code-auditor-mcp 4.1.0 → 5.0.1

package/dist/phase/rules/schemaValidator.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"schemaValidator.d.ts","sourceRoot":"","sources":["../../../src/phase/rules/schemaValidator.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAmB,MAAM,aAAa,CAAC;AASnE,mEAAmE;AACnE,KAAK,oBAAoB,GAAG;IAC1B,QAAQ,CAAC,OAAO,EAAE,SAAS,CAAC,YAAY,EAAE,KAAK,EAAE,YAAY,EAAE,IAAI,CAAC,CAAC;IACrE,QAAQ,CAAC,KAAK,EAAE,SAAS,CAAC,yBAAyB,CAAC,CAAC;CACtD,CAAC;AAmFF,+EAA+E;AAC/E,eAAO,MAAM,oBAAoB,EAAE,SAAS,cAAc,CAAC,oBAAoB,CAAC,EAI/E,CAAC"}

package/dist/phase/rules/schemaValidator.js

@@ -0,0 +1,107 @@
+/**
+ * Spec 68 §3.2 — the schema-validator rules, migrated to `analyze(ctx)`.
+ *
+ * The three rules here (`schema-field-mismatch`, `missing-field`, `extra-field`)
+ * read the `cross-language-entities` fact and reduce it through
+ * `SchemaValidator` — the same pure class the legacy Stage-4 reducer ran. The
+ * reducer (`createSchemaValidatorReducer` in pipelineAdapters.ts) called
+ * `extractSchemas(entities)` then `new SchemaValidator().validateSchemas(schemas)`
+ * and returned the resulting `SchemaViolation[]`; each violation already carries
+ * its own `rule` (`schema-field-mismatch` | `missing-field` | `extra-field`), so
+ * the migration is a filter: one rule per violation type, re-homed verbatim.
+ *
+ * `extractSchemas` and `SchemaValidator` are imported (not re-homed) because —
+ * like `DependencyGraphBuilder` — they import no analyzer class and no pipeline,
+ * so §15 keeps them. The reducer's two guards are dropped here by construction:
+ *   - the `isScoped` early-return is a *stage* concern (scoped runs never reach
+ *     a full-corpus reducer), not a rule concern — the phase model hands a rule
+ *     whatever facts it declared and the rule evaluates them;
+ *   - the `countCrossLanguagePairs === 0` notRunReason is a *coverage* signal
+ *     (§8), not a finding — `validateSchemas` on a single-language corpus
+ *     returns `[]` because every name-group has `byLanguage.size < 2`, so the
+ *     rules already emit nothing (the empty multiset the parity test pins).
+ *
+ * The `cross-language-entities` producer (`extractCrossLanguageEntities`) emits
+ * full `CrossLanguageEntity` values whose `parameters` (TS interfaces) and
+ * `metadata.fields` (Go structs) already carry `description`/`tag`, so
+ * `extractSchemas` works over the fact as-is — no shape enrichment is required.
+ */
+import { RULE_REGISTRY } from '../../analyzers/ruleRegistry.js';
+import { SchemaValidator, extractSchemas, } from '../../analyzers/cross-language/SchemaValidator.js';
+const META = RULE_REGISTRY;
+/**
+ * Run the cross-language schema comparison over the entity fact. Returns every
+ * violation, across all three rule types; each rule filters to its own `rule`.
+ * `validateSchemas` is async, so the three `analyze` bodies await it (the phase
+ * model awaits each rule).
+ */
+async function validate(entities) {
+    const schemas = extractSchemas(entities);
+    return new SchemaValidator().validateSchemas(schemas);
+}
+/** Emit one finding per violation of the given type, re-homed from the reducer. */
+function findingsFor(violations, ruleId) {
+    const out = [];
+    for (const v of violations) {
+        if (v.rule !== ruleId)
+            continue;
+        out.push({
+            ruleId,
+            severity: v.severity,
+            message: v.message,
+            file: v.file,
+            line: v.line,
+            symbol: v.fieldName,
+        });
+    }
+    return out;
+}
+// ── schema-field-mismatch ────────────────────────────────────────────────────
+const schemaFieldMismatch = {
+    id: 'schema-field-mismatch',
+    analyzer: 'schema-validator',
+    needs: { formats: ['typescript', 'tsx', 'javascript', 'go'], facts: ['cross-language-entities'] },
+    severity: 'severe',
+    message: META['schema-field-mismatch'].message,
+    docs: META['schema-field-mismatch'].docs,
+    thresholds: META['schema-field-mismatch'].thresholds,
+    samples: META['schema-field-mismatch'].samples,
+    async analyze(ctx) {
+        return findingsFor(await validate(ctx.facts['cross-language-entities']), 'schema-field-mismatch');
+    },
+};
+// ── missing-field ────────────────────────────────────────────────────────────
+const missingField = {
+    id: 'missing-field',
+    analyzer: 'schema-validator',
+    needs: { formats: ['typescript', 'tsx', 'javascript', 'go'], facts: ['cross-language-entities'] },
+    severity: 'severe',
+    message: META['missing-field'].message,
+    docs: META['missing-field'].docs,
+    thresholds: META['missing-field'].thresholds,
+    samples: META['missing-field'].samples,
+    async analyze(ctx) {
+        return findingsFor(await validate(ctx.facts['cross-language-entities']), 'missing-field');
+    },
+};
+// ── extra-field ──────────────────────────────────────────────────────────────
+const extraField = {
+    id: 'extra-field',
+    analyzer: 'schema-validator',
+    needs: { formats: ['typescript', 'tsx', 'javascript', 'go'], facts: ['cross-language-entities'] },
+    severity: 'severe',
+    message: META['extra-field'].message,
+    docs: META['extra-field'].docs,
+    thresholds: META['extra-field'].thresholds,
+    samples: META['extra-field'].samples,
+    async analyze(ctx) {
+        return findingsFor(await validate(ctx.facts['cross-language-entities']), 'extra-field');
+    },
+};
+/** The three schema-validator rules this slice migrates, in registry order. */
+export const schemaValidatorRules = [
+    schemaFieldMismatch,
+    missingField,
+    extraField,
+];
+//# sourceMappingURL=schemaValidator.js.map

