@guardrail-ai/rules 0.1.0

package/dist/env-var-leak.js

@@ -0,0 +1,86 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+const traverse_1 = __importDefault(require("@babel/traverse"));
+const LOG_METHODS = new Set(['log', 'debug', 'info', 'warn', 'error', 'trace']);
+const RESPONSE_METHODS = new Set(['json', 'send', 'write', 'end']);
+const envVarLeakRule = {
+    id: 'security/env-var-leak',
+    name: 'Environment Variable Leak',
+    description: 'Detects process.env values being passed to console.log or HTTP response methods',
+    severity: 'high',
+    category: 'security',
+    detect(context) {
+        const violations = [];
+        const { ast, filePath } = context;
+        (0, traverse_1.default)(ast, {
+            CallExpression(path) {
+                const callee = path.node.callee;
+                // Check if this is console.log(process.env.X) or res.json(process.env.X)
+                if (callee.type !== 'MemberExpression')
+                    return;
+                if (callee.property.type !== 'Identifier')
+                    return;
+                const isLogCall = callee.object.type === 'Identifier' &&
+                    callee.object.name === 'console' &&
+                    LOG_METHODS.has(callee.property.name);
+                const isResponseCall = RESPONSE_METHODS.has(callee.property.name);
+                if (!isLogCall && !isResponseCall)
+                    return;
+                // Check if any argument references process.env
+                for (const arg of path.node.arguments) {
+                    if (arg.type === 'SpreadElement')
+                        continue;
+                    if (containsProcessEnv(arg)) {
+                        violations.push({
+                            ruleId: 'security/env-var-leak',
+                            severity: 'high',
+                            message: `process.env value passed to ${isLogCall ? 'console' : 'response'} — may leak secrets.`,
+                            location: {
+                                file: filePath,
+                                line: path.node.loc?.start.line ?? 0,
+                                column: path.node.loc?.start.column ?? 0,
+                            },
+                        });
+                        break;
+                    }
+                }
+            },
+        });
+        return violations;
+    },
+};
+function containsProcessEnv(node) {
+    if (!node || typeof node !== 'object')
+        return false;
+    // process.env.X
+    if (node.type === 'MemberExpression' &&
+        node.object?.type === 'MemberExpression' &&
+        node.object.object?.type === 'Identifier' &&
+        node.object.object.name === 'process' &&
+        node.object.property?.type === 'Identifier' &&
+        node.object.property.name === 'env') {
+        return true;
+    }
+    // Recurse into child nodes
+    for (const key of Object.keys(node)) {
+        if (key === 'loc' || key === 'start' || key === 'end' || key === 'type')
+            continue;
+        const child = node[key];
+        if (Array.isArray(child)) {
+            for (const item of child) {
+                if (containsProcessEnv(item))
+                    return true;
+            }
+        }
+        else if (child && typeof child === 'object' && child.type) {
+            if (containsProcessEnv(child))
+                return true;
+        }
+    }
+    return false;
+}
+exports.default = envVarLeakRule;
+//# sourceMappingURL=env-var-leak.js.map

package/dist/env-var-leak.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"env-var-leak.js","sourceRoot":"","sources":["../src/env-var-leak.ts"],"names":[],"mappings":";;;;;AAAA,+DAAuC;AAGvC,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,CAAC,KAAK,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC;AAChF,MAAM,gBAAgB,GAAG,IAAI,GAAG,CAAC,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC;AAEnE,MAAM,cAAc,GAAS;IAC3B,EAAE,EAAE,uBAAuB;IAC3B,IAAI,EAAE,2BAA2B;IACjC,WAAW,EACT,iFAAiF;IACnF,QAAQ,EAAE,MAAM;IAChB,QAAQ,EAAE,UAAU;IAEpB,MAAM,CAAC,OAAoB;QACzB,MAAM,UAAU,GAAgB,EAAE,CAAC;QACnC,MAAM,EAAE,GAAG,EAAE,QAAQ,EAAE,GAAG,OAAO,CAAC;QAElC,IAAA,kBAAQ,EAAC,GAAG,EAAE;YACZ,cAAc,CAAC,IAAI;gBACjB,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC;gBAEhC,yEAAyE;gBACzE,IAAI,MAAM,CAAC,IAAI,KAAK,kBAAkB;oBAAE,OAAO;gBAC/C,IAAI,MAAM,CAAC,QAAQ,CAAC,IAAI,KAAK,YAAY;oBAAE,OAAO;gBAElD,MAAM,SAAS,GACb,MAAM,CAAC,MAAM,CAAC,IAAI,KAAK,YAAY;oBACnC,MAAM,CAAC,MAAM,CAAC,IAAI,KAAK,SAAS;oBAChC,WAAW,CAAC,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;gBAExC,MAAM,cAAc,GAAG,gBAAgB,CAAC,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;gBAElE,IAAI,CAAC,SAAS,IAAI,CAAC,cAAc;oBAAE,OAAO;gBAE1C,+CAA+C;gBAC/C,KAAK,MAAM,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC;oBACtC,IAAI,GAAG,CAAC,IAAI,KAAK,eAAe;wBAAE,SAAS;oBAC3C,IAAI,kBAAkB,CAAC,GAAG,CAAC,EAAE,CAAC;wBAC5B,UAAU,CAAC,IAAI,CAAC;4BACd,MAAM,EAAE,uBAAuB;4BAC/B,QAAQ,EAAE,MAAM;4BAChB,OAAO,EAAE,+BAA+B,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,UAAU,sBAAsB;4BAChG,QAAQ,EAAE;gCACR,IAAI,EAAE,QAAQ;gCACd,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,IAAI,CAAC;gCACpC,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,MAAM,IAAI,CAAC;6BACzC;yBACF,CAAC,CAAC;wBACH,MAAM;oBACR,CAAC;gBACH,CAAC;YACH,CAAC;SACF,CAAC,CAAC;QAEH,OAAO,UAAU,CAAC;IACpB,CAAC;CACF,CAAC;AAEF,SAAS,kBAAkB,CAAC,IAAS;IACnC,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IAEpD,gBAAgB;IAChB,IACE,IAAI,CAAC,IAAI,KAAK,kBAAkB;QAChC,IAAI,CAAC,MAAM,EAAE,IAAI,KAAK,kBAAkB;QACxC,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,IAAI,KAAK,YAAY;QACzC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,KAAK,SAAS;QACrC,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,IAAI,KAAK,YAAY;QAC3C,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,KAAK,KAAK,EACnC,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,2BAA2B;IAC3B,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QACpC,IAAI,GAAG,KAAK,KAAK,IAAI,GAAG,KAAK,OAAO,IAAI,GAAG,KAAK,KAAK,IAAI,GAAG,KAAK,MAAM;YAAE,SAAS;QAClF,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC;QACxB,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;YACzB,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;gBACzB,IAAI,kBAAkB,CAAC,IAAI,CAAC;oBAAE,OAAO,IAAI,CAAC;YAC5C,CAAC;QACH,CAAC;aAAM,IAAI,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC;YAC5D,IAAI,kBAAkB,CAAC,KAAK,CAAC;gBAAE,OAAO,IAAI,CAAC;QAC7C,CAAC;IACH,CAAC;IAED,OAAO,KAAK,CAAC;AACf,CAAC;AAED,kBAAe,cAAc,CAAC"}

