@methiu/raigal 0.2.6 → 0.2.7

package/dist/{version-DtOeK-2T.js → version-CXMYu17z.js}

@@ -1,6 +1,6 @@
 import "node:fs";
 import "node:url";
 //#region src/version.ts
-const APP_VERSION = "0.2.6";
+const APP_VERSION = "0.2.7";
 //#endregion
 export { APP_VERSION as t };

package/package.json

@@ -1,10 +1,10 @@
 {
 	"name": "@methiu/raigal",
-	"version": "0.2.6",
+	"version": "0.2.7",
 	"publishConfig": {
 		"access": "public"
 	},
-	"description": "Catch the slop AI coding agents leave in your code: narrative comments, swallowed exceptions, as-any casts, dead code, oversized functions. 50+ rules across 10 language targets (TypeScript, JavaScript, Expo / React Native, Python, Go, Rust, Ruby, PHP, C#, C/C++). Sub-second, deterministic, no LLM at runtime.",
+	"description": "Raigal CLI: a code-quality and security gate for AI-written code. Runs formatting, lint, code-quality, AI-pattern, architecture and security checks across 10 language targets and scores each change from 0 to 100.",
 	"type": "module",
 	"bin": {
 		"raigal": "dist/cli.js",
@@ -14,7 +14,9 @@
 	"files": [
 		"dist",
 		"scripts",
-		"tools/jb"
+		"tools/jb",
+		"LICENSE",
+		"THIRD_PARTY_NOTICES.md"
 	],
 	"exports": {
 		".": {
@@ -81,7 +83,8 @@
 		"cpp"
 	],
 	"author": {
-		"name": "Kenny Olawuwo",
+		"name": "Raigal",
+		"email": "matei@raigal.dev",
 		"url": "https://raigal.dev"
 	},
 	"license": "SEE LICENSE IN LICENSE",

package/scripts/check-tarball-keys.mjs

@@ -11,6 +11,15 @@ const ALLOWED_KEYS = new Set([]);
 const PH_KEY_PREFIX = `${"p" + "h" + "c"}_`;
 const PH_KEY_PATTERN = new RegExp(`${PH_KEY_PREFIX}[A-Za-z0-9_-]{20,}`, "g");
 
+// Signing-key and issuer overrides must never reach the published package.
+const FORBIDDEN_STRINGS = [
+	"RAIGAL_PUBLIC_KEY",
+	"RAIGAL_KEY_ID",
+	"RAIGAL_ISSUER",
+	"RAIGAL_TEST_PUBLIC_KEY",
+	"RAIGAL_TEST_KEY_ID",
+];
+
 const ROOT_DIR = path.resolve(import.meta.dirname, "..");
 
 const walkDirectory = (dir, callback) => {
@@ -60,11 +69,20 @@ try {
 
 	// 3. Scan all extracted files for unapproved PostHog keys
 	const unauthorizedKeys = [];
+	const forbiddenHits = [];
 
 	walkDirectory(packageDir, (filePath) => {
 		// Only check text / script / metadata files
 		try {
 			const content = fs.readFileSync(filePath, "utf-8");
+			const relFile = path.relative(packageDir, filePath).split(path.sep).join("/");
+			if (relFile.startsWith("dist/")) {
+				for (const needle of FORBIDDEN_STRINGS) {
+					if (content.includes(needle)) {
+						forbiddenHits.push({ needle, file: relFile });
+					}
+				}
+			}
 			const matches = content.match(PH_KEY_PATTERN);
 			if (matches) {
 				for (const match of matches) {
@@ -87,6 +105,14 @@ try {
 		process.exit(1);
 	}
 
+	if (forbiddenHits.length > 0) {
+		console.error("Tarball key check FAILED: signing-key overrides found in package:");
+		for (const item of forbiddenHits) {
+			console.error(`  - "${item.needle}" in file "${item.file}"`);
+		}
+		process.exit(1);
+	}
+
 	console.log("Tarball key check passed: No unauthorized PostHog keys found in package.");
 	process.exit(0);
 } catch (err) {