@opensip-cli/checks-universal 0.1.0

package/dist/checks/security/no-eval.d.ts

@@ -0,0 +1,16 @@
+/**
+ * @fileoverview Detect dangerous eval and dynamic code execution
+ *
+ * Migrated to defineRegexListCheck (Layer 4 Phase C6). The original
+ * `findEvalPattern` shape returned only the first matching pattern's
+ * exec result per line; that semantics is preserved via the helper's
+ * `oneViolationPerLine: true` option (combined with non-global regexes).
+ */
+/**
+ * Check: security/no-eval
+ *
+ * Detects usage of eval(), new Function(), and similar dynamic code execution
+ * patterns that can lead to code injection vulnerabilities.
+ */
+export declare const noEval: import("@opensip-cli/fitness").Check;
+//# sourceMappingURL=no-eval.d.ts.map

package/dist/checks/security/no-eval.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"no-eval.d.ts","sourceRoot":"","sources":["../../../src/checks/security/no-eval.ts"],"names":[],"mappings":"AAEA;;;;;;;GAOG;AAIH;;;;;GAKG;AACH,eAAO,MAAM,MAAM,sCAoEjB,CAAC"}

package/dist/checks/security/no-eval.js

@@ -0,0 +1,83 @@
+// @fitness-ignore-file timer-lifecycle -- All setInterval references are in regex patterns and documentation strings, not actual timer usage
+// @fitness-ignore-file no-eval -- Fitness check definition references eval/Function/setTimeout/setInterval in string literals and regex patterns, not actual usage
+/**
+ * @fileoverview Detect dangerous eval and dynamic code execution
+ *
+ * Migrated to defineRegexListCheck (Layer 4 Phase C6). The original
+ * `findEvalPattern` shape returned only the first matching pattern's
+ * exec result per line; that semantics is preserved via the helper's
+ * `oneViolationPerLine: true` option (combined with non-global regexes).
+ */
+import { defineRegexListCheck } from '@opensip-cli/fitness';
+/**
+ * Check: security/no-eval
+ *
+ * Detects usage of eval(), new Function(), and similar dynamic code execution
+ * patterns that can lead to code injection vulnerabilities.
+ */
+export const noEval = defineRegexListCheck({
+    id: '9f6d299f-8155-4719-b605-897e9dcb1fdb',
+    slug: 'no-eval',
+    scope: { languages: ['typescript'], concerns: ['backend', 'frontend', 'cli'] },
+    contentFilter: 'strip-strings',
+    confidence: 'medium',
+    description: 'Detect dangerous eval and dynamic code execution',
+    longDescription: `**Purpose:** Detects usage of \`eval()\`, \`new Function()\`, and other dynamic code execution patterns that can lead to code injection vulnerabilities.
+
+**Detects:**
+- \`eval(\` calls
+- \`new Function(\` constructor usage
+- \`setTimeout('string', ...)\` with string argument instead of function reference
+- \`setInterval('string', ...)\` with string argument instead of function reference
+
+**Why it matters:** Dynamic code execution from strings (\`eval\`, \`new Function\`, string-based timers) allows attackers to inject and run arbitrary code if any input reaches these functions.
+
+**Scope:** General best practice. Analyzes each file individually against the production preset.`,
+    tags: ['security', 'injection', 'eval'],
+    fileTypes: ['ts', 'tsx'],
+    options: {
+        // Original site emitted at most one violation per line, returning
+        // the FIRST matching pattern via findEvalPattern().
+        oneViolationPerLine: true,
+    },
+    patterns: [
+        {
+            id: '1ea47b8c-18be-402b-ae19-8ac66a88d050',
+            slug: 'eval-call',
+            // Match only the global/bare `eval(` — NOT a member call `x.eval(`
+            // (e.g. ioredis / Sequelize `redis.eval(luaScript, …)` is a Redis
+            // server-side Lua EVAL, not JavaScript eval) nor an identifier that
+            // merely ends in `eval` (`retrieval(`, `myEval(`). The negative
+            // lookbehind rejects a preceding `.`, word char, or `$`.
+            regex: /(?<![.\w$])eval\s*\(/,
+            message: 'eval() usage detected - use JSON.parse or other safe alternatives',
+            severity: 'error',
+            suggestion: 'Replace eval() with safe alternatives: use JSON.parse() for JSON strings, use a proper expression parser for math, or restructure code to avoid dynamic evaluation entirely.',
+        },
+        {
+            id: 'b7c3a2c2-0448-405f-86e3-8b5fca987bc7',
+            slug: 'new-function',
+            regex: /\bnew\s+Function\s*\(/,
+            message: 'new Function() usage detected - avoid dynamic code generation',
+            severity: 'error',
+            suggestion: 'Replace new Function() with precompiled functions or safe alternatives. For templating, use a template engine. For dynamic behavior, use configuration objects or the strategy pattern.',
+        },
+        {
+            id: 'a09a09f6-13c1-4988-9275-aec0ef3572e5',
+            slug: 'set-timeout-string',
+            regex: /setTimeout\s*\(\s*['"`][^'"`]+['"`]/,
+            message: 'setTimeout with string argument detected - use function reference',
+            severity: 'error',
+            suggestion: 'Pass a function reference instead of a string: setTimeout(() => doSomething(), 1000) or setTimeout(doSomething, 1000). String arguments are evaluated like eval().',
+        },
+        {
+            id: '9968cdec-1541-4522-ac02-e9eff56a5c2a',
+            slug: 'set-interval-string',
+            regex: /setInterval\s*\(\s*['"`][^'"`]+['"`]/,
+            message: 'setInterval with string argument detected - use function reference',
+            severity: 'error',
+            suggestion: 'Pass a function reference instead of a string: setInterval(() => doSomething(), 1000) or setInterval(doSomething, 1000). String arguments are evaluated like eval().',
+        },
+    ],
+});
+//# sourceMappingURL=no-eval.js.map

