launchprep 0.0.1 → 0.1.0

package/src/checks-batch4.mjs

@@ -0,0 +1,529 @@
+// The last of the tier-1 checks.
+//
+// Discipline, same as everywhere else in this directory: read the value, not the
+// identifier. Judge the line, not a 200-character neighbourhood. Require evidence
+// that the thing is used the dangerous way before saying a word.
+
+const finding = (id, title, severity, file, line, detail, fix) =>
+  ({ id, title, severity, file, line, detail, fix });
+
+const lineOf = (t, i) => t.slice(0, i).split('\n').length;
+const lineAt = (t, i) => {
+  const a = t.lastIndexOf('\n', i) + 1;
+  const b = t.indexOf('\n', i);
+  return t.slice(a, b === -1 ? t.length : b);
+};
+// the whole call expression starting at i, bounded so we never judge a neighbour
+const callAt = (t, i, max = 260) => {
+  const open = t.indexOf('(', i);
+  if (open === -1) return t.slice(i, i + max);
+  let depth = 0;
+  for (let j = open; j < Math.min(t.length, open + max); j++) {
+    if (t[j] === '(') depth++;
+    else if (t[j] === ')' && --depth === 0) return t.slice(i, j + 1);
+  }
+  return t.slice(i, i + max);
+};
+const isJS = (p) => /\.(ts|tsx|js|jsx|mjs|cjs)$/.test(p);
+const isServer = (p) =>
+  /\/(api|routes?|server|actions?|controllers?|handlers?|jobs?|workers?|lib|services?)\//.test(p);
+
+// union of every manifest in the repo - monorepos keep the root one empty
+const depNames = (repo) => {
+  const names = new Set();
+  for (const f of repo.find(/(^|\/)package\.json$/)) {
+    try {
+      const m = JSON.parse(f.text || '');
+      for (const k of Object.keys({ ...m.dependencies, ...m.devDependencies })) names.add(k);
+    } catch {}
+  }
+  for (const f of repo.find(/requirements.*\.txt$|(^|\/)(Gemfile|pyproject\.toml)$/))
+    (f.text || '').split('\n').forEach(l => {
+      const m = l.match(/^\s*(?:gem\s+['"])?([A-Za-z0-9_.-]+)/);
+      if (m) names.add(m[1].toLowerCase());
+    });
+  return names;
+};
+const anyText = (repo, pathRe) =>
+  repo.files.filter(f => f.text && pathRe.test(f.path)).map(f => f.text).join('\n');
+
+export const BATCH4_CHECKS = [
+
+// ── DATA-003 ────────────────────────────────────────────────────────────────
+// Postgres does NOT index a foreign key column. It indexes primary keys and
+// unique constraints and nothing else. Every join through an unindexed FK is a
+// sequential scan that is invisible at 100 rows and fatal at 100,000.
+{ id: 'DATA-003', run(repo, profile) {
+    const db = profile.stack?.database;
+    if (!['postgres', 'supabase', 'mysql', 'planetscale'].includes(db)) return [];
+    const out = [];
+
+    // ---- Prisma ----
+    // Coverage is per MODEL. An @@index([scheduleId]) on Booking says nothing
+    // about Host.scheduleId. And one finding per schema, not one per relation:
+    // cal.com has 23 uncovered columns across 147 relation declarations, and
+    // reporting each occurrence produced 605 findings nobody would ever read.
