@opensip-cli/checks-universal 0.1.0

package/dist/checks/security/package-supply-chain-policy.js

@@ -0,0 +1,534 @@
+// @fitness-ignore-file unbounded-memory -- reads small repository config files (package.json, lockfiles, workflows); bounded by standard project metadata size
+/**
+ * @fileoverview Package supply-chain policy check
+ *
+ * Validates consumer-side package-manager guardrails for npm, pnpm, and Bun:
+ * pinned package manager, committed lockfile, frozen CI installs, install
+ * script policy, dependency maturity gates, lockfile integrity coverage,
+ * exotic dependency review, and trusted publishing posture.
+ */
+import * as fs from 'node:fs';
+import * as path from 'node:path';
+import { defineCheck } from '@opensip-cli/fitness';
+const SUPPORTED_LOCKFILES = [
+    'pnpm-lock.yaml',
+    'package-lock.json',
+    'npm-shrinkwrap.json',
+    'bun.lock',
+    'bun.lockb',
+];
+const PNPM_WORKSPACE_FILE = 'pnpm-workspace.yaml';
+const INSTALL_LIFECYCLE_SCRIPTS = new Set(['preinstall', 'install', 'postinstall']);
+const DEPENDENCY_FIELDS = [
+    'dependencies',
+    'devDependencies',
+    'optionalDependencies',
+    'peerDependencies',
+];
+function readIfExists(filePath) {
+    try {
+        if (!fs.existsSync(filePath))
+            return null;
+        return fs.readFileSync(filePath, 'utf8');
+    }
+    catch {
+        // @swallow-ok unreadable file (permission/IO) -> treat as absent
+        return null;
+    }
+}
+function parseJson(content) {
+    try {
+        return JSON.parse(content);
+    }
+    catch {
+        // @swallow-ok malformed JSON -> treat as unparseable
+        return null;
+    }
+}
+function lineOf(content, needle) {
+    const lines = content.split('\n');
+    for (const [i, line] of lines.entries()) {
+        if (typeof needle === 'string' ? line.includes(needle) : needle.test(line)) {
+            return i + 1;
+        }
+    }
+    return 1;
+}
+function normalizeRel(filePath, rootDir) {
+    return path.relative(rootDir, filePath).split(path.sep).join('/');
+}
+function getConfigValue(content, key) {
+    if (!content)
+        return null;
+    const escaped = key.replaceAll(/[.*+?^${}()|[\]\\]/g, String.raw `\$&`);
+    const match = new RegExp(String.raw `^\s*${escaped}\s*[:=]\s*([^#\n]+)`, 'm').exec(content);
+    return match?.[1]?.trim().replaceAll(/^['"]|['"]$/g, '') ?? null;
+}
+function getNpmrcBoolean(content, key) {
+    return getConfigValue(content, key)?.toLowerCase() === 'true';
+}
+function getPositiveNumber(content, key) {
+    const value = getConfigValue(content, key);
+    if (!value)
+        return null;
+    const parsed = Number.parseInt(value, 10);
+    return Number.isFinite(parsed) && parsed > 0 ? parsed : null;
+}
+function hasTopLevelKey(content, key) {
+    if (!content)
+        return false;
+    const escaped = key.replaceAll(/[.*+?^${}()|[\]\\]/g, String.raw `\$&`);
+    return new RegExp(`^${escaped}:`, 'm').test(content);
+}
+function hasScalarValue(content, key, expected) {
+    return getConfigValue(content, key)?.toLowerCase() === expected.toLowerCase();
+}
+async function readPackageJsons(files, rootDir) {
+    const packagePaths = files.paths
+        .filter((filePath) => path.basename(filePath) === 'package.json')
+        .sort((a, b) => a.length - b.length);
+    // Read all package.json files in parallel, then assemble in path order.
+    const contents = await Promise.all(packagePaths.map((filePath) => files.read(filePath)));
+    const packages = [];
+    for (const [i, filePath] of packagePaths.entries()) {
+        const json = parseJson(contents[i]);
+        if (!json)
+            continue;
+        packages.push({
+            filePath,
+            relPath: normalizeRel(filePath, rootDir),
+            packageDir: path.dirname(filePath),
+            json,
+        });
+    }
+    return packages;
+}
+function findRootPackagePath(paths) {
+    const candidates = paths
+        .filter((filePath) => path.basename(filePath) === 'package.json')
+        .sort((a, b) => a.split(path.sep).length - b.split(path.sep).length);
+    return candidates[0] ?? null;
+}
+function readWorkflows(rootDir) {
+    const workflowsDir = path.join(rootDir, '.github', 'workflows');
+    if (!fs.existsSync(workflowsDir))
+        return [];
+    const workflows = [];
+    for (const entry of fs.readdirSync(workflowsDir, { withFileTypes: true })) {
+        if (!entry.isFile() || !/\.(ya?ml)$/i.test(entry.name))
+            continue;
+        const filePath = path.join(workflowsDir, entry.name);
+        const content = readIfExists(filePath);
+        if (content === null)
+            continue;
+        workflows.push({ filePath, relPath: normalizeRel(filePath, rootDir), content });
+    }
+    return workflows;
+}
+async function buildSnapshot(files) {
+    const rootPackagePath = findRootPackagePath(files.paths);
+    if (!rootPackagePath)
+        return null;
+    const rootDir = path.dirname(rootPackagePath);
+    const rootContent = await files.read(rootPackagePath);
+    const rootPackage = parseJson(rootContent);
+    if (!rootPackage)
+        return null;
+    return {
+        rootDir,
+        rootPackagePath,
+        rootPackage,
+        packages: await readPackageJsons(files, rootDir),
+        lockfiles: new Set(SUPPORTED_LOCKFILES.filter((name) => fs.existsSync(path.join(rootDir, name)))),
+        pnpmWorkspace: readIfExists(path.join(rootDir, PNPM_WORKSPACE_FILE)),
+        npmrc: readIfExists(path.join(rootDir, '.npmrc')),
