@intentius/chant 0.53.1 → 0.54.1

package/dist/terraform/manifest.d.ts

@@ -10,8 +10,16 @@
 import type { CarveReport } from "./carve.js";
 import type { OwnershipMarker } from "../ownership.js";
 export declare const CARVE_MANIFEST_SUFFIX = ".carve.json";
+/**
+ * Version 2 (#2039): `emit.files`, `bridge.written`, `bridge.patch` and
+ * `apply.stampedFiles` are recorded relative to the manifest's own directory,
+ * so the manifest stays true when the tree is copied, moved, or checked out
+ * elsewhere. Version-1 manifests recorded them absolute; readers resolve
+ * either through `resolveManifestFilePath`.
+ */
+export declare const CARVE_MANIFEST_VERSION = 2;
 export interface CarveManifest {
-    version: 1;
+    version: 1 | 2;
     /** Terraform address of the carved resource, e.g. `aws_s3_bucket.assets`. */
     target: string;
     /** Terraform resource type, when known. */
@@ -25,7 +33,13 @@ export interface CarveManifest {
     /** Recorded by `carve emit`. */
     emit?: {
         source: "tfstate" | "live";
-        /** Emitted chant source file path(s). */
+        /**
+         * Emitted chant source file path(s), relative to the manifest's directory
+         * (absolute in version-1 manifests). The manifest sits at the scaffolded
+         * project's root, so these are also project-root-relative — the same base
+         * `chant graph --format ir` uses for `sourceLoc.file`, which is the join
+         * from a carved Terraform address to the chant entity it became (#2040).
+         */
         files: string[];
         /**
          * Deferred outbound inputs declared as build parameters in the emitted
@@ -45,9 +59,10 @@ export interface CarveManifest {
     };
     /** Recorded by `carve bridge`. */
     bridge?: {
+        /** Files written, relative to the manifest's directory (absolute in version-1 manifests). */
         written: string[];
         appliedInPlace: boolean;
-        /** The git-applyable `.patch` carrying the whole survivor edit. */
+        /** The git-applyable `.patch` carrying the whole survivor edit, relative to the manifest's directory (absolute in version-1 manifests). */
         patch?: string;
         /** Carved addresses whose own `.tf` block the rewrites remove (#998). */
         excised?: string[];
@@ -57,7 +72,7 @@ export interface CarveManifest {
     apply?: {
         marker: OwnershipMarker;
         ownershipTags: Record<string, string>;
-        /** Emitted files the marker was stamped into (`--write-source`). */
+        /** Emitted files the marker was stamped into (`--write-source`), relative to the manifest's directory (absolute in version-1 manifests). */
         stampedFiles?: string[];
         at: string;
     };
@@ -66,9 +81,15 @@ export interface CarveManifest {
 export declare function carveSlug(target: string): string;
 /** Where the manifest for `target` lives inside an output dir. */
 export declare function carveManifestPath(outDir: string, target: string): string;
+/**
+ * Resolve a manifest-recorded file path against the manifest's directory.
+ * Absolute paths (version-1 manifests) pass through untouched, so both
+ * on-disk spellings read the same.
+ */
+export declare function resolveManifestFilePath(manifestDir: string, p: string): string;
 /** Write (or overwrite) a manifest into the output dir. Returns the path. */
 export declare function writeCarveManifest(outDir: string, manifest: CarveManifest): string;
-/** Read a manifest, or null when absent/unreadable/not a v1 manifest. */
+/** Read a manifest, or null when absent/unreadable/not a known-version manifest. */
 export declare function readCarveManifest(path: string): CarveManifest | null;
 /** All carve manifest paths in an output dir. */
 export declare function listCarveManifests(outDir: string): string[];
@@ -84,6 +105,10 @@ export interface ResolvedManifest {
  * several is an error naming what is (or is not) there.
  */
 export declare function resolveCarveManifest(outDir: string, select?: string): ResolvedManifest;
-/** Read-modify-write a section of an existing manifest. No-op when absent. */
+/**
+ * Read-modify-write a section of an existing manifest. No-op when absent.
+ * The whole manifest is re-normalized on write, so updating a version-1
+ * manifest also migrates its recorded paths to the relative contract.
+ */
 export declare function updateCarveManifest(outDir: string, target: string, patch: Partial<Pick<CarveManifest, "boundary" | "emit" | "bridge" | "apply">>): string | undefined;
 //# sourceMappingURL=manifest.d.ts.map

