@empline/preflight 1.0.20

package/dist/checks/security/csrf-protection.js

@@ -0,0 +1,249 @@
+#!/usr/bin/env tsx
+"use strict";
+/**
+ * CSRF Protection Validation Preflight (BLOCKING)
+ *
+ * Ensures state-changing API routes have CSRF protection:
+ * - POST/PUT/PATCH/DELETE routes should validate origin/referer
+ * - Forms should use CSRF tokens or SameSite cookies
+ * - Mutation endpoints should not rely solely on cookies
+ *
+ * Usage:
+ *   pnpm preflight:csrf-protection
+ *   pnpm preflight:csrf-protection:verbose
+ */
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.tags = exports.description = exports.blocking = exports.category = exports.name = exports.id = void 0;
+const fs = __importStar(require("fs"));
+const path = __importStar(require("path"));
+const console_chars_1 = require("../../utils/console-chars");
+const file_cache_1 = require("../../shared/file-cache");
+const universal_progress_reporter_1 = require("../system/universal-progress-reporter");
+// Check metadata
+exports.id = "security/csrf-protection";
+exports.name = "Csrf Protection";
+exports.category = "security";
+exports.blocking = true;
+exports.description = "CSRF Protection Validation Preflight (BLOCKING)";
+exports.tags = ["security"];
+const issues = [];
+// Routes that are exempt from CSRF (public, read-only, or have other protection)
+const EXEMPT_ROUTES = [
+    "/api/auth/", // NextAuth handles its own CSRF
+    "/api/webhooks/", // Webhooks use signature verification
+    "/api/cron/", // Cron jobs use secret headers
+    "/api/health", // Health checks
+    "/api/public/", // Explicitly public endpoints
+    "/api/e2e/", // E2E test routes - disabled in production
+    "/api/debug-", // Debug routes - disabled in production
+    // Search/analytics routes (POST for complex queries, but read-only operations)
+    "/api/search/", // Search endpoints use POST for complex filters
+    "/api/monitoring/", // RUM/analytics data collection
+    "/api/contact", // Contact form - public, rate-limited
+    "/api/analytics/", // Analytics data collection - public
+    // Card operations (require auth, not state-changing in dangerous way)
+    "/api/cards/validate", // Validation only
+    "/api/cards/ocr", // OCR processing
+    "/api/cards/identify", // Card identification
+    "/api/cards/brand-series-validation", // Validation only
+    "/api/checklists/", // Checklist operations
+    "/api/inventory/status", // Status check
+    "/api/listings/check-duplicates", // Duplicate check
+    "/api/images/delete", // Requires auth, deletes user's own images
+    "/api/manual-login", // Dev-only login helper
+    // Public submission routes (rate-limited, not sensitive)
+    "/api/reviews", // Public reviews - rate-limited
+    "/api/cart/", // Cart operations - session-based
+    // Admin routes (require admin auth which is checked in route)
+    "/api/admin/", // Admin routes have their own auth checks
+    // Reference data (admin-only creation)
+    "/api/reference-data/", // Reference data management
+    // External integrations (have their own auth mechanisms)
+    "/api/integrations/", // External platform integrations
+];
+// Patterns indicating CSRF protection
+const CSRF_PROTECTION_PATTERNS = [
+    "validateCsrfToken",
+    "csrfToken",
+    "csrf-token",
+    "x-csrf-token",
+    "origin",
+    "referer",
+    "getServerSession", // Session-based auth with proper cookie settings
+    "auth()", // NextAuth v5 auth() helper
+    "verifySignature", // Webhook signature verification
+    "validateOrigin",
+];
+// CACHED FILE LISTS - Scan once, use everywhere
+let _cachedApiRouteFiles = null;
+// CACHED FILE LISTS - Scan once, use everywhere
+let _cachedAllTsxFiles = null;
+async function getAllTsxFiles() {
+    if (!_cachedAllTsxFiles) {
+        _cachedAllTsxFiles = await file_cache_1.fileCache.getAllTsx();
+    }
+    return _cachedAllTsxFiles;
+}
+async function getApiRouteFiles() {
+    if (!_cachedApiRouteFiles) {
+        _cachedApiRouteFiles = await file_cache_1.fileCache.getAPIRouteFiles();
+    }
+    return _cachedApiRouteFiles;
+}
+async function scanApiRoute(filePath) {
+    const normalized = filePath.replace(/\\/g, "/");
+    // Check if exempt
+    if (EXEMPT_ROUTES.some((exempt) => normalized.includes(exempt))) {
+        return;
+    }
+    const content = fs.readFileSync(filePath, "utf-8");
+    const lines = content.split("\n");