+        bunfig: readIfExists(path.join(rootDir, 'bunfig.toml')),
+        workflows: readWorkflows(rootDir),
+    };
+}
+function pushViolation(violations, violation) {
+    violations.push({ severity: 'warning', line: 1, ...violation });
+}
+function checkPackageManagerPin(snapshot, violations) {
+    const value = snapshot.rootPackage.packageManager;
+    if (!value) {
+        pushViolation(violations, {
+            filePath: snapshot.rootPackagePath,
+            type: 'package-manager-missing',
+            message: 'Root package.json does not declare a packageManager pin',
+            suggestion: 'Add an exact packageManager value such as "pnpm@11.5.1+sha512.<hash>" so Corepack installs the expected package manager.',
+            severity: 'error',
+        });
+        return;
+    }
+    if (!/^(npm|pnpm|bun)@\d+\.\d+\.\d+(?:[-+][A-Za-z0-9._~+-]+)?$/.test(value)) {
+        pushViolation(violations, {
+            filePath: snapshot.rootPackagePath,
+            type: 'package-manager-not-exact',
+            message: `packageManager "${value}" is not an exact package-manager version`,
+            suggestion: 'Pin packageManager to an exact version; do not use ranges, tags, or unversioned package-manager names.',
+            severity: 'error',
+            line: lineOf(readIfExists(snapshot.rootPackagePath) ?? '', 'packageManager'),
+        });
+    }
+    if (value.startsWith('pnpm@') && !value.includes('+sha512.')) {
+        pushViolation(violations, {
+            filePath: snapshot.rootPackagePath,
+            type: 'package-manager-missing-integrity',
+            message: 'pnpm packageManager pin is missing a Corepack sha512 integrity suffix',
+            suggestion: 'Use `corepack use pnpm@<version>` with a modern Corepack so package.json records the sha512-qualified pnpm pin.',
+            line: lineOf(readIfExists(snapshot.rootPackagePath) ?? '', 'packageManager'),
+        });
+    }
+}
+function checkLockfilePosture(snapshot, violations) {
+    if (snapshot.lockfiles.size === 0) {
+        pushViolation(violations, {
+            filePath: snapshot.rootPackagePath,
+            type: 'lockfile-missing',
+            message: 'No supported package-manager lockfile found at the project root',
+            suggestion: 'Commit one root lockfile: pnpm-lock.yaml, package-lock.json, npm-shrinkwrap.json, or bun.lock.',
+            severity: 'error',
+        });
+        return;
+    }
+    if (snapshot.lockfiles.size > 1) {
+        pushViolation(violations, {
+            filePath: snapshot.rootPackagePath,
+            type: 'multiple-lockfiles',
+            message: `Multiple package-manager lockfiles found: ${[...snapshot.lockfiles].join(', ')}`,
+            suggestion: 'Keep one authoritative lockfile for the package manager used by package.json#packageManager.',
+        });
+    }
+}
+function checkPackageLockIntegrity(snapshot, violations) {
+    const lockPath = path.join(snapshot.rootDir, 'package-lock.json');
+    const content = readIfExists(lockPath);
+    if (!content)
+        return;
+    const lock = parseJson(content);
+    if (!lock)
+        return;
+    const entries = [
+        ...Object.entries(lock.packages ?? {}),
+        ...Object.entries(lock.dependencies ?? {}),
+    ];
+    for (const [name, entry] of entries) {
+        if (!entry.resolved?.startsWith('http'))
+            continue;
+        if (entry.integrity)
+            continue;
+        pushViolation(violations, {
+            filePath: lockPath,
+            type: 'lockfile-entry-missing-integrity',
+            message: `Remote package-lock entry "${name || '<root>'}" has a resolved URL but no integrity hash`,
+            suggestion: 'Regenerate the lockfile with a modern npm CLI and review any direct URL dependencies.',
+            severity: 'error',
+            line: lineOf(content, entry.resolved),
+        });
+    }
+}
+function checkPnpmLockIntegrity(snapshot, violations) {
+    const lockPath = path.join(snapshot.rootDir, 'pnpm-lock.yaml');
+    const content = readIfExists(lockPath);
+    if (!content)
+        return;
+    const lines = content.split('\n');
+    for (const [index, rawLine] of lines.entries()) {
+        const line = rawLine.trim();
+        if (!line.includes('http') || !/(tarball|resolution):/.test(line))
+            continue;
+        const lookahead = lines.slice(index, index + 8).join('\n');
+        if (/integrity:\s*sha\d+-/i.test(lookahead) || /integrity:\s*['"]?sha\d+-/i.test(line))
+            continue;
+        pushViolation(violations, {
+            filePath: lockPath,
+            type: 'lockfile-entry-missing-integrity',
+            message: 'pnpm lockfile contains a remote tarball resolution without a nearby integrity hash',
+            suggestion: 'Upgrade pnpm and regenerate the lockfile; modern pnpm rejects mutable remote tarball entries without integrity.',
+            severity: 'error',
+            line: index + 1,
+        });
+    }
+}
+function checkLockfileIntegrity(snapshot, violations) {
+    checkPackageLockIntegrity(snapshot, violations);
+    checkPnpmLockIntegrity(snapshot, violations);
+}
+function dependencyEntries(pkg) {
+    const entries = [];
+    for (const field of DEPENDENCY_FIELDS) {
+        for (const [name, spec] of Object.entries(pkg[field] ?? {})) {
+            entries.push([name, spec]);
+        }
+    }
+    return entries;
+}
+function hasCommitPin(spec) {
+    return /#[a-f0-9]{40}(?:$|[^\da-f])/i.test(spec);
+}
