@empline/preflight 1.1.0

package/dist/checks/runtime/server-client-decimal.js

@@ -0,0 +1,246 @@
+#!/usr/bin/env tsx
+"use strict";
+/**
+ * Server→Client Decimal Serialization Preflight (BLOCKING)
+ *
+ * Detects Prisma Decimal fields being passed from Server Components to Client Components
+ * without proper serialization. This causes the runtime error:
+ *
+ *   "Only plain objects can be passed to Client Components from Server Components.
+ *    Decimal objects are not supported."
+ *
+ * This is a BLOCKING preflight because it causes runtime crashes in production.
+ *
+ * Checks for:
+ * - Server Component pages passing Prisma query results with price/Decimal fields to Client Components
+ * - Missing Number() or .toNumber() conversion before passing to client
+ *
+ * @see https://nextjs.org/docs/app/building-your-application/rendering/composition-patterns
+ */
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.tags = exports.description = exports.blocking = exports.category = exports.name = exports.id = void 0;
+exports.run = run;
+const fs = __importStar(require("fs"));
+const path = __importStar(require("path"));
+const console_chars_1 = require("../../utils/console-chars");
+const universal_progress_reporter_1 = require("../system/universal-progress-reporter");
+const glob_1 = require("glob");
+// Check metadata
+exports.id = "runtime/server-client-decimal";
+exports.name = "Server Client Decimal";
+exports.category = "runtime";
+exports.blocking = true;
+exports.description = "Server→Client Decimal Serialization Preflight (BLOCKING)";
+exports.tags = ["runtime"];
+const issues = [];
+// Decimal field names that Prisma returns as Decimal type
+const DECIMAL_FIELDS = [
+    "price",
+    "shippingCost",
+    "amount",
+    "total",
+    "subtotal",
+    "fee",
+    "cost",
+    "tax",
+    "discount",
+];
+// Pattern to detect Client component imports and props passing
+const CLIENT_COMPONENT_PATTERN = /<(\w+Client)\s+[^>]*(?:listings|featuredListings|products|items)=\{([^}]+)\}/g;
+// Pattern to detect Prisma queries selecting price fields
+const PRISMA_SELECT_PRICE = /prisma\.\w+\.(?:findMany|findFirst|findUnique)\([^)]*select:\s*\{[^}]*price:\s*true/gs;
+function getCodeSnippet(lines, lineNumber) {
+    const start = Math.max(0, lineNumber - 2);
+    const end = Math.min(lines.length, lineNumber + 2);
+    return lines
+        .slice(start, end)
+        .map((l, i) => {
+        const num = start + i + 1;
+        const marker = num === lineNumber ? ">" : " ";
+        return `${marker} ${num.toString().padStart(4)} | ${l}`;
+    })
+        .join("\n");
+}
+async function analyzeFile(filePath) {
+    const content = fs.readFileSync(filePath, "utf-8");
+    const lines = content.split("\n");
+    // Only check Server Component pages (no "use client" directive)
+    if (content.includes('"use client"') || content.includes("'use client'")) {
+        return;
+    }
+    // Check if file has Prisma queries that select price
+    const hasPrismaPrice = PRISMA_SELECT_PRICE.test(content);
+    if (!hasPrismaPrice)
+        return;
+    // Reset regex
+    PRISMA_SELECT_PRICE.lastIndex = 0;
+    // Look for patterns where listings with price are passed to Client components
+    // without explicit serialization
+    // Pattern 1: Direct passing of query results to Client component
+    const clientPassingPattern = /<(\w+Client)[^>]*\s+(listings|featuredListings|products|items)=\{(\w+)\}/g;
+    let match;
+    while ((match = clientPassingPattern.exec(content)) !== null) {
+        const [fullMatch, componentName, propName, varName] = match;
+        const lineNumber = content.substring(0, match.index).split("\n").length;
+        // Check if the variable is serialized before passing
+        // Look for patterns like: varName.map(x => ({ ...x, price: Number(x.price) }))
+        // or serializeListing(varName) or similar
+        const beforeMatch = content.substring(0, match.index);
+        const afterVarDecl = content.substring(content.lastIndexOf(varName, match.index) - 500, match.index);
+        // Check if there's serialization happening