+    // Check for state-changing methods
+    const hasPost = /export\s+(?:async\s+)?function\s+POST/i.test(content);
+    const hasPut = /export\s+(?:async\s+)?function\s+PUT/i.test(content);
+    const hasPatch = /export\s+(?:async\s+)?function\s+PATCH/i.test(content);
+    const hasDelete = /export\s+(?:async\s+)?function\s+DELETE/i.test(content);
+    if (!hasPost && !hasPut && !hasPatch && !hasDelete) {
+        return; // GET-only routes don't need CSRF protection
+    }
+    // Check for CSRF protection patterns
+    const hasProtection = CSRF_PROTECTION_PATTERNS.some((pattern) => content.toLowerCase().includes(pattern.toLowerCase()));
+    if (!hasProtection) {
+        // Find the line with the export
+        let lineNumber = 1;
+        for (let i = 0; i < lines.length; i++) {
+            if (/export\s+(?:async\s+)?function\s+(?:POST|PUT|PATCH|DELETE)/i.test(lines[i])) {
+                lineNumber = i + 1;
+                break;
+            }
+        }
+        const methods = [hasPost && "POST", hasPut && "PUT", hasPatch && "PATCH", hasDelete && "DELETE"]
+            .filter(Boolean)
+            .join(", ");
+        issues.push({
+            file: filePath,
+            line: lineNumber,
+            severity: "warning",
+            message: `State-changing route (${methods}) without apparent CSRF protection. Ensure session auth or origin validation is in place.`,
+        });
+    }
+    // Check for cookie-only auth without session validation
+    if (content.includes("cookies()") &&
+        !content.includes("getServerSession") &&
+        !content.includes("auth()")) {
+        const cookieLine = lines.findIndex((l) => l.includes("cookies()")) + 1;
+        issues.push({
+            file: filePath,
+            line: cookieLine || 1,
+            severity: "warning",
+            message: "Using cookies() without session validation - ensure CSRF protection is in place",
+        });
+    }
+}
+async function scanForms(filePath) {
+    const content = fs.readFileSync(filePath, "utf-8");
+    const lines = content.split("\n");
+    // Check for forms with action but no CSRF token
+    const formActionRegex = /<form[^>]*action\s*=\s*["'][^"']+["'][^>]*>/gi;
+    let match;
+    while ((match = formActionRegex.exec(content)) !== null) {
+        const beforeMatch = content.slice(0, match.index);
+        const lineNumber = beforeMatch.split("\n").length;
+        // Check if there's a CSRF token input nearby
+        const formEnd = content.indexOf("</form>", match.index);
+        const formContent = content.slice(match.index, formEnd > 0 ? formEnd : match.index + 500);
+        if (!formContent.includes("csrf") && !formContent.includes("_token")) {
+            issues.push({
+                file: filePath,
+                line: lineNumber,
+                severity: "warning",
+                message: "Form with action attribute - ensure CSRF token is included or use fetch with proper headers",
+            });
+        }
+    }
+}
+async function main() {
+    const reporter = (0, universal_progress_reporter_1.createUniversalProgressReporter)(path.basename(__filename, ".ts"));
+    const verbose = process.argv.includes("--verbose") || process.argv.includes("-v");
+    console.log(`${console_chars_1.emoji.shield}  CSRF Protection Validation Preflight`);
+    console.log((0, console_chars_1.createDivider)(60, "heavy"));
+    // Scan API routes
+    const apiRoutes = await getApiRouteFiles();
+    for (const file of apiRoutes) {
+        await scanApiRoute(file);
+    }
+    // Scan for forms
+    const components = await getAllTsxFiles();
+    for (const file of components) {
+        await scanForms(file);
+    }
+    const errors = issues.filter((i) => i.severity === "error");
+    const warnings = issues.filter((i) => i.severity === "warning");
+    if (verbose || issues.length > 0) {
+        if (errors.length > 0) {
+            console.log(`\n${console_chars_1.emoji.error} ERRORS (blocking):`);
+            errors.forEach((issue) => {
+                console.log(`   ${issue.file}:${issue.line}`);
+                console.log(`      ${issue.message}`);
+            });
+        }
+        if (warnings.length > 0) {
+            console.log(`\n${console_chars_1.emoji.warning}  WARNINGS:`);
+            warnings.slice(0, 15).forEach((issue) => {
+                console.log(`   ${issue.file}:${issue.line}`);
