codesift-mcp 0.3.0 → 0.5.0

package/dist/tools/nextjs-security-readers.js

@@ -0,0 +1,318 @@
+/**
+ * AST readers for Next.js Server Actions security audit (T2).
+ *
+ * Each reader is a focused, pure function that extracts a specific signal
+ * from a parsed tree-sitter Tree. The orchestrator in `nextjs-security-tools.ts`
+ * composes them into a per-action audit.
+ */
+import { extractZodSchema } from "../utils/nextjs.js";
+/** Determine if a tree-sitter program has a file-scope `"use server"` directive. */
+function hasFileScopeUseServer(tree) {
+    const root = tree.rootNode;
+    const first = root.namedChildren[0];
+    if (!first)
+        return false;
+    if (first.type !== "expression_statement")
+        return false;
+    const inner = first.namedChildren[0];
+    if (!inner)
+        return false;
+    if (inner.type !== "string")
+        return false;
+    const text = inner.text.length >= 2 ? inner.text.slice(1, -1) : inner.text;
+    return text === "use server";
+}
+/** Returns true if the function body's first statement is `"use server"` directive. */
+function hasInlineUseServer(body) {
+    if (body.type !== "statement_block")
+        return false;
+    const first = body.namedChildren[0];
+    if (!first)
+        return false;
+    if (first.type !== "expression_statement")
+        return false;
+    const inner = first.namedChildren[0];
+    if (!inner || inner.type !== "string")
+        return false;
+    const text = inner.text.length >= 2 ? inner.text.slice(1, -1) : inner.text;
+    return text === "use server";
+}
+export function extractServerActionFunctions(tree, _source, file) {
+    const out = [];
+    const root = tree.rootNode;
+    const fileScope = hasFileScopeUseServer(tree);
+    if (fileScope) {
+        // All exported functions in this file are server actions.
+        for (const exp of root.descendantsOfType("export_statement")) {
+            // function_declaration form
+            for (const fn of exp.descendantsOfType("function_declaration")) {
+                // Skip nested function declarations
+                if (fn.parent?.id !== exp.id && fn.parent?.parent?.id !== exp.id)
+                    continue;
+                const name = fn.childForFieldName("name")?.text ?? "<anon>";
+                const isAsync = /\basync\b/.test(exp.text.split("function")[0] ?? "");
+                const body = fn.childForFieldName("body");
+                out.push({
+                    name,
+                    file,
+                    line: fn.startPosition.row + 1,
+                    isAsync,
+                    bodyNode: body ?? null,
+                    fnNode: fn,
+                });
+            }
+            // const x = async () => { ... }   OR   const x = wrap(async () => { ... })
+            for (const decl of exp.descendantsOfType("variable_declarator")) {
+                const name = decl.childForFieldName("name")?.text;
+                const value = decl.childForFieldName("value");
+                if (!name || !value)
+                    continue;
+                // Direct arrow / function_expression
+                if (value.type === "arrow_function" || value.type === "function_expression") {
+                    const isAsync = /^\s*async\b/.test(value.text);
+                    const body = value.childForFieldName("body");
+                    out.push({
+                        name,
+                        file,
+                        line: decl.startPosition.row + 1,
+                        isAsync,
+                        bodyNode: body ?? null,
+                        fnNode: value,
+                    });
+                }
+                else if (value.type === "call_expression") {
+                    // HOC wrapper: find the inner arrow/function expression argument.
+                    const args = value.childForFieldName("arguments") ?? value.namedChild(1);
+                    if (!args)
+                        continue;
+                    for (const arg of args.namedChildren) {
+                        if (arg.type === "arrow_function" || arg.type === "function_expression") {
+                            const isAsync = /^\s*async\b/.test(arg.text);
+                            const body = arg.childForFieldName("body");
+                            out.push({
+                                name,
+                                file,
+                                line: decl.startPosition.row + 1,
+                                isAsync,
+                                bodyNode: body && body.type === "statement_block" ? body : null,
+                                fnNode: arg,
+                            });
+                            break;
+                        }
+                    }
+                }
+            }
+        }
+        return out;
+    }
+    // No file-scope directive: walk all functions and find inline `"use server"`.
+    const allFns = [
+        ...root.descendantsOfType("function_declaration"),
+        ...root.descendantsOfType("arrow_function"),
+        ...root.descendantsOfType("function_expression"),
+    ];
+    for (const fn of allFns) {
+        const body = fn.childForFieldName("body");
+        if (!body || body.type !== "statement_block")
+            continue;
+        if (!hasInlineUseServer(body))
+            continue;
+        let name = "<anon>";
+        if (fn.type === "function_declaration") {
+            name = fn.childForFieldName("name")?.text ?? "<anon>";
+        }
+        else {
+            // Try to find enclosing variable_declarator for name
+            let p = fn.parent;
+            while (p) {
+                if (p.type === "variable_declarator") {
+                    name = p.childForFieldName("name")?.text ?? "<anon>";
+                    break;
+                }
+                p = p.parent;
+            }
+        }
+        const isAsync = /^\s*async\b/.test(fn.text);
+        out.push({
+            name,
+            file,
+            line: fn.startPosition.row + 1,
+            isAsync,
+            bodyNode: body,
+            fnNode: fn,
+        });
+    }
+    return out;
+}
+// ---------------------------------------------------------------------------
+// Auth guard detection (Task 15)
+// ---------------------------------------------------------------------------
+/** Default identifier set for auth detection. */
+const AUTH_CALL_NAMES = new Set([
+    "auth",
+    "getSession",
+    "getServerSession",
+    "currentUser",
+    "validateRequest",
+    "getAuth",
+    "getUser",
+]);
+const AUTH_HOC_NAMES = new Set(["withAuth", "requireAuth", "withSession"]);
+export function detectAuthGuard(fn) {
+    const body = fn.bodyNode;
+    // 0) HOC wrapper detection — if the function node is the argument of a known HOC wrapper.
+    let p = fn.fnNode.parent;
+    while (p) {
+        if (p.type === "call_expression") {
+            const callee = p.childForFieldName("function") ?? p.namedChild(0);
+            if (callee?.type === "identifier" && AUTH_HOC_NAMES.has(callee.text)) {
+                return { confidence: "medium", pattern: "hoc" };
+            }
+        }
+        p = p.parent;
+    }
+    if (!body) {
+        return { confidence: "none", pattern: "none" };
+    }
+    // 1) Look for direct auth call expressions inside body.
