@empline/preflight 1.0.20

package/dist/checks/runtime/process-stdio-usage.js

@@ -0,0 +1,179 @@
+#!/usr/bin/env tsx
+"use strict";
+/**
+ * Preflight: Unsafe process stdio usage in shared app code
+ *
+ * Catches runtime issues like:
+ *   TypeError: Cannot read properties of undefined (reading 'write')
+ * when client/edge bundles execute code that calls:
+ *   process.stdout.write(...)
+ *   process.stderr.write(...)
+ *
+ * Rule:
+ * - Disallow direct `process.(stdout|stderr).write(` in app-shared folders.
+ * - Allow opt-out per file via: `preflight:allow-process-stdio`
+ */
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.tags = exports.description = exports.blocking = exports.category = exports.name = exports.id = void 0;
+exports.run = run;
+const fs = __importStar(require("fs"));
+const path = __importStar(require("path"));
+const console_chars_1 = require("../../utils/console-chars");
+const findings_writer_1 = require("../../utils/findings-writer");
+// Check metadata
+exports.id = "runtime/process-stdio-usage";
+exports.name = "Process Stdio Usage";
+exports.category = "runtime";
+exports.blocking = false;
+exports.description = "Preflight: Unsafe process stdio usage in shared app code";
+exports.tags = ["runtime"];
+const WORKSPACE_ROOT = process.cwd();
+const SCAN_DIRS = ["app", "components", "contexts", "hooks", "lib"];
+const ALLOWED_EXTS = new Set([".ts", ".tsx", ".js", ".jsx"]);
+const ALLOW_COMMENT = "preflight:allow-process-stdio";
+function shouldSkipDirName(dirName) {
+    return (dirName === "node_modules" ||
+        dirName === ".next" ||
+        dirName === ".git" ||
+        dirName === "dist" ||
+        dirName === "build" ||
+        dirName === "coverage" ||
+        dirName === "test-results" ||
+        dirName === "reports" ||
+        dirName === "backups" ||
+        dirName === "scripts" ||
+        dirName === "prisma" ||
+        dirName === "tests" ||
+        dirName === "__mocks__");
+}
+function collectFiles(dir, out) {
+    const entries = fs.readdirSync(dir, { withFileTypes: true });
+    for (const entry of entries) {
+        const fullPath = path.join(dir, entry.name);
+        if (entry.isDirectory()) {
+            if (shouldSkipDirName(entry.name))
+                continue;
+            collectFiles(fullPath, out);
+            continue;
+        }
+        const ext = path.extname(entry.name);
+        if (!ALLOWED_EXTS.has(ext))
+            continue;
+        out.push(fullPath);
+    }
+}
+function findUnsafeStdioCalls(filePath) {
+    const content = fs.readFileSync(filePath, "utf8");
+    if (content.includes(ALLOW_COMMENT))
+        return [];
+    const findings = [];
+    // Very small comment-aware line scan to avoid obvious false positives.
+    // (Not a full parser; good enough for preflight.)
+    const lines = content.split(/\r?\n/);
+    let inBlockComment = false;
+    for (let i = 0; i < lines.length; i++) {
+        const line = lines[i];
+        const trimmed = line.trim();
+        if (!inBlockComment && trimmed.startsWith("/*")) {
+            inBlockComment = true;
+        }
+        if (inBlockComment) {
+            if (trimmed.includes("*/")) {
+                inBlockComment = false;
+            }
+            continue;
+        }
+        if (trimmed.startsWith("//"))
+            continue;
+        const patterns = [
+            { re: /\bprocess\.stdout\.write\s*\(/g, match: "process.stdout.write(" },
+            { re: /\bprocess\.stderr\.write\s*\(/g, match: "process.stderr.write(" },
+        ];
+        for (const { re, match } of patterns) {
+            let m;
+            re.lastIndex = 0;
+            // eslint-disable-next-line no-cond-assign
+            while ((m = re.exec(line))) {
+                const startIdx = typeof m.index === "number" ? m.index : -1;
+                const column = startIdx >= 0 ? startIdx + 1 : undefined;
+                const endColumn = typeof column === "number" ? column + String(m[0] ?? "").length : undefined;
+                findings.push({
+                    file: path.relative(WORKSPACE_ROOT, filePath),
+                    line: i + 1,
+                    column,
+                    endColumn,
+                    match,
+                    text: line,
+                });
+            }
+        }
+    }
+    return findings;
+}
+function run() {
+    const files = [];