package/dist/phase/rules/schemaValidator.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"schemaValidator.js","sourceRoot":"","sources":["../../../src/phase/rules/schemaValidator.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AAGH,OAAO,EAAE,aAAa,EAAE,MAAM,iCAAiC,CAAC;AAChE,OAAO,EACL,eAAe,EACf,cAAc,GAEf,MAAM,mDAAmD,CAAC;AAS3D,MAAM,IAAI,GAAG,aAAa,CAAC;AAE3B;;;;;GAKG;AACH,KAAK,UAAU,QAAQ,CAAC,QAAkB;IACxC,MAAM,OAAO,GAAG,cAAc,CAAC,QAA4C,CAAC,CAAC;IAC7E,OAAO,IAAI,eAAe,EAAE,CAAC,eAAe,CAAC,OAAO,CAAC,CAAC;AACxD,CAAC;AAED,mFAAmF;AACnF,SAAS,WAAW,CAClB,UAA6B,EAC7B,MAA+B;IAE/B,MAAM,GAAG,GAAc,EAAE,CAAC;IAC1B,KAAK,MAAM,CAAC,IAAI,UAAU,EAAE,CAAC;QAC3B,IAAI,CAAC,CAAC,IAAI,KAAK,MAAM;YAAE,SAAS;QAChC,GAAG,CAAC,IAAI,CAAC;YACP,MAAM;YACN,QAAQ,EAAE,CAAC,CAAC,QAAQ;YACpB,OAAO,EAAE,CAAC,CAAC,OAAO;YAClB,IAAI,EAAE,CAAC,CAAC,IAAI;YACZ,IAAI,EAAE,CAAC,CAAC,IAAI;YACZ,MAAM,EAAE,CAAC,CAAC,SAAS;SACpB,CAAC,CAAC;IACL,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,gFAAgF;AAEhF,MAAM,mBAAmB,GAAyC;IAChE,EAAE,EAAE,uBAAuB;IAC3B,QAAQ,EAAE,kBAAkB;IAC5B,KAAK,EAAE,EAAE,OAAO,EAAE,CAAC,YAAY,EAAE,KAAK,EAAE,YAAY,EAAE,IAAI,CAAC,EAAE,KAAK,EAAE,CAAC,yBAAyB,CAAC,EAAE;IACjG,QAAQ,EAAE,QAAQ;IAClB,OAAO,EAAE,IAAI,CAAC,uBAAuB,CAAC,CAAC,OAAO;IAC9C,IAAI,EAAE,IAAI,CAAC,uBAAuB,CAAC,CAAC,IAAI;IACxC,UAAU,EAAE,IAAI,CAAC,uBAAuB,CAAC,CAAC,UAAU;IACpD,OAAO,EAAE,IAAI,CAAC,uBAAuB,CAAC,CAAC,OAAO;IAC9C,KAAK,CAAC,OAAO,CAAC,GAAG;QACf,OAAO,WAAW,CAAC,MAAM,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,yBAAyB,CAAC,CAAC,EAAE,uBAAuB,CAAC,CAAC;IACpG,CAAC;CACF,CAAC;AAEF,gFAAgF;AAEhF,MAAM,YAAY,GAAyC;IACzD,EAAE,EAAE,eAAe;IACnB,QAAQ,EAAE,kBAAkB;IAC5B,KAAK,EAAE,EAAE,OAAO,EAAE,CAAC,YAAY,EAAE,KAAK,EAAE,YAAY,EAAE,IAAI,CAAC,EAAE,KAAK,EAAE,CAAC,yBAAyB,CAAC,EAAE;IACjG,QAAQ,EAAE,QAAQ;IAClB,OAAO,EAAE,IAAI,CAAC,eAAe,CAAC,CAAC,OAAO;IACtC,IAAI,EAAE,IAAI,CAAC,eAAe,CAAC,CAAC,IAAI;IAChC,UAAU,EAAE,IAAI,CAAC,eAAe,CAAC,CAAC,UAAU;IAC5C,OAAO,EAAE,IAAI,CAAC,eAAe,CAAC,CAAC,OAAO;IACtC,KAAK,CAAC,OAAO,CAAC,GAAG;QACf,OAAO,WAAW,CAAC,MAAM,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,yBAAyB,CAAC,CAAC,EAAE,eAAe,CAAC,CAAC;IAC5F,CAAC;CACF,CAAC;AAEF,gFAAgF;AAEhF,MAAM,UAAU,GAAyC;IACvD,EAAE,EAAE,aAAa;IACjB,QAAQ,EAAE,kBAAkB;IAC5B,KAAK,EAAE,EAAE,OAAO,EAAE,CAAC,YAAY,EAAE,KAAK,EAAE,YAAY,EAAE,IAAI,CAAC,EAAE,KAAK,EAAE,CAAC,yBAAyB,CAAC,EAAE;IACjG,QAAQ,EAAE,QAAQ;IAClB,OAAO,EAAE,IAAI,CAAC,aAAa,CAAC,CAAC,OAAO;IACpC,IAAI,EAAE,IAAI,CAAC,aAAa,CAAC,CAAC,IAAI;IAC9B,UAAU,EAAE,IAAI,CAAC,aAAa,CAAC,CAAC,UAAU;IAC1C,OAAO,EAAE,IAAI,CAAC,aAAa,CAAC,CAAC,OAAO;IACpC,KAAK,CAAC,OAAO,CAAC,GAAG;QACf,OAAO,WAAW,CAAC,MAAM,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,yBAAyB,CAAC,CAAC,EAAE,aAAa,CAAC,CAAC;IAC1F,CAAC;CACF,CAAC;AAEF,+EAA+E;AAC/E,MAAM,CAAC,MAAM,oBAAoB,GAAoD;IACnF,mBAAmB;IACnB,YAAY;IACZ,UAAU;CACX,CAAC"}