package/dist/terraform/manifest.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"manifest.d.ts","sourceRoot":"","sources":["../../src/terraform/manifest.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAIH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,SAAS,CAAC;AAC3C,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAEpD,eAAO,MAAM,qBAAqB,gBAAgB,CAAC;AAEnD,MAAM,WAAW,aAAa;IAC5B,OAAO,EAAE,CAAC,CAAC;IACX,6EAA6E;IAC7E,MAAM,EAAE,MAAM,CAAC;IACf,2CAA2C;IAC3C,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,iEAAiE;IACjE,IAAI,EAAE,MAAM,CAAC;IACb,qEAAqE;IACrE,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,uEAAuE;IACvE,QAAQ,EAAE,WAAW,CAAC;IACtB,gCAAgC;IAChC,IAAI,CAAC,EAAE;QACL,MAAM,EAAE,SAAS,GAAG,MAAM,CAAC;QAC3B,yCAAyC;QACzC,KAAK,EAAE,MAAM,EAAE,CAAC;QAChB;;;WAGG;QACH,MAAM,CAAC,EAAE,MAAM,CACb,MAAM,EACN;YACE,8EAA8E;YAC9E,MAAM,EAAE,MAAM,CAAC;YACf,mEAAmE;YACnE,QAAQ,EAAE,MAAM,CAAC;YACjB,kCAAkC;YAClC,KAAK,EAAE,MAAM,EAAE,CAAC;YAChB,2CAA2C;YAC3C,OAAO,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO,CAAC;SACrC,CACF,CAAC;QACF,EAAE,EAAE,MAAM,CAAC;KACZ,CAAC;IACF,kCAAkC;IAClC,MAAM,CAAC,EAAE;QACP,OAAO,EAAE,MAAM,EAAE,CAAC;QAClB,cAAc,EAAE,OAAO,CAAC;QACxB,mEAAmE;QACnE,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,yEAAyE;QACzE,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;QACnB,EAAE,EAAE,MAAM,CAAC;KACZ,CAAC;IACF,iCAAiC;IACjC,KAAK,CAAC,EAAE;QACN,MAAM,EAAE,eAAe,CAAC;QACxB,aAAa,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QACtC,oEAAoE;QACpE,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;QACxB,EAAE,EAAE,MAAM,CAAC;KACZ,CAAC;CACH;AAED,oFAAoF;AACpF,wBAAgB,SAAS,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAEhD;AAED,kEAAkE;AAClE,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,CAExE;AAED,6EAA6E;AAC7E,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,aAAa,GAAG,MAAM,CAKlF;AAED,yEAAyE;AACzE,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,GAAG,aAAa,GAAG,IAAI,CAUpE;AAED,iDAAiD;AACjD,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,CAM3D;AAED,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,EAAE,aAAa,CAAC;IACzB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED;;;;;GAKG;AACH,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,gBAAgB,CAsBtF;AAED,8EAA8E;AAC9E,wBAAgB,mBAAmB,CACjC,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,MAAM,EACd,KAAK,EAAE,OAAO,CAAC,IAAI,CAAC,aAAa,EAAE,UAAU,GAAG,MAAM,GAAG,QAAQ,GAAG,OAAO,CAAC,CAAC,GAC5E,MAAM,GAAG,SAAS,CAOpB"}
+{"version":3,"file":"manifest.d.ts","sourceRoot":"","sources":["../../src/terraform/manifest.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAIH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,SAAS,CAAC;AAC3C,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAEpD,eAAO,MAAM,qBAAqB,gBAAgB,CAAC;AAEnD;;;;;;GAMG;AACH,eAAO,MAAM,sBAAsB,IAAI,CAAC;AAExC,MAAM,WAAW,aAAa;IAC5B,OAAO,EAAE,CAAC,GAAG,CAAC,CAAC;IACf,6EAA6E;IAC7E,MAAM,EAAE,MAAM,CAAC;IACf,2CAA2C;IAC3C,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,iEAAiE;IACjE,IAAI,EAAE,MAAM,CAAC;IACb,qEAAqE;IACrE,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,uEAAuE;IACvE,QAAQ,EAAE,WAAW,CAAC;IACtB,gCAAgC;IAChC,IAAI,CAAC,EAAE;QACL,MAAM,EAAE,SAAS,GAAG,MAAM,CAAC;QAC3B;;;;;;WAMG;QACH,KAAK,EAAE,MAAM,EAAE,CAAC;QAChB;;;WAGG;QACH,MAAM,CAAC,EAAE,MAAM,CACb,MAAM,EACN;YACE,8EAA8E;YAC9E,MAAM,EAAE,MAAM,CAAC;YACf,mEAAmE;YACnE,QAAQ,EAAE,MAAM,CAAC;YACjB,kCAAkC;YAClC,KAAK,EAAE,MAAM,EAAE,CAAC;YAChB,2CAA2C;YAC3C,OAAO,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,OAAO,CAAC;SACrC,CACF,CAAC;QACF,EAAE,EAAE,MAAM,CAAC;KACZ,CAAC;IACF,kCAAkC;IAClC,MAAM,CAAC,EAAE;QACP,6FAA6F;QAC7F,OAAO,EAAE,MAAM,EAAE,CAAC;QAClB,cAAc,EAAE,OAAO,CAAC;QACxB,2IAA2I;QAC3I,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,yEAAyE;QACzE,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;QACnB,EAAE,EAAE,MAAM,CAAC;KACZ,CAAC;IACF,iCAAiC;IACjC,KAAK,CAAC,EAAE;QACN,MAAM,EAAE,eAAe,CAAC;QACxB,aAAa,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QACtC,4IAA4I;QAC5I,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;QACxB,EAAE,EAAE,MAAM,CAAC;KACZ,CAAC;CACH;AAED,oFAAoF;AACpF,wBAAgB,SAAS,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAEhD;AAED,kEAAkE;AAClE,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,CAExE;AAmCD;;;;GAIG;AACH,wBAAgB,uBAAuB,CAAC,WAAW,EAAE,MAAM,EAAE,CAAC,EAAE,MAAM,GAAG,MAAM,CAE9E;AAED,6EAA6E;AAC7E,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,aAAa,GAAG,MAAM,CAKlF;AAED,oFAAoF;AACpF,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,GAAG,aAAa,GAAG,IAAI,CAUpE;AAED,iDAAiD;AACjD,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,CAM3D;AAED,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,EAAE,aAAa,CAAC;IACzB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED;;;;;GAKG;AACH,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,gBAAgB,CAsBtF;AAED;;;;GAIG;AACH,wBAAgB,mBAAmB,CACjC,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,MAAM,EACd,KAAK,EAAE,OAAO,CAAC,IAAI,CAAC,aAAa,EAAE,UAAU,GAAG,MAAM,GAAG,QAAQ,GAAG,OAAO,CAAC,CAAC,GAC5E,MAAM,GAAG,SAAS,CAOpB"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@intentius/chant",
-  "version": "0.53.1",
+  "version": "0.54.1",
   "description": "Declarative infrastructure-as-code toolkit — TypeScript on Node.js",
   "license": "Apache-2.0",
   "homepage": "https://intentius.io/chant",

