards
+ * (see report `advisor-plans/reports/005-doctor-design.md` for the
+ * classification and per-guard parameterization). Each guard is a pure,
+ * synchronous function that scans an app root and returns a `GuardResult`.
+ *
+ * `../cli/doctor.ts` is the only in-package caller; this module is also
+ * published under the `./guards` export subpath for advanced/CI use
+ * outside the CLI.
+ */
+export { scanDbToolScoping } from "./db-tool-scoping.js";
+export { scanDrizzlePush } from "./no-drizzle-push.js";
+export { scanEnvCredentials } from "./no-env-credentials.js";
+export { scanEnvMutation } from "./no-env-mutation.js";
+export { scanLocalhostFallback } from "./no-localhost-fallback.js";
+export { scanUnscopedCredentials } from "./no-unscoped-credentials.js";
+export { scanUnscopedQueries } from "./no-unscoped-queries.js";
+//# sourceMappingURL=index.js.map

package/dist/guards/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/guards/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,EAAE,iBAAiB,EAAE,MAAM,sBAAsB,CAAC;AAEzD,OAAO,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAC;AACvD,OAAO,EAAE,kBAAkB,EAAE,MAAM,yBAAyB,CAAC;AAC7D,OAAO,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAC;AACvD,OAAO,EAAE,qBAAqB,EAAE,MAAM,4BAA4B,CAAC;AAEnE,OAAO,EAAE,uBAAuB,EAAE,MAAM,8BAA8B,CAAC;AACvE,OAAO,EAAE,mBAAmB,EAAE,MAAM,0BAA0B,CAAC","sourcesContent":["/**\n * `agent-native doctor`'s guard functions — the source-code safety\n * invariants ported from this monorepo's `scripts/guard-*.mjs` CI guards\n * (see report `advisor-plans/reports/005-doctor-design.md` for the\n * classification and per-guard parameterization). Each guard is a pure,\n * synchronous function that scans an app root and returns a `GuardResult`.\n *\n * `../cli/doctor.ts` is the only in-package caller; this module is also\n * published under the `./guards` export subpath for advanced/CI use\n * outside the CLI.\n */\n\nexport { scanDbToolScoping } from \"./db-tool-scoping.js\";\nexport type { DbToolScopingOptions } from \"./db-tool-scoping.js\";\nexport { scanDrizzlePush } from \"./no-drizzle-push.js\";\nexport { scanEnvCredentials } from \"./no-env-credentials.js\";\nexport { scanEnvMutation } from \"./no-env-mutation.js\";\nexport { scanLocalhostFallback } from \"./no-localhost-fallback.js\";\nexport type { LocalhostFallbackOptions } from \"./no-localhost-fallback.js\";\nexport { scanUnscopedCredentials } from \"./no-unscoped-credentials.js\";\nexport { scanUnscopedQueries } from \"./no-unscoped-queries.js\";\nexport type { UnscopedQueriesOptions } from \"./no-unscoped-queries.js\";\nexport type { GuardFinding, GuardResult, GuardScanOptions } from \"./types.js\";\n"]}

package/dist/guards/no-drizzle-push.d.ts

@@ -0,0 +1,14 @@
+/**
+ * scanDrizzlePush — ported from `scripts/guard-no-drizzle-push.mjs`.
+ *
+ * Refuse to let `drizzle-kit push` (or `drizzle push`) get wired into any
+ * build/deploy path (`netlify.toml`, or a `package.json` build/deploy
+ * script). Generic guard — no monorepo-specific path assumption in the
+ * original, ported as-is.
+ *
+ * Standalone `db:push` / `db:push:*` npm scripts are intentionally NOT
+ * flagged — those are explicit, human-invoked commands, not build hooks.
+ */
+import type { GuardResult, GuardScanOptions } from "./types.js";
+export declare function scanDrizzlePush(options: GuardScanOptions): GuardResult;
+//# sourceMappingURL=no-drizzle-push.d.ts.map

package/dist/guards/no-drizzle-push.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"no-drizzle-push.d.ts","sourceRoot":"","sources":["../../src/guards/no-drizzle-push.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAQH,OAAO,KAAK,EAAgB,WAAW,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AAgC9E,wBAAgB,eAAe,CAAC,OAAO,EAAE,gBAAgB,GAAG,WAAW,CActE"}

package/dist/guards/no-drizzle-push.js

@@ -0,0 +1,97 @@
+/**
+ * scanDrizzlePush — ported from `scripts/guard-no-drizzle-push.mjs`.
+ *
+ * Refuse to let `drizzle-kit push` (or `drizzle push`) get wired into any
+ * build/deploy path (`netlify.toml`, or a `package.json` build/deploy
+ * script). Generic guard — no monorepo-specific path assumption in the
+ * original, ported as-is.
+ *
+ * Standalone `db:push` / `db:push:*` npm scripts are intentionally NOT
+ * flagged — those are explicit, human-invoked commands, not build hooks.