package/dist/phase/rules/secrets.d.ts

@@ -0,0 +1,34 @@
+/**
+ * Spec 68 §3.2 — the hardcoded-credential rules, migrated to `analyze(ctx)`.
+ *
+ * `hardcoded-secret` re-homes `UniversalSecretsAnalyzer.inspectNode`'s
+ * *classification* half: given a `secret-candidates` fact (which the producer
+ * built from the four credential positions — variable/assignment/pair/call —
+ * carrying the name/key/args and the enclosing node's start position), it runs
+ * the pure decision the legacy analyzer made inside the same `walkAST` loop.
+ * The producer projected the positional context; this rule decides whether it is
+ * a secret.
+ *
+ * The classification helpers (`SECRET_NAMES`, `normalizeName`, `isSecretName`,
+ * `looksLikeRealSecret`, `isPlaceholder`, `hasKnownTokenPrefix`,
+ * `isCredentialSelector`, `HARD_SYMBOL`, `PLACEHOLDERS`, `isTestOrFixtureFile`)
+ * are re-homed verbatim — copied, not imported, because the analyzer is deleted
+ * in §15 and the rule must not couple the new pipeline to a class about to
+ * disappear. The `isTestOrFixtureFile` skip, which the legacy analyzer applied
+ * per-file before walking, becomes a per-candidate skip here (a file is either a
+ * test fixture or not, so the two are equivalent).
+ *
+ * `hardcoded-connection` (the other security rule, reading `string-literals`)
+ * lives in `security.ts` alongside this file; both are re-exported from
+ * `securityRules` in that module so the registry and runner stay unchanged.
+ */
+import type { RuleDefinition } from '../types.js';
+/** The declaration for `hardcoded-secret`: it reads `secret-candidates`. */
+type SecretNeeds = {
+    readonly formats: readonly ['typescript', 'tsx', 'javascript'];
+    readonly facts: readonly ['secret-candidates'];
+};
+/** The hardcoded-secret rule this slice migrates, in registry order. */
+export declare const secretsRules: readonly RuleDefinition<SecretNeeds>[];
+export {};
+//# sourceMappingURL=secrets.d.ts.map

package/dist/phase/rules/secrets.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"secrets.d.ts","sourceRoot":"","sources":["../../../src/phase/rules/secrets.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAEH,OAAO,KAAK,EAAE,cAAc,EAA4B,MAAM,aAAa,CAAC;AAK5E,4EAA4E;AAC5E,KAAK,WAAW,GAAG;IACjB,QAAQ,CAAC,OAAO,EAAE,SAAS,CAAC,YAAY,EAAE,KAAK,EAAE,YAAY,CAAC,CAAC;IAC/D,QAAQ,CAAC,KAAK,EAAE,SAAS,CAAC,mBAAmB,CAAC,CAAC;CAChD,CAAC;AA8LF,wEAAwE;AACxE,eAAO,MAAM,YAAY,EAAE,SAAS,cAAc,CAAC,WAAW,CAAC,EAE9D,CAAC"}

