@fourteensystems/prodcheck 0.3.0

package/dist/rules/wrapper-unrecognized.js

@@ -0,0 +1,81 @@
+export const RULE_ID = "WRAPPER-UNRECOGNIZED";
+const SEVERITY_RANK = { critical: 4, high: 3, med: 2, low: 1 };
+function capSeverity(computed, max) {
+    const maxRank = SEVERITY_RANK[max] ?? 4;
+    const computedRank = SEVERITY_RANK[computed] ?? 2;
+    return computedRank > maxRank ? max : computed;
+}
+export function run(index, config) {
+    const findings = [];
+    const maxSeverity = config.rules[RULE_ID]?.severity ?? "high";
+    for (const [name, wrapper] of index.wrappers.wrappers) {
+        // Skip fully resolved wrappers where both auth AND rate-limit are enforced
+        if (wrapper.resolved && wrapper.evidence.authEnforced && wrapper.evidence.rateLimitEnforced) {
+            continue;
+        }
+        // Determine what this wrapper WOULD have triggered
+        const wouldTrigger = [];
+        // Check if any wrapped routes are mutation routes (need auth)
+        const mutationFileSet = new Set(index.routes.mutationRoutes.map((r) => r.file));
+        const wrappedMutationFiles = wrapper.usageFiles.filter((f) => mutationFileSet.has(f));
+        if (wrappedMutationFiles.length > 0) {
+            if (!wrapper.resolved || !wrapper.evidence.authEnforced) {
+                wouldTrigger.push("AUTH-BOUNDARY-MISSING");
+            }
+        }
+        // Check if any wrapped routes are API routes (need rate limiting)
+        // Exclude routes that are already exempt from rate-limit (cron, webhook, etc.)
+        const apiFileSet = new Set(index.routes.all.filter((r) => r.isApi).map((r) => r.file));
+        const wrappedApiFiles = wrapper.usageFiles.filter((f) => apiFileSet.has(f) && !isRateLimitExemptPath(f));
+        if (wrappedApiFiles.length > 0) {
+            if (!wrapper.resolved || !wrapper.evidence.rateLimitEnforced) {
+                wouldTrigger.push("RATE-LIMIT-MISSING");
+            }
+        }
+        if (wouldTrigger.length === 0)
+            continue;
+        // Severity = high if wrapping mutation routes, med otherwise
+        const computedSeverity = wrappedMutationFiles.length > 0 ? "high" : "med";
+        const status = !wrapper.resolved
+            ? "could not be resolved"
+            : wrapper.evidence.authCallPresent && !wrapper.evidence.authEnforced
+                ? "calls auth but enforcement not proven"
+                : wrapper.evidence.rateLimitCallPresent && !wrapper.evidence.rateLimitEnforced
+                    ? "calls rate limiter but enforcement not proven"
+                    : "missing protections";
+        const evidence = [
+            `${name}() wraps ${wrapper.usageCount} route handler(s) (${wrapper.mutationRouteCount} mutation)`,
+            `Would have triggered: ${wouldTrigger.join(", ")}`,
+            `Top routes: ${wrapper.usageFiles.slice(0, 5).join(", ")}${wrapper.usageCount > 5 ? ` (+${wrapper.usageCount - 5} more)` : ""}`,
+        ];
+        if (wrapper.evidence.authCallPresent) {
+            evidence.push(`Auth call detected: ${wrapper.evidence.authDetails.join(", ")}`);
+        }
+        if (wrapper.evidence.rateLimitCallPresent) {
+            evidence.push(`Rate-limit call detected: ${wrapper.evidence.rateLimitDetails.join(", ")}`);
+        }
+        findings.push({
+            ruleId: RULE_ID,
+            severity: capSeverity(computedSeverity, maxSeverity),
+            confidence: "high",
+            message: `Wrapper "${name}" wraps ${wrapper.usageCount} handler(s); ${status}`,
+            file: wrapper.usageFiles[0],
+            evidence,
+            confidenceRationale: "High: wrapper usage is certain, but protection cannot be verified",
+            remediation: [
+                `If ${name} enforces auth: add "${name}" to hints.auth.functions`,
+                `If ${name} enforces rate limiting: add "${name}" to hints.rateLimit.wrappers`,
+                ...(wrapper.definitionFile
+                    ? [`Verify wrapper implementation at ${wrapper.definitionFile}`]
+                    : [`Wrapper definition could not be found — check import paths`]),
+            ],
+            tags: ["wrapper", "config"],
+        });
+    }
+    return findings;
+}
+/** Paths exempt from rate-limit — mirrors EXEMPT_PATH_PATTERNS + WEBHOOK patterns in rate-limit-missing. */
+function isRateLimitExemptPath(file) {
+    return /\/cron\//.test(file) || /webhook/i.test(file) || /\/tasks\//.test(file);
+}
+//# sourceMappingURL=wrapper-unrecognized.js.map

