@nifrajs/cli 2.11.0 → 2.12.0

package/dist/rules/index.js

@@ -0,0 +1,133 @@
+import { isBuiltInCode } from "./codes.js";
+export function validateRulePacks(packs) {
+    if (packs === undefined)
+        return [];
+    const names = new Set();
+    const codes = new Set();
+    const normalized = [];
+    for (const pack of packs) {
+        if (typeof pack?.name !== "string" || pack.name.trim() === "")
+            throw new Error("rule pack name must be a non-empty string");
+        if (names.has(pack.name))
+            throw new Error(`duplicate rule pack: ${pack.name}`);
+        names.add(pack.name);
+        if (!Array.isArray(pack.rules))
+            throw new Error(`rule pack ${pack.name} must contain rules`);
+        const rules = [];
+        for (const rule of pack.rules) {
+            if (typeof rule?.code !== "string" ||
+                typeof rule.title !== "string" ||
+                typeof rule.scan !== "function") {
+                throw new Error(`rule pack ${pack.name} contains an invalid rule`);
+            }
+            if (rule.code.startsWith("NF-"))
+                throw new Error(`application rule pack code ${rule.code} uses the reserved NF- prefix`);
+            if (codes.has(rule.code))
+                throw new Error(`duplicate application rule code: ${rule.code}`);
+            codes.add(rule.code);
+            rules.push(rule);
+        }
+        normalized.push(Object.freeze({ name: pack.name, rules: Object.freeze(rules) }));
+    }
+    return Object.freeze(normalized);
+}
+export function parseRulePacks(value) {
+    if (value === undefined)
+        return [];
+    if (!Array.isArray(value))
+        throw new TypeError("rulePacks must be an array");
+    const packs = [];
+    for (const rawPack of value) {
+        if (typeof rawPack !== "object" || rawPack === null || Array.isArray(rawPack))
+            throw new TypeError("rule pack must be an object");
+        const packRecord = Object.fromEntries(Object.entries(rawPack));
+        const name = packRecord.name;
+        const rawRules = packRecord.rules;
+        if (typeof name !== "string" || !Array.isArray(rawRules))
+            throw new TypeError("rule pack requires a name and rules array");
+        const rules = [];
+        for (const rawRule of rawRules) {
+            if (typeof rawRule !== "object" || rawRule === null || Array.isArray(rawRule))
+                throw new TypeError(`rule pack ${name} contains an invalid rule`);
+            const ruleRecord = Object.fromEntries(Object.entries(rawRule));
+            if (typeof ruleRecord.code !== "string" ||
+                typeof ruleRecord.title !== "string" ||
+                typeof ruleRecord.scan !== "function") {
+                throw new TypeError(`rule pack ${name} contains an invalid rule`);
+            }
+            const scan = ruleRecord.scan;
+            rules.push({
+                code: ruleRecord.code,
+                title: ruleRecord.title,
+                scan: async (ctx) => {
+                    const result = await Reflect.apply(scan, undefined, [ctx]);
+                    if (!Array.isArray(result))
+                        throw new TypeError(`rule ${ruleRecord.code} did not return diagnostics`);
+                    const findings = [];
+                    for (const item of result) {
+                        if (typeof item !== "object" || item === null || Array.isArray(item))
+                            throw new TypeError(`rule ${ruleRecord.code} returned an invalid diagnostic`);
+                        const finding = Object.fromEntries(Object.entries(item));
+                        if (typeof finding.code !== "string" ||
+                            (finding.severity !== "error" &&
+                                finding.severity !== "warn" &&
+                                finding.severity !== "info") ||
+                            typeof finding.message !== "string") {
+                            throw new TypeError(`rule ${ruleRecord.code} returned an invalid diagnostic`);
+                        }
+                        const code = finding.code;
+                        const severity = finding.severity;
+                        const message = finding.message;
+                        const rawFix = typeof finding.fix === "object" && finding.fix !== null && !Array.isArray(finding.fix)
+                            ? Object.fromEntries(Object.entries(finding.fix))
+                            : undefined;
+                        findings.push({
+                            code,
+                            severity,
+                            message,
+                            ...(typeof finding.file === "string" ? { file: finding.file } : {}),
+                            ...(typeof finding.line === "number" ? { line: finding.line } : {}),
+                            ...(Array.isArray(finding.evidence)
+                                ? {
+                                    evidence: finding.evidence.filter((item) => typeof item === "string"),
+                                }
+                                : {}),
+                            ...(typeof rawFix?.recipe === "string"
+                                ? {
+                                    fix: {
+                                        recipe: rawFix.recipe,
+                                        ...(typeof rawFix.command === "string" ? { command: rawFix.command } : {}),
+                                    },
+                                }
+                                : {}),
+                            ...(typeof finding.verify === "string" ? { verify: finding.verify } : {}),
+                        });
+                    }
+                    return findings;
+                },
+            });
+        }
+        packs.push({ name, rules });
+    }
+    return validateRulePacks(packs);
+}
+export async function runRuleRegistry(ctx, builtIns, packs = []) {
+    const rules = [...builtIns, ...validateRulePacks(packs).flatMap((pack) => pack.rules)];
+    const out = [];
+    for (const rule of rules) {
+        if (isBuiltInCode(rule.code) === false && rule.code.startsWith("NF-")) {
+            throw new Error(`application rule pack code ${rule.code} uses the reserved NF- prefix`);
+        }
+        const findings = await rule.scan(ctx);
+        out.push(...findings);
+    }
+    return out;
+}
+export function sourceIndex(files) {
+    const map = new Map(files.map((file) => [file.file, file.content]));
+    return Object.freeze({
+        files: Object.freeze(files.map((file) => file.file)),
+        read: (file) => map.get(file),
+    });
+}
+//# sourceMappingURL=index.js.map