package/dist/fetch-without-error-handling.d.ts

@@ -0,0 +1,4 @@
+import type { Rule } from '@guardrail-ai/core';
+declare const fetchWithoutErrorHandlingRule: Rule;
+export default fetchWithoutErrorHandlingRule;
+//# sourceMappingURL=fetch-without-error-handling.d.ts.map

package/dist/fetch-without-error-handling.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"fetch-without-error-handling.d.ts","sourceRoot":"","sources":["../src/fetch-without-error-handling.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,IAAI,EAA0B,MAAM,oBAAoB,CAAC;AAEvE,QAAA,MAAM,6BAA6B,EAAE,IAgEpC,CAAC;AAEF,eAAe,6BAA6B,CAAC"}

package/dist/fetch-without-error-handling.js

@@ -0,0 +1,62 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+const traverse_1 = __importDefault(require("@babel/traverse"));
+const fetchWithoutErrorHandlingRule = {
+    id: 'ai-codegen/fetch-without-error-handling',
+    name: 'Fetch Without Error Handling',
+    description: 'Detects fetch() calls not wrapped in try/catch or without .catch()',
+    severity: 'warning',
+    category: 'ai-codegen',
+    detect(context) {
+        const violations = [];
+        const { ast, filePath } = context;
+        (0, traverse_1.default)(ast, {
+            CallExpression(path) {
+                const callee = path.node.callee;
+                // Match fetch() or window.fetch()
+                const isFetch = (callee.type === 'Identifier' && callee.name === 'fetch') ||
+                    (callee.type === 'MemberExpression' &&
+                        callee.property.type === 'Identifier' &&
+                        callee.property.name === 'fetch');
+                if (!isFetch)
+                    return;
+                // Check if it's inside a try block
+                let inTry = false;
+                let hasCatch = false;
+                // Walk up ancestors
+                const ancestors = path.getAncestry();
+                for (const anc of ancestors) {
+                    if (anc.isTryStatement()) {
+                        inTry = true;
+                        break;
+                    }
+                    if (anc.isCallExpression() &&
+                        anc.node.callee.type === 'MemberExpression' &&
+                        anc.node.callee.property.type === 'Identifier' &&
+                        anc.node.callee.property.name === 'catch') {
+                        hasCatch = true;
+                        break;
+                    }
+                }
+                if (!inTry && !hasCatch) {
+                    violations.push({
+                        ruleId: 'ai-codegen/fetch-without-error-handling',
+                        severity: 'warning',
+                        message: 'fetch() call without error handling. Wrap in try/catch or chain .catch().',
+                        location: {
+                            file: filePath,
+                            line: path.node.loc?.start.line ?? 0,
+                            column: path.node.loc?.start.column ?? 0,
+                        },
+                    });
+                }
+            },
+        });
+        return violations;
+    },
+};
+exports.default = fetchWithoutErrorHandlingRule;
+//# sourceMappingURL=fetch-without-error-handling.js.map

package/dist/fetch-without-error-handling.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"fetch-without-error-handling.js","sourceRoot":"","sources":["../src/fetch-without-error-handling.ts"],"names":[],"mappings":";;;;;AAAA,+DAAuC;AAGvC,MAAM,6BAA6B,GAAS;IAC1C,EAAE,EAAE,yCAAyC;IAC7C,IAAI,EAAE,8BAA8B;IACpC,WAAW,EAAE,oEAAoE;IACjF,QAAQ,EAAE,SAAS;IACnB,QAAQ,EAAE,YAAY;IAEtB,MAAM,CAAC,OAAoB;QACzB,MAAM,UAAU,GAAgB,EAAE,CAAC;QACnC,MAAM,EAAE,GAAG,EAAE,QAAQ,EAAE,GAAG,OAAO,CAAC;QAElC,IAAA,kBAAQ,EAAC,GAAG,EAAE;YACZ,cAAc,CAAC,IAAI;gBACjB,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC;gBAEhC,kCAAkC;gBAClC,MAAM,OAAO,GACX,CAAC,MAAM,CAAC,IAAI,KAAK,YAAY,IAAI,MAAM,CAAC,IAAI,KAAK,OAAO,CAAC;oBACzD,CAAC,MAAM,CAAC,IAAI,KAAK,kBAAkB;wBACjC,MAAM,CAAC,QAAQ,CAAC,IAAI,KAAK,YAAY;wBACrC,MAAM,CAAC,QAAQ,CAAC,IAAI,KAAK,OAAO,CAAC,CAAC;gBAEtC,IAAI,CAAC,OAAO;oBAAE,OAAO;gBAErB,mCAAmC;gBACnC,IAAI,KAAK,GAAG,KAAK,CAAC;gBAClB,IAAI,QAAQ,GAAG,KAAK,CAAC;gBAErB,oBAAoB;gBACpB,MAAM,SAAS,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;gBACrC,KAAK,MAAM,GAAG,IAAI,SAAS,EAAE,CAAC;oBAC5B,IAAI,GAAG,CAAC,cAAc,EAAE,EAAE,CAAC;wBACzB,KAAK,GAAG,IAAI,CAAC;wBACb,MAAM;oBACR,CAAC;oBACD,IACE,GAAG,CAAC,gBAAgB,EAAE;wBACtB,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,KAAK,kBAAkB;wBAC3C,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,KAAK,YAAY;wBAC9C,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,KAAK,OAAO,EACzC,CAAC;wBACD,QAAQ,GAAG,IAAI,CAAC;wBAChB,MAAM;oBACR,CAAC;gBACH,CAAC;gBAED,IAAI,CAAC,KAAK,IAAI,CAAC,QAAQ,EAAE,CAAC;oBACxB,UAAU,CAAC,IAAI,CAAC;wBACd,MAAM,EAAE,yCAAyC;wBACjD,QAAQ,EAAE,SAAS;wBACnB,OAAO,EACL,2EAA2E;wBAC7E,QAAQ,EAAE;4BACR,IAAI,EAAE,QAAQ;4BACd,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,IAAI,CAAC;4BACpC,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,MAAM,IAAI,CAAC;yBACzC;qBACF,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;SACF,CAAC,CAAC;QAEH,OAAO,UAAU,CAAC;IACpB,CAAC;CACF,CAAC;AAEF,kBAAe,6BAA6B,CAAC"}