package/dist/phase/rules/secrets.js

@@ -0,0 +1,208 @@
+/**
+ * Spec 68 §3.2 — the hardcoded-credential rules, migrated to `analyze(ctx)`.
+ *
+ * `hardcoded-secret` re-homes `UniversalSecretsAnalyzer.inspectNode`'s
+ * *classification* half: given a `secret-candidates` fact (which the producer
+ * built from the four credential positions — variable/assignment/pair/call —
+ * carrying the name/key/args and the enclosing node's start position), it runs
+ * the pure decision the legacy analyzer made inside the same `walkAST` loop.
+ * The producer projected the positional context; this rule decides whether it is
+ * a secret.
+ *
+ * The classification helpers (`SECRET_NAMES`, `normalizeName`, `isSecretName`,
+ * `looksLikeRealSecret`, `isPlaceholder`, `hasKnownTokenPrefix`,
+ * `isCredentialSelector`, `HARD_SYMBOL`, `PLACEHOLDERS`, `isTestOrFixtureFile`)
+ * are re-homed verbatim — copied, not imported, because the analyzer is deleted
+ * in §15 and the rule must not couple the new pipeline to a class about to
+ * disappear. The `isTestOrFixtureFile` skip, which the legacy analyzer applied
+ * per-file before walking, becomes a per-candidate skip here (a file is either a
+ * test fixture or not, so the two are equivalent).
+ *
+ * `hardcoded-connection` (the other security rule, reading `string-literals`)
+ * lives in `security.ts` alongside this file; both are re-exported from
+ * `securityRules` in that module so the registry and runner stay unchanged.
+ */
+import { RULE_REGISTRY } from '../../analyzers/ruleRegistry.js';
+const META = RULE_REGISTRY['hardcoded-secret'];
+// ── Classification (re-homed verbatim from UniversalSecretsAnalyzer) ───────
+/** Secret-ish names, normalized so `apiKey`/`api_key`/`API_KEY`/`x-api-key`
+ *  collapse to one form. */
+const SECRET_NAMES = new Set([
+    'password', 'passwd', 'pwd', 'passphrase',
+    'secret', 'clientsecret',
+    'apikey',
+    'accesskey', 'accesstoken',
+    'authtoken',
+    'token',
+    'privatekey',
+    'credential', 'credentials',
+    'awssecret', 'awskey',
+    'sessionkey', 'signingkey',
+    'authorization',
+    'xapikey', 'xauthtoken',
+]);
+function normalizeName(name) {
+    return name.toLowerCase().replace(/[^a-z0-9]/g, '');
+}
+function isSecretName(name) {
+    const norm = normalizeName(name);
+    return norm.length > 0 && SECRET_NAMES.has(norm);
+}
+/** A symbol that is not a common word separator (`-`, `_`, `.`, space). */
+const HARD_SYMBOL = /[^A-Za-z0-9\-_.\s]/;
+/** A known token prefix (`Bearer …`, `sk-…`, `ghp_…`, `AKIA…`, `xoxb-…`, JWT). */
+function hasKnownTokenPrefix(value) {
+    const t = value.trim();
+    return (/^Bearer\s/i.test(t) ||
+        /^sk-[A-Za-z0-9]{20,}/.test(t) ||
+        /^(ghp|gho|ghu|ghs|github_pat)_[A-Za-z0-9]{20,}/.test(t) ||
+        /^(sk|rk|pk)_(live|test)_[A-Za-z0-9]{10,}/.test(t) ||
+        /^AKIA[0-9A-Z]{16}$/.test(t) ||
+        /^xox[baprs]-/.test(t) ||
+        /^eyJ[A-Za-z0-9_-]{10,}\./.test(t));
+}
+const PLACEHOLDERS = new Set([
+    'password', 'passwd', 'pwd', 'changeme', 'changethis', 'secret', 'yoursecret',
+    'yourapikey', 'yourtoken', 'yourapitoken', 'apikey', 'token', 'example',
+    'dummy', 'placeholder', 'replaceme', 'todo', 'fixme', 'xxx', 'xxxx', 'xxxxx',
+    'test', 'testpassword', 'testsecret', 'testtoken', '123456', '12345678',
+    '123456789', 'password123', 'qwerty', 'letmein', 'abc123', 'foobar',
+    'helloworld', 'notareal', 'notreal', 'sample', 'samplekey', 'sampletoken',
+    'insecure', 'insecurepassword', 'notasecret',
+]);
+/** Reject placeholder/example values: templates, redactions, and common words. */
+function isPlaceholder(value) {
+    const t = value.trim();
+    if (t.length === 0)
+        return true;
+    if (/^<[^>]+>$/.test(t))
+        return true;
+    if (/^[.…]{3,}$/.test(t))
+        return true;
+    if (/^[*xX]{3,}$/.test(t))
+        return true;
+    if (/^redacted$/i.test(t))
+        return true;
+    const norm = normalizeName(t);
+    if (PLACEHOLDERS.has(norm))
+        return true;
+    if (/^(your|test|example|sample|dummy|placeholder|replaceme|changeme)/.test(norm))
+        return true;
+    return false;
+}
+/** Does this literal look like a real credential value rather than a placeholder? */
+function looksLikeRealSecret(value) {
+    const t = value.trim();
+    if (isPlaceholder(t))
+        return false;
+    if (hasKnownTokenPrefix(t))
+        return true;
+    if (t.length < 8)
+        return false;
+    if (/^[^@\s]+@[^@\s]+\.[^@\s]+$/.test(t))
+        return false;
+    if (/^https?:\/\//i.test(t))
+        return false;
+    // A letters-only camelCase identifier (`styleToken`, `cssProperty`) is a code
+    // reference written as a string — an operator→field map value, not a
+    // credential. Real credentials carry digits or hard symbols; a clean
+    // camelCase name carries none of that entropy.
+    if (/^[A-Za-z_$][A-Za-z_$]*$/.test(t))
+        return false;
+    const hasDigit = /\d/.test(t);
+    const hasUpper = /[A-Z]/.test(t);
+    const hasHardSymbol = HARD_SYMBOL.test(t);
+    return hasDigit || hasUpper || hasHardSymbol;
+}
+/** Is this path a test/fixture file? Excluded up front (precision-first). */
+function isTestOrFixtureFile(filePath) {
+    const lower = filePath.toLowerCase();
+    return (lower.includes('.test.') || lower.includes('.spec.') ||
+        lower.includes('__tests__') ||
+        lower.includes('/test/') || lower.includes('/tests/') ||
+        lower.includes('/fixtures/') || lower.includes('.fixture.') ||
+        lower.endsWith('_test.go'));
+}
+/** Is this string a credential *field selector* (`#password`, `.api_key`,
+ *  `input[name=token]`)? Extracts the field-name core and checks the set. */
+function isCredentialSelector(text) {
+    let core = text.trim().replace(/^['"]|['"]$/g, '');
+    core = core.replace(/^[.#]/, '').trim();
+    const bracket = core.match(/\[([^\[\]]+)\]$/);
+    if (bracket)
+        core = bracket[1];
+    core = core.replace(/^name\s*=\s*["']?|["']?$/gi, '');
+    core = core.replace(/["']/g, '').trim();
+    return isSecretName(core);
+}
+// ── Detection ───────────────────────────────────────────────────────────────
+/** Build the finding, anchored at the candidate's enclosing-node position. */
+function makeFinding(file, line, column, name, value) {
+    const label = name ? ` "${name}"` : '';
+    const reference = name
+        ? `process.env.${normalizeName(name).toUpperCase()}`
+        : 'process.env.SECRET';
+    return {
+        ruleId: 'hardcoded-secret',
+        severity: 'critical',
+        message: `Hardcoded secret${label} detected: a ${value.length}-character credential is embedded in source. ` +
+            'Move it to an environment variable or secret store.',
+        file,
+        line,
+        column,
+        resolution: {
+            action: 'remove-hardcoded-secret',
+            summary: `Replace the hardcoded${label} credential with a reference to an environment variable or secret store (e.g. ${reference}).`,
+            symbols: name ? [name] : undefined,
+            files: [file],
+            lines: [line],
+        },
+    };
+}
+/** Re-homes `inspectNode` + `checkCredentialCall`: classify candidates into
+ *  hardcoded-secret findings. */
+function detectHardcodedSecret(candidates) {
+    const findings = [];
+    for (const c of candidates) {
+        if (isTestOrFixtureFile(c.file))
+            continue;
+        if (c.position === 'call') {
+            // `fn('<selector>', '<secret>')` — the page.type reference case.
+            if (c.args.length < 2)
+                continue;
+            const hasSelector = c.args.some(isCredentialSelector);
+            if (!hasSelector)
+                continue;
+            for (const value of c.args) {
+                if (isCredentialSelector(value))
+                    continue;
+                if (looksLikeRealSecret(value)) {
+                    findings.push(makeFinding(c.file, c.line, c.column, undefined, value));
+                }
+            }
+            continue;
+        }
+        if (isSecretName(c.name) && looksLikeRealSecret(c.value)) {
+            findings.push(makeFinding(c.file, c.line, c.column, c.name, c.value));
+        }
+    }
+    return findings;
+}
+const hardcodedSecret = {
+    id: 'hardcoded-secret',
+    analyzer: 'secrets',
+    needs: { formats: ['typescript', 'tsx', 'javascript'], facts: ['secret-candidates'] },
+    severity: 'critical',
+    message: META.message,
+    docs: META.docs,
+    thresholds: META.thresholds,
+    samples: META.samples,
+    analyze(ctx) {
+        return detectHardcodedSecret(ctx.facts['secret-candidates']);
+    },
+};
+/** The hardcoded-secret rule this slice migrates, in registry order. */
+export const secretsRules = [
+    hardcodedSecret,
+];
+//# sourceMappingURL=secrets.js.map