+    for (const f of repo.find(/\.prisma$/)) {
+      const t = f.text; if (!t) continue;
+      if (/provider\s*=\s*"mysql"/.test(t)) continue;   // MySQL indexes FKs itself
+      const cols = []; let firstAt = 0, total = 0;
+      const models = /model\s+\w+\s*\{([\s\S]*?)\n\}/g;
+      let mm;
+      while ((mm = models.exec(t))) {
+        const body = mm[1], base = mm.index;
+        const indexed = new Set();
+        let m;
+        const idx = /@@(?:index|unique|id)\s*\(\s*\[\s*([A-Za-z0-9_]+)/g;
+        while ((m = idx.exec(body))) indexed.add(m[1]);
+        const inline = /^\s*([A-Za-z0-9_]+)\s+\S+.*@(?:id|unique)\b/gm;
+        while ((m = inline.exec(body))) indexed.add(m[1]);
+        const rel = /@relation\s*\([^)]*fields:\s*\[\s*([A-Za-z0-9_,\s]+?)\s*\]/g;
+        while ((m = rel.exec(body))) {
+          const lead = m[1].split(',')[0].trim();
+          if (!lead || indexed.has(lead)) continue;
+          if (!total) firstAt = base + m.index;
+          total++;
+          if (!cols.includes(lead)) cols.push(lead);
+        }
+      }
+      if (!total) continue;
+      const eg = cols.slice(0, 4).join(', ') + (cols.length > 4 ? `, and ${cols.length - 4} more` : '');
+      out.push(finding('DATA-003',
+        `${total} foreign key${total === 1 ? '' : 's'} in this schema ${total === 1 ? 'has' : 'have'} no index`,
+        'high', f.path, lineOf(t, firstAt),
+        `Postgres indexes primary keys and unique columns — never foreign keys. Every query that joins or filters on ${eg} reads the whole table. At a hundred rows nobody notices; at a hundred thousand everything is slow at once, and the code never changed.`,
+        `Add @@index([column]) for each — start with ${cols[0]}.`));
+    }
+
+    // ---- raw SQL ----
+    // Only when there is no Prisma schema. A Prisma project's migrations are
+    // GENERATED from the schema - they are a historical log, and every one that
+    // ever created a table would report again. That was 240 findings in the
+    // audit corpus for six repositories.
+    const sql = repo.find(/\.sql$/).filter(f => f.text);
+    if (sql.length && !repo.has(/\.prisma$/)) {
+      const indexed = new Set();
+      for (const f of sql) {
+        let m;
+        const ci = /CREATE\s+(?:UNIQUE\s+)?INDEX[^(]*\(\s*"?([A-Za-z0-9_]+)/gi;
+        while ((m = ci.exec(f.text))) indexed.add(m[1].toLowerCase());
+        const pk = /(?:PRIMARY\s+KEY|UNIQUE)\s*\(\s*"?([A-Za-z0-9_]+)/gi;
+        while ((m = pk.exec(f.text))) indexed.add(m[1].toLowerCase());
+      }
+      // one finding for the schema, not one per migration
+      const cols = []; let total = 0, at = null;
+      for (const f of sql) {
+        let m;
+        const fk = /(?:FOREIGN\s+KEY\s*\(\s*"?([A-Za-z0-9_]+)"?\s*\)|^\s*"?([A-Za-z0-9_]+)"?\s+[A-Za-z]+[^,\n]*\bREFERENCES\b)/gim;
+        while ((m = fk.exec(f.text))) {
+          const col = (m[1] || m[2] || '').toLowerCase();
+          if (!col || indexed.has(col) || cols.includes(col)) continue;
+          if (!at) at = { path: f.path, line: lineOf(f.text, m.index) };
+          total++; cols.push(col);
+        }
+      }
+      if (at) out.push(finding('DATA-003',
+        `${total} foreign key${total === 1 ? '' : 's'} with no index`, 'high',
+        at.path, at.line,
+        `Postgres never indexes a foreign key for you. Joins and cascading deletes through ${cols.slice(0, 3).join(', ')} scan the entire table.`,
+        `CREATE INDEX ON the table (${cols[0]});`));
+    }
+    return out;
+  }},
+
+// ── TEN-002 ─────────────────────────────────────────────────────────────────
+// An index on (created_at, tenant_id) does not help a query filtered by tenant.
+// Only the LEADING column of an index is usable on its own.
+{ id: 'TEN-002', run(repo, profile) {
+    if (profile.tenancy !== 'multi-tenant-shared-db') return [];
+    const TENANT = /^(tenant_?id|org(?:anization)?_?id|workspace_?id|account_?id|company_?id|team_?id)$/i;
+    const out = [];
+    for (const f of repo.find(/\.(sql|prisma)$/)) {
+      const t = f.text; if (!t) continue;
+      // does a tenant column exist at all?
