@rigour-labs/core 6.7.10 → 6.8.1-rc.1

package/dist/gates/deprecated-apis.test.js

@@ -1,318 +0,0 @@
-import { describe, it, expect, vi, beforeEach } from 'vitest';
-const mockFindFiles = vi.hoisted(() => vi.fn());
-const mockReadFile = vi.hoisted(() => vi.fn());
-vi.mock('../utils/scanner.js', () => ({
-    FileScanner: { findFiles: mockFindFiles },
-}));
-vi.mock('fs-extra', () => ({
-    default: {
-        readFile: mockReadFile,
-        pathExists: vi.fn().mockResolvedValue(false),
-        pathExistsSync: vi.fn().mockReturnValue(false),
-        readFileSync: vi.fn().mockReturnValue(''),
-        readJson: vi.fn().mockResolvedValue(null),
-        readdirSync: vi.fn().mockReturnValue([]),
-    },
-}));
-import { DeprecatedApisGate } from './deprecated-apis.js';
-describe('DeprecatedApisGate — Node.js Security', () => {
-    let gate;
-    beforeEach(() => {
-        gate = new DeprecatedApisGate();
-        vi.clearAllMocks();
-    });
-    it('should flag new Buffer() as security-critical', async () => {
-        mockFindFiles.mockResolvedValue(['src/handler.js']);
-        mockReadFile.mockResolvedValue(`
-const buf = new Buffer(100);
-const buf2 = new Buffer('hello');
-        `);
-        const failures = await gate.run({ cwd: '/project' });
-        expect(failures.length).toBeGreaterThanOrEqual(1);
-        const secFail = failures.find(f => f.title === 'Security-Deprecated APIs');
-        expect(secFail).toBeDefined();
-        expect(secFail.severity).toBe('critical');
-        expect(secFail.details).toContain('Buffer');
-    });
-    it('should flag crypto.createCipher as security-critical', async () => {
-        mockFindFiles.mockResolvedValue(['src/encrypt.ts']);
-        mockReadFile.mockResolvedValue(`
-import crypto from 'crypto';
-const cipher = crypto.createCipher('aes-256-cbc', 'password');
-        `);
-        const failures = await gate.run({ cwd: '/project' });
-        expect(failures.length).toBeGreaterThanOrEqual(1);
-        expect(failures[0].details).toContain('createCipher');
-    });
-    it('should flag document.write() as security risk', async () => {
-        mockFindFiles.mockResolvedValue(['src/page.tsx']);
-        mockReadFile.mockResolvedValue(`
-document.write('<script>alert("xss")</script>');
-        `);
-        const failures = await gate.run({ cwd: '/project' });
-        expect(failures.length).toBeGreaterThanOrEqual(1);
-        expect(failures[0].details).toContain('document.write');
-    });
-    it('should flag eval() as security risk', async () => {
-        mockFindFiles.mockResolvedValue(['src/dynamic.js']);
-        mockReadFile.mockResolvedValue(`
-const result = eval(userInput);
-        `);
-        const failures = await gate.run({ cwd: '/project' });
-        expect(failures.length).toBeGreaterThanOrEqual(1);
-        expect(failures[0].details).toContain('eval');
-    });
-});
-describe('DeprecatedApisGate — Node.js Superseded', () => {
-    let gate;
-    beforeEach(() => {
-        gate = new DeprecatedApisGate();
-        vi.clearAllMocks();
-    });
-    it('should flag url.parse() as superseded', async () => {
-        mockFindFiles.mockResolvedValue(['src/router.ts']);
-        mockReadFile.mockResolvedValue(`
-import url from 'url';
-const parsed = url.parse(req.url);
-        `);
-        const failures = await gate.run({ cwd: '/project' });
-        expect(failures.length).toBeGreaterThanOrEqual(1);
-        expect(failures[0].details).toContain('url.parse');
-    });
-    it('should flag fs.exists() as superseded', async () => {
-        mockFindFiles.mockResolvedValue(['src/checker.ts']);
-        mockReadFile.mockResolvedValue(`
-const fs = require('fs');
-fs.exists('/tmp/test', (exists) => {});
-        `);
-        const failures = await gate.run({ cwd: '/project' });
-        expect(failures.length).toBeGreaterThanOrEqual(1);
-        expect(failures[0].details).toContain('fs.exists');
-    });
-    it('should flag require("domain") as removed', async () => {
-        mockFindFiles.mockResolvedValue(['src/app.js']);
-        mockReadFile.mockResolvedValue(`
-const domain = require('domain');
-        `);
-        const failures = await gate.run({ cwd: '/project' });
-        expect(failures.length).toBeGreaterThanOrEqual(1);
-        expect(failures[0].details).toContain('domain');
-    });
-});
-describe('DeprecatedApisGate — Python', () => {