package/dist/phase/rules/secrets.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"secrets.js","sourceRoot":"","sources":["../../../src/phase/rules/secrets.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAGH,OAAO,EAAE,aAAa,EAAE,MAAM,iCAAiC,CAAC;AAEhE,MAAM,IAAI,GAAG,aAAa,CAAC,kBAAkB,CAAC,CAAC;AAQ/C,8EAA8E;AAE9E;4BAC4B;AAC5B,MAAM,YAAY,GAAG,IAAI,GAAG,CAAC;IAC3B,UAAU,EAAE,QAAQ,EAAE,KAAK,EAAE,YAAY;IACzC,QAAQ,EAAE,cAAc;IACxB,QAAQ;IACR,WAAW,EAAE,aAAa;IAC1B,WAAW;IACX,OAAO;IACP,YAAY;IACZ,YAAY,EAAE,aAAa;IAC3B,WAAW,EAAE,QAAQ;IACrB,YAAY,EAAE,YAAY;IAC1B,eAAe;IACf,SAAS,EAAE,YAAY;CACxB,CAAC,CAAC;AAEH,SAAS,aAAa,CAAC,IAAY;IACjC,OAAO,IAAI,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,YAAY,EAAE,EAAE,CAAC,CAAC;AACtD,CAAC;AAED,SAAS,YAAY,CAAC,IAAY;IAChC,MAAM,IAAI,GAAG,aAAa,CAAC,IAAI,CAAC,CAAC;IACjC,OAAO,IAAI,CAAC,MAAM,GAAG,CAAC,IAAI,YAAY,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;AACnD,CAAC;AAED,2EAA2E;AAC3E,MAAM,WAAW,GAAG,oBAAoB,CAAC;AAEzC,kFAAkF;AAClF,SAAS,mBAAmB,CAAC,KAAa;IACxC,MAAM,CAAC,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;IACvB,OAAO,CACL,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC;QACpB,sBAAsB,CAAC,IAAI,CAAC,CAAC,CAAC;QAC9B,gDAAgD,CAAC,IAAI,CAAC,CAAC,CAAC;QACxD,0CAA0C,CAAC,IAAI,CAAC,CAAC,CAAC;QAClD,oBAAoB,CAAC,IAAI,CAAC,CAAC,CAAC;QAC5B,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC;QACtB,0BAA0B,CAAC,IAAI,CAAC,CAAC,CAAC,CACnC,CAAC;AACJ,CAAC;AAED,MAAM,YAAY,GAAG,IAAI,GAAG,CAAC;IAC3B,UAAU,EAAE,QAAQ,EAAE,KAAK,EAAE,UAAU,EAAE,YAAY,EAAE,QAAQ,EAAE,YAAY;IAC7E,YAAY,EAAE,WAAW,EAAE,cAAc,EAAE,QAAQ,EAAE,OAAO,EAAE,SAAS;IACvE,OAAO,EAAE,aAAa,EAAE,WAAW,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO;IAC5E,MAAM,EAAE,cAAc,EAAE,YAAY,EAAE,WAAW,EAAE,QAAQ,EAAE,UAAU;IACvE,WAAW,EAAE,aAAa,EAAE,QAAQ,EAAE,SAAS,EAAE,QAAQ,EAAE,QAAQ;IACnE,YAAY,EAAE,UAAU,EAAE,SAAS,EAAE,QAAQ,EAAE,WAAW,EAAE,aAAa;IACzE,UAAU,EAAE,kBAAkB,EAAE,YAAY;CAC7C,CAAC,CAAC;AAEH,kFAAkF;AAClF,SAAS,aAAa,CAAC,KAAa;IAClC,MAAM,CAAC,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;IACvB,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAChC,IAAI,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IACrC,IAAI,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IACtC,IAAI,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IACvC,IAAI,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IACvC,MAAM,IAAI,GAAG,aAAa,CAAC,CAAC,CAAC,CAAC;IAC9B,IAAI,YAAY,CAAC,GAAG,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IACxC,IAAI,kEAAkE,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IAC/F,OAAO,KAAK,CAAC;AACf,CAAC;AAED,qFAAqF;AACrF,SAAS,mBAAmB,CAAC,KAAa;IACxC,MAAM,CAAC,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;IACvB,IAAI,aAAa,CAAC,CAAC,CAAC;QAAE,OAAO,KAAK,CAAC;IACnC,IAAI,mBAAmB,CAAC,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IACxC,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,KAAK,CAAC;IAC/B,IAAI,4BAA4B,CAAC,IAAI,CAAC,CAAC,CAAC;QAAE,OAAO,KAAK,CAAC;IACvD,IAAI,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC;QAAE,OAAO,KAAK,CAAC;IAC1C,8EAA8E;IAC9E,qEAAqE;IACrE,qEAAqE;IACrE,+CAA+C;IAC/C,IAAI,yBAAyB,CAAC,IAAI,CAAC,CAAC,CAAC;QAAE,OAAO,KAAK,CAAC;IACpD,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC9B,MAAM,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACjC,MAAM,aAAa,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC1C,OAAO,QAAQ,IAAI,QAAQ,IAAI,aAAa,CAAC;AAC/C,CAAC;AAED,6EAA6E;AAC7E,SAAS,mBAAmB,CAAC,QAAgB;IAC3C,MAAM,KAAK,GAAG,QAAQ,CAAC,WAAW,EAAE,CAAC;IACrC,OAAO,CACL,KAAK,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,QAAQ,CAAC;QACpD,KAAK,CAAC,QAAQ,CAAC,WAAW,CAAC;QAC3B,KAAK,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,SAAS,CAAC;QACrD,KAAK,CAAC,QAAQ,CAAC,YAAY,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,WAAW,CAAC;QAC3D,KAAK,CAAC,QAAQ,CAAC,UAAU,CAAC,CAC3B,CAAC;AACJ,CAAC;AAED;6EAC6E;AAC7E,SAAS,oBAAoB,CAAC,IAAY;IACxC,IAAI,IAAI,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,cAAc,EAAE,EAAE,CAAC,CAAC;IACnD,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IACxC,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAC;IAC9C,IAAI,OAAO;QAAE,IAAI,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;IAC/B,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,4BAA4B,EAAE,EAAE,CAAC,CAAC;IACtD,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IACxC,OAAO,YAAY,CAAC,IAAI,CAAC,CAAC;AAC5B,CAAC;AAED,+EAA+E;AAE/E,8EAA8E;AAC9E,SAAS,WAAW,CAClB,IAAY,EACZ,IAAY,EACZ,MAAc,EACd,IAAwB,EACxB,KAAa;IAEb,MAAM,KAAK,GAAG,IAAI,CAAC,CAAC,CAAC,KAAK,IAAI,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;IACvC,MAAM,SAAS,GAAG,IAAI;QACpB,CAAC,CAAC,eAAe,aAAa,CAAC,IAAI,CAAC,CAAC,WAAW,EAAE,EAAE;QACpD,CAAC,CAAC,oBAAoB,CAAC;IACzB,OAAO;QACL,MAAM,EAAE,kBAAkB;QAC1B,QAAQ,EAAE,UAAU;QACpB,OAAO,EACL,mBAAmB,KAAK,gBAAgB,KAAK,CAAC,MAAM,+CAA+C;YACnG,qDAAqD;QACvD,IAAI;QACJ,IAAI;QACJ,MAAM;QACN,UAAU,EAAE;YACV,MAAM,EAAE,yBAAyB;YACjC,OAAO,EACL,wBAAwB,KAAK,iFAAiF,SAAS,IAAI;YAC7H,OAAO,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS;YAClC,KAAK,EAAE,CAAC,IAAI,CAAC;YACb,KAAK,EAAE,CAAC,IAAI,CAAC;SACd;KACF,CAAC;AACJ,CAAC;AAED;iCACiC;AACjC,SAAS,qBAAqB,CAAC,UAAsC;IACnE,MAAM,QAAQ,GAAc,EAAE,CAAC;IAC/B,KAAK,MAAM,CAAC,IAAI,UAAU,EAAE,CAAC;QAC3B,IAAI,mBAAmB,CAAC,CAAC,CAAC,IAAI,CAAC;YAAE,SAAS;QAE1C,IAAI,CAAC,CAAC,QAAQ,KAAK,MAAM,EAAE,CAAC;YAC1B,iEAAiE;YACjE,IAAI,CAAC,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC;gBAAE,SAAS;YAChC,MAAM,WAAW,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,oBAAoB,CAAC,CAAC;YACtD,IAAI,CAAC,WAAW;gBAAE,SAAS;YAC3B,KAAK,MAAM,KAAK,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC;gBAC3B,IAAI,oBAAoB,CAAC,KAAK,CAAC;oBAAE,SAAS;gBAC1C,IAAI,mBAAmB,CAAC,KAAK,CAAC,EAAE,CAAC;oBAC/B,QAAQ,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,SAAS,EAAE,KAAK,CAAC,CAAC,CAAC;gBACzE,CAAC;YACH,CAAC;YACD,SAAS;QACX,CAAC;QAED,IAAI,YAAY,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,mBAAmB,CAAC,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC;YACzD,QAAQ,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC;QACxE,CAAC;IACH,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,MAAM,eAAe,GAAgC;IACnD,EAAE,EAAE,kBAAkB;IACtB,QAAQ,EAAE,SAAS;IACnB,KAAK,EAAE,EAAE,OAAO,EAAE,CAAC,YAAY,EAAE,KAAK,EAAE,YAAY,CAAC,EAAE,KAAK,EAAE,CAAC,mBAAmB,CAAC,EAAE;IACrF,QAAQ,EAAE,UAAU;IACpB,OAAO,EAAE,IAAI,CAAC,OAAO;IACrB,IAAI,EAAE,IAAI,CAAC,IAAI;IACf,UAAU,EAAE,IAAI,CAAC,UAAU;IAC3B,OAAO,EAAE,IAAI,CAAC,OAAO;IACrB,OAAO,CAAC,GAAG;QACT,OAAO,qBAAqB,CAAC,GAAG,CAAC,KAAK,CAAC,mBAAmB,CAAC,CAAC,CAAC;IAC/D,CAAC;CACF,CAAC;AAEF,wEAAwE;AACxE,MAAM,CAAC,MAAM,YAAY,GAA2C;IAClE,eAAe;CAChB,CAAC"}