package/src/audit/catalog.ts

@@ -127,6 +127,22 @@ export const CF_STATIC_ASSETS: Authority = {
   name: "Cloudflare Workers — Static assets",
   url: "https://developers.cloudflare.com/workers/static-assets/",
 };
+export const MOZILLA_TLS: Authority = {
+  name: "Mozilla — Server Side TLS",
+  url: "https://wiki.mozilla.org/Security/Server_Side_TLS",
+};
+export const CWE_DIR_LISTING: Authority = {
+  name: "CWE-548 — Exposure of Information Through Directory Listing",
+  url: "https://cwe.mitre.org/data/definitions/548.html",
+};
+export const GIXY_ALIAS: Authority = {
+  name: "Gixy — alias traversal",
+  url: "https://github.com/yandex/gixy/blob/master/docs/en/plugins/aliastraversal.md",
+};
+export const NGINX_STUB_STATUS: Authority = {
+  name: "nginx — ngx_http_stub_status_module",
+  url: "https://nginx.org/en/docs/http/ngx_http_stub_status_module.html",
+};
 export const CWE_HARDCODED_CREDS: Authority = {
   name: "CWE-798 — Use of Hard-coded Credentials",
   url: "https://cwe.mitre.org/data/definitions/798.html",
@@ -197,6 +213,14 @@ export const RULE_CATEGORY: Record<string, Category> = {
   WRG004: "security",
   WRG005: "security",
   WRG006: "security",
+  // NGX — nginx config audit (#1979), lexicon-independent like SEC/WRG.
+  NGX001: "security",
+  NGX002: "security",
+  NGX003: "security",
+  NGX004: "security",
+  NGX005: "security",
+  NGX006: "best-practice",
+  NGX007: "best-practice",
   // AGT — agent configuration (`chant audit --agents`). Core-owned like COR/EXT:
   // these run against the machine's own agent config, not against any one
   // lexicon's emitted output, so no lexicon ships them.
@@ -247,6 +271,17 @@ export const RULE_CATALOG: Record<string, RuleMeta> = {
   WRG005: meta("WRG005", M, G, "Non-production environment shares a data store with production", "Give the non-production environment its own KV namespace/R2 bucket/D1 database id instead of reusing production's.", [CF_ENVIRONMENTS]),
   WRG006: meta("WRG006", M, G, "Static assets served from the project root", "Point [site].bucket / [assets].directory at a dedicated public output folder, not the project root, so non-public files (config, source maps, .git) aren't served.", [CF_STATIC_ASSETS]),
 