package/dist/rules/wrapper-unrecognized.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"wrapper-unrecognized.js","sourceRoot":"","sources":["../../src/rules/wrapper-unrecognized.ts"],"names":[],"mappings":"AAIA,MAAM,CAAC,MAAM,OAAO,GAAG,sBAAsB,CAAC;AAE9C,MAAM,aAAa,GAA2B,EAAE,QAAQ,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,GAAG,EAAE,CAAC,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC;AAEvF,SAAS,WAAW,CAAC,QAAkB,EAAE,GAAW;IAClD,MAAM,OAAO,GAAG,aAAa,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IACxC,MAAM,YAAY,GAAG,aAAa,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;IAClD,OAAO,YAAY,GAAG,OAAO,CAAC,CAAC,CAAE,GAAgB,CAAC,CAAC,CAAC,QAAQ,CAAC;AAC/D,CAAC;AAED,MAAM,UAAU,GAAG,CAAC,KAAgB,EAAE,MAAuB;IAC3D,MAAM,QAAQ,GAAc,EAAE,CAAC;IAC/B,MAAM,WAAW,GAAG,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,QAAQ,IAAI,MAAM,CAAC;IAE9D,KAAK,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,QAAQ,EAAE,CAAC;QACtD,2EAA2E;QAC3E,IAAI,OAAO,CAAC,QAAQ,IAAI,OAAO,CAAC,QAAQ,CAAC,YAAY,IAAI,OAAO,CAAC,QAAQ,CAAC,iBAAiB,EAAE,CAAC;YAC5F,SAAS;QACX,CAAC;QAED,mDAAmD;QACnD,MAAM,YAAY,GAAa,EAAE,CAAC;QAElC,8DAA8D;QAC9D,MAAM,eAAe,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;QAChF,MAAM,oBAAoB,GAAG,OAAO,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;QAEtF,IAAI,oBAAoB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACpC,IAAI,CAAC,OAAO,CAAC,QAAQ,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,YAAY,EAAE,CAAC;gBACxD,YAAY,CAAC,IAAI,CAAC,uBAAuB,CAAC,CAAC;YAC7C,CAAC;QACH,CAAC;QAED,kEAAkE;QAClE,+EAA+E;QAC/E,MAAM,UAAU,GAAG,IAAI,GAAG,CACxB,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAC3D,CAAC;QACF,MAAM,eAAe,GAAG,OAAO,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CACtD,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,qBAAqB,CAAC,CAAC,CAAC,CAC/C,CAAC;QAEF,IAAI,eAAe,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC/B,IAAI,CAAC,OAAO,CAAC,QAAQ,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,iBAAiB,EAAE,CAAC;gBAC7D,YAAY,CAAC,IAAI,CAAC,oBAAoB,CAAC,CAAC;YAC1C,CAAC;QACH,CAAC;QAED,IAAI,YAAY,CAAC,MAAM,KAAK,CAAC;YAAE,SAAS;QAExC,6DAA6D;QAC7D,MAAM,gBAAgB,GAAa,oBAAoB,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC;QAEpF,MAAM,MAAM,GAAG,CAAC,OAAO,CAAC,QAAQ;YAC9B,CAAC,CAAC,uBAAuB;YACzB,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,eAAe,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,YAAY;gBAClE,CAAC,CAAC,uCAAuC;gBACzC,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,oBAAoB,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,iBAAiB;oBAC5E,CAAC,CAAC,+CAA+C;oBACjD,CAAC,CAAC,qBAAqB,CAAC;QAE9B,MAAM,QAAQ,GAAa;YACzB,GAAG,IAAI,YAAY,OAAO,CAAC,UAAU,sBAAsB,OAAO,CAAC,kBAAkB,YAAY;YACjG,yBAAyB,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;YAClD,eAAe,OAAO,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,OAAO,CAAC,UAAU,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,OAAO,CAAC,UAAU,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,EAAE;SAChI,CAAC;QAEF,IAAI,OAAO,CAAC,QAAQ,CAAC,eAAe,EAAE,CAAC;YACrC,QAAQ,CAAC,IAAI,CAAC,uBAAuB,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAClF,CAAC;QACD,IAAI,OAAO,CAAC,QAAQ,CAAC,oBAAoB,EAAE,CAAC;YAC1C,QAAQ,CAAC,IAAI,CAAC,6BAA6B,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAC7F,CAAC;QAED,QAAQ,CAAC,IAAI,CAAC;YACZ,MAAM,EAAE,OAAO;YACf,QAAQ,EAAE,WAAW,CAAC,gBAAgB,EAAE,WAAW,CAAC;YACpD,UAAU,EAAE,MAAM;YAClB,OAAO,EAAE,YAAY,IAAI,WAAW,OAAO,CAAC,UAAU,gBAAgB,MAAM,EAAE;YAC9E,IAAI,EAAE,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC;YAC3B,QAAQ;YACR,mBAAmB,EAAE,mEAAmE;YACxF,WAAW,EAAE;gBACX,MAAM,IAAI,wBAAwB,IAAI,2BAA2B;gBACjE,MAAM,IAAI,iCAAiC,IAAI,+BAA+B;gBAC9E,GAAG,CAAC,OAAO,CAAC,cAAc;oBACxB,CAAC,CAAC,CAAC,oCAAoC,OAAO,CAAC,cAAc,EAAE,CAAC;oBAChE,CAAC,CAAC,CAAC,4DAA4D,CAAC,CAAC;aACpE;YACD,IAAI,EAAE,CAAC,SAAS,EAAE,QAAQ,CAAC;SAC5B,CAAC,CAAC;IACL,CAAC;IAED,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,4GAA4G;AAC5G,SAAS,qBAAqB,CAAC,IAAY;IACzC,OAAO,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAClF,CAAC"}

package/dist/util/hof.d.ts

@@ -0,0 +1,22 @@
+/**
+ * Shared Higher-Order Function (HOF) detection utilities.
+ * Used by wrapper analysis and rules.
+ */
+/**
+ * Extract the ordered chain of HOF wrapper names from route source.
+ * E.g., `export const POST = withWorkspace(withErrorBoundary(handler))` → ["withWorkspace", "withErrorBoundary"]
+ * E.g., `export default withAuth(handler)` → ["withAuth"]
+ * Returns empty array if no HOF wrapper detected.
+ */
+export declare function extractHofWrapperChain(src: string): string[];
+/**
+ * Check if route source is exported via a specific known function (HOF pattern).
+ * E.g., `export const POST = withAuth(handler)` with functionName="withAuth" → true
+ */
+export declare function isWrappedByFunction(src: string, functionName: string): boolean;
+/**
+ * Find the import source for a given identifier in the source.
+ * Returns the module specifier or undefined if not imported (same-file definition).
+ */
+export declare function findImportSource(src: string, identifierName: string): string | undefined;
+//# sourceMappingURL=hof.d.ts.map

package/dist/util/hof.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"hof.d.ts","sourceRoot":"","sources":["../../src/util/hof.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAIH;;;;;GAKG;AACH,wBAAgB,sBAAsB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,EAAE,CAsB5D;AA2CD;;;GAGG;AACH,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,GAAG,OAAO,CAY9E;AAED;;;GAGG;AACH,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAoBxF"}