-    let gate;
-    beforeEach(() => {
-        gate = new DeprecatedApisGate();
-        vi.clearAllMocks();
-    });
-    it('should flag pickle.loads() as security risk', async () => {
-        mockFindFiles.mockResolvedValue(['handler.py']);
-        mockReadFile.mockResolvedValue(`
-import pickle
-data = pickle.loads(untrusted_input)
-        `);
-        const failures = await gate.run({ cwd: '/project' });
-        expect(failures.length).toBeGreaterThanOrEqual(1);
-        expect(failures[0].details).toContain('pickle');
-    });
-    it('should flag os.system() as security risk', async () => {
-        mockFindFiles.mockResolvedValue(['runner.py']);
-        mockReadFile.mockResolvedValue(`
-import os
-os.system(user_command)
-        `);
-        const failures = await gate.run({ cwd: '/project' });
-        expect(failures.length).toBeGreaterThanOrEqual(1);
-        expect(failures[0].details).toContain('os.system');
-    });
-    it('should flag subprocess with shell=True', async () => {
-        mockFindFiles.mockResolvedValue(['runner.py']);
-        mockReadFile.mockResolvedValue(`
-import subprocess
-subprocess.run(cmd, shell=True)
-        `);
-        const failures = await gate.run({ cwd: '/project' });
-        expect(failures.length).toBeGreaterThanOrEqual(1);
-        expect(failures[0].details).toContain('shell=True');
-    });
-    it('should flag import imp as removed', async () => {
-        mockFindFiles.mockResolvedValue(['loader.py']);
-        mockReadFile.mockResolvedValue(`
-import imp
-module = imp.load_source('name', 'path')
-        `);
-        const failures = await gate.run({ cwd: '/project' });
-        expect(failures.length).toBeGreaterThanOrEqual(1);
-        expect(failures[0].details).toContain('imp');
-    });
-    it('should flag from distutils as removed', async () => {
-        mockFindFiles.mockResolvedValue(['setup.py']);
-        mockReadFile.mockResolvedValue(`
-from distutils.core import setup
-        `);
-        const failures = await gate.run({ cwd: '/project' });
-        expect(failures.length).toBeGreaterThanOrEqual(1);
-        expect(failures[0].details).toContain('distutils');
-    });
-    it('should flag typing.Dict as superseded', async () => {
-        mockFindFiles.mockResolvedValue(['models.py']);
-        mockReadFile.mockResolvedValue(`
-from typing import Dict, List, Optional
-        `);
-        const failures = await gate.run({ cwd: '/project' });
-        expect(failures.length).toBeGreaterThanOrEqual(1);
-    });
-    it('should not flag when disabled', async () => {
-        const disabled = new DeprecatedApisGate({ enabled: false });
-        const failures = await disabled.run({ cwd: '/project' });
-        expect(failures).toHaveLength(0);
-    });
-});
-describe('DeprecatedApisGate — Go', () => {
-    let gate;
-    beforeEach(() => {
-        gate = new DeprecatedApisGate();
-        vi.clearAllMocks();
-    });
-    it('should flag ioutil usage as deprecated', async () => {
-        mockFindFiles.mockResolvedValue(['main.go']);
-        mockReadFile.mockResolvedValue(`
-package main
-import "io/ioutil"
-func main() {
-    data, _ := ioutil.ReadFile("test.txt")
-    ioutil.WriteFile("out.txt", data, 0644)
-}
-        `);
-        const failures = await gate.run({ cwd: '/project' });
-        expect(failures.length).toBeGreaterThanOrEqual(1);
-        expect(failures[0].details).toContain('ioutil');
-    });
-    it('should flag strings.Title as deprecated', async () => {
-        mockFindFiles.mockResolvedValue(['util.go']);
-        mockReadFile.mockResolvedValue(`
-package util
-import "strings"
-func Title(s string) string {
-    return strings.Title(s)
-}
-        `);
-        const failures = await gate.run({ cwd: '/project' });
-        expect(failures.length).toBeGreaterThanOrEqual(1);
-        expect(failures[0].details).toContain('strings.Title');
-    });
-});
-describe('DeprecatedApisGate — C#', () => {
-    let gate;
-    beforeEach(() => {
-        gate = new DeprecatedApisGate();
-        vi.clearAllMocks();
-    });
-    it('should flag BinaryFormatter as security-deprecated', async () => {
-        mockFindFiles.mockResolvedValue(['Serializer.cs']);
-        mockReadFile.mockResolvedValue(`
-using System.Runtime.Serialization.Formatters.Binary;
-var formatter = new BinaryFormatter();