package/dist/hallucinated-import.d.ts

@@ -0,0 +1,4 @@
+import type { Rule } from '@guardrail-ai/core';
+declare const hallucinatedImportRule: Rule;
+export default hallucinatedImportRule;
+//# sourceMappingURL=hallucinated-import.d.ts.map

package/dist/hallucinated-import.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"hallucinated-import.d.ts","sourceRoot":"","sources":["../src/hallucinated-import.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,IAAI,EAA0B,MAAM,oBAAoB,CAAC;AAuBvE,QAAA,MAAM,sBAAsB,EAAE,IAuD7B,CAAC;AAEF,eAAe,sBAAsB,CAAC"}

package/dist/hallucinated-import.js

@@ -0,0 +1,75 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+const traverse_1 = __importDefault(require("@babel/traverse"));
+const hallucinated_packages_json_1 = __importDefault(require("./data/hallucinated-packages.json"));
+const HALLUCINATED_SET = new Set(hallucinated_packages_json_1.default);
+// Heuristic: packages ending in -utils, -helpers, -tools with generic prefixes
+const SUSPICIOUS_SUFFIX = /^[a-z]+-(?:utils|helpers|tools|lib|common|shared|base)$/;
+function isSuspicious(source) {
+    // Skip relative imports and builtins
+    if (source.startsWith('.') || source.startsWith('/'))
+        return false;
+    // Get bare package name (strip deep imports)
+    const pkg = source.startsWith('@')
+        ? source.split('/').slice(0, 2).join('/')
+        : source.split('/')[0];
+    if (HALLUCINATED_SET.has(pkg))
+        return true;
+    if (SUSPICIOUS_SUFFIX.test(pkg))
+        return true;
+    return false;
+}
+const hallucinatedImportRule = {
+    id: 'ai-codegen/hallucinated-import',
+    name: 'Hallucinated Import',
+    description: 'Detects imports of npm packages commonly hallucinated by AI code generators',
+    severity: 'high',
+    category: 'ai-codegen',
+    detect(context) {
+        const violations = [];
+        const { ast, filePath } = context;
+        (0, traverse_1.default)(ast, {
+            ImportDeclaration(path) {
+                const source = path.node.source.value;
+                if (isSuspicious(source)) {
+                    violations.push({
+                        ruleId: 'ai-codegen/hallucinated-import',
+                        severity: 'high',
+                        message: `Potentially hallucinated import "${source}". Verify this package exists on npm.`,
+                        location: {
+                            file: filePath,
+                            line: path.node.loc?.start.line ?? 0,
+                            column: path.node.loc?.start.column ?? 0,
+                        },
+                    });
+                }
+            },
+            CallExpression(path) {
+                if (path.node.callee.type === 'Identifier' &&
+                    path.node.callee.name === 'require' &&
+                    path.node.arguments.length === 1 &&
+                    path.node.arguments[0].type === 'StringLiteral') {
+                    const source = path.node.arguments[0].value;
+                    if (isSuspicious(source)) {
+                        violations.push({
+                            ruleId: 'ai-codegen/hallucinated-import',
+                            severity: 'high',
+                            message: `Potentially hallucinated require "${source}". Verify this package exists on npm.`,
+                            location: {
+                                file: filePath,
+                                line: path.node.loc?.start.line ?? 0,
+                                column: path.node.loc?.start.column ?? 0,
+                            },
+                        });
+                    }
+                }
+            },
+        });
+        return violations;
+    },
+};
+exports.default = hallucinatedImportRule;
+//# sourceMappingURL=hallucinated-import.js.map

package/dist/hallucinated-import.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"hallucinated-import.js","sourceRoot":"","sources":["../src/hallucinated-import.ts"],"names":[],"mappings":";;;;;AAAA,+DAAuC;AAEvC,mGAAqE;AAErE,MAAM,gBAAgB,GAAG,IAAI,GAAG,CAAC,oCAAoB,CAAC,CAAC;AAEvD,+EAA+E;AAC/E,MAAM,iBAAiB,GAAG,yDAAyD,CAAC;AAEpF,SAAS,YAAY,CAAC,MAAc;IAClC,qCAAqC;IACrC,IAAI,MAAM,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,MAAM,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,OAAO,KAAK,CAAC;IAEnE,6CAA6C;IAC7C,MAAM,GAAG,GAAG,MAAM,CAAC,UAAU,CAAC,GAAG,CAAC;QAChC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC;QACzC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;IAEzB,IAAI,gBAAgB,CAAC,GAAG,CAAC,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IAC3C,IAAI,iBAAiB,CAAC,IAAI,CAAC,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IAE7C,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAM,sBAAsB,GAAS;IACnC,EAAE,EAAE,gCAAgC;IACpC,IAAI,EAAE,qBAAqB;IAC3B,WAAW,EACT,6EAA6E;IAC/E,QAAQ,EAAE,MAAM;IAChB,QAAQ,EAAE,YAAY;IAEtB,MAAM,CAAC,OAAoB;QACzB,MAAM,UAAU,GAAgB,EAAE,CAAC;QACnC,MAAM,EAAE,GAAG,EAAE,QAAQ,EAAE,GAAG,OAAO,CAAC;QAElC,IAAA,kBAAQ,EAAC,GAAG,EAAE;YACZ,iBAAiB,CAAC,IAAI;gBACpB,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC;gBACtC,IAAI,YAAY,CAAC,MAAM,CAAC,EAAE,CAAC;oBACzB,UAAU,CAAC,IAAI,CAAC;wBACd,MAAM,EAAE,gCAAgC;wBACxC,QAAQ,EAAE,MAAM;wBAChB,OAAO,EAAE,oCAAoC,MAAM,uCAAuC;wBAC1F,QAAQ,EAAE;4BACR,IAAI,EAAE,QAAQ;4BACd,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,IAAI,CAAC;4BACpC,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,MAAM,IAAI,CAAC;yBACzC;qBACF,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;YAED,cAAc,CAAC,IAAI;gBACjB,IACE,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,KAAK,YAAY;oBACtC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,KAAK,SAAS;oBACnC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,KAAK,CAAC;oBAChC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,IAAI,KAAK,eAAe,EAC/C,CAAC;oBACD,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;oBAC5C,IAAI,YAAY,CAAC,MAAM,CAAC,EAAE,CAAC;wBACzB,UAAU,CAAC,IAAI,CAAC;4BACd,MAAM,EAAE,gCAAgC;4BACxC,QAAQ,EAAE,MAAM;4BAChB,OAAO,EAAE,qCAAqC,MAAM,uCAAuC;4BAC3F,QAAQ,EAAE;gCACR,IAAI,EAAE,QAAQ;gCACd,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,IAAI,CAAC;gCACpC,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,MAAM,IAAI,CAAC;6BACzC;yBACF,CAAC,CAAC;oBACL,CAAC;gBACH,CAAC;YACH,CAAC;SACF,CAAC,CAAC;QAEH,OAAO,UAAU,CAAC;IACpB,CAAC;CACF,CAAC;AAEF,kBAAe,sBAAsB,CAAC"}