package/dist/util/hof.js

@@ -0,0 +1,99 @@
+/**
+ * Shared Higher-Order Function (HOF) detection utilities.
+ * Used by wrapper analysis and rules.
+ */
+const HTTP_METHODS = "GET|POST|PUT|PATCH|DELETE";
+/**
+ * Extract the ordered chain of HOF wrapper names from route source.
+ * E.g., `export const POST = withWorkspace(withErrorBoundary(handler))` → ["withWorkspace", "withErrorBoundary"]
+ * E.g., `export default withAuth(handler)` → ["withAuth"]
+ * Returns empty array if no HOF wrapper detected.
+ */
+export function extractHofWrapperChain(src) {
+    const chains = [];
+    // Pattern 1: export const METHOD = wrapper(...)
+    const constPattern = new RegExp(`export\\s+(?:const|let|var)\\s+(?:${HTTP_METHODS})\\s*=\\s*(.+)`, "gm");
+    for (const m of src.matchAll(constPattern)) {
+        chains.push(...extractCallChain(m[1]));
+    }
+    // Pattern 2: export default wrapper(...)
+    const defaultPattern = /export\s+default\s+([a-zA-Z_]\w*)\s*\(/gm;
+    for (const m of src.matchAll(defaultPattern)) {
+        // Only add if not already captured
+        if (!chains.includes(m[1])) {
+            chains.push(m[1]);
+        }
+    }
+    return [...new Set(chains)];
+}
+/**
+ * Extract function names from a call chain expression.
+ * E.g., "withWorkspace(withErrorBoundary(handler))" → ["withWorkspace", "withErrorBoundary"]
+ * E.g., "withAuth(async (req) => { ... })" → ["withAuth"]
+ *
+ * Only extracts the leading nested call chain — stops at the first
+ * non-wrapper token (e.g., `async`, handler body) to avoid picking
+ * up identifiers deep inside the handler.
+ */
+function extractCallChain(expr) {
+    const names = [];
+    let pos = 0;
+    while (pos < expr.length) {
+        // Skip whitespace
+        while (pos < expr.length && /\s/.test(expr[pos]))
+            pos++;
+        // Try to match identifier(
+        const remaining = expr.slice(pos);
+        const match = remaining.match(/^([a-zA-Z_]\w*)\s*\(/);
+        if (!match)
+            break;
+        const name = match[1];
+        if (SKIP_IDENTIFIERS.has(name))
+            break; // Not a wrapper, stop
+        names.push(name);
+        pos += match[0].length;
+    }
+    return names;
+}
+const SKIP_IDENTIFIERS = new Set([
+    "async", "await", "function", "return", "new", "typeof", "void",
+    "if", "else", "for", "while", "switch", "case", "try", "catch",
+    "throw", "const", "let", "var", "class", "import", "export",
+    "console", "Error", "Promise", "Array", "Object", "String", "Number",
+    "Boolean", "JSON", "Math", "Date", "RegExp", "Map", "Set",
+    "Response", "Request", "Headers", "NextResponse", "NextRequest",
+]);
+/**
+ * Check if route source is exported via a specific known function (HOF pattern).
+ * E.g., `export const POST = withAuth(handler)` with functionName="withAuth" → true
+ */
+export function isWrappedByFunction(src, functionName) {
+    const escaped = functionName.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+    // export const METHOD = fn(...)
+    const hofPattern = new RegExp(`export\\s+(?:const|let|var)\\s+(?:${HTTP_METHODS})\\s*=\\s*${escaped}\\s*\\(`, "m");
+    if (hofPattern.test(src))
+        return true;
+    // export default fn(...)
+    const defaultPattern = new RegExp(`export\\s+default\\s+${escaped}\\s*\\(`, "m");
+    return defaultPattern.test(src);
+}
+/**
+ * Find the import source for a given identifier in the source.
+ * Returns the module specifier or undefined if not imported (same-file definition).
+ */
+export function findImportSource(src, identifierName) {
+    const escaped = identifierName.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+    // Named import: import { name } from "source" or import { other as name } from "source"
+    const namedPattern = new RegExp(`import\\s*\\{[^}]*\\b(?:${escaped}|\\w+\\s+as\\s+${escaped})\\b[^}]*\\}\\s*from\\s*["']([^"']+)["']`);
+    const namedMatch = src.match(namedPattern);
+    if (namedMatch)
+        return namedMatch[1];
+    // Default import: import name from "source"
+    const defaultPattern = new RegExp(`import\\s+${escaped}\\s+from\\s*["']([^"']+)["']`);
+    const defaultMatch = src.match(defaultPattern);
+    if (defaultMatch)
+        return defaultMatch[1];
+    // Namespace import + property access won't match here — that's fine for v1
+    return undefined;
+}
+//# sourceMappingURL=hof.js.map

package/dist/util/hof.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"hof.js","sourceRoot":"","sources":["../../src/util/hof.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,MAAM,YAAY,GAAG,2BAA2B,CAAC;AAEjD;;;;;GAKG;AACH,MAAM,UAAU,sBAAsB,CAAC,GAAW;IAChD,MAAM,MAAM,GAAa,EAAE,CAAC;IAE5B,gDAAgD;IAChD,MAAM,YAAY,GAAG,IAAI,MAAM,CAC7B,qCAAqC,YAAY,gBAAgB,EACjE,IAAI,CACL,CAAC;IACF,KAAK,MAAM,CAAC,IAAI,GAAG,CAAC,QAAQ,CAAC,YAAY,CAAC,EAAE,CAAC;QAC3C,MAAM,CAAC,IAAI,CAAC,GAAG,gBAAgB,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACzC,CAAC;IAED,yCAAyC;IACzC,MAAM,cAAc,GAAG,0CAA0C,CAAC;IAClE,KAAK,MAAM,CAAC,IAAI,GAAG,CAAC,QAAQ,CAAC,cAAc,CAAC,EAAE,CAAC;QAC7C,mCAAmC;QACnC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YAC3B,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACpB,CAAC;IACH,CAAC;IAED,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC;AAC9B,CAAC;AAED;;;;;;;;GAQG;AACH,SAAS,gBAAgB,CAAC,IAAY;IACpC,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,IAAI,GAAG,GAAG,CAAC,CAAC;IAEZ,OAAO,GAAG,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC;QACzB,kBAAkB;QAClB,OAAO,GAAG,GAAG,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YAAE,GAAG,EAAE,CAAC;QAExD,2BAA2B;QAC3B,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAClC,MAAM,KAAK,GAAG,SAAS,CAAC,KAAK,CAAC,sBAAsB,CAAC,CAAC;QACtD,IAAI,CAAC,KAAK;YAAE,MAAM;QAElB,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;QACtB,IAAI,gBAAgB,CAAC,GAAG,CAAC,IAAI,CAAC;YAAE,MAAM,CAAC,sBAAsB;QAE7D,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACjB,GAAG,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;IACzB,CAAC;IAED,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAM,gBAAgB,GAAG,IAAI,GAAG,CAAC;IAC/B,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM;IAC/D,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO;IAC9D,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,QAAQ;IAC3D,SAAS,EAAE,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,QAAQ;IACpE,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,KAAK;IACzD,UAAU,EAAE,SAAS,EAAE,SAAS,EAAE,cAAc,EAAE,aAAa;CAChE,CAAC,CAAC;AAEH;;;GAGG;AACH,MAAM,UAAU,mBAAmB,CAAC,GAAW,EAAE,YAAoB;IACnE,MAAM,OAAO,GAAG,YAAY,CAAC,OAAO,CAAC,qBAAqB,EAAE,MAAM,CAAC,CAAC;IACpE,gCAAgC;IAChC,MAAM,UAAU,GAAG,IAAI,MAAM,CAC3B,qCAAqC,YAAY,aAAa,OAAO,SAAS,EAC9E,GAAG,CACJ,CAAC;IACF,IAAI,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IAEtC,yBAAyB;IACzB,MAAM,cAAc,GAAG,IAAI,MAAM,CAAC,wBAAwB,OAAO,SAAS,EAAE,GAAG,CAAC,CAAC;IACjF,OAAO,cAAc,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAClC,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,gBAAgB,CAAC,GAAW,EAAE,cAAsB;IAClE,MAAM,OAAO,GAAG,cAAc,CAAC,OAAO,CAAC,qBAAqB,EAAE,MAAM,CAAC,CAAC;IAEtE,wFAAwF;IACxF,MAAM,YAAY,GAAG,IAAI,MAAM,CAC7B,2BAA2B,OAAO,kBAAkB,OAAO,0CAA0C,CACtG,CAAC;IACF,MAAM,UAAU,GAAG,GAAG,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;IAC3C,IAAI,UAAU;QAAE,OAAO,UAAU,CAAC,CAAC,CAAC,CAAC;IAErC,4CAA4C;IAC5C,MAAM,cAAc,GAAG,IAAI,MAAM,CAC/B,aAAa,OAAO,8BAA8B,CACnD,CAAC;IACF,MAAM,YAAY,GAAG,GAAG,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC;IAC/C,IAAI,YAAY;QAAE,OAAO,YAAY,CAAC,CAAC,CAAC,CAAC;IAEzC,2EAA2E;IAE3E,OAAO,SAAS,CAAC;AACnB,CAAC"}