package/dist/checks/security/no-eval.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"no-eval.js","sourceRoot":"","sources":["../../../src/checks/security/no-eval.ts"],"names":[],"mappings":"AAAA,6IAA6I;AAC7I,mKAAmK;AACnK;;;;;;;GAOG;AAEH,OAAO,EAAE,oBAAoB,EAAE,MAAM,sBAAsB,CAAC;AAE5D;;;;;GAKG;AACH,MAAM,CAAC,MAAM,MAAM,GAAG,oBAAoB,CAAC;IACzC,EAAE,EAAE,sCAAsC;IAC1C,IAAI,EAAE,SAAS;IACf,KAAK,EAAE,EAAE,SAAS,EAAE,CAAC,YAAY,CAAC,EAAE,QAAQ,EAAE,CAAC,SAAS,EAAE,UAAU,EAAE,KAAK,CAAC,EAAE;IAC9E,aAAa,EAAE,eAAe;IAC9B,UAAU,EAAE,QAAQ;IACpB,WAAW,EAAE,kDAAkD;IAC/D,eAAe,EAAE;;;;;;;;;;iGAU8E;IAC/F,IAAI,EAAE,CAAC,UAAU,EAAE,WAAW,EAAE,MAAM,CAAC;IACvC,SAAS,EAAE,CAAC,IAAI,EAAE,KAAK,CAAC;IACxB,OAAO,EAAE;QACP,kEAAkE;QAClE,oDAAoD;QACpD,mBAAmB,EAAE,IAAI;KAC1B;IACD,QAAQ,EAAE;QACR;YACE,EAAE,EAAE,sCAAsC;YAC1C,IAAI,EAAE,WAAW;YACjB,mEAAmE;YACnE,kEAAkE;YAClE,oEAAoE;YACpE,gEAAgE;YAChE,yDAAyD;YACzD,KAAK,EAAE,sBAAsB;YAC7B,OAAO,EAAE,mEAAmE;YAC5E,QAAQ,EAAE,OAAO;YACjB,UAAU,EACR,8KAA8K;SACjL;QACD;YACE,EAAE,EAAE,sCAAsC;YAC1C,IAAI,EAAE,cAAc;YACpB,KAAK,EAAE,uBAAuB;YAC9B,OAAO,EAAE,+DAA+D;YACxE,QAAQ,EAAE,OAAO;YACjB,UAAU,EACR,yLAAyL;SAC5L;QACD;YACE,EAAE,EAAE,sCAAsC;YAC1C,IAAI,EAAE,oBAAoB;YAC1B,KAAK,EAAE,qCAAqC;YAC5C,OAAO,EAAE,mEAAmE;YAC5E,QAAQ,EAAE,OAAO;YACjB,UAAU,EACR,oKAAoK;SACvK;QACD;YACE,EAAE,EAAE,sCAAsC;YAC1C,IAAI,EAAE,qBAAqB;YAC3B,KAAK,EAAE,sCAAsC;YAC7C,OAAO,EAAE,oEAAoE;YAC7E,QAAQ,EAAE,OAAO;YACjB,UAAU,EACR,sKAAsK;SACzK;KACF;CACF,CAAC,CAAC"}