+  // nginx config audit (#1979, the #446 follow-up) — lexicon-independent,
+  // same shape as SEC/WRG: `nginx.ts` scans every nginx config it detects
+  // regardless of which (if any) audit lexicons are installed.
+  NGX001: meta("NGX001", M, G, "Deprecated TLS protocol enabled", "Remove SSLv2/SSLv3/TLSv1/TLSv1.1 from ssl_protocols and serve TLSv1.2 and TLSv1.3 only.", [MOZILLA_TLS]),
+  NGX002: meta("NGX002", M, G, "Weak cipher suite enabled", "Remove the RC4/DES/MD5/NULL/EXPORT-class entries from ssl_ciphers and use a modern cipher list (e.g. Mozilla's intermediate configuration).", [MOZILLA_TLS]),
+  NGX003: meta("NGX003", M, G, "Directory listing enabled", "Remove `autoindex on` (or scope it to a directory that is genuinely meant to be enumerated) so file listings aren't served to anyone who asks.", [CWE_DIR_LISTING]),
+  NGX004: meta("NGX004", M, G, "alias path traversal", "End the location prefix with \"/\" so it matches the trailing slash of the alias target — without it, a request for \"<prefix>../\" escapes the aliased directory.", [GIXY_ALIAS]),
+  NGX005: meta("NGX005", M, G, "Status endpoint with no access restriction", "Restrict the stub_status location with allow/deny (or auth_basic/auth_request) so connection metrics aren't public reconnaissance.", [NGINX_STUB_STATUS]),
+  NGX006: meta("NGX006", R, G, "Server version disclosure", "Add `server_tokens off;` in the http block so nginx stops advertising its exact version in the Server header and error pages."),
+  NGX007: meta("NGX007", R, G, "Access logging disabled at server scope", "Re-enable access_log at http/server scope (silencing a single noisy location is fine) so requests are recorded for incident investigation."),
+
   // ── Agent configuration (`chant audit --agents`) ──────────────────
   AGT001: agentMeta(
     "AGT001",

package/src/audit/discover.ts

@@ -33,6 +33,7 @@ import { basename, join, relative } from "path";
 import { parseYAML } from "../yaml";
 import type { LexiconPlugin } from "../lexicon";
 import type { AuditInput, AuditLexicon } from "./core";
+import { isNginxConfigPath } from "./nginx";
 
 /** Lexicons the auditor knows how to detect and run checks for. */
 export const AUDIT_LEXICONS = ["github", "gitlab", "forgejo", "k8s", "docker", "aws", "azure", "gcp", "helm", "fountain"] as const;
@@ -267,6 +268,15 @@ export function ciLexiconForPath(path: string): AuditLexicon | undefined {
 /**
  * Whether a path is worth reading/fetching at all. Bounds the local walk and,
  * crucially, the remote fetch (so we never pull a whole repo's contents).
+ *
+ * nginx configs (#1979) ride along the way `wrangler.toml` does: the NGX
+ * scanner (`./nginx.ts`) reads them directly, no lexicon plugin — but a
+ * scanner can only see what this filter admits, so its own path detector is
+ * part of the candidate set. (Found the hard way: the checks shipped wired
+ * into the CLI while no `.conf` ever survived collection, so they were
+ * unreachable on both the local and hosted paths.) Content confirmation —
+ * a `conf.d/` file that isn't nginx — happens at parse time in the scanner,
+ * never here.
  */
 export function isCandidatePath(path: string): boolean {
   const name = basename(path);
@@ -275,6 +285,7 @@ export function isCandidatePath(path: string): boolean {
   if (name === "Chart.yaml") return true;
   if (isSecretBearingName(name)) return true;
   if (isWranglerConfigName(name)) return true;
+  if (isNginxConfigPath(path)) return true;
   return /\.(ya?ml|json|template)$/i.test(name);
 }
 