+        const hasNumberConversion = afterVarDecl.includes(`Number(`) && afterVarDecl.includes("price");
+        const hasToNumber = afterVarDecl.includes(".toNumber()");
+        const hasSerialize = /serialize\w*\(|Serialize\w*\(/.test(afterVarDecl);
+        const hasMapWithPrice = /\.map\([^)]*price:\s*Number\(/.test(afterVarDecl);
+        // Also check if the source data is already serialized (e.g., via serializeListingWithCatalog)
+        const sourceSerializationPattern = new RegExp(`${varName}[^=]*=.*serialize`, "i");
+        const hasSourceSerialization = sourceSerializationPattern.test(content);
+        // Check if file imports serialization utilities (strong indicator of proper handling)
+        const importsSerializationUtils = /import.*serialize.*from.*serialization-utils/.test(content);
+        // Check if the data comes from a function that uses serialization
+        const usesSerializationInFile = /serializeListing|serializeListingWithCatalog|serializeDecimal/.test(content);
+        // If passing raw Prisma results without serialization
+        if (!hasNumberConversion &&
+            !hasToNumber &&
+            !hasSerialize &&
+            !hasMapWithPrice &&
+            !hasSourceSerialization &&
+            !importsSerializationUtils &&
+            !usesSerializationInFile) {
+            // Check if the variable comes directly from a Prisma query
+            const varDeclPattern = new RegExp(`(?:const|let)\\s+(?:\\[?[^\\]]*${varName}[^\\]]*\\]?|${varName})\\s*=\\s*await\\s+(?:prisma|getCached)`, "g");
+            if (varDeclPattern.test(content)) {
+                issues.push({
+                    file: filePath,
+                    line: lineNumber,
+                    message: `Passing "${varName}" with Decimal price field to <${componentName}> without serialization`,
+                    suggestion: `Serialize before passing: ${varName}.map(item => ({ ...item, price: Number(item.price) }))`,
+                    codeSnippet: getCodeSnippet(lines, lineNumber),
+                });
+            }
+        }
+    }
+    // Pattern 2: JSON.stringify on objects with price from Prisma (for schema markup)
+    // Skip if the data source already serializes price to Number
+    const jsonStringifyPattern = /JSON\.stringify\(\s*(\w+Schema|\w+)\s*\)/g;
+    while ((match = jsonStringifyPattern.exec(content)) !== null) {
+        const [fullMatch, varName] = match;
+        const lineNumber = content.substring(0, match.index).split("\n").length;
+        // Check if the schema object contains price from Prisma without Number()
+        const schemaDefStart = content.lastIndexOf(`const ${varName}`, match.index);
+        if (schemaDefStart === -1)
+            continue;
+        const schemaDef = content.substring(schemaDefStart, match.index);
+        // Check if schema references listing.price or similar
+        const hasPriceRef = /listing\.price|item\.price|\.price/.test(schemaDef);
+        if (!hasPriceRef)
+            continue;
+        // Check if price is wrapped with Number() in the schema itself
+        const hasNumberWrap = /Number\([^)]*\.price\)|price:\s*Number\(/.test(schemaDef);
+        if (hasNumberWrap)
+            continue;
+        // Check if the data source already serializes price (look for price: Number( in the file)
+        // This handles cases where getCachedFeaturedListings() returns { price: Number(listing.price) }
+        const hasSerializedSource = /price:\s*Number\(/.test(content);
+        if (hasSerializedSource)
+            continue;
+        // Check if using a serialized variable
+        const usesSerializedVar = /serialized\w*\./.test(schemaDef);
+        if (usesSerializedVar)
+            continue;
+        issues.push({
+            file: filePath,
+            line: lineNumber,
+            message: `JSON.stringify on schema with Decimal price field - causes "Decimal objects are not supported" error`,
+            suggestion: `Wrap price with Number(): price: Number(listing.price)`,
+            codeSnippet: getCodeSnippet(lines, lineNumber),
+        });
+    }
+}
+async function run() {