package/dist/checks/security/no-hardcoded-secrets.d.ts

@@ -0,0 +1,28 @@
+/**
+ * @fileoverview Detect hardcoded secrets in source code.
+ *
+ * Inline regex-list shape retained — migration to `defineRegexListCheck`
+ * deferred (Phase C6 / 2026-05-23 NF2). This site has site-specific
+ * post-match filters that the helper does not model:
+ *   1. `isInsideRegexLiteral` — skips matches inside `/.../` literals
+ *      to avoid false-firing on detection-pattern source itself.
+ *   2. `lineHasRedactionPlaceholder` — skips lines containing `***`,
+ *      `[REDACTED]`, `<REDACTED>`, or `X{4,}` redaction markers.
+ * Adding these as helper options would broaden its surface beyond
+ * what the other adopters need; keeping them inline here is the
+ * smaller change.
+ */
+import { type CheckViolation } from '@opensip-cli/fitness';
+/**
+ * Check: security/no-hardcoded-secrets
+ *
+ * Detects hardcoded secrets, API keys, and credentials in source code.
+ * Secrets should come from environment variables or secret management.
+ */
+export declare const noHardcodedSecrets: import("@opensip-cli/fitness").Check;
+/**
+ * Pure analysis function. Exported so unit tests can exercise the
+ * detection logic without standing up the full Check framework.
+ */
+export declare function analyzeHardcodedSecrets(content: string, filePath: string): CheckViolation[];
+//# sourceMappingURL=no-hardcoded-secrets.d.ts.map

package/dist/checks/security/no-hardcoded-secrets.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"no-hardcoded-secrets.d.ts","sourceRoot":"","sources":["../../../src/checks/security/no-hardcoded-secrets.ts"],"names":[],"mappings":"AACA;;;;;;;;;;;;;GAaG;AAGH,OAAO,EAAe,KAAK,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAyFxE;;;;;GAKG;AACH,eAAO,MAAM,kBAAkB,sCA4B7B,CAAC;AAEH;;;GAGG;AACH,wBAAgB,uBAAuB,CAAC,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,cAAc,EAAE,CAc3F"}

