@nifrajs/cli 3.3.0 → 4.0.0

package/src/rules/security.ts

@@ -1,8 +1,10 @@
 import type * as TSApi from "typescript"
+import { isBrowserSource } from "../check-scan.ts"
 import { type Diagnostic, diagnostic } from "../diagnostics.ts"
-import { importProjectTypeScript } from "../internal/typescript-import.ts"
+import { scriptKindOf } from "../internal/script-kind.ts"
 import { commentBlockHasMarker } from "./comment-markers.ts"
 import type { CheckRule, SourceIndex } from "./index.ts"
+import { loadRuleTypeScript } from "./typescript.ts"
 
 /**
  * A security rule that cannot run says so as an advisory finding instead of silently returning no
@@ -42,17 +44,33 @@ function reviewedEvidence(lines: readonly string[], line: number): readonly stri
 
 /**
  * NF-S002 severity by file role. Server-side code compares real secret material - a timing oracle
- * there is exploitable, so it fails the gate. Client-bundled code (route modules, .tsx/.jsx)
+ * there is exploitable, so it fails the gate. Browser code (a route's frontend half, `frontend/`)
  * compares values the client already holds, so the same shape is advisory rather than a gate
- * failure. A server marker beats a client marker (`routes/x.server.ts` is server), and a plain .ts
- * that cannot be classified is treated as server - fail closed.
+ * failure. `shared/` also runs on the server, and a file that cannot be classified is treated as
+ * server - fail closed.
  */
 function secretComparisonSeverity(file: string): "error" | "warn" {
   const path = file.replaceAll("\\", "/")
-  if (/\.server\.[cm]?[tj]sx?$/.test(path)) return "error"
-  if (/(?:^|\/)server\//.test(path) || /(?:^|\/)backend\.[cm]?[tj]s$/.test(path)) return "error"
-  if (/\.[tj]sx$/.test(path) || /(?:^|\/)routes\//.test(path)) return "warn"
-  return "error"
+  if (!isBrowserSource(path) || /\.server\.[cm]?[tj]sx?$/.test(path)) return "error"
+  if (/\.shared\.[^/]+$/.test(path) || /(?:^|\/)shared\//.test(path)) return "error"
+  return "warn"
+}
+
+const CONFIRMATION_NAME =
+  /^(?:confirm|confirmation|confirmPassword|passwordConfirmation|passwordConfirm|passwordRepeat|repeatPassword)$/i
+
+/** Client form confirmation compares two values already held by the browser, not secret material. */
+function isClientConfirmationPair(
+  file: string,
+  left: string | undefined,
+  right: string | undefined,
+): boolean {
+  if (secretComparisonSeverity(file) !== "warn") return false
+  const names = [left, right]
+  return (
+    names.some((name) => name?.toLowerCase() === "password") &&
+    names.some((name) => name !== undefined && CONFIRMATION_NAME.test(name))
+  )
 }
 
 function nameOf(ts: typeof TSApi, node: TSApi.Node): string | undefined {
@@ -63,18 +81,20 @@ function nameOf(ts: typeof TSApi, node: TSApi.Node): string | undefined {
 
 /**
  * The operand name to match secret-like patterns against for NF-S002, or undefined when the operand
- * cannot hold runtime secret material. A property access to an uppercase-initial member
+ * cannot hold runtime secret material. A property access to a PascalCase member
  * (`ts.SyntaxKind.PlusToken`, `MediaKind.Audio`) reads an enum/type-constant discriminant, never a
  * secret string or byte buffer, so comparing against it is a kind check a timing oracle does not
- * apply to. Runtime secret fields follow the camelCase convention (`apiToken`, `signature`), so an
- * uppercase-initial member is a safe exclusion. Identifiers stay matched in every case, so an
- * `UPPER_SNAKE` secret constant still surfaces.
+ * apply to. An `UPPER_SNAKE` member is the configuration spelling (`process.env.API_TOKEN`,
+ * `env.WEBHOOK_SECRET`) and stays matched, as does a string-literal element access
+ * (`process.env["API_KEY"]`).
  */
 function secretName(ts: typeof TSApi, node: TSApi.Node): string | undefined {
   if (ts.isPropertyAccessExpression(node)) {
     const member = node.name.text
-    return /^[A-Z]/.test(member) ? undefined : member
+    return /^[A-Z]/.test(member) && !/^[A-Z][A-Z0-9_]*$/.test(member) ? undefined : member
   }
+  if (ts.isElementAccessExpression(node) && ts.isStringLiteralLike(node.argumentExpression))
+    return node.argumentExpression.text
   return nameOf(ts, node)
 }
 