package/dist/util/hof.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=hof.test.d.ts.map

package/dist/util/hof.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"hof.test.d.ts","sourceRoot":"","sources":["../../src/util/hof.test.ts"],"names":[],"mappings":""}

package/dist/util/hof.test.js

@@ -0,0 +1,79 @@
+import { describe, it, expect } from "vitest";
+import { extractHofWrapperChain, isWrappedByFunction, findImportSource } from "./hof.js";
+describe("extractHofWrapperChain", () => {
+    it("extracts single wrapper from const export", () => {
+        const src = `export const POST = withWorkspace(async (req) => { return Response.json({}); });`;
+        expect(extractHofWrapperChain(src)).toEqual(["withWorkspace"]);
+    });
+    it("extracts chained wrappers", () => {
+        const src = `export const POST = withWorkspace(withErrorBoundary(async (req) => { return Response.json({}); }));`;
+        expect(extractHofWrapperChain(src)).toEqual(["withWorkspace", "withErrorBoundary"]);
+    });
+    it("extracts from export default", () => {
+        const src = `export default withAuth(handler);`;
+        expect(extractHofWrapperChain(src)).toEqual(["withAuth"]);
+    });
+    it("extracts from multiple method exports", () => {
+        const src = `
+      export const GET = withWorkspace(getHandler);
+      export const POST = withWorkspace(postHandler);
+    `;
+        // Should deduplicate
+        expect(extractHofWrapperChain(src)).toEqual(["withWorkspace"]);
+    });
+    it("returns empty for regular function exports", () => {
+        const src = `export async function POST(req: Request) { return Response.json({}); }`;
+        expect(extractHofWrapperChain(src)).toEqual([]);
+    });
+    it("skips JavaScript keywords", () => {
+        const src = `export const POST = async function(req) { return new Response(); };`;
+        // "async" and "Response" should be filtered out
+        const chain = extractHofWrapperChain(src);
+        expect(chain).not.toContain("async");
+        expect(chain).not.toContain("Response");
+    });
+});
+describe("isWrappedByFunction", () => {
+    it("matches const export pattern", () => {
+        const src = `export const POST = withAuth(async (req) => {});`;
+        expect(isWrappedByFunction(src, "withAuth")).toBe(true);
+    });
+    it("matches default export pattern", () => {
+        const src = `export default withAuth(handler);`;
+        expect(isWrappedByFunction(src, "withAuth")).toBe(true);
+    });
+    it("does not match different function", () => {
+        const src = `export const POST = withAuth(handler);`;
+        expect(isWrappedByFunction(src, "withRateLimit")).toBe(false);
+    });
+    it("does not match function call inside handler", () => {
+        const src = `export async function POST(req: Request) { withAuth(); }`;
+        expect(isWrappedByFunction(src, "withAuth")).toBe(false);
+    });
+});
+describe("findImportSource", () => {
+    it("finds named import source", () => {
+        const src = `import { withWorkspace } from "@/lib/auth";`;
+        expect(findImportSource(src, "withWorkspace")).toBe("@/lib/auth");
+    });
+    it("finds default import source", () => {
+        const src = `import withAuth from "@/lib/auth";`;
+        expect(findImportSource(src, "withAuth")).toBe("@/lib/auth");
+    });
+    it("returns undefined for same-file definition", () => {
+        const src = `
+      function withAuth(handler: any) { return handler; }
+      export const POST = withAuth(handler);
+    `;
+        expect(findImportSource(src, "withAuth")).toBeUndefined();
+    });
+    it("handles aliased imports", () => {
+        const src = `import { myAuth as withAuth } from "@/lib/auth";`;
+        expect(findImportSource(src, "withAuth")).toBe("@/lib/auth");
+    });
+    it("handles multiple named imports", () => {
+        const src = `import { foo, withWorkspace, bar } from "@/lib/auth";`;
+        expect(findImportSource(src, "withWorkspace")).toBe("@/lib/auth");
+    });
+});
+//# sourceMappingURL=hof.test.js.map