package/dist/checks/security/no-hardcoded-secrets.js

@@ -0,0 +1,209 @@
+// @fitness-ignore-file no-hardcoded-secrets -- Fitness check definition references secret patterns in longDescription as examples, not actual secrets
+/**
+ * @fileoverview Detect hardcoded secrets in source code.
+ *
+ * Inline regex-list shape retained — migration to `defineRegexListCheck`
+ * deferred (Phase C6 / 2026-05-23 NF2). This site has site-specific
+ * post-match filters that the helper does not model:
+ *   1. `isInsideRegexLiteral` — skips matches inside `/.../` literals
+ *      to avoid false-firing on detection-pattern source itself.
+ *   2. `lineHasRedactionPlaceholder` — skips lines containing `***`,
+ *      `[REDACTED]`, `<REDACTED>`, or `X{4,}` redaction markers.
+ * Adding these as helper options would broaden its surface beyond
+ * what the other adopters need; keeping them inline here is the
+ * smaller change.
+ */
+import { logger } from '@opensip-cli/core';
+import { defineCheck } from '@opensip-cli/fitness';
+/**
+ * Creates a pre-compiled RegExp for pattern matching.
+ * These patterns operate on trusted source code files, not user input,
+ * and use bounded character classes to prevent ReDoS.
+ * @param pattern - The regex pattern string
+ * @param flags - Optional regex flags
+ * @returns Compiled RegExp object
+ */
+function createPattern(pattern, flags) {
+    // @fitness-ignore-next-line semgrep-scan -- non-literal RegExp is intentional; patterns are hardcoded string constants for code analysis, not user input
+    return new RegExp(pattern, flags);
+}
+// Patterns that indicate hardcoded secrets
+// Note: These regex patterns operate on trusted source code files, not user input.
+// The patterns use bounded character classes and limited repetition to prevent ReDoS.
+const SECRET_PATTERNS = [
+    // Stripe keys - bounded alphanumeric character class
+    {
+        regex: createPattern('[\'"`]sk_live_[a-zA-Z0-9]{20,}[\'"`]', 'g'),
+        message: 'Hardcoded Stripe secret key detected',
+        suggestion: 'Move Stripe secret key to environment variable: process.env.STRIPE_SECRET_KEY. Never commit production keys to source control.',
+    },
+    {
+        regex: createPattern('[\'"`]pk_live_[a-zA-Z0-9]{20,}[\'"`]', 'g'),
+        message: 'Hardcoded Stripe publishable key detected',
+        suggestion: 'Move Stripe publishable key to environment variable: process.env.STRIPE_PUBLISHABLE_KEY. Use separate keys for test/production environments.',
+    },
+    {
+        regex: createPattern('[\'"`]rk_live_[a-zA-Z0-9]{20,}[\'"`]', 'g'),
+        message: 'Hardcoded Stripe restricted key detected',
+        suggestion: 'Move Stripe restricted key to environment variable. Consider using Stripe Connect if exposing to third parties.',
+    },
+    // AWS keys - bounded alphanumeric character class
+    {
+        regex: createPattern('[\'"`]AKIA[A-Z0-9]{16}[\'"`]', 'g'),
+        message: 'Hardcoded AWS access key detected',
+        suggestion: 'Remove AWS access key immediately and rotate it. Use IAM roles, environment variables, or AWS Secrets Manager instead of hardcoded credentials.',
+    },
+    // Generic API keys - use [\\w-] (word chars + hyphen) to avoid character class duplicates
+    {
+        regex: createPattern('(?:api[_-]?key|apikey)\\s*[:=]\\s*[\'"`][\\w-]{16,}[\'"`]', 'gi'),
+        message: 'Hardcoded API key detected',
+        suggestion: 'Move API key to environment variable: process.env.API_KEY. For local development, use .env files (and add to .gitignore).',
+    },
+    // Passwords - uses [^'"`]* which is bounded by quote characters
+    {
+        regex: createPattern('(?:password|passwd|pwd)\\s*[:=]\\s*[\'"`][^\'"`]{8,}[\'"`]', 'gi'),
+        message: 'Hardcoded password detected',
+        suggestion: 'Move password to environment variable or secrets manager. Never store passwords in source code. Consider using a password manager or vault service.',
+    },
+    // JWT secrets - uses [^'"`]* which is bounded by quote characters
+    {
+        regex: createPattern('(?:jwt[_-]?secret|jwt[_-]?key)\\s*[:=]\\s*[\'"`][^\'"`]{8,}[\'"`]', 'gi'),
+        message: 'Hardcoded JWT secret detected',
+        suggestion: 'Move JWT secret to environment variable: process.env.JWT_SECRET. Generate a strong random secret (256+ bits) and rotate periodically.',
+    },
+    // Database connection strings with credentials - uses [^:]+ and [^@]+ which are bounded
+    {
+        regex: createPattern('(?:postgres|mysql|mongodb)://[^:]+:[^@]+@', 'gi'),
+        message: 'Hardcoded database connection string with credentials detected',
+        suggestion: 'Use environment variables for database credentials: process.env.DATABASE_URL. Consider using IAM authentication or secrets manager for production.',
+    },
+    // Private keys (PEM format start) - fixed pattern, no variable repetition
+    {
+        regex: createPattern(String.raw `-----BEGIN\s+(?:RSA\s+)?PRIVATE\s+KEY-----`, 'g'),
+        message: 'Hardcoded private key detected',
+        suggestion: 'Move private key to a secure file outside the repository or use a secrets manager. Never commit private keys to source control. If exposed, rotate immediately.',
+    },
