laxy-verify 1.2.3 → 1.3.0

package/dist/security-audit.d.ts

@@ -1,17 +1,17 @@
-export interface SecurityAuditResult {
-    totalVulnerabilities: number;
-    critical: number;
-    high: number;
-    moderate: number;
-    low: number;
-    summary: string;
-    missingHeaders: string[];
-    headerCheckUrl?: string;
-    headerCheckError?: string;
-}
-export declare function auditSecurityHeaders(url: string): Promise<{
-    missingHeaders: string[];
-    checkedUrl: string;
-    error?: string;
-}>;
-export declare function runSecurityAudit(cwd: string, appUrl?: string, timeoutMs?: number): Promise<SecurityAuditResult>;
+export interface SecurityAuditResult {
+    totalVulnerabilities: number;
+    critical: number;
+    high: number;
+    moderate: number;
+    low: number;
+    summary: string;
+    missingHeaders: string[];
+    headerCheckUrl?: string;
+    headerCheckError?: string;
+}
+export declare function auditSecurityHeaders(url: string): Promise<{
+    missingHeaders: string[];
+    checkedUrl: string;
+    error?: string;
+}>;
+export declare function runSecurityAudit(cwd: string, appUrl?: string, timeoutMs?: number): Promise<SecurityAuditResult>;