package/dist/hardcoded-api-key.d.ts

@@ -0,0 +1,4 @@
+import type { Rule } from '@guardrail-ai/core';
+declare const hardcodedApiKeyRule: Rule;
+export default hardcodedApiKeyRule;
+//# sourceMappingURL=hardcoded-api-key.d.ts.map

package/dist/hardcoded-api-key.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"hardcoded-api-key.d.ts","sourceRoot":"","sources":["../src/hardcoded-api-key.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,IAAI,EAA0B,MAAM,oBAAoB,CAAC;AAgCvE,QAAA,MAAM,mBAAmB,EAAE,IAiH1B,CAAC;AAEF,eAAe,mBAAmB,CAAC"}

package/dist/hardcoded-api-key.js

@@ -0,0 +1,129 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+const traverse_1 = __importDefault(require("@babel/traverse"));
+/**
+ * Detects hardcoded API keys, secrets, and tokens in source code.
+ *
+ * Catches patterns like:
+ *   const API_KEY = "sk-abc123..."
+ *   headers: { Authorization: "Bearer eyJ..." }
+ *   password = "hardcoded"
+ */
+const SUSPICIOUS_NAMES = /(?:api[_-]?key|secret|token|password|passwd|credentials|auth|bearer|private[_-]?key|access[_-]?key|client[_-]?secret)/i;
+const KEY_PATTERNS = [
+    /^sk-[a-zA-Z0-9]{20,}$/, // OpenAI-style
+    /^ghp_[a-zA-Z0-9]{36}$/, // GitHub PAT
+    /^github_pat_[a-zA-Z0-9_]{80,}$/, // GitHub fine-grained PAT
+    /^glpat-[a-zA-Z0-9\-_]{20,}$/, // GitLab PAT
+    /^xox[bposa]-[a-zA-Z0-9\-]{10,}$/, // Slack tokens
+    /^AKIA[0-9A-Z]{16}$/, // AWS Access Key
+    /^eyJ[a-zA-Z0-9\-_]+\.[a-zA-Z0-9\-_]+\.[a-zA-Z0-9\-_]+$/, // JWT
+    /^Bearer\s+[a-zA-Z0-9\-_.]+$/, // Bearer token
+];
+const MIN_SUSPICIOUS_LENGTH = 8;
+function looksLikeSecret(value) {
+    if (value.length < MIN_SUSPICIOUS_LENGTH)
+        return false;
+    return KEY_PATTERNS.some((pattern) => pattern.test(value));
+}
+const hardcodedApiKeyRule = {
+    id: 'security/hardcoded-api-key',
+    name: 'Hardcoded API Key',
+    description: 'Detects hardcoded API keys, secrets, and tokens that should be stored in environment variables',
+    severity: 'critical',
+    category: 'security',
+    detect(context) {
+        const violations = [];
+        const { ast, filePath } = context;
+        (0, traverse_1.default)(ast, {
+            VariableDeclarator(path) {
+                const { id, init } = path.node;
+                if (id.type === 'Identifier' &&
+                    init?.type === 'StringLiteral' &&
+                    SUSPICIOUS_NAMES.test(id.name)) {
+                    const value = init.value;
+                    if (value.length >= MIN_SUSPICIOUS_LENGTH) {
+                        violations.push({
+                            ruleId: 'security/hardcoded-api-key',
+                            severity: 'critical',
+                            message: `Hardcoded secret in variable "${id.name}". Use environment variables instead.`,
+                            location: {
+                                file: filePath,
+                                line: id.loc?.start.line ?? 0,
+                                column: id.loc?.start.column ?? 0,
+                            },
+                        });
+                    }
+                }
+            },
+            AssignmentExpression(path) {
+                const { left, right } = path.node;
+                if (left.type === 'MemberExpression' &&
+                    left.property.type === 'Identifier' &&
+                    SUSPICIOUS_NAMES.test(left.property.name) &&
+                    right.type === 'StringLiteral' &&
+                    right.value.length >= MIN_SUSPICIOUS_LENGTH) {
+                    violations.push({
+                        ruleId: 'security/hardcoded-api-key',
+                        severity: 'critical',
+                        message: `Hardcoded secret assigned to "${left.property.name}". Use environment variables instead.`,
+                        location: {
+                            file: filePath,
+                            line: left.loc?.start.line ?? 0,
+                            column: left.loc?.start.column ?? 0,
+                        },
+                    });
+                }
+            },
+            StringLiteral(path) {
+                if (looksLikeSecret(path.node.value)) {
+                    // Avoid double-reporting if already caught above
+                    const parent = path.parent;
+                    if (parent.type === 'VariableDeclarator' ||
+                        parent.type === 'AssignmentExpression') {
+                        return;
+                    }
+                    violations.push({
+                        ruleId: 'security/hardcoded-api-key',
+                        severity: 'critical',
+                        message: `String literal looks like a hardcoded secret or token. Use environment variables instead.`,
+                        location: {
+                            file: filePath,
+                            line: path.node.loc?.start.line ?? 0,
+                            column: path.node.loc?.start.column ?? 0,
+                        },
+                    });
+                }
+            },
+            ObjectProperty(path) {
+                const { key, value } = path.node;
+                const keyName = key.type === 'Identifier'
+                    ? key.name
+                    : key.type === 'StringLiteral'
+                        ? key.value
+                        : null;
+                if (keyName &&
+                    SUSPICIOUS_NAMES.test(keyName) &&
+                    value.type === 'StringLiteral' &&
+                    value.value.length >= MIN_SUSPICIOUS_LENGTH) {
+                    violations.push({
+                        ruleId: 'security/hardcoded-api-key',
+                        severity: 'critical',
+                        message: `Hardcoded secret in property "${keyName}". Use environment variables instead.`,
+                        location: {
+                            file: filePath,
+                            line: key.loc?.start.line ?? 0,
+                            column: key.loc?.start.column ?? 0,
+                        },
+                    });
+                }
+            },
+        });
+        return violations;
+    },
+};
+exports.default = hardcodedApiKeyRule;
+//# sourceMappingURL=hardcoded-api-key.js.map