+                console.log(`      ${issue.message}`);
+            });
+            if (warnings.length > 15) {
+                console.log(`   ... and ${warnings.length - 15} more warnings`);
+            }
+        }
+    }
+    console.log("\n" + (0, console_chars_1.createDivider)(60, "heavy"));
+    console.log(`API routes scanned: ${apiRoutes.length}`);
+    console.log(`Components scanned: ${components.length}`);
+    console.log(`Errors: ${errors.length}`);
+    console.log(`Warnings: ${warnings.length}`);
+    if (errors.length > 0) {
+        console.log(`\n${console_chars_1.emoji.error} CSRF Protection Validation FAILED`);
+        process.exit(1);
+    }
+    console.log(`\n${console_chars_1.emoji.success} CSRF Protection Validation PASSED`);
+    if (warnings.length > 0) {
+        console.log("   (Review warnings to ensure adequate protection)");
+    }
+}
+main().catch(console.error);
+//# sourceMappingURL=csrf-protection.js.map

package/dist/checks/security/csrf-protection.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"csrf-protection.js","sourceRoot":"","sources":["../../../src/checks/security/csrf-protection.ts"],"names":[],"mappings":";;AACA;;;;;;;;;;;GAWG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAEH,uCAAyB;AACzB,2CAA6B;AAC7B,6DAAiE;AACjE,wDAAoD;AACpD,uFAAwF;AAGxF,iBAAiB;AACJ,QAAA,EAAE,GAAG,0BAA0B,CAAC;AAChC,QAAA,IAAI,GAAG,iBAAiB,CAAC;AACzB,QAAA,QAAQ,GAAG,UAAU,CAAC;AACtB,QAAA,QAAQ,GAAG,IAAI,CAAC;AAChB,QAAA,WAAW,GAAG,iDAAiD,CAAC;AAChE,QAAA,IAAI,GAAG,CAAC,UAAU,CAAC,CAAC;AASjC,MAAM,MAAM,GAAY,EAAE,CAAC;AAE3B,iFAAiF;AACjF,MAAM,aAAa,GAAG;IACpB,YAAY,EAAE,gCAAgC;IAC9C,gBAAgB,EAAE,sCAAsC;IACxD,YAAY,EAAE,+BAA+B;IAC7C,aAAa,EAAE,gBAAgB;IAC/B,cAAc,EAAE,8BAA8B;IAC9C,WAAW,EAAE,2CAA2C;IACxD,aAAa,EAAE,wCAAwC;IACvD,+EAA+E;IAC/E,cAAc,EAAE,gDAAgD;IAChE,kBAAkB,EAAE,gCAAgC;IACpD,cAAc,EAAE,sCAAsC;IACtD,iBAAiB,EAAE,qCAAqC;IACxD,sEAAsE;IACtE,qBAAqB,EAAE,kBAAkB;IACzC,gBAAgB,EAAE,iBAAiB;IACnC,qBAAqB,EAAE,sBAAsB;IAC7C,oCAAoC,EAAE,kBAAkB;IACxD,kBAAkB,EAAE,uBAAuB;IAC3C,uBAAuB,EAAE,eAAe;IACxC,gCAAgC,EAAE,kBAAkB;IACpD,oBAAoB,EAAE,2CAA2C;IACjE,mBAAmB,EAAE,wBAAwB;IAC7C,yDAAyD;IACzD,cAAc,EAAE,gCAAgC;IAChD,YAAY,EAAE,kCAAkC;IAChD,8DAA8D;IAC9D,aAAa,EAAE,0CAA0C;IACzD,uCAAuC;IACvC,sBAAsB,EAAE,4BAA4B;IACpD,yDAAyD;IACzD,oBAAoB,EAAE,iCAAiC;CACxD,CAAC;AAEF,sCAAsC;AACtC,MAAM,wBAAwB,GAAG;IAC/B,mBAAmB;IACnB,WAAW;IACX,YAAY;IACZ,cAAc;IACd,QAAQ;IACR,SAAS;IACT,kBAAkB,EAAE,iDAAiD;IACrE,QAAQ,EAAE,4BAA4B;IACtC,iBAAiB,EAAE,iCAAiC;IACpD,gBAAgB;CACjB,CAAC;AAEF,gDAAgD;AAEhD,IAAI,oBAAoB,GAAoB,IAAI,CAAC;AACjD,gDAAgD;AAEhD,IAAI,kBAAkB,GAAoB,IAAI,CAAC;AAC/C,KAAK,UAAU,cAAc;IAC3B,IAAI,CAAC,kBAAkB,EAAE,CAAC;QACxB,kBAAkB,GAAG,MAAM,sBAAS,CAAC,SAAS,EAAE,CAAC;IACnD,CAAC;IACD,OAAO,kBAAkB,CAAC;AAC5B,CAAC;AAED,KAAK,UAAU,gBAAgB;IAC7B,IAAI,CAAC,oBAAoB,EAAE,CAAC;QAC1B,oBAAoB,GAAG,MAAM,sBAAS,CAAC,gBAAgB,EAAE,CAAC;IAC5D,CAAC;IACD,OAAO,oBAAoB,CAAC;AAC9B,CAAC;AAED,KAAK,UAAU,YAAY,CAAC,QAAgB;IAC1C,MAAM,UAAU,GAAG,QAAQ,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;IAEhD,kBAAkB;IAClB,IAAI,aAAa,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC;QAChE,OAAO;IACT,CAAC;IAED,MAAM,OAAO,GAAG,EAAE,CAAC,YAAY,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;IACnD,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAElC,mCAAmC;IACnC,MAAM,OAAO,GAAG,wCAAwC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IACvE,MAAM,MAAM,GAAG,uCAAuC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IACrE,MAAM,QAAQ,GAAG,yCAAyC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IACzE,MAAM,SAAS,GAAG,0CAA0C,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAE3E,IAAI,CAAC,OAAO,IAAI,CAAC,MAAM,IAAI,CAAC,QAAQ,IAAI,CAAC,SAAS,EAAE,CAAC;QACnD,OAAO,CAAC,6CAA6C;IACvD,CAAC;IAED,qCAAqC;IACrC,MAAM,aAAa,GAAG,wBAAwB,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAC9D,OAAO,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,OAAO,CAAC,WAAW,EAAE,CAAC,CACtD,CAAC;IAEF,IAAI,CAAC,aAAa,EAAE,CAAC;QACnB,gCAAgC;QAChC,IAAI,UAAU,GAAG,CAAC,CAAC;QACnB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YACtC,IAAI,6DAA6D,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;gBACjF,UAAU,GAAG,CAAC,GAAG,CAAC,CAAC;gBACnB,MAAM;YACR,CAAC;QACH,CAAC;QAED,MAAM,OAAO,GAAG,CAAC,OAAO,IAAI,MAAM,EAAE,MAAM,IAAI,KAAK,EAAE,QAAQ,IAAI,OAAO,EAAE,SAAS,IAAI,QAAQ,CAAC;aAC7F,MAAM,CAAC,OAAO,CAAC;aACf,IAAI,CAAC,IAAI,CAAC,CAAC;QAEd,MAAM,CAAC,IAAI,CAAC;YACV,IAAI,EAAE,QAAQ;YACd,IAAI,EAAE,UAAU;YAChB,QAAQ,EAAE,SAAS;YACnB,OAAO,EAAE,yBAAyB,OAAO,2FAA2F;SACrI,CAAC,CAAC;IACL,CAAC;IAED,wDAAwD;IACxD,IACE,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC;QAC7B,CAAC,OAAO,CAAC,QAAQ,CAAC,kBAAkB,CAAC;QACrC,CAAC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAC3B,CAAC;QACD,MAAM,UAAU,GAAG,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC,GAAG,CAAC,CAAC;QACvE,MAAM,CAAC,IAAI,CAAC;YACV,IAAI,EAAE,QAAQ;YACd,IAAI,EAAE,UAAU,IAAI,CAAC;YACrB,QAAQ,EAAE,SAAS;YACnB,OAAO,EAAE,iFAAiF;SAC3F,CAAC,CAAC;IACL,CAAC;AACH,CAAC;AAED,KAAK,UAAU,SAAS,CAAC,QAAgB;IACvC,MAAM,OAAO,GAAG,EAAE,CAAC,YAAY,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;IACnD,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAElC,gDAAgD;IAChD,MAAM,eAAe,GAAG,+CAA+C,CAAC;IACxE,IAAI,KAAK,CAAC;IAEV,OAAO,CAAC,KAAK,GAAG,eAAe,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;QACxD,MAAM,WAAW,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC;QAClD,MAAM,UAAU,GAAG,WAAW,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC;QAElD,6CAA6C;QAC7C,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,SAAS,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC;QACxD,MAAM,WAAW,GAAG,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,EAAE,OAAO,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,GAAG,GAAG,CAAC,CAAC;QAE1F,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;YACrE,MAAM,CAAC,IAAI,CAAC;gBACV,IAAI,EAAE,QAAQ;gBACd,IAAI,EAAE,UAAU;gBAChB,QAAQ,EAAE,SAAS;gBACnB,OAAO,EACL,6FAA6F;aAChG,CAAC,CAAC;QACL,CAAC;IACH,CAAC;AACH,CAAC;AAED,KAAK,UAAU,IAAI;IACjB,MAAM,QAAQ,GAAG,IAAA,6DAA+B,EAAC,IAAI,CAAC,QAAQ,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC,CAAC;IACnF,MAAM,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,IAAI,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;IAElF,OAAO,CAAC,GAAG,CAAC,GAAG,qBAAK,CAAC,MAAM,wCAAwC,CAAC,CAAC;IACrE,OAAO,CAAC,GAAG,CAAC,IAAA,6BAAa,EAAC,EAAE,EAAE,OAAO,CAAC,CAAC,CAAC;IAExC,kBAAkB;IAClB,MAAM,SAAS,GAAG,MAAM,gBAAgB,EAAE,CAAC;IAE3C,KAAK,MAAM,IAAI,IAAI,SAAS,EAAE,CAAC;QAC7B,MAAM,YAAY,CAAC,IAAI,CAAC,CAAC;IAC3B,CAAC;IAED,iBAAiB;IACjB,MAAM,UAAU,GAAG,MAAM,cAAc,EAAE,CAAC;IAE1C,KAAK,MAAM,IAAI,IAAI,UAAU,EAAE,CAAC;QAC9B,MAAM,SAAS,CAAC,IAAI,CAAC,CAAC;IACxB,CAAC;IAED,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC;IAC5D,MAAM,QAAQ,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC;IAEhE,IAAI,OAAO,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACjC,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACtB,OAAO,CAAC,GAAG,CAAC,KAAK,qBAAK,CAAC,KAAK,qBAAqB,CAAC,CAAC;YACnD,MAAM,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,EAAE;gBACvB,OAAO,CAAC,GAAG,CAAC,MAAM,KAAK,CAAC,IAAI,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;gBAC9C,OAAO,CAAC,GAAG,CAAC,SAAS,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;YACxC,CAAC,CAAC,CAAC;QACL,CAAC;QAED,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACxB,OAAO,CAAC,GAAG,CAAC,KAAK,qBAAK,CAAC,OAAO,aAAa,CAAC,CAAC;YAC7C,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,EAAE;gBACtC,OAAO,CAAC,GAAG,CAAC,MAAM,KAAK,CAAC,IAAI,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;gBAC9C,OAAO,CAAC,GAAG,CAAC,SAAS,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;YACxC,CAAC,CAAC,CAAC;YACH,IAAI,QAAQ,CAAC,MAAM,GAAG,EAAE,EAAE,CAAC;gBACzB,OAAO,CAAC,GAAG,CAAC,cAAc,QAAQ,CAAC,MAAM,GAAG,EAAE,gBAAgB,CAAC,CAAC;YAClE,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO,CAAC,GAAG,CAAC,IAAI,GAAG,IAAA,6BAAa,EAAC,EAAE,EAAE,OAAO,CAAC,CAAC,CAAC;IAC/C,OAAO,CAAC,GAAG,CAAC,uBAAuB,SAAS,CAAC,MAAM,EAAE,CAAC,CAAC;IACvD,OAAO,CAAC,GAAG,CAAC,uBAAuB,UAAU,CAAC,MAAM,EAAE,CAAC,CAAC;IACxD,OAAO,CAAC,GAAG,CAAC,WAAW,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC;IACxC,OAAO,CAAC,GAAG,CAAC,aAAa,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC;IAE5C,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACtB,OAAO,CAAC,GAAG,CAAC,KAAK,qBAAK,CAAC,KAAK,oCAAoC,CAAC,CAAC;QAClE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,OAAO,CAAC,GAAG,CAAC,KAAK,qBAAK,CAAC,OAAO,oCAAoC,CAAC,CAAC;IACpE,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACxB,OAAO,CAAC,GAAG,CAAC,oDAAoD,CAAC,CAAC;IACpE,CAAC;AACH,CAAC;AAED,IAAI,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC"}

package/dist/checks/security/dependency-audit.d.ts

@@ -0,0 +1,25 @@
+#!/usr/bin/env tsx
+/**
+ * Dependency Security Audit Preflight
+ *
+ * Checks for known vulnerabilities in npm dependencies using pnpm audit.
+ * Blocks deployment on critical/high vulnerabilities.
