@nifrajs/cli 3.5.0 → 4.0.2

package/dist/rules/routes.js

@@ -1,4 +1,6 @@
 import { RESERVED_KEY_READOUT, reservedKeyFor } from "@nifrajs/client";
+import { RoutePatternOverlapLimitError, routePatternOverlap } from "@nifrajs/core";
+import { expandOptionalParams, paramConstraint } from "@nifrajs/core/pattern";
 import { diagnostic } from "../diagnostics.js";
 import { commentBlockHasMarker } from "./comment-markers.js";
 /**
@@ -20,6 +22,8 @@ import { commentBlockHasMarker } from "./comment-markers.js";
  */
 /** Opt-out pragma for a route deliberately served only to NON-typed-client consumers. */
 const RESERVED_SEGMENT_PRAGMA = "nifra-expect reserved-segment";
+const ROUTE_OVERLAP_PRAGMA = "nifra-expect route-overlap";
+const PARAM_MODIFIER_PRAGMA = "nifra-expect param-modifier";
 /** Parse-don't-cast over the project fact: a malformed entry is dropped, never trusted. */
 function routeFacts(ctx) {
     const raw = ctx.project.routes;
@@ -37,6 +41,17 @@ function routeFacts(ctx) {
     }
     return out;
 }
+/** One fact per registration site, so `all()` or `method([...])` reports its path once, not per method. */
+function pathSites(routes) {
+    const seen = new Set();
+    return routes.filter((route) => {
+        const site = `${route.file}\n${route.line}\n${route.path}`;
+        if (seen.has(site))
+            return false;
+        seen.add(site);
+        return true;
+    });
+}
 /**
  * The typed escape spelling for a colliding segment, e.g. `/api/delete` + `delete` →
  * `api("delete").post()` shown as the chain up to the collision. Best-effort readability: earlier
@@ -53,7 +68,7 @@ export const reservedSegmentRule = {
     async scan(ctx) {
         const findings = [];
         const linesByFile = new Map();
-        for (const route of routeFacts(ctx)) {
+        for (const route of pathSites(routeFacts(ctx))) {
             for (const segment of route.path.split("/")) {
                 if (segment === "")
                     continue;
@@ -98,6 +113,9 @@ export const duplicateRouteRule = {
     async scan(ctx) {
         const findings = [];
         const byFile = new Map();
+        // Two calls that each register several methods collide once per shared method; that is one
+        // pair of lines to fix, so it is reported once.
+        const reported = new Set();
         for (const route of routeFacts(ctx)) {
             let seen = byFile.get(route.file);
             if (seen === undefined) {
@@ -110,6 +128,10 @@ export const duplicateRouteRule = {
                 seen.set(key, route);
                 continue;
             }
+            const pair = `${route.file}\n${route.line}\n${first.line}\n${route.path}`;
+            if (reported.has(pair))
+                continue;
+            reported.add(pair);
             findings.push(diagnostic({
                 code: "NF-C019",
                 severity: "error",
@@ -123,5 +145,161 @@ export const duplicateRouteRule = {
         return findings;
     },
 };
-export const routeRules = Object.freeze([reservedSegmentRule, duplicateRouteRule]);
+/**
+ * NF-C024: two different same-method route patterns in one source file accept at least one of the
+ * same paths. This is deliberately file-scoped, like NF-C019: the static scanner cannot prove
+ * which application instance owns routes collected from different files in a monorepo.
+ */
+export const overlappingRouteRule = {
+    code: "NF-C024",
+    title: "Overlapping route registration",
+    async scan(ctx) {
+        const findings = [];
+        const linesByFile = new Map();
+        const byFile = new Map();
+        for (const route of routeFacts(ctx)) {
+            const routes = byFile.get(route.file);
+            if (routes === undefined)
+                byFile.set(route.file, [route]);
+            else
+                routes.push(route);
+        }
+        // As in NF-C019: two multi-method calls overlap once per shared method, reported once.
+        const reported = new Set();
+        for (const [file, routes] of byFile) {
+            const lines = () => {
+                let value = linesByFile.get(file);
+                if (value === undefined) {
+                    value = (ctx.project.source.read(file) ?? "").split("\n");
+                    linesByFile.set(file, value);
+                }
+                return value;
+            };
+            for (let laterIndex = 0; laterIndex < routes.length; laterIndex += 1) {
+                const later = routes[laterIndex];
+                const laterKey = `${later.method} ${later.path}`;
+                for (let earlierIndex = 0; earlierIndex < laterIndex; earlierIndex += 1) {
+                    const earlier = routes[earlierIndex];
+                    if (earlier.method !== later.method || `${earlier.method} ${earlier.path}` === laterKey)
+                        continue;
+                    if (commentBlockHasMarker(lines(), later.line, ROUTE_OVERLAP_PRAGMA))
+                        continue;
+                    if (commentBlockHasMarker(lines(), earlier.line, ROUTE_OVERLAP_PRAGMA))
+                        continue;
+                    let witness;
+                    try {
+                        witness = routePatternOverlap(earlier.path, later.path);
+                    }
+                    catch (error) {
+                        if (error instanceof RoutePatternOverlapLimitError) {
+                            findings.push(diagnostic({
+                                code: "NF-C025",
+                                severity: "error",
+                                file: later.file,
+                                line: later.line,
+                                message: `${laterKey} could not be proven disjoint from ${earlier.method} ${earlier.path}; bounded route-overlap analysis exceeded its safety budget - simplify the patterns or add the ${ROUTE_OVERLAP_PRAGMA} comment only after manual review`,
+                                evidence: [
+                                    `${earlier.method} ${earlier.path}`,
+                                    `${later.method} ${later.path}`,
+                                    `first registration: line ${earlier.line}`,
+                                ],
+                                verify: "nifra check --lints-only",
+                            }));
+                        }
+                        // The primary route parser diagnostic owns malformed route patterns. A secondary lint
+                        // must remain total and never turn an invalid route into a checker crash.
+                        continue;
+                    }
+                    if (witness === undefined)
+                        continue;
+                    const pair = `${file}\n${later.line}\n${later.path}\n${earlier.line}\n${earlier.path}`;
+                    if (reported.has(pair))
+                        break;
+                    reported.add(pair);
+                    findings.push(diagnostic({
+                        code: "NF-C024",
+                        severity: "error",
+                        file: later.file,
+                        line: later.line,
+                        message: `${laterKey} overlaps ${earlier.method} ${earlier.path} (first at line ${earlier.line}); witness path: ${witness} - make the patterns disjoint, order them intentionally with a pragma, or add the ${ROUTE_OVERLAP_PRAGMA} comment above either registration`,
+                        evidence: [
+                            `${earlier.method} ${earlier.path}`,
+                            `${later.method} ${later.path}`,
+                            `witness: ${witness}`,
+                            `first registration: line ${earlier.line}`,
+                        ],
+                        verify: "nifra check --lints-only",
+                    }));
+                    break;
+                }
+            }
+        }
+        return findings;
+    },
+};
+/** A param name directly followed by a character other routers read as a modifier. */
+const PARAM_MODIFIER = /:[A-Za-z_][A-Za-z0-9_]*[?*+{(<]/g;
+/**
+ * The first param in `path` whose modifier the router reads as literal text. A `{...}` group the
+ * router reads as a constraint (`:id{[0-9]+}`, `:ext{png|jpg}`) is syntax, so it is passed over.