+    const reporter = (0, universal_progress_reporter_1.createUniversalProgressReporter)(exports.name);
+    const args = process.argv.slice(2);
+    const isWarn = args.includes("--warn");
+    const isVerbose = args.includes("--verbose");
+    console.log(`\n${console_chars_1.emoji.search} Server${console_chars_1.chars.arrow}Client Decimal Serialization Check`);
+    console.log("=".repeat(60));
+    // Only check app/ pages (Server Components)
+    const files = await (0, glob_1.glob)(["app/**/page.tsx", "app/**/layout.tsx"], {
+        ignore: ["**/node_modules/**", "**/.next/**"],
+    });
+    console.log(`${console_chars_1.emoji.file} Checking ${files.length} Server Component files...\n`);
+    for (const file of files) {
+        await analyzeFile(file);
+    }
+    if (issues.length === 0) {
+        console.log(`${console_chars_1.emoji.success} No Server${console_chars_1.chars.arrow}Client Decimal serialization issues found\n`);
+        process.exit(0);
+    }
+    console.log(`${console_chars_1.emoji.error} Found ${issues.length} Server${console_chars_1.chars.arrow}Client Decimal serialization issue(s):\n`);
+    for (const issue of issues) {
+        const relativePath = path.relative(process.cwd(), issue.file);
+        console.log(`  ${console_chars_1.emoji.error} ${relativePath}:${issue.line}`);
+        console.log(`     ${issue.message}`);
+        console.log(`     ${console_chars_1.emoji.hint} ${issue.suggestion}`);
+        if (isVerbose) {
+            console.log(`\n${issue.codeSnippet}\n`);
+        }
+        console.log();
+    }
+    console.log(`${console_chars_1.emoji.wrench} QUICK FIX:`);
+    console.log("   Serialize Decimal fields before passing to Client Components:");
+    console.log("");
+    console.log("   // Before passing to client:");
+    console.log("   const serializedListings = listings.map(item => ({");
+    console.log("     ...item,");
+    console.log("     price: Number(item.price),");
+    console.log("   }));");
+    console.log("");
+    if (isWarn) {
+        console.log(`${console_chars_1.emoji.warning}  SERVER${console_chars_1.chars.arrow}CLIENT DECIMAL CHECK PASSED WITH WARNINGS\n`);
+        process.exit(0);
+    }
+    else {
+        console.log(`${console_chars_1.emoji.error} SERVER${console_chars_1.chars.arrow}CLIENT DECIMAL CHECK FAILED`);
+        console.log("   Fix these issues to prevent runtime crashes.\n");
+        process.exit(1);
+    }
+}
+// Allow direct execution
+if (require.main === module) {
+    run().catch(console.error);
+}
+//# sourceMappingURL=server-client-decimal.js.map

package/dist/checks/runtime/server-client-decimal.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"server-client-decimal.js","sourceRoot":"","sources":["../../../src/checks/runtime/server-client-decimal.ts"],"names":[],"mappings":";;AACA;;;;;;;;;;;;;;;;GAgBG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA0LH,kBA+DC;AAvPD,uCAAyB;AAEzB,2CAA6B;AAC7B,6DAAyD;AACzD,uFAAwF;AACxF,+BAA4B;AAG5B,iBAAiB;AACJ,QAAA,EAAE,GAAG,+BAA+B,CAAC;AACrC,QAAA,IAAI,GAAG,uBAAuB,CAAC;AAC/B,QAAA,QAAQ,GAAG,SAAS,CAAC;AACrB,QAAA,QAAQ,GAAG,IAAI,CAAC;AAChB,QAAA,WAAW,GAAG,0DAA0D,CAAC;AACzE,QAAA,IAAI,GAAG,CAAC,SAAS,CAAC,CAAC;AAUhC,MAAM,MAAM,GAAY,EAAE,CAAC;AAE3B,0DAA0D;AAC1D,MAAM,cAAc,GAAG;IACrB,OAAO;IACP,cAAc;IACd,QAAQ;IACR,OAAO;IACP,UAAU;IACV,KAAK;IACL,MAAM;IACN,KAAK;IACL,UAAU;CACX,CAAC;AAEF,+DAA+D;AAC/D,MAAM,wBAAwB,GAC5B,+EAA+E,CAAC;AAElF,0DAA0D;AAC1D,MAAM,mBAAmB,GACvB,uFAAuF,CAAC;AAE1F,SAAS,cAAc,CAAC,KAAe,EAAE,UAAkB;IACzD,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,UAAU,GAAG,CAAC,CAAC,CAAC;IAC1C,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,EAAE,UAAU,GAAG,CAAC,CAAC,CAAC;IACnD,OAAO,KAAK;SACT,KAAK,CAAC,KAAK,EAAE,GAAG,CAAC;SACjB,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE;QACZ,MAAM,GAAG,GAAG,KAAK,GAAG,CAAC,GAAG,CAAC,CAAC;QAC1B,MAAM,MAAM,GAAG,GAAG,KAAK,UAAU,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC;QAC9C,OAAO,GAAG,MAAM,IAAI,GAAG,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC;IAC1D,CAAC,CAAC;SACD,IAAI,CAAC,IAAI,CAAC,CAAC;AAChB,CAAC;AAED,KAAK,UAAU,WAAW,CAAC,QAAgB;IACzC,MAAM,OAAO,GAAG,EAAE,CAAC,YAAY,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