-        `);
-        const failures = await gate.run({ cwd: '/project' });
-        expect(failures.length).toBeGreaterThanOrEqual(1);
-        expect(failures[0].details).toContain('BinaryFormatter');
-    });
-    it('should flag WebClient as deprecated', async () => {
-        mockFindFiles.mockResolvedValue(['HttpHelper.cs']);
-        mockReadFile.mockResolvedValue(`
-using System.Net;
-var client = new WebClient();
-        `);
-        const failures = await gate.run({ cwd: '/project' });
-        expect(failures.length).toBeGreaterThanOrEqual(1);
-        expect(failures[0].details).toContain('WebClient');
-    });
-    it('should flag Thread.Abort as removed', async () => {
-        mockFindFiles.mockResolvedValue(['Worker.cs']);
-        mockReadFile.mockResolvedValue(`
-using System.Threading;
-Thread.Abort();
-        `);
-        const failures = await gate.run({ cwd: '/project' });
-        expect(failures.length).toBeGreaterThanOrEqual(1);
-    });
-});
-describe('DeprecatedApisGate — Java', () => {
-    let gate;
-    beforeEach(() => {
-        gate = new DeprecatedApisGate();
-        vi.clearAllMocks();
-    });
-    it('should flag Vector and Hashtable as deprecated', async () => {
-        mockFindFiles.mockResolvedValue(['Legacy.java']);
-        mockReadFile.mockResolvedValue(`
-import java.util.*;
-Vector<String> v = new Vector<String>();
-Hashtable<String, Integer> ht = new Hashtable<String, Integer>();
-        `);
-        const failures = await gate.run({ cwd: '/project' });
-        expect(failures.length).toBeGreaterThanOrEqual(1);
-    });
-    it('should flag new Integer() as deprecated', async () => {
-        mockFindFiles.mockResolvedValue(['Boxing.java']);
-        mockReadFile.mockResolvedValue(`
-Integer x = new Integer(42);
-Long y = new Long(100L);
-        `);
-        const failures = await gate.run({ cwd: '/project' });
-        expect(failures.length).toBeGreaterThanOrEqual(1);
-        expect(failures[0].details).toMatch(/Integer|Long/);
-    });
-    it('should flag Thread.stop as security-deprecated', async () => {
-        mockFindFiles.mockResolvedValue(['ThreadManager.java']);
-        mockReadFile.mockResolvedValue(`
-thread.stop();
-        `);
-        const failures = await gate.run({ cwd: '/project' });
-        expect(failures.length).toBeGreaterThanOrEqual(1);
-    });
-    it('should flag finalize() as deprecated', async () => {
-        mockFindFiles.mockResolvedValue(['Resource.java']);
-        mockReadFile.mockResolvedValue(`
-class Resource {
-    protected void finalize() throws Throwable {
-        super.finalize();
-    }
-}
-        `);
-        const failures = await gate.run({ cwd: '/project' });
-        expect(failures.length).toBeGreaterThanOrEqual(1);
-        expect(failures[0].details).toContain('finalize');
-    });
-});
-describe('DeprecatedApisGate — word fragments and non-code text', () => {
-    let gate;
-    beforeEach(() => {
-        gate = new DeprecatedApisGate();
-        vi.clearAllMocks();
-    });
-    async function apisFor(file, source) {
-        mockFindFiles.mockResolvedValue([file]);
-        mockReadFile.mockResolvedValue(source);
-        const failures = await gate.run({ cwd: '/project' });
-        return failures.map(f => f.details).join('\n');
-    }
-    it('does not flag ArrayBuffer or SharedArrayBuffer as the Buffer() constructor', async () => {
-        const details = await apisFor('src/lib/ingestion-proxy.ts', 'const empty = new ArrayBuffer(0);\nconst shared = new SharedArrayBuffer(8);\n');
-        expect(details).not.toContain('Buffer() constructor');
-    });
-    it('still flags a bare Buffer() constructor call', async () => {
-        expect(await apisFor('src/handler.js', "const b = Buffer(10);\n")).toContain('Buffer() constructor');
-    });
-    it('does not flag "with (" inside a trailing comment or a string', async () => {
-        const details = await apisFor('src/lib/aliases.ts', [
-            "const pattern = compile(source); // match with (optional) prefix",
-            "const label = 'works with (legacy) clients';",
-        ].join('\n'));
-        expect(details).not.toContain('with statement');
-    });
-    it('still flags a real with statement', async () => {
-        expect(await apisFor('src/legacy.js', 'with (obj) {\n  x = 1;\n}\n')).toContain('with statement');
-    });
-});