+    for (const dirName of SCAN_DIRS) {
+        const abs = path.join(WORKSPACE_ROOT, dirName);
+        if (fs.existsSync(abs)) {
+            collectFiles(abs, files);
+        }
+    }
+    const findings = files.flatMap(findUnsafeStdioCalls);
+    (0, findings_writer_1.writeFindings)(findings.map((f) => ({
+        severity: "error",
+        message: `Unsafe ${f.match} in shared code`,
+        file: f.file.replaceAll(path.sep, "/"),
+        range: { startLine: f.line, startColumn: f.column, endLine: f.line, endColumn: f.endColumn },
+    })));
+    if (findings.length === 0) {
+        console.log(`${console_chars_1.emoji.success} Preflight: No unsafe process stdio writes found`);
+        return { errors: 0, warnings: 0 };
+    }
+    console.log(`${console_chars_1.emoji.error} Preflight: Found ${findings.length} unsafe process stdio write(s) in shared code`);
+    console.log("   Fix by using console.* or a safe wrapper that checks availability.");
+    console.log(`   To explicitly allow (rare): add "${ALLOW_COMMENT}" to the file.`);
+    console.log("");
+    for (const f of findings) {
+        console.log(`- ${f.file}:${f.line}  ${f.match}`);
+        console.log(`  ${f.text.trim()}`);
+    }
+    return { errors: findings.length, warnings: 0 };
+}
+if (require.main === module) {
+    const result = run();
+    process.exit(result.errors > 0 ? 1 : 0);
+}
+//# sourceMappingURL=process-stdio-usage.js.map

package/dist/checks/runtime/process-stdio-usage.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"process-stdio-usage.js","sourceRoot":"","sources":["../../../src/checks/runtime/process-stdio-usage.ts"],"names":[],"mappings":";;AACA;;;;;;;;;;;;GAYG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA0KM,kBAAG;AAxKZ,uCAAyB;AACzB,2CAA6B;AAE7B,6DAAkD;AAClD,iEAA4D;AAG5D,iBAAiB;AACJ,QAAA,EAAE,GAAG,6BAA6B,CAAC;AACnC,QAAA,IAAI,GAAG,qBAAqB,CAAC;AAC7B,QAAA,QAAQ,GAAG,SAAS,CAAC;AACrB,QAAA,QAAQ,GAAG,KAAK,CAAC;AACjB,QAAA,WAAW,GAAG,0DAA0D,CAAC;AACzE,QAAA,IAAI,GAAG,CAAC,SAAS,CAAC,CAAC;AAWhC,MAAM,cAAc,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC;AAErC,MAAM,SAAS,GAAG,CAAC,KAAK,EAAE,YAAY,EAAE,UAAU,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC;AACpE,MAAM,YAAY,GAAG,IAAI,GAAG,CAAC,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC;AAE7D,MAAM,aAAa,GAAG,+BAA+B,CAAC;AAEtD,SAAS,iBAAiB,CAAC,OAAe;IACxC,OAAO,CACL,OAAO,KAAK,cAAc;QAC1B,OAAO,KAAK,OAAO;QACnB,OAAO,KAAK,MAAM;QAClB,OAAO,KAAK,MAAM;QAClB,OAAO,KAAK,OAAO;QACnB,OAAO,KAAK,UAAU;QACtB,OAAO,KAAK,cAAc;QAC1B,OAAO,KAAK,SAAS;QACrB,OAAO,KAAK,SAAS;QACrB,OAAO,KAAK,SAAS;QACrB,OAAO,KAAK,QAAQ;QACpB,OAAO,KAAK,OAAO;QACnB,OAAO,KAAK,WAAW,CACxB,CAAC;AACJ,CAAC;AAED,SAAS,YAAY,CAAC,GAAW,EAAE,GAAa;IAC9C,MAAM,OAAO,GAAG,EAAE,CAAC,WAAW,CAAC,GAAG,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC;IAC7D,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;QAC5B,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;QAE5C,IAAI,KAAK,CAAC,WAAW,EAAE,EAAE,CAAC;YACxB,IAAI,iBAAiB,CAAC,KAAK,CAAC,IAAI,CAAC;gBAAE,SAAS;YAC5C,YAAY,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;YAC5B,SAAS;QACX,CAAC;QAED,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QACrC,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,GAAG,CAAC;YAAE,SAAS;QACrC,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IACrB,CAAC;AACH,CAAC;AAED,SAAS,oBAAoB,CAAC,QAAgB;IAC5C,MAAM,OAAO,GAAG,EAAE,CAAC,YAAY,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;IAClD,IAAI,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAC;QAAE,OAAO,EAAE,CAAC;IAE/C,MAAM,QAAQ,GAAc,EAAE,CAAC;IAE/B,uEAAuE;IACvE,kDAAkD;IAClD,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IACrC,IAAI,cAAc,GAAG,KAAK,CAAC;IAE3B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACtC,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;QACtB,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;QAE5B,IAAI,CAAC,cAAc,IAAI,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;YAChD,cAAc,GAAG,IAAI,CAAC;QACxB,CAAC;QACD,IAAI,cAAc,EAAE,CAAC;YACnB,IAAI,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;gBAC3B,cAAc,GAAG,KAAK,CAAC;YACzB,CAAC;YACD,SAAS;QACX,CAAC;QAED,IAAI,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC;YAAE,SAAS;QAEvC,MAAM,QAAQ,GAAG;YACf,EAAE,EAAE,EAAE,gCAAgC,EAAE,KAAK,EAAE,uBAAuB,EAAE;YACxE,EAAE,EAAE,EAAE,gCAAgC,EAAE,KAAK,EAAE,uBAAuB,EAAE;SACzE,CAAC;QAEF,KAAK,MAAM,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,QAAQ,EAAE,CAAC;YACrC,IAAI,