@dokebi/cli 0.4.2 → 0.4.27

package/dist/check/security-rules.js

@@ -0,0 +1,450 @@
+// Security rules of `dokebi check` over the TypeScript AST (D-0076 §6), on only when the plugin
+// they protect is installed (an app without @dokebi/auth may compare whatever it likes):
+//   plain-password-compare  (error, @dokebi/auth) a value named like a password (a word of its
+//                           name is password, passwd, passphrase, pass, pw or pwd) compared with
+//                           ===, !==, == or != (not with '', null, undefined, a boolean or a
+//                           number; not two values that both come from the request input, such
+//                           as a new password and its confirmation field (AI-M05 F4); not two
+//                           of them where one is a confirmation such as passwordConfirm, unless
+//                           one side is a stored value: a hash, or a field of a user, row,
+//                           account or credentials object), or given to node:crypto's timingSafeEqual, scrypt,
+//                           pbkdf2 or argon2, to the update() of a createHash()/createHmac(), or
+//                           to bcrypt/argon2 packages: the plugin checks and hashes passwords.
+//   csrf-exempt-unverified  (warning, @dokebi/csrf) a route whose `config` has `csrf: false` and
+//                           whose registration call (with the handler functions of the same file
+//                           it names) shows no rawBody, signature check (signature, createHmac,
+//                           timingSafeEqual, .verify(…)), no seal, no @dokebi/auth token refresh
+//                           (tokens.refresh(…): the refresh token is the proof), and no `oauth`
+//                           key or `auth: { via: 'token' }` in the same config (a Bearer-only
+//                           route: no cookie authenticates it; `via: 'any'` or 'session' does
+//                           not count): an exempt route must prove the sender some other way.
+// Both are heuristics on names and text; a `// dokebi-check: allow <rule> <reason>` comment
+// silences a deliberate case.
+import { field, nodes, property, } from './typescript.js';
+const PASSWORD_WORDS = new Set(['password', 'passwd', 'passphrase', 'pass', 'pw', 'pwd']);
+/** A second password typed to confirm the first: comparing the two is fine. */
+const CONFIRM_WORDS = new Set([
+    'confirm',
+    'confirmation',
+    'confirmed',
+    'repeat',
+    'again',
+    'retype',
+]);
+/**
+ * Objects that hold request input: a value read from them (`body.password`, `request.query.x`,
+ * a local destructured from `request.body`) is something the user just typed.
+ */
+const INPUT_HOLDERS = new Set([
+    'body',
+    'query',
+    'params',
+    'input',
+    'inputs',
+    'form',
+    'fields',
+    'values',
+    'payload',
+    'submitted',
+]);
+/** Objects that hold stored records: a password read from them is the stored one. */
+const STORED_HOLDERS = new Set([
+    'db',
+    'database',
+    'row',
+    'rows',
+    'record',
+    'records',
+    'user',
+    'users',
+    'account',
+    'accounts',
+    'admin',
+    'admins',
+    'author',
+    'authors',
+    'member',
+    'members',
+    'credential',
+    'credentials',
+    'existing',
+    'model',
+    'entity',
+    'stored',
+    'saved',
+]);
+/** Words of a value's own name that say it is stored: `passwordHash`, `pass_phc`. */
+const STORED_VALUES = new Set(['hash', 'hashed', 'digest', 'phc', 'stored', 'saved']);
+/** Calls that only reshape a typed value (`String(body.next).trim()`). */
+const RESHAPE = new Set([
+    'String',
+    'trim',
+    'trimStart',
+    'trimEnd',
+    'normalize',
+    'toString',
+    'toLowerCase',
+    'toUpperCase',
+]);
+const COMPARE = [
+    'EqualsEqualsEqualsToken',
+    'ExclamationEqualsEqualsToken',
+    'EqualsEqualsToken',
+    'ExclamationEqualsToken',
+];
+/** node:crypto functions that hash or compare secrets. */
+const CRYPTO = new Set([
+    'timingSafeEqual',
+    'scrypt',
+    'scryptSync',
+    'pbkdf2',
+    'pbkdf2Sync',
+    'argon2',
+    'argon2Sync',
+]);
+/** Password packages an app might call instead of the plugin. */
+const PASSWORD_PACKAGES = new Set(['bcrypt', 'bcryptjs', 'argon2']);
+/**
+ * Proofs of the sender in a route's text: a raw-body signature, a seal, or @dokebi/auth's token
+ * refresh (`request.auth.tokens.refresh(token)`, `realm.tokens.refresh(…)`): the refresh token
+ * the request carries is the credential, which another site does not have.