package/dist/rules/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/rules/index.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,aAAa,EAAE,MAAM,YAAY,CAAA;AAiC1C,MAAM,UAAU,iBAAiB,CAAC,KAAsC;IACtE,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,EAAE,CAAA;IAClC,MAAM,KAAK,GAAG,IAAI,GAAG,EAAU,CAAA;IAC/B,MAAM,KAAK,GAAG,IAAI,GAAG,EAAU,CAAA;IAC/B,MAAM,UAAU,GAAe,EAAE,CAAA;IACjC,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,IAAI,OAAO,IAAI,EAAE,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE;YAC3D,MAAM,IAAI,KAAK,CAAC,2CAA2C,CAAC,CAAA;QAC9D,IAAI,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,wBAAwB,IAAI,CAAC,IAAI,EAAE,CAAC,CAAA;QAC9E,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;QACpB,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,aAAa,IAAI,CAAC,IAAI,qBAAqB,CAAC,CAAA;QAC5F,MAAM,KAAK,GAAgB,EAAE,CAAA;QAC7B,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;YAC9B,IACE,OAAO,IAAI,EAAE,IAAI,KAAK,QAAQ;gBAC9B,OAAO,IAAI,CAAC,KAAK,KAAK,QAAQ;gBAC9B,OAAO,IAAI,CAAC,IAAI,KAAK,UAAU,EAC/B,CAAC;gBACD,MAAM,IAAI,KAAK,CAAC,aAAa,IAAI,CAAC,IAAI,2BAA2B,CAAC,CAAA;YACpE,CAAC;YACD,IAAI,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC;gBAC7B,MAAM,IAAI,KAAK,CAAC,8BAA8B,IAAI,CAAC,IAAI,+BAA+B,CAAC,CAAA;YACzF,IAAI,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC;gBAAE,MAAM,IAAI,KAAK,CAAC,oCAAoC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAA;YAC1F,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;YACpB,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;QAClB,CAAC;QACD,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAA;IAClF,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,CAAA;AAClC,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,KAAc;IAC3C,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,EAAE,CAAA;IAClC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,MAAM,IAAI,SAAS,CAAC,4BAA4B,CAAC,CAAA;IAC5E,MAAM,KAAK,GAAe,EAAE,CAAA;IAC5B,KAAK,MAAM,OAAO,IAAI,KAAK,EAAE,CAAC;QAC5B,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC;YAC3E,MAAM,IAAI,SAAS,CAAC,6BAA6B,CAAC,CAAA;QACpD,MAAM,UAAU,GAAG,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAA;QAC9D,MAAM,IAAI,GAAG,UAAU,CAAC,IAAI,CAAA;QAC5B,MAAM,QAAQ,GAAG,UAAU,CAAC,KAAK,CAAA;QACjC,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC;YACtD,MAAM,IAAI,SAAS,CAAC,2CAA2C,CAAC,CAAA;QAClE,MAAM,KAAK,GAAgB,EAAE,CAAA;QAC7B,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;YAC/B,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC;gBAC3E,MAAM,IAAI,SAAS,CAAC,aAAa,IAAI,2BAA2B,CAAC,CAAA;YACnE,MAAM,UAAU,GAAG,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAA;YAC9D,IACE,OAAO,UAAU,CAAC,IAAI,KAAK,QAAQ;gBACnC,OAAO,UAAU,CAAC,KAAK,KAAK,QAAQ;gBACpC,OAAO,UAAU,CAAC,IAAI,KAAK,UAAU,EACrC,CAAC;gBACD,MAAM,IAAI,SAAS,CAAC,aAAa,IAAI,2BAA2B,CAAC,CAAA;YACnE,CAAC;YACD,MAAM,IAAI,GAAG,UAAU,CAAC,IAAI,CAAA;YAC5B,KAAK,CAAC,IAAI,CAAC;gBACT,IAAI,EAAE,UAAU,CAAC,IAAI;gBACrB,KAAK,EAAE,UAAU,CAAC,KAAK;gBACvB,IAAI,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;oBAClB,MAAM,MAAM,GAAY,MAAM,OAAO,CAAC,KAAK,CAAC,IAAI,EAAE,SAAS,EAAE,CAAC,GAAG,CAAC,CAAC,CAAA;oBACnE,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;wBACxB,MAAM,IAAI,SAAS,CAAC,QAAQ,UAAU,CAAC,IAAI,6BAA6B,CAAC,CAAA;oBAC3E,MAAM,QAAQ,GAAiB,EAAE,CAAA;oBACjC,KAAK,MAAM,IAAI,IAAI,MAAM,EAAE,CAAC;wBAC1B,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC;4BAClE,MAAM,IAAI,SAAS,CAAC,QAAQ,UAAU,CAAC,IAAI,iCAAiC,CAAC,CAAA;wBAC/E,MAAM,OAAO,GAAG,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAA;wBACxD,IACE,OAAO,OAAO,CAAC,IAAI,KAAK,QAAQ;4BAChC,CAAC,OAAO,CAAC,QAAQ,KAAK,OAAO;gCAC3B,OAAO,CAAC,QAAQ,KAAK,MAAM;gCAC3B,OAAO,CAAC,QAAQ,KAAK,MAAM,CAAC;4BAC9B,OAAO,OAAO,CAAC,OAAO,KAAK,QAAQ,EACnC,CAAC;4BACD,MAAM,IAAI,SAAS,CAAC,QAAQ,UAAU,CAAC,IAAI,iCAAiC,CAAC,CAAA;wBAC/E,CAAC;wBACD,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAA;wBACzB,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAA;wBACjC,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,CAAA;wBAC/B,MAAM,MAAM,GACV,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ,IAAI,OAAO,CAAC,GAAG,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC;4BACpF,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;4BACjD,CAAC,CAAC,SAAS,CAAA;wBACf,QAAQ,CAAC,IAAI,CAAC;4BACZ,IAAI;4BACJ,QAAQ;4BACR,OAAO;4BACP,GAAG,CAAC,OAAO,OAAO,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;4BACnE,GAAG,CAAC,OAAO,OAAO,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;4BACnE,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC;gCACjC,CAAC,CAAC;oCACE,QAAQ,EAAE,OAAO,CAAC,QAAQ,CAAC,MAAM,CAC/B,CAAC,IAAI,EAAkB,EAAE,CAAC,OAAO,IAAI,KAAK,QAAQ,CACnD;iCACF;gCACH,CAAC,CAAC,EAAE,CAAC;4BACP,GAAG,CAAC,OAAO,MAAM,EAAE,MAAM,KAAK,QAAQ;gCACpC,CAAC,CAAC;oCACE,GAAG,EAAE;wCACH,MAAM,EAAE,MAAM,CAAC,MAAM;wCACrB,GAAG,CAAC,OAAO,MAAM,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;qCAC3E;iCACF;gCACH,CAAC,CAAC,EAAE,CAAC;4BACP,GAAG,CAAC,OAAO,OAAO,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;yBAC1E,CAAC,CAAA;oBACJ,CAAC;oBACD,OAAO,QAAQ,CAAA;gBACjB,CAAC;aACF,CAAC,CAAA;QACJ,CAAC;QACD,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAA;IAC7B,CAAC;IACD,OAAO,iBAAiB,CAAC,KAAK,CAAC,CAAA;AACjC,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,GAAgB,EAChB,QAA8B,EAC9B,QAA6B,EAAE;IAE/B,MAAM,KAAK,GAAG,CAAC,GAAG,QAAQ,EAAE,GAAG,iBAAiB,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAA;IACtF,MAAM,GAAG,GAAiB,EAAE,CAAA;IAC5B,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,IAAI,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,KAAK,IAAI,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,EAAE,CAAC;YACtE,MAAM,IAAI,KAAK,CAAC,8BAA8B,IAAI,CAAC,IAAI,+BAA+B,CAAC,CAAA;QACzF,CAAC;QACD,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;QACrC,GAAG,CAAC,IAAI,CAAC,GAAG,QAAQ,CAAC,CAAA;IACvB,CAAC;IACD,OAAO,GAAG,CAAA;AACZ,CAAC;AAED,MAAM,UAAU,WAAW,CAAC,KAA4B;IACtD,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAA;IACnE,OAAO,MAAM,CAAC,MAAM,CAAC;QACnB,KAAK,EAAE,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACpD,IAAI,EAAE,CAAC,IAAY,EAAE,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC;KACtC,CAAC,CAAA;AACJ,CAAC"}