package/dist/util/hof.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"hof.test.js","sourceRoot":"","sources":["../../src/util/hof.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAC9C,OAAO,EAAE,sBAAsB,EAAE,mBAAmB,EAAE,gBAAgB,EAAE,MAAM,UAAU,CAAC;AAEzF,QAAQ,CAAC,wBAAwB,EAAE,GAAG,EAAE;IACtC,EAAE,CAAC,2CAA2C,EAAE,GAAG,EAAE;QACnD,MAAM,GAAG,GAAG,kFAAkF,CAAC;QAC/F,MAAM,CAAC,sBAAsB,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC;IACjE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,2BAA2B,EAAE,GAAG,EAAE;QACnC,MAAM,GAAG,GAAG,qGAAqG,CAAC;QAClH,MAAM,CAAC,sBAAsB,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,eAAe,EAAE,mBAAmB,CAAC,CAAC,CAAC;IACtF,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,8BAA8B,EAAE,GAAG,EAAE;QACtC,MAAM,GAAG,GAAG,mCAAmC,CAAC;QAChD,MAAM,CAAC,sBAAsB,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC;IAC5D,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,uCAAuC,EAAE,GAAG,EAAE;QAC/C,MAAM,GAAG,GAAG;;;KAGX,CAAC;QACF,qBAAqB;QACrB,MAAM,CAAC,sBAAsB,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC;IACjE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,4CAA4C,EAAE,GAAG,EAAE;QACpD,MAAM,GAAG,GAAG,wEAAwE,CAAC;QACrF,MAAM,CAAC,sBAAsB,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;IAClD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,2BAA2B,EAAE,GAAG,EAAE;QACnC,MAAM,GAAG,GAAG,qEAAqE,CAAC;QAClF,gDAAgD;QAChD,MAAM,KAAK,GAAG,sBAAsB,CAAC,GAAG,CAAC,CAAC;QAC1C,MAAM,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;QACrC,MAAM,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC;IAC1C,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,qBAAqB,EAAE,GAAG,EAAE;IACnC,EAAE,CAAC,8BAA8B,EAAE,GAAG,EAAE;QACtC,MAAM,GAAG,GAAG,kDAAkD,CAAC;QAC/D,MAAM,CAAC,mBAAmB,CAAC,GAAG,EAAE,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC1D,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,gCAAgC,EAAE,GAAG,EAAE;QACxC,MAAM,GAAG,GAAG,mCAAmC,CAAC;QAChD,MAAM,CAAC,mBAAmB,CAAC,GAAG,EAAE,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC1D,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,mCAAmC,EAAE,GAAG,EAAE;QAC3C,MAAM,GAAG,GAAG,wCAAwC,CAAC;QACrD,MAAM,CAAC,mBAAmB,CAAC,GAAG,EAAE,eAAe,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAChE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,6CAA6C,EAAE,GAAG,EAAE;QACrD,MAAM,GAAG,GAAG,0DAA0D,CAAC;QACvE,MAAM,CAAC,mBAAmB,CAAC,GAAG,EAAE,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC3D,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,kBAAkB,EAAE,GAAG,EAAE;IAChC,EAAE,CAAC,2BAA2B,EAAE,GAAG,EAAE;QACnC,MAAM,GAAG,GAAG,6CAA6C,CAAC;QAC1D,MAAM,CAAC,gBAAgB,CAAC,GAAG,EAAE,eAAe,CAAC,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;IACpE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,6BAA6B,EAAE,GAAG,EAAE;QACrC,MAAM,GAAG,GAAG,oCAAoC,CAAC;QACjD,MAAM,CAAC,gBAAgB,CAAC,GAAG,EAAE,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;IAC/D,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,4CAA4C,EAAE,GAAG,EAAE;QACpD,MAAM,GAAG,GAAG;;;KAGX,CAAC;QACF,MAAM,CAAC,gBAAgB,CAAC,GAAG,EAAE,UAAU,CAAC,CAAC,CAAC,aAAa,EAAE,CAAC;IAC5D,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,yBAAyB,EAAE,GAAG,EAAE;QACjC,MAAM,GAAG,GAAG,kDAAkD,CAAC;QAC/D,MAAM,CAAC,gBAAgB,CAAC,GAAG,EAAE,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;IAC/D,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,gCAAgC,EAAE,GAAG,EAAE;QACxC,MAAM,GAAG,GAAG,uDAAuD,CAAC;QACpE,MAAM,CAAC,gBAAgB,CAAC,GAAG,EAAE,eAAe,CAAC,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;IACpE,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/util/monorepo.d.ts

@@ -0,0 +1,6 @@
+/**
+ * Walk up from startDir to find a monorepo workspace root.
+ * Returns null if no workspace root is found (i.e., not a monorepo).
+ */
+export declare function findWorkspaceRoot(startDir: string): string | null;
+//# sourceMappingURL=monorepo.d.ts.map

package/dist/util/monorepo.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"monorepo.d.ts","sourceRoot":"","sources":["../../src/util/monorepo.ts"],"names":[],"mappings":"AAGA;;;GAGG;AACH,wBAAgB,iBAAiB,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAiBjE"}

package/dist/util/monorepo.js

@@ -0,0 +1,29 @@
+import path from "node:path";
+import { existsSync, readFileSync } from "node:fs";
+/**
+ * Walk up from startDir to find a monorepo workspace root.
+ * Returns null if no workspace root is found (i.e., not a monorepo).
+ */
+export function findWorkspaceRoot(startDir) {
+    let dir = path.dirname(startDir);
+    while (dir !== path.dirname(dir)) {
+        if (existsSync(path.join(dir, "pnpm-workspace.yaml")))
+            return dir;
+        if (existsSync(path.join(dir, "turbo.json")))
+            return dir;
+        const pkgPath = path.join(dir, "package.json");
+        if (existsSync(pkgPath)) {
+            try {
+                const pkg = JSON.parse(readFileSync(pkgPath, "utf8"));
+                if (pkg.workspaces)
+                    return dir;
+            }
+            catch {
+                // Ignore parse errors in parent package.json
+            }
+        }
+        dir = path.dirname(dir);
+    }
+    return null;
+}
+//# sourceMappingURL=monorepo.js.map

package/dist/util/monorepo.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"monorepo.js","sourceRoot":"","sources":["../../src/util/monorepo.ts"],"names":[],"mappings":"AAAA,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAEnD;;;GAGG;AACH,MAAM,UAAU,iBAAiB,CAAC,QAAgB;IAChD,IAAI,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;IACjC,OAAO,GAAG,KAAK,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QACjC,IAAI,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,qBAAqB,CAAC,CAAC;YAAE,OAAO,GAAG,CAAC;QAClE,IAAI,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,YAAY,CAAC,CAAC;YAAE,OAAO,GAAG,CAAC;QACzD,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,cAAc,CAAC,CAAC;QAC/C,IAAI,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;YACxB,IAAI,CAAC;gBACH,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC;gBACtD,IAAI,GAAG,CAAC,UAAU;oBAAE,OAAO,GAAG,CAAC;YACjC,CAAC;YAAC,MAAM,CAAC;gBACP,6CAA6C;YAC/C,CAAC;QACH,CAAC;QACD,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAC1B,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist/util/outbound-fetch.d.ts