+    let firstAuthCall = null;
+    for (const call of body.descendantsOfType("call_expression")) {
+        const callee = call.childForFieldName("function") ?? call.namedChild(0);
+        if (callee?.type === "identifier" && AUTH_CALL_NAMES.has(callee.text)) {
+            firstAuthCall = { name: callee.text, line: call.startPosition.row + 1, node: call };
+            break;
+        }
+        // Member access like auth.protect()
+        if (callee?.type === "member_expression") {
+            const obj = callee.childForFieldName("object") ?? callee.namedChild(0);
+            const prop = callee.childForFieldName("property") ?? callee.namedChild(1);
+            if (obj?.type === "identifier" && AUTH_CALL_NAMES.has(obj.text)) {
+                firstAuthCall = {
+                    name: `${obj.text}.${prop?.text ?? ""}`,
+                    line: call.startPosition.row + 1,
+                    node: call,
+                };
+                break;
+            }
+        }
+    }
+    if (firstAuthCall) {
+        // Walk forward in body looking for if(!result)/throw/return within the next 5 statements.
+        const callLine = firstAuthCall.line;
+        const callIndex = firstAuthCall.node.endIndex;
+        let resultChecked = false;
+        for (const ifStmt of body.descendantsOfType("if_statement")) {
+            if (ifStmt.startIndex >= callIndex && ifStmt.startPosition.row <= callLine + 5) {
+                // Heuristic: any if-throw/return after the auth call counts as "checked"
+                const inner = ifStmt.text;
+                if (/throw|return\s|redirect/.test(inner)) {
+                    resultChecked = true;
+                    break;
+                }
+            }
+        }
+        // Also handle assignment + checked condition: if (!session) { ... }
+        if (!resultChecked) {
+            // Look for any assignment storing the call result, then a usage in if-condition
+            for (const decl of body.descendantsOfType("variable_declarator")) {
+                const value = decl.childForFieldName("value");
+                if (!value)
+                    continue;
+                // Skip assignments before the auth call
+                if (decl.startIndex < firstAuthCall.node.startIndex)
+                    continue;
+                const varName = decl.childForFieldName("name")?.text;
+                if (!varName)
+                    continue;
+                // Check for usage in subsequent if condition
+                for (const ifStmt of body.descendantsOfType("if_statement")) {
+                    if (ifStmt.startIndex < decl.endIndex)
+                        continue;
+                    const cond = ifStmt.childForFieldName("condition") ?? ifStmt.namedChild(0);
+                    if (cond && new RegExp(`\\b${varName}\\b`).test(cond.text)) {
+                        const inner = ifStmt.text;
+                        if (/throw|return\s|redirect/.test(inner)) {
+                            resultChecked = true;
+                            break;
+                        }
+                    }
+                }
+                if (resultChecked)
+                    break;
+            }
+        }
+        return {
+            confidence: resultChecked ? "high" : "medium",
+            pattern: "direct",
+            callsite: { name: firstAuthCall.name, line: firstAuthCall.line },
+        };
+    }
+    // 2) Comment-only mention as fallback (low).
+    const bodyText = body.text;
+    if (/(?:\/\/|\/\*)\s*[^*]*\b(auth|session|user|permission)/i.test(bodyText)) {
+        return { confidence: "low", pattern: "none" };
+    }
+    return { confidence: "none", pattern: "none" };
+}
+// ---------------------------------------------------------------------------
+// Input validation detection (Task 16)
+// ---------------------------------------------------------------------------
+export function detectInputValidation(fn, tree, source) {
+    const body = fn.bodyNode;
+    if (!body)
+        return { lib: "none", confidence: "high" };
+    // 1) Look for `.parse()` or `.safeParse()` call expressions on a Zod schema.
+    for (const call of body.descendantsOfType("call_expression")) {
+        const callee = call.childForFieldName("function") ?? call.namedChild(0);
+        if (callee?.type !== "member_expression")
+            continue;
+        const prop = callee.childForFieldName("property") ?? callee.namedChild(1);
+        if (prop?.type !== "property_identifier")
+            continue;
+        if (prop.text !== "parse" && prop.text !== "safeParse")