package/dist/rules/legacy.d.ts

@@ -0,0 +1,7 @@
+import type { CheckRule } from "./index.js";
+/** Legacy rule name → stable NF- code. Exported so `nifra.check.json` rule overrides can be keyed
+ * by either name and still hit both diagnostic views. */
+export declare const LEGACY_RULE_CODES: Readonly<Record<string, string>>;
+/** Stable registry adapters for the existing source scanners. */
+export declare const legacyRules: readonly CheckRule[];
+//# sourceMappingURL=legacy.d.ts.map

package/dist/rules/legacy.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"legacy.d.ts","sourceRoot":"","sources":["../../src/rules/legacy.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,SAAS,EAAe,MAAM,YAAY,CAAA;AAExD;yDACyD;AACzD,eAAO,MAAM,iBAAiB,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAkB7D,CAAA;AAiEF,iEAAiE;AACjE,eAAO,MAAM,WAAW,EAAE,SAAS,SAAS,EAE3C,CAAA"}

package/dist/rules/legacy.js

@@ -0,0 +1,85 @@
+/** Legacy rule name → stable NF- code. Exported so `nifra.check.json` rule overrides can be keyed
+ * by either name and still hit both diagnostic views. */
+export const LEGACY_RULE_CODES = Object.freeze({
+    typecheck: "NF-C001",
+    "typed-client": "NF-C002",
+    "untyped-client": "NF-C003",
+    "server-only-import": "NF-C004",
+    "removed-import": "NF-C005",
+    "interpolated-sql": "NF-C006",
+    "response-route": "NF-C007",
+    "undeclared-dependency": "NF-C008",
+    "duplicate-install": "NF-C009",
+    "stale-workspace-dist": "NF-C010",
+    pipeline: "NF-C011",
+    "server-manifest-drift": "NF-C012",
+    "manifest-drift": "NF-C013",
+    "capability-assurance": "NF-C014",
+    "capability-config": "NF-C015",
+    "check-config": "NF-C016",
+    "contract-drift": "NF-K001",
+});
+const TITLES = Object.freeze({
+    typecheck: "TypeScript contract check",
+    "typed-client": "Typed client check",
+    "untyped-client": "Untyped client check",
+    "server-only-import": "Server-only import check",
+    "removed-import": "Removed import check",
+    "interpolated-sql": "Interpolated SQL check",
+    "response-route": "Raw response route advisory",
+    "undeclared-dependency": "Undeclared dependency check",
+    "duplicate-install": "Duplicate install check",
+    "stale-workspace-dist": "Stale workspace build check",
+    pipeline: "Build pipeline check",
+    "server-manifest-drift": "Server manifest drift check",
+    "manifest-drift": "Trust manifest drift check",
+    "capability-assurance": "Capability assurance check",
+    "capability-config": "Assurance configuration check",
+    "check-config": "Check configuration check",
+    "contract-drift": "Contract snapshot drift",
+});
+function recipeFor(finding) {
+    if (finding.rule === "stale-workspace-dist")
+        return { recipe: "workspace-dist.rebuild", command: "nifra fix --code NF-C010" };
+    if (finding.rule === "server-manifest-drift")
+        return { recipe: "manifest.sync", command: "nifra sync-manifest" };
+    if (finding.rule === "contract-drift")
+        return { recipe: "contracts.snapshot", command: "nifra contracts snapshot" };
+    return undefined;
+}
+function toDiagnostic(finding, code) {
+    const severity = finding.severity === "warning" ? "warn" : finding.severity;
+    const evidence = finding.evidence ?? finding.chain;
+    const fix = recipeFor(finding);
+    return Object.freeze({
+        code,
+        severity,
+        message: finding.message,
+        ...(finding.file === undefined ? {} : { file: finding.file }),
+        ...(finding.line === undefined ? {} : { line: finding.line }),
+        ...(evidence === undefined ? {} : { evidence }),
+        ...(fix === undefined ? {} : { fix }),
+        ...(finding.verify === undefined ? {} : { verify: finding.verify }),
+    });
+}
+function findingsFor(ctx, rule) {
+    const findings = ctx.project.legacyDiagnostics;
+    if (!Array.isArray(findings))
+        return [];
+    const code = LEGACY_RULE_CODES[rule];
+    if (code === undefined)
+        return [];
+    return findings
+        .filter((finding) => finding?.rule === rule)
+        .map((finding) => toDiagnostic(finding, code));
+}
+function makeRule(rule) {
+    const code = LEGACY_RULE_CODES[rule];
+    const title = TITLES[rule];
+    if (code === undefined || title === undefined)
+        throw new Error(`unknown legacy rule ${rule}`);
+    return Object.freeze({ code, title, scan: async (ctx) => findingsFor(ctx, rule) });
+}
+/** Stable registry adapters for the existing source scanners. */
+export const legacyRules = Object.freeze(Object.keys(LEGACY_RULE_CODES).map((name) => makeRule(name)));
+//# sourceMappingURL=legacy.js.map