+ */
+function literalModifier(path) {
+    PARAM_MODIFIER.lastIndex = 0;
+    for (let found = PARAM_MODIFIER.exec(path); found !== null; found = PARAM_MODIFIER.exec(path)) {
+        const text = found[0];
+        if (!text.endsWith("{"))
+            return text;
+        const constraint = paramConstraint(path.slice(PARAM_MODIFIER.lastIndex - 1));
+        if (constraint === undefined)
+            return text;
+        const end = PARAM_MODIFIER.lastIndex + constraint.source.length + 1;
+        // A modifier after the constraint is literal text like any other (`:id{[0-9]+}?/posts`).
+        if ("?*+{(<".includes(path[end] ?? "/"))
+            return path.slice(found.index, end + 1);
+        PARAM_MODIFIER.lastIndex = end;
+    }
+    return undefined;
+}
+/**
+ * NF-C026: a param followed by `?`, `*`, `+`, `{`, `(` or `<` that the router reads as literal text
+ * (`/users/:id?/posts`, `/users/:id{int}`). Only a trailing `?` run and a valid `{...}` are syntax.
+ */
+export const paramModifierRule = {
+    code: "NF-C026",
+    title: "Route param followed by an unsupported modifier",
+    async scan(ctx) {
+        const findings = [];
+        const linesByFile = new Map();
+        for (const route of pathSites(routeFacts(ctx))) {
+            const forms = expandOptionalParams(route.path);
+            const text = literalModifier(forms[forms.length - 1] ?? route.path);
+            if (text === undefined)
+                continue;
+            let lines = linesByFile.get(route.file);
+            if (lines === undefined) {
+                lines = (ctx.project.source.read(route.file) ?? "").split("\n");
+                linesByFile.set(route.file, lines);
+            }
+            if (commentBlockHasMarker(lines, route.line, PARAM_MODIFIER_PRAGMA))
+                continue;
+            const character = text[text.length - 1];
+            findings.push(diagnostic({
+                code: "NF-C026",
+                severity: "warn",
+                file: route.file,
+                line: route.line,
+                message: `${route.method} ${route.path} - '${character}' after '${text.slice(0, -1)}' is matched as literal text, not as a param modifier${character === "?" ? "; a request path never contains '?', so this route cannot be reached" : ""}. Optional params are supported as the trailing whole segments of a path (\`/users/:id?\`, \`/d/:year?/:month?\`), and a constraint as one character class with an optional count (\`:id{[0-9]+}\`, \`:code{[A-Z]{2}}\`) or a list of two or more values (\`:ext{png|jpg}\`); for anything else register each path, or mark a deliberate literal with \`// ${PARAM_MODIFIER_PRAGMA}\` above the registration`,
+                evidence: [`${route.method} ${route.path}`, `literal: ${text}`],
+                verify: "nifra check --lints-only",
+            }));
+        }
+        return findings;
+    },
+};
+export const routeRules = Object.freeze([
+    reservedSegmentRule,
+    duplicateRouteRule,
+    overlappingRouteRule,
+    paramModifierRule,
+]);
 //# sourceMappingURL=routes.js.map

package/dist/rules/routes.js.map

@@ -1 +1 @@
-{"version":3,"file":"routes.js","sourceRoot":"","sources":["../../src/rules/routes.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,oBAAoB,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAA;AACtE,OAAO,EAAmB,UAAU,EAAE,MAAM,mBAAmB,CAAA;AAC/D,OAAO,EAAE,qBAAqB,EAAE,MAAM,sBAAsB,CAAA;AAG5D;;;;;;;;;;;;;;;;GAgBG;AAEH,yFAAyF;AACzF,MAAM,uBAAuB,GAAG,+BAA+B,CAAA;AAS/D,2FAA2F;AAC3F,SAAS,UAAU,CAAC,GAAgB;IAClC,MAAM,GAAG,GAAuB,GAAG,CAAC,OAAO,CAAC,MAAM,CAAA;IAClD,MAAM,GAAG,GAAsB,EAAE,CAAA;IACjC,KAAK,MAAM,IAAI,IAAI,GAAG,EAAE,CAAC;QACvB,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC;YAAE,SAAQ;QAC9E,MAAM,MAAM,GAAG,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAA;QACvD,IACE,OAAO,MAAM,CAAC,IAAI,KAAK,QAAQ;YAC/B,OAAO,MAAM,CAAC,IAAI,KAAK,QAAQ;YAC/B,OAAO,MAAM,CAAC,MAAM,KAAK,QAAQ;YACjC,OAAO,MAAM,CAAC,IAAI,KAAK,QAAQ;YAE/B,SAAQ;QACV,GAAG,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC,CAAA;IAC9F,CAAC;IACD,OAAO,GAAG,CAAA;AACZ,CAAC;AAED;;;;GAIG;AACH,SAAS,eAAe,CAAC,IAAY,EAAE,SAAiB;IACtD,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,KAAK,EAAE,CAAC,CAAA;IACpE,MAAM,MAAM,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC,CAAC,CAAA;IAC1E,OAAO,GAAG,CAAC,KAAK,EAAE,GAAG,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,SAAS,IAAI,CAAA;AAC1D,CAAC;AAED,MAAM,CAAC,MAAM,mBAAmB,GAAc;IAC5C,IAAI,EAAE,SAAS;IACf,KAAK,EAAE,yDAAyD;IAChE,KAAK,CAAC,IAAI,CAAC,GAAG;QACZ,MAAM,QAAQ,GAAiB,EAAE,CAAA;QACjC,MAAM,WAAW,GAAG,IAAI,GAAG,EAA6B,CAAA;QACxD,KAAK,MAAM,KAAK,IAAI,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;YACpC,KAAK,MAAM,OAAO,IAAI,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;gBAC5C,IAAI,OAAO,KAAK,EAAE;oBAAE,SAAQ;gBAC5B,MAAM,SAAS,GAAG,cAAc,CAAC,OAAO,CAAC,CAAA;gBACzC,IAAI,SAAS,KAAK,SAAS;oBAAE,SAAQ;gBACrC,IAAI,KAAK,GAAG,WAAW,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;gBACvC,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;oBACxB,KAAK,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;oBAC/D,WAAW,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,CAAA;gBACpC,CAAC;gBACD,IAAI,qBAAqB,CAAC,KAAK,EAAE,KAAK,CAAC,IAAI,EAAE,uBAAuB,CAAC;oBAAE,SAAQ;gBAC/E,QAAQ,CAAC,IAAI,CACX,UAAU,CAAC;oBACT,IAAI,EAAE,SAAS;oBACf,QAAQ,EAAE,MAAM;oBAChB,IAAI,EAAE,KAAK,CAAC,IAAI;oBAChB,IAAI,EAAE,KAAK,CAAC,IAAI;oBAChB,OAAO,EAAE,GAAG,KAAK,CAAC,MAAM,IAAI,KAAK,CAAC,IAAI,eAAe,OAAO,kDAAkD,SAAS,gBAAgB,oBAAoB,oFAAoF,eAAe,CAAC,KAAK,CAAC,IAAI,EAAE,OAAO,CAAC,sFAAsF,uBAAuB,gGAAgG;oBAChe,QAAQ,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,IAAI,KAAK,CAAC,IAAI,EAAE,EAAE,YAAY,OAAO,EAAE,CAAC;oBAClE,sFAAsF;oBACtF,qFAAqF;oBACrF,GAAG,EAAE,EAAE,MAAM,EAAE,yBAAyB,EAAE,OAAO,EAAE,0BAA0B,EAAE;oBAC/E,MAAM,EAAE,0BAA0B;iBACnC,CAAC,CACH,CAAA;gBACD,MAAK,CAAC,0DAA0D;YAClE,CAAC;QACH,CAAC;QACD,OAAO,QAAQ,CAAA;IACjB,CAAC;CACF,CAAA;AAED;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAc;IAC3C,IAAI,EAAE,SAAS;IACf,KAAK,EAAE,8BAA8B;IACrC,KAAK,CAAC,IAAI,CAAC,GAAG;QACZ,MAAM,QAAQ,GAAiB,EAAE,CAAA;QACjC,MAAM,MAAM,GAAG,IAAI,GAAG,EAAwC,CAAA;QAC9D,KAAK,MAAM,KAAK,IAAI,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;YACpC,IAAI,IAAI,GAAG,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;YACjC,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;gBACvB,IAAI,GAAG,IAAI,GAAG,EAAE,CAAA;gBAChB,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,EAAE,IAAI,CAAC,CAAA;YAC9B,CAAC;YACD,MAAM,GAAG,GAAG,GAAG,KAAK,CAAC,MAAM,IAAI,KAAK,CAAC,IAAI,EAAE,CAAA;YAC3C,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;YAC3B,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;gBACxB,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAA;gBACpB,SAAQ;YACV,CAAC;YACD,QAAQ,CAAC,IAAI,CACX,UAAU,CAAC;gBACT,IAAI,EAAE,SAAS;gBACf,QAAQ,EAAE,OAAO;gBACjB,IAAI,EAAE,KAAK,CAAC,IAAI;gBAChB,IAAI,EAAE,KAAK,CAAC,IAAI;gBAChB,OAAO,EAAE,GAAG,GAAG,oDAAoD,KAAK,CAAC,IAAI,kEAAkE;gBAC/I,QAAQ,EAAE,CAAC,GAAG,EAAE,4BAA4B,KAAK,CAAC,IAAI,EAAE,CAAC;gBACzD,MAAM,EAAE,0BAA0B;aACnC,CAAC,CACH,CAAA;QACH,CAAC;QACD,OAAO,QAAQ,CAAA;IACjB,CAAC;CACF,CAAA;AAED,MAAM,CAAC,MAAM,UAAU,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,mBAAmB,EAAE,kBAAkB,CAAC,CAAC,CAAA"}
+{"version":3,"file":"routes.js","sourceRoot":"","sources":["../../src/rules/routes.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,oBAAoB,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAA;AACtE,OAAO,EAAE,6BAA6B,EAAE,mBAAmB,EAAE,MAAM,eAAe,CAAA;AAClF,OAAO,EAAE,oBAAoB,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAA;AAC7E,OAAO,EAAmB,UAAU,EAAE,MAAM,mBAAmB,CAAA;AAC/D,OAAO,EAAE,qBAAqB,EAAE,MAAM,sBAAsB,CAAA;AAG5D;;;;;;;;;;;;;;;;GAgBG;AAEH,yFAAyF;AACzF,MAAM,uBAAuB,GAAG,+BAA+B,CAAA;AAC/D,MAAM,oBAAoB,GAAG,4BAA4B,CAAA;AACzD,MAAM,qBAAqB,GAAG,6BAA6B,CAAA;AAS3D,2FAA2F;AAC3F,SAAS,UAAU,CAAC,GAAgB;IAClC,MAAM,GAAG,GAAuB,GAAG,CAAC,OAAO,CAAC,MAAM,CAAA;IAClD,MAAM,GAAG,GAAsB,EAAE,CAAA;IACjC,KAAK,MAAM,IAAI,IAAI,GAAG,EAAE,CAAC;QACvB,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC;YAAE,SAAQ;QAC9E,MAAM,MAAM,GAAG,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAA;QACvD,IACE,OAAO,MAAM,CAAC,IAAI,KAAK,QAAQ;YAC/B,OAAO,MAAM,CAAC,IAAI,KAAK,QAAQ;YAC/B,OAAO,MAAM,CAAC,MAAM,KAAK,QAAQ;YACjC,OAAO,MAAM,CAAC,IAAI,KAAK,QAAQ;YAE/B,SAAQ;QACV,GAAG,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC,CAAA;IAC9F,CAAC;IACD,OAAO,GAAG,CAAA;AACZ,CAAC;AAED,2GAA2G;AAC3G,SAAS,SAAS,CAAC,MAAkC;IACnD,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAA;IAC9B,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE;QAC7B,MAAM,IAAI,GAAG,GAAG,KAAK,CAAC,IAAI,KAAK,KAAK,CAAC,IAAI,KAAK,KAAK,CAAC,IAAI,EAAE,CAAA;QAC1D,IAAI,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC;YAAE,OAAO,KAAK,CAAA;QAChC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAA;QACd,OAAO,IAAI,CAAA;IACb,CAAC,CAAC,CAAA;AACJ,CAAC;AAED;;;;GAIG;AACH,SAAS,eAAe,CAAC,IAAY,EAAE,SAAiB;IACtD,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,KAAK,EAAE,CAAC,CAAA;IACpE,MAAM,MAAM,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC,CAAC,CAAA;IAC1E,OAAO,GAAG,CAAC,KAAK,EAAE,GAAG,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,SAAS,IAAI,CAAA;AAC1D,CAAC;AAED,MAAM,CAAC,MAAM,mBAAmB,GAAc;IAC5C,IAAI