;IACnD,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAElC,gEAAgE;IAChE,IAAI,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAC,EAAE,CAAC;QACzE,OAAO;IACT,CAAC;IAED,qDAAqD;IACrD,MAAM,cAAc,GAAG,mBAAmB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IACzD,IAAI,CAAC,cAAc;QAAE,OAAO;IAE5B,cAAc;IACd,mBAAmB,CAAC,SAAS,GAAG,CAAC,CAAC;IAElC,8EAA8E;IAC9E,iCAAiC;IAEjC,iEAAiE;IACjE,MAAM,oBAAoB,GACxB,2EAA2E,CAAC;IAC9E,IAAI,KAAK,CAAC;IAEV,OAAO,CAAC,KAAK,GAAG,oBAAoB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;QAC7D,MAAM,CAAC,SAAS,EAAE,aAAa,EAAE,QAAQ,EAAE,OAAO,CAAC,GAAG,KAAK,CAAC;QAC5D,MAAM,UAAU,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC;QAExE,qDAAqD;QACrD,+EAA+E;QAC/E,0CAA0C;QAE1C,MAAM,WAAW,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC;QACtD,MAAM,YAAY,GAAG,OAAO,CAAC,SAAS,CACpC,OAAO,CAAC,WAAW,CAAC,OAAO,EAAE,KAAK,CAAC,KAAK,CAAC,GAAG,GAAG,EAC/C,KAAK,CAAC,KAAK,CACZ,CAAC;QAEF,2CAA2C;QAC3C,MAAM,mBAAmB,GAAG,YAAY,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,YAAY,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;QAC/F,MAAM,WAAW,GAAG,YAAY,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAC;QACzD,MAAM,YAAY,GAAG,+BAA+B,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;QACxE,MAAM,eAAe,GAAG,+BAA+B,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;QAE3E,8FAA8F;QAC9F,MAAM,0BAA0B,GAAG,IAAI,MAAM,CAAC,GAAG,OAAO,mBAAmB,EAAE,GAAG,CAAC,CAAC;QAClF,MAAM,sBAAsB,GAAG,0BAA0B,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAExE,sFAAsF;QACtF,MAAM,yBAAyB,GAAG,8CAA8C,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAE/F,kEAAkE;QAClE,MAAM,uBAAuB,GAC3B,+DAA+D,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAEhF,sDAAsD;QACtD,IACE,CAAC,mBAAmB;YACpB,CAAC,WAAW;YACZ,CAAC,YAAY;YACb,CAAC,eAAe;YAChB,CAAC,sBAAsB;YACvB,CAAC,yBAAyB;YAC1B,CAAC,uBAAuB,EACxB,CAAC;YACD,2DAA2D;YAC3D,MAAM,cAAc,GAAG,IAAI,MAAM,CAC/B,kCAAkC,OAAO,eAAe,OAAO,yCAAyC,EACxG,GAAG,CACJ,CAAC;YAEF,IAAI,cAAc,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;gBACjC,MAAM,CAAC,IAAI,CAAC;oBACV,IAAI,EAAE,QAAQ;oBACd,IAAI,EAAE,UAAU;oBAChB,OAAO,EAAE,YAAY,OAAO,kCAAkC,aAAa,yBAAyB;oBACpG,UAAU,EAAE,6BAA6B,OAAO,wDAAwD;oBACxG,WAAW,EAAE,cAAc,CAAC,KAAK,EAAE,UAAU,CAAC;iBAC/C,CAAC,CAAC;YACL,CAAC;QACH,CAAC;IACH,CAAC;IAED,kFAAkF;IAClF,6DAA6D;IAC7D,MAAM,oBAAoB,GAAG,2CAA2C,CAAC;IAEzE,OAAO,CAAC,KAAK,GAAG,oBAAoB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;QAC7D,MAAM,CAAC,SAAS,EAAE,OAAO,CAAC,GAAG,KAAK,CAAC;QACnC,MAAM,UAAU,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC;QAExE,yEAAyE;QACzE,MAAM,cAAc,GAAG,OAAO,CAAC,WAAW,CAAC,SAAS,OAAO,EAAE,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC;QAC5E,IAAI,cAAc,KAAK,CAAC,CAAC;YAAE,SAAS;QAEpC,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,CAAC,cAAc,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC;QAEjE,sDAAsD;QACtD,MAAM,WAAW,GAAG,oCAAoC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QACzE,IAAI,CAAC,WAAW;YAAE,SAAS;QAE3B,+DAA+D;QAC/D,MAAM,aAAa,GAAG,0CAA0C,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QACjF,IAAI,aAAa;YAAE,SAAS;QAE5B,0FAA0F;QAC1F,gGAAgG;QAChG,MAAM,mBAAmB,GAAG,mBAAmB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAC9D,IAAI,mBAAmB;YAAE,SAAS;QAElC,uCAAuC;QACvC,MAAM,iBAAiB,GAAG,iBAAiB,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QAC5D,IAAI,iBAAiB;YAAE,SAAS;QAEhC,MAAM,CAAC,IAAI,CAAC;YACV,IAAI,EAAE,QAAQ;YACd,IAAI,EAAE,UAAU;YAChB,OAAO,EAAE,sGAAsG;YAC/G,UAAU,EAAE,wDAAwD;YACpE,WAAW,EAAE,cAAc,CAAC,KAAK,EAAE,UAAU,CAAC;SAC/C,CAAC,CAAC;IACL,CAAC;AACH,CAAC;AAEM,KAAK,UAAU,GAAG;IACvB,MAAM,QAAQ,GAAG,IAAA,6DAA+B,EAAC,YAAI,CAAC,CAAC;IACvD,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IACnC,MAAM,MAAM,GAAG,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;IACvC,MAAM,SAAS,GAAG,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IAE7C,OAAO,CAAC,GAAG,CAAC,KAAK,qBAAK,CAAC,MAAM,UAAU,qBAAK,CAAC,KAAK,oCAAoC,CAAC,CAAC;IACxF,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC;IAE5B,4CAA4C;IAC5C,MAAM,KAAK,GAAG,MAAM,IAAA,WAAI,EAAC,CAAC,iBAAiB,EAAE,mBAAmB,CAAC,EAAE;QACjE,MAAM,EAAE,CAAC,oBAAoB,EAAE,aAAa,CAAC;KAC9C,CAAC,CAAC;IAEH,OAAO,CAAC,GAAG,CAAC,GAAG,qBAAK,CAAC,IAAI,aAAa,KAAK,CAAC,MAAM,8BAA8B,CAAC,CAAC;IAElF,