+    // Bearer tokens - use [\\w-] (word chars + hyphen) to avoid character class duplicates
+    {
+        regex: createPattern('[\'"`]Bearer\\s+[\\w-]{20,}[\'"`]', 'g'),
+        message: 'Hardcoded bearer token detected',
+        suggestion: 'Remove hardcoded bearer token. Tokens should be obtained at runtime through authentication flows, not stored in code.',
+    },
+];
+/**
+ * Check: security/no-hardcoded-secrets
+ *
+ * Detects hardcoded secrets, API keys, and credentials in source code.
+ * Secrets should come from environment variables or secret management.
+ */
+export const noHardcodedSecrets = defineCheck({
+    id: '68ba1265-9e9b-4a1c-9adc-73c68f470242',
+    slug: 'no-hardcoded-secrets',
+    scope: { languages: ['typescript'], concerns: ['backend', 'frontend', 'cli'] },
+    contentFilter: 'strip-strings',
+    confidence: 'medium',
+    description: 'Detect hardcoded secrets, API keys, and credentials in source code',
+    longDescription: `**Purpose:** Detects hardcoded secrets, API keys, and credentials in source code that should be stored in environment variables or a secrets manager.
+
+**Detects:**
+- Stripe keys: \`sk_live_\`, \`pk_live_\`, \`rk_live_\` prefixed strings
+- AWS access keys: \`AKIA\` prefixed strings (16+ alphanumeric chars)
+- Generic API keys: \`api_key\`/\`apikey\` assignments with 16+ character string values
+- Hardcoded passwords: \`password\`/\`passwd\`/\`pwd\` assignments with 8+ character values
+- JWT secrets: \`jwt_secret\`/\`jwt_key\` assignments with 8+ character values
+- Database connection strings with embedded credentials: \`postgres://user:pass@host\`
+- PEM private keys: \`-----BEGIN PRIVATE KEY-----\`
+- Bearer tokens: \`Bearer \` followed by 20+ character token strings
+
+**Why it matters:** Secrets committed to source control are permanently exposed in git history and can be harvested by attackers scanning repositories.
+
+**Scope:** General best practice. Analyzes each file individually against the production preset.`,
+    tags: ['security', 'secrets', 'credentials'],
+    fileTypes: ['ts', 'tsx'],
+    analyze(content, filePath) {
+        return analyzeHardcodedSecrets(content, filePath);
+    },
+});
+/**
+ * Pure analysis function. Exported so unit tests can exercise the
+ * detection logic without standing up the full Check framework.
+ */
+export function analyzeHardcodedSecrets(content, filePath) {
+    logger.debug({
+        evt: 'fitness.checks.no_hardcoded_secrets.analyze',
+        msg: 'Analyzing file for hardcoded secrets and credentials',
+    });
+    const violations = [];
+    const lines = content.split('\n');
+    for (const [lineNum, line_] of lines.entries()) {
+        const line = line_ ?? '';
+        analyzeLine(line, lineNum + 1, filePath, violations);
+    }
+    return violations;
+}
+function analyzeLine(line, lineNumber, filePath, violations) {
+    const trimmed = line.trim();
+    if (trimmed.startsWith('//') || trimmed.startsWith('*'))
+        return;
+    for (const pattern of SECRET_PATTERNS) {
+        pattern.regex.lastIndex = 0;
+        const matched = pattern.regex.exec(line);
+        if (!matched)
+            continue;
+        if (isInsideRegexLiteral(line, matched.index))
+            continue;
+        if (lineHasRedactionPlaceholder(line))
+            continue;
+        violations.push({
+            line: lineNumber,
+            column: matched.index,
+            message: pattern.message,
+            severity: 'error',
+            suggestion: pattern.suggestion,
+            match: matched[0],
+            filePath,
+        });
+    }
+}
+/**
+ * Heuristic: is `pos` inside a regex literal on `line`? Walks the line
+ * tracking unescaped `/` chars as regex-literal delimiters. A position
+ * with an odd number of unescaped `/` chars to its left, and another
+ * unescaped `/` after, is inside a literal.
+ *
+ * Heuristic — division operators and JSX can confuse it, but lines
+ * with those tokens AND a secret-pattern match in the same line are
+ * rare; the trade-off favors silencing the redaction-pattern FPs.
+ */
+function isInsideRegexLiteral(line, pos) {
+    // Count unescaped slashes before pos.
+    let slashesBefore = 0;
+    for (let i = 0; i < pos; i++) {
+        if (line[i] === '/' && line[i - 1] !== '\\')
+            slashesBefore++;
+    }
+    if (slashesBefore % 2 !== 1)
+        return false;
+    // Check at least one unescaped slash follows.
+    for (let i = pos; i < line.length; i++) {
+        if (line[i] === '/' && line[i - 1] !== '\\')
+            return true;
+    }
+    return false;
+}
+/**
+ * True iff the LINE around a secret match contains a redaction-
+ * placeholder marker. Many of the project-defined patterns only match
+ * the HEADER (e.g. `-----BEGIN PRIVATE KEY-----`) but the surrounding
+ * value is replaced with `***`, `[REDACTED]`, etc. Checking the line
+ * (not just the matched span) catches those.
+ *
+ * Markers: `***`, `<REDACTED>`, `[REDACTED]`, runs of `X` (4+).
+ */
+function lineHasRedactionPlaceholder(line) {
+    return (line.includes('***') ||
+        line.includes('[REDACTED]') ||
+        line.includes('<REDACTED>') ||
+        /X{4,}/.test(line));
+}
+//# sourceMappingURL=no-hardcoded-secrets.js.map