CAAyB,CAAC;YAC9B,EAAE,CAAC,SAAS,GAAG,CAAC,CAAC;YACjB,0CAA0C;YAC1C,OAAO,CAAC,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC;gBAC3B,MAAM,QAAQ,GAAG,OAAO,CAAC,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;gBAC5D,MAAM,MAAM,GAAG,QAAQ,IAAI,CAAC,CAAC,CAAC,CAAC,QAAQ,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;gBACxD,MAAM,SAAS,GACb,OAAO,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC;gBAE9E,QAAQ,CAAC,IAAI,CAAC;oBACZ,IAAI,EAAE,IAAI,CAAC,QAAQ,CAAC,cAAc,EAAE,QAAQ,CAAC;oBAC7C,IAAI,EAAE,CAAC,GAAG,CAAC;oBACX,MAAM;oBACN,SAAS;oBACT,KAAK;oBACL,IAAI,EAAE,IAAI;iBACX,CAAC,CAAC;YACL,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,SAAS,GAAG;IACV,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,KAAK,MAAM,OAAO,IAAI,SAAS,EAAE,CAAC;QAChC,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,cAAc,EAAE,OAAO,CAAC,CAAC;QAC/C,IAAI,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;YACvB,YAAY,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QAC3B,CAAC;IACH,CAAC;IAED,MAAM,QAAQ,GAAG,KAAK,CAAC,OAAO,CAAC,oBAAoB,CAAC,CAAC;IAErD,IAAA,+BAAa,EACX,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QACnB,QAAQ,EAAE,OAAO;QACjB,OAAO,EAAE,UAAU,CAAC,CAAC,KAAK,iBAAiB;QAC3C,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC;QACtC,KAAK,EAAE,EAAE,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC,IAAI,EAAE,SAAS,EAAE,CAAC,CAAC,SAAS,EAAE;KAC7F,CAAC,CAAC,CACJ,CAAC;IAEF,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC1B,OAAO,CAAC,GAAG,CAAC,GAAG,qBAAK,CAAC,OAAO,kDAAkD,CAAC,CAAC;QAChF,OAAO,EAAE,MAAM,EAAE,CAAC,EAAE,QAAQ,EAAE,CAAC,EAAE,CAAC;IACpC,CAAC;IAED,OAAO,CAAC,GAAG,CACT,GAAG,qBAAK,CAAC,KAAK,qBAAqB,QAAQ,CAAC,MAAM,+CAA+C,CAClG,CAAC;IACF,OAAO,CAAC,GAAG,CAAC,uEAAuE,CAAC,CAAC;IACrF,OAAO,CAAC,GAAG,CAAC,uCAAuC,aAAa,gBAAgB,CAAC,CAAC;IAClF,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAEhB,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;QACzB,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC;QACjD,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;IACpC,CAAC;IAED,OAAO,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,QAAQ,EAAE,CAAC,EAAE,CAAC;AAClD,CAAC;AAED,IAAI,OAAO,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;IAC5B,MAAM,MAAM,GAAG,GAAG,EAAE,CAAC;IACrB,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAC1C,CAAC"}

package/dist/checks/runtime/server-client-decimal.d.ts

@@ -0,0 +1,25 @@
+#!/usr/bin/env tsx
+/**
+ * Server→Client Decimal Serialization Preflight (BLOCKING)
+ *
+ * Detects Prisma Decimal fields being passed from Server Components to Client Components
+ * without proper serialization. This causes the runtime error:
+ *
+ *   "Only plain objects can be passed to Client Components from Server Components.
+ *    Decimal objects are not supported."
+ *
+ * This is a BLOCKING preflight because it causes runtime crashes in production.
+ *
+ * Checks for:
+ * - Server Component pages passing Prisma query results with price/Decimal fields to Client Components
+ * - Missing Number() or .toNumber() conversion before passing to client
+ *
+ * @see https://nextjs.org/docs/app/building-your-application/rendering/composition-patterns
+ */
+export declare const id = "runtime/server-client-decimal";
+export declare const name = "Server Client Decimal";
+export declare const category = "runtime";
+export declare const blocking = true;
+export declare const description = "Server\u2192Client Decimal Serialization Preflight (BLOCKING)";
+export declare const tags: string[];
+//# sourceMappingURL=server-client-decimal.d.ts.map

package/dist/checks/runtime/server-client-decimal.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"server-client-decimal.d.ts","sourceRoot":"","sources":["../../../src/checks/runtime/server-client-decimal.ts"],"names":[],"mappings":";AACA;;;;;;;;;;;;;;;;GAgBG;AASH,eAAO,MAAM,EAAE,kCAAkC,CAAC;AAClD,eAAO,MAAM,IAAI,0BAA0B,CAAC;AAC5C,eAAO,MAAM,QAAQ,YAAY,CAAC;AAClC,eAAO,MAAM,QAAQ,OAAO,CAAC;AAC7B,eAAO,MAAM,WAAW,kEAA6D,CAAC;AACtF,eAAO,MAAM,IAAI,UAAc,CAAC"}

package/dist/checks/runtime/server-client-decimal.js

@@ -0,0 +1,243 @@
+#!/usr/bin/env tsx
+"use strict";
+/**
+ * Server→Client Decimal Serialization Preflight (BLOCKING)
+ *
+ * Detects Prisma Decimal fields being passed from Server Components to Client Components
+ * without proper serialization. This causes the runtime error:
+ *
+ *   "Only plain objects can be passed to Client Components from Server Components.