@@ -99,8 +119,7 @@ function isPresenceComparison(ts: typeof TSApi, node: TSApi.BinaryExpression): b
 }
 
 function parse(ts: typeof TSApi, file: string, source: string): TSApi.SourceFile {
-  const kind = /\.tsx?$/.test(file) ? ts.ScriptKind.TSX : ts.ScriptKind.JS
-  return ts.createSourceFile(file, source, ts.ScriptTarget.Latest, true, kind)
+  return ts.createSourceFile(file, source, ts.ScriptTarget.Latest, true, scriptKindOf(ts, file))
 }
 
 function parsedFile(
@@ -123,62 +142,138 @@ function parsedFile(
   return parsed
 }
 
+interface SecretComparison {
+  readonly node: TSApi.BinaryExpression
+  readonly left: string | undefined
+  readonly right: string | undefined
+  readonly line: number
+}
+
+function secretComparisons(
+  ts: typeof TSApi,
+  file: string,
+  tree: TSApi.SourceFile,
+): readonly SecretComparison[] {
+  const operators = [
+    ts.SyntaxKind.EqualsEqualsEqualsToken,
+    ts.SyntaxKind.ExclamationEqualsEqualsToken,
+    ts.SyntaxKind.EqualsEqualsToken,
+    ts.SyntaxKind.ExclamationEqualsToken,
+  ]
+  const found: SecretComparison[] = []
+  const visit = (node: TSApi.Node): void => {
+    if (
+      ts.isBinaryExpression(node) &&
+      operators.includes(node.operatorToken.kind) &&
+      !isPresenceComparison(ts, node)
+    ) {
+      const left = secretName(ts, node.left)
+      const right = secretName(ts, node.right)
+      if (
+        ((left !== undefined && SECRET.test(left)) ||
+          (right !== undefined && SECRET.test(right))) &&
+        !isClientConfirmationPair(file, left, right)
+      ) {
+        const line = tree.getLineAndCharacterOfPosition(node.getStart(tree)).line + 1
+        found.push({ node, left, right, line })
+      }
+    }
+    ts.forEachChild(node, visit)
+  }
+  visit(tree)
+  return found
+}
+
+function timingSafeHelper(file: string): string {
+  const typed = /\.[cm]?tsx?$/.test(file)
+  return [
+    'import { timingSafeEqual as nifraTimingSafeEqualBytes } from "node:crypto"',
+    "",
+    typed
+      ? "function nifraTimingSafeEqual(left: string, right: string): boolean {"
+      : "function nifraTimingSafeEqual(left, right) {",
+    "  const leftBytes = Buffer.from(left)",
+    "  const rightBytes = Buffer.from(right)",
+    "  return leftBytes.length === rightBytes.length && nifraTimingSafeEqualBytes(leftBytes, rightBytes)",
+    "}",
+  ].join("\n")
+}
+
+/**
+ * Rewrite every unreviewed NF-S002 comparison in one file to `nifraTimingSafeEqual(left, right)` and
+ * add the helper once. Sites come from the syntax tree, not a reported line: the helper lands above
+ * them, so a line number a check run reported no longer names the same statement after the first fix.
+ */
+export function rewriteSecretComparisons(ts: typeof TSApi, file: string, source: string): string {
+  const tree = parse(ts, file, source)
+  const lines = tree.text.split("\n")
+  const sites = secretComparisons(ts, file, tree).filter((site) => !hasReview(lines, site.line))
+  // A comparison nested inside another (`(token === a) === flag`) is left for the next run, so every
+  // edit below covers a disjoint range and applying them from the end keeps earlier offsets valid.
+  const outer = sites.filter(
+    ({ node }) =>
+      !sites.some(
+        (other) => other.node !== node && other.node.pos >= node.pos && other.node.end <= node.end,
+      ),
+  )
+  if (outer.length === 0) return source
+  let text = source
+  for (const { node } of outer.toSorted((a, b) => b.node.end - a.node.end)) {
+    const call = `nifraTimingSafeEqual(${node.left.getText(tree)}, ${node.right.getText(tree)})`
+    const negated =
+      node.operatorToken.kind === ts.SyntaxKind.ExclamationEqualsEqualsToken ||
+      node.operatorToken.kind === ts.SyntaxKind.ExclamationEqualsToken
+    text = `${text.slice(0, node.getStart(tree))}${negated ? `!${call}` : call}${text.slice(node.end)}`
+  }
+  if (source.includes("function nifraTimingSafeEqual")) return text
+  // After a shebang and the directive prologue: an import above `"use client"` turns it into a no-op.
+  let at = 0
+  for (const statement of tree.statements) {
+    if (!ts.isExpressionStatement(statement) || !ts.isStringLiteral(statement.expression)) break
+    at = statement.end
+  }