package/dist/rules/legacy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"legacy.js","sourceRoot":"","sources":["../../src/rules/legacy.ts"],"names":[],"mappings":"AAIA;yDACyD;AACzD,MAAM,CAAC,MAAM,iBAAiB,GAAqC,MAAM,CAAC,MAAM,CAAC;IAC/E,SAAS,EAAE,SAAS;IACpB,cAAc,EAAE,SAAS;IACzB,gBAAgB,EAAE,SAAS;IAC3B,oBAAoB,EAAE,SAAS;IAC/B,gBAAgB,EAAE,SAAS;IAC3B,kBAAkB,EAAE,SAAS;IAC7B,gBAAgB,EAAE,SAAS;IAC3B,uBAAuB,EAAE,SAAS;IAClC,mBAAmB,EAAE,SAAS;IAC9B,sBAAsB,EAAE,SAAS;IACjC,QAAQ,EAAE,SAAS;IACnB,uBAAuB,EAAE,SAAS;IAClC,gBAAgB,EAAE,SAAS;IAC3B,sBAAsB,EAAE,SAAS;IACjC,mBAAmB,EAAE,SAAS;IAC9B,cAAc,EAAE,SAAS;IACzB,gBAAgB,EAAE,SAAS;CAC5B,CAAC,CAAA;AAEF,MAAM,MAAM,GAAqC,MAAM,CAAC,MAAM,CAAC;IAC7D,SAAS,EAAE,2BAA2B;IACtC,cAAc,EAAE,oBAAoB;IACpC,gBAAgB,EAAE,sBAAsB;IACxC,oBAAoB,EAAE,0BAA0B;IAChD,gBAAgB,EAAE,sBAAsB;IACxC,kBAAkB,EAAE,wBAAwB;IAC5C,gBAAgB,EAAE,6BAA6B;IAC/C,uBAAuB,EAAE,6BAA6B;IACtD,mBAAmB,EAAE,yBAAyB;IAC9C,sBAAsB,EAAE,6BAA6B;IACrD,QAAQ,EAAE,sBAAsB;IAChC,uBAAuB,EAAE,6BAA6B;IACtD,gBAAgB,EAAE,4BAA4B;IAC9C,sBAAsB,EAAE,4BAA4B;IACpD,mBAAmB,EAAE,+BAA+B;IACpD,cAAc,EAAE,2BAA2B;IAC3C,gBAAgB,EAAE,yBAAyB;CAC5C,CAAC,CAAA;AAEF,SAAS,SAAS,CAAC,OAAwB;IACzC,IAAI,OAAO,CAAC,IAAI,KAAK,sBAAsB;QACzC,OAAO,EAAE,MAAM,EAAE,wBAAwB,EAAE,OAAO,EAAE,0BAA0B,EAAE,CAAA;IAClF,IAAI,OAAO,CAAC,IAAI,KAAK,uBAAuB;QAC1C,OAAO,EAAE,MAAM,EAAE,eAAe,EAAE,OAAO,EAAE,qBAAqB,EAAE,CAAA;IACpE,IAAI,OAAO,CAAC,IAAI,KAAK,gBAAgB;QACnC,OAAO,EAAE,MAAM,EAAE,oBAAoB,EAAE,OAAO,EAAE,0BAA0B,EAAE,CAAA;IAC9E,OAAO,SAAS,CAAA;AAClB,CAAC;AAED,SAAS,YAAY,CAAC,OAAwB,EAAE,IAAY;IAC1D,MAAM,QAAQ,GAAa,OAAO,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAA;IACrF,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,OAAO,CAAC,KAAK,CAAA;IAClD,MAAM,GAAG,GAAG,SAAS,CAAC,OAAO,CAAC,CAAA;IAC9B,OAAO,MAAM,CAAC,MAAM,CAAC;QACnB,IAAI;QACJ,QAAQ;QACR,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,GAAG,CAAC,OAAO,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,CAAC;QAC7D,GAAG,CAAC,OAAO,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,CAAC;QAC7D,GAAG,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC;QAC/C,GAAG,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC;QACrC,GAAG,CAAC,OAAO,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC;KACpE,CAAC,CAAA;AACJ,CAAC;AAED,SAAS,WAAW,CAAC,GAAgB,EAAE,IAAY;IACjD,MAAM,QAAQ,GAAG,GAAG,CAAC,OAAO,CAAC,iBAAiB,CAAA;IAC9C,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC;QAAE,OAAO,EAAE,CAAA;IACvC,MAAM,IAAI,GAAG,iBAAiB,CAAC,IAAI,CAAC,CAAA;IACpC,IAAI,IAAI,KAAK,SAAS;QAAE,OAAO,EAAE,CAAA;IACjC,OAAO,QAAQ;SACZ,MAAM,CAAC,CAAC,OAAO,EAA8B,EAAE,CAAC,OAAO,EAAE,IAAI,KAAK,IAAI,CAAC;SACvE,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,YAAY,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC,CAAA;AAClD,CAAC;AAED,SAAS,QAAQ,CAAC,IAAY;IAC5B,MAAM,IAAI,GAAG,iBAAiB,CAAC,IAAI,CAAC,CAAA;IACpC,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,CAAA;IAC1B,IAAI,IAAI,KAAK,SAAS,IAAI,KAAK,KAAK,SAAS;QAAE,MAAM,IAAI,KAAK,CAAC,uBAAuB,IAAI,EAAE,CAAC,CAAA;IAC7F,OAAO,MAAM,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,GAAgB,EAAE,EAAE,CAAC,WAAW,CAAC,GAAG,EAAE,IAAI,CAAC,EAAE,CAAC,CAAA;AACjG,CAAC;AAED,iEAAiE;AACjE,MAAM,CAAC,MAAM,WAAW,GAAyB,MAAM,CAAC,MAAM,CAC5D,MAAM,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAC7D,CAAA"}

package/dist/rules/routes.d.ts

@@ -0,0 +1,12 @@
+import type { CheckRule } from "./index.js";
+export declare const reservedSegmentRule: CheckRule;
+/**
+ * NF-C019: the same method+path registered twice in one file - the later registration is dead or
+ * shadowing, and which one serves is a router implementation detail nobody should depend on.
+ * Scoped to a single file on purpose: two different apps in one repo (a monorepo with several
+ * backends) legitimately both register `GET /health`, and this scanner cannot tell app instances
+ * apart across files - so cross-file duplicates are NOT flagged rather than guessed at.
+ */
+export declare const duplicateRouteRule: CheckRule;
+export declare const routeRules: readonly CheckRule[];
+//# sourceMappingURL=routes.d.ts.map

package/dist/rules/routes.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"routes.d.ts","sourceRoot":"","sources":["../../src/rules/routes.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,SAAS,EAAe,MAAM,YAAY,CAAA;AA8ExD,eAAO,MAAM,mBAAmB,EAAE,SAiCjC,CAAA;AAED;;;;;;GAMG;AACH,eAAO,MAAM,kBAAkB,EAAE,SAgChC,CAAA;AAED,eAAO,MAAM,UAAU,sBAA2D,CAAA"}