package/dist/phase/rules/security.d.ts

@@ -0,0 +1,30 @@
+/**
+ * Spec 68 §3.2 — the hardcoded-credential rules, migrated to `analyze(ctx)`.
+ *
+ * `hardcoded-connection` re-homes `UniversalDataAccessAnalyzer.checkGeneralPatterns`
+ * (the one detector that walks raw string literals): flag any string whose text
+ * matches a connection-string shape. It reads the `string-literals` fact, whose
+ * producer already pre-computed the `enclosingFunction` label the legacy
+ * `enclosingIdentity` returned, so the symbol (`<fn>:hardcoded-connection[:n]`)
+ * is byte-identical to the pre-migration output. The message is the full legacy
+ * literal, not the registry's shortened template.
+ *
+ * `hardcoded-secret` (UniversalSecretsAnalyzer) lives in `secrets.ts`: it
+ * anchors at the enclosing `variable_declarator` / `assignment_expression` /
+ * `pair` / `call_expression`, not at the string node, so it reads the
+ * `secret-candidates` fact carrying that positional context.
+ *
+ * The other three security rules (`command-injection-risk`,
+ * `dynamic-require-of-project-path`, `unescaped-html-interpolation`) read
+ * call-site / expression context, another later fact kind.
+ */
+import type { RuleDefinition } from '../types.js';
+/** The shared declaration for the hardcoded-credential rules in this slice. */
+type SecurityNeeds = {
+    readonly formats: readonly ['typescript', 'tsx', 'javascript'];
+    readonly facts: readonly ['string-literals'];
+};
+/** The hardcoded-credential rules this slice migrates, in registry order. */
+export declare const securityRules: readonly RuleDefinition<SecurityNeeds>[];
+export {};
+//# sourceMappingURL=security.d.ts.map