+  if (at === 0 && text.startsWith("#!")) at = text.includes("\n") ? text.indexOf("\n") : text.length
+  const helper = timingSafeHelper(file)
+  return at === 0 ? `${helper}\n\n${text}` : `${text.slice(0, at)}\n\n${helper}\n${text.slice(at)}`
+}
+
 export const secretComparisonRule: CheckRule = {
   code: "NF-S002",
   title: "Non-constant-time secret comparison",
   async scan(ctx) {
-    const ts = await importProjectTypeScript(ctx.root)
+    const loaded = await loadRuleTypeScript(ctx)
+    if (loaded.diagnostics !== undefined) return loaded.diagnostics
+    const ts = loaded.compiler
     if (ts === undefined) return didNotRun("NF-S002", "Non-constant-time secret comparison scan")
     const findings: Diagnostic[] = []
     for (const file of ctx.project.source.files) {
       const parsed = parsedFile(ts, ctx.project.source, file)
       if (parsed === undefined) continue
       const { tree, lines } = parsed
-      const visit = (node: TSApi.Node): void => {
-        if (
-          ts.isBinaryExpression(node) &&
-          [
-            ts.SyntaxKind.EqualsEqualsEqualsToken,
-            ts.SyntaxKind.ExclamationEqualsEqualsToken,
-            ts.SyntaxKind.EqualsEqualsToken,
-            ts.SyntaxKind.ExclamationEqualsToken,
-          ].includes(node.operatorToken.kind) &&
-          !isPresenceComparison(ts, node)
-        ) {
-          const left = secretName(ts, node.left)
-          const right = secretName(ts, node.right)
-          if (
-            (left !== undefined && SECRET.test(left)) ||
-            (right !== undefined && SECRET.test(right))
-          ) {
-            const line = tree.getLineAndCharacterOfPosition(node.getStart(tree)).line + 1
-            const reviewed = hasReview(lines, line)
-            findings.push(
-              diagnostic({
-                code: "NF-S002",
-                severity: reviewed ? "info" : secretComparisonSeverity(file),
-                file,
-                line,
-                message: reviewed
-                  ? "secret comparison is explicitly marked as reviewed"
-                  : "secret-like values must use a length check and timing-safe comparison",
-                evidence: [left ?? right ?? "secret comparison", ...reviewedEvidence(lines, line)],
-                ...(reviewed
-                  ? {}
-                  : {
-                      fix: {
-                        recipe: "security.timing-safe-equal",
-                        command: "nifra fix --code NF-S002",
-                      },
-                    }),
-                verify: "nifra check --lints-only",
-              }),
-            )
-          }
-        }
-        ts.forEachChild(node, visit)
+      for (const { left, right, line } of secretComparisons(ts, file, tree)) {
+        const reviewed = hasReview(lines, line)
+        findings.push(
+          diagnostic({
+            code: "NF-S002",
+            severity: reviewed ? "info" : secretComparisonSeverity(file),
+            file,
+            line,
+            message: reviewed
+              ? "secret comparison is explicitly marked as reviewed"
+              : "secret-like values must use a length check and timing-safe comparison",
+            evidence: [left ?? right ?? "secret comparison", ...reviewedEvidence(lines, line)],
+            ...(reviewed
+              ? {}
+              : {
+                  fix: {
+                    recipe: "security.timing-safe-equal",
+                    command: "nifra fix --code NF-S002",
+                  },
+                }),
+            verify: "nifra check --lints-only",
+          }),
+        )
       }
-      visit(tree)
     }
     return findings
   },
@@ -188,7 +283,9 @@ export const piiLogRule: CheckRule = {
   code: "NF-S003",
   title: "Sensitive value in log call",
   async scan(ctx) {
-    const ts = await importProjectTypeScript(ctx.root)
+    const loaded = await loadRuleTypeScript(ctx)
+    if (loaded.diagnostics !== undefined) return loaded.diagnostics
+    const ts = loaded.compiler
     if (ts === undefined) return didNotRun("NF-S003", "Sensitive-value-in-log scan")
     const findings: Diagnostic[] = []
     for (const file of ctx.project.source.files) {
@@ -232,11 +329,37 @@ export const piiLogRule: CheckRule = {
   },
 }
 