package/dist/checks/security/no-hardcoded-secrets.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"no-hardcoded-secrets.js","sourceRoot":"","sources":["../../../src/checks/security/no-hardcoded-secrets.ts"],"names":[],"mappings":"AAAA,sJAAsJ;AACtJ;;;;;;;;;;;;;GAaG;AAEH,OAAO,EAAE,MAAM,EAAE,MAAM,mBAAmB,CAAC;AAC3C,OAAO,EAAE,WAAW,EAAuB,MAAM,sBAAsB,CAAC;AAExE;;;;;;;GAOG;AACH,SAAS,aAAa,CAAC,OAAe,EAAE,KAAc;IACpD,yJAAyJ;IACzJ,OAAO,IAAI,MAAM,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;AACpC,CAAC;AAED,2CAA2C;AAC3C,mFAAmF;AACnF,sFAAsF;AACtF,MAAM,eAAe,GAAG;IACtB,qDAAqD;IACrD;QACE,KAAK,EAAE,aAAa,CAAC,sCAAsC,EAAE,GAAG,CAAC;QACjE,OAAO,EAAE,sCAAsC;QAC/C,UAAU,EACR,gIAAgI;KACnI;IACD;QACE,KAAK,EAAE,aAAa,CAAC,sCAAsC,EAAE,GAAG,CAAC;QACjE,OAAO,EAAE,2CAA2C;QACpD,UAAU,EACR,8IAA8I;KACjJ;IACD;QACE,KAAK,EAAE,aAAa,CAAC,sCAAsC,EAAE,GAAG,CAAC;QACjE,OAAO,EAAE,0CAA0C;QACnD,UAAU,EACR,iHAAiH;KACpH;IACD,kDAAkD;IAClD;QACE,KAAK,EAAE,aAAa,CAAC,8BAA8B,EAAE,GAAG,CAAC;QACzD,OAAO,EAAE,mCAAmC;QAC5C,UAAU,EACR,iJAAiJ;KACpJ;IACD,0FAA0F;IAC1F;QACE,KAAK,EAAE,aAAa,CAAC,2DAA2D,EAAE,IAAI,CAAC;QACvF,OAAO,EAAE,4BAA4B;QACrC,UAAU,EACR,2HAA2H;KAC9H;IACD,gEAAgE;IAChE;QACE,KAAK,EAAE,aAAa,CAAC,4DAA4D,EAAE,IAAI,CAAC;QACxF,OAAO,EAAE,6BAA6B;QACtC,UAAU,EACR,qJAAqJ;KACxJ;IACD,kEAAkE;IAClE;QACE,KAAK,EAAE,aAAa,CAAC,mEAAmE,EAAE,IAAI,CAAC;QAC/F,OAAO,EAAE,+BAA+B;QACxC,UAAU,EACR,uIAAuI;KAC1I;IACD,wFAAwF;IACxF;QACE,KAAK,EAAE,aAAa,CAAC,2CAA2C,EAAE,IAAI,CAAC;QACvE,OAAO,EAAE,gEAAgE;QACzE,UAAU,EACR,oJAAoJ;KACvJ;IACD,0EAA0E;IAC1E;QACE,KAAK,EAAE,aAAa,CAAC,MAAM,CAAC,GAAG,CAAA,4CAA4C,EAAE,GAAG,CAAC;QACjF,OAAO,EAAE,gCAAgC;QACzC,UAAU,EACR,iKAAiK;KACpK;IACD,uFAAuF;IACvF;QACE,KAAK,EAAE,aAAa,CAAC,mCAAmC,EAAE,GAAG,CAAC;QAC9D,OAAO,EAAE,iCAAiC;QAC1C,UAAU,EACR,uHAAuH;KAC1H;CACF,CAAC;AAEF;;;;;GAKG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG,WAAW,CAAC;IAC5C,EAAE,EAAE,sCAAsC;IAC1C,IAAI,EAAE,sBAAsB;IAC5B,KAAK,EAAE,EAAE,SAAS,EAAE,CAAC,YAAY,CAAC,EAAE,QAAQ,EAAE,CAAC,SAAS,EAAE,UAAU,EAAE,KAAK,CAAC,EAAE;IAC9E,aAAa,EAAE,eAAe;IAC9B,UAAU,EAAE,QAAQ;IACpB,WAAW,EAAE,oEAAoE;IACjF,eAAe,EAAE;;;;;;;;;;;;;;iGAc8E;IAC/F,IAAI,EAAE,CAAC,UAAU,EAAE,SAAS,EAAE,aAAa,CAAC;IAC5C,SAAS,EAAE,CAAC,IAAI,EAAE,KAAK,CAAC;IAExB,OAAO,CAAC,OAAe,EAAE,QAAgB;QACvC,OAAO,uBAAuB,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