package/dist/phase/rules/security.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"security.d.ts","sourceRoot":"","sources":["../../../src/phase/rules/security.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,OAAO,KAAK,EAAE,cAAc,EAA8B,MAAM,aAAa,CAAC;AAK9E,+EAA+E;AAC/E,KAAK,aAAa,GAAG;IACnB,QAAQ,CAAC,OAAO,EAAE,SAAS,CAAC,YAAY,EAAE,KAAK,EAAE,YAAY,CAAC,CAAC;IAC/D,QAAQ,CAAC,KAAK,EAAE,SAAS,CAAC,iBAAiB,CAAC,CAAC;CAC9C,CAAC;AAiEF,6EAA6E;AAC7E,eAAO,MAAM,aAAa,EAAE,SAAS,cAAc,CAAC,aAAa,CAAC,EAEjE,CAAC"}

package/dist/phase/rules/security.js

@@ -0,0 +1,85 @@
+/**
+ * Spec 68 §3.2 — the hardcoded-credential rules, migrated to `analyze(ctx)`.
+ *
+ * `hardcoded-connection` re-homes `UniversalDataAccessAnalyzer.checkGeneralPatterns`
+ * (the one detector that walks raw string literals): flag any string whose text
+ * matches a connection-string shape. It reads the `string-literals` fact, whose
+ * producer already pre-computed the `enclosingFunction` label the legacy
+ * `enclosingIdentity` returned, so the symbol (`<fn>:hardcoded-connection[:n]`)
+ * is byte-identical to the pre-migration output. The message is the full legacy
+ * literal, not the registry's shortened template.
+ *
+ * `hardcoded-secret` (UniversalSecretsAnalyzer) lives in `secrets.ts`: it
+ * anchors at the enclosing `variable_declarator` / `assignment_expression` /
+ * `pair` / `call_expression`, not at the string node, so it reads the
+ * `secret-candidates` fact carrying that positional context.
+ *
+ * The other three security rules (`command-injection-risk`,
+ * `dynamic-require-of-project-path`, `unescaped-html-interpolation`) read
+ * call-site / expression context, another later fact kind.
+ */
+import { RULE_REGISTRY } from '../../analyzers/ruleRegistry.js';
+const META = RULE_REGISTRY['hardcoded-connection'];
+/** Re-homes `isConnectionString` from UniversalDataAccessAnalyzer. */
+function isConnectionString(text) {
+    const patterns = [
+        /mongodb:\/\//i,
+        /postgres:\/\//i,
+        /mysql:\/\//i,
+        /Server=.*;Database=/i,
+        /Data Source=.*;Initial Catalog=/i,
+    ];
+    return patterns.some((pattern) => pattern.test(text));
+}
+/** Re-homes `checkGeneralPatterns`: flag connection-string literals, keying the
+ *  symbol ordinal on `<fn>:hardcoded-connection` per file (the legacy detector
+ *  ran once per AST, so two files sharing a function name do not collide). */
+function detectHardcodedConnection(facts) {
+    const byFile = new Map();
+    for (const lit of facts) {
+        if (!isConnectionString(lit.value))
+            continue;
+        const arr = byFile.get(lit.file) ?? [];
+        arr.push(lit);
+        byFile.set(lit.file, arr);
+    }
+    const findings = [];
+    for (const lits of byFile.values()) {
+        const ordinals = new Map();
+        for (const lit of lits) {
+            const baseSym = `${lit.enclosingFunction}:hardcoded-connection`;
+            const count = (ordinals.get(baseSym) ?? 0) + 1;
+            ordinals.set(baseSym, count);
+            const sym = count > 1 ? `${baseSym}:${count}` : baseSym;
+            findings.push({
+                ruleId: 'hardcoded-connection',
+                severity: 'critical',
+                message: 'Hardcoded database connection string detected. Use environment variables. ' +
+                    '(On Cloudflare Workers/D1, connection strings are injected via bindings.)',
+                file: lit.file,
+                line: lit.line,
+                column: lit.column,
+                symbol: sym,
+            });
+        }
+    }
+    return findings;
+}
+const hardcodedConnection = {
+    id: 'hardcoded-connection',
+    analyzer: 'data-access',
+    needs: { formats: ['typescript', 'tsx', 'javascript'], facts: ['string-literals'] },
+    severity: 'critical',
+    message: META.message,
+    docs: META.docs,
+    thresholds: META.thresholds,
+    samples: META.samples,
+    analyze(ctx) {
+        return detectHardcodedConnection(ctx.facts['string-literals']);
+    },
+};
+/** The hardcoded-credential rules this slice migrates, in registry order. */
+export const securityRules = [
+    hardcodedConnection,
+];
+//# sourceMappingURL=security.js.map