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,WAAW,CAAC,IAAI,CAAC,CAAC;IAC1B,CAAC;IAED,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACxB,OAAO,CAAC,GAAG,CACT,GAAG,qBAAK,CAAC,OAAO,aAAa,qBAAK,CAAC,KAAK,6CAA6C,CACtF,CAAC;QACF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,OAAO,CAAC,GAAG,CACT,GAAG,qBAAK,CAAC,KAAK,UAAU,MAAM,CAAC,MAAM,UAAU,qBAAK,CAAC,KAAK,0CAA0C,CACrG,CAAC;IAEF,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,MAAM,YAAY,GAAG,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;QAC9D,OAAO,CAAC,GAAG,CAAC,KAAK,qBAAK,CAAC,KAAK,IAAI,YAAY,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;QAC9D,OAAO,CAAC,GAAG,CAAC,QAAQ,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;QACrC,OAAO,CAAC,GAAG,CAAC,QAAQ,qBAAK,CAAC,IAAI,IAAI,KAAK,CAAC,UAAU,EAAE,CAAC,CAAC;QAEtD,IAAI,SAAS,EAAE,CAAC;YACd,OAAO,CAAC,GAAG,CAAC,KAAK,KAAK,CAAC,WAAW,IAAI,CAAC,CAAC;QAC1C,CAAC;QACD,OAAO,CAAC,GAAG,EAAE,CAAC;IAChB,CAAC;IAED,OAAO,CAAC,GAAG,CAAC,GAAG,qBAAK,CAAC,MAAM,aAAa,CAAC,CAAC;IAC1C,OAAO,CAAC,GAAG,CAAC,kEAAkE,CAAC,CAAC;IAChF,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAChB,OAAO,CAAC,GAAG,CAAC,iCAAiC,CAAC,CAAC;IAC/C,OAAO,CAAC,GAAG,CAAC,uDAAuD,CAAC,CAAC;IACrE,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;IAC7B,OAAO,CAAC,GAAG,CAAC,iCAAiC,CAAC,CAAC;IAC/C,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;IACvB,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAEhB,IAAI,MAAM,EAAE,CAAC;QACX,OAAO,CAAC,GAAG,CACT,GAAG,qBAAK,CAAC,OAAO,WAAW,qBAAK,CAAC,KAAK,6CAA6C,CACpF,CAAC;QACF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;SAAM,CAAC;QACN,OAAO,CAAC,GAAG,CAAC,GAAG,qBAAK,CAAC,KAAK,UAAU,qBAAK,CAAC,KAAK,6BAA6B,CAAC,CAAC;QAC9E,OAAO,CAAC,GAAG,CAAC,mDAAmD,CAAC,CAAC;QACjE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;AACH,CAAC;AAGD,yBAAyB;AACzB,IAAI,OAAO,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;IAC5B,GAAG,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;AAC7B,CAAC"}

package/dist/checks/security/client-external-api-calls.d.ts

@@ -0,0 +1,25 @@
+#!/usr/bin/env tsx
+/**
+ * Client-Side External API Calls Preflight
+ *
+ * Detects client-side code that makes direct fetch/axios calls to external APIs.
+ * External API calls from the browser are blocked by CSP and should go through
+ * server-side API routes instead.
+ *
+ * Pattern detected:
+ * - fetch() calls to external URLs in "use client" components
+ * - Direct API calls to third-party services (WooCommerce, eBay, etc.)
+ *
+ * Fix: Create a server-side API route to proxy the request.
+ *
+ * Usage:
+ *   pnpm preflight:client-external-api-calls
+ */
+export declare const id = "security/client-external-api-calls";
+export declare const name = "Client External API Calls";
+export declare const category = "security";
+export declare const blocking = true;
+export declare const description = "Detects client-side code making direct calls to external APIs";
+export declare const tags: string[];
+export declare function run(): Promise<void>;
+//# sourceMappingURL=client-external-api-calls.d.ts.map

package/dist/checks/security/client-external-api-calls.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"client-external-api-calls.d.ts","sourceRoot":"","sources":["../../../src/checks/security/client-external-api-calls.ts"],"names":[],"mappings":";AACA;;;;;;;;;;;;;;;GAeG;AASH,eAAO,MAAM,EAAE,uCAAuC,CAAC;AACvD,eAAO,MAAM,IAAI,8BAA8B,CAAC;AAChD,eAAO,MAAM,QAAQ,aAAa,CAAC;AACnC,eAAO,MAAM,QAAQ,OAAO,CAAC;AAC7B,eAAO,MAAM,WAAW,kEAAkE,CAAC;AAC3F,eAAO,MAAM,IAAI,UAAuC,CAAC;AAoHzD,wBAAsB,GAAG,IAAI,OAAO,CAAC,IAAI,CAAC,CAkDzC"}

package/dist/checks/security/client-external-api-calls.js

@@ -0,0 +1,206 @@
+#!/usr/bin/env tsx
+"use strict";
+/**
+ * Client-Side External API Calls Preflight
+ *
+ * Detects client-side code that makes direct fetch/axios calls to external APIs.
+ * External API calls from the browser are blocked by CSP and should go through
+ * server-side API routes instead.
+ *
+ * Pattern detected:
+ * - fetch() calls to external URLs in "use client" components
+ * - Direct API calls to third-party services (WooCommerce, eBay, etc.)
+ *
+ * Fix: Create a server-side API route to proxy the request.