;IACpD,CAAC;CACF,CAAC,CAAC;AAEH;;;GAGG;AACH,MAAM,UAAU,uBAAuB,CAAC,OAAe,EAAE,QAAgB;IACvE,MAAM,CAAC,KAAK,CAAC;QACX,GAAG,EAAE,6CAA6C;QAClD,GAAG,EAAE,sDAAsD;KAC5D,CAAC,CAAC;IACH,MAAM,UAAU,GAAqB,EAAE,CAAC;IACxC,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAElC,KAAK,MAAM,CAAC,OAAO,EAAE,KAAK,CAAC,IAAI,KAAK,CAAC,OAAO,EAAE,EAAE,CAAC;QAC/C,MAAM,IAAI,GAAG,KAAK,IAAI,EAAE,CAAC;QACzB,WAAW,CAAC,IAAI,EAAE,OAAO,GAAG,CAAC,EAAE,QAAQ,EAAE,UAAU,CAAC,CAAC;IACvD,CAAC;IAED,OAAO,UAAU,CAAC;AACpB,CAAC;AAED,SAAS,WAAW,CAClB,IAAY,EACZ,UAAkB,EAClB,QAAgB,EAChB,UAA4B;IAE5B,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;IAC5B,IAAI,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,OAAO;IAEhE,KAAK,MAAM,OAAO,IAAI,eAAe,EAAE,CAAC;QACtC,OAAO,CAAC,KAAK,CAAC,SAAS,GAAG,CAAC,CAAC;QAC5B,MAAM,OAAO,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACzC,IAAI,CAAC,OAAO;YAAE,SAAS;QACvB,IAAI,oBAAoB,CAAC,IAAI,EAAE,OAAO,CAAC,KAAK,CAAC;YAAE,SAAS;QACxD,IAAI,2BAA2B,CAAC,IAAI,CAAC;YAAE,SAAS;QAChD,UAAU,CAAC,IAAI,CAAC;YACd,IAAI,EAAE,UAAU;YAChB,MAAM,EAAE,OAAO,CAAC,KAAK;YACrB,OAAO,EAAE,OAAO,CAAC,OAAO;YACxB,QAAQ,EAAE,OAAO;YACjB,UAAU,EAAE,OAAO,CAAC,UAAU;YAC9B,KAAK,EAAE,OAAO,CAAC,CAAC,CAAC;YACjB,QAAQ;SACT,CAAC,CAAC;IACL,CAAC;AACH,CAAC;AAED;;;;;;;;;GASG;AACH,SAAS,oBAAoB,CAAC,IAAY,EAAE,GAAW;IACrD,sCAAsC;IACtC,IAAI,aAAa,GAAG,CAAC,CAAC;IACtB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC;QAC7B,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,GAAG,IAAI,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,IAAI;YAAE,aAAa,EAAE,CAAC;IAC/D,CAAC;IACD,IAAI,aAAa,GAAG,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IAC1C,8CAA8C;IAC9C,KAAK,IAAI,CAAC,GAAG,GAAG,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACvC,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,GAAG,IAAI,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,IAAI;YAAE,OAAO,IAAI,CAAC;IAC3D,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;;;;GAQG;AACH,SAAS,2BAA2B,CAAC,IAAY;IAC/C,OAAO,CACL,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC;QACpB,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC;QAC3B,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC;QAC3B,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CACnB,CAAC;AACJ,CAAC"}