@@ -0,0 +1,14 @@
+/**
+ * Detect outbound HTTP fetch calls with user-influenced URLs.
+ * Used by RL and INPUT-VALIDATION rules to identify SSRF surface
+ * on public-intent endpoints.
+ */
+export interface OutboundFetchResult {
+    hasOutboundFetch: boolean;
+    hasUserInfluencedUrl: boolean;
+    /** True when both outbound fetch AND user-influenced URL are present */
+    isRisky: boolean;
+    evidence: string[];
+}
+export declare function detectOutboundFetcher(src: string): OutboundFetchResult;
+//# sourceMappingURL=outbound-fetch.d.ts.map

package/dist/util/outbound-fetch.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"outbound-fetch.d.ts","sourceRoot":"","sources":["../../src/util/outbound-fetch.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,MAAM,WAAW,mBAAmB;IAClC,gBAAgB,EAAE,OAAO,CAAC;IAC1B,oBAAoB,EAAE,OAAO,CAAC;IAC9B,wEAAwE;IACxE,OAAO,EAAE,OAAO,CAAC;IACjB,QAAQ,EAAE,MAAM,EAAE,CAAC;CACpB;AA8BD,wBAAgB,qBAAqB,CAAC,GAAG,EAAE,MAAM,GAAG,mBAAmB,CA6BtE"}

package/dist/util/outbound-fetch.js

@@ -0,0 +1,59 @@
+/**
+ * Detect outbound HTTP fetch calls with user-influenced URLs.
+ * Used by RL and INPUT-VALIDATION rules to identify SSRF surface
+ * on public-intent endpoints.
+ */
+/**
+ * Outbound fetch patterns — HTTP client calls that make external requests.
+ * Excludes false positives like fetchUser(), fetchData() by requiring
+ * non-word char or start-of-line before "fetch".
+ */
+const OUTBOUND_FETCH_PATTERNS = [
+    { pattern: /(?:^|[^.\w])fetch\s*\(/, label: "fetch()" },
+    { pattern: /axios\s*[.(]/, label: "axios" },
+    { pattern: /(?:^|[^.\w])got\s*[.(]/, label: "got()" },
+    { pattern: /undici\.request\s*\(/, label: "undici.request()" },
+    { pattern: /https?\.(?:get|request)\s*\(/, label: "http.get/request()" },
+];
+/**
+ * User-influenced URL patterns — evidence that the fetch target
+ * is constructed from user-supplied request data.
+ */
+const USER_INPUT_PATTERNS = [
+    { pattern: /searchParams\.get\s*\(/, label: "reads searchParams" },
+    { pattern: /searchParams\.\w/, label: "accesses searchParams" },
+    { pattern: /new\s+URL\s*\(\s*(?:request|req)\.url/, label: "parses request URL" },
+    { pattern: /(?:request|req)\.url\b/, label: "reads request.url" },
+    { pattern: /(?:request|req)\.json\s*\(/, label: "reads request body" },
+    { pattern: /req\.body\b/, label: "reads req.body" },
+    { pattern: /req\.query\b/, label: "reads req.query" },
+    { pattern: /params\.\w/, label: "reads route params" },
+];
+export function detectOutboundFetcher(src) {
+    const evidence = [];
+    let hasOutboundFetch = false;
+    let hasUserInfluencedUrl = false;
+    for (const { pattern, label } of OUTBOUND_FETCH_PATTERNS) {
+        if (pattern.test(src)) {
+            hasOutboundFetch = true;
+            evidence.push(`outbound HTTP call: ${label}`);
+            break; // one is enough
+        }
+    }
+    if (hasOutboundFetch) {
+        for (const { pattern, label } of USER_INPUT_PATTERNS) {
+            if (pattern.test(src)) {
+                hasUserInfluencedUrl = true;
+                evidence.push(`user-controlled input: ${label}`);
+                break; // one is enough
+            }
+        }
+    }
+    return {
+        hasOutboundFetch,
+        hasUserInfluencedUrl,
+        isRisky: hasOutboundFetch && hasUserInfluencedUrl,
+        evidence,
+    };
+}
+//# sourceMappingURL=outbound-fetch.js.map

package/dist/util/outbound-fetch.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"outbound-fetch.js","sourceRoot":"","sources":["../../src/util/outbound-fetch.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAUH;;;;GAIG;AACH,MAAM,uBAAuB,GAAyC;IACpE,EAAE,OAAO,EAAE,wBAAwB,EAAE,KAAK,EAAE,SAAS,EAAE;IACvD,EAAE,OAAO,EAAE,cAAc,EAAE,KAAK,EAAE,OAAO,EAAE;IAC3C,EAAE,OAAO,EAAE,wBAAwB,EAAE,KAAK,EAAE,OAAO,EAAE;IACrD,EAAE,OAAO,EAAE,sBAAsB,EAAE,KAAK,EAAE,kBAAkB,EAAE;IAC9D,EAAE,OAAO,EAAE,8BAA8B,EAAE,KAAK,EAAE,oBAAoB,EAAE;CACzE,CAAC;AAEF;;;GAGG;AACH,MAAM,mBAAmB,GAAyC;IAChE,EAAE,OAAO,EAAE,wBAAwB,EAAE,KAAK,EAAE,oBAAoB,EAAE;IAClE,EAAE,OAAO,EAAE,kBAAkB,EAAE,KAAK,EAAE,uBAAuB,EAAE;IAC/D,EAAE,OAAO,EAAE,uCAAuC,EAAE,KAAK,EAAE,oBAAoB,EAAE;IACjF,EAAE,OAAO,EAAE,wBAAwB,EAAE,KAAK,EAAE,mBAAmB,EAAE;IACjE,EAAE,OAAO,EAAE,4BAA4B,EAAE,KAAK,EAAE,oBAAoB,EAAE;IACtE,EAAE,OAAO,EAAE,aAAa,EAAE,KAAK,EAAE,gBAAgB,EAAE;IACnD,EAAE,OAAO,EAAE,cAAc,EAAE,KAAK,EAAE,iBAAiB,EAAE;IACrD,EAAE,OAAO,EAAE,YAAY,EAAE,KAAK,EAAE,oBAAoB,EAAE;CACvD,CAAC;AAEF,MAAM,UAAU,qBAAqB,CAAC,GAAW;IAC/C,MAAM,QAAQ,GAAa,EAAE,CAAC;IAC9B,IAAI,gBAAgB,GAAG,KAAK,CAAC;IAC7B,IAAI,oBAAoB,GAAG,KAAK,CAAC;IAEjC,KAAK,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,uBAAuB,EAAE,CAAC;QACzD,IAAI,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;YACtB,gBAAgB,GAAG,IAAI,CAAC;YACxB,QAAQ,CAAC,IAAI,CAAC,uBAAuB,KAAK,EAAE,CAAC,CAAC;YAC9C,MAAM,CAAC,gBAAgB;QACzB,CAAC;IACH,CAAC;IAED,IAAI,gBAAgB,EAAE,CAAC;QACrB,KAAK,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,mBAAmB,EAAE,CAAC;YACrD,IAAI,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;gBACtB,oBAAoB,GAAG,IAAI,CAAC;gBAC5B,QAAQ,CAAC,IAAI,CAAC,0BAA0B,KAAK,EAAE,CAAC,CAAC;gBACjD,MAAM,CAAC,gBAAgB;YACzB,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO;QACL,gBAAgB;QAChB,oBAAoB;QACpB,OAAO,EAAE,gBAAgB,IAAI,oBAAoB;QACjD,QAAQ;KACT,CAAC;AACJ,CAAC"}