+ *
+ * Usage:
+ *   pnpm preflight:client-external-api-calls
+ */
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.tags = exports.description = exports.blocking = exports.category = exports.name = exports.id = void 0;
+exports.run = run;
+const fs = __importStar(require("fs"));
+const path = __importStar(require("path"));
+const file_cache_1 = require("../../shared/file-cache");
+const console_chars_1 = require("../../utils/console-chars");
+const universal_progress_reporter_1 = require("../system/universal-progress-reporter");
+// Check metadata
+exports.id = "security/client-external-api-calls";
+exports.name = "Client External API Calls";
+exports.category = "security";
+exports.blocking = true;
+exports.description = "Detects client-side code making direct calls to external APIs";
+exports.tags = ["security", "csp", "api", "client"];
+// External API patterns that should NOT be called directly from client
+const EXTERNAL_API_PATTERNS = [
+    // WooCommerce
+    /wp-json\/wc\/v[0-9]+/,
+    // WordPress REST API
+    /wp-json\/wp\/v[0-9]+/,
+    // Generic external API indicators
+    /\.com\/api\//,
+    /\.io\/api\//,
+    // Specific third-party APIs that need proxying
+    /api\.ebay\.com/,
+    /api\.tcgplayer\.com/,
+    /api\.amazon\.com/,
+    /api\.stripe\.com/,
+    /api\.paypal\.com/,
+];
+// Allowed patterns (our own API routes)
+const ALLOWED_PATTERNS = [
+    /^\/api\//,
+    /^api\//,
+    /`\/api\//,
+    /"\/api\//,
+    /'\/api\//,
+];
+// Files/directories to exclude
+const EXCLUDE_PATTERNS = [
+    "**/node_modules/**",
+    "**/*.test.ts",
+    "**/*.test.tsx",
+    "**/*.spec.ts",
+    "**/*.spec.tsx",
+    "**/tests/**",
+    "**/scripts/**",
+    "**/docs/**",
+    "**/*.d.ts",
+    "**/lib/integrations/**", // Server-side integration code is allowed
+    "**/app/api/**", // API routes are server-side
+];
+function isClientComponent(content) {
+    // Check for "use client" directive at the start of the file
+    const firstLines = content.slice(0, 500);
+    return /"use client"|'use client'/.test(firstLines);
+}
+function findExternalApiCalls(filePath, content) {
+    const issues = [];
+    const lines = content.split("\n");
+    // Only check client components
+    if (!isClientComponent(content)) {
+        return issues;
+    }
+    lines.forEach((line, index) => {
+        const lineNum = index + 1;
+        // Skip comments
+        if (line.trim().startsWith("//") || line.trim().startsWith("*")) {
+            return;
+        }
+        // Check for fetch calls
+        if (/fetch\s*\(/.test(line)) {
+            // Check if it's calling an external API
+            for (const pattern of EXTERNAL_API_PATTERNS) {
+                if (pattern.test(line)) {
+                    // Make sure it's not using our own API
+                    const isAllowed = ALLOWED_PATTERNS.some((allowed) => allowed.test(line));
+                    if (!isAllowed) {
+                        issues.push({
+                            file: filePath,
+                            line: lineNum,
+                            message: "Client-side fetch to external API detected. Use a server-side API route instead.",
+                            code: "CLIENT_EXTERNAL_FETCH",
+                            snippet: line.trim().slice(0, 100),
+                        });
+                    }
+                }
+            }
+        }
+        // Check for axios calls to external URLs
+        if (/axios\.(get|post|put|delete|patch)\s*\(/.test(line)) {
+            for (const pattern of EXTERNAL_API_PATTERNS) {
+                if (pattern.test(line)) {
+                    const isAllowed = ALLOWED_PATTERNS.some((allowed) => allowed.test(line));
+                    if (!isAllowed) {
+                        issues.push({
+                            file: filePath,
+                            line: lineNum,
+                            message: "Client-side axios call to external API detected. Use a server-side API route instead.",
+                            code: "CLIENT_EXTERNAL_AXIOS",
+                            snippet: line.trim().slice(0, 100),
+                        });
+                    }
+                }
+            }
+        }
+    });
+    return issues;
+}
+async function run() {
+    const reporter = (0, universal_progress_reporter_1.createUniversalProgressReporter)(exports.name);