+function isExoticSpec(spec) {
+    return /^(git\+|git:\/\/|github:|gitlab:|bitbucket:|https?:\/\/|ssh:\/\/|git@|file:)/.test(spec);
+}
+function checkExoticDependencies(snapshot, violations) {
+    for (const pkg of snapshot.packages) {
+        const content = readIfExists(pkg.filePath) ?? '';
+        for (const [name, spec] of dependencyEntries(pkg.json)) {
+            if (!isExoticSpec(spec))
+                continue;
+            const isGit = /^(git\+|git:\/\/|github:|gitlab:|bitbucket:|ssh:\/\/|git@)/.test(spec);
+            if (isGit && hasCommitPin(spec))
+                continue;
+            const kind = spec.startsWith('file:')
+                ? 'local path dependency'
+                : 'mutable non-registry dependency';
+            pushViolation(violations, {
+                filePath: pkg.filePath,
+                type: 'exotic-dependency-source',
+                message: `${pkg.relPath} declares ${kind} ${name}@${spec}`,
+                suggestion: 'Prefer registry/workspace dependencies. If a git dependency is unavoidable, pin it to a full 40-character commit SHA and review it explicitly.',
+                line: lineOf(content, `"${name}"`),
+            });
+        }
+    }
+}
+function checkInstallLifecycleScripts(snapshot, violations) {
+    for (const pkg of snapshot.packages) {
+        for (const scriptName of Object.keys(pkg.json.scripts ?? {})) {
+            if (!INSTALL_LIFECYCLE_SCRIPTS.has(scriptName))
+                continue;
+            pushViolation(violations, {
+                filePath: pkg.filePath,
+                type: 'install-lifecycle-script',
+                message: `${pkg.relPath} declares an install-time lifecycle script "${scriptName}"`,
+                suggestion: 'Avoid install-time lifecycle scripts in publishable packages. If this is an app-only script, document why it is safe and keep dependency install scripts disabled or allowlisted.',
+                severity: pkg.json.private === true ? 'warning' : 'error',
+                line: lineOf(readIfExists(pkg.filePath) ?? '', `"${scriptName}"`),
+            });
+        }
+    }
+}
+function checkInstallScriptPolicy(snapshot, violations) {
+    if (snapshot.lockfiles.has('pnpm-lock.yaml')) {
+        if (!hasTopLevelKey(snapshot.pnpmWorkspace, 'allowBuilds')) {
+            pushViolation(violations, {
+                filePath: path.join(snapshot.rootDir, PNPM_WORKSPACE_FILE),
+                type: 'install-script-policy-missing',
+                message: 'pnpm project does not declare an allowBuilds install-script policy',
+                suggestion: 'Add an explicit allowBuilds map to pnpm-workspace.yaml and approve only dependencies that truly need install/build scripts.',
+                severity: 'error',
+            });
+        }
+        if (hasScalarValue(snapshot.pnpmWorkspace, 'dangerouslyAllowAllBuilds', 'true')) {
+            pushViolation(violations, {
+                filePath: path.join(snapshot.rootDir, PNPM_WORKSPACE_FILE),
+                type: 'install-script-policy-allows-all',
+                message: 'pnpm dangerouslyAllowAllBuilds is enabled',
+                suggestion: 'Remove dangerouslyAllowAllBuilds and use a narrow allowBuilds map instead.',
+                severity: 'error',
+                line: lineOf(snapshot.pnpmWorkspace ?? '', 'dangerouslyAllowAllBuilds'),
+            });
+        }
+    }
+    if (snapshot.lockfiles.has('package-lock.json') ||
+        snapshot.lockfiles.has('npm-shrinkwrap.json')) {
+        const npmHasPolicy = getNpmrcBoolean(snapshot.npmrc, 'ignore-scripts') ||
+            (getNpmrcBoolean(snapshot.npmrc, 'strict-allow-scripts') &&
+                snapshot.npmrc?.includes('allow-scripts'));
+        if (!npmHasPolicy) {
+            pushViolation(violations, {
+                filePath: path.join(snapshot.rootDir, '.npmrc'),
+                type: 'install-script-policy-missing',
+                message: 'npm project does not disable or strictly allowlist dependency install scripts',
+                suggestion: 'Set ignore-scripts=true, or use strict-allow-scripts=true with a narrow allow-scripts policy for dependencies that genuinely need lifecycle hooks.',
+            });
+        }
+    }
+    if (snapshot.lockfiles.has('bun.lock') || snapshot.lockfiles.has('bun.lockb')) {
+        const trusted = snapshot.rootPackage.trustedDependencies;
+        if (!Array.isArray(trusted)) {
+            pushViolation(violations, {
+                filePath: snapshot.rootPackagePath,
+                type: 'install-script-policy-missing',
+                message: 'Bun project does not declare trustedDependencies',
+                suggestion: 'Add trustedDependencies to package.json. Use [] to disable all dependency lifecycle scripts, or list only reviewed packages.',
+            });
+        }
+    }
+}
+function checkMinimumReleaseAge(snapshot, violations) {
+    if (snapshot.lockfiles.has('pnpm-lock.yaml')) {
+        if ((getPositiveNumber(snapshot.pnpmWorkspace, 'minimumReleaseAge') ?? 0) <= 0) {
+            pushViolation(violations, {
+                filePath: path.join(snapshot.rootDir, PNPM_WORKSPACE_FILE),
+                type: 'minimum-release-age-missing',
+                message: 'pnpm minimumReleaseAge is not explicitly enabled',
+                suggestion: 'Set minimumReleaseAge: 1440 or higher in pnpm-workspace.yaml, and pair it with minimumReleaseAgeStrict: true.',
+                severity: 'error',
+            });
+        }