package/dist/phase/rules/security.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"security.js","sourceRoot":"","sources":["../../../src/phase/rules/security.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAGH,OAAO,EAAE,aAAa,EAAE,MAAM,iCAAiC,CAAC;AAEhE,MAAM,IAAI,GAAG,aAAa,CAAC,sBAAsB,CAAC,CAAC;AAQnD,sEAAsE;AACtE,SAAS,kBAAkB,CAAC,IAAY;IACtC,MAAM,QAAQ,GAAG;QACf,eAAe;QACf,gBAAgB;QAChB,aAAa;QACb,sBAAsB;QACtB,kCAAkC;KACnC,CAAC;IACF,OAAO,QAAQ,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;AACxD,CAAC;AAED;;8EAE8E;AAC9E,SAAS,yBAAyB,CAAC,KAAmC;IACpE,MAAM,MAAM,GAAG,IAAI,GAAG,EAA+B,CAAC;IACtD,KAAK,MAAM,GAAG,IAAI,KAAK,EAAE,CAAC;QACxB,IAAI,CAAC,kBAAkB,CAAC,GAAG,CAAC,KAAK,CAAC;YAAE,SAAS;QAC7C,MAAM,GAAG,GAAG,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;QACvC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACd,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IAC5B,CAAC;IAED,MAAM,QAAQ,GAAc,EAAE,CAAC;IAC/B,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,MAAM,EAAE,EAAE,CAAC;QACnC,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAkB,CAAC;QAC3C,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;YACvB,MAAM,OAAO,GAAG,GAAG,GAAG,CAAC,iBAAiB,uBAAuB,CAAC;YAChE,MAAM,KAAK,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC;YAC/C,QAAQ,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;YAC7B,MAAM,GAAG,GAAG,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,OAAO,IAAI,KAAK,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC;YAExD,QAAQ,CAAC,IAAI,CAAC;gBACZ,MAAM,EAAE,sBAAsB;gBAC9B,QAAQ,EAAE,UAAU;gBACpB,OAAO,EACL,4EAA4E;oBAC5E,2EAA2E;gBAC7E,IAAI,EAAE,GAAG,CAAC,IAAI;gBACd,IAAI,EAAE,GAAG,CAAC,IAAI;gBACd,MAAM,EAAE,GAAG,CAAC,MAAM;gBAClB,MAAM,EAAE,GAAG;aACZ,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,MAAM,mBAAmB,GAAkC;IACzD,EAAE,EAAE,sBAAsB;IAC1B,QAAQ,EAAE,aAAa;IACvB,KAAK,EAAE,EAAE,OAAO,EAAE,CAAC,YAAY,EAAE,KAAK,EAAE,YAAY,CAAC,EAAE,KAAK,EAAE,CAAC,iBAAiB,CAAC,EAAE;IACnF,QAAQ,EAAE,UAAU;IACpB,OAAO,EAAE,IAAI,CAAC,OAAO;IACrB,IAAI,EAAE,IAAI,CAAC,IAAI;IACf,UAAU,EAAE,IAAI,CAAC,UAAU;IAC3B,OAAO,EAAE,IAAI,CAAC,OAAO;IACrB,OAAO,CAAC,GAAG;QACT,OAAO,yBAAyB,CAAC,GAAG,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAC,CAAC;IACjE,CAAC;CACF,CAAC;AAEF,6EAA6E;AAC7E,MAAM,CAAC,MAAM,aAAa,GAA6C;IACrE,mBAAmB;CACpB,CAAC"}

package/dist/phase/rules/securityDefects.d.ts

@@ -0,0 +1,37 @@
+/**
+ * Spec 68 §3.2 — the three single-file security rules (Spec 61 R6), migrated to
+ * `analyze(ctx)`. They read the `security-candidates` fact, whose producer
+ * (`securityCandidates.ts`) already resolved the structural half the legacy
+ * `UniversalSecurityAnalyzer` walked the AST to obtain:
+ *
+ *   - `command-injection-risk`       — a shell/process invocation whose command
+ *     is interpolated/concatenated (the producer resolved `unsafe`).
+ *   - `dynamic-require-of-project-path` — a computed require/import specifier
+ *     (the producer filtered out literals and carried the raw arg + callee text).
+ *   - `unescaped-html-interpolation` — a sink-reaching template substitution that
+ *     resolves to a member access (the producer ran the three-phase sink flow).
+ *
+ * The rule's job is the pure-text classification the producer could not do
+ * without deciding — `isConfigPath` (dynamic-require), the `isTestOrFixtureFile`
+ * skip (all three, matching the legacy per-file early return) — and the
+ * finding/message/resolution construction. The producers never decided "is this
+ * a finding"; they projected the positional context and the resolved
+ * name/prop, exactly as `secretCandidates.ts` does for `secret-candidates`.
+ *
+ * The helper functions (`isTestOrFixtureFile`, `isConfigPath`) are re-homed
+ * verbatim — copied, not imported, because `UniversalSecurityAnalyzer` is
+ * deleted in §15 and the rule must not couple the new pipeline to a class about
+ * to disappear. The finding messages are the full legacy literals (not the
+ * registry's shortened `{method}`/`{path}`/`{field}` templates), matching how
+ * `hardcoded-connection` and `hardcoded-secret` carry their pre-migration text.
+ */
+import type { RuleDefinition } from '../types.js';
+/** The declaration for the three rules: they read `security-candidates`. */
+type SecurityDefectNeeds = {
+    readonly formats: readonly ['typescript', 'tsx', 'javascript'];
+    readonly facts: readonly ['security-candidates'];
+};
+/** The three single-file security rules this slice migrates, in registry order. */
+export declare const securityDefectRules: readonly RuleDefinition<SecurityDefectNeeds>[];
+export {};
+//# sourceMappingURL=securityDefects.d.ts.map

package/dist/phase/rules/securityDefects.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"securityDefects.d.ts","sourceRoot":"","sources":["../../../src/phase/rules/securityDefects.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAEH,OAAO,KAAK,EAAE,cAAc,EAA8B,MAAM,aAAa,CAAC;AAO9E,4EAA4E;AAC5E,KAAK,mBAAmB,GAAG;IACzB,QAAQ,CAAC,OAAO,EAAE,SAAS,CAAC,YAAY,EAAE,KAAK,EAAE,YAAY,CAAC,CAAC;IAC/D,QAAQ,CAAC,KAAK,EAAE,SAAS,CAAC,qBAAqB,CAAC,CAAC;CAClD,CAAC;AAwKF,mFAAmF;AACnF,eAAO,MAAM,mBAAmB,EAAE,SAAS,cAAc,CAAC,mBAAmB,CAAC,EAI7E,CAAC"}