package/dist/hardcoded-api-key.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"hardcoded-api-key.js","sourceRoot":"","sources":["../src/hardcoded-api-key.ts"],"names":[],"mappings":";;;;;AAAA,+DAAuC;AAGvC;;;;;;;GAOG;AAEH,MAAM,gBAAgB,GACpB,wHAAwH,CAAC;AAE3H,MAAM,YAAY,GAAG;IACnB,uBAAuB,EAAc,eAAe;IACpD,uBAAuB,EAAc,aAAa;IAClD,gCAAgC,EAAK,0BAA0B;IAC/D,6BAA6B,EAAQ,aAAa;IAClD,iCAAiC,EAAI,eAAe;IACpD,oBAAoB,EAAiB,iBAAiB;IACtD,wDAAwD,EAAE,MAAM;IAChE,6BAA6B,EAAQ,eAAe;CACrD,CAAC;AAEF,MAAM,qBAAqB,GAAG,CAAC,CAAC;AAEhC,SAAS,eAAe,CAAC,KAAa;IACpC,IAAI,KAAK,CAAC,MAAM,GAAG,qBAAqB;QAAE,OAAO,KAAK,CAAC;IACvD,OAAO,YAAY,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;AAC7D,CAAC;AAED,MAAM,mBAAmB,GAAS;IAChC,EAAE,EAAE,4BAA4B;IAChC,IAAI,EAAE,mBAAmB;IACzB,WAAW,EACT,gGAAgG;IAClG,QAAQ,EAAE,UAAU;IACpB,QAAQ,EAAE,UAAU;IAEpB,MAAM,CAAC,OAAoB;QACzB,MAAM,UAAU,GAAgB,EAAE,CAAC;QACnC,MAAM,EAAE,GAAG,EAAE,QAAQ,EAAE,GAAG,OAAO,CAAC;QAElC,IAAA,kBAAQ,EAAC,GAAG,EAAE;YACZ,kBAAkB,CAAC,IAAI;gBACrB,MAAM,EAAE,EAAE,EAAE,IAAI,EAAE,GAAG,IAAI,CAAC,IAAI,CAAC;gBAC/B,IACE,EAAE,CAAC,IAAI,KAAK,YAAY;oBACxB,IAAI,EAAE,IAAI,KAAK,eAAe;oBAC9B,gBAAgB,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,EAC9B,CAAC;oBACD,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC;oBACzB,IAAI,KAAK,CAAC,MAAM,IAAI,qBAAqB,EAAE,CAAC;wBAC1C,UAAU,CAAC,IAAI,CAAC;4BACd,MAAM,EAAE,4BAA4B;4BACpC,QAAQ,EAAE,UAAU;4BACpB,OAAO,EAAE,iCAAiC,EAAE,CAAC,IAAI,uCAAuC;4BACxF,QAAQ,EAAE;gCACR,IAAI,EAAE,QAAQ;gCACd,IAAI,EAAE,EAAE,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,IAAI,CAAC;gCAC7B,MAAM,EAAE,EAAE,CAAC,GAAG,EAAE,KAAK,CAAC,MAAM,IAAI,CAAC;6BAClC;yBACF,CAAC,CAAC;oBACL,CAAC;gBACH,CAAC;YACH,CAAC;YAED,oBAAoB,CAAC,IAAI;gBACvB,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,IAAI,CAAC,IAAI,CAAC;gBAClC,IACE,IAAI,CAAC,IAAI,KAAK,kBAAkB;oBAChC,IAAI,CAAC,QAAQ,CAAC,IAAI,KAAK,YAAY;oBACnC,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC;oBACzC,KAAK,CAAC,IAAI,KAAK,eAAe;oBAC9B,KAAK,CAAC,KAAK,CAAC,MAAM,IAAI,qBAAqB,EAC3C,CAAC;oBACD,UAAU,CAAC,IAAI,CAAC;wBACd,MAAM,EAAE,4BAA4B;wBACpC,QAAQ,EAAE,UAAU;wBACpB,OAAO,EAAE,iCAAiC,IAAI,CAAC,QAAQ,CAAC,IAAI,uCAAuC;wBACnG,QAAQ,EAAE;4BACR,IAAI,EAAE,QAAQ;4BACd,IAAI,EAAE,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,IAAI,CAAC;4BAC/B,MAAM,EAAE,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,MAAM,IAAI,CAAC;yBACpC;qBACF,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;YAED,aAAa,CAAC,IAAI;gBAChB,IAAI,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;oBACrC,iDAAiD;oBACjD,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC;oBAC3B,IACE,MAAM,CAAC,IAAI,KAAK,oBAAoB;wBACpC,MAAM,CAAC,IAAI,KAAK,sBAAsB,EACtC,CAAC;wBACD,OAAO;oBACT,CAAC;oBAED,UAAU,CAAC,IAAI,CAAC;wBACd,MAAM,EAAE,4BAA4B;wBACpC,QAAQ,EAAE,UAAU;wBACpB,OAAO,EAAE,2FAA2F;wBACpG,QAAQ,EAAE;4BACR,IAAI,EAAE,QAAQ;4BACd,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,IAAI,CAAC;4BACpC,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,MAAM,IAAI,CAAC;yBACzC;qBACF,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;YAED,cAAc,CAAC,IAAI;gBACjB,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,IAAI,CAAC,IAAI,CAAC;gBACjC,MAAM,OAAO,GACX,GAAG,CAAC,IAAI,KAAK,YAAY;oBACvB,CAAC,CAAC,GAAG,CAAC,IAAI;oBACV,CAAC,CAAC,GAAG,CAAC,IAAI,KAAK,eAAe;wBAC5B,CAAC,CAAC,GAAG,CAAC,KAAK;wBACX,CAAC,CAAC,IAAI,CAAC;gBAEb,IACE,OAAO;oBACP,gBAAgB,CAAC,IAAI,CAAC,OAAO,CAAC;oBAC9B,KAAK,CAAC,IAAI,KAAK,eAAe;oBAC9B,KAAK,CAAC,KAAK,CAAC,MAAM,IAAI,qBAAqB,EAC3C,CAAC;oBACD,UAAU,CAAC,IAAI,CAAC;wBACd,MAAM,EAAE,4BAA4B;wBACpC,QAAQ,EAAE,UAAU;wBACpB,OAAO,EAAE,iCAAiC,OAAO,uCAAuC;wBACxF,QAAQ,EAAE;4BACR,IAAI,EAAE,QAAQ;4BACd,IAAI,EAAE,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,IAAI,CAAC;4BAC9B,MAAM,EAAE,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,MAAM,IAAI,CAAC;yBACnC;qBACF,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;SACF,CAAC,CAAC;QAEH,OAAO,UAAU,CAAC;IACpB,CAAC;CACF,CAAC;AAEF,kBAAe,mBAAmB,CAAC"}