+/**
+ * A function's own name, or for an anonymous arrow/function expression the name it is bound to
+ * (`const requireAuth = async () => …`, `{ canEdit: () => … }`), which is how a gate is usually written.
+ */
+function functionName(ts: typeof TSApi, fn: TSApi.Node): string | undefined {
+  if (ts.isFunctionLike(fn) && fn.name !== undefined)
+    return ts.isIdentifier(fn.name) ? fn.name.text : undefined
+  let binding = fn.parent
+  while (
+    binding !== undefined &&
+    (ts.isParenthesizedExpression(binding) ||
+      ts.isAsExpression(binding) ||
+      ts.isSatisfiesExpression(binding))
+  )
+    binding = binding.parent
+  if (
+    binding !== undefined &&
+    (ts.isVariableDeclaration(binding) || ts.isPropertyAssignment(binding)) &&
+    ts.isIdentifier(binding.name)
+  )
+    return binding.name.text
+  return undefined
+}
+
 export const failOpenGateRule: CheckRule = {
   code: "NF-S001",
   title: "Fail-open gate",
   async scan(ctx) {
-    const ts = await importProjectTypeScript(ctx.root)
+    const loaded = await loadRuleTypeScript(ctx)
+    if (loaded.diagnostics !== undefined) return loaded.diagnostics
+    const ts = loaded.compiler
     if (ts === undefined) return didNotRun("NF-S001", "Fail-open gate scan")
     const findings: Diagnostic[] = []
     for (const file of ctx.project.source.files) {
@@ -247,10 +370,7 @@ export const failOpenGateRule: CheckRule = {
         if (ts.isCatchClause(node)) {
           let parent: TSApi.Node | undefined = node.parent
           while (parent !== undefined && !ts.isFunctionLike(parent)) parent = parent.parent
-          const name =
-            ts.isFunctionLike(parent) && parent.name && ts.isIdentifier(parent.name)
-              ? parent.name.text
-              : undefined
+          const name = parent === undefined ? undefined : functionName(ts, parent)
           // `can` only names a gate in camelCase (`canEdit`, `canAccess`) - matching it
           // case-insensitively swept in `canonicalize…`, `cancel…`, `candidate…`, none of them
           // authorization decisions. The other roots stay case-insensitive.
@@ -317,7 +437,9 @@ export const corsOriginPredicateRule: CheckRule = {
   code: "NF-S004",
   title: "CORS origin predicate ignores the origin",
   async scan(ctx) {
-    const ts = await importProjectTypeScript(ctx.root)
+    const loaded = await loadRuleTypeScript(ctx)
+    if (loaded.diagnostics !== undefined) return loaded.diagnostics
+    const ts = loaded.compiler
     if (ts === undefined) return didNotRun("NF-S004", "CORS origin predicate scan")
     const findings: Diagnostic[] = []
     for (const file of ctx.project.source.files) {
@@ -378,7 +500,9 @@ export const externalRedirectRule: CheckRule = {
   code: "NF-S005",
   title: "External redirect opt-out",
   async scan(ctx) {
-    const ts = await importProjectTypeScript(ctx.root)
+    const loaded = await loadRuleTypeScript(ctx)
+    if (loaded.diagnostics !== undefined) return loaded.diagnostics
+    const ts = loaded.compiler
     if (ts === undefined) return didNotRun("NF-S005", "External redirect opt-out scan")
     const findings: Diagnostic[] = []
     for (const file of ctx.project.source.files) {
@@ -435,7 +559,9 @@ export const assuranceEscapeHatchRule: CheckRule = {
   code: "NF-S006",
   title: "Security escape hatch enabled",
   async scan(ctx) {
-    const ts = await importProjectTypeScript(ctx.root)
+    const loaded = await loadRuleTypeScript(ctx)
+    if (loaded.diagnostics !== undefined) return loaded.diagnostics
+    const ts = loaded.compiler
     if (ts === undefined) return didNotRun("NF-S006", "Security escape hatch scan")
     const findings: Diagnostic[] = []
     for (const file of ctx.project.source.files) {
@@ -478,7 +604,9 @@ export const unprefixedSecureCookieRule: CheckRule = {
   code: "NF-S007",
   title: "Secure cookie without a __Host-/__Secure- prefix",
   async scan(ctx) {
-    const ts = await importProjectTypeScript(ctx.root)
+    const loaded = await loadRuleTypeScript(ctx)
+    if (loaded.diagnostics !== undefined) return loaded.diagnostics
+    const ts = loaded.compiler
     if (ts === undefined) return didNotRun("NF-S007", "Secure cookie prefix scan")
     const findings: Diagnostic[] = []
     for (const file of ctx.project.source.files) {