+ */
+import { lineColForOffset, readFileSafe, relPosix, walk, } from "./scan-utils.js";
+const DANGEROUS_SCRIPT_HOOKS = new Set([
+    "build",
+    "prebuild",
+    "postbuild",
+    "install",
+    "preinstall",
+    "postinstall",
+    "deploy",
+    "predeploy",
+    "postdeploy",
+    "start",
+    "prestart",
+    "poststart",
+    "ci",
+    "release",
+    "prerelease",
+    "postrelease",
+]);
+const PATTERNS = [/\bdrizzle-kit\s+push\b/, /\bdrizzle\s+push\b/];
+function matchesForbidden(str) {
+    if (!str || typeof str !== "string")
+        return false;
+    return PATTERNS.some((p) => p.test(str));
+}
+export function scanDrizzlePush(options) {
+    const { root } = options;
+    const findings = [];
+    for (const file of walk(root)) {
+        const base = file.split("/").pop() ?? file;
+        if (base === "netlify.toml") {
+            scanNetlifyToml(root, file, findings);
+        }
+        else if (base === "package.json") {
+            scanPackageJson(root, file, findings);
+        }
+    }
+    return { name: "no-drizzle-push", findings };
+}
+function scanNetlifyToml(root, file, findings) {
+    const contents = readFileSafe(file);
+    if (contents === null || !matchesForbidden(contents))
+        return;
+    const lines = contents.split("\n");
+    const rel = relPosix(root, file);
+    for (let i = 0; i < lines.length; i++) {
+        if (matchesForbidden(lines[i])) {
+            findings.push({
+                file: rel,
+                line: i + 1,
+                message: `forbidden \`drizzle-kit push\` in netlify.toml: ${lines[i].trim()}`,
+            });
+        }
+    }
+}
+function scanPackageJson(root, file, findings) {
+    const contents = readFileSafe(file);
+    if (contents === null)
+        return;
+    let json;
+    try {
+        json = JSON.parse(contents);
+    }
+    catch {
+        return;
+    }
+    const scripts = json.scripts;
+    if (!scripts || typeof scripts !== "object")
+        return;
+    const rel = relPosix(root, file);
+    for (const [name, cmd] of Object.entries(scripts)) {
+        if (!DANGEROUS_SCRIPT_HOOKS.has(name))
+            continue;
+        if (matchesForbidden(cmd)) {
+            // Locate the line for a readable finding; fall back to line 1.
+            const idx = contents.indexOf(`"${name}"`);
+            const line = idx >= 0 ? lineColForOffset(contents, idx).line : 1;
+            findings.push({
+                file: rel,
+                line,
+                message: `forbidden \`drizzle-kit push\` in scripts.${name}: ${String(cmd)}`,
+            });
+        }
+    }
+}
+//# sourceMappingURL=no-drizzle-push.js.map

package/dist/guards/no-drizzle-push.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"no-drizzle-push.js","sourceRoot":"","sources":["../../src/guards/no-drizzle-push.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,EACL,gBAAgB,EAChB,YAAY,EACZ,QAAQ,EACR,IAAI,GACL,MAAM,iBAAiB,CAAC;AAGzB,MAAM,sBAAsB,GAAG,IAAI,GAAG,CAAC;IACrC,OAAO;IACP,UAAU;IACV,WAAW;IACX,SAAS;IACT,YAAY;IACZ,aAAa;IACb,QAAQ;IACR,WAAW;IACX,YAAY;IACZ,OAAO;IACP,UAAU;IACV,WAAW;IACX,IAAI;IACJ,SAAS;IACT,YAAY;IACZ,aAAa;CACd,CAAC,CAAC;AAEH,MAAM,QAAQ,GAAG,CAAC,wBAAwB,EAAE,oBAAoB,CAAC,CAAC;AAElE,SAAS,gBAAgB,CAAC,GAAY;IACpC,IAAI,CAAC,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IAClD,OAAO,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;AAC3C,CAAC;AAMD,MAAM,UAAU,eAAe,CAAC,OAAyB;IACvD,MAAM,EAAE,IAAI,EAAE,GAAG,OAAO,CAAC;IACzB,MAAM,QAAQ,GAAmB,EAAE,CAAC;IAEpC,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QAC9B,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,IAAI,IAAI,CAAC;QAC3C,IAAI,IAAI,KAAK,cAAc,EAAE,CAAC;YAC5B,eAAe,CAAC,IAAI,EAAE,IAAI,EAAE,QAAQ,CAAC,CAAC;QACxC,CAAC;aAAM,IAAI,IAAI,KAAK,cAAc,EAAE,CAAC;YACnC,eAAe,CAAC,IAAI,EAAE,IAAI,EAAE,QAAQ,CAAC,CAAC;QACxC,CAAC;IACH,CAAC;IAED,OAAO,EAAE,IAAI,EAAE,iBAAiB,EAAE,QAAQ,EAAE,CAAC;AAC/C,CAAC;AAED,SAAS,eAAe,CACtB,IAAY,EACZ,IAAY,EACZ,QAAwB;IAExB,MAAM,QAAQ,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC;IACpC,IAAI,QAAQ,KAAK,IAAI,IAAI,CAAC,gBAAgB,CAAC,QAAQ,CAAC;QAAE,OAAO;IAC7D,MAAM,KAAK,GAAG,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IACnC,MAAM,GAAG,GAAG,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IACjC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACtC,IAAI,gBAAgB,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YAC/B,QAAQ,CAAC,IAAI,CAAC;gBACZ,IAAI,EAAE,GAAG;gBACT,IAAI,EAAE,CAAC,GAAG,CAAC;gBACX,OAAO,EAAE,mDAAmD,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE;aAC9E,CAAC,CAAC;QACL,CAAC;IACH,CAAC;AACH,CAAC;AAED,SAAS,eAAe,CACtB,IAAY,EACZ,IAAY,EACZ,QAAwB;IAExB,MAAM,QAAQ,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC;IACpC,IAAI,QAAQ,KAAK,IAAI;QAAE,OAAO;IAC9B,IAAI,IAAqB,CAAC;IAC1B,IAAI,CAAC;QACH,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAoB,CAAC;IACjD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO;IACT,CAAC;IACD,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC;IAC7B,IAAI,CAAC,OAAO,IAAI,OAAO,OAAO,KAAK,QAAQ;QAAE,OAAO;IACpD,MAAM,GAAG,GAAG,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IACjC,KAAK,MAAM,CAAC,IAAI,EAAE,GAAG,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QAClD,IAAI,CAAC,sBAAsB,CAAC,GAAG,CAAC,IAAI,CAAC;YAAE,SAAS;QAChD,IAAI,gBAAgB,CAAC,GAAG,CAAC,EAAE,CAAC;YAC1B,+DAA+D;YAC/D,MAAM,GAAG,GAAG,QAAQ,CAAC,OAAO,CAAC,IAAI,IAAI,GAAG,CAAC,CAAC;YAC1C,MAAM,IAAI,GAAG,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,gBAAgB,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;YACjE,QAAQ,CAAC,IAAI,CAAC;gBACZ,IAAI,EAAE,GAAG;gBACT,IAAI;gBACJ,OAAO,EAAE,6CAA6C,IAAI,KAAK,MAAM,CAAC,GAAG,CAAC,EAAE;aAC7E,CAAC,CAAC;QACL,CAAC;IACH,CAAC;AACH,CAAC","sourcesContent":["/**\n * scanDrizzlePush — ported from `scripts/guard-no-drizzle-push.mjs`.\n *\n * Refuse to let `drizzle-kit push` (or `drizzle push`) get wired into any\n * build/deploy path (`netlify.toml`, or a `package.json` build/deploy\n * script). Generic guard — no monorepo-specific path assumption in the\n * original, ported as-is.\n *\n * Standalone `db:push` / `db:push:*` npm scripts are intentionally NOT\n * flagged — those are explicit, human-invoked commands, not build hooks.\n */\n\nimport {\n  lineColForOffset,\n  readFileSafe,\n  relPosix,\n  walk,\n} from \"./scan-utils.js\";\nimport type { GuardFinding, GuardResult, GuardScanOptions } from \"./types.js\";\n\nconst DANGEROUS_SCRIPT_HOOKS = new Set([\n  \"build\",\n  \"prebuild\",\n  \"postbuild\",\n  \"install\",\n  \"preinstall\",\n  \"postinstall\",\n  \"deploy\",\n  \"predeploy\",\n  \"postdeploy\",\n  \"start\",\n  \"prestart\",\n  \"poststart\",\n  \"ci\",\n  \"release\",\n  \"prerelease\",\n  \"postrelease\",\n]);\n\nconst PATTERNS = [/\\bdrizzle-kit\\s+push\\b/, /\\bdrizzle\\s+push\\b/];\n\nfunction matchesForbidden(str: unknown): str is string {\n  if (!str || typeof str !== \"string\") return false;\n  return PATTERNS.some((p) => p.test(str));\n}\n\ninterface PackageJsonLike {\n  scripts?: Record<string, unknown>;\n}\n\nexport function scanDrizzlePush(options: GuardScanOptions): GuardResult {\n  const { root } = options;\n  const findings: GuardFinding[] = [];\n\n  for (const file of walk(root)) {\n    const base = file.split(\"/\").pop() ?? file;\n    if (base === \"netlify.toml\") {\n      scanNetlifyToml(root, file, findings);\n    } else if (base === \"package.json\") {\n      scanPackageJson(root, file, findings);\n    }\n  }\n\n  return { name: \"no-drizzle-push\", findings };\n}\n\nfunction scanNetlifyToml(\n  root: string,\n  file: string,\n  findings: GuardFinding[],\n): void {\n  const contents = readFileSafe(file);\n  if (contents === null || !matchesForbidden(contents)) return;\n  const lines = contents.split(\"\\n\");\n  const rel = relPosix(root, file);\n  for (let i = 0; i < lines.length; i++) {\n    if (matchesForbidden(lines[i])) {\n      findings.push({\n        file: rel,\n        line: i + 1,\n        message: `forbidden \\`drizzle-kit push\\` in netlify.toml: ${lines[i].trim()}`,\n      });\n    }\n  }\n}\n\nfunction scanPackageJson(\n  root: string,\n  file: string,\n  findings: GuardFinding[],\n): void {\n  const contents = readFileSafe(file);\n  if (contents === null) return;\n  let json: PackageJsonLike;\n  try {\n    json = JSON.parse(contents) as PackageJsonLike;\n  } catch {\n    return;\n  }\n  const scripts = json.scripts;\n  if (!scripts || typeof scripts !== \"object\") return;\n  const rel = relPosix(root, file);\n  for (const [name, cmd] of Object.entries(scripts)) {\n    if (!DANGEROUS_SCRIPT_HOOKS.has(name)) continue;\n    if (matchesForbidden(cmd)) {\n      // Locate the line for a readable finding; fall back to line 1.\n      const idx = contents.indexOf(`\"${name}\"`);\n      const line = idx >= 0 ? lineColForOffset(contents, idx).line : 1;\n      findings.push({\n        file: rel,\n        line,\n        message: `forbidden \\`drizzle-kit push\\` in scripts.${name}: ${String(cmd)}`,\n      });\n    }\n  }\n}\n"]}

package/dist/guards/no-env-credentials.d.ts

@@ -0,0 +1,36 @@
+/**
+ * scanEnvCredentials — ported from `scripts/guard-no-env-credentials.mjs`.
+ *
+ * User credentials are per-user (or per-org) data. They MUST live in SQL,
+ * scoped by `userEmail` / `orgId`, never in `process.env` — a deployment's
+ * env vars are shared by every signed-in user. This guard flags any
+ * `process.env.<KEY>` / `process.env["KEY"]` read whose key is not on the
+ * deploy-level allowlist (`DATABASE_URL`, `BETTER_AUTH_SECRET`, etc.), plus
+ * any dynamic `process.env[key]` read (the key is only known at runtime, so
+ * it can never be allowlisted safely).