+ *
+ * Severity Levels:
+ * - critical: BLOCKING - must fix before deploy
+ * - high: BLOCKING - must fix before deploy
+ * - moderate: WARNING - should fix soon
+ * - low: INFO - fix when convenient
+ *
+ * Usage:
+ *   pnpm preflight:dependency-audit
+ *   pnpm preflight:dependency-audit --strict (blocks on moderate too)
+ *   pnpm preflight:dependency-audit --verbose
+ */
+export declare const id = "security/dependency-audit";
+export declare const name = "Dependency Audit";
+export declare const category = "security";
+export declare const blocking = true;
+export declare const description = "Dependency Security Audit Preflight";
+export declare const tags: string[];
+//# sourceMappingURL=dependency-audit.d.ts.map

package/dist/checks/security/dependency-audit.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"dependency-audit.d.ts","sourceRoot":"","sources":["../../../src/checks/security/dependency-audit.ts"],"names":[],"mappings":";AACA;;;;;;;;;;;;;;;;GAgBG;AASH,eAAO,MAAM,EAAE,8BAA8B,CAAC;AAC9C,eAAO,MAAM,IAAI,qBAAqB,CAAC;AACvC,eAAO,MAAM,QAAQ,aAAa,CAAC;AACnC,eAAO,MAAM,QAAQ,OAAO,CAAC;AAC7B,eAAO,MAAM,WAAW,wCAAwC,CAAC;AACjE,eAAO,MAAM,IAAI,UAAe,CAAC"}

package/dist/checks/security/dependency-audit.js

@@ -0,0 +1,219 @@
+#!/usr/bin/env tsx
+"use strict";
+/**
+ * Dependency Security Audit Preflight
+ *
+ * Checks for known vulnerabilities in npm dependencies using pnpm audit.
+ * Blocks deployment on critical/high vulnerabilities.
+ *
+ * Severity Levels:
+ * - critical: BLOCKING - must fix before deploy
+ * - high: BLOCKING - must fix before deploy
+ * - moderate: WARNING - should fix soon
+ * - low: INFO - fix when convenient
+ *
+ * Usage:
+ *   pnpm preflight:dependency-audit
+ *   pnpm preflight:dependency-audit --strict (blocks on moderate too)
+ *   pnpm preflight:dependency-audit --verbose
+ */
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.tags = exports.description = exports.blocking = exports.category = exports.name = exports.id = void 0;
+const child_process_1 = require("child_process");
+const path = __importStar(require("path"));
+const console_chars_1 = require("../../utils/console-chars");
+const universal_progress_reporter_1 = require("../system/universal-progress-reporter");
+// Check metadata
+exports.id = "security/dependency-audit";
+exports.name = "Dependency Audit";
+exports.category = "security";
+exports.blocking = true;
+exports.description = "Dependency Security Audit Preflight";
+exports.tags = ["security"];
+const isStrict = process.argv.includes("--strict");
+const isVerbose = process.argv.includes("--verbose");
+console.log(`${console_chars_1.emoji.lock} Dependency Security Audit Preflight`);
+console.log((0, console_chars_1.createDivider)(60, "heavy"));
+let errors = 0;
+let warnings = 0;
+async function main() {
+    const reporter = (0, universal_progress_reporter_1.createUniversalProgressReporter)(path.basename(__filename, ".ts"));
+    console.log(`\n${console_chars_1.emoji.search} Running pnpm audit...\n`);
+    let auditOutput;
+    let auditResult = null;
+    try {
+        // Run pnpm audit with JSON output
+        auditOutput = (0, child_process_1.execSync)("pnpm audit --json 2>&1", {
+            encoding: "utf-8",
+            maxBuffer: 10 * 1024 * 1024, // 10MB buffer for large outputs
+            shell: process.platform === "win32" ? "pwsh.exe" : "/bin/bash",
+        });
+        // Try to parse JSON output
+        try {
+            auditResult = JSON.parse(auditOutput);
+        }
+        catch {
+            // pnpm audit may output multiple JSON objects, try to find vulnerabilities
+            const lines = auditOutput.split("\n").filter(Boolean);
+            for (const line of lines) {
+                try {
+                    const parsed = JSON.parse(line);
+                    if (parsed.vulnerabilities) {
+                        auditResult = parsed;
+                        break;
+                    }
+                }
+                catch {
+                    // Skip non-JSON lines
+                }
+            }
+        }
+    }
+    catch (error) {
+        // pnpm audit exits with non-zero when vulnerabilities found
+        auditOutput = error.stdout || "";
+        try {
+            auditResult = JSON.parse(auditOutput);
+        }
+        catch {
+            // Fallback: run without JSON and parse text output
+            console.log(`${console_chars_1.emoji.warning}  Could not parse JSON audit output, running text audit...\n`);
+            try {
+                const textOutput = (0, child_process_1.execSync)("pnpm audit 2>&1", {
+                    encoding: "utf-8",
+                    maxBuffer: 10 * 1024 * 1024,
+                    shell: process.platform === "win32" ? "pwsh.exe" : "/bin/bash",
+                });
+                if (isVerbose) {
+                    console.log(textOutput);
+                }
+                // Parse text output for vulnerability counts
+                const criticalMatch = textOutput.match(/(\d+)\s+critical/i);
+                const highMatch = textOutput.match(/(\d+)\s+high/i);
+                const moderateMatch = textOutput.match(/(\d+)\s+moderate/i);
+                const lowMatch = textOutput.match(/(\d+)\s+low/i);
+                auditResult = {
+                    vulnerabilities: {
+                        critical: criticalMatch ? parseInt(criticalMatch[1]) : 0,
+                        high: highMatch ? parseInt(highMatch[1]) : 0,
+                        moderate: moderateMatch ? parseInt(moderateMatch[1]) : 0,
+                        low: lowMatch ? parseInt(lowMatch[1]) : 0,
+                        info: 0,
+                        total: 0,
+                    },
+                };
+                auditResult.vulnerabilities.total =
+                    auditResult.vulnerabilities.critical +
+                        auditResult.vulnerabilities.high +
+                        auditResult.vulnerabilities.moderate +
+                        auditResult.vulnerabilities.low;
+            }
+            catch {
+                console.log(`${console_chars_1.emoji.success} No vulnerabilities found (or audit not available)`);
+                process.exit(0);
+            }
+        }
+    }
+    if (!auditResult || !auditResult.vulnerabilities) {
+        console.log(`${console_chars_1.emoji.success} No vulnerabilities found`);
+        process.exit(0);
+    }
+    const { vulnerabilities } = auditResult;
+    // Display results
+    console.log(`${console_chars_1.emoji.chart} Vulnerability Summary:`);
+    console.log((0, console_chars_1.createDivider)(60, "heavy"));
+    if (vulnerabilities.critical > 0) {
+        console.log(`${console_chars_1.emoji.error} Critical: ${vulnerabilities.critical}`);
+        errors += vulnerabilities.critical;
+    }
+    else {
+        console.log(`${console_chars_1.emoji.success} Critical: 0`);
+    }
+    if (vulnerabilities.high > 0) {
+        console.log(`${console_chars_1.emoji.error} High:     ${vulnerabilities.high}`);
+        errors += vulnerabilities.high;
+    }
+    else {
+        console.log(`${console_chars_1.emoji.success} High:     0`);
+    }
+    if (vulnerabilities.moderate > 0) {
+        if (isStrict) {
+            console.log(`${console_chars_1.emoji.error} Moderate: ${vulnerabilities.moderate}`);
+            errors += vulnerabilities.moderate;
+        }
+        else {
+            console.log(`${console_chars_1.emoji.warning}  Moderate: ${vulnerabilities.moderate}`);
+            warnings += vulnerabilities.moderate;
+        }
+    }
+    else {
+        console.log(`${console_chars_1.emoji.success} Moderate: 0`);
+    }
+    if (vulnerabilities.low > 0) {
+        console.log(`${console_chars_1.emoji.info}  Low:      ${vulnerabilities.low}`);
+    }
+    else {
+        console.log(`${console_chars_1.emoji.success} Low:      0`);
+    }
+    console.log((0, console_chars_1.createDivider)(60, "heavy"));
+    console.log(`   Total:    ${vulnerabilities.total}`);
+    // Recommendations
+    if (errors > 0 || warnings > 0) {
+        console.log(`\n${console_chars_1.emoji.clipboard} Recommendations:`);
+        console.log('   1. Run "pnpm audit" to see detailed vulnerability info');
+        console.log('   2. Run "pnpm audit --fix" to auto-fix where possible');
+        console.log("   3. Update vulnerable packages manually if auto-fix fails");
+        console.log("   4. Check if vulnerabilities are in dev dependencies only");
+    }
+    // Exit status
+    if (errors > 0) {