,EAAE,SAAS;IACf,KAAK,EAAE,yDAAyD;IAChE,KAAK,CAAC,IAAI,CAAC,GAAG;QACZ,MAAM,QAAQ,GAAiB,EAAE,CAAA;QACjC,MAAM,WAAW,GAAG,IAAI,GAAG,EAA6B,CAAA;QACxD,KAAK,MAAM,KAAK,IAAI,SAAS,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC;YAC/C,KAAK,MAAM,OAAO,IAAI,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;gBAC5C,IAAI,OAAO,KAAK,EAAE;oBAAE,SAAQ;gBAC5B,MAAM,SAAS,GAAG,cAAc,CAAC,OAAO,CAAC,CAAA;gBACzC,IAAI,SAAS,KAAK,SAAS;oBAAE,SAAQ;gBACrC,IAAI,KAAK,GAAG,WAAW,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;gBACvC,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;oBACxB,KAAK,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;oBAC/D,WAAW,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,CAAA;gBACpC,CAAC;gBACD,IAAI,qBAAqB,CAAC,KAAK,EAAE,KAAK,CAAC,IAAI,EAAE,uBAAuB,CAAC;oBAAE,SAAQ;gBAC/E,QAAQ,CAAC,IAAI,CACX,UAAU,CAAC;oBACT,IAAI,EAAE,SAAS;oBACf,QAAQ,EAAE,MAAM;oBAChB,IAAI,EAAE,KAAK,CAAC,IAAI;oBAChB,IAAI,EAAE,KAAK,CAAC,IAAI;oBAChB,OAAO,EAAE,GAAG,KAAK,CAAC,MAAM,IAAI,KAAK,CAAC,IAAI,eAAe,OAAO,kDAAkD,SAAS,gBAAgB,oBAAoB,oFAAoF,eAAe,CAAC,KAAK,CAAC,IAAI,EAAE,OAAO,CAAC,sFAAsF,uBAAuB,gGAAgG;oBAChe,QAAQ,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,IAAI,KAAK,CAAC,IAAI,EAAE,EAAE,YAAY,OAAO,EAAE,CAAC;oBAClE,sFAAsF;oBACtF,qFAAqF;oBACrF,GAAG,EAAE,EAAE,MAAM,EAAE,yBAAyB,EAAE,OAAO,EAAE,0BAA0B,EAAE;oBAC/E,MAAM,EAAE,0BAA0B;iBACnC,CAAC,CACH,CAAA;gBACD,MAAK,CAAC,0DAA0D;YAClE,CAAC;QACH,CAAC;QACD,OAAO,QAAQ,CAAA;IACjB,CAAC;CACF,CAAA;AAED;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAc;IAC3C,IAAI,EAAE,SAAS;IACf,KAAK,EAAE,8BAA8B;IACrC,KAAK,CAAC,IAAI,CAAC,GAAG;QACZ,MAAM,QAAQ,GAAiB,EAAE,CAAA;QACjC,MAAM,MAAM,GAAG,IAAI,GAAG,EAAwC,CAAA;QAC9D,2FAA2F;QAC3F,gDAAgD;QAChD,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAU,CAAA;QAClC,KAAK,MAAM,KAAK,IAAI,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;YACpC,IAAI,IAAI,GAAG,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;YACjC,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;gBACvB,IAAI,GAAG,IAAI,GAAG,EAAE,CAAA;gBAChB,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,EAAE,IAAI,CAAC,CAAA;YAC9B,CAAC;YACD,MAAM,GAAG,GAAG,GAAG,KAAK,CAAC,MAAM,IAAI,KAAK,CAAC,IAAI,EAAE,CAAA;YAC3C,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;YAC3B,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;gBACxB,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAA;gBACpB,SAAQ;YACV,CAAC;YACD,MAAM,IAAI,GAAG,GAAG,KAAK,CAAC,IAAI,KAAK,KAAK,CAAC,IAAI,KAAK,KAAK,CAAC,IAAI,KAAK,KAAK,CAAC,IAAI,EAAE,CAAA;YACzE,IAAI,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC;gBAAE,SAAQ;YAChC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,CAAA;YAClB,QAAQ,CAAC,IAAI,CACX,UAAU,CAAC;gBACT,IAAI,EAAE,SAAS;gBACf,QAAQ,EAAE,OAAO;gBACjB,IAAI,EAAE,KAAK,CAAC,IAAI;gBAChB,IAAI,EAAE,KAAK,CAAC,IAAI;gBAChB,OAAO,EAAE,GAAG,GAAG,oDAAoD,KAAK,CAAC,IAAI,kEAAkE;gBAC/I,QAAQ,EAAE,CAAC,GAAG,EAAE,4BAA4B,KAAK,CAAC,IAAI,EAAE,CAAC;gBACzD,MAAM,EAAE,0BAA0B;aACnC,CAAC,CACH,CAAA;QACH,CAAC;QACD,OAAO,QAAQ,CAAA;IACjB,CAAC;CACF,CAAA;AAED;;;;GAIG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAc;IAC7C,IAAI,EAAE,SAAS;IACf,KAAK,EAAE,gCAAgC;IACvC,KAAK,CAAC,IAAI,CAAC,GAAG;QACZ,MAAM,QAAQ,GAAiB,EAAE,CAAA;QACjC,MAAM,WAAW,GAAG,IAAI,GAAG,EAA6B,CAAA;QACxD,MAAM,MAAM,GAAG,IAAI,GAAG,EAA6B,CAAA;QACnD,KAAK,MAAM,KAAK,IAAI,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;YACpC,MAAM,MAAM,GAAG,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;YACrC,IAAI,MAAM,KAAK,SAAS;gBAAE,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,CAAA;;gBACpD,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;QACzB,CAAC;QAED,uFAAuF;QACvF,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAU,CAAA;QAClC,KAAK,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,MAAM,EAAE,CAAC;YACpC,MAAM,KAAK,GAAG,GAAsB,EAAE;gBACpC,IAAI,KAAK,GAAG,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC,CAAA;gBACjC,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;oBACxB,KAAK,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;oBACzD,WAAW,CAAC,GAAG,CAAC,IAAI,EAAE,KAAK,CAAC,CAAA;gBAC9B,CAAC;gBACD,OAAO,KAAK,CAAA;YACd,CAAC,CAAA;YAED,KAAK,IAAI,UAAU,GAAG,CAAC,EAAE,UAAU,GAAG,MAAM,CAAC,MAAM,EAAE,UAAU,IAAI,CAAC,EAAE,CAAC;gBACrE,MAAM,KAAK,GAAG,MAAM,CAAC,UAAU,CAAE,CAAA;gBACjC,MAAM,QAAQ,GAAG,GAAG,KAAK,CAAC,MAAM,IAAI,KAAK,CAAC,IAAI,EAAE,CAAA;gBAChD,KAAK,IAAI,YAAY,GAAG,CAAC,EAAE,YAAY,GAAG,UAAU,EAAE,YAAY,IAAI,CAAC,EAAE,CAAC;oBACxE,MAAM,OAAO,GAAG,MAAM,CAAC,YAAY,CAAE,CAAA;oBACrC,IAAI,OAAO,CAAC,MAAM,KAAK,KAAK,CAAC,MAAM,IAAI,GAAG,OAAO,CAAC,MAAM,IAAI,OAAO,CAAC,IAAI,EAAE,KAAK,QAAQ;wBACrF,SAAQ;oBACV,IAAI,qBAAqB,CAAC,KAAK,EAAE,EAAE,KAAK,CAAC,IAAI,EAAE,oBAAoB,CAAC;wBAAE,SAAQ;oBAC9E,IAAI,qBAAqB,CAAC,KAAK,EAAE,EAAE,OAAO,CAAC,IAAI,EAAE,oBAAoB,CAAC;wBAAE,SAAQ;oBAEhF,IAAI,OAA2B,CAAA;oBAC/B,IAAI,CAAC;wBACH,OAAO,GAAG,mBAAmB,CAAC,OAAO,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,CAAA;oBACzD,CAAC;oBAAC,OAAO,KAAK,EAAE,CAAC;wBACf,IAAI,KAAK,YAAY,6BAA6B,EAAE,CAAC;4BACnD,QAAQ,CAAC,IAAI,CACX,UAAU,CAAC;gCACT,IAAI,EAAE,SAAS;gCACf,QAAQ,EAAE,OAAO;gCACjB,IAAI,EAAE,KAAK,CAAC,IAAI;gCAChB,IAAI,EAAE,KAAK,CAAC,IAAI;gCAChB,OAAO,EAAE,GAAG,QAAQ,sCAAsC,OAAO,CAAC,MAAM,IAAI,OAAO,CAAC,IAAI,kGAAkG,oBAAoB,mCAAmC;gCACjP,QAAQ,EAAE;oCACR,GAAG,OAAO,CAAC,MAAM,IAAI,OAAO,CAAC,IAAI,EAAE;oCACnC,GAAG,KAAK,CAAC,MAAM,IAAI,KAAK,CAAC,IAAI,EAAE;oCAC/B,4BAA4B,OAAO,CAAC,IAAI,EAAE;iCAC3C;gCACD,MAAM,EAAE,0BAA0B;6BACnC,CAAC,CACH,CAAA;wBACH,CAAC;wBACD,sFAAsF;wBACtF,0EAA0E;wBAC1E,SAAQ;oBACV,CAAC;oBACD,IAAI,OAAO,KAAK,SAAS;wBAAE,SAAQ;oBACnC,MAAM,IAAI,GAAG,GAAG,IAAI,KAAK,KAAK,CAAC,IAAI,KAAK,KAAK,CAAC,IAAI,KAAK,OAAO,CAAC,IAAI,KAAK,OAAO,CAAC,IAAI,EAAE,CAAA;oBACtF,IAAI,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC;wBAAE,MAAK;oBAC7B,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,CAAA;oBAElB,QAAQ,CAAC,IAAI,CACX,UAAU,CAAC;wBACT,IAAI,EAAE,SAAS;wBACf,QAAQ,EAAE,OAAO;wBACjB,IAAI,EAAE,KAAK,CAAC,IAAI;wBAChB,IAAI,EAAE,KAAK,CAAC,IAAI;wBAChB,OAAO,EAAE,GAAG,QAAQ,aAAa,OAAO,CAAC,MAAM,IAAI,OAAO,CAAC,IAAI,mBAAmB,OAAO,CAAC,IAAI,oBAAoB,OAAO,qFAAqF,oBAAoB,oCAAoC;wBACtQ,QAAQ,EAAE;4BACR,GAAG,OAAO,CAAC,MAAM,IAAI,OAAO,CAAC,IAAI,EAAE;4BACnC,GAAG,KAAK,CAAC,MAAM,IAAI,KAAK,CAAC,IAAI,EAAE;4BAC/B,YAAY,OAAO,EAAE;4BACrB,4BAA4B,OAAO,CAAC,IAAI,EAAE;yBAC3C;wBACD,MAAM,EAAE,0BAA0B;qBACnC,CAAC,CACH,CAAA;oBACD,MAAK;gBACP,CAAC;YACH,CAAC;QACH,CAAC;QACD,OAAO,QAAQ,CAAA;IACjB,CAAC;CACF,CAAA;AAED,sFAAsF;AACtF,MAAM,cAAc,GAAG,kCAAkC,CAAA;AAEzD;;;GAGG;AACH,SAAS,eAAe,CAAC,IAAY;IACnC,cAAc,CAAC,SAAS,GAAG,CAAC,CAAA;IAC5B,KAAK,IAAI,KAAK,GAAG,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,KAAK,KAAK,IAAI,EAAE,KAAK,GAAG,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QAC9F,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAA;QACrB,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC;YAAE,OAAO,IAAI,CAAA;QACpC,MAAM,UAAU,GAAG,eAAe,CAAC,IAAI,CAAC,KAAK,CAAC,cAAc,CAAC,SAAS,GAAG,CAAC,CAAC,CAAC,CAAA;QAC5E,IAAI,UAAU,KAAK,SAAS;YAAE,OAAO,IAAI,CAAA;QACzC,MAAM,GAAG,GAAG,cAAc,CAAC,SAAS,GAAG,UAAU,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,CAAA;QACnE,yFAAyF;QACzF,IAAI,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC;YAAE,OAAO,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,EAAE,GAAG,GAAG,CAAC,CAAC,CAAA;QAChF,cAAc,CAAC,SAAS,GAAG,GAAG,CAAA;IAChC,CAAC;IACD,OAAO,SAAS,CAAA;AAClB,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAc;IAC1C,IAAI,EAAE,SAAS;IACf,KAAK,EAAE,iDAAiD;IACxD,KAAK,CAAC,IAAI,CAAC,GAAG;QACZ,MAAM,QAAQ,GAAiB,EAAE,CAAA;QACjC,MAAM,WAAW,GAAG,IAAI,GAAG,EAA6B,CAAA;QACxD,KAAK,MAAM,KAAK,IAAI,SAAS,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC;YAC/C,MAAM,KAAK,GAAG,oBAAoB,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;YAC9C,MAAM,IAAI,GAAG,eAAe,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,IAAI,KAAK,CAAC,IAAI,CAAC,CAAA;YACnE,IAAI,IAAI,KAAK,SAAS;gBAAE,SAAQ;YAChC,IAAI,KAAK,GAAG,WAAW,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;YACvC,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;gBACxB,KAAK,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;gBAC/D,WAAW,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,CAAA;YACpC,CAAC;YACD,IAAI,qBAAqB,CAAC,KAAK,EAAE,KAAK,CAAC,IAAI,EAAE,qBAAqB,CAAC;gBAAE,SAAQ;YAC7E,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAE,CAAA;YACxC,QAAQ,CAAC,IAAI,CACX,UAAU,CAAC;gBACT,IAAI,EAAE,SAAS;gBACf,QAAQ,EAAE,MAAM;gBAChB,IAAI,EAAE,KAAK,CAAC,IAAI;gBAChB,IAAI,EAAE,KAAK,CAAC,IAAI;gBAChB,OAAO,EAAE,GAAG,KAAK,CAAC,MAAM,IAAI,KAAK,CAAC,IAAI,OAAO,SAAS,YAAY,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,wDAAwD,SAAS,KAAK,GAAG,CAAC,CAAC,CAAC,sEAAsE,CAAC,CAAC,CAAC,EAAE,8VAA8V,qBAAqB,2BAA2B;gBACxnB,QAAQ,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,IAAI,KAAK,CAAC,IAAI,EAAE,EAAE,YAAY,IAAI,EAAE,CAAC;gBAC/D,MAAM,EAAE,0BAA0B;aACnC,CAAC,CACH,CAAA;QACH,CAAC;QACD,OAAO,QAAQ,CAAA;IACjB,CAAC;CACF,CAAA;AAED,MAAM,CAAC,MAAM,UAAU,GAAG,MAAM,CAAC,MAAM,CAAC;IACtC,mBAAmB;IACnB,kBAAkB;IAClB,oBAAoB;IACpB,iBAAiB;CAClB,CAAC,CAAA"}

package/dist/rules/secrets.d.ts

@@ -0,0 +1,10 @@
+import { type SecretExemption } from "@nifrajs/web/zones";
+import type { CheckRule } from "./index.js";
+/**
+ * The app's `secretExemptions`, read statically from `nifra.config.ts` (check never imports app code):
+ * an array literal of object literals with string fields, the form the build error suggests.