+ *
+ * Conditional guard — per report 005's V1 guard set table, this is "the big
+ * one": the original only scans a curated set of monorepo subtrees
+ * (`packages/core/src/{credentials,secrets,vault,agent}/`, template
+ * credential libs/routes) via `FORBIDDEN_PATH_PREDICATES` — none of which
+ * exist in a generated app, so nothing would ever be scanned. This port
+ * replaces that default-allow-outside-a-curated-subtree behavior with
+ * default-deny across the whole app source tree: every `process.env.<KEY>`
+ * read anywhere in app source must be on the deploy-var allowlist (kept
+ * verbatim) or carry the opt-out marker. `HIGH_RISK_ENV_KEY_ALLOWLIST`,
+ * `HIGH_RISK_PROCESS_ENV_ALLOWLIST`, and `HIGH_RISK_ENV_VARS_WRITE_ALLOWLIST`
+ * — the three monorepo-file-keyed exception maps for specific template
+ * platform-adapter files — are dropped entirely per the report; with
+ * default-deny scanning already covering every `process.env` read
+ * everywhere, the narrower `env-config.ts`/`core-routes.ts`-specific
+ * registration checks those maps supported become redundant (any
+ * high-risk key would already be caught by the general scan) and are
+ * dropped along with them. The per-line `// guard:allow-env-credential`
+ * marker remains the only escape hatch.
+ *
+ * Opt-out (same line, or the line immediately above):
+ *   process.env.SOMETHING // guard:allow-env-credential — short reason
+ */
+import type { GuardResult, GuardScanOptions } from "./types.js";
+export declare function scanEnvCredentials(options: GuardScanOptions): GuardResult;
+//# sourceMappingURL=no-env-credentials.d.ts.map

package/dist/guards/no-env-credentials.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"no-env-credentials.d.ts","sourceRoot":"","sources":["../../src/guards/no-env-credentials.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AAQH,OAAO,KAAK,EAAgB,WAAW,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AA4G9E,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,gBAAgB,GAAG,WAAW,CAgFzE"}

package/dist/guards/no-env-credentials.js

@@ -0,0 +1,204 @@
+/**
+ * scanEnvCredentials — ported from `scripts/guard-no-env-credentials.mjs`.
+ *
+ * User credentials are per-user (or per-org) data. They MUST live in SQL,
+ * scoped by `userEmail` / `orgId`, never in `process.env` — a deployment's
+ * env vars are shared by every signed-in user. This guard flags any
+ * `process.env.<KEY>` / `process.env["KEY"]` read whose key is not on the
+ * deploy-level allowlist (`DATABASE_URL`, `BETTER_AUTH_SECRET`, etc.), plus
+ * any dynamic `process.env[key]` read (the key is only known at runtime, so
+ * it can never be allowlisted safely).
+ *
+ * Conditional guard — per report 005's V1 guard set table, this is "the big
+ * one": the original only scans a curated set of monorepo subtrees
+ * (`packages/core/src/{credentials,secrets,vault,agent}/`, template
+ * credential libs/routes) via `FORBIDDEN_PATH_PREDICATES` — none of which
+ * exist in a generated app, so nothing would ever be scanned. This port
+ * replaces that default-allow-outside-a-curated-subtree behavior with
+ * default-deny across the whole app source tree: every `process.env.<KEY>`
+ * read anywhere in app source must be on the deploy-var allowlist (kept
+ * verbatim) or carry the opt-out marker. `HIGH_RISK_ENV_KEY_ALLOWLIST`,
+ * `HIGH_RISK_PROCESS_ENV_ALLOWLIST`, and `HIGH_RISK_ENV_VARS_WRITE_ALLOWLIST`
+ * — the three monorepo-file-keyed exception maps for specific template
+ * platform-adapter files — are dropped entirely per the report; with
+ * default-deny scanning already covering every `process.env` read
+ * everywhere, the narrower `env-config.ts`/`core-routes.ts`-specific
+ * registration checks those maps supported become redundant (any
+ * high-risk key would already be caught by the general scan) and are
+ * dropped along with them. The per-line `// guard:allow-env-credential`
+ * marker remains the only escape hatch.
+ *
+ * Opt-out (same line, or the line immediately above):
+ *   process.env.SOMETHING // guard:allow-env-credential — short reason
+ */
+import { lineColForOffset, readFileSafe, relPosix, walk, } from "./scan-utils.js";
+const ALLOWLIST_EXACT = new Set([
+    "DATABASE_URL",
+    "DATABASE_AUTH_TOKEN",
+    "NODE_ENV",
+    "CI",
+    "DEBUG",
+    "NETLIFY",
+    "VERCEL",
+    "RENDER",
+    "FLY_APP_NAME",
+    "K_SERVICE",
+    "AWS_LAMBDA_FUNCTION_NAME",
+    "BETTER_AUTH_SECRET",
+    "BETTER_AUTH_URL",
+    "NOTION_CLIENT_ID",
+    "NOTION_CLIENT_SECRET",
+    "NOTION_STATE_SECRET",
+    "GOOGLE_SIGN_IN_CLIENT_ID",
+    "GOOGLE_SIGN_IN_CLIENT_SECRET",
+    "AUTH_SECRET",
+    "A2A_SECRET",
+    "ACCESS_TOKEN",
+    "PORT",
+    "HOST",
+    "SECRETS_ENCRYPTION_KEY",
+]);
+const ALLOWLIST_PREFIX = [