+            continue;
+        // Disambiguate Zod from other libs by inspecting the file for a Zod schema.
+        const zodShape = extractZodSchema(tree, source);
+        if (zodShape) {
+            return { lib: "zod", confidence: "high" };
+        }
+        // Fallback: at least the .parse() call indicates structured validation.
+        return { lib: "manual", confidence: "medium" };
+    }
+    // 2) Manual validation: count if-throw statements in the first 5 statements.
+    let manualCount = 0;
+    const stmts = body.namedChildren.slice(0, 5);
+    for (const s of stmts) {
+        if (s.type !== "if_statement")
+            continue;
+        if (/throw\b/.test(s.text))
+            manualCount++;
+    }
+    if (manualCount >= 1) {
+        return { lib: "manual", confidence: "medium" };
+    }
+    return { lib: "none", confidence: "high" };
+}
+// ---------------------------------------------------------------------------
+// Rate limiting detection (Task 16)
+// ---------------------------------------------------------------------------
+const RATE_LIMIT_PATTERNS = [
+    { regex: /\bratelimit\.limit\s*\(/, lib: "upstash" },
+    { regex: /\@upstash\/ratelimit/, lib: "upstash" },
+    { regex: /\bcreateRateLimiter\s*\(/, lib: "manual" },
+    { regex: /\brateLimit\s*\(/, lib: "manual" },
+    { regex: /\bnext\/rate-limit/, lib: "vercel" },
+];
+export function detectRateLimiting(fn, _tree, _source) {
+    const body = fn.bodyNode;
+    if (!body)
+        return { lib: "none", confidence: "high" };
+    const text = body.text;
+    for (const { regex, lib } of RATE_LIMIT_PATTERNS) {
+        if (regex.test(text)) {
+            return { lib, confidence: "high" };
+        }
+    }
+    return { lib: "none", confidence: "high" };
+}
+//# sourceMappingURL=nextjs-security-readers.js.map

package/dist/tools/nextjs-security-readers.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"nextjs-security-readers.js","sourceRoot":"","sources":["../../src/tools/nextjs-security-readers.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAGH,OAAO,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AAOtD,oFAAoF;AACpF,SAAS,qBAAqB,CAAC,IAAiB;IAC9C,MAAM,IAAI,GAAG,IAAI,CAAC,QAAQ,CAAC;IAC3B,MAAM,KAAK,GAAG,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC;IACpC,IAAI,CAAC,KAAK;QAAE,OAAO,KAAK,CAAC;IACzB,IAAI,KAAK,CAAC,IAAI,KAAK,sBAAsB;QAAE,OAAO,KAAK,CAAC;IACxD,MAAM,KAAK,GAAG,KAAK,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC;IACrC,IAAI,CAAC,KAAK;QAAE,OAAO,KAAK,CAAC;IACzB,IAAI,KAAK,CAAC,IAAI,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IAC1C,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC,MAAM,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC;IAC3E,OAAO,IAAI,KAAK,YAAY,CAAC;AAC/B,CAAC;AAED,uFAAuF;AACvF,SAAS,kBAAkB,CAAC,IAAuB;IACjD,IAAI,IAAI,CAAC,IAAI,KAAK,iBAAiB;QAAE,OAAO,KAAK,CAAC;IAClD,MAAM,KAAK,GAAG,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC;IACpC,IAAI,CAAC,KAAK;QAAE,OAAO,KAAK,CAAC;IACzB,IAAI,KAAK,CAAC,IAAI,KAAK,sBAAsB;QAAE,OAAO,KAAK,CAAC;IACxD,MAAM,KAAK,GAAG,KAAK,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC;IACrC,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,IAAI,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IACpD,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC,MAAM,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC;IAC3E,OAAO,IAAI,KAAK,YAAY,CAAC;AAC/B,CAAC;AAeD,MAAM,UAAU,4BAA4B,CAC1C,IAAiB,EACjB,OAAe,EACf,IAAY;IAEZ,MAAM,GAAG,GAAqB,EAAE,CAAC;IACjC,MAAM,IAAI,GAAG,IAAI,CAAC,QAAQ,CAAC;IAE3B,MAAM,SAAS,GAAG,qBAAqB,CAAC,IAAI,CAAC,CAAC;IAE9C,IAAI,SAAS,EAAE,CAAC;QACd,0DAA0D;QAC1D,KAAK,MAAM,GAAG,IAAI,IAAI,CAAC,iBAAiB,CAAC,kBAAkB,CAAC,EAAE,CAAC;YAC7D,4BAA4B;YAC5B,KAAK,MAAM,EAAE,IAAI,GAAG,CAAC,iBAAiB,CAAC,sBAAsB,CAAC,EAAE,CAAC;gBAC/D,oCAAoC;gBACpC,IAAI,EAAE,CAAC,MAAM,EAAE,EAAE,KAAK,GAAG,CAAC,EAAE,IAAI,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,EAAE,KAAK,GAAG,CAAC,EAAE;oBAAE,SAAS;gBAC3E,MAAM,IAAI,GAAG,EAAE,CAAC,iBAAiB,CAAC,MAAM,CAAC,EAAE,IAAI,IAAI,QAAQ,CAAC;gBAC5D,MAAM,OAAO,GAAG,WAAW,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;gBACtE,MAAM,IAAI,GAAG,EAAE,CAAC,iBAAiB,CAAC,MAAM,CAAC,CAAC;gBAC1C,GAAG,CAAC,IAAI,CAAC;oBACP,IAAI;oBACJ,IAAI;oBACJ,IAAI,EAAE,EAAE,CAAC,aAAa,CAAC,GAAG,GAAG,CAAC;oBAC9B,OAAO;oBACP,QAAQ,EAAE,IAAI,IAAI,IAAI;oBACtB,MAAM,EAAE,EAAE;iBACX,CAAC,CAAC;YACL,CAAC;YACD,2EAA2E;YAC3E,KAAK,MAAM,IAAI,IAAI,GAAG,CAAC,iBAAiB,CAAC,qBAAqB,CAAC,EAAE,CAAC;gBAChE,MAAM,IAAI,GAAG,IAAI,CAAC,iBAAiB,CAAC,MAAM,CAAC,EAAE,IAAI,CAAC;gBAClD,MAAM,KAAK,GAAG,IAAI,CAAC,iBAAiB,CAAC,OAAO,CAAC,CAAC;gBAC9C,IAAI,CAAC,IAAI,IAAI,CAAC,KAAK;oBAAE,SAAS;gBAC9B,qCAAqC;gBACrC,IAAI,KAAK,CAAC,IAAI,KAAK,gBAAgB,IAAI,KAAK,CAAC,IAAI,KAAK,qBAAqB,EAAE,CAAC;oBAC5E,MAAM,OAAO,GAAG,aAAa,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;oBAC/C,MAAM,IAAI,GAAG,KAAK,CAAC,iBAAiB,CAAC,MAAM,CAAC,CAAC;oBAC7C,GAAG,CAAC,IAAI,CAAC;wBACP,IAAI;wBACJ,IAAI;wBACJ,IAAI,EAAE,IAAI,CAAC,aAAa,CAAC,GAAG,GAAG,CAAC;wBAChC,OAAO;wBACP,QAAQ,EAAE,IAAI,IAAI,IAAI;wBACtB,MAAM,EAAE,KAAK;qBACd,CAAC,CAAC;gBACL,CAAC;qBAAM,IAAI,KAAK,CAAC,IAAI,KAAK,iBAAiB,EAAE,CAAC;oBAC5C,kEAAkE;oBAClE,MAAM,IAAI,GAAG,KAAK,CAAC,iBAAiB,CAAC,WAAW,CAAC,IAAI,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;oBACzE,IAAI,CAAC,IAAI;wBAAE,SAAS;oBACpB,KAAK,MAAM,GAAG,IAAI,IAAI,CAAC,aAAa,EAAE,CAAC;wBACrC,IAAI,GAAG,CAAC,IAAI,KAAK,gBAAgB,IAAI,GAAG,CAAC,IAAI,KAAK,qBAAqB,EAAE,CAAC;4BACxE,MAAM,OAAO,GAAG,aAAa,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;4BAC7C,MAAM,IAAI,GAAG,GAAG,CAAC,iBAAiB,CAAC,MAAM,CAAC,CAAC;4BAC3C,GAAG,CAAC,IAAI,CAAC;gCACP,IAAI;gCACJ,IAAI;gCACJ,IAAI,EAAE,IAAI,CAAC,aAAa,CAAC,GAAG,GAAG,CAAC;gCAChC,OAAO;gCACP,QAAQ,EAAE,IAAI,IAAI,IAAI,CAAC,IAAI,KAAK,iBAAiB,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI;gCAC/D,MAAM,EAAE,GAAG;6BACZ,CAAC,CAAC;4BACH,MAAM;wBACR,CAAC;oBACH,CAAC;gBACH,CAAC;YACH,CAAC;QACH,CAAC;QACD,OAAO,GAAG,CAAC;IACb,CAAC;IAED,8EAA8E;IAC9E,MAAM,MAAM,GAAwB;QAClC,GAAG,IAAI,CAAC,iBAAiB,CAAC,sBAAsB,CAAC;QACjD,GAAG,IAAI,CAAC,iBAAiB,CAAC,gBAAgB,CAAC;QAC3C,GAAG,IAAI,CAAC,iBAAiB,CAAC,qBAAqB,CAAC;KACjD,CAAC;IACF,KAAK,MAAM,EAAE,IAAI,MAAM,EAAE,CAAC;QACxB,MAAM,IAAI,GAAG,EAAE,CAAC,iBAAiB,CAAC,MAAM,CAAC,CAAC;QAC1C,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,IAAI,KAAK,iBAAiB;YAAE,SAAS;QACvD,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC;YAAE,SAAS;QAExC,IAAI,IAAI,GAAG,QAAQ,CAAC;QACpB,IAAI,EAAE,CAAC,IAAI,KAAK,sBAAsB,EAAE,CAAC;YACvC,IAAI,GAAG,EAAE,CAAC,iBAAiB,CAAC,MAAM,CAAC,EAAE,IAAI,IAAI,QAAQ,CAAC;QACxD,CAAC;aAAM,CAAC;YACN,qDAAqD;YACrD,IAAI,CAAC,GAA6B,EAAE,CAAC,MAAM,CAAC;YAC5C,OAAO,CAAC,EAAE,CAAC;gBACT,IAAI,CAAC,CAAC,IAAI,KAAK,qBAAqB,EAAE,CAAC;oBACrC,IAAI,GAAG,CAAC,CAAC,iBAAiB,CAAC,MAAM,CAAC,EAAE,IAAI,IAAI,QAAQ,CAAC;oBACrD,MAAM;gBACR,CAAC;gBACD,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC;YACf,CAAC;QACH,CAAC;QACD,MAAM,OAAO,GAAG,aAAa,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC;QAC5C,GAAG,CAAC,IAAI,CAAC;YACP,IAAI;YACJ,IAAI;YACJ,IAAI,EAAE,EAAE,CAAC,aAAa,CAAC,GAAG,GAAG,CAAC;YAC9B,OAAO;YACP,QAAQ,EAAE,IAAI;YACd,MAAM,EAAE,EAAE;SACX,CAAC,CAAC;IACL,CAAC;IAED,OAAO,GAAG,CAAC;AACb,CAAC;AAED,8EAA8E;AAC9E,iCAAiC;AACjC,8EAA8E;AAE9E,iDAAiD;AACjD,MAAM,eAAe,GAAG,IAAI,GAAG,CAAC;IAC9B,MAAM;IACN,YAAY;IACZ,kBAAkB;IAClB,aAAa;IACb,iBAAiB;IACjB,SAAS;IACT,SAAS;CACV,CAAC,CAAC;AAEH,MAAM,cAAc,GAAG,IAAI,GAAG,CAAC,CAAC,UAAU,EAAE,aAAa,EAAE,aAAa,CAAC,CAAC,CAAC;AAE3E,MAAM,UAAU,eAAe,CAAC,EAAkB;IAChD,MAAM,IAAI,GAAG,EAAE,CAAC,QAAQ,CAAC;IAEzB,0FAA0F;IAC1F,IAAI,CAAC,GAA6B,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC;IACnD,OAAO,CAAC,EAAE,CAAC;QACT,IAAI,CAAC,CAAC,IAAI,KAAK,iBAAiB,EAAE,CAAC;YACjC,MAAM,MAAM,GAAG,CAAC,CAAC,iBAAiB,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;YAClE,IAAI,MAAM,EAAE,IAAI,KAAK,YAAY,IAAI,cAAc,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;gBACrE,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;YAClD,CAAC;QACH,CAAC;QACD,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC;IACf,CAAC;IAED,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,OAAO,EAAE,UAAU,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC;IACjD,CAAC;IAED,wDAAwD;IACxD,IAAI,aAAa,GAAmE,IAAI,CAAC;IACzF,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,iBAAiB,CAAC,iBAAiB,CAAC,EAAE,CAAC;QAC7D,MAAM,MAAM,GAAG,IAAI,CAAC,iBAAiB,CAAC,UAAU,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;QACxE,IAAI,MAAM,EAAE,IAAI,KAAK,YAAY,IAAI,eAAe,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;YACtE,aAAa,GAAG,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,aAAa,CAAC,GAAG,GAAG,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;YACpF,MAAM;QACR,CAAC;QACD,oCAAoC;QACpC,IAAI,MAAM,EAAE,IAAI,KAAK,mBAAmB,EAAE,CAAC;YACzC,MAAM,GAAG,GAAG,MAAM,CAAC,iBAAiB,CAAC,QAAQ,CAAC,IAAI,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;YACvE,MAAM,IAAI,GAAG,MAAM,CAAC,iBAAiB,CAAC,UAAU,CAAC,IAAI,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;YAC1E,IAAI,GAAG,EAAE,IAAI,KAAK,YAAY,IAAI,eAAe,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;gBAChE,aAAa,GAAG;oBACd,IAAI,EAAE,GAAG,GAAG,CAAC,IAAI,IAAI,IAAI,EAAE,IAAI,IAAI,EAAE,EAAE;oBACvC,IAAI,EAAE,IAAI,CAAC,aAAa,CAAC,GAAG,GAAG,CAAC;oBAChC,IAAI,EAAE,IAAI;iBACX,CAAC;gBACF,MAAM;YACR,CAAC;QACH,CAAC;IACH,CAAC;IAED,IAAI,aAAa,EAAE,CAAC;QAClB,0FAA0F;QAC1F,MAAM,QAAQ,GAAG,aAAa,CAAC,IAAI,CAAC;QACpC,MAAM,SAAS,GAAG,aAAa,CAAC,IAAI,CAAC,QAAQ,CAAC