package/dist/gates/deprecated-dependencies.test.d.ts

@@ -1 +0,0 @@
-export {};

package/dist/gates/deprecated-dependencies.test.js

@@ -1,55 +0,0 @@
-import fs from 'fs';
-import os from 'os';
-import path from 'path';
-import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest';
-import { DeprecatedDependenciesGate, installedVersions, lineOfDependency } from './deprecated-dependencies.js';
-let cwd;
-beforeEach(() => {
-    cwd = fs.mkdtempSync(path.join(os.tmpdir(), 'deprecated-deps-'));
-    fs.writeFileSync(path.join(cwd, 'package.json'), JSON.stringify({ dependencies: { request: '^2.88.0', 'left-pad': '^1.3.0' }, devDependencies: { '@scope/tool': '1.0.0' } }, null, 2));
-    fs.writeFileSync(path.join(cwd, 'package-lock.json'), JSON.stringify({ packages: {
-            'node_modules/request': { version: '2.88.2' },
-            'node_modules/@scope/tool': { version: '1.0.0' },
-        } }));
-});
-afterEach(() => fs.rmSync(cwd, { recursive: true, force: true }));
-/** A registry answering per exact version, like registry.npmjs.org/<name>/<version>. */
-const registry = (deprecated) => vi.fn(async (url) => {
-    const [, name, version] = /registry\.test\/(.+)\/([^/]+)$/.exec(url);
-    return { ok: true, json: async () => ({ version, deprecated: deprecated[`${decodeURIComponent(name)}@${version}`] }) };
-});
-describe('DeprecatedDependenciesGate', () => {
-    it('reports the installed version npm deprecated, on its package.json line', async () => {
-        const fetch = registry({ 'request@2.88.2': 'request has been deprecated' });
-        const failures = await new DeprecatedDependenciesGate({ enabled: true, registry: 'https://registry.test' }, fetch).run({ cwd });
-        expect(failures).toEqual([expect.objectContaining({ id: 'deprecated-dependencies', files: ['package.json'], line: 3 })]);
-        expect(failures[0].details).toContain('request@2.88.2 is deprecated on npm: request has been deprecated');
-        expect(fetch.mock.calls.map(c => c[0])).toEqual(['https://registry.test/request/2.88.2', 'https://registry.test/@scope%2Ftool/1.0.0']);
-    });
-    it('asks once a day, and says nothing for a version it cannot determine or a registry that does not answer', async () => {
-        const fetch = registry({ 'request@2.88.2': 'deprecated' });
-        const gate = new DeprecatedDependenciesGate({ enabled: true, registry: 'https://registry.test' }, fetch);
-        await gate.run({ cwd });
-        await gate.run({ cwd });
-        expect(fetch).toHaveBeenCalledTimes(2); // left-pad has no installed version; the second run is cached
-        fs.rmSync(path.join(cwd, '.rigour'), { recursive: true });
-        const down = vi.fn(async () => { throw new Error('offline'); });
-        expect(await new DeprecatedDependenciesGate({ enabled: true }, down).run({ cwd })).toEqual([]);
-    });
-    it('is off unless enabled', async () => {
-        const fetch = registry({});
-        expect(await new DeprecatedDependenciesGate({}, fetch).run({ cwd })).toEqual([]);
-        expect(fetch).not.toHaveBeenCalled();
-    });
-});
-describe('helpers', () => {
-    it('reads installed versions from the lockfile, else node_modules', async () => {
-        fs.mkdirSync(path.join(cwd, 'node_modules', 'left-pad'), { recursive: true });
-        fs.writeFileSync(path.join(cwd, 'node_modules', 'left-pad', 'package.json'), JSON.stringify({ version: '1.3.0' }));
-        expect([...(await installedVersions(cwd, ['request', 'left-pad', 'missing']))]).toEqual([['request', '2.88.2'], ['left-pad', '1.3.0']]);
-    });
-    it('finds the line declaring a dependency', () => {
-        expect(lineOfDependency('{\n  "dependencies": {\n    "request": "^2"\n  }\n}', 'request')).toBe(3);
-        expect(lineOfDependency('{}', 'request')).toBeUndefined();
-    });
-});