+ */
+const VERIFIED = /rawBody|signature|createHmac|timingSafeEqual|\.verify\s*\(|\bseal|\btokens\s*\.\s*refresh\s*\(/i;
+/** `passwordHash` → [password, hash]; `pass_phc` → [pass, phc]; `PW` → [pw]. */
+export function nameWords(name) {
+    return name
+        .replace(/([a-z0-9])([A-Z])/g, '$1 $2')
+        .replace(/([A-Z]+)([A-Z][a-z])/g, '$1 $2')
+        .split(/[\s_$-]+/)
+        .filter(Boolean)
+        .map((word) => word.toLowerCase());
+}
+export function passwordLike(name) {
+    return nameWords(name).some((word) => PASSWORD_WORDS.has(word));
+}
+export function securityRules(file, kinds, installed, report) {
+    const text = file.text;
+    const compare = new Set(COMPARE.map((name) => kinds[name]));
+    const snippet = (node) => {
+        const source = text.slice(node.getStart(), node.end).replace(/\s+/g, ' ');
+        return source.length > 60 ? `${source.slice(0, 59)}…` : source;
+    };
+    const unwrap = (node) => {
+        let current = node;
+        while (current &&
+            (current.kind === kinds.ParenthesizedExpression ||
+                current.kind === kinds.AsExpression ||
+                current.kind === kinds.NonNullExpression))
+            current = field(current, 'expression');
+        return current;
+    };
+    /** The name an expression reads: `password`, `body.password`, `body['password']`. */
+    const nameOf = (node) => {
+        const current = unwrap(node);
+        if (!current)
+            return undefined;
+        if (current.kind === kinds.Identifier)
+            return String(property(current, 'text'));
+        if (current.kind === kinds.PropertyAccessExpression) {
+            const name = field(current, 'name');
+            return name ? String(property(name, 'text')) : undefined;
+        }
+        if (current.kind === kinds.ElementAccessExpression) {
+            const key = field(current, 'argumentExpression');
+            return key &&
+                (key.kind === kinds.StringLiteral || key.kind === kinds.NoSubstitutionTemplateLiteral)
+                ? String(property(key, 'text'))
+                : undefined;
+        }
+        return undefined;
+    };
+    /** '', null, undefined, true, false or a number: a presence or shape test, not a check. */
+    const harmless = (node) => {
+        const current = unwrap(node);
+        if (!current)
+            return true;
+        if (current.kind === kinds.StringLiteral ||
+            current.kind === kinds.NoSubstitutionTemplateLiteral)
+            return String(property(current, 'text')) === '';
+        if (current.kind === kinds.Identifier)
+            return String(property(current, 'text')) === 'undefined';
+        return (current.kind === kinds.NullKeyword ||
+            current.kind === kinds.TrueKeyword ||
+            current.kind === kinds.FalseKeyword ||
+            current.kind === kinds.NumericLiteral ||
+            current.kind === kinds.TypeOfExpression);
+    };
+    /** Whether a password-like name is read anywhere inside `node`. */
+    const readsPassword = (node) => {
+        let found = false;
+        const walk = (current) => {
+            if (found)
+                return undefined;
+            const name = nameOf(current);
+            if ((current.kind === kinds.Identifier ||
+                current.kind === kinds.PropertyAccessExpression ||
+                current.kind === kinds.ElementAccessExpression) &&
+                name !== undefined &&
+                passwordLike(name)) {
+                found = true;
+                return undefined;
+            }
+            current.forEachChild(walk);
+            return undefined;
+        };
+        walk(node);
+        return found;
+    };
+    const calleeName = (call) => {
+        const callee = unwrap(field(call, 'expression'));
+        if (callee?.kind === kinds.Identifier)
+            return String(property(callee, 'text'));
+        if (callee?.kind === kinds.PropertyAccessExpression) {
+            const name = field(callee, 'name');
+            return name ? String(property(name, 'text')) : undefined;
+        }
+        return undefined;
+    };
+    const receiverOf = (call) => {
+        const callee = unwrap(field(call, 'expression'));
+        return callee?.kind === kinds.PropertyAccessExpression
+            ? unwrap(field(callee, 'expression'))
+            : undefined;
+    };
+    /** `createHash('sha256')` somewhere at the start of `node`'s call chain. */
+    const fromHash = (node) => {
+        let current = unwrap(node);
+        while (current) {
+            if (current.kind === kinds.CallExpression) {
+                const name = calleeName(current);
+                if (name === 'createHash' || name === 'createHmac')
+                    return true;
+                current = receiverOf(current);
+            }
+            else if (current.kind === kinds.PropertyAccessExpression)
+                current = unwrap(field(current, 'expression'));
+            else
+                return false;
+        }
+        return false;
+    };
+    /**
+     * Where the values of local names come from in this file: initializers of `const x = …` and,
+     * for `const { a, b: c } = source`, the source object. A name declared several times keeps
+     * every source (a stored one anywhere makes it stored).