+    "npm_",
+    "AGENT_NATIVE_",
+    "AGENT_",
+    "NETLIFY_",
+    "VERCEL_",
+    "CF_",
+];
+/** Dev-only paths where ANTHROPIC_API_KEY etc. may legitimately be read
+ * from env (local dev tooling, scripts, tests). Portable subset of the
+ * original — the monorepo-only `packages/core/src/dev` predicate is
+ * dropped (see report 005's V1 guard set table). */
+const DEV_ONLY_PATH_PATTERNS = [
+    /\.spec\.[tj]sx?$/,
+    /\.test\.[tj]sx?$/,
+    /^scripts\//,
+];
+const DEV_ONLY_KEYS = new Set(["ANTHROPIC_API_KEY"]);
+const OPT_OUT_MARKER = /\/\/\s*guard:allow-env-credential\b[^\n]*/;
+const OPT_OUT_REQUIRES_REASON = /\/\/\s*guard:allow-env-credential\s*[—-]\s*\S/;
+const ENV_READ_REGEX = /process\.env(?:\.([A-Z][A-Z0-9_]*)|\[\s*["']([A-Z][A-Z0-9_]*)["']\s*\])/g;
+const ENV_DYNAMIC_READ_REGEX = /process\.env(?:\?\.)?\s*\[\s*(?!["'])([^\]\n]+?)\s*\]/g;
+function isAllowlistedKey(key) {
+    if (ALLOWLIST_EXACT.has(key))
+        return true;
+    return ALLOWLIST_PREFIX.some((prefix) => key.startsWith(prefix));
+}
+function isDevOnlyPath(rel) {
+    return DEV_ONLY_PATH_PATTERNS.some((re) => re.test(rel));
+}
+function hasOptOutOnLine(lines, lineIdx) {
+    const cur = lines[lineIdx] ?? "";
+    if (OPT_OUT_MARKER.test(cur))
+        return true;
+    const prev = lines[lineIdx - 1] ?? "";
+    if (/^\s*\/\//.test(prev) && OPT_OUT_MARKER.test(prev))
+        return true;
+    return false;
+}
+function optOutOnLineIsValid(lines, lineIdx, key, rel) {
+    const cur = lines[lineIdx] ?? "";
+    const prev = lines[lineIdx - 1] ?? "";
+    const candidate = OPT_OUT_REQUIRES_REASON.test(cur)
+        ? cur
+        : OPT_OUT_REQUIRES_REASON.test(prev)
+            ? prev
+            : null;
+    if (!candidate)
+        return { ok: false, why: "missing or empty reason" };
+    if (/dev-only\b/i.test(candidate)) {
+        if (!DEV_ONLY_KEYS.has(key)) {
+            return {
+                ok: false,
+                why: `key "${key}" is not in the dev-only credential allowlist`,
+            };
+        }
+        if (!isDevOnlyPath(rel)) {
+            return {
+                ok: false,
+                why: "dev-only opt-out used outside dev / scripts / test paths",
+            };
+        }
+    }
+    return { ok: true };
+}
+export function scanEnvCredentials(options) {
+    const { root } = options;
+    const findings = [];
+    for (const file of walk(root)) {
+        if (!/\.(ts|tsx|mts|cts|js|mjs|cjs)$/.test(file))
+            continue;
+        if (file.endsWith(".d.ts"))
+            continue;
+        const rel = relPosix(root, file);
+        const contents = readFileSafe(file);
+        if (contents === null || !contents.includes("process.env"))
+            continue;
+        const lines = contents.split("\n");
+        ENV_READ_REGEX.lastIndex = 0;
+        let m;
+        while ((m = ENV_READ_REGEX.exec(contents)) !== null) {
+            const key = m[1] ?? m[2];
+            if (!key)
+                continue;
+            const { line } = lineColForOffset(contents, m.index);
+            const lineIdx = line - 1;
+            const lineText = lines[lineIdx] ?? "";
+            const trimmed = lineText.trimStart();
+            if (trimmed.startsWith("*") ||
+                trimmed.startsWith("//") ||
+                trimmed.startsWith("/*")) {
+                continue;
+            }
+            if (isAllowlistedKey(key))
+                continue;
+            if (hasOptOutOnLine(lines, lineIdx)) {
+                const verdict = optOutOnLineIsValid(lines, lineIdx, key, rel);
+                if (verdict.ok)
+                    continue;
+                findings.push({
+                    file: rel,
+                    line,
+                    message: `process.env.${key} opt-out invalid: ${verdict.why}`,
+                });
+                continue;
+            }
+            findings.push({
+                file: rel,
+                line,
+                message: `process.env.${key} read — not a deploy-level allowlisted key. User credentials must be read via resolveCredential(key, { userEmail, orgId }), never process.env.`,
+            });
+        }
+        ENV_DYNAMIC_READ_REGEX.lastIndex = 0;
+        while ((m = ENV_DYNAMIC_READ_REGEX.exec(contents)) !== null) {
+            const { line } = lineColForOffset(contents, m.index);
+            const lineIdx = line - 1;
+            const lineText = lines[lineIdx] ?? "";
+            const trimmed = lineText.trimStart();
+            if (trimmed.startsWith("*") ||
+                trimmed.startsWith("//") ||
+                trimmed.startsWith("/*")) {
+                continue;
+            }
+            if (hasOptOutOnLine(lines, lineIdx)) {