+        if (!hasScalarValue(snapshot.pnpmWorkspace, 'minimumReleaseAgeStrict', 'true')) {
+            pushViolation(violations, {
+                filePath: path.join(snapshot.rootDir, PNPM_WORKSPACE_FILE),
+                type: 'minimum-release-age-not-strict',
+                message: 'pnpm minimumReleaseAgeStrict is not enabled',
+                suggestion: 'Set minimumReleaseAgeStrict: true so newly published versions fail closed instead of being silently exempted.',
+            });
+        }
+    }
+    if ((snapshot.lockfiles.has('package-lock.json') ||
+        snapshot.lockfiles.has('npm-shrinkwrap.json')) &&
+        (getPositiveNumber(snapshot.npmrc, 'min-release-age') ?? 0) <= 0) {
+        pushViolation(violations, {
+            filePath: path.join(snapshot.rootDir, '.npmrc'),
+            type: 'minimum-release-age-missing',
+            message: 'npm min-release-age is not enabled',
+            suggestion: 'Set min-release-age to a positive number of days in project .npmrc.',
+        });
+    }
+    if ((snapshot.lockfiles.has('bun.lock') || snapshot.lockfiles.has('bun.lockb')) &&
+        (getPositiveNumber(snapshot.bunfig, 'minimumReleaseAge') ?? 0) <= 0) {
+        pushViolation(violations, {
+            filePath: path.join(snapshot.rootDir, 'bunfig.toml'),
+            type: 'minimum-release-age-missing',
+            message: 'Bun minimumReleaseAge is not enabled',
+            suggestion: 'Set [install].minimumReleaseAge to a positive number of seconds in bunfig.toml.',
+        });
+    }
+}
+function workflowLines(workflow) {
+    return workflow.content.split('\n');
+}
+function isFrozenInstallLine(line) {
+    return (/\bnpm\s+ci\b/.test(line) ||
+        /\bpnpm\s+(?:install|i)\b.*--frozen-lockfile/.test(line) ||
+        /\bpnpm\s+ci\b/.test(line) ||
+        /\bbun\s+install\b.*--frozen-lockfile/.test(line) ||
+        /\bbun\s+ci\b/.test(line));
+}
+function isPackageManagerBootstrapLine(line) {
+    return (/\bnpm\s+install\b.*\s--prefix\b.*\bnpm@\d+/.test(line) ||
+        /\bnpm\s+install\s+--prefix\b.*\bnpm@\d+/.test(line));
+}
+function isMutableInstallLine(line) {
+    if (isPackageManagerBootstrapLine(line))
+        return false;
+    return (/\bnpm\s+install\b/.test(line) ||
+        (/\bpnpm\s+(?:install|i)\b/.test(line) && !line.includes('--frozen-lockfile')) ||
+        (/\bbun\s+install\b/.test(line) && !line.includes('--frozen-lockfile')));
+}
+function checkFrozenCiInstalls(snapshot, violations) {
+    if (snapshot.workflows.length === 0)
+        return;
+    let hasFrozenInstall = false;
+    for (const workflow of snapshot.workflows) {
+        for (const [index, rawLine] of workflowLines(workflow).entries()) {
+            const line = rawLine.trim();
+            if (line.startsWith('#'))
+                continue;
+            if (isFrozenInstallLine(line))
+                hasFrozenInstall = true;
+            if (!isMutableInstallLine(line))
+                continue;
+            pushViolation(violations, {
+                filePath: workflow.filePath,
+                type: 'ci-install-not-frozen',
+                message: `${workflow.relPath} uses a mutable package install command: ${line}`,
+                suggestion: 'Use npm ci, pnpm install --frozen-lockfile, pnpm ci, bun install --frozen-lockfile, or bun ci in CI.',
+                severity: 'error',
+                line: index + 1,
+            });
+        }
+    }
+    if (!hasFrozenInstall) {
+        pushViolation(violations, {
+            filePath: snapshot.workflows[0]?.filePath ?? snapshot.rootPackagePath,
+            type: 'ci-frozen-install-missing',
+            message: 'No frozen package install command was found in GitHub workflows',
+            suggestion: 'Use npm ci, pnpm install --frozen-lockfile, pnpm ci, bun install --frozen-lockfile, or bun ci in every CI install lane.',
+        });
+    }
+}
+function checkTrustedPublishing(snapshot, violations) {
+    for (const workflow of snapshot.workflows) {
+        if (!/\bnpm\s+publish\b/.test(workflow.content))
+            continue;
+        if (!/id-token:\s*write/.test(workflow.content)) {
+            pushViolation(violations, {
+                filePath: workflow.filePath,
+                type: 'trusted-publishing-missing-oidc',
+                message: `${workflow.relPath} publishes to npm without id-token: write permission`,
+                suggestion: 'Use npm trusted publishing/OIDC and add permissions.id-token: write to the publish job.',
+                severity: 'error',
+                line: lineOf(workflow.content, 'npm publish'),
+            });
+        }
+        if (!/(--provenance|NPM_CONFIG_PROVENANCE\s*[:=]\s*true|provenance:\s*true)/.test(workflow.content)) {
+            pushViolation(violations, {
+                filePath: workflow.filePath,
+                type: 'publish-provenance-missing',
+                message: `${workflow.relPath} publishes to npm without explicit provenance`,
+                suggestion: 'Publish with npm trusted publishing and --provenance so consumers can verify build provenance.',
+                line: lineOf(workflow.content, 'npm publish'),
+            });
+        }
+        if (/(NPM_TOKEN|NODE_AUTH_TOKEN)/.test(workflow.content)) {
+            pushViolation(violations, {
+                filePath: workflow.filePath,
+                type: 'publish-token-exposure',
+                message: `${workflow.relPath} references a long-lived npm publish token`,