+     */
+    const sources = new Map();
+    const collect = (node) => {
+        if (node.kind === kinds.VariableDeclaration) {
+            const name = field(node, 'name');
+            const initializer = field(node, 'initializer');
+            if (name && initializer) {
+                if (name.kind === kinds.Identifier) {
+                    const key = String(property(name, 'text'));
+                    sources.set(key, [...(sources.get(key) ?? []), initializer]);
+                }
+                else if (name.kind === kinds.ObjectBindingPattern)
+                    for (const element of nodes(name, 'elements')) {
+                        const local = field(element, 'name');
+                        if (element.kind === kinds.BindingElement && local?.kind === kinds.Identifier) {
+                            const key = String(property(local, 'text'));
+                            sources.set(key, [...(sources.get(key) ?? []), initializer]);
+                        }
+                    }
+            }
+        }
+        node.forEachChild(collect);
+        return undefined;
+    };
+    file.forEachChild(collect);
+    const words = (name, set) => nameWords(name).some((word) => set.has(word));
+    /**
+     * Where a compared value comes from: `input` (request input: a field of body, query, params,
+     * a form, or a local made from one), `stored` (a hash, a field of a user, row, account or
+     * credentials object, a local made from one, or a call that loads one) or `unknown`.
+     */
+    const origin = (node, depth = 0) => {
+        let current = unwrap(node);
+        while (current?.kind === kinds.AwaitExpression)
+            current = unwrap(field(current, 'expression'));
+        if (!current || depth > 8)
+            return 'unknown';
+        if (current.kind === kinds.Identifier) {
+            const name = String(property(current, 'text'));
+            if (words(name, STORED_VALUES) || words(name, STORED_HOLDERS))
+                return 'stored';
+            // Where it was declared counts first: a `body` loaded from the database is not input.
+            const from = (sources.get(name) ?? []).map((item) => origin(item, depth + 1));
+            if (from.includes('stored'))
+                return 'stored';
+            if (INPUT_HOLDERS.has(name))
+                return 'input';
+            return from.length && from.every((item) => item === 'input') ? 'input' : 'unknown';
+        }
+        if (current.kind === kinds.PropertyAccessExpression ||
+            current.kind === kinds.ElementAccessExpression) {
+            const own = nameOf(current);
+            if (own !== undefined && words(own, STORED_VALUES))
+                return 'stored';
+            // The holder itself (`request.body`, `request.user`) as the value: a destructuring source.
+            if (own !== undefined && INPUT_HOLDERS.has(own))
+                return 'input';
+            if (own !== undefined && STORED_HOLDERS.has(own))
+                return 'stored';
+            const holder = unwrap(field(current, 'expression'));
+            const holderName = nameOf(holder);
+            if (holderName !== undefined && words(holderName, STORED_HOLDERS))
+                return 'stored';
+            const inner = origin(holder, depth + 1);
+            if (inner === 'stored')
+                return 'stored';
+            return inner === 'input' || (holderName !== undefined && INPUT_HOLDERS.has(holderName))
+                ? 'input'
+                : 'unknown';
+        }
+        if (current.kind === kinds.CallExpression) {
+            const name = calleeName(current);
+            if (name !== undefined && (words(name, STORED_HOLDERS) || words(name, STORED_VALUES)))
+                return 'stored';
+            if (name === undefined || !RESHAPE.has(name))
+                return 'unknown';
+            const receiver = receiverOf(current);
+            const args = nodes(current, 'arguments');
+            return origin(receiver ?? args[0], depth + 1);
+        }
+        if (current.kind === kinds.BinaryExpression) {
+            const operator = field(current, 'operatorToken')?.kind;
+            // `body.password ?? ''`: the typed value, or an empty default.