+      let col = null, at = 0, m;
+      const decl = /^\s*"?([A-Za-z0-9_]+)"?\s+(?:String|Int|BigInt|uuid|UUID|text|varchar|integer|bigint)/gmi;
+      while ((m = decl.exec(t))) if (TENANT.test(m[1])) { col = m[1]; at = m.index; break; }
+      if (!col) continue;
+      // is it the leading column of ANY index?
+      const leads = new Set();
+      const idx = /(?:@@(?:index|unique)\s*\(\s*\[\s*|CREATE\s+(?:UNIQUE\s+)?INDEX[^(]*\(\s*"?)([A-Za-z0-9_]+)/gi;
+      while ((m = idx.exec(t))) leads.add(m[1].toLowerCase());
+      if (leads.has(col.toLowerCase())) continue;
+      out.push(finding('TEN-002', `No index leads with ${col}`, 'medium',
+        f.path, lineOf(t, at),
+        `Every query in a shared-database product filters by ${col} first. Only the first column of an index can be used on its own, so an index on anything else does not help — each customer's page load reads every customer's rows.`,
+        `Add a composite index that starts with ${col}, e.g. (${col}, created_at).`));
+    }
+    return out;
+  }},
+
+// ── RU-006 ──────────────────────────────────────────────────────────────────
+// MySQL's "utf8" is utf8mb3 - three bytes, which cannot hold an emoji.
+{ id: 'RU-006', run(repo, profile) {
+    if (!profile.stack || profile.stack.database === 'none') return [];
+    const out = [];
+    const BAD = /(?:DEFAULT\s+CHARSET\s*=\s*|CHARACTER\s+SET\s+|charset:\s*|encoding:\s*)utf8(?!mb4)\b|COLLATE\s*=?\s*utf8_(?!mb4)/gi;
+    for (const f of repo.files) {
+      const t = f.text;
+      if (!t || !/\.(sql|ya?ml|cnf|ini|toml)$/.test(f.path)) continue;
+      let m; BAD.lastIndex = 0;
+      while ((m = BAD.exec(t))) {
+        out.push(finding('RU-006', 'Text columns cannot store emoji', 'high',
+          f.path, lineOf(t, m.index),
+          "MySQL's \"utf8\" is three bytes per character, which is not enough for an emoji, and not enough for a good deal of Chinese, Japanese and Korean. Saving a name with an emoji in it does not truncate — it throws, and the request fails.",
+          'Use utf8mb4 and collation utf8mb4_unicode_ci. Existing tables need converting, not just the default.'));
+        break;   // one per file is the point; the fix is the same everywhere
+      }
+    }
+    return out;
+  }},
+
+// ── MOB-004 ─────────────────────────────────────────────────────────────────
+{ id: 'MOB-004', run(repo, profile) {
+    const s = profile.surface;
+    if (!['mobile-ios', 'mobile-android'].includes(s)) return [];
+    const out = [];
+
+    if (s === 'mobile-ios') {
+      const plists = repo.find(/Info\.plist$/);
+      const plist = plists.map(f => f.text || '').join('\n');
+      if (!plists.length) return [];
+      const NEEDS = [
+        [/AVCaptureDevice|UIImagePickerController|\.camera\b/, 'NSCameraUsageDescription', 'the camera'],
+        [/CLLocationManager|requestWhenInUseAuthorization/, 'NSLocationWhenInUseUsageDescription', 'location'],
+        [/PHPhotoLibrary|PHPickerViewController/, 'NSPhotoLibraryUsageDescription', 'the photo library'],
+        [/AVAudioSession|AVAudioRecorder|requestRecordPermission/, 'NSMicrophoneUsageDescription', 'the microphone'],
+        [/CNContactStore/, 'NSContactsUsageDescription', 'contacts'],
+      ];
+      const code = anyText(repo, /\.(swift|m|mm|h)$/);
+      for (const [use, key, human] of NEEDS) {
+        if (!use.test(code) || plist.includes(key)) continue;
+        out.push(finding('MOB-004', `Uses ${human} with no ${key}`, 'high',
+          plists[0].path, 1,
+          `iOS kills the app the instant it asks for ${human} without a usage string, and App Review rejects the build before that. This is not a warning — the submission is refused.`,