+                suggestion: 'Prefer npm trusted publishing/OIDC. Remove NPM_TOKEN/NODE_AUTH_TOKEN from publish jobs after migration.',
+                line: lineOf(workflow.content, /NPM_TOKEN|NODE_AUTH_TOKEN/),
+            });
+        }
+    }
+}
+export async function analyzePackageSupplyChainPolicy(files) {
+    const snapshot = await buildSnapshot(files);
+    if (!snapshot)
+        return [];
+    const violations = [];
+    const subChecks = [
+        checkPackageManagerPin,
+        checkLockfilePosture,
+        checkLockfileIntegrity,
+        checkExoticDependencies,
+        checkInstallLifecycleScripts,
+        checkInstallScriptPolicy,
+        checkMinimumReleaseAge,
+        checkFrozenCiInstalls,
+        checkTrustedPublishing,
+    ];
+    for (const runCheck of subChecks) {
+        // @fitness-ignore-next-line detached-promises -- sub-checks are synchronous (each returns void, mutating `violations`), not promises
+        runCheck(snapshot, violations);
+    }
+    return violations;
+}
+export const packageSupplyChainPolicy = defineCheck({
+    id: 'ea3ec1d6-16ab-43c4-9875-50d3fd9f564c',
+    slug: 'package-supply-chain-policy',
+    scope: { languages: ['typescript'], concerns: ['config'] },
+    contentFilter: 'raw',
+    fileTypes: ['json'],
+    confidence: 'medium',
+    description: 'Validate npm/pnpm/Bun supply-chain guardrails',
+    longDescription: `**Purpose:** Validates package-manager supply-chain guardrails for npm, pnpm, and Bun projects.
+
+**Detects:**
+- Missing or non-exact \`packageManager\` pins
+- Missing or conflicting lockfiles
+- Remote lockfile entries without integrity hashes
+- Mutable git, URL, tarball, or local path dependencies
+- Install-time lifecycle scripts and missing install-script allowlists
+- Missing dependency release-age gates
+- CI install commands that can rewrite lockfiles
+- npm publish workflows that lack OIDC/provenance or still use long-lived tokens
+
+**Why it matters:** Modern npm-family attacks often execute during installation, exploit fresh compromised versions before takedown, or bypass weakened lockfile/install-script policy. These checks keep the project in a fail-closed posture before dependency code runs in CI or developer machines.
+
+**Scope:** General best practice. Cross-file analysis over package metadata, root lockfiles, package-manager config files, and GitHub workflow files.`,
+    tags: ['security', 'dependencies', 'supply-chain'],
+    analyzeAll: analyzePackageSupplyChainPolicy,
+});
+//# sourceMappingURL=package-supply-chain-policy.js.map

package/dist/checks/security/package-supply-chain-policy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"package-supply-chain-policy.js","sourceRoot":"","sources":["../../../src/checks/security/package-supply-chain-policy.ts"],"names":[],"mappings":"AAAA,+JAA+J;AAC/J;;;;;;;GAOG;AAEH,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAC9B,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAElC,OAAO,EAAE,WAAW,EAA0C,MAAM,sBAAsB,CAAC;AAuC3F,MAAM,mBAAmB,GAAG;IAC1B,gBAAgB;IAChB,mBAAmB;IACnB,qBAAqB;IACrB,UAAU;IACV,WAAW;CACH,CAAC;AAEX,MAAM,mBAAmB,GAAG,qBAAqB,CAAC;AAElD,MAAM,yBAAyB,GAAG,IAAI,GAAG,CAAC,CAAC,YAAY,EAAE,SAAS,EAAE,aAAa,CAAC,CAAC,CAAC;AACpF,MAAM,iBAAiB,GAAG;IACxB,cAAc;IACd,iBAAiB;IACjB,sBAAsB;IACtB,kBAAkB;CACV,CAAC;AAEX,SAAS,YAAY,CAAC,QAAgB;IACpC,IAAI,CAAC;QACH,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC;YAAE,OAAO,IAAI,CAAC;QAC1C,OAAO,EAAE,CAAC,YAAY,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;IAC3C,CAAC;IAAC,MAAM,CAAC;QACP,iEAAiE;QACjE,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAS,SAAS,CAAI,OAAe;IACnC,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CAAC,OAAO,CAAM,CAAC;IAClC,CAAC;IAAC,MAAM,CAAC;QACP,qDAAqD;QACrD,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAS,MAAM,CAAC,OAAe,EAAE,MAAuB;IACtD,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAClC,KAAK,MAAM,CAAC,CAAC,EAAE,IAAI,CAAC,IAAI,KAAK,CAAC,OAAO,EAAE,EAAE,CAAC;QACxC,IAAI,OAAO,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YAC3E,OAAO,CAAC,GAAG,CAAC,CAAC;QACf,CAAC;IACH,CAAC;IACD,OAAO,CAAC,CAAC;AACX,CAAC;AAED,SAAS,YAAY,CAAC,QAAgB,EAAE,OAAe;IACrD,OAAO,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AACpE,CAAC;AAED,SAAS,cAAc,CAAC,OAAsB,EAAE,GAAW;IACzD,IAAI,CAAC,OAAO;QAAE,OAAO,IAAI,CAAC;IAC1B,MAAM,OAAO,GAAG,GAAG,CAAC,UAAU,CAAC,qBAAqB,EAAE,MAAM,CAAC,GAAG,CAAA,KAAK,CAAC,CAAC;IACvE,MAAM,KAAK,GAAG,IAAI,MAAM,CAAC,MAAM,CAAC,GAAG,CAAA,OAAO,OAAO,qBAAqB,EAAE,GAAG,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAC3F,OAAO,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,UAAU,CAAC,cAAc,EAAE,EAAE,CAAC,IAAI,IAAI,CAAC;AACnE,CAAC;AAED,SAAS,eAAe,CAAC,OAAsB,EAAE,GAAW;IAC1D,OAAO,cAAc,CAAC,OAAO,EAAE,GAAG,CAAC,EAAE,WAAW,EAAE,KAAK,MAAM,CAAC;AAChE,CAAC;AAED,SAAS,iBAAiB,CAAC,OAAsB,EAAE,GAAW;IAC5D,MAAM,KAAK,GAAG,cAAc,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;IAC3C,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,CAAC;IACxB,MAAM,MAAM,GAAG,MAAM,CAAC,QAAQ,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IAC1C,OAAO,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC;AAC/D,CAAC;AAED,SAAS,cAAc,CAAC,OAAsB,EAAE,GAAW;IACzD,IAAI,CAAC,OAAO;QAAE,OAAO,KAAK,CAAC;IAC3B,MAAM,OAAO,GAAG,GAAG,CAAC,UAAU,CAAC,qBAAqB,EAAE,MAAM,CAAC,GAAG,CAAA,KAAK,CAAC,CAAC;IACvE,OAAO,IAAI,MAAM,CAAC,IAAI,OAAO,GAAG,EAAE,GAAG,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;AACvD,CAAC;AAED,SAAS,cAAc,CAAC,OAAsB,EAAE,GAAW,EAAE,QAAgB;IAC3E,OAAO,cAAc,CAAC,OAAO,EAAE,GAAG,CAAC,EAAE,WAAW,EAAE,KAAK,QAAQ,CAAC,WAAW,EAAE,CAAC;AAChF