+ */
+export declare function readSecretExemptions(appRoot: string): SecretExemption[];
+export declare const secretSourceRule: CheckRule;
+export declare const secretRules: readonly CheckRule[];
+//# sourceMappingURL=secrets.d.ts.map

package/dist/rules/secrets.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"secrets.d.ts","sourceRoot":"","sources":["../../src/rules/secrets.ts"],"names":[],"mappings":"AAQA,OAAO,EAEL,KAAK,eAAe,EAGrB,MAAM,oBAAoB,CAAA;AAK3B,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,YAAY,CAAA;AAkD3C;;;GAGG;AACH,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,MAAM,GAAG,eAAe,EAAE,CA0CvE;AAED,eAAO,MAAM,gBAAgB,EAAE,SAuD9B,CAAA;AAED,eAAO,MAAM,WAAW,sBAAoC,CAAA"}

package/dist/rules/secrets.js

@@ -0,0 +1,169 @@
+/**
+ * NF-C032: what looks like a credential in browser code or in `public/`, checked from source with the
+ * scanner every client build runs (`@nifrajs/web/zones`). The build also matches the values of the
+ * build environment's private variables in its output; that needs the build's environment, so it
+ * stays the build's.
+ */
+import { existsSync, readFileSync } from "node:fs";
+import { join } from "node:path";
+import { publicScanFiles, scanForSecrets, } from "@nifrajs/web/zones";
+import { CONFIG_FILE } from "../app-files.js";
+import { stripComments } from "../check-scan.js";
+import { diagnostic } from "../diagnostics.js";
+import { codeUnitOrder } from "../internal/code-unit-order.js";
+import { zonedFiles } from "./zones.js";
+const BROWSER_CODE = new Set(["route-frontend", "frontend", "shared"]);
+const EXEMPTIONS_START = /\bexport\s+const\s+secretExemptions\b[^=]*=\s*\[/;
+/**
+ * The tokens of an array literal, from just after its `[` to the `]` that closes it. A string is one
+ * token, so a bracket or a colon inside one (`"routes/[lang]/index.tsx"`) is text, never syntax.
+ */
+function arrayTokens(src, from) {
+    const tokens = [];
+    let depth = 0;
+    let i = from;
+    while (i < src.length) {
+        const c = src[i];
+        if (c === '"' || c === "'" || c === "`") {
+            let value = "";
+            let j = i + 1;
+            while (j < src.length && src[j] !== c) {
+                if (src[j] === "\\") {
+                    value += src[j + 1] ?? "";
+                    j += 2;
+                }
+                else
+                    value += src[j++];
+            }
+            tokens.push({ kind: "string", value });
+            i = j + 1;
+        }
+        else if (/[\w$]/.test(c)) {
+            let j = i;
+            while (j < src.length && /[\w$]/.test(src[j]))
+                j++;
+            tokens.push({ kind: "word", value: src.slice(i, j) });
+            i = j;
+        }
+        else {
+            if (c === "]" || c === "}" || c === ")") {
+                if (depth === 0)
+                    break;
+                depth--;
+            }
+            else if (c === "[" || c === "{" || c === "(")
+                depth++;
+            if (!/\s/.test(c))
+                tokens.push({ kind: "punct", value: c });
+            i++;
+        }
+    }
+    return tokens;
+}
+const isPunct = (token, value) => token?.kind === "punct" && token.value === value;
+/**
+ * The app's `secretExemptions`, read statically from `nifra.config.ts` (check never imports app code):
+ * an array literal of object literals with string fields, the form the build error suggests.
+ */
+export function readSecretExemptions(appRoot) {
+    const path = join(appRoot, CONFIG_FILE);
+    if (!existsSync(path))
+        return [];
+    const text = stripComments(readFileSync(path, "utf8"));
+    const opened = EXEMPTIONS_START.exec(text);
+    if (opened === null)
+        return [];
+    const tokens = arrayTokens(text, opened.index + opened[0].length);
+    const exemptions = [];
+    let depth = 0;
+    let fields;
+    for (let i = 0; i < tokens.length; i++) {
+        const token = tokens[i];
+        if (token.kind === "punct" && "[{(".includes(token.value)) {
+            depth++;
+            if (depth === 1 && token.value === "{")
+                fields = {};
+        }
+        else if (token.kind === "punct" && "]})".includes(token.value)) {
+            if (depth === 1 && fields !== undefined) {
+                const { rule, reason, file, env } = fields;
+                if (rule !== undefined && reason !== undefined) {
+                    exemptions.push({
+                        rule: rule,
+                        reason,
+                        ...(file === undefined ? {} : { file }),
+                        ...(env === undefined ? {} : { env }),
+                    });
+                }
+                fields = undefined;
+            }
+            depth--;
+        }
+        else if (depth === 1 &&
+            fields !== undefined &&
+            token.kind !== "punct" &&
+            isPunct(tokens[i + 1], ":") &&
+            tokens[i + 2]?.kind === "string" &&
+            (isPunct(tokens[i + 3], ",") || isPunct(tokens[i + 3], "}"))) {
+            fields[token.value] ??= tokens[i + 2].value;
+            i += 2;
+        }
+    }
+    return exemptions;
+}
+export const secretSourceRule = {
+    code: "NF-C032",
+    title: "Credential in browser code",
+    async scan(ctx) {
+        const { files } = zonedFiles(ctx);
+        const apps = new Map();
+        for (const { file, app, classification } of files) {
+            if (!apps.has(app))
+                apps.set(app, []);
+            if (!BROWSER_CODE.has(classification.zone))
+                continue;
+            const text = ctx.sources.read(file);
+            if (text === undefined)
+                continue;
+            const name = app === "" ? file : file.slice(app.length + 1);
+            apps.get(app)?.push({ name, text, firstParty: true });
+        }
+        const findings = [];
+        for (const [app, sources] of apps) {
+            const appRoot = join(ctx.root, app);
+            const publicDir = join(appRoot, "public");
+            try {
+                const found = scanForSecrets({
+                    sources,
+                    artifacts: existsSync(publicDir) ? publicScanFiles(publicDir, "public") : [],
+                    exemptions: readSecretExemptions(appRoot),
+                });
+                for (const finding of found) {
+                    const file = app === "" ? finding.file : `${app}/${finding.file}`;
+                    findings.push(diagnostic({
+                        code: "NF-C032",
+                        severity: "error",
+                        file,
+                        line: finding.line,
+                        message: `${file} carries what looks like a credential (${finding.what}), and it reaches the browser. Read it from the environment in a route's backend half or under backend/, and rotate it if it was ever committed`,
+                        evidence: [`rule: ${finding.rule}`, `match: ${finding.preview}`],
+                        verify: "nifra check",
+                    }));
+                }
+            }
+            catch (error) {
+                // A malformed exemption: the build refuses it with the same message.