+ *    Decimal objects are not supported."
+ *
+ * This is a BLOCKING preflight because it causes runtime crashes in production.
+ *
+ * Checks for:
+ * - Server Component pages passing Prisma query results with price/Decimal fields to Client Components
+ * - Missing Number() or .toNumber() conversion before passing to client
+ *
+ * @see https://nextjs.org/docs/app/building-your-application/rendering/composition-patterns
+ */
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.tags = exports.description = exports.blocking = exports.category = exports.name = exports.id = void 0;
+const fs = __importStar(require("fs"));
+const glob_1 = require("glob");
+const path = __importStar(require("path"));
+const console_chars_1 = require("../../utils/console-chars");
+// Check metadata
+exports.id = "runtime/server-client-decimal";
+exports.name = "Server Client Decimal";
+exports.category = "runtime";
+exports.blocking = true;
+exports.description = "Server→Client Decimal Serialization Preflight (BLOCKING)";
+exports.tags = ["runtime"];
+const issues = [];
+// Decimal field names that Prisma returns as Decimal type
+const DECIMAL_FIELDS = [
+    "price",
+    "shippingCost",
+    "amount",
+    "total",
+    "subtotal",
+    "fee",
+    "cost",
+    "tax",
+    "discount",
+];
+// Pattern to detect Client component imports and props passing
+const CLIENT_COMPONENT_PATTERN = /<(\w+Client)\s+[^>]*(?:listings|featuredListings|products|items)=\{([^}]+)\}/g;
+// Pattern to detect Prisma queries selecting price fields
+const PRISMA_SELECT_PRICE = /prisma\.\w+\.(?:findMany|findFirst|findUnique)\([^)]*select:\s*\{[^}]*price:\s*true/gs;
+function getCodeSnippet(lines, lineNumber) {
+    const start = Math.max(0, lineNumber - 2);
+    const end = Math.min(lines.length, lineNumber + 2);
+    return lines
+        .slice(start, end)
+        .map((l, i) => {
+        const num = start + i + 1;
+        const marker = num === lineNumber ? ">" : " ";
+        return `${marker} ${num.toString().padStart(4)} | ${l}`;
+    })
+        .join("\n");
+}
+async function analyzeFile(filePath) {
+    const content = fs.readFileSync(filePath, "utf-8");
+    const lines = content.split("\n");
+    // Only check Server Component pages (no "use client" directive)
+    if (content.includes('"use client"') || content.includes("'use client'")) {
+        return;
+    }
+    // Check if file has Prisma queries that select price
+    const hasPrismaPrice = PRISMA_SELECT_PRICE.test(content);
+    if (!hasPrismaPrice)
+        return;
+    // Reset regex
+    PRISMA_SELECT_PRICE.lastIndex = 0;
+    // Look for patterns where listings with price are passed to Client components
+    // without explicit serialization
+    // Pattern 1: Direct passing of query results to Client component
+    const clientPassingPattern = /<(\w+Client)[^>]*\s+(listings|featuredListings|products|items)=\{(\w+)\}/g;
+    let match;
+    while ((match = clientPassingPattern.exec(content)) !== null) {
+        const [fullMatch, componentName, propName, varName] = match;
+        const lineNumber = content.substring(0, match.index).split("\n").length;
+        // Check if the variable is serialized before passing
+        // Look for patterns like: varName.map(x => ({ ...x, price: Number(x.price) }))
+        // or serializeListing(varName) or similar
+        const beforeMatch = content.substring(0, match.index);
+        const afterVarDecl = content.substring(content.lastIndexOf(varName, match.index) - 500, match.index);
+        // Check if there's serialization happening
+        const hasNumberConversion = afterVarDecl.includes(`Number(`) && afterVarDecl.includes("price");
+        const hasToNumber = afterVarDecl.includes(".toNumber()");
+        const hasSerialize = /serialize\w*\(|Serialize\w*\(/.test(afterVarDecl);