+        console.log(`\n${console_chars_1.emoji.error} FAILED: ${errors} critical/high vulnerabilities found`);
+        console.log("   Fix vulnerabilities before deploying to production.");
+        process.exit(1);
+    }
+    if (warnings > 0) {
+        console.log(`\n${console_chars_1.emoji.warning}  PASSED with warnings: ${warnings} moderate vulnerabilities`);
+        console.log("   Consider fixing these vulnerabilities soon.");
+        process.exit(0);
+    }
+    console.log(`\n${console_chars_1.emoji.success} No blocking vulnerabilities found!`);
+    process.exit(0);
+}
+main().catch((error) => {
+    console.error("Error running dependency audit:", error);
+    process.exit(1);
+});
+//# sourceMappingURL=dependency-audit.js.map

package/dist/checks/security/dependency-audit.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"dependency-audit.js","sourceRoot":"","sources":["../../../src/checks/security/dependency-audit.ts"],"names":[],"mappings":";;AACA;;;;;;;;;;;;;;;;GAgBG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAEH,iDAAyC;AACzC,2CAA6B;AAC7B,6DAAiE;AACjE,uFAAwF;AAGxF,iBAAiB;AACJ,QAAA,EAAE,GAAG,2BAA2B,CAAC;AACjC,QAAA,IAAI,GAAG,kBAAkB,CAAC;AAC1B,QAAA,QAAQ,GAAG,UAAU,CAAC;AACtB,QAAA,QAAQ,GAAG,IAAI,CAAC;AAChB,QAAA,WAAW,GAAG,qCAAqC,CAAC;AACpD,QAAA,IAAI,GAAG,CAAC,UAAU,CAAC,CAAC;AAajC,MAAM,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;AACnD,MAAM,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;AAErD,OAAO,CAAC,GAAG,CAAC,GAAG,qBAAK,CAAC,IAAI,sCAAsC,CAAC,CAAC;AACjE,OAAO,CAAC,GAAG,CAAC,IAAA,6BAAa,EAAC,EAAE,EAAE,OAAO,CAAC,CAAC,CAAC;AAExC,IAAI,MAAM,GAAG,CAAC,CAAC;AACf,IAAI,QAAQ,GAAG,CAAC,CAAC;AAEjB,KAAK,UAAU,IAAI;IACjB,MAAM,QAAQ,GAAG,IAAA,6DAA+B,EAAC,IAAI,CAAC,QAAQ,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC,CAAC;IACnF,OAAO,CAAC,GAAG,CAAC,KAAK,qBAAK,CAAC,MAAM,0BAA0B,CAAC,CAAC;IAEzD,IAAI,WAAmB,CAAC;IACxB,IAAI,WAAW,GAAuB,IAAI,CAAC;IAE3C,IAAI,CAAC;QACH,kCAAkC;QAClC,WAAW,GAAG,IAAA,wBAAQ,EAAC,wBAAwB,EAAE;YAC/C,QAAQ,EAAE,OAAO;YACjB,SAAS,EAAE,EAAE,GAAG,IAAI,GAAG,IAAI,EAAE,gCAAgC;YAC7D,KAAK,EAAE,OAAO,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,WAAW;SAC/D,CAAC,CAAC;QAEH,2BAA2B;QAC3B,IAAI,CAAC;YACH,WAAW,GAAG,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;QACxC,CAAC;QAAC,MAAM,CAAC;YACP,2EAA2E;YAC3E,MAAM,KAAK,GAAG,WAAW,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;YACtD,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;gBACzB,IAAI,CAAC;oBACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;oBAChC,IAAI,MAAM,CAAC,eAAe,EAAE,CAAC;wBAC3B,WAAW,GAAG,MAAM,CAAC;wBACrB,MAAM;oBACR,CAAC;gBACH,CAAC;gBAAC,MAAM,CAAC;oBACP,sBAAsB;gBACxB,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;IAAC,OAAO,KAAU,EAAE,CAAC;QACpB,4DAA4D;QAC5D,WAAW,GAAG,KAAK,CAAC,MAAM,IAAI,EAAE,CAAC;QAEjC,IAAI,CAAC;YACH,WAAW,GAAG,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;QACxC,CAAC;QAAC,MAAM,CAAC;YACP,mDAAmD;YACnD,OAAO,CAAC,GAAG,CAAC,GAAG,qBAAK,CAAC,OAAO,8DAA8D,CAAC,CAAC;YAE5F,IAAI,CAAC;gBACH,MAAM,UAAU,GAAG,IAAA,wBAAQ,EAAC,iBAAiB,EAAE;oBAC7C,QAAQ,EAAE,OAAO;oBACjB,SAAS,EAAE,EAAE,GAAG,IAAI,GAAG,IAAI;oBAC3B,KAAK,EAAE,OAAO,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,WAAW;iBAC/D,CAAC,CAAC;gBAEH,IAAI,SAAS,EAAE,CAAC;oBACd,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;gBAC1B,CAAC;gBAED,6CAA6C;gBAC7C,MAAM,aAAa,GAAG,UAAU,CAAC,KAAK,CAAC,mBAAmB,CAAC,CAAC;gBAC5D,MAAM,SAAS,GAAG,UAAU,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC;gBACpD,MAAM,aAAa,GAAG,UAAU,CAAC,KAAK,CAAC,mBAAmB,CAAC,CAAC;gBAC5D,MAAM,QAAQ,GAAG,UAAU,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC;gBAElD,WAAW,GAAG;oBACZ,eAAe,EAAE;wBACf,QAAQ,EAAE,aAAa,CAAC,CAAC,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;wBACxD,IAAI,EAAE,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;wBAC5C,QAAQ,EAAE,aAAa,CAAC,CAAC,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;wBACxD,GAAG,EAAE,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;wBACzC,IAAI,EAAE,CAAC;wBACP,KAAK,EAAE,CAAC;qBACT;iBACF,CAAC;gBAEF,WAAW,CAAC,eAAe,CAAC,KAAK;oBAC/B,WAAW,CAAC,eAAe,CAAC,QAAQ;wBACpC,WAAW,CAAC,eAAe,CAAC,IAAI;wBAChC,WAAW,CAAC,eAAe,CAAC,QAAQ;wBACpC,WAAW,CAAC,eAAe,CAAC,GAAG,CAAC;YACpC,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,CAAC,GAAG,CAAC,GAAG,qBAAK,CAAC,OAAO,oDAAoD,CAAC,CAAC;gBAClF