+                findings.push(diagnostic({
+                    code: "NF-C032",
+                    severity: "error",
+                    file: join(app, CONFIG_FILE),
+                    message: error instanceof Error ? error.message : String(error),
+                    verify: "nifra check",
+                }));
+            }
+        }
+        return findings.sort((a, b) => codeUnitOrder(a.file ?? "", b.file ?? "") || (a.line ?? 0) - (b.line ?? 0));
+    },
+};
+export const secretRules = Object.freeze([secretSourceRule]);
+//# sourceMappingURL=secrets.js.map

package/dist/rules/secrets.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"secrets.js","sourceRoot":"","sources":["../../src/rules/secrets.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,SAAS,CAAA;AAClD,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAA;AAChC,OAAO,EACL,eAAe,EAGf,cAAc,GACf,MAAM,oBAAoB,CAAA;AAC3B,OAAO,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAA;AAC7C,OAAO,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAA;AAChD,OAAO,EAAmB,UAAU,EAAE,MAAM,mBAAmB,CAAA;AAC/D,OAAO,EAAE,aAAa,EAAE,MAAM,gCAAgC,CAAA;AAE9D,OAAO,EAAE,UAAU,EAAE,MAAM,YAAY,CAAA;AAEvC,MAAM,YAAY,GAAG,IAAI,GAAG,CAAC,CAAC,gBAAgB,EAAE,UAAU,EAAE,QAAQ,CAAC,CAAC,CAAA;AAEtE,MAAM,gBAAgB,GAAG,kDAAkD,CAAA;AAI3E;;;GAGG;AACH,SAAS,WAAW,CAAC,GAAW,EAAE,IAAY;IAC5C,MAAM,MAAM,GAAY,EAAE,CAAA;IAC1B,IAAI,KAAK,GAAG,CAAC,CAAA;IACb,IAAI,CAAC,GAAG,IAAI,CAAA;IACZ,OAAO,CAAC,GAAG,GAAG,CAAC,MAAM,EAAE,CAAC;QACtB,MAAM,CAAC,GAAG,GAAG,CAAC,CAAC,CAAW,CAAA;QAC1B,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG,EAAE,CAAC;YACxC,IAAI,KAAK,GAAG,EAAE,CAAA;YACd,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;YACb,OAAO,CAAC,GAAG,GAAG,CAAC,MAAM,IAAI,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC;gBACtC,IAAI,GAAG,CAAC,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;oBACpB,KAAK,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAA;oBACzB,CAAC,IAAI,CAAC,CAAA;gBACR,CAAC;;oBAAM,KAAK,IAAI,GAAG,CAAC,CAAC,EAAE,CAAC,CAAA;YAC1B,CAAC;YACD,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,CAAA;YACtC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;QACX,CAAC;aAAM,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;YAC3B,IAAI,CAAC,GAAG,CAAC,CAAA;YACT,OAAO,CAAC,GAAG,GAAG,CAAC,MAAM,IAAI,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAW,CAAC;gBAAE,CAAC,EAAE,CAAA;YAC5D,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC,CAAA;YACrD,CAAC,GAAG,CAAC,CAAA;QACP,CAAC;aAAM,CAAC;YACN,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG,EAAE,CAAC;gBACxC,IAAI,KAAK,KAAK,CAAC;oBAAE,MAAK;gBACtB,KAAK,EAAE,CAAA;YACT,CAAC;iBAAM,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG;gBAAE,KAAK,EAAE,CAAA;YACvD,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;gBAAE,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC,CAAA;YAC3D,CAAC,EAAE,CAAA;QACL,CAAC;IACH,CAAC;IACD,OAAO,MAAM,CAAA;AACf,CAAC;AAED,MAAM,OAAO,GAAG,CAAC,KAAwB,EAAE,KAAa,EAAW,EAAE,CACnE,KAAK,EAAE,IAAI,KAAK,OAAO,IAAI,KAAK,CAAC,KAAK,KAAK,KAAK,CAAA;AAElD;;;GAGG;AACH,MAAM,UAAU,oBAAoB,CAAC,OAAe;IAClD,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,EAAE,WAAW,CAAC,CAAA;IACvC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,EAAE,CAAA;IAChC,MAAM,IAAI,GAAG,aAAa,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAA;IACtD,MAAM,MAAM,GAAG,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;IAC1C,IAAI,MAAM,KAAK,IAAI;QAAE,OAAO,EAAE,CAAA;IAC9B,MAAM,MAAM,GAAG,WAAW,CAAC,IAAI,EAAE,MAAM,CAAC,KAAK,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAA;IACjE,MAAM,UAAU,GAAsB,EAAE,CAAA;IACxC,IAAI,KAAK,GAAG,CAAC,CAAA;IACb,IAAI,MAA0C,CAAA;IAC9C,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACvC,MAAM,KAAK,GAAG,MAAM,CAAC,CAAC,CAAU,CAAA;QAChC,IAAI,KAAK,CAAC,IAAI,KAAK,OAAO,IAAI,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC;YAC1D,KAAK,EAAE,CAAA;YACP,IAAI,KAAK,KAAK,CAAC,IAAI,KAAK,CAAC,KAAK,KAAK,GAAG;gBAAE,MAAM,GAAG,EAAE,CAAA;QACrD,CAAC;aAAM,IAAI,KAAK,CAAC,IAAI,KAAK,OAAO,IAAI,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC;YACjE,IAAI,KAAK,KAAK,CAAC,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;gBACxC,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,EAAE,GAAG,MAAM,CAAA;gBAC1C,IAAI,IAAI,KAAK,SAAS,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;oBAC/C,UAAU,CAAC,IAAI,CAAC;wBACd,IAAI,EAAE,IAA+B;wBACrC,MAAM;wBACN,GAAG,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC;wBACvC,GAAG,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC;qBACtC,CAAC,CAAA;gBACJ,CAAC;gBACD,MAAM,GAAG,SAAS,CAAA;YACpB,CAAC;YACD,KAAK,EAAE,CAAA;QACT,CAAC;aAAM,IACL,KAAK,KAAK,CAAC;YACX,MAAM,KAAK,SAAS;YACpB,KAAK,CAAC,IAAI,KAAK,OAAO;YACtB,OAAO,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,CAAC,EAAE,GAAG,CAAC;YAC3B,MAAM