;QAC9C,IAAI,aAAa,GAAG,KAAK,CAAC;QAC1B,KAAK,MAAM,MAAM,IAAI,IAAI,CAAC,iBAAiB,CAAC,cAAc,CAAC,EAAE,CAAC;YAC5D,IAAI,MAAM,CAAC,UAAU,IAAI,SAAS,IAAI,MAAM,CAAC,aAAa,CAAC,GAAG,IAAI,QAAQ,GAAG,CAAC,EAAE,CAAC;gBAC/E,yEAAyE;gBACzE,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC;gBAC1B,IAAI,yBAAyB,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;oBAC1C,aAAa,GAAG,IAAI,CAAC;oBACrB,MAAM;gBACR,CAAC;YACH,CAAC;QACH,CAAC;QACD,oEAAoE;QACpE,IAAI,CAAC,aAAa,EAAE,CAAC;YACnB,gFAAgF;YAChF,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,iBAAiB,CAAC,qBAAqB,CAAC,EAAE,CAAC;gBACjE,MAAM,KAAK,GAAG,IAAI,CAAC,iBAAiB,CAAC,OAAO,CAAC,CAAC;gBAC9C,IAAI,CAAC,KAAK;oBAAE,SAAS;gBACrB,wCAAwC;gBACxC,IAAI,IAAI,CAAC,UAAU,GAAG,aAAa,CAAC,IAAI,CAAC,UAAU;oBAAE,SAAS;gBAC9D,MAAM,OAAO,GAAG,IAAI,CAAC,iBAAiB,CAAC,MAAM,CAAC,EAAE,IAAI,CAAC;gBACrD,IAAI,CAAC,OAAO;oBAAE,SAAS;gBACvB,6CAA6C;gBAC7C,KAAK,MAAM,MAAM,IAAI,IAAI,CAAC,iBAAiB,CAAC,cAAc,CAAC,EAAE,CAAC;oBAC5D,IAAI,MAAM,CAAC,UAAU,GAAG,IAAI,CAAC,QAAQ;wBAAE,SAAS;oBAChD,MAAM,IAAI,GAAG,MAAM,CAAC,iBAAiB,CAAC,WAAW,CAAC,IAAI,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;oBAC3E,IAAI,IAAI,IAAI,IAAI,MAAM,CAAC,MAAM,OAAO,KAAK,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;wBAC3D,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC;wBAC1B,IAAI,yBAAyB,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;4BAC1C,aAAa,GAAG,IAAI,CAAC;4BACrB,MAAM;wBACR,CAAC;oBACH,CAAC;gBACH,CAAC;gBACD,IAAI,aAAa;oBAAE,MAAM;YAC3B,CAAC;QACH,CAAC;QAED,OAAO;YACL,UAAU,EAAE,aAAa,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ;YAC7C,OAAO,EAAE,QAAQ;YACjB,QAAQ,EAAE,EAAE,IAAI,EAAE,aAAa,CAAC,IAAI,EAAE,IAAI,EAAE,aAAa,CAAC,IAAI,EAAE;SACjE,CAAC;IACJ,CAAC;IAED,6CAA6C;IAC7C,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC;IAC3B,IAAI,wDAAwD,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC5E,OAAO,EAAE,UAAU,EAAE,KAAK,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC;IAChD,CAAC;IAED,OAAO,EAAE,UAAU,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC;AACjD,CAAC;AAED,8EAA8E;AAC9E,uCAAuC;AACvC,8EAA8E;AAE9E,MAAM,UAAU,qBAAqB,CACnC,EAAkB,EAClB,IAAiB,EACjB,MAAc;IAEd,MAAM,IAAI,GAAG,EAAE,CAAC,QAAQ,CAAC;IACzB,IAAI,CAAC,IAAI;QAAE,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,CAAC;IAEtD,6EAA6E;IAC7E,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,iBAAiB,CAAC,iBAAiB,CAAC,EAAE,CAAC;QAC7D,MAAM,MAAM,GAAG,IAAI,CAAC,iBAAiB,CAAC,UAAU,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;QACxE,IAAI,MAAM,EAAE,IAAI,KAAK,mBAAmB;YAAE,SAAS;QACnD,MAAM,IAAI,GAAG,MAAM,CAAC,iBAAiB,CAAC,UAAU,CAAC,IAAI,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;QAC1E,IAAI,IAAI,EAAE,IAAI,KAAK,qBAAqB;YAAE,SAAS;QACnD,IAAI,IAAI,CAAC,IAAI,KAAK,OAAO,IAAI,IAAI,CAAC,IAAI,KAAK,WAAW;YAAE,SAAS;QAEjE,4EAA4E;QAC5E,MAAM,QAAQ,GAAG,gBAAgB,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QAChD,IAAI,QAAQ,EAAE,CAAC;YACb,OAAO,EAAE,GAAG,EAAE,KAAK,EAAE,UAAU,EAAE,MAAM,EAAE,CAAC;QAC5C,CAAC;QACD,wEAAwE;QACxE,OAAO,EAAE,GAAG,EAAE,QAAQ,EAAE,UAAU,EAAE,QAAQ,EAAE,CAAC;IACjD,CAAC;IAED,6EAA6E;IAC7E,IAAI,WAAW,GAAG,CAAC,CAAC;IACpB,MAAM,KAAK,GAAG,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IAC7C,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;QACtB,IAAI,CAAC,CAAC,IAAI,KAAK,cAAc;YAAE,SAAS;QACxC,IAAI,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;YAAE,WAAW,EAAE,CAAC;IAC5C,CAAC;IACD,IAAI,WAAW,IAAI,CAAC,EAAE,CAAC;QACrB,OAAO,EAAE,GAAG,EAAE,QAAQ,EAAE,UAAU,EAAE,QAAQ,EAAE,CAAC;IACjD,CAAC;IAED,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,CAAC;AAC7C,CAAC;AAED,8EAA8E;AAC9E,oCAAoC;AACpC,8EAA8E;AAE9E,MAAM,mBAAmB,GAA2D;IAClF,EAAE,KAAK,EAAE,yBAAyB,EAAE,GAAG,EAAE,SAAS,EAAE;IACpD,EAAE,KAAK,EAAE,sBAAsB,EAAE,GAAG,EAAE,SAAS,EAAE;IACjD,EAAE,KAAK,EAAE,0BAA0B,EAAE,GAAG,EAAE,QAAQ,EAAE;IACpD,EAAE,KAAK,EAAE,kBAAkB,EAAE,GAAG,EAAE,QAAQ,EAAE;IAC5C,EAAE,KAAK,EAAE,oBAAoB,EAAE,GAAG,EAAE,QAAQ,EAAE;CAC/C,CAAC;AAEF,MAAM,UAAU,kBAAkB,CAChC,EAAkB,EAClB,KAAkB,EAClB,OAAe;IAEf,MAAM,IAAI,GAAG,EAAE,CAAC,QAAQ,CAAC;IACzB,IAAI,CAAC,IAAI;QAAE,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,CAAC;IACtD,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC;IAEvB,KAAK,MAAM,EAAE,KAAK,EAAE,GAAG,EAAE,IAAI,mBAAmB,EAAE,CAAC;QACjD,IAAI,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YACrB,OAAO,EAAE,GAAG,EAAE,UAAU,EAAE,MAAM,EAAE,CAAC;QACrC,CAAC;IACH,CAAC;IACD,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,CAAC;AAC7C,CAAC"}

package/dist/tools/nextjs-security-scoring.d.ts

@@ -0,0 +1,15 @@
+/**
+ * Pure scoring helpers for Server Actions security audit (T2).
+ *
+ * Takes per-check info objects (auth, validation, rate, error) and produces
+ * a numeric score 0-100, a grade bucket, and a list of top missing checks.