package/dist/checks/security/package-supply-chain-policy.d.ts

@@ -0,0 +1,12 @@
+/**
+ * @fileoverview Package supply-chain policy check
+ *
+ * Validates consumer-side package-manager guardrails for npm, pnpm, and Bun:
+ * pinned package manager, committed lockfile, frozen CI installs, install
+ * script policy, dependency maturity gates, lockfile integrity coverage,
+ * exotic dependency review, and trusted publishing posture.
+ */
+import { type CheckViolation, type FileAccessor } from '@opensip-cli/fitness';
+export declare function analyzePackageSupplyChainPolicy(files: FileAccessor): Promise<CheckViolation[]>;
+export declare const packageSupplyChainPolicy: import("@opensip-cli/fitness").Check;
+//# sourceMappingURL=package-supply-chain-policy.d.ts.map

package/dist/checks/security/package-supply-chain-policy.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"package-supply-chain-policy.d.ts","sourceRoot":"","sources":["../../../src/checks/security/package-supply-chain-policy.ts"],"names":[],"mappings":"AACA;;;;;;;GAOG;AAKH,OAAO,EAAe,KAAK,cAAc,EAAE,KAAK,YAAY,EAAE,MAAM,sBAAsB,CAAC;AAskB3F,wBAAsB,+BAA+B,CACnD,KAAK,EAAE,YAAY,GAClB,OAAO,CAAC,cAAc,EAAE,CAAC,CAqB3B;AAED,eAAO,MAAM,wBAAwB,sCA2BnC,CAAC"}