+        const hasMapWithPrice = /\.map\([^)]*price:\s*Number\(/.test(afterVarDecl);
+        // Also check if the source data is already serialized (e.g., via serializeListingWithCatalog)
+        const sourceSerializationPattern = new RegExp(`${varName}[^=]*=.*serialize`, "i");
+        const hasSourceSerialization = sourceSerializationPattern.test(content);
+        // Check if file imports serialization utilities (strong indicator of proper handling)
+        const importsSerializationUtils = /import.*serialize.*from.*serialization-utils/.test(content);
+        // Check if the data comes from a function that uses serialization
+        const usesSerializationInFile = /serializeListing|serializeListingWithCatalog|serializeDecimal/.test(content);
+        // If passing raw Prisma results without serialization
+        if (!hasNumberConversion &&
+            !hasToNumber &&
+            !hasSerialize &&
+            !hasMapWithPrice &&
+            !hasSourceSerialization &&
+            !importsSerializationUtils &&
+            !usesSerializationInFile) {
+            // Check if the variable comes directly from a Prisma query
+            const varDeclPattern = new RegExp(`(?:const|let)\\s+(?:\\[?[^\\]]*${varName}[^\\]]*\\]?|${varName})\\s*=\\s*await\\s+(?:prisma|getCached)`, "g");
+            if (varDeclPattern.test(content)) {
+                issues.push({
+                    file: filePath,
+                    line: lineNumber,
+                    message: `Passing "${varName}" with Decimal price field to <${componentName}> without serialization`,
+                    suggestion: `Serialize before passing: ${varName}.map(item => ({ ...item, price: Number(item.price) }))`,
+                    codeSnippet: getCodeSnippet(lines, lineNumber),
+                });
+            }
+        }
+    }
+    // Pattern 2: JSON.stringify on objects with price from Prisma (for schema markup)
+    // Skip if the data source already serializes price to Number
+    const jsonStringifyPattern = /JSON\.stringify\(\s*(\w+Schema|\w+)\s*\)/g;
+    while ((match = jsonStringifyPattern.exec(content)) !== null) {
+        const [fullMatch, varName] = match;
+        const lineNumber = content.substring(0, match.index).split("\n").length;
+        // Check if the schema object contains price from Prisma without Number()
+        const schemaDefStart = content.lastIndexOf(`const ${varName}`, match.index);
+        if (schemaDefStart === -1)
+            continue;
+        const schemaDef = content.substring(schemaDefStart, match.index);
+        // Check if schema references listing.price or similar
+        const hasPriceRef = /listing\.price|item\.price|\.price/.test(schemaDef);
+        if (!hasPriceRef)
+            continue;
+        // Check if price is wrapped with Number() in the schema itself
+        const hasNumberWrap = /Number\([^)]*\.price\)|price:\s*Number\(/.test(schemaDef);
+        if (hasNumberWrap)
+            continue;
+        // Check if the data source already serializes price (look for price: Number( in the file)
+        // This handles cases where getCachedFeaturedListings() returns { price: Number(listing.price) }
+        const hasSerializedSource = /price:\s*Number\(/.test(content);
+        if (hasSerializedSource)
+            continue;
+        // Check if using a serialized variable
+        const usesSerializedVar = /serialized\w*\./.test(schemaDef);
+        if (usesSerializedVar)
+            continue;
+        issues.push({
+            file: filePath,
+            line: lineNumber,
+            message: `JSON.stringify on schema with Decimal price field - causes "Decimal objects are not supported" error`,
+            suggestion: `Wrap price with Number(): price: Number(listing.price)`,
+            codeSnippet: getCodeSnippet(lines, lineNumber),