package/src/audit/edge-init-safety.test.ts

@@ -54,8 +54,8 @@ function resolveRelative(from: string, spec: string): string | undefined {
   return undefined;
 }
 
-/** Static (non-type-only) imports and re-exports of a file, resolved to paths. */
-function staticImports(sf: ts.SourceFile): string[] {
+/** Static (non-type-only) import/re-export specifiers of a file. */
+function staticSpecifiers(sf: ts.SourceFile): string[] {
   const out: string[] = [];
   for (const stmt of sf.statements) {
     let spec: string | undefined;
@@ -66,7 +66,16 @@ function staticImports(sf: ts.SourceFile): string[] {
       if (stmt.isTypeOnly) continue;
       spec = (stmt.moduleSpecifier as ts.StringLiteral).text;
     }
-    if (!spec || !spec.startsWith(".")) continue;
+    if (spec) out.push(spec);
+  }
+  return out;
+}
+
+/** Static (non-type-only) imports and re-exports of a file, resolved to paths. */
+function staticImports(sf: ts.SourceFile): string[] {
+  const out: string[] = [];
+  for (const spec of staticSpecifiers(sf)) {
+    if (!spec.startsWith(".")) continue;
     const resolved = resolveRelative(sf.fileName, spec);
     if (resolved) out.push(resolved);
   }
@@ -171,4 +180,28 @@ describe("edge-imported lexicon modules are init-safe", () => {
     for (const sf of transitiveClosure(barrels()).values()) offenders.push(...moduleScopeOffenses(sf));
     expect(offenders, "move these into a function (lazy) — they crash edge bundles").toEqual([]);
   });
+
+  test("no static import of the full @intentius/chant barrel in the transitive import graph", () => {
+    // The relative-import walk above stops at package specifiers, and the bare
+    // core barrel is exactly the package import that must never appear: its
+    // static graph reaches build() → discovery/fold-import → the TypeScript
+    // compiler, whose own module init touches __filename and crashes workerd
+    // at startup. This is how WHM503's `../../render` import (whose render.ts
+    // imports `@intentius/chant` for Composite) broke the hosted audit's
+    // 0.53.1 bump. Subpath imports (`@intentius/chant/lint/post-synth`,
+    // `@intentius/chant/effect-receipt`, …) are the deliberately edge-clean
+    // seams and stay allowed.
+    const offenders: string[] = [];
+    for (const sf of transitiveClosure(barrels()).values()) {
+      for (const spec of staticSpecifiers(sf)) {
+        if (spec === "@intentius/chant") {
+          offenders.push(sf.fileName.replace(lexiconsDir, "lexicons"));
+        }
+      }
+    }
+    expect(
+      offenders,
+      "these edge-reachable modules import the full core barrel — import the specific subpath (or split the needed piece into a light module) instead",
+    ).toEqual([]);
+  });
 });