package/src/rules/typescript.ts

@@ -0,0 +1,77 @@
+import type { Diagnostic } from "../diagnostics.ts"
+import {
+  loadProjectTypeScript,
+  type TypeScriptApi,
+  type TypeScriptSession,
+  unsupportedTypeScriptDiagnostic,
+} from "../internal/typescript-import.ts"
+import type { RuleContext } from "./index.ts"
+
+interface RuleTypeScriptLoad {
+  readonly compiler: TypeScriptApi | undefined
+  readonly session: TypeScriptSession | undefined
+  readonly diagnostics: readonly Diagnostic[] | undefined
+}
+
+interface SessionCacheEntry {
+  readonly pending: ReturnType<typeof loadProjectTypeScript>
+  leases: number
+}
+
+const sessionCache = new WeakMap<RuleContext["sources"], SessionCacheEntry>()
+
+function cachedLoad(ctx: RuleContext): SessionCacheEntry {
+  const cached = sessionCache.get(ctx.sources)
+  if (cached !== undefined) return cached
+  const entry: SessionCacheEntry = {
+    pending: loadProjectTypeScript(ctx.root, undefined, ctx.sources),
+    leases: 0,
+  }
+  sessionCache.set(ctx.sources, entry)
+  return entry
+}
+
+/** Retain a direct rule-registry session until the whole registry run has completed. */
+export function retainRuleTypeScript(ctx: RuleContext): void {
+  const entry = cachedLoad(ctx)
+  entry.leases += 1
+}
+
+/** Release a direct rule-registry session and terminate its TypeScript 7 worker when unused. */
+export async function releaseRuleTypeScript(ctx: RuleContext): Promise<void> {
+  const entry = sessionCache.get(ctx.sources)
+  if (entry === undefined) return
+  entry.leases = Math.max(0, entry.leases - 1)
+  if (entry.leases !== 0) return
+  sessionCache.delete(ctx.sources)
+  try {
+    const loaded = await entry.pending
+    await loaded.session?.close()
+  } catch {
+    // The scanner that consumed the same pending load owns the diagnostic for load failures.
+  }
+}
+
+/** Keep every AST-backed rule on the same project compiler session. */
+export async function loadRuleTypeScript(ctx: RuleContext): Promise<RuleTypeScriptLoad> {
+  if (ctx.project.check.unsupportedTypeScriptVersion !== undefined) {
+    // The check-wide loader already supplied the single structured failure diagnostic.
+    return { compiler: undefined, session: undefined, diagnostics: [] }
+  }
+  if (ctx.typescriptSession !== undefined) {
+    return {
+      compiler: ctx.typescriptSession.compiler,
+      session: ctx.typescriptSession,
+      diagnostics: undefined,
+    }
+  }
+  const loaded = await cachedLoad(ctx).pending
+  if (loaded.unsupported !== undefined) {
+    return {
+      compiler: undefined,
+      session: undefined,
+      diagnostics: [unsupportedTypeScriptDiagnostic(loaded.unsupported.version)],
+    }
+  }
+  return { compiler: loaded.compiler, session: loaded.session, diagnostics: undefined }
+}