,CAAC;AAED,KAAK,UAAU,gBAAgB,CAAC,KAAmB,EAAE,OAAe;IAClE,MAAM,YAAY,GAAG,KAAK,CAAC,KAAK;SAC7B,MAAM,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,KAAK,cAAc,CAAC;SAChE,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC;IAEvC,wEAAwE;IACxE,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;IAEzF,MAAM,QAAQ,GAAsB,EAAE,CAAC;IACvC,KAAK,MAAM,CAAC,CAAC,EAAE,QAAQ,CAAC,IAAI,YAAY,CAAC,OAAO,EAAE,EAAE,CAAC;QACnD,MAAM,IAAI,GAAG,SAAS,CAAc,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;QACjD,IAAI,CAAC,IAAI;YAAE,SAAS;QACpB,QAAQ,CAAC,IAAI,CAAC;YACZ,QAAQ;YACR,OAAO,EAAE,YAAY,CAAC,QAAQ,EAAE,OAAO,CAAC;YACxC,UAAU,EAAE,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC;YAClC,IAAI;SACL,CAAC,CAAC;IACL,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,SAAS,mBAAmB,CAAC,KAAwB;IACnD,MAAM,UAAU,GAAG,KAAK;SACrB,MAAM,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,KAAK,cAAc,CAAC;SAChE,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC;IACvE,OAAO,UAAU,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC;AAC/B,CAAC;AAED,SAAS,aAAa,CAAC,OAAe;IACpC,MAAM,YAAY,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,SAAS,EAAE,WAAW,CAAC,CAAC;IAChE,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,YAAY,CAAC;QAAE,OAAO,EAAE,CAAC;IAC5C,MAAM,SAAS,GAAmB,EAAE,CAAC;IACrC,KAAK,MAAM,KAAK,IAAI,EAAE,CAAC,WAAW,CAAC,YAAY,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC;QAC1E,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC;YAAE,SAAS;QACjE,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;QACrD,MAAM,OAAO,GAAG,YAAY,CAAC,QAAQ,CAAC,CAAC;QACvC,IAAI,OAAO,KAAK,IAAI;YAAE,SAAS;QAC/B,SAAS,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,OAAO,EAAE,YAAY,CAAC,QAAQ,EAAE,OAAO,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC;IAClF,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,KAAK,UAAU,aAAa,CAAC,KAAmB;IAC9C,MAAM,eAAe,GAAG,mBAAmB,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IACzD,IAAI,CAAC,eAAe;QAAE,OAAO,IAAI,CAAC;IAClC,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC;IAC9C,MAAM,WAAW,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;IACtD,MAAM,WAAW,GAAG,SAAS,CAAc,WAAW,CAAC,CAAC;IACxD,IAAI,CAAC,WAAW;QAAE,OAAO,IAAI,CAAC;IAE9B,OAAO;QACL,OAAO;QACP,eAAe;QACf,WAAW;QACX,QAAQ,EAAE,MAAM,gBAAgB,CAAC,KAAK,EAAE,OAAO,CAAC;QAChD,SAAS,EAAE,IAAI,GAAG,CAChB,mBAAmB,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC,CAAC,CAC9E;QACD,aAAa,EAAE,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,mBAAmB,CAAC,CAAC;QACpE,KAAK,EAAE,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;QACjD,MAAM,EAAE,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,aAAa,CAAC,CAAC;QACvD,SAAS,EAAE,aAAa,CAAC,OAAO,CAAC;KAClC,CAAC;AACJ,CAAC;AAED,SAAS,aAAa,CACpB,UAA4B,EAC5B,SAGC;IAED,UAAU,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,EAAE,GAAG,SAAS,EAAE,CAAC,CAAC;AAClE,CAAC;AAED,SAAS,sBAAsB,CAAC,QAAyB,EAAE,UAA4B;IACrF,MAAM,KAAK,GAAG,QAAQ,CAAC,WAAW,CAAC,cAAc,CAAC;IAClD,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,aAAa,CAAC,UAAU,EAAE;YACxB,QAAQ,EAAE,QAAQ,CAAC,eAAe;YAClC,IAAI,EAAE,yBAAyB;YAC/B,OAAO,EAAE,yDAAyD;YAClE,UAAU,EACR,0HAA0H;YAC5H,QAAQ,EAAE,OAAO;SAClB,CAAC,CAAC;QACH,OAAO;IACT,CAAC;IAED,IAAI,CAAC,0DAA0D,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QAC5E,aAAa,CAAC,UAAU,EAAE;YACxB,QAAQ,EAAE,QAAQ,CAAC,eAAe;YAClC,IAAI,EAAE,2BAA2B;YACjC,OAAO,EAAE,mBAAmB,KAAK,2CAA2C;YAC5E,UAAU,EACR,wGAAwG;YAC1G,QAAQ,EAAE,OAAO;YACjB,IAAI,EAAE,MAAM,CAAC,YAAY,CAAC,QAAQ,CAAC,eAAe,CAAC,IAAI,EAAE,EAAE,gBAAgB,CAAC;SAC7E,CAAC,CAAC;IACL,CAAC;IAED,IAAI,KAAK,CAAC,UAAU,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC;QAC7D,aAAa,CAAC,UAAU,EAAE;YACxB,QAAQ,EAAE,QAAQ,CAAC,eAAe;YAClC,IAAI,EAAE,mCAAmC;YACzC,OAAO,EAAE,uEAAuE;YAChF,UAAU,EACR,iHAAiH;YACnH,IAAI,EAAE,MAAM,CAAC,YAAY,CAAC,QAAQ,CAAC,eAAe,CAAC,IAAI,EAAE,EAAE,gBAAgB,CAAC;SAC7E,CAAC,CAAC;IACL,CAAC;AACH,CAAC;AAED,SAAS,oBAAoB,CAAC,QAAyB,EAAE,UAA4B;IACnF,IAAI,QAAQ,CAAC,SAAS,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;QAClC,aAAa,CAAC,UAAU,EAAE;YACxB,QAAQ,EAAE,QAAQ,CAAC,eAAe;YAClC,IAAI,EAAE,kBAAkB;YACxB,OAAO,EAAE,iEAAiE;YAC1E,UAAU,EACR,gGAAgG;YAClG,QAAQ,EAAE,OAAO;SAClB,CAAC,CAAC;QACH,OAAO;IACT,CAAC;IAED,IAAI,QAAQ,CAAC,SAAS,CAAC,IAAI,GAAG,CAAC,EAAE,CAAC;QAChC,aAAa,CAAC,UAAU,EAAE;YACxB,QAAQ,EAAE,QAAQ,CAAC,eAAe;YAClC,IAAI,EAAE,oBAAoB;YAC1B,OAAO,EAAE,6CAA6C,CAAC,GAAG,QAAQ,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;YAC1F,UAAU,EACR,8FAA8F;SACjG,CAAC,CAAC;IACL,CAAC;AACH,CAAC;AAED,SAAS,yBAAyB,CAAC,QAAyB,EAAE,UAA4B;IACxF,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,mBAAmB,CAAC,CAAC;IAClE,MAAM,OAAO,GAAG,YAAY,CAAC,QAAQ,CAAC,CAAC;IACvC,IAAI,CAAC,OAAO;QAAE,OAAO;IACrB,MAAM,IAAI,GAAG,SAAS,CAGnB,OAAO,CAAC,CAAC;IACZ,IAAI,CAAC,IAAI;QAAE,OAAO;IAElB,MAAM,OAAO,GAAG;QACd,GAAG,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,IAAI,EAAE,CAAC;QACtC,GAAG,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,YAAY,IAAI,EAAE,CAAC;KAC3C,CAAC;IACF,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,OAAO,EAAE,CAAC;QACpC,IAAI,CAAC,KAAK,CAAC,QAAQ,EAAE,UAAU,CAAC,MAAM,CAAC;YAAE,SAAS;QAClD,IAAI,KAAK,CAAC,SAAS;YAAE,SAAS;QAC9B,aAAa,CAAC,UAAU,EAAE;YACxB,QAAQ,EAAE,QAAQ;YAClB,IAAI,EAAE,kCAAkC;YACxC,OAAO,EAAE,8BAA8B,IAAI,IAAI,QAAQ,4CAA4C;YACnG,UAAU,EACR,uFAAuF;YACzF,QAAQ,EAAE,OAAO;YACjB,IAAI,EAAE,MAAM,CAAC,OAAO,EAAE,KAAK,CAAC,QAAQ,CAAC;SACtC,CAAC,CAAC;IACL,CAAC;AACH,CAAC;AAED,SAAS,sBAAsB,CAAC,QAAyB,EAAE,UAA4B;IACrF,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,gBAAgB,CAAC,CAAC;IAC/D,MAAM,OAAO,GAAG,YAAY,CAAC,QAAQ,CAAC,CAAC;IACvC,IAAI,CAAC,OAAO;QAAE,OAAO;IACrB,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAClC,KAAK,MAAM,CAAC,KAAK,EAAE,OAAO,CAAC,IAAI,KAAK,CAAC,OAAO,EAAE,EAAE,CAAC;QAC/C,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC;QAC5B,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,uBAAuB,CAAC,IAAI,CAAC,IAAI,CAAC;YAAE,SAAS;QAC5E,MAAM,SAAS,GAAG,KAAK,CAAC,KAAK,CAAC,KAAK,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC3D,IAAI,uBAAuB,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,4BAA4B,CAAC,IAAI,CAAC,IAAI,CAAC;YACpF,SAAS;QACX,aAAa,CAAC,UAAU,EAAE;YACxB,QAAQ,EAAE,QAAQ;YAClB,IAAI,EAAE,kCAAkC;YACxC,OAAO,EAAE,oFAAoF;YAC7F,UAAU,EACR,iHAAiH;YACnH,QAAQ,EAAE,OAAO;YACjB,IAAI,EAAE,KAAK,GAAG,CAAC;SAChB,CAAC,CAAC;IACL,CAAC;AACH,CAAC;AAED,SAAS,sBAAsB,CAAC,QAAyB,EAAE,UAA4B;IACrF,yBAAyB,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;IAChD,sBAAsB,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;AAC/C,CAAC;AAED,SAAS,iBAAiB,CAAC,GAAgB;IACzC,MAAM,OAAO,GAAuB,EAAE,CAAC;IACvC,KAAK,MAAM,KAAK,IAAI,iBAAiB,EAAE,CAAC;QACtC,KAAK,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC;YAC5D,OAAO,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC;QAC7B,CAAC;IACH,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,SAAS,YAAY,CAAC,IAAY;IAChC,OAAO,8BAA8B,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACnD,CAAC;AAED,SAAS,YAAY,CAAC,IAAY;IAChC,OAAO,8EAA8E,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACnG,CAAC;AAED,SAAS,uBAAuB,CAAC,QAAyB,EAAE,UAA4B;IACtF,KAAK,MAAM,GAAG,IAAI,QAAQ,CAAC,QAAQ,EAAE,CAAC;QACpC,MAAM,OAAO,GAAG,YAAY,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC;QACjD,KAAK,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,iBAAiB,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;YACvD,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC;gBAAE,SAAS;YAClC,MAAM,KAAK,GAAG,4DAA4D,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACtF,IAAI,KAAK,IAAI,YAAY,CAAC,IAAI,CAAC;gBAAE,SAAS;YAC1C,MAAM,IAAI,GAAG,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC;gBACnC,CAAC,CAAC,uBAAuB;gBACzB,CAAC,CAAC,iCAAiC,CAAC;YACtC,aAAa,CAAC,UAAU,EAAE;gBACxB,QAAQ,EAAE,GAAG,CAAC,QAAQ;gBACtB,IAAI,EAAE,0BAA0B;gBAChC,OAAO,EAAE,GAAG,GAAG,CAAC,OAAO,aAAa,IAAI,IAAI,IAAI,IAAI,IAAI,EAAE;gBAC1D,UAAU,EACR,gJAAgJ;gBAClJ,IAAI,EAAE,MAAM,CAAC,OAAO,EAAE,IAAI,IAAI,GAAG,CAAC;aACnC,CAAC,CAAC;QACL,CAAC;IACH,CAAC;AACH,CAAC;AAED,SAAS,4BAA4B,CACnC,QAAyB,EACzB,UAA4B;IAE5B,KAAK,MAAM,GAAG,IAAI,QAAQ,CAAC,QAAQ,EAAE,CAAC;QACpC,KAAK,MAAM,UAAU,IAAI,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,OAAO,IAAI,EAAE,CAAC,EAAE,CAAC;YAC7D,IAAI,CAAC,yBAAyB,CAAC,GAAG,CAAC,UAAU,CAAC;gBAAE,SAAS;YACzD,aAAa,CAAC,UAAU,EAAE;gBACxB,QAAQ,EAAE,GAAG,CAAC,QAAQ;gBACtB,IAAI,EAAE,0BAA0B;gBAChC,OAAO,EAAE,GAAG,GAAG,CAAC,OAAO,+CAA+C,UAAU,GAAG;gBACnF,UAAU,EACR,mLAAmL;gBACrL,QAAQ,EAAE,GAAG,CAAC,IAAI,CAAC,OAAO,KAAK,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,OAAO;gBACzD,IAAI,EAAE,MAAM,CAAC,YAAY,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,EAAE,EAAE,IAAI,UAAU,GAAG,CAAC;aAClE,CAAC,CAAC;QACL,CAAC;IACH,CAAC;AACH,CAAC;AAED,SAAS,wBAAwB,CAAC,QAAyB,EAAE,UAA4B;IACvF,IAAI,QAAQ,CAAC,SAAS,CAAC,GAAG,CAAC,gBAAgB,CAAC,EAAE,CAAC;QAC7C,IAAI,CAAC,cAAc,CAAC,QAAQ,CAAC,aAAa,EAAE,aAAa,CAAC,EAAE,CAAC;YAC3D,aAAa,CAAC,UAAU,EAAE;gBACxB,QAAQ,EAAE,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,mBAAmB,CAAC;gBAC1D,IAAI,EAAE,+BAA+B;gBACrC,OAAO,EAAE,oEAAoE;gBAC7E,UAAU,EACR,6HAA6H;gBAC/H,QAAQ,EAAE,OAAO;aAClB,CAAC,CAAC;QACL,CAAC;QACD,IAAI,cAAc,CAAC,QAAQ,CAAC,aAAa,EAAE,2BAA2B,EAAE,MAAM,CAAC,EAAE,CAAC;YAChF,aAAa,CAAC,UAAU,EAAE;gBACxB,QAAQ,EAAE,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,mBAAmB,CAAC;gBAC1D,IAAI,EAAE,kCAAkC;gBACxC,OAAO,EAAE,2CAA2C;gBACpD,UAAU,EAAE,4EAA4E;gBACxF,QAAQ,EAAE,OAAO;gBACjB,IAAI,EAAE,MAAM,CAAC,QAAQ,CAAC,aAAa,IAAI,EAAE,EAAE,2BAA2B,CAAC;aACxE,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,IACE,QAAQ,CAAC,SAAS,CAAC,GAAG,CAAC,mBAAmB,CAAC;QAC3C,QAAQ,CAAC,SAAS,CAAC,GAAG,CAAC,qBAAqB,CAAC,EAC7C,CAAC;QACD,MAAM,YAAY,GAChB,eAAe,CAAC,QAAQ,CAAC,KAAK,EAAE,gBAAgB,CAAC;YACjD,CAAC,eAAe,CAAC,QAAQ,CAAC,KAAK,EAAE,sBAAsB,CAAC;gBACtD,QAAQ,CAAC,KAAK,EAAE,QAAQ,CAAC,eAAe,CAAC,CAAC,CAAC;QAC/C,IAAI,CAAC,YAAY,EAAE,CAAC;YAClB,aAAa,CAAC,UAAU,EAAE;gBACxB,QAAQ,EAAE,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,QAAQ,CAAC;gBAC/C,IAAI,EAAE,+BAA+B;gBACrC,OAAO,EAAE,+EAA+E;gBACxF,UAAU,EACR,oJAAoJ;aACvJ,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,IAAI,QAAQ,CAAC,SAAS,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,QAAQ,CAAC,SAAS,CAAC,GAAG,CAAC,WAAW,CAAC,EAAE,CAAC;QAC9E,MAAM,OAAO,GAAG,QAAQ,CAAC,WAAW,CAAC,mBAAmB,CAAC;QACzD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;YAC5B,aAAa,CAAC,UAAU,EAAE;gBACxB,QAAQ,EAAE,QAAQ,CAAC,eAAe;gBAClC,IAAI,EAAE,+BAA+B;gBACrC,OAAO,EAAE,kDAAkD;gBAC3D,UAAU,EACR,8HAA8H;aACjI,CAAC,CAAC;QACL,CAAC;IACH,CAAC;AACH,CAAC;AAED,SAAS,sBAAsB,CAAC,QAAyB,EAAE,UAA4B;IACrF,IAAI,QAAQ,CAAC,SAAS,CAAC,GAAG,CAAC,gBAAgB,CAAC,EAAE,CAAC;QAC7C,IAAI,CAAC,iBAAiB,CAAC,QAAQ,CAAC,aAAa,EAAE,mBAAmB,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC;YAC/E,aAAa,CAAC,UAAU,EAAE;gBACxB,QAAQ,EAAE,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,mBAAmB,CAAC;gBAC1D,IAAI,EAAE,6BAA6B;gBACnC,OAAO,EAAE,kDAAkD;gBAC3D,UAAU,EACR,+GAA+G;gBACjH,QAAQ,EAAE,OAAO;aAClB,CAAC,CAAC;QACL,CAAC;QACD,IAAI,CAAC,cAAc,CAAC,QAAQ,CAAC,aAAa,EAAE,yBAAyB,EAAE,MAAM,CAAC,EAAE,CAAC;YAC/E,aAAa,CAAC,UAAU,EAAE;gBACxB,QAAQ,EAAE,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,mBAAmB,CAAC;gBAC1D,IAAI,EAAE,gCAAgC;gBACtC,OAAO,EAAE,6CAA6C;gBACtD,UAAU,EACR,+GAA+G;aAClH,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,IACE,CAAC,QAAQ,CAAC,SAAS,CAAC,GAAG,CAAC,mBAAmB,