+                const verdict = optOutOnLineIsValid(lines, lineIdx, "<dynamic>", rel);
+                if (verdict.ok)
+                    continue;
+                findings.push({
+                    file: rel,
+                    line,
+                    message: `process.env[<dynamic>] opt-out invalid: ${verdict.why}`,
+                });
+                continue;
+            }
+            findings.push({
+                file: rel,
+                line,
+                message: `process.env[<dynamic key>] read — dynamic keys can never be allowlisted safely.`,
+            });
+        }
+    }
+    return { name: "no-env-credentials", findings };
+}
+//# sourceMappingURL=no-env-credentials.js.map

package/dist/guards/no-env-credentials.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"no-env-credentials.js","sourceRoot":"","sources":["../../src/guards/no-env-credentials.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AAEH,OAAO,EACL,gBAAgB,EAChB,YAAY,EACZ,QAAQ,EACR,IAAI,GACL,MAAM,iBAAiB,CAAC;AAGzB,MAAM,eAAe,GAAG,IAAI,GAAG,CAAC;IAC9B,cAAc;IACd,qBAAqB;IACrB,UAAU;IACV,IAAI;IACJ,OAAO;IACP,SAAS;IACT,QAAQ;IACR,QAAQ;IACR,cAAc;IACd,WAAW;IACX,0BAA0B;IAC1B,oBAAoB;IACpB,iBAAiB;IACjB,kBAAkB;IAClB,sBAAsB;IACtB,qBAAqB;IACrB,0BAA0B;IAC1B,8BAA8B;IAC9B,aAAa;IACb,YAAY;IACZ,cAAc;IACd,MAAM;IACN,MAAM;IACN,wBAAwB;CACzB,CAAC,CAAC;AAEH,MAAM,gBAAgB,GAAG;IACvB,MAAM;IACN,eAAe;IACf,QAAQ;IACR,UAAU;IACV,SAAS;IACT,KAAK;CACN,CAAC;AAEF;;;oDAGoD;AACpD,MAAM,sBAAsB,GAAG;IAC7B,kBAAkB;IAClB,kBAAkB;IAClB,YAAY;CACb,CAAC;AAEF,MAAM,aAAa,GAAG,IAAI,GAAG,CAAC,CAAC,mBAAmB,CAAC,CAAC,CAAC;AAErD,MAAM,cAAc,GAAG,2CAA2C,CAAC;AACnE,MAAM,uBAAuB,GAAG,+CAA+C,CAAC;AAEhF,MAAM,cAAc,GAClB,0EAA0E,CAAC;AAE7E,MAAM,sBAAsB,GAC1B,wDAAwD,CAAC;AAE3D,SAAS,gBAAgB,CAAC,GAAW;IACnC,IAAI,eAAe,CAAC,GAAG,CAAC,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IAC1C,OAAO,gBAAgB,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,GAAG,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC;AACnE,CAAC;AAED,SAAS,aAAa,CAAC,GAAW;IAChC,OAAO,sBAAsB,CAAC,IAAI,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;AAC3D,CAAC;AAED,SAAS,eAAe,CAAC,KAAe,EAAE,OAAe;IACvD,MAAM,GAAG,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;IACjC,IAAI,cAAc,CAAC,IAAI,CAAC,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IAC1C,MAAM,IAAI,GAAG,KAAK,CAAC,OAAO,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;IACtC,IAAI,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IACpE,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,mBAAmB,CAC1B,KAAe,EACf,OAAe,EACf,GAAW,EACX,GAAW;IAEX,MAAM,GAAG,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;IACjC,MAAM,IAAI,GAAG,KAAK,CAAC,OAAO,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;IACtC,MAAM,SAAS,GAAG,uBAAuB,CAAC,IAAI,CAAC,GAAG,CAAC;QACjD,CAAC,CAAC,GAAG;QACL,CAAC,CAAC,uBAAuB,CAAC,IAAI,CAAC,IAAI,CAAC;YAClC,CAAC,CAAC,IAAI;YACN,CAAC,CAAC,IAAI,CAAC;IACX,IAAI,CAAC,SAAS;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,yBAAyB,EAAE,CAAC;IAErE,IAAI,aAAa,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;QAClC,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;YAC5B,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,GAAG,EAAE,QAAQ,GAAG,+CAA+C;aAChE,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,EAAE,CAAC;YACxB,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,GAAG,EAAE,0DAA0D;aAChE,CAAC;QACJ,CAAC;IACH,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;AACtB,CAAC;AAED,MAAM,UAAU,kBAAkB,CAAC,OAAyB;IAC1D,MAAM,EAAE,IAAI,EAAE,GAAG,OAAO,CAAC;IACzB,MAAM,QAAQ,GAAmB,EAAE,CAAC;IAEpC,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QAC9B,IAAI,CAAC,gCAAgC,CAAC,IAAI,CAAC,IAAI,CAAC;YAAE,SAAS;QAC3D,IAAI,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC;YAAE,SAAS;QACrC,MAAM,GAAG,GAAG,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;QAEjC,MAAM,QAAQ,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC;QACpC,IAAI,QAAQ,KAAK,IAAI,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,aAAa,CAAC;YAAE,SAAS;QAErE,MAAM,KAAK,GAAG,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAEnC,cAAc,CAAC,SAAS,GAAG,CAAC,CAAC;QAC7B,IAAI,CAAyB,CAAC;QAC9B,OAAO,CAAC,CAAC,GAAG,cAAc,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;YACpD,MAAM,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;YACzB,IAAI,CAAC,GAAG;gBAAE,SAAS;YACnB,MAAM,EAAE,IAAI,EAAE,GAAG,gBAAgB,CAAC,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC;YACrD,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,CAAC;YACzB,MAAM,QAAQ,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;YACtC,MAAM,OAAO,GAAG,QAAQ,CAAC,SAAS,EAAE,CAAC;YACrC,IACE,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC;gBACvB,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC;gBACxB,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC,EACxB,CAAC;gBACD,SAAS;YACX,CAAC;YACD,IAAI,gBAAgB,CAAC,GAAG,CAAC;gBAAE,SAAS;YACpC,IAAI,eAAe,CAAC,KAAK,EAAE,OAAO,CAAC,EAAE,CAAC;gBACpC,MAAM,OAAO,GAAG,mBAAmB,CAAC,KAAK,EAAE,OAAO,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC;gBAC9D,IAAI,OAAO,CAAC,EAAE;oBAAE,SAAS;gBACzB,QAAQ,CAAC,IAAI,CAAC;oBACZ,IAAI,EAAE,GAAG;oBACT,IAAI;oBACJ,OAAO,EAAE,eAAe,GAAG,qBAAqB,OAAO,CAAC,GAAG,EAAE;iBAC9D,CAAC,CAAC;gBACH,SAAS;YACX,CAAC;YACD,QAAQ,CAAC,IAAI,CAAC;gBACZ,IAAI,EAAE,GAAG;gBACT,IAAI;gBACJ,OAAO,EAAE,eAAe,GAAG,gJAAgJ;aAC5K,CAAC,CAAC;QACL,CAAC;QAED,sBAAsB,CAAC,SAAS,GAAG,CAAC,CAAC;QACrC,OAAO,CAAC,CAAC,GAAG,sBAAsB,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;YAC5D,MAAM,EAAE,IAAI,EAAE,GAAG,gBAAgB,CAAC,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC;YACrD,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,CAAC;YACzB,MAAM,QAAQ,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;YACtC,MAAM,OAAO,GAAG,QAAQ,CAAC,SAAS,EAAE,CAAC;YACrC,IACE,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC;gBACvB,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC;gBACxB,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC,EACxB,CAAC;gBACD,SAAS;YACX,CAAC;YACD,IAAI,eAAe,CAAC,KAAK,EAAE,OAAO,CAAC,EAAE,CAAC;gBACpC,MAAM,OAAO,GAAG,mBAAmB,CAAC,KAAK,EAAE,OAAO,EAAE,WAAW,EAAE,GAAG,CAAC,CAAC;gBACtE,IAAI,OAAO,CAAC,EAAE;oBAAE,SAAS;gBACzB,QAAQ,CAAC,IAAI,CAAC;oBACZ,IAAI,EAAE,GAAG;oBACT,IAAI;oBACJ,OAAO,EAAE,2CAA2C,OAAO,CAAC,GAAG,EAAE;iBAClE,CAAC,CAAC;gBACH,SAAS;YACX,CAAC;YACD,QAAQ,CAAC,IAAI,CAAC;gBACZ,IAAI,EAAE,GAAG;gBACT,IAAI;gBACJ,OAAO,EAAE,iFAAiF;aAC3F,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,OAAO,EAAE,IAAI,EAAE,oBAAoB,EAAE,QAAQ,EAAE,CAAC;AAClD,CAAC","sourcesContent":["/**\n * scanEnvCredentials — ported from `scripts/guard-no-env-credentials.mjs`.\n *\n * User credentials are per-user (or per-org) data. They MUST live in SQL,\n * scoped by `userEmail` / `orgId`, never in `process.env` — a deployment's\n * env vars are shared by every signed-in user. This guard flags any\n * `process.env.<KEY>` / `process.env[\"KEY\"]` read whose key is not on the\n * deploy-level allowlist (`DATABASE_URL`, `BETTER_AUTH_SECRET`, etc.), plus\n * any dynamic `process.env[key]` read (the key is only known at runtime, so\n * it can never be allowlisted safely).\n *\n * Conditional guard — per report 005's V1 guard set table, this is \"the big\n * one\": the original only scans a curated set of monorepo subtrees\n * (`packages/core/src/{credentials,secrets,vault,agent}/`, template\n * credential libs/routes) via `FORBIDDEN_PATH_PREDICATES` — none of which\n * exist in a generated app, so nothing would ever be scanned. This port\n * replaces that default-allow-outside-a-curated-subtree behavior with\n * default-deny across the whole app source tree: every `process.env.<KEY>`\n * read anywhere in app source must be on the deploy-var allowlist (kept\n * verbatim) or carry the opt-out marker. `HIGH_RISK_ENV_KEY_ALLOWLIST`,\n * `HIGH_RISK_PROCESS_ENV_ALLOWLIST`, and `HIGH_RISK_ENV_VARS_WRITE_ALLOWLIST`\n * — the three monorepo-file-keyed exception maps for specific template\n * platform-adapter files — are dropped entirely per the report; with\n * default-deny scanning already covering every `process.env` read\n * everywhere, the narrower `env-config.ts`/`core-routes.ts`-specific\n * registration checks those maps supported become redundant (any\n * high-risk key would already be caught by the general scan) and are\n * dropped along with them. The per-line `// guard:allow-env-credential`\n * marker remains the only escape hatch.\n *\n * Opt-out (same line, or the line immediately above):\n *   process.env.SOMETHING // guard:allow-env-credential — short reason\n */\n\nimport {\n  lineColForOffset,\n  readFileSafe,\n  relPosix,\n  walk,\n} from \"./scan-utils.js\";\nimport type { GuardFinding, GuardResult, GuardScanOptions } from \"./types.js\";\n\nconst ALLOWLIST_EXACT = new Set([\n  \"DATABASE_URL\",\n  \"DATABASE_AUTH_TOKEN\",\n  \"NODE_ENV\",\n  \"CI\",\n  \"DEBUG\",\n  \"NETLIFY\",\n  \"VERCEL\",\n  \"RENDER\",\n  \"FLY_APP_NAME\",\n  \"K_SERVICE\",\n  \"AWS_LAMBDA_FUNCTION_NAME\",\n  \"BETTER_AUTH_SECRET\",\n  \"BETTER_AUTH_URL\",\n  \"NOTION_CLIENT_ID\",\n  \"NOTION_CLIENT_SECRET\",\n  \"NOTION_STATE_SECRET\",\n  \"GOOGLE_SIGN_IN_CLIENT_ID\",\n  \"GOOGLE_SIGN_IN_CLIENT_SECRET\",\n  \"AUTH_SECRET\",\n  \"A2A_SECRET\",\n  \"ACCESS_TOKEN\",\n  \"PORT\",\n  \"HOST\",\n  \"SECRETS_ENCRYPTION_KEY\",\n]);\n\nconst ALLOWLIST_PREFIX = [\n  \"npm_\",\n  \"AGENT_NATIVE_\",\n  \"AGENT_\",\n  \"NETLIFY_\",\n  \"VERCEL_\",\n  \"CF_\",\n];\n\n/** Dev-only paths where ANTHROPIC_API_KEY etc. may legitimately be read\n * from env (local dev tooling, scripts, tests). Portable subset of the\n * original — the monorepo-only `packages/core/src/dev` predicate is\n * dropped (see report 005's V1 guard set table). */\nconst DEV_ONLY_PATH_PATTERNS = [\n  /\\.spec\\.