package/src/rules/zones.ts

@@ -0,0 +1,195 @@
+/**
+ * NF-C028 and NF-C029: the frontend/backend zone rules, checked from source.
+ *
+ * Every browser build and dev server enforces these already; this reports them without building,
+ * with the same classifier (`@nifrajs/web/zones`) so the three can never disagree. NF-C004 owns
+ * browser code reaching server code (with the chain); NF-C028 owns the other directions: a zoned
+ * file importing one in no zone, backend code importing frontend code, and shared code importing
+ * anything but shared code. NF-C029 owns private environment reads in browser code.
+ */
+import { existsSync, readFileSync, realpathSync } from "node:fs"
+import { dirname, isAbsolute, join, relative } from "node:path"
+import {
+  type Classification,
+  createZoneClassifier,
+  importAllowed,
+  importRuleMessage,
+  privateEnvReads,
+  privateEnvReason,
+  type ZoneClassifier,
+} from "@nifrajs/web/zones"
+import { CONFIG_FILE, FRAMEWORK_FILE } from "../app-files.ts"
+import { importSites, stripComments } from "../check-scan.ts"
+import { type Diagnostic, diagnostic } from "../diagnostics.ts"
+import { codeUnitOrder } from "../internal/code-unit-order.ts"
+import type { CheckRule, RuleContext } from "./index.ts"
+
+const ZONE_FOLDER = new Set(["routes", "frontend", "backend", "shared"])
+const FRONTEND = new Set(["route-frontend", "frontend"])
+const SERVER = new Set(["backend", "route-backend", "fn"])
+const BACKEND = new Set(["backend", "route-backend"])
+const BROWSER_CODE = new Set(["route-frontend", "frontend", "shared"])
+const CODE_FILE = /\.(?:[cm]?[jt]sx?|svelte|vue|mdx)$/
+
+/** The app a project file belongs to: the path before its first zone folder, or `undefined`. */
+function appOf(file: string): string | undefined {
+  const parts = file.split("/")
+  const at = parts.findIndex((part, i) => i < parts.length - 1 && ZONE_FOLDER.has(part))
+  return at === -1 ? undefined : parts.slice(0, at).join("/")
+}
+
+interface ZonedFile {
+  readonly file: string
+  readonly app: string
+  readonly classification: Classification
+}
+
+/** Every scanned source file that belongs to an app, classified once per app classifier. */
+export function zonedFiles(ctx: RuleContext): {
+  readonly files: readonly ZonedFile[]
+  readonly classifierFor: (app: string) => ZoneClassifier
+} {
+  const classifiers = new Map<string, ZoneClassifier>()
+  const classifierFor = (app: string): ZoneClassifier => {
+    let classifier = classifiers.get(app)
+    if (classifier === undefined) {
+      const appRoot = join(ctx.root, app)
+      classifier = createZoneClassifier({
+        appRoot,
+        generatedFiles: [join(appRoot, "server-manifest.ts")],
+      })
+      classifiers.set(app, classifier)
+    }
+    return classifier
+  }
+  const files: ZonedFile[] = []
+  for (const file of ctx.sources.files) {
+    if (!CODE_FILE.test(file)) continue
+    const app = appOf(file)
+    if (app === undefined) continue
+    files.push({ file, app, classification: classifierFor(app).classify(join(ctx.root, file)) })
+  }
+  return { files, classifierFor }
+}
+
+const real = (path: string): string => {
+  try {
+    return realpathSync(path)
+  } catch {
+    return path
+  }
+}
+
+/** Where a resolved import lands, as the project names it. Both sides are real paths: a checkout
+ * reached through a symlink (`/var` -> `/private/var` on macOS) still names files project-relative. */
+function display(root: string, file: string): string {
+  const rel = relative(real(root), real(file)).replaceAll("\\", "/")
+  return rel.startsWith("../") || isAbsolute(rel) ? file : rel
+}
+
+/** A relative import resolved against the importing file, or `undefined` when it does not resolve. */
+function resolveRelative(root: string, from: string, specifier: string): string | undefined {
+  if (!specifier.startsWith("./") && !specifier.startsWith("../")) return undefined
+  try {