+            if (operator === kinds.QuestionQuestionToken || operator === kinds.BarBarToken)
+                return origin(field(current, 'left'), depth + 1);
+            return 'unknown';
+        }
+        if (current.kind === kinds.ConditionalExpression) {
+            const branches = [field(current, 'whenTrue'), field(current, 'whenFalse')].map((item) => harmless(item) ? 'input' : origin(item, depth + 1));
+            if (branches.includes('stored'))
+                return 'stored';
+            return branches.every((item) => item === 'input') ? 'input' : 'unknown';
+        }
+        return 'unknown';
+    };
+    const passwordFix = 'let @dokebi/auth do it: sign in with await request.auth.attempt({ identity, password }) (it checks, throttles and starts the session); hash new passwords with passwords.hash(password) and check one with passwords.verify(hash, password) (the plugin API or @dokebi/auth); never compare or hash a password yourself';
+    /** Function bodies of this file by name (a route's handler given by name). */
+    const declarations = new Map();
+    for (const statement of nodes(file, 'statements')) {
+        if (statement.kind === kinds.FunctionDeclaration) {
+            const name = field(statement, 'name');
+            if (name)
+                declarations.set(String(property(name, 'text')), statement);
+        }
+        else if (statement.kind === kinds.VariableStatement) {
+            const list = field(statement, 'declarationList');
+            for (const declaration of list ? nodes(list, 'declarations') : []) {
+                const name = field(declaration, 'name');
+                if (name?.kind === kinds.Identifier)
+                    declarations.set(String(property(name, 'text')), declaration);
+            }
+        }
+    }
+    /** The registration call text plus the handlers of this file it names. */
+    const routeText = (call) => {
+        const parts = [text.slice(call.getStart(), call.end)];
+        const named = (node) => {
+            const current = unwrap(node);
+            if (current?.kind !== kinds.Identifier)
+                return;
+            const declaration = declarations.get(String(property(current, 'text')));
+            if (declaration)
+                parts.push(text.slice(declaration.getStart(), declaration.end));
+        };
+        for (const argument of nodes(call, 'arguments')) {
+            named(argument);
+            if (unwrap(argument)?.kind === kinds.ObjectLiteralExpression)
+                for (const item of nodes(unwrap(argument), 'properties'))
+                    if (item.kind === kinds.PropertyAssignment)
+                        named(field(item, 'initializer'));
+        }
+        return parts.join('\n');
+    };
+    const propertyName = (node) => {
+        const name = field(node, 'name');
+        if (!name)
+            return undefined;
+        if (name.kind === kinds.Identifier || name.kind === kinds.StringLiteral)
+            return String(property(name, 'text'));
+        return undefined;
+    };
+    const visit = (node) => {
+        if (installed.auth && node.kind === kinds.BinaryExpression) {
+            const operator = field(node, 'operatorToken');
+            if (operator && compare.has(operator.kind)) {
+                const left = field(node, 'left');
+                const right = field(node, 'right');
+                const leftName = nameOf(left);
+                const rightName = nameOf(right);
+                const leftPassword = leftName !== undefined && passwordLike(leftName);
+                const rightPassword = rightName !== undefined && passwordLike(rightName);
+                const confirmation = [leftName, rightName].some((name) => name !== undefined && nameWords(name).some((word) => CONFIRM_WORDS.has(word)));
+                if ((leftPassword && !harmless(right)) || (rightPassword && !harmless(left))) {
+                    // AI-M05 F4: two values the user typed (a new password and its confirmation) may be
+                    // compared; a typed value against a stored one (a hash, a user or row field) may not.