package/dist/util/outbound-fetch.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=outbound-fetch.test.d.ts.map

package/dist/util/outbound-fetch.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"outbound-fetch.test.d.ts","sourceRoot":"","sources":["../../src/util/outbound-fetch.test.ts"],"names":[],"mappings":""}

package/dist/util/outbound-fetch.test.js

@@ -0,0 +1,83 @@
+import { describe, it, expect } from "vitest";
+import { detectOutboundFetcher } from "./outbound-fetch.js";
+describe("detectOutboundFetcher", () => {
+    it("detects fetch() with user-influenced URL", () => {
+        const src = `
+export async function GET(request: Request) {
+  const url = new URL(request.url).searchParams.get("target");
+  const response = await fetch(url);
+  return Response.json(await response.json());
+}`;
+        const result = detectOutboundFetcher(src);
+        expect(result.hasOutboundFetch).toBe(true);
+        expect(result.hasUserInfluencedUrl).toBe(true);
+        expect(result.isRisky).toBe(true);
+        expect(result.evidence.length).toBeGreaterThanOrEqual(2);
+    });
+    it("detects axios with user-influenced URL", () => {
+        const src = `
+export async function POST(request: Request) {
+  const body = await request.json();
+  const response = await axios.get(body.url);
+  return Response.json(response.data);
+}`;
+        const result = detectOutboundFetcher(src);
+        expect(result.isRisky).toBe(true);
+    });
+    it("does NOT flag fetch with hardcoded URL", () => {
+        const src = `
+export async function GET() {
+  const response = await fetch("https://api.example.com/data");
+  return Response.json(await response.json());
+}`;
+        const result = detectOutboundFetcher(src);
+        expect(result.hasOutboundFetch).toBe(true);
+        expect(result.hasUserInfluencedUrl).toBe(false);
+        expect(result.isRisky).toBe(false);
+    });
+    it("does NOT flag when no fetch present", () => {
+        const src = `
+export async function POST(request: Request) {
+  const body = await request.json();
+  await prisma.user.create({ data: body });
+  return Response.json({ ok: true });
+}`;
+        const result = detectOutboundFetcher(src);
+        expect(result.hasOutboundFetch).toBe(false);
+        expect(result.isRisky).toBe(false);
+        expect(result.evidence).toHaveLength(0);
+    });
+    it("does NOT match fetchUser() as outbound fetch", () => {
+        const src = `
+export async function GET(request: Request) {
+  const url = new URL(request.url);
+  const user = await fetchUser(url.searchParams.get("id"));
+  return Response.json(user);
+}`;
+        const result = detectOutboundFetcher(src);
+        expect(result.hasOutboundFetch).toBe(false);
+    });
+    it("detects got() with user input", () => {
+        const src = `
+import got from "got";
+export async function GET(request: Request) {
+  const target = new URL(request.url).searchParams.get("url");
+  const response = await got(target);
+  return Response.json(response.body);
+}`;
+        const result = detectOutboundFetcher(src);
+        expect(result.isRisky).toBe(true);
+    });
+    it("detects undici.request with user input", () => {
+        const src = `
+import { request as undiciRequest } from "undici";
+export async function POST(req: Request) {
+  const body = await req.json();
+  const { body: responseBody } = await undici.request(body.endpoint);
+  return Response.json(responseBody);
+}`;
+        const result = detectOutboundFetcher(src);
+        expect(result.isRisky).toBe(true);
+    });
+});
+//# sourceMappingURL=outbound-fetch.test.js.map