+ */
+import type { AuthGuardInfo, InputValidationInfo, RateLimitingInfo, ErrorHandlingInfo, SecurityScore } from "./nextjs-security-tools.js";
+export interface ServerActionAuditInput {
+    auth: AuthGuardInfo;
+    input_validation: InputValidationInfo;
+    rate_limiting: RateLimitingInfo;
+    error_handling: ErrorHandlingInfo;
+}
+export declare function scoreServerAction(audit: ServerActionAuditInput): SecurityScore;
+//# sourceMappingURL=nextjs-security-scoring.d.ts.map

package/dist/tools/nextjs-security-scoring.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"nextjs-security-scoring.d.ts","sourceRoot":"","sources":["../../src/tools/nextjs-security-scoring.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,EACV,aAAa,EACb,mBAAmB,EACnB,gBAAgB,EAChB,iBAAiB,EACjB,aAAa,EACd,MAAM,4BAA4B,CAAC;AAEpC,MAAM,WAAW,sBAAsB;IACrC,IAAI,EAAE,aAAa,CAAC;IACpB,gBAAgB,EAAE,mBAAmB,CAAC;IACtC,aAAa,EAAE,gBAAgB,CAAC;IAChC,cAAc,EAAE,iBAAiB,CAAC;CACnC;AAuBD,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,sBAAsB,GAAG,aAAa,CAsC9E"}

package/dist/tools/nextjs-security-scoring.js

@@ -0,0 +1,65 @@
+/**
+ * Pure scoring helpers for Server Actions security audit (T2).
+ *
+ * Takes per-check info objects (auth, validation, rate, error) and produces
+ * a numeric score 0-100, a grade bucket, and a list of top missing checks.
+ */
+const WEIGHTS = {
+    auth: 40,
+    input_validation: 30,
+    rate_limiting: 20,
+    error_handling: 10,
+};
+const CONFIDENCE_MULTIPLIER = {
+    high: 1.0,
+    medium: 0.5,
+    low: 0.2,
+    none: 0,
+};
+function gradeFor(score) {
+    if (score >= 90)
+        return "excellent";
+    if (score >= 70)
+        return "good";
+    if (score >= 40)
+        return "needs_work";
+    return "poor";
+}
+export function scoreServerAction(audit) {
+    // Auth: score from confidence multiplier
+    const authMult = CONFIDENCE_MULTIPLIER[audit.auth.confidence] ?? 0;
+    const authPoints = Math.round(WEIGHTS.auth * authMult);
+    // Input validation: zero unless lib != none
+    let validationMult = 0;
+    if (audit.input_validation.lib !== "none") {
+        validationMult = CONFIDENCE_MULTIPLIER[audit.input_validation.confidence] ?? 0;
+    }
+    const validationPoints = Math.round(WEIGHTS.input_validation * validationMult);
+    // Rate limiting: zero unless lib != none
+    let rateMult = 0;
+    if (audit.rate_limiting.lib !== "none") {
+        rateMult = CONFIDENCE_MULTIPLIER[audit.rate_limiting.confidence] ?? 0;
+    }
+    const ratePoints = Math.round(WEIGHTS.rate_limiting * rateMult);
+    // Error handling: try/catch present?
+    const errorPoints = audit.error_handling.has_try_catch
+        ? Math.round(WEIGHTS.error_handling * (CONFIDENCE_MULTIPLIER[audit.error_handling.confidence] ?? 0))
+        : 0;
+    const score = authPoints + validationPoints + ratePoints + errorPoints;
+    // Top missing list (highest weight first)
+    const top_missing = [];
+    if (authPoints < WEIGHTS.auth)
+        top_missing.push("auth");
+    if (validationPoints < WEIGHTS.input_validation)
+        top_missing.push("input_validation");
+    if (ratePoints < WEIGHTS.rate_limiting)
+        top_missing.push("rate_limiting");
+    if (errorPoints < WEIGHTS.error_handling)
+        top_missing.push("error_handling");
+    return {
+        score,
+        grade: gradeFor(score),
+        top_missing,
+    };
+}
+//# sourceMappingURL=nextjs-security-scoring.js.map

package/dist/tools/nextjs-security-scoring.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"nextjs-security-scoring.js","sourceRoot":"","sources":["../../src/tools/nextjs-security-scoring.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAiBH,MAAM,OAAO,GAAG;IACd,IAAI,EAAE,EAAE;IACR,gBAAgB,EAAE,EAAE;IACpB,aAAa,EAAE,EAAE;IACjB,cAAc,EAAE,EAAE;CACV,CAAC;AAEX,MAAM,qBAAqB,GAA2B;IACpD,IAAI,EAAE,GAAG;IACT,MAAM,EAAE,GAAG;IACX,GAAG,EAAE,GAAG;IACR,IAAI,EAAE,CAAC;CACR,CAAC;AAEF,SAAS,QAAQ,CAAC,KAAa;IAC7B,IAAI,KAAK,IAAI,EAAE;QAAE,OAAO,WAAW,CAAC;IACpC,IAAI,KAAK,IAAI,EAAE;QAAE,OAAO,MAAM,CAAC;IAC/B,IAAI,KAAK,IAAI,EAAE;QAAE,OAAO,YAAY,CAAC;IACrC,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,KAA6B;IAC7D,yCAAyC;IACzC,MAAM,QAAQ,GAAG,qBAAqB,CAAC,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;IACnE,MAAM,UAAU,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,GAAG,QAAQ,CAAC,CAAC;IAEvD,4CAA4C;IAC5C,IAAI,cAAc,GAAG,CAAC,CAAC;IACvB,IAAI,KAAK,CAAC,gBAAgB,CAAC,GAAG,KAAK,MAAM,EAAE,CAAC;QAC1C,cAAc,GAAG,qBAAqB,CAAC,KAAK,CAAC,gBAAgB,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;IACjF,CAAC;IACD,MAAM,gBAAgB,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,gBAAgB,GAAG,cAAc,CAAC,CAAC;IAE/E,yCAAyC;IACzC,IAAI,QAAQ,GAAG,CAAC,CAAC;IACjB,IAAI,KAAK,CAAC,aAAa,CAAC,GAAG,KAAK,MAAM,EAAE,CAAC;QACvC,QAAQ,GAAG,qBAAqB,CAAC,KAAK,CAAC,aAAa,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;IACxE,CAAC;IACD,MAAM,UAAU,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,aAAa,GAAG,QAAQ,CAAC,CAAC;IAEhE,qCAAqC;IACrC,MAAM,WAAW,GAAG,KAAK,CAAC,cAAc,CAAC,aAAa;QACpD,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,cAAc,GAAG,CAAC,qBAAqB,CAAC,KAAK,CAAC,cAAc,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC;QACpG,CAAC,CAAC,CAAC,CAAC;IAEN,MAAM,KAAK,GAAG,UAAU,GAAG,gBAAgB,GAAG,UAAU,GAAG,WAAW,CAAC;IAEvE,0CAA0C;IAC1C,MAAM,WAAW,GAAa,EAAE,CAAC;IACjC,IAAI,UAAU,GAAG,OAAO,CAAC,IAAI;QAAE,WAAW,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACxD,IAAI,gBAAgB,GAAG,OAAO,CAAC,gBAAgB;QAAE,WAAW,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC;IACtF,IAAI,UAAU,GAAG,OAAO,CAAC,aAAa;QAAE,WAAW,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;IAC1E,IAAI,WAAW,GAAG,OAAO,CAAC,cAAc;QAAE,WAAW,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;IAE7E,OAAO;QACL,KAAK;QACL,KAAK,EAAE,QAAQ,CAAC,KAAK,CAAC;QACtB,WAAW;KACZ,CAAC;AACJ,CAAC"}

package/dist/tools/nextjs-security-tools.d.ts

@@ -0,0 +1,75 @@
+/**
+ * Next.js Server Actions security audit (T2).