+        });
+    }
+}
+async function main() {
+    const args = process.argv.slice(2);
+    const isWarn = args.includes("--warn");
+    const isVerbose = args.includes("--verbose");
+    console.log(`\n${console_chars_1.emoji.search} Server${console_chars_1.chars.arrow}Client Decimal Serialization Check`);
+    console.log("=".repeat(60));
+    // Only check app/ pages (Server Components)
+    const files = await (0, glob_1.glob)(["app/**/page.tsx", "app/**/layout.tsx"], {
+        ignore: ["**/node_modules/**", "**/.next/**"],
+    });
+    console.log(`${console_chars_1.emoji.file} Checking ${files.length} Server Component files...\n`);
+    for (const file of files) {
+        await analyzeFile(file);
+    }
+    if (issues.length === 0) {
+        console.log(`${console_chars_1.emoji.success} No Server${console_chars_1.chars.arrow}Client Decimal serialization issues found\n`);
+        process.exit(0);
+    }
+    console.log(`${console_chars_1.emoji.error} Found ${issues.length} Server${console_chars_1.chars.arrow}Client Decimal serialization issue(s):\n`);
+    for (const issue of issues) {
+        const relativePath = path.relative(process.cwd(), issue.file);
+        console.log(`  ${console_chars_1.emoji.error} ${relativePath}:${issue.line}`);
+        console.log(`     ${issue.message}`);
+        console.log(`     ${console_chars_1.emoji.hint} ${issue.suggestion}`);
+        if (isVerbose) {
+            console.log(`\n${issue.codeSnippet}\n`);
+        }
+        console.log();
+    }
+    console.log(`${console_chars_1.emoji.wrench} QUICK FIX:`);
+    console.log("   Serialize Decimal fields before passing to Client Components:");
+    console.log("");
+    console.log("   // Before passing to client:");
+    console.log("   const serializedListings = listings.map(item => ({");
+    console.log("     ...item,");
+    console.log("     price: Number(item.price),");
+    console.log("   }));");
+    console.log("");
+    if (isWarn) {
+        console.log(`${console_chars_1.emoji.warning}  SERVER${console_chars_1.chars.arrow}CLIENT DECIMAL CHECK PASSED WITH WARNINGS\n`);
+        process.exit(0);
+    }
+    else {
+        console.log(`${console_chars_1.emoji.error} SERVER${console_chars_1.chars.arrow}CLIENT DECIMAL CHECK FAILED`);
+        console.log("   Fix these issues to prevent runtime crashes.\n");
+        process.exit(1);
+    }
+}
+main().catch((err) => {
+    console.error(`${console_chars_1.emoji.error} Error:`, err);
+    process.exit(1);
+});
+//# sourceMappingURL=server-client-decimal.js.map

package/dist/checks/runtime/server-client-decimal.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"server-client-decimal.js","sourceRoot":"","sources":["../../../src/checks/runtime/server-client-decimal.ts"],"names":[],"mappings":";;AACA;;;;;;;;;;;;;;;;GAgBG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAEH,uCAAyB;AACzB,+BAA4B;AAC5B,2CAA6B;AAC7B,6DAAyD;AAGzD,iBAAiB;AACJ,QAAA,EAAE,GAAG,+BAA+B,CAAC;AACrC,QAAA,IAAI,GAAG,uBAAuB,CAAC;AAC/B,QAAA,QAAQ,GAAG,SAAS,CAAC;AACrB,QAAA,QAAQ,GAAG,IAAI,CAAC;AAChB,QAAA,WAAW,GAAG,0DAA0D,CAAC;AACzE,QAAA,IAAI,GAAG,CAAC,SAAS,CAAC,CAAC;AAUhC,MAAM,MAAM,GAAY,EAAE,CAAC;AAE3B,0DAA0D;AAC1D,MAAM,cAAc,GAAG;IACrB,OAAO;IACP,cAAc;IACd,QAAQ;IACR,OAAO;IACP,UAAU;IACV,KAAK;IACL,MAAM;IACN,KAAK;IACL,UAAU;CACX,CAAC;AAEF,+DAA+D;AAC/D,MAAM,wBAAwB,GAC5B,+EAA+E,CAAC;AAElF,0DAA0D;AAC1D,MAAM,mBAAmB,GACvB,uFAAuF,CAAC;AAE1F,SAAS,cAAc,CAAC,KAAe,EAAE,UAAkB;IACzD,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,UAAU,GAAG,CAAC,CAAC,CAAC;IAC1C,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,EAAE,UAAU,GAAG,CAAC,CAAC,CAAC;IACnD,OAAO,KAAK;SACT,KAAK,CAAC,KAAK,EAAE,GAAG,CAAC;SACjB,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE;QACZ,MAAM,GAAG,GAAG,KAAK,GAAG,CAAC,GAAG,CAAC,CAAC;QAC1B,MAAM,MAAM,GAAG,GAAG,KAAK,UAAU,