package/dist/security-audit.js

@@ -1,127 +1,127 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.auditSecurityHeaders = auditSecurityHeaders;
-exports.runSecurityAudit = runSecurityAudit;
-/**
- * npm audit wrapper plus runtime security-header checks.
- *
- * The package audit catches known dependency vulnerabilities.
- * The header audit adds shallow runtime coverage for common missing
- * browser-enforced protections on the running app.
- */
-const node_child_process_1 = require("node:child_process");
-async function runNpmAudit(cwd, timeoutMs) {
-    return new Promise((resolve) => {
-        const chunks = [];
-        const proc = process.platform === "win32"
-            ? (0, node_child_process_1.spawn)(process.env.ComSpec || "cmd.exe", ["/d", "/c", "npm audit --json"], {
-                stdio: ["ignore", "pipe", "pipe"],
-                cwd,
-            })
-            : (0, node_child_process_1.spawn)("npm", ["audit", "--json"], {
-                shell: true,
-                stdio: ["ignore", "pipe", "pipe"],
-                cwd,
-            });
-        const timer = setTimeout(() => {
-            try {
-                proc.kill();
-            }
-            catch { }
-            resolve({ totalVulnerabilities: 0, critical: 0, high: 0, moderate: 0, low: 0 });
-        }, timeoutMs);
-        proc.stdout?.on("data", (chunk) => chunks.push(chunk.toString()));
-        proc.stderr?.on("data", () => { });
-        proc.on("exit", () => {
-            clearTimeout(timer);
-            try {
-                const json = JSON.parse(chunks.join(""));
-                const meta = json.metadata?.vulnerabilities ?? json.vulnerabilities ?? {};
-                const critical = meta.critical ?? 0;
-                const high = meta.high ?? 0;
-                const moderate = meta.moderate ?? 0;
-                const low = meta.low ?? 0;
-                resolve({
-                    totalVulnerabilities: critical + high + moderate + low,
-                    critical,
-                    high,
-                    moderate,
-                    low,
-                });
-            }
-            catch {
-                resolve({ totalVulnerabilities: 0, critical: 0, high: 0, moderate: 0, low: 0 });
-            }
-        });
-    });
-}
-async function auditSecurityHeaders(url) {
-    const requiredHeaders = ["X-Frame-Options", "Content-Security-Policy"];
-    const urlObj = new URL(url);
-    if (urlObj.protocol === "https:") {
-        requiredHeaders.push("Strict-Transport-Security");
-    }
-    let response;
-    try {
-        response = await fetch(url, {
-            method: "HEAD",
-            redirect: "follow",
-            signal: AbortSignal.timeout(5000),
-        });
-    }
-    catch {
-        try {
-            response = await fetch(url, {
-                method: "GET",
-                redirect: "follow",
-                signal: AbortSignal.timeout(5000),
-            });
-        }
-        catch (error) {
-            return {
-                missingHeaders: [],
-                checkedUrl: url,
-                error: error instanceof Error ? error.message : String(error),
-            };
-        }
-    }
-    const missingHeaders = requiredHeaders.filter((headerName) => !response.headers.get(headerName));
-    return {
-        missingHeaders,
-        checkedUrl: response.url || url,
-    };
-}
-async function runSecurityAudit(cwd, appUrl, timeoutMs = 30000) {
-    console.log("  Running security audit (npm audit + runtime headers)...");
-    const [npmAudit, headerAudit] = await Promise.all([
-        runNpmAudit(cwd, timeoutMs),
-        appUrl ? auditSecurityHeaders(appUrl) : Promise.resolve(null),
-    ]);
-    const parts = [];
-    if (npmAudit.critical > 0)
-        parts.push(`${npmAudit.critical} critical`);
-    if (npmAudit.high > 0)
-        parts.push(`${npmAudit.high} high`);
-    if (npmAudit.moderate > 0)
-        parts.push(`${npmAudit.moderate} moderate`);
-    if (npmAudit.low > 0)
-        parts.push(`${npmAudit.low} low`);
-    const missingHeaders = headerAudit?.missingHeaders ?? [];
-    if (missingHeaders.length > 0) {
-        parts.push(`missing headers: ${missingHeaders.join(", ")}`);
-    }
-    if (headerAudit?.error) {
-        parts.push(`header check skipped: ${headerAudit.error}`);
-    }
-    const summary = parts.length > 0
-        ? parts.join(" | ")
-        : "No known vulnerabilities or missing security headers";
-    console.log(`  Security: ${summary}`);
-    return {
-        ...npmAudit,
-        summary,
-        missingHeaders,
-        headerCheckUrl: headerAudit?.checkedUrl,
-        headerCheckError: headerAudit?.error,
-    };
-}
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.auditSecurityHeaders = auditSecurityHeaders;
+exports.runSecurityAudit = runSecurityAudit;
+/**
+ * npm audit wrapper plus runtime security-header checks.
+ *
+ * The package audit catches known dependency vulnerabilities.
+ * The header audit adds shallow runtime coverage for common missing
+ * browser-enforced protections on the running app.
+ */
+const node_child_process_1 = require("node:child_process");
+async function runNpmAudit(cwd, timeoutMs) {
+    return new Promise((resolve) => {
+        const chunks = [];
+        const proc = process.platform === "win32"
+            ? (0, node_child_process_1.spawn)(process.env.ComSpec || "cmd.exe", ["/d", "/c", "npm audit --json"], {
+                stdio: ["ignore", "pipe", "pipe"],
+                cwd,
+            })
+            : (0, node_child_process_1.spawn)("npm", ["audit", "--json"], {
+                shell: true,
+                stdio: ["ignore", "pipe", "pipe"],
+                cwd,
+            });
+        const timer = setTimeout(() => {
+            try {
+                proc.kill();
+            }
+            catch { }
+            resolve({ totalVulnerabilities: 0, critical: 0, high: 0, moderate: 0, low: 0 });
+        }, timeoutMs);
+        proc.stdout?.on("data", (chunk) => chunks.push(chunk.toString()));
+        proc.stderr?.on("data", () => { });
+        proc.on("exit", () => {
+            clearTimeout(timer);
+            try {
+                const json = JSON.parse(chunks.join(""));
+                const meta = json.metadata?.vulnerabilities ?? json.vulnerabilities ?? {};
+                const critical = meta.critical ?? 0;
+                const high = meta.high ?? 0;
+                const moderate = meta.moderate ?? 0;
+                const low = meta.low ?? 0;
+                resolve({
+                    totalVulnerabilities: critical + high + moderate + low,
+                    critical,
+                    high,
+                    moderate,
+                    low,
+                });
+            }
+            catch {
+                resolve({ totalVulnerabilities: 0, critical: 0, high: 0, moderate: 0, low: 0 });
+            }
+        });
+    });
+}
+async function auditSecurityHeaders(url) {
+    const requiredHeaders = ["X-Frame-Options", "Content-Security-Policy"];
+    const urlObj = new URL(url);
+    if (urlObj.protocol === "https:") {
+        requiredHeaders.push("Strict-Transport-Security");
+    }
+    let response;
+    try {
+        response = await fetch(url, {
+            method: "HEAD",
+            redirect: "follow",
+            signal: AbortSignal.timeout(5000),
+        });
+    }
+    catch {
+        try {
+            response = await fetch(url, {
+                method: "GET",
+                redirect: "follow",
+                signal: AbortSignal.timeout(5000),
+            });
+        }
+        catch (error) {
+            return {
+                missingHeaders: [],
+                checkedUrl: url,
+                error: error instanceof Error ? error.message : String(error),
+            };
+        }
+    }
+    const missingHeaders = requiredHeaders.filter((headerName) => !response.headers.get(headerName));
+    return {
+        missingHeaders,
+        checkedUrl: response.url || url,
+    };
+}
+async function runSecurityAudit(cwd, appUrl, timeoutMs = 30000) {
+    console.log("  Running security audit (npm audit + runtime headers)...");
+    const [npmAudit, headerAudit] = await Promise.all([
+        runNpmAudit(cwd, timeoutMs),
+        appUrl ? auditSecurityHeaders(appUrl) : Promise.resolve(null),
+    ]);
+    const parts = [];
+    if (npmAudit.critical > 0)
+        parts.push(`${npmAudit.critical} critical`);
+    if (npmAudit.high > 0)
+        parts.push(`${npmAudit.high} high`);
+    if (npmAudit.moderate > 0)
+        parts.push(`${npmAudit.moderate} moderate`);
+    if (npmAudit.low > 0)
+        parts.push(`${npmAudit.low} low`);
+    const missingHeaders = headerAudit?.missingHeaders ?? [];
+    if (missingHeaders.length > 0) {
+        parts.push(`missing headers: ${missingHeaders.join(", ")}`);
+    }
+    if (headerAudit?.error) {
+        parts.push(`header check skipped: ${headerAudit.error}`);
+    }
+    const summary = parts.length > 0
+        ? parts.join(" | ")
+        : "No known vulnerabilities or missing security headers";
+    console.log(`  Security: ${summary}`);
+    return {
+        ...npmAudit,
+        summary,
+        missingHeaders,
+        headerCheckUrl: headerAudit?.checkedUrl,
+        headerCheckError: headerAudit?.error,
+    };
+}