+ *
+ * Walks files containing `"use server"` (file-scope or inline) and audits each
+ * exported server action against four checks: authorization guards, input
+ * validation, rate limiting, and structured error handling. Per-action scoring
+ * follows a weighted formula (auth 40, validation 30, rate 20, error 10).
+ *
+ * This file is the public-facing entry point and types module. The reader and
+ * scoring helpers live in their own files (`nextjs-security-readers.ts` and
+ * `nextjs-security-scoring.ts`) per the 3-file split (D10).
+ */
+export type AuthConfidence = "high" | "medium" | "low" | "none";
+export type ValidationLib = "zod" | "manual" | "none";
+export type RateLimitLib = "upstash" | "vercel" | "express" | "manual" | "none";
+export interface AuthGuardInfo {
+    confidence: AuthConfidence;
+    pattern: "direct" | "hoc" | "none";
+    callsite?: {
+        name: string;
+        line: number;
+    };
+}
+export interface InputValidationInfo {
+    lib: ValidationLib;
+    confidence: "high" | "medium" | "low";
+}
+export interface RateLimitingInfo {
+    lib: RateLimitLib;
+    confidence: "high" | "medium" | "low";
+}
+export interface ErrorHandlingInfo {
+    has_try_catch: boolean;
+    confidence: "high" | "medium" | "low";
+}
+export interface ServerActionAudit {
+    name: string;
+    file: string;
+    line: number;
+    is_async: boolean;
+    auth: AuthGuardInfo;
+    input_validation: InputValidationInfo;
+    rate_limiting: RateLimitingInfo;
+    error_handling: ErrorHandlingInfo;
+    score: number;
+    grade: "poor" | "needs_work" | "good" | "excellent";
+    top_missing: string[];
+}
+export interface SecurityScore {
+    score: number;
+    grade: "poor" | "needs_work" | "good" | "excellent";
+    top_missing: string[];
+}
+export interface ServerActionsAuditCounts {
+    excellent: number;
+    good: number;
+    needs_work: number;
+    poor: number;
+}
+export interface ServerActionsAuditResult {
+    total: number;
+    actions: ServerActionAudit[];
+    counts: ServerActionsAuditCounts;
+    violations: string[];
+    parse_failures: string[];
+    scan_errors: string[];
+    workspaces_scanned: string[];
+    limitations: string[];
+}
+export interface NextjsAuditServerActionsOptions {
+    workspace?: string | undefined;
+    max_files?: number | undefined;
+}
+export declare function nextjsAuditServerActions(repo: string, options?: NextjsAuditServerActionsOptions): Promise<ServerActionsAuditResult>;
+//# sourceMappingURL=nextjs-security-tools.d.ts.map

package/dist/tools/nextjs-security-tools.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"nextjs-security-tools.d.ts","sourceRoot":"","sources":["../../src/tools/nextjs-security-tools.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAoBH,MAAM,MAAM,cAAc,GAAG,MAAM,GAAG,QAAQ,GAAG,KAAK,GAAG,MAAM,CAAC;AAEhE,MAAM,MAAM,aAAa,GAAG,KAAK,GAAG,QAAQ,GAAG,MAAM,CAAC;AAEtD,MAAM,MAAM,YAAY,GAAG,SAAS,GAAG,QAAQ,GAAG,SAAS,GAAG,QAAQ,GAAG,MAAM,CAAC;AAEhF,MAAM,WAAW,aAAa;IAC5B,UAAU,EAAE,cAAc,CAAC;IAC3B,OAAO,EAAE,QAAQ,GAAG,KAAK,GAAG,MAAM,CAAC;IACnC,QAAQ,CAAC,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC;CAC3C;AAED,MAAM,WAAW,mBAAmB;IAClC,GAAG,EAAE,aAAa,CAAC;IACnB,UAAU,EAAE,MAAM,GAAG,QAAQ,GAAG,KAAK,CAAC;CACvC;AAED,MAAM,WAAW,gBAAgB;IAC/B,GAAG,EAAE,YAAY,CAAC;IAClB,UAAU,EAAE,MAAM,GAAG,QAAQ,GAAG,KAAK,CAAC;CACvC;AAED,MAAM,WAAW,iBAAiB;IAChC,aAAa,EAAE,OAAO,CAAC;IACvB,UAAU,EAAE,MAAM,GAAG,QAAQ,GAAG,KAAK,CAAC;CACvC;AAED,MAAM,WAAW,iBAAiB;IAChC,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,OAAO,CAAC;IAClB,IAAI,EAAE,aAAa,CAAC;IACpB,gBAAgB,EAAE,mBAAmB,CAAC;IACtC,aAAa,EAAE,gBAAgB,CAAC;IAChC,cAAc,EAAE,iBAAiB,CAAC;IAClC,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,MAAM,GAAG,YAAY,GAAG,MAAM,GAAG,WAAW,CAAC;IACpD,WAAW,EAAE,MAAM,EAAE,CAAC;CACvB;AAED,MAAM,WAAW,aAAa;IAC5B,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,MAAM,GAAG,YAAY,GAAG,MAAM,GAAG,WAAW,CAAC;IACpD,WAAW,EAAE,MAAM,EAAE,CAAC;CACvB;AAED,MAAM,WAAW,wBAAwB;IACvC,SAAS,EAAE,MAAM,CAAC;IAClB,IAAI,EAAE,MAAM,CAAC;IACb,UAAU,EAAE,MAAM,CAAC;IACnB,IAAI,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,wBAAwB;IACvC,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,iBAAiB,EAAE,CAAC;IAC7B,MAAM,EAAE,wBAAwB,CAAC;IACjC,UAAU,EAAE,MAAM,EAAE,CAAC;IACrB,cAAc,EAAE,MAAM,EAAE,CAAC;IACzB,WAAW,EAAE,MAAM,EAAE,CAAC;IACtB,kBAAkB,EAAE,MAAM,EAAE,CAAC;IAC7B,WAAW,EAAE,MAAM,EAAE,CAAC;CACvB;AAED,MAAM,WAAW,+BAA+B;IAC9C,SAAS,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC/B,SAAS,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CAChC;AAiBD,wBAAsB,wBAAwB,CAC5C,IAAI,EAAE,MAAM,EACZ,OAAO,CAAC,EAAE,+BAA+B,GACxC,OAAO,CAAC,wBAAwB,CAAC,CA2HnC"}

package/dist/tools/nextjs-security-tools.js

@@ -0,0 +1,153 @@
+/**
+ * Next.js Server Actions security audit (T2).