+    // Relative specifiers only: a bare one would let the resolver reach for a global install.
+    return Bun.resolveSync(specifier, dirname(join(root, from)))
+  } catch {
+    return undefined
+  }
+}
+
+export const zoneImportRule: CheckRule = {
+  code: "NF-C028",
+  title: "Zone import check",
+  async scan(ctx) {
+    const { files, classifierFor } = zonedFiles(ctx)
+    const findings: Diagnostic[] = []
+    for (const { file, app, classification: from } of files) {
+      if (from.zone === "error" || from.zone === "library" || from.zone === "generated") continue
+      const content = ctx.sources.read(file)
+      if (content === undefined) continue
+      for (const { specifier, line } of importSites(content, file)) {
+        const target = resolveRelative(ctx.root, file, specifier)
+        if (target === undefined) continue
+        const to = classifierFor(app).classify(target)
+        const targetName = display(ctx.root, target)
+        let message: string
+        if (to.zone === "error") message = `${file} imports ${targetName}: ${to.reason}`
+        else if (
+          (SERVER.has(from.zone) && FRONTEND.has(to.zone)) ||
+          // Shared code reaching backend code is NF-C004's, reported there with the chain.
+          (from.zone === "shared" && !importAllowed(from.zone, to.zone) && !BACKEND.has(to.zone))
+        ) {
+          message = importRuleMessage(file, from.zone, targetName, to.zone)
+        } else continue
+        findings.push(
+          diagnostic({
+            code: "NF-C028",
+            severity: "error",
+            file,
+            line,
+            message,
+            evidence: [`import: ${specifier}`, `from zone: ${from.zone}`, `to zone: ${to.zone}`],
+            verify: "nifra check",
+          }),
+        )
+      }
+    }
+    return findings.sort(
+      (a, b) => codeUnitOrder(a.file ?? "", b.file ?? "") || (a.line ?? 0) - (b.line ?? 0),
+    )
+  },
+}
+
+const PREFIX_EXPORT =
+  /\bexport\s+const\s+publicEnvPrefix\s*(?::\s*string\s*)?=\s*(?:"([^"\\\r\n]*)"|'([^'\\\r\n]*)')/
+
+/** The app's public-env prefix when its config declares it as a string literal, else the default. */
+function publicPrefix(root: string, app: string): string {
+  for (const config of [FRAMEWORK_FILE, CONFIG_FILE]) {
+    const path = join(root, app, config)
+    if (!existsSync(path)) continue
+    const match = PREFIX_EXPORT.exec(stripComments(readFileSync(path, "utf8")))
+    if (match !== null) return match[1] ?? match[2] ?? "PUBLIC_"
+  }
+  return "PUBLIC_"
+}
+
+export const privateEnvRule: CheckRule = {
+  code: "NF-C029",
+  title: "Private environment read in browser code",
+  async scan(ctx) {
+    const { files } = zonedFiles(ctx)
+    const prefixes = new Map<string, string>()
+    const findings: Diagnostic[] = []
+    for (const { file, app, classification } of files) {
+      if (!BROWSER_CODE.has(classification.zone)) continue
+      const content = ctx.sources.read(file)
+      if (content === undefined) continue
+      let prefix = prefixes.get(app)
+      if (prefix === undefined) {
+        prefix = publicPrefix(ctx.root, app)
+        prefixes.set(app, prefix)
+      }
+      const reads = privateEnvReads(file, content, prefix)
+      if (reads.length === 0) continue
+      const first = reads[0] ?? ""
+      const name = /[.[(]["']?([A-Za-z_$][\w$]*)["']?[)\]]?$/.exec(first)?.[1]
+      const index = name === undefined ? -1 : content.indexOf(name)
+      findings.push(
+        diagnostic({
+          code: "NF-C029",
+          severity: "error",
+          file,
+          ...(index === -1 ? {} : { line: content.slice(0, index).split("\n").length }),
+          message: `${file} ${privateEnvReason(reads, prefix)}`,
+          evidence: reads.map((read) => `read: ${read}`),
+          verify: "nifra check",
+        }),
+      )
+    }
+    return findings
+  },
+}
+
+export const zoneRules = Object.freeze([zoneImportRule, privateEnvRule])