package/dist/rules/routes.js

@@ -0,0 +1,142 @@
+import { diagnostic } from "../diagnostics.js";
+import { commentBlockHasMarker } from "./comment-markers.js";
+/**
+ * Route-table lints over the statically collected route registrations (`scanStaticRouteText` in
+ * ../check.ts fills `ctx.project.staticRoutes` during the source walk - no second scan here).
+ *
+ * NF-C018 exists because the typed client's proxy intercepts a fixed set of property names before
+ * path resolution (`resolveSegment` + the thenable guard in @nifrajs/client): the seven HTTP verbs
+ * (case-insensitively), `subscribe`, `ws`, `index`, and `then`. A route whose path contains a
+ * static segment spelling one of these cannot be reached by DOT ACCESS - `api.delete.post` resolves
+ * the DELETE verb, not the path. The typed spelling is a call on the parent node
+ * (`api.api("delete").post()`, treaty.ts `CollisionEscape`), and the client type rejects the dot
+ * access with the same guidance - so the collision is a warning that teaches the escape spelling,
+ * not a blocking error: the route IS reachable, just not by the spelling its name suggests.
+ */
+const RESERVED_VERB_SEGMENTS = new Set([
+    "get",
+    "post",
+    "put",
+    "patch",
+    "delete",
+    "head",
+    "options",
+]);
+// Intercepted by exact match only (`key === "subscribe"` etc.), unlike the lowercased verbs.
+const RESERVED_EXACT_SEGMENTS = new Set(["subscribe", "ws", "index", "then"]);
+const RESERVED_READOUT = "get/post/put/patch/delete/head/options (any casing), subscribe, ws, index, then";
+/** Opt-out pragma for a route deliberately served only to NON-typed-client consumers. */
+const RESERVED_SEGMENT_PRAGMA = "nifra-expect reserved-segment";
+/** Parse-don't-cast over the project fact: a malformed entry is dropped, never trusted. */
+function routeFacts(ctx) {
+    const raw = ctx.project.staticRoutes;
+    if (!Array.isArray(raw))
+        return [];
+    const out = [];
+    for (const item of raw) {
+        if (typeof item !== "object" || item === null)
+            continue;
+        const record = item;
+        if (typeof record.file === "string" &&
+            typeof record.line === "number" &&
+            typeof record.method === "string" &&
+            typeof record.path === "string") {
+            out.push({ file: record.file, line: record.line, method: record.method, path: record.path });
+        }
+    }
+    return out;
+}
+/**
+ * The typed escape spelling for a colliding segment, e.g. `/api/delete` + `delete` →
+ * `api("delete").post()` shown as the chain up to the collision. Best-effort readability: earlier
+ * segments render as dot access, the colliding one as the parent-node call.
+ */
+function routeEscapeHint(path, colliding) {
+    const segments = path.split("/").filter((segment) => segment !== "");
+    const before = segments.slice(0, Math.max(segments.indexOf(colliding), 0));
+    return `${["api", ...before].join(".")}("${colliding}")`;
+}
+/** The reserved key a static path segment collides with, or undefined. Params/wildcards never collide. */
+function reservedCollision(segment) {
+    if (segment.startsWith(":") || segment.startsWith("*"))
+        return undefined;
+    if (RESERVED_EXACT_SEGMENTS.has(segment))
+        return segment;
+    const lower = segment.toLowerCase();
+    return RESERVED_VERB_SEGMENTS.has(lower) ? lower : undefined;
+}
+export const reservedSegmentRule = {
+    code: "NF-C018",
+    title: "Route segment collides with a reserved client proxy key",
+    async scan(ctx) {
+        const findings = [];
+        const linesByFile = new Map();
+        for (const route of routeFacts(ctx)) {
+            for (const segment of route.path.split("/")) {
+                if (segment === "")
+                    continue;
+                const collision = reservedCollision(segment);
+                if (collision === undefined)
+                    continue;
+                let lines = linesByFile.get(route.file);
+                if (lines === undefined) {
+                    lines = (ctx.sources.read(route.file) ?? "").split("\n");
+                    linesByFile.set(route.file, lines);
+                }
+                if (commentBlockHasMarker(lines, route.line, RESERVED_SEGMENT_PRAGMA))
+                    continue;
+                findings.push(diagnostic({
+                    code: "NF-C018",
+                    severity: "warn",
+                    file: route.file,
+                    line: route.line,
+                    message: `${route.method} ${route.path} - segment '${segment}' collides with the reserved client proxy key '${collision}' (reserved: ${RESERVED_READOUT}); dot access cannot reach it - call the parent node with the segment instead (\`${routeEscapeHint(route.path, segment)}\`), rename the segment, or mark an intentionally non-typed-client route with \`// ${RESERVED_SEGMENT_PRAGMA}\` above the registration`,
+                    evidence: [`${route.method} ${route.path}`, `segment: ${segment}`],
+                    verify: "nifra check --lints-only",
+                }));
+                break; // one finding per route, even if several segments collide
+            }
+        }
+        return findings;
+    },
+};
+/**
+ * NF-C019: the same method+path registered twice in one file - the later registration is dead or
+ * shadowing, and which one serves is a router implementation detail nobody should depend on.
+ * Scoped to a single file on purpose: two different apps in one repo (a monorepo with several
+ * backends) legitimately both register `GET /health`, and this scanner cannot tell app instances
+ * apart across files - so cross-file duplicates are NOT flagged rather than guessed at.
+ */
+export const duplicateRouteRule = {
+    code: "NF-C019",
+    title: "Duplicate route registration",
+    async scan(ctx) {
+        const findings = [];
+        const byFile = new Map();
+        for (const route of routeFacts(ctx)) {
+            let seen = byFile.get(route.file);
+            if (seen === undefined) {
+                seen = new Map();
+                byFile.set(route.file, seen);
+            }
+            const key = `${route.method} ${route.path}`;
+            const first = seen.get(key);
+            if (first === undefined) {
+                seen.set(key, route);
+                continue;
+            }
+            findings.push(diagnostic({
+                code: "NF-C019",
+                severity: "error",
+                file: route.file,
+                line: route.line,
+                message: `${key} is registered twice in this file (first at line ${first.line}) - remove or rename one; which registration serves is undefined`,
+                evidence: [key, `first registration: line ${first.line}`],
+                verify: "nifra check --lints-only",
+            }));
+        }
+        return findings;
+    },
+};
+export const routeRules = Object.freeze([reservedSegmentRule, duplicateRouteRule]);
+//# sourceMappingURL=routes.js.map