package/dist/gates/frontend-secret-exposure.test.d.ts

@@ -1 +0,0 @@
-export {};

package/dist/gates/frontend-secret-exposure.test.js

@@ -1,148 +0,0 @@
-import { describe, it, expect, beforeEach, afterEach } from 'vitest';
-import { FrontendSecretExposureGate } from './frontend-secret-exposure.js';
-import * as fs from 'fs';
-import * as path from 'path';
-import * as os from 'os';
-describe('FrontendSecretExposureGate', () => {
-    let testDir;
-    beforeEach(() => {
-        testDir = fs.mkdtempSync(path.join(os.tmpdir(), 'frontend-secret-test-'));
-    });
-    afterEach(() => {
-        fs.rmSync(testDir, { recursive: true, force: true });
-    });
-    it('detects process.env secret usage in client-bundled file', async () => {
-        const filePath = path.join(testDir, 'src/components/Checkout.tsx');
-        fs.mkdirSync(path.dirname(filePath), { recursive: true });
-        fs.writeFileSync(filePath, `
-            export function Checkout() {
-                const key = process.env.STRIPE_SECRET_KEY;
-                return <div>{key}</div>;
-            }
-        `);
-        const gate = new FrontendSecretExposureGate();
-        const failures = await gate.run({ cwd: testDir });
-        expect(failures.length).toBeGreaterThan(0);
-        expect(failures[0].id).toBe('frontend-secret-exposure');
-        expect(failures[0].files).toContain('src/components/Checkout.tsx');
-    });
-    it('detects import.meta.env secret usage in frontend app path', async () => {
-        const filePath = path.join(testDir, 'src/app/page.tsx');
-        fs.mkdirSync(path.dirname(filePath), { recursive: true });
-        fs.writeFileSync(filePath, `
-            export default function Page() {
-                return <span>{import.meta.env.OPENAI_API_KEY}</span>;
-            }
-        `);
-        const gate = new FrontendSecretExposureGate();
-        const failures = await gate.run({ cwd: testDir });
-        expect(failures.length).toBeGreaterThan(0);
-    });
-    it('treats a file outside frontend paths that imports Node built-ins as server code', async () => {
-        const cli = path.join(testDir, 'packages/cli/src/commands/post.ts');
-        const spawner = path.join(testDir, 'packages/core/src/exec.ts');
-        const shared = path.join(testDir, 'packages/shared/src/config.ts');
-        const component = path.join(testDir, 'src/components/Admin.tsx');
-        for (const file of [cli, spawner, shared, component])
-            fs.mkdirSync(path.dirname(file), { recursive: true });
-        fs.writeFileSync(cli, "import { execFileSync } from 'child_process';\nexport const token = process.env.GITHUB_TOKEN;\n");
-        fs.writeFileSync(spawner, "import { execa } from 'execa';\nexport const env = { GH_TOKEN: process.env.GH_TOKEN };\n");
-        fs.writeFileSync(shared, 'export const token = process.env.GITHUB_TOKEN;\n');
-        fs.writeFileSync(component, "import fs from 'node:fs';\nexport const key = process.env.STRIPE_SECRET_KEY;\n");
-        const files = (await new FrontendSecretExposureGate().run({ cwd: testDir })).flatMap(f => f.files ?? []);
-        expect(files).not.toContain('packages/cli/src/commands/post.ts'); // Node-only: never bundled
-        expect(files).not.toContain('packages/core/src/exec.ts'); // a package that spawns processes is Node-only too
-        expect(files).toContain('packages/shared/src/config.ts'); // could be bundled: still flagged
-        expect(files).toContain('src/components/Admin.tsx'); // a frontend path stays frontend
-    });
-    it('does not flag public env prefixes in client files', async () => {
-        const filePath = path.join(testDir, 'components/Header.tsx');
-        fs.mkdirSync(path.dirname(filePath), { recursive: true });
-        fs.writeFileSync(filePath, `
-            export const key = process.env.NEXT_PUBLIC_STRIPE_KEY;
-        `);
-        const gate = new FrontendSecretExposureGate();
-        const failures = await gate.run({ cwd: testDir });
-        expect(failures).toHaveLength(0);
-    });
-    it('does not flag server-only API route', async () => {
-        const filePath = path.join(testDir, 'pages/api/charge.ts');
-        fs.mkdirSync(path.dirname(filePath), { recursive: true });
-        fs.writeFileSync(filePath, `