+                    const sides = [origin(left), origin(right)];
+                    const typed = sides.every((side) => side === 'input');
+                    const stored = sides.includes('stored');
+                    if (!(typed || (leftPassword && rightPassword && confirmation && !stored)))
+                        report(node, 'plain-password-compare', `${snippet(node)} compares a password itself: a plain comparison leaks timing, and stored passwords must be hashes the plugin checks`, passwordFix);
+                }
+            }
+        }
+        else if (installed.auth && node.kind === kinds.CallExpression) {
+            const name = calleeName(node);
+            const receiver = receiverOf(node);
+            const receiverName = receiver?.kind === kinds.Identifier ? String(property(receiver, 'text')) : undefined;
+            const hashing = (name !== undefined && CRYPTO.has(name)) ||
+                (name === 'update' && fromHash(receiver)) ||
+                (receiverName !== undefined && PASSWORD_PACKAGES.has(receiverName));
+            if (hashing && nodes(node, 'arguments').some(readsPassword))
+                report(node, 'plain-password-compare', `${snippet(node)} hashes or compares a password itself (@dokebi/auth is installed)`, passwordFix);
+        }
+        else if (installed.csrf && node.kind === kinds.PropertyAssignment) {
+            const value = unwrap(field(node, 'initializer'));
+            const object = node.parent;
+            const config = object?.parent;
+            if (propertyName(node) === 'csrf' &&
+                value?.kind === kinds.FalseKeyword &&
+                object?.kind === kinds.ObjectLiteralExpression &&
+                config?.kind === kinds.PropertyAssignment &&
+                propertyName(config) === 'config') {
+                let call = config.parent;
+                while (call && call.kind !== kinds.CallExpression)
+                    call = call.parent;
+                // A route that requires an OAuth Bearer token (config.oauth) is not authenticated by
+                // the visitor's cookies, so another site cannot post to it as the visitor.
+                // So is a route of @dokebi/auth that reads Bearer tokens only (auth: { via: 'token' }):
+                // no session cookie authenticates it. `via: 'any'` and 'session' accept the cookie, so
+                // they prove nothing.
+                const properties = nodes(object, 'properties');
+                const tokenOnly = properties.some((p) => {
+                    if (p.kind !== kinds.PropertyAssignment || propertyName(p) !== 'auth')
+                        return false;
+                    const auth = unwrap(field(p, 'initializer'));
+                    if (auth?.kind !== kinds.ObjectLiteralExpression)
+                        return false;
+                    return nodes(auth, 'properties').some((item) => {
+                        if (item.kind !== kinds.PropertyAssignment || propertyName(item) !== 'via')
+                            return false;
+                        const via = unwrap(field(item, 'initializer'));
+                        return ((via?.kind === kinds.StringLiteral ||
+                            via?.kind === kinds.NoSubstitutionTemplateLiteral) &&
+                            property(via, 'text') === 'token');
+                    });
+                });
+                const bearer = tokenOnly || properties.some((p) => propertyName(p) === 'oauth');
+                if (!bearer && (!call || !VERIFIED.test(routeText(call))))
+                    report(node, 'csrf-exempt-unverified', "A route with config: { csrf: false } shows no other proof of its sender (no rawBody, signature check or seal in its registration or its handler in this file): any site can post to it with the visitor's cookies", 'remove csrf: false (forms and scripts send the token: data.csrf.field, the X-XSRF-TOKEN header; Inertia does it by itself), or verify the sender in the handler (an HMAC signature over the raw body with timingSafeEqual, a sealed request); never turn the check off to make a test pass. A deliberate case takes // dokebi-check: allow csrf-exempt-unverified <reason>');
+            }
+        }
+        node.forEachChild(visit);
+        return undefined;
+    };
+    file.forEachChild(visit);
+}

package/dist/check/shared-state-rules.d.ts

@@ -0,0 +1,15 @@
+import type { Problem } from './problems.js';
+type Options = Record<string, unknown>;
+/** One piece of state kept in process memory: its option path and what it would lose. */
+export interface Kept {
+    readonly path: readonly string[];
+    readonly what: string;
+    readonly fix: (redis: string | undefined) => string;
+}
+/**
+ * The state of each installed plugin that stays in one process with these options (also
+ * `doctor --production`, D-0184: the plugins refuse it in production too).