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAClB,CAAC;QACH,CAAC;IACH,CAAC;IAED,IAAI,CAAC,WAAW,IAAI,CAAC,WAAW,CAAC,eAAe,EAAE,CAAC;QACjD,OAAO,CAAC,GAAG,CAAC,GAAG,qBAAK,CAAC,OAAO,2BAA2B,CAAC,CAAC;QACzD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,MAAM,EAAE,eAAe,EAAE,GAAG,WAAW,CAAC;IAExC,kBAAkB;IAClB,OAAO,CAAC,GAAG,CAAC,GAAG,qBAAK,CAAC,KAAK,yBAAyB,CAAC,CAAC;IACrD,OAAO,CAAC,GAAG,CAAC,IAAA,6BAAa,EAAC,EAAE,EAAE,OAAO,CAAC,CAAC,CAAC;IAExC,IAAI,eAAe,CAAC,QAAQ,GAAG,CAAC,EAAE,CAAC;QACjC,OAAO,CAAC,GAAG,CAAC,GAAG,qBAAK,CAAC,KAAK,cAAc,eAAe,CAAC,QAAQ,EAAE,CAAC,CAAC;QACpE,MAAM,IAAI,eAAe,CAAC,QAAQ,CAAC;IACrC,CAAC;SAAM,CAAC;QACN,OAAO,CAAC,GAAG,CAAC,GAAG,qBAAK,CAAC,OAAO,cAAc,CAAC,CAAC;IAC9C,CAAC;IAED,IAAI,eAAe,CAAC,IAAI,GAAG,CAAC,EAAE,CAAC;QAC7B,OAAO,CAAC,GAAG,CAAC,GAAG,qBAAK,CAAC,KAAK,cAAc,eAAe,CAAC,IAAI,EAAE,CAAC,CAAC;QAChE,MAAM,IAAI,eAAe,CAAC,IAAI,CAAC;IACjC,CAAC;SAAM,CAAC;QACN,OAAO,CAAC,GAAG,CAAC,GAAG,qBAAK,CAAC,OAAO,cAAc,CAAC,CAAC;IAC9C,CAAC;IAED,IAAI,eAAe,CAAC,QAAQ,GAAG,CAAC,EAAE,CAAC;QACjC,IAAI,QAAQ,EAAE,CAAC;YACb,OAAO,CAAC,GAAG,CAAC,GAAG,qBAAK,CAAC,KAAK,cAAc,eAAe,CAAC,QAAQ,EAAE,CAAC,CAAC;YACpE,MAAM,IAAI,eAAe,CAAC,QAAQ,CAAC;QACrC,CAAC;aAAM,CAAC;YACN,OAAO,CAAC,GAAG,CAAC,GAAG,qBAAK,CAAC,OAAO,eAAe,eAAe,CAAC,QAAQ,EAAE,CAAC,CAAC;YACvE,QAAQ,IAAI,eAAe,CAAC,QAAQ,CAAC;QACvC,CAAC;IACH,CAAC;SAAM,CAAC;QACN,OAAO,CAAC,GAAG,CAAC,GAAG,qBAAK,CAAC,OAAO,cAAc,CAAC,CAAC;IAC9C,CAAC;IAED,IAAI,eAAe,CAAC,GAAG,GAAG,CAAC,EAAE,CAAC;QAC5B,OAAO,CAAC,GAAG,CAAC,GAAG,qBAAK,CAAC,IAAI,eAAe,eAAe,CAAC,GAAG,EAAE,CAAC,CAAC;IACjE,CAAC;SAAM,CAAC;QACN,OAAO,CAAC,GAAG,CAAC,GAAG,qBAAK,CAAC,OAAO,cAAc,CAAC,CAAC;IAC9C,CAAC;IAED,OAAO,CAAC,GAAG,CAAC,IAAA,6BAAa,EAAC,EAAE,EAAE,OAAO,CAAC,CAAC,CAAC;IACxC,OAAO,CAAC,GAAG,CAAC,gBAAgB,eAAe,CAAC,KAAK,EAAE,CAAC,CAAC;IAErD,kBAAkB;IAClB,IAAI,MAAM,GAAG,CAAC,IAAI,QAAQ,GAAG,CAAC,EAAE,CAAC;QAC/B,OAAO,CAAC,GAAG,CAAC,KAAK,qBAAK,CAAC,SAAS,mBAAmB,CAAC,CAAC;QACrD,OAAO,CAAC,GAAG,CAAC,2DAA2D,CAAC,CAAC;QACzE,OAAO,CAAC,GAAG,CAAC,yDAAyD,CAAC,CAAC;QACvE,OAAO,CAAC,GAAG,CAAC,6DAA6D,CAAC,CAAC;QAC3E,OAAO,CAAC,GAAG,CAAC,6DAA6D,CAAC,CAAC;IAC7E,CAAC;IAED,cAAc;IACd,IAAI,MAAM,GAAG,CAAC,EAAE,CAAC;QACf,OAAO,CAAC,GAAG,CAAC,KAAK,qBAAK,CAAC,KAAK,YAAY,MAAM,sCAAsC,CAAC,CAAC;QACtF,OAAO,CAAC,GAAG,CAAC,wDAAwD,CAAC,CAAC;QACtE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,IAAI,QAAQ,GAAG,CAAC,EAAE,CAAC;QACjB,OAAO,CAAC,GAAG,CAAC,KAAK,qBAAK,CAAC,OAAO,2BAA2B,QAAQ,2BAA2B,CAAC,CAAC;QAC9F,OAAO,CAAC,GAAG,CAAC,gDAAgD,CAAC,CAAC;QAC9D,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,OAAO,CAAC,GAAG,CAAC,KAAK,qBAAK,CAAC,OAAO,qCAAqC,CAAC,CAAC;IACrE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC;AAED,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE;IACrB,OAAO,CAAC,KAAK,CAAC,iCAAiC,EAAE,KAAK,CAAC,CAAC;IACxD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC,CAAC,CAAC"}

package/dist/checks/security/env-value-leakage.d.ts

@@ -0,0 +1,21 @@
+#!/usr/bin/env tsx
+/**
+ * Preflight: Env value leakage (outside .env files)
+ *
+ * Goal:
+ * - Catch env-variable *values* (especially secrets) being stored in non-.env files
+ *   like .ts/.tsx/.js/.json configs, or docs with accidental real keys.
+ *
+ * How:
+ * - Load the env-var names from .env.example (source of truth).
+ * - Scan non-env files for patterns like `OPENAI_API_KEY = "..."` or `OPENAI_API_KEY: "..."`.
+ * - Block only when the value looks like a real secret (sk-..., pk_live..., ghp_..., AKIA...).
+ * - Warn for non-secret values (to keep signal high and avoid breaking existing patterns).
+ */
+export declare const id = "security/env-value-leakage";
+export declare const name = "Env Value Leakage";
+export declare const category = "security";
+export declare const blocking = true;
+export declare const description = "Preflight: Env value leakage (outside .env files)";
+export declare const tags: string[];
+//# sourceMappingURL=env-value-leakage.d.ts.map

package/dist/checks/security/env-value-leakage.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"env-value-leakage.d.ts","sourceRoot":"","sources":["../../../src/checks/security/env-value-leakage.ts"],"names":[],"mappings":";AACA;;;;;;;;;;;;GAYG;AAcH,eAAO,MAAM,EAAE,+BAA+B,CAAC;AAC/C,eAAO,MAAM,IAAI,sBAAsB,CAAC;AACxC,eAAO,MAAM,QAAQ,aAAa,CAAC;AACnC,eAAO,MAAM,QAAQ,OAAO,CAAC;AAC7B,eAAO,MAAM,WAAW,sDAAsD,CAAC;AAC/E,eAAO,MAAM,IAAI,UAAe,CAAC"}