+    const verbose = process.argv.includes("--verbose") || process.argv.includes("-v");
+    console.log(`\n${console_chars_1.emoji.search} Client External API Calls Check\n`);
+    console.log("Checking for client-side external API calls...\n");
+    const files = await file_cache_1.fileCache.getAllTsTsx();
+    const allIssues = [];
+    for (const file of files) {
+        const filePath = path.join(process.cwd(), file);
+        const content = fs.readFileSync(filePath, "utf-8");
+        const issues = findExternalApiCalls(file, content);
+        allIssues.push(...issues);
+    }
+    console.log((0, console_chars_1.createDivider)(70, "light"));
+    if (allIssues.length === 0) {
+        console.log(`\n${console_chars_1.emoji.success} No client-side external API calls detected\n`);
+        console.log("All external API calls are properly routed through server-side API routes.\n");
+        process.exit(0);
+    }
+    console.log(`\n${console_chars_1.emoji.error} Found ${allIssues.length} client-side external API call(s):\n`);
+    const toShow = verbose ? allIssues : allIssues.slice(0, 10);
+    toShow.forEach((issue, i) => {
+        console.log(`${i + 1}. ${issue.file}:${issue.line}`);
+        console.log(`   ${issue.message}`);
+        console.log(`   Code: ${issue.snippet}`);
+        console.log();
+    });
+    if (!verbose && allIssues.length > 10) {
+        console.log(`  ... and ${allIssues.length - 10} more issues\n`);
+    }
+    console.log((0, console_chars_1.createDivider)(70, "light"));
+    console.log(`\n${console_chars_1.emoji.hint} How to fix:\n`);
+    console.log("   1. Create a server-side API route in app/api/");
+    console.log("   2. Proxy the external API call through your route");
+    console.log("   3. Update the client to call your API route instead\n");
+    console.log("   Why: Browser CSP blocks direct calls to external APIs.");
+    console.log("   Server-side routes bypass CSP and keep credentials secure.\n");
+    console.log(`${console_chars_1.emoji.error} Client External API Calls check FAILED\n`);
+    process.exit(1);
+}
+// Allow direct execution
+if (require.main === module) {
+    run().catch(console.error);
+}
+//# sourceMappingURL=client-external-api-calls.js.map

package/dist/checks/security/client-external-api-calls.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"client-external-api-calls.js","sourceRoot":"","sources":["../../../src/checks/security/client-external-api-calls.ts"],"names":[],"mappings":";;AACA;;;;;;;;;;;;;;;GAeG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAkIH,kBAkDC;AAlLD,uCAAyB;AACzB,2CAA6B;AAC7B,wDAAoD;AACpD,6DAAiE;AACjE,uFAAwF;AAExF,iBAAiB;AACJ,QAAA,EAAE,GAAG,oCAAoC,CAAC;AAC1C,QAAA,IAAI,GAAG,2BAA2B,CAAC;AACnC,QAAA,QAAQ,GAAG,UAAU,CAAC;AACtB,QAAA,QAAQ,GAAG,IAAI,CAAC;AAChB,QAAA,WAAW,GAAG,+DAA+D,CAAC;AAC9E,QAAA,IAAI,GAAG,CAAC,UAAU,EAAE,KAAK,EAAE,KAAK,EAAE,QAAQ,CAAC,CAAC;AAUzD,uEAAuE;AACvE,MAAM,qBAAqB,GAAG;IAC5B,cAAc;IACd,sBAAsB;IACtB,qBAAqB;IACrB,sBAAsB;IACtB,kCAAkC;IAClC,cAAc;IACd,aAAa;IACb,+CAA+C;IAC/C,gBAAgB;IAChB,qBAAqB;IACrB,kBAAkB;IAClB,kBAAkB;IAClB,kBAAkB;CACnB,CAAC;AAEF,wCAAwC;AACxC,MAAM,gBAAgB,GAAG;IACvB,UAAU;IACV,QAAQ;IACR,UAAU;IACV,UAAU;IACV,UAAU;CACX,CAAC;AAEF,+BAA+B;AAC/B,MAAM,gBAAgB,GAAG;IACvB,oBAAoB;IACpB,cAAc;IACd,eAAe;IACf,cAAc;IACd,eAAe;IACf,aAAa;IACb,eAAe;IACf,YAAY;IACZ,WAAW;IACX,wBAAwB,EAAE,0CAA0C;IACpE,eAAe,EAAE,6BAA6B;CAC/C,CAAC;AAEF,SAAS,iBAAiB,CAAC,OAAe;IACxC,4DAA4D;IAC5D,MAAM,UAAU,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;IACzC,OAAO,2BAA2B,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;AACtD,CAAC;AAED,SAAS,oBAAoB,CAAC,QAAgB,EAAE,OAAe;IAC7D,MAAM,MAAM,GAAY,EAAE,CAAC;IAC3B,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAElC,+BAA+B;IAC/B,IAAI,CAAC,iBAAiB,CAAC,OAAO,CAAC,EAAE,CAAC;QAChC,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE;QAC5B,MAAM,OAAO,GAAG,KAAK,GAAG,CAAC,CAAC;QAE1B,gBAAgB;QAChB,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;YAChE,OAAO;QACT,CAAC;QAED,wBAAwB;QACxB,IAAI,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YAC5B,wCAAwC;YACxC,KAAK,MAAM,OAAO,IAAI,qBAAqB,EAAE,CAAC;gBAC5C,IAAI,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;oBACvB,uCAAuC;oBACvC,MAAM,SAAS,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;oBACzE,IAAI,CAAC,SAAS,EAAE,CAAC;wBACf,MAAM,CAAC,IAAI,CAAC;4BACV,IAAI,EAAE,QAAQ;4BACd,IAAI,EAAE,OAAO;4BACb,OAAO,EAAE,kFAAkF;4BAC3F,IAAI,EAAE,uBAAuB;4BAC7B,OAAO,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC;yBACnC,CAAC,CAAC;oBACL,CAAC;gBACH,CAAC;YACH,CAAC;QACH,CAAC;QAED,yCAAyC;QACzC,IAAI,yCAAyC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YACzD,KAAK,MAAM,OAAO,IAAI,qBAAqB,EAAE,CAAC;gBAC5C,IAAI,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;oBACvB,MAAM,SAAS,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;oBACzE,IAAI,CAAC,SAAS,EAAE,CAAC;wBACf,MAAM,CAAC,IAAI,CAAC;4BACV,IAAI,EAAE,QAAQ;4BACd,IAAI,EAAE,OAAO;4BACb,OAAO,EAAE,uFAAuF;4BAChG,IAAI,EAAE,uBAAuB;4BAC7B,OAAO,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC;yBACnC,CAAC,CAAC;oBACL,CAAC;gBACH,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,OAAO,MAAM,CAAC;AAChB,CAAC;AAEM,KAAK,UAAU,GAAG;IACvB,MAAM,QAAQ,GAAG,IAAA,6DAA+B,EAAC,YAAI,CAAC,CAAC;IACvD,MAAM,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,IAAI,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;IAElF,OAAO,CAAC,GAAG,CAAC,KAAK,qBAAK,CAAC,MAAM,oCAAoC,CAAC,CAAC;IACnE,OAAO,CAAC,GAAG,CAAC,kDAAkD,CAAC,CAAC;IAEhE,MAAM,KAAK,GAAG,MAAM,sBAAS,CAAC,WAAW,EAAE,CAAC;IAE5C,MAAM,SAAS,GAAY,EAAE,CAAC;IAE9B,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,IAAI,CAAC,CAAC;QAChD,MAAM,OAAO,GAAG,EAAE,CAAC,YAAY,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;QACnD,MAAM,MAAM,GAAG,oBAAoB,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;QACnD,SAAS,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,CAAC;IAC5B,CAAC;IAED,OAAO,CAAC,GAAG,CAAC,IAAA,6BAAa,EAAC,EAAE,EAAE,OAAO,CAAC,CAAC,CAAC;IAExC,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC3B,OAAO,CAAC,GAAG,CAAC,KAAK,qBAAK,CAAC,OAAO,+CAA+C,CAAC,CAAC;QAC/E,OAAO,CAAC,GAAG,CAAC,8EAA8E,CAAC,CAAC;QAC5F,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,OAAO,CAAC,GAAG,CAAC,KAAK,qBAAK,CAAC,KAAK,UAAU,SAAS,CAAC,MAAM,sCAAsC,CAAC,CAAC;IAE9F,MAAM,MAAM,GAAG,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IAC5D,MAAM,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,CAAC,EAAE,EAAE;QAC1B,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,KAAK,CAAC,IAAI,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;QACrD,OAAO,CAAC,GAAG,CAAC,MAAM,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;QACnC,OAAO,CAAC,GAAG,CAAC,YAAY,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;QACzC,OAAO,CAAC,GAAG,EAAE,CAAC;IAChB,CAAC,CAAC,CAAC;IAEH,IAAI,CAAC,OAAO,IAAI,SAAS,CAAC,MAAM,GAAG,EAAE,EAAE,CAAC;QACtC,OAAO,CAAC,GAAG,CAAC,aAAa,SAAS,CAAC,MAAM,GAAG,EAAE,gBAAgB,CAAC,CAAC;IAClE,CAAC;IAED,OAAO,CAAC,GAAG,CAAC,IAAA,6BAAa,EAAC,EAAE,EAAE,OAAO,CAAC,CAAC,CAAC;IACxC,OAAO,CAAC,GAAG,CAAC,KAAK,qBAAK,CAAC,IAAI,gBAAgB,CAAC,CAAC;IAC7C,OAAO,CAAC,GAAG,CAAC,kDAAkD,CAAC,CAAC;IAChE,OAAO,CAAC,GAAG,CAAC,sDAAsD,CAAC,CAAC;IACpE,OAAO,CAAC,GAAG,CAAC,0DAA0D,CAAC,CAAC;IACxE,OAAO,CAAC,GAAG,CAAC,2DAA2D,CAAC,CAAC;IACzE,OAAO,CAAC,GAAG,CAAC,iEAAiE,CAAC,CAAC;IAE/E,OAAO,CAAC,GAAG,CAAC,GAAG,qBAAK,CAAC,KAAK,2CAA2C,CAAC,CAAC;IACvE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC;AAGD,yBAAyB;AACzB,IAAI,OAAO,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;IAC5B,GAAG,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;AAC7B,CAAC"}

package/dist/checks/security/csrf-protection.d.ts

@@ -0,0 +1,20 @@
+#!/usr/bin/env tsx
+/**
+ * CSRF Protection Validation Preflight (BLOCKING)
+ *
+ * Ensures state-changing API routes have CSRF protection:
+ * - POST/PUT/PATCH/DELETE routes should validate origin/referer
+ * - Forms should use CSRF tokens or SameSite cookies
+ * - Mutation endpoints should not rely solely on cookies
+ *
+ * Usage:
+ *   pnpm preflight:csrf-protection
+ *   pnpm preflight:csrf-protection:verbose
+ */
+export declare const id = "security/csrf-protection";
+export declare const name = "Csrf Protection";
+export declare const category = "security";
+export declare const blocking = true;
+export declare const description = "CSRF Protection Validation Preflight (BLOCKING)";
+export declare const tags: string[];
+//# sourceMappingURL=csrf-protection.d.ts.map

package/dist/checks/security/csrf-protection.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"csrf-protection.d.ts","sourceRoot":"","sources":["../../../src/checks/security/csrf-protection.ts"],"names":[],"mappings":";AACA;;;;;;;;;;;GAWG;AAUH,eAAO,MAAM,EAAE,6BAA6B,CAAC;AAC7C,eAAO,MAAM,IAAI,oBAAoB,CAAC;AACtC,eAAO,MAAM,QAAQ,aAAa,CAAC;AACnC,eAAO,MAAM,QAAQ,OAAO,CAAC;AAC7B,eAAO,MAAM,WAAW,oDAAoD,CAAC;AAC7E,eAAO,MAAM,IAAI,UAAe,CAAC"}