+ */
+export declare function kept(installed: ReadonlySet<string>, options: Options): Kept[];
+export declare function sharedStateProblems(root: string, installed: ReadonlySet<string>): Promise<Problem[]>;
+export {};

package/dist/check/shared-state-rules.js

@@ -0,0 +1,117 @@
+// The shared-state rule of `dokebi check` (D-0161, an error):
+//   shared-state-memory  an app with more than one worker (options.application-runtime.workers
+//                        above 1) keeps state its workers must share in process memory: the
+//                        session store, auth tokens and login counts, OAuth grants, rate-limit
+//                        counters, seal replay nonces or a local WebSocket hub. Each worker would
+//                        hold its own (R1: 4 of 4 reset links answered "invalid"), and the plugins
+//                        refuse to start that way in a cluster worker and in production.
+// Production with one worker is refused at start too; dokebi.yaml cannot tell a production run.
+import { readFile } from 'node:fs/promises';
+import { join } from 'node:path';
+import { CONFIG_FILE, parseProjectConfig } from '../configuration.js';
+import { debug, describeError, isMissing } from '../diagnostics.js';
+import { CliError } from '../errors.js';
+import { optionLine } from './project-rules.js';
+const RULE = 'shared-state-memory';
+const record = (value) => value !== null && typeof value === 'object' && !Array.isArray(value) ? value : {};
+const redisValue = (redis) => `driver: redis, connection: ${redis ?? '<a dokebi-redis connection>'}`;
+const addRedis = (redis) => redis === undefined ? ' (npx dokebi add @dokebi/redis first)' : '';
+/**
+ * The state of each installed plugin that stays in one process with these options (also
+ * `doctor --production`, D-0184: the plugins refuse it in production too).
+ */
+export function kept(installed, options) {
+    const found = [];
+    const plugin = (id) => record(options[id]);
+    if (installed.has('dokebi-session') &&
+        (record(plugin('dokebi-session').store).driver ?? 'memory') === 'memory')
+        found.push({
+            path: ['dokebi-session', 'store'],
+            what: 'sessions',
+            fix: (redis) => `set options.dokebi-session.store: { ${redisValue(redis)} }${addRedis(redis)}`,
+        });
+    if (installed.has('dokebi-auth')) {
+        const auth = plugin('dokebi-auth');
+        if ((record(auth.tokens).driver ?? 'memory') === 'memory')
+            found.push({
+                path: ['dokebi-auth', 'tokens'],
+                what: 'auth tokens (mail links, API and remember-me tokens)',
+                fix: (redis) => `set options.dokebi-auth.tokens: { ${redisValue(redis)} } (or { driver: sql, connection: <a dokebi-db connection> })${addRedis(redis)}`,
+            });
+        if ((record(record(auth.throttle).store).driver ?? 'memory') === 'memory')
+            found.push({
+                path: ['dokebi-auth', 'throttle'],
+                what: 'login attempt counts',
+                fix: (redis) => `set options.dokebi-auth.throttle.store: { ${redisValue(redis)} }${addRedis(redis)}`,
+            });
+    }
+    if (installed.has('dokebi-oauth') &&
+        (record(plugin('dokebi-oauth').store).driver ?? 'memory') === 'memory')
+        found.push({
+            path: ['dokebi-oauth', 'store'],
+            what: 'OAuth grants and tokens',
+            fix: (redis) => `set options.dokebi-oauth.store: { ${redisValue(redis)} } (or { driver: sql, connection: <a dokebi-db connection> })${addRedis(redis)}`,
+        });
+    if (installed.has('dokebi-rate-limit') &&
+        (plugin('dokebi-rate-limit').driver ?? 'local') === 'local')
+        found.push({
+            path: ['dokebi-rate-limit'],
+            what: 'rate-limit counters',
+            fix: (redis) => `set options.dokebi-rate-limit: { ${redisValue(redis)} }${addRedis(redis)}`,
+        });
+    const hub = plugin('dokebi-websocket-hub');
+    const hubShared = installed.has('dokebi-websocket-hub') && hub.mode === 'cluster';
+    if (installed.has('dokebi-websocket-hub') && !hubShared && hub.allowInCluster !== true)
+        found.push({
+            path: ['dokebi-websocket-hub'],
+            what: 'WebSocket presence (a local hub)',
+            fix: (redis) => `set options.dokebi-websocket-hub: { mode: cluster, redisConnection: ${redis ?? '<a dokebi-redis connection>'} }${addRedis(redis)}`,
+        });
+    if (installed.has('dokebi-seal')) {
+        const nonces = record(plugin('dokebi-seal').nonces);
+        const driver = nonces.driver ?? 'auto';
+        const shared = driver === 'redis' || ((driver === 'auto' || driver === 'hub') && hubShared);
+        if (!shared && nonces.allowInCluster !== true)
+            found.push({
+                path: ['dokebi-seal', 'nonces'],
+                what: 'replay nonces of sealed requests',
+                fix: (redis) => `set options.dokebi-seal.nonces: { ${redisValue(redis)} }${addRedis(redis)}`,
+            });
+    }
+    return found;
+}
+export async function sharedStateProblems(root, installed) {
+    let source;
+    try {
+        source = await readFile(join(root, CONFIG_FILE), 'utf8');
+    }
+    catch (error) {
+        if (isMissing(error))
+            return [];
+        throw new CliError('READ_FAILED', `Cannot read ${CONFIG_FILE}`, { cause: error });
+    }
+    let options;
+    try {
+        options = record(parseProjectConfig(source).options);
+    }
+    catch (error) {
+        // doctor reports an invalid dokebi.yaml; this rule has nothing to read then.