+ *
+ * Walks files containing `"use server"` (file-scope or inline) and audits each
+ * exported server action against four checks: authorization guards, input
+ * validation, rate limiting, and structured error handling. Per-action scoring
+ * follows a weighted formula (auth 40, validation 30, rate 20, error 10).
+ *
+ * This file is the public-facing entry point and types module. The reader and
+ * scoring helpers live in their own files (`nextjs-security-readers.ts` and
+ * `nextjs-security-scoring.ts`) per the 3-file split (D10).
+ */
+import { readFile } from "node:fs/promises";
+import { join, relative } from "node:path";
+import { discoverWorkspaces } from "../utils/nextjs.js";
+import { cachedParseFile as parseFile } from "../utils/nextjs-audit-cache.js";
+import { cachedWalkDirectory as walkDirectory } from "../utils/nextjs-audit-cache.js";
+import { getCodeIndex } from "./index-tools.js";
+import { extractServerActionFunctions, detectAuthGuard, detectInputValidation, detectRateLimiting, } from "./nextjs-security-readers.js";
+import { scoreServerAction } from "./nextjs-security-scoring.js";
+// ---------------------------------------------------------------------------
+// Orchestrator (Task 18)
+// ---------------------------------------------------------------------------
+const ACTION_EXTS = new Set([".ts", ".tsx", ".js", ".jsx"]);
+const PARSE_CONCURRENCY = 10;
+const MAX_FILE_SIZE_BYTES = 2_097_152;
+const DEFAULT_MAX_FILES = 2000;
+/** Quick sniff: does the file mention `"use server"` directive at all? */
+function quickHasUseServer(source) {
+    // Cheap text check before invoking the parser.
+    return source.includes("use server");
+}
+export async function nextjsAuditServerActions(repo, options) {
+    if (process.env.CODESIFT_DISABLE_TOOLS?.includes("nextjs_audit_server_actions")) {
+        throw new Error("nextjs_audit_server_actions is disabled via CODESIFT_DISABLE_TOOLS");
+    }
+    const index = await getCodeIndex(repo);
+    if (!index) {
+        throw new Error(`Repository not found: ${repo}. Run index_folder first.`);
+    }
+    const projectRoot = index.root;
+    let workspaces;
+    if (options?.workspace) {
+        workspaces = [join(projectRoot, options.workspace)];
+    }
+    else {
+        const discovered = await discoverWorkspaces(projectRoot);
+        workspaces = discovered.length > 0 ? discovered.map((w) => w.root) : [projectRoot];
+    }
+    const maxFiles = options?.max_files ?? DEFAULT_MAX_FILES;
+    const actions = [];
+    const parse_failures = [];
+    const scan_errors = [];
+    const workspaces_scanned = [];
+    const violations = new Set();
+    for (const workspace of workspaces) {
+        workspaces_scanned.push(workspace);
+        const candidates = [];
+        for (const subdir of ["app", "src/app", "lib", "src/lib", "actions", "src/actions"]) {
+            const fullDir = join(workspace, subdir);
+            try {
+                const walked = await walkDirectory(fullDir, {
+                    followSymlinks: true,
+                    fileFilter: (ext) => ACTION_EXTS.has(ext),
+                    maxFileSize: MAX_FILE_SIZE_BYTES,
+                });
+                candidates.push(...walked);
+            }
+            catch (err) {
+                scan_errors.push(`${fullDir}: ${err instanceof Error ? err.message : String(err)}`);
+            }
+        }
+        const remaining = maxFiles - actions.length;
+        const toProcess = candidates.slice(0, Math.max(0, remaining));
+        for (let i = 0; i < toProcess.length; i += PARSE_CONCURRENCY) {
+            const chunk = toProcess.slice(i, i + PARSE_CONCURRENCY);
+            const results = await Promise.all(chunk.map(async (filePath) => {
+                const rel = relative(projectRoot, filePath);
+                try {
+                    const source = await readFile(filePath, "utf8");
+                    if (!quickHasUseServer(source))
+                        return null;
+                    const tree = await parseFile(filePath, source);
+                    if (!tree) {
+                        parse_failures.push(rel);
+                        return null;
+                    }
+                    const fns = extractServerActionFunctions(tree, source, rel);
+                    if (fns.length === 0)
+                        return null;
+                    return fns.map((fn) => {
+                        const auth = detectAuthGuard(fn);
+                        const input_validation = detectInputValidation(fn, tree, source);
+                        const rate_limiting = detectRateLimiting(fn, tree, source);
+                        const error_handling = {
+                            has_try_catch: fn.bodyNode ? /\btry\s*\{/.test(fn.bodyNode.text) : false,
+                            confidence: "high",
+                        };
+                        const score = scoreServerAction({ auth, input_validation, rate_limiting, error_handling });
+                        const audit = {
+                            name: fn.name,
+                            file: fn.file,
+                            line: fn.line,
+                            is_async: fn.isAsync,
+                            auth,
+                            input_validation,
+                            rate_limiting,
+                            error_handling,
+                            score: score.score,
+                            grade: score.grade,
+                            top_missing: score.top_missing,
+                        };
+                        for (const m of score.top_missing)
+                            violations.add(m);
+                        return audit;
+                    });
+                }
+                catch (err) {
+                    parse_failures.push(`${rel}: ${err instanceof Error ? err.message : String(err)}`);
+                    return null;
+                }
+            }));
+            for (const r of results) {
+                if (!r)
+                    continue;
+                actions.push(...r);
+            }
+        }
+    }
+    const counts = {
+        excellent: 0,
+        good: 0,
+        needs_work: 0,
+        poor: 0,
+    };
+    for (const a of actions) {
+        counts[a.grade]++;
+    }
+    return {
+        total: actions.length,
+        actions,
+        counts,
+        violations: [...violations],
+        parse_failures,
+        scan_errors,
+        workspaces_scanned,
+        limitations: [
+            "auth detection limited to default identifier set (auth, getSession, currentUser, etc.)",
+            "input validation detection currently Zod-only (Yup/Joi/TypeBox not detected)",
+        ],
+    };
+}
+//# sourceMappingURL=nextjs-security-tools.js.map