CAAC;QAC1C,QAAQ,CAAC,SAAS,CAAC,GAAG,CAAC,qBAAqB,CAAC,CAAC;QAChD,CAAC,iBAAiB,CAAC,QAAQ,CAAC,KAAK,EAAE,iBAAiB,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,EAChE,CAAC;QACD,aAAa,CAAC,UAAU,EAAE;YACxB,QAAQ,EAAE,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,QAAQ,CAAC;YAC/C,IAAI,EAAE,6BAA6B;YACnC,OAAO,EAAE,oCAAoC;YAC7C,UAAU,EAAE,qEAAqE;SAClF,CAAC,CAAC;IACL,CAAC;IAED,IACE,CAAC,QAAQ,CAAC,SAAS,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,QAAQ,CAAC,SAAS,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;QAC3E,CAAC,iBAAiB,CAAC,QAAQ,CAAC,MAAM,EAAE,mBAAmB,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,EACnE,CAAC;QACD,aAAa,CAAC,UAAU,EAAE;YACxB,QAAQ,EAAE,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,aAAa,CAAC;YACpD,IAAI,EAAE,6BAA6B;YACnC,OAAO,EAAE,sCAAsC;YAC/C,UAAU,EAAE,iFAAiF;SAC9F,CAAC,CAAC;IACL,CAAC;AACH,CAAC;AAED,SAAS,aAAa,CAAC,QAAsB;IAC3C,OAAO,QAAQ,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;AACtC,CAAC;AAED,SAAS,mBAAmB,CAAC,IAAY;IACvC,OAAO,CACL,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC;QACzB,6CAA6C,CAAC,IAAI,CAAC,IAAI,CAAC;QACxD,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC;QAC1B,sCAAsC,CAAC,IAAI,CAAC,IAAI,CAAC;QACjD,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,CAC1B,CAAC;AACJ,CAAC;AAED,SAAS,6BAA6B,CAAC,IAAY;IACjD,OAAO,CACL,4CAA4C,CAAC,IAAI,CAAC,IAAI,CAAC;QACvD,yCAAyC,CAAC,IAAI,CAAC,IAAI,CAAC,CACrD,CAAC;AACJ,CAAC;AAED,SAAS,oBAAoB,CAAC,IAAY;IACxC,IAAI,6BAA6B,CAAC,IAAI,CAAC;QAAE,OAAO,KAAK,CAAC;IACtD,OAAO,CACL,mBAAmB,CAAC,IAAI,CAAC,IAAI,CAAC;QAC9B,CAAC,0BAA0B,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,mBAAmB,CAAC,CAAC;QAC9E,CAAC,mBAAmB,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,mBAAmB,CAAC,CAAC,CACxE,CAAC;AACJ,CAAC;AAED,SAAS,qBAAqB,CAAC,QAAyB,EAAE,UAA4B;IACpF,IAAI,QAAQ,CAAC,SAAS,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO;IAC5C,IAAI,gBAAgB,GAAG,KAAK,CAAC;IAC7B,KAAK,MAAM,QAAQ,IAAI,QAAQ,CAAC,SAAS,EAAE,CAAC;QAC1C,KAAK,MAAM,CAAC,KAAK,EAAE,OAAO,CAAC,IAAI,aAAa,CAAC,QAAQ,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC;YACjE,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC;YAC5B,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;gBAAE,SAAS;YACnC,IAAI,mBAAmB,CAAC,IAAI,CAAC;gBAAE,gBAAgB,GAAG,IAAI,CAAC;YACvD,IAAI,CAAC,oBAAoB,CAAC,IAAI,CAAC;gBAAE,SAAS;YAC1C,aAAa,CAAC,UAAU,EAAE;gBACxB,QAAQ,EAAE,QAAQ,CAAC,QAAQ;gBAC3B,IAAI,EAAE,uBAAuB;gBAC7B,OAAO,EAAE,GAAG,QAAQ,CAAC,OAAO,4CAA4C,IAAI,EAAE;gBAC9E,UAAU,EACR,sGAAsG;gBACxG,QAAQ,EAAE,OAAO;gBACjB,IAAI,EAAE,KAAK,GAAG,CAAC;aAChB,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,IAAI,CAAC,gBAAgB,EAAE,CAAC;QACtB,aAAa,CAAC,UAAU,EAAE;YACxB,QAAQ,EAAE,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,QAAQ,IAAI,QAAQ,CAAC,eAAe;YACrE,IAAI,EAAE,2BAA2B;YACjC,OAAO,EAAE,iEAAiE;YAC1E,UAAU,EACR,yHAAyH;SAC5H,CAAC,CAAC;IACL,CAAC;AACH,CAAC;AAED,SAAS,sBAAsB,CAAC,QAAyB,EAAE,UAA4B;IACrF,KAAK,MAAM,QAAQ,IAAI,QAAQ,CAAC,SAAS,EAAE,CAAC;QAC1C,IAAI,CAAC,mBAAmB,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC;YAAE,SAAS;QAC1D,IAAI,CAAC,mBAAmB,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;YAChD,aAAa,CAAC,UAAU,EAAE;gBACxB,QAAQ,EAAE,QAAQ,CAAC,QAAQ;gBAC3B,IAAI,EAAE,iCAAiC;gBACvC,OAAO,EAAE,GAAG,QAAQ,CAAC,OAAO,sDAAsD;gBAClF,UAAU,EACR,yFAAyF;gBAC3F,QAAQ,EAAE,OAAO;gBACjB,IAAI,EAAE,MAAM,CAAC,QAAQ,CAAC,OAAO,EAAE,aAAa,CAAC;aAC9C,CAAC,CAAC;QACL,CAAC;QACD,IACE,CAAC,uEAAuE,CAAC,IAAI,CAC3E,QAAQ,CAAC,OAAO,CACjB,EACD,CAAC;YACD,aAAa,CAAC,UAAU,EAAE;gBACxB,QAAQ,EAAE,QAAQ,CAAC,QAAQ;gBAC3B,IAAI,EAAE,4BAA4B;gBAClC,OAAO,EAAE,GAAG,QAAQ,CAAC,OAAO,+CAA+C;gBAC3E,UAAU,EACR,gGAAgG;gBAClG,IAAI,EAAE,MAAM,CAAC,QAAQ,CAAC,OAAO,EAAE,aAAa,CAAC;aAC9C,CAAC,CAAC;QACL,CAAC;QACD,IAAI,6BAA6B,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;YACzD,aAAa,CAAC,UAAU,EAAE;gBACxB,QAAQ,EAAE,QAAQ,CAAC,QAAQ;gBAC3B,IAAI,EAAE,wBAAwB;gBAC9B,OAAO,EAAE,GAAG,QAAQ,CAAC,OAAO,4CAA4C;gBACxE,UAAU,EACR,yGAAyG;gBAC3G,IAAI,EAAE,MAAM,CAAC,QAAQ,CAAC,OAAO,EAAE,2BAA2B,CAAC;aAC5D,CAAC,CAAC;QACL,CAAC;IACH,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,+BAA+B,CACnD,KAAmB;IAEnB,MAAM,QAAQ,GAAG,MAAM,aAAa,CAAC,KAAK,CAAC,CAAC;IAC5C,IAAI,CAAC,QAAQ;QAAE,OAAO,EAAE,CAAC;IAEzB,MAAM,UAAU,GAAqB,EAAE,CAAC;IACxC,MAAM,SAAS,GAAG;QAChB,sBAAsB;QACtB,oBAAoB;QACpB,sBAAsB;QACtB,uBAAuB;QACvB,4BAA4B;QAC5B,wBAAwB;QACxB,sBAAsB;QACtB,qBAAqB;QACrB,sBAAsB;KACvB,CAAC;IACF,KAAK,MAAM,QAAQ,IAAI,SAAS,EAAE,CAAC;QACjC,qIAAqI;QACrI,QAAQ,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;IACjC,CAAC;IACD,OAAO,UAAU,CAAC;AACpB,CAAC;AAED,MAAM,CAAC,MAAM,wBAAwB,GAAG,WAAW,CAAC;IAClD,EAAE,EAAE,sCAAsC;IAC1C,IAAI,EAAE,6BAA6B;IACnC,KAAK,EAAE,EAAE,SAAS,EAAE,CAAC,YAAY,CAAC,EAAE,QAAQ,EAAE,CAAC,QAAQ,CAAC,EAAE;IAC1D,aAAa,EAAE,KAAK;IACpB,SAAS,EAAE,CAAC,MAAM,CAAC;IAEnB,UAAU,EAAE,QAAQ;IACpB,WAAW,EAAE,+CAA+C;IAC5D,eAAe,EAAE;;;;;;;;;;;;;;sJAcmI;IACpJ,IAAI,EAAE,CAAC,UAAU,EAAE,cAAc,EAAE,cAAc,CAAC;IAElD,UAAU,EAAE,+BAA+B;CAC5C,CAAC,CAAC"}

package/dist/checks/security/rate-limit-coverage.d.ts

@@ -0,0 +1,10 @@
+/**
+ * @fileoverview Validate routes have rate limiting configured
+ */
+/**
+ * Check: security/rate-limit-coverage
+ *
+ * Validates that routes have rate limiting configured.
+ */
+export declare const rateLimitCoverage: import("@opensip-cli/fitness").Check;
+//# sourceMappingURL=rate-limit-coverage.d.ts.map

package/dist/checks/security/rate-limit-coverage.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"rate-limit-coverage.d.ts","sourceRoot":"","sources":["../../../src/checks/security/rate-limit-coverage.ts"],"names":[],"mappings":"AAAA;;GAEG;AA8FH;;;;GAIG;AACH,eAAO,MAAM,iBAAiB,sCA+E5B,CAAC"}