+          `Add <key>${key}</key> to Info.plist with one plain sentence saying why you need it.`));
+      }
+      return out;
+    }
+
+    // Android: a dangerous permission declared but never requested at runtime
+    const manifests = repo.find(/AndroidManifest\.xml$/);
+    if (!manifests.length) return [];
+    const code = anyText(repo, /\.(kt|java)$/);
+    const requestsAtRuntime =
+      /requestPermissions|ActivityResultContracts\.RequestPermission|shouldShowRequestPermissionRationale|Manifest\.permission\./.test(code);
+    if (requestsAtRuntime) return [];
+    const DANGEROUS = /android\.permission\.(CAMERA|ACCESS_FINE_LOCATION|ACCESS_COARSE_LOCATION|RECORD_AUDIO|READ_CONTACTS|READ_EXTERNAL_STORAGE)/;
+    for (const f of manifests) {
+      const m = (f.text || '').match(DANGEROUS);
+      if (!m) continue;
+      out.push(finding('MOB-004', `${m[1]} declared but never requested`, 'high',
+        f.path, lineOf(f.text, f.text.indexOf(m[0])),
+        `Since Android 6 a manifest entry only makes a permission askable — it does not grant it. The first call throws SecurityException and the app crashes, on every device, every time.`,
+        'Request it at runtime and handle the refusal before you use the feature.'));
+      break;
+    }
+    return out;
+  }},
+
+// ── UP-008 ──────────────────────────────────────────────────────────────────
+// sharp and PIL both drop metadata by default, so their presence is the fix.
+// This only fires when the raw bytes go straight to storage.
+{ id: 'UP-008', run(repo, profile) {
+    if (!profile.has_file_uploads || profile.data_sensitivity === 'none') return [];
+    const deps = depNames(repo);
+    const STRIPPERS = ['sharp', 'jimp', 'pillow', 'PIL', 'imagemagick', 'exifr',
+      'piexifjs', 'exif-be-gone', 'image-size', 'squoosh', 'mini-svg-data-uri'];
+    if (STRIPPERS.some(d => deps.has(d))) return [];
+    const code = anyText(repo, /\.(ts|tsx|js|jsx|mjs|py|rb|php)$/);
+    if (/sharp\(|Image\.open|MiniMagick|exiftool|-strip|withoutMetadata|piexif/.test(code)) return [];
+
+    // does it actually accept a format that carries GPS?
+    for (const f of repo.files) {
+      const t = f.text;
+      if (!t || !/\.(ts|tsx|js|jsx|mjs|py|rb|php)$/.test(f.path)) continue;
+      const m = t.match(/(?:image\/jpe?g|image\/heic|\.jpe?g['"]|\.heic['"])/i);
+      if (!m) continue;
+      if (!/upload|multer|putObject|createReadStream|\.save\(|storage/i.test(t)) continue;
+      return [finding('UP-008', 'Photo uploads keep their GPS coordinates', 'medium',
+        f.path, lineOf(t, t.indexOf(m[0])),
+        'A photo taken on a phone carries the exact place and time it was taken. Stored and served as-is, anyone who downloads a user\'s picture learns where they live.',
+        'Run uploads through sharp — it drops metadata by default — or strip EXIF before writing.')];
+    }
+    return [];
+  }},
+
+// ── API-010 ─────────────────────────────────────────────────────────────────
+// Neither fetch nor python-requests has a default timeout. Nothing times out.
+{ id: 'API-010', run(repo, profile) {
+    if (profile.stage !== 'production') return [];
+    const out = [];
+    for (const f of repo.files) {
+      const t = f.text; if (!t) continue;
+      const py = /\.py$/.test(f.path);
+      if (!py && !(isJS(f.path) && isServer(f.path))) continue;
+
+      const re = py
+        ? /\brequests\.(?:get|post|put|patch|delete)\s*\(/g
+        : /\b(?:fetch|axios(?:\.(?:get|post|put|patch|delete))?)\s*\(/g;
+      let m;
+      while ((m = re.exec(t))) {
+        const call = callAt(t, m.index);
+        // only outbound: an absolute URL or an env-var base. A relative path is
+        // this app talking to itself and is somebody else's problem.