-            export default function handler() {
-                return process.env.STRIPE_SECRET_KEY;
-            }
-        `);
-        const gate = new FrontendSecretExposureGate();
-        const failures = await gate.run({ cwd: testDir });
-        expect(failures).toHaveLength(0);
-    });
-    it('does not flag .server files', async () => {
-        const filePath = path.join(testDir, 'src/lib/payments.server.ts');
-        fs.mkdirSync(path.dirname(filePath), { recursive: true });
-        fs.writeFileSync(filePath, `
-            export const stripeSecret = process.env.STRIPE_SECRET_KEY;
-        `);
-        const gate = new FrontendSecretExposureGate();
-        const failures = await gate.run({ cwd: testDir });
-        expect(failures).toHaveLength(0);
-    });
-    it('does not treat server scripts or test configuration as browser bundles', async () => {
-        for (const file of ['scripts/migrate.mjs', 'e2e/session.ts', 'tests/helpers/db.ts', 'playwright.config.ts']) {
-            const filePath = path.join(testDir, file);
-            fs.mkdirSync(path.dirname(filePath), { recursive: true });
-            fs.writeFileSync(filePath, 'export const key = process.env.SESSION_SECRET;');
-        }
-        const gate = new FrontendSecretExposureGate({ server_path_patterns: ['(^|/)pages/api/'] });
-        expect(await gate.run({ cwd: testDir })).toHaveLength(0);
-    });
-    it('ignores shell files even when a broad project scan passes them in', async () => {
-        const shellPath = path.join(testDir, 'scripts/rigour-team.sh');
-        fs.mkdirSync(path.dirname(shellPath), { recursive: true });
-        fs.writeFileSync(shellPath, 'node -e "process.env.APP_DATABASE_URL"');
-        const gate = new FrontendSecretExposureGate();
-        expect(await gate.run({ cwd: testDir, patterns: ['**/*'] })).toHaveLength(0);
-    });
-    it('respects explicit allowlist env names', async () => {
-        const filePath = path.join(testDir, 'src/views/App.tsx');
-        fs.mkdirSync(path.dirname(filePath), { recursive: true });
-        fs.writeFileSync(filePath, `
-            export const x = process.env.INTERNAL_TOKEN_FOR_DOCS;
-        `);
-        const gate = new FrontendSecretExposureGate({
-            allowlist_env_names: ['INTERNAL_TOKEN_FOR_DOCS'],
-        });
-        const failures = await gate.run({ cwd: testDir });
-        expect(failures).toHaveLength(0);
-    });
-    it('skips when disabled', async () => {
-        const filePath = path.join(testDir, 'src/components/Client.tsx');
-        fs.mkdirSync(path.dirname(filePath), { recursive: true });
-        fs.writeFileSync(filePath, `
-            export const x = process.env.OPENAI_API_KEY;
-        `);
-        const gate = new FrontendSecretExposureGate({ enabled: false });
-        const failures = await gate.run({ cwd: testDir });
-        expect(failures).toHaveLength(0);
-    });
-    it('treats SvelteKit endpoints and root tool configs as server code', async () => {
-        const files = {
-            'src/routes/api/sync/+server.ts': 'export const GET = () => fetch(url, { headers: { key: process.env.STRIPE_SECRET_KEY } });\n',
-            'drizzle.config.ts': 'export default { dbCredentials: { url: process.env.DATABASE_SECRET_URL } };\n',
-            'apps/web/drizzle.config.ts': 'export default { dbCredentials: { url: process.env.DATABASE_SECRET_URL } };\n',
-        };
-        for (const [rel, body] of Object.entries(files)) {
-            fs.mkdirSync(path.dirname(path.join(testDir, rel)), { recursive: true });
-            fs.writeFileSync(path.join(testDir, rel), body);
-        }
-        const failures = await new FrontendSecretExposureGate().run({ cwd: testDir });
-        expect(failures).toHaveLength(0);
-    });
-    it('still flags a secret in a config module inside the client source tree', async () => {
-        const filePath = path.join(testDir, 'src/components/site.config.ts');
-        fs.mkdirSync(path.dirname(filePath), { recursive: true });
-        fs.writeFileSync(filePath, 'export const key = process.env.STRIPE_SECRET_KEY;\n');
-        const failures = await new FrontendSecretExposureGate().run({ cwd: testDir });
-        expect(failures.length).toBeGreaterThan(0);
-    });
-});