package/dist/hardcoded-localhost.d.ts

@@ -0,0 +1,4 @@
+import type { Rule } from '@guardrail-ai/core';
+declare const hardcodedLocalhostRule: Rule;
+export default hardcodedLocalhostRule;
+//# sourceMappingURL=hardcoded-localhost.d.ts.map

package/dist/hardcoded-localhost.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"hardcoded-localhost.d.ts","sourceRoot":"","sources":["../src/hardcoded-localhost.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,IAAI,EAA0B,MAAM,oBAAoB,CAAC;AAKvE,QAAA,MAAM,sBAAsB,EAAE,IAiD7B,CAAC;AAEF,eAAe,sBAAsB,CAAC"}

package/dist/hardcoded-localhost.js

@@ -0,0 +1,53 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+const traverse_1 = __importDefault(require("@babel/traverse"));
+const LOCALHOST_PATTERN = /https?:\/\/(localhost|127\.0\.0\.1|0\.0\.0\.0)(:\d+)?/;
+const hardcodedLocalhostRule = {
+    id: 'ai-codegen/hardcoded-localhost',
+    name: 'Hardcoded Localhost',
+    description: 'Detects hardcoded localhost/127.0.0.1 URLs that should use environment variables',
+    severity: 'warning',
+    category: 'ai-codegen',
+    detect(context) {
+        const violations = [];
+        const { ast, filePath } = context;
+        (0, traverse_1.default)(ast, {
+            StringLiteral(path) {
+                if (LOCALHOST_PATTERN.test(path.node.value)) {
+                    violations.push({
+                        ruleId: 'ai-codegen/hardcoded-localhost',
+                        severity: 'warning',
+                        message: `Hardcoded localhost URL "${path.node.value.substring(0, 50)}". Use an environment variable for the base URL.`,
+                        location: {
+                            file: filePath,
+                            line: path.node.loc?.start.line ?? 0,
+                            column: path.node.loc?.start.column ?? 0,
+                        },
+                    });
+                }
+            },
+            TemplateLiteral(path) {
+                for (const quasi of path.node.quasis) {
+                    if (LOCALHOST_PATTERN.test(quasi.value.raw)) {
+                        violations.push({
+                            ruleId: 'ai-codegen/hardcoded-localhost',
+                            severity: 'warning',
+                            message: 'Hardcoded localhost URL in template literal. Use an environment variable for the base URL.',
+                            location: {
+                                file: filePath,
+                                line: quasi.loc?.start.line ?? 0,
+                                column: quasi.loc?.start.column ?? 0,
+                            },
+                        });
+                    }
+                }
+            },
+        });
+        return violations;
+    },
+};
+exports.default = hardcodedLocalhostRule;
+//# sourceMappingURL=hardcoded-localhost.js.map

package/dist/hardcoded-localhost.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"hardcoded-localhost.js","sourceRoot":"","sources":["../src/hardcoded-localhost.ts"],"names":[],"mappings":";;;;;AAAA,+DAAuC;AAGvC,MAAM,iBAAiB,GACrB,uDAAuD,CAAC;AAE1D,MAAM,sBAAsB,GAAS;IACnC,EAAE,EAAE,gCAAgC;IACpC,IAAI,EAAE,qBAAqB;IAC3B,WAAW,EACT,kFAAkF;IACpF,QAAQ,EAAE,SAAS;IACnB,QAAQ,EAAE,YAAY;IAEtB,MAAM,CAAC,OAAoB;QACzB,MAAM,UAAU,GAAgB,EAAE,CAAC;QACnC,MAAM,EAAE,GAAG,EAAE,QAAQ,EAAE,GAAG,OAAO,CAAC;QAElC,IAAA,kBAAQ,EAAC,GAAG,EAAE;YACZ,aAAa,CAAC,IAAI;gBAChB,IAAI,iBAAiB,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;oBAC5C,UAAU,CAAC,IAAI,CAAC;wBACd,MAAM,EAAE,gCAAgC;wBACxC,QAAQ,EAAE,SAAS;wBACnB,OAAO,EAAE,4BAA4B,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,EAAE,EAAE,CAAC,kDAAkD;wBACvH,QAAQ,EAAE;4BACR,IAAI,EAAE,QAAQ;4BACd,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,IAAI,CAAC;4BACpC,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,MAAM,IAAI,CAAC;yBACzC;qBACF,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;YAED,eAAe,CAAC,IAAI;gBAClB,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;oBACrC,IAAI,iBAAiB,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;wBAC5C,UAAU,CAAC,IAAI,CAAC;4BACd,MAAM,EAAE,gCAAgC;4BACxC,QAAQ,EAAE,SAAS;4BACnB,OAAO,EACL,4FAA4F;4BAC9F,QAAQ,EAAE;gCACR,IAAI,EAAE,QAAQ;gCACd,IAAI,EAAE,KAAK,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,IAAI,CAAC;gCAChC,MAAM,EAAE,KAAK,CAAC,GAAG,EAAE,KAAK,CAAC,MAAM,IAAI,CAAC;6BACrC;yBACF,CAAC,CAAC;oBACL,CAAC;gBACH,CAAC;YACH,CAAC;SACF,CAAC,CAAC;QAEH,OAAO,UAAU,CAAC;IACpB,CAAC;CACF,CAAC;AAEF,kBAAe,sBAAsB,CAAC"}