+        if (!/https?:\/\/|process\.env\.|os\.environ|_URL\b|_ENDPOINT\b|BASE_URL/.test(call)) continue;
+        if (/timeout|AbortSignal|signal\s*:|AbortController/.test(call)) continue;
+        out.push(finding('API-010', 'Outbound call with no timeout', 'medium',
+          f.path, lineOf(t, m.index),
+          'Neither fetch nor requests times out on its own. If the other end stops answering — not refuses, just stops — this waits forever, and so does the user, and so does the worker handling their request.',
+          py ? 'Pass timeout=10 to every requests call.'
+             : 'Pass signal: AbortSignal.timeout(10_000), or timeout: 10000 for axios.'));
+      }
+    }
+    return out;
+  }},
+
+// ── AIOP-016 ────────────────────────────────────────────────────────────────
+{ id: 'AIOP-016', run(repo, profile) {
+    if (!profile.calls_llm) return [];
+    const out = [];
+    for (const f of repo.files) {
+      const t = f.text; if (!t || !isJS(f.path) && !/\.py$/.test(f.path)) continue;
+      if (!/anthropic|openai|Anthropic\(|OpenAI\(|messages\.create|chat\.completions/i.test(t)) continue;
+      // \b matters: without it, axiosResponse.body matches on its trailing 'e'
+      const re = /\b(?:e|err|error|ex)\.(?:message|response|body|detail)\b/g;
+      let m;
+      while ((m = re.exec(t))) {
+        const line = lineAt(t, m.index);
+        if (/console\.|logger\.|log\(|logging\.|capture|Sentry/.test(line)) continue;  // logging is right
+        if (!/(res\.|Response\.json|json\(|send\(|return\s*\{|jsonify|content\s*:|message\s*:)/.test(line)) continue;
+        out.push(finding('AIOP-016', 'The provider\'s error text is shown to the user', 'medium',
+          f.path, lineOf(t, m.index),
+          'Provider errors name the model, your organisation id, your rate limits and sometimes your account tier. Your user sees your bill, and a stranger learns which vendor to attack.',
+          'Log the real error, show the user one sentence and a reference id.'));
+      }
+    }
+    return out;
+  }},
+
+// ── NEXT-010 ────────────────────────────────────────────────────────────────
+{ id: 'NEXT-010', run(repo, profile) {
+    if (profile.stack?.framework !== 'next' || !profile.calls_llm) return [];
+    const out = [];
+    for (const f of repo.find(/app\/.*\/route\.(ts|js)$|pages\/api\/.*\.(ts|js)$/)) {
+      const t = f.text; if (!t) continue;
+      if (!/messages\.create|chat\.completions|generateText|streamText|anthropic|openai/i.test(t)) continue;
+      // Two routers, two spellings. App Router exports maxDuration/runtime at the
+      // top level; Pages Router puts them inside `export const config = {...}`.
+      // Only handling the first flagged 77 supabase routes that WERE configured.
+      if (/export\s+const\s+(?:maxDuration|runtime|config)\b/.test(t)) continue;
+      if (/\b(?:maxDuration|runtime)\s*:/.test(t)) continue;
+      out.push(finding('NEXT-010', 'Model call in a route with the default timeout', 'medium',
+        f.path, 1,
+        'A serverless function is killed at its default limit — ten seconds on most plans. A model answering a real question routinely takes longer, so the request dies mid-sentence and the user sees a blank failure. You are still billed for the tokens.',
+        "Add  export const maxDuration = 60  to this file, or stream the response."));
+    }
+    return out;
+  }},
+
+// ── NEXT-012 ────────────────────────────────────────────────────────────────
+{ id: 'NEXT-012', run(repo, profile) {
+    if (profile.stack?.framework !== 'next') return [];
+    const out = [];
+    for (const f of repo.find(/(^|\/)app\/.*page\.(tsx|jsx|ts|js)$/)) {
+      const t = f.text; if (!t) continue;
+      if (!/export\s+default\s+async\s+function|await\s+(?:fetch|db|prisma|sql|supabase)/.test(t)) continue;
+      if (/<Suspense/.test(t)) continue;
+      const dir = f.path.replace(/[^/]+$/, '');
+      if (repo.files.some(x => x.path.startsWith(dir) && /loading\.(tsx|jsx|ts|js)$/.test(x.path))) continue;