package/dist/gates/hallucinated-imports/framework-modules-nuxt.test.d.ts

@@ -1 +0,0 @@
-export {};

package/dist/gates/hallucinated-imports/framework-modules-nuxt.test.js

@@ -1,27 +0,0 @@
-import fs from 'fs';
-import os from 'os';
-import path from 'path';
-import { afterEach, beforeEach, describe, expect, it } from 'vitest';
-import { isNuxtProvided, NuxtRoots } from './framework-modules.js';
-let dir;
-beforeEach(() => {
-    dir = fs.mkdtempSync(path.join(os.tmpdir(), 'nuxt-'));
-    fs.mkdirSync(path.join(dir, 'docs/server/api'), { recursive: true });
-    fs.writeFileSync(path.join(dir, 'docs/package.json'), JSON.stringify({ devDependencies: { nuxt: '^4.0.0' } }));
-    fs.writeFileSync(path.join(dir, 'package.json'), JSON.stringify({ dependencies: { vue: '^3.0.0' } }));
-});
-afterEach(() => { fs.rmSync(dir, { recursive: true, force: true }); });
-describe('Nuxt-provided modules', () => {
-    it('recognises aliases, virtual modules, the generated .nuxt dir and packages Nuxt supplies', () => {
-        for (const [spec, pkg] of [['~~/server/api/ai.post', '~~'], ['~/utils/x', '~'], ['@/components/A.vue', '@'], ['#imports', '#imports'], ['../../.nuxt/ui', '..'], ['h3', 'h3'], ['@vue/shared', '@vue/shared']]) {
-            expect(isNuxtProvided(spec, pkg)).toBe(true);
-        }
-        expect(isNuxtProvided('left-pad', 'left-pad')).toBe(false);
-        expect(isNuxtProvided('@scope/pkg', '@scope/pkg')).toBe(false);
-    });
-    it('applies only inside a project that depends on nuxt', async () => {
-        const roots = new NuxtRoots(dir);
-        expect(await roots.rootFor('docs/server/api/ai.post.ts')).toBe(path.join(dir, 'docs'));
-        expect(await roots.rootFor('src/index.ts')).toBeNull();
-    });
-});

package/dist/gates/hallucinated-imports/js-resolver-types.test.d.ts

@@ -1 +0,0 @@
-export {};

package/dist/gates/hallucinated-imports/js-resolver-types.test.js

@@ -1,14 +0,0 @@
-import { describe, expect, it } from 'vitest';
-import { typeOnlySpecifiers, typesPackageFor } from './js-resolver.js';
-describe('type-only imports', () => {
-    it('finds specifiers imported only for types, and everything in a .d.ts file', () => {
-        const ts = "import type { Context } from 'aws-lambda';\nimport { handler } from 'aws-lambda';\nexport type { Ev } from 'events-lib';\n";
-        expect([...typeOnlySpecifiers(ts, 'src/a.ts')]).toEqual(['aws-lambda', 'events-lib']);
-        const dts = "import type { Writable } from 'node:stream';\nimport { Context } from 'aws-lambda';\ntype X = import('express').Request;\n";
-        expect([...typeOnlySpecifiers(dts, 'src/global.d.ts')]).toEqual(['node:stream', 'aws-lambda', 'express']);
-    });
-    it('names the DefinitelyTyped package, scoped ones included', () => {
-        expect(typesPackageFor('aws-lambda')).toBe('@types/aws-lambda');
-        expect(typesPackageFor('@babel/core')).toBe('@types/babel__core');
-    });
-});

package/dist/gates/hallucinated-imports-sveltekit.test.d.ts

@@ -1 +0,0 @@
-export {};