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC;QAC9C,OAAO,GAAG,MAAM,IAAI,GAAG,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC;IAC1D,CAAC,CAAC;SACD,IAAI,CAAC,IAAI,CAAC,CAAC;AAChB,CAAC;AAED,KAAK,UAAU,WAAW,CAAC,QAAgB;IACzC,MAAM,OAAO,GAAG,EAAE,CAAC,YAAY,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;IACnD,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAElC,gEAAgE;IAChE,IAAI,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAC,EAAE,CAAC;QACzE,OAAO;IACT,CAAC;IAED,qDAAqD;IACrD,MAAM,cAAc,GAAG,mBAAmB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IACzD,IAAI,CAAC,cAAc;QAAE,OAAO;IAE5B,cAAc;IACd,mBAAmB,CAAC,SAAS,GAAG,CAAC,CAAC;IAElC,8EAA8E;IAC9E,iCAAiC;IAEjC,iEAAiE;IACjE,MAAM,oBAAoB,GACxB,2EAA2E,CAAC;IAC9E,IAAI,KAAK,CAAC;IAEV,OAAO,CAAC,KAAK,GAAG,oBAAoB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;QAC7D,MAAM,CAAC,SAAS,EAAE,aAAa,EAAE,QAAQ,EAAE,OAAO,CAAC,GAAG,KAAK,CAAC;QAC5D,MAAM,UAAU,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC;QAExE,qDAAqD;QACrD,+EAA+E;QAC/E,0CAA0C;QAE1C,MAAM,WAAW,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC;QACtD,MAAM,YAAY,GAAG,OAAO,CAAC,SAAS,CACpC,OAAO,CAAC,WAAW,CAAC,OAAO,EAAE,KAAK,CAAC,KAAK,CAAC,GAAG,GAAG,EAC/C,KAAK,CAAC,KAAK,CACZ,CAAC;QAEF,2CAA2C;QAC3C,MAAM,mBAAmB,GAAG,YAAY,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,YAAY,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;QAC/F,MAAM,WAAW,GAAG,YAAY,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAC;QACzD,MAAM,YAAY,GAAG,+BAA+B,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;QACxE,MAAM,eAAe,GAAG,+BAA+B,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;QAE3E,8FAA8F;QAC9F,MAAM,0BAA0B,GAAG,IAAI,MAAM,CAAC,GAAG,OAAO,mBAAmB,EAAE,GAAG,CAAC,CAAC;QAClF,MAAM,sBAAsB,GAAG,0BAA0B,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAExE,sFAAsF;QACtF,MAAM,yBAAyB,GAAG,8CAA8C,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAE/F,kEAAkE;QAClE,MAAM,uBAAuB,GAC3B,+DAA+D,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAEhF,sDAAsD;QACtD,IACE,CAAC,mBAAmB;YACpB,CAAC,WAAW;YACZ,CAAC,YAAY;YACb,CAAC,eAAe;YAChB,CAAC,sBAAsB;YACvB,CAAC,yBAAyB;YAC1B,CAAC,uBAAuB,EACxB,CAAC;YACD,2DAA2D;YAC3D,MAAM,cAAc,GAAG,IAAI,MAAM,CAC/B,kCAAkC,OAAO,eAAe,OAAO,yCAAyC,EACxG,GAAG,CACJ,CAAC;YAEF,IAAI,cAAc,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;gBACjC,MAAM,CAAC,IAAI,CAAC;oBACV,IAAI,EAAE,QAAQ;oBACd,IAAI,EAAE,UAAU;oBAChB,OAAO,EAAE,YAAY,OAAO,kCAAkC,aAAa,yBAAyB;oBACpG,UAAU,EAAE,6BAA6B,OAAO,wDAAwD;oBACxG,WAAW,EAAE,cAAc,CAAC,KAAK,EAAE,UAAU,CAAC;iBAC/C,CAAC,CAAC;YACL,CAAC;QACH,CAAC;IACH,CAAC;IAED,kFAAkF;IAClF,6DAA6D;IAC7D,MAAM,oBAAoB,GAAG,2CAA2C,CAAC;IAEzE,OAAO,CAAC,KAAK,GAAG,oBAAoB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;QAC7D,MAAM,CAAC,SAAS,EAAE,OAAO,CAAC,GAAG,KAAK,CAAC;QACnC,MAAM,UAAU,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC;QAExE,yEAAyE;QACzE,MAAM,cAAc,GAAG,OAAO,CAAC,WAAW,CAAC,SAAS,OAAO,EAAE,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC;QAC5E,IAAI,cAAc,KAAK,CAAC,CAAC;YAAE,SAAS;QAEpC,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,CAAC,cAAc,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC;QAEjE,sDAAsD;QACtD,MAAM,WAAW,GAAG,oCAAoC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QACzE,IAAI,CAAC,WAAW;YAAE,SAAS;QAE3B,+DAA+D;QAC/D,MAAM,aAAa,GAAG,0CAA0C,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QACjF,IAAI,aAAa;YAAE,SAAS;QAE5B,0FAA0F;QAC1F,gGAAgG;QAChG,MAAM,mBAAmB,GAAG,mBAAmB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAC9D,IAAI,mBAAmB;YAAE,SAAS;QAElC,uCAAuC;QACvC,MAAM,iBAAiB,GAAG,iBAAiB,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QAC5D,IAAI,iBAAiB;YAAE,SAAS;QAEhC,MAAM,CAAC,IAAI,CAAC;YACV,IAAI,EAAE,QAAQ;YACd,IAAI,EAAE,UAAU;YAChB,OAAO,EAAE,sGAAsG;YAC/G,UAAU,EAAE,wDAAwD;YACpE,WAAW,EAAE,cAAc,CAAC,KAAK,EAAE,UAAU,CAAC;SAC/C,CAAC,CAAC;IACL,CAAC;AACH,CAAC;AAED,KAAK,UAAU,IAAI;IACjB,