[tj]sx?$/,\n  /\\.test\\.[tj]sx?$/,\n  /^scripts\\//,\n];\n\nconst DEV_ONLY_KEYS = new Set([\"ANTHROPIC_API_KEY\"]);\n\nconst OPT_OUT_MARKER = /\\/\\/\\s*guard:allow-env-credential\\b[^\\n]*/;\nconst OPT_OUT_REQUIRES_REASON = /\\/\\/\\s*guard:allow-env-credential\\s*[—-]\\s*\\S/;\n\nconst ENV_READ_REGEX =\n  /process\\.env(?:\\.([A-Z][A-Z0-9_]*)|\\[\\s*[\"']([A-Z][A-Z0-9_]*)[\"']\\s*\\])/g;\n\nconst ENV_DYNAMIC_READ_REGEX =\n  /process\\.env(?:\\?\\.)?\\s*\\[\\s*(?![\"'])([^\\]\\n]+?)\\s*\\]/g;\n\nfunction isAllowlistedKey(key: string): boolean {\n  if (ALLOWLIST_EXACT.has(key)) return true;\n  return ALLOWLIST_PREFIX.some((prefix) => key.startsWith(prefix));\n}\n\nfunction isDevOnlyPath(rel: string): boolean {\n  return DEV_ONLY_PATH_PATTERNS.some((re) => re.test(rel));\n}\n\nfunction hasOptOutOnLine(lines: string[], lineIdx: number): boolean {\n  const cur = lines[lineIdx] ?? \"\";\n  if (OPT_OUT_MARKER.test(cur)) return true;\n  const prev = lines[lineIdx - 1] ?? \"\";\n  if (/^\\s*\\/\\//.test(prev) && OPT_OUT_MARKER.test(prev)) return true;\n  return false;\n}\n\nfunction optOutOnLineIsValid(\n  lines: string[],\n  lineIdx: number,\n  key: string,\n  rel: string,\n): { ok: boolean; why?: string } {\n  const cur = lines[lineIdx] ?? \"\";\n  const prev = lines[lineIdx - 1] ?? \"\";\n  const candidate = OPT_OUT_REQUIRES_REASON.test(cur)\n    ? cur\n    : OPT_OUT_REQUIRES_REASON.test(prev)\n      ? prev\n      : null;\n  if (!candidate) return { ok: false, why: \"missing or empty reason\" };\n\n  if (/dev-only\\b/i.test(candidate)) {\n    if (!DEV_ONLY_KEYS.has(key)) {\n      return {\n        ok: false,\n        why: `key \"${key}\" is not in the dev-only credential allowlist`,\n      };\n    }\n    if (!isDevOnlyPath(rel)) {\n      return {\n        ok: false,\n        why: \"dev-only opt-out used outside dev / scripts / test paths\",\n      };\n    }\n  }\n  return { ok: true };\n}\n\nexport function scanEnvCredentials(options: GuardScanOptions): GuardResult {\n  const { root } = options;\n  const findings: GuardFinding[] = [];\n\n  for (const file of walk(root)) {\n    if (!/\\.(ts|tsx|mts|cts|js|mjs|cjs)$/.test(file)) continue;\n    if (file.endsWith(\".d.ts\")) continue;\n    const rel = relPosix(root, file);\n\n    const contents = readFileSafe(file);\n    if (contents === null || !contents.includes(\"process.env\")) continue;\n\n    const lines = contents.split(\"\\n\");\n\n    ENV_READ_REGEX.lastIndex = 0;\n    let m: RegExpExecArray | null;\n    while ((m = ENV_READ_REGEX.exec(contents)) !== null) {\n      const key = m[1] ?? m[2];\n      if (!key) continue;\n      const { line } = lineColForOffset(contents, m.index);\n      const lineIdx = line - 1;\n      const lineText = lines[lineIdx] ?? \"\";\n      const trimmed = lineText.trimStart();\n      if (\n        trimmed.startsWith(\"*\") ||\n        trimmed.startsWith(\"//\") ||\n        trimmed.startsWith(\"/*\")\n      ) {\n        continue;\n      }\n      if (isAllowlistedKey(key)) continue;\n      if (hasOptOutOnLine(lines, lineIdx)) {\n        const verdict = optOutOnLineIsValid(lines, lineIdx, key, rel);\n        if (verdict.ok) continue;\n        findings.push({\n          file: rel,\n          line,\n          message: `process.env.${key} opt-out invalid: ${verdict.why}`,\n        });\n        continue;\n      }\n      findings.push({\n        file: rel,\n        line,\n        message: `process.env.${key} read — not a deploy-level allowlisted key. User credentials must be read via resolveCredential(key, { userEmail, orgId }), never process.env.`,\n      });\n    }\n\n    ENV_DYNAMIC_READ_REGEX.lastIndex = 0;\n    while ((m = ENV_DYNAMIC_READ_REGEX.exec(contents)) !== null) {\n      const { line } = lineColForOffset(contents, m.index);\n      const lineIdx = line - 1;\n      const lineText = lines[lineIdx] ?? \"\";\n      const trimmed = lineText.trimStart();\n      if (\n        trimmed.startsWith(\"*\") ||\n        trimmed.startsWith(\"//\") ||\n        trimmed.startsWith(\"/*\")\n      ) {\n        continue;\n      }\n      if (hasOptOutOnLine(lines, lineIdx)) {\n        const verdict = optOutOnLineIsValid(lines, lineIdx, \"<dynamic>\", rel);\n        if (verdict.ok) continue;\n        findings.push({\n          file: rel,\n          line,\n          message: `process.env[<dynamic>] opt-out invalid: ${verdict.why}`,\n        });\n        continue;\n      }\n      findings.push({\n        file: rel,\n        line,\n        message: `process.env[<dynamic key>] read — dynamic keys can never be allowlisted safely.`,\n      });\n    }\n  }\n\n  return { name: \"no-env-credentials\", findings };\n}\n"]}