package/src/audit/nginx.test.ts

@@ -0,0 +1,180 @@
+import { describe, test, expect } from "vitest";
+import { auditNginxConfigs, isNginxConfigPath, parseNginx, NginxParseError, type ScannableFile } from "./nginx";
+import { RULE_CATALOG, RULE_CATEGORY } from "./catalog";
+
+const file = (content: string, path = "nginx.conf"): ScannableFile => ({ path, content });
+
+/** A minimal, otherwise-clean server (server_tokens off keeps NGX006 out of unrelated tests). */
+const wrap = (body: string): string => `http {\n  server_tokens off;\n  server {\n    listen 443 ssl;\n${body}\n  }\n}\n`;
+
+describe("isNginxConfigPath (detector)", () => {
+  test("accepts nginx.conf anywhere and .conf under nginx-ish directories", () => {
+    for (const p of [
+      "nginx.conf",
+      "deploy/nginx.conf",
+      "docker/nginx/default.conf",
+      "etc/nginx/conf.d/app.conf",
+      "nginx/sites-available/site.conf",
+      "nginx/sites-enabled/site.conf",
+      "etc/nginx/snippets/ssl.conf",
+    ]) {
+      expect(isNginxConfigPath(p), p).toBe(true);
+    }
+  });
+
+  test("rejects .conf files with no nginx-ish ancestry", () => {
+    for (const p of ["app.conf", "etc/systemd/system/app.service.d/override.conf", "supervisord.conf", "src/logrotate.conf"]) {
+      expect(isNginxConfigPath(p), p).toBe(false);
+    }
+  });
+});
+
+describe("parseNginx", () => {
+  test("parses directives, nested blocks, quotes, and comments with line numbers", () => {
+    const tree = parseNginx(
+      `# main\nworker_processes auto;\nhttp {\n  server {\n    listen 80; # inline comment\n    server_name "ex ample.com" 'two';\n  }\n}\n`,
+    );
+    expect(tree.map((d) => d.name)).toEqual(["worker_processes", "http"]);
+    expect(tree[0].line).toBe(2);
+    const server = tree[1].block![0];
+    expect(server.name).toBe("server");
+    expect(server.block!.map((d) => d.name)).toEqual(["listen", "server_name"]);
+    expect(server.block![0].line).toBe(5);
+    // Quoting keeps spaces and strips the quotes themselves.
+    expect(server.block![1].args).toEqual(["ex ample.com", "two"]);
+  });
+
+  test("throws NginxParseError on unbalanced braces and unterminated strings", () => {
+    expect(() => parseNginx("http { server {")).toThrow(NginxParseError);
+    expect(() => parseNginx("}")).toThrow(NginxParseError);
+    expect(() => parseNginx('server_name "unterminated;')).toThrow(NginxParseError);
+  });
+});
+
+describe("auditNginxConfigs — gating", () => {
+  test("a candidate that fails to parse contributes no findings (never a crash)", () => {
+    expect(auditNginxConfigs([file("http { { }")])).toEqual([]);
+  });
+
+  test("a .conf in a shared directory name that isn't nginx (no marker directive) contributes nothing", () => {
+    // systemd-style drop-in that happens to live under conf.d/
+    const systemd = file("[Service]\n", "conf.d/app.conf");
+    expect(auditNginxConfigs([systemd])).toEqual([]);
+    // Even nginx-looking directives without any marker stay silent.
+    expect(auditNginxConfigs([file("autoindex on;\n", "conf.d/x.conf")])).toEqual([]);
+  });
+
+  test("a non-candidate path is never scanned", () => {
+    expect(auditNginxConfigs([file(wrap("autoindex on;"), "README.md")])).toEqual([]);
+  });
+});
+
+describe("NGX001 — deprecated TLS protocols", () => {
+  test("flags SSLv3/TLSv1/TLSv1.1 with the offending names, keeps modern-only silent", () => {
+    const bad = auditNginxConfigs([file(wrap("    ssl_protocols SSLv3 TLSv1 TLSv1.1 TLSv1.2;"))]);
+    expect(bad).toHaveLength(1);
+    expect(bad[0].checkId).toBe("NGX001");
+    expect(bad[0].severity).toBe("error");
+    expect(bad[0].message).toContain("SSLv3");
+    expect(bad[0].line).toBeGreaterThan(1);
+
+    expect(auditNginxConfigs([file(wrap("    ssl_protocols TLSv1.2 TLSv1.3;"))])).toEqual([]);
+  });
+});
+
+describe("NGX002 — weak cipher suites", () => {
+  test("flags positive weak entries; exclusions (!RC4) and modern suites pass", () => {
+    const bad = auditNginxConfigs([file(wrap('    ssl_protocols TLSv1.2;\n    ssl_ciphers "HIGH:RC4-SHA:DES-CBC3-SHA";'))]);