package/dist/index.d.ts

@@ -0,0 +1,26 @@
+import type { Rule } from '@guardrail-ai/core';
+import hardcodedApiKeyRule from './hardcoded-api-key.js';
+import sqlInjectionRule from './sql-injection.js';
+import insecureCorsRule from './insecure-cors.js';
+import envVarLeakRule from './env-var-leak.js';
+import noRateLimitingRule from './no-rate-limiting.js';
+import unsafeRegexRule from './unsafe-regex.js';
+import noEvalRule from './no-eval.js';
+import noSecretsInLogsRule from './no-secrets-in-logs.js';
+import deadCodeRule from './dead-code.js';
+import duplicateLogicRule from './duplicate-logic.js';
+import inefficientLoopRule from './inefficient-loop.js';
+import nPlusOneQueryRule from './n-plus-one-query.js';
+import hallucinatedImportRule from './hallucinated-import.js';
+import placeholderCodeRule from './placeholder-code.js';
+import hardcodedLocalhostRule from './hardcoded-localhost.js';
+import consoleLogSpamRule from './console-log-spam.js';
+import overlyBroadCatchRule from './overly-broad-catch.js';
+import unusedImportsRule from './unused-imports.js';
+import anyTypeAbuseRule from './any-type-abuse.js';
+import fetchWithoutErrorHandlingRule from './fetch-without-error-handling.js';
+import promiseWithoutCatchRule from './promise-without-catch.js';
+import magicNumbersRule from './magic-numbers.js';
+export declare const builtinRules: Rule[];
+export { hardcodedApiKeyRule, sqlInjectionRule, insecureCorsRule, envVarLeakRule, noRateLimitingRule, deadCodeRule, duplicateLogicRule, inefficientLoopRule, nPlusOneQueryRule, hallucinatedImportRule, placeholderCodeRule, hardcodedLocalhostRule, consoleLogSpamRule, overlyBroadCatchRule, unusedImportsRule, anyTypeAbuseRule, fetchWithoutErrorHandlingRule, promiseWithoutCatchRule, magicNumbersRule, unsafeRegexRule, noEvalRule, noSecretsInLogsRule, };
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,oBAAoB,CAAC;AAG/C,OAAO,mBAAmB,MAAM,wBAAwB,CAAC;AACzD,OAAO,gBAAgB,MAAM,oBAAoB,CAAC;AAClD,OAAO,gBAAgB,MAAM,oBAAoB,CAAC;AAClD,OAAO,cAAc,MAAM,mBAAmB,CAAC;AAC/C,OAAO,kBAAkB,MAAM,uBAAuB,CAAC;AACvD,OAAO,eAAe,MAAM,mBAAmB,CAAC;AAChD,OAAO,UAAU,MAAM,cAAc,CAAC;AACtC,OAAO,mBAAmB,MAAM,yBAAyB,CAAC;AAG1D,OAAO,YAAY,MAAM,gBAAgB,CAAC;AAC1C,OAAO,kBAAkB,MAAM,sBAAsB,CAAC;AAGtD,OAAO,mBAAmB,MAAM,uBAAuB,CAAC;AACxD,OAAO,iBAAiB,MAAM,uBAAuB,CAAC;AAGtD,OAAO,sBAAsB,MAAM,0BAA0B,CAAC;AAC9D,OAAO,mBAAmB,MAAM,uBAAuB,CAAC;AACxD,OAAO,sBAAsB,MAAM,0BAA0B,CAAC;AAC9D,OAAO,kBAAkB,MAAM,uBAAuB,CAAC;AACvD,OAAO,oBAAoB,MAAM,yBAAyB,CAAC;AAC3D,OAAO,iBAAiB,MAAM,qBAAqB,CAAC;AACpD,OAAO,gBAAgB,MAAM,qBAAqB,CAAC;AACnD,OAAO,6BAA6B,MAAM,mCAAmC,CAAC;AAC9E,OAAO,uBAAuB,MAAM,4BAA4B,CAAC;AACjE,OAAO,gBAAgB,MAAM,oBAAoB,CAAC;AAElD,eAAO,MAAM,YAAY,EAAE,IAAI,EA8B9B,CAAC;AAEF,OAAO,EACL,mBAAmB,EACnB,gBAAgB,EAChB,gBAAgB,EAChB,cAAc,EACd,kBAAkB,EAClB,YAAY,EACZ,kBAAkB,EAClB,mBAAmB,EACnB,iBAAiB,EACjB,sBAAsB,EACtB,mBAAmB,EACnB,sBAAsB,EACtB,kBAAkB,EAClB,oBAAoB,EACpB,iBAAiB,EACjB,gBAAgB,EAChB,6BAA6B,EAC7B,uBAAuB,EACvB,gBAAgB,EAChB,eAAe,EACf,UAAU,EACV,mBAAmB,GACpB,CAAC"}