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IACnC,MAAM,MAAM,GAAG,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;IACvC,MAAM,SAAS,GAAG,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IAE7C,OAAO,CAAC,GAAG,CAAC,KAAK,qBAAK,CAAC,MAAM,UAAU,qBAAK,CAAC,KAAK,oCAAoC,CAAC,CAAC;IACxF,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC;IAE5B,4CAA4C;IAC5C,MAAM,KAAK,GAAG,MAAM,IAAA,WAAI,EAAC,CAAC,iBAAiB,EAAE,mBAAmB,CAAC,EAAE;QACjE,MAAM,EAAE,CAAC,oBAAoB,EAAE,aAAa,CAAC;KAC9C,CAAC,CAAC;IAEH,OAAO,CAAC,GAAG,CAAC,GAAG,qBAAK,CAAC,IAAI,aAAa,KAAK,CAAC,MAAM,8BAA8B,CAAC,CAAC;IAElF,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,WAAW,CAAC,IAAI,CAAC,CAAC;IAC1B,CAAC;IAED,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACxB,OAAO,CAAC,GAAG,CACT,GAAG,qBAAK,CAAC,OAAO,aAAa,qBAAK,CAAC,KAAK,6CAA6C,CACtF,CAAC;QACF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,OAAO,CAAC,GAAG,CACT,GAAG,qBAAK,CAAC,KAAK,UAAU,MAAM,CAAC,MAAM,UAAU,qBAAK,CAAC,KAAK,0CAA0C,CACrG,CAAC;IAEF,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,MAAM,YAAY,GAAG,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;QAC9D,OAAO,CAAC,GAAG,CAAC,KAAK,qBAAK,CAAC,KAAK,IAAI,YAAY,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;QAC9D,OAAO,CAAC,GAAG,CAAC,QAAQ,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;QACrC,OAAO,CAAC,GAAG,CAAC,QAAQ,qBAAK,CAAC,IAAI,IAAI,KAAK,CAAC,UAAU,EAAE,CAAC,CAAC;QAEtD,IAAI,SAAS,EAAE,CAAC;YACd,OAAO,CAAC,GAAG,CAAC,KAAK,KAAK,CAAC,WAAW,IAAI,CAAC,CAAC;QAC1C,CAAC;QACD,OAAO,CAAC,GAAG,EAAE,CAAC;IAChB,CAAC;IAED,OAAO,CAAC,GAAG,CAAC,GAAG,qBAAK,CAAC,MAAM,aAAa,CAAC,CAAC;IAC1C,OAAO,CAAC,GAAG,CAAC,kEAAkE,CAAC,CAAC;IAChF,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAChB,OAAO,CAAC,GAAG,CAAC,iCAAiC,CAAC,CAAC;IAC/C,OAAO,CAAC,GAAG,CAAC,uDAAuD,CAAC,CAAC;IACrE,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;IAC7B,OAAO,CAAC,GAAG,CAAC,iCAAiC,CAAC,CAAC;IAC/C,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;IACvB,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAEhB,IAAI,MAAM,EAAE,CAAC;QACX,OAAO,CAAC,GAAG,CACT,GAAG,qBAAK,CAAC,OAAO,WAAW,qBAAK,CAAC,KAAK,6CAA6C,CACpF,CAAC;QACF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;SAAM,CAAC;QACN,OAAO,CAAC,GAAG,CAAC,GAAG,qBAAK,CAAC,KAAK,UAAU,qBAAK,CAAC,KAAK,6BAA6B,CAAC,CAAC;QAC9E,OAAO,CAAC,GAAG,CAAC,mDAAmD,CAAC,CAAC;QACjE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;AACH,CAAC;AAED,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;IACnB,OAAO,CAAC,KAAK,CAAC,GAAG,qBAAK,CAAC,KAAK,SAAS,EAAE,GAAG,CAAC,CAAC;IAC5C,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC,CAAC,CAAC"}

package/dist/checks/security/csrf-protection.d.ts

@@ -0,0 +1,20 @@
+#!/usr/bin/env tsx
+/**
+ * CSRF Protection Validation Preflight (BLOCKING)
+ *
+ * Ensures state-changing API routes have CSRF protection:
+ * - POST/PUT/PATCH/DELETE routes should validate origin/referer
+ * - Forms should use CSRF tokens or SameSite cookies
+ * - Mutation endpoints should not rely solely on cookies
+ *
+ * Usage:
+ *   pnpm preflight:csrf-protection
+ *   pnpm preflight:csrf-protection:verbose
+ */
+export declare const id = "security/csrf-protection";
+export declare const name = "Csrf Protection";
+export declare const category = "security";
+export declare const blocking = true;
+export declare const description = "CSRF Protection Validation Preflight (BLOCKING)";
+export declare const tags: string[];
+//# sourceMappingURL=csrf-protection.d.ts.map

package/dist/checks/security/csrf-protection.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"csrf-protection.d.ts","sourceRoot":"","sources":["../../../src/checks/security/csrf-protection.ts"],"names":[],"mappings":";AACA;;;;;;;;;;;GAWG;AAUH,eAAO,MAAM,EAAE,6BAA6B,CAAC;AAC7C,eAAO,MAAM,IAAI,oBAAoB,CAAC;AACtC,eAAO,MAAM,QAAQ,aAAa,CAAC;AACnC,eAAO,MAAM,QAAQ,OAAO,CAAC;AAC7B,eAAO,MAAM,WAAW,oDAAoD,CAAC;AAC7E,eAAO,MAAM,IAAI,UAAe,CAAC"}