+    expect(bad.map((f) => f.checkId)).toEqual(["NGX002"]);
+    expect(bad[0].message).toContain("RC4-SHA");
+
+    const good = auditNginxConfigs([
+      file(wrap('    ssl_protocols TLSv1.2;\n    ssl_ciphers "ECDHE-ECDSA-AES128-GCM-SHA256:!RC4:!MD5:!aNULL";')),
+    ]);
+    expect(good).toEqual([]);
+  });
+});
+
+describe("NGX003 — directory listing", () => {
+  test("flags autoindex on, not autoindex off", () => {
+    const bad = auditNginxConfigs([file(wrap("    location /files/ {\n      autoindex on;\n    }"))]);
+    expect(bad.map((f) => f.checkId)).toEqual(["NGX003"]);
+    expect(auditNginxConfigs([file(wrap("    autoindex off;"))])).toEqual([]);
+  });
+});
+
+describe("NGX004 — alias traversal", () => {
+  test("flags the gixy shape: prefix without trailing slash + alias with one", () => {
+    const bad = auditNginxConfigs([file(wrap("    location /i {\n      alias /data/w3/images/;\n    }"))]);
+    expect(bad.map((f) => f.checkId)).toEqual(["NGX004"]);
+    expect(bad[0].message).toContain("/i../");
+  });
+
+  test("slash-terminated prefixes, slashless alias targets, and regex locations pass", () => {
+    for (const body of [
+      "    location /i/ {\n      alias /data/w3/images/;\n    }",
+      "    location /i {\n      alias /data/w3/images;\n    }",
+      "    location ~ ^/img {\n      alias /data/w3/images/;\n    }",
+    ]) {
+      expect(auditNginxConfigs([file(wrap(body))]), body).toEqual([]);
+    }
+  });
+});
+
+describe("NGX005 — open status endpoint", () => {
+  test("flags stub_status with no restriction; allow/deny or auth_basic silences it", () => {
+    const bad = auditNginxConfigs([file(wrap("    location /nginx_status {\n      stub_status;\n    }"))]);
+    expect(bad.map((f) => f.checkId)).toEqual(["NGX005"]);
+
+    for (const guarded of [
+      "    location /nginx_status {\n      stub_status;\n      allow 127.0.0.1;\n      deny all;\n    }",
+      '    location /nginx_status {\n      stub_status;\n      auth_basic "metrics";\n    }',
+    ]) {
+      expect(auditNginxConfigs([file(wrap(guarded))]), guarded).toEqual([]);
+    }
+  });
+});
+
+describe("NGX006 — server version disclosure", () => {
+  test("flags an http block with no server_tokens off; the off switch (anywhere) silences it", () => {
+    const bare = auditNginxConfigs([file("http {\n  server {\n    listen 80;\n  }\n}\n")]);
+    expect(bare.map((f) => f.checkId)).toEqual(["NGX006"]);
+    expect(bare[0].severity).toBe("info");
+
+    expect(auditNginxConfigs([file("http {\n  server_tokens off;\n  server {\n    listen 80;\n  }\n}\n")])).toEqual([]);
+  });
+
+  test("a partial include with no http block is not flagged (the main conf owns this)", () => {
+    expect(auditNginxConfigs([file("server {\n  listen 80;\n}\n", "etc/nginx/conf.d/app.conf")])).toEqual([]);
+  });
+});
+
+describe("NGX007 — access logging disabled at server scope", () => {
+  test("flags http/server-scope access_log off; a single silenced location is normal practice", () => {
+    const bad = auditNginxConfigs([
+      file("http {\n  server_tokens off;\n  server {\n    listen 80;\n    access_log off;\n  }\n}\n"),
+    ]);
+    expect(bad.map((f) => f.checkId)).toEqual(["NGX007"]);
+
+    const ok = auditNginxConfigs([
+      file(
+        "http {\n  server_tokens off;\n  server {\n    listen 80;\n    location = /healthz {\n      access_log off;\n    }\n  }\n}\n",
+      ),
+    ]);
+    expect(ok).toEqual([]);
+  });
+});
+
+describe("catalog coverage", () => {
+  test("every NGX finding id has catalog metadata and a category mapping", () => {
+    for (const id of ["NGX001", "NGX002", "NGX003", "NGX004", "NGX005", "NGX006", "NGX007"]) {
+      expect(RULE_CATALOG[id], id).toBeDefined();
+      expect(RULE_CATALOG[id].remediation.length).toBeGreaterThan(0);
+      expect(RULE_CATEGORY[id], id).toBeDefined();
+    }
+    // The launch families carry external authority, per the epic's tiering goal.
+    for (const id of ["NGX001", "NGX002", "NGX003", "NGX004", "NGX005"]) {
+      expect(RULE_CATALOG[id].authority?.length, id).toBeGreaterThan(0);
+    }
+  });
+});