package/dist/index.js

@@ -0,0 +1,83 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.noSecretsInLogsRule = exports.noEvalRule = exports.unsafeRegexRule = exports.magicNumbersRule = exports.promiseWithoutCatchRule = exports.fetchWithoutErrorHandlingRule = exports.anyTypeAbuseRule = exports.unusedImportsRule = exports.overlyBroadCatchRule = exports.consoleLogSpamRule = exports.hardcodedLocalhostRule = exports.placeholderCodeRule = exports.hallucinatedImportRule = exports.nPlusOneQueryRule = exports.inefficientLoopRule = exports.duplicateLogicRule = exports.deadCodeRule = exports.noRateLimitingRule = exports.envVarLeakRule = exports.insecureCorsRule = exports.sqlInjectionRule = exports.hardcodedApiKeyRule = exports.builtinRules = void 0;
+// Security
+const hardcoded_api_key_js_1 = __importDefault(require("./hardcoded-api-key.js"));
+exports.hardcodedApiKeyRule = hardcoded_api_key_js_1.default;
+const sql_injection_js_1 = __importDefault(require("./sql-injection.js"));
+exports.sqlInjectionRule = sql_injection_js_1.default;
+const insecure_cors_js_1 = __importDefault(require("./insecure-cors.js"));
+exports.insecureCorsRule = insecure_cors_js_1.default;
+const env_var_leak_js_1 = __importDefault(require("./env-var-leak.js"));
+exports.envVarLeakRule = env_var_leak_js_1.default;
+const no_rate_limiting_js_1 = __importDefault(require("./no-rate-limiting.js"));
+exports.noRateLimitingRule = no_rate_limiting_js_1.default;
+const unsafe_regex_js_1 = __importDefault(require("./unsafe-regex.js"));
+exports.unsafeRegexRule = unsafe_regex_js_1.default;
+const no_eval_js_1 = __importDefault(require("./no-eval.js"));
+exports.noEvalRule = no_eval_js_1.default;
+const no_secrets_in_logs_js_1 = __importDefault(require("./no-secrets-in-logs.js"));
+exports.noSecretsInLogsRule = no_secrets_in_logs_js_1.default;
+// Quality
+const dead_code_js_1 = __importDefault(require("./dead-code.js"));
+exports.deadCodeRule = dead_code_js_1.default;
+const duplicate_logic_js_1 = __importDefault(require("./duplicate-logic.js"));
+exports.duplicateLogicRule = duplicate_logic_js_1.default;
+// Performance
+const inefficient_loop_js_1 = __importDefault(require("./inefficient-loop.js"));
+exports.inefficientLoopRule = inefficient_loop_js_1.default;
+const n_plus_one_query_js_1 = __importDefault(require("./n-plus-one-query.js"));
+exports.nPlusOneQueryRule = n_plus_one_query_js_1.default;
+// AI-Codegen
+const hallucinated_import_js_1 = __importDefault(require("./hallucinated-import.js"));
+exports.hallucinatedImportRule = hallucinated_import_js_1.default;
+const placeholder_code_js_1 = __importDefault(require("./placeholder-code.js"));
+exports.placeholderCodeRule = placeholder_code_js_1.default;
+const hardcoded_localhost_js_1 = __importDefault(require("./hardcoded-localhost.js"));
+exports.hardcodedLocalhostRule = hardcoded_localhost_js_1.default;
+const console_log_spam_js_1 = __importDefault(require("./console-log-spam.js"));
+exports.consoleLogSpamRule = console_log_spam_js_1.default;
+const overly_broad_catch_js_1 = __importDefault(require("./overly-broad-catch.js"));
+exports.overlyBroadCatchRule = overly_broad_catch_js_1.default;
+const unused_imports_js_1 = __importDefault(require("./unused-imports.js"));
+exports.unusedImportsRule = unused_imports_js_1.default;
+const any_type_abuse_js_1 = __importDefault(require("./any-type-abuse.js"));
+exports.anyTypeAbuseRule = any_type_abuse_js_1.default;
+const fetch_without_error_handling_js_1 = __importDefault(require("./fetch-without-error-handling.js"));
+exports.fetchWithoutErrorHandlingRule = fetch_without_error_handling_js_1.default;
+const promise_without_catch_js_1 = __importDefault(require("./promise-without-catch.js"));
+exports.promiseWithoutCatchRule = promise_without_catch_js_1.default;
+const magic_numbers_js_1 = __importDefault(require("./magic-numbers.js"));
+exports.magicNumbersRule = magic_numbers_js_1.default;
+exports.builtinRules = [
+    // Security
+    hardcoded_api_key_js_1.default,
+    sql_injection_js_1.default,
+    insecure_cors_js_1.default,
+    env_var_leak_js_1.default,
+    no_rate_limiting_js_1.default,
+    unsafe_regex_js_1.default,
+    no_eval_js_1.default,
+    no_secrets_in_logs_js_1.default,
+    // Quality
+    dead_code_js_1.default,
+    duplicate_logic_js_1.default,
+    // Performance
+    inefficient_loop_js_1.default,
+    n_plus_one_query_js_1.default,
+    // AI-Codegen
+    hallucinated_import_js_1.default,
+    placeholder_code_js_1.default,
+    hardcoded_localhost_js_1.default,
+    console_log_spam_js_1.default,
+    overly_broad_catch_js_1.default,
+    unused_imports_js_1.default,
+    any_type_abuse_js_1.default,
+    fetch_without_error_handling_js_1.default,
+    promise_without_catch_js_1.default,
+    magic_numbers_js_1.default,
+];
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";;;;;;AAEA,WAAW;AACX,kFAAyD;AA8DvD,8BA9DK,8BAAmB,CA8DL;AA7DrB,0EAAkD;AA8DhD,2BA9DK,0BAAgB,CA8DL;AA7DlB,0EAAkD;AA8DhD,2BA9DK,0BAAgB,CA8DL;AA7DlB,wEAA+C;AA8D7C,yBA9DK,yBAAc,CA8DL;AA7DhB,gFAAuD;AA8DrD,6BA9DK,6BAAkB,CA8DL;AA7DpB,wEAAgD;AA4E9C,0BA5EK,yBAAe,CA4EL;AA3EjB,8DAAsC;AA4EpC,qBA5EK,oBAAU,CA4EL;AA3EZ,oFAA0D;AA4ExD,8BA5EK,+BAAmB,CA4EL;AA1ErB,UAAU;AACV,kEAA0C;AAyDxC,uBAzDK,sBAAY,CAyDL;AAxDd,8EAAsD;AAyDpD,6BAzDK,4BAAkB,CAyDL;AAvDpB,cAAc;AACd,gFAAwD;AAuDtD,8BAvDK,6BAAmB,CAuDL;AAtDrB,gFAAsD;AAuDpD,4BAvDK,6BAAiB,CAuDL;AArDnB,aAAa;AACb,sFAA8D;AAqD5D,iCArDK,gCAAsB,CAqDL;AApDxB,gFAAwD;AAqDtD,8BArDK,6BAAmB,CAqDL;AApDrB,sFAA8D;AAqD5D,iCArDK,gCAAsB,CAqDL;AApDxB,gFAAuD;AAqDrD,6BArDK,6BAAkB,CAqDL;AApDpB,oFAA2D;AAqDzD,+BArDK,+BAAoB,CAqDL;AApDtB,4EAAoD;AAqDlD,4BArDK,2BAAiB,CAqDL;AApDnB,4EAAmD;AAqDjD,2BArDK,2BAAgB,CAqDL;AApDlB,wGAA8E;AAqD5E,wCArDK,yCAA6B,CAqDL;AApD/B,0FAAiE;AAqD/D,kCArDK,kCAAuB,CAqDL;AApDzB,0EAAkD;AAqDhD,2BArDK,0BAAgB,CAqDL;AAnDL,QAAA,YAAY,GAAW;IAClC,WAAW;IACX,8BAAmB;IACnB,0BAAgB;IAChB,0BAAgB;IAChB,yBAAc;IACd,6BAAkB;IAClB,yBAAe;IACf,oBAAU;IACV,+BAAmB;IAEnB,UAAU;IACV,sBAAY;IACZ,4BAAkB;IAElB,cAAc;IACd,6BAAmB;IACnB,6BAAiB;IAEjB,aAAa;IACb,gCAAsB;IACtB,6BAAmB;IACnB,gCAAsB;IACtB,6BAAkB;IAClB,+BAAoB;IACpB,2BAAiB;IACjB,2BAAgB;IAChB,yCAA6B;IAC7B,kCAAuB;IACvB,0BAAgB;CACjB,CAAC"}

package/dist/inefficient-loop.d.ts

@@ -0,0 +1,4 @@
+import type { Rule } from '@guardrail-ai/core';
+declare const inefficientLoopRule: Rule;
+export default inefficientLoopRule;
+//# sourceMappingURL=inefficient-loop.d.ts.map

package/dist/inefficient-loop.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"inefficient-loop.d.ts","sourceRoot":"","sources":["../src/inefficient-loop.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,IAAI,EAA0B,MAAM,oBAAoB,CAAC;AA8CvE,QAAA,MAAM,mBAAmB,EAAE,IAyE1B,CAAC;AAEF,eAAe,mBAAmB,CAAC"}