package/dist/rules/routes.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"routes.js","sourceRoot":"","sources":["../../src/rules/routes.ts"],"names":[],"mappings":"AAAA,OAAO,EAAmB,UAAU,EAAE,MAAM,mBAAmB,CAAA;AAC/D,OAAO,EAAE,qBAAqB,EAAE,MAAM,sBAAsB,CAAA;AAG5D;;;;;;;;;;;;GAYG;AACH,MAAM,sBAAsB,GAAwB,IAAI,GAAG,CAAC;IAC1D,KAAK;IACL,MAAM;IACN,KAAK;IACL,OAAO;IACP,QAAQ;IACR,MAAM;IACN,SAAS;CACV,CAAC,CAAA;AACF,6FAA6F;AAC7F,MAAM,uBAAuB,GAAwB,IAAI,GAAG,CAAC,CAAC,WAAW,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC,CAAA;AAClG,MAAM,gBAAgB,GACpB,iFAAiF,CAAA;AAEnF,yFAAyF;AACzF,MAAM,uBAAuB,GAAG,+BAA+B,CAAA;AAS/D,2FAA2F;AAC3F,SAAS,UAAU,CAAC,GAAgB;IAClC,MAAM,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,YAAY,CAAA;IACpC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC;QAAE,OAAO,EAAE,CAAA;IAClC,MAAM,GAAG,GAAsB,EAAE,CAAA;IACjC,KAAK,MAAM,IAAI,IAAI,GAAG,EAAE,CAAC;QACvB,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,IAAI;YAAE,SAAQ;QACvD,MAAM,MAAM,GAAG,IAA+B,CAAA;QAC9C,IACE,OAAO,MAAM,CAAC,IAAI,KAAK,QAAQ;YAC/B,OAAO,MAAM,CAAC,IAAI,KAAK,QAAQ;YAC/B,OAAO,MAAM,CAAC,MAAM,KAAK,QAAQ;YACjC,OAAO,MAAM,CAAC,IAAI,KAAK,QAAQ,EAC/B,CAAC;YACD,GAAG,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC,CAAA;QAC9F,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAA;AACZ,CAAC;AAED;;;;GAIG;AACH,SAAS,eAAe,CAAC,IAAY,EAAE,SAAiB;IACtD,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,KAAK,EAAE,CAAC,CAAA;IACpE,MAAM,MAAM,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC,CAAC,CAAA;IAC1E,OAAO,GAAG,CAAC,KAAK,EAAE,GAAG,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,SAAS,IAAI,CAAA;AAC1D,CAAC;AAED,0GAA0G;AAC1G,SAAS,iBAAiB,CAAC,OAAe;IACxC,IAAI,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,OAAO,SAAS,CAAA;IACxE,IAAI,uBAAuB,CAAC,GAAG,CAAC,OAAO,CAAC;QAAE,OAAO,OAAO,CAAA;IACxD,MAAM,KAAK,GAAG,OAAO,CAAC,WAAW,EAAE,CAAA;IACnC,OAAO,sBAAsB,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAA;AAC9D,CAAC;AAED,MAAM,CAAC,MAAM,mBAAmB,GAAc;IAC5C,IAAI,EAAE,SAAS;IACf,KAAK,EAAE,yDAAyD;IAChE,KAAK,CAAC,IAAI,CAAC,GAAG;QACZ,MAAM,QAAQ,GAAiB,EAAE,CAAA;QACjC,MAAM,WAAW,GAAG,IAAI,GAAG,EAA6B,CAAA;QACxD,KAAK,MAAM,KAAK,IAAI,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;YACpC,KAAK,MAAM,OAAO,IAAI,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;gBAC5C,IAAI,OAAO,KAAK,EAAE;oBAAE,SAAQ;gBAC5B,MAAM,SAAS,GAAG,iBAAiB,CAAC,OAAO,CAAC,CAAA;gBAC5C,IAAI,SAAS,KAAK,SAAS;oBAAE,SAAQ;gBACrC,IAAI,KAAK,GAAG,WAAW,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;gBACvC,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;oBACxB,KAAK,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;oBACxD,WAAW,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,CAAA;gBACpC,CAAC;gBACD,IAAI,qBAAqB,CAAC,KAAK,EAAE,KAAK,CAAC,IAAI,EAAE,uBAAuB,CAAC;oBAAE,SAAQ;gBAC/E,QAAQ,CAAC,IAAI,CACX,UAAU,CAAC;oBACT,IAAI,EAAE,SAAS;oBACf,QAAQ,EAAE,MAAM;oBAChB,IAAI,EAAE,KAAK,CAAC,IAAI;oBAChB,IAAI,EAAE,KAAK,CAAC,IAAI;oBAChB,OAAO,EAAE,GAAG,KAAK,CAAC,MAAM,IAAI,KAAK,CAAC,IAAI,eAAe,OAAO,kDAAkD,SAAS,gBAAgB,gBAAgB,oFAAoF,eAAe,CAAC,KAAK,CAAC,IAAI,EAAE,OAAO,CAAC,sFAAsF,uBAAuB,2BAA2B;oBACvZ,QAAQ,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,IAAI,KAAK,CAAC,IAAI,EAAE,EAAE,YAAY,OAAO,EAAE,CAAC;oBAClE,MAAM,EAAE,0BAA0B;iBACnC,CAAC,CACH,CAAA;gBACD,MAAK,CAAC,0DAA0D;YAClE,CAAC;QACH,CAAC;QACD,OAAO,QAAQ,CAAA;IACjB,CAAC;CACF,CAAA;AAED;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAc;IAC3C,IAAI,EAAE,SAAS;IACf,KAAK,EAAE,8BAA8B;IACrC,KAAK,CAAC,IAAI,CAAC,GAAG;QACZ,MAAM,QAAQ,GAAiB,EAAE,CAAA;QACjC,MAAM,MAAM,GAAG,IAAI,GAAG,EAAwC,CAAA;QAC9D,KAAK,MAAM,KAAK,IAAI,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;YACpC,IAAI,IAAI,GAAG,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;YACjC,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;gBACvB,IAAI,GAAG,IAAI,GAAG,EAAE,CAAA;gBAChB,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,EAAE,IAAI,CAAC,CAAA;YAC9B,CAAC;YACD,MAAM,GAAG,GAAG,GAAG,KAAK,CAAC,MAAM,IAAI,KAAK,CAAC,IAAI,EAAE,CAAA;YAC3C,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;YAC3B,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;gBACxB,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAA;gBACpB,SAAQ;YACV,CAAC;YACD,QAAQ,CAAC,IAAI,CACX,UAAU,CAAC;gBACT,IAAI,EAAE,SAAS;gBACf,QAAQ,EAAE,OAAO;gBACjB,IAAI,EAAE,KAAK,CAAC,IAAI;gBAChB,IAAI,EAAE,KAAK,CAAC,IAAI;gBAChB,OAAO,EAAE,GAAG,GAAG,oDAAoD,KAAK,CAAC,IAAI,kEAAkE;gBAC/I,QAAQ,EAAE,CAAC,GAAG,EAAE,4BAA4B,KAAK,CAAC,IAAI,EAAE,CAAC;gBACzD,MAAM,EAAE,0BAA0B;aACnC,CAAC,CACH,CAAA;QACH,CAAC;QACD,OAAO,QAAQ,CAAA;IACjB,CAAC;CACF,CAAA;AAED,MAAM,CAAC,MAAM,UAAU,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,mBAAmB,EAAE,kBAAkB,CAAC,CAAC,CAAA"}