+      out.push(finding('NEXT-012', 'Nothing shown while this page loads its data', 'low',
+        f.path, 1,
+        'The browser stays on the previous page with no sign anything happened. On a slow connection people press the link again, or decide it is broken and leave.',
+        `Add loading.tsx next to this file, or wrap the data part in <Suspense>.`));
+    }
+    return out;
+  }},
+
+// ── INF-002 ─────────────────────────────────────────────────────────────────
+{ id: 'INF-002', run(repo, profile) {
+    if (profile.stage !== 'production') return [];
+    if (!['vps', 'aws', 'gcp'].includes(profile.stack?.host)) return [];
+    const out = [];
+    for (const f of repo.find(/docker-compose.*\.ya?ml$/)) {
+      const t = f.text; if (!t) continue;
+      if (/restart\s*:/.test(t) && /healthcheck\s*:/.test(t)) continue;
+      const missing = [!/restart\s*:/.test(t) && 'no restart policy',
+                       !/healthcheck\s*:/.test(t) && 'no healthcheck'].filter(Boolean);
+      out.push(finding('INF-002', `Containers have ${missing.join(' and ')}`, 'medium',
+        f.path, 1,
+        'On your own server nothing brings the app back. It crashes at three in the morning, stays down until you notice, and no page anywhere says so.',
+        'Add  restart: unless-stopped  and a healthcheck to each service.'));
+    }
+    for (const f of repo.find(/\.service$/)) {
+      const t = f.text; if (!t || !/\[Service\]/.test(t) || /Restart\s*=/.test(t)) continue;
+      out.push(finding('INF-002', 'systemd will not restart this service', 'medium',
+        f.path, lineOf(t, t.indexOf('[Service]')),
+        'Without a Restart directive systemd starts the process once. If it exits — a bad deploy, an out-of-memory kill — it stays exited.',
+        'Add  Restart=always  and  RestartSec=5  under [Service].'));
+    }
+    return out;
+  }},
+
+// ── OBS-003 ─────────────────────────────────────────────────────────────────
+{ id: 'OBS-003', run(repo, profile) {
+    if (!['pre-launch', 'production'].includes(profile.stage)) return [];
+    if (profile.business_model === 'internal-tool') return [];
+    const deps = depNames(repo);
+    const LIBS = ['posthog-js', 'posthog-node', '@vercel/analytics', 'plausible-tracker',
+      'mixpanel', 'mixpanel-browser', '@amplitude/analytics-browser', 'analytics',
+      '@segment/analytics-next', 'fathom-client', 'umami', 'react-ga4'];
+    if (LIBS.some(d => deps.has(d))) return [];
+    const html = anyText(repo, /\.(html|tsx|jsx|erb|vue|svelte)$/);
+    if (/googletagmanager|gtag\(|plausible\.io|umami\.|posthog|matomo|fathom/i.test(html)) return [];
+    const anchor = repo.files.find(f => f.text && /(^|\/)package\.json$/.test(f.path));
+    if (!anchor) return [];
+    return [finding('OBS-003', 'Nothing measures whether anyone uses this', 'low',
+      anchor.path, 1,
+      'You will be able to see that people signed up and not what they did next — which page they left from, which feature nobody opened. Every decision after launch becomes a guess.',
+      'Add one privacy-friendly analytics tool. Plausible and Umami need no cookie banner.')];
+  }},
+
+// ── UX-006 ──────────────────────────────────────────────────────────────────
+{ id: 'UX-006', run(repo, profile) {
+    if (!profile.is_public || profile.surface !== 'web-site') return [];
+    // the sharp version of this bug: a staging robots.txt shipped to production
+    for (const f of repo.find(/(^|\/)robots\.txt$/)) {
+      const t = f.text || '';
+      if (/^\s*Disallow:\s*\/\s*$/mi.test(t) && !/^\s*Allow:/mi.test(t)) {
+        return [finding('UX-006', 'robots.txt hides the whole site from search', 'low',
+          f.path, lineOf(t, t.search(/^\s*Disallow:\s*\/\s*$/mi)),
+          'Disallow: / tells every search engine to index nothing. This is almost always a staging file that reached production, and the site simply never appears in Google.',
+          'Remove the blanket Disallow, or scope it to the paths you actually want hidden.')];