package/dist/util/outbound-fetch.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"outbound-fetch.test.js","sourceRoot":"","sources":["../../src/util/outbound-fetch.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAC9C,OAAO,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAC;AAE5D,QAAQ,CAAC,uBAAuB,EAAE,GAAG,EAAE;IACrC,EAAE,CAAC,0CAA0C,EAAE,GAAG,EAAE;QAClD,MAAM,GAAG,GAAG;;;;;EAKd,CAAC;QACC,MAAM,MAAM,GAAG,qBAAqB,CAAC,GAAG,CAAC,CAAC;QAC1C,MAAM,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC3C,MAAM,CAAC,MAAM,CAAC,oBAAoB,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC/C,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAClC,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,sBAAsB,CAAC,CAAC,CAAC,CAAC;IAC3D,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,wCAAwC,EAAE,GAAG,EAAE;QAChD,MAAM,GAAG,GAAG;;;;;EAKd,CAAC;QACC,MAAM,MAAM,GAAG,qBAAqB,CAAC,GAAG,CAAC,CAAC;QAC1C,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACpC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,wCAAwC,EAAE,GAAG,EAAE;QAChD,MAAM,GAAG,GAAG;;;;EAId,CAAC;QACC,MAAM,MAAM,GAAG,qBAAqB,CAAC,GAAG,CAAC,CAAC;QAC1C,MAAM,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC3C,MAAM,CAAC,MAAM,CAAC,oBAAoB,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAChD,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACrC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,qCAAqC,EAAE,GAAG,EAAE;QAC7C,MAAM,GAAG,GAAG;;;;;EAKd,CAAC;QACC,MAAM,MAAM,GAAG,qBAAqB,CAAC,GAAG,CAAC,CAAC;QAC1C,MAAM,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC5C,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACnC,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;IAC1C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,8CAA8C,EAAE,GAAG,EAAE;QACtD,MAAM,GAAG,GAAG;;;;;EAKd,CAAC;QACC,MAAM,MAAM,GAAG,qBAAqB,CAAC,GAAG,CAAC,CAAC;QAC1C,MAAM,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC9C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,+BAA+B,EAAE,GAAG,EAAE;QACvC,MAAM,GAAG,GAAG;;;;;;EAMd,CAAC;QACC,MAAM,MAAM,GAAG,qBAAqB,CAAC,GAAG,CAAC,CAAC;QAC1C,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACpC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,wCAAwC,EAAE,GAAG,EAAE;QAChD,MAAM,GAAG,GAAG;;;;;;EAMd,CAAC;QACC,MAAM,MAAM,GAAG,qBAAqB,CAAC,GAAG,CAAC,CAAC;QAC1C,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACpC,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/util/paths.d.ts

@@ -0,0 +1,6 @@
+/**
+ * Check if a file path matches any of the allowlist glob patterns.
+ * Used by rules to skip files/routes that the user has marked as exempt.
+ */
+export declare function isAllowlisted(filePath: string, allowlistPaths: string[]): boolean;
+//# sourceMappingURL=paths.d.ts.map

package/dist/util/paths.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"paths.d.ts","sourceRoot":"","sources":["../../src/util/paths.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,wBAAgB,aAAa,CAAC,QAAQ,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM,EAAE,GAAG,OAAO,CAGjF"}

package/dist/util/paths.js

@@ -0,0 +1,18 @@
+/**
+ * Check if a file path matches any of the allowlist glob patterns.
+ * Used by rules to skip files/routes that the user has marked as exempt.
+ */
+export function isAllowlisted(filePath, allowlistPaths) {
+    if (allowlistPaths.length === 0)
+        return false;
+    return allowlistPaths.some((pattern) => matchGlob(filePath, pattern));
+}
+function matchGlob(filePath, pattern) {
+    const regexStr = pattern
+        .replace(/[.+^${}()|[\]\\]/g, "\\$&")
+        .replace(/\*\*/g, "{{GLOBSTAR}}")
+        .replace(/\*/g, "[^/]*")
+        .replace(/\{\{GLOBSTAR\}\}/g, ".*");
+    return new RegExp(`^${regexStr}$`).test(filePath);
+}
+//# sourceMappingURL=paths.js.map

package/dist/util/paths.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"paths.js","sourceRoot":"","sources":["../../src/util/paths.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,MAAM,UAAU,aAAa,CAAC,QAAgB,EAAE,cAAwB;IACtE,IAAI,cAAc,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IAC9C,OAAO,cAAc,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,SAAS,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC,CAAC;AACxE,CAAC;AAED,SAAS,SAAS,CAAC,QAAgB,EAAE,OAAe;IAClD,MAAM,QAAQ,GAAG,OAAO;SACrB,OAAO,CAAC,mBAAmB,EAAE,MAAM,CAAC;SACpC,OAAO,CAAC,OAAO,EAAE,cAAc,CAAC;SAChC,OAAO,CAAC,KAAK,EAAE,OAAO,CAAC;SACvB,OAAO,CAAC,mBAAmB,EAAE,IAAI,CAAC,CAAC;IACtC,OAAO,IAAI,MAAM,CAAC,IAAI,QAAQ,GAAG,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;AACpD,CAAC"}

package/dist/util/resolve.d.ts

@@ -0,0 +1,30 @@
+export interface TsconfigPaths {
+    baseUrl?: string;
+    paths: Record<string, string[]>;
+}
+export interface ResolveOptions {
+    rootDir: string;
+    tsconfigPaths?: TsconfigPaths;
+}
+/**
+ * Load tsconfig.json (with extends chain) and extract compilerOptions.paths + baseUrl.
+ * Falls back to tsconfig.app.json if tsconfig.json not found.
+ */
+export declare function loadTsconfigPaths(rootDir: string): TsconfigPaths | undefined;
+/**
+ * Resolve an import specifier to a relative file path within rootDir.
+ * Returns the relative path (e.g., "src/lib/auth.ts") or undefined if unresolvable.
+ */
+export declare function resolveImportPath(fromFile: string, importPath: string, opts: ResolveOptions): string | undefined;
+/**
+ * Follow barrel re-exports to find the actual definition file.
+ * E.g., index.ts → export { withWorkspace } from "./workspace" → workspace.ts
+ *
+ * Returns the final file path and source, or undefined if not found.
+ * Follows up to maxHops (default 5) with cycle detection.
+ */
+export declare function followReExport(symbolName: string, startFile: string, opts: ResolveOptions, maxHops?: number): {
+    file: string;
+    src: string;
+} | undefined;
+//# sourceMappingURL=resolve.d.ts.map

package/dist/util/resolve.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"resolve.d.ts","sourceRoot":"","sources":["../../src/util/resolve.ts"],"names":[],"mappings":"AAGA,MAAM,WAAW,aAAa;IAC5B,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;CACjC;AAED,MAAM,WAAW,cAAc;IAC7B,OAAO,EAAE,MAAM,CAAC;IAChB,aAAa,CAAC,EAAE,aAAa,CAAC;CAC/B;AAED;;;GAGG;AACH,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,MAAM,GAAG,aAAa,GAAG,SAAS,CAS5E;AAyID;;;GAGG;AACH,wBAAgB,iBAAiB,CAC/B,QAAQ,EAAE,MAAM,EAChB,UAAU,EAAE,MAAM,EAClB,IAAI,EAAE,cAAc,GACnB,MAAM,GAAG,SAAS,CA6BpB;AA4ED;;;;;;GAMG;AACH,wBAAgB,cAAc,CAC5B,UAAU,EAAE,MAAM,EAClB,SAAS,EAAE,MAAM,EACjB,IAAI,EAAE,cAAc,EACpB,OAAO,GAAE,MAAU,GAClB;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,GAAG,SAAS,CAuD3C"}