,CAAC,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,KAAK,QAAQ;YAChC,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,CAAC,EAAE,GAAG,CAAC,IAAI,OAAO,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,EAC5D,CAAC;YACD,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,KAAM,MAAM,CAAC,CAAC,GAAG,CAAC,CAAW,CAAC,KAAK,CAAA;YACtD,CAAC,IAAI,CAAC,CAAA;QACR,CAAC;IACH,CAAC;IACD,OAAO,UAAU,CAAA;AACnB,CAAC;AAED,MAAM,CAAC,MAAM,gBAAgB,GAAc;IACzC,IAAI,EAAE,SAAS;IACf,KAAK,EAAE,4BAA4B;IACnC,KAAK,CAAC,IAAI,CAAC,GAAG;QACZ,MAAM,EAAE,KAAK,EAAE,GAAG,UAAU,CAAC,GAAG,CAAC,CAAA;QACjC,MAAM,IAAI,GAAG,IAAI,GAAG,EAA4B,CAAA;QAChD,KAAK,MAAM,EAAE,IAAI,EAAE,GAAG,EAAE,cAAc,EAAE,IAAI,KAAK,EAAE,CAAC;YAClD,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;gBAAE,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,EAAE,CAAC,CAAA;YACrC,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,cAAc,CAAC,IAAI,CAAC;gBAAE,SAAQ;YACpD,MAAM,IAAI,GAAG,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;YACnC,IAAI,IAAI,KAAK,SAAS;gBAAE,SAAQ;YAChC,MAAM,IAAI,GAAG,GAAG,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,GAAG,CAAC,CAAC,CAAA;YAC3D,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,IAAI,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC,CAAA;QACvD,CAAC;QACD,MAAM,QAAQ,GAAiB,EAAE,CAAA;QACjC,KAAK,MAAM,CAAC,GAAG,EAAE,OAAO,CAAC,IAAI,IAAI,EAAE,CAAC;YAClC,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,GAAG,CAAC,CAAA;YACnC,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAA;YACzC,IAAI,CAAC;gBACH,MAAM,KAAK,GAAG,cAAc,CAAC;oBAC3B,OAAO;oBACP,SAAS,EAAE,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,eAAe,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE;oBAC5E,UAAU,EAAE,oBAAoB,CAAC,OAAO,CAAC;iBAC1C,CAAC,CAAA;gBACF,KAAK,MAAM,OAAO,IAAI,KAAK,EAAE,CAAC;oBAC5B,MAAM,IAAI,GAAG,GAAG,KAAK,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,GAAG,IAAI,OAAO,CAAC,IAAI,EAAE,CAAA;oBACjE,QAAQ,CAAC,IAAI,CACX,UAAU,CAAC;wBACT,IAAI,EAAE,SAAS;wBACf,QAAQ,EAAE,OAAO;wBACjB,IAAI;wBACJ,IAAI,EAAE,OAAO,CAAC,IAAI;wBAClB,OAAO,EAAE,GAAG,IAAI,0CAA0C,OAAO,CAAC,IAAI,iJAAiJ;wBACvN,QAAQ,EAAE,CAAC,SAAS,OAAO,CAAC,IAAI,EAAE,EAAE,UAAU,OAAO,CAAC,OAAO,EAAE,CAAC;wBAChE,MAAM,EAAE,aAAa;qBACtB,CAAC,CACH,CAAA;gBACH,CAAC;YACH,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,qEAAqE;gBACrE,QAAQ,CAAC,IAAI,CACX,UAAU,CAAC;oBACT,IAAI,EAAE,SAAS;oBACf,QAAQ,EAAE,OAAO;oBACjB,IAAI,EAAE,IAAI,CAAC,GAAG,EAAE,WAAW,CAAC;oBAC5B,OAAO,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;oBAC/D,MAAM,EAAE,aAAa;iBACtB,CAAC,CACH,CAAA;YACH,CAAC;QACH,CAAC;QACD,OAAO,QAAQ,CAAC,IAAI,CAClB,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,IAAI,EAAE,EAAE,CAAC,CAAC,IAAI,IAAI,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,CACrF,CAAA;IACH,CAAC;CACF,CAAA;AAED,MAAM,CAAC,MAAM,WAAW,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAA"}

package/dist/rules/security.d.ts

@@ -1,4 +1,11 @@
+import type * as TSApi from "typescript";
 import type { CheckRule } from "./index.js";
+/**
+ * Rewrite every unreviewed NF-S002 comparison in one file to `nifraTimingSafeEqual(left, right)` and
+ * add the helper once. Sites come from the syntax tree, not a reported line: the helper lands above
+ * them, so a line number a check run reported no longer names the same statement after the first fix.
+ */
+export declare function rewriteSecretComparisons(ts: typeof TSApi, file: string, source: string): string;
 export declare const secretComparisonRule: CheckRule;
 export declare const piiLogRule: CheckRule;
 export declare const failOpenGateRule: CheckRule;

package/dist/rules/security.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"security.d.ts","sourceRoot":"","sources":["../../src/rules/security.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,SAAS,EAAe,MAAM,YAAY,CAAA;AAyHxD,eAAO,MAAM,oBAAoB,EAAE,SA2DlC,CAAA;AAED,eAAO,MAAM,UAAU,EAAE,SA8CxB,CAAA;AAED,eAAO,MAAM,gBAAgB,EAAE,SAgE9B,CAAA;AAiBD,eAAO,MAAM,uBAAuB,EAAE,SA2DrC,CAAA;AAED,eAAO,MAAM,oBAAoB,EAAE,SA8ClC,CAAA;AAWD,eAAO,MAAM,wBAAwB,EAAE,SAuCtC,CAAA;AAID,eAAO,MAAM,0BAA0B,EAAE,SAsDxC,CAAA;AAED,eAAO,MAAM,aAAa,sBAQxB,CAAA"}
+{"version":3,"file":"security.d.ts","sourceRoot":"","sources":["../../src/rules/security.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,KAAK,KAAK,MAAM,YAAY,CAAA;AAKxC,OAAO,KAAK,EAAE,SAAS,EAAe,MAAM,YAAY,CAAA;AAoMxD;;;;GAIG;AACH,wBAAgB,wBAAwB,CAAC,EAAE,EAAE,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,CA+B/F;AAED,eAAO,MAAM,oBAAoB,EAAE,SAwClC,CAAA;AAED,eAAO,MAAM,UAAU,EAAE,SAgDxB,CAAA;AA0BD,eAAO,MAAM,gBAAgB,EAAE,SA+D9B,CAAA;AAiBD,eAAO,MAAM,uBAAuB,EAAE,SA6DrC,CAAA;AAED,eAAO,MAAM,oBAAoB,EAAE,SAgDlC,CAAA;AAWD,eAAO,MAAM,wBAAwB,EAAE,SAyCtC,CAAA;AAID,eAAO,MAAM,0BAA0B,EAAE,SAwDxC,CAAA;AAED,eAAO,MAAM,aAAa,sBAQxB,CAAA"}