package/dist/rules/security.d.ts

@@ -0,0 +1,10 @@
+import type { CheckRule } from "./index.js";
+export declare const secretComparisonRule: CheckRule;
+export declare const piiLogRule: CheckRule;
+export declare const failOpenGateRule: CheckRule;
+export declare const corsOriginPredicateRule: CheckRule;
+export declare const externalRedirectRule: CheckRule;
+export declare const assuranceEscapeHatchRule: CheckRule;
+export declare const unprefixedSecureCookieRule: CheckRule;
+export declare const securityRules: readonly CheckRule[];
+//# sourceMappingURL=security.d.ts.map

package/dist/rules/security.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"security.d.ts","sourceRoot":"","sources":["../../src/rules/security.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,SAAS,EAAe,MAAM,YAAY,CAAA;AAmGxD,eAAO,MAAM,oBAAoB,EAAE,SA2DlC,CAAA;AAED,eAAO,MAAM,UAAU,EAAE,SA8CxB,CAAA;AAED,eAAO,MAAM,gBAAgB,EAAE,SAkD9B,CAAA;AAiBD,eAAO,MAAM,uBAAuB,EAAE,SA2DrC,CAAA;AAED,eAAO,MAAM,oBAAoB,EAAE,SA8ClC,CAAA;AAWD,eAAO,MAAM,wBAAwB,EAAE,SAuCtC,CAAA;AAID,eAAO,MAAM,0BAA0B,EAAE,SAsDxC,CAAA;AAED,eAAO,MAAM,aAAa,sBAQxB,CAAA"}