+        debug('check: shared-state rule skipped, dokebi.yaml not readable', {
+            error: describeError(error),
+        });
+        return [];
+    }
+    const workers = record(options['application-runtime']).workers;
+    if (typeof workers !== 'number' || workers <= 1)
+        return [];
+    const redis = Object.keys(record(record(options['dokebi-redis']).connections))[0];
+    const problems = kept(installed, options).map((item) => ({
+        rule: RULE,
+        file: CONFIG_FILE,
+        line: optionLine(source, ['options', ...item.path]),
+        message: `${workers} workers keep their own ${item.what} in process memory: each worker would see only its own, and the plugin refuses to start this way in a cluster worker and in production (D-0161)`,
+        fix: item.fix(redis),
+    }));
+    debug('check: shared-state rule done', { workers, problems: problems.length });
+    return problems;
+}

package/dist/check/source-rules.d.ts

@@ -1,5 +1,6 @@
+import { type ErrorList } from './error-rules.js';
 import type { DokebiImports } from './packages.js';
-import { type Problem } from './problems.js';
+import { type Problem, type RuleName } from './problems.js';
 import { type Kinds, type TsNode, type TsSourceFile, type TypeScriptProject } from './typescript.js';
 interface Marker {
     readonly line: number;
@@ -14,14 +15,36 @@ export interface FloatingCandidate {
     readonly expression: TsNode;
     readonly problem: Problem;
 }
+/**
+ * D-0120 §1.4: the names one import of a browser file binds; when none of them has a type the
+ * module resolved to nothing and floating-promise cannot judge its calls (a warning).
+ */
+export interface UntypedCandidate {
+    readonly names: readonly TsNode[];
+    readonly problem: Problem;
+}
 export interface FileFindings {
     readonly problems: Problem[];
     readonly candidates: FloatingCandidate[];
+    /** Browser files only (D-0120 §1.4). */
+    readonly imports?: UntypedCandidate[];
 }
 /** Walks one file: all syntactic problems, and the statements the checker must judge. */
-export declare function inspectFile(file: TsSourceFile, kinds: Kinds, root: string, imports: DokebiImports): Promise<FileFindings>;
+export declare function inspectFile(file: TsSourceFile, kinds: Kinds, root: string, imports: DokebiImports, 
+/** Installed plugin ids: the security rules run only for the plugin they protect. */
+installed?: ReadonlySet<string>, 
+/** The codes of src/shared/errors.ts (D-0077 D); unknown-error-code runs only with them. */
+errorList?: ErrorList, 
+/**
+ * D-0120: a virtual browser source — the file problems name, and the only rules that run
+ * (the per-plugin, server and import rules do not apply to browser code).
+ */
+browser?: {
+    readonly path: string;
+    readonly rules: ReadonlySet<RuleName>;
+}): Promise<FileFindings>;
 /** Every program file: syntactic problems, then one batched checker call for the candidates. */
-export declare function sourceProblems(typescript: TypeScriptProject, root: string, imports: DokebiImports, skip: (path: string) => boolean): Promise<{
+export declare function sourceProblems(typescript: TypeScriptProject, root: string, imports: DokebiImports, skip: (path: string) => boolean, installed?: ReadonlySet<string>): Promise<{
     problems: Problem[];
     files: number;
 }>;