+      }
+    }
+    if (repo.has(/(^|\/)sitemap.*\.xml$/) || repo.has(/(^|\/)(app|src)\/sitemap\.(ts|js)$/)) return [];
+    const anchor = repo.files.find(f => /(^|\/)(index\.html|package\.json)$/.test(f.path));
+    if (!anchor) return [];
+    return [finding('UX-006', 'No sitemap', 'low',
+      anchor.path, 1,
+      'Search engines find pages by following links. Anything not linked from your home page may never be discovered at all.',
+      'Add a sitemap.xml, or app/sitemap.ts if you are on Next.')];
+  }},
+
+// ── LEG-003 ─────────────────────────────────────────────────────────────────
+{ id: 'LEG-003', run(repo, profile) {
+    if (!profile.is_public || !profile.has_accounts) return [];
+    if (repo.has(/terms|\/tos[./]|conditions/i)) return [];
+    if (repo.grep(/terms of (?:service|use)/i, /\.(tsx|jsx|html|erb|md|vue|svelte)$/).length) return [];
+    return [finding('LEG-003', 'People can create accounts with no terms', 'medium',
+      'terms of service', 1,
+      'The terms are what let you close an abusive account, cap what you owe when something breaks, and say the service can change. Without them every one of those is arguable.',
+      'Publish terms and link them from the sign-up form, not just the footer.')];
+  }},
+
+// ── LEG-006 ─────────────────────────────────────────────────────────────────
+// alt="" is CORRECT for decoration. Only a missing attribute is a failure.
+{ id: 'LEG-006', run(repo, profile) {
+    if (!['web-app', 'web-site'].includes(profile.surface) || !profile.is_public) return [];
+    const out = [];
+    for (const f of repo.files) {
+      const t = f.text;
+      if (!t || !/\.(html|htm|tsx|jsx|erb|vue|svelte)$/.test(f.path)) continue;
+      const re = /<img\b[^>]*>/gi;
+      let m;
+      while ((m = re.exec(t))) {
+        const tag = m[0];
+        if (/\balt\s*=/.test(tag) || /\baria-hidden\s*=\s*["'{]?true/.test(tag)) continue;
+        out.push(finding('LEG-006', 'Image with no alt attribute', 'medium',
+          f.path, lineOf(t, m.index),
+          'A screen reader reads the file name instead, which tells a blind visitor nothing. In the US and Australia this is the single most commonly litigated accessibility failure, and the fix is one attribute.',
+          'Add alt="what the image shows". For purely decorative images use alt="" — empty is correct, missing is not.'));
+      }
+    }
+    return out;
+  }},
+
+// ── DEP-016 ─────────────────────────────────────────────────────────────────
+// "Gating merges" means running on pull_request. A push-only workflow tells you
+// about the breakage after it is already on main.
+{ id: 'DEP-016', run(repo, profile) {
+    if (!profile.has_ci) return [];
+    if (!['b2b-saas', 'marketplace'].includes(profile.business_model)) return [];
+    const wf = repo.find(/\.github\/workflows\/.*\.ya?ml$/);
+    if (!wf.length) return [];
+    const runsTests = wf.some(f => /\b(?:test|jest|vitest|pytest|rspec|go test|cargo test)\b/i.test(f.text || ''));
+    if (!runsTests) return [];
+    if (wf.some(f => /pull_request/.test(f.text || ''))) return [];
+    return [finding('DEP-016', 'CI runs after the merge, not before it', 'low',
+      wf[0].path, 1,
+      'These workflows trigger on push only. The tests do run — but they run once the broken code is already on main, so nothing was ever stopped from landing.',
+      'Add  pull_request:  to the on: trigger, then make the check required in branch protection.')];
+  }},
+
+// ── AIOP-020 ────────────────────────────────────────────────────────────────
+// The rule was written as "temperature unset for a deterministic task". That
+// advice is now actively wrong: temperature is REMOVED on Opus 5, Sonnet 5,
+// Opus 4.8/4.7 and Fable 5 - passing it returns a 400. The real defect is the
+// same one temperature was a poor proxy for: parsing free text as JSON and
+// hoping. Structured output is the fix that works on every current model.
+{ id: 'AIOP-020', run(repo, profile) {
+    if (!profile.calls_llm) return [];
+    const out = [];
+    for (const f of repo.files) {
+      const t = f.text; if (!t) continue;
+      const py = /\.py$/.test(f.path);
+      if (!py && !/\.(ts|tsx|js|jsx|mjs)$/.test(f.path)) continue;
+      // must be a real SDK call - "message" and "content" are not evidence
+      if (!/messages\.create|chat\.completions\.create|messages\.stream|messages\.parse|generateObject|generateText/.test(t)) continue;
+      // already constrained? then there is nothing to say
+      if (/output_config|response_format|output_format|strict\s*:\s*true|zodResponseFormat|messages\.parse|generateObject|tool_choice/.test(t)) continue;
+
+      const re = py ? /json\.loads\s*\(/g : /JSON\.parse\s*\(/g;
+      let m;
+      while ((m = re.exec(t))) {
+        const call = callAt(t, m.index, 160);
+        // the argument has to come off the model response, not off a file or a body
+        if (!/\.(?:content|text|output_text)\b|completion|choices\[/.test(call)) continue;
+        out.push(finding('AIOP-020', 'Model output parsed as JSON with nothing enforcing the shape', 'low',
+          f.path, lineOf(t, m.index),
+          'Nothing guarantees the reply is valid JSON. It usually is, which is worse than never — the failure arrives at random, in production, on the request you cannot reproduce.',
+          'Constrain the response instead of hoping: output_config.format with a schema, or a tool with strict: true. (Do not reach for temperature — it is removed on the current Claude models and returns a 400.)'));
+      }
+    }
+    return out;
+  }},
+
+// ── DEP-011 ─────────────────────────────────────────────────────────────────
+// The rule says "audit surfaces advisories at high or critical". We cannot run
+// an audit - that is execution and network, and the scanner does neither. What
+// IS statically true, and never goes stale, is whether anything at all would
+// tell you. Two ways to be blind: not knowing what you installed, or knowing
+// and having nobody watching it.
+{ id: 'DEP-011', scope: 'root', run(repo) {
+    // scope:'root' matters. The lockfile lives at the repo root and nowhere
+    // else; cal.com's yarn.lock is exactly where it belongs. Run per-workspace
+    // and this fires on every package in every monorepo - 133 times in the
+    // audit corpus, all of them wrong.
+    const hasManifest = repo.has(/(^|\/)package\.json$/);
+    if (!hasManifest) return [];
+    const LOCKS = /(^|\/)(package-lock\.json|yarn\.lock|pnpm-lock\.yaml|npm-shrinkwrap\.json|bun\.lockb?)$/;
+    if (!repo.has(LOCKS)) {
+      return [finding('DEP-011', 'No lockfile — you cannot tell what you deployed', 'high',
+        'package.json', 1,
+        'Without a lockfile each install resolves versions afresh, so the code on your server is not the code you tested, and when an advisory lands nobody can say whether it applies to you.',
+        'Commit the lockfile your package manager produces. It belongs in git.')];
+    }
+    const watched =
+      repo.has(/\.github\/dependabot\.ya?ml$/) ||
+      repo.has(/(^|\/)renovate\.json5?$/) ||
+      repo.has(/\.github\/renovate\.json5?$/) ||
+      repo.find(/\.github\/workflows\/.*\.ya?ml$/)
+        .some(f => /npm audit|pnpm audit|yarn audit|snyk|osv-scanner|trivy|dependency-review/i.test(f.text || ''));
+    if (watched) return [];
+    return [finding('DEP-011', 'Nothing watches your dependencies for advisories', 'high',
+      'package.json', 1,
+      'A vulnerability will be published in something you depend on. That is not a risk, it is a schedule. Right now there is no mechanism by which you would find out — not a mail, not a failing build, nothing.',
+      'Add .github/dependabot.yml, or Renovate, or a dependency-review